diff --git a/.acrolinx-config.edn b/.acrolinx-config.edn new file mode 100644 index 0000000000..db312c63cd --- /dev/null +++ b/.acrolinx-config.edn @@ -0,0 +1,38 @@ +{:allowed-branchname-matches ["master"] + :allowed-filename-matches ["windows/"] + :acrolinx-check-settings + { + "languageId" "en" + "ruleSetName" "Standard Commercial" + "requestedFlagTypes" ["SPELLING" "GRAMMAR" "STYLE" + "TERMINOLOGY_DEPRECATED" + "TERMINOLOGY_VALID" + "VOICE_GUIDANCE" + ] + "termSetNames" ["M365"] + } + + :template-header + + " +## Acrolinx Scorecards + +**A minimum Acrolinx score of 20 is required.** + +Click the scorecard links for each article to review the Acrolinx feedback on grammar, spelling, punctuation, writing style, and terminology: + +| Article | Score | Issues | Scorecard | Processed | +| ------- | ----- | ------ | --------- | --------- | +" + + :template-change + "| ${s/file} | ${acrolinx/qualityscore} | ${acrolinx/flags/issues} | [link](${acrolinx/scorecard}) | ${s/status} | +" + + :template-footer + " +**More info about Acrolinx** + +You are helping M365 test Acrolinx while we merge to the Microsoft instance. We have set the minimum score to 20 to test that the minimum score script works. This is effectively *not* setting a minimum score. If you need to bypass this score, please contact krowley or go directly to the marveldocs-admins. Thanks for your patience while we continue with roll out! +" +} diff --git a/.gitignore b/.gitignore index f774b7e22a..4d2ce285a9 100644 --- a/.gitignore +++ b/.gitignore @@ -5,7 +5,8 @@ obj/ _site/ Tools/NuGet/ .optemp/ - +Thumbs.db +.DS_Store .openpublishing.build.mdproj .openpublishing.buildcore.ps1 diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 70cc3d7d3b..2ffc227a40 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -1,561 +1,484 @@ -{ - "build_entry_point": "", - "docsets_to_publish": [ - { - "docset_name": "bcs-VSTS", - "build_source_folder": "bcs", - "build_output_subfolder": "bcs-VSTS", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": false, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, - { - "docset_name": "education-VSTS", - "build_source_folder": "education", - "build_output_subfolder": "education-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "eula-vsts", - "build_source_folder": "windows/eulas", - "build_output_subfolder": "eula-vsts", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": false, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, - { - "docset_name": "gdpr", - "build_source_folder": "gdpr", - "build_output_subfolder": "gdpr", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": false, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, - { - "docset_name": "internet-explorer-VSTS", - "build_source_folder": "browsers/internet-explorer", - "build_output_subfolder": "internet-explorer-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "itpro-hololens-VSTS", - "build_source_folder": "devices/hololens", - "build_output_subfolder": "itpro-hololens-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "keep-secure-VSTS", - "build_source_folder": "windows/keep-secure", - "build_output_subfolder": "keep-secure-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "known-issues", - "build_source_folder": "windows/known-issues", - "build_output_subfolder": "known-issues", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": false, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, - { - "docset_name": "mdop-VSTS", - "build_source_folder": "mdop", - "build_output_subfolder": "mdop-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "microsoft-edge-VSTS", - "build_source_folder": "browsers/edge", - "build_output_subfolder": "microsoft-edge-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "privacy", - "build_source_folder": "windows/privacy", - "build_output_subfolder": "privacy", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, - { - "docset_name": "security", - "build_source_folder": "windows/security", - "build_output_subfolder": "security", - "locale": "en-us", - "monikers": [], - "moniker_ranges": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content", - "LandingData": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes" - }, - { - "docset_name": "smb-VSTS", - "build_source_folder": "smb", - "build_output_subfolder": "smb-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "store-for-business-VSTS", - "build_source_folder": "store-for-business", - "build_output_subfolder": "store-for-business-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "surface-hub-VSTS", - "build_source_folder": "devices/surface-hub", - "build_output_subfolder": "surface-hub-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "surface-VSTS", - "build_source_folder": "devices/surface", - "build_output_subfolder": "surface-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "win-access-protection-VSTS", - "build_source_folder": "windows/access-protection", - "build_output_subfolder": "win-access-protection-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "win-app-management-VSTS", - "build_source_folder": "windows/application-management", - "build_output_subfolder": "win-app-management-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "win-client-management-VSTS", - "build_source_folder": "windows/client-management", - "build_output_subfolder": "win-client-management-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "win-configuration-VSTS", - "build_source_folder": "windows/configuration", - "build_output_subfolder": "win-configuration-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "win-development-VSTS", - "build_source_folder": "windows/deployment", - "build_output_subfolder": "win-development-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "win-device-security-VSTS", - "build_source_folder": "windows/device-security", - "build_output_subfolder": "win-device-security-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "windows-configure-VSTS", - "build_source_folder": "windows/configure", - "build_output_subfolder": "windows-configure-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "windows-deploy-VSTS", - "build_source_folder": "windows/deploy", - "build_output_subfolder": "windows-deploy-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "windows-hub-VSTS", - "build_source_folder": "windows/hub", - "build_output_subfolder": "windows-hub-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "windows-manage-VSTS", - "build_source_folder": "windows/manage", - "build_output_subfolder": "windows-manage-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "windows-plan-VSTS", - "build_source_folder": "windows/plan", - "build_output_subfolder": "windows-plan-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "windows-update-VSTS", - "build_source_folder": "windows/update", - "build_output_subfolder": "windows-update-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "win-threat-protection-VSTS", - "build_source_folder": "windows/threat-protection", - "build_output_subfolder": "win-threat-protection-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - }, - { - "docset_name": "win-whats-new-VSTS", - "build_source_folder": "windows/whats-new", - "build_output_subfolder": "win-whats-new-VSTS", - "locale": "en-us", - "monikers": [], - "open_to_public_contributors": true, - "type_mapping": { - "Conceptual": "Content", - "ManagedReference": "Content", - "RestApi": "Content" - }, - "build_entry_point": "docs", - "template_folder": "_themes", - "moniker_groups": [], - "version": 0 - } - ], - "notification_subscribers": [ - "elizapo@microsoft.com" - ], - "sync_notification_subscribers": [ - "daniha@microsoft.com" - ], - "branches_to_filter": [ - "" - ], - "git_repository_url_open_to_public_contributors": "https://github.com/MicrosoftDocs/windows-itpro-docs", - "git_repository_branch_open_to_public_contributors": "master", - "skip_source_output_uploading": false, - "need_preview_pull_request": true, - "resolve_user_profile_using_github": true, - "contribution_branch_mappings": {}, - "dependent_repositories": [ - { - "path_to_root": "_themes.pdf", - "url": "https://github.com/Microsoft/templates.docs.msft.pdf", - "branch": "master", - "branch_mapping": {} - }, - { - "path_to_root": "_themes", - "url": "https://github.com/Microsoft/templates.docs.msft", - "branch": "master", - "branch_mapping": {} - } - ], - "branch_target_mapping": { - "live": [ - "Publish", - "Pdf" - ], - "master": [ - "Publish", - "Pdf" - ], - "atp-api-danm": [ - "Publish", - "Pdf" - ] - }, - "need_generate_pdf_url_template": true, - "targets": { - "Pdf": { - "template_folder": "_themes.pdf" - } - }, - "need_generate_pdf": false, - "need_generate_intellisense": false -} \ No newline at end of file +{ + "build_entry_point": "", + "docsets_to_publish": [ + { + "docset_name": "education", + "build_source_folder": "education", + "build_output_subfolder": "education", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "hololens", + "build_source_folder": "devices/hololens", + "build_output_subfolder": "hololens", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "internet-explorer", + "build_source_folder": "browsers/internet-explorer", + "build_output_subfolder": "internet-explorer", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "keep-secure", + "build_source_folder": "windows/keep-secure", + "build_output_subfolder": "keep-secure", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "mdop", + "build_source_folder": "mdop", + "build_output_subfolder": "mdop", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "microsoft-edge", + "build_source_folder": "browsers/edge", + "build_output_subfolder": "microsoft-edge", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "release-information", + "build_source_folder": "windows/release-information", + "build_output_subfolder": "release-information", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "smb", + "build_source_folder": "smb", + "build_output_subfolder": "smb", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "store-for-business", + "build_source_folder": "store-for-business", + "build_output_subfolder": "store-for-business", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "surface", + "build_source_folder": "devices/surface", + "build_output_subfolder": "surface", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "surface-hub", + "build_source_folder": "devices/surface-hub", + "build_output_subfolder": "surface-hub", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "win-access-protection", + "build_source_folder": "windows/access-protection", + "build_output_subfolder": "win-access-protection", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "win-app-management", + "build_source_folder": "windows/application-management", + "build_output_subfolder": "win-app-management", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "win-client-management", + "build_source_folder": "windows/client-management", + "build_output_subfolder": "win-client-management", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "win-configuration", + "build_source_folder": "windows/configuration", + "build_output_subfolder": "win-configuration", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "win-deployment", + "build_source_folder": "windows/deployment", + "build_output_subfolder": "win-deployment", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "win-device-security", + "build_source_folder": "windows/device-security", + "build_output_subfolder": "win-device-security", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "windows-configure", + "build_source_folder": "windows/configure", + "build_output_subfolder": "windows-configure", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "windows-deploy", + "build_source_folder": "windows/deploy", + "build_output_subfolder": "windows-deploy", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "windows-hub", + "build_source_folder": "windows/hub", + "build_output_subfolder": "windows-hub", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "windows-manage", + "build_source_folder": "windows/manage", + "build_output_subfolder": "windows-manage", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "windows-plan", + "build_source_folder": "windows/plan", + "build_output_subfolder": "windows-plan", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "windows-privacy", + "build_source_folder": "windows/privacy", + "build_output_subfolder": "windows-privacy", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "windows-security", + "build_source_folder": "windows/security", + "build_output_subfolder": "windows-security", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "windows-update", + "build_source_folder": "windows/update", + "build_output_subfolder": "windows-update", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "win-threat-protection", + "build_source_folder": "windows/threat-protection", + "build_output_subfolder": "win-threat-protection", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, + { + "docset_name": "win-whats-new", + "build_source_folder": "windows/whats-new", + "build_output_subfolder": "win-whats-new", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": true, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + } + ], + "notification_subscribers": [ + "elizapo@microsoft.com" + ], + "sync_notification_subscribers": [ + "daniha@microsoft.com" + ], + "branches_to_filter": [ + "" + ], + "git_repository_url_open_to_public_contributors": "https://github.com/MicrosoftDocs/windows-itpro-docs", + "git_repository_branch_open_to_public_contributors": "public", + "skip_source_output_uploading": false, + "need_preview_pull_request": true, + "resolve_user_profile_using_github": true, + "contribution_branch_mappings": {}, + "dependent_repositories": [ + { + "path_to_root": "_themes.pdf", + "url": "https://github.com/Microsoft/templates.docs.msft.pdf", + "branch": "master", + "branch_mapping": {} + }, + { + "path_to_root": "_themes", + "url": "https://github.com/Microsoft/templates.docs.msft", + "branch": "master", + "branch_mapping": {} + } + ], + "branch_target_mapping": { + "live": [ + "Publish", + "Pdf" + ], + "master": [ + "Publish", + "Pdf" + ] + }, + "need_generate_pdf_url_template": true, + "targets": { + "Pdf": { + "template_folder": "_themes.pdf" + } + }, + "need_generate_pdf": false, + "need_generate_intellisense": false +} diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index ab677cc666..b0c5c1a8d2 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1,38 +1,98 @@ { "redirections": [ { -"source_path": "windows/application-management/msix-app-packaging-tool-walkthrough.md", -"redirect_url": "https://docs.microsoft.com/windows/msix/mpt-overview", +"source_path": "devices/hololens/hololens-upgrade-enterprise.md", +"redirect_url": "https://docs.microsoft.com/hololens/hololens-requirements#upgrade-to-windows-holographic-for-business", "redirect_document_id": true }, { +"source_path": "devices/hololens/hololens-install-localized.md", +"redirect_url": "https://docs.microsoft.com/hololens/hololens1-install-localized", +"redirect_document_id": false +}, +{ +"source_path": "devices/hololens/hololens-install-apps.md", +"redirect_url": "https://docs.microsoft.com/hololens/holographic-store-apps", +"redirect_document_id": false +}, +{ +"source_path": "devices/hololens/hololens-setup.md", +"redirect_url": "https://docs.microsoft.com/hololens/hololens1-setup", +"redirect_document_id": true +}, +{ +"source_path": "devices/hololens/hololens-use-apps.md", +"redirect_url": "https://docs.microsoft.com/hololens/holographic-home#using-apps-on-hololens", +"redirect_document_id": true +}, +{ +"source_path": "devices/hololens/hololens-get-apps.md", +"redirect_url": "https://docs.microsoft.com/hololens/holographic-store-apps", +"redirect_document_id": true +}, +{ +"source_path": "devices/hololens/hololens-spaces-on-hololens.md", +"redirect_url": "https://docs.microsoft.com/hololens/hololens-spaces", +"redirect_document_id": true +}, +{ +"source_path": "devices/hololens/hololens-clicker.md", +"redirect_url": "https://docs.microsoft.com/hololens/hololens1-clicker", +"redirect_document_id": true +}, +{ +"source_path": "devices/hololens/hololens-clicker-restart-recover.md", +"redirect_url": "https://docs.microsoft.com/hololens/hololens1-clicker#restart-or-recover-the-clicker", +"redirect_document_id": false +}, +{ + "source_path": "devices/hololens/hololens-find-and-save-files.md", + "redirect_url": "https://docs.microsoft.com/hololens/holographic-data", + "redirect_document_id": false +}, +{ + "source_path": "devices/hololens/hololens-management-overview.md", + "redirect_url": "https://docs.microsoft.com/hololens", + "redirect_document_id": false +}, +{ +"source_path": "devices/surface/manage-surface-pro-3-firmware-updates.md", +"redirect_url": "https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates", +"redirect_document_id": false +}, +{ +"source_path": "devices/surface/update.md", +"redirect_url": "https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates", +"redirect_document_id": false +}, +{ "source_path": "windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations", "redirect_document_id": true }, { "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", "redirect_document_id": true }, { "source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", "redirect_document_id": false }, { "source_path": "windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", +"redirect_document_id": false }, { "source_path": "windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-containers-help-protect-windows", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-containers-help-protect-windows", "redirect_document_id": true }, { @@ -42,7 +102,7 @@ }, { "source_path": "windows/deployment/update/windows-update-sources.md", -"redirect_url": "/windows/deployment/update/how-windows-update-works", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/how-windows-update-works", "redirect_document_id": true }, { @@ -62,27 +122,27 @@ }, { "source_path": "windows/security/threat-protection/intelligence/av-tests.md", -"redirect_url": "/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests", "redirect_document_id": true }, { "source_path": "windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-countermeasures", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", "redirect_document_id": true }, { "source_path": "windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-countermeasures", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", "redirect_document_id": false }, { "source_path": "windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-countermeasures", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/intelligence/transparency-report.md", -"redirect_url": "/windows/security/threat-protection/intelligence/av-tests", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/intelligence/av-tests", "redirect_document_id": true }, { @@ -97,5132 +157,5973 @@ }, { "source_path": "windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/how-hardware-based-containers-help-protect-windows", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows.md", -"redirect_url": "/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/encrypted-hard-drive.md", -"redirect_url": "/windows/security/information-protection/encrypted-hard-drive", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/encrypted-hard-drive", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/secure-the-windows-10-boot-process.md", -"redirect_url": "/windows/security/information-protection/secure-the-windows-10-boot-process", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/secure-the-windows-10-boot-process", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md", -"redirect_url": "/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/tpm/change-the-tpm-owner-password.md", -"redirect_url": "/windows/security/information-protection/tpm/change-the-tpm-owner-password", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/change-the-tpm-owner-password", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/tpm/how-windows-uses-the-tpm.md", -"redirect_url": "/windows/security/information-protection/tpm/how-windows-uses-the-tpm", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/how-windows-uses-the-tpm", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md", -"redirect_url": "/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/tpm/manage-tpm-commands.md", -"redirect_url": "/windows/security/information-protection/tpm/manage-tpm-commands", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/manage-tpm-commands", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/tpm/manage-tpm-lockout.md", -"redirect_url": "/windows/security/information-protection/tpm/manage-tpm-lockout", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/manage-tpm-lockout", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md", -"redirect_url": "/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/tpm/tpm-fundamentals.md", -"redirect_url": "/windows/security/information-protection/tpm/tpm-fundamentals", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-fundamentals", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/tpm/tpm-recommendations.md", -"redirect_url": "/windows/security/information-protection/tpm/tpm-recommendations", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-recommendations", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-overview.md", -"redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-overview", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-overview", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md", -"redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings", "redirect_document_id": true }, { "source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-top-node.md", -"redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-top-node", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-top-node", "redirect_document_id": true }, { "source_path": "windows/deployment/update/waas-windows-insider-for-business.md", -"redirect_url": "/windows-insider/at-work-pro/wip-4-biz-get-started", +"redirect_url": "https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-get-started", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/device-guard/device-guard-deployment-guide.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-application-control/create-your-windows-defender-application-control-planning-document.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-application-control/document-your-windows-defender-application-control-management-processes.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-application-control/windows-defender-device-guard-and-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control", +"redirect_document_id": false +}, +{ "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/smbv1-microsoft-network-client-digitally-sign-communications-if-server-agrees", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agress.md", -"redirect_url": "/windows/security/threat-protectionsecurity-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protectionsecurity-policy-settings/smbv1-microsoft-network-server-digitally-sign-communications-if-client-agrees", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create", +"redirect_document_id": false +}, +{ "source_path": "windows/security/threat-protection/applocker/administer-applocker-using-mdm.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker-using-mdm", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker-using-mdm", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/administer-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/applocker-architecture-and-components.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/applocker-functions.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/applocker-overview.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/applocker-policies-deployment-guide.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/applocker-policies-design-guide.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/applocker-policy-use-scenarios.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/applocker-processes-and-interactions.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/applocker-settings.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/applocker-technical-reference.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/configure-an-applocker-policy-for-audit-only.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/configure-an-applocker-policy-for-enforce-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/configure-exceptions-for-an-applocker-rule.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/configure-the-application-identity-service.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/configure-the-appLocker-reference-device.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/create-a-rule-for-packaged-apps.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-file-hash-condition.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-path-condition.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/create-a-rule-that-uses-a-publisher-condition.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/create-applocker-default-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/create-list-of-applications-deployed-to-each-business-group.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/create-your-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/create-your-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/delete-an-applocker-rule.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/deploy-the-applocker-policy-into-production.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/determine-group-policy-structure-and-rule-enforcement.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/determine-your-application-control-objectives.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/dll-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/document-your-application-list.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/document-your-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/edit-an-applocker-policy.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/edit-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/enable-the-dll-rule-collection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/enforce-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules", +"redirect_document_id": false }, { "source_path": "windows/security/threat-protection/applocker/executable-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/export-an-applocker-policy-from-a-gpo.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/export-an-applocker-policy-to-an-xml-file.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/how-applocker-works-techref.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/import-an-applocker-policy-from-another-computer.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/import-an-applocker-policy-into-a-gpo.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/maintain-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/manage-packaged-apps-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/merge-applocker-policies-manually.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/monitor-application-usage-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/optimize-applocker-performance.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/plan-for-applocker-policy-management.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/refresh-an-applocker-policy.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/requirements-for-deploying-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/requirements-to-use-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/run-the-automatically-generate-rules-wizard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/script-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/security-considerations-for-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/select-types-of-rules-to-create.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/test-and-update-an-applocker-policy.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/tools-to-use-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understand-applocker-enforcement-settings.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understand-applocker-policy-design-decisions.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understand-the-applocker-policy-deployment-process.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understanding-applocker-default-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-behavior.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-collections.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-condition-types.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understanding-applocker-rule-exceptions.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understanding-the-file-hash-rule-condition-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understanding-the-path-rule-condition-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/understanding-the-publisher-rule-condition-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker", +"redirect_document_id": false }, { "source_path": "windows/security/threat-protection/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/use-the-applocker-windows-powershell-cmdlets.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/using-event-viewer-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/using-software-restriction-policies-and-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/what-is-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/windows-installer-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/working-with-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/applocker/working-with-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/device-guard/steps-to-deploy-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/device-guard/deploy-managed-installer-for-device-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-managed-installer", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/device-guard/device-guard-deployment-enable-virtualization-based-security.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/enable-virtualization-based-security", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/enable-virtualization-based-security", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-family-options.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-hide-notifications.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-hide-notifications", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-security-center/windows-defender-security-center.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/customize-controlled-folders-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/customize-exploit-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/customize-exploit-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/microsoft-defender-atp/customize-exploit-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/emet-exploit-protection-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/emet-exploit-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-attack-surface-reduction", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-controlled-folders", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-exploit-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/enable-exploit-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/enable-network-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-attack-surface-reduction", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-controlled-folder-access", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-exploit-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-network-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-network-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-network-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-windows-defender-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-exploit-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/event-views", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/graphics.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/graphics", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", +"redirect_document_id": false }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/import-export-exploit-protection-emet-xml", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/network-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/prerelease.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/prerelease", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prerelease", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-exploit-protection-mitigations", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-exploit-protection-mitigations", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/troubleshoot-np.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-np", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-np", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", +"redirect_document_id": false +}, +{ +"source_path": "windows/keep-secure/advanced-features-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-best-practices", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-language", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/overview-hunting.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-reference.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-schema-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-alertevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicefileevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-imageloadevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-logonevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicelogonevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machineinfo-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceinfo-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-machinenetworkinfo-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-miscevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-networkcommunicationevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicenetworkevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-processcreationevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceprocessevents-table", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-registryevents-table.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-deviceregistryevents-table", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts-queue", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/alerts-queue-endpoint-detection-response.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts-queue-endpoint-detection-response", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/apis-intro.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/apis-intro", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/api-hello-world.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/api-hello-world", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/assign-portal-access", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-simulations", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/basic-permissions-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/check-sensor-status", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/community-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/community", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/conditional-access", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-arcsight", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-and-manage-tvm.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-and-manage-tvm", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/tvm-dashboard-insights.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-attack-surface-reduction.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-attack-surface-reduction", +"redirect_document_id": true +}, + +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configuration-score.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-conditional-access-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-conditional-access", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection", +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications", "redirect_document_id": true }, { -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection", +"source_path": "windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection", -"redirect_document_id": true +"source_path": "windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", +"redirect_document_id": false }, { -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection", +"source_path": "windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-gp", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-mdm", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-non-windows", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-script", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-mssp-support-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-mssp-support", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-siem", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-splunk", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { -"source_path": "windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection", +"source_path": "windows/security/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-ti-api", "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/microsoft-defender-atp/custom-ti-api.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/custom-detection-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/custom-detection-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/data-retention-settings", +"redirect_document_id": true +}, +{ "source_path": "windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/defender-compatibility", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/deprecate.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/deprecate", "redirect_document_id": true }, { "source_path": "windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { -"source_path": "windows/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection", +"source_path": "windows/security/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti", "redirect_document_id": true }, { -"source_path": "windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/prerelease.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/prerelease", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/install-wd-app-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-offline.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/block-untrusted-fonts-in-enterprise.md", -"redirect_url": "/windows/security/threat-protection/block-untrusted-fonts-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/change-history-for-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/change-history-for-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/override-mitigation-options-for-app-related-security-policies.md", -"redirect_url": "/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/overview-of-threat-mitigations-in-windows-10.md", -"redirect_url": "/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md", -"redirect_url": "/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md", -"redirect_url": "/windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/access-this-computer-from-the-network.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/account-lockout-duration.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/account-lockout-duration", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/account-lockout-policy.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/account-lockout-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/account-lockout-threshold.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/account-lockout-threshold", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/account-policies.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/account-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-administrator-account-status.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-guest-account-status.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-rename-administrator-account.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/accounts-rename-guest-account.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/act-as-part-of-the-operating-system.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/add-workstations-to-domain.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/administer-security-policy-settings.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/allow-log-on-locally.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/allow-log-on-locally", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-policy.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/audit-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/back-up-files-and-directories.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/bypass-traverse-checking.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/change-the-system-time.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/change-the-system-time", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/change-the-time-zone.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/change-the-time-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-a-pagefile.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/create-a-pagefile", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-a-token-object.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/create-a-token-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-global-objects.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/create-global-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-permanent-shared-objects.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/create-symbolic-links.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/create-symbolic-links", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/debug-programs.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/debug-programs", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-log-on-as-a-service.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-log-on-locally.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/deny-log-on-locally", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/enforce-password-history.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/enforce-password-history", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/enforce-user-logon-restrictions.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/generate-security-audits.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/generate-security-audits", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/how-to-configure-security-policy-settings.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/impersonate-a-client-after-authentication.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/increase-a-process-working-set.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/increase-scheduling-priority.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-require-smart-card.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/kerberos-policy.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/kerberos-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/load-and-unload-device-drivers.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/lock-pages-in-memory.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/log-on-as-a-batch-job.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/log-on-as-a-service.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/log-on-as-a-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/manage-auditing-and-security-log.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-password-age.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/maximum-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/minimum-password-age.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/minimum-password-age", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/minimum-password-length.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/minimum-password-length", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/modify-an-object-label.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/modify-an-object-label", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/modify-firmware-environment-values.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-list-manager-policies.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-list-manager-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/password-must-meet-complexity-requirements.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/password-policy.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/password-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/perform-volume-maintenance-tasks.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/profile-single-process.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/profile-single-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/profile-system-performance.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/profile-system-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/remove-computer-from-docking-station.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/replace-a-process-level-token.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/reset-account-lockout-counter-after.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/restore-files-and-directories.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/restore-files-and-directories", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/security-options.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/security-options", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/security-policy-settings-reference.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/security-policy-settings.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/shut-down-the-system.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/shut-down-the-system", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/synchronize-directory-service-data.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-settings-optional-subsystems.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-policy-settings/user-rights-assignment.md", -"redirect_url": "/windows/security/threat-protection/security-policy-settings/user-rights-assignment", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/device-guard/deploy-catalog-files-to-support-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md", -"redirect_url": "/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md", -"redirect_url": "/windows/security/threat-protection/device-guard/deploy-managed-installer-for-device-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md", -"redirect_url": "/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/device-guard-deployment-guide.md", -"redirect_url": "/windows/security/threat-protection/device-guard/device-guard-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md", -"redirect_url": "/windows/security/threat-protection/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/steps-to-deploy-windows-defender-application-control.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/advanced-security-audit-policy-settings.md", -"redirect_url": "/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/advanced-security-auditing-faq.md", -"redirect_url": "/windows/security/threat-protection/auditing/advanced-security-auditing.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-account-lockout.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-application-generated.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-application-group-management.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-audit-policy-change.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-authentication-policy-change.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-authorization-policy-change.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-central-access-policy-staging.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-certification-services.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-computer-account-management.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-credential-validation.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-detailed-directory-service-replication.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-detailed-file-share.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-directory-service-access.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-directory-service-changes.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-directory-service-replication.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-distribution-group-management.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-dpapi-activity.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-file-share.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-file-system.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-filtering-platform-packet-drop.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-group-membership.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-handle-manipulation.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-ipsec-driver.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-ipsec-main-mode.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-kerberos-authentication-service.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-kernel-object.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-logoff.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-logon.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-network-policy-server.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-other-account-logon-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-other-account-management-events.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-other-logonlogoff-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-other-object-access-events.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-other-policy-change-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-other-system-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-pnp-activity.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-process-creation.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-process-termination.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-registry.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-removable-storage.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-rpc-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-sam.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-security-group-management.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-security-state-change.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-security-system-extension.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-special-logon.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-system-integrity.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/audit-user-account-management.md", -"redirect_url": "/windows/security/threat-protection/auditing/audit-user-device-claims.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-account-logon-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/basic-audit-account-management.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-directory-service-access.md", -"redirect_url": "/windows/security/threat-protection/auditing/basic-audit-logon-events.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-object-access.md", -"redirect_url": "/windows/security/threat-protection/auditing/basic-audit-policy-change.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-privilege-use.md", -"redirect_url": "/windows/security/threat-protection/auditing/basic-audit-process-tracking.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-audit-system-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/basic-security-audit-policies.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/basic-security-audit-policy-settings.md", -"redirect_url": "/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-1100.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-1102.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-1104.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-1105.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-1108.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4608.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4610.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4611.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4612.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4614.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4615.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4616.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4618.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4621.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4622.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4624.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4625.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4626.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4627.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4634.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4647.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4648.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4649.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4656.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4657.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4658.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4660.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4661.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4662.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4663.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4664.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4670.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4671.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4672.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4673.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4674.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4675.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4688.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4689.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4690.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4691.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4692.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4693.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4694.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4695.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4696.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4697.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4698.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4699.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4700.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4701.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4702.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4703.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4704.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4705.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4706.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4707.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4713.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4714.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4715.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4716.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4717.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4718.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4719.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4720.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4722.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4723.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4724.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4725.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4726.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4731.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4732.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4733.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4734.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4735.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4738.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4739.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4740.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4741.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4742.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4743.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4749.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4750.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4751.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4752.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4753.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4764.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4765.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4766.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4767.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4768.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4769.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4770.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4771.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4772.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4773.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4774.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4775.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4776.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4777.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4778.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4779.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4780.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4781.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4782.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4793.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4794.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4798.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4799.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4800.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4801.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4802.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4803.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4816.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4817.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4818.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4819.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4826.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4864.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4865.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4866.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4867.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4902.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4904.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4905.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4906.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4907.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4908.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4909.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4910.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4911.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4912.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4913.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4928.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4929.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4930.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4931.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4932.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4933.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4934.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4935.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4936.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4937.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4944.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4945.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4946.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4947.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4948.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4949.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4950.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4951.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4952.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4953.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4954.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4956.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4957.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4958.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-4964.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-4985.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5024.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5025.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5027.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5028.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5029.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5030.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5031.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5032.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5033.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5034.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5035.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5037.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5038.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5039.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5051.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5056.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5057.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5058.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5059.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5060.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5061.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5062.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5063.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5064.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5065.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5066.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5067.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5068.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5069.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5070.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5136.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5137.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5138.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5139.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5140.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5141.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5142.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5143.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5144.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5145.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5148.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5149.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5150.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5151.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5152.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5153.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5154.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5155.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5156.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5157.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5158.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5159.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5168.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5376.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5377.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5378.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5447.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5632.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5633.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5712.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5888.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-5889.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-5890.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6144.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6145.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6281.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6400.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6401.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6402.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6403.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6404.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6405.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6406.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6407.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6408.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6409.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6410.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6416.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6419.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6420.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6421.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6422.md", -"redirect_url": "/windows/security/threat-protection/auditing/event-6423.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/event-6424.md", -"redirect_url": "/windows/security/threat-protection/auditing/file-system-global-object-access-auditing.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md", -"redirect_url": "/windows/security/threat-protection/auditing/monitor-claim-types.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/monitor-resource-attribute-definitions.md", -"redirect_url": "/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md", -"redirect_url": "/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md", -"redirect_url": "/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/other-events.md", -"redirect_url": "/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/registry-global-object-access-auditing.md", -"redirect_url": "/windows/security/threat-protection/auditing/security-auditing-overview.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", -"redirect_url": "/windows/security/threat-protection/auditing/view-the-security-event-log.md", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md", -"redirect_url": "/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", -"redirect_url": "/windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/administer-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/administer-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-architecture-and-components.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-architecture-and-components", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-functions.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-functions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-overview.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-policies-deployment-guide.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-policies-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-policies-design-guide.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-policies-design-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-policy-use-scenarios.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-policy-use-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-processes-and-interactions.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-processes-and-interactions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-settings.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/applocker-technical-reference.md", -"redirect_url": "/windows/security/threat-protection/applocker/applocker-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-an-applocker-policy-for-audit-only.md", -"redirect_url": "/windows/security/threat-protection/applocker/configure-an-applocker-policy-for-audit-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/configure-an-applocker-policy-for-enforce-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-exceptions-for-an-applocker-rule.md", -"redirect_url": "/windows/security/threat-protection/applocker/configure-exceptions-for-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-the-application-identity-service.md", -"redirect_url": "/windows/security/threat-protection/applocker/configure-the-application-identity-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/configure-the-appLocker-reference-device.md", -"redirect_url": "/windows/security/threat-protection/applocker/configure-the-appLocker-reference-device", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-a-rule-for-packaged-apps.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-a-rule-for-packaged-apps", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-file-hash-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-path-condition.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-path-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-publisher-condition", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-applocker-default-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-list-of-applications-deployed-to-each-business-group", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-your-applocker-planning-document.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-your-applocker-planning-document", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-your-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-your-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/create-your-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/create-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/delete-an-applocker-rule.md", -"redirect_url": "/windows/security/threat-protection/applocker/delete-an-applocker-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", -"redirect_url": "/windows/security/threat-protection/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/deploy-the-applocker-policy-into-production.md", -"redirect_url": "/windows/security/threat-protection/applocker/deploy-the-applocker-policy-into-production", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement.md", -"redirect_url": "/windows/security/threat-protection/applocker/determine-group-policy-structure-and-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", -"redirect_url": "/windows/security/threat-protection/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/determine-your-application-control-objectives.md", -"redirect_url": "/windows/security/threat-protection/applocker/determine-your-application-control-objectives", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", -"redirect_url": "/windows/security/threat-protection/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/dll-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/dll-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md", -"redirect_url": "/windows/security/threat-protection/applocker/document-group-policy-structure-and-applocker-rule-enforcement", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/document-your-application-control-management-processes.md", -"redirect_url": "/windows/security/threat-protection/applocker/document-your-application-control-management-processes", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/document-your-application-list.md", -"redirect_url": "/windows/security/threat-protection/applocker/document-your-application-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/document-your-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/document-your-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/edit-an-applocker-policy.md", -"redirect_url": "/windows/security/threat-protection/applocker/edit-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/edit-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/edit-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/enable-the-dll-rule-collection.md", -"redirect_url": "/windows/security/threat-protection/applocker/enable-the-dll-rule-collection", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/enforce-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/enforce-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/executable-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/executable-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/export-an-applocker-policy-from-a-gpo.md", -"redirect_url": "/windows/security/threat-protection/applocker/export-an-applocker-policy-from-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file.md", -"redirect_url": "/windows/security/threat-protection/applocker/export-an-applocker-policy-to-an-xml-file", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/how-applocker-works-techref.md", -"redirect_url": "/windows/security/threat-protection/applocker/how-applocker-works-techref", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/import-an-applocker-policy-from-another-computer.md", -"redirect_url": "/windows/security/threat-protection/applocker/import-an-applocker-policy-from-another-computer", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/import-an-applocker-policy-into-a-gpo.md", -"redirect_url": "/windows/security/threat-protection/applocker/import-an-applocker-policy-into-a-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/maintain-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/applocker/maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/manage-packaged-apps-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/manage-packaged-apps-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md", -"redirect_url": "/windows/security/threat-protection/applocker/merge-applocker-policies-by-using-set-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/merge-applocker-policies-manually.md", -"redirect_url": "/windows/security/threat-protection/applocker/merge-applocker-policies-manually", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/monitor-application-usage-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/monitor-application-usage-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/optimize-applocker-performance.md", -"redirect_url": "/windows/security/threat-protection/applocker/optimize-applocker-performance", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/plan-for-applocker-policy-management.md", -"redirect_url": "/windows/security/threat-protection/applocker/plan-for-applocker-policy-management", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/refresh-an-applocker-policy.md", -"redirect_url": "/windows/security/threat-protection/applocker/refresh-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/requirements-for-deploying-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/applocker/requirements-for-deploying-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/requirements-to-use-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/requirements-to-use-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/run-the-automatically-generate-rules-wizard.md", -"redirect_url": "/windows/security/threat-protection/applocker/run-the-automatically-generate-rules-wizard", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/script-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/script-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/security-considerations-for-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/security-considerations-for-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/select-types-of-rules-to-create.md", -"redirect_url": "/windows/security/threat-protection/applocker/select-types-of-rules-to-create", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md", -"redirect_url": "/windows/security/threat-protection/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/test-and-update-an-applocker-policy.md", -"redirect_url": "/windows/security/threat-protection/applocker/test-and-update-an-applocker-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/tools-to-use-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/tools-to-use-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understand-applocker-enforcement-settings.md", -"redirect_url": "/windows/security/threat-protection/applocker/understand-applocker-enforcement-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understand-applocker-policy-design-decisions.md", -"redirect_url": "/windows/security/threat-protection/applocker/understand-applocker-policy-design-decisions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", -"redirect_url": "/windows/security/threat-protection/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understand-the-applocker-policy-deployment-process.md", -"redirect_url": "/windows/security/threat-protection/applocker/understand-the-applocker-policy-deployment-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-applocker-allow-and-deny-actions-on-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-default-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-applocker-default-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-rule-behavior.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-applocker-rule-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-rule-collections.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-applocker-rule-collections", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-rule-condition-types.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-applocker-rule-condition-types", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-applocker-rule-exceptions.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-applocker-rule-exceptions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-the-file-hash-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-the-path-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/understanding-the-publisher-rule-condition-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", -"redirect_url": "/windows/security/threat-protection/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets.md", -"redirect_url": "/windows/security/threat-protection/applocker/use-the-applocker-windows-powershell-cmdlets", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/using-event-viewer-with-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/using-event-viewer-with-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/applocker/using-software-restriction-policies-and-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/what-is-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/what-is-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/windows-installer-rules-in-applocker.md", -"redirect_url": "/windows/security/threat-protection/applocker/windows-installer-rules-in-applocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/working-with-applocker-policies.md", -"redirect_url": "/windows/security/threat-protection/applocker/working-with-applocker-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/applocker/working-with-applocker-rules.md", -"redirect_url": "/windows/security/threat-protection/applocker/working-with-applocker-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/change-history-for-device-security.md", -"redirect_url": "/windows/security/threat-protection/change-history-for-device-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/enable-virtualization-based-protection-of-code-integrity.md", -"redirect_url": "/windows/security/threat-protection/enable-virtualization-based-protection-of-code-integrity", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/get-support-for-security-baselines.md", -"redirect_url": "/windows/security/threat-protection/get-support-for-security-baselines", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", -"redirect_url": "/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/security-compliance-toolkit-10.md", -"redirect_url": "/windows/security/threat-protection/security-compliance-toolkit-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/windows-10-mobile-security-guide.md", -"redirect_url": "/windows/security/threat-protection/windows-10-mobile-security-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/windows-security-baselines.md", -"redirect_url": "/windows/security/threat-protection/windows-security-baselines", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/app-behavior-with-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/app-behavior-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/limitations-with-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/limitations-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/overview-create-wip-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/testing-scenarios-for-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/using-owa-with-wip.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/using-owa-with-wip", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/windows-information-protection/wip-app-enterprise-context.md", -"redirect_url": "/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/encrypted-hard-drive.md", -"redirect_url": "/windows/security/hardware-protection/encrypted-hard-drive", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/how-hardware-based-containers-help-protect-windows.md", -"redirect_url": "/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/secure-the-windows-10-boot-process.md", -"redirect_url": "/windows/security/hardware-protection/secure-the-windows-10-boot-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds.md", -"redirect_url": "/windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/change-the-tpm-owner-password.md", -"redirect_url": "/windows/securityhardware-protection/tpm/change-the-tpm-owner-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/how-windows-uses-the-tpm.md", -"redirect_url": "/windows/securityhardware-protection/tpm/how-windows-uses-the-tpm", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm.md", -"redirect_url": "/windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/manage-tpm-commands.md", -"redirect_url": "/windows/security/hardware-protection/tpm/manage-tpm-commands", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/manage-tpm-lockout.md", -"redirect_url": "/windows/security/hardware-protection/tpm/manage-tpm-lockout", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md", -"redirect_url": "/windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/tpm-fundamentals.md", -"redirect_url": "/windows/security/hardware-protection/tpm/tpm-fundamentals", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/tpm-recommendations.md", -"redirect_url": "/windows/security/hardware-protection/tpm/tpm-recommendations", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/trusted-platform-module-overview.md", -"redirect_url": "/windows/security/hardware-protection/tpm/trusted-platform-module-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md", -"redirect_url": "/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/tpm/trusted-platform-module-top-node.md", -"redirect_url": "/windows/security/hardware-protection/tpm/trusted-platform-module-top-node", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bcd-settings-and-bitlocker.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-basic-deployment.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-basic-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-countermeasures.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-countermeasures", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-frequently-asked-questions.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-group-policy-settings.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-management-for-enterprises.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-overview.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-recovery-guide-plan.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md", -"redirect_url": "/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure.md", -"redirect_url": "/windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md", -"redirect_url": "/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks.md", -"redirect_url": "/windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", -"redirect_url": "/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys.md", -"redirect_url": "/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-credential-theft-mitigation-guide-abstract.md", -"redirect_url": "/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/change-history-for-access-protection.md", -"redirect_url": "/windows/security/identity-protection/change-history-for-access-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/configure-s-mime.md", -"redirect_url": "/windows/security/identity-protection/configure-s-mime", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/enterprise-certificate-pinning.md", -"redirect_url": "/windows/security/identity-protection/enterprise-certificate-pinning", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/installing-digital-certificates-on-windows-10-mobile.md", -"redirect_url": "/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/remote-credential-guard.md", -"redirect_url": "/windows/security/identity-protection/remote-credential-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/assign-security-group-filters-to-the-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/basic-firewall-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/basic-firewall-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/boundary-zone-gpos.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/boundary-zone-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/boundary-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/boundary-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/certificate-based-isolation-policy-design-example.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/certificate-based-isolation-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/change-rules-from-request-to-require-mode.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/change-rules-from-request-to-require-mode", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-configuring-basic-firewall-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-creating-group-policy-objects.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-creating-group-policy-objects", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-creating-inbound-firewall-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-creating-outbound-firewall-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-authentication-methods.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-authentication-methods", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-data-protection-quick-mode-settings.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-data-protection-quick-mode-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-key-exchange-main-mode-settings.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-key-exchange-main-mode-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-the-rules-to-require-encryption.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-the-rules-to-require-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-the-windows-firewall-log.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-the-windows-firewall-log", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-a-group-account-in-active-directory.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-a-group-account-in-active-directory", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-a-group-policy-object.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-a-group-policy-object", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-authentication-exemption-list-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-authentication-exemption-list-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-authentication-request-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-authentication-request-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-inbound-icmp-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-inbound-icmp-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-inbound-port-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-inbound-port-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-inbound-program-or-service-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-inbound-program-or-service-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-outbound-port-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-outbound-port-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-an-outbound-program-or-service-rule.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-an-outbound-program-or-service-rule", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-inbound-rules-to-support-rpc.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-inbound-rules-to-support-rpc", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/create-wmi-filters-for-the-gpo", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/determining-the-trusted-state-of-your-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/documenting-the-zones.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/documenting-the-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/domain-isolation-policy-design-example.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/domain-isolation-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/enable-predefined-inbound-rules.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/enable-predefined-inbound-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/enable-predefined-outbound-rules.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/enable-predefined-outbound-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/encryption-zone-gpos.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/encryption-zone-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/encryption-zone.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/encryption-zone", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/exempt-icmp-from-authentication.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/exempt-icmp-from-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/exemption-list.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/exemption-list", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/firewall-gpos.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/firewall-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/firewall-policy-design-example.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/firewall-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gathering-information-about-your-active-directory-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-devices.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gathering-information-about-your-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-other-relevant-information.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gathering-other-relevant-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gathering-the-information-you-need.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gathering-the-information-you-need", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-boundary.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gpo-domiso-boundary", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-encryption.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gpo-domiso-encryption", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-firewall.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gpo-domiso-firewall", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-clients", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/isolated-domain-gpos.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/isolated-domain-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/isolated-domain.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/isolated-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/isolating-apps-on-your-network.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/isolating-apps-on-your-network", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/link-the-gpo-to-the-domain.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/link-the-gpo-to-the-domain", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/open-windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/open-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-certificate-based-authentication.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-certificate-based-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-domain-isolation-zones.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-domain-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-gpo-deployment.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-gpo-deployment", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-isolation-groups-for-the-zones.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-isolation-groups-for-the-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-network-access-groups.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-network-access-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-server-isolation-zones.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-server-isolation-zones", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-the-gpos.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-the-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/procedures-used-in-this-guide.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/procedures-used-in-this-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/protect-devices-from-unwanted-network-traffic", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/restrict-access-to-only-trusted-devices.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/restrict-access-to-only-trusted-devices", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/server-isolation-gpos.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/server-isolation-gpos", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/server-isolation-policy-design-example.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/server-isolation-policy-design-example", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/server-isolation-policy-design.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/server-isolation-policy-design", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/verify-that-network-traffic-is-authenticated", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md", -"redirect_url": "/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-authentication.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-authentication", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-auto-trigger-profile.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-auto-trigger-profile", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-conditional-access.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-conditional-access", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-connection-type.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-connection-type", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-guide.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-name-resolution.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-name-resolution", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-profile-options.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-profile-options", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-routing.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-routing", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/vpn/vpn-security-features.md", -"redirect_url": "/windows/security/identity-protection/vpn/vpn-security-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-get-started.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-overview.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md", -"redirect_url": "/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/user-account-control/how-user-account-control-works.md", -"redirect_url": "/windows/security/identity-protection/user-account-control/how-user-account-control-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md", -"redirect_url": "/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/user-account-control/user-account-control-overview.md", -"redirect_url": "/windows/security/identity-protection/user-account-control/user-account-control-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/user-account-control/user-account-control-security-policy-settings.md", -"redirect_url": "/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-debugging-information.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-debugging-information", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-events.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-events", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-group-policy-and-registry-settings.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-removal-policy-service.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-smart-cards-for-windows-service.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-tools-and-settings.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-and-remote-desktop-services.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-architecture.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-architecture", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/smart-cards/smart-card-certificate-propagation-service.md", -"redirect_url": "/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-and-password-changes.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-and-password-changes", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-biometrics-in-enterprise.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-adfs.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-deploy-mfa.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-policy-settings.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-pki.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-deployment-cert-trust.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-deployment-guide.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-deployment-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-deployment-key-trust.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-errors-during-pin-creation.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-event-300.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-event-300", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-features.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-features", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-how-it-works.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-new-install.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-identity-verification.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-adfs.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-pki.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-manage-in-organization.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-manage-in-organization", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-overview.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-overview", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-planning-guide.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-planning-guide", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-prepare-people-to-use.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password.md", -"redirect_url": "/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/additional-mitigations.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/additional-mitigations", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-considerations.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-considerations", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-how-it-works.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-how-it-works", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-known-issues.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-known-issues", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-manage.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-manage", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-not-protected-scenarios.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-protection-limits.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-protection-limits", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-requirements.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-requirements", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/credential-guard/credential-guard-scripts.md", -"redirect_url": "/windows/security/identity-protection/credential-guard/credential-guard-scripts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/access-control.md", -"redirect_url": "/windows/security/identity-protection/access-control/access-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/active-directory-accounts.md", -"redirect_url": "/windows/security/identity-protection/access-control/active-directory-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/active-directory-security-groups.md", -"redirect_url": "/windows/security/identity-protection/access-control/active-directory-security-groups", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/dynamic-access-control.md", -"redirect_url": "/windows/security/identity-protection/access-control/dynamic-access-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/local-accounts.md", -"redirect_url": "/windows/security/identity-protection/access-control/local-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/microsoft-accounts.md", -"redirect_url": "/windows/security/identity-protection/access-control/microsoft-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/security-identifiers.md", -"redirect_url": "/windows/security/identity-protection/access-control/security-identifiers", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/security-principals.md", -"redirect_url": "/windows/security/identity-protection/access-control/security-principals", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/service-accounts.md", -"redirect_url": "/windows/security/identity-protection/access-control/service-accounts", -"redirect_document_id": true -}, -{ -"source_path": "windows/access-protection/access-control/special-identities.md", -"redirect_url": "/windows/security/identity-protection/access-control/special-identities", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-code-integrity-policies-steps.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md", -"redirect_url": "/windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/deploy-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control", -"redirect_document_id": true -}, -{ -"source_path": "windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection.md", -"redirect_url": "/windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", -"redirect_document_id": true -}, -{ -"source_path": "devices/surface/surface-device-compatibility-with-windows-10-ltsb.md", -"redirect_url": "/devices/surface/surface-device-compatibility-with-windows-10-ltsc", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/windows-diagnostic-data-1709.md", -"redirect_url": "/windows/configuration/windows-diagnostic-data", -"redirect_document_id": true -}, -{ -"source_path": "windows/configuration/EventName.md", -"redirect_url": "/windows/configuration/enhanced-telemetry-windows-analytics-events-and-fields", -"redirect_document_id": true -}, -{ -"source_path": "education/windows/windows-10-pro-to-pro-edu-upgrade.md", -"redirect_url": "/education/windows/switch-to-pro-education", +"source_path": "windows/security/threat-protection/microsoft-defender-atp/enable-custom-ti.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", "redirect_document_id": false }, { -"source_path": "education/windows/switch-to-pro-education.md", -"redirect_url": "/education/windows/change-to-pro-education", +"source_path": "windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { - "source_path": "education/windows/swithc-to-pro-de.md", - "redirect_url": "/education/windows/switch-to-pro-education", - "redirect_document_id": false - }, -{ -"source_path": "windows/client-management/mdm/policy-admx-backed.md", -"redirect_url": "/windows/client-management/mdm/policy-configuration-service-provider", -"redirect_document_id": true -}, -{ -"source_path": "windows/client-management/mdm/policy-csp-location.md", -"redirect_url": "/windows/client-management/mdm/policy-configuration-service-provider", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/configure-windows-defender-in-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-pua-windows-defender-for-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/get-started-with-windows-defender-for-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-block-at-first-sight.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-in-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/windows-defender-enhanced-notifications.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", +"source_path": "windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-secure-score", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-aad-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-siem-integration", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/evaluate-atp.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/evaluate-atp", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/event-error-codes", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/experiment-custom-ti.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/fix-unhealthy-sensors", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/fix-unhealthy-sensors.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/fix-unhealthy-sensors", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-cvekbmap-collection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-cvekbmap-collection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-kbinfo-collection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-kbinfo-collection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-machinegroups-collection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machinegroups-collection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-machinesecuritystates-collection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machinesecuritystates-collection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-config.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-config", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/information-protection-in-windows-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/information-protection-in-windows-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-domain", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-files", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-incidents", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-ip", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-machines", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-user", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/licensing", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-reports", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machines-view-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-tags", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-alerts", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-automation-file-uploads", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-automation-folder-exclusions", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-edr.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-edr", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/management-apis.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/management-apis", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-incidents-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-incidents", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-suppression-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mssp-support", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/next-gen-threat-and-vuln-mgt.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/offboard-machines", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-configure", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/onboard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/onboard-offline-machines.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/overview-hardware-based-isolation.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/partner-applications.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/partner-applications", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/portal-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/powerbi-reports", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/powershell-example-code", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/powershell-example-code.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ +"source_path": "windows/keep-secure/preferences-setup-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-apis", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/use-apis.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preferences-setup", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/prerelease.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/prerelease", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/prerelease.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prerelease", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preview", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preview-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/python-example-code", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/python-example-code.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/rbac", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/response-actions.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts", +"redirect_document_id": false +}, +{ +"source_path": "windows/keep-secure/response-actions-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/response-actions", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-detection-test", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/secure-score-dashboard", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/service-status", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-indicator-concepts", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/threat-protection-integration.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/threat-protection-reports-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-protection-reports", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/time-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/troubleshoot-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/troubleshoot-windows-defender-in-windows-10.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", +"redirect_document_id": false +}, +{ +"source_path": "windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/troubleshoot-custom-ti.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding-error-messages", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-siem", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-custom-ti", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/use-custom-ti.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-atp/whats-new-in-windows-defender-atp.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/whats-new-in-microsoft-defender-atp", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-config.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-config", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-cloud-app-security-integration.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-cloud-app-security-integration", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/windows-defender-security-center-atp.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-security-center", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-threat-experts", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-application-guard/configure-wd-app-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/configure-wd-app-guard", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-application-guard/faq-wd-app-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/faq-wd-app-guard", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-application-guard/install-wd-app-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/install-wd-app-guard", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-application-guard/reqs-wd-app-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/reqs-wd-app-guard", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/test-scenarios-wd-app-guard", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-application-guard/wd-app-guard-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/collect-diagnostic-data-update-compliance", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/troubleshoot-reporting.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-offline.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-offline", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/block-untrusted-fonts-in-enterprise.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/block-untrusted-fonts-in-enterprise", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/change-history-for-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/change-history-for-threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/override-mitigation-options-for-app-related-security-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/overview-of-threat-mitigations-in-windows-10.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/wannacrypt-ransomware-worm-targets-out-of-date-systems-wdsi", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-defender-application-control.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/access-credential-manager-as-a-trusted-caller", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/access-this-computer-from-the-network.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/access-this-computer-from-the-network", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/account-lockout-duration.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-duration", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/account-lockout-policy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/account-lockout-threshold.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-lockout-threshold", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/account-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/account-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/accounts-administrator-account-status.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-administrator-account-status", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/accounts-guest-account-status.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-guest-account-status", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/accounts-rename-administrator-account.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-rename-administrator-account", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/accounts-rename-guest-account.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/accounts-rename-guest-account", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/act-as-part-of-the-operating-system.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/act-as-part-of-the-operating-system", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/add-workstations-to-domain.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/add-workstations-to-domain", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/adjust-memory-quotas-for-a-process", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/administer-security-policy-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/administer-security-policy-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/allow-log-on-locally.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/allow-log-on-locally", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/allow-log-on-through-remote-desktop-services", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-audit-the-access-of-global-system-objects", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/audit-policy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/back-up-files-and-directories.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/back-up-files-and-directories", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/bypass-traverse-checking.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/bypass-traverse-checking", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/change-the-system-time.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/change-the-system-time", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/change-the-time-zone.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/change-the-time-zone", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/create-a-pagefile.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-a-pagefile", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/create-a-token-object.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-a-token-object", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/create-global-objects.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-global-objects", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/create-permanent-shared-objects.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-permanent-shared-objects", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/create-symbolic-links.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/create-symbolic-links", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", +"redirect_document_id": false +}, +{ +"source_path": "windows/device-security/security-policy-settings/debug-programs.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/debug-programs", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-access-to-this-computer-from-the-network", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-batch-job", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/deny-log-on-as-a-service.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-as-a-service", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/deny-log-on-locally.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-locally", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/deny-log-on-through-remote-desktop-services", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-allow-undock-without-having-to-log-on", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-controller-ldap-server-signing-requirements", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-controller-refuse-machine-account-password-changes", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-disable-machine-account-password-changes", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-maximum-machine-account-password-age", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/enforce-password-history.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/enforce-password-history", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/enforce-user-logon-restrictions.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/enforce-user-logon-restrictions", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/force-shutdown-from-a-remote-system", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/generate-security-audits.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/generate-security-audits", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/how-to-configure-security-policy-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/impersonate-a-client-after-authentication.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/impersonate-a-client-after-authentication", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/increase-a-process-working-set.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/increase-a-process-working-set", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/increase-scheduling-priority.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/increase-scheduling-priority", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-display-last-user-name", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-account-lockout-threshold", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-machine-inactivity-limit", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-require-smart-card.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-require-smart-card", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/interactive-logon-smart-card-removal-behavior", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/kerberos-policy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/kerberos-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/load-and-unload-device-drivers.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/load-and-unload-device-drivers", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/lock-pages-in-memory.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/lock-pages-in-memory", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/log-on-as-a-batch-job.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/log-on-as-a-batch-job", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/log-on-as-a-service.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/log-on-as-a-service", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/manage-auditing-and-security-log.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/manage-auditing-and-security-log", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-service-ticket", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-lifetime-for-user-ticket", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/maximum-password-age.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-password-age", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/minimum-password-age.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/minimum-password-age", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/minimum-password-length.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/minimum-password-length", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/modify-an-object-label.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/modify-an-object-label", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/modify-firmware-environment-values.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/modify-firmware-environment-values", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-allow-anonymous-sidname-translation", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-remotely-accessible-registry-paths", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-list-manager-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-list-manager-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-localsystem-null-session-fallback", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/password-must-meet-complexity-requirements.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/password-must-meet-complexity-requirements", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/password-policy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/password-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/perform-volume-maintenance-tasks.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/perform-volume-maintenance-tasks", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/profile-single-process.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/profile-single-process", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/profile-system-performance.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/profile-system-performance", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/recovery-console-allow-automatic-administrative-logon", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/remove-computer-from-docking-station.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/remove-computer-from-docking-station", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/replace-a-process-level-token.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/replace-a-process-level-token", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/reset-account-lockout-counter-after.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/reset-account-lockout-counter-after", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/restore-files-and-directories.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/restore-files-and-directories", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/secpol-advanced-security-audit-policy-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/security-options.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/security-options", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/security-policy-settings-reference.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/security-policy-settings-reference", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/security-policy-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/security-policy-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/shut-down-the-system.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/shut-down-the-system", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/shutdown-clear-virtual-memory-pagefile", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/store-passwords-using-reversible-encryption", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/synchronize-directory-service-data.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/synchronize-directory-service-data", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/system-settings-optional-subsystems.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-settings-optional-subsystems", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/take-ownership-of-files-or-other-objects", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-policy-settings/user-rights-assignment.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/user-rights-assignment", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-catalog-files-to-support-windows-defender-application-control", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/deploy-managed-installer-for-device-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-managed-installer-for-device-guard", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/deploy-windows-defender-application-control.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/deploy-windows-defender-application-control", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/device-guard-deployment-guide.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/device-guard-deployment-guide", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/requirements-and-deployment-planning-guidelines-for-device-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/steps-to-deploy-windows-defender-application-control.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/advanced-security-audit-policy-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/advanced-security-auditing-faq.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/advanced-security-auditing", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-account-lockout.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-application-generated", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-application-group-management.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-audit-policy-change", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-authentication-policy-change.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-authorization-policy-change", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-central-access-policy-staging.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-certification-services", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-computer-account-management.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-credential-validation", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-detailed-directory-service-replication.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-detailed-file-share", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-directory-service-access.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-directory-service-replication.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-distribution-group-management", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-dpapi-activity.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-file-share", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-file-system.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-filtering-platform-connection", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-filtering-platform-packet-drop.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-group-membership.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-handle-manipulation", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-ipsec-driver.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-ipsec-extended-mode", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-ipsec-main-mode.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-ipsec-quick-mode", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-kerberos-authentication-service.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-kernel-object.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-logoff", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-logon.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-network-policy-server.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-other-account-logon-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-account-management-events", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-other-logonlogoff-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-object-access-events", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-other-policy-change-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-other-privilege-use-events", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-other-system-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-pnp-activity", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-process-creation.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-process-termination", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-registry.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-removable-storage", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-rpc-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-sam", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-security-group-management.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-security-state-change", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-security-system-extension.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-sensitive-privilege-use", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-special-logon.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-system-integrity", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/audit-user-account-management.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-user-device-claims", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/basic-audit-account-logon-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-account-management", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/basic-audit-directory-service-access.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-logon-events", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/basic-audit-object-access.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-policy-change", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/basic-audit-privilege-use.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-audit-process-tracking", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/basic-audit-system-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/basic-security-audit-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/basic-security-audit-policy-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-1100.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-1102", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-1104.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-1105", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-1108.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4608", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4610.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4611", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4612.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4614", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4615.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4616", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4618.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4621", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4622.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4624", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4625.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4626", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4627.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4634", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4647.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4648", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4649.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4656", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4657.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4658", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4660.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4661", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4662.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4663", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4664.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4670", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4671.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4672", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4673.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4674", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4675.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4688", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4689.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4690", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4691.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4692", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4693.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4694", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4695.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4696", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4697.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4698", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4699.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4700", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4701.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4702", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4703.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4704", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4705.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4706", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4707.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4713", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4714.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4715", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4716.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4717", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4718.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4719", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4720.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4722", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4723.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4724", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4725.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4726", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4731.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4732", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4733.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4734", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4735.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4738", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4739.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4740", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4741.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4742", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4743.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4749", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4750.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4751", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4752.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4753", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4764.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4765", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4766.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4767", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4768.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4769", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4770.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4771", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4772.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4773", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4774.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4775", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4776.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4777", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4778.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4779", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4780.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4781", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4782.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4793", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4794.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4798", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4799.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4800", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4801.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4802", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4803.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4816", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4817.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4818", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4819.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4826", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4864.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4865", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4866.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4867", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4902.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4904", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4905.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4906", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4907.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4908", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4909.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4910", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4911.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4912", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4913.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4928", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4929.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4930", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4931.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4932", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4933.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4934", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4935.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4936", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4937.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4944", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4945.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4946", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4947.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4948", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4949.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4950", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4951.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4952", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4953.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4954", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4956.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4957", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4958.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4964", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-4985.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5024", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5025.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5027", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5028.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5029", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5030.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5031", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5032.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5033", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5034.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5035", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5037.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5038", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5039.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5051", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5056.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5057", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5058.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5059", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5060.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5061", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5062.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5063", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5064.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5065", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5066.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5067", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5068.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5069", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5070.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5136", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5137.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5138", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5139.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5140", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5141.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5142", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5143.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5144", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5145.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5148", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5149.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5150", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5151.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5152", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5153.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5154", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5155.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5156", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5157.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5158", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5159.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5168", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5376.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5377", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5378.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5447", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5632.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5633", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5712.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5888", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-5889.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-5890", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-6144.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6145", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-6281.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6400", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-6401.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6402", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-6403.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6404", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-6405.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6406", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-6407.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6408", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-6409.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6410", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-6416.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6419", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-6420.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6421", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-6422.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6423", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/event-6424.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/file-system-global-object-access-auditing", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-claim-types", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/monitor-resource-attribute-definitions.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-the-central-access-policies-associated-with-files-and-folders", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-the-resource-attributes-on-files-and-folders", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/monitor-the-use-of-removable-storage-devices.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/monitor-user-and-device-claims-during-sign-in", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/other-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/planning-and-deploying-advanced-security-audit-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/registry-global-object-access-auditing.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/security-auditing-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/view-the-security-event-log", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/administer-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/administer-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/applocker-architecture-and-components.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-architecture-and-components", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/applocker-functions.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-functions", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/applocker-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/applocker-policies-deployment-guide.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-policies-deployment-guide", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/applocker-policies-design-guide.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-policies-design-guide", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/applocker-policy-use-scenarios.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-policy-use-scenarios", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/applocker-processes-and-interactions.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-processes-and-interactions", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/applocker-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/applocker-technical-reference.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/applocker-technical-reference", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/configure-an-applocker-policy-for-audit-only.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-an-applocker-policy-for-audit-only", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-an-applocker-policy-for-enforce-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/configure-exceptions-for-an-applocker-rule.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-exceptions-for-an-applocker-rule", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/configure-the-application-identity-service.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-the-application-identity-service", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/configure-the-appLocker-reference-device.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/configure-the-appLocker-reference-device", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/create-a-rule-for-packaged-apps.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-for-packaged-apps", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-file-hash-condition", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-path-condition.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-path-condition", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-a-rule-that-uses-a-publisher-condition", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/create-applocker-default-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-applocker-default-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-list-of-applications-deployed-to-each-business-group", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/create-your-applocker-planning-document.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-your-applocker-planning-document", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/create-your-applocker-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-your-applocker-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/create-your-applocker-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/create-your-applocker-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/delete-an-applocker-rule.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/delete-an-applocker-rule", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/deploy-the-applocker-policy-into-production.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/deploy-the-applocker-policy-into-production", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/determine-group-policy-structure-and-rule-enforcement", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/determine-your-application-control-objectives.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/determine-your-application-control-objectives", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/dll-rules-in-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/dll-rules-in-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-group-policy-structure-and-applocker-rule-enforcement", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/document-your-application-control-management-processes.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-your-application-control-management-processes", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/document-your-application-list.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-your-application-list", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/document-your-applocker-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/document-your-applocker-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/edit-an-applocker-policy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/edit-an-applocker-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/edit-applocker-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/edit-applocker-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/enable-the-dll-rule-collection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/enable-the-dll-rule-collection", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/enforce-applocker-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/enforce-applocker-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/executable-rules-in-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/executable-rules-in-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/export-an-applocker-policy-from-a-gpo.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/export-an-applocker-policy-from-a-gpo", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/export-an-applocker-policy-to-an-xml-file", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/how-applocker-works-techref.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/how-applocker-works-techref", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/import-an-applocker-policy-from-another-computer.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/import-an-applocker-policy-from-another-computer", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/import-an-applocker-policy-into-a-gpo.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/import-an-applocker-policy-into-a-gpo", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/maintain-applocker-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/maintain-applocker-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/manage-packaged-apps-with-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/manage-packaged-apps-with-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/merge-applocker-policies-by-using-set-applockerpolicy", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/merge-applocker-policies-manually.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/merge-applocker-policies-manually", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/monitor-application-usage-with-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/monitor-application-usage-with-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/optimize-applocker-performance.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/optimize-applocker-performance", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/plan-for-applocker-policy-management.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/plan-for-applocker-policy-management", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/refresh-an-applocker-policy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/refresh-an-applocker-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/requirements-for-deploying-applocker-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/requirements-for-deploying-applocker-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/requirements-to-use-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/requirements-to-use-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/run-the-automatically-generate-rules-wizard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/run-the-automatically-generate-rules-wizard", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/script-rules-in-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/script-rules-in-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/security-considerations-for-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/security-considerations-for-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/select-types-of-rules-to-create.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/select-types-of-rules-to-create", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/test-and-update-an-applocker-policy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/test-and-update-an-applocker-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/tools-to-use-with-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/tools-to-use-with-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understand-applocker-enforcement-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-applocker-enforcement-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understand-applocker-policy-design-decisions.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-applocker-policy-design-decisions", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understand-the-applocker-policy-deployment-process.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understand-the-applocker-policy-deployment-process", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-allow-and-deny-actions-on-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understanding-applocker-default-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-default-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understanding-applocker-rule-behavior.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-behavior", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understanding-applocker-rule-collections.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-collections", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understanding-applocker-rule-condition-types.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-condition-types", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understanding-applocker-rule-exceptions.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-applocker-rule-exceptions", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-the-file-hash-rule-condition-in-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-the-path-rule-condition-in-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/understanding-the-publisher-rule-condition-in-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/use-the-applocker-windows-powershell-cmdlets", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/using-event-viewer-with-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/using-event-viewer-with-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/using-software-restriction-policies-and-applocker-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/what-is-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/what-is-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/windows-installer-rules-in-applocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/windows-installer-rules-in-applocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/working-with-applocker-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/working-with-applocker-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/applocker/working-with-applocker-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/applocker/working-with-applocker-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/change-history-for-device-security.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/change-history-for-device-security", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/enable-virtualization-based-protection-of-code-integrity.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/enable-virtualization-based-protection-of-code-integrity", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/get-support-for-security-baselines.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/get-support-for-security-baselines", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/security-compliance-toolkit-10.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/security-compliance-toolkit-10", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/windows-10-mobile-security-guide.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-10-mobile-security-guide", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/windows-security-baselines.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/app-behavior-with-wip.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/app-behavior-with-wip", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/limitations-with-wip.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/limitations-with-wip", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/overview-create-wip-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/testing-scenarios-for-wip.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/using-owa-with-wip.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/using-owa-with-wip", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/windows-information-protection/wip-app-enterprise-context.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/encrypted-hard-drive.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/encrypted-hard-drive", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/how-hardware-based-containers-help-protect-windows.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/secure-the-windows-10-boot-process.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/secure-the-windows-10-boot-process", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/tpm/change-the-tpm-owner-password.md", +"redirect_url": "https://docs.microsoft.com/windows/securityhardware-protection/tpm/change-the-tpm-owner-password", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/tpm/how-windows-uses-the-tpm.md", +"redirect_url": "https://docs.microsoft.com/windows/securityhardware-protection/tpm/how-windows-uses-the-tpm", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/tpm/manage-tpm-commands.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/manage-tpm-commands", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/tpm/manage-tpm-lockout.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/manage-tpm-lockout", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/tpm/tpm-fundamentals.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/tpm-fundamentals", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/tpm/tpm-recommendations.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/tpm-recommendations", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/tpm/trusted-platform-module-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/trusted-platform-module-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/tpm/trusted-platform-module-services-group-policy-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/tpm/trusted-platform-module-top-node.md", +"redirect_url": "https://docs.microsoft.com/windows/security/hardware-protection/tpm/trusted-platform-module-top-node", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bcd-settings-and-bitlocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bitlocker-basic-deployment.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-basic-deployment", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bitlocker-countermeasures.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-countermeasures", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bitlocker-frequently-asked-questions.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bitlocker-group-policy-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bitlocker-management-for-enterprises.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bitlocker-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bitlocker-recovery-guide-plan.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/choose-the-right-bitlocker-countermeasure", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/protect-bitlocker-from-pre-boot-attacks", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys.md", +"redirect_url": "https://docs.microsoft.com/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-credential-theft-mitigation-guide-abstract.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/change-history-for-access-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/change-history-for-access-protection", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/configure-s-mime.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/configure-s-mime", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/enterprise-certificate-pinning.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/enterprise-certificate-pinning", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/installing-digital-certificates-on-windows-10-mobile.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/remote-credential-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/assign-security-group-filters-to-the-gpo.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/assign-security-group-filters-to-the-gpo", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/basic-firewall-policy-design.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/basic-firewall-policy-design", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/boundary-zone-gpos.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/boundary-zone-gpos", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/boundary-zone.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/boundary-zone", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/certificate-based-isolation-policy-design-example.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design-example", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/certificate-based-isolation-policy-design.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/certificate-based-isolation-policy-design", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/change-rules-from-request-to-require-mode.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/change-rules-from-request-to-require-mode", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-configuring-basic-firewall-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-basic-firewall-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-creating-group-policy-objects.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-group-policy-objects", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-creating-inbound-firewall-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-inbound-firewall-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-creating-outbound-firewall-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-outbound-firewall-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/configure-authentication-methods.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-authentication-methods", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/configure-data-protection-quick-mode-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-data-protection-quick-mode-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/configure-key-exchange-main-mode-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-key-exchange-main-mode-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/configure-the-rules-to-require-encryption.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-the-rules-to-require-encryption", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/configure-the-windows-firewall-log.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-the-windows-firewall-log", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/create-a-group-account-in-active-directory.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-a-group-account-in-active-directory", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/create-a-group-policy-object.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-a-group-policy-object", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/create-an-authentication-exemption-list-rule.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-authentication-exemption-list-rule", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/create-an-authentication-request-rule.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-authentication-request-rule", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/create-an-inbound-icmp-rule.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-inbound-icmp-rule", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/create-an-inbound-port-rule.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-inbound-port-rule", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/create-an-inbound-program-or-service-rule.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-inbound-program-or-service-rule", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/create-an-outbound-port-rule.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-outbound-port-rule", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/create-an-outbound-program-or-service-rule.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-an-outbound-program-or-service-rule", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/create-inbound-rules-to-support-rpc.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-inbound-rules-to-support-rpc", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/create-wmi-filters-for-the-gpo", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/determining-the-trusted-state-of-your-devices.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/determining-the-trusted-state-of-your-devices", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/documenting-the-zones.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/documenting-the-zones", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/domain-isolation-policy-design-example.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design-example", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/domain-isolation-policy-design.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/domain-isolation-policy-design", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/enable-predefined-inbound-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/enable-predefined-inbound-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/enable-predefined-outbound-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/enable-predefined-outbound-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/encryption-zone-gpos.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/encryption-zone-gpos", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/encryption-zone.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/encryption-zone", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/exempt-icmp-from-authentication.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/exempt-icmp-from-authentication", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/exemption-list.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/exemption-list", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/firewall-gpos.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/firewall-gpos", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/firewall-policy-design-example.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/firewall-policy-design-example", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-active-directory-deployment.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-information-about-your-active-directory-deployment", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/gathering-information-about-your-devices.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-information-about-your-devices", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/gathering-other-relevant-information.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-other-relevant-information", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/gathering-the-information-you-need.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gathering-the-information-you-need", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/gpo-domiso-boundary.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-boundary", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/gpo-domiso-encryption.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-encryption", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/gpo-domiso-firewall.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-firewall", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-clients.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-clients", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-servers.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/gpo-domiso-isolateddomain-servers", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/isolated-domain-gpos.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/isolated-domain-gpos", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/isolated-domain.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/isolated-domain", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/isolating-apps-on-your-network.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/isolating-apps-on-your-network", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/link-the-gpo-to-the-domain.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/link-the-gpo-to-the-domain", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/open-windows-firewall-with-advanced-security.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/open-windows-firewall-with-advanced-security", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/planning-certificate-based-authentication.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-certificate-based-authentication", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/planning-domain-isolation-zones.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-domain-isolation-zones", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/planning-gpo-deployment.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-gpo-deployment", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/planning-isolation-groups-for-the-zones.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-isolation-groups-for-the-zones", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/planning-network-access-groups.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-network-access-groups", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/planning-server-isolation-zones.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-server-isolation-zones", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/planning-the-gpos.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-the-gpos", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/procedures-used-in-this-guide.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/procedures-used-in-this-guide", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/protect-devices-from-unwanted-network-traffic.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/protect-devices-from-unwanted-network-traffic", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/restrict-access-to-only-trusted-devices.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/restrict-access-to-only-trusted-devices", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/server-isolation-gpos.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/server-isolation-gpos", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/server-isolation-policy-design-example.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/server-isolation-policy-design-example", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/server-isolation-policy-design.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/server-isolation-policy-design", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/verify-that-network-traffic-is-authenticated.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/verify-that-network-traffic-is-authenticated", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/windows-firewall/windows-firewall-with-advanced-security.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/vpn/vpn-authentication.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-authentication", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/vpn/vpn-auto-trigger-profile.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-auto-trigger-profile", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/vpn/vpn-conditional-access.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-conditional-access", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/vpn/vpn-connection-type.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-connection-type", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/vpn/vpn-guide.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-guide", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/vpn/vpn-name-resolution.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-name-resolution", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/vpn/vpn-profile-options.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-profile-options", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/vpn/vpn-routing.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-routing", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/vpn/vpn-security-features.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/vpn/vpn-security-features", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-get-started.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/user-account-control/how-user-account-control-works.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/how-user-account-control-works", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/user-account-control/user-account-control-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/user-account-control/user-account-control-security-policy-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/smart-cards/smart-card-debugging-information.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-debugging-information", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/smart-cards/smart-card-events.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-events", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/smart-cards/smart-card-group-policy-and-registry-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/smart-cards/smart-card-removal-policy-service.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/smart-cards/smart-card-smart-cards-for-windows-service.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/smart-cards/smart-card-tools-and-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/smart-cards/smart-card-and-remote-desktop-services.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/smart-cards/smart-card-architecture.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-architecture", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/smart-cards/smart-card-certificate-propagation-service.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-and-password-changes.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-and-password-changes", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-biometrics-in-enterprise.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-adfs.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-deploy-mfa.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-policy-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-cert-trust-validate-pki.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-deployment-cert-trust.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-deployment-guide.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-deployment-guide", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-deployment-key-trust.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-errors-during-pin-creation.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-event-300.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-event-300", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-features.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-features", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-how-it-works.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-how-it-works", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-new-install.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-new-install.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-devreg.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-provision.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-identity-verification.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-identity-verification", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-key-trust-adfs.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-key-trust-deploy-mfa.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-key-trust-policy-settings.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-key-trust-validate-pki.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-manage-in-organization.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-manage-in-organization", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-planning-guide.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-planning-guide", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-prepare-people-to-use.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/credential-guard/additional-mitigations.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/additional-mitigations", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/credential-guard/credential-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/credential-guard/credential-guard-considerations.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-considerations", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/credential-guard/credential-guard-how-it-works.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-how-it-works", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/credential-guard/credential-guard-known-issues.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-known-issues", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/credential-guard/credential-guard-manage.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-manage", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/credential-guard/credential-guard-not-protected-scenarios.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/credential-guard/credential-guard-protection-limits.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-protection-limits", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/credential-guard/credential-guard-requirements.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-requirements", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/credential-guard/credential-guard-scripts.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-scripts", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/access-control/access-control.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/access-control", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/access-control/active-directory-accounts.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-accounts", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/access-control/active-directory-security-groups.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/access-control/dynamic-access-control.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/dynamic-access-control", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/access-control/local-accounts.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/local-accounts", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/access-control/microsoft-accounts.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/access-control/security-identifiers.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/security-identifiers", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/access-control/security-principals.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/security-principals", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/access-control/service-accounts.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/service-accounts", +"redirect_document_id": true +}, +{ +"source_path": "windows/access-protection/access-control/special-identities.md", +"redirect_url": "https://docs.microsoft.com/windows/security/identity-protection/access-control/special-identities", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/deploy-code-integrity-policies-steps.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules.md", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-windows-defender-application-control-policy-rules-and-file-rules", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-windows-defender-application-control", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies.md", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-catalog-files-to-support-windows-defender-application-control", +"redirect_document_id": true +}, +{ +"source_path": "windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection", +"redirect_document_id": true +}, +{ +"source_path": "devices/surface/surface-device-compatibility-with-windows-10-ltsb.md", +"redirect_url": "https://docs.microsoft.com/surface/surface-device-compatibility-with-windows-10-ltsc", +"redirect_document_id": true +}, +{ +"source_path": "windows/configuration/windows-diagnostic-data-1709.md", +"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-diagnostic-data", +"redirect_document_id": true +}, +{ +"source_path": "windows/configuration/EventName.md", +"redirect_url": "https://docs.microsoft.com/windows/configuration/enhanced-telemetry-windows-analytics-events-and-fields", +"redirect_document_id": true +}, +{ +"source_path": "education/windows/windows-10-pro-to-pro-edu-upgrade.md", +"redirect_url": "https://docs.microsoft.com/education/windows/change-to-pro-education", +"redirect_document_id": false +}, +{ +"source_path": "education/windows/switch-to-pro-education.md", +"redirect_url": "https://docs.microsoft.com/education/windows/change-to-pro-education", +"redirect_document_id": false +}, +{ + "source_path": "education/windows/swithc-to-pro-de.md", + "redirect_url": "https://docs.microsoft.com/education/windows/switch-to-pro-education", + "redirect_document_id": false + }, +{ +"source_path": "windows/client-management/mdm/policy-admx-backed.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider", +"redirect_document_id": true +}, +{ +"source_path": "windows/client-management/mdm/policy-csp-location.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider", +"redirect_document_id": false +}, +{ +"source_path": "windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", +"redirect_document_id": false +}, +{ +"source_path": "windows/keep-secure/configure-windows-defender-in-windows-10.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/enable-pua-windows-defender-for-windows-10.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/get-started-with-windows-defender-for-windows-10.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", +"redirect_document_id": false +}, +{ +"source_path": "windows/keep-secure/run-cmd-scan-windows-defender-for-windows-10.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-for-windows-10.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/windows-defender-block-at-first-sight.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/windows-defender-in-windows-10.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", +"redirect_document_id": true +}, +{ +"source_path": "windows/keep-secure/windows-defender-enhanced-notifications.md", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-scenario-7.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", "redirect_document_id": true }, { "source_path": "devices/surface/surface-diagnostic-toolkit.md", -"redirect_url": "/surface/index", +"redirect_url": "https://docs.microsoft.com/surface/index", "redirect_document_id": true }, { "source_path": "devices/surface/manage-surface-dock-firmware-updates.md", -"redirect_url": "devices/surface/update", +"redirect_url": "https://docs.microsoft.com/surface/indexdevices/surface/update", "redirect_document_id": true }, { "source_path": "devices/surface-hub/i-am-done-finishing-your-surface-hub-meeting.md", -"redirect_url": "/surface-hub/finishing-your-surface-hub-meeting", +"redirect_url": "https://docs.microsoft.com/surface-hub/finishing-your-surface-hub-meeting", "redirect_document_id": true }, { "source_path": "devices/hololens/hololens-microsoft-layout-app.md", -"redirect_url": "/hololens/hololens-microsoft-dynamics-365-layout-app", +"redirect_url": "https://docs.microsoft.com/hololens/hololens-microsoft-dynamics-365-layout-app", "redirect_document_id": true }, { @@ -5240,14 +6141,24 @@ "redirect_url": "https://docs.microsoft.com/dynamics365/#pivot=mixed-reality-apps", "redirect_document_id": true }, +{ + "source_path": "devices/hololens/hololens-restart-recover.md", + "redirect_url": "/hololens/hololens-recovery", + "redirect_document_id": false +}, +{ + "source_path": "devices/hololens/holographic-photos-and-video.md", + "redirect_url": "/hololens/holographic-photos-and-videos", + "redirect_document_id": false +}, { "source_path": "devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md", -"redirect_url": "/surface-hub/provisioning-packages-for-surface-hub", +"redirect_url": "https://docs.microsoft.com/surface-hub/provisioning-packages-for-surface-hub", "redirect_document_id": true }, { "source_path": "devices/surface-hub/manage-settings-with-local-admin-account-surface-hub.md", -"redirect_url": "/surface-hub/admin-group-management-for-surface-hub", +"redirect_url": "https://docs.microsoft.com/surface-hub/admin-group-management-for-surface-hub", "redirect_document_id": true }, { @@ -5257,548 +6168,538 @@ }, { "source_path": "devices/surface-hub/intro-to-surface-hub.md", -"redirect_url": "/surface-hub/index", +"redirect_url": "https://docs.microsoft.com/surface-hub/index", "redirect_document_id": false }, { "source_path": "windows/manage/waas-quick-start.md", -"redirect_url": "/windows/deployment/update/waas-quick-start", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-quick-start", "redirect_document_id": true }, { "source_path": "windows/manage/waas-overview.md", -"redirect_url": "/windows/deployment/update/waas-overview", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-overview", "redirect_document_id": true }, { "source_path": "windows/manage/waas-servicing-strategy-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-servicing-strategy-windows-10-updates", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-strategy-windows-10-updates", "redirect_document_id": true }, { "source_path": "windows/manage/waas-deployment-rings-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-deployment-rings-windows-10-updates", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates", "redirect_document_id": true }, { "source_path": "windows/manage/waas-servicing-branches-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-servicing-branches-windows-10-updates", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-branches-windows-10-updates", "redirect_document_id": true }, { "source_path": "windows/manage/update-compliance-monitor.md", -"redirect_url": "/windows/deployment/update/update-compliance-monitor", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor", "redirect_document_id": true }, { "source_path": "windows/manage/update-compliance-get-started.md", -"redirect_url": "/windows/deployment/update/update-compliance-get-started", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started", "redirect_document_id": true }, { "source_path": "windows/manage/update-compliance-using.md", -"redirect_url": "/windows/deployment/update/update-compliance-using", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-using", "redirect_document_id": true }, { "source_path": "windows/manage/waas-optimize-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-optimize-windows-10-updates", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-optimize-windows-10-updates", "redirect_document_id": true }, { "source_path": "windows/manage/waas-delivery-optimization.md", -"redirect_url": "/windows/deployment/update/waas-delivery-optimization", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization", "redirect_document_id": true }, { "source_path": "windows/manage/waas-branchcache.md", -"redirect_url": "/windows/deployment/update/waas-branchcache", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-branchcache", "redirect_document_id": true }, { "source_path": "windows/manage/waas-mobile-updates.md", -"redirect_url": "/windows/deployment/update/waas-mobile-updates", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-mobile-updates", "redirect_document_id": true }, { "source_path": "windows/manage/waas-manage-updates-wufb.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wufb", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", "redirect_document_id": true }, { "source_path": "windows/manage/waas-configure-wufb.md", -"redirect_url": "/windows/deployment/update/waas-configure-wufb", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb", "redirect_document_id": true }, { "source_path": "windows/manage/waas-integrate-wufb.md", -"redirect_url": "/windows/deployment/update/waas-integrate-wufb", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-integrate-wufb", "redirect_document_id": true }, { "source_path": "windows/manage/waas-wufb-group-policy.md", -"redirect_url": "/windows/deployment/update/waas-wufb-group-policy", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-group-policy", "redirect_document_id": true }, { "source_path": "windows/manage/waas-wufb-intune.md", -"redirect_url": "/windows/deployment/update/waas-wufb-intune.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-intune.md", "redirect_document_id": true }, { "source_path": "windows/manage/waas-manage-updates-wsus.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wsus", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wsus", "redirect_document_id": true }, { "source_path": "windows/manage/waas-manage-updates-configuration-manager.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/manage/waas-restart.md", -"redirect_url": "/windows/deployment/update/waas-restart", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-restart", "redirect_document_id": true }, { "source_path": "windows/manage/waas-update-windows-10.md", -"redirect_url": "/windows/deployment/update/index", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/index", "redirect_document_id": false }, { "source_path": "windows/manage/configure-windows-telemetry-in-your-organization.md", -"redirect_url": "/windows/configuration/configure-windows-diagnostic-data-in-your-organization", +"redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization", "redirect_document_id": true }, { "source_path": "windows/manage/lockdown-features-windows-10.md", -"redirect_url": "/windows/configuration/lockdown-features-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/configuration/lockdown-features-windows-10", "redirect_document_id": true }, { "source_path": "windows/manage/set-up-shared-or-guest-pc.md", -"redirect_url": "/windows/configuration/set-up-shared-or-guest-pc", +"redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-shared-or-guest-pc", "redirect_document_id": true }, { "source_path": "windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", -"redirect_url": "/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", +"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", "redirect_document_id": false }, { "source_path": "windows/manage/set-up-a-device-for-anyone-to-use.md", -"redirect_url": "/windows/configuration/kiosk-shared-pc", +"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-shared-pc", "redirect_document_id": false }, { "source_path": "windows/configuration/set-up-a-device-for-anyone-to-use.md", -"redirect_url": "/windows/configuration/kiosk-shared-pc", +"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-shared-pc", "redirect_document_id": true }, { "source_path": "windows/manage/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", -"redirect_url": "/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions", +"redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions", "redirect_document_id": true }, { "source_path": "windows/manage/guidelines-for-assigned-access-app.md", -"redirect_url": "/windows/configuration/guidelines-for-assigned-access-app", +"redirect_url": "https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app", "redirect_document_id": true }, { "source_path": "windows/manage/lock-down-windows-10-to-specific-apps.md", -"redirect_url": "/windows/configuration/lock-down-windows-10-to-specific-apps", +"redirect_url": "https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps", "redirect_document_id": true }, { "source_path": "windows/manage/set-up-a-kiosk-for-windows-10-for-mobile-edition.md", -"redirect_url": "/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition", "redirect_document_id": true }, { "source_path": "windows/manage/lockdown-xml.md", -"redirect_url": "/windows/configuration/mobile-devices/lockdown-xml", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/lockdown-xml", "redirect_document_id": true }, { "source_path": "windows/manage/settings-that-can-be-locked-down.md", -"redirect_url": "/windows/configuration/mobile-devices/settings-that-can-be-locked-down", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/settings-that-can-be-locked-down", "redirect_document_id": true }, { "source_path": "windows/manage/product-ids-in-windows-10-mobile.md", -"redirect_url": "/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile", "redirect_document_id": true }, { "source_path": "windows/manage/manage-tips-and-suggestions.md", -"redirect_url": "/windows/configuration/manage-tips-and-suggestions", +"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-tips-and-suggestions", "redirect_document_id": true }, { "source_path": "windows/manage/windows-10-start-layout-options-and-policies.md", -"redirect_url": "/windows/configuration/windows-10-start-layout-options-and-policies", +"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-10-start-layout-options-and-policies", "redirect_document_id": true }, { "source_path": "windows/manage/configure-windows-10-taskbar.md", -"redirect_url": "/windows/configuration//configure-windows-10-taskbar", +"redirect_url": "https://docs.microsoft.com/windows/configuration//configure-windows-10-taskbar", "redirect_document_id": true }, { "source_path": "windows/manage/customize-and-export-start-layout.md", -"redirect_url": "/windows/configuration//customize-and-export-start-layout", +"redirect_url": "https://docs.microsoft.com/windows/configuration//customize-and-export-start-layout", "redirect_document_id": true }, { "source_path": "windows/manage/start-layout-xml-desktop.md", -"redirect_url": "/windows/configuration/start-layout-xml-desktop", +"redirect_url": "https://docs.microsoft.com/windows/configuration/start-layout-xml-desktop", "redirect_document_id": true }, { "source_path": "windows/manage/start-layout-xml-mobile.md", -"redirect_url": "/windows/configuration/mobile-devices/start-layout-xml-mobile", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/start-layout-xml-mobile", "redirect_document_id": true }, { "source_path": "windows/manage/customize-windows-10-start-screens-by-using-group-policy.md", -"redirect_url": "/windows/configuration/customize-windows-10-start-screens-by-using-group-policy", +"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-group-policy", "redirect_document_id": true }, { "source_path": "windows/manage/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", -"redirect_url": "/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", +"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", "redirect_document_id": true }, { "source_path": "windows/manage/customize-windows-10-start-screens-by-using-mobile-device-management.md", -"redirect_url": "/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management", +"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-testing-scenarios.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-scenario-1.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-scenario-2.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-scenario-3.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-scenario-4.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-scenario-5.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-scenario-6.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-o365.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-o365", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-o365", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-crm.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-crm", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-crm", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-powerbi.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-powerbi", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-powerbi", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-voice-commands.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-policy-settings.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-feedback.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-feedback", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-feedback", "redirect_document_id": true }, { "source_path": "windows/manage/stop-employees-from-using-the-windows-store.md", -"redirect_url": "/windows/configuration/stop-employees-from-using-the-windows-store", +"redirect_url": "https://docs.microsoft.com/windows/configuration/stop-employees-from-using-the-windows-store", "redirect_document_id": true }, { "source_path": "windows/configuration/stop-employees-from-using-the-windows-store.md", -"redirect_url": "/windows/configuration/stop-employees-from-using-microsoft-store", +"redirect_url": "https://docs.microsoft.com/windows/configuration/stop-employees-from-using-microsoft-store", "redirect_document_id": true }, { "source_path": "windows/manage/configure-devices-without-mdm.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", "redirect_document_id": false }, { "source_path": "windows/manage/changes-to-start-policies-in-windows-10.md", -"redirect_url": "/windows/configuration/changes-to-start-policies-in-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/configuration/changes-to-start-policies-in-windows-10", "redirect_document_id": true }, { "source_path": "windows/manage/how-it-pros-can-use-configuration-service-providers.md", -"redirect_url": "/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers", "redirect_document_id": true }, { "source_path": "windows/manage/lock-down-windows-10.md", -"redirect_url": "/windows/configuration/index", +"redirect_url": "https://docs.microsoft.com/windows/configuration/index", "redirect_document_id": true }, { "source_path": "windows/manage/manage-wifi-sense-in-enterprise.md", -"redirect_url": "/windows/configuration/manage-wifi-sense-in-enterprise", +"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-wifi-sense-in-enterprise", "redirect_document_id": true }, { "source_path": "windows/deploy/provisioning-packages.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", "redirect_document_id": true }, { "source_path": "windows/deploy/provisioning-how-it-works.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-how-it-works", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-how-it-works", "redirect_document_id": true }, { "source_path": "windows/deploy/provisioning-install-icd.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-install-icd", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-install-icd", "redirect_document_id": true }, { "source_path": "windows/deploy/provisioning-create-package.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-create-package", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package", "redirect_document_id": true }, { "source_path": "windows/deploy/provisioning-apply-package.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-apply-package", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package", "redirect_document_id": true }, { "source_path": "windows/deploy/provisioning-uninstall-package.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-uninstall-package", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-uninstall-package", "redirect_document_id": true }, { "source_path": "windows/deploy/provision-pcs-for-initial-deployment.md", -"redirect_url": "/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment", "redirect_document_id": true }, { "source_path": "windows/deploy/provision-pcs-with-apps-and-certificates.md", -"redirect_url": "/windows/configuration/provisioning-packages/provision-pcs-with-apps", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-with-apps", "redirect_document_id": true }, { "source_path": "windows/deploy/provisioning-script-to-install-app.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-script-to-install-app", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-script-to-install-app", "redirect_document_id": true }, { "source_path": "windows/deploy/provisioning-nfc.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-nfc", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-nfc", "redirect_document_id": true }, { "source_path": "windows/deploy/provisioning-command-line.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-command-line", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-command-line", "redirect_document_id": true }, { "source_path": "windows/deploy/provisioning-multivariant.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-multivariant", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-multivariant", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-edp-policy-using-intune.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-edp-policy-using-sccm.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-vpn-and-edp-policy-using-intune.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", "redirect_document_id": true }, { "source_path": "windows/keep-secure/hello-enable-phone-signin.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-identity-verification", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", "redirect_document_id": false }, { "source_path": "windows/keep-secure/deploy-edp-policy-using-intune.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune", "redirect_document_id": true }, { "source_path": "windows/keep-secure/guidance-and-best-practices-edp.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip", "redirect_document_id": true }, { "source_path": "windows/keep-secure/overview-create-edp-policy.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/overview-create-wip-policy", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/overview-create-wip-policy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/protect-enterprise-data-using-edp.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", "redirect_document_id": true }, { "source_path": "windows/keep-secure/testing-scenarios-for-edp.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip", "redirect_document_id": true }, { "source_path": "windows/keep-secure/wip-enterprise-overview.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", "redirect_document_id": false }, { "source_path": "windows/keep-secure/enlightened-microsoft-apps-and-edp.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", "redirect_document_id": true }, { "source_path": "windows/deploy/update-windows-10-images-with-provisioning-packages.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", "redirect_document_id": false }, { "source_path": "windows/deploy/upgrade-analytics-prepare-your-environment.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-identify-apps", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-identify-apps", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-release-notes.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-requirements", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-review-site-discovery.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-additional-insights", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/additional-configuration-windows-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-additional-insights", "redirect_document_id": true }, { "source_path": "windows/keep-secure/ad-ds-schema-extensions-to-support-tpm-backup.md", -"redirect_url": "https://technet.microsoft.com/library/jj635854.aspx", +"redirect_url": "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj635854(v=ws.11)", "redirect_document_id": true }, { "source_path": "windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md", -"redirect_url": "/windows/device-security/device-guard/device-guard-deployment-guide", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide", "redirect_document_id": true }, { "source_path": "windows/keep-secure/device-guard-certification-and-compliance.md", -"redirect_url": "/windows/device-security/device-guard/device-guard-deployment-guide", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide", "redirect_document_id": false }, { "source_path": "windows/keep-secure/enable-phone-signin-to-pc-and-vpn.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-enable-phone-signin", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-enable-phone-signin", "redirect_document_id": true }, { "source_path": "windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md", -"redirect_url": "/windows/device-security/device-guard/device-guard-deployment-guide", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide", "redirect_document_id": false }, { "source_path": "windows/keep-secure/implement-microsoft-passport-in-your-organization.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-manage-in-organization", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-manage-in-organization", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-identity-verification-using-microsoft-passport.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-identity-verification", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-passport-and-password-changes.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-and-password-changes", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-and-password-changes", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-passport-errors-during-pin-creation.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-errors-during-pin-creation", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-errors-during-pin-creation", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-passport-guide.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-identity-verification", -"redirect_document_id": false -}, -{ -"source_path": "windows/keep-secure/monitor-onboarding-windows-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", "redirect_document_id": false }, { "source_path": "windows/keep-secure/passport-event-300.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-event-300", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-event-300", "redirect_document_id": true }, { "source_path": "windows/keep-secure/prepare-people-to-use-microsoft-passport.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-prepare-people-to-use", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-prepare-people-to-use", "redirect_document_id": true }, { "source_path": "windows/keep-secure/why-a-pin-is-better-than-a-password.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-hello-in-enterprise.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-biometrics-in-enterprise", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-biometrics-in-enterprise", "redirect_document_id": true }, { "source_path": "windows/manage/app-inventory-managemement-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/app-inventory-management-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-microsoft-store-for-business", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business", +"redirect_document_id": false }, { "source_path": "windows/manage/application-development-for-windows-as-a-service.md", @@ -5807,177 +6708,177 @@ }, { "source_path": "windows/manage/appv-accessibility.md", -"redirect_url": "/windows/application-management/app-v/appv-getting-started", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-getting-started", "redirect_document_id": true }, { "source_path": "windows/manage/appv-accessing-the-client-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-using-the-client-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-using-the-client-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-install-the-appv-client-for-shared-content-store-mode.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", "redirect_document_id": true }, { "source_path": "windows/manage/appv-modify-client-configuration-with-the-admx-template-and-group-policy.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", "redirect_document_id": false }, { "source_path": "windows/manage/appv-planning-for-migrating-from-a-previous-version-of-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version", "redirect_document_id": true }, { "source_path": "windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md", -"redirect_url": "/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", +"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", "redirect_document_id": true }, { "source_path": "windows/manage/disconnect-your-organization-from-microsoft.md", -"redirect_url": "/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", +"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", "redirect_document_id": false }, { "source_path": "windows/manage/introduction-to-windows-10-servicing.md", -"redirect_url": "/windows/deployment/update/index", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/index", "redirect_document_id": true }, { "source_path": "windows/manage/manage-cortana-in-enterprise.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-overview", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview", "redirect_document_id": true }, { "source_path": "windows/manage/cortana-at-work-overview.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-overview", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview", "redirect_document_id": false }, { "source_path": "windows/manage/manage-inventory-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-managemement-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/app-inventory-managemement-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-managemement-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/uev-accessibility.md", -"redirect_url": "/windows/configuration/ue-v/uev-for-windows", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-for-windows", "redirect_document_id": true }, { "source_path": "windows/manage/uev-privacy-statement.md", -"redirect_url": "/windows/configuration/ue-v/uev-security-considerations", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-security-considerations", "redirect_document_id": true }, { "source_path": "windows/plan/act-community-ratings-and-process.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": true }, { "source_path": "windows/plan/act-database-configuration.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-database-migration.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-deployment-options.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-glossary.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/activating-and-closing-windows-in-acm.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-lps-share-permissions.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-operatingsystem-application-report.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-operatingsystem-computer-report.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-operatingsystem-device-report.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-product-and-documentation-resources.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-settings-dialog-box-preferences-tab.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-settings-dialog-box-settings-tab.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-toolbar-icons-in-acm.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-tools-packages-and-services.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/act-user-interface-reference.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/adding-or-editing-an-issue.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/adding-or-editing-a-solution.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/analyzing-your-compatibility-data.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/application-dialog-box.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/categorizing-your-compatibility-data.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { @@ -5987,77 +6888,77 @@ }, { "source_path": "windows/plan/common-compatibility-issues.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/compatibility-monitor-users-guide.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/computer-dialog-box.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/configuring-act.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/creating-and-editing-issues-and-solutions.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/creating-an-enterprise-environment-for-compatibility-testing.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/creating-an-inventory-collector-package.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/creating-a-runtime-analysis-package.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/customizing-your-report-views.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/data-sent-through-the-microsoft-compatibility-exchange.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/deciding-whether-to-fix-an-application-or-deploy-a-workaround.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/deciding-which-applications-to-test.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/deleting-a-data-collection-package.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/deploying-an-inventory-collector-package.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/deploying-a-runtime-analysis-package.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { @@ -6067,6822 +6968,6772 @@ }, { "source_path": "windows/plan/example-filter-queries.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/exporting-a-data-collection-package.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/filtering-your-compatibility-data.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/fixing-compatibility-issues.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/identifying-computers-for-inventory-collection.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/integration-with-management-solutions-.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wufb", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", "redirect_document_id": false }, { "source_path": "windows/plan/internet-explorer-web-site-report.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/labeling-data-in-acm.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/log-file-locations-for-data-collection-packages.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/managing-your-data-collection-packages.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/organizational-tasks-for-each-report-type.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/organizing-your-compatibility-data.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/prioritizing-your-compatibility-data.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/ratings-icons-in-acm.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/resolving-an-issue.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/saving-opening-and-exporting-reports.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/selecting-the-send-and-receive-status-for-an-application.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/selecting-your-compatibility-rating.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/selecting-your-deployment-status.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/sending-and-receiving-compatibility-data.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/settings-for-acm.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/setup-and-deployment.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wufb", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", "redirect_document_id": false }, { "source_path": "windows/plan/software-requirements-for-act.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/software-requirements-for-rap.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/taking-inventory-of-your-organization.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/testing-compatibility-on-the-target-platform.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/troubleshooting-act.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/troubleshooting-act-database-issues.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/troubleshooting-the-act-configuration-wizard.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/troubleshooting-the-act-log-processing-service.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/using-act.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/using-compatibility-monitor-to-send-feedback.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/viewing-your-compatibility-reports.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/websiteurl-dialog-box.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/welcome-to-act.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/whats-new-in-act-60.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": false }, { "source_path": "windows/plan/windows-10-guidance-for-education-environments.md", -"redirect_url": "/edu/windows/index", +"redirect_url": "https://docs.microsoft.com/education/windows", "redirect_document_id": true }, { "source_path": "windows/plan/windows-10-servicing-options.md", -"redirect_url": "/windows/deployment/update/waas-overview", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-overview", "redirect_document_id": false }, { "source_path": "windows/plan/windows-update-for-business.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wufb", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", "redirect_document_id": false }, { "source_path": "windows/whats-new/applocker.md", -"redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", +"redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", "redirect_document_id": true }, { "source_path": "windows/whats-new/bitlocker.md", -"redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", +"redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", "redirect_document_id": false }, { "source_path": "windows/whats-new/change-history-for-what-s-new-in-windows-10.md", -"redirect_url": "/windows/whats-new/index", +"redirect_url": "https://docs.microsoft.com/windows/whats-new/index", "redirect_document_id": true }, { "source_path": "windows/whats-new/credential-guard.md", -"redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", +"redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", "redirect_document_id": false }, { "source_path": "windows/whats-new/device-guard-overview.md", -"redirect_url": "/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control", "redirect_document_id": false }, { "source_path": "windows/whats-new/device-management.md", -"redirect_url": "/windows/client-management/index", +"redirect_url": "https://docs.microsoft.com/windows/client-management/index", "redirect_document_id": false }, { "source_path": "windows/whats-new/edge-ie11-whats-new-overview.md", -"redirect_url": "/microsoft-edge/deploy/enterprise-guidance-using-microsoft-edge-and-ie11", +"redirect_url": "https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility", "redirect_document_id": true }, { "source_path": "windows/whats-new/edp-whats-new-overview.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", "redirect_document_id": false }, { "source_path": "windows/whats-new/lockdown-features-windows-10.md", -"redirect_url": "/windows/configuration/lockdown-features-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/configuration/lockdown-features-windows-10", "redirect_document_id": false }, { "source_path": "windows/whats-new/microsoft-passport.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-identity-verification", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", "redirect_document_id": false }, { "source_path": "windows/whats-new/new-provisioning-packages.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", "redirect_document_id": false }, { "source_path": "windows/whats-new/security-auditing.md", -"redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", +"redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", "redirect_document_id": false }, { "source_path": "windows/whats-new/trusted-platform-module.md", -"redirect_url": "/windows/device-security/tpm/trusted-platform-module-overview", +"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-overview", "redirect_document_id": true }, { "source_path": "windows/whats-new/user-account-control.md", -"redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", +"redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", "redirect_document_id": false }, { "source_path": "windows/whats-new/windows-spotlight.md", -"redirect_url": "/windows/configuration/windows-spotlight", +"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-spotlight", "redirect_document_id": true }, { "source_path": "windows/whats-new/windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/windows-store-for-business-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview", "redirect_document_id": true }, { "source_path": "store-for-business/windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/microsoft-store-for-business-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/microsoft-store-for-business-overview", "redirect_document_id": true }, { "source_path": "windows/whats-new/windows-update-for-business.md", -"redirect_url": "/windows/whats-new/whats-new-windows-10-version-1507-and-1511", +"redirect_url": "https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1507-and-1511", "redirect_document_id": false }, { "source_path": "windows/keep-secure/windows-10-security-guide.md", -"redirect_url": "/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", "redirect_document_id": true }, { "source_path": "windows/whats-new/security.md", -"redirect_url": "/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", "redirect_document_id": false }, { "source_path": "windows/configure/basic-level-windows-diagnostic-events-and-fields-1703.md", -"redirect_url": "/windows/configuration/basic-level-windows-diagnostic-events-and-fields", +"redirect_url": "https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields", "redirect_document_id": true }, { "source_path": "windows/configure/change-history-for-configure-windows-10.md", -"redirect_url": "/windows/configuration/change-history-for-configure-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/configuration/change-history-for-configure-windows-10", "redirect_document_id": true }, { "source_path": "windows/configure/changes-to-start-policies-in-windows-10.md", -"redirect_url": "/windows/configuration/changes-to-start-policies-in-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/configuration/changes-to-start-policies-in-windows-10", "redirect_document_id": true }, { "source_path": "windows/configure/configure-devices-without-mdm.md", -"redirect_url": "/windows/configuration/configure-devices-without-mdm", +"redirect_url": "https://docs.microsoft.com/windows/configuration/configure-devices-without-mdm", "redirect_document_id": true }, { "source_path": "windows/configuration/configure-devices-without-mdm.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", "redirect_document_id": true }, { "source_path": "windows/configure/configure-mobile.md", -"redirect_url": "/windows/configuration/mobile-devices/configure-mobile", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/configure-mobile", "redirect_document_id": true }, { "source_path": "windows/configure/configure-windows-10-taskbar.md", -"redirect_url": "/windows/configuration/configure-windows-10-taskbar", +"redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-10-taskbar", "redirect_document_id": true }, { "source_path": "windows/configure/configure-windows-telemetry-in-your-organization.md", -"redirect_url": "/windows/configuration/configure-windows-diagnostic-data-in-your-organization", +"redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization", "redirect_document_id": true }, { "source_path": "windows/configuration/configure-windows-telemetry-in-your-organization.md", -"redirect_url": "/windows/configuration/configure-windows-diagnostic-data-in-your-organization", +"redirect_url": "https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-crm.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-crm", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-crm", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-feedback.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-feedback", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-feedback", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-o365.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-o365", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-o365", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-overview.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-overview", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-policy-settings.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-policy-settings", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-powerbi.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-powerbi", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-powerbi", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-scenario-1.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-1", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-scenario-2.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-2", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-scenario-3.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-3", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-scenario-4.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-4", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-scenario-5.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-5", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-scenario-6.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-6", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-scenario-7.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-scenario-7", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-testing-scenarios.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios", "redirect_document_id": true }, { "source_path": "windows/configure/cortana-at-work-voice-commands.md", -"redirect_url": "/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", +"redirect_url": "https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-voice-commands", "redirect_document_id": true }, { "source_path": "windows/configure/customize-and-export-start-layout.md", -"redirect_url": "/windows/configuration/customize-and-export-start-layout", +"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-and-export-start-layout", "redirect_document_id": true }, { "source_path": "windows/configure/customize-windows-10-start-screens-by-using-group-policy.md", -"redirect_url": "/windows/configuration/customize-windows-10-start-screens-by-using-group-policy", +"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-group-policy", "redirect_document_id": true }, { "source_path": "windows/configure/customize-windows-10-start-screens-by-using-mobile-device-management.md", -"redirect_url": "/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management", +"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management", "redirect_document_id": true }, { "source_path": "windows/configure/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md", -"redirect_url": "/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", +"redirect_url": "https://docs.microsoft.com/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd", "redirect_document_id": true }, { "source_path": "windows/configure/guidelines-for-assigned-access-app.md", -"redirect_url": "/windows/configuration/guidelines-for-assigned-access-app", +"redirect_url": "https://docs.microsoft.com/windows/configuration/guidelines-for-assigned-access-app", "redirect_document_id": true }, { "source_path": "windows/configure/how-it-pros-can-use-configuration-service-providers.md", -"redirect_url": "/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers", "redirect_document_id": true }, { "source_path": "windows/configure/kiosk-shared-pc.md", -"redirect_url": "/windows/configuration/kiosk-shared-pc", +"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-shared-pc", "redirect_document_id": true }, { "source_path": "windows/configuration/kiosk-shared-pc.md", -"redirect_url": "/windows/configuration/kiosk-methods", +"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-methods", "redirect_document_id": true }, { "source_path": "windows/configuration/setup-kiosk-digital-signage.md", -"redirect_url": "/windows/configuration/kiosk-single-app", +"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-single-app", "redirect_document_id": true }, { "source_path": "windows/configuration/multi-app-kiosk-xml.md", -"redirect_url": "/windows/configuration/kiosk-xml", +"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-xml", "redirect_document_id": true }, { "source_path": "windows/configuration/multi-app-kiosk-troubleshoot.md", -"redirect_url": "/windows/configuration/kiosk-troubleshoot", +"redirect_url": "https://docs.microsoft.com/windows/configuration/kiosk-troubleshoot", "redirect_document_id": true }, { "source_path": "windows/configure/lock-down-windows-10-to-specific-apps.md", -"redirect_url": "/windows/configuration/lock-down-windows-10-to-specific-apps", +"redirect_url": "https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps", "redirect_document_id": true }, { "source_path": "windows/configure/lock-down-windows-10.md", -"redirect_url": "/windows/configuration/lock-down-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/configuration/lock-down-windows-10", "redirect_document_id": true }, { "source_path": "windows/configure/lockdown-features-windows-10.md", -"redirect_url": "/windows/configuration/lockdown-features-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/configuration/lockdown-features-windows-10", "redirect_document_id": true }, { "source_path": "windows/configure/lockdown-xml.md", -"redirect_url": "/windows/configuration/mobile-devices/lockdown-xml", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/lockdown-xml", "redirect_document_id": true }, { "source_path": "windows/configure/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", -"redirect_url": "/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", +"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services", "redirect_document_id": true }, { "source_path": "windows/configure/manage-tips-and-suggestions.md", -"redirect_url": "/windows/configuration/manage-tips-and-suggestions", +"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-tips-and-suggestions", "redirect_document_id": true }, { "source_path": "windows/configure/manage-wifi-sense-in-enterprise.md", -"redirect_url": "/windows/configuration/manage-wifi-sense-in-enterprise", +"redirect_url": "https://docs.microsoft.com/windows/configuration/manage-wifi-sense-in-enterprise", "redirect_document_id": true }, { "source_path": "windows/configure/mobile-lockdown-designer.md", -"redirect_url": "/windows/configuration/mobile-devices/mobile-lockdown-designer", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/mobile-lockdown-designer", "redirect_document_id": true }, { "source_path": "windows/configure/product-ids-in-windows-10-mobile.md", -"redirect_url": "/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile", "redirect_document_id": true }, { "source_path": "windows/configure/provision-pcs-for-initial-deployment.md", -"redirect_url": "/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment", "redirect_document_id": true }, { "source_path": "windows/configure/provision-pcs-with-apps-and-certificates.md", -"redirect_url": "/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates", "redirect_document_id": true }, { "source_path": "windows/configure/provision-pcs-with-apps.md", -"redirect_url": "/windows/configuration/provisioning-packages/provision-pcs-with-apps", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provision-pcs-with-apps", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-apply-package.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-apply-package", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-apply-package", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-command-line.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-command-line", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-command-line", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-configure-mobile.md", -"redirect_url": "/windows/configuration/mobile-devices/provisioning-configure-mobile", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/provisioning-configure-mobile", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-create-package.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-create-package", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-how-it-works.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-how-it-works", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-how-it-works", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-install-icd.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-install-icd", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-install-icd", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-multivariant.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-multivariant", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-multivariant", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-nfc.md", -"redirect_url": "/windows/configuration/mobile-devices/provisioning-nfc", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/provisioning-nfc", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-package-splitter.md", -"redirect_url": "/windows/configuration/mobile-devices/provisioning-package-splitter", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/provisioning-package-splitter", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-packages.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-packages", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-powershell.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-powershell", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-powershell", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-script-to-install-app.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-script-to-install-app", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-script-to-install-app", "redirect_document_id": true }, { "source_path": "windows/configure/provisioning-uninstall-package.md", -"redirect_url": "/windows/configuration/provisioning-packages/provisioning-uninstall-package", +"redirect_url": "https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-uninstall-package", "redirect_document_id": true }, { "source_path": "windows/configure/set-up-a-device-for-anyone-to-use.md", -"redirect_url": "/windows/configuration/set-up-a-device-for-anyone-to-use", +"redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-a-device-for-anyone-to-use", "redirect_document_id": true }, { "source_path": "windows/configure/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", -"redirect_url": "/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions", +"redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions", "redirect_document_id": true }, { "source_path": "windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions.md", - "redirect_url": "/windows/configuration/setup-kiosk-digital-signage", + "redirect_url": "https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage", "redirect_document_id": true }, { "source_path": "windows/configure/set-up-a-kiosk-for-windows-10-for-mobile-edition.md", -"redirect_url": "/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition", "redirect_document_id": true }, { "source_path": "windows/configure/set-up-shared-or-guest-pc.md", -"redirect_url": "/windows/configuration/set-up-shared-or-guest-pc", +"redirect_url": "https://docs.microsoft.com/windows/configuration/set-up-shared-or-guest-pc", "redirect_document_id": true }, { "source_path": "windows/configure/settings-that-can-be-locked-down.md", -"redirect_url": "/windows/configuration/mobile-devices/settings-that-can-be-locked-down", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/settings-that-can-be-locked-down", "redirect_document_id": true }, { "source_path": "windows/configure/start-layout-xml-desktop.md", -"redirect_url": "/windows/configuration/start-layout-xml-desktop", +"redirect_url": "https://docs.microsoft.com/windows/configuration/start-layout-xml-desktop", "redirect_document_id": true }, { "source_path": "windows/configure/start-layout-xml-mobile.md", -"redirect_url": "/windows/configuration/mobile-devices/start-layout-xml-mobile", +"redirect_url": "https://docs.microsoft.com/windows/configuration/mobile-devices/start-layout-xml-mobile", "redirect_document_id": true }, { "source_path": "windows/configure/start-secondary-tiles.md", -"redirect_url": "/windows/configuration/start-secondary-tiles", +"redirect_url": "https://docs.microsoft.com/windows/configuration/start-secondary-tiles", "redirect_document_id": true }, { "source_path": "windows/configure/start-taskbar-lockscreen.md", -"redirect_url": "/windows/configuration/start-taskbar-lockscreen", +"redirect_url": "https://docs.microsoft.com/windows/configuration/start-taskbar-lockscreen", "redirect_document_id": true }, { "source_path": "windows/configuration/start-taskbar-lockscreen.md", -"redirect_url": "/windows/configuration/windows-10-start-layout-options-and-policies", +"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-10-start-layout-options-and-policies", "redirect_document_id": true }, { "source_path": "windows/configure/stop-employees-from-using-the-windows-store.md", -"redirect_url": "/windows/configuration/stop-employees-from-using-the-windows-store", +"redirect_url": "https://docs.microsoft.com/windows/configuration/stop-employees-from-using-the-windows-store", "redirect_document_id": true }, { "source_path": "windows/configure/windows-10-start-layout-options-and-policies.md", -"redirect_url": "/windows/configuration/windows-10-start-layout-options-and-policies", +"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-10-start-layout-options-and-policies", "redirect_document_id": true }, { "source_path": "windows/configure/windows-diagnostic-data-1703.md", -"redirect_url": "/windows/configuration/windows-diagnostic-data", +"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-diagnostic-data", "redirect_document_id": true }, { "source_path": "windows/configure/windows-spotlight.md", -"redirect_url": "/windows/configuration/windows-spotlight", +"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-spotlight", "redirect_document_id": true }, { "source_path": "windows/manage/windows-spotlight.md", -"redirect_url": "/windows/configuration/windows-spotlight", +"redirect_url": "https://docs.microsoft.com/windows/configuration/windows-spotlight", "redirect_document_id": true }, { "source_path": "windows/deploy/activate-forest-by-proxy-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/activate-forest-by-proxy-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-by-proxy-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/activate-forest-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/activate-forest-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/activate-using-active-directory-based-activation-client.md", -"redirect_url": "/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client", "redirect_document_id": true }, { "source_path": "windows/deploy/activate-using-key-management-service-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/activate-using-key-management-service-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-using-key-management-service-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/activate-windows-10-clients-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/activate-windows-10-clients-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/activate-windows-10-clients-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/active-directory-based-activation-overview.md", -"redirect_url": "/windows/deployment/volume-activation/active-directory-based-activation-overview", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/active-directory-based-activation-overview", "redirect_document_id": true }, { "source_path": "windows/deploy/add-a-windows-10-operating-system-image-using-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/add-a-windows-10-operating-system-image-using-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/deploy/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/deploy/add-manage-products-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/add-manage-products-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/add-manage-products-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/add-remove-computers-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/add-remove-computers-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/add-remove-computers-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/add-remove-product-key-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/add-remove-product-key-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/add-remove-product-key-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/appendix-information-sent-to-microsoft-during-activation-client.md", -"redirect_url": "/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client", "redirect_document_id": true }, { "source_path": "windows/deploy/assign-applications-using-roles-in-mdt-2013.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt-2013", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt-2013", "redirect_document_id": true }, { "source_path": "windows/deploy/assign-applications-using-roles-in-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/assign-applications-using-roles-in-mdt", "redirect_document_id": true }, { "source_path": "windows/deploy/build-a-distributed-environment-for-windows-10-deployment.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-10-deployment", "redirect_document_id": true }, { "source_path": "windows/deploy/change-history-for-deploy-windows-10.md", -"redirect_url": "/windows/deployment/change-history-for-deploy-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/deployment/change-history-for-deploy-windows-10", "redirect_document_id": true }, { "source_path": "windows/deploy/configure-a-pxe-server-to-load-windows-pe.md", -"redirect_url": "/windows/deployment/configure-a-pxe-server-to-load-windows-pe", +"redirect_url": "https://docs.microsoft.com/windows/deployment/configure-a-pxe-server-to-load-windows-pe", "redirect_document_id": true }, { "source_path": "windows/deploy/configure-client-computers-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/configure-client-computers-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/configure-client-computers-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/configure-mdt-2013-for-userexit-scripts.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-2013-for-userexit-scripts", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-2013-for-userexit-scripts", "redirect_document_id": true }, { "source_path": "windows/deploy/configure-mdt-2013-settings.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-2013-settings", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-2013-settings", "redirect_document_id": true }, { "source_path": "windows/deploy/configure-mdt-deployment-share-rules.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-deployment-share-rules", "redirect_document_id": true }, { "source_path": "windows/deploy/configure-mdt-for-userexit-scripts.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-for-userexit-scripts", "redirect_document_id": true }, { "source_path": "windows/deploy/configure-mdt-settings.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/configure-mdt-settings", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/configure-mdt-settings", "redirect_document_id": true }, { "source_path": "windows/deploy/create-a-custom-windows-pe-boot-image-with-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/create-a-custom-windows-pe-boot-image-with-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/deploy/create-a-task-sequence-with-configuration-manager-and-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt", "redirect_document_id": true }, { "source_path": "windows/deploy/create-a-windows-10-reference-image.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/create-a-windows-10-reference-image", "redirect_document_id": true }, { "source_path": "windows/deploy/create-an-application-to-deploy-with-windows-10-using-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/create-an-application-to-deploy-with-windows-10-using-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/deploy/deploy-a-windows-10-image-using-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt", "redirect_document_id": true }, { "source_path": "windows/deploy/deploy-whats-new.md", -"redirect_url": "/windows/deployment/deploy-whats-new", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-whats-new", "redirect_document_id": true }, { "source_path": "windows/deploy/deploy-windows-10-using-pxe-and-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/deploy-windows-10-using-pxe-and-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit", "redirect_document_id": true }, { "source_path": "windows/deploy/deploy-windows-to-go.md", -"redirect_url": "/windows/deployment/deploy-windows-to-go", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-to-go", "redirect_document_id": true }, { "source_path": "windows/deploy/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/finalize-the-os-configuration-for-windows-10-deployment-with-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/deploy/get-started-with-the-microsoft-deployment-toolkit.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit", "redirect_document_id": true }, { "source_path": "windows/deploy/getting-started-with-the-user-state-migration-tool.md", -"redirect_url": "/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool", "redirect_document_id": true }, { "source_path": "windows/deploy/import-export-vamt-data.md", -"redirect_url": "/windows/deployment/volume-activation/import-export-vamt-data", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/import-export-vamt-data", "redirect_document_id": true }, { "source_path": "windows/deploy/install-configure-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/install-configure-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-configure-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/install-kms-client-key-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/install-kms-client-key-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-kms-client-key-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/install-product-key-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/install-product-key-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-product-key-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/install-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/install-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/install-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/integrate-configuration-manager-with-mdt-2013.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt-2013", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt-2013", "redirect_document_id": true }, { "source_path": "windows/deploy/integrate-configuration-manager-with-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/integrate-configuration-manager-with-mdt", "redirect_document_id": true }, { "source_path": "windows/deploy/introduction-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/introduction-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/introduction-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/key-features-in-mdt-2013.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/key-features-in-mdt-2013", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/key-features-in-mdt-2013", "redirect_document_id": true }, { "source_path": "windows/deploy/key-features-in-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/key-features-in-mdt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/key-features-in-mdt", "redirect_document_id": true }, { "source_path": "windows/deploy/kms-activation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/kms-activation-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/kms-activation-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/local-reactivation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/local-reactivation-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/local-reactivation-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/manage-activations-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/manage-activations-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/manage-activations-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/manage-product-keys-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/manage-product-keys-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/manage-product-keys-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/manage-vamt-data.md", -"redirect_url": "/windows/deployment/volume-activation/manage-vamt-data", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/manage-vamt-data", "redirect_document_id": true }, { "source_path": "windows/deploy/manage-windows-upgrades-with-upgrade-analytics.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": true }, { "source_path": "windows/deploy/manage-windows-upgrades-with-upgrade-readiness.md", -"redirect_url": "/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness", "redirect_document_id": true }, { "source_path": "windows/deploy/mbr-to-gpt.md", -"redirect_url": "/windows/deployment/mbr-to-gpt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/mbr-to-gpt", "redirect_document_id": true }, { "source_path": "windows/deploy/mdt-2013-lite-touch-components.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/mdt-2013-lite-touch-components", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/mdt-2013-lite-touch-components", "redirect_document_id": true }, { "source_path": "windows/deploy/mdt-lite-touch-components.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/mdt-lite-touch-components", "redirect_document_id": true }, { "source_path": "windows/deploy/migrate-application-settings.md", -"redirect_url": "/windows/deployment/usmt/migrate-application-settings", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/migrate-application-settings", "redirect_document_id": true }, { "source_path": "windows/deploy/migration-store-types-overview.md", -"redirect_url": "/windows/deployment/usmt/migration-store-types-overview", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/migration-store-types-overview", "redirect_document_id": true }, { "source_path": "windows/deploy/monitor-activation-client.md", -"redirect_url": "/windows/deployment/volume-activation/monitor-activation-client", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/monitor-activation-client", "redirect_document_id": true }, { "source_path": "windows/deploy/monitor-windows-10-deployment-with-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/monitor-windows-10-deployment-with-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/deploy/offline-migration-reference.md", -"redirect_url": "/windows/deployment/usmt/offline-migration-reference", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/offline-migration-reference", "redirect_document_id": true }, { "source_path": "windows/deploy/online-activation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/online-activation-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/online-activation-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/plan-for-volume-activation-client.md", -"redirect_url": "/windows/deployment/volume-activation/plan-for-volume-activation-client", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/plan-for-volume-activation-client", "redirect_document_id": true }, { "source_path": "windows/deploy/prepare-for-windows-deployment-with-mdt-2013.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt-2013", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt-2013", "redirect_document_id": true }, { "source_path": "windows/deploy/prepare-for-windows-deployment-with-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt", "redirect_document_id": true }, { "source_path": "windows/deploy/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/deploy/proxy-activation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/proxy-activation-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/proxy-activation-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/refresh-a-windows-7-client-with-windows-10-using-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/deploy/refresh-a-windows-7-computer-with-windows-10.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/refresh-a-windows-7-computer-with-windows-10", "redirect_document_id": true }, { "source_path": "windows/deploy/remove-products-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/remove-products-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/remove-products-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/replace-a-windows-7-client-with-windows-10-using-configuration-manager.md", -"redirect_url": "/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-sccm/replace-a-windows-7-client-with-windows-10-using-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/deploy/replace-a-windows-7-computer-with-a-windows-10-computer.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/replace-a-windows-7-computer-with-a-windows-10-computer", "redirect_document_id": true }, { "source_path": "windows/deploy/resolve-windows-10-upgrade-errors.md", -"redirect_url": "/windows/deployment/upgrade/resolve-windows-10-upgrade-errors", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/resolve-windows-10-upgrade-errors", "redirect_document_id": true }, { "source_path": "windows/deploy/scenario-kms-activation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/scenario-kms-activation-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/scenario-kms-activation-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/scenario-online-activation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/scenario-online-activation-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/scenario-online-activation-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/scenario-proxy-activation-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/scenario-proxy-activation-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/scenario-proxy-activation-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/set-up-mdt-2013-for-bitlocker.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/set-up-mdt-2013-for-bitlocker", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/set-up-mdt-2013-for-bitlocker", "redirect_document_id": true }, { "source_path": "windows/deploy/set-up-mdt-for-bitlocker.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker", "redirect_document_id": true }, { "source_path": "windows/deploy/sideload-apps-in-windows-10.md", -"redirect_url": "/windows/application-management/sideload-apps-in-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/application-management/sideload-apps-in-windows-10", "redirect_document_id": true }, { "source_path": "windows/deploy/simulate-a-windows-10-deployment-in-a-test-environment.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/simulate-a-windows-10-deployment-in-a-test-environment", "redirect_document_id": true }, { "source_path": "windows/deploy/troubleshoot-upgrade-analytics.md", -"redirect_url": "/windows/deployment/upgrade/troubleshoot-upgrade-readiness", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-readiness", "redirect_document_id": true }, { "source_path": "windows/deploy/troubleshoot-upgrade-readiness.md", -"redirect_url": "/windows/deployment/upgrade/troubleshoot-upgrade-readiness", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-readiness", +"redirect_document_id": false }, { "source_path": "windows/deploy/understanding-migration-xml-files.md", -"redirect_url": "/windows/deployment/usmt/understanding-migration-xml-files", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/understanding-migration-xml-files", "redirect_document_id": true }, { "source_path": "windows/deploy/update-product-status-vamt.md", -"redirect_url": "/windows/deployment/volume-activation/update-product-status-vamt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/update-product-status-vamt", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-additional-insights.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-additional-insights", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-additional-insights", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-architecture.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-architecture", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-architecture", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-deploy-windows.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-deploy-windows", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deploy-windows", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-deployment-script.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-deployment-script", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deployment-script", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-get-started.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-get-started", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-identify-apps.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-identify-apps", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-identify-apps", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-requirements.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-requirements", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-resolve-issues.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-resolve-issues", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-resolve-issues", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-analytics-upgrade-overview.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-upgrade-overview", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-upgrade-overview", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-readiness-additional-insights.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-additional-insights", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-additional-insights", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-readiness-architecture.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-architecture", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-architecture", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-readiness-deploy-windows.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-deploy-windows", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deploy-windows", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-readiness-deployment-script.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-deployment-script", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deployment-script", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-readiness-get-started.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-get-started", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-readiness-identify-apps.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-identify-apps", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-identify-apps", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-readiness-release-notes.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-release-notes", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-release-notes", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-readiness-requirements.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-requirements", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-readiness-resolve-issues.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-resolve-issues", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-resolve-issues", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-readiness-upgrade-overview.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-upgrade-overview", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-upgrade-overview", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-windows-phone-8-1-to-10.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10", "redirect_document_id": true }, { "source_path": "windows/deploy/use-orchestrator-runbooks-with-mdt-2013.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt-2013", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt-2013", "redirect_document_id": true }, { "source_path": "windows/deploy/use-orchestrator-runbooks-with-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-orchestrator-runbooks-with-mdt", "redirect_document_id": true }, { "source_path": "windows/deploy/use-the-mdt-database-to-stage-windows-10-deployment-information.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-the-mdt-database-to-stage-windows-10-deployment-information", "redirect_document_id": true }, { "source_path": "windows/deploy/use-the-volume-activation-management-tool-client.md", -"redirect_url": "/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client", "redirect_document_id": true }, { "source_path": "windows/deploy/use-upgrade-analytics-to-manage-windows-upgrades.md", -"redirect_url": "/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", "redirect_document_id": true }, { "source_path": "windows/deploy/use-upgrade-readiness-to-manage-windows-upgrades.md", -"redirect_url": "/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades", +"redirect_document_id": false }, { "source_path": "windows/deploy/use-vamt-in-windows-powershell.md", -"redirect_url": "/windows/deployment/volume-activation/use-vamt-in-windows-powershell", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/use-vamt-in-windows-powershell", "redirect_document_id": true }, { "source_path": "windows/deploy/use-web-services-in-mdt-2013.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt-2013", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt-2013", "redirect_document_id": true }, { "source_path": "windows/deploy/use-web-services-in-mdt.md", -"redirect_url": "/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/use-web-services-in-mdt", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-best-practices.md", -"redirect_url": "/windows/deployment/usmt/usmt-best-practices", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-best-practices", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-choose-migration-store-type.md", -"redirect_url": "/windows/deployment/usmt/usmt-choose-migration-store-type", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-choose-migration-store-type", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-command-line-syntax.md", -"redirect_url": "/windows/deployment/usmt/usmt-command-line-syntax", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-command-line-syntax", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-common-issues.md", -"redirect_url": "/windows/deployment/usmt/usmt-common-issues", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-common-migration-scenarios.md", -"redirect_url": "/windows/deployment/usmt/usmt-common-migration-scenarios", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-common-migration-scenarios", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-configxml-file.md", -"redirect_url": "/windows/deployment/usmt/usmt-configxml-file", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-configxml-file", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-conflicts-and-precedence.md", -"redirect_url": "/windows/deployment/usmt/usmt-conflicts-and-precedence", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-conflicts-and-precedence", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-custom-xml-examples.md", -"redirect_url": "/windows/deployment/usmt/usmt-custom-xml-examples", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-custom-xml-examples", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-customize-xml-files.md", -"redirect_url": "/windows/deployment/usmt/usmt-customize-xml-files", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-customize-xml-files", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-determine-what-to-migrate.md", -"redirect_url": "/windows/deployment/usmt/usmt-determine-what-to-migrate", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-determine-what-to-migrate", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-estimate-migration-store-size.md", -"redirect_url": "/windows/deployment/usmt/usmt-estimate-migration-store-size", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-estimate-migration-store-size", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-exclude-files-and-settings.md", -"redirect_url": "/windows/deployment/usmt/usmt-exclude-files-and-settings", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-exclude-files-and-settings", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-extract-files-from-a-compressed-migration-store.md", -"redirect_url": "/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-faq.md", -"redirect_url": "/windows/deployment/usmt/usmt-faq", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-faq", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-general-conventions.md", -"redirect_url": "/windows/deployment/usmt/usmt-general-conventions", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-general-conventions", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-hard-link-migration-store.md", -"redirect_url": "/windows/deployment/usmt/usmt-hard-link-migration-store", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-hard-link-migration-store", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-how-it-works.md", -"redirect_url": "/windows/deployment/usmt/usmt-how-it-works", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-how-it-works", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-how-to.md", -"redirect_url": "/windows/deployment/usmt/usmt-how-to", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-how-to", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-identify-application-settings.md", -"redirect_url": "/windows/deployment/usmt/usmt-identify-application-settings", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-application-settings", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-identify-file-types-files-and-folders.md", -"redirect_url": "/windows/deployment/usmt/usmt-identify-file-types-files-and-folders", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-file-types-files-and-folders", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-identify-operating-system-settings.md", -"redirect_url": "/windows/deployment/usmt/usmt-identify-operating-system-settings", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-operating-system-settings", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-identify-users.md", -"redirect_url": "/windows/deployment/usmt/usmt-identify-users", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-identify-users", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-include-files-and-settings.md", -"redirect_url": "/windows/deployment/usmt/usmt-include-files-and-settings", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-include-files-and-settings", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-loadstate-syntax.md", -"redirect_url": "/windows/deployment/usmt/usmt-loadstate-syntax", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-loadstate-syntax", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-log-files.md", -"redirect_url": "/windows/deployment/usmt/usmt-log-files", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-log-files", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-migrate-efs-files-and-certificates.md", -"redirect_url": "/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-migrate-user-accounts.md", -"redirect_url": "/windows/deployment/usmt/usmt-migrate-user-accounts", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-migrate-user-accounts", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-migration-store-encryption.md", -"redirect_url": "/windows/deployment/usmt/usmt-migration-store-encryption", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-migration-store-encryption", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-overview.md", -"redirect_url": "/windows/deployment/usmt/usmt-overview", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-overview", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-plan-your-migration.md", -"redirect_url": "/windows/deployment/usmt/usmt-plan-your-migration", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-plan-your-migration", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-recognized-environment-variables.md", -"redirect_url": "/windows/deployment/usmt/usmt-recognized-environment-variables", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-recognized-environment-variables", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-reference.md", -"redirect_url": "/windows/deployment/usmt/usmt-reference", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-reference", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-requirements.md", -"redirect_url": "/windows/deployment/usmt/usmt-requirements", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-requirements", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-reroute-files-and-settings.md", -"redirect_url": "/windows/deployment/usmt/usmt-reroute-files-and-settings", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-reroute-files-and-settings", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-resources.md", -"redirect_url": "/windows/deployment/usmt/usmt-resources", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-resources", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-return-codes.md", -"redirect_url": "/windows/deployment/usmt/usmt-return-codes", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-return-codes", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-scanstate-syntax.md", -"redirect_url": "/windows/deployment/usmt/usmt-scanstate-syntax", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-scanstate-syntax", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-technical-reference.md", -"redirect_url": "/windows/deployment/usmt/usmt-technical-reference", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-technical-reference", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-test-your-migration.md", -"redirect_url": "/windows/deployment/usmt/usmt-test-your-migration", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-test-your-migration", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-topics.md", -"redirect_url": "/windows/deployment/usmt/usmt-topics", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-topics", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-troubleshooting.md", -"redirect_url": "/windows/deployment/usmt/usmt-troubleshooting", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-troubleshooting", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-utilities.md", -"redirect_url": "/windows/deployment/usmt/usmt-utilities", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-utilities", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-what-does-usmt-migrate.md", -"redirect_url": "/windows/deployment/usmt/usmt-what-does-usmt-migrate", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-what-does-usmt-migrate", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-xml-elements-library.md", -"redirect_url": "/windows/deployment/usmt/usmt-xml-elements-library", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-xml-elements-library", "redirect_document_id": true }, { "source_path": "windows/deploy/usmt-xml-reference.md", -"redirect_url": "/windows/deployment/usmt/usmt-xml-reference", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/usmt-xml-reference", "redirect_document_id": true }, { "source_path": "windows/deploy/vamt-known-issues.md", -"redirect_url": "/windows/deployment/volume-activation/vamt-known-issues", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/vamt-known-issues", "redirect_document_id": true }, { "source_path": "windows/deploy/vamt-requirements.md", -"redirect_url": "/windows/deployment/volume-activation/vamt-requirements", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/vamt-requirements", "redirect_document_id": true }, { "source_path": "windows/deploy/vamt-step-by-step.md", -"redirect_url": "/windows/deployment/volume-activation/vamt-step-by-step", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/vamt-step-by-step", "redirect_document_id": true }, { "source_path": "windows/deploy/verify-the-condition-of-a-compressed-migration-store.md", -"redirect_url": "/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store", "redirect_document_id": true }, { "source_path": "windows/deploy/volume-activation-management-tool.md", -"redirect_url": "/windows/deployment/volume-activation/volume-activation-management-tool", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-management-tool", "redirect_document_id": true }, { "source_path": "windows/deploy/volume-activation-windows-10.md", -"redirect_url": "/windows/deployment/volume-activation/volume-activation-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-windows-10", "redirect_document_id": true }, { "source_path": "windows/deploy/windows-10-deployment-scenarios.md", -"redirect_url": "/windows/deployment/windows-10-deployment-scenarios", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-deployment-scenarios", "redirect_document_id": true }, { "source_path": "windows/deploy/windows-10-deployment-tools-reference.md", -"redirect_url": "/windows/deployment/windows-10-deployment-tools-reference", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-deployment-tools-reference", "redirect_document_id": true }, { "source_path": "windows/deploy/windows-10-edition-upgrades.md", -"redirect_url": "/windows/deployment/upgrade/windows-10-edition-upgrades", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-10-edition-upgrades", "redirect_document_id": true }, { "source_path": "windows/deploy/windows-10-enterprise-e3-overview.md", -"redirect_url": "/windows/deployment/windows-10-enterprise-e3-overview", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-enterprise-e3-overview", "redirect_document_id": true }, { "source_path": "windows/deploy/windows-10-poc-mdt.md", -"redirect_url": "/windows/deployment/windows-10-poc-mdt", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-poc-mdt", "redirect_document_id": true }, { "source_path": "windows/deploy/windows-10-poc-sc-config-mgr.md", -"redirect_url": "/windows/deployment/windows-10-poc-sc-config-mgr", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-poc-sc-config-mgr", "redirect_document_id": true }, { "source_path": "windows/deploy/windows-10-poc.md", -"redirect_url": "/windows/deployment/windows-10-poc", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-poc", "redirect_document_id": true }, { "source_path": "windows/deploy/windows-10-upgrade-paths.md", -"redirect_url": "/windows/deployment/upgrade/windows-10-upgrade-paths", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-10-upgrade-paths", "redirect_document_id": true }, { "source_path": "windows/deploy/windows-adk-scenarios-for-it-pros.md", -"redirect_url": "/windows/deployment/windows-adk-scenarios-for-it-pros", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-adk-scenarios-for-it-pros", "redirect_document_id": true }, { "source_path": "windows/deploy/windows-deployment-scenarios-and-tools.md", -"redirect_url": "/windows/deployment/windows-deployment-scenarios-and-tools", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-deployment-scenarios-and-tools", "redirect_document_id": true }, { "source_path": "windows/deploy/windows-upgrade-and-migration-considerations.md", -"redirect_url": "/windows/deployment/upgrade/windows-upgrade-and-migration-considerations", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-upgrade-and-migration-considerations", "redirect_document_id": true }, { "source_path": "windows/deploy/xml-file-requirements.md", -"redirect_url": "/windows/deployment/usmt/xml-file-requirements", +"redirect_url": "https://docs.microsoft.com/windows/deployment/usmt/xml-file-requirements", "redirect_document_id": true }, { "source_path": "windows/keep-secure/access-control.md", -"redirect_url": "/windows/access-protection/access-control/access-control", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/access-control", "redirect_document_id": true }, { "source_path": "windows/keep-secure/access-credential-manager-as-a-trusted-caller.md", -"redirect_url": "/windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/access-credential-manager-as-a-trusted-caller", "redirect_document_id": true }, { "source_path": "windows/keep-secure/access-this-computer-from-the-network.md", -"redirect_url": "/windows/device-security/security-policy-settings/access-this-computer-from-the-network", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/access-this-computer-from-the-network", "redirect_document_id": true }, { "source_path": "windows/keep-secure/account-lockout-duration.md", -"redirect_url": "/windows/device-security/security-policy-settings/account-lockout-duration", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-lockout-duration", "redirect_document_id": true }, { "source_path": "windows/keep-secure/account-lockout-policy.md", -"redirect_url": "/windows/device-security/security-policy-settings/account-lockout-policy", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-lockout-policy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/account-lockout-threshold.md", -"redirect_url": "/windows/device-security/security-policy-settings/account-lockout-threshold", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-lockout-threshold", "redirect_document_id": true }, { "source_path": "windows/keep-secure/account-policies.md", -"redirect_url": "/windows/device-security/security-policy-settings/account-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/account-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/accounts-administrator-account-status.md", -"redirect_url": "/windows/device-security/security-policy-settings/accounts-administrator-account-status", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-administrator-account-status", "redirect_document_id": true }, { "source_path": "windows/keep-secure/accounts-block-microsoft-accounts.md", -"redirect_url": "/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts", "redirect_document_id": true }, { "source_path": "windows/keep-secure/accounts-guest-account-status.md", -"redirect_url": "/windows/device-security/security-policy-settings/accounts-guest-account-status", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-guest-account-status", "redirect_document_id": true }, { "source_path": "windows/keep-secure/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only.md", -"redirect_url": "/windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-limit-local-account-use-of-blank-passwords-to-console-logon-only", "redirect_document_id": true }, { "source_path": "windows/keep-secure/accounts-rename-administrator-account.md", -"redirect_url": "/windows/device-security/security-policy-settings/accounts-rename-administrator-account", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-rename-administrator-account", "redirect_document_id": true }, { "source_path": "windows/keep-secure/accounts-rename-guest-account.md", -"redirect_url": "/windows/device-security/security-policy-settings/accounts-rename-guest-account", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/accounts-rename-guest-account", "redirect_document_id": true }, { "source_path": "windows/keep-secure/act-as-part-of-the-operating-system.md", -"redirect_url": "/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system", "redirect_document_id": true }, { "source_path": "windows/keep-secure/active-directory-accounts.md", -"redirect_url": "/windows/access-protection/access-control/active-directory-accounts", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/active-directory-accounts", "redirect_document_id": true }, { "source_path": "windows/keep-secure/active-directory-security-groups.md", -"redirect_url": "/windows/access-protection/access-control/active-directory-security-groups", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/active-directory-security-groups", "redirect_document_id": true }, { "source_path": "windows/keep-secure/add-production-devices-to-the-membership-group-for-a-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/add-production-devices-to-the-membership-group-for-a-zone", "redirect_document_id": true }, { "source_path": "windows/keep-secure/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md", -"redirect_url": "/windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set", "redirect_document_id": true }, { "source_path": "windows/keep-secure/add-test-devices-to-the-membership-group-for-a-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/add-test-devices-to-the-membership-group-for-a-zone", "redirect_document_id": true }, { "source_path": "windows/keep-secure/add-workstations-to-domain.md", -"redirect_url": "/windows/device-security/security-policy-settings/add-workstations-to-domain", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/add-workstations-to-domain", "redirect_document_id": true }, { "source_path": "windows/keep-secure/additional-mitigations.md", -"redirect_url": "/windows/access-protection/credential-guard/additional-mitigations", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/additional-mitigations", "redirect_document_id": true }, { "source_path": "windows/keep-secure/adjust-memory-quotas-for-a-process.md", -"redirect_url": "/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process", "redirect_document_id": true }, { "source_path": "windows/keep-secure/administer-applocker.md", -"redirect_url": "/windows/device-security/applocker/administer-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/administer-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/administer-security-policy-settings.md", -"redirect_url": "/windows/device-security/security-policy-settings/administer-security-policy-settings", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/advanced-features-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/administer-security-policy-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/advanced-security-audit-policy-settings.md", -"redirect_url": "/windows/device-security/auditing/advanced-security-audit-policy-settings", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/advanced-security-audit-policy-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/advanced-security-auditing-faq.md", -"redirect_url": "/windows/device-security/auditing/advanced-security-auditing-faq", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/advanced-security-auditing-faq", "redirect_document_id": true }, { "source_path": "windows/keep-secure/advanced-security-auditing.md", -"redirect_url": "/windows/device-security/auditing/advanced-security-auditing", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/advanced-security-auditing", "redirect_document_id": true }, { "source_path": "windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/allow-log-on-locally.md", -"redirect_url": "/windows/device-security/security-policy-settings/allow-log-on-locally", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/allow-log-on-locally", "redirect_document_id": true }, { "source_path": "windows/keep-secure/allow-log-on-through-remote-desktop-services.md", -"redirect_url": "/windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services", "redirect_document_id": true }, { "source_path": "windows/keep-secure/api-portal-mapping-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/app-behavior-with-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/app-behavior-with-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/app-behavior-with-wip", "redirect_document_id": true }, { "source_path": "windows/keep-secure/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide.md", -"redirect_url": "/windows/access-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/appendix-a-sample-gpo-template-files-for-settings-used-in-this-guide", "redirect_document_id": true }, { "source_path": "windows/keep-secure/appendix-a-security-monitoring-recommendations-for-many-audit-events.md", -"redirect_url": "/windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/applocker-architecture-and-components.md", -"redirect_url": "/windows/device-security/applocker/applocker-architecture-and-components", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-architecture-and-components", "redirect_document_id": true }, { "source_path": "windows/keep-secure/applocker-functions.md", -"redirect_url": "/windows/device-security/applocker/applocker-functions", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-functions", "redirect_document_id": true }, { "source_path": "windows/keep-secure/applocker-overview.md", -"redirect_url": "/windows/device-security/applocker/applocker-overview", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-overview", "redirect_document_id": true }, { "source_path": "windows/keep-secure/applocker-policies-deployment-guide.md", -"redirect_url": "/windows/device-security/applocker/applocker-policies-deployment-guide", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-policies-deployment-guide", "redirect_document_id": true }, { "source_path": "windows/keep-secure/applocker-policies-design-guide.md", -"redirect_url": "/windows/device-security/applocker/applocker-policies-design-guide", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-policies-design-guide", "redirect_document_id": true }, { "source_path": "windows/keep-secure/applocker-policy-use-scenarios.md", -"redirect_url": "/windows/device-security/applocker/applocker-policy-use-scenarios", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-policy-use-scenarios", "redirect_document_id": true }, { "source_path": "windows/keep-secure/applocker-processes-and-interactions.md", -"redirect_url": "/windows/device-security/applocker/applocker-processes-and-interactions", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-processes-and-interactions", "redirect_document_id": true }, { "source_path": "windows/keep-secure/applocker-settings.md", -"redirect_url": "/windows/device-security/applocker/applocker-settings", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/applocker-technical-reference.md", -"redirect_url": "/windows/device-security/applocker/applocker-technical-reference", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/applocker-technical-reference", "redirect_document_id": true }, { "source_path": "windows/keep-secure/apply-a-basic-audit-policy-on-a-file-or-folder.md", -"redirect_url": "/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/apply-a-basic-audit-policy-on-a-file-or-folder", "redirect_document_id": true }, { "source_path": "windows/keep-secure/assign-security-group-filters-to-the-gpo.md", -"redirect_url": "/windows/access-protection/windows-firewall/assign-security-group-filters-to-the-gpo", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/assign-security-group-filters-to-the-gpo", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-account-lockout.md", -"redirect_url": "/windows/device-security/auditing/audit-account-lockout", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-account-lockout", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-application-generated.md", -"redirect_url": "/windows/device-security/auditing/audit-application-generated", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-application-generated", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-application-group-management.md", -"redirect_url": "/windows/device-security/auditing/audit-application-group-management", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-application-group-management", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-audit-policy-change.md", -"redirect_url": "/windows/device-security/auditing/audit-audit-policy-change", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-audit-policy-change", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-audit-the-access-of-global-system-objects.md", -"redirect_url": "/windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-audit-the-access-of-global-system-objects", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-audit-the-use-of-backup-and-restore-privilege.md", -"redirect_url": "/windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-audit-the-use-of-backup-and-restore-privilege", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-authentication-policy-change.md", -"redirect_url": "/windows/device-security/auditing/audit-authentication-policy-change", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-authentication-policy-change", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-authorization-policy-change.md", -"redirect_url": "/windows/device-security/auditing/audit-authorization-policy-change", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-authorization-policy-change", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-central-access-policy-staging.md", -"redirect_url": "/windows/device-security/auditing/audit-central-access-policy-staging", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-central-access-policy-staging", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-certification-services.md", -"redirect_url": "/windows/device-security/auditing/audit-certification-services", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-certification-services", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-computer-account-management.md", -"redirect_url": "/windows/device-security/auditing/audit-computer-account-management", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-computer-account-management", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-credential-validation.md", -"redirect_url": "/windows/device-security/auditing/audit-credential-validation", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-credential-validation", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-detailed-directory-service-replication.md", -"redirect_url": "/windows/device-security/auditing/audit-detailed-directory-service-replication", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-detailed-directory-service-replication", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-detailed-file-share.md", -"redirect_url": "/windows/device-security/auditing/audit-detailed-file-share", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-detailed-file-share", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-directory-service-access.md", -"redirect_url": "/windows/device-security/auditing/audit-directory-service-access", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-directory-service-access", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-directory-service-changes.md", -"redirect_url": "/windows/device-security/auditing/audit-directory-service-changes", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-directory-service-changes", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-directory-service-replication.md", -"redirect_url": "/windows/device-security/auditing/audit-directory-service-replication", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-directory-service-replication", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-distribution-group-management.md", -"redirect_url": "/windows/device-security/auditing/audit-distribution-group-management", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-distribution-group-management", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-dpapi-activity.md", -"redirect_url": "/windows/device-security/auditing/audit-dpapi-activity", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-dpapi-activity", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-file-share.md", -"redirect_url": "/windows/device-security/auditing/audit-file-share", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-file-share", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-file-system.md", -"redirect_url": "/windows/device-security/auditing/audit-file-system", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-file-system", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-filtering-platform-connection.md", -"redirect_url": "/windows/device-security/auditing/audit-filtering-platform-connection", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-filtering-platform-connection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-filtering-platform-packet-drop.md", -"redirect_url": "/windows/device-security/auditing/audit-filtering-platform-packet-drop", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-filtering-platform-packet-drop", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-filtering-platform-policy-change.md", -"redirect_url": "/windows/device-security/auditing/audit-filtering-platform-policy-change", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-filtering-platform-policy-change", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-force-audit-policy-subcategory-settings-to-override.md", -"redirect_url": "/windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-force-audit-policy-subcategory-settings-to-override", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-group-membership.md", -"redirect_url": "/windows/device-security/auditing/audit-group-membership", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-group-membership", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-handle-manipulation.md", -"redirect_url": "/windows/device-security/auditing/audit-handle-manipulation", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-handle-manipulation", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-ipsec-driver.md", -"redirect_url": "/windows/device-security/auditing/audit-ipsec-driver", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-driver", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-ipsec-extended-mode.md", -"redirect_url": "/windows/device-security/auditing/audit-ipsec-extended-mode", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-extended-mode", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-ipsec-main-mode.md", -"redirect_url": "/windows/device-security/auditing/audit-ipsec-main-mode", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-main-mode", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-ipsec-quick-mode.md", -"redirect_url": "/windows/device-security/auditing/audit-ipsec-quick-mode", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-ipsec-quick-mode", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-kerberos-authentication-service.md", -"redirect_url": "/windows/device-security/auditing/audit-kerberos-authentication-service", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-kerberos-authentication-service", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-kerberos-service-ticket-operations.md", -"redirect_url": "/windows/device-security/auditing/audit-kerberos-service-ticket-operations", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-kerberos-service-ticket-operations", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-kernel-object.md", -"redirect_url": "/windows/device-security/auditing/audit-kernel-object", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-kernel-object", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-logoff.md", -"redirect_url": "/windows/device-security/auditing/audit-logoff", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-logoff", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-logon.md", -"redirect_url": "/windows/device-security/auditing/audit-logon", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-logon", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-mpssvc-rule-level-policy-change.md", -"redirect_url": "/windows/device-security/auditing/audit-mpssvc-rule-level-policy-change", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-mpssvc-rule-level-policy-change", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-network-policy-server.md", -"redirect_url": "/windows/device-security/auditing/audit-network-policy-server", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-network-policy-server", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-non-sensitive-privilege-use.md", -"redirect_url": "/windows/device-security/auditing/audit-non-sensitive-privilege-use", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-non-sensitive-privilege-use", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-other-account-logon-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-account-logon-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-account-logon-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-other-account-management-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-account-management-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-account-management-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-other-logonlogoff-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-logonlogoff-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-logonlogoff-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-other-object-access-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-object-access-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-object-access-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-other-policy-change-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-policy-change-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-policy-change-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-other-privilege-use-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-privilege-use-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-privilege-use-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-other-system-events.md", -"redirect_url": "/windows/device-security/auditing/audit-other-system-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-other-system-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-pnp-activity.md", -"redirect_url": "/windows/device-security/auditing/audit-pnp-activity", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-pnp-activity", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-policy.md", -"redirect_url": "/windows/device-security/security-policy-settings/audit-policy", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-policy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-process-creation.md", -"redirect_url": "/windows/device-security/auditing/audit-process-creation", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-process-creation", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-process-termination.md", -"redirect_url": "/windows/device-security/auditing/audit-process-termination", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-process-termination", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-registry.md", -"redirect_url": "/windows/device-security/auditing/audit-registry", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-registry", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-removable-storage.md", -"redirect_url": "/windows/device-security/auditing/audit-removable-storage", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-removable-storage", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-rpc-events.md", -"redirect_url": "/windows/device-security/auditing/audit-rpc-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-rpc-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-sam.md", -"redirect_url": "/windows/device-security/auditing/audit-sam", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-sam", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-security-group-management.md", -"redirect_url": "/windows/device-security/auditing/audit-security-group-management", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-security-group-management", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-security-state-change.md", -"redirect_url": "/windows/device-security/auditing/audit-security-state-change", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-security-state-change", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-security-system-extension.md", -"redirect_url": "/windows/device-security/auditing/audit-security-system-extension", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-security-system-extension", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-sensitive-privilege-use.md", -"redirect_url": "/windows/device-security/auditing/audit-sensitive-privilege-use", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-sensitive-privilege-use", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-shut-down-system-immediately-if-unable-to-log-security-audits.md", -"redirect_url": "/windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/audit-shut-down-system-immediately-if-unable-to-log-security-audits", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-special-logon.md", -"redirect_url": "/windows/device-security/auditing/audit-special-logon", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-special-logon", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-system-integrity.md", -"redirect_url": "/windows/device-security/auditing/audit-system-integrity", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-system-integrity", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-user-account-management.md", -"redirect_url": "/windows/device-security/auditing/audit-user-account-management", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-user-account-management", "redirect_document_id": true }, { "source_path": "windows/keep-secure/audit-user-device-claims.md", -"redirect_url": "/windows/device-security/auditing/audit-user-device-claims", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/audit-user-device-claims", "redirect_document_id": true }, { "source_path": "windows/keep-secure/back-up-files-and-directories.md", -"redirect_url": "/windows/device-security/security-policy-settings/back-up-files-and-directories", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/back-up-files-and-directories", "redirect_document_id": true }, { "source_path": "windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md", -"redirect_url": "/windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds", +"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/backup-tpm-recovery-information-to-ad-ds", "redirect_document_id": true }, { "source_path": "windows/keep-secure/basic-audit-account-logon-events.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-account-logon-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-account-logon-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/basic-audit-account-management.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-account-management", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-account-management", "redirect_document_id": true }, { "source_path": "windows/keep-secure/basic-audit-directory-service-access.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-directory-service-access", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-directory-service-access", "redirect_document_id": true }, { "source_path": "windows/keep-secure/basic-audit-logon-events.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-logon-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-logon-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/basic-audit-object-access.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-object-access", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-object-access", "redirect_document_id": true }, { "source_path": "windows/keep-secure/basic-audit-policy-change.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-policy-change", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-policy-change", "redirect_document_id": true }, { "source_path": "windows/keep-secure/basic-audit-privilege-use.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-privilege-use", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-privilege-use", "redirect_document_id": true }, { "source_path": "windows/keep-secure/basic-audit-process-tracking.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-process-tracking", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-process-tracking", "redirect_document_id": true }, { "source_path": "windows/keep-secure/basic-audit-system-events.md", -"redirect_url": "/windows/device-security/auditing/basic-audit-system-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-audit-system-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/basic-firewall-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/basic-firewall-policy-design", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/basic-firewall-policy-design", "redirect_document_id": true }, { "source_path": "windows/keep-secure/basic-security-audit-policies.md", -"redirect_url": "/windows/device-security/auditing/basic-security-audit-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-security-audit-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/basic-security-audit-policy-settings.md", -"redirect_url": "/windows/device-security/auditing/basic-security-audit-policy-settings", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/basic-security-audit-policy-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bcd-settings-and-bitlocker.md", -"redirect_url": "/windows/device-security/bitlocker/bcd-settings-and-bitlocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bcd-settings-and-bitlocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bitlocker-basic-deployment.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-basic-deployment", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-basic-deployment", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bitlocker-countermeasures.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-countermeasures", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-countermeasures", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bitlocker-device-encryption-overview-windows-10.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-device-encryption-overview-windows-10", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bitlocker-frequently-asked-questions.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-frequently-asked-questions", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-frequently-asked-questions", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bitlocker-group-policy-settings.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-group-policy-settings", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-group-policy-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bitlocker-how-to-deploy-on-windows-server.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-deploy-on-windows-server", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bitlocker-how-to-enable-network-unlock.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bitlocker-overview.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-overview", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-overview", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bitlocker-recovery-guide-plan.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-recovery-guide-plan", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-recovery-guide-plan", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bitlocker-use-bitlocker-recovery-password-viewer.md", -"redirect_url": "/windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer", "redirect_document_id": true }, { "source_path": "windows/keep-secure/block-untrusted-fonts-in-enterprise.md", -"redirect_url": "/windows/threat-protection/block-untrusted-fonts-in-enterprise", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/block-untrusted-fonts-in-enterprise", "redirect_document_id": true }, { "source_path": "windows/keep-secure/boundary-zone-gpos.md", -"redirect_url": "/windows/access-protection/windows-firewall/boundary-zone-gpos", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/boundary-zone-gpos", "redirect_document_id": true }, { "source_path": "windows/keep-secure/boundary-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/boundary-zone", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/boundary-zone", "redirect_document_id": true }, { "source_path": "windows/keep-secure/bypass-traverse-checking.md", -"redirect_url": "/windows/device-security/security-policy-settings/bypass-traverse-checking", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/bypass-traverse-checking", "redirect_document_id": true }, { "source_path": "windows/keep-secure/certificate-based-isolation-policy-design-example.md", -"redirect_url": "/windows/access-protection/windows-firewall/certificate-based-isolation-policy-design-example", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/certificate-based-isolation-policy-design-example", "redirect_document_id": true }, { "source_path": "windows/keep-secure/certificate-based-isolation-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/certificate-based-isolation-policy-design", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/certificate-based-isolation-policy-design", "redirect_document_id": true }, { "source_path": "windows/keep-secure/change-rules-from-request-to-require-mode.md", -"redirect_url": "/windows/access-protection/windows-firewall/change-rules-from-request-to-require-mode", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/change-rules-from-request-to-require-mode", "redirect_document_id": true }, { "source_path": "windows/keep-secure/change-the-system-time.md", -"redirect_url": "/windows/device-security/security-policy-settings/change-the-system-time", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/change-the-system-time", "redirect_document_id": true }, { "source_path": "windows/keep-secure/change-the-time-zone.md", -"redirect_url": "/windows/device-security/security-policy-settings/change-the-time-zone", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/change-the-time-zone", "redirect_document_id": true }, { "source_path": "windows/keep-secure/change-the-tpm-owner-password.md", -"redirect_url": "/windows/device-security/tpm/change-the-tpm-owner-password", +"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/change-the-tpm-owner-password", "redirect_document_id": true }, { "source_path": "windows/keep-secure/check-sensor-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-configuring-basic-firewall-settings.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-configuring-basic-firewall-settings", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-basic-firewall-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-configuring-rules-for-an-isolated-server-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-an-isolated-server-zone", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-servers-in-a-standalone-isolated-server-zone", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-configuring-rules-for-the-boundary-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-boundary-zone", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-configuring-rules-for-the-encryption-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-encryption-zone", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-configuring-rules-for-the-isolated-domain.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-configuring-rules-for-the-isolated-domain", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-creating-group-policy-objects.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-creating-group-policy-objects", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-group-policy-objects", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-creating-inbound-firewall-rules.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-creating-inbound-firewall-rules", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-inbound-firewall-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-creating-outbound-firewall-rules.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-creating-outbound-firewall-rules", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-outbound-firewall-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-implementing-a-basic-firewall-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-basic-firewall-policy-design", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-implementing-a-certificate-based-isolation-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-certificate-based-isolation-policy-design", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-implementing-a-domain-isolation-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-domain-isolation-policy-design", "redirect_document_id": true }, { "source_path": "windows/keep-secure/checklist-implementing-a-standalone-server-isolation-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/checklist-implementing-a-standalone-server-isolation-policy-design", "redirect_document_id": true }, { "source_path": "windows/keep-secure/choose-the-right-bitlocker-countermeasure.md", -"redirect_url": "/windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/choose-the-right-bitlocker-countermeasure", "redirect_document_id": true }, { "source_path": "windows/keep-secure/command-line-arguments-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configuration-management-reference-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-advanced-scan-types-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-an-applocker-policy-for-audit-only.md", -"redirect_url": "/windows/device-security/applocker/configure-an-applocker-policy-for-audit-only", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-an-applocker-policy-for-audit-only", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-an-applocker-policy-for-enforce-rules.md", -"redirect_url": "/windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-arcsight-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-an-applocker-policy-for-enforce-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-authentication-methods.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-authentication-methods", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-authentication-methods", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-block-at-first-sight-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-cloud-block-timeout-period-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-data-protection-quick-mode-settings.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-data-protection-quick-mode-settings", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-data-protection-quick-mode-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-email-notifications-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-end-user-interaction-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-exceptions-for-an-applocker-rule.md", -"redirect_url": "/windows/device-security/applocker/configure-exceptions-for-an-applocker-rule", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-exceptions-for-an-applocker-rule", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-exclusions-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-extension-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-group-policy-to-autoenroll-and-deploy-certificates.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-group-policy-to-autoenroll-and-deploy-certificates", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-key-exchange-main-mode-settings.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-key-exchange-main-mode-settings", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-key-exchange-main-mode-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-local-policy-overrides-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-local-policy-overrides-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-network-connections-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-notifications-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-process-opened-file-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-protection-features-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-protection-features-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-real-time-protection-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-remediation-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-remediation-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-s-mime.md", -"redirect_url": "/windows/access-protection/configure-s-mime", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/configure-s-mime", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-server-exclusions-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-splunk-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-the-application-identity-service.md", -"redirect_url": "/windows/device-security/applocker/configure-the-application-identity-service", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-the-application-identity-service", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-the-appLocker-reference-device.md", -"redirect_url": "/windows/device-security/applocker/configure-the-appLocker-reference-device", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/configure-the-appLocker-reference-device", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-the-rules-to-require-encryption.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-the-rules-to-require-encryption", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-the-rules-to-require-encryption", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-the-windows-firewall-log.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-the-windows-firewall-log", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-the-windows-firewall-log", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-the-workstation-authentication-certificate-template.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-the-workstation-authentication-certificate-template", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-the-workstation-authentication-certificate-template", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-windows-defender-antivirus-features.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/configure-windows-defender-antivirus-features", "redirect_document_id": true }, { "source_path": "windows/keep-secure/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked.md", -"redirect_url": "/windows/access-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/configure-windows-firewall-to-suppress-notifications-when-a-program-is-blocked", "redirect_document_id": true }, { "source_path": "windows/keep-secure/confirm-that-certificates-are-deployed-correctly.md", -"redirect_url": "/windows/access-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/confirm-that-certificates-are-deployed-correctly", "redirect_document_id": true }, { "source_path": "windows/keep-secure/copy-a-gpo-to-create-a-new-gpo.md", -"redirect_url": "/windows/access-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/copy-a-gpo-to-create-a-new-gpo", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-a-basic-audit-policy-settings-for-an-event-category.md", -"redirect_url": "/windows/device-security/auditing/create-a-basic-audit-policy-settings-for-an-event-category", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/create-a-basic-audit-policy-settings-for-an-event-category", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-a-group-account-in-active-directory.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-a-group-account-in-active-directory", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-a-group-account-in-active-directory", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-a-group-policy-object.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-a-group-policy-object", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-a-group-policy-object", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-a-pagefile.md", -"redirect_url": "/windows/device-security/security-policy-settings/create-a-pagefile", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-a-pagefile", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-a-rule-for-packaged-apps.md", -"redirect_url": "/windows/device-security/applocker/create-a-rule-for-packaged-apps", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-for-packaged-apps", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-a-rule-that-uses-a-file-hash-condition.md", -"redirect_url": "/windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-that-uses-a-file-hash-condition", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-a-rule-that-uses-a-path-condition.md", -"redirect_url": "/windows/device-security/applocker/create-a-rule-that-uses-a-path-condition", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-that-uses-a-path-condition", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-a-rule-that-uses-a-publisher-condition.md", -"redirect_url": "/windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-a-rule-that-uses-a-publisher-condition", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-a-token-object.md", -"redirect_url": "/windows/device-security/security-policy-settings/create-a-token-object", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-a-token-object", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-an-authentication-exemption-list-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-authentication-exemption-list-rule", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-authentication-exemption-list-rule", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-an-authentication-request-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-authentication-request-rule", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-authentication-request-rule", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-an-inbound-icmp-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-inbound-icmp-rule", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-inbound-icmp-rule", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-an-inbound-port-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-inbound-port-rule", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-inbound-port-rule", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-an-inbound-program-or-service-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-inbound-program-or-service-rule", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-inbound-program-or-service-rule", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-an-outbound-port-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-outbound-port-rule", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-outbound-port-rule", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-an-outbound-program-or-service-rule.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-an-outbound-program-or-service-rule", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-an-outbound-program-or-service-rule", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-and-verify-an-efs-dra-certificate.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-applocker-default-rules.md", -"redirect_url": "/windows/device-security/applocker/create-applocker-default-rules", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-applocker-default-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-global-objects.md", -"redirect_url": "/windows/device-security/security-policy-settings/create-global-objects", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-global-objects", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-inbound-rules-to-support-rpc.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-inbound-rules-to-support-rpc", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-inbound-rules-to-support-rpc", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-list-of-applications-deployed-to-each-business-group.md", -"redirect_url": "/windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-list-of-applications-deployed-to-each-business-group", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-permanent-shared-objects.md", -"redirect_url": "/windows/device-security/security-policy-settings/create-permanent-shared-objects", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-permanent-shared-objects", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-symbolic-links.md", -"redirect_url": "/windows/device-security/security-policy-settings/create-symbolic-links", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/create-symbolic-links", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-vpn-and-wip-policy-using-intune.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-wip-policy-using-intune.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-intune", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-wip-policy-using-sccm.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-wmi-filters-for-the-gpo.md", -"redirect_url": "/windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/create-wmi-filters-for-the-gpo", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-your-applocker-planning-document.md", -"redirect_url": "/windows/device-security/applocker/create-your-applocker-planning-document", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-your-applocker-planning-document", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-your-applocker-policies.md", -"redirect_url": "/windows/device-security/applocker/create-your-applocker-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-your-applocker-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/create-your-applocker-rules.md", -"redirect_url": "/windows/device-security/applocker/create-your-applocker-rules", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/create-your-applocker-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/credential-guard-considerations.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-considerations", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-considerations", "redirect_document_id": true }, { "source_path": "windows/keep-secure/credential-guard-how-it-works.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-how-it-works", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-how-it-works", "redirect_document_id": true }, { "source_path": "windows/keep-secure/credential-guard-manage.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-manage", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-manage", "redirect_document_id": true }, { "source_path": "windows/keep-secure/credential-guard-not-protected-scenarios.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-not-protected-scenarios", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-not-protected-scenarios", "redirect_document_id": true }, { "source_path": "windows/keep-secure/credential-guard-protection-limits.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-protection-limits", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-protection-limits", "redirect_document_id": true }, { "source_path": "windows/keep-secure/credential-guard-requirements.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-requirements", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-requirements", "redirect_document_id": true }, { "source_path": "windows/keep-secure/credential-guard-scripts.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard-scripts", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-scripts", "redirect_document_id": true }, { "source_path": "windows/keep-secure/credential-guard.md", -"redirect_url": "/windows/access-protection/credential-guard/credential-guard", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard", "redirect_document_id": true }, { "source_path": "windows/keep-secure/custom-ti-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/customize-run-review-remediate-scans-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", -"redirect_url": "/windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/dcom-machine-access-restrictions-in-security-descriptor-definition-language-sddl-syntax", "redirect_document_id": true }, { "source_path": "windows/keep-secure/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax.md", -"redirect_url": "/windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/dcom-machine-launch-restrictions-in-security-descriptor-definition-language-sddl-syntax", "redirect_document_id": true }, { "source_path": "windows/keep-secure/debug-programs.md", -"redirect_url": "/windows/device-security/security-policy-settings/debug-programs", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/debug-programs", "redirect_document_id": true }, { "source_path": "windows/keep-secure/defender-compatibility-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/delete-an-applocker-rule.md", -"redirect_url": "/windows/device-security/applocker/delete-an-applocker-rule", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/delete-an-applocker-rule", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deny-access-to-this-computer-from-the-network.md", -"redirect_url": "/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deny-log-on-as-a-batch-job.md", -"redirect_url": "/windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-as-a-batch-job", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deny-log-on-as-a-service.md", -"redirect_url": "/windows/device-security/security-policy-settings/deny-log-on-as-a-service", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-as-a-service", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deny-log-on-locally.md", -"redirect_url": "/windows/device-security/security-policy-settings/deny-log-on-locally", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-locally", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deny-log-on-through-remote-desktop-services.md", -"redirect_url": "/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deploy-applocker-policies-by-using-the-enforce-rules-setting.md", -"redirect_url": "/windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-catalog-files-to-support-code-integrity-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md", -"redirect_url": "/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-code-integrity-policies-policy-rules-and-file-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deploy-code-integrity-policies-steps.md", -"redirect_url": "/windows/device-security/device-guard/deploy-code-integrity-policies-steps", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-code-integrity-policies-steps", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-device-guard-deploy-code-integrity-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md", -"redirect_url": "/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-device-guard-enable-virtualization-based-security", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deploy-manage-report-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deploy-the-applocker-policy-into-production.md", -"redirect_url": "/windows/device-security/applocker/deploy-the-applocker-policy-into-production", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/deploy-the-applocker-policy-into-production", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deploy-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deploy-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deploy-wip-policy-using-intune.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deployment-vdi-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/deployment-vdi-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/designing-a-windows-firewall-with-advanced-security-strategy.md", -"redirect_url": "/windows/access-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/designing-a-windows-firewall-with-advanced-security-strategy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/determine-group-policy-structure-and-rule-enforcement.md", -"redirect_url": "/windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/determine-group-policy-structure-and-rule-enforcement", "redirect_document_id": true }, { "source_path": "windows/keep-secure/determine-which-applications-are-digitally-signed-on-a-reference-computer.md", -"redirect_url": "/windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer", "redirect_document_id": true }, { "source_path": "windows/keep-secure/determine-your-application-control-objectives.md", -"redirect_url": "/windows/device-security/applocker/determine-your-application-control-objectives", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/determine-your-application-control-objectives", "redirect_document_id": true }, { "source_path": "windows/keep-secure/determining-the-trusted-state-of-your-devices.md", -"redirect_url": "/windows/access-protection/windows-firewall/determining-the-trusted-state-of-your-devices", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/determining-the-trusted-state-of-your-devices", "redirect_document_id": true }, { "source_path": "windows/keep-secure/device-guard-deployment-guide.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide", "redirect_document_id": true }, { "source_path": "windows/keep-secure/devices-allow-undock-without-having-to-log-on.md", -"redirect_url": "/windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-allow-undock-without-having-to-log-on", "redirect_document_id": true }, { "source_path": "windows/keep-secure/devices-allowed-to-format-and-eject-removable-media.md", -"redirect_url": "/windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-allowed-to-format-and-eject-removable-media", "redirect_document_id": true }, { "source_path": "windows/keep-secure/devices-prevent-users-from-installing-printer-drivers.md", -"redirect_url": "/windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-prevent-users-from-installing-printer-drivers", "redirect_document_id": true }, { "source_path": "windows/keep-secure/devices-restrict-cd-rom-access-to-locally-logged-on-user-only.md", -"redirect_url": "/windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-restrict-cd-rom-access-to-locally-logged-on-user-only", "redirect_document_id": true }, { "source_path": "windows/keep-secure/devices-restrict-floppy-access-to-locally-logged-on-user-only.md", -"redirect_url": "/windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/devices-restrict-floppy-access-to-locally-logged-on-user-only", "redirect_document_id": true }, { "source_path": "windows/keep-secure/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md", -"redirect_url": "/windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application", "redirect_document_id": true }, { "source_path": "windows/keep-secure/dll-rules-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/dll-rules-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/dll-rules-in-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/document-group-policy-structure-and-applocker-rule-enforcement.md", -"redirect_url": "/windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-group-policy-structure-and-applocker-rule-enforcement", "redirect_document_id": true }, { "source_path": "windows/keep-secure/document-your-application-control-management-processes.md", -"redirect_url": "/windows/device-security/applocker/document-your-application-control-management-processes", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-your-application-control-management-processes", "redirect_document_id": true }, { "source_path": "windows/keep-secure/document-your-application-list.md", -"redirect_url": "/windows/device-security/applocker/document-your-application-list", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-your-application-list", "redirect_document_id": true }, { "source_path": "windows/keep-secure/document-your-applocker-rules.md", -"redirect_url": "/windows/device-security/applocker/document-your-applocker-rules", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/document-your-applocker-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/documenting-the-zones.md", -"redirect_url": "/windows/access-protection/windows-firewall/documenting-the-zones", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/documenting-the-zones", "redirect_document_id": true }, { "source_path": "windows/keep-secure/domain-controller-allow-server-operators-to-schedule-tasks.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-controller-allow-server-operators-to-schedule-tasks", "redirect_document_id": true }, { "source_path": "windows/keep-secure/domain-controller-ldap-server-signing-requirements.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-controller-ldap-server-signing-requirements", "redirect_document_id": true }, { "source_path": "windows/keep-secure/domain-controller-refuse-machine-account-password-changes.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-controller-refuse-machine-account-password-changes", "redirect_document_id": true }, { "source_path": "windows/keep-secure/domain-isolation-policy-design-example.md", -"redirect_url": "/windows/access-protection/windows-firewall/domain-isolation-policy-design-example", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/domain-isolation-policy-design-example", "redirect_document_id": true }, { "source_path": "windows/keep-secure/domain-isolation-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/domain-isolation-policy-design", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/domain-isolation-policy-design", "redirect_document_id": true }, { "source_path": "windows/keep-secure/domain-member-digitally-encrypt-or-sign-secure-channel-data-always.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-or-sign-secure-channel-data-always", "redirect_document_id": true }, { "source_path": "windows/keep-secure/domain-member-digitally-encrypt-secure-channel-data-when-possible.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-digitally-encrypt-secure-channel-data-when-possible", "redirect_document_id": true }, { "source_path": "windows/keep-secure/domain-member-digitally-sign-secure-channel-data-when-possible.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-digitally-sign-secure-channel-data-when-possible", "redirect_document_id": true }, { "source_path": "windows/keep-secure/domain-member-disable-machine-account-password-changes.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-disable-machine-account-password-changes", "redirect_document_id": true }, { "source_path": "windows/keep-secure/domain-member-maximum-machine-account-password-age.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-maximum-machine-account-password-age", "redirect_document_id": true }, { "source_path": "windows/keep-secure/domain-member-require-strong-windows-2000-or-later-session-key.md", -"redirect_url": "/windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/domain-member-require-strong-windows-2000-or-later-session-key", "redirect_document_id": true }, { "source_path": "windows/keep-secure/dynamic-access-control.md", -"redirect_url": "/windows/access-protection/access-control/dynamic-access-control", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/dynamic-access-control", "redirect_document_id": true }, { "source_path": "windows/keep-secure/edit-an-applocker-policy.md", -"redirect_url": "/windows/device-security/applocker/edit-an-applocker-policy", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/edit-an-applocker-policy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/edit-applocker-rules.md", -"redirect_url": "/windows/device-security/applocker/edit-applocker-rules", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/edit-applocker-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/enable-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/enable-computer-and-user-accounts-to-be-trusted-for-delegation.md", -"redirect_url": "/windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation", "redirect_document_id": true }, { "source_path": "windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/enable-predefined-inbound-rules.md", -"redirect_url": "/windows/access-protection/windows-firewall/enable-predefined-inbound-rules", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/enable-predefined-inbound-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/enable-predefined-outbound-rules.md", -"redirect_url": "/windows/access-protection/windows-firewall/enable-predefined-outbound-rules", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/enable-siem-integration-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/enable-predefined-outbound-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/enable-the-dll-rule-collection.md", -"redirect_url": "/windows/device-security/applocker/enable-the-dll-rule-collection", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/enable-the-dll-rule-collection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/encrypted-hard-drive.md", -"redirect_url": "/windows/device-security/encrypted-hard-drive", +"redirect_url": "https://docs.microsoft.com/windows/device-security/encrypted-hard-drive", "redirect_document_id": true }, { "source_path": "windows/keep-secure/encryption-zone-gpos.md", -"redirect_url": "/windows/access-protection/windows-firewall/encryption-zone-gpos", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/encryption-zone-gpos", "redirect_document_id": true }, { "source_path": "windows/keep-secure/encryption-zone.md", -"redirect_url": "/windows/access-protection/windows-firewall/encryption-zone", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/encryption-zone", "redirect_document_id": true }, { "source_path": "windows/keep-secure/enforce-applocker-rules.md", -"redirect_url": "/windows/device-security/applocker/enforce-applocker-rules", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/enforce-applocker-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/enforce-password-history.md", -"redirect_url": "/windows/device-security/security-policy-settings/enforce-password-history", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/enforce-password-history", "redirect_document_id": true }, { "source_path": "windows/keep-secure/enforce-user-logon-restrictions.md", -"redirect_url": "/windows/device-security/security-policy-settings/enforce-user-logon-restrictions", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/enforce-user-logon-restrictions", "redirect_document_id": true }, { "source_path": "windows/keep-secure/enlightened-microsoft-apps-and-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip", "redirect_document_id": true }, { "source_path": "windows/keep-secure/enterprise-certificate-pinning.md", -"redirect_url": "/windows/access-protection/enterprise-certificate-pinning", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/enterprise-certificate-pinning", "redirect_document_id": true }, { "source_path": "windows/keep-secure/evaluate-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/evaluate-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/evaluating-windows-firewall-with-advanced-security-design-examples.md", -"redirect_url": "/windows/access-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-1100.md", -"redirect_url": "/windows/device-security/auditing/event-1100", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1100", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-1102.md", -"redirect_url": "/windows/device-security/auditing/event-1102", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1102", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-1104.md", -"redirect_url": "/windows/device-security/auditing/event-1104", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1104", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-1105.md", -"redirect_url": "/windows/device-security/auditing/event-1105", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1105", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-1108.md", -"redirect_url": "/windows/device-security/auditing/event-1108", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-1108", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4608.md", -"redirect_url": "/windows/device-security/auditing/event-4608", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4608", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4610.md", -"redirect_url": "/windows/device-security/auditing/event-4610", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4610", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4611.md", -"redirect_url": "/windows/device-security/auditing/event-4611", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4611", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4612.md", -"redirect_url": "/windows/device-security/auditing/event-4612", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4612", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4614.md", -"redirect_url": "/windows/device-security/auditing/event-4614", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4614", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4615.md", -"redirect_url": "/windows/device-security/auditing/event-4615", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4615", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4616.md", -"redirect_url": "/windows/device-security/auditing/event-4616", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4616", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4618.md", -"redirect_url": "/windows/device-security/auditing/event-4618", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4618", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4621.md", -"redirect_url": "/windows/device-security/auditing/event-4621", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4621", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4622.md", -"redirect_url": "/windows/device-security/auditing/event-4622", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4622", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4624.md", -"redirect_url": "/windows/device-security/auditing/event-4624", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4624", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4625.md", -"redirect_url": "/windows/device-security/auditing/event-4625", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4625", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4626.md", -"redirect_url": "/windows/device-security/auditing/event-4626", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4626", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4627.md", -"redirect_url": "/windows/device-security/auditing/event-4627", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4627", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4634.md", -"redirect_url": "/windows/device-security/auditing/event-4634", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4634", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4647.md", -"redirect_url": "/windows/device-security/auditing/event-4647", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4647", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4648.md", -"redirect_url": "/windows/device-security/auditing/event-4648", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4648", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4649.md", -"redirect_url": "/windows/device-security/auditing/event-4649", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4649", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4656.md", -"redirect_url": "/windows/device-security/auditing/event-4656", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4656", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4657.md", -"redirect_url": "/windows/device-security/auditing/event-4657", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4657", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4658.md", -"redirect_url": "/windows/device-security/auditing/event-4658", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4658", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4660.md", -"redirect_url": "/windows/device-security/auditing/event-4660", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4660", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4661.md", -"redirect_url": "/windows/device-security/auditing/event-4661", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4661", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4662.md", -"redirect_url": "/windows/device-security/auditing/event-4662", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4662", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4663.md", -"redirect_url": "/windows/device-security/auditing/event-4663", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4663", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4664.md", -"redirect_url": "/windows/device-security/auditing/event-4664", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4664", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4670.md", -"redirect_url": "/windows/device-security/auditing/event-4670", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4670", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4671.md", -"redirect_url": "/windows/device-security/auditing/event-4671", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4671", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4672.md", -"redirect_url": "/windows/device-security/auditing/event-4672", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4672", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4673.md", -"redirect_url": "/windows/device-security/auditing/event-4673", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4673", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4674.md", -"redirect_url": "/windows/device-security/auditing/event-4674", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4674", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4675.md", -"redirect_url": "/windows/device-security/auditing/event-4675", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4675", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4688.md", -"redirect_url": "/windows/device-security/auditing/event-4688", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4688", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4689.md", -"redirect_url": "/windows/device-security/auditing/event-4689", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4689", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4690.md", -"redirect_url": "/windows/device-security/auditing/event-4690", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4690", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4691.md", -"redirect_url": "/windows/device-security/auditing/event-4691", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4691", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4692.md", -"redirect_url": "/windows/device-security/auditing/event-4692", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4692", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4693.md", -"redirect_url": "/windows/device-security/auditing/event-4693", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4693", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4694.md", -"redirect_url": "/windows/device-security/auditing/event-4694", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4694", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4695.md", -"redirect_url": "/windows/device-security/auditing/event-4695", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4695", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4696.md", -"redirect_url": "/windows/device-security/auditing/event-4696", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4696", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4697.md", -"redirect_url": "/windows/device-security/auditing/event-4697", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4697", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4698.md", -"redirect_url": "/windows/device-security/auditing/event-4698", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4698", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4699.md", -"redirect_url": "/windows/device-security/auditing/event-4699", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4699", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4700.md", -"redirect_url": "/windows/device-security/auditing/event-4700", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4700", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4701.md", -"redirect_url": "/windows/device-security/auditing/event-4701", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4701", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4702.md", -"redirect_url": "/windows/device-security/auditing/event-4702", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4702", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4703.md", -"redirect_url": "/windows/device-security/auditing/event-4703", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4703", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4704.md", -"redirect_url": "/windows/device-security/auditing/event-4704", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4704", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4705.md", -"redirect_url": "/windows/device-security/auditing/event-4705", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4705", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4706.md", -"redirect_url": "/windows/device-security/auditing/event-4706", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4706", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4707.md", -"redirect_url": "/windows/device-security/auditing/event-4707", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4707", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4713.md", -"redirect_url": "/windows/device-security/auditing/event-4713", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4713", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4714.md", -"redirect_url": "/windows/device-security/auditing/event-4714", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4714", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4715.md", -"redirect_url": "/windows/device-security/auditing/event-4715", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4715", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4716.md", -"redirect_url": "/windows/device-security/auditing/event-4716", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4716", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4717.md", -"redirect_url": "/windows/device-security/auditing/event-4717", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4717", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4718.md", -"redirect_url": "/windows/device-security/auditing/event-4718", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4718", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4719.md", -"redirect_url": "/windows/device-security/auditing/event-4719", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4719", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4720.md", -"redirect_url": "/windows/device-security/auditing/event-4720", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4720", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4722.md", -"redirect_url": "/windows/device-security/auditing/event-4722", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4722", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4723.md", -"redirect_url": "/windows/device-security/auditing/event-4723", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4723", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4724.md", -"redirect_url": "/windows/device-security/auditing/event-4724", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4724", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4725.md", -"redirect_url": "/windows/device-security/auditing/event-4725", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4725", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4726.md", -"redirect_url": "/windows/device-security/auditing/event-4726", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4726", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4731.md", -"redirect_url": "/windows/device-security/auditing/event-4731", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4731", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4732.md", -"redirect_url": "/windows/device-security/auditing/event-4732", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4732", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4733.md", -"redirect_url": "/windows/device-security/auditing/event-4733", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4733", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4734.md", -"redirect_url": "/windows/device-security/auditing/event-4734", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4734", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4735.md", -"redirect_url": "/windows/device-security/auditing/event-4735", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4735", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4738.md", -"redirect_url": "/windows/device-security/auditing/event-4738", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4738", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4739.md", -"redirect_url": "/windows/device-security/auditing/event-4739", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4739", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4740.md", -"redirect_url": "/windows/device-security/auditing/event-4740", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4740", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4741.md", -"redirect_url": "/windows/device-security/auditing/event-4741", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4741", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4742.md", -"redirect_url": "/windows/device-security/auditing/event-4742", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4742", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4743.md", -"redirect_url": "/windows/device-security/auditing/event-4743", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4743", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4749.md", -"redirect_url": "/windows/device-security/auditing/event-4749", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4749", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4750.md", -"redirect_url": "/windows/device-security/auditing/event-4750", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4750", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4751.md", -"redirect_url": "/windows/device-security/auditing/event-4751", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4751", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4752.md", -"redirect_url": "/windows/device-security/auditing/event-4752", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4752", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4753.md", -"redirect_url": "/windows/device-security/auditing/event-4753", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4753", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4764.md", -"redirect_url": "/windows/device-security/auditing/event-4764", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4764", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4765.md", -"redirect_url": "/windows/device-security/auditing/event-4765", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4765", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4766.md", -"redirect_url": "/windows/device-security/auditing/event-4766", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4766", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4767.md", -"redirect_url": "/windows/device-security/auditing/event-4767", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4767", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4768.md", -"redirect_url": "/windows/device-security/auditing/event-4768", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4768", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4769.md", -"redirect_url": "/windows/device-security/auditing/event-4769", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4769", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4770.md", -"redirect_url": "/windows/device-security/auditing/event-4770", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4770", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4771.md", -"redirect_url": "/windows/device-security/auditing/event-4771", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4771", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4772.md", -"redirect_url": "/windows/device-security/auditing/event-4772", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4772", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4773.md", -"redirect_url": "/windows/device-security/auditing/event-4773", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4773", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4774.md", -"redirect_url": "/windows/device-security/auditing/event-4774", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4774", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4775.md", -"redirect_url": "/windows/device-security/auditing/event-4775", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4775", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4776.md", -"redirect_url": "/windows/device-security/auditing/event-4776", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4776", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4777.md", -"redirect_url": "/windows/device-security/auditing/event-4777", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4777", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4778.md", -"redirect_url": "/windows/device-security/auditing/event-4778", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4778", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4779.md", -"redirect_url": "/windows/device-security/auditing/event-4779", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4779", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4780.md", -"redirect_url": "/windows/device-security/auditing/event-4780", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4780", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4781.md", -"redirect_url": "/windows/device-security/auditing/event-4781", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4781", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4782.md", -"redirect_url": "/windows/device-security/auditing/event-4782", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4782", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4793.md", -"redirect_url": "/windows/device-security/auditing/event-4793", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4793", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4794.md", -"redirect_url": "/windows/device-security/auditing/event-4794", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4794", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4798.md", -"redirect_url": "/windows/device-security/auditing/event-4798", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4798", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4799.md", -"redirect_url": "/windows/device-security/auditing/event-4799", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4799", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4800.md", -"redirect_url": "/windows/device-security/auditing/event-4800", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4800", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4801.md", -"redirect_url": "/windows/device-security/auditing/event-4801", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4801", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4802.md", -"redirect_url": "/windows/device-security/auditing/event-4802", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4802", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4803.md", -"redirect_url": "/windows/device-security/auditing/event-4803", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4803", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4816.md", -"redirect_url": "/windows/device-security/auditing/event-4816", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4816", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4817.md", -"redirect_url": "/windows/device-security/auditing/event-4817", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4817", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4818.md", -"redirect_url": "/windows/device-security/auditing/event-4818", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4818", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4819.md", -"redirect_url": "/windows/device-security/auditing/event-4819", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4819", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4826.md", -"redirect_url": "/windows/device-security/auditing/event-4826", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4826", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4864.md", -"redirect_url": "/windows/device-security/auditing/event-4864", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4864", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4865.md", -"redirect_url": "/windows/device-security/auditing/event-4865", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4865", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4866.md", -"redirect_url": "/windows/device-security/auditing/event-4866", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4866", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4867.md", -"redirect_url": "/windows/device-security/auditing/event-4867", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4867", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4902.md", -"redirect_url": "/windows/device-security/auditing/event-4902", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4902", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4904.md", -"redirect_url": "/windows/device-security/auditing/event-4904", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4904", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4905.md", -"redirect_url": "/windows/device-security/auditing/event-4905", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4905", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4906.md", -"redirect_url": "/windows/device-security/auditing/event-4906", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4906", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4907.md", -"redirect_url": "/windows/device-security/auditing/event-4907", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4907", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4908.md", -"redirect_url": "/windows/device-security/auditing/event-4908", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4908", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4909.md", -"redirect_url": "/windows/device-security/auditing/event-4909", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4909", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4910.md", -"redirect_url": "/windows/device-security/auditing/event-4910", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4910", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4911.md", -"redirect_url": "/windows/device-security/auditing/event-4911", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4911", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4912.md", -"redirect_url": "/windows/device-security/auditing/event-4912", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4912", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4913.md", -"redirect_url": "/windows/device-security/auditing/event-4913", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4913", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4928.md", -"redirect_url": "/windows/device-security/auditing/event-4928", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4928", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4929.md", -"redirect_url": "/windows/device-security/auditing/event-4929", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4929", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4930.md", -"redirect_url": "/windows/device-security/auditing/event-4930", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4930", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4931.md", -"redirect_url": "/windows/device-security/auditing/event-4931", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4931", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4932.md", -"redirect_url": "/windows/device-security/auditing/event-4932", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4932", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4933.md", -"redirect_url": "/windows/device-security/auditing/event-4933", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4933", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4934.md", -"redirect_url": "/windows/device-security/auditing/event-4934", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4934", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4935.md", -"redirect_url": "/windows/device-security/auditing/event-4935", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4935", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4936.md", -"redirect_url": "/windows/device-security/auditing/event-4936", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4936", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4937.md", -"redirect_url": "/windows/device-security/auditing/event-4937", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4937", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4944.md", -"redirect_url": "/windows/device-security/auditing/event-4944", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4944", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4945.md", -"redirect_url": "/windows/device-security/auditing/event-4945", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4945", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4946.md", -"redirect_url": "/windows/device-security/auditing/event-4946", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4946", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4947.md", -"redirect_url": "/windows/device-security/auditing/event-4947", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4947", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4948.md", -"redirect_url": "/windows/device-security/auditing/event-4948", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4948", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4949.md", -"redirect_url": "/windows/device-security/auditing/event-4949", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4949", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4950.md", -"redirect_url": "/windows/device-security/auditing/event-4950", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4950", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4951.md", -"redirect_url": "/windows/device-security/auditing/event-4951", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4951", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4952.md", -"redirect_url": "/windows/device-security/auditing/event-4952", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4952", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4953.md", -"redirect_url": "/windows/device-security/auditing/event-4953", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4953", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4954.md", -"redirect_url": "/windows/device-security/auditing/event-4954", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4954", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4956.md", -"redirect_url": "/windows/device-security/auditing/event-4956", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4956", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4957.md", -"redirect_url": "/windows/device-security/auditing/event-4957", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4957", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4958.md", -"redirect_url": "/windows/device-security/auditing/event-4958", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4958", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4964.md", -"redirect_url": "/windows/device-security/auditing/event-4964", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4964", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-4985.md", -"redirect_url": "/windows/device-security/auditing/event-4985", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-4985", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5024.md", -"redirect_url": "/windows/device-security/auditing/event-5024", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5024", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5025.md", -"redirect_url": "/windows/device-security/auditing/event-5025", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5025", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5027.md", -"redirect_url": "/windows/device-security/auditing/event-5027", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5027", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5028.md", -"redirect_url": "/windows/device-security/auditing/event-5028", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5028", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5029.md", -"redirect_url": "/windows/device-security/auditing/event-5029", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5029", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5030.md", -"redirect_url": "/windows/device-security/auditing/event-5030", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5030", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5031.md", -"redirect_url": "/windows/device-security/auditing/event-5031", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5031", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5032.md", -"redirect_url": "/windows/device-security/auditing/event-5032", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5032", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5033.md", -"redirect_url": "/windows/device-security/auditing/event-5033", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5033", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5034.md", -"redirect_url": "/windows/device-security/auditing/event-5034", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5034", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5035.md", -"redirect_url": "/windows/device-security/auditing/event-5035", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5035", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5037.md", -"redirect_url": "/windows/device-security/auditing/event-5037", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5037", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5038.md", -"redirect_url": "/windows/device-security/auditing/event-5038", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5038", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5039.md", -"redirect_url": "/windows/device-security/auditing/event-5039", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5039", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5051.md", -"redirect_url": "/windows/device-security/auditing/event-5051", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5051", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5056.md", -"redirect_url": "/windows/device-security/auditing/event-5056", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5056", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5057.md", -"redirect_url": "/windows/device-security/auditing/event-5057", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5057", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5058.md", -"redirect_url": "/windows/device-security/auditing/event-5058", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5058", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5059.md", -"redirect_url": "/windows/device-security/auditing/event-5059", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5059", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5060.md", -"redirect_url": "/windows/device-security/auditing/event-5060", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5060", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5061.md", -"redirect_url": "/windows/device-security/auditing/event-5061", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5061", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5062.md", -"redirect_url": "/windows/device-security/auditing/event-5062", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5062", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5063.md", -"redirect_url": "/windows/device-security/auditing/event-5063", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5063", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5064.md", -"redirect_url": "/windows/device-security/auditing/event-5064", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5064", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5065.md", -"redirect_url": "/windows/device-security/auditing/event-5065", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5065", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5066.md", -"redirect_url": "/windows/device-security/auditing/event-5066", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5066", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5067.md", -"redirect_url": "/windows/device-security/auditing/event-5067", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5067", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5068.md", -"redirect_url": "/windows/device-security/auditing/event-5068", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5068", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5069.md", -"redirect_url": "/windows/device-security/auditing/event-5069", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5069", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5070.md", -"redirect_url": "/windows/device-security/auditing/event-5070", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5070", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5136.md", -"redirect_url": "/windows/device-security/auditing/event-5136", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5136", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5137.md", -"redirect_url": "/windows/device-security/auditing/event-5137", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5137", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5138.md", -"redirect_url": "/windows/device-security/auditing/event-5138", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5138", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5139.md", -"redirect_url": "/windows/device-security/auditing/event-5139", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5139", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5140.md", -"redirect_url": "/windows/device-security/auditing/event-5140", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5140", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5141.md", -"redirect_url": "/windows/device-security/auditing/event-5141", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5141", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5142.md", -"redirect_url": "/windows/device-security/auditing/event-5142", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5142", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5143.md", -"redirect_url": "/windows/device-security/auditing/event-5143", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5143", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5144.md", -"redirect_url": "/windows/device-security/auditing/event-5144", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5144", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5145.md", -"redirect_url": "/windows/device-security/auditing/event-5145", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5145", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5148.md", -"redirect_url": "/windows/device-security/auditing/event-5148", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5148", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5149.md", -"redirect_url": "/windows/device-security/auditing/event-5149", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5149", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5150.md", -"redirect_url": "/windows/device-security/auditing/event-5150", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5150", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5151.md", -"redirect_url": "/windows/device-security/auditing/event-5151", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5151", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5152.md", -"redirect_url": "/windows/device-security/auditing/event-5152", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5152", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5153.md", -"redirect_url": "/windows/device-security/auditing/event-5153", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5153", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5154.md", -"redirect_url": "/windows/device-security/auditing/event-5154", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5154", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5155.md", -"redirect_url": "/windows/device-security/auditing/event-5155", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5155", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5156.md", -"redirect_url": "/windows/device-security/auditing/event-5156", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5156", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5157.md", -"redirect_url": "/windows/device-security/auditing/event-5157", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5157", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5158.md", -"redirect_url": "/windows/device-security/auditing/event-5158", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5158", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5159.md", -"redirect_url": "/windows/device-security/auditing/event-5159", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5159", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5168.md", -"redirect_url": "/windows/device-security/auditing/event-5168", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5168", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5376.md", -"redirect_url": "/windows/device-security/auditing/event-5376", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5376", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5377.md", -"redirect_url": "/windows/device-security/auditing/event-5377", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5377", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5378.md", -"redirect_url": "/windows/device-security/auditing/event-5378", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5378", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5447.md", -"redirect_url": "/windows/device-security/auditing/event-5447", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5447", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5632.md", -"redirect_url": "/windows/device-security/auditing/event-5632", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5632", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5633.md", -"redirect_url": "/windows/device-security/auditing/event-5633", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5633", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5712.md", -"redirect_url": "/windows/device-security/auditing/event-5712", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5712", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5888.md", -"redirect_url": "/windows/device-security/auditing/event-5888", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5888", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5889.md", -"redirect_url": "/windows/device-security/auditing/event-5889", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5889", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-5890.md", -"redirect_url": "/windows/device-security/auditing/event-5890", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-5890", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6144.md", -"redirect_url": "/windows/device-security/auditing/event-6144", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6144", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6145.md", -"redirect_url": "/windows/device-security/auditing/event-6145", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6145", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6281.md", -"redirect_url": "/windows/device-security/auditing/event-6281", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6281", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6400.md", -"redirect_url": "/windows/device-security/auditing/event-6400", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6400", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6401.md", -"redirect_url": "/windows/device-security/auditing/event-6401", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6401", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6402.md", -"redirect_url": "/windows/device-security/auditing/event-6402", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6402", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6403.md", -"redirect_url": "/windows/device-security/auditing/event-6403", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6403", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6404.md", -"redirect_url": "/windows/device-security/auditing/event-6404", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6404", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6405.md", -"redirect_url": "/windows/device-security/auditing/event-6405", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6405", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6406.md", -"redirect_url": "/windows/device-security/auditing/event-6406", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6406", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6407.md", -"redirect_url": "/windows/device-security/auditing/event-6407", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6407", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6408.md", -"redirect_url": "/windows/device-security/auditing/event-6408", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6408", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6409.md", -"redirect_url": "/windows/device-security/auditing/event-6409", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6409", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6410.md", -"redirect_url": "/windows/device-security/auditing/event-6410", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6410", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6416.md", -"redirect_url": "/windows/device-security/auditing/event-6416", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6416", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6419.md", -"redirect_url": "/windows/device-security/auditing/event-6419", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6419", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6420.md", -"redirect_url": "/windows/device-security/auditing/event-6420", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6420", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6421.md", -"redirect_url": "/windows/device-security/auditing/event-6421", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6421", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6422.md", -"redirect_url": "/windows/device-security/auditing/event-6422", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6422", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6423.md", -"redirect_url": "/windows/device-security/auditing/event-6423", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6423", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-6424.md", -"redirect_url": "/windows/device-security/auditing/event-6424", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/event-6424", "redirect_document_id": true }, { "source_path": "windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/executable-rules-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/executable-rules-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/executable-rules-in-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/exempt-icmp-from-authentication.md", -"redirect_url": "/windows/access-protection/windows-firewall/exempt-icmp-from-authentication", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/exempt-icmp-from-authentication", "redirect_document_id": true }, { "source_path": "windows/keep-secure/exemption-list.md", -"redirect_url": "/windows/access-protection/windows-firewall/exemption-list", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/exemption-list", "redirect_document_id": true }, { "source_path": "windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/export-an-applocker-policy-from-a-gpo.md", -"redirect_url": "/windows/device-security/applocker/export-an-applocker-policy-from-a-gpo", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/export-an-applocker-policy-from-a-gpo", "redirect_document_id": true }, { "source_path": "windows/keep-secure/export-an-applocker-policy-to-an-xml-file.md", -"redirect_url": "/windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/export-an-applocker-policy-to-an-xml-file", "redirect_document_id": true }, { "source_path": "windows/keep-secure/file-system-global-object-access-auditing.md", -"redirect_url": "/windows/device-security/auditing/file-system-global-object-access-auditing", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/file-system-global-object-access-auditing", "redirect_document_id": true }, { "source_path": "windows/keep-secure/firewall-gpos.md", -"redirect_url": "/windows/access-protection/windows-firewall/firewall-gpos", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/firewall-gpos", "redirect_document_id": true }, { "source_path": "windows/keep-secure/firewall-policy-design-example.md", -"redirect_url": "/windows/access-protection/windows-firewall/firewall-policy-design-example", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/firewall-policy-design-example", "redirect_document_id": true }, { "source_path": "windows/keep-secure/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/force-shutdown-from-a-remote-system.md", -"redirect_url": "/windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system", "redirect_document_id": true }, { "source_path": "windows/keep-secure/gathering-information-about-your-active-directory-deployment.md", -"redirect_url": "/windows/access-protection/windows-firewall/gathering-information-about-your-active-directory-deployment", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-information-about-your-active-directory-deployment", "redirect_document_id": true }, { "source_path": "windows/keep-secure/gathering-information-about-your-current-network-infrastructure.md", -"redirect_url": "/windows/access-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-information-about-your-current-network-infrastructure", "redirect_document_id": true }, { "source_path": "windows/keep-secure/gathering-information-about-your-devices.md", -"redirect_url": "/windows/access-protection/windows-firewall/gathering-information-about-your-devices", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-information-about-your-devices", "redirect_document_id": true }, { "source_path": "windows/keep-secure/gathering-other-relevant-information.md", -"redirect_url": "/windows/access-protection/windows-firewall/gathering-other-relevant-information", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-other-relevant-information", "redirect_document_id": true }, { "source_path": "windows/keep-secure/gathering-the-information-you-need.md", -"redirect_url": "/windows/access-protection/windows-firewall/gathering-the-information-you-need", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gathering-the-information-you-need", "redirect_document_id": true }, { "source_path": "windows/keep-secure/general-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/generate-security-audits.md", -"redirect_url": "/windows/device-security/security-policy-settings/generate-security-audits", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/generate-security-audits", "redirect_document_id": true }, { "source_path": "windows/keep-secure/gpo-domiso-boundary.md", -"redirect_url": "/windows/access-protection/windows-firewall/gpo-domiso-boundary", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-boundary", "redirect_document_id": true }, { "source_path": "windows/keep-secure/gpo-domiso-encryption.md", -"redirect_url": "/windows/access-protection/windows-firewall/gpo-domiso-encryption", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-encryption", "redirect_document_id": true }, { "source_path": "windows/keep-secure/gpo-domiso-firewall.md", -"redirect_url": "/windows/access-protection/windows-firewall/gpo-domiso-firewall", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-firewall", "redirect_document_id": true }, { "source_path": "windows/keep-secure/gpo-domiso-isolateddomain-clients.md", -"redirect_url": "/windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-clients", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-clients", "redirect_document_id": true }, { "source_path": "windows/keep-secure/gpo-domiso-isolateddomain-servers.md", -"redirect_url": "/windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-servers", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/gpo-domiso-isolateddomain-servers", "redirect_document_id": true }, { "source_path": "windows/keep-secure/guidance-and-best-practices-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip", "redirect_document_id": true }, { "source_path": "windows/keep-secure/hello-and-password-changes.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-and-password-changes", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-and-password-changes", "redirect_document_id": true }, { "source_path": "windows/keep-secure/hello-biometrics-in-enterprise.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-biometrics-in-enterprise", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-biometrics-in-enterprise", "redirect_document_id": true }, { "source_path": "windows/keep-secure/hello-errors-during-pin-creation.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-errors-during-pin-creation", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-errors-during-pin-creation", "redirect_document_id": true }, { "source_path": "windows/keep-secure/hello-event-300.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-event-300", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-event-300", "redirect_document_id": true }, { "source_path": "windows/keep-secure/hello-how-it-works.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-how-it-works", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-how-it-works", "redirect_document_id": true }, { "source_path": "windows/keep-secure/hello-identity-verification.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-identity-verification", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-identity-verification", "redirect_document_id": true }, { "source_path": "windows/keep-secure/hello-manage-in-organization.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-manage-in-organization", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-manage-in-organization", "redirect_document_id": true }, { "source_path": "windows/keep-secure/hello-prepare-people-to-use.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-prepare-people-to-use", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-prepare-people-to-use", "redirect_document_id": true }, { "source_path": "windows/keep-secure/hello-why-pin-is-better-than-password.md", -"redirect_url": "/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-why-pin-is-better-than-password", "redirect_document_id": true }, { "source_path": "windows/keep-secure/how-applocker-works-techref.md", -"redirect_url": "/windows/device-security/applocker/how-applocker-works-techref", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/how-applocker-works-techref", "redirect_document_id": true }, { "source_path": "windows/keep-secure/how-to-configure-security-policy-settings.md", -"redirect_url": "/windows/device-security/security-policy-settings/how-to-configure-security-policy-settings", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/how-to-configure-security-policy-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md", -"redirect_url": "/windows/access-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections", "redirect_document_id": true }, { "source_path": "windows/keep-secure/how-user-account-control-works.md", -"redirect_url": "/windows/access-protection/user-account-control/how-user-account-control-works", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/how-user-account-control-works", "redirect_document_id": true }, { "source_path": "windows/keep-secure/identifying-your-windows-firewall-with-advanced-security-deployment-goals.md", -"redirect_url": "/windows/access-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/identifying-your-windows-firewall-with-advanced-security-deployment-goals", "redirect_document_id": true }, { "source_path": "windows/keep-secure/impersonate-a-client-after-authentication.md", -"redirect_url": "/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication", "redirect_document_id": true }, { "source_path": "windows/keep-secure/implementing-your-windows-firewall-with-advanced-security-design-plan.md", -"redirect_url": "/windows/access-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan", "redirect_document_id": true }, { "source_path": "windows/keep-secure/import-an-applocker-policy-from-another-computer.md", -"redirect_url": "/windows/device-security/applocker/import-an-applocker-policy-from-another-computer", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/import-an-applocker-policy-from-another-computer", "redirect_document_id": true }, { "source_path": "windows/keep-secure/import-an-applocker-policy-into-a-gpo.md", -"redirect_url": "/windows/device-security/applocker/import-an-applocker-policy-into-a-gpo", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/import-an-applocker-policy-into-a-gpo", "redirect_document_id": true }, { "source_path": "windows/keep-secure/increase-a-process-working-set.md", -"redirect_url": "/windows/device-security/security-policy-settings/increase-a-process-working-set", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/increase-a-process-working-set", "redirect_document_id": true }, { "source_path": "windows/keep-secure/increase-scheduling-priority.md", -"redirect_url": "/windows/device-security/security-policy-settings/increase-scheduling-priority", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/increase-scheduling-priority", "redirect_document_id": true }, { "source_path": "windows/keep-secure/initialize-and-configure-ownership-of-the-tpm.md", -"redirect_url": "/windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm", +"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/initialize-and-configure-ownership-of-the-tpm", "redirect_document_id": true }, { "source_path": "windows/keep-secure/installing-digital-certificates-on-windows-10-mobile.md", -"redirect_url": "/windows/access-protection/installing-digital-certificates-on-windows-10-mobile", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/installing-digital-certificates-on-windows-10-mobile", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-display-user-information-when-the-session-is-locked.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-do-not-display-last-user-name.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-do-not-display-last-user-name", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-do-not-require-ctrl-alt-del.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-dont-display-username-at-sign-in.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-machine-account-lockout-threshold.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-machine-account-lockout-threshold", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-machine-inactivity-limit.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-machine-inactivity-limit", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-message-text-for-users-attempting-to-log-on.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-message-text-for-users-attempting-to-log-on", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-message-title-for-users-attempting-to-log-on.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-message-title-for-users-attempting-to-log-on", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-number-of-previous-logons-to-cache-in-case-domain-controller-is-not-available", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-prompt-user-to-change-password-before-expiration.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-prompt-user-to-change-password-before-expiration", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-require-domain-controller-authentication-to-unlock-workstation.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-require-domain-controller-authentication-to-unlock-workstation", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-require-smart-card.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-require-smart-card", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-require-smart-card", "redirect_document_id": true }, { "source_path": "windows/keep-secure/interactive-logon-smart-card-removal-behavior.md", -"redirect_url": "/windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/interactive-logon-smart-card-removal-behavior", "redirect_document_id": true }, { "source_path": "windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/investigate-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/investigate-domain-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/investigate-ip-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/investigate-user-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/isolated-domain-gpos.md", -"redirect_url": "/windows/access-protection/windows-firewall/isolated-domain-gpos", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/isolated-domain-gpos", "redirect_document_id": true }, { "source_path": "windows/keep-secure/isolated-domain.md", -"redirect_url": "/windows/access-protection/windows-firewall/isolated-domain", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/isolated-domain", "redirect_document_id": true }, { "source_path": "windows/keep-secure/isolating-apps-on-your-network.md", -"redirect_url": "/windows/access-protection/windows-firewall/isolating-apps-on-your-network", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/isolating-apps-on-your-network", "redirect_document_id": true }, { "source_path": "windows/keep-secure/kerberos-policy.md", -"redirect_url": "/windows/device-security/security-policy-settings/kerberos-policy", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/kerberos-policy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/limitations-with-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/limitations-with-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/limitations-with-wip", "redirect_document_id": true }, { "source_path": "windows/keep-secure/link-the-gpo-to-the-domain.md", -"redirect_url": "/windows/access-protection/windows-firewall/link-the-gpo-to-the-domain", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/link-the-gpo-to-the-domain", "redirect_document_id": true }, { "source_path": "windows/keep-secure/load-and-unload-device-drivers.md", -"redirect_url": "/windows/device-security/security-policy-settings/load-and-unload-device-drivers", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/load-and-unload-device-drivers", "redirect_document_id": true }, { "source_path": "windows/keep-secure/local-accounts.md", -"redirect_url": "/windows/access-protection/access-control/local-accounts", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/local-accounts", "redirect_document_id": true }, { "source_path": "windows/keep-secure/lock-pages-in-memory.md", -"redirect_url": "/windows/device-security/security-policy-settings/lock-pages-in-memory", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/lock-pages-in-memory", "redirect_document_id": true }, { "source_path": "windows/keep-secure/log-on-as-a-batch-job.md", -"redirect_url": "/windows/device-security/security-policy-settings/log-on-as-a-batch-job", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/log-on-as-a-batch-job", "redirect_document_id": true }, { "source_path": "windows/keep-secure/log-on-as-a-service.md", -"redirect_url": "/windows/device-security/security-policy-settings/log-on-as-a-service", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/log-on-as-a-service", "redirect_document_id": true }, { "source_path": "windows/keep-secure/machines-view-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/maintain-applocker-policies.md", -"redirect_url": "/windows/device-security/applocker/maintain-applocker-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/maintain-applocker-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-auditing-and-security-log.md", -"redirect_url": "/windows/device-security/security-policy-settings/manage-auditing-and-security-log", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/manage-auditing-and-security-log", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-event-based-updates-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-outdated-endpoints-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-packaged-apps-with-applocker.md", -"redirect_url": "/windows/device-security/applocker/manage-packaged-apps-with-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/manage-packaged-apps-with-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-protection-update-schedule-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-protection-updates-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-tpm-commands.md", -"redirect_url": "/windows/device-security/tpm/manage-tpm-commands", +"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/manage-tpm-commands", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-tpm-lockout.md", -"redirect_url": "/windows/device-security/tpm/manage-tpm-lockout", +"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/manage-tpm-lockout", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-updates-baselines-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/manage-updates-mobile-devices-vms-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/mandatory-settings-for-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip", "redirect_document_id": true }, { "source_path": "windows/keep-secure/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/mapping-your-deployment-goals-to-a-windows-firewall-with-advanced-security-design", "redirect_document_id": true }, { "source_path": "windows/keep-secure/maximum-lifetime-for-service-ticket.md", -"redirect_url": "/windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-lifetime-for-service-ticket", "redirect_document_id": true }, { "source_path": "windows/keep-secure/maximum-lifetime-for-user-ticket-renewal.md", -"redirect_url": "/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket-renewal", "redirect_document_id": true }, { "source_path": "windows/keep-secure/maximum-lifetime-for-user-ticket.md", -"redirect_url": "/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-lifetime-for-user-ticket", "redirect_document_id": true }, { "source_path": "windows/keep-secure/maximum-password-age.md", -"redirect_url": "/windows/device-security/security-policy-settings/maximum-password-age", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-password-age", "redirect_document_id": true }, { "source_path": "windows/keep-secure/maximum-tolerance-for-computer-clock-synchronization.md", -"redirect_url": "/windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/maximum-tolerance-for-computer-clock-synchronization", "redirect_document_id": true }, { "source_path": "windows/keep-secure/merge-applocker-policies-by-using-set-applockerpolicy.md", -"redirect_url": "/windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/merge-applocker-policies-by-using-set-applockerpolicy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/merge-applocker-policies-manually.md", -"redirect_url": "/windows/device-security/applocker/merge-applocker-policies-manually", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/merge-applocker-policies-manually", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-accounts.md", -"redirect_url": "/windows/access-protection/access-control/microsoft-accounts", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/microsoft-accounts", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-network-client-digitally-sign-communications-always.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-always", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-network-client-digitally-sign-communications-if-server-agrees.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-client-digitally-sign-communications-if-server-agrees", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-client-send-unencrypted-password-to-third-party-smb-servers", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-network-server-amount-of-idle-time-required-before-suspending-session.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-amount-of-idle-time-required-before-suspending-session", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-attempt-s4u2self-to-obtain-claim-information", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-network-server-digitally-sign-communications-always.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-always", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-network-server-digitally-sign-communications-if-client-agrees.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-digitally-sign-communications-if-client-agrees", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-network-server-disconnect-clients-when-logon-hours-expire.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-disconnect-clients-when-logon-hours-expire", "redirect_document_id": true }, { "source_path": "windows/keep-secure/microsoft-network-server-server-spn-target-name-validation-level.md", -"redirect_url": "/windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/microsoft-network-server-server-spn-target-name-validation-level", "redirect_document_id": true }, { "source_path": "windows/keep-secure/minimum-password-age.md", -"redirect_url": "/windows/device-security/security-policy-settings/minimum-password-age", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/minimum-password-age", "redirect_document_id": true }, { "source_path": "windows/keep-secure/minimum-password-length.md", -"redirect_url": "/windows/device-security/security-policy-settings/minimum-password-length", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/minimum-password-length", "redirect_document_id": true }, { "source_path": "windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/modify-an-object-label.md", -"redirect_url": "/windows/device-security/security-policy-settings/modify-an-object-label", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/modify-an-object-label", "redirect_document_id": true }, { "source_path": "windows/keep-secure/modify-firmware-environment-values.md", -"redirect_url": "/windows/device-security/security-policy-settings/modify-firmware-environment-values", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/modify-firmware-environment-values", "redirect_document_id": true }, { "source_path": "windows/keep-secure/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows.md", -"redirect_url": "/windows/access-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/modify-gpo-filters-to-apply-to-a-different-zone-or-version-of-windows", "redirect_document_id": true }, { "source_path": "windows/keep-secure/monitor-application-usage-with-applocker.md", -"redirect_url": "/windows/device-security/applocker/monitor-application-usage-with-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/monitor-application-usage-with-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/monitor-central-access-policy-and-rule-definitions.md", -"redirect_url": "/windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-central-access-policy-and-rule-definitions", "redirect_document_id": true }, { "source_path": "windows/keep-secure/monitor-claim-types.md", -"redirect_url": "/windows/device-security/auditing/monitor-claim-types", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-claim-types", "redirect_document_id": true }, { "source_path": "windows/keep-secure/monitor-resource-attribute-definitions.md", -"redirect_url": "/windows/device-security/auditing/monitor-resource-attribute-definitions", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-resource-attribute-definitions", "redirect_document_id": true }, { "source_path": "windows/keep-secure/monitor-the-central-access-policies-associated-with-files-and-folders.md", -"redirect_url": "/windows/device-security/auditing/monitor-the-central-access-policies-associated-with-files-and-folders", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-central-access-policies-associated-with-files-and-folders", "redirect_document_id": true }, { "source_path": "windows/keep-secure/monitor-the-central-access-policies-that-apply-on-a-file-server.md", -"redirect_url": "/windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-central-access-policies-that-apply-on-a-file-server", "redirect_document_id": true }, { "source_path": "windows/keep-secure/monitor-the-resource-attributes-on-files-and-folders.md", -"redirect_url": "/windows/device-security/auditing/monitor-the-resource-attributes-on-files-and-folders", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-resource-attributes-on-files-and-folders", "redirect_document_id": true }, { "source_path": "windows/keep-secure/monitor-the-use-of-removable-storage-devices.md", -"redirect_url": "/windows/device-security/auditing/monitor-the-use-of-removable-storage-devices", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-the-use-of-removable-storage-devices", "redirect_document_id": true }, { "source_path": "windows/keep-secure/monitor-user-and-device-claims-during-sign-in.md", -"redirect_url": "/windows/device-security/auditing/monitor-user-and-device-claims-during-sign-in", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/monitor-user-and-device-claims-during-sign-in", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-access-allow-anonymous-sidname-translation.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-allow-anonymous-sidname-translation", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts-and-shares", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-do-not-allow-anonymous-enumeration-of-sam-accounts", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-do-not-allow-storage-of-passwords-and-credentials-for-network-authentication", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-access-let-everyone-permissions-apply-to-anonymous-users.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-let-everyone-permissions-apply-to-anonymous-users", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-access-named-pipes-that-can-be-accessed-anonymously.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-named-pipes-that-can-be-accessed-anonymously", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-access-remotely-accessible-registry-paths-and-subpaths.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-access-remotely-accessible-registry-paths.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-remotely-accessible-registry-paths", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-access-shares-that-can-be-accessed-anonymously.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-shares-that-can-be-accessed-anonymously", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-access-sharing-and-security-model-for-local-accounts.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-access-sharing-and-security-model-for-local-accounts", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-list-manager-policies.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-list-manager-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-list-manager-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-allow-localsystem-null-session-fallback.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-allow-localsystem-null-session-fallback", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-configure-encryption-types-allowed-for-kerberos.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-force-logoff-when-logon-hours-expire.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-force-logoff-when-logon-hours-expire", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-lan-manager-authentication-level.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-lan-manager-authentication-level", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-ldap-client-signing-requirements.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-ldap-client-signing-requirements", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-clients", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-remote-server-exceptions-for-ntlm-authentication", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-restrict-ntlm-add-server-exceptions-in-this-domain.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-add-server-exceptions-in-this-domain", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-restrict-ntlm-audit-incoming-ntlm-traffic.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-incoming-ntlm-traffic", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-audit-ntlm-authentication-in-this-domain", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-restrict-ntlm-incoming-ntlm-traffic.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-restrict-ntlm-ntlm-authentication-in-this-domain.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-ntlm-authentication-in-this-domain", "redirect_document_id": true }, { "source_path": "windows/keep-secure/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers.md", -"redirect_url": "/windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/network-security-restrict-ntlm-outgoing-ntlm-traffic-to-remote-servers", "redirect_document_id": true }, { "source_path": "windows/keep-secure/open-the-group-policy-management-console-to-ip-security-policies.md", -"redirect_url": "/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-ip-security-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security", "redirect_document_id": true }, { "source_path": "windows/keep-secure/open-the-group-policy-management-console-to-windows-firewall.md", -"redirect_url": "/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall", "redirect_document_id": true }, { "source_path": "windows/keep-secure/open-windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/access-protection/windows-firewall/open-windows-firewall-with-advanced-security", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/open-windows-firewall-with-advanced-security", "redirect_document_id": true }, { "source_path": "windows/keep-secure/optimize-applocker-performance.md", -"redirect_url": "/windows/device-security/applocker/optimize-applocker-performance", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/optimize-applocker-performance", "redirect_document_id": true }, { "source_path": "windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md", -"redirect_url": "/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/optional-create-a-code-signing-certificate-for-code-integrity-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/other-events.md", -"redirect_url": "/windows/device-security/auditing/other-events", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/other-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md", -"redirect_url": "/windows/threat-protection/override-mitigation-options-for-app-related-security-policies", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/override-mitigation-options-for-app-related-security-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/overview-create-wip-policy.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/overview-create-wip-policy", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/overview-create-wip-policy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/overview-of-threat-mitigations-in-windows-10.md", -"redirect_url": "/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/overview-of-threat-mitigations-in-windows-10", "redirect_document_id": true }, { "source_path": "windows/keep-secure/packaged-apps-and-packaged-app-installer-rules-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/password-must-meet-complexity-requirements.md", -"redirect_url": "/windows/device-security/security-policy-settings/password-must-meet-complexity-requirements", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/password-must-meet-complexity-requirements", "redirect_document_id": true }, { "source_path": "windows/keep-secure/password-policy.md", -"redirect_url": "/windows/device-security/security-policy-settings/password-policy", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/password-policy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/perform-volume-maintenance-tasks.md", -"redirect_url": "/windows/device-security/security-policy-settings/perform-volume-maintenance-tasks", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/perform-volume-maintenance-tasks", "redirect_document_id": true }, { "source_path": "windows/keep-secure/plan-for-applocker-policy-management.md", -"redirect_url": "/windows/device-security/applocker/plan-for-applocker-policy-management", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/plan-for-applocker-policy-management", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-and-deploying-advanced-security-audit-policies.md", -"redirect_url": "/windows/device-security/auditing/planning-and-deploying-advanced-security-audit-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/planning-and-deploying-advanced-security-audit-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md", -"redirect_url": "/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-certificate-based-authentication.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-certificate-based-authentication", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-certificate-based-authentication", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-domain-isolation-zones.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-domain-isolation-zones", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-domain-isolation-zones", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-gpo-deployment.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-gpo-deployment", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-gpo-deployment", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-group-policy-deployment-for-your-isolation-zones.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-group-policy-deployment-for-your-isolation-zones", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-isolation-groups-for-the-zones.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-isolation-groups-for-the-zones", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-isolation-groups-for-the-zones", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-network-access-groups.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-network-access-groups", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-network-access-groups", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-server-isolation-zones.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-server-isolation-zones", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-server-isolation-zones", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-settings-for-a-basic-firewall-policy.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-settings-for-a-basic-firewall-policy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-the-gpos.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-the-gpos", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-the-gpos", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-to-deploy-windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-to-deploy-windows-firewall-with-advanced-security", "redirect_document_id": true }, { "source_path": "windows/keep-secure/planning-your-windows-firewall-with-advanced-security-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/planning-your-windows-firewall-with-advanced-security-design", "redirect_document_id": true }, { "source_path": "windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/powershell-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/preferences-setup-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies.md", -"redirect_url": "/windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/prevent-end-user-interaction-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/prevent-end-user-interaction-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/preview-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/preview-settings-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/preview-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/procedures-used-in-this-guide.md", -"redirect_url": "/windows/access-protection/windows-firewall/procedures-used-in-this-guide", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/procedures-used-in-this-guide", "redirect_document_id": true }, { "source_path": "windows/keep-secure/profile-single-process.md", -"redirect_url": "/windows/device-security/security-policy-settings/profile-single-process", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/profile-single-process", "redirect_document_id": true }, { "source_path": "windows/keep-secure/profile-system-performance.md", -"redirect_url": "/windows/device-security/security-policy-settings/profile-system-performance", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/profile-system-performance", "redirect_document_id": true }, { "source_path": "windows/keep-secure/protect-bitlocker-from-pre-boot-attacks.md", -"redirect_url": "/windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/protect-bitlocker-from-pre-boot-attacks", "redirect_document_id": true }, { "source_path": "windows/keep-secure/protect-devices-from-unwanted-network-traffic.md", -"redirect_url": "/windows/access-protection/windows-firewall/protect-devices-from-unwanted-network-traffic", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/protect-devices-from-unwanted-network-traffic", "redirect_document_id": true }, { "source_path": "windows/keep-secure/protect-enterprise-data-using-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip", "redirect_document_id": true }, { "source_path": "windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md", -"redirect_url": "/windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", +"redirect_url": "https://docs.microsoft.com/windows/device-security/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices", "redirect_document_id": true }, { "source_path": "windows/keep-secure/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md", -"redirect_url": "/windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/python-example-code-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/recommended-network-definitions-for-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip", "redirect_document_id": true }, { "source_path": "windows/keep-secure/recovery-console-allow-automatic-administrative-logon.md", -"redirect_url": "/windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/recovery-console-allow-automatic-administrative-logon", "redirect_document_id": true }, { "source_path": "windows/keep-secure/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders.md", -"redirect_url": "/windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/recovery-console-allow-floppy-copy-and-access-to-all-drives-and-folders", "redirect_document_id": true }, { "source_path": "windows/keep-secure/refresh-an-applocker-policy.md", -"redirect_url": "/windows/device-security/applocker/refresh-an-applocker-policy", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/refresh-an-applocker-policy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/registry-global-object-access-auditing.md", -"redirect_url": "/windows/device-security/auditing/registry-global-object-access-auditing", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/registry-global-object-access-auditing", "redirect_document_id": true }, { "source_path": "windows/keep-secure/remote-credential-guard.md", -"redirect_url": "/windows/access-protection/remote-credential-guard", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/remote-credential-guard", "redirect_document_id": true }, { "source_path": "windows/keep-secure/remove-computer-from-docking-station.md", -"redirect_url": "/windows/device-security/security-policy-settings/remove-computer-from-docking-station", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/remove-computer-from-docking-station", "redirect_document_id": true }, { "source_path": "windows/keep-secure/replace-a-process-level-token.md", -"redirect_url": "/windows/device-security/security-policy-settings/replace-a-process-level-token", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/replace-a-process-level-token", "redirect_document_id": true }, { "source_path": "windows/keep-secure/report-monitor-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/report-monitor-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/require-encryption-when-accessing-sensitive-network-resources.md", -"redirect_url": "/windows/access-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources", "redirect_document_id": true }, { "source_path": "windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection", +"redirect_document_id": false }, { "source_path": "windows/keep-secure/requirements-for-deploying-applocker-policies.md", -"redirect_url": "/windows/device-security/applocker/requirements-for-deploying-applocker-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/requirements-for-deploying-applocker-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/requirements-to-use-applocker.md", -"redirect_url": "/windows/device-security/applocker/requirements-to-use-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/requirements-to-use-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/reset-account-lockout-counter-after.md", -"redirect_url": "/windows/device-security/security-policy-settings/reset-account-lockout-counter-after", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/reset-account-lockout-counter-after", "redirect_document_id": true }, { "source_path": "windows/keep-secure/respond-file-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/respond-machine-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/response-actions-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/restore-files-and-directories.md", -"redirect_url": "/windows/device-security/security-policy-settings/restore-files-and-directories", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/restore-files-and-directories", "redirect_document_id": true }, { "source_path": "windows/keep-secure/restrict-access-to-only-specified-users-or-devices.md", -"redirect_url": "/windows/access-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices", "redirect_document_id": true }, { "source_path": "windows/keep-secure/restrict-access-to-only-trusted-devices.md", -"redirect_url": "/windows/access-protection/windows-firewall/restrict-access-to-only-trusted-devices", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/restrict-access-to-only-trusted-devices", "redirect_document_id": true }, { "source_path": "windows/keep-secure/restrict-server-access-to-members-of-a-group-only.md", -"redirect_url": "/windows/access-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/restrict-server-access-to-members-of-a-group-only", "redirect_document_id": true }, { "source_path": "windows/keep-secure/review-scan-results-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/review-scan-results-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/run-scan-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/run-the-automatically-generate-rules-wizard.md", -"redirect_url": "/windows/device-security/applocker/run-the-automatically-generate-rules-wizard", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/run-the-automatically-generate-rules-wizard", "redirect_document_id": true }, { "source_path": "windows/keep-secure/scheduled-catch-up-scans-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/script-rules-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/script-rules-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/script-rules-in-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/secpol-advanced-security-audit-policy-settings.md", -"redirect_url": "/windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/secpol-advanced-security-audit-policy-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/securing-end-to-end-ipsec-connections-by-using-ikev2.md", -"redirect_url": "/windows/access-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2", "redirect_document_id": true }, { "source_path": "windows/keep-secure/security-auditing-overview.md", -"redirect_url": "/windows/device-security/auditing/security-auditing-overview", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/security-auditing-overview", "redirect_document_id": true }, { "source_path": "windows/keep-secure/security-considerations-for-applocker.md", -"redirect_url": "/windows/device-security/applocker/security-considerations-for-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/security-considerations-for-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/security-identifiers.md", -"redirect_url": "/windows/access-protection/access-control/security-identifiers", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/security-identifiers", "redirect_document_id": true }, { "source_path": "windows/keep-secure/security-options.md", -"redirect_url": "/windows/device-security/security-policy-settings/security-options", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/security-options", "redirect_document_id": true }, { "source_path": "windows/keep-secure/security-policy-settings-reference.md", -"redirect_url": "/windows/device-security/security-policy-settings/security-policy-settings-reference", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/security-policy-settings-reference", "redirect_document_id": true }, { "source_path": "windows/keep-secure/security-policy-settings.md", -"redirect_url": "/windows/device-security/security-policy-settings/security-policy-settings", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/security-policy-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/security-principals.md", -"redirect_url": "/windows/access-protection/access-control/security-principals", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/security-principals", "redirect_document_id": true }, { "source_path": "windows/keep-secure/select-types-of-rules-to-create.md", -"redirect_url": "/windows/device-security/applocker/select-types-of-rules-to-create", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/select-types-of-rules-to-create", "redirect_document_id": true }, { "source_path": "windows/keep-secure/server-isolation-gpos.md", -"redirect_url": "/windows/access-protection/windows-firewall/server-isolation-gpos", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/server-isolation-gpos", "redirect_document_id": true }, { "source_path": "windows/keep-secure/server-isolation-policy-design-example.md", -"redirect_url": "/windows/access-protection/windows-firewall/server-isolation-policy-design-example", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/server-isolation-policy-design-example", "redirect_document_id": true }, { "source_path": "windows/keep-secure/server-isolation-policy-design.md", -"redirect_url": "/windows/access-protection/windows-firewall/server-isolation-policy-design", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/server-isolation-policy-design", "redirect_document_id": true }, { "source_path": "windows/keep-secure/service-accounts.md", -"redirect_url": "/windows/access-protection/access-control/service-accounts", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/service-accounts", "redirect_document_id": true }, { "source_path": "windows/keep-secure/service-status-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/service-status-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/shut-down-the-system.md", -"redirect_url": "/windows/device-security/security-policy-settings/shut-down-the-system", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/shut-down-the-system", "redirect_document_id": true }, { "source_path": "windows/keep-secure/shutdown-allow-system-to-be-shut-down-without-having-to-log-on.md", -"redirect_url": "/windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/shutdown-allow-system-to-be-shut-down-without-having-to-log-on", "redirect_document_id": true }, { "source_path": "windows/keep-secure/shutdown-clear-virtual-memory-pagefile.md", -"redirect_url": "/windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/shutdown-clear-virtual-memory-pagefile", "redirect_document_id": true }, { "source_path": "windows/keep-secure/smart-card-and-remote-desktop-services.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-and-remote-desktop-services", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-and-remote-desktop-services", "redirect_document_id": true }, { "source_path": "windows/keep-secure/smart-card-architecture.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-architecture", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-architecture", "redirect_document_id": true }, { "source_path": "windows/keep-secure/smart-card-certificate-propagation-service.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-certificate-propagation-service", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-certificate-propagation-service", "redirect_document_id": true }, { "source_path": "windows/keep-secure/smart-card-certificate-requirements-and-enumeration.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-certificate-requirements-and-enumeration", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-certificate-requirements-and-enumeration", "redirect_document_id": true }, { "source_path": "windows/keep-secure/smart-card-debugging-information.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-debugging-information", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-debugging-information", "redirect_document_id": true }, { "source_path": "windows/keep-secure/smart-card-events.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-events", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-events", "redirect_document_id": true }, { "source_path": "windows/keep-secure/smart-card-group-policy-and-registry-settings.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-group-policy-and-registry-settings", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-group-policy-and-registry-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/smart-card-how-smart-card-sign-in-works-in-windows.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows", "redirect_document_id": true }, { "source_path": "windows/keep-secure/smart-card-removal-policy-service.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-removal-policy-service", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-removal-policy-service", "redirect_document_id": true }, { "source_path": "windows/keep-secure/smart-card-smart-cards-for-windows-service.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-smart-cards-for-windows-service", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-smart-cards-for-windows-service", "redirect_document_id": true }, { "source_path": "windows/keep-secure/smart-card-tools-and-settings.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-tools-and-settings", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-tools-and-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/smart-card-windows-smart-card-technical-reference.md", -"redirect_url": "/windows/access-protection/smart-cards/smart-card-windows-smart-card-technical-reference", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/smart-cards/smart-card-windows-smart-card-technical-reference", "redirect_document_id": true }, { "source_path": "windows/keep-secure/special-identities.md", -"redirect_url": "/windows/access-protection/access-control/special-identities", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/access-control/special-identities", "redirect_document_id": true }, { "source_path": "windows/keep-secure/specify-cloud-protection-level-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/store-passwords-using-reversible-encryption.md", -"redirect_url": "/windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/store-passwords-using-reversible-encryption", "redirect_document_id": true }, { "source_path": "windows/keep-secure/switch-pcr-banks-on-tpm-2-0-devices.md", -"redirect_url": "/windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices", +"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/switch-pcr-banks-on-tpm-2-0-devices", "redirect_document_id": true }, { "source_path": "windows/keep-secure/synchronize-directory-service-data.md", -"redirect_url": "/windows/device-security/security-policy-settings/synchronize-directory-service-data", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/synchronize-directory-service-data", "redirect_document_id": true }, { "source_path": "windows/keep-secure/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer.md", -"redirect_url": "/windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-cryptography-force-strong-key-protection-for-user-keys-stored-on-the-computer", "redirect_document_id": true }, { "source_path": "windows/keep-secure/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing.md", -"redirect_url": "/windows/device-security/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-cryptography-use-fips-compliant-algorithms-for-encryption-hashing-and-signing", "redirect_document_id": true }, { "source_path": "windows/keep-secure/system-objects-require-case-insensitivity-for-non-windows-subsystems.md", -"redirect_url": "/windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-objects-require-case-insensitivity-for-non-windows-subsystems", "redirect_document_id": true }, { "source_path": "windows/keep-secure/system-objects-strengthen-default-permissions-of-internal-system-objects.md", -"redirect_url": "/windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-objects-strengthen-default-permissions-of-internal-system-objects", "redirect_document_id": true }, { "source_path": "windows/keep-secure/system-settings-optional-subsystems.md", -"redirect_url": "/windows/device-security/security-policy-settings/system-settings-optional-subsystems", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-settings-optional-subsystems", "redirect_document_id": true }, { "source_path": "windows/keep-secure/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies.md", -"redirect_url": "/windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/system-settings-use-certificate-rules-on-windows-executables-for-software-restriction-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/take-ownership-of-files-or-other-objects.md", -"redirect_url": "/windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects", "redirect_document_id": true }, { "source_path": "windows/keep-secure/test-an-applocker-policy-by-using-test-applockerpolicy.md", -"redirect_url": "/windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/test-an-applocker-policy-by-using-test-applockerpolicy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/test-and-update-an-applocker-policy.md", -"redirect_url": "/windows/device-security/applocker/test-and-update-an-applocker-policy", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/test-and-update-an-applocker-policy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/testing-scenarios-for-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip", "redirect_document_id": true }, { "source_path": "windows/keep-secure/threat-indicator-concepts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/tools-to-use-with-applocker.md", -"redirect_url": "/windows/device-security/applocker/tools-to-use-with-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/tools-to-use-with-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/tpm-fundamentals.md", -"redirect_url": "/windows/device-security/tpm/tpm-fundamentals", +"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/tpm-fundamentals", "redirect_document_id": true }, { "source_path": "windows/keep-secure/tpm-recommendations.md", -"redirect_url": "/windows/device-security/tpm/tpm-recommendations", +"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/tpm-recommendations", "redirect_document_id": true }, { "source_path": "windows/keep-secure/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/troubleshoot-siem-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/keep-secure/troubleshoot-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/troubleshoot-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/trusted-platform-module-overview.md", -"redirect_url": "/windows/device-security/tpm/trusted-platform-module-overview", +"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-overview", "redirect_document_id": true }, { "source_path": "windows/keep-secure/trusted-platform-module-services-group-policy-settings.md", -"redirect_url": "/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings", +"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/trusted-platform-module-top-node.md", -"redirect_url": "/windows/device-security/tpm/trusted-platform-module-top-node", +"redirect_url": "https://docs.microsoft.com/windows/device-security/tpm/trusted-platform-module-top-node", "redirect_document_id": true }, { "source_path": "windows/keep-secure/turn-on-windows-firewall-and-configure-default-behavior.md", -"redirect_url": "/windows/access-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/turn-on-windows-firewall-and-configure-default-behavior", "redirect_document_id": true }, { "source_path": "windows/keep-secure/types-of-attacks-for-volume-encryption-keys.md", -"redirect_url": "/windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys", +"redirect_url": "https://docs.microsoft.com/windows/device-security/bitlocker/types-of-attacks-for-volume-encryption-keys", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understand-applocker-enforcement-settings.md", -"redirect_url": "/windows/device-security/applocker/understand-applocker-enforcement-settings", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-applocker-enforcement-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understand-applocker-policy-design-decisions.md", -"redirect_url": "/windows/device-security/applocker/understand-applocker-policy-design-decisions", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-applocker-policy-design-decisions", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md", -"redirect_url": "/windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understand-the-applocker-policy-deployment-process.md", -"redirect_url": "/windows/device-security/applocker/understand-the-applocker-policy-deployment-process", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understand-the-applocker-policy-deployment-process", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understanding-applocker-allow-and-deny-actions-on-rules.md", -"redirect_url": "/windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-allow-and-deny-actions-on-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understanding-applocker-default-rules.md", -"redirect_url": "/windows/device-security/applocker/understanding-applocker-default-rules", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-default-rules", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understanding-applocker-rule-behavior.md", -"redirect_url": "/windows/device-security/applocker/understanding-applocker-rule-behavior", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-behavior", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understanding-applocker-rule-collections.md", -"redirect_url": "/windows/device-security/applocker/understanding-applocker-rule-collections", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-collections", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understanding-applocker-rule-condition-types.md", -"redirect_url": "/windows/device-security/applocker/understanding-applocker-rule-condition-types", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-condition-types", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understanding-applocker-rule-exceptions.md", -"redirect_url": "/windows/device-security/applocker/understanding-applocker-rule-exceptions", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-applocker-rule-exceptions", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understanding-the-file-hash-rule-condition-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-the-file-hash-rule-condition-in-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understanding-the-path-rule-condition-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-the-path-rule-condition-in-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understanding-the-publisher-rule-condition-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/understanding-the-publisher-rule-condition-in-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/understanding-the-windows-firewall-with-advanced-security-design-process.md", -"redirect_url": "/windows/access-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/understanding-the-windows-firewall-with-advanced-security-design-process", "redirect_document_id": true }, { "source_path": "windows/keep-secure/use-a-reference-computer-to-create-and-maintain-applocker-policies.md", -"redirect_url": "/windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/use-applocker-and-software-restriction-policies-in-the-same-domain.md", -"redirect_url": "/windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain", "redirect_document_id": true }, { "source_path": "windows/keep-secure/use-custom-ti-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/use-group-policy-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-group-policy-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/use-intune-config-manager-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/use-powershell-cmdlets-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/use-the-applocker-windows-powershell-cmdlets.md", -"redirect_url": "/windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/use-the-applocker-windows-powershell-cmdlets", "redirect_document_id": true }, { "source_path": "windows/keep-secure/use-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/use-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/use-windows-event-forwarding-to-assist-in-instrusion-detection.md", -"redirect_url": "/windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/use-windows-event-forwarding-to-assist-in-instrusion-detection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/use-wmi-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/use-wmi-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-admin-approval-mode-for-the-built-in-administrator-account.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-admin-approval-mode-for-the-built-in-administrator-account", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-behavior-of-the-elevation-prompt-for-standard-users.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-behavior-of-the-elevation-prompt-for-standard-users", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-detect-application-installations-and-prompt-for-elevation.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-detect-application-installations-and-prompt-for-elevation", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-group-policy-and-registry-key-settings.md", -"redirect_url": "/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-only-elevate-executables-that-are-signed-and-validated.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-only-elevate-executables-that-are-signed-and-validated", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-overview.md", -"redirect_url": "/windows/access-protection/user-account-control/user-account-control-overview", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-overview", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-run-all-administrators-in-admin-approval-mode.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-security-policy-settings.md", -"redirect_url": "/windows/access-protection/user-account-control/user-account-control-security-policy-settings", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-security-policy-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-switch-to-the-secure-desktop-when-prompting-for-elevation", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-account-control-virtualize-file-and-registry-write-failures-to-per-user-locations", "redirect_document_id": true }, { "source_path": "windows/keep-secure/user-rights-assignment.md", -"redirect_url": "/windows/device-security/security-policy-settings/user-rights-assignment", +"redirect_url": "https://docs.microsoft.com/windows/device-security/security-policy-settings/user-rights-assignment", "redirect_document_id": true }, { "source_path": "windows/keep-secure/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md", -"redirect_url": "/windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects", "redirect_document_id": true }, { "source_path": "windows/keep-secure/using-event-viewer-with-applocker.md", -"redirect_url": "/windows/device-security/applocker/using-event-viewer-with-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/using-event-viewer-with-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/using-owa-with-wip.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/using-owa-with-wip", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/using-owa-with-wip", "redirect_document_id": true }, { "source_path": "windows/keep-secure/using-software-restriction-policies-and-applocker-policies.md", -"redirect_url": "/windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/using-software-restriction-policies-and-applocker-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/utilize-microsoft-cloud-protection-windows-defender-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/verify-that-network-traffic-is-authenticated.md", -"redirect_url": "/windows/access-protection/windows-firewall/verify-that-network-traffic-is-authenticated", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/verify-that-network-traffic-is-authenticated", "redirect_document_id": true }, { "source_path": "windows/keep-secure/view-the-security-event-log.md", -"redirect_url": "/windows/device-security/auditing/view-the-security-event-log", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/view-the-security-event-log", "redirect_document_id": true }, { "source_path": "windows/keep-secure/virtual-smart-card-deploy-virtual-smart-cards.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards", "redirect_document_id": true }, { "source_path": "windows/keep-secure/virtual-smart-card-evaluate-security.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-evaluate-security", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-evaluate-security", "redirect_document_id": true }, { "source_path": "windows/keep-secure/virtual-smart-card-get-started.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-get-started", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-get-started", "redirect_document_id": true }, { "source_path": "windows/keep-secure/virtual-smart-card-overview.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-overview", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-overview", "redirect_document_id": true }, { "source_path": "windows/keep-secure/virtual-smart-card-tpmvscmgr.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr", "redirect_document_id": true }, { "source_path": "windows/keep-secure/virtual-smart-card-understanding-and-evaluating.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating", "redirect_document_id": true }, { "source_path": "windows/keep-secure/virtual-smart-card-use-virtual-smart-cards.md", -"redirect_url": "/windows/access-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards", "redirect_document_id": true }, { "source_path": "windows/keep-secure/vpn-authentication.md", -"redirect_url": "/windows/access-protection/vpn/vpn-authentication", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-authentication", "redirect_document_id": true }, { "source_path": "windows/keep-secure/vpn-auto-trigger-profile.md", -"redirect_url": "/windows/access-protection/vpn/vpn-auto-trigger-profile", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-auto-trigger-profile", "redirect_document_id": true }, { "source_path": "windows/keep-secure/vpn-conditional-access.md", -"redirect_url": "/windows/access-protection/vpn/vpn-conditional-access", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-conditional-access", "redirect_document_id": true }, { "source_path": "windows/keep-secure/vpn-connection-type.md", -"redirect_url": "/windows/access-protection/vpn/vpn-connection-type", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-connection-type", "redirect_document_id": true }, { "source_path": "windows/keep-secure/vpn-guide.md", -"redirect_url": "/windows/access-protection/vpn/vpn-guide", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-guide", "redirect_document_id": true }, { "source_path": "windows/keep-secure/vpn-name-resolution.md", -"redirect_url": "/windows/access-protection/vpn/vpn-name-resolution", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-name-resolution", "redirect_document_id": true }, { "source_path": "windows/keep-secure/vpn-profile-options.md", -"redirect_url": "/windows/access-protection/vpn/vpn-profile-options", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-profile-options", "redirect_document_id": true }, { "source_path": "windows/keep-secure/vpn-routing.md", -"redirect_url": "/windows/access-protection/vpn/vpn-routing", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-routing", "redirect_document_id": true }, { "source_path": "windows/keep-secure/vpn-security-features.md", -"redirect_url": "/windows/access-protection/vpn/vpn-security-features", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/vpn/vpn-security-features", "redirect_document_id": true }, { "source_path": "windows/keep-secure/what-is-applocker.md", -"redirect_url": "/windows/device-security/applocker/what-is-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/what-is-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/which-editions-of-windows-support-advanced-audit-policy-configuration.md", -"redirect_url": "/windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", +"redirect_url": "https://docs.microsoft.com/windows/device-security/auditing/which-editions-of-windows-support-advanced-audit-policy-configuration", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-10-mobile-security-guide.md", -"redirect_url": "/windows/device-security/windows-10-mobile-security-guide", +"redirect_url": "https://docs.microsoft.com/windows/device-security/windows-10-mobile-security-guide", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-credential-theft-mitigation-guide-abstract.md", -"redirect_url": "/windows/access-protection/windows-credential-theft-mitigation-guide-abstract", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-credential-theft-mitigation-guide-abstract", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-antivirus-compatibility.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-compatibility", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-antivirus-in-windows-10.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-antivirus-on-windows-server-2016.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-offline.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/windows-defender-offline", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-offline", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-security-center-antivirus.md", -"redirect_url": "/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-antivirus/windows-defender-security-center-antivirus", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-available-settings.md", -"redirect_url": "/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-overview.md", -"redirect_url": "/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-overview", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-defender-smartscreen-set-individual-device.md", -"redirect_url": "/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-firewall-with-advanced-security-administration-with-windows-powershell.md", -"redirect_url": "/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-firewall-with-advanced-security-deployment-guide.md", -"redirect_url": "/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-firewall-with-advanced-security-design-guide.md", -"redirect_url": "/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security-design-guide", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-firewall-with-advanced-security.md", -"redirect_url": "/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security", +"redirect_url": "https://docs.microsoft.com/windows/access-protection/windows-firewall/windows-firewall-with-advanced-security", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-installer-rules-in-applocker.md", -"redirect_url": "/windows/device-security/applocker/windows-installer-rules-in-applocker", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/windows-installer-rules-in-applocker", "redirect_document_id": true }, { "source_path": "windows/keep-secure/windows-security-baselines.md", -"redirect_url": "/windows/device-security/windows-security-baselines", +"redirect_url": "https://docs.microsoft.com/windows/device-security/windows-security-baselines", "redirect_document_id": true }, { "source_path": "windows/keep-secure/wip-app-enterprise-context.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/wip-app-enterprise-context", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/wip-app-enterprise-context", "redirect_document_id": true }, { "source_path": "windows/keep-secure/working-with-applocker-policies.md", -"redirect_url": "/windows/device-security/applocker/working-with-applocker-policies", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/working-with-applocker-policies", "redirect_document_id": true }, { "source_path": "windows/keep-secure/working-with-applocker-rules.md", -"redirect_url": "/windows/device-security/applocker/working-with-applocker-rules", +"redirect_url": "https://docs.microsoft.com/windows/device-security/applocker/working-with-applocker-rules", "redirect_document_id": true }, { "source_path": "windows/manage/acquire-apps-windows-store-for-business.md", -"redirect_url": "/microsoft-store/acquire-apps-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/acquire-apps-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/acquire-apps-windows-store-for-business.md", -"redirect_url": "/microsoft-store/acquire-apps-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/acquire-apps-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/add-unsigned-app-to-code-integrity-policy.md", -"redirect_url": "/microsoft-store/add-unsigned-app-to-code-integrity-policy", +"redirect_url": "https://docs.microsoft.com/microsoft-store/add-unsigned-app-to-code-integrity-policy", "redirect_document_id": true }, { "source_path": "windows/manage/administrative-tools-in-windows-10.md", -"redirect_url": "/windows/client-management/administrative-tools-in-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/client-management/administrative-tools-in-windows-10", "redirect_document_id": true }, { "source_path": "windows/manage/app-inventory-management-windows-store-for-business.md", -"redirect_url": "/microsoft-store/app-inventory-management-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/app-inventory-management-windows-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/apps-in-windows-store-for-business.md", -"redirect_url": "/microsoft-store/apps-in-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/apps-in-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/apps-in-windows-store-for-business.md", -"redirect_url": "/microsoft-store/apps-in-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/apps-in-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/appv-about-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-about-appv", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-about-appv", "redirect_document_id": true }, { "source_path": "windows/manage/appv-add-or-remove-an-administrator-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-add-or-upgrade-packages-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-administering-appv-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-administering-appv-with-powershell", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-administering-appv-with-powershell", "redirect_document_id": true }, { "source_path": "windows/manage/appv-administering-virtual-applications-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-allow-administrators-to-enable-connection-groups.md", -"redirect_url": "/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups", "redirect_document_id": true }, { "source_path": "windows/manage/appv-application-publishing-and-client-interaction.md", -"redirect_url": "/windows/application-management/app-v/appv-application-publishing-and-client-interaction", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-application-publishing-and-client-interaction", "redirect_document_id": true }, { "source_path": "windows/manage/appv-apply-the-deployment-configuration-file-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell", "redirect_document_id": true }, { "source_path": "windows/manage/appv-apply-the-user-configuration-file-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell", "redirect_document_id": true }, { "source_path": "windows/manage/appv-auto-batch-sequencing.md", -"redirect_url": "/windows/application-management/app-v/appv-auto-batch-sequencing", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-batch-sequencing", "redirect_document_id": true }, { "source_path": "windows/manage/appv-auto-batch-updating.md", -"redirect_url": "/windows/application-management/app-v/appv-auto-batch-updating", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-batch-updating", "redirect_document_id": true }, { "source_path": "windows/manage/appv-auto-clean-unpublished-packages.md", -"redirect_url": "/windows/application-management/app-v/appv-auto-clean-unpublished-packages", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-clean-unpublished-packages", "redirect_document_id": true }, { "source_path": "windows/manage/appv-auto-provision-a-vm.md", -"redirect_url": "/windows/application-management/app-v/appv-auto-provision-a-vm", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-auto-provision-a-vm", "redirect_document_id": true }, { "source_path": "windows/manage/appv-available-mdm-settings.md", -"redirect_url": "/windows/application-management/app-v/appv-available-mdm-settings", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-available-mdm-settings", "redirect_document_id": true }, { "source_path": "windows/manage/appv-capacity-planning.md", -"redirect_url": "/windows/application-management/app-v/appv-capacity-planning", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-capacity-planning", "redirect_document_id": true }, { "source_path": "windows/manage/appv-client-configuration-settings.md", -"redirect_url": "/windows/application-management/app-v/appv-client-configuration-settings", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-client-configuration-settings", "redirect_document_id": true }, { "source_path": "windows/manage/appv-configure-access-to-packages-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-configure-connection-groups-to-ignore-the-package-version.md", -"redirect_url": "/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version", "redirect_document_id": true }, { "source_path": "windows/manage/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md", -"redirect_url": "/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server", "redirect_document_id": true }, { "source_path": "windows/manage/appv-connect-to-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-connect-to-the-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-connect-to-the-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-connection-group-file.md", -"redirect_url": "/windows/application-management/app-v/appv-connection-group-file", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-connection-group-file", "redirect_document_id": true }, { "source_path": "windows/manage/appv-connection-group-virtual-environment.md", -"redirect_url": "/windows/application-management/app-v/appv-connection-group-virtual-environment", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-connection-group-virtual-environment", "redirect_document_id": true }, { "source_path": "windows/manage/appv-convert-a-package-created-in-a-previous-version-of-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv", "redirect_document_id": true }, { "source_path": "windows/manage/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md", -"redirect_url": "/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages", "redirect_document_id": true }, { "source_path": "windows/manage/appv-create-a-connection-group.md", -"redirect_url": "/windows/application-management/app-v/appv-create-a-connection-group", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-connection-group", "redirect_document_id": true }, { "source_path": "windows/manage/appv-create-a-custom-configuration-file-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-create-a-package-accelerator-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell", "redirect_document_id": true }, { "source_path": "windows/manage/appv-create-a-package-accelerator.md", -"redirect_url": "/windows/application-management/app-v/appv-create-a-package-accelerator", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-package-accelerator", "redirect_document_id": true }, { "source_path": "windows/manage/appv-create-a-virtual-application-package-package-accelerator.md", -"redirect_url": "/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator", "redirect_document_id": true }, { "source_path": "windows/manage/appv-create-and-use-a-project-template.md", -"redirect_url": "/windows/application-management/app-v/appv-create-and-use-a-project-template", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-create-and-use-a-project-template", "redirect_document_id": true }, { "source_path": "windows/manage/appv-creating-and-managing-virtualized-applications.md", -"redirect_url": "/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications", "redirect_document_id": true }, { "source_path": "windows/manage/appv-customize-virtual-application-extensions-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-delete-a-connection-group.md", -"redirect_url": "/windows/application-management/app-v/appv-delete-a-connection-group", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-delete-a-connection-group", "redirect_document_id": true }, { "source_path": "windows/manage/appv-delete-a-package-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-delete-a-package-with-the-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-delete-a-package-with-the-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-deploy-appv-databases-with-sql-scripts.md", -"redirect_url": "/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts", "redirect_document_id": true }, { "source_path": "windows/manage/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md", -"redirect_url": "/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions", "redirect_document_id": true }, { "source_path": "windows/manage/appv-deploy-the-appv-server-with-a-script.md", -"redirect_url": "/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script", "redirect_document_id": true }, { "source_path": "windows/manage/appv-deploy-the-appv-server.md", -"redirect_url": "/windows/application-management/app-v/appv-deploy-the-appv-server", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploy-the-appv-server", "redirect_document_id": true }, { "source_path": "windows/manage/appv-deploying-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-appv", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-appv", "redirect_document_id": true }, { "source_path": "windows/manage/appv-deploying-microsoft-office-2010-wth-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv", "redirect_document_id": true }, { "source_path": "windows/manage/appv-deploying-microsoft-office-2013-with-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv", "redirect_document_id": true }, { "source_path": "windows/manage/appv-deploying-microsoft-office-2016-with-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv", "redirect_document_id": true }, { "source_path": "windows/manage/appv-deploying-packages-with-electronic-software-distribution-solutions.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions", "redirect_document_id": true }, { "source_path": "windows/manage/appv-deploying-the-appv-sequencer-and-client.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client", "redirect_document_id": true }, { "source_path": "windows/manage/appv-deploying-the-appv-server.md", -"redirect_url": "/windows/application-management/app-v/appv-deploying-the-appv-server", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deploying-the-appv-server", "redirect_document_id": true }, { "source_path": "windows/manage/appv-deployment-checklist.md", -"redirect_url": "/windows/application-management/app-v/appv-deployment-checklist", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-deployment-checklist", "redirect_document_id": true }, { "source_path": "windows/manage/appv-dynamic-configuration.md", -"redirect_url": "/windows/application-management/app-v/appv-dynamic-configuration", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-dynamic-configuration", "redirect_document_id": true }, { "source_path": "windows/manage/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md", -"redirect_url": "/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions", "redirect_document_id": true }, { "source_path": "windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell", "redirect_document_id": true }, { "source_path": "windows/manage/appv-enable-the-app-v-desktop-client.md", -"redirect_url": "/windows/application-management/app-v/appv-enable-the-app-v-desktop-client", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-enable-the-app-v-desktop-client", "redirect_document_id": true }, { "source_path": "windows/manage/appv-evaluating-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-evaluating-appv", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-evaluating-appv", "redirect_document_id": true }, { "source_path": "windows/manage/appv-for-windows.md", -"redirect_url": "/windows/application-management/app-v/appv-for-windows", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-for-windows", "redirect_document_id": true }, { "source_path": "windows/manage/appv-getting-started.md", -"redirect_url": "/windows/application-management/app-v/appv-getting-started", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-getting-started", "redirect_document_id": true }, { "source_path": "windows/manage/appv-high-level-architecture.md", -"redirect_url": "/windows/application-management/app-v/appv-high-level-architecture", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-high-level-architecture", "redirect_document_id": true }, { "source_path": "windows/manage/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell", "redirect_document_id": true }, { "source_path": "windows/manage/appv-install-the-management-and-reporting-databases-on-separate-computers.md", -"redirect_url": "/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers", "redirect_document_id": true }, { "source_path": "windows/manage/appv-install-the-management-server-on-a-standalone-computer.md", -"redirect_url": "/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer", "redirect_document_id": true }, { "source_path": "windows/manage/appv-install-the-publishing-server-on-a-remote-computer.md", -"redirect_url": "/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer", "redirect_document_id": true }, { "source_path": "windows/manage/appv-install-the-reporting-server-on-a-standalone-computer.md", -"redirect_url": "/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer", "redirect_document_id": true }, { "source_path": "windows/manage/appv-install-the-sequencer.md", -"redirect_url": "/windows/application-management/app-v/appv-install-the-sequencer", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-install-the-sequencer", "redirect_document_id": true }, { "source_path": "windows/manage/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md", -"redirect_url": "/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help", "redirect_document_id": true }, { "source_path": "windows/manage/appv-maintaining-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-maintaining-appv", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-maintaining-appv", "redirect_document_id": true }, { "source_path": "windows/manage/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell", "redirect_document_id": true }, { "source_path": "windows/manage/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell", "redirect_document_id": true }, { "source_path": "windows/manage/appv-managing-connection-groups.md", -"redirect_url": "/windows/application-management/app-v/appv-managing-connection-groups", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-managing-connection-groups", "redirect_document_id": true }, { "source_path": "windows/manage/appv-migrating-to-appv-from-a-previous-version.md", -"redirect_url": "/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version", "redirect_document_id": true }, { "source_path": "windows/manage/appv-modify-an-existing-virtual-application-package.md", -"redirect_url": "/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package", "redirect_document_id": true }, { "source_path": "windows/manage/appv-modify-client-configuration-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-modify-client-configuration-with-powershell", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-modify-client-configuration-with-powershell", "redirect_document_id": true }, { "source_path": "windows/manage/appv-move-the-appv-server-to-another-computer.md", -"redirect_url": "/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer", "redirect_document_id": true }, { "source_path": "windows/manage/appv-operations.md", -"redirect_url": "/windows/application-management/app-v/appv-operations", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-operations", "redirect_document_id": true }, { "source_path": "windows/manage/appv-performance-guidance.md", -"redirect_url": "/windows/application-management/app-v/appv-performance-guidance", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-performance-guidance", "redirect_document_id": true }, { "source_path": "windows/manage/appv-planning-checklist.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-checklist", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-checklist", "redirect_document_id": true }, { "source_path": "windows/manage/appv-planning-folder-redirection-with-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-folder-redirection-with-appv", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-folder-redirection-with-appv", "redirect_document_id": true }, { "source_path": "windows/manage/appv-planning-for-appv-server-deployment.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-for-appv-server-deployment", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-appv-server-deployment", "redirect_document_id": true }, { "source_path": "windows/manage/appv-planning-for-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-for-appv", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-appv", "redirect_document_id": true }, { "source_path": "windows/manage/appv-planning-for-high-availability-with-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-for-high-availability-with-appv", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-high-availability-with-appv", "redirect_document_id": true }, { "source_path": "windows/manage/appv-planning-for-sequencer-and-client-deployment.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment", "redirect_document_id": true }, { "source_path": "windows/manage/appv-planning-for-using-appv-with-office.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-for-using-appv-with-office", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-for-using-appv-with-office", "redirect_document_id": true }, { "source_path": "windows/manage/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions", "redirect_document_id": true }, { "source_path": "windows/manage/appv-planning-to-deploy-appv.md", -"redirect_url": "/windows/application-management/app-v/appv-planning-to-deploy-appv", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-planning-to-deploy-appv", "redirect_document_id": true }, { "source_path": "windows/manage/appv-preparing-your-environment.md", -"redirect_url": "/windows/application-management/app-v/appv-preparing-your-environment", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-preparing-your-environment", "redirect_document_id": true }, { "source_path": "windows/manage/appv-prerequisites.md", -"redirect_url": "/windows/application-management/app-v/appv-prerequisites", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-prerequisites", "redirect_document_id": true }, { "source_path": "windows/manage/appv-publish-a-connection-group.md", -"redirect_url": "/windows/application-management/app-v/appv-publish-a-connection-group", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-publish-a-connection-group", "redirect_document_id": true }, { "source_path": "windows/manage/appv-publish-a-packages-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-register-and-unregister-a-publishing-server-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-release-notes-for-appv-for-windows-1703.md", -"redirect_url": "/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703", "redirect_document_id": true }, { "source_path": "windows/manage/appv-release-notes-for-appv-for-windows.md", -"redirect_url": "/windows/application-management/app-v/appv-release-notes-for-appv-for-windows", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-release-notes-for-appv-for-windows", "redirect_document_id": true }, { "source_path": "windows/manage/appv-reporting.md", -"redirect_url": "/windows/application-management/app-v/appv-reporting", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-reporting", "redirect_document_id": true }, { "source_path": "windows/manage/appv-running-locally-installed-applications-inside-a-virtual-environment.md", -"redirect_url": "/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment", "redirect_document_id": true }, { "source_path": "windows/manage/appv-security-considerations.md", -"redirect_url": "/windows/application-management/app-v/appv-security-considerations", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-security-considerations", "redirect_document_id": true }, { "source_path": "windows/manage/appv-sequence-a-new-application.md", -"redirect_url": "/windows/application-management/app-v/appv-sequence-a-new-application", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-sequence-a-new-application", "redirect_document_id": true }, { "source_path": "windows/manage/appv-sequence-a-package-with-powershell.md", -"redirect_url": "/windows/application-management/app-v/appv-sequence-a-package-with-powershell", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-sequence-a-package-with-powershell", "redirect_document_id": true }, { "source_path": "windows/manage/appv-supported-configurations.md", -"redirect_url": "/windows/application-management/app-v/appv-supported-configurations", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-supported-configurations", "redirect_document_id": true }, { "source_path": "windows/manage/appv-technical-reference.md", -"redirect_url": "/windows/application-management/app-v/appv-technical-reference", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-technical-reference", "redirect_document_id": true }, { "source_path": "windows/manage/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-troubleshooting.md", -"redirect_url": "/windows/application-management/app-v/appv-troubleshooting", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-troubleshooting", "redirect_document_id": true }, { "source_path": "windows/manage/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md", -"redirect_url": "/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation", "redirect_document_id": true }, { "source_path": "windows/manage/appv-using-the-client-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-using-the-client-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-using-the-client-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md", -"redirect_url": "/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console", "redirect_document_id": true }, { "source_path": "windows/manage/appv-viewing-appv-server-publishing-metadata.md", -"redirect_url": "/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata", +"redirect_url": "https://docs.microsoft.com/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata", "redirect_document_id": true }, { "source_path": "windows/manage/assign-apps-to-employees.md", -"redirect_url": "/microsoft-store/assign-apps-to-employees", +"redirect_url": "https://docs.microsoft.com/microsoft-store/assign-apps-to-employees", "redirect_document_id": true }, { "source_path": "windows/manage/configure-mdm-provider-windows-store-for-business.md", -"redirect_url": "/microsoft-store/configure-mdm-provider-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/configure-mdm-provider-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/configure-mdm-provider-windows-store-for-business.md", -"redirect_url": "/microsoft-store/configure-mdm-provider-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/configure-mdm-provider-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/connect-to-remote-aadj-pc.md", -"redirect_url": "/windows/client-management/connect-to-remote-aadj-pc", +"redirect_url": "https://docs.microsoft.com/windows/client-management/connect-to-remote-aadj-pc", "redirect_document_id": true }, { "source_path": "windows/manage/device-guard-signing-portal.md", -"redirect_url": "/microsoft-store/device-guard-signing-portal", +"redirect_url": "https://docs.microsoft.com/microsoft-store/device-guard-signing-portal", "redirect_document_id": true }, { "source_path": "windows/manage/distribute-apps-from-your-private-store.md", -"redirect_url": "/microsoft-store/distribute-apps-from-your-private-store", +"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-from-your-private-store", "redirect_document_id": true }, { "source_path": "windows/manage/distribute-apps-to-your-employees-windows-store-for-business.md", -"redirect_url": "/microsoft-store/distribute-apps-to-your-employees-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-to-your-employees-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/distribute-apps-to-your-employees-windows-store-for-business.md", -"redirect_url": "/microsoft-store/distribute-apps-to-your-employees-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-to-your-employees-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/distribute-apps-with-management-tool.md", -"redirect_url": "/microsoft-store/distribute-apps-with-management-tool", +"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-apps-with-management-tool", "redirect_document_id": true }, { "source_path": "windows/manage/distribute-offline-apps.md", -"redirect_url": "/microsoft-store/distribute-offline-apps", +"redirect_url": "https://docs.microsoft.com/microsoft-store/distribute-offline-apps", "redirect_document_id": true }, { "source_path": "windows/manage/find-and-acquire-apps-overview.md", -"redirect_url": "/microsoft-store/find-and-acquire-apps-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/find-and-acquire-apps-overview", "redirect_document_id": true }, { "source_path": "windows/manage/group-policies-for-enterprise-and-education-editions.md", -"redirect_url": "/windows/client-management/group-policies-for-enterprise-and-education-editions", +"redirect_url": "https://docs.microsoft.com/windows/client-management/group-policies-for-enterprise-and-education-editions", "redirect_document_id": true }, { "source_path": "windows/manage/join-windows-10-mobile-to-azure-active-directory.md", -"redirect_url": "/windows/client-management/join-windows-10-mobile-to-azure-active-directory", +"redirect_url": "https://docs.microsoft.com/windows/client-management/join-windows-10-mobile-to-azure-active-directory", "redirect_document_id": true }, { "source_path": "windows/manage/manage-access-to-private-store.md", -"redirect_url": "/microsoft-store/manage-access-to-private-store", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-access-to-private-store", "redirect_document_id": true }, { @@ -12892,662 +13743,772 @@ }, { "source_path": "store-for-business/manage-apps-windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/manage-apps-microsoft-store-for-business-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-apps-microsoft-store-for-business-overview", "redirect_document_id": true }, { "source_path": "windows/manage/manage-corporate-devices.md", -"redirect_url": "/windows/client-management/index", +"redirect_url": "https://docs.microsoft.com/windows/client-management/index", "redirect_document_id": true }, { "source_path": "windows/manage/manage-orders-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-orders-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-orders-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/manage-orders-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-orders-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-orders-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/manage-private-store-settings.md", -"redirect_url": "/microsoft-store/manage-private-store-settings", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-private-store-settings", "redirect_document_id": true }, { "source_path": "windows/manage/manage-settings-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-settings-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-settings-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/manage-settings-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-settings-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-settings-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/manage-users-and-groups-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-users-and-groups-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-users-and-groups-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/manage-users-and-groups-windows-store-for-business.md", -"redirect_url": "/microsoft-store/manage-users-and-groups-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/manage-users-and-groups-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/manage-windows-10-in-your-organization-modern-management.md", -"redirect_url": "/windows/client-management/manage-windows-10-in-your-organization-modern-management", +"redirect_url": "https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management", "redirect_document_id": true }, { "source_path": "windows/manage/mandatory-user-profile.md", -"redirect_url": "/windows/client-management/mandatory-user-profile", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mandatory-user-profile", "redirect_document_id": true }, { "source_path": "windows/manage/new-policies-for-windows-10.md", -"redirect_url": "/windows/client-management/new-policies-for-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/client-management/new-policies-for-windows-10", "redirect_document_id": true }, { "source_path": "windows/manage/prerequisites-windows-store-for-business.md", -"redirect_url": "/microsoft-store/prerequisites-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/prerequisites-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/prerequisites-windows-store-for-business.md", -"redirect_url": "/microsoft-store/prerequisites-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/reset-a-windows-10-mobile-device.md", -"redirect_url": "/windows/client-management/reset-a-windows-10-mobile-device", +"redirect_url": "https://docs.microsoft.com/windows/client-management/reset-a-windows-10-mobile-device", "redirect_document_id": true }, { "source_path": "windows/manage/roles-and-permissions-windows-store-for-business.md", -"redirect_url": "/microsoft-store/roles-and-permissions-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/roles-and-permissions-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/roles-and-permissions-windows-store-for-business.md", -"redirect_url": "/microsoft-store/roles-and-permissions-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/roles-and-permissions-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/settings-reference-windows-store-for-business.md", -"redirect_url": "/microsoft-store/settings-reference-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/settings-reference-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/settings-reference-windows-store-for-business.md", -"redirect_url": "/microsoft-store/settings-reference-microsoft-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/settings-reference-microsoft-store-for-business", "redirect_document_id": true }, { "source_path": "windows/manage/sign-code-integrity-policy-with-device-guard-signing.md", -"redirect_url": "/microsoft-store/sign-code-integrity-policy-with-device-guard-signing", +"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-code-integrity-policy-with-device-guard-signing", "redirect_document_id": true }, { "source_path": "windows/manage/sign-up-windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/sign-up-windows-store-for-business-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-windows-store-for-business-overview", "redirect_document_id": true }, { "source_path": "store-for-business/sign-up-windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/sign-up-microsoft-store-for-business-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business-overview", "redirect_document_id": true }, { "source_path": "windows/manage/sign-up-windows-store-for-business.md", -"redirect_url": "/microsoft-store/sign-up-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/sign-up-windows-store-for-business.md", -"redirect_url": "/microsoft-store/sign-up-microsoft-store-for-business", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business", +"redirect_document_id": false }, { "source_path": "windows/manage/troubleshoot-windows-store-for-business.md", -"redirect_url": "/microsoft-store/troubleshoot-windows-store-for-business", +"redirect_url": "https://docs.microsoft.com/microsoft-store/troubleshoot-windows-store-for-business", "redirect_document_id": true }, { "source_path": "store-for-business/troubleshoot-windows-store-for-business.md", -"redirect_url": "/microsoft-store/troubleshoot-microsoft-store-for-business", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/microsoft-store/troubleshoot-microsoft-store-for-business", +"redirect_document_id": false }, { "source_path": "windows/manage/uev-administering-uev-with-windows-powershell-and-wmi.md", -"redirect_url": "/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi", "redirect_document_id": true }, { "source_path": "windows/manage/uev-administering-uev.md", -"redirect_url": "/windows/configuration/ue-v/uev-administering-uev", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-administering-uev", "redirect_document_id": true }, { "source_path": "windows/manage/uev-application-template-schema-reference.md", -"redirect_url": "/windows/configuration/ue-v/uev-application-template-schema-reference", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-application-template-schema-reference", "redirect_document_id": true }, { "source_path": "windows/manage/uev-changing-the-frequency-of-scheduled-tasks.md", -"redirect_url": "/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-changing-the-frequency-of-scheduled-tasks", "redirect_document_id": true }, { "source_path": "windows/manage/uev-configuring-uev-with-group-policy-objects.md", -"redirect_url": "/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-configuring-uev-with-group-policy-objects", "redirect_document_id": true }, { "source_path": "windows/manage/uev-configuring-uev-with-system-center-configuration-manager.md", -"redirect_url": "/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-configuring-uev-with-system-center-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/manage/uev-deploy-required-features.md", -"redirect_url": "/windows/configuration/ue-v/uev-deploy-required-features", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-deploy-required-features", "redirect_document_id": true }, { "source_path": "windows/manage/uev-deploy-uev-for-custom-applications.md", -"redirect_url": "/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications", "redirect_document_id": true }, { "source_path": "windows/manage/uev-for-windows.md", -"redirect_url": "/windows/configuration/ue-v/uev-for-windows", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-for-windows", "redirect_document_id": true }, { "source_path": "windows/manage/uev-getting-started.md", -"redirect_url": "/windows/configuration/ue-v/uev-getting-started", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-getting-started", "redirect_document_id": true }, { "source_path": "windows/manage/uev-manage-administrative-backup-and-restore.md", -"redirect_url": "/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-manage-administrative-backup-and-restore", "redirect_document_id": true }, { "source_path": "windows/manage/uev-manage-configurations.md", -"redirect_url": "/windows/configuration/ue-v/uev-manage-configurations", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-manage-configurations", "redirect_document_id": true }, { "source_path": "windows/manage/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md", -"redirect_url": "/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi", "redirect_document_id": true }, { "source_path": "windows/manage/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md", -"redirect_url": "/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi", "redirect_document_id": true }, { "source_path": "windows/manage/uev-migrating-settings-packages.md", -"redirect_url": "/windows/configuration/ue-v/uev-migrating-settings-packages", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-migrating-settings-packages", "redirect_document_id": true }, { "source_path": "windows/manage/uev-prepare-for-deployment.md", -"redirect_url": "/windows/configuration/ue-v/uev-prepare-for-deployment", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-prepare-for-deployment", "redirect_document_id": true }, { "source_path": "windows/manage/uev-release-notes-1607.md", -"redirect_url": "/windows/configuration/ue-v/uev-release-notes-1607", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-release-notes-1607", "redirect_document_id": true }, { "source_path": "windows/manage/uev-security-considerations.md", -"redirect_url": "/windows/configuration/ue-v/uev-security-considerations", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-security-considerations", "redirect_document_id": true }, { "source_path": "windows/manage/uev-sync-methods.md", -"redirect_url": "/windows/configuration/ue-v/uev-sync-methods", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-sync-methods", "redirect_document_id": true }, { "source_path": "windows/manage/uev-sync-trigger-events.md", -"redirect_url": "/windows/configuration/ue-v/uev-sync-trigger-events", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-sync-trigger-events", "redirect_document_id": true }, { "source_path": "windows/manage/uev-synchronizing-microsoft-office-with-uev.md", -"redirect_url": "/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-synchronizing-microsoft-office-with-uev", "redirect_document_id": true }, { "source_path": "windows/manage/uev-technical-reference.md", -"redirect_url": "/windows/configuration/ue-v/uev-technical-reference", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-technical-reference", "redirect_document_id": true }, { "source_path": "windows/manage/uev-troubleshooting.md", -"redirect_url": "/windows/configuration/ue-v/uev-troubleshooting", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-troubleshooting", "redirect_document_id": true }, { "source_path": "windows/manage/uev-upgrade-uev-from-previous-releases.md", -"redirect_url": "/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-upgrade-uev-from-previous-releases", "redirect_document_id": true }, { "source_path": "windows/manage/uev-using-uev-with-application-virtualization-applications.md", -"redirect_url": "/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-using-uev-with-application-virtualization-applications", "redirect_document_id": true }, { "source_path": "windows/manage/uev-whats-new-in-uev-for-windows.md", -"redirect_url": "/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-whats-new-in-uev-for-windows", "redirect_document_id": true }, { "source_path": "windows/manage/uev-working-with-custom-templates-and-the-uev-generator.md", -"redirect_url": "/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator", +"redirect_url": "https://docs.microsoft.com/windows/configuration/ue-v/uev-working-with-custom-templates-and-the-uev-generator", "redirect_document_id": true }, { "source_path": "windows/manage/update-windows-store-for-business-account-settings.md", -"redirect_url": "/microsoft-store/update-windows-store-for-business-account-settings", +"redirect_url": "https://docs.microsoft.com/microsoft-store/update-windows-store-for-business-account-settings", "redirect_document_id": true }, { "source_path": "store-for-business/update-windows-store-for-business-account-settings.md", -"redirect_url": "/microsoft-store/update-microsoft-store-for-business-account-settings", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/microsoft-store/update-microsoft-store-for-business-account-settings", +"redirect_document_id": false }, { "source_path": "windows/manage/windows-10-mobile-and-mdm.md", -"redirect_url": "/windows/client-management/windows-10-mobile-and-mdm", +"redirect_url": "https://docs.microsoft.com/windows/client-management/windows-10-mobile-and-mdm", "redirect_document_id": true }, { "source_path": "windows/manage/windows-libraries.md", -"redirect_url": "/windows/client-management/windows-libraries", +"redirect_url": "https://docs.microsoft.com/windows/client-management/windows-libraries", "redirect_document_id": true }, { "source_path": "windows/manage/windows-store-for-business-overview.md", -"redirect_url": "/microsoft-store/windows-store-for-business-overview", +"redirect_url": "https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview", "redirect_document_id": true }, { "source_path": "windows/manage/working-with-line-of-business-apps.md", -"redirect_url": "/microsoft-store/working-with-line-of-business-apps", +"redirect_url": "https://docs.microsoft.com/microsoft-store/working-with-line-of-business-apps", "redirect_document_id": true }, { "source_path": "windows/plan/act-technical-reference.md", -"redirect_url": "/windows/deployment/planning/act-technical-reference", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/act-technical-reference", "redirect_document_id": true }, { "source_path": "windows/plan/applying-filters-to-data-in-the-sua-tool.md", -"redirect_url": "/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/applying-filters-to-data-in-the-sua-tool", "redirect_document_id": true }, { "source_path": "windows/plan/available-data-types-and-operators-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/available-data-types-and-operators-in-compatibility-administrator", "redirect_document_id": true }, { "source_path": "windows/plan/best-practice-recommendations-for-windows-to-go.md", -"redirect_url": "/windows/deployment/planning/best-practice-recommendations-for-windows-to-go", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/best-practice-recommendations-for-windows-to-go", "redirect_document_id": true }, { "source_path": "windows/plan/change-history-for-plan-for-windows-10-deployment.md", -"redirect_url": "/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/change-history-for-plan-for-windows-10-deployment", "redirect_document_id": true }, { "source_path": "windows/plan/compatibility-administrator-users-guide.md", -"redirect_url": "/windows/deployment/planning/compatibility-administrator-users-guide", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/compatibility-administrator-users-guide", "redirect_document_id": true }, { "source_path": "windows/plan/compatibility-fix-database-management-strategies-and-deployment.md", -"redirect_url": "/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/compatibility-fix-database-management-strategies-and-deployment", "redirect_document_id": true }, { "source_path": "windows/plan/compatibility-fixes-for-windows-8-windows-7-and-windows-vista.md", -"redirect_url": "/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/compatibility-fixes-for-windows-8-windows-7-and-windows-vista", "redirect_document_id": true }, { "source_path": "windows/plan/creating-a-custom-compatibility-fix-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/creating-a-custom-compatibility-fix-in-compatibility-administrator", "redirect_document_id": true }, { "source_path": "windows/plan/creating-a-custom-compatibility-mode-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/creating-a-custom-compatibility-mode-in-compatibility-administrator", "redirect_document_id": true }, { "source_path": "windows/plan/creating-an-apphelp-message-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/creating-an-apphelp-message-in-compatibility-administrator", "redirect_document_id": true }, { "source_path": "windows/plan/deployment-considerations-for-windows-to-go.md", -"redirect_url": "/windows/deployment/planning/deployment-considerations-for-windows-to-go", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/deployment-considerations-for-windows-to-go", "redirect_document_id": true }, { "source_path": "windows/plan/device-dialog-box.md", -"redirect_url": "/windows/deployment/planning/device-dialog-box", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/device-dialog-box", "redirect_document_id": true }, { "source_path": "windows/plan/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/enabling-and-disabling-compatibility-fixes-in-compatibility-administrator", "redirect_document_id": true }, { "source_path": "windows/plan/fixing-applications-by-using-the-sua-tool.md", -"redirect_url": "/windows/deployment/planning/fixing-applications-by-using-the-sua-tool", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/fixing-applications-by-using-the-sua-tool", "redirect_document_id": true }, { "source_path": "windows/plan/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/installing-and-uninstalling-custom-compatibility-databases-in-compatibility-administrator", "redirect_document_id": true }, { "source_path": "windows/plan/managing-application-compatibility-fixes-and-custom-fix-databases.md", -"redirect_url": "/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/managing-application-compatibility-fixes-and-custom-fix-databases", "redirect_document_id": true }, { "source_path": "windows/plan/prepare-your-organization-for-windows-to-go.md", -"redirect_url": "/windows/deployment/planning/prepare-your-organization-for-windows-to-go", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/prepare-your-organization-for-windows-to-go", "redirect_document_id": true }, { "source_path": "windows/plan/searching-for-fixed-applications-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/searching-for-fixed-applications-in-compatibility-administrator", "redirect_document_id": true }, { "source_path": "windows/plan/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/searching-for-installed-compatibility-fixes-with-the-query-tool-in-compatibility-administrator", "redirect_document_id": true }, { "source_path": "windows/plan/security-and-data-protection-considerations-for-windows-to-go.md", -"redirect_url": "/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/security-and-data-protection-considerations-for-windows-to-go", "redirect_document_id": true }, { "source_path": "windows/plan/showing-messages-generated-by-the-sua-tool.md", -"redirect_url": "/windows/deployment/planning/showing-messages-generated-by-the-sua-tool", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/showing-messages-generated-by-the-sua-tool", "redirect_document_id": true }, { "source_path": "windows/plan/sua-users-guide.md", -"redirect_url": "/windows/deployment/planning/sua-users-guide", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/sua-users-guide", "redirect_document_id": true }, { "source_path": "windows/plan/tabs-on-the-sua-tool-interface.md", -"redirect_url": "/windows/deployment/planning/tabs-on-the-sua-tool-interface", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/tabs-on-the-sua-tool-interface", "redirect_document_id": true }, { "source_path": "windows/plan/testing-your-application-mitigation-packages.md", -"redirect_url": "/windows/deployment/planning/testing-your-application-mitigation-packages", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/testing-your-application-mitigation-packages", "redirect_document_id": true }, { "source_path": "windows/plan/understanding-and-using-compatibility-fixes.md", -"redirect_url": "/windows/deployment/planning/understanding-and-using-compatibility-fixes", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/understanding-and-using-compatibility-fixes", "redirect_document_id": true }, { "source_path": "windows/plan/using-the-compatibility-administrator-tool.md", -"redirect_url": "/windows/deployment/planning/using-the-compatibility-administrator-tool", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-compatibility-administrator-tool", "redirect_document_id": true }, { "source_path": "windows/plan/using-the-sdbinstexe-command-line-tool.md", -"redirect_url": "/windows/deployment/planning/using-the-sdbinstexe-command-line-tool", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-sdbinstexe-command-line-tool", "redirect_document_id": true }, { "source_path": "windows/plan/using-the-sua-tool.md", -"redirect_url": "/windows/deployment/planning/using-the-sua-tool", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-sua-tool", "redirect_document_id": true }, { "source_path": "windows/plan/using-the-sua-wizard.md", -"redirect_url": "/windows/deployment/planning/using-the-sua-wizard", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/using-the-sua-wizard", "redirect_document_id": true }, { "source_path": "windows/plan/viewing-the-events-screen-in-compatibility-administrator.md", -"redirect_url": "/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/viewing-the-events-screen-in-compatibility-administrator", "redirect_document_id": true }, { "source_path": "windows/plan/windows-10-compatibility.md", -"redirect_url": "/windows/deployment/planning/windows-10-compatibility", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-compatibility", "redirect_document_id": true }, { "source_path": "windows/plan/windows-10-deployment-considerations.md", -"redirect_url": "/windows/deployment/planning/windows-10-deployment-considerations", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-deployment-considerations", "redirect_document_id": true }, { "source_path": "windows/plan/windows-10-enterprise-faq-itpro.md", -"redirect_url": "/windows/deployment/planning/windows-10-enterprise-faq-itpro", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-enterprise-faq-itpro", "redirect_document_id": true }, { "source_path": "windows/plan/windows-10-infrastructure-requirements.md", -"redirect_url": "/windows/deployment/planning/windows-10-infrastructure-requirements", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-infrastructure-requirements", "redirect_document_id": true }, { "source_path": "windows/plan/windows-to-go-frequently-asked-questions.md", -"redirect_url": "/windows/deployment/planning/windows-to-go-frequently-asked-questions", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-to-go-frequently-asked-questions", "redirect_document_id": true }, { "source_path": "windows/plan/windows-to-go-overview.md", -"redirect_url": "/windows/deployment/planning/windows-to-go-overview", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-to-go-overview", "redirect_document_id": true }, { "source_path": "windows/update/change-history-for-update-windows-10.md", -"redirect_url": "/windows/deployment/update/change-history-for-update-windows-10", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/change-history-for-update-windows-10", "redirect_document_id": true }, { "source_path": "windows/update/update-compliance-get-started.md", -"redirect_url": "/windows/deployment/update/update-compliance-get-started", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-get-started", "redirect_document_id": true }, { "source_path": "windows/update/update-compliance-monitor.md", -"redirect_url": "/windows/deployment/update/update-compliance-monitor", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor", "redirect_document_id": true }, { "source_path": "windows/update/update-compliance-using.md", -"redirect_url": "/windows/deployment/update/update-compliance-using", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/update-compliance-using", "redirect_document_id": true }, { "source_path": "windows/update/waas-branchcache.md", -"redirect_url": "/windows/deployment/update/waas-branchcache", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-branchcache", "redirect_document_id": true }, { "source_path": "windows/update/waas-configure-wufb.md", -"redirect_url": "/windows/deployment/update/waas-configure-wufb", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-configure-wufb", "redirect_document_id": true }, { "source_path": "windows/update/waas-delivery-optimization.md", -"redirect_url": "/windows/deployment/update/waas-delivery-optimization", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization", "redirect_document_id": true }, { "source_path": "windows/update/waas-deployment-rings-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-deployment-rings-windows-10-updates", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates", "redirect_document_id": true }, { "source_path": "windows/update/waas-integrate-wufb.md", -"redirect_url": "/windows/deployment/update/waas-integrate-wufb", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-integrate-wufb", "redirect_document_id": true }, { "source_path": "windows/update/waas-manage-updates-configuration-manager.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-configuration-manager", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-configuration-manager", "redirect_document_id": true }, { "source_path": "windows/update/waas-manage-updates-wsus.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wsus", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wsus", "redirect_document_id": true }, { "source_path": "windows/update/waas-manage-updates-wufb.md", -"redirect_url": "/windows/deployment/update/waas-manage-updates-wufb", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb", +"redirect_document_id": false }, { "source_path": "windows/update/waas-mobile-updates.md", -"redirect_url": "/windows/deployment/update/waas-mobile-updates", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-mobile-updates", "redirect_document_id": true }, { "source_path": "windows/update/waas-optimize-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-optimize-windows-10-updates", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-optimize-windows-10-updates", "redirect_document_id": true }, { "source_path": "windows/update/waas-overview.md", -"redirect_url": "/windows/deployment/update/waas-overview", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-overview", "redirect_document_id": true }, { "source_path": "windows/update/waas-quick-start.md", -"redirect_url": "/windows/deployment/update/waas-quick-start", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-quick-start", "redirect_document_id": true }, { "source_path": "windows/update/waas-restart.md", -"redirect_url": "/windows/deployment/update/waas-restart", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-restart", "redirect_document_id": true }, { "source_path": "windows/update/waas-servicing-branches-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-servicing-branches-windows-10-updates", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-branches-windows-10-updates", "redirect_document_id": true }, { "source_path": "windows/update/waas-servicing-strategy-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-servicing-strategy-windows-10-updates", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-strategy-windows-10-updates", "redirect_document_id": true }, { "source_path": "windows/update/waas-windows-insider-for-business-aad.md", -"redirect_url": "/windows/deployment/update/waas-windows-insider-for-business-aad", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business-aad", "redirect_document_id": true }, { "source_path": "windows/update/waas-windows-insider-for-business.md", -"redirect_url": "/windows/deployment/update/waas-windows-insider-for-business", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business", "redirect_document_id": true }, { "source_path": "windows/update/waas-wufb-group-policy.md", -"redirect_url": "/windows/deployment/update/waas-wufb-group-policy", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-group-policy", "redirect_document_id": true }, { "source_path": "windows/update/waas-wufb-intune.md", -"redirect_url": "/windows/deployment/update/waas-wufb-intune", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-wufb-intune", "redirect_document_id": true }, { "source_path": "windows/manage/manage-settings-app-with-group-policy.md", -"redirect_url": "/windows/client-management/manage-settings-app-with-group-policy", +"redirect_url": "https://docs.microsoft.com/windows/client-management/manage-settings-app-with-group-policy", "redirect_document_id": true }, { +"source_path": "windows/client-management/mdm/create-a-custom-configuration-service-provider.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": true +}, +{ +"source_path": "windows/client-management/mdm/design-a-custom-windows-csp.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/iconfigserviceprovider2.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/iconfigserviceprovider2configmanagernotification.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/iconfigserviceprovider2getnode.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnode.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodeadd.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodeclear.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodecopy.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodedeletechild.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodedeleteproperty.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodeexecute.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodegetchildnodenames.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodegetproperty.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodegetpropertyidentifiers.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodegetvalue.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodemove.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodesetproperty.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodesetvalue.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspnodetransactioning.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/icspvalidate.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ +"source_path": "windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md", +"redirect_url": "https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference", +"redirect_document_id": false +}, +{ "source_path": "windows/keep-secure/collect-wip-audit-event-logs.md", -"redirect_url": "/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs", +"redirect_url": "https://docs.microsoft.com/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs", "redirect_document_id": true }, { "source_path": "windows/keep-secure/deploy-managed-installer-for-device-guard.md", -"redirect_url": "/windows/device-security/device-guard/deploy-managed-installer-for-device-guard", +"redirect_url": "https://docs.microsoft.com/windows/device-security/device-guard/deploy-managed-installer-for-device-guard", "redirect_document_id": true }, { "source_path": "windows/deploy/upgrade-readiness-data-sharing.md", -"redirect_url": "/windows/deployment/upgrade/upgrade-readiness-data-sharing", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-data-sharing", "redirect_document_id": true }, { "source_path": "windows/index.md", -"redirect_url": "/windows/windows-10/index", +"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", "redirect_document_id": true }, { "source_path": "windows/manage/index.md", -"redirect_url": "/windows/windows-10/index", +"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", "redirect_document_id": true }, { "source_path": "windows/deploy/index.md", -"redirect_url": "/windows/deployment/index", +"redirect_url": "https://docs.microsoft.com/windows/deployment/index", "redirect_document_id": true }, { "source_path": "windows/plan/index.md", -"redirect_url": "/windows/deployment/planning/index", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/index", "redirect_document_id": true }, { "source_path": "windows/keep-secure/index.md", -"redirect_url": "/windows/windows-10/index", +"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", "redirect_document_id": true }, { "source_path": "windows/manage/windows-store-for-business.md", -"redirect_url": "/microsoft-store/index", +"redirect_url": "https://docs.microsoft.com/microsoft-store/index", "redirect_document_id": true }, { "source_path": "windows/update/index.md", -"redirect_url": "/windows/deployment/update/index", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/index", "redirect_document_id": true }, { "source_path": "windows/configure/index.md", -"redirect_url": "/windows/configuration/index", +"redirect_url": "https://docs.microsoft.com/windows/configuration/index", "redirect_document_id": true }, { "source_path": "windows/keep-secure/security-technologies.md", -"redirect_url": "/windows/windows-10/index", +"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", "redirect_document_id": true }, { @@ -13557,392 +14518,1188 @@ }, { "source_path": "windows/keep-secure/windows-10-enterprise-security-guides.md", -"redirect_url": "/windows/windows-10/index", +"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", "redirect_document_id": true }, { "source_path": "windows/keep-secure/change-history-for-keep-windows-10-secure.md", -"redirect_url": "/windows/windows-10/index", +"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", "redirect_document_id": true }, { "source_path": "windows/manage/change-history-for-manage-and-update-windows-10.md", -"redirect_url": "/windows/windows-10/index", +"redirect_url": "https://docs.microsoft.com/windows/windows-10/index", "redirect_document_id": true }, { "source_path": "windows/deployment/update/waas-servicing-branches-windows-10-updates.md", -"redirect_url": "/windows/deployment/update/waas-servicing-channels-windows-10-updates", +"redirect_url": "https://docs.microsoft.com/windows/deployment/update/waas-servicing-channels-windows-10-updates", "redirect_document_id": true }, { "source_path": "windows/deployment/windows-10-enterprise-activation-subscription.md", -"redirect_url": "/windows/deployment/windows-10-enterprise-subscription-activation", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation", "redirect_document_id": true }, { "source_path": "windows/deployment/windows-10-auto-pilot.md", -"redirect_url": "/windows/deployment/windows-autopilot/windows-10-autopilot", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/security-analytics-dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot", "redirect_document_id": true }, { "source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/general-settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/enable-security-analytics-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection", -"redirect_document_id": true -}, -{ -"source_path": "windows/security/threat-protection/windows-defender-atp/settings-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/time-settings-windows-defender-advanced-threat-protection", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection", "redirect_document_id": true }, { "source_path": "windows/privacy/basic-level-windows-diagnostic-events-and-fields.md", -"redirect_url": "/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809", +"redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903", "redirect_document_id": true }, { "source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md", -"redirect_url": "/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703", +"redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703", "redirect_document_id": true }, { "source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields-1709.md", -"redirect_url": "/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709", +"redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709", "redirect_document_id": true }, { "source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields.md", -"redirect_url": "/windows/privacy/basic-level-windows-diagnostic-events-and-fields", +"redirect_url": "https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields", "redirect_document_id": true }, { "source_path": "windows/configuration/configure-windows-diagnostic-data-in-your-organization.md", -"redirect_url": "/windows/privacy/configure-windows-diagnostic-data-in-your-organization", +"redirect_url": "https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization", "redirect_document_id": true }, { "source_path": "windows/configuration/diagnostic-data-viewer-overview.md", -"redirect_url": "/windows/privacy/diagnostic-data-viewer-overview", +"redirect_url": "https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overview", "redirect_document_id": true }, { "source_path": "windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields.md", -"redirect_url": "/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields", +"redirect_url": "https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields", "redirect_document_id": true }, { "source_path": "windows/configuration/gdpr-win10-whitepaper.md", -"redirect_url": "/windows/privacy/gdpr-win10-whitepaper", +"redirect_url": "https://docs.microsoft.com/windows/privacy/gdpr-win10-whitepaper", "redirect_document_id": true }, { "source_path": "windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services.md", -"redirect_url": "/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services", +"redirect_url": "https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services", "redirect_document_id": true }, { "source_path": "windows/configuration/manage-windows-endpoints-version-1709.md", -"redirect_url": "/windows/privacy/manage-windows-endpoints", +"redirect_url": "https://docs.microsoft.com/windows/privacy/manage-windows-endpoints", "redirect_document_id": true }, { "source_path": "windows/configuration/windows-diagnostic-data-1703.md", -"redirect_url": "/windows/privacy/windows-diagnostic-data-1703", +"redirect_url": "https://docs.microsoft.com/windows/privacy/windows-diagnostic-data-1703", "redirect_document_id": true }, { "source_path": "windows/configuration/windows-diagnostic-data.md", -"redirect_url": "/windows/privacy/windows-diagnostic-data", +"redirect_url": "https://docs.microsoft.com/windows/privacy/windows-diagnostic-data", "redirect_document_id": true }, { "source_path": "windows/deployment/upgrade/windows-10-edition-downgrades.md", -"redirect_url": "/windows/deployment/upgrade/windows-10-edition-upgrades", +"redirect_url": "https://docs.microsoft.com/windows/deployment/upgrade/windows-10-edition-upgrades", "redirect_document_id": true }, { "source_path": "education/windows/windows-automatic-redeployment.md", -"redirect_url": "/education/windows/autopilot-reset", +"redirect_url": "https://docs.microsoft.com/education/windows/autopilot-reset", "redirect_document_id": true }, { "source_path": "windows/deployment/windows-autopilot/windows-10-autopilot.md", -"redirect_url": "/windows/deployment/windows-autopilot/windows-autopilot", -"redirect_document_id": true +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot", +"redirect_document_id": false }, { "source_path": "windows/privacy/manage-windows-endpoints.md", -"redirect_url": "/windows/privacy/manage-windows-1809-endpoints", +"redirect_url": "https://docs.microsoft.com/windows/privacy/manage-windows-1809-endpoints", "redirect_document_id": true }, { +"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp", +"redirect_document_id": false +}, +{ +"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp", +"redirect_document_id": false + }, +{ +"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-full-sample-powershell.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-full-sample-powershell", +"redirect_document_id": false +}, +{ +"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-list.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list", +"redirect_document_id": false +}, +{ +"source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-odata-samples.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples", +"redirect_document_id": false +}, +{ "source_path":"windows/security/threat-protection/windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-actor-information-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-actor-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alerts", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-info-by-id", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-actor-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-domain-info", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-files-info", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-ip-info", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-machine-info", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-alerts", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { -"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", -"redirect_document_id": false +"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-domain-related-machines", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-domain-statistics", +"redirect_document_id": true }, { "source_path": "windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/is-domain-seen-in-org", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/block-file-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false -},{ +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-information", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-related-alerts", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-related-machines", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-file-statistics", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-fileactions-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/unblock-file-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-alerts", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ip-related-machines", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ip-statistics", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/is-ip-seen-org", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/collect-investigation-package", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/find-machine-info-by-ip", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-filemachineaction-object", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineactions-collection-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-filemachineactions-collection", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machine-by-id", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machine-log-on-users", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machine-related-alerts", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machineaction-object", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-machineaction-object.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machineaction-object", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/get-machineactions-collection", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-machineactions-collection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machineactions-collection", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-machines", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-started.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-started", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/get-started.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/index", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-package-sas-uri", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/machine-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/isolate-machine", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/unisolate-machine", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/unrestrict-code-execution", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/restrict-code-execution", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-ms-flow.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-ms-flow", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-app-token", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi-user-token.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-power-bi-user-token", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-powershell.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-python.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { -"source_path": "windows/security/threat-protection/windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"source_path": "windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/run-av-scan", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/stop-and-quarantine-file", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alert-related-user-info", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-ti-indicators-collection", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-user-information", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-user-related-alerts", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { +"source_path": "windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-user-related-machines", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/initiate-autoir-investigation-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/initiate-autoir-investigation", +"redirect_document_id": true +}, +{ "source_path": "windows/security/threat-protection/windows-defender-atp/get-ti-indicator-by-id-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/use-apis", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis", "redirect_document_id": false }, { "source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md", -"redirect_url": "/windows/security/threat-protection/windows-defender-atp/threat-analytics", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics", "redirect_document_id": true }, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/threat-analytics.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-analytics", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/threat-and-vuln-mgt-scenarios.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/add-or-remove-machine-tags", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/create-alert-by-reference", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/delete-ti-indicator-by-id", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/files", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/find-machines-by-ip-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/find-machines-by-ip", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machineaction", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/machineactionsnote.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machineactionsnote", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/offboard-machine-api", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/post-ti-indicator-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/ti-indicator-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/ti-indicator", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/update-alert", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/incidents-queue.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/incidents-queue", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/incidents-queue.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/troubleshoot-overview.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-mdatp", +"redirect_document_id": false +}, +{ +"source_path":"windows/security/threat-protection/windows-defender-atp/use-apis.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use-apis", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/user-alert-windows-defender-advanced-threat-protection-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user", +"redirect_document_id": true +}, +{ +"source_path": "windows/deployment/planning/windows-10-fall-creators-deprecation.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-1709-removed-features", +"redirect_document_id": true +}, +{ +"source_path": "windows/deployment/planning/windows-10-creators-update-deprecation.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-1703-removed-features", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators-windows-defender-advanced-threat-protection.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/manage-indicators.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-allowed-blocked-list", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/windows-10-enterprise-subscription-activation.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation", +"redirect_document_id": true +}, +{ +"source_path": "windows/hub/windows-10-landing.yml", +"redirect_url": "https://docs.microsoft.com/windows/windows-10", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/improve-request-performance", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-atp/configure-microsoft-threat-experts.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts", +"redirect_document_id": true +}, +{ +"source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-network.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements", +"redirect_document_id": true +}, +{ +"source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/windows-autopilot/windows-autopilot-requirements-configuration.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/windows-autopilot/user-driven-aad.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven", +"redirect_document_id": true +}, +{ +"source_path": "windows/deployment/windows-autopilot/user-driven-hybrid.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/windows-autopilot/intune-connector.md", +"redirect_url": "https://docs.microsoft.com/intune/windows-autopilot-hybrid", +"redirect_document_id": true +}, +{ +"source_path": "windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-reset", +"redirect_document_id": true +}, +{ +"source_path": "windows/deployment/windows-autopilot/windows-autopilot-reset-local.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-reset", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/windows-autopilot/configure-autopilot.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/add-devices", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/windows-autopilot/administer.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-autopilot/add-devices", +"redirect_document_id": false +}, +{ +"source_path": "windows/hub/release-information.md", +"redirect_url": "https://docs.microsoft.com/windows/release-information", +"redirect_document_id": true +}, +{ +"source_path": "windows/deployment/windows-10-architecture-posters.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/windows-10-deployment-scenarios", +"redirect_document_id": true +}, +{ +"source_path": "windows/device-security/index.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection", +"redirect_document_id": true +}, +{ +"source_path": "browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md", +"redirect_url": "https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11", +"redirect_document_id": true +}, +{ +"source_path": "education/get-started/change-history-ms-edu-get-started.md", +"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy", +"redirect_document_id": true +}, +{ +"source_path": "education/get-started/get-started-with-microsoft-education.md", +"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy", +"redirect_document_id": false +}, +{ +"source_path": "education/get-started/configure-microsoft-store-for-education.md", +"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/microsoft-store-for-education", +"redirect_document_id": false +}, +{ +"source_path": "education/get-started/enable-microsoft-teams.md", +"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/set-up-teams-for-education", +"redirect_document_id": false +}, +{ +"source_path": "education/get-started/finish-setup-and-other-tasks.md", +"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy", +"redirect_document_id": false +}, +{ +"source_path": "education/get-started/inclusive-classroom-it-admin.md", +"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/inclusive-classroom-it-admin", +"redirect_document_id": false +}, +{ +"source_path": "education/get-started/set-up-office365-edu-tenant.md", +"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/create-your-office-365-tenant", +"redirect_document_id": false +}, +{ +"source_path": "education/get-started/set-up-windows-10-education-devices.md", +"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/set-up-windows-10-education-devices", +"redirect_document_id": false +}, +{ +"source_path": "education/get-started/set-up-windows-education-devices.md", +"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/set-up-windows-10-education-devices", +"redirect_document_id": false +}, +{ +"source_path": "education/get-started/use-intune-for-education.md", +"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/use-intune-for-education", +"redirect_document_id": false +}, +{ + "source_path": "devices/surface/surface-dock-updater.md", + "redirect_url": "/surface/surface-dock-firmware-update", + "redirect_document_id": true + }, +{ +"source_path": "education/get-started/use-school-data-sync.md", +"redirect_url": "https://docs.microsoft.com/microsoft-365/education/deploy/school-data-sync", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exploit-protection", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-mac", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-whatsnew.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew", +"redirect_document_id": true +}, +{ +"source_path": "windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-intune", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-jamf", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-other-mdm.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-with-other-mdm", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-install-manually", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-updates", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-exclusions.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-exclusions", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-preferences.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-preferences", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-pua.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-pua", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-support-perf.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-support-perf", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-support-kext.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-support-kext", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-privacy.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-privacy", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/mac-resources", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework.md", +"redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/windows-security-configuration-framework.md", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-1-enterprise-basic-security.md", +"redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-1-enterprise-basic-security.md", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-2-enterprise-enhanced-security.md", +"redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-2-enterprise-enhanced-security.md", +"redirect_document_id": false +}, +{ + "source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-3-enterprise-high-security.md", +"redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-3-enterprise-high-security.md", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-4-enterprise-devops-security.md", +"redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-4-enterprise-devops-security.md", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-security-configuration-framework/level-5-enterprise-administrator-security.md", +"redirect_url": "https://github.com/microsoft/SecCon-Framework/blob/master/level-5-enterprise-administrator-security.md", +"redirect_document_id": false +}, +{ +"source_path": "windows/security/threat-protection/windows-security-configuration-framework/windows-security-compliance.md", +"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines", +"redirect_document_id": true +}, +{ +"source_path": "windows/release-information/status-windows-10-1703.yml", +"redirect_url": "https://docs.microsoft.com/windows/release-information/windows-message-center", +"redirect_document_id": true +}, +{ +"source_path": "windows/release-information/resolved-issues-windows-10-1703.yml", +"redirect_url": "https://docs.microsoft.com/windows/release-information/windows-message-center", +"redirect_document_id": true +}, +{ +"source_path": "windows/deployment/planning/windows-10-1703-removed-features.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/planning/windows-10-1709-removed-features.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/planning/windows-10-1803-removed-features.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", +"redirect_document_id": false +}, +{ +"source_path": "devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md", +"redirect_url": "/surface/manage-surface-driver-and-firmware-updates", +"redirect_document_id": true +}, +{ +"source_path": "windows/deployment/planning/windows-10-1809-removed-features.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/planning/windows-10-1903-removed-features.md", +"redirect_url": "https://docs.microsoft.com/windows/deployment/planning/windows-10-removed-features", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/update/windows-analytics-azure-portal.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/update/windows-analytics-FAQ-troubleshooting.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/update/windows-analytics-get-started.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/update/windows-analytics-overview.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/update/windows-analytics-privacy.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/update/device-health-get-started.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/update/device-health-monitor.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/update/device-health-using.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/upgrade-readiness-additional-insights.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/upgrade-readiness-architecture.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/upgrade-readiness-data-sharing.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/upgrade-readiness-deployment-script.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/upgrade-readiness-deploy-windows.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/upgrade-readiness-get-started.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/upgrade-readiness-identify-apps.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/upgrade-readiness-requirements.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/upgrade-readiness-resolve-issues.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/upgrade-readiness-target-new-OS.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, +{ +"source_path": "windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md", +"redirect_url": "https://docs.microsoft.com/configmgr/desktop-analytics/overview", +"redirect_document_id": false +}, ] } diff --git a/.vscode/extensions.json b/.vscode/extensions.json new file mode 100644 index 0000000000..af02986a5a --- /dev/null +++ b/.vscode/extensions.json @@ -0,0 +1,5 @@ +{ + "recommendations": [ + "docsmsft.docs-authoring-pack" + ] +} \ No newline at end of file diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000000..e7f59d08ec --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,7 @@ +{ + "cSpell.words": [ + "kovter", + "kovter's", + "poshspy" + ] +} \ No newline at end of file diff --git a/CODEOWNERS b/CODEOWNERS new file mode 100644 index 0000000000..7fc05fbd5b --- /dev/null +++ b/CODEOWNERS @@ -0,0 +1,5 @@ +docfx.json @microsoftdocs/officedocs-admin +.openpublishing.build.ps1 @microsoftdocs/officedocs-admin +.openpublishing.publish.config.json @microsoftdocs/officedocs-admin +CODEOWNERS @microsoftdocs/officedocs-admin +.acrolinx-config.edn @microsoftdocs/officedocs-admin diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index bd183c2b97..75cb7255c8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -18,7 +18,7 @@ We've tried to make editing an existing, public file as simple as possible. **To edit a topic** -1. Go to the page on docs.microsoft.com that you want to update, and then click **Edit**. +1. Go to the page on docs.microsoft.com that you want to update, and then click **Edit**. ![GitHub Web, showing the Edit link](images/contribute-link.png) @@ -30,12 +30,12 @@ We've tried to make editing an existing, public file as simple as possible. ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) -4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: +4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: - **If you're linked to the Microsoft organization in GitHub:** [Windows authoring guide](https://aka.ms/WindowsAuthoring) - **If you're external to Microsoft:** [Mastering Markdown](https://guides.github.com/features/mastering-markdown/) -5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. +5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) @@ -45,19 +45,19 @@ We've tried to make editing an existing, public file as simple as possible. The **Comparing changes** screen appears to see what the changes are between your fork and the original content. -7. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in. +7. On the **Comparing changes** screen, you’ll see if there are any problems with the file you’re checking in. If there are no problems, you’ll see the message, **Able to merge**. ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) -8. Click **Create pull request**. +8. Click **Create pull request**. -9. Enter a title and description to give the approver the appropriate context about what’s in the request. +9. Enter a title and description to give the approver the appropriate context about what’s in the request. -10. Scroll to the bottom of the page, making sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. +10. Scroll to the bottom of the page, making sure that only your changed files are in this pull request. Otherwise, you could overwrite changes from other people. -11. Click **Create pull request** again to actually submit the pull request. +11. Click **Create pull request** again to actually submit the pull request. The pull request is sent to the writer of the topic and your edits are reviewed. If your request is accepted, updates are published to one of the following places: diff --git a/ThirdPartyNotices b/ThirdPartyNotices index a0bd09d68f..faceb5a528 100644 --- a/ThirdPartyNotices +++ b/ThirdPartyNotices @@ -7,7 +7,7 @@ see the [LICENSE](LICENSE) file, and grant you a license to any code in the repo Microsoft, Windows, Microsoft Azure and/or other Microsoft products and services referenced in the documentation may be either trademarks or registered trademarks of Microsoft in the United States and/or other countries. The licenses for this project do not grant you rights to use any Microsoft names, logos, or trademarks. -Microsoft's general trademark guidelines can be found at http://go.microsoft.com/fwlink/?LinkID=254653. +Microsoft's general trademark guidelines can be found at https://go.microsoft.com/fwlink/?LinkID=254653. Privacy information can be found at https://privacy.microsoft.com/en-us/ diff --git a/bcs/index.md b/bcs/index.md deleted file mode 100644 index 49e0775203..0000000000 --- a/bcs/index.md +++ /dev/null @@ -1,3 +0,0 @@ ---- -redirect_url: /microsoft-365/business/ ---- diff --git a/bcs/support/microsoft-365-business-faqs.md b/bcs/support/microsoft-365-business-faqs.md deleted file mode 100644 index 332b565f0c..0000000000 --- a/bcs/support/microsoft-365-business-faqs.md +++ /dev/null @@ -1,3 +0,0 @@ ---- -redirect_url: https://docs.microsoft.com/microsoft-365/business/support/microsoft-365-business-faqs ---- \ No newline at end of file diff --git a/bcs/support/transition-csp-subscription.md b/bcs/support/transition-csp-subscription.md deleted file mode 100644 index 45a6e1c74c..0000000000 --- a/bcs/support/transition-csp-subscription.md +++ /dev/null @@ -1,3 +0,0 @@ ---- -redirect_url: https://docs.microsoft.com/microsoft-365/business/support/transition-csp-subscription ---- \ No newline at end of file diff --git a/browsers/edge/about-microsoft-edge.md b/browsers/edge/about-microsoft-edge.md index deef9f2c1a..5cd357aea7 100644 --- a/browsers/edge/about-microsoft-edge.md +++ b/browsers/edge/about-microsoft-edge.md @@ -1,8 +1,12 @@ --- title: Microsoft Edge system and language requirements -description: Overview information about Microsoft Edge, the default browser for Windows 10. This topic includes links to other Microsoft Edge topics. +description: Overview information about Microsoft Edge, the default browser for Windows 10. This topic includes links to other Microsoft Edge topics. ms.assetid: 70377735-b2f9-4b0b-9658-4cf7c1d745bb -author: shortpatti +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp ms.prod: edge ms.mktglfcycl: general ms.topic: reference @@ -15,7 +19,10 @@ ms.date: 10/02/2018 # Microsoft Edge system and language requirements >Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile -Microsoft Edge is the new, default web browser for Windows 10, helping you to experience modern web standards, better performance, improved security, and increased reliability. Microsoft Edge lets you stay up-to-date through the Microsoft Store and to manage your enterprise through Group Policy or your mobile device management (MDM) tools. +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + +Microsoft Edge is the new, default web browser for Windows 10, helping you to experience modern web standards, better performance, improved security, and increased reliability. Microsoft Edge lets you stay up-to-date through the Microsoft Store and to manage your enterprise through Group Policy or your mobile device management (MDM) tools. >[!IMPORTANT] @@ -26,136 +33,138 @@ Microsoft Edge is the new, default web browser for Windows 10, helping you to e Some of the components might also need additional system resources. Check the component's documentation for more information. -| Item | Minimum requirements | -| ------------------ | -------------------------------------------- | -| Computer/processor | 1 gigahertz (GHz) or faster (32-bit (x86) or 64-bit (x64)) | -| Operating system |

**Note**
For specific Windows 10 Mobile requirements, see the [Minimum hardware requirements for Windows 10 Mobile](https://go.microsoft.com/fwlink/p/?LinkID=699266) topic. | -| Memory |

| -| Hard drive space | | -| DVD drive | DVD-ROM drive (if installing from a DVD-ROM) | -| Display | Super VGA (800 x 600) or higher-resolution monitor with 256 colors | -| Graphics card | Microsoft DirectX 9 or later with Windows Display Driver Model (WDDM) 1.0 driver | -| Peripherals | Internet connection and a compatible pointing device | +| Item | Minimum requirements | +|--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Computer/processor | 1 gigahertz (GHz) or faster (32-bit (x86) or 64-bit (x64)) | +| Operating system |

Note
For specific Windows 10 Mobile requirements, see the [Minimum hardware requirements for Windows 10 Mobile](https://go.microsoft.com/fwlink/p/?LinkID=699266) topic. | +| Memory |

| +| Hard drive space | | +| DVD drive | DVD-ROM drive (if installing from a DVD-ROM) | +| Display | Super VGA (800 x 600) or higher-resolution monitor with 256 colors | +| Graphics card | Microsoft DirectX 9 or later with Windows Display Driver Model (WDDM) 1.0 driver | +| Peripherals | Internet connection and a compatible pointing device | + --- -  + ## Supported languages -Microsoft Edge supports all of the same languages as Windows 10 and you can use the [Microsoft Translator extension](https://www.microsoft.com/en-us/p/translator-for-microsoft-edge/9nblggh4n4n3) to translate foreign language web pages and text selections for 60+ languages. +Microsoft Edge supports all of the same languages as Windows 10 and you can use the [Microsoft Translator extension](https://www.microsoft.com/p/translator-for-microsoft-edge/9nblggh4n4n3) to translate foreign language web pages and text selections for 60+ languages. If the extension does not work after install, restart Microsoft Edge. If the extension still does not work, provide feedback through the Feedback Hub. -| Language | Country/Region | Code | -| ------------------------ | -------------- | ------ | -| Afrikaans (South Africa) | South Africa | af-ZA | -| Albanian (Albania) | Albania | sq-AL | -| Amharic | Ethiopia | am-ET | -| Arabic (Saudi Arabia) | Saudi Arabia | ar-SA | -| Armenian | Armenia | hy-AM | -| Assamese | India | as-IN | -| Azerbaijani (Latin, Azerbaijan) | Azerbaijan | az-Latn-AZ | -| Bangla (Bangladesh) | Bangladesh | bn-BD | -| Bangla (India) | India | bn-IN | -| Basque (Basque) | Spain | eu-ES | -| Belarusian (Belarus) | Belarus | be-BY | -| Bosnian (Latin) | Bosnia and Herzegovina | bs-Latn-BA | -| Bulgarian (Bulgaria) | Bulgaria | bg-BG | -| Catalan (Catalan) | Spain | ca-ES | -| Central Kurdish (Arabic) | Iraq | ku-Arab-IQ | -| Cherokee (Cherokee) | United States | chr-Cher-US | -| Chinese (Hong Kong SAR) | Hong Kong Special Administrative Region | zh-HK | -| Chinese (Simplified, China) | People's Republic of China | zh-CN | -| Chinese (Traditional, Taiwan) | Taiwan | zh-TW | -| Croatian (Croatia) | Croatia | hr-HR | -| Czech (Czech Republic) | Czech Republic | cs-CZ | -| Danish (Denmark) | Denmark | da-DK | -| Dari | Afghanistan | prs-AF | -| Dutch (Netherlands) | Netherlands | nl-NL | -| English (United Kingdom) | United Kingdom | en-GB | -| English (United States) | United States | en-US | -| Estonian (Estonia) | Estonia | et-EE | -| Filipino (Philippines) | Philippines | fil-PH | -| Finnish (Finland) | Finland | fi_FI | -| French (Canada) | Canada | fr-CA | -| French (France) | France | fr-FR | -| Galician (Galician) | Spain | gl-ES | -| Georgian | Georgia | ka-GE | -| German (Germany) | Germany | de-DE | -| Greek (Greece) | Greece | el-GR | -| Gujarati | India | gu-IN | -| Hausa (Latin, Nigeria) | Nigeria | ha-Latn-NG | -| Hebrew (Israel) | Israel | he-IL | -| Hindi (India) | India | hi-IN | -| Hungarian (Hungary) | Hungary | hu-HU | -| Icelandic | Iceland | is-IS | -| Igbo | Nigeria | ig-NG | -| Indonesian (Indonesia) | Indonesia | id-ID | -| Irish | Ireland | ga-IE | -| isiXhosa | South Africa | xh-ZA | -| isiZulu | South Africa | zu-ZA | -| Italian (Italy) | Italy | it-IT | -| Japanese (Japan) | Japan | ja-JP | -| Kannada | India | kn-IN | -| Kazakh (Kazakhstan) | Kazakhstan | kk-KZ | -| Khmer (Cambodia) | Cambodia | km-KH | -| K'iche' | Guatemala | quc-Latn-GT | -| Kinyarwanda | Rwanda | rw-RW | -| KiSwahili | Kenya, Tanzania | sw-KE | -| Konkani | India | kok-IN | -| Korean (Korea) | Korea | ko-KR | -| Kyrgyz | Kyrgyzstan | ky-KG | -| Lao (Laos) | Lao P.D.R. | lo-LA | -| Latvian (Latvia) | Latvia | lv-LV | -| Lithuanian (Lithuania) | Lithuania | lt-LT | -| Luxembourgish (Luxembourg) | Luxembourg | lb-LU | -| Macedonian (Former Yugoslav Republic of Macedonia) | Macedonia (FYROM) | mk-MK | -| Malay (Malaysia) | Malaysia, Brunei, and Singapore | ms-MY | -| Malayalam | India | ml-IN | -| Maltese | Malta | mt-MT | -| Maori | New Zealand | mi-NZ | -| Marathi | India | mr-IN | -| Mongolian (Cyrillic) | Mongolia | mn-MN | -| Nepali | Federal Democratic Republic of Nepal | ne-NP | -| Norwegian (Nynorsk) | Norway | nn-NO | -| Norwegian, Bokmål (Norway) | Norway | nb-NO | -| Odia | India | or-IN | -| Polish (Poland) | Poland | pl-PL | -| Portuguese (Brazil) | Brazil | pt-BR | -| Portuguese (Portugal) | Portugal | pt-PT | -| Punjabi | India | pa-IN | -| Punjabi (Arabic) | Pakistan | pa-Arab-PK | -| Quechua | Peru | quz-PE | -| Romanian (Romania) | Romania | ro-RO | -| Russian (Russia) | Russia | ru-RU | -| Scottish Gaelic | United Kingdom | gd-GB | -| Serbian (Cyrillic, Bosnia, and Herzegovina) | Bosnia and Herzegovina | sr-Cyrl-BA | -| Serbian (Cyrillic, Serbia) | Serbia | sr-Cyrl-RS | -| Serbian (Latin, Serbia) | Serbia | sr-Latn-RS | -| Sesotho sa Leboa | South Africa | nso-ZA | -| Setswana (South Africa) | South Africa and Botswana | tn-ZA | -| Sindhi (Arabic) | Pakistan | sd-Arab-PK | -| Sinhala | Sri Lanka | si-LK | -| Slovak (Slovakia) | Slovakia | sk-SK | -| Slovenian (Slovenia) | Slovenia | sl-SL | -| Spanish (Mexico) | Mexico | es-MX | -| Spanish (Spain, International Sort) | Spain | en-ES | -| Swedish (Sweden) | Sweden | sv-SE | -| Tajik (Cyrillic) | Tajikistan | tg-Cyrl-TJ | -| Tamil (India) | India and Sri Lanka | ta-IN | -| Tatar | Russia | tt-RU | -| Telugu | India | te-IN | -| Thai (Thailand) | Thailand | th-TH | -| Tigrinya (Ethiopia) | Ethiopia | ti-ET | -| Turkish (Turkey) | Turkey | tr-TR | -| Turkmen | Turkmenistan | tk-TM | -| Ukrainian (Ukraine) | Ukraine | uk-UA | -| Urdu | Pakistan | ur-PK | -| Uyghur | People's Republic of China | ug-CN | -| Uzbek (Latin, Uzbekistan) | Uzbekistan | uz-Latn-UZ | -| Valencian | Spain | ca-ES-valencia | -| Vietnamese | Vietnam | vi-VN | -| Welsh | United Kingdom | cy-GB | -| Wolof | Senegal | wo-SN | -| Yoruba | Nigeria | yo-NG | ---- \ No newline at end of file +| Language | Country/Region | Code | +|----------------------------------------------------|-----------------------------------------|----------------| +| Afrikaans (South Africa) | South Africa | af-ZA | +| Albanian (Albania) | Albania | sq-AL | +| Amharic | Ethiopia | am-ET | +| Arabic (Saudi Arabia) | Saudi Arabia | ar-SA | +| Armenian | Armenia | hy-AM | +| Assamese | India | as-IN | +| Azerbaijani (Latin, Azerbaijan) | Azerbaijan | az-Latn-AZ | +| Bangla (Bangladesh) | Bangladesh | bn-BD | +| Bangla (India) | India | bn-IN | +| Basque (Basque) | Spain | eu-ES | +| Belarusian (Belarus) | Belarus | be-BY | +| Bosnian (Latin) | Bosnia and Herzegovina | bs-Latn-BA | +| Bulgarian (Bulgaria) | Bulgaria | bg-BG | +| Catalan (Catalan) | Spain | ca-ES | +| Central Kurdish (Arabic) | Iraq | ku-Arab-IQ | +| Cherokee (Cherokee) | United States | chr-Cher-US | +| Chinese (Hong Kong SAR) | Hong Kong Special Administrative Region | zh-HK | +| Chinese (Simplified, China) | People's Republic of China | zh-CN | +| Chinese (Traditional, Taiwan) | Taiwan | zh-TW | +| Croatian (Croatia) | Croatia | hr-HR | +| Czech (Czech Republic) | Czech Republic | cs-CZ | +| Danish (Denmark) | Denmark | da-DK | +| Dari | Afghanistan | prs-AF | +| Dutch (Netherlands) | Netherlands | nl-NL | +| English (United Kingdom) | United Kingdom | en-GB | +| English (United States) | United States | en-US | +| Estonian (Estonia) | Estonia | et-EE | +| Filipino (Philippines) | Philippines | fil-PH | +| Finnish (Finland) | Finland | fi_FI | +| French (Canada) | Canada | fr-CA | +| French (France) | France | fr-FR | +| Galician (Galician) | Spain | gl-ES | +| Georgian | Georgia | ka-GE | +| German (Germany) | Germany | de-DE | +| Greek (Greece) | Greece | el-GR | +| Gujarati | India | gu-IN | +| Hausa (Latin, Nigeria) | Nigeria | ha-Latn-NG | +| Hebrew (Israel) | Israel | he-IL | +| Hindi (India) | India | hi-IN | +| Hungarian (Hungary) | Hungary | hu-HU | +| Icelandic | Iceland | is-IS | +| Igbo | Nigeria | ig-NG | +| Indonesian (Indonesia) | Indonesia | id-ID | +| Irish | Ireland | ga-IE | +| isiXhosa | South Africa | xh-ZA | +| isiZulu | South Africa | zu-ZA | +| Italian (Italy) | Italy | it-IT | +| Japanese (Japan) | Japan | ja-JP | +| Kannada | India | kn-IN | +| Kazakh (Kazakhstan) | Kazakhstan | kk-KZ | +| Khmer (Cambodia) | Cambodia | km-KH | +| K'iche' | Guatemala | quc-Latn-GT | +| Kinyarwanda | Rwanda | rw-RW | +| KiSwahili | Kenya, Tanzania | sw-KE | +| Konkani | India | kok-IN | +| Korean (Korea) | Korea | ko-KR | +| Kyrgyz | Kyrgyzstan | ky-KG | +| Lao (Laos) | Lao P.D.R. | lo-LA | +| Latvian (Latvia) | Latvia | lv-LV | +| Lithuanian (Lithuania) | Lithuania | lt-LT | +| Luxembourgish (Luxembourg) | Luxembourg | lb-LU | +| Macedonian (Former Yugoslav Republic of Macedonia) | Macedonia (FYROM) | mk-MK | +| Malay (Malaysia) | Malaysia, Brunei, and Singapore | ms-MY | +| Malayalam | India | ml-IN | +| Maltese | Malta | mt-MT | +| Maori | New Zealand | mi-NZ | +| Marathi | India | mr-IN | +| Mongolian (Cyrillic) | Mongolia | mn-MN | +| Nepali | Federal Democratic Republic of Nepal | ne-NP | +| Norwegian (Nynorsk) | Norway | nn-NO | +| Norwegian, Bokmål (Norway) | Norway | nb-NO | +| Odia | India | or-IN | +| Polish (Poland) | Poland | pl-PL | +| Portuguese (Brazil) | Brazil | pt-BR | +| Portuguese (Portugal) | Portugal | pt-PT | +| Punjabi | India | pa-IN | +| Punjabi (Arabic) | Pakistan | pa-Arab-PK | +| Quechua | Peru | quz-PE | +| Romanian (Romania) | Romania | ro-RO | +| Russian (Russia) | Russia | ru-RU | +| Scottish Gaelic | United Kingdom | gd-GB | +| Serbian (Cyrillic, Bosnia, and Herzegovina) | Bosnia and Herzegovina | sr-Cyrl-BA | +| Serbian (Cyrillic, Serbia) | Serbia | sr-Cyrl-RS | +| Serbian (Latin, Serbia) | Serbia | sr-Latn-RS | +| Sesotho sa Leboa | South Africa | nso-ZA | +| Setswana (South Africa) | South Africa and Botswana | tn-ZA | +| Sindhi (Arabic) | Pakistan | sd-Arab-PK | +| Sinhala | Sri Lanka | si-LK | +| Slovak (Slovakia) | Slovakia | sk-SK | +| Slovenian (Slovenia) | Slovenia | sl-SL | +| Spanish (Mexico) | Mexico | es-MX | +| Spanish (Spain, International Sort) | Spain | en-ES | +| Swedish (Sweden) | Sweden | sv-SE | +| Tajik (Cyrillic) | Tajikistan | tg-Cyrl-TJ | +| Tamil (India) | India and Sri Lanka | ta-IN | +| Tatar | Russia | tt-RU | +| Telugu | India | te-IN | +| Thai (Thailand) | Thailand | th-TH | +| Tigrinya (Ethiopia) | Ethiopia | ti-ET | +| Turkish (Turkey) | Turkey | tr-TR | +| Turkmen | Turkmenistan | tk-TM | +| Ukrainian (Ukraine) | Ukraine | uk-UA | +| Urdu | Pakistan | ur-PK | +| Uyghur | People's Republic of China | ug-CN | +| Uzbek (Latin, Uzbekistan) | Uzbekistan | uz-Latn-UZ | +| Valencian | Spain | ca-ES-valencia | +| Vietnamese | Vietnam | vi-VN | +| Welsh | United Kingdom | cy-GB | +| Wolof | Senegal | wo-SN | +| Yoruba | Nigeria | yo-NG | + +--- diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index e62e7d861d..37bef54e3a 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -1,16 +1,17 @@ --- -description: You can customize your organization’s browser settings in Microsoft Edge with Group Policy or Microsoft Intune, or other MDM service. When you do this, you set the policy once and then copy it onto many computers—that is, touch once, configure many. +description: You can customize your organization’s browser settings in Microsoft Edge with Group Policy or Microsoft Intune, or other MDM service. When you do this, you set the policy once and then copy it onto many computers—that is, touch once, configure many. ms.assetid: 2e849894-255d-4f68-ae88-c2e4e31fa165 -author: shortpatti -ms.author: pashort -manager: dougkim +ms.reviewer: +author: dansimp +ms.author: dansimp +audience: itpro +manager: dansimp ms.prod: edge ms.mktglfcycl: explore ms.topic: reference ms.sitesec: library title: Group Policy and Mobile Device Management settings for Microsoft Edge (Microsoft Edge for IT Pros) ms.localizationpriority: medium -ms.date: 10/29/2018 --- # Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge @@ -218,4 +219,4 @@ Some policy settings have additional options you can configure. For example, if - [Group Policy and the Group Policy Management Console (GPMC)](https://go.microsoft.com/fwlink/p/?LinkId=617921) - [Group Policy and the Local Group Policy Editor](https://go.microsoft.com/fwlink/p/?LinkId=617922) - [Group Policy and the Advanced Group Policy Management (AGPM)](https://go.microsoft.com/fwlink/p/?LinkId=617923) -- [Group Policy and Windows PowerShell](https://go.microsoft.com/fwlink/p/?LinkId=617924). \ No newline at end of file +- [Group Policy and Windows PowerShell](https://go.microsoft.com/fwlink/p/?LinkId=617924). diff --git a/browsers/edge/change-history-for-microsoft-edge.md b/browsers/edge/change-history-for-microsoft-edge.md index 6d86a32508..2529a88fea 100644 --- a/browsers/edge/change-history-for-microsoft-edge.md +++ b/browsers/edge/change-history-for-microsoft-edge.md @@ -6,18 +6,20 @@ ms.topic: reference ms.mktglfcycl: explore ms.sitesec: library ms.localizationpriority: medium -manager: dougkim -ms.author: pashort -author: shortpatti +audience: itpro +manager: dansimp +author: dansimp ms.date: 10/02/2018 +ms.author: dansimp --- # Change history for Microsoft Edge Discover what's new and updated in the Microsoft Edge for both Windows 10 and Windows 10 Mobile. +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). -# [2018](#tab/2018) - +#### [2018](#tab/2018/) ## October 2018 The Microsoft Edge team introduces new group policies and MDM settings for Microsoft Edge on Windows 10. The new policies let you enable/disable @@ -31,45 +33,45 @@ We have discontinued the **Configure Favorites** group policy, so use the [Provi -| **New or updated** | **Group Policy** | **Description** | -|------------|-----------------|--------------------| -| New | [Allow fullscreen mode](group-policies/browser-settings-management-gp.md#allow-fullscreen-mode) | [!INCLUDE [allow-fullscreen-mode-shortdesc](shortdesc/allow-fullscreen-mode-shortdesc.md)] | -| New | [Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed](group-policies/prelaunch-preload-gp.md#allow-microsoft-edge-to-pre-launch-at-windows-startup-when-the-system-is-idle-and-each-time-microsoft-edge-is-closed) | [!INCLUDE [allow-prelaunch-shortdesc](shortdesc/allow-prelaunch-shortdesc.md)] | -| New | [Allow Microsoft Edge to load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed](group-policies/prelaunch-preload-gp.md#allow-microsoft-edge-to-load-the-start-and-new-tab-page-at-windows-startup-and-each-time-microsoft-edge-is-closed) | [!INCLUDE [allow-tab-preloading-shortdesc](shortdesc/allow-tab-preloading-shortdesc.md)] | -| New | [Allow printing](group-policies/browser-settings-management-gp.md#allow-printing) | [!INCLUDE [allow-printing-shortdesc](shortdesc/allow-printing-shortdesc.md)] | -| New | [Allow Saving History](group-policies/browser-settings-management-gp.md#allow-saving-history) | [!INCLUDE [allow-saving-history-shortdesc](shortdesc/allow-saving-history-shortdesc.md)] | -| New | [Allow sideloading of Extensions](group-policies/extensions-management-gp.md#allow-sideloading-of-extensions) | [!INCLUDE [allow-sideloading-of-extensions-shortdesc](shortdesc/allow-sideloading-of-extensions-shortdesc.md)] | -| New | [Configure collection of browsing data for Microsoft 365 Analytics](group-policies/telemetry-management-gp.md#configure-collection-of-browsing-data-for-microsoft-365-analytics) | [!INCLUDE [configure-browser-telemetry-for-m365-analytics-shortdesc](shortdesc/configure-browser-telemetry-for-m365-analytics-shortdesc.md)] | -| New | [Configure Favorites Bar](group-policies/favorites-management-gp.md#configure-favorites-bar) | [!INCLUDE [configure-favorites-bar-shortdesc](shortdesc/configure-favorites-bar-shortdesc.md)] | -| New | [Configure Home Button](group-policies/home-button-gp.md#configure-home-button) | [!INCLUDE [configure-home-button-shortdesc](shortdesc/configure-home-button-shortdesc.md)] | -| New | [Configure kiosk mode](available-policies.md#configure-kiosk-mode) | [!INCLUDE [configure-kiosk-mode-shortdesc](shortdesc/configure-kiosk-mode-shortdesc.md)] | -| New | [Configure kiosk reset after idle timeout](available-policies.md#configure-kiosk-reset-after-idle-timeout) |[!INCLUDE [configure-kiosk-reset-after-idle-timeout-shortdesc](shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md)] | -| New | [Configure Open Microsoft Edge With](group-policies/start-pages-gp.md#configure-open-microsoft-edge-with) | [!INCLUDE [configure-open-microsoft-edge-with-shortdesc](shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] | -| New | [Prevent certificate error overrides](group-policies/security-privacy-management-gp.md#prevent-certificate-error-overrides) | [!INCLUDE [prevent-certificate-error-overrides-shortdesc](shortdesc/prevent-certificate-error-overrides-shortdesc.md)] | -| New | [Prevent users from turning on browser syncing](group-policies/sync-browser-settings-gp.md#prevent-users-from-turning-on-browser-syncing) | [!INCLUDE [prevent-users-to-turn-on-browser-syncing-shortdesc](shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md)] | -| New | [Prevent turning off required extensions](group-policies/extensions-management-gp.md#prevent-turning-off-required-extensions) | [!INCLUDE [prevent-turning-off-required-extensions-shortdesc](shortdesc/prevent-turning-off-required-extensions-shortdesc.md)] | -| New | [Set Home Button URL](group-policies/home-button-gp.md#set-home-button-url) | [!INCLUDE [set-home-button-url-shortdesc](shortdesc/set-home-button-url-shortdesc.md)] | -| New | [Set New Tab page URL](group-policies/new-tab-page-settings-gp.md#set-new-tab-page-url) | [!INCLUDE [set-new-tab-url-shortdesc](shortdesc/set-new-tab-url-shortdesc.md)] | -| Updated | [Show message when opening sites in Internet Explorer](group-policies/interoperability-enterprise-guidance-gp.md#show-message-when-opening-sites-in-internet-explorer) | [!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] | -| New | [Unlock Home Button](group-policies/home-button-gp.md#unlock-home-button) | [!INCLUDE [unlock-home-button-shortdesc](shortdesc/unlock-home-button-shortdesc.md)] | - - -# [2017](#tab/2017) +| **New or updated** | **Group Policy** | **Description** | +|--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------| +| New | [Allow fullscreen mode](group-policies/browser-settings-management-gp.md#allow-fullscreen-mode) | [!INCLUDE [allow-fullscreen-mode-shortdesc](shortdesc/allow-fullscreen-mode-shortdesc.md)] | +| New | [Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed](group-policies/prelaunch-preload-gp.md#allow-microsoft-edge-to-pre-launch-at-windows-startup-when-the-system-is-idle-and-each-time-microsoft-edge-is-closed) | [!INCLUDE [allow-prelaunch-shortdesc](shortdesc/allow-prelaunch-shortdesc.md)] | +| New | [Allow Microsoft Edge to load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed](group-policies/prelaunch-preload-gp.md#allow-microsoft-edge-to-load-the-start-and-new-tab-page-at-windows-startup-and-each-time-microsoft-edge-is-closed) | [!INCLUDE [allow-tab-preloading-shortdesc](shortdesc/allow-tab-preloading-shortdesc.md)] | +| New | [Allow printing](group-policies/browser-settings-management-gp.md#allow-printing) | [!INCLUDE [allow-printing-shortdesc](shortdesc/allow-printing-shortdesc.md)] | +| New | [Allow Saving History](group-policies/browser-settings-management-gp.md#allow-saving-history) | [!INCLUDE [allow-saving-history-shortdesc](shortdesc/allow-saving-history-shortdesc.md)] | +| New | [Allow sideloading of Extensions](group-policies/extensions-management-gp.md#allow-sideloading-of-extensions) | [!INCLUDE [allow-sideloading-of-extensions-shortdesc](shortdesc/allow-sideloading-of-extensions-shortdesc.md)] | +| New | [Configure collection of browsing data for Microsoft 365 Analytics](group-policies/telemetry-management-gp.md#configure-collection-of-browsing-data-for-microsoft-365-analytics) | [!INCLUDE [configure-browser-telemetry-for-m365-analytics-shortdesc](shortdesc/configure-browser-telemetry-for-m365-analytics-shortdesc.md)] | +| New | [Configure Favorites Bar](group-policies/favorites-management-gp.md#configure-favorites-bar) | [!INCLUDE [configure-favorites-bar-shortdesc](shortdesc/configure-favorites-bar-shortdesc.md)] | +| New | [Configure Home Button](group-policies/home-button-gp.md#configure-home-button) | [!INCLUDE [configure-home-button-shortdesc](shortdesc/configure-home-button-shortdesc.md)] | +| New | [Configure kiosk mode](available-policies.md#configure-kiosk-mode) | [!INCLUDE [configure-kiosk-mode-shortdesc](shortdesc/configure-kiosk-mode-shortdesc.md)] | +| New | [Configure kiosk reset after idle timeout](available-policies.md#configure-kiosk-reset-after-idle-timeout) | [!INCLUDE [configure-kiosk-reset-after-idle-timeout-shortdesc](shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md)] | +| New | [Configure Open Microsoft Edge With](group-policies/start-pages-gp.md#configure-open-microsoft-edge-with) | [!INCLUDE [configure-open-microsoft-edge-with-shortdesc](shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] | +| New | [Prevent certificate error overrides](group-policies/security-privacy-management-gp.md#prevent-certificate-error-overrides) | [!INCLUDE [prevent-certificate-error-overrides-shortdesc](shortdesc/prevent-certificate-error-overrides-shortdesc.md)] | +| New | [Prevent users from turning on browser syncing](group-policies/sync-browser-settings-gp.md#prevent-users-from-turning-on-browser-syncing) | [!INCLUDE [prevent-users-to-turn-on-browser-syncing-shortdesc](shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md)] | +| New | [Prevent turning off required extensions](group-policies/extensions-management-gp.md#prevent-turning-off-required-extensions) | [!INCLUDE [prevent-turning-off-required-extensions-shortdesc](shortdesc/prevent-turning-off-required-extensions-shortdesc.md)] | +| New | [Set Home Button URL](group-policies/home-button-gp.md#set-home-button-url) | [!INCLUDE [set-home-button-url-shortdesc](shortdesc/set-home-button-url-shortdesc.md)] | +| New | [Set New Tab page URL](group-policies/new-tab-page-settings-gp.md#set-new-tab-page-url) | [!INCLUDE [set-new-tab-url-shortdesc](shortdesc/set-new-tab-url-shortdesc.md)] | +| Updated | [Show message when opening sites in Internet Explorer](group-policies/interoperability-enterprise-guidance-gp.md#show-message-when-opening-sites-in-internet-explorer) | [!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] | +| New | [Unlock Home Button](group-policies/home-button-gp.md#unlock-home-button) | [!INCLUDE [unlock-home-button-shortdesc](shortdesc/unlock-home-button-shortdesc.md)] | +#### [2017](#tab/2017/) ## September 2017 + |New or changed topic | Description | |---------------------|-------------| |[Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros](microsoft-edge-faq.md) | New | ## February 2017 + |New or changed topic | Description | |----------------------|-------------| |[Available Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](available-policies.md) |Added new Group Policy and MDM settings for the Windows Insider Program. Reformatted for easier readability outside of scrolling table. | -# [2016](#tab/2016) - +#### [2016](#tab/2016/) ## November 2016 + |New or changed topic | Description | |----------------------|-------------| |[Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) |Added the infographic image and a download link.| @@ -79,6 +81,7 @@ We have discontinued the **Configure Favorites** group policy, so use the [Provi |[Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) |Added a link to the Microsoft Edge infographic, helping you to evaluate the potential impact of using Microsoft Edge in your organization. | ## July 2016 + |New or changed topic | Description | |----------------------|-------------| |[Microsoft Edge requirements and language support](hardware-and-software-requirements.md)| Updated to include a note about the Long Term Servicing Branch (LTSB). | @@ -87,6 +90,7 @@ We have discontinued the **Configure Favorites** group policy, so use the [Provi ## June 2016 + |New or changed topic | Description | |----------------------|-------------| |[Security enhancements for Microsoft Edge](security-enhancements-microsoft-edge.md) |New | @@ -97,4 +101,4 @@ We have discontinued the **Configure Favorites** group policy, so use the [Provi |----------------------|-------------| |[Available Policies for Microsoft Edge](available-policies.md) | Added new policies and the Supported versions column for Windows 10 Insider Preview. | ---- +* * * diff --git a/browsers/edge/docfx.json b/browsers/edge/docfx.json index c0761e7192..640106062b 100644 --- a/browsers/edge/docfx.json +++ b/browsers/edge/docfx.json @@ -1,39 +1,52 @@ { "build": { - "content": - [ - { - "files": ["**/*.md","**/*.yml"], - "exclude": ["**/obj/**"] - } - ], + "content": [ + { + "files": [ + "**/*.md", + "**/*.yml" + ], + "exclude": [ + "**/obj/**", + "**/includes/**", + "**/shortdesc/**" + ] + } + ], "resource": [ - { - "files": ["**/images/**"], - "exclude": ["**/obj/**"] - } + { + "files": [ + "**/images/**", + "**/*.png", + "**/*.jpg", + "**/*.gif" + ], + "exclude": [ + "**/obj/**" + ] + } ], "globalMetadata": { - "uhfHeaderId": "MSDocsHeader-WindowsIT", - "breadcrumb_path": "/microsoft-edge/deploy/breadcrumb/toc.json", - "ROBOTS": "INDEX, FOLLOW", - "ms.technology": "microsoft-edge", - "ms.topic": "article", - "ms.author": "shortpatti", - "ms.date": "04/05/2017", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", - "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "Win.microsoft-edge" - } - } + "breadcrumb_path": "/microsoft-edge/deploy/breadcrumb/toc.json", + "ROBOTS": "INDEX, FOLLOW", + "ms.technology": "microsoft-edge", + "audience": "ITPro", + "ms.topic": "article", + "manager": "laurawi", + "ms.prod": "edge", + "feedback_system": "None", + "hideEdit": true, + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "Win.microsoft-edge", + "folder_relative_path_in_docset": "./" + } + }, + "titleSuffix": "Edge" }, - "externalReference": [ - ], + "externalReference": [], "template": "op.html", "dest": "browsers/edge", - "markdownEngineName": "dfm" + "markdownEngineName": "markdig" } -} \ No newline at end of file +} diff --git a/browsers/edge/edge-technical-demos.md b/browsers/edge/edge-technical-demos.md index 4044596777..d8eb14bd02 100644 --- a/browsers/edge/edge-technical-demos.md +++ b/browsers/edge/edge-technical-demos.md @@ -1,11 +1,14 @@ --- -title: Microsoft Edge training and demonstrations +title: Microsoft Edge training and demonstrations +ms.reviewer: +audience: itpro +manager: dansimp description: Get access to training and demonstrations for Microsoft Edge. ms.prod: edge ms.topic: article -ms.manager: elizapo -author: lizap -ms.author: elizapo +ms.manager: dansimp +author: dansimp +ms.author: dansimp ms.localizationpriority: high --- @@ -27,10 +30,10 @@ Find out more about new and improved features of Microsoft Edge, and how you can Get a behind the scenes look at Microsoft Edge and the improvements we've made to make it faster and more efficient. -![VIDEO https://channel9.msdn.com/events/webplatformsummit/microsoft-edge-web-summit-2017/es14] +> [!VIDEO https://channel9.msdn.com/events/webplatformsummit/microsoft-edge-web-summit-2017/es14/player] ### Building a safer browser: Four guards to keep users safe Learn about our security strategy and how we use the Four Guards to keep your users safe while they browse the Internet. -![VIDEO https://channel9.msdn.com/events/webplatformsummit/microsoft-edge-web-summit-2017/es03] \ No newline at end of file +> [!VIDEO https://channel9.msdn.com/events/webplatformsummit/microsoft-edge-web-summit-2017/es03/player] diff --git a/browsers/edge/emie-to-improve-compatibility.md b/browsers/edge/emie-to-improve-compatibility.md index 5fa2461985..40444da9f6 100644 --- a/browsers/edge/emie-to-improve-compatibility.md +++ b/browsers/edge/emie-to-improve-compatibility.md @@ -1,23 +1,28 @@ --- description: If you're having problems with Microsoft Edge, this topic tells how to use the Enterprise Mode site list to automatically open sites using IE11. ms.assetid: 89c75f7e-35ca-4ca8-96fa-b3b498b53bE4 -author: shortpatti -ms.author: pashort -ms.manager: dougkim -ms.prod: browser-edge +ms.reviewer: +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp +ms.manager: dansimp +ms.prod: edge ms.topic: reference ms.mktglfcycl: support ms.sitesec: library ms.pagetype: appcompat title: Use Enterprise Mode to improve compatibility (Microsoft Edge for IT Pros) ms.localizationpriority: medium -ms.date: 10/24/2018 --- # Use Enterprise Mode to improve compatibility > Applies to: Windows 10 +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + If you have specific websites and apps that have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the websites open in Internet Explorer 11 automatically. Additionally, if you know that your intranet sites aren't going to work correctly with Microsoft Edge, you can set all intranet sites to automatically open using IE11 with the **Send all intranet sites to IE** group policy. Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. @@ -39,11 +44,11 @@ If you're having trouble deciding whether Microsoft Edge is right for your organ |Microsoft Edge |IE11 | |---------|---------| -|Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana. |IE11 offers enterprises additional security, manageability, performance, backward compatibility, and modern standards support. | +|Microsoft Edge takes you beyond just browsing to actively engaging with the web through features like Web Note, Reading View, and Cortana. |IE11 offers enterprises additional security, manageability, performance, backward compatibility, and modern standards support. | ## Configure the Enterprise Mode Site List -[Available policy options](includes/configure-enterprise-mode-site-list-include.md) +[!INCLUDE [Available policy options](includes/configure-enterprise-mode-site-list-include.md)] ## Related topics diff --git a/browsers/edge/group-policies/address-bar-settings-gp.md b/browsers/edge/group-policies/address-bar-settings-gp.md index b8b82b3882..d718092a90 100644 --- a/browsers/edge/group-policies/address-bar-settings-gp.md +++ b/browsers/edge/group-policies/address-bar-settings-gp.md @@ -4,10 +4,12 @@ description: Microsoft Edge, by default, shows a list of search suggestions in t services: keywords: ms.localizationpriority: medium -manager: dougkim -author: shortpatti -ms.author: pashort +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp ms.date: 10/02/2018 +ms.reviewer: ms.topic: reference ms.prod: edge ms.mktglfcycl: explore @@ -16,6 +18,9 @@ ms.sitesec: library # Address bar +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge, by default, shows a list of search suggestions in the address bar. You can minimize network connections from Microsoft Edge to Microsoft services by hiding the functionality of the Address bar drop-down list. You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: diff --git a/browsers/edge/group-policies/adobe-settings-gp.md b/browsers/edge/group-policies/adobe-settings-gp.md index 3ad76e0397..7d9d3e6652 100644 --- a/browsers/edge/group-policies/adobe-settings-gp.md +++ b/browsers/edge/group-policies/adobe-settings-gp.md @@ -4,10 +4,12 @@ description: Adobe Flash Player still has a significant presence on the internet services: keywords: ms.localizationpriority: medium -manager: dougkim -author: shortpatti -ms.author: pashort +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp ms.date: 10/02/2018 +ms.reviewer: ms.topic: reference ms.prod: edge ms.mktglfcycl: explore @@ -16,6 +18,9 @@ ms.sitesec: library # Adobe Flash +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Adobe Flash Player still has a significant presence on the internet, such as digital ads. However, open standards, such as HTML5, provide many of the capabilities and functionalities becoming an alternative for content on the web. With Adobe no longer supporting Flash after 2020, Microsoft has started to phase out Flash from Microsoft Edge by adding the [Configure the Adobe Flash Click-to-Run setting](#configure-the-adobe-flash-click-to-run-setting) group policy giving you a way to control the list of websites that have permission to run Adobe Flash content. To learn more about Microsoft’s plan for phasing out Flash from Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash]( https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). diff --git a/browsers/edge/group-policies/books-library-management-gp.md b/browsers/edge/group-policies/books-library-management-gp.md index d2e9d6ea91..b2689d9638 100644 --- a/browsers/edge/group-policies/books-library-management-gp.md +++ b/browsers/edge/group-policies/books-library-management-gp.md @@ -4,10 +4,12 @@ description: Microsoft Edge decreases the amount of storage used by book files b services: keywords: ms.localizationpriority: medium -manager: dougkim -author: shortpatti -ms.author: pashort +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp ms.date: 10/02/2018 +ms.reviewer: ms.topic: reference ms.prod: edge ms.mktglfcycl: explore @@ -16,6 +18,9 @@ ms.sitesec: library # Books Library +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge decreases the amount of storage used by book files by downloading them to a shared folder in Windows. You can configure Microsoft Edge to update the configuration data for the library automatically or gather diagnostic data, such as usage data. @@ -33,4 +38,4 @@ You can find the Microsoft Edge Group Policy settings in the following location [!INCLUDE [allow-ext-telemetry-books-tab-include.md](../includes/allow-ext-telemetry-books-tab-include.md)] ## Always show the Books Library in Microsoft Edge -[!INCLUDE [always-enable-book-library-include.md](../includes/always-enable-book-library-include.md)] \ No newline at end of file +[!INCLUDE [always-enable-book-library-include.md](../includes/always-enable-book-library-include.md)] diff --git a/browsers/edge/group-policies/browser-settings-management-gp.md b/browsers/edge/group-policies/browser-settings-management-gp.md index 2570cc3c69..2301806f5f 100644 --- a/browsers/edge/group-policies/browser-settings-management-gp.md +++ b/browsers/edge/group-policies/browser-settings-management-gp.md @@ -4,10 +4,12 @@ description: Not only do the other Microsoft Edge group policies enhance the bro services: keywords: ms.localizationpriority: medium -manager: dougkim -author: shortpatti -ms.author: pashort +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp ms.date: 10/02/2018 +ms.reviewer: ms.topic: reference ms.prod: edge ms.mktglfcycl: explore @@ -16,6 +18,9 @@ ms.sitesec: library # Browser experience +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Not only do the other Microsoft Edge group policies enhance the browsing experience, but we also want to mention some of the other and common browsing experiences. For example, printing web content is a common browsing experience. However, if you want to prevent users from printing web content, Microsoft Edge has a group policy that allows you to prevent printing. The same goes for Pop-up Blocker; Microsoft Edge has a group policy that lets you prevent pop-up windows or let users choose to use Pop-up Blocker. You can use any one of the following group policies to continue enhancing the browsing experience for your users. diff --git a/browsers/edge/group-policies/developer-settings-gp.md b/browsers/edge/group-policies/developer-settings-gp.md index ca4870ac95..67c6d1284c 100644 --- a/browsers/edge/group-policies/developer-settings-gp.md +++ b/browsers/edge/group-policies/developer-settings-gp.md @@ -1,13 +1,15 @@ --- -title: Microsoft Edge - Developer tools -description: Microsoft Edge, by default, allows users to use the F12 developer tools as well as access the about:flags page. You can prevent users from using the F12 developer tools or from accessing the about:flags page. +title: Microsoft Edge - Developer tools +description: Microsoft Edge, by default, allows users to use the F12 developer tools as well as access the about:flags page. You can prevent users from using the F12 developer tools or from accessing the about:flags page. services: keywords: ms.localizationpriority: medium -managre: dougkim -author: shortpatti -ms.author: pashort +author: dansimp +ms.author: dansimp ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp ms.topic: reference ms.prod: edge ms.mktglfcycl: explore @@ -16,6 +18,9 @@ ms.sitesec: library # Developer tools +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge, by default, allows users to use the F12 developer tools as well as access the about:flags page. You can prevent users from using the F12 developer tools or from accessing the about:flags page. You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: diff --git a/browsers/edge/group-policies/extensions-management-gp.md b/browsers/edge/group-policies/extensions-management-gp.md index 3a7fc2dfe5..dc9b9406b4 100644 --- a/browsers/edge/group-policies/extensions-management-gp.md +++ b/browsers/edge/group-policies/extensions-management-gp.md @@ -4,10 +4,12 @@ description: Currently, Microsoft Edge allows users to add or personalize, and u services: keywords: ms.localizationpriority: medium -manager: dougkim -author: shortpatti -ms.author: pashort +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp ms.date: 10/02/2018 +ms.reviewer: ms.topic: reference ms.prod: edge ms.mktglfcycl: explore @@ -16,6 +18,9 @@ ms.sitesec: library # Extensions +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Currently, Microsoft Edge allows users to add or personalize, and uninstall extensions. You can prevent users from uninstalling extensions or sideloading of extensions, which does not prevent sideloading using Add-AppxPackage via PowerShell. Allowing sideloading of extensions installs and runs unverified extensions. You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: diff --git a/browsers/edge/group-policies/favorites-management-gp.md b/browsers/edge/group-policies/favorites-management-gp.md index 13c415afdf..9a022da181 100644 --- a/browsers/edge/group-policies/favorites-management-gp.md +++ b/browsers/edge/group-policies/favorites-management-gp.md @@ -1,13 +1,15 @@ --- title: Microsoft Edge - Favorites group policies -description: Configure Microsoft Edge to either show or hide the favorites bar on all pages. Microsoft Edge hides the favorites bar by default but shows the favorites bar on the Start and New tab pages. Also, by default, the favorites bar toggle, in Settings, is set to Off but enabled allowing users to make changes. +description: Configure Microsoft Edge to either show or hide the favorites bar on all pages. Microsoft Edge hides the favorites bar by default but shows the favorites bar on the Start and New tab pages. Also, by default, the favorites bar toggle, in Settings, is set to Off but enabled allowing users to make changes. services: keywords: ms.localizationpriority: medium -manager: dougkim -author: shortpatti -ms.author: pashort +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp ms.date: 10/02/2018 +ms.reviewer: ms.topic: reference ms.prod: edge ms.mktglfcycl: explore @@ -16,6 +18,9 @@ ms.sitesec: library # Favorites +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + You can customize the favorites bar, for example, you can turn off features such as Save a Favorite and Import settings, and hide or show the favorites bar on all pages. Another customization you can make is provisioning a standard list of favorites, including folders, to appear in addition to the user’s favorites. If it’s important to keep the favorites in both IE11 and Microsoft Edge synced, you can turn on syncing where changes to the list of favorites in one browser reflect in the other. >[!TIP] @@ -35,4 +40,4 @@ You can find the Microsoft Edge Group Policy settings in the following location [!INCLUDE [prevent-changes-to-favorites-include](../includes/prevent-changes-to-favorites-include.md)] ## Provision Favorites -[!INCLUDE [provision-favorites-include](../includes/provision-favorites-include.md)] \ No newline at end of file +[!INCLUDE [provision-favorites-include](../includes/provision-favorites-include.md)] diff --git a/browsers/edge/group-policies/home-button-gp.md b/browsers/edge/group-policies/home-button-gp.md index 3f22c2897d..8f498a5d58 100644 --- a/browsers/edge/group-policies/home-button-gp.md +++ b/browsers/edge/group-policies/home-button-gp.md @@ -1,10 +1,12 @@ --- title: Microsoft Edge - Home button group policies description: Microsoft Edge shows the home button, by default, and by clicking it the Start page loads. With the relevant Home button policies, you can configure the Home button to load the New tab page or a specific page. You can also configure Microsoft Edge to hide the home button. -manager: dougkim -ms.author: pashort -author: shortpatti +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp ms.date: 10/02/2018 +ms.reviewer: ms.localizationpriority: medium ms.prod: edge ms.mktglfcycl: explore @@ -14,6 +16,9 @@ ms.topic: reference # Home button +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge shows the home button, by default, and by clicking it the Start page loads. With the relevant Home button policies, you can configure the Home button to load the New tab page or a specific page. You can also configure Microsoft Edge to hide the home button. ## Relevant group policies diff --git a/browsers/edge/group-policies/index.yml b/browsers/edge/group-policies/index.yml index 6e7a2ccb42..cb590ce308 100644 --- a/browsers/edge/group-policies/index.yml +++ b/browsers/edge/group-policies/index.yml @@ -2,19 +2,19 @@ documentType: LandingData -title: Microsoft Edge group policies +title: Microsoft Edge Legacy group policies metadata: document_id: - title: Microsoft Edge group policies + title: Microsoft Edge Legacy group policies - description: Learn how to configure group policies in Microsoft Edge on Windows 10. + description: Learn how to configure group policies in Microsoft Edge Legacy on Windows 10. - text: Some of the features in Microsoft Edge gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. + text: Some of the features in Microsoft Edge Legacy gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. (To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).) - keywords: Microsoft Edge, Windows 10, Windows 10 Mobile + keywords: Microsoft Edge Legacy, Windows 10, Windows 10 Mobile ms.localizationpriority: medium @@ -36,7 +36,7 @@ sections: - type: markdown - text: Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPOs) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. + text: (Note - You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).) Microsoft Edge Legacy works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPOs) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. - items: @@ -92,7 +92,7 @@ sections: - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/developer-settings-gp - html:

Learn how configure Microsoft Edge for development and testing.

+ html:

Learn how to configure Microsoft Edge for development and testing.

image: diff --git a/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md b/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md index 9e39200fe0..f1a0929bb3 100644 --- a/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md +++ b/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md @@ -2,10 +2,12 @@ title: Microsoft Edge - Interoperability and enterprise mode guidance description: Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or included on your Enterprise Mode Site List. If you are running web apps that continue to use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and modern standards support. ms.localizationpriority: medium -manager: dougkim -ms.author: pashort -author: shortpatti +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp ms.date: 10/02/2018 +ms.reviewer: ms.prod: edge ms.mktglfcycl: explore ms.sitesec: library @@ -14,6 +16,9 @@ ms.topic: reference # Interoperability and enterprise mode guidance +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge is the default browser experience for Windows 10 and Windows 10 Mobile. However, Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or included on your Enterprise Mode Site List. If you are running web apps that continue to use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and modern standards support. >[!TIP] diff --git a/browsers/edge/group-policies/new-tab-page-settings-gp.md b/browsers/edge/group-policies/new-tab-page-settings-gp.md index b18871a3e6..2f61f0bd35 100644 --- a/browsers/edge/group-policies/new-tab-page-settings-gp.md +++ b/browsers/edge/group-policies/new-tab-page-settings-gp.md @@ -1,10 +1,12 @@ --- title: Microsoft Edge - New Tab page group policies description: Microsoft Edge loads the default New tab page by default. With the relevant New Tab policies, you can set a URL to load in the New Tab page and prevent users from making changes. You can also load a blank page instead or let the users choose what loads. -manager: dougkim -ms.author: pashort -author: shortpatti +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp ms.date: 10/02/2018 +ms.reviewer: ms.localizationpriority: medium ms.prod: edge ms.mktglfcycl: explore @@ -15,6 +17,9 @@ ms.topic: reference # New Tab page +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge loads the default New tab page by default. With the relevant New Tab policies, you can set a URL to load in the New Tab page and prevent users from making changes. You can also load a blank page instead or let the users choose what loads. >[!NOTE] @@ -42,4 +47,4 @@ You can find the Microsoft Edge Group Policy settings in the following location [!INCLUDE [set-new-tab-url-include](../includes/set-new-tab-url-include.md)] ## Allow web content on New Tab page -[!INCLUDE [allow-web-content-new-tab-page-include](../includes/allow-web-content-new-tab-page-include.md)] \ No newline at end of file +[!INCLUDE [allow-web-content-new-tab-page-include](../includes/allow-web-content-new-tab-page-include.md)] diff --git a/browsers/edge/group-policies/prelaunch-preload-gp.md b/browsers/edge/group-policies/prelaunch-preload-gp.md index 8baa1858bb..5c4bf7c5fe 100644 --- a/browsers/edge/group-policies/prelaunch-preload-gp.md +++ b/browsers/edge/group-policies/prelaunch-preload-gp.md @@ -1,16 +1,21 @@ --- title: Microsoft Edge - Prelaunch and tab preload group policies description: Microsoft Edge pre-launches as a background process during Windows startup when the system is idle waiting to be launched by the user. Pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start up Microsoft Edge. -manager: dougkim -ms.author: pashort -author: shortpatti -ms.date: 10/02/2018 +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +ms.prod: edge +ms.reviewer: ms.localizationpriority: medium ms.topic: reference --- # Prelaunch Microsoft Edge and preload tabs in the background +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge pre-launches as a background process during Windows startup when the system is idle waiting to be launched by the user. Pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start up Microsoft Edge. You can also configure Microsoft Edge to prevent Microsoft Edge from pre-launching. Additionally, Microsoft Edge preloads the Start and New Tab pages during Windows sign in, which minimizes the amount of time required to start Microsoft Edge and load a new tab. You can also configure Microsoft Edge to prevent preloading of tabs. @@ -39,4 +44,4 @@ You can find the Microsoft Edge Group Policy settings in the following location [!INCLUDE [allow-prelaunch-include](../includes/allow-prelaunch-include.md)] ## Allow Microsoft Edge to load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed -[!INCLUDE [allow-tab-preloading-include](../includes/allow-tab-preloading-include.md)] \ No newline at end of file +[!INCLUDE [allow-tab-preloading-include](../includes/allow-tab-preloading-include.md)] diff --git a/browsers/edge/group-policies/search-engine-customization-gp.md b/browsers/edge/group-policies/search-engine-customization-gp.md index 75677a0ec8..480d0e275f 100644 --- a/browsers/edge/group-policies/search-engine-customization-gp.md +++ b/browsers/edge/group-policies/search-engine-customization-gp.md @@ -1,16 +1,21 @@ --- title: Microsoft Edge - Search engine customization group policies -description: Microsoft Edge, by default, uses the search engine specified in App settings, which lets users make changes. You can prevent users from making changes and still use the search engine specified in App settings by disabling the Allow search engine customization policy. You can also use the policy-set search engine specified in the OpenSearch XML file in which you can configure up to five additional search engines and setting any one of them as the default. -manager: dougkim -ms.author: pashort -author: shortpatti -ms.date: 10/02/2018 +description: Microsoft Edge, by default, uses the search engine specified in App settings, which lets users make changes. You can prevent users from making changes and still use the search engine specified in App settings by disabling the Allow search engine customization policy. You can also use the policy-set search engine specified in the OpenSearch XML file in which you can configure up to five additional search engines and setting any one of them as the default. +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp +ms.prod: edge +ms.reviewer: ms.localizationpriority: medium ms.topic: reference --- # Search engine customization +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge, by default, uses the search engine specified in App settings, which lets users make changes. You can prevent users from making changes and still use the search engine specified in App settings by disabling the Allow search engine customization policy. You can also use the policy-set search engine specified in the OpenSearch XML file in which you can configure up to five additional search engines and setting any one of them as the default. ## Relevant group policies diff --git a/browsers/edge/group-policies/security-privacy-management-gp.md b/browsers/edge/group-policies/security-privacy-management-gp.md index cf137c8439..033d73b50e 100644 --- a/browsers/edge/group-policies/security-privacy-management-gp.md +++ b/browsers/edge/group-policies/security-privacy-management-gp.md @@ -1,16 +1,21 @@ --- title: Microsoft Edge - Security and privacy group policies -description: Microsoft Edge helps to defend from increasingly sophisticated and prevalent web-based attacks against Windows. While most websites are safe, some sites have been designed to steal personal information or gain access to your system’s resources. -manager: dougkim -ms.author: pashort -author: shortpatti +description: Microsoft Edge helps to defend from increasingly sophisticated and prevalent web-based attacks against Windows. While most websites are safe, some sites have been designed to steal personal information or gain access to your system’s resources. +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp ms.date: 10/02/2018 +ms.reviewer: ms.localizationpriority: medium ms.topic: reference --- # Security and privacy +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge is designed with improved security in mind, helping to defend people from increasingly sophisticated and prevalent web-based attacks against Windows. Because Microsoft Edge is designed like a Universal Windows app, changing the browser to an app, it fundamentally changes the process model so that both the outer manager process and the different content processes all live within app container sandboxes. Microsoft Edge runs in 64-bit not just by default, but anytime it’s running on a 64-bit operating system. Because Microsoft Edge doesn’t support legacy ActiveX controls or 3rd-party binary extensions, there’s no longer a reason to run 32-bit processes on a 64-bit system. @@ -56,17 +61,18 @@ Another method thieves often use _hacking_ to attack a system through malformed Microsoft Edge addresses these threats to help make browsing the web a safer experience. -| Feature | Description | -|---|---| -| **[Windows Hello](https://blogs.windows.com/bloggingwindows/2015/03/17/making-windows-10-more-personal-and-more-secure-with-windows-hello/)** | Microsoft Edge is the first browser to natively support Windows Hello to authenticate the user and the website with asymmetric cryptography technology, powered by early implementation of the [Web Authentication (formerly FIDO 2.0 Web API) specification](https://w3c.github.io/webauthn/). | -| **Microsoft SmartScreen** | Defends against phishing by performing reputation checks on sites visited and blocking any sites that are thought to be a phishing site. SmartScreen also helps to defend against installing malicious software, drive-by attacks, or file downloads, even from trusted sites. Drive-by attacks are malicious web-based attacks that compromise your system by targeting security vulnerabilities in commonly used software and may be hosted on trusted sites. | -| **Certificate Reputation system** | Collects data about certificates in use, detecting new certificates and flagging fraudulent certificates automatically, and sends the data to Microsoft. The systems and tools in place include | -| **Microsoft EdgeHTML and modern web standards** | Microsoft Edge uses Microsoft EdgeHTML as the rendering engine. This engine focuses on modern standards letting web developers build and maintain a consistent site across all modern browsers. It also helps to defend against hacking through these security standards features:

**NOTE:** Both Microsoft Edge and Internet Explorer 11 support HSTS. | -| **Code integrity and image loading restrictions** | Microsoft Edge content processes support code integrity and image load restrictions, helping to prevent malicious DLLs from loading or injecting into the content processes. Only [properly signed images](https://blogs.windows.com/msedgedev/2015/11/17/microsoft-edge-module-code-integrity/) are allowed to load into Microsoft Edge. Binaries on remote devices (such as UNC or WebDAV) can’t load. | -| **Memory corruption mitigations** | Memory corruption attacks frequently happen to apps written in C or C++ don’t provide safety or buffer overflow protection. When an attacker provides malformed input to a program, the program’s memory becomes corrupt allowing the attacker to take control of the program. Although attackers have adapted and invented new ways to attack, we’ve responded with memory safety defenses, mitigating the most common forms of attack, including and especially [use-after-free (UAF)](https://cwe.mitre.org/data/definitions/416.html) vulnerabilities. | -| **Memory Garbage Collector (MemGC) mitigation** | MemGC replaces Memory Protector and helps to protect the browser from UAF vulnerabilities. MemGC frees up memory from the programmer and automating it. Only freeing memory when the automation detects no references left pointing to a given block of memory. | -| **Control Flow Guard** | Attackers use memory corruption attacks to gain control of the CPU program counter to jump to any code location they want. Control Flow Guard, a Microsoft Visual Studio technology, compiles checks around code that performs indirect jumps based on a pointer. Those jumps get restricted to function entry points with known addresses only making attacker take-overs must more difficult constraining where an attack jumps. | -| **All web content runs in an app container sandbox** |Microsoft Edge takes the sandbox even farther, running its content processes in containers not just by default, but all of the time. Microsoft Edge doesn’t support 3rd party binary extensions, so there is no reason for it to run outside of the container, making Microsoft Edge more secure. | -| **Extension model and HTML5 support** |Microsoft Edge does not support binary extensions because they can bring code and data into the browser’s processes without any protection. So if anything goes wrong, the entire browser itself can be compromised or go down. We encourage everyone to use our scripted HTML5-based extension model. For more info about the new extensions, see the [Microsoft Edge Developer Center](https://developer.microsoft.com/microsoft-edge/extensions/). | -| **Reduced attack surfaces** |Microsoft Edge does not support VBScript, JScript, VML, Browser Helper Objects, Toolbars, ActiveX controls, and [document modes](https://msdn.microsoft.com/library/jj676915.aspx). Many IE browser vulnerabilities only appear in legacy document modes, so removing support reduced attack surface making the browser more secure.

It also means that it’s not as backward compatible. With this reduced backward compatibility, Microsoft Edge automatically falls back to Internet Explorer 11 for any apps that need backward compatibility. This fall back happens when you use the Enterprise Mode Site List. | +| Feature | Description | +|-----------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **[Windows Hello](https://blogs.windows.com/bloggingwindows/2015/03/17/making-windows-10-more-personal-and-more-secure-with-windows-hello/)** | Microsoft Edge is the first browser to natively support Windows Hello to authenticate the user and the website with asymmetric cryptography technology, powered by early implementation of the [Web Authentication (formerly FIDO 2.0 Web API) specification](https://w3c.github.io/webauthn/). | +| **Microsoft SmartScreen** | Defends against phishing by performing reputation checks on sites visited and blocking any sites that are thought to be a phishing site. SmartScreen also helps to defend against installing malicious software, drive-by attacks, or file downloads, even from trusted sites. Drive-by attacks are malicious web-based attacks that compromise your system by targeting security vulnerabilities in commonly used software and may be hosted on trusted sites. | +| **Certificate Reputation system** | Collects data about certificates in use, detecting new certificates and flagging fraudulent certificates automatically, and sends the data to Microsoft. The systems and tools in place include

| +| **Microsoft EdgeHTML and modern web standards** | Microsoft Edge uses Microsoft EdgeHTML as the rendering engine. This engine focuses on modern standards letting web developers build and maintain a consistent site across all modern browsers. It also helps to defend against hacking through these security standards features:

**NOTE:** Both Microsoft Edge and Internet Explorer 11 support HSTS. | +| **Code integrity and image loading restrictions** | Microsoft Edge content processes support code integrity and image load restrictions, helping to prevent malicious DLLs from loading or injecting into the content processes. Only [properly signed images](https://blogs.windows.com/msedgedev/2015/11/17/microsoft-edge-module-code-integrity/) are allowed to load into Microsoft Edge. Binaries on remote devices (such as UNC or WebDAV) can’t load. | +| **Memory corruption mitigations** | Memory corruption attacks frequently happen to apps written in C or C++ don’t provide safety or buffer overflow protection. When an attacker provides malformed input to a program, the program’s memory becomes corrupt allowing the attacker to take control of the program. Although attackers have adapted and invented new ways to attack, we’ve responded with memory safety defenses, mitigating the most common forms of attack, including and especially [use-after-free (UAF)](https://cwe.mitre.org/data/definitions/416.html) vulnerabilities. | +| **Memory Garbage Collector (MemGC) mitigation** | MemGC replaces Memory Protector and helps to protect the browser from UAF vulnerabilities. MemGC frees up memory from the programmer and automating it. Only freeing memory when the automation detects no references left pointing to a given block of memory. | +| **Control Flow Guard** | Attackers use memory corruption attacks to gain control of the CPU program counter to jump to any code location they want. Control Flow Guard, a Microsoft Visual Studio technology, compiles checks around code that performs indirect jumps based on a pointer. Those jumps get restricted to function entry points with known addresses only making attacker take-overs must more difficult constraining where an attack jumps. | +| **All web content runs in an app container sandbox** | Microsoft Edge takes the sandbox even farther, running its content processes in containers not just by default, but all of the time. Microsoft Edge doesn’t support 3rd party binary extensions, so there is no reason for it to run outside of the container, making Microsoft Edge more secure. | +| **Extension model and HTML5 support** | Microsoft Edge does not support binary extensions because they can bring code and data into the browser’s processes without any protection. So if anything goes wrong, the entire browser itself can be compromised or go down. We encourage everyone to use our scripted HTML5-based extension model. For more info about the new extensions, see the [Microsoft Edge Developer Center](https://developer.microsoft.com/microsoft-edge/extensions/). | +| **Reduced attack surfaces** | Microsoft Edge does not support VBScript, JScript, VML, Browser Helper Objects, Toolbars, ActiveX controls, and [document modes](https://msdn.microsoft.com/library/jj676915.aspx). Many IE browser vulnerabilities only appear in legacy document modes, so removing support reduced attack surface making the browser more secure.

It also means that it’s not as backward compatible. With this reduced backward compatibility, Microsoft Edge automatically falls back to Internet Explorer 11 for any apps that need backward compatibility. This fall back happens when you use the Enterprise Mode Site List. | + --- diff --git a/browsers/edge/group-policies/start-pages-gp.md b/browsers/edge/group-policies/start-pages-gp.md index 55df08e642..5ea55bba9f 100644 --- a/browsers/edge/group-policies/start-pages-gp.md +++ b/browsers/edge/group-policies/start-pages-gp.md @@ -1,11 +1,13 @@ --- title: Microsoft Edge - Start pages group policies -description: Microsoft Edge loads the pages specified in App settings as the default Start pages. With the relevant Start pages policies, you can configure Microsoft Edge to load either the Start page, New tab page, previously opened pages, or a specific page or pages. You can also configure Microsoft Edge to prevent users from making changes. -manager: dougkim -ms.author: pashort -author: shortpatti +description: Microsoft Edge loads the pages specified in App settings as the default Start pages. With the relevant Start pages policies, you can configure Microsoft Edge to load either the Start page, New tab page, previously opened pages, or a specific page or pages. You can also configure Microsoft Edge to prevent users from making changes. +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp ms.localizationpriority: medium ms.date: 10/02/2018 +ms.reviewer: ms.prod: edge ms.mktglfcycl: explore ms.sitesec: library @@ -14,6 +16,9 @@ ms.topic: reference # Start pages +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge loads the pages specified in App settings as the default Start pages. With the relevant Start pages policies, you can configure Microsoft Edge to load either the Start page, New tab page, previously opened pages, or a specific page or pages. You can also configure Microsoft Edge to prevent users from making changes. ## Relevant group policies diff --git a/browsers/edge/group-policies/sync-browser-settings-gp.md b/browsers/edge/group-policies/sync-browser-settings-gp.md index aac83e87ca..cdce19d2e5 100644 --- a/browsers/edge/group-policies/sync-browser-settings-gp.md +++ b/browsers/edge/group-policies/sync-browser-settings-gp.md @@ -1,16 +1,20 @@ --- -title: Microsoft Edge - Sync browser settings +title: Microsoft Edge - Sync browser settings description: By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. The “browser” group uses the Sync your Settings option in Settings to sync information like history and favorites. -manager: dougkim -ms.author: pashort -author: shortpatti +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp ms.date: 10/02/2018 +ms.reviewer: ms.localizationpriority: medium ms.topic: reference --- # Sync browser settings +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. The “browser” group uses the Sync your Settings option in Settings to sync information like history and favorites. You can configure Microsoft Edge to prevent the “browser” group from syncing and prevent users from turning on the _Sync your Settings_ toggle in Settings. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option in the Do not sync browser policy. @@ -41,4 +45,4 @@ To verify the settings: [!INCLUDE [do-not-sync-browser-settings-include](../includes/do-not-sync-browser-settings-include.md)] ## Prevent users from turning on browser syncing -[!INCLUDE [prevent-users-to-turn-on-browser-syncing-include](../includes/prevent-users-to-turn-on-browser-syncing-include.md)] \ No newline at end of file +[!INCLUDE [prevent-users-to-turn-on-browser-syncing-include](../includes/prevent-users-to-turn-on-browser-syncing-include.md)] diff --git a/browsers/edge/group-policies/telemetry-management-gp.md b/browsers/edge/group-policies/telemetry-management-gp.md index c83cd2848c..fb3329f960 100644 --- a/browsers/edge/group-policies/telemetry-management-gp.md +++ b/browsers/edge/group-policies/telemetry-management-gp.md @@ -1,16 +1,21 @@ --- title: Microsoft Edge - Telemetry and data collection group policies description: Microsoft Edge gathers diagnostic data, intranet history, internet history, tracking information of sites visited, and Live Tile metadata. You can configure Microsoft Edge to collect all or none of this information. -manager: dougkim -ms.author: pashort -author: shortpatti +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp ms.date: 10/02/2018 +ms.reviewer: ms.localizationpriority: medium ms.topic: reference --- # Telemetry and data collection +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + Microsoft Edge gathers diagnostic data, intranet history, internet history, tracking information of sites visited, and Live Tile metadata. You can configure Microsoft Edge to collect all or none of this information. You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: @@ -27,4 +32,4 @@ You can find the Microsoft Edge Group Policy settings in the following location [!INCLUDE [configure-do-not-track-include.md](../includes/configure-do-not-track-include.md)] ## Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start -[!INCLUDE [prevent-live-tile-pinning-start-include](../includes/prevent-live-tile-pinning-start-include.md)] \ No newline at end of file +[!INCLUDE [prevent-live-tile-pinning-start-include](../includes/prevent-live-tile-pinning-start-include.md)] diff --git a/browsers/edge/img-microsoft-edge-infographic-lg.md b/browsers/edge/img-microsoft-edge-infographic-lg.md index e9d8b67cc2..9b329c580b 100644 --- a/browsers/edge/img-microsoft-edge-infographic-lg.md +++ b/browsers/edge/img-microsoft-edge-infographic-lg.md @@ -2,10 +2,15 @@ description: A full-sized view of the Microsoft Edge infographic. title: Full-sized view of the Microsoft Edge infographic ms.date: 11/10/2016 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp --- Return to: [Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md)
-Download image: [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/en-us/download/details.aspx?id=53892) +Download image: [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/download/details.aspx?id=53892) ![Full-sized Microsoft Edge infographic](images/img-microsoft-edge-infographic-lg.png) diff --git a/browsers/edge/includes/allow-address-bar-suggestions-include.md b/browsers/edge/includes/allow-address-bar-suggestions-include.md index fef471693a..fdcebd090e 100644 --- a/browsers/edge/includes/allow-address-bar-suggestions-include.md +++ b/browsers/edge/includes/allow-address-bar-suggestions-include.md @@ -1,49 +1,52 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
->*Default setting: Enabled or not configured (Allowed)* - -[!INCLUDE [allow-address-bar-drop-down-shortdesc](../shortdesc/allow-address-bar-drop-down-shortdesc.md)] - - -### Supported values - - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Prevented. Hide the Address bar drop-down list and disable the _Show search and site suggestions as I type_ toggle in Settings. |![Most restricted value](../images/check-gn.png) | -|Enabled or not configured **(default)** |1 |1 |Allowed. Show the Address bar drop-down list and make it available. | | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow Address bar drop-down list suggestions -- **GP name:** AllowAddressBarDropdown -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowAddressBarDropdown](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser\#browser-allowaddressbardropdown) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowAddressBarDropdown -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\ServiceUI -- **Value name:** ShowOneBox -- **Value type:** REG_DWORD - - -### Related policies - -[Configure search suggestions in Address bar](../available-policies.md#configure-search-suggestions-in-address-bar): [!INCLUDE [configure-additional-search-engines-shortdesc](../shortdesc/configure-additional-search-engines-shortdesc.md)] - -

\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
+>*Default setting: Enabled or not configured (Allowed)* + +[!INCLUDE [allow-address-bar-drop-down-shortdesc](../shortdesc/allow-address-bar-drop-down-shortdesc.md)] + + +### Supported values + + +| Group Policy | MDM | Registry | Description | Most restricted | +|-----------------------------------------|:---:|:--------:|---------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled | 0 | 0 | Prevented. Hide the Address bar drop-down list and disable the *Show search and site suggestions as I type* toggle in Settings. | ![Most restricted value](../images/check-gn.png) | +| Enabled or not configured **(default)** | 1 | 1 | Allowed. Show the Address bar drop-down list and make it available. | | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow Address bar drop-down list suggestions +- **GP name:** AllowAddressBarDropdown +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowAddressBarDropdown](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser\#browser-allowaddressbardropdown) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowAddressBarDropdown +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\ServiceUI +- **Value name:** ShowOneBox +- **Value type:** REG_DWORD + + +### Related policies + +[Configure search suggestions in Address bar](../available-policies.md#configure-search-suggestions-in-address-bar): [!INCLUDE [configure-additional-search-engines-shortdesc](../shortdesc/configure-additional-search-engines-shortdesc.md)] + +
diff --git a/browsers/edge/includes/allow-adobe-flash-include.md b/browsers/edge/includes/allow-adobe-flash-include.md index c3965dd477..3a7671c32a 100644 --- a/browsers/edge/includes/allow-adobe-flash-include.md +++ b/browsers/edge/includes/allow-adobe-flash-include.md @@ -1,9 +1,12 @@ --- -author: shortpatti -ms.author: pashort +author: eavena +ms.author: eravena ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp ms.prod: edge -ms:topic: include +ms.topic: include --- @@ -14,10 +17,11 @@ ms:topic: include ### Supported values -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Disabled |0 |0 |Prevented | -|Enabled **(default)** |1 |1 |Allowed | +| Group Policy | MDM | Registry | Description | +|-----------------------|:---:|:--------:|-------------| +| Disabled | 0 | 0 | Prevented | +| Enabled **(default)** | 1 | 1 | Allowed | + --- ### ADMX info and settings @@ -31,7 +35,7 @@ ms:topic: include #### MDM settings - **MDM name:** Browser/[AllowFlash](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser\#browser-allowflash) - **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowAdobeFlash +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowFlash - **Data type:** Integer #### Registry settings diff --git a/browsers/edge/includes/allow-clearing-browsing-data-include.md b/browsers/edge/includes/allow-clearing-browsing-data-include.md index a3bd064c75..bd8b84f244 100644 --- a/browsers/edge/includes/allow-clearing-browsing-data-include.md +++ b/browsers/edge/includes/allow-clearing-browsing-data-include.md @@ -1,44 +1,47 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
->*Default setting: Disabled or not configured (Prevented)* - -[!INCLUDE [allow-clearing-browsing-data-on-exit-shortdesc](../shortdesc/allow-clearing-browsing-data-on-exit-shortdesc.md)] - -### Supported values - - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured **(default)** |0 |0 |Prevented. Users can configure the _Clear browsing data_ option in Settings. | | -|Enabled |1 |1 |Allowed. Clear the browsing data upon exit automatically. |![Most restricted value](../images/check-gn.png) | ---- - - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow clearing browsing data on exit -- **GP name:** AllowClearingBrowsingDataOnExit -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ClearBrowsingDataOnExit](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser\#browser-clearbrowsingdataonexit) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ClearBrowsingDataOnExit -- **Data type:** Integer - -#### Registry -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Privacy -- **Value name:** ClearBrowsingHistoryOnExit -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
+>*Default setting: Disabled or not configured (Prevented)* + +[!INCLUDE [allow-clearing-browsing-data-on-exit-shortdesc](../shortdesc/allow-clearing-browsing-data-on-exit-shortdesc.md)] + +### Supported values + + +| Group Policy | MDM | Registry | Description | Most restricted | +|------------------------------------------|:---:|:--------:|------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured **(default)** | 0 | 0 | Prevented. Users can configure the *Clear browsing data* option in Settings. | | +| Enabled | 1 | 1 | Allowed. Clear the browsing data upon exit automatically. | ![Most restricted value](../images/check-gn.png) | + +--- + + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow clearing browsing data on exit +- **GP name:** AllowClearingBrowsingDataOnExit +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ClearBrowsingDataOnExit](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser\#browser-clearbrowsingdataonexit) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ClearBrowsingDataOnExit +- **Data type:** Integer + +#### Registry +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Privacy +- **Value name:** ClearBrowsingHistoryOnExit +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/allow-config-updates-books-include.md b/browsers/edge/includes/allow-config-updates-books-include.md index 21454f87b9..02b449e5e2 100644 --- a/browsers/edge/includes/allow-config-updates-books-include.md +++ b/browsers/edge/includes/allow-config-updates-books-include.md @@ -1,46 +1,49 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1803 or later*
->*Default setting: Enabled or not configured (Allowed)* - -[!INCLUDE [allow-configuration-updates-for-books-library-shortdesc](../shortdesc/allow-configuration-updates-for-books-library-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Prevented. |![Most restricted value](../images/check-gn.png) | -|Enabled or not configured
**(default)** |1 |1 |Allowed. Microsoft Edge updates the configuration data for the Books Library automatically. | | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow configuration updates for the Books Library -- **GP name:** AllowConfigurationUpdateForBooksLibrary -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowConfigurationUpdateForBooksLibrary](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowconfigurationupdateforbookslibrary) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowConfigurationUpdateForBooksLibrary -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\BooksLibrary -- **Value name:** AllowConfigurationUpdateForBooksLibrary -- **Value type:** REG_DWORD - -### Related topics - -[!INCLUDE [man-connections-win-comp-services-shortdesc-include](man-connections-win-comp-services-shortdesc-include.md)] - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1803 or later*
+>*Default setting: Enabled or not configured (Allowed)* + +[!INCLUDE [allow-configuration-updates-for-books-library-shortdesc](../shortdesc/allow-configuration-updates-for-books-library-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------------------------------------|:---:|:--------:|---------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled | 0 | 0 | Prevented. | ![Most restricted value](../images/check-gn.png) | +| Enabled or not configured
**(default)** | 1 | 1 | Allowed. Microsoft Edge updates the configuration data for the Books Library automatically. | | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow configuration updates for the Books Library +- **GP name:** AllowConfigurationUpdateForBooksLibrary +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowConfigurationUpdateForBooksLibrary](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowconfigurationupdateforbookslibrary) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowConfigurationUpdateForBooksLibrary +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\BooksLibrary +- **Value name:** AllowConfigurationUpdateForBooksLibrary +- **Value type:** REG_DWORD + +### Related topics + +[!INCLUDE [man-connections-win-comp-services-shortdesc-include](man-connections-win-comp-services-shortdesc-include.md)] + +
diff --git a/browsers/edge/includes/allow-cortana-include.md b/browsers/edge/includes/allow-cortana-include.md index 867850d83f..248600e48b 100644 --- a/browsers/edge/includes/allow-cortana-include.md +++ b/browsers/edge/includes/allow-cortana-include.md @@ -1,43 +1,46 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Enabled (Allowed)* - -[!INCLUDE [allow-cortana-shortdesc](../shortdesc/allow-cortana-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Prevented. Users can still search to find items on their device. |![Most restricted value](../images/check-gn.png) | -|Enabled
**(default)** |1 |1 |Allowed. | | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow Cortana -- **GP name:** AllowCortana -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Experience/[AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) -- **Supported devices:** Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/AllowCortana -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\Windows\Windows Search -- **Value name:** AllowCortana -- **Value type:** REG_DWORD - -
- +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Enabled (Allowed)* + +[!INCLUDE [allow-cortana-shortdesc](../shortdesc/allow-cortana-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------------------|:---:|:--------:|------------------------------------------------------------------|:------------------------------------------------:| +| Disabled | 0 | 0 | Prevented. Users can still search to find items on their device. | ![Most restricted value](../images/check-gn.png) | +| Enabled
**(default)** | 1 | 1 | Allowed. | | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow Cortana +- **GP name:** AllowCortana +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Experience/[AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) +- **Supported devices:** Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/AllowCortana +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\Windows\Windows Search +- **Value name:** AllowCortana +- **Value type:** REG_DWORD + +
+ diff --git a/browsers/edge/includes/allow-dev-tools-include.md b/browsers/edge/includes/allow-dev-tools-include.md index b335926754..8a715d6905 100644 --- a/browsers/edge/includes/allow-dev-tools-include.md +++ b/browsers/edge/includes/allow-dev-tools-include.md @@ -1,44 +1,47 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
->*Default setting: Enabled (Allowed)* - -[!INCLUDE [allow-developer-tools-shortdesc](../shortdesc/allow-developer-tools-shortdesc.md)] - - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Prevented |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Allowed | | ---- - - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow Developer Tools -- **GP name:** AllowDeveloperTools -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowDeveloperTools](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowdevelopertools) -- **Supported devices:** Desktop -- **URI full Path:** ./Vendor/MSFT/Policy/Config/Browser/AllowDeveloperTools -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\F12 -- **Value name:** AllowDeveloperTools -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
+>*Default setting: Enabled (Allowed)* + +[!INCLUDE [allow-developer-tools-shortdesc](../shortdesc/allow-developer-tools-shortdesc.md)] + + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------|:---:|:--------:|-------------|:------------------------------------------------:| +| Disabled | 0 | 0 | Prevented | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Allowed | | + +--- + + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow Developer Tools +- **GP name:** AllowDeveloperTools +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowDeveloperTools](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowdevelopertools) +- **Supported devices:** Desktop +- **URI full Path:** ./Vendor/MSFT/Policy/Config/Browser/AllowDeveloperTools +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\F12 +- **Value name:** AllowDeveloperTools +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/allow-enable-book-library-include.md b/browsers/edge/includes/allow-enable-book-library-include.md index ec76df7f79..be4dcd7cfd 100644 --- a/browsers/edge/includes/allow-enable-book-library-include.md +++ b/browsers/edge/includes/allow-enable-book-library-include.md @@ -1,41 +1,44 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1709 or later*
->*Default setting: Disabled or not configured* - -[!INCLUDE [always-show-books-library-shortdesc](../shortdesc/always-show-books-library-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Show the Books Library only in countries or regions where supported. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Show the Books Library, regardless of the device’s country or region. | | ---- -### ADMX info and settings - -#### ADMX info -- **GP English name:** Always show the Books Library in Microsoft Edge -- **GP name:** AlwaysEnableBooksLibrary -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[Browser/AlwaysEnableBooksLibrary](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AlwaysEnableBooksLibrary -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main -- **Value name:** AlwaysEnableBooksLibrary -- **Value type:** REG_DWORD - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1709 or later*
+>*Default setting: Disabled or not configured* + +[!INCLUDE [always-show-books-library-shortdesc](../shortdesc/always-show-books-library-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|-----------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Show the Books Library only in countries or regions where supported. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Show the Books Library, regardless of the device’s country or region. | | + +--- +### ADMX info and settings + +#### ADMX info +- **GP English name:** Always show the Books Library in Microsoft Edge +- **GP name:** AlwaysEnableBooksLibrary +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[Browser/AlwaysEnableBooksLibrary](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AlwaysEnableBooksLibrary +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main +- **Value name:** AlwaysEnableBooksLibrary +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/allow-ext-telemetry-books-tab-include.md b/browsers/edge/includes/allow-ext-telemetry-books-tab-include.md index f078711142..1b39d3081d 100644 --- a/browsers/edge/includes/allow-ext-telemetry-books-tab-include.md +++ b/browsers/edge/includes/allow-ext-telemetry-books-tab-include.md @@ -1,43 +1,46 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1803 or later*
->*Default setting: Disabled or not configured (Gather and send only basic diagnostic data)* - -[!INCLUDE [allow-extended-telemetry-for-books-tab-shortdesc](../shortdesc/allow-extended-telemetry-for-books-tab-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Gather and send only basic diagnostic data. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Gather all diagnostic data. For this policy to work correctly, you must set the diagnostic data in _Settings > Diagnostics & feedback_ to **Full**. | | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow extended telemetry for the Books tab -- **GP name:** EnableExtendedBooksTelemetry -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** [Browser/EnableExtendedBooksTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enableextendedbookstelemetry) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/EnableExtendedBooksTelemetry -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary -- **Value name:** EnableExtendedBooksTelemetry -- **Value type:** REG_DWORD - - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1803 or later*
+>*Default setting: Disabled or not configured (Gather and send only basic diagnostic data)* + +[!INCLUDE [allow-extended-telemetry-for-books-tab-shortdesc](../shortdesc/allow-extended-telemetry-for-books-tab-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|-----------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Gather and send only basic diagnostic data. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Gather all diagnostic data. For this policy to work correctly, you must set the diagnostic data in *Settings > Diagnostics & feedback* to **Full**. | | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow extended telemetry for the Books tab +- **GP name:** EnableExtendedBooksTelemetry +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** [Browser/EnableExtendedBooksTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enableextendedbookstelemetry) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/EnableExtendedBooksTelemetry +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary +- **Value name:** EnableExtendedBooksTelemetry +- **Value type:** REG_DWORD + + +
diff --git a/browsers/edge/includes/allow-extensions-include.md b/browsers/edge/includes/allow-extensions-include.md index bb9b65ea2c..977e027f08 100644 --- a/browsers/edge/includes/allow-extensions-include.md +++ b/browsers/edge/includes/allow-extensions-include.md @@ -1,46 +1,49 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1607 or later*
->*Default setting: Enabled or not configured (Allowed)* - -[!INCLUDE [allow-extensions-shortdesc](../shortdesc/allow-extensions-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Disabled |0 |0 |Prevented | -|Enabled or not configured
**(default)** |1 |1 |Allowed | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow Extensions -- **GP name:** AllowExtensions -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowextensions) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowExtensions -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Extensions -- **Value name:** ExtensionsEnabled -- **Value type:** REG_DWORD - -### Related topics - -[!INCLUDE [microsoft-browser-extension-policy-shortdesc](../shortdesc/microsoft-browser-extension-policy-shortdesc.md)] - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1607 or later*
+>*Default setting: Enabled or not configured (Allowed)* + +[!INCLUDE [allow-extensions-shortdesc](../shortdesc/allow-extensions-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | +|--------------------------------------------|:---:|:--------:|-------------| +| Disabled | 0 | 0 | Prevented | +| Enabled or not configured
**(default)** | 1 | 1 | Allowed | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow Extensions +- **GP name:** AllowExtensions +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowextensions) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowExtensions +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Extensions +- **Value name:** ExtensionsEnabled +- **Value type:** REG_DWORD + +### Related topics + +[!INCLUDE [microsoft-browser-extension-policy-shortdesc](../shortdesc/microsoft-browser-extension-policy-shortdesc.md)] + +
diff --git a/browsers/edge/includes/allow-full-screen-include.md b/browsers/edge/includes/allow-full-screen-include.md index 6cbfe544bd..34d3dc32be 100644 --- a/browsers/edge/includes/allow-full-screen-include.md +++ b/browsers/edge/includes/allow-full-screen-include.md @@ -1,44 +1,47 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Enabled or not configured (Allowed)* - - -[!INCLUDE [allow-fullscreen-mode-shortdesc](../shortdesc/allow-fullscreen-mode-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Prevented |![Most restricted value](../images/check-gn.png) | -|Enabled
**(default)** |1 |1 |Allowed | | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow fullscreen mode -- **GP name:** AllowFullScreenMode -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowFullscreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowfullscreenmode) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowFullscreen -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main -- **Value name:** AllowFullScreenMode -- **Value type:** REG_DWORD - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Enabled or not configured (Allowed)* + + +[!INCLUDE [allow-fullscreen-mode-shortdesc](../shortdesc/allow-fullscreen-mode-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------------------|:---:|:--------:|-------------|:------------------------------------------------:| +| Disabled | 0 | 0 | Prevented | ![Most restricted value](../images/check-gn.png) | +| Enabled
**(default)** | 1 | 1 | Allowed | | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow fullscreen mode +- **GP name:** AllowFullScreenMode +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowFullscreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowfullscreenmode) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowFullscreen +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main +- **Value name:** AllowFullScreenMode +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/allow-inprivate-browsing-include.md b/browsers/edge/includes/allow-inprivate-browsing-include.md index 77339e72ef..0d66095576 100644 --- a/browsers/edge/includes/allow-inprivate-browsing-include.md +++ b/browsers/edge/includes/allow-inprivate-browsing-include.md @@ -1,44 +1,47 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
->*Default setting: Enabled or not configured (Allowed)* - - -[!INCLUDE [allow-inprivate-browsing-shortdesc](../shortdesc/allow-inprivate-browsing-shortdesc.md)] - - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Prevented |![Most restricted value](../images/check-gn.png) | -|Enabled or not configured
**(default)** |1 |1 |Allowed | | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow InPrivate browsing -- **GP name:** AllowInPrivate -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowInPrivate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowinprivate) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowInPrivate -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main -- **Value name:** AllowInPrivate -- **Value type:** REG_DWORD - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
+>*Default setting: Enabled or not configured (Allowed)* + + +[!INCLUDE [allow-inprivate-browsing-shortdesc](../shortdesc/allow-inprivate-browsing-shortdesc.md)] + + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------------------------------------|:---:|:--------:|-------------|:------------------------------------------------:| +| Disabled | 0 | 0 | Prevented | ![Most restricted value](../images/check-gn.png) | +| Enabled or not configured
**(default)** | 1 | 1 | Allowed | | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow InPrivate browsing +- **GP name:** AllowInPrivate +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowInPrivate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowinprivate) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowInPrivate +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Value name:** AllowInPrivate +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/allow-microsoft-compatibility-list-include.md b/browsers/edge/includes/allow-microsoft-compatibility-list-include.md index bbc6aad2d2..580909fe1d 100644 --- a/browsers/edge/includes/allow-microsoft-compatibility-list-include.md +++ b/browsers/edge/includes/allow-microsoft-compatibility-list-include.md @@ -1,42 +1,45 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1607 or later*
->*Default setting: Enabled or not configured (Allowed)* - -[!INCLUDE [allow-microsoft-compatibility-list-shortdesc](../shortdesc/allow-microsoft-compatibility-list-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Prevented |![Most restricted value](../images/check-gn.png) | -|Enabled or not configured
**(default)** |1 |1 |Allowed | | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow Microsoft Compatibility List -- **GP name:** AllowCVList -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowMicrosoftCompatibilityList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowmicrosoftcompatibilitylist) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowMicrosoftCompatibilityList -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\BrowserEmulation -- **Value name:** MSCompatibilityMode -- **Value type:** REG_DWORD - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1607 or later*
+>*Default setting: Enabled or not configured (Allowed)* + +[!INCLUDE [allow-microsoft-compatibility-list-shortdesc](../shortdesc/allow-microsoft-compatibility-list-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------------------------------------|:---:|:--------:|-------------|:------------------------------------------------:| +| Disabled | 0 | 0 | Prevented | ![Most restricted value](../images/check-gn.png) | +| Enabled or not configured
**(default)** | 1 | 1 | Allowed | | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow Microsoft Compatibility List +- **GP name:** AllowCVList +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowMicrosoftCompatibilityList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowmicrosoftcompatibilitylist) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowMicrosoftCompatibilityList +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\BrowserEmulation +- **Value name:** MSCompatibilityMode +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/allow-prelaunch-include.md b/browsers/edge/includes/allow-prelaunch-include.md index 7f1d10363c..1953faa630 100644 --- a/browsers/edge/includes/allow-prelaunch-include.md +++ b/browsers/edge/includes/allow-prelaunch-include.md @@ -1,44 +1,47 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Enabled or not configured (Allowed)* - -[!INCLUDE [allow-prelaunch-shortdesc](../shortdesc/allow-prelaunch-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Prevented |![Most restrictive value](../images/check-gn.png) | -|Enabled or not configured
**(default)** |1 |1 |Allowed | | ---- - - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed -- **GP name:** AllowPreLaunch -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowPrelaunch](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowPrelaunch -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\ -- **Value name:** AllowPrelaunch -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Enabled or not configured (Allowed)* + +[!INCLUDE [allow-prelaunch-shortdesc](../shortdesc/allow-prelaunch-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------------------------------------|:---:|:--------:|-------------|:-------------------------------------------------:| +| Disabled | 0 | 0 | Prevented | ![Most restrictive value](../images/check-gn.png) | +| Enabled or not configured
**(default)** | 1 | 1 | Allowed | | + +--- + + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed +- **GP name:** AllowPreLaunch +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowPrelaunch](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowPrelaunch +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main +- **Value name:** AllowPrelaunch +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/allow-printing-include.md b/browsers/edge/includes/allow-printing-include.md index c489b9ebdd..47055ba966 100644 --- a/browsers/edge/includes/allow-printing-include.md +++ b/browsers/edge/includes/allow-printing-include.md @@ -1,42 +1,45 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Enabled or not configured (Allowed)* - -[!INCLUDE [allow-printing-shortdesc](../shortdesc/allow-printing-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Prevented |![Most restrictive value](../images/check-gn.png) | -|Enabled or not configured
**(default)** |1 |1 |Allowed | | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow printing -- **GP name:** AllowPrinting -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowPrinting](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowprinting) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowPrinting -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main -- **Value name:** AllowPrinting -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Enabled or not configured (Allowed)* + +[!INCLUDE [allow-printing-shortdesc](../shortdesc/allow-printing-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------------------------------------|:---:|:--------:|-------------|:-------------------------------------------------:| +| Disabled | 0 | 0 | Prevented | ![Most restrictive value](../images/check-gn.png) | +| Enabled or not configured
**(default)** | 1 | 1 | Allowed | | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow printing +- **GP name:** AllowPrinting +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowPrinting](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowprinting) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowPrinting +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Value name:** AllowPrinting +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/allow-saving-history-include.md b/browsers/edge/includes/allow-saving-history-include.md index cc495aac9e..874d301abb 100644 --- a/browsers/edge/includes/allow-saving-history-include.md +++ b/browsers/edge/includes/allow-saving-history-include.md @@ -1,44 +1,47 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Enabled or not configured (Allowed)* - -[!INCLUDE [allow-saving-history-shortdesc](../shortdesc/allow-saving-history-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Prevented |![Most restricted value](../images/check-gn.png) | -|Enabled or not configured
**(default)** |1 |1 |Allowed | | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow Saving History -- **GP name:** AllowSavingHistory -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowSavingHistory](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSavingHistory -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main -- **Value name:** AllowSavingHistory -- **Value type:** REG_DWORD - - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Enabled or not configured (Allowed)* + +[!INCLUDE [allow-saving-history-shortdesc](../shortdesc/allow-saving-history-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------------------------------------|:---:|:--------:|-------------|:------------------------------------------------:| +| Disabled | 0 | 0 | Prevented | ![Most restricted value](../images/check-gn.png) | +| Enabled or not configured
**(default)** | 1 | 1 | Allowed | | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow Saving History +- **GP name:** AllowSavingHistory +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowSavingHistory](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSavingHistory +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Value name:** AllowSavingHistory +- **Value type:** REG_DWORD + + +
diff --git a/browsers/edge/includes/allow-search-engine-customization-include.md b/browsers/edge/includes/allow-search-engine-customization-include.md index cc3137fa52..eb4891088f 100644 --- a/browsers/edge/includes/allow-search-engine-customization-include.md +++ b/browsers/edge/includes/allow-search-engine-customization-include.md @@ -1,56 +1,59 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
->*Default setting: Enabled or not configured (Allowed)* - -[!INCLUDE [allow-search-engine-customization-shortdesc](../shortdesc/allow-search-engine-customization-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Prevented |![Most restricted value](../images/check-gn.png) | -|Enabled or not configured
**(default)** |1 |1 |Allowed | | ---- - -### ADMX info and settings - -##### ADMX info -- **GP English name:** Allow search engine customization -- **GP name:** AllowSearchEngineCustomization -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowSearchEngineCustomization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsearchenginecustomization) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchEngineCustomization -- **Data type:** Integer - - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Protected -- **Value name:** AllowSearchEngineCustomization -- **Value type:** REG_DWORD - - -### Related policies - -- [Set default search engine](../available-policies.md#set-default-search-engine): [!INCLUDE [set-default-search-engine-shortdesc](../shortdesc/set-default-search-engine-shortdesc.md)] - -- [Configure additional search engines](../available-policies.md#configure-additional-search-engines): [!INCLUDE [configure-additional-search-engines-shortdesc](../shortdesc/configure-additional-search-engines-shortdesc.md)] - -### Related topics - -- [!INCLUDE [man-connections-win-comp-services-shortdesc-include](man-connections-win-comp-services-shortdesc-include.md)] - -- [!INCLUDE [search-provider-discovery-shortdesc-include](search-provider-discovery-shortdesc-include.md)] - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
+>*Default setting: Enabled or not configured (Allowed)* + +[!INCLUDE [allow-search-engine-customization-shortdesc](../shortdesc/allow-search-engine-customization-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------------------------------------|:---:|:--------:|-------------|:------------------------------------------------:| +| Disabled | 0 | 0 | Prevented | ![Most restricted value](../images/check-gn.png) | +| Enabled or not configured
**(default)** | 1 | 1 | Allowed | | + +--- + +### ADMX info and settings + +##### ADMX info +- **GP English name:** Allow search engine customization +- **GP name:** AllowSearchEngineCustomization +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowSearchEngineCustomization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsearchenginecustomization) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchEngineCustomization +- **Data type:** Integer + + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Protected +- **Value name:** AllowSearchEngineCustomization +- **Value type:** REG_DWORD + + +### Related policies + +- [Set default search engine](../available-policies.md#set-default-search-engine): [!INCLUDE [set-default-search-engine-shortdesc](../shortdesc/set-default-search-engine-shortdesc.md)] + +- [Configure additional search engines](../available-policies.md#configure-additional-search-engines): [!INCLUDE [configure-additional-search-engines-shortdesc](../shortdesc/configure-additional-search-engines-shortdesc.md)] + +### Related topics + +- [!INCLUDE [man-connections-win-comp-services-shortdesc-include](man-connections-win-comp-services-shortdesc-include.md)] + +- [!INCLUDE [search-provider-discovery-shortdesc-include](search-provider-discovery-shortdesc-include.md)] + +
diff --git a/browsers/edge/includes/allow-shared-folder-books-include.md b/browsers/edge/includes/allow-shared-folder-books-include.md index d4b813968c..fadbac9ad5 100644 --- a/browsers/edge/includes/allow-shared-folder-books-include.md +++ b/browsers/edge/includes/allow-shared-folder-books-include.md @@ -1,49 +1,53 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1803*
->*Default setting: Disabled or not configured (Not allowed)* - -[!INCLUDE [allow-a-shared-books-folder-shortdesc](../shortdesc/allow-a-shared-books-folder-shortdesc.md)] - - - -### Supported values -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Prevented. Microsoft Edge downloads book files to a per-user folder for each user. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Allowed. Microsoft Edge downloads book files to a shared folder. For this policy to work correctly, you must also enable the **Allow a Windows app to share application data between users** group policy, which you can find:

**Computer Configuration\\Administrative Templates\\Windows Components\\App Package Deployment\\**

Also, the users must be signed in with a school or work account.| | ---- - -![Allow a shared books folder](../images/allow-shared-books-folder_sm.png) - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow a shared Books folder -- **GP name:** UseSharedFolderForBooks -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[UseSharedFolderForBooks](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-usesharedfolderforbooks) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/UseSharedFolderForBooks -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary -- **Value name:** UseSharedFolderForBooks -- **Value type:** REG_DWORD - -### Related policies - -**Allow a Windows app to share application data between users:** [!INCLUDE [allow-windows-app-to-share-data-users-shortdesc](../shortdesc/allow-windows-app-to-share-data-users-shortdesc.md)] - -

+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1803*
+>*Default setting: Disabled or not configured (Not allowed)* + +[!INCLUDE [allow-a-shared-books-folder-shortdesc](../shortdesc/allow-a-shared-books-folder-shortdesc.md)] + + + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Prevented. Microsoft Edge downloads book files to a per-user folder for each user. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Allowed. Microsoft Edge downloads book files to a shared folder. For this policy to work correctly, you must also enable the **Allow a Windows app to share application data between users** group policy, which you can find:

**Computer Configuration\\Administrative Templates\\Windows Components\\App Package Deployment\\**

Also, the users must be signed in with a school or work account. | | + +--- + +![Allow a shared books folder](../images/allow-shared-books-folder_sm.png) + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow a shared Books folder +- **GP name:** UseSharedFolderForBooks +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[UseSharedFolderForBooks](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-usesharedfolderforbooks) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/UseSharedFolderForBooks +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary +- **Value name:** UseSharedFolderForBooks +- **Value type:** REG_DWORD + +### Related policies + +**Allow a Windows app to share application data between users:** [!INCLUDE [allow-windows-app-to-share-data-users-shortdesc](../shortdesc/allow-windows-app-to-share-data-users-shortdesc.md)] + +

diff --git a/browsers/edge/includes/allow-sideloading-extensions-include.md b/browsers/edge/includes/allow-sideloading-extensions-include.md index b0575c853b..987387dbe6 100644 --- a/browsers/edge/includes/allow-sideloading-extensions-include.md +++ b/browsers/edge/includes/allow-sideloading-extensions-include.md @@ -1,52 +1,55 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Enabled (Allowed)* - -[!INCLUDE [allow-sideloading-of-extensions-shortdesc](../shortdesc/allow-sideloading-of-extensions-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured |0 |0 |Prevented. Disabling does not prevent sideloading of extensions using Add-AppxPackage via PowerShell. To prevent this, you must enable the **Allows development of Windows Store apps and installing them from an integrated development environment (IDE)** group policy, which you can find:

**Computer Configuration\\Administrative Templates\\Windows Components\\App Package Deployment\\**

For the MDM setting, set the **ApplicationManagement/AllowDeveloperUnlock** policy to 1 (enabled). |![Most restricted value](../images/check-gn.png) | -|Enabled
**(default)** |1 |1 |Allowed. | | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow sideloading of Extensions -- **GP name:** AllowSideloadingOfExtensions -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowSideloadingExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSideloadingExtensions -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Extensions -- **Value name:** AllowSideloadingOfExtensions -- **Value type:** REG_DWORD - -### Related policies - -- [Allows development of Windows Store apps and installing them from an integrated development environment (IDE)](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock): When you enable this policy and the **Allow all trusted apps to install** policy, you allow users to develop Windows Store apps and install them directly from an IDE. - -- [Allow all trusted apps to install](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowalltrustedapps): When you enable this policy, you can manage the installation of trusted line-of-business (LOB) or developer-signed Windows Store apps. - -### Related topics - -[Enable your device for development](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development): Access development features, along with other developer-focused settings to make it possible for you to develop, test, and debug apps. Learn how to configure your environment for development, the difference between Developer Mode and sideloading, and the security risks of Developer mode. - -

\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Enabled (Allowed)* + +[!INCLUDE [allow-sideloading-of-extensions-shortdesc](../shortdesc/allow-sideloading-of-extensions-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|----------------------------|:---:|:--------:|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured | 0 | 0 | Prevented. Disabling does not prevent sideloading of extensions using Add-AppxPackage via PowerShell. To prevent this, you must enable the **Allows development of Windows Store apps and installing them from an integrated development environment (IDE)** group policy, which you can find:

**Computer Configuration\\Administrative Templates\\Windows Components\\App Package Deployment\\**

For the MDM setting, set the **ApplicationManagement/AllowDeveloperUnlock** policy to 1 (enabled). | ![Most restricted value](../images/check-gn.png) | +| Enabled
**(default)** | 1 | 1 | Allowed. | | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow sideloading of Extensions +- **GP name:** AllowSideloadingOfExtensions +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowSideloadingExtensions](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSideloadingExtensions +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Extensions +- **Value name:** AllowSideloadingOfExtensions +- **Value type:** REG_DWORD + +### Related policies + +- [Allows development of Windows Store apps and installing them from an integrated development environment (IDE)](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowdeveloperunlock): When you enable this policy and the **Allow all trusted apps to install** policy, you allow users to develop Windows Store apps and install them directly from an IDE. + +- [Allow all trusted apps to install](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowalltrustedapps): When you enable this policy, you can manage the installation of trusted line-of-business (LOB) or developer-signed Windows Store apps. + +### Related topics + +[Enable your device for development](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development): Access development features, along with other developer-focused settings to make it possible for you to develop, test, and debug apps. Learn how to configure your environment for development, the difference between Developer Mode and sideloading, and the security risks of Developer mode. + +

diff --git a/browsers/edge/includes/allow-tab-preloading-include.md b/browsers/edge/includes/allow-tab-preloading-include.md index c62d262521..2083558b86 100644 --- a/browsers/edge/includes/allow-tab-preloading-include.md +++ b/browsers/edge/includes/allow-tab-preloading-include.md @@ -1,42 +1,46 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1802*
->*Default setting: Enabled or not configured (Allowed)* - -[!INCLUDE [allow-tab-preloading-shortdesc](../shortdesc/allow-tab-preloading-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Prevented. |![Most restricted value](../images/check-gn.png) | -|Enabled or not configured
**(default)** |1 |1 |Allowed. Preload Start and New Tab pages. | | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow Microsoft Edge to load the Start and New Tab pages in the background at Windows startup and each time Microsoft Edge is closed -- **GP name:** AllowTabPreloading -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowTabPreloading](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowTabPreloading -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\TabPreloader -- **Value name:** AllowTabPreloading -- **Value type:** REG_DWORD - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1802*
+>*Default setting: Enabled or not configured (Allowed)* + +[!INCLUDE [allow-tab-preloading-shortdesc](../shortdesc/allow-tab-preloading-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------------------------------------|:---:|:--------:|-------------------------------------------|:------------------------------------------------:| +| Disabled | 0 | 0 | Prevented. | ![Most restricted value](../images/check-gn.png) | +| Enabled or not configured
**(default)** | 1 | 1 | Allowed. Preload Start and New Tab pages. | | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow Microsoft Edge to load the Start and New Tab pages in the background at Windows startup and each time Microsoft Edge is closed +- **GP name:** AllowTabPreloading +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowTabPreloading](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowTabPreloading +- **Data type:** Integer + +#### Registry settings +- **Path:** HKCU\SOFTWARE\Policies\Microsoft\MicrosoftEdge\TabPreloader +- **Create Value name:** AllowTabPreloading +- **Value type:** REG_DWORD +- **DWORD Value:** 1 + +
diff --git a/browsers/edge/includes/allow-web-content-new-tab-page-include.md b/browsers/edge/includes/allow-web-content-new-tab-page-include.md index cdd5bb2adc..88e91371ac 100644 --- a/browsers/edge/includes/allow-web-content-new-tab-page-include.md +++ b/browsers/edge/includes/allow-web-content-new-tab-page-include.md @@ -1,47 +1,50 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 11/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Enabled (the default New Tab page loads)* - - -[!INCLUDE [allow-web-content-on-new-tab-page-shortdesc](../shortdesc/allow-web-content-on-new-tab-page-shortdesc.md)] - - -### Supported values - -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Disabled |0 |0 |Load a blank page instead of the default New Tab page and prevent users from making changes. | -|Enabled or not configured **(default)** |1 |1 |Load the default New Tab page and the users make changes. | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Allow web content on New Tab page -- **GP name:** AllowWebContentOnNewTabPage -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowWebContentOnNewTabPage](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowWebContentOnNewTabPage -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI -- **Value name:** AllowWebContentOnNewTabPage -- **Value type:** REG_DWORD - -### Related policies -[Set New Tab page URL](../available-policies.md#set-new-tab-page-url): [!INCLUDE [set-new-tab-url-shortdesc](../shortdesc/set-new-tab-url-shortdesc.md)] - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 11/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Enabled (the default New Tab page loads)* + + +[!INCLUDE [allow-web-content-on-new-tab-page-shortdesc](../shortdesc/allow-web-content-on-new-tab-page-shortdesc.md)] + + +### Supported values + +| Group Policy | MDM | Registry | Description | +|-----------------------------------------|:---:|:--------:|----------------------------------------------------------------------------------------------| +| Disabled | 0 | 0 | Load a blank page instead of the default New Tab page and prevent users from making changes. | +| Enabled or not configured **(default)** | 1 | 1 | Load the default New Tab page and the users make changes. | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Allow web content on New Tab page +- **GP name:** AllowWebContentOnNewTabPage +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowWebContentOnNewTabPage](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowWebContentOnNewTabPage +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI +- **Value name:** AllowWebContentOnNewTabPage +- **Value type:** REG_DWORD + +### Related policies +[Set New Tab page URL](../available-policies.md#set-new-tab-page-url): [!INCLUDE [set-new-tab-url-shortdesc](../shortdesc/set-new-tab-url-shortdesc.md)] + +
diff --git a/browsers/edge/includes/always-enable-book-library-include.md b/browsers/edge/includes/always-enable-book-library-include.md index 16ee156803..7cb4f04653 100644 --- a/browsers/edge/includes/always-enable-book-library-include.md +++ b/browsers/edge/includes/always-enable-book-library-include.md @@ -1,43 +1,46 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1709 or later*
->*Default setting: Disabled or not configured* - - -[!INCLUDE [always-show-books-library-shortdesc](../shortdesc/always-show-books-library-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Show the Books Library only in countries or regions where supported. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Show the Books Library, regardless of the device’s country or region. | | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Always show the Books Library in Microsoft Edge -- **GP name:** AlwaysEnableBooksLibrary -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AlwaysEnableBooksLibrary](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AlwaysEnableBooksLibrary -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main -- **Value name:** AlwaysEnableBooksLibrary -- **Value type:** REG_DWORD - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1709 or later*
+>*Default setting: Disabled or not configured* + + +[!INCLUDE [always-show-books-library-shortdesc](../shortdesc/always-show-books-library-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|-----------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Show the Books Library only in countries or regions where supported. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Show the Books Library, regardless of the device’s country or region. | | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Always show the Books Library in Microsoft Edge +- **GP name:** AlwaysEnableBooksLibrary +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AlwaysEnableBooksLibrary](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AlwaysEnableBooksLibrary +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Value name:** AlwaysEnableBooksLibrary +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/configure-additional-search-engines-include.md b/browsers/edge/includes/configure-additional-search-engines-include.md index cd5341cd46..e1ff2e9999 100644 --- a/browsers/edge/includes/configure-additional-search-engines-include.md +++ b/browsers/edge/includes/configure-additional-search-engines-include.md @@ -1,55 +1,58 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
->*Default setting: Disabled or not configured (Prevented)* - -[!INCLUDE [configure-additional-search-engines-shortdesc](../shortdesc/configure-additional-search-engines-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Prevented. Use the search engine specified in App settings.

If you enabled this policy and now want to disable it, all previously configured search engines get removed. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Allowed. Add up to five additional search engines and set any one of them as the default.

For each search engine added you must specify a link to the OpenSearch XML file that contains, at a minimum, the short name and URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/dev-guide/browser/search-provider-discovery/). | | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure additional search engines -- **GP name:** ConfigureAdditionalSearchEngines -- **GP element:** ConfigureAdditionalSearchEngines_Prompt -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ConfigureAdditionalSearchEngines](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configureadditionalsearchengines) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureAdditionalSearchEngines -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\OpenSearch -- **Value name:** ConfigureAdditionalSearchEngines -- **Value type:** REG_SZ - -### Related policies - -- [Set default search engine](../available-policies.md\#set-default-search-engine): [!INCLUDE [set-default-search-engine-shortdesc](../shortdesc/set-default-search-engine-shortdesc.md)] - -- [Allow search engine customization](../available-policies.md#allow-search-engine-customization): [!INCLUDE [allow-search-engine-customization-shortdesc](../shortdesc/allow-search-engine-customization-shortdesc.md)] - - -### Related topics - -- [!INCLUDE [microsoft-browser-extension-policy-shortdesc](../shortdesc/microsoft-browser-extension-policy-shortdesc.md)] - -- [Search provider discovery](https://docs.microsoft.com/microsoft-edge/dev-guide/browser/search-provider-discovery): Rich search integration is built into the Microsoft Edge address bar, including search suggestions, results from the web, your browsing history, and favorites. - -

\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
+>*Default setting: Disabled or not configured (Prevented)* + +[!INCLUDE [configure-additional-search-engines-shortdesc](../shortdesc/configure-additional-search-engines-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Prevented. Use the search engine specified in App settings.

If you enabled this policy and now want to disable it, all previously configured search engines get removed. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Allowed. Add up to five additional search engines and set any one of them as the default.

For each search engine added you must specify a link to the OpenSearch XML file that contains, at a minimum, the short name and URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/dev-guide/browser/search-provider-discovery/). | | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure additional search engines +- **GP name:** ConfigureAdditionalSearchEngines +- **GP element:** ConfigureAdditionalSearchEngines_Prompt +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ConfigureAdditionalSearchEngines](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configureadditionalsearchengines) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureAdditionalSearchEngines +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\OpenSearch +- **Value name:** ConfigureAdditionalSearchEngines +- **Value type:** REG_SZ + +### Related policies + +- [Set default search engine](../available-policies.md\#set-default-search-engine): [!INCLUDE [set-default-search-engine-shortdesc](../shortdesc/set-default-search-engine-shortdesc.md)] + +- [Allow search engine customization](../available-policies.md#allow-search-engine-customization): [!INCLUDE [allow-search-engine-customization-shortdesc](../shortdesc/allow-search-engine-customization-shortdesc.md)] + + +### Related topics + +- [!INCLUDE [microsoft-browser-extension-policy-shortdesc](../shortdesc/microsoft-browser-extension-policy-shortdesc.md)] + +- [Search provider discovery](https://docs.microsoft.com/microsoft-edge/dev-guide/browser/search-provider-discovery): Rich search integration is built into the Microsoft Edge address bar, including search suggestions, results from the web, your browsing history, and favorites. + +

diff --git a/browsers/edge/includes/configure-adobe-flash-click-to-run-include.md b/browsers/edge/includes/configure-adobe-flash-click-to-run-include.md index 3011317313..852be617a5 100644 --- a/browsers/edge/includes/configure-adobe-flash-click-to-run-include.md +++ b/browsers/edge/includes/configure-adobe-flash-click-to-run-include.md @@ -1,42 +1,45 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
->*Default setting: Enabled or not configured (Does not load content automatically)* - -[!INCLUDE [configure-adobe-flash-click-to-run-setting-shortdesc](../shortdesc/configure-adobe-flash-click-to-run-setting-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled |0 |0 |Load and run Adobe Flash content automatically. | | -|Enabled or not configured
**(default)** |1 |1 |Do not load or run Adobe Flash content and require action from the user. |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings - -#### ADMX info -- **GP English name:** Configure the Adobe Flash Click-to-Run setting -- **GP name:** AllowFlashClickToRun -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowFlashClickToRun](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowflashclicktorun) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowFlashClickToRun -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Security -- **Value name:** FlashClickToRunMode -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
+>*Default setting: Enabled or not configured (Does not load content automatically)* + +[!INCLUDE [configure-adobe-flash-click-to-run-setting-shortdesc](../shortdesc/configure-adobe-flash-click-to-run-setting-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------------------------------------|:---:|:--------:|--------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled | 0 | 0 | Load and run Adobe Flash content automatically. | | +| Enabled or not configured
**(default)** | 1 | 1 | Do not load or run Adobe Flash content and require action from the user. | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings + +#### ADMX info +- **GP English name:** Configure the Adobe Flash Click-to-Run setting +- **GP name:** AllowFlashClickToRun +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowFlashClickToRun](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowflashclicktorun) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowFlashClickToRun +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Security +- **Value name:** FlashClickToRunMode +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/configure-autofill-include.md b/browsers/edge/includes/configure-autofill-include.md index bd717cc583..1ef991e263 100644 --- a/browsers/edge/includes/configure-autofill-include.md +++ b/browsers/edge/includes/configure-autofill-include.md @@ -1,42 +1,45 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Not configured (Blank)* - -[!INCLUDE [configure-autofill-shortdesc](../shortdesc/configure-autofill-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Not configured
**(default)** | Blank |Blank |Users can choose to use Autofill. | | -|Disabled | 0 | no | Prevented. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |yes | Allowed. | | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Autofill -- **GP name:** AllowAutofill -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowAutofill](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser\#browser-allowautofill) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowAutofill -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main -- **Value name:** Use FormSuggest -- **Value type:** REG_SZ - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Not configured (Blank)* + +[!INCLUDE [configure-autofill-shortdesc](../shortdesc/configure-autofill-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------|:-----:|:--------:|-----------------------------------|:------------------------------------------------:| +| Not configured
**(default)** | Blank | Blank | Users can choose to use Autofill. | | +| Disabled | 0 | no | Prevented. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | yes | Allowed. | | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Autofill +- **GP name:** AllowAutofill +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowAutofill](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser\#browser-allowautofill) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowAutofill +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Value name:** Use FormSuggest +- **Value type:** REG_SZ + +
diff --git a/browsers/edge/includes/configure-browser-telemetry-for-m365-analytics-include.md b/browsers/edge/includes/configure-browser-telemetry-for-m365-analytics-include.md index f4c4360129..1525399652 100644 --- a/browsers/edge/includes/configure-browser-telemetry-for-m365-analytics-include.md +++ b/browsers/edge/includes/configure-browser-telemetry-for-m365-analytics-include.md @@ -1,62 +1,65 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Disabled or not configured (No data collected or sent)* - -[!INCLUDE [configure-browser-telemetry-for-m365-analytics-shortdesc](../shortdesc/configure-browser-telemetry-for-m365-analytics-shortdesc.md)] - - ->[!IMPORTANT] ->For this policy to work, enable the **Allow Telemetry** group policy with the _Enhanced_ option and enable the **Configure the Commercial ID** group policy by providing the Commercial ID. -> ->You can find these policies in the following location of the Group Policy Editor: -> ->**Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection and Preview Builds\\** -> - - -### Supported values - - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |No data collected or sent |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Send intranet history only | | -|Enabled |2 |2 |Send Internet history only | | -|Enabled |3 |3 |Send both intranet and Internet history | | ---- - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure collection of browsing data for Microsoft 365 Analytics -- **GP name:** ConfigureTelemetryForMicrosoft365Analytics -- **GP element:** ZonesListBox -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - - -#### MDM settings -- **MDM name:** Browser/[ConfigureTelemetryForMicrosoft365Analytics](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureTelemetryForMicrosoft365Analytics -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection -- **Value name:** MicrosoftEdgeDataOptIn -- **Value type:** REG_DWORD - -### Related policies -- Allow Telemetry: Allows Microsoft to run diagnostics on the device and troubleshoot. The default setting for Allow Telemetry is set to _Enhanced_ (2 for MDM). - -- Configure the Commercial ID: Define the Commercial ID used to associate the device's telemetry data as belonging to a given organization. - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Disabled or not configured (No data collected or sent)* + +[!INCLUDE [configure-browser-telemetry-for-m365-analytics-shortdesc](../shortdesc/configure-browser-telemetry-for-m365-analytics-shortdesc.md)] + + +> [!IMPORTANT] +> For this policy to work, enable the **Allow Telemetry** group policy with the _Enhanced_ option and enable the **Configure the Commercial ID** group policy by providing the Commercial ID. +> +> You can find these policies in the following location of the Group Policy Editor: +> +> **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection and Preview Builds\\** +> + + +### Supported values + + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|-----------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | No data collected or sent | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Send intranet history only | | +| Enabled | 2 | 2 | Send Internet history only | | +| Enabled | 3 | 3 | Send both intranet and Internet history | | + +--- + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure collection of browsing data for Microsoft 365 Analytics +- **GP name:** ConfigureTelemetryForMicrosoft365Analytics +- **GP element:** ZonesListBox +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + + +#### MDM settings +- **MDM name:** Browser/[ConfigureTelemetryForMicrosoft365Analytics](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureTelemetryForMicrosoft365Analytics +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection +- **Value name:** MicrosoftEdgeDataOptIn +- **Value type:** REG_DWORD + +### Related policies +- Allow Telemetry: Allows Microsoft to run diagnostics on the device and troubleshoot. The default setting for Allow Telemetry is set to _Enhanced_ (2 for MDM). + +- Configure the Commercial ID: Define the Commercial ID used to associate the device's telemetry data as belonging to a given organization. + +
diff --git a/browsers/edge/includes/configure-cookies-include.md b/browsers/edge/includes/configure-cookies-include.md index 5ef992f09e..36922a6177 100644 --- a/browsers/edge/includes/configure-cookies-include.md +++ b/browsers/edge/includes/configure-cookies-include.md @@ -1,43 +1,46 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Disabled or not configured (Allow all cookies from all sites)* - -[!INCLUDE [configure-cookies-shortdesc](../shortdesc/configure-cookies-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Enabled |0 |0 |Block all cookies from all sites. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Block only coddies from third party websites. | | -|Disabled or not configured
**(default)** |2 |2 |Allow all cookies from all sites. | | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure cookies -- **GP name:** Cookies -- **GP element:** CookiesListBox -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowCookies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser\#browser-allowcookies) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowCookies -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main -- **Value name:** Cookies -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Disabled or not configured (Allow all cookies from all sites)* + +[!INCLUDE [configure-cookies-shortdesc](../shortdesc/configure-cookies-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|-----------------------------------------------|:------------------------------------------------:| +| Enabled | 0 | 0 | Block all cookies from all sites. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Block only cookies from third party websites. | | +| Disabled or not configured
**(default)** | 2 | 2 | Allow all cookies from all sites. | | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure cookies +- **GP name:** Cookies +- **GP element:** CookiesListBox +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowCookies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser\#browser-allowcookies) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowCookies +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Value name:** Cookies +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/configure-do-not-track-include.md b/browsers/edge/includes/configure-do-not-track-include.md index 4e77fdadf8..f4868357b9 100644 --- a/browsers/edge/includes/configure-do-not-track-include.md +++ b/browsers/edge/includes/configure-do-not-track-include.md @@ -1,42 +1,45 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Not configured (Do not send tracking information)* - -[!INCLUDE [configure-do-not-track-shortdesc](../shortdesc/configure-do-not-track-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Not configured
**(default)** |Blank |Blank |Do not send tracking information but let users choose to send tracking information to sites they visit. | | -|Disabled |0 |0 |Never send tracking information. | | -|Enabled |1 |1 |Send tracking information. |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Do Not Track -- **GP name:** AllowDoNotTrack -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowDoNotTrack](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowdonottrack) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowDoNotTrack -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main -- **Value name:** DoNotTrack -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Not configured (Do not send tracking information)* + +[!INCLUDE [configure-do-not-track-shortdesc](../shortdesc/configure-do-not-track-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------|:-----:|:--------:|---------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Not configured
**(default)** | Blank | Blank | Do not send tracking information but let users choose to send tracking information to sites they visit. | | +| Disabled | 0 | 0 | Never send tracking information. | | +| Enabled | 1 | 1 | Send tracking information. | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Do Not Track +- **GP name:** AllowDoNotTrack +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowDoNotTrack](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowdonottrack) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowDoNotTrack +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Value name:** DoNotTrack +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/configure-edge-kiosk-reset-idle-timeout-include.md b/browsers/edge/includes/configure-edge-kiosk-reset-idle-timeout-include.md index 2fa8b095e5..ccdd275e01 100644 --- a/browsers/edge/includes/configure-edge-kiosk-reset-idle-timeout-include.md +++ b/browsers/edge/includes/configure-edge-kiosk-reset-idle-timeout-include.md @@ -1,54 +1,56 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: 5 minutes* - -[!INCLUDE [configure-kiosk-reset-after-idle-timeout-shortdesc](../shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md)] - -You must set the Configure kiosk mode policy to enabled (1 - InPrivate public browsing) and configure Microsoft Edge as a single-app in assigned access for this policy to take effect; otherwise, Microsoft Edge ignores this setting. To learn more about assigned access and kiosk configuration, see [Configure kiosk and shared devices running Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-shared-pc). - -### Supported values - -- **Any integer from 1-1440 (5 minutes is the default)** – The time in minutes from the last user activity before Microsoft Edge kiosk mode resets to the default kiosk configuration. A confirmation dialog displays for the user to cancel or continue and automatically continues after 30 seconds. - -- **0** – No idle timer. - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure kiosk reset after idle timeout -- **GP name:** ConfigureKioskResetAfterIdleTimeout -- **GP element:** ConfigureKioskResetAfterIdleTimeout_TextBox -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ConfigureKioskResetAfterIdleTimeout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskResetAfterIdleTimeout -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\KioskMode -- **Value name:**ConfigureKioskResetAfterIdleTimeout -- **Value type:** REG_DWORD - - - -### Related policies - -[Configure kiosk mode](../available-policies.md#configure-kiosk-mode): [!INCLUDE [configure-kiosk-mode-shortdesc](../shortdesc/configure-kiosk-mode-shortdesc.md)] - - - -### Related topics -[Deploy Microsoft Edge kiosk mode](../microsoft-edge-kiosk-mode-deploy.md): Microsoft Edge kiosk mode works with assigned access to allow IT administrators, to create a tailored browsing experience designed for kiosk devices. In this deployment guidance, you learn about the different Microsoft Edge kiosk mode types to help you determine what configuration is best suited for your kiosk device. You also learn about the other group policies to help you enhance the how to set up your Microsoft Edge kiosk mode experience. - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: 5 minutes* + +[!INCLUDE [configure-kiosk-reset-after-idle-timeout-shortdesc](../shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md)] + +You must set the Configure kiosk mode policy to enabled (1 - InPrivate public browsing) and configure Microsoft Edge as a single-app in assigned access for this policy to take effect; otherwise, Microsoft Edge ignores this setting. To learn more about assigned access and kiosk configuration, see [Configure kiosk and shared devices running Windows desktop editions](https://docs.microsoft.com/windows/configuration/kiosk-shared-pc). + +### Supported values + +- **Any integer from 1-1440 (5 minutes is the default)** – The time in minutes from the last user activity before Microsoft Edge kiosk mode resets to the default kiosk configuration. A confirmation dialog displays for the user to cancel or continue and automatically continues after 30 seconds. + +- **0** – No idle timer. + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure kiosk reset after idle timeout +- **GP name:** ConfigureKioskResetAfterIdleTimeout +- **GP element:** ConfigureKioskResetAfterIdleTimeout_TextBox +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ConfigureKioskResetAfterIdleTimeout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskResetAfterIdleTimeout +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\KioskMode +- Value name:ConfigureKioskResetAfterIdleTimeout +- **Value type:** REG_DWORD + + + +### Related policies + +[Configure kiosk mode](../available-policies.md#configure-kiosk-mode): [!INCLUDE [configure-kiosk-mode-shortdesc](../shortdesc/configure-kiosk-mode-shortdesc.md)] + + + +### Related topics +[Deploy Microsoft Edge kiosk mode](../microsoft-edge-kiosk-mode-deploy.md): Microsoft Edge kiosk mode works with assigned access to allow IT administrators, to create a tailored browsing experience designed for kiosk devices. In this deployment guidance, you learn about the different Microsoft Edge kiosk mode types to help you determine what configuration is best suited for your kiosk device. You also learn about the other group policies to help you enhance the how to set up your Microsoft Edge kiosk mode experience. + +
diff --git a/browsers/edge/includes/configure-enterprise-mode-site-list-include.md b/browsers/edge/includes/configure-enterprise-mode-site-list-include.md index aeb849adf4..0c02984f58 100644 --- a/browsers/edge/includes/configure-enterprise-mode-site-list-include.md +++ b/browsers/edge/includes/configure-enterprise-mode-site-list-include.md @@ -9,10 +9,11 @@ ### Supported values -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Disabled or not configured
**(default)** |0 |0 |Turned off. Microsoft Edge does not check the Enterprise Mode Site List, and in this case, users might experience problems while using legacy apps. | -|Enabled |1 |1 |Turned on. Microsoft Edge checks the Enterprise Mode Site List if configured. If an XML file exists in the cache container, IE11 waits 65 seconds and then checks the local cache for a new version from the server. If the server has a different version, Microsoft Edge uses the server file and stores it in the cache container. If you already use a site list, Enterprise Mode continues to work during the 65 seconds, but uses the existing file. To add the location to your site list, enter it in the **{URI}** box.

For details on how to configure the Enterprise Mode Site List, see [Interoperability and enterprise guidance](../group-policies/interoperability-enterprise-guidance-gp.md). | +| Group Policy | MDM | Registry | Description | +|---------------------------------------------|:---:|:--------:|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Disabled or not configured
**(default)** | 0 | 0 | Turned off. Microsoft Edge does not check the Enterprise Mode Site List, and in this case, users might experience problems while using legacy apps. | +| Enabled | 1 | 1 | Turned on. Microsoft Edge checks the Enterprise Mode Site List if configured. If an XML file exists in the cache container, IE11 waits 65 seconds and then checks the local cache for a new version from the server. If the server has a different version, Microsoft Edge uses the server file and stores it in the cache container. If you already use a site list, Enterprise Mode continues to work during the 65 seconds, but uses the existing file. To add the location to your site list, enter it in the **{URI}** box.

For details on how to configure the Enterprise Mode Site List, see [Interoperability and enterprise guidance](../group-policies/interoperability-enterprise-guidance-gp.md). | + --- ### ADMX info and settings @@ -29,7 +30,7 @@ - **Supported devices:** Desktop and Mobile - **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/EnterpriseModeSiteList - **Data type:** String - + #### Registry settings - **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main\EnterpriseMode - **Value name:** SiteList @@ -37,8 +38,9 @@ ### Related Policies -[Show message opening sites in IE](../available-policies.md#show-message-when-opening-sites-in-internet-explorer): [!INCLUDE -[show-message-when-opening-sites-in-ie-shortdesc](../shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] +[Show message opening sites in IE](../available-policies.md#show-message-when-opening-sites-in-internet-explorer) + +[!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](../shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] ### Related topics @@ -54,4 +56,4 @@ -

\ No newline at end of file +
diff --git a/browsers/edge/includes/configure-favorites-bar-include.md b/browsers/edge/includes/configure-favorites-bar-include.md index a5350ca9aa..e4e4ae2cb6 100644 --- a/browsers/edge/includes/configure-favorites-bar-include.md +++ b/browsers/edge/includes/configure-favorites-bar-include.md @@ -1,46 +1,48 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Not configured (Hidden but shown on the Start and New Tab pages)* - - -[!INCLUDE [allow-favorites-bar-shortdesc](../shortdesc/configure-favorites-bar-shortdesc.md)] - - -### Supported values - - -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Not configured **(default)** |Blank |Blank |Hidden but shown on the Start and New Tab pages.

Favorites Bar toggle (in Settings) = **Off** and enabled letting users make changes. | -|Disabled |0 |0 |Hidden on all pages.

| -|Enabled |1 |1 |Shown on all pages. | - ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Favorites Bar -- **GP name:** ConfigureFavoritesBar -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ConfigureFavoritesBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureFavoritesBar -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main -- **Value name:** ConfigureFavoritesBar -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Not configured (Hidden but shown on the Start and New Tab pages)* + + +[!INCLUDE [allow-favorites-bar-shortdesc](../shortdesc/configure-favorites-bar-shortdesc.md)] + + +### Supported values + + +|Group Policy |MDM |Registry |Description | +|---|:---:|:---:|---| +|Not configured **(default)** |Blank |Blank |Hidden but shown on the Start and New Tab pages.

Favorites Bar toggle (in Settings) = **Off** and enabled letting users make changes. | +|Disabled |0 |0 |Hidden on all pages.

| +|Enabled |1 |1 |Shown on all pages. | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Favorites Bar +- **GP name:** ConfigureFavoritesBar +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ConfigureFavoritesBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureFavoritesBar +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main +- **Value name:** ConfigureFavoritesBar +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/configure-favorites-include.md b/browsers/edge/includes/configure-favorites-include.md index 5287150eea..500c9acc12 100644 --- a/browsers/edge/includes/configure-favorites-include.md +++ b/browsers/edge/includes/configure-favorites-include.md @@ -1,12 +1,14 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->Discontinued in the Windows 10 October 2018 Update. Use the **[Provision Favorites](../available-policies.md#provision-favorites)** group policy instead. - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>Discontinued in the Windows 10 October 2018 Update. Use the **[Provision Favorites](../available-policies.md#provision-favorites)** group policy instead. + +
diff --git a/browsers/edge/includes/configure-home-button-include.md b/browsers/edge/includes/configure-home-button-include.md index eaaa4f7af4..3082d3014b 100644 --- a/browsers/edge/includes/configure-home-button-include.md +++ b/browsers/edge/includes/configure-home-button-include.md @@ -1,58 +1,61 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/28/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Disabled or not configured (Show home button and load the Start page)* - - -[!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] - - -### Supported values - -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Disabled or not configured
**(default)** |0 |0 |Load the Start page. | -|Enabled |1 |1 |Load the New Tab page. | -|Enabled |2 |2 |Load the custom URL defined in the Set Home Button URL policy. | -|Enabled |3 |3 |Hide the home button. | ---- - - ->[!TIP] ->If you want to make changes to this policy:
  1. Enable the **Unlock Home Button** policy.
  2. Make changes to the **Configure Home Button** policy or **Set Home Button URL** policy.
  3. Disable the **Unlock Home Button** policy.
- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Home Button -- **GP name:** ConfigureHomeButton -- **GP element:** ConfigureHomeButtonDropdown -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings -- **Value name:** ConfigureHomeButton -- **Value type:** REG_DWORD - -### Related policies - -- [Set Home Button URL](../available-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] - -- [Unlock Home Button](../available-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] - - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/28/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Disabled or not configured (Show home button and load the Start page)* + + +[!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] + + +### Supported values + +| Group Policy | MDM | Registry | Description | +|---------------------------------------------|:---:|:--------:|----------------------------------------------------------------| +| Disabled or not configured
**(default)** | 0 | 0 | Load the Start page. | +| Enabled | 1 | 1 | Load the New Tab page. | +| Enabled | 2 | 2 | Load the custom URL defined in the Set Home Button URL policy. | +| Enabled | 3 | 3 | Hide the home button. | + +--- + + +>[!TIP] +>If you want to make changes to this policy:
  1. Enable the **Unlock Home Button** policy.
  2. Make changes to the **Configure Home Button** policy or **Set Home Button URL** policy.
  3. Disable the **Unlock Home Button** policy.
+ + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Home Button +- **GP name:** ConfigureHomeButton +- **GP element:** ConfigureHomeButtonDropdown +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Value name:** ConfigureHomeButton +- **Value type:** REG_DWORD + +### Related policies + +- [Set Home Button URL](../available-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] + +- [Unlock Home Button](../available-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] + + +
diff --git a/browsers/edge/includes/configure-kiosk-mode-supported-values-include.md b/browsers/edge/includes/configure-kiosk-mode-supported-values-include.md index 98e3d163d0..bda51bb3e5 100644 --- a/browsers/edge/includes/configure-kiosk-mode-supported-values-include.md +++ b/browsers/edge/includes/configure-kiosk-mode-supported-values-include.md @@ -1,13 +1,16 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/27/2018 -ms.prod: edge -ms:topic: include ---- - -| | | -|---|---| -| **Single-app**

![thumbnail](../images/Picture1-sm.png)

**Digital/interactive signage**

Displays a specific site in full-screen mode, running Microsoft Edge InPrivate protecting user data.

**Policy setting** = Not configured (0 default)

|

 

![thumbnail](../images/Picture2-sm.png)

**Public browsing**

Runs a limited multi-tab version of Microsoft Edge, protecting user data. Microsoft Edge is the only app users can use on the device, preventing them from customizing Microsoft Edge. Users can only browse publically or end their browsing session.

The single-app public browsing mode is the only kiosk mode that has an **End session** button. Microsoft Edge also resets the session after a specified time of user inactivity. Both restart Microsoft Edge and clear the user’s session.

_**Example.**_ A public library or hotel concierge desk are two examples of public browsing that provides access to Microsoft Edge and other apps.

**Policy setting** = Enabled (1) | -| **Multi-app**

![thumbnail](../images/Picture5-sm.png)

**Normal browsing**

Runs a full-version of Microsoft Edge with all browsing features and preserves the user data and state between sessions.

Some features may not work depending on what other apps you have configured in assigned access. For example, installing extensions or books from the Microsoft store are not allowed if the store is not available. Also, if Internet Explorer 11 is set up in assigned access, you can enable [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) to automatically switch users to Internet Explorer 11 for sites that need backward compatibility support.

**Policy setting** = Not configured (0 default) |

 

![thumbnail](../images/Picture6-sm.png)

**Public browsing**

Runs a multi-tab version of Microsoft Edge InPrivate with a tailored experience for kiosks that runs in full-screen mode. Users can open and close Microsoft Edge and launch other apps if allowed by assigned access. Instead of an End session button to clear their browsing session, the user closes Microsoft Edge normally.

In this configuration, Microsoft Edge can interact with other applications. For example, if Internet Explorer 11 is set up in multi-app assigned access, you can enable [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) to automatically switch users to Internet Explorer 11 for sites that need backward compatibility support.

_**Example.**_ A public library or hotel concierge desk are two examples of public browsing that provides access to Microsoft Edge and other apps.

**Policy setting** = Enabled (1) | ---- \ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +| | | +|----------|------| +|**Single-app**

![thumbnail](../images/Picture1-sm.png)

**Digital/interactive signage**

Displays a specific site in full-screen mode, running Microsoft Edge InPrivate protecting user data.

**Policy setting** = Not configured (0 default)

|

 

![thumbnail](../images/Picture2-sm.png)

Public browsing

Runs a limited multi-tab version of Microsoft Edge, protecting user data. Microsoft Edge is the only app users can use on the device, preventing them from customizing Microsoft Edge. Users can only browse publically or end their browsing session.

The single-app public browsing mode is the only kiosk mode that has an End session button. Microsoft Edge also resets the session after a specified time of user inactivity. Both restart Microsoft Edge and clear the user’s session.

Example. A public library or hotel concierge desk are two examples of public browsing that provides access to Microsoft Edge and other apps.

Policy setting = Enabled (1) | +| **Multi-app**

![thumbnail](../images/Picture5-sm.png)

**Normal browsing**

Runs a full-version of Microsoft Edge with all browsing features and preserves the user data and state between sessions.

Some features may not work depending on what other apps you have configured in assigned access. For example, installing extensions or books from the Microsoft store are not allowed if the store is not available. Also, if Internet Explorer 11 is set up in assigned access, you can enable [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) to automatically switch users to Internet Explorer 11 for sites that need backward compatibility support.

**Policy setting** = Not configured (0 default) |

 

![thumbnail](../images/Picture6-sm.png)

Public browsing

Runs a multi-tab version of Microsoft Edge InPrivate with a tailored experience for kiosks that runs in full-screen mode. Users can open and close Microsoft Edge and launch other apps if allowed by assigned access. Instead of an End session button to clear their browsing session, the user closes Microsoft Edge normally.

In this configuration, Microsoft Edge can interact with other applications. For example, if Internet Explorer 11 is set up in multi-app assigned access, you can enable [EnterpriseModeSiteList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-enterprisemodesitelist) to automatically switch users to Internet Explorer 11 for sites that need backward compatibility support.

Example. A public library or hotel concierge desk are two examples of public browsing that provides access to Microsoft Edge and other apps.

Policy setting = Enabled (1) | + +--- diff --git a/browsers/edge/includes/configure-microsoft-edge-kiosk-mode-include.md b/browsers/edge/includes/configure-microsoft-edge-kiosk-mode-include.md index 197b2c1f1a..1c08a3d745 100644 --- a/browsers/edge/includes/configure-microsoft-edge-kiosk-mode-include.md +++ b/browsers/edge/includes/configure-microsoft-edge-kiosk-mode-include.md @@ -1,49 +1,51 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/27/2018 -ms.prod: edge -ms:topic: include ---- - - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Not configured* - -[!INCLUDE [configure-kiosk-mode-shortdesc](../shortdesc/configure-kiosk-mode-shortdesc.md)] - -For this policy to work, you must configure Microsoft Edge in assigned access; otherwise, Microsoft Edge ignores the settings in this policy. To learn more about assigned access and kiosk configuration, see [Configure kiosk and shared devices running Windows desktop editions](https://aka.ms/E489vw). - -### Supported values - -[!INCLUDE [configure-kiosk-mode-supported-values-include](configure-kiosk-mode-supported-values-include.md)] - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure kiosk mode -- **GP name:** ConfigureKioskMode -- **GP element:** ConfigureKioskMode_TextBox -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ConfigureKioskMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskMode -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\KioskMode -- **Value name:** ConfigureKioskMode -- **Value type:** REG_SZ - -### Related policies -[Configure kiosk reset after idle timeout](../available-policies.md#configure-kiosk-reset-after-idle-timeout): [!INCLUDE [configure-kiosk-reset-after-idle-timeout-shortdesc](../shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md)] - - -### Related topics -[Deploy Microsoft Edge kiosk mode](../microsoft-edge-kiosk-mode-deploy.md): Microsoft Edge kiosk mode works with assigned access to allow IT administrators, to create a tailored browsing experience designed for kiosk devices. In this deployment guidance, you learn about the different Microsoft Edge kiosk mode types to help you determine what configuration is best suited for your kiosk device. You also learn about the other group policies to help you enhance the how to set up your Microsoft Edge kiosk mode experience. - -

\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/27/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Not configured* + +[!INCLUDE [configure-kiosk-mode-shortdesc](../shortdesc/configure-kiosk-mode-shortdesc.md)] + +For this policy to work, you must configure Microsoft Edge in assigned access; otherwise, Microsoft Edge ignores the settings in this policy. To learn more about assigned access and kiosk configuration, see [Configure kiosk and shared devices running Windows desktop editions](https://aka.ms/E489vw). + +### Supported values + +[!INCLUDE [configure-kiosk-mode-supported-values-include](configure-kiosk-mode-supported-values-include.md)] + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure kiosk mode +- **GP name:** ConfigureKioskMode +- **GP element:** ConfigureKioskMode_TextBox +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ConfigureKioskMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskMode +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\KioskMode +- **Value name:** ConfigureKioskMode +- **Value type:** REG_SZ + +### Related policies +[Configure kiosk reset after idle timeout](../available-policies.md#configure-kiosk-reset-after-idle-timeout): [!INCLUDE [configure-kiosk-reset-after-idle-timeout-shortdesc](../shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md)] + + +### Related topics +[Deploy Microsoft Edge kiosk mode](../microsoft-edge-kiosk-mode-deploy.md): Microsoft Edge kiosk mode works with assigned access to allow IT administrators, to create a tailored browsing experience designed for kiosk devices. In this deployment guidance, you learn about the different Microsoft Edge kiosk mode types to help you determine what configuration is best suited for your kiosk device. You also learn about the other group policies to help you enhance the how to set up your Microsoft Edge kiosk mode experience. + +
diff --git a/browsers/edge/includes/configure-open-edge-with-include.md b/browsers/edge/includes/configure-open-edge-with-include.md index 35c21d3076..a86cf568ce 100644 --- a/browsers/edge/includes/configure-open-edge-with-include.md +++ b/browsers/edge/includes/configure-open-edge-with-include.md @@ -1,65 +1,68 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Enabled (A specific page or pages)* - -[!INCLUDE [configure-open-microsoft-edge-with-shortdesc](../shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] - -**Version 1703 or later:**
If you don't want to send traffic to Microsoft, use the \ value, which honors both domain and non domain-joined devices when it's the only configured URL. - -**version 1809:**
When you enable this policy (Configure Open Microsoft Edge With) and select an option, and also enable the Configure Start Pages policy, Microsoft Edge ignores the Configure Start Page policy.

- -### Supported values - -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Not configured |Blank |Blank |If you don't configure this policy and you enable the Disable Lockdown of Start Pages policy, users can change or customize the Start page. | -|Enabled |0 |0 |Load the Start page. | -|Enabled |1 |1 |Load the New Tab page. | -|Enabled |2 |2 |Load the previous pages. | -|Enabled
**(default)** |3 |3 |Load a specific page or pages. | ---- - - ->[!TIP] ->If you want to make changes to this policy:

  1. Set the **Disabled Lockdown of Start Pages** policy to not configured.
  2. Make changes to the **Configure Open Microsoft With** policy.
  3. Enable the **Disabled Lockdown of Start Pages** policy.
- - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Open Microsoft Edge With -- **GP name:** ConfigureOpenMicrosoftEdgeWith -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ConfigureOpenEdgeWith](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureOpenEdgeWith -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings -- **Value name:** ConfigureOpenEdgeWith -- **Value type:** REG_DWORD - -### Related policies - -- [Configure Start pages](../available-policies.md#configure-start-pages): [!INCLUDE [configure-start-pages-shortdesc](../shortdesc/configure-start-pages-shortdesc.md)] - -- [Disable lockdown of Start pages](../available-policies.md#disable-lockdown-of-start-pages): [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)] - - - - - ---- \ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Enabled (A specific page or pages)* + +[!INCLUDE [configure-open-microsoft-edge-with-shortdesc](../shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] + +**Version 1703 or later:**
If you don't want to send traffic to Microsoft, use the \ value, which honors both domain and non domain-joined devices when it's the only configured URL. + +**version 1809:**
When you enable this policy (Configure Open Microsoft Edge With) and select an option, and also enable the Configure Start Pages policy, Microsoft Edge ignores the Configure Start Page policy.

+ +### Supported values + +| Group Policy | MDM | Registry | Description | +|--------------------------|:-----:|:--------:|---------------------------------------------------------------------------------------------------------------------------------------------| +| Not configured | Blank | Blank | If you don't configure this policy and you enable the Disable Lockdown of Start Pages policy, users can change or customize the Start page. | +| Enabled | 0 | 0 | Load the Start page. | +| Enabled | 1 | 1 | Load the New Tab page. | +| Enabled | 2 | 2 | Load the previous pages. | +| Enabled
**(default)** | 3 | 3 | Load a specific page or pages. | + +--- + + +>[!TIP] +>If you want to make changes to this policy:

  1. Set the **Disabled Lockdown of Start Pages** policy to not configured.
  2. Make changes to the **Configure Open Microsoft With** policy.
  3. Enable the **Disabled Lockdown of Start Pages** policy.
+ + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Open Microsoft Edge With +- **GP name:** ConfigureOpenMicrosoftEdgeWith +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ConfigureOpenEdgeWith](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureOpenEdgeWith +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Value name:** ConfigureOpenEdgeWith +- **Value type:** REG_DWORD + +### Related policies + +- [Configure Start pages](../available-policies.md#configure-start-pages): [!INCLUDE [configure-start-pages-shortdesc](../shortdesc/configure-start-pages-shortdesc.md)] + +- [Disable lockdown of Start pages](../available-policies.md#disable-lockdown-of-start-pages): [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)] + + + + + +--- diff --git a/browsers/edge/includes/configure-password-manager-include.md b/browsers/edge/includes/configure-password-manager-include.md index 463baf4185..5f075480ea 100644 --- a/browsers/edge/includes/configure-password-manager-include.md +++ b/browsers/edge/includes/configure-password-manager-include.md @@ -1,46 +1,49 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Enabled (Allowed/users can change the setting)* - -[!INCLUDE [configure-password-manager-shortdesc](../shortdesc/configure-password-manager-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Not configured |Blank |Blank |Users can choose to save and manage passwords locally. | | -|Disabled |0 |no |Not allowed. |![Most restricted value](../images/check-gn.png) | -|Enabled
**(default)** |1 |yes |Allowed. | | ---- - -Verify not allowed/disabled settings: -1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. -2. Verify the settings **Save Password** is toggled off or on and is greyed out. - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Password Manager -- **GP name:** AllowPasswordManager -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowPasswordManager](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowpasswordmanager) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowPasswordManager -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main -- **Value name:** FormSuggest Passwords -- **Value type:** REG_SZ - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Enabled (Allowed/users can change the setting)* + +[!INCLUDE [configure-password-manager-shortdesc](../shortdesc/configure-password-manager-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|--------------------------|:-----:|:--------:|--------------------------------------------------------|:------------------------------------------------:| +| Not configured | Blank | Blank | Users can choose to save and manage passwords locally. | | +| Disabled | 0 | no | Not allowed. | ![Most restricted value](../images/check-gn.png) | +| Enabled
**(default)** | 1 | yes | Allowed. | | + +--- + +Verify not allowed/disabled settings: +1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. +2. Verify the settings **Save Password** is toggled off or on and is greyed out. + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Password Manager +- **GP name:** AllowPasswordManager +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowPasswordManager](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowpasswordmanager) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowPasswordManager +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main +- **Value name:** FormSuggest Passwords +- **Value type:** REG_SZ + +
diff --git a/browsers/edge/includes/configure-pop-up-blocker-include.md b/browsers/edge/includes/configure-pop-up-blocker-include.md index dffcc2ed7e..43374d7ccd 100644 --- a/browsers/edge/includes/configure-pop-up-blocker-include.md +++ b/browsers/edge/includes/configure-pop-up-blocker-include.md @@ -1,42 +1,45 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Disabled (Turned off)* - -[!INCLUDE [configure-pop-up-blocker-shortdesc](../shortdesc/configure-pop-up-blocker-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Not configured |Blank |Blank |Users can choose to use Pop-up Blocker. | | -|Disabled
**(default)** |0 |0 |Turned off. Allow pop-up windows to open. | | -|Enabled |1 |1 |Turned on. Prevent pop-up windows from opening. |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Pop-up Blocker -- **GP name:** AllowPopups -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowPopups](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowpopups) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowPopups -- **Data type:** Integer - -### Registry -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main -- **Value name:** AllowPopups -- **Value type:** REG_SZ - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Disabled (Turned off)* + +[!INCLUDE [configure-pop-up-blocker-shortdesc](../shortdesc/configure-pop-up-blocker-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------|:-----:|:--------:|-------------------------------------------------|:------------------------------------------------:| +| Not configured | Blank | Blank | Users can choose to use Pop-up Blocker. | | +| Disabled
**(default)** | 0 | 0 | Turned off. Allow pop-up windows to open. | | +| Enabled | 1 | 1 | Turned on. Prevent pop-up windows from opening. | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Pop-up Blocker +- **GP name:** AllowPopups +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowPopups](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowpopups) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowPopups +- **Data type:** Integer + +### Registry +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Value name:** AllowPopups +- **Value type:** REG_SZ + +
diff --git a/browsers/edge/includes/configure-search-suggestions-address-bar-include.md b/browsers/edge/includes/configure-search-suggestions-address-bar-include.md index 4985091db3..5e74e11ac7 100644 --- a/browsers/edge/includes/configure-search-suggestions-address-bar-include.md +++ b/browsers/edge/includes/configure-search-suggestions-address-bar-include.md @@ -1,42 +1,45 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Not configured (Blank)* - -[!INCLUDE [configure-search-suggestions-in-address-bar-shortdesc](../shortdesc/configure-search-suggestions-in-address-bar-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Not configured
**(default)** |Blank |Blank |Users can choose to see search suggestions. | | -|Disabled |0 |0 |Prevented. Hide the search suggestions. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Allowed. Show the search suggestions. | | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure search suggestions in Address bar -- **GP name:** AllowSearchSuggestionsinAddressBar -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[AllowSearchSuggestionsinAddressBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsearchsuggestionsinaddressbar) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchSuggestionsinAddressBar -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes -- **Value name:** ShowSearchSuggestionsGlobal -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Not configured (Blank)* + +[!INCLUDE [configure-search-suggestions-in-address-bar-shortdesc](../shortdesc/configure-search-suggestions-in-address-bar-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------|:-----:|:--------:|---------------------------------------------|:------------------------------------------------:| +| Not configured
**(default)** | Blank | Blank | Users can choose to see search suggestions. | | +| Disabled | 0 | 0 | Prevented. Hide the search suggestions. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Allowed. Show the search suggestions. | | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure search suggestions in Address bar +- **GP name:** AllowSearchSuggestionsinAddressBar +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[AllowSearchSuggestionsinAddressBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsearchsuggestionsinaddressbar) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/AllowSearchSuggestionsinAddressBar +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes +- **Value name:** ShowSearchSuggestionsGlobal +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/configure-start-pages-include.md b/browsers/edge/includes/configure-start-pages-include.md index 3d007554e7..911d1b11c9 100644 --- a/browsers/edge/includes/configure-start-pages-include.md +++ b/browsers/edge/includes/configure-start-pages-include.md @@ -1,51 +1,54 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
->*Default setting: Blank or not configured (Load pages specified in App settings)* - -[!INCLUDE [configure-start-pages-shortdesc](../shortdesc/configure-start-pages-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Not configured |Blank |Blank |Load the pages specified in App settings as the default Start pages. | -|Enabled |String |String |Enter the URLs of the pages you want to load as the Start pages, separating each page using angle brackets:

    \\

**Version 1703 or later:**
If you do not want to send traffic to Microsoft, use the \ value, which honors both domain and non-domain-joined devices when it's the only configured URL.

**Version 1809:**
When you enable the Configure Open Microsoft Edge With policy with any option selected, and you enable the Configure Start Pages policy, the Configure Open Microsoft Edge With policy takes precedence, ignoring the Configure Start Pages policy. | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Configure Start pages -- **GP name:** HomePages -- **GP element:** HomePagesPrompt -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[HomePages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-homepages) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/HomePages -- **Data type:** String - -#### Registry settings -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Internet Settings -- **Value name:** ProvisionedHomePages -- **Value type:** REG_SZ - - -### Related policies - -- [Disable Lockdown of Start Pages](#disable-lockdown-of-start-pages): [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)] - -- [Configure Open Microsoft Edge With](../available-policies.md#configure-open-microsoft-edge-with): [!INCLUDE [configure-open-microsoft-edge-with-shortdesc](../shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] - - - -

\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
+>*Default setting: Blank or not configured (Load pages specified in App settings)* + +[!INCLUDE [configure-start-pages-shortdesc](../shortdesc/configure-start-pages-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | +|----------------|:------:|:--------:|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Not configured | Blank | Blank | Load the pages specified in App settings as the default Start pages. | +| Enabled | String | String | Enter the URLs of the pages you want to load as the Start pages, separating each page using angle brackets:

    \\

**Version 1703 or later:**
If you do not want to send traffic to Microsoft, use the \ value, which honors both domain and non-domain-joined devices when it's the only configured URL.

**Version 1809:**
When you enable the Configure Open Microsoft Edge With policy with any option selected, and you enable the Configure Start Pages policy, the Configure Open Microsoft Edge With policy takes precedence, ignoring the Configure Start Pages policy. | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Configure Start pages +- **GP name:** HomePages +- **GP element:** HomePagesPrompt +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[HomePages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-homepages) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/HomePages +- **Data type:** String + +#### Registry settings +- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Value name:** ProvisionedHomePages +- **Value type:** REG_SZ + + +### Related policies + +- [Disable Lockdown of Start Pages](../available-policies.md#disable-lockdown-of-start-pages): [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)] + +- [Configure Open Microsoft Edge With](../available-policies.md#configure-open-microsoft-edge-with): [!INCLUDE [configure-open-microsoft-edge-with-shortdesc](../shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] + + + +

diff --git a/browsers/edge/includes/configure-windows-defender-smartscreen-include.md b/browsers/edge/includes/configure-windows-defender-smartscreen-include.md index 5e460d6a00..c17f639024 100644 --- a/browsers/edge/includes/configure-windows-defender-smartscreen-include.md +++ b/browsers/edge/includes/configure-windows-defender-smartscreen-include.md @@ -1,9 +1,12 @@ --- -author: shortpatti -ms.author: pashort +author: eavena +ms.author: eravena ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp ms.prod: edge -ms:topic: include +ms.topic: include --- @@ -14,16 +17,17 @@ ms:topic: include ### Supported values -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Not configured |Blank |Blank |Users can choose to use Windows Defender SmartScreen. | | -|Disabled |0 |0 |Turned off. Do not protect users from potential threats and prevent users from turning it on. | | -|Enabled |1 |1 |Turned on. Protect users from potential threats and prevent users from turning it off. |![Most restricted value](../images/check-gn.png) | +| Group Policy | MDM | Registry | Description | Most restricted | +|----------------|:-----:|:--------:|-----------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Not configured | Blank | Blank | Users can choose to use Windows Defender SmartScreen. | | +| Disabled | 0 | 0 | Turned off. Do not protect users from potential threats and prevent users from turning it on. | | +| Enabled | 1 | 1 | Turned on. Protect users from potential threats and prevent users from turning it off. | ![Most restricted value](../images/check-gn.png) | + --- To verify Windows Defender SmartScreen is turned off (disabled): 1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. -2. Verify the setting **Help protect me from malicious sites and download with SmartScreen Filter** is disabled.

![Verify that Windows Defender SmartScreen is turned off (disabled)](../images/allow-smart-screen-validation.PNG) +2. Verify the setting **Help protect me from malicious sites and download with Windows Defender SmartScreen** is disabled.

![Verify that Windows Defender SmartScreen is turned off (disabled)](../images/allow-smart-screen-validation.PNG) ### ADMX info and settings @@ -44,4 +48,4 @@ To verify Windows Defender SmartScreen is turned off (disabled): - **Value name:** EnabledV9 - **Value type:** REG_DWORD -

\ No newline at end of file +
diff --git a/browsers/edge/includes/disable-lockdown-of-start-pages-include.md b/browsers/edge/includes/disable-lockdown-of-start-pages-include.md index 94af3ec1e5..d2ae261042 100644 --- a/browsers/edge/includes/disable-lockdown-of-start-pages-include.md +++ b/browsers/edge/includes/disable-lockdown-of-start-pages-include.md @@ -1,55 +1,58 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Enabled (Start pages are not editable)* - -[!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Not configured |0 |0 |Locked. Start pages configured in either the Configure Open Microsoft Edge With policy and Configure Start Pages policy are not editable. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Unlocked. Users can make changes to all configured start pages.

When you enable this policy and define a set of URLs in the Configure Start Pages policy, Microsoft Edge uses the URLs defined in the Configure Open Microsoft Edge With policy. | | ---- - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Disable lockdown of Start pages -- **GP name:** DisableLockdownOfStartPages -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[DisableLockdownOfStartPages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-disablelockdownofstartpages) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/DisableLockdownOfStartPages -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings -- **Value name:** DisableLockdownOfStartPages -- **Value type:** REG_SZ - - - - - -### Related Policies -- [Configure Start pages](../available-policies.md#configure-start-pages): [!INCLUDE [configure-start-pages-shortdesc](../shortdesc/configure-start-pages-shortdesc.md)] - -- [Configure Open Microsoft Edge With](../available-policies.md#configure-open-microsoft-edge-with): [!INCLUDE [configure-open-microsoft-edge-with-shortdesc](../shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] - -### Related topics - -[!INCLUDE [microsoft-browser-extension-policy-shortdesc](../shortdesc/microsoft-browser-extension-policy-shortdesc.md)] - -

\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Enabled (Start pages are not editable)* + +[!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../shortdesc/disable-lockdown-of-start-pages-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|----------------|:---:|:--------:|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Not configured | 0 | 0 | Locked. Start pages configured in either the Configure Open Microsoft Edge With policy and Configure Start Pages policy are not editable. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Unlocked. Users can make changes to all configured start pages.

When you enable this policy and define a set of URLs in the Configure Start Pages policy, Microsoft Edge uses the URLs defined in the Configure Open Microsoft Edge With policy. | | + +--- + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Disable lockdown of Start pages +- **GP name:** DisableLockdownOfStartPages +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[DisableLockdownOfStartPages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-disablelockdownofstartpages) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/DisableLockdownOfStartPages +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Value name:** DisableLockdownOfStartPages +- **Value type:** REG_SZ + + + + + +### Related Policies +- [Configure Start pages](../available-policies.md#configure-start-pages): [!INCLUDE [configure-start-pages-shortdesc](../shortdesc/configure-start-pages-shortdesc.md)] + +- [Configure Open Microsoft Edge With](../available-policies.md#configure-open-microsoft-edge-with): [!INCLUDE [configure-open-microsoft-edge-with-shortdesc](../shortdesc/configure-open-microsoft-edge-with-shortdesc.md)] + +### Related topics + +[!INCLUDE [microsoft-browser-extension-policy-shortdesc](../shortdesc/microsoft-browser-extension-policy-shortdesc.md)] + +

diff --git a/browsers/edge/includes/do-not-sync-browser-settings-include.md b/browsers/edge/includes/do-not-sync-browser-settings-include.md index 143622193e..c20bdd6781 100644 --- a/browsers/edge/includes/do-not-sync-browser-settings-include.md +++ b/browsers/edge/includes/do-not-sync-browser-settings-include.md @@ -1,52 +1,55 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Disabled or not configured (Allowed/turned on)* - -[!INCLUDE [do-not-sync-browser-settings-shortdesc](../shortdesc/do-not-sync-browser-settings-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Disabled or not configured
**(default)** |0 |0 |Allowed/turned on. The “browser” group syncs automatically between user’s devices and lets users to make changes. | -|Enabled |2 |2 |Prevented/turned off. The “browser” group does not use the _Sync your Settings_ option. | ---- - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Do not sync browser settings -- **GP name:** DisableWebBrowserSettingSync -- **GP path:** Windows Components/Sync your settings -- **GP ADMX file name:** SettingSync.admx - -#### MDM settings -- **MDM name:** [Experience/DoNotSyncBrowserSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-donotsyncbrowsersetting) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/DoNotSyncBrowserSettings -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\Policies\Microsoft\Windows\SettingSync -- **Value name:** DisableWebBrowserSettingSyncUserOverride -- **Value - -### Related policies - -[Prevent users from turning on browser syncing](../available-policies.md#prevent-users-from-turning-on-browser-syncing): [!INCLUDE [prevent-users-to-turn-on-browser-syncing-shortdesc](../shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md)] - - - -### Related topics - -[About sync setting on Microsoft Edge on Windows 10 devices](https://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices) -

-

+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Disabled or not configured (Allowed/turned on)* + +[!INCLUDE [do-not-sync-browser-settings-shortdesc](../shortdesc/do-not-sync-browser-settings-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | +|---------------------------------------------|:---:|:--------:|-------------------------------------------------------------------------------------------------------------------| +| Disabled or not configured
**(default)** | 0 | 0 | Allowed/turned on. The “browser” group syncs automatically between user’s devices and lets users to make changes. | +| Enabled | 2 | 2 | Prevented/turned off. The “browser” group does not use the *Sync your Settings* option. | + +--- + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Do not sync browser settings +- **GP name:** DisableWebBrowserSettingSync +- **GP path:** Windows Components/Sync your settings +- **GP ADMX file name:** SettingSync.admx + +#### MDM settings +- **MDM name:** [Experience/DoNotSyncBrowserSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-donotsyncbrowsersetting) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/DoNotSyncBrowserSettings +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\Policies\Microsoft\Windows\SettingSync +- **Value name:** DisableWebBrowserSettingSyncUserOverride +- **Value + +### Related policies + +[Prevent users from turning on browser syncing](../available-policies.md#prevent-users-from-turning-on-browser-syncing): [!INCLUDE [prevent-users-to-turn-on-browser-syncing-shortdesc](../shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md)] + + + +### Related topics + +[About sync setting on Microsoft Edge on Windows 10 devices](https://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices) +

+

diff --git a/browsers/edge/includes/do-not-sync-include.md b/browsers/edge/includes/do-not-sync-include.md index 4434b8e64c..e959162f90 100644 --- a/browsers/edge/includes/do-not-sync-include.md +++ b/browsers/edge/includes/do-not-sync-include.md @@ -1,45 +1,48 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Disabled or not configured (Allowed/turned on)* - -[!INCLUDE [do-not-sync-shortdesc](../shortdesc/do-not-sync-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Allowed/turned on. Users can choose what to sync to their device. | | -|Enabled |2 |2 |Prevented/turned off. Disables the _Sync your Settings_ toggle and prevents syncing. |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Do not sync -- **GP name:** AllowSyncMySettings -- **GP path:** Windows Components/Sync your settings -- **GP ADMX file name:** SettingSync.admx - -#### MDM settings -- **MDM name:** Experience/[AllowSyncMySettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowsyncmysettings) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/AllowSyncMySettings -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\Windows\SettingSync -- **Value name:** DisableSettingSyn -- **Value type:** REG_DWORD - -### Related topics -[About sync setting on Microsoft Edge on Windows 10 devices](https://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices): Learn about what settings are synced. - - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Disabled or not configured (Allowed/turned on)* + +[!INCLUDE [do-not-sync-shortdesc](../shortdesc/do-not-sync-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|--------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Allowed/turned on. Users can choose what to sync to their device. | | +| Enabled | 2 | 2 | Prevented/turned off. Disables the *Sync your Settings* toggle and prevents syncing. | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Do not sync +- **GP name:** AllowSyncMySettings +- **GP path:** Windows Components/Sync your settings +- **GP ADMX file name:** SettingSync.admx + +#### MDM settings +- **MDM name:** Experience/[AllowSyncMySettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowsyncmysettings) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/AllowSyncMySettings +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\Windows\SettingSync +- **Value name:** DisableSettingSyn +- **Value type:** REG_DWORD + +### Related topics +[About sync setting on Microsoft Edge on Windows 10 devices](https://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices): Learn about what settings are synced. + + +
diff --git a/browsers/edge/includes/enable-device-for-dev-shortdesc-include.md b/browsers/edge/includes/enable-device-for-dev-shortdesc-include.md index 7d722faf12..afb78c58e3 100644 --- a/browsers/edge/includes/enable-device-for-dev-shortdesc-include.md +++ b/browsers/edge/includes/enable-device-for-dev-shortdesc-include.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -[Enable your device for development](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development): Developers can access special development features, along with other developer-focused settings, which makes it possible for them to develop, test, and debug apps. Learn how to configure your environment for development, the difference between Developer Mode and sideloading, and the security risks of Developer mode. \ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +[Enable your device for development](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development): Developers can access special development features, along with other developer-focused settings, which makes it possible for them to develop, test, and debug apps. Learn how to configure your environment for development, the difference between Developer Mode and sideloading, and the security risks of Developer mode. diff --git a/browsers/edge/includes/ie11-send-all-sites-not-in-site-list-include.md b/browsers/edge/includes/ie11-send-all-sites-not-in-site-list-include.md index d3d116dc84..d64fe44479 100644 --- a/browsers/edge/includes/ie11-send-all-sites-not-in-site-list-include.md +++ b/browsers/edge/includes/ie11-send-all-sites-not-in-site-list-include.md @@ -1,19 +1,21 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - ->*Supported versions: Internet Explorer 11 on Windows 10, version 1607 or later*
->*Default setting: Disabled or not configured* - -By default, all sites open the currently active browser. With this policy, you can automatically open all sites not included in the Enterprise Mode Site List in Microsoft Edge. When you enable this policy, you must also turn on the Internet Explorer\Use the Enterprise Mode IE website list policy and include at least one site in the Enterprise Mode Site List. - ->[!NOTE] ->If you’ve also enabled the Microsoft Edge [Send all intranet sites to Internet Explorer 11](../available-policies.md#send-all-intranet-sites-to-internet-explorer-11) policy, all intranet sites continue to open in Internet Explorer 11. - -You can find the group policy settings in the following location of the Group Policy Editor: - -      **Computer Configuration\\Administrative Templates\\Windows Components\\Internet Explorer\\** +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +>*Supported versions: Internet Explorer 11 on Windows 10, version 1607 or later*
+>*Default setting: Disabled or not configured* + +By default, all sites open the currently active browser. With this policy, you can automatically open all sites not included in the Enterprise Mode Site List in Microsoft Edge. When you enable this policy, you must also turn on the Internet Explorer\Use the Enterprise Mode IE website list policy and include at least one site in the Enterprise Mode Site List. + +>[!NOTE] +>If you’ve also enabled the Microsoft Edge [Send all intranet sites to Internet Explorer 11](../available-policies.md#send-all-intranet-sites-to-internet-explorer-11) policy, all intranet sites continue to open in Internet Explorer 11. + +You can find the group policy settings in the following location of the Group Policy Editor: + +      **Computer Configuration\\Administrative Templates\\Windows Components\\Internet Explorer\\** diff --git a/browsers/edge/includes/keep-fav-sync-ie-edge-include.md b/browsers/edge/includes/keep-fav-sync-ie-edge-include.md index c7fc49bc93..eb790351a1 100644 --- a/browsers/edge/includes/keep-fav-sync-ie-edge-include.md +++ b/browsers/edge/includes/keep-fav-sync-ie-edge-include.md @@ -1,41 +1,44 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
->*Default setting: Disabled or not configured (Turned off/not syncing)* - -[!INCLUDE [keep-favorites-in-sync-between-ie-and-edge-shortdesc](../shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Turned off/not syncing | | -|Enabled |1 |1 |Turned on/syncing |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -### ADMX info -- **GP English name:** Keep favorites in sync between Internet Explorer and Microsoft Edge -- **GP name:** SyncFavoritesBetweenIEAndMicrosoftEdge -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[SyncFavoritesBetweenIEAndMicrosoftEdge](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-syncfavoritesbetweenieandmicrosoftedge) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SyncFavoritesBetweenIEAndMicrosoftEdge -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main -- **Value name:** SyncFavoritesBetweenIEAndMicrosoftEdge -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
+>*Default setting: Disabled or not configured (Turned off/not syncing)* + +[!INCLUDE [keep-favorites-in-sync-between-ie-and-edge-shortdesc](../shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Turned off/not syncing | | +| Enabled | 1 | 1 | Turned on/syncing | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +### ADMX info +- **GP English name:** Keep favorites in sync between Internet Explorer and Microsoft Edge +- **GP name:** SyncFavoritesBetweenIEAndMicrosoftEdge +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[SyncFavoritesBetweenIEAndMicrosoftEdge](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-syncfavoritesbetweenieandmicrosoftedge) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SyncFavoritesBetweenIEAndMicrosoftEdge +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main +- **Value name:** SyncFavoritesBetweenIEAndMicrosoftEdge +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/man-connections-win-comp-services-shortdesc-include.md b/browsers/edge/includes/man-connections-win-comp-services-shortdesc-include.md index f7d692d864..211b16465b 100644 --- a/browsers/edge/includes/man-connections-win-comp-services-shortdesc-include.md +++ b/browsers/edge/includes/man-connections-win-comp-services-shortdesc-include.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -[Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services): Learn about the network connections from Windows to Microsoft services. Also, learn about the privacy settings that affect the data shared with either Microsoft or apps and how to manage them in an enterprise. You can configure diagnostic data at the lowest level for your edition of Windows and evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment. +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +[Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services): Learn about the network connections from Windows to Microsoft services. Also, learn about the privacy settings that affect the data shared with either Microsoft or apps and how to manage them in an enterprise. You can configure diagnostic data at the lowest level for your edition of Windows and evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment. diff --git a/browsers/edge/includes/prevent-access-about-flag-include.md b/browsers/edge/includes/prevent-access-about-flag-include.md index 1f55180874..144451edb0 100644 --- a/browsers/edge/includes/prevent-access-about-flag-include.md +++ b/browsers/edge/includes/prevent-access-about-flag-include.md @@ -1,41 +1,44 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1607 or later*
->*Default setting: Disabled or not configured (Allowed)* - -[!INCLUDE [prevent-access-to-about-flags-page-shortdesc](../shortdesc/prevent-access-to-about-flags-page-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Allowed | | -|Enabled |1 |1 |Prevented |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Prevent access to the about:flags page in Microsoft Edge -- **GP name:** PreventAccessToAboutFlagsInMicrosoftEdge -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[PreventAccessToAboutFlagsInMicrosoftEdge](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventaccesstoaboutflagsinmicrosoftedge) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventAccessToAboutFlagsInMicrosoftEdge -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main -- **Value name:** PreventAccessToAboutFlagsInMicrosoftEdge -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1607 or later*
+>*Default setting: Disabled or not configured (Allowed)* + +[!INCLUDE [prevent-access-to-about-flags-page-shortdesc](../shortdesc/prevent-access-to-about-flags-page-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|-------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Allowed | | +| Enabled | 1 | 1 | Prevented | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Prevent access to the about:flags page in Microsoft Edge +- **GP name:** PreventAccessToAboutFlagsInMicrosoftEdge +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[PreventAccessToAboutFlagsInMicrosoftEdge](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventaccesstoaboutflagsinmicrosoftedge) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventAccessToAboutFlagsInMicrosoftEdge +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main +- **Value name:** PreventAccessToAboutFlagsInMicrosoftEdge +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/prevent-bypassing-win-defender-files-include.md b/browsers/edge/includes/prevent-bypassing-win-defender-files-include.md index 7638ce642a..1c3c2ebf02 100644 --- a/browsers/edge/includes/prevent-bypassing-win-defender-files-include.md +++ b/browsers/edge/includes/prevent-bypassing-win-defender-files-include.md @@ -1,41 +1,44 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
->*Default setting: Disabled or not configured (Allowed/turned off)* - -[!INCLUDE [prevent-bypassing-windows-defender-prompts-for-files-shortdesc](../shortdesc/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Allowed/turned off. Users can ignore the warning and continue to download the unverified file(s). | | -|Enabled |1 |1 |Prevented/turned on. |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Prevent bypassing Windows Defender SmartScreen prompts for files -- **GP name:** PreventSmartScreenPromptOverrideForFiles -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[PreventSmartScreenPromptOverrideForFiles](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventsmartscreenpromptoverrideforfiles) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter -- **Value name:** PreventOverrideAppRepUnknown -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
+>*Default setting: Disabled or not configured (Allowed/turned off)* + +[!INCLUDE [prevent-bypassing-windows-defender-prompts-for-files-shortdesc](../shortdesc/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|---------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Allowed/turned off. Users can ignore the warning and continue to download the unverified file(s). | | +| Enabled | 1 | 1 | Prevented/turned on. | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Prevent bypassing Windows Defender SmartScreen prompts for files +- **GP name:** PreventSmartScreenPromptOverrideForFiles +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[PreventSmartScreenPromptOverrideForFiles](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventsmartscreenpromptoverrideforfiles) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter +- **Value name:** PreventOverrideAppRepUnknown +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/prevent-bypassing-win-defender-sites-include.md b/browsers/edge/includes/prevent-bypassing-win-defender-sites-include.md index 438290f181..a6b5e9dde9 100644 --- a/browsers/edge/includes/prevent-bypassing-win-defender-sites-include.md +++ b/browsers/edge/includes/prevent-bypassing-win-defender-sites-include.md @@ -1,41 +1,44 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
->*Default setting: Disabled or not configured (Allowed/turned off)* - -[!INCLUDE [prevent-bypassing-windows-defender-prompts-for-sites-shortdesc](../shortdesc/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Allowed/turned off. Users can ignore the warning and continue to the site.| | -|Enabled |1 |1 |Prevented/turned on. |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Prevent bypassing Windows Defender SmartScreen prompts for sites -- **GP name:** PreventSmartscreenPromptOverride -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[PreventSmartscreenPromptOverride](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventsmartscreenpromptoverride) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter -- **Value name:** PreventOverride -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
+>*Default setting: Disabled or not configured (Allowed/turned off)* + +[!INCLUDE [prevent-bypassing-windows-defender-prompts-for-sites-shortdesc](../shortdesc/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|----------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Allowed/turned off. Users can ignore the warning and continue to the site. | | +| Enabled | 1 | 1 | Prevented/turned on. | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Prevent bypassing Windows Defender SmartScreen prompts for sites +- **GP name:** PreventSmartscreenPromptOverride +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[PreventSmartscreenPromptOverride](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventsmartscreenpromptoverride) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter +- **Value name:** PreventOverride +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/prevent-certificate-error-overrides-include.md b/browsers/edge/includes/prevent-certificate-error-overrides-include.md index 404d0688e3..ab20b1ca5b 100644 --- a/browsers/edge/includes/prevent-certificate-error-overrides-include.md +++ b/browsers/edge/includes/prevent-certificate-error-overrides-include.md @@ -1,40 +1,43 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Disabled or not configured (Allowed/turned off)* - -[!INCLUDE [prevent-certificate-error-overrides-shortdesc](../shortdesc/prevent-certificate-error-overrides-shortdesc.md)] - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Allowed/turned on. Override the security warning to sites that have SSL errors. | | -|Enabled |1 |1 |Prevented/turned on. |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Prevent certificate error overrides -- **GP name:** PreventCertErrorOverrides -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[PreventCertErrorOverrides](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventCertErrorOverrides -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Setting -- **Value name:** PreventCertErrorOverrides -- **Value type:** REG_DWORD - -
+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Disabled or not configured (Allowed/turned off)* + +[!INCLUDE [prevent-certificate-error-overrides-shortdesc](../shortdesc/prevent-certificate-error-overrides-shortdesc.md)] + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|---------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Allowed/turned on. Override the security warning to sites that have SSL errors. | | +| Enabled | 1 | 1 | Prevented/turned on. | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Prevent certificate error overrides +- **GP name:** PreventCertErrorOverrides +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[PreventCertErrorOverrides](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventCertErrorOverrides +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Setting +- **Value name:** PreventCertErrorOverrides +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/prevent-changes-to-favorites-include.md b/browsers/edge/includes/prevent-changes-to-favorites-include.md index 75a386025f..0b6691b746 100644 --- a/browsers/edge/includes/prevent-changes-to-favorites-include.md +++ b/browsers/edge/includes/prevent-changes-to-favorites-include.md @@ -1,41 +1,44 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1709 or later*
->*Default setting: Disabled or not configured (Allowed/not locked down)* - -[!INCLUDE [prevent-changes-to-favorites-shortdesc](../shortdesc/prevent-changes-to-favorites-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Allowed/unlocked. Users can add, import, and make changes to the Favorites list. | | -|Enabled |1 |1 |Prevented/locked down. |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Prevent changes to Favorites on Microsoft Edge -- **GP name:** LockdownFavorites -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[LockdownFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/LockdownFavorites -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Favorites -- **Value name:** LockdownFavorites -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1709 or later*
+>*Default setting: Disabled or not configured (Allowed/not locked down)* + +[!INCLUDE [prevent-changes-to-favorites-shortdesc](../shortdesc/prevent-changes-to-favorites-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|-----------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Allowed/unlocked. Users can add, import, and make changes to the Favorites list. | | +| Enabled | 1 | 1 | Prevented/locked down. | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Prevent changes to Favorites on Microsoft Edge +- **GP name:** LockdownFavorites +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[LockdownFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-lockdownfavorites) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/LockdownFavorites +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Favorites +- **Value name:** LockdownFavorites +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/prevent-first-run-webpage-open-include.md b/browsers/edge/includes/prevent-first-run-webpage-open-include.md index ec2966bba7..be8eec24b9 100644 --- a/browsers/edge/includes/prevent-first-run-webpage-open-include.md +++ b/browsers/edge/includes/prevent-first-run-webpage-open-include.md @@ -1,41 +1,44 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
->*Default setting: Disabled or not configured (Allowed)* - -[!INCLUDE [prevent-first-run-webpage-from-opening-shortdesc](../shortdesc/prevent-first-run-webpage-from-opening-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Allowed. Load the First Run webpage. | | -|Enabled |1 |1 |Prevented. |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Prevent the First Run webpage from opening on Microsoft Edge -- **GP name:** PreventFirstRunPage -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[PreventFirstRunPage](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventfirstrunpage) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventFirstRunPage -- **Data type:** Integer - -####Registry -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main -- **Value name:** PreventFirstRunPage -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
+>*Default setting: Disabled or not configured (Allowed)* + +[!INCLUDE [prevent-first-run-webpage-from-opening-shortdesc](../shortdesc/prevent-first-run-webpage-from-opening-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|--------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Allowed. Load the First Run webpage. | | +| Enabled | 1 | 1 | Prevented. | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Prevent the First Run webpage from opening on Microsoft Edge +- **GP name:** PreventFirstRunPage +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[PreventFirstRunPage](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventfirstrunpage) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventFirstRunPage +- **Data type:** Integer + +#### Registry +- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main +- **Value name:** PreventFirstRunPage +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/prevent-live-tile-pinning-start-include.md b/browsers/edge/includes/prevent-live-tile-pinning-start-include.md index e595e3fe28..ea8f458f04 100644 --- a/browsers/edge/includes/prevent-live-tile-pinning-start-include.md +++ b/browsers/edge/includes/prevent-live-tile-pinning-start-include.md @@ -1,41 +1,44 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
->*Default setting: Disabled or not configured (Collect and send)* - -[!INCLUDE [prevent-edge-from-gathering-live-tile-info-shortdesc](../shortdesc/prevent-edge-from-gathering-live-tile-info-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Collect and send Live Tile metadata. | | -|Enabled |1 |1 |Do not collect data. |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start -- **GP name:** PreventLiveTileDataCollection -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[PreventLiveTileDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventlivetiledatacollection) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventLiveTileDataCollection -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main -- **Value name:** PreventLiveTileDataCollection -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
+>*Default setting: Disabled or not configured (Collect and send)* + +[!INCLUDE [prevent-edge-from-gathering-live-tile-info-shortdesc](../shortdesc/prevent-edge-from-gathering-live-tile-info-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|--------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Collect and send Live Tile metadata. | | +| Enabled | 1 | 1 | Do not collect data. | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start +- **GP name:** PreventLiveTileDataCollection +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[PreventLiveTileDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventlivetiledatacollection) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventLiveTileDataCollection +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main +- **Value name:** PreventLiveTileDataCollection +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/prevent-localhost-address-for-webrtc-include.md b/browsers/edge/includes/prevent-localhost-address-for-webrtc-include.md index 39187a492b..0bc6ba7764 100644 --- a/browsers/edge/includes/prevent-localhost-address-for-webrtc-include.md +++ b/browsers/edge/includes/prevent-localhost-address-for-webrtc-include.md @@ -1,41 +1,44 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
->*Default setting: Disabled or not configured (Allowed/show localhost IP addresses)* - -[!INCLUDE [prevent-using-localhost-ip-address-for-webrtc-shortdesc](../shortdesc/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Allowed. Show localhost IP addresses. | | -|Enabled |1 |1 |Prevented. |![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Prevent using Localhost IP address for WebRTC -- **GP name:** HideLocalHostIPAddress -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[PreventUsingLocalHostIPAddressForWebRTC](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventusinglocalhostipaddressforwebrtc) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventUsingLocalHostIPAddressForWebRTC -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main -- **Value name:** HideLocalHostIPAddress -- **Value type:** REG_DWORD - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
+>*Default setting: Disabled or not configured (Allowed/show localhost IP addresses)* + +[!INCLUDE [prevent-using-localhost-ip-address-for-webrtc-shortdesc](../shortdesc/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|---------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | Allowed. Show localhost IP addresses. | | +| Enabled | 1 | 1 | Prevented. | ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Prevent using Localhost IP address for WebRTC +- **GP name:** HideLocalHostIPAddress +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[PreventUsingLocalHostIPAddressForWebRTC](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-preventusinglocalhostipaddressforwebrtc) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventUsingLocalHostIPAddressForWebRTC +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main +- **Value name:** HideLocalHostIPAddress +- **Value type:** REG_DWORD + +
diff --git a/browsers/edge/includes/prevent-turning-off-required-extensions-include.md b/browsers/edge/includes/prevent-turning-off-required-extensions-include.md index 4f168cc2ab..897dc4f9bb 100644 --- a/browsers/edge/includes/prevent-turning-off-required-extensions-include.md +++ b/browsers/edge/includes/prevent-turning-off-required-extensions-include.md @@ -1,9 +1,12 @@ --- -author: shortpatti -ms.author: pashort +author: eavena +ms.author: eravena ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp ms.prod: edge -ms:topic: include +ms.topic: include --- @@ -15,10 +18,11 @@ ms:topic: include ### Supported values -|Group Policy |Description | -|---|---| -|Disabled or not configured
**(default)** |Allowed. Users can uninstall extensions. If you previously enabled this policy and you decide to disable it, the list of extension PFNs defined in this policy get ignored. | -|Enabled |Provide a semi-colon delimited list of extension PFNs. For example, adding the following OneNote Web Clipper and Office Online extension prevents users from turning it off:

_Microsoft.OneNoteWebClipper8wekyb3d8bbwe;Microsoft.OfficeOnline8wekyb3d8bbwe_

After defining the list of extensions, you deploy them through any available enterprise deployment channel, such as Microsoft Intune.

Removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the [Allow Developer Tools](../group-policies/developer-settings-gp.md#allow-developer-tools) policy, then this policy does not prevent users from debugging and altering the logic on an extension. | +| Group Policy | Description | +|---------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Disabled or not configured
**(default)** | Allowed. Users can uninstall extensions. If you previously enabled this policy and you decide to disable it, the list of extension PFNs defined in this policy get ignored. | +| Enabled | Provide a semi-colon delimited list of extension PFNs. For example, adding the following OneNote Web Clipper and Office extension prevents users from turning it off:

*Microsoft.OneNoteWebClipper8wekyb3d8bbwe;Microsoft.OfficeOnline8wekyb3d8bbwe*

After defining the list of extensions, you deploy them through any available enterprise deployment channel, such as Microsoft Intune.

Removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the [Allow Developer Tools](../group-policies/developer-settings-gp.md#allow-developer-tools) policy, then this policy does not prevent users from debugging and altering the logic on an extension. | + --- @@ -50,7 +54,7 @@ ms:topic: include - [Find a package family name (PFN) for per-app VPN](https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn): There are two ways to find a PFN so that you can configure a per-app VPN. - [How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune](https://docs.microsoft.com/intune/windows-store-for-business): The Microsoft Store for Business gives you a place to find and purchase apps for your organization, individually, or in volume. By connecting the store to Microsoft Intune, you can manage volume-purchased apps from the Azure portal. - [How to assign apps to groups with Microsoft Intune](https://docs.microsoft.com/intune/apps-deploy): Apps can be assigned to devices whether or not Intune manages them. -- [Manage apps from the Microsoft Store for Business with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business): Configuration Manager supports managing Microsoft Store for Business apps on both Windows 10 devices with the Configuration Manager client, and also Windows 10 devices enrolled with Microsoft Intune. +- [Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business): Configuration Manager supports managing Microsoft Store for Business apps on both Windows 10 devices with the Configuration Manager client, and also Windows 10 devices enrolled with Microsoft Intune. - [How to add Windows line-of-business (LOB) apps to Microsoft Intune](https://docs.microsoft.com/intune/lob-apps-windows): A line-of-business (LOB) app is one that you add from an app installation file. Typically, these types of apps are written in-house. -

\ No newline at end of file +
diff --git a/browsers/edge/includes/prevent-users-to-turn-on-browser-syncing-include.md b/browsers/edge/includes/prevent-users-to-turn-on-browser-syncing-include.md index 5548ae3f74..d04f548fca 100644 --- a/browsers/edge/includes/prevent-users-to-turn-on-browser-syncing-include.md +++ b/browsers/edge/includes/prevent-users-to-turn-on-browser-syncing-include.md @@ -1,44 +1,48 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Enabled or not configured (Prevented/turned off)* - -[!INCLUDE [prevent-users-to-turn-on-browser-syncing-shortdesc](../shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md)] - -### Supported values -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Disabled |0 |0 |Allowed/turned on. Users can sync the browser settings. | -|Enabled or not configured
**(default)** |1 |1 |Prevented/turned off. | ---- - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Prevent users from turning on browser syncing -- **GP name:** PreventUsersFromTurningOnBrowserSyncing -- **GP path:** Windows Components/Sync your settings -- **GP ADMX file name:** SettingSync.admx - -#### MDM settings -- **MDM name:** Experience/[PreventUsersFromTurningOnBrowserSyncing](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-preventusersfromturningonbrowsersyncing) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/PreventUsersFromTurningOnBrowserSyncing -- **Data type:** String - - -### Related policies -[Do not sync browser settings](../available-policies.md#do-not-sync-browser-settings): [!INCLUDE [do-not-sync-browser-settings-shortdesc](../shortdesc/do-not-sync-browser-settings-shortdesc.md)]. - -### Related topics -[About sync setting on Microsoft Edge on Windows 10 devices](https://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices) - - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Enabled or not configured (Prevented/turned off)* + +[!INCLUDE [prevent-users-to-turn-on-browser-syncing-shortdesc](../shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | +|--------------------------------------------|:---:|:--------:|---------------------------------------------------------| +| Disabled | 0 | 0 | Allowed/turned on. Users can sync the browser settings. | +| Enabled or not configured
**(default)** | 1 | 1 | Prevented/turned off. | + +--- + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Prevent users from turning on browser syncing +- **GP name:** PreventUsersFromTurningOnBrowserSyncing +- **GP path:** Windows Components/Sync your settings +- **GP ADMX file name:** SettingSync.admx + +#### MDM settings +- **MDM name:** Experience/[PreventUsersFromTurningOnBrowserSyncing](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-preventusersfromturningonbrowsersyncing) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/PreventUsersFromTurningOnBrowserSyncing +- **Data type:** String + + +### Related policies +[Do not sync browser settings](../available-policies.md#do-not-sync-browser-settings): [!INCLUDE [do-not-sync-browser-settings-shortdesc](../shortdesc/do-not-sync-browser-settings-shortdesc.md)]. + +### Related topics +[About sync setting on Microsoft Edge on Windows 10 devices](https://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices) + + +
diff --git a/browsers/edge/includes/provision-favorites-include.md b/browsers/edge/includes/provision-favorites-include.md index a67f33444b..fdb0016715 100644 --- a/browsers/edge/includes/provision-favorites-include.md +++ b/browsers/edge/includes/provision-favorites-include.md @@ -1,49 +1,52 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
->*Default setting: Disabled or not configured (Customizable)* - -[!INCLUDE [provision-favorites-shortdesc](../shortdesc/provision-favorites-shortdesc.md)] - - ->[!IMPORTANT] ->Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. - -### Supported values - -|Group Policy |Description |Most restricted | -|---|---|:---:| -|Disabled or not configured
**(default)** |Users can customize the favorites list, such as adding folders, or adding and removing favorites. | | -|Enabled |Define a default list of favorites in Microsoft Edge. In this case, the Save a Favorite, Import settings, and context menu options (such as Create a new folder) are turned off.

To define a default list of favorites, do the following:

  1. In the upper-right corner of Microsoft Edge, click the ellipses (**...**) and select **Settings**.
  2. Click **Import from another browser**, click **Export to file** and save the file.
  3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision. Specify the URL as:
    • HTTP location: "SiteList"=https://localhost:8080/URLs.html
    • Local network: "SiteList"="\network\shares\URLs.html"
    • Local file: "SiteList"=file:///c:/Users/Documents/URLs.html
|![Most restricted value](../images/check-gn.png) | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Provision Favorites -- **GP name:** ConfiguredFavorites -- **GP element:** ConfiguredFavoritesPrompt -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ProvisionFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ProvisionFavorites -- **Data type:** String - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Favorites -- **Value name:** ConfiguredFavorites -- **Value type:** REG_SZ - -### Related policies -[Keep favorites in sync between Internet Explorer and Microsoft Edge](../available-policies.md#keep-favorites-in-sync-between-internet-explorer-and-microsoft-edge): [!INCLUDE [keep-favorites-in-sync-between-ie-and-edge-shortdesc](../shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md)] - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1511 or later*
+>*Default setting: Disabled or not configured (Customizable)* + +[!INCLUDE [provision-favorites-shortdesc](../shortdesc/provision-favorites-shortdesc.md)] + + +>[!IMPORTANT] +>Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. + +### Supported values + +| Group Policy | Description | Most restricted | +|---------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | Users can customize the favorites list, such as adding folders, or adding and removing favorites. | | +| Enabled | Define a default list of favorites in Microsoft Edge. In this case, the Save a Favorite, Import settings, and context menu options (such as Create a new folder) are turned off.

To define a default list of favorites, do the following:

  1. In the upper-right corner of Microsoft Edge, click the ellipses (**...**) and select **Settings**.
  2. Click **Import from another browser**, click **Export to file** and save the file.
  3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision. Specify the URL as:
    • HTTP location: "SiteList"=
    • Local network: "SiteList"="\network\shares\URLs.html"
    • Local file: "SiteList"=file:///c:/Users/Documents/URLs.html
| ![Most restricted value](../images/check-gn.png) | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Provision Favorites +- **GP name:** ConfiguredFavorites +- **GP element:** ConfiguredFavoritesPrompt +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ProvisionFavorites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-provisionfavorites) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ProvisionFavorites +- **Data type:** String + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Favorites +- **Value name:** ConfiguredFavorites +- **Value type:** REG_SZ + +### Related policies +[Keep favorites in sync between Internet Explorer and Microsoft Edge](../available-policies.md#keep-favorites-in-sync-between-internet-explorer-and-microsoft-edge): [!INCLUDE [keep-favorites-in-sync-between-ie-and-edge-shortdesc](../shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md)] + +
diff --git a/browsers/edge/includes/search-provider-discovery-shortdesc-include.md b/browsers/edge/includes/search-provider-discovery-shortdesc-include.md index 0189af0a67..ef83bc4778 100644 --- a/browsers/edge/includes/search-provider-discovery-shortdesc-include.md +++ b/browsers/edge/includes/search-provider-discovery-shortdesc-include.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -[Search provider discovery](https://docs.microsoft.com/microsoft-edge/dev-guide/browser/search-provider-discovery): Microsoft Edge follows the OpenSearch 1.1 specification to discover and use web search providers. When a user browses to a search service, the OpenSearch description is picked up and saved for later use. Users can then choose to add the search service to use in the Microsoft Edge address bar. \ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +[Search provider discovery](https://docs.microsoft.com/microsoft-edge/dev-guide/browser/search-provider-discovery): Microsoft Edge follows the OpenSearch 1.1 specification to discover and use web search providers. When a user browses to a search service, the OpenSearch description is picked up and saved for later use. Users can then choose to add the search service to use in the Microsoft Edge address bar. diff --git a/browsers/edge/includes/send-all-intranet-sites-ie-include.md b/browsers/edge/includes/send-all-intranet-sites-ie-include.md index 17ce737c8c..2d8195f03e 100644 --- a/browsers/edge/includes/send-all-intranet-sites-ie-include.md +++ b/browsers/edge/includes/send-all-intranet-sites-ie-include.md @@ -1,59 +1,62 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Disabled or not configured* - -[!INCLUDE [send-all-intranet-sites-to-ie-shortdesc](../shortdesc/send-all-intranet-sites-to-ie-shortdesc.md)] - ->[!TIP] ->Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have websites or web apps that still use this technology and needs IE11 to run, you can add them to the Enterprise Mode site list, using Enterprise Mode Site List Manager. - - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |All sites, including intranet sites, open in Microsoft Edge automatically. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Only intranet sites open in Internet Explorer 11 automatically.

Enabling this policy opens all intranet sites in IE11 automatically, even if the users have Microsoft Edge as their default browser.

  1. In Group Policy Editor, navigate to:

    **Computer Configuration\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file**

  2. Click **Enable** and then refresh the policy to view the affected sites in Microsoft Edge.

    A message opens stating that the page needs to open in IE. At the same time, the page opens in IE11 automatically; in a new frame if it is not yet running, or in a new tab.

| | ---- - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Send all intranet sites to Internet Explorer 11 -- **GP name:** SendIntranetTraffictoInternetExplorer -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[SendIntranetTraffictoInternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sendintranettraffictointernetexplorer) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main -- **Value name:** SendIntranetTraffictoInternetExplorer -- **Value type:** REG_DWORD - -### Related Policies -- [Configure the Enterprise Mode Site List](../available-policies.md#configure-the-enterprise-mode-site-list): [!INCLUDE [configure-enterprise-mode-site-list-shortdesc](../shortdesc/configure-enterprise-mode-site-list-shortdesc.md)] - -- [Show message when opening sites in Internet Explorer](../available-policies.md#show-message-when-opening-sites-in-internet-explorer): [!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](../shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] - - -### Related topics -- [Blog: How Microsoft Edge and Internet Explorer 11 on Windows 10 work better together in the Enterprise](https://go.microsoft.com/fwlink/p/?LinkID=624035). Many customers depend on legacy features only available in older versions of Internet Explorer and are familiar with our Enterprise Mode tools for IE11. The Enterprise Mode has been extended to support to Microsoft Edge by opening any site specified on the Enterprise Mode Site List in IE11. IT Pros can use their existing IE11 Enterprise Mode Site List, or they can create a new one specifically for Microsoft Edge. By keeping Microsoft Edge as the default browser in Windows 10 and only opening legacy line of business sites in IE11 when necessary, you can help keep newer development projects on track, using the latest web standards on Microsoft Edge. - -- [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). Learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. - -- [Use the Enterprise Mode Site List Manager](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager). You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain paths and to specify whether the site renders using Enterprise Mode or the default mode. - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10*
+>*Default setting: Disabled or not configured* + +[!INCLUDE [send-all-intranet-sites-to-ie-shortdesc](../shortdesc/send-all-intranet-sites-to-ie-shortdesc.md)] + +>[!TIP] +>Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have websites or web apps that still use this technology and needs IE11 to run, you can add them to the Enterprise Mode site list, using Enterprise Mode Site List Manager. + + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | All sites, including intranet sites, open in Microsoft Edge automatically. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Only intranet sites open in Internet Explorer 11 automatically.

Enabling this policy opens all intranet sites in IE11 automatically, even if the users have Microsoft Edge as their default browser.

  1. In Group Policy Editor, navigate to:

    **Computer Configuration\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file**

  2. Click **Enable** and then refresh the policy to view the affected sites in Microsoft Edge.

    A message opens stating that the page needs to open in IE. At the same time, the page opens in IE11 automatically; in a new frame if it is not yet running, or in a new tab.

| | + +--- + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Send all intranet sites to Internet Explorer 11 +- **GP name:** SendIntranetTraffictoInternetExplorer +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[SendIntranetTraffictoInternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sendintranettraffictointernetexplorer) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SendIntranetTraffictoInternetExplorer +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Value name:** SendIntranetTraffictoInternetExplorer +- **Value type:** REG_DWORD + +### Related Policies +- [Configure the Enterprise Mode Site List](../available-policies.md#configure-the-enterprise-mode-site-list): [!INCLUDE [configure-enterprise-mode-site-list-shortdesc](../shortdesc/configure-enterprise-mode-site-list-shortdesc.md)] + +- [Show message when opening sites in Internet Explorer](../available-policies.md#show-message-when-opening-sites-in-internet-explorer): [!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](../shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] + + +### Related topics +- [Blog: How Microsoft Edge and Internet Explorer 11 on Windows 10 work better together in the Enterprise](https://go.microsoft.com/fwlink/p/?LinkID=624035). Many customers depend on legacy features only available in older versions of Internet Explorer and are familiar with our Enterprise Mode tools for IE11. The Enterprise Mode has been extended to support to Microsoft Edge by opening any site specified on the Enterprise Mode Site List in IE11. IT Pros can use their existing IE11 Enterprise Mode Site List, or they can create a new one specifically for Microsoft Edge. By keeping Microsoft Edge as the default browser in Windows 10 and only opening legacy line of business sites in IE11 when necessary, you can help keep newer development projects on track, using the latest web standards on Microsoft Edge. + +- [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377). Learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. + +- [Use the Enterprise Mode Site List Manager](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager). You can use IE11 and the Enterprise Mode Site List Manager to add individual website domains and domain paths and to specify whether the site renders using Enterprise Mode or the default mode. + +
diff --git a/browsers/edge/includes/set-default-search-engine-include.md b/browsers/edge/includes/set-default-search-engine-include.md index f7156818de..104cb3ebdd 100644 --- a/browsers/edge/includes/set-default-search-engine-include.md +++ b/browsers/edge/includes/set-default-search-engine-include.md @@ -1,57 +1,60 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
->*Default setting: Not configured (Defined in App settings)* - -[!INCLUDE [set-default-search-engine-shortdesc](../shortdesc/set-default-search-engine-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Not configured
**(default)** |Blank |Blank |Use the search engine specified in App settings. If you don't configure this policy and disable the [Allow search engine customization](../group-policies/search-engine-customization-gp.md#allow-search-engine-customization) policy, users cannot make changes. | | -|Disabled |0 |0 |Remove or don't use the policy-set search engine and use the search engine for the market, letting users make changes. | | -|Enabled |1 |1 |Use the policy-set search engine specified in the OpenSearch XML file, preventing users from making changes.

Specify a link to the OpenSearch XML file that contains, at a minimum, the short name and the URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://docs.microsoft.com/microsoft-edge/dev-guide/browser/search-provider-discovery). Use this format to specify the link you want to add.

If you want your users to use the default Microsoft Edge settings for each market, then set the string to **EDGEDEFAULT**.

If you would like your users to use Microsoft Bing as the default search engine, then set the string to **EDGEBING**. |![Most restricted value](../images/check-gn.png) | ---- - - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Set default search engine -- **GP name:** SetDefaultSearchEngine -- **GP element:** SetDefaultSearchEngine_Prompt -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** [SetDefaultSearchEngine](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setdefaultsearchengine) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetDefaultSearchEngine -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\OpenSearch -- **Value name:** SetDefaultSearchEngine -- **Value type:** REG_SZ - -### Related policies - -- [Configure additional search engines](../available-policies.md#configure-additional-search-engines): [!INCLUDE [configure-additional-search-engines-shortdesc](../shortdesc/configure-additional-search-engines-shortdesc.md)] - -- [Allow search engine customization](../available-policies.md#allow-search-engine-customization): [!INCLUDE [allow-search-engine-customization-shortdesc](../shortdesc/allow-search-engine-customization-shortdesc.md)] - -### Related topics - -- [!INCLUDE [microsoft-browser-extension-policy-shortdesc](../shortdesc/microsoft-browser-extension-policy-shortdesc.md)] - -- [Search provider discovery](https://docs.microsoft.com/microsoft-edge/dev-guide/browser/search-provider-discovery): The Microsoft Edge address bar uses rich search integration, including search suggestions, results from the web, your browsing history, and favorites. - -

\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later*
+>*Default setting: Not configured (Defined in App settings)* + +[!INCLUDE [set-default-search-engine-shortdesc](../shortdesc/set-default-search-engine-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------|:-----:|:--------:|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Not configured
**(default)** | Blank | Blank | Use the search engine specified in App settings. If you don't configure this policy and disable the [Allow search engine customization](../group-policies/search-engine-customization-gp.md#allow-search-engine-customization) policy, users cannot make changes. | | +| Disabled | 0 | 0 | Remove or don't use the policy-set search engine and use the search engine for the market, letting users make changes. | | +| Enabled | 1 | 1 | Use the policy-set search engine specified in the OpenSearch XML file, preventing users from making changes.

Specify a link to the OpenSearch XML file that contains, at a minimum, the short name and the URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://docs.microsoft.com/microsoft-edge/dev-guide/browser/search-provider-discovery). Use this format to specify the link you want to add.

If you want your users to use the default Microsoft Edge settings for each market, then set the string to **EDGEDEFAULT**.

If you would like your users to use Microsoft Bing as the default search engine, then set the string to **EDGEBING**. | ![Most restricted value](../images/check-gn.png) | + +--- + + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Set default search engine +- **GP name:** SetDefaultSearchEngine +- **GP element:** SetDefaultSearchEngine_Prompt +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** [SetDefaultSearchEngine](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setdefaultsearchengine) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetDefaultSearchEngine +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\OpenSearch +- **Value name:** SetDefaultSearchEngine +- **Value type:** REG_SZ + +### Related policies + +- [Configure additional search engines](../available-policies.md#configure-additional-search-engines): [!INCLUDE [configure-additional-search-engines-shortdesc](../shortdesc/configure-additional-search-engines-shortdesc.md)] + +- [Allow search engine customization](../available-policies.md#allow-search-engine-customization): [!INCLUDE [allow-search-engine-customization-shortdesc](../shortdesc/allow-search-engine-customization-shortdesc.md)] + +### Related topics + +- [!INCLUDE [microsoft-browser-extension-policy-shortdesc](../shortdesc/microsoft-browser-extension-policy-shortdesc.md)] + +- [Search provider discovery](https://docs.microsoft.com/microsoft-edge/dev-guide/browser/search-provider-discovery): The Microsoft Edge address bar uses rich search integration, including search suggestions, results from the web, your browsing history, and favorites. + +

diff --git a/browsers/edge/includes/set-home-button-url-include.md b/browsers/edge/includes/set-home-button-url-include.md index 5e091f18ac..3cf0692dbb 100644 --- a/browsers/edge/includes/set-home-button-url-include.md +++ b/browsers/edge/includes/set-home-button-url-include.md @@ -1,49 +1,52 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Disabled or not configured (Blank)* - -[!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Disabled or not configured
**(default)** |Blank |Blank |Show the home button, load the Start pages, and lock down the home button to prevent users from changing what page loads. | -|Enabled - String |String |String |Enter a URL in string format, for example, https://www.msn.com.

For this policy to work, you must also enable the [Configure Home Button](../available-policies.md#configure-home-button) policy and select the _Show home button & set a specific page_ option. | ---- - - -### ADMX info and settings -#### ADMX info -- **GP English name:** Set Home Button URL -- **GP name:** SetHomeButtonURL -- **GP element:** SetHomeButtonURLPrompt -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[SetHomeButtonURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) -- **Supported devices:** Desktop and Mobile -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetHomeButtonURL -- **Data type:** String - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings -- **Value name:** ConfigureHomeButtonURL -- **Value type:** REG_SZ - -### Related policies - -- [Configure Home Button](../available-policies.md#configure-home-button): [!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] - -- [Unlock Home Button](../available-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] - -

+--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Disabled or not configured (Blank)* + +[!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | +|---------------------------------------------|:------:|:--------:|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Disabled or not configured
**(default)** | Blank | Blank | Show the home button, load the Start pages, and lock down the home button to prevent users from changing what page loads. | +| Enabled - String | String | String | Enter a URL in string format, for example, https://www.msn.com.

For this policy to work, you must also enable the [Configure Home Button](../available-policies.md#configure-home-button) policy and select the *Show home button & set a specific page* option. | + +--- + + +### ADMX info and settings +#### ADMX info +- **GP English name:** Set Home Button URL +- **GP name:** SetHomeButtonURL +- **GP element:** SetHomeButtonURLPrompt +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[SetHomeButtonURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) +- **Supported devices:** Desktop and Mobile +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetHomeButtonURL +- **Data type:** String + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Value name:** ConfigureHomeButtonURL +- **Value type:** REG_SZ + +### Related policies + +- [Configure Home Button](../available-policies.md#configure-home-button): [!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] + +- [Unlock Home Button](../available-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] + +

diff --git a/browsers/edge/includes/set-new-tab-url-include.md b/browsers/edge/includes/set-new-tab-url-include.md index 8b9ac1c728..58536ae480 100644 --- a/browsers/edge/includes/set-new-tab-url-include.md +++ b/browsers/edge/includes/set-new-tab-url-include.md @@ -1,48 +1,51 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Disabled or not configured (Blank)* - -[!INCLUDE [set-new-tab-url-shortdesc](../shortdesc/set-new-tab-url-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Disabled or not configured
**(default)** |Blank |Blank |Load the default New Tab page. | -|Enabled - String |String |String |Enter a URL in string format, for example, https://www.msn.com.

Enabling this policy prevents users from making changes.

| ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Set New Tab page URL -- **GP name:** SetNewTabPageURL -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[SetNewTabPageURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetNewTabPageURL -- **Data type:** String - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings -- **Value name:** NewTabPageUR -- **Value type:** REG_SZ - - -### Related policies - -[Allow web content on New Tab page](../available-policies.md#allow-web-content-on-new-tab-page): [!INCLUDE [allow-web-content-on-new-tab-page-shortdesc](../shortdesc/allow-web-content-on-new-tab-page-shortdesc.md)] - - - -

\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Disabled or not configured (Blank)* + +[!INCLUDE [set-new-tab-url-shortdesc](../shortdesc/set-new-tab-url-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | +|---------------------------------------------|:------:|:--------:|----------------------------------------------------------------------------------------------------------------------------------| +| Disabled or not configured
**(default)** | Blank | Blank | Load the default New Tab page. | +| Enabled - String | String | String | Enter a URL in string format, for example, https://www.msn.com.

Enabling this policy prevents users from making changes.

| + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Set New Tab page URL +- **GP name:** SetNewTabPageURL +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[SetNewTabPageURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetNewTabPageURL +- **Data type:** String + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Value name:** NewTabPageUR +- **Value type:** REG_SZ + + +### Related policies + +[Allow web content on New Tab page](../available-policies.md#allow-web-content-on-new-tab-page): [!INCLUDE [allow-web-content-on-new-tab-page-shortdesc](../shortdesc/allow-web-content-on-new-tab-page-shortdesc.md)] + + + +

diff --git a/browsers/edge/includes/show-message-opening-sites-ie-include.md b/browsers/edge/includes/show-message-opening-sites-ie-include.md index c5e808c926..024279e776 100644 --- a/browsers/edge/includes/show-message-opening-sites-ie-include.md +++ b/browsers/edge/includes/show-message-opening-sites-ie-include.md @@ -1,52 +1,55 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - - ->*Supported versions: Microsoft Edge on Windows 10, version 1607 and later*
->*Default setting: Disabled or not configured (No additional message)* - - -[!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](../shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] - - -### Supported values - -|Group Policy |MDM |Registry |Description |Most restricted | -|---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |No additional message displays. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Show an additional message stating that a site has opened in IE11. | | -|Enabled |2 |2 |Show an additional message with a _Keep going in Microsoft Edge_ link to allow users to open the site in Microsoft Edge. | | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Show message when opening sites in Internet Explorer -- **GP name:** ShowMessageWhenOpeningSitesInInternetExplorer -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[ShowMessageWhenOpeningSitesInInternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-showmessagewhenopeningsitesininternetexplorer) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ShowMessageWhenOpeningSitesInInternetExplorer -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main -- **Value name:** ShowMessageWhenOpeningSitesInInternetExplorer -- **Value type:** REG_DWORD - -### Related policies - -- [Configure the Enterprise Mode Site List](../available-policies.md#configure-the-enterprise-mode-site-list): [!INCLUDE [configure-enterprise-mode-site-list-shortdesc](../shortdesc/configure-enterprise-mode-site-list-shortdesc.md)] - -- [Send all intranet sites to Internet Explorer 11](../available-policies.md#send-all-intranet-sites-to-internet-explorer-11): [!INCLUDE [send-all-intranet-sites-to-ie-shortdesc](../shortdesc/send-all-intranet-sites-to-ie-shortdesc.md)] - - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + + +>*Supported versions: Microsoft Edge on Windows 10, version 1607 and later*
+>*Default setting: Disabled or not configured (No additional message)* + + +[!INCLUDE [show-message-when-opening-sites-in-ie-shortdesc](../shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md)] + + +### Supported values + +| Group Policy | MDM | Registry | Description | Most restricted | +|---------------------------------------------|:---:|:--------:|--------------------------------------------------------------------------------------------------------------------------|:------------------------------------------------:| +| Disabled or not configured
**(default)** | 0 | 0 | No additional message displays. | ![Most restricted value](../images/check-gn.png) | +| Enabled | 1 | 1 | Show an additional message stating that a site has opened in IE11. | | +| Enabled | 2 | 2 | Show an additional message with a *Keep going in Microsoft Edge* link to allow users to open the site in Microsoft Edge. | | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Show message when opening sites in Internet Explorer +- **GP name:** ShowMessageWhenOpeningSitesInInternetExplorer +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[ShowMessageWhenOpeningSitesInInternetExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-showmessagewhenopeningsitesininternetexplorer) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ShowMessageWhenOpeningSitesInInternetExplorer +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main +- **Value name:** ShowMessageWhenOpeningSitesInInternetExplorer +- **Value type:** REG_DWORD + +### Related policies + +- [Configure the Enterprise Mode Site List](../available-policies.md#configure-the-enterprise-mode-site-list): [!INCLUDE [configure-enterprise-mode-site-list-shortdesc](../shortdesc/configure-enterprise-mode-site-list-shortdesc.md)] + +- [Send all intranet sites to Internet Explorer 11](../available-policies.md#send-all-intranet-sites-to-internet-explorer-11): [!INCLUDE [send-all-intranet-sites-to-ie-shortdesc](../shortdesc/send-all-intranet-sites-to-ie-shortdesc.md)] + + +
diff --git a/browsers/edge/includes/unlock-home-button-include.md b/browsers/edge/includes/unlock-home-button-include.md index d2c2e44746..c7dae69002 100644 --- a/browsers/edge/includes/unlock-home-button-include.md +++ b/browsers/edge/includes/unlock-home-button-include.md @@ -1,48 +1,51 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - ->*Supported versions: Microsoft Edge on Windows 10, version 1809*
->*Default setting: Disabled or not configured (Home button is locked)* - -[!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] - -### Supported values - -|Group Policy |MDM |Registry |Description | -|---|:---:|:---:|---| -|Disabled or not configured
**(default)** |0 |0 |Locked, preventing users from making changes. | -|Enabled |1 |1 |Unlocked, letting users make changes. | ---- - -### ADMX info and settings -#### ADMX info -- **GP English name:** Unlock Home Button -- **GP name:** UnlockHomeButton -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx - -#### MDM settings -- **MDM name:** Browser/[UnlockHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) -- **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/UnlockHomeButton -- **Data type:** Integer - -#### Registry settings -- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Internet Settings -- **Value name:** UnlockHomeButton -- **Value type:** REG_DWORD - -### Related policies - -- [Configure Home Button](../available-policies.md#configure-home-button): [!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] - -- [Set Home Button URL](../available-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] - - -
\ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +>*Supported versions: Microsoft Edge on Windows 10, version 1809*
+>*Default setting: Disabled or not configured (Home button is locked)* + +[!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] + +### Supported values + +| Group Policy | MDM | Registry | Description | +|---------------------------------------------|:---:|:--------:|-----------------------------------------------| +| Disabled or not configured
**(default)** | 0 | 0 | Locked, preventing users from making changes. | +| Enabled | 1 | 1 | Unlocked, letting users make changes. | + +--- + +### ADMX info and settings +#### ADMX info +- **GP English name:** Unlock Home Button +- **GP name:** UnlockHomeButton +- **GP path:** Windows Components/Microsoft Edge +- **GP ADMX file name:** MicrosoftEdge.admx + +#### MDM settings +- **MDM name:** Browser/[UnlockHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) +- **Supported devices:** Desktop +- **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/UnlockHomeButton +- **Data type:** Integer + +#### Registry settings +- **Path:** HKLM\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Value name:** UnlockHomeButton +- **Value type:** REG_DWORD + +### Related policies + +- [Configure Home Button](../available-policies.md#configure-home-button): [!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] + +- [Set Home Button URL](../available-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] + + +
diff --git a/browsers/edge/index.yml b/browsers/edge/index.yml index 9550d5d1d2..61b851adf2 100644 --- a/browsers/edge/index.yml +++ b/browsers/edge/index.yml @@ -2,19 +2,19 @@ documentType: LandingData -title: Microsoft Edge Group Policy configuration options +title: Microsoft Edge Legacy Group Policy configuration options metadata: document_id: - title: Microsoft Edge Group Policy configuration options + title: Microsoft Edge Group Legacy Policy configuration options description: - text: Learn how to deploy and configure group policies in Microsoft Edge on Windows 10. Some of the features coming to Microsoft Edge gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. - - keywords: Microsoft Edge, Windows 10 + text: (Note - You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).) Learn how to deploy and configure group policies in Microsoft Edge Legacy on Windows 10. Some of the features coming to Microsoft Edge Legacy gives you the ability to set a custom URL for the New Tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. + + keywords: Microsoft Edge Legacy, Windows 10 ms.localizationpriority: medium @@ -36,7 +36,7 @@ sections: - type: markdown - text: Learn about interoperability goals and enterprise guidance along with system requirements, language support and frequently asked questions. + text: (Note - You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).) Learn about interoperability goals and enterprise guidance along with system requirements, language support and frequently asked questions. - items: @@ -92,7 +92,7 @@ sections: - href: https://docs.microsoft.com/microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp - html:

Learch how you can use the Enterprise Mode site list for websites and apps that have compatibility problems in Microsoft Edge.

+ html:

Learn how you can use the Enterprise Mode site list for websites and apps that have compatibility problems in Microsoft Edge.

image: diff --git a/browsers/edge/managing-group-policy-admx-files.md b/browsers/edge/managing-group-policy-admx-files.md index 2f76d6a665..8b93e0ebc2 100644 --- a/browsers/edge/managing-group-policy-admx-files.md +++ b/browsers/edge/managing-group-policy-admx-files.md @@ -2,12 +2,15 @@ title: Managing group policy ADMX files description: Learn how to centrally administer and incorporate ADMX files when editing the administrative template policy settings inside a local or domain-based Group Policy object. ms.assetid: -author: shortpatti -ms.author: pashort +ms.reviewer: +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp ms.prod: edge ms.sitesec: library ms.localizationpriority: medium -ms.date: 10/19/2018 +ms.date: 10/19/2018 --- # Managing group policy ADMX files diff --git a/browsers/edge/microsoft-edge-faq.md b/browsers/edge/microsoft-edge-faq.md index f989f0e5c8..632905e3cb 100644 --- a/browsers/edge/microsoft-edge-faq.md +++ b/browsers/edge/microsoft-edge-faq.md @@ -1,96 +1,58 @@ --- -title: Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros +title: Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros +ms.reviewer: +audience: itpro +manager: dansimp description: Answers to frequently asked questions about Microsoft Edge features, integration, support, and potential problems. -author: shortpatti -ms.author: pashort +author: dansimp +ms.author: dansimp ms.prod: edge -ms.topic: reference +ms.topic: article ms.mktglfcycl: general ms.sitesec: library ms.localizationpriority: medium -ms.date: 11/05/2018 --- # Frequently Asked Questions (FAQs) for IT Pros >Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile -**Q: Why is the Sync settings option under Settings \> Accounts \> Sync your settings permanently disabled? +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). -**A:** In the Windows 10 Anniversary Update, domain-joined users who connected their Microsoft Account (MSA) could roam settings and data between Windows devices. A group policy to prevent users from connecting their MSAs exists, but this setting also prevents users from easily accessing their personal Microsoft services. Enterprises can still enable Enterprise State Roaming with Azure Active Directory. +## How can I get the next major version of Microsoft Edge, based on Chromium? +In December 2018, Microsoft [announced](https://blogs.windows.com/windowsexperience/2018/12/06/microsoft-edge-making-the-web-better-through-more-open-source-collaboration/#8jv53blDvL6TIKuS.97) our intention to adopt the Chromium open source project in the development of Microsoft Edge on the desktop, to create better web compatibility for our customers and less fragmentation of the web for all web developers. You can get more information at the [Microsoft Edge Insiders site](https://www.microsoftedgeinsider.com/). ->In a nutshell, any fresh install of Windows 10 Creators Update or higher does not support funtionality if it's under an Active Directory, but works for Azure Active Directory. +## What’s the difference between Microsoft Edge and Internet Explorer 11? How do I know which one to use? +Microsoft Edge is the default browser for all Windows 10 devices. It’s built to be highly compatible with the modern web. For some enterprise web apps and a small set of sites that were built to work with older technologies like ActiveX, [you can use Enterprise Mode](emie-to-improve-compatibility.md) to automatically send users to Internet Explorer 11. -**Q: What is the size of the local storage for Microsoft Edge overall and per domain?** +For more information on how Internet Explorer and Microsoft Edge work together to support your legacy web apps, while still defaulting to the higher security and modern experiences enabled by Microsoft Edge, see [Legacy apps in the enterprise](https://blogs.windows.com/msedgedev/2017/04/07/legacy-web-apps-enterprise/#RAbtRvJSYFaKu2BI.97). -**A:** The limits are 5MB per subdomain, 10MB per domain, and 50MB total. +## Does Microsoft Edge work with Enterprise Mode? +[Enterprise Mode](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11) helps you run many legacy web applications with better backward compatibility. You can configure both Microsoft Edge and Internet Explorer to use the same Enterprise Mode Site List, switching seamlessly between browsers to support both modern and legacy web apps. -**Q: What is the difference between Microsoft Edge and Internet Explorer 11? How do I know which one to use?** +## How do I customize Microsoft Edge and related settings for my organization? +You can use Group Policy or Microsoft Intune to manage settings related to Microsoft Edge, such as security settings, folder redirection, and preferences. See [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/group-policies/) for a list of policies currently available for Microsoft Edge and configuration information. Note that the preview release of Chromium-based Microsoft Edge might not include management policies or other enterprise functionality; our focus during the preview is modern browser fundamentals. -**A:** Microsoft Edge is the default browser for all Windows 10 devices. It is built to be highly compatible with the modern web. For some enterprise web apps and a small set of sites on the web that were built to work with older technologies like ActiveX, [you can use Enterprise Mode](https://docs.microsoft.com/microsoft-edge/deploy/emie-to-improve-compatibility) to automatically send users to Internet Explorer 11 for those sites. +## Is Adobe Flash supported in Microsoft Edge? +Adobe Flash is currently supported as a built-in feature of Microsoft Edge on PCs running Windows 10. In July 2017, Adobe announced that Flash support will end after 2020. With this change to Adobe support, we’ve started to phase Flash out of Microsoft Edge by adding the [Configure the Adobe Flash Click-to-Run setting group policy](https://docs.microsoft.com/microsoft-edge/deploy/available-policies#configure-the-adobe-flash-click-to-run-setting) - this lets you control which websites can run Adobe Flash content. -For more information on how Internet Explorer and Microsoft Edge can work together to support your legacy web apps, while still defaulting to the higher bar for security and modern experiences enabled by Microsoft Edge, see [Legacy apps in the enterprise](https://blogs.windows.com/msedgedev/2017/04/07/legacy-web-apps-enterprise/#RAbtRvJSYFaKu2BI.97). +To learn more about Microsoft’s plan for phasing Flash out of Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash](https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). -**Q: Does Microsoft Edge work with Enterprise Mode?** +## Does Microsoft Edge support ActiveX controls or BHOs like Silverlight or Java? +No. Microsoft Edge doesn’t support ActiveX controls and BHOs like Silverlight or Java. If you’re running web apps that use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and standards support. -**A:** [Enterprise Mode](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11) offers better backward compatibility and enables customers to run many legacy web applications. Microsoft Edge and Internet Explorer can be configured to use the same Enterprise Mode Site List, switching seamlessly between browsers to support both modern and legacy web apps. +## How often will Microsoft Edge be updated? +In Windows 10, we’re delivering Windows as a service, updated on a cadence driven by quality and the availability of new features. Microsoft Edge security updates are released every two to four weeks, while bigger feature updates are included in the Windows 10 releases on a semi-annual cadence. +## How can I provide feedback on Microsoft Edge? +Microsoft Edge is an evergreen browser - we’ll continue to evolve both the web platform and the user interface with regular updates. To send feedback on user experience, or on broken or malicious sites, use the **Send Feedback** option under the ellipses icon (**...**) in the Microsoft Edge toolbar. -**Q: I have Windows 10, but I don’t seem to have Microsoft Edge. Why?** +## Will Internet Explorer 11 continue to receive updates? +We’re committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it’s installed. For details, see [Lifecycle FAQ - Internet Explorer](https://support.microsoft.com/help/17454/). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge. -**A:** Long-Term Servicing Branch (LTSB) versions of Windows, including Windows Server 2016 and Windows Server 2019, don't include Microsoft Edge or many other Universal Windows Platform (UWP) apps. These apps and their services are frequently updated with new functionality and can't be supported on systems running LTSB operating systems. For customers who require the LTSB for specialized devices, we recommend using Internet Explorer 11. - -**Q: How do I get the latest Canary/Beta/Preview version of Microsoft Edge?** - -**A:** You can access the latest preview version of Microsoft Edge by updating to the latest Windows 10 preview via the [Windows Insider Program](https://insider.windows.com/). To run the preview version of Microsoft Edge on a stable version of Windows 10 (or any other OS), you can download a [Virtual Machine](https://developer.microsoft.com/microsoft-edge/tools/vms/windows/) that we provide or use the upcoming RemoteEdge service. - -**Q: How do I customize Microsoft Edge and related settings for my organization?** - -**A:** You can use Group Policy or Microsoft Intune to manage settings related to Microsoft Edge, such as security settings, folder redirection, and preferences. See [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/group-policies/index) for a list of available policies for Microsoft Edge and configuration combinations. - -**Q: Is Adobe Flash supported in Microsoft Edge?** - -**A:** Currently, Adobe Flash is supported as a built-in feature of Microsoft Edge on devices running the desktop version of Windows 10. In July 2017, Adobe announced that Flash will no longer be supported after 2020. With Adobe no longer supporting Flash after 2020, Microsoft has started to phase out Flash from Microsoft Edge by adding the [Configure the Adobe Flash Click-to-Run setting](available-policies.md#configure-the-adobe-flash-click-to-run-setting) group policy giving you a way to control the list of websites that have permission to run Adobe Flash content. - - - -To learn more about Microsoft’s plan for phasing out Flash from Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash]( https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). - - -**Q: Does Microsoft Edge support ActiveX controls or BHOs like Silverlight or Java?** - -**A:** No. Microsoft Edge does not support ActiveX controls and BHOs such as Silverlight or Java. If you are running web apps that continue to use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and modern standards support. - - -**Q: How often will Microsoft Edge be updated?** - -**A:** In Windows 10, we are delivering Windows as a service, updated on a cadence driven by quality and the availability of new features. Microsoft Edge security updates are released every two to four weeks, and the bigger feature updates are currently pushed out with the Windows 10 releases on a semi-annual cadence. - -**Q: How can I provide feedback on Microsoft Edge?** - -**A:** Microsoft Edge is an evergreen browser and we will continue to evolve both the web platform and the user interface with regular updates. To send feedback on user experience, or on broken or malicious sites, you can use the **Send Feedback** option under the ellipses icon (**...**) in the Microsoft Edge toolbar. You can also provide feedback through the [Microsoft Edge Dev Twitter](https://twitter.com/MSEdgeDev) account. - -**Q: Will Internet Explorer 11 continue to receive updates?** - -**A:** We will continue to deliver security updates to Internet Explorer 11 through its supported lifespan. To ensure consistent behavior across Windows versions, we will evaluate Internet Explorer 11 bugs for servicing on a case by case basis. The latest features and platform updates will only be available in Microsoft Edge. - -**Q: I loaded a web page and Microsoft Edge sent me to Internet Explorer - what happened?** - -**A:** In some cases, Internet Explorer loads automatically for sites that still rely on legacy technologies such as ActiveX. For more information, read [Legacy web apps in the enterprise](https://blogs.windows.com/msedgedev/2017/04/07/legacy-web-apps-enterprise/#uHpbs94kAaVsU1qB.97). - -**Q: Why is Do Not Track (DNT) off by default in Microsoft Edge?** - -**A:** When Microsoft first set the Do Not Track setting to “On” by default in Internet Explorer 10, industry standards had not yet been established. We are now making this default change as the World Wide Web Consortium (W3C) formalizes industry standards to recommend that default settings allow customers to actively indicate whether they want to enable DNT. As a result, DNT will not be enabled by default in upcoming versions of Microsoft’s browsers, but we will provide customers with clear information on how to turn this feature on in the browser settings should you wish to do so. - -**Q: How do I find out what version of Microsoft Edge I have?** - -**A:** Open Microsoft Edge. In the upper right corner click the ellipses icon (**…**), and then click **Settings**. Look in the **About this app** section to find your version. - -**Q: What is Microsoft EdgeHTML?** - -**A:** Microsoft EdgeHTML is the new web rendering engine that powers the Microsoft Edge web browser and Windows 10 web app platform, and that helps web developers build and maintain a consistent site across all modern browsers. The Microsoft EdgeHTML engine also helps to defend against hacking through support for the W3C standard for [Content Security Policy (CSP)](https://developer.microsoft.com/microsoft-edge/platform/documentation/dev-guide/security/content-Security-Policy), which can help web developers defend their sites against cross-site scripting attacks, and support for the [HTTP Strict Transport Security (HSTS)](https://developer.microsoft.com/microsoft-edge/platform/documentation/dev-guide/security/HSTS/) security feature (IETF-standard compliant), which helps ensure that connections to important sites, such as to your bank, are always secured. - -**Q: Will Windows 7 or Windows 8.1 users get Microsoft Edge or the new Microsoft EdgeHTML rendering engine?** - -**A:** No. Microsoft Edge has been designed and built to showcase Windows 10 features like Cortana, and is built on top of the Universal Windows Platform. +## How do I find out what version of Microsoft Edge I have? +In the upper right corner of Microsoft Edge, click the ellipses icon (**...**), and then click **Settings**. Look in the **About Microsoft Edge** section to find your version. +## What is Microsoft EdgeHTML? +Microsoft EdgeHTML is the web rendering engine that powers the current Microsoft Edge web browser and Windows 10 web app platform. (As opposed to *Microsoft Edge, based on Chromium*.) diff --git a/browsers/edge/microsoft-edge-forrester.md b/browsers/edge/microsoft-edge-forrester.md index 46e097832b..23c3505440 100644 --- a/browsers/edge/microsoft-edge-forrester.md +++ b/browsers/edge/microsoft-edge-forrester.md @@ -1,10 +1,13 @@ --- title: Forrester Total Economic Impact - Microsoft Edge +ms.reviewer: +audience: itpro +manager: dansimp description: Review the results of the Microsoft Edge study carried out by Forrester Research ms.prod: edge ms.topic: article -author: lizap -ms.author: elizapo +author: dansimp +ms.author: dansimp ms.localizationpriority: high --- # Measuring the impact of Microsoft Edge - Total Economic Impact (TEI) of Microsoft Edge @@ -14,7 +17,7 @@ Forrester Research measures the return on investment (ROI) of Microsoft Edge in ## Forrester report video summary View a brief overview of the Forrester TEI case study that Microsoft commissioned to examine the value your organization can achieve by utilizing Microsoft Edge: ->![VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE26zQm] +> ![VIDEO ] ## Forrester Study report @@ -31,4 +34,4 @@ Get a graphical summary of the TEI of Microsoft Edge Forrester Study report and Forrester surveyed 168 customers using Microsoft Edge form the US, Germany, UK, and Japan, ranging in size from 500 to over 100,000 employees. This document is an abridged version of this survey commissioned by Microsoft and delivery by Forrester consulting. -[Download the survey infographic](https://www.microsoft.com/download/details.aspx?id=53892) \ No newline at end of file +[Download the survey infographic](https://www.microsoft.com/download/details.aspx?id=53892) diff --git a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md index 81e06a0a9d..c4141688d8 100644 --- a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md +++ b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md @@ -1,24 +1,34 @@ --- -title: Deploy Microsoft Edge kiosk mode -description: Microsoft Edge kiosk mode works with assigned access to allow IT admins to create a tailored browsing experience designed for kiosk devices. To use Microsoft Edge kiosk mode, you must configure Microsoft Edge as an application in assigned access. +title: Deploy Microsoft Edge Legacy kiosk mode +description: Microsoft Edge Legacy kiosk mode works with assigned access to allow IT admins to create a tailored browsing experience designed for kiosk devices. To use Microsoft Edge Legacy kiosk mode, you must configure Microsoft Edge Legacy as an application in assigned access. ms.assetid: -author: shortpatti -ms.author: pashort +ms.reviewer: +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp ms.prod: edge ms.sitesec: library -ms.topic: get-started-article +ms.topic: article ms.localizationpriority: medium -ms.date: 10/29/2018 +ms.date: 01/17/2020 --- -# Deploy Microsoft Edge kiosk mode +# Deploy Microsoft Edge Legacy kiosk mode ->Applies to: Microsoft Edge on Windows 10, version 1809 ->Professional, Enterprise, and Education +>Applies to: Microsoft Edge Legacy (version 45 and earlier) on Windows 10, version 1809 or later +>Professional, Enterprise, and Education -In the Windows 10 October 2018 Update, we added the capability to use Microsoft Edge as a kiosk using assigned access. With assigned access, you create a tailored browsing experience locking down a Windows 10 device to only run as a single-app or multi-app kiosk. Assigned access restricts a local standard user account so that it only has access to one or more Windows app, such as Microsoft Edge in kiosk mode. +> [!NOTE] +> You've reached the documentation for Microsoft Edge Legacy (version 45 and earlier.) To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). For information about kiosk mode in the new version of Microsoft Edge, see [Microsoft Edge kiosk mode](https://docs.microsoft.com/DeployEdge/microsoft-edge-kiosk-mode). -In this topic, you learn how to configure the behavior of Microsoft Edge when it's running in kiosk mode with assigned access. You also learn how to set up your kiosk device using either Windows Setting or Microsoft Intune or other MDM service. +In the Windows 10 October 2018 Update, we added the capability to use Microsoft Edge Legacy as a kiosk using assigned access. With assigned access, you create a tailored browsing experience locking down a Windows 10 device to only run as a single-app or multi-app kiosk. Assigned access restricts a local standard user account so that it only has access to one or more Windows app, such as Microsoft Edge Legacy in kiosk mode. + +In this topic, you'll learn: + +- How to configure the behavior of Microsoft Edge Legacy when it's running in kiosk mode with assigned access. +- What's required to run Microsoft Edge Legacy kiosk mode on your kiosk devices. +- You'll also learn how to set up your kiosk device using either Windows Setting or Microsoft Intune or an other MDM service. At the end of this topic, you can find a list of [supported policies](#supported-policies-for-kiosk-mode) for kiosk mode and a [feature comparison](#feature-comparison-of-kiosk-mode-and-kiosk-browser-app) of the kiosk mode policy and kiosk browser app. You also find instructions on how to provide us feedback or get support. @@ -27,7 +37,7 @@ At the end of this topic, you can find a list of [supported policies](#supported >**Policy** = Configure kiosk mode (ConfigureKioskMode) -Microsoft Edge kiosk mode supports four configurations types that depend on how Microsoft Edge is set up with assigned access, either as a single-app or multi-app kiosk. These configuration types help you determine what is best suited for your kiosk device or scenario. +Microsoft Edge Legacy kiosk mode supports four configurations types that depend on how Microsoft Edge Legacy is set up with assigned access, either as a single-app or multi-app kiosk. These configuration types help you determine what is best suited for your kiosk device or scenario. - Learn about [creating a kiosk experience](https://docs.microsoft.com/windows-hardware/customize/enterprise/create-a-kiosk-image) @@ -38,15 +48,17 @@ Microsoft Edge kiosk mode supports four configurations types that depend on how - Learn about configuring a more secure kiosk experience: [Other settings to lock down](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage#other-settings-to-lock-down). -### Important things to remember before getting started +### Important things to note before getting started -- The public browsing kiosk types run Microsoft Edge InPrivate mode to protect user data with a browsing experience designed for public kiosks. +- There are [required steps to follow](#setup- required-for-microsoft-edge-legacy-kiosk-mode) in order to use the following Microsoft Edge Legacy kiosk mode types either alongside the new version of Microsoft Edge or prevent the new version of Microsoft Edge from being installed on your kiosk device. -- Microsoft Edge kiosk mode has a built-in timer to help keep data safe in public browsing sessions. When the idle time (no user activity) meets the time limit, a confirmation message prompts the user to continue, and if no user activity Microsoft Edge resets the session to the default URL. By default, the idle timer is 5 minutes, but you can choose a value of your own. +- The public browsing kiosk types run Microsoft Edge Legacy InPrivate mode to protect user data with a browsing experience designed for public kiosks. + +- Microsoft Edge Legacy kiosk mode has a built-in timer to help keep data safe in public browsing sessions. When the idle time (no user activity) meets the time limit, a confirmation message prompts the user to continue, and if no user activity Microsoft Edge Legacy resets the session to the default URL. By default, the idle timer is 5 minutes, but you can choose a value of your own. - Optionally, you can define a single URL for the Home button, Start page, and New Tab page. See [Supported policies for kiosk mode](#supported-policies-for-kiosk-mode) to learn more. -- No matter which configuration type you choose, you must set up Microsoft Edge in assigned access; otherwise, Microsoft Edge ignores the settings in this policy (Configure kiosk mode/ConfigureKioskMode).

Learn more about assigned access: +- No matter which configuration type you choose, you must set up Microsoft Edge Legacy in assigned access; otherwise, Microsoft Edge Legacy ignores the settings in this policy (Configure kiosk mode/ConfigureKioskMode).

Learn more about assigned access: - [Configure kiosk and shared devices running Windows desktop editions](https://aka.ms/E489vw). @@ -59,46 +71,58 @@ Microsoft Edge kiosk mode supports four configurations types that depend on how [!INCLUDE [configure-kiosk-mode-supported-values-include](includes/configure-kiosk-mode-supported-values-include.md)] -## Set up Microsoft Edge kiosk mode +## Set up Microsoft Edge Legacy kiosk mode -Now that you're familiar with the different kiosk mode configurations and have the one you want to use in mind, you can use one of the following methods to set up Microsoft Edge kiosk mode: +Now that you're familiar with the different kiosk mode configurations and have the one you want to use in mind, you can use one of the following methods to set up Microsoft Edge Legacy kiosk mode: - **Windows Settings.** Use only to set up a couple of single-app devices because you perform these steps physically on each device. For a multi-app kiosk device, use Microsoft Intune or other MDM service. -- **Microsoft Intune or other MDM service.** Use to set up several single-app or multi-app kiosk devices. Microsoft Intune and other MDM service providers offer more options for customizing the Microsoft Edge kiosk mode experience using any of the [Supported policies for kiosk mode](#supported-policies-for-kiosk-mode). +- **Microsoft Intune or other MDM service.** Use to set up several single-app or multi-app kiosk devices. Microsoft Intune and other MDM service providers offer more options for customizing the Microsoft Edge Legacy kiosk mode experience using any of the [Supported policies for kiosk mode](#supported-policies-for-kiosk-mode). ### Prerequisites -- Microsoft Edge on Windows 10, version 1809 (Professional, Enterprise, and Education). +- Microsoft Edge Legacy on Windows 10, version 1809 (Professional, Enterprise, and Education). + +- See [Setup required for Microsoft Edge Legacy kiosk mode](#setup-required-for-microsoft-edge-legacy-kiosk-mode). - URL to load when the kiosk launches. The URL that you provide sets the Home button, Start page, and New Tab page. -- _**For Microsoft Intune or other MDM service**_, you must have the AppUserModelID (AUMID) to set up Microsoft Edge: +- _**For Microsoft Intune or other MDM service**_, you must have the AppUserModelID (AUMID) to set up Microsoft Edge Legacy: ``` Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge ``` +### Setup required for Microsoft Edge Legacy kiosk mode + +When the new version of Microsoft Edge Stable channel is installed, Microsoft Edge Legacy is hidden and all attempts to launch Microsoft Edge Legacy are redirected to the new version of Microsoft Edge. + +To continue using Microsoft Edge Legacy kiosk mode on your kiosk devices take one of the following actions: + +- If you plan to install Microsoft Edge Stable channel, want to allow it to be installed, or it is already installed on your kiosk device set the Microsoft Edge [Allow Microsoft Edge Side by Side browser experience](https://docs.microsoft.com/DeployEdge/microsoft-edge-update-policies#allowsxs) policy to **Enabled**. +- To prevent Microsoft Edge Stable channel from being installed on your kiosk devices deploy the Microsoft Edge [Allow installation default](https://docs.microsoft.com/DeployEdge/microsoft-edge-update-policies#installdefault) policy for Stable channel or consider using the [Blocker toolkit](https://docs.microsoft.com/DeployEdge/microsoft-edge-blocker-toolkit) to disable automatic delivery of Microsoft Edge. + +> [!NOTE] +> For more information about accessing Microsoft Edge Legacy after installing Microsoft Edge, see [How to access the old version of Microsoft Edge](https://docs.microsoft.com/DeployEdge/microsoft-edge-sysupdate-access-old-edge). ### Use Windows Settings Windows Settings is the simplest and the only way to set up one or a couple of single-app devices. - 1. On the kiosk device, open Windows Settings, and in the search field type **kiosk** and then select **Set up a kiosk (assigned access)**. 2. On the **Set up a kiosk** page, click **Get started**. 3. Type a name to create a new kiosk account, or choose an existing account from the populated list and click **Next**. -4. On the **Choose a kiosk app** page, select **Microsoft Edge** and then click **Next**. +4. On the **Choose a kiosk app** page, select **Microsoft Edge Legacy** and then click **Next**. -5. Select how Microsoft Edge displays when running in kiosk mode: +5. Select how Microsoft Edge Legacy displays when running in kiosk mode: - - **As a digital sign or interactive display** - Displays a specific site in full-screen mode, running Microsoft Edge InPrivate protecting user data. + - **As a digital sign or interactive display** - Displays a specific site in full-screen mode, running Microsoft Edge Legacy InPrivate protecting user data. - - **As a public browser** - Runs a limited multi-tab version of Microsoft Edge, protecting user data. + - **As a public browser** - Runs a limited multi-tab version of Microsoft Edge Legacy, protecting user data. 6. Select **Next**. @@ -118,42 +142,42 @@ Windows Settings is the simplest and the only way to set up one or a couple of s - User your new kiosk device.

OR

-- Make changes to your kiosk device. In Windows Settings, on the **Set up a kiosk** page, make your changes to **Choose a kiosk mode** and **Set up Microsoft Edge**. +- Make changes to your kiosk device. In Windows Settings, on the **Set up a kiosk** page, make your changes to **Choose a kiosk mode** and **Set up Microsoft Edge Legacy**. --- ### Use Microsoft Intune or other MDM service -With this method, you can use Microsoft Intune or other MDM services to configure Microsoft Edge kiosk mode in assigned access and how it behaves on a kiosk device. To learn about a few app fundamentals and requirements before adding them to Intune, see [Add apps to Microsoft Intune](https://docs.microsoft.com/intune/apps-add). +With this method, you can use Microsoft Intune or other MDM services to configure Microsoft Edge Legacy kiosk mode in assigned access and how it behaves on a kiosk device. To learn about a few app fundamentals and requirements before adding them to Intune, see [Add apps to Microsoft Intune](https://docs.microsoft.com/intune/apps-add). >[!IMPORTANT] >If you are using a local account as a kiosk account in Microsoft Intune, make sure to sign into this account and then sign out before configuring the kiosk device. 1. In Microsoft Intune or other MDM service, configure [AssignedAccess](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to prevent users from accessing the file system, running executables, or other apps. -2. Configure the following MDM settings to setup Microsoft Edge kiosk mode on the kiosk device and then restart the device. +2. Configure the following MDM settings to setup Microsoft Edge Legacy kiosk mode on the kiosk device and then restart the device. | | | |---|---| - | **[ConfigureKioskMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode)**

![](images/icon-thin-line-computer.png) | Configure the display mode for Microsoft Edge as a kiosk app.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskMode

**Data type:** Integer

**Allowed values:**

  • **Single-app kiosk experience**
    • **0** - Digital signage and interactive display
    • **1** - InPrivate Public browsing
  • **Multi-app kiosk experience**
    • **0** - Normal Microsoft Edge running in assigned access
    • **1** - InPrivate public browsing with other apps
| - | **[ConfigureKioskResetAfterIdleTimeout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout)**

![](images/icon-thin-line-computer.png) | Change the time in minutes from the last user activity before Microsoft Edge kiosk mode resets the user's session.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskResetAfterIdleTimeout

**Data type:** Integer

**Allowed values:**

  • **0** - No idle timer
  • **1-1440 (5 minutes is the default)** - Set reset on idle timer
| - | **[HomePages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-homepages)**

![](images/icon-thin-line-computer.png) | Set one or more start pages, URLs, to load when Microsoft Edge launches.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/HomePages

**Data type:** String

**Allowed values:**

Enter one or more URLs, for example,
   \\ | + | **[ConfigureKioskMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode)**

![](images/icon-thin-line-computer.png) | Configure the display mode for Microsoft Edge Legacy as a kiosk app.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskMode

**Data type:** Integer

**Allowed values:**

  • **Single-app kiosk experience**
    • **0** - Digital signage and interactive display
    • **1** - InPrivate Public browsing
  • **Multi-app kiosk experience**
    • **0** - Normal Microsoft Edge Legacy running in assigned access
    • **1** - InPrivate public browsing with other apps
| + | **[ConfigureKioskResetAfterIdleTimeout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout)**

![](images/icon-thin-line-computer.png) | Change the time in minutes from the last user activity before Microsoft Edge Legacy kiosk mode resets the user's session.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureKioskResetAfterIdleTimeout

**Data type:** Integer

**Allowed values:**

  • **0** - No idle timer
  • **1-1440 (5 minutes is the default)** - Set reset on idle timer
| + | **[HomePages](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-homepages)**

![](images/icon-thin-line-computer.png) | Set one or more start pages, URLs, to load when Microsoft Edge Legacy launches.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/HomePages

**Data type:** String

**Allowed values:**

Enter one or more URLs, for example,
   \\ | | **[ConfigureHomeButton](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton)**

![](images/icon-thin-line-computer.png) | Configure how the Home Button behaves.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ConfigureHomeButton

**Data type:** Integer

**Allowed values:**

  • **0 (default)** - Not configured. Show home button, and load the default Start page.
  • **1** - Enabled. Show home button and load New Tab page
  • **2** - Enabled. Show home button & set a specific page.
  • **3** - Enabled. Hide the home button.
| | **[SetHomeButtonURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl)**

![](images/icon-thin-line-computer.png) | If you set ConfigureHomeButton to 2, configure the home button URL.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetHomeButtonURL

**Data type:** String

**Allowed values:** Enter a URL, for example, https://www.bing.com | | **[SetNewTabPageURL](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl)**

![](images/icon-thin-line-computer.png) | Set a custom URL for the New Tab page.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetNewTabPageURL

**Data type:** String

**Allowed values:** Enter a URL, for example, https://www.msn.com | -**_Congratulations!_**

You’ve just finished setting up a kiosk or digital signage with policies for Microsoft Edge kiosk mode using Microsoft Intune or other MDM service. +**_Congratulations!_**

You’ve just finished setting up a kiosk or digital signage with policies for Microsoft Edge Legacy kiosk mode using Microsoft Intune or other MDM service. -**_What's next?_**

Now it's time to use your new kiosk device. Sign into the device with the kiosk account selected to run Microsoft Edge kiosk mode. +**_What's next?_**

Now it's time to use your new kiosk device. Sign into the device with the kiosk account selected to run Microsoft Edge Legacy kiosk mode. --- ## Supported policies for kiosk mode -Use any of the Microsoft Edge policies listed below to enhance the kiosk experience depending on the Microsoft Edge kiosk mode type you configure. To learn more about these policies, see [Policy CSP - Browser](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser). +Use any of the Microsoft Edge Legacy policies listed below to enhance the kiosk experience depending on the Microsoft Edge Legacy kiosk mode type you configure. To learn more about these policies, see [Policy CSP - Browser](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser). Make sure to check with your provider for instructions. @@ -230,34 +254,32 @@ Make sure to check with your provider for instructions. --- ## Feature comparison of kiosk mode and kiosk browser app -In the following table, we show you the features available in both Microsoft Edge kiosk mode and Kiosk Browser app available in Microsoft Store. Both kiosk mode and kiosk browser app work in assigned access. -| **Feature** | **Microsoft Edge kiosk mode** | **Microsoft Kiosk browser app** | -|---------------|:----------------:|:---------------:| -| Print support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | -| Multi-tab support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | -| Allow/Block URL support | ![Supported](images/148767.png)

*\*For Microsoft Edge kiosk mode use* Windows Defender Firewall*. Microsoft kiosk browser has custom policy support.* | ![Supported](images/148767.png) | -| Configure Home Button | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| Set Start page(s) URL | ![Supported](images/148767.png) | ![Supported](images/148767.png)

*Same as Home button URL* | -| Set New Tab page URL | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | -| Favorites management | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | -| End session button | ![Supported](images/148767.png) | ![Supported](images/148767.png)

*In Microsoft Intune, you must create a custom URI to enable. Dedicated UI configuration introduced in version 1808.* | -| Reset on inactivity | ![Supported](images/148767.png) | ![Supported](images/148767.png) | -| Internet Explorer integration (Enterprise Mode site list) | ![Supported](images/148767.png)

*Multi-app mode only* | ![Not supported](images/148766.png) | -| Available in Microsoft Store | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -|SKU availability | Windows 10 October 2018 Update
Professional, Enterprise, and Education | Windows 10 April 2018 Update
Professional, Enterprise, and Education | +In the following table, we show you the features available in both Microsoft Edge Legacy kiosk mode and Kiosk Browser app available in Microsoft Store. Both kiosk mode and kiosk browser app work in assigned access. +| **Feature** | **Microsoft Edge Legacy kiosk mode** | **Microsoft Kiosk browser app** | +|-----------------------------------------------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------:|:-------------------------------------------------------------------------------------------------------------------------------------------------------:| +| Print support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | +| Multi-tab support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | +| Allow/Block URL support | ![Not Supported](images/148766.png) ![Supported](images/148767.png) | +| Configure Home Button | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| Set Start page(s) URL | ![Supported](images/148767.png) | ![Supported](images/148767.png)

*Same as Home button URL* | +| Set New Tab page URL | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | +| Favorites management | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | +| End session button | ![Supported](images/148767.png) | ![Supported](images/148767.png)

*In Microsoft Intune, you must create a custom URI to enable. Dedicated UI configuration introduced in version 1808.* | +| Reset on inactivity | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| Internet Explorer integration (Enterprise Mode site list) | ![Supported](images/148767.png)

*Multi-app mode only* | ![Not supported](images/148766.png) | +| Available in Microsoft Store | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| SKU availability | Windows 10 October 2018 Update
Professional, Enterprise, and Education | Windows 10 April 2018 Update
Professional, Enterprise, and Education | + **\*Windows Defender Firewall**

-To prevent access to unwanted websites on your kiosk device, use Windows Defender Firewall to configure a list of allowed websites, blocked websites or both. For more details, see [Windows Defender Firewall with Advanced Security Deployment](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide). +To prevent access to unwanted websites on your kiosk device, use Windows Defender Firewall to configure a list of allowed websites, blocked websites or both, using IP addresses. For more details, see [Windows Defender Firewall with Advanced Security Deployment Guide](https://docs.microsoft.com/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide). --- ## Provide feedback or get support -To provide feedback on Microsoft Edge kiosk mode in Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. +To provide feedback on Microsoft Edge Legacy kiosk mode in Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. **_For multi-app kiosk only._** If you have set up the Feedback Hub in assigned access, you can you submit the feedback from the device running Microsoft Edge in kiosk mode in which you can include diagnostic logs. In the Feedback Hub, select **Microsoft Edge** as the **Category**, and **All other issues** as the subcategory. - - - diff --git a/browsers/edge/microsoft-edge.yml b/browsers/edge/microsoft-edge.yml index 1d5723ae94..5c105dcdc2 100644 --- a/browsers/edge/microsoft-edge.yml +++ b/browsers/edge/microsoft-edge.yml @@ -33,14 +33,14 @@ sections: - type: markdown text: " Even if you still have legacy apps in your organization, you can default to the secure, modern experience of Microsoft Edge and provide a consistent level of compatibility with existing legacy applications.
- +

**Test your site on Microsoft Edge**
Test your site on Microsoft Edge for free instantly, with remote browser testing powered by BrowserStack. You can also use the linting tool sonarwhal to assess your site's accessibility, speed, security, and more.
Test your site on Microsoft Edge for free on BrowserStack
Use sonarwhal to improve your website.
**Improve compatibility with Enterprise Mode**
With Enterprise Mode you can use Microsoft Edge as your default browser, while ensuring apps continue working on IE11.
Use Enterprse mode to improve compatibility
Turn on Enterprise Mode and use a site list
Enterprise Site List Portal
Ultimate browser strategy on Windows 10
**Web Application Compatibility Lab Kit**
The Web Application Compatibility Lab Kit is a primer for the features and techniques used to provide web application compatibility during a typical enterprise migration to Microsoft Edge.
Find out more

**Test your site on Microsoft Edge**
Test your site on Microsoft Edge for free instantly, with remote browser testing powered by BrowserStack. You can also use the linting tool sonarwhal to assess your site's accessibility, speed, security, and more.
Test your site on Microsoft Edge for free on BrowserStack
Use sonarwhal to improve your website.
**Improve compatibility with Enterprise Mode**
With Enterprise Mode you can use Microsoft Edge as your default browser, while ensuring apps continue working on IE11.
Use Enterprise mode to improve compatibility
Turn on Enterprise Mode and use a site list
Enterprise Site List Portal
Ultimate browser strategy on Windows 10
**Web Application Compatibility Lab Kit**
The Web Application Compatibility Lab Kit is a primer for the features and techniques used to provide web application compatibility during a typical enterprise migration to Microsoft Edge.
Find out more
" - title: Security - items: - type: markdown text: " - Microsoft Edge uses Windows Hello and SmartScreen to defend against phishing and malware. Take a look at some of the additional features behind the strong defense that Microsoft Edge provides against web-based attacks.
+ Microsoft Edge uses Windows Hello and Windows Defender SmartScreen to defend against phishing and malware. Take a look at some of the additional features behind the strong defense that Microsoft Edge provides against web-based attacks.

**NSS Labs web browser security reports**
See the results of two global tests measuring how effective browsers are at protecting against socially engineered malware and phishing attacks.
Download the reports
**Microsoft Edge sandbox**
See how Microsoft Edge has significantly reduced the attack surface of the sandbox by configuring the app container to further reduce its privilege.
Find out more
**Windows Defender SmartScreen**
Manage your organization's computer settings with Group Policy and MDM settings to display a warning page to employees or block a site entirely.
Read the docs
" diff --git a/browsers/edge/shortdesc/allow-a-shared-books-folder-shortdesc.md b/browsers/edge/shortdesc/allow-a-shared-books-folder-shortdesc.md index 7eb5da6bd4..ecfa4c5ca0 100644 --- a/browsers/edge/shortdesc/allow-a-shared-books-folder-shortdesc.md +++ b/browsers/edge/shortdesc/allow-a-shared-books-folder-shortdesc.md @@ -1,9 +1,12 @@ --- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp ms.prod: edge -ms:topic: include +ms.topic: include --- -Microsoft Edge does not use a shared folder by default but downloads book files to a per-user folder for each user. With this policy, you can configure Microsoft Edge to store books from the Books Library to a default, shared folder in Windows, which decreases the amount of storage used by book files. When you enable this policy, Microsoft Edge downloads books to a shared folder after user action to download the book to their device, which allows them to remove downloaded books at any time. For this policy to work correctly, you must also enable the **Allow a Windows app to share application data between users** group policy. Also, the users must be signed in with a school or work account. \ No newline at end of file +Microsoft Edge does not use a shared folder by default but downloads book files to a per-user folder for each user. With this policy, you can configure Microsoft Edge to store books from the Books Library to a default, shared folder in Windows, which decreases the amount of storage used by book files. When you enable this policy, Microsoft Edge downloads books to a shared folder after user action to download the book to their device, which allows them to remove downloaded books at any time. For this policy to work correctly, you must also enable the **Allow a Windows app to share application data between users** group policy. Also, the users must be signed in with a school or work account. diff --git a/browsers/edge/shortdesc/allow-address-bar-drop-down-shortdesc.md b/browsers/edge/shortdesc/allow-address-bar-drop-down-shortdesc.md index d970c98301..116864a49f 100644 --- a/browsers/edge/shortdesc/allow-address-bar-drop-down-shortdesc.md +++ b/browsers/edge/shortdesc/allow-address-bar-drop-down-shortdesc.md @@ -1,9 +1,12 @@ --- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp ms.prod: edge -ms:topic: include +ms.topic: include --- -Microsoft Edge shows the Address bar drop-down list and makes it available by default, which takes precedence over the Configure search suggestions in Address bar policy. We recommend disabling this policy if you want to minimize network connections from Microsoft Edge to Microsoft service, which hides the functionality of the Address bar drop-down list. When you disable this policy, Microsoft Edge also disables the _Show search and site suggestions as I type_ toggle in Settings. \ No newline at end of file +Microsoft Edge shows the Address bar drop-down list and makes it available by default, which takes precedence over the Configure search suggestions in Address bar policy. We recommend disabling this policy if you want to minimize network connections from Microsoft Edge to Microsoft service, which hides the functionality of the Address bar drop-down list. When you disable this policy, Microsoft Edge also disables the _Show search and site suggestions as I type_ toggle in Settings. diff --git a/browsers/edge/shortdesc/allow-adobe-flash-shortdesc.md b/browsers/edge/shortdesc/allow-adobe-flash-shortdesc.md index a06ece3f82..dca6cf6233 100644 --- a/browsers/edge/shortdesc/allow-adobe-flash-shortdesc.md +++ b/browsers/edge/shortdesc/allow-adobe-flash-shortdesc.md @@ -1,9 +1,12 @@ --- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp ms.prod: edge -ms:topic: include +ms.topic: include --- -Adobe Flash is integrated with Microsoft Edge and runs Adobe Flash content by default. With this policy, you can configure Microsoft Edge to prevent Adobe Flash content from running. \ No newline at end of file +Adobe Flash is integrated with Microsoft Edge and runs Adobe Flash content by default. With this policy, you can configure Microsoft Edge to prevent Adobe Flash content from running. diff --git a/browsers/edge/shortdesc/allow-clearing-browsing-data-on-exit-shortdesc.md b/browsers/edge/shortdesc/allow-clearing-browsing-data-on-exit-shortdesc.md index 75e6fa71ed..af3d4fefef 100644 --- a/browsers/edge/shortdesc/allow-clearing-browsing-data-on-exit-shortdesc.md +++ b/browsers/edge/shortdesc/allow-clearing-browsing-data-on-exit-shortdesc.md @@ -1,9 +1,12 @@ --- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp ms.prod: edge -ms:topic: include +ms.topic: include --- -Microsoft Edge does not clear the browsing data on exit by default, but users can configure the _Clear browsing data_ option in Settings. Browsing data includes information you entered in forms, passwords, and even the websites visited. With this policy, you can configure Microsoft Edge to clear the browsing data automatically each time Microsoft Edge closes. \ No newline at end of file +Microsoft Edge does not clear the browsing data on exit by default, but users can configure the _Clear browsing data_ option in Settings. Browsing data includes information you entered in forms, passwords, and even the websites visited. With this policy, you can configure Microsoft Edge to clear the browsing data automatically each time Microsoft Edge closes. diff --git a/browsers/edge/shortdesc/allow-configuration-updates-for-books-library-shortdesc.md b/browsers/edge/shortdesc/allow-configuration-updates-for-books-library-shortdesc.md index 69f981f0d4..40a927c882 100644 --- a/browsers/edge/shortdesc/allow-configuration-updates-for-books-library-shortdesc.md +++ b/browsers/edge/shortdesc/allow-configuration-updates-for-books-library-shortdesc.md @@ -1,9 +1,12 @@ --- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp ms.prod: edge -ms:topic: include +ms.topic: include --- -Microsoft Edge automatically updates the configuration data for the Books library. Disabling this policy prevents Microsoft Edge from updating the configuration data. If Microsoft receives feedback about the amount of data about the Books library, the data comes as a JSON file. \ No newline at end of file +Microsoft Edge automatically updates the configuration data for the Books library. Disabling this policy prevents Microsoft Edge from updating the configuration data. If Microsoft receives feedback about the amount of data about the Books library, the data comes as a JSON file. diff --git a/browsers/edge/shortdesc/allow-cortana-shortdesc.md b/browsers/edge/shortdesc/allow-cortana-shortdesc.md index cc694ab73b..fbfa0f13b0 100644 --- a/browsers/edge/shortdesc/allow-cortana-shortdesc.md +++ b/browsers/edge/shortdesc/allow-cortana-shortdesc.md @@ -1,9 +1,12 @@ --- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp ms.prod: edge -ms:topic: include +ms.topic: include --- -Since Microsoft Edge is integration with Cortana, Microsoft Edge allows users to use Cortana voice assistant by default. With this policy, you can configure Microsoft Edge to prevent users from using Cortana but can still search to find items on their device. \ No newline at end of file +Since Microsoft Edge is integration with Cortana, Microsoft Edge allows users to use Cortana voice assistant by default. With this policy, you can configure Microsoft Edge to prevent users from using Cortana but can still search to find items on their device. diff --git a/browsers/edge/shortdesc/allow-developer-tools-shortdesc.md b/browsers/edge/shortdesc/allow-developer-tools-shortdesc.md index ef095e5733..9d134d4a38 100644 --- a/browsers/edge/shortdesc/allow-developer-tools-shortdesc.md +++ b/browsers/edge/shortdesc/allow-developer-tools-shortdesc.md @@ -1,9 +1,12 @@ --- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro +manager: dansimp ms.prod: edge -ms:topic: include +ms.topic: include --- -Microsoft Edge allows users to use the F12 developer tools to build and debug web pages by default. With this policy, you can configure Microsoft Edge to prevent users from using the F12 developer tools. \ No newline at end of file +Microsoft Edge allows users to use the F12 developer tools to build and debug web pages by default. With this policy, you can configure Microsoft Edge to prevent users from using the F12 developer tools. diff --git a/browsers/edge/shortdesc/allow-extended-telemetry-for-books-tab-shortdesc.md b/browsers/edge/shortdesc/allow-extended-telemetry-for-books-tab-shortdesc.md index 1bbf337754..9d39c7e091 100644 --- a/browsers/edge/shortdesc/allow-extended-telemetry-for-books-tab-shortdesc.md +++ b/browsers/edge/shortdesc/allow-extended-telemetry-for-books-tab-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, and depending on the device configuration, Microsoft Edge gathers basic diagnostic data about the books in the Books Library and sends it to Microsoft. Enabling this policy gathers and sends both basic and additional diagnostic data, such as usage data. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, and depending on the device configuration, Microsoft Edge gathers basic diagnostic data about the books in the Books Library and sends it to Microsoft. Enabling this policy gathers and sends both basic and additional diagnostic data, such as usage data. diff --git a/browsers/edge/shortdesc/allow-extensions-shortdesc.md b/browsers/edge/shortdesc/allow-extensions-shortdesc.md index 41849af3ef..ca5e422178 100644 --- a/browsers/edge/shortdesc/allow-extensions-shortdesc.md +++ b/browsers/edge/shortdesc/allow-extensions-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge allows users to add or personalize extensions in Microsoft Edge by default. With this policy, you can configure Microsoft to prevent users from adding or personalizing extensions. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge allows users to add or personalize extensions in Microsoft Edge by default. With this policy, you can configure Microsoft to prevent users from adding or personalizing extensions. diff --git a/browsers/edge/shortdesc/allow-fullscreen-mode-shortdesc.md b/browsers/edge/shortdesc/allow-fullscreen-mode-shortdesc.md index 6f37d4a659..1aca979b7e 100644 --- a/browsers/edge/shortdesc/allow-fullscreen-mode-shortdesc.md +++ b/browsers/edge/shortdesc/allow-fullscreen-mode-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge allows fullscreen mode by default, which shows only the web content and hides the Microsoft Edge UI. When allowing fullscreen mode, users and extensions must have the proper permissions. Disabling this policy prevents fullscreen mode in Microsoft Edge. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge allows fullscreen mode by default, which shows only the web content and hides the Microsoft Edge UI. When allowing fullscreen mode, users and extensions must have the proper permissions. Disabling this policy prevents fullscreen mode in Microsoft Edge. diff --git a/browsers/edge/shortdesc/allow-inprivate-browsing-shortdesc.md b/browsers/edge/shortdesc/allow-inprivate-browsing-shortdesc.md index 0171d9c8a5..4e15608ff7 100644 --- a/browsers/edge/shortdesc/allow-inprivate-browsing-shortdesc.md +++ b/browsers/edge/shortdesc/allow-inprivate-browsing-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge allows InPrivate browsing, and after closing all InPrivate tabs, Microsoft Edge deletes the browsing data from the device. With this policy, you can configure Microsoft Edge to prevent InPrivate web browsing. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge allows InPrivate browsing, and after closing all InPrivate tabs, Microsoft Edge deletes the browsing data from the device. With this policy, you can configure Microsoft Edge to prevent InPrivate web browsing. diff --git a/browsers/edge/shortdesc/allow-microsoft-compatibility-list-shortdesc.md b/browsers/edge/shortdesc/allow-microsoft-compatibility-list-shortdesc.md index 769d1ee379..46d2b5f57e 100644 --- a/browsers/edge/shortdesc/allow-microsoft-compatibility-list-shortdesc.md +++ b/browsers/edge/shortdesc/allow-microsoft-compatibility-list-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -During browser navigation, Microsoft Edge checks the Microsoft Compatibility List for websites with known compatibility issues. If found, users are prompted to use Internet Explorer, where the site loads and displays correctly. Periodically during browser navigation, Microsoft Edge downloads the latest version of the list and applies the updates. With this policy, you can configure Microsoft Edge to ignore the compatibility list. You can view the compatibility list at about:compat. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +During browser navigation, Microsoft Edge checks the Microsoft Compatibility List for websites with known compatibility issues. If found, users are prompted to use Internet Explorer, where the site loads and displays correctly. Periodically during browser navigation, Microsoft Edge downloads the latest version of the list and applies the updates. With this policy, you can configure Microsoft Edge to ignore the compatibility list. You can view the compatibility list at about:compat. diff --git a/browsers/edge/shortdesc/allow-prelaunch-shortdesc.md b/browsers/edge/shortdesc/allow-prelaunch-shortdesc.md index 3d939db8c0..fcaf11e3ef 100644 --- a/browsers/edge/shortdesc/allow-prelaunch-shortdesc.md +++ b/browsers/edge/shortdesc/allow-prelaunch-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge pre-launches as a background process during Windows startup when the system is idle waiting to be launched by the user. Pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start Microsoft Edge. You can also configure Microsoft Edge to prevent from pre-launching. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge pre-launches as a background process during Windows startup when the system is idle waiting to be launched by the user. Pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start Microsoft Edge. You can also configure Microsoft Edge to prevent from pre-launching. diff --git a/browsers/edge/shortdesc/allow-printing-shortdesc.md b/browsers/edge/shortdesc/allow-printing-shortdesc.md index b9e4cf691f..f03766176c 100644 --- a/browsers/edge/shortdesc/allow-printing-shortdesc.md +++ b/browsers/edge/shortdesc/allow-printing-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge allows users to print web content by default. With this policy, you can configure Microsoft Edge to prevent users from printing web content. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge allows users to print web content by default. With this policy, you can configure Microsoft Edge to prevent users from printing web content. diff --git a/browsers/edge/shortdesc/allow-saving-history-shortdesc.md b/browsers/edge/shortdesc/allow-saving-history-shortdesc.md index e37a1e9bfc..9acffb1e18 100644 --- a/browsers/edge/shortdesc/allow-saving-history-shortdesc.md +++ b/browsers/edge/shortdesc/allow-saving-history-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge saves the browsing history of visited websites and shows them in the History pane by default. Disabling this policy prevents Microsoft Edge from saving the browsing history. If browsing history existed before disabling this policy, the previous browsing history remains in the History pane. Disabling this policy does not stop roaming of existing browsing history or browsing history from other devices. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge saves the browsing history of visited websites and shows them in the History pane by default. Disabling this policy prevents Microsoft Edge from saving the browsing history. If browsing history existed before disabling this policy, the previous browsing history remains in the History pane. Disabling this policy does not stop roaming of existing browsing history or browsing history from other devices. diff --git a/browsers/edge/shortdesc/allow-search-engine-customization-shortdesc.md b/browsers/edge/shortdesc/allow-search-engine-customization-shortdesc.md index e94443a99b..4992a19eab 100644 --- a/browsers/edge/shortdesc/allow-search-engine-customization-shortdesc.md +++ b/browsers/edge/shortdesc/allow-search-engine-customization-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, users can add new search engines or change the default search engine, in Settings. With this policy, you can prevent users from customizing the search engine in Microsoft Edge. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, users can add new search engines or change the default search engine, in Settings. With this policy, you can prevent users from customizing the search engine in Microsoft Edge. diff --git a/browsers/edge/shortdesc/allow-sideloading-of-extensions-shortdesc.md b/browsers/edge/shortdesc/allow-sideloading-of-extensions-shortdesc.md index e9e9fd0512..e16dbdc2db 100644 --- a/browsers/edge/shortdesc/allow-sideloading-of-extensions-shortdesc.md +++ b/browsers/edge/shortdesc/allow-sideloading-of-extensions-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge allows sideloading, which installs and runs unverified extensions. Disabling this policy prevents sideloading of extensions but does not prevent sideloading using Add-AppxPackage via PowerShell. You can only install extensions through Microsoft store (including a store for business), enterprise storefront (such as Company Portal) or PowerShell (using Add-AppxPackage). \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge allows sideloading, which installs and runs unverified extensions. Disabling this policy prevents sideloading of extensions but does not prevent sideloading using Add-AppxPackage via PowerShell. You can only install extensions through Microsoft store (including a store for business), enterprise storefront (such as Company Portal) or PowerShell (using Add-AppxPackage). diff --git a/browsers/edge/shortdesc/allow-tab-preloading-shortdesc.md b/browsers/edge/shortdesc/allow-tab-preloading-shortdesc.md index b276822d74..783d8517ed 100644 --- a/browsers/edge/shortdesc/allow-tab-preloading-shortdesc.md +++ b/browsers/edge/shortdesc/allow-tab-preloading-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge allows preloading of the Start and New Tab pages during Windows sign in, and each time Microsoft Edge closes by default. Preloading minimizes the amount of time required to start Microsoft Edge and load a new tab. With this policy, you can configure Microsoft Edge to prevent preloading of tabs. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge allows preloading of the Start and New Tab pages during Windows sign in, and each time Microsoft Edge closes by default. Preloading minimizes the amount of time required to start Microsoft Edge and load a new tab. With this policy, you can configure Microsoft Edge to prevent preloading of tabs. diff --git a/browsers/edge/shortdesc/allow-web-content-on-new-tab-page-shortdesc.md b/browsers/edge/shortdesc/allow-web-content-on-new-tab-page-shortdesc.md index a056b0a737..eb2a40f269 100644 --- a/browsers/edge/shortdesc/allow-web-content-on-new-tab-page-shortdesc.md +++ b/browsers/edge/shortdesc/allow-web-content-on-new-tab-page-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 11/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge loads the default New Tab page and lets the users make changes. If you disable this policy, a blank page loads instead of the New Tab page and prevents users from changing it. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 11/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge loads the default New Tab page and lets the users make changes. If you disable this policy, a blank page loads instead of the New Tab page and prevents users from changing it. diff --git a/browsers/edge/shortdesc/allow-windows-app-to-share-data-users-shortdesc.md b/browsers/edge/shortdesc/allow-windows-app-to-share-data-users-shortdesc.md index 86ac25c632..51e769d22c 100644 --- a/browsers/edge/shortdesc/allow-windows-app-to-share-data-users-shortdesc.md +++ b/browsers/edge/shortdesc/allow-windows-app-to-share-data-users-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -With this policy, you can configure Windows 10 to share application data among multiple users on the system and with other instances of that app. Data shared through the SharedLocal folder is available through the Windows.Storage API. If you previously enabled this policy and now want to disable it, any shared app data remains in the SharedLocal folder. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +With this policy, you can configure Windows 10 to share application data among multiple users on the system and with other instances of that app. Data shared through the SharedLocal folder is available through the Windows.Storage API. If you previously enabled this policy and now want to disable it, any shared app data remains in the SharedLocal folder. diff --git a/browsers/edge/shortdesc/always-show-books-library-shortdesc.md b/browsers/edge/shortdesc/always-show-books-library-shortdesc.md index a91b389923..264f64a898 100644 --- a/browsers/edge/shortdesc/always-show-books-library-shortdesc.md +++ b/browsers/edge/shortdesc/always-show-books-library-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge shows the Books Library only in countries or regions where supported. With this policy, you can configure Microsoft Edge to show the Books Library regardless of the device’s country or region. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge shows the Books Library only in countries or regions where supported. With this policy, you can configure Microsoft Edge to show the Books Library regardless of the device’s country or region. diff --git a/browsers/edge/shortdesc/configure-additional-search-engines-shortdesc.md b/browsers/edge/shortdesc/configure-additional-search-engines-shortdesc.md index 39961b4f01..f4a61c024c 100644 --- a/browsers/edge/shortdesc/configure-additional-search-engines-shortdesc.md +++ b/browsers/edge/shortdesc/configure-additional-search-engines-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, users cannot add, remove, or change any of the search engines in Microsoft Edge, but they can set a default search engine. You can set the default search engine using the Set default search engine policy. However, with this policy, you can configure up to five additional search engines and set any one of them as the default. If you previously enabled this policy and now want to disable it, disabling deletes all configured search engines. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, users cannot add, remove, or change any of the search engines in Microsoft Edge, but they can set a default search engine. You can set the default search engine using the Set default search engine policy. However, with this policy, you can configure up to five additional search engines and set any one of them as the default. If you previously enabled this policy and now want to disable it, disabling deletes all configured search engines. diff --git a/browsers/edge/shortdesc/configure-adobe-flash-click-to-run-setting-shortdesc.md b/browsers/edge/shortdesc/configure-adobe-flash-click-to-run-setting-shortdesc.md index d0be48cb2b..0f73c32d5f 100644 --- a/browsers/edge/shortdesc/configure-adobe-flash-click-to-run-setting-shortdesc.md +++ b/browsers/edge/shortdesc/configure-adobe-flash-click-to-run-setting-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge supports Adobe Flash as a built-in feature rather than as an external add-on and updates automatically via Windows Update. By default, Microsoft Edge prevents Adobe Flash content from loading automatically, requiring action from the user, for example, clicking the **Click-to-Run** button. Depending on how often the content loads and runs, the sites for the content gets added to the auto-allowed list. Disable this policy if you want Adobe Flash content to load automatically. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge supports Adobe Flash as a built-in feature rather than as an external add-on and updates automatically via Windows Update. By default, Microsoft Edge prevents Adobe Flash content from loading automatically, requiring action from the user, for example, clicking the **Click-to-Run** button. Depending on how often the content loads and runs, the sites for the content gets added to the auto-allowed list. Disable this policy if you want Adobe Flash content to load automatically. diff --git a/browsers/edge/shortdesc/configure-autofill-shortdesc.md b/browsers/edge/shortdesc/configure-autofill-shortdesc.md index 1688989ef7..94441080d8 100644 --- a/browsers/edge/shortdesc/configure-autofill-shortdesc.md +++ b/browsers/edge/shortdesc/configure-autofill-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, users can choose to use the Autofill feature to populate the form fields automatically. With this policy, you can configure Microsoft Edge, when enabled to use Autofill or, when disabled to prevent using Autofill. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, users can choose to use the Autofill feature to populate the form fields automatically. With this policy, you can configure Microsoft Edge, when enabled to use Autofill or, when disabled to prevent using Autofill. diff --git a/browsers/edge/shortdesc/configure-browser-telemetry-for-m365-analytics-shortdesc.md b/browsers/edge/shortdesc/configure-browser-telemetry-for-m365-analytics-shortdesc.md index 32abbdf60a..75a3631a95 100644 --- a/browsers/edge/shortdesc/configure-browser-telemetry-for-m365-analytics-shortdesc.md +++ b/browsers/edge/shortdesc/configure-browser-telemetry-for-m365-analytics-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge does not send browsing history data to Microsoft 365 Analytics by default. With this policy though, you can configure Microsoft Edge to send intranet history only, internet history only, or both to Microsoft 365 Analytics for enterprise devices with a configured Commercial ID. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge does not send browsing history data to Microsoft 365 Analytics by default. With this policy though, you can configure Microsoft Edge to send intranet history only, internet history only, or both to Microsoft 365 Analytics for enterprise devices with a configured Commercial ID. diff --git a/browsers/edge/shortdesc/configure-cookies-shortdesc.md b/browsers/edge/shortdesc/configure-cookies-shortdesc.md index ea5cb7e557..93152d2e3d 100644 --- a/browsers/edge/shortdesc/configure-cookies-shortdesc.md +++ b/browsers/edge/shortdesc/configure-cookies-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge allows all cookies from all websites by default. With this policy, you can configure Microsoft to block only 3rd-party cookies or block all cookies. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge allows all cookies from all websites by default. With this policy, you can configure Microsoft to block only 3rd-party cookies or block all cookies. diff --git a/browsers/edge/shortdesc/configure-do-not-track-shortdesc.md b/browsers/edge/shortdesc/configure-do-not-track-shortdesc.md index f9de9cd2ec..dd27fad917 100644 --- a/browsers/edge/shortdesc/configure-do-not-track-shortdesc.md +++ b/browsers/edge/shortdesc/configure-do-not-track-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge does not send ‘Do Not Track’ requests to websites asking for tracking information, but users can choose to send tracking information to sites they visit. With this policy, you can configure Microsoft Edge to send or never send tracking information. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge does not send ‘Do Not Track’ requests to websites asking for tracking information, but users can choose to send tracking information to sites they visit. With this policy, you can configure Microsoft Edge to send or never send tracking information. diff --git a/browsers/edge/shortdesc/configure-enterprise-mode-site-list-shortdesc.md b/browsers/edge/shortdesc/configure-enterprise-mode-site-list-shortdesc.md index fd49f0e0c9..d13febee60 100644 --- a/browsers/edge/shortdesc/configure-enterprise-mode-site-list-shortdesc.md +++ b/browsers/edge/shortdesc/configure-enterprise-mode-site-list-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have sites or apps that use this technology, you can configure Microsoft Edge to check the Enterprise Mode Site List XML file that lists the sites and domains with compatibility issues and switch to IE11 automatically. You can use the same site list for both Microsoft Edge and IE11, or you can use separate lists. By default, Microsoft Edge ignores the Enterprise Mode and the Enterprise Mode Site List XML file. In this case, users might experience problems while using legacy apps. These sites and domains must be viewed using Internet Explorer 11 and Enterprise Mode. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have sites or apps that use this technology, you can configure Microsoft Edge to check the Enterprise Mode Site List XML file that lists the sites and domains with compatibility issues and switch to IE11 automatically. You can use the same site list for both Microsoft Edge and IE11, or you can use separate lists. By default, Microsoft Edge ignores the Enterprise Mode and the Enterprise Mode Site List XML file. In this case, users might experience problems while using legacy apps. These sites and domains must be viewed using Internet Explorer 11 and Enterprise Mode. diff --git a/browsers/edge/shortdesc/configure-favorites-bar-shortdesc.md b/browsers/edge/shortdesc/configure-favorites-bar-shortdesc.md index 0303f69e10..8f16c20242 100644 --- a/browsers/edge/shortdesc/configure-favorites-bar-shortdesc.md +++ b/browsers/edge/shortdesc/configure-favorites-bar-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge hides the favorites bar by default but shows it on the Start and New Tab pages. Also, by default, the Favorites Bar toggle, in Settings, is set to Off but enabled letting users make changes. With this policy, you can configure Microsoft Edge to either show or hide the Favorites Bar on all pages. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge hides the favorites bar by default but shows it on the Start and New Tab pages. Also, by default, the Favorites Bar toggle, in Settings, is set to Off but enabled letting users make changes. With this policy, you can configure Microsoft Edge to either show or hide the Favorites Bar on all pages. diff --git a/browsers/edge/shortdesc/configure-favorites-shortdesc.md b/browsers/edge/shortdesc/configure-favorites-shortdesc.md index ae90afc8af..9317df97f3 100644 --- a/browsers/edge/shortdesc/configure-favorites-shortdesc.md +++ b/browsers/edge/shortdesc/configure-favorites-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Discontinued in Windows 10, version 1809. Use the **[Provision Favorites](../available-policies.md#provision-favorites)** policy instead. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Discontinued in Windows 10, version 1809. Use the **[Provision Favorites](../available-policies.md#provision-favorites)** policy instead. diff --git a/browsers/edge/shortdesc/configure-home-button-shortdesc.md b/browsers/edge/shortdesc/configure-home-button-shortdesc.md index 7a0260f8ea..c02a0dcee9 100644 --- a/browsers/edge/shortdesc/configure-home-button-shortdesc.md +++ b/browsers/edge/shortdesc/configure-home-button-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge shows the home button and by clicking it the Start page loads by default. With this policy, you can configure the home button to load the New Tab page or a URL defined in the Set Home Button URL policy. You can also configure Microsoft Edge to hide the home button. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge shows the home button and by clicking it the Start page loads by default. With this policy, you can configure the home button to load the New Tab page or a URL defined in the Set Home Button URL policy. You can also configure Microsoft Edge to hide the home button. diff --git a/browsers/edge/shortdesc/configure-kiosk-mode-shortdesc.md b/browsers/edge/shortdesc/configure-kiosk-mode-shortdesc.md index ea135db692..0247b490e6 100644 --- a/browsers/edge/shortdesc/configure-kiosk-mode-shortdesc.md +++ b/browsers/edge/shortdesc/configure-kiosk-mode-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Configure how Microsoft Edge behaves when it’s running in kiosk mode with assigned access, either as a single-app or as one of many apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with a tailored experience for kiosks, or normal browsing in Microsoft Edge. +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Configure how Microsoft Edge behaves when it’s running in kiosk mode with assigned access, either as a single-app or as one of many apps running on the kiosk device. You can control whether Microsoft Edge runs InPrivate full screen, InPrivate multi-tab with a tailored experience for kiosks, or normal browsing in Microsoft Edge. diff --git a/browsers/edge/shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md b/browsers/edge/shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md index 3bcba1b944..3a7657e544 100644 --- a/browsers/edge/shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md +++ b/browsers/edge/shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -You can configure Microsoft Edge kiosk mode to reset to the configured start experience after a specified amount of idle time in minutes (0-1440). The reset timer begins after the last user interaction. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge kiosk mode resets after 30 seconds. Resetting to the configured start experience deletes the current user’s browsing data. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +You can configure Microsoft Edge kiosk mode to reset to the configured start experience after a specified amount of idle time in minutes (0-1440). The reset timer begins after the last user interaction. Once the idle time meets the time specified, a confirmation message prompts the user to continue, and if no user action, Microsoft Edge kiosk mode resets after 30 seconds. Resetting to the configured start experience deletes the current user’s browsing data. diff --git a/browsers/edge/shortdesc/configure-open-microsoft-edge-with-shortdesc.md b/browsers/edge/shortdesc/configure-open-microsoft-edge-with-shortdesc.md index 5bf099b3ca..8d1cc4f603 100644 --- a/browsers/edge/shortdesc/configure-open-microsoft-edge-with-shortdesc.md +++ b/browsers/edge/shortdesc/configure-open-microsoft-edge-with-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge loads a specific page or pages defined in the Configure Start Pages policy and allow users to make changes. With this policy, you can configure Microsoft Edge to load either the Start page, New Tab page, previously opened pages. You can also configure Microsoft Edge to prevent users from changing or customizing the Start page. For this policy to work correctly, you must also configure the Configure Start Pages. If you want to prevent users from making changes, don’t configure the Disable Lockdown of Start Pages policy. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge loads a specific page or pages defined in the Configure Start Pages policy and allow users to make changes. With this policy, you can configure Microsoft Edge to load either the Start page, New Tab page, previously opened pages. You can also configure Microsoft Edge to prevent users from changing or customizing the Start page. For this policy to work correctly, you must also configure the Configure Start Pages. If you want to prevent users from making changes, don’t configure the Disable Lockdown of Start Pages policy. diff --git a/browsers/edge/shortdesc/configure-password-manager-shortdesc.md b/browsers/edge/shortdesc/configure-password-manager-shortdesc.md index 0f77b004ba..0d3bd9b655 100644 --- a/browsers/edge/shortdesc/configure-password-manager-shortdesc.md +++ b/browsers/edge/shortdesc/configure-password-manager-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge uses Password Manager automatically, allowing users to manager passwords locally. Disabling this policy restricts Microsoft Edge from using Password Manager. Don’t configure this policy if you want to let users choose to save and manage passwords locally using Password Manager. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge uses Password Manager automatically, allowing users to manager passwords locally. Disabling this policy restricts Microsoft Edge from using Password Manager. Don’t configure this policy if you want to let users choose to save and manage passwords locally using Password Manager. diff --git a/browsers/edge/shortdesc/configure-pop-up-blocker-shortdesc.md b/browsers/edge/shortdesc/configure-pop-up-blocker-shortdesc.md index 18d5e9bf38..d15347179d 100644 --- a/browsers/edge/shortdesc/configure-pop-up-blocker-shortdesc.md +++ b/browsers/edge/shortdesc/configure-pop-up-blocker-shortdesc.md @@ -1,10 +1,12 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge turns off Pop-up Blocker, which opens pop-up windows. Enabling this policy turns on Pop-up Blocker preventing pop-up windows from opening. If you want users to choose to use Pop-up Blocker, don’t configure this policy. - +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge turns off Pop-up Blocker, which opens pop-up windows. Enabling this policy turns on Pop-up Blocker preventing pop-up windows from opening. If you want users to choose to use Pop-up Blocker, don’t configure this policy. + diff --git a/browsers/edge/shortdesc/configure-search-suggestions-in-address-bar-shortdesc.md b/browsers/edge/shortdesc/configure-search-suggestions-in-address-bar-shortdesc.md index f9e057b6a5..2bdf42c6d3 100644 --- a/browsers/edge/shortdesc/configure-search-suggestions-in-address-bar-shortdesc.md +++ b/browsers/edge/shortdesc/configure-search-suggestions-in-address-bar-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, users can choose to see search suggestions in the Address bar of Microsoft Edge. Disabling this policy hides the search suggestions and enabling this policy shows the search suggestions. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, users can choose to see search suggestions in the Address bar of Microsoft Edge. Disabling this policy hides the search suggestions and enabling this policy shows the search suggestions. diff --git a/browsers/edge/shortdesc/configure-start-pages-shortdesc.md b/browsers/edge/shortdesc/configure-start-pages-shortdesc.md index f9b5185f3d..146511b737 100644 --- a/browsers/edge/shortdesc/configure-start-pages-shortdesc.md +++ b/browsers/edge/shortdesc/configure-start-pages-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge loads the pages specified in App settings as the default Start pages. With this policy, you can configure one or more Start pages when you enable this policy and enable the Configure Open Microsoft Edge With policy. Once you set the Start pages, either in this policy or Configure Open Microsoft Edge With policy, users cannot make changes. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge loads the pages specified in App settings as the default Start pages. With this policy, you can configure one or more Start pages when you enable this policy and enable the Configure Open Microsoft Edge With policy. Once you set the Start pages, either in this policy or Configure Open Microsoft Edge With policy, users cannot make changes. diff --git a/browsers/edge/shortdesc/configure-windows-defender-smartscreen-shortdesc.md b/browsers/edge/shortdesc/configure-windows-defender-smartscreen-shortdesc.md index 58dfd6be9a..62547e8955 100644 --- a/browsers/edge/shortdesc/configure-windows-defender-smartscreen-shortdesc.md +++ b/browsers/edge/shortdesc/configure-windows-defender-smartscreen-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge uses Windows Defender SmartScreen (turned on) to protect users from potential phishing scams and malicious software by default. Also, by default, users cannot disable (turn off) Windows Defender SmartScreen. Enabling this policy turns off Windows Defender SmartScreen and prevent users from turning it on. Don’t configure this policy to let users choose to turn Windows defender SmartScreen on or off. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge uses Windows Defender SmartScreen (turned on) to protect users from potential phishing scams and malicious software by default. Also, by default, users cannot disable (turn off) Windows Defender SmartScreen. Enabling this policy turns on Windows Defender SmartScreen and prevent users from turning it off. Don’t configure this policy to let users choose to turn Windows defender SmartScreen on or off. diff --git a/browsers/edge/shortdesc/disable-lockdown-of-start-pages-shortdesc.md b/browsers/edge/shortdesc/disable-lockdown-of-start-pages-shortdesc.md index e0c635c0c7..37ff4011ad 100644 --- a/browsers/edge/shortdesc/disable-lockdown-of-start-pages-shortdesc.md +++ b/browsers/edge/shortdesc/disable-lockdown-of-start-pages-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, the Start pages configured in either the Configure Start Pages policy or Configure Open Microsoft Edge policies cannot be changed and remain locked down. Enabling this policy unlocks the Start pages, and lets users make changes to either all configured Start page or any Start page configured with the Configure Start pages policy. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, the Start pages configured in either the Configure Start Pages policy or Configure Open Microsoft Edge policies cannot be changed and remain locked down. Enabling this policy unlocks the Start pages, and lets users make changes to either all configured Start page or any Start page configured with the Configure Start pages policy. diff --git a/browsers/edge/shortdesc/do-not-sync-browser-settings-shortdesc.md b/browsers/edge/shortdesc/do-not-sync-browser-settings-shortdesc.md index 93ecd60efe..f0cb07d514 100644 --- a/browsers/edge/shortdesc/do-not-sync-browser-settings-shortdesc.md +++ b/browsers/edge/shortdesc/do-not-sync-browser-settings-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, the “browser” group syncs automatically between user’s devices and allowing users to choose to make changes. The “browser” group uses the _Sync your Settings_ option in Settings to sync information like history and favorites. Enabling this policy prevents the “browser” group from using the Sync your Settings option. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, the “browser” group syncs automatically between user’s devices and allowing users to choose to make changes. The “browser” group uses the _Sync your Settings_ option in Settings to sync information like history and favorites. Enabling this policy prevents the “browser” group from using the Sync your Settings option. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option. diff --git a/browsers/edge/shortdesc/do-not-sync-shortdesc.md b/browsers/edge/shortdesc/do-not-sync-shortdesc.md index 5902fb6656..f61cc11548 100644 --- a/browsers/edge/shortdesc/do-not-sync-shortdesc.md +++ b/browsers/edge/shortdesc/do-not-sync-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge turns on the _Sync your settings_ toggle in **Settings > Device sync settings** letting users choose what to sync on their devices. Enabling this policy turns off and disables the _Sync your settings_ toggle preventing the syncing of user’s settings between their devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable this policy and select the _Allow users to turn syncing on_ option. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge turns on the _Sync your settings_ toggle in **Settings > Device sync settings** letting users choose what to sync on their devices. Enabling this policy turns off and disables the _Sync your settings_ toggle preventing the syncing of user’s settings between their devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable this policy and select the _Allow users to turn syncing on_ option. diff --git a/browsers/edge/shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md b/browsers/edge/shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md index 981ef9d876..3bd062d263 100644 --- a/browsers/edge/shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md +++ b/browsers/edge/shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge does not sync the user’s favorites between IE and Microsoft Edge. Enabling this policy syncs favorites between Internet Explorer and Microsoft Edge. Changes to favorites in one browser reflect in the other, including additions, deletions, modifications, and ordering of favorites. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge does not sync the user’s favorites between IE and Microsoft Edge. Enabling this policy syncs favorites between Internet Explorer and Microsoft Edge. Changes to favorites in one browser reflect in the other, including additions, deletions, modifications, and ordering of favorites. diff --git a/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md b/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md index efc6fc71a1..91065aa687 100644 --- a/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md +++ b/browsers/edge/shortdesc/microsoft-browser-extension-policy-shortdesc.md @@ -1,10 +1,12 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -[Microsoft browser extension policy](https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy): -This document describes the supported mechanisms for extending or modifying the behavior or user experience of Microsoft Edge and Internet Explorer or the content displayed by these browsers. Any technique not explicitly listed in this document is considered **unsupported**. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +[Microsoft browser extension policy](https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy): +This document describes the supported mechanisms for extending or modifying the behavior or user experience of Microsoft Edge and Internet Explorer or the content displayed by these browsers. Any technique not explicitly listed in this document is considered **unsupported**. diff --git a/browsers/edge/shortdesc/prevent-access-to-about-flags-page-shortdesc.md b/browsers/edge/shortdesc/prevent-access-to-about-flags-page-shortdesc.md index 518f94bdea..5bf46ea949 100644 --- a/browsers/edge/shortdesc/prevent-access-to-about-flags-page-shortdesc.md +++ b/browsers/edge/shortdesc/prevent-access-to-about-flags-page-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, users can access the about:flags page in Microsoft Edge, which is used to change developer settings and enable experimental features. Enabling this policy prevents users from accessing the about:flags page. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, users can access the about:flags page in Microsoft Edge, which is used to change developer settings and enable experimental features. Enabling this policy prevents users from accessing the about:flags page. diff --git a/browsers/edge/shortdesc/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md b/browsers/edge/shortdesc/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md index 6330b51213..3676adbc89 100644 --- a/browsers/edge/shortdesc/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md +++ b/browsers/edge/shortdesc/prevent-bypassing-windows-defender-prompts-for-files-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge allows users to bypass (ignore) the Windows Defender SmartScreen warnings about potentially malicious files, allowing them to continue downloading the unverified file(s). Enabling this policy prevents users from bypassing the warnings, blocking them from downloading of the unverified file(s). \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge allows users to bypass (ignore) the Windows Defender SmartScreen warnings about potentially malicious files, allowing them to continue downloading the unverified file(s). Enabling this policy prevents users from bypassing the warnings, blocking them from downloading of the unverified file(s). diff --git a/browsers/edge/shortdesc/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md b/browsers/edge/shortdesc/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md index d5eaea4a31..05bae5dac6 100644 --- a/browsers/edge/shortdesc/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md +++ b/browsers/edge/shortdesc/prevent-bypassing-windows-defender-prompts-for-sites-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge allows users to bypass (ignore) the Windows Defender SmartScreen warnings about potentially malicious sites, allowing them to continue to the site. With this policy though, you can configure Microsoft Edge to prevent users from bypassing the warnings, blocking them from continuing to the site. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge allows users to bypass (ignore) the Windows Defender SmartScreen warnings about potentially malicious sites, allowing them to continue to the site. With this policy though, you can configure Microsoft Edge to prevent users from bypassing the warnings, blocking them from continuing to the site. diff --git a/browsers/edge/shortdesc/prevent-certificate-error-overrides-shortdesc.md b/browsers/edge/shortdesc/prevent-certificate-error-overrides-shortdesc.md index 156b1bb385..675180c666 100644 --- a/browsers/edge/shortdesc/prevent-certificate-error-overrides-shortdesc.md +++ b/browsers/edge/shortdesc/prevent-certificate-error-overrides-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge, by default, allows overriding of the security warnings to sites that have SSL errors, bypassing or ignoring certificate errors. Enabling this policy prevents overriding of the security warnings. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge, by default, allows overriding of the security warnings to sites that have SSL errors, bypassing or ignoring certificate errors. Enabling this policy prevents overriding of the security warnings. diff --git a/browsers/edge/shortdesc/prevent-changes-to-favorites-shortdesc.md b/browsers/edge/shortdesc/prevent-changes-to-favorites-shortdesc.md index 78c77baf42..33db87a522 100644 --- a/browsers/edge/shortdesc/prevent-changes-to-favorites-shortdesc.md +++ b/browsers/edge/shortdesc/prevent-changes-to-favorites-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, users can add, import, and make changes to the Favorites list in Microsoft Edge. Enabling this policy locks down the Favorites list in Microsoft Edge, preventing users from making changes. When enabled, Microsoft Edge turns off the Save a Favorite, Import settings, and context menu items, such as Create a new folder. Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, users can add, import, and make changes to the Favorites list in Microsoft Edge. Enabling this policy locks down the Favorites list in Microsoft Edge, preventing users from making changes. When enabled, Microsoft Edge turns off the Save a Favorite, Import settings, and context menu items, such as Create a new folder. Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. diff --git a/browsers/edge/shortdesc/prevent-edge-from-gathering-live-tile-info-shortdesc.md b/browsers/edge/shortdesc/prevent-edge-from-gathering-live-tile-info-shortdesc.md index 87d3b927ed..30d9a48e8d 100644 --- a/browsers/edge/shortdesc/prevent-edge-from-gathering-live-tile-info-shortdesc.md +++ b/browsers/edge/shortdesc/prevent-edge-from-gathering-live-tile-info-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge collects the Live Tile metadata and sends it to Microsoft to help provide users a complete experience when they pin Live Tiles to the Start menu. However, with this policy, you can configure Microsoft Edge to prevent Microsoft from collecting Live Tile metadata, providing users with a limited experience. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge collects the Live Tile metadata and sends it to Microsoft to help provide users a complete experience when they pin Live Tiles to the Start menu. However, with this policy, you can configure Microsoft Edge to prevent Microsoft from collecting Live Tile metadata, providing users with a limited experience. diff --git a/browsers/edge/shortdesc/prevent-first-run-webpage-from-opening-shortdesc.md b/browsers/edge/shortdesc/prevent-first-run-webpage-from-opening-shortdesc.md index af24d3583b..9ed6170971 100644 --- a/browsers/edge/shortdesc/prevent-first-run-webpage-from-opening-shortdesc.md +++ b/browsers/edge/shortdesc/prevent-first-run-webpage-from-opening-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, when launching Microsoft Edge for the first time, the First Run webpage (a welcome page) hosted on Microsoft.com loads automatically via an FWLINK. The welcome page lists the new features and helpful tips of Microsoft Edge. With this policy, you can configure Microsoft Edge to prevent loading the welcome page on first explicit user-launch. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, when launching Microsoft Edge for the first time, the First Run webpage (a welcome page) hosted on Microsoft.com loads automatically via an FWLINK. The welcome page lists the new features and helpful tips of Microsoft Edge. With this policy, you can configure Microsoft Edge to prevent loading the welcome page on first explicit user-launch. diff --git a/browsers/edge/shortdesc/prevent-turning-off-required-extensions-shortdesc.md b/browsers/edge/shortdesc/prevent-turning-off-required-extensions-shortdesc.md index 7875990600..7264330137 100644 --- a/browsers/edge/shortdesc/prevent-turning-off-required-extensions-shortdesc.md +++ b/browsers/edge/shortdesc/prevent-turning-off-required-extensions-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge allows users to uninstall extensions by default. Enabling this policy prevents users from uninstalling extensions but lets them configure options for extensions defined in this policy, such as allowing InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. If you enabled this policy and now you want to disable it, the list of extension package family names (PFNs) defined in this policy get ignored after disabling this policy. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge allows users to uninstall extensions by default. Enabling this policy prevents users from uninstalling extensions but lets them configure options for extensions defined in this policy, such as allowing InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. If you enabled this policy and now you want to disable it, the list of extension package family names (PFNs) defined in this policy get ignored after disabling this policy. diff --git a/browsers/edge/shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md b/browsers/edge/shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md index daa02c5729..e624de62e6 100644 --- a/browsers/edge/shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md +++ b/browsers/edge/shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. With this policy, though, you can prevent the “browser” group from syncing and prevent users from turning on the _Sync your Settings_ toggle in Settings. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option in the Do not sync browser policy. For this policy to work correctly, you must enable the Do not sync browser policy. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. With this policy, though, you can prevent the “browser” group from syncing and prevent users from turning on the _Sync your Settings_ toggle in Settings. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option in the Do not sync browser policy. For this policy to work correctly, you must enable the Do not sync browser policy. diff --git a/browsers/edge/shortdesc/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md b/browsers/edge/shortdesc/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md index 4ba3bff11a..5ef4bbdeca 100644 --- a/browsers/edge/shortdesc/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md +++ b/browsers/edge/shortdesc/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge shows localhost IP address while making calls using the WebRTC protocol. Enabling this policy hides the localhost IP addresses. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge shows localhost IP address while making calls using the WebRTC protocol. Enabling this policy hides the localhost IP addresses. diff --git a/browsers/edge/shortdesc/provision-favorites-shortdesc.md b/browsers/edge/shortdesc/provision-favorites-shortdesc.md index e2ed5da50f..30b9677f92 100644 --- a/browsers/edge/shortdesc/provision-favorites-shortdesc.md +++ b/browsers/edge/shortdesc/provision-favorites-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, users can customize the Favorites list in Microsoft Edge. With this policy though, you provision a standard list of favorites, which can include folders, to appear in the Favorites list in addition to the user’s favorites. Edge. Once you provision the Favorites list, users cannot customize it, such as adding folders for organizing, and adding or removing any of the favorites configured. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, users can customize the Favorites list in Microsoft Edge. With this policy though, you provision a standard list of favorites, which can include folders, to appear in the Favorites list in addition to the user’s favorites. Edge. Once you provision the Favorites list, users cannot customize it, such as adding folders for organizing, and adding or removing any of the favorites configured. diff --git a/browsers/edge/shortdesc/search-provider-discovery-shortdesc.md b/browsers/edge/shortdesc/search-provider-discovery-shortdesc.md index 454549bffe..8f54c4b93a 100644 --- a/browsers/edge/shortdesc/search-provider-discovery-shortdesc.md +++ b/browsers/edge/shortdesc/search-provider-discovery-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge follows the OpenSearch 1.1 specification to discover and use web search providers. When a user browses to a search service, the OpenSearch description is picked up and saved for later use. Users can then choose to add the search service to use in the Microsoft Edge address bar. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge follows the OpenSearch 1.1 specification to discover and use web search providers. When a user browses to a search service, the OpenSearch description is picked up and saved for later use. Users can then choose to add the search service to use in the Microsoft Edge address bar. diff --git a/browsers/edge/shortdesc/send-all-intranet-sites-to-ie-shortdesc.md b/browsers/edge/shortdesc/send-all-intranet-sites-to-ie-shortdesc.md index 79dfd220c1..787f96dd9b 100644 --- a/browsers/edge/shortdesc/send-all-intranet-sites-to-ie-shortdesc.md +++ b/browsers/edge/shortdesc/send-all-intranet-sites-to-ie-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, all websites, including intranet sites, open in Microsoft Edge automatically. Only enable this policy if there are known compatibility problems with Microsoft Edge. Enabling this policy loads only intranet sites in Internet Explorer 11 automatically. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, all websites, including intranet sites, open in Microsoft Edge automatically. Only enable this policy if there are known compatibility problems with Microsoft Edge. Enabling this policy loads only intranet sites in Internet Explorer 11 automatically. diff --git a/browsers/edge/shortdesc/set-default-search-engine-shortdesc.md b/browsers/edge/shortdesc/set-default-search-engine-shortdesc.md index c9d57f2140..39b408d1b4 100644 --- a/browsers/edge/shortdesc/set-default-search-engine-shortdesc.md +++ b/browsers/edge/shortdesc/set-default-search-engine-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge uses the search engine specified in App settings, letting users make changes at any time unless the Allow search engine customization policy is disabled, which restricts users from making changes. With this policy, you can either remove or use the policy-set search engine. When you remove the policy-set search engine, Microsoft Edge uses the specified search engine for the market, which lets users make changes to the default search engine. You can use the policy-set search engine specified in the OpenSearch XML, which prevents users from making changes. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge uses the search engine specified in App settings, letting users make changes at any time unless the Allow search engine customization policy is disabled, which restricts users from making changes. With this policy, you can either remove or use the policy-set search engine. When you remove the policy-set search engine, Microsoft Edge uses the specified search engine for the market, which lets users make changes to the default search engine. You can use the policy-set search engine specified in the OpenSearch XML, which prevents users from making changes. diff --git a/browsers/edge/shortdesc/set-home-button-url-shortdesc.md b/browsers/edge/shortdesc/set-home-button-url-shortdesc.md index 98fcc7aef2..863cfdf84a 100644 --- a/browsers/edge/shortdesc/set-home-button-url-shortdesc.md +++ b/browsers/edge/shortdesc/set-home-button-url-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, Microsoft Edge shows the home button and loads the Start page, and locks down the home button to prevent users from changing what page loads. Enabling this policy loads a custom URL for the home button. When you enable this policy, and enable the Configure Home Button policy with the _Show home button & set a specific page_ option selected, a custom URL loads when the user clicks the home button. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, Microsoft Edge shows the home button and loads the Start page, and locks down the home button to prevent users from changing what page loads. Enabling this policy loads a custom URL for the home button. When you enable this policy, and enable the Configure Home Button policy with the _Show home button & set a specific page_ option selected, a custom URL loads when the user clicks the home button. diff --git a/browsers/edge/shortdesc/set-new-tab-url-shortdesc.md b/browsers/edge/shortdesc/set-new-tab-url-shortdesc.md index 9f27db97ce..5062d322e4 100644 --- a/browsers/edge/shortdesc/set-new-tab-url-shortdesc.md +++ b/browsers/edge/shortdesc/set-new-tab-url-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -Microsoft Edge loads the default New Tab page by default. Enabling this policy lets you set a New Tab page URL in Microsoft Edge, preventing users from changing it. When you enable this policy, and you disable the Allow web content on New Tab page policy, Microsoft Edge ignores any URL specified in this policy and opens about:blank. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +Microsoft Edge loads the default New Tab page by default. Enabling this policy lets you set a New Tab page URL in Microsoft Edge, preventing users from changing it. When you enable this policy, and you disable the Allow web content on New Tab page policy, Microsoft Edge ignores any URL specified in this policy and opens about:blank. diff --git a/browsers/edge/shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md b/browsers/edge/shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md index a15e780afe..1dc59094fd 100644 --- a/browsers/edge/shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md +++ b/browsers/edge/shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md @@ -1,8 +1,10 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- -Microsoft Edge does not show a notification before opening sites in Internet Explorer 11. However, with this policy, you can configure Microsoft Edge to display a notification before a site opens in IE11 or let users continue in Microsoft Edge. If you want users to continue in Microsoft Edge, enable this policy to show the _Keep going in Microsoft Edge_ link in the notification. For this policy to work correctly, you must also enable the Configure the Enterprise Mode Site List or Send all intranet sites to Internet Explorer 11, or both. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- +Microsoft Edge does not show a notification before opening sites in Internet Explorer 11. However, with this policy, you can configure Microsoft Edge to display a notification before a site opens in IE11 or let users continue in Microsoft Edge. If you want users to continue in Microsoft Edge, enable this policy to show the _Keep going in Microsoft Edge_ link in the notification. For this policy to work correctly, you must also enable the Configure the Enterprise Mode Site List or Send all intranet sites to Internet Explorer 11, or both. diff --git a/browsers/edge/shortdesc/unlock-home-button-shortdesc.md b/browsers/edge/shortdesc/unlock-home-button-shortdesc.md index d412d67e72..0dd37009b6 100644 --- a/browsers/edge/shortdesc/unlock-home-button-shortdesc.md +++ b/browsers/edge/shortdesc/unlock-home-button-shortdesc.md @@ -1,9 +1,11 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -By default, when you enable the Configure Home Button policy or provide a URL in the Set Home Button URL policy, Microsoft Edge locks down the home button to prevent users from changing the settings. When you enable this policy, users can make changes to the home button even if you enabled the Configure Home Button or Set Home Button URL policies. \ No newline at end of file +--- +author: dansimp +ms.author: dansimp +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +By default, when you enable the Configure Home Button policy or provide a URL in the Set Home Button URL policy, Microsoft Edge locks down the home button to prevent users from changing the settings. When you enable this policy, users can make changes to the home button even if you enabled the Configure Home Button or Set Home Button URL policies. diff --git a/browsers/edge/troubleshooting-microsoft-edge.md b/browsers/edge/troubleshooting-microsoft-edge.md index 3f3707624b..3c50d4d50e 100644 --- a/browsers/edge/troubleshooting-microsoft-edge.md +++ b/browsers/edge/troubleshooting-microsoft-edge.md @@ -2,13 +2,16 @@ title: Troubleshoot Microsoft Edge description: ms.assetid: -author: shortpatti -ms.author: pashort +ms.reviewer: +audience: itpro +manager: dansimp +author: dansimp +ms.author: dansimp ms.prod: edge ms.sitesec: library title: Deploy Microsoft Edge kiosk mode ms.localizationpriority: medium -ms.date: 10/15/2018 +ms.date: 10/15/2018 --- # Troubleshoot Microsoft Edge @@ -32,4 +35,4 @@ If you want to deliver applications to users via Citrix through Microsoft Edge, ## Missing SettingSync.admx and SettingSync.adml files -Make sure to [download](https://www.microsoft.com/en-us/download/windows.aspx) the latest templates to C:\windows\policydefinitions\. \ No newline at end of file +Make sure to [download](https://www.microsoft.com/download/windows.aspx) the latest templates to C:\windows\policydefinitions\. diff --git a/browsers/edge/use-powershell-to manage-group-policy.md b/browsers/edge/use-powershell-to manage-group-policy.md index b4a16608e7..58a6b06b27 100644 --- a/browsers/edge/use-powershell-to manage-group-policy.md +++ b/browsers/edge/use-powershell-to manage-group-policy.md @@ -8,8 +8,11 @@ ms.pagetype: security title: Security enhancements for Microsoft Edge (Microsoft Edge for IT Pros) ms.localizationpriority: medium ms.date: 10/02/2018 -ms.author: pashort -author: shortpatti +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp +author: dansimp --- # Use Windows PowerShell to manage group policy diff --git a/browsers/edge/web-app-compat-toolkit.md b/browsers/edge/web-app-compat-toolkit.md index f2742ca22d..8ec157e607 100644 --- a/browsers/edge/web-app-compat-toolkit.md +++ b/browsers/edge/web-app-compat-toolkit.md @@ -1,11 +1,14 @@ --- -title: Web Application Compatibility lab kit +title: Web Application Compatibility lab kit +ms.reviewer: +audience: itpro +manager: dansimp description: Learn how to use the web application compatibility toolkit for Microsoft Edge. ms.prod: edge ms.topic: article -ms.manager: elizapo -author: lizap -ms.author: elizapo +ms.manager: dansimp +author: dansimp +ms.author: dansimp ms.localizationpriority: high --- @@ -52,4 +55,4 @@ The Web Application Compatibility Lab Kit is also available in the following lan [DOWNLOAD THE LAB KIT](https://www.microsoft.com/evalcenter/evaluate-windows-10-web-application-compatibility-lab) >[!TIP] ->Please use a broad bandwidth to download this content to enhance your downloading experience. Lab environment requires 8 GB of available memory and 100 GB of free disk space. \ No newline at end of file +>Please use a broad bandwidth to download this content to enhance your downloading experience. Lab environment requires 8 GB of available memory and 100 GB of free disk space. diff --git a/browsers/enterprise-mode/add-employees-enterprise-mode-portal.md b/browsers/enterprise-mode/add-employees-enterprise-mode-portal.md index 808a874dba..08d914e629 100644 --- a/browsers/enterprise-mode/add-employees-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/add-employees-enterprise-mode-portal.md @@ -3,11 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how to add employees to the Enterprise Mode Site List Portal. -author: jdeckerms +author: dansimp ms.prod: ie11 title: Add employees to the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Add employees to the Enterprise Mode Site List Portal @@ -62,4 +65,4 @@ The available roles are: 2. Save the EnterpriseModeUsersList.xlsx file. - The Excel file includes all employees with access to the Enterprise Mode Site List Portal, including user name, email address, role, and group name. \ No newline at end of file + The Excel file includes all employees with access to the Enterprise Mode Site List Portal, including user name, email address, role, and group name. diff --git a/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md b/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md index 877885d8e6..39adf2816d 100644 --- a/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md +++ b/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the Bulk add from file area of the Enterprise Mode Site List Manager. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md b/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md index 4cdf9fe53e..b4da3f64f5 100644 --- a/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md +++ b/browsers/enterprise-mode/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Add multiple sites to your Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2). -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: da659ff5-70d5-4852-995e-4df67c4871dd +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 10/24/2017 diff --git a/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md b/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md index 49b19fe506..55b2dcd28a 100644 --- a/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md +++ b/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26 +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md b/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md index 59729cbde1..c1a7aee9b8 100644 --- a/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md +++ b/browsers/enterprise-mode/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that''s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 513e8f3b-fedf-4d57-8d81-1ea4fdf1ac0b +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/administrative-templates-and-ie11.md b/browsers/enterprise-mode/administrative-templates-and-ie11.md index 6adfc06b58..d92810ceb5 100644 --- a/browsers/enterprise-mode/administrative-templates-and-ie11.md +++ b/browsers/enterprise-mode/administrative-templates-and-ie11.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: security description: Administrative templates and Internet Explorer 11 -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3 +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/approve-change-request-enterprise-mode-portal.md b/browsers/enterprise-mode/approve-change-request-enterprise-mode-portal.md index d6f1772b59..fd58f63df5 100644 --- a/browsers/enterprise-mode/approve-change-request-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/approve-change-request-enterprise-mode-portal.md @@ -3,11 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how Approvers can approve open change requests in the Enterprise Mode Site List Portal. -author: jdeckerms +author: dansimp ms.prod: ie11 title: Approve a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Approve a change request using the Enterprise Mode Site List Portal @@ -56,4 +59,4 @@ The original Requester, the Approver(s) group, and the Administrator(s) group ca ## Next steps -After an Approver approves the change request, it must be scheduled for inclusion in the production Enterprise Mode Site List. For the scheduling steps, see the [Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md) topic. \ No newline at end of file +After an Approver approves the change request, it must be scheduled for inclusion in the production Enterprise Mode Site List. For the scheduling steps, see the [Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md) topic. diff --git a/browsers/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file.md b/browsers/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file.md index 417dc77cad..7696eedaca 100644 --- a/browsers/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file.md +++ b/browsers/enterprise-mode/check-for-new-enterprise-mode-site-list-xml-file.md @@ -2,12 +2,14 @@ title: Check for a new Enterprise Mode site list xml file (Internet Explorer 11 for IT Pros) description: You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. ms.assetid: 2bbc7017-622e-4baa-8981-c0bbda10e9df +ms.reviewer: +manager: dansimp ms.prod: ie11 ms.mktglfcycl: deploy ms.pagetype: appcompat ms.sitesec: library -author: jdeckerms -ms.author: dougkim +author: dansimp +ms.author: dansimp ms.date: 08/14/2017 ms.localizationpriority: low --- diff --git a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md index 5329325698..4fc4fb1ecc 100644 --- a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md +++ b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md @@ -2,9 +2,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy description: Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: a145e80f-eb62-4116-82c4-3cc35fd064b6 +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Collect data using Enterprise Site Discovery ms.sitesec: library ms.date: 07/27/2017 @@ -45,7 +48,7 @@ Before you start, you need to make sure you have the following: - IETelemetry.mof file - - Sample System Center 2012 report templates + - Sample Configuration Manager report templates You must use System Center 2012 R2 Configuration Manager or later for these samples to work. @@ -144,18 +147,18 @@ You need to set up your computers for data collection by running the provided Po **To set up Enterprise Site Discovery** -- Start PowerShell in elevated mode (using admin privileges) and run IETElemetrySetUp.ps1 by by-passing the PowerShell execution policy, using this command: `powershell -ExecutionPolicy Bypass .\IETElemetrySetUp.ps1`. For more info, see [about Execution Policies](https://go.microsoft.com/fwlink/p/?linkid=517460). +- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1 by by-passing the PowerShell execution policy, using this command: `powershell -ExecutionPolicy Bypass .\IETelemetrySetUp.ps1`. For more info, see [about Execution Policies](https://go.microsoft.com/fwlink/p/?linkid=517460). ### WMI only: Set up your firewall for WMI data If you choose to use WMI as your data output, you need to make sure that your WMI data can travel through your firewall for the domain. If you’re sure, you can skip this section; otherwise, follow these steps: **To set up your firewall** -1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. +1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. -2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. +2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. -3. Restart your computer to start collecting your WMI data. +3. Restart your computer to start collecting your WMI data. ## Use PowerShell to finish setting up Enterprise Site Discovery You can determine which zones or domains are used for data collection, using PowerShell. If you don’t want to use PowerShell, you can do this using Group Policy. For more info, see [Use Group Policy to finish setting up Enterprise Site Discovery](#use-group-policy-to-finish-setting-up-enterprise-site-discovery). @@ -168,13 +171,13 @@ You can determine which zones or domains are used for data collection, using Pow **To set up data collection using a domain allow list** - - Start PowerShell in elevated mode (using admin privileges) and run IETElemetrySetUp.ps1, using this command: `.\IETElemetrySetUp.ps1 [other args] -SiteAllowList sharepoint.com,outlook.com,onedrive.com`. +- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -SiteAllowList sharepoint.com,outlook.com,onedrive.com`. >**Important**
Wildcards, like \*.microsoft.com, aren’t supported. **To set up data collection using a zone allow list** - - Start PowerShell in elevated mode (using admin privileges) and run IETElemetrySetUp.ps1, using this command: `.\IETElemetrySetUp.ps1 [other args] -ZoneAllowList Computer,Intranet,TrustedSites,Internet,RestrictedSites`. +- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -ZoneAllowList Computer,Intranet,TrustedSites,Internet,RestrictedSites`. >**Important**
Only Computer, Intranet, TrustedSites, Internet, and RestrictedSites are supported. @@ -444,7 +447,7 @@ After you’ve collected your data, you’ll need to turn Enterprise Site Discov **To stop collecting data, using PowerShell** -- On your client computer, start Windows PowerShell in elevated mode (using admin privileges) and run `IETelemetrySetUp.ps1`, using this command: `powershell -ExecutionPolicy Bypass .\IETElemetrySetUp.ps1 –IEFeatureOff`. +- On your client computer, start Windows PowerShell in elevated mode (using admin privileges) and run `IETelemetrySetUp.ps1`, using this command: `powershell -ExecutionPolicy Bypass .\IETelemetrySetUp.ps1 –IEFeatureOff`. >**Note**
Turning off data collection only disables the Enterprise Site Discovery feature – all data already written to WMI stays on your employee’s computer. diff --git a/browsers/enterprise-mode/configure-settings-enterprise-mode-portal.md b/browsers/enterprise-mode/configure-settings-enterprise-mode-portal.md index 290b39d09d..807cc8d2c8 100644 --- a/browsers/enterprise-mode/configure-settings-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/configure-settings-enterprise-mode-portal.md @@ -3,11 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how the Administrator can use the Settings page to set up Groups and roles, the Enterprise Mode Site List Portal environment, and the freeze dates for production changes. -author: jdeckerms +author: dansimp ms.prod: ie11 title: Use the Settings page to finish setting up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Use the Settings page to finish setting up the Enterprise Mode Site List Portal @@ -91,4 +94,4 @@ This optional area lets you specify a period when your employees must stop addin - [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) -- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) \ No newline at end of file +- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) diff --git a/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md b/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md index 771b794761..cbfc5f11b5 100644 --- a/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/create-change-request-enterprise-mode-portal.md @@ -3,11 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how to create a change request within the Enterprise Mode Site List Portal. -author: jdeckerms +author: dansimp ms.prod: ie11 title: Create a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Create a change request using the Enterprise Mode Site List Portal @@ -67,4 +70,4 @@ Employees assigned to the Requester role can create a change request. A change r - **If the change is incorrect.** The Requester can rollback the change in pre-production or ask for help from the Administrator. ## Next steps -After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see the [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md) topic. \ No newline at end of file +After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see the [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md) topic. diff --git a/browsers/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index 04ba74d178..ad225f2556 100644 --- a/browsers/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -3,9 +3,12 @@ ms.localizationpriority: low description: Delete a single site from your global Enterprise Mode site list. ms.pagetype: appcompat ms.mktglfcycl: deploy -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 41413459-b57f-48da-aedb-4cbec1e2981a +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md index f19c3e402a..403690d64f 100644 --- a/browsers/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 76aa9a85-6190-4c3a-bc25-0f914de228ea +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/enterprise-mode-overview-for-ie11.md b/browsers/enterprise-mode/enterprise-mode-overview-for-ie11.md index 30ded77dda..ae103d5802 100644 --- a/browsers/enterprise-mode/enterprise-mode-overview-for-ie11.md +++ b/browsers/enterprise-mode/enterprise-mode-overview-for-ie11.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Use the topics in this section to learn how to set up and use Enterprise Mode, Enterprise Mode Site List Manager, and the Enterprise Mode Site List Portal for your company. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: d52ba8ba-b3c7-4314-ba14-0610e1d8456e +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Enterprise Mode for Internet Explorer 11 (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md b/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md index ef400d46d7..634fd7cd91 100644 --- a/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md +++ b/browsers/enterprise-mode/enterprise-mode-schema-version-1-guidance.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 7 or Windows 8.1 Update. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 17c61547-82e3-48f2-908d-137a71938823 +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Enterprise Mode schema v.1 guidance (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 @@ -176,7 +179,7 @@ Where https://fabrikam.com doesn't use IE8 Enterprise Mode, but https://fabrikam

Example 

 <docMode>
-  <domain exclude="false">fakrikam.com
+  <domain exclude="false">fabrikam.com
     <path docMode="7">/products</path>
   </domain>
 </docMode>
@@ -230,4 +233,4 @@ If you want to target specific sites in your organization. |You can specify subdomains in the domain tag. |<docMode>
<domain docMode="5">contoso.com</domain>
<domain docMode="9">info.contoso.com</domain>
<docMode> |
  • contoso.com uses document mode 5.
  • info.contoso.com uses document mode 9.
  • test.contoso.com also uses document mode 5.
| |You can specify exact URLs by listing the full path. |<emie>
<domain exclude="false">bing.com</domain>
<domain exclude="false" forceCompatView="true">contoso.com</domain>
<emie>|
  • bing.com uses IE8 Enterprise Mode.
  • contoso.com uses IE7 Enterprise Mode.
| |You can nest paths underneath domains. |<emie>
<domain exclude="true">contoso.com
<path exclude="false">/about</path>
<path exclude="true">
/about/business</path>
</domain>
</emie> |
  • contoso.com will use the default version of IE.
  • contoso.com/about and everything underneath that node will load in Enterprise Mode, except contoso.com/about/business, which will load in the default version of IE.
| -|You can’t add a path underneath a path. The file will still be parsed, but the sub-path will be ignored. |<emie>
<domain exclude="true">contoso.com
<path>/about
<path exclude="true">/business</path>
</path>
</domain>
</emie> |
  • contoso.com will use the default version of IE.
  • contoso.com/about and everything underneath that node will load in Enterprise Mode, including contoso.com/about/business because the last rule is ignored.
| \ No newline at end of file +|You can’t add a path underneath a path. The file will still be parsed, but the sub-path will be ignored. |<emie>
<domain exclude="true">contoso.com
<path>/about
<path exclude="true">/business</path>
</path>
</domain>
</emie> |
  • contoso.com will use the default version of IE.
  • contoso.com/about and everything underneath that node will load in Enterprise Mode, including contoso.com/about/business because the last rule is ignored.
| diff --git a/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md b/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md index 2460a2a53d..70694a3df2 100644 --- a/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md +++ b/browsers/enterprise-mode/enterprise-mode-schema-version-2-guidance.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 10. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 909ca359-5654-4df9-b9fb-921232fc05f5 +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Enterprise Mode schema v.2 guidance (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 12/04/2017 diff --git a/browsers/enterprise-mode/enterprise-mode.md b/browsers/enterprise-mode/enterprise-mode.md index 663a632588..30d32a8d1a 100644 --- a/browsers/enterprise-mode/enterprise-mode.md +++ b/browsers/enterprise-mode/enterprise-mode.md @@ -3,10 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: security description: Use this section to learn about how to turn on Enterprise Mode. -author: shortpatti -ms.author: pashort -ms.prod: edge, ie11 +author: dansimp +ms.author: dansimp +ms.prod: edge ms.assetid: +ms.reviewer: +manager: dansimp title: Enterprise Mode for Microsoft Edge ms.sitesec: library ms.date: '' @@ -52,6 +54,6 @@ You can build and manage your Enterprise Mode Site List is by using any generic ### Add a single site to the site list -### Add mulitple sites to the site list +### Add multiple sites to the site list diff --git a/browsers/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md index 929957a727..4f4cbb32bb 100644 --- a/browsers/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: After you create your Enterprise Mode site list in the Enterprise Mode Site List Manager, you can export the contents to an Enterprise Mode (.EMIE) file. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 9ee7c13d-6fca-4446-bc22-d23a0213a95d +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Export your Enterprise Mode site list from the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index 7be8b574cc..a1d5a8a76b 100644 --- a/browsers/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Instructions about how to clear all of the sites from your global Enterprise Mode site list. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 90f38a6c-e0e2-4c93-9a9e-c425eca99e97 +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list.md b/browsers/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list.md index 37eb813af3..91ff0fab17 100644 --- a/browsers/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list.md +++ b/browsers/enterprise-mode/remove-sites-from-a-local-compatibililty-view-list.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Instructions about how to remove sites from a local compatibility view list. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: f6ecaa75-ebcb-4f8d-8721-4cd6e73c0ac9 +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Remove sites from a local compatibility view list (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list.md b/browsers/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list.md index ca2d5c72aa..4e7e10efde 100644 --- a/browsers/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list.md +++ b/browsers/enterprise-mode/remove-sites-from-a-local-enterprise-mode-site-list.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Instructions about how to remove sites from a local Enterprise Mode site list. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: c7d6dd0b-e264-42bb-8c9d-ac2f837018d2 +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Remove sites from a local Enterprise Mode site list (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md index e41bd71f67..2cb578171f 100644 --- a/browsers/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 254a986b-494f-4316-92c1-b089ee8b3e0a +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Save your site list to XML in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/schedule-production-change-enterprise-mode-portal.md b/browsers/enterprise-mode/schedule-production-change-enterprise-mode-portal.md index 17ab2b26ac..c946663dda 100644 --- a/browsers/enterprise-mode/schedule-production-change-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/schedule-production-change-enterprise-mode-portal.md @@ -3,11 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how Administrators can schedule approved change requests for production in the Enterprise Mode Site List Portal. -author: jdeckerms +author: dansimp ms.prod: ie11 title: Schedule approved change requests for production using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Schedule approved change requests for production using the Enterprise Mode Site List Portal @@ -47,4 +50,4 @@ After a change request is approved, the original Requester can schedule the chan ## Next steps -After the update to the production environment completes, the Requester must again test the change. If the testing succeeds, the Requester can sign off on the change request. If the testing fails, the Requester can contact the Administrator group for more help. For the production environment testing steps, see the [Verify the change request update in the production environment using the Enterprise Mode Site List Portal](verify-changes-production-enterprise-mode-portal.md) topic. \ No newline at end of file +After the update to the production environment completes, the Requester must again test the change. If the testing succeeds, the Requester can sign off on the change request. If the testing fails, the Requester can contact the Administrator group for more help. For the production environment testing steps, see the [Verify the change request update in the production environment using the Enterprise Mode Site List Portal](verify-changes-production-enterprise-mode-portal.md) topic. diff --git a/browsers/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index 17eed9cd2e..bf7e73664e 100644 --- a/browsers/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Search to see if a specific site already appears in your global Enterprise Mode site list. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: e399aeaf-6c3b-4cad-93c9-813df6ad47f9 +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Search your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md index 4dff80ce73..47322f0c03 100644 --- a/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md +++ b/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Set up and turn on Enterprise Mode logging and data collection in your organization. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 2e98a280-f677-422f-ba2e-f670362afcde +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Set up Enterprise Mode logging and data collection (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/set-up-enterprise-mode-portal.md b/browsers/enterprise-mode/set-up-enterprise-mode-portal.md index a3ec81f18b..21efc17c35 100644 --- a/browsers/enterprise-mode/set-up-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/set-up-enterprise-mode-portal.md @@ -3,11 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how to set up the Enterprise Mode Site List Portal for your organization. -author: jdeckerms +author: dansimp ms.prod: ie11 title: Set up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Set up the Enterprise Mode Site List Portal @@ -229,4 +232,4 @@ Register the EMIEScheduler tool and service for production site list changes. - [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) -- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) \ No newline at end of file +- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) diff --git a/browsers/enterprise-mode/turn-off-enterprise-mode.md b/browsers/enterprise-mode/turn-off-enterprise-mode.md index 31c3feec2f..d34ccca8ce 100644 --- a/browsers/enterprise-mode/turn-off-enterprise-mode.md +++ b/browsers/enterprise-mode/turn-off-enterprise-mode.md @@ -2,10 +2,13 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat -description: How to turn Enteprrise Mode off temporarily while testing websites and how to turn it off completely if you no longer want to to use it. -author: jdeckerms +description: How to turn Enterprise Mode off temporarily while testing websites and how to turn it off completely if you no longer want to to use it. +author: dansimp ms.prod: ie11 ms.assetid: 5027c163-71e0-49b8-9dc0-f0a7310c7ae3 +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Turn off Enterprise Mode (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md index 74225acded..b34f9be63f 100644 --- a/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md +++ b/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Turn on local user control and logging for Enterprise Mode. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 6622ecce-24b1-497e-894a-e1fd5a8a66d1 +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Turn on local control and logging for Enterprise Mode (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/use-the-enterprise-mode-portal.md b/browsers/enterprise-mode/use-the-enterprise-mode-portal.md index d57c5f411b..010448c58d 100644 --- a/browsers/enterprise-mode/use-the-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/use-the-enterprise-mode-portal.md @@ -7,6 +7,10 @@ ms.prod: ie11 title: Use the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp +author: dansimp --- # Use the Enterprise Mode Site List Portal diff --git a/browsers/enterprise-mode/use-the-enterprise-mode-site-list-manager.md b/browsers/enterprise-mode/use-the-enterprise-mode-site-list-manager.md index b85478da24..f68c42ca3c 100644 --- a/browsers/enterprise-mode/use-the-enterprise-mode-site-list-manager.md +++ b/browsers/enterprise-mode/use-the-enterprise-mode-site-list-manager.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Use the topics in this section to learn about how to use the Enterprise Mode Site List Manager. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: f4dbed4c-08ff-40b1-ab3f-60d3b6e8ec9b +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Use the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 12/04/2017 diff --git a/browsers/enterprise-mode/using-enterprise-mode.md b/browsers/enterprise-mode/using-enterprise-mode.md index 244e102f38..c6f3e6048e 100644 --- a/browsers/enterprise-mode/using-enterprise-mode.md +++ b/browsers/enterprise-mode/using-enterprise-mode.md @@ -3,9 +3,12 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: security description: Use this section to learn about how to turn on and use IE7 Enterprise Mode or IE8 Enterprise Mode. -author: jdeckerms +author: dansimp ms.prod: ie11 ms.assetid: 238ead3d-8920-429a-ac23-02f089c4384a +ms.reviewer: +manager: dansimp +ms.author: dansimp title: Using IE7 Enterprise Mode or IE8 Enterprise Mode (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md b/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md index 9ceeafb141..a72f720a3f 100644 --- a/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/verify-changes-preprod-enterprise-mode-portal.md @@ -3,11 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how to make sure your change request info is accurate within the pre-production environment of the Enterprise Mode Site List Portal. -author: jdeckerms +author: dansimp ms.prod: ie11 title: Verify your changes using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Verify your changes using the Enterprise Mode Site List Portal diff --git a/browsers/enterprise-mode/verify-changes-production-enterprise-mode-portal.md b/browsers/enterprise-mode/verify-changes-production-enterprise-mode-portal.md index 5ec5b93f66..8387697841 100644 --- a/browsers/enterprise-mode/verify-changes-production-enterprise-mode-portal.md +++ b/browsers/enterprise-mode/verify-changes-production-enterprise-mode-portal.md @@ -3,11 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how the Requester makes sure that the change request update is accurate within the production environment using the Enterprise Mode Site List Portal. -author: jdeckerms +author: dansimp ms.prod: ie11 title: Verify the change request update in the production environment using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Verify the change request update in the production environment using the Enterprise Mode Site List Portal diff --git a/browsers/enterprise-mode/view-apps-enterprise-mode-site-list.md b/browsers/enterprise-mode/view-apps-enterprise-mode-site-list.md index 8ed5e12491..6ae2c865ea 100644 --- a/browsers/enterprise-mode/view-apps-enterprise-mode-site-list.md +++ b/browsers/enterprise-mode/view-apps-enterprise-mode-site-list.md @@ -3,11 +3,14 @@ ms.localizationpriority: low ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how to view the active Enterprise Mode Site List from the Enterprise Mode Site List Portal. -author: jdeckerms +author: dansimp ms.prod: ie11 title: View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal diff --git a/browsers/includes/available-duel-browser-experiences-include.md b/browsers/includes/available-duel-browser-experiences-include.md index 3ea0832564..e506d779b2 100644 --- a/browsers/includes/available-duel-browser-experiences-include.md +++ b/browsers/includes/available-duel-browser-experiences-include.md @@ -1,20 +1,22 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -## Available dual-browser experiences -Based on the size of your legacy web app dependency, determined by the data collected with [Windows Upgrade Analytics](https://blogs.windows.com/windowsexperience/2016/09/26/new-windows-10-and-office-365-features-for-the-secure-productive-enterprise/), there are several options from which you can choose to configure your enterprise browsing environment: - -- Use Microsoft Edge as your primary browser. - -- Use Microsoft Edge as your primary browser and use Enterprise Mode to open sites in Internet Explorer 11 (IE11) that use IE proprietary technologies. - -- Use Microsoft Edge as your primary browser and open all intranet sites in IE11. - -- Use IE11 as your primary browser and use Enterprise Mode to open sites in Microsoft Edge that use modern web technologies. - -For more info about when to use which option, and which option is best for you, see the [Continuing to make it easier for Enterprise customers to upgrade to Internet Explorer 11 — and Windows 10](https://blogs.windows.com/msedgedev/2015/11/23/windows-10-1511-enterprise-improvements) blog. \ No newline at end of file +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +## Available dual-browser experiences +Based on the size of your legacy web app dependency, determined by the data collected with [Windows Upgrade Analytics](https://blogs.windows.com/windowsexperience/2016/09/26/new-windows-10-and-office-365-features-for-the-secure-productive-enterprise/), there are several options from which you can choose to configure your enterprise browsing environment: + +- Use Microsoft Edge as your primary browser. + +- Use Microsoft Edge as your primary browser and use Enterprise Mode to open sites in Internet Explorer 11 (IE11) that use IE proprietary technologies. + +- Use Microsoft Edge as your primary browser and open all intranet sites in IE11. + +- Use IE11 as your primary browser and use Enterprise Mode to open sites in Microsoft Edge that use modern web technologies. + +For more info about when to use which option, and which option is best for you, see the [Continuing to make it easier for Enterprise customers to upgrade to Internet Explorer 11 — and Windows 10](https://blogs.windows.com/msedgedev/2015/11/23/windows-10-1511-enterprise-improvements) blog. diff --git a/browsers/includes/helpful-topics-include.md b/browsers/includes/helpful-topics-include.md index 450c65b503..0a0f72e971 100644 --- a/browsers/includes/helpful-topics-include.md +++ b/browsers/includes/helpful-topics-include.md @@ -1,36 +1,38 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - - -## Helpful information and additional resources -- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) - -- [Technical guidance, tools, and resources on Enterprise browsing](https://technet.microsoft.com/ie) - -- [Enterprise Mode Site List Manager (schema v.1)](https://www.microsoft.com/download/details.aspx?id=42501) - -- [Enterprise Mode Site List Manager (schema v.2)](https://www.microsoft.com/download/details.aspx?id=49974) - -- [Use the Enterprise Mode Site List Manager](../enterprise-mode/use-the-enterprise-mode-site-list-manager.md) - -- [Collect data using Enterprise Site Discovery](../enterprise-mode/collect-data-using-enterprise-site-discovery.md) - -- [Web Application Compatibility Lab Kit](https://technet.microsoft.com/microsoft-edge/mt612809.aspx) - -- [Microsoft Services Support](https://www.microsoft.com/en-us/microsoftservices/support.aspx) - -- [Find a Microsoft partner on Pinpoint](https://partnercenter.microsoft.com/pcv/search) - - - - - -- [Web Application Compatibility Lab Kit for Internet Explorer 11](https://technet.microsoft.com/browser/mt612809.aspx) -- [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=290956) -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](https://go.microsoft.com/fwlink/p/?LinkId=760646) -- [Fix web compatibility issues using document modes and the Enterprise Mode site list](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list) +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + + +## Helpful information and additional resources +- [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal) + +- [Technical guidance, tools, and resources on Enterprise browsing](https://technet.microsoft.com/ie) + +- [Enterprise Mode Site List Manager (schema v.1)](https://www.microsoft.com/download/details.aspx?id=42501) + +- [Enterprise Mode Site List Manager (schema v.2)](https://www.microsoft.com/download/details.aspx?id=49974) + +- [Use the Enterprise Mode Site List Manager](../enterprise-mode/use-the-enterprise-mode-site-list-manager.md) + +- [Collect data using Enterprise Site Discovery](../enterprise-mode/collect-data-using-enterprise-site-discovery.md) + +- [Web Application Compatibility Lab Kit](https://technet.microsoft.com/microsoft-edge/mt612809.aspx) + +- [Microsoft Services Support](https://www.microsoft.com/microsoftservices/support.aspx) + +- [Find a Microsoft partner on Pinpoint](https://partnercenter.microsoft.com/pcv/search) + + + + + +- [Web Application Compatibility Lab Kit for Internet Explorer 11](https://technet.microsoft.com/browser/mt612809.aspx) +- [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=290956) +- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](https://go.microsoft.com/fwlink/p/?LinkId=760646) +- [Fix web compatibility issues using document modes and the Enterprise Mode site list](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list) diff --git a/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md b/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md index 02ad5fe86d..22464cc569 100644 --- a/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md +++ b/browsers/includes/import-into-the-enterprise-mode-site-list-mgr-include.md @@ -1,20 +1,22 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 -ms.prod: edge -ms:topic: include ---- - -If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. - ->[!IMPORTANT] ->Importing your file overwrites everything that’s currently in the tool, so make sure it’s what want to do. - -1. In the Enterprise Mode Site List Manager, click **File \> Import**. - -2. Go to the exported .EMIE file.

For example, `C:\users\\documents\sites.emie` - -1. Click **Open**. - -2. Review the alert message about all of your entries being overwritten and click **Yes**. +--- +author: eavena +ms.author: eravena +ms.date: 10/02/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager. + +>[!IMPORTANT] +>Importing your file overwrites everything that’s currently in the tool, so make sure it’s what want to do. + +1. In the Enterprise Mode Site List Manager, click **File \> Import**. + +2. Go to the exported .EMIE file.

For example, `C:\users\\documents\sites.emie` + +1. Click **Open**. + +2. Review the alert message about all of your entries being overwritten and click **Yes**. diff --git a/browsers/includes/interoperability-goals-enterprise-guidance.md b/browsers/includes/interoperability-goals-enterprise-guidance.md index a18552366f..04470d33af 100644 --- a/browsers/includes/interoperability-goals-enterprise-guidance.md +++ b/browsers/includes/interoperability-goals-enterprise-guidance.md @@ -1,37 +1,41 @@ ---- -author: shortpatti -ms.author: pashort -ms.date: 10/15/2018 -ms.prod: edge -ms:topic: include ---- - -## Interoperability goals and enterprise guidance - -Our primary goal is that your websites work in Microsoft Edge. To that end, we've made Microsoft Edge the default browser. - -You must continue using IE11 if web apps use any of the following: - -* ActiveX controls - -* x-ua-compatible headers - -* <meta> tags - -* Enterprise mode or compatibility view to addressing compatibility issues - -* legacy document modes - -If you have uninstalled IE11, you can download it from the Microsoft Store or the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). Alternatively, you can use Enterprise Mode with Microsoft Edge to transition only the sites that need these technologies to load in IE11. - ->[!TIP] ->If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy](https://go.microsoft.com/fwlink/p/?LinkId=620714). - - -|Technology |Why it existed |Why we don't need it anymore | -|---------|---------|---------| -|ActiveX |ActiveX is a binary extension model introduced in 1996 which allowed developers to embed native Windows technologies (COM/OLE) in web pages. These controls can be downloaded and installed from a site and were subsequently loaded in-process and rendered in Internet Explorer. | | -|Browser Helper Objects (BHO) |BHOs are a binary extension model introduced in 1997 which enabled developers to write COM objects that were loaded in-process with the browser and could perform actions on available windows and modules. A common use was to build toolbars that installed into Internet Explorer. | | -|Document modes | Starting with IE8, Internet Explorer introduced a new “document mode” with every release. These document modes could be requested via the x-ua-compatible header to put the browser into a mode which emulates legacy versions. |Similar to other modern browsers, Microsoft Edge has a single “living” document mode. To minimize the compatibility burden, we test features behind switches in about:flags until stable and ready to be turned on by default. | ---- - +--- +author: eavena +ms.author: eravena +ms.date: 10/15/2018 +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: edge +ms.topic: include +--- + +## Interoperability goals and enterprise guidance + +Our primary goal is that your websites work in Microsoft Edge. To that end, we've made Microsoft Edge the default browser. + +You must continue using IE11 if web apps use any of the following: + +* ActiveX controls + +* x-ua-compatible headers + +* <meta> tags with an http-equivalent value of X-UA-Compatible header + +* Enterprise mode or compatibility view to addressing compatibility issues + +* legacy document modes + +If you have uninstalled IE11, you can download it from the Microsoft Store or the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). Alternatively, you can use Enterprise Mode with Microsoft Edge to transition only the sites that need these technologies to load in IE11. + +>[!TIP] +>If you want to use Group Policy to set Internet Explorer as your default browser, you can find the info here, [Set the default browser using Group Policy](https://go.microsoft.com/fwlink/p/?LinkId=620714). + + +|Technology |Why it existed |Why we don't need it anymore | +|---------|---------|---------| +|ActiveX |ActiveX is a binary extension model introduced in 1996 which allowed developers to embed native Windows technologies (COM/OLE) in web pages. These controls can be downloaded and installed from a site and were subsequently loaded in-process and rendered in Internet Explorer. | | +|Browser Helper Objects (BHO) |BHOs are a binary extension model introduced in 1997 which enabled developers to write COM objects that were loaded in-process with the browser and could perform actions on available windows and modules. A common use was to build toolbars that installed into Internet Explorer. | | +|Document modes | Starting with IE8, Internet Explorer introduced a new “document mode” with every release. These document modes could be requested via the x-ua-compatible header to put the browser into a mode which emulates legacy versions. |Similar to other modern browsers, Microsoft Edge has a single “living” document mode. To minimize the compatibility burden, we test features behind switches in about:flags until stable and ready to be turned on by default. | + + +--- + diff --git a/browsers/internet-explorer/TOC.md b/browsers/internet-explorer/TOC.md index 229def58e0..28a0957588 100644 --- a/browsers/internet-explorer/TOC.md +++ b/browsers/internet-explorer/TOC.md @@ -1,188 +1,191 @@ -#[IE11 Deployment Guide for IT Pros](ie11-deploy-guide/index.md) +# [IE11 Deployment Guide for IT Pros](ie11-deploy-guide/index.md) -##[Change history for the Internet Explorer 11 (IE11) Deployment Guide](ie11-deploy-guide/change-history-for-internet-explorer-11.md) +## [Change history for the Internet Explorer 11 (IE11) Deployment Guide](ie11-deploy-guide/change-history-for-internet-explorer-11.md) -##[System requirements and language support for Internet Explorer 11](ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md) +## [System requirements and language support for Internet Explorer 11](ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md) -##[List of updated features and tools - Internet Explorer 11 (IE11)](ie11-deploy-guide/updated-features-and-tools-with-ie11.md) +## [List of updated features and tools - Internet Explorer 11 (IE11)](ie11-deploy-guide/updated-features-and-tools-with-ie11.md) -##[Install and Deploy Internet Explorer 11 (IE11)](ie11-deploy-guide/install-and-deploy-ie11.md) -###[Customize Internet Explorer 11 installation packages](ie11-deploy-guide/customize-ie11-install-packages.md) -####[Using IEAK 11 to create packages](ie11-deploy-guide/using-ieak11-to-create-install-packages.md) -####[Create packages for multiple operating systems or languages](ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md) -####[Using .INF files to create packages](ie11-deploy-guide/using-inf-files-to-create-install-packages.md) -###[Choose how to install Internet Explorer 11 (IE11)](ie11-deploy-guide/choose-how-to-install-ie11.md) -####[Install Internet Explorer 11 (IE11) - System Center 2012 R2 Configuration Manager](ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md) -####[Install Internet Explorer 11 (IE11) - Windows Server Update Services (WSUS)](ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md) -####[Install Internet Explorer 11 (IE11) - Microsoft Intune](ie11-deploy-guide/install-ie11-using-microsoft-intune.md) -####[Install Internet Explorer 11 (IE11) - Network](ie11-deploy-guide/install-ie11-using-the-network.md) -####[Install Internet Explorer 11 (IE11) - Operating system deployment systems](ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md) -####[Install Internet Explorer 11 (IE11) - Third-party tools](ie11-deploy-guide/install-ie11-using-third-party-tools.md) -###[Choose how to deploy Internet Explorer 11 (IE11)](ie11-deploy-guide/choose-how-to-deploy-ie11.md) -####[Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS)](ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md) -####[Deploy Internet Explorer 11 using software distribution tools](ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md) -###[Virtualization and compatibility with Internet Explorer 11](ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md) +## [Install and Deploy Internet Explorer 11 (IE11)](ie11-deploy-guide/install-and-deploy-ie11.md) +### [Customize Internet Explorer 11 installation packages](ie11-deploy-guide/customize-ie11-install-packages.md) +#### [Using IEAK 11 to create packages](ie11-deploy-guide/using-ieak11-to-create-install-packages.md) +#### [Create packages for multiple operating systems or languages](ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md) +#### [Using .INF files to create packages](ie11-deploy-guide/using-inf-files-to-create-install-packages.md) +### [Choose how to install Internet Explorer 11 (IE11)](ie11-deploy-guide/choose-how-to-install-ie11.md) +#### [Install Internet Explorer 11 (IE11) - System Center 2012 R2 Configuration Manager](ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md) +#### [Install Internet Explorer 11 (IE11) - Windows Server Update Services (WSUS)](ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md) +#### [Install Internet Explorer 11 (IE11) - Microsoft Intune](ie11-deploy-guide/install-ie11-using-microsoft-intune.md) +#### [Install Internet Explorer 11 (IE11) - Network](ie11-deploy-guide/install-ie11-using-the-network.md) +#### [Install Internet Explorer 11 (IE11) - Operating system deployment systems](ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md) +#### [Install Internet Explorer 11 (IE11) - Third-party tools](ie11-deploy-guide/install-ie11-using-third-party-tools.md) +### [Choose how to deploy Internet Explorer 11 (IE11)](ie11-deploy-guide/choose-how-to-deploy-ie11.md) +#### [Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS)](ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md) +#### [Deploy Internet Explorer 11 using software distribution tools](ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md) +### [Virtualization and compatibility with Internet Explorer 11](ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md) -##[Collect data using Enterprise Site Discovery](ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md) +## [Collect data using Enterprise Site Discovery](ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md) -##[Enterprise Mode for Internet Explorer 11 (IE11)](ie11-deploy-guide/enterprise-mode-overview-for-ie11.md) -###[Tips and tricks to manage Internet Explorer compatibility](ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md) -###[Enterprise Mode and the Enterprise Mode Site List](ie11-deploy-guide/what-is-enterprise-mode.md) -###[Set up Enterprise Mode logging and data collection](ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md) -###[Turn on Enterprise Mode and use a site list](ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md) -###[Enterprise Mode schema v.2 guidance](ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md) -###[Enterprise Mode schema v.1 guidance](ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md) -###[Check for a new Enterprise Mode site list xml file](ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md) -###[Turn on local control and logging for Enterprise Mode](ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md) -###[Use the Enterprise Mode Site List Manager](ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md) -####[Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) -####[Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) -####[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) -####[Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) -####[Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager](ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) -####[Fix validation problems using the Enterprise Mode Site List Manager](ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) -####[Search your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) -####[Save your site list to XML in the Enterprise Mode Site List Manager](ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) -####[Export your Enterprise Mode site list from the Enterprise Mode Site List Manager](ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) -####[Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md) -####[Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) -####[Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) -###[Use the Enterprise Mode Site List Portal](ie11-deploy-guide/use-the-enterprise-mode-portal.md) -####[Set up the Enterprise Mode Site List Portal](ie11-deploy-guide/set-up-enterprise-mode-portal.md) -#####[Use the Settings page to finish setting up the Enterprise Mode Site List Portal](ie11-deploy-guide/configure-settings-enterprise-mode-portal.md) -#####[Add employees to the Enterprise Mode Site List Portal](ie11-deploy-guide/add-employees-enterprise-mode-portal.md) -####[Workflow-based processes for employees using the Enterprise Mode Site List Portal](ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md) -#####[Create a change request using the Enterprise Mode Site List Portal](ie11-deploy-guide/create-change-request-enterprise-mode-portal.md) -#####[Verify your changes using the Enterprise Mode Site List Portal](ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md) -#####[Approve a change request using the Enterprise Mode Site List Portal](ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md) -#####[Schedule approved change requests for production using the Enterprise Mode Site List Portal](ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md) -#####[Verify the change request update in the production environment using the Enterprise Mode Site List Portal](ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md) -#####[View the apps currently on the Enterprise Mode Site List](ie11-deploy-guide/view-apps-enterprise-mode-site-list.md) -#####[View the available Enterprise Mode reports from the Enterprise Mode Site List Portal](ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md) -###[Using IE7 Enterprise Mode or IE8 Enterprise Mode](ie11-deploy-guide/using-enterprise-mode.md) -###[Fix web compatibility issues using document modes and the Enterprise Mode site list](ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md) -###[Remove sites from a local Enterprise Mode site list](ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md) -###[Remove sites from a local compatibility view list](ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md) -###[Turn off Enterprise Mode](ie11-deploy-guide/turn-off-enterprise-mode.md) +## [Enterprise Mode for Internet Explorer 11 (IE11)](ie11-deploy-guide/enterprise-mode-overview-for-ie11.md) +### [Tips and tricks to manage Internet Explorer compatibility](ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md) +### [Enterprise Mode and the Enterprise Mode Site List](ie11-deploy-guide/what-is-enterprise-mode.md) +### [Set up Enterprise Mode logging and data collection](ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md) +### [Turn on Enterprise Mode and use a site list](ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md) +### [Enterprise Mode schema v.2 guidance](ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md) +### [Enterprise Mode schema v.1 guidance](ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md) +### [Check for a new Enterprise Mode site list xml file](ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md) +### [Turn on local control and logging for Enterprise Mode](ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md) +### [Use the Enterprise Mode Site List Manager](ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md) +#### [Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md) +#### [Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md) +#### [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) +#### [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) +#### [Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager](ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md) +#### [Fix validation problems using the Enterprise Mode Site List Manager](ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md) +#### [Search your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +#### [Save your site list to XML in the Enterprise Mode Site List Manager](ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md) +#### [Export your Enterprise Mode site list from the Enterprise Mode Site List Manager](ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md) +#### [Import your Enterprise Mode site list to the Enterprise Mode Site List Manager](ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md) +#### [Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +#### [Remove all sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager](ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md) +### [Use the Enterprise Mode Site List Portal](ie11-deploy-guide/use-the-enterprise-mode-portal.md) +#### [Set up the Enterprise Mode Site List Portal](ie11-deploy-guide/set-up-enterprise-mode-portal.md) +##### [Use the Settings page to finish setting up the Enterprise Mode Site List Portal](ie11-deploy-guide/configure-settings-enterprise-mode-portal.md) +##### [Add employees to the Enterprise Mode Site List Portal](ie11-deploy-guide/add-employees-enterprise-mode-portal.md) +#### [Workflow-based processes for employees using the Enterprise Mode Site List Portal](ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md) +##### [Create a change request using the Enterprise Mode Site List Portal](ie11-deploy-guide/create-change-request-enterprise-mode-portal.md) +##### [Verify your changes using the Enterprise Mode Site List Portal](ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md) +##### [Approve a change request using the Enterprise Mode Site List Portal](ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md) +##### [Schedule approved change requests for production using the Enterprise Mode Site List Portal](ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md) +##### [Verify the change request update in the production environment using the Enterprise Mode Site List Portal](ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md) +##### [View the apps currently on the Enterprise Mode Site List](ie11-deploy-guide/view-apps-enterprise-mode-site-list.md) +##### [View the available Enterprise Mode reports from the Enterprise Mode Site List Portal](ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md) +### [Using IE7 Enterprise Mode or IE8 Enterprise Mode](ie11-deploy-guide/using-enterprise-mode.md) +### [Fix web compatibility issues using document modes and the Enterprise Mode site list](ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md) +### [Remove sites from a local Enterprise Mode site list](ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md) +### [Remove sites from a local compatibility view list](ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md) +### [Turn off Enterprise Mode](ie11-deploy-guide/turn-off-enterprise-mode.md) -##[Group Policy and Internet Explorer 11 (IE11)](ie11-deploy-guide/group-policy-and-ie11.md) -###[Group Policy management tools](ie11-deploy-guide/group-policy-objects-and-ie11.md) -####[Group Policy and the Group Policy Management Console (GPMC)](ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md) -####[Group Policy and the Local Group Policy Editor](ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md) -####[Group Policy and Advanced Group Policy Management (AGPM)](ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md) -####[Group Policy and Windows Powershell](ie11-deploy-guide/group-policy-windows-powershell-ie11.md) -####[Group Policy and Shortcut Extensions](ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md) -###[New group policy settings for Internet Explorer 11](ie11-deploy-guide/new-group-policy-settings-for-ie11.md) -###[Set the default browser using Group Policy](ie11-deploy-guide/set-the-default-browser-using-group-policy.md) -###[ActiveX installation using group policy](ie11-deploy-guide/activex-installation-using-group-policy.md) -###[Group Policy and compatibility with Internet Explorer 11](ie11-deploy-guide/group-policy-compatability-with-ie11.md) -###[Group policy preferences and Internet Explorer 11](ie11-deploy-guide/group-policy-preferences-and-ie11.md) -###[Administrative templates and Internet Explorer 11](ie11-deploy-guide/administrative-templates-and-ie11.md) -###[Enable and disable add-ons using administrative templates and group policy](ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md) +## [Group Policy and Internet Explorer 11 (IE11)](ie11-deploy-guide/group-policy-and-ie11.md) +### [Group Policy management tools](ie11-deploy-guide/group-policy-objects-and-ie11.md) +#### [Group Policy and the Group Policy Management Console (GPMC)](ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md) +#### [Group Policy and the Local Group Policy Editor](ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md) +#### [Group Policy and Advanced Group Policy Management (AGPM)](ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md) +#### [Group Policy and Windows Powershell](ie11-deploy-guide/group-policy-windows-powershell-ie11.md) +#### [Group Policy and Shortcut Extensions](ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md) +### [New group policy settings for Internet Explorer 11](ie11-deploy-guide/new-group-policy-settings-for-ie11.md) +### [Set the default browser using Group Policy](ie11-deploy-guide/set-the-default-browser-using-group-policy.md) +### [ActiveX installation using group policy](ie11-deploy-guide/activex-installation-using-group-policy.md) +### [Group Policy and compatibility with Internet Explorer 11](ie11-deploy-guide/group-policy-compatibility-with-ie11.md) +### [Group policy preferences and Internet Explorer 11](ie11-deploy-guide/group-policy-preferences-and-ie11.md) +### [Administrative templates and Internet Explorer 11](ie11-deploy-guide/administrative-templates-and-ie11.md) +### [Enable and disable add-ons using administrative templates and group policy](ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md) -##[Manage Internet Explorer 11](ie11-deploy-guide/manage-ie11-overview.md) -###[Auto detect settings Internet Explorer 11](ie11-deploy-guide/auto-detect-settings-for-ie11.md) -###[Auto configuration settings for Internet Explorer 11](ie11-deploy-guide/auto-configuration-settings-for-ie11.md) -###[Auto proxy configuration settings for Internet Explorer 11](ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md) +## [Manage Internet Explorer 11](ie11-deploy-guide/manage-ie11-overview.md) +### [Auto detect settings Internet Explorer 11](ie11-deploy-guide/auto-detect-settings-for-ie11.md) +### [Auto configuration settings for Internet Explorer 11](ie11-deploy-guide/auto-configuration-settings-for-ie11.md) +### [Auto proxy configuration settings for Internet Explorer 11](ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md) -##[Troubleshoot Internet Explorer 11 (IE11)](ie11-deploy-guide/troubleshoot-ie11.md) -###[Setup problems with Internet Explorer 11](ie11-deploy-guide/setup-problems-with-ie11.md) -###[Install problems with Internet Explorer 11](ie11-deploy-guide/install-problems-with-ie11.md) -###[Problems after installing Internet Explorer 11](ie11-deploy-guide/problems-after-installing-ie11.md) -###[Auto configuration and auto proxy problems with Internet Explorer 11](ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md) -###[User interface problems with Internet Explorer 11](ie11-deploy-guide/user-interface-problems-with-ie11.md) -###[Group Policy problems with Internet Explorer 11](ie11-deploy-guide/group-policy-problems-ie11.md) -###[.NET Framework problems with Internet Explorer 11](ie11-deploy-guide/net-framework-problems-with-ie11.md) -###[Enhanced Protected Mode problems with Internet Explorer](ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md) -###[Fix font rendering problems by turning off natural metrics](ie11-deploy-guide/turn-off-natural-metrics.md) -###[Intranet problems with Internet Explorer 11](ie11-deploy-guide/intranet-problems-and-ie11.md) -###[Browser cache changes and roaming profiles](ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md) +## [Troubleshoot Internet Explorer 11 (IE11)](ie11-deploy-guide/troubleshoot-ie11.md) +### [Setup problems with Internet Explorer 11](ie11-deploy-guide/setup-problems-with-ie11.md) +### [Install problems with Internet Explorer 11](ie11-deploy-guide/install-problems-with-ie11.md) +### [Problems after installing Internet Explorer 11](ie11-deploy-guide/problems-after-installing-ie11.md) +### [Auto configuration and auto proxy problems with Internet Explorer 11](ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md) +### [User interface problems with Internet Explorer 11](ie11-deploy-guide/user-interface-problems-with-ie11.md) +### [Group Policy problems with Internet Explorer 11](ie11-deploy-guide/group-policy-problems-ie11.md) +### [.NET Framework problems with Internet Explorer 11](ie11-deploy-guide/net-framework-problems-with-ie11.md) +### [Enhanced Protected Mode problems with Internet Explorer](ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md) +### [Fix font rendering problems by turning off natural metrics](ie11-deploy-guide/turn-off-natural-metrics.md) +### [Intranet problems with Internet Explorer 11](ie11-deploy-guide/intranet-problems-and-ie11.md) +### [Browser cache changes and roaming profiles](ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md) -##[Out-of-date ActiveX control blocking](ie11-deploy-guide/out-of-date-activex-control-blocking.md) -###[Blocked out-of-date ActiveX controls](ie11-deploy-guide/blocked-out-of-date-activex-controls.md) +## [Out-of-date ActiveX control blocking](ie11-deploy-guide/out-of-date-activex-control-blocking.md) +### [Blocked out-of-date ActiveX controls](ie11-deploy-guide/blocked-out-of-date-activex-controls.md) -##[Deprecated document modes and Internet Explorer 11](ie11-deploy-guide/deprecated-document-modes.md) +## [Deprecated document modes and Internet Explorer 11](ie11-deploy-guide/deprecated-document-modes.md) -##[What is the Internet Explorer 11 Blocker Toolkit?](ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md) -###[Internet Explorer 11 delivery through automatic updates](ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) -###[Internet Explorer 11 Blocker Toolkit FAQ](ie11-faq/faq-ie11-blocker-toolkit.md) +## [What is the Internet Explorer 11 Blocker Toolkit?](ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md) +### [Internet Explorer 11 delivery through automatic updates](ie11-deploy-guide/ie11-delivery-through-automatic-updates.md) +### [Internet Explorer 11 Blocker Toolkit FAQ](ie11-faq/faq-ie11-blocker-toolkit.md) -##[Missing Internet Explorer Maintenance settings for Internet Explorer 11](ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md) +## [Missing Internet Explorer Maintenance settings for Internet Explorer 11](ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md) -##[Missing the Compatibility View Button](ie11-deploy-guide/missing-the-compatibility-view-button.md) +## [Missing the Compatibility View Button](ie11-deploy-guide/missing-the-compatibility-view-button.md) -##[Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013](ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md) +## [Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013](ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md) -#[IE11 Frequently Asked Questions (FAQ) Guide for IT Pros](ie11-faq/faq-for-it-pros-ie11.md) +# [IE11 Frequently Asked Questions (FAQ) Guide for IT Pros](ie11-faq/faq-for-it-pros-ie11.md) -#[Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](ie11-ieak/index.md) -##[What IEAK can do for you](ie11-ieak/what-ieak-can-do-for-you.md) -##[Internet Explorer Administration Kit (IEAK) information and downloads](ie11-ieak/ieak-information-and-downloads.md) -##[Before you start using IEAK 11](ie11-ieak/before-you-create-custom-pkgs-ieak11.md) -###[Hardware and software requirements for IEAK 11](ie11-ieak/hardware-and-software-reqs-ieak11.md) -###[Determine the licensing version and features to use in IEAK 11](ie11-ieak/licensing-version-and-features-ieak11.md) -###[Security features and IEAK 11](ie11-ieak/security-and-ieak11.md) -###[File types used or created by IEAK 11](ie11-ieak/file-types-ieak11.md) -###[Tasks and references to consider before creating and deploying custom packages using IEAK 11](ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md) -###[Create the build computer folder structure using IEAK 11](ie11-ieak/create-build-folder-structure-ieak11.md) -###[Set up auto detection for DHCP or DNS servers using IEAK 11](ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md) -###[Use proxy auto-configuration (.pac) files with IEAK 11](ie11-ieak/proxy-auto-config-examples.md) -###[Customize the toolbar button and Favorites List icons using IEAK 11](ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md) -###[Use the uninstallation .INF files to uninstall custom components](ie11-ieak/create-uninstall-inf-files-for-custom-components.md) -###[Add and approve ActiveX controls using the IEAK 11](ie11-ieak/add-and-approve-activex-controls-ieak11.md) -###[Register an uninstall app for custom components using IEAK 11](ie11-ieak/register-uninstall-app-ieak11.md) -###[Customize Automatic Search for Internet Explorer using IEAK 11](ie11-ieak/customize-automatic-search-for-ie.md) -###[Create multiple versions of your custom package using IEAK 11](ie11-ieak/create-multiple-browser-packages-ieak11.md) -###[Before you install your package over your network using IEAK 11](ie11-ieak/prep-network-install-with-ieak11.md) -###[Use the RSoP snap-in to review policy settings](ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md) -###[IEAK 11 - Frequently Asked Questions](ie11-faq/faq-ieak11.md) -###[Troubleshoot custom package and IEAK 11 problems](ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md) +# [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](ie11-ieak/index.md) +## [What IEAK can do for you](ie11-ieak/what-ieak-can-do-for-you.md) +## [Internet Explorer Administration Kit (IEAK) information and downloads](ie11-ieak/ieak-information-and-downloads.md) +## [Before you start using IEAK 11](ie11-ieak/before-you-create-custom-pkgs-ieak11.md) +### [Hardware and software requirements for IEAK 11](ie11-ieak/hardware-and-software-reqs-ieak11.md) +### [Determine the licensing version and features to use in IEAK 11](ie11-ieak/licensing-version-and-features-ieak11.md) +### [Security features and IEAK 11](ie11-ieak/security-and-ieak11.md) +### [File types used or created by IEAK 11](ie11-ieak/file-types-ieak11.md) +### [Tasks and references to consider before creating and deploying custom packages using IEAK 11](ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md) +### [Create the build computer folder structure using IEAK 11](ie11-ieak/create-build-folder-structure-ieak11.md) +### [Set up auto detection for DHCP or DNS servers using IEAK 11](ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md) +### [Use proxy auto-configuration (.pac) files with IEAK 11](ie11-ieak/proxy-auto-config-examples.md) +### [Customize the toolbar button and Favorites List icons using IEAK 11](ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md) +### [Use the uninstallation .INF files to uninstall custom components](ie11-ieak/create-uninstall-inf-files-for-custom-components.md) +### [Add and approve ActiveX controls using the IEAK 11](ie11-ieak/add-and-approve-activex-controls-ieak11.md) +### [Register an uninstall app for custom components using IEAK 11](ie11-ieak/register-uninstall-app-ieak11.md) +### [Customize Automatic Search for Internet Explorer using IEAK 11](ie11-ieak/customize-automatic-search-for-ie.md) +### [Create multiple versions of your custom package using IEAK 11](ie11-ieak/create-multiple-browser-packages-ieak11.md) +### [Before you install your package over your network using IEAK 11](ie11-ieak/prep-network-install-with-ieak11.md) +### [Use the RSoP snap-in to review policy settings](ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md) +### [IEAK 11 - Frequently Asked Questions](ie11-faq/faq-ieak11.md) +### [Troubleshoot custom package and IEAK 11 problems](ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md) -##[Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](ie11-ieak/ieak11-wizard-custom-options.md) -###[Use the File Locations page in the IEAK 11 Wizard](ie11-ieak/file-locations-ieak11-wizard.md) -###[Use the Platform Selection page in the IEAK 11 Wizard](ie11-ieak/platform-selection-ieak11-wizard.md) -###[Use the Language Selection page in the IEAK 11 Wizard](ie11-ieak/language-selection-ieak11-wizard.md) -###[Use the Package Type Selection page in the IEAK 11 Wizard](ie11-ieak/pkg-type-selection-ieak11-wizard.md) -###[Use the Feature Selection page in the IEAK 11 Wizard](ie11-ieak/feature-selection-ieak11-wizard.md) -###[Use the Automatic Version Synchronization page in the IEAK 11 Wizard](ie11-ieak/auto-version-sync-ieak11-wizard.md) -###[Use the Custom Components page in the IEAK 11 Wizard](ie11-ieak/custom-components-ieak11-wizard.md) -###[Use the Internal Install page in the IEAK 11 Wizard](ie11-ieak/internal-install-ieak11-wizard.md) -###[Use the User Experience page in the IEAK 11 Wizard](ie11-ieak/user-experience-ieak11-wizard.md) -###[Use the Browser User Interface page in the IEAK 11 Wizard](ie11-ieak/browser-ui-ieak11-wizard.md) -###[Use the Search Providers page in the IEAK 11 Wizard](ie11-ieak/search-providers-ieak11-wizard.md) -###[Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md) -###[Use the Accelerators page in the IEAK 11 Wizard](ie11-ieak/accelerators-ieak11-wizard.md) -###[Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard](ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md) -###[Use the Browsing Options page in the IEAK 11 Wizard](ie11-ieak/browsing-options-ieak11-wizard.md) -###[Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard](ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md) -###[Use the Compatibility View page in the IEAK 11 Wizard](ie11-ieak/compat-view-ieak11-wizard.md) -###[Use the Connection Manager page in the IEAK 11 Wizard](ie11-ieak/connection-mgr-ieak11-wizard.md) -###[Use the Connection Settings page in the IEAK 11 Wizard](ie11-ieak/connection-settings-ieak11-wizard.md) -###[Use the Automatic Configuration page in the IEAK 11 Wizard](ie11-ieak/auto-config-ieak11-wizard.md) -###[Use the Proxy Settings page in the IEAK 11 Wizard](ie11-ieak/proxy-settings-ieak11-wizard.md) -###[Use the Security and Privacy Settings page in the IEAK 11 Wizard](ie11-ieak/security-and-privacy-settings-ieak11-wizard.md) -###[Use the Add a Root Certificate page in the IEAK 11 Wizard](ie11-ieak/add-root-certificate-ieak11-wizard.md) -###[Use the Programs page in the IEAK 11 Wizard](ie11-ieak/programs-ieak11-wizard.md) -###[Use the Additional Settings page in the IEAK 11 Wizard](ie11-ieak/additional-settings-ieak11-wizard.md) -###[Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard](ie11-ieak/wizard-complete-ieak11-wizard.md) +## [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](ie11-ieak/ieak11-wizard-custom-options.md) +### [Use the File Locations page in the IEAK 11 Wizard](ie11-ieak/file-locations-ieak11-wizard.md) +### [Use the Platform Selection page in the IEAK 11 Wizard](ie11-ieak/platform-selection-ieak11-wizard.md) +### [Use the Language Selection page in the IEAK 11 Wizard](ie11-ieak/language-selection-ieak11-wizard.md) +### [Use the Package Type Selection page in the IEAK 11 Wizard](ie11-ieak/pkg-type-selection-ieak11-wizard.md) +### [Use the Feature Selection page in the IEAK 11 Wizard](ie11-ieak/feature-selection-ieak11-wizard.md) +### [Use the Automatic Version Synchronization page in the IEAK 11 Wizard](ie11-ieak/auto-version-sync-ieak11-wizard.md) +### [Use the Custom Components page in the IEAK 11 Wizard](ie11-ieak/custom-components-ieak11-wizard.md) +### [Use the Internal Install page in the IEAK 11 Wizard](ie11-ieak/internal-install-ieak11-wizard.md) +### [Use the User Experience page in the IEAK 11 Wizard](ie11-ieak/user-experience-ieak11-wizard.md) +### [Use the Browser User Interface page in the IEAK 11 Wizard](ie11-ieak/browser-ui-ieak11-wizard.md) +### [Use the Search Providers page in the IEAK 11 Wizard](ie11-ieak/search-providers-ieak11-wizard.md) +### [Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md) +### [Use the Accelerators page in the IEAK 11 Wizard](ie11-ieak/accelerators-ieak11-wizard.md) +### [Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard](ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md) +### [Use the Browsing Options page in the IEAK 11 Wizard](ie11-ieak/browsing-options-ieak11-wizard.md) +### [Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard](ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md) +### [Use the Compatibility View page in the IEAK 11 Wizard](ie11-ieak/compat-view-ieak11-wizard.md) +### [Use the Connection Manager page in the IEAK 11 Wizard](ie11-ieak/connection-mgr-ieak11-wizard.md) +### [Use the Connection Settings page in the IEAK 11 Wizard](ie11-ieak/connection-settings-ieak11-wizard.md) +### [Use the Automatic Configuration page in the IEAK 11 Wizard](ie11-ieak/auto-config-ieak11-wizard.md) +### [Use the Proxy Settings page in the IEAK 11 Wizard](ie11-ieak/proxy-settings-ieak11-wizard.md) +### [Use the Security and Privacy Settings page in the IEAK 11 Wizard](ie11-ieak/security-and-privacy-settings-ieak11-wizard.md) +### [Use the Add a Root Certificate page in the IEAK 11 Wizard](ie11-ieak/add-root-certificate-ieak11-wizard.md) +### [Use the Programs page in the IEAK 11 Wizard](ie11-ieak/programs-ieak11-wizard.md) +### [Use the Additional Settings page in the IEAK 11 Wizard](ie11-ieak/additional-settings-ieak11-wizard.md) +### [Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard](ie11-ieak/wizard-complete-ieak11-wizard.md) -##[Using Internet Settings (.INS) files with IEAK 11](ie11-ieak/using-internet-settings-ins-files.md) -###[Use the Branding .INS file to create custom branding and setup info](ie11-ieak/branding-ins-file-setting.md) -###[Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar](ie11-ieak/browsertoolbars-ins-file-setting.md) -###[Use the CabSigning .INS file to review the digital signatures for your apps](ie11-ieak/cabsigning-ins-file-setting.md) -###[Use the ConnectionSettings .INS file to review the network connections for install](ie11-ieak/connectionsettings-ins-file-setting.md) -###[Use the CustomBranding .INS file to specify the custom branding location](ie11-ieak/custombranding-ins-file-setting.md) -###[Use the ExtRegInf .INS file to specify installation files and mode](ie11-ieak/extreginf-ins-file-setting.md) -###[Use the FavoritesEx .INS file for your Favorites icon and URLs](ie11-ieak/favoritesex-ins-file-setting.md) -###[Use the HideCustom .INS file to hide GUIDs](ie11-ieak/hidecustom-ins-file-setting.md) -###[Use the ISP_Security .INS file to add your root certificate](ie11-ieak/isp-security-ins-file-setting.md) -###[Use the Media .INS file to specify your install media](ie11-ieak/media-ins-file-setting.md) -###[Use the Proxy .INS file to specify a proxy server](ie11-ieak/proxy-ins-file-setting.md) -###[Use the Security Imports .INS file to import security info](ie11-ieak/security-imports-ins-file-setting.md) -###[Use the URL .INS file to use an auto-configured proxy server](ie11-ieak/url-ins-file-setting.md) +## [Using Internet Settings (.INS) files with IEAK 11](ie11-ieak/using-internet-settings-ins-files.md) +### [Use the Branding .INS file to create custom branding and setup info](ie11-ieak/branding-ins-file-setting.md) +### [Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar](ie11-ieak/browsertoolbars-ins-file-setting.md) +### [Use the CabSigning .INS file to review the digital signatures for your apps](ie11-ieak/cabsigning-ins-file-setting.md) +### [Use the ConnectionSettings .INS file to review the network connections for install](ie11-ieak/connectionsettings-ins-file-setting.md) +### [Use the CustomBranding .INS file to specify the custom branding location](ie11-ieak/custombranding-ins-file-setting.md) +### [Use the ExtRegInf .INS file to specify installation files and mode](ie11-ieak/extreginf-ins-file-setting.md) +### [Use the FavoritesEx .INS file for your Favorites icon and URLs](ie11-ieak/favoritesex-ins-file-setting.md) +### [Use the HideCustom .INS file to hide GUIDs](ie11-ieak/hidecustom-ins-file-setting.md) +### [Use the ISP_Security .INS file to add your root certificate](ie11-ieak/isp-security-ins-file-setting.md) +### [Use the Media .INS file to specify your install media](ie11-ieak/media-ins-file-setting.md) +### [Use the Proxy .INS file to specify a proxy server](ie11-ieak/proxy-ins-file-setting.md) +### [Use the Security Imports .INS file to import security info](ie11-ieak/security-imports-ins-file-setting.md) +### [Use the URL .INS file to use an auto-configured proxy server](ie11-ieak/url-ins-file-setting.md) -##[IExpress Wizard for Windows Server 2008 R2 with SP1](ie11-ieak/iexpress-wizard-for-win-server.md) -###[IExpress Wizard command-line options](ie11-ieak/iexpress-command-line-options.md) -###[Internet Explorer Setup command-line options and return codes](ie11-ieak/ie-setup-command-line-options-and-return-codes.md) +## [IExpress Wizard for Windows Server 2008 R2 with SP1](ie11-ieak/iexpress-wizard-for-win-server.md) +### [IExpress Wizard command-line options](ie11-ieak/iexpress-command-line-options.md) +### [Internet Explorer Setup command-line options and return codes](ie11-ieak/ie-setup-command-line-options-and-return-codes.md) +## KB Troubleshoot +### [Clear the Internet Explorer cache from a command line](kb-support/clear-ie-cache-from-command-line.md) +### [Internet Explorer and Microsoft Edge FAQ for IT Pros](kb-support/ie-edge-faqs.md) diff --git a/browsers/internet-explorer/docfx.json b/browsers/internet-explorer/docfx.json index 0c42ef4158..50208546bb 100644 --- a/browsers/internet-explorer/docfx.json +++ b/browsers/internet-explorer/docfx.json @@ -1,40 +1,48 @@ { "build": { - "content": - [ - { - "files": ["**/*.md","**/*.yml"], - "exclude": ["**/obj/**"] - } - ], + "content": [ + { + "files": [ + "**/*.md", + "**/*.yml" + ], + "exclude": [ + "**/obj/**" + ] + } + ], "resource": [ - { - "files": ["**/images/**"], - "exclude": ["**/obj/**"] - } + { + "files": [ + "**/images/**" + ], + "exclude": [ + "**/obj/**" + ] + } ], "globalMetadata": { - "uhfHeaderId": "MSDocsHeader-WindowsIT", - "breadcrumb_path": "/internet-explorer/breadcrumb/toc.json", - "ROBOTS": "INDEX, FOLLOW", - "ms.author": "shortpatti", - "author": "eross-msft", - "ms.technology": "internet-explorer", - "ms.topic": "article", - "ms.date": "04/05/2017", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", - "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "Win.internet-explorer" - } - } + "breadcrumb_path": "/internet-explorer/breadcrumb/toc.json", + "ROBOTS": "INDEX, FOLLOW", + "audience": "ITPro", + "ms.technology": "internet-explorer", + "ms.prod": "ie11", + "ms.topic": "article", + "manager": "laurawi", + "ms.date": "04/05/2017", + "feedback_system": "None", + "hideEdit": true, + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "Win.internet-explorer", + "folder_relative_path_in_docset": "./" + } + }, + "titleSuffix": "Internet Explorer" }, - "externalReference": [ - ], + "externalReference": [], "template": "op.html", "dest": "edges/internet-explorer", - "markdownEngineName": "dfm" + "markdownEngineName": "markdig" } -} \ No newline at end of file +} diff --git a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md index 8cab9278d3..8fe62f2f79 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/activex-installation-using-group-policy.md @@ -1,46 +1,49 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: How to use Group Policy to install ActiveX controls. -author: shortpatti -ms.prod: ie11 -ms.assetid: 59185370-558c-47e0-930c-8a5ed657e9e3 -title: ActiveX installation using group policy (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Group Policy and ActiveX installation - -ActiveX controls are installed and invoked using the HTML object tag with the CODEBASE attribute. This attribute, through a URL, makes Internet Explorer: - -- Get the ActiveX control if it's not already installed. - -- Download the installation package. - -- Perform trust verification on the object. - -- Prompt for installation permission, using the IE Information Bar. - -During installation, the rendering page registers and invokes the control, so that after installation, any standard user can invoke the control. - -**Important**
ActiveX control installation requires administrator-level permissions. - -## Group Policy for the ActiveX Installer Service - -You use the ActiveX Installer Service (AXIS) and Group Policy to manage your ActiveX control deployment. The AXIS-related settings can be changed using either the Group Policy Management Console (GPMC) or the Local Group Policy Editor, and include: - -- **Approved Installation Sites for ActiveX Controls.** A list of approved installation sites used by AXIS to determine whether it can install a particular ActiveX control. - -- **ActiveX installation policy for sites in trusted zones.** Identifies how AXIS should behave when a website tries to install an ActiveX control. First, AXIS looks to see if the site appears in either the list of approved installation sites or in the **Trusted sites** zone. If the does, then AXIS checks to make sure the control meets your company's policy requirements. If the ActiveX control meets all of these requirements, the control is installed. - -For more information about the ActiveX Installer Service, see [Administering the ActiveX Installer Service in Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=214503). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: How to use Group Policy to install ActiveX controls. +author: dansimp +ms.prod: ie11 +ms.assetid: 59185370-558c-47e0-930c-8a5ed657e9e3 +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: ActiveX installation using group policy (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Group Policy and ActiveX installation + +ActiveX controls are installed and invoked using the HTML object tag with the CODEBASE attribute. This attribute, through a URL, makes Internet Explorer: + +- Get the ActiveX control if it's not already installed. + +- Download the installation package. + +- Perform trust verification on the object. + +- Prompt for installation permission, using the IE Information Bar. + +During installation, the rendering page registers and invokes the control, so that after installation, any standard user can invoke the control. + +**Important**
ActiveX control installation requires administrator-level permissions. + +## Group Policy for the ActiveX Installer Service + +You use the ActiveX Installer Service (AXIS) and Group Policy to manage your ActiveX control deployment. The AXIS-related settings can be changed using either the Group Policy Management Console (GPMC) or the Local Group Policy Editor, and include: + +- **Approved Installation Sites for ActiveX Controls.** A list of approved installation sites used by AXIS to determine whether it can install a particular ActiveX control. + +- **ActiveX installation policy for sites in trusted zones.** Identifies how AXIS should behave when a website tries to install an ActiveX control. First, AXIS looks to see if the site appears in either the list of approved installation sites or in the **Trusted sites** zone. If the does, then AXIS checks to make sure the control meets your company's policy requirements. If the ActiveX control meets all of these requirements, the control is installed. + +For more information about the ActiveX Installer Service, see [Administering the ActiveX Installer Service in Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=214503). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md index bee3a36c25..664bc596e1 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-employees-enterprise-mode-portal.md @@ -1,65 +1,68 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how to add employees to the Enterprise Mode Site List Portal. -author: shortpatti -ms.prod: ie11 -title: Add employees to the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - -# Add employees to the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After you get the Enterprise Mode Site List Portal up and running, you must add your employees. During this process, you'll also assign roles and groups. - -The available roles are: - -- **Requester.** The primary role to assign to employees that need to access the Enterprise Mode Site List Portal. The Requester can create change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal change requests, and sign off and close personal change requests. - -- **App Manager.** This role is considered part of the Approvers group. The App Manager can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. - -- **Group Head.** This role is considered part of the Approvers group. The Group Head can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. - -- **Administrator.** The role with the highest-level rights; we recommend limiting the number of employees you grant this role. The Administrator can perform any task that can be performed by the other roles, in addition to adding employees to the portal, assigning employee roles, approving registrations to the portal, configuring portal settings (for example, determining the freeze schedule, determining the pre-production and production XML paths, and determining the attachment upload location), and using the standalone Enterprise Mode Site List Manager page. - -**To add an employee to the Enterprise Mode Site List Portal** -1. Open the Enterprise Mode Site List Portal and click the **Employee Management** icon in the upper-right area of the page. - - The **Employee management** page appears. - -2. Click **Add a new employee**. - - The **Add a new employee** page appears. - -3. Fill out the fields for each employee, including: - - - **Email.** Add the employee's email address. - - - **Name.** This box autofills based on the email address. - - - **Role.** Pick a single role for the employee, based on the list above. - - - **Group name.** Pick the name of the employee's group. The group association also assigns a group of Approvers. - - - **Comments.** Add optional comments about the employee. - - - **Active.** Click the check box to make the employee active in the system. If you want to keep the employee in the system, but you want to prevent access, clear this check box. - -4. Click **Save**. - -**To export all employees to an Excel spreadsheet** -1. On the **Employee management** page, click **Export to Excel**. - -2. Save the EnterpriseModeUsersList.xlsx file. - - The Excel file includes all employees with access to the Enterprise Mode Site List Portal, including user name, email address, role, and group name. \ No newline at end of file +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how to add employees to the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: Add employees to the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +--- + +# Add employees to the Enterprise Mode Site List Portal + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +After you get the Enterprise Mode Site List Portal up and running, you must add your employees. During this process, you'll also assign roles and groups. + +The available roles are: + +- **Requester.** The primary role to assign to employees that need to access the Enterprise Mode Site List Portal. The Requester can create change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal change requests, and sign off and close personal change requests. + +- **App Manager.** This role is considered part of the Approvers group. The App Manager can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. + +- **Group Head.** This role is considered part of the Approvers group. The Group Head can approve change requests, validate changes in the pre-production environment, rollback pre-production and production changes in case of failure, send personal approval requests, view personal requests, and sign off and close personal requests. + +- **Administrator.** The role with the highest-level rights; we recommend limiting the number of employees you grant this role. The Administrator can perform any task that can be performed by the other roles, in addition to adding employees to the portal, assigning employee roles, approving registrations to the portal, configuring portal settings (for example, determining the freeze schedule, determining the pre-production and production XML paths, and determining the attachment upload location), and using the standalone Enterprise Mode Site List Manager page. + +**To add an employee to the Enterprise Mode Site List Portal** +1. Open the Enterprise Mode Site List Portal and click the **Employee Management** icon in the upper-right area of the page. + + The **Employee management** page appears. + +2. Click **Add a new employee**. + + The **Add a new employee** page appears. + +3. Fill out the fields for each employee, including: + + - **Email.** Add the employee's email address. + + - **Name.** This box autofills based on the email address. + + - **Role.** Pick a single role for the employee, based on the list above. + + - **Group name.** Pick the name of the employee's group. The group association also assigns a group of Approvers. + + - **Comments.** Add optional comments about the employee. + + - **Active.** Click the check box to make the employee active in the system. If you want to keep the employee in the system, but you want to prevent access, clear this check box. + +4. Click **Save**. + +**To export all employees to an Excel spreadsheet** +1. On the **Employee management** page, click **Export to Excel**. + +2. Save the EnterpriseModeUsersList.xlsx file. + + The Excel file includes all employees with access to the Enterprise Mode Site List Portal, including user name, email address, role, and group name. diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md index a399ecaa73..8ead60630e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md @@ -1,109 +1,112 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the Bulk add from file area of the Enterprise Mode Site List Manager. -author: shortpatti -ms.prod: ie11 -ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c -title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) - -**Applies to:** - -- Windows 8.1 -- Windows 7 - -You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the **Bulk add from file** area of the Enterprise Mode Site List Manager. You can only add specific URLs, not Internet or Intranet Zones. - -If you want to add your websites one at a time, see Add sites to the [Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). - -## Create an Enterprise Mode site list (TXT) file -You can create and use a custom text file to add multiple sites to your Enterprise Mode site list at the same time.

**Important**
This text file is only lets you add multiple sites at the same time. You can’t use this file to deploy Enterprise Mode into your company. - -You must separate each site using commas or carriage returns. For example: - -``` -microsoft.com, bing.com, bing.com/images -``` -**-OR-** - -``` -microsoft.com -bing.com -bing.com/images -``` - -## Create an Enterprise Mode site list (XML) file using the v.1 version of the Enterprise Mode schema -You can create and use a custom XML file with the Enterprise Mode Site List Manager to add multiple sites to your Enterprise Mode site list at the same time. For more info about the v.1 version of the Enterprise Mode schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -Each XML file must include: - -- **Version number.** This number must be incremented with each version of the Enterprise Mode site list, letting Internet Explorer know whether the list is new. Approximately 65 seconds after Internet Explorer 11 starts, it compares your site list version to the stored version number. If your file has a higher number, the newer version is loaded.

**Important**
After this check, IE11 won’t look for an updated list again until you restart the browser. - -- **<emie> tag.** This tag specifies the domains and domain paths that must be rendered using IE7 Enterprise Mode, IE8 Enterprise Mode, or the default IE11 browser environment.

**Important**
If you decide a site requires IE7 Enterprise Mode, you must add `forceCompatView=”true”` to your XML file. That code tells Enterprise Mode to check for a `DOCTYPE` tag on the specified webpage. If there is, the site renders using Windows Internet Explorer 7. If there’s no tag, the site renders using Microsoft Internet Explorer 5. - -- **<docMode> tag.**This tag specifies the domains and domain paths that need either to appear using the specific doc mode you assigned to the site. Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -### Enterprise Mode v.1 XML schema example -The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). - -``` - - - www.cpandl.com - www.woodgrovebank.com - adatum.com - contoso.com - relecloud.com - /about - - fabrikam.com - /products - - - - contoso.com - /travel - - fabrikam.com - /products - - - -``` - -To make sure your site list is up-to-date; wait 65 seconds after opening IE and then check that the `CurrentVersion` value in the `HKEY\CURRENT\USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode\` registry key matches the version number in your file.

**Important**
If `CurrentVersion` is not set or is wrong, it means that the XML parsing failed. This can mean that the XML file isn’t there, that there are access problems, or that the XML file format is wrong. Don’t manually change the `CurrentVersion` registry setting. You must make your changes to your site list and then update the list using the import function in the Enterprise Mode Site List Manager (. - -## Add multiple sites to the Enterprise Mode Site List Manager (schema v.1) -After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.1). - - **To add multiple sites** - -1. In the Enterprise Mode Site List Manager (schema v.1), click **Bulk add from file**. - -2. Go to your site list (either .txt or .xml) to add the included sites to the tool, and then click **Open**.

-Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -3. Click **OK** to close the **Bulk add sites to the list** menu. - -4. On the **File** menu, click **Save to XML**, and save your file.

-You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the Bulk add from file area of the Enterprise Mode Site List Manager. +author: dansimp +ms.prod: ie11 +ms.assetid: 20aF07c4-051a-451f-9c46-5a052d9Ae27c +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) + +**Applies to:** + +- Windows 8.1 +- Windows 7 + +You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the **Bulk add from file** area of the Enterprise Mode Site List Manager. You can only add specific URLs, not Internet or Intranet Zones. + +If you want to add your websites one at a time, see Add sites to the [Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). + +## Create an Enterprise Mode site list (TXT) file +You can create and use a custom text file to add multiple sites to your Enterprise Mode site list at the same time.

**Important**
This text file is only lets you add multiple sites at the same time. You can’t use this file to deploy Enterprise Mode into your company. + +You must separate each site using commas or carriage returns. For example: + +``` +microsoft.com, bing.com, bing.com/images +``` +**-OR-** + +``` +microsoft.com +bing.com +bing.com/images +``` + +## Create an Enterprise Mode site list (XML) file using the v.1 version of the Enterprise Mode schema +You can create and use a custom XML file with the Enterprise Mode Site List Manager to add multiple sites to your Enterprise Mode site list at the same time. For more info about the v.1 version of the Enterprise Mode schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). + +Each XML file must include: + +- **Version number.** This number must be incremented with each version of the Enterprise Mode site list, letting Internet Explorer know whether the list is new. Approximately 65 seconds after Internet Explorer 11 starts, it compares your site list version to the stored version number. If your file has a higher number, the newer version is loaded.

**Important**
After this check, IE11 won’t look for an updated list again until you restart the browser. + +- **<emie> tag.** This tag specifies the domains and domain paths that must be rendered using IE7 Enterprise Mode, IE8 Enterprise Mode, or the default IE11 browser environment.

**Important**
If you decide a site requires IE7 Enterprise Mode, you must add `forceCompatView=”true”` to your XML file. That code tells Enterprise Mode to check for a `DOCTYPE` tag on the specified webpage. If there is, the site renders using Windows Internet Explorer 7. If there’s no tag, the site renders using Microsoft Internet Explorer 5. + +- <docMode> tag.This tag specifies the domains and domain paths that need either to appear using the specific doc mode you assigned to the site. Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). + +### Enterprise Mode v.1 XML schema example +The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). + +``` + + + www.cpandl.com + www.woodgrovebank.com + adatum.com + contoso.com + relecloud.com + /about + + fabrikam.com + /products + + + + contoso.com + /travel + + fabrikam.com + /products + + + +``` + +To make sure your site list is up-to-date; wait 65 seconds after opening IE and then check that the `CurrentVersion` value in the `HKEY\CURRENT\USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode\` registry key matches the version number in your file.

**Important**
If `CurrentVersion` is not set or is wrong, it means that the XML parsing failed. This can mean that the XML file isn’t there, that there are access problems, or that the XML file format is wrong. Don’t manually change the `CurrentVersion` registry setting. You must make your changes to your site list and then update the list using the import function in the Enterprise Mode Site List Manager (. + +## Add multiple sites to the Enterprise Mode Site List Manager (schema v.1) +After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.1). + + **To add multiple sites** + +1. In the Enterprise Mode Site List Manager (schema v.1), click **Bulk add from file**. + +2. Go to your site list (either .txt or .xml) to add the included sites to the tool, and then click **Open**.

+Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). + +3. Click **OK** to close the **Bulk add sites to the list** menu. + +4. On the **File** menu, click **Save to XML**, and save your file.

+You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). + +## Next steps +After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +## Related topics +- [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md index 1f1d14991d..f351c57bb9 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md @@ -1,119 +1,122 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Add multiple sites to your Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2). -author: shortpatti -ms.prod: ie11 -ms.assetid: da659ff5-70d5-4852-995e-4df67c4871dd -title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 10/24/2017 ---- - - -# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 - -You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the **Bulk add from file** area of the Enterprise Mode Site List Manager (schema v.2). You can only add specific URLs, not Internet or Intranet Zones. - -To add your websites one at a time, see [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md). - -## Create an Enterprise Mode site list (TXT) file - -You can create and use a custom text file with the Enterprise Mode Site List Manager (schema v.2) to add multiple sites to your Enterprise Mode site list at the same time. - ->**Important:**
This text file is only lets you add multiple sites at the same time. You can’t use this file to deploy Enterprise Mode into your company. - -You must separate each site using commas or carriage returns. For example: - -``` -microsoft.com, bing.com, bing.com/images -``` -**-OR-** - -``` -microsoft.com -bing.com -bing.com/images -``` - -## Create an Enterprise Mode site list (XML) file using the v.2 version of the Enterprise Mode schema - -You can create and use a custom XML file with the Enterprise Mode Site List Manager (schema v.2) to add multiple sites to your Enterprise Mode site list at the same time. - -Each XML file must include: - -- **site-list version number**. This number must be incremented with each version of the Enterprise Mode site list, letting Internet Explorer know whether the list is new. Approximately 65 seconds after Internet Explorer 11 starts, it compares your site list version to the stored version number. If your file has a higher number, the newer version is loaded.

**Important**
After this check, IE11 won’t look for an updated list again until you restart the browser.  - -- **<compat-mode> tag.** This tag specifies what compatibility setting are used for specific sites or domains. - -- **<open-in> tag.** This tag specifies what browser opens for each sites or domain. - -### Enterprise Mode v.2 XML schema example - -The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). - -``` - - - - EnterpriseSitelistManager - 10240 - 20150728.135021 - - - - IE8Enterprise - MSEdge - - - IE7Enterprise - IE11 - - - default - IE11 - - -``` -In the above example, the following is true: - -- www.cpandl.com, as the main domain, must use IE8 Enterprise Mode. However, www.cpandl.com/images must use IE7 Enterprise Mode. - -- contoso.com, and all of its domain paths, can use the default compatibility mode for the site. - -To make sure your site list is up-to-date; wait 65 seconds after opening IE and then check that the `CurrentVersion` value in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode\` registry key matches the version number in your file.

**Important**
If `CurrentVersion` is not set or is wrong, it means that the XML parsing failed. This can mean that the XML file isn’t there, that there are access problems, or that the XML file format is wrong. Don’t manually change the `CurrentVersion` registry setting. You must make your changes to your site list and then update the list using the import function in the Enterprise Mode Site List Manager (schema v.2). - -## Add multiple sites to the Enterprise Mode Site List Manager (schema v.2) -After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.2). - - **To add multiple sites** - -1. In the Enterprise Mode Site List Manager (schema v.2), click **Bulk add from file**. - -2. Go to your site list (either .txt or .xml) to add the included sites to the tool, and then click **Open**.

-Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). - -3. Click **OK** to close the **Bulk add sites to the list** menu. - -4. On the **File** menu, click **Save to XML**, and save your file.

-You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -- [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Add multiple sites to your Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2). +author: dansimp +ms.prod: ie11 +ms.assetid: da659ff5-70d5-4852-995e-4df67c4871dd +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 10/24/2017 +--- + + +# Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 + +You can add multiple sites to your Enterprise Mode site list by creating a custom text (TXT) or Extensible Markup Language (XML) file of problematic sites and then adding it in the **Bulk add from file** area of the Enterprise Mode Site List Manager (schema v.2). You can only add specific URLs, not Internet or Intranet Zones. + +To add your websites one at a time, see [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md). + +## Create an Enterprise Mode site list (TXT) file + +You can create and use a custom text file with the Enterprise Mode Site List Manager (schema v.2) to add multiple sites to your Enterprise Mode site list at the same time. + +>**Important:**
This text file is only lets you add multiple sites at the same time. You can’t use this file to deploy Enterprise Mode into your company. + +You must separate each site using commas or carriage returns. For example: + +``` +microsoft.com, bing.com, bing.com/images +``` +**-OR-** + +``` +microsoft.com +bing.com +bing.com/images +``` + +## Create an Enterprise Mode site list (XML) file using the v.2 version of the Enterprise Mode schema + +You can create and use a custom XML file with the Enterprise Mode Site List Manager (schema v.2) to add multiple sites to your Enterprise Mode site list at the same time. + +Each XML file must include: + +- **site-list version number**. This number must be incremented with each version of the Enterprise Mode site list, letting Internet Explorer know whether the list is new. Approximately 65 seconds after Internet Explorer 11 starts, it compares your site list version to the stored version number. If your file has a higher number, the newer version is loaded.

**Important**
After this check, IE11 won’t look for an updated list again until you restart the browser.  + +- **<compat-mode> tag.** This tag specifies what compatibility setting are used for specific sites or domains. + +- **<open-in> tag.** This tag specifies what browser opens for each sites or domain. + +### Enterprise Mode v.2 XML schema example + +The following is an example of what your XML file should look like when you’re done adding your sites. For more info about how to create your XML file, see [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md). + +``` + + + + EnterpriseSitelistManager + 10240 + 20150728.135021 + + + + IE8Enterprise + MSEdge + + + IE7Enterprise + IE11 + + + default + IE11 + + +``` +In the above example, the following is true: + +- www.cpandl.com, as the main domain, must use IE8 Enterprise Mode. However, www.cpandl.com/images must use IE7 Enterprise Mode. + +- contoso.com, and all of its domain paths, can use the default compatibility mode for the site. + +To make sure your site list is up-to-date; wait 65 seconds after opening IE and then check that the `CurrentVersion` value in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode\` registry key matches the version number in your file.

**Important**
If `CurrentVersion` is not set or is wrong, it means that the XML parsing failed. This can mean that the XML file isn’t there, that there are access problems, or that the XML file format is wrong. Don’t manually change the `CurrentVersion` registry setting. You must make your changes to your site list and then update the list using the import function in the Enterprise Mode Site List Manager (schema v.2). + +## Add multiple sites to the Enterprise Mode Site List Manager (schema v.2) +After you create your .xml or .txt file, you can bulk add the sites to the Enterprise Mode Site List Manager (schema v.2). + + **To add multiple sites** + +1. In the Enterprise Mode Site List Manager (schema v.2), click **Bulk add from file**. + +2. Go to your site list (either .txt or .xml) to add the included sites to the tool, and then click **Open**.

+Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). + +3. Click **OK** to close the **Bulk add sites to the list** menu. + +4. On the **File** menu, click **Save to XML**, and save your file.

+You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). + +## Next steps +After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) +- [Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md index 2eab3c28fd..8b8435daff 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md @@ -1,63 +1,66 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -author: shortpatti -ms.prod: ie11 -ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26 -title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) - -**Applies to:** - -- Windows 8.1 -- Windows 7 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.

**Important**
You can only add specific URLs, not Internet or Intranet Zones. - -

**Note**
If you need to include a lot of sites, instead of adding them one at a time, you can create a list of websites and add them all at the same time. For more information, see [Add multiple sites to the Enterprise Mode site list using a file and the Windows 7 and 8.1 Enterprise Mode Site List Manager](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md). - -## Adding a site to your compatibility list -You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager. -

**Note**
If you're using the v.2 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see [Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2)](add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md). - - **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.1)** - -1. In the Enterprise Mode Site List Manager (schema v.1), click **Add**. - -2. Type the URL for the website that’s experiencing compatibility problems, like *<domain>.com* or *<domain>.com*/*<path>* into the **URL** box.

-Don't include the `https://` or `https://` designation. The tool automatically tries both versions during validation. - -3. Type any comments about the website into the **Notes about URL** box.

-Administrators can only see comments while they’re in this tool. - -4. Choose **IE7 Enterprise Mode**, **IE8 Enterprise Mode**, or the appropriate document mode for sites that must be rendered using the emulation of a previous version of IE, or pick **Default IE** if the site should use the latest version of IE. - -The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, **IE8 Enterprise Mode** is automatically selected. - -Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -5. Click **Save** to validate your website and to add it to the site list for your enterprise.

-If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. - -6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

-You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that's designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. +author: dansimp +ms.prod: ie11 +ms.assetid: 042e44e8-568d-4717-8fd3-69dd198bbf26 +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.1) + +**Applies to:** + +- Windows 8.1 +- Windows 7 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 7 or Windows Internet Explorer 8, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.

**Important**
You can only add specific URLs, not Internet or Intranet Zones. + +

Note
If you need to include a lot of sites, instead of adding them one at a time, you can create a list of websites and add them all at the same time. For more information, see Add multiple sites to the Enterprise Mode site list using a file and the Windows 7 and 8.1 Enterprise Mode Site List Manager. + +## Adding a site to your compatibility list +You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager. +

Note
If you're using the v.2 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2). + + **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.1)** + +1. In the Enterprise Mode Site List Manager (schema v.1), click **Add**. + +2. Type the URL for the website that’s experiencing compatibility problems, like *<domain>.com* or *<domain>.com*/*<path>* into the **URL** box.

+Don't include the `https://` or `https://` designation. The tool automatically tries both versions during validation. + +3. Type any comments about the website into the **Notes about URL** box.

+Administrators can only see comments while they’re in this tool. + +4. Choose **IE7 Enterprise Mode**, **IE8 Enterprise Mode**, or the appropriate document mode for sites that must be rendered using the emulation of a previous version of IE, or pick **Default IE** if the site should use the latest version of IE. + +The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, **IE8 Enterprise Mode** is automatically selected. + +Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). + +5. Click **Save** to validate your website and to add it to the site list for your enterprise.

+ If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. + +6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

+ You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +## Next steps +After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md index df209b5a60..46a8edef5e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md +++ b/browsers/internet-explorer/ie11-deploy-guide/add-single-sites-to-enterprise-mode-site-list-using-the-version-2-enterprise-mode-tool.md @@ -1,79 +1,82 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that''s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. -author: shortpatti -ms.prod: ie11 -ms.assetid: 513e8f3b-fedf-4d57-8d81-1ea4fdf1ac0b -title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 - -Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.

**Important**
You can only add specific URLs, not Internet or Intranet Zones. - -

**Note**
If you need to include a lot of sites, instead of adding them one at a time, you can create a list of websites and add them all at the same time. For more information, see the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) topic, based on your operating system. - -## Adding a site to your compatibility list -You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager.

-**Note**
If you're using the v.1 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see [Add sites to the Enterprise Mode site list using the WEnterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). - - **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.2)** - -1. In the Enterprise Mode Site List Manager (schema v.2), click **Add**. - -2. Type the URL for the website that’s experiencing compatibility problems, like *<domain>.com* or *<domain>.com*/*<path>* into the **URL** box.

-Don't include the `https://` or `https://` designation. The tool automatically tries both versions during validation. - -3. Type any comments about the website into the **Notes about URL** box.

-Administrators can only see comments while they’re in this tool. - -4. In the **Compat Mode** box, choose one of the following: - - - **IE8Enterprise**. Loads the site in IE8 Enterprise Mode. - - - **IE7Enterprise**. Loads the site in IE7 Enterprise Mode. - - - **IE\[*x*\]**. Where \[x\] is the document mode number and the site loads in the specified document mode. - - - **Default Mode**. Loads the site using the default compatibility mode for the page. - - The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, **IE8 Enterprise Mode** is automatically selected. - - Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). - -5. In conjunction with the compatibility mode, you'll need to use the **Open in** box to pick which browser opens the site. - - - **IE11**. Opens the site in IE11, regardless of which browser is opened by the employee. - - - **MSEdge**. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee. - - - **None**. Opens in whatever browser the employee chooses. - -6. Click **Save** to validate your website and to add it to the site list for your enterprise.

-If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. - -7. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

-You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Next steps -After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). - -## Related topics -- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that''s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer. +author: dansimp +ms.prod: ie11 +ms.assetid: 513e8f3b-fedf-4d57-8d81-1ea4fdf1ac0b +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: Add sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Add single sites to the Enterprise Mode site list using the Enterprise Mode Site List Manager (schema v.2) + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 + +Enterprise Mode is a compatibility mode that runs on Internet Explorer 11, letting websites render using a modified browser configuration that’s designed to emulate either Windows Internet Explorer 8 or Windows Internet Explorer 7, avoiding the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer.

**Important**
You can only add specific URLs, not Internet or Intranet Zones. + +

Note
If you need to include a lot of sites, instead of adding them one at a time, you can create a list of websites and add them all at the same time. For more information, see the Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2) or the Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1) topic, based on your operating system. + +## Adding a site to your compatibility list +You can add individual sites to your compatibility list by using the Enterprise Mode Site List Manager.

+**Note**
If you're using the v.1 version of the Enterprise Mode schema, you'll need to use the Enterprise Mode Site List Manager (schema v.1). For more info, see [Add sites to the Enterprise Mode site list using the WEnterprise Mode Site List Manager (schema v.1)](add-single-sites-to-enterprise-mode-site-list-using-the-version-1-enterprise-mode-tool.md). + + **To add a site to your compatibility list using the Enterprise Mode Site List Manager (schema v.2)** + +1. In the Enterprise Mode Site List Manager (schema v.2), click **Add**. + +2. Type the URL for the website that’s experiencing compatibility problems, like *<domain>.com* or *<domain>.com*/*<path>* into the **URL** box.

+ Don't include the `https://` or `https://` designation. The tool automatically tries both versions during validation. + +3. Type any comments about the website into the **Notes about URL** box.

+ Administrators can only see comments while they’re in this tool. + +4. In the **Compat Mode** box, choose one of the following: + + - **IE8Enterprise**. Loads the site in IE8 Enterprise Mode. + + - **IE7Enterprise**. Loads the site in IE7 Enterprise Mode. + + - **IE\[*x*\]**. Where \[x\] is the document mode number and the site loads in the specified document mode. + + - **Default Mode**. Loads the site using the default compatibility mode for the page. + + The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, **IE8 Enterprise Mode** is automatically selected. + + Enterprise Mode takes precedence over document modes, so sites that are already included in the Enterprise Mode site list won’t be affected by this update and will continue to load in Enterprise Mode, as usual. For more specific info about using document modes, see [Fix web compatibility issues using document modes and the Enterprise Mode site list](fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md). + +5. In conjunction with the compatibility mode, you'll need to use the **Open in** box to pick which browser opens the site. + + - **IE11**. Opens the site in IE11, regardless of which browser is opened by the employee. + + - **MSEdge**. Opens the site in Microsoft Edge, regardless of which browser is opened by the employee. + + - **None**. Opens in whatever browser the employee chooses. + +6. Click **Save** to validate your website and to add it to the site list for your enterprise.

+ If your site passes validation, it’s added to the global compatibility list. If the site doesn’t pass validation, you’ll get an error message explaining the problem. You’ll then be able to either cancel the site or ignore the validation problem and add it to your list anyway. + +7. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

+ You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your registry key. For more information about the registry key, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +## Next steps +After you’ve added all of your sites to the tool and saved the file to XML, you can configure the rest of the Enterprise Mode functionality to use it. You can also turn Enterprise Mode on locally, so your users have the option to use Enterprise Mode on individual websites from the **Tools** menu. For more information, see [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md). + +## Related topics +- [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853) + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md index 2fc51f57c7..f08c08fcdb 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/administrative-templates-and-ie11.md @@ -1,79 +1,82 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -description: Administrative templates and Internet Explorer 11 -author: shortpatti -ms.prod: ie11 -ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3 -title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Administrative templates and Internet Explorer 11 - -Administrative Templates are made up of a hierarchy of policy categories and subcategories that define how your policy settings appear in the Local Group Policy Editor, including: - -- What registry locations correspond to each setting. - -- What value options or restrictions are associated with each setting. - -- The default value for many settings. - -- Text explanations about each setting and the supported version of Internet Explorer. - -For a conceptual overview of Administrative Templates, see [Managing Group Policy ADMX Files Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=214519). - -## What are Administrative Templates? -Administrative Templates are XML-based, multi-language files that define the registry-based Group Policy settings in the Local Group Policy Editor. There are two types of Administrative Templates: - -- **ADMX.** A language-neutral setup file that states the number and type of policy setting, and the location by category, as it shows up in the Local Group Policy Editor. - -- **ADML.** A language-specific setup file that provides language-related information to the ADMX file. This file lets the policy setting show up in the right language in the Local Group Policy Editor. You can add new languages by adding new ADML files in the required language. - -## How do I store Administrative Templates? -As an admin, you can create a central store folder on your SYSVOL directory, named **PolicyDefinitions**. For example, %*SystemRoot*%\\PolicyDefinitions. This folder provides a single, centralized storage location for your Administrative Templates (both ADMX and ADML) files, so they can be used by your domain-based Group Policy Objects (GPOs). -

**Important**
Your Group Policy tools use the ADMX files in your store, ignoring any local copies. For more information about creating a central store, see [Scenario 1: Editing the Local GPO Using ADMX Files](https://go.microsoft.com/fwlink/p/?LinkId=276810). - -## Administrative Templates-related Group Policy settings -When you install Internet Explorer 11, it updates the local administrative files, Inetres.admx and Inetres.adml, both located in the **PolicyDefinitions** folder. -

**Note**
You won't see the new policy settings if you try to view or edit your policy settings on a computer that isn't running IE11. To fix this, you can either install IE11, or you can copy the updated Inetres.admx and Inetres.adml files from another computer to the **PolicyDefinitions** folder on this computer. - -IE11 provides these new policy settings, which are editable in the Local Group Policy Editor, and appear in the following policy paths: - -- Computer Configuration\\Administrative Templates\\Windows Components\\ - -- User Configuration\\Administrative Templates\\Windows Components\\ - - -|Catalog |Description | -| ------------------------------------------------ | --------------------------------------------| -|IE |Turns standard IE configuration on and off. | -|Internet Explorer\Accelerators |Sets up and manages Accelerators. | -|Internet Explorer\Administrator Approved Controls |Turns ActiveX controls on and off. | -|Internet Explorer\Application Compatibility |Turns the **Cut**, **Copy**, or **Paste** operations on or off. This setting also requires that `URLACTION_SCRIPT_PASTE` is set to **Prompt**. | -|Internet Explorer\Browser Menus |Shows or hides the IE menus and menu options.| -|Internet Explorer\Corporate Settings |Turns off whether you specify the code download path for each computer. | -|Internet Explorer\Delete Browsing History |Turns the **Delete Browsing History** settings on and off. | -|Internet Explorer\Internet Control Panel |Turns pages on and off in the **Internet Options** dialog box. Also turns on and off the subcategories that manage settings on the **Content**, **General**, **Security** and **Advanced** pages. | -|Internet Explorer\Internet Settings |Sets up and manages the **Advanced settings**, **AutoComplete**, **Display Settings**, and **URL Encoding** options. | -|Internet Explorer\Persistence Behavior |Sets up and manages the file size limits for Internet security zones. | -|Internet Explorer\Privacy |Turns various privacy-related features on and off. | -|Internet Explorer\Security Features |Turns various security-related features on and off in the browser, Windows Explorer, and other applications. | -|Internet Explorer\Toolbars |Turns on and off the ability for users to edit toolbars in the browser. You can also set the default toolbar buttons here. | -|RSS Feeds |Sets up and manages RSS feeds in the browser. | - - -## Editing Group Policy settings -Regardless which tool you're using to edit your Group Policy settings, you'll need to follow one of these guides for step-by-step editing instructions: - -- **If you're using the Group Policy Management Console (GPMC) or the Local Group Policy Editor.** See [Edit Administrative Template Policy Settings](https://go.microsoft.com/fwlink/p/?LinkId=214521) for step-by-step instructions about editing your Administrative Templates. - -- **If you're using GPMC with Advanced Group Policy Management (AGPM).** See [Checklist: Create, Edit, and Deploy a GPO](https://go.microsoft.com/fwlink/p/?LinkId=214522) for step-by-step instructions about how to check out a GPO from the AGPM archive, edit it, and request deployment. - -## Related topics -- [Administrative templates (.admx) for Windows 10 download](https://go.microsoft.com/fwlink/p/?LinkId=746579) -- [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +description: Administrative templates and Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 2b390786-f786-41cc-bddc-c55c8a4c5af3 +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: Administrative templates and Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Administrative templates and Internet Explorer 11 + +Administrative Templates are made up of a hierarchy of policy categories and subcategories that define how your policy settings appear in the Local Group Policy Editor, including: + +- What registry locations correspond to each setting. + +- What value options or restrictions are associated with each setting. + +- The default value for many settings. + +- Text explanations about each setting and the supported version of Internet Explorer. + +For a conceptual overview of Administrative Templates, see [Managing Group Policy ADMX Files Step-by-Step Guide](https://go.microsoft.com/fwlink/p/?LinkId=214519). + +## What are Administrative Templates? +Administrative Templates are XML-based, multi-language files that define the registry-based Group Policy settings in the Local Group Policy Editor. There are two types of Administrative Templates: + +- **ADMX.** A language-neutral setup file that states the number and type of policy setting, and the location by category, as it shows up in the Local Group Policy Editor. + +- **ADML.** A language-specific setup file that provides language-related information to the ADMX file. This file lets the policy setting show up in the right language in the Local Group Policy Editor. You can add new languages by adding new ADML files in the required language. + +## How do I store Administrative Templates? +As an admin, you can create a central store folder on your SYSVOL directory, named **PolicyDefinitions**. For example, %*SystemRoot*%\\PolicyDefinitions. This folder provides a single, centralized storage location for your Administrative Templates (both ADMX and ADML) files, so they can be used by your domain-based Group Policy Objects (GPOs). +

Important
Your Group Policy tools use the ADMX files in your store, ignoring any local copies. For more information about creating a central store, see Scenario 1: Editing the Local GPO Using ADMX Files. + +## Administrative Templates-related Group Policy settings +When you install Internet Explorer 11, it updates the local administrative files, Inetres.admx and Inetres.adml, both located in the **PolicyDefinitions** folder. +

Note
You won't see the new policy settings if you try to view or edit your policy settings on a computer that isn't running IE11. To fix this, you can either install IE11, or you can copy the updated Inetres.admx and Inetres.adml files from another computer to the PolicyDefinitions folder on this computer. + +IE11 provides these new policy settings, which are editable in the Local Group Policy Editor, and appear in the following policy paths: + +- Computer Configuration\\Administrative Templates\\Windows Components\\ + +- User Configuration\\Administrative Templates\\Windows Components\\ + + +|Catalog |Description | +| ------------------------------------------------ | --------------------------------------------| +|IE |Turns standard IE configuration on and off. | +|Internet Explorer\Accelerators |Sets up and manages Accelerators. | +|Internet Explorer\Administrator Approved Controls |Turns ActiveX controls on and off. | +|Internet Explorer\Application Compatibility |Turns the **Cut**, **Copy**, or **Paste** operations on or off. This setting also requires that `URLACTION_SCRIPT_PASTE` is set to **Prompt**. | +|Internet Explorer\Browser Menus |Shows or hides the IE menus and menu options.| +|Internet Explorer\Corporate Settings |Turns off whether you specify the code download path for each computer. | +|Internet Explorer\Delete Browsing History |Turns the **Delete Browsing History** settings on and off. | +|Internet Explorer\Internet Control Panel |Turns pages on and off in the **Internet Options** dialog box. Also turns on and off the subcategories that manage settings on the **Content**, **General**, **Security** and **Advanced** pages. | +|Internet Explorer\Internet Settings |Sets up and manages the **Advanced settings**, **AutoComplete**, **Display Settings**, and **URL Encoding** options. | +|Internet Explorer\Persistence Behavior |Sets up and manages the file size limits for Internet security zones. | +|Internet Explorer\Privacy |Turns various privacy-related features on and off. | +|Internet Explorer\Security Features |Turns various security-related features on and off in the browser, Windows Explorer, and other applications. | +|Internet Explorer\Toolbars |Turns on and off the ability for users to edit toolbars in the browser. You can also set the default toolbar buttons here. | +|RSS Feeds |Sets up and manages RSS feeds in the browser. | + + +## Editing Group Policy settings +Regardless which tool you're using to edit your Group Policy settings, you'll need to follow one of these guides for step-by-step editing instructions: + +- **If you're using the Group Policy Management Console (GPMC) or the Local Group Policy Editor.** See [Edit Administrative Template Policy Settings](https://go.microsoft.com/fwlink/p/?LinkId=214521) for step-by-step instructions about editing your Administrative Templates. + +- **If you're using GPMC with Advanced Group Policy Management (AGPM).** See [Checklist: Create, Edit, and Deploy a GPO](https://go.microsoft.com/fwlink/p/?LinkId=214522) for step-by-step instructions about how to check out a GPO from the AGPM archive, edit it, and request deployment. + +## Related topics +- [Administrative templates (.admx) for Windows 10 April 2018 Update](https://www.microsoft.com/download/details.aspx?id=56880) +- [Administrative templates (.admx) for Windows 10 October 2018 Update](https://www.microsoft.com/download/details.aspx?id=57576) +- [Administrative Templates (.admx) for Windows 8.1 and Windows Server 2012 R2](https://go.microsoft.com/fwlink/p/?LinkId=746580) diff --git a/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md index 02bda50d22..977e17394e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/approve-change-request-enterprise-mode-portal.md @@ -1,59 +1,62 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: appcompat -description: Details about how Approvers can approve open change requests in the Enterprise Mode Site List Portal. -author: shortpatti -ms.prod: ie11 -title: Approve a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - -# Approve a change request using the Enterprise Mode Site List Portal - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -After a change request is successfully submitted to the pre-defined Approver(s), employees granted the role of **App Manager**, **Group Head**, or **Administrator**, they must approve the changes. - -## Approve or reject a change request -The Approvers get an email stating that a Requester successfully opened, tested, and submitted the change request to the Approvers group. The Approvers can accept or reject a change request. - -**To approve or reject a change request** -1. The Approver logs onto the Enterprise Mode Site List Portal, **All Approvals** page. - - The Approver can also get to the **All Approvals** page by clicking **Approvals Pending** from the left pane. - -2. The Approver clicks the expander arrow (**\/**) to the right side of the change request, showing the list of Approvers and the **Approve** and **Reject** buttons. - -3. The Approver reviews the change request, making sure it's correct. If the info is correct, the Approver clicks **Approve** to approve the change request. If the info seems incorrect, or if the app shouldn't be added to the site list, the Approver clicks **Reject**. - - An email is sent to the Requester, the Approver(s) group, and the Administrator(s) group, with the updated status of the request. - - -## Send a reminder to the Approver(s) group -If the change request is sitting in the approval queue for too long, the Requester can send a reminder to the group. - -- From the **My Approvals** page, click the checkbox next to the name of each Approver to be reminded, and then click **Send reminder**. - - An email is sent to the selected Approver(s). - - -## View rejected change requests -The original Requester, the Approver(s) group, and the Administrator(s) group can all view the rejected change request. - -**To view the rejected change request** - -- In the Enterprise Mode Site List Portal, click **Rejected** from the left pane. - - All rejected change requests appear, with role assignment determining which ones are visible. - - -## Next steps -After an Approver approves the change request, it must be scheduled for inclusion in the production Enterprise Mode Site List. For the scheduling steps, see the [Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md) topic. \ No newline at end of file +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: appcompat +description: Details about how Approvers can approve open change requests in the Enterprise Mode Site List Portal. +author: dansimp +ms.prod: ie11 +title: Approve a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +--- + +# Approve a change request using the Enterprise Mode Site List Portal + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +After a change request is successfully submitted to the pre-defined Approver(s), employees granted the role of **App Manager**, **Group Head**, or **Administrator**, they must approve the changes. + +## Approve or reject a change request +The Approvers get an email stating that a Requester successfully opened, tested, and submitted the change request to the Approvers group. The Approvers can accept or reject a change request. + +**To approve or reject a change request** +1. The Approver logs onto the Enterprise Mode Site List Portal, **All Approvals** page. + + The Approver can also get to the **All Approvals** page by clicking **Approvals Pending** from the left pane. + +2. The Approver clicks the expander arrow (**\/**) to the right side of the change request, showing the list of Approvers and the **Approve** and **Reject** buttons. + +3. The Approver reviews the change request, making sure it's correct. If the info is correct, the Approver clicks **Approve** to approve the change request. If the info seems incorrect, or if the app shouldn't be added to the site list, the Approver clicks **Reject**. + + An email is sent to the Requester, the Approver(s) group, and the Administrator(s) group, with the updated status of the request. + + +## Send a reminder to the Approver(s) group +If the change request is sitting in the approval queue for too long, the Requester can send a reminder to the group. + +- From the **My Approvals** page, click the checkbox next to the name of each Approver to be reminded, and then click **Send reminder**. + + An email is sent to the selected Approver(s). + + +## View rejected change requests +The original Requester, the Approver(s) group, and the Administrator(s) group can all view the rejected change request. + +**To view the rejected change request** + +- In the Enterprise Mode Site List Portal, click **Rejected** from the left pane. + + All rejected change requests appear, with role assignment determining which ones are visible. + + +## Next steps +After an Approver approves the change request, it must be scheduled for inclusion in the production Enterprise Mode Site List. For the scheduling steps, see the [Schedule approved change requests for production using the Enterprise Mode Site List Portal](schedule-production-change-enterprise-mode-portal.md) topic. diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md index d28ba9a2ab..d45374e404 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-and-auto-proxy-problems-with-ie11.md @@ -1,59 +1,62 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto configuration and auto proxy problems with Internet Explorer 11 -author: shortpatti -ms.prod: ie11 -ms.assetid: 3fbbc2c8-859b-4b2e-abc3-de2c299e0938 -title: Auto configuration and auto proxy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto configuration and auto proxy problems with Internet Explorer 11 -You might experience some problems using automatic configuration and auto-proxy with Internet Explorer 11. - -## Branding changes aren't distributed using automatic configuration -If you've turned on the **Disable external branding of Internet Explorer** Group Policy Object, you won't be able to use automatic configuration to distribute your branding changes to your users' computers. When this object is turned on, it prevents the branding of IE by a non-Microsoft company or entity, such as an Internet service provider or Internet content provider. For more information about automatic configuration, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) and [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). For more information about Group Policy settings, see [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md). - -## Proxy server setup issues -If you experience issues while setting up your proxy server, you can try these troubleshooting steps: - -- Check to make sure the proxy server address is right. - -- Check that both **Automatically detect settings** and **Automatic configuration** are turned on in the browser. - -- Check that the browser is pointing to the right automatic configuration script location. - - **To check your proxy server address** - -1. On the **Tools** menu, click **Internet Options**, and then **Connections**. - -2. Click **Settings** or **LAN Settings**, and then look at your proxy server address. - -3. If you have multiple proxy servers, click **Advanced** to look at all of the additional addresses.

**Note**
If IE11 uses a proxy server for local IP addresses, regardless whether you turned on the **Bypass Proxy Server for Local Addresses** option, see [Internet Explorer Uses Proxy Server for Local IP Address Even if the "Bypass Proxy Server for Local Addresses" Option Is Turned On](https://go.microsoft.com/fwlink/p/?LinkId=85652). - - **To check that you've turned on the correct settings** - -1. On the **Tools** menu, click **Internet Options**, and then click **Connections**. - -2. Click **Settings** or **LAN Settings**. - -3. In the **Automatic configuration** area, check that you've clicked the **Automatically detect settings** box. If you've turned on automatic configuration, check to make sure that you've also clicked the **Use automatic configuration script** box.

**Note**
If at this point everything is set up correctly, but the proxy server still isn't behaving properly, click the **Detect my network settings** box in the **Error** dialog box to try to detect the proxy server, again. - - **To check that you're pointing to the correct automatic configuration script location** - -1. On the **Tools** menu, click **Internet Options**, and then click **Connections**. - -2. Click **Settings** or **LAN Settings**. - -3. In the **Automatic configuration** area, check that you've chosen the **Use automatic configuration script** box, and that it has the correct location to your automatic configuration script or for your automatic proxy URL. - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: networking +description: Auto configuration and auto proxy problems with Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 3fbbc2c8-859b-4b2e-abc3-de2c299e0938 +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: Auto configuration and auto proxy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Auto configuration and auto proxy problems with Internet Explorer 11 +You might experience some problems using automatic configuration and auto-proxy with Internet Explorer 11. + +## Branding changes aren't distributed using automatic configuration +If you've turned on the **Disable external branding of Internet Explorer** Group Policy Object, you won't be able to use automatic configuration to distribute your branding changes to your users' computers. When this object is turned on, it prevents the branding of IE by a non-Microsoft company or entity, such as an Internet service provider or Internet content provider. For more information about automatic configuration, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) and [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). For more information about Group Policy settings, see [Group policy objects and Internet Explorer 11 (IE11)](group-policy-objects-and-ie11.md). + +## Proxy server setup issues +If you experience issues while setting up your proxy server, you can try these troubleshooting steps: + +- Check to make sure the proxy server address is right. + +- Check that both **Automatically detect settings** and **Automatic configuration** are turned on in the browser. + +- Check that the browser is pointing to the right automatic configuration script location. + + **To check your proxy server address** + +1. On the **Tools** menu, click **Internet Options**, and then **Connections**. + +2. Click **Settings** or **LAN Settings**, and then look at your proxy server address. + +3. If you have multiple proxy servers, click **Advanced** to look at all of the additional addresses.

**Note**
If IE11 uses a proxy server for local IP addresses, regardless whether you turned on the **Bypass Proxy Server for Local Addresses** option, see [Internet Explorer Uses Proxy Server for Local IP Address Even if the "Bypass Proxy Server for Local Addresses" Option Is Turned On](https://go.microsoft.com/fwlink/p/?LinkId=85652). + + **To check that you've turned on the correct settings** + +4. On the **Tools** menu, click **Internet Options**, and then click **Connections**. + +5. Click **Settings** or **LAN Settings**. + +6. In the **Automatic configuration** area, check that you've clicked the **Automatically detect settings** box. If you've turned on automatic configuration, check to make sure that you've also clicked the **Use automatic configuration script** box.

**Note**
If at this point everything is set up correctly, but the proxy server still isn't behaving properly, click the **Detect my network settings** box in the **Error** dialog box to try to detect the proxy server, again. + + **To check that you're pointing to the correct automatic configuration script location** + +7. On the **Tools** menu, click **Internet Options**, and then click **Connections**. + +8. Click **Settings** or **LAN Settings**. + +9. In the **Automatic configuration** area, check that you've chosen the **Use automatic configuration script** box, and that it has the correct location to your automatic configuration script or for your automatic proxy URL. + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md index 9e485e54d8..1b9a0ba9c8 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-configuration-settings-for-ie11.md @@ -1,71 +1,74 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto configuration settings for Internet Explorer 11 -author: shortpatti -ms.prod: ie11 -ms.assetid: 90308d59-45b9-4639-ab1b-497e5ba19023 -title: Auto configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto configuration settings for Internet Explorer 11 -Automatic configuration lets you apply custom branding and graphics to your internal Internet Explorer installations, running on Windows 8.1 or Windows Server 2012 R2. For more information about adding custom branding and graphics to your IE package, see [Customize the toolbar button and Favorites List icons using IEAK 11](../ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md).

**Important**
You'll only see and be able to use the **IE Customization Wizard 11 - Automatic Configuration** page if you're creating an internal IE installation package. For more information about the **IE Customization Wizard 11 - Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). - -## Adding the automatic configuration registry key -For custom graphics and branding, add the `FEATURE\AUTOCONFIG\BRANDING` registry key to your IE installation package.

**Important**
Follow these directions carefully because serious problems can occur if you update your registry incorrectly. For added protection, back up your registry so you can restore it if a problem occurs. - - **To add the registry key** - -1. On the **Start** screen, type **regedit**, and then click **Regedit.exe**. - -2. Right-click the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl` subkey, point to **New**, and then click **Key**. - -3. Enter the new key name, `FEATURE\AUTOCONFIG\BRANDING`, and then press Enter. - -4. Right-click `FEATURE\AUTOCONFIG\BRANDING`, point to **New**, and then click **DWORD (32-bit) Value**. - -5. Enter the new DWORD value name, **iexplore.exe**, and then press Enter. - -6. Right-click **iexplore.exe**, and then click **Modify**. - -7. In the **Value data** box, enter **1**, and then click **OK**. - -8. Exit the registry editor. - -## Updating your automatic configuration settings -After adding the `FEATURE\AUTOCONFIG\BRANDING` registry key, you can change your automatic configuration settings to pick up the updated branding. -

**Important**
Your branding changes won't be added or updated if you've previously chosen the **Disable external branding of IE** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. This setting is intended to prevent branding by a third-party, like an Internet service or content provider. For more information about Group Policy, including videos and the latest technical documentation, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). - - **To update your settings** - -1. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. - -2. Choose the **Automatically detect configuration settings** check box to allow automatic detection of browser settings. - -3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: - - - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that automatic configuration only happens when the computer restarts. - - - **Automatic Configuration URL (.INS file) box:** Type the location of your automatic configuration script. - - - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script.

**Important**
Internet Explorer 11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. - -If your branding changes aren't correctly deployed after running through this process, see [Auto configuration and auto proxy problems with Internet Explorer 11](auto-configuration-and-auto-proxy-problems-with-ie11.md). - -## Locking your automatic configuration settings -You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. - -- **Using Microsoft Active Directory.** Choose **Disable changing Automatic Configuration settings** from the Administrative Templates setting. - -- **Not Using Active Directory.** Choose the **Disable changing Automatic Configuration settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: networking +description: Auto configuration settings for Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 90308d59-45b9-4639-ab1b-497e5ba19023 +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: Auto configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Auto configuration settings for Internet Explorer 11 +Automatic configuration lets you apply custom branding and graphics to your internal Internet Explorer installations, running on Windows 8.1 or Windows Server 2012 R2. For more information about adding custom branding and graphics to your IE package, see [Customize the toolbar button and Favorites List icons using IEAK 11](../ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md).

**Important**
You'll only see and be able to use the **IE Customization Wizard 11 - Automatic Configuration** page if you're creating an internal IE installation package. For more information about the **IE Customization Wizard 11 - Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). + +## Adding the automatic configuration registry key +For custom graphics and branding, add the `FEATURE\AUTOCONFIG\BRANDING` registry key to your IE installation package.

**Important**
Follow these directions carefully because serious problems can occur if you update your registry incorrectly. For added protection, back up your registry so you can restore it if a problem occurs. + + **To add the registry key** + +1. On the **Start** screen, type **regedit**, and then click **Regedit.exe**. + +2. Right-click the `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl` subkey, point to **New**, and then click **Key**. + +3. Enter the new key name, `FEATURE\AUTOCONFIG\BRANDING`, and then press Enter. + +4. Right-click `FEATURE\AUTOCONFIG\BRANDING`, point to **New**, and then click **DWORD (32-bit) Value**. + +5. Enter the new DWORD value name, **iexplore.exe**, and then press Enter. + +6. Right-click **iexplore.exe**, and then click **Modify**. + +7. In the **Value data** box, enter **1**, and then click **OK**. + +8. Exit the registry editor. + +## Updating your automatic configuration settings +After adding the `FEATURE\AUTOCONFIG\BRANDING` registry key, you can change your automatic configuration settings to pick up the updated branding. +

Important
Your branding changes won't be added or updated if you've previously chosen the Disable external branding of IE setting in the User Configuration\Administrative Templates\Windows Components\Internet Explorer Group Policy object. This setting is intended to prevent branding by a third-party, like an Internet service or content provider. For more information about Group Policy, including videos and the latest technical documentation, see the Group Policy TechCenter. + + **To update your settings** + +1. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. + +2. Choose the **Automatically detect configuration settings** check box to allow automatic detection of browser settings. + +3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: + + - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that automatic configuration only happens when the computer restarts. + + - **Automatic Configuration URL (.INS file) box:** Type the location of your automatic configuration script. + + - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script.

**Important**
Internet Explorer 11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. + +If your branding changes aren't correctly deployed after running through this process, see [Auto configuration and auto proxy problems with Internet Explorer 11](auto-configuration-and-auto-proxy-problems-with-ie11.md). + +## Locking your automatic configuration settings +You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. + +- **Using Microsoft Active Directory.** Choose **Disable changing Automatic Configuration settings** from the Administrative Templates setting. + +- **Not Using Active Directory.** Choose the **Disable changing Automatic Configuration settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md index 8d6510713e..6d58aac85b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-detect-settings-for-ie11.md @@ -1,52 +1,55 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto detect settings Internet Explorer 11 -author: shortpatti -ms.prod: ie11 -ms.assetid: c6753cf4-3276-43c5-aae9-200e9e82753f -title: Auto detect settings Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto detect settings Internet Explorer 11 -After you specify the specific settings related to automatic detection on your Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) servers, you can set up your users' browser settings from a central location. - -Automatic detection works even if the browser wasn't originally set up or installed by the administrator. - -- **Using DHCP servers:** For local area network (LAN)-based users. This server type lets you specify your global and subnet TCP/IP parameters centrally, defining your users' parameters by using reserved addresses. By doing it this way, a computer can move between subnets, automatically reconfiguring for TCP/IP when it starts. - -- **Using DNS servers:** For users on dial-up connections. This server type uses a set of protocols and services on a TCP/IP network, which lets users search for other computers by using hierarchical, user-friendly names (hosts), instead of numeric IP addresses.

**Note**
DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen. - -## Updating your automatic detection settings -To use automatic detection, you have to set up your DHCP and DNS servers.

**Note**
Your DHCP servers must support the `DHCPINFORM` message, to obtain the DHCP options. - - **To turn on automatic detection for DHCP servers** - -1. Open the Internet Explorer Customization Wizard 11, and go to the **Automatic Configuration** page. - -2. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. For more information about the **Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). - -3. Open the [DHCP Administrative Tool](https://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](https://go.microsoft.com/fwlink/p/?LinkId=294649). - - **To turn on automatic detection for DNS servers** - -1. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. - -2. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. - -3. In your DNS database file, create a host record named, **WPAD**. This record has the IP address of the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

**-OR-**

Create a canonical name (CNAME) alias record named, **WPAD**. This record has the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

**Note**
For more information about creating a **WPAD** entry, see [Creating a WPAD entry in DNS](https://go.microsoft.com/fwlink/p/?LinkId=294651).  - -4. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file.

**Note**
Internet Explorer 11 creates a default URL template based on the host name, **wpad**. For example, `https://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file. - -   - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: networking +description: Auto detect settings Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: c6753cf4-3276-43c5-aae9-200e9e82753f +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: Auto detect settings Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Auto detect settings Internet Explorer 11 +After you specify the specific settings related to automatic detection on your Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) servers, you can set up your users' browser settings from a central location. + +Automatic detection works even if the browser wasn't originally set up or installed by the administrator. + +- **Using DHCP servers:** For local area network (LAN)-based users. This server type lets you specify your global and subnet TCP/IP parameters centrally, defining your users' parameters by using reserved addresses. By doing it this way, a computer can move between subnets, automatically reconfiguring for TCP/IP when it starts. + +- **Using DNS servers:** For users on dial-up connections. This server type uses a set of protocols and services on a TCP/IP network, which lets users search for other computers by using hierarchical, user-friendly names (hosts), instead of numeric IP addresses.

**Note**
DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen. + +## Updating your automatic detection settings +To use automatic detection, you have to set up your DHCP and DNS servers.

**Note**
Your DHCP servers must support the `DHCPINFORM` message, to obtain the DHCP options. + + **To turn on automatic detection for DHCP servers** + +1. Open the Internet Explorer Customization Wizard 11, and go to the **Automatic Configuration** page. + +2. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. For more information about the **Automatic Configuration** page, see [Use the Automatic Configuration page in the IEAK 11 Wizard](../ie11-ieak/auto-config-ieak11-wizard.md). + +3. Open the [DHCP Administrative Tool](https://go.microsoft.com/fwlink/p/?LinkId=302212), create a new option type, using the code number 252, and then associate it with the URL to your configuration file. For detailed instructions about how to do this, see [Create an option 252 entry in DHCP](https://go.microsoft.com/fwlink/p/?LinkId=294649). + + **To turn on automatic detection for DNS servers** + +4. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. + +5. Choose the **Automatically detect configuration settings** box to automatically detect your browser settings. + +6. In your DNS database file, create a host record named, **WPAD**. This record has the IP address of the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.

**-OR-**

Create a canonical name (CNAME) alias record named, **WPAD**. This record has the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.

**Note**
For more information about creating a **WPAD** entry, see [Creating a WPAD entry in DNS](https://go.microsoft.com/fwlink/p/?LinkId=294651). + +7. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file.

**Note**
Internet Explorer 11 creates a default URL template based on the host name, **wpad**. For example, `https://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file. + + + + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md index a0e95c8fac..bd7bd5c030 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/auto-proxy-configuration-settings-for-ie11.md @@ -1,47 +1,50 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: networking -description: Auto proxy configuration settings for Internet Explorer 11 -author: shortpatti -ms.prod: ie11 -ms.assetid: 5120aaf9-8ead-438a-8472-3cdd924b7d9e -title: Auto proxy configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Auto proxy configuration settings for Internet Explorer 11 -Configure and maintain your proxy settings, like pointing your users' browsers to your automatic proxy script, through the Internet Explorer Customization Wizard 11 running on either Windows 8.1 or Windows Server 2012 R2. - -## Updating your auto-proxy settings -You can use your Internet settings (.ins) files to set up your standard proxy settings. You can also specify script files (.js, .jvs, or .pac) to configure and maintain your advanced proxy settings. IE uses your auto-proxy script files to dynamically determine whether to connect to a host or use a proxy server. If a proxy server connection fails, Internet Explorer 11 automatically attempts to connect to another proxy server that you have specified. - - **To update your settings** - -1. Create a script file with your proxy information, copying it to a server location. - -2. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. - -3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: - - - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that updates only happen when the computer restarts. - - - **Automatic Configuration URL (.INS file) box:** Type the location of the .ins file you want to use for automatic configuration. For more information about setting up **Automatic Configuration**, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md). - - - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script. This script runs whenever IE11 makes a network request and can include multiple proxy servers for each protocol type.

**Important**
IE11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. - -## Locking your auto-proxy settings -You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. - -- **Using Microsoft Active Directory.** Choose **Disable changing proxy settings** from the Administrative Templates setting. - -- **Not Using Active Directory.** Choose the **Prevent changing proxy settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. For more information about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: networking +description: Auto proxy configuration settings for Internet Explorer 11 +author: dansimp +ms.prod: ie11 +ms.assetid: 5120aaf9-8ead-438a-8472-3cdd924b7d9e +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: Auto proxy configuration settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Auto proxy configuration settings for Internet Explorer 11 +Configure and maintain your proxy settings, like pointing your users' browsers to your automatic proxy script, through the Internet Explorer Customization Wizard 11 running on either Windows 8.1 or Windows Server 2012 R2. + +## Updating your auto-proxy settings +You can use your Internet settings (.ins) files to set up your standard proxy settings. You can also specify script files (.js, .jvs, or .pac) to configure and maintain your advanced proxy settings. IE uses your auto-proxy script files to dynamically determine whether to connect to a host or use a proxy server. If a proxy server connection fails, Internet Explorer 11 automatically attempts to connect to another proxy server that you have specified. + + **To update your settings** + +1. Create a script file with your proxy information, copying it to a server location. + +2. Open the IE Customization Wizard 11, and go to the **Automatic Configuration** page. + +3. Choose the **Enable Automatic Configuration** box to let you change the rest of the configuration options, including: + + - **Automatically configure every box:** Type how often IE should check for configuration updates. Typing **0** (zero), or not putting in any number, means that updates only happen when the computer restarts. + + - **Automatic Configuration URL (.INS file) box:** Type the location of the .ins file you want to use for automatic configuration. For more information about setting up **Automatic Configuration**, see [Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md). + + - **Automatic proxy URL (.JS, .JVS, or .PAC file) box:** Type the location of your automatic proxy script. This script runs whenever IE11 makes a network request and can include multiple proxy servers for each protocol type.

**Important**
IE11 no longer supports using file server locations with your proxy configuration (.pac) files. To keep using your .pac files, you have to keep them on a web server and reference them using a URL, like `https://share/test.ins`. + +## Locking your auto-proxy settings +You have two options to restrict your users' ability to override the automatic configuration settings, based on your environment. + +- **Using Microsoft Active Directory.** Choose **Disable changing proxy settings** from the Administrative Templates setting. + +- **Not Using Active Directory.** Choose the **Prevent changing proxy settings** setting in the `User Configuration\Administrative Templates\Windows Components\Internet Explorer` Group Policy object. For more information about Group Policy, see the [Group Policy TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=214514). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md b/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md index ac73cc7854..12bd5502e3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md +++ b/browsers/internet-explorer/ie11-deploy-guide/blocked-out-of-date-activex-controls.md @@ -1,40 +1,43 @@ ---- -title: Blocked out-of-date ActiveX controls -description: This page is periodically updated with new ActiveX controls blocked by this feature. -author: shortpatti -ms.author: pashort -manager: elizapo -ms.date: 05/10/2018 -ms.topic: article -ms.prod: ie11 -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: security -ms.assetid: '' -ms.sitesec: library ---- - -# Blocked out-of-date ActiveX controls - -ActiveX controls are small apps that let websites provide content, like videos and games, and let you interact with content, like toolbars. Unfortunately, because many ActiveX controls aren't automatically updated, they can become outdated as new versions are released. It's very important that you keep your ActiveX controls up to date because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. To help avoid this situation, Internet Explorer includes a security feature called _out-of-date ActiveX control blocking_. - -We'll periodically update this page with new ActiveX controls blocked by this feature. We'll typically provide one month's advance notice before adding new controls to the list. - -You will receive a notification if a webpage tries to load one of the following of ActiveX control versions: - -**Java** - -| Java 2 Platform, Standard Edition (J2SE) 1.4, everything below (but not including) update 43 | -|----------------------------------------------------------------------------------------------| -| J2SE 5.0, everything below (but not including) update 99 | -| Java SE 6, everything below (but not including) update 181 | -| Java SE 7, everything below (but not including) update 171 | -| Java SE 8, everything below (but not including) update 161 | -| Java SE 9, everything below (but not including) update 4 | - -**Silverlight** - -| Everything below (but not including) Silverlight 5.1.50907.0 | -|--------------------------------------------------------------| - -For more information, see [Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md) and [Internet Explorer begins blocking out-of-date ActiveX controls](https://blogs.msdn.com/b/ie/archive/2014/08/06/internet-explorer-begins-blocking-out-of-date-activex-controls.aspx). You can also view Microsoft's complete list of out-of-date ActiveX controls in the XML-based [version list](https://go.microsoft.com/fwlink/?LinkId=403864). \ No newline at end of file +--- +title: Blocked out-of-date ActiveX controls +description: This page is periodically updated with new ActiveX controls blocked by this feature. +author: dansimp +ms.author: dansimp +audience: itpro manager: dansimp +ms.date: 05/10/2018 +ms.topic: article +ms.prod: ie11 +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: security +ms.assetid: '' +ms.reviewer: +ms.sitesec: library +--- + +# Blocked out-of-date ActiveX controls + +ActiveX controls are small apps that let websites provide content, like videos and games, and let you interact with content, like toolbars. Unfortunately, because many ActiveX controls aren't automatically updated, they can become outdated as new versions are released. It's very important that you keep your ActiveX controls up to date because malicious software (or malware) can target security flaws in outdated controls, damaging your computer by collecting info from it, installing unwanted software, or by letting someone else control it remotely. To help avoid this situation, Internet Explorer includes a security feature called _out-of-date ActiveX control blocking_. + +We'll periodically update this page with new ActiveX controls blocked by this feature. We'll typically provide one month's advance notice before adding new controls to the list. + +You will receive a notification if a webpage tries to load one of the following of ActiveX control versions: + +**Java** + +| Java 2 Platform, Standard Edition (J2SE) 1.4, everything below (but not including) update 43 | +|----------------------------------------------------------------------------------------------| +| J2SE 5.0, everything below (but not including) update 99 | +| Java SE 6, everything below (but not including) update 181 | +| Java SE 7, everything below (but not including) update 171 | +| Java SE 8, everything below (but not including) update 161 | +| Java SE 9, everything below (but not including) update 4 | + +**Silverlight** + + +| Everything below (but not including) Silverlight 5.1.50907.0 | +|--------------------------------------------------------------| +| | + +For more information, see [Out-of-date ActiveX control blocking](out-of-date-activex-control-blocking.md) and [Internet Explorer begins blocking out-of-date ActiveX controls](https://blogs.msdn.com/b/ie/archive/2014/08/06/internet-explorer-begins-blocking-out-of-date-activex-controls.aspx). You can also view Microsoft's complete list of out-of-date ActiveX controls in the XML-based [version list](https://go.microsoft.com/fwlink/?LinkId=403864). diff --git a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md index dc4bf14619..fe61c67cf5 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md +++ b/browsers/internet-explorer/ie11-deploy-guide/browser-cache-changes-and-roaming-profiles.md @@ -1,35 +1,38 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -ms.pagetype: performance -description: Browser cache changes and roaming profiles -author: shortpatti -ms.prod: ie11 -ms.assetid: 85f0cd01-6f82-4bd1-9c0b-285af1ce3436 -title: Browser cache changes and roaming profiles (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 10/16/2017 ---- - - -# Browser cache changes and roaming profiles -We’ve redesigned the browser cache to improve the performance, flexibility, reliability, and scalability of Internet Explorer and the apps that rely on the Windows Internet (WinINet) cache. Our new database design stops multiple clients from simultaneously accessing and using cached information, while also providing a higher level of data integrity. - -You won’t notice any changes to the management of your roaming profile data if you use our new database implementation in conjunction with the [roaming user profile guidelines](https://go.microsoft.com/fwlink/p/?LinkId=401544). This means that IE data that’s stored in the `AppData\Roaming` user profile folder is still be uploaded to your normal profile storage location after a user successfully logs off.

**Note**
Cookies in a roaming profile can only be set by Internet Explorer for the desktop, with Enhanced Protected Mode turned off. Cookies set by the immersive version of IE or by Microsoft Store apps, can’t be part of a roaming profile. For more information about persistent cookies and roaming, see [Persistent cookies are not roamed in Internet Explorer](https://go.microsoft.com/fwlink/p/?LinkId=401545). - -To get the best results while using roaming profiles, we strongly recommend the following: - -- Create a separate roaming repository for each domain account that uses roaming. - -- Restrict roaming user profiles so they work on only one computer at a time. Using a single roaming profile on multiple computers isn’t supported (via console or Remote Desktop) and can cause unpredictable results, including cookie loss. - -- Allow all computers that let users sign-on with a roaming profile have identical IE cookie policies and settings. - -- Make sure to delete the user’s local roaming profile at sign off for any computer using user profile roaming. You can do this by turning on the **Delete cached copies of roaming profiles** Group Policy Object. - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +ms.pagetype: performance +description: Browser cache changes and roaming profiles +author: dansimp +ms.prod: ie11 +ms.assetid: 85f0cd01-6f82-4bd1-9c0b-285af1ce3436 +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: Browser cache changes and roaming profiles (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 10/16/2017 +--- + + +# Browser cache changes and roaming profiles +We’ve redesigned the browser cache to improve the performance, flexibility, reliability, and scalability of Internet Explorer and the apps that rely on the Windows Internet (WinINet) cache. Our new database design stops multiple clients from simultaneously accessing and using cached information, while also providing a higher level of data integrity. + +You won’t notice any changes to the management of your roaming profile data if you use our new database implementation in conjunction with the [roaming user profile guidelines](https://go.microsoft.com/fwlink/p/?LinkId=401544). This means that IE data that’s stored in the `AppData\Roaming` user profile folder is still be uploaded to your normal profile storage location after a user successfully logs off.

**Note**
Cookies in a roaming profile can only be set by Internet Explorer for the desktop, with Enhanced Protected Mode turned off. Cookies set by the immersive version of IE or by Microsoft Store apps, can’t be part of a roaming profile. For more information about persistent cookies and roaming, see [Persistent cookies are not roamed in Internet Explorer](https://go.microsoft.com/fwlink/p/?LinkId=401545). + +To get the best results while using roaming profiles, we strongly recommend the following: + +- Create a separate roaming repository for each domain account that uses roaming. + +- Restrict roaming user profiles so they work on only one computer at a time. Using a single roaming profile on multiple computers isn’t supported (via console or Remote Desktop) and can cause unpredictable results, including cookie loss. + +- Allow all computers that let users sign-on with a roaming profile have identical IE cookie policies and settings. + +- Make sure to delete the user’s local roaming profile at sign off for any computer using user profile roaming. You can do this by turning on the **Delete cached copies of roaming profiles** Group Policy Object. + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md index d53090e7ee..d3cae2a67a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/change-history-for-internet-explorer-11.md @@ -1,53 +1,56 @@ ---- -ms.localizationpriority: medium -title: Change history for Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) -description: This topic lists new and updated topics in the Internet Explorer 11 Deployment Guide documentation for Windows 10 and Windows 10 Mobile. -ms.mktglfcycl: deploy -ms.prod: ie11 -ms.sitesec: library -author: shortpatti -ms.date: 07/27/2017 ---- - - -# Change history for Internet Explorer 11 -This topic lists new and updated topics in the Internet Explorer 11 documentation for both Windows 10 and Windows 10 Mobile. - -## April 2017 -|New or changed topic | Description | -|----------------------|-------------| -|[Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md)|Updates to the Enterprise Mode section to include info about the Enterprise Mode Site List Portal. | - -## March 2017 -|New or changed topic | Description | -|----------------------|-------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to add the Allow VBScript to run in Internet Explorer and the Hide the button (next to the New Tab button) that opens Microsoft Edge settings. | - -## November 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) |Updated the DocMode reason section to correct Code 8 and to add Code 9.| - -## August 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | -|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | -|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | - -## July 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to include the comprehensive list of Group Policies that were added with Internet Explorer 11. | - -## June 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated with 2 new policies, Send all sites not included in the Enterprise Mode Site List to Microsoft Edge and Show message when opening sites in Microsoft Edge using Enterprise Mode. | - - -## May 2016 -|New or changed topic | Description | -|----------------------|-------------| -|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) | Added info about using <emie> and <docMode> together. | - +--- +ms.localizationpriority: medium +title: Change history for Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) +description: This topic lists new and updated topics in the Internet Explorer 11 Deployment Guide documentation for Windows 10 and Windows 10 Mobile. +ms.mktglfcycl: deploy +ms.prod: ie11 +ms.sitesec: library +author: dansimp +ms.date: 07/27/2017 +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +--- + + +# Change history for Internet Explorer 11 +This topic lists new and updated topics in the Internet Explorer 11 documentation for both Windows 10 and Windows 10 Mobile. + +## April 2017 +|New or changed topic | Description | +|----------------------|-------------| +|[Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md)|Updates to the Enterprise Mode section to include info about the Enterprise Mode Site List Portal. | + +## March 2017 +|New or changed topic | Description | +|----------------------|-------------| +|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to add the Allow VBScript to run in Internet Explorer and the Hide the button (next to the New Tab button) that opens Microsoft Edge settings. | + +## November 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md) |Updated the DocMode reason section to correct Code 8 and to add Code 9.| + +## August 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[Enterprise Mode schema v.2 guidance](enterprise-mode-schema-version-2-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | +|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) |Updated to remove the IP range restrictions and to add code examples for both IPv4 and IPv6 addresses. | +|[Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)|Added the Understanding the returned reason codes section to the topic. | + +## July 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated to include the comprehensive list of Group Policies that were added with Internet Explorer 11. | + +## June 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Updated with 2 new policies, Send all sites not included in the Enterprise Mode Site List to Microsoft Edge and Show message when opening sites in Microsoft Edge using Enterprise Mode. | + + +## May 2016 +|New or changed topic | Description | +|----------------------|-------------| +|[Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md) | Added info about using <emie> and <docMode> together. | + diff --git a/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md b/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md index 9b2c6b0e6d..0b2d9ff141 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md +++ b/browsers/internet-explorer/ie11-deploy-guide/check-for-new-enterprise-mode-site-list-xml-file.md @@ -1,49 +1,51 @@ ---- -title: Check for a new Enterprise Mode site list xml file (Internet Explorer 11 for IT Pros) -description: You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. -ms.assetid: 2bbc7017-622e-4baa-8981-c0bbda10e9df -ms.prod: ie11 -ms.mktglfcycl: deploy -ms.pagetype: appcompat -ms.sitesec: library -author: shortpatti -ms.author: pashort -ms.date: 08/14/2017 -ms.localizationpriority: medium ---- - - -# Check for a new Enterprise Mode site list xml file - -**Applies to:** - -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) - -You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. You can add and remove sites from your XML list as frequently as you want, changing which sites should render in Enterprise Mode for your employees. For information about turning on Enterprise Mode and using site lists, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). - -The information in this topic only covers HTTPS protocol. We strongly recommend that you use HTTPS protocol instead of file protocol due to increased performance. - -**How Internet Explorer 11 looks for an updated site list** - -1. Internet Explorer starts up and looks for an updated site list in the following places: - - 1. **In the cache container.** IE first checks the cache container to see if it finds your XML site list. - - 2. **In the local cache.** If there’s nothing in the cache container, IE checks your local cache for the site list. - - 3. **On the server.** Based on standard IE caching rules, IE might look for a copy of your site list in the location you put specified in the **SiteList** value of the registry. - -2. If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.

**Note**
If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one. - -   - -  - -  - - - +--- +title: Check for a new Enterprise Mode site list xml file (Internet Explorer 11 for IT Pros) +description: You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. +ms.assetid: 2bbc7017-622e-4baa-8981-c0bbda10e9df +ms.reviewer: +audience: itpro manager: dansimp +ms.prod: ie11 +ms.mktglfcycl: deploy +ms.pagetype: appcompat +ms.sitesec: library +author: dansimp +ms.author: dansimp +ms.date: 08/14/2017 +ms.localizationpriority: medium +--- + + +# Check for a new Enterprise Mode site list xml file + +**Applies to:** + +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) + +You can have centralized control over Enterprise Mode by creating a single, global XML site list that includes the list of websites to render using Enterprise Mode. You can add and remove sites from your XML list as frequently as you want, changing which sites should render in Enterprise Mode for your employees. For information about turning on Enterprise Mode and using site lists, see [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md). + +The information in this topic only covers HTTPS protocol. We strongly recommend that you use HTTPS protocol instead of file protocol due to increased performance. + +**How Internet Explorer 11 looks for an updated site list** + +1. Internet Explorer starts up and looks for an updated site list in the following places: + + 1. **In the cache container.** IE first checks the cache container to see if it finds your XML site list. + + 2. **In the local cache.** If there’s nothing in the cache container, IE checks your local cache for the site list. + + 3. **On the server.** Based on standard IE caching rules, IE might look for a copy of your site list in the location you put specified in the **SiteList** value of the registry. + +2. If there’s an .xml file in the cache container, IE waits 65 seconds and then checks the local cache for a newer version of the file from the server, based on standard caching rules. If the server file has a different version number than the version in the cache container, the server file is used and stored in the cache container.

**Note**
If you’re already using a site list, enterprise mode continues to work during the 65 second wait; it just uses your existing site list instead of your new one. + +   + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md index c92cdac5b8..c35d115df7 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-deploy-ie11.md @@ -1,27 +1,31 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Choose how to deploy Internet Explorer 11 (IE11) -author: shortpatti -ms.prod: ie11 -ms.assetid: 21b6a301-c222-40bc-ad0b-27f66fc54d9d -title: Choose how to deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Choose how to deploy Internet Explorer 11 (IE11) -In this section, you can learn about how to deploy your custom version of Internet Explorer using Automatic Version Synchronization (AVS) or using your software distribution tools. - -## In this section -| Topic | Description | -|------------------------------------------------------------- | ------------------------------------------------------ | -|[Deploy IE11 using Automatic Version Synchronization (AVS)](deploy-ie11-using-automatic-version-synchronization-avs.md) |Guidance about how to deploy your custom browser packages using Automatic Version Synchronization (AVS). | -|[Deploy IE11 using software distribution tools](deploy-ie11-using-software-distribution-tools.md) |Guidance about how to deploy your custom browser packages using System Center 2012 R2, Windows Server Update Services (WSUS), Group Policy software installation, or Microsoft Deployment toolkit (MDT). | -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Choose how to deploy Internet Explorer 11 (IE11) +author: dansimp +ms.prod: ie11 +ms.assetid: 21b6a301-c222-40bc-ad0b-27f66fc54d9d +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: Choose how to deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Choose how to deploy Internet Explorer 11 (IE11) +In this section, you can learn about how to deploy your custom version of Internet Explorer using Automatic Version Synchronization (AVS) or using your software distribution tools. + +## In this section + +| Topic | Description | +|------------------------------------------------------------- | ------------------------------------------------------ | +|[Deploy IE11 using Automatic Version Synchronization (AVS)](deploy-ie11-using-automatic-version-synchronization-avs.md) |Guidance about how to deploy your custom browser packages using Automatic Version Synchronization (AVS). | +|[Deploy IE11 using software distribution tools](deploy-ie11-using-software-distribution-tools.md) |Guidance about how to deploy your custom browser packages using System Center 2012 R2, Windows Server Update Services (WSUS), Group Policy software installation, or Microsoft Deployment toolkit (MDT). | + + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md index 0ed79bd249..563f38160c 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/choose-how-to-install-ie11.md @@ -1,34 +1,37 @@ ---- -ms.localizationpriority: medium -ms.mktglfcycl: deploy -description: Choose how to install Internet Explorer 11 (IE11) -author: shortpatti -ms.prod: ie11 -ms.assetid: 9572f5f1-5d67-483e-bd63-ffea95053481 -title: Choose how to install Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) -ms.sitesec: library -ms.date: 07/27/2017 ---- - - -# Choose how to install Internet Explorer 11 (IE11) -Before you install Internet Explorer 11, you should: - -- **Migrate Group Policy Objects.** Decide if your Group Policy Objects should migrate to the new version. - -- **Check vendor support for updated functionality.** Check whether third-party vendors have new versions or updates to necessary add-ons, apps, or code libraries. - -- **Choose the right version of Internet Explorer.** IE11 comes pre-installed on Windows 8.1 and Windows Server 2012 R2 or you can download it for Windows 7 SP1 or Windows Server 2008 R2 with Service Pack 1 (SP1) from the [Internet Explorer Downloads](https://go.microsoft.com/fwlink/p/?LinkId=214251) site. - -- **Choose how you'll deploy your installation package.** Your deployment method should be based on whether you're installing to computers already running Windows, or if you're deploying IE11 as part of a Windows installation. - - - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](https://www.microsoft.com/en-us/cloud-platform/microsoft-intune). - - - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](https://go.microsoft.com/fwlink/p/?LinkId=299408). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148), [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669). - -  - -  - - - +--- +ms.localizationpriority: medium +ms.mktglfcycl: deploy +description: Choose how to install Internet Explorer 11 (IE11) +author: dansimp +ms.prod: ie11 +ms.assetid: 9572f5f1-5d67-483e-bd63-ffea95053481 +ms.reviewer: +audience: itpro manager: dansimp +ms.author: dansimp +title: Choose how to install Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros) +ms.sitesec: library +ms.date: 07/27/2017 +--- + + +# Choose how to install Internet Explorer 11 (IE11) +Before you install Internet Explorer 11, you should: + +- **Migrate Group Policy Objects.** Decide if your Group Policy Objects should migrate to the new version. + +- **Check vendor support for updated functionality.** Check whether third-party vendors have new versions or updates to necessary add-ons, apps, or code libraries. + +- **Choose the right version of Internet Explorer.** IE11 comes pre-installed on Windows 8.1 and Windows Server 2012 R2 or you can download it for Windows 7 SP1 or Windows Server 2008 R2 with Service Pack 1 (SP1) from the [Internet Explorer Downloads](https://go.microsoft.com/fwlink/p/?LinkId=214251) site. + +- **Choose how you'll deploy your installation package.** Your deployment method should be based on whether you're installing to computers already running Windows, or if you're deploying IE11 as part of a Windows installation. + + - **Existing computers running Windows.** Use System Center R2 2012 System Center 2012 R2 Configuration Manager, System Center Essentials 2010, Windows Server Updates Services (WSUS), or Microsoft Intune to deploy IE11. For more information about how to use these systems, see [System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkID=276664), [System Center Essentials 2010](https://go.microsoft.com/fwlink/p/?LinkId=395200), [Windows Server Update Services](https://go.microsoft.com/fwlink/p/?LinkID=276790), and [Microsoft Intune Overview](https://www.microsoft.com/cloud-platform/microsoft-intune). + + - **As part of a Windows deployment.** Update your Windows images to include IE11, and then add the update to your MDT deployment share or to your Windows image. For instructions about how to create and use Windows images, see [Create and Manage a Windows Image Using DISM](https://go.microsoft.com/fwlink/p/?LinkId=299408). For general information about deploying IE, see [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=331148), [Windows ADK Overview](https://go.microsoft.com/fwlink/p/?LinkId=276669). + +  + +  + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md index 424b01e58e..12049fdcb9 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md +++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md @@ -2,9 +2,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy description: Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: a145e80f-eb62-4116-82c4-3cc35fd064b6 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Collect data using Enterprise Site Discovery ms.sitesec: library ms.date: 07/27/2017 @@ -21,7 +25,7 @@ ms.date: 07/27/2017 Use Internet Explorer to collect data on computers running Windows Internet Explorer 8 through Internet Explorer 11 on Windows 10, Windows 8.1, or Windows 7. This inventory information helps you build a list of websites used by your company so you can make more informed decisions about your IE deployments, including figuring out which sites might be at risk or require overhauls during future upgrades. >**Upgrade Readiness and Windows upgrades**
->You can use Upgrade Readiness to help manage your Windows 10 upgrades on devices running Windows 8.1 and Windows 7 (SP1). You can also use Upgrade Readiness to review several site discovery reports. For more information, see [Manage Windows upgrades with Upgrade Readiness](https://docs.microsoft.com/en-us/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness). +>You can use Upgrade Readiness to help manage your Windows 10 upgrades on devices running Windows 8.1 and Windows 7 (SP1). You can also use Upgrade Readiness to review several site discovery reports. For more information, see [Manage Windows upgrades with Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness). ## Before you begin @@ -144,18 +148,18 @@ You need to set up your computers for data collection by running the provided Po **To set up Enterprise Site Discovery** -- Start PowerShell in elevated mode (using admin privileges) and run IETElemetrySetUp.ps1 by by-passing the PowerShell execution policy, using this command: `powershell -ExecutionPolicy Bypass .\IETElemetrySetUp.ps1`. For more info, see [about Execution Policies](https://go.microsoft.com/fwlink/p/?linkid=517460). +- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1 by by-passing the PowerShell execution policy, using this command: `powershell -ExecutionPolicy Bypass .\IETelemetrySetUp.ps1`. For more info, see [about Execution Policies](https://go.microsoft.com/fwlink/p/?linkid=517460). ### WMI only: Set up your firewall for WMI data If you choose to use WMI as your data output, you need to make sure that your WMI data can travel through your firewall for the domain. If you’re sure, you can skip this section; otherwise, follow these steps: **To set up your firewall** -1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. +1. In **Control Panel**, click **System and Security**, and then click **Windows Firewall**. -2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. +2. In the left pane, click **Allow an app or feature through Windows Firewall** and scroll down to check the box for **Windows Management Instrumentation (WMI)**. -3. Restart your computer to start collecting your WMI data. +3. Restart your computer to start collecting your WMI data. ## Use PowerShell to finish setting up Enterprise Site Discovery You can determine which zones or domains are used for data collection, using PowerShell. If you don’t want to use PowerShell, you can do this using Group Policy. For more info, see [Use Group Policy to finish setting up Enterprise Site Discovery](#use-group-policy-to-finish-setting-up-enterprise-site-discovery). @@ -168,13 +172,13 @@ You can determine which zones or domains are used for data collection, using Pow **To set up data collection using a domain allow list** - - Start PowerShell in elevated mode (using admin privileges) and run IETElemetrySetUp.ps1, using this command: `.\IETElemetrySetUp.ps1 [other args] -SiteAllowList sharepoint.com,outlook.com,onedrive.com`. +- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -SiteAllowList sharepoint.com,outlook.com,onedrive.com`. >**Important**
Wildcards, like \*.microsoft.com, aren’t supported. **To set up data collection using a zone allow list** - - Start PowerShell in elevated mode (using admin privileges) and run IETElemetrySetUp.ps1, using this command: `.\IETElemetrySetUp.ps1 [other args] -ZoneAllowList Computer,Intranet,TrustedSites,Internet,RestrictedSites`. +- Start PowerShell in elevated mode (using admin privileges) and run IETelemetrySetUp.ps1, using this command: `.\IETelemetrySetUp.ps1 [other args] -ZoneAllowList Computer,Intranet,TrustedSites,Internet,RestrictedSites`. >**Important**
Only Computer, Intranet, TrustedSites, Internet, and RestrictedSites are supported. @@ -245,7 +249,7 @@ You can use both the WMI and XML settings individually or together: -**To turn on both WMI and XML recording** +To turn on both WMI and XML recording @@ -444,7 +448,7 @@ After you’ve collected your data, you’ll need to turn Enterprise Site Discov **To stop collecting data, using PowerShell** -- On your client computer, start Windows PowerShell in elevated mode (using admin privileges) and run `IETelemetrySetUp.ps1`, using this command: `powershell -ExecutionPolicy Bypass .\IETElemetrySetUp.ps1 –IEFeatureOff`. +- On your client computer, start Windows PowerShell in elevated mode (using admin privileges) and run `IETelemetrySetUp.ps1`, using this command: `powershell -ExecutionPolicy Bypass .\IETelemetrySetUp.ps1 –IEFeatureOff`. >**Note**
Turning off data collection only disables the Enterprise Site Discovery feature – all data already written to WMI stays on your employee’s computer. @@ -473,7 +477,7 @@ You can completely remove the data stored on your employee’s computers. ## Related topics * [Enterprise Mode Site List Manager (schema v.2) download](https://go.microsoft.com/fwlink/?LinkId=746562) * [Enterprise Mode for Internet Explorer 11 (IE11)](enterprise-mode-overview-for-ie11.md) -  + diff --git a/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md index 52e126df5a..d01fccf729 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/configure-settings-enterprise-mode-portal.md @@ -3,11 +3,15 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how the Administrator can use the Settings page to set up Groups and roles, the Enterprise Mode Site List Portal environment, and the freeze dates for production changes. -author: shortpatti +author: dansimp ms.prod: ie11 title: Use the Settings page to finish setting up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp --- # Use the Settings page to finish setting up the Enterprise Mode Site List Portal @@ -91,4 +95,4 @@ This optional area lets you specify a period when your employees must stop addin - [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md) -- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) \ No newline at end of file +- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md index 145c439f02..d15192b9d3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md +++ b/browsers/internet-explorer/ie11-deploy-guide/create-change-request-enterprise-mode-portal.md @@ -3,11 +3,15 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy ms.pagetype: appcompat description: Details about how to create a change request within the Enterprise Mode Site List Portal. -author: shortpatti +author: dansimp ms.prod: ie11 title: Create a change request using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp --- # Create a change request using the Enterprise Mode Site List Portal @@ -67,4 +71,4 @@ Employees assigned to the Requester role can create a change request. A change r - **If the change is incorrect.** The Requester can rollback the change in pre-production or ask for help from the Administrator. ## Next steps -After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see the [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md) topic. \ No newline at end of file +After the change request is created, the Requester must make sure the suggested changes work in the pre-production environment. For these steps, see the [Verify your changes using the Enterprise Mode Site List Portal](verify-changes-preprod-enterprise-mode-portal.md) topic. diff --git a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md index a644d1d832..6c260e93aa 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/create-install-packages-for-multiple-operating-systems-or-languages.md @@ -2,9 +2,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy description: Create packages for multiple operating systems or languages -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: 44051f9d-63a7-43bf-a427-d0a0a1c717da +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Create packages for multiple operating systems or languages (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 @@ -14,13 +18,13 @@ ms.date: 07/27/2017 # Create packages for multiple operating systems or languages You'll create multiple versions of your custom browser package if: -- You support more than 1 version of Windows®. +- You support more than 1 version of Windows®. -- You support more than 1 language. +- You support more than 1 language. -- You have custom installation packages with only minor differences. Like, having a different phone number. +- You have custom installation packages with only minor differences. Like, having a different phone number. - **To create a new package** + **To create a new package** 1. Create an installation package using the Internet Explorer Customization Wizard 11, as described in the [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](../ie11-ieak/ieak11-wizard-custom-options.md) topic. @@ -30,11 +34,11 @@ You'll create multiple versions of your custom browser package if: **Important**
Except for the **Title bar** text, **Favorites**, **Links bar**, **Home page**, and **Search bar**, keep all of your wizard settings the same for all of your build computers. -   + -  + -  + diff --git a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md index 0bf4925ab6..fc43585ae7 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md +++ b/browsers/internet-explorer/ie11-deploy-guide/customize-ie11-install-packages.md @@ -2,9 +2,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy description: Customize Internet Explorer 11 installation packages -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: 10a14a09-673b-4f8b-8d12-64036135e7fd +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Customize Internet Explorer 11 installation packages (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md index 4549be210a..b2c4c0f80a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/delete-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md @@ -3,9 +3,13 @@ ms.localizationpriority: medium description: Delete a single site from your global Enterprise Mode site list. ms.pagetype: appcompat ms.mktglfcycl: deploy -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: 41413459-b57f-48da-aedb-4cbec1e2981a +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Delete sites from your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md index 59bb64352d..b9089ee16a 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-automatic-version-synchronization-avs.md @@ -2,9 +2,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy description: You can deploy Internet Explorer 11 to your users' computers by using your custom browser packages and Automatic Version Synchronization (AVS). -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: f51224bd-3371-4551-821d-1d62310e3384 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Deploy Internet Explorer 11 using Automatic Version Synchronization (AVS) (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 @@ -19,14 +23,14 @@ Automatic Version Synchronization (AVS) lets you use the Internet Explorer Admin You must synchronize the setup files at least once on the local computer, for each language and operating system combination, before proceeding through the rest of the wizard. If your packages have more than one version of IE, you need to keep the versions in separate component download folders, which can be pointed to from the **File Locations** page of the IEAK 11. For more information about using the AVS feature, see [Use the Automatic Version Synchronization page in the IEAK 11 Wizard](../ie11-ieak/auto-version-sync-ieak11-wizard.md) . -##Related topics +## Related topics - [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md) - [Customize Internet Explorer 11 installation packages](customize-ie11-install-packages.md) -  + -  + diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md index 1441f5564f..dc31c3230e 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-ie11-using-software-distribution-tools.md @@ -2,9 +2,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy description: Deploy Internet Explorer 11 using software distribution tools -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: fd027775-651a-41e1-8ec3-d32eca876d8a +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Deploy Internet Explorer 11 using software distribution tools (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md index ef14f9f67f..567b8fbeb8 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deploy-pinned-sites-using-mdt-2013.md @@ -2,9 +2,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy description: You can pin websites to the Windows 8.1 taskbar for quick access using the Microsoft Deployment Toolkit (MDT) 2013. -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: 24f4dcac-9032-4fe8-bf6d-2d712d61cb0c +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Deploy pinned websites using Microsoft Deployment Toolkit (MDT) 2013 (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md index 57bc32ac4a..f0f44c2897 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md @@ -3,9 +3,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy ms.pagetype: appcompat description: Windows Internet Explorer 8 introduced document modes as a way to move from the proprietary coding of web features to a more standardized type of coding that could run on multiple browsers and devices. -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: 00cb1f39-2b20-4d37-9436-62dc03a6320b +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Deprecated document modes and Internet Explorer 11 (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md index 504bd09a21..8ad5f3e6ad 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md +++ b/browsers/internet-explorer/ie11-deploy-guide/edit-the-enterprise-mode-site-list-using-the-enterprise-mode-site-list-manager.md @@ -3,9 +3,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy ms.pagetype: appcompat description: You can use Internet Explorer 11 and the Enterprise Mode Site List Manager to change whether page rendering should use Enterprise Mode or the default Internet Explorer browser configuration. You can also add, remove, or delete associated comments. -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: 76aa9a85-6190-4c3a-bc25-0f914de228ea +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Edit the Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md index 0d7ebd65fa..2ab127eec5 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md @@ -3,10 +3,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy ms.pagetype: security description: Enable and disable add-ons using administrative templates and group policy -ms.author: pashort -author: shortpatti +ms.author: dansimp +author: dansimp ms.prod: ie11 ms.assetid: c6fe1cd3-0bfc-4d23-8016-c9601f674c0b +ms.reviewer: +audience: itpro +manager: dansimp title: Enable and disable add-ons using administrative templates and group policy (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 4/12/2018 @@ -105,4 +108,4 @@ Open the Local Group Policy Editor and go to: User Configuration\Administrative 7. Click **OK** twice to close the Group Policy editor. - \ No newline at end of file + diff --git a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md index 5c5693833e..d0998607dc 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enhanced-protected-mode-problems-with-ie11.md @@ -3,9 +3,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy ms.pagetype: security description: Enhanced Protected Mode problems with Internet Explorer -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: 15890ad1-733d-4f7e-a318-10399b389f45 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Enhanced Protected Mode problems with Internet Explorer (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md index 6a0402921f..71104a8786 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11.md @@ -3,9 +3,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy ms.pagetype: appcompat description: Use the topics in this section to learn how to set up and use Enterprise Mode, Enterprise Mode Site List Manager, and the Enterprise Mode Site List Portal for your company. -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: d52ba8ba-b3c7-4314-ba14-0610e1d8456e +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Enterprise Mode for Internet Explorer 11 (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 @@ -16,15 +20,16 @@ ms.date: 07/27/2017 **Applies to:** -- Windows 10 -- Windows 8.1 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2008 R2 with Service Pack 1 (SP1) +- Windows 10 +- Windows 8.1 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2008 R2 with Service Pack 1 (SP1) Use the topics in this section to learn how to set up and use Enterprise Mode and the Enterprise Mode Site List Manager in your company. ## In this section + |Topic |Description | |---------------------------------------------------------------|-----------------------------------------------------------------------------------| |[Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md)|Includes descriptions of the features of Enterprise Mode. | @@ -41,11 +46,11 @@ Use the topics in this section to learn how to set up and use Enterprise Mode an |[Remove sites from a local Enterprise Mode site list](remove-sites-from-a-local-enterprise-mode-site-list.md) |Guidance about how to remove websites from a device's local Enterprise Mode site list. | |[Remove sites from a local compatibility view list](remove-sites-from-a-local-compatibililty-view-list.md) |Guidance about how to remove websites from a device's local compatibility view list. | |[Turn off Enterprise Mode](turn-off-enterprise-mode.md) |Guidance about how to stop using your site list and how to turn off local control, using Group Policy or the registry. | -  - -  - -  + + + + + diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md index 307614576b..81e964a54b 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-1-guidance.md @@ -3,9 +3,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy ms.pagetype: appcompat description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 7 or Windows 8.1 Update. -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: 17c61547-82e3-48f2-908d-137a71938823 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Enterprise Mode schema v.1 guidance (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 07/27/2017 @@ -27,10 +31,10 @@ If you don't want to use the Enterprise Mode Site List Manager, you also have th ## Enterprise Mode schema v.1 example The following is an example of the Enterprise Mode schema v.1. This schema can run on devices running Windows 7 and Windows 8.1. -**Important**
-Make sure that you don't specify a protocol when adding your URLs. Using a URL like `contoso.com` automatically applies to both https://contoso.com and https://contoso.com. +> [!IMPORTANT] +> Make sure that you don't specify a protocol when adding your URLs. Using a URL like `contoso.com` automatically applies to both http://contoso.com and https://contoso.com. -``` xml +```xml www.cpandl.com @@ -72,7 +76,7 @@ This table includes the elements used by the Enterprise Mode schema. - @@ -131,11 +135,11 @@ This table includes the elements used by the Enterprise Mode schema.

Example 

 <emie>
-  <domain exclude="true">fabrikam.com
-    <path exclude="false">/products</path>
+  <domain exclude="true">fabrikam.com
+    <path exclude="false">/products</path>
   </domain>
 </emie>

-Where https://fabrikam.com doesn't use IE8 Enterprise Mode, but https://fabrikam.com/products does. +Where https://fabrikam.com doesn't use IE8 Enterprise Mode, but https://fabrikam.com/products does.

Setting nameRoot node for the schema.

Example 

-<rules version="205">
+<rules version="205">
   <emie>
     <domain>contoso.com</domain>
   </emie>
@@ -84,19 +88,19 @@ This table includes the elements used by the Enterprise Mode schema.
The parent node for the Enterprise Mode section of the schema. All <domain> entries will have either IE8 Enterprise Mode or IE7 Enterprise Mode applied.

Example 

-<rules version="205">
+<rules version="205">
   <emie>
     <domain>contoso.com</domain>
   </emie>
 </rules>
-or- -

For IPv6 ranges:

<rules version="205">
+
For IPv6 ranges:
<rules version="205">
   <emie>
     <domain>[10.122.34.99]:8080</domain>
   </emie>
   </rules>

 -or-
-
For IPv4 ranges:
<rules version="205">
+
For IPv4 ranges:
<rules version="205">
   <emie>
     <domain>10.122.34.99:8080</domain>
   </emie>
@@ -105,12 +109,12 @@ This table includes the elements used by the Enterprise Mode schema.
<docMode>The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the <docMode> section that uses the same value as a <domain> element in the <emie> section, the <emie> element is applied. +The parent node for the document mode section of the section. All <domain> entries will get IE5 - IE11 document modes applied. If there's a <domain> element in the <docMode> section that uses the same value as a <domain> element in the <emie> section, the <emie> element is applied.

Example 

-<rules version="205">
+<rules version="205">
   <docMode>
-    <domain docMode="7">contoso.com</domain>
+    <domain docMode="7">contoso.com</domain>
   </docMode>
 </rules>
 Internet Explorer 11Internet Explorer 11 and Microsoft Edge
@@ -153,31 +157,31 @@ This table includes the attributes used by the Enterprise Mode schema. -<version> +version Specifies the version of the Enterprise Mode Site List. This attribute is supported for the <rules> element. Internet Explorer 11 and Microsoft Edge -<exclude> -Specifies the domain or path excluded from applying the behavior and is supported on the <domain> and <path> elements. +exclude +Specifies the domain or path is excluded from applying Enterprise Mode. This attribute is only supported on the <domain> and <path> elements in the <emie> section.

Example 

 <emie>
-  <domain exclude="false">fabrikam.com
-    <path exclude="true">/products</path>
+  <domain exclude="false">fabrikam.com
+    <path exclude="true">/products</path>
   </domain>
 </emie>

-Where https://fabrikam.com uses IE8 Enterprise Mode, but https://fabrikam.com/products does not. +Where https://fabrikam.com uses IE8 Enterprise Mode, but https://fabrikam.com/products does not. Internet Explorer 11 and Microsoft Edge -<docMode> +docMode Specifies the document mode to apply. This attribute is only supported on <domain> or <path> elements in the <docMode> section.

Example 

 <docMode>
-  <domain exclude="false">fakrikam.com
-    <path docMode="7">/products</path>
+  <domain exclude="false">fabrikam.com
+    <path docMode="7">/products</path>
   </domain>
 </docMode>
Internet Explorer 11 @@ -203,7 +207,7 @@ For example, say you want all of the sites in the contoso.com domain to open usi ### What not to include in your schema We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways: -- Don’t use protocols. For example, `https://`, `https://`, or custom protocols. They break parsing. +- Don’t use protocols. For example, `http://`, `https://`, or custom protocols. They break parsing. - Don’t use wildcards. - Don’t use query strings, ampersands break parsing. @@ -214,7 +218,7 @@ You can use trailing slashes at the path-level, but not at the domain-level: **Example** -``` xml +```xml contoso.com /about/ diff --git a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md index d9689c000a..a321e5a744 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md +++ b/browsers/internet-explorer/ie11-deploy-guide/enterprise-mode-schema-version-2-guidance.md @@ -3,9 +3,13 @@ ms.localizationpriority: medium ms.mktglfcycl: deploy ms.pagetype: appcompat description: Use the Enterprise Mode Site List Manager to create and update your Enterprise Mode site list for devices running Windows 10. -author: shortpatti +author: dansimp ms.prod: ie11 ms.assetid: 909ca359-5654-4df9-b9fb-921232fc05f5 +ms.reviewer: +audience: itpro +manager: dansimp +ms.author: dansimp title: Enterprise Mode schema v.2 guidance (Internet Explorer 11 for IT Pros) ms.sitesec: library ms.date: 12/04/2017 @@ -22,8 +26,8 @@ ms.date: 12/04/2017 Use the Enterprise Mode Site List Manager to create and update your site list for devices running Windows 7, Windows 8.1, and Windows 10, using the version 2.0 (v.2) of the Enterprise Mode schema. If you don't want to use the Enterprise Mode Site List Manager, you also have the option to update your XML schema using Notepad, or any other XML-editing app. -**Important**
-If you're running Windows 7 or Windows 8.1 and you've been using the version 1.0 (v.1) of the schema, you can continue to do so, but you won't get the benefits that come with the updated schema. For info about the v.1 schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). +> [!IMPORTANT] +> If you're running Windows 7 or Windows 8.1 and you've been using the version 1.0 (v.1) of the schema, you can continue to do so, but you won't get the benefits that come with the updated schema. For info about the v.1 schema, see [Enterprise Mode schema v.1 guidance](enterprise-mode-schema-version-1-guidance.md). ## Enterprise Mode schema v.2 updates Because of the schema changes, you can't combine the old version (v.1) with the new version (v.2) of the schema. If you look at your XML file, you can tell which version you're using by: @@ -37,24 +41,24 @@ You can continue to use the v.1 version of the schema on Windows 10, but you wo ### Enterprise Mode v.2 schema example The following is an example of the v.2 version of the Enterprise Mode schema. -**Important**
-Make sure that you don't specify a protocol when adding your URLs. Using a URL like ``, automatically applies to both https://contoso.com and https://contoso.com. -  -``` xml +> [!IMPORTANT] +> Make sure that you don't specify a protocol when adding your URLs. Using a URL like ``, automatically applies to both http://contoso.com and https://contoso.com. + +```xml - + EnterpriseSitelistManager 10240 20150728.135021 - + IE8Enterprise MSEdge - default + Default IE11 @@ -62,14 +66,15 @@ Make sure that you don't specify a protocol when adding your URLs. Using a URL l IE11 - default + Default IE11 - default - none + Default + None IE8Enterprise" + None IE7 @@ -103,8 +108,8 @@ This table includes the elements used by the v.2 version of the Enterprise Mode A new root node with this text is using the updated v.2 version of the schema. It replaces <rules>.

Example 

-<site-list version="205">
-  <site url="contoso.com">
+<site-list version="205">
+  <site url="contoso.com">
     <compat-mode>IE8Enterprise</compat-mode>
     <open-in>IE11</open-in>
   </site>
@@ -116,19 +121,19 @@ This table includes the elements used by the v.2 version of the Enterprise Mode
 A unique entry added for each site you want to put on the Enterprise Mode site list. The first <site> element will overrule any additional <site> elements that use the same value for the <url> element.
 
Example
 
-<site url="contoso.com">
+<site url="contoso.com">
   <compat-mode>default</compat-mode>
   <open-in>none</open-in>
 </site>

 -or-
-
For IPv4 ranges:
<site url="10.122.34.99:8080">
+
For IPv4 ranges:
<site url="10.122.34.99:8080">
   <compat-mode>IE8Enterprise</compat-mode>
 <site>

 -or-
-
For IPv6 ranges:
<site url="[10.122.34.99]:8080">
+
For IPv6 ranges:
<site url="[10.122.34.99]:8080">
   <compat-mode>IE8Enterprise</compat-mode>
 <site>

-You can also use the self-closing version, <url="contoso.com" />, which also sets:
+You can also use the self-closing version, <url="contoso.com" />, which also sets:
 
    
   
  • <compat-mode>default</compat-mode>
    • 
   
  • <open-in>none</open-in>
    • 
@@ -140,21 +145,21 @@ You can also use the self-closing version, <url="contoso.com" />, which al
 A child element that controls what compatibility setting is used for specific sites or domains. This element is only supported in IE11.
 
    Example
 
    -<site url="contoso.com">
+<site url="contoso.com">
   <compat-mode>IE8Enterprise</compat-mode>
 </site>
    
 -or-
-
    For IPv4 ranges:
    <site url="10.122.34.99:8080">
+
    For IPv4 ranges:
    <site url="10.122.34.99:8080">
   <compat-mode>IE8Enterprise</compat-mode>
 <site>
    
 -or-
-
    For IPv6 ranges:
    <site url="[10.122.34.99]:8080">
+
    For IPv6 ranges:
    <site url="[10.122.34.99]:8080">
   <compat-mode>IE8Enterprise</compat-mode>
 <site>
    
 Where:
 
      
   
    • IE8Enterprise. Loads the site in IE8 Enterprise Mode.
      This element is required for sites included in the EmIE section of the v.1 schema and is needed to load in IE8 Enterprise Mode.
      • 
-  
    • IE7Enterprise. Loads the site in IE7 Enterprise Mode.
      This element is required for sites included in the EmIE section of the v.1 schema and is needed to load in IE7 Enterprise Mode.
      Important
      This tag replaces the combination of the `"forceCompatView"="true"` attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.
      • 
+  
    • IE7Enterprise. Loads the site in IE7 Enterprise Mode.
      This element is required for sites included in the EmIE section of the v.1 schema and is needed to load in IE7 Enterprise Mode.
      Important
      This tag replaces the combination of the "forceCompatView"="true" attribute and the list of sites specified in the EmIE section of the v.1 version of the schema.
      • 
   
    • IE[x]. Where [x] is the document mode number into which the site loads.
      • 
   
    • Default or not specified. Loads the site using the default compatibility mode for the page. In this situation, X-UA-compatible meta tags or HTTP headers are honored.
      • 
 
    
@@ -165,7 +170,7 @@ Where:
 A child element that controls what browser is used for sites. This element supports the Open in IE11 or Open in Microsoft Edge experiences, for devices running Windows 10.
 
    Example
 
    -<site url="contoso.com">
+<site url="contoso.com">
   <open-in>none</open-in>
 </site>
    
 Where:
@@ -192,13 +197,13 @@ The <url> attribute, as part of the <site> element in the v.2 versio
 
 
 allow-redirect
-A boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).
+A boolean attribute of the <open-in> element that controls the behavior for redirected sites. Setting this attribute to "true" indicates that the site will open in IE11 or Microsoft Edge even if the site is navigated to as part of a HTTP or meta refresh redirection chain. Omitting the attribute is equivalent to "false" (sites in redirect chain will not open in another browser).
 
    Example
 
    -<site url="contoso.com/travel">
-  <open-in allow-redirect="true">IE11</open-in>
+<site url="contoso.com/travel">
+  <open-in allow-redirect="true">IE11</open-in>
 </site>
    
-In this example, if https://contoso.com/travel is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.
+In this example, if https://contoso.com/travel is encountered in a redirect chain in Microsoft Edge, it will be opened in Internet Explorer.
 Internet Explorer 11 and Microsoft Edge
 
 
@@ -210,14 +215,14 @@ In this example, if https://contoso.com/travel is encountered in a redirect chai
 url
 Specifies the URL (and port number using standard port conventions) to which the child elements apply. The URL can be a domain, sub-domain, or any path URL.
 
    Note
    
-Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both https://contoso.com and https://contoso.com.
+Make sure that you don't specify a protocol. Using <site url="contoso.com"> applies to both http://contoso.com and https://contoso.com.
 
    Example
 
    -<site url="contoso.com:8080">
+<site url="contoso.com:8080">
   <compat-mode>IE8Enterprise</compat-mode>
   <open-in>IE11</open-in>
 </site>
    
-In this example, going to https://contoso.com:8080 using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode.
+In this example, going to https://contoso.com:8080 using Microsoft Edge, causes the site to open in IE11 and load in IE8 Enterprise Mode.
 Internet Explorer 11 and Microsoft Edge
 
 
@@ -228,26 +233,26 @@ These v.1 version schema attributes have been deprecated in the v.2 version of t
 
-
-
+
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -255,44 +260,43 @@ These v.1 version schema attributes have been deprecated in the v.2 version of t
 
    
 
 
    Deprecated attributeNew attributeDeprecated element/attributeNew element
 Replacement example
 
    
     
 
 
    <forceCompatView>forceCompatView
 <compat-mode>Replace <forceCompatView="true"> with <compat-mode>IE7Enterprise</compat-mode>Replace forceCompatView="true" with <compat-mode>IE7Enterprise</compat-mode>
 
    
 
    <docMode>docMode
 <compat-mode>Replace <docMode="IE5"> with <compat-mode>IE5</compat-mode>Replace docMode="IE5" with <compat-mode>IE5</compat-mode>
 
    
 
    <doNotTransition>doNotTransition
 <open-in>Replace <doNotTransition="true"> with <open-in>none</open-in>Replace doNotTransition="true" with <open-in>none</open-in>
 
    
 
    
 <domain> and <path>Replace:
 
     <emie>
-  <domain exclude="false">contoso.com</domain>
+  <domain>contoso.com</domain>
 </emie>
    
 With:
 
    -<site url="contoso.com"/>
+<site url="contoso.com"/>
   <compat-mode>IE8Enterprise</compat-mode>
+  <open-in>IE11</open-in>
 </site>
    
 -AND-
    
 Replace:
 
     <emie>
-  <domain exclude="true">contoso.com
-     <path exclude="false" forceCompatView="true">/about</path>
+  <domain exclude="true" doNotTransition="true">
+    contoso.com
+    <path forceCompatView="true">/about</path>
   </domain>
 </emie>
    
 With:
 
    -<site url="contoso.com/about">
+<site url="contoso.com/about">
   <compat-mode>IE7Enterprise</compat-mode>
+  <open-in>IE11</open-in>
 </site>
    		
 
    
 
    
 
 While the old, replaced attributes aren't supported in the v.2 version of the schema, they'll continue to work in the v.1 version of the schema. If, however, you're using the v.2 version of the schema and these attributes are still there, the v.2 version schema takes precedence. We don’t recommend combining the two schemas, and instead recommend that you move to the v.2 version of the schema to take advantage of the new features.
 
-**Important**
    
-Saving your v.1 version of the file using the new Enterprise Mode Site List Manager (schema v.2) automatically updates the XML to the new v.2 version of the schema.
+> [!IMPORTANT]
+> Saving your v.1 version of the file using the new Enterprise Mode Site List Manager (schema v.2) automatically updates the XML to the new v.2 version of the schema.
 
 ### What not to include in your schema
 We recommend that you not add any of the following items to your schema because they can make your compatibility list behave in unexpected ways:
 
-- Don’t use protocols. For example, https://, https://, or custom protocols. They break parsing.
+- Don’t use protocols. For example, `http://`, `https://`, or custom protocols. They break parsing.
 - Don’t use wildcards.
 - Don’t use query strings, ampersands break parsing.
 
 ## Related topics
 - [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md)
-
-
-
-
diff --git a/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md
index 88fe3e4d99..cf235b25aa 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/export-your-enterprise-mode-site-list-from-the-enterprise-mode-site-list-manager.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: After you create your Enterprise Mode site list in the Enterprise Mode Site List Manager, you can export the contents to an Enterprise Mode (.EMIE) file.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 9ee7c13d-6fca-4446-bc22-d23a0213a95d
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Export your Enterprise Mode site list from the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md
index 99b28d4482..f1d72eb1a1 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: The Internet Explorer 11 Enterprise Mode site list lets you specify document modes for specific websites, helping you fix compatibility issues without changing a single line of code on the site.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 4b21bb27-aeac-407f-ae58-ab4c6db2baf6
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Fix web compatibility issues using document modes and the Enterprise Mode site list (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md
index d3209fc547..c3c7ead8ff 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/fix-validation-problems-using-the-enterprise-mode-site-list-manager.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: When you add multiple sites to your Enterprise Mode site list entries, they’re validated by the Enterprise Mode Site List Manager before they’re entered into your global list.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 9f80e39f-dcf1-4124-8931-131357f31d67
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Fix validation problems using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md
index 213c9481d9..d2fadc609c 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-advanced-group-policy-mgmt-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: Overview about Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 63a7ef4a-6de2-4d08-aaba-0479131e3406
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -30,7 +34,7 @@ From AGPM you can:
 -   **Manage your GPO lifecycle with change control features.** You can use the available version-control, history, and auditing features to help you manage your GPOs while moving through your archive, to your editing process, and finally to your GPO deployment.
 
 **Note**
    
-For more information about AGPM, and to get the license, see [Advanced Group Policy Management 4.0 Documents](https://www.microsoft.com/en-us/download/details.aspx?id=13975).
+For more information about AGPM, and to get the license, see [Advanced Group Policy Management 4.0 Documents](https://www.microsoft.com/download/details.aspx?id=13975).
 
  
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md
index 35697cb576..df5754f0b6 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-group-policy-mgmt-console-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: Overview about Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: ae3d227d-3da7-46b8-8a61-c71bfeae0c63
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md
index df2143a7a8..d80c5af350 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: Use the topics in this section to learn about Group Policy and how to use it to manage Internet Explorer.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 50383d3f-9ac9-4a30-8852-354b6eb9434a
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Group Policy and Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -31,15 +35,15 @@ Use the topics in this section to learn about Group Policy and how to use it to
 |[New group policy settings for Internet Explorer 11](new-group-policy-settings-for-ie11.md) |Info about many of the new group policy settings added for Internet Explorer 11. |
 |[Group Policy management tools](group-policy-objects-and-ie11.md) |Guidance about how to use Microsoft Active Directory Domain Services (AD DS) to manage your Group Policy settings. |
 |[ActiveX installation using group policy](activex-installation-using-group-policy.md) |Info about using the ActiveX Installer Service (AXIS) and Group Policy to manage your ActiveX control deployment. |
-|[Group Policy and compatibility with Internet Explorer 11](group-policy-compatability-with-ie11.md) |Our Group Policy recommendations for security, performance, and compatibility with previous versions of IE, regardless of which Zone the website is in. |
+|[Group Policy and compatibility with Internet Explorer 11](group-policy-compatibility-with-ie11.md) |Our Group Policy recommendations for security, performance, and compatibility with previous versions of IE, regardless of which Zone the website is in. |
 |[Group policy preferences and Internet Explorer 11](group-policy-preferences-and-ie11.md) |Info about Group Policy preferences, as compared to Group Policy settings. |
 |[Administrative templates and Internet Explorer 11](administrative-templates-and-ie11.md) |Info about Administrative Templates, including where to store them and the related Group Policy settings. | 
 |[Enable and disable add\-ons using administrative templates and group policy](enable-and-disable-add-ons-using-administrative-templates-and-group-policy.md) |Guidance about how to use your local Group Policy editor or the CLSID and Administrative Templates to manage your Group Policy objects.
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md
index b615824d04..4ca3868ed5 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-and-local-group-policy-editor-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: Group Policy, the Local Group Policy Editor, and Internet Explorer 11
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 6fc30e91-efac-4ba5-9ee2-fa77dcd36467
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Group Policy, the Local Group Policy Editor, and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md
deleted file mode 100644
index e8069dbf48..0000000000
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatability-with-ie11.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-ms.localizationpriority: medium
-ms.mktglfcycl: deploy
-ms.pagetype: security
-description: Group Policy suggestions for compatibility with Internet Explorer 11
-author: shortpatti
-ms.prod: ie11
-ms.assetid: 7482c99f-5d79-4344-9e1c-aea9f0a68e18
-title: Group Policy and compatibility with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
-ms.sitesec: library
-ms.date: 07/27/2017
----
-
-
-# Group Policy and compatibility with Internet Explorer 11
-Internet Explorer 11 has many Group Policy entries that can be configured for keeping your environment managed and safe. This table includes all of our recommendations around security, performance, and compatibility with the previous versions of Internet Explorer, regardless of which Zone the website is in.
-
-|Activity                         |Location                                      |Setting the policy object                                                |
-|---------------------------------|----------------------------------------------|-------------------------------------------------------------------------|
-|Turn on Compatibility View for all intranet zones |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Turn on IE Standards Mode for local intranet** , and then click **Disabled**. |
-|Turn on Compatibility View for selected websites, using Group Policy |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Use Policy List of Windows Internet Explorer 7 sites** , and then click **Enabled**.Users will be able to add or remove sites manually to their local Compatibility View list, but they won’t be able to remove the sites you specifically added. |
-|Turn on Quirks mode for selected websites, using Group Policy |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Use Policy List of Quirks Mode sites**, and then click **Enabled**. |
-|Ensure your users are using the most up-to-date version of Microsoft’s compatibility list. |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Include updated Web site lists from Microsoft**, and then click **Enabled**. |
-|Restrict users from making security zone configuration changes. |`Administrative Templates\ Windows Components\Internet Explorer\Internet Control Panel` |Double-click **Disable the Security Page**, and then click **Enabled**. |
-|Control which security zone settings are applied to specific websites. |`Administrative Templates\ Windows Components\Internet Explorer\Internet Control Panel\Security Page` |Double-click **Site to Zone Assignment List**, click **Enabled**, and then enter your list of websites and their applicable security zones.  |
-|Turn off Data Execution Prevention (DEP).  |`Administrative Templates\ Windows Components\Internet Explorer\Security Features` |Double-click **Turn off Data Execution Prevention**, and then click **Enabled**.  |
-
- 
-
- 
-
- 
-
-
-
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md
new file mode 100644
index 0000000000..8a5b6d7859
--- /dev/null
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-compatibility-with-ie11.md
@@ -0,0 +1,39 @@
+---
+ms.localizationpriority: medium
+ms.mktglfcycl: deploy
+ms.pagetype: security
+description: Group Policy suggestions for compatibility with Internet Explorer 11
+author: dansimp
+ms.prod: ie11
+ms.assetid: 7482c99f-5d79-4344-9e1c-aea9f0a68e18
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
+title: Group Policy and compatibility with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
+ms.sitesec: library
+ms.date: 07/27/2017
+---
+
+
+# Group Policy and compatibility with Internet Explorer 11
+Internet Explorer 11 has many Group Policy entries that can be configured for keeping your environment managed and safe. This table includes all of our recommendations around security, performance, and compatibility with the previous versions of Internet Explorer, regardless of which Zone the website is in.
+
+|Activity                         |Location                                      |Setting the policy object                                                |
+|---------------------------------|----------------------------------------------|-------------------------------------------------------------------------|
+|Turn on Compatibility View for all intranet zones |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Turn on IE Standards Mode for local intranet** , and then click **Disabled**. |
+|Turn on Compatibility View for selected websites, using Group Policy |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Use Policy List of Windows Internet Explorer 7 sites** , and then click **Enabled**.Users will be able to add or remove sites manually to their local Compatibility View list, but they won’t be able to remove the sites you specifically added. |
+|Turn on Quirks mode for selected websites, using Group Policy |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Use Policy List of Quirks Mode sites**, and then click **Enabled**. |
+|Ensure your users are using the most up-to-date version of Microsoft’s compatibility list. |`Administrative Templates\Windows Components\Internet Explorer\Compatibility View` |Double-click **Include updated Web site lists from Microsoft**, and then click **Enabled**. |
+|Restrict users from making security zone configuration changes. |`Administrative Templates\ Windows Components\Internet Explorer\Internet Control Panel` |Double-click **Disable the Security Page**, and then click **Enabled**. |
+|Control which security zone settings are applied to specific websites. |`Administrative Templates\ Windows Components\Internet Explorer\Internet Control Panel\Security Page` |Double-click **Site to Zone Assignment List**, click **Enabled**, and then enter your list of websites and their applicable security zones.  |
+|Turn off Data Execution Prevention (DEP).  |`Administrative Templates\ Windows Components\Internet Explorer\Security Features` |Double-click **Turn off Data Execution Prevention**, and then click **Enabled**.  |
+
+ 
+
+ 
+
+ 
+
+
+
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md
index 810c6ec4c0..403471f4c7 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-objects-and-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: Overview of the available Group Policy management tools
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: e33bbfeb-6b80-4e71-8bba-1d0369a87312
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Group Policy management tools (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -30,7 +34,7 @@ After deploying IE11 to your organization, you can continue to manage the browse
 **Note**
    
 Whenever possible, we recommend that you manage IE11 using Administrative Templates, because these settings are always written to secure policy branches in the registry. In addition, we recommend that you deploy using standard user accounts instead of letting your users log on to their computers as administrators. This helps to prevent your users from making unwanted changes to their systems or overriding Group Policy settings.
 
-     
+     
 Users won't be able to use the IE11 user interface or the registry to change any managed settings on their computers. However, they will be able to change many of the preferences associated with the settings you set up using the Internet Explorer Administration Kit 11 (IEAK 11).
 
 ## Which GPO tool should I use?
@@ -44,9 +48,9 @@ You can use any of these tools to create, manage, view, and troubleshoot Group P
 
 -   [Group Policy, Windows Powershell, and Internet Explorer 11](group-policy-windows-powershell-ie11.md). A command-line shell and scripting language that helps automate Windows and application administration on a single computer locally, or across many computers remotely.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md
index b676409da7..ae5c5f783e 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-preferences-and-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: Info about Group Policy preferences versus Group Policy settings
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: f2264c97-7f09-4f28-bb5c-58ab80dcc6ee
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Group policy preferences and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md
index 96f776d73e..008e2624c0 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-problems-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: Links to troubleshooting topics and log files that can help address Group Policy problems with Internet Explorer 11.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 0da0d9a9-200c-46c4-96be-630e82de017b
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Group Policy problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md
index 42a69458a5..1f0caf9bc3 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-shortcut-extensions-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: Instructions about how to create and configure shortcut preference extensions to file system objects, URLs, and shell objects.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: c6fbf990-13e4-4be7-9f08-5bdd43179b3b
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Group Policy, Shortcut Extensions, and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md
index 355eac531d..2de349942d 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/group-policy-windows-powershell-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: Overview about how Group Policy works with Windows Powershell and Internet Explorer 11
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: e3607cde-a498-4e04-9daa-b331412967fc
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Group Policy, Windows Powershell, and Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md b/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md
index 7391d19ecf..0b1edff4cd 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md
@@ -2,12 +2,15 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: support
 ms.pagetype: security
-description:
-author: shortpatti
-ms.author: pashort
-ms.manager: elizapo
+description: 
+author: dansimp
+ms.author: dansimp
+ms.manager: dansimp
 ms.prod: ie11
-ms.assetid:
+ms.assetid: 
+ms.reviewer: 
+audience: itpro
+manager: dansimp
 title: Internet Explorer 11 delivery through automatic updates
 ms.sitesec: library
 ms.date: 05/22/2018
@@ -53,7 +56,7 @@ If you use Automatic Updates in your company, but want to stop your users from a
     >The toolkit won't stop users with local administrator accounts from manually installing Internet Explorer 11. Using this toolkit also prevents your users from receiving automatic upgrades from Internet Explorer 8, Internet Explorer 9, or Internet Explorer 10 to Internet Explorer 11. For more information, see the [Internet Explorer 11 Blocker Toolkit frequently asked questions](../ie11-faq/faq-ie11-blocker-toolkit.md).
 
 -   **Use an update management solution to control update deployment.**
-    If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [System Center 2012 Configuration Manager](https://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit.
+    If you already use an update management solution, like [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or the more advanced [Microsoft Endpoint Configuration Manager](https://go.microsoft.com/fwlink/?LinkID=276664), you should use that instead of the Internet Explorer Blocker Toolkit.
 
     >[!Note]
     >If you use WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your company. This scenario is discussed in detail in the Knowledge Base article [here](https://support.microsoft.com/kb/946202).
@@ -62,45 +65,45 @@ Additional information on Internet Explorer 11, including a Readiness Toolkit, t
 
 ## Availability of Internet Explorer 11
 
-Automatic Updates will start to distribute Internet Explorer 11 shortly after the final release of the product and will distribute it through the System Center Configuration Manager, Microsoft Systems Management Server, and WSUS.
+Automatic Updates will start to distribute Internet Explorer 11 shortly after the final release of the product and will distribute it through the Microsoft Endpoint Configuration Manager and WSUS.
 
 ## Prevent automatic installation of Internet Explorer 11 with WSUS
 
 Internet Explorer 11 will be released to WSUS as an Update Rollup package. Therefore, if you’ve configured WSUS to “auto-approve” Update Rollup packages, it’ll be automatically approved and installed. To stop Internet Explorer 11 from being automatically approved for installation, you need to:
 
-1.  Click **Start**, click **Administrative Tools**, and then click **Microsoft
-    Windows Server Update Services 3.0**.
+1. Click **Start**, click **Administrative Tools**, and then click **Microsoft
+   Windows Server Update Services 3.0**.
 
-2.  Expand *ComputerName*, and then click **Options**.
+2. Expand *ComputerName*, and then click **Options**.
 
-3.  Click **Automatic Approvals**.
+3. Click **Automatic Approvals**.
 
-4.  Click the rule that automatically approves an update that is classified as
-    Update Rollup, and then click **Edit.**
+4. Click the rule that automatically approves an update that is classified as
+   Update Rollup, and then click **Edit.**
 
-    >[!Note]
-    >If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else.
+   >[!Note]
+   >If you don’t see a rule like this, you most likely haven’t configured WSUS to automatically approve Update Rollups for installation. In this situation, you don’t have to do anything else.
 
-5.  Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section.
+5. Click the **Update Rollups** property under the **Step 2: Edit the properties (click an underlined value)** section.
 
-    >[!Note]
-    >The properties for this rule will resemble the following:
    • When an update is in Update Rollups
    • Approve the update for all computers
    
+   >[!Note]
+   >The properties for this rule will resemble the following:
    • When an update is in Update Rollups
    • Approve the update for all computers
    
 
-6.  Clear the **Update Rollup** check box, and then click **OK**.
+6. Clear the **Update Rollup** check box, and then click **OK**.
 
-7.  Click **OK** to close the **Automatic Approvals** dialog box.
    After the new Internet Explorer 11 package is available for download, you should manually synchronize the new package to your WSUS server, so that when you re-enable auto-approval it won’t be automatically installed.
+7. Click **OK** to close the **Automatic Approvals** dialog box.
    After the new Internet Explorer 11 package is available for download, you should manually synchronize the new package to your WSUS server, so that when you re-enable auto-approval it won’t be automatically installed.
 
-8.  Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**.
+8. Click **Start**, click **Administrative Tools**, and then click **Microsoft Windows Server Update Services 3.0**.
 
-9.  Expand *ComputerName*, and then click **Synchronizations**.
+9. Expand *ComputerName*, and then click **Synchronizations**.
 
-10.  Click **Synchronize Now**.
+10. Click **Synchronize Now**.
 
-11.  Expand *ComputerName*, expand **Updates**, and then click **All Updates**.
+11. Expand *ComputerName*, expand **Updates**, and then click **All Updates**.
 
-12.  Choose **Unapproved** in the **Approval**drop down box.
+12. Choose **Unapproved** in the **Approval**drop down box.
 
-13.  Check to make sure that Microsoft Internet Explorer 11 is listed as an unapproved update.
+13. Check to make sure that Microsoft Internet Explorer 11 is listed as an unapproved update.
 
     >[!Note]
     >There may be multiple updates, depending on the imported language and operating system updates.
diff --git a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md
index ba9aba7115..5097f83564 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md
@@ -1,8 +1,12 @@
 ---
 description: A full-sized view of how document modes are chosen in IE11.
 title: Full-sized flowchart detailing how document modes are chosen in IE11
-author: shortpatti
+author: dansimp
 ms.date: 04/19/2017
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 ---
 
 Return to: [Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md)
    
diff --git a/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md
index 8c224e01b5..5ab9dd5e58 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/import-into-the-enterprise-mode-site-list-manager.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: If you need to replace your entire site list because of errors, or simply because it’s out of date, you can import your exported Enterprise Mode site list using the Enterprise Mode Site List Manager.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: cacd5d68-700b-4a96-b4c9-ca2c40c1ac5f
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Import your Enterprise Mode site list to the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -39,9 +43,9 @@ Importing your file overwrites everything that’s currently in the tool, so mak
 - [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853)
 - [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378)
 - [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md)
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/index.md b/browsers/internet-explorer/ie11-deploy-guide/index.md
index 6d5935a29b..74f09e116d 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/index.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/index.md
@@ -1,13 +1,14 @@
 ---
 ms.mktglfcycl: deploy
 description: Use this guide to learn about the several options and processes you'll need to consider while you're planning for, deploying, and customizing Internet Explorer 11 for your employee's devices.
-author: shortpatti
+author: dansimp
+ms.author: dansimp
 ms.prod: ie11
 ms.assetid: bddc2d97-c38d-45c5-9588-1f5bbff2e9c3
 title: Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.localizationpriority: medium
-ms.date: 07/27/2017
+manager: dansimp
 ---
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md
index 94788e4dfc..e9fcf44f0e 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-and-deploy-ie11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use the topics in this section to learn how to customize your Internet Explorer installation package, how to choose the right method for installation, and how to deploy IE into your environment.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: caca18c1-d5c4-4404-84f8-d02bc562915f
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Install and Deploy Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -31,11 +35,11 @@ Use the topics in this section to learn how to customize your Internet Explorer
 |[Choose how to install Internet Explorer 11 (IE11)](choose-how-to-install-ie11.md) |Guidance for the different ways you can install IE, including using System Center 2012 R2 Configuration Manager, Windows Server Update Services (WSUS), Microsoft Intune, your network, the operating system deployment system, or third-party tools. |
 |[Choose how to deploy Internet Explorer 11 (IE11)](choose-how-to-deploy-ie11.md) |Guidance about how to deploy your custom version of IE using Automatic Version Synchronization (AVS) or using your software distribution tools. |
 |[Virtualization and compatibility with Internet Explorer 11](virtualization-and-compatibility-with-ie11.md) |Info about the Microsoft-supported options for virtualizing web apps. |
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md
index c72e03d477..7dd92ecc08 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-microsoft-intune.md
@@ -2,16 +2,19 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to add and deploy the Internet Explorer 11 update using Microsoft Intune.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: b2dfc08c-78af-4c22-8867-7be3b92b1616
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 title: Install Internet Explorer 11 (IE11) using Microsoft Intune (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
 ---
 
 
-#  Install Internet Explorer 11 (IE11) using Microsoft Intune
+# Install Internet Explorer 11 (IE11) using Microsoft Intune
 Internet Explorer 11 is available as an update in Microsoft Intune. Microsoft Intune uses Windows cloud services to help you manage updates, monitor and protect your computers, provide remote assistance, track hardware and software inventory, and set security policies. For more information, see the [Documentation Library for Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=301805).
 
 ## Adding and deploying the IE11 package
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md
index 7d3b1213f8..5dade69199 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-operating-system-deployment-systems.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to install the Internet Explorer 11 update using Microsoft Deployment Toolkit (MDT) and your Windows images.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: e16f9144-170c-4964-a62d-0d1a16f4cd1f
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Install Internet Explorer 11 (IE11) using Microsoft Deployment Toolkit (MDT) and your Windows images (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md
index ce93f99c12..2b40174159 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-system-center-configuration-manager.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: How to install the Internet Explorer 11 update using System Center 2012 R2 Configuration Manager
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 9ede9722-29b3-4cb7-956d-ffa91e7bedbd
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Install Internet Explorer 11 (IE11) using System Center 2012 R2 Configuration Manager (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md
index 8d8382d64f..9da3cd91fa 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-the-network.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to install the Internet Explorer 11 update using your network
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 85f6429d-947a-4031-8f93-e26110a35828
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Install Internet Explorer 11 (IE11) using your network (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -18,22 +22,22 @@ You can install Internet Explorer 11 (IE11) over your network by putting your c
 
  **To manually create the folder structure**
 
--   Copy your custom IE11 installation file into a folder on your network, making sure it's available to your employees.
+- Copy your custom IE11 installation file into a folder on your network, making sure it's available to your employees.
 
- **To create the folder structure using IEAK 11**
+  **To create the folder structure using IEAK 11**
 
--   Run the Internet Explorer Customization Wizard 11 in IEAK 11, using the **Full Installation Package** option.
    
-The wizard automatically puts your custom installation files in your `\\Flat` folder. Where the `` is the location of your other build files.
+- Run the Internet Explorer Customization Wizard 11 in IEAK 11, using the **Full Installation Package** option.
    
+  The wizard automatically puts your custom installation files in your `\\Flat` folder. Where the `` is the location of your other build files.
 
 **Note**
    Use the localized versions of the IE Customization Wizard 11 to create localized IE11 installation packages.
 
 ## Related topics
 - [Internet Explorer Administration Kit 11 (IEAK 11) - Administration Guide for IT Pros](../ie11-ieak/index.md)
-     
+     
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md
index bd5133b8b9..5d230773e3 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-third-party-tools.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to install the Internet Explorer 11 update using third-party tools and command-line options.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 30190c66-49f7-4ca4-8b57-a47656aa0c7e
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Install Internet Explorer 11 (IE11) using third-party tools (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md
index 37916eff52..62bfab42b9 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-ie11-using-windows-server-update-services-wsus.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to install the Internet Explorer 11 update using Windows Server Update Services (WSUS)'
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 6cbd6797-c670-4236-8423-e0919478f2ce
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Install Internet Explorer 11 (IE11) using Windows Server Update Services (WSUS) (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -16,34 +20,34 @@ Windows Server Update Services (WSUS) lets you download a single copy of the Mic
 
  **To import from Windows Update to WSUS**
 
-1.  Open your WSUS admin site. For example, `https:///WSUSAdmin/`.
    
-Where `` is the name of your WSUS server.
+1. Open your WSUS admin site. For example, `https:///WSUSAdmin/`.
    
+   Where `` is the name of your WSUS server.
 
-2.  Choose the top server node or the **Updates** node, and then click **Import Updates**.
+2. Choose the top server node or the **Updates** node, and then click **Import Updates**.
 
-3.  To get the updates, install the Microsoft Update Catalog ActiveX control.
+3. To get the updates, install the Microsoft Update Catalog ActiveX control.
 
-4.  Search for Internet Explorer 11 and add its contents to your basket.
+4. Search for Internet Explorer 11 and add its contents to your basket.
 
-5.  After you're done browsing, go to your basket and click **Import**.
+5. After you're done browsing, go to your basket and click **Import**.
 
-    You can also download the updates without importing them by unchecking the **Import directly into Windows Server Update Services** box.
+   You can also download the updates without importing them by unchecking the **Import directly into Windows Server Update Services** box.
 
- **To approve Internet Explorer in WSUS for installation**
+   **To approve Internet Explorer in WSUS for installation**
 
-1.  Open your WSUS admin site and check the **Review synchronization settings** box from the **To Do** list.
+6. Open your WSUS admin site and check the **Review synchronization settings** box from the **To Do** list.
 
-2.  Click **Synchronize now** to sync your WSUS server with Windows Update, and then click **Updates** from the navigation bar.
+7. Click **Synchronize now** to sync your WSUS server with Windows Update, and then click **Updates** from the navigation bar.
 
-3.  Enter **Internet Explorer 11** into the **Search Contains** box, and then click **Apply**.
+8. Enter **Internet Explorer 11** into the **Search Contains** box, and then click **Apply**.
 
-4.  Choose the right version of IE11 for your operating system, and click **Approve for installation**.
+9. Choose the right version of IE11 for your operating system, and click **Approve for installation**.
 
-5.  Click each computer group you want to set up for the WSUS server, picking the right approval level, and then click **OK**.
+10. Click each computer group you want to set up for the WSUS server, picking the right approval level, and then click **OK**.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md
index f1136e386c..3ebe727aeb 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/install-problems-with-ie11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to fix potential installation problems with Internet Explorer 11
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 3ae77745-86ac-40a9-a37d-eebbf37661a3
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Install problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md
index 1dcf781581..16331ab49c 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/intranet-problems-and-ie11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to fix intranet search problems with Internet Explorer 11
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 3ee71d93-d9d2-48e1-899e-07932c73faa6
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Fix intranet search problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -21,7 +25,7 @@ IE11 works differently with search, based on whether your organization is domain
 
 -   **Non-domain-joined computers.** A single word entry is treated as an intranet site. However, if the term doesn't resolve to a site, IE11 then treats the entry as a search term and opens your default search provider.
 
-To explicitly go to an intranet site, regardless of the environment, users can type either a trailing slash like ` contoso/` or the `https://` prefix. Either of these will cause IE11 to treat the entry as an intranet search. You can also change the default behavior so that IE11 treats your single word entry in the address bar as an intranet site, regardless of your environment.
+To explicitly go to an intranet site, regardless of the environment, users can type either a trailing slash like `contoso/` or the `https://` prefix. Either of these will cause IE11 to treat the entry as an intranet search. You can also change the default behavior so that IE11 treats your single word entry in the address bar as an intranet site, regardless of your environment.
 
  **To enable single-word intranet search**
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md
index 16311a42a8..2270749c81 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/manage-ie11-overview.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use the topics in this section to learn about how to auto detect your settings, auto configure your configuration settings, and auto configure your proxy configuration settings for Internet Explorer.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: eb3cce62-fc7b-41e3-97b6-2916b85bcf55
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Manage Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -31,9 +35,9 @@ Use the topics in this section to learn about how to auto detect your settings,
 |[Auto configuration settings for Internet Explorer 11](auto-configuration-settings-for-ie11.md) |Guidance about how to add, update and lock your auto configuration settings. |
 |[Auto proxy configuration settings for Internet Explorer 11](auto-proxy-configuration-settings-for-ie11.md) |Guidance about how to add, update, and lock your auto-proxy settings. | 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md
index 563b6dee54..c0087953b7 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/missing-internet-explorer-maintenance-settings-for-ie11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: support
 description: IEM-configured settings have been deprecated for Internet Explorer 10 and newer. Use this topic to learn where to go to fix the affected settings through Group Policy Preferences, Administrative Templates (.admx), or the IEAK.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 89084e01-4e3f-46a6-b90e-48ee58d6821c
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Missing Internet Explorer Maintenance settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -61,7 +65,7 @@ The IEM settings have replacements you can use in either Group Policy Preference
 |Automatic browser configuration |Lets you update your employee's computer after you've deployed IE11, by specifying a URL to an .ins file, an auto-proxy URL, or both. You can decide when the update occurs, in minutes. Typing zero, or not putting in any number, means that automatic configuration only happens after the browser is started and used to go to a page. |In the **Internet Settings Group Policy Preferences** dialog box, click the **Automatic Configuration** tab, and then add your URL.
    On the **Automatic Configuration** page of IEAK 11, modify the configuration settings, including providing the URL to an .ins file or an auto-proxy site. |
 |Proxy settings |Lets you specify your proxy servers. |In the **Internet Settings Group Policy Preferences** dialog box, click the **Connections** tab, click **LAN Settings**, and then choose whether to turn on automatic detection of your configuration settings and if you want to use proxy servers.
    -OR-
    On the **Proxy Settings** page of IEAK 11, turn on your proxy settings, adding your proxy server addresses and exceptions. |
 |User Agent string |Lets the browser provide identification to visited servers. This string is often used to keep Internet traffic statistics. |This setting isn't available anymore. |
- 
+ 
 ### URLs replacements
 
 |IEM setting |Description |Replacement tool |
diff --git a/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md b/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md
index c5e09b4cfb..fbc40cbf73 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/missing-the-compatibility-view-button.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: support
 description: Internet Explorer 11 uses the latest standards mode, which simplifies web page compatibility for users by removing the **Compatibility View** button and reducing the number of compatibility options in the F12 developer tools for developers.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 501c96c9-9f03-4913-9f4b-f67bd9edbb61
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Missing the Compatibility View Button (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md
index bed077a506..3e564954a6 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/net-framework-problems-with-ie11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: support
 description: How to turn managed browser hosting controls back on in Internet Explorer 11.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: b0b7f60f-9099-45ab-84f4-4ac64d7bcb43
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: .NET Framework problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -16,9 +20,9 @@ If you’re having problems launching your legacy apps while running Internet Ex
 
  **To turn managed browser hosting controls back on**
 
-1.  **For x86 systems or for 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**.
+1.  **For x86 systems or for 64-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**.
 
-2.  **For x64 systems or for 64-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**.
+2.  **For 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\Wow6432Node\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**.
 
 For more information, see the [Web Applications](https://go.microsoft.com/fwlink/p/?LinkId=308903) section of the Application Compatibility in the .NET Framework 4.5 page.
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md
index 0b64ef876d..65e099eb37 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/new-group-policy-settings-for-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: New group policy settings for Internet Explorer 11
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 669cc1a6-e2cb-403f-aa31-c1de52a615d1
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: New group policy settings for Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -13,42 +17,43 @@ ms.date: 07/27/2017
 
 
 # New group policy settings for Internet Explorer 11
-Internet Explorer 11 gives you some new Group Policy settings to help you manage your company's web browser configurations, including:
+Internet Explorer 11 gives you some new Group Policy settings to help you manage your company's web browser configurations, including:
 
-|Policy |Category Path |Supported on |Explanation |
-|-------|--------------|-------------|------------|
-|Allow IE to use the HTTP2 network protocol |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |IE11 on Windows 10 |This policy setting determines whether IE uses the HTTP2 network protocol. HTTP2 works with HTTP requests to optimize the latency of network requests through compression, multiplexing, and prioritization.
    If you enable this policy setting, IE uses the HTTP2 network protocol.
    If you disable this policy setting, IE won't use the HTTP2 network protocol.
    If you don't configure this policy setting, users can turn this behavior on or off, using the **Internet Explorer Advanced Internet Options** settings. The default is on. |
-|Allow IE to use the SPDY/3 network protocol |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |IE11 on Windows 10 |This policy setting determines whether Internet Explorer uses the SPDY/3 network protocol. SPDY/3 works with HTTP requests to optimize the latency of network requests through compression, multiplexing and prioritization.
    If you enable this policy setting, Internet Explorer uses the SPDY/3 network protocol.
    If you disable this policy setting, Internet Explorer won't use the SPDY/3 network protocol.
    If you don't configure this policy setting, users can turn this behavior on or off, on the **Advanced* tab of the **Internet Options** dialog box. The default is on.
    **Note**
    We've replaced the SPDY/3 protocol with the HTTP2 protocol in Windows 10. You can configure the HTTP2 protocol by using the **Allow IE to use the HTTP2 network protocol** setting. |
-|Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10 |This policy setting allows IE to provide enhanced suggestions as the user types in the Address bar. To provide enhanced suggestions, the user’s keystrokes are sent to Microsoft through Microsoft services.
    If you enable this policy setting, users receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.
    If you disable this policy setting, users won’t receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.
    If you don’t configure this policy setting, users can change the **Suggestions** setting on the **Settings** charm. |
-|Allow only approved domains to use the TDC ActiveX control |
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
     |IE11 in Windows 10 |This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the **Internet** and **Restricted Sites** security zones.
    If you enable this policy setting, users won’t be able to run the TDC ActiveX control from all sites in the specified zone.
    If you disable this policy setting, users can run the TDC Active X control from all sites in the specified zone. |
-|Allow SSL3 Fallback |Administrative Templates\Windows Components\Internet Explorer\Security Features |Internet Explorer 11 on Windows 10 |This policy setting allows you to stop websites from falling back to using Secure Socket Layer (SSL) 3.0 or lower, if Transport Layer Security (TLS) 1.0 or higher, fails. This setting doesn’t affect which security protocols are enabled.
    If you enable this policy setting and a website fails while using the TLS 1.0 or higher security protocols, Internet Explorer will try to fallback and use SSL 3.0 or lower security protocols.
    If you disable or don’t configure this setting, Internet Explorer uses the default system protocols.
    **Important:**
    By default, SSL 3.0 is disabled. If you choose to enable SSL 3.0, we recommend that you disable or don't configure this setting to help mitigate potential man-in-the-middle attacks. |
-|Allow VBScript to run in Internet Explorer|
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Internet Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Intranet Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Local Machine Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Internet Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Intranet Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Local Machine Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Restricted Sites Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Trusted Sites Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Restricted Sites Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Trusted Sites Zone
     |Internet Explorer 11|This policy setting lets you decide whether VBScript can run on pages in specific Internet Explorer zones.
    If you enable this policy setting (default), you must also pick one of the following options from the Options box:
    • Enable. VBScript runs on pages in specific zones, without any interaction.
    • Prompt. Employees are prompted whether to allow VBScript to run in the zone.
    • Disable. VBScript is prevented from running in the zone.
    If you disable or don’t configure this policy setting, VBScript runs without any interaction in the specified zone.|
-|Always send Do Not Track header |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |At least Internet Explorer 10 |This policy setting allows you to configure how IE sends the Do Not Track (DNT) header.
    If you enable this policy setting, IE sends a `DNT:1` header with all HTTP and HTTPS requests. The `DNT:1` header signals to the servers not to track the user.
    **In Internet Explorer 9 and 10:**
    If you disable this policy setting, IE only sends the Do Not Track header if a Tracking Protection List is enabled or inPrivate Browsing mode is used.
    **In at least IE11:**
    If you disable this policy setting, IE only sends the Do Not Track header if inPrivate Browsing mode is used.
    If you don't configure the policy setting, users can select the **Always send Do Not Track header** option on the **Advanced* tab of the **Internet Options** dialog box. By selecting this option, IE sends a `DNT:1` header with all HTTP and HTTPS requests; unless the user grants a site-specific exception, in which case IE sends a `DNT:0` header. By default, this option is enabled. |
-|Don't run antimalware programs against ActiveX controls
    (Internet, Restricted Zones) |
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone
     |IE11 on Windows 10 |This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.
    If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.
    If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.
    If you don't configure this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using the Internet Explorer's **Security** settings. |
-|Don't run antimalware programs against ActiveX controls
    (Intranet, Trusted, Local Machine Zones) |
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
     |IE11 on Windows 10 |This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.
    If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.
    If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.
    If you don't configure this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer's **Security** settings. |
-|Hide the button (next to the New Tab button) that opens Microsoft Edge |User Configuration\Administrative Templates\Windows Components/Internet Explorer\Internet Settings\Advanced Settings\Browsing\ |IE11 on Windows 10, version 1703|This policy setting lets you decide whether employees can see the open Microsoft Edge button, which appears next to the New Tab button.
    If you enable this policy setting, the button to open Microsoft Edge from Internet Explorer will be hidden.
    If you disable this policy setting, the button to open Microsoft Edge from Internet Explorer appears.
    If you don't configure this policy setting, the button to open Microsoft Edge from Internet Explorer can be configured by your employees. |
-|Let users turn on and use Enterprise Mode from the **Tools** menu |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10 |This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the **Tools** menu.
    If you enable this policy setting, users can see and use the **Enterprise Mode** option from the **Tools** menu. If you enable this setting, but don’t specify a report location, Enterprise Mode will still be available to your users, but you won’t get any reports.
    If you disable or don’t configure this policy setting, the menu option won’t appear and users won’t be able to turn on Enterprise Mode locally. |
-|Limit Site Discovery output by Domain |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to control which domains are included in the discovery function of the Internet Explorer Site Discovery Toolkit.
    If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in your specified domains, configured by adding one domain per line to the included text box.
    If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all domains.
    **Note:**
    You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. |
-|Limit Site Discovery output by Zone |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to control which zones are included in the discovery function of the Internet Explorer Site Discovery Toolkit.
    If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all specified security zones.
    If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all security zones.
    To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:
    • 0 – Restricted Sites zone
    • 0 – Internet zone
    • 0 – Trusted Sites zone
    • 0 – Local Intranet zone
    • 0 – Local Machine zone

    **Example 1:** Include only the Local Intranet zone (binary representation: 00010), based on:
    • 0 – Restricted Sites zone
    • 0 – Internet zone
    • 0 – Trusted Sites zone
    • 1 – Local Intranet zone
    • 0 – Local Machine zone

    **Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones (binary representation: 10110), based on:
    • 1 – Restricted Sites zone
    • 0 – Internet zone
    • 1 – Trusted Sites zone
    • 1 – Local Intranet zone
    • 1 – Local Machine zone
    **Note:**
    You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. |
-|Prevent deleting ActiveX Filtering, Tracking Protection and Do Not Track data |Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History |At least Windows Internet Explorer 9 |**In Internet Explorer 9 and Internet Explorer 10:**
    This policy setting prevents users from deleting ActiveX Filtering and Tracking Protection data, which includes the list of websites for which the user has chosen to disable ActiveX Filtering or Tracking Protection. In addition, Tracking Protection data is also collected if users turn on the **Personalized Tracking Protection List**, which blocks third-party items while the user is browsing.
    **In IE11:**
    This policy setting prevents users from deleting ActiveX Filtering, Tracking Protection data, and Do Not Track exceptions, stored in the **Delete Browsing History** dialog box, for visited websites.
    If you enable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is preserved when the user clicks **Delete**.
    If you disable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is deleted when the user clicks **Delete**.
    If you don’t configure this policy setting, users can turn this feature on and off, determining whether to delete ActiveX Filtering, Tracking Protection, and Do Not Track data when clicking **Delete**. |
-|Send all sites not included in the Enterprise Mode Site List to Microsoft Edge |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10, version 1607 |This policy setting lets you decide whether to open all sites that aren’t specified to open in IE11 by the Enterprise Mode site list, to open in Microsoft Edge.
    If you enable this policy setting, you must also enable the Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list policy setting and you must include at least one site in the Enterprise Mode site list.
    If you disable or don't configure this policy setting, all sites will open based on the currently active browser.
    **Note:**
    If you’ve also enabled the Administrative Templates\Windows Components\Microsoft Edge\Send all intranet sites to Internet Explorer 11 policy setting, then all intranet sites will continue to open in Internet Explorer 11. |
-|Show message when opening sites in Microsoft Edge using Enterprise Mode |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10, version 1607 |This policy setting lets you decide whether employees see an additional page in Internet Explorer 11, stating that a site has been opened using Microsoft Edge with Enterprise Mode.
    If you enable this policy setting, employees see an additional page in Internet Explorer 11, stating that a site has been opened using Microsoft Edge with Enterprise Mode.
    If you disable or don't configure this policy setting, the default app behavior occurs and no additional page appears. |
-|Turn off automatic download of the ActiveX VersionList |Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management |At least Windows Internet Explorer 8 |This policy setting allows you to decide whether Internet Explorer automatically downloads updated versions of Microsoft's VersionList.XML file. This file tells Internet Explorer whether to stop specific ActiveX controls from loading.
    If you enable this policy setting, Internet Explorer stops automatically downloading updated versions of the VersionList.XML file.
    If you disable or don’t configure this setting, Internet Explorer continues to download updated versions of the VersionList.XML file.
    **Important:**
    Stopping this file from updating breaks the out-of-date ActiveX control blocking feature, potentially compromising the security of the device. For more info, see the Out-of-Date ActiveX Control Blocking (https://technet.microsoft.com/itpro/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking) topic. |
-|Turn off loading websites and content in the background to optimize performance |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |IE11 on Windows 10 |This policy setting determines whether Internet Explorer preemptively loads websites and content in the background, speeding up performance such that when the user clicks a hyperlink, the background page seamlessly switches into view.
    If you enable this policy setting, IE doesn't load any websites or content in the background.
    If you disable this policy setting, IE preemptively loads websites and content in the background.
    If you don’t configure this policy setting, users can turn this behavior on or off, using IE settings. This feature is turned on by default. |
-|Turn off phone number detection |Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Advanced settings\Browsing |IE11 on Windows 10 |This policy setting determines whether phone numbers are recognized and turned into hyperlinks, which can be used to invoke the default phone application on the system.
    If you enable this policy setting, phone number detection is turned off. Users won’t be able to modify this setting.
    If you disable this policy setting, phone number detection is turned on. Users won’t be able to modify this setting.
    If you don't configure this policy setting, users can turn this behavior on or off, using IE settings. The default is on. |
-|Turn off sending URL path as UTF-8 |User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\URL Encoding |At least Windows Internet Explorer 7 |This policy setting determines whether to let IE send the path portion of a URL using the UTF-8 standard. This standard defines characters so they're readable in any language and lets you exchange Internet addresses (URLs) with characters included in any language.
    If you enable this policy setting, UTF-8 is not allowed. Users won't be able to change this setting.
    If you disable this policy setting, UTF-8 is allowed. Users won't be able to change this setting.
    If you don't configure this policy setting, users can turn this behavior on or off. |
-|Turn off sending UTF-8 query strings for URLs |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |IE11 on Windows 10 |This policy setting determines whether IE uses 8-bit Unicode Transformation Format (UTF-8) to encode query strings in URLs before sending them to servers or to proxy servers.
    If you enable this policy setting, you must specify when to use UTF-8 to encode query strings:
    • **0.** Never encode query strings.
    • **1.** Only encode query strings for URLs that aren't in the Intranet zone.
    • **2.** Only encode query strings for URLs that are in the Intranet zone.
    • **3.** Always encode query strings.
    If you disable or don't configure this policy setting, users can turn this behavior on or off, using IE Advanced Options settings. The default is to encode all query strings in UTF-8. |
-|Turn off the ability to launch report site problems using a menu option |Administrative Templates\Windows Components\Internet Explorer\Browser menus |Internet Explorer 11 |This policy setting allows you to manage whether users can start the **eport Site Problems** dialog box from the **Internet Explorer** settings area or from the **Tools** menu.
    If you enable this policy setting, users won’t be able to start the **Report Site Problems** dialog box from the Internet Explorer settings or the Tools menu.
    If you disable or don’t configure this policy setting, users will be able to start the **Report Site Problems** dialog box from the **Internet Explorer** settings area or from the **Tools** menu. |
-|Turn off the flip ahead with page prediction feature |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |At least Internet Explorer 10 on Windows 8 |This policy setting determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website.
    If you enable this policy setting, flip ahead with page prediction is turned off and the next webpage isn’t loaded into the background.
    If you disable this policy setting, flip ahead with page prediction is turned on and the next webpage is loaded into the background.
    If you don’t configure this setting, users can turn this behavior on or off, using the **Settings** charm.
    **Note**
    Microsoft collects your browsing history to improve how flip ahead with page prediction works. This feature isn’t available for Internet Explorer for the desktop. |
-|Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows |Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |IE11 on Windows 10 |This policy setting determines whether IE11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.
    If you enable this policy setting, IE11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.
    If you disable this policy setting, IE11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.
    If you don't configure this policy setting, users can turn this feature on or off using IE settings. This feature is turned off by default.
    **Important**
    When using 64-bit processes, some ActiveX controls and toolbars might not be available. |
-|Turn on Site Discovery WMI output |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to manage the WMI output functionality of the Internet Explorer Site Discovery Toolkit.
    If you enable this policy setting, the Internet Explorer Site Discovery Toolkit will log its collected data to an WMI class, which can be aggregated by using a client-management solution, such as System Center Configuration Manager.
    If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit won’t log its collected data to an WMI class.
    **Note:**
    Enabling or disabling this setting won’t impact any other output methods available to the Internet Explorer Site Discovery Toolkit. |
-|Turn on Site Discovery XML output |Administrative Templates\Windows Components\Internet Explorer |At least Internet Explorer 8 |This policy setting allows you to manage the XML output functionality of the Internet Explorer Site Discovery Toolkit.
    If you enable this policy setting, the Internet Explorer Site Discovery Toolkit will log its collected data to an XML file, stored in your specified location.
    If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit won’t log its collected data to an XML file.
    **Note:**
    Enabling or disabling this setting won’t impact any other output methods available to the Internet Explorer Site Discovery Toolkit. |
-|Use the Enterprise Mode IE website list |Administrative Templates\Windows Components\Internet Explorer |IE11 on Windows 10, version 1511 |This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode, instead of Standard mode, because of compatibility issues. Users can’t edit this list.
    If you enable this policy setting, Internet Explorer downloads the Enterprise Mode website list from the `HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE`\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode hive, opening all included websites using Enterprise Mode. We recommend storing and downloading your list from a secure web server `(https://)`, to help protect against data tampering.
    If you disable or don’t configure this policy setting, Internet Explorer opens all websites using **Standard** mode. |
+
+|                                               Policy                                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       Category Path                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |                Supported on                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 Explanation                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+|-----------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+|                             Allow IE to use the HTTP2 network protocol                              |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |             IE11 on Windows 10             |                                                                                                                                                                                                                                                                                                                                                                                                                                                              This policy setting determines whether IE uses the HTTP2 network protocol. HTTP2 works with HTTP requests to optimize the latency of network requests through compression, multiplexing, and prioritization.
    If you enable this policy setting, IE uses the HTTP2 network protocol.
    If you disable this policy setting, IE won't use the HTTP2 network protocol.
    If you don't configure this policy setting, users can turn this behavior on or off, using the **Internet Explorer Advanced Internet Options** settings. The default is on.                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+|                             Allow IE to use the SPDY/3 network protocol                             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |             IE11 on Windows 10             |                                                                                                                                                                                                                                                                                                                                      This policy setting determines whether Internet Explorer uses the SPDY/3 network protocol. SPDY/3 works with HTTP requests to optimize the latency of network requests through compression, multiplexing and prioritization.
    If you enable this policy setting, Internet Explorer uses the SPDY/3 network protocol.
    If you disable this policy setting, Internet Explorer won't use the SPDY/3 network protocol.
    If you don't configure this policy setting, users can turn this behavior on or off, on the **Advanced\* tab of the \*\*Internet Options** dialog box. The default is on.
    **Note**
    We've replaced the SPDY/3 protocol with the HTTP2 protocol in Windows 10. You can configure the HTTP2 protocol by using the **Allow IE to use the HTTP2 network protocol** setting.                                                                                                                                                                                                                                                                                                                                       |
+|    Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar    |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Administrative Templates\Windows Components\Internet Explorer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |             IE11 on Windows 10             |                                                                                                                                                                                                                                                                                                                                                       This policy setting allows IE to provide enhanced suggestions as the user types in the Address bar. To provide enhanced suggestions, the user’s keystrokes are sent to Microsoft through Microsoft services.
    If you enable this policy setting, users receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.
    If you disable this policy setting, users won’t receive enhanced suggestions while typing in the Address bar. In addition, users won’t be able to change the **Suggestions** setting on the **Settings** charm.
    If you don’t configure this policy setting, users can change the **Suggestions** setting on the **Settings** charm.                                                                                                                                                                                                                                                                                                                                                        |
+|                     Allow only approved domains to use the TDC ActiveX control                      |                                                                                                                                                                                                                                                                                                                                                  
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
                                                                                                                                                                                                                                                                                                                                                      |             IE11 in Windows 10             |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the **Internet** and **Restricted Sites** security zones.
    If you enable this policy setting, users won’t be able to run the TDC ActiveX control from all sites in the specified zone.
    If you disable this policy setting, users can run the TDC Active X control from all sites in the specified zone.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+|                                         Allow SSL3 Fallback                                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Administrative Templates\Windows Components\Internet Explorer\Security Features                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |     Internet Explorer 11 on Windows 10     |                                                                                                                                                                                                                                                                                                                                                       This policy setting allows you to stop websites from falling back to using Secure Socket Layer (SSL) 3.0 or lower, if Transport Layer Security (TLS) 1.0 or higher, fails. This setting doesn’t affect which security protocols are enabled.
    If you enable this policy setting and a website fails while using the TLS 1.0 or higher security protocols, Internet Explorer will try to fallback and use SSL 3.0 or lower security protocols.
    If you disable or don’t configure this setting, Internet Explorer uses the default system protocols.
    **Important:**
    By default, SSL 3.0 is disabled. If you choose to enable SSL 3.0, we recommend that you disable or don't configure this setting to help mitigate potential man-in-the-middle attacks.                                                                                                                                                                                                                                                                                                                                                        |
+|                             Allow VBScript to run in Internet Explorer                              | 
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Internet Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Intranet Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Local Machine Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Internet Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Intranet Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Local Machine Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Restricted Sites Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Locked-Down Trusted Sites Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Restricted Sites Zone
    •  Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone/Trusted Sites Zone
     |            Internet Explorer 11            |                                                                                                                                                                                                                                                                                                                                                                                                                                   This policy setting lets you decide whether VBScript can run on pages in specific Internet Explorer zones.
    If you enable this policy setting (default), you must also pick one of the following options from the Options box:
    • Enable. VBScript runs on pages in specific zones, without any interaction.
    • Prompt. Employees are prompted whether to allow VBScript to run in the zone.
    • Disable. VBScript is prevented from running in the zone.
    If you disable or don’t configure this policy setting, VBScript runs without any interaction in the specified zone.                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+|                                   Always send Do Not Track header                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |       At least Internet Explorer 10        |                                                                                                                                                                                                                                    This policy setting allows you to configure how IE sends the Do Not Track (DNT) header.
    If you enable this policy setting, IE sends a `DNT:1` header with all HTTP and HTTPS requests. The `DNT:1` header signals to the servers not to track the user.
    **In Internet Explorer 9 and 10:**
    If you disable this policy setting, IE only sends the Do Not Track header if a Tracking Protection List is enabled or inPrivate Browsing mode is used.
    **In at least IE11:**
    If you disable this policy setting, IE only sends the Do Not Track header if inPrivate Browsing mode is used.
    If you don't configure the policy setting, users can select the **Always send Do Not Track header** option on the **Advanced\* tab of the \*\*Internet Options** dialog box. By selecting this option, IE sends a `DNT:1` header with all HTTP and HTTPS requests; unless the user grants a site-specific exception, in which case IE sends a `DNT:0` header. By default, this option is enabled.                                                                                                                                                                                                                                     |
+|       Don't run antimalware programs against ActiveX controls
    (Internet, Restricted Zones)       |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |             IE11 on Windows 10             |                                                                                                                                                                                                                                                                                                                                                                               This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.
    If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.
    If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.
    If you don't configure this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using the Internet Explorer's **Security** settings.                                                                                                                                                                                                                                                                                                                                                                                |
+| Don't run antimalware programs against ActiveX controls
    (Intranet, Trusted, Local Machine Zones) |                                                                                                                                                                                                                                                                                                                                                  
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone
    • Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone
                                                                                                                                                                                                                                                                                                                                                      |             IE11 on Windows 10             |                                                                                                                                                                                                                                                                                                                                                                                  This policy setting determines whether IE runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.
    If you enable this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.
    If you disable this policy setting, IE always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.
    If you don't configure this policy setting, IE won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer's **Security** settings.                                                                                                                                                                                                                                                                                                                                                                                   |
+|               Hide the button (next to the New Tab button) that opens Microsoft Edge                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              User Configuration\Administrative Templates\Windows Components/Internet Explorer\Internet Settings\Advanced Settings\Browsing\                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |      IE11 on Windows 10, version 1703      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  This policy setting lets you decide whether employees can see the open Microsoft Edge button, which appears next to the New Tab button.
    If you enable this policy setting, the button to open Microsoft Edge from Internet Explorer will be hidden.
    If you disable this policy setting, the button to open Microsoft Edge from Internet Explorer appears.
    If you don't configure this policy setting, the button to open Microsoft Edge from Internet Explorer can be configured by your employees.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+|                  Let users turn on and use Enterprise Mode from the **Tools** menu                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Administrative Templates\Windows Components\Internet Explorer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |             IE11 on Windows 10             |                                                                                                                                                                                                                                                                                                                                                                      This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the **Tools** menu.
    If you enable this policy setting, users can see and use the **Enterprise Mode** option from the **Tools** menu. If you enable this setting, but don’t specify a report location, Enterprise Mode will still be available to your users, but you won’t get any reports.
    If you disable or don’t configure this policy setting, the menu option won’t appear and users won’t be able to turn on Enterprise Mode locally.                                                                                                                                                                                                                                                                                                                                                                       |
+|                                Limit Site Discovery output by Domain                                |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Administrative Templates\Windows Components\Internet Explorer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |        At least Internet Explorer 8        |                                                                                                                                                                                                                                                                                                                                                                                                              This policy setting allows you to control which domains are included in the discovery function of the Internet Explorer Site Discovery Toolkit.
    If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in your specified domains, configured by adding one domain per line to the included text box.
    If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all domains.
    **Note:**
    You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit.                                                                                                                                                                                                                                                                                                                                                                                                              |
+|                                 Limit Site Discovery output by Zone                                 |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Administrative Templates\Windows Components\Internet Explorer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |        At least Internet Explorer 8        | This policy setting allows you to control which zones are included in the discovery function of the Internet Explorer Site Discovery Toolkit.
    If you enable this policy setting, the Internet Explorer Site Discovery Toolkit collects data from all specified security zones.
    If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit collects data from all sites in all security zones.
    To specify which zones can collect data, you must include a binary number that represents your selected zones, based on this order:
    • 0 – Restricted Sites zone
    • 0 – Internet zone
    • 0 – Trusted Sites zone
    • 0 – Local Intranet zone
    • 0 – Local Machine zone

    **Example 1:** Include only the Local Intranet zone (binary representation: 00010), based on:
    • 0 – Restricted Sites zone
    • 0 – Internet zone
    • 0 – Trusted Sites zone
    • 1 – Local Intranet zone
    • 0 – Local Machine zone

    **Example 2:** Include only the Restricted Sites, Trusted Sites, and Local Intranet zones (binary representation: 10110), based on:
    • 1 – Restricted Sites zone
    • 0 – Internet zone
    • 1 – Trusted Sites zone
    • 1 – Local Intranet zone
    • 1 – Local Machine zone
    **Note:**
    You can use this setting in conjunction with the other settings that control the Internet Explorer Site Discovery Toolkit. |
+|            Prevent deleting ActiveX Filtering, Tracking Protection and Do Not Track data            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |    At least Windows Internet Explorer 9    |                                                                                                                                    **In Internet Explorer 9 and Internet Explorer 10:**
    This policy setting prevents users from deleting ActiveX Filtering and Tracking Protection data, which includes the list of websites for which the user has chosen to disable ActiveX Filtering or Tracking Protection. In addition, Tracking Protection data is also collected if users turn on the **Personalized Tracking Protection List**, which blocks third-party items while the user is browsing.
    **In IE11:**
    This policy setting prevents users from deleting ActiveX Filtering, Tracking Protection data, and Do Not Track exceptions, stored in the **Delete Browsing History** dialog box, for visited websites.
    If you enable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is preserved when the user clicks **Delete**.
    If you disable this policy setting, ActiveX Filtering, Tracking Protection and Do Not Track data is deleted when the user clicks **Delete**.
    If you don’t configure this policy setting, users can turn this feature on and off, determining whether to delete ActiveX Filtering, Tracking Protection, and Do Not Track data when clicking **Delete**.                                                                                                                                    |
+|           Send all sites not included in the Enterprise Mode Site List to Microsoft Edge            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Administrative Templates\Windows Components\Internet Explorer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |      IE11 on Windows 10, version 1607      |                                                                                                                                                                                                                                                                                                                                         This policy setting lets you decide whether to open all sites that aren’t specified to open in IE11 by the Enterprise Mode site list, to open in Microsoft Edge.
    If you enable this policy setting, you must also enable the Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list policy setting and you must include at least one site in the Enterprise Mode site list.
    If you disable or don't configure this policy setting, all sites will open based on the currently active browser.
    **Note:**
    If you’ve also enabled the Administrative Templates\Windows Components\Microsoft Edge\Send all intranet sites to Internet Explorer 11 policy setting, then all intranet sites will continue to open in Internet Explorer 11.                                                                                                                                                                                                                                                                                                                                         |
+|               Show message when opening sites in Microsoft Edge using Enterprise Mode               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Administrative Templates\Windows Components\Internet Explorer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |      IE11 on Windows 10, version 1607      |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         This policy setting lets you decide whether employees see an additional page in Internet Explorer 11, stating that a site has been opened using Microsoft Edge with Enterprise Mode.
    If you enable this policy setting, employees see an additional page in Internet Explorer 11, stating that a site has been opened using Microsoft Edge with Enterprise Mode.
    If you disable or don't configure this policy setting, the default app behavior occurs and no additional page appears.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+|                       Turn off automatic download of the ActiveX VersionList                        |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |    At least Windows Internet Explorer 8    |                                                                                                                                                                                                                                                                                                This policy setting allows you to decide whether Internet Explorer automatically downloads updated versions of Microsoft's VersionList.XML file. This file tells Internet Explorer whether to stop specific ActiveX controls from loading.
    If you enable this policy setting, Internet Explorer stops automatically downloading updated versions of the VersionList.XML file.
    If you disable or don’t configure this setting, Internet Explorer continues to download updated versions of the VersionList.XML file.
    **Important:**
    Stopping this file from updating breaks the out-of-date ActiveX control blocking feature, potentially compromising the security of the device. For more info, see the Out-of-Date ActiveX Control Blocking () topic.                                                                                                                                                                                                                                                                                                |
+|           Turn off loading websites and content in the background to optimize performance           |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |             IE11 on Windows 10             |                                                                                                                                                                                                                                                                                                                                                                                                                                        This policy setting determines whether Internet Explorer preemptively loads websites and content in the background, speeding up performance such that when the user clicks a hyperlink, the background page seamlessly switches into view.
    If you enable this policy setting, IE doesn't load any websites or content in the background.
    If you disable this policy setting, IE preemptively loads websites and content in the background.
    If you don’t configure this policy setting, users can turn this behavior on or off, using IE settings. This feature is turned on by default.                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+|                                   Turn off phone number detection                                   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Advanced settings\Browsing                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |             IE11 on Windows 10             |                                                                                                                                                                                                                                                                                                                                                                                                                                                              This policy setting determines whether phone numbers are recognized and turned into hyperlinks, which can be used to invoke the default phone application on the system.
    If you enable this policy setting, phone number detection is turned off. Users won’t be able to modify this setting.
    If you disable this policy setting, phone number detection is turned on. Users won’t be able to modify this setting.
    If you don't configure this policy setting, users can turn this behavior on or off, using IE settings. The default is on.                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+|                                 Turn off sending URL path as UTF-8                                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\URL Encoding                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |    At least Windows Internet Explorer 7    |                                                                                                                                                                                                                                                                                                                                                                                                                                                  This policy setting determines whether to let IE send the path portion of a URL using the UTF-8 standard. This standard defines characters so they're readable in any language and lets you exchange Internet addresses (URLs) with characters included in any language.
    If you enable this policy setting, UTF-8 is not allowed. Users won't be able to change this setting.
    If you disable this policy setting, UTF-8 is allowed. Users won't be able to change this setting.
    If you don't configure this policy setting, users can turn this behavior on or off.                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+|                            Turn off sending UTF-8 query strings for URLs                            |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |             IE11 on Windows 10             |                                                                                                                                                                                                                                                                                                                                                                This policy setting determines whether IE uses 8-bit Unicode Transformation Format (UTF-8) to encode query strings in URLs before sending them to servers or to proxy servers.
    If you enable this policy setting, you must specify when to use UTF-8 to encode query strings:
    • **0.** Never encode query strings.
    • **1.** Only encode query strings for URLs that aren't in the Intranet zone.
    • **2.** Only encode query strings for URLs that are in the Intranet zone.
    • **3.** Always encode query strings.
    If you disable or don't configure this policy setting, users can turn this behavior on or off, using IE Advanced Options settings. The default is to encode all query strings in UTF-8.                                                                                                                                                                                                                                                                                                                                                                |
+|               Turn off the ability to launch report site problems using a menu option               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        Administrative Templates\Windows Components\Internet Explorer\Browser menus                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |            Internet Explorer 11            |                                                                                                                                                                                                                                                                                                                                                                                                                                                           This policy setting allows you to manage whether users can start the **eport Site Problems** dialog box from the **Internet Explorer** settings area or from the **Tools** menu.
    If you enable this policy setting, users won’t be able to start the **Report Site Problems** dialog box from the Internet Explorer settings or the Tools menu.
    If you disable or don’t configure this policy setting, users will be able to start the **Report Site Problems** dialog box from the **Internet Explorer** settings area or from the **Tools** menu.                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+|                        Turn off the flip ahead with page prediction feature                         |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             | At least Internet Explorer 10 on Windows 8 |                                                                                                                                                                                                                                                                                                                                                                           This policy setting determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website.
    If you enable this policy setting, flip ahead with page prediction is turned off and the next webpage isn’t loaded into the background.
    If you disable this policy setting, flip ahead with page prediction is turned on and the next webpage is loaded into the background.
    If you don’t configure this setting, users can turn this behavior on or off, using the **Settings** charm.
    **Note**
    Microsoft collects your browsing history to improve how flip ahead with page prediction works. This feature isn’t available for Internet Explorer for the desktop.                                                                                                                                                                                                                                                                                                                                                                            |
+| Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |             IE11 on Windows 10             |                                                                                                                                                                                                                                                                                                                                                   This policy setting determines whether IE11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.
    If you enable this policy setting, IE11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.
    If you disable this policy setting, IE11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.
    If you don't configure this policy setting, users can turn this feature on or off using IE settings. This feature is turned off by default.
    **Important**
    When using 64-bit processes, some ActiveX controls and toolbars might not be available.                                                                                                                                                                                                                                                                                                                                                    |
+|                                  Turn on Site Discovery WMI output                                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Administrative Templates\Windows Components\Internet Explorer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |        At least Internet Explorer 8        |                                                                                                                                                                                                                                                                                                                                                                                                      This policy setting allows you to manage the WMI output functionality of the Internet Explorer Site Discovery Toolkit.
    If you enable this policy setting, the Internet Explorer Site Discovery Toolkit will log its collected data to an WMI class, which can be aggregated by using a client-management solution, such as Microsoft Endpoint Configuration Manager.
    If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit won’t log its collected data to an WMI class.
    **Note:**
    Enabling or disabling this setting won’t impact any other output methods available to the Internet Explorer Site Discovery Toolkit.                                                                                                                                                                                                                                                                                                                                                                                                       |
+|                                  Turn on Site Discovery XML output                                  |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Administrative Templates\Windows Components\Internet Explorer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |        At least Internet Explorer 8        |                                                                                                                                                                                                                                                                                                                                                                                                                                            This policy setting allows you to manage the XML output functionality of the Internet Explorer Site Discovery Toolkit.
    If you enable this policy setting, the Internet Explorer Site Discovery Toolkit will log its collected data to an XML file, stored in your specified location.
    If you disable or don’t configure this setting, the Internet Explorer Site Discovery Toolkit won’t log its collected data to an XML file.
    **Note:**
    Enabling or disabling this setting won’t impact any other output methods available to the Internet Explorer Site Discovery Toolkit.                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+|                               Use the Enterprise Mode IE website list                               |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               Administrative Templates\Windows Components\Internet Explorer                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |      IE11 on Windows 10, version 1511      |                                                                                                                                                                                                                                                                                                                                                                 This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode, instead of Standard mode, because of compatibility issues. Users can’t edit this list.
    If you enable this policy setting, Internet Explorer downloads the Enterprise Mode website list from the `HKEY_CURRENT_USER or HKEY_LOCAL_MACHINE`\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode hive, opening all included websites using Enterprise Mode. We recommend storing and downloading your list from a secure web server `(https://)`, to help protect against data tampering.
    If you disable or don’t configure this policy setting, Internet Explorer opens all websites using **Standard** mode.                                                                                                                                                                                                                                                                                                                                                                 |
 
 ## Removed Group Policy settings
 IE11 no longer supports these Group Policy settings:
 
--   Turn on Internet Explorer 7 Standards Mode
+-   Turn on Internet Explorer 7 Standards Mode
 
 -   Turn off Compatibility View button
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md
index a834636814..5591606f32 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md
@@ -3,10 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: Use out-of-date ActiveX control blocking to help you know when IE prevents a webpage from loading outdated ActiveX controls and to update the outdated control, so that it’s safer to use.
-author: shortpatti
-ms.author: pashort
+author: dansimp
+ms.author: dansimp
 ms.prod: ie11
 ms.assetid: e61866bb-1ff1-4a8d-96f2-61d3534e8199
+ms.reviewer: 
+audience: itpro
+manager: dansimp
 title: Out-of-date ActiveX control blocking (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 05/10/2018
@@ -189,15 +192,15 @@ Before running the PowerShell script, you must copy both the .ps1 and .mof file
 
  **To configure IE to use WMI logging**
 
-1.  Open your Group Policy editor and turn on the `Administrative Templates\Windows Components\Internet Explorer\Turn on ActiveX control logging in IE` setting.
+1. Open your Group Policy editor and turn on the `Administrative Templates\Windows Components\Internet Explorer\Turn on ActiveX control logging in IE` setting.
 
-2.  On the client device, start PowerShell in elevated mode (using admin privileges) and run `ConfigureWMILogging.ps1` by by-passing the PowerShell execution policy, using this command:
-```
-powershell –ExecutionPolicy Bypass .\ConfigureWMILogging.ps1
-``` 
-For more info, see [about_Execution_Policies](https://go.microsoft.com/fwlink/p/?linkid=517460).
+2. On the client device, start PowerShell in elevated mode (using admin privileges) and run `ConfigureWMILogging.ps1` by by-passing the PowerShell execution policy, using this command:
+   ```
+   powershell –ExecutionPolicy Bypass .\ConfigureWMILogging.ps1
+   ``` 
+   For more info, see [about_Execution_Policies](https://go.microsoft.com/fwlink/p/?linkid=517460).
 
-3.  **Optional:** Set up your domain firewall for WMI data. For more info, see [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md).
+3. **Optional:** Set up your domain firewall for WMI data. For more info, see [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md).
 
 The inventory info appears in the WMI class, `IEAXControlBlockingAuditInfo`, located in the WMI namespace, *root\\cimv2\\IETelemetry*. To collect the inventory info from your client computers, we recommend using System Center 2012 R2 Configuration Manager or any agent that can access the WMI data. For more info, see [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md).
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md
index 9e8959e2a9..80a59c9305 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/problems-after-installing-ie11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: support
 description: Possible solutions to the problems you might encounter after installing IE11, such as crashing or seeming slow, getting into an unusable state, or problems with adaptive streaming and DRM playback.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: c4b75ad3-9c4a-4dd2-9fed-69f776f542e6
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Problems after installing Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 10/16/2017
@@ -42,29 +46,29 @@ If you notice that CPU usage is running higher than normal, or that IE is freque
 
  **To check your browser add-ons**
 
-1.  Start IE11 in **No Add-ons mode** by running the **Run** command from the **Start** menu, and then typing `iexplore.exe -extoff` into the box.
+1. Start IE11 in **No Add-ons mode** by running the **Run** command from the **Start** menu, and then typing `iexplore.exe -extoff` into the box.
 
-2.  Check if IE still crashes.
    
-If the browser doesn't crash, open Internet Explorer for the desktop, click the **Tools** menu, and click **Manage Add-ons**.
+2. Check if IE still crashes.
    
+   If the browser doesn't crash, open Internet Explorer for the desktop, click the **Tools** menu, and click **Manage Add-ons**.
 
-3.  Click **Toolbars and Extensions**, click each toolbar or extension, clicking **Disable** to turn off all of the browser extensions and toolbars.
+3. Click **Toolbars and Extensions**, click each toolbar or extension, clicking **Disable** to turn off all of the browser extensions and toolbars.
 
-4.  Restart IE11. Go back to the **Manage Add-Ons** window and turn on each item, one-by-one.
    
-After you turn each item back on, see if IE crashes or slows down. Doing it this way will help you identify the add-on that's causing IE to crash. After you've figured out which add-on was causing the problem, turn it off until you have an update from the manufacturer.
+4. Restart IE11. Go back to the **Manage Add-Ons** window and turn on each item, one-by-one.
    
+   After you turn each item back on, see if IE crashes or slows down. Doing it this way will help you identify the add-on that's causing IE to crash. After you've figured out which add-on was causing the problem, turn it off until you have an update from the manufacturer.
 
- **To check for Software Rendering mode**
+   **To check for Software Rendering mode**
 
-1.  Open Internet Explorer for the desktop, click the **Tools** menu, and then click **Internet Options**.
+5. Open Internet Explorer for the desktop, click the **Tools** menu, and then click **Internet Options**.
 
-2.  On the **Advanced** tab, go to the **Accelerated graphics** section, and then turn on Software Rendering mode by choosing the **Use software rendering instead of GPU rendering** box.
    
-If the **Use software rendering instead of GPU rendering** option is greyed out, it means that your current video card or video driver doesn't support GPU hardware acceleration. For more information, see [Windows 10 Support](https://go.microsoft.com/fwlink/?LinkId=746588).
+6. On the **Advanced** tab, go to the **Accelerated graphics** section, and then turn on Software Rendering mode by choosing the **Use software rendering instead of GPU rendering** box.
    
+   If the **Use software rendering instead of GPU rendering** option is greyed out, it means that your current video card or video driver doesn't support GPU hardware acceleration. For more information, see [Windows 10 Support](https://go.microsoft.com/fwlink/?LinkId=746588).
 
 ## Adaptive streaming and DRM playback don’t work with Windows Server 2012 R2
 IE11 in Windows Server 2012 R2 doesn’t include media features like adaptive streaming or Digital Rights Management (DRM) playback. To add these features, you’ll need to download and install the Media Feature Pack from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=320789), as well as an app that uses PlayReady DRM from the Microsoft Store, such as the Xbox Music app or Xbox Video app. The app must be installed to specifically turn on DRM features, while all other media features are installed with the Media Feature Pack.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
index e63c2475a6..df8a2b1707 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/remove-all-sites-from-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Instructions about how to clear all of the sites from your global Enterprise Mode site list.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 90f38a6c-e0e2-4c93-9a9e-c425eca99e97
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Remove all sites from your Enterprise Mode site list using the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -37,9 +41,9 @@ This is a permanent removal and erases everything. However, if you determine it
 - [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853)
 - [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378)
 - [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md)
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md
index 5037f6fe3c..4995a12e9a 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-compatibililty-view-list.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Instructions about how to remove sites from a local compatibility view list.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: f6ecaa75-ebcb-4f8d-8721-4cd6e73c0ac9
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Remove sites from a local compatibility view list (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md
index 05a2e285bb..c9b859509b 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/remove-sites-from-a-local-enterprise-mode-site-list.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Instructions about how to remove sites from a local Enterprise Mode site list.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: c7d6dd0b-e264-42bb-8c9d-ac2f837018d2
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Remove sites from a local Enterprise Mode site list (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md
index d6bba6d3d8..28b18117e1 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/save-your-site-list-to-xml-in-the-enterprise-mode-site-list-manager.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: You can save your current Enterprise Mode compatibility site list as an XML file, for distribution and use by your managed systems.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 254a986b-494f-4316-92c1-b089ee8b3e0a
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Save your site list to XML in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md
index 06af735490..4565b9f0c1 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/schedule-production-change-enterprise-mode-portal.md
@@ -3,11 +3,15 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Details about how Administrators can schedule approved change requests for production in the Enterprise Mode Site List Portal.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 title: Schedule approved change requests for production using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
+ms.reviewer: 
+audience: itprom
+manager: dansimp
+ms.author: dansimp
 ---
 
 # Schedule approved change requests for production using the Enterprise Mode Site List Portal
@@ -47,4 +51,4 @@ After a change request is approved, the original Requester can schedule the chan
 
 
 ## Next steps
-After the update to the production environment completes, the Requester must again test the change. If the testing succeeds, the Requester can sign off on the change request. If the testing fails, the Requester can contact the Administrator group for more help. For the production environment testing steps, see the [Verify the change request update in the production environment using the Enterprise Mode Site List Portal](verify-changes-production-enterprise-mode-portal.md) topic.
\ No newline at end of file
+After the update to the production environment completes, the Requester must again test the change. If the testing succeeds, the Requester can sign off on the change request. If the testing fails, the Requester can contact the Administrator group for more help. For the production environment testing steps, see the [Verify the change request update in the production environment using the Enterprise Mode Site List Portal](verify-changes-production-enterprise-mode-portal.md) topic.
diff --git a/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
index d4ac172352..bc468576ed 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/search-your-enterprise-mode-site-list-in-the-enterprise-mode-site-list-manager.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Search to see if a specific site already appears in your global Enterprise Mode site list.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: e399aeaf-6c3b-4cad-93c9-813df6ad47f9
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Search your Enterprise Mode site list in the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -26,16 +30,16 @@ You can search to see if a specific site already appears in your global Enterpri
 
  **To search your compatibility list**
 
--   From the Enterprise Mode Site List Manager, type part of the URL into the **Search** box.
    
-The search query searches all of the text. For example, entering *“micro”* will return results like, www.microsoft.com, microsoft.com, and microsoft.com/images. Wildcard characters aren’t supported.
+- From the Enterprise Mode Site List Manager, type part of the URL into the **Search** box.
    
+  The search query searches all of the text. For example, entering *“micro”* will return results like, www.microsoft.com, microsoft.com, and microsoft.com/images. Wildcard characters aren’t supported.
 
 ## Related topics
 - [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853)
 - [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378)
 - [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md)
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md
index 896d0512a7..b6c1af8258 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: Use the Group Policy setting, Set a default associations configuration file, to set the default browser for your company devices running Windows 10.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: f486c9db-0dc9-4cd6-8a0b-8cb872b1d361
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Set the default browser using Group Policy (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md
index a72a457d0a..fd55a40ebd 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Set up and turn on Enterprise Mode logging and data collection in your organization.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 2e98a280-f677-422f-ba2e-f670362afcde
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Set up Enterprise Mode logging and data collection (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -37,33 +41,33 @@ When you turn logging on, you need a valid URL that points to a server that can
 
  **To set up an endpoint server**
 
-1.  Configure an IIS server to work with your Enterprise Mode data collection process. If you’re unsure how to set up IIS, see the [IIS installation webpage](https://go.microsoft.com/fwlink/p/?LinkId=507609).
+1. Configure an IIS server to work with your Enterprise Mode data collection process. If you’re unsure how to set up IIS, see the [IIS installation webpage](https://go.microsoft.com/fwlink/p/?LinkId=507609).
 
-2.  Open Internet Information Services (IIS) and turn on the ASP components from the **Add Roles and Features Wizard**, **Server Roles** page.
    
-This lets you create an ASP form that accepts the incoming POST messages.
+2. Open Internet Information Services (IIS) and turn on the ASP components from the **Add Roles and Features Wizard**, **Server Roles** page.
    
+   This lets you create an ASP form that accepts the incoming POST messages.
 
-3.  Open the Internet Information Services (IIS) Manager, click **Bindings**, highlight **Port 81**, click **Edit**, and then change the website information to point to Port 81 so it matches your custom-created port.
+3. Open the Internet Information Services (IIS) Manager, click **Bindings**, highlight **Port 81**, click **Edit**, and then change the website information to point to Port 81 so it matches your custom-created port.
 
-    ![IIS Manager, editing website bindings](images/ie-emie-editbindings.png)
+   ![IIS Manager, editing website bindings](images/ie-emie-editbindings.png)
 
-4.  Open the **Logging** feature, pick **W3C** for the format, and click **Select Fields** to open the **W3C Logging Fields** box.
+4. Open the **Logging** feature, pick **W3C** for the format, and click **Select Fields** to open the **W3C Logging Fields** box.
 
-    ![IIS Manager, setting logging options](images/ie-emie-logging.png)
+   ![IIS Manager, setting logging options](images/ie-emie-logging.png)
 
-5.  Change the WC3 logging fields to include only the **Date**, **Client IP**, **User Name**, and **URI Query** standard fields, and then click **OK**.
    
-Using only these fields keeps the log file simple, giving you the date, client IP address, and the website URI information for any site changed by your users.
+5. Change the WC3 logging fields to include only the **Date**, **Client IP**, **User Name**, and **URI Query** standard fields, and then click **OK**.
    
+   Using only these fields keeps the log file simple, giving you the date, client IP address, and the website URI information for any site changed by your users.
 
-6.  Apply these changes to your default website and close the IIS Manager.
+6. Apply these changes to your default website and close the IIS Manager.
 
-7.  Put your EmIE.asp file into the root of the web server, using this command:
+7. Put your EmIE.asp file into the root of the web server, using this command:
 
    ``` 
-    <% @ LANGUAGE=javascript %>
-    <%
-    Response.AppendToLog(" ;" + Request.Form("URL") + " ;" + Request.Form("EnterpriseMode"));
-    %>
-    ```
-This code logs your POST fields to your IIS log file, where you can review all of the collected data.
+   <% @ LANGUAGE=javascript %>
+   <%
+   Response.AppendToLog(" ;" + Request.Form("URL") + " ;" + Request.Form("EnterpriseMode"));
+   %>
+   ```
+   This code logs your POST fields to your IIS log file, where you can review all of the collected data.
 
 
 ### IIS log file information
@@ -83,47 +87,47 @@ For logging, you’re going to need a valid URL that points to a server that can
 
  **To set up the sample**
 
-1.  Set up a server to collect your Enterprise Mode information from your users.
+1. Set up a server to collect your Enterprise Mode information from your users.
 
-2.  Go to the Internet Explorer/[EMIE-Data_Collection_Sample](https://go.microsoft.com/fwlink/p/?LinkId=507401) page on GitHub and tap or click the **Download ZIP** button to download the complete project.
+2. Go to the Internet Explorer/[EMIE-Data_Collection_Sample](https://go.microsoft.com/fwlink/p/?LinkId=507401) page on GitHub and tap or click the **Download ZIP** button to download the complete project.
 
-3.  Open Microsoft Visual Studio 2013 with Update 2, and then open the PhoneHomeSample.sln file.
+3. Open Microsoft Visual Studio 2013 with Update 2, and then open the PhoneHomeSample.sln file.
 
-4.  On the **Build** menu, tap or click **Build Solution**.
    
-The required packages are automatically downloaded and included in the solution.
+4. On the **Build** menu, tap or click **Build Solution**.
    
+   The required packages are automatically downloaded and included in the solution.
 
- **To set up your endpoint server**
+   **To set up your endpoint server**
 
-1.  Right-click on the name, PhoneHomeSample, and click **Publish**.
+5. Right-click on the name, PhoneHomeSample, and click **Publish**.
 
-    ![Visual Studio, Publish menu](images/ie-emie-publishsolution.png)
+   ![Visual Studio, Publish menu](images/ie-emie-publishsolution.png)
 
-2.  In the **Publish Web** wizard, pick the publishing target and options that work for your organization.
+6. In the **Publish Web** wizard, pick the publishing target and options that work for your organization.
 
    **Important**
    
    Make sure you have a database associated with your publishing target. Otherwise, your reports won’t be collected and you’ll have problems deploying the website. 
 
-    ![Visual Studio, Publish Web wizard](images/ie-emie-publishweb.png)
+   ![Visual Studio, Publish Web wizard](images/ie-emie-publishweb.png)
 
    After you finish the publishing process, you need to test to make sure the app deployed successfully.
 
- **To test, deploy, and use the app**
+   **To test, deploy, and use the app**
 
-1.  Open a registry editor on the computer where you deployed the app, go to the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode` key, and change the **Enable** string to:
+7. Open a registry editor on the computer where you deployed the app, go to the `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode` key, and change the **Enable** string to:
 
-    ``` "Enable"="https:///api/records/"
-    ```
- Where `` points to your deployment URL.
+   ``` "Enable"="https:///api/records/"
+   ```
+   Where `` points to your deployment URL.
 
-2.  After you’re sure your deployment works, you can deploy it to your users using one of the following:
+8. After you’re sure your deployment works, you can deploy it to your users using one of the following:
 
-    -   Turn on the **Let users turn on and use Enterprise Mode from the Tools menu** Group Policy setting, putting your `` information into the **Options** box.
+   -   Turn on the **Let users turn on and use Enterprise Mode from the Tools menu** Group Policy setting, putting your `` information into the **Options** box.
 
-    -   Deploy the registry key in Step 3 using System Center or other management software.
+   -   Deploy the registry key in Step 3 using System Center or other management software.
 
-3.  Get your users to visit websites, turning Enterprise Mode on or off locally, as necessary.
+9. Get your users to visit websites, turning Enterprise Mode on or off locally, as necessary.
 
- **To view the report results**
+   **To view the report results**
 
 -   Go to `https:///List` to see the report results.
    
 If you’re already on the webpage, you’ll need to refresh the page to see the results.
@@ -149,9 +153,9 @@ You may need to do some additional package cleanup to remove older package versi
 - [What is Enterprise Mode?](what-is-enterprise-mode.md)
 - [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md)
 - [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md)
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md
index 47c4caf92b..e63d79527c 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-portal.md
@@ -3,11 +3,15 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Details about how to set up the Enterprise Mode Site List Portal for your organization.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 title: Set up the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 ---
 
 # Set up the Enterprise Mode Site List Portal
@@ -43,7 +47,10 @@ You must download the deployment folder (**EMIEWebPortal/**), which includes all
 
    Installs the npm package manager and bulk adds all the third-party libraries back into your codebase.
 
-6. Go back up a directory, open the solution file **EMIEWebPortal.sln** in Visual Studio, and then build the entire solution.
+6. Go back up a directory, open the solution file **EMIEWebPortal.sln** in Visual Studio, open **Web.config** from **EMIEWebPortal/** folder, and replace MSIT-LOB-COMPAT with your server name hosting your database, replace LOBMerged with your database name, and build the entire solution.
+
+      >[!Note]
+      >Step 3 of this topic provides the steps to create your database.
 
 7. Copy the contents of the **EMIEWebPortal/** folder to a dedicated folder on your file system. For example, _D:\EMIEWebApp_. In a later step, you'll designate this folder as your website in the IIS Manager.
 
@@ -105,17 +112,6 @@ Create a new Application Pool and the website, by using the IIS Manager.
     >[!Note]
     >You must also make sure that **Anonymous Authentication** is marked as **Enabled**.
 
-10. Return to the **<website_name> Home** pane, and double-click the **Connection Strings** icon.
-
-11. Open the **LOBMergedEntities Connection String** to edit: 
-
-    - **Data source.** Type the name of your local computer.
-
-    - **Initial catalog.** The name of your database.
-
-        >[!Note]
-        >Step 3 of this topic provides the steps to create your database.
-
 ## Step 3 - Create and prep your database
 Create a SQL Server database and run our custom query to create the Enterprise Mode Site List tables.
 
@@ -229,4 +225,4 @@ Register the EMIEScheduler tool and service for production site list changes.
 
 - [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md)
 
-- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) 
\ No newline at end of file
+- [Use the Enterprise Mode Site List Manager tool or page](use-the-enterprise-mode-site-list-manager.md) 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md
index 55f9bcfe0a..7dd3e837c0 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/setup-problems-with-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: support
 ms.pagetype: appcompat
 description: Reviewing log files to learn more about potential setup problems with Internet Explorer 11.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 2cd79988-17d1-4317-bee9-b3ae2dd110a0
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Setup problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md
index 212f8f717a..a8953ad3f4 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/system-requirements-and-language-support-for-ie11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Lists the minimum system requirements and supported languages for Internet Explorer 11.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 27185e3d-c486-4e4a-9c51-5cb317c0006d
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: System requirements and language support for Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -31,16 +35,16 @@ IE11 isn't supported on Windows 8 or Windows Server 2012.
 
 Some of the components in this table might also need additional system resources. Check the component's documentation for more information.
 
-|Item                        |Minimum requirements                                    |
-|----------------------------|--------------------------------------------------------|
-|Computer/processor          |1 gigahertz (GHz) 32-bit (x86) or 64-bit (x64)          |
-|Operating system            |
    • Windows 10 (32-bit or 64-bit)
    • Windows 8.1 Update (32-bit or 64-bit)
    • Windows 7 with SP1 (32-bit or 64-bit)
    • Windows Server 2012 R2
    • Windows Server 2008 R2 with SP1 (64-bit only)
     |
-|Memory            |
    • Windows 10 (32-bit)-1 GB
    • Windows 10 (64-bit)-2 GB
    • Windows 8.1 Update (32-bit)-1 GB
    • Windows 8.1 Update (64-bit)-2 GB
    • Windows 7 with SP1 (32-bit or 64-bit)-512 MB
    • Windows Server 2012 R2-512 MB
    • Windows Server 2008 R2 with SP1 (64-bit only)-512 MB
     |
-|Hard drive space            |
    • Windows 10 (32-bit)-16 GB
    • Windows 10 (64-bit)-20 GB
    • Windows 8.1 Update (32-bit)-16 GB
    • Windows 8.1 Update (64-bit)-20 GB
    • Windows 7 with SP1 (32-bit)-70 MB
    • Windows 7 with SP1 (64-bit)-120 MB
    • Windows Server 2012 R2-32 GB
    • Windows Server 2008 R2 with SP1 (64-bit only)-200 MB
        •  |
-|Drive                       |CD-ROM drive (if installing from a CD-ROM) |
-|Display                     |Super VGA (800 x 600) or higher-resolution monitor with 256 colors |
-|Peripherals                 |Internet connection and a compatible pointing device               |
 
+|        Item        |                                                                                                                                                                  Minimum requirements                                                                                                                                                                   |
+|--------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Computer/processor |                                                                                                                                                     1 gigahertz (GHz) 32-bit (x86) or 64-bit (x64)                                                                                                                                                      |
+|  Operating system  |                                                            
        • Windows 10 (32-bit or 64-bit)
        • Windows 8.1 Update (32-bit or 64-bit)
        • Windows 7 with SP1 (32-bit or 64-bit)
        • Windows Server 2012 R2
        • Windows Server 2008 R2 with SP1 (64-bit only)
                                                                     |
+|       Memory       |                  
        • Windows 10 (32-bit)-1 GB
        • Windows 10 (64-bit)-2 GB
        • Windows 8.1 Update (32-bit)-1 GB
        • Windows 8.1 Update (64-bit)-2 GB
        • Windows 7 with SP1 (32-bit or 64-bit)-512 MB
        • Windows Server 2012 R2-512 MB
        • Windows Server 2008 R2 with SP1 (64-bit only)-512 MB
                          |
+|  Hard drive space  | 
        • Windows 10 (32-bit)-16 GB
        • Windows 10 (64-bit)-20 GB
        • Windows 8.1 Update (32-bit)-16 GB
        • Windows 8.1 Update (64-bit)-20 GB
        • Windows 7 with SP1 (32-bit)-70 MB
        • Windows 7 with SP1 (64-bit)-120 MB
        • Windows Server 2012 R2-32 GB
        • Windows Server 2008 R2 with SP1 (64-bit only)-200 MB
            •  |
+|       Drive        |                                                                                                                                                       CD-ROM drive (if installing from a CD-ROM)                                                                                                                                                        |
+|      Display       |                                                                                                                                           Super VGA (800 x 600) or higher-resolution monitor with 256 colors                                                                                                                                            |
+|    Peripherals     |                                                                                                                                                  Internet connection and a compatible pointing device                                                                                                                                                   |
 
 ## Support for .NET Framework
 You might experience start up issues where IE11 fails to launch an application that uses managed browser hosting controls with your legacy apps. This is because, starting with Internet Explorer 10, the browser started blocking legacy apps from using the .NET Framework 1.1 and 2.0. To fix this problem, see [.NET Framework problems with Internet Explorer 11](net-framework-problems-with-ie11.md).
@@ -50,9 +54,9 @@ IE11 is available in 108 languages for Windows 8.1 and Windows 10 and in 97 lan
 
 Computers running localized versions of Windows should run the same version of IE11. For example, if your employees use the Spanish edition of Windows, you should deploy the Spanish version of IE11. On the other hand, if your employees use multiple localized versions of Windows, like Spanish, French, and Catalan, you should install IE11 in one of the languages, and then install language packs for the others.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md
index de391cfd69..c5a68132d8 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md
@@ -3,10 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Find out how to achieve better backward compatibility for your legacy web applications with the Enterprise Mode Site List.
-author: shortpatti
-ms.author: pashort
+author: dansimp
+ms.author: dansimp
 ms.prod: ie11
 ms.assetid: 
+ms.reviewer: 
+audience: itpro
+manager: dansimp
 title: Tips and tricks to manage Internet Explorer compatibility
 ms.sitesec: library
 ms.date: 05/10/2018
@@ -125,9 +128,9 @@ We recommend that enterprise customers focus their new development on establishe
 - [Document modes](https://msdn.microsoft.com/library/dn384051(v=vs.85).aspx)
 - [What is Enterprise Mode?](what-is-enterprise-mode.md)
 - [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md)
-- [Enterprise Site Discovery Toolkit](https://www.microsoft.com/en-us/download/details.aspx?id=44570)
+- [Enterprise Site Discovery Toolkit](https://www.microsoft.com/download/details.aspx?id=44570)
 - [Collect data using Enterprise Site Discovery](collect-data-using-enterprise-site-discovery.md)
 - [Download the Enterprise Mode Site List Manager (schema v.2)](https://go.microsoft.com/fwlink/p/?LinkId=716853)
 - [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378)
 - [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md)
-- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md)
\ No newline at end of file
+- [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md)
diff --git a/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md
index 7e28e38f9f..39d999c947 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/troubleshoot-ie11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: support
 description: Use the topics in this section to learn how to troubleshoot several of the more common problems experienced with Internet Explorer.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 0361c1a6-3faa-42b2-a588-92439eebeeab
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Troubleshoot Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md
index 53ac1a4017..1df0d6b95e 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/turn-off-enterprise-mode.md
@@ -2,10 +2,14 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
-description: How to turn Enteprrise Mode off temporarily while testing websites and how to turn it off completely if you no longer want to to use it.
-author: shortpatti
+description: How to turn Enterprise Mode off temporarily while testing websites and how to turn it off completely if you no longer want to to use it.
+author: dansimp
 ms.prod: ie11
 ms.assetid: 5027c163-71e0-49b8-9dc0-f0a7310c7ae3
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Turn off Enterprise Mode (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -29,49 +33,49 @@ In addition, if you no longer want your users to be able to turn Enterprise Mode
 **Important**
            
 Turning off both of these features turns off Enterprise Mode for your company. Turning off Enterprise Mode also causes any websites included in your employee’s manual site lists to not appear in Enterprise Mode.
 
-  **To turn off the site list using Group Policy**
+  **To turn off the site list using Group Policy**
 
-1.  Open your Group Policy editor, like Group Policy Management Console (GPMC).
+1. Open your Group Policy editor, like Group Policy Management Console (GPMC).
 
-2.  Go to the **Use the Enterprise Mode IE website list** setting, and then click **Disabled**.
            
-Enterprise Mode will no longer look for the site list, effectively turning off Enterprise Mode. However, if you previously turned on local control for your employees, Enterprise Mode will still be available from the **Tools** menu. You need to turn that part of the functionality off separately.
+2. Go to the **Use the Enterprise Mode IE website list** setting, and then click **Disabled**.
            
+   Enterprise Mode will no longer look for the site list, effectively turning off Enterprise Mode. However, if you previously turned on local control for your employees, Enterprise Mode will still be available from the **Tools** menu. You need to turn that part of the functionality off separately.
 
- **To turn off local control using Group Policy**
+   **To turn off local control using Group Policy**
 
-1.  Open your Group Policy editor, like Group Policy Management Console (GPMC).
+3. Open your Group Policy editor, like Group Policy Management Console (GPMC).
 
-2.  Go to the **Let users turn on and use Enterprise Mode from the Tools menu** setting, and then click **Disable**.
+4. Go to the **Let users turn on and use Enterprise Mode from the Tools menu** setting, and then click **Disable**.
 
-3.  Enterprise Mode no longer shows up on the **Tools** menu for your employees. However, if you are still using an Enterprise Mode site list, all of the globally listed sites will still appear in Enterprise Mode. If you want to turn off all of Enterprise Mode, you will need to also turn off the site list functionality.
+5. Enterprise Mode no longer shows up on the **Tools** menu for your employees. However, if you are still using an Enterprise Mode site list, all of the globally listed sites will still appear in Enterprise Mode. If you want to turn off all of Enterprise Mode, you will need to also turn off the site list functionality.
 
- **To turn off the site list using the registry**
+   **To turn off the site list using the registry**
 
-1.  Open a registry editor, such as regedit.exe.
+6. Open a registry editor, such as regedit.exe.
 
-2.  Go to `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode`, and then delete the **SiteList** value.
            
-You can also use HKEY_LOCAL_MACHINE, depending whether you want to turn off the Enterprise Mode site list for users or for computers.
+7. Go to `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\EnterpriseMode`, and then delete the **SiteList** value.
            
+   You can also use HKEY_LOCAL_MACHINE, depending whether you want to turn off the Enterprise Mode site list for users or for computers.
 
-3.  Close all and restart all instances of Internet Explorer.
            
-IE11 stops looking at the site list for rendering instructions. However, Enterprise Mode is still available to your users locally (if it was turned on).
+8. Close all and restart all instances of Internet Explorer.
            
+   IE11 stops looking at the site list for rendering instructions. However, Enterprise Mode is still available to your users locally (if it was turned on).
 
- **To turn off local control using the registry**
+   **To turn off local control using the registry**
 
-1.  Open a registry editor, such as regedit.exe.
+9. Open a registry editor, such as regedit.exe.
 
-2.  Go `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`, and then delete the **Enable** value.
            
-You can also use HKEY_CURRENT_USER, depending whether you want to turn off Enterprise Mode for users or for computers.
+10. Go `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`, and then delete the **Enable** value.
            
+    You can also use HKEY_CURRENT_USER, depending whether you want to turn off Enterprise Mode for users or for computers.
 
-3.  Close and restart all instances of IE.
            
-Enterprise Mode is no longer a user option on the **Tools** menu in IE11. However, IE11 still looks at the site list (if it was turned on).
+11. Close and restart all instances of IE.
            
+    Enterprise Mode is no longer a user option on the **Tools** menu in IE11. However, IE11 still looks at the site list (if it was turned on).
 
 ## Related topics
 - [What is Enterprise Mode?](what-is-enterprise-mode.md)
 - [Turn on Enterprise Mode and use a site list](turn-on-enterprise-mode-and-use-a-site-list.md)
 - [Turn on local control and logging for Enterprise Mode](turn-on-local-control-and-logging-for-enterprise-mode.md)
 - [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md)
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md b/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md
index c98c3e7c5b..90442b3bbc 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/turn-off-natural-metrics.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: support
 description: Turn off natural metrics for Internet Explorer 11
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: e31a27d7-662e-4106-a3d2-c6b0531961d5
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Fix font rendering problems by turning off natural metrics (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -20,15 +24,15 @@ However, you might find that many intranet sites need you to use Windows Graphic
 
 -   Add the following HTTP header to each site: `X-UA-TextLayoutMetrics: gdi`
 
-
            **-OR-**
            
+
            -OR-
            
 
 - Add the following <meta> tag to each site: ``
 
 Turning off natural metrics automatically turns on GDI metrics.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md
index a46290559e..29c8de2486 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md
@@ -2,19 +2,17 @@
 title: Turn on Enterprise Mode and use a site list (Internet Explorer 11 for IT Pros)
 description: How to turn on Enterprise Mode and specify a site list.
 ms.assetid: 800e9c5a-57a6-4d61-a38a-4cb972d833e1
+ms.reviewer: 
+audience: itpro
+manager: dansimp
 ms.prod: ie11
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 ms.sitesec: library
-author: shortpatti
-ms.author: pashort
+author: dansimp
+ms.author: dansimp
 ms.date: 08/14/2017
 ms.localizationpriority: medium
-
-
-
-
-
 ---
 
 
@@ -35,28 +33,28 @@ Before you can use a site list with Enterprise Mode, you need to turn the functi
 
  **To turn on Enterprise Mode using Group Policy**
 
-1.  Open your Group Policy editor and go to the `Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list` setting.
            
-Turning this setting on also requires you to create and store a site list. For more information about creating your site list, see the [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics.
+1. Open your Group Policy editor and go to the `Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list` setting.
            
+   Turning this setting on also requires you to create and store a site list. For more information about creating your site list, see the [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics.
 
-    ![local group policy editor for using a site list](images/ie-emie-grouppolicysitelist.png)
+   ![local group policy editor for using a site list](images/ie-emie-grouppolicysitelist.png)
 
-2.  Click **Enabled**, and then in the **Options** area, type the location to your site list.
+2. Click **Enabled**, and then in the **Options** area, type the location to your site list.
 
- **To turn on Enterprise Mode using the registry**
+   **To turn on Enterprise Mode using the registry**
 
-1.  **For only the local user:** Open a registry editor, like regedit.exe and go to `HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`.
-
            -OR-
            
-**For all users on the device:** Open a registry editor, like regedit.exe and go to `HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`.
+3. **For only the local user:** Open a registry editor, like regedit.exe and go to `HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`.
+   
            -OR-
            
+   For all users on the device: Open a registry editor, like regedit.exe and go to HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode.
 
-2.  Edit the `SiteList` registry key to point to where you want to keep your Enterprise Mode site list file. For example:
+4. Edit the `SiteList` registry key to point to where you want to keep your Enterprise Mode site list file. For example:
 
-    ![enterprise mode with site list in the registry](images/ie-emie-registrysitelist.png)
+   ![enterprise mode with site list in the registry](images/ie-emie-registrysitelist.png)
 
-    -   **HTTPS location**: `"SiteList"="https://localhost:8080/sites.xml"`
+   -   **HTTPS location**: `"SiteList"="https://localhost:8080/sites.xml"`
 
-    -   **Local network:** `"SiteList"="\\network\shares\sites.xml"`
+   -   **Local network:** `"SiteList"="\\network\shares\sites.xml"`
 
-    -   **Local file:** `"SiteList"="file:///c:\\Users\\\\Documents\\testList.xml"`
+   -   **Local file:** `"SiteList"="file:///c:\\Users\\\\Documents\\testList.xml"`
     
    All of your managed devices must have access to this location if you want them to be able to access and use Enterprise Mode and your site list. For information about how to create and use an Enterprise Mode site list, see [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md).
 
@@ -65,9 +63,9 @@ Turning this setting on also requires you to create and store a site list. For m
 - [Download the Enterprise Mode Site List Manager (schema v.1)](https://go.microsoft.com/fwlink/p/?LinkID=394378)
 - [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md)
 - [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md)
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md
index ea9a56a081..1324c12963 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Turn on local user control and logging for Enterprise Mode.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 6622ecce-24b1-497e-894a-e1fd5a8a66d1
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Turn on local control and logging for Enterprise Mode (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -28,34 +32,34 @@ Besides turning on this feature, you also have the option to provide a URL for E
 
  **To turn on local control of Enterprise Mode using Group Policy**
 
-1.  Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting.
+1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting.
 
-    ![group policy editor with emie setting](images/ie-emie-editpolicy.png)
+   ![group policy editor with emie setting](images/ie-emie-editpolicy.png)
 
-2.  Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu.
+2. Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu.
 
- **To turn on local control of Enterprise Mode using the registry**
+   **To turn on local control of Enterprise Mode using the registry**
 
-1.  Open a registry editor, like regedit.exe and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`.
+3. Open a registry editor, like regedit.exe and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode`.
 
-2.  In the right pane, right-click and click **New**, click **String Value**, and then name the new value **Enable**.
+4. In the right pane, right-click and click **New**, click **String Value**, and then name the new value **Enable**.
 
-3.  Right-click the **Enable** key, click **Modify**, and then type a **Value data** to point to a server that you can listen to for updates.
+5. Right-click the **Enable** key, click **Modify**, and then type a **Value data** to point to a server that you can listen to for updates.
 
-    ![edit registry string for data collection location](images/ie-emie-editregistrystring.png)
+   ![edit registry string for data collection location](images/ie-emie-editregistrystring.png)
 
 Your **Value data** location can be any of the following types:
 
--   **URL location (like, https://www.emieposturl.com/api/records or https://localhost:13000)**. IE sends a POST message to the URL every time a change is made to Enterprise Mode from the **Tools** menu.
            **Important**
            
-The `https://www.emieposturl.com/api/records` example will only work if you’ve downloaded the sample discussed in the [Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md) topic. If you don’t have the sample, you won’t have the web API.
--   **Local network location (like, https://*emieposturl*/)**. IE sends a POST message to your specified local network location every time a change is made to Enterprise Mode from the **Tools** menu.
--   **Empty string**. If you leave the **Value data** box blank; your employees will be able to turn Enterprise Mode on and off from the **Tools** menu, but you won’t collect any logging data.
+- **URL location (like, https://www.emieposturl.com/api/records or https://localhost:13000)**. IE sends a POST message to the URL every time a change is made to Enterprise Mode from the **Tools** menu.
            **Important**
            
+  The `https://www.emieposturl.com/api/records` example will only work if you’ve downloaded the sample discussed in the [Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md) topic. If you don’t have the sample, you won’t have the web API.
+- **Local network location (like, https://emieposturl/)**. IE sends a POST message to your specified local network location every time a change is made to Enterprise Mode from the **Tools** menu.
+- **Empty string**. If you leave the **Value data** box blank; your employees will be able to turn Enterprise Mode on and off from the **Tools** menu, but you won’t collect any logging data.
 
 For information about how to collect the data provided when your employees turn Enterprise Mode on or off from the **Tools** menu, see [Set up Enterprise Mode logging and data collection](set-up-enterprise-mode-logging-and-data-collection.md).
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md
index 2d64e28d56..446375289c 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/updated-features-and-tools-with-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: High-level info about some of the new and updated features for Internet Explorer 11.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: f53c6f04-7c60-40e7-9fc5-312220f08156
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: List of updated features and tools - Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md
index 0da4b5a228..c26e39ddcc 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-portal.md
@@ -7,6 +7,11 @@ ms.prod: ie11
 title: Use the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
+ms.reviewer: dansimp
+audience: itpro
+manager: dansimp
+ms.author: dansimp
+author: dansimp
 ---
 
 # Use the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md
index 9abbcb8a09..58ffc300ce 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Use the topics in this section to learn about how to use the Enterprise Mode Site List Manager.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: f4dbed4c-08ff-40b1-ab3f-60d3b6e8ec9b
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Enterprise Mode Site List Manager (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 12/04/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md
index 907b26056e..3a1f3b4596 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/user-interface-problems-with-ie11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: support
 description: Info about where features went in the IEAK11, where the Favorites, Command, and Status bars went, and where the search bar went.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 7324faff-ccb6-4e14-ad91-af12dbca575e
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: User interface problems with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -29,15 +33,15 @@ For IE11, the UI has been changed to provide just the controls needed to support
 
  **To turn the toolbars back on**
 
--   Right click in the IE toolbar heading and choose to turn on the **Command bar**, **Favorites bar**, and **Status bar** from the menu.
-
            -OR-
            
-In IE, press **ALT+V** to show the **View** menu, press **T** to enter the **Toolbars** menu, and then press:
+- Right click in the IE toolbar heading and choose to turn on the **Command bar**, **Favorites bar**, and **Status bar** from the menu.
+  
            -OR-
            
+  In IE, press ALT+V to show the View menu, press T to enter the Toolbars menu, and then press:
 
-    -   **C** to turn on the **Command Bar**
+  -   **C** to turn on the **Command Bar**
 
-    -   **F** to turn on the **Favorites Bar**
+  -   **F** to turn on the **Favorites Bar**
 
-    -   **S** to turn on the **Status Bar**
+  -   **S** to turn on the **Status Bar**
 
 ## Where did the search box go?
 IE11 uses the **One Box** feature, which lets users type search terms directly into the **Address bar**. Any text entered into the **Address bar** that doesn't appear to be a URL is automatically sent to the currently selected search provider.
@@ -45,11 +49,11 @@ IE11 uses the **One Box** feature, which lets users type search terms directly i
 >[!NOTE]
 >Depending on how you've set up your intranet search, the text entry might resolve to an intranet site. For more information about this, see  [Intranet problems with Internet Explorer 11](intranet-problems-and-ie11.md).
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md
index 14c7b096ac..6bff79cc82 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/using-enterprise-mode.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: security
 description: Use this section to learn about how to turn on and use IE7 Enterprise Mode or IE8 Enterprise Mode.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 238ead3d-8920-429a-ac23-02f089c4384a
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Using IE7 Enterprise Mode or IE8 Enterprise Mode (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md
index f4d86e9b12..710c69e3cb 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/using-ieak11-to-create-install-packages.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use IEAK 11 while planning, customizing, and building the custom installation package.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: af93742f-f955-44ab-bfa2-7bf0c99045d3
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Using Internet Explorer Administration Kit 11 (IEAK 11) to create packages (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md b/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md
index 1ccb850f60..1f7b62dfa5 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/using-inf-files-to-create-install-packages.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use Setup Information (.inf) files to create installation packages.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 04fa2ba8-8d84-4af6-ab99-77e4f1961b0e
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Using Setup Information (.inf) files to create packages (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -16,14 +20,14 @@ IEAK 11 uses Setup information (.inf) files to provide uninstallation instructi
 
  **To add uninstallation instructions to the .inf files**
 
--   Open the Registry Editor (regedit.exe) and add these registry keys:
-```
-HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"DisplayName",,"description"
-HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"UninstallString",,"command-line"
-```
-Where **"description"** is the name that shows up in the **Uninstall or change a program** box and **"command-line"** is the command that runs after the component is picked.
-
            **Note**
            
-Make sure your script removes the uninstallation registry key, too. Otherwise, the component name will continue to show up in the **Uninstall or change a program**.
+- Open the Registry Editor (regedit.exe) and add these registry keys:
+  ```
+  HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"DisplayName",,"description"
+  HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\app-name,"UninstallString",,"command-line"
+  ```
+  Where **"description"** is the name that shows up in the **Uninstall or change a program** box and **"command-line"** is the command that runs after the component is picked.
+  
            Note
            
+  Make sure your script removes the uninstallation registry key, too. Otherwise, the component name will continue to show up in the Uninstall or change a program.
 
 ## Limitations
 .Inf files have limitations:
@@ -34,9 +38,9 @@ Make sure your script removes the uninstallation registry key, too. Otherwise, t
 
 -   You can't use **CopyFiles** to copy a file to another place on your hard drive, it can only copy files from the source disk to the destination directory. For information, see [INF CopyFiles Directive](https://go.microsoft.com/fwlink/p/?LinkId=298510).
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md
index 3f67e92d70..8a161b2ffb 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-preprod-enterprise-mode-portal.md
@@ -3,11 +3,15 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Details about how to make sure your change request info is accurate within the pre-production environment of the Enterprise Mode Site List Portal.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 title: Verify your changes using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 ---
 
 # Verify your changes using the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md
index 66e6178858..42db6c85c5 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/verify-changes-production-enterprise-mode-portal.md
@@ -3,11 +3,15 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Details about how the Requester makes sure that the change request update is accurate within the production environment using the Enterprise Mode Site List Portal.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 title: Verify the change request update in the production environment using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 ---
 
 # Verify the change request update in the production environment using the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md
index af5ebf2e29..2be252275c 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/view-apps-enterprise-mode-site-list.md
@@ -3,11 +3,15 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Details about how to view the active Enterprise Mode Site List from the Enterprise Mode Site List Portal.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 title: View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 ---
 
 # View the apps included in the active Enterprise Mode Site List from the Enterprise Mode Site List Portal
diff --git a/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md b/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md
index 942409e353..20ad5ac557 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/view-enterprise-mode-reports-for-portal.md
@@ -3,11 +3,15 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Details about how an Administrator can view the available Enterprise Mode reports from the Enterprise Mode Site List Portal.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 title: View the available Enterprise Mode reports from the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 ---
 
 # View the available Enterprise Mode reports from the Enterprise Mode Site List Portal
@@ -47,4 +51,4 @@ Administrators can view the Microsoft-provided Enterprise Mode reports from the
 
     - **Reasons for request.** Shows how many change request reasons exist, based on the **Reason for request** field.
 
-    - **Requested changes by app name.** Shows what specific apps were **Added to site list**, **Deleted from site list**, or **Updated from site list**.
\ No newline at end of file
+    - **Requested changes by app name.** Shows what specific apps were **Added to site list**, **Deleted from site list**, or **Updated from site list**.
diff --git a/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md b/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md
index d62ac7df09..e5de6fffdd 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/virtualization-and-compatibility-with-ie11.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: virtualization
 description: Virtualization and compatibility with Internet Explorer 11
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: b0388c04-2584-4b6d-a7a8-4e0476773a80
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Virtualization and compatibility with Internet Explorer 11 (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md
index 61997d30d7..da309b68cd 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Info about the features included in Enterprise Mode with Internet Explorer 11.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 3c77e9f3-eb21-46d9-b5aa-f9b2341cfefa
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Enterprise Mode and the Enterprise Mode Site List (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 10/25/2018
@@ -67,19 +71,19 @@ This is a view of the [raw EMIE v2 schema.xml file](https://gist.github.com/kypf
 
 ```xml
 
-	
+	
 	
 		EnterpriseSiteListManager
 		10586
 		20150728.135021
 	
-  	 
+  	 
 	
 		IE8Enterprise
 		IE11
 	
 	
-		default
+		Default
 		IE11
 	
 	
@@ -88,8 +92,8 @@ This is a view of the [raw EMIE v2 schema.xml file](https://gist.github.com/kypf
 	
 	  
 	
 	  
 		IE8Enterprise"
@@ -160,6 +164,6 @@ Because the tool is open-source, the source code is readily available for examin
 
 - [Web Application Compatibility Lab Kit](https://technet.microsoft.com/microsoft-edge/mt612809.aspx)
 
-- [Microsoft Services Support](https://www.microsoft.com/en-us/microsoftservices/support.aspx)
+- [Microsoft Services Support](https://www.microsoft.com/microsoftservices/support.aspx)
 
 - [Find a Microsoft partner on Pinpoint](https://partnercenter.microsoft.com/pcv/search)
diff --git a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md
index f0dbb0fe38..98f659748d 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/what-is-the-internet-explorer-11-blocker-toolkit.md
@@ -3,11 +3,14 @@ ms.localizationpriority: medium
 ms.mktglfcycl: support
 ms.pagetype: security
 description: How to download and use the Internet Explorer 11 Blocker Toolkit to turn off the automatic delivery of IE11 through the Automatic Updates feature of Windows Update.
-author: shortpatti
-ms.author: pashort
+author: dansimp
+ms.author: dansimp
 ms.manager: elizapo
 ms.prod: ie11
 ms.assetid: fafeaaee-171c-4450-99f7-5cc7f8d7ba91
+ms.reviewer: 
+audience: itpro
+manager: dansimp
 title: What is the Internet Explorer 11 Blocker Toolkit? (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 05/10/2018
diff --git a/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md b/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md
index e63b48ab92..de71b3a8ff 100644
--- a/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md
+++ b/browsers/internet-explorer/ie11-deploy-guide/workflow-processes-enterprise-mode-portal.md
@@ -3,11 +3,15 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: Use the topics in this section to learn how to perform all of the workflow-related processes in the Enterprise Mode Site List Portal.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 title: Workflow-based processes for employees using the Enterprise Mode Site List Portal (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 ---
 
 
@@ -40,4 +44,4 @@ Use the topics in this section to learn how to perform the available Enterprise
 
 - [Enterprise Mode Site List Portal source code](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal)
 
-- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md)
\ No newline at end of file
+- [Enterprise Mode and the Enterprise Mode Site List](what-is-enterprise-mode.md)
diff --git a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md
index 304aac3c88..8917b1de22 100644
--- a/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md
+++ b/browsers/internet-explorer/ie11-faq/faq-for-it-pros-ie11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: explore
 description: Frequently asked questions about Internet Explorer 11 for IT Pros
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 140e7d33-584a-44da-8c68-6c1d568e1de3
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Internet Explorer 11 - FAQ for IT Pros (Internet Explorer 11 for IT Pros)
 ms.sitesec: library
 ms.date: 10/16/2017
@@ -12,31 +16,31 @@ ms.date: 10/16/2017
 
 
 # Internet Explorer 11 - FAQ for IT Pros
-Answering frequently asked questions about Internet Explorer 11 (IE11) features, operating system support, integration with the Windows operating system, Group Policy, and general configuration.
+Answering frequently asked questions about Internet Explorer 11 (IE11) features, operating system support, integration with the Windows operating system, Group Policy, and general configuration.
 
 ## Frequently Asked Questions
 
 **Q: What operating system does IE11 run on?**
 
--   Windows 10
+-   Windows 10
 
--   Windows 8.1
+-   Windows 8.1
 
--   Windows Server 2012 R2
+-   Windows Server 2012 R2
 
--   Windows 7 with Service Pack 1 (SP1)
+-   Windows 7 with Service Pack 1 (SP1)
 
--   Windows Server 2008 R2 with Service Pack 1 (SP1)
+-   Windows Server 2008 R2 with Service Pack 1 (SP1)
 
 
-**Q: How do I install IE11 on Windows 10, Windows 8.1, or Windows Server 2012 R2?**
            
-IE11 is preinstalled with Windows 8.1 and Windows Server 2012 R2. No additional action is required.
+**Q: How do I install IE11 on Windows 10, Windows 8.1, or Windows Server 2012 R2?**
            
+IE11 is preinstalled with Windows 8.1 and Windows Server 2012 R2. No additional action is required.
 
-**Q: How do I install IE11 on Windows 7 with SP1 or Windows Server 2008 R2 with SP1?**
            
-You can install IE11 on computers running either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. To download IE11, see the IE11 [home page](https://go.microsoft.com/fwlink/p/?LinkId=290956).
+**Q: How do I install IE11 on Windows 7 with SP1 or Windows Server 2008 R2 with SP1?**
            
+You can install IE11 on computers running either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. To download IE11, see the IE11 [home page](https://go.microsoft.com/fwlink/p/?LinkId=290956).
 
-**Q: How does IE11 integrate with Windows 8.1?**
            
-IE11 is the default handler for the HTTP and HTTPS protocols and the default browser for Windows 8.1. There are two experiences in Windows 8.1: Internet Explorer and Internet Explorer for the desktop. IE is the default browser for touch-first, immersive experiences. Internet Explorer for the desktop provides a more traditional window and tab management experience. The underlying platform of IE11 is fully interoperable across both IE and the familiar Internet Explorer for the desktop, letting developers write the same markup for both experiences.
+**Q: How does IE11 integrate with Windows 8.1?**
            
+IE11 is the default handler for the HTTP and HTTPS protocols and the default browser for Windows 8.1. There are two experiences in Windows 8.1: Internet Explorer and Internet Explorer for the desktop. IE is the default browser for touch-first, immersive experiences. Internet Explorer for the desktop provides a more traditional window and tab management experience. The underlying platform of IE11 is fully interoperable across both IE and the familiar Internet Explorer for the desktop, letting developers write the same markup for both experiences.
 
 **Q: What are the new or improved security features?**
            
 IE11 offers improvements to Enhanced Protected Mode, password manager, and other security features. IE11 also turns on Transport Layer Security (TLS) 1.2 by default.
@@ -62,9 +66,9 @@ Supported web standards include:
 For more information about specific changes and additions, see the [IE11 guide for developers](https://go.microsoft.com/fwlink/p/?LinkId=313188).
 
 **Q: What test tools exist to test for potential application compatibility issues?**
            
-The Compat Inspector tool supports Windows Internet Explorer 9 through IE11. For more information, see [Compat Inspector User Guide](https://go.microsoft.com/fwlink/p/?LinkId=313189). In addition, you can use the new [F12 Developer Tools](https://go.microsoft.com/fwlink/p/?LinkId=313190) that are included with IE11, or the [modern.ie](https://go.microsoft.com/fwlink/p/?linkid=308902) website for Microsoft Edge.
+The Compat Inspector tool supports Windows Internet Explorer 9 through IE11. For more information, see [Compat Inspector User Guide](https://go.microsoft.com/fwlink/p/?LinkId=313189). In addition, you can use the new [F12 Developer Tools](https://go.microsoft.com/fwlink/p/?LinkId=313190) that are included with IE11, or the [modern.ie](https://go.microsoft.com/fwlink/p/?linkid=308902) website for Microsoft Edge.
 
-**Q: Why am I having problems launching my legacy apps with Internet Explorer 11**?
            
+**Q: Why am I having problems launching my legacy apps with Internet Explorer 11**?
            
 It’s most likely because IE no longer starts apps that use managed browser hosting controls, like in the .NET Framework 1.1 and 2.0. You can get IE11 to use managed browser hosting controls again, by:
 
 -   **For x86 systems or for 32-bit processes on x64 systems:** Go to the `HKLM\SOFTWARE\MICROSOFT\.NETFramework` registry key and change the **EnableIEHosting** value to **1**.
@@ -77,7 +81,7 @@ For more information, see the [Web Applications](https://go.microsoft.com/fwlink
 Yes. You can review the XML-based [compatibility version list](https://go.microsoft.com/fwlink/p/?LinkId=403864).
 
 **Q: What is Enterprise Mode?**
            
-Enterprise Mode is a compatibility mode designed for Enterprises. This mode lets websites render using a modified browser configuration that’s designed to avoid the common compatibility problems associated with web apps written and tested on older versions of IE, like Windows Internet Explorer 7 or Windows Internet Explorer 8.
            
+Enterprise Mode is a compatibility mode designed for Enterprises. This mode lets websites render using a modified browser configuration that’s designed to avoid the common compatibility problems associated with web apps written and tested on older versions of IE, like Windows Internet Explorer 7 or Windows Internet Explorer 8.
            
 For more information, see [Turn on Enterprise Mode and use a site list](../ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md).
 
 **Q: What is the Enterprise Mode Site List Manager tool?**
            
@@ -85,18 +89,18 @@ Enterprise Mode Site List Manager tool gives you a way to add websites to your E
 For more information, see all of the topics in [Use the Enterprise Mode Site List Manager](../ie11-deploy-guide/use-the-enterprise-mode-site-list-manager.md).
 
 **Q: Are browser plug-ins supported in IE11?**
            
-The immersive version of IE11 provides an add-on–free experience, so browser plugins won't load and dependent content won't be displayed. This doesn't apply to Internet Explorer for the desktop. For more information, see [Browsing Without Plug-ins](https://go.microsoft.com/fwlink/p/?LinkId=242587). However, Internet Explorer for the desktop and IE11 on Windows 7 with SP1 do support browser plugins, including ActiveX controls such as Adobe Flash and Microsoft Silverlight.
+The immersive version of IE11 provides an add-on–free experience, so browser plugins won't load and dependent content won't be displayed. This doesn't apply to Internet Explorer for the desktop. For more information, see [Browsing Without Plug-ins](https://go.microsoft.com/fwlink/p/?LinkId=242587). However, Internet Explorer for the desktop and IE11 on Windows 7 with SP1 do support browser plugins, including ActiveX controls such as Adobe Flash and Microsoft Silverlight.
 
 **Q: Is Adobe Flash supported on IE11?**
            
-Adobe Flash is included as a platform feature and is available out of the box for Windows 8.1, running on both IE and Internet Explorer for the desktop. Users can turn this feature on or off using the **Manage Add-ons** dialog box, while administrators can turn this feature on or off using the Group Policy setting, **Turn off Adobe Flash in IE and prevent applications from using IE technology to instantiate Flash objects**.
            
+Adobe Flash is included as a platform feature and is available out of the box for Windows 8.1, running on both IE and Internet Explorer for the desktop. Users can turn this feature on or off using the **Manage Add-ons** dialog box, while administrators can turn this feature on or off using the Group Policy setting, **Turn off Adobe Flash in IE and prevent applications from using IE technology to instantiate Flash objects**.
            
 **Important**
            
-The preinstalled version of Adobe Flash isn't supported on IE11 running on either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. However, you can still download and install the separate Adobe Flash plug-in.
+The preinstalled version of Adobe Flash isn't supported on IE11 running on either Windows 7 with SP1 or Windows Server 2008 R2 with SP1. However, you can still download and install the separate Adobe Flash plug-in.
 
-**Q: Can I replace IE11 on Windows 8.1 with an earlier version?**
            
-No. Windows 8.1 doesn't support any of the previous versions of IE.
+**Q: Can I replace IE11 on Windows 8.1 with an earlier version?**
            
+No. Windows 8.1 doesn't support any of the previous versions of IE.
 
 **Q: Are there any new Group Policy settings in IE11?**
            
-IE11 includes all of the previous Group Policy settings you've used to manage and control web browser configuration since Internet Explorer 9. It also includes the following new Group Policy settings, supporting new features:
+IE11 includes all of the previous Group Policy settings you've used to manage and control web browser configuration since Internet Explorer 9. It also includes the following new Group Policy settings, supporting new features:
 
 -   Turn off Page Prediction
 
@@ -120,14 +124,14 @@ Visit the [Springboard Series for Microsoft Browsers](https://go.microsoft.com/f
 
 
 
-**Q: Can I customize settings for IE on Windows 8.1?**
            
+**Q: Can I customize settings for IE on Windows 8.1?**
            
 Settings can be customized in the following ways:
 
 -   IE11 **Settings** charm.
 
 -   IE11-related Group Policy settings.
 
--   IEAK 11 for settings shared by both IE and Internet Explorer for the desktop.
+-   IEAK 11 for settings shared by both IE and Internet Explorer for the desktop.
 
 **Q: Can I make Internet Explorer for the desktop my default browsing experience?**
            
 Group Policy settings can be set to open either IE or Internet Explorer for the desktop as the default browser experience. Individual users can configure their own settings in the **Programs** tab of **Internet Options**. The following table shows the settings and results:
            
@@ -143,6 +147,7 @@ Group Policy settings can be set to open either IE or Internet Explorer for the
 Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard.
 
 IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center:
+
 |  |  |  |
 |---------|---------|---------|
 |[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi)     |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi)         |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi)         |
@@ -196,4 +201,4 @@ The following table displays which pages are available in IEAK 11, based on the
 ## Related topics
 - [Microsoft Edge - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760643)
 - [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md)
-- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md)
\ No newline at end of file
+- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](../ie11-ieak/index.md)
diff --git a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md b/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md
index 3bba45984c..a4cb639bc5 100644
--- a/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md
+++ b/browsers/internet-explorer/ie11-faq/faq-ie11-blocker-toolkit.md
@@ -2,10 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: explore
 description: Get answers to commonly asked questions about the Internet Explorer 11 Blocker Toolkit.
-author: shortpatti
-ms.author: pashort
+author: dansimp
+ms.author: dansimp
 ms.prod: ie11
 ms.assetid: 
+ms.reviewer: 
+audience: itpro
+manager: dansimp
 title: Internet Explorer 11 Blocker Toolkit - Frequently Asked Questions
 ms.sitesec: library
 ms.date: 05/10/2018
@@ -18,11 +21,11 @@ Get answers to commonly asked questions about the Internet Explorer 11 Blocker T
 >[!Important]
 >If you administer your company’s environment using an update management solution, such as Windows Server Update Services (WSUS) or System Center 2012 Configuration Manager, you don’t need to use the Internet Explorer 11 Blocker Toolkit. Update management solutions let you completely manage your Windows Updates and Microsoft Updates, including your Internet Explorer 11 deployment.
 
--   [Automatic updates delivery process]()
+-   [Automatic updates delivery process](#automatic-updates-delivery-process)
 
--   [How the Internet Explorer 11 Blocker Toolkit works]()
+-   [How the Internet Explorer 11 Blocker Toolkit works](#how-the-internet-explorer-11-blocker-toolkit-works)
 
--   [Internet Explorer 11 Blocker Toolkit and other update services]()
+-   [Internet Explorer 11 Blocker Toolkit and other update services](#internet-explorer-11-blocker-toolkit-and-other-update-services)
 
 ## Automatic Updates delivery process
 
@@ -48,7 +51,7 @@ other update management solution.
 **Q. Why don’t we just block URL access to Windows Update or Microsoft Update?**  
 A. Blocking the Windows Update or Microsoft Update URLs also stops delivery of critical security and reliability updates for all of the supported versions of the Windows operating system; leaving your computers more vulnerable.
 
-How the Internet Explorer 11 Blocker Toolkit works
+## How the Internet Explorer 11 Blocker Toolkit works
 
 **Q. How should I test the Internet Explorer 11 Blocker Toolkit in my company?**  
 A. Because the toolkit only sets a registry key to turn on and off the delivery of Internet Explorer 11, there should be no additional impact or side effects to your environment. No additional testing should be necessary.  
diff --git a/browsers/internet-explorer/ie11-faq/faq-ieak11.md b/browsers/internet-explorer/ie11-faq/faq-ieak11.md
index 59d6f5be4a..8064c74737 100644
--- a/browsers/internet-explorer/ie11-faq/faq-ieak11.md
+++ b/browsers/internet-explorer/ie11-faq/faq-ieak11.md
@@ -3,11 +3,14 @@ ms.localizationpriority: medium
 ms.mktglfcycl: support
 ms.pagetype: security
 description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions.
-author: shortpatti
-ms.author: pashort
+author: dansimp
+ms.author: dansimp
 ms.manager: elizapo
 ms.prod: ie11
-ms.assetid:
+ms.assetid: 
+ms.reviewer: 
+audience: itpro
+manager: dansimp
 title: IEAK 11 - Frequently Asked Questions
 ms.sitesec: library
 ms.date: 05/10/2018
@@ -35,7 +38,7 @@ You can customize and install IEAK 11 on the following supported operating syste
 
 >[!Note]
 >IEAK 11 does not support building custom packages for Windows RT.
-     
+
 
 **What can I customize with IEAK 11?**
 
@@ -51,7 +54,7 @@ Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of
 >IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. To download IEAK 11, see [Internet Explorer Administration Kit (IEAK) information and downloads](../ie11-ieak/ieak-information-and-downloads.md).
 
 **Q: Is there a version of the Internet Explorer Administration Kit (IEAK) supporting IE11?**
            
-Yes. The Internet Explorer Administration Kit 11 (IEAK 11) is available for download. IEAK 11 lets you create custom versions of IE11 for use in your organization. For more information, see the following resources:
+Yes. The Internet Explorer Administration Kit 11 (IEAK 11) is available for download. IEAK 11 lets you create custom versions of IE11 for use in your organization. For more information, see the following resources:
 
 - [Internet Explorer Administration Kit Information and Downloads](https://go.microsoft.com/fwlink/p/?LinkId=214250) on the Internet Explorer TechCenter.
 
@@ -97,6 +100,7 @@ The following table displays which pages are available in IEAK 11, based on the
 Yes. You can use IEAK 11 to build custom Internet Explorer 11 packages in any of the supported 24 languages. You'll select the language for the custom package on the Language Selection page of the customization wizard.
 
 IEAK 11 is available in 24 languages but can build customized Internet Explorer 11 packages in all languages of the supported operating systems. Select a language below and download IEAK 11 from the download center:
+
 |  |  |  |
 |---------|---------|---------|
 |[English](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/en-us/ieak.msi)     |[French](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/fr-fr/ieak.msi)         |[Norwegian (Bokmål)](https://download.microsoft.com/download/A/B/1/AB1954BF-8B20-4F01-808A-FE5EE5269F08/MSI/nb-no/ieak.msi)         |
diff --git a/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md
index b56b2dedbf..b211933353 100644
--- a/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/accelerators-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Accelerators page in the IEAK 11 Customization Wizard to add accelerators to employee devices.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 208305ad-1bcd-42f3-aca3-0ad1dda7048b
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Accelerators page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md b/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md
index f2ab6f6f59..7e89dab65d 100644
--- a/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/add-and-approve-activex-controls-ieak11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use IEAK 11 to add and approve ActiveX controls for your organization.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 33040bd1-f0e4-4541-9fbb-16e0c76752ab
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Add and approve ActiveX controls using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md
index b0b9219277..eae4f678e5 100644
--- a/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/add-root-certificate-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: We’re sorry. While we continue to recommend that you digitally sign your package, we’ve removed all of the functionality that allowed you to add a root certificate using the Internet Explorer Customization Wizard 11. The wizard page itself will be removed in a future version of the IEAK.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 7ae4e747-49d2-4551-8790-46a61b5fe838
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Add a Root Certificate page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md
index 08b62952da..60be35bc0d 100644
--- a/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/additional-settings-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Additional Settings page in IEAK 11 Customization Wizard for additional settings that relate to your employee’s desktop, operating system, and security.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: c90054af-7b7f-4b00-b55b-5e5569f65f25
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Additional Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md
index 440d2c7fc1..d3883b39ca 100644
--- a/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/auto-config-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Automatic Configuration page in the IEAK 11 Customization Wizard to add URLs to auto-configure IE.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: de5b1dbf-6e4d-4f86-ae08-932f14e606b0
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Automatic Configuration page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md b/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md
index b14d4aa1ce..1a46247c5c 100644
--- a/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/auto-detection-dhcp-or-dns-servers-ieak11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to set up automatic detection for DHCP or DNS servers using IEAK 11 in your organization.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: c6bfe7c4-f452-406f-b47e-b7f0d8c44ae1
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Set up auto detection for DHCP or DNS servers using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -23,13 +27,13 @@ Before you can set up your environment to use automatic detection, you need to t
 ## Automatic detection on DHCP and DNS servers
 Automatic detection works even if the browser wasn't originally set up or installed by the administrator.
 
--   **Using DHCP servers:** For local area network (LAN)-based users. This server type lets you specify your global and subnet TCP/IP parameters centrally, defining your users' parameters by using reserved addresses. By doing it this way, a computer can move between subnets, automatically reconfiguring for TCP/IP when it starts.
-
            **Note**
            
-Your DHCP servers must support the DHCPINFORM message, to obtain the DHCP options.    
+- **Using DHCP servers:** For local area network (LAN)-based users. This server type lets you specify your global and subnet TCP/IP parameters centrally, defining your users' parameters by using reserved addresses. By doing it this way, a computer can move between subnets, automatically reconfiguring for TCP/IP when it starts.
+  
            Note
            
+  Your DHCP servers must support the DHCPINFORM message, to obtain the DHCP options.    
 
--   **Using DNS servers:** For users on dial-up connections. This server type uses a set of protocols and services on a TCP/IP network, which lets users search for other computers by using hierarchical, user-friendly names (hosts), instead of numeric IP addresses. To use this, you have to set up either the host record or the CNAME alias record in the DNS database file.
-
            **Note**
            
-DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen.
+- **Using DNS servers:** For users on dial-up connections. This server type uses a set of protocols and services on a TCP/IP network, which lets users search for other computers by using hierarchical, user-friendly names (hosts), instead of numeric IP addresses. To use this, you have to set up either the host record or the CNAME alias record in the DNS database file.
+  
            Note
            
+  DHCP has a higher priority than DNS for automatic configuration. If DHCP provides the URL to a .pac, .jvs, .js, or .ins configuration file, the process stops and the DNS lookup doesn't happen.
 
 **To set up automatic detection for DHCP servers**
 
@@ -43,16 +47,16 @@ DHCP has a higher priority than DNS for automatic configuration. If DHCP provide
 
 **To set up automatic detection for DNS servers**
 
-1.  In your DNS database file, the file that’s used to associate your host (computer) names to static IP addresses in a zone, you need to create a host record named, **WPAD**. This record contains entries for all of the hosts that require static mappings, such as workstations, name servers, and mail servers. It also has the IP address to the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.
            The syntax is:
            
-` IN A `
            
-`corserv IN A 192.55.200.143`
            
-`nameserver2 IN A 192.55.200.2`
            
-`mailserver1 IN A 192.55.200.51`
-
            **-OR-**
            
-Create a canonical name (CNAME) alias record, named **WPAD**. This record lets you use more than one name to point to a single host, letting you host both an FTP server and a web server on the same computer. It also includes the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.
            
-**Note**
            For more info about creating a **WPAD** entry, see [Creating a WPAD entry in DNS](https://go.microsoft.com/fwlink/p/?LinkId=294651). 
+1. In your DNS database file, the file that’s used to associate your host (computer) names to static IP addresses in a zone, you need to create a host record named, **WPAD**. This record contains entries for all of the hosts that require static mappings, such as workstations, name servers, and mail servers. It also has the IP address to the web server storing your automatic configuration (.js, .jvs, .pac, or .ins) file.
            The syntax is:
            
+   ` IN A `
            
+   `corserv IN A 192.55.200.143`
            
+   `nameserver2 IN A 192.55.200.2`
            
+   `mailserver1 IN A 192.55.200.51`
+   
            -OR-
            
+   Create a canonical name (CNAME) alias record, named WPAD. This record lets you use more than one name to point to a single host, letting you host both an FTP server and a web server on the same computer. It also includes the resolved name (not the IP address) of the server storing your automatic configuration (.pac) file.
            
+   Note
            For more info about creating a WPAD entry, see Creating a WPAD entry in DNS. 
 
-2.  After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file.
+2. After the database file propagates to the server, the DNS name, `wpad..com` resolves to the server name that includes your automatic configuration file.
 
 **Note**
            
 IE11 creates a default URL template based on the host name,**wpad**. For example, `https://wpad..com/wpad.dat`. Because of this, you need to set up a file or redirection point in your web server **WPAD** record, named **wpad.dat**. The **wpad.dat** record delivers the contents of your automatic configuration file.
diff --git a/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md
index ae8a5441f1..c317a46e0e 100644
--- a/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/auto-version-sync-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Automatic Version Synchronization page in the IEAK 11 Customization Wizard to download the IE11 Setup file each time you run the Wizard.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: bfc7685f-843b-49c3-8b9b-07e69705840c
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Automatic Version Synchronization page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md b/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md
index 6970178857..3508c186af 100644
--- a/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/before-you-create-custom-pkgs-ieak11.md
@@ -2,11 +2,14 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: A list of steps to follow before you start to create your custom browser installation packages.
-author: shortpatti
-ms.author: pashort
+author: dansimp
+ms.author: dansimp
 ms.manager: elizapo
 ms.prod: ie11
 ms.assetid: 6ed182b0-46cb-4865-9563-70825be9a5e4
+ms.reviewer: 
+audience: itpro
+manager: dansimp
 title: Before you start using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 04/24/2018
diff --git a/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md
index 5a0efa8edf..5c9c189f24 100644
--- a/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/branding-ins-file-setting.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use the \[Branding\] .INS file setting to set up your custom branding and setup info in your browser install package.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: cde600c6-29cf-4bd3-afd1-21563d2642df
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Branding .INS file to create custom branding and setup info (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md
index 03b1f4eddb..c1f3999a3a 100644
--- a/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/browser-ui-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Browser User Interface page in the IEAK 11 Customization Wizard to change the toolbar buttons and the title bar.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: c4a18dcd-2e9c-4b5b-bcc5-9b9361a79f0d
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Browser User Interface page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -16,7 +20,7 @@ The **Browser User Interface** page of the Internet Explorer Customization Wizar
 
 **Note**
            The customizations you make on this page apply only to Internet Explorer for the desktop.
 
- **To use the Browser User Interface page**
+ **To use the Browser User Interface page**
 
 1.  Check the **Customize Title Bars** box so you can add your custom text to the **Title Bar Text** box.
            
 The text shows up in the title bar as **IE provided by** <*your_custom_text*>.
@@ -25,27 +29,27 @@ The text shows up in the title bar as **IE provided by** <*your_custom_text*&
 
 **Note**
            Only Administrators can use this option.
 
-3.  Click **Add** to add new toolbar buttons.
            
-The **Browser Toolbar Button Information** box appears.
+3. Click **Add** to add new toolbar buttons.
            
+   The **Browser Toolbar Button Information** box appears.
 
-4.  In the **Toolbar caption** box, type the text that shows up when an employee hovers over your custom button. We recommend no more than 10 characters.
+4. In the **Toolbar caption** box, type the text that shows up when an employee hovers over your custom button. We recommend no more than 10 characters.
 
-5.  In the **Toolbar action** box, browse to your script or executable file that runs when an employee clicks your custom button.
+5. In the **Toolbar action** box, browse to your script or executable file that runs when an employee clicks your custom button.
 
-6.  In the **Toolbar icon** box, browse to the icon file that represents your button while active. This icon must be 20x20 pixels.
+6. In the **Toolbar icon** box, browse to the icon file that represents your button while active. This icon must be 20x20 pixels.
 
-7.  Check the **This button should be shown on the toolbar by default** box so your custom button shows by default.
            
-This box should be cleared if you want to offer a custom set of buttons, but want your employees to choose whether or not to use them. In this situation, your buttons will show up in the **Customize Toolbars** dialog box, under **Available toolbar buttons**. Your employees can get to this dialog box in IE by clicking **Tools** from the **Command Bar**, clicking **Toolbars**, and then clicking **Customize**.
+7. Check the **This button should be shown on the toolbar by default** box so your custom button shows by default.
            
+   This box should be cleared if you want to offer a custom set of buttons, but want your employees to choose whether or not to use them. In this situation, your buttons will show up in the **Customize Toolbars** dialog box, under **Available toolbar buttons**. Your employees can get to this dialog box in IE by clicking **Tools** from the **Command Bar**, clicking **Toolbars**, and then clicking **Customize**.
 
-8.  Click **OK.**
+8. Click **OK.**
 
-9.  Click **Edit** to change your custom toolbar button or **Remove** to delete the button. The removed button will disappear from your employee’s computer after you apply the updated customization. Only custom toolbar buttons can be removed.
+9. Click **Edit** to change your custom toolbar button or **Remove** to delete the button. The removed button will disappear from your employee’s computer after you apply the updated customization. Only custom toolbar buttons can be removed.
 
 10. Click **Next** to go to the [Search Providers](search-providers-ieak11-wizard.md) page or **Back** to go to the [User Experience](user-experience-ieak11-wizard.md) page.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md
index e317f9ebc8..b2b123ff69 100644
--- a/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/browsertoolbars-ins-file-setting.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: Use the \[BrowserToolbars\] .INS file setting to customize your Internet Explorer toolbar and buttons.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 83af0558-9df3-4c2e-9350-44f7788efa6d
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the BrowserToolbars .INS file to customize the Internet Explorer toolbar and buttons (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md
index b602a68d7f..a39adaff3e 100644
--- a/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/browsing-options-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Browsing Options page in the IEAK 11 Customization Wizard to manage items in the Favorites, Favorites Bar, and Feeds section.
-author: shortpatti
-ms.prod: ie111
+author: dansimp
+ms.prod: ie11
 ms.assetid: d6bd71ba-5df3-4b8c-8bb5-dcbc50fd974e
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Browsing Options page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md
index d7a3094423..e5bf7ebb40 100644
--- a/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/cabsigning-ins-file-setting.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use the \[CabSigning\] .INS file setting to customize the digital signature info for your apps.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 098707e9-d712-4297-ac68-7d910ca8f43b
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the CabSigning .INS file to customize the digital signature info for your apps (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md
index 64b989ddcb..cda9702eb4 100644
--- a/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/compat-view-ieak11-wizard.md
@@ -3,9 +3,13 @@ ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 ms.pagetype: appcompat
 description: We’re sorry. We’ve removed all of the functionality included on the **Compatibility View** page of the Internet Explorer Customization Wizard 11.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 51d8f80e-93a5-41e4-9478-b8321458bc30
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Compatibility View page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md
index 2e8573d0f1..aaec7b0fa2 100644
--- a/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/connection-mgr-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: We’re sorry. We’ve removed all of the functionality included on the **Connection Manager** page of the Internet Explorer Customization Wizard 11.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 1edaa7db-cf6b-4f94-b65f-0feff3d4081a
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Connection Manager page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md
index a54ca3f9f5..66beabdbca 100644
--- a/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/connection-settings-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Connection Settings page in IEAK 11 Customization Wizard to import and preset connection settings on your employee’s computers.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: dc93ebf7-37dc-47c7-adc3-067d07de8b78
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Connection Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -24,15 +28,15 @@ The **Connection Settings** page of the Internet Explorer Administration Kit (IE
 
 **To use the Connection Settings page**
 
-1.  Decide if you want to customize your connection settings. You can pick:
+1. Decide if you want to customize your connection settings. You can pick:
 
-    -   **Do not customize Connection Settings.** Pick this option if you don’t want to preset your employee’s connection settings.
+   -   **Do not customize Connection Settings.** Pick this option if you don’t want to preset your employee’s connection settings.
 
-    -   **Import the current Connection Settings from this machine.** Pick this option to import your connection settings from your computer and use them as the preset for your employee’s connection settings.
+   -   **Import the current Connection Settings from this machine.** Pick this option to import your connection settings from your computer and use them as the preset for your employee’s connection settings.
  
- **Note**
            If you want to change any of your settings later, you can click **Modify Settings** to open the **Internet Properties** box, click the **Connection Settings** tab, and make your changes.
+   **Note**
            If you want to change any of your settings later, you can click **Modify Settings** to open the **Internet Properties** box, click the **Connection Settings** tab, and make your changes.
 
-2.  Check the **Delete existing Dial-up Connection Settings** box to clear any existing settings on your employee’s computers.
+2. Check the **Delete existing Dial-up Connection Settings** box to clear any existing settings on your employee’s computers.
 
-3.  Click **Next** to go to the [Automatic Configuration](auto-config-ieak11-wizard.md) page or **Back** to go to the [Connection Manager](connection-mgr-ieak11-wizard.md) page.
+3. Click **Next** to go to the [Automatic Configuration](auto-config-ieak11-wizard.md) page or **Back** to go to the [Connection Manager](connection-mgr-ieak11-wizard.md) page.
 
diff --git a/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md
index 0112c0f16f..779e024e57 100644
--- a/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/connectionsettings-ins-file-setting.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: Use the \[ConnectionSettings\] .INS file setting to specify the network connection settings needed to install your custom package.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 41410300-6ddd-43b2-b9e2-0108a2221355
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the ConnectionSettings .INS file to review the network connections for install (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md
index b8981f575f..91f26adf5b 100644
--- a/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/create-build-folder-structure-ieak11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: How to create your folder structure on the computer that you’ll use to build your custom browser package.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: e0d05a4c-099f-4f79-a069-4aa1c28a1080
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Create the build computer folder structure using IEAK 11  (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md
index 4827fc1c75..3e8043c959 100644
--- a/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/create-manage-deploy-custom-pkgs-ieak11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: Review this list of tasks and references before you create and deploy your Internet Explorer 11 custom install packages.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: fe71c603-bf07-41e1-a477-ade5b28c9fb3
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Tasks and references to consider before creating and deploying custom packages using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -17,7 +21,7 @@ Review this list of tasks and references to help you use the Internet Explorer A
 |Task                                    |References                                                    |
 |----------------------------------------|--------------------------------------------------------------|
 |Review concepts and requirements, including info about the version and features you'll use. |
            • [Hardware and software requirements for IEAK 11](hardware-and-software-reqs-ieak11.md)
            • [Determine the licensing version and features to use in IEAK 11](licensing-version-and-features-ieak11.md)
            • [Before you start using IEAK 11](before-you-create-custom-pkgs-ieak11.md)
             |
-|Prep your environment and get all of the info you'll need for running IEAK 11 |
            • [Create the build computer folder structure using IEAK 11](create-build-folder-structure-ieak11.md)
            • [Customize the Toolbar button and Favorites List icons using IEAK 11](guidelines-toolbar-and-favorites-list-ieak11.md)
            • [Before you install your package over your network using IEAK 11](prep-network-install-with-ieak11.md)
            • [Set up auto detection for DHCP or DNS servers using IEAK 11](auto-detection-dhcp-or-dns-servers-ieak11.md)
            • [Register an uninstall app for custom components using IEAK 11](register-uninstall-app-ieak11.md)
            • [Add and approve ActiveX controls using the IEAK 11](add-and-approve-activex-controls-ieak11.md)
            • [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](ieak11-wizard-custom-options.md)
            • [Security features and IEAK 11 ](security-and-ieak11.md)
             |
+|Prep your environment and get all of the info you'll need for running IEAK 11 |
            • [Create the build computer folder structure using IEAK 11](create-build-folder-structure-ieak11.md)
            • [Customize the Toolbar button and Favorites List icons using IEAK 11](guidelines-toolbar-and-favorites-list-ieak11.md)
            • [Before you install your package over your network using IEAK 11](prep-network-install-with-ieak11.md)
            • [Set up auto detection for DHCP or DNS servers using IEAK 11](auto-detection-dhcp-or-dns-servers-ieak11.md)
            • [Register an uninstall app for custom components using IEAK 11](register-uninstall-app-ieak11.md)
            • [Add and approve ActiveX controls using the IEAK 11](add-and-approve-activex-controls-ieak11.md)
            • [Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options](ieak11-wizard-custom-options.md)
            • [Security features and IEAK 11](security-and-ieak11.md)
             |
 |Run the Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard |
            • [Use the File Locations page in the IEAK 11 Wizard](file-locations-ieak11-wizard.md)
            • [Use the Platform Selection page in the IEAK 11 Wizard](platform-selection-ieak11-wizard.md)
            • [Use the Language Selection page in the IEAK 11 Wizard](language-selection-ieak11-wizard.md)
            • [Use the Package Type Selection page in the IEAK 11 Wizard](pkg-type-selection-ieak11-wizard.md)
            • [Use the Feature Selection page in the IEAK 11 Wizard](feature-selection-ieak11-wizard.md)
            • [Use the Automatic Version Synchronization page in the IEAK 11 Wizard](auto-version-sync-ieak11-wizard.md)
            • [Use the Custom Components page in the IEAK 11 Wizard](custom-components-ieak11-wizard.md)
            • [Use the Internal Install page in the IEAK 11 Wizard](internal-install-ieak11-wizard.md)
            • [Use the User Experience page in the IEAK 11 Wizard](user-experience-ieak11-wizard.md)
            • [Use the Browser User Interface page in the IEAK 11 Wizard](browser-ui-ieak11-wizard.md)
            • [Use the Search Providers page in the IEAK 11 Wizard](search-providers-ieak11-wizard.md)
            • [Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard](important-urls-home-page-and-support-ieak11-wizard.md)
            • [Use the Accelerators page in the IEAK 11 Wizard](accelerators-ieak11-wizard.md)
            • [Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard](favorites-favoritesbar-and-feeds-ieak11-wizard.md)
            • [Use the Browsing Options page in the IEAK 11 Wizard](browsing-options-ieak11-wizard.md)
            • [Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard](first-run-and-welcome-page-ieak11-wizard.md)
            • [Use the Compatibility View page in the IEAK 11 Wizard](compat-view-ieak11-wizard.md)
            • [Use the Connection Manager page in the IEAK 11 Wizard](connection-mgr-ieak11-wizard.md)
            • [Use the Connection Settings page in the IEAK 11 Wizard](connection-settings-ieak11-wizard.md)
            • [Use the Automatic Configuration page in the IEAK 11 Wizard](auto-config-ieak11-wizard.md)
            • [Use the Proxy Settings page in the IEAK 11 Wizard](proxy-settings-ieak11-wizard.md)
            • [Use the Security and Privacy Settings page in the IEAK 11 Wizard](security-and-privacy-settings-ieak11-wizard.md)
            • [Use the Add a Root Certificate page in the IEAK 11 Wizard](add-root-certificate-ieak11-wizard.md)
            • [Use the Programs page in the IEAK 11 Wizard](programs-ieak11-wizard.md)
            • [Use the Additional Settings page in the IEAK 11 Wizard](additional-settings-ieak11-wizard.md)
            • [Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard](wizard-complete-ieak11-wizard.md)
             |
 |Review your policy settings and create multiple versions of your install package. |
            • [Create multiple versions of your custom package using IEAK 11](create-multiple-browser-packages-ieak11.md)
            • [Use the RSoP snap-in to review policy settings](rsop-snapin-for-policy-settings-ieak11.md)
              **Note**
              For deployment instructions, additional troubleshooting, and post-installation management, see the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md)
             |
 |Review the general IEAK Customization Wizard 11 information, which applies throughout the process. |
            • [Troubleshoot custom package and IEAK 11 problems](troubleshooting-custom-browser-pkg-ieak11.md)
            • [File types used or created by IEAK 11](file-types-ieak11.md)
            • [Customize Automatic Search using IEAK 11](customize-automatic-search-for-ie.md)
            • [Use the uninstallation .INF files to uninstall custom components](create-uninstall-inf-files-for-custom-components.md)
            • [Using Internet Settings (.INS) files with IEAK 11](using-internet-settings-ins-files.md)
            • [Use proxy auto-configuration (.pac) files with IEAK 11](proxy-auto-config-examples.md)
            • [IExpress Wizard for Windows Server 2008 R2 with SP1](iexpress-wizard-for-win-server.md)
             |
diff --git a/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md b/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md
index cb1a3823fc..6196fabf79 100644
--- a/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/create-multiple-browser-packages-ieak11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Steps to create multiple versions of your custom browser if you support more than 1 version of Windows, more than 1 language, or have different features in each package.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 4c5f3503-8c69-4691-ae97-1523091ab333
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Create multiple versions of your custom package using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md b/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md
index e9cb1ff4ce..3cf498605c 100644
--- a/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md
+++ b/browsers/internet-explorer/ie11-ieak/create-uninstall-inf-files-for-custom-components.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use Setup information (.inf) files to uninstall custom components from your custom browser packages.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 8257aa41-58de-4339-81dd-9f2ffcc10a08
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use Setup information (.inf) files to uninstall custom components (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md
index 5b7532f69e..571b73d327 100644
--- a/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/custom-components-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Custom Components page in the IEAK 11 Customization Wizard to add additional components for your employees to install with IE.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 38a2b90f-c324-4dc8-ad30-8cd3e3e901d7
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Custom Components page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md
index f404bf78cf..e7469fa864 100644
--- a/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/custombranding-ins-file-setting.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: Use the \[CustomBranding\] .INS file setting to specify the location of your branding cabinet (.cab) file.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 9c74e239-65c5-4aa5-812f-e0ed80c5c2b0
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the CustomBranding .INS file to create custom branding and setup info (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -14,7 +18,8 @@ ms.date: 07/27/2017
 # Use the CustomBranding .INS file to create custom branding and setup info
 Provide the URL to your branding cabinet (.cab) file.
 
-|Name       |Value                           | Description                                                  |
-|-----------|--------------------------------|--------------------------------------------------------------|
-|Branding |`` |The location of your branding cabinet (.cab) file. For example, https://www.<your_server>.net/cabs/branding.cab.|
+
+|   Name   |      Value       |                                                      Description                                                       |
+|----------|------------------|------------------------------------------------------------------------------------------------------------------------|
+| Branding | `` | The location of your branding cabinet (.cab) file. For example, https://www.<your_server>.net/cabs/branding.cab. |
 
diff --git a/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md b/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md
index fde8b84b67..3c0af97192 100644
--- a/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md
+++ b/browsers/internet-explorer/ie11-ieak/customize-automatic-search-for-ie.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: manage
 description: Customize Automatic Search in Internet Explorer so that your employees can type a single word into the Address box to search for frequently used pages.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 694e2f92-5e08-49dc-b83f-677d61fa918a
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Customize Automatic Search using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -21,13 +25,13 @@ You can customize Automatic Search so that your employees can type a single word
 
 **To set up Automatic Search**
 
-1.  Create a script (.asp) file that conditionally looks for search terms, and post it to an intranet server here: https://ieautosearch/response.asp?MT=%1&srch=%2.
            
-For info about the acceptable values for the *%1* and *%2* parameters, see the [Automatic Search parameters](#automatic-search-parameters). For an example of the script file, see the [Sample Automatic Search script](#sample-automatic-search-script).
            
-**Important**
            If you aren’t using IIS in your company, you’ll need to remap this URL to your script file’s location. 
+1. Create a script (.asp) file that conditionally looks for search terms, and post it to an intranet server here: https://ieautosearch/response.asp?MT=%1&srch=%2.
            
+   For info about the acceptable values for the *%1* and *%2* parameters, see the [Automatic Search parameters](#automatic-search-parameters). For an example of the script file, see the [Sample Automatic Search script](#sample-automatic-search-script).
            
+   **Important**
            If you aren’t using IIS in your company, you’ll need to remap this URL to your script file’s location. 
 
-2.  On the **Additional Settings** page of the IEAK 11, click **Internet Settings**, and then click **Advanced Settings**.
+2. On the **Additional Settings** page of the IEAK 11, click **Internet Settings**, and then click **Advanced Settings**.
 
-3.  Go to the section labeled **Searching** and type *intranet* into the **Search Provider Keyword** box.
+3. Go to the section labeled **Searching** and type *intranet* into the **Search Provider Keyword** box.
 
 **To redirect to a different site than the one provided by the search results**
 
@@ -90,9 +94,9 @@ end if
 %>
 ```
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md
index 4c3726a566..06e8d6c3f3 100644
--- a/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/extreginf-ins-file-setting.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use the \[ExtRegInf\] .INS file setting to specify your Setup information (.inf) files and the installation mode for your custom components.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 53148422-d784-44dc-811d-ef814b86a4c6
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the ExtRegInf .INS file to specify your installation files and mode (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -12,7 +16,7 @@ ms.date: 07/27/2017
 
 
 # Use the ExtRegInf .INS file to specify installation files and mode
-Info about how to specify your Setup information (.inf) files and the instsallation mode for your custom components.
+Info about how to specify your Setup information (.inf) files and the installation mode for your custom components.
 
 |Name       |Value    |Description                                                                                                       |
 |-----------|---------|------------------------------------------------------------------------------------------------------------------|
diff --git a/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md
index 7b876c2cea..47bf04d6e2 100644
--- a/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/favorites-favoritesbar-and-feeds-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Favorites, Favorites Bar, and Feeds page in IEAK 11 Customization Wizard to add links, web slices, and feeds to your custom browser package.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 84afa831-5642-4b8f-b7df-212a53ec8fc7
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Favorites, Favorites Bar, and Feeds page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md
index 68953ff98d..694b8d994d 100644
--- a/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/favoritesex-ins-file-setting.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use the \[FavoritesEx\] .INS file setting to specify your Favorites icon file, whether Favorites is available offline, and your Favorites URLs.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 55de376a-d442-478e-8978-3b064407b631
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the FavoritesEx .INS file for your Favorites icon and URLs (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md
index 4baf035425..b27bc3273a 100644
--- a/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/feature-selection-ieak11-wizard.md
@@ -2,12 +2,15 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Feature Selection page in the IEAK 11 Customization Wizard to choose which parts of the setup processes and Internet Explorer 11 to change for your company.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 9cb8324e-d73b-41ba-ade9-3acc796e21d8
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Feature Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
-ms.date: 07/27/2017
 ---
 
 
diff --git a/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md
index 70f59f0665..f3224c2055 100644
--- a/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/file-locations-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the File Locations page in the IEAK 11 Customization Wizard to change the location of your install package and IE11 folders.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: bd0620e1-0e07-4560-95ac-11888c2c389e
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the File Locations page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md b/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md
index d782c47cf9..38703f9131 100644
--- a/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/file-types-ieak11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: Review the file types that are created and used by tools in the Internet Explorer Administration Kit 11 (IEAK 11).
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: e5735074-3e9b-4a00-b1a7-b8fd8baca327
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: File types used or created by IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -19,7 +23,7 @@ A list of the file types used or created by tools in IEAK 11:
 |.adm | An admin file (located at `:\Program Files\Windows IEAK 11\policies`), used by Group Policy to define the system policies and restrictions for Windows. You can use the IEAK 11 to change these settings. |
 |.bat |An ASCII text file that contains a sequence of operating system commands, including the parameters and operators supported by the batch command language. When you run the batch file from a command prompt, the computer processes each command sequentially. |
 |.bmp, .gif, .jpeg, and .jpg |Image files you can use to customize your toolbar button and favorites list icons. For info, see the [Customize the Toolbar button and Favorites List icons using IEAK 11](guidelines-toolbar-and-favorites-list-ieak11.md) page. |
-|.cab |A compressed cabinet (.cab) file, created by the Internet Explorer Customization Wizard 11 to store your custom compenent files. We highly recommend that your .cab files be signed for security purposes. For more info, see the [Security features and IEAK 11](security-and-ieak11.md) page. |
+|.cab |A compressed cabinet (.cab) file, created by the Internet Explorer Customization Wizard 11 to store your custom component files. We highly recommend that your .cab files be signed for security purposes. For more info, see the [Security features and IEAK 11](security-and-ieak11.md) page. |
 |.cif |A component info file (IESetup.cif), identifying the new or updated components you're going to install with Internet Explorer. Each component file has an associated *ComponentID* that's used by Windows Update Setup to determine whether a new component or an update exists. |
 |.cmp |Connection profile files that are created by the Connection Manager Administration Kit (CMAK). |
 |.cms |Service provider files, created by the CMAK tool to specify the configuration of the phone book and many of the other functions of your service profiles. |
diff --git a/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md
index 8ee207bf57..507450938d 100644
--- a/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/first-run-and-welcome-page-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the First Run Wizard and Welcome Page Options page in the IEAK 11 Customization Wizard to set what your employee’s see the first time they log on to IE, based on their operating system.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 85f856a6-b707-48a9-ba99-3a6e898276a9
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the First Run Wizard and Welcome Page Options page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md b/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md
index f3fbc10a27..0864538448 100644
--- a/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/guidelines-toolbar-and-favorites-list-ieak11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: Customization guidelines for your Internet Explorer toolbar button and Favorites List icons.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: bddc8f23-9ac1-449d-ad71-f77f43ae3b5c
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Customize the toolbar button and Favorites List icons using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md b/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md
index 6e1b19b500..0ba0f580a8 100644
--- a/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/hardware-and-software-reqs-ieak11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: List of supported hardware and software requirements for Internet Explorer 11 and the Internet Explorer Administration Kit 11.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: c50b86dc-7184-43d1-8daf-e750eb88dabb
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Hardware and software requirements for Internet Explorer 11 and the IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md
index a0cec600e1..7d50512355 100644
--- a/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/hidecustom-ins-file-setting.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use the \[HideCustom\] .INS file setting to decide whether to hide the GUID for each custom component.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: e673f7b1-c3aa-4072-92b0-20c6dc3d9277
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the HideCustom .INS file to hide the GUID for each custom component (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -17,11 +21,11 @@ Info about whether to hide the globally unique identifier (GUID) for each of you
 |Name                  |Value                                                                |Description                                    |
 |------|-------------------------------------------------------------------------------------|-----------------------------------------------|
 |GUID  |
            • **0.** Component isn't hidden.
            • **1.** Component is hidden.
             |Determines whether this is a hidden component. | 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md
index 3363f80ab6..51dc959759 100644
--- a/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md
+++ b/browsers/internet-explorer/ie11-ieak/ie-setup-command-line-options-and-return-codes.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Reference about the command-line options and return codes for Internet Explorer Setup.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 40c23024-cb5d-4902-ad1b-6e8a189a699f
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Internet Explorer Setup command-line options and return codes (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md b/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md
index 0e0ea99ea5..b8c3d25c24 100644
--- a/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md
+++ b/browsers/internet-explorer/ie11-ieak/ieak-information-and-downloads.md
@@ -3,11 +3,14 @@ ms.localizationpriority: medium
 ms.mktglfcycl: support
 ms.pagetype: security
 description: The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. Use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after Internet Explorer deployment.
-author: shortpatti
-ms.author: pashort
+author: dansimp
+ms.author: dansimp
 ms.manager: dougkim
 ms.prod: ie11
-ms.assetid:
+ms.assetid: 
+ms.reviewer: 
+audience: itpro
+manager: dansimp
 title: Internet Explorer Administration Kit (IEAK) information and downloads
 ms.sitesec: library
 ms.date: 05/10/2018
diff --git a/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md b/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md
index 1e17bda2eb..f27ec8b5b9 100644
--- a/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md
+++ b/browsers/internet-explorer/ie11-ieak/ieak11-wizard-custom-options.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: Review the options available to help you customize your browser install packages for deployment to your employee's devices.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 4b804da3-c3ac-4b60-ab1c-99536ff6e31b
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Internet Explorer Administration Kit 11 (IEAK 11) Customization Wizard options (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md b/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md
index c2483af8c4..cd7c730569 100644
--- a/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md
+++ b/browsers/internet-explorer/ie11-ieak/iexpress-command-line-options.md
@@ -2,19 +2,23 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Reference about the command-line options for the IExpress Wizard.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: aa16d738-1067-403c-88b3-bada12cf9752
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: IExpress Wizard command-line options (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
 ---
 
+# IExpress Wizard command-line options
 
 **Applies to:**
 - Windows Server 2008 R2 with SP1
 
-# IExpress Wizard command-line options
 Use command-line options with the IExpress Wizard (IExpress.exe) to control your Internet Explorer custom browser package extraction process. 
 
 These command-line options work with IExpress:
            
diff --git a/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md b/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md
index 235580070d..35dc9f9cc5 100644
--- a/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md
+++ b/browsers/internet-explorer/ie11-ieak/iexpress-wizard-for-win-server.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use the IExpress Wizard on Windows Server 2008 R2 with SP1 to create self-extracting files to run your custom Internet Explorer Setup program.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 5100886d-ec88-4c1c-8cd7-be00da874c57
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: IExpress Wizard for Windows Server 2008 R2 with SP1 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md
index 604489d8fc..022767b179 100644
--- a/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/important-urls-home-page-and-support-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Important URLs - Home Page and Support page in the IEAK 11 Customization Wizard to choose one or more **Home** pages and an online support page for your customized version of IE.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 19e34879-ba9d-41bf-806a-3b9b9b752fc1
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Important URLs - Home Page and Support page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/index.md b/browsers/internet-explorer/ie11-ieak/index.md
index 74c0cbdb1c..3187f8b507 100644
--- a/browsers/internet-explorer/ie11-ieak/index.md
+++ b/browsers/internet-explorer/ie11-ieak/index.md
@@ -1,13 +1,14 @@
 ---
 ms.mktglfcycl: plan
 description: IEAK 11 - Internet Explorer Administration Kit 11 Users Guide
-author: shortpatti
+author: dansimp
+ms.author: dansimp
 ms.prod: ie11
 ms.assetid: 847bd7b4-d5dd-4e10-87b5-4d7d3a99bbac
 title: Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.localizationpriority: medium
-ms.date: 07/27/2017
+manager: dansimp
 ---
 
 
@@ -45,4 +46,4 @@ IE11 and IEAK 11 offers differing experiences between Windows 7 and Windows 8.1
 - [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md)
 - [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md)
 - [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md)
-- [Microsoft Edge - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760643)
\ No newline at end of file
+- [Microsoft Edge - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760643)
diff --git a/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md
index 30e1694ffe..15db2bc20f 100644
--- a/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/internal-install-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Internal Install page in the IEAK 11 Customization Wizard to customize Setup for the default browser and the latest browser updates.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 33d078e3-75b8-455b-9126-f0d272ed676f
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Internal Install page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md
index ba4e23f6df..b625916fd1 100644
--- a/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/isp-security-ins-file-setting.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use the \[ISP_Security\] .INS file setting to add the root certificate for your custom Internet Explorer package.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 4eca2de5-7071-45a2-9c99-75115be00d06
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the ISP_Security .INS file to add your root certificate (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md
index cd6540d994..b2f66781b7 100644
--- a/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/language-selection-ieak11-wizard.md
@@ -1,10 +1,14 @@
 ---
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
-description: How to use the Language Selection page in the IEAK 11 Customization Wizard to choose the lanaguage for your IEAK 11 custom package.
-author: shortpatti
+description: How to use the Language Selection page in the IEAK 11 Customization Wizard to choose the language for your IEAK 11 custom package.
+author: dansimp
 ms.prod: ie11
 ms.assetid: f9d4ab57-9b1d-4cbc-9398-63f4938df1f6
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Language Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md
index 056ef076a4..296dec1688 100644
--- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md
@@ -2,10 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: Learn about the version of the IEAK 11 you should run, based on your license agreement.
-author: pashort
-ms.author: shortpatti
-ms.prod: ie11, ieak11
+author: dansimp
+ms.author: dansimp
+ms.prod: ie11
 ms.assetid: 69d25451-08af-4db0-9daa-44ab272acc15
+ms.reviewer: 
+audience: itpro
+manager: dansimp
 title: Determine the licensing version and features to use in IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 10/23/2018
@@ -15,44 +18,45 @@ ms.date: 10/23/2018
 # Determine the licensing version and features to use in IEAK 11
 In addition to the Software License Terms for the Internet Explorer Administration Kit 11 (IEAK 11, referred to as the "software"), these Guidelines further define how you may and may not use the software to create versions of Internet Explorer 11 with optional customizations (referred to as the "customized browser") for internal use and distribution in accordance with the IEAK 11 Software License Terms. IEAK 11 is for testing purposes only and is not intended to be used in a production environment.
 
-During installation, you must pick a version of IEAK 11, either **External** or **Internal**, based on your license agreement. Your version selection decides the options you can chose, the steps you follow to deploy your Internet Explorer 11 package, and how you manage the browser after deployment.
+During installation, you must pick a version of IEAK 11, either **External** or **Internal**, based on your license agreement. Your version selection decides the options you can chose, the steps you follow to deploy your Internet Explorer 11 package, and how you manage the browser after deployment.
 
 -   **External Distribution as an Internet Service Provider (ISP), Internet Content Provider (ICP), or Developer.** If you are an ISP or an ICP, your license agreement also states that you must show the Internet Explorer logo on your packaging and promotional goods, as well as on your website.
     >[!IMPORTANT]
-    >Original Equipment Manufacturers (OEMs) that install IEAK 11 as part of a Windows product, under an OEM license agreement with Microsoft, must use their appropriate Windows OEM Preinstallation document (OPD) as the guide for allowable customizations.
+    >Original Equipment Manufacturers (OEMs) that install IEAK 11 as part of a Windows product, under an OEM license agreement with Microsoft, must use their appropriate Windows OEM Preinstallation document (OPD) as the guide for allowable customizations.
 
 -   **Internal Distribution via a Corporate Intranet.** This version is for network admins that plan to directly deploy IE11 into a corporate environment.
 
 ## Available features by version
 
-| Feature | Internal | External |
-| ---------------------------------------- | :---------------------------------------------: | :----------------------------------------------: |
-|Welcome screen                            | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|File locations                            | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Platform selection                        | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Language selection                        | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Package type selection                    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Feature selection                         | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Automatic Version Synchronization (AVS)   | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Custom components                         | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Internal install                          | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
-|User experience                           | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
-|Browser user interface                    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Search providers                          | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Important URLs – Home page and support    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Accelerators                              | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Favorites, Favorites bar, and feeds       | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Browsing options                          | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
-|First Run wizard and Welcome page options | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Connection manager                        | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Connection settings                       | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Automatic configuration                   | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
-|Proxy settings                            | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Security and privacy settings             | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
-|Add a root certificate                    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
-|Programs                                  | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
-|Additional settings                       | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
-|Wizard complete                           | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)     |
+|                  Feature                  |                                     Internal                                     |                                       External                                       |
+|-------------------------------------------|:--------------------------------------------------------------------------------:|:------------------------------------------------------------------------------------:|
+|              Welcome screen               | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|              File locations               | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|            Platform selection             | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|            Language selection             | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|          Package type selection           | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|             Feature selection             | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|  Automatic Version Synchronization (AVS)  | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|             Custom components             | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|             Internal install              | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
+|              User experience              | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
+|          Browser user interface           | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|             Search providers              | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|  Important URLs – Home page and support   | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|               Accelerators                | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|    Favorites, Favorites bar, and feeds    | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|             Browsing options              | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
+| First Run wizard and Welcome page options | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|            Connection manager             | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|            Connection settings            | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|          Automatic configuration          | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
+|              Proxy settings               | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|       Security and privacy settings       | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
+|          Add a root certificate           | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
+|                 Programs                  | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+|            Additional settings            | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) | ![Not available](https://docs.microsoft.com/microsoft-edge/deploy/images/148766.png) |
+|              Wizard complete              | ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png) |   ![Available](https://docs.microsoft.com/microsoft-edge/deploy/images/148767.png)   |
+
 ---
 
 
diff --git a/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md
index ff473d6648..a441fe7be2 100644
--- a/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/media-ins-file-setting.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use the \[Media\] .INS file setting to specify the types of media on which your custom install package is available.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: c57bae60-d520-49a9-a77d-da43f7ebe5b8
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Media .INS file to specify your install media (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md
index 19e75dbdca..ce2517bf60 100644
--- a/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/pkg-type-selection-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Package Type Selection page in the IEAK 11 Customization Wizard to pick the media type you’ll use to distribute your custom package.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: dd91f788-d05e-4f45-9fd5-d951abf04f2c
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Package Type Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md
index 9bac11b82d..342ac46d58 100644
--- a/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/platform-selection-ieak11-wizard.md
@@ -2,16 +2,19 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Platform Selection page in the IEAK 11 Customization Wizard to pick the specs for your employee devices that will get the install package.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 9cbf5abd-86f7-42b6-9810-0b606bbe8218
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 title: Use the Platform Selection page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
 ---
 
 
-#  Use the Platform Selection page in the IEAK 11 Wizard
+# Use the Platform Selection page in the IEAK 11 Wizard
 The **Platform Selection** page of the Internet Explorer Customization Wizard 11 lets you pick the operating system and architecture (32-bit or 64-bit) for the devices on which you’re going to install the custom installation package.
 
 **To use the Platform Selection page**
diff --git a/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md b/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md
index d6e16707bd..809110fc8b 100644
--- a/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/prep-network-install-with-ieak11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: Learn about what you need to do before you deploy your custom browser package using IEAK 11 over your network.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 2c66d22a-4a94-47cc-82ab-7274abe1dfd6
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Before you install your package over your network using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md
index 7509c355d2..8b46cc1615 100644
--- a/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/programs-ieak11-wizard.md
@@ -2,16 +2,19 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Programs page in the IEAK 11 Customization Wizard to pick the default programs to use for Internet services.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: f715668f-a50d-4db0-b578-e6526fbfa1fc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 title: Use the Programs page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
 ---
 
 
-#  Use the Programs page in the IEAK 11 Wizard
+# Use the Programs page in the IEAK 11 Wizard
 The **Programs** page of the Internet Explorer Customization Wizard 11 lets you pick the default programs to use for Internet services, like email, contact lists, and newsgroups, by importing settings from your computer.
 
 **Important**
            The customizations you make on this page only apply to Internet Explorer for the desktop.
diff --git a/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md b/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md
index 5e04f4e473..06213a78ae 100644
--- a/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md
+++ b/browsers/internet-explorer/ie11-ieak/proxy-auto-config-examples.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Learn about how to use a proxy auto-configuration (.pac) file to specify an automatic proxy URL.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 6c94708d-71bd-44bd-a445-7e6763b374ae
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use proxy auto-configuration (.pac) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md
index c98971ddef..80e2e5d2c0 100644
--- a/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/proxy-ins-file-setting.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use the \[Proxy\] .INS file setting to define whether to use a proxy server.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 30b03c2f-e3e5-48d2-9007-e3fd632f3c18
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Proxy .INS file to specify a proxy server (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md
index 22252bf546..a99dc70ae0 100644
--- a/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/proxy-settings-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Proxy Settings page in the IEAK 11 Customization Wizard to pick the proxy servers used to connect to required services.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 1fa1eee3-e97d-41fa-a48c-4a6e0dc8b544
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Proxy Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md b/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md
index e0838b0473..c6fb131002 100644
--- a/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/register-uninstall-app-ieak11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Learn how to register an uninstall app for your custom components, using IEAK 11.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 4da1d408-af4a-4c89-a491-d6f005fd5005
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Register an uninstall app for custom components using IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.date: 07/27/2017
 ---
diff --git a/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md b/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md
index 922be0f879..8bf7232c7c 100644
--- a/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/rsop-snapin-for-policy-settings-ieak11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: manage
 description: Learn how to use the Resultant Set of Policy (RSoP) snap-in to view your policy settings.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 0f21b320-e879-4a06-8589-aae6fc264666
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the RSoP snap-in to review policy settings (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md
index 3633d298c1..f66425a743 100644
--- a/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/search-providers-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Search Providers page in the IEAK 11 Customization Wizard to add additional providers and set the default.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 48cfaba5-f4c0-493c-b656-445311b7bc52
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Search Providers page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md b/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md
index fe275274f8..71d99f8b9f 100644
--- a/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/security-and-ieak11.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: plan
 description: Learn about the security features available in Internet Explorer 11 and IEAK 11.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 5b64c9cb-f8da-411a-88e4-fa69dea473e2
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Security features and IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md
index 8da6980597..16ffc69435 100644
--- a/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/security-and-privacy-settings-ieak11-wizard.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: How to use the Security and Privacy Settings page in the IEAK 11 Customization Wizard to manage your security zones, privacy settings, and content ratings.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: cb7cd1df-6a79-42f6-b3a1-8ae467053f82
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Security and Privacy Settings page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md
index a01457ac6c..e65b0e2b77 100644
--- a/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/security-imports-ins-file-setting.md
@@ -2,9 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: deploy
 description: Use the \[Security Imports\] .INS file setting to decide whether to import security info to your custom package.
-author: shortpatti
+author: dansimp
 ms.prod: ie11
 ms.assetid: 19791c44-aaa7-4f37-9faa-85cbdf29f68e
+ms.reviewer: 
+audience: itpro
+manager: dansimp
+ms.author: dansimp
 title: Use the Security Imports .INS file to import security info (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
diff --git a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md
index 8f9826a8b5..7b0db0bbc4 100644
--- a/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md
+++ b/browsers/internet-explorer/ie11-ieak/troubleshooting-custom-browser-pkg-ieak11.md
@@ -2,10 +2,13 @@
 ms.localizationpriority: medium
 ms.mktglfcycl: support
 description: Info about some of the known issues using the Internet Exporer Customization Wizard and a custom Internet Explorer install package.
-author: shortpatti
-ms.author: pashort
+author: dansimp
+ms.author: dansimp
 ms.prod: ie11
 ms.assetid: 9e22cc61-6c63-4cab-bfdf-6fe49db945e4
+ms.reviewer: 
+audience: itpro
+manager: dansimp
 title: Troubleshoot custom package and IEAK 11 problems (Internet Explorer Administration Kit 11 for IT Pros)
 ms.sitesec: library
 ms.date: 07/27/2017
@@ -73,8 +76,8 @@ If you cannot uninstall IE using **Uninstall or change a program** in the Contro
 ## The Internet Explorer Customization Wizard 11 does not work with user names that user double-byte character sets
 The customization wizard does not work with user names that use double-byte character sets, such as Chinese or Japanese. To fix this, set the **TEMP** and **TMP** environmental variables to a path that does not use these characters (for example, C:\temp).
 
-1.	Open **System Properties**, click the **Advanced** tab, and then click **Environmental Variables**.
-2.	Click Edit, and then modify the **TEMP** and **TMP** environmental variables to a non-user profile directory.
+1. Open **System Properties**, click the **Advanced** tab, and then click **Environmental Variables**.
+2. Click Edit, and then modify the **TEMP** and **TMP** environmental variables to a non-user profile directory.
 
  
 ## Unicode characters are not supported in IEAK 11 path names
diff --git a/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md b/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md
index b5ba778a93..965fda174e 100644
--- a/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md
+++ b/browsers/internet-explorer/ie11-ieak/url-ins-file-setting.md
@@ -1,37 +1,40 @@
----
-ms.localizationpriority: medium
-ms.mktglfcycl: deploy
-description: Use the \[URL\] .INS file setting to decide whether to use an auto-configured proxy server.
-author: shortpatti
-ms.prod: ie11
-ms.assetid: 05b09dfa-cf11-408d-92c2-b4ae434a59a7
-title: Use the URL .INS file to use an auto-configured proxy server (Internet Explorer Administration Kit 11 for IT Pros)
-ms.sitesec: library
-ms.date: 07/27/2017
----
-
-
-# Use the URL .INS file to use an auto-configured proxy server
-Info about whether to use an auto-configured proxy server. If yes, this also includes the URLs to the pages that appear when your employees first connect to that server.
-
-|Name |Value |Description |
-|-----|------|------------|
-|AutoConfig |
            • **0.** Don’t automatically configure the browser.
            • **1.** Automatically configure the browser.
             |Determines whether to automatically configure the customized browser on your employee’s device. |
-|AutoConfigJSURL |`` |The URL for the proxy auto-config file (.js or .jvs) |
-|AutoConfigTime |*integer* |Automatically configures the browser on your employee’s device after its run for a specified length of time. |
-|AutoConfigURL |`` |The URL for the proxy auto-config (.pac) file. |
-|FirstHomePage |`` |The page (URL) that appears the first time the custom browser is opened on the employee’s device. |
-|Help_Page |`` |The URL to your internal technical support site. |
-|Home_Page |`` |The URL to your default **Home** page. |
-|NoWelcome |
            • **0.** Display the **Welcome** page.
            • **1.** Don’t display the **Welcome** page.
             |Determines whether to show the **Welcome** page the first time the browser’s used on an employee’s device. |
-|Quick_Link_1 |`` |The URL to your first Quick Link. |
-|Quick_Link_1_Name |`` |The name of the site associated with Quick_Link_1. |
-|Quick_Link_2 |`` |The URL to your second Quick Link. |
-|Quick_Link_2_Name |`` |The name of the site associated with Quick_Link_2. |
-|Quick_Link_X |`` |The URL to another Quick Link. |
-|Quick_Link_X_Icon |`` |A Quick Links icon (.ico) file. |
-|Quick_Link_X_Name |`` |The name of the site associated with another Quick Link. |
-|Quick_Link_X_Offline |
            • **0.** Don’t make the Quick Links available offline.
            • **1.** Make the Quick Links available offline.
             |Determines whether to make the Quick Links available for offline browsing. |
-|Search_Page |`` |The URL to the default search page. |
-|UseLocalIns |
            • **0.** Don’t use a local .ins file.
            • **1.** Use a local .ins file.
             |Determines whether to use a local Internet Settings (.ins) file |
-
+---
+ms.localizationpriority: medium
+ms.mktglfcycl: deploy
+description: Use the \[URL\] .INS file setting to decide whether to use an auto-configured proxy server.
+author: dansimp
+ms.prod: ie11
+ms.assetid: 05b09dfa-cf11-408d-92c2-b4ae434a59a7
+ms.reviewer: 
+audience: itpro
manager: dansimp
+ms.author: dansimp
+title: Use the URL .INS file to use an auto-configured proxy server (Internet Explorer Administration Kit 11 for IT Pros)
+ms.sitesec: library
+ms.date: 07/27/2017
+---
+
+
+# Use the URL .INS file to use an auto-configured proxy server
+Info about whether to use an auto-configured proxy server. If yes, this also includes the URLs to the pages that appear when your employees first connect to that server.
+
+|Name |Value |Description |
+|-----|------|------------|
+|AutoConfig |
            • **0.** Don’t automatically configure the browser.
            • **1.** Automatically configure the browser.
             |Determines whether to automatically configure the customized browser on your employee’s device. |
+|AutoConfigJSURL |`` |The URL for the proxy auto-config file (.js or .jvs) |
+|AutoConfigTime |*integer* |Automatically configures the browser on your employee’s device after its run for a specified length of time. |
+|AutoConfigURL |`` |The URL for the proxy auto-config (.pac) file. |
+|FirstHomePage |`` |The page (URL) that appears the first time the custom browser is opened on the employee’s device. |
+|Help_Page |`` |The URL to your internal technical support site. |
+|Home_Page |`` |The URL to your default **Home** page. |
+|NoWelcome |
            • **0.** Display the **Welcome** page.
            • **1.** Don’t display the **Welcome** page.
             |Determines whether to show the **Welcome** page the first time the browser’s used on an employee’s device. |
+|Quick_Link_1 |`` |The URL to your first Quick Link. |
+|Quick_Link_1_Name |`` |The name of the site associated with Quick_Link_1. |
+|Quick_Link_2 |`` |The URL to your second Quick Link. |
+|Quick_Link_2_Name |`` |The name of the site associated with Quick_Link_2. |
+|Quick_Link_X |`` |The URL to another Quick Link. |
+|Quick_Link_X_Icon |`` |A Quick Links icon (.ico) file. |
+|Quick_Link_X_Name |`` |The name of the site associated with another Quick Link. |
+|Quick_Link_X_Offline |
            • **0.** Don’t make the Quick Links available offline.
            • **1.** Make the Quick Links available offline.
             |Determines whether to make the Quick Links available for offline browsing. |
+|Search_Page |`` |The URL to the default search page. |
+|UseLocalIns |
            • **0.** Don’t use a local .ins file.
            • **1.** Use a local .ins file.
             |Determines whether to use a local Internet Settings (.ins) file |
+
diff --git a/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md
index 425f3e2e60..ed8f2be8f1 100644
--- a/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/user-experience-ieak11-wizard.md
@@ -1,57 +1,60 @@
----
-ms.localizationpriority: medium
-ms.mktglfcycl: deploy
-description: How to use the User Experience page in the IEAK 11 Customization Wizard to decide user interaction with the Setup process.
-author: shortpatti
-ms.prod: ie11
-ms.assetid: d3378058-e4f0-4a11-a888-b550af994bfa
-title: Use the User Experience page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
-ms.sitesec: library
-ms.date: 07/27/2017
----
-
-
-# Use the User Experience page in the IEAK 11 Wizard
-The **User Experience** page of the Internet Explorer Customization Wizard 11 lets you decide how much you want your employees to interact with the custom package’s Setup process.
-
-**Note**
            You’ll only see this page if you are running the **Internal** version of the Internet Explorer Customization Wizard 11.
            The customizations you make on this page only apply to Internet Explorer for the desktop on Windows 7.
-
-**To use the User Experience page**
-
-1.  Choose how your employee should interact with Setup, including:
-
-    -   **Interactive installation**. Lets your employees change installation options while installing your custom package. This experience shows all of the progress and error messages throughout the process.
-
-    -   **Hands-free installation**. Lets you make all of the decisions for your employees. However, they’ll still see all of the progress and error messages throughout the process.
-
-    -   **Completely silent installation**. Lets you make all of the decisions for your employees and hides all of the progress and error messages. Because this mode is completely silent, if the installation fails, your employees won’t know and they won’t be able to run the installation package again.
-    
            Both the hands-free and completely silent installation options will:
-    
-        - Answer prompts so Setup can continue.
-    
-        - Accept the license agreement.
-
-        - Determine that Internet Explorer 11 is installed and not just downloaded.
-
-        - Perform your specific installation type.
-
-        - Install IE in the default location, unless it is already installed. In that case, the new version of the browser is installed in the same location as the previous version.
-
-2.  Choose if your employee’s device will restart at the end of Setup.
-
-    -   **Default**. Prompts your employees to restart after installing IE.
-
-    -   **No restart**. Doesn’t restart the computer after installing IE. The employee will have to manually restart later.
-
-    -   **Force restart**. Automatically restarts the computer after installing IE.
-
-3.  Click **Next** to go to the [Browser User Interface](browser-ui-ieak11-wizard.md) page or **Back** to go to the [Internal Install](internal-install-ieak11-wizard.md) page.
-
- 
-
- 
-
-
-
-
-
+---
+ms.localizationpriority: medium
+ms.mktglfcycl: deploy
+description: How to use the User Experience page in the IEAK 11 Customization Wizard to decide user interaction with the Setup process.
+author: dansimp
+ms.prod: ie11
+ms.assetid: d3378058-e4f0-4a11-a888-b550af994bfa
+ms.reviewer: 
+audience: itpro
manager: dansimp
+ms.author: dansimp
+title: Use the User Experience page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
+ms.sitesec: library
+ms.date: 07/27/2017
+---
+
+
+# Use the User Experience page in the IEAK 11 Wizard
+The **User Experience** page of the Internet Explorer Customization Wizard 11 lets you decide how much you want your employees to interact with the custom package’s Setup process.
+
+**Note**
            You’ll only see this page if you are running the **Internal** version of the Internet Explorer Customization Wizard 11.
            The customizations you make on this page only apply to Internet Explorer for the desktop on Windows 7.
+
+**To use the User Experience page**
+
+1. Choose how your employee should interact with Setup, including:
+
+   - **Interactive installation**. Lets your employees change installation options while installing your custom package. This experience shows all of the progress and error messages throughout the process.
+
+   - **Hands-free installation**. Lets you make all of the decisions for your employees. However, they’ll still see all of the progress and error messages throughout the process.
+
+   - **Completely silent installation**. Lets you make all of the decisions for your employees and hides all of the progress and error messages. Because this mode is completely silent, if the installation fails, your employees won’t know and they won’t be able to run the installation package again.
+     
            Both the hands-free and completely silent installation options will:
+    
+     - Answer prompts so Setup can continue.
+    
+     - Accept the license agreement.
+
+     - Determine that Internet Explorer 11 is installed and not just downloaded.
+
+     - Perform your specific installation type.
+
+     - Install IE in the default location, unless it is already installed. In that case, the new version of the browser is installed in the same location as the previous version.
+
+2. Choose if your employee’s device will restart at the end of Setup.
+
+   -   **Default**. Prompts your employees to restart after installing IE.
+
+   -   **No restart**. Doesn’t restart the computer after installing IE. The employee will have to manually restart later.
+
+   -   **Force restart**. Automatically restarts the computer after installing IE.
+
+3. Click **Next** to go to the [Browser User Interface](browser-ui-ieak11-wizard.md) page or **Back** to go to the [Internal Install](internal-install-ieak11-wizard.md) page.
+
+ 
+
+ 
+
+
+
+
+
diff --git a/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md b/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md
index b3eaeb6c0f..3efd12ffa8 100644
--- a/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md
+++ b/browsers/internet-explorer/ie11-ieak/using-internet-settings-ins-files.md
@@ -1,34 +1,37 @@
----
-ms.localizationpriority: medium
-ms.mktglfcycl: deploy
-description: Info about how to use Internet Settings (.ins) files and the IEAK 11 to configure your custom browser package.
-author: shortpatti
-ms.prod: ie11
-ms.assetid: a24a7cdb-681e-4f34-a53c-6d8383c5f977
-title: Using Internet Settings (.INS) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
-ms.sitesec: library
-ms.date: 07/27/2017
----
-
-
-# Using Internet Settings (.INS) files with IEAK 11
-Use the Internet Settings (.ins) files and the Internet Explorer Administration Kit 11 (IEAK 11) to configure your custom browser and its components. You can create multiple versions of your custom package by customizing copies of this file.
-
-Here's a list of the availble .INS file settings:
-
-|Setting                                  |Description                                                                   |
-|-----------------------------------------|------------------------------------------------------------------------------|
-|[Branding](branding-ins-file-setting.md) |Customize the branding and setup information in your browser package. |
-|[BrowserToolbars](browsertoolbars-ins-file-setting.md) |Customize the appearance of the IE toolbar. |
-|[CabSigning](cabsigning-ins-file-setting.md) |Digital signature information for your programs. |
-|[ConnectionSettings](connectionsettings-ins-file-setting.md) |Info about the networking connection settings used to install your custom package. |
-|[CustomBranding](custombranding-ins-file-setting.md) |URL location to your branding cabinet (.cab) file. |
-|[ExtRegInf](extreginf-ins-file-setting.md) |Names of your Setup information (.inf) files and the installation mode for components. |
-|[FavoritesEx](favoritesex-ins-file-setting.md) |Add a path to your icon file for **Favorites**, decide whether **Favorites** are available offline, and add URLs to each**Favorites** site. |
-|[HideCustom](hidecustom-ins-file-setting.md) |Whether to hide the globally unique identifier (GUID) for each custom component. |
-|[ISP_Security](isp-security-ins-file-setting.md) |The root certificate you’re adding to your custom package. |
-|[Media](media-ins-file-setting.md) |Types of media in which your custom installation package is available. |
-|[Proxy](proxy-ins-file-setting.md) |Whether to use a proxy server. |
-|[Security Imports](security-imports-ins-file-setting.md) |Whether to import security information for your custom package. |
-|[URL](url-ins-file-setting.md) |Whether to use an auto-configured proxy server. |
-
+---
+ms.localizationpriority: medium
+ms.mktglfcycl: deploy
+description: Info about how to use Internet Settings (.ins) files and the IEAK 11 to configure your custom browser package.
+author: dansimp
+ms.prod: ie11
+ms.assetid: a24a7cdb-681e-4f34-a53c-6d8383c5f977
+ms.reviewer: 
+audience: itpro
manager: dansimp
+ms.author: dansimp
+title: Using Internet Settings (.INS) files with IEAK 11 (Internet Explorer Administration Kit 11 for IT Pros)
+ms.sitesec: library
+ms.date: 07/27/2017
+---
+
+
+# Using Internet Settings (.INS) files with IEAK 11
+Use the Internet Settings (.ins) files and the Internet Explorer Administration Kit 11 (IEAK 11) to configure your custom browser and its components. You can create multiple versions of your custom package by customizing copies of this file.
+
+Here's a list of the available .INS file settings:
+
+|Setting                                  |Description                                                                   |
+|-----------------------------------------|------------------------------------------------------------------------------|
+|[Branding](branding-ins-file-setting.md) |Customize the branding and setup information in your browser package. |
+|[BrowserToolbars](browsertoolbars-ins-file-setting.md) |Customize the appearance of the IE toolbar. |
+|[CabSigning](cabsigning-ins-file-setting.md) |Digital signature information for your programs. |
+|[ConnectionSettings](connectionsettings-ins-file-setting.md) |Info about the networking connection settings used to install your custom package. |
+|[CustomBranding](custombranding-ins-file-setting.md) |URL location to your branding cabinet (.cab) file. |
+|[ExtRegInf](extreginf-ins-file-setting.md) |Names of your Setup information (.inf) files and the installation mode for components. |
+|[FavoritesEx](favoritesex-ins-file-setting.md) |Add a path to your icon file for **Favorites**, decide whether **Favorites** are available offline, and add URLs to each**Favorites** site. |
+|[HideCustom](hidecustom-ins-file-setting.md) |Whether to hide the globally unique identifier (GUID) for each custom component. |
+|[ISP_Security](isp-security-ins-file-setting.md) |The root certificate you’re adding to your custom package. |
+|[Media](media-ins-file-setting.md) |Types of media in which your custom installation package is available. |
+|[Proxy](proxy-ins-file-setting.md) |Whether to use a proxy server. |
+|[Security Imports](security-imports-ins-file-setting.md) |Whether to import security information for your custom package. |
+|[URL](url-ins-file-setting.md) |Whether to use an auto-configured proxy server. |
+
diff --git a/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md b/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md
index 2754da89f4..5e8b4e979e 100644
--- a/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md
+++ b/browsers/internet-explorer/ie11-ieak/what-ieak-can-do-for-you.md
@@ -1,66 +1,68 @@
----
-ms.localizationpriority: medium
-ms.mktglfcycl: support
-ms.pagetype: security
-description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions.
-author: shortpatti
-ms.author: pashort
-ms.manager: elizapo
-ms.prod: ie11
-ms.assetid: 
-title: What IEAK can do for you
-ms.sitesec: library
-ms.date: 05/10/2018
----
-
-# What IEAK can do for you
-
-Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. 
-
-IEAK 10 and newer includes the ability to install using one of the following installation modes:
-
--   Internal
-
--   External
-
-## IEAK 11 users
-Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions.
-
-IEAK 10 and newer includes the ability to install using one of the following installation modes:
-- Internal
-- External
-
->[!NOTE]
->IEAK 11 works in network environments, with or without Microsoft Active Directory service.
-
-
-### Corporations
-IEAK helps corporate administrators establish version control, centrally distribute and manage browser installation, configure automatic connection profiles, and customize large portions of Internet Explorer, including features, security, communications settings, and other important functionality.
-
-Corporate administrators install IEAK using Internal mode (for Internet Explorer 10 or newer) or Corporate mode (for Internet Explorer 9 or older).
-
-### Internet service providers
-IEAK helps ISPs customize, deploy and distribute, add third-party add-ons, search providers, and custom components, as well as include web slices and accelerators all as part of a custom Internet Explorer installation package.
-
-ISPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Service Provider (ISP) mode (for Internet Explorer 9 or older).
-
-### Internet content providers
-IEAK helps ICPs customize the appearance of Internet Explorer and its Setup program, including letting you add your company name or specific wording to the Title bar, set up a customer support webpage, set up the user home page and search providers, add links to the Favorites and the Explorer bars, add optional components, web slices and accelerators, and determine which compatibility mode Internet Explorer should use.
-
-ICPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older)
-
-### Independent software vendors
-IEAK helps ISVs distribute (and redistribute) a custom version of Internet Explorer that can include custom components, programs, and controls (like the web browser control) that you create for your users. ISVs can also determine home pages, search providers, and add websites to the Favorites bar.
-
-ISVs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older).
-
-## Additional resources
-
-- [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md)
-- [Download IEAK 11](ieak-information-and-downloads.md) 
-- [IEAK 11 overview](index.md)
-- [IEAK 11 administrators guide](https://docs.microsoft.com/internet-explorer/ie11-ieak/index)
-- [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md)
-- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md)
-- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md)
-- [Microsoft Edge - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760643)
\ No newline at end of file
+---
+ms.localizationpriority: medium
+ms.mktglfcycl: support
+ms.pagetype: security
+description: Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions.
+author: dansimp
+ms.author: dansimp
+ms.manager: elizapo
+ms.prod: ie11
+ms.assetid: 
+ms.reviewer: 
+audience: itpro
manager: dansimp
+title: What IEAK can do for you
+ms.sitesec: library
+ms.date: 05/10/2018
+---
+
+# What IEAK can do for you
+
+Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions. 
+
+IEAK 10 and newer includes the ability to install using one of the following installation modes:
+
+-   Internal
+
+-   External
+
+## IEAK 11 users
+Internet Explorer Administration Kit (IEAK) helps corporations, Internet service providers (ISPs), Internet content providers (ICPs), and independent software vendors (ISVs) to deploy and manage web-based solutions.
+
+IEAK 10 and newer includes the ability to install using one of the following installation modes:
+- Internal
+- External
+
+>[!NOTE]
+>IEAK 11 works in network environments, with or without Microsoft Active Directory service.
+
+
+### Corporations
+IEAK helps corporate administrators establish version control, centrally distribute and manage browser installation, configure automatic connection profiles, and customize large portions of Internet Explorer, including features, security, communications settings, and other important functionality.
+
+Corporate administrators install IEAK using Internal mode (for Internet Explorer 10 or newer) or Corporate mode (for Internet Explorer 9 or older).
+
+### Internet service providers
+IEAK helps ISPs customize, deploy and distribute, add third-party add-ons, search providers, and custom components, as well as include web slices and accelerators all as part of a custom Internet Explorer installation package.
+
+ISPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Service Provider (ISP) mode (for Internet Explorer 9 or older).
+
+### Internet content providers
+IEAK helps ICPs customize the appearance of Internet Explorer and its Setup program, including letting you add your company name or specific wording to the Title bar, set up a customer support webpage, set up the user home page and search providers, add links to the Favorites and the Explorer bars, add optional components, web slices and accelerators, and determine which compatibility mode Internet Explorer should use.
+
+ICPs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older)
+
+### Independent software vendors
+IEAK helps ISVs distribute (and redistribute) a custom version of Internet Explorer that can include custom components, programs, and controls (like the web browser control) that you create for your users. ISVs can also determine home pages, search providers, and add websites to the Favorites bar.
+
+ISVs install IEAK using External mode (for Internet Explorer 10 or newer) or Internet Content Provider (ICP) mode (for Internet Explorer 9 or older).
+
+## Additional resources
+
+- [IEAK 11 - Frequently Asked Questions](../ie11-faq/faq-ieak11.md)
+- [Download IEAK 11](ieak-information-and-downloads.md) 
+- [IEAK 11 overview](index.md)
+- [IEAK 11 administrators guide](https://docs.microsoft.com/internet-explorer/ie11-ieak/index)
+- [IEAK 11 licensing guidelines](licensing-version-and-features-ieak11.md)
+- [Internet Explorer 11 - FAQ for IT Pros](../ie11-faq/faq-for-it-pros-ie11.md)
+- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md)
+- [Microsoft Edge - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760643)
diff --git a/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md b/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md
index aa88edcfee..e81b0eedea 100644
--- a/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md
+++ b/browsers/internet-explorer/ie11-ieak/wizard-complete-ieak11-wizard.md
@@ -1,28 +1,31 @@
----
-ms.localizationpriority: medium
-ms.mktglfcycl: deploy
-description: How to use the Wizard Complete - Next Steps page in the IEAK 11 Customization Wizard to build your custom Internet Explorer install package.
-author: shortpatti
-ms.prod: ie11
-ms.assetid: aaaac88a-2022-4d0b-893c-b2404b45cabc
-title: Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
-ms.sitesec: library
-ms.date: 07/27/2017
----
-
-
-# Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard
-The **Wizard Complete – Next Steps** page of the Internet Explorer Customization Wizard 11 lets you build your custom installation package, after you click **Finish**.
-
-In most cases, your next steps will be to prepare your files for installation from your network or from another distribution method. If you haven’t already done it, you’ll need to digitally sign any program or .cab files that are going to be distributed over the Internet or over an intranet that isn’t configured to allow downloads.
-
-After that, the steps you’ll use to distribute your customized browser will vary, depending on your version of IEAK (Internal or External) and the media you’re using to distribute the package. For more information, see the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md).
-
- 
-
- 
-
-
-
-
-
+---
+ms.localizationpriority: medium
+ms.mktglfcycl: deploy
+description: How to use the Wizard Complete - Next Steps page in the IEAK 11 Customization Wizard to build your custom Internet Explorer install package.
+author: dansimp
+ms.prod: ie11
+ms.assetid: aaaac88a-2022-4d0b-893c-b2404b45cabc
+ms.reviewer: 
+audience: itpro
manager: dansimp
+ms.author: dansimp
+title: Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard (Internet Explorer Administration Kit 11 for IT Pros)
+ms.sitesec: library
+ms.date: 07/27/2017
+---
+
+
+# Use the Wizard Complete - Next Steps page in the IEAK 11 Wizard
+The **Wizard Complete – Next Steps** page of the Internet Explorer Customization Wizard 11 lets you build your custom installation package, after you click **Finish**.
+
+In most cases, your next steps will be to prepare your files for installation from your network or from another distribution method. If you haven’t already done it, you’ll need to digitally sign any program or .cab files that are going to be distributed over the Internet or over an intranet that isn’t configured to allow downloads.
+
+After that, the steps you’ll use to distribute your customized browser will vary, depending on your version of IEAK (Internal or External) and the media you’re using to distribute the package. For more information, see the [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](../ie11-deploy-guide/index.md).
+
+ 
+
+ 
+
+
+
+
+
diff --git a/browsers/internet-explorer/index.md b/browsers/internet-explorer/index.md
index c2dbda0086..6c3085d888 100644
--- a/browsers/internet-explorer/index.md
+++ b/browsers/internet-explorer/index.md
@@ -1,8 +1,9 @@
 ---
 ms.mktglfcycl: deploy
 description: The landing page for IE11 that lets you access the documentation.
-author: shortpatti
-ms.prod: IE11
+author: dansimp
+ms.author: dansimp
+ms.prod: ie11
 title: Internet Explorer 11 (IE11) (Internet Explorer 11 for IT Pros)
 assetid: be3dc32e-80d9-4d9f-a802-c7db6c50dbe0
 ms.sitesec: library
diff --git a/browsers/internet-explorer/internet-explorer.yml b/browsers/internet-explorer/internet-explorer.yml
index c9b14b03a2..4c11b5c85e 100644
--- a/browsers/internet-explorer/internet-explorer.yml
+++ b/browsers/internet-explorer/internet-explorer.yml
@@ -33,7 +33,7 @@ sections:
   - type: markdown
     text: "
       Find information and tips to help you assess compatibility and prioritize processes as you plan for Internet Explorer 11.
             
-      
+      

            **Get started with compatibility**
            Find out how to extend your company's investment in older web apps through higher compatibility with older rendering engines while moving forward to a more modern browser like Internet Explorer 11.
            What is Enterprise Mode?
            Tips and tricks to manage Internet Explorer compatibility
            Download the Enterprise Site Discovery Toolkit
            Collect data using Enterprise Site Discovery
            Manage Windows upgrades with Upgrade Readiness
            Demo: Plan and manage Windows 10 upgrades and feature updates with Upgrade Readiness
            **Using Enterprise Mode**
            Learn how to avoid the commom compatibility problems associated with web apps written and tested on older versions of Internet Explorer by using Enterprise Mode.
            Turn on Enterprise Mode and use a site list
            Add sites to the Enterprise Mode site list
            Edit the Enterprise Mode site list
            Turn on local control and logging for Enterprise Mode

            **Get started with compatibility**
            Find out how to extend your company's investment in older web apps through higher compatibility with older rendering engines while moving forward to a more modern browser like Internet Explorer 11.
            What is Enterprise Mode?
            Tips and tricks to manage Internet Explorer compatibility
            Download the Enterprise Site Discovery Toolkit
            Collect data using Enterprise Site Discovery
            Manage Windows upgrades with Upgrade Readiness
            Demo: Plan and manage Windows 10 upgrades and feature updates with Upgrade Readiness
            **Using Enterprise Mode**
            Learn how to avoid the common compatibility problems associated with web apps written and tested on older versions of Internet Explorer by using Enterprise Mode.
            Turn on Enterprise Mode and use a site list
            Add sites to the Enterprise Mode site list
            Edit the Enterprise Mode site list
            Turn on local control and logging for Enterprise Mode
            
       
            
       "
 - title: Deploy
@@ -41,7 +41,7 @@ sections:
   - type: markdown
     text: "
       Find the resources you need to successfully deploy Internet Explorer 11 in your organization. 
             
-      
+      

            **Customize Internet Explorer 11**
            The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after deployment.
            Download IEAK 11
            IEAK 11 user's guide
            Frequently asked questions about IEAK 11
            Customization and distribution guidelines
            **Install Internet Explorer 11**
            Explore the different options for installation.
            Through Automatic Updates (recommended)
            As part of an operating system deployment
            Over the network
            With System Center 2012 R2 Configuration Manager
            With Windows Server Update Services (WSUS)
            With Microsoft Intune
            With third-party tools

            **Customize Internet Explorer 11**
            The Internet Explorer Administration Kit (IEAK) simplifies the creation, deployment, and management of customized Internet Explorer packages. You can use the IEAK to configure the out-of-box Internet Explorer experience or to manage user settings after deployment.
            Download IEAK 11
            IEAK 11 user's guide
            Frequently asked questions about IEAK 11
            Customization and distribution guidelines
            **Install Internet Explorer 11**
            Explore the different options for installation.
            Through Automatic Updates (recommended)
            As part of an operating system deployment
            Over the network
            With System Center 2012 R2 Configuration Manager
            With Windows Server Update Services (WSUS)
            With Microsoft Intune
            With third-party tools
            
       
            
       "
 - title: Manage
@@ -49,7 +49,7 @@ sections:
   - type: markdown
     text: "
       Find everything you need to manage Internet Explorer 11 effectively in your organization. Get information on Group Policy, blocked out-of-date ActiveX controls, scripts, and more. 
             
-      
+      

            **Enforce settings with Group Policy**
            Learn how to use Group Policy to enforce settings on the computers in your organization.
            Group Policy for beginners
            New Group Policy settings for IE11
            Administrative templates for IE11
            **Standardize with Group Policy preferences**
            Group Policy preferences simplify deployment and standardize configurations, but unlike Group Policy, they can later be changed by users.
            Group Policy preferences for IE11
            Configure Group Policy preferences

            **Blocked out-of-date ActiveX controls**
            Find out more about the out-of-date ActiveX control blocking security feature available in Internet Explorer.
            Blocked out-of-date ActiveX controls
            Out-of-date ActiveX control blocking
            Update to block out-of-date ActiveX controls in Internet Explorer
            **Scripts for IT professionals**
            Find scripts to help you save time and automate common tasks.
            Batch loop: Check is a process running, if yes, wait in loop
            Script to join user to AD with automatic Local user Profile Migration
            Find-IE Citrix receiver Version
            See all scripts

            **Enforce settings with Group Policy**
            Learn how to use Group Policy to enforce settings on the computers in your organization.
            Group Policy for beginners
            New Group Policy settings for IE11
            Administrative templates for IE11
            **Standardize with Group Policy preferences**
            Group Policy preferences simplify deployment and standardize configurations, but unlike Group Policy, they can later be changed by users.
            Group Policy preferences for IE11
            Configure Group Policy preferences

            **Blocked out-of-date ActiveX controls**
            Find out more about the out-of-date ActiveX control blocking security feature available in Internet Explorer.
            Blocked out-of-date ActiveX controls
            Out-of-date ActiveX control blocking
            Update to block out-of-date ActiveX controls in Internet Explorer
            **Scripts for IT professionals**
            Find scripts to help you save time and automate common tasks.
            Batch loop: Check is a process running, if yes, wait in loop
            Script to join user to AD with automatic Local user Profile Migration
            Find-IE Citrix receiver Version
            See all scripts
            
       
            
       "
 - title: Support
diff --git a/browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md b/browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md
new file mode 100644
index 0000000000..0031c6792e
--- /dev/null
+++ b/browsers/internet-explorer/kb-support/clear-ie-cache-from-command-line.md
@@ -0,0 +1,137 @@
+---
+title: Clear the Internet Explorer cache from a command line
+description: Introduces command-line commands and a sample batch file for clearing the IE cache.
+audience: ITPro
+manager: msmets
+author: ramakoni1
+ms.author: ramakoni
+ms.reviewer: ramakoni, DEV_Triage
+ms.prod: internet-explorer
+ms.technology:
+ms.topic: kb-support
+ms.custom: CI=111020
+ms.localizationpriority: Normal
+# localization_priority: medium
+# ms.translationtype: MT
+ms.date: 01/23/2020
+---
+# How to clear Internet Explorer cache by using the command line
+
+This article outlines the procedure to clear the Internet Explorer cache by using the command line.
+
+## Command line commands to clear browser cache
+
+1. Delete history from the Low folder  
+   `del /s /q C:\Users\\%username%\AppData\Local\Microsoft\Windows\History\low\* /ah`
+
+2. Delete history  
+   `RunDll32.exe InetCpl.cpl, ClearMyTracksByProcess 1`
+
+3. Delete cookies  
+   `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2`
+
+4. Delete temporary internet files  
+   `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8`
+
+5. Delete form data  
+   `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 16`
+
+6. Delete stored passwords  
+   `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 32`
+
+7. Delete all  
+   `RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255`
+
+8. Delete files and settings stored by add-ons  
+   `InetCpl.cpl,ClearMyTracksByProcess 4351`
+
+If you upgraded from a previous version of Internet Explorer, you have to use the following commands to delete the files from older versions:  
+`RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 9`
+
+Command to reset Internet Explorer settings:  
+`Rundll32.exe inetcpl.cpl ResetIEtoDefaults`
+
+## Sample batch file to clear Internet Explorer cache files
+
+A sample batch file is available that you can use to clear Internet Explorer cache files and other items. You can download the file from [https://msdnshared.blob.core.windows.net/media/2017/09/ClearIE_Cache.zip](https://msdnshared.blob.core.windows.net/media/2017/09/ClearIE_Cache.zip).
+
+The batch file offers the following options:
+
+- Delete Non-trusted web History (low-level hidden cleanup)
+- Delete History
+- Delete Cookies
+- Delete Temporary Internet Files
+- Delete Form Data
+- Delete Stored Passwords
+- Delete All
+- Delete All "Also delete files and settings stored by add-ons"
+- Delete IE10 and IE9 Temporary Internet Files
+- Resets IE Settings
+- EXIT
+
+**Contents of the batch file**
+
+```console
+@echo off
+::  AxelR Test Batch
+::  tested on Windows 8 + IE10, Windows7 + IE9
+
+:home
+cls
+COLOR 00
+echo Delete IE History
+echo Please select the task you wish to run.
+echo Pick one:
+echo.
+echo  1. Delete Non-trusted web History(low level hidden clean up)
+echo  2. Delete History
+echo  3. Delete Cookies
+echo  4. Delete Temporary Internet Files
+echo  5. Delete Form Data
+echo  6. Delete Stored Passwords
+echo  7. Delete All
+echo  8. Delete All "Also delete files and settings stored by add-ons"
+echo  9. Delete IE10 and 9 Temporary Internet Files
+echo  10. Reset IE Settings
+echo  77. EXIT
+:choice
+Echo Hit a number [1-10] and press enter.
+set /P CH=[1-10]
+
+if "%CH%"=="1" set x=del /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\History\low\* /ah
+if "%CH%"=="2" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1
+if "%CH%"=="3" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2
+if "%CH%"=="4" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8
+if "%CH%"=="5" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 16
+if "%CH%"=="6" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 32
+if "%CH%"=="7" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255
+if "%CH%"=="8" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 4351
+if "%CH%"=="9" set x=RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 9
+if "%CH%"=="10" set x=rundll32.exe inetcpl.cpl ResetIEtoDefaults
+if "%CH%"=="77" goto quit
+
+%x%
+
+goto Home
+
+::Temporary Internet Files > Delete files - To delete copies of web pages, images, and media
+::that  are saved for faster viewing.
+::Cookies > Delete cookies - To delete cookies, which are files that are stored on your computer by
+::websites to save preferences such as login information.
+::History > Delete history - To delete the history of the websites you have visited.
+::Form data > Delete forms - To delete all the saved information that you have typed into
+::forms.
+::Passwords > Delete passwords - To delete all the passwords that are automatically filled in
+::when you log on to a website that you've previously visited.
+::Delete all - To delete all of these listed items in one operation.
+
+::enter below in search/run to see Low  history dir if exists
+::C:\Users\%username%\AppData\Local\Microsoft\Windows\History\low
+
+::Delete all low (untrusted history) very hidden
+::this will clean any unlocked  files under the dir and not delete the dir structure
+::del /s /q low\* /ah ::del /s /q C:\Users\%username%\AppData\Local\Microsoft\Windows\History\low\* /ah
+
+goto Home
+:quit
+```
diff --git a/browsers/internet-explorer/kb-support/ie-edge-faqs.md b/browsers/internet-explorer/kb-support/ie-edge-faqs.md
new file mode 100644
index 0000000000..ef07a2a337
--- /dev/null
+++ b/browsers/internet-explorer/kb-support/ie-edge-faqs.md
@@ -0,0 +1,222 @@
+---
+title: IE and Microsoft Edge FAQ for IT Pros
+description: Describes frequently asked questions about Internet Explorer and Microsoft Edge for IT professionals.
+audience: ITPro
+manager: msmets
+author: ramakoni1
+ms.author: ramakoni
+ms.reviewer: ramakoni, DEV_Triage
+ms.prod: internet-explorer
+ms.technology:
+ms.topic: kb-support
+ms.custom: CI=111020
+ms.localizationpriority: Normal
+# localization_priority: medium
+# ms.translationtype: MT
+ms.date: 01/23/2020
+---
+# Internet Explorer and Microsoft Edge frequently asked questions (FAQ) for IT Pros
+
+## Cookie-related questions
+
+### What is a cookie?
+
+An HTTP cookie (the web cookie or browser cookie) is a small piece of data that a server sends to the user's web browser. The web browser may store the cookie and return it to the server together with the next request. For example, a cookie might be used to indicate whether two requests come from the same browser in order to allow the user to remain logged-in. The cookie records stateful information for the stateless HTTP protocol.
+
+### How does Internet Explorer handle cookies?
+
+For more information about how Internet Explorer handles cookies, see the following articles:
+
+- [Beware Cookie Sharing in Cross-Zone Scenarios](https://blogs.msdn.microsoft.com/ieinternals/2011/03/10/beware-cookie-sharing-in-cross-zone-scenarios/)
+- [A Quick Look at P3P](https://blogs.msdn.microsoft.com/ieinternals/2013/09/17/a-quick-look-at-p3p/)
+- [Internet Explorer Cookie Internals FAQ](https://blogs.msdn.microsoft.com/ieinternals/2009/08/20/internet-explorer-cookie-internals-faq/)
+- [Privacy Beyond Blocking Cookies](https://blogs.msdn.microsoft.com/ie/2008/08/25/privacy-beyond-blocking-cookies-bringing-awareness-to-third-party-content/)
+- [Description of Cookies](https://support.microsoft.com/help/260971/description-of-cookies)
+
+### Where does Internet Explorer store cookies?
+
+To see where Internet Explorer stores its cookies, follow these steps:
+
+1. Start File Explorer.
+2. Select **Views** \> **Change folder and search options**.
+3. In the **Folder Options** dialog box, select **View**.
+4. In **Advanced settings**, select **Do not show hidden files, folders, or drivers**.
+5. Clear **Hide protected operation system files (Recommended)**.
+6. Select **Apply**.
+7. Select **OK**.
+
+The following are the folder locations where the cookies are stored:
+
+**In Windows 10**  
+C:\Users\username\AppData\Local\Microsoft\Windows\INetCache
+
+**In Windows 8 and Windows 8.1**  
+C:\Users\username\AppData\Local\Microsoft\Windows\INetCookies
+
+**In Windows 7**  
+C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies  
+C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies\Low
+
+### What is the per-domain cookie limit?
+
+Since the June 2018 cumulative updates for Internet Explorer and Microsoft Edge, the per-domain cookie limit is increased from 50 to 180 for both browsers. The cookies vary by path. So, if the same cookie is set for the same domain but for different paths, it's essentially a new cookie.
+
+There's still a 5 Kilobytes (KB) limit on the size of the cookie header that is sent out. This limit can cause some cookies to be lost after they exceed that value.
+
+The JavaScript limitation was updated to 10 KB from 4 KB.
+
+For more information, see [Internet Explorer Cookie Internals (FAQ)](https://blogs.msdn.microsoft.com/ieinternals/2009/08/20/internet-explorer-cookie-internals-faq/).
+
+#### Additional information about cookie limits
+
+**What does the Cookie RFC allow?**  
+RFC 2109 defines how cookies should be implemented, and it defines minimum values that browsers support. According to the RFC, browsers would ideally have no limits on the size and number of cookies that a browser can handle. To meet the specifications, the user agent should support the following:
+
+- At least 300 cookies total
+- At least 20 cookies per unique host or domain name
+
+For practicality, individual browser makers set a limit on the total number of cookies that any one domain or unique host can set. They also limit the total number of cookies that can be stored on a computer.
+
+### Cookie size limit per domain
+
+Some browsers also limit the amount of space that any one domain can use for cookies. This means that if your browser sets a limit of 4,096 bytes per domain for cookies, 4,096 bytes is the maximum available space in that domain even though you can set up to 180 cookies.
+
+## Proxy Auto Configuration (PAC)-related questions
+
+### Is an example Proxy Auto Configuration (PAC) file available?
+
+Here is a simple PAC file:
+
+```vb
+function FindProxyForURL(url, host)
+{
+ return "PROXY proxyserver:portnumber";
+}
+```
+
+> [!NOTE]
+> The previous PAC always returns the **proxyserver:portnumber** proxy.
+
+For more information about how to write a PAC file and about the different functions in a PAC file, see [the FindProxyForURL website](https://findproxyforurl.com/).
+
+**Third-party information disclaimer**  
+The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.
+
+### How to improve performance by using PAC scripts
+
+- [Browser is slow to respond when you use an automatic configuration script](https://support.microsoft.com/help/315810/browser-is-slow-to-respond-when-you-use-an-automatic-configuration-scr)
+- [Optimizing performance with automatic Proxyconfiguration scripts (PAC)](https://blogs.msdn.microsoft.com/askie/2014/02/07/optimizing-performance-with-automatic-proxyconfiguration-scripts-pac/)
+
+## Other questions
+
+### How to set home and start pages in Microsoft Edge and allow user editing
+
+For more information, see the following blog article:
+
+[How do I set the home page in Microsoft Edge?](https://blogs.msdn.microsoft.com/askie/2017/10/04/how-do-i-set-the-home-page-in-edge/)
+
+### How to add sites to the Enterprise Mode (EMIE) site list
+
+For more information about how to add sites to an EMIE list, see [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool).
+
+### What is Content Security Policy (CSP)?
+
+By using [Content Security Policy](https://docs.microsoft.com/microsoft-edge/dev-guide/security/content-security-policy), you create an allow list of sources of trusted content in the HTTP headers. You also pre-approve certain servers for content that is loaded into a webpage, and instruct the browser to execute or render only resources from those sources. You can use this technique to prevent malicious content from being injected into sites.
+
+Content Security Policy is supported in all versions of Microsoft Edge. It lets web developers lock down the resources that can be used by their web application. This helps prevent [cross-site scripting](https://en.wikipedia.org/wiki/Cross-site_scripting) attacks that remain a common vulnerability on the web. However, the first version of Content Security Policy was difficult to implement on websites that used inline script elements that either pointed to script sources or contained script directly.
+
+CSP2 makes these scenarios easier to manage by adding support for nonces and hashes for script and style resources. A nonce is a cryptographically strong random value that is generated on each page load that appears in both the CSP policy and in the script tags on the page. Using nonces can help minimize the need to maintain a list of allowed source URL values while also allowing trusted scripts that are declared in script elements to run.
+
+For more information, see the following articles:
+
+- [Introducing support for Content Security Policy Level 2](https://blogs.windows.com/msedgedev/2017/01/10/edge-csp-2/)
+- [Content Security Policy](https://en.wikipedia.org/wiki/Content_Security_Policy)
+
+### Where to find Internet Explorer security zones registry entries
+
+Most of the Internet Zone entries can be found in [Internet Explorer security zones registry entries for advanced users](https://support.microsoft.com/help/182569/internet-explorer-security-zones-registry-entries-for-advanced-users).
+
+This article was written for Internet Explorer 6 but is still applicable to Internet Explorer 11.
+
+The default Zone Keys are stored in the following locations:
+
+- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
+- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
+
+### Why don't HTML5 videos play in Internet Explorer 11?
+
+To play HTML5 videos in the Internet Zone, use the default settings or make sure that the registry key value of **2701** under **Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3** is set to **0**.
+
+- 0 (the default value): Allow
+- 3: Disallow
+
+This key is read by the **URLACTION\_ALLOW\_AUDIO\_VIDEO 0x00002701** URL action flag that determines whether media elements (audio and video) are allowed in pages in a URL security zone.
+
+For more information, see [Unable to play HTML5 Videos in IE](https://blogs.msdn.microsoft.com/askie/2014/12/31/unable-to-play-html5-videos-in-ie/).
+
+For Windows 10 N and Windows KN editions, you must also download the feature pack that is discussed in [Media feature pack for Windows 10 N and Windows 10 KN editions](https://support.microsoft.com/help/3010081/media-feature-pack-for-windows-10-n-and-windows-10-kn-editions).
+
+For more information about how to check Windows versions, see [Which version of Windows operating system am I running?](https://support.microsoft.com/help/13443/windows-which-version-am-i-running)
+
+### What is the Enterprise Mode Site List Portal?
+
+This is a new feature to add sites to your enterprise mode site list XML. For more information, see [Enterprise Mode Site List Portal](https://github.com/MicrosoftEdge/enterprise-mode-site-list-portal).
+
+### What is Enterprise Mode Feature?
+
+For more information about this topic, see [Enterprise Mode and the Enterprise Mode Site List](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode).
+
+### Where can I obtain a list of HTTP Status codes?
+
+For information about this list, see [HTTP Status Codes](https://docs.microsoft.com/windows/win32/winhttp/http-status-codes).
+
+### What is end of support for Internet Explorer 11?
+
+Internet Explorer 11 is the last major version of Internet Explorer. Internet Explorer 11 will continue receiving security updates and technical support for the lifecycle of the version of Windows on which it is installed.
+
+For more information, see [Lifecycle FAQ — Internet Explorer and Edge](https://support.microsoft.com/help/17454/lifecycle-faq-internet-explorer).
+
+### How to configure TLS (SSL) for Internet Explorer
+
+For more information about how to configure TLS/SSL for Internet Explorer, see [Group Policy Setting to configure TLS/SSL](https://gpsearch.azurewebsites.net/#380).
+
+### What is Site to Zone?
+
+Site to Zone usually refers to one of the following:
+
+**Site to Zone Assignment List**  
+This is a Group Policy policy setting that can be used to add sites to the various security zones.
+
+The Site to Zone Assignment List policy setting associates sites to zones by using the following values for the Internet security zones:
+
+- Intranet zone
+- Trusted Sites zone
+- Internet zone
+- Restricted Sites zone
+
+If you set this policy setting to **Enabled**, you can enter a list of sites and their related zone numbers. By associating a site to a zone, you can make sure that the security settings for the specified zone are applied to the site.
+
+**Site to Zone Mapping**  
+Site to Zone Mapping is stored as the name of the key. The protocol is a registry value that has a number that assigns it to the corresponding zone. Internet Explorer will read from the following registry subkeys for the sites that are deployed through the Site to Zone assignment list:
+
+- HKEY\_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
+- HKEY\_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapKey
+
+**Site to Zone Assignment List policy**  
+This policy setting is available for both Computer Configuration and User Configuration:
+
+- Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page
+- User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page
+
+**References**  
+[How to configure Internet Explorer security zone sites using group polices](https://blogs.msdn.microsoft.com/askie/2012/06/05/how-to-configure-internet-explorer-security-zone-sites-using-group-polices/)
+
+### What are the limits for MaxConnectionsPerServer, MaxConnectionsPer1_0Server for the current versions of Internet Explorer?
+
+For more information about these settings and limits, see [Connectivity Enhancements in Windows Internet Explorer 8](https://docs.microsoft.com/previous-versions/cc304129(v=vs.85)).
+
+### What is the MaxConnectionsPerProxy setting, and what are the maximum allowed values for this setting?
+
+The **MaxConnectionsPerProxy** setting controls the number of connections that a single-user client can maintain to a given host by using a proxy server.
+
+For more information, see [Understanding Connection Limits and New Proxy Connection Limits in WinInet and Internet Explorer](https://blogs.msdn.microsoft.com/jpsanders/2009/06/29/understanding-connection-limits-and-new-proxy-connection-limits-in-wininet-and-internet-explorer/).
diff --git a/devices/hololens/TOC.md b/devices/hololens/TOC.md
index b314f85b52..d1c0ab596f 100644
--- a/devices/hololens/TOC.md
+++ b/devices/hololens/TOC.md
@@ -1,16 +1,69 @@
-# [Microsoft HoloLens](index.md)
-## [What's new in Microsoft HoloLens](hololens-whats-new.md)
-## [HoloLens in the enterprise: requirements and FAQ](hololens-requirements.md)
-## [Insider preview for Microsoft HoloLens](hololens-insider.md)
-## [Set up HoloLens](hololens-setup.md)
-## [Install localized version of HoloLens](hololens-install-localized.md)
-## [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md) 
-## [Enroll HoloLens in MDM](hololens-enroll-mdm.md)
-## [Manage updates to HoloLens](hololens-updates.md)
-## [Set up HoloLens in kiosk mode](hololens-kiosk.md)
-## [Share HoloLens with multiple people](hololens-multiple-users.md)
+# [HoloLens overview](index.md)
+
+# Get Started with HoloLens 2
+## [HoloLens 2 hardware](hololens2-hardware.md)
+## [Get your HoloLens 2 ready to use](hololens2-setup.md)
+## [Set up your HoloLens 2](hololens2-start.md)
+## [HoloLens 2 fit and comfort FAQ](hololens2-fit-comfort-faq.md)
+## [Supported languages for HoloLens 2](hololens2-language-support.md)
+## [Getting around HoloLens 2](hololens2-basic-usage.md)
+
+# Get started with HoloLens (1st gen)
+## [HoloLens (1st gen) hardware](hololens1-hardware.md)
+## [Get your HoloLens (1st gen) ready to use](hololens1-setup.md)
+## [Set up your HoloLens (1st gen)](hololens1-start.md)
+## [HoloLens (1st gen) fit and comfort FAQ](hololens1-fit-comfort-faq.md)
+## [Install localized version of HoloLens (1st gen)](hololens1-install-localized.md)
+## [Getting around HoloLens (1st gen)](hololens1-basic-usage.md)
+
+# Deploying HoloLens and Mixed Reality Apps in Commercial Environments
+## [Deployment planning](hololens-requirements.md)
+## [Commercial feature overview](hololens-commercial-features.md)
+## [Lincense Requriements](hololens-licenses-requirements.md)
+## [Commercial Infrastructure Guidance](hololens-commercial-infrastructure.md)
+## [Unlock Windows Holographic for Business features](hololens1-upgrade-enterprise.md)
 ## [Configure HoloLens using a provisioning package](hololens-provisioning.md)
-## [Install apps on HoloLens](hololens-install-apps.md)
+## [Enroll HoloLens in MDM](hololens-enroll-mdm.md)
+## [Set up ring based updates for HoloLens](hololens-updates.md)
 ## [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md)
-## [How HoloLens stores data for spaces](hololens-spaces.md)
-## [Change history for Microsoft HoloLens documentation](change-history-hololens.md)
\ No newline at end of file
+
+# Navigating Windows Holographic
+## [Start menu and mixed reality home](holographic-home.md)
+## [Use your voice with HoloLens](hololens-cortana.md)
+## [Find and save files](holographic-data.md)
+## [Create, share, and view photos and video](holographic-photos-and-videos.md)
+
+# User management and access management
+## [Accounts on HoloLens](hololens-identity.md)
+## [Share your HoloLens with multiple people](hololens-multiple-users.md)
+## [Set up HoloLens as a kiosk (single application access)](hololens-kiosk.md)
+## [Set up limited application access](hololens-kiosk.md)
+
+# Holographic Applications
+## [Try 3D Viewer](holographic-3d-viewer-beta.md)
+## [Find, install, and uninstall applications](holographic-store-apps.md)
+## [Install and uninstall custom applications](holographic-custom-apps.md)
+
+# Accessories and connectivity
+## [Connect to Bluetooth and USB-C devices](hololens-connect-devices.md)
+## [Use the HoloLens (1st gen) clicker](hololens1-clicker.md)
+## [Connect to a network](hololens-network.md)
+## [Use HoloLens offline](hololens-offline.md)
+
+# Hologram optics and placement in space
+## [Tips for viewing clear Holograms](hololens-calibration.md)
+## [Environment considerations for HoloLens](hololens-environment-considerations.md)
+## [Spatial mapping on HoloLens](hololens-spaces.md)
+
+# Update, troubleshoot, or recover HoloLens
+## [Update HoloLens](hololens-update-hololens.md)
+## [Restart, reset, or recover](hololens-recovery.md)
+## [Troubleshoot HoloLens](hololens-troubleshooting.md)
+## [Known issues](hololens-known-issues.md)
+## [Frequently asked questions](hololens-faq.md)
+## [Hololens services status](hololens-status.md)
+
+# [Release Notes](hololens-release-notes.md)
+# [Give us feedback](hololens-feedback.md)
+# [Join the Windows Insider program](hololens-insider.md)
+# [Change history for Microsoft HoloLens documentation](change-history-hololens.md)
diff --git a/devices/hololens/change-history-hololens.md b/devices/hololens/change-history-hololens.md
index 1fc820a243..4b3449e838 100644
--- a/devices/hololens/change-history-hololens.md
+++ b/devices/hololens/change-history-hololens.md
@@ -1,24 +1,27 @@
 ---
 title: Change history for Microsoft HoloLens documentation
+ms.reviewer: 
+manager: dansimp
 description: This topic lists new and updated topics for HoloLens.
 keywords: change history
 ms.prod: hololens
 ms.mktglfcycl: manage
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.localizationpriority: medium
-ms.date: 11/05/2018
 ---
 
 # Change history for Microsoft HoloLens documentation
 
 This topic lists new and updated topics in the [Microsoft HoloLens documentation](index.md).
 
-## Windows 10 Holographic for Business, version 1809
+## April 2019
 
-The topics in this library have been updated for Windows 10 Holographic for Business, version 1809.
+New or changed topic | Description
+--- | ---
+[Restore HoloLens 2 using Advanced Recovery Companion](hololens-recovery.md) | New
 
 ## November 2018
 
@@ -26,6 +29,10 @@ New or changed topic | Description
 --- | ---
 [How HoloLens stores data for spaces](hololens-spaces.md) | New
 
+## Windows 10 Holographic for Business, version 1809
+
+The topics in this library have been updated for Windows 10 Holographic for Business, version 1809.
+
 
 ## October 2018
 
@@ -43,11 +50,6 @@ New or changed topic | Description
 --- | ---
 Insider preview for Microsoft HoloLens | New (topic retired on release of Windows 10, version 1809)
 
-## June 2018
-
-New or changed topic | Description
---- | ---
-[HoloLens in the enterprise: requirements and FAQ](hololens-requirements.md#pin) | Added instructions for creating a sign-in PIN. 
 
 ## May 2018
 
@@ -71,7 +73,7 @@ The topics in this library have been updated for Windows 10 Holographic for Busi
 
 New or changed topic | Description
 --- | ---
-[Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md)  | Replaced the instructions for upgrading to Windows Holographic for Business using Microsoft Intune with a link to the new Intune topic.
+[Unlock Windows Holographic for Business features](hololens1-upgrade-enterprise.md)  | Replaced the instructions for upgrading to Windows Holographic for Business using Microsoft Intune with a link to the new Intune topic.
 
 ## December 2017
 
@@ -79,14 +81,8 @@ New or changed topic | Description
 --- | ---
 [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) | New
 
-## May 2017
-
-| New or changed topic | Description |
-| --- | --- |
-| [Microsoft HoloLens in the enterprise: requirements](hololens-requirements.md) | Changed title to **Microsoft HoloLens in the enterprise: requirements and FAQ**, added questions and answers in new [FAQ section](hololens-requirements.md#faq-for-hololens) |
-
 ## January 2017
 
 | New or changed topic | Description |
 | --- | --- |
-| All topics | Changed all references from **Windows Holographic Enterprise** to **Windows Holographic for Business** |
\ No newline at end of file
+| All topics | Changed all references from **Windows Holographic Enterprise** to **Windows Holographic for Business** |
diff --git a/devices/hololens/docfx.json b/devices/hololens/docfx.json
index 06af992034..4f53494c32 100644
--- a/devices/hololens/docfx.json
+++ b/devices/hololens/docfx.json
@@ -4,7 +4,7 @@
       {
         "files": [
           "**/*.md",
-		  "**/**.yml"
+          "**/**.yml"
         ],
         "exclude": [
           "**/obj/**",
@@ -17,7 +17,8 @@
       {
         "files": [
           "**/*.png",
-          "**/*.jpg"
+          "**/*.jpg",
+          "**/*.gif"
         ],
         "exclude": [
           "**/obj/**",
@@ -29,26 +30,38 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
-		"uhfHeaderId": "MSDocsHeader-WindowsIT", 
-		"breadcrumb_path": "/hololens/breadcrumb/toc.json",
-		"ms.technology": "windows",
-		"ms.topic": "article",
-		"ms.author": "jdecker",
-		"ms.date": "04/05/2017",
-		"feedback_system": "GitHub",
-		"feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
-		"feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
-		"_op_documentIdPathDepotMapping": {
-			"./": {
-			  "depot_name": "Win.itpro-hololens"
-			}
-		}
-	},
+      "breadcrumb_path": "/hololens/breadcrumb/toc.json",
+      "ms.technology": "windows",
+      "ms.topic": "article",
+      "audience": "ITPro",
+      "manager": "laurawi",
+      "ms.date": "04/05/2017",
+      "feedback_system": "GitHub",
+      "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
+      "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "Win.itpro-hololens",
+          "folder_relative_path_in_docset": "./"
+        } 
+          
+        }
+    },
     "fileMetadata": {},
     "template": [
       null
     ],
     "dest": "devices/hololens",
-    "markdownEngineName": "dfm"
-  }
+    "markdownEngineName": "markdig"
+  },
+    "contributors_to_exclude": [ 
+    "rjagiewich", 
+    "traya1", 
+    "rmca14", 
+    "claydetels19", 
+    "Kellylorenebaker",
+    "jborsecnik",
+    "tiburd",
+    "garycentric"
+    ]
 }
diff --git a/devices/hololens/holographic-3d-viewer-beta.md b/devices/hololens/holographic-3d-viewer-beta.md
new file mode 100644
index 0000000000..0973813221
--- /dev/null
+++ b/devices/hololens/holographic-3d-viewer-beta.md
@@ -0,0 +1,202 @@
+---
+title: Using 3D Viewer on HoloLens
+description: Describes the types of files and features that 3D Viewer Beta on HoloLens supports, and how to use and troubleshoot the app.
+ms.prod: hololens
+ms.sitesec: library
+author: Teresa-Motiv
+ms.author: v-tea
+ms.topic: article
+ms.localizationpriority: high
+ms.date: 10/30/2019
+ms.reviewer: scooley
+audience: ITPro
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+---
+
+# Using 3D Viewer on HoloLens
+
+3D Viewer lets you view 3D models on HoloLens. You can open and view *supported* .fbx files from Microsoft Edge, OneDrive, and other apps.
+
+If you're having trouble opening a 3D model in 3D Viewer, or certain features of your 3D model are unsupported, see [Supported content specifications](#supported-content-specifications).
+
+To build or optimize 3D models for use with 3D Viewer, see [Optimizing 3D models for 3D Viewer](#optimizing-3d-models-for-3d-viewer-beta).
+
+There are two ways to open a 3D model on HoloLens. See [Viewing 3D models on HoloLens](#viewing-3d-models-on-hololens) to learn more.
+
+If you're having trouble after reading these topics, see [Troubleshooting](#troubleshooting).
+
+## Supported content specifications
+
+### File format
+
+- FBX format
+- Maximum FBX release 2015.1.0
+
+### File size
+
+- Minimum 5 KB
+- Maximum 500 MB
+
+### Geometry
+
+- Polygonal models only. No subdivision surfaces or NURBs
+- Right-handed coordinate system
+- Shear in transformation matrices is not supported
+
+### Textures
+
+- Texture maps must be embedded in the FBX file
+- Supported image formats
+  - JPEG and PNG images
+  - BMP images (24-bit RGB true-color)
+  - TGA images (24-bit RGB and 32-bit RGBQ true-color)
+- Maximum texture resolution of 2048x2048
+- Maximum of one diffuse map, one normal map, and one reflection cube map per mesh
+- Alpha channel in diffuse textures causes pixels to be discarded if below 50%
+
+### Animation
+
+- Scale/rotation/translation animation on individual objects
+- Skeletal (rigged) animation with skinning
+  - Maximum of 4 influences per vertex
+
+### Materials
+
+- Lambert and Phong materials are supported, with adjustable parameters
+- Supported material properties for Lambert
+  - Main Texture (RGB + Alpha Test)
+  - Diffuse Color (RGB)
+  - Ambient Color (RGB)
+- Supported material properties for Phong
+  - Main Texture (RGB + Alpha Test)
+  - Diffuse Color (RGB)
+  - Ambient Color (RGB)
+  - Specular Color (RGB)
+  - Shininess
+  - Reflectivity
+- Custom materials are not supported
+- Maximum of one material per mesh
+- Maximum of one material layer
+- Maximum of 8 materials per file
+
+### File and model limitations
+
+There are hard limits on the size of files, as well as the number of models, vertices, and meshes that can be open simultaneously in 3D Viewer Beta:
+
+- 500 MB maximum file size per model
+- Vertices: 600,000 combined on all open models
+- Meshes: 1,600 combined on all open models
+- Maximum of 40 models open at one time
+
+## Optimizing 3D models for 3D Viewer Beta
+
+### Special considerations
+
+- Avoid black materials or black areas in texture maps. Holograms are made of light, thus HoloLens renders black (the absence of light) as transparent.
+- Before exporting to FBX from your creation tool, ensure all geometry is visible and unlocked and no layers that contain geometry are turned off or templated. Visibility is not respected.
+- Avoid very large translation offsets between nodes (for example, 100,000 units). This can cause the model to jitter while being moved/scaled/rotated.
+
+### Performance optimization
+
+Keep performance in mind while authoring content and validate in the 3D Viewer Beta app on HoloLens during the authoring process for best results. 3D Viewer Beta renders content real-time and performance is subject to HoloLens hardware capabilities.  
+
+There are many variables in a 3D model that can impact performance. 3D Viewer Beta will show a warning on load if there are more than 150,000 vertices or more than 400 meshes. Animations can have an impact on the performance of other open models. There are also hard limits on the total number models, vertices, and meshes that can be open simultaneously in 3D Viewer Beta (see [File and model limitations](#file-and-model-limitations)).  
+
+If the 3D model isn't running well due to model complexity, consider:
+
+- Reducing polygon count
+- Reducing number of bones in rigged animation
+- Avoiding self-occlusion
+
+Double-sided rendering is supported in 3D Viewer Beta, although it is turned off by default for performance reasons. This can be turned on via the **Double Sided** button on the **Details** page. For best performance, avoid the need for double-sided rendering in your content.
+
+### Validating your 3D model
+
+Validate your model by opening it in 3D Viewer Beta on HoloLens. Select the **Details** button to view your model's characteristics and warnings of unsupported content (if present).
+
+### Rendering 3D models with true-to-life dimensions
+
+By default, 3D Viewer Beta displays 3D models at a comfortable size and position relative to the user. However, if rendering a 3D model with true-to-life measurements is important (for example, when evaluating furniture models in a room), the content creator can set a flag within the file's metadata to prevent resizing of that model by both the application and the user.
+
+To prevent scaling of the model, add a Boolean custom attribute to any object in the scene named Microsoft_DisableScale and set it to true. 3D Viewer Beta will then respect the FbxSystemUnit information baked into the FBX file. Scale in 3D Viewer Beta is 1 meter per FBX unit.
+
+## Viewing 3D models on HoloLens
+
+### Open an FBX file from Microsoft Edge
+
+FBX files can be opened directly from a website using Microsoft Edge on HoloLens.
+
+1. In Microsoft Edge, navigate to the webpage containing the FBX file you want to view.
+1. Select the file to download it.
+1. When the download is complete, select the **Open** button in Microsoft Edge to open the file in 3D Viewer Beta.
+
+The downloaded file can be accessed and opened again later by using Downloads in Microsoft Edge. To save a 3D model and ensure continued access, download the file on your PC and save it to your OneDrive account. The file can then be opened from the OneDrive app on HoloLens.
+
+> [!NOTE]
+> Some websites with downloadable FBX models provide them in compressed ZIP format. 3D Viewer Beta cannot open ZIP files directly. Instead, use your PC to extract the FBX file and save it to your OneDrive account. The file can then be opened from the OneDrive app on HoloLens.
+
+### Open an FBX file from OneDrive
+
+FBX files can be opened from OneDrive by using the OneDrive app on HoloLens. Be sure you've installed OneDrive using Microsoft Store app on HoloLens and that you've already uploaded the FBX file to OneDrive on your PC.
+
+Once in OneDrive, FBX files can be opened on HoloLens using 3D Viewer Beta in one of two ways:
+
+- Launch OneDrive on HoloLens and select the FBX file to open it in 3D Viewer Beta.
+- Launch 3D Viewer Beta, air tap to show the toolbar, and select **Open File**. OneDrive will launch, allowing you to select an FBX file.
+
+## Troubleshooting
+
+### I see a warning when I open a 3D model
+
+You will see a warning if you attempt to open a 3D model that contains features that are not supported by 3D Viewer Beta, or if the model is too complex and performance may be affected. 3D Viewer Beta will still load the 3D model, but performance or visual fidelity may be compromised.
+
+For more info, see [Supported content specifications](#supported-content-specifications) and [Optimizing 3D models for 3D Viewer Beta](#optimizing-3d-models-for-3d-viewer-beta).
+
+### I see a warning and the 3D model doesn't load
+
+You will see an error message when 3D Viewer Beta cannot load a 3D model due to complexity or file size, or if the FBX file is corrupt or invalid. You will also see an error message if you have reached the limit on the total number of models, vertices, or meshes that can be open simultaneously.  
+
+For more info, see [Supported content specifications](#supported-content-specifications) and [File and model limitations](#file-and-model-limitations).
+
+If you feel your model meets the supported content specifications and has not exceeded the file or model limitations, you may send your FBX file to the 3D Viewer Beta team at holoapps@microsoft.com. We are not able to respond personally, but having examples of files that do not load properly will help our team improve on future versions of the app.
+
+### My 3D model loads, but does not appear as expected
+
+If your 3D model does not look as expected in 3D Viewer Beta, air tap to show the toolbar, then select **Details**. Aspects of the file which are not supported by 3D Viewer Beta will be highlighted as warnings.
+
+The most common issue you might see is missing textures, likely because they are not embedded in the FBX file. In this case, the model will appear white. This issue can be addressed in the creation process by exporting from your creation tool to FBX with the embed textures option selected.
+
+For more info, see [Supported content specifications](#supported-content-specifications) and [Optimizing 3D models for 3D Viewer Beta](#optimizing-3d-models-for-3d-viewer-beta).
+
+### I experience performance drops while viewing my 3D model
+
+Performance when loading and viewing a 3D model can be affected by the complexity of the model, number of models open simultaneously, or number of models with active animations.
+
+For more info, see [Optimizing 3D models for 3D Viewer Beta](#optimizing-3d-models-for-3d-viewer-beta) and [File and model limitations](#file-and-model-limitations).
+
+### When I open an FBX file on HoloLens, it doesn't open in 3D Viewer Beta
+
+3D Viewer Beta is automatically associated with the .fbx file extension when it is installed.
+
+If you try to open an FBX file and see a dialog box that directs you to Microsoft Store, you do not currently have an app associated with the .fbx file extension on HoloLens.
+
+Verify that 3D Viewer Beta is installed. If it is not installed, download it from Microsoft Store on HoloLens.
+
+If 3D Viewer Beta is already installed, launch 3D Viewer Beta, then try opening the file again. If the issue persists, uninstall and reinstall 3D Viewer Beta. This will re-associate the .fbx file extension with 3D Viewer Beta.
+
+If attempting to open an FBX file opens an app other than 3D Viewer Beta, that app was likely installed after 3D Viewer Beta and has taken over association with the .fbx file extension. If you prefer 3D Viewer Beta to be associated with the .fbx file extension, uninstall and reinstall 3D Viewer Beta.
+
+### The Open File button in 3D Viewer Beta doesn't launch an app
+
+The **Open File** button will open the app associated with the file picker function on HoloLens. If OneDrive is installed, the **Open File** button should launch OneDrive. However, if there is currently no app associated with the file picker function installed on HoloLens, you will be directed to Microsoft Store.
+
+If the **Open File** button launches an app other than OneDrive, that app was likely installed after OneDrive and has taken over association with the file picker function. If you prefer OneDrive to launch when selecting the **Open File** button in 3D Viewer Beta, uninstall and reinstall OneDrive.
+
+If the **Open File** button is not active, it's possible that you have reached the limit of models that can be open in 3D Viewer Beta at one time. If you have 40 models open in 3D Viewer Beta, you will need to close some before you will be able to open additional models.
+
+## Additional resources
+
+- [Support forums](http://forums.hololens.com/categories/3d-viewer-beta)
+- [Third-party notices](https://www.microsoft.com/{lang-locale}/legal/products)
diff --git a/devices/hololens/holographic-custom-apps.md b/devices/hololens/holographic-custom-apps.md
new file mode 100644
index 0000000000..0a86a7b37a
--- /dev/null
+++ b/devices/hololens/holographic-custom-apps.md
@@ -0,0 +1,54 @@
+---
+title: Manage custom apps for HoloLens
+description: Side load custom apps on HoloLens.  Learn more about installing, and uninstalling holographic apps.
+ms.assetid: 6bd124c4-731c-4bcc-86c7-23f9b67ff616
+ms.date: 07/01/2019
+manager: v-miegge
+keywords: hololens, sideload, side load, side-load, store, uwp, app, install
+ms.prod: hololens
+ms.sitesec: library
+author: mattzmsft
+ms.author: mazeller
+ms.topic: article
+ms.localizationpriority: medium
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Install and manage custom applications (non-store)
+
+HoloLens supports many existing applications from the Microsoft Store, as well as new apps built specifically for HoloLens. This article focuses on custom holographic applications.  
+
+For more information about store apps, see [Manage apps with the store](holographic-store-apps.md).
+
+## Install custom apps
+
+You can install your own applications on HoloLens either by using the Device Portal or by deploying the apps from Visual Studio.
+
+### Installing an application package with the Device Portal
+
+1. Establish a connection from [Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal) to the target HoloLens.
+1. In the left navigation, navigate to the **Apps** page .
+1. Under **App Package** browse to the .appx file that is associated with your application.
+   > [!IMPORTANT]
+   > Make sure to reference any associated dependency and certificate files.
+
+1. Select **Go**.
+   ![Install app form in Windows Device Portal on Microsoft HoloLens](images/deviceportal-appmanager.jpg)
+
+### Deploying from Microsoft Visual Studio 2015
+
+1. Open your app's Visual Studio solution (.sln file).
+1. Open the project's **Properties**.
+1. Select the following build configuration: **Master/x86/Remote Machine**.
+1. When you select **Remote Machine**:
+   - Make sure the address points to the Wi-Fi IP address of your HoloLens.
+   - Set authentication to **Universal (Unencrypted Protocol)**.
+1. Build your solution.
+1. To deploy the app from your development PC to your HoloLens, select **Remote Machine**. If you already have an existing build on the HoloLens, select **Yes** to install this newer version.  
+
+   ![Remote Machine deployment for apps to Microsoft HoloLens in Visual Studio](images/vs2015-remotedeployment.jpg)  
+1. The application will install and auto launch on your HoloLens.
+
+After you've installed an app, you'll find it in the **All apps** list​ (**Start** > **All apps**).
diff --git a/devices/hololens/holographic-data.md b/devices/hololens/holographic-data.md
new file mode 100644
index 0000000000..1f28c4fac9
--- /dev/null
+++ b/devices/hololens/holographic-data.md
@@ -0,0 +1,100 @@
+---
+title: Find and save files on HoloLens
+description: Use File Explorer on HoloLens to view and manage files on your device
+keywords: how-to, file picker, files, photos, videos, pictures, OneDrive, storage, file explorer
+ms.assetid: 77d2e357-f65f-43c8-b62f-6cd9bf37070a
+author: mattzmsft
+ms.author: mazeller
+manager: v-miegge
+ms.reviewer: jarrettrenshaw
+ms.date: 12/30/2019
+keywords: hololens
+ms.prod: hololens
+ms.sitesec: library
+ms.topic: article
+audience: ITPro
+ms.localizationpriority: medium
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Find, open, and save files on HoloLens
+
+Files you create on HoloLens, including photos and videos, are saved directly to your HoloLens device. View and manage them in the same way you would manage files on Windows 10:
+
+- Using the File Explorer app to access local folders.
+- Within an app's storage.
+- In a special folder (such as the video or music library).
+- Using a storage service that includes an app and file picker (such as OneDrive).
+- Using a desktop PC connected to your HoloLens by using a USB cable, using MTP (Media Transfer Protocol) support.
+
+## View files on HoloLens using File Explorer
+
+> Applies to all HoloLens 2 devices and HoloLens (1st gen) as of the [Windows 10 April 2018 Update (RS4) for HoloLens](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018).
+
+Use File Explorer on HoloLens to view and manage files on your device, including 3D objects, documents, and pictures. Go to **Start**  > **All apps**  > **File Explorer** to get started.
+
+> [!TIP]
+> If there are no files listed in File Explorer, select **This Device** in the top left pane.
+
+If you don’t see any files in File Explorer, the "Recent" filter may be active (clock icon is highlighted in left pane). To fix this, select the **This Device** document icon in the left pane (beneath the clock icon), or open the menu and select **This Device**.
+
+## Find and view your photos and videos
+
+[Mixed reality capture](holographic-photos-and-videos.md) lets you take mixed reality photos and videos on HoloLens.  These photos and videos are saved to the device's Camera Roll folder.
+
+You can access photos and videos taken with HoloLens by:
+
+- accessing the Camera Roll directly through the [Photos app](holographic-photos-and-videos.md).
+- uploading photos and videos to cloud storage by syncing your photos and videos to OneDrive.
+- using the Mixed Reality Capture page of the [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#mixed-reality-capture).
+
+### Photos app
+
+The Photos app is one of the default apps on the **Start** menu, and comes built-in with HoloLens. Learn more about [using the Photos app to view content](holographic-photos-and-videos.md).
+
+You can also install the [OneDrive app](https://www.microsoft.com/p/onedrive/9wzdncrfj1p3) from the Microsoft Store to sync photos to other devices.
+
+### OneDrive app
+
+[OneDrive](https://onedrive.live.com/) lets you access, manage, and share your photos and videos with any device and with any user. To access the photos and videos captured on HoloLens, download the [OneDrive app](https://www.microsoft.com/p/onedrive/9wzdncrfj1p3) from the Microsoft Store on your HoloLens. Once downloaded, open the OneDrive app and select **Settings** > **Camera upload**, and turn on **Camera upload**.
+
+### Connect to a PC
+
+If your HoloLens is running the [Windows 10 April 2018 update](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018) or later, you can connect your HoloLens to a Windows 10 PC by using a USB cable to browse photos and videos on the device by using MTP (media transfer protocol). You'll need to make sure the device is unlocked to browse files if you have a PIN or password set up on your device.  
+
+If you have enabled the [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal), you can use it to browse, retrieve, and manage the photos and videos stored on your device.
+
+## Access files within an app
+
+If an application saves files on your device, you can use that application to access them.
+
+### Requesting files from another app
+
+An application can request to save a file or open a file from another app by using [file pickers](https://docs.microsoft.com/windows/mixed-reality/app-model#file-pickers).
+
+### Known folders
+
+HoloLens supports a number of [known folders](https://docs.microsoft.com/windows/mixed-reality/app-model#known-folders) that apps can request permission to access.
+
+## View HoloLens files on your PC
+
+Similar to other mobile devices, connect HoloLens to your desktop PC using MTP (Media Transfer Protocol) and open File Explorer on the PC to access your HoloLens libraries for easy transfer.
+
+To see your HoloLens files in File Explorer on your PC:
+
+1. Sign in to HoloLens, then plug it into the PC using the USB cable that came with the HoloLens.
+
+1. Select **Open Device to view files with File Explorer**, or open File Explorer on the PC and navigate to the device.
+
+To see info about your HoloLens, right-click the device name in File Explorer on your PC, then select **Properties**.
+
+> [!NOTE]
+> HoloLens (1st gen) does not support connecting to external hard drives or SD cards.
+
+## Sync to the cloud
+
+To sync photos and other files from your HoloLens to the cloud, install and set up OneDrive on HoloLens. To get OneDrive, search for it in the Microsoft Store on your HoloLens.
+
+HoloLens doesn't back up app files and data, so it's a good idea to save your important stuff to OneDrive. That way, if you reset your device or uninstall an app, your info will be backed up.
diff --git a/devices/hololens/holographic-home.md b/devices/hololens/holographic-home.md
new file mode 100644
index 0000000000..9b554c0638
--- /dev/null
+++ b/devices/hololens/holographic-home.md
@@ -0,0 +1,87 @@
+---
+title: Start menu and mixed reality home
+description: Navigate the mixed reality home in Windows Holographic.
+ms.assetid: 742bc126-7996-4f3a-abb2-cf345dff730c
+ms.date: 08/07/2019
+keywords: hololens
+ms.prod: hololens
+ms.sitesec: library
+author: scooley
+ms.author: scooley
+ms.topic: article
+ms.localizationpriority: high
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Start menu and mixed reality home
+
+Just like the Windows PC experience starts with the desktop, Windows Holographic starts with mixed reality home.  Using the Start menu you can open and place app windows, immersive app launchers, and 3D content in mixed reality home, and their placement in your physical space will be remembered.
+
+## Use the Start menu
+
+The Start menu on HoloLens is where you'll open apps, see important status info, and access tools like the camera.
+
+Wherever you are in HoloLens, you can always open the Start menu by using **Start gesture**.  On HoloLens (1st gen) the Start gesture is [bloom](https://support.microsoft.com/help/12644/hololens-use-gestures). On HoloLens 2, the [Start gesture](hololens2-basic-usage.md#start-gesture) is to tap the Start icon that appears on your wrist.  You can also open the Start menu using your voice by saying "Go to Start".
+
+> [!TIP]
+> When the Start menu is open, use the Start gesture to close it, or look at the Start menu and say "Close".
+
+At the top of the Start menu, you'll see status indicators for Wi-Fi, battery, volume, and a clock. On HoloLens 2 there is also a listening indicator that shows whether the device is speech enabled and is listening for voice commands. At the bottom you'll find the **Photo** and **Video** buttons which allow you to take photos and video recordings.  There is also a **Connect** button that allows you to project what you see to another device using Miracast.
+
+### Find apps on Start menu
+
+The Start menu has a **Pinned apps** list and an **All apps** list.
+
+- The **Pinned apps** list shows apps that have been pinned. You can add and remove apps from the **Pinned apps** list using the context menu that appears when you **select and hold** on an app tile.
+
+- The **All apps** list shows all apps that are installed on the device.  Select the **All apps** button on the right side of the **Start** menu to get to the list.
+
+On both app lists, use the **Page up** and **Page down** buttons on the right side of the Start menu to page through all the apps in the list.  Both app lists will automatically open to the page that was last used during a device session.
+
+> [!TIP]
+> On HoloLens 2, you can directly scroll the app lists using your index finger. Just touch the list with your finger tip and drag upwards or downwards.
+
+### Open apps from Start menu
+
+To open an app from the Start menu, simply **select** an **app tile**. You can also say the name of an app to open it.
+
+When you open an app from the Start menu, one of the following will happen, depending on how the app is designed:
+
+- An **app window** is placed. The app is then loaded in the window and you can use it like a touch screen.
+- A **3D app launcher** for an immersive app is placed. You need to then **select** the launcher to open the immersive app.
+- An app window is placed which acts as a **launcher** for an immersive app. The immersive app will proceed to launch automatically.
+
+App windows and app launchers placed in mixed reality home will stay around until you decide to remove them.  They give you a convenient shortcut in the world to use those app windows or to launch immersive apps without having to open them again from the Start menu. 
+
+> [!NOTE]
+>Like on a phone, system resources is managed automatically on HoloLens.  For example, when you open a new immersive app, all other running apps will immediately become inactive. There is no need to remove app windows and launchers in mixed reality home to free up system resources. 
+
+## Using apps on HoloLens
+
+Apps on HoloLens can use app window view or immersive view. With app window view the app simply shows its content inside a window. With immersive view an app takes you away from mixed realty home where it can then display its content in the physical environment all around you. Apps can also choose to use both views.
+
+### Use app windows
+
+On HoloLens (1st gen) app windows are placed and used in mixed reality home, where you can [move, resize, and rotate](hololens1-basic-usage.md#move-resize-and-rotate-apps) them as you like. In addition to using app windows with gaze and gesture, you can also use them with Bluetooth connected mouse and keyboard.
+
+On HoloLens 2, in addition to using app windows in mixed reality home, you can also use one app window at a time inside an immersive app. You can also put an app window into **Follow me** mode where it will stay in front of you as you walk around. When you open an app window while inside an immersive app, it will open in **Follow me** mode automatically. You can [move, resize, and rotate](hololens2-basic-usage.md#move-resize-and-rotate-holograms) app windows directly using your hands in both mixed reality home and inside an immersive app.
+
+> [!NOTE]
+>
+> - Up to three app windows can be active in mixed reality home at a time. You can open more, but only three will remain active.
+> - When an app window is not active, it will show content that looks darkened compared to an active window.  Some will simply show the app icon instead of any content.  To activate an inactive window simply **select** it.
+> - Each open app can have one active window at a time, except Microsoft Edge, which can have up to three.
+
+### Close apps
+
+To close an app that uses an app window, simply close the app window with the **Close** button on the title bar.  You can also look at the window and say "Close".
+
+To exit an app that uses immersive view, use the Start gesture to bring up the **Start menu**, then select the **Mixed reality home** button.
+
+If an immersive app is in a broken state and you need to restart it, you can make sure the app is first completely shut down by closing its launcher in mixed reality home, then launching it from the Start menu.
+
+## Related info
+
+[Find, Install, and Uninstall applications from the Microsoft Store](holographic-store-apps.md)
diff --git a/devices/hololens/holographic-photos-and-videos.md b/devices/hololens/holographic-photos-and-videos.md
new file mode 100644
index 0000000000..10e6bb4756
--- /dev/null
+++ b/devices/hololens/holographic-photos-and-videos.md
@@ -0,0 +1,150 @@
+---
+title: Capture and manage mixed reality photos and videos
+description: Learn how to capture, view, and share mixed reality photos and videos, using HoloLens.
+keywords: hololens, photo, video, capture, mrc, mixed reality capture, photos, camera, stream, livestream, demo
+ms.assetid: 1b636ec3-6186-4fbb-81b2-71155aef0593
+ms.prod: hololens
+ms.sitesec: library
+author: mattzmsft
+ms.author: mazeller
+ms.topic: article
+audience: ITPro
+ms.localizationpriority: medium
+ms.date: 10/28/2019
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Create mixed reality photos and videos
+
+HoloLens gives users the experience of mixing the real world with the digital world.  Mixed reality capture (MRC) lets you capture that experience as a photo or video, or share what you see with others in real-time.
+
+Mixed reality capture uses a first-person point of view so other people can see holograms as you see them. For a third-person point of view, use [spectator view](https://docs.microsoft.com/windows/mixed-reality/spectator-view). Spectator view is especially useful for demos.
+
+While it's fun to share videos amongst friends and colleagues, videos can also help teach other people to use an app or to communicate problems with apps and experiences.
+
+> [!NOTE]
+> If you can't launch mixed reality capture experiences and your HoloLens is a work device, check with your system administrator. Access to the camera can be restricted through company policy.
+
+## Capture a mixed reality photo
+
+There are several ways to take a photo of mixed reality on HoloLens; you can use hardware buttons, voice, or the Start menu.
+
+### Hardware buttons to take photos
+
+To take a quick photo of your current view, press the volume up and volume down buttons at the same time.  This is a bit like the HoloLens version of a screenshot or print screen.
+
+- [Button locations on HoloLens 2](hololens2-hardware.md)
+- [Button locations on HoloLens (1st gen)](hololens1-hardware.md#hololens-components)
+
+> [!NOTE]
+> Holding the **volume up** and **volume down** buttons for three seconds will start recording a video rather than taking a photo. To stop recording, tap both **volume up** and **volume down** buttons simultaneously.
+
+### Voice commands to take photos
+
+Cortana can also take a picture. Say: "Hey Cortana, take a picture."
+
+### Start menu to take photos
+
+Use the Start gesture to go to **Start**, then select the **camera** icon.
+
+Point your head in the direction of what you want to capture, then [air tap](hololens2-basic-usage.md#touch-holograms-near-you) to take a photo. You can continue to air tap and capture additional photos. Any photos you capture will be saved to your device.
+
+Use the Start gesture again to end photo capture.  
+
+## Capture a mixed reality video
+
+There are several ways to record a video of mixed reality on HoloLens; you can use hardware buttons, voice, or the Start menu.
+
+### Hardware buttons to record videos
+
+The quickest way to record a video is to press and hold the **volume up** and **volume down** buttons simultaneously until a three-second countdown begins. To stop recording, tap both buttons simultaneously.
+
+> [!NOTE]
+> Quickly pressing the **volume up** and **volume down** buttons at the same time will take a photo rather than recording a video.
+
+### Voice to record videos
+
+Cortana can also record a video. Say: "Hey Cortana, start recording." To stop a video, say "Hey Cortana, stop recording."
+
+### Start menu to record videos
+
+Use the Start gesture to go to **Start**, then select the **video** icon. Point your head in the direction of what you want to capture, then [air tap](hololens2-basic-usage.md#touch-holograms-near-you) to start recording. There will be a three second countdown and your recording will begin.
+
+To stop recording, use the Start gesture and select the highlighted **video** icon. The video will be saved to your device.
+
+> [!NOTE]
+> **Applies to HoloLens (1st gen) only**  
+> The [Windows 10 October 2018 Update](https://docs.microsoft.com/windows/mixed-reality/release-notes-october-2018) changes how the Start gesture and Windows button behave on HoloLens (1st gen). Before the update, the Start gesture or Windows button would stop a video recording. After the update, however, the Start gesture or Windows button opens the **Start** menu (or the **quick actions menu** if you are in an immersive app), from which you can select the highlighted **video** icon to stop recording.
+
+## Share what you see in real-time
+
+You can share what you see in HoloLens with friends and colleagues in real-time. There are a few methods available:
+
+1. Connecting to a Miracast-enabled device or adapter to watch on a TV.
+1. Using [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal) to watch on a PC
+1. Using the [Microsoft HoloLens companion app](https://www.microsoft.com/store/productId/9NBLGGH4QWNX) to watch on a PC.
+1. Deploying the [Microsoft Dynamics 365 Remote Assist](https://dynamics.microsoft.com/en-us/mixed-reality/remote-assist) app, which enables front-line workers to stream what they see to a remote expert. The remote expert can then guide the front-line worker verbally or by annotating in their world.
+
+> [!NOTE]
+> Sharing what you see via Windows Device Portal or Microsoft HoloLens companion app requires your HoloLens to be in [Developer mode](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#setting-up-hololens-to-use-windows-device-portal).
+
+### Stream video with Miracast
+
+Use the Start gesture to go to **Start**, then select the **connect** icon. From the picker that appears, select the Miracast-enabled device or adapter to which you want to connect.
+
+To stop sharing, use the Start gesture and select the highlighted **connect** icon. Because you were streaming, nothing will be saved to your device.
+
+> [!NOTE]
+> Miracast support was enabled on HoloLens (1st gen) beginning with the [Windows 10 October 2018 Update](https://docs.microsoft.com/windows/mixed-reality/release-notes-october-2018).
+
+### Real time video with Windows Device Portal
+
+Because sharing via Windows Device Portal requires Developer mode to be enabled on HoloLens, follow the instructions in our developer documentation to [set up Developer mode and navigate Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal).
+
+### Microsoft HoloLens companion app
+
+Because sharing via the Microsoft HoloLens companion app requires Developer mode to be enabled on HoloLens, follow the instructions in our developer documentation to [set up Developer mode](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). Then, download the [Microsoft HoloLens companion app](https://www.microsoft.com/store/productId/9NBLGGH4QWNX) and follow the instructions within the app to connect to your HoloLens.
+
+Once the app is set up with your HoloLens, select the **Live stream** option from the app's main menu.
+
+## View your mixed reality photos and videos
+
+Mixed reality photos and videos are saved to the device's "Camera Roll". You can browse the contents of this folder on your HoloLens with the File Explorer app (navigate to Pictures > Camera Roll).
+
+You can also view your mixed reality photos and videos in the Photos app, which is pre-installed on HoloLens. To pin a photo in your world, select it in the Photos app and choose **Place in mixed world**. You can move the photo around your world after it's been placed.
+
+To view and/or save your mixed reality photos and videos on a PC connected to HoloLens, you can use [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#mixed-reality-capture) or your [PC's File Explorer via MTP](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018#new-features-for-hololens).
+
+## Share your mixed reality photos and videos
+
+After capturing a mixed reality photo or video, a preview will appear. Select the **share** icon above the preview to bring up the share assistant. From there, you can select the end point to which you'd like to share that photo or video.
+
+You can also share mixed reality photos and videos from OneDrive, by automatically uploading your mixed reality photos and videos. Open the OneDrive app on HoloLens and sign in with a personal [Microsoft account](https://account.microsoft.com) if you haven't already. Select the **settings** icon and choose **Camera upload**. Turn Camera upload on. Your mixed reality photos and videos will now be uploaded to OneDrive each time you launch the app on HoloLens.
+
+> [!NOTE]
+> You can only enable camera upload in OneDrive if you’re signed into OneDrive with a personal Microsoft account. If you set up HoloLens with a work or school account, you can add a personal Microsoft account in the OneDrive app to enable this feature.
+
+## Limitations of mixed reality capture
+
+- While using mixed reality capture, the framerate of HoloLens will be halved to 30 Hz.
+- Videos have a maximum length of five minutes.
+- The resolution of photos and videos may be reduced if the photo/video camera is already in use by another application, while live streaming, or when system resources are low.
+
+## Default file format and resolution
+
+### Default photo format and resolution
+
+|  Device  |  Format  |  Extension  |  Resolution  |
+|----------|----------|----------|----------|
+| HoloLens 2 | [JPEG](https://en.wikipedia.org/wiki/JPEG) | .jpg | 3904x2196px |
+| HoloLens (1st gen) | [JPEG](https://en.wikipedia.org/wiki/JPEG) | .jpg | 1408x792px |
+
+### Recorded video format and resolution
+
+| Device | Format | Extension | Resolution | Speed | Audio |
+|----------|----------|----------|----------|----------|----------|
+| HoloLens 2 | [MPEG-4](https://en.wikipedia.org/wiki/MPEG-4) | .mp4 | 1920x1080px | 30fps | 48kHz Stereo |
+| HoloLens (1st gen) |  [MPEG-4](https://en.wikipedia.org/wiki/MPEG-4) | .mp4 | 1216x684px | 24fps | 48kHz Stereo |
diff --git a/devices/hololens/holographic-store-apps.md b/devices/hololens/holographic-store-apps.md
new file mode 100644
index 0000000000..085f14c50e
--- /dev/null
+++ b/devices/hololens/holographic-store-apps.md
@@ -0,0 +1,53 @@
+---
+title: Find, install, and uninstall applications
+description: The Microsoft Store is your source for apps and games that work with HoloLens.  Learn more about finding, installing, and uninstalling holographic apps.
+ms.assetid: cbe9aa3a-884f-4a92-bf54-8d4917bc3435
+ms.reviewer: v-miegge
+ms.date: 08/30/2019
+manager: jarrettr
+keywords: hololens, store, uwp, app, install
+ms.prod: hololens
+ms.sitesec: library
+author: mattzmsft
+ms.author: mazeller
+ms.topic: article
+ms.localizationpriority: high
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Find, install, and uninstall applications from the Microsoft Store
+
+The Microsoft Store is your go-to source for apps and games that work with HoloLens. When you go to the Store on your HoloLens, any apps you see there will run on it.
+
+Apps on HoloLens use either 2D view or holographic view. Apps that use 2D view look like windows and can be positioned all around you. Apps that use holographic view surround you and become the only app you see.
+
+HoloLens supports many existing applications from the Microsoft Store, as well as new apps built specifically for HoloLens.  This article focuses on holographic applications from the Microsoft Store.
+
+To learn more about installing and running custom apps, read [Custom holographic applications](holographic-custom-apps.md).
+
+## Find apps
+
+Open the Microsoft Store from the **Start** menu. Then browse for apps and games. You can use Cortana to search by saying "Hey, Cortana" and then saying your search terms.
+
+## Install apps
+
+To download apps, you'll need to be signed in with a Microsoft account. To buy them, you'll need a payment method associated with the Microsoft account you use on your HoloLens. To set up a payment method, go to [account.microsoft.com](https://account.microsoft.com/) and select **Payment & billing** > **Payment options** > **Add a payment option**.
+
+1. To open the [**Start** menu](holographic-home.md), perform a [bloom](hololens1-basic-usage.md) gesture or tap your wrist.
+2. Select the Store app and then tap to place this tile into your world.
+3. Once the Store app opens, use the search bar to look for any desired application.
+4. Select **Get** or **Install** on the application's page (a purchase may be required).
+
+## Uninstall apps
+
+There are two ways to uninstall applications.  You can uninstall applications through the Microsoft Store or Start menu.
+
+### Uninstall from the Start menu
+
+On the **Start** menu or in the **All apps** list, gaze at the app. Tap and hold until the menu appears, then select **Uninstall**.
+
+### Uninstall from the Microsoft Store
+
+Open the Microsoft Store from the **Start** menu, and then browse for the application you'd like to uninstall.  On the Store page, each application that you have installed has an **Uninstall** button.
diff --git a/devices/hololens/hololens-FAQ.md b/devices/hololens/hololens-FAQ.md
new file mode 100644
index 0000000000..a183165e4a
--- /dev/null
+++ b/devices/hololens/hololens-FAQ.md
@@ -0,0 +1,217 @@
+---
+title: Frequently asked questions about HoloLens and holograms
+description: Do you have a quick question about HoloLens or interacting with holograms?  This article provides a quick answer and more resources.
+keywords: hololens, faq, known issue, help
+ms.prod: hololens
+ms.sitesec: library
+author: Teresa-Motiv
+ms.author: v-tea
+ms.topic: article
+audience: ITPro
+ms.localizationpriority: medium
+ms.date: 10/30/2019
+ms.reviewer: 
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# HoloLens and holograms: Frequently asked questions
+
+Here are some answers to questions you might have about using HoloLens, placing holograms, working with spaces, and more.
+
+Any time you're having problems, make sure HoloLens is [charged up](https://support.microsoft.com/help/12627/hololens-charge-your-hololens). Try [restarting it](hololens-restart-recover.md) to see if that fixes things. And please use the Feedback app to send us info about the issue—you'll find it on the [**Start** menu](holographic-home.md).
+
+For tips about wearing your HoloLens, see [HoloLens fit and comfort: FAQ](https://support.microsoft.com/help/13405/hololens-fit-and-comfort-faq).
+
+This FAQ addresses the following questions and issues:
+
+
+- [My holograms don't look right or are moving around](#my-holograms-dont-look-right-or-are-moving-around)
+- [I see a message that says "Finding your space"](#i-see-a-message-that-says-finding-your-space)
+- [I'm not seeing the holograms I expect to see in my space](#im-not-seeing-the-holograms-i-expect-to-see-in-my-space)
+- [I can't place holograms where I want](#i-cant-place-holograms-where-i-want)
+- [Holograms disappear or are encased in other holograms or objects](#holograms-disappear-or-are-encased-in-other-holograms-or-objects)
+- [I can see holograms that are on the other side of a wall](#i-can-see-holograms-that-are-on-the-other-side-of-a-wall)
+- [When I place a hologram on a wall, it seems to float](#when-i-place-a-hologram-on-a-wall-it-seems-to-float)
+- [Apps appear too close to me when I'm trying to move them](#apps-appear-too-close-to-me-when-im-trying-to-move-them)
+- [I'm getting a low disk space error](#im-getting-a-low-disk-space-error)
+- [HoloLens doesn't respond to my gestures](#hololens-doesnt-respond-to-my-gestures)
+- [HoloLens doesn't respond to my voice](#hololens-doesnt-respond-to-my-voice)
+- [I'm having problems pairing or using a Bluetooth device](#im-having-problems-pairing-or-using-a-bluetooth-device)
+- [I'm having problems with the HoloLens clicker](#im-having-problems-with-the-hololens-clicker)
+- [I can't connect to Wi-Fi](#i-cant-connect-to-wi-fi)
+- [My HoloLens isn't running well, is unresponsive, or won't start](#my-hololens-isnt-running-well-is-unresponsive-or-wont-start)
+- [How do I delete all spaces?](#how-do-i-delete-all-spaces)
+- [I cannot find or use the keyboard to type in the HoloLens 2 Emulator](#i-cannot-find-or-use-the-keyboard-to-type-in-the-hololens-2-emulator)
+
+## My holograms don't look right or are moving around
+
+If your holograms don't look right (for example, they're jittery or shaky, or you see black patches on top of them), try one of these fixes:
+
+- [Clean your device visor](hololens1-hardware.md#care-and-cleaning) and make sure nothing is blocking the sensors.
+- Make sure you're in a well-lit room without a lot of direct sunlight.
+- Try walking around and gazing at your surroundings so HoloLens can scan them more completely.
+- If you've placed a lot of holograms, try removing some.
+
+If you're still having problems, trying running the Calibration app, which calibrates your HoloLens just for you, to help keep your holograms looking their best. Go to **Settings **>** System **>** Utilities**. Under Calibration, select **Open Calibration**.
+
+[Back to list](#list)
+
+## I see a message that says Finding your space
+
+When HoloLens is learning or loading a space, you might see a brief message that says "Finding your space." If this message continues for more than a few seconds, you'll see another message under the Start menu that says "Still looking for your space."
+
+These messages mean that HoloLens is having trouble mapping your space. When this happens, you'll be able to open apps, but you won't be able to place holograms in your environment.
+
+If you see these messages often, try the following:
+
+- Make sure you're in a well-lit room without a lot of direct sunlight.
+- Make sure your device visor is clean. [Learn how](hololens1-hardware.md#care-and-cleaning).
+- Make sure you have a strong Wi-Fi signal. If you enter a new environment that has no Wi-Fi or a weak signal, HoloLens won't be able find your space. Check your Wi-Fi connection by going to **Settings **> **Network & Internet** >** Wi-Fi**.
+- Try moving more slowly.
+
+[Back to list](#list)
+
+## I'm not seeing the holograms I expect to see in my space
+
+If you don't see holograms you placed, or you're seeing some you don't expect, try the following:
+
+- Try turning on some lights. HoloLens works best in a well-lit space.
+- Remove holograms you don't need by going to **Settings** > **System** > **Holograms** > **Remove nearby holograms**. Or, if needed, select **Remove all holograms**.
+
+  > [!NOTE]
+  > If the layout or lighting in your space changes significantly, your device might have trouble identifying your space and showing your holograms.
+
+[Back to list](#list)
+
+## I can't place holograms where I want
+
+Here are some things to try if you're having trouble placing holograms:
+
+- Stand about 1 to 3 meters from where you're trying to place the hologram.
+- Don't place holograms on black or reflective surfaces.
+- Make sure you're in a well-lit room without a lot of direct sunlight.
+- Walk around the rooms so HoloLens can rescan your surroundings. To see what's already been scanned, air tap to reveal the mapping mesh graphic.
+
+[Back to list](#list)
+
+## Holograms disappear or are encased in other holograms or objects
+
+If you get too close to a hologram, it will temporarily disappear—just move away from it. Also, if you've placed a lot of holograms close together, some may disappear. Try removing a few.
+
+Holograms can also be blocked or encased by other holograms or by objects such as walls. If this happens, try one of the following:
+
+- If the hologram is encased in another hologram, move it to another location: select **Adjust**, then tap and hold to position it.
+- If the hologram is encased in a wall, select **Adjust**, then walk toward the wall until the hologram appears. Tap and hold, then pull the hologram forward and out of the wall.
+- If you can't move the hologram with gestures, use your voice to remove it. Gaze at the hologram, then say "Remove." Then reopen it and place it in a new location.
+
+[Back to list](#list)
+
+## I can see holograms that are on the other side of a wall
+
+If you're very close to a wall, or if HoloLens hasn't scanned the wall yet, you'll be able to see holograms that are in the next room. Stand 1 to 3 meters from the wall and gaze to scan it.
+
+If HoloLens has problems scanning the wall, it might be because there's a black or reflective object nearby (for example, a black couch or a stainless steel refrigerator). If there is, scan the other side of the wall.
+
+[Back to list](#list)
+
+## When I place a hologram on a wall, it seems to float
+
+Holograms placed on walls will appear to be an inch or so away from the wall. If they appear farther away, try the following:
+
+- Stand 1 to 3 meters from the wall when you place a hologram and face the wall straight on.
+- Air tap the wall to reveal the mapping mesh graphic. Make sure the mesh is lined up with the wall. If it isn't, remove the hologram, rescan the wall, and try again.
+- If the issue persists, run the Calibration app. You'll find it in **Settings** > **System** > **Utilities**.
+
+[Back to list](#list)
+
+## Apps appear too close to me when I'm trying to move them
+
+Try walking around and looking at the area where you're placing the app so HoloLens will scan it from different angles. [Cleaning your device visor](hololens1-hardware.md#care-and-cleaning) may also help.
+
+[Back to list](#list)
+
+## I'm getting a low disk space error
+
+Free up some storage space by doing one or more of the following:
+
+- Remove some of the holograms you've placed, or remove some saved data from within apps. [How do I find my data?](holographic-data.md)
+- Delete some pictures and videos in the Photos app.
+- Uninstall some apps from your HoloLens. In the All apps list, tap and hold the app you want to uninstall, then select **Uninstall**. (This will also delete any of the app's data stored on the device.)
+
+[Back to list](#list)
+
+## HoloLens doesn't respond to my gestures
+
+To make sure HoloLens can see your gestures, keep your hand in the gesture frame, which extends a couple of feet on either side of you. HoloLens can also best see your hand when you hold it about 18 inches in front of your body (though you don't have to be precise about this). When HoloLens can see your hand, the cursor will change from a dot to a ring. Learn more about [using gestures in HoloLens 2](hololens2-basic-usage.md) or [using gestures in HoloLens (1st gen)](hololens1-basic-usage.md).
+
+[Back to list](#list)
+
+## HoloLens doesn't respond to my voice
+
+If Cortana isn't responding to your voice, make sure Cortana is on. In the **All apps** list, select **Cortana** > **Menu** > **Notebook** > **Settings** to make changes. To learn more about what you can say, see [Use your voice with HoloLens](hololens-cortana.md).
+
+[Back to list](#list)
+
+## I'm having problems pairing or using a Bluetooth device
+
+If you're having problems [pairing a Bluetooth device](hololens-connect-devices.md), try the following:
+
+- Go to **Settings** > **Devices** and make sure Bluetooth is turned on. If it is, try turning if off and on again.
+- Make sure your Bluetooth device is fully charged or has fresh batteries.
+- If you still can't connect, [restart your HoloLens](hololens-recovery.md).
+
+If you're having trouble using a Bluetooth device, make sure it's a supported device. Supported devices include:
+
+- English-language QWERTY Bluetooth keyboards, which can be used anywhere you use the holographic keyboard.
+- Bluetooth mice.
+- The [HoloLens clicker](hololens1-clicker.md).
+
+Other Bluetooth HID and GATT devices can be paired, but they might require a companion app from Microsoft Store to work with HoloLens.
+
+HoloLens doesn't support Bluetooth audio profiles. Bluetooth audio devices, such as speakers and headsets, may appear as available in HoloLens settings, but they aren't supported.
+
+[Back to list](#list)
+
+## I'm having problems with the HoloLens clicker
+
+Use the [clicker](hololens1-clicker.md) to select, scroll, move, and resize holograms. Additional clicker gestures may vary from app to app.
+
+If you're having trouble using the clicker, make sure its charged and paired with your HoloLens. If the battery is low, the indicator light will blink amber. To see if its paired, go to **Settings** > **Devices** and see if it shows up there. [Pair the clicker](hololens-connect-devices.md#pair-the-clicker).
+
+If the clicker is charged and paired and you're still having problems, reset it by holding down the main button and the pairing button for 15 seconds. Then pair the clicker with your HoloLens again.
+
+If that doesn't help, see [Restart or recover the HoloLens clicker](hololens1-clicker.md#restart-or-recover-the-clicker).
+
+[Back to list](#list)
+
+## I can't connect to Wi-Fi
+
+Here are some things to try if you can't connect to Wi-Fi on HoloLens:
+
+- Make sure Wi-Fi is turned on. Bloom to go to Start, then select **Settings** > **Network & Internet** > **Wi-Fi** to check. If Wi-Fi is on, try turning it off and on again.
+- Move closer to the router or access point.
+- Restart your Wi-Fi router, then [restart HoloLens](hololens-recovery.md). Try connecting again.
+- If none of these things work, check to make sure your router is using the latest firmware. You can find this information on the manufacturers website.
+
+[Back to list](#list)
+
+## My HoloLens isn't running well, is unresponsive, or won't start
+
+If your device isn't performing properly, see [Restart, reset, or recover HoloLens](hololens-recovery.md).
+
+[Back to list](#list)
+
+## How do I delete all spaces?
+
+*Coming soon*
+
+[Back to list](#list)
+
+## I cannot find or use the keyboard to type in the HoloLens 2 Emulator
+
+*Coming soon*
+
+[Back to list](#list)
diff --git a/devices/hololens/hololens-calibration.md b/devices/hololens/hololens-calibration.md
new file mode 100644
index 0000000000..cfc55d1070
--- /dev/null
+++ b/devices/hololens/hololens-calibration.md
@@ -0,0 +1,149 @@
+---
+title: Improve visual quality and comfort
+description: Calibrating your IPD (interpupillary distance) can improve the quality of your visuals. Both HoloLens and Windows Mixed Reality immersive headsets offer ways to customize IPD.
+author: Teresa-Motiv
+ms.author: xerxesb
+ms.date: 9/13/2019
+ms.topic: article
+keywords: calibration, comfort, visuals, quality, ipd
+ms.prod: hololens
+ms.sitesec: library
+author: Teresa-Motiv
+ms.localizationpriority: high
+ms.reviewer: 
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Improve visual quality and comfort
+
+HoloLens 2 and HoloLens (1st gen) both work better when they're calibrated to your unique eyes.
+
+While both devices need to calibrate for the best hologram viewing experience, they use different calibration technologies and techniques.  Jump to [HoloLens 2 calibration](#calibrating-your-hololens-2) or [HoloLens (1st gen) calibration](#calibrating-your-hololens-1st-gen).
+
+## Calibrating your HoloLens 2
+
+HoloLens 2 uses eye-tracking technology to improve your experience seeing and interacting with the virtual environment. Calibrating the HoloLens 2 ensures that it can accurately track your eyes (and the eyes of anyone else who uses the device).  After calibration, holograms will appear correctly even as the visor shifts on your head.
+
+HoloLens 2 prompts a user to calibrate the device under the following circumstances:
+
+- The user is using the device for the first time
+- The user previously opted out of the calibration process
+- The calibration process did not succeed the last time the user used the device
+- The user has deleted their calibration profiles
+- The visor is raised and the lowered and any of the above circumstances apply (this may be disabled in **Settings > System > Calibration**.)
+
+![Calibration prompt](./images/07-et-adjust-for-your-eyes.png)
+
+During this process, you'll look at a set of targets (gems). It's fine if you blink or close your eyes during calibration but try not to stare at other objects in the room.  This allows HoloLens to learn about your eye position to render your holographic world.
+
+![Calibration prompt](./images/07-et-hold-head-still.png)
+
+![Calibration prompt](./images/08-et-gems.png)
+
+![Calibration prompt](./images/09-et-adjusting.png)
+
+If calibration was successful, you'll see a success screen.  If not, read more about diagnosing calibration failures [here](#troubleshooting-hololens-2-calibration).
+
+![Calibration prompt](./images/10-et-success.png)
+
+### Calibration when sharing a device or session
+
+Multiple users can share a HoloLens 2 device, without a need for each person to go through device setup. When a new user puts the device on their head for th first time, HoloLens 2 automatically prompts the user to calibrate visuals. When a user that has previously calibrated visuals puts the device on their head, the display seamlessly adjusts for quality and a comfortable viewing experience.  
+
+### Manually starting the calibration process
+
+1. Use the start gesture to open the [**Start** menu](hololens2-basic-usage.md#start-gesture).
+1. If the Settings app isn't pinned to **Start**, select **All Apps**.
+1. Select **Settings**, and then select **System** > **Calibration** > **Eye Calibration** > **Run eye calibration**.
+
+   ![The Settings app, showing the Run eye calibration option](./images/C-Settings.Calibration.png)
+
+### Troubleshooting HoloLens 2 calibration
+
+Calibration should work for most people, but there are cases where calibration fails.
+  
+Some potential reasons for calibration failure include:
+
+- Getting distracted and not following the calibration targets
+- Dirty or scratched device visor or device visor not positioned properly
+- Dirty or scratched glasses
+- Certain types of contact lenses and glasses (colored contact lenses, some toric contact lenses, IR blocking glasses, some high prescription glasses, sunglasses, or similar)
+- More-pronounced makeup and some eyelash extensions
+- Hair or thick eyeglass frames if they are blocking the device from seeing your eyes
+- Certain eye physiology, eye conditions or eye surgery such as narrow eyes, long eyelashes, amblyopia, nystagmus, some cases of LASIK or other eye surgeries
+
+If calibration is unsuccessful try:
+
+- Cleaning your device visor
+- Cleaning your glasses
+- Pushing your device visor as close to your eyes as possible
+- Moving objects in your visor out of the way (such as hair)
+- Turning on a light in your room or moving out of direct sunlight
+
+If you followed all guidelines and calibration is still failing, please let us know by filing feedback in [Feedback Hub](hololens-feedback.md).
+
+### Calibration data and security
+
+Calibration information is stored locally on the device and is not associated with any account information. There is no record of who has used the device without calibration. This mean new users will get prompted to calibrate visuals when they use the device for the first time, as well as users who opted out of calibration previously or if calibration was unsuccessful.
+
+Calibration information can always be deleted from the device in **Settings** > **Privacy** > **Eye tracker**.  
+
+### Disable calibration
+
+You can also disable the calibration prompt by following these steps:
+
+1. Select **Settings** > **System** > **Calibration**.
+1. Turn off **When a new person uses this HoloLens, automatically ask to run eye calibration**.
+
+> [!IMPORTANT]
+> This setting may adversely affect hologram rendering quality and comfort.  When you turn off this setting, features that depend on eye tracking (such as text scrolling) no longer work in immersive applications.
+
+### HoloLens 2 eye-tracking technology
+
+The device uses its eye-tracking technology to improve display quality, and to ensure that all holograms are positioned accurately and comfortable to view in 3D. Because it uses the eyes as landmarks, the device can adjust itself for every user and tune its visuals as the headset shifts slightly throughout use.  All adjustments happen on the fly without a need for manual tuning.
+
+HoloLens applications use eye tracking to track where you are looking in real time. This is the main capability developers can leverage to enable a whole new level of context, human understanding and interactions within the Holographic experience. Developers don’t need to do anything to leverage this capability.
+
+## Calibrating your HoloLens (1st gen)
+
+HoloLens (1st gen) adjusts hologram display according to the your [interpupillary distance](https://en.wikipedia.org/wiki/Interpupillary_distance) (IPD). If the IPD is not accurate, holograms may appear unstable or at an incorrect distance. You can improve the quality of your visuals by calibrating the device to your interpupillary distance (IPD).
+
+When you set up your Hololens (1st gen) device, it prompts to calibrate your visuals after Cortana introduces herself. It's recommended that you complete the calibration step during this setup phase. However you can skip it by waiting until Cortana prompts you and then saying "Skip."
+
+During the calibration process, HoloLens asks you to align your finger with a series of six targets per eye. HoloLens uses this process to set the IPD correctly for your eyes.
+
+![IPD finger-alignment screen at second step](./images/ipd-finger-alignment-300px.jpg)
+
+### Manually start the calibration process
+
+If you need to update the calibration or if a new user needs to adjust it, you can manually run the Calibration app at any time. The Calibration app is installed by default. You can access it by using eihter the **Start** menu or the Settings app.
+
+To use the **Start** menu to run the Calibration app, follow these steps:
+
+1. Use the [bloom](hololens1-basic-usage.md) gesture to open the **Start** menu.
+1. To view all apps, select **+**.
+1. Select **Calibration**.
+
+![Accessing the calibration app from the shell](./images/calibration-shell.png)
+
+![The calibration app displayed as a Live Cube after being launched](./images/calibration-livecube-200px.png)
+
+To use the Settings app to run the Calibration app, follow these steps:
+
+1. Use the [bloom](hololens1-basic-usage.md) gesture to open the **Start** menu.
+1. If **Settings** isn't pinned to **Start**, select **+** to view all apps.
+1. Select **Settings**.
+1. Select **System** > **Utilities** > **Open Calibration**.
+
+![Launching the calibration app from the settings app](./images/calibration-settings-500px.jpg)
+
+## Immersive headsets
+
+Some immersive headsets provide the ability to customize the IPD setting. To change the IPD for your headset, open the Settings app and select **Mixed reality** > **Headset display**, and then move the slider control. You’ll see the changes in real time in your headset. If you know your IPD, maybe from a visit to the optometrist, you can enter it directly as well.
+
+You can also adjust this setting on your PC by selecting **Settings** > **Mixed reality** > **Headset display**.
+
+If your headset does not support IPD customization, this setting will be disabled.
diff --git a/devices/hololens/hololens-commercial-features.md b/devices/hololens/hololens-commercial-features.md
new file mode 100644
index 0000000000..309d81e904
--- /dev/null
+++ b/devices/hololens/hololens-commercial-features.md
@@ -0,0 +1,78 @@
+---
+title: Commercial features
+description: The Microsoft HoloLens Commercial Suite includes features that make it easier for businesses to manage HoloLens devices. HoloLens 2 devices are equipped with commercial features by default.
+keywords: HoloLens, commercial, features, mdm, mobile device management, kiosk mode
+author: scooley
+ms.author: scooley
+ms.date: 08/26/2019
+ms.topic: article
+audience: ITPro
+ms.prod: hololens
+ms.sitesec: library
+ms.localizationpriority: high
+ms.reviewer: 
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Commercial features
+
+HoloLens includes features that make it easier for businesses to manage HoloLens devices.
+
+Every HoloLens 2 device has commercial features available.
+
+HoloLens (1st gen) came with two licensing options, the developer license and a commercial license. To unlock HoloLens's commercial capabilities, upgrade from the developer license to a commercial license. To purchase the Microsoft HoloLens Commercial Suite, contact your local Microsoft account manager.
+
+>[!VIDEO https://www.youtube.com/embed/tNd0e2CiAkE]
+
+## Key commercial features
+
+- **Kiosk mode.** You can use HoloLens in demo or showcase experiences by using kiosk mode, to limit which apps can run.
+
+  ![Using kiosk mode, HoloLens launches directly into the app of your choice.](images/201608-kioskmode-400px.png)
+
+- **Mobile Device Management (MDM) for HoloLens.** Your IT department can manage multiple HoloLens devices simultaneously by using solutions such as Microsoft Intune. You can manage settings, select apps to install, and set security configurations that are tailored to your organization's needs.
+
+  ![Mobile Device Management on HoloLens provides enterprise-grade device management across multiple devices.](images/201608-enterprisemanagement-400px.png)
+
+- **Windows Update for Business.** Windows Update for Business provides controlled operating system updates to devices and support for the long-term servicing channel.
+- **Data security.** BitLocker data encryption is enabled on HoloLens to provide the same level of security protection as any other Windows device.
+- **Work access.** Anyone in your organization can remotely connect to the corporate network through virtual private network (VPN) on a HoloLens. HoloLens can also access Wi-Fi networks that require credentials.
+- **Microsoft Store for Business.** Your IT department can also set up an enterprise private store, containing only your company’s apps for your specific HoloLens usage. Securely distribute your enterprise software to selected group of enterprise users.
+
+## Feature comparison between editions
+
+|Features |HoloLens Development Edition |HoloLens Commercial Suite |HoloLens 2 |
+|---|:---:|:---:|:---:|
+|Device Encryption (BitLocker) | |✔️ |✔️ |
+|Virtual Private Network (VPN) | |✔️ |✔️ |
+|[Kiosk mode](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal#kiosk-mode) | |✔️ |✔️ |
+|**Management and deployment** | | | |
+|Mobile Device Management (MDM) | |✔️ |✔️ |
+|Ability to block unenrollment | |✔️ |✔️ |
+|Cert-based corporate Wi-Fi access | |✔️ |✔️ |
+|Microsoft Store (Consumer) |Consumer |Filter by using MDM |Filter by using MDM |
+|[Business Store Portal](https://docs.microsoft.com/microsoft-store/working-with-line-of-business-apps) | |✔️ |✔️ |
+|**Security and identity** | | | |
+|Sign in by using Azure Active Directory (AAD) account |✔️ |✔️ |✔️ |
+|Sign in by using Microsoft Account (MSA) |✔️ |✔️ |✔️ |
+|Next Generation Credentials with PIN unlock |✔️ |✔️ |✔️ |
+|[Secure boot](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-secure-boot) |✔️ |✔️ |✔️ |
+|**Servicing and support** | | | |
+|Automatic system updates as they arrive |✔️ |✔️ |✔️ |
+|[Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) | |✔️ |✔️ |
+|Long-Term Servicing Channel (LTSC) | |✔️ |✔️ |
+
+## Enabling commercial features
+
+Your organization's IT admin can set up commercial features such as Microsoft Store for Business, kiosk mode, and enterprise Wi-Fi access. The [Microsoft HoloLens](https://docs.microsoft.com/hololens) documentation provides step-by-step instructions for enrolling devices and installing apps from Microsoft Store for Business.
+
+## See also
+
+- [Microsoft HoloLens](https://docs.microsoft.com/hololens)
+- [Kiosk mode](/windows/mixed-reality/using-the-windows-device-portal.md#kiosk-mode)
+- [CSPs supported in HoloLens devices](/windows/client-management/mdm/configuration-service-provider-reference#csps-supported-in-hololens-devices)
+- [Microsoft Store For Business and line of business applications](https://blogs.technet.microsoft.com/sbucci/2016/04/13/windows-store-for-business-and-line-of-business-applications/)
+- [Working with line-of-business apps](/microsoft-store/working-with-line-of-business-apps)
diff --git a/devices/hololens/hololens-commercial-infrastructure.md b/devices/hololens/hololens-commercial-infrastructure.md
new file mode 100644
index 0000000000..ad23e185ee
--- /dev/null
+++ b/devices/hololens/hololens-commercial-infrastructure.md
@@ -0,0 +1,113 @@
+---
+title: Infrastructure Guidelines for HoloLens
+description: 
+ms.prod: hololens
+ms.sitesec: library
+author: pawinfie
+ms.author: pawinfie
+audience: ITPro
+ms.topic: article
+ms.localizationpriority: high
+ms.date: 1/23/2020
+ms.reviewer: 
+manager: bradke
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Configure Your Network
+
+This portion of the document will require the following people:
+1.	Network Admin with permissions to make changes to the proxy/firewall
+2.	Azure Active Directory Admin
+3.	Mobile Device Manager Admin
+4.	Teams admin for Remote Assist only
+
+## Infrastructure Requirements
+
+### HoloLens Specific Network Requirements
+Make sure that these ports and URLs are allowed on your network firewall. This will enable HoloLens to function properly. The latest list can be found [here](hololens-offline.md).
+
+### Remote Assist Specific Network Requirements
+
+1.	The recommended bandwidth for optimal performance of Remote Assist is 1.5Mbps. Detailed network requirements and additional information can be found [here](https://docs.microsoft.com/MicrosoftTeams/prepare-network).
+**Please note, if you don’t network have network speeds of at least 1.5Mbps, Remote Assist will still work. However, quality may suffer.**
+1. Make sure that these ports and URLs are allowed on your network firewall. This will enable Microsoft Teams to function. The latest list can be found [here](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams).
+
+### Guides Specific Network Requirements
+Guides only require network access to download and use the app.
+
+## Azure Active Directory Guidance
+This step is only necessary if your company plans on managing the HoloLens and mixed reality apps.
+
+### 1. Ensure that you have an Azure AD License. 
+Please [HoloLens Licenses Requirements](hololens-licenses-requirements.md)for additional information.
+
+### 2. Ensure that your company’s users are in Azure Active Directory (Azure AD).
+Instructions for adding users can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/add-users-azure-active-directory).
+
+### 3. We suggest that users who will be need similar licenses are added to a group.
+1. [Create a Group](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-create-azure-portal) 
+
+2. [Add users to groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-groups-members-azure-portal)
+
+### 4. Ensure that your company’s users (or group of users) are assigned the necessary licenses. 
+Directions for assigning licenses can be found [here](https://docs.microsoft.com/azure/active-directory/fundamentals/license-users-groups).
+
+### 5. **IMPORTANT:** Only do this step if users are expected to enroll their HoloLens/Mobile device onto the network. 
+These steps ensure that your company’s users (or a group of users) can add devices.
+1. Option 1: Give all users permission to join devices to Azure AD.
+**Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** >
+**Set Users may join devices to Azure AD to *All***
+
+1.	Option 2: Give selected users/groups permission to join devices to Azure AD
+**Sign in to the Azure portal as an administrator** > **Azure Active Directory** > **Devices** > **Device Settings** >
+**Set Users may join devices to Azure AD to *Selected***
+![Image that shows Configuration of Azure AD Joined Devices](images/azure-ad-image.png)
+
+1.	Option 3: You can block all users from joining their devices to the domain. This means that all devices will need to be manually enrolled by your IT department. 
+
+## Mobile Device Manager Admin Steps
+
+### Scenario 1: Kiosk Mode
+As a note, auto-launching an app does not currently work for HoloLens.
+
+How to Set Up Kiosk Mode Using Microsoft Intune.
+#### 1. Sync Microsoft Store to Intune ([Here](https://docs.microsoft.com/intune/apps/windows-store-for-business))
+
+#### 2.	Check your app settings
+
+1. Log into your Microsoft Store Business account
+1. **Manage** > **Products and Services** > **Apps and Software** > **Select the app you want to sync** > **Private Store Availability** > **Select “Everyone” or “Specific Groups”**
+1.	If you do not see your apps in **Intune** > **Client Apps** > **Apps** , you may have to [sync your apps](https://docs.microsoft.com/intune/apps/windows-store-for-business#synchronize-apps) again.
+
+#### 3.	Configuring Kiosk Mode using MDM
+
+Information on configuring Kiosk Mode in Intune can be found [here](https://docs.microsoft.com/hololens/hololens-kiosk#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803)
+
+ >[!NOTE]
+    >You can configure different users to have different Kiosk Mode experiences by using “Azure AD” as the “User logon type”. However, this option is only available in Multi-App kiosk mode. Multi-App kiosk mode will work with only one app as well as multiple apps.
+
+![Image that shows Configuration of Kiosk Mode in Intune](images/aad-kioskmode.png)
+
+If you are configuring Kiosk Mode on an MDM other than Intune, please check your MDM provider's documentation.
+
+## Additional Intune Quick Links
+
+1.	[Create Profiles:](https://docs.microsoft.com/intune/configuration/device-profile-create) Profiles allow you to add and configure settings that will be pushed to the devices in your organization.
+
+1. [CSPs (Configuration Service Providers)](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference#csps-supported-in-hololens-devices) allows you to create and deploy management settings for the devices on your network. Some CSPs are supported by HoloLens devices. (See the list of CSPs for HoloLens [here](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference#csps-supported-in-hololens-devices).
+
+1.	[Create Compliance Policy](https://docs.microsoft.com/intune/protect/create-compliance-policy)
+
+1.	 Conditional Access allows/denies mobile devices and mobile applications from accessing company resources. Two documents you may find helpful are [Plan your CA Deployment](https://docs.microsoft.com/azure/active-directory/conditional-access/plan-conditional-access) and [Best Practices](https://docs.microsoft.com/azure/active-directory/conditional-access/best-practices).
+
+## Certificates and Authentication
+### MDM Certificate Distribution
+If your company requires certificates, Intune supports PKCS, PFX, and SCEP. It is important to understand which certificate is right for your company. Please visit [here](https://docs.microsoft.com/intune/protect/certificates-configure) to determine which cert is best for you. If you plan to use certs for HoloLens Authentication, PFX or SCEP may be right for you.
+
+Steps for SCEP can be found [here](https://docs.microsoft.com/intune/protect/certificates-profile-scep).
+
+### Device Certificates
+Certificates can also be added to the HoloLens through package provisioning. Please see [HoloLens Provisioning](hololens-provisioning.md) for additional information.
diff --git a/devices/hololens/hololens-connect-devices.md b/devices/hololens/hololens-connect-devices.md
new file mode 100644
index 0000000000..bbe2dad4d3
--- /dev/null
+++ b/devices/hololens/hololens-connect-devices.md
@@ -0,0 +1,74 @@
+---
+title: Connect to Bluetooth and USB-C devices
+description: This guide walks through connecting to Bluetooth and USB-C devices and accessories.
+ms.assetid: 01af0848-3b36-4c13-b797-f38ad3977e30
+ms.prod: hololens
+ms.sitesec: library
+author: Teresa-Motiv
+ms.author: v-tea
+ms.topic: article
+ms.localizationpriority: high
+ms.date: 09/13/2019
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Connect to Bluetooth and USB-C devices
+
+## Pair Bluetooth devices
+
+Pair a Bluetooth mouse and keyboard with HoloLens, then use them to interact with holograms and to type anywhere you'd use the holographic keyboard.
+
+Classes of Bluetooth devices supported by HoloLens 2:
+
+- Mouse
+- Keyboard
+- Bluetooth audio output (A2DP) devices
+
+Classes of Bluetooth devices supported by HoloLens (1st gen):
+
+- Mouse
+- Keyboard
+- HoloLens (1st gen) clicker
+
+> [!NOTE]
+> Other types of Bluetooth devices, such as speakers, headsets, smartphones, and game pads, may appear as available in HoloLens settings, but aren't supported on HoloLens (1st gen). [Learn more](https://go.microsoft.com/fwlink/p/?LinkId=746660).
+
+### Pair a Bluetooth keyboard or mouse
+
+1. Turn on your keyboard or mouse and make it discoverable. The way you make it discoverable depends on the device. To learn how to do this, check the device or visit the manufacturer's website.
+
+1. Use the bloom gesture (HoloLens (1st gen) or the start gesture (HoloLens 2) to go to **Start**, then select **Settings**.
+1. Select **Devices** and make sure that Bluetooth is on. When you see the device name, select **Pair** and follow the instructions.
+
+### Pair the clicker
+
+> Applies to HoloLens (1st gen) only.
+
+1. Use the bloom gesture to go to **Start**, then select **Settings**.
+
+1. Select **Devices** and make sure that Bluetooth is on.
+1. Use the tip of a pen to press and hold the clicker's pairing button until the status light blinks white. Make sure to hold the button down until the light starts blinking. [Where's the pairing button?](hololens1-clicker.md)
+1. On the pairing screen, select **Clicker** > **Pair**.
+
+## Connect USB-C devices
+
+> Applies to HoloLens 2 only.
+
+HoloLens 2 lets you connect a wide range of USB-C devices.
+
+HoloLens 2 supports the following devices classes:
+
+- Mass storage devices (such as thumb drives)
+- Ethernet adapters (including ethernet with charging)
+- USB-C to 3.5mm digital audio adapters
+- USB-C digital audio headsets (including headset adapters with charging)
+- Wired mouse
+- Wired keyboard
+- Combination PD hubs (USB A + PD charging)
+
+## Connect to Miracast
+
+Use Miracast by opening the **Start** menu and selecting the display icon or saying "Connect" while gazing at the **Start** menu. Choose an available device from the list that appears and complete pairing to begin projection.
diff --git a/devices/hololens/hololens-cortana.md b/devices/hololens/hololens-cortana.md
new file mode 100644
index 0000000000..82ded27dd3
--- /dev/null
+++ b/devices/hololens/hololens-cortana.md
@@ -0,0 +1,122 @@
+---
+title: Use your voice with HoloLens
+description: Cortana can help you do all kinds of things on your HoloLens
+ms.assetid: fd96fb0e-6759-4dbe-be1f-58bedad66fed
+ms.date: 11/8/2019
+keywords: hololens
+ms.prod: hololens
+ms.sitesec: library
+author: v-miegge
+audience: ITPro
+ms.author: v-miegge
+ms.topic: article
+manager: jarrettr
+ms.localizationpriority: high
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Use your voice with HoloLens
+
+You can use your voice to do almost anything on HoloLens, such as taking a quick photo or opening an app. Many voice commands are built into HoloLens, while others are available through Cortana.
+
+This article teaches you how to control HoloLens and your holographic world with your voice and with Cortana.
+
+> [!NOTE]
+> Speech is only supported in [some languages](hololens2-language-support.md). The speech language is based on the Windows display language, not the keyboard language.  
+>  
+> You can verify the Windows display language by selecting **Settings** > **Time and Language** > **Language**.
+
+## Built-in voice commands
+
+Get around HoloLens faster with these basic commands. In order to use these you need to enable Speech during first run of the device or in **Settings** > **Privacy** > **Speech**. You can always check whether speech is enabled by looking at the status at the top of Start menu.
+
+### General speech commands
+
+Use these commands throughout Windows Mixed Reality to get around faster. Some commands use the gaze cursor, which you bring up by saying “select.”
+
+>[!NOTE]
+>Hand rays are not supported on HoloLens (1st Gen).
+
+| Say this | To do this |
+| - | - |
+| "Select" | Say "select" to bring up the gaze cursor. Then, turn your head to position the cursor on the thing you want to select, and say “select” again. |
+|Open the Start menu | "Go to Start" |
+|Close the Start menu | "Close" |
+|Leave an immersive app | Say "Go to Start" to bring up the quick actions menu, then say "Mixed reality home." |
+|Hide and show hand ray | "Hide hand ray" / "Show hand ray" |
+|See available speech commands | "What can I say?" |
+
+### Hologram commands
+
+To use these commands, gaze at a 3D object, hologram, or app window.
+
+| Say this | To do this |
+| - | - |
+| "Bigger" | Make it bigger |
+| "Smaller" | Make it smaller |
+| "Face me" | Turn it to face you |
+| "Move this" | Move it (follow your gaze) |
+| "Close" | Close it |
+| "Follow me" / "Stop following" | Make it follow you as you move around |
+
+### See it, say it
+
+Many buttons and other elements on HoloLens also respond to your voice—for example, **Follow me** and **Close** on the app bar, or the **Back** button in Edge. To find out if a button is voice-enabled, rest your **gaze cursor** on it for a moment to see a voice tip.
+
+### Dictation mode
+
+Tired of typing? Switch to dictation mode any time that the holographic keyboard is active. To get started, select the microphone button or say "Start dictating." To stop dictating, select the button again or say "Stop dictating." To delete what you just dictated, say "Delete that."
+
+> [!NOTE]
+> To use dictation mode, you have to have an internet connection.
+
+HoloLens dictation uses explicit punctuation, meaning that you say the name of the punctuation you want to use. For instance, you might say "Hey **comma** what are you up to **question mark**."
+
+Here are the punctuation keywords that you can use:
+
+- Period, comma, question mark, exclamation point/exclamation mark
+- New line/new paragraph
+- Semicolon, colon
+- Open quote(s), close quote(s)
+- Hashtag, smiley/smiley face, frowny, winky
+- Dollar, percent
+
+Sometimes it's helpful to spell out things like email addresses. For instance, to dictate example@outlook.com, you'd say "E X A M P L E at outlook dot com."
+
+## Do more with Cortana
+
+Cortana can help you do all kinds of things on your HoloLens, from searching the web to shutting down your device. She can give you suggestions, ideas, reminders, alerts, and more. To get her attention, select Cortana  on **Start** or say "Hey Cortana" anytime.
+
+![Hey Cortana!](images/cortana-on-hololens.png)
+
+Here are some things you can try saying (remember to say "Hey Cortana" first).
+
+**Hey, Cortana**...
+
+- What can I say?
+- Increase the volume.
+- Decrease the brightness.
+- Shut down.
+- Restart.
+- Go to sleep.
+- Mute.
+- Launch <*app name*>.
+- Move <*app name*> here (gaze at the spot that you want the app to move to).
+- Go to Start.
+- Take a picture.
+- Start recording. (Starts recording a video.)
+- Stop recording. (Stops recording a video.)
+- What time is it?
+- Show me the latest NBA scores.
+- How much battery do I have left?
+- Tell me a joke.
+
+Some Cortana features that you're used to from Windows on your PC or phone (for example, reminders and notifications) aren't supported in Microsoft HoloLens, and the Cortana experience may vary from one region to another.
+
+### Turn Cortana off
+
+Cortana is on the first time you use HoloLens when you enable speech. You can turn her off in Cortana's settings. In the **All apps** list, select **Cortana** > **Settings**. Then turn off Cortana can give you suggestions, ideas, reminders, alerts, and more.
+
+If Cortana isn't responding to "Hey Cortana," check that speech is enabled on Start and go to Cortana's settings and check to make sure she's on.
diff --git a/devices/hololens/hololens-encryption.md b/devices/hololens/hololens-encryption.md
index 8a223c0745..6c8b9118e6 100644
--- a/devices/hololens/hololens-encryption.md
+++ b/devices/hololens/hololens-encryption.md
@@ -4,22 +4,28 @@ description: Enable Bitlocker device encryption to protect files stored on the H
 ms.prod: hololens
 ms.mktglfcycl: manage
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.localizationpriority: medium
 ms.date: 01/26/2019
+ms.reviewer: 
+manager: dansimp
+appliesto:
+- HoloLens (1st gen)
 ---
 
 # Enable encryption for HoloLens
 
-You can enable [BitLocker device encryption](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) to protect files and information stored on the HoloLens. Device encryption helps protect your data by encrypting it using AES-CBC 128 encryption method, which is equivalent to [EncryptionMethodByDriveType method 3](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp#encryptionmethodbydrivetype) in the BitLocker configuration service provider (CSP). Only someone with the right encryption key (such as a password) can decrypt it or perform a data recovery.
+HoloLens (1st gen) and HoloLens 2 both support device encryption using BitLocker, however, BitLocker is always enabled on HoloLens 2.
 
+This article will help you enable and manage BitLocker on HoloLens (1st gen).
 
+On HoloLens (1st gen) you can enable BitLocker device encryption manually or using mobile device management (MDM). Follow these instructions to enable [BitLocker device encryption](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) to protect files and information stored on the HoloLens. Device encryption helps protect your data using the AES-CBC 128 encryption method, which is equivalent to [EncryptionMethodByDriveType method 3](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp#encryptionmethodbydrivetype) in the BitLocker configuration service provider (CSP). Personnel who have the correct encryption key (such as a password) can decrypt it or perform a data recovery.
 
 ## Enable device encryption using MDM
 
-You can use your mobile device management (MDM) provider to apply a policy that requires device encryption. The policy used is the [Security/RequireDeviceEncryption setting](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-security#security-requiredeviceencryption) in the Policy CSP.
+You can use your Mobile Device Management (MDM) provider to apply a policy that requires device encryption. The policy to use is the [Security/RequireDeviceEncryption setting](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-security#security-requiredeviceencryption) in the Policy CSP.
 
 [See instructions for enabling device encryption using Microsoft Intune.](https://docs.microsoft.com/intune/compliance-policy-create-windows#windows-holographic-for-business)
 
@@ -37,69 +43,57 @@ Provisioning packages are files created by the Windows Configuration Designer to
 
 ### Create a provisioning package that upgrades the Windows Holographic edition and enables encryption
 
-1.	[Create a provisioning package for HoloLens.](hololens-provisioning.md)
-
-2.  Go to **Runtime settings** > **Policies** > **Security**, and select **RequireDeviceEncryption**.
+1. [Create a provisioning package for HoloLens.](hololens-provisioning.md)
+1. Go to **Runtime settings** > **Policies** > **Security**, and select **RequireDeviceEncryption**.
 
     ![Require device encryption setting configured to yes](images/device-encryption.png)
 
-2.	Browse to and select the XML license file that was provided when you purchased the Commercial Suite.
+1. Find the XML license file that was provided when you purchased the Commercial Suite.
 
+1. Browse to and select the XML license file that was provided when you purchased the Commercial Suite.
     >[!NOTE]
     >You can configure [additional settings in the provisioning package](hololens-provisioning.md).
 
-3. On the **File** menu, click **Save**. 
+1. On the **File** menu, click **Save**. 
 
-4. Read the warning that project files may contain sensitive information, and click **OK**.
+1. Read the warning explaining that project files may contain sensitive information and click **OK**.
 
     >[!IMPORTANT]
-    >When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
-    
-3. On the **Export** menu, click **Provisioning package**.
+    >When you build a provisioning package, you may include sensitive information in the project files and provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when no longer needed.
 
-4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next**.
-
-5. Set a value for **Package Version**.
+1. On the **Export** menu, click **Provisioning package**.
+1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next**.
+1. Set a value for **Package Version**.
 
     >[!TIP]
     >You can make changes to existing packages and change the version number to update previously applied packages.
 
-6. On the **Select security details for the provisioning package**, click **Next**.
-
-7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
+1. On the **Select security details for the provisioning package**, click **Next**.
+1. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
 
     Optionally, you can click Browse to change the default output location.
 
-8. Click **Next**.
-
-9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.
-
-10. When the build completes, click **Finish**. 
-
+1. Click **Next**.
+1. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.
+1. When the build completes, click **Finish**.
 
 ### Apply the provisioning package to HoloLens
 
 1. Connect the device via USB to a PC and start the device, but do not continue past the **fit** page of the initial setup experience (the first page with the blue box).
-
-2. Briefly press and release the **Volume Down** and **Power** buttons simultaneously.
-
-3. HoloLens will show up as a device in File Explorer on the PC.
-
-4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage.
-
-5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page.
-
-6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package.
-
-7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with device setup.
+1. Briefly press and release the **Volume Down** and **Power** buttons simultaneously.
+1. HoloLens will show up as a device in File Explorer on the PC.
+1. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage.
+1. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page.
+1. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package.
+1. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with device setup.
 
 >[!NOTE]
->If the device was purchased before August 2016, you will need to sign into the device with a Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package. 
+>If the device was purchased before August 2016, you will need to sign into the device with a Microsoft account, get the latest OS update, and then reset the OS in order to apply the provisioning package.
 
 ## Verify device encryption
 
 Encryption is silent on HoloLens. To verify the device encryption status:
- 
--	On HoloLens, go to **Settings** > **System** > **About**. **BitLocker** is **enabled** if the device is encrypted. 
 
-![About screen showing BitLocker enabled](images/about-encryption.png)
+- On HoloLens, go to **Settings** > **System** > **About**. **BitLocker** is **enabled** if the device is encrypted. 
+
+    ![About screen showing BitLocker enabled](images/about-encryption.png)
diff --git a/devices/hololens/hololens-enroll-mdm.md b/devices/hololens/hololens-enroll-mdm.md
index 5f79d72c2e..dc042a0f9f 100644
--- a/devices/hololens/hololens-enroll-mdm.md
+++ b/devices/hololens/hololens-enroll-mdm.md
@@ -1,14 +1,19 @@
 ---
-title: Enroll HoloLens in MDM (HoloLens)
+title: Enroll HoloLens in MDM
 description: Enroll HoloLens in mobile device management (MDM) for easier management of multiple devices.
 ms.prod: hololens
-ms.mktglfcycl: manage
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+ms.assetid: 2a9b3fca-8370-44ec-8b57-fb98b8d317b0
+author: scooley
+ms.author: scooley
 ms.topic: article
 ms.localizationpriority: medium
-ms.date: 07/27/2017
+ms.date: 07/15/2019
+ms.reviewer: 
+manager: dansimp
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
 ---
 
 # Enroll HoloLens in MDM
@@ -16,26 +21,28 @@ ms.date: 07/27/2017
 You can manage multiple Microsoft HoloLens devices simultaneously using solutions like [Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business). You will be able to manage settings, select apps to install and set security configurations tailored to your organization's need. See [Manage devices running Windows Holographic with Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business), the [configuration service providers (CSPs) that are supported in Windows Holographic](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/configuration-service-provider-reference#hololens), and the [policies supported by Windows Holographic for Business](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#hololenspolicies).
 
 >[!NOTE]
->Mobile device management (MDM), including the VPN, Bitlocker, and kiosk mode features, is only available when you [upgrade to Windows Holographic for Business](hololens-upgrade-enterprise.md).
-
+>Mobile device management (MDM), including the VPN, Bitlocker, and kiosk mode features, is only available when you [upgrade to Windows Holographic for Business](hololens1-upgrade-enterprise.md).
 
 ## Requirements
- Your organization will need to have mobile device management (MDM) set up in order to manage HoloLens devices. Your MDM provider can be Microsoft Intune or a 3rd party provider that uses Microsoft MDM APIs.
 
-## Auto-enrollment in MDM 
+ Your organization will need to have Mobile Device Management (MDM) set up in order to manage HoloLens devices. Your MDM provider can be Microsoft Intune or a 3rd party provider that uses Microsoft MDM APIs.
 
-If your organization uses Azure Active Directory (Azure AD) and an MDM solution that accepts an AAD token for authentication (currently, only supported in Microsoft Intune and AirWatch), your IT admin can configure Azure AD to automatically allow MDM enrollment after the user signs in with their Azure AD account. [Learn how to configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment) 
+## Auto-enrollment in MDM
+
+If your organization uses Azure Active Directory (Azure AD) and an MDM solution that accepts an AAD token for authentication (currently, only supported in Microsoft Intune and AirWatch), your IT admin can configure Azure AD to automatically allow MDM enrollment after the user signs in with their Azure AD account. [Learn how to configure Azure AD enrollment.](https://docs.microsoft.com/intune/deploy-use/set-up-windows-device-management-with-microsoft-intune#azure-active-directory-enrollment)
 
 When auto-enrollment is enabled, no additional manual enrollment is needed. When the user signs in with an Azure AD account, the device is enrolled in MDM after completing the first-run experience.
 
 ## Enroll through Settings app
 
  When the device is not enrolled in MDM during the first-run experience, the user can manually enroll the device with the organization's MDM server using the Settings app.
- 
+
 1. Go to **Settings** > **Accounts** > **Work access**.
-
-2. Select **Enroll into device management** and enter your organizational account. You will be redirected to your organization's sign in page.
-
-4. Upon successful authentication to the MDM server, a success message is shown.
+1. Select **Enroll into device management** and enter your organizational account. You will be redirected to your organization's sign in page.
+1. Upon successful authentication to the MDM server, a success message is shown.
 
 Your device is now enrolled with your MDM server. The device will need to restart to acquire policies, certificates, and apps. The Settings app will now reflect that the device is enrolled in device management.
+
+## Unenroll HoloLens from Intune
+
+You cannot [unenroll](https://docs.microsoft.com/intune-user-help/unenroll-your-device-from-intune-windows) HoloLens from Intune remotely. If the administrator unenrolls the device using MDM, the device will age out of the Intune dashboard.
\ No newline at end of file
diff --git a/devices/hololens/hololens-environment-considerations.md b/devices/hololens/hololens-environment-considerations.md
new file mode 100644
index 0000000000..bdd500b298
--- /dev/null
+++ b/devices/hololens/hololens-environment-considerations.md
@@ -0,0 +1,121 @@
+---
+title: Environment considerations for HoloLens
+description: Get the best possible experience using HoloLens when you optimize the device for your eyes and environment. Many different environmental factors are fused together to enable tracking, but as a Mixed Reality developer, there are several factors you can keep in mind to tune a space for better holograms.
+keywords: holographic frame, field of view, fov, calibration, spaces, environment, how-to
+author: dorreneb
+ms.author: dobrown
+manager: jarrettr
+ms.date: 8/29/2019
+ms.prod: hololens
+ms.topic: article
+audience: ITPro
+ms.localizationpriority: high
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Environment considerations for HoloLens
+
+HoloLens blends the holographic with the "real" world, placing holograms in your surroundings. A holographic app window "hangs" on the wall, a holographic ballerina spins on the tabletop, bunny ears sit on top of your unwitting friend’s head. When you’re using an immersive game or app, the holographic world will spread to fill your surroundings but you’ll still be able to see and move around the space.
+
+The holograms you place will stay where you’ve put them, even if you turn off your device.
+
+## Setting up an environment
+
+HoloLens devices know how to place stable and accurate holograms by *tracking* users in a space. Without proper tracking, the device does not understand the environment or the user within it so holograms can appear in the wrong places, not appear in the same spot every time, or not appear at all. The data used to track users is represented in the *spatial map*.  
+
+Tracking performance is heavily influenced by the environment the user is in, and tuning an environment to induce stable and consistent tracking is an art rather than a science. Many different environmental factors are fused together to enable tracking, but as a Mixed Reality developer, there are several factors you can keep in mind to tune a space for better tracking.
+
+### Lighting
+
+Windows Mixed Reality uses visual light to track the user's location. When an environment is too bright, the cameras can get saturated, and nothing is seen. If the environment is too dark, the cameras cannot pick up enough information, and nothing is seen. Lighting should be even and sufficiently bright that a human can see without effort, but not so bright that the light is painful to look at.  
+
+Areas where there are points of bright light in an overall dim area are also problematic, as the camera has to adjust when moving in and out of bright spaces. This can cause the device to "get lost" and think that the change in light equates to a change in location. Stable light levels in an area will lead to better tracking.  
+
+Any outdoor lighting can also cause instability in the tracker, as the sun may vary considerably over time. For example, tracking in the same space in the summer vs. winter can produce drastically different results, as the secondhand light outside may be higher at different times of year.  
+
+If you have a luxmeter, a steady 500-1000 lux is a good place to start.  
+
+#### Types of lighting
+
+Different types of light in a space can also influence tracking. Light bulbs pulse with the AC electricity running through it - if the AC frequency is 50Hz, then the light pulses at 50Hz. For a human, this pulsing is not noticed. However, HoloLens' 30fps camera sees these changes - some frames will be well-lit, some will be poorly lit, and some will be over-exposed as the camera tries to compensate for light pulses.  
+
+In the USA, electricity frequency standard is 60Hz, so light bulb pulses are harmonized with HoloLens' framerate - 60Hz pulses align with HoloLens' 30 FPS framerate. However, many countries have an AC frequency standard of 50Hz, which means some HoloLens frames will be taken during pulses, and others will not. In particular, fluorescent lighting in Europe has been known to cause issues.  
+
+There are a few things you can try to resolve flickering issues. Temperature, bulb age, and warm-up cycles are common causes of fluorescent flickering and replacing bulbs may help. Tightening bulbs and making sure current draws are constant can also help.  
+
+### Items in a space
+
+HoloLens uses unique environmental landmarks, also known as *features*, to locate itself in a space.  
+
+A device can almost never track in a feature-poor area, as the device has no way of knowing where in space it is. Adding features to the walls of a space is usually a good way to improve tracking. Posters, symbols taped to a wall, plants, unique objects, or other similar items all help. A messy desk is a good example of an environment that leads to good tracking - there are a lot of different features in a single area.  
+
+Additionally, use unique features in the same space. The same poster repeated multiple times over a wall, for example, will cause device confusion as the HoloLens won't know which of the repetitive posters it is looking at. One common way of adding unique features is to use lines of masking tape to create unique, non-repetitive patterns along the walls and floor of a space.  
+
+A good question to ask yourself is: if you saw just a small amount of the scene, could you uniquely locate yourself in the space? If not, it's likely the device will have problems tracking as well.
+
+#### Wormholes
+
+If you have two areas or regions that look the same, the tracker may think they are the same. This results in the device tricking itself into thinking it is somewhere else. We call these types of repetitive areas *wormholes*.  
+
+To prevent wormholes, try to prevent identical areas in the same space. Identical areas can sometimes include factory stations, windows on a building, server racks, or work stations. Labelling areas or adding unique features to each similar-looking areas can help mitigate wormholes.
+
+### Movement in a space
+
+If your environment is constantly shifting and changing, the device has no stable features to locate against.  
+
+The more moving objects that are in a space, including people, the easier it is to lose tracking. Moving conveyor belts, items in different states of construction, and lots of people in a space have all been known to cause tracking issues.
+
+The HoloLens can quickly adapt to these changes, but only when that area is clearly visible to the device. Areas that are not seen as frequently may lag behind reality, which can cause errors in the spatial map. For example, a user scans a friend and then turns around while the friend leaves the room. A 'ghost' representation of the friend will persist in the spatial mapping data until the user re-scans the now empty space.
+
+### Proximity of the user to items in the space
+
+Similarly to how humans cannot focus well on objects close to the eyes, HoloLens struggles when objects are close to it's cameras. If an object is too close to be seen with both cameras, or if an object is blocking one camera, the device will have far more issues with tracking against the object.  
+
+The cameras can see no closer than 15cm from an object.
+
+### Surfaces in a space
+
+Strongly reflective surfaces will likely look different depending on the angle, which affects tracking. Think of a brand new car - when you move around it, light reflects and you see different objects in the surface as you move. To the tracker, the different objects reflected in the surface represent a changing environment, and the device loses tracking.
+
+Less shiny objects are easier to track against.
+
+### Wi-Fi fingerprint considerations
+
+As long as Wi-Fi is enabled, map data will be correlated with a Wi-Fi fingerprint, even when not connected to an actual WiFi network/router. Without Wi-Fi info, the space and holograms may be slightly slower to recognize. If the Wi-Fi signals change significantly, the device may think it is in a different space altogether.
+
+Network identification (such as SSID or MAC address) is not sent to Microsoft, and all Wi-Fi references are kept local on the HoloLens.
+
+## Mapping new spaces
+
+When you enter a new space (or load an existing one), you’ll see a mesh graphic spreading over the space. This means your device is mapping your surroundings. While a HoloLens will learn a space over time, there are tips and tricks to map spaces.
+
+## Environment management
+
+There are two settings which enable users to “clean up” holograms and cause HoloLens to “forget" a space. They exist in **Holograms and environments** in the settings app, with the second setting also appearing under **Privacy** in the settings app.  
+
+1. **Delete nearby holograms**. When you select this setting, HoloLens will erase all anchored holograms and all stored map data for the “current space” where the device is located. A new map section would be created and stored in the database for that location once holograms are again placed in that same space.
+
+1. **Delete all holograms**.By selecting this setting, HoloLens will erase ALL map data and anchored holograms in the entire databases of spaces. No holograms will be rediscovered and any holograms need to be newly placed to again store map sections in the database.
+
+## Hologram quality
+
+Holograms can be placed throughout your environment—high, low, and all around you—but you’ll see them through a [holographic frame](https://docs.microsoft.com/windows/mixed-reality/holographic-frame) that sits in front of your eyes. To get the best view, make sure to adjust your device so you can see the entire frame. And don’t hesitate to walk around your environment and explore!
+
+For your [holograms](https://docs.microsoft.com/windows/mixed-reality/hologram) to look crisp, clear, and stable, your HoloLens needs to be calibrated just for you. When you first set up your HoloLens, you’ll be guided through this process. Later on, if holograms don’t look right or you’re seeing a lot of errors, you can make adjustments.
+
+If you are having trouble mapping spaces, try deleting nearby holograms and remapping the space.
+
+### Calibration
+
+If your holograms look jittery or shaky, or if you’re having trouble placing holograms, the first thing to try is the [Calibration app](hololens-calibration.md). This app can also help if you’re experiencing any discomfort while using your HoloLens.
+
+To get to the Calibration app, go to **Settings** > **System** > **Utilities**. Select **Open Calibration** and follow the instructions.
+
+If someone else is going to be using your HoloLens, they should run the Calibration app first so the device is set up properly for them.
+
+## See also
+
+- [Spatial mapping design](https://docs.microsoft.com/windows/mixed-reality/spatial-mapping)
+- [Holograms](https://docs.microsoft.com/windows/mixed-reality/hologram)
diff --git a/devices/hololens/hololens-feedback.md b/devices/hololens/hololens-feedback.md
new file mode 100644
index 0000000000..3199517a90
--- /dev/null
+++ b/devices/hololens/hololens-feedback.md
@@ -0,0 +1,82 @@
+---
+title: Give us feedback
+description: Create actionable feedback for HoloLens and Windows Mixed Reality developers by using the Feedback Hub.
+ms.assetid: b9b24c72-ff86-44a9-b30d-dd76c49479a9
+author: mattzmsft
+ms.author: mazeller
+ms.date: 09/13/2019
+ms.prod: hololens
+ms.topic: article
+keywords: feedback, bug, issue, error, troubleshoot, help
+manager: jarrettr
+ms.localizationpriority: medium
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Give us feedback
+
+Use the Feedback Hub to tell us which features you love, which features you could do without, or when something could be better.
+
+## Feedback for Windows Mixed Reality immersive headset on PC
+
+> [!IMPORTANT]
+> Before you report an issue, make sure that your environment meets the following requirements so that you can successfully upload logs and other information:
+>
+> - Have a minimum of 3GB free disk space available on the main drive of the device.
+> - To upload cabs or other large files, connect to a non-metered network.
+
+1. Make sure that you have the immersive headset connected to your PC, and then on the desktop, select **Feedback Hub**.
+1. In the left pane, select **Feedback**.
+    ![Feedback tab](images/feedback1-600px.png)
+1. To enter new feedback, select **Add new feedback**.
+  ![Add new feedback](images/feedback2-600px.png)
+1. To make feedback actionable, in **What kind of feedback is this?** select **Problem**.
+1. In **Summarize your issue**, enter a meaningful title for your feedback.
+1. In **Give us more detail**, provide details and repro steps.
+  ![Details and repro steps](images/feedback3-600px.png)
+
+    As the top category, select **Mixed Reality**. Then select an applicable subcategory, as explained in the following table:
+    
+    |Subcategory  |Description |
+    |----------|----------|
+    |  Apps  |  Issues about a specific application. |
+    |  Developer  |  Issues about authoring or running an app for Mixed Reality. |
+    |  Device  |  Issues about the head-mounted device (HMD) itself. |
+    |  Home experience  |  Issues about your VR environment and your interactions with the your mixed reality home. |
+    |  Input  |  Issues about input methods, such as motion controllers, speech, gamepad, or mouse and keyboard. |
+    |  Set up  |  Anything that is preventing you from setting up the device. |
+    |  All other issues  |  Anything else. |
+  
+1. If possible, add traces or video to your feedback to help us identify and fix the issue more quickly. To do this, follow these steps:
+   1. To start collecting traces, select **Start capture**. The app starts collecting traces and a video capture of your mixed reality scenario.
+   
+    ![Start Capture](images/feedback4-600px.png)
+   1. Do not close the Feedback Hub app, but switch to the scenario that produces the issue. Run through the scenario to produce the circumstances that you have described.
+   1. After you finish your scenario, go back to the Feedback Hub app and select **Stop capture**. The app stops collecting information, stores the information in a file, and attaches the file to your feedback.
+1. Select **Submit**.
+  ![Submit](images/feedback5-600px.png)
+   The Thank You page indicates that your feedback has been successfully submitted.
+  ![Thank You](images/feedback6-600px.png)
+
+To easily direct other people (such as co-workers, Microsoft staff, [forum](https://forums.hololens.com/) readers et al) to the issue, go to **Feedback** > **My Feedback**, select the issue, select **Share**. This action provides a shortened URL that you can give to others so that they can upvote or escalate your issue.
+
+## Feedback for HoloLens
+
+1. Use the **bloom** gesture to open the **Start** menu, and then select **Feedback Hub**.
+
+   ![Start menu on Microsoft HoloLens](images/startmenu.jpg)
+1. Place the app in your environment and then select the app to launch it.
+1. To see if someone else has given similar feedback, in the Feedback search box, enter a few keywords about the topic.
+
+   ![Search Feedback](images/searchfeedback-500px.jpg)
+1. If you find similar feedback, select it, add any details, then select **Upvote**.
+
+   ![Upvote existing Feedback](images/upvotefeedback-500px.jpg)
+1. If you don’t find any similar feedback, select **Add new feedback**, select a topic from **Select a category**, and then select a subcategory from **Select a subcategory**.
+
+   ![Add new Feedback](images/addnewfeedback-500px.jpg)
+1. Enter your feedback.
+1. If you are reporting a reproducible issue, you can select **Reproduce**. Without closing Feedback Hub, reproduce the issue. After you finish, come back to Feedback Hub and select **I’m done**. The app adds a mixed reality capture of your repro and relevant diagnostic logs to your feedback.
+1. Select **Post feedback**, and you’re done.
diff --git a/devices/hololens/hololens-identity.md b/devices/hololens/hololens-identity.md
new file mode 100644
index 0000000000..3cc6cc4cfc
--- /dev/null
+++ b/devices/hololens/hololens-identity.md
@@ -0,0 +1,111 @@
+---
+title: Managing user identity and login on HoloLens
+description: Manage user identity, security, and login on HoloLens.
+keywords: HoloLens, user, account, aad, adfs, microsoft account, msa, credentials, reference
+ms.assetid: 728cfff2-81ce-4eb8-9aaa-0a3c3304660e
+author: scooley
+ms.author: scooley
+ms.date: 1/6/2019
+ms.prod: hololens
+ms.topic: article
+ms.sitesec: library
+ms.topic: article
+ms.localizationpriority: medium
+audience: ITPro
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# User identity and signin
+
+> [!NOTE]
+> This article is a technical reference for IT Pros and tech enthusiasts. If you're looking for HoloLens set up instructions, read "[Setting up your HoloLens (1st gen)](hololens1-start.md)" or "[Setting up your HoloLens 2](hololens2-start.md)".
+
+Like other Windows devices, HoloLens always operates under a user context. There is always a user identity. HoloLens treats identity in almost the same manner as other Windows 10 devices do. This article is a deep-dive reference for identity on HoloLens, and focuses on how HoloLens differs from other Windows 10 devices.
+
+HoloLens supports several kinds of user identities. You can use one or more user accounts to sign in. Here's an overview of the identity types and authentication options on HoloLens:
+
+| Identity type | Accounts per device | Authentication options |
+| --- | --- | --- |
+| [Azure Active Directory (AAD)](https://docs.microsoft.com/azure/active-directory/) | 32 (see details) | 
            • Azure web credential provider
            • Azure Authenticator App
            • Biometric (Iris) – HoloLens 2 only
            • PIN – Optional for HoloLens (1st gen), required for HoloLens 2
            • Password
             |
+| [Microsoft Account (MSA)](https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts) | 1 | 
            • Biometric (Iris) – HoloLens 2 only
            • PIN – Optional for HoloLens (1st gen), required for HoloLens 2
            • Password
             |
+| [Local account](https://docs.microsoft.com/windows/security/identity-protection/access-control/local-accounts) | 1 | Password |
+
+Cloud-connected accounts (AAD and MSA) offer more features because they can use Azure services.  
+
+## Setting up users
+
+The most common way to set up a new user is during the HoloLens out-of-box experience (OOBE). During setup, HoloLens prompts for a user to sign in by using the account that they want to use on the device. This account can be a consumer Microsoft account or an enterprise account that has been configured in Azure. See Setting up your [HoloLens (1st gen)](hololens1-start.md) or [HoloLens 2](hololens2-start.md).
+
+Like Windows on other devices, signing in during setup creates a user profile on the device. The user profile stores apps and data. The same account also provides Single Sign-on for apps such as Edge or Skype by using the Windows Account Manager APIs.  
+
+If you use an enterprise or organizational account to sign in to HoloLens, HoloLens enrolls in the organization's IT infrastructure. This enrollment allows your IT Admin to configure Mobile Device Management (MDM) to send group policies to your HoloLens.
+
+By default, as for other Windows 10 devices, you'll have to sign in again when HoloLens restarts or resumes from standby. You can use the Settings app to change this behavior, or the behavior can be controlled by group policy.
+
+### Linked accounts
+
+As in the Desktop version of Windows, you can link additional web account credentials to your HoloLens account. Such linking makes it easier to access resources across or within apps (such as the Store) or to combine access to personal and work resources. After you connect an account to the device, you can grant permission to use the device to apps so that you don't have to sign in to each app individually.
+
+Linking accounts does not separate the user data created on the device, such as images or downloads.  
+
+### Setting up multi-user support (AAD only)
+
+> [!NOTE]
+> **HoloLens (1st gen)** began supporting multiple AAD users in the [Windows 10 April 2018 Update](https://docs.microsoft.com/windows/mixed-reality/release-notes-april-2018) as part of [Windows Holographic for Business](hololens-upgrade-enterprise.md).
+
+HoloLens supports multiple users from the same AAD tenant. To use this feature, you must use an account that belongs to your organization to set up the device. Subsequently, other users from the same tenant can sign in to the device from the sign-in screen or by tapping the user tile on the Start panel. Only one user can be signed in at a time. When a user signs in, HoloLens signs out the previous user.  
+
+All users can use the apps installed on the device. However, each user has their own app data and preferences. Removing an app from the device removes it for all users.  
+
+## Removing users
+
+You can remove a user from the device by going to **Settings** > **Accounts** > **Other people**. This action also reclaims space by removing all of that user's app data from the device.  
+
+## Using single sign-on within an app
+
+As an app developer, you can take advantage of linked identities on HoloLens by using the [Windows Account Manager APIs](https://docs.microsoft.com/uwp/api/Windows.Security.Authentication.Web.Core), just as you would on other Windows devices. Some code samples for these APIs are available [here](https://go.microsoft.com/fwlink/p/?LinkId=620621).
+
+Any account interrupts that might occur, such as requesting user consent for account information, two-factor authentication, and so forth, must be handled when the app requests an authentication token.
+
+If your app requires a specific account type that hasn't been linked previously, your app can ask the system to prompt the user to add one. This request triggers the account settings pane to launch as a modal child of your app. For 2D apps, this window renders directly over the center of your app. For Unity apps, this request briefly takes the user out of your holographic app to render the child window. For information about customizing the commands and actions on this pane, see [WebAccountCommand Class](https://docs.microsoft.com/uwp/api/Windows.UI.ApplicationSettings.WebAccountCommand).
+
+## Enterprise and other authentication
+
+If your app uses other types of authentication, such as NTLM, Basic, or Kerberos, you can use [Windows Credential UI](https://docs.microsoft.com/uwp/api/Windows.Security.Credentials.UI) to collect, process, and store the user's credentials. The user experience for collecting these credentials is very similar to other cloud-driven account interrupts, and appears as a child app on top of your 2D app or briefly suspends a Unity app to show the UI.
+
+## Deprecated APIs
+
+One way in which developing for HoloLens differs from developing for Desktop is that the [OnlineIDAuthenticator](https://docs.microsoft.com/uwp/api/Windows.Security.Authentication.OnlineId.OnlineIdAuthenticator) API is not fully supported. Although the API returns a token if the primary account is in good-standing, interrupts such as those described in this article do not display any UI for the user and fail to correctly authenticate the account.
+
+## Frequently asked questions
+
+### Is Windows Hello for Business supported on HoloLens?
+
+Windows Hello for Business (which supports using a PIN to sign in) is supported for HoloLens. To allow Windows Hello for Business PIN sign-in on HoloLens:
+
+1. The HoloLens device must be [managed by MDM](hololens-enroll-mdm.md).
+1. You must enable Windows Hello for Business for the device. ([See instructions for Microsoft Intune.](https://docs.microsoft.com/intune/windows-hello))
+1. On HoloLens, the user can then use **Settings** > **Sign-in Options** > **Add PIN** to set up a PIN.
+
+> [!NOTE]
+> Users who sign in by using a Microsoft account can also set up a PIN in **Settings** > **Sign-in Options** > **Add PIN**. This PIN is associated with [Windows Hello](https://support.microsoft.com/help/17215/windows-10-what-is-hello), rather than [Windows Hello for Business](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-overview).
+
+#### Does the type of account change the sign-in behavior?
+
+Yes, the behavior for the type of account affects the sign-in behavior. If you apply policies for sign-in, the policy is always respected. If no policy for sign-in is applied, these are the default behaviors for each account type:
+
+- **Microsoft account**: signs in automatically
+- **Local account**: always asks for password, not configurable in **Settings**
+- **Azure AD**: asks for password by default, and configurable by **Settings** to no longer ask for password.
+
+> [!NOTE]
+> Inactivity timers are currently not supported, which means that the **AllowIdleReturnWithoutPassword** policy is only respected when the device goes into StandBy.
+
+## Additional resources
+
+Read much more about user identity protection and authentication on [the Windows 10 security and identity documentation](https://docs.microsoft.com/windows/security/identity-protection/).
+
+Learn more about setting up hybrid identity infrastructure thorough the [Azure Hybrid identity documentation](https://docs.microsoft.com/azure/active-directory/hybrid/).
diff --git a/devices/hololens/hololens-insider.md b/devices/hololens/hololens-insider.md
index 3a90c8fe68..633f296a3e 100644
--- a/devices/hololens/hololens-insider.md
+++ b/devices/hololens/hololens-insider.md
@@ -3,50 +3,52 @@ title: Insider preview for Microsoft HoloLens (HoloLens)
 description: It’s simple to get started with Insider builds and to provide valuable feedback for our next major operating system update for HoloLens.
 ms.prod: hololens
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: scooley
+ms.author: scooley
 ms.topic: article
 ms.localizationpriority: medium
-ms.date: 10/23/2018
+audience: ITPro
+ms.date: 1/6/2020
+ms.reviewer: 
+manager: dansimp
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
 ---
 
 # Insider preview for Microsoft HoloLens
 
-Welcome to the latest Insider Preview builds for HoloLens!  It’s simple to get started and provide valuable feedback for our next major operating system update for HoloLens. 
- 
+Welcome to the latest Insider Preview builds for HoloLens!  It’s simple to get started and provide valuable feedback for our next major operating system update for HoloLens.
 
- 
-
-## How do I install the Insider builds? 
- 
-On a device running the Windows 10 April 2018 Update, go to **Settings -> Update & Security -> Windows Insider Program** and select **Get started**. Link the account you used to register as a Windows Insider. 
+## Start receiving Insider builds
 
-Then, select **Active development of Windows**, choose whether you’d like to receive **Fast** or **Slow** builds, and review the program terms. 
+On a device running the Windows 10 April 2018 Update, go to **Settings** -> **Update & Security** -> **Windows Insider Program** and select **Get started**. Link the account you used to register as a Windows Insider.
 
-Select **Confirm -> Restart Now** to finish up. After your device has rebooted, go to **Settings -> Update & Security -> Check for updates** to get the latest build. 
+Then, select **Active development of Windows**, choose whether you’d like to receive **Fast** or **Slow** builds, and review the program terms.
 
-## How do I stop receiving Insider builds?
+Select **Confirm -> Restart Now** to finish up. After your device has rebooted, go to **Settings -> Update & Security -> Check for updates** to get the latest build.
 
-If you no longer want to receive Insider builds of Windows Holographic, you can opt out when your HoloLens is running a production build, or you can [recover your device](https://docs.microsoft.com/windows/mixed-reality/reset-or-recover-your-hololens#perform-a-full-device-recovery) using the Windows Device Recovery Tool to recover your device to a non-Insider version of Windows Holographic.
+## Stop receiving Insider builds
+
+If you no longer want to receive Insider builds of Windows Holographic, you can opt out when your HoloLens is running a production build, or you can [recover your device](hololens-recovery.md) using the Windows Device Recovery Tool to recover your device to a non-Insider version of Windows Holographic.
 
 To verify that your HoloLens is running a production build:
+
 - Go to **Settings > System > About**, and find the build number.
-- If the build number is 10.0.17763.1, your HoloLens is running a production build. [See the list of production build numbers.](https://www.microsoft.com/itpro/windows-10/release-information)
+- [See the release notes for production build numbers.](hololens-release-notes.md)
 
 To opt out of Insider builds:
+
 - On a HoloLens running a production build, go to **Settings > Update & Security > Windows Insider Program**, and select **Stop Insider builds**.
 - Follow the instructions to opt out your device.
 
+## Provide feedback and report issues
 
+Please use [the Feedback Hub app](hololens-feedback.md) on your HoloLens to provide feedback and report issues. Using Feedback Hub ensures that all necessary diagnostics information is included to help our engineers quickly debug and resolve the problem.  Issues with the Chinese and Japanese version of HoloLens should be reported the same way.
+
+>[!NOTE]
+>Be sure to accept the prompt that asks whether you’d like Feedback Hub to access your Documents folder (select **Yes** when prompted).
 
 ## Note for developers
 
 You are welcome and encouraged to try developing your applications using Insider builds of HoloLens.  Check out the [HoloLens Developer Documentation](https://developer.microsoft.com/windows/mixed-reality/development) to get started. Those same instructions work with Insider builds of HoloLens.  You can use the same builds of Unity and Visual Studio that you're already using for HoloLens development.
-
-## Provide feedback and report issues
-
-Please use [the Feedback Hub app](https://docs.microsoft.com/windows/mixed-reality/give-us-feedback) on your HoloLens or Windows 10 PC to provide feedback and report issues. Using Feedback Hub ensures that all necessary diagnostics information is included to help our engineers quickly debug and resolve the problem.  Issues with the Chinese and Japanese version of HoloLens should be reported the same way.
-
->[!NOTE]
->Be sure to accept the prompt that asks whether you’d like Feedback Hub to access your Documents folder (select **Yes** when prompted).
- 
diff --git a/devices/hololens/hololens-install-apps.md b/devices/hololens/hololens-install-apps.md
deleted file mode 100644
index 05d7673aa2..0000000000
--- a/devices/hololens/hololens-install-apps.md
+++ /dev/null
@@ -1,94 +0,0 @@
----
-title: Install apps on HoloLens (HoloLens)
-description: The recommended way to install apps on HoloLens is to use Microsoft Store for Business.
-ms.prod: hololens
-ms.mktglfcycl: manage
-ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
-ms.topic: article
-ms.localizationpriority: medium
-ms.date: 10/23/2018
----
-
-# Install apps on HoloLens
-
-The recommended way to install Universal Windows Platform (UWP) apps on HoloLens is to use Microsoft Store for Business. You can make your own [line-of-business application](https://technet.microsoft.com/itpro/windows/manage/working-with-line-of-business-apps) available through Microsoft Store for Business.
-
-You can also deploy apps using your mobile device management (MDM) provider or use the Windows Device Portal to install apps.
-
-## Use Microsoft Store for Business to deploy apps to HoloLens
-
-Microsoft Store for Business is a private Microsoft Store for your enterprise. People in your organization can open the Store app and select your private Store to install apps that you have made available to them. 
-
-![How Microsoft Store for Business appears in Store app](images/wsfb-private.png)
-
-In your Microsoft Store for Business dashboard, you can also download apps to distribute to devices that aren't connected to the Internet, plus add line-of-business (LOB) apps for distribution. 
-
-### Requirements
-
-- You need to be a global administrator for your Azure Active Directory (Azure AD) tenant. 
-
-    >[!TIP]
-    >You can create an Azure AD account and tenant as part of the Store for Business sign-up process.
-     
-- End users need Azure AD accounts when they access Store for Business content from Windows-based devices.
-
-### Microsoft Store for Business process
-
-1. [Sign up for Microsoft Store for Business.](https://technet.microsoft.com/itpro/windows/manage/sign-up-windows-store-for-business)
-2. [Assign roles and permissions for managing your Store for Business.](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business)
-3. (Optional) [Configure Microsoft Store for Business to work with your MDM provider.](https://technet.microsoft.com/itpro/windows/manage/configure-mdm-provider-windows-store-for-business)
-3. [Get apps for your Store for Business.](https://technet.microsoft.com/itpro/windows/manage/acquire-apps-windows-store-for-business)
-4. [Distribute apps to your employees.](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-to-your-employees-windows-store-for-business)
-
-### Install apps on HoloLens from Microsoft Store for Business
-
-The method that you use to install an app from your Microsoft Store for Business on HoloLens depends on the distribution method that you choose.
-
-| Distribution method | To install on HoloLens|
-| --- | --- |
-| [Using private store](https://docs.microsoft.com/microsoft-store/distribute-apps-from-your-private-store) | Open the Store app and select the tab for your organization to choose from available apps.  |
-| Using MDM | [You can configure MDM to synchronize your Store for Business inventory.](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-with-management-tool)

             See the **Important** note in [Use MDM to deploy apps to HoloLens.](#use-mdm-to-deploy-apps-to-hololens) |
-
-
-
-## Use MDM to deploy apps to HoloLens
-
->[!IMPORTANT]
->Online-licensed apps cannot be deployed with Microsoft Store for Business on HoloLens via an MDM provider. If attempted, apps will remain in “downloading” state. Instead, you can use your MDM provider to deploy MDM-hosted apps to HoloLens, or deploy offline-licensed apps to HoloLens via Store for Business
-
-
-You can deploy UWP apps to HoloLens using your MDM provider. For Intune instructions, see [Deploy apps in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/add-apps).
-
-Using Intune, you can also [monitor your app deployment](https://docs.microsoft.com/intune/deploy-use/monitor-apps-in-microsoft-intune).
-
-
-
-## Use the Windows Device Portal to install apps on HoloLens
-
->[!IMPORTANT]
->When you set up HoloLens to use the Device Portal, you must enable **Developer Mode** on the device. **Developer Mode** on a device that has been upgraded to Windows Holographic for Business enables side-loading of apps, which risks the installation of apps that have not been certified by the Microsoft Store. Administrators can block the ability to enable **Developer Mode** using the **ApplicationManagement/AllowDeveloper Unlock** setting in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). [Learn more about Developer Mode.](https://msdn.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode)
-
-1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. 
-
-2. On a PC, connect to the HoloLens using [Wi-Fi](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_wi-fi) or [USB](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#connecting_over_usb).
-
-3. [Create a user name and password](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#creating_a_username_and_password) if this is the first time you connect to the Windows Device Portal, or enter the user name and password that you previously set up.
-
-    >[!TIP]
-    >If you see a certificate error in the browser, follow [these troubleshooting steps](https://developer.microsoft.com/windows/mixed-reality/Using_the_Windows_Device_Portal.html#security_certificate).
-
-4. In the Windows Device Portal, click **Apps**.
-
-    ![App Manager](images/apps.png)
-    
-5. In **Install app**, select an **app package** from a folder on your computer or network. If the app package requires additional software, such as dependency frameworks, select **I want to specify framework packages**.
-
-6. In **Deploy**, click **Go** to deploy the app package and added dependencies to the connected HoloLens.
-
-
-
-
-
-
diff --git a/devices/hololens/hololens-install-localized.md b/devices/hololens/hololens-install-localized.md
deleted file mode 100644
index e3729388c3..0000000000
--- a/devices/hololens/hololens-install-localized.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-title: Install localized versions of HoloLens (HoloLens)
-description: Learn how to install the Chinese or Japanese versions of HoloLens
-ms.prod: hololens
-ms.mktglfcycl: manage
-ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
-ms.topic: article
-ms.localizationpriority: medium
-ms.date: 11/13/2018
----
-
-# Install localized versions of HoloLens
-
-In order to switch to the Chinese or Japanese version of HoloLens, you’ll need to download the build for the language on a PC and then install it on your HoloLens using the Windows Device Recovery Tool (WDRT). 
- 
->[!IMPORTANT] 
->Installing the Chinese or Japanese builds of HoloLens using WDRT will delete existing data, like personal files and settings, from your HoloLens. 
- 
-   
-2. On your PC, download and install [the Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379). 
-3. Download the package for the language you want to your PC:  [Simplified Chinese](https://aka.ms/hololensdownload-ch) or [Japanese](https://aka.ms/hololensdownload-jp).
-4. When the download is finished, select **File Explorer > Downloads**. Right-click the zipped folder you just downloaded, and select **Extract all... > Extract** to unzip it. 
-5. Connect your HoloLens to your PC using the micro-USB cable it came with. (Even if you've been using other cables to connect your HoloLens, this one works best.)  
-6. The tool will automatically detect your HoloLens. Select the Microsoft HoloLens tile. 
-7. On the next screen, select **Manual package selection** and choose the installation file contained in the folder you unzipped in step 4. (Look for a file with the extension “.ffu”.) 
-8. Select **Install software** and follow the instructions to finish installing. 
-9. Once the build is installed, HoloLens setup will start automatically. Put on the device and follow the setup directions. 
- 
-When you’re done with setup, go to **Settings -> Update & Security -> Windows Insider Program** and check that you’re configured to receive the latest preview builds.  The Chinese/Japanese version of HoloLens will be kept up-to-date with the latest preview builds via the Windows Insider Program the same way the English version is. 
-
-## Note for language support
-
-- You can’t change the system language between English, Japanese, and Chinese using the Settings app. Flashing a new build is the only supported way to change the device system language.
-- While you can enter Simplified Chinese / Japanese text using the on-screen Pinyin keyboard, typing in Simplified Chinese / Japanese using a Bluetooth hardware keyboard is not supported at this time.  However, on Chinese/Japanese HoloLens, you can continue to use a BT keyboard to type in English (the ~ key on a hardware keyboard toggles the keyboard to type in English).
diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md
index c888927596..d0dbb126b7 100644
--- a/devices/hololens/hololens-kiosk.md
+++ b/devices/hololens/hololens-kiosk.md
@@ -3,22 +3,24 @@ title: Set up HoloLens in kiosk mode (HoloLens)
 description: Use a kiosk configuration to lock down the apps on HoloLens. 
 ms.prod: hololens
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.localizationpriority: medium
 ms.date: 11/13/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Set up HoloLens in kiosk mode
 
 
 
-In Windows 10, version 1803, you can configure your HoloLens devices to run as multi-app or single-app kiosks. You can also configure guest access for a HoloLens kiosk device by [designating a SpecialGroup account in your XML file.](#guest)
+In Windows 10, version 1803, you can configure your HoloLens devices to run as multi-app or single-app kiosks. You can also configure guest access for a HoloLens kiosk device by [designating a SpecialGroup account in your XML file.](#add-guest-access-to-the-kiosk-configuration-optional)
 
 When HoloLens is configured as a multi-app kiosk, only the allowed apps are available to the user. The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. 
 
-Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the bloom gesture and Cortana are disabled, and placed apps aren't shown in the user's surroundings. 
+Single-app kiosk mode starts the specified app when the user signs in, and restricts the user's ability to launch new apps or change the running app. When single-app kiosk mode is enabled for HoloLens, the [start gestures](https://docs.microsoft.com/hololens/hololens2-basic-usage#start-gesture) (including [Bloom](https://docs.microsoft.com/hololens/hololens1-basic-usage) on HoloLens (1st Gen)) and Cortana are disabled, and placed apps aren't shown in the user's surroundings. 
 
 The following table lists the device capabilities in the different kiosk modes.
 
@@ -38,24 +40,22 @@ The [AssignedAccess Configuration Service Provider (CSP)](https://docs.microsoft
 >Be aware that voice commands are enabled for kiosk mode configured in Microsoft Intune or provisioning packages, even if the Cortana app is not selected as a kiosk app. 
 
 For HoloLens devices running Windows 10, version 1803, there are three methods that you can use to configure the device as a kiosk:
-- You can use [Microsoft Intune or other mobile device management (MDM) service](#intune-kiosk) to configure single-app and multi-app kiosks.
-- You can [use a provisioning package](#ppkg-kiosk) to configure single-app and multi-app kiosks.
-- You can [use the Windows Device Portal](#portal-kiosk) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device.
+- You can use [Microsoft Intune or other mobile device management (MDM) service](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803) to configure single-app and multi-app kiosks.
+- You can [use a provisioning package](#setup-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure single-app and multi-app kiosks.
+- You can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks. This method is recommended only for demonstrations, as it requires that developer mode be enabled on the device.
 
-For HoloLens devices running Windows 10, version 1607, you can [use the Windows Device Portal](#portal-kiosk) to configure single-app kiosks.
+For HoloLens devices running Windows 10, version 1607, you can [use the Windows Device Portal](#set-up-kiosk-mode-using-the-windows-device-portal-windows-10-version-1607-and-version-1803) to configure single-app kiosks.
 
-
-## Start layout for HoloLens 
+## Start layout for HoloLens
 
-If you use [MDM, Microsoft Intune](#intune-kiosk), or a [provisioning package](#ppkg-kiosk) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. 
+If you use [MDM, Microsoft Intune](#set-up-kiosk-mode-using-microsoft-intune-or-mdm-windows-10-version-1803), or a [provisioning package](#setup-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to configure a multi-app kiosk, the procedure requires a Start layout. Start layout customization isn't supported in Holographic for Business, so you'll need to use a placeholder Start layout. 
 
 >[!NOTE]
 >Because a single-app kiosk launches the kiosk app when a user signs in, there is no Start screen displayed.
 
-
 ### Start layout file for MDM (Intune and others)
 
-Save the following sample as an XML file. You will select this file when you configure the kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile).
+Save the following sample as an XML file. You can use this file when you configure the multi-app kiosk in Microsoft Intune (or in another MDM service that provides a kiosk profile).
 
 >[!NOTE]
 >If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, use the [Start layout instructions for a provisioning package](#start-layout-for-a-provisioning-package). 
@@ -78,7 +78,7 @@ Save the following sample as an XML file. You will select this file when you con
 
 ### Start layout for a provisioning package
 
-You will [create an XML file](#ppkg-kiosk) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file.
+You will [create an XML file](#setup-kiosk-mode-using-a-provisioning-package-windows-10-version-1803) to define the kiosk configuration to be included in a provisioning package. Use the following sample in the `StartLayout` section of your XML file.
 
 ```xml
 
@@ -98,34 +98,28 @@ You will [create an XML file](#ppkg-kiosk) to define the kiosk configuration to
                 ]]>
             
             
-``` 
+```
 
-
 ## Set up kiosk mode using Microsoft Intune or MDM (Windows 10, version 1803)
 
 For HoloLens devices that are managed by Microsoft Intune, you [create a device profile](https://docs.microsoft.com/intune/device-profile-create) and configure the [Kiosk settings](https://docs.microsoft.com/intune/kiosk-settings).
 
-For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file.  
+For other MDM services, check your provider's documentation for instructions. If you need to use a custom setting and full XML configuration to set up a kiosk in your MDM service, [create an XML file that defines the kiosk configuration](#create-a-kiosk-configuration-xml-file), and make sure to include the [Start layout](#start-layout-for-a-provisioning-package) in the XML file.  
 
-
-
-
 ## Setup kiosk mode using a provisioning package (Windows 10, version 1803)
 
 Process:
-1. [Create an XML file that defines the kiosk configuration.](#create-xml-file)
-2. [Add the XML file to a provisioning package.](#add-xml)
-3. [Apply the provisioning package to HoloLens.](#apply-ppkg)
+1. [Create an XML file that defines the kiosk configuration.](#create-a-kiosk-configuration-xml-file)
+2. [Add the XML file to a provisioning package.](#add-the-kiosk-configuration-xml-file-to-a-provisioning-package)
+3. [Apply the provisioning package to HoloLens.](#apply-the-provisioning-package-to-hololens)
 
-
 ### Create a kiosk configuration XML file
 
 Follow [the instructions for creating a kiosk configuration XML file for desktop](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configure-a-kiosk-using-a-provisioning-package), with the following exceptions:
 
 - Do not include Classic Windows applications (Win32) since they aren't supported on HoloLens.
-- Use the [placeholder Start XML](#start-kiosk) for HoloLens.
+- Use the [placeholder Start XML](#start-layout-for-hololens) for HoloLens.
 
-
 #### Add guest access to the kiosk configuration (optional)
 
 In the [Configs section of the XML file](https://docs.microsoft.com/windows/configuration/lock-down-windows-10-to-specific-apps#configs), you can configure a special group named **Visitor** to allow guests to use the kiosk. When the kiosk is configured with the **Visitor** special group, a "**Guest**" option is added to the sign-in page. The **Guest** account does not require a password, and any data associated with the account is deleted when the account signs out.
@@ -141,8 +135,6 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest*
  
 ```
 
-
-
 ### Add the kiosk configuration XML file to a provisioning package
 
 1. Open [Windows Configuration Designer](https://www.microsoft.com/store/apps/9nblggh4tx22).
@@ -153,27 +145,25 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest*
 6. Expand **Runtime settings** > **AssignedAccess** > **MultiAppAssignedAccessSettings**.
 7. In the center pane, click **Browse** to locate and select the kiosk configuration XML file that you created.
 
-  ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png)
+   ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png)
 
 8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed.   
-8. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**.
-8.  On the **File** menu, select **Save.**
-9.  On the **Export** menu, select **Provisioning package**.
-10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
+9. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**.
+10. On the **File** menu, select **Save.**
+11. On the **Export** menu, select **Provisioning package**.
+12. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.**
 
-11. On the **Provisioning package security** page, do not select **Enable package encryption** or provisioning will fail on HoloLens. You can choose to enable package signing.
+13. On the **Provisioning package security** page, do not select **Enable package encryption** or provisioning will fail on HoloLens. You can choose to enable package signing.
 
       -   **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package.
 
-12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location.
+14. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Configuration Designer uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location.
 
-13. Click **Next**.
+15. Click **Next**.
 
-14. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
+16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status.
 
     
-
-
 ### Apply the provisioning package to HoloLens
 
 1. Connect HoloLens via USB to a PC and start the device, but do not continue past the **Fit** page of OOBE (the first page with the blue box).
@@ -189,7 +179,6 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest*
 7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with OOBE.
 
 
-
 ## Set up kiosk mode using the Windows Device Portal (Windows 10, version 1607 and version 1803) 
 
 1. [Set up the HoloLens to use the Windows Device Portal](https://developer.microsoft.com/windows/mixed-reality/using_the_windows_device_portal#setting_up_hololens_to_use_windows_device_portal). The Device Portal is a web server on your HoloLens that you can connect to from a web browser on your PC. 
@@ -209,7 +198,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest*
     ![Kiosk Mode](images/kiosk.png)
 
     >[!NOTE]
-    >The kiosk mode option will be available if the device is [enrolled in device management](hololens-enroll-mdm.md) and has a [license to upgrade to Windows Holographic for Business](hololens-upgrade-enterprise.md).
+    >The kiosk mode option will be available if the device is [enrolled in device management](hololens-enroll-mdm.md) and has a [license to upgrade to Windows Holographic for Business](hololens1-upgrade-enterprise.md).
 
 5. Select **Enable Kiosk Mode**, choose an app to run when the device starts, and click **Save**.
 
@@ -226,4 +215,4 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest*
 
 
 Watch how to configure a kiosk in a provisioning package.
->[!VIDEO https://www.microsoft.com/videoplayer/embed/fa125d0f-77e4-4f64-b03e-d634a4926884?autoplay=false]
\ No newline at end of file
+>[!VIDEO https://www.microsoft.com/videoplayer/embed/fa125d0f-77e4-4f64-b03e-d634a4926884?autoplay=false]
diff --git a/devices/hololens/hololens-known-issues.md b/devices/hololens/hololens-known-issues.md
new file mode 100644
index 0000000000..3cb3f43717
--- /dev/null
+++ b/devices/hololens/hololens-known-issues.md
@@ -0,0 +1,160 @@
+---
+title: HoloLens known issues
+description: This is the list of known issues that may affect HoloLens developers.
+keywords: troubleshoot, known issue, help
+author: mattzmsft
+ms.author: mazeller
+ms.date: 8/30/2019
+ms.topic: article
+HoloLens and holograms: Frequently asked questions
+manager: jarrettr
+ms.prod: hololens
+appliesto:
+- HoloLens 1
+---
+
+# HoloLens known issues
+
+This is the current list of known issues for HoloLens that affect developers. Check here first if you are seeing an odd behavior. This list will be kept updated as new issues are discovered or reported, or as issues are addressed in future HoloLens software updates.
+
+## Unable to connect and deploy to HoloLens through Visual Studio
+
+>[!NOTE]
+>Last Update: 8/8 @ 5:11PM - Visual Studio has released VS 2019 Version 16.2 which includes a fix to this issue. We recommend updating to this newest version to avoid experiencing this error.
+
+Visual Studio has released VS 2019 Version 16.2 which includes a fix to this issue. We recommend updating to this newest version to avoid experiencing this error.
+
+Issue root-cause: Users who used Visual Studio 2015 or early releases of Visual Studio 2017 to deploy and debug applications on their HoloLens and then subsequently used the latest versions of Visual Studio 2017 or Visual Studio 2019 with the same HoloLens will be affected. The newer releases of Visual Studio deploy a new version of a component, but files from the older version are left over on the device, causing the newer version to fail.  This causes the following error message: DEP0100: Please ensure that target device has developer mode enabled. Could not obtain a developer license on \ due to error 80004005.
+
+### Workaround
+
+Our team is currently working on a fix. In the meantime, you can use the following steps to work around the issue and help unblock deployment and debugging:  
+
+1. Open Visual Studio
+1. Select **File** > **New** > **Project**.
+1. Select **Visual C#** > **Windows Desktop** > **Console App (.NET Framework)**.
+1. Give the project a name (such as "HoloLensDeploymentFix") and make sure the Framework is set to at least .NET Framework 4.5, then Select **OK**.
+1. Right-click on the **References** node in Solution Explorer and add the following references (select to the **Browse** section and select **Browse**):
+
+    ``` CMD
+    C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86\Microsoft.Tools.Deploy.dll
+    C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86\Microsoft.Tools.Connectivity.dll
+    C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86\SirepInterop.dll
+    ```
+
+    >[!NOTE]
+    >If you don't have 10.0.18362.0 installed, use the most recent version that you have. 
+
+1. Right-click on the project in Solution Explorer and select **Add** > **Existing Item**.
+1. Browse to C:\Program Files (x86)\Windows Kits\10\bin\10.0.18362.0\x86 and change the filter to **All Files (\*.\*)**.
+1. Select both SirepClient.dll and SshClient.dll, and Select **Add**.
+1. Locate and select both files in Solution Explorer (they should be at the bottom of the list of files) and change **Copy to Output Directory** in the **Properties** window to **Copy always**.
+1. At the top of the file, add the following to the existing list of `using` statements:
+
+    ``` CMD
+    using Microsoft.Tools.Deploy;
+    using System.Net;
+    ```
+
+1. Inside of `static void Main(...)`, add the following code:
+
+    ``` PowerShell
+    RemoteDeployClient client = RemoteDeployClient.CreateRemoteDeployClient();
+    client.Connect(new ConnectionOptions()
+    {
+        Credentials = new NetworkCredential("DevToolsUser", string.Empty),
+        IPAddress = IPAddress.Parse(args[0])
+    });
+    client.RemoteDevice.DeleteFile(@"C:\Data\Users\DefaultAccount\AppData\Local\DevelopmentFiles\VSRemoteTools\x86\CoreCLR\mscorlib.ni.dll");
+    ```
+
+1. Select **Build** > **Build Solution**.
+1. Open a Command Prompt Window and cd to the folder that contains the compiled .exe file (for example, C:\MyProjects\HoloLensDeploymentFix\bin\Debug)
+1. Run the executable and provide the device's IP address as a command-line argument. (If connected using USB, you can use 127.0.0.1, otherwise use the device’s Wi-Fi IP address.)  For example, "HoloLensDeploymentFix 127.0.0.1"
+
+1. After the tool has exited without any messages (this should only take a few seconds), you will now be able to deploy and debug from Visual Studio 2017 or newer.  Continued use of the tool is not necessary.
+
+We will provide further updates as they become available.
+
+## Issues launching the Microsoft Store and apps on HoloLens
+
+> [!NOTE]
+> Last Update: 4/2 @ 10 AM - Issue resolved. 
+
+You may experience issues when trying to launch the Microsoft Store and apps on HoloLens. We've determined that the issue occurs when background app updates deploy a newer version of framework packages in specific sequences while one or more of their dependent apps are still running. In this case,  an automatic app update delivered a new version of the .NET Native Framework (version 10.0.25531 to 10.0.27413) caused the apps that are running to not correctly update for all running apps consuming the prior version of the framework.  The flow for framework update is as follows: 
+
+1. The new framework package is downloaded from the store and installed
+1. All apps using the older framework are ‘updated’ to use the newer version
+
+If step 2 is interrupted before completion then any apps for which the newer framework wasn’t registered will fail to launch from the start menu.  We believe any app on HoloLens could be affected by this issue.
+
+Some users have reported that closing hung apps and launching other apps such as Feedback Hub, 3D Viewer or Photos resolves the issue for them—however, this does not work 100% of the time.
+
+We have root caused that this issue was not caused the update itself, but a bug in the OS that resulted in the .NET Native framework update being handled incorrectly. We are pleased to announce that we have identified a fix and have released an update (OS version 17763.380) containing the fix.  
+
+To see if your device can take the update, please:
+
+1. Go to the Settings app and open **Update & Security**.
+1. Select **Check for Updates**.
+1. If update to 17763.380 is available, please update to this build to receive the fix for the App Hang bug
+1. Upon updating to this version of the OS, the Apps should work as expected.
+
+Additionally, as we do with every HoloLens OS release, we have posted the FFU image to the [Microsoft Download Center](https://aka.ms/hololensdownload/10.0.17763.380).
+
+If you would not like to take the update, we have released a new version of the Microsoft Store UWP app as of 3/29. After you have the updated version of the Store:
+
+1. Open the Store and confirm that it loads.
+1. Use the bloom gesture to open the menu.
+1. Attempt to open previously broken apps.
+1. If it still cannot be launched, tap and hold the icon of the broken app and select uninstall.
+1. Resinstall these apps from the store.
+
+If your device is still unable to load apps, you can sideload a version of the .NET Native Framework and Runtime through the download center by following these steps:
+
+1. Please download [this zip file](https://download.microsoft.com/download/8/5/C/85C23745-794C-419D-B8D7-115FBCCD6DA7/netfx_1.7.zip) from the Microsoft Download Center. Unzipping will produce two files.  Microsoft.NET.Native.Runtime.1.7.appx and Microsoft.NET.Native.Framework.1.7.appx
+1. Please verify that your device is dev unlocked.  If you haven’t done that before the instructions to do that are [here](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal).
+1. You then want to get into the Windows Device Portal. Our recommendation is to do this over USB and you would do that by typing http://127.0.0.1:10080 into your browser.
+1. After you have the Windows Device Portal up we need you to “side load” the two files that you downloaded. To do that you need to go down the left side bar until you get to the **Apps** section and select **Apps**.
+1. You will then see a screen that is similar to the below.  You want to go to the section that says **Install App** and browse to where you unzipped those two APPX files. You can only do one at a time, so after you select the first one, then click on “Go” under the Deploy section. Then do this for the second APPX file.
+
+   ![Windows Device Portal to Install Side-Loaded app](images/20190322-DevicePortal.png)
+1. At this point we believe your applications should start working again and that you can also get to the Store.
+1. In some cases, it is necessary run the additional step of launching the 3D Viewer app before affected apps will launch. 
+
+We appreciate your patience as we have gone through the process to get this issue resolved, and we look forward to continued working with our community to create successful Mixed Reality experiences.
+
+## Device Update
+
+- 30 seconds after a new update, the shell may disappear one time. Please perform the **bloom** gesture to resume your session.
+
+## Visual Studio
+
+- See [Install the tools](https://docs.microsoft.com/windows/mixed-reality/install-the-tools) for the most up-to-date version of Visual Studio that is recommended for HoloLens development.
+- When deploying an app from Visual Studio to your HoloLens, you may see the error: **The requested operation cannot be performed on a file with a user-mapped section open. (Exception from HRESULT: 0x800704C8)**. If this happens, try again and your deployment will generally succeed.
+
+## Emulator
+
+- Not all apps in the Microsoft Store are compatible with the emulator. For example, Young Conker and Fragments are not playable on the emulator.
+- You cannot use the PC webcam in the Emulator.
+- The Live Preview feature of the Windows Device Portal does not work with the emulator. You can still capture Mixed Reality videos and images.
+
+## Unity
+
+- See [Install the tools](https://docs.microsoft.com/windows/mixed-reality/install-the-tools) for the most up-to-date version of Unity recommended for HoloLens development.
+- Known issues with the Unity HoloLens Technical Preview are documented in the [HoloLens Unity forums](https://forum.unity3d.com/threads/known-issues.394627/).
+
+## Windows Device Portal
+
+- The Live Preview feature in Mixed Reality capture may exhibit several seconds of latency.
+- On the Virtual Input page, the Gesture and Scroll controls under the Virtual Gestures section are not functional. Using them will have no effect. The virtual keyboard on the same page works correctly.
+- After enabling Developer Mode in Settings, it may take a few seconds before the switch to turn on the Device Portal is enabled.
+
+## API
+
+- If the application sets the [focus point](https://docs.microsoft.com/windows/mixed-reality/focus-point-in-unity) behind the user or the normal to camera.forward, holograms will not appear in Mixed Reality Capture photos or videos. Until this bug is fixed in Windows, if applications actively set the [focus point](https://docs.microsoft.com/windows/mixed-reality/focus-point-in-unity) they should ensure the plane normal is set opposite camera-forward (for example, normal = -camera.forward).
+
+## Xbox Wireless Controller
+
+- Xbox Wireless Controller S must be updated before it can be used with HoloLens. Ensure you are [up to date](https://support.xbox.com/xbox-one/accessories/update-controller-for-stereo-headset-adapter) before attempting to pair your controller with a HoloLens.
+- If you reboot your HoloLens while the Xbox Wireless Controller is connected, the controller will not automatically reconnect to HoloLens. The Guide button light will flash slowly until the controller powers off after 3 minutes. To reconnect your controller immediately, power off the controller by holding the Guide button until the light turns off. When you power your controller on again, it will reconnect to HoloLens.
+- If your HoloLens enters standby while the Xbox Wireless Controller is connected, any input on the controller will wake the HoloLens. You can prevent this by powering off your controller when you are done using it.
diff --git a/devices/hololens/hololens-licenses-requirements.md b/devices/hololens/hololens-licenses-requirements.md
new file mode 100644
index 0000000000..6d33228879
--- /dev/null
+++ b/devices/hololens/hololens-licenses-requirements.md
@@ -0,0 +1,50 @@
+---
+title: Licenses for Mixed Reality Deployment
+description: 
+ms.prod: hololens
+ms.sitesec: library
+author: pawinfie
+ms.author: pawinfie
+audience: ITPro
+ms.topic: article
+ms.localizationpriority: high
+ms.date: 1/23/2020
+ms.reviewer: 
+manager: bradke
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Licenses Required for Mixed Reality Deployment
+
+If you plan on using a Mobile Device Management system (MDM) to manage your HoloLens, please review the MDM License Guidance section.
+
+## Mobile Device Management (MDM) Licenses Guidance
+
+If you plan on using an MDM other than Intune, an [Azure Active Directory Licenses](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) is required.
+
+If you plan on using Intune as your MDM, you can acquire an [Enterprise Mobility + Security (EMS) suite (E3 or E5) licenses](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/compare-plans-and-pricing). **Please note that Azure AD is included in both suites.** 
+
+## Identify the licenses needed for your scenario and products
+
+### Remote Assist License Requirements
+Make sure you have the required licensing and device. Updated licensing and product requirements can be found [here](https://docs.microsoft.com/dynamics365/mixed-reality/remote-assist/requirements).
+
+1.	[Remote Assist License](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis)
+1.	[Teams Freemium/Teams](https://products.office.com/microsoft-teams/free)
+1.	[Azure Active Directory (Azure AD) License](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis)
+
+### Guides License Requirements
+Updated licensing and device requirements can be found [here](https://docs.microsoft.com/dynamics365/mixed-reality/guides/requirements).
+
+1.	[Azure Active Directory (Azure AD) License](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis)
+1.	[Power BI](https://powerbi.microsoft.com/desktop/)
+1.	[Guides](https://docs.microsoft.com/dynamics365/mixed-reality/guides/setup)
+
+### Scenario 1: Kiosk Mode
+If you are not planning to use an MDM to manage your device and you are planning to use a local account or an MSA as the login identity, you will not need any additional licenses. Kiosk mode can be accomplished using a provisioning packages.
+
+1.	If you are **not** planning to use an MDM to manage your device and you are planning to use a local account or an MSA as the login identity, you will not need any additional licenses. Kiosk mode can be accomplished using a provisioning packages.
+1.	If you are planning to use an MDM other than Intune, your MDM provider will have steps on configuring Kiosk mode. 
+1. If you are planning to use **Intune** as your MDM, implementation directions can be found in [Configuring your Network for HoloLens]().
diff --git a/devices/hololens/hololens-multiple-users.md b/devices/hololens/hololens-multiple-users.md
index f5bbdf30af..4bd8b317ef 100644
--- a/devices/hololens/hololens-multiple-users.md
+++ b/devices/hololens/hololens-multiple-users.md
@@ -1,31 +1,53 @@
 ---
-title: Share HoloLens with multiple people (HoloLens)
-description: You can configure HoloLens to be shared by multiple Azure Active Directory accounts.
+title: Share your HoloLens with multiple people
+description: You can configure HoloLens to be shared by multiple Azure Active Directory accounts, or by multiple users that use a single account.
 ms.prod: hololens
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: scooley
+ms.author: scooley
 ms.topic: article
 ms.localizationpriority: medium
-ms.date: 04/30/2018
+ms.date: 09/16/2019
+ms.reviewer: 
+manager: dansimp
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
 ---
 
-# Share HoloLens with multiple people
+# Share your HoloLens with multiple people
 
+It's common to share one HoloLens with many people or to have many people share a set of HoloLens devices.  This article describes the different ways in which you can share a device.
 
-A HoloLens device can be shared by multiple Azure Active Directory (Azure AD) accounts, each with their own user settings and user data on the device.
+## Share with multiple people, each using their own account
 
-**Prerequisite**: The HoloLens device must be running Windows 10, version 1803, and be [upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md).
+**Prerequisite**: The HoloLens device must be running Windows 10, version 1803 or later.  HoloLens (1st gen) also need to be [upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md).
 
-During setup, you must select **My work or school owns it** and sign in with an Azure AD account. After setup, ensure that **Other People** appears in **Settings** > **Accounts**.
+When they use their own Azure Active Directory (Azure AD) accounts, multiple users can each keep their own user settings and user data on the device.
 
-Other people can use the HoloLens device by signing in with their Azure AD account credentials. To switch users, press the power button once to go to standby and then press the power button again to return to the lock screen, or select the user tile on the upper right of the pins panel to sign out the current user.  
+To make sure that multiple people can use their own accounts on your HoloLens, follow these steps to configure it:
 
->[!NOTE] 
->Each subsequent user will need to perform [Calibration](https://developer.microsoft.com/windows/mixed-reality/calibration) in order to set their correct interpupillary distance (PD) for the device while signed in.
+1. Make sure the the device is running Windows 10, version 1803 or later.
+   > [!IMPORTANT]
+   > If you are using a HoloLens (1st gen) device, [upgrade the device to Windows Holographic for Business](hololens1-upgrade-enterprise.md).
+1. When you set up the device, select **My work or school owns it** and sign in by using an Azure AD account.
+1. After you finish setup, make sure that the account settings (**Settings** > **Accounts**) includes **Other users**.
 
-To see users on the device or to remove a user from the device, go to **Settings** > **Accounts** > **Other users**.
- 
+To use HoloLens, each user follows these steps:
 
- 
+1. If another user has been using the device, do one of the following:
+   - Press the power button once to go to standby, and then press the power button again to return to the lock screen
+   - HoloLens 2 users may select the user tile on the top of the Pins panel to sign out the current user.
 
+1. Use your Azure AD account credentials to sign in to the device.  
+    If this is the first time that you have used the device, you have to [calibrate](hololens-calibration.md) HoloLens to your own eyes.
+
+To see a list of the device users or to remove a user from the device, go to **Settings** > **Accounts** > **Other users**.
+
+## Share with multiple people, all using the same account
+
+Multiple users can also share a HoloLens device while using a single user account.
+
+**On HoloLens 2**, when a new user puts the device on their head for the first time (while keeping the same account signed in), the device prompts the new user to quickly calibrate and personalize the viewing experience. The device can store the calibration information so that in the future, the device can automatically optimize the quality and comfort of each user's viewing experience. The users do not need to calibrate the device again.
+
+**On HoloLens (1st gen)** users sharing an account will need to ask to recalibrate in the Settings app.  Read more about [calibration](hololens-calibration.md).
diff --git a/devices/hololens/hololens-network.md b/devices/hololens/hololens-network.md
new file mode 100644
index 0000000000..19c9669559
--- /dev/null
+++ b/devices/hololens/hololens-network.md
@@ -0,0 +1,93 @@
+---
+title: Connect to a network
+description: Instructions on how to connect to internet with HoloLens and how to identify the device's IP address.
+ms.assetid: 0895606e-96c0-491e-8b1c-52e56b00365d
+author: mattzmsft
+ms.author: mazeller
+keywords: HoloLens, wifi, wireless, internet, ip, ip address
+ms.date: 08/30/19
+ms.prod: hololens
+ms.sitesec: library
+ms.localizationpriority: high
+ms.reviewer: 
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Connect to a network
+
+To do most things on your HoloLens, you have to be connected to a network. This guide will help you:
+
+- Connect to a network using Wi-Fi or (for HoloLens 2 only) Ethernet over USB-C
+- Disable and re-enable Wi-Fi
+
+Read more about [using HoloLens offline](hololens-offline.md).
+
+## Connecting for the first time
+
+The first time you use your HoloLens, you'll be guided through connecting to a Wi-Fi network. If you have trouble connecting to Wi-Fi during setup, make sure that your network is either an open, password-protected network or a captive portal network. Make sure that the network doesn't require you to use a certificate to connect. After setup, you can connect to other types of Wi-Fi networks.
+
+## Connecting to Wi-Fi after setup
+
+1. Select **Start** > **Settings**.
+   - *HoloLens (1st gen) only*: Use your gaze to position the Settings app, then air tap to place it, or say "Place."
+1. Select **Network & Internet** > **Wi-Fi**. If you don't see your network, scroll down the list.
+1. Select a network, then select **Connect**.
+1. If you are prompted for a network password type it and then select **Next**.
+
+## Connecting to Wi-Fi on HoloLens (1st gen)
+
+HoloLens contains a 802.11ac-capable, 2x2 Wi-Fi radio. Connecting HoloLens to a Wi-Fi network is similar to connecting a Windows 10 Desktop or Mobile device to a Wi-Fi network.
+
+![HoloLens Wi-Fi settings](./images/wifi-hololens-600px.jpg)
+
+1. Open the **Start** menu.
+1. Select the Settings app from **Start** or from the **All Apps** list on the right of the **Start** menu. The Settings app will be auto-placed in front of you.
+1. Select **Network & Internet**.
+1. Make sure Wi-Fi is turned on.
+1. Select a Wi-Fi network from the list.
+1. If needed, type in the Wi-Fi network password.
+
+You can also confirm you are connected to a Wi-Fi network by checking the Wi-Fi status in the **Start** menu:
+
+1. Open the **Start** menu.
+1. Look at the top left of the **Start** menu for Wi-Fi status. The state of Wi-Fi and the SSID of the connected network will be shown.
+
+## Disabling Wi-Fi on HoloLens (1st gen)
+
+### Using the Settings app on HoloLens
+
+1. Open the **Start** menu.
+1. Select the **Settings** app from **Start** or from the **All Apps** list on the right of the **Start** menu. The **Settings** app will be auto-placed in front of you.
+1. Select **Network & Internet**.
+1. Select the Wi-Fi slider switch to move it to the **Off** position. This will turn off the RF components of the Wi-Fi radio and disable all Wi-Fi functionality on HoloLens.
+
+    > [!WARNING]
+    > When the Wi-Fi radio is disabled, HoloLens will not be able to automatically load your [spaces](hololens-spaces.md).
+
+1. Move the slider switch to the **On** position to turn on the Wi-Fi radio and restore Wi-Fi functionality on Microsoft HoloLens. The selected Wi-Fi radio state (**On** or **Off**) will persist across reboots.
+
+## Identifying the IP Address of your HoloLens on the Wi-Fi network
+
+### By using the Settings app
+
+1. Open the **Start** menu.
+1. Select the **Settings** app from **Start** or from the **All Apps** list on the right of the **Start** menu. The **Settings** app will be auto-placed in front of you.
+1. Select **Network & Internet**.
+1. Scroll down to beneath the list of available Wi-Fi networks and select **Hardware properties**.
+
+    ![Hardware properties in Wi-Fi settings](./images/wifi-hololens-hwdetails.jpg)
+
+   The IP address appears next to **IPv4 address**.
+
+### By using Cortana
+
+Say "Hey Cortana, What's my IP address?" and Cortana will display and read out your IP address.
+
+### By using Windows Device Portal
+
+1. In a web browser on your PC, open the [device portal](/windows/mixed-reality/using-the-windows-device-portal.md#networking).
+1. Navigate to the **Networking** section.  
+   This section displays your IP address and other network information. By using this method, you can copy and paste of the IP address on your development PC.
diff --git a/devices/hololens/hololens-offline.md b/devices/hololens/hololens-offline.md
new file mode 100644
index 0000000000..e3b11960b1
--- /dev/null
+++ b/devices/hololens/hololens-offline.md
@@ -0,0 +1,160 @@
+---
+title: Manage connection endpoints for HoloLens 
+description: To set up HoloLens, you'll need to connect to a Wi-Fi network
+keywords: hololens, offline, OOBE
+audience: ITPro
+ms.date: 07/01/2019
+ms.assetid: b86f603c-d25f-409b-b055-4bbc6edcd301
+author: v-miegge
+ms.author: v-miegge
+manager: v-miegge
+ms.topic: article
+ms.prod: hololens
+ms.sitesec: library
+ms.localizationpriority: high
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Manage connection endpoints for HoloLens 
+
+Some HoloLens components, apps, and related services transfer data to Microsoft network endpoints. This article lists different endpoints and URLs that need to be whitelisted in your network configuratiion (e.g. proxy or firewall) for those components to be functional.    
+
+## Near-offline setup
+
+HoloLens supports a limited set of offline experiences for customers who have network environment restrictions. However, HoloLens needs network connection to go through initial device set up and the following URLs have to be enabled:
+
+| Purpose | URL |
+|------|------|
+| IDPS | https://sdx.microsoft.com/frx/idps |
+| [NCSI](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-ncsi) |  http://www.msftconnecttest.com/connecttest.txt  |
+| AADv9 | https://login.microsoftonline.com/WebApp/CloudDomainJoin/9 |
+| AADv10 | https://login.microsoftonline.com/WebApp/CloudDomainJoin/10 |
+| AAD Pin | https://account.live.com/aadngc?uiflavor=win10&showSuccess=1 |
+| MSA | https://login.live.com/ppsecure/inlineconnect.srf?id=80600 |
+| MSA Pin | https://account.live.com/msangc?fl=enroll |
+
+## Endpoint configuration
+
+In addition to the list above, to take full advantage of HoloLens functionality, the following endpoints need to be enabled in your network configuration.
+
+
+| Purpose | URL |
+|------|------|
+| Azure                                               | wd-prod-fe.cloudapp.azure.com                                       |   |   |   
+|                                                     | ris-prod-atm.trafficmanager.net                                     |   |   |   |
+|                                                     | validation-v2.sls.trafficmanager.net                                |   |   |   |
+| Azure AD Multi-Factor Authentication                | https://secure.aadcdn.microsoftonline-p.com                         |   |   |   |
+| Intune and MDM Configurations                       | activation-v2.sls.microsoft.com/*                                   |   |   |   |
+|                                                     | cdn.onenote.net                                                     |   |   |   |
+|                                                     | client.wns.windows.com                                              |   |   |   |
+|                                                     | crl.microsoft.com/pki/crl/*                                         |   |   |   |
+|                                                     | ctldl.windowsupdate.com                                             |   |   |   |
+|                                                     | *displaycatalog.mp.microsoft.com                                    |   |   |   |
+|                                                     | dm3p.wns.windows.com                                                |   |   |   |
+|                                                     | *microsoft.com/pkiops/*                                             |   |   |   |
+|                                                     | ocsp.digicert.com/*                                                 |   |   |   |
+|                                                     | r.manage.microsoft.com                                              |   |   |   |
+|                                                     | tile-service.weather.microsoft.com                                  |   |   |   |
+|                                                     | settings-win.data.microsoft.com                                     |   |   |   |
+| Certificates                                        | activation-v2.sls.microsoft.com/*                                   |   |   |   |
+|                                                     | crl.microsoft.com/pki/crl/*                                         |   |   |   |
+|                                                     | ocsp.digicert.com/*                                                 |   |   |   |
+|                                                     | https://www.microsoft.com/pkiops/*                                          |   |   |   |
+| Cortana and Search                                  | store-images.*microsoft.com                                         |   |   |   |
+|                                                     | www.bing.com/client                                                 |   |   |   |
+|                                                     | www.bing.com                                                        |   |   |   |
+|                                                     | www.bing.com/proactive                                              |   |   |   |
+|                                                     | www.bing.com/threshold/xls.aspx                                     |   |   |   |
+|                                                     | exo-ring.msedge.net                                                 |   |   |   |
+|                                                     | fp.msedge.net                                                       |   |   |   |
+|                                                     | fp-vp.azureedge.net                                                 |   |   |   |
+|                                                     | odinvzc.azureedge.net                                               |   |   |   |
+|                                                     | spo-ring.msedge.net                                                 |   |   |   |
+| Device Authentication                               | login.live.com*                                                     |   |   |   |
+| Device metadata                                     | dmd.metaservices.microsoft.com                                      |   |   |   |
+| Location                                            | inference.location.live.net                                         |   |   |   |
+|                                                     | location-inference-westus.cloudapp.net                              |   |   |   |
+| Diagnostic Data                                     | v10.events.data.microsoft.com                                       |   |   |   |
+|                                                     | v10.vortex-win.data.microsoft.com/collect/v1                        |   |   |   |
+|                                                     | https://www.microsoft.com                                                   |   |   |   |
+|                                                     | co4.telecommand.telemetry.microsoft.com                             |   |   |   |
+|                                                     | cs11.wpc.v0cdn.net                                                  |   |   |   |
+|                                                     | cs1137.wpc.gammacdn.net                                             |   |   |   |
+|                                                     | modern.watson.data.microsoft.com*                                   |   |   |   |
+|                                                     | watson.telemetry.microsoft.com                                      |   |   |   |
+| Licensing                                           | licensing.mp.microsoft.com                                          |   |   |   |
+| Microsoft Account                                   | login.msa.akadns6.net                                               |   |   |   |
+|                                                     | us.configsvc1.live.com.akadns.net                                   |   |   |   |
+| Microsoft Edge                                      | iecvlist.microsoft.com                                              |   |   |   |
+| Microsoft forward link redirection service (FWLink) | go.microsoft.com                                                    |   |   |   |
+| Microsoft Store                                     | *.wns.windows.com                                                   |   |   |   |
+|                                                     | storecatalogrevocation.storequality.microsoft.com                   |   |   |   |
+|                                                     | img-prod-cms-rt-microsoft-com*                                      |   |   |   |
+|                                                     | store-images.microsoft.com                                          |   |   |   |
+|                                                     | .md.mp.microsoft.com                                                |   |   |
+|                                                     | *displaycatalog.mp.microsoft.com                                    |   |   |   |
+|                                                     | pti.store.microsoft.com                                             |   |   |   |
+|                                                     | storeedgefd.dsx.mp.microsoft.com                                    |   |   |   |
+|                                                     | markets.books.microsoft.com                                         |   |   |   |
+|                                                     | share.microsoft.com                                                 |   |   |   |
+| Network Connection Status Indicator (NCSI)          | www.msftconnecttest.com*                                            |   |   |   |
+| Office                                              | *.c-msedge.net                                                      |   |   |   |
+|                                                     | *.e-msedge.net                                                      |   |   |   |
+|                                                     | *.s-msedge.net                                                      |   |   |   |
+|                                                     | nexusrules.officeapps.live.com                                      |   |   |   |
+|                                                     | ocos-office365-s2s.msedge.net                                       |   |   |   |
+|                                                     | officeclient.microsoft.com                                          |   |   |   |
+|                                                     | outlook.office365.com                                               |   |   |   |
+|                                                     | client-office365-tas.msedge.net                                     |   |   |   |
+|                                                     | https://www.office.com                                                      |   |   |   |
+|                                                     | onecollector.cloudapp.aria                                          |   |   |   |
+|                                                     | v10.events.data.microsoft.com/onecollector/1.0/                     |   |   |   |
+|                                                     | self.events.data.microsoft.com                                      |   |   |   |
+|                                                     | to-do.microsoft.com                                                 |   |   |   |
+| OneDrive                                            | g.live.com/1rewlive5skydrive/*                                      |   |   |   |
+|                                                     | msagfx.live.com                                                     |   |   |   |
+|                                                     | oneclient.sfx.ms                                                    |   |   |   |
+| Photos App                                          | evoke-windowsservices-tas.msedge.net                                |   |   |   |
+| Settings                                            | cy2.settings.data.microsoft.com.akadns.net                          |   |   |   |
+|                                                     | settings.data.microsoft.com                                         |   |   |   |
+|                                                     | settings-win.data.microsoft.com                                     |   |   |   |
+| Windows Defender                                    | wdcp.microsoft.com                                                  |   |   |   |
+|                                                     | definitionupdates.microsoft.com                                     |   |   |   |
+|                                                     | go.microsoft.com                                                    |   |   |   |
+|                                                     | *smartscreen.microsoft.com                                          |   |   |   |
+|                                                     | smartscreen-sn3p.smartscreen.microsoft.com                          |   |   |   |
+|                                                     | unitedstates.smartscreen-prod.microsoft.com                         |   |   |   |
+| Windows Spotlight                                   | *.search.msn.com                                                    |   |   |   |
+|                                                     | arc.msn.com                                                         |   |   |   |
+|                                                     | g.msn.com*                                                          |   |   |   |
+|                                                     | query.prod.cms.rt.microsoft.com                                     |   |   |   |
+|                                                     | ris.api.iris.microsoft.com                                          |   |   |   |
+| Windows Update                                      | *.prod.do.dsp.mp.microsoft.com                                      |   |   |   |
+|                                                     | cs9.wac.phicdn.net                                                  |   |   |   |
+|                                                     | emdl.ws.microsoft.com                                               |   |   |   |
+|                                                     | *.dl.delivery.mp.microsoft.com                                      |   |   |   |
+|                                                     | *.windowsupdate.com                                                 |   |   |   |
+|                                                     | *.delivery.mp.microsoft.com                                         |   |   |   |
+|                                                     | *.update.microsoft.com                                              |   |   |   |
+
+
+
+## References
+
+> [!NOTE]
+> If you are deploying D365 Remote Assist, you will have to enable the endpoints on this [list](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges#skype-for-business-online-and-microsoft-teams) 
+- [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization)
+- [Manage connection endpoints for Windows 10 Enterprise, version 1903](https://docs.microsoft.com/windows/privacy/manage-windows-1903-endpoints)
+- [Manage connections from Windows 10 operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services)
+- [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm)
+- [Intune network configuration requirements and bandwidth](https://docs.microsoft.com/intune/fundamentals/network-bandwidth-use#network-communication-requirements)
+- [Network endpoints for Microsoft Intune](https://docs.microsoft.com/intune/fundamentals/intune-endpoints)
+- [Office 365 URLs and IP address ranges](https://docs.microsoft.com/office365/enterprise/urls-and-ip-address-ranges)
+- [Prerequisites for Azure AD Connect](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-install-prerequisites)
+
+
+## HoloLens limitations
+
+After your HoloLens is set up, you can use it without a Wi-Fi connection, but apps that use Internet connections will have limited capabilities when you use HoloLens offline.
diff --git a/devices/hololens/hololens-provisioning.md b/devices/hololens/hololens-provisioning.md
index 3e488d4a85..b22a4ef671 100644
--- a/devices/hololens/hololens-provisioning.md
+++ b/devices/hololens/hololens-provisioning.md
@@ -3,11 +3,13 @@ title: Configure HoloLens using a provisioning package (HoloLens)
 description: Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging.
 ms.prod: hololens
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.localizationpriority: medium
 ms.date: 11/13/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Configure HoloLens using a provisioning package
@@ -34,7 +36,7 @@ The HoloLens wizard helps you configure the following settings in a provisioning
 - Upgrade to the enterprise edition
 
     >[!NOTE]
-    >Settings in a provisioning package will only be applied if the provisioning package includes an edition upgrade license to Windows Holographic for Business or if [the device has already been upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md).
+    >Settings in a provisioning package will only be applied if the provisioning package includes an edition upgrade license to Windows Holographic for Business or if [the device has already been upgraded to Windows Holographic for Business](hololens1-upgrade-enterprise.md).
 
 - Configure the HoloLens first experience (OOBE)
 - Configure Wi-Fi network 
@@ -59,7 +61,7 @@ Use the Windows Configuration Designer tool to create a provisioning package.
 
 2. Click **Provision HoloLens devices**.
 
-  ![ICD start options](images/icd-create-options-1703.png)   
+   ![ICD start options](images/icd-create-options-1703.png)   
 
 3. Name your project and click **Finish**. 
 
@@ -72,12 +74,12 @@ Use the Windows Configuration Designer tool to create a provisioning package.
 
 
 
-
-
-
- 
-
-
+
+
+
+ 
+
+
            ![step one](images/one.png)![set up device](images/set-up-device.png)

            Browse to and select the enterprise license file to upgrade the HoloLens edition.

            You can also toggle **Yes** or **No** to hide parts of the first experience.

            To set up the device without the need to connect to a Wi-Fi network, toggle **Skip Wi-Fi setup** to **On**.

            Select a region and timezone in which the device will be used.             		![Select enterprise licence file and configure OOBE](images/set-up-device-details.png)
            ![step two](images/two.png)  ![set up network](images/set-up-network.png)

            In this section, you can enter the details of the Wi-Fi wireless network that the device should connect to automatically. To do this, select **On**, enter the SSID, the network type (**Open** or **WPA2-Personal**), and (if **WPA2-Personal**) the password for the wireless network.            		![Enter network SSID and type](images/set-up-network-details-desktop.png)
            ![step three](images/three.png)  ![account management](images/account-management.png)

            You can enroll the device in Azure Active Directory, or create a local account on the device

            Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup). The **maximum number of devices per user** setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click **Get bulk token**. In the **Let's get you signed in** window, enter an account that has permissions to join a device to Azure AD, and then the password. Click **Accept** to give Windows Configuration Designer the necessary permissions. 

            To create a local account, select that option and enter a user name and password. 

            **Important:** (For Windows 10, version 1607 only) If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.              		![join  Azure AD or create a local  account](images/account-management-details.png)
            ![step four](images/four.png) ![add certificates](images/add-certificates.png)

            To provision the device with a certificate, click **Add a certificate**. Enter a name for the certificate, and then browse to and select the certificate to be used.            		![add a certificate](images/add-certificates-details.png)
            ![step five](images/five.png) ![Developer Setup](images/developer-setup.png)

            Toggle **Yes** or **No** to enable Developer Mode on the HoloLens. [Learn more about Developer Mode.](https://docs.microsoft.com/windows/uwp/get-started/enable-your-device-for-development#developer-mode)            		![Enable Developer Mode](images/developer-setup-details.png)
            ![step six](images/six.png) ![finish](images/finish.png)

            Do not set a password to protect your provisioning package. If the provisioning package is protected by a password, provisioning the HoloLens device will fail.            		![Protect your package](images/finish-details.png)
            step oneset up device

            Browse to and select the enterprise license file to upgrade the HoloLens edition.

            You can also toggle Yes or No to hide parts of the first experience.

            To set up the device without the need to connect to a Wi-Fi network, toggle Skip Wi-Fi setup to On.

            Select a region and timezone in which the device will be used.             		Select enterprise licence file and configure OOBE
            step two  set up network

            In this section, you can enter the details of the Wi-Fi wireless network that the device should connect to automatically. To do this, select On, enter the SSID, the network type (Open or WPA2-Personal), and (if WPA2-Personal) the password for the wireless network.            		Enter network SSID and type
            step three  account management

            You can enroll the device in Azure Active Directory, or create a local account on the device

            Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, set up Azure AD join in your organization. The maximum number of devices per user setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click Get bulk token. In the Let's get you signed in window, enter an account that has permissions to join a device to Azure AD, and then the password. Click Accept to give Windows Configuration Designer the necessary permissions. 

            To create a local account, select that option and enter a user name and password. 

            Important: (For Windows 10, version 1607 only) If you create a local account in the provisioning package, you must change the password using the Settings app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.              		join  Azure AD or create a local  account
            step four add certificates

            To provision the device with a certificate, click Add a certificate. Enter a name for the certificate, and then browse to and select the certificate to be used.            		add a certificate
            step five Developer Setup

            Toggle Yes or No to enable Developer Mode on the HoloLens. Learn more about Developer Mode.            		Enable Developer Mode
            step six finish

            Do not set a password to protect your provisioning package. If the provisioning package is protected by a password, provisioning the HoloLens device will fail.            		Protect your package
            
 
            
 
 After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page.
@@ -88,7 +90,7 @@ After you're done, click **Create**. It only takes a few seconds. When the packa
 ## Create a provisioning package for HoloLens using advanced provisioning
 
 >[!NOTE]
->Settings in a provisioning package will only be applied if the provisioning package includes an edition upgrade license to Windows Holographic for Business or if [the device has already been upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md).
+>Settings in a provisioning package will only be applied if the provisioning package includes an edition upgrade license to Windows Holographic for Business or if [the device has already been upgraded to Windows Holographic for Business](hololens1-upgrade-enterprise.md).
 
 1. On the Windows Configuration Designer start page, select **Advanced provisioning**.
 2. In the **Enter project details** window, specify a name for your project and the location for your project. Optionally, enter a brief description to describe your project.
@@ -184,7 +186,7 @@ In Windows Configuration Designer, when you create a provisioning package for Wi
 | --- | --- |
 | **Certificates** | Deploy a certificate to HoloLens.  |
 | **ConnectivityProfiles** | Deploy a Wi-Fi profile to HoloLens.   |
-| **EditionUpgrade** | [Upgrade to Windows Holographic for Business.](hololens-upgrade-enterprise.md)  |
+| **EditionUpgrade** | [Upgrade to Windows Holographic for Business.](hololens1-upgrade-enterprise.md)  |
 | **Policies** | Allow or prevent developer mode on HoloLens. [Policies supported by Windows Holographic for Business](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#hololenspolicies) |
 
 >[!NOTE]
diff --git a/devices/hololens/hololens-recovery.md b/devices/hololens/hololens-recovery.md
new file mode 100644
index 0000000000..b2e0d48bc7
--- /dev/null
+++ b/devices/hololens/hololens-recovery.md
@@ -0,0 +1,131 @@
+---
+title: Reset or recover your HoloLens 
+ms.reviewer: Both basic and advanced instructions for rebooting or resetting your HoloLens.
+description: How to use Advanced Recovery Companion to flash an image to HoloLens 2.
+keywords: how-to, reboot, reset, recover, hard reset, soft reset, power cycle, HoloLens, shut down, arc, advanced recovery companion
+ms.prod: hololens
+ms.sitesec: library
+author: mattzmsft
+ms.author: mazeller
+ms.date: 08/30/2019
+ms.topic: article
+ms.localizationpriority: high
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Restart, reset, or recover HoloLens
+
+If you’re experiencing problems with your HoloLens you may want to try a restart, reset, or even re-flash with device recovery.
+
+Here are some things to try if your HoloLens isn’t running well.  This article will guide you through the recommended recovery steps in succession.
+
+This article focuses on the HoloLens device and software, if your holograms don't look right, [this article](hololens-environment-considerations.md) talks about environmental factors that improve hologram quality.
+
+## Restart your HoloLens
+
+First, try restarting the device.
+
+### Perform a safe restart by using Cortana
+
+The safest way to restart the HoloLens is by using Cortana. This is generally a great first-step when experiencing an issue with HoloLens:
+
+1. Put on your device
+1. Make sure it’s powered on, a user is logged in, and the device is not waiting for a password to unlock it.
+1. Say “Hey Cortana, reboot” or "Hey Cortana, restart."
+1. When she acknowledges she will ask you for confirmation. Wait a second for a sound to play after she has finished her question, indicating she is listening to you and then say “Yes.”
+1. The device will now restart.
+
+### Perform a safe restart by using the power button
+
+If you still can't restart your device, you can try to restart it by using the power button:
+
+1. Press and hold the power button for five seconds.
+   1. After one second, you will see all five LEDs illuminate, then slowly turn off from right to left.
+   1. After five seconds, all LEDs will be off, indicating the shutdown command was issued successfully.
+   1. Note that it’s important to stop pressing the button immediately after all the LEDs have turned off.
+1. Wait one minute for the shutdown to cleanly succeed. Note that the shutdown may still be in progress even if the displays are turned off.
+1. Power on the device again by pressing and holding the power button for one second.
+
+### Perform a safe restart by using Windows Device Portal
+
+> [!NOTE]
+> To do this, HoloLens has to be configured as a developer device.  
+> Read more about [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal).
+
+If the previous procedure doesn't work, you can try to restart the device by using [Windows Device Portal](https://docs.microsoft.com/windows/mixed-reality/using-the-windows-device-portal). In the upper right corner, there is an option to restart or shut down the device.
+
+### Perform an unsafe forced restart
+
+If none of the previous methods are able to successfully restart your device, you can force a restart. This method is equivalent to pulling the battery from the HoloLens.  It is a dangerous operation which may leave your device in a corrupt state.  If that happens, you'll have to flash your HoloLens.  
+
+> [!WARNING]
+> This is a potentially harmful method and should only be used in the event none of the above methods work.
+
+1. Press and hold the power button for at least 10 seconds.
+
+   - It’s okay to hold the button for longer than 10 seconds.
+   - It’s safe to ignore any LED activity.
+1. Release the button and wait for two or three seconds.
+1. Power on the device again by pressing and holding the power button for one second.
+If you’re still having problems, press the power button for 4 seconds, until all of the battery indicators fade out and the screen stops displaying holograms. Wait 1 minute, then press the power button again to turn on the device.
+
+## Reset to factory settings
+
+>[!NOTE]
+>The battery needs at least 40 percent charge to reset.
+
+If your HoloLens is still experiencing issues after restarting, try resetting it to factory state.  Resetting your HoloLens keeps the version of the Windows Holographic software that’s installed on it and returns everything else to factory settings.
+
+If you reset your device, all your personal data, apps, and settings will be erased. Resetting will only install the latest installed version of Windows Holographic and you will have to redo all the initialization steps (calibrate, connect to Wi-Fi, create a user account, download apps, and so forth).
+
+1. Launch the Settings app, and then select **Update** > **Reset**.
+1. Select the **Reset device** option and read the confirmation message.
+1. If you agree to reset your device, the device will restart and display a set of spinning gears with a progress bar.
+1. Wait about 30 minutes for this process to complete.
+1. The reset will complete and the device will restart into the out-of-the-box experience.
+
+## Re-install the operating system
+
+If the device is still having a problem after rebooting and resetting, you can use a recovery tool on your computer to reinstall the HoloLens' operating system and firmware.  
+
+HoloLens (1st gen) and HoloLens 2 use different tools but both tools will auto-detect your HoloLens and install new software.
+
+All of the data HoloLens needs to reset is packaged in a Full Flash Update (ffu).  This is similar to an iso, wim, or vhd.  [Learn about FFU image file formats.](https://docs.microsoft.com/windows-hardware/manufacture/desktop/wim-vs-ffu-image-file-formats)
+
+### HoloLens 2
+
+The Advanced Recovery Companion is a new app in Microsoft Store restore the operating system image to your HoloLens 2 device.
+
+1. On your computer, get [Advanced Recovery Companion](https://www.microsoft.com/p/advanced-recovery-companion/9p74z35sfrs8?activetab=pivot:overviewtab) from Microsoft Store.
+2. Connect HoloLens 2 to your computer.
+3. Start Advanced Recovery Companion.
+4. On the **Welcome** page, select your device.
+5. On the **Device info** page, select **Install software** to install the default package. (If you have a Full Flash Update (FFU) image that you want to install instead, select **Manual package selection**.)
+6. Software installation will begin. Do not use the device or disconnect the cable during installation. When you see the **Installation finished** page, you can disconnect and use your device.
+
+>[!TIP]
+>In the event that a HoloLens 2 gets into a state where Advanced Recovery Companion cannot recognize the device, and it does not boot, try forcing the device into Flashing Mode and recovering it with Advanced Recovery Companion:
+
+1.	Connect the HoloLens 2 to a PC with Advanced Recovery Companion installed.
+1.	Press and hold the **Volume Up and Power buttons** until the device reboots.  Release the Power button, but continue to hold the Volume Up button until the third LED is lit. It will the the only lit LED.
+   1.	The device should be visible in **Device Manager** as a **Microsoft HoloLens Recovery** device:
+1.	Launch Advanced Recovery Companion, and follow the on-screen prompts to reflash the OS to the HoloLens 2.
+
+### HoloLens (1st gen)
+
+If necessary, you can install a completely new operating system on your HoloLens (1st gen) with the Windows Device Recovery Tool.
+
+Before you use this tool, determine if restarting or resetting your HoloLens fixes the problem. The recovery process may take some time.  When you're done, the latest version of the Windows Holographic software approved for your HoloLens will be installed.
+
+To use the tool, you’ll need a computer running Windows 10 or later, with at least 4 GB of free storage space.  Please note that you can’t run this tool on a virtual machine.
+
+To recover your HoloLens
+
+1. Download and install the [Windows Device Recovery Tool](https://support.microsoft.com/help/12379/windows-10-mobile-device-recovery-tool-faq) on your computer.
+1. Connect the HoloLens (1st gen) to your computer using the Micro USB cable that came with your HoloLens.
+1. Run the Windows Device Recovery Tool and follow the instructions.
+
+If the HoloLens (1st gen) isn’t automatically detected, select **My device was not detected** and follow the instructions to put your device into recovery mode.
diff --git a/devices/hololens/hololens-release-notes.md b/devices/hololens/hololens-release-notes.md
new file mode 100644
index 0000000000..aaf200a4b0
--- /dev/null
+++ b/devices/hololens/hololens-release-notes.md
@@ -0,0 +1,108 @@
+---
+title: What's new in Microsoft HoloLens
+description: Learn about updates in each new HoloLens release.
+author: scooley
+ms.author: scooley
+manager: dansimp
+ms.prod: hololens
+ms.sitesec: library
+ms.topic: article
+ms.localizationpriority: medium
+ms.date: 12/02/2019
+audience: ITPro
+appliesto:
+- HoloLens 1
+- HoloLens 2
+
+---
+
+# HoloLens Release Notes
+
+## HoloLens 2
+> [!Note]
+> HoloLens Emulator Release Notes can be found [here](https://docs.microsoft.com/windows/mixed-reality/hololens-emulator-archive).
+
+### January Update - build 18362.1043
+
+- Stability improvements for exclusive apps when working with the HoloLens 2 emulator.
+
+### December Update - build 18362.1042
+
+- Introduces LSR (Last Stage Reproduction) fixes. Improves visual rendering of holograms to appear more stable and crisp by more accurately accounting for their depth. This will be more noticeable if apps do not set the depth of holograms correctly, after this update.
+- Fixes stability of exclusive apps and navigation between exclusive apps.
+- Resolves an issue where Mixed Reality Capture couldn't record video after device is left in standby state for multiple days.
+- Improves hologram stability.
+
+### November Update - build 18362.1039
+
+- Fixes for **"Select"** voice commands during initial set-up for en-CA and en-AU.
+- Improvements in visual quality of objects placed far away in latest Unity and MRTK versions.
+- Fixes addressing issues with holographic applications being stuck in a paused state on launch until the pins panel is brought up and dismissed again.
+- OpenXR runtime conformance fixes and improvements for HoloLens 2 and the emulator.
+
+## HoloLens (1st gen)
+
+### Windows 10 Holographic, version 1809
+
+> **Applies to:** Hololens (1st gen)
+
+| Feature | Details |
+|---|---|
+| **Quick actions menu** | When you're in an app, the Bloom gesture will now open a Quick actions menu to give you quick access to commonly used system features without having to leave the app. 
             See [Set up HoloLens in kiosk mode](hololens-kiosk.md) for information about the Quick actions menu in kiosk mode.

            ![sample of the Quick actions menu](images/minimenu.png) |
+| **Stop video capture from the Start or quick actions menu** | If you start video capture from the Start menu or quick actions menu, you’ll be able to stop recording from the same place. (Don’t forget, you can always do this with voice commands too.) |
+| **Project to a Miracast-enabled device** | Project your HoloLens content to a nearby Surface device or TV/Monitor if using Microsoft Display adapter.  On **Start**, select **Connect**, and then select the device you want to project to. **Note:** You can deploy HoloLens to use Miracast projection without enabling developer mode. |
+| **New notifications** | View and respond to notification toasts on HoloLens, just like you do on a PC. Gaze to respond to or dismiss them (or if you’re in an immersive experience, use the bloom gesture). |
+| **HoloLens overlays**
            (file picker, keyboard, dialogs, etc.) | You’ll now see overlays such as the keyboard, dialogs, file picker, etc. when using immersive apps. |
+| **Visual feedback overlay UI for volume change** | When you use the volume up/down buttons on your HoloLens you’ll see a visual display of the volume level. |
+| **New UI for device boot** | A loading indicator was added during the boot process to provide visual feedback that the system is loading. Reboot your device to see the new loading indicator—it’s between the "Hello" message and the Windows boot logo. |
+| **Nearby sharing** | Addition of the Windows Nearby Sharing experience, allowing you to share a capture with a nearby Windows device. When you capture a photo or video on HoloLens (or use the share button from an app such as Microsoft Edge), select a nearby Windows device to share with. |
+| **Share from Microsoft Edge** | Share button is now available on Microsoft Edge windows on HoloLens. In Microsoft Edge, select **Share**. Use the HoloLens share picker to share web content. |
+
+#### For international customers
+
+| Feature | Details |
+| --- | --- |
+| Localized Chinese and Japanese builds | Use HoloLens with localized user interface for Simplified Chinese or Japanese, including localized Pinyin keyboard, dictation, and voice commands.
            [Learn how to install the Chinese and Japanese versions of HoloLens.](hololens1-install-localized.md) |
+| Speech Synthesis (TTS) | Speech synthesis feature now supports Chinese, Japanese, and English. |
+
+#### For administrators
+
+| Feature |  Details  |
+|---|----|
+| [Enable post-setup provisioning](hololens-provisioning.md) | You can now apply a runtime provisioning package at any time using **Settings**. |
+| Assigned access with Azure AD groups | You can now use Azure AD groups for configuration of Windows assigned access to set up single or multi-app kiosk configuration. |
+| PIN sign-in on profile switch from sign-in screen | PIN sign-in is now available for **Other User**. |
+| Sign in with Web Credential Provider using password | You can now select the Globe sign-in option to launch web sign-in with your password. From the sign-in screen, select **Sign-In options** and select the Globe option to launch web sign-in. Enter your user name if needed, then your password. 
            **Note:** You can choose to bypass any PIN/Smartcard options when prompted during web sign-in. |
+| Read device hardware info through MDM so devices can be tracked by serial number | IT administrators can see and track HoloLens by device serial number in their MDM console. Refer to your MDM documentation for feature availability and instructions. |
+| Set HoloLens device name through MDM (rename) | IT administrators can see and rename HoloLens devices in their MDM console. Refer to your MDM documentation for feature availability and instructions. |
+
+### Windows 10, version 1803 for Microsoft HoloLens
+
+> **Applies to:** Hololens (1st gen)
+
+Windows 10, version 1803, is the first feature update to Windows Holographic for Business since its release in Windows 10, version 1607. This update introduces the following changes:
+
+- Previously, you could only verify that upgrade license for Commercial Suite had been applied to your HoloLens device by checking to see if VPN was an available option on the device. Now, **Settings** > **System** will display **Windows Holographic for Business** after the upgrade license is applied. [Learn how to unlock Windows Holographic for Business features](hololens1-upgrade-enterprise.md).
+
+- You can view the operating system build number in device properties in the File Explorer app and in the [Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379/windows-10-mobile-device-recovery-tool-faq).
+- Provisioning a HoloLens device is now easier with the new **Provision HoloLens devices** wizard in the Windows Configuration Designer tool. In the wizard, you can configure the setup experience and network connections, set developer mode, and obtain bulk Azure AD tokens. [Learn how to use the simple provisioning wizard for HoloLens](hololens-provisioning.md#wizard).
+
+    ![Provisioning HoloLens devices](images/provision-hololens-devices.png)
+
+- When you create a local account in a provisioning package, the password no longer expires every 42 days.
+
+- You can [configure HoloLens as a single-app or multi-app kiosk](hololens-kiosk.md). Multi-app kiosk mode lets you set up a HoloLens to only run the apps that you specify, and prevents users from making changes.
+
+- Media Transfer Protocol (MTP) is enabled so that you can connect the HoloLens device to a PC by USB and transfer files between HoloLens and the PC. You can also use the File Explorer app to move and delete files from within HoloLens.
+
+- Previously, after you signed in to the device with an Azure Active Directory (Azure AD) account, you then had to **Add work access** in **Settings** to get access to corporate resources. Now, you sign in with an Azure AD account and enrollment happens automatically.
+
+- Before you sign in, you can choose the network icon below the password field to choose a different Wi-Fi network to connect to. You can also connect to a guest network, such as at a hotel, conference center, or business. 
+
+- You can now easily [share HoloLens with multiple people](hololens-multiple-users.md) using Azure AD accounts.
+
+- When setup or  sign-in fails, choose the new **Collect info** option to get diagnostic logs for troubleshooting.
+
+- Individual users can sync their corporate email without enrolling their device in mobile device management (MDM). You can use the device with a Microsoft Account, download and install the Mail app, and add an email account directly.
+
+- You can check the MDM sync status for a device in **Settings** > **Accounts** > **Access Work or School** > **Info**. In the **Device sync status** section, you can start a sync, see areas managed by MDM, and create and export an advanced diagnostics report.
diff --git a/devices/hololens/hololens-requirements.md b/devices/hololens/hololens-requirements.md
index 402cb33a40..eb068d6e65 100644
--- a/devices/hololens/hololens-requirements.md
+++ b/devices/hololens/hololens-requirements.md
@@ -1,86 +1,145 @@
 ---
-title: HoloLens in the enterprise requirements and FAQ (HoloLens)
-description: Requirements and FAQ for general use, Wi-Fi, and device management for HoloLens in the enterprise.
+title: Set up HoloLens in a commercial environment
+description: Learn more about deploying and managing HoloLens in enterprise environments.
 ms.prod: hololens
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+ms.assetid: 88bf50aa-0bac-4142-afa4-20b37c013001
+author: scooley
+ms.author: scooley
 ms.topic: article
 ms.localizationpriority: medium
-ms.date: 06/04/2018
+ms.date: 07/15/2019
 ---
 
-# Microsoft HoloLens in the enterprise: requirements and FAQ
+# Deploy HoloLens in a commercial environment
 
-When you develop for HoloLens, there are [system requirements and tools](https://developer.microsoft.com/windows/mixed-reality/install_the_tools) that you need. In an enterprise environment, there are also a few requirements to use and manage HoloLens which are listed below.
+You can deploy and configure HoloLens at scale in a commercial setting.  
 
-## Requirements
+This article includes:
 
-### General use
-- Microsoft account or Azure Active Directory (Azure AD) account
-- Wi-Fi network to set up HoloLens
+- Infrastructure requirements and recommendations for HoloLens management
+- Tools for provisioning HoloLens
+- Instructions for remote device management
+- Options for application deployment
 
->[!NOTE]
->After you set up HoloLens, you can use it offline [with some limitations](https://support.microsoft.com/help/12645/hololens-use-hololens-offline).
+This guide assumes basic familiarity with HoloLens. Follow the [get started guide](hololens1-setup.md) to set up HoloLens for the first time.
 
+## Infrastructure for managing HoloLens
+
+HoloLens is, at its core, a Windows mobile device integrated with Azure.  It works best in commercial environments with wireless network availability (wi-fi) and access to Microsoft services.
+
+Critical cloud services include:
+
+- Azure active directory (AAD)
+- Windows Update (WU)
+
+Commercial customers will need enterprise mobility management (EMM) or mobile device management (MDM) infrastructure to manage HoloLens devices at scale.  This guide uses [Microsoft Intune](https://www.microsoft.com/enterprise-mobility-security/microsoft-intune) as an example, though any provider with full support for Microsoft Policy can support HoloLens.  Ask your mobile device management provider if they support HoloLens 2.
+
+HoloLens does support a limited set of cloud disconnected experiences.
+
+## Initial set up at scale
+
+The HoloLens out of box experience is great for setting up one or two devices or for experiencing HoloLens for the first time.  If you're provisioning many HoloLens devices, however, selecting your language and settings manually for each device gets tedious and limits scale.
+
+This section:
+
+- Introduces Windows provisioning using provisioning packages
+- Walks through applying a provisioning package during first setup
+
+### Create and apply a provisioning package
+
+The best way to configure many new HoloLens device is with Windows provisioning.  You can use it to specify desired configuration and settings required to enroll the devices into management and then apply that configuration to target devices in minutes.
+
+A [provisioning package](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-packages)  (.ppkg) is a collection of configuration settings. With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device.
+
+### Upgrade to Windows Holographic for Business
+
+- HoloLens Enterprise license XML file
+
+Some of the HoloLens configurations you can apply in a provisioning package:
+
+- Apply certificates to the device
+- Set up a Wi-Fi connection
+- Pre-configure out of box questions like language and locale
+- (HoloLens 2) bulk enroll in mobile device management
+- (HoloLens v1) Apply key to enable Windows Holographic for Business
+
+Follow [this guide](https://docs.microsoft.com/hololens/hololens-provisioning) to create and apply a provisioning package to HoloLens.
+
+### Set up user identity and enroll in device management
+
+The last step in setting up HoloLens for management at scale is to enroll devices with mobile device management infrastructure.  There are several ways to enroll:
+
+1. Bulk enrollment with a security token in a provisioning package.  
+  Pros: this is the most automated approach  
+  Cons: takes initial server-side setup  
+1. Auto-enroll on user sign in.  
+  Pros: easiest approach  
+  Cons: users will need to complete set up after the provisioning package has been applied
+1. _not recommended_ - Manually enroll post-setup.  
+  Pros: possible to enroll after set up  
+  Cons: most manual approach and devices aren't centrally manageable until they're manually enrolled.
+
+Learn more about MDM enrollment [here](hololens-enroll-mdm.md).
+
+## Ongoing device management
+
+Ongoing device management will depend on your mobile device management infrastructure.  Most have the same general functionality but the user interface may vary widely.
+
+This article outlines [policies and capabilities HoloLens supports](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference#hololens).
+
+[This article](https://docs.microsoft.com/intune/windows-holographic-for-business) talks about Intune's management tools for HoloLens.
+
+### Push compliance policy via Intune
+
+[Compliance policies](https://docs.microsoft.com/intune/device-compliance-get-started) are rules and settings that devices must meet to be compliant in your corporate infrastructure. Use these policies with Conditional Access to block access to company resources for devices that are non-compliant.
+
+For example, you can create a policy that requires Bitlocker be enabled.
+
+[Create compliance policies with Intune](https://docs.microsoft.com/intune/compliance-policy-create-windows).
+
+### Manage updates
+
+Intune includes a feature called Update rings for Windows 10 devices, including HoloLens 2 and HoloLens v1 (with Holographic for Business). Update rings include a group of settings that determine how and when updates are installed.
+
+For example, you can create a maintenance window to install updates, or choose to restart after updates are installed.  You can also choose to pause updates indefinitely until you're ready to update.
+
+Read more about [configuring update rings with Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure).
+
+## Application management
+
+Manage HoloLens applications through:
+
+1. Microsoft Store  
+  The Microsoft Store is the best way to distribute and consume applications on HoloLens.  There is a great set of core HoloLens applications already available in the store or you can [publish your own](https://docs.microsoft.com/windows/uwp/publish/).  
+  All applications in the store are available publicly to everyone, but if it isn't acceptable, checkout the Microsoft Store for Business.  
+
+1. [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/)  
+  Microsoft Store for Business and Education is a custom store for your corporate environment.  It lets you use the Microsoft Store built into Windows 10 and HoloLens to find, acquire, distribute, and manage apps for your organization.  It also lets you deploy apps that are specific to your commercial environment but not to the world.
+
+1. Application deployment and management via Intune or another mobile device management solution  
+  Most mobile device management solutions, including Intune, provide a way to deploy line of business applications directly to a set of enrolled devices.  See this article for [Intune app install](https://docs.microsoft.com/intune/apps-deploy).
+
+1. _not recommended_ Device Portal  
+  Applications can also be installed on HoloLens directly using the Windows Device Portal.  This isn't recommended since Developer Mode has to be enabled to use the device portal.
+
+Read more about [installing apps on HoloLens](https://docs.microsoft.com/hololens/hololens-install-apps).
+
+## Get support
+
+Get support through the Microsoft support site.
+
+[File a support request](https://support.microsoft.com/supportforbusiness/productselection?sapid=e9391227-fa6d-927b-0fff-f96288631b8f).
+
+## Technical Reference
+
+### Wireless network EAP support
 
-### Supported wireless network EAP methods 
 - PEAP-MS-CHAPv2
 - PEAP-TLS
-- TLS 
+- TLS
 - TTLS-CHAP
 - TTLS-CHAPv2
 - TTLS-MS-CHAPv2
 - TTLS-PAP
 - TTLS-TLS
-
-### Device management 
-   - Users have Azure AD accounts with [Intune license assigned](https://docs.microsoft.com/intune/get-started/start-with-a-paid-subscription-to-microsoft-intune-step-4)
-   - Wi-Fi network
-   - Intune or a 3rd party mobile device management (MDM) provider that uses Microsoft MDM APIs
-   
-### Upgrade to Windows Holographic for Business 
-- HoloLens Enterprise license XML file
-
-
-## FAQ for HoloLens
-
-
-#### Is Windows Hello for Business supported on HoloLens?
-
-Windows Hello for Business (using a PIN to sign in) is supported for HoloLens. To allow Windows Hello for Business PIN sign-in on HoloLens:
-
-1. The HoloLens device must be [managed by MDM](hololens-enroll-mdm.md).
-2. You must enable Windows Hello for Business for the device. ([See instructions for Microsoft Intune.](https://docs.microsoft.com/intune/windows-hello))
-3. On HoloLens, the user can then set up a PIN from **Settings** > **Sign-in Options** > **Add PIN**.
-
->[!NOTE]
->Users who sign in with a Microsoft account can also set up a PIN in **Settings** > **Sign-in Options** > **Add PIN**. This PIN is associated with [Windows Hello](https://support.microsoft.com/help/17215/windows-10-what-is-hello), rather than [Windows Hello for Business](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-overview).
-
-#### Does the type of account change the sign-in behavior?
-
-Yes, the behavior for the type of account impacts the sign-in behavior. If you apply policies for sign-in, the policy is always respected. If no policy for sign-in is applied, these are the default behaviors for each account type.
-
-- Microsoft account: signs in automatically
-- Local account: always asks for password, not configurable in **Settings**
-- Azure AD: asks for password by default; configurable by **Settings** to no longer ask for password. 
-
->[!NOTE]
->Inactivity timers are currently not supported, which means that the **AllowIdleReturnWithoutPassword** policy is respected only when the device goes into StandBy. 
-
-
-#### How do I remove a HoloLens device from the Intune dashboard?
-
-You cannot [unenroll](https://docs.microsoft.com/intune-user-help/unenroll-your-device-from-intune-windows) HoloLens from Intune remotely. If the administrator unenrolls the device using MDM, the device will age out of the Intune dashboard.
-
-
-## Related resources
-
-[Getting started with Azure Active Directory Premium](https://azure.microsoft.com/documentation/articles/active-directory-get-started-premium/)
-
-[Get started with Intune](https://docs.microsoft.com/intune/understand-explore/get-started-with-a-30-day-trial-of-microsoft-intune)
-
-[Enroll devices for management in Intune](https://docs.microsoft.com/intune/deploy-use/enroll-devices-in-microsoft-intune#supported-device-platforms)
-
-[Azure AD editions](https://azure.microsoft.com/documentation/articles/active-directory-editions/)
-
diff --git a/devices/hololens/hololens-setup.md b/devices/hololens/hololens-setup.md
deleted file mode 100644
index 0f62fc2e6e..0000000000
--- a/devices/hololens/hololens-setup.md
+++ /dev/null
@@ -1,44 +0,0 @@
----
-title: Set up HoloLens (HoloLens)
-description: The first time you set up HoloLens, you'll need a Wi-Fi network and either a Microsoft or Azure Active Directory account.
-ms.prod: hololens
-ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
-ms.topic: article
-ms.localizationpriority: medium
-ms.date: 07/27/2017
----
-
-# Set up HoloLens
-
-Before you get started setting up your HoloLens, make sure you have a Wi-Fi network and a Microsoft account or an Azure Active Directory (Azure AD) account. 
-
-## Network connectivity requirements
-
-The first time you use your HoloLens, you'll be guided through connecting to a Wi-Fi network. You need to connect HoloLens to a Wi-Fi network with Internet connectivity so that the user account can be authenticated.
-
-- It can be an open Wi-Fi or password-protected Wi-Fi network.
-- The Wi-Fi network cannot require certificates to connect.
-- The Wi-Fi network does not need to provide access to enterprise resources or intranet sites. 
-
-## HoloLens setup
-
-The HoloLens setup process combines a quick tutorial on using HoloLens with the steps needed to connect to the network and add an account.
-
-1. Be sure your HoloLens is [charged](https://support.microsoft.com/help/12627), then [adjust it](https://support.microsoft.com/help/12632) for a comfortable fit.
-2. [Turn on HoloLens](https://support.microsoft.com/help/12642). You will be guided through a calibration procedure and how to perform [the gestures](https://support.microsoft.com/help/12644/hololens-use-gestures) that you will use to operate HoloLens.
-3. Next, you'll be guided through connecting to a Wi-Fi network. 
-4. After HoloLens connects to the Wi-Fi network, you select between **My work or school owns it** and **I own it**. 
-    - When you choose **My work or school owns it**, you sign in with an Azure AD account. If your organization uses Azure AD Premium and has configured automatic MDM enrollment, HoloLens will be enrolled in MDM. If your organization does not use Azure AD Premium, automatic MDM enrollment isn't available, so you will need to [enroll HoloLens in device management manually](hololens-enroll-mdm.md#enroll-through-settings-app).
-        1. Enter your organizational account. 
-        2. Accept privacy statement.
-        3. Sign in using your Azure AD credentials. This may redirect to your organization's sign-in page.
-        4. Continue with device setup.
-    - When you choose **I own it**, you sign in with a Microsoft account. After setup is complete, you can [enroll HoloLens in device management manually](hololens-enroll-mdm.md#enroll-through-settings-app).
-        1. Enter your Microsoft account. 
-        2. Enter your password. If your Microsoft account requires [two-step verification (2FA)](https://blogs.technet.microsoft.com/microsoft_blog/2013/04/17/microsoft-account-gets-more-secure/), complete the verification process. 
-5. The device sets your time zone based on information obtained from the Wi-Fi network. 
-6. Next, you learn how to perform the bloom gesture and how to select and place the Start screen. After you place the Start screen, setup is complete and you can begin using HoloLens.
-
-
diff --git a/devices/hololens/hololens-spaces.md b/devices/hololens/hololens-spaces.md
index 19307fdfb6..26790eacca 100644
--- a/devices/hololens/hololens-spaces.md
+++ b/devices/hololens/hololens-spaces.md
@@ -1,69 +1,114 @@
 ---
-title: How HoloLens stores data for spaces (HoloLens)
-description: 
+title: Mapping physical spaces with HoloLens
+description: HoloLens learns what a space looks like over time. Users can facilitate this process by moving the HoloLens in certain ways through the space.
+ms.assetid: bd55ecd1-697a-4b09-8274-48d1499fcb0b
+author: dorreneb
+ms.author: dobrown
+ms.date: 09/16/2019
+keywords: hololens, Windows Mixed Reality, design, spatial mapping, HoloLens, surface reconstruction, mesh, head tracking, mapping
 ms.prod: hololens
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
 ms.topic: article
-ms.localizationpriority: medium
-ms.date: 11/05/2018
+ms.localizationpriority: high
+appliesto:
+- HoloLens 1 (1st gen)
+- HoloLens 2
 ---
 
-# How HoloLens stores data for spaces
+# Mapping physical spaces with HoloLens
 
-In the Windows 10, version 1803 update for Microsoft HoloLens, the mapping data for [spaces](https://support.microsoft.com/help/13760/hololens-spaces-on-hololens) is stored in a local database. 
+HoloLens blends holograms with your physical world. To do that, HoloLens has to learn about the physical world around you and remember where you place holograms within that space.
 
-The map database is not exposed to a user of the device, even when plugged into a PC or when using the File Explorer app. When BitLocker is enabled, the stored map data is also encrypted with the entire volume.
+Over time, the HoloLens builds up a *spatial map* of the environment that it has seen.  HoloLens updates the map as the environment changes. As long as you are logged in and the device is turned on, HoloLens creates and updates your spatial maps. If you hold or wear the device with the cameras pointed at a space, the HoloLens tries to map the area. While the HoloLens learns a space naturally over time, there are ways in which you can help HoloLens map your space more quickly and efficiently.  
 
-Holograms that are anchored within the same map section are considered to be “nearby” in the current space.
+> [!NOTE]
+> If your HoloLens can’t map your space or is out of calibration, HoloLens may enter Limited mode. In Limited mode, you won’t be able to place holograms in your surroundings.
 
+This article explains how HoloLens maps spaces, how to improve spatial mapping, and how to manage the spatial data that HoloLens collects.
 
-## Frequently asked questions
+## Choosing and setting up and your space
 
-**How can I remove map data and known spaces from the HoloLens?**
+Features in your environment can make it difficult for the HoloLens to interpret a space. Light levels, materials in the space, the layout of objects, and more can all affect how HoloLens maps an area.
 
-There are two options for deleting map data in **Settings > System > Holograms**: 
+HoloLens works best in certain kinds of environments. To produce the best spatial map, choose a room that has adequate light and plenty of space. Avoid dark spaces and rooms that have a lot of dark, shiny, or translucent surfaces (for instance, mirrors or gauzy curtains).
 
-- Select **Remove nearby holograms** to delete nearby holograms, clearing the map data and anchored holograms for the current space. A brand new map section would be created and stored in the database for that location while the device is used there. This option can be used to clear the map data for work without affecting any map data from home, for example.
-- Select **Remove all holograms** to delete all holograms, clearing all locally stored map data and anchored holograms. No holograms will be rediscovered and any holograms need to be newly placed.
+HoloLens is optimized for indoor use. Spatial mapping also works best when Wi-Fi is turned on, although it doesn't have to be connected to a network. HoloLens can obtain Wi-Fi access points even if it is not connected or authenticated. HoloLens functionality does not change whether the access points are internet-connected or intranet/local only.
 
->[!NOTE]
->When you remove nearby or all holograms, HoloLens immediately starts scanning and mapping the current space.
+Only use HoloLens in safe places with no tripping hazards. [More on safety](https://support.microsoft.com/help/4023454/safety-information).
 
-**How does Wi-Fi data get used by HoloLens and where is the data stored?**
+## Mapping your space
 
-As long as Wi-Fi is enabled, map data will be correlated with nearby Wi-Fi access points. There is no difference in behavior if a network is connected or just nearby. Network characteristics are not sent to Microsoft, and all Wi-Fi references are kept local on the HoloLens.
+Now you're ready to start mapping your spare.  When HoloLens starts mapping your surroundings, you'll see a mesh graphic spreading over the space.  In mixed reality home, you can trigger the map to show by selecting on a mapped surface.
 
-Wi-Fi characteristics are stored locally to help correlate hologram locations and map sections stored within HoloLens’ database of known spaces. It’s inaccessible to users, and not sent to Microsoft via the cloud or via telemetry.
+Here are guidelines for building a great spatial map.
 
+### Understand the scenarios for the area
 
+It is important to spend the most time where you will be using the HoloLens, so that the map is relevant and complete. For example, if a user scenario for HoloLens involves moving from Point A to Point B, walk that path two to three times, looking in all directions as you move.  
 
-**Does HoloLens need to be connected to the internet?**
+### Walk slowly around the space
 
-No, internet connectivity is not required. Observed Wi-Fi access points are obtained without being connected or authenticated. It does not change functionality if the access points are internet connected or intranet/local only.
+If you walk too quickly around the area, it's likely that the HoloLens will miss mapping areas. Walk slowly around the space, stopping every 5-8 feet to look around at your surroundings.  
 
+Smooth movements also help the HoloLens map more efficiently.
 
+### Look in all directions
 
+Looking around as you map the space gives the HoloLens more data on where points are relative to each other.  
 
+If you don't look up, for example, the HoloLens may not know where the ceiling in a room is.  
 
-**Since HoloLens no longer requires you to select a space when Wi-Fi is disabled, how does it find the space automatically?**
+Don't forget to look down at the floor as you map the space.
 
-If Wi-Fi is disabled, the space search can still happen; HoloLens will need to search more of the map data within the spaces database, and finding holograms can take longer. 
+### Cover key areas multiple times
 
-HoloLens will sense and remember spaces even when Wi-Fi is disabled, by securely storing the sensor data when holograms are placed. Without the Wi-Fi info, the space and holograms may be slower to recognize at a later time, as the HoloLens needs to compare active scans to all hologram anchors and map sections stored on the device in order to locate the correct portion of the map.
+Moving through an area multiple times will help pick up features you may have missed on the first walkthrough. To build an ideal map, try traversing an area two to three times.
 
-HoloLens will visually compare the current scanning data from the sensors to locally stored map sections in the entire spaces database.  It will locate holograms faster if the Wi-Fi characteristics can be found, to narrow down the number of spaces to compare.
+If possible, while repeating these movements, spend time walking through an area in one direction, then turn around and walk back the way you came.
 
+### Take your time mapping the area
 
+It can take between 15 and 20 minutes for the HoloLens to fully map and adjust itself to its surroundings. If you have a space in which you plan to use a HoloLens frequently, taking that time up front to map the space can prevent issues later on.  
 
+## Possible errors in the spatial map
 
- 
+Errors in spatial mapping data fall into a few categories:
 
+- *Holes*: Real-world surfaces are missing from the spatial mapping data.
+- *Hallucinations*: Surfaces exist in the spatial mapping data that do not exist in the real world.
+- *Wormholes*: HoloLens 'loses' part of the spatial map by thinking it is in a different part of the map than it actually is.
+- *Bias*: Surfaces in the spatial mapping data are imperfectly aligned with real-world surfaces, either pushed in or pulled out.
 
+If you see any of these errors please use the [FeedbackHub](hololens-feedback.md) to send feedback.
+
+## Security and storage for spatial data
+
+Windows 10 version 1803 update for Microsoft HoloLens and later stores mapping data in a local (on-device) database.
+
+HoloLens users cannot directly access the map database, even when the device is plugged into a PC or when using the File Explorer app. When BitLocker is enabled on HoloLens, the stored map data is also encrypted along with the entire volume.
+
+### Remove map data and known spaces from HoloLens
+
+There are two options for deleting map data in **Settings > System > Holograms**:
+
+- To delete nearby holograms, select **Remove nearby holograms**. This command clears the map data and anchored holograms for the current space. If you continue to use the device in the same space, it creates and stores a brand new map section to replace the deleted information.
+
+   > [!NOTE]
+   > "Nearby" holograms are holograms that are anchored within the same map section in the current space.
+
+   For example, you can use this option to clear work-related map data without affecting any home-related map data.
+
+- To delete all holograms, select **Remove all holograms**. This command clears all map data that is stored on the device as well as all anchored holograms. You will need to explicitly place any holograms. You will not be able to rediscover the previously-placed holograms.
+
+> [!NOTE]
+> After you remove nearby or all holograms, HoloLens immediately starts scanning and mapping the current space.
+
+### Wi-Fi data in spatial maps
+
+HoloLens stores Wi-Fi characteristics to help correlate hologram locations and map sections that are stored within the HoloLens database of known spaces. Information about Wi-Fi characteristics is not accessible to users, and not sent to Microsoft using the cloud or using telemetry.
+
+As long as Wi-Fi is enabled, HoloLens correlates map data with nearby Wi-Fi access points. There is no difference in behavior whether a network is connected or just detected nearby. If Wi-Fi is disabled, HoloLens still searches the space. However, HoloLens has to search more of the map data within the spaces database, and may need more time to find holograms. Without the Wi-Fi info, the HoloLens has to compare active scans to all hologram anchors and map sections that are stored on the device in order to locate the correct portion of the map.
 
 ## Related topics
 
-- [Environment considerations for HoloLens](https://docs.microsoft.com/windows/mixed-reality/environment-considerations-for-hololens)
 - [Spatial mapping design](https://docs.microsoft.com/windows/mixed-reality/spatial-mapping-design)
-- [HoloLens and holograms: FAQ](https://support.microsoft.com/help/13456/hololens-and-holograms-faq)
diff --git a/devices/hololens/hololens-status.md b/devices/hololens/hololens-status.md
new file mode 100644
index 0000000000..e6ccdbd207
--- /dev/null
+++ b/devices/hololens/hololens-status.md
@@ -0,0 +1,36 @@
+---
+title: HoloLens status
+description: Shows the status of HoloLens online services. 
+author: todmccoy
+ms.author: v-todmc
+ms.reviewer: luoreill
+manager: jarrettr
+audience: Admin
+ms.topic: article
+ms.prod: hololens
+ms.localizationpriority: high
+ms.sitesec: library
+---
+
+# HoloLens status
+
+✔️ **All services are active**
+
+**Key** ✔️ Good, ⓘ Information, ⚠ Warning, ❌ Critical
+
+Area|HoloLens (1st gen)|HoloLens 2
+----|:----:|:----:
+[Azure services](https://status.azure.com/status)|✔️|✔️
+[Store app](https://www.microsoft.com/store/collections/hlgettingstarted/hololens)|✔️|✔️
+[Apps](https://www.microsoft.com/hololens/apps)|✔️|✔️
+[MDM](https://docs.microsoft.com/hololens/hololens-enroll-mdm)|✔️|✔️
+
+## Notes and related topics
+
+[Frequently asked questions about using Skype for HoloLens](https://support.skype.com/faq/FA34641/frequently-asked-questions-about-using-skype-for-hololens)
+
+For more details about the status of the myriad Azure Services that can connect to HoloLens, see [Azure status](https://azure.microsoft.com/status/).
+
+For more details about current known issues, see [HoloLens known issues](hololens-known-issues.md).
+
+Follow HoloLens on [Twitter](https://twitter.com/HoloLens) and subscribe on [Reddit](https://www.reddit.com/r/HoloLens/).
diff --git a/devices/hololens/hololens-troubleshooting.md b/devices/hololens/hololens-troubleshooting.md
new file mode 100644
index 0000000000..7102984f4c
--- /dev/null
+++ b/devices/hololens/hololens-troubleshooting.md
@@ -0,0 +1,94 @@
+---
+title: HoloLens troubleshooting
+description: Solutions for common HoloLens issues.
+author: mattzmsft
+ms.author: mazeller
+ms.date: 12/02/2019
+ms.prod: hololens
+ms.topic: article
+ms.custom: CSSTroubleshooting
+audience: ITPro
+ms.localizationpriority: medium
+keywords: issues, bug, troubleshoot, fix, help, support, HoloLens
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Troubleshooting HoloLens issues
+
+This article describes how to resolve several common HoloLens issues.
+
+## My HoloLens is unresponsive or won’t start
+
+If your HoloLens won't start:
+
+- If the LEDs next to the power button don't light up, or only one LED briefly blinks, you may need to charge your HoloLens.
+- If the LEDs light up when you press the power button but you can't see anything on the displays, hold the power button until all five of the LEDs turn off.
+
+If your HoloLens becomes frozen or unresponsive:
+
+- Turn off your HoloLens by pressing the power button until all five of the LEDs turn themselves off, or for 10 seconds if the LEDs are unresponsive. To start your HoloLens, press the power button again.
+
+If these steps don't work, you can try [recovering your device](hololens-recovery.md).
+
+## Holograms don't look good
+
+If your holograms are unstable, jumpy, or don’t look right, try:
+
+- Cleaning your device visor and sensor bar on the front of your HoloLens.
+- Increasing the light in your room.
+- Walking around and looking at your surroundings so that HoloLens can scan them more completely.
+- Calibrating your HoloLens for your eyes. Go to **Settings** > **System** > **Utilities**. Under **Calibration**, select **Open Calibration**.
+
+## HoloLens doesn’t respond to gestures
+
+To make sure that HoloLens can see your gestures.  Keep your hand in the gesture frame - when HoloLens can see your hand, the cursor changes from a dot to a ring.
+
+Learn more about using gestures on [HoloLens (1st gen)](hololens1-basic-usage.md#use-hololens-with-your-hands) or [HoloLens 2](hololens2-basic-usage.md#the-hand-tracking-frame).
+
+If your environment is too dark, HoloLens might not see your hand, so make sure that there’s enough light.
+
+If your visor has fingerprints or smudges, use the microfiber cleaning cloth that came with the HoloLens to clean your visor gently.
+
+## HoloLens doesn’t respond to my voice commands
+
+If Cortana isn’t responding to your voice commands, make sure Cortana is turned on. On the All apps list, select **Cortana** > **Menu** > **Notebook** > **Settings** to make changes. To learn more about what you can say, see [Use your voice with HoloLens](hololens-cortana.md).
+
+## I can’t place holograms or see holograms that I previously placed
+
+If HoloLens can’t map or load your space, it enters Limited mode and you won’t be able to place holograms or see holograms that you’ve placed. Here are some things to try:
+
+- Make sure that there’s enough light in your environment so HoloLens can see and map the space.
+- Make sure that you’re connected to a Wi-Fi network. If you’re not connected to Wi-Fi, HoloLens can’t identify and load a known space.
+- If you need to create a new space, connect to Wi-Fi, then restart your HoloLens.
+- To see if the correct space is active, or to manually load a space, go to **Settings** > **System** > **Spaces**.
+- If the correct space is loaded and you’re still having problems, the space may be corrupt. To fix this issue, select the space, then select **Remove**. After you remove the space, HoloLens starts to map your surroundings and create a new space.
+
+## My HoloLens can’t tell what space I’m in
+
+If your HoloLens can’t identify and load the space you’re in automatically, check the following factors:
+
+- Make sure that you’re connected to Wi-Fi
+- Make sure that there’s plenty of light in the room
+- Make sure that there haven’t been any major changes to the surroundings.
+
+You can also load a space manually or manage your spaces by going to **Settings** > **System** > **Spaces**.
+
+## I’m getting a “low disk space” error
+
+You’ll need to free up some storage space by doing one or more of the following:
+
+- Delete some unused spaces. Go to **Settings** > **System** > **Spaces**, select a space that you no longer need, and then select **Remove**.
+- Remove some of the holograms that you’ve placed.
+- Delete some pictures and videos from the Photos app.
+- Uninstall some apps from your HoloLens. In the **All apps** list, tap and hold the app you want to uninstall, and then select **Uninstall**.
+
+## My HoloLens can’t create a new space
+
+The most likely problem is that you’re running low on storage space. Try one of the [previous tips](#im-getting-a-low-disk-space-error) to free up some disk space.
+
+## The HoloLens emulators isn't working
+
+Information about the HoloLens emulator is located in our developer documentation.  Read more about [troubleshooting the HoloLens emulator](https://docs.microsoft.com/windows/mixed-reality/using-the-hololens-emulator#troubleshooting).
diff --git a/devices/hololens/hololens-update-hololens.md b/devices/hololens/hololens-update-hololens.md
new file mode 100644
index 0000000000..14d8993c95
--- /dev/null
+++ b/devices/hololens/hololens-update-hololens.md
@@ -0,0 +1,92 @@
+---
+title: Update HoloLens
+description: Check your HoloLens' build number, update, and roll back updates.
+keywords: how-to, update, roll back, HoloLens, check build, build number
+ms.prod: hololens
+ms.sitesec: library
+author: scooley
+ms.author: scooley
+ms.topic: article
+ms.localizationpriority: medium
+ms.date: 11/27/2019
+audience: ITPro
+ms.reviewer: 
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
+---
+
+# Update HoloLens
+
+HoloLens uses Windows Update, just like other Windows 10 devices. Your HoloLens will automatically download and install system updates whenever it is plugged-in to power and connected to the Internet, even when it is in standby.
+
+This article will walk through HoloLens tools for:
+
+- viewing your current operating system version (build number)
+- checking for updates
+- manually updating HoloLens
+- rolling back to an older update
+
+## Check your operating system version (build number)
+
+You can verify the system version number, (build number) by opening the Settings app and selecting **System** > **About**.
+
+## Check for updates and manually update
+
+You can check for updates any time in settings.  To see available updates and check for new updates:
+
+1. Open the **Settings** app.
+1. Navigate to **Update & Security** > **Windows Update**.
+1. Select **Check for updates**.
+
+If an update is available, it will start downloading the new version. After the download is complete, select the **Restart Now** button to trigger the installation. If your device is below 40% and not plugged in, restarting will not start installing the update.
+
+While your HoloLens is installing the update, it will display spinning gears and a progress indicator. Do not turn off your HoloLens during this time. It will restart automatically once it has completed the installation.
+
+HoloLens applies one update at a time.  If your HoloLens is more than one version behind the latest you may need to run through the update process multiple times to get it fully up to date.
+
+## Go back to a previous version - HoloLens 2
+
+In some cases, you might want to go back to a previous version of the HoloLens software. You can do this by using the Advanced Recovery Companion to reset your HoloLens to the earlier version.
+
+> [!NOTE]
+> Going back to an earlier version deletes your personal files and settings.
+
+To go back to a previous version of HoloLens 2, follow these steps:
+
+1. Make sure that you don't have any phones or Windows devices plugged in to your PC.
+1. On your PC, download the [Advanced Recovery Companion](https://www.microsoft.com/p/advanced-recovery-companion/9p74z35sfrs8?activetab=pivot:overviewtab) from the Microsoft Store.
+1. Download the [most recent HoloLens 2 release](https://aka.ms/hololens2download).
+1. When you have finished these downloads, open **File explorer** > **Downloads**. Right-click the zipped folder that you just downloaded, and select **Extract all** > **Extract** to unzip it.
+1. Connect your HoloLens to your PC using a USB-A to USB-C cable. (Even if you've been using other cables to connect your HoloLens, this one works best.)
+1. The Advanced Recovery Companion automatically detects your HoloLens. Select the **Microsoft HoloLens** tile.
+1. On the next screen, select **Manual package selection** and then select the installation file contained in the folder that you unzipped in step 4. (Look for a file with the .ffu extension.)
+1. Select **Install software**, and follow the instructions.
+
+## Go back to a previous version - HoloLens (1st Gen)
+
+In some cases, you might want to go back to a previous version of the HoloLens software. You can do this by using the Windows Device Recovery Tool to reset your HoloLens to the earlier version.
+
+> [!NOTE]
+> Going back to an earlier version deletes your personal files and settings.
+
+To go back to a previous version of HoloLens 1, follow these steps:
+
+1. Make sure that you don't have any phones or Windows devices plugged in to your PC.
+1. On your PC, download the [Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379).
+1. Download the [HoloLens Anniversary Update recovery package](https://aka.ms/hololensrecovery).
+1. When the downloads finish, open **File explorer** > **Downloads**. Right-click the zipped folder you just downloaded, and select **Extract all** > **Extract** to unzip it.
+1. Connect your HoloLens to your PC using the micro-USB cable that it came with. (Even if you've been using other cables to connect your HoloLens, this one works best.)
+1. The WDRT will automatically detect your HoloLens. Select the **Microsoft HoloLens** tile.
+1. On the next screen, select **Manual package selection** and choose the installation file contained in the folder you unzipped in step 4. (Look for a file with the .ffu extension.)
+1. Select **Install software**, and follow the instructions.
+
+> [!NOTE]
+> If the WDRT doesn't detect your HoloLens, try restarting your PC. If that doesn't work, select **My device was not detected**, select **Microsoft HoloLens**, and then follow the instructions.
+
+## Windows Insider Program on HoloLens
+
+Want to see the latest features in HoloLens?  If so, join the Windows Insider Program; you'll get access to preview builds of HoloLens software updates before they're available to the general public.
+
+[Get Windows Insider preview for Microsoft HoloLens](hololens-insider.md).
diff --git a/devices/hololens/hololens-updates.md b/devices/hololens/hololens-updates.md
index 9ea1e9de34..e0b662bd3d 100644
--- a/devices/hololens/hololens-updates.md
+++ b/devices/hololens/hololens-updates.md
@@ -1,43 +1,97 @@
 ---
-title: Manage updates to HoloLens (HoloLens)
+title: Managing updates to HoloLens
 description: Administrators can use mobile device management to manage updates to HoloLens devices.
 ms.prod: hololens
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: Teresa-Motiv
+ms.author: v-tea
+audience: ITPro
 ms.topic: article
-ms.localizationpriority: medium
-ms.date: 04/30/2018
+ms.localizationpriority: high
+ms.date: 11/7/2019
+ms.reviewer: jarrettr
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+- HoloLens 2
 ---
 
-# Manage updates to HoloLens
+# Managing HoloLens updates
 
->**Looking for how to get the latest update? See [Update HoloLens](https://support.microsoft.com/help/12643/hololens-update-hololens).**
+HoloLens uses Windows Update, just like other Windows 10 devices. When an update is available, it will be automatically downloaded and installed the next time your device is plugged in and connected to the Internet.
+
+This article will walk through all of the way to manage updates on HoloLens.
+
+## Manually check for updates
+
+While HoloLens periodically checks for system updates so you don't have to, there may be circumstances in which you want to manually check.
+
+To manually check for updates, go to **Settings** > **Update & Security** > **Check for updates**. If the Settings app says your device is up to date, you have all the updates that are currently available.
+
+## Go back to a previous version (HoloLens 2)
+
+In some cases, you might want to go back to a previous version of the HoloLens software. You can do this by using the Advanced Recovery Companion to reset your HoloLens to the earlier version.
+
+> [!NOTE]
+> Going back to an earlier version deletes your personal files and settings.
+
+To go back to a previous version of HoloLens 2, follow these steps:
+
+1. Make sure that you don't have any phones or Windows devices plugged in to your PC.
+1. On your PC, download the [Advanced Recovery Companion](https://www.microsoft.com/p/advanced-recovery-companion/9p74z35sfrs8?activetab=pivot:overviewtab) from the Microsoft Store.
+1. Download the [most recent HoloLens 2 release](https://aka.ms/hololens2download).
+1. When you have finished these downloads, open **File explorer** > **Downloads**. Right-click the zipped folder that you just downloaded, and select **Extract all** > **Extract** to unzip it.
+1. Connect your HoloLens to your PC using a USB-A to USB-C cable . (Even if you've been using other cables to connect your HoloLens, this one works best.)
+1. The Advanced Recovery Companion automatically detects your HoloLens. Select the **Microsoft HoloLens** tile.
+1. On the next screen, select **Manual package selection** and then select the installation file contained in the folder that you unzipped in step 4. (Look for a file with the .ffu extension.)
+1. Select **Install software**, and follow the instructions.
+
+## Go back to a previous version (HoloLens (1st gen))
+
+In some cases, you might want to go back to a previous version of the HoloLens software. You can do this by using the Windows Device Recovery Tool to reset your HoloLens to the earlier version.
+
+> [!NOTE]
+> Going back to an earlier version deletes your personal files and settings.
+
+To go back to a previous version of HoloLens (1st gen), follow these steps:
+
+1. Make sure that you don't have any phones or Windows devices plugged in to your PC.
+1. On your PC, download the [Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379).
+1. Download the [HoloLens Anniversary Update recovery package](https://aka.ms/hololensrecovery).
+1. When the downloads finish, open **File explorer** > **Downloads**. Right-click the zipped folder you just downloaded, and select **Extract all** > **Extract** to unzip it.
+1. Connect your HoloLens to your PC using the micro-USB cable that it came with. (Even if you've been using other cables to connect your HoloLens, this one works best.)
+1. The WDRT will automatically detect your HoloLens. Select the **Microsoft HoloLens** tile.
+1. On the next screen, select **Manual package selection** and choose the installation file contained in the folder you unzipped in step 4. (Look for a file with the .ffu extension.)
+1. Select **Install software**, and follow the instructions.
+
+> [!NOTE]
+> If the WDRT doesn't detect your HoloLens, try restarting your PC. If that doesn't work, select **My device was not detected**, select **Microsoft HoloLens**, and then follow the instructions.
+
+# Use policies to manage updates to HoloLens
 
 >[!NOTE]
->HoloLens devices must be [upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md) to manage updates.
-
-For a complete list of Update policies, see [Policies supported by Windows Holographic for Business](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#a-href-idhololenspoliciesapolicies-supported-by-windows-holographic-for-business).
+>HoloLens (1st gen) devices must be [upgraded to Windows Holographic for Business](hololens1-upgrade-enterprise.md) to manage updates.
 
 To configure how and when updates are applied, use the following policies:
--	[Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate)
--	[Update/ScheduledInstallDay](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-scheduledinstallday)
--	[Update/ScheduledInstallTime](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-scheduledinstalltime)
+
+- [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate)
+- [Update/ScheduledInstallDay](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-scheduledinstallday)
+- [Update/ScheduledInstallTime](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-scheduledinstalltime)
 
 To turn off the automatic check for updates, set the following policy to value **5** – Turn off Automatic Updates:
+
 - [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate)
 
 In Microsoft Intune, you can use **Automatic Update Behavior** to change this policy. (See [Manage software updates in Microsoft Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure))
 
-For devices on Windows 10, version 1607 only: You can use the following update policies to configure devices to get updates from Windows Server Update Service (WSUS) instead of Windows Update:
+For devices on Windows 10, version 1607 only: You can use the following update policies to configure devices and get updates from the Windows Server Update Service (WSUS), instead of Windows Update:
 
-- [Update/AllowUpdateService](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowupdateservice) 
-- [Update/RequireUpdateApproval](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-requireupdateapproval) 
-- [Update/UpdateServiceUrl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updateserviceurl) 
+- [Update/AllowUpdateService](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowupdateservice)
+- [Update/RequireUpdateApproval](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-requireupdateapproval)
+- [Update/UpdateServiceUrl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updateserviceurl)
 
+For more information about using policies to manage HoloLens, see the following articles:
 
-
-## Related topics
-
+- [Policies supported by HoloLens 2](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#policies-supported-by-hololens-2)
 - [Policies supported by Windows Holographic for Business](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider#a-href-idhololenspoliciesapolicies-supported-by-windows-holographic-for-business)
 - [Manage software updates in Microsoft Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure)
diff --git a/devices/hololens/hololens-upgrade-enterprise.md b/devices/hololens/hololens-upgrade-enterprise.md
deleted file mode 100644
index f7da9a892b..0000000000
--- a/devices/hololens/hololens-upgrade-enterprise.md
+++ /dev/null
@@ -1,100 +0,0 @@
----
-title: Unlock Windows Holographic for Business features (HoloLens)
-description: HoloLens provides extra features designed for business when you upgrade to Windows Holographic for Business.
-ms.prod: hololens
-ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
-ms.topic: article
-ms.localizationpriority: medium
-ms.date: 07/09/2018
----
-
-# Unlock Windows Holographic for Business features
-
-
-
-Microsoft HoloLens is available in the *Development Edition*, which runs Windows Holographic (an edition of Windows 10 designed for HoloLens), and in the [Commercial Suite](https://docs.microsoft.com/windows/mixed-reality/commercial-features), which provides extra features designed for business. 
-
-When you purchase the Commercial Suite, you receive a license that upgrades Windows Holographic to Windows Holographic for Business. This license can be applied to the device either through the organization's [mobile device management (MDM) provider](#edition-upgrade-using-mdm) or a [provisioning package](#edition-upgrade-using-a-provisioning-package).
-
->[!TIP]
->In Windows 10, version 1803, you can tell that the HoloLens has been upgraded to the business edition in **Settings** > **System**. 
-
-
-
-## Edition upgrade using MDM 
-
-The enterprise license can be applied by any MDM provider that supports the [WindowsLicensing configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn904983.aspx). The latest version of the Microsoft MDM API will support WindowsLicensing CSP.
-
-For step-by-step instructions for upgrading HoloLens using Microsoft Intune, see [Upgrade devices running Windows Holographic to Windows Holographic for Business](https://docs.microsoft.com/intune/holographic-upgrade).
-
- On other MDM providers, the specific steps for setting up and deploying the policy might vary.
-
-
-
-## Edition upgrade using a provisioning package
-
-Provisioning packages are files created by the Windows Configuration Designer tool that apply a specified configuration to a device. 
-
-### Create a provisioning package that upgrades the Windows Holographic edition
-
-1.	[Create a provisioning package for HoloLens.](hololens-provisioning.md)
-
-2.  Go to **Runtime settings** > **EditionUpgrade**, and select **EditionUpgradeWithLicense**.
-
-    ![Upgrade edition with license setting selected](images/icd1.png)
-
-2.	Browse to and select the XML license file that was provided when you purchased the Commercial Suite.
-
-    >[!NOTE]
-    >You can configure [additional settings in the provisioning package](hololens-provisioning.md).
-
-3. On the **File** menu, click **Save**. 
-
-4. Read the warning that project files may contain sensitive information, and click **OK**.
-
-    >[!IMPORTANT]
-    >When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
-    
-3. On the **Export** menu, click **Provisioning package**.
-
-4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next**.
-
-5. Set a value for **Package Version**.
-
-    >[!TIP]
-    >You can make changes to existing packages and change the version number to update previously applied packages.
-
-6. On the **Select security details for the provisioning package**, click **Next**.
-
-7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
-
-    Optionally, you can click **Browse** to change the default output location.
-
-8. Click **Next**.
-
-9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.
-
-10. When the build completes, click **Finish**. 
-
-
-### Apply the provisioning package to HoloLens
-
-1. Connect the device via USB to a PC and start the device, but do not continue past the **fit** page of the initial setup experience (the first page with the blue box). HoloLens will show up as a device in File Explorer on the PC.
-
-    >[!NOTE]
-    >If the HoloLens device is running Windows 10, version 1607 or earlier, briefly press and release the **Volume Down** and **Power** buttons simultaneously to open File Explorer.
-
-4. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage.
-
-5. Briefly press and release the **Volume Down** and **Power** buttons simultaneously again while on the **fit** page.
-
-6. The device will ask you if you trust the package and would like to apply it. Confirm that you trust the package.
-
-7. You will see whether the package was applied successfully or not. If it failed, you can fix your package and try again. If it succeeded, proceed with device setup.
-
-
-
-
-
diff --git a/devices/hololens/hololens-whats-new.md b/devices/hololens/hololens-whats-new.md
index 0e17d81790..59c777fdec 100644
--- a/devices/hololens/hololens-whats-new.md
+++ b/devices/hololens/hololens-whats-new.md
@@ -3,44 +3,45 @@ title: What's new in Microsoft HoloLens (HoloLens)
 description: Windows Holographic for Business gets new features in Windows 10, version 1809.
 ms.prod: hololens
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.localizationpriority: medium
 ms.date: 11/13/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # What's new in Microsoft HoloLens
 
 ## Windows 10, version 1809 for Microsoft HoloLens
 
-### For everyone 
- 
-Feature | Details   
---- | --- 
-Quick actions menu | When you're in an app, the Bloom gesture will now open a Quick actions menu to give you quick access to commonly used system features without having to leave the app. See [Set up HoloLens in kiosk mode](hololens-kiosk.md) for information about the Quick actions menu in kiosk mode.

            ![sample of the Quick actions menu](images/minimenu.png)
-Stop video capture from the Start or quick actions menu | If you start video capture from the Start menu or quick actions menu, you’ll be able to stop recording from the same place. (Don’t forget, you can always do this with voice commands too.) 
-Project to a Miracast-enabled device | Project your HoloLens content to a nearby Surface device or TV/Monitor if using Microsoft Display adapter.  On **Start**, select **Connect**, and then select the device you want to project to. **Note:** You can deploy HoloLens to use Miracast projection without enabling developer mode.
-New notifications | View and respond to notification toasts on HoloLens, just like you do on a PC. Gaze to respond to or dismiss them (or if you’re in an immersive experience, use the bloom gesture).  
-HoloLens overlays (file picker, keyboard, dialogs, etc.) | You’ll now see overlays such as the keyboard, dialogs, file picker, etc. when using immersive apps.  
-Visual feedback overlay UI for volume change | When you use the volume up/down buttons on your HoloLens you’ll see a visual display of the volume level. 
-New UI for device boot | A loading indicator was added during the boot process to provide visual feedback that the system is loading. Reboot your device to see the new loading indicator—it’s between the "Hello" message and the Windows boot logo. 
-Share UX: Nearby Sharing | Addition of the Windows Nearby Sharing experience, allowing you to share a capture with a nearby Windows device. When you capture a photo or video on HoloLens (or use the share button from an app such as Microsoft Edge), select a nearby Windows device to share with. 
-Share from Microsoft Edge | Share button is now available on Microsoft Edge windows on HoloLens. In Microsoft Edge, select **Share**. Use the HoloLens share picker to share web content. 
+> **Applies to:** Hololens (1st gen)
 
+### For everyone
 
+| Feature | Details |
+|---|---|
+| **Quick actions menu** | When you're in an app, the Bloom gesture will now open a Quick actions menu to give you quick access to commonly used system features without having to leave the app. 
             See [Set up HoloLens in kiosk mode](hololens-kiosk.md) for information about the Quick actions menu in kiosk mode.

            ![sample of the Quick actions menu](images/minimenu.png) |
+| **Stop video capture from the Start or quick actions menu** | If you start video capture from the Start menu or quick actions menu, you’ll be able to stop recording from the same place. (Don’t forget, you can always do this with voice commands too.) |
+| **Project to a Miracast-enabled device** | Project your HoloLens content to a nearby Surface device or TV/Monitor if using Microsoft Display adapter.  On **Start**, select **Connect**, and then select the device you want to project to. **Note:** You can deploy HoloLens to use Miracast projection without enabling developer mode. |
+| **New notifications** | View and respond to notification toasts on HoloLens, just like you do on a PC. Gaze to respond to or dismiss them (or if you’re in an immersive experience, use the bloom gesture). |
+| **HoloLens overlays**
            (file picker, keyboard, dialogs, etc.) | You’ll now see overlays such as the keyboard, dialogs, file picker, etc. when using immersive apps. |
+| **Visual feedback overlay UI for volume change** | When you use the volume up/down buttons on your HoloLens you’ll see a visual display of the volume level. |
+| **New UI for device boot** | A loading indicator was added during the boot process to provide visual feedback that the system is loading. Reboot your device to see the new loading indicator—it’s between the "Hello" message and the Windows boot logo. |
+| **Nearby sharing** | Addition of the Windows Nearby Sharing experience, allowing you to share a capture with a nearby Windows device. When you capture a photo or video on HoloLens (or use the share button from an app such as Microsoft Edge), select a nearby Windows device to share with. |
+| **Share from Microsoft Edge** | Share button is now available on Microsoft Edge windows on HoloLens. In Microsoft Edge, select **Share**. Use the HoloLens share picker to share web content. |
 
-### For administrators 
+### For administrators
 
-
-Feature | Details  
---- | --- 
-[Enable post-setup provisioning](hololens-provisioning.md) | You can now apply a runtime provisioning package at any time using **Settings**.   
-Assigned access with Azure AD groups | You can now use Azure AD groups for configuration of Windows assigned access to set up single or multi-app kiosk configuration.  
-PIN sign-in on profile switch from sign-in screen  | PIN sign-in is now available for **Other User**.  | When signing in as **Other User**, the PIN option is now available under **Sign-In options**. 
-Sign in with Web Credential Provider using password | You can now select the Globe sign-in option to launch web sign-in with your password. From the sign-in screen, select **Sign-In options** and select the Globe option to launch web sign-in. Enter your user name if needed, then your password. 
            **Note:** You can choose to bypass any PIN/Smartcard options when prompted during web sign-in.  
-Read device hardware info through MDM so devices can be tracked by serial # | IT administrators can see and track HoloLens by device serial number in their MDM console. Refer to your MDM documentation for feature availability and instructions. 
-Set HoloLens device name through MDM (rename) |  IT administrators can see and rename HoloLens devices in their MDM console. Refer to your MDM documentation for feature availability and instructions. 
+| Feature |  Details  |
+|---|----|
+|         [Enable post-setup provisioning](hololens-provisioning.md)          |                                                                                                                                   You can now apply a runtime provisioning package at any time using **Settings**.                                                                                                                                   |
+|                    Assigned access with Azure AD groups                     |                                                                                                           You can now use Azure AD groups for configuration of Windows assigned access to set up single or multi-app kiosk configuration.                                                                                                            |
+|              PIN sign-in on profile switch from sign-in screen              |                                                                                                                                                  PIN sign-in is now available for **Other User**.                                                                                                                                                    |
+|             Sign in with Web Credential Provider using password             | You can now select the Globe sign-in option to launch web sign-in with your password. From the sign-in screen, select **Sign-In options** and select the Globe option to launch web sign-in. Enter your user name if needed, then your password. 
            **Note:** You can choose to bypass any PIN/Smartcard options when prompted during web sign-in.  |
+| Read device hardware info through MDM so devices can be tracked by serial # |                                                                                        IT administrators can see and track HoloLens by device serial number in their MDM console. Refer to your MDM documentation for feature availability and instructions.                                                                                         |
+|                Set HoloLens device name through MDM (rename)                |                                                                                                IT administrators can see and rename HoloLens devices in their MDM console. Refer to your MDM documentation for feature availability and instructions.                                                                                                |
 
 ### For international customers 
  
@@ -50,15 +51,16 @@ Feature | Details
 Localized Chinese and Japanese builds | Use HoloLens with localized user interface for Simplified Chinese or Japanese, including localized Pinyin keyboard, dictation, and voice commands.  
 Speech Synthesis (TTS) | Speech synthesis feature now supports Chinese, Japanese, and English. 
 
-[Learn how to install the Chinese and Japanese versions of HoloLens.](hololens-install-localized.md) 
+[Learn how to install the Chinese and Japanese versions of HoloLens.](hololens1-install-localized.md) 
 
-    
 
 ## Windows 10, version 1803 for Microsoft HoloLens
 
+> **Applies to:** Hololens (1st gen)
+
 Windows 10, version 1803, is the first feature update to Windows Holographic for Business since its release in Windows 10, version 1607. This update introduces the following changes:
 
-- Previously, you could only verify that upgrade license for Commercial Suite had been applied to your HoloLens device by checking to see if VPN was an available option on the device. Now, **Settings** > **System** will display **Windows Holographic for Business** after the upgrade license is applied. [Learn how to unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md). 
+- Previously, you could only verify that upgrade license for Commercial Suite had been applied to your HoloLens device by checking to see if VPN was an available option on the device. Now, **Settings** > **System** will display **Windows Holographic for Business** after the upgrade license is applied. [Learn how to unlock Windows Holographic for Business features](hololens1-upgrade-enterprise.md). 
 
 - You can view the operating system build number in device properties in the File Explorer app and in the [Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379/windows-10-mobile-device-recovery-tool-faq).
     
@@ -83,14 +85,3 @@ Windows 10, version 1803, is the first feature update to Windows Holographic for
 - Individual users can sync their corporate email without enrolling their device in mobile device management (MDM). You can use the device with a Microsoft Account, download and install the Mail app, and add an email account directly.
 
 - You can check the MDM sync status for a device in **Settings** > **Accounts** > **Access Work or School** > **Info**. In the **Device sync status** section, you can start a sync, see areas managed by MDM, and create and export an advanced diagnostics report.
-
-
-
-
-
-## Additional resources
-
-- [Reset or recover your HoloLens](https://developer.microsoft.com/windows/mixed-reality/reset_or_recover_your_hololens)
-- [Restart, reset, or recover HoloLens](https://support.microsoft.com/help/13452/hololens-restart-reset-or-recover-hololens)
-- [Manage devices running Windows Holographic with Microsoft Intune](https://docs.microsoft.com/intune/windows-holographic-for-business)
-
diff --git a/devices/hololens/hololens1-basic-usage.md b/devices/hololens/hololens1-basic-usage.md
new file mode 100644
index 0000000000..282eaada0a
--- /dev/null
+++ b/devices/hololens/hololens1-basic-usage.md
@@ -0,0 +1,138 @@
+---
+title: Getting around HoloLens (1st gen)
+description: A brief tour of the HoloLens (1st gen) interface
+ms.assetid: 064f7eb0-190e-4643-abeb-ed3b09312042
+ms.date: 9/16/2019
+ms.reviewer: jarrettr
+manager: jarrettr
+keywords: hololens
+ms.prod: hololens
+ms.sitesec: library
+author: v-miegge
+ms.author: v-miegge
+ms.topic: article
+ms.localizationpriority: high
+appliesto:
+- HoloLens (1st gen)
+---
+
+# Getting around HoloLens (1st gen)
+
+Ready to step into the world of holograms? Here's some information to get started.
+
+This guide provides an intro to mixed reality, gestures for interacting with holograms, and an intro to Windows Holographic.
+
+## Discover mixed reality
+
+On HoloLens, holograms blend with your physical environment to look and sound like they're part of your world. Even when holograms are all around you, you can still see your surroundings, move freely, and interact with other people and objects. We call this experience "mixed reality."
+
+The holographic frame positions your holograms where your eyes are most sensitive to detail, and the see-through lenses leave your peripheral vision unobscured. With spatial sound, you can pinpoint a hologram even if it’s behind you. And because HoloLens learns and understands your environment, you can place holograms on and around real objects—and so can your apps and games. So a character in a game might sit down on your sofa, or [space robots could bust out of your walls](https://www.microsoft.com/store/apps/9nblggh5fv3j).
+
+## Use HoloLens with your hands
+
+Getting around HoloLens is a lot like using your smart phone. You can use your hands to manipulate holographic windows, menus, and buttons.  Instead of pointing, clicking, or tapping, you'll use your gaze, your [voice](hololens-cortana.md), and gestures to select apps and holograms and to get around HoloLens.
+
+When you know these basic interactions, getting around on HoloLens will be a snap.
+
+We'll walk you through the basics the first time you use your HoloLens. You'll also find a gesture tutorial on your **Start** menu—look for the Learn Gestures app.
+
+### The hand-tracking frame
+
+HoloLens has sensors that can see a few feet to either side of you. When you use your hands, you'll need to keep them inside that frame, or HoloLens won't see them. As you move around, the frame moves with you.  
+
+![Image that shows the HoloLens hand-tracking frame](./images/hololens-2-gesture-frame.png)
+
+### Open the Start menu with bloom
+
+To open the **Start** menu:
+
+1. Hold your hand in front of you so it's in the gesture frame.
+1. Bloom: bring all of your fingers together then open your hand.
+  ![Animation that shows the bloom gesture](./images/hololens-bloom.gif)
+
+### Select holograms with gaze and air tap
+
+To select an app or other hologram, air tap it while looking directly at the hologram you're selecting. To do this, follow these steps:
+
+1. Gaze at the hologram you want to select.
+1. Point your index finger straight up toward the ceiling.
+1. Air tap: lower your finger, then quickly raise it.
+   ![Air-tap gesture animation](./images/hololens-air-tap.gif)
+
+### Select a hologram by using your voice
+
+1. The gaze cursor is a dot that you move around by moving your head. You can use it to target voice commands with precision.
+1. Gaze at the hologram that you want to select.
+1. To select the hologram, say "Select."
+
+## Holograms and apps
+
+Now it's time to put gestures to the test!
+
+You'll find your installed apps in the [Start menu](holographic-home.md) and there are more apps for HoloLens (1st gen) in the Microsoft Store.
+
+Open the **Start** menu and select an app!
+
+Using apps on HoloLens is a little different from on a PC: Some apps use a 2D view and look like other Windows applications. Other apps (immersive apps) use a 3D view and when you launch them, they become the only app you see.
+
+When you place an app window or app launcher, it will stay put until you remove it. You can move or resize these holograms in your mixed reality home at any time.
+
+## Move, resize, and rotate apps
+
+Moving and resizing apps on HoloLens works a bit differently than it does on a PC. Instead of dragging the app, you'll use your gaze, along with a [gesture](https://support.microsoft.com/help/12644/hololens-use-gestures) or the [clicker](hololens1-clicker.md). You can also rotate an app window in 3D space.
+
+> [!TIP]
+> Rearrange apps using your voice - gaze at an app and say "Face me," "Bigger," or "Smaller." Or have Cortana move an app for you: say "Hey Cortana, move \**app name\** here."
+
+### Move an app
+
+Gaze at the app (at the title bar of an app window), and then do one of the following.
+
+- Tap and hold to select the app. Move your hand to position the app, and raise your finger to place it.
+- Select **Adjust**, tap and hold, and move your hand to position the app. Raise your finger to place it, then select **Done**.
+- Select **Adjust**, click and hold the clicker, and move your hand to position the app. Release the clicker, then select **Done**.
+
+> [!TIP]
+> If you drop apps when you move them, make sure to keep your hand in the gesture frame by following it with your gaze.
+
+### Resize an app
+
+Gaze at the app, and then do one of the following.
+
+- Gaze at a corner or edge of an app window, and tap and hold. Move your hand to change the app's size, and raise your finger when you're done.
+- Select **Adjust**. Gaze at one of the blue squares at the corners of the app, tap and hold, then move your hand to resize the app. Raise your finger to release it, then select **Done**.
+- Select **Adjust**. Gaze at one of the blue squares at the corners of the app, click and hold the clicker, then move your hand to resize the app. Release the clicker, then select **Done**.
+
+> [!TIP]
+> In Adjust mode, you can move or resize any hologram.
+
+### Rotate an app
+
+Gaze at the app, and tap and hold with both hands to select it. Rotate the app by keeping one hand steady and moving your other hand around it. When you're done, raise both index fingers.
+
+### Scroll content in an app window
+
+Gaze at the content of the app window. Tap and hold and then move your hand slightly upwards or downwards to scroll the content.
+
+## Meet the HoloLens (1st gen) Clicker
+
+The [HoloLens (1st Gen) clicker](hololens1-clicker.md) gives you another way to interact with holograms. [Pair it](hololens-connect-devices.md) with your HoloLens and then use it along with your gaze to select, scroll, and more.
+
+## Next steps
+
+Congratulations! you're ready to use HoloLens (1st gen).
+
+Now you can configure your HoloLens (1st gen) to meet your specific needs.
+
+[Connect bluetooth devices like mouse and keyboard](hololens-connect-devices.md)
+
+[Learn more about Voice and Cortana](hololens-cortana.md)
+
+### Help! I don't see my holograms
+
+If you don’t see holograms that you’ve placed while using HoloLens, here are some things to try:
+
+- Make sure that you’re looking in the right area—remember, holograms stay where you left them!
+- Make sure that you're in a well-lit room without a lot of direct sunlight.
+- Wait. When HoloLens has trouble recognizing your space, previously placed holograms can take up to a minute to reappear.
+- If issue persists, you may want to clear out your Holograms storage data in **Settings** > **System** > **Holograms**, then place holograms in mixed reality home again.
diff --git a/devices/hololens/hololens1-clicker.md b/devices/hololens/hololens1-clicker.md
new file mode 100644
index 0000000000..9da6a40ba5
--- /dev/null
+++ b/devices/hololens/hololens1-clicker.md
@@ -0,0 +1,97 @@
+---
+title: Use the HoloLens clicker
+description:  This article outlines how to use the HoloLens clicker, including clicker pairing, charging, and recovery.
+ms.assetid: 7d4a30fd-cf1d-4c9a-8eb1-1968ccecbe59
+ms.date: 09/16/2019
+manager: jarrettr
+keywords: hololens
+ms.prod: hololens
+ms.sitesec: library
+author: v-miegge
+ms.author: v-miegge
+ms.topic: article
+ms.localizationpriority: high
+appliesto:
+- HoloLens (1st gen)
+---
+
+# Use the HoloLens (1st gen) clicker
+
+The clicker was designed specifically for HoloLens (1st gen) and gives you another way to interact with holograms. It comes with HoloLens (1st gen), in a separate box.
+
+Use it in place of hand gestures to select, scroll, move, and resize apps.
+
+## Clicker hardware and pairing
+
+The HoloLens (1st gen) clicker has a finger loop to make it easier to hold, and an indicator light.
+
+![The HoloLens Clicker](images/use-hololens-clicker-1.png)
+
+### Clicker indicator lights
+
+Here's what the lights on the clicker mean.
+
+- **Blinking white**. The clicker is in pairing mode.
+- **Fast-blinking white**. Pairing was successful.
+- **Solid white**. The clicker is charging.
+- **Blinking amber**. The battery is low.
+- **Solid amber**. The clicker ran into an error and you'll need to restart it. While pressing the pairing button, click and hold for 15 seconds.
+
+### Pair the clicker with your HoloLens (1st gen)
+
+1. Use the bloom gesture to go to **Start**, then select **Settings** > **Devices** and verify that Bluetooth is on.
+1. On the clicker, press and hold the pairing button until the status light blinks white.
+1. On the pairing screen, select **Clicker** > **Pair**.
+
+### Charge the clicker
+
+When the clicker battery is low, the battery indicator will blink amber. Plug the Micro USB cable into a USB power supply to charge the device.
+
+## Use the clicker with HoloLens (1st gen)
+
+### Hold the clicker
+
+To put on the clicker, slide the loop over your ring or middle finger so that the Micro USB port faces toward your wrist. Rest your thumb in the indentation.
+
+![How to hold the Clicker](images/use-hololens-clicker-2.png)
+
+### Clicker gestures
+
+Clicker gestures are small wrist rotations, not the larger movements used for HoloLens hand gestures. And HoloLens recognizes your gestures and clicks even if the clicker is outside the [gesture frame](hololens1-basic-usage.md), so you can hold the clicker in the position that's most comfortable for you​.
+
+- **Select**. To select a hologram, button, or other element, gaze at it, then click.
+
+- **Click and hold**. Click and hold your thumb down on the button to do some of the same things you would with tap and hold, such as move or resize a hologram.
+
+- **Scroll**. On the app bar, select **Scroll Tool**. Click and hold, then rotate the clicker up, down, left, or right. To scroll faster, move your hand farther from the center of the scroll tool.
+
+- **Zoom**. On the app bar, select **Zoom Tool**. Click and hold, then rotate the clicker up to zoom in, or down to zoom out.
+
+> [!TIP]
+> To zoom in or out when using Microsoft Edge, gaze at a page and double-click.
+
+## Restart or recover the clicker
+
+Here are some things to try if the HoloLens clicker is unresponsive or isn’t working well.
+
+### Restart the clicker
+
+Use the tip of a pen to press and hold the pairing button. At the same time, click and hold the clicker for 15 seconds. If the clicker was already paired with your HoloLens, it will stay paired after it restarts.
+
+If the clicker won't turn on or restart, try charging it by using the HoloLens charger. If the battery is very low, it might take a few minutes for the white indicator light to turn on.
+
+### Re-pair the clicker
+
+Select **Settings** > **Devices** and select the clicker. Select **Remove**, wait a few seconds, then pair the clicker again.
+
+### Recover the clicker
+
+If restarting and re-pairing the clicker don’t fix the problem, the Windows Device Recovery Tool can help you recover it. The recovery process may take some time, and it will install the latest version of the clicker software. To use the tool, you’ll need a computer running Windows 10 or later that has at least 4 GB of free storage space.
+
+To recover the clicker:
+
+1. Download and install the [Windows Device Recovery Tool](https://dev.azure.com/ContentIdea/ContentIdea/_queries/query/8a004dbe-73f8-4a32-94bc-368fc2f2a895/) on your computer.
+1. Connect the clicker to your computer by using the Micro USB cable that came with your HoloLens.
+1. Run the Windows Device Recovery Tool and follow the instructions.
+
+If the clicker isn’t automatically detected, select **My device was not detected** and follow the instructions to put your device into recovery mode.
diff --git a/devices/hololens/hololens1-fit-comfort-faq.md b/devices/hololens/hololens1-fit-comfort-faq.md
new file mode 100644
index 0000000000..d76375918c
--- /dev/null
+++ b/devices/hololens/hololens1-fit-comfort-faq.md
@@ -0,0 +1,64 @@
+---
+title: HoloLens (1st gen) fit and comfort frequently asked questions
+description: Answers to frequently asked questions about how to fit your HoloLens (1st gen).
+ms.prod: hololens
+ms.sitesec: library
+author: Teresa-Motiv
+ms.author: v-tea
+ms.topic: article
+ms.localizationpriority: high
+ms.date: 10/09/2019
+ms.reviewer: jarrettr
+audience: ITPro
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+---
+
+# HoloLens (1st gen) fit and comfort frequently asked questions
+
+Here are some tips on how to stay comfortable and have the best experience using your HoloLens.
+
+For step-by-step instructions and a video about putting on and adjusting your device, see [Get your HoloLens (1st gen) ready to use](hololens1-setup.md).
+
+> [!NOTE]
+> The fit and comfort tips in this topic are meant only as general guidance—they don't replace any laws or regulations, or your good judgment when using HoloLens. Stay safe, and have fun!
+
+Here are some tips on how to stay comfortable and have the best experience using your HoloLens.
+
+## I'm experiencing discomfort when I use my device. What should I do?
+
+If you experience discomfort, take a break until you feel better. Try sitting in a well-lit room and relaxing for a bit. The next time your use your HoloLens, try using it for a shorter period of time at first.
+
+For more information, see [Health and safety on HoloLens](https://go.microsoft.com/fwlink/p/?LinkId=746661).
+
+## I can't see the whole holographic frame, or my holograms are cut off
+
+To see the top edge of the holographic frame, move the device so it sits higher on your head, or angle the headband up slightly in front. To see the bottom edge, move the device to sit lower on your head, or angle the headband down slightly in front. If the left or right edge of the view frame isn't visible, make sure the HoloLens visor is centered on your forehead.
+
+## I need to look up or down to see holograms
+
+Try adjusting the position of your device visor so the holographic frame matches your natural gaze. Here's how:
+
+- **If you need to look up to see holograms**. First, shift the back of the headband a bit higher on your head. Then use one hand to hold the headband in place and the other to gently rotate the visor so you have a good view of the holographic frame.
+- **If you need to look down to see holograms**. First, shift the back of the headband a bit lower on your head. Then place your thumbs under the device arms and your index fingers on top of the headband, and gently squeeze with your thumbs to rotate the visor so you have a good view of the holographic frame.
+
+## The device slides down when I'm using it, or I need to make the headband too tight to keep it secure
+
+The overhead strap can help keep your HoloLens secure on your head, particularly if you're moving around a lot. The strap may also let you loosen the headband a bit. [Learn how to use it](hololens1-setup.md#adjust-fit).
+
+You can also experiment with the positioning of the headband—depending on your head size and shape, you may need to slide it up or down to reposition it on your forehead.
+
+## My HoloLens feels heavy on my nose
+
+If your HoloLens is adjusted correctly, the nose pad should rest lightly on your nose. If it feels heavy on your nose, try rotating the visor up or adjusting the angle of the headband. You can also slide the device visor out—grasp the device arms just behind the visor and pull forward gently.
+
+## How can I adjust HoloLens to fit with my glasses?
+
+The device visor can slide in and out to accommodate eyewear. Grasp the device arms just behind the visor and pull forward gently to adjust it.
+
+## My arm gets tired when I use gestures. What can I do?
+
+When using gestures, there's no need to extend your arm out far from your body. Keep it closer to your side, where it's more comfortable and will get less tired. [Learn more about gestures](hololens1-basic-usage.md#use-hololens-with-your-hands).
+
+And be sure to try out [voice commands](hololens-cortana.md) and the [HoloLens clicker](hololens1-clicker.md).
diff --git a/devices/hololens/hololens1-hardware.md b/devices/hololens/hololens1-hardware.md
new file mode 100644
index 0000000000..285f44dd6a
--- /dev/null
+++ b/devices/hololens/hololens1-hardware.md
@@ -0,0 +1,166 @@
+---
+title: HoloLens (1st gen) hardware
+description: An outline of the components that make up Microsoft HoloLens (1st gen), the world's first fully untethered holographic computer running Windows.
+ms.assetid: 527d494e-2ab6-46ca-bd5a-bfc6b43cc833
+ms.date: 09/16/2019
+keywords: hololens
+ms.prod: hololens
+ms.sitesec: library
+author: mattzmsft
+ms.author: mazeller
+ms.topic: article
+manager: jarrettr
+ms.localizationpriority: medium
+appliesto:
+- HoloLens (1st gen)
+---
+
+# HoloLens (1st gen) hardware
+
+![Microsoft HoloLens (1st gen)](images/see-through-400px.jpg)
+
+Microsoft HoloLens (1st gen) is the world's first fully untethered holographic computer. HoloLens redefines personal computing through holographic experiences to empower you in new ways. HoloLens blends cutting-edge optics and sensors to deliver 3D holograms pinned to the real world around you.
+
+## HoloLens components
+
+![Image that shows the contents of the box](images/hololens-box-contents.png)
+
+Your HoloLens includes the following features:
+
+- **Visor**. Contains the HoloLens sensors and displays. You can rotate the visor up while you are wearing the HoloLens.
+- **Headband**. To put the HoloLens on, use the adjustment wheel to expand the headband. With the HoloLens in place, tighten the adjustment wheel until the headband is comfortable.
+- **Brightness buttons**. When you're wearing the HoloLens, the brightness buttons are on the left side of the device.
+- **Volume buttons**. When you're wearing the HoloLens, the volume buttons are on the right side of the device.
+- **Device arms**. When you pick up, put on, or take off your HoloLens, always grasp or hold it by the device arms.
+
+## In the box
+
+> [!VIDEO https://www.microsoft.com/videoplayer/embed/c7ceb904-9d5f-4194-9e10-e8a949dbad7d]  
+
+The HoloLens box contains the following items:
+
+- **Nose pads**. Select a nose pad that fits the shape of your nose and accommodates your eyewear.
+- **Overhead strap**. When you're wearing the HoloLens while you move around, use the overhead strap to help keep the device in place. Additionally, if you're wearing the HoloLens for extended periods, using the overhead strap may make the device more comfortable to wear.
+- **Micro USB cable**. Use the micro-USB cable to connect your HoloLens to the power supply for charging, or use it to connect your HoloLens to your computer.
+- **Power supply**. Plugs into a power outlet.
+- **Microfiber cloth**. Use the cloth to clean your HoloLens visor.
+
+>[!TIP]
+>The [clicker](hololens1-clicker.md) ships with HoloLens (1st Gen), in a separate box.
+
+### Power Supply details
+
+The power supply and the USB cable that come with the device are the best supported mechanism for charging. The power supply is an 18W charger.  It supplies 9V at 2A.
+
+Charging rate and speed may vary depending on the environment in which the device is running.
+
+In order to maintain/advance Internal Battery Charge Percentage while the device is on, it must be connected minimum to a 15W charger.
+
+## Device specifications
+
+### Display
+
+![HoloLens has see-through holographic lenses](images/displays-400px.jpg)
+
+|   |   |
+| - | - |
+| Optics | See-through holographic lenses (waveguides) |
+| Holographic resolution | 2 HD 16:9 light engines producing 2.3M total light points |
+| Holographic density | \>2.5k radiants (light points per radian) |
+| Eye-based rendering | Automatic pupillary distance calibration |
+
+### Sensors
+
+![HoloLens has sensors for understanding its environment and user actions](images/sensor-bar-400px.jpg)
+
+- 1 inertial measurement unit (IMU)
+- 4 environment understanding cameras
+- 1 depth camera
+- 1 2MP photo / HD video camera
+- Mixed reality capture
+- 4 microphones
+- 1 ambient light sensor
+
+### Input, output, and connectivity
+
+- Built-in speakers
+- Audio 3.5mm jack
+- Volume up/down
+- Brightness up/down
+- Power button
+- Battery status LEDs
+- Wi-Fi 802.11ac
+- Micro USB 2.0
+- Bluetooth 4.1 LE
+
+### Power
+
+- Battery Life
+- 2-3 hours of active use
+- Up to 2 weeks of standby time
+- Fully functional when charging
+- Passively cooled (no fans)
+
+### Processors
+
+![The motherboard for Microsoft HoloLens](images/motherboard-400px.jpg)
+
+- Intel 32-bit architecture with TPM 2.0 support
+- Custom-built Microsoft Holographic Processing Unit (HPU 1.0)
+
+### Memory
+
+- 64 GB Flash
+- 2 GB RAM
+
+### Fit
+
+|   |   |
+| - | - |
+| Sizing | Single size with adjustable band. Fits over glasses |
+| Weight | 579 grams |
+
+## Device capabilities
+
+Using the following to understand user actions:
+
+- Gaze tracking
+- Gesture input
+- Voice support
+
+Using the following to understand the environment:
+
+- Spatial sound
+
+## Pre-installed software
+
+- Windows 10
+- Windows Store
+- Holograms
+- Microsoft Edge
+- Photos
+- Settings
+- Windows Feedback
+- Calibration
+- Learn Gestures
+
+## Device certifications
+
+### Safety
+
+HoloLens has been tested and found to conform to the basic impact protection requirements of ANSI Z87.1, CSA Z94.3 and EN 166.
+
+## Care and cleaning
+
+Handle your HoloLens carefully. To lift, carry, and adjust your HoloLens, use the device arms—not the overhead strap. To keep the visor free of dust and fingerprints and avoid touching it. Repeated cleaning could damage the visor, so try to keep your device clean.
+
+Don't use any cleaners or solvents on your HoloLens, and don't submerge it in water or apply water directly to it.
+
+To clean the visor, remove any dust using a camel or goat hair lens brush or a bulb-style lens blower. Lightly moisten the microfiber cloth with a small amount of distilled water, then use it to wipe the visor gently in a circular motion.
+
+To clean the rest of the device, including the headband and device arms, use a lint-free cloth moistened with mild soap and water. Let your HoloLens dry completely before using it again.
+
+![Image that shows how to clean the visor](images/hololens-cleaning-visor.png)
+
+> [!div class="nextstepaction"]
+> [Set up and start your HoloLens (1st gen)](hololens1-setup.md)
diff --git a/devices/hololens/hololens1-install-localized.md b/devices/hololens/hololens1-install-localized.md
new file mode 100644
index 0000000000..52e4862bbe
--- /dev/null
+++ b/devices/hololens/hololens1-install-localized.md
@@ -0,0 +1,39 @@
+---
+title: Install localized versions of HoloLens
+description: Learn how to install the Chinese or Japanese versions of HoloLens
+ms.prod: hololens
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.localizationpriority: high
+ms.date: 9/16/2019
+ms.reviewer: 
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+---
+
+# Install localized versions of HoloLens (1st gen)
+
+In order to switch to the Chinese or Japanese version of HoloLens, you’ll need to use the Windows Device Recovery Tool (WDRT) to download the build for the language on a PC and then install it on your HoloLens.
+
+> [!IMPORTANT]
+> Using WDRT to install the Chinese or Japanese builds of HoloLens deletes existing data, such as personal files and settings, from your HoloLens. 
+
+1. On your PC, download and install [the Windows Device Recovery Tool (WDRT)](https://support.microsoft.com/help/12379).
+1. Download the package for the language you want to your PC:  [Simplified Chinese](https://aka.ms/hololensdownload-ch) or [Japanese](https://aka.ms/hololensdownload-jp).
+1. When the download finishes, select **File Explorer** > **Downloads**. Right-click the zipped folder that you just downloaded, and select **Extract all** > **Extract** to unzip it.
+1. Connect your HoloLens to your PC using the micro-USB cable that it shipped with. (Even if you've been using other cables to connect your HoloLens, this one works best.)
+1. After the tool automatically detects your HoloLens, select the Microsoft HoloLens tile.
+1. On the next screen, select **Manual package selection** and select the installation file that resides in the folder that you unzipped in step 4. (Look for a file that has the extension “.ffu”.) 
+1. Select **Install software** and follow the instructions. 
+1. After the build installs, HoloLens setup automatically starts. Put on the device and follow the setup directions. 
+
+When you’re done with setup, go to **Settings** > **Update & Security** > **Windows Insider Program**, and check that you’re configured to receive the latest preview builds. Like the English preview builds, the Windows Insider Program keeps the Chinese and Japanese versions of HoloLens up-to-date with the latest preview builds.
+
+> [!NOTE]
+>  
+> - You can’t use the Settings app to change the system language between English, Japanese, and Chinese. Flashing a new build is the only supported way to change the device system language.
+> - While you can use the on-screen Pinyin keyboard to enter Simplified Chinese or Japanese text, using a Bluetooth hardware keyboard to type Simplified Chinese or Japanese text is not supported at this time.  However, on Chinese or Japanese HoloLens, you can continue to use a Bluetooth keyboard to type in English (to toggle a hardware keyboard to type in English, press the ~ key).
diff --git a/devices/hololens/hololens1-setup.md b/devices/hololens/hololens1-setup.md
new file mode 100644
index 0000000000..cbbc2315b7
--- /dev/null
+++ b/devices/hololens/hololens1-setup.md
@@ -0,0 +1,106 @@
+---
+title: Prepare a new HoloLens
+description: This guide walks through first time set up.
+ms.prod: hololens
+ms.sitesec: library
+author: JesseMcCulloch
+ms.author: jemccull
+ms.topic: article
+ms.localizationpriority: high
+ms.date: 8/12/2019
+ms.reviewer: 
+manager: jarrettr
+appliesto:
+- Hololens (1st gen)
+---
+
+# Get your HoloLens (1st gen) ready to use
+
+Follow along to set up a HoloLens (1st gen) for the first time.
+
+## Charge your HoloLens (1st gen)
+
+To charge your HoloLens, connect the power supply to the charging port by using the included Micro USB cable. Then plug the power supply into a power outlet. When the device is charging, the battery indicator will light up in a wave pattern.
+
+![Image that shows how to attach the Micro USB cable to the HoloLens](./images/hololens-charging.png)
+
+When your HoloLens is on, the battery indicator shows the battery level in increments. When only one of the five lights is on, the battery level is below 20 percent. If the battery level is critically low and you try to turn on the device, one light will blink briefly, then go out.
+
+> [!TIP]
+> To get an estimate of your current battery level, say "Hey Cortana, how much battery do I have left?"
+
+The power supply and USB cable that come with the device are the best way to charge your HoloLens (1st gen).  The power supply provides 18W of power (9V 2A).
+
+Charging rate and speed may vary depending on the environment in which the device is running.
+
+## Adjust fit
+
+> [!VIDEO https://www.microsoft.com/videoplayer/embed/be3cb527-f2f1-4f85-b4f7-a34fbaba980d]
+
+|     |     |
+|:--- |:--- |
+|1. Rotate the headband up to about 20-30 degrees.|![Step one, rotate the headband](./images/FitGuideStep1.png)|
+|2. Push the headband back. Do not pull it back, or manipulate the band behind the hinge, because over time this can break the band.|![Step two, push the headband back](./images/FitGuideStep2.png)|
+|3. Turn the adjustment wheel to extend the headband all the way out. |![Step three, use the adjustment wheel to extend the headband](./images/FitGuideStep3.png)|
+|4. Hold the device by the device arms, and place it on your head. Make sure that the headband sits at the top of your forehead, and then tighten the adjustment wheel.|![Step four, put on the device and adjust the headband](./images/FitGuideStep4.png)|
+|5. Slide the visor back, and then check the fit of the device. The headband should sit at the top of the forehead, just below your hairline, with the speakers above your ears. The lenses should be centered over your eyes.|![Step five, slide the visor back and check the fit](./images/FitGuideSetep5.png)|
+
+## Turn on your HoloLens
+
+Use the power button to turn HoloLens on and off or to put it in standby mode.
+
+![Image that shows the HoloLens power button](./images/hololens-power.png)
+
+If your device doesn't respond or won't start, see [Restart, reset, or recover HoloLens](hololens-restart-recover.md).
+
+When your HoloLens is off or in standby, turn it on by pressing the power button for one second. If it doesn't turn on, plug it in and charge it for at least 30 minutes.
+
+> [!TIP]
+> To restart HoloLens, say "Hey Cortana, reboot the device."
+
+### Put HoloLens in standby
+
+To put your HoloLens in standby while it's turned on, press the power button once. The battery indicators blink off. To wake it from standby, press the power button again.
+
+HoloLens automatically goes into standby after 3 minutes of inactivity. When it's in standby, it automatically shuts down after 4 hours, or after the battery level drops by 10 percent.
+
+### Shut down HoloLens
+
+To shut down (turn off) HoloLens, hold the power button down for four seconds. The battery indicators turn off one by one and the device shuts down.
+
+HoloLens automatically shuts down when the battery level drops to one percent, even if it's plugged in. After you've recharged the battery to three percent, you'll be able to turn HoloLens on again.
+
+## Adjust volume and brightness
+
+The brightness and volume buttons are on top of the device arms—volume to your right and brightness to your left.
+
+![Image that shows the HoloLens buttons](./images/hololens-buttons.jpg)
+
+## HoloLens indicator lights
+
+![Image that shows the HoloLens indicator lights](./images/hololens-lights.png)
+
+Not sure what the indicator lights on your HoloLens mean? Here's some help.
+
+|When the lights do this |It means |
+| - | - |
+|Scroll from the center outward. |HoloLens is starting up. |
+|Stay lit (all or some). |HoloLens is on and ready to use. Battery life is shown in 20 percent increments. |
+|Scroll, then light up, then scroll. |HoloLens is on and charging. Battery life is shown in 20 percent increments. |
+|Turn off one by one. |HoloLens is shutting down. |
+|Turn off all at once. |HoloLens is going into standby. |
+|All light up, then one blinks briefly, then all turn off. |Battery is critically low. HoloLens needs to charge. |
+|All scroll, then one blinks, then all scroll. |Battery is critically low. HoloLens is charging. |
+
+## Safety and comfort
+
+### Use in safe surroundings
+
+Use your HoloLens in a safe space that’s free of obstructions and tripping hazards. Don’t use it when you need a clear field of view and your full attention, such as while you’re operating a vehicle or doing other potentially hazardous activities.
+
+### Stay comfortable
+
+Keep your first few sessions with HoloLens brief and be sure to take breaks. If you experience discomfort, stop and rest until you feel better. This might include temporary feelings of nausea, motion sickness, dizziness, disorientation, headache, fatigue, eye strain, or dry eyes.
+
+> [!div class="nextstepaction"]
+> [Start and configure your HoloLens (1st gen)](hololens1-start.md)
diff --git a/devices/hololens/hololens1-start.md b/devices/hololens/hololens1-start.md
new file mode 100644
index 0000000000..466fc431b2
--- /dev/null
+++ b/devices/hololens/hololens1-start.md
@@ -0,0 +1,75 @@
+---
+title: Set up HoloLens (1st gen)
+description: This guide walks through first time set up.  You'll need a Wi-Fi network and either a Microsoft (MSA) or Azure Active Directory (Azure AD) account.
+ms.assetid: 0136188e-1305-43be-906e-151d70292e87
+ms.prod: hololens
+author: Teresa-Motiv
+ms.author: v-tea
+ms.topic: article
+ms.date: 8/12/19
+manager: jarrettr
+ms.topic: article
+ms.localizationpriority: high
+appliesto:
+- HoloLens (1st gen)
+---
+
+# Set up your HoloLens (1st gen)
+
+The first time you turn on your HoloLens, you'll be guided through calibrating your device, setting up your device, and signing in.  This article walks through the HoloLens (1st gen) first start and setup experience.
+
+In the next section, you'll learn how to work with HoloLens and interact with holograms. To skip ahead to that article, see [Get started with HoloLens (1st gen)](hololens1-basic-usage.md).
+
+## Before you start
+
+Before you get started, make sure you have the following available:
+
+**A Wi-Fi connection**. You'll need to connect your HoloLens to a Wi-Fi network to set it up. The first time you connect, you'll need an open or password-protected network that doesn't require navigating to a website or using certificates to connect. [Learn more about the websites that HoloLens uses](hololens-offline.md).
+
+**A Microsoft account or a work account**. You'll also need to use a Microsoft account (or a work account, if your organization owns the device) to sign in to HoloLens. If you don't have a Microsoft account, go to [account.microsoft.com](http://account.microsoft.com) and set one up for free.
+
+**A safe, well-lit space with no tripping hazards**. [Health and safety info](http://go.microsoft.com/fwlink/p/?LinkId=746661).
+
+**The optional comfort accessories** that came with your HoloLens, to help you get the most comfortable fit. [More on fit and comfort](https://support.microsoft.com/help/12632/hololens-fit-your-hololens).
+
+> [!NOTE]
+>  
+> - The first time that you use your HoloLens, [Cortana](hololens-cortana.md) is already on and ready to guide you (though she won't be able to respond to your questions until after you set up your device). You can turn Cortana off at any time in Cortana's settings.
+> - In order to switch to the Chinese or Japanese version of HoloLens, you’ll need to download the build for the language on a PC and then install it on your HoloLens. For more information, see [Install localized versions of HoloLens (1st gen)](hololens1-install-localized.md).
+
+## Start your Hololens and set up Windows
+
+The first time you start your HoloLens, your first task is to set up Windows Holographic on your device.
+
+1. Connect to the internet (HoloLens guides you to select Wi-Fi network).
+
+1. Sign in to your user account. Choose between **My work or school owns it** and **I own it**.
+    - When you choose **My work or school owns it**, you sign in by using an Azure AD account. If your organization uses Azure AD Premium and has configured automatic MDM enrollment, HoloLens automatically enrolls in MDM. If your organization does not use Azure AD Premium, automatic MDM enrollment isn't available, so you will need to [manually enroll HoloLens in device management](hololens-enroll-mdm.md#enroll-through-settings-app). To sign in to your device the first time by using a work or school account, follow these steps:
+        1. Enter your organizational account information.
+        1. Accept the privacy statement.
+        1. Sign in by using your Azure AD credentials. This may redirect to your organization's sign-in page.
+        1. Continue setting up the device.
+    - When you choose **I own it**, you sign in by using a Microsoft account. After setup is complete, you can [manually enroll HoloLens in device management](hololens-enroll-mdm.md#enroll-through-settings-app).
+        1. Enter your Microsoft account information.
+        1. Enter your password. If your Microsoft account requires [two-step verification (2FA)](https://blogs.technet.microsoft.com/microsoft_blog/2013/04/17/microsoft-account-gets-more-secure/), complete the verification process.
+
+1. The device sets your time zone based on information that it obtains from the Wi-Fi network.
+
+## Calibration
+
+After Cortana introduces herself, the next setup step is calibration. For the best HoloLens experience, you should complete the calibration process during setup.
+
+HoloLens (1st gen) uses the distance between your pupils (IPD or [interpupillary distance](https://en.wikipedia.org/wiki/Interpupillary_distance)) to make holograms clear and easy to interact with. If the IPD is not correct, holograms may appear to be unstable or at an incorrect distance.
+
+During calibration, HoloLens asks you to align your finger with a series of six targets per eye. HoloLens uses this process to set the correct IPD for your eyes. If the calibration needs to be updated or adjusted for a new user, the new user can run the Calibration app  outside of setup.
+
+![IPD finger-alignment screen at second step](./images/ipd-finger-alignment-300px.jpg)
+
+*IPD finger-alignment screen at second step*
+
+Congratulations! Setup is complete and you can begin using HoloLens.
+
+## Next steps
+
+> [!div class="nextstepaction"]
+> [Get started with HoloLens (1st gen)](hololens1-basic-usage.md)
diff --git a/devices/hololens/hololens1-upgrade-enterprise.md b/devices/hololens/hololens1-upgrade-enterprise.md
new file mode 100644
index 0000000000..5e535af10d
--- /dev/null
+++ b/devices/hololens/hololens1-upgrade-enterprise.md
@@ -0,0 +1,91 @@
+---
+title: Unlock Windows Holographic for Business features
+description: When you upgrade to Windows Holographic for Business, HoloLens provides extra features that are designed for business.
+ms.prod: hololens
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.localizationpriority: medium
+ms.date: 9/16/2019
+ms.reviewer: 
+manager: jarrettr
+appliesto:
+- HoloLens (1st gen)
+---
+
+# Unlock Windows Holographic for Business features
+
+Microsoft HoloLens is available in the *Development Edition*, which runs Windows Holographic (an edition of Windows 10 that is designed for HoloLens), and in the [Commercial Suite](hololens-commercial-features.md), which provides extra features designed for business.
+
+When you purchase the Commercial Suite, you receive a license that upgrades Windows Holographic to Windows Holographic for Business. You can apply this license to the device either by using the organization's [mobile device management (MDM) provider](#edition-upgrade-by-using-mdm) or a [provisioning package](#edition-upgrade-by-using-a-provisioning-package).
+
+> [!TIP]
+> In Windows 10, version 1803, you can check that the HoloLens has been upgraded to the business edition by selecting **Settings** > **System**.
+
+## Edition upgrade by using MDM
+
+The enterprise license can be applied by any MDM provider that supports the [WindowsLicensing configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn904983.aspx). The latest version of the Microsoft MDM API will support WindowsLicensing CSP.
+
+For step-by-step instructions for upgrading HoloLens by using Microsoft Intune, see [Upgrade devices running Windows Holographic to Windows Holographic for Business](https://docs.microsoft.com/intune/holographic-upgrade).
+
+ On other MDM providers, the specific steps for setting up and deploying the policy might vary.
+
+## Edition upgrade by using a provisioning package
+
+Provisioning packages are files created by the Windows Configuration Designer tool that apply a specified configuration to a device.
+
+### Create a provisioning package that upgrades the Windows Holographic edition
+
+1. [Create a provisioning package for HoloLens.](hololens-provisioning.md)
+1. Go to **Runtime settings** > **EditionUpgrade**, and select **EditionUpgradeWithLicense**.
+
+    ![Upgrade edition with license setting selected](images/icd1.png)
+
+1. Find the XML license file that was provided when you purchased the Commercial Suite.
+
+    > [!NOTE]
+    > You can configure [additional settings in the provisioning package](hololens-provisioning.md).
+
+1. On the **File** menu, select **Save**. 
+
+1. Read the warning that project files may contain sensitive information and click **OK**.
+
+    > [!IMPORTANT]
+    > When you build a provisioning package, you may include sensitive information in the project files and provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when no longer needed.
+
+1. On the **Export** menu, select **Provisioning package**.
+
+1. Change **Owner** to **IT Admin**, which sets the precedence of this provisioning package to be higher than others applied to this device from different sources, and then select **Next**.
+
+1. Set a value for **Package Version**.
+
+    > [!TIP]
+    > You can make changes to existing packages and change the version number to update previously applied packages.
+
+1. On **Select security details for the provisioning package**, select **Next**.
+
+1. Select **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.
+
+    Optionally, you can select **Browse** to change the default output location.
+
+1. Select **Next**.
+
+1. Select **Build** to start building the package. The build page displays the project information, and the progress bar indicates the build status.
+
+1. When the build completes, select **Finish**.
+
+### Apply the provisioning package to HoloLens
+
+1. Using the USB cable, connect the device to a PC. Start the device, but do not continue past the **fit** page of the initial setup experience (the first page with the blue box). On the PC, HoloLens shows up as a device in File Explorer.
+
+    > [!NOTE]
+    > If the HoloLens device is running Windows 10, version 1607 or earlier, open File Explorer by briefly pressing and releasing the **Volume Down** and **Power** buttons simultaneously on the device.
+
+1. In File Explorer, drag and drop the provisioning package (.ppkg) onto the device storage.
+
+1. While HoloLens is still on the **fit** page, briefly press and release the **Volume Down** and **Power** buttons simultaneously again.
+
+1. HoloLens asks you if you trust the package and would like to apply it. Confirm that you trust the package.
+
+1. You will see whether the package was applied successfully or not. If it was not applied successfully, you can fix your package and try again. If successful, proceed with device setup.
diff --git a/devices/hololens/hololens2-basic-usage.md b/devices/hololens/hololens2-basic-usage.md
new file mode 100644
index 0000000000..59426de18e
--- /dev/null
+++ b/devices/hololens/hololens2-basic-usage.md
@@ -0,0 +1,192 @@
+---
+title: Getting around HoloLens 2
+description: A guide to using HoloLens 2 with your hands
+ms.assetid: 5f791a5c-bdb2-4c5d-bf46-4a198de68f21
+ms.date: 9/17/2019
+keywords: hololens
+ms.prod: hololens
+ms.sitesec: library
+author: scooley
+ms.author: scooley
+ms.topic: article
+ms.localizationpriority: high
+appliesto:
+- HoloLens 2
+---
+
+# Getting around HoloLens 2
+
+Ready to explore the world of holograms?
+
+This guide provides an intro to:
+
+- Interacting with mixed reality
+- Using your hands and voice for interacting with holograms on HoloLens 2
+- Navigating Windows 10 on HoloLens (Windows Holographic)
+
+## Discover mixed reality
+
+On HoloLens, holograms blend the digital world with your physical environment to look and sound like they're part of your world. Even when holograms are all around you, you can always see your surroundings, move freely, and interact with people and objects. We call this experience "mixed reality".
+
+The holographic frame positions your holograms where your eyes are most sensitive to detail and the see-through lenses leave your peripheral vision clear. With spatial sound, you can pinpoint a hologram by listening, even if it’s behind you. And, because HoloLens understands your physical environment, you can place holograms on and around real objects such as tables and walls.
+
+Getting around HoloLens is a lot like using your smart phone. You can use your hands to touch and manipulate holographic windows, menus, and buttons.  
+
+Once you know these basic interactions, getting around on HoloLens will be a snap.
+
+> [!TIP]
+> If you have a HoloLens near you right now, the **Tips** app provides literal hands-on tutorials for hand interactions on HoloLens.  
+> Use the start gesture to go to **Start** or say "Go to Start" and select **Tips**.
+
+## The hand-tracking frame
+
+HoloLens has sensors that can see a few feet to either side of you. When you use your hands, you'll need to keep them inside that frame, or HoloLens won't see them. However, the frame moves with you as you move around.  
+
+![Image that shows the HoloLens hand-tracking frame](./images/hololens-2-gesture-frame.png)
+
+## Touch holograms near you
+
+When a hologram is near you, bring your hand close to it and a white ring should appear on the tip of your index finger.  This is the **touch cursor** which helps you touch and interact with holograms with precision. To **select** something, simply **tap** it with the touch cursor. **Scroll** content by **swiping** on the surface of the content with your finger, just like you're using a touch screen.
+
+To **grab** a hologram near you, pinch your **thumb** and **index finger** together on the hologram and hold. To let go, release your fingers. Use this **grab gesture** to move, resize, and rotate 3D objects and app windows in mixed reality home.
+
+To bring up a **context menu**, like the ones you'll find on an app tile in the Start menu, **tap and hold** like you do on a touch screen.
+
+## Use hand ray for holograms out of reach
+
+> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3ZOum]
+
+When there are no holograms near your hands, the **touch cursor** will hide automatically and **hand rays** will appear from the palm of your hands. Hand rays allow you to interact with holograms from a distance.
+
+> [!TIP]
+> If you find hand rays distracting, you can hide them by saying “Hide hand rays”. To make them reappear, say "Show hand rays."
+
+### Select using air tap
+
+To select something using **hand ray**, follow these steps:
+
+1. Use a hand ray from your palm to target the item. You don't need to raise your entire arm, you can keep your elbow low and comfortable.
+1. Point your index finger straight up toward the ceiling.
+1. To perform the **air tap** gesture, pinch your thumb and index finger together and then quickly release them.
+
+   ![Air-tap gesture animation](./images/hololens-air-tap.gif)
+
+### Grab using air tap and hold
+
+> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3Wxnh]
+
+To grab a hologram or scroll app window content using **hand ray**, start with an **air tap**, but keep your fingers together instead of releasing them.
+
+Use **air tap and hold** to perform the following actions with hand ray:
+
+- **Scroll**. To scroll app window content, air tap and hold on the content and then move your hand ray up and down or side to side.
+- **Grab**. To grab an app window or hologram, target the app title bar or hologram with your hand ray and then air tap and hold.
+- **Open context menus**. To open context menus, air tap and hold with your hand ray.
+
+## Start gesture
+
+> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3Wxng]
+
+The Start gesture opens the **Start menu**.  To perform the Start gesture, hold out your hand with your palm facing you. You’ll see a **Start icon** appear over your inner wrist. Tap this icon using your other hand.  The Start menu will open **where you’re looking**.
+
+> [!TIP]
+>
+> - You can use the Start gesture as long as your hands are inside the hand-tracking frame.  You do not need to be looking down at the Start icon. Keep your elbow low and comfortable, and look in the direction where you want the Start menu to open.
+> - If the Start menu didn't open at the position you want, simply move your head around to reposition it.
+> - If you have trouble reading the smaller text on the Start menu, step closer to it after it opens.
+> - If your hand is slightly off to the side of the frame, you may still be able to view the Start menu by tapping your inner wrist, even if you don't see the icon.
+
+![Image that shows the Start icon and the Start gesture](./images/hololens-2-start-gesture.png)
+
+To **close** the Start menu, do the Start gesture when the Start menu is open.  You can also look at the Start menu and say "Close".
+
+### One-handed Start gesture
+
+> [!IMPORTANT]
+> For the one-handed Start gesture to work:
+>
+> 1. You must update to the November 2019 update (build 18363.1039) or later.
+> 1. Your eyes must be calibrated on the device so that eye tracking functions correctly. If you do not see orbiting dots around the Start icon when you look at it, your eyes are not [calibrated](https://docs.microsoft.com/hololens/hololens-calibration#calibrating-your-hololens-2) on the device.
+
+You can also perform the Start gesture with only one hand. To do this, hold out your hand with your palm facing you and look at the **Start icon** on your inner wrist. **While keeping your eye on the icon**, pinch your thumb and index finger together.
+
+![Image that shows the Start icon and the one-handed start gesture](./images/hololens-2-start-alternative.png)
+
+## Start menu, mixed reality home, and apps
+
+Ready to put all these hand interactions to the test?!
+
+You'll find your installed apps in the [Start menu](holographic-home.md) and you can find additional apps for HoloLens in the [Microsoft Store](holographic-store-apps.md).
+
+Just as Windows PC always starts its experience at the desktop, HoloLens always starts in **mixed reality home** when turned on.  Using the Start menu, you can open and place app windows, as well as app launchers and 3D content in mixed reality home. Their placements in your physical space will be remembered by HoloLens.
+
+Open the **Start menu**, then select the **Settings** app tile. An app window will open in front of you.
+
+Settings is an example of a HoloLens app that uses a 2D **app window**.  It's very similar to a Windows application on PC.
+
+Now you can open the **Start menu** again and select the **Tips** app tile. A 3D **app launcher** for the app will appear in front of you. To open the app, you need to select the **play** button on the launcher.
+
+Tips is an example of an **immersive app**. An immersive app takes you away from mixed reality home when it runs and becomes the only app you see.  To exit, you need to bring up the Start menu and select the **mixed reality home** button at the bottom.
+
+[Go here to learn more](holographic-home.md) about Start menu and mixed reality home, including info on how to use and manage apps on HoloLens 2.
+
+## Move, resize, and rotate holograms
+
+In mixed reality home you can move, resize, and rotate app windows and 3D objects using your hands, hand ray and voice commands.
+
+### Moving holograms
+
+Move a hologram or app by following these steps:
+
+1. Grab the hologram by pinching your index finger and thumb on the hologram or face your hand down and then close your fist over it.  Grab a 3D hologram anywhere inside its blue bounding box.  For an app window, grab its title bar.
+1. Without letting go, move your hand to position the hologram. When moving an app window this way, the app window automatically turns to face you as it moves, making it easier to use at its new position.  
+1. Release your fingers to place it.
+
+### Resizing holograms
+
+> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE3ZYIb]
+
+Grab and use the **resize handles** that appear on the corners of 3D holograms and app windows to resize them.
+
+For an app window, when resized this way the window content correspondingly increases in size and becomes easier to read.
+
+If you want to resize an app window so that **more content** appears in the window, use the resize handles located on the sides and bottom edges of the app window.
+
+There are two ways to resize a hologram that's further away from you. You can either grab two corners of the hologram, or use the resize controls.
+
+### Rotating holograms
+
+For 3D holograms, grab and use the rotate handles that appear on the vertical edges of the bounding box.
+
+For app windows, moving an app window will cause it to automatically rotate and face you.
+
+You can also grab a 3D hologram or app window with **both hands** (or hand ray) at once and then:
+
+- Move your hands closer together or further apart to resize the hologram.
+- Move your hands closer and further away from your body to rotate the hologram.
+
+### Follow me, stop following
+
+Holograms and app windows stay where you placed them in the world.  That's not always convenient if you need to move around and you want an application to stay visible. To ask an app to start or stop following you, select **Follow me** in the top right corner of the app window (next to the **Close** button).  An app window that is following you will also follow you into, an out of, an immersive app.
+
+## Use HoloLens with your voice
+
+You can use your voice to do most of the same things you do with hands on HoloLens, like taking a quick photo or opening an app.
+
+| To do this | Say this |
+| - | - |
+| Open the Start menu | "Go to Start" |
+| Select | Say "select" to bring up the gaze cursor. Then, turn your head to position the cursor on the thing you want to select, and say “select” again. |
+| See available speech commands | "What can I say?" |
+
+ [See more voice commands and ways to use speech with HoloLens](hololens-cortana.md)
+
+## Next steps
+
+Congratulations! You're ready to use HoloLens 2!
+
+Now you can configure your HoloLens 2 to meet your specific needs.  Other things you may want to try include:
+
+- [Connecting bluetooth devices like a mouse and keyboard](hololens-connect-devices.md)
+- [Installing apps from the store](holographic-store-apps.md)
+- [Sharing your HoloLens with other people](hololens-multiple-users.md)
diff --git a/devices/hololens/hololens2-fit-comfort-faq.md b/devices/hololens/hololens2-fit-comfort-faq.md
new file mode 100644
index 0000000000..e97e03f502
--- /dev/null
+++ b/devices/hololens/hololens2-fit-comfort-faq.md
@@ -0,0 +1,69 @@
+---
+title: HoloLens 2 fit and comfort FAQ
+description: Answers to frequently asked questions about how to fit your HoloLens 2.
+ms.prod: hololens
+ms.sitesec: library
+author: Teresa-Motiv
+ms.author: v-tea
+ms.topic: article
+audience: ItPro
+ms.localizationpriority: high
+ms.date: 11/07/2019
+ms.reviewer: jarrettr
+manager: jarrettr
+appliesto:
+- HoloLens 2
+---
+
+# HoloLens 2 fit and comfort frequently asked questions
+
+Here are some tips on how to stay comfortable and have the best experience using your HoloLens.
+
+For step-by-step instructions and a video about putting on and adjusting your device, see [Get your HoloLens 2 ready to use](hololens2-setup.md).
+
+> [!NOTE]
+> The fit and comfort tips in this topic are meant only as general guidance—they don't replace any laws or regulations, or your good judgment when using HoloLens. Stay safe, and have fun!
+
+Here are some tips on how to stay comfortable and have the best experience using your HoloLens.
+
+## I'm experiencing discomfort when I use my device. What should I do?
+
+If you experience discomfort, take a break until you feel better. Try sitting in a well-lit room and relaxing for a bit. The next time your use your HoloLens, try using it for a shorter period of time at first.
+
+For more information, see [Health and safety on HoloLens](https://go.microsoft.com/fwlink/p/?LinkId=746661).
+
+## I can't see the whole holographic frame, or my holograms are cut off
+
+To see the top edge of the holographic frame, move the device so it sits higher on your head, or angle the headband up slightly in front. To see the bottom edge, move the device to sit lower on your head, or angle the headband down slightly in front. If the left or right edge of the view frame isn't visible, make sure the HoloLens visor is centered on your forehead.
+
+## I need to look up or down to see holograms
+
+Try adjusting the position of your device visor so the holographic frame matches your natural gaze. Here's how:
+
+- **If you need to look up to see holograms**. First, shift the back of the headband a bit higher on your head. Then use one hand to hold the headband in place and the other to gently rotate the visor so you have a good view of the holographic frame.
+- **If you need to look down to see holograms**. First, shift the back of the headband a bit lower on your head. Then place your thumbs under the device arms and your index fingers on top of the headband, and gently squeeze with your thumbs to rotate the visor so you have a good view of the holographic frame.
+
+## Hologram image color or brightness does not look right
+
+For HoloLens 2, take the following steps to ensure the highest visual quality of holograms presented in displays:
+
+- **Increase brightness of the display.** Holograms look best when the display is at its brightest level.
+- **Bring visor closer to your eyes.** Swing the visor down to the closest position to your eyes.
+- **Shift visor down.** Try moving the brow pad on your forehead down, which will result in the visor moving down closer to your nose.
+- **Run eye calibration.** The display uses your IPD and eye gaze to optimize images on the display. If you don't run eye calibration, the image quality may be made worse.
+
+## The device slides down when I'm using it, or I need to make the headband too tight to keep it secure
+
+The overhead strap can help keep your HoloLens secure on your head, particularly if you're moving around a lot. The strap may also let you loosen the headband a bit. [Learn how to use it](hololens2-setup.md#adjust-fit).
+
+You can also experiment with the positioning of the headband—depending on your head size and shape, you may need to slide it up or down to reposition it on your forehead.
+
+## How can I adjust HoloLens to fit with my glasses?
+
+To accommodate eyewear, you can tilt the visor.
+
+## My arm gets tired when I use gestures. What can I do?
+
+When using gestures, there's no need to extend your arm out far from your body. Keep it closer to your side, where it's more comfortable and will get less tired. You can also use hand rays to interact with holograms without raising your arms [Learn more about gestures and hand rays](hololens2-basic-usage.md#the-hand-tracking-frame).
+
+And be sure to try out [voice commands](hololens-cortana.md).
diff --git a/devices/hololens/hololens2-hardware.md b/devices/hololens/hololens2-hardware.md
new file mode 100644
index 0000000000..ca62dbf852
--- /dev/null
+++ b/devices/hololens/hololens2-hardware.md
@@ -0,0 +1,162 @@
+---
+title: HoloLens 2 hardware
+description: An outline of the components that make up Microsoft HoloLens 2, the latest evolution of Microsoft's fully untethered holographic computer running Windows 10.
+ms.assetid: 651d0430-bfbc-4685-a4fd-db7c33ce9325
+ms.date: 9/17/2019
+keywords: hololens
+ms.prod: hololens
+ms.sitesec: library
+author: scooley
+ms.author: scooley
+ms.topic: article
+ms.localizationpriority: high
+appliesto:
+- HoloLens 2
+---
+
+# HoloLens 2 hardware
+
+![HoloLens 2 side view](images/hololens2-exploded-medium.png)
+
+Microsoft HoloLens 2 is an untethered holographic computer.  It refines the holographic computing journey started by HoloLens (1st gen) to provide a more comfortable and immersive experience paired with more options for collaborating in mixed reality.
+
+## HoloLens components
+
+- **Visor**. Contains the HoloLens sensors and displays. You can rotate the visor up while wearing the HoloLens.
+- **Headband**. To put the HoloLens on, use the adjustment wheel to expand the headband. With the HoloLens in place, tighten the adjustment wheel by turning to the right, until the headband is comfortable.
+- **Brightness buttons**. When wearing the HoloLens, the brightness buttons are on the left side of the device.
+- **Volume buttons**. When wearing the HoloLens, the volume buttons are on the right side of the device.
+
+## In the box
+
+- **Brow pad**. You can remove and replace the brow pad, as needed.
+- **Overhead strap**. When you're wearing the HoloLens while moving around, use the overhead strap to help keep the device in place. When wearing the HoloLens for extended periods, the overhead strap may make the device more comfortable to wear.
+- **USB-C cable**. Use the USB-C cable to connect your HoloLens to the power supply for charging, or to connect your HoloLens to your computer.
+- **Power supply**. Plugs into a power outlet.
+- **Microfiber cloth**. Use to clean your HoloLens visor.
+
+### Power Supply details
+
+The power supply and the USB cable that come with the device are the best supported mechanism for charging. The power supply is an 18W charger.  It's supplies 9V at 2A.
+
+Charging rate and speed may vary depending on the environment in which the device is running.
+
+In order to maintain/advance Internal Battery Charge Percentage while the device is on, it must be connected minimum to a 15W charger.
+
+## Device specifications
+
+### Display
+
+|   |   |
+| - | - |
+| Optics | See-through holographic lenses (waveguides) |
+| Holographic resolution | 2k 3:2 light engines |
+| Holographic density | >2.5k radiants (light points per radian) |
+| Eye-based rendering | Display optimization for 3D eye position |
+
+### Sensors
+
+|   |   |
+| - | - |
+| Head tracking | 4 visible light cameras |
+| Eye tracking | 2 Infrared (IR) cameras |
+| Depth | 1-MP Time-of-Flight depth sensor |
+| Inertial measurement unit (IMU) | Accelerometer, gyroscope, magnetometer |
+| Camera | 8-MP stills, 1080p30 video |
+
+### Audio and speech
+
+|   |   |
+| - | - |
+| Microphone array | 5 channels |
+| Speakers | Built-in spatial sound |
+
+### Compute and connectivity
+
+|   |   |
+| - | - |
+| System on chip | Qualcomm Snapdragon 850 Compute Platform [details](https://www.qualcomm.com/products/snapdragon-850-mobile-compute-platform) |
+| Holographic processing unit | Second-generation custom-built holographic processing unit |
+| Memory | 4-GB LPDDR4x system DRAM |
+| Storage | 64-GB UFS 2.1 |
+| WiFi | 802.11ac 2x2 |
+| Bluetooth | 5.0 |
+| USB | USB Type-C |
+
+### Power
+
+|   |   |
+| - | - |
+| Battery Life | 2-3 hours of active use. Up to 2 weeks of standby time. |
+| Battery technology | [Lithium batteries](https://www.microsoft.com/download/details.aspx?id=43388) |
+| Charging behavior | Fully functional when charging |
+| Cooling type | Passively cooled (no fans) |
+| Power draw | In order to maintain/advance Internal Battery Charge Percentage while the device is on, it must be connected minimum to a 15W charger. |
+
+### Fit
+
+|   |   |
+| - | - |
+| Sizing | Single size with adjustable band.  Fits over eyeglasses |
+| Weight | 566 grams |
+
+## Device capabilities
+
+### Human understanding
+
+|   |   |
+| - | - |
+| Hand tracking | Two-handed fully articulated model, direct manipulation |
+| Eye tracking | Real-time tracking |
+| Voice | Command and control on-device; Cortana natural language with internet connectivity |
+
+### Environment understanding
+
+|   |   |
+| - | - |
+| Six Degrees of Freedom (6DoF) tracking | World-scale positional tracking |
+| Spatial mapping | Real-time environment mesh |
+| Mixed reality capture | Mixed hologram and physical environment photos and videos |
+
+## Pre-installed software
+
+- Windows Holographic Operating System
+- Microsoft Edge
+- Dynamics 365 Remote Assist
+- Dynamics 365 Layout
+- Dynamics 365 Guides
+- 3D Viewer
+- OneDrive for Business
+- HoloLens Tips
+- Cortana
+
+## Device certifications
+
+### Safety
+
+HoloLens 2 has been tested and conforms to the basic impact protection requirements of ANSI Z87.1, CSA Z94.3 and EN 166.
+
+## Care and cleaning
+
+Handle your HoloLens carefully. Use the headband to lift and carry the HoloLens 2.
+
+As you would for eyeglasses or protective eye-wear, try to keep the HoloLens visor free of dust and fingerprints. When possible, avoid touching the visor. Repeated cleaning could damage the visor, so keep your device clean!
+
+Don't use any cleaners or solvents on your HoloLens, and don't submerge it in water or apply water directly to it.
+
+To clean the visor, remove any dust by using a camel or goat hair lens brush or a bulb-style lens blower. Lightly moisten the microfiber cloth with a small amount of distilled water, then use it to wipe the visor gently in a circular motion.
+
+Clean the rest of the device, including the headband and device arms, with a lint-free microfiber cloth moistened with mild soap and water. Let your HoloLens dry completely before reuse.
+
+![Image that shows how to clean the visor](images/hololens-cleaning-visor.png)
+
+### Replace the brow pad
+
+The brow pad is magnetically attached to the device. To detach it, pull gently away. To replace it, snap it back into place.
+
+![Remove or replace the brow pad](images/hololens2-remove-browpad.png)
+
+## Next step
+
+> [!div class="nextstepaction"]
+> [Set up and start your HoloLens 2](hololens2-setup.md)
diff --git a/devices/hololens/hololens2-language-support.md b/devices/hololens/hololens2-language-support.md
new file mode 100644
index 0000000000..9c56ec9d8c
--- /dev/null
+++ b/devices/hololens/hololens2-language-support.md
@@ -0,0 +1,73 @@
+---
+title: Supported languages for HoloLens 2
+description: 
+ms.prod: hololens
+ms.sitesec: library
+author: Teresa-Motiv
+ms.author: v-tea
+ms.topic: article
+ms.localizationpriority: medium
+ms.date: 9/12/2019
+audience: ITPro
+ms.reviewer: jarrettr
+manager: jarrettr
+appliesto:
+- HoloLens 2
+---
+
+# Supported languages for HoloLens 2
+
+HoloLens 2 supports the following languages, including voice commands and dictation features, keyboard layouts, and OCR recognition within apps.
+
+- Chinese Simplified (China)
+- English (Australia)
+- English (Canada)
+- English (Great Britain)
+- English (United States)
+- French (Canada)
+- French (France)
+- German (Germany)
+- Italian (Italy)
+- Japanese (Japan)
+- Spanish (Spain)
+
+HoloLens 2 is also available in the following languages. However, this support does not include speech commands or dictation features.
+
+- Chinese Traditional (Taiwan and Hong Kong)
+- Dutch (Netherlands)
+- Korean (Korea)
+
+## Changing language or keyboard
+
+The setup process configures your HoloLens for a region and language. You can change this configuration by using the **Time & language** section of **Settings**.
+
+> [!NOTE]
+> Your speech and dictation language depends on the Windows display language.
+
+## To change the Windows display language
+
+1. Go to the **Start** menu, and then select **Settings** > **Time and language** > **Language**.
+2. Select **Windows display language**, and then select a language.  
+
+If the supported language you’re looking for is not in the menu, follow these steps: 
+
+1. Under **Preferred languages** select **Add a language**. 
+2. Search for and add the language.
+3. Select the **Windows display language** menu again and choose the language you added.
+
+The Windows display language affects the following settings for Windows and for apps that support localization:
+
+- The user interface text language.
+- The speech language.
+- The default layout of the on-screen keyboard.
+
+## To change the keyboard layout
+
+To add or remove a keyboard layout, open the **Start** menu and then select **Settings** > **Time & language** > **Keyboard**.
+
+If your HoloLens has more than one keyboard layout, use the **Layout** key to switch between them. The **Layout** key is in the lower right corner of the on-screen keyboard.
+
+> [!NOTE]
+> The on-screen keyboard can use Input Method Editor (IME) to enter characters in languages such as Chinese. However, HoloLens does not support external Bluetooth keyboards that use IME.
+> 
+> While you use IME with the on-screen keyboard, you can continue to use a Bluetooth keyboard to type in English. To switch between keyboards, press ~.
diff --git a/devices/hololens/hololens2-setup.md b/devices/hololens/hololens2-setup.md
new file mode 100644
index 0000000000..79189a7cf6
--- /dev/null
+++ b/devices/hololens/hololens2-setup.md
@@ -0,0 +1,120 @@
+---
+title: Prepare a new HoloLens 2
+description: This guide walks through first time set up and hardware guide.
+keywords: hololens, lights, fit, comfort, parts
+ms.assetid: 02692dcf-aa22-4d1e-bd00-f89f51048e32
+ms.date: 9/17/2019
+keywords: hololens
+ms.prod: hololens
+ms.sitesec: library
+author: scooley
+ms.author: scooley
+ms.topic: article
+ms.localizationpriority: high
+appliesto:
+- HoloLens 2
+---
+
+# Get your HoloLens 2 ready to use
+
+The procedures below will help you set up a HoloLens 2 for the first time.
+
+## Charge your HoloLens
+
+Connect the power supply to the charging port by using the USB-C cable (included). Plug the power supply into a power outlet. The power supply and USB-C-to-C cable that come with the device are the best way to charge your HoloLens 2. The charger supplies 18W of power (9V at 2A).
+
+Charging rate and speed may vary depending on the environment in which the device is running.
+
+- When the device is charging, the battery indicator lights up to indicate the current level of charge.  The last light will fade in and out to indicate active charging.
+- When your HoloLens is on, the battery indicator displays the battery level in increments.
+- When only one of the five lights is on, the battery level is below 20 percent.
+- If the battery level is critically low and you try to turn on the device, one light will blink briefly, then go out.
+
+## Adjust fit
+
+Place the HoloLens 2 on your head. If you wear eyeglasses, leave them on.  The brow pad should sit comfortably on your forehead and the back band should sit in the middle-back of your head.
+
+If necessary, extend the headband by turning the adjustment wheel, and then loosen the overhead strap.
+
+![HoloLens 2 fit and adjustments](images/hololens2-fit.png)
+
+### Attach and detach the overhead strap
+
+The overhead strap isn't required, but it can make wearing HoloLens 2 more comfortable during long periods of use.
+
+To detach the front of the overhead strap, unhook the strap and slide it through the retractable loop on the brow pad. To reattach it, pull out the loop and slide the strap back through.
+
+To detach the back of the overhead strap, press the button below each connection tab and pull gently. To reattach it, push the connection tabs back into the slots until they click.
+
+![attach or remove the HoloLens 2 head strap](images/hololens2-headstrap.png)
+
+## Turn on the HoloLens 2
+
+To turn on your HoloLens 2, press the Power button.  The LED lights below the Power button display the battery level.
+
+> [!NOTE]
+> To power on HoloLens 2 for the very first time, after unboxing, press and hold the power button for at least 4 seconds to turn it on. Next time you power on HoloLens 2, it’ll start after a short power button press.
+
+### Power button actions for different power transitions
+
+| To do this | Perform this action | The HoloLens 2 will do this |
+| - | - | - |
+| To turn on | Single button press. | All five lights turn on, then change to indicate the battery level. After four seconds, a sound plays. |
+| To sleep | Single button press. | All five lights turn on, then fade off one at a time. After the lights turn off, a sound plays and the screen displays "Goodbye." |
+| To wake from sleep | Single button press. | All five lights turn on, then change to indicate the battery level. A sound immediately plays. |
+| To turn off | Press and hold for 5s. |  All five lights turn on, then fade off one at a time. After the lights turn off, a sound plays and the screen displays "Goodbye." |
+| To force the Hololens to restart if it is unresponsive | Press and hold for 10s. | All five lights turn on, then fade off one at a time. After the lights turn off. |
+
+## HoloLens behavior reference
+
+Not sure what the indicator lights on your HoloLens mean? Want to know how HoloLens should behave while charging?  Here's some help!
+
+### Charging behavior
+
+| State of the Device | Action | HoloLens 2 will do this |
+| - | - | - |
+| OFF | Plug in USB Cable | Device transitions to ON with indicator lights showing battery level and device starts charging.
+| ON | Remove USB Cable | Device stops charging
+| ON | Plug in USB Cable | Device starts charging
+| SLEEP | Plug in USB Cable | Device starts charging
+| SLEEP | Remove USB Cable | Device stops charging
+| ON with USB cable plugged in | Turn off Device | Device transitions to ON with indicator lights showing battery level and device will start charging |
+
+### Lights that indicate the battery level
+
+| Number of lights | Battery level |
+| - | - |
+| Four solid lights, one light fading in and out | Between 100% and 81% (fully charged) |
+| Three solid lights, one light fading in and out | Between 80% and 61% |
+| Two solid lights, one light fading in and out | Between 60% and 41% |
+| One solid light, one light fading in and out | Between 40% and 21% |
+| One light fading in and out | Between 20% and 5% or lower (critical battery) |
+
+### Sleep Behavior
+
+| State of the Device | Action | HoloLens 2 will do this |
+| - | - | - |
+| ON | Single Power button press | Device transitions to SLEEP and turns off all indicator lights |
+| ON | No movement for 3 minutes | Device transition to SLEEP and turns off all indicator lights |
+| SLEEP | Single Power button Press | Device transitions to ON and turns on indicator lights |
+
+### Lights to indicate problems
+
+| When you do this | The lights do this | It means this |
+| - | - | - |
+| You press the Power button. | One light flashes five times, then turns off. | The HoloLens battery is critically low. Charge your HoloLens. |
+| You press the Power button. | All five lights flash five times, then turn off. |  HoloLens cannot start correctly and is in an error state. [Reinstall the operating system](hololens-recovery.md) to recover your device. |
+| You press the Power button. | The 1st, 3rd, and 5th lights flash together continually. |  HoloLens may have a hardware failure. To be sure, [reinstall the OS](hololens-recovery.md#hololens-2), and try again. After reinstalling the OS, if the light-flash pattern persists, contact [support](https://support.microsoft.com/en-us/supportforbusiness/productselection?sapid=3ec35c62-022f-466b-3a1e-dbbb7b9a55fb). |
+
+## Safety and comfort
+
+### Use HoloLens in safe surroundings
+
+Use your HoloLens in a safe space, free of obstructions and tripping hazards. Don’t use it when you need a clear field of view or can't commit your full attention, such as while you’re operating a vehicle or doing other potentially hazardous activities.
+
+### Stay comfortable
+
+Keep your first few sessions with HoloLens brief and be sure to take breaks. If you experience discomfort, stop and rest until you feel better. This might include temporary feelings of nausea, motion sickness, dizziness, disorientation, headache, fatigue, eye strain, or dry eyes.
+
+> [!div class="nextstepaction"]
+> [Start and configure your HoloLens 2](hololens2-start.md)
diff --git a/devices/hololens/hololens2-start.md b/devices/hololens/hololens2-start.md
new file mode 100644
index 0000000000..78d3697f03
--- /dev/null
+++ b/devices/hololens/hololens2-start.md
@@ -0,0 +1,93 @@
+---
+title: Set up your HoloLens 2
+description: This guide walks through first time set up.  You'll need a Wi-Fi network and either a Microsoft (MSA) or Azure Active Directory (AAD) account.
+ms.assetid: 507305f4-e85a-47c5-a055-a3400ae8a10e
+ms.date: 9/17/2019
+keywords: hololens
+ms.prod: hololens
+ms.sitesec: library
+author: scooley
+ms.author: scooley
+ms.topic: article
+ms.localizationpriority: high
+appliesto:
+- HoloLens 2
+---
+
+# Set up your HoloLens 2
+
+The first time you turn on your HoloLens, you'll be guided through setting up your device, signing in with a user account, and calibrating the HoloLens to your eyes.  This section walks through the HoloLens 2 initial setup experience.
+
+In the next section, you'll learn how to work with HoloLens and interact with holograms. To skip ahead to that article, see [Get started with HoloLens 2](hololens2-basic-usage.md).
+
+## Before you start
+
+Before you get started, make sure you have the following available:
+
+**A network connection**. You'll need to connect your HoloLens to a network to set it up. With HoloLens 2, you can connect with Wi-Fi or by using ethernet (you'll need a USB-C-to-Ethernet adapter). The first time you connect, you'll need an open or password-protected network that doesn't require navigating to a website or using certificates to connect. [Learn more about the websites that HoloLens uses](hololens-offline.md).
+
+**A Microsoft account**. You'll also need to sign in to HoloLens with a Microsoft account (or with your work account, if your organization owns the device). If you don't have a Microsoft account, go to [account.microsoft.com](https://account.microsoft.com) and set one up for free.
+
+**A safe, well-lit space with no tripping hazards**. [Health and safety info](https://go.microsoft.com/fwlink/p/?LinkId=746661).
+
+**The optional comfort accessories** that came with your HoloLens, to help you get the most comfortable fit. [More on fit and comfort](hololens2-setup.md#adjust-fit).
+
+## Set up Windows
+
+The first time you start your HoloLens 2, your first task is to set up Windows Holographic.  When you start your HoloLens, you will hear music and see a Windows logo.
+
+![First screen during first boot](images/01-magic-moment.png)
+
+HoloLens 2 will walk you through the following steps:
+
+1. Select your language.
+    ![Select language](images/04-language.png)
+
+1. Select your region.
+    ![Select region](images/05-region.png)
+
+1. Calibrate HoloLens to your eyes.  If you choose to skip calibration, you'll be prompted the next time you log in.
+
+    To calibrate, you'll look at a set of targets (referred to as gems). It's fine if you blink or close your eyes during calibration, but try not to stare at other objects in the room or physical space. HoloLens uses this process to learn about your eye position so that it can better render your holographic world. After calibration, holograms will appear correctly even as the visor shifts on your head.
+
+    Calibration information is stored locally on the device and is not associated with any account information. For more information, see [Calibration data and security](hololens-calibration.md#calibration-data-and-security).
+
+    ![Calibration selection screen](images/06-et-corners.png)
+
+1. Connect to the internet (select Wi-Fi or your ethernet connection).
+     HoloLens sets your time zone automatically based on information obtained from the Wi-Fi network. After setup finishes, you can change the time zone by using the Settings app.
+
+    ![Connect to Wi-Fi](images/11-network.png)
+> [!NOTE] 
+> If you progress past the Wi-Fi step and later need to switch to a different network while still in setup, you can press the **Volume Down** and **Power** buttons simultaneously to return to this step if you are running an OS version from October 2019 or later. For earlier versions, you may need to [reset the device](hololens-recovery.md) or restart it in a location where the Wi-Fi network is not available to prevent it from automatically connecting.
+> 
+> Also note that during HoloLens Setup, there is a credential timeout of two minutes. The username/password needs to be entered within two minutes otherwise the username field will be automatically cleared.
+
+1. Sign in to your user account. You'll choose between **My work or school owns it** and **I own it**.
+    - When you choose **My work or school owns it**, you sign in with an Azure AD account. If your organization uses Azure AD Premium and has configured automatic MDM enrollment, HoloLens automatically enrolls in MDM. If your organization does not use Azure AD Premium, automatic MDM enrollment isn't available. In that case, you need to [manually enroll HoloLens in device management](hololens-enroll-mdm.md#enroll-through-settings-app).
+        1. Enter your organizational account information.
+        1. Accept the privacy statement and the end user license agreement.
+        1. Sign in by using your Azure AD credentials. This may redirect to your organization's sign-in page.
+        1. Continue setting up the device.
+    - When you choose **I own it**, you sign in with a Microsoft account. After setup is complete, you can [manually enroll HoloLens in device management](hololens-enroll-mdm.md#enroll-through-settings-app).
+        1. Enter your Microsoft account information.
+        2. Enter your password. If your Microsoft account requires [two-step verification (2FA)](https://blogs.technet.microsoft.com/microsoft_blog/2013/04/17/microsoft-account-gets-more-secure/), complete the verification process.
+
+    ![Set user](images/13-device-owner.png)
+
+1. Select whether to enable speech on HoloLens 2, and whether to send diagnostic telemetry.
+    ![Enable Cortana](images/22-do-more-with-voice.png)
+
+1. Select your telemetry level. If you can, please enable Full telemetry. This information really helps the HoloLens engineering team.
+     ![Telemetry level](images/24-telemetry.png)
+
+1. Learn how to use the start gesture on HoloLens 2.
+     ![Learn how to use the start gesture, image 1](images/26-01-startmenu-learning.png)
+     ![Learn how to use the start gesture, image 2](images/26-02-startmenu-learning.png)
+
+Congratulations!  Setup is complete and you're ready to use HoloLens!
+
+## Next steps
+
+> [!div class="nextstepaction"]
+> [Get started with HoloLens 2](hololens2-basic-usage.md)
diff --git a/devices/hololens/images/01-magic-moment.png b/devices/hololens/images/01-magic-moment.png
new file mode 100644
index 0000000000..0d55443b55
Binary files /dev/null and b/devices/hololens/images/01-magic-moment.png differ
diff --git a/devices/hololens/images/02-00-magic-moment.png b/devices/hololens/images/02-00-magic-moment.png
new file mode 100644
index 0000000000..ae76fb70ea
Binary files /dev/null and b/devices/hololens/images/02-00-magic-moment.png differ
diff --git a/devices/hololens/images/02-01-magic-moment-bird-intro.png b/devices/hololens/images/02-01-magic-moment-bird-intro.png
new file mode 100644
index 0000000000..ae76fb70ea
Binary files /dev/null and b/devices/hololens/images/02-01-magic-moment-bird-intro.png differ
diff --git a/devices/hololens/images/02-02-bird-palm.png b/devices/hololens/images/02-02-bird-palm.png
new file mode 100644
index 0000000000..fda1f3dcdd
Binary files /dev/null and b/devices/hololens/images/02-02-bird-palm.png differ
diff --git a/devices/hololens/images/02-03-bird-button.png b/devices/hololens/images/02-03-bird-button.png
new file mode 100644
index 0000000000..749a1ab6fc
Binary files /dev/null and b/devices/hololens/images/02-03-bird-button.png differ
diff --git a/devices/hololens/images/04-language.png b/devices/hololens/images/04-language.png
new file mode 100644
index 0000000000..1106322c29
Binary files /dev/null and b/devices/hololens/images/04-language.png differ
diff --git a/devices/hololens/images/05-region.png b/devices/hololens/images/05-region.png
new file mode 100644
index 0000000000..f350298813
Binary files /dev/null and b/devices/hololens/images/05-region.png differ
diff --git a/devices/hololens/images/06-et-corners.png b/devices/hololens/images/06-et-corners.png
new file mode 100644
index 0000000000..af48472f60
Binary files /dev/null and b/devices/hololens/images/06-et-corners.png differ
diff --git a/devices/hololens/images/07-et-adjust-for-your-eyes.png b/devices/hololens/images/07-et-adjust-for-your-eyes.png
new file mode 100644
index 0000000000..e127ba9a9d
Binary files /dev/null and b/devices/hololens/images/07-et-adjust-for-your-eyes.png differ
diff --git a/devices/hololens/images/07-et-hold-head-still.png b/devices/hololens/images/07-et-hold-head-still.png
new file mode 100644
index 0000000000..a4952767bf
Binary files /dev/null and b/devices/hololens/images/07-et-hold-head-still.png differ
diff --git a/devices/hololens/images/08-et-gems.png b/devices/hololens/images/08-et-gems.png
new file mode 100644
index 0000000000..8eaba193f0
Binary files /dev/null and b/devices/hololens/images/08-et-gems.png differ
diff --git a/devices/hololens/images/09-et-adjusting.png b/devices/hololens/images/09-et-adjusting.png
new file mode 100644
index 0000000000..038dcab588
Binary files /dev/null and b/devices/hololens/images/09-et-adjusting.png differ
diff --git a/devices/hololens/images/10-et-failure1.png b/devices/hololens/images/10-et-failure1.png
new file mode 100644
index 0000000000..249abff7f6
Binary files /dev/null and b/devices/hololens/images/10-et-failure1.png differ
diff --git a/devices/hololens/images/10-et-failure2.png b/devices/hololens/images/10-et-failure2.png
new file mode 100644
index 0000000000..f4b2f34334
Binary files /dev/null and b/devices/hololens/images/10-et-failure2.png differ
diff --git a/devices/hololens/images/10-et-success.png b/devices/hololens/images/10-et-success.png
new file mode 100644
index 0000000000..c74c89056e
Binary files /dev/null and b/devices/hololens/images/10-et-success.png differ
diff --git a/devices/hololens/images/11-network.png b/devices/hololens/images/11-network.png
new file mode 100644
index 0000000000..1fc3884721
Binary files /dev/null and b/devices/hololens/images/11-network.png differ
diff --git a/devices/hololens/images/12-agreement.png b/devices/hololens/images/12-agreement.png
new file mode 100644
index 0000000000..96695c1888
Binary files /dev/null and b/devices/hololens/images/12-agreement.png differ
diff --git a/devices/hololens/images/13-device-owner.png b/devices/hololens/images/13-device-owner.png
new file mode 100644
index 0000000000..fe66cd5386
Binary files /dev/null and b/devices/hololens/images/13-device-owner.png differ
diff --git a/devices/hololens/images/14-sign-in-msa.png b/devices/hololens/images/14-sign-in-msa.png
new file mode 100644
index 0000000000..c0e3aa4d9e
Binary files /dev/null and b/devices/hololens/images/14-sign-in-msa.png differ
diff --git a/devices/hololens/images/15-iris-enrollment.png b/devices/hololens/images/15-iris-enrollment.png
new file mode 100644
index 0000000000..6bda392726
Binary files /dev/null and b/devices/hololens/images/15-iris-enrollment.png differ
diff --git a/devices/hololens/images/16-iris-hold-head-still.png b/devices/hololens/images/16-iris-hold-head-still.png
new file mode 100644
index 0000000000..09205015c0
Binary files /dev/null and b/devices/hololens/images/16-iris-hold-head-still.png differ
diff --git a/devices/hololens/images/17-iris-dots.png b/devices/hololens/images/17-iris-dots.png
new file mode 100644
index 0000000000..2ac6119b89
Binary files /dev/null and b/devices/hololens/images/17-iris-dots.png differ
diff --git a/devices/hololens/images/18-iris-enrollment-done.png b/devices/hololens/images/18-iris-enrollment-done.png
new file mode 100644
index 0000000000..6405ab8581
Binary files /dev/null and b/devices/hololens/images/18-iris-enrollment-done.png differ
diff --git a/devices/hololens/images/19-pin-create.png b/devices/hololens/images/19-pin-create.png
new file mode 100644
index 0000000000..fd0c1ee5e8
Binary files /dev/null and b/devices/hololens/images/19-pin-create.png differ
diff --git a/devices/hololens/images/20-pin-setup.png b/devices/hololens/images/20-pin-setup.png
new file mode 100644
index 0000000000..752fc54e5c
Binary files /dev/null and b/devices/hololens/images/20-pin-setup.png differ
diff --git a/devices/hololens/images/201608-enterprisemanagement-400px.png b/devices/hololens/images/201608-enterprisemanagement-400px.png
new file mode 100644
index 0000000000..11c204f0f6
Binary files /dev/null and b/devices/hololens/images/201608-enterprisemanagement-400px.png differ
diff --git a/devices/hololens/images/201608-kioskmode-400px.png b/devices/hololens/images/201608-kioskmode-400px.png
new file mode 100644
index 0000000000..8d21453b8f
Binary files /dev/null and b/devices/hololens/images/201608-kioskmode-400px.png differ
diff --git a/devices/hololens/images/20190322-DevicePortal.png b/devices/hololens/images/20190322-DevicePortal.png
new file mode 100644
index 0000000000..7fdd2e34b3
Binary files /dev/null and b/devices/hololens/images/20190322-DevicePortal.png differ
diff --git a/devices/hololens/images/22-do-more-with-voice.png b/devices/hololens/images/22-do-more-with-voice.png
new file mode 100644
index 0000000000..2bf874c80d
Binary files /dev/null and b/devices/hololens/images/22-do-more-with-voice.png differ
diff --git a/devices/hololens/images/23-do-more-with-voice-learn.png b/devices/hololens/images/23-do-more-with-voice-learn.png
new file mode 100644
index 0000000000..b805befc49
Binary files /dev/null and b/devices/hololens/images/23-do-more-with-voice-learn.png differ
diff --git a/devices/hololens/images/24-telemetry.png b/devices/hololens/images/24-telemetry.png
new file mode 100644
index 0000000000..004d1d5dff
Binary files /dev/null and b/devices/hololens/images/24-telemetry.png differ
diff --git a/devices/hololens/images/25-telemetry-info.png b/devices/hololens/images/25-telemetry-info.png
new file mode 100644
index 0000000000..4c4075a68f
Binary files /dev/null and b/devices/hololens/images/25-telemetry-info.png differ
diff --git a/devices/hololens/images/26-01-startmenu-learning.png b/devices/hololens/images/26-01-startmenu-learning.png
new file mode 100644
index 0000000000..e24da1b854
Binary files /dev/null and b/devices/hololens/images/26-01-startmenu-learning.png differ
diff --git a/devices/hololens/images/26-02-startmenu-learning.png b/devices/hololens/images/26-02-startmenu-learning.png
new file mode 100644
index 0000000000..1a81a79178
Binary files /dev/null and b/devices/hololens/images/26-02-startmenu-learning.png differ
diff --git a/devices/hololens/images/26-03-startmenu-learning.png b/devices/hololens/images/26-03-startmenu-learning.png
new file mode 100644
index 0000000000..55d59d18f5
Binary files /dev/null and b/devices/hololens/images/26-03-startmenu-learning.png differ
diff --git a/devices/hololens/images/26-04-startmenu-learning.png b/devices/hololens/images/26-04-startmenu-learning.png
new file mode 100644
index 0000000000..b7d62f5650
Binary files /dev/null and b/devices/hololens/images/26-04-startmenu-learning.png differ
diff --git a/devices/hololens/images/B-Calibration-4-Gem.png b/devices/hololens/images/B-Calibration-4-Gem.png
new file mode 100644
index 0000000000..fbfd95cb32
Binary files /dev/null and b/devices/hololens/images/B-Calibration-4-Gem.png differ
diff --git a/devices/hololens/images/C-Settings.Calibration.png b/devices/hololens/images/C-Settings.Calibration.png
new file mode 100644
index 0000000000..d27f3d754c
Binary files /dev/null and b/devices/hololens/images/C-Settings.Calibration.png differ
diff --git a/devices/hololens/images/D-CheckThisOut-Prompt.png b/devices/hololens/images/D-CheckThisOut-Prompt.png
new file mode 100644
index 0000000000..a81a75a153
Binary files /dev/null and b/devices/hololens/images/D-CheckThisOut-Prompt.png differ
diff --git a/devices/hololens/images/FitGuideSetep5.png b/devices/hololens/images/FitGuideSetep5.png
new file mode 100644
index 0000000000..9529fe69b0
Binary files /dev/null and b/devices/hololens/images/FitGuideSetep5.png differ
diff --git a/devices/hololens/images/FitGuideStep1.png b/devices/hololens/images/FitGuideStep1.png
new file mode 100644
index 0000000000..846ef9fc0b
Binary files /dev/null and b/devices/hololens/images/FitGuideStep1.png differ
diff --git a/devices/hololens/images/FitGuideStep2.png b/devices/hololens/images/FitGuideStep2.png
new file mode 100644
index 0000000000..6ac59ff43b
Binary files /dev/null and b/devices/hololens/images/FitGuideStep2.png differ
diff --git a/devices/hololens/images/FitGuideStep3.png b/devices/hololens/images/FitGuideStep3.png
new file mode 100644
index 0000000000..e255da8f15
Binary files /dev/null and b/devices/hololens/images/FitGuideStep3.png differ
diff --git a/devices/hololens/images/FitGuideStep4.png b/devices/hololens/images/FitGuideStep4.png
new file mode 100644
index 0000000000..77e99f3d55
Binary files /dev/null and b/devices/hololens/images/FitGuideStep4.png differ
diff --git a/devices/hololens/images/HoloLens2_AppBarFollowing.gif b/devices/hololens/images/HoloLens2_AppBarFollowing.gif
new file mode 100644
index 0000000000..84d7f2589e
Binary files /dev/null and b/devices/hololens/images/HoloLens2_AppBarFollowing.gif differ
diff --git a/devices/hololens/images/HoloLens2_BoundingBox.gif b/devices/hololens/images/HoloLens2_BoundingBox.gif
new file mode 100644
index 0000000000..451bcae997
Binary files /dev/null and b/devices/hololens/images/HoloLens2_BoundingBox.gif differ
diff --git a/devices/hololens/images/HoloLens2_BoundingBox_Rotate.gif b/devices/hololens/images/HoloLens2_BoundingBox_Rotate.gif
new file mode 100644
index 0000000000..43a764a954
Binary files /dev/null and b/devices/hololens/images/HoloLens2_BoundingBox_Rotate.gif differ
diff --git a/devices/hololens/images/HoloLens2_Loader.gif b/devices/hololens/images/HoloLens2_Loader.gif
new file mode 100644
index 0000000000..81d8232494
Binary files /dev/null and b/devices/hololens/images/HoloLens2_Loader.gif differ
diff --git a/devices/hololens/images/HoloLens2_Proximity.gif b/devices/hololens/images/HoloLens2_Proximity.gif
new file mode 100644
index 0000000000..f39f326ea7
Binary files /dev/null and b/devices/hololens/images/HoloLens2_Proximity.gif differ
diff --git a/devices/hololens/images/aad-kioskmode.PNG b/devices/hololens/images/aad-kioskmode.PNG
new file mode 100644
index 0000000000..c058f25241
Binary files /dev/null and b/devices/hololens/images/aad-kioskmode.PNG differ
diff --git a/devices/hololens/images/addnewfeedback-500px.jpg b/devices/hololens/images/addnewfeedback-500px.jpg
new file mode 100644
index 0000000000..8948dd2dae
Binary files /dev/null and b/devices/hololens/images/addnewfeedback-500px.jpg differ
diff --git a/devices/hololens/images/azure-ad-image.PNG b/devices/hololens/images/azure-ad-image.PNG
new file mode 100644
index 0000000000..e0215265f6
Binary files /dev/null and b/devices/hololens/images/azure-ad-image.PNG differ
diff --git a/devices/hololens/images/calibration-livecube-200px.png b/devices/hololens/images/calibration-livecube-200px.png
new file mode 100644
index 0000000000..44b0142e40
Binary files /dev/null and b/devices/hololens/images/calibration-livecube-200px.png differ
diff --git a/devices/hololens/images/calibration-settings-500px.jpg b/devices/hololens/images/calibration-settings-500px.jpg
new file mode 100644
index 0000000000..0419f0307f
Binary files /dev/null and b/devices/hololens/images/calibration-settings-500px.jpg differ
diff --git a/devices/hololens/images/calibration-shell.png b/devices/hololens/images/calibration-shell.png
new file mode 100644
index 0000000000..f833452cc5
Binary files /dev/null and b/devices/hololens/images/calibration-shell.png differ
diff --git a/devices/hololens/images/cortana-on-hololens.png b/devices/hololens/images/cortana-on-hololens.png
new file mode 100644
index 0000000000..6205d3d2fd
Binary files /dev/null and b/devices/hololens/images/cortana-on-hololens.png differ
diff --git a/devices/hololens/images/deviceportal-appmanager.jpg b/devices/hololens/images/deviceportal-appmanager.jpg
new file mode 100644
index 0000000000..68576fcfc7
Binary files /dev/null and b/devices/hololens/images/deviceportal-appmanager.jpg differ
diff --git a/devices/hololens/images/displays-400px.jpg b/devices/hololens/images/displays-400px.jpg
new file mode 100644
index 0000000000..0ed5558bdc
Binary files /dev/null and b/devices/hololens/images/displays-400px.jpg differ
diff --git a/devices/hololens/images/feedback1-600px.png b/devices/hololens/images/feedback1-600px.png
new file mode 100644
index 0000000000..ba7cec37da
Binary files /dev/null and b/devices/hololens/images/feedback1-600px.png differ
diff --git a/devices/hololens/images/feedback2-600px.png b/devices/hololens/images/feedback2-600px.png
new file mode 100644
index 0000000000..89d44622a6
Binary files /dev/null and b/devices/hololens/images/feedback2-600px.png differ
diff --git a/devices/hololens/images/feedback3-600px.png b/devices/hololens/images/feedback3-600px.png
new file mode 100644
index 0000000000..0431687b55
Binary files /dev/null and b/devices/hololens/images/feedback3-600px.png differ
diff --git a/devices/hololens/images/feedback4-600px.png b/devices/hololens/images/feedback4-600px.png
new file mode 100644
index 0000000000..35594f2ca8
Binary files /dev/null and b/devices/hololens/images/feedback4-600px.png differ
diff --git a/devices/hololens/images/feedback5-600px.png b/devices/hololens/images/feedback5-600px.png
new file mode 100644
index 0000000000..967987d6ae
Binary files /dev/null and b/devices/hololens/images/feedback5-600px.png differ
diff --git a/devices/hololens/images/feedback6-600px.png b/devices/hololens/images/feedback6-600px.png
new file mode 100644
index 0000000000..431a4da9da
Binary files /dev/null and b/devices/hololens/images/feedback6-600px.png differ
diff --git a/devices/hololens/images/hololens-2-air-tap.gif b/devices/hololens/images/hololens-2-air-tap.gif
new file mode 100644
index 0000000000..9139718cdb
Binary files /dev/null and b/devices/hololens/images/hololens-2-air-tap.gif differ
diff --git a/devices/hololens/images/hololens-2-button-sleep.png b/devices/hololens/images/hololens-2-button-sleep.png
new file mode 100644
index 0000000000..29f75da34f
Binary files /dev/null and b/devices/hololens/images/hololens-2-button-sleep.png differ
diff --git a/devices/hololens/images/hololens-2-button-turn-off.png b/devices/hololens/images/hololens-2-button-turn-off.png
new file mode 100644
index 0000000000..8e3f4a2c72
Binary files /dev/null and b/devices/hololens/images/hololens-2-button-turn-off.png differ
diff --git a/devices/hololens/images/hololens-2-button-turn-on.png b/devices/hololens/images/hololens-2-button-turn-on.png
new file mode 100644
index 0000000000..25ce3fcc58
Binary files /dev/null and b/devices/hololens/images/hololens-2-button-turn-on.png differ
diff --git a/devices/hololens/images/hololens-2-button-wake.png b/devices/hololens/images/hololens-2-button-wake.png
new file mode 100644
index 0000000000..135b1e3a04
Binary files /dev/null and b/devices/hololens/images/hololens-2-button-wake.png differ
diff --git a/devices/hololens/images/hololens-2-gesture-frame.png b/devices/hololens/images/hololens-2-gesture-frame.png
new file mode 100644
index 0000000000..cc1a9f667d
Binary files /dev/null and b/devices/hololens/images/hololens-2-gesture-frame.png differ
diff --git a/devices/hololens/images/hololens-2-screenshot-with-callouts.png b/devices/hololens/images/hololens-2-screenshot-with-callouts.png
new file mode 100644
index 0000000000..769310e749
Binary files /dev/null and b/devices/hololens/images/hololens-2-screenshot-with-callouts.png differ
diff --git a/devices/hololens/images/hololens-2-start-alternative.png b/devices/hololens/images/hololens-2-start-alternative.png
new file mode 100644
index 0000000000..763cd8600e
Binary files /dev/null and b/devices/hololens/images/hololens-2-start-alternative.png differ
diff --git a/devices/hololens/images/hololens-2-start-gesture.png b/devices/hololens/images/hololens-2-start-gesture.png
new file mode 100644
index 0000000000..109c6235bb
Binary files /dev/null and b/devices/hololens/images/hololens-2-start-gesture.png differ
diff --git a/devices/hololens/images/hololens-air-tap.gif b/devices/hololens/images/hololens-air-tap.gif
new file mode 100644
index 0000000000..9139718cdb
Binary files /dev/null and b/devices/hololens/images/hololens-air-tap.gif differ
diff --git a/devices/hololens/images/hololens-bloom.gif b/devices/hololens/images/hololens-bloom.gif
new file mode 100644
index 0000000000..db7d8378e5
Binary files /dev/null and b/devices/hololens/images/hololens-bloom.gif differ
diff --git a/devices/hololens/images/hololens-box-contents.png b/devices/hololens/images/hololens-box-contents.png
new file mode 100644
index 0000000000..51b4b5e163
Binary files /dev/null and b/devices/hololens/images/hololens-box-contents.png differ
diff --git a/devices/hololens/images/hololens-buttons.jpg b/devices/hololens/images/hololens-buttons.jpg
new file mode 100644
index 0000000000..868487b0bf
Binary files /dev/null and b/devices/hololens/images/hololens-buttons.jpg differ
diff --git a/devices/hololens/images/hololens-charging.png b/devices/hololens/images/hololens-charging.png
new file mode 100644
index 0000000000..a5dd4d7dcd
Binary files /dev/null and b/devices/hololens/images/hololens-charging.png differ
diff --git a/devices/hololens/images/hololens-cleaning-visor.png b/devices/hololens/images/hololens-cleaning-visor.png
new file mode 100644
index 0000000000..68f990d43b
Binary files /dev/null and b/devices/hololens/images/hololens-cleaning-visor.png differ
diff --git a/devices/hololens/images/hololens-clicker-500px.jpg b/devices/hololens/images/hololens-clicker-500px.jpg
new file mode 100644
index 0000000000..4dd7d954f4
Binary files /dev/null and b/devices/hololens/images/hololens-clicker-500px.jpg differ
diff --git a/devices/hololens/images/hololens-frame.png b/devices/hololens/images/hololens-frame.png
new file mode 100644
index 0000000000..5789f1b8c8
Binary files /dev/null and b/devices/hololens/images/hololens-frame.png differ
diff --git a/devices/hololens/images/hololens-gaze.png b/devices/hololens/images/hololens-gaze.png
new file mode 100644
index 0000000000..d21ffef0b2
Binary files /dev/null and b/devices/hololens/images/hololens-gaze.png differ
diff --git a/devices/hololens/images/hololens-lights.png b/devices/hololens/images/hololens-lights.png
new file mode 100644
index 0000000000..f3a19b84a3
Binary files /dev/null and b/devices/hololens/images/hololens-lights.png differ
diff --git a/devices/hololens/images/hololens-power.png b/devices/hololens/images/hololens-power.png
new file mode 100644
index 0000000000..80c3e7c215
Binary files /dev/null and b/devices/hololens/images/hololens-power.png differ
diff --git a/devices/hololens/images/hololens-vector-white.png b/devices/hololens/images/hololens-vector-white.png
new file mode 100644
index 0000000000..583a307449
Binary files /dev/null and b/devices/hololens/images/hololens-vector-white.png differ
diff --git a/devices/hololens/images/hololens2-exploded-large.png b/devices/hololens/images/hololens2-exploded-large.png
new file mode 100644
index 0000000000..fc639a0f62
Binary files /dev/null and b/devices/hololens/images/hololens2-exploded-large.png differ
diff --git a/devices/hololens/images/hololens2-exploded-medium.png b/devices/hololens/images/hololens2-exploded-medium.png
new file mode 100644
index 0000000000..3e1fbea7de
Binary files /dev/null and b/devices/hololens/images/hololens2-exploded-medium.png differ
diff --git a/devices/hololens/images/hololens2-fit.png b/devices/hololens/images/hololens2-fit.png
new file mode 100644
index 0000000000..dacaf4cbd7
Binary files /dev/null and b/devices/hololens/images/hololens2-fit.png differ
diff --git a/devices/hololens/images/hololens2-headstrap.png b/devices/hololens/images/hololens2-headstrap.png
new file mode 100644
index 0000000000..805637214b
Binary files /dev/null and b/devices/hololens/images/hololens2-headstrap.png differ
diff --git a/devices/hololens/images/hololens2-lift-visor.png b/devices/hololens/images/hololens2-lift-visor.png
new file mode 100644
index 0000000000..4d83f2c730
Binary files /dev/null and b/devices/hololens/images/hololens2-lift-visor.png differ
diff --git a/devices/hololens/images/hololens2-remove-browpad.png b/devices/hololens/images/hololens2-remove-browpad.png
new file mode 100644
index 0000000000..619f14e4fd
Binary files /dev/null and b/devices/hololens/images/hololens2-remove-browpad.png differ
diff --git a/devices/hololens/images/hololens2-side-render-medium.png b/devices/hololens/images/hololens2-side-render-medium.png
new file mode 100644
index 0000000000..d4650c05e2
Binary files /dev/null and b/devices/hololens/images/hololens2-side-render-medium.png differ
diff --git a/devices/hololens/images/hololens2-side-render-small.png b/devices/hololens/images/hololens2-side-render-small.png
new file mode 100644
index 0000000000..a1a612e05a
Binary files /dev/null and b/devices/hololens/images/hololens2-side-render-small.png differ
diff --git a/devices/hololens/images/hololens2-side-render-xs.png b/devices/hololens/images/hololens2-side-render-xs.png
new file mode 100644
index 0000000000..08d5f966cd
Binary files /dev/null and b/devices/hololens/images/hololens2-side-render-xs.png differ
diff --git a/devices/hololens/images/hololens2-side-render.png b/devices/hololens/images/hololens2-side-render.png
new file mode 100644
index 0000000000..143fb8fc50
Binary files /dev/null and b/devices/hololens/images/hololens2-side-render.png differ
diff --git a/devices/hololens/images/ipd-finger-alignment-300px.jpg b/devices/hololens/images/ipd-finger-alignment-300px.jpg
new file mode 100644
index 0000000000..7a4c929867
Binary files /dev/null and b/devices/hololens/images/ipd-finger-alignment-300px.jpg differ
diff --git a/devices/hololens/images/keyboard.png b/devices/hololens/images/keyboard.png
new file mode 100644
index 0000000000..6962567b83
Binary files /dev/null and b/devices/hololens/images/keyboard.png differ
diff --git a/devices/hololens/images/motherboard-400px.jpg b/devices/hololens/images/motherboard-400px.jpg
new file mode 100644
index 0000000000..5a2a085477
Binary files /dev/null and b/devices/hololens/images/motherboard-400px.jpg differ
diff --git a/devices/hololens/images/recover-clicker-1.png b/devices/hololens/images/recover-clicker-1.png
new file mode 100644
index 0000000000..ad54e6ee09
Binary files /dev/null and b/devices/hololens/images/recover-clicker-1.png differ
diff --git a/devices/hololens/images/recover-clicker-2.png b/devices/hololens/images/recover-clicker-2.png
new file mode 100644
index 0000000000..d7a9d6fd0d
Binary files /dev/null and b/devices/hololens/images/recover-clicker-2.png differ
diff --git a/devices/hololens/images/searchfeedback-500px.jpg b/devices/hololens/images/searchfeedback-500px.jpg
new file mode 100644
index 0000000000..952e29a6ec
Binary files /dev/null and b/devices/hololens/images/searchfeedback-500px.jpg differ
diff --git a/devices/hololens/images/see-through-400px.jpg b/devices/hololens/images/see-through-400px.jpg
new file mode 100644
index 0000000000..d9fba1c9e0
Binary files /dev/null and b/devices/hololens/images/see-through-400px.jpg differ
diff --git a/devices/hololens/images/sensor-bar-400px.jpg b/devices/hololens/images/sensor-bar-400px.jpg
new file mode 100644
index 0000000000..bf0b8f7f21
Binary files /dev/null and b/devices/hololens/images/sensor-bar-400px.jpg differ
diff --git a/devices/hololens/images/startmenu.jpg b/devices/hololens/images/startmenu.jpg
new file mode 100644
index 0000000000..b685db51ee
Binary files /dev/null and b/devices/hololens/images/startmenu.jpg differ
diff --git a/devices/hololens/images/upvotefeedback-500px.jpg b/devices/hololens/images/upvotefeedback-500px.jpg
new file mode 100644
index 0000000000..f1eda89efa
Binary files /dev/null and b/devices/hololens/images/upvotefeedback-500px.jpg differ
diff --git a/devices/hololens/images/use-hololens-clicker-1.png b/devices/hololens/images/use-hololens-clicker-1.png
new file mode 100644
index 0000000000..ad54e6ee09
Binary files /dev/null and b/devices/hololens/images/use-hololens-clicker-1.png differ
diff --git a/devices/hololens/images/use-hololens-clicker-2.png b/devices/hololens/images/use-hololens-clicker-2.png
new file mode 100644
index 0000000000..d7a9d6fd0d
Binary files /dev/null and b/devices/hololens/images/use-hololens-clicker-2.png differ
diff --git a/devices/hololens/images/vs2015-remotedeployment.jpg b/devices/hololens/images/vs2015-remotedeployment.jpg
new file mode 100644
index 0000000000..a7d6b43dc3
Binary files /dev/null and b/devices/hololens/images/vs2015-remotedeployment.jpg differ
diff --git a/devices/hololens/images/wifi-hololens-600px.jpg b/devices/hololens/images/wifi-hololens-600px.jpg
new file mode 100644
index 0000000000..eb6930a29f
Binary files /dev/null and b/devices/hololens/images/wifi-hololens-600px.jpg differ
diff --git a/devices/hololens/images/wifi-hololens-hwdetails.jpg b/devices/hololens/images/wifi-hololens-hwdetails.jpg
new file mode 100644
index 0000000000..e4b45047cf
Binary files /dev/null and b/devices/hololens/images/wifi-hololens-hwdetails.jpg differ
diff --git a/devices/hololens/index.md b/devices/hololens/index.md
index 9b7ed69845..98835e4ce5 100644
--- a/devices/hololens/index.md
+++ b/devices/hololens/index.md
@@ -1,46 +1,58 @@
 ---
-title: Microsoft HoloLens (HoloLens)
-description: HoloLens provides extra features designed for business in the Commercial Suite.
+title: Microsoft HoloLens
+description: Landing page Microsoft HoloLens.
 ms.prod: hololens
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+ms.assetid: 0947f5b3-8f0f-42f0-aa27-6d2cad51d040
+author: scooley
+ms.author: scooley
 ms.topic: article
 ms.localizationpriority: medium
-ms.date: 07/27/2018
+ms.date: 10/14/2019
+audience: ITPro
+appliesto:
+- HoloLens 1
+- HoloLens 2
+
 ---
 
 # Microsoft HoloLens
 
-
 
-
+
+
+
            Microsoft HoloLens is the first fully self-contained holographic computer running Windows 10.
             Microsoft HoloLens is available in the **Development Edition**, which runs Windows Holographic (an edition of Windows 10 designed for HoloLens), and in the **Commercial Suite**, which runs Windows Holographic for Business when you apply the Enterprise license file to the device.
            		![Hololens](images/hololens.png)
            
+
            Microsoft HoloLens is the first fully self-contained holographic computer running Windows 10.
            
+
+
            Now, with the introduction of HoloLens 2, every device provides commercial ready management enhanced by the reliability, security, and scalability of cloud and AI services from Microsoft.
            
+
+
            To learn more about HoloLens 2 for developers, check out the mixed reality developer documentation.
            
+
+
            To buy HoloLens, check out HoloLens pricing and sales on microsoft.com/HoloLens.
            
+            		HoloLens 2 side view
            
 
            
 
-## In this section
+## Guides in this section
+
+| Guide | Description |
+| --- | --- |
+| [Get started with HoloLens 2](hololens2-setup.md) | Set up HoloLens 2 for the first time.  |
+| [Get started with HoloLens (1st gen)](hololens1-setup.md) | Set up HoloLens (1st gen) for the first time.  |
+| [Get started with HoloLens in a commercial or classroom environment](hololens-requirements.md) | Plan for a multi-device HoloLens deployment and create a strategy for ongoing device management.
            This section is tailored to IT professionals managing devices with existing device management infrastructure.  |
+
+## Quick reference by topic
 
 | Topic | Description |
 | --- | --- |
-| [What's new in Microsoft HoloLens](hololens-whats-new.md) | Discover the new features in the latest update. |
-| [HoloLens in the enterprise: requirements](hololens-requirements.md) | Lists requirements for general use, Wi-Fi, and device management |
-| [Set up HoloLens](hololens-setup.md) | How to set up HoloLens for the first time  |
-[Install localized version of HoloLens](hololens-install-localized.md) | Install the Chinese or Japanese version of HoloLens
-| [Unlock Windows Holographic for Business features](hololens-upgrade-enterprise.md)  | How to upgrade your Development Edition HoloLens to Windows Holographic for Business |
-| [Enroll HoloLens in MDM](hololens-enroll-mdm.md) | Manage multiple HoloLens devices simultaneously using solutions like Microsoft Intune |
-| [Manage updates to HoloLens](hololens-updates.md) | Use mobile device management (MDM) policies to configure settings for updates. |
-| [Set up HoloLens in kiosk mode](hololens-kiosk.md) | Enable kiosk mode for HoloLens, which limits the user's ability to launch new apps or change the running app  |
-[Share HoloLens with multiple people](hololens-multiple-users.md) | Multiple users can shared a HoloLens device by using their Azure Active Directory accounts. |
-| [Configure HoloLens using a provisioning package](hololens-provisioning.md) | Provisioning packages make it easy for IT administrators to configure HoloLens devices without imaging |
-| [Install apps on HoloLens](hololens-install-apps.md) | Use Microsoft Store for Business, mobile device management (MDM), or the Windows Device Portal to install apps on HoloLens |
-| [Enable Bitlocker device encryption for HoloLens](hololens-encryption.md) | Learn how to use Bitlocker device encryption to protect files and information stored on the HoloLens |
-| [Change history for Microsoft HoloLens documentation](change-history-hololens.md) | See new and updated topics in the HoloLens documentation library. |
+| [What's new in HoloLens](hololens-whats-new.md) | Discover new features in the latest updates via HoloLens release notes. |
+| [Install and manage applications on HoloLens](hololens-install-apps.md) | Install and manage important applications on HoloLens at scale.  |
+| [HoloLens update management](hololens-updates.md) | Use mobile device management (MDM) policies to configure settings for updates. |
+| [HoloLens user management](hololens-multiple-users.md) | Multiple users can shared a HoloLens device by using their Azure Active Directory accounts. |
+| [HoloLens application access management](hololens-kiosk.md) | Manage application access for different user groups.  |
+| [Recover and troubleshoot HoloLens issues](https://support.microsoft.com/products/hololens) |  Learn how to gather logs from HoloLens, recover a misbehaving device, or reset HoloLens when necessary.  |
+| [Get support](https://support.microsoft.com/products/hololens) | Connect with Microsoft support resources for HoloLens in enterprise.  |
 
 ## Related resources
 
-- [Help for using HoloLens](https://support.microsoft.com/products/hololens)
-
-- [Documentation for Holographic app development](https://developer.microsoft.com/windows/mixed-reality/development)
-
-- [HoloLens Commercial Suite](https://www.microsoft.com/microsoft-hololens/hololens-commercial)
-
-- [HoloLens release notes](https://developer.microsoft.com/en-us/windows/mixed-reality/release_notes)
+* [Documentation for Holographic app development](https://developer.microsoft.com/windows/mixed-reality/development)
+* [HoloLens release notes](https://docs.microsoft.com/hololens/hololens-release-notes)
diff --git a/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md b/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md
new file mode 100644
index 0000000000..e499178078
--- /dev/null
+++ b/devices/surface-hub/General-Data-Privacy-Regulation-and-Surface-Hub.md
@@ -0,0 +1,25 @@
+---
+title: General Data Privacy Regulation and Surface Hub
+description: Informs users who are subject to EU data protection laws of their options regarding how to delete or restrict diagnostic data produced by Surface Hub.
+ms.assetid: 087713CF-631D-477B-9CC6-EFF939DE0186
+keywords: GDPR
+ms.prod: surface-hub
+ms.sitesec: library
+author: Teresa-MOTIV
+ms.author: v-tea
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# General Data Privacy Regulation and Surface Hub
+
+In May 2018, a European privacy law, the General Data Protection Regulation (GDPR), took effect. The GDPR imposes new rules on companies, government agencies, non-profits, and other organizations that offer goods and services to people in the European Union (EU), or that collect and analyze data tied to EU residents.
+
+Surface Hub customers concerned about privacy under the new GDPR regulations can manage their device privacy with the following options that are provided by Microsoft:
+
+* **Option 1:** Surface Hub devices in regions enforcing GDPR regulations will install KB4284830 when publicly available to automatically reduce diagnostic data emission to basic. Customers opting to provide a higher level of diagnostic data can use the Surface Hub Settings application or Mobile Device Management to override the default basic setting.
+
+* **Option 2:** Surface Hub customers who want to remove any existing diagnostic data can download the **Surface Hub Delete Diagnostic Data** application from the Microsoft Store. This app will allow customers to request deletion of associated diagnostic data directly from their Surface Hub device.
+
+Microsoft has extensive expertise in protecting data, championing privacy, and complying with complex regulations, and currently complies with both EU-U.S. Privacy Shield and EU Model Clauses. We believe that the GDPR is an important step forward for clarifying and enabling individual privacy rights. We want to help you focus on your core business while efficiently preparing for the GDPR.
+
diff --git a/devices/surface-hub/TOC.md b/devices/surface-hub/TOC.md
index d24333f170..59d2d76a0d 100644
--- a/devices/surface-hub/TOC.md
+++ b/devices/surface-hub/TOC.md
@@ -1,8 +1,72 @@
 # [Microsoft Surface Hub](index.md)
-## [What's new in Windows 10, version 1703 for Surface Hub?](surfacehub-whats-new-1703.md)
-## [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md)
-## [Prepare your environment for Microsoft Surface Hub](prepare-your-environment-for-surface-hub.md)
-### [Physically install Microsoft Surface Hub](physically-install-your-surface-hub-device.md)
+
+# Surface Hub 2S
+
+## Overview
+### [What's new in Surface Hub 2S for IT admins](surface-hub-2s-whats-new.md)
+### [Surface Hub 2S tech specs](surface-hub-2s-techspecs.md) 
+### [Operating system essentials (Surface Hub)](differences-between-surface-hub-and-windows-10-enterprise.md)
+### [Adjust Surface Hub 2S brightness, volume, and input](surface-hub-2s-onscreen-display.md)
+### [Use Microsoft Whiteboard on a Surface Hub](https://support.office.com/article/use-microsoft-whiteboard-on-a-surface-hub-5c594985-129d-43f9-ace5-7dee96f7621d)
+
+## Plan
+### [Surface Hub 2S Site Readiness Guide](surface-hub-2s-site-readiness-guide.md) 
+#### [Site planning for Surface Hub 2S](surface-hub-2s-site-planning.md)
+#### [Surface Hub 2S quick start](surface-hub-2s-quick-start.md)
+#### [Install and mount Surface Hub 2S](surface-hub-2s-install-mount.md)
+#### [Customize wall mount of Surface Hub 2S](surface-hub-2s-custom-install.md)
+#### [Setup worksheet](setup-worksheet-surface-hub.md)
+#### [Surface Hub 2S ports and keypad overview](surface-hub-2s-port-keypad-overview.md)
+#### [Connect devices to Surface Hub 2S](surface-hub-2s-connect.md)
+### [Prepare your environment for Microsoft Surface Hub 2S](surface-hub-2s-prepare-environment.md)
+### [Configure Easy Authentication for Surface Hub 2S](surface-hub-2s-phone-authenticate.md)
+
+## Deploy
+### [Surface Hub 2S adoption and training](surface-hub-2s-adoption-kit.md)
+### [Surface Hub 2S adoption videos](surface-hub-2s-adoption-videos.md)
+
+### [First time setup for Surface Hub 2S](surface-hub-2s-setup.md)
+### [Connect devices to Surface Hub 2S](surface-hub-2s-connect.md)
+### [Surface Hub 2S deployment checklist](surface-hub-2s-deploy-checklist.md)
+### [Create Surface Hub 2S device account](surface-hub-2s-account.md)
+### [Create provisioning packages for Surface Hub 2S](surface-hub-2s-deploy.md)
+### [Deploy apps to Surface Hub 2S using Intune](surface-hub-2s-deploy-apps-intune.md)
+### [Create Surface Hub 2S on-premises accounts with PowerShell](surface-hub-2s-onprem-powershell.md)
+
+## Manage
+### [Manage Surface Hub 2S with Microsoft Intune](surface-hub-2s-manage-intune.md)
+### [Local management for Surface Hub 2S settings](local-management-surface-hub-settings.md)
+### [Manage device account password rotation](surface-hub-2s-manage-passwords.md)
+### [Manage Windows updates](manage-windows-updates-for-surface-hub.md)
+### [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md)
+### [Save your BitLocker key](save-bitlocker-key-surface-hub.md)
+### [Microsoft Exchange properties](exchange-properties-for-surface-hub-device-accounts.md)
+### [Applying ActiveSync policies to device accounts](apply-activesync-policies-for-surface-hub-device-accounts.md)
+
+## Secure
+### [Secure and manage Surface Hub 2S with SEMM and UEFI](surface-hub-2s-secure-with-uefi-semm.md)
+### [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md)
+
+## Troubleshoot
+### [Recover and reset Surface Hub 2S](surface-hub-2s-recover-reset.md)
+### [Troubleshoot Miracast on Surface Hub](miracast-troubleshooting.md)
+### [How to pack and ship your Surface Hub 2S for service](surface-hub-2s-pack-components.md)
+### [Change history](surface-hub-2s-change-history.md)
+
+# Surface Hub
+## Overview
+### [What's new in Windows 10, version 1703 for Surface Hub?](surfacehub-whats-new-1703.md)
+### [Operating system essentials (Surface Hub)](differences-between-surface-hub-and-windows-10-enterprise.md)
+### [Technical information for 55” Microsoft Surface Hub](surface-hub-technical-55.md)
+### [Technical information for 84” Microsoft Surface Hub](surface-hub-technical-84.md)
+### [Use Microsoft Whiteboard on a Surface Hub](https://support.office.com/article/use-microsoft-whiteboard-on-a-surface-hub-5c594985-129d-43f9-ace5-7dee96f7621d)
+
+## Plan
+### [Prepare your environment for Microsoft Surface Hub](prepare-your-environment-for-surface-hub.md)
+### [Surface Hub Site Readiness Guide](surface-hub-site-readiness-guide.md) 
+### [Physically install Microsoft Surface Hub](physically-install-your-surface-hub-device.md) 
+
+## Deploy
 ### [Create and test a device account](create-and-test-a-device-account-surface-hub.md)
 #### [Online deployment](online-deployment-surface-hub-device-accounts.md)
 #### [On-premises deployment (single forest)](on-premises-deployment-surface-hub-device-accounts.md)
@@ -13,12 +77,15 @@
 #### [Microsoft Exchange properties](exchange-properties-for-surface-hub-device-accounts.md)
 #### [Applying ActiveSync policies to device accounts](apply-activesync-policies-for-surface-hub-device-accounts.md)
 #### [Password management](password-management-for-surface-hub-device-accounts.md)
-### [Create provisioning packages](provisioning-packages-for-surface-hub.md)
-### [Admin group management](admin-group-management-for-surface-hub.md)
-## [Set up Microsoft Surface Hub](set-up-your-surface-hub.md)
-### [Setup worksheet](setup-worksheet-surface-hub.md)
-### [First-run program](first-run-program-surface-hub.md)
-## [Manage Microsoft Surface Hub](manage-surface-hub.md)
+#### [Create provisioning packages](provisioning-packages-for-surface-hub.md)
+#### [Admin group management](admin-group-management-for-surface-hub.md)
+### [Set up Microsoft Surface Hub](set-up-your-surface-hub.md)
+#### [Setup worksheet](setup-worksheet-surface-hub.md)
+#### [First-run program](first-run-program-surface-hub.md)
+
+## Manage
+### [Manage Microsoft Surface Hub](manage-surface-hub.md)
+### [PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md)
 ### [Remote Surface Hub management](remote-surface-hub-management.md)
 #### [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md)
 #### [Monitor your Surface Hub](monitor-surface-hub.md)
@@ -30,21 +97,34 @@
 #### [Device reset](device-reset-surface-hub.md)
 #### [Use fully qualified domain name with Surface Hub](use-fully-qualified-domain-name-surface-hub.md)
 #### [Wireless network management](wireless-network-management-for-surface-hub.md)
+### [Implement Quality of Service on Surface Hub](surface-hub-qos.md)
 ### [Install apps on your Surface Hub](install-apps-on-surface-hub.md)
 ### [Configure Surface Hub Start menu](surface-hub-start-menu.md)
 ### [Set up and use Microsoft Whiteboard](whiteboard-collaboration.md) 
 ### [End a Surface Hub meeting with End session](i-am-done-finishing-your-surface-hub-meeting.md)
-### [Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md)
-### [Save your BitLocker key](save-bitlocker-key-surface-hub.md)
 ### [Connect other devices and display with Surface Hub](connect-and-display-with-surface-hub.md)
 ### [Miracast on existing wireless network or LAN](miracast-over-infrastructure.md)
 ### [Enable 802.1x wired authentication](enable-8021x-wired-authentication.md)
 ### [Using a room control system](use-room-control-system-with-surface-hub.md)
+
+## Secure
+### [Sign in to Surface Hub with Microsoft Authenticator](surface-hub-authenticator-app.md)
+### [Save your BitLocker key](save-bitlocker-key-surface-hub.md)
+### [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md)
+
+## Troubleshoot
 ### [Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md)
-## [PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md)
-## [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md)
-## [Top support solutions for Surface Hub](support-solutions-surface-hub.md)
-## [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md)
-## [Troubleshoot Miracast on Surface Hub](miracast-troubleshooting.md)
-## [Useful downloads for Surface Hub administrators](surface-hub-downloads.md)
-## [Change history for Surface Hub](change-history-surface-hub.md)
\ No newline at end of file
+### [Surface Hub SSD replacement](surface-hub-ssd-replacement.md)
+### [Top support solutions for Surface Hub](support-solutions-surface-hub.md)
+### [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md)
+### [Surface Hub Update History](surface-hub-update-history.md)
+### [Known issues and additional information about Microsoft Surface Hub](known-issues-and-additional-info-about-surface-hub.md)
+### [How to use cloud recovery for BitLocker on a Surface Hub](use-cloud-recovery-for-bitlocker-on-surfacehub.md)
+### [Using the Surface Hub Hardware Diagnostic Tool to test a device account](use-surface-hub-diagnostic-test-device-account.md)
+### [Troubleshoot Miracast on Surface Hub](miracast-troubleshooting.md)
+### [Surface Hub Miracast channels 149-165 not supported in Europe, Japan, Israel](surfacehub-miracast-not-supported-europe-japan-israel.md)
+### [What to do if the Connect app in Surface Hub exits unexpectedly](connect-app-in-surface-hub-unexpectedly-exits.md)
+### [Surface Hub may install updates and restart outside maintenance hours](surface-hub-installs-updates-and-restarts-outside-maintenance-hours.md)
+### [General Data Privacy Regulation and Surface Hub](general-data-privacy-regulation-and-surface-hub.md)
+### [Useful downloads for Surface Hub administrators](surface-hub-downloads.md)
+### [Change history for Surface Hub](change-history-surface-hub.md)
diff --git a/devices/surface-hub/accessibility-surface-hub.md b/devices/surface-hub/accessibility-surface-hub.md
index 634261a1e3..031501c2b4 100644
--- a/devices/surface-hub/accessibility-surface-hub.md
+++ b/devices/surface-hub/accessibility-surface-hub.md
@@ -2,13 +2,14 @@
 title: Accessibility (Surface Hub)
 description: Accessibility settings for the Microsoft Surface Hub can be changed by using the Settings app. You'll find them under Ease of Access. Your Surface Hub has the same accessibility options as Windows 10.
 ms.assetid: 1D44723B-1162-4DF6-99A2-8A3F24443442
+ms.reviewer: 
+manager: dansimp
 keywords: Accessibility settings, Settings app, Ease of Access
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 08/16/2017
 ms.localizationpriority: medium
 ---
 
diff --git a/devices/surface-hub/admin-group-management-for-surface-hub.md b/devices/surface-hub/admin-group-management-for-surface-hub.md
index 5771b3f3c5..8125113887 100644
--- a/devices/surface-hub/admin-group-management-for-surface-hub.md
+++ b/devices/surface-hub/admin-group-management-for-surface-hub.md
@@ -2,11 +2,13 @@
 title: Admin group management (Surface Hub)
 description: Every Microsoft Surface Hub can be configured individually by opening the Settings app on the device.
 ms.assetid: FA67209E-B355-4333-B903-482C4A3BDCCE
+ms.reviewer: 
+manager: dansimp
 keywords: admin group management, Settings app, configure Surface Hub
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
 ms.localizationpriority: medium
@@ -35,7 +37,7 @@ Note that the local admin account information is not backed by any directory ser
 
 ### Domain join the device to Active Directory (AD)
 
-You can domain join the Surface Hub to your AD domain to allow users from a specified security group to configure settings. During first run, choose to use [Active Directory Domain Services](first-run-program-surface-hub.md#a-href-iduse-active-directoryause-active-directory-domain-services). You'll need to provide credentials that are capable of joining the domain of your choice, and the name of an existing security group. Anyone who is a member of that security group can enter their credentials and unlock Settings.
+You can domain join the Surface Hub to your AD domain to allow users from a specified security group to configure settings. During first run, choose to use [Active Directory Domain Services](first-run-program-surface-hub.md#use-active-directory-domain-services). You'll need to provide credentials that are capable of joining the domain of your choice, and the name of an existing security group. Anyone who is a member of that security group can enter their credentials and unlock Settings.
 
 #### What happens when you domain join your Surface Hub?
 Surface Hubs use domain join to:
@@ -51,7 +53,7 @@ Surface Hub does not support applying group policies or certificates from the do
 
 ### Azure Active Directory (Azure AD) join the device
 
-You can Azure AD join the Surface Hub to allow IT pros from your Azure AD tenant to configure settings. During first run, choose to use [Microsoft Azure Active Directory](first-run-program-surface-hub.md#a-href-iduse-microsoft-azureause-microsoft-azure-active-directory). You will need to provide credentials that are capable of joining the Azure AD tenant of your choice. After you successfully Azure AD join, the appropriate people will be granted admin rights on the device.
+You can Azure AD join the Surface Hub to allow IT pros from your Azure AD tenant to configure settings. During first run, choose to use [Microsoft Azure Active Directory](first-run-program-surface-hub.md#use-microsoft-azure-active-directory). You will need to provide credentials that are capable of joining the Azure AD tenant of your choice. After you successfully Azure AD join, the appropriate people will be granted admin rights on the device.
 
 By default, all **global administrators** will be given admin rights on an Azure AD joined Surface Hub. With **Azure AD Premium** or **Enterprise Mobility Suite (EMS)**, you can add additional administrators:
 1.  In the [Azure classic portal](https://manage.windowsazure.com/), click **Active Directory**, and then click the name of your organization's directory.
@@ -64,8 +66,11 @@ Surface Hubs use Azure AD join to:
 - Grant admin rights to the appropriate users in your Azure AD tenant.
 - Backup the device's BitLocker recovery key by storing it under the account that was used to Azure AD join the device. See [Save your BitLocker key](save-bitlocker-key-surface-hub.md) for details.
 
-> [!IMPORTANT]
-> Surface Hub does not currently support automatic enrollment to Microsoft Intune through Azure AD join. If your organization automatically enrolls Azure AD joined devices into Intune, you must disable this policy for Surface Hub before joining the device to Azure AD.
+### Automatic enrollment via Azure Active Directory join
+
+Surface Hub now supports the ability to automatically enroll in Intune by joining the device to Azure Active Directory. 
+
+For more information, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment).
 
 ### Which should I choose?
 
diff --git a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md
index f037f97ecb..8196982606 100644
--- a/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md
+++ b/devices/surface-hub/appendix-a-powershell-scripts-for-surface-hub.md
@@ -2,11 +2,13 @@
 title: PowerShell for Surface Hub (Surface Hub)
 description: PowerShell scripts to help set up and manage your Microsoft Surface Hub.
 ms.assetid: 3EF48F63-8E4C-4D74-ACD5-461F1C653784
+ms.reviewer: 
+manager: dansimp
 keywords: PowerShell, set up Surface Hub, manage Surface Hub
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 01/10/2018
 ms.localizationpriority: medium
@@ -496,7 +498,7 @@ if (![System.String]::IsNullOrEmpty($strRegPoolEntry))
     $strRegPool = $strRegPoolEntry
 }
 
-# Try to SfB-enable the account. Note that it may not work right away as the account needs to propogate to active directory
+# Try to SfB-enable the account. Note that it may not work right away as the account needs to propagate to active directory
 PrintAction "Enabling Skype for Business..."
 Start-Sleep -s 10
 $Error.Clear()
@@ -532,7 +534,7 @@ if ($status.Count -gt 0)
         elseif ($v[0] -eq "F")
         {
             $color = "red"
-            $v += " Go to http://aka.ms/shubtshoot"
+            $v += " Go to https://aka.ms/shubtshoot"
         }
 
         Write-Host -NoNewline $k -ForegroundColor $color
@@ -609,7 +611,7 @@ function ExitIfError($strMsg)
 
 ## Check dependencies ##
 try {
-    Import-Module LyncOnlineConnector
+    Import-Module SkypeOnlineConnector
     Import-Module MSOnline
 }
 catch
@@ -876,7 +878,7 @@ if (![System.String]::IsNullOrEmpty($strRegPoolEntry))
 }
 #>
 
-# Try to SfB-enable the account. Note that it may not work right away as the account needs to propogate to active directory
+# Try to SfB-enable the account. Note that it may not work right away as the account needs to propagate to active directory
 PrintAction "Enabling Skype for Business on $strRegPool"
 Start-Sleep -s 10
 $Error.Clear()
@@ -976,7 +978,7 @@ if ($status.Count -gt 0)
         elseif ($v[0] -eq "F")
         {
             $color = "red"
-            $v += " Go to http://aka.ms/shubtshoot for help"
+            $v += " Go to https://aka.ms/shubtshoot for help"
         }
 
         Write-Host -NoNewline $k -ForegroundColor $color
@@ -1098,7 +1100,7 @@ if ($fSfbIsOnline -or $fExIsOnline)
 if ($fSfbIsOnline)
 {
     try {
-        Import-Module LyncOnlineConnector
+        Import-Module SkypeOnlineConnector
     }
     catch
     {
@@ -1350,7 +1352,7 @@ Validate -Test "ActiveSync devices are allowed" -Condition ($strDefaultAccessLev
 
 # Check if there exists a device access rule that bans the device type Windows Mail
 $blockingRules = Get-ActiveSyncDeviceAccessRule | where {($_.AccessLevel -eq 'Block' -or $_.AccessLevel -eq 'Quarantine') -and $_.Characteristic -eq 'DeviceType'-and $_.QueryString -eq 'WindowsMail'}
-Validate -Test "Windows mail devices are not blocked or quarantined" -Condition ($blockingRules -eq $null -or $blockingRules.Length -eq 0) -FailureMsg "DeviceType Windows Mail is accessible - devices are blocked or quaratined - the surface hub will not be able to send mail or sync its calendar."
+Validate -Test "Windows mail devices are not blocked or quarantined" -Condition ($blockingRules -eq $null -or $blockingRules.Length -eq 0) -FailureMsg "DeviceType Windows Mail is accessible - devices are blocked or quarantined - the surface hub will not be able to send mail or sync its calendar."
 
 ## End Exchange ##
 
@@ -1409,7 +1411,7 @@ if ($fHasOnline)
     }
 }
 
-#If there is an on-prem component, we can get the authorative AD user from mailbox
+#If there is an on-prem component, we can get the authoritative AD user from mailbox
 if ($fHasOnPrem)
 {
     $accountOnPrem = $null
@@ -1511,7 +1513,7 @@ else
 if ($online)
 {
     try {
-        Import-Module LyncOnlineConnector
+        Import-Module SkypeOnlineConnector
     }
     catch
     {
diff --git a/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md b/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md
index f34a48b0b7..7ea2bc584c 100644
--- a/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md
+++ b/devices/surface-hub/apply-activesync-policies-for-surface-hub-device-accounts.md
@@ -2,13 +2,15 @@
 title: Applying ActiveSync policies to device accounts (Surface Hub)
 description: The Microsoft Surface Hub's device account uses ActiveSync to sync mail and calendar. This allows people to join and start scheduled meetings from the Surface Hub, and allows them to email any whiteboards they have made during their meeting.
 ms.assetid: FAABBA74-3088-4275-B58E-EC1070F4D110
+ms.reviewer: 
+manager: dansimp
 keywords: Surface Hub, ActiveSync policies
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 07/27/2017
+ms.date: 06/20/2019
 ms.localizationpriority: medium
 ---
 
diff --git a/devices/surface-hub/change-history-surface-hub.md b/devices/surface-hub/change-history-surface-hub.md
index 836ff19136..2d55222b1b 100644
--- a/devices/surface-hub/change-history-surface-hub.md
+++ b/devices/surface-hub/change-history-surface-hub.md
@@ -1,13 +1,14 @@
 ---
 title: Change history for Surface Hub
+ms.reviewer: 
+manager: dansimp
 description: This topic lists new and updated topics for Surface Hub.
 keywords: change history
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 07/12/2018
 ms.localizationpriority: medium
 ---
 
@@ -15,6 +16,16 @@ ms.localizationpriority: medium
 
 This topic lists new and updated topics in the [Surface Hub Admin Guide]( surface-hub-administrators-guide.md).
 
+## April 2019
+
+New or changed topic | Description
+--- | ---
+[Surface Hub Site Readiness Guide](surface-hub-site-readiness-guide.md) | New; previously available for download only
+[Technical information for 55” Microsoft Surface Hub](surface-hub-technical-55.md) | New; previously available for download and on [Surface Hub Tech Spec](https://support.microsoft.com/help/4483539/surface-hub-tech-spec)
+[Technical information for 84” Microsoft Surface Hub](surface-hub-technical-84.md) | New; previously available for download and on [Surface Hub Tech Spec](https://support.microsoft.com/help/4483539/surface-hub-tech-spec)
+[Surface Hub SSD replacement](surface-hub-ssd-replacement.md) | New; previously available for download only
+[Implement Quality of Service on Surface Hub](surface-hub-qos.md) | New
+
 ## July 2018
 
 New or changed topic | Description
@@ -181,4 +192,4 @@ The topics in this library have been updated for Windows 10, version 1607 (also
 | [Create and test a device account (Surface Hub)](create-and-test-a-device-account-surface-hub.md) | Reorganize and streamline guidance on creating a device account.  |
 | [Introduction to Surface Hub](intro-to-surface-hub.md) | Move Surface Hub dependencies table to [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md). |
 | [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md) | Add dependency table and reorganize topic. |
-| [Local management for Surface Hub settings](local-management-surface-hub-settings.md) | New topic. |
\ No newline at end of file
+| [Local management for Surface Hub settings](local-management-surface-hub-settings.md) | New topic. |
diff --git a/devices/surface-hub/change-surface-hub-device-account.md b/devices/surface-hub/change-surface-hub-device-account.md
index bef2ff6610..142af6e80e 100644
--- a/devices/surface-hub/change-surface-hub-device-account.md
+++ b/devices/surface-hub/change-surface-hub-device-account.md
@@ -2,11 +2,13 @@
 title: Change the Microsoft Surface Hub device account
 description: You can change the device account in Settings to either add an account if one was not already provisioned, or to change any properties of an account that was already provisioned.
 ms.assetid: AFC43043-3319-44BC-9310-29B1F375E672
+ms.reviewer: 
+manager: dansimp
 keywords: change device account, change properties, Surface Hub
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
 ms.localizationpriority: medium
diff --git a/devices/surface-hub/connect-and-display-with-surface-hub.md b/devices/surface-hub/connect-and-display-with-surface-hub.md
index 241cfc77e6..5fd13d7b95 100644
--- a/devices/surface-hub/connect-and-display-with-surface-hub.md
+++ b/devices/surface-hub/connect-and-display-with-surface-hub.md
@@ -2,10 +2,12 @@
 title: Connect other devices and display with Surface Hub
 description: You can connect other device to your Surface Hub to display content. 
 ms.assetid: 8BB80FA3-D364-4A90-B72B-65F0F0FC1F0D
+ms.reviewer: 
+manager: dansimp
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
 ms.localizationpriority: medium
@@ -107,17 +109,17 @@ Use these ports on the Surface Hub for Guest Mode.
 
 
 
- 
+ 
 
 ### Port locations
 
 These are the port connections used for Guest Mode on the 55" and 84" Surface Hubs.
 
-![image showing guest ports on 55" surface hub. ](images/sh-55-guest-ports.png)
+![image showing guest ports on 55" surface hub.](images/sh-55-guest-ports.png)
 
 Wired port connections on 55" Surface Hub
 
-![image showing guest ports on 84" surface hub. ](images/sh-84-guest-ports.png)
+![image showing guest ports on 84" surface hub.](images/sh-84-guest-ports.png)
 
 Wired port connections on 84" Surface Hub
 
@@ -222,7 +224,7 @@ Your choice of video cable will be determined by what is available from your sou
 
 
 
- 
+ 
 
 Source audio is provided by DisplayPort and HDMI cables. If you must use VGA, Surface Hub has an audio input port that uses a 3.5 mm plug. Surface Hub also uses a USB cable that provides Touchback and Inkback from the Surface Hub to compatible Windows 10 devices. The USB cable can be used with any video input that is already connected with a cable.
 
@@ -273,26 +275,26 @@ Check directly with graphics card vendors for the latest drivers.
 
 
 
            NVIDIA
            
-
            [http://nvidia.com/Download/index.aspx](http://nvidia.com/Download/index.aspx)
            
+
            http://nvidia.com/Download/index.aspx
            
 
 
 
            AMD
            
-
            [http://support.amd.com/en-us/download](http://support.amd.com/en-us/download)
            
+
            http://support.amd.com/en-us/download
            
 
 
 
            Intel
            
-
            [https://downloadcenter.intel.com/](https://downloadcenter.intel.com/)
            
+
            https://downloadcenter.intel.com/
            
 
 
 
 
- 
+ 
 
 ### Ports
 
 Replacement PC ports on 55" Surface Hub
 
-![image showing replacement pc ports on 55" surface hub. ](images/sh-55-rpc-ports.png)
+![image showing replacement pc ports on 55" surface hub.](images/sh-55-rpc-ports.png)
 
 @@ -345,11 +347,11 @@ Replacement PC ports on 55" Surface Hub
 
            
 

 
            
 
- 
+ 
 
 Replacement PC ports on 84" Surface Hub
 
-![image showing replacement pc ports on 84" surface hub. ](images/sh-84-rpc-ports.png)
+![image showing replacement pc ports on 84" surface hub.](images/sh-84-rpc-ports.png)
 
 @@ -402,7 +404,7 @@ Replacement PC ports on 84" Surface Hub
 
            
 

 
            
 
- 
+ 
 
 ### Replacement PC setup instructions
 
@@ -437,9 +439,9 @@ You can switch the Surface Hub to use the internal PC.
 
 3.  Turn on the Surface Hub using the power switch next to the power cable.
 
- 
+ 
 ## Video Out
- 
+ 
 The Surface Hub includes a Video Out port for mirroring visual content from the Surface Hub to another display.
 
 ### Ports
@@ -489,4 +491,4 @@ You can connect the following accessories to Surface Hub using Bluetooth:
 - Speakers
 
 >[!NOTE]
->After you connect a Bluetooth headset or speaker, you might need to change the [default microphone and speaker settings](local-management-surface-hub-settings.md).
\ No newline at end of file
+>After you connect a Bluetooth headset or speaker, you might need to change the [default microphone and speaker settings](local-management-surface-hub-settings.md).
diff --git a/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md b/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md
new file mode 100644
index 0000000000..439d3c68d7
--- /dev/null
+++ b/devices/surface-hub/connect-app-in-surface-hub-unexpectedly-exits.md
@@ -0,0 +1,20 @@
+---
+title: What to do if the Connect app in Surface Hub exits unexpectedly
+description: Describes how to resolve an issue where the Connect app in Surface Hub exits to the Welcome screen after cycling through inputs.
+ms.assetid: 9576f4e4-d936-4235-8a03-d8a6fe9e8fec
+keywords: surface, hub, connect, input, displayport
+ms.prod: surface-hub
+ms.sitesec: library
+author: todmccoy
+ms.author: v-todmc
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# What to do if the Connect app in Surface Hub exits unexpectedly
+
+At times, a wired Connect session that is started from the Welcome screen by connecting a DisplayPort input will exit back to the Welcome screen after using the side keypad or the source button to cycle through all source inputs.
+
+This is an issue in the Connect app and its default full-screen state. By changing the size of the app, or by selecting a DisplayPort input thumbnail in the Connect app, you can prevent input cycling from affecting the app.
+
+The way to resolve this issue is to first launch the Connect app from the Welcome screen, and THEN connect a DisplayPort input. If the input is already connected, manually select the thumbnail.
\ No newline at end of file
diff --git a/devices/surface-hub/create-a-device-account-using-office-365.md b/devices/surface-hub/create-a-device-account-using-office-365.md
index 2d52e698c0..ff76987746 100644
--- a/devices/surface-hub/create-a-device-account-using-office-365.md
+++ b/devices/surface-hub/create-a-device-account-using-office-365.md
@@ -2,11 +2,13 @@
 title: Create a device account using UI (Surface Hub)
 description: If you prefer to use a graphical user interface, you can create a device account for your Microsoft Surface Hub with either the Office 365 UI or the Exchange Admin Center.
 ms.assetid: D11BCDC4-DABA-4B9A-9ECB-58E02CC8218C
-keywords: create device account, Office 365 UI, Exchange Admin center, Office 365 admin center, Skype for Business, mobile device mailbox policy
+ms.reviewer: 
+manager: dansimp
+keywords: create device account, Office 365 UI, Exchange Admin center, Microsoft 365 admin center, Skype for Business, mobile device mailbox policy
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 05/04/2018
 ms.localizationpriority: medium
@@ -20,22 +22,22 @@ If you prefer to use a graphical user interface, you can create a device account
 ## Create a device account using Office 365
 
 
-1.  [Create the account in the Office 365 Admin Center](#create-device-acct-o365-admin-ctr).
+1.  [Create the account in the Microsoft 365 Admin Center](#create-device-acct-o365-admin-ctr).
 2.  [Create a mobile device mailbox (ActiveSync) policy from the Microsoft Exchange Admin Center](#create-device-acct-o365-mbx-policy).
 3.  [Use PowerShell to complete device account creation](#create-device-acct-o365-complete-acct).
 4.  [Use PowerShell to configure Exchange properties of the account](#create-device-acct-o365-configure-exch-prop).
 5.  [Enable the account with Skype for Business](#create-device-acct-o365-skype-for-business).
 
-### Create the account in the Office 365 Admin Center
+### Create the account in the admin center
 
-1.  Sign in to Office 365 by visiting http://portal.office.com
-2.  Provide the admin credentials for your Office 365 tenant. This will take you to your Office 365 Admin Center.
+1.  Sign in to Office 365 by visiting https://portal.office.com
+2.  Provide the admin credentials for your Office 365 tenant. This will take you to your Microsoft 365 Admin Center.
 
-    ![Office 365 admin center.](images/setupdeviceaccto365-02.png)
+    ![Microsoft 365 admin center.](images/setupdeviceaccto365-02.png)
 
-3. In the Office 365 Admin Center, navigate to **Resources** in the left panel, and then click **Rooms & equipment**.
+3. In the admin center, navigate to **Resources** in the left panel, and then click **Rooms & equipment**.
 
-    ![Rooms & equipment option in Office 365 admin center](images/room-equipment.png)
+    ![Rooms & equipment option in admin center](images/room-equipment.png)
 
 4. Click **Add** to create a new Room account. Enter a display name and email address for the account, and then click **Add**.
 
@@ -47,9 +49,9 @@ If you prefer to use a graphical user interface, you can create a device account
 
 ### Create a mobile device mailbox (ActiveSync) policy from the Exchange Admin Center
 
-1.  In the Office 365 Admin Center’s left panel, click **ADMIN**, and then click **Exchange**.
+1.  In the admin center’s left panel, click **ADMIN**, and then click **Exchange**.
 
-    ![Office 365 admin center, showing exchange active users.](images/setupdeviceaccto365-08.png)
+    ![admin center, showing exchange active users.](images/setupdeviceaccto365-08.png)
 
 2.  This will open another tab on your browser to take you to the Exchange Admin Center, where you can create and set the Mailbox Setting for Surface Hub.
 
@@ -75,7 +77,7 @@ From here on, you'll need to finish the account creation process using PowerShel
 
 In order to run cmdlets used by these PowerShell scripts, the following must be installed for the admin PowerShell console:
 
--   [Microsoft Online Services Sign-In Assistant for IT Professionals RTW](https://www.microsoft.com/en-us/download/details.aspx?id=41950)
+-   [Microsoft Online Services Sign-In Assistant for IT Professionals RTW](https://www.microsoft.com/download/details.aspx?id=41950)
 -   [Windows Azure Active Directory Module for Windows PowerShell](https://www.microsoft.com/web/handlers/webpi.ashx/getinstaller/WindowsAzurePowershellGet.3f.3f.3fnew.appids)
 -   [Skype for Business Online, Windows PowerShell Module](https://www.microsoft.com/download/details.aspx?id=39366)
 
@@ -93,7 +95,7 @@ Install the following module in Powershell
 
 2.  Create a Credentials object, then create a new session that connects to Skype for Business Online, and provide the global tenant administrator account, then click **OK**.
 
-    ![Image for Windows PowerShell credential request. ](images/setupdeviceaccto365-18.png)
+    ![Image for Windows PowerShell credential request.](images/setupdeviceaccto365-18.png)
 
 3.  To connect to Microsoft Online Services, run:
 
@@ -217,6 +219,8 @@ In order to enable Skype for Business, your environment will need to meet the fo
 
 ## Create a device account using the Exchange Admin Center
 
+>[!NOTE]
+>This method will only work if you are syncing from an on-premises Active Directory.
 
 You can use the Exchange Admin Center to create a device account:
 
@@ -241,7 +245,7 @@ You can use the Exchange Admin Center to create a device account:
 >[!NOTE]
 >If you want to create and assign a policy to the account you created, and are using Exchange 2010, look up the corresponding information regarding policy creation and policy assignment when using the EMC (Exchange management console).
 
- 
+ 
 
 1.  Go to the Exchange Admin Center.
 
@@ -369,11 +373,11 @@ If you aren't sure what value to use for the `RegistrarPool` parameter in your e
     Get-CsOnlineUser -Identity ‘alice@contoso.microsoft.com’| fl *registrarpool*
     ```
     
-3.  To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
+3. To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
 
-    ```PowerShell
-    Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
-    ```
+   ```PowerShell
+   Enable-CsMeetingRoom -Identity $strEmail -RegistrarPool "sippoolbl20a04.infra.lync.com" -SipAddressType EmailAddress
+   ```
 
     
 
diff --git a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md b/devices/surface-hub/create-and-test-a-device-account-surface-hub.md
index 3895e5aea7..dc72c7463a 100644
--- a/devices/surface-hub/create-and-test-a-device-account-surface-hub.md
+++ b/devices/surface-hub/create-and-test-a-device-account-surface-hub.md
@@ -2,14 +2,17 @@
 title: Create and test a device account (Surface Hub)
 description: This topic introduces how to create and test the device account that Microsoft Surface Hub uses to communicate with Microsoft Exchange and Skype.
 ms.assetid: C8605B5F-2178-4C3A-B4E0-CE32C70ECF67
+ms.reviewer: rikot
+manager: dansimp
 keywords: create and test device account, device account, Surface Hub and Microsoft Exchange, Surface Hub and Skype
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 03/06/2018
 ms.localizationpriority: medium
+ms.audience: itpro
 ---
 
 # Create and test a device account (Surface Hub)
@@ -20,7 +23,7 @@ This topic introduces how to create and test the device account that Microsoft S
 A **device account** is an Exchange resource account that Surface Hub uses to:
 
 -   Display its meeting calendar
--   Join Skype for Business calls
+-   Join Teams or Skype for Business calls
 -   Send email (for example, email whiteboard content from a meeting)
 
 Once the device account is provisioned to a Surface Hub, people can add this account to a meeting invitation the same way that they would invite a meeting room. 
diff --git a/devices/surface-hub/device-reset-surface-hub.md b/devices/surface-hub/device-reset-surface-hub.md
index 7fce01ab55..6d7d33415f 100644
--- a/devices/surface-hub/device-reset-surface-hub.md
+++ b/devices/surface-hub/device-reset-surface-hub.md
@@ -1,102 +1,123 @@
 ---
-title: Device reset (Surface Hub)
-description: You may wish to reset your Microsoft Surface Hub.
+title: Reset or recover a Surface Hub
+description: Describes the reset and recovery processes for the Surface Hub, and provides instructions.
 ms.assetid: 44E82EEE-1905-464B-A758-C2A1463909FF
-keywords: reset Surface Hub
+ms.reviewer: 
+manager: dansimp
+keywords: reset Surface Hub, recover
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 07/27/2017
+ms.date: 07/31/2019
 ms.localizationpriority: medium
 ---
 
-# Device reset (Surface Hub)
+# Reset or recover a Surface Hub
 
+This article describes how to reset or recover a Microsoft Surface Hub.  
 
-You may wish to reset your Microsoft Surface Hub.
+[Resetting the Surface Hub](#reset-a-surface-hub) returns its operating system to the last cumulative Windows update, and removes all local user files and configuration information. The information that is removed includes the following:
 
-Typical reasons for a reset include:
+- The device account
+- Account information for the device's local administrators
+- Domain-join or Azure AD-join information
+- Mobile Device Management (MDM) enrollment information
+- Configuration information that was set by using MDM or the Settings app
 
--   The device isn’t running well after installing an update.
--   You’re repurposing the device for a new meeting space and want to reconfigure it.
--   You want to change how you locally manage the device.
+[Recovering a Surface Hub from the cloud](#recover-a-surface-hub-from-the-cloud) also removes this information. In addition, the Surface Hub downloads a new operating system image and installs it. You can specify whether the recovery process preserves other information that is stored on the Surface Hub.
 
-Initiating a reset will return the device to the last cumulative Windows update, and remove all local user files and configuration, including:
+## Reset a Surface Hub
 
--   The device account
--   MDM enrollment
--   Domain join or Azure AD join information
--   Local admins on the device
--   Configurations from MDM or the Settings app
+You may have to reset your Surface Hub for reasons such as the following:
 
-> [!IMPORTANT]
-> Performing a device reset may take up to 6 hours. Do not turn off or unplug the Surface Hub until the process has completed. Interrupting the process will render the device inoperable, requiring warranty service to return to normal functionality.
+- You are re-purposing the device for a new meeting space and want to reconfigure it.
+- You want to change how you locally manage the device.
+- The user name or password for the device account or the Administrator account has been lost.
+- After you install an update, the performance of the device decreases.
 
-After the reset, Surface Hub restarts the [first run program](first-run-program-surface-hub.md) again. If the Surface Hub displays a Welcome screen, that indicates that the reset encountered a problem and rolled back to the previously existing OS image.
+During the reset process, if you see a blank screen for long periods of time, please wait and do not take any action.
 
-If you see a blank screen for long periods of time during the **Reset device** process, please wait and do not take any action.
+> [!WARNING]
+> The device reset process may take up to six hours. Do not turn off or unplug the Surface Hub until the process has finished. If you interrupt the process, the device becomes inoperable. The device requires warranty service in order to become functional again.
 
+1. On your Surface Hub, open **Settings**.
 
-## Reset a Surface Hub from Settings
+   ![Image that shows Settings app for Surface Hub.](images/sh-settings.png)
 
-**To reset a Surface Hub**
-1.	On your Surface Hub, open **Settings**.
+1. Select **Update & Security**.
 
-    ![Image showing Settings app for Surface Hub.](images/sh-settings.png)
+   ![Image that shows Update & Security group in Settings app for Surface Hub.](images/sh-settings-update-security.png)
 
-2.	Click **Update & Security**.
+1. Select **Recovery**, and then, under **Reset device**, select **Get started**.
 
-    ![Image showing Update & Security group in Settings app for Surface Hub.](images/sh-settings-update-security.png)
+   ![Image that shows the Reset device option in Settings app for Surface Hub.](images/sh-settings-reset-device.png)
 
-3.	Click **Recovery**, and then, under **Reset device**, click **Get started**.
-
-    ![Image showing Reset device option in Settings app for Surface Hub.](images/sh-settings-reset-device.png)
+   After the reset process finishes, the Surface Hub starts the [first run program](first-run-program-surface-hub.md) again. If the reset process encounters a problem, it rolls the Surface Hub back to the previously-existing operating system image and then displays the Welcome screen.
 
 
+
 ## Recover a Surface Hub from the cloud
 
-In the Windows Recovery Environment (Windows RE), you can recover your device by downloading a factory build from the cloud and installing it on the Surface Hub. This allows devices in an unusable state to recover without requiring assistance from Microsoft Support.
+If for some reason the Surface Hub becomes unusable, you can still recover it from the cloud without assistance from Microsoft Support. The Surface Hub can download a fresh operating system image from the cloud, and use that image to reinstall its operating system.
 
->[!NOTE]
->The **Recover from the cloud** process requires an open internet connection (no proxy, or other authentications). An ethernet connection is recommended.
+You may have to use this type of recovery process under the following circumstances:
+
+- [The Surface Hub or its related accounts have entered an unstable state](#recover-a-surface-hub-in-a-bad-state)
+- [The Surface Hub is locked](#recover-a-locked-surface-hub)
+
+>[!IMPORTANT]
+>The **Recover from the cloud** process requires an open internet connection (no proxy or other authentications). An ethernet connection is recommended.
 
 ### Recover a Surface Hub in a bad state
 
-If the device account gets into an unstable state or the Admin account is running into issues, you can use cloud recovery in **Settings**. You should only use cloud recovery when [reset](#reset-a-surface-hub-from-settings) doesn't fix the problem.
+If the device account gets into an unstable state or if the administrator account encounters problems, you can use the Settings app to start the cloud recovery process. You should only use the cloud recovery process when the [device reset](#reset-a-surface-hub) process doesn't fix the problem.
 
-1. On your Surface Hub, go to **Settings** > **Update & security** > **Recovery**.
+1. On your Surface Hub, select **Settings** > **Update & security** > **Recovery**.
 
-2. Under **Recover from the cloud**, click **Restart now**.
+1. Under **Recover from the cloud**, select **Restart now**.
 
-    ![recover from the cloud](images/recover-from-the-cloud.png)
+   ![recover from the cloud](images/recover-from-the-cloud.png)
 
 ### Recover a locked Surface Hub
 
-On rare occasions, a Surface Hub may encounter an error while cleaning up user and app data at the end of a session. When this happens, the device will automatically reboot and try again. But if this operation fails repeatedly, the device will be automatically locked to protect user data. To unlock it, you must reset or recover the device from [Windows RE](https://technet.microsoft.com/library/cc765966.aspx).
+On rare occasions, a Surface Hub may encounter an error while cleaning up user and app data at the end of a session. When this happens, the device automatically restarts and tries the operation again. But if this operation fails repeatedly, the device automatically locks to protect user data. To unlock it, you must [reset the device](#reset-a-surface-hub) or, if that doesn't work, recover it from the cloud.
 
-1.  From the welcome screen, toggle the Surface Hub's power switch 3 times. Wait a few seconds between each toggle. See the [Surface Hub Site Readiness Guide (PDF)](https://download.microsoft.com/download/3/8/8/3883E991-DFDB-4E70-8D28-20B26045FC5B/Surface-Hub-Site-Readiness-Guide_EN.pdf) for help with locating the power switch.
-2. The device should automatically boot into Windows RE.
-3. After the Surface Hub enters Windows RE, select **Recover from the cloud**. (Optionally, you can choose **Reset**, however **Recover from the cloud** is the recommended approach.)
+1. Locate the power switch on the bottom of Surface Hub. The power switch is next to the power cord connection. For more information about the power switch, see the [Surface Hub Site Readiness Guide (PDF)](surface-hub-site-readiness-guide.md).
 
-    ![Recover from the cloud](images/recover-from-cloud.png)
+1. While the Surface Hub displays the Welcome screen, use the power switch to turn off the Surface Hub.
 
-4. Enter the Bitlocker key (if prompted).
-5. When prompted, select **Reinstall**.
+1. Use the power switch to turn the Surface Hub back on. The device starts and displays the Surface Hub Logo screen. When you see spinning dots under the Surface Hub Logo, use the power switch to turn the Surface Hub off again.  
+
+1. Repeat step 3 three times, or until the Surface Hub displays the “Preparing Automatic Repair” message. After it displays this message, the Surface Hub displays the Windows RE screen.
+
+1. Select **Advanced Options**.
+
+1. Select **Recover from the cloud**. (Optionally, you can select **Reset**. However, **Recover from the cloud** is the recommended approach.)
+
+   ![Recover from the cloud](images/recover-from-cloud.png)
+1. If you are prompted to enter the Bitlocker key, do one of the following:
+
+   - To preserve the information that Bitlocker protects on the Surface Hub, enter the Bitlocker key.
+   - To discard the protected information, select **Skip this drive**  
+
+1. When you are prompted, select **Reinstall**.
 
     ![Reinstall](images/reinstall.png)
 
-6. Select **Yes** to repartition the disk.
+1. To repartition the disk, select **Yes**.
 
-    ![Repartition](images/repartition.png)
+   ![Repartition](images/repartition.png)
 
-Reset will begin after the image is downloaded from the cloud. You will see progress indicators.
+   First, the recovery process downloads the operating system image from the cloud.  
 
-![downloading 97&](images/recover-progress.png)
+   ![downloading 97&](images/recover-progress.png)
+
+   When the download finishes, the recovery process restores the Surface Hub according to the options that you selected.
 
 ## Related topics
 
 [Manage Microsoft Surface Hub](manage-surface-hub.md)
 
-[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)
\ No newline at end of file
+[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)
diff --git a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md
index ae478d22b4..73a50f66c9 100644
--- a/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md
+++ b/devices/surface-hub/differences-between-surface-hub-and-windows-10-enterprise.md
@@ -1,17 +1,19 @@
 ---
-title: Differences between Surface Hub and Windows 10 Enterprise
-description: This topic explains the differences between Windows 10 Team and Windows 10 Enterprise.
+title: Operating system essentials (Surface Hub)
+description: This topic explains unique aspects of the Windows 10 Team operating system and how it differs from Windows 10 Enterprise.
 keywords: change history
 ms.prod: surface-hub
 ms.sitesec: library
-author: isaiahng
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 11/01/2017
+ms.date: 06/20/2019
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
-# Differences between Surface Hub and Windows 10 Enterprise
+# Operating system essentials (Surface Hub)
 
 The Surface Hub operating system, Windows 10 Team, is based on Windows 10 Enterprise, providing rich support for enterprise management, security, and other features. However, there are important differences between them. While the Enterprise edition is designed for PCs, Windows 10 Team is designed from the ground up for large screens and meeting rooms. When you evaluate security and management requirements for Surface Hub, it's best to consider it as a new operating system. This article is designed to help highlight the key differences between Windows 10 Team on Surface Hub and Windows 10 Enterprise, and what the differences mean for your organization.
 
@@ -125,13 +127,13 @@ The administrative features in Windows 10 Enterprise, such as the Microsoft Mana
 
 ### Remote management and monitoring
 
-Surface Hub supports remote management through mobile device management (MDM), and monitoring through Operations Management Suite (OMS).
+Surface Hub supports remote management through mobile device management (MDM) solutions such as [Microsoft Intune](https://docs.microsoft.com/intune/) and monitoring through [Azure Monitor](https://azure.microsoft.com/services/monitor/). 
 
 *Organization policies that this may affect:* 
             Surface Hub doesn't support installing Win32 agents required by most traditional PC management and monitoring tools, such as System Center Operations Manager.
 
-### Group policy
+### Group Policy
 
-Surface Hub does not support group policy, including auditing. Instead, use MDM to apply policies to your Surface Hub. For more information about MDM, see [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md).
+Surface Hub does not support Windows Group Policy, including auditing. Instead, use MDM to apply policies to your Surface Hub. For more information about MDM, see [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md).
 
 *Organization policies that this may affect:* 
             Use MDM to manage Surface Hub rather than group policy.
 
diff --git a/devices/surface-hub/docfx.json b/devices/surface-hub/docfx.json
index 88d3dc2f7e..8eba3c49b1 100644
--- a/devices/surface-hub/docfx.json
+++ b/devices/surface-hub/docfx.json
@@ -1,42 +1,62 @@
 {
   "build": {
-    "content":
-      [
-        {
-          "files": ["**/**.md", "**/**.yml"],
-          "exclude": ["**/obj/**"]
-        }
-      ],
+    "content": [
+      {
+        "files": [
+          "**/**.md",
+          "**/**.yml"
+        ],
+        "exclude": [
+          "**/obj/**"
+        ]
+      }
+    ],
     "resource": [
-        {
-          "files": ["**/images/**"],
-          "exclude": ["**/obj/**"]
+      {
+        "files": [
+          "**/images/**",
+          "**/*.pptx",
+          "**/*.pdf"
+        ],
+        "exclude": [
+          "**/obj/**"
+        ]
+      }
+    ],
+    "globalMetadata": {
+      "breadcrumb_path": "/surface-hub/breadcrumb/toc.json",
+      "ROBOTS": "INDEX, FOLLOW",
+      "ms.technology": "windows",
+      "audience": "ITPro",
+      "ms.topic": "article",
+      "manager": "laurawi",
+      "ms.mktglfcycl": "manage",
+      "ms.sitesec": "library",
+      "ms.date": "05/23/2017",
+      "feedback_system": "GitHub",
+      "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
+      "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "Win.surface-hub",
+          "folder_relative_path_in_docset": "./"
         }
-    ],
-	"globalMetadata": {
-		"uhfHeaderId": "MSDocsHeader-WindowsIT", 
-	    "breadcrumb_path": "/surface-hub/breadcrumb/toc.json",
-		"ROBOTS": "INDEX, FOLLOW",
-		"ms.technology": "windows",
-		"ms.topic": "article",
-		"ms.mktglfcycl": "manage",
-		"author": "jdeckerms",
-		"ms.sitesec": "library",
-		"ms.author": "jdecker",
-		"ms.date": "05/23/2017",
-		"feedback_system": "GitHub",
-		"feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
-		"feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
-		"_op_documentIdPathDepotMapping": {
-			"./": {
-			  "depot_name": "Win.surface-hub"
-			}
-		}
+      },
+      "contributors_to_exclude": [ 
+        "rjagiewich", 
+        "traya1", 
+        "rmca14", 
+        "claydetels19", 
+        "Kellylorenebaker",
+        "jborsecnik",
+        "tiburd",
+        "garycentric"
+      ],
+      "titleSuffix": "Surface Hub"
     },
-    "externalReference": [
-    ],
+    "externalReference": [],
     "template": "op.html",
     "dest": "devices/surface-hub",
-    "markdownEngineName": "dfm"
+    "markdownEngineName": "markdig"
   }
-}
\ No newline at end of file
+}
diff --git a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Navigation.pptx b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Navigation.pptx
new file mode 100644
index 0000000000..b06a6e8b44
Binary files /dev/null and b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Navigation.pptx differ
diff --git a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Office365.pptx b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Office365.pptx
new file mode 100644
index 0000000000..4fa5e3abd9
Binary files /dev/null and b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Office365.pptx differ
diff --git a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Teams.pptx b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Teams.pptx
new file mode 100644
index 0000000000..210102de52
Binary files /dev/null and b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Teams.pptx differ
diff --git a/devices/surface-hub/downloads/Guide-SurfaceHub2S-Whiteboard.pptx b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Whiteboard.pptx
new file mode 100644
index 0000000000..6d39d374a7
Binary files /dev/null and b/devices/surface-hub/downloads/Guide-SurfaceHub2S-Whiteboard.pptx differ
diff --git a/devices/surface-hub/downloads/Outline-SurfaceHub2S-EndUser.pdf b/devices/surface-hub/downloads/Outline-SurfaceHub2S-EndUser.pdf
new file mode 100644
index 0000000000..6c5b52d377
Binary files /dev/null and b/devices/surface-hub/downloads/Outline-SurfaceHub2S-EndUser.pdf differ
diff --git a/devices/surface-hub/downloads/Outline-SurfaceHub2S-HelpDesk.pdf b/devices/surface-hub/downloads/Outline-SurfaceHub2S-HelpDesk.pdf
new file mode 100644
index 0000000000..ae296c8c08
Binary files /dev/null and b/devices/surface-hub/downloads/Outline-SurfaceHub2S-HelpDesk.pdf differ
diff --git a/devices/surface-hub/downloads/Outline-SurfaceHub2S-PowerUser.pdf b/devices/surface-hub/downloads/Outline-SurfaceHub2S-PowerUser.pdf
new file mode 100644
index 0000000000..9f64a7c4f2
Binary files /dev/null and b/devices/surface-hub/downloads/Outline-SurfaceHub2S-PowerUser.pdf differ
diff --git a/devices/surface-hub/downloads/QRCConnectYourPC.pdf b/devices/surface-hub/downloads/QRCConnectYourPC.pdf
new file mode 100644
index 0000000000..fbdb9d9164
Binary files /dev/null and b/devices/surface-hub/downloads/QRCConnectYourPC.pdf differ
diff --git a/devices/surface-hub/downloads/QRCJoinTeamsMeeting.pdf b/devices/surface-hub/downloads/QRCJoinTeamsMeeting.pdf
new file mode 100644
index 0000000000..62b86d2a00
Binary files /dev/null and b/devices/surface-hub/downloads/QRCJoinTeamsMeeting.pdf differ
diff --git a/devices/surface-hub/downloads/QRCManageTeamsMeeting.pdf b/devices/surface-hub/downloads/QRCManageTeamsMeeting.pdf
new file mode 100644
index 0000000000..a6af26dcf9
Binary files /dev/null and b/devices/surface-hub/downloads/QRCManageTeamsMeeting.pdf differ
diff --git a/devices/surface-hub/downloads/QRCNavigationBasics.pdf b/devices/surface-hub/downloads/QRCNavigationBasics.pdf
new file mode 100644
index 0000000000..6d8eb75ad5
Binary files /dev/null and b/devices/surface-hub/downloads/QRCNavigationBasics.pdf differ
diff --git a/devices/surface-hub/downloads/QRCScheduleTeamsMeeting.pdf b/devices/surface-hub/downloads/QRCScheduleTeamsMeeting.pdf
new file mode 100644
index 0000000000..a33cf1b1e1
Binary files /dev/null and b/devices/surface-hub/downloads/QRCScheduleTeamsMeeting.pdf differ
diff --git a/devices/surface-hub/downloads/QRCShareSendFile.pdf b/devices/surface-hub/downloads/QRCShareSendFile.pdf
new file mode 100644
index 0000000000..56d5c9f8c2
Binary files /dev/null and b/devices/surface-hub/downloads/QRCShareSendFile.pdf differ
diff --git a/devices/surface-hub/downloads/QRCSignInToViewMeetingsFiles.pdf b/devices/surface-hub/downloads/QRCSignInToViewMeetingsFiles.pdf
new file mode 100644
index 0000000000..61caa64f94
Binary files /dev/null and b/devices/surface-hub/downloads/QRCSignInToViewMeetingsFiles.pdf differ
diff --git a/devices/surface-hub/downloads/QRCStartNewTeamsMeeting.pdf b/devices/surface-hub/downloads/QRCStartNewTeamsMeeting.pdf
new file mode 100644
index 0000000000..d7a7c89268
Binary files /dev/null and b/devices/surface-hub/downloads/QRCStartNewTeamsMeeting.pdf differ
diff --git a/devices/surface-hub/downloads/QRCWhiteboardAdvanced.pdf b/devices/surface-hub/downloads/QRCWhiteboardAdvanced.pdf
new file mode 100644
index 0000000000..aed2f55671
Binary files /dev/null and b/devices/surface-hub/downloads/QRCWhiteboardAdvanced.pdf differ
diff --git a/devices/surface-hub/downloads/QRCWhiteboardTools.pdf b/devices/surface-hub/downloads/QRCWhiteboardTools.pdf
new file mode 100644
index 0000000000..c6dfcc3523
Binary files /dev/null and b/devices/surface-hub/downloads/QRCWhiteboardTools.pdf differ
diff --git a/devices/surface-hub/downloads/SurfaceHubAdoptionToolKit.pdf b/devices/surface-hub/downloads/SurfaceHubAdoptionToolKit.pdf
new file mode 100644
index 0000000000..79675aaaaa
Binary files /dev/null and b/devices/surface-hub/downloads/SurfaceHubAdoptionToolKit.pdf differ
diff --git a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf b/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf
new file mode 100644
index 0000000000..9fa82b77c5
Binary files /dev/null and b/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf differ
diff --git a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf b/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf
new file mode 100644
index 0000000000..36d552a91a
Binary files /dev/null and b/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf differ
diff --git a/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf b/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf
new file mode 100644
index 0000000000..216737e393
Binary files /dev/null and b/devices/surface-hub/downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf differ
diff --git a/devices/surface-hub/enable-8021x-wired-authentication.md b/devices/surface-hub/enable-8021x-wired-authentication.md
index 810dc3d2ce..bf91e2e42c 100644
--- a/devices/surface-hub/enable-8021x-wired-authentication.md
+++ b/devices/surface-hub/enable-8021x-wired-authentication.md
@@ -3,10 +3,12 @@ title: Enable 802.1x wired authentication
 description: 802.1x Wired Authentication MDM policies have been enabled on Surface Hub devices. 
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 11/15/2017
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
diff --git a/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md b/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md
index 2975a20db0..b6fca3a49e 100644
--- a/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md
+++ b/devices/surface-hub/exchange-properties-for-surface-hub-device-accounts.md
@@ -2,13 +2,15 @@
 title: Microsoft Exchange properties (Surface Hub)
 description: Some Microsoft Exchange properties of the device account must be set to particular values to have the best meeting experience on Microsoft Surface Hub.
 ms.assetid: 3E84393B-C425-45BF-95A6-D6502BA1BF29
+ms.reviewer: 
+manager: dansimp
 keywords: Microsoft Exchange properties, device account, Surface Hub, Windows PowerShell cmdlet
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 07/27/2017
+ms.date: 06/20/2019
 ms.localizationpriority: medium
 ---
 
diff --git a/devices/surface-hub/finishing-your-surface-hub-meeting.md b/devices/surface-hub/finishing-your-surface-hub-meeting.md
index c56335e042..8776870779 100644
--- a/devices/surface-hub/finishing-your-surface-hub-meeting.md
+++ b/devices/surface-hub/finishing-your-surface-hub-meeting.md
@@ -4,10 +4,12 @@ description: To end a Surface Hub meeting, tap End session. Surface Hub cleans u
 keywords: I am Done, end Surface Hub meeting, finish Surface Hub meeting, clean up Surface Hub meeting
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
diff --git a/devices/surface-hub/first-run-program-surface-hub.md b/devices/surface-hub/first-run-program-surface-hub.md
index 346d0c8d8a..3d38a356f5 100644
--- a/devices/surface-hub/first-run-program-surface-hub.md
+++ b/devices/surface-hub/first-run-program-surface-hub.md
@@ -2,11 +2,13 @@
 title: First-run program (Surface Hub)
 description: The term \ 0034;first run \ 0034; refers to the series of steps you'll go through the first time you power up your Microsoft Surface Hub, and means the same thing as \ 0034;out-of-box experience \ 0034; (OOBE). This section will walk you through the process.
 ms.assetid: 07C9E84C-1245-4511-B3B3-75939AD57C49
+ms.reviewer: 
+manager: dansimp
 keywords: first run, Surface Hub, out-of-box experience, OOBE
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
 ms.localizationpriority: medium
@@ -38,7 +40,7 @@ Each of these sections also contains information about paths you might take when
 >[!NOTE]
 >You should have the separate keyboard that came with your Surface Hub set up and ready before beginning. See the Surface Hub Setup Guide for details.
 
- 
+ 
 
 ## Hi there page
 
@@ -48,7 +50,7 @@ This is the first screen you'll see when you power up the Surface Hub for the fi
 >[!NOTE]
 >This is also where you begin the optional process of deploying a provisioning package. See [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md) if that's what you're doing.
 
- Select a language and the initial setup options are displayed.
+ Select a language and the initial setup options are displayed.
 
 ![Image showing ICD options checklist.](images/setuplocale.png)
 
@@ -66,7 +68,7 @@ If the default values shown are correct, then you can click **Next** to go on. O
 >[!NOTE]
 > Once the settings on this page are entered, you can't come back to this screen unless you reset the device (see [Device reset](device-reset-surface-hub.md)). Make sure that the settings are properly configured before proceeding.
 
- 
+ 
 
 When the settings are accepted, the device will check for a wired network connection. If the connection is fine, it will display the [Set up for you page](#set-up-for-you). If there is a problem with the wired connection, the device will display the [Network setup page](#network-setup).
 
@@ -86,9 +88,9 @@ This screen is shown only if the device fails to detect a wired network. If you
 -   You can select one of the wireless networks shown. If the network is secured, you'll be taken to a login page. See [Wireless network setup](#wireless) for details.
 -   Click **Skip this step** to skip connecting to a network. You'll be taken to the [Set up for you page](#set-up-for-you).
     >[!NOTE]
-    >If you skip this, the device will not have a network connection, and nothing that requires a network connection will work on your Surface Hub, including system updates and email and calendar synchronization. You can connect to a wireless network later using Settings (see [Wireless network managment](wireless-network-management-for-surface-hub.md)).
+    >If you skip this, the device will not have a network connection, and nothing that requires a network connection will work on your Surface Hub, including system updates and email and calendar synchronization. You can connect to a wireless network later using Settings (see [Wireless network management](wireless-network-management-for-surface-hub.md)).
 
-     
+     
 
 -   You can plug in a network cable while this screen is visible. The device will detect it, and will add **Next** to the screen. Click **Next** to continue with making the wired connection.
 
@@ -121,9 +123,9 @@ This page will be shown when the device detects a wired connection with limited
 
 -   You can select a wireless network to use instead of the limited wired connection.
 -   You can skip connecting to a network by selecting **Skip this step**. You'll be taken to the [Set up for you page](#set-up-for-you).
-    **Note**  If you skip this, the device will not have a network connection, and nothing that requires a network connection will work on your Surface Hub, including things like email and calendar synchronization. You can connect to a wireless network later using Settings (see [Wireless network managment](wireless-network-management-for-surface-hub.md)).
+    **Note**  If you skip this, the device will not have a network connection, and nothing that requires a network connection will work on your Surface Hub, including things like email and calendar synchronization. You can connect to a wireless network later using Settings (see [Wireless network management](wireless-network-management-for-surface-hub.md)).
 
-     
+     
 
 -   You can select **Enter proxy settings** which will allow you to specify how to use the network proxy. You'll be taken to the next screen.
 
@@ -147,9 +149,9 @@ When you click **Next**, the device will attempt to connect to the proxy server.
 You can skip connecting to a network by selecting **Skip this step**. You'll be taken to the [Set up for you page](#set-up-for-you).
 
 >[!NOTE]
->If you skip this, the device will not have a network connection, and nothing that requires a network connection will work on your Surface Hub, including things like email and calendar synchronization. You can connect to a wireless network later using Settings (see [Wireless network managment](wireless-network-management-for-surface-hub.md)).
+>If you skip this, the device will not have a network connection, and nothing that requires a network connection will work on your Surface Hub, including things like email and calendar synchronization. You can connect to a wireless network later using Settings (see [Wireless network management](wireless-network-management-for-surface-hub.md)).
 
- 
+ 
 
 ## Set up for you page
 
@@ -183,12 +185,12 @@ On this page, the Surface Hub will ask for credentials for the device account th
 
 Use either a **user principal name (UPN)** or a **domain\\user name** as the account identifier in the first entry field. Use the format that matches your environment, and enter the password.
 
-| Environment  | Required format for device account|
-| ------------ | ----------------------------------|
-| Device account is hosted only online.  | username@domain.com|
-| Device account is hosted only on-prem.  | DOMAIN\username|
-| Device account is hosted online and on-prem (hybrid).  |  DOMAIN\username|
 
+|                      Environment                      | Required format for device account |
+|-------------------------------------------------------|------------------------------------|
+|         Device account is hosted only online.         |        username@domain.com         |
+|        Device account is hosted only on-prem.         |          DOMAIN\username           |
+| Device account is hosted online and on-prem (hybrid). |          DOMAIN\username           |
 
 Click **Skip setting up a device account** to skip setting up a device account. However, if you don't set up a device account, the device will not be fully integrated into your infrastructure. For example, people won't be able to:
 
@@ -201,7 +203,7 @@ If you skip setting it up now, you can add a device account later by using the S
 
 If you click **Skip setting up a device account**, the device will display a dialog box showing what will happen if the device doesn't have a device account. If you choose **Yes, skip this**, you will be sent to the [Name this device page](#name-this-device).
 
-![Image showing message the is displaed to confirm you want to skip creating a device account.](images/setupskipdeviceacct.png)
+![Image showing message the is displayed to confirm you want to skip creating a device account.](images/setupskipdeviceacct.png)
 
 ### What happens?
 
@@ -317,7 +319,7 @@ Because every Surface Hub can be used by any number of authenticated employees,
 >[!NOTE]
 >The purpose of this page is primarily to determine who can configure the device from the device’s UI; that is, who can actually visit a device, log in, open up the Settings app, and make changes to the Settings.
 
- 
+ 
 
 ![Image showing Set up admins for this device page.](images/setupsetupadmins.png)
 
@@ -335,12 +337,12 @@ This is what happens when you choose an option.
 
 -   **Use Microsoft Azure Active Directory**
 
-    Clicking this option allows you to join the device to Azure AD. Once you click **Next**, the device will restart to apply some settings, and then you’ll be taken to the [Use Microsoft Azure Active Directory](#use-microsoft-azure) page and asked to enter credentials that can allow you to join Azure AD. Members of the Azure Global Admins security group from the joined organization will be able to use the Settings app. The specific people that will be allowed depends on your Azure AD subscription and how you’ve configured the settings for your Azure AD organization.
+    Clicking this option allows you to join the device to Azure AD. Once you click **Next**, the device will restart to apply some settings, and then you’ll be taken to the [Use Microsoft Azure Active Directory](#use-microsoft-azure) page and asked to enter credentials that can allow you to join Azure AD. Members of the Azure Global Admins role from the joined organization will be able to use the Settings app. The specific people that will be allowed depends on your Azure AD subscription and how you’ve configured the settings for your Azure AD organization.
     
-    >[!IMPORTANT]
-    >Administrators added to the Azure Global Admins group after you join the device to Azure AD will be unable to use the Settings app.
+    > [!IMPORTANT]
+    > Administrators added to the Azure Device Administrators role after you join the device to Azure AD will be unable to use the Settings app.
     >
-    >If you join Surface Hub to Azure AD during first-run setup, single sign-on (SSO) for Office apps will not work properly. Users will have to sign in to each Office app individually.
+    > If you join Surface Hub to Azure AD during first-run setup, single sign-on (SSO) for Office apps will not work properly. Users will have to sign in to each Office app individually.
 
 -   **Use Active Directory Domain Services**
 
@@ -355,7 +357,7 @@ This is what happens when you choose an option.
 >[!NOTE]
 >After you finish this process, you won't be able to change the device's admin option unless you reset the device.
 
- 
+ 
 
 ### Use Microsoft Azure Active Directory
 
@@ -414,7 +416,7 @@ If the join is successful, you'll see the **Enter a security group** page. When
 >[!NOTE]
 >If you domain join the Surface Hub, you can't unjoin the device without resetting it.
 
- 
+ 
 
 ### Use a local admin
 
@@ -440,7 +442,7 @@ This page will attempt to create a new admin account using the credentials that
 >[!IMPORTANT]
 >Before you do the updates, make sure you read [Save your BitLocker key](save-bitlocker-key-surface-hub.md) in order to make sure you have a backup of the key.
 
- 
+ 
 
 In order to get the latest features and fixes, you should update your Surface Hub as soon as you finish all of the preceding first-run steps.
 
@@ -449,9 +451,9 @@ In order to get the latest features and fixes, you should update your Surface Hu
 3.  If updates are available, they will be downloaded. Once downloading is complete, click the **Update now** button to install the updates.
 4.  Follow the onscreen prompts after the updates are installed. You may need to restart the device.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md
index fde0bb2f8a..ea543e69f2 100644
--- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md
+++ b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md
@@ -2,141 +2,144 @@
 title: Hybrid deployment (Surface Hub)
 description: A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub.
 ms.assetid: 7BFBB7BE-F587-422E-9CE4-C9DDF829E4F1
+ms.reviewer: 
+manager: dansimp
 keywords: hybrid deployment, device account for Surface Hub, Exchange hosted on-prem, Exchange hosted online
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 08/30/2018
 ms.localizationpriority: medium
 ---
 
 # Hybrid deployment (Surface Hub)
-A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-premises](#exchange-on-prem), [Exchange hosted online](#exchange-online), Skype for Business on-premises, Skype for Business online, and Skype for Business hybrid. Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).)
 
->[!NOTE]
->In an Exchange hybrid environment, follow the steps for [Exchange on-premises](#exchange-on-prem). To move Exchange objects to Office 365, use the [New-MoveRequest](https://docs.microsoft.com/powershell/module/exchange/move-and-migration/new-moverequest?view=exchange-ps) cmdlet.
+A hybrid deployment requires special processing to set up a device account for your Microsoft Surface Hub. If you’re using a hybrid deployment, in which your organization has a mix of services, with some hosted on-premises and some hosted online, then your configuration will depend on where each service is hosted. This topic covers hybrid deployments for [Exchange hosted on-premises](#exchange-on-premises), [Exchange hosted online](#exchange-online), Skype for Business on-premises, Skype for Business online, and Skype for Business hybrid. Because there are so many different variations in this type of deployment, it's not possible to provide detailed instructions for all of them. The following process will work for many configurations. If the process isn't right for your setup, we recommend that you use PowerShell (see [Appendix: PowerShell](appendix-a-powershell-scripts-for-surface-hub.md)) to achieve the same end result as documented here, and for other deployment options. You should then use the provided Powershell script to verify your Surface Hub setup. (See [Account Verification Script](appendix-a-powershell-scripts-for-surface-hub.md#acct-verification-ps-scripts).)
+
+> [!NOTE]
+> In an Exchange hybrid environment, follow the steps for [Exchange on-premises](#exchange-on-premises). To move Exchange objects to Office 365, use the [New-MoveRequest](https://docs.microsoft.com/powershell/module/exchange/move-and-migration/new-moverequest?view=exchange-ps) cmdlet.
 
-
 ## Exchange on-premises
+
 Use this procedure if you use Exchange on-premises.
 
-1.  For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account. This account will be synced to Office 365.
+1. For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account. This account will be synced to Office 365.
 
-    - In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**.
-    - Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.
            
-    
-        ![New object box for creating a new user in active directory.](images/hybriddeployment-01a.png)
+- In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**.
+- Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.
            
 
-    - Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
+![New object box for creating a new user in active directory.](images/hybriddeployment-01a.png)
 
-        >**Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
+- Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
 
-        ![Image showing password dialog box.](images/hybriddeployment-02a.png)
-        
-    -   Click **Finish** to create the account.
+> **Important** Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
 
-        ![Image with account name, logon name, and password options for new user.](images/hybriddeployment-03a.png)
+![Image showing password dialog box.](images/hybriddeployment-02a.png)
 
+-   Click **Finish** to create the account.
 
+![Image with account name, logon name, and password options for new user.](images/hybriddeployment-03a.png)
 
-2.  Enable the remote mailbox.
+2. Enable the remote mailbox.
 
-    Open your on-premises Exchange Management Shell with administrator permissions, and run this cmdlet.
+Open your on-premises Exchange Management Shell with administrator permissions, and run this cmdlet.
 
-    ```PowerShell
-    Enable-RemoteMailbox 'HUB01@contoso.com' -RemoteRoutingAddress 'HUB01@contoso.com' -Room
-    ```
-    >[!NOTE]
-    >If you don't have an on-premises Exchange environment to run this cmdlet, you can make the same changes directly to the Active Directory object for the account.
-    >
-    >msExchRemoteRecipientType = 33
-    >
-    >msExchRecipientDisplayType = -2147481850
-    >
-    >msExchRecipientTypeDetails = 8589934592
-    
-3.  After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Office 365 admin center and verify that the account created in the previous steps has merged to online.
-    
-4.  Connect to Microsoft Exchange Online and set some properties for the account in Office 365.
+```PowerShell
+Enable-RemoteMailbox 'HUB01@contoso.com' -RemoteRoutingAddress 'HUB01@contoso.com' -Room
+```
 
-    Start a remote PowerShell session on a PC and connect to Microsoft Exchange. Be sure you have the right permissions set to run the associated cmdlets.
+> [!NOTE]
+> If you don't have an on-premises Exchange environment to run this cmdlet, you can make the same changes directly to the Active Directory object for the account.
+>
+> msExchRemoteRecipientType = 33
+>
+> msExchRecipientDisplayType = -2147481850
+>
+> msExchRecipientTypeDetails = 8589934592
 
-    The next steps will be run on your Office 365 tenant.
+3. After you've created the account, run a directory synchronization. When it's complete, go to the users page in your Microsoft 365 admin center and verify that the account created in the previous steps has merged to online.
 
-    ```PowerShell
-    Set-ExecutionPolicy RemoteSigned
-    $cred=Get-Credential -Message "Please use your Office 365 admin credentials"
-    $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'https://ps.outlook.com/powershell' -Credential $cred -Authentication Basic -AllowRedirection
-    Import-PSSession $sess
-    ```
+4. Connect to Microsoft Exchange Online and set some properties for the account in Office 365.
 
-5.  Create a new Exchange ActiveSync policy, or use a compatible existing policy.
+Start a remote PowerShell session on a PC and connect to Microsoft Exchange. Be sure you have the right permissions set to run the associated cmdlets.
 
-    After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy or use a compatible existing policy.
-    
-    Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
+The next steps will be run on your Office 365 tenant.
 
-    If you haven’t created a compatible policy yet, use the following cmdlet—-this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
+```PowerShell
+Set-ExecutionPolicy RemoteSigned
+$cred=Get-Credential -Message "Please use your Office 365 admin credentials"
+$sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri 'https://ps.outlook.com/powershell' -Credential $cred -Authentication Basic -AllowRedirection
+Import-PSSession $sess
+```
 
-    ```PowerShell
-    $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
-    ```
+5. Create a new Exchange ActiveSync policy, or use a compatible existing policy.
 
-    Once you have a compatible policy, then you will need to apply the policy to the device account. 
+After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy or use a compatible existing policy.
 
-    ```PowerShell
-    Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id
-    ```
+Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
 
-6.  Set Exchange properties.
+If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
 
-    Setting Exchange properties on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
+```PowerShell
+$easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
+```
 
-    ```PowerShell
-    Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
-    Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse 'This is a Surface Hub room!'
-    ```
+Once you have a compatible policy, you will need to apply the policy to the device account. 
 
-7.  Connect to Azure AD.
+```PowerShell
+Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id
+```
 
-	You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command :
-    ```PowerShell
-    Install-Module -Name AzureAD
-    ```
-	
-    You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect.
+6. Set Exchange properties.
 
-    ```PowerShell
-    Import-Module AzureAD
-    Connect-AzureAD -Credential $cred
-    ```
-8.  Assign an Office 365 license.
+Setting Exchange properties on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
 
-    The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account.
- 
-    You can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant.
+```PowerShell
+Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
+Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse 'This is a Surface Hub room!'
+```
 
-    Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable.
+7. Connect to Azure AD.
 
-    ```PowerShell
-    Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US"
-	
-	Get-AzureADSubscribedSku | Select Sku*,*Units
-	$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
-    $License.SkuId = SkuId You selected 
-	
-	$AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
-    $AssignedLicenses.AddLicenses = $License
-    $AssignedLicenses.RemoveLicenses = @()
-	
-    Set-AzureADUserLicense -ObjectId "HUB01@contoso.com"  -AssignedLicenses $AssignedLicenses
-    ```
+You first need to install Azure AD module for PowerShell version 2. In an elevated PowerShell prompt, run the following command:
+
+```PowerShell
+Install-Module -Name AzureAD
+```
+
+You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect.
+
+```PowerShell
+Import-Module AzureAD
+Connect-AzureAD -Credential $cred
+```
+
+8. Assign an Office 365 license.
+
+The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account.
+
+You can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant.
+
+Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable.
+
+```PowerShell
+Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US"
+
+Get-AzureADSubscribedSku | Select Sku*,*Units
+$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
+$License.SkuId = SkuId You selected 
+
+$AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
+$AssignedLicenses.AddLicenses = $License
+$AssignedLicenses.RemoveLicenses = @()
+
+Set-AzureADUserLicense -ObjectId "HUB01@contoso.com"  -AssignedLicenses $AssignedLicenses
+```
 
 Next, you enable the device account with [Skype for Business Online](#skype-for-business-online), [Skype for Business on-premises](#skype-for-business-on-premises), or [Skype for Business hybrid](#skype-for-business-hybrid).
 
-
 ### Skype for Business Online
 
 To enable Skype for Business online, your tenant users must have Exchange mailboxes (at least one Exchange mailbox in the tenant is required). The following table explains which plans or additional services you need.
@@ -147,7 +150,7 @@ To enable Skype for Business online, your tenant users must have Exchange mailbo
 | Initiate an ad-hoc meeting | Skype for Business Standalone Plan 2 | E 1, 3, 4, or 5 | Skype for Business Server Standard CAL or Enterprise CAL |
 | Initiate an ad-hoc meeting and dial out from a meeting to phone numbers | Skype for Business Standalone Plan 2 with Audio Conferencing

            **Note** PSTN consumption billing is optional | E1 or E3 with Audio Conferencing, or E5| Skype for Business Server Standard CAL or Enterprise CAL |
 | Give the room a phone number and make or receive calls from the room or join a dial-in conference using a phone number | Skype for Business Standalone Plan 2 with Phone System and a PSTN Voice Calling plan | E1 or E3 with Phone System and a PSTN Voice Calling plan, or E5 | Skype for Business Server Standard CAL or Plus CAL |
-    
+
 The following table lists the Office 365 plans and Skype for Business options.
 
 | O365 Plan | Skype for Business | Phone System | Audio Conferencing | Calling Plans |
@@ -160,42 +163,42 @@ The following table lists the Office 365 plans and Skype for Business options.
 
 1. Start by creating a remote PowerShell session from a PC to the Skype for Business online environment.
 
-        ```PowerShell
-        Import-Module SkypeOnlineConnector  
-        $cssess=New-CsOnlineSession -Credential $cred  
-        Import-PSSession $cssess -AllowClobber
-        ```
-        
+```PowerShell
+Import-Module SkypeOnlineConnector  
+$cssess=New-CsOnlineSession -Credential $cred  
+Import-PSSession $cssess -AllowClobber
+```
+
 2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
 
-        ```PowerShell
-        Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool 'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName
-        ```
-        
-    If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet:
+```PowerShell
+Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool 'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName
+```
 
-        ```PowerShell
-        Get-CsOnlineUser -Identity ‘HUB01@contoso.com’| fl *registrarpool*
-        ```
+If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet:
+
+```PowerShell
+Get-CsOnlineUser -Identity ‘HUB01@contoso.com’| fl *registrarpool*
+```
 
 3. Assign Skype for Business license to your Surface Hub account.
 
-    Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) to the device.
-    
-    -   Login as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app.
-    
-    -   Click on **Users and Groups** and then **Add users, reset passwords, and more**.
-    
-    -   Click the Surface Hub account, and then click the pen icon to edit the account information.
-    
-    -   Click **Licenses**.
-    
-    -   In **Assign licenses**, select Skype for Business (Plan 1) or Skype for Business (Plan 2), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 2 license if you want to use Enterprise Voice on your Surface Hub.
-    
-    -   Click **Save**.
+ Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) license to the device.
 
-    >[!NOTE]
-    >You can also use the Windows Azure Active Directory Module for Windows Powershell to run the cmdlets needed to assign one of these licenses, but that's not covered here.
+- Login as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app.
+
+- Click on **Users and Groups** and then **Add users, reset passwords, and more**.
+
+- Click the Surface Hub account, and then click the pen icon to edit the account information.
+
+- Click **Licenses**.
+
+- In **Assign licenses**, select Skype for Business (Plan 1) or Skype for Business (Plan 2), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 2 license if you want to use Enterprise Voice on your Surface Hub.
+
+- Click **Save**.
+
+> [!NOTE]
+> You can also use the Windows Azure Active Directory Module for Windows Powershell to run the cmdlets needed to assign one of these licenses, but that's not covered here.
 
 For validation, you should be able to use any Skype for Business client (PC, Android, etc.) to sign in to this account.
 
@@ -203,7 +206,7 @@ For validation, you should be able to use any Skype for Business client (PC, And
 
 To run this cmdlet, you will need to connect to one of the Skype front-ends. Open the Skype PowerShell and run:
 
-```
+```PowerShell
 Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool registrarpoolfqdn -SipAddressType UserPrincipalName 
 ```
 
@@ -215,181 +218,181 @@ The Surface Hub requires a Skype account of the type `meetingroom`, while a norm
 
 In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet.
 
->[!NOTE]
->To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).
+> [!NOTE]
+> To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).
 
 
 ## Exchange online
+
 Use this procedure if you use Exchange online.
 
-1.  Create an email account in Office 365.
+1. Create an email account in Office 365.
 
-    Start a remote PowerShell session on a PC and connect to Exchange. Be sure you have the right permissions set to run the associated cmdlets.
+Start a remote PowerShell session on a PC and connect to Exchange. Be sure you have the right permissions set to run the associated cmdlets.
 
-    ```PowerShell
-    Set-ExecutionPolicy RemoteSigned
-    $cred=Get-Credential -Message "Please use your Office 365 admin credentials"
-    $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/PowerShell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
-    Import-PSSession $sess
-    ```
+```PowerShell
+Set-ExecutionPolicy RemoteSigned
+$cred=Get-Credential -Message "Please use your Office 365 admin credentials"
+$sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/PowerShell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
+Import-PSSession $sess
+```
 
-2.  Set up mailbox.
+2. Set up a mailbox.
 
-    After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub.
+After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub.
 
-    If you're changing an existing resource mailbox:
+If you're changing an existing resource mailbox:
 
-    ```PowerShell
-    Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
-    ```
+```PowerShell
+Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
+```
 
-    If you’re creating a new resource mailbox:
+If you’re creating a new resource mailbox:
 
-    ```PowerShell
-    New-Mailbox -MicrosoftOnlineServicesID 'HUB01@contoso.com' -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
-    ```
+```PowerShell
+New-Mailbox -MicrosoftOnlineServicesID 'HUB01@contoso.com' -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
+```
 
-3.  Create Exchange ActiveSync policy.
+3. Create Exchange ActiveSync policy.
 
-    After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy.
+After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy.
 
-    Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
+Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, Exchange services on the Surface Hub (mail, calendar, and joining meetings) will not be enabled.
 
-    If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
+If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
 
-    ```PowerShell
-    $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
-    ```
+```PowerShell
+$easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
+```
 
-    Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too.
+Once you have a compatible policy, you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too.
 
-    ```PowerShell
-    Set-Mailbox 'HUB01@contoso.com' -Type Regular
-    Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id
-    Set-Mailbox 'HUB01@contoso.com' -Type Room
-    $credNewAccount = Get-Credential -Message "Please provide the Surface Hub username and password"
-    Set-Mailbox 'HUB01@contoso.com' -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true
-    ```
+```PowerShell
+Set-Mailbox 'HUB01@contoso.com' -Type Regular
+Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.id
+Set-Mailbox 'HUB01@contoso.com' -Type Room
+$credNewAccount = Get-Credential -Message "Please provide the Surface Hub username and password"
+Set-Mailbox 'HUB01@contoso.com' -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true
+```
 
-4.  Set Exchange properties.
+4. Set Exchange properties.
 
-    Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
+Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
 
-    ```PowerShell
-    Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
-    Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
-    ```
+```PowerShell
+Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
+Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
+```
 
-5.  Add email address for your on-premises domain account.
+5. Add an email address for your on-premises domain account.
 
-    For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account.
-    
-    - In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**.
-    - Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.
+For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account.
 
-        ![New object box for creating a new user in Active Directory.](images/hybriddeployment-01a.png)
+- In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**.
+- Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**.
 
-    - Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
-    
-        >[!IMPORTANT]
-        >Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
-    
-        ![Image showing password dialog box.](images/hybriddeployment-02a.png)
-    
-    - Click **Finish** to create the account.
+![New object box for creating a new user in Active Directory.](images/hybriddeployment-01a.png)
 
-        ![Image with account name, logon name, and password options for new user.](images/hybriddeployment-03a.png)
+- Type the password for this account. You'll need to retype it for verification. Make sure the **Password never expires** checkbox is the only option selected.
 
-6.  Run directory synchronization.
+> [!IMPORTANT]
+> Selecting **Password never expires** is a requirement for Skype for Business on the Surface Hub. Your domain rules may prohibit passwords that don't expire. If so, you'll need to create an exception for each Surface Hub device account.
 
-    After you've created the account, run a directory synchronization. When it's complete, go to the users page and verify that the two accounts created in the previous steps have merged.
+![Image showing password dialog box.](images/hybriddeployment-02a.png)
 
-7.  Connect to Azure AD.
+- Click **Finish** to create the account.
 
-    You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command :
-    
-    ```PowerShell
-    Install-Module -Name AzureAD
-    ```
-    You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect.
+![Image with account name, logon name, and password options for new user.](images/hybriddeployment-03a.png)
 
-    ```PowerShell
-    Import-Module AzureAD
-    Connect-AzureAD -Credential $cred
-    ```
+6. Run directory synchronization.
 
-8.  Assign an Office 365 license.
+After you've created the account, run a directory synchronization. When it's complete, go to the users page and verify that the two accounts created in the previous steps have merged.
 
-    The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account.
+7. Connect to Azure AD.
 
-    Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant.
+You first need to install Azure AD module for PowerShell version 2. In an elevated PowerShell prompt, run the following command:
 
-    Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable.
+```PowerShell
+Install-Module -Name AzureAD
+```
 
-    ```PowerShell
-    Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US"
-	
-	Get-AzureADSubscribedSku | Select Sku*,*Units
-	$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
-    $License.SkuId = SkuId You selected 
-	
-	$AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
-    $AssignedLicenses.AddLicenses = $License
-    $AssignedLicenses.RemoveLicenses = @()
-	
-    Set-AzureADUserLicense -ObjectId "HUB01@contoso.com"  -AssignedLicenses $AssignedLicenses
-    ```
+You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect:
 
-Next, you enable the device account with [Skype for Business Online](#sfb-online), [Skype for Business on-premises](#sfb-onprem), or [Skype for Business hybrid](#sfb-hybrid).
+```PowerShell
+Import-Module AzureAD
+Connect-AzureAD -Credential $cred
+```
 
+8. Assign an Office 365 license.
 
-### Skype for Business Online    
-    
-In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](#sfb-online).
+The device account needs to have a valid Office 365 (O365) license, or Exchange and Skype for Business will not work. If you have the license, you need to assign a usage location to your device account—this determines what license SKUs are available for your account.
+
+Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant.
+
+Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable.
+
+```PowerShell
+Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US"
+
+Get-AzureADSubscribedSku | Select Sku*,*Units
+$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
+$License.SkuId = SkuId You selected 
+
+$AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
+$AssignedLicenses.AddLicenses = $License
+$AssignedLicenses.RemoveLicenses = @()
+
+Set-AzureADUserLicense -ObjectId "HUB01@contoso.com"  -AssignedLicenses $AssignedLicenses
+```
+
+Next, you enable the device account with [Skype for Business Online](#skype-for-business-online), [Skype for Business on-premises](#skype-for-business-on-premises), or [Skype for Business hybrid](#skype-for-business-hybrid).
+
+### Skype for Business Online
+
+In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](#skype-for-business-online).
 
 1. Start by creating a remote PowerShell session to the Skype for Business online environment from a PC.
 
-   ```PowerShell
-   Import-Module SkypeOnlineConnector  
-   $cssess=New-CsOnlineSession -Credential $cred  
-   Import-PSSession $cssess -AllowClobber
-   ```
+```PowerShell
+Import-Module SkypeOnlineConnector  
+$cssess=New-CsOnlineSession -Credential $cred  
+Import-PSSession $cssess -AllowClobber
+```
 
 2. To enable your Surface Hub account for Skype for Business Server, run this cmdlet:
 
-   ```PowerShell
-   Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool  
-   'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName
-   ```
+```PowerShell
+Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool  
+'sippoolbl20a04.infra.lync.com' -SipAddressType UserPrincipalName
+```
 
    If you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet:
 
-   ```PowerShell
-   Get-CsOnlineUser -Identity 'HUB01@contoso.com'| fl *registrarpool*
-   ```
+```PowerShell
+Get-CsOnlineUser -Identity 'HUB01@contoso.com'| fl *registrarpool*
+```
 
 10. Assign Skype for Business license to your Surface Hub account
 
-    Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) to the device.
+Once you've completed the preceding steps to enable your Surface Hub account in Skype for Business Online, you need to assign a license to the Surface Hub. Using the O365 administrative portal, assign either a Skype for Business Online (Plan 2) or a Skype for Business Online (Plan 3) license to the device.
 
-    - Sign in as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app.
-    
-    - Click on **Users and Groups** and then **Add users, reset passwords, and more**.
-    
-    - Click the Surface Hub account, and then click the pen icon to edit the account information.
-    
-    - Click **Licenses**.
-    
-    - In **Assign licenses**, select Skype for Business (Plan 2) or Skype for Business (Plan 3), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 3 license if you want to use Enterprise Voice on your Surface Hub.
-    
-    - Click **Save**.
+- Sign in as a tenant administrator, open the O365 Administrative Portal, and click on the Admin app.
 
-        >[!NOTE]
-        > You can also use the Windows Azure Active Directory Module for Windows PowerShell to run the cmdlets needed to assign one of these licenses, but that's not covered here.
+- Click on **Users and Groups** and then **Add users, reset passwords, and more**.
+
+- Click the Surface Hub account, and then click the pen icon to edit the account information.
+
+- Click **Licenses**.
+
+- In **Assign licenses**, select Skype for Business (Plan 2) or Skype for Business (Plan 3), depending on your licensing and Enterprise Voice requirements. You'll have to use a Plan 3 license if you want to use Enterprise Voice on your Surface Hub.
+
+- Click **Save**.
+
+> [!NOTE]
+> You can also use the Windows Azure Active Directory Module for Windows PowerShell to run the cmdlets needed to assign one of these licenses, but that's not covered here.
 
 For validation, you should be able to use any Skype for Business client (PC, Android, etc) to sign in to this account.
 
-
 ### Skype for Business on-premises
 
 To run this cmdlet, you will need to connect to one of the Skype front-ends. Open the Skype PowerShell and run:
@@ -398,15 +401,13 @@ To run this cmdlet, you will need to connect to one of the Skype front-ends. Ope
 Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool registrarpoolfqdn -SipAddressType UserPrincipalName 
 ```
 
-
 ### Skype for Business hybrid
 
 If your organization has set up [hybrid connectivity between Skype for Business Server and Skype for Business Online](https://technet.microsoft.com/library/jj205403.aspx), the guidance for creating accounts differs from a standard Surface Hub deployment.
 
 The Surface Hub requires a Skype account of the type *meetingroom*, while a normal user would use a *user* type account in Skype. If your Skype server is set up for hybrid where you might have users on the local Skype server as well as users hosted in Office 365, you might run into a few issues when trying to create a Surface Hub account.
- 
+
 In Skype for Business Server 2015 hybrid environment, any user that you want in Skype for Business Online must first be created in the on-premises deployment, so that the user account is created in Active Directory Domain Services. You can then move the user to Skype for Business Online. The move of a user account from on-premises to online is done via the [Move-CsUser](https://technet.microsoft.com/library/gg398528.aspx) cmdlet. To move a Csmeetingroom object, use the [Move-CsMeetingRoom](https://technet.microsoft.com/library/jj204889.aspx?f=255&mspperror=-2147217396) cmdlet.
 
->[!NOTE]
->To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).
-
+> [!NOTE]
+> To use the Move-CsMeetingRoom cmdlet, you must have installed [the May 2017 cumulative update 6.0.9319.281 for Skype for Business Server 2015](https://support.microsoft.com/help/4020991/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p) or [the July 2017 cumulative update 5.0.8308.992 for Lync Server 2013](https://support.microsoft.com/help/4034279/enables-the-move-csmeetingroom-cmdlet-to-move-a-meeting-room-from-on-p).
diff --git a/devices/surface-hub/images/01-diagnostic.png b/devices/surface-hub/images/01-diagnostic.png
new file mode 100644
index 0000000000..fde5951776
Binary files /dev/null and b/devices/surface-hub/images/01-diagnostic.png differ
diff --git a/devices/surface-hub/images/01-escape.png b/devices/surface-hub/images/01-escape.png
new file mode 100644
index 0000000000..badfc5883d
Binary files /dev/null and b/devices/surface-hub/images/01-escape.png differ
diff --git a/devices/surface-hub/images/02-all-apps.png b/devices/surface-hub/images/02-all-apps.png
new file mode 100644
index 0000000000..a29e9d8428
Binary files /dev/null and b/devices/surface-hub/images/02-all-apps.png differ
diff --git a/devices/surface-hub/images/02-skip-this-drive.png b/devices/surface-hub/images/02-skip-this-drive.png
new file mode 100644
index 0000000000..930f0b26d3
Binary files /dev/null and b/devices/surface-hub/images/02-skip-this-drive.png differ
diff --git a/devices/surface-hub/images/03-recover-from-cloud.png b/devices/surface-hub/images/03-recover-from-cloud.png
new file mode 100644
index 0000000000..be422cecc8
Binary files /dev/null and b/devices/surface-hub/images/03-recover-from-cloud.png differ
diff --git a/devices/surface-hub/images/03-welcome.png b/devices/surface-hub/images/03-welcome.png
new file mode 100644
index 0000000000..b71ebe0752
Binary files /dev/null and b/devices/surface-hub/images/03-welcome.png differ
diff --git a/devices/surface-hub/images/04-test-results-1.png b/devices/surface-hub/images/04-test-results-1.png
new file mode 100644
index 0000000000..e0b53f2dc3
Binary files /dev/null and b/devices/surface-hub/images/04-test-results-1.png differ
diff --git a/devices/surface-hub/images/04-yes.png b/devices/surface-hub/images/04-yes.png
new file mode 100644
index 0000000000..9c26b795ce
Binary files /dev/null and b/devices/surface-hub/images/04-yes.png differ
diff --git a/devices/surface-hub/images/05-test-results-2.png b/devices/surface-hub/images/05-test-results-2.png
new file mode 100644
index 0000000000..55b7c7abed
Binary files /dev/null and b/devices/surface-hub/images/05-test-results-2.png differ
diff --git a/devices/surface-hub/images/05a-reinstall.png b/devices/surface-hub/images/05a-reinstall.png
new file mode 100644
index 0000000000..60d90928ba
Binary files /dev/null and b/devices/surface-hub/images/05a-reinstall.png differ
diff --git a/devices/surface-hub/images/05b-downloading.png b/devices/surface-hub/images/05b-downloading.png
new file mode 100644
index 0000000000..59393e7162
Binary files /dev/null and b/devices/surface-hub/images/05b-downloading.png differ
diff --git a/devices/surface-hub/images/06-account-settings.png b/devices/surface-hub/images/06-account-settings.png
new file mode 100644
index 0000000000..35a92f2ff8
Binary files /dev/null and b/devices/surface-hub/images/06-account-settings.png differ
diff --git a/devices/surface-hub/images/06-out-of-box.png b/devices/surface-hub/images/06-out-of-box.png
new file mode 100644
index 0000000000..a513b46c5b
Binary files /dev/null and b/devices/surface-hub/images/06-out-of-box.png differ
diff --git a/devices/surface-hub/images/07-account-settings-details.png b/devices/surface-hub/images/07-account-settings-details.png
new file mode 100644
index 0000000000..421f372b03
Binary files /dev/null and b/devices/surface-hub/images/07-account-settings-details.png differ
diff --git a/devices/surface-hub/images/07-cancel.png b/devices/surface-hub/images/07-cancel.png
new file mode 100644
index 0000000000..a788960011
Binary files /dev/null and b/devices/surface-hub/images/07-cancel.png differ
diff --git a/devices/surface-hub/images/08-test-account.png b/devices/surface-hub/images/08-test-account.png
new file mode 100644
index 0000000000..d7cbf9620d
Binary files /dev/null and b/devices/surface-hub/images/08-test-account.png differ
diff --git a/devices/surface-hub/images/08-troubleshoot.png b/devices/surface-hub/images/08-troubleshoot.png
new file mode 100644
index 0000000000..d2af1969bd
Binary files /dev/null and b/devices/surface-hub/images/08-troubleshoot.png differ
diff --git a/devices/surface-hub/images/09-network.png b/devices/surface-hub/images/09-network.png
new file mode 100644
index 0000000000..d69f2d67ec
Binary files /dev/null and b/devices/surface-hub/images/09-network.png differ
diff --git a/devices/surface-hub/images/09-recover-from-cloud2.png b/devices/surface-hub/images/09-recover-from-cloud2.png
new file mode 100644
index 0000000000..64650a91bb
Binary files /dev/null and b/devices/surface-hub/images/09-recover-from-cloud2.png differ
diff --git a/devices/surface-hub/images/10-cancel.png b/devices/surface-hub/images/10-cancel.png
new file mode 100644
index 0000000000..ffef745522
Binary files /dev/null and b/devices/surface-hub/images/10-cancel.png differ
diff --git a/devices/surface-hub/images/10-environment.png b/devices/surface-hub/images/10-environment.png
new file mode 100644
index 0000000000..376e077249
Binary files /dev/null and b/devices/surface-hub/images/10-environment.png differ
diff --git a/devices/surface-hub/images/11-certificates.png b/devices/surface-hub/images/11-certificates.png
new file mode 100644
index 0000000000..13b45396b3
Binary files /dev/null and b/devices/surface-hub/images/11-certificates.png differ
diff --git a/devices/surface-hub/images/12-trust-model.png b/devices/surface-hub/images/12-trust-model.png
new file mode 100644
index 0000000000..996bb4fdd4
Binary files /dev/null and b/devices/surface-hub/images/12-trust-model.png differ
diff --git a/devices/surface-hub/images/2s-mount-pattern.png b/devices/surface-hub/images/2s-mount-pattern.png
new file mode 100644
index 0000000000..92262fb428
Binary files /dev/null and b/devices/surface-hub/images/2s-mount-pattern.png differ
diff --git a/devices/surface-hub/images/35mm.png b/devices/surface-hub/images/35mm.png
new file mode 100644
index 0000000000..7a414337b6
Binary files /dev/null and b/devices/surface-hub/images/35mm.png differ
diff --git a/devices/surface-hub/images/analog.png b/devices/surface-hub/images/analog.png
new file mode 100644
index 0000000000..1f1666903b
Binary files /dev/null and b/devices/surface-hub/images/analog.png differ
diff --git a/devices/surface-hub/images/caution.PNG b/devices/surface-hub/images/caution.PNG
new file mode 100644
index 0000000000..0f87b07c0f
Binary files /dev/null and b/devices/surface-hub/images/caution.PNG differ
diff --git a/devices/surface-hub/images/dport.png b/devices/surface-hub/images/dport.png
new file mode 100644
index 0000000000..2842f96ad4
Binary files /dev/null and b/devices/surface-hub/images/dport.png differ
diff --git a/devices/surface-hub/images/dportio.png b/devices/surface-hub/images/dportio.png
new file mode 100644
index 0000000000..02bf145d60
Binary files /dev/null and b/devices/surface-hub/images/dportio.png differ
diff --git a/devices/surface-hub/images/dportout.png b/devices/surface-hub/images/dportout.png
new file mode 100644
index 0000000000..4b6bb87663
Binary files /dev/null and b/devices/surface-hub/images/dportout.png differ
diff --git a/devices/surface-hub/images/h2gen-platemount.png b/devices/surface-hub/images/h2gen-platemount.png
new file mode 100644
index 0000000000..4a8ca76fd4
Binary files /dev/null and b/devices/surface-hub/images/h2gen-platemount.png differ
diff --git a/devices/surface-hub/images/h2gen-railmount.png b/devices/surface-hub/images/h2gen-railmount.png
new file mode 100644
index 0000000000..0c8bf8ffb6
Binary files /dev/null and b/devices/surface-hub/images/h2gen-railmount.png differ
diff --git a/devices/surface-hub/images/hdmi.png b/devices/surface-hub/images/hdmi.png
new file mode 100644
index 0000000000..a2c69ace45
Binary files /dev/null and b/devices/surface-hub/images/hdmi.png differ
diff --git a/devices/surface-hub/images/hub2s-rear.png b/devices/surface-hub/images/hub2s-rear.png
new file mode 100644
index 0000000000..f30a81159c
Binary files /dev/null and b/devices/surface-hub/images/hub2s-rear.png differ
diff --git a/devices/surface-hub/images/hub2s-schematic.png b/devices/surface-hub/images/hub2s-schematic.png
new file mode 100644
index 0000000000..28c328a005
Binary files /dev/null and b/devices/surface-hub/images/hub2s-schematic.png differ
diff --git a/devices/surface-hub/images/iec.png b/devices/surface-hub/images/iec.png
new file mode 100644
index 0000000000..7ca6e9237b
Binary files /dev/null and b/devices/surface-hub/images/iec.png differ
diff --git a/devices/surface-hub/images/key-55.png b/devices/surface-hub/images/key-55.png
new file mode 100644
index 0000000000..d0ee9a5d13
Binary files /dev/null and b/devices/surface-hub/images/key-55.png differ
diff --git a/devices/surface-hub/images/qos-create.png b/devices/surface-hub/images/qos-create.png
new file mode 100644
index 0000000000..7cd4726ddb
Binary files /dev/null and b/devices/surface-hub/images/qos-create.png differ
diff --git a/devices/surface-hub/images/qos-setting.png b/devices/surface-hub/images/qos-setting.png
new file mode 100644
index 0000000000..d775d9a46f
Binary files /dev/null and b/devices/surface-hub/images/qos-setting.png differ
diff --git a/devices/surface-hub/images/replacement-port-55.PNG b/devices/surface-hub/images/replacement-port-55.PNG
new file mode 100644
index 0000000000..5bf0b51b02
Binary files /dev/null and b/devices/surface-hub/images/replacement-port-55.PNG differ
diff --git a/devices/surface-hub/images/replacement-port-84.PNG b/devices/surface-hub/images/replacement-port-84.PNG
new file mode 100644
index 0000000000..45284b4ab9
Binary files /dev/null and b/devices/surface-hub/images/replacement-port-84.PNG differ
diff --git a/devices/surface-hub/images/rj11.png b/devices/surface-hub/images/rj11.png
new file mode 100644
index 0000000000..f044354caa
Binary files /dev/null and b/devices/surface-hub/images/rj11.png differ
diff --git a/devices/surface-hub/images/rj45.png b/devices/surface-hub/images/rj45.png
new file mode 100644
index 0000000000..ca88423217
Binary files /dev/null and b/devices/surface-hub/images/rj45.png differ
diff --git a/devices/surface-hub/images/sh-55-bottom.png b/devices/surface-hub/images/sh-55-bottom.png
new file mode 100644
index 0000000000..3d718d1226
Binary files /dev/null and b/devices/surface-hub/images/sh-55-bottom.png differ
diff --git a/devices/surface-hub/images/sh-55-clearance.png b/devices/surface-hub/images/sh-55-clearance.png
new file mode 100644
index 0000000000..12fc35ec49
Binary files /dev/null and b/devices/surface-hub/images/sh-55-clearance.png differ
diff --git a/devices/surface-hub/images/sh-55-front.png b/devices/surface-hub/images/sh-55-front.png
new file mode 100644
index 0000000000..e1268ee328
Binary files /dev/null and b/devices/surface-hub/images/sh-55-front.png differ
diff --git a/devices/surface-hub/images/sh-55-hand-rear.png b/devices/surface-hub/images/sh-55-hand-rear.png
new file mode 100644
index 0000000000..b1ff007ec2
Binary files /dev/null and b/devices/surface-hub/images/sh-55-hand-rear.png differ
diff --git a/devices/surface-hub/images/sh-55-hand.png b/devices/surface-hub/images/sh-55-hand.png
new file mode 100644
index 0000000000..6f8d96ba8e
Binary files /dev/null and b/devices/surface-hub/images/sh-55-hand.png differ
diff --git a/devices/surface-hub/images/sh-55-rear.png b/devices/surface-hub/images/sh-55-rear.png
new file mode 100644
index 0000000000..840b941e03
Binary files /dev/null and b/devices/surface-hub/images/sh-55-rear.png differ
diff --git a/devices/surface-hub/images/sh-55-top.png b/devices/surface-hub/images/sh-55-top.png
new file mode 100644
index 0000000000..f8c93f5d1b
Binary files /dev/null and b/devices/surface-hub/images/sh-55-top.png differ
diff --git a/devices/surface-hub/images/sh-84-bottom.png b/devices/surface-hub/images/sh-84-bottom.png
new file mode 100644
index 0000000000..d7252537e4
Binary files /dev/null and b/devices/surface-hub/images/sh-84-bottom.png differ
diff --git a/devices/surface-hub/images/sh-84-clearance.png b/devices/surface-hub/images/sh-84-clearance.png
new file mode 100644
index 0000000000..8fd0cd2c32
Binary files /dev/null and b/devices/surface-hub/images/sh-84-clearance.png differ
diff --git a/devices/surface-hub/images/sh-84-front.png b/devices/surface-hub/images/sh-84-front.png
new file mode 100644
index 0000000000..8afa0de18b
Binary files /dev/null and b/devices/surface-hub/images/sh-84-front.png differ
diff --git a/devices/surface-hub/images/sh-84-hand-top.png b/devices/surface-hub/images/sh-84-hand-top.png
new file mode 100644
index 0000000000..1e52446eb0
Binary files /dev/null and b/devices/surface-hub/images/sh-84-hand-top.png differ
diff --git a/devices/surface-hub/images/sh-84-hand.png b/devices/surface-hub/images/sh-84-hand.png
new file mode 100644
index 0000000000..3e84a8a434
Binary files /dev/null and b/devices/surface-hub/images/sh-84-hand.png differ
diff --git a/devices/surface-hub/images/sh-84-rear.png b/devices/surface-hub/images/sh-84-rear.png
new file mode 100644
index 0000000000..5837d4e185
Binary files /dev/null and b/devices/surface-hub/images/sh-84-rear.png differ
diff --git a/devices/surface-hub/images/sh-84-side.png b/devices/surface-hub/images/sh-84-side.png
new file mode 100644
index 0000000000..6b1ad8385b
Binary files /dev/null and b/devices/surface-hub/images/sh-84-side.png differ
diff --git a/devices/surface-hub/images/sh-84-top.png b/devices/surface-hub/images/sh-84-top.png
new file mode 100644
index 0000000000..badc94af0b
Binary files /dev/null and b/devices/surface-hub/images/sh-84-top.png differ
diff --git a/devices/surface-hub/images/sh-84-wall.png b/devices/surface-hub/images/sh-84-wall.png
new file mode 100644
index 0000000000..15d2e5a848
Binary files /dev/null and b/devices/surface-hub/images/sh-84-wall.png differ
diff --git a/devices/surface-hub/images/sh2-account2.png b/devices/surface-hub/images/sh2-account2.png
new file mode 100644
index 0000000000..2a2267ab7c
Binary files /dev/null and b/devices/surface-hub/images/sh2-account2.png differ
diff --git a/devices/surface-hub/images/sh2-account3.png b/devices/surface-hub/images/sh2-account3.png
new file mode 100644
index 0000000000..b67ff0da37
Binary files /dev/null and b/devices/surface-hub/images/sh2-account3.png differ
diff --git a/devices/surface-hub/images/sh2-account4.png b/devices/surface-hub/images/sh2-account4.png
new file mode 100644
index 0000000000..7495f28607
Binary files /dev/null and b/devices/surface-hub/images/sh2-account4.png differ
diff --git a/devices/surface-hub/images/sh2-account5.png b/devices/surface-hub/images/sh2-account5.png
new file mode 100644
index 0000000000..3dc9061733
Binary files /dev/null and b/devices/surface-hub/images/sh2-account5.png differ
diff --git a/devices/surface-hub/images/sh2-add-group.png b/devices/surface-hub/images/sh2-add-group.png
new file mode 100644
index 0000000000..eb44ad8cf9
Binary files /dev/null and b/devices/surface-hub/images/sh2-add-group.png differ
diff --git a/devices/surface-hub/images/sh2-add-room.png b/devices/surface-hub/images/sh2-add-room.png
new file mode 100644
index 0000000000..c53ee340bc
Binary files /dev/null and b/devices/surface-hub/images/sh2-add-room.png differ
diff --git a/devices/surface-hub/images/sh2-apps-assign.png b/devices/surface-hub/images/sh2-apps-assign.png
new file mode 100644
index 0000000000..f6a91864c8
Binary files /dev/null and b/devices/surface-hub/images/sh2-apps-assign.png differ
diff --git a/devices/surface-hub/images/sh2-assign-group.png b/devices/surface-hub/images/sh2-assign-group.png
new file mode 100644
index 0000000000..a2d79bcd34
Binary files /dev/null and b/devices/surface-hub/images/sh2-assign-group.png differ
diff --git a/devices/surface-hub/images/sh2-cartridge.png b/devices/surface-hub/images/sh2-cartridge.png
new file mode 100644
index 0000000000..3c7a2e83be
Binary files /dev/null and b/devices/surface-hub/images/sh2-cartridge.png differ
diff --git a/devices/surface-hub/images/sh2-config-file.png b/devices/surface-hub/images/sh2-config-file.png
new file mode 100644
index 0000000000..d8293c8ff6
Binary files /dev/null and b/devices/surface-hub/images/sh2-config-file.png differ
diff --git a/devices/surface-hub/images/sh2-deploy-apps-sync.png b/devices/surface-hub/images/sh2-deploy-apps-sync.png
new file mode 100644
index 0000000000..060c29c17f
Binary files /dev/null and b/devices/surface-hub/images/sh2-deploy-apps-sync.png differ
diff --git a/devices/surface-hub/images/sh2-keepout-zones.png b/devices/surface-hub/images/sh2-keepout-zones.png
new file mode 100644
index 0000000000..bf318963df
Binary files /dev/null and b/devices/surface-hub/images/sh2-keepout-zones.png differ
diff --git a/devices/surface-hub/images/sh2-keypad.png b/devices/surface-hub/images/sh2-keypad.png
new file mode 100644
index 0000000000..595bb19341
Binary files /dev/null and b/devices/surface-hub/images/sh2-keypad.png differ
diff --git a/devices/surface-hub/images/sh2-mobile-stand.png b/devices/surface-hub/images/sh2-mobile-stand.png
new file mode 100644
index 0000000000..75c64f06f3
Binary files /dev/null and b/devices/surface-hub/images/sh2-mobile-stand.png differ
diff --git a/devices/surface-hub/images/sh2-mount-config.png b/devices/surface-hub/images/sh2-mount-config.png
new file mode 100644
index 0000000000..5cde6108a1
Binary files /dev/null and b/devices/surface-hub/images/sh2-mount-config.png differ
diff --git a/devices/surface-hub/images/sh2-onscreen-display.png b/devices/surface-hub/images/sh2-onscreen-display.png
new file mode 100644
index 0000000000..4605f50734
Binary files /dev/null and b/devices/surface-hub/images/sh2-onscreen-display.png differ
diff --git a/devices/surface-hub/images/sh2-pen-pressure.png b/devices/surface-hub/images/sh2-pen-pressure.png
new file mode 100644
index 0000000000..67054ca972
Binary files /dev/null and b/devices/surface-hub/images/sh2-pen-pressure.png differ
diff --git a/devices/surface-hub/images/sh2-pen.png b/devices/surface-hub/images/sh2-pen.png
new file mode 100644
index 0000000000..1a95b9581e
Binary files /dev/null and b/devices/surface-hub/images/sh2-pen.png differ
diff --git a/devices/surface-hub/images/sh2-ports.png b/devices/surface-hub/images/sh2-ports.png
new file mode 100644
index 0000000000..2d30422911
Binary files /dev/null and b/devices/surface-hub/images/sh2-ports.png differ
diff --git a/devices/surface-hub/images/sh2-proxy.png b/devices/surface-hub/images/sh2-proxy.png
new file mode 100644
index 0000000000..81946a9906
Binary files /dev/null and b/devices/surface-hub/images/sh2-proxy.png differ
diff --git a/devices/surface-hub/images/sh2-reset.png b/devices/surface-hub/images/sh2-reset.png
new file mode 100644
index 0000000000..06b306ec5d
Binary files /dev/null and b/devices/surface-hub/images/sh2-reset.png differ
diff --git a/devices/surface-hub/images/sh2-run1.png b/devices/surface-hub/images/sh2-run1.png
new file mode 100644
index 0000000000..15aa540166
Binary files /dev/null and b/devices/surface-hub/images/sh2-run1.png differ
diff --git a/devices/surface-hub/images/sh2-run10.png b/devices/surface-hub/images/sh2-run10.png
new file mode 100644
index 0000000000..5e980fa334
Binary files /dev/null and b/devices/surface-hub/images/sh2-run10.png differ
diff --git a/devices/surface-hub/images/sh2-run11.png b/devices/surface-hub/images/sh2-run11.png
new file mode 100644
index 0000000000..02362bc5da
Binary files /dev/null and b/devices/surface-hub/images/sh2-run11.png differ
diff --git a/devices/surface-hub/images/sh2-run12.png b/devices/surface-hub/images/sh2-run12.png
new file mode 100644
index 0000000000..f619ac4c42
Binary files /dev/null and b/devices/surface-hub/images/sh2-run12.png differ
diff --git a/devices/surface-hub/images/sh2-run13.png b/devices/surface-hub/images/sh2-run13.png
new file mode 100644
index 0000000000..77b9e3e2a6
Binary files /dev/null and b/devices/surface-hub/images/sh2-run13.png differ
diff --git a/devices/surface-hub/images/sh2-run14.png b/devices/surface-hub/images/sh2-run14.png
new file mode 100644
index 0000000000..d88ca872ca
Binary files /dev/null and b/devices/surface-hub/images/sh2-run14.png differ
diff --git a/devices/surface-hub/images/sh2-run2.png b/devices/surface-hub/images/sh2-run2.png
new file mode 100644
index 0000000000..fd379b2b05
Binary files /dev/null and b/devices/surface-hub/images/sh2-run2.png differ
diff --git a/devices/surface-hub/images/sh2-run3.png b/devices/surface-hub/images/sh2-run3.png
new file mode 100644
index 0000000000..8171beecbf
Binary files /dev/null and b/devices/surface-hub/images/sh2-run3.png differ
diff --git a/devices/surface-hub/images/sh2-run4.png b/devices/surface-hub/images/sh2-run4.png
new file mode 100644
index 0000000000..1a132dfebb
Binary files /dev/null and b/devices/surface-hub/images/sh2-run4.png differ
diff --git a/devices/surface-hub/images/sh2-run5.png b/devices/surface-hub/images/sh2-run5.png
new file mode 100644
index 0000000000..ebfe53f3cb
Binary files /dev/null and b/devices/surface-hub/images/sh2-run5.png differ
diff --git a/devices/surface-hub/images/sh2-run6.png b/devices/surface-hub/images/sh2-run6.png
new file mode 100644
index 0000000000..896531f4ec
Binary files /dev/null and b/devices/surface-hub/images/sh2-run6.png differ
diff --git a/devices/surface-hub/images/sh2-run7.png b/devices/surface-hub/images/sh2-run7.png
new file mode 100644
index 0000000000..59e60d84de
Binary files /dev/null and b/devices/surface-hub/images/sh2-run7.png differ
diff --git a/devices/surface-hub/images/sh2-run8.png b/devices/surface-hub/images/sh2-run8.png
new file mode 100644
index 0000000000..ec2daf8e4f
Binary files /dev/null and b/devices/surface-hub/images/sh2-run8.png differ
diff --git a/devices/surface-hub/images/sh2-run9.png b/devices/surface-hub/images/sh2-run9.png
new file mode 100644
index 0000000000..5bd3abea88
Binary files /dev/null and b/devices/surface-hub/images/sh2-run9.png differ
diff --git a/devices/surface-hub/images/sh2-set-intune1.png b/devices/surface-hub/images/sh2-set-intune1.png
new file mode 100644
index 0000000000..9993225210
Binary files /dev/null and b/devices/surface-hub/images/sh2-set-intune1.png differ
diff --git a/devices/surface-hub/images/sh2-set-intune3.png b/devices/surface-hub/images/sh2-set-intune3.png
new file mode 100644
index 0000000000..f931d828fc
Binary files /dev/null and b/devices/surface-hub/images/sh2-set-intune3.png differ
diff --git a/devices/surface-hub/images/sh2-set-intune5.png b/devices/surface-hub/images/sh2-set-intune5.png
new file mode 100644
index 0000000000..9afb1c1445
Binary files /dev/null and b/devices/surface-hub/images/sh2-set-intune5.png differ
diff --git a/devices/surface-hub/images/sh2-set-intune6.png b/devices/surface-hub/images/sh2-set-intune6.png
new file mode 100644
index 0000000000..155cbb9930
Binary files /dev/null and b/devices/surface-hub/images/sh2-set-intune6.png differ
diff --git a/devices/surface-hub/images/sh2-set-intune8.png b/devices/surface-hub/images/sh2-set-intune8.png
new file mode 100644
index 0000000000..a8d9bfe874
Binary files /dev/null and b/devices/surface-hub/images/sh2-set-intune8.png differ
diff --git a/devices/surface-hub/images/sh2-setup-1.png b/devices/surface-hub/images/sh2-setup-1.png
new file mode 100644
index 0000000000..1204020f9f
Binary files /dev/null and b/devices/surface-hub/images/sh2-setup-1.png differ
diff --git a/devices/surface-hub/images/sh2-setup-2.png b/devices/surface-hub/images/sh2-setup-2.png
new file mode 100644
index 0000000000..0d6501782b
Binary files /dev/null and b/devices/surface-hub/images/sh2-setup-2.png differ
diff --git a/devices/surface-hub/images/sh2-setup-3.png b/devices/surface-hub/images/sh2-setup-3.png
new file mode 100644
index 0000000000..2b827f4405
Binary files /dev/null and b/devices/surface-hub/images/sh2-setup-3.png differ
diff --git a/devices/surface-hub/images/sh2-setup-4.png b/devices/surface-hub/images/sh2-setup-4.png
new file mode 100644
index 0000000000..0825dadce4
Binary files /dev/null and b/devices/surface-hub/images/sh2-setup-4.png differ
diff --git a/devices/surface-hub/images/sh2-thermal-audio.png b/devices/surface-hub/images/sh2-thermal-audio.png
new file mode 100644
index 0000000000..5d9640df9b
Binary files /dev/null and b/devices/surface-hub/images/sh2-thermal-audio.png differ
diff --git a/devices/surface-hub/images/sh2-token.png b/devices/surface-hub/images/sh2-token.png
new file mode 100644
index 0000000000..115153a767
Binary files /dev/null and b/devices/surface-hub/images/sh2-token.png differ
diff --git a/devices/surface-hub/images/sh2-token2.png b/devices/surface-hub/images/sh2-token2.png
new file mode 100644
index 0000000000..324bc27f63
Binary files /dev/null and b/devices/surface-hub/images/sh2-token2.png differ
diff --git a/devices/surface-hub/images/sh2-token3.png b/devices/surface-hub/images/sh2-token3.png
new file mode 100644
index 0000000000..04e173d391
Binary files /dev/null and b/devices/surface-hub/images/sh2-token3.png differ
diff --git a/devices/surface-hub/images/sh2-uefi1.png b/devices/surface-hub/images/sh2-uefi1.png
new file mode 100644
index 0000000000..ecb5aad455
Binary files /dev/null and b/devices/surface-hub/images/sh2-uefi1.png differ
diff --git a/devices/surface-hub/images/sh2-uefi10.png b/devices/surface-hub/images/sh2-uefi10.png
new file mode 100644
index 0000000000..eafc0617a2
Binary files /dev/null and b/devices/surface-hub/images/sh2-uefi10.png differ
diff --git a/devices/surface-hub/images/sh2-uefi2.png b/devices/surface-hub/images/sh2-uefi2.png
new file mode 100644
index 0000000000..8dbcb3df84
Binary files /dev/null and b/devices/surface-hub/images/sh2-uefi2.png differ
diff --git a/devices/surface-hub/images/sh2-uefi3.png b/devices/surface-hub/images/sh2-uefi3.png
new file mode 100644
index 0000000000..f9b0fdb754
Binary files /dev/null and b/devices/surface-hub/images/sh2-uefi3.png differ
diff --git a/devices/surface-hub/images/sh2-uefi4.png b/devices/surface-hub/images/sh2-uefi4.png
new file mode 100644
index 0000000000..ae6f427772
Binary files /dev/null and b/devices/surface-hub/images/sh2-uefi4.png differ
diff --git a/devices/surface-hub/images/sh2-uefi5.png b/devices/surface-hub/images/sh2-uefi5.png
new file mode 100644
index 0000000000..18a780074f
Binary files /dev/null and b/devices/surface-hub/images/sh2-uefi5.png differ
diff --git a/devices/surface-hub/images/sh2-uefi6.png b/devices/surface-hub/images/sh2-uefi6.png
new file mode 100644
index 0000000000..7b4390574a
Binary files /dev/null and b/devices/surface-hub/images/sh2-uefi6.png differ
diff --git a/devices/surface-hub/images/sh2-uefi7.png b/devices/surface-hub/images/sh2-uefi7.png
new file mode 100644
index 0000000000..0302b41a43
Binary files /dev/null and b/devices/surface-hub/images/sh2-uefi7.png differ
diff --git a/devices/surface-hub/images/sh2-uefi8.png b/devices/surface-hub/images/sh2-uefi8.png
new file mode 100644
index 0000000000..c5ccc27628
Binary files /dev/null and b/devices/surface-hub/images/sh2-uefi8.png differ
diff --git a/devices/surface-hub/images/sh2-uefi9.png b/devices/surface-hub/images/sh2-uefi9.png
new file mode 100644
index 0000000000..4747c398c8
Binary files /dev/null and b/devices/surface-hub/images/sh2-uefi9.png differ
diff --git a/devices/surface-hub/images/sh2-wall-front.png b/devices/surface-hub/images/sh2-wall-front.png
new file mode 100644
index 0000000000..349e124bb0
Binary files /dev/null and b/devices/surface-hub/images/sh2-wall-front.png differ
diff --git a/devices/surface-hub/images/sh2-wall-side.png b/devices/surface-hub/images/sh2-wall-side.png
new file mode 100644
index 0000000000..f09cbda81e
Binary files /dev/null and b/devices/surface-hub/images/sh2-wall-side.png differ
diff --git a/devices/surface-hub/images/sh2-wcd.png b/devices/surface-hub/images/sh2-wcd.png
new file mode 100644
index 0000000000..8a945dfca4
Binary files /dev/null and b/devices/surface-hub/images/sh2-wcd.png differ
diff --git a/devices/surface-hub/images/ssd-click.PNG b/devices/surface-hub/images/ssd-click.PNG
new file mode 100644
index 0000000000..5dfcc57c42
Binary files /dev/null and b/devices/surface-hub/images/ssd-click.PNG differ
diff --git a/devices/surface-hub/images/ssd-lift-door.PNG b/devices/surface-hub/images/ssd-lift-door.PNG
new file mode 100644
index 0000000000..d395ce91aa
Binary files /dev/null and b/devices/surface-hub/images/ssd-lift-door.PNG differ
diff --git a/devices/surface-hub/images/ssd-location.PNG b/devices/surface-hub/images/ssd-location.PNG
new file mode 100644
index 0000000000..9b774456b1
Binary files /dev/null and b/devices/surface-hub/images/ssd-location.PNG differ
diff --git a/devices/surface-hub/images/ssd-lock-tab.PNG b/devices/surface-hub/images/ssd-lock-tab.PNG
new file mode 100644
index 0000000000..17c11dc7a2
Binary files /dev/null and b/devices/surface-hub/images/ssd-lock-tab.PNG differ
diff --git a/devices/surface-hub/images/ssd-pull-tab.PNG b/devices/surface-hub/images/ssd-pull-tab.PNG
new file mode 100644
index 0000000000..a306f08a13
Binary files /dev/null and b/devices/surface-hub/images/ssd-pull-tab.PNG differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-1.png b/devices/surface-hub/images/surface-hub-2s-repack-1.png
new file mode 100644
index 0000000000..cab6f33cb7
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-1.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-10.png b/devices/surface-hub/images/surface-hub-2s-repack-10.png
new file mode 100644
index 0000000000..7f3c6ab51c
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-10.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-11.png b/devices/surface-hub/images/surface-hub-2s-repack-11.png
new file mode 100644
index 0000000000..0e0485056a
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-11.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-12.png b/devices/surface-hub/images/surface-hub-2s-repack-12.png
new file mode 100644
index 0000000000..7032cbc1b7
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-12.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-13.png b/devices/surface-hub/images/surface-hub-2s-repack-13.png
new file mode 100644
index 0000000000..465ce22bee
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-13.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-2.png b/devices/surface-hub/images/surface-hub-2s-repack-2.png
new file mode 100644
index 0000000000..f8fbc235b6
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-2.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-3.png b/devices/surface-hub/images/surface-hub-2s-repack-3.png
new file mode 100644
index 0000000000..e270326ab9
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-3.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-4.png b/devices/surface-hub/images/surface-hub-2s-repack-4.png
new file mode 100644
index 0000000000..42bc3a0389
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-4.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-5.png b/devices/surface-hub/images/surface-hub-2s-repack-5.png
new file mode 100644
index 0000000000..d6457cd161
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-5.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-6.png b/devices/surface-hub/images/surface-hub-2s-repack-6.png
new file mode 100644
index 0000000000..73b8a14630
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-6.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-7.png b/devices/surface-hub/images/surface-hub-2s-repack-7.png
new file mode 100644
index 0000000000..54a20e2257
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-7.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-8.png b/devices/surface-hub/images/surface-hub-2s-repack-8.png
new file mode 100644
index 0000000000..f2dcac60ed
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-8.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-repack-9.png b/devices/surface-hub/images/surface-hub-2s-repack-9.png
new file mode 100644
index 0000000000..c067cbf1d8
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-repack-9.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-replace-camera-1.png b/devices/surface-hub/images/surface-hub-2s-replace-camera-1.png
new file mode 100644
index 0000000000..10530cba1e
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-replace-camera-1.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-replace-camera-2.png b/devices/surface-hub/images/surface-hub-2s-replace-camera-2.png
new file mode 100644
index 0000000000..119dc21a5a
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-replace-camera-2.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-1.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-1.png
new file mode 100644
index 0000000000..ceebc3d5fd
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-1.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-10.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-10.png
new file mode 100644
index 0000000000..77ab33c1d5
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-10.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-2.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-2.png
new file mode 100644
index 0000000000..3cf6d0ec62
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-2.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-3.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-3.png
new file mode 100644
index 0000000000..d44ad9d37c
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-3.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-4.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-4.png
new file mode 100644
index 0000000000..ffbec86f57
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-4.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-5.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-5.png
new file mode 100644
index 0000000000..90ddf71366
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-5.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-6.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-6.png
new file mode 100644
index 0000000000..5020d16853
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-6.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-7.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-7.png
new file mode 100644
index 0000000000..9ea535dff4
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-7.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-8.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-8.png
new file mode 100644
index 0000000000..1a64ae0ebb
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-8.png differ
diff --git a/devices/surface-hub/images/surface-hub-2s-replace-cartridge-9.png b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-9.png
new file mode 100644
index 0000000000..9d9bc52c66
Binary files /dev/null and b/devices/surface-hub/images/surface-hub-2s-replace-cartridge-9.png differ
diff --git a/devices/surface-hub/images/switch.png b/devices/surface-hub/images/switch.png
new file mode 100644
index 0000000000..5ea0d21909
Binary files /dev/null and b/devices/surface-hub/images/switch.png differ
diff --git a/devices/surface-hub/images/usb.png b/devices/surface-hub/images/usb.png
new file mode 100644
index 0000000000..a743c6b634
Binary files /dev/null and b/devices/surface-hub/images/usb.png differ
diff --git a/devices/surface-hub/images/vga.png b/devices/surface-hub/images/vga.png
new file mode 100644
index 0000000000..016b42d1f4
Binary files /dev/null and b/devices/surface-hub/images/vga.png differ
diff --git a/devices/surface-hub/images/~$rface-hub-site-readiness-guide-en-us.docx b/devices/surface-hub/images/~$rface-hub-site-readiness-guide-en-us.docx
new file mode 100644
index 0000000000..1d44312447
Binary files /dev/null and b/devices/surface-hub/images/~$rface-hub-site-readiness-guide-en-us.docx differ
diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md
index f91b3e81bf..f60588a000 100644
--- a/devices/surface-hub/index.md
+++ b/devices/surface-hub/index.md
@@ -1,61 +1,182 @@
 ---
-title: Microsoft Surface Hub admin guide
-description: Documents related to the Microsoft Surface Hub.
-ms.assetid: 69C99E91-1441-4318-BCAF-FE8207420555
+title: Surface Hub
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+layout: LandingPage
 ms.prod: surface-hub
-ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
-ms.topic: article
-ms.date: 09/07/2017
-ms.localizationpriority: medium
+ms.tgt_pltfrm: na
+ms.devlang: na
+ms.topic: landing-page
+description: "Get started with Microsoft Surface Hub."
+ms.localizationpriority: High
+---
+# Get started with Surface Hub
+
+Surface Hub 2S is an all-in-one digital interactive whiteboard, meetings platform, and collaborative computing device that brings the power of Windows 10 to team collaboration. Use the links below to learn how to plan, deploy, manage, and support your Surface Hub devices.
+
+
            
+
+
+
 ---
 
-# Microsoft Surface Hub admin guide
-
->[Looking for the Surface Hub admin guide for Windows 10, version 1607?](https://download.microsoft.com/download/7/2/5/7252051B-7E97-4781-B5DF-58D4B1A4BB88/surface-hub-admin-guide-1607.pdf)
-
->[Looking for the user's guide for Surface Hub?](https://download.microsoft.com/download/3/6/B/36B6331E-0C63-4E71-A05D-EE88D05081F8/surface-hub-user-guide-en-us.pdf)
-
-
-
            Microsoft Surface Hub is an all-in-one productivity device that is intended for brainstorming, collaboration, and presentations. In order to get the maximum benefit from Surface Hub, your organization’s infrastructure and the Surface Hub itself must be properly set up and integrated. The documentation in this library describes what needs to be done both before and during setup in order to help you optimize your use of the device.![image of a Surface Hub](images/surfacehub.png) 
            
- 
-
-## Surface Hub setup process
-
-In some ways, adding your new Surface Hub is just like adding any other Microsoft Windows-based device to your network. However, in order to get your Surface Hub up and running at its full capacity, there are some very specific requirements. Here are the next topics you'll need:
-
-1. [Prepare your environment for Surface Hub](prepare-your-environment-for-surface-hub.md)
-2. [Gather the information listed in the Setup worksheet](setup-worksheet-surface-hub.md)
-2. [Physically install your Surface Hub device](physically-install-your-surface-hub-device.md)
-3. [Run the Surface Hub first-run setup program (OOBE)](first-run-program-surface-hub.md)
-
-
-
-## In this section
-
-| Topic | Description |
-| --- | --- |
-| [What's new in Windows 10, version 1703 for Surface Hub?](surfacehub-whats-new-1703.md) | Discover the changes and improvements for Microsoft Surface Hub in the Windows 10, version 1703 release (also known as Creators Update). |
-| [Differences between Surface Hub and Windows 10 Enterprise](differences-between-surface-hub-and-windows-10-enterprise.md) | This topic explains the differences between the operating system on Surface Hub and Windows 10 Enterprise. |
-| [Prepare your environment for Microsoft Surface Hub](prepare-your-environment-for-surface-hub.md) | This section contains an overview of the steps required to prepare your environment so that you can use all of the features of Surface Hub. See [Intro to Surface Hub](intro-to-surface-hub.md) for a description of how the device and its features interact with your IT environment. |
-| [Set up Microsoft Surface Hub](set-up-your-surface-hub.md) | Set up instructions for Surface Hub include a setup worksheet, and a walkthrough of the first-run program. |
-| [Manage Microsoft Surface Hub](manage-surface-hub.md) | How to manage your Surface Hub after finishing the first-run program. |
-| [PowerShell for Surface Hub](appendix-a-powershell-scripts-for-surface-hub.md) |
-| [How Surface Hub addresses Wi-Fi Direct security issues](surface-hub-wifi-direct.md) | This topic provides guidance on Wi-Fi Direct security risks, how the Surface Hub has addressed those risks, and how Surface Hub administrators can configure the device for the highest level of security.  | PowerShell scripts to help set up and manage your Surface Hub. |
-| [Top support solutions for Surface Hub](support-solutions-surface-hub.md) | These are the top Microsoft Support solutions for common issues experienced using Surface Hub. |
-| [Troubleshoot Microsoft Surface Hub](troubleshoot-surface-hub.md) | Troubleshoot common problems, including setup issues, Exchange ActiveSync errors. |
-| [Troubleshoot Miracast on Surface Hub](miracast-troubleshooting.md) | Learn how to resolve Miracast issues. |
-| [Useful downloads for Surface Hub administrators](surface-hub-downloads.md) | This topic provides links to useful Surface Hub documents, such as product datasheets, the site readiness guide, and user's guide. |
-| [Change history for Surface Hub](change-history-surface-hub.md) | This topic lists new and updated topics in the Surface Hub documentation library. |
-
-
-
-## Additional resources
-
-- [Surface Hub update history](https://support.microsoft.com/help/4037666/surface-surface-hub-update-history)
-- [Surface Hub help](https://support.microsoft.com/hub/4343507/surface-hub-help)
-- [Surface IT Pro Blog](https://blogs.technet.microsoft.com/surface/)
-- [Surface Playlist of videos](https://www.youtube.com/playlist?list=PLXtHYVsvn_b__1Baibdu4elN4SoF3JTBZ)
-- [Microsoft Surface on Twitter](https://twitter.com/surface)
-
+
\ No newline at end of file
diff --git a/devices/surface-hub/install-apps-on-surface-hub.md b/devices/surface-hub/install-apps-on-surface-hub.md
index 847625be1f..74505ca6ff 100644
--- a/devices/surface-hub/install-apps-on-surface-hub.md
+++ b/devices/surface-hub/install-apps-on-surface-hub.md
@@ -2,14 +2,17 @@
 title: Install apps on your Microsoft Surface Hub
 description: Admins can install apps can from either the Microsoft Store or the Microsoft Store for Business.
 ms.assetid: 3885CB45-D496-4424-8533-C9E3D0EDFD94
+ms.reviewer: 
+manager: dansimp
 keywords: install apps, Microsoft Store, Microsoft Store for Business
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 10/23/2018
 ms.localizationpriority: medium
+audience: ITPro
 ---
 
 # Install apps on your Microsoft Surface Hub
@@ -17,9 +20,9 @@ ms.localizationpriority: medium
 You can install additional apps on your Surface Hub to fit your team or organization's needs. There are different methods for installing apps depending on whether you are developing and testing an app, or deploying a released app. This topic describes methods for installing apps for either scenario.
 
 A few things to know about apps on Surface Hub:
-- Surface Hub only runs [Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/windows/uwp/get-started/whats-a-uwp). Apps created using the [Desktop App Converter](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) will not run on Surface Hub. See a [list of apps that work with Surface Hub](https://support.microsoft.com/help/4040382/surface-Apps-that-work-with-Microsoft-Surface-Hub).
+- Surface Hub only runs [Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/windows/uwp/get-started/whats-a-uwp). Apps created using the [Desktop App Converter](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) will not run on Surface Hub.
 - Apps must be targeted for the [Universal device family](https://msdn.microsoft.com/library/windows/apps/dn894631) or Windows Team device family.
-- Surface Hub only supports [offline-licensed apps](https://docs.microsoft.com/microsoft-store/distribute-offline-apps) from Microsoft Store for Business.
+- Surface Hub only supports [offline-licensed apps](https://docs.microsoft.com/microsoft-store/distribute-offline-apps) from [Microsoft Store for Business](https://businessstore.microsoft.com/store).
 - By default, apps must be Store-signed to be installed. During testing and development, you can also choose to run developer-signed UWP apps by placing the device in developer mode.
 - When submitting an app to the Microsoft Store, developers need to set Device family availability and Organizational licensing options to make sure an app will be available to run on Surface Hub.
 - You need admin credentials to install apps on your Surface Hub. Since the device is designed to be used in communal spaces like meeting rooms, people can't access the Microsoft Store to download and install apps.
@@ -37,10 +40,10 @@ By enabling developer mode, you can also install developer-signed UWP apps.
 > After developer mode has been enabled, you will need to reset the Surface Hub to disable it. Resetting the device removes all local user files and configurations and then reinstalls Windows.
 
 **To turn on developer mode** 
-1.	From your Surface Hub, start **Settings**.
-2.	Type the device admin credentials when prompted.
-3.	Navigate to **Update & security** > **For developers**.
-4.	Select **Developer mode** and accept the warning prompt.
+1. From your Surface Hub, start **Settings**.
+2. Type the device admin credentials when prompted.
+3. Navigate to **Update & security** > **For developers**.
+4. Select **Developer mode** and accept the warning prompt.
 
 ### Visual Studio
 During development, the easiest way to test your app on a Surface Hub is using Visual Studio. Visual Studio's remote debugging feature helps you discover issues in your app before deploying it broadly. For more information, see [Test Surface Hub apps using Visual Studio](https://msdn.microsoft.com/windows/uwp/debug-test-perf/test-surface-hub-apps-using-visual-studio).
@@ -99,10 +102,10 @@ To evaluate apps released on the Microsoft Store, use the Microsoft Store app on
 > - To install apps, you will need to manually sign in to the Microsoft Store app on each Surface Hub you own.
 
 **To browse the Microsoft Store on Surface Hub** 
-1.	From your Surface Hub, start **Settings**.
-2.	Type the device admin credentials when prompted.
-3.	Navigate to **This device** > **Apps & features**.
-4.	Select **Open Store**.
+1. From your Surface Hub, start **Settings**.
+2. Type the device admin credentials when prompted.
+3. Navigate to **This device** > **Apps & features**.
+4. Select **Open Store**.
 
 ### Download app packages from Microsoft Store for Business
 To download the app package you need to install apps on your Surface Hub, visit the [Microsoft Store for Business](https://www.microsoft.com/business-store). The Store for Business is where you can find, acquire, and manage apps for the Windows 10 devices in your organization, including Surface Hub.
@@ -126,17 +129,16 @@ To deploy apps to a large number of Surface Hubs in your organization, use a sup
 
 | MDM provider                | Supports offline-licensed app packages |
 |-----------------------------|----------------------------------------|
-| On-premises MDM with System Center Configuration Manager (beginning in version 1602) | Yes |
-| Hybrid MDM with System Center Configuration Manager and Microsoft Intune | Yes |
-| [Microsoft Intune standalone](https://docs.microsoft.com/intune/windows-store-for-business) | Yes |
+| On-premises MDM with  Configuration Manager (beginning in version 1602) | Yes |
+|
 | Third-party MDM provider    | Check to make sure your MDM provider supports deploying offline-licensed app packages. |
 
-**To deploy apps remotely using System Center Configuration Manager (either on-prem MDM or hybrid MDM)**
+**To deploy apps remotely using Microsoft Endpoint Configuration Manager**
 
 > [!NOTE]
-> These instructions are based on the current branch of System Center Configuration Manager.
+> These instructions are based on the current branch of Microsoft Endpoint Configuration Manager.
 
-1. Enroll your Surface Hubs to System Center Configuration Manager. For more information, see [Enroll a Surface Hub into MDM](manage-settings-with-mdm-for-surface-hub.md#enroll-into-mdm).
+1. Enroll your Surface Hubs to Configuration Manager. For more information, see [Enroll a Surface Hub into MDM](manage-settings-with-mdm-for-surface-hub.md#enroll-into-mdm).
 2. Download the offline-licensed app package, the *encoded* license file, and any necessary dependency files from the Store for Business. For more information, see [Download an offline-licensed app](https://technet.microsoft.com/itpro/windows/manage/distribute-offline-apps#download-an-offline-licensed-app). Place the downloaded files in the same folder on a network share.
 3. In the **Software Library** workspace of the Configuration Manager console, click **Overview** > **Application Management** > **Applications**.
 4. On the **Home** tab, in the **Create** group, click **Create Application**.
@@ -147,16 +149,16 @@ To deploy apps to a large number of Surface Hubs in your organization, use a sup
 9. On the **General Information** page, complete additional details about the app. Some of this information might already be populated if it was automatically obtained from the app package.
 10. Click **Next**, review the application information on the Summary page, and then complete the Create Application Wizard. 
 11. Create a deployment type for the application. For more information, see [Create deployment types for the application](https://docs.microsoft.com/sccm/apps/deploy-use/create-applications#create-deployment-types-for-the-application).
-12. Deploy the application to your Surface Hubs. For more information, see [Deploy applications with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/deploy-applications).
-13. As needed, update the app by downloading a new package from the Store for Business, and publishing an application revision in Configuration Manager. For more information, see [Update and retire applications with System Center Configuration Manager](https://technet.microsoft.com/library/mt595704.aspx). 
+12. Deploy the application to your Surface Hubs. For more information, see [Deploy applications with Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/deploy-applications).
+13. As needed, update the app by downloading a new package from the Store for Business, and publishing an application revision in Configuration Manager. For more information, see [Update and retire applications with Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt595704.aspx). 
 
 > [!NOTE] 
-> If you are using System Center Configuration Manager (current branch), you can bypass the above steps by connecting the Store for Business to System Center Configuration Manager. By doing so, you can synchronize the list of apps you've purchased with System Center Configuration Manager, view these in the Configuration Manager console, and deploy them like you would any other app. For more information, see [Manage apps from the Microsoft Store for Business with System Center Configuration Manager](https://technet.microsoft.com/library/mt740630.aspx).
+> If you are using Microsoft Endpoint Configuration Manager (current branch), you can bypass the above steps by connecting the Store for Business to Configuration Manager. By doing so, you can synchronize the list of apps you've purchased with Configuration Manager, view these in the Configuration Manager console, and deploy them like you would any other app. For more information, see [Manage apps from the Microsoft Store for Business with Configuration Manager](https://technet.microsoft.com/library/mt740630.aspx).
 
 
 ## Summary
 
-There are a few different ways to install apps on your Surface Hub depending on whether you are developing apps, evaluating apps on a small number of devices, or deploying apps broadly to your oganization. This table summarizes the supported methods:
+There are a few different ways to install apps on your Surface Hub depending on whether you are developing apps, evaluating apps on a small number of devices, or deploying apps broadly to your organization. This table summarizes the supported methods:
 
 | Install method             | Developing apps | Evaluating apps on 
             a few devices | Deploying apps broadly 
             to your organization |
 | -------------------------- | --------------- | ------------------------------------- | ---------------------- |
diff --git a/devices/surface-hub/juneworkspace.code-workspace b/devices/surface-hub/juneworkspace.code-workspace
new file mode 100644
index 0000000000..f23e17c3ca
--- /dev/null
+++ b/devices/surface-hub/juneworkspace.code-workspace
@@ -0,0 +1,11 @@
+{
+	"folders": [
+		{
+			"path": "C:\\github\\windows-docs-pr"
+		},
+		{
+			"path": "."
+		}
+	],
+	"settings": {}
+}
\ No newline at end of file
diff --git a/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md b/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md
new file mode 100644
index 0000000000..003795ec22
--- /dev/null
+++ b/devices/surface-hub/known-issues-and-additional-info-about-surface-hub.md
@@ -0,0 +1,26 @@
+---
+title: Known issues and additional information about Microsoft Surface Hub
+description: Outlines known issues with Microsoft Surface Hub.
+ms.assetid: aee90a0c-fb05-466e-a2b1-92de89d0f2b7
+keywords: surface, hub, issues
+ms.prod: surface-hub
+ms.sitesec: library
+author: todmccoy
+ms.author: v-todmc
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# Known issues and additional information about Microsoft Surface Hub
+
+We're listening. Quality is a top priority, and we want to keep you informed about issues impacting customers. The following are some known issues of Microsoft Surface Hub:
+
+- **Skype for Business isn't using proxy for media traffic with RS2**
+
            For some Surface Hub users who are behind a proxy, Skype for Business won't use the proxy server for media. However, the Surface Hub will be able to sign in to the account. We received your feedback and are aware of the media traffic issue when you are using proxy. We're actively investigating this issue and will release fixes as soon as a solution is identified and tested. 
+
+- **For AAD joined devices, when a user tries to sign in to "My meetings & files", Surface Hub reports that there is no Internet connection**
+
            We’re aware of a set of issues that affect sign-in and document access on Surface Hub. We're actively investigating these issues. As a workaround until a resolution is released, customers can reset their devices and set up their Hub to use a local admin account. After reconfiguring to use the local admin account, "My meetings and files" will work as expected.
+- **Single sign-in when Azure AD joined**
+
            Surface Hub was designed for communal spaces, which impacts the way user credentials are stored. Because of this, there are currently limitations in how single sign-in works when devices are Azure AD joined. Microsoft is aware of this limitation and is actively investigating options for a resolution.
+- **Miracast over Infrastructure projection to Surface Hub fails if the Surface Hub has a dot character (.) in the friendly name**
+
            Surface Hub users may experience issues projecting to their device if the Friendly Name includes a period or dot in the name (.) -- for example, "Conf.Room42". To work around the issue, change the Friendly Name of the Hub in **Settings** > **Surface Hub** > **About**, and then restart the device. Microsoft is working on a solution to this issue.
\ No newline at end of file
diff --git a/devices/surface-hub/local-management-surface-hub-settings.md b/devices/surface-hub/local-management-surface-hub-settings.md
index b53d27448f..810691dfe8 100644
--- a/devices/surface-hub/local-management-surface-hub-settings.md
+++ b/devices/surface-hub/local-management-surface-hub-settings.md
@@ -4,10 +4,12 @@ description: How to manage Surface Hub settings with Settings.
 keywords: manage Surface Hub, Surface Hub settings
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 07/27/2017
+ms.date: 07/08/2019
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
@@ -27,7 +29,6 @@ Surface Hubs have many settings that are common to other Windows devices, but al
 | Change admin account password  | Surface Hub > Accounts | Change the password for the local admin account. This is only available if you configured the device to use a local admin during first run. |
 | Device Management | Surface Hub > Device management | Manage policies and business applications using mobile device management (MDM). |
 | Provisioning packages | Surface Hub > Device management | Set or change provisioning packages installed on the Surface Hub. |
-| Configure Operations Management Suite (OMS) | Surface Hub > Device management | Set up monitoring for your Surface Hub using OMS. |
 | Open the Microsoft Store app | Surface Hub > Apps & features | The Microsoft Store app is only available to admins through the Settings app. |
 | Skype for Business domain name | Surface Hub > Calling & Audio | Configure a domain name for your Skype for Business server. |
 | Default Speaker volume | Surface Hub > Calling & Audio | Configure the default speaker volume for the Surface Hub when it starts a session. |
@@ -58,4 +59,4 @@ Surface Hubs have many settings that are common to other Windows devices, but al
 
 [Remote Surface Hub management](remote-surface-hub-management.md)
 
-[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)
\ No newline at end of file
+[Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)
diff --git a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md
index 65c471f4a1..b3a74fc47d 100644
--- a/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md
+++ b/devices/surface-hub/manage-settings-with-mdm-for-surface-hub.md
@@ -2,11 +2,13 @@
 title: Manage settings with an MDM provider (Surface Hub)
 description: Microsoft Surface Hub provides an enterprise management solution to help IT administrators manage policies and business applications on these devices using a mobile device management (MDM) solution.
 ms.assetid: 18EB8464-6E22-479D-B0C3-21C4ADD168FE
+ms.reviewer: 
+manager: dansimp
 keywords: mobile device management, MDM, manage policies
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 03/07/2018
 ms.localizationpriority: medium
@@ -17,9 +19,8 @@ ms.localizationpriority: medium
 Surface Hub and other Windows 10 devices allow IT administrators to manage settings and policies using a mobile device management (MDM) provider. A built-in management component communicates with the management server, so there is no need to install additional clients on the device. For more information, see [Windows 10 mobile device management](https://msdn.microsoft.com/library/windows/hardware/dn914769.aspx).
 
 Surface Hub has been validated with Microsoft’s first-party MDM providers:
-- On-premises MDM with System Center Configuration Manager (beginning in version 1602)
-- Hybrid MDM with System Center Configuration Manager and Microsoft Intune
 - Microsoft Intune standalone
+- On-premises MDM with Microsoft Endpoint Configuration Manager
 
 You can also manage Surface Hubs using any third-party MDM provider that can communicate with Windows 10 using the MDM protocol.
 
@@ -30,7 +31,7 @@ You can enroll your Surface Hubs using bulk, manual, or automatic enrollment.
 **To configure bulk enrollment**
 - Surface Hub supports the [Provisioning CSP](https://msdn.microsoft.com/library/windows/hardware/mt203665.aspx) for bulk enrollment into MDM. For more information, see [Windows 10 bulk enrollment](https://msdn.microsoft.com/library/windows/hardware/mt613115.aspx).
            
 --OR--
-- If you have an on-premises System Center Configuration Manager infrastructure, see [How to bulk enroll devices with On-premises Mobile Device Management in System Center Configuration Manager](https://technet.microsoft.com/library/mt627898.aspx).
+- If you have an on-premises Microsoft Endpoint Configuration Manager infrastructure, see [How to bulk enroll devices with On-premises Mobile Device Management in Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm).
 
 ### Manual enrollment
 **To configure manual enrollment**
@@ -44,148 +45,163 @@ You can enroll your Surface Hubs using bulk, manual, or automatic enrollment.
 
 Surface Hub now supports the ability to automatically enroll in Intune by joining the device to Azure Active Directory. 
 
-For more information, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment).
+First step is to set up Automatic MDM enrollment. See [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment).
+
+Then, when devices are setup during First-run, pick the option to join to Azure Active Directory, see [Set up admins for this device page](https://docs.microsoft.com/surface-hub/first-run-program-surface-hub#set-up-admins-for-this-device-page)
 
 ## Manage Surface Hub settings with MDM
 
-You can use MDM to manage some [Surface Hub CSP settings](#supported-surface-hub-csp-settings), and some [Windows 10 settings](#supported-windows-10-settings). Depending on the MDM provider that you use, you may set these settings using a built-in user interface, or by deploying custom SyncML. Microsoft Intune and System Center Configuration Manager provide built-in experiences to help create policy templates for Surface Hub. Refer to documentation from your MDM provider to learn how to create and deploy SyncML.
+You can use MDM to manage some [Surface Hub CSP settings](#supported-surface-hub-csp-settings), and some [Windows 10 settings](#supported-windows-10-settings). Depending on the MDM provider that you use, you may set these settings using a built-in user interface, or by deploying custom SyncML. Microsoft Intune and Microsoft Endpoint Configuration Manager provide built-in experiences to help create policy templates for Surface Hub. Refer to documentation from your MDM provider to learn how to create and deploy SyncML.
 
 ### Supported Surface Hub CSP settings
 
-You can configure the Surface Hub settings in the following table using MDM. The table identifies if the setting is supported with Microsoft Intune, System Center Configuration Manager, or SyncML.
+You can configure the Surface Hub settings in the following table using MDM. The table identifies if the setting is supported with Microsoft Intune, Microsoft Endpoint Configuration Manager, or SyncML.
 
 For more information, see [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323). 
 
-| Setting          | Node in the SurfaceHub CSP         | Supported with
            Intune? | Supported with
            Configuration Manager? | Supported with
            SyncML\*? |
-| ---- | --- | --- | --- | --- |
-| Maintenance hours | MaintenanceHoursSimple/Hours/StartTime 
             MaintenanceHoursSimple/Hours/Duration | Yes | Yes | Yes |
-| Automatically turn on the screen using motion sensors | InBoxApps/Welcome/AutoWakeScreen | Yes | Yes | Yes |
-| Require a pin for wireless projection | InBoxApps/WirelessProjection/PINRequired | Yes | Yes | Yes |
-| Enable wireless projection | InBoxApps/WirelessProjection/Enabled | Yes | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Miracast channel to use for wireless projection | InBoxApps/WirelessProjection/Channel | Yes | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Connect to your Operations Management Suite workspace | MOMAgent/WorkspaceID 
             MOMAgent/WorkspaceKey | Yes | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Welcome screen background image | InBoxApps/Welcome/CurrentBackgroundPath | Yes | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Meeting information displayed on the welcome screen | InBoxApps/Welcome/MeetingInfoOption | Yes | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Friendly name for wireless projection | Properties/FriendlyName | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Device account, including password rotation | DeviceAccount/*``* 
             See [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). | No | No | Yes |
-| Specify Skype domain | InBoxApps/SkypeForBusiness/DomainName | Yes 
              | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Auto launch Connect App when projection is initiated | InBoxApps/Connect/AutoLaunch | Yes 
              | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Set default volume | Properties/DefaultVolume | Yes 
              | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Set screen timeout | Properties/ScreenTimeout | Yes 
              | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Set session timeout | Properties/SessionTimeout | Yes 
              | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Set sleep timeout | Properties/SleepTimeout | Yes 
              | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Allow session to resume after screen is idle | Properties/AllowSessionResume | Yes 
              | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Allow device account to be used for proxy authentication | Properties/AllowAutoProxyAuth | Yes 
              | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Disable auto-populating the sign-in dialog with invitees from scheduled meetings | Properties/DisableSignInSuggestions | Yes 
              | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Disable "My meetings and files" feature in Start menu | Properties/DoNotShowMyMeetingsAndFiles | Yes 
              | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Set the LanProfile for 802.1x Wired Auth | Dot3/LanProfile | Yes 
             [Use a custom policy.](#example-intune)  | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Set the EapUserData for 802.1x Wired Auth | Dot3/EapUserData | Yes 
             [Use a custom policy.](#example-intune)  | Yes.
             [Use a custom setting.](#example-sccm) | Yes |
+
+|                                     Setting                                      |                                                    Node in the SurfaceHub CSP                                                    |            Supported with
            Intune?             |    Supported with
            Configuration Manager?     | Supported with
            SyncML\*? |
+|----------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------|
+|                                Maintenance hours                                 |                        MaintenanceHoursSimple/Hours/StartTime 
             MaintenanceHoursSimple/Hours/Duration                         |                       Yes                        |                       Yes                       |             Yes             |
+|              Automatically turn on the screen using motion sensors               |                                                 InBoxApps/Welcome/AutoWakeScreen                                                 |                       Yes                        |                       Yes                       |             Yes             |
+|                      Require a pin for wireless projection                       |                                             InBoxApps/WirelessProjection/PINRequired                                             |                       Yes                        |                       Yes                       |             Yes             |
+|                            Enable wireless projection                            |                                               InBoxApps/WirelessProjection/Enabled                                               |                       Yes                        | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                 Miracast channel to use for wireless projection                  |                                               InBoxApps/WirelessProjection/Channel                                               |                       Yes                        | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|              Connect to your Operations Management Suite workspace               |                                         MOMAgent/WorkspaceID 
             MOMAgent/WorkspaceKey                                          |                       Yes                        | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                         Welcome screen background image                          |                                             InBoxApps/Welcome/CurrentBackgroundPath                                              |                       Yes                        | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|               Meeting information displayed on the welcome screen                |                                               InBoxApps/Welcome/MeetingInfoOption                                                |                       Yes                        | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                      Friendly name for wireless projection                       |                                                     Properties/FriendlyName                                                      | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                   Device account, including password rotation                    | DeviceAccount/*``* 
             See [SurfaceHub CSP](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). |                        No                        |                       No                        |             Yes             |
+|                               Specify Skype domain                               |                                              InBoxApps/SkypeForBusiness/DomainName                                               |                    Yes 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|               Auto launch Connect App when projection is initiated               |                                                   InBoxApps/Connect/AutoLaunch                                                   |                    Yes 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                                Set default volume                                |                                                     Properties/DefaultVolume                                                     |                    Yes 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                                Set screen timeout                                |                                                     Properties/ScreenTimeout                                                     |                    Yes 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                               Set session timeout                                |                                                    Properties/SessionTimeout                                                     |                    Yes 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                                Set sleep timeout                                 |                                                     Properties/SleepTimeout                                                      |                    Yes 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                   Allow session to resume after screen is idle                   |                                                  Properties/AllowSessionResume                                                   |                    Yes 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|             Allow device account to be used for proxy authentication             |                                                  Properties/AllowAutoProxyAuth                                                   |                    Yes 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+| Disable auto-populating the sign-in dialog with invitees from scheduled meetings |                                               Properties/DisableSignInSuggestions                                                |                    Yes 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|              Disable "My meetings and files" feature in Start menu               |                                              Properties/DoNotShowMyMeetingsAndFiles                                              |                    Yes 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                     Set the LanProfile for 802.1x Wired Auth                     |                                                         Dot3/LanProfile                                                          | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                    Set the EapUserData for 802.1x Wired Auth                     |                                                         Dot3/EapUserData                                                         | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+
 \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
 
 ### Supported Windows 10 settings
 
 In addition to Surface Hub-specific settings, there are numerous settings common to all Windows 10 devices. These settings are defined in the [Configuration service provider reference](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference). 
 
-The following tables include info on Windows 10 settings that have been validated with Surface Hub. There is a table with settings for these areas: security, browser, Windows Updates, Windows Defender, remote reboot, certificates, and logs. Each table identifies if the setting is supported with Microsoft Intune, System Center Configuration Manager, or SyncML.
+The following tables include info on Windows 10 settings that have been validated with Surface Hub. There is a table with settings for these areas: security, browser, Windows Updates, Windows Defender, remote reboot, certificates, and logs. Each table identifies if the setting is supported with Microsoft Intune, Microsoft Endpoint Configuration Manager, or SyncML.
 
 #### Security settings
-| Setting  | Details  | CSP reference | Supported with
            Intune? | Supported with
            Configuration Manager? | Supported with
            SyncML\*? |
-| --- | --- | --- |---- | --- | --- |
-| Allow Bluetooth | Keep this enabled to support Bluetooth peripherals. | [Connectivity/AllowBluetooth](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Connectivity_AllowBluetooth) | Yes. 
              |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Bluetooth policies | Use to set the Bluetooth device name, and block advertising, discovery, and automatic pairing. | Bluetooth/*``* 
             See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes. 
              |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Allow camera | Keep this enabled for Skype for Business. | [Camera/AllowCamera](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Camera_AllowCamera) | Yes. 
              |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Allow location | Keep this enabled to support apps such as Maps. | [System/AllowLocation](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowLocation) | Yes. 
             . |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Allow telemetry | Keep this enabled to help Microsoft improve Surface Hub. | [System/AllowTelemetry](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowTelemetry) | Yes. 
              |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Allow USB Drives | Keep this enabled to support USB drives on Surface Hub | [System/AllowStorageCard](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowstoragecard) | Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
+
+|      Setting       |                                            Details                                             |                                                                          CSP reference                                                                           |            Supported with
            Intune?             |    Supported with
            Configuration Manager?     | Supported with
            SyncML\*? |
+|--------------------|------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------|
+|  Allow Bluetooth   |                      Keep this enabled to support Bluetooth peripherals.                       |                   [Connectivity/AllowBluetooth](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Connectivity_AllowBluetooth)                   |                    Yes. 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+| Bluetooth policies | Use to set the Bluetooth device name, and block advertising, discovery, and automatic pairing. |                     Bluetooth/*``* 
             See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx)                      |                    Yes. 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|    Allow camera    |                           Keep this enabled for Skype for Business.                            |                            [Camera/AllowCamera](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Camera_AllowCamera)                            |                    Yes. 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|   Allow location   |                        Keep this enabled to support apps such as Maps.                         |                          [System/AllowLocation](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowLocation)                          |                   Yes. 
             .                    | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|  Allow telemetry   |                    Keep this enabled to help Microsoft improve Surface Hub.                    |                         [System/AllowTelemetry](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#System_AllowTelemetry)                         |                    Yes. 
                                 | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|  Allow USB Drives  |                     Keep this enabled to support USB drives on Surface Hub                     | [System/AllowStorageCard](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#system-allowstoragecard) | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+
 \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package. 
 
 #### Browser settings
 
-| Setting  | Details | CSP reference | Supported with
            Intune? | Supported with
            Configuration Manager? | Supported with
            SyncML\*? |
-| --- | --- | --- |---- | --- | --- |
-| Homepages | Use to configure the default homepages in Microsoft Edge. | [Browser/Homepages](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_Homepages)  |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Allow cookies | Surface Hub automatically deletes cookies at the end of a session. Use this to block cookies within a session. | [Browser/AllowCookies](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowCookies) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Allow developer tools  | Use to stop users from using F12 Developer Tools. | [Browser/AllowDeveloperTools](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDeveloperTools) | Yes 
             [Use a custom policy.](#example-intune) |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Allow Do Not Track | Use to enable Do Not Track headers. | [Browser/AllowDoNotTrack](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDoNotTrack) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Allow pop-ups | Use to block pop-up browser windows. | [Browser/AllowPopups](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowPopups) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Allow search suggestions | Use to block search suggestions in the address bar. | [Browser/AllowSearchSuggestionsinAddressBar](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSearchSuggestionsinAddressBar) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Allow SmartScreen | Keep this enabled to turn on SmartScreen. | [Browser/AllowSmartScreen](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSmartScreen) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Prevent ignoring SmartScreen Filter warnings for websites | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from accessing potentially malicious websites. | [Browser/PreventSmartScreenPromptOverride](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverride) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Prevent ignoring SmartScreen Filter warnings for files | For extra security, use to stop users from ignoring SmartScreen Filter warnings and block them from downloading unverified files from Microsoft Edge. | [Browser/PreventSmartScreenPromptOverrideForFiles](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverrideForFiles) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
+|                          Setting                          |                                                                        Details                                                                        |                                                                             CSP reference                                                                              |            Supported with
            Intune?             |    Supported with
            Configuration Manager?     | Supported with
            SyncML\*? |
+|-----------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------|
+|                         Homepages                         |                                               Use to configure the default homepages in Microsoft Edge.                                               |                                [Browser/Homepages](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_Homepages)                                | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                       Allow cookies                       |                    Surface Hub automatically deletes cookies at the end of a session. Use this to block cookies within a session.                     |                             [Browser/AllowCookies](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowCookies)                             | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                   Allow developer tools                   |                                                   Use to stop users from using F12 Developer Tools.                                                   |                      [Browser/AllowDeveloperTools](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDeveloperTools)                      | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                    Allow Do Not Track                     |                                                          Use to enable Do Not Track headers.                                                          |                          [Browser/AllowDoNotTrack](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowDoNotTrack)                          | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                       Allow pop-ups                       |                                                         Use to block pop-up browser windows.                                                          |                              [Browser/AllowPopups](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowPopups)                              | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                 Allow search suggestions                  |                                                  Use to block search suggestions in the address bar.                                                  |       [Browser/AllowSearchSuggestionsinAddressBar](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSearchSuggestionsinAddressBar)       | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|                     Allow Windows Defender SmartScreen                     |                                                       Keep this enabled to turn on Windows Defender SmartScreen.                                                       |                         [Browser/AllowSmartScreen](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_AllowSmartScreen)                         | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+| Prevent ignoring Windows Defender SmartScreen warnings for websites |     For extra security, use to stop users from ignoring Windows Defender SmartScreen warnings and block them from accessing potentially malicious websites.     |         [Browser/PreventSmartScreenPromptOverride](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverride)         | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|  Prevent ignoring Windows Defender SmartScreen warnings for files   | For extra security, use to stop users from ignoring Windows Defender SmartScreen warnings and block them from downloading unverified files from Microsoft Edge. | [Browser/PreventSmartScreenPromptOverrideForFiles](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Browser_PreventSmartScreenPromptOverrideForFiles) | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+
 \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
 
 #### Windows Update settings
 
-| Setting | Details | CSP reference | Supported with
            Intune? | Supported with
            Configuration Manager? | Supported with
            SyncML*? |
-| --- | --- | --- |---- | --- | --- |
-| Use Current Branch or Current Branch for Business | Use to configure Windows Update for Business – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/BranchReadinessLevel](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel) | Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Defer feature updates| See above. | [Update/ DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Defer quality updates | See above. | [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Pause feature updates | See above. | [Update/PauseFeatureUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Pause quality updates | See above. | [Update/PauseQualityUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates) |  Yes 
             [Use a custom policy.](#example-intune)  | Yes.
             [Use a custom setting.](#example-sccm) | Yes|
-| Configure device to use WSUS| Use to connect your Surface Hub to WSUS instead of Windows Update – see [Windows updates](manage-windows-updates-for-surface-hub.md). | [Update/UpdateServiceUrl](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Delivery optimization | Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Configure Delivery Optimization for Windows 10](https://technet.microsoft.com/itpro/windows/manage/waas-delivery-optimization) for details. | DeliveryOptimization/*``* 
             See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
+|                      Setting                      |                                                                                                           Details                                                                                                            |                                                                    CSP reference                                                                    |            Supported with
            Intune?             |    Supported with
            Configuration Manager?     | Supported with
            SyncML\*? |
+|---------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------|
+| Use Current Branch or Current Branch for Business |                                                       Use to configure Windows Update for Business – see [Windows updates](manage-windows-updates-for-surface-hub.md).                                                       |            [Update/BranchReadinessLevel](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_BranchReadinessLevel)             | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|               Defer feature updates               |                                                                                                          See above.                                                                                                          | [Update/ DeferFeatureUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferFeatureUpdatesPeriodInDays) | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|               Defer quality updates               |                                                                                                          See above.                                                                                                          | [Update/DeferQualityUpdatesPeriodInDays](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_DeferQualityUpdatesPeriodInDays)  | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|               Pause feature updates               |                                                                                                          See above.                                                                                                          |             [Update/PauseFeatureUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseFeatureUpdates)              | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|               Pause quality updates               |                                                                                                          See above.                                                                                                          |             [Update/PauseQualityUpdates](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_PauseQualityUpdates)              | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|           Configure device to use WSUS            |                                            Use to connect your Surface Hub to WSUS instead of Windows Update – see [Windows updates](manage-windows-updates-for-surface-hub.md).                                             |                [Update/UpdateServiceUrl](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_UpdateServiceUrl)                 | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|               Delivery optimization               | Use peer-to-peer content sharing to reduce bandwidth issues during updates. See [Configure Delivery Optimization for Windows 10](https://technet.microsoft.com/itpro/windows/manage/waas-delivery-optimization) for details. |         DeliveryOptimization/*``* 
             See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx)          | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+
 \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
 
 #### Windows Defender settings
 
-| Setting | Details | CSP reference | Supported with
            Intune? | Supported with
            Configuration Manager? | Supported with
            SyncML\*? |
-| --- | --- | --- |---- | --- | --- |
-| Defender policies | Use to configure various Defender settings, including a scheduled scan time. | Defender/*``* 
             See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Defender status | Use to initiate a Defender scan, force a Security intelligence update, query any threats detected. | [Defender CSP](https://msdn.microsoft.com/library/windows/hardware/mt187856.aspx) | No. | No. | Yes |
+|      Setting      |                                              Details                                               |                                                     CSP reference                                                      |            Supported with
            Intune?             |    Supported with
            Configuration Manager?     | Supported with
            SyncML\*? |
+|-------------------|----------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------|
+| Defender policies |            Use to configure various Defender settings, including a scheduled scan time.            | Defender/*``* 
             See [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+|  Defender status  | Use to initiate a Defender scan, force a Security intelligence update, query any threats detected. |                   [Defender CSP](https://msdn.microsoft.com/library/windows/hardware/mt187856.aspx)                    |                       Yes                        |                       Yes                       |             Yes             |
+
 \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
 
 #### Remote reboot
 
-| Setting | Details | CSP reference | Supported with
            Intune? | Supported with
            Configuration Manager? | Supported with
            SyncML\*? |
-| --- | --- | --- |---- | --- | --- |
-| Reboot the device immediately | Use in conjunction with OMS to minimize support costs – see [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). | ./Vendor/MSFT/Reboot/RebootNow 
             See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes | No | Yes |
-| Reboot the device at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/Single 
             See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
-| Reboot the device daily at a scheduled date and time | See above. | ./Vendor/MSFT/Reboot/Schedule/DailyRecurrent 
             See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) |  Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
+|                       Setting                        |                                                          Details                                                          |                                                             CSP reference                                                             |            Supported with
            Intune?             |    Supported with
            Configuration Manager?     | Supported with
            SyncML\*? |
+|------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------|
+|            Reboot the device immediately             | Use in conjunction with OMS to minimize support costs – see [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). |        ./Vendor/MSFT/Reboot/RebootNow 
             See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx)        |                       Yes                        |                       No                        |             Yes             |
+|    Reboot the device at a scheduled date and time    |                                                        See above.                                                         |     ./Vendor/MSFT/Reboot/Schedule/Single 
             See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx)     | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+| Reboot the device daily at a scheduled date and time |                                                        See above.                                                         | ./Vendor/MSFT/Reboot/Schedule/DailyRecurrent 
             See [Reboot CSP](https://msdn.microsoft.com/library/windows/hardware/mt720802.aspx) | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+
 \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
 
 #### Install certificates
 
-| Setting | Details | CSP reference | Supported with
            Intune? | Supported with
            Configuration Manager? | Supported with
            SyncML\*? |
-| --- | --- | --- |---- | --- | --- |
-| Install trusted CA certificates | Use to deploy trusted root and intermediate CA certificates. |  [RootCATrustedCertificates CSP](https://msdn.microsoft.com/library/windows/hardware/dn904970.aspx) | Yes. 
             See [Configure Intune certificate profiles](https://docs.microsoft.com/intune/deploy-use/configure-intune-certificate-profiles). | Yes. 
             See [How to create certificate profiles in System Center Configuration Manager](https://docs.microsoft.com/sccm/protect/deploy-use/create-certificate-profiles). | Yes |
+|             Setting             |                           Details                            |                                           CSP reference                                            |                                                         Supported with
            Intune?                                                          |                                                                  Supported with
            Configuration Manager?                                                                  | Supported with
            SyncML\*? |
+|---------------------------------|--------------------------------------------------------------|----------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------|
+| Install trusted CA certificates | Use to deploy trusted root and intermediate CA certificates. | [RootCATrustedCertificates CSP](https://msdn.microsoft.com/library/windows/hardware/dn904970.aspx) | Yes. 
             See [Configure Intune certificate profiles](https://docs.microsoft.com/intune/deploy-use/configure-intune-certificate-profiles). | Yes. 
             See [How to create certificate profiles in Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/create-certificate-profiles). |             Yes             |
+
 
 \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
 
 #### Collect logs
 
-| Setting | Details | CSP reference | Supported with
            Intune? | Supported with
            Configuration Manager? | Supported with
            SyncML*? |
-| --- | --- | --- |---- | --- | --- |
-| Collect ETW logs | Use to remotely collect ETW logs from Surface Hub. | [DiagnosticLog CSP](https://msdn.microsoft.com/library/windows/hardware/mt219118.aspx) | No | No | Yes |
+|     Setting      |                      Details                       |                                     CSP reference                                      | Supported with
            Intune? | Supported with
            Configuration Manager? | Supported with
            SyncML\*? |
+|------------------|----------------------------------------------------|----------------------------------------------------------------------------------------|---------------------------|------------------------------------------|-----------------------------|
+| Collect ETW logs | Use to remotely collect ETW logs from Surface Hub. | [DiagnosticLog CSP](https://msdn.microsoft.com/library/windows/hardware/mt219118.aspx) |            No             |                    No                    |             Yes             |
+
 
 \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
 
 #### Set network quality of service (QoS) policy
 
-| Setting | Details | CSP reference | Supported with
            Intune? | Supported with
            Configuration Manager? | Supported with
            SyncML*? |
-| --- | --- | --- |--- | --- | ---- |
-| Set Network QoS Policy | Use to set a QoS policy to perform a set of actions on network traffic. This is useful for prioritizing Skype network packets. | [NetworkQoSPolicy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkqospolicy-csp) | Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
+|        Setting         |                                                            Details                                                             |                                                    CSP reference                                                     |            Supported with
            Intune?             |    Supported with
            Configuration Manager?     | Supported with
            SyncML\*? |
+|------------------------|--------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------|
+| Set Network QoS Policy | Use to set a QoS policy to perform a set of actions on network traffic. This is useful for prioritizing Skype network packets. | [NetworkQoSPolicy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkqospolicy-csp) | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+
 \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
 
 #### Set network proxy
 
-| Setting | Details | CSP reference | Supported with
            Intune? | Supported with
            Configuration Manager? | Supported with
            SyncML*? |
-| --- | ---- | --- |---- | --- | --- |
-| Set Network proxy | Use to configure a proxy server for ethernet and Wi-Fi connections. | [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp) | Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
+|      Setting      |                               Details                               |                                                CSP reference                                                 |            Supported with
            Intune?             |    Supported with
            Configuration Manager?     | Supported with
            SyncML\*? |
+|-------------------|---------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------|
+| Set Network proxy | Use to configure a proxy server for ethernet and Wi-Fi connections. | [NetworkProxy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/networkproxy-csp) | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+
 \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
 
 #### Configure Start menu
 
-| Setting | Details | CSP reference | Supported with
            Intune? | Supported with
            Configuration Manager? | Supported with
            SyncML*? |
-| --- | ---- | --- |---- | --- | --- |
-| Configure Start menu | Use to configure which apps are displayed on the Start menu. For more information, see [Configure Surface Hub Start menu](surface-hub-start-menu.md) | [Policy CSP: Start/StartLayout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-startlayout) | Yes 
             [Use a custom policy.](#example-intune)  |  Yes.
             [Use a custom setting.](#example-sccm) | Yes |
+|       Setting        |                                                                       Details                                                                        |                                                        CSP reference                                                         |            Supported with
            Intune?             |    Supported with
            Configuration Manager?     | Supported with
            SyncML\*? |
+|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------|-------------------------------------------------|-----------------------------|
+| Configure Start menu | Use to configure which apps are displayed on the Start menu. For more information, see [Configure Surface Hub Start menu](surface-hub-start-menu.md) | [Policy CSP: Start/StartLayout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-startlayout) | Yes 
             [Use a custom policy.](#example-intune) | Yes.
             [Use a custom setting.](#example-sccm) |             Yes             |
+
 \*Settings supported with SyncML can also be configured in a Windows Configuration Designer provisioning package.
 
 ### Generate OMA URIs for settings 
-You need to use a setting’s OMA URI to create a custom policy in Intune, or a custom setting in System Center Configuration Manager.
+You need to use a setting’s OMA URI to create a custom policy in Intune, or a custom setting in Microsoft Endpoint Configuration Manager.
 
 **To generate the OMA URI for any setting in the CSP documentation**
 1. In the CSP documentation, identify the root node of the CSP. Generally, this looks like `./Vendor/MSFT/` 
            
@@ -209,11 +225,11 @@ You can use Microsoft Intune to manage Surface Hub settings. For custom settings
 
 
 
-## Example: Manage Surface Hub settings with System Center Configuration Manager
-System Center Configuration Manager supports managing modern devices that do not require the Configuration Manager client to manage them, including Surface Hub. If you already use System Center Configuration Manager to manage other devices in your organization, you can continue to use the Configuration Manager console as your single location for managing Surface Hubs.
+## Example: Manage Surface Hub settings with  Microsoft Endpoint Configuration Manager
+Configuration Manager supports managing modern devices that do not require the Configuration Manager client to manage them, including Surface Hub. If you already use Configuration Manager to manage other devices in your organization, you can continue to use the Configuration Manager console as your single location for managing Surface Hubs.
 
 > [!NOTE]
-> These instructions are based on the current branch of System Center Configuration Manager.
+> These instructions are based on the current branch of Configuration Manager.
 
 **To create a configuration item for Surface Hub settings**
 
@@ -248,7 +264,7 @@ System Center Configuration Manager supports managing modern devices that do not
 18. When you're done, on the **Browse Settings** dialog, click **Close**.
 19. Complete the wizard. 
             You can view the new configuration item in the **Configuration Items** node of the **Assets and Compliance** workspace.
 
-For more information, see [Create configuration items for Windows 8.1 and Windows 10 devices managed without the System Center Configuration Manager client](https://docs.microsoft.com/sccm/compliance/deploy-use/create-configuration-items-for-windows-8.1-and-windows-10-devices-managed-without-the-client).
+For more information, see [Create configuration items for Windows 8.1 and Windows 10 devices managed without the Microsoft Endpoint Configuration Manager client](https://docs.microsoft.com/configmgr/compliance/deploy-use/create-configuration-items-for-windows-8.1-and-windows-10-devices-managed-without-the-client).
 
 ## Related topics
 
@@ -256,9 +272,9 @@ For more information, see [Create configuration items for Windows 8.1 and Window
 
 
 
- 
-
- 
+
+
+
 
 
 
diff --git a/devices/surface-hub/manage-surface-hub-settings.md b/devices/surface-hub/manage-surface-hub-settings.md
index ac7d714624..a5d76ff156 100644
--- a/devices/surface-hub/manage-surface-hub-settings.md
+++ b/devices/surface-hub/manage-surface-hub-settings.md
@@ -4,10 +4,12 @@ description: This section lists topics for managing Surface Hub settings.
 keywords: Surface Hub accessibility settings, device account, device reset, windows updates, wireless network management
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
diff --git a/devices/surface-hub/manage-surface-hub.md b/devices/surface-hub/manage-surface-hub.md
index da29b06c9d..4ad681ff5f 100644
--- a/devices/surface-hub/manage-surface-hub.md
+++ b/devices/surface-hub/manage-surface-hub.md
@@ -2,11 +2,13 @@
 title: Manage Microsoft Surface Hub
 description: How to manage your Surface Hub after finishing the first-run program.
 ms.assetid: FDB6182C-1211-4A92-A930-6C106BCD5DC1
+ms.reviewer: 
+manager: dansimp
 keywords: manage Surface Hub
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 01/17/2018
 ms.localizationpriority: medium
@@ -17,7 +19,7 @@ ms.localizationpriority: medium
 After initial setup of Microsoft Surface Hub, the device’s settings and configuration can be modified or changed in a couple ways:
 
 - **Local management** - Every Surface Hub can be configured locally using the **Settings** app on the device. To prevent unauthorized users from changing settings, the Settings app requires admin credentials to open the app. For more information, see [Local management for Surface Hub settings](local-management-surface-hub-settings.md).
-- **Remote management** - Surface Hub allow IT admins to manage settings and policies using a mobile device management (MDM) provider, such as Microsoft Intune, System Center Configuration Manager, and other third-party providers. Additionally, admins can monitor Surface Hubs using Microsoft Operations Management Suite (OMS). For more information, see [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md), and [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). 
+- **Remote management** - Surface Hub allow IT admins to manage settings and policies using a mobile device management (MDM) provider, such as Microsoft Intune, Microsoft Endpoint Configuration Manager, and other third-party providers. Additionally, admins can monitor Surface Hubs using Microsoft Operations Management Suite (OMS). For more information, see [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md), and [Monitor your Microsoft Surface Hub](monitor-surface-hub.md). 
 
 > [!NOTE]
 > These management methods are not mutually exclusive. Devices can be both locally and remotely managed if you choose. However, MDM policies and settings will overwrite any local changes when the Surface Hub syncs with the management server. 
@@ -41,7 +43,8 @@ Learn about managing and updating Surface Hub.
  [Enable 802.1x wired authentication](enable-8021x-wired-authentication.md) | 802.1x Wired Authentication MDM policies have been enabled on Surface Hub devices. 
 | [Using a room control system](https://technet.microsoft.com/itpro/surface-hub/use-room-control-system-with-surface-hub) | Room control systems can be used with your Microsoft Surface Hub.|
 [Using the Surface Hub Recovery Tool](surface-hub-recovery-tool.md) | Use the Surface Hub Recovery Tool to re-image the Surface Hub SSD.
+[Surface Hub SSD replacement](surface-hub-ssd-replacement.md) | Learn how to remove and replace the solid state drive in your Surface Hub.
 
 ## Related topics
 
-- [View Power BI presentation mode on Surface Hub & Windows 10](https://powerbi.microsoft.com/documentation/powerbi-mobile-win10-app-presentation-mode/)
\ No newline at end of file
+- [View Power BI presentation mode on Surface Hub & Windows 10](https://powerbi.microsoft.com/documentation/powerbi-mobile-win10-app-presentation-mode/)
diff --git a/devices/surface-hub/manage-windows-updates-for-surface-hub.md b/devices/surface-hub/manage-windows-updates-for-surface-hub.md
index 625ba99f34..961a12fcd0 100644
--- a/devices/surface-hub/manage-windows-updates-for-surface-hub.md
+++ b/devices/surface-hub/manage-windows-updates-for-surface-hub.md
@@ -2,13 +2,14 @@
 title: Windows updates (Surface Hub)
 description: You can manage Windows updates on your Microsoft Surface Hub by setting the maintenance window, deferring updates, or using Windows Server Update Services (WSUS).
 ms.assetid: A737BD50-2D36-4DE5-A604-55053D549045
+ms.reviewer: 
+manager: dansimp
 keywords: manage Windows updates, Surface Hub, Windows Server Update Services, WSUS
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 11/03/2017
 ms.localizationpriority: medium
 ---
 
@@ -57,7 +58,7 @@ Surface Hubs, like all Windows 10 devices, include **Windows Update for Business
 2. [Configure when Surface Hub receives updates](#configure-when-surface-hub-receives-updates).
 
 > [!NOTE]
-> You can use Microsoft Intune, System Center Configuration Manager, or a supported third-party MDM provider to set up WUfB. [Walkthrough: use Microsoft Intune to configure Windows Update for Business.](https://docs.microsoft.com/windows/deployment/update/waas-wufb-intune)
+> You can use Microsoft Intune, Microsoft Endpoint Configuration Manager, or a supported third-party MDM provider to set up WUfB. [Walkthrough: use Microsoft Intune to configure Windows Update for Business.](https://docs.microsoft.com/windows/deployment/update/waas-wufb-intune)
 
 
 ### Group Surface Hub into deployment rings
@@ -67,7 +68,7 @@ This table gives examples of deployment rings.
 
 | Deployment ring | Ring size | Servicing branch | Deferral for feature updates | Deferral for quality updates (security fixes, drivers, and other updates) | Validation step |
 | --------- | --------- | --------- | --------- | --------- | --------- |
-| Preview (e.g. non-critical or test devices) | Small | Semi-annual channel (Targeted) | None.  | None.  | Manually test and evaluate new functionality. Pause updates if there are issues. |
+| Preview (e.g. non-critical or test devices) | Small | Windows Insider Preview | None.  | None.  | Manually test and evaluate new functionality. Pause updates if there are issues. |
 | Release (e.g. devices used by select teams) | Medium | Semi-annual channel  | None. | None.  | Monitor device usage and user feedback. Pause updates if there are issues. |
 | Broad deployment (e.g. most of the devices in your organization) | Large | Semi-annual channel |  120 days after release. | 7-14 days after release. | Monitor device usage and user feedback. Pause updates if there are issues. |
 | Mission critical (e.g. devices in executive boardrooms) | Small | Semi-annual channel |  180 days after release (maximum deferral for feature updates). | 30 days after release (maximum deferral for quality updates). | Monitor device usage and user feedback. |
diff --git a/devices/surface-hub/miracast-over-infrastructure.md b/devices/surface-hub/miracast-over-infrastructure.md
index 7b6737d1ac..1b09f33999 100644
--- a/devices/surface-hub/miracast-over-infrastructure.md
+++ b/devices/surface-hub/miracast-over-infrastructure.md
@@ -3,10 +3,12 @@ title: Miracast on existing wireless network or LAN
 description: Windows 10 enables you to send a Miracast stream over a local network.
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 08/03/2017
+ms.date: 06/20/2019
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
diff --git a/devices/surface-hub/miracast-troubleshooting.md b/devices/surface-hub/miracast-troubleshooting.md
index 6f3bdf62ec..9517857676 100644
--- a/devices/surface-hub/miracast-troubleshooting.md
+++ b/devices/surface-hub/miracast-troubleshooting.md
@@ -3,10 +3,12 @@ title: Troubleshoot Miracast on Surface Hub
 description: Learn how to resolve issues with Miracast on Surface Hub.
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 07/27/2017
+ms.date: 06/20/2019
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
diff --git a/devices/surface-hub/monitor-surface-hub.md b/devices/surface-hub/monitor-surface-hub.md
index a210f9834d..262c565327 100644
--- a/devices/surface-hub/monitor-surface-hub.md
+++ b/devices/surface-hub/monitor-surface-hub.md
@@ -2,11 +2,13 @@
 title: Monitor your Microsoft Surface Hub
 description: Monitoring for Microsoft Surface Hub devices is enabled through Microsoft Operations Management Suite (OMS).
 ms.assetid: 1D2ED317-DFD9-423D-B525-B16C2B9D6942
+ms.reviewer: 
+manager: dansimp
 keywords: monitor Surface Hub, Microsoft Operations Management Suite, OMS
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
 ms.localizationpriority: medium
@@ -93,10 +95,10 @@ This table describes the sample queries in the Surface Hub solution:
 | Hardware   | Error | **Contact Microsoft support**. 
             Indicates impact to core functionality (such as Skype, projection, touch, and internet connectivity). 
             **Note** Some events, including heartbeat, include the device’s serial number that you can use when contacting support.| Triggers when there is an error with any of the following hardware components. 
             **Components that affect Skype**: 
             - Speaker driver 
             - Microphone driver 
             - Camera driver 
             **Components that affect wired and wireless projection**: 
             - Wired touchback driver 
             - Wired ingest driver 
             - Wireless adapter driver 
             - Wi-Fi Direct error 
             **Other components**: 
             - Touch digitizer driver 
             - Network adapter error (not reported to OMS)|
 
 **To set up an alert**
-1.	From the Surface Hub solution, select one of the sample queries.
-2.	Modify the query as desired. See Log Analytics search reference to learn more.
-3.	Click **Alert** at the top of the page to open the **Add Alert Rule** screen. See [Alerts in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-alerts/) for details on the options to configure the alert.
-4.	Click **Save** to complete the alert rule. It will start running immediately.
+1. From the Surface Hub solution, select one of the sample queries.
+2. Modify the query as desired. See Log Analytics search reference to learn more.
+3. Click **Alert** at the top of the page to open the **Add Alert Rule** screen. See [Alerts in Log Analytics](https://azure.microsoft.com/documentation/articles/log-analytics-alerts/) for details on the options to configure the alert.
+4. Click **Save** to complete the alert rule. It will start running immediately.
 
 ## Enroll your Surface Hub
 
@@ -136,7 +138,7 @@ You'll need the workspace ID and primary key of your OMS workspace. You can get
 A confirmation dialog will appear telling you whether or not the OMS configuration was successfully applied to the device. If it was, the device will start sending data to OMS.
 
 ### Enroll using a provisioning package
-You can use a provisioning package to enroll your Surface Hub. For more infomation, see [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md).
+You can use a provisioning package to enroll your Surface Hub. For more information, see [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md).
  
 ### Enroll using a MDM provider
 You can enroll Surface Hub into OMS using the SurfaceHub CSP. Intune and Configuration Manager provide built-in experiences to help create policy templates for Surface Hub. For more information, see [Manage Surface Hub settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md).
diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
index 46877db4de..88b0653b00 100644
--- a/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
+++ b/devices/surface-hub/on-premises-deployment-surface-hub-device-accounts.md
@@ -2,11 +2,13 @@
 title: On-premises deployment single forest (Surface Hub)
 description: This topic explains how you add a device account for your Microsoft Surface Hub when you have a single-forest, on-premises deployment.
 ms.assetid: 80E12195-A65B-42D1-8B84-ECC3FCBAAFC6
+ms.reviewer: 
+manager: dansimp
 keywords: single forest deployment, on prem deployment, device account, Surface Hub
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.date: 08/28/2018
 ms.localizationpriority: medium
 ---
@@ -18,94 +20,98 @@ This topic explains how you add a device account for your Microsoft Surface Hub
 
 If you have a single-forest on-premises deployment with Microsoft Exchange 2013 or later and Skype for Business 2013 or later, then you can [use the provided PowerShell scripts](appendix-a-powershell-scripts-for-surface-hub.md#create-on-premises-ps-scripts) to create device accounts. If you’re using a multi-forest deployment, see [On-premises deployment for Surface Hub in a multi-forest environment](on-premises-deployment-surface-hub-multi-forest.md).
 
-1.  Start a remote PowerShell session from a PC and connect to Exchange.
+1. Start a remote PowerShell session from a PC and connect to Exchange.
 
-    Be sure you have the right permissions set to run the associated cmdlets.
+   Be sure you have the right permissions set to run the associated cmdlets.
 
-    Note here that `$strExchangeServer` is the fully qualified domain name (FQDN) of your Exchange server, and `$strLyncFQDN` is the FQDN of your Skype for Business server.
-
-    ```PowerShell
-    Set-ExecutionPolicy Unrestricted
-    $org='contoso.microsoft.com'
-    $cred=Get-Credential $admin@$org
-    $sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $cred -AllowRedirection -Authentication Kerberos -ConnectionUri "http://$strExchangeServer/powershell" -WarningAction SilentlyContinue
-    $sessLync = New-PSSession -Credential $cred -ConnectionURI "https://$strLyncFQDN/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue
-    Import-PSSession $sessExchange
-    Import-PSSession $sessLync
-    ```
-
-2.  After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub.
-
-    If you're changing an existing resource mailbox:
-
-    ```PowerShell
-    Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
-    ```
-
-    If you’re creating a new resource mailbox:
-
-    ```PowerShell
-    New-Mailbox -UserPrincipalName HUB01@contoso.com -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
-    ```
-
-3.  After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy.
-
-    Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
-
-    If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
-
-    ```PowerShell
-    $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
-    ```
-
-    Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too.
-
-    ```PowerShell
-    Set-Mailbox $acctUpn -Type Regular
-    Set-CASMailbox $acctUpn -ActiveSyncMailboxPolicy $easPolicy
-    Set-Mailbox $acctUpn -Type Room
-    Set-Mailbox $credNewAccount.UserName -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true
-    ```
-
-4.  Various Exchange properties can be set on the device account to improve the meeting experience for people. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
-
-    ```PowerShell
-    Set-CalendarProcessing -Identity $acctUpn -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
-    Set-CalendarProcessing -Identity $acctUpn -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
-    ```
-
-5.  If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information.
-
-    ```PowerShell
-    Set-AdUser $acctUpn -PasswordNeverExpires $true
-    ```
-
-6.  Enable the account in Active Directory so it will authenticate to the Surface Hub.
-
-    ```PowerShell
-    Set-AdUser $acctUpn -Enabled $true
-    ```
-
-7.  Enable the device account with Skype for Business by enabling your Surface Hub AD account on a Skype for Business Server pool:
-
-    ```PowerShell
-    Enable-CsMeetingRoom -SipAddress "sip:HUB01@contoso.com"
-     -DomainController DC-ND-001.contoso.com -RegistrarPool LYNCPool15.contoso.com
-     -Identity HUB01
-    ```
-
-    You'll need to use the Session Initiation Protocol (SIP) address and domain controller for the Surface Hub, along with your own Skype for Business Server pool identifier and user identity.
-
-8.  OPTIONAL: You can also allow your Surface Hub to make and receive public switched telephone network (PSTN) phone calls by enabling Enterprise Voice for your account. Enterprise Voice isn't a requirement for Surface Hub, but if you want PSTN dialing functionality for the Surface Hub client, here's how to enable it:
+   Note here that `$strExchangeServer` is the fully qualified domain name (FQDN) of your Exchange server, and `$strLyncFQDN` is the FQDN of your Skype for Business server.
 
    ```PowerShell
-    Set-CsMeetingRoom  -Identity HUB01 -DomainController DC-ND-001.contoso.com -LineURI "tel:+14255550555;ext=50555"  -EnterpriseVoiceEnabled $true
-    ```
+   Set-ExecutionPolicy Unrestricted
+   $org='contoso.microsoft.com'
+   $cred=Get-Credential $admin@$org
+   $sessExchange = New-PSSession -ConfigurationName microsoft.exchange -Credential $cred -AllowRedirection -Authentication Kerberos -ConnectionUri "http://$strExchangeServer/powershell" -WarningAction SilentlyContinue
+   $sessLync = New-PSSession -Credential $cred -ConnectionURI "https://$strLyncFQDN/OcsPowershell" -AllowRedirection -WarningAction SilentlyContinue
+   Import-PSSession $sessExchange
+   Import-PSSession $sessLync
+   ```
 
-    Again, you need to replace the provided domain controller and phone number examples with your own information. The parameter value `$true` stays the same.
+2. After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub.
+
+   If you're changing an existing resource mailbox:
+
+   ```PowerShell
+   Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
+   ```
+
+   If you’re creating a new resource mailbox:
+
+   ```PowerShell
+   New-Mailbox -UserPrincipalName HUB01@contoso.com -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
+   ```
+> [!IMPORTANT] 
+> ActiveSync Virtual Directory Basic Authentication is required to be enabled as the Surface Hub is unable to authenticate using other authentication methods.
+
+3. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy.
+
+   Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
+
+   If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
+
+   ```PowerShell
+   $easPolicy = New-MobileDeviceMailboxPolicy -Name “SurfaceHubs” -PasswordEnabled $false
+   ```
+
+   Once you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. You need to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox—you may need to re-enable it and set the password again too.
+
+   ```PowerShell
+   $acctUpn = Get-Mailbox -Identity ""
+   $credNewAccount.Password = ConvertTo-SecureString -String  -AsPlainText -Force
+   Set-Mailbox $acctUpn -Type Regular
+   Set-CASMailbox $acctUpn -ActiveSyncMailboxPolicy $easPolicy
+   Set-Mailbox $acctUpn -Type Room
+   Set-Mailbox $acctUpn -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true
+   ```
+
+4. Various Exchange properties can be set on the device account to improve the meeting experience for people. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
+
+   ```PowerShell
+   Set-CalendarProcessing -Identity $acctUpn -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
+   Set-CalendarProcessing -Identity $acctUpn -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
+   ```
+
+5. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information.
+
+   ```PowerShell
+   Set-AdUser $acctUpn -PasswordNeverExpires $true
+   ```
+
+6. Enable the account in Active Directory so it will authenticate to the Surface Hub.
+
+   ```PowerShell
+   Set-AdUser $acctUpn -Enabled $true
+   ```
+
+7. Enable the device account with Skype for Business by enabling your Surface Hub AD account on a Skype for Business Server pool:
+
+   ```PowerShell
+   Enable-CsMeetingRoom -SipAddress "sip:HUB01@contoso.com"
+    -DomainController DC-ND-001.contoso.com -RegistrarPool LYNCPool15.contoso.com
+    -Identity HUB01
+   ```
+
+   You'll need to use the Session Initiation Protocol (SIP) address and domain controller for the Surface Hub, along with your own Skype for Business Server pool identifier and user identity.
+
+8. OPTIONAL: You can also allow your Surface Hub to make and receive public switched telephone network (PSTN) phone calls by enabling Enterprise Voice for your account. Enterprise Voice isn't a requirement for Surface Hub, but if you want PSTN dialing functionality for the Surface Hub client, here's how to enable it:
+
+   ```PowerShell
+   Set-CsMeetingRoom  -Identity HUB01 -DomainController DC-ND-001.contoso.com -LineURI "tel:+14255550555;ext=50555"  -EnterpriseVoiceEnabled $true
+   ```
+
+   Again, you need to replace the provided domain controller and phone number examples with your own information. The parameter value `$true` stays the same.
     
 
- ## Disable anonymous email and IM
+ ## Disable anonymous email and IM
 
 
 
@@ -141,7 +147,7 @@ To change the policy entry:
 ```
 $policyEntry =  New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -value $true
 $clientPolicy | Set-CsClientPolicy -PolicyEntry @{Replace = $policyEntry}
-```	
+``` 
 	
 To remove the policy entry:
 
@@ -150,7 +156,7 @@ $policyEntry = New-CsClientPolicyEntry -Name AllowResourceAccountSendMessage -va
 $clientPolicy | Set-CsClientPolicy -PolicyEntry @{Remove = $policyEntry}
 ```
 
- 
+ 
 
 
 
diff --git a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md b/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md
index cae7e9639e..f643e4cfe6 100644
--- a/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md
+++ b/devices/surface-hub/on-premises-deployment-surface-hub-multi-forest.md
@@ -4,9 +4,11 @@ description: This topic explains how you add a device account for your Microsoft
 keywords: multi forest deployment, on prem deployment, device account, Surface Hub
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.date: 08/28/2018
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
diff --git a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md
index d5c567a57f..0cd6fc5219 100644
--- a/devices/surface-hub/online-deployment-surface-hub-device-accounts.md
+++ b/devices/surface-hub/online-deployment-surface-hub-device-accounts.md
@@ -2,11 +2,13 @@
 title: Online deployment with Office 365 (Surface Hub)
 description: This topic has instructions for adding a device account for your Microsoft Surface Hub when you have a pure, online deployment.
 ms.assetid: D325CA68-A03F-43DF-8520-EACF7C3EDEC1
+ms.reviewer: 
+manager: dansimp
 keywords: device account for Surface Hub, online deployment
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 02/21/2018
 ms.localizationpriority: medium
@@ -19,129 +21,129 @@ This topic has instructions for adding a device account for your Microsoft Surfa
 
 If you have a pure, online (O365) deployment, then you can [use the provided PowerShell scripts](appendix-a-powershell-scripts-for-surface-hub.md#create-os356-ps-scripts) to create device accounts. 
 
-1.  Start a remote PowerShell session on a PC and connect to Exchange.
+1. Start a remote PowerShell session on a PC and connect to Exchange.
 
-    Be sure you have the right permissions set to run the associated cmdlets.
+   Be sure you have the right permissions set to run the associated cmdlets.
 
-    ```PowerShell
-    Set-ExecutionPolicy RemoteSigned
-    $org='contoso.microsoft.com'
-    $cred=Get-Credential admin@$org
-    $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
-    Import-PSSession $sess
-    ```
+   ```PowerShell
+   Set-ExecutionPolicy RemoteSigned
+   $org='contoso.microsoft.com'
+   $cred=Get-Credential admin@$org
+   $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
+   Import-PSSession $sess
+   ```
 
-2.  After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub.
+2. After establishing a session, you’ll either create a new mailbox and enable it as a RoomMailboxAccount, or change the settings for an existing room mailbox. This will allow the account to authenticate into the Surface Hub.
 
-    If you're changing an existing resource mailbox:
+   If you're changing an existing resource mailbox:
 
-    ```PowerShell
-    Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
-    ```
+   ```PowerShell
+   Set-Mailbox -Identity 'HUB01' -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
+   ```
 
-    If you’re creating a new resource mailbox:
+   If you’re creating a new resource mailbox:
 
-    ```PowerShell
-    New-Mailbox -MicrosoftOnlineServicesID HUB01@contoso.com -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
-    ```
+   ```PowerShell
+   New-Mailbox -MicrosoftOnlineServicesID HUB01@contoso.com -Alias HUB01 -Name "Hub-01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
+   ```
 
-3.  After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy.
+3. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy.
 
-    Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
+   Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to False. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
 
-    If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
+   If you haven’t created a compatible policy yet, use the following cmdlet—this one creates a policy called "Surface Hubs". Once it’s created, you can apply the same policy to other device accounts.
 
-    ```PowerShell
-    $easPolicy = New-MobileDeviceMailboxPolicy -Name "SurfaceHubs" -PasswordEnabled $false -AllowNonProvisionableDevices $True
-    ```
+   ```PowerShell
+   $easPolicy = New-MobileDeviceMailboxPolicy -Name "SurfaceHubs" -PasswordEnabled $false -AllowNonProvisionableDevices $True
+   ```
 
-    Once you have a compatible policy, then you will need to apply the policy to the device account.
+   Once you have a compatible policy, then you will need to apply the policy to the device account.
 
-    ```PowerShell
-    Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.Id
-    ```
+   ```PowerShell
+   Set-CASMailbox 'HUB01@contoso.com' -ActiveSyncMailboxPolicy $easPolicy.Id
+   ```
 
-4.  Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
+4. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties need to be set in the [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md) section.
 
-    ```PowerShell
-    Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
-    Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
-    ```
+   ```PowerShell
+   Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
+   Set-CalendarProcessing -Identity 'HUB01@contoso.com' -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
+   ```
 
-5.  Connect to Azure AD.
+5. Connect to Azure AD.
     
-    You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command :
+   You first need to install Azure AD module for PowerShell version 2. In an elevated powershell prompt run the following command :
     
-    ```PowerShell
-    Install-Module -Name AzureAD
-    ```
-    You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect.
+   ```PowerShell
+   Install-Module -Name AzureAD
+   ```
+   You need to connect to Azure AD to apply some account settings. You can run this cmdlet to connect.
 
-    ```PowerShell
-    Import-Module AzureAD
-    Connect-AzureAD -Credential $cred
-    ```
+   ```PowerShell
+   Import-Module AzureAD
+   Connect-AzureAD -Credential $cred
+   ```
 
-6.  If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information.
+6. If you decide to have the password not expire, you can set that with PowerShell cmdlets too. See [Password management](password-management-for-surface-hub-device-accounts.md) for more information.
 
-    ```PowerShell
-    Set-AzureADUser -ObjectId "HUB01@contoso.com" -PasswordPolicies "DisablePasswordExpiration"
-    ```
+   ```PowerShell
+   Set-AzureADUser -ObjectId "HUB01@contoso.com" -PasswordPolicies "DisablePasswordExpiration"
+   ```
 
-7.  Surface Hub requires a license for Skype for Business functionality. In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](hybrid-deployment-surface-hub-device-accounts.md#sfb-online).
+7. Surface Hub requires a license for Skype for Business functionality. In order to enable Skype for Business, your environment will need to meet the [prerequisites for Skype for Business online](hybrid-deployment-surface-hub-device-accounts.md#skype-for-business-online).
    
-    Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant.
+   Next, you can use `Get-AzureADSubscribedSku` to retrieve a list of available SKUs for your O365 tenant.
 
-    Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable.
+   Once you list out the SKUs, you'll need to assign the SkuId you want to the `$License.SkuId` variable.
 
-    ```PowerShell
-    Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US"
+   ```PowerShell
+   Set-AzureADUser -ObjectId "HUB01@contoso.com" -UsageLocation "US"
 	
-	Get-AzureADSubscribedSku | Select Sku*,*Units
-	$License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
-    $License.SkuId = SkuId You selected 
+   Get-AzureADSubscribedSku | Select Sku*,*Units
+   $License = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicense
+   $License.SkuId = SkuId You selected 
 	
-	$AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
-    $AssignedLicenses.AddLicenses = $License
-    $AssignedLicenses.RemoveLicenses = @()
+   $AssignedLicenses = New-Object -TypeName Microsoft.Open.AzureAD.Model.AssignedLicenses
+   $AssignedLicenses.AddLicenses = $License
+   $AssignedLicenses.RemoveLicenses = @()
 	
-    Set-AzureADUserLicense -ObjectId "HUB01@contoso.com"  -AssignedLicenses $AssignedLicenses
-    ```
+   Set-AzureADUserLicense -ObjectId "HUB01@contoso.com"  -AssignedLicenses $AssignedLicenses
+   ```
 
-8.  Enable the device account with Skype for Business.
-	If the Skype for Business PowerShell module is not installed, [download the Skype for Business Online Windows PowerShell Module](https://www.microsoft.com/download/details.aspx?id=39366). 
+8. Enable the device account with Skype for Business.
+   If the Skype for Business PowerShell module is not installed, [download the Skype for Business Online Windows PowerShell Module](https://www.microsoft.com/download/details.aspx?id=39366). 
 
-    -   Start by creating a remote PowerShell session from a PC.
+   - Start by creating a remote PowerShell session from a PC.
 
-        ```PowerShell
-        Import-Module SkypeOnlineConnector  
-        $cssess=New-CsOnlineSession -Credential $cred  
-        Import-PSSession $cssess -AllowClobber
-        ```
+     ```PowerShell
+     Import-Module SkypeOnlineConnector  
+     $cssess=New-CsOnlineSession -Credential $cred  
+     Import-PSSession $cssess -AllowClobber
+     ```
 
-   - Next, if you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet (for example, *alice@contoso.com*):
+   - Next, if you aren't sure what value to use for the `RegistrarPool` parameter in your environment, you can get the value from an existing Skype for Business user using this cmdlet (for example, alice@contoso.com):
 
-        ```PowerShell
-        (Get-CsTenant).TenantPoolExtension
-        ```
-        OR by setting a variable
+       ```PowerShell
+       Get-CsOnlineUser -Identity 'alice@contoso.com' | fl registrarpool
+       ```
+       OR by setting a variable
         
-        ```PowerShell
-		$strRegistrarPool = (Get-CsTenant).TenantPoolExtension
-		$strRegistrarPool = $strRegistrarPool[0].Substring($strRegistrarPool[0].IndexOf(':') + 1)
-        ```
+       ```PowerShell
+	$strRegistrarPool = Get-CsOnlineUser -Identity 'alice@contoso.com' | fl registrarpool | out-string
+	$strRegistrarPool = $strRegistrarPool.Substring($strRegistrarPool.IndexOf(':') + 2)
+       ```
         
-    - Enable the Surface Hub account with the following cmdlet:
+   - Enable the Surface Hub account with the following cmdlet:
       
-        ```PowerShell
-        Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool yourRegistrarPool -SipAddressType EmailAddress
-        ```
+       ```PowerShell
+       Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool yourRegistrarPool -SipAddressType EmailAddress
+       ```
         
-        OR using the $strRegistarPool variable from above
+       OR using the $strRegistarPool variable from above
         
-        ```PowerShell
-        Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool $strRegistrarPool -SipAddressType EmailAddress
-        ```
+       ```PowerShell
+       Enable-CsMeetingRoom -Identity 'HUB01@contoso.com' -RegistrarPool $strRegistrarPool -SipAddressType EmailAddress
+       ```
 
 For validation, you should be able to use any Skype for Business client (PC, Android, etc) to sign in to this account.
 
diff --git a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md b/devices/surface-hub/password-management-for-surface-hub-device-accounts.md
index be86720a3a..22e7e1284c 100644
--- a/devices/surface-hub/password-management-for-surface-hub-device-accounts.md
+++ b/devices/surface-hub/password-management-for-surface-hub-device-accounts.md
@@ -2,11 +2,13 @@
 title: Password management (Surface Hub)
 description: Every Microsoft Surface Hub device account requires a password to authenticate and enable features on the device.
 ms.assetid: 0FBFB546-05F0-430E-905E-87111046E4B8
+ms.reviewer: 
+manager: dansimp
 keywords: password, password management, password rotation, device account
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
 ms.localizationpriority: medium
diff --git a/devices/surface-hub/physically-install-your-surface-hub-device.md b/devices/surface-hub/physically-install-your-surface-hub-device.md
index f750d07a4f..6d06a9ac69 100644
--- a/devices/surface-hub/physically-install-your-surface-hub-device.md
+++ b/devices/surface-hub/physically-install-your-surface-hub-device.md
@@ -2,11 +2,13 @@
 title: Physically install Microsoft Surface Hub
 description: The Microsoft Surface Hub Readiness Guide will help make sure that your site is ready for the installation.
 ms.assetid: C764DBFB-429B-4B29-B4E8-D7F0073BC554
+ms.reviewer: 
+manager: dansimp
 keywords: Surface Hub, readiness guide, installation location, mounting options
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
 ms.localizationpriority: medium
@@ -15,7 +17,7 @@ ms.localizationpriority: medium
 # Physically install Microsoft Surface Hub
 
 
-The Microsoft Surface Hub Readiness Guide will help make sure that your site is ready for the installation. You can download the Guide from the [Microsoft Download Center](https://go.microsoft.com/fwlink/?LinkId=718144). It includes planning information for both the 55" and 84" devices, as well as info on moving the Surface Hub from receiving to the installation location, mounting options, and a list of what's in the box.
+The [Microsoft Surface Hub Readiness Guide](surface-hub-site-readiness-guide.md) will help make sure that your site is ready for the installation. It includes planning information for both the 55" and 84" devices, as well as info on moving the Surface Hub from receiving to the installation location, mounting options, and a list of what's in the box.
 
 You may also want to check out the Unpacking Guide. It will show you how to unpack the devices efficiently and safely. There are two guides, one for the 55" and one for the 84". A printed version of the Unpacking Guide is attached to the outside front of each unit's shipping crate.
 
diff --git a/devices/surface-hub/prepare-your-environment-for-surface-hub.md b/devices/surface-hub/prepare-your-environment-for-surface-hub.md
index 6f1deba6b9..198dba4f74 100644
--- a/devices/surface-hub/prepare-your-environment-for-surface-hub.md
+++ b/devices/surface-hub/prepare-your-environment-for-surface-hub.md
@@ -2,11 +2,13 @@
 title: Prepare your environment for Microsoft Surface Hub
 description: This section contains an overview of the steps required to prepare your environment so that you can use all of the features of Microsoft Surface Hub.
 ms.assetid: 336A206C-5893-413E-A270-61BFF3DF7DA9
+ms.reviewer: 
+manager: dansimp
 keywords: prepare environment, features of Surface Hub, create and test device account, check network availability
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 12/04/2017
 ms.localizationpriority: medium
@@ -26,8 +28,8 @@ Review these dependencies to make sure Surface Hub features will work in your IT
 | Active Directory or Azure Active Directory (Azure AD) | 
            The Surface Hub's uses an Active Directory or Azure AD account (called a **device account**) to access Exchange and Skype for Business services. The Surface Hub must be able to connect to your Active Directory domain controller or to your Azure AD tenant in order to validate the device account’s credentials, as well as to access information like the device account’s display name, alias, Exchange server, and Session Initiation Protocol (SIP) address.
            You can also domain join or Azure AD join your Surface Hub to allow a group of authorized users to configure settings on the Surface Hub. |
 | Exchange (Exchange 2013 or later, or Exchange Online) and Exchange ActiveSync | 
            Exchange is used for enabling mail and calendar features, and also lets people who use the device send meeting requests to the Surface Hub, enabling one-touch meeting join.
            ActiveSync is used to sync the device account’s calendar and mail to the Surface Hub. If the device cannot use ActiveSync, it will not show meetings on the welcome screen, and joining meetings and emailing whiteboards will not be enabled. |
 | Skype for Business (Lync Server 2013 or later, or Skype for Business Online)  | Skype for Business is used for various conferencing features, like video calls, instant messaging, and screen sharing.|
-| Mobile device management (MDM) solution (Microsoft Intune, System Center Configuration Manager, or supported third-party MDM provider) | If you want to apply settings and install apps remotely, and to multiple devices at a time, you must set up a MDM solution and enroll the device to that solution. See [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) for details. |
-| Microsoft Operations Managmement Suite (OMS)   | OMS is used to monitor the health of Surface Hub devices. See [Monitor your Surface Hub](monitor-surface-hub.md) for details. |
+| Mobile device management (MDM) solution (Microsoft Intune, Microsoft Endpoint Configuration Manager, or supported third-party MDM provider) | If you want to apply settings and install apps remotely, and to multiple devices at a time, you must set up a MDM solution and enroll the device to that solution. See [Manage settings with an MDM provider](manage-settings-with-mdm-for-surface-hub.md) for details. |
+| Microsoft Operations Management Suite (OMS)   | OMS is used to monitor the health of Surface Hub devices. See [Monitor your Surface Hub](monitor-surface-hub.md) for details. |
 | Network and Internet access   | In order to function properly, the Surface Hub should have access to a wired or wireless network. Overall, a wired connection is preferred. 802.1X Authentication is supported for both wired and wireless connections.


            **802.1X authentication:** In Windows 10, version 1703, 802.1X authentication for wired and wireless connections is enabled by default in Surface Hub. If your organization doesn't use 802.1X authentication, there is no configuration required and Surface Hub will continue to function as normal. If you use 802.1X authentication, you must ensure that the authentication certification is installed on Surface Hub. You can deliver the certificate to Surface Hub using the [ClientCertificateInstall CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/clientcertificateinstall-csp) in MDM, or you can [create a provisioning package](provisioning-packages-for-surface-hub.md) and install it during first run or through the Settings app. After the certificate is applied to Surface Hub, 802.1X authentication will start working automatically.
            **Note:** For more information on enabling 802.1X wired authentication on Surface Hub, see [Enable 802.1x wired authentication](enable-8021x-wired-authentication.md).

            **Dynamic IP:** The Surface Hub cannot be configured to use a static IP. It must use DHCP to assign an IP address.

            **Proxy servers:** If your topology requires a connection to a proxy server to reach Internet services, then you can configure it during first run, or in Settings. Proxy credentials are stored across Surface Hub sessions and only need to be set once. |
 
 Additionally, note that Surface Hub requires the following open ports:
@@ -100,15 +102,15 @@ When you go through the first-run program for your Surface Hub, there's some inf
 
 
 
-
            [Create and test a device account](create-and-test-a-device-account-surface-hub.md)
            
+
            Create and test a device account
            
 
            This topic introduces how to create and test the device account that Surface Hub uses to communicate with and Skype.
            
 
 
-
            [Create provisioning packages](provisioning-packages-for-certificates-surface-hub.md)
            
+
            Create provisioning packages
            
 
            For Windows 10, settings that use the registry or a content services platform (CSP) can be configured using provisioning packages. You can also add certificates during first run using provisioning.
            
 
 
-
            [Admin group management](admin-group-management-for-surface-hub.md)
            
+
            Admin group management
            
 
            Every Surface Hub can be configured individually by opening the Settings app on the device. However, to prevent people who are not administrators from changing the settings, the Settings app requires administrator credentials to open the app and change settings.
            
 
            The Settings app requires local administrator credentials to open the app.
            
 
@@ -121,9 +123,9 @@ When you go through the first-run program for your Surface Hub, there's some inf
 - [Blog post: Surface Hub in a Multi-Domain Environment](https://blogs.technet.microsoft.com/y0av/2017/11/08/11/)
 - [Blog post: Configuring a proxy for your Surface Hub](https://blogs.technet.microsoft.com/y0av/2017/12/03/7/)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/devices/surface-hub/provisioning-packages-for-surface-hub.md b/devices/surface-hub/provisioning-packages-for-surface-hub.md
index 5698f985b0..607c66829e 100644
--- a/devices/surface-hub/provisioning-packages-for-surface-hub.md
+++ b/devices/surface-hub/provisioning-packages-for-surface-hub.md
@@ -1,12 +1,14 @@
 ---
 title: Create provisioning packages (Surface Hub)
-description: For Windows 10, settings that use the registry or a configuration service provider (CSP) can be configured using provisioning packages. 
+description: For Windows 10, settings that use the registry or a configuration service provider (CSP) can be configured using provisioning packages.
 ms.assetid: 8AA25BD4-8A8F-4B95-9268-504A49BA5345
+ms.reviewer: 
+manager: dansimp
 keywords: add certificate, provisioning package
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 03/16/2019
 ms.localizationpriority: medium
@@ -70,11 +72,11 @@ After you [install Windows Configuration Designer](https://technet.microsoft.com
 ### Create the provisioning package 
 
 1. Open Windows Configuration Designer:
-    - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, 
+   - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, 
     
-    or
+     or
     
-    - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**.
+   - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**.
 
 2. Click **Provision Surface Hub devices**.
 
@@ -83,13 +85,13 @@ After you [install Windows Configuration Designer](https://technet.microsoft.com
 ### Configure settings
 
 
- 
-
-
-
-
-
-
+ 
+
+
+
+
+
+
            ![step one](images/one.png) ![add certificates](images/add-certificates.png)

            To provision the device with a certificate, click **Add a certificate**. Enter a name for the certificate, and then browse to and select the certificate to be used.            		![add a certificate](images/add-certificates-details.png)
            ![step two](images/two.png)  ![configure proxy settings](images/proxy.png)

            Toggle **Yes** or **No** for proxy settings. The default configuration for Surface Hub is to automatically detect proxy settings, so you can select **No** if that is the setting that you want. However, if your infrastructure previously required using a proxy server and has changed to not require a proxy server, you can use a provisioning package to revert your Surface Hub devices to the default settings by selecting **Yes** and **Automatically detect settings**. 

            If you toggle **Yes**, you can select to automatically detect proxy settings, or you can manually configure the settings by entering a URL to a setup script, or a static proxy server address. You can also identify whether to use the proxy server for local addresses, and enter exceptions (addresses that Surface Hub should connect to directly without using the proxy server).              		![configure proxy settings](images/proxy-details.png)
            ![step three](images/three.png)  ![device admins](images/set-up-device-admins.png)

            You can enroll the device in Active Directory and specify a security group to use the Settings app, enroll in Azure Active Directory to allow global admins to use the Settings app, or create a local administrator account on the device.

            To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain, and specify the security group to have admin credentials on Surface Hub. If a provisioning package that enrolls a device in Active Directory is going to be applied to a Surface Hub that was reset, the same domain account can only be used if the account listed is a domain administrator or is the same account that set up the Surface Hub initially. Otherwise, a different domain account must be used in the provisioning package.

            Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup). The **maximum number of devices per user** setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click **Get bulk token**. In the **Let's get you signed in** window, enter an account that has permissions to join a device to Azure AD, and then the password. Click **Accept** to give Windows Configuration Designer the necessary permissions.

            To create a local administrator account, select that option and enter a user name and password. 

            **Important:** If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.              		![join Active Directory, Azure AD, or create a local admin account](images/set-up-device-admins-details.png)
            ![step four](images/four.png) ![enroll in device management](images/enroll-mdm.png)

            Toggle **Yes** or **No** for enrollment in MDM. 

            If you toggle **Yes**, you must provide a service account and password or certificate thumbprint that is authorized to enroll the device, and also specify the authentication type. If required by your MDM provider, also enter the URLs for the discovery service, enrollment service, and policy service. [Learn more about managing Surface Hub with MDM.](manage-settings-with-mdm-for-surface-hub.md)            		![enroll in mobile device management](images/enroll-mdm-details.png)
            ![step five](images/five.png) ![add applications](images/add-applications.png)

            You can install multiple Universal Windows Platform (UWP) apps in a provisioning package. For help with the settings, see [Provision PCs with apps](https://technet.microsoft.com/itpro/windows/configure/provision-pcs-with-apps). 

            **Important:** Although the wizard interface allows you to select a Classic Win32 app, only include UWP apps in a provisioning package that will be applied to Surface Hub. If you include a Classic Win32 app, provisioning will fail.             		![add an application](images/add-applications-details.png)
            ![step six](images/six.png)  ![Add configuration file](images/add-config-file.png)

            You don't configure any settings in this step. It provides instructions for including a configuration file that contains a list of device accounts. The configuration file must not contain column headers. When you apply the provisioning package to Surface Hub, if a Surface Hub configuration file is included on the USB drive, you can select the account and friendly name for the device from the file. See [Sample configuration file](#sample-configuration-file) for an example.

            **Important:** The configuration file can only be applied during the out-of-box setup experience (OOBE) and can only be used with provisioning packages created using the Windows Configuration Designer released with Windows 10, version 1703.              		![Add a Surface Hub configuration file](images/add-config-file-details.png)
              ![finish](images/finish.png)

            You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.            		![Protect your package](images/finish-details.png)
            step one add certificates

            To provision the device with a certificate, click Add a certificate. Enter a name for the certificate, and then browse to and select the certificate to be used.            		add a certificate
            step two  configure proxy settings

            Toggle Yes or No for proxy settings. The default configuration for Surface Hub is to automatically detect proxy settings, so you can select No if that is the setting that you want. However, if your infrastructure previously required using a proxy server and has changed to not require a proxy server, you can use a provisioning package to revert your Surface Hub devices to the default settings by selecting Yes and Automatically detect settings. 

            If you toggle Yes, you can select to automatically detect proxy settings, or you can manually configure the settings by entering a URL to a setup script, or a static proxy server address. You can also identify whether to use the proxy server for local addresses, and enter exceptions (addresses that Surface Hub should connect to directly without using the proxy server).              		configure proxy settings
            step three  device admins

            You can enroll the device in Active Directory and specify a security group to use the Settings app, enroll in Azure Active Directory to allow global admins to use the Settings app, or create a local administrator account on the device.

            To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain, and specify the security group to have admin credentials on Surface Hub. If a provisioning package that enrolls a device in Active Directory is going to be applied to a Surface Hub that was reset, the same domain account can only be used if the account listed is a domain administrator or is the same account that set up the Surface Hub initially. Otherwise, a different domain account must be used in the provisioning package.

            Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, set up Azure AD join in your organization. The maximum number of devices per user setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click Get bulk token. In the Let's get you signed in window, enter an account that has permissions to join a device to Azure AD, and then the password. Click Accept to give Windows Configuration Designer the necessary permissions.

            To create a local administrator account, select that option and enter a user name and password. 

            Important: If you create a local account in the provisioning package, you must change the password using the Settings app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.              		join Active Directory, Azure AD, or create a local admin account
            step four enroll in device management

            Toggle Yes or No for enrollment in MDM. 

            If you toggle Yes, you must provide a service account and password or certificate thumbprint that is authorized to enroll the device, and also specify the authentication type. If required by your MDM provider, also enter the URLs for the discovery service, enrollment service, and policy service. Learn more about managing Surface Hub with MDM.            		enroll in mobile device management
            step five add applications

            You can install multiple Universal Windows Platform (UWP) apps in a provisioning package. For help with the settings, see Provision PCs with apps. 

            Important: Although the wizard interface allows you to select a Classic Win32 app, only include UWP apps in a provisioning package that will be applied to Surface Hub. If you include a Classic Win32 app, provisioning will fail.             		add an application
            step six  Add configuration file

            You don't configure any settings in this step. It provides instructions for including a configuration file that contains a list of device accounts. The configuration file must not contain column headers. When you apply the provisioning package to Surface Hub, if a Surface Hub configuration file is included on the USB drive, you can select the account and friendly name for the device from the file. See Sample configuration file for an example.

            Important: The configuration file can only be applied during the out-of-box setup experience (OOBE) and can only be used with provisioning packages created using the Windows Configuration Designer released with Windows 10, version 1703.              		Add a Surface Hub configuration file
              finish

            You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.            		Protect your package
            
 
            
 
 After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page.
@@ -139,11 +141,11 @@ After you [install Windows Configuration Designer](https://technet.microsoft.com
 ### Create the provisioning package (advanced)
 
 1. Open Windows Configuration Designer:
-    - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, 
+   - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, 
     
-    or
+     or
     
-    - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**.
+   - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**.
 
 2. Click **Advanced provisioning**.
    
diff --git a/devices/surface-hub/remote-surface-hub-management.md b/devices/surface-hub/remote-surface-hub-management.md
index 5038e225b5..7a9acbe0fd 100644
--- a/devices/surface-hub/remote-surface-hub-management.md
+++ b/devices/surface-hub/remote-surface-hub-management.md
@@ -4,10 +4,12 @@ description: This section lists topics for managing Surface Hub.
 keywords: remote management, MDM, install apps, monitor Surface Hub, Operations Management Suite, OMS
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
diff --git a/devices/surface-hub/save-bitlocker-key-surface-hub.md b/devices/surface-hub/save-bitlocker-key-surface-hub.md
index 3a013dd827..6bbfd1532a 100644
--- a/devices/surface-hub/save-bitlocker-key-surface-hub.md
+++ b/devices/surface-hub/save-bitlocker-key-surface-hub.md
@@ -2,13 +2,15 @@
 title: Save your BitLocker key (Surface Hub)
 description: Every Microsoft Surface Hub is automatically set up with BitLocker drive encryption software. Microsoft strongly recommends that you make sure you back up your BitLocker recovery keys.
 ms.assetid: E11E4AB6-B13E-4ACA-BCE1-4EDC9987E4F2
+ms.reviewer: 
+manager: dansimp
 keywords: Surface Hub, BitLocker, Bitlocker recovery keys
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 07/27/2017
+ms.date: 07/08/2019
 ms.localizationpriority: medium
 ---
 
@@ -25,7 +27,7 @@ There are several ways to manage your BitLocker key on the Surface Hub.
 
 2.  If you’ve joined the Surface Hub to Azure Active Directory (Azure AD), the BitLocker key will be stored under the account that was used to join the device.
 
-3.  If you’re using an admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive.
+3.  If you’re using a local admin account to manage the device, you can save the BitLocker key by going to the **Settings** app and navigating to **Update & security** > **Recovery**. Insert a USB drive and select the option to save the BitLocker key. The key will be saved to a text file on the USB drive.
 
 
 ## Related topics
diff --git a/devices/surface-hub/set-up-your-surface-hub.md b/devices/surface-hub/set-up-your-surface-hub.md
index 80178e7c22..96f42c3df1 100644
--- a/devices/surface-hub/set-up-your-surface-hub.md
+++ b/devices/surface-hub/set-up-your-surface-hub.md
@@ -2,11 +2,13 @@
 title: Set up Microsoft Surface Hub
 description: Set up instructions for Surface Hub include a setup worksheet, and a walkthrough of the first-run program.
 ms.assetid: 4D1722BC-704D-4471-BBBE-D0500B006221
+ms.reviewer: 
+manager: dansimp
 keywords: set up instructions, Surface Hub, setup worksheet, first-run program
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
 ms.localizationpriority: medium
@@ -35,21 +37,21 @@ Before you turn on your Microsoft Surface Hub for the first time, make sure you'
 
 
 
-
            [Setup worksheet](setup-worksheet-surface-hub.md)
            
-
            When you've finished pre-setup and are ready to start first-time setup for your Surface Hub, make sure you have all the information listed in this section.
            
+
            Setup worksheet
            
+
            When you've finished pre-setup and are ready to start first-time setup for your Surface Hub, make sure you have all the information listed in this section.
            
 
 
-
            [First-run program](first-run-program-surface-hub.md)
            
-
            The term "first run" refers to the series of steps you'll go through the first time you power up your Surface Hub, and means the same thing as "out-of-box experience" (OOBE). This section will walk you through the process.
            
+
            First-run program
            
+
            The term "first run" refers to the series of steps you'll go through the first time you power up your Surface Hub, and means the same thing as "out-of-box experience" (OOBE). This section will walk you through the process.
            
 
 
 
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/devices/surface-hub/setup-worksheet-surface-hub.md b/devices/surface-hub/setup-worksheet-surface-hub.md
index f66fce4ef7..6043d88f1d 100644
--- a/devices/surface-hub/setup-worksheet-surface-hub.md
+++ b/devices/surface-hub/setup-worksheet-surface-hub.md
@@ -2,13 +2,15 @@
 title: Setup worksheet (Surface Hub)
 description: When you've finished pre-setup and are ready to start first-time setup for your Microsoft Surface Hub, make sure you have all the information listed in this section.
 ms.assetid: AC6F925B-BADE-48F5-8D53-8B6FFF6EE3EB
+ms.reviewer: 
+manager: dansimp
 keywords: Setup worksheet, pre-setup, first-time setup
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 07/27/2017
+ms.date: 06/20/2019
 ms.localizationpriority: medium
 ---
 
diff --git a/devices/surface-hub/skype-hybrid-voice.md b/devices/surface-hub/skype-hybrid-voice.md
index 5537a823c7..c805fb9005 100644
--- a/devices/surface-hub/skype-hybrid-voice.md
+++ b/devices/surface-hub/skype-hybrid-voice.md
@@ -1,13 +1,15 @@
 ---
 title: Online or hybrid deployment using Skype Hybrid Voice environment  (Surface Hub)
 description: This topic explains how to enable Skype for Business Cloud PBX with on premises PSTN connectivity via Cloud Connector Edition or Skype for Business 2015 pool.
-keywords: hybrid deployment, Skype Hybrid Voice 
+keywords: hybrid deployment, Skype Hybrid Voice
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
@@ -20,72 +22,72 @@ If you deployed Skype for Business Cloud PBX with one of the hybrid voice option
 >[!WARNING]
 >If you create an account before configuration of Hybrid voice (you run Enable-CSMeetingRoom command), you will not be able to configure required hybrid voice parameters. In order to configure hybrid voice parameters for a previously configured account or to reconfigure a phone number, delete the E5 or E3  + Cloud PBX add-on license, and then follow the steps below, starting at step 3.
 
-1. Create a new user account for Surface Hub. This example uses **surfacehub2@adatum.com**. The account can be created in local Active Directory and synchronized to the cloud, or created directly in the cloud. 
+1. Create a new user account for Surface Hub. This example uses surfacehub2@adatum.com. The account can be created in local Active Directory and synchronized to the cloud, or created directly in the cloud. 
 
     ![new object user](images/new-user-hybrid-voice.png)
 
-2.	Select **Password Never Expires**. This is important for a Surface Hub device.
+2. Select **Password Never Expires**. This is important for a Surface Hub device.
 
-    ![Password never expires](images/new-user-password-hybrid-voice.png)
+   ![Password never expires](images/new-user-password-hybrid-voice.png)
 
-3.	In Office 365, add **E5** license or **E3 and Cloud PBX** add-on to the user account created for the room. This is required for Hybrid Voice to work.
+3. In Office 365, add **E5** license or **E3 and Cloud PBX** add-on to the user account created for the room. This is required for Hybrid Voice to work.
 
-    ![Add product license](images/product-license-hybrid-voice.png)
+   ![Add product license](images/product-license-hybrid-voice.png)
 
-4.	Wait approximately 15 minutes until the user account for the room appears in Skype for Business Online.
+4. Wait approximately 15 minutes until the user account for the room appears in Skype for Business Online.
 
-5.	After the user account for room is created in Skype for Business Online, enable it for Hybrid Voice in Skype for Business Remote PowerShell by running the following cmdlet:
+5. After the user account for room is created in Skype for Business Online, enable it for Hybrid Voice in Skype for Business Remote PowerShell by running the following cmdlet:
 
-    ```
-    Set-csuser surfacehub2@adatum.com EnterpriseVoiceEnabled $true -HostedVoiceMail $true -onpremlineuri tel:+15005000102
-    ```
+   ```
+   Set-csuser surfacehub2@adatum.com EnterpriseVoiceEnabled $true -HostedVoiceMail $true -onpremlineuri tel:+15005000102
+   ```
     
-6.	Validate Hybrid Voice call flow by placing test calls from the Surface Hub.
+6. Validate Hybrid Voice call flow by placing test calls from the Surface Hub.
 
-7.	Start a remote PowerShell session on a PC and connect to Exchange by running the following cmdlets.
+7. Start a remote PowerShell session on a PC and connect to Exchange by running the following cmdlets.
 
-    ```
-    Set-ExecutionPolicy Unrestricted
-    $cred=Get-Credential -Message "Please use your Office 365 admin credentials"
-    $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/ps1-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
-    Import-PSSession $sess
-    ```
+   ```
+   Set-ExecutionPolicy Unrestricted
+   $cred=Get-Credential -Message "Please use your Office 365 admin credentials"
+   $sess= New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/ps1-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
+   Import-PSSession $sess
+   ```
     
-8.	After establishing a session, modify the user account for the room to enable it as a **RoomMailboxAccount** by running the following cmdlets. This allows the account to authenticate with Surface Hub.
+8. After establishing a session, modify the user account for the room to enable it as a **RoomMailboxAccount** by running the following cmdlets. This allows the account to authenticate with Surface Hub.
 
-    ```
-    Set-Mailbox surfacehub2@adatum.com -Type Room
-    Set-Mailbox surfacehub2@adatum.com -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
-    ```
+   ```
+   Set-Mailbox surfacehub2@adatum.com -Type Room
+   Set-Mailbox surfacehub2@adatum.com -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
+   ```
     
-9.	After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy.
+9. After setting up the mailbox, you will need to either create a new Exchange ActiveSync policy, or use a compatible existing policy.
 
-    Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to **False**. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
+   Surface Hubs are only compatible with device accounts that have an ActiveSync policy where the **PasswordEnabled** property is set to **False**. If this isn’t set properly, then Exchange services on the Surface Hub (mail, calendar, and joining meetings), will not be enabled.
     
-    If you haven’t created a compatible policy yet, use the following cmdlet (this one creates a policy called "Surface Hubs"). After it’s created, you can apply the same policy to other device accounts.
+   If you haven’t created a compatible policy yet, use the following cmdlet (this one creates a policy called "Surface Hubs"). After it’s created, you can apply the same policy to other device accounts.
 
-    ```
-    $easPolicy = New-MobileDeviceMailboxPolicy -Name "SurfaceHubs" -PasswordEnabled $false
-    ```
+   ```
+   $easPolicy = New-MobileDeviceMailboxPolicy -Name "SurfaceHubs" -PasswordEnabled $false
+   ```
     
-    After you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. Run the following cmdlets to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox (you may need to re-enable the account and set the password again).
+   After you have a compatible policy, then you will need to apply the policy to the device account. However, policies can only be applied to user accounts and not resource mailboxes. Run the following cmdlets to convert the mailbox into a user type, apply the policy, and then convert it back into a mailbox (you may need to re-enable the account and set the password again).
     
-    ```
-    Set-Mailbox surfacehub2@adatum.com -Type Regular
-    Set-CASMailbox surfacehub2@adatum.com -ActiveSyncMailboxPolicy $easPolicy.id
-    Set-Mailbox surfacehub2@adatum.com -Type Room
-    $credNewAccount = Get-Credential -Message "Please provide the Surface Hub username and password"
-    Set-Mailbox surfacehub2@adatum.com -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true
-    ```
+   ```
+   Set-Mailbox surfacehub2@adatum.com -Type Regular
+   Set-CASMailbox surfacehub2@adatum.com -ActiveSyncMailboxPolicy $easPolicy.id
+   Set-Mailbox surfacehub2@adatum.com -Type Room
+   $credNewAccount = Get-Credential -Message "Please provide the Surface Hub username and password"
+   Set-Mailbox surfacehub2@adatum.com -RoomMailboxPassword $credNewAccount.Password -EnableRoomMailboxAccount $true
+   ```
     
-10.	Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties can be set in [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md). The following cmdlets provide an example of setting Exchange properties.
+10. Various Exchange properties must be set on the device account to improve the meeting experience. You can see which properties can be set in [Exchange properties](exchange-properties-for-surface-hub-device-accounts.md). The following cmdlets provide an example of setting Exchange properties.
 
     ```
     Set-CalendarProcessing surfacehub2@adatum.com -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false
     Set-CalendarProcessing surfacehub2@adatum.com -AddAdditionalResponse $true -AdditionalResponse "This is a Surface Hub room!"
     ```
 
-11.	Enable the mailbox as a meeting device in Skype for Business Online. Run the following cmdlet which enables the acount as a meeting device. 
+11. Enable the mailbox as a meeting device in Skype for Business Online. Run the following cmdlet which enables the account as a meeting device. 
 
     ```
     Get-CsTenant | select registrarpool
@@ -103,4 +105,4 @@ At this moment the room account is fully configured, including Hybrid Voice. If
 In the following image, you can see how the device appears to users.
 
 
-![](images/select-room-hybrid-voice.png)
\ No newline at end of file
+![](images/select-room-hybrid-voice.png)
diff --git a/devices/surface-hub/support-solutions-surface-hub.md b/devices/surface-hub/support-solutions-surface-hub.md
index 66d4455737..b683f85daf 100644
--- a/devices/surface-hub/support-solutions-surface-hub.md
+++ b/devices/surface-hub/support-solutions-surface-hub.md
@@ -2,11 +2,13 @@
 title: Top support solutions for Microsoft Surface Hub
 description: Find top solutions for common issues using Surface Hub.
 ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A
+ms.reviewer: 
+manager: dansimp
 keywords: Troubleshoot common problems, setup issues
 ms.prod: surface-hub
 ms.sitesec: library
-author: kaushika-msft
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 10/24/2017
 ms.localizationpriority: medium
diff --git a/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md b/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md
new file mode 100644
index 0000000000..98ad30890e
--- /dev/null
+++ b/devices/surface-hub/surface-Hub-installs-updates-and-restarts-outside-maintenance-hours.md
@@ -0,0 +1,40 @@
+---
+title: Surface Hub may install updates and restart outside maintenance hours
+description: troubleshooting information for Surface Hub regarding automatic updates
+ms.assetid: 6C09A9F8-F9CF-4491-BBFB-67A1A1DED0AA
+keywords: surface hub, maintenance window, update
+ms.prod: surface-hub
+ms.sitesec: library
+author: Teresa-MOTIV
+ms.author: v-tea
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# Surface Hub may install updates and restart outside maintenance hours
+
+Under specific circumstances, Surface Hub installs updates during business hours instead of during the regular maintenance window. The device then restarts if it is necessary. You cannot use the device until the process is completed.
+
+> [!NOTE]  
+> This isn't expected behavior for missing a maintenance window. It occurs only if the device is out-of-date for a long time.
+
+## Cause
+To ensure that Surface Hub remains available for use during business hours, the Hub is configured to perform administrative functions during a maintenance window that is defined in Settings (see "References," below). During this maintenance period, the Hub automatically installs any available updates through Windows Update or Windows Server Update Service (WSUS). Once updates are complete, the Hub may restart.
+
+Updates can be installed during the maintenance window only if the Surface Hub is turned on but not in use or reserved. For example, if the Surface Hub is scheduled for a meeting that lasts 24 hours, any updates that are scheduled to be installed will be deferred until the Hub is available during the next maintenance window. If the Hub continues to be busy and misses multiple maintenance windows, the Hub will eventually begin to install and download updates. This can occur during or outside the maintenance window. Once the download and installation has begun, the device may restart.
+
+## To avoid this issue
+
+It's important that you set aside maintenance time for Surface Hub to perform administrative functions. Reserving the Surface Hub for 24 hour intervals or using the device during the maintenance window delays installing updates. We recommend that you not use or reserve the Hub during scheduled maintenance period. A two-hour window should be reserved for updating.
+
+One option that you can use to control the availability of updates is Windows Server Update Service (WSUS). WSUS provides control over what updates are installed and when.
+
+## References 
+ 
+[Update the Surface Hub](first-run-program-surface-hub.md#update-the-surface-hub) 
+
+[Maintenance window](manage-windows-updates-for-surface-hub.md#maintenance-window) 
+
+[Deploy Windows 10 updates using Windows Server Update Services (WSUS)](/windows/deployment/update/waas-manage-updates-wsus) 
+
+
diff --git a/devices/surface-hub/surface-hub-2s-account.md b/devices/surface-hub/surface-hub-2s-account.md
new file mode 100644
index 0000000000..fb93b0e7d9
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-account.md
@@ -0,0 +1,96 @@
+---
+title: "Create Surface Hub 2S device account"
+description: "This page describes the procedure for creating the Surface Hub 2S device account."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Create Surface Hub 2S device account
+
+Creating a Surface Hub device account (also known as a Room mailbox) allows Surface Hub 2S to receive, approve, or decline meeting requests and join meetings using Microsoft Teams or Skype for Business. Configure the device account during OOBE setup. If needed you can change it later (without going through OOBE setup).
+
+Unlike standard Room mailboxes that remain disabled by default, you need to enable the Surface Hub 2S device account to sign on to Microsoft Teams and Skype for Business. Surface Hub 2S relies on Exchange ActiveSync, which requires an ActiveSync mailbox policy on the device account. Apply the default ActiveSync mailbox policy that comes with Exchange Online.
+
+Create the account using the Microsoft 365 admin center or by using PowerShell. You can use Exchange Online PowerShell to configure specific features including: 
+
+- Calendar processing for every Surface Hub device account.
+- Custom auto replies to scheduling requests.
+- If the default ActiveSync mailbox policy has already been modified by someone else or another process, you will likely have to create and assign a new ActiveSync mailbox policy 
+
+## Create account using Microsoft 365 admin center
+
+1. In the Microsoft 365 admin center, go to **Resources** and choose **Rooms & Equipment** and then select **+ Room**.
+
+2. Provide a name and email address for the device account. Leave remaining settings unchanged in the default state.
+
+![Provide a name and email address](images/sh2-account2.png)
+
+![Leave remaining settings unchanged in the default state](images/sh2-account3.png)
+
+3. Set the password for the device account. To set the password, choose **Users** and then select **Active Users**. Now search for the newly created user to set the password. Ensure that you **do not** select the option **Make this user change their password when they first sign in.**
+
+![Set the password for the device account](images/sh2-account4.png)
+
+4. Assign the room with an Office 365 license. It’s recommended to assign the Office 365 **Meeting Room** license, a new option that automatically enables the account for Skype for Business Online and Microsoft Teams.
+
+![Assign Office 365 license](images/sh2-account5.png)
+
+### Finalize setup via PowerShell
+
+- **Skype for Business:** For Skype for Business only (on-premises or online), you can enable the Skype for Business object by running **Enable-CsMeetingRoom** to enable features such as Meeting room prompt for audio and Lobby hold.
+
+- **Microsoft Teams and Skype for Business Calendar:** Set [**Calendar Auto processing**](https://docs.microsoft.com/surface-hub/surface-hub-2s-account?source=docs#set-calendar-auto-processing) for this account.
+
+## Create account using PowerShell
+Instead of using the Microsoft Admin Center portal, you can create the account using PowerShell.
+
+### Connect to Exchange Online PowerShell
+
+```powershell
+$365Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell -Credential (Get-Credential) -Authentication Basic –AllowRedirection
+$ImportResults = Import-PSSession $365Session
+```
+
+### Create a new Room Mailbox
+
+```powershell
+New-Mailbox -MicrosoftOnlineServicesID account@YourDomain.com -Alias SurfaceHub2S -Name SurfaceHub2S -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString  -String "" -AsPlainText -Force)
+```
+
+### Set Calendar Auto processing
+
+```powershell
+Set-CalendarProcessing -Identity "account@YourDomain.com" -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts   $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false -AddAdditionalResponse $true -AdditionalResponse "This room is equipped with a Surface Hub"
+```
+
+### Assign a license
+
+```powershell
+Connect-MsolService
+Set-Msoluser -UserPrincipalName account@YourDomain.com -UsageLocation IE
+Set-MsolUserLicense -UserPrincipalName "account@YourDomain.com" -AddLicenses "contoso:MEETING_ROOM"
+```
+
+## Connect to Skype for Business Online using PowerShell
+
+### Install prerequisites
+
+- [Visual C++ 2017 Redistributable](https://aka.ms/vs/15/release/vc_redist.x64.exe)
+- [Skype for Business Online PowerShell Module](https://www.microsoft.com/download/confirmation.aspx?id=39366)
+
+```powershell
+Import-Module LyncOnlineConnector
+$SfBSession = New-CsOnlineSession -Credential (Get-Credential)
+Import-PSSession $SfBSession -AllowClobber
+
+# Enable the Skype for Business meeting room
+Enable-CsMeetingRoom -Identity account@YourDomain.com -RegistrarPool(Get-CsTenant).Registrarpool -SipAddressType EmailAddress
+```
diff --git a/devices/surface-hub/surface-hub-2s-adoption-kit.md b/devices/surface-hub/surface-hub-2s-adoption-kit.md
new file mode 100644
index 0000000000..2cc29c519b
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-adoption-kit.md
@@ -0,0 +1,59 @@
+---
+title: "Surface Hub 2S Adoption and training guides"
+description: "Microsoft has developed downloadable materials that you can make available for your users to aid in adoption of Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 11/04/2019
+ms.localizationpriority: Medium
+---
+
+# Surface Hub 2S adoption and training guides
+
+Whether you're a small or large business, a Surface Hub adoption plan is critical in generating the right use cases and helping your users become comfortable with the device. Check out these downloadable guides designed to help you deliver training across your organization.
+
+## On-demand training
+
+- [Surface Hub 2S adoption and training videos](surface-hub-2s-adoption-videos.md)
+
+## Adoption toolkit
+
+- [Surface Hub adoption toolkit](downloads/SurfaceHubAdoptionToolKit.pdf)
+
+## Training guides
+
+- [Training guide – end user](downloads/TrainingGuide-SurfaceHub2S-EndUser.pdf)
+- [Training guide – power user](downloads/TrainingGuide-SurfaceHub2S-PowerUser.pdf)
+- [Training guide – help desk](downloads/TrainingGuide-SurfaceHub2S-HelpDesk.pdf)
+- [Training guide – Microsoft Teams desktop](downloads/Guide-SurfaceHub2S-Teams.pptx)
+
+[Download all training guides](https://download.microsoft.com/download/2/2/3/2234F70E-E65A-4790-93DF-F4C373A75B8E/SurfaceHub2S-TrainerGuides-July2019.zip)
+
+## End user guides
+
+- [Guide to Navigation on Surface Hub](downloads/Guide-SurfaceHub2S-Navigation.pptx)
+- [Guide to Office 365 on Surface Hub](downloads/Guide-SurfaceHub2S-Office365.pptx)
+- [Guide to Microsoft Whiteboard on Surface Hub](downloads/Guide-SurfaceHub2S-Whiteboard.pptx)
+- [Guide to Microsoft Teams on Surface Hub](downloads/Guide-SurfaceHub2S-Teams.pptx)
+
+[Download all end user guides](https://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip)
+
+## Quick reference cards
+
+- [Connect your PC](downloads/QRCConnectYourPC.pdf) 
+- [Join a Teams Meeting](downloads/QRCJoinTeamsMeeting.pdf)
+- [Manage a Teams meeting](downloads/QRCManageTeamsMeeting.pdf)
+- [Navigation basics](downloads/QRCNavigationBasics.pdf)
+- [Schedule a Teams meeting](downloads/QRCScheduleTeamsMeeting.pdf)
+- [Start a new Teams meeting](downloads/QRCStartNewTeamsMeeting.pdf)
+- [Share or send a file](downloads/QRCShareSendFile.pdf)
+- [Sign in to view meetings and files](downloads/QRCSignInToViewMeetingsFiles.pdf)
+- [Whiteboard advanced](downloads/QRCWhiteboardAdvanced.pdf)
+- [Whiteboard tools](downloads/QRCWhiteboardTools.pdf)
+
+[Download all quick reference cards](https://download.microsoft.com/download/E/7/F/E7FC6611-BB55-43E1-AF36-7BD5CE6E0FE0/SurfaceHub2S-EndUserGuides-July2019.zip)
diff --git a/devices/surface-hub/surface-hub-2s-adoption-videos.md b/devices/surface-hub/surface-hub-2s-adoption-videos.md
new file mode 100644
index 0000000000..5e0419624f
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-adoption-videos.md
@@ -0,0 +1,137 @@
+---
+title: "Surface Hub 2S on-demand adoption and training videos"
+description: "This page contains on-demand training for Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 11/04/2019
+ms.localizationpriority: Medium
+---
+
+# Surface Hub 2S on-demand adoption and training videos
+
+This page contains comprehensive training for Surface Hub 2S, available on demand.
+
+## Chapter 1 - Training overview
+
+> ![VIDEO ]
            
+
+- Welcome and introduction
+- Training overview and agenda
+- Software and technology reference
+- Surface Hub messaging
+- Industries and user roles
+- Overview of training services
+- Training best practices
+
+## Chapter 2 - Getting started with Surface Hub
+
+> ![VIDEO ]
            
+
+- What is Surface Hub?
+- Technical overview
+- Steelcase Roam and the mobility story
+- Surface Hub services
+- Getting started with Surface Hub
+- Gathering expectations
+
+## Chapter 3 - Navigating Surface Hub
+
+> ![VIDEO ]
            
+
+- Welcome screen
+- Start menu
+- Full screen
+- Clip to Whiteboard
+- Task bar menu
+- Teams/Skype
+- End Session
+
+## Chapter 4 - Whiteboarding and collaboration
+
+> ![VIDEO ]
            
+
+- Whiteboard introduction
+- Starting the Whiteboard
+- Whiteboard tools
+- Inserting pictures
+- Changing the background
+- Sharing the whiteboard
+- Export the Whiteboard	
+ 
+## Chapter 5 - Exploring Surface Hub apps
+
+> ![VIDEO ]
            
+
+- Surface Hub apps introduction
+- PowerPoint overview
+- Microsoft Word
+- Microsoft Excel
+- Microsoft Edge
+
+## Chapter 6 - Advanced apps and Office 365
+
+> ![VIDEO ]
            
+
+- Advanced apps introduction
+- Microsoft Maps
+- Photos
+- Power BI
+- Sign in to Office 365
+- OneDrive
+- CoAuthor documents
+
+## Chapter 7 - Connecting devices
+
+> ![VIDEO ]
            
+
+- Connect introduction
+- Miracast overview
+- Touch and Pen Input
+- Wired connect overview
+- Line of Business app workflows
+- Troubleshooting Miracast and wired connect	
+ 
+## Chapter 8 - Skype for Business meetings
+
+> ![VIDEO ]
            
+
+- Introduction to Skype for Business
+-Scheduling Skype for Business meetings
+- Start a meeting
+- Start an ad hoc meeting
+- Join a meeting on your calendar
+- Managing a Skype for Business meeting
+- Present content
+	
+## Chapter 9 - Microsoft Teams meetings
+
+> ![VIDEO ]
            
+
+- Introduction to Microsoft Teams
+- Scheduling Microsoft Teams meetings
+- Start a meeting
+- Start an ad hoc meeting
+- Join a meeting on your calendar
+- Managing a Microsoft Teams meeting
+- Present content
+- Conclusion
+
+## Chapter 10 - Basic troubleshooting
+
+> ![VIDEO ]
            
+
+- Introduction to Surface Hub troubleshooting
+- Application troubleshooting
+- End Session
+- Restart the device
+- Power cycle the device
+- Factory reset
+- Settings
+- Manage Surface Hub
+- Conclusion
\ No newline at end of file
diff --git a/devices/surface-hub/surface-hub-2s-change-history.md b/devices/surface-hub/surface-hub-2s-change-history.md
new file mode 100644
index 0000000000..f629bd6bd6
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-change-history.md
@@ -0,0 +1,38 @@
+---
+title: "Change history for Surface Hub 2S"
+description: "This page shows change history for Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+audience: Admin
+ms.manager: laurawi
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Change history for Surface Hub 2S
+
+This topic summarizes new and updated content in the Surface Hub 2S documentation library.
+
+## August 2019
+
+Changes | Description
+|:--- |:--- 
+|Connect devices to Surface Hub 2S| Updated with guidance for connecting to a second display.
+
+## July 2019
+
+Changes | Description
+|:--- |:--- |
+| Reset and recovery for Surface Hub 2S | Added link to Surface recovery website that enables customers to download a recovery image for Surface Hub 2S |
+| Surface Hub 2S tech specs | Updated power consumption data |
+| Surface Hub 2S Adoption Kit | New |
+
+## June 2019
+
+Changes | Description
+|:--- |:--- |
+| Published new guidance for Surface Hub 2S | New |
diff --git a/devices/surface-hub/surface-hub-2s-connect.md b/devices/surface-hub/surface-hub-2s-connect.md
new file mode 100644
index 0000000000..a32df68734
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-connect.md
@@ -0,0 +1,134 @@
+---
+title: "Connect devices to Surface Hub 2S"
+description: "This page explains how to connect external devices to Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 11/13/2019
+ms.localizationpriority: Medium
+---
+
+# Connect devices to Surface Hub 2S
+Surface Hub 2S enables you to connect external devices, mirror the display on Surface Hub 2S to another device, and connect multiple third-party peripherals including video conference cameras, conference phones, and room system devices.
+
+You can display content from your devices to Surface Hub 2S. If the source device is Windows-based, that device can also provide TouchBack and InkBack, which takes video and audio from the connected device and presents them on Surface Hub 2S. If Surface Hub 2S encounters a High-Bandwidth Digital Content Protection (HDCP) signal, such as a Blu-ray DVD player, the source is displayed as a black image.
+
+> [!NOTE]
+> Surface Hub 2S uses the video input selected until a new connection is made, the existing connection is disrupted, or the Connect app is closed.
+
+## Recommended wired configurations 
+
+In general, it’s recommended to use native cable connections whenever possible such as USB-C to USB-C or HDMI to HDMI. Other combinations such as MiniDP to HDMI or MiniDP to USB-C will also work. Some additional configuration may be required to optimize the video-out experience, as described on this page.
+
+| **Connection** | **Functionality** | **Description**|
+| --- | --- | ---|
+| HDMI + USB-C | HDMI-in for audio and video

            USB-C for TouchBack and InkBack | USB-C supports TouchBack and InkBack with the HDMI A/V connection.

            Use USB-C to USB-A to connect to legacy computers.

            **NOTE:** For best results, connect HDMI before connecting a USB-C cable. If the computer you're using for HDMI is not compatible with TouchBack and InkBack, you won't need a USB-C cable. |
+| USB-C 
             (via compute module) | Video-in 
            Audio-in | Single cable needed for A/V

            TouchBack and InkBack is supported

            HDCP enabled |
+| HDMI (in port) | Video, Audio into Surface Hub 2S | Single cable needed for A/V

            TouchBack and InkBack not supported

            HDCP enabled |
+| MiniDP 1.2 output | Video-out such as mirroring to a larger projector. | Single cable needed for A/V |
+
+When you connect a guest computer to Surface Hub 2S via the USB-C port, several USB devices are discovered and configured. These peripheral devices are created for TouchBack and InkBack. As shown in the following table, the peripheral devices can be viewed in Device Manager, which will show duplicate names for some devices, as shown in the following table.
+
+ 
+|**Peripheral**| **Listing in Device Manager** |
+| ---------------------------- |------------- | ------------------------------|
+| Human interface devices | HID-compliant consumer control device
            HID-compliant pen
            HID-compliant pen (duplicate item)
            HID-compliant pen (duplicate item)
            HID-compliant touch screen
            USB Input Device
            USB Input Device (duplicate item) |
+| Keyboards | Standard PS/2 keyboard |
+| Mice and other pointing devices | HID-compliant mouse |
+| USB controllers | Generic USB hub
            USB composite device |
+
+## Connecting video-in to Surface Hub 2S
+
+You can input video to Surface Hub 2S using USB-C or HDMI, as indicated in the following table.  
+
+### Surface Hub 2S video-in settings
+
+| **Signal Type** | **Resolution** | **Frame rate** | **HDMI** | **USB-C** |
+| --------------- | -------------- | -------------- | -------- | --------- |
+| PC              | 640 x 480      | 60             | X        | X         |
+| PC              | 720 x 480      | 60             | X        | X         |
+| PC              | 1024 x 768     | 60             | X        | X         |
+| PC              | 1920 x 1080    | 60             | X        | X         |
+| PC              | 3840x2560      | 30             | X        | X         |
+| HDTV            | 720p           | 60             | X        | X         |
+| HDTV            | 1080p          | 60             | X        | X         |
+| 4K UHD          | 3840x2560      | 30             | X        | X         |
+
+> [!NOTE]
+> The 4K UHD resolution (3840×2560) is only supported when connecting to ports on the compute module. It is not supported on the “guest” USB ports located on the left, top, and right sides of the device.
+
+> [!NOTE]
+> Video from a connected external PC may appear smaller when displayed on Surface Hub 2S.
+
+## Mirroring Surface Hub 2S display on another device
+
+You can output video to another display using MiniDP, as indicated in the following table.
+
+### Surface Hub 2S video-out settings
+
+| **Signal Type** | **Resolution** | **Frame rate** | **MiniDP** |
+| --------------- | -------------- | -------------- | ---------- |
+| PC              | 640 x 480      | 60             | X          |
+| PC              | 720 x 480      | 60             | X          |
+| PC              | 1024 x 768     | 60             | X          |
+| PC              | 1920 x 1080    | 60             | X          |
+| PC              | 3840 x 2560    | 60             | X          |
+| HDTV            | 720p           | 60             | X          |
+| HDTV            | 1080p          | 60             | X          |
+| 4K UHD          | 3840 x 2560    | 60             | X          |
+
+
+ 
+Surface Hub 2S includes a MiniDP video-out port for projecting visual content from Surface Hub 2S to another display. If you plan to use Surface Hub 2S to project to another display, note the following recommendations:
+
+- **Keyboard required.** Before you begin, you’ll need to connect either a wired or Bluetooth-enabled external keyboard  to Surface Hub 2S. Note that unlike the original Surface Hub, a keyboard for Surface Hub 2S is sold separately and is not included in the shipping package.

            
+- **Set duplicate mode.** Surface Hub 2S supports video-out in duplicate mode only. However, you will still need to manually configure the display mode when you connect for the first time:
+    1. Enter the **Windows logo key** + **P**, which opens the Project pane on the right side of Surface Hub 2S, and then select **Duplicate** mode.
+    2. When you’re finished with your Surface Hub 2S session, select **End Session**. This ensures that the duplicate setting is saved for the next session.

            
+- **Plan for different aspect ratios.** Like other Surface devices, Surface Hub 2S uses a 3:2 display aspect ratio (the relationship between the width and the height of the display). Projecting Surface Hub 2S onto displays with different aspect ratios is supported. Note however that because Surface Hub 2S duplicates the display, the MiniDP output will also only display in a 3:2 aspect ratio, which may result in letterboxing or curtaining depending on the aspect ratio of the receiving display. 
+
+> [!NOTE]
+> if your second monitor uses a 16:9 aspect ratio (the predominant ratio for most TV monitors), black bars may appear on the left and right sides of the mirrored display. If this occurs, you may wish to inform your users that there is no need to adjust the second display.
+
+## Selecting cables
+
+Note the following recommendations:
+
+- **USB.** USB 3.1 Gen 2 cables.
+- **MiniDP.** DisplayPort cables certified for up to 3 meters in length.
+- **HDMI.** If a long cable is necessary, HDMI is recommended due to the wide availability of cost-effective, long-haul cables with the ability to install repeaters if needed.
+
+> [!NOTE]
+> Most DisplayPort sources will automatically switch to HDMI signaling if HDMI is detected.
+
+## Wirelessly connect to Surface Hub 2S
+
+Windows 10 natively supports Miracast, which lets you wireless connect to Surface Hub 2S.

            
+
+### To connect using Miracast:
+
+1. On your Windows 10 device, enter **Windows logo key** + **K**. 
+2. In the Connect window, look for the name of your Surface Hub 2S in the list of nearby devices. You can find the name of your Surface Hub 2S in the bottom left corner of the display.
+3. Enter a PIN if your system administrator has enabled the PIN setting for Miracast connections. This requires you to enter a PIN number when you connect to Surface Hub 2S for the first time.
+
+> [!NOTE]
+>If you do not see the name of the Surface Hub 2S device as expected, it’s possible the previous session was prematurely closed. If so, sign into Surface Hub 2S directly to end the previous session and then connect from your external device.
+
+## Connecting peripherals to Surface Hub 2S
+
+### Bluetooth accessories
+
+You can connect the following accessories to Surface Hub-2S using Bluetooth:
+
+- Mice
+- Keyboards
+- Headsets
+- Speakers
+
+> [!NOTE]
+> After you connect a Bluetooth headset or speaker, you might need to change the default microphone and speaker settings. For more information, see [**Local management for Surface Hub settings**](https://docs.microsoft.com/surface-hub/local-management-surface-hub-settings).
diff --git a/devices/surface-hub/surface-hub-2s-custom-install.md b/devices/surface-hub/surface-hub-2s-custom-install.md
new file mode 100644
index 0000000000..c86ac8b4b3
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-custom-install.md
@@ -0,0 +1,86 @@
+---
+title: "Customize wall mount of Surface Hub 2S"
+description: "Learn how to perform a custom install of Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Customize wall mount of Surface Hub 2S
+
+If you’re not using certified mounting solutions, you can mount Surface Hub 2S using readily available retail hardware.
+
+## Set wall mount measurements
+
+Surface Hub 2S recommended mounting measurements:
+
+|**Item**|**Description**|**Notes**|
+|:------ |:------------- |:------- |
+|**Height from bottom of Surface Hub 2S**| 1026.5 mm (40.41”) | Recommended |
+|**Height from top of Surface Hub 2S**| 1767.2 mm (69.57”) | Recommended |
+|**Height from center of mount**| 1397 mm (55”) | Recommended |
+
+1. Measure 1026.5 mm (40.41”) from the floor level to set the recommended minimum height.
+2. Measure 1767.2 mm (69.57”) from the floor level to set the recommended top height.
+
+![*Surface Hub 2S wall mount front view*](images/sh2-wall-front.png) 
            
+
+3. Measure 1397 mm (55”) mm from the floor level to set the recommended center height.
+
+![*Surface Hub 2S wall mount side view*](images/sh2-wall-side.png) 
            
+
+## Obstruction free mounting
+
+In addition to the visible ports on the sides of the device, certain integrated components must remain free of obstruction in order to function correctly. These include the Bluetooth, Wi-Fi, occupancy, and mic sensors as well thermal cooling vents.
+ Keep out zones
+
+|**Item**|**Description**|**Notes**|
+|:---- |:----------- |:----- |
+|**Access**| Ensure unimpeded access to input/output ports, the compute cartridge, Bluetooth radio, Bluetooth sensor, Wi-Fi radio, Wi-Fi sensor, occupancy sensor. | See Figure 1. |
+|**Air flow**| Avoid blocking inlet and outlet air vent zones. | See Figure 2  |
+|**Audio**| Avoid blocking audio exit zone on rear of Surface Hub 2S. | See Figure 2. |
+
+![*Figure 1. Keep out zones for Surface Hub 2S components*](images/sh2-keepout-zones.png) 
            
+***Figure 1. Keep out zones for Surface Hub 2S components***
+
+![*Figure 2. Avoid blocking thermal inlet/outlet and audio exit zones*](images/sh2-thermal-audio.png) 
            
+***Figure 2. Avoid blocking thermal inlet/outlet and audio exit zones.
            ***
+
+The removable compute cartridge containing the I/O ports must remain free of any obstructions or impediments of any kind.
+
+![*Figure 3.View of compute cartridge on the underside of Surface Hub 2s.*](images/sh2-ports.png) 
            
+***Figure 3.View of compute cartridge on the underside of Surface Hub 2s.***
+
+![*Figure 4. Unimpeded removal of compute cartridge *](images/sh2-cartridge.png) 
            
+***Figure 4. Unimpeded removal of compute cartridge***
+
+## Selecting a mounting system
+
+Surface Hub 2S uses a 350 mm x 350 mm mounting framework that meets most — but not all — of the criteria listed in the VESA Flat Display Mounting Interface Standard. You can install Surface Hub 2S using any of various off-the-shelf display brackets designed to accommodate displays that diverge from exact VESA specifications, as shown below.
+
+On the back of Surface Hub 2S, you’ll find a square pattern of four M6 x 1.0 threaded holes centered on the circular bump (565 mm in diameter). Attach your mount using four M6 x 1.0–12 mm-long metric bolts. Or, depending on preference, you can use longer bolts up to a maximum of 20 mm.
+Important considerations for mounting systems
+
+|**Item**|**Description**|**Notes**|
+|:------ |:------------- |:------- |
+|**Strength**| Only choose mounts that can safely support devices of at least 28 kg (62 lbs.). | Required |
+|**Stiffness**| Avoid flexible display mounts that can diminish the interactive pen and touch use experience. Most TV mounts are not designed to support touch displays. | Recommended |
+|**Depth**| Keep the device mounted tightly to the wall especially in corridors and along circulation paths within rooms.| Recommended |
+|**Versatility**| Ensure your mounting solution remains hidden from view in both the existing landscape mode and any  potential portrait mode (subject to future availability). | Recommended |
+
+![*Figure 5. Surface Hub 2S mounting configuration*](images/sh2-mount-config.png) 
            
+***Figure 5. Surface Hub 2S mounting configuration***
+
+## Mounting methods compatible with Surface Hub 2S
+
+Surface Hub 2S is compatible with mounts that allow you to place it at angles of 10-70 degrees from the vertical plane. Rail mounts typically have multiple holes and a set of slots, enabling compatibility across a wide range of displays. A rail attached to the wall and two mounts attached to the display enable you to securely install Surface Hub 2S to a wall. When evaluating rail mounts for compatibility, ensure they meet versatility requirements listed earlier.
+
+![*Figure 6. Rail mounts*](images/h2gen-railmount.png)
            
+***Figure 6. Surface Hub 2S rail mounts***
diff --git a/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md b/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md
new file mode 100644
index 0000000000..77fe0fa1ca
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-deploy-apps-intune.md
@@ -0,0 +1,58 @@
+---
+title: "Deploy apps to Surface Hub 2S using Intune"
+description: "Learn how you can deploy apps to Surface Hub 2S using Intune."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Deploy apps to Surface Hub 2S using Intune
+
+You can install additional apps to fit your team or organization's needs.
+
+## Developer guidelines
+
+- Surface Hub only runs [Universal Windows Platform (UWP) apps](https://msdn.microsoft.com/windows/uwp/get-started/whats-a-uwp). Apps created using the [Desktop App Converter](https://docs.microsoft.com/windows/uwp/porting/desktop-to-uwp-run-desktop-app-converter) will not run on Surface Hub.
+- Apps must be targeted for the [Universal device family](https://msdn.microsoft.com/library/windows/apps/dn894631) or Windows Team device family.
+- Surface Hub only supports [offline-licensed apps](https://docs.microsoft.com/microsoft-store/distribute-offline-apps) from [Microsoft Store for Business](https://businessstore.microsoft.com/store).
+- By default, apps must be Store-signed to be installed. During testing and development, you can also choose to run developer-signed UWP apps by placing the device in developer mode.
+- When developing and submitting apps to the Microsoft Store, set Device family availability and Organizational licensing options to ensure that apps are available to run on Surface Hub.
+- You need admin credentials to install apps on Surface Hub. Designed for use in meeting rooms and other shared spaces, Surface Hub prevents regular users from accessing the Microsoft Store to download and install apps.
+
+## Deployment guidelines
+
+You can deploy Universal Windows Platform (UWP) apps to Surface Hub 2S using Intune, easing app deployment to devices.
+
+1. To deploy apps, enable MDM for your organization. In the Intune portal, select **Intune** as your MDM Authority (recommended). 
            
+
+    ![Choose MDM authority](images/sh2-set-intune5.png)
+
+2. Enable the Microsoft Store for Business in Intune. Open Intune, select **Client apps** > **Microsoft Store for Business.** 
            
+
+    ![Enable Store for Business](images/sh2-deploy-apps-sync.png)
+
+3. In Intune open **Microsoft Store for Business** and select **Settings** > **Distribute** > **Management tools**. Choose **Microsoft Intune** as your management tool. 
            
+
+    ![Add Intune as your management tool](images/sh2-set-intune8.png)
+
+4. In Microsoft Store for Business, select **Settings** > **Shop** > **Shopping Experience**, and then select **Show offline apps**. Offline apps refer to apps that can be synced to Intune and centrally deployed to a device.
+5. After enabling Offline shopping, you can acquire offline licenses for apps that you can sync to Intune and deploy as Device licensing.
+6. In **Intune** > **Client apps** > **Microsoft Store for Business**, select **Sync**.
+7. In the Client apps page, search for the app in the apps list. Assign the apps to the desired device group or groups. Select **Assignments** > **Add group**. 
            
+
+![*Assigning apps to groups *](images/sh2-assign-group.png) 
            
+
+8. Under assignment type, choose **Required**. 
            
+
+![*Assigning apps to groups *](images/sh2-add-group.png) 
            
+
+9. For the selected groups, choose **Device licensing** and then select **OK** and save the assignment. 
            
+ 
+![*Assigning apps to groups *](images/sh2-apps-assign.png)
diff --git a/devices/surface-hub/surface-hub-2s-deploy-checklist.md b/devices/surface-hub/surface-hub-2s-deploy-checklist.md
new file mode 100644
index 0000000000..08421ad2f6
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-deploy-checklist.md
@@ -0,0 +1,65 @@
+---
+title: "Surface Hub 2S deployment checklists"
+description: "Verify your deployment of Surface Hub 2S using pre- and post-deployment checklists."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Surface Hub 2S deployment checklists
+
+## Surface Hub 2S pre-deployment checklist
+
+|**Item**|**Response**|
+|:------ |:------ |
+|**Device account name**| |
+|**Device account UPN**| |
+|**ActiveSync Policy**| |
+|**Calendar processing configuration completed**| ☐ Yes 
              ☐ No |
+|**Device-friendly name**| |
+|**Device host name**| |
+|**Affiliation**| ☐ None 
             ☐ Active Directory affiliation 
             ☐ Azure Active Directory |
+|**Microsoft Teams Mode**| ☐ Mode 0 
             ☐ Mode 1 
             ☐ Mode 2 |
+|**Device Management**| ☐ Yes, Microsoft Intune 
             ☐ Yes, other mobile device manager [MDM] 
             ☐ None |  
+|**Proxy**| ☐ Automatic configuration 
             ☐ Proxy server 
             ☐ Proxy auto-config (PAC) file |
+|**Proxy authentication**| ☐ Device account credentials 
             ☐ Prompt for credentials |
+|**Password rotation**| ☐ On 
             ☐ Off |
+|**Skype for Business additional domain names (on-premises only)**| |
+|**Session timeout time**| |
+|**Session timeout action**| ☐ End session 
             ☐ Allow resume |
+|**My meetings and files**| ☐ Enabled 
             ☐ Disabled |
+|**Lock screen timeout**| |
+|**Sleep idle timeout**| |
+|**Bluetooth**| ☐ On 
             ☐ Off |
+|**Use only BitLocker USB drives**| ☐ On 
             ☐ Off |
+|**Install additional certificates (on-premises only)**| |
+|**Windows update**| ☐ Windows Update for Business 
             ☐ Windows Server Update Services [WSUS] |
+|**Surface app speaker setting**| ☐ Rolling stand 
             ☐ Wall-mounted |
+|**IP Address**| ☐ Wired — DHCP 
             ☐ Wired — DHCP reservation 
             ☐ Wireless — DHCP 
             ☐ Wireless — DHCP reservation |
+
+## Surface Hub 2S post-deployment checklist
+
+|**Check**|**Response**|
+|:------|:---------|
+|**Device account syncing**| ☐ Yes 
             ☐ No |
+|**Bitlocker key**| ☐ Saved to file (no affiliation) 
             ☐ Saved in Active Directory (AD affiliation) 
            ☐ Saved in Azure AD (Azure AD affiliation) |
+|**Device OS updates**| ☐ Completed |
+|**Windows Store updates**| ☐ Automatic 
             ☐ Manual |
+|**Microsoft Teams scheduled meeting**| ☐ Confirmation email received 
             ☐ Meeting appears on start screen 
              ☐ One-touch join functions 
             ☐ Able to join audio 
             ☐ Able to join video 
             ☐ Able to share screen ||
+|**Skype for Business scheduled meeting**| ☐ Confirmation email received 
             ☐ Meeting appears on start screen 
             ☐ One-touch join functions correctly 
             ☐ Able to join audio 
             ☐ Able to join video 
             ☐ Able to share screen 
             ☐ Able to send/receive IM |
+|**Scheduled meeting when already invited**| ☐ Meeting declined |
+|**Microsoft Teams ad-hoc meeting**| ☐ Invite other users work 
             ☐ Able to join audio 
             ☐ Able to join video 
             ☐ Able to share screen |
+|**Skype for Business scheduled meeting**| ☐ Invite other users work 
             ☐ Able to join audio 
             ☐ Able to join video 
             ☐ Able to share screen 
             ☐ Able to send/receive IM |
+|**Microsoft Whiteboard**| ☐ Launch from Welcome / Start screen 
             ☐ Launch from Microsoft Teams | 
+|**Incoming Skype/Teams call**| ☐ Able to join audio
            ☐ Able to join video 
             ☐ Able to share screen 
             ☐ Able to send/receive IM (Skype for Business only) |
+|**Incoming live video streams**| ☐ Maximum 2 (Skype for Business) 
             ☐ Maximum 4 (Microsoft Teams) |
+|**Microsoft Teams Mode 0 behavior**| ☐ Skype for Business tile on Welcome/Start screen 
             ☐ Can join scheduled Skype for Business meetings (Skype UI) 
             ☐ Can join scheduled Teams meetings (Teams UI) |
+|**Microsoft Teams Mode 1 behavior**| ☐ Teams tile on Welcome/Start screen 
             ☐ Can join scheduled Skype for Business meetings (Skype UI) 
             ☐ Can join scheduled Teams meetings (Teams UI) |
+|**Microsoft Teams Mode 2 behavior**| ☐ Teams tile on Welcome / Start screen 
             ☐ Can join scheduled Teams meetings 
             ☐ Fail to join Skype for Business meetings |
diff --git a/devices/surface-hub/surface-hub-2s-deploy.md b/devices/surface-hub/surface-hub-2s-deploy.md
new file mode 100644
index 0000000000..87908ed944
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-deploy.md
@@ -0,0 +1,66 @@
+---
+title: "Create provisioning packages for Surface Hub 2S"
+description: "This page describes how to deploy Surface Hub 2S using provisioning packages and other tools."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Create provisioning packages for Surface Hub 2S
+
+You can use Windows Configuration Designer (WCD) to create provisioning packages to automate the deployment process of Surface Hub 2S. Use provisioning packages to add certificates, configure proxies, set up device administrators and device accounts. You can also use provisioning packages along with a configuration file to deploy multiple Surface Hubs with a single USB thumb drive.
+
+### Install Windows Configuration Designer
+
+Install Windows Configuration Designer from the Windows Assessment and Deployment Kit (ADK) for Windows 10. Download and install the [ADK for Windows 10, version 1703](https://go.microsoft.com/fwlink/p/?LinkId=845542). For more information, see [Download and install the Windows ADK](https://docs.microsoft.com/windows-hardware/get-started/adk-install).
+
+### Add certificates
+
+You can import Certificate Authority certificates to Surface Hub 2S.
+To add certificates to Surface Hub 2S, you need a copy of each certificate as X.509 in .cer format. You cannot import .crt, .pfx or other container formats. Certificates must be imported into Windows Configuration Designer and arranged by hierarchy:
+
+ ![Add certificates](images/sh2-wcd.png)
+
+### Configure proxy during OOBE
+
+In Windows Configuration Designer, go to the Configure proxy settings tab and enter the appropriate settings as shown below.
+
+ ![Configure proxy settings](images/sh2-proxy.png) 
+
+> [!NOTE]
+> When configuring proxy settings, turn off **Automatically detect settings** if you intend to use a setup script or a proxy server. You can use a setup script *or* a proxy server, not both.
+
+### Affiliate Surface Hub 2S with Azure Active Directory
+
+You can affiliate Surface Hub 2S with Azure Active Directory using a provisioning package:
+As an Azure Active Directory Global Administrator, you can join large numbers of new Windows devices to Azure Active Directory and Intune using a bulk token.
+
+To create a bulk token, give it a friendly name, configure the expiration date (maximum of 30 days) and use your Admin credentials to acquire the token as shown below:
+
+ ![Set up device admins](images/sh2-token.png) 

            
+ ![Set up device admins](images/sh2-token2.png) 

            
+ ![Set up device admins](images/sh2-token3.png) 

            
+
+### Provisioning multiple devices (.csv file)
+
+In addition to the provisioning package, you can use a Surface Hub configuration file to make it even easier to set up your devices. A Surface Hub configuration file contains a list of device accounts and friendly names for wireless projection. During first run, you get an option to choose a device account and friendly name from a configuration file.
+
+### To create a Surface Hub configuration file
+
+1. Using Microsoft Excel or another CSV editor, create a CSV file named: **SurfaceHubConfiguration.csv**
+2. Enter a list of device accounts and friendly names in this format:
+
+```
+,,
+```
+
+3. Save the file to the root of the USB thumb drive where you copied the PPKG file.
+
+    ![Configuration file example](images/sh2-config-file.png)
diff --git a/devices/surface-hub/surface-hub-2s-install-mount.md b/devices/surface-hub/surface-hub-2s-install-mount.md
new file mode 100644
index 0000000000..1ae4dcadb6
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-install-mount.md
@@ -0,0 +1,36 @@
+---
+title: "Install and mount Surface Hub 2S"
+description: "Learn how to install and mount Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Install and mount Surface Hub 2S
+
+Surface Hub 2S is designed for ease of mobility with a form factor that enables you to quickly install and begin using the device. Microsoft has partnered with Steelcase on the following certified mounting solutions: Roam Mobile Stand and Roam Wall Mount. Both fully integrate with the design of Surface Hub 2S, enabling unimpeded access to the compute cartridge, power, USB-A, USB-C, and other ports.
+
+You can mount Surface Hub 2S with the certified wall mount or the certified mobile stand, both developed in partnership with Steelcase. Both fully integrate with the design of Surface Hub 2S, enabling unimpeded access to the compute cartridge along with all I/O ports and power. 
+
+For more information, see [Officially licensed third-party accessories](http://licensedhardware.azurewebsites.net/surface) and view installation demos from the Surface product team at [Steelcase mobile stand and APC battery set up](https://youtu.be/VTzdu4Skpkg).
+
+ ![Surface Hub 2S on Roam Mobile Stand](images/sh2-mobile-stand.png)
            
+
+If you’re not using licensed accessories, see [Customize wall mount of Surface Hub 2S](surface-hub-2s-custom-install.md).
+
+| 1. **Set up your mount first** | |
+|:------ |:-------- |
+| Leave your Surface Hub in the box until the mount is set up and mounting hardware is applied. Mount is not included. Your mount is sold separately. | ![* Set up your mount first *](images/sh2-setup-1.png) 
             |
+| 2. **Attach hardware to the Surface Hub** | |
+| Mounting hardware and specific instructions are found in the box for your mount. | ![* Attach hardware to the Surface Hub *](images/sh2-setup-2.png) 
             |
+| 3. **Remove the instructional label before mounting.** | |
+| Get someone to help you lift and mount your Surface Hub. Make sure to hold and lift the Surface Hub from the bottom. | ![* Remove the instructional label before mounting *](images/sh2-setup-3.png) 
             |
+| 4. **Attach accessories and power on** | |
+| Install accessories and attach power cable as shown. See guides on the screen cling. Remove cling wrap from the screen. Press the power button to power on. | ![* Attach accessories and power on *](images/sh2-setup-4.png) 
             |
diff --git a/devices/surface-hub/surface-hub-2s-manage-intune.md b/devices/surface-hub/surface-hub-2s-manage-intune.md
new file mode 100644
index 0000000000..be1df464ef
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-manage-intune.md
@@ -0,0 +1,74 @@
+---
+title: "Manage Surface Hub 2S with Intune"
+description: "Learn how to update and manage Surface Hub 2S using Intune."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Manage Surface Hub 2S with Intune
+
+## Register Surface Hub 2S with Intune
+
+Surface Hub 2S allows IT administrators to manage settings and policies using a mobile device management (MDM) provider. Surface Hub 2S has a built-in management component to communicate with the management server, so there is no need to install additional clients on the device.
+
+### Manual registration
+
+1. Sign in as a local administrator on Surface Hub 2S and open the **Settings** app. Select **Surface Hub** > **Device management** and then select **+** to add.
+2. After authenticating, the device will automatically register with Intune.
+
+ ![Register Surface Hub 2S with Intune](images/sh2-set-intune1.png)
            
+
+### Auto registration — Azure Active Directory Affiliated
+
+During the initial setup process, when affiliating a Surface Hub with an Azure AD tenant that has Intune auto enrollment enabled, the device will automatically enroll with Intune. For more information, refer to [Intune enrollment methods for Windows devices](https://docs.microsoft.com/intune/enrollment/windows-enrollment-methods). Azure AD affiliation and Intune auto enrollment is required for the Surface Hub to be a "compliant device" in Intune. 
+
+## Windows 10 Team Edition settings
+
+Select Windows 10 Team for preset device restriction settings for Surface Hub and Surface Hub 2S.
+
+ ![Set device restrictions for Surface Hub 2S.](images/sh2-set-intune3.png) 
            
+
+These settings include user experience and app behavior, Azure Log Analytics registration, Maintenance windows configuration, Session settings, and Miracast settings. For a complete list of available Windows 10 Team settings, see [SurfaceHub CSP](https://docs.microsoft.com/windows/client-management/mdm/surfacehub-csp).
+
+## Additional supported configuration service providers (CSPs)
+
+For additional supported CSPs, see [Surface Hub CSPs in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference#surfacehubcspsupport).
+
+## Quality of Service (QoS) settings
+
+To ensure optimal video and audio quality on Surface Hub 2S, add the following QoS settings to the device. The settings are identical for Skype for Business and Teams.
+
+|**Name**|**Description**|**OMA-URI**|**Type**|**Value**|
+|:------ |:------------- |:--------- |:------ |:------- |
+|**Audio Ports**| Audio Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubAudio/SourcePortMatchCondition | String  | 50000-50019 |
+|**Audio DSCP**| Audio ports marking | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubAudio/DSCPAction | Integer | 46 |
+|**Video Ports**| Video Port range | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubVideo/SourcePortMatchCondition | String  | 50020-50039 |
+|**Video DSCP**| Video ports marking | ./Device/Vendor/MSFT/NetworkQoSPolicy/HubVideo/DSCPAction | Integer | 34 |
+
+> [!NOTE]
+> These are the default port ranges. Administrators may change the port ranges in the Skype for Business and Teams control panel.
+
+## Microsoft Teams Mode settings
+
+You can set the Microsoft Teams app mode using Intune. Surface Hub 2S comes installed with Microsoft Teams in mode 0, which supports both Microsoft Teams and Skype for Business. You can adjust the modes as shown below.
+
+### Modes:
+
+- Mode 0 — Skype for Business with Microsoft Teams functionality for scheduled meetings.
+- Mode 1 — Microsoft Teams with Skype for Business functionality for scheduled meetings.
+- Mode 2 — Microsoft Teams only.
+
+To set modes, add the following settings to a custom Device Configuration Profile.
+
+|**Name**|**Description**|**OMA-URI**|**Type**|**Value**|
+|:--- |:--- |:--- |:--- |:--- |
+|**Teams App ID**|App name|./Vendor/MSFT/SurfaceHub/Properties/VtcAppPackageId|String| Microsoft.MicrosoftTeamsforSurfaceHub_8wekyb3d8bbwe!Teams|
+|**Teams App Mode**|Teams mode|./Vendor/MSFT/SurfaceHub/Properties/SurfaceHubMeetingMode|Integer| 0 or 1 or 2|
diff --git a/devices/surface-hub/surface-hub-2s-manage-passwords.md b/devices/surface-hub/surface-hub-2s-manage-passwords.md
new file mode 100644
index 0000000000..accd5d7e84
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-manage-passwords.md
@@ -0,0 +1,21 @@
+---
+title: "Manage device account password rotation"
+description: "Learn how to configure Surface Hub 2S on-premises accounts with PowerShell"
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+# Manage device account password rotation
+
+You can configure Surface Hub 2S to automatically change a device account password without requiring you to manually update the device account information.
+
+If you turn on Password Rotation, Surface Hub 2S changes the password every 7 days. The automatically generated passwords contain 15-32 characters including  a combination of uppercase and lowercase letters, numbers, and special characters.
+
+Passwords do not change during a meeting. If Surface Hub 2S is turned off, it attempts to change the password immediately when turned on or every 10 minutes until successful.
diff --git a/devices/surface-hub/surface-hub-2s-onprem-powershell.md b/devices/surface-hub/surface-hub-2s-onprem-powershell.md
new file mode 100644
index 0000000000..fb2c98dcbd
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-onprem-powershell.md
@@ -0,0 +1,72 @@
+---
+title: "Configure Surface Hub 2S on-premises accounts with PowerShell"
+description: "Learn how to configure Surface Hub 2S on-premises accounts with PowerShell"
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Configure Surface Hub 2S on-premises accounts with PowerShell
+
+## Connect to Exchange Server PowerShell
+
+> [!IMPORTANT]
+> You'll need the Fully Qualified Domain Name (FQDN) for the Client Access service of the on-premises Exchange server for some of these cmdlets.
+
+```PowerShell
+$ExchServer = Read-Host "Please Enter the FQDN of your Exchange Server"
+$ExchSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://$ExchServer/PowerShell/ -Authentication Kerberos -Credential (Get-Credential)
+Import-PSSession $ExchSession
+```
+
+```PowerShell
+$ExchServer = Read-Host "Please Enter the FQDN of your Exchange Server"
+$ExchSession = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://$ExchServer/PowerShell/ -Authentication Kerberos -Credential (Get-Credential)
+Import-PSSession $ExchSession
+```
+
+## Create the device account
+
+```PowerShell
+New-Mailbox -UserPrincipalName Hub01@contoso.com -Alias Hub01 -Name "Hub 01" -Room -EnableRoomMailboxAccount $true -RoomMailboxPassword (ConvertTo-SecureString -String  -AsPlainText -Force)
+```
+
+## Set automatic calendar processing
+
+```PowerShell
+Set-CalendarProcessing -Identity "HUB01@contoso.com" -AutomateProcessing AutoAccept -AddOrganizerToSubject $false –AllowConflicts   $false –DeleteComments $false -DeleteSubject $false -RemovePrivateProperty $false -AddAdditionalResponse $true -AdditionalResponse "This room is equipped with a Surface Hub"
+```
+
+## Enable the Skype for Business object
+
+> [!NOTE]
+> It is important that you know the FQDN of the Skype for Business Registrar Pool.
+
+```PowerShell
+Enable-CsMeetingRoom -Identity Contoso\HUB01 -SipAddressType emailaddress -RegistrarPool SfbIEFE01.contoso.local
+```
+
+## Mobile Device Mailbox Policy
+
+You may need to create a Mobile Device Mailbox Policy (also known as ActiveSync Policy) to allow your Surface Hub to connect to your online or on-premises environment.
+
+## Create a Surface Hub mobile device mailbox policy
+
+```PowerShell
+New-MobileDeviceMailboxPolicy -Name “Surface Hubs” -PasswordEnabled $false
+```
+
+## Additional settings
+
+It is recommended to add a MailTip to Surface Hub rooms so users remember to make the meeting a Skype for Business or Teams meeting:
+
+```PowerShell
+Set-Mailbox "Surface Hub 2S" -MailTip "This is a Surface Hub room. Please make sure this is a Microsoft Teams meeting."
+```
diff --git a/devices/surface-hub/surface-hub-2s-onscreen-display.md b/devices/surface-hub/surface-hub-2s-onscreen-display.md
new file mode 100644
index 0000000000..da4712505e
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-onscreen-display.md
@@ -0,0 +1,39 @@
+---
+title: "Adjust Surface Hub 2S brightness, volume, and input"
+description: "Learn how to use the onscreen display to adjust brightness and other settings in Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 07/09/2019
+ms.localizationpriority: Medium
+---
+# Adjust Surface Hub 2S brightness, volume, and input
+
+Surface Hub 2S provides an on-screen display for volume, brightness, and input control. The Source button functions as a toggle key to switch between the volume, brightness, and input control menus.
+
+## To show the on-screen display
+
+- Press and hold the **Source** button for 4 seconds.
+
+  ![Surface Hub 2S on-screen display](images/sh2-onscreen-display.png)
            
+
+ When the on-screen display is visible, use one or more buttons to reach desired settings.
+ 
+## To adjust volume
+
+- Use the **Volume up/down** button to increase or decrease volume.
+
+## To adjust brightness
+
+1. Press the **Source** button again to switch to the brightness menu.
+2. Use the **Volume up/down** button to increase or decrease brightness.
+
+## To adjust input
+
+1. Press the **Source** button twice to switch to the Source menu.
+2. Use the **Volume up/down** button to switch between PC, HDMI, and USB-C inputs.
diff --git a/devices/surface-hub/surface-hub-2s-pack-components.md b/devices/surface-hub/surface-hub-2s-pack-components.md
new file mode 100644
index 0000000000..287f43ec7b
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-pack-components.md
@@ -0,0 +1,85 @@
+---
+title: "How to pack and ship your Surface Hub 2S for service"
+description: "Instructions for packing Surface Hub 2S components, replacing the Compute cartridge, and replacing the camera"
+keywords: pack, replace components, camera, compute cartridge
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 07/1/2019
+ms.localizationpriority: Medium
+---
+
+# How to pack and ship your Surface Hub 2S for service
+
+If you replace your Surface Hub 2S, one of its components, or a related accessory, use the instructions in this article when you pack the device for shipment. 
+
+>[!IMPORTANT]  
+>When packing your device for shipment, make sure that you use the packaging in which your replacement device arrived.  
+
+## How to pack your Surface Hub 2S 50”
+
+Use the following steps to pack your Surface Hub 2S 50" for shipment.
+
+![The Surface Hub unit and mobile stand.](images/surface-hub-2s-repack-1.png)
+
+![Remove the pen and the camera. Do not pack them with the unit.](images/surface-hub-2s-repack-2.png)
+
+![Remove the drive and the power cable. Do not pack them with the unit.](images/surface-hub-2s-repack-3.png)
+
+![Do not pack the Setup guide with the unit.](images/surface-hub-2s-repack-4.png)
+
+![Unplug all cables, slide the cover sideways, and unscrew the locking screw of the Compute Cartridge.](images/surface-hub-2s-repack-5.png)
+
+![Slide the Compute Cartridge out of the unit.](images/surface-hub-2s-repack-6.png)
+
+![You will need the Compute Cartridge and a screwdriver.](images/surface-hub-2s-repack-7.png)
+
+![Remove the cover screw and the cover from the Compute Cartridge, and then remove the solid state drive (SSD).](images/surface-hub-2s-repack-8.png)
+
+![Replace the cover and slide the Compute Cartridge back into the unit.](images/surface-hub-2s-repack-9.png)
+
+![Re-fasten the locking screw and slide the cover into place.](images/surface-hub-2s-repack-10.png)
+
+![Remove any base or mounting hardware. Using two people, place the unit in the base of the shipping container.](images/surface-hub-2s-repack-11.png)
+
+![Replace the cover of the shipping container, and insert the four clips.](images/surface-hub-2s-repack-12.png)
+
+![Close the four clips.](images/surface-hub-2s-repack-13.png)
+
+## How to replace and pack your Surface Hub 2S Compute Cartridge
+
+Use the following steps to remove the Surface Hub 2S Compute Cartridge, pack it for shipment, and install the new Compute Cartridge.
+
+![Image of the compute cartridge.](images/surface-hub-2s-replace-cartridge-1.png)
+
+![Unplug all cables, slide the cover sideways, and unscrew the locking screw of the Compute Cartridge.](images/surface-hub-2s-replace-cartridge-2.png)
+
+![Slide the Compute Cartridge out of the unit.](images/surface-hub-2s-replace-cartridge-3.png)
+
+![You will need the Compute Cartridge and a screwdriver.](images/surface-hub-2s-replace-cartridge-4.png)
+
+![Remove the cover screw and the cover from the Compute Cartridge, and then remove the solid state drive (SSD). When finished, replace the cover.](images/surface-hub-2s-repack-8.png)
+
+![You will need the packaging fixtures that were used to package your replacement Compute Cartridge.](images/surface-hub-2s-replace-cartridge-6.png)
+
+![Place the old Compute Cartridge in the packaging fixtures.](images/surface-hub-2s-replace-cartridge-7.png)
+
+![Place the old Compute Cartridge and its packaging into the box that was used for the replacement Compute Cartridge. Reseal the box.](images/surface-hub-2s-replace-cartridge-8.png)
+
+![Image of the replacement Compute Cartridge.](images/surface-hub-2s-replace-cartridge-1.png)
+
+![Slide the replacement Compute Cartridge into the unit.](images/surface-hub-2s-replace-cartridge-9.png)
+
+![Fasten the locking screw and slide the cover into place.](images/surface-hub-2s-replace-cartridge-10.png)
+
+## How to replace your Surface Hub 2S Camera
+
+Use the following steps to remove the Surface Hub 2S camera and install the new camera.
+
+![You will need the new camera and the two-millimeter allen wrench](images/surface-hub-2s-replace-camera-1.png)
+
+![Unplug the old camera from the unit. If needed, use the allen wrench to adjust the new camera. Plug the new camera into the unit.](images/surface-hub-2s-replace-camera-2.png)
diff --git a/devices/surface-hub/surface-hub-2s-phone-authenticate.md b/devices/surface-hub/surface-hub-2s-phone-authenticate.md
new file mode 100644
index 0000000000..f79bbca0d4
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-phone-authenticate.md
@@ -0,0 +1,43 @@
+---
+title: "Configure password-less phone sign-in for Surface Hub 2S"
+description: "Learn how to simplify signing in to Surface Hub 2S using password-less phone sign-in on your mobile device."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Configure password-less phone sign-in  for Surface Hub 2S
+
+Password-less phone sign-in simplifies signing-in to your meetings and files on Surface Hub 2S.
+
+> [!NOTE]
+> Password-less phone sign-in requires that your primary email address must match your UPN.
+
+## To set up password-less phone sign-in
+
+1. Download the [Microsoft Authenticator](https://www.microsoft.com/account/authenticator) app for iPhone or Android to your phone.
+2. From your PC, go to [https://aka.ms/MFASetup](https://aka.ms/MFASetup) , sign in with your account, and select **Next.**
+3. In the Additional security verification screen, select Mobile App and Use verification code, and then select **Setup**.
+
+## To configure mobile app
+
+1. In the Microsoft authenticator app on your phone, add an account, choose **Work or School Account**, and then scan the QR code displayed on your PC
+2. Send a notification to your phone and then approve the sign-in request.
+3. In the Authenticator app on your phone, use the drop-down menu next to your account and select **Enable phone sign-in**.
+4. If required, register your device with your organization and follow the on-screen instructions.
+
+## To sign in to Surface Hub
+
+1. On Surface Hub, sign into **My meetings and files** and select **Send notification** when prompted.
+2. Match the number displayed on your phone with the number displayed on Surface Hub to approve your sign-in request.
+3. If prompted, enter the PIN or biometric ID on your phone to complete sign-in.
+
+## Learn more
+For more information, see [Password-less phone sign-in with the Microsoft Authenticator app](https://docs.microsoft.com/azure/active-directory/authentication/howto-authentication-phone-sign-in).
diff --git a/devices/surface-hub/surface-hub-2s-port-keypad-overview.md b/devices/surface-hub/surface-hub-2s-port-keypad-overview.md
new file mode 100644
index 0000000000..8a667d95ac
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-port-keypad-overview.md
@@ -0,0 +1,43 @@
+---
+title: "Surface Hub 2S ports and keypad overview"
+description: "This page describes the ports, physical buttons, and configuration information essential for connecting to Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Surface Hub 2S ports and keypad overview
+
+This page describes the ports, physical buttons, and configuration information essential for connecting to Surface Hub 2S whether via wired, Wi-Fi, or Bluetooth methods. It also includes best practice recommendations for key connectivity scenarios.
+
+> [!NOTE]
+> You can find the serial number on the outside of the packaging, on the display by the power cord, or by using the Surface app. 
+
+The figure below shows the location of ports and physical buttons on a keypad attached to the underside of the device. The table includes detailed descriptions of each element.
+
+ ![Front facing and underside view of I/O connections and physical buttons](images/hub2s-schematic.png)
+
+## Port and keypad component reference
+
+|**Key**|**Component**|**Description**|**Key parameters**|
+|:--- |:--------- |:----------- |:-------------- |
+| 1 | **USB C** | **USB 3.1 Gen 1** 
             Use as a walk-up port for plugging in peripherals such as thumb-drives. Guest ports are on each side of the device (4).
             
             *NOTE: This is the recommended port for connecting an external camera. Additional camera mount features are incorporated into the design to help support retention of attached cameras.*
             
             NOTE: TouchBack and video ingest are not supported on these ports. | Type C 
             
             15 W Port (5V/3A)       |
+| 2 | **AC power** | **100-240 V input** 
             Connect to standard AC power and Surface Hub 2S will auto switch to the local power standard such as110 volts in the US and Canada or 220 volts in the UK. | IEC 60320 C14 |
+| 3 | **DC power** | **24V DC input port** 
             Use for connecting to mobile battery. | Xbox1 Dual barrel to Anderson connector |
+| 4 | **Ethernet** | **1000/100/10 Base-T** 
             Use for providing a continuous connection in a corporate environment and related scenarios requiring maximum stability or capacity. | RJ45 |
+| 5 | **USB-A** | **USB 3.1 Gen 1** 
             Use as a walk-up port for plugging in peripherals such as thumb-drives. | Type A
            7.5 W Port (5V/1.5A) |
+| 6 | **USB-C** | **USB 3.1 Gen 1** 
             Use as a walk-up port for connecting external PCs and related devices or plugging in peripherals such as thumb-drives.
             
             *NOTE: This is the recommended  input port for video, TouchBack, and InkBack.* | Type C 
             18 W Port (5V/3A, 9V/2A) |
+| 7 | **HDMI-in** | **HDMI 2.0, HDCP 2.2 /1.4** 
             Use for multiple scenarios including HDMI-to-HDMI guest input. | Standard HDMI |
+| 8 | **Mini DP-out** | **Mini DP 1.2 output** 
             Use for video-out scenarios such as mirroring the Surface Hub 2S display to a larger projector.
             
             *NOTE: This supports a maximum resolution of 3840 x 2160 (4K UHD) @60Hz.* | Mini DP |
+| 9 | **Source**  | Use to toggle among connected ingest sources — external PC, HDMI, and Mini DP modes. | n/a |
+| 10 | **Volume** | Use +/- to adjust audio locally on the device. 
             
             *NOTE: When navigating to the brightness control, use +/- on the volume slider to control display brightness.* | n/a |
+| 11 | **Power** | Power device on/off. 
             Use also to navigate display menus and select items. | n/a |
+
+ ![Rear facing view of wireless, audio, & related components](images/hub2s-rear.png)
diff --git a/devices/surface-hub/surface-hub-2s-prepare-environment.md b/devices/surface-hub/surface-hub-2s-prepare-environment.md
new file mode 100644
index 0000000000..5f10258934
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-prepare-environment.md
@@ -0,0 +1,50 @@
+---
+title: "Prepare your environment for Surface Hub 2S"
+description: "Learn what you need to do to prepare your environment for Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 11/21/2019
+ms.localizationpriority: Medium
+---
+
+# Prepare your environment for Surface Hub 2S
+
+## Office 365 readiness
+
+If you use Exchange Online, Skype for Business Online, Microsoft Teams, or Microsoft Whiteboard, and intend to manage Surface Hub 2S with Intune, first review the [Office 365 requirements for endpoints](https://docs.microsoft.com/office365/enterprise/office-365-endpoints).
+
+Office 365 endpoints help optimize your network by sending all trusted Office 365 network requests directly through your firewall, bypassing all additional packet-level inspection or processing. This feature reduces latency and your perimeter capacity requirements.
+
+Microsoft regularly updates the Office 365 service with new features and functionality, which may alter required ports, URLs, and IP addresses. To evaluate, configure, and stay up to date with changes, subscribe to the [Office 365 IP Address and URL Web service](https://docs.microsoft.com/office365/enterprise/office-365-ip-web-service).
+
+## Device affiliation
+
+Use Device affiliation to manage user access to the Settings app on Surface Hub 2S.
+With the Windows 10 Team Edition operating system (that runs on Surface Hub 2S),  only authorized users can adjust settings using the Settings app. Since choosing the affiliation can impact feature availability, plan appropriately to ensure that users can access features as intended.
+
+> [!NOTE]
+> You can only set Device affiliation during the initial out-of-box experience (OOBE) setup. If you need to reset Device affiliation, you’ll have to repeat OOBE setup.
+
+## No affiliation
+
+No affiliation is like having Surface Hub 2S in a workgroup with a different local Administrator account on each Surface Hub 2S. If you choose No affiliation, you must locally save the [BitLocker Key to a USB thumb drive](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-key-management-faq). You can still enroll the device with Intune; however, only the local admin can access the Settings app using the account credentials configured during OOBE. You can change the Administrator account password from the Settings app.
+
+## Active Directory Domain Services
+
+If you affiliate Surface Hub 2S with on-premises Active Directory Domain Services, you need to manage access to the Settings app using a security group on your domain. This helps ensure that all security group members have permissions to change settings on Surface Hub 2S. Also note the following:
+
+- When Surface Hub 2S affiliates with your on-premises Active Directory Domain Services, the BitLocker key can be saved in the Active Directory Schema. For more information, see [Prepare your organization for BitLocker: Planning and policies](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies). 
+- Your organization’s Trusted Root CAs are pushed to the same container in Surface Hub 2S, which means you don’t need to import them using a provisioning package.
+- You can still enroll the device with Intune to centrally manage settings on your Surface Hub 2S.
+
+## Azure Active Directory
+
+When you choose to affiliate your Surface Hub 2S with Azure Active Directory (Azure AD), any user in the Global Admins Security Group can sign in to the Settings app on Surface Hub 2S. Currently, no other group can be delegated to sign in to the Settings app on Surface Hub 2S.
+
+If you enabled Intune Automatic Enrollment for your organization, Surface Hub 2S will automatically enroll itself with Intune. The device’s BitLocker key is automatically saved in Azure AD. When affiliating Surface Hub 2S with Azure AD, single sign-on and Easy Authentication will not work.
diff --git a/devices/surface-hub/surface-hub-2s-quick-start.md b/devices/surface-hub/surface-hub-2s-quick-start.md
new file mode 100644
index 0000000000..3d7f08641a
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-quick-start.md
@@ -0,0 +1,46 @@
+---
+title: "Surface Hub 2S quick start"
+description: "View the quick start steps to begin using Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Surface Hub 2S quick start
+
+## Unpack Surface Hub 2S
+
+1. Use the handles on each side of the box to move it to the space where you'll set it up.
+2. Before opening, remove the clips (4) on the front and back, and then lift the top off the box using the handles.
+3. In the base of the Surface Hub 2S, open the accessories box containing the setup guide, Surface Hub 2 pen, Surface Hub 2 camera, and the power cable.
+4. On the back of the Surface Hub, there's an instructional label showing you where to attach the mounting hardware. Install them in place and remove the label.
+
+See this video for more information about [unboxing and set up](https://youtu.be/fCrxdNXvru4).
+
+## Install and adjust pen
+
+1. Attach Surface Hub 2 pen magnetically to your preferred side of the device.
+
+![*Surface Hub 2 pen comes ready to use. To replace AAA battery, pull off the top button and insert battery as shown. The indicator light will turn red when the battery is low.*](images/sh2-pen.png) 
            
+
+2. To adjust pen pressure, open the Surface app on Surface Hub 2S, select Pen, and adjust the slider.
+
+![*Adjust the slider to change pen pressure *](images/sh2-pen-pressure.png) 
            
+
+## Install camera
+
+Remove the lens cling from the camera and attach it to the USB-C port on the top of the Surface Hub 2S.
+
+## Start Surface Hub 2S
+
+1. Insert the power cable into the back of the device and plug it into a power outlet. Run the cable through any cable guides on your mounting solution and remove the screen clang.
+2. To begin, press the power button on the bottom right.
+
+![* Keypad showing source, volume and power buttons*](images/sh2-keypad.png) 
            
diff --git a/devices/surface-hub/surface-hub-2s-recover-reset.md b/devices/surface-hub/surface-hub-2s-recover-reset.md
new file mode 100644
index 0000000000..af763b9e26
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-recover-reset.md
@@ -0,0 +1,69 @@
+---
+title: "Reset and recovery for Surface Hub 2S"
+description: "Learn how to recover and reset Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 12/05/2019
+ms.localizationpriority: Medium
+---
+
+# Reset and recovery for Surface Hub 2S
+
+If you encounter problems with Surface Hub 2S, you can reset the device to factory settings or restore by using a USB drive.
+
+To begin, sign in to Surface Hub 2S with admin credentials, open the **Settings** app, select **Update & security**, and then select **Recovery**.
+
+## Reset the device
+
+1. To reset the device, select **Get Started**.
+2. When the **Ready to reset this device** window appears, select **Reset**. 
+  >[!NOTE]
+  >Surface Hub 2S reinstalls the operating system from the recovery partition. This may take up to one hour to complete.
+3. To reconfigure the device, run the first-time Setup program.
+4. If you manage the device using Microsoft Intune or another mobile device management solution, retire and delete the previous record, and then re-enroll the new device. For more information, see [Remove devices by using wipe, retire, or manually unenrolling the device](https://docs.microsoft.com/intune/devices-wipe).
+
+![*Reset and recovery for Surface Hub 2S*](images/sh2-reset.png)
            
+*Figure 1. Reset and recovery for Surface Hub 2S* 
+
+## Recover Surface Hub 2S by using a USB recovery drive
+
+New in Surface Hub 2S, you can now reinstall the device by using a recovery image.
+
+### Recovery from a USB drive
+
+Using Surface Hub 2S, you can reinstall the device by using a recovery image. By doing this, you can reinstall the device to the factory settings if you lost the BitLocker key, or if you no longer have admin credentials to the Settings app.
+
+>[!NOTE]
+>Use a USB 3.0 drive with 8 GB or 16 GB of storage, formatted as FAT32.
+
+1. From a separate PC, download the .zip file recovery image from the [Surface Recovery website](https://support.microsoft.com/surfacerecoveryimage?devicetype=surfacehub2s) and then return to these instructions. 
+1. Unzip the downloaded file onto the root of the USB drive.  
+1. Connect the USB drive to any USB-C or USB-A port on Surface Hub 2S.
+1. Turn off the device:
+   1. While holding down the Volume down button, press the Power button.
+   1. Keep holding both buttons until you see the Windows logo.
+   1. Release the Power button but continue to hold the Volume until the Install UI begins.
+
+    ![*Use Volume down and power buttons to initiate recovery*](images/sh2-keypad.png) 
            
+   **Figure 2. Volume and Power buttons**
+
+1. On the language selection screen, select the display language for your Surface Hub 2S.
+1. Select **Recover from a drive** and **Fully clean the drive**, and then select **Recover**. If you're prompted for a BitLocker key, select **Skip this drive**. Surface Hub 2S reboots several times and takes approximately 30 minutes to complete the recovery process.
+
+When the first-time setup screen appears,remove the USB drive.
+
+## Recover a locked Surface Hub
+
+At the end of a session, Surface Hub 2S may occasionally encounter an error during the cleanup of user and app data at the end of a session. If this occurs, the device automatically reboots and resumes the data cleanup. However, if this operation repeatedly fails, the device automatically locks to protect user data.
+
+**To unlock a Surface Hub 2S:** 
            
+- Reset or recover the device from the Windows Recovery Environment. For more information, see [What is Windows RE?](https://technet.microsoft.com/library/cc765966.aspx)
+
+> [!NOTE]
+> To enter recovery mode, unplug the power cord and plug it in again three times.
diff --git a/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md b/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md
new file mode 100644
index 0000000000..8d0768ba93
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-secure-with-uefi-semm.md
@@ -0,0 +1,68 @@
+---
+title: "Secure and manage Surface Hub 2S with SEMM"
+description: "Learn more about securing Surface Hub 2S with SEMM."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Secure and manage Surface Hub 2S with SEMM and UEFI
+
+New in Surface Hub 2S, you can use SEMM to manage the UEFI setting of the device.
+Use the Microsoft Surface UEFI Configurator to control the following components:
+
+- Wired LAN
+- Cameras
+- Bluetooth
+- Wi-Fi
+- Occupancy sensor
+
+Use the Microsoft Surface UEFI Configurator to turn on or off the following UEFI settings:
+
+- Boot
+
+    - IPv6 for PXE Boot
+    - Alternate Boot
+    - Boot Order Lock
+    - USB Boot
+- UEFI Front Page
+
+    - Devices
+    - Boot
+    - Date/Time
+
+## Create UEFI configuration image
+
+Unlike other Surface devices, you cannot use an MSI file or a Win PE image to apply these settings on Surface Hub 2S. Instead, you need to create a USB image to load into the device. To create a Surface Hub 2S UEFI configuration image, download and install the latest version of the Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center. For more information about using UEFI and SEMM, see [Microsoft Surface Enterprise Management Mode](https://docs.microsoft.com/surface/surface-enterprise-management-mode).
+
+## To configure UEFI on Surface Hub 2S
+
+1. Start the UEFI Configurator and on the first screen, choose **Configuration Package**.

            
+![* Start the UEFI Configurator and choose Configuration Package*](images/sh2-uefi1.png) 
             
            
+2. To add the certificate to your package, you must have a valid certificate with the private key in a .pfx file format to sign and protect the package. Select **+ Certificate Protection.** 
            
+![* Select + Certificate Protection *](images/sh2-uefi2.png) 

            
+3. Enter the certificate’s private key’s password.
            
+![* Enter the certificate’s private key’s password *](images/sh2-uefi3.png) 

            
+4. After importing the private key, continue creating the package.
            
+![* Continue creating the package *](images/sh2-uefi4.png) 

            
+5. Choose **Hub** and **Surface Hub 2S** as the target for the UEFI configuration package.
            
+![* Choose Hub and Surface Hub 2S as the target for the UEFI configuration package *](images/sh2-uefi5.png) 

            
+6. Choose the components and settings you want to activate or deactivate on Surface Hub 2S.
            
+![* Choose the components and settings you want to activate or deactivate *](images/sh2-uefi6.png) 

            
+7. Use the USB option to export the file.
            
+![* Use the USB option to export the file *](images/sh2-uefi8.png) 

            
+8. Insert and choose the USB drive you’d like to use for this package. The USB drive will be formatted and you lose any information you have on it.
            
+![* Insert and choose the USB drive for your package  *](images/sh2-uefi9.png) 

            
+9. Upon successful creation of the package, the Configurator will display the last two characters of your certificate’s thumbprint. You need these characters when you import to the configuration to Surface Hub 2S.
            
+![* Successful configuration of package *](images/sh2-uefi10.png) 
            
+
+## To boot into UEFI
+
+Turn off Surface Hub 2S. Press and hold the **Volume Up** button and press the **Power** Button. Keep holding the Volume Up button until the UEFI menu appears.
diff --git a/devices/surface-hub/surface-hub-2s-setup.md b/devices/surface-hub/surface-hub-2s-setup.md
new file mode 100644
index 0000000000..08318020fb
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-setup.md
@@ -0,0 +1,100 @@
+---
+title: "First time Setup  for Surface Hub 2S"
+description: "Learn how to complete first time Setup for Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 07/03/2019
+ms.localizationpriority: Medium
+---
+
+# First time Setup for Surface Hub 2S
+
+When you first start Surface Hub 2S, the device automatically enters first time Setup mode to guide you through account configuration and related settings.
+
+## Configuring Surface Hub 2S account
+
+1. **Configure your locale.** Enter region, language, keyboard layout and time zone information. Select **Next**.
+
+   ![* Configure your locale *](images/sh2-run1.png) 
            
+1. **Connect  to a wireless network.** Choose your preferred wireless network and select **Next.**
+
+- This option is not shown if connected using an Ethernet cable.
+- You cannot connect to a wireless network in hotspots (captive portals) that redirect sign-in requests to a provider’s website.
+
+3. **Enter device account info.** Use **domain\user** for on-premises and hybrid environments and **user\@example.com** for online environments. Select **Next.**
+
+   ![* Enter device account info *](images/sh2-run2.png) 
            
+1. **Enter additional info.** If requested, provide your Exchange server address and then select **Next.**
+
+    ![* Enter more info; for example, Exchange server name*](images/sh2-run3.png) 
            
+
+1. **Name this device.** Enter a name for your device or use the suggested one based on your account’s display name and user principle name [UPN]. **Select Next**.
+
+- The **Friendly name** is visible on the bottom left corner of Surface Hub 2S and is shown when projecting to the device.
+
+- The **Device name** identifies the device when affiliated with Active Directory or Azure Active Directory, and when enrolling the device with Intune.
+
+  ![* Name this device*](images/sh2-run4.png) 
            
+ 
+## Configuring device admin accounts
+
+You can only set up device admins during first time Setup. For more information, refer to [Surface Hub 2S device affiliation](https://docs.microsoft.com/surface-hub/surface-hub-2s-prepare-environment#device-affiliation).
+
+ In the **Setup admins for this device** window, select one of the following options: Active Directory Domain Services, Azure Active Directory, or Local admin.
+
+   ![* Setup admins for this device *](images/sh2-run5.png) 
            
+
+### Active Directory Domain Services
+
+1. Enter the credentials of a user who has permissions to join the device to Active Directory.
+
+    ![* Setup admins using domain join *](images/sh2-run6.png) 
            
+
+2. Select the Active Directory Security Group containing members allowed to log on to the Settings app on Surface Hub 2S.
+
+    ![* Enter a security group *](images/sh2-run7.png) 
            
+1. Select **Finish**. The device will restart.
+
+### Azure Active Directory
+
+When choosing to affiliate your device with Azure Active Directory, the device will immediately restart and display the following page. Select **Next**.
+
+![* If your organization uses Office 365 or other business services from Microsoft, we’ll enrolll this device with your organization*](images/sh2-run8.png) 
            
+
+1. Enter the email address or UPN of an account **with Intune Plan 1** or greater and then select **Next.**
+
+    ![* Enter work or school account*](images/sh2-run9.png) 
            
+
+2. If redirected, authenticate using your organization’s sign-in page and provide additional logon information if requested. The device will restart.
+
+## Local Administrator account
+
+- Enter a username and password for your local admin. The device will restart.
+
+     ![* Set up an admin account*](images/sh2-run10.png) 
            
+ 
+## Using provisioning packages
+
+If you insert a USB thumb drive with a provisioning package into one of the USB ports when you start Surface Hub 2S, the device displays the following page.
+
+1. Enter the requested settings and select **Set up**.
+
+    ![* Enter regional settings for provisioning package*](images/sh2-run11.png) 
            
+
+    ![* Provision this device from removable media*](images/sh2-run12.png) 
            
+2. Choose the provisioning package you’d like to use.
+
+   ![* Choose provisioning package to use*](images/sh2-run13.png) 
            
+
+3. If you created a multiple devices CSV file, you will be able to choose a device configuration. For more information, refer to [Create provisioning packages for Surface Hub 2S](https://docs.microsoft.com/surface-hub/surface-hub-2s-deploy#provisioning-multiple-devices-csv-file).
+
+
+    ![* Select a device account and friendly name from your configuration file*](images/sh2-run14.png) 
            
+
+4. Follow the instructions to complete first time Setup.
diff --git a/devices/surface-hub/surface-hub-2s-site-planning.md b/devices/surface-hub/surface-hub-2s-site-planning.md
new file mode 100644
index 0000000000..9b04ea0174
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-site-planning.md
@@ -0,0 +1,43 @@
+---
+title: "Surface Hub 2S site planning"
+description: "Learn more about rooms for Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Surface Hub 2S site planning
+
+## Introduction
+
+Designed for team collaboration, Surface Hub 2S can transform the way you work  —  not only in the conference rooms but any place you want to work. One of the biggest advantages of Surface Hub 2S is the ability to move it from one space to another when used with the Steelcase Roam mobile stand and mobile battery. Providing unplugged, uninterrupted teamwork capabilities, Surface Hub 2S can be integrated into almost any workspace.
+
+## Room considerations
+
+Designed for interactive use in smaller conference rooms and huddle spaces, Surface Hub 2S provides a 4K camera, microphone array, crystal clear speakers, and a brilliant 4K+ resolution display. Optimizing the user experience in larger spaces with more people further away from the display may require peripherals such as an extra camera, microphone, or room systems solution such as Microsoft Teams Rooms.
+
+As a general guideline, install Surface Hub 2S in a space that meets the following criteria:
+
+- People can reach all four edges of the touchscreen.
+- The screen is not in direct sunlight, which could affect viewing or damage the screen.
+- Ventilation openings are not blocked.
+- Microphones are not affected by noise sources, such as fans or vents.
+- Space is well lit with no reflective sources.
+
+Whether mounted to a wall or installed on the mobile stand, the areas where you use the device should maintain:
+
+- Room temperatures no cooler than 10°C (50° F) and no hotter than 35°C  (95° F).
+- Relative humidity no lower than 20 percent and no higher than 80 percent.
+
+For detailed room planning guidance and more information about Microsoft Teams Rooms see [Plan Microsoft Teams Rooms.](https://docs.microsoft.com/MicrosoftTeams/room-systems/skype-room-systems-v2-0)
+
+## Managing Surface Hub 2S location
+
+If you plan to use Surface Hub 2S on a mobile stand, you may wish to explore third-party solutions that enable location services. For example, active RFID systems can provide real-time tracking throughout complex office or industrial spaces. For more information, see your A/V provider or other third-party expertise for guidance.
diff --git a/devices/surface-hub/surface-hub-2s-site-readiness-guide.md b/devices/surface-hub/surface-hub-2s-site-readiness-guide.md
new file mode 100644
index 0000000000..8db9d3818e
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-site-readiness-guide.md
@@ -0,0 +1,25 @@
+---
+title: "Surface Hub 2S site readiness guide"
+description: "Get familiar with site readiness requirements and recommendations for Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Surface Hub 2S site readiness guide
+
+|**Topic**|**Description**|
+|:-------|:-------|
+| [Site planning for Surface Hub 2S](surface-hub-2s-site-planning.md) | Review room considerations and planning for peripherals. |
+| [Surface Hub 2S quick start](surface-hub-2s-quick-start.md) | Get an overview of required steps to unpack and start Surface Hub 2S. |
+| [Install and mount Surface Hub 2S](surface-hub-2s-install-mount.md) | Learn about licensed accessories to install and mount Surface Hub 2S. |
+| [Customizing installation of Surface Hub 2S](surface-hub-2s-custom-install.md) | Learn how to custom install without licensed mounting accessories.|
+| [Surface Hub 2S ports and keypad overview](surface-hub-2s-port-keypad-overview.md) | Get details for I/O ports and keypad power and selection controls. |
+| [Connect to Surface Hub 2S](surface-hub-2s-connect.md) | Learn about wired and wireless methods to connect to Surface Hub.|
diff --git a/devices/surface-hub/surface-hub-2s-techspecs.md b/devices/surface-hub/surface-hub-2s-techspecs.md
new file mode 100644
index 0000000000..4e40f9ae25
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-techspecs.md
@@ -0,0 +1,45 @@
+---
+title: "Surface Hub 2S tech specs"
+description: "View tech specs for Surface Hub 2S including pen, camera, and optional mobile battery specifications."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+manager: laurawi
+ms.author: greglin
+audience: Admin
+ms.topic: article
+ms.date: 11/19/2019
+ms.localizationpriority: Medium
+---
+
+# Surface Hub 2S tech specs
+
+|**Item**|**Details**|
+|:------ |:--------- |
+|**Dimensions**| 29.2" x 43.2" x 3.0” (741 mm x 1097 mm x 76 mm) |
+|**Shipping dimensions**| 47.64" x 36.89" x 9.92" (1,210 mm x 937 mm x 252 mm)|
+|**Weight**| 61.6 lbs. (28 kg) |
+|**Shipping Weight**| 81.08 lbs. (36.77 kg) |
+|**Resolution**| 3840 x 2560 |
+|**Display**| PixelSense Display, 3:2 aspect ratio, 10-bit color, 15.5 mm border, anti-glare, IPS LCD |
+|**Processor**| Quad-core 8th Generation Intel Core i5 processor, 8 GB RAM, 128 GB SSD 1 |
+|**Graphics**| Intel UHD Graphics 620 |
+|**Wireless**| Wi-Fi 5 (IEEE 802.11 a/b/g/n/ac compatible) Bluetooth Wireless 4.1 technology 
             Miracast display |
+|**Connections**| USB-A 
             Mini-DisplayPort 1.2 video output 
             RJ45 gigabit Ethernet (1000/100/10 BaseT) 
             HDMI video input (HDMI 2.0, HDCP 2.2 /1.4) 
             USB-C with DisplayPort input 
             Four USB-C (on display) |
+|**Sensors**| Doppler occupancy 2 
             Accelerometer 
             Gyroscope |
+|**Audio/Video**| Full-range, front facing 3-way stereo speakers 
             Full band 8-element MEMS microphone array 
             Microsoft Surface Hub 2 Camera, 4K, USB-C connection, 90-degree HFOV |
+|**Pen**| Microsoft Surface Hub 2 Pen (active) |
+|**Software**| Windows 10 
             Microsoft Teams for Surface Hub 3 
             Skype for Business 
             Microsoft Whiteboard 
             Microsoft Office (Mobile) 
             Microsoft Power BI 2 |
+|**Exterior**| Casing: Precision machined aluminum with mineral-composite resin 
             Color: Platinum 
             Physical Buttons: Power, Volume, Source |
+|**What’s in the box**| One Surface Hub 2S 
             One Surface Hub 2 Pen  
             One Surface Hub 2 Camera 
             2.5 m AC Power Cable 
             Quick Start Guide |
+|**Warranty**| 1-year limited hardware warranty |
+|**BTU**| 1518 BTU/hr |
+|**Input Voltage**| 50/60Hz 110/230v nominal, 90-265v max |
+|**Input power, operating**| 445 W (495 W Surge Load) |
+|**Input Current**| 5.46 A |
+|**Input Power, standby**| 5 W max  |
+
+> [!NOTE]
+> 1 System software uses significant storage space. Available storage is subject to change based on system software updates and apps usage. 1 GB= 1 billion bytes. See Surface.com/Storage for more details. 
             2 Doppler sensor not available in Hong Kong, India, Kuwait, and Oman  due to government regulations.
+
             3 Software license required for some features. Sold separately.
             
diff --git a/devices/surface-hub/surface-hub-2s-unpack.md b/devices/surface-hub/surface-hub-2s-unpack.md
new file mode 100644
index 0000000000..950a5caa6f
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-unpack.md
@@ -0,0 +1,36 @@
+---
+title: "Unpack Surface Hub 2S"
+description: "This page includes information about safely unpacking Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# Unpack Surface Hub 2S
+
+## Unpacking the Surface Hub 2S
+
+Before you remove Surface Hub 2S from the box, make sure that you have your mounting solution assembled and someone available to help you.
+
+1. Use the handles on each side of the box to move it to the space where you'll set it up.
+2. Before opening, remove the clips (4) on the front and back, and then lift the top off the box using the handles.
+3. In the base of the Surface Hub 2S, open the accessories box containing the setup guide, Surface Hub 2 pen, Surface Hub 2 camera, and the power cable.
+4. On the back of the surface hub, there's an instructional label that shows you where to attach the mounting hardware. Install them in place and remove the label.
+5. If you're using a mobile stand remember to lock the wheels to keep the stand in place
+6. Be sure to lift the Surface Hub 2S with both hands and support the bottom of the device.
+7. Align the installed hardware with the slots on the mount so it rests firmly in place.
+8. Follow any further instructions that came with your mounting solution.
+
+## Install pen and camera
+
+1. Unwrap your Surface Hub 2 pen and attach it magnetically to your preferred side of the device.
+2. Remove the lens cling from the camera and attach it to the USB-C port on the top of the Surface Hub 2S.
+3. Insert the power cable into the back of the device and plug it into a power outlet. Run the cable through any cable guides on your mounting solution and remove the screen clang.
+4. To begin, press the power button on the bottom right.
diff --git a/devices/surface-hub/surface-hub-2s-whats-new.md b/devices/surface-hub/surface-hub-2s-whats-new.md
new file mode 100644
index 0000000000..13d7eb06ce
--- /dev/null
+++ b/devices/surface-hub/surface-hub-2s-whats-new.md
@@ -0,0 +1,65 @@
+---
+title: "What's new in Surface Hub 2S for IT admins"
+description: "Learn more about new features in Surface Hub 2S."
+keywords: separate values with commas
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+audience: Admin
+ms.topic: article
+ms.date: 06/20/2019
+ms.localizationpriority: Medium
+---
+
+# What's new in Surface Hub 2S for IT admins
+
+Surface Hub 2S is an all-in-one collaboration canvas that’s built for teamwork delivering a digital whiteboard, meetings platform, and a Windows 10 computing experience in one device.
+
+|**Capability**|**Summary**|**Learn more**|
+|:-------|:------|:----|
+|**Mobile Device Management and UEFI manageability**| Manage settings and policies using a mobile device management (MDM) provider. 
             
             Full integration with Surface Enterprise Management Mode (SEMM) lets you manage hardware components and firmware. | [Managing Surface Hub 2S with Microsoft Intune](surface-hub-2s-manage-intune.md) 
             
             [Surface Enterprise Management Mode](https://docs.microsoft.com/surface/surface-enterprise-management-mode) |
+|**Cloud and on-premises coexistence**| Supports on-premises, hybrid, or online. | [Prepare your environment for Microsoft Surface Hub 2S](surface-hub-2s-prepare-environment.md) |
+|**Reset and recovery**| Restore from the cloud or USB drive. | [Recover and reset Surface Hub 2S](surface-hub-2s-recover-reset.md) |
+|**Microsoft Whiteboard**| Ofice 365 integration, intelligent ink, and Bing search bring powerful new capabilities, enabling a persistent digital canvas shareable across most browsers, Windows and iOS devices. | [Announcing a new whiteboard for your Surface Hub](https://techcommunity.microsoft.com/t5/Office-365-Blog/Announcing-a-new-Whiteboard-for-your-Surface-Hub/ba-p/637050) |
+|**Microsoft Teams Meeting Room License**| Extends Office 365 licensing options across Skype for Business, Microsoft Teams, and Intune. | [Teams Meeting Room Licensing Update](https://docs.microsoft.com/MicrosoftTeams/room-systems/skype-room-systems-v2-0) |
+|**On-screen display**| Adjust volume, brightness, and input control directly on the display. |  |
+|**Sensor-activated Connected Standby**| Doppler sensor activates Connected Standby after 1 minute of inactivity.
             
             Manage this setting remotely using Intune or directly on the device from the Settings app. | [Surface Hub 2S tech specs](surface-hub-2s-techspecs.md) |
+|**Surface Hub pen**| Ergonomically redesigned and easily attachable on the sides of the device.  |  |
+|**Surface app for Surface Hub 2S**| Change audio settings and view your device's information from the Surface app |  |
+|**Ready for tomorrow**| Removable cartridge facilitates upgrading to new features. |  |
+
+For more information about what’s new in Surface Hub 2S, see:
+
+- [Surface Hub 2S product site](https://www.microsoft.com/p/surface-hub-2S/8P62MW6BN9G4?activetab=pivot:overviewtab)
+- [Behind the Design Surface Hub 2S](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Behind-the-design-Surface-Hub-2S/ba-p/464099)
+
+## Surface Hub 2S compared with Surface Hub
+
+The following table details the differences between Surface Hub and Surface Hub 2S:
+
+|**Component**| **Surface Hub 55”**|**Surface Hub 84”**| **Surface Hub 2S**|
+|:----- |:---- |:---- |:----- |
+|**Form Factor**| 55” | 84” | 50” |
+|**Dimension**| 31.75” x 59.62” x 3.38” 
             (806.4 mm x 1514.3 mm x 85.8 mm) | 46.12” x 86.7” x 4.15” 
             (1171.5 mm x 2202.9 mm x 105.4 mm) | 29.2" x 43.2" x 3.0" 
             (741 mm x 1097 mm x 76 mm) |
+|**Weight**| 105 lbs. (48 kg) | 280 lbs. (127 kg) | 61.6 lbs. (28 kg) |
+|**Display**| Resolution: 
             1920 x 1080 @ 120 Hz  
             Contrast ratio: 
             1300:1 
             Touch: 
             100-point multi-touch 
             Projective Capacitance optically bonded sensor | Resolution: 
             3840 x 2160 @ 120 Hz  
             Contrast Ratio: 
             1400:1 
             Touch: 
             100-point multi-touch 
             Projective Capacitance optically bonded sensor | Resolution: 
             3840 x 2560 @ 60 Hz |
+|**Aspect Ratio**| 16:9 | 16:9 | 3:2 |
+|**Storage**| SSD 128 GB | SSD 128 GB | SSD 128 GB |
+|**RAM**| 8 GB RAM | 8 GB RAM | 8 GB RAM |
+|**Processor**| 4th Generation Intel® Core i5 | 4th Generation Intel Core i7 | Quad-core 8th Generation Intel Core i5 processor |
+|**Graphics**| Intel HD 4600 | NVIDIA Quadro K2200 | Intel UHD Graphics 620 |
+|**Network**| Wi-Fi (802.11 a/b/g/n/ac) 
             Ethernet 1 Gbps 
             Bluetooth 4.0 low energy 
             Miracast enabled | Wi-Fi (802.11 a/b/g/n/ac) 
             Ethernet 1 Gbps 
             Bluetooth 4.0 low energy 
             Miracast enabled | Wi-Fi 5 (IEEE 802.11 a/b/g/n/ac) 
             Ethernet 1 Gbps 
             Bluetooth Wireless 4.1 technology 
             Miracast Display |
+|**Ports**| (1) USB 3.0 (bottom) + (1) USB 3.0 (side access)  
             (2) USB 2.0 
             DisplayPort Video Output 
             3.5 mm Stereo Out 
             RJ11 Connector for system-level control 
             
             DisplayPort Video Input 
             HDMI Video Input 
             VGA Video Input 
             3.5 mm Stereo Input 
             (1) USB 2.0 type B Touchback Output | (1) USB 3.0 (bottom) + (1) USB 3.0 (side access) 
             (4) USB 2.0 
             DisplayPort Video Output 
             3.5 mm Stereo Out 
             RJ11 Connector for system-level control 
             
             DisplayPort Video Input 
             HDMI Video Input 
             VGA Video Input 
             3.5 mm Stereo Input 
             (1) USB 2.0 type B Touchback Output | (1) USB-A 
             Mini-DisplayPort Video Output 
             HDMI Video Input 
             USB-C with DisplayPort Input 
             (4) USB-C (on display) 
             RJ45 Gigabit Ethernet |
+|**Sensors**| (2) Passive Infrared Presence Sensors, Ambient Light Sensors | (2) Passive Infrared Presence Sensors, Ambient Light Sensors | Doppler occupancy sensor, 
             Accelerometer, 
             Gyroscope  |
+|**NFC**| NFC reader | NFC reader | N/A |
+|**Speakers**| (2) Front-facing stereo speakers | (2) Front-facing stereo speakers | Full range front facing 3-way stereo speakers |
+|**Microphone**| High-Performance, 4-Element Array | High-Performance, 4-Element Array | Full band 8-element MEMS microphone array |
+|**Camera**| (2) Wide angle HD cameras 1080p @ 30 fps | (2) Wide angle HD cameras 1080p @ 30 fps | (1) Microsoft Surface Hub 2 Camera, 4K, USB-C connection, 90-degree horizontal field of view                                                           |
+|**Pen**| (2) Powered, active, subpixel accuracy | (2) Powered, active, subpixel accuracy | (1) Microsoft Surface Hub 2 Pen (active) |
+|**Physical buttons**| Power, Input Select, Volume, Brightness | Power, Input Select, Volume, Brightness | Power, Volume, Source |
+|**Software**| Windows 10 + Office (Word, PowerPoint, Excel) | Windows 10 + Office (Word, PowerPoint, Excel) | Windows 10 + Office (Word, PowerPoint, Excel) |
+
+> [!NOTE]
+> The NFC reader available in the original Surface Hub is discontinued in Surface Hub 2S and is no longer available.
diff --git a/devices/surface-hub/surface-hub-authenticator-app.md b/devices/surface-hub/surface-hub-authenticator-app.md
index a068fe1fab..9ad0606641 100644
--- a/devices/surface-hub/surface-hub-authenticator-app.md
+++ b/devices/surface-hub/surface-hub-authenticator-app.md
@@ -3,10 +3,12 @@ title: Sign in to Surface Hub with Microsoft Authenticator
 description: Use Microsoft Authenticator on your mobile device to sign in to Surface Hub.
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 08/28/2017
+ms.reviewer: 
+manager: dansimp
 localizationpriority: medium
 ---
 
@@ -14,7 +16,6 @@ localizationpriority: medium
 
 People in your organization can sign in to a Surface Hub  without a password using the Microsoft Authenticator app, available on Android and iOS.
 
-
 ## Organization prerequisites
 
 To let people in your organization sign in to Surface Hub with their phones and other devices instead of a password, you’ll need to make sure that your organization meets these prerequisites: 
@@ -27,42 +28,40 @@ To let people in your organization sign in to Surface Hub with their phones and
 
     ![multi-factor authentication options](images/mfa-options.png)
 
-- Enable content hosting on Azure AD services such as Office online, SharePoint, etc. 
+- Enable content hosting on Azure AD services such as Office, SharePoint, etc. 
 
 - Surface Hub must be running Windows 10, version 1703 or later.
 
 - Surface Hub is set up with either a local or domain-joined account.
 
-Currently, you cannot use Microsoft Authenticator to sign in to Surface Hubs that are joined to Azure AD. 
+Currently, you cannot use Microsoft Authenticator to sign in to Surface Hubs that are joined to Azure AD.
 
 ## Individual prerequisites
 
 - An Android phone running 6.0 or later, or an iPhone or iPad running iOS9 or later 
 
-- The most recent version of the Microsoft Authenticator app from the appropriate app store 
+- The most recent version of the Microsoft Authenticator app from the appropriate app store
+
     >[!NOTE]
     >On iOS, the app version must be 5.4.0 or higher.
     >
     >The Microsoft Authenticator app on phones running a Windows operating system can't be used to sign in to Surface Hub.
-    
+
 - Passcode or screen lock on your device is enabled
 
 - A standard SMTP email address (example: joe@contoso.com). Non-standard or vanity SMTP email addresses (example: firstname.lastname@contoso.com) currently don’t work.
 
-
 ## How to set up the Microsoft Authenticator app
 
 >[!NOTE]
 >If Company Portal is installed on your Android device, uninstall it before you set up Microsoft Authenticator. After you set up the app, you can reinstall Company Portal.
 >
->If you have already set up Microsoft Authenticator on your phone and registered your device, go to the [sign-in instructions](#signin).
+>If you have already set up Microsoft Authenticator on your phone and registered your device, go to the sign-in instructions.
 
 1. Add your work or school account to Microsoft Authenticator for Multi-Factor Authentication. You will need a QR code provided by your IT department. For help, see [Get started with the Microsoft Authenticator app](https://docs.microsoft.com/azure/multi-factor-authentication/end-user/microsoft-authenticator-app-how-to).
 2. Go to **Settings** and register your device.
-1. Return to the accounts page and choose **Enable phone sign-in** from the account dropdown menu.
+3. Return to the accounts page and choose **Enable phone sign-in** from the account dropdown menu.
 
-
-
 ## How to sign in to Surface Hub during a meeting
 
 1. After you’ve set up a meeting, go to the Surface Hub and select **Sign in to see your meetings and files**.
@@ -75,14 +74,13 @@ Currently, you cannot use Microsoft Authenticator to sign in to Surface Hubs tha
 2. You’ll see a list of the people invited to the meeting. Select yourself (or the person who wants to sign in – make sure this person has gone through the steps to set up their device before your meeting), and then select **Continue**.
 
     ![screenshot of list of attendees in a meeting](images/attendees.png)
-    
+
     You'll see a code on the Surface Hub.
-    
+
     ![screenshot of code for Approve Sign in](images/approve-signin.png)
-    
+
 3. To approve the sign-in, open the Authenticator app, enter the four-digit code that’s displayed on the Surface Hub, and select **Approve**. You will then be asked to enter the PIN or use your fingerprint to complete the sign in. 
 
     ![screenshot of the Approve sign-in screen in Microsoft Authenticator](images/approve-signin2.png)
-    
-You can now access all files through the OneDrive app.
 
+You can now access all files through the OneDrive app.
\ No newline at end of file
diff --git a/devices/surface-hub/surface-hub-downloads.md b/devices/surface-hub/surface-hub-downloads.md
index 689358891c..5e5073588a 100644
--- a/devices/surface-hub/surface-hub-downloads.md
+++ b/devices/surface-hub/surface-hub-downloads.md
@@ -3,25 +3,25 @@ title: Useful downloads for Microsoft Surface Hub
 description: Downloads related to the Microsoft Surface Hub.
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 08/22/2017
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
 # Useful downloads for Microsoft Surface Hub
 
-This topic provides links to useful Surface Hub documents, such as product datasheets, the site readiness guide, and user's guide.
+This topic provides links to useful Surface Hub documents, such as product datasheets and user's guide.
 
 | Link | Description |
 | --- | --- |
-| [Surface Hub Site Readiness Guide (PDF)](https://download.microsoft.com/download/3/8/8/3883E991-DFDB-4E70-8D28-20B26045FC5B/Surface-Hub-Site-Readiness-Guide_EN.pdf)  | Make sure your site is ready for Surface Hub, including structural and power requirements, and get technical specs for Surface Hub. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/27/aa/27aa7dd7-7cb7-40ea-9bd6-c7de0795f68c.mov?n=04.07.16_installation_video_01_site_readiness.mov)  |
 | [Surface Hub Setup Guide (English, French, Spanish) (PDF)](https://download.microsoft.com/download/0/1/6/016363A4-8602-4F01-8281-9BE5C814DC78/Setup-Guide_EN-FR-SP.pdf) | Get a quick overview of how to set up the environment for your new Surface Hub. |
 | [Surface Hub Quick Reference Guide (PDF)](https://download.microsoft.com/download/9/E/E/9EE660F8-3FC6-4909-969E-89EA648F06DB/Surface%20Hub%20Quick%20Reference%20Guide_en-us.pdf)  | Use this quick reference guide to get information about key features and functions of the Surface Hub. |
 | [Surface Hub User Guide (PDF)](https://download.microsoft.com/download/3/6/B/36B6331E-0C63-4E71-A05D-EE88D05081F8/surface-hub-user-guide-en-us.pdf) | Learn how to use Surface Hub in scheduled or ad-hoc meetings. Invite remote participants, use the built-in tools, save data from your meeting, and more. |
 | [Surface Hub Replacement PC Drivers](https://www.microsoft.com/download/details.aspx?id=52210) | The Surface Hub Replacement PC driver set is available for those customers who have chosen to disable the Surface Hub’s internal PC and use an external computer with their 84” or 55” Surface Hub. This download is meant to be used with the Surface Hub Admin Guide , which contains further details on configuring a Surface Hub Replacement PC.  |
-| [Surface Hub SSD Replacement Guide (PDF)](https://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf) | Learn how to replace the solid state drive (SSD) for the 55- and 84-inch Surface Hub. |
 | [Microsoft Surface Hub Rollout and Adoption Success Kit (ZIP)](https://download.microsoft.com/download/F/A/3/FA3ADEA4-4966-456B-8BDE-0A594FD52C6C/Surface_Hub_Adoption_Kit_Final_0519.pdf) | Best practices for generating awareness and implementing change management to maximize adoption, usage, and benefits of Microsoft Surface Hub. The Rollout and Adoption Success Kit zip file includes the Rollout and Adoption Success Kit detailed document, Surface Hub presentation, demo guidance, awareness graphics, and more. |
 | [Unpacking Guide for 84-inch Surface Hub (PDF)](https://download.microsoft.com/download/5/2/B/52B4007E-D8C8-4EED-ACA9-FEEF93F6055C/84_Unpacking_Guide_English_French-Spanish.pdf) | Learn how to unpack your 84-inch Surface Hub efficiently and safely. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/75/2b/752b73dc-6e9d-4692-8ba1-0f9fc03bff6b.mov?n=04.07.16_installation_video_03_unpacking_84.mov) |
 | [Unpacking Guide for 55-inch Surface Hub (PDF)](https://download.microsoft.com/download/2/E/7/2E7616A2-F936-4512-8052-1E2D92DFD070/55_Unpacking_Guide_English-French-Spanish.PDF) | Learn how to unpack your 55-inch Surface Hub efficiently and safely. [Watch the video (opens in a pop-up media player)](http://compass.xbox.com/assets/a9/d6/a9d6b4d7-d33f-4e8b-be92-28f7fc2c06d7.mov?n=04.07.16_installation_video_02_unpacking_55.mov) |
diff --git a/devices/surface-hub/surface-hub-qos.md b/devices/surface-hub/surface-hub-qos.md
new file mode 100644
index 0000000000..105a188ae1
--- /dev/null
+++ b/devices/surface-hub/surface-hub-qos.md
@@ -0,0 +1,53 @@
+---
+title: Implement Quality of Service on Surface Hub
+ms.reviewer: 
+manager: dansimp
+description: Learn how to configure QoS on Surface Hub.
+ms.prod: surface-hub
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# Implement Quality of Service (QoS) on Surface Hub
+
+Quality of Service (QoS) is a combination of network technologies that allows the administrators to optimize the experience of real time audio/video and application sharing communications.
+ 
+Configuring [QoS for Skype for Business](https://docs.microsoft.com/windows/client-management/mdm/networkqospolicy-csp) on the Surface Hub can be done using your [mobile device management (MDM) provider](manage-settings-with-mdm-for-surface-hub.md) or through a [provisioning package](provisioning-packages-for-surface-hub.md). 
+ 
+ 
+This procedure explains how to configure QoS for Surface Hub using Microsoft Intune. 
+
+1. In Intune, [create a custom policy](https://docs.microsoft.com/intune/custom-settings-configure).
+
+    ![Screenshot of custom policy creation dialog in Intune](images/qos-create.png)
+
+2. In **Custom OMA-URI Settings**, select **Add**. For each setting that you add, you will enter a name, description (optional), data type, OMA-URI, and value.
+
+    ![Screenshot of a blank OMA-URI setting dialog box](images/qos-setting.png)
+
+3. Add the following custom OMA-URI settings:
+
+    Name | Data type | OMA-URI
            ./Device/Vendor/MSFT/NetworkQoSPolicy |  Value
+    --- | --- | --- | ---
+    Audio Source Port | String |  /HubAudio/SourcePortMatchCondition  |   Get the values from your Skype administrator
+    Audio DSCP | Integer |  /HubAudio/DSCPAction  |   46
+    Video Source Port | String |  /HubVideo/SourcePortMatchCondition   |  Get the values from your Skype administrator
+    Video DSCP | Integer |  /HubVideo/DSCPAction   |   34
+    Audio Process Name | String |  /HubAudio/AppPathNameMatchCondition  |   Microsoft.PPISkype.Windows.exe
+    Video Process Name | String |  /HubVideo/AppPathNameMatchCondition  |   Microsoft.PPISkype.Windows.exe
+
+    >[!IMPORTANT]
+    >Each **OMA-URI** path begins with `./Device/Vendor/MSFT/NetworkQoSPolicy`. The full path for the audio source port setting, for example, will be `./Device/Vendor/MSFT/NetworkQoSPolicy/HubAudio/SourcePortMatchCondition`.
+
+
+
+
+4. When the policy has been created, [deploy it to the Surface Hub.](manage-settings-with-mdm-for-surface-hub.md#manage-surface-hub-settings-with-mdm)
+
+
+>[!WARNING]
+>Currently, you cannot configure the setting **IPProtocolMatchCondition** in the [NetworkQoSPolicy CSP](https://docs.microsoft.com/windows/client-management/mdm/networkqospolicy-csp). If this setting is configured, the policy will fail to apply.
+ 
diff --git a/devices/surface-hub/surface-hub-recovery-tool.md b/devices/surface-hub/surface-hub-recovery-tool.md
index e6e0eeb5c1..75feb89fc2 100644
--- a/devices/surface-hub/surface-hub-recovery-tool.md
+++ b/devices/surface-hub/surface-hub-recovery-tool.md
@@ -2,11 +2,13 @@
 title: Using the Surface Hub Recovery Tool
 description: How to use the Surface Hub Recovery Tool to re-image the SSD.
 ms.assetid: FDB6182C-1211-4A92-A930-6C106BCD5DC1
+ms.reviewer: 
+manager: dansimp
 keywords: manage Surface Hub
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 05/22/2018
 ms.localizationpriority: medium
@@ -16,10 +18,10 @@ ms.localizationpriority: medium
 
 The [Microsoft Surface Hub Recovery Tool](https://www.microsoft.com/download/details.aspx?id=52210) helps you re-image your Surface Hub Solid State Drive (SSD) using a Windows 10 desktop device, without calling support or replacing the SSD. With this tool, you can reimage an SSD that has an unknown Administrator password, boot errors, was unable to complete a cloud recovery, or for a device that has an older version of the operating system. The tool will not fix physically damaged SSDs.
 
-To re-image the Surface Hub SSD using the Recovery Tool, you'll need to remove the SSD from the Surface Hub, connect the drive to the USB-to-SATA cable, and then connect the cable to the desktop PC on which the Recovery Tool is installed. For more information on how to remove the existing drive from your Surface Hub, please refer to the [Surface Hub SSD Replacement Guide (PDF)](https://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf).
+To re-image the Surface Hub SSD using the Recovery Tool, you'll need to remove the SSD from the Surface Hub, connect the drive to the USB-to-SATA cable, and then connect the cable to the desktop PC on which the Recovery Tool is installed. For more information on how to remove the existing drive from your Surface Hub, see [Surface Hub SSD replacement](surface-hub-ssd-replacement.md).
 
->[!IMPORTANT]
->Do not let the device go to sleep or interrupt the download of the image file.
+> [!IMPORTANT]
+> Do not let the device go to sleep or interrupt the download of the image file.
 
 If the tool is unsuccessful in reimaging your drive, please contact [Surface Hub Support](https://support.microsoft.com/help/4037644/surface-contact-surface-warranty-and-software-support).
 
@@ -73,7 +75,7 @@ Install Surface Hub Recovery Tool on the host PC.
 
     ![Download the image?](images/shrt-download.png)
 
-5. When the download is complete, the tool instructs you to connect an SSD drive. If the tool is unable to locate the attached drive, there is a good chance that the cable being used is not reporting the name of the SSD to Windows.  The imaging tool must find the name of the drive as "LITEON L CH-128V2S USB Device" before it can continue.  For more information on how to remove the existing drive from your Surface Hub, please refer to the [Surface Hub SSD Replacement Guide (PDF)](https://download.microsoft.com/download/1/F/2/1F202254-7156-459F-ABD2-39CF903A25DE/surface-hub-ssd-replacement-guide_en-us.pdf).
+5. When the download is complete, the tool instructs you to connect an SSD drive. If the tool is unable to locate the attached drive, there is a good chance that the cable being used is not reporting the name of the SSD to Windows.  The imaging tool must find the name of the drive as "LITEON L CH-128V2S USB Device" before it can continue.  For more information on how to remove the existing drive from your Surface Hub, see [Surface Hub SSD replacement](surface-hub-ssd-replacement.md).
 
     ![Connect SSD](images/shrt-drive.png)
 
@@ -91,7 +93,7 @@ Install Surface Hub Recovery Tool on the host PC.
 
 Issue | Notes
 --- | ---
-The tool fails to image the SSD	| Make sure you are using a factory-supplied SSD and one of the tested cables.
+The tool fails to image the SSD | Make sure you are using a factory-supplied SSD and one of the tested cables.
 The reimaging process appears halted/frozen | It is safe to close and restart the Surface Hub Recovery Tool with no ill effect to the SSD.
 The drive isn’t recognized by the tool | Verify that the Surface Hub SSD is enumerated as a Lite-On drive, "LITEON L CH-128V2S USB Device".  If the drive is recognized as another named device, your current cable isn’t compatible. Try another cable or one of the tested cable listed above.
 Error: -2147024809 | Open Disk Manager and remove the partitions on the Surface Hub drive.  Disconnect and reconnect the drive to the host machine. Restart the imaging tool again.
diff --git a/devices/surface-hub/surface-hub-site-readiness-guide.md b/devices/surface-hub/surface-hub-site-readiness-guide.md
new file mode 100644
index 0000000000..d12281f55b
--- /dev/null
+++ b/devices/surface-hub/surface-hub-site-readiness-guide.md
@@ -0,0 +1,138 @@
+---
+title: Surface Hub Site Readiness Guide
+ms.reviewer: 
+manager: laurawi
+description: Use this Site Readiness Guide to help plan your Surface Hub installation.
+ms.prod: surface-hub
+ms.sitesec: library
+author: greg-lindsay
+ms.author: greglin
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# Surface Hub Site Readiness Guide 
+
+Use this Site Readiness Guide to help plan your Surface Hub installation. In this guide, you’ll find: 
+- Site readiness topics 
+- Detailed hardware specifications on power, ports, and cables
+- Recommendations for moving and storage 
+- Links to guidance on unpacking and mounting 
+
+## Site readiness planning
+
+The room needs to be large enough to provide good viewing angles, but small enough for the microphones to pick up clear signals from the people in the room. Most rooms that are about 22 feet (seven meters) long will provide a good meeting experience. In the conference area, mount Surface Hub where:
+
+- Everyone in the room can see it.
+- People can reach all four edges of the touchscreen.
+- The screen is not in direct sunlight, which could affect viewing or damage the screen.
+- Ventilation openings are not blocked.
+- Microphones are not affected by noise sources, such as fans or vents.
+You can find more details in the [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md) sections.  For cleaning, care, and safety information, see the mounting guides and user guide at https://www.microsoft.com/surface/support/surface-hub.
+
+### Hardware considerations
+
+Surface Hub arrives with:
+- Two Microsoft Surface Hub pens
+- A Microsoft wireless keyboard, customized for Surface Hub
+- A 9-foot NEMA 5-15P (US Standard) to C13 power cable
+
+You’ll need to provide:
+- Cat-5e or Cat-6 network cables
+- Display cables (optional)
+- Audio cable (optional)
+- Type A to B USB cable (optional)
+
+For details about cable ports, see the [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md) sections. For details about cables, see [Wired Connect](#wired). 
+
+Microsoft Surface Hub has an internal PC and does not require an external computer system. 
+
+For power recommendations, see [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md). For power cable safety warnings, see the mounting guides at https://www.microsoft.com/surface/support/surface-hub.
+
+### Data and other connections
+
+To use Surface Hub, you need an active Ethernet port and a standard power outlet. In addition, you may want to:
+
+- Equip the conference table for Wired Connect.
+- Expand the wall outlet configuration to include:
+    - Additional AC outlets 
+    - Ethernetports 
+    - Audio ports 
+    - Video ports (DisplayPort, HDMI, VGA, etc.) 
+
+
+## When Surface Hub arrives
+
+Surface Hub is large and heavy, so let Receiving know when it will arrive and what they should do to handle it safely. For details on the packing weights and other specifications, see [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md).
+
+Consider the following: 
+- Wait to unpack Surface Hub from the shipping container until you’ve moved it to the conference area where you plan to install it.
+- Make sure your loading dock can accept a shipment on a pallet and hold it securely until it can be installed.
+- Check for local labor union rules that would require you to use union labor to unload or move Surface Hub.   
+- Do not leave Surface Hub in a hot or humid environment. As with any computer-based or display equipment, heat and humidity can damage Surface Hub. The recommended storage temperatures are 32°F to 95°F with a relative humidity of less than 70 percent. 
+
+### Moving Surface Hub
+
+Before you move Surface Hub, make sure that all the doorways, thresholds, hallways, and elevators are big enough to accommodate it. For information on the dimensions and weight of your Surface Hub in its shipping container, see [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md).
+
+### Unpacking Surface Hub
+
+For unpacking information, refer to the unpacking guide included in the shipping container. You can open the unpacking instructions before you open the shipping container.  These instructions can also be found here: https://www.microsoft.com/surface/support/surface-hub
+
+>[!IMPORTANT]
+>Retain and store all Surface Hub shipping materials—including the pallet, container, and screws—in case you need to ship Surface Hub to a new location or send it
+for repairs. For the 84” Surface Hub, retain the lifting handles. 
+
+### Lifting Surface Hub
+
+The 55” Surface Hub requires two people to safely lift and mount. The 84” Surface Hub requires four people to safely lift and mount. Those assisting must be able to lift 70 pounds to waist height. Review the unpacking and mounting guide for details on lifting Surface Hub. You can find it at https://www.microsoft.com/surface/support/surface-hub.
+
+## Mounting and setup
+
+See your mounting guide at https://www.microsoft.com/surface/support/surface-hub for detailed instructions. 
+
+There are three ways to mount your Surface Hub:
+
+- **Wall mount**: Lets you permanently hang Surface Hub on a conference space wall.
+- **Floor support mount**: Supports Surface Hub on the floor while it is permanently anchored to a conference space wall.
+- **Rolling stand**: Supports Surface Hub and lets you move it to other conference locations. For links to guides that provide details about each mounting method, including building requirements, see https://www.microsoft.com/surface/support/surface-hub.
+
+For specifications on available mounts for the original Surface Hub, see the following:
+
+- [Surface Hub Mounts and Stands Datasheet](https://download.microsoft.com/download/5/0/1/501F98D9-1BCC-4448-A1DB-47056CEE33B6/20160711_Surface_Hub_Mounts_and_Stands_Datasheet.pdf)
+- [Surface Hub Stand and Wall Mount Specifications](https://download.microsoft.com/download/7/A/7/7A75BD0F-5A46-4BCE-B313-A80E47AEB581/20160720_Combined_Stand_Wall_Mount_Drawings.pdf)
+
+## The Connect experience
+
+Connect lets people project their laptop, tablet, or phone to the Surface Hub screen. Connect allows wireless or wired connection types.
+
+#### Wireless connect 
+
+Since wireless connect is based on Miracast, you don’t need cables or additional setup planning to use it. Your users can load Miracast on most Miracast-enabled Windows 8.1 and Windows 10 devices. Then they can project their display from their computer or phone to the Surface Hub screen.
+
+
+#### Wired connect
+
+With wired connect, a cable transmits information from computers, tablets, or phones to Surface Hub. There are three video cable options, and they all use the same USB 2.0 cable. The cable bundle can include one or all of these connection options.
+
+- DisplayPort (DisplayPort cable + USB 2.0 cable)
+- HDMI (HDMI cable + USB 2.0 cable)
+- VGA (VGA cable + 3.5mm audio cable + USB 2.0 cable)
+
+For example, to provide audio, video, and touchback capability to all three video options, your Wired Connect cable bundle must include:
+
+- A DisplayPort cable 
+- An HDMI cable
+- A VGA cable
+- A USB 2.0 cable
+- A 3.5mm cable
+
+When you create your wired connect cable bundles, check the [55” Microsoft Surface Hub technical information](surface-hub-technical-55.md) or [84” Microsoft Surface Hub technical information](surface-hub-technical-84.md) sections for specific technical and physical details and port locations for each type of Surface Hub. Make the cables long enough to reach from Surface Hub to where the presenter will sit or stand.
+
+For details on Touchback and Inkback, see the user guide at https://www.microsoft.com/surface/support/surface-hub. 
+
+
+
+## See also
+
+[Watch the video (opens in a pop-up media player)](https://compass.xbox.com/assets/27/aa/27aa7dd7-7cb7-40ea-9bd6-c7de0795f68c.mov?n=04.07.16_installation_video_01_site_readiness.mov)  
diff --git a/devices/surface-hub/surface-hub-ssd-replacement.md b/devices/surface-hub/surface-hub-ssd-replacement.md
new file mode 100644
index 0000000000..7896a7d634
--- /dev/null
+++ b/devices/surface-hub/surface-hub-ssd-replacement.md
@@ -0,0 +1,54 @@
+---
+title: Surface Hub SSD replacement
+ms.reviewer: 
+manager: dansimp
+description: Learn how to replace the solid state drive in a Surface Hub.
+ms.prod: surface-hub
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# Surface Hub SSD replacement
+
+You might need to remove the solid state drive (SSD) from your Surface Hub so that you can reimage it using the [Surface Hub Recovery Tool](surface-hub-recovery-tool.md) or because you've been sent a replacement drive. You would reimage your SSD when the operating system is no longer bootable, such as from a Windows update failure, BitLocker issues, reset failure, or hardware failure. 
+
+
+>[!WARNING]
+>Make sure the Surface Hub is turned off at the AC switch.
+
+1. Locate the SSD compartment door on the rear, upper portion of the Surface Hub in the locations illustrated below. The door is identifiable as it doesn't have open ventilation slots.
+
+    ![SSD compartment door](images/ssd-location.png)
+
+    *Surface Hub hard drive locations*
+
+2. Locate the locking tab on the hard drive compartment door. On the Surface Hub 55, the locking tab will be located on the left-hand side of the door. On the Surface Hub 84, it will be on the right-hand side as shown in the illustration.
+
+    ![SSD compartment locking tab](images/ssd-lock-tab.png)
+
+    *Locking tab on hard drive compartment door*
+
+3. Lift open the compartment door to access the hard drive.
+
+    ![Lift](images/ssd-lift-door.png)
+
+    *Lift compartment door*
+
+4. Locate the pull tab, which may be partially hidden under the rear cover. Pull on the tab to eject the hard drive from the compartment.
+
+    ![Pull](images/ssd-pull-tab.png)
+
+    *Pull tab*
+
+5. Slide the replacement drive into place until you hear it click.
+
+    ![Slide in drive](images/ssd-click.png)
+    
+    *Slide replacement drive into place*
+
+6. Close the compartment door.
+
+7. Apply power to the Surface Hub.
diff --git a/devices/surface-hub/surface-hub-start-menu.md b/devices/surface-hub/surface-hub-start-menu.md
index dbd5b02e92..468e0d3329 100644
--- a/devices/surface-hub/surface-hub-start-menu.md
+++ b/devices/surface-hub/surface-hub-start-menu.md
@@ -3,10 +3,12 @@ title: Configure Surface Hub Start menu
 description: Use MDM to customize the Start menu on Surface Hub. 
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: greg-lindsay
+ms.author: greglin
 ms.topic: article
-ms.date: 01/17/2018
+ms.date: 08/15/2018
+ms.reviewer: 
+manager: laurawi
 ms.localizationpriority: medium
 ---
 
@@ -100,13 +102,12 @@ There are a few key differences between Start menu customization for Surface Hub
     
   
 
-
 ```
 
 
 ## Example: Start layout that includes a Microsoft Edge link
 
-This example shows a link to a website and a link to a .pdf file.
+This example shows a link to a website and a link to a .pdf file. The secondary tile for Microsoft Edge uses a 150 x 150 pixel icon.
 
 ```xml
 
@@ -164,10 +165,10 @@ This example shows a link to a website and a link to a .pdf file.
              TileID="6153963000"
              DisplayName="cstrtqbiology.pdf"
              Arguments="-contentTile -formatVersion 0x00000003 -pinnedTimeLow 0x45b7376e -pinnedTimeHigh 0x01d2356c -securityFlags 0x00000000 -tileType 0x00000000 -url 0x0000003a https://www.ada.gov/regs2010/2010ADAStandards/Guidance_2010ADAStandards.pdf"
-             Square150x150LogoUri="ms-appx:///"                                                
+             Square150x150LogoUri="ms-appx:///Assets/MicrosoftEdgeSquare150x150.png"
              Wide310x150LogoUri="ms-appx:///" 
-             ShowNameOnSquare150x150Logo="true"                                                      
-             ShowNameOnWide310x150Logo="true"
+             ShowNameOnSquare150x150Logo="true"
+             ShowNameOnWide310x150Logo="false"
              BackgroundColor="#ff4e4248"
              Size="4x2" 
              Row="4"
@@ -177,14 +178,7 @@ This example shows a link to a website and a link to a .pdf file.
     
   
 
-
 ```
 
 >[!NOTE]
->Microsoft Edge tile logos won't appear on secondary tiles because they aren't stored in Surface Hub.
->
 >The default value for `ForegroundText` is light; you don't need to include `ForegroundText` in your XML unless you're changing the value to dark.
-
-## More information
-
-- [Blog post: Changing Surface Hub’s Start Menu](https://blogs.technet.microsoft.com/y0av/2018/02/13/47/)
diff --git a/devices/surface-hub/surface-hub-technical-55.md b/devices/surface-hub/surface-hub-technical-55.md
new file mode 100644
index 0000000000..6abc46e411
--- /dev/null
+++ b/devices/surface-hub/surface-hub-technical-55.md
@@ -0,0 +1,153 @@
+---
+title: Technical information for 55" Surface Hub
+ms.reviewer: 
+manager: dansimp
+description: Specifications for the 55" Surface Hub
+ms.prod: surface-hub
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# Technical information for 55" Surface Hub
+
+## Measurements 
+
+|
+--- | ---
+Pricing	| Starting at $8,999 
+Size |	31.75” x 59.62” x 3.38” (806.4mm x 1514.3mm x 85.8mm)
+Storage/RAM	| SSD 128GB with 8GB RAM
+Processor |	4th Generation Intel® Core™ i5 
+Graphics |	Intel® HD 4600 
+Ports |	**Internal PC**
            • (1) USB 3.0 (bottom) + (1) USB 3.0 (side access) 
            • (2) USB 2.0
            • Ethernet 1000 Base-T
            • DisplayPort 
            • Video Output
            • 3.5mm Stereo Out
            • RJ11 Connector for system-level control
            **Alternate PC**
            • (2) USB 2.0 type B output
            • Connection for Camera, Sensors, Microphone, Speakers
            • (1) DisplayPort Video Input
            **Guest PC**
            • DisplayPort Video Input
            • HDMI Video Input
            • VGA Video Input
            • 3.5mm Stereo Input
            • (1) USB 2.0 type B Touchback™ Output
+Sensors |	(2) Passive Infrared Presence Sensors, Ambient Light Sensors 
+Speakers |	(2) Front-facing stereo speakers 
+Microphone |	High-Performance, 4-Element Array 
+Camera |	(2) Wide angle HD cameras 1080p @ 30fps 
+Pen	 | (2) Powered, active, subpixel accuracy 
+Physical side buttons |	Power, Input Select, Volume, Brightness 
+Software |	Windows 10 + Office (Word, PowerPoint, Excel) 
+What’s in the box |	• Surface Hub 55”
            • (2) Surface Hub Pens
            • Power Cable
            • Setup Guide
            • Start Guide
            • Safety and Warranty documents
            • Wireless All-in-One Keyboard
+Mounting features	| 4X VESA standard, 400mm x 400mm plus 1150mm x 400mm pattern, 8X M6 X 1.0 threaded mounting locations
+Display height from floor	| Recommended height of 55 inches (139.7 cm) to center of screen
+Product weight |	Approx. 105 lb. (47.6 kg) without accessories
+Product shipping weight	 | Approx. 150 lb. (68 kg)
+Product dimensions HxWxD | 	31.63 x 59.62 x 3.2 inches (80.34 x 151.44 x 8.14 cm)
+Product shipping dimensions HxWxD |	43 x 65 x 20 inches (109 x 165 x 51 cm)
+Product thickness	| Touch surface to mounting surface: ≤ 2.4 inches (6 cm)
+Orientation	 | Landscape only. Display cannot be used in a portrait orientation.
+BTU	 | 1706 BTU/h
+Image resolution |	1920 x 1080
+Frame rate |	120Hz
+EDID preferred timing, replacement PC |	1920 x 1080, 120Hz vertical refresh
+EDID preferred timing, wired connect |	1920 x 1080, 60Hz vertical refresh
+Input voltage | (50/60Hz)	110/230v nominal, 90-265v max
+Input power, operating |	500W max
+Input power, standby    |  	5W nominal
+
+
+## Replacement PC connections 
+
+Connector and location | Label | Description
+--- | --- | ---
+Switch, bottom I/O | ![](images/switch.png) | Switches the function between using internal PC or external PC.
+Display port, bottom I/O | ![](images/dport.png) | Provides input for replacement PC.
+USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for replacement PC to internal peripherals. 
+USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for integrated hub.
+
+
+## Wired connect connections
+
+Connector and location | Label | Description
+--- | --- | ---
+Display port, bottom I/O | ![](images/dportio.png) | Provides input for wired connect PC.
+HDMI, bottom I/O | ![](images/hdmi.png) | Provides HDMI input for wired connect PC.
+VGA, bottom I/O | ![](images/vga.png) | Provides VGA input for wired connect PC.
+3.5mm, bottom I/O | ![](images/35mm.png) | Provides analog audio input.
+USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for video ingest touchback.
+
+## Additional connections
+
+Connector and location | Label | Description
+--- | --- | ---
+USB type A, side I/O | ![](images/usb.png) | Provides 1 USB 3.0 connection for USB devices. Wake-on USB capable.
+USB type A, bottom I/O with blue insulator | ![](images/usb.png) | Provides USB 3.0 connection.
+3.5mm, bottom I/O | ![](images/analog.png) | Provides analog audio out.
+Display port, bottom I/O | ![](images/dportout.png) | Provides mirrored video out function to another display.
+IEC/EN60320-C13 receptacle with hard switch | ![](images/iec.png) | Provides AC input and compliance with EU power requirements.
+RJ45, bottom I/O | ![](images/rj45.png) | Connects to Ethernet.
+RJ11, bottom I/O | ![](images/rj11.png) | Connects to room control systems.
+
+
+
+
+
+
+
+## Diagrams of ports and clearances
+
+***Top view of 55" Surface Hub***
+
+![](images/sh-55-top.png)
+
+---
+
+
+***Front view of 55" Surface Hub***
+
+![](images/sh-55-front.png)
+
+
+---
+
+***Bottom view of 55" Surface Hub***
+
+![](images/sh-55-bottom.png)
+
+
+---
+
+***Replacement PC ports on 55" Surface Hub***
+
+![](images/sh-55-rpc-ports.png)
+
+
+---
+
+***Keypad on right side of 55" Surface Hub***
+
+![](images/key-55.png)
+
+
+---
+
+***Rear view of 55" Surface Hub***
+
+![](images/sh-55-rear.png)
+
+
+---
+
+***Clearances for 55" Surface Hub***
+
+![](images/sh-55-clearance.png)
+
+---
+
+
+***Front and bottom handholds and clearances for 55" Surface Hub***
+
+![](images/sh-55-hand.png)
+
+
+---
+
+
+***Rear handholds and clearances for 55" Surface Hub***
+
+![](images/sh-55-hand-rear.png)
+
+
diff --git a/devices/surface-hub/surface-hub-technical-84.md b/devices/surface-hub/surface-hub-technical-84.md
new file mode 100644
index 0000000000..0ba7d45aa1
--- /dev/null
+++ b/devices/surface-hub/surface-hub-technical-84.md
@@ -0,0 +1,159 @@
+---
+title: Technical information for 84" Surface Hub
+ms.reviewer: 
+manager: dansimp
+description: Specifications for the 84" Surface Hub
+ms.prod: surface-hub
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# Technical information for 84" Surface Hub
+
+## Measurements 
+
+|
+--- | ---
+Pricing	| Starting at $21,999 
+Size |	46.12” x 86.7” x 4.15” (1171.5mm x 2202.9mm x 105.4mm)
+Storage/RAM	| SSD 128GB with 8GB RAM
+Processor	| 4th Generation Intel® Core™ i7 
+Graphics |	NVIDIA Quadro K2200 
+Ports |	**Internal PC**
            • (1) USB 3.0 (bottom) + (1) USB 3.0 (side access)
            • (4) USB 2.0
            •  Ethernet 1000 Base-T
            • DisplayPort Video Output
            • 3.5mm Stereo Out
            • RJ11 Connector for system-level control
            **Alternate PC**
            • (2) USB 2.0 type B output
            •  connection for Camera, Sensors, Microphone, Speakers
            • (2) DisplayPort Video Input
            **Guest PC**
            • DisplayPort Video Input
            • HDMI Video Input
            • VGA Video Input
            • 3.5mm Stereo Input
            • (1) USB 2.0 type B Touchback™ Output
+Sensors	 | (2) Passive Infrared Presence Sensors, Ambient Light Sensors 
+Speakers |	(2) Front-facing stereo speakers 
+Microphone |	High-Performance, 4-Element Array 
+Camera |	(2) Wide angle HD cameras 1080p @ 30fps 
+Pen |	(2) Powered, active, subpixel accuracy 
+Physical side buttons |	Power, Input Select, Volume, Brightness 
+Software |	Windows 10 + Office (Word, PowerPoint, Excel) 
+What’s in the box |	• Surface Hub 84”
            • (2) Surface Hub Pens
            • Power Cable
            • Setup Guide
            • Safety and Warranty documents
            • Wireless All-in-One Keyboard
+Mounting features	| 4X VESA standard, 1200mm x 600mm pattern, 8X M8 X 1.25 threaded mounting locations
+Display height from floor	| Recommended height of 54 inches (139.7 cm) to center of screen
+Product weight |	Approx. 280 lb. (127 kg.)
+Product shipping weight	 | Approx. 580 lb. (263 kg.)
+Product dimensions HxWxD | 	46 x 86.9 x 4.1 inches (116.8 x 220.6 x 10.4 cm)
+Product shipping dimensions HxWxD |	66.14 x 88.19 x 24.4 inches (168 x 224 x 62 cm)
+Product thickness	| Touch surface to mounting surface: ≤ 3.1 inches (7.8 cm)
+Orientation	 | Landscape only. Display cannot be used in a portrait orientation.
+BTU	 | 3070.8 BTU/h
+Image resolution |	3840 x 2160
+Frame rate |	120Hz
+Contrast Ratio | 1400:1
+EDID preferred timing, replacement PC |	3840 x 2140, 120Hz vertical refresh
+EDID preferred timing, wired connect |	1920 x 1080, 60Hz vertical refresh
+Input voltage | 110/230v nominal, 90-265v max
+Input power, operating |	900W max
+Input power, standby    |  	5W nominal, 1-10W max
+
+
+## Replacement PC connections 
+
+Connector and location | Label | Description
+--- | --- | ---
+Switch, bottom I/O | ![](images/switch.png) | Switches the function between using internal PC or external PC.
+Display port, bottom I/O | ![](images/dport.png) | Provides input for replacement PC.
+Display port, bottom I/O | ![](images/dport.png) | Provides second input for replacement PC.
+USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for replacement PC to internal peripherals. 
+USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for integrated hub.
+
+
+## Wired connect connections
+
+Connector and location | Label | Description
+--- | --- | ---
+Display port, bottom I/O | ![](images/dportio.png) | Provides input for wired connect PC.
+HDMI, bottom I/O | ![](images/hdmi.png) | Provides HDMI input for wired connect PC.
+VGA, bottom I/O | ![](images/vga.png) | Provides VGA input for wired connect PC.
+3.5mm, bottom I/O | ![](images/35mm.png) | Provides analog audio input.
+USB type B, bottom I/O | ![](images/usb.png) | Provides USB connection for video ingest touchback.
+
+## Additional connections
+
+Connector and location | Label | Description
+--- | --- | ---
+USB type A, side I/O | ![](images/usb.png) | Provides 1 USB 3.0 connection for USB devices. Wake-on USB capable.
+USB type A, bottom I/O with blue insulator | ![](images/usb.png) | Provides USB 3.0 connection.
+3.5mm, bottom I/O | ![](images/analog.png) | Provides analog audio out.
+Display port, bottom I/O | ![](images/dportout.png) | Provides mirrored video out function to another display.
+IEC/EN60320-C13 receptacle with hard switch | ![](images/iec.png) | Provides AC input and compliance with EU power requirements.
+RJ45, bottom I/O | ![](images/rj45.png) | Connects to Ethernet.
+RJ11, bottom I/O | ![](images/rj11.png) | Connects to room control systems.
+
+
+
+
+
+
+
+## Diagrams of ports and clearances
+
+***Top view of 84" Surface Hub***
+
+![](images/sh-84-top.png)
+
+---
+
+
+***Front view of 84" Surface Hub***
+
+![](images/sh-84-front.png)
+
+
+---
+
+***Bottom view of 84" Surface Hub***
+
+![](images/sh-84-bottom.png)
+
+
+---
+
+***Replacement PC ports on 84" Surface Hub***
+
+![](images/sh-84-rpc-ports.png)
+
+
+
+---
+
+***Rear view of 84" Surface Hub***
+
+![](images/sh-84-rear.png)
+
+
+---
+
+***Clearances for 84" Surface Hub***
+
+![](images/sh-84-clearance.png)
+
+---
+
+
+***Removable lifting handles on 84” Surface Hub ***
+
+![](images/sh-84-hand.png)
+
+
+---
+
+
+***Wall mount threads on back of 84” Surface Hub ***
+
+![](images/sh-84-wall.png)
+
+---
+***Lifting handles in top view of 84” Surface Hub***
+
+![](images/sh-84-hand-top.png)
+
+---
+***Side view of 84” Surface Hub***
+
+![](images/sh-84-side.png)
+
+
diff --git a/devices/surface-hub/surface-hub-update-history.md b/devices/surface-hub/surface-hub-update-history.md
new file mode 100644
index 0000000000..943400d44c
--- /dev/null
+++ b/devices/surface-hub/surface-hub-update-history.md
@@ -0,0 +1,528 @@
+---
+title: Surface Hub update history
+description: Surface Hub update history
+ms.assetid: d66a9392-2b14-4cb2-95c3-92db0ae2de34
+keywords:
+ms.prod: surface-hub
+ms.sitesec: library
+author: v-miegge
+ms.author: v-miegge
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# Surface Hub update history
+
+Windows 10 was designed to be a service, which means it automatically gets better through periodic software updates. The great news is that you usually don’t have to do anything to get the latest Windows 10 updates—they'll download and install whenever they’re available.
+
+Most Windows updates focus on performance and security improvements to keep you going 24/7.
+
+One thing we’re hearing from you is that you want to know more about what's in our Windows 10 updates, so we're providing more details on this page. In the list below, the most recent Windows update is listed first. Installing the most recent update ensures that you also get any previous updates you might have missed, including security updates. Microsoft Store apps are updated through the Microsoft Store (managed by the Surface Hub's system administrator). Details about app updates are provided on a per-app basis.
+We'll be refreshing this page as new updates are released, so stay tuned for the latest info. And thank you for helping us learn and get better with each update!
+
+Please refer to the “[Surface Hub Important Information](https://support.microsoft.com/products/surface-devices/surface-hub)” page for related topics on current and past releases that may require your attention.
+
+## Windows 10 Team Creators Update 1703
+
+
            
+September 24, 2019—update for Team edition based on KB4516059*  (OS Build 15063.2078)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+ * Update to Surface Hub 2S Recovery Settings page to accurately reflect recovery options.
+ * Update to Surface Hub 2S Welcome screen to improve device recognizability.
+ * Addressed an issue with the Windows Team Edition shell background displaying incorrectly.
+ * Addressed an issue with Start Menu layout persistence when configured using MDM policy.
+ * Fixed an issue in Microsoft Edge that occurs when browsing some internal websites.
+ * Fixed an issue in Skype for Business that occurs when presenting in full-screen mode.
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4503289](https://support.microsoft.com/help/4503289)
+
            
+
+
            
+August 17, 2019—update for Team edition based on KB4512474*  (OS Build 15063.2021)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+ * Ensures that Video Out on Hub 2S defaults to "Duplicate" mode.
+ * Improves reliability for some Arabic language usage scenarios on Surface Hub.
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4503289](https://support.microsoft.com/help/4503289)
+ 
            
+
+
            
+June 18, 2019—update for Team edition based on KB4503289*  (OS Build 15063.1897)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Addresses an issue with log collection for Microsoft Surface Hub 2S.
+* Addresses an issue preventing a user from signing in to a Microsoft Surface Hub device with an Azure Active Directory account. This issue occurs because a previous session did not end successfully.
+* Adds support for TLS 1.2 connections to identity providers and Exchange in device account setup scenarios.
+* Fixes to improve reliability of Hardware Diagnostic App on Hub 2S. 
+* Fix to improve consistency of first-run setup experience on Hub 2S. 
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4503289](https://support.microsoft.com/help/4503289)
+
            
+
+
            
+May 28, 2019—update for Team edition based on KB4499162*  (OS Build 15063.1835)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Ensures that Surface Hub users aren't prompted to enter proxy credentials after the "Use device account credentials" feature has been enabled.
+* Resolves an issue where Skype connections fail periodically because audio/video isn't using the correct proxy.
+* Adds support for TLS 1.2 in Skype for Business.
+* Resolves a SIP connection failure in the Skype client when the Skype server has TLS 1.0 or TLS 1.1 disabled.
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4499162](https://support.microsoft.com/help/4499162)
+
            
+
+
            
+April 25, 2019—update for Team edition based on KB4493436*  (OS Build 15063.1784)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Resolves video and audio sync issue with some USB devices that are connected to the Surface Hub.
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4493436](https://support.microsoft.com/help/4493436)
+
            
+
+
            
+November 27, 2018—update for Team edition based on KB4467699*  (OS Build 15063.1478)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Addresses an issue that prevents some users from Signing-In to “My Meetings and Files.”
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KBKB4467699](https://support.microsoft.com/help/KB4467699)
+
            
+
+
            
+October 18, 2018 —update for Team edition based on KB4462939*  (OS Build 15063.1418)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Skype for Business fixes: 
+  * Resolves Skype for Business connection issue when resuming from sleep
+  * Resolves Skype for Business network connection issue, when device is connected to Internet
+  * Resolves Skype for Business crash when searching for users from directory
+* Resolves issue where the Hub mistakenly reports “No Internet connection” in enterprise proxy environments.
+* Implemented a feature allowing customers to op-in to a new Whiteboard experience.
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4462939](https://support.microsoft.com/help/4462939)
+
            
+
+
            
+August 31, 2018 —update for Team edition based on KB4343889* (OS Build 15063.1292)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Adds support for Microsoft Teams
+* Resolves task management issue with Intune registration
+* Enables Administrators to disable Instant Messaging and Email services for the Hub
+* Additional bug fixes and reliability improvements for the Surface Hub Skype for Business App
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4343889](https://support.microsoft.com/help/4343889)
+
            
+
+
            
+June 21, 2018 —update for Team edition based on KB4284830* (OS Build 15063.1182)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Telemetry change in support of GDPR requirements in EMEA
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4284830](https://support.microsoft.com/help/KB4284830)
+
            
+
+
            
+April 17, 2018 —update for Team edition based on KB4093117* (OS Build 15063.1058)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Resolves a wired projection issue
+* Enables bulk update for certain MDM (Mobile Device Management) policies
+* Resolves phone dialer issue with international calls
+* Addresses image resolution issue when 2 Surface Hubs join the same meeting
+* Resolves OMS (Operations Management Suite) certificate handling error
+* Addresses a security issue when cleaning up at the end of a session
+* Addresses Miracast issue, when Surface Hub is specified to channels 149 through 165
+  * Channels 149 through 165 will continue to be unusable in Europe, Japan or Israel due to regional governmental regulations
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4093117](https://support.microsoft.com/help/4093117)
+
            
+
+
            
+February 23, 2018 —update for Team edition based on KB4077528* (OS Build 15063.907)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Resolved an issue where MDM settings were not being correctly applied
+* Improved Cleanup process
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4077528](https://support.microsoft.com/help/4077528)
+
            
+
+
            
+January 16, 2018 —update for Team edition based on KB4057144* (OS Build 15063.877)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Adds ability to manage Start Menu tile layout via MDM
+* MDM bug fix on password rotation configuration
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4057144](https://support.microsoft.com/help/4057144)
+
            
+
+
            
+December 12, 2017 —update for Team edition based on KB4053580* (OS Build 15063.786)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Resolves camera video flashes (tearing or flickers) during Skype for Business calls
+* Resolves Notification Center SSD ID issue
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4053580](https://support.microsoft.com/help/4053580)
+
            
+
+
            
+November 14, 2017 —update for Team edition based on KB4048954* (OS Build 15063.726)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Feature update that allows customers to enable 802.1x wired network authentication using MDM policy.
+* A feature update that enables users to dynamically select an application of their choice when opening a file.
+* Fix that ensures that End Session cleanup fully removes all connections between the user’s account and the device.
+* Performance fix that improves cleanup time as well as Miracast connection time.
+* Introduces Easy Authentication utilization during ad-hock meetings.
+* Fix that ensures service components to use the same proxy that is configured across the device.
+* Reduces and more thoroughly secures the telemetry transmitted by the device, reducing bandwidth utilization.
+* Enables a feature allowing users to provide feedback to Microsoft after a meeting concludes.
+
+Please refer to the [Surface Hub Admin guide](https://docs.microsoft.com/surface-hub/) for enabling/disabling device features and services.
+*[KB4048954](https://support.microsoft.com/help/4048954)
+
            
+
+
            
+October 10, 2017 —update for Team edition based on KB4041676* (OS Build 15063.674)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Skype for Business
+  * Resolves issue that required a device reboot when resuming from sleep.
+  * Fixes issue where external contacts did not resolve through Skype Online Hub account.
+* PowerPoint
+  * Fixes problem where some PowerPoint presentations would not project on Hub.
+* General
+  * Fix to resolve issue where USB port could not be disabled by System Administrator.
+
+*[KB4041676](https://support.microsoft.com/help/4041676)
+
            
+
+
            
+September 12, 2017 —update for Team edition based on KB4038788* (OS Build 15063.605) 
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Security
+  * Resolves issue with Bitlocker when device wakes from sleep.
+* General
+  * Reduces frequency/amount of device health telemetry, improving system performance.
+  * Fixes issue that prevented device from collecting system logs.
+
+*[KB4038788](https://support.microsoft.com/help/4038788)
+
            
+
+
            
+August 1, 2017 — update for Team edition based on KB4032188* (OS Build 15063.498)
+
+* Skype for Business 
+  * Resolves Skype for Business Sign-In issue, which required retry or system reboot.
+  * Resolves Skype for Business meeting time being incorrectly displayed.
+  * Fixes to improve Surface Hub Skype for Business reliability.
+
+*[KB4032188](https://support.microsoft.com/help/4032188)
+
            
+
+
            
+June 27, 2017 — update for Team edition based on KB4022716* (OS Build 15063.442)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Address NVIDIA driver crashes that may necessitate sleeping 84” Surface Hub to power down, requiring a manual restart.
+* Resolved an issue where some apps fail to launch on an 84” Surface Hub.
+
+*[KB4022716](https://support.microsoft.com/help/4022716)
+
            
+
+
            
+June 13, 2017 — update for Team edition based on KB4022725* (OS Build 15063.413)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* General
+  * Resolved Pen ink dropping issues with pens
+  * Resolved issue causing extended time to “cleanup” meeting
+
+*[KB4022725](https://support.microsoft.com/help/4022725)
+
            
+
+
            
+May 24, 2017 — update for Team edition based on KB4021573* (OS Build 15063.328)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* General
+  * Resolved issue with proxy setting retention during update issue
+
+*[KB4021573](https://support.microsoft.com/help/4021573)
+
            
+
+
            
+May 9, 2017 — update for Team edition based on KB4016871* (OS Build 15063.296)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* General
+  * Addressed sleep/wake cycle issue
+  * Resolved several Reset and Recovery issues
+  * Addressed Update History tab issue
+  * Resolved Miracast service launch issue
+* Apps
+  * Fixed App package update error
+
+*[KB4016871](https://support.microsoft.com/help/4016871)
+
            
+
+
            
+Windows 10 Team Creators Update 1703 for Surface Hub — General Release notes (OS Build 15063.0)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Evolving the large screen experience 
+  * Improved the meeting carousel in Welcome and Start
+  * Join meetings and end the session directly from the Start menu
+  * Apps can utilize more of the screen during a session
+  * Simplified Skype controls
+  * Improved mechanisms for providing feedback
+* Access My Personal Content*
+  * Personal single sign-on from Welcome or Start
+  * Join meetings and end the session directly from the Start menu
+  * Access personal files through OneDrive for Business directly from Start
+  * Pre-populated attendee sign-in
+  * Streamlined authentication flows with “Authenticator” app**
+* Deployment & Manageability 
+  * Simplified OOBE experience through bulk provisioning
+  * Cloud-based device recovery service
+  * Enterprise client certificate support
+  * Improved proxy credential support
+  * Added and /improved Skype Quality of Service (QoS) configuration support
+  * Added ability to set default device volume in Settings
+  * Improved MDM support for Surface Hub [settings](https://docs.microsoft.com/surface-hub/remote-surface-hub-management)
+* Improved Security 
+  * Added ability to restrict USB drives to BitLocker only
+  * Added ability to disable USB ports via MDM
+  * Added ability to disable “Resume session” functionality on timeout
+  * Addition of wired 802.1x support
+* Audio and Projection
+  * Dolby Audio “Human Speaker” enhancements
+  * Reduced “pen tap” sounds when using Pen during Skype for Business calls
+  * Added support for Miracast infrastructure connections
+* Reliability and Performance fixes
+  * Resolved several Reset and Recovery issues
+  * Resolved Surface Hub Exchange authentication issue when utilizing client certificates
+  * Improved Wi-Fi network connection and credentials stability
+  * Fixed Miracast audio popping and sync issues during video playback
+  * Included setting to disable auto connect behavior
+
+*Single sign-in feature requires use of Office365 and OneDrive for Business
+**Refer to Admin Guide for service requirements
+
+
            
+
+## Windows 10 Team Anniversary Update 1607
+
+
            
+March 14th, 2017 — update for Team edition based on KB4013429* (OS Build 14393.953)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* General
+  * Security fix for File Explorer to prevent navigation to restricted file locations
+* Skype for Business
+  * Fix to address latency during Remote Desktop based screen sharing
+
+*[KB4013429](https://support.microsoft.com/help/4013429)
+
            
+
+
            
+January 10th, 2017 — update for Team edition based on KB4000825* (OS Build 14393.693)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Enabled selection of 106/109 Keyboard Layouts for use with physical Japanese keyboards
+
+*[KB4000825](https://support.microsoft.com/help/4000825)
+
            
+
+
            
+December 13, 2016 — update for Team edition based on KB3206632* (OS Build 14393.576)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Resolves wired connection audio distortion issue
+
+*[KB3206632](https://support.microsoft.com/help/3206632)
+
            
+
+
            
+November 4, 2016 — update for Windows 10 Team Anniversary edition based on KB3200970* (OS Build 14393.447)
+
+This update to the Windows 10 Team Anniversary Update (version 1607) for Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Skype for Business bug fixes to improve reliability
+
+*[KB3200970](https://support.microsoft.com/help/3200970)
+
            
+
+
            
+October 25, 2016 — update for Team edition based on KB3197954* (OS Build 14393.351)
+
+This update to the Surface Hub includes quality improvements and security fixes. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Enabling new Sleep feature in OS and Bios to reduce the Surface Hub’s power consumption and improve its long-term reliability
+* General
+  * Resolves scenarios where the on-screen keyboard would sometimes not appear
+  * Resolves Whiteboard application shift that occasionally occurs when opening scheduled meeting
+  * Resolves issue that prevented Admins from changing the local administrator password, after device has been Reset
+  * BIOS change resolving issue with status bar tracking during device Reset
+  * UEFI update to resolve powering down issues
+
+*[KB3197954](https://support.microsoft.com/help/3197954)
+
            
+
+
            
+October 11, 2016 — update for Team edition based on KB3194496* (OS Build 14393.222)
+
+This update brings the Windows 10 Team Anniversary Update to Surface Hub and includes quality improvements and security fixes. (Your device will be running Windows 10 Version 1607 after it's installed.) Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Skype for Business
+  * Performance improvements when joining meetings, including issues when joining a meeting using federated accounts
+  * Video Based Screen Sharing (VBSS) support now available on Skype for Business for Surface Hub
+  * Resolved disconnection after 5 minutes of idle time issue
+  * Resolved Skype Hub-to-Hub screen sharing failure
+  * Improvements to Skype video, including:
+    * Loss of video during meeting with multiple video presenters
+    * Video cropping during calls
+    * Outgoing call video not displaying for other participants
+  * Addressed issue with UPN sign in error
+  * Addressed issue with dial pad during use of Session Initiation Protocol (SIP) calls
+* Whiteboard
+  * User can now save and recall Whiteboard sessions using OneDrive online service (via Share functionality)
+  * Improved launching Whiteboard when removing pen from dock
+* Apps
+  * Pre-installed OneDrive app, for access to your personal and work files
+  * Pre-installed Photos app, to view photos and video
+  * Pre-installed PowerBI app, to view dashboards
+  * The Office apps – Word, Excel, PowerPoint – are all ink-enabled
+  * Edge on Surface Hub now supports Flash-based websites
+* General
+  * Enabled Audio Device Selection (for Surface Hubs attached using external audio devices)
+  * Enabled support for HDCP on DisplayPort output connector
+  * System UI changes to settings for usability optimization (refer to [User and Admin Guides](https://www.microsoft.com/surface/support/surface-hub) for additional details)
+  * Bug fixes and performance optimizations to speed up the Azure Active Directory sign-in flow
+  * Significantly improved time needed to reset and restore Surface Hub
+  * Windows Defender UI has been added within settings
+  * Improved UX touch to start
+  * Enabled support for greater than 1080p wireless projection via Miracast, on supported devices
+  * Resolved “There’s no internet connection” and “Appointments may be out of date” false notification states from launch
+  * Improved reliability of on-screen keyboard
+  * Additional support for creating Surface Hub provisioning packages using Windows Imaging & Configuration Designer (ICD) and improved Surface Hub monitoring solution on Operations Management Suite (OMS)
+
+*[KB3194496](https://support.microsoft.com/help/3194496)
+
            
+
+## Updates for Windows 10 Version 1511
+
+
            
+November 4, 2016 — update for Windows 10 Team (version 1511) on KB3198586* (OS Build 10586.679)
+
+This update to the Windows 10 Team edition (version 1511) to Surface Hub includes quality improvements and security fixes that are outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history). There are no Surface Hub specific items in this update.
+
+*[KB3198586](https://support.microsoft.com/help/3198586)
+
            
+
+
            
+July 12, 2016 — KB3172985* (OS Build 10586.494)
+
+This update includes quality improvements and security fixes. No new operating system features are being introduced in this update. Key changes specific to the Surface Hub (those not already included in the [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history)), include:
+
+* Fixed issue that caused Windows system crashes
+* Fixed issue that caused repeated Edge crashes
+* Fixed issue causing pre-shutdown service crashes
+* Fixed issue where some app data wasn’t properly removed after a session
+* Updated Broadcom NFC driver to improve NFC performance
+* Updated Marvell Wi-Fi driver to improve Miracast performance
+* Updated Nvidia driver to fix a display bug in which 84" Surface Hub devices show dim or fuzzy content
+* Numerous Skype for Business issues fixed, including: 
+  * Issue that caused Skype for Business to disconnect during meetings
+  * Issue in which users were unable to join meetings when the meeting organizer was on a federated configuration
+  * Enabling Skype for Business application sharing
+  * Issue that caused Skype application crashes
+* Added a prompt in “Settings” to inform users that the OS can become corrupted if device reset is interrupted before completion
+
+*[KB3172985](https://support.microsoft.com/help/3172985)
+
            
+
+
            
+June 14, 2016 — KB3163018* (OS Build 10586.420)
+
+This update to the Surface Hub includes quality improvements and security fixes. No new operating system features are being introduced in this update. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Constrained release. Refer to July 12, 2016 — [KB3172985](https://support.microsoft.com/en-us/help/3172985) (OS Build 10586.494) for Surface Hub specific package details
+
+*[KB3163018](https://support.microsoft.com/help/3163018)
+
            
+
+
            
+May 10, 2016 — KB3156421* (OS Build 10586.318)
+
+This update to the Surface Hub includes quality improvements and security fixes. No new operating system features are being introduced in this update. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Fixed issue that prevented certain Store apps (OneDrive) from installing
+* Fixed issue that caused touch input to stop responding in applications
+
+*[KB3156421](https://support.microsoft.com/help/3156421)
+
            
+
+
            
+April 12, 2016 — KB3147458* (OS Build 10586.218)
+
+This update to the Surface Hub includes quality improvements and security fixes. No new operating system features are being introduced in this update. Key updates to Surface Hub, not already outlined in [Windows 10 Update History](https://support.microsoft.com/help/4018124/windows-10-update-history), include:
+
+* Fixed issue where volume level wasn’t properly reset between sessions
+
+*[KB3147458](https://support.microsoft.com/help/3147458)
+
            
+
+## Related topics
+
+* [Windows 10 feature roadmap](https://go.microsoft.com/fwlink/p/?LinkId=785967)
+* [Windows 10 release information](https://go.microsoft.com/fwlink/p/?LinkId=724328)
+* [Windows 10 November update: FAQ](https://windows.microsoft.com/windows-10/windows-update-faq)
+* [Microsoft Surface update history](https://go.microsoft.com/fwlink/p/?LinkId=724327)
+* [Microsoft Lumia update history](https://go.microsoft.com/fwlink/p/?LinkId=785968)
+* [Get Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=616447)
diff --git a/devices/surface-hub/surface-hub-wifi-direct.md b/devices/surface-hub/surface-hub-wifi-direct.md
index c4051021b6..8d94858bfa 100644
--- a/devices/surface-hub/surface-hub-wifi-direct.md
+++ b/devices/surface-hub/surface-hub-wifi-direct.md
@@ -1,113 +1,117 @@
 ---
 title: How Surface Hub addresses Wi-Fi Direct security issues
-description: This topic provides guidance on Wi-Fi Direct security risks.
+description: Guidance about Wi-Fi Direct security risks.
 keywords: change history
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 07/27/2017
+ms.date: 11/27/2019
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
 # How Surface Hub addresses Wi-Fi Direct security issues
 
-Microsoft Surface Hub is an all-in-one productivity device that enables teams to better brainstorm, collaborate, and share ideas. Surface Hub relies on Miracast for wireless projection by using Wi-Fi Direct.
+Microsoft Surface Hub is an all-in-one productivity device that enables teams to better brainstorm, collaborate, and share ideas. Surface Hub relies on Miracast for wireless projection through Wi-Fi Direct.
 
-This topic provides guidance on Wi-Fi Direct security vulnerabilities, how Surface Hub has addressed those risks, and how Surface Hub administrators can configure the device for the highest level of security. This hardening information will help customers with high security requirements understand how best to protect their Surface Hub connected networks and data in transit.
+This article describes Wi-Fi Direct security vulnerabilities, how Surface Hub addresses those risks, and how administrators can configure Surface Hub for the highest level of security. This information will help customers who have high security requirements protect their Surface Hub-connected networks and data in transit.
 
-The intended audiences for this topic include IT and network administrators interested in deploying Microsoft Surface Hub in their corporate environment with optimal security settings.
+The intended audiences for this article are IT and network administrators who want to deploy Surface Hub in their corporate environment with optimal security settings.
 
 ## Overview
 
-Microsoft Surface Hub's security depends extensively on Wi-Fi Direct / Miracast and the associated 802.11, Wi-Fi Protected Access (WPA2), and Wireless Protected Setup (WPS) standards. Since the device only supports WPS (as opposed to WPA2 Pre-Shared Key (PSK) or WPA2 Enterprise), issues traditionally associated with 802.11 encryption are simplified by design. 
+Security for Surface Hub depends extensively on Wi-Fi Direct/Miracast and the associated 802.11, Wi-Fi Protected Access (WPA2), and Wireless Protected Setup (WPS) standards. Because the device only supports WPS (as opposed to WPA2 Pre-Shared Key [PSK] or WPA2 Enterprise), the issues often associated with 802.11 encryption are simplified.
 
-It is important to note Surface Hub operates on par with the field of Miracast receivers, meaning that it is protected from, and vulnerable to, a similar set of exploits as all WPS-based wireless network devices. But Surface Hub’s implementation of WPS has extra precautions built in, and its internal architecture helps prevent an attacker – even after compromising the Wi-Fi Direct / Miracast layer – to move past the network interface onto other attack surfaces and connected enterprise networks see [Wi-Fi Direct vulnerabilities and how Surface Hub addresses them](#vulnerabilities).  
+Surface Hub operates on par with the field of Miracast receivers. So, it's vulnerable to a similar set of exploits as all WPS-based wireless network devices. But the Surface Hub implementation of WPS has extra precautions built in. Also, its internal architecture helps prevent an attacker who has compromised the Wi-Fi Direct/Miracast layer from moving past the network interface onto other attack surfaces and connected enterprise networks.
 
 ## Wi-Fi Direct background
 
-Miracast is part of the Wi-Fi Display standard, which itself is supported by the Wi-Fi Direct protocol. These standards are supported in modern mobile devices for screen sharing and collaboration.
+Miracast is part of the Wi-Fi Display standard, which is supported by the Wi-Fi Direct protocol. These standards are supported in modern mobile devices for screen sharing and collaboration.
 
-Wi-Fi Direct or Wi-Fi "Peer to Peer" (P2P) is a standard released by the Wi-Fi Alliance for "Ad-Hoc" networks. This allows supported devices to communicate directly and create groups of networks without requiring a traditional Wi-Fi Access Point or an Internet connection.
+Wi-Fi Direct or Wi-Fi "peer to peer" (P2P) is a standard from the Wi-Fi Alliance for "Ad-Hoc" networks. Supported devices can communicate directly and create groups of networks without a conventional Wi-Fi access point or Internet connection.
 
-Security for Wi-Fi Direct is provided by WPA2 using the WPS standard.  Authentication mechanism for devices can be a numerical pin (WPS-PIN), a physical or virtual Push Button (WPS-PBC), or an out-of-band message such as Near Field Communication (WPS-OOO). The Microsoft Surface Hub supports both Push Button (which is the default) and PIN methods.
+Security for Wi-Fi Direct is provided by WPA2 under the WPS standard. The authentication mechanism for devices can be a numerical pin (WPS-PIN), a physical or virtual push button (WPS-PBC), or an out-of-band message such as near field communication (WPS-OOO). Surface Hub supports both the PIN method and the push-button method, which is the default.
 
-In Wi-Fi Direct, groups are created as either "persistent," allowing for automatic reconnection using stored key material, or "temporary," where devices cannot re-authenticate without user intervention or action. Wi-Fi Direct groups will typically determine a Group Owner (GO) through a negotiation protocol, which mimics the "station" or "Access Point" functionality for the established Wi-Fi Direct Group. This Wi-Fi Direct GO provides authentication (via an “Internal Registrar”), and facilitate upstream network connections. For Surface Hub, this GO negotiation does not take place, as the network only operates in "autonomous" mode, where Surface Hub is always the Group Owner. Finally, Surface Hub does not and will not join other Wi-Fi Direct networks itself as a client.
+In Wi-Fi Direct, groups are created as one of the following types:
+- *Persistent*, in which automatic reconnection can occur by using stored key material
+- *Temporary*, in which devices can't re-authenticate without user action
 
-
-## Wi-Fi Direct vulnerabilities and how Surface Hub addresses them
+Wi-Fi Direct groups determine a *group owner* (GO) through a negotiation protocol, which mimics the "station" or "access point" functionality for the established Wi-Fi Direct group. The Wi-Fi Direct GO provides authentication (via an "internal registrar") and facilitates upstream network connections. For Surface Hub, this GO negotiation doesn't occur. The network only operates in "autonomous" mode, and Surface Hub is always the group owner. Finally, Surface Hub itself doesn't join other Wi-Fi Direct networks as a client.
 
-**Vulnerabilities and attacks in the Wi-Fi Direct invitation, broadcast, and discovery process**: Wi-Fi Direct / Miracast attacks may target weaknesses in the group establishment, peer discovery, device broadcast, or invitation processes.
+## How Surface Hub addresses Wi-Fi Direct vulnerabilities
 
-|Wi-Fi Direct Vulnerability |	Surface Hub Mitigation |
+**Vulnerabilities and attacks in the Wi-Fi Direct invitation, broadcast, and discovery process:** Wi-Fi Direct/Miracast attacks may target weaknesses in the group establishment, peer discovery, device broadcast, or invitation processes.
+
+|Wi-Fi Direct vulnerability | Surface Hub mitigation |
 | --- | --- |
-| The discovery process may remain active for an extended period of time, which could allow Invitations and connections to be established without the intent of the device owner.	| Surface Hub only operates as the Group Owner (GO), which does not perform the client Discovery or GO negotiation process. Broadcast can be turned off by fully disabling wireless projection. |
-| Invitation and discovery using PBC allows an unauthenticated attacker to perform repeated connection attempts or unauthenticated connections are automatically accepted.	| By requiring WPS PIN security, Administrators can reduce the potential for such unauthorized connections or "Invitation bombs" (where invitations are repeatedly sent until a user mistakenly accepts one). |
+| The discovery process may remain active for an extended period of time, which could allow invitations and connections to be established without the approval of the device owner. | Surface Hub only operates as the group owner, which doesn't perform the client discovery or GO negotiation processes. You can fully disable wireless projection to turn off broadcast. |
+| Invitation and discovery through PBC allows an unauthenticated attacker to perform repeated connection attempts, or unauthenticated connections are automatically accepted. | By requiring WPS PIN security, administrators can reduce the potential for such unauthorized connections or "invitation bombs," in which invitations are repeatedly sent until a user mistakenly accepts one. |
 
-**Wi-Fi Protected Setup (WPS) Push Button Connect (PBC) vs PIN Entry**: Public weaknesses have been demonstrated in WPS-PIN method design and implementation, other vulnerabilities exist within WPS-PBC involving active attacks against a protocol designed for one time use. 
+**Wi-Fi Protected Setup (WPS) push button connect (PBC) vs PIN entry:** Public weaknesses have been demonstrated in WPS-PIN method design and implementation. WPS-PBC has other vulnerabilities that could allow active attacks against a protocol that's designed for one-time use.
 
-| Wi-Fi Direct Vulnerability |	Surface Hub Mitigation |
+| Wi-Fi Direct vulnerability | Surface Hub mitigation |
 | --- | --- |
-| WPS-PBC is vulnerable to active attackers. As stated within the WPS specification: "The PBC method has zero bits of entropy and only protects against passive eavesdropping attacks. PBC protects against eavesdropping attacks and takes measures to prevent a device from joining a network that was not selected by the device owner. The absence of authentication, however, means that PBC does not protect against active attack". Attackers can use selective wireless jamming or other potential denial-of-service vulnerabilities in order to trigger an unintended Wi-Fi Direct GO or connection. Additionally, an active attacker, with only physical proximity, can repeatedly teardown any Wi-Fi Direct group and attempt the described attack until it is successful. |Enable WPS-PIN security within Surface Hub’s configuration. As discussed within the Wi-Fi WPS specification: "The PBC method should only be used if no PIN-capable Registrar is available and the WLAN user is willing to accept the risks associated with PBC". |
-| WPS-PIN implementations can be brute-forced using a Vulnerability within the WPS standard. Due to the design of split PIN verification, a number of implementation vulnerabilities occurred in the past several years across a wide range of Wi-Fi hardware manufacturers. In 2011 two researchers (Stefan Viehböck and Craig Heffner) released information on this vulnerability and tools such as "Reaver" as a proof of concept. |	The Microsoft implementation of WPS within Surface Hub changes the pin every 30 seconds. In order to crack the pin, an attacker must work through the entire exploit in less than 30 seconds. Given the current state of tools and research in this area, a brute-force pin-cracking attack through WPS is unlikely. |
-| WPS-PIN can be cracked using an offline attack due to weak initial key (E-S1,E S2) entropy. In 2014, Dominique Bongard discussed a "Pixie Dust" attack where poor initial randomness for the pseudo random number generator (PRNG) within the wireless device lead to the ability to perform an offline brute-force attack. | The Microsoft implementation of WPS within Surface Hub is not susceptible to this offline PIN brute-force attack. The WPS-PIN is randomized for each connection. |
+| WPS-PBC is vulnerable to active attackers. The WPS specification states: "The PBC method has zero bits of entropy and only protects against passive eavesdropping attacks. PBC protects against eavesdropping attacks and takes measures to prevent a device from joining a network that was not selected by the device owner. The absence of authentication, however, means that PBC does not protect against active attack." Attackers can use selective wireless jamming or other denial-of-service techniques to trigger an unintended Wi-Fi Direct GO or connection. Also, an active attacker who merely has physical proximity can repeatedly tear down any Wi-Fi Direct group and attempt the attack until it succeeds. | Enable WPS-PIN security in Surface Hub configuration. The Wi-Fi WPS specification states: "The PBC method should only be used if no PIN-capable registrar is available and the WLAN user is willing to accept the risks associated with PBC." |
+| WPS-PIN implementations can be subject to brute-force attacks that target a vulnerability in the WPS standard. The design of split PIN verification led to multiple implementation vulnerabilities over the past several years across a range of Wi-Fi hardware manufacturers. In 2011, researchers Stefan Viehböck and Craig Heffner released information about this vulnerability and tools such as "Reaver" as a proof of concept. |   The Microsoft implementation of WPS in Surface Hub changes the PIN every 30 seconds. To crack the PIN, an attacker must complete the entire exploit in less than 30 seconds. Given the current state of tools and research in this area, a brute-force PIN-cracking attack through WPS is unlikely to succeed. |
+| WPS-PIN can be cracked by an offline attack because of weak initial key (E-S1,E S2) entropy. In 2014, Dominique Bongard described a "Pixie Dust" attack where poor initial randomness for the pseudo random number generator (PRNG) in the wireless device allowed an offline brute-force attack. | The Microsoft implementation of WPS in Surface Hub is not susceptible to this offline PIN brute-force attack. The WPS-PIN is randomized for each connection. |
 
-**Unintended exposure of network services**: Network daemons intended for Ethernet or WLAN services may be accidentally exposed due to misconfiguration (such as binding to “all”/0.0.0.0 interfaces), a poorly configured device firewall, or missing firewall rules altogether.
+**Unintended exposure of network services:** Network daemons that are intended for Ethernet or WLAN services may be accidentally exposed because of misconfiguration (such as binding to "all"/0.0.0.0 interfaces). Other possible causes include a poorly configured device firewall or missing firewall rules.
 
-| Wi-Fi Direct Vulnerability |	Surface Hub Mitigation |
+| Wi-Fi Direct vulnerability | Surface Hub mitigation |
 | --- | --- |
-| Misconfiguration binds a vulnerable or unauthenticated network service to "all" interfaces, which includes the Wi-Fi Direct interface. This potentially exposes services not intended to be accessible to Wi-Fi Direct clients, which may be weakly or automatically authenticated. | Within Surface Hub, the default firewall rules only permit the required TCP and UDP network ports and by default deny all inbound connections. Strong authentication can be configured by enabling the WPS-PIN mode. |
+| Misconfiguration binds a vulnerable or unauthenticated network service to "all" interfaces, which includes the Wi-Fi Direct interface. This can expose services that shouldn't be accessible to Wi-Fi Direct clients, which may be weakly or automatically authenticated. | In Surface Hub, the default firewall rules only permit the required TCP and UDP network ports and by default deny all inbound connections. Configure strong authentication by enabling the WPS-PIN mode.|
 
-**Bridging Wi-Fi Direct and other wired or wireless networks**: While network bridging between WLAN or Ethernet networks is a violation of the Wi-Fi Direct specification, such a bridge or misconfiguration may effectively lower or remove wireless access controls for the internal corporate network.
+**Bridging Wi-Fi Direct and other wired or wireless networks:** Network bridging between WLAN or Ethernet networks is a violation of the Wi-Fi Direct specification. Such a bridge or misconfiguration may effectively lower or remove wireless access controls for the internal corporate network.
 
-| Wi-Fi Direct Vulnerability |	Surface Hub Mitigation |
+| Wi-Fi Direct vulnerability | Surface Hub mitigation |
 | --- | --- |
-| Wi-Fi Direct devices could allow unauthenticated or poorly authenticated access to bridged network connections. This may allow Wi-Fi Direct networks to route traffic to internal Ethernet LAN or other infrastructure or enterprise WLAN networks in violation of existing IT security protocols. |	Surface Hub cannot be configured to bridge Wireless interfaces or allow routing between disparate networks. The default firewall rules add defense in depth to any such routing or bridge connections. |
+| Wi-Fi Direct devices could allow unauthenticated or poorly authenticated access to bridged network connections. This might allow Wi-Fi Direct networks to route traffic to internal Ethernet LAN or other infrastructure or to enterprise WLAN networks in violation of existing IT security protocols. | Surface Hub can't be configured to bridge wireless interfaces or allow routing between disparate networks. The default firewall rules add defense in depth to any such routing or bridge connections. |
 
-**The use of Wi-Fi Direct “legacy” mode**: Exposure to unintended networks or devices when operating in “legacy” mode may present a risk. Device spoofing or unintended connections could occur if WPS-PIN is not enabled.
+**The use of Wi-Fi Direct "legacy" mode:** Exposure to unintended networks or devices may occur when you operate in "legacy" mode. Device spoofing or unintended connections could occur if WPS-PIN is not enabled.
 
-
-| Wi-Fi Direct Vulnerability |	Surface Hub Mitigation |
+| Wi-Fi Direct vulnerability | Surface Hub mitigation |
 | --- | --- |
-| By supporting both Wi-Fi Direct and 802.11 infrastructure clients, the system is operating in a "legacy" support mode. This may expose the connection setup phase indefinitely, allowing for groups to be joined or devices invited to connect well after their intended setup phase terminates. |	Surface Hub does not support Wi-Fi Direct legacy clients. Only Wi-Fi Direct connections can be made to Surface Hub even when WPS-PIN mode is enabled. |
+| By supporting both Wi-Fi Direct and 802.11 infrastructure clients, the system is operating in a "legacy" support mode. This may expose the connection-setup phase indefinitely, allowing groups to be joined or devices invited to connect well after their intended setup phase terminates. |    Surface Hub doesn't support Wi-Fi Direct legacy clients. Only Wi-Fi Direct connections can be made to Surface Hub even when WPS-PIN mode is enabled. |
 
-**Wi-Fi Direct GO negotiation during connection setup**: The Group Owner within Wi-Fi Direct is analogous to the “Access Point” in a traditional 802.11 wireless network. The negotiation can be gamed by a malicious device. 
+**Wi-Fi Direct GO negotiation during connection setup:** The group owner in Wi-Fi Direct is analogous to the "access point" in a conventional 802.11 wireless network. The negotiation can be gamed by a malicious device.
 
-|Wi-Fi Direct Vulnerability |	Surface Hub Mitigation |
+|Wi-Fi Direct vulnerability |   Surface Hub mitigation |
 | --- | --- |
-| If groups are dynamically established or if the Wi-Fi Direct device can be made to join new groups, the Group Owner (GO) negotiation can be won by a malicious device that always specifies the max Group Owner "intent" value of 15. (Unless such device is configured to always be a Group Owner, in which case the connection fails.)	| Surface Hub takes advantage of Wi-Fi Direct "Autonomous mode", which skips the GO negotiation phase of the connection setup. Surface Hub is always the Group Owner. |
+| If groups are dynamically established or the Wi-Fi Direct device can be made to join new groups, the group owner negotiation can be won by a malicious device that always specifies the maximum group owner "intent" value of 15. (But the connection fails if the device is configured to always be a group owner.)  | Surface Hub takes advantage of Wi-Fi Direct "Autonomous mode," which skips the GO negotiation phase of connection setup. And Surface Hub is always the group owner. |
 
-**Unintended or malicious Wi-Fi deauthentication**: Wi-Fi deauthentication is an age-old attack that can be used by a physically local attacker to expedite information leaks against the connection setup process, trigger new four-way handshakes, target Wi-Fi Direct WPS-PBC for active attack, or create denial-of-service attacks.
+**Unintended or malicious Wi-Fi deauthentication:** Wi-Fi deauthentication is an old attack in which a local attacker can expedite information leaks in the connection-setup process, trigger new four-way handshakes, target Wi-Fi Direct WPS-PBC for active attacks, or create denial-of-service attacks.
 
-| Wi-Fi Direct Vulnerability |	Surface Hub Mitigation |
+| Wi-Fi Direct vulnerability | Surface Hub mitigation |
 | --- | --- |
-| Deauthentication packets can be sent by an unauthenticated attacker to cause the station to re-authenticate and sniff the resulting handshake. Cryptographic or brute-force attacks can be attempted on the resulting handshake. Mitigations for these attack include:  enforcing length and complexity policies for pre-shared keys; configuring the Access Point (if applicable) to detect malicious levels of deauthentication packets; and using WPS to automatically generate strong keys. In PBC mode the user is interacting with a physical or virtual button to allow arbitrary device association. This process should happen only at setup within a small window, once the button is automatically "pushed", the device will accept any station associating via a canonical PIN value (all zeros). Deauthentication can force a repeated setup process. |	The current Surface Hub design uses WPS in PIN or PBC mode. No PSK configuration is permitted, helping enforce the generation of strong keys. It is recommended to enable WPS-PIN. |
-| Beyond denial-of-service attacks, deauthentication packets can also be used to trigger a reconnect which re-opens the window of opportunity for active attacks against WPS-PBC. |	Enable WPS-PIN security within Surface Hub’s configuration. |
+| Deauthentication packets can be sent by an unauthenticated attacker to cause the station to re-authenticate then to sniff the resulting handshake. Cryptographic or brute-force attacks can be attempted on the resulting handshake. Mitigation for these attack includes enforcing length and complexity policies for pre-shared keys, configuring the access point (if applicable) to detect malicious levels of deauthentication packets, and using WPS to automatically generate strong keys. In PBC mode, the user interacts with a physical or virtual button to allow arbitrary device association. This process should happen only at setup, within a short window. After the button is automatically "pushed," the device will accept any station that associates via a canonical PIN value (all zeros). Deauthentication can force a repeated setup process. |   Surface Hub uses WPS in PIN or PBC mode. No PSK configuration is permitted. This method helps enforce generation of strong keys. It's best to enable WPS-PIN security for Surface Hub. |
+| In addition to denial-of-service attacks, deauthentication packets can be used to trigger a reconnect that re-opens the window of opportunity for active attacks against WPS-PBC. |   Enable WPS-PIN security in the Surface Hub configuration. |
 
-**Basic wireless information disclosure**: Wireless networks, 802.11 or otherwise, are inherently sources of information disclosure. Although the information is largely connection or device metadata, it remains an accepted risk for any 802.11 administrator. Wi-Fi Direct with device authentication via WPS-PIN effectively reveals the same information as a PSK or Enterprise 802.11 network.
+**Basic wireless information disclosure:** Wireless networks, 802.11 or otherwise, are inherently at risk of information disclosure. Although this information is mostly connection or device metadata, this problem remains a known risk for any 802.11 network administrator. Wi-Fi Direct with device authentication via WPS-PIN effectively reveals the same information as a PSK or Enterprise 802.11 network.
 
-| Wi-Fi Direct Vulnerability |	Surface Hub Mitigation |
+| Wi-Fi Direct vulnerability | Surface Hub mitigation |
 | --- | --- |
-| During broadcast, connection setup, or even with already encrypted connections, basic information about the devices and packet sizes is wirelessly transmitted. At a basic level, a local attacker within wireless range can determine the names of wireless devices, the MAC addresses of communicating equipment, and possibly other details such as the version of the wireless stack, packet sizes, or the configured Access Point or Group Owner options by examining the relevant 802.11 Information Elements.	| The Wi-Fi Direct network employed by Surface Hub cannot be further protected from metadata leaks, in the same way 802.11 Enterprise or PSK wireless networks also leak such metadata. Physical security and removing potential threats from the wireless proximity can be used to reduce any potential information leaks. |
+| During broadcast, connection setup, or even normal operation of already-encrypted connections, basic information about devices and packet sizes is wirelessly transmitted. At a basic level, a local attacker who's within wireless range can examine the relevant 802.11 information elements to determine the names of wireless devices, the MAC addresses of communicating equipment, and possibly other details, such as the version of the wireless stack, packet sizes, or the configured access point or group owner options.  | The Wi-Fi Direct network that Surface Hub uses can't be further protected from metadata leaks, just like for 802.11 Enterprise or PSK wireless networks. Physical security and removal of potential threats from wireless proximity can help reduce potential information leaks. |
 
-**Wireless evil twin or spoofing attacks**:  Spoofing the wireless name is a trivial and known exploit for a physically local attacker in order to lure unsuspecting or mistaken users to connect.
+**Wireless evil twin or spoofing attacks:**  Spoofing the wireless name is a simple, well-known exploit a local attacker can use to lure unsuspecting or mistaken users to connect.
 
-| Wi-Fi Direct Vulnerability |	Surface Hub Mitigation |
+| Wi-Fi Direct vulnerability | Surface Hub mitigation |
 | --- | --- |
-| By spoofing or cloning the wireless name or "SSID" of the target network, an attacker may trick the user into connecting to fake malicious network. By supporting unauthenticated, auto-join Miracast an attacker could capture the intended display materials or attempt to perform network attacks on the connecting device. |	While no specific protections against joining a spoofed Surface Hub are in place, this attack is partially mitigated in two ways. First, any potential attack must be physically within Wi-Fi range. Second, this attack is only possible during the very first connection. Subsequent connections use a persistent Wi-Fi Direct group and Windows will remember and prioritize this prior connection during future Hub use. (Note: Spoofing the MAC address, Wi-Fi channel and SSID simultaneously was not considered for this report and may result in inconsistent Wi-Fi behavior.) Overall this weakness is a fundamental problem for any 802.11 wireless network not using Enterprise WPA2 protocols such as EAP-TLS or EAP-PWD, which are not supported in Wi-Fi Direct. |
+| By spoofing or cloning the wireless name or "SSID" of the target network, an attacker may trick the user into connecting to a fake, malicious network. By supporting unauthenticated, auto-join Miracast, an attacker could capture the intended display materials or launch network attacks on the connecting device. | While there are no specific protections against joining a spoofed Surface Hub, this vulnerability is partially mitigated in two ways. First, any potential attack must be physically within Wi-Fi range. Second, this attack is only possible during the first connection. Subsequent connections use a persistent Wi-Fi Direct group, and Windows will remember and prioritize this prior connection during future Hub use. (Note: Spoofing the MAC address, Wi-Fi channel, and SSID simultaneously was not considered for this report and may result in inconsistent Wi-Fi behavior.) Overall, this weakness is a fundamental problem for any 802.11 wireless network that lacks Enterprise WPA2 protocols such as EAP-TLS or EAP-PWD, which Wi-Fi Direct doesn't support. |
 
 ## Surface Hub hardening guidelines
 
-Surface Hub is designed to facilitate collaboration and allow users to start or join meetings quickly and efficiently. As such, the default Wi-Fi Direct settings for Surface Hub are optimized for this scenario.
+Surface Hub is designed to facilitate collaboration and allow users to start or join meetings quickly and efficiently. The default Wi-Fi Direct settings for Surface Hub are optimized for this scenario.
 
-For users who require additional security around the wireless interface, we recommend Surface Hub users enable the WPS-PIN security setting. This disables WPS-PBC mode and offers client authentication, and provides the strongest level of protection by preventing any unauthorized connections to Surface Hub.
+For additional wireless interface security, Surface Hub users should enable the WPS-PIN security setting. This setting disables WPS-PBC mode and offers client authentication. It provides the strongest level of protection by preventing unauthorized connection to Surface Hub.
 
-If concerns remain around authentication and authorization of a Surface Hub, we recommend users connect the device to a separate network, either Wi-Fi (such as a "guest" Wi-Fi network) or using separate Ethernet network (preferably an entirely different physical network, but a VLAN can also provide some added security). Of course, this approach may preclude connections to internal network resources or services, and may require additional network configurations to regain access.
+If you still have concerns about authentication and authorization for Surface Hub, we recommend that you connect the device to a separate network. You could use Wi-Fi (such as a "guest" Wi-Fi network) or a separate Ethernet network, preferably an entirely different physical network. But a VLAN can also provide added security. Of course, this approach may preclude connections to internal network resources or services and may require additional network configuration to regain access.
 
-Also recommended: 
-- [Install regular system updates.](manage-windows-updates-for-surface-hub.md) 
-- Update the Miracast settings to disable auto-present mode.
+Also recommended:
+- [Install regular system updates](manage-windows-updates-for-surface-hub.md) 
+- Update the Miracast settings to disable auto-present mode
 
 ## Learn more
 
@@ -116,7 +120,3 @@ Also recommended:
 
 
 
-
-
-
-
diff --git a/devices/surface-hub/surface-hub.yml b/devices/surface-hub/surface-hub.yml
index 0a9e948ca5..dac70e8f37 100644
--- a/devices/surface-hub/surface-hub.yml
+++ b/devices/surface-hub/surface-hub.yml
@@ -34,7 +34,7 @@ sections:
   - type: markdown
     text: "
       Prepare to deploy Surface Hub in your organization. Explore site readiness, assembly, configuration, and Exchange and ActiveSync policies. 
             
-      
+      

            **Get ready for Surface Hub**
            Explore the steps you'll need to take to set up Surface Hub.
            Surface Hub Site Readiness Guide (PDF, 1.48 MB)
            Unpacking guides
            **Assembly for Surface Hub**
            Learn how to assemble your Surface Hub.
            Surface Hub Setup Guide (PDF, 1.43 MB)
            Mounting and assembling guides
            **Prepare your environment**
            Learn about setup dependencies and account requirements.
            Prepare your environment
            Create and test a device account

            **Get ready for Surface Hub**
            Explore the steps you'll need to take to set up Surface Hub.
            Surface Hub Site Readiness Guide (PDF, 1.48 MB)
            Unpacking guides
            **Assembly for Surface Hub**
            Learn how to assemble your Surface Hub.
            Surface Hub Setup Guide (PDF, 1.43 MB)
            Mounting and assembling guides
            **Prepare your environment**
            Learn about setup dependencies and account requirements.
            Prepare your environment
            Create and test a device account
            
       
            
       "
 - title: Deploy
diff --git a/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md b/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md
new file mode 100644
index 0000000000..7a30ff1e37
--- /dev/null
+++ b/devices/surface-hub/surfacehub-miracast-not-supported-europe-japan-israel.md
@@ -0,0 +1,23 @@
+---
+title: Surface Hub Miracast channels 149-165 not supported in Europe, Japan, Israel
+description: Surface Hub Miracast channels 149-165 not supported in Europe, Japan, Israel
+ms.assetid: 8af3a832-0537-403b-823b-12eaa7a1af1f
+keywords:
+ms.prod: surface-hub
+ms.sitesec: library
+author: v-miegge
+ms.author: v-miegge
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# Summary
+
+In compliance with regional governmental regulations, all 5-GHz wireless devices in Europe, Japan, and Israel do not support the U-NII-3 band. In Surface Hub, the channels that are associated with U-NII-3 are 149 through 165. This includes Miracast connection on these channels. Therefore, Surface Hubs that are used in Europe, Japan, and Israel can't use channels 149 through 165 for Miracast connection.
+
+## More Information
+
+For more information see the [U-NII](https://en.wikipedia.org/wiki/U-NII) topic on Wikipedia.
+
+> [!NOTE]
+> Microsoft provides third-party contact information to help you find additional information about this topic. This information may change without notice. Microsoft does not guarantee the accuracy of third-party information. 
\ No newline at end of file
diff --git a/devices/surface-hub/surfacehub-whats-new-1703.md b/devices/surface-hub/surfacehub-whats-new-1703.md
index 985b44c3cd..0626c4a0d7 100644
--- a/devices/surface-hub/surfacehub-whats-new-1703.md
+++ b/devices/surface-hub/surfacehub-whats-new-1703.md
@@ -1,12 +1,14 @@
 ---
-title: What's new in Windows 10, version 1703 for Surface Hub 
+title: What's new in Windows 10, version 1703 for Surface Hub
 description: Windows 10, version 1703 (Creators Update) brings new features to Microsoft Surface Hub.
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 01/18/2018
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
diff --git a/devices/surface-hub/troubleshoot-surface-hub.md b/devices/surface-hub/troubleshoot-surface-hub.md
index a6158edff8..af6809a477 100644
--- a/devices/surface-hub/troubleshoot-surface-hub.md
+++ b/devices/surface-hub/troubleshoot-surface-hub.md
@@ -2,11 +2,13 @@
 title: Troubleshoot Microsoft Surface Hub
 description: Troubleshoot common problems, including setup issues, Exchange ActiveSync errors.
 ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A
+ms.reviewer: 
+manager: dansimp
 keywords: Troubleshoot common problems, setup issues, Exchange ActiveSync errors
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 03/16/2018
 ms.localizationpriority: medium
diff --git a/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md b/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md
new file mode 100644
index 0000000000..d03cfe3055
--- /dev/null
+++ b/devices/surface-hub/use-cloud-recovery-for-bitlocker-on-surfacehub.md
@@ -0,0 +1,77 @@
+---
+title: How to use cloud recovery for BitLocker on a Surface Hub
+description: How to use cloud recovery for BitLocker on a Surface Hub
+ms.assetid: c0bde23a-49de-40f3-a675-701e3576d44d
+keywords: Accessibility settings, Settings app, Ease of Access
+ms.prod: surface-hub
+ms.sitesec: library
+author: v-miegge
+ms.author: v-miegge
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# Summary
+
+This article describes how to use the cloud recovery function if you are unexpectedly prompted by BitLocker on a Surface Hub device.
+
+> [!NOTE]
+> You should follow these steps only if a BitLocker recovery key isn't available.
+
+> [!WARNING]
+> * This recovery process deletes the contents of the internal drive. If the process fails, the internal drive will become completely unusable. If this occurs, you will have to log a service request with Microsoft for a resolution.
+> * After the recovery process is complete, the device will be reset to the factory settings and returned to its Out of Box Experience state.
+> * After the recovery, the Surface Hub must be completely reconfigured.
+
+> [!IMPORTANT]
+> This process requires an open Internet connection that does not use a proxy or other authentication method.
+
+## Cloud recovery process
+
+To perform a cloud recovery, follow these steps:
+
+1. Select **Press Esc for more recovery options**.
+
+   ![Screenshot of Escape](images/01-escape.png)
+
+1. Select **Skip this drive**.
+
+   ![Screenshot of Skip this drive](images/02-skip-this-drive.png)
+
+1. Select **Recover from the cloud**.
+
+   ![Screenshot of Recover from the cloud](images/03-recover-from-cloud.png)
+
+1. Select **Yes**.
+
+   ![Screenshot of Yes](images/04-yes.png)
+
+1. Select **Reinstall**.
+
+   ![Screenshot of Reinstall](images/05a-reinstall.png)
+
+   ![Screenshot of Downloading](images/05b-downloading.png)
+
+1. After the cloud recovery process is complete, start the reconfiguration by using the **Out of Box Experience**.
+
+   ![Screenshot of Out of the Box](images/06-out-of-box.png)
+
+## "Something went Wrong" error message
+
+This error is usually caused by network issues that occur during the recovery download. When this issue occurs, don't turn off the Hub because you won't be able to restart it. If you receive this error message, return to the "Recover from the cloud" step, and then restart the recovery process.
+
+1. Select **Cancel**.
+
+   ![Screenshot of Cancel](images/07-cancel.png)
+
+1. Select **Troubleshoot**.
+
+   ![Screenshot of Troubleshoot](images/08-troubleshoot.png)
+
+1. Select **Recover from the cloud**.
+
+   ![Screenshot of Recover from the cloud](images/09-recover-from-cloud2.png)
+
+1. If the **Wired network isn't found** error occurs, select **Cancel**, and then let the Surface Hub rediscover the wired network.
+
+   ![Screenshot of Wired network isn't found](images/10-cancel.png)
\ No newline at end of file
diff --git a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md
index f64a9fbf5d..33233a023b 100644
--- a/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md
+++ b/devices/surface-hub/use-fully-qualified-domain-name-surface-hub.md
@@ -1,11 +1,13 @@
 ---
-title: Use fully qualified doman name with Surface Hub
+title: Use fully qualified domain name with Surface Hub
 description: Troubleshoot common problems, including setup issues, Exchange ActiveSync errors.
 keywords: ["Troubleshoot common problems", "setup issues", "Exchange ActiveSync errors"]
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ms.prod: surface-hub
 ms.sitesec: library
@@ -23,7 +25,7 @@ There are a few scenarios where you need to specify the domain name of your Skyp
 2. Click **Surface Hub**, and then click **Calling & Audio**. 
 3. Under **Skype for Business configuration**, click **Configure domain name**. 
 4. Type the domain name for your Skype for Business server, and then click **Ok**. 
-> [!TIP]
-> You can type multiple domain names, separated by commas. 
             For example: lync.com, outlook.com, lync.glbdns.microsoft.com
+   > [!TIP]
+   > You can type multiple domain names, separated by commas. 
             For example: lync.com, outlook.com, lync.glbdns.microsoft.com
 
     ![Add Skype for Business FQDN to Settings](images/system-settings-add-fqdn.png)
diff --git a/devices/surface-hub/use-room-control-system-with-surface-hub.md b/devices/surface-hub/use-room-control-system-with-surface-hub.md
index 7c5fc0e5d9..cbc437e783 100644
--- a/devices/surface-hub/use-room-control-system-with-surface-hub.md
+++ b/devices/surface-hub/use-room-control-system-with-surface-hub.md
@@ -2,11 +2,13 @@
 title: Using a room control system (Surface Hub)
 description: Room control systems can be used with your Microsoft Surface Hub.
 ms.assetid: DC365002-6B35-45C5-A2B8-3E1EB0CB8B50
+ms.reviewer: 
+manager: dansimp
 keywords: room control system, Surface Hub
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
 ms.localizationpriority: medium
@@ -31,7 +33,7 @@ To connect to a room control system control panel, you don't need to configure a
 | Parity | none |
 | Flow control | none |
 | Line feed | every carriage return |
- 
+ 
 
 ## Wiring diagram
 
@@ -53,7 +55,7 @@ The following command modifiers are available. Commands terminate with a new lin
 | - | Decrease a value |
 | = | Set a discrete value |
 | ? | Queries for a current value |
- 
+ 
 
 ## Power
 
@@ -74,7 +76,7 @@ In Replacement PC mode, the power states are only Ready and Off and only change
 | 0 | S5 | Off |
 | 5 | S0 | Ready |
 
-For a control device, anything other than 5 / Ready should be considered off. Each PowerOn command results in two state changes and reponses. 
+For a control device, anything other than 5 / Ready should be considered off. Each PowerOn command results in two state changes and responses. 
 
 | Command | State change| Response |
 | --- | --- | --- |
@@ -110,7 +112,7 @@ Changes to volume levels can be sent by a room control system, or other system.
 | Volume- |  SMC sends the volume down command.

            PC service notifies SMC of new volume level. |  Volume = 50 |
 
 
- 
+ 
 
 ## Mute for audio
 
@@ -121,7 +123,7 @@ Audio can be muted.
 | AudioMute+ |  SMC sends the audio mute command.

            PC service notifies SMC that audio is muted. |  none |
 
 
- 
+ 
 
 ## Video source
 
@@ -135,7 +137,7 @@ Several display sources can be used.
 | 3 |  VGA |
 
 
- 
+ 
 
 Changes to display source can be sent by a room control system, or other system.
 
@@ -158,7 +160,7 @@ Errors are returned following the format in this table.
 | Error: Command not available when off '<input>'. |  When the Surface Hub is off, commands other than Power return this error. For example, "Volume+" would be invalid and return " Error: Command not available when off 'Volume'". |
 
 
- 
+ 
 
 ## Related topics
 
@@ -167,9 +169,9 @@ Errors are returned following the format in this table.
 
 [Microsoft Surface Hub administrator's guide](surface-hub-administrators-guide.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md b/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md
new file mode 100644
index 0000000000..0e5600c12c
--- /dev/null
+++ b/devices/surface-hub/use-surface-hub-diagnostic-test-device-account.md
@@ -0,0 +1,135 @@
+---
+title: Using the Surface Hub Hardware Diagnostic Tool to test a device account
+description: Using the Surface Hub Hardware Diagnostic Tool to test a device account
+ms.assetid: a87b7d41-d0a7-4acc-bfa6-b9070f99bc9c
+keywords: Accessibility settings, Settings app, Ease of Access
+ms.prod: surface-hub
+ms.sitesec: library
+author: v-miegge
+ms.author: v-miegge
+ms.topic: article
+ms.localizationpriority: medium
+---
+
+# Using the Surface Hub Hardware Diagnostic Tool to test a device account
+
+## Introduction
+
+> [!NOTE]
+> The "Account Settings" section of the Surface Hub Hardware Diagnostic tool doesn’t collect any information. The email and password that are entered as input are used only directly on your environment and not collected or transferred to anyone. The login information persists only until the application is closed or you end the current session on the Surface Hub.
+
+> [!IMPORTANT]
+> * Administrator privileges are not required to run this application.
+> * The results of the diagnostic should be discussed with your local administrator before you open a service call with Microsoft.
+
+### Surface Hub Hardware Diagnostic
+
+By default, the [Surface Hub Hardware Diagnostic](https://www.microsoft.com/store/apps/9nblggh51f2g) application isn’t installed in earlier versions of the Surface Hub system. The application is available for free from the Microsoft Store. Administrator privileges are required to install the application.
+
+   ![Screenshot of Hardware Diagnostic](images/01-diagnostic.png)
+
+## About the Surface Hub Hardware Diagnostic Tool
+
+The Surface Hub Hardware Diagnostic tool is an easy-to-navigate tool that lets the user test many of the hardware components within the Surface Hub device. This tool can also test and verify a Surface Hub device account. This article describes how to use the Account Settings test within the Surface Hub Hardware Diagnostic tool.
+
+> [!NOTE]
+> The device account for the Surface Hub should be created before any testing is done. The Surface Hub Administrator Guide provides instructions and PowerShell scripts to help you create on-premises, online (Office365), or hybrid device accounts. For more information, go to the [Create and test a device account (Surface Hub)](https://docs.microsoft.com/surface-hub/create-and-test-a-device-account-surface-hub) topic in the guide.
+
+### Device account testing process
+
+1. Navigate to **All Apps**, and then locate the Surface Hub Hardware Diagnostic application.
+
+    ![Screenshot of  All Apps](images/02-all-apps.png)
+
+1. When the application starts, the **Welcome** page provides a text window to document the reason why you are testing the Hub. This note can be saved to USB together with the diagnostic results at the conclusion of testing. After you finish entering a note, select the **Continue** button.
+
+    ![Screenshot of  Welcome](images/03-welcome.png)
+
+1. The next screen provides you the option to test all or some of the Surface Hub components. To begin testing the device account, select the **Test Results** icon.
+
+    ![Screenshot of  Test Results](images/04-test-results-1.png)
+
+    ![Screenshot of  Test Results](images/05-test-results-2.png)
+
+1. Select **Account Settings**.  
+
+    ![Screenshot of  Account Settings](images/06-account-settings.png)
+
+    The Account Settings screen is used to test your device account.
+
+    ![Screenshot of  Account Settings Details](images/07-account-settings-details.png)
+
+1. Enter the email address of your device account. The password is optional but is recommended. Select the **Test Account** button when you are ready to continue.
+
+    ![Screenshot of  Test Account](images/08-test-account.png)
+
+1. After testing is finished, review the results for the four areas of testing. Each section can be expanded or collapsed by selecting the Plus or Minus sign next to each topic.
+
+    **Network**
+
+    ![Screenshot of Network](images/09-network.png)
+
+    **Environment**
+
+    ![Screenshot of Environment](images/10-environment.png)
+
+    **Certificates**
+
+    ![Screenshot of Certificates](images/11-certificates.png)
+
+    **Trust Model**
+
+    ![Screenshot of Trust Model](images/12-trust-model.png)
+
+## Appendix
+
+### Field messages and resolution
+
+#### Network
+
+Field |Success |Failure |Comment |Reference
+|------|------|------|------|------|
+Internet Connectivity |Device does have Internet connectivity |Device does not have Internet connectivity |Verifies internet connectivity, including proxy connection |[Configuring a proxy for your Surface Hub](https://blogs.technet.microsoft.com/y0av/2017/12/03/7/)
+HTTP Version |1.1 |1.0 |If HTTP 1.0 found, it will cause issue with WU and Store |
+Direct Internet Connectivity |Device has a Proxy configured Device has no Proxy configured |N/A |Informational. Is your device behind a proxy? |
+Proxy Address | | |If configured, returns proxy address. |
+Proxy Authentication |Proxy does not require Authentication |Proxy requires Proxy Auth |Result may be a false positive if a user already has an open session in Edge and has authenticated through the proxy. |[Configuring a proxy for your Surface Hub](https://blogs.technet.microsoft.com/y0av/2017/12/03/7/)
+Proxy Auth Types | | |If proxy authentication is used, return the Authentication methods advertised by the proxy.  |
+
+#### Environment
+
+Field |Success |Failure |Comment |Reference
+|------|------|------|------|------|
+SIP Domain | | |Informational.  |
+Skype Environment |Skype for Business Online, Skype for Business OnPrem, Skype for Business Hybrid |Informational. |What type of environment was detected. Note: Hybrid can only be detected if the password is entered.
+LyncDiscover FQDN | | |Informational. Displays the LyncDiscover DNS result |
+LyncDiscover URI | | |Informational. Displays the URL used to perform a LyncDiscover on your environment.|
+LyncDiscover |Connection Successful |Connection Failed |Response from LyncDiscover web service. |
+SIP Pool Hostname | | |Informational. Display the SIP pool name discovered from LyncDiscover |
+
+#### Certificates (in-premises hybrid only)
+
+LyncDiscover Certificate
+
+Field |Success |Failure |Comment |Reference
+|------|------|------|------|------|
+LyncDiscover Cert CN | | |Informational. Displays the LD cert Common name |
+LyncDiscover Cert CA | | |Informational. Displays the LD Cert CA |
+LyncDiscover Cert Root CA | | |Informational. Displays the LD Cert Root CA, if available. |
+LD Trust Status |Certificate is Trusted. |Certificate is not trusted, please add the Root CA. |Verify the certificate against the local cert store. Returns positive if the machine trusts the certificate.|[Download and deploy Skype for Business certificates using PowerShell](https://blogs.msdn.microsoft.com/surfacehub/2016/06/07/download-and-deploy-skype-for-business-certificates-using-powershell/)/[Supported items for Surface Hub provisioning packages](https://docs.microsoft.com/surface-hub/provisioning-packages-for-surface-hub#supported-items-for-surface-hub-provisioning-packages)
+
+SIP Pool Certification
+
+Field |Success |Failure |Comment |Reference
+|------|------|------|------|------|
+SIP Pool Cert CN | | |(CONTENTS) |
+SIP Pool Cert CA | | |(CONTENTS) |
+SIP Pool Trust Status |Certificate is Trusted. |Certificate is not trusted, please add the Root CA. |Verify the certificate against the local cert store and return a positive if the devices trusts the certificate. |
+SIP Pool Cert Root CA | | |Information. Display the SIP Pool Cert Root CA, if available. |
+
+#### Trust Model (on-premises hybrid only)
+
+Field |Success |Failure |Comment |Reference
+|------|------|------|------|------|
+Trust Model Status |No Trust Model Issue Detected. |SIP Domain and server domain are different please add the following domains. |Check the LD FQDN/ LD Server Name/ Pool Server name for Trust model issue. |[Surface Hub and the Skype for Business Trusted Domain List](https://blogs.technet.microsoft.com/y0av/2017/10/25/95/)
+Domain Name(s) | | |Return the list of domains that should be added for SFB to connect. |
diff --git a/devices/surface-hub/whiteboard-collaboration.md b/devices/surface-hub/whiteboard-collaboration.md
index 9a68506147..a6e9524cd2 100644
--- a/devices/surface-hub/whiteboard-collaboration.md
+++ b/devices/surface-hub/whiteboard-collaboration.md
@@ -1,69 +1,70 @@
 ---
-title: Set up and use Microsoft Whiteboard  
+title: Set up and use Microsoft Whiteboard
 description: Microsoft Whiteboard’s latest update includes the capability for two Surface Hubs to collaborate in real time on the same board.
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 03/18/2019
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
-# Set up and use Microsoft Whiteboard 
+# Set up and use Microsoft Whiteboard
 
+The Microsoft Whiteboard app includes the capability for Surface Hubs and other devices to collaborate in real time on the same board.
 
+## Prerequisites
 
->[!IMPORTANT]
->A new Microsoft Whiteboard app was released on July 12, 2018. The existing Whiteboard app that comes installed on Surface Hub and is pinned to the Welcome screen has been renamed **Microsoft Whiteboard 2016**. Microsoft Whiteboard 2016 will be automatically upgraded by May 21, 2019, and the collaboration service for the legacy app will stop functioning after June 7, 2019. For more details, see [Enable Microsoft Whiteboard on Surface Hub](https://support.office.com/article/enable-microsoft-whiteboard-on-surface-hub-b5df4539-f735-42ff-b22a-0f5e21be7627?ui=en-US&rs=en-US&ad=US).
+To use whiteboard collaboration complete the following actions:
 
-The Microsoft Whiteboard app includes the capability for two Surface Hubs to collaborate in real time on the same board. 
+- Add  Whiteboard.ms, whiteboard.microsoft.com, and wbd.ms to your list of allowed sites.
+- Open port: **HTTPS: 443** (normally configured when you first run Surface Hub.)
 
-By ensuring that your organization meets the prerequisites, users can then ink, collaborate, and ideate together. 
+## Office 365 requirements
 
-![example of a whiteboard with collaborative inking](images/wb-collab-example.png)
+- Whiteboard collaboration is only supported in the Office 365 commercial environment and requires Office 365 with cloud-based Azure Active Directory (Azure AD).
+- You can only run collaborative sessions among users belonging to the same Office 365 tenant.
+- Office 365 Germany or Office 365 operated by 21Vianet do not support whiteboard collaboration.
 
-## Prerequisites for Whiteboard to Whiteboard collaboration (Microsoft Whiteboard 2016)
-
-To get Whiteboard to Whiteboard collaboration up and running, you’ll need to make sure your organization meets the following requirements:
-
-- Office 365 with cloud-based Azure Active Directory (Azure AD) for all users
-- OneDrive for Business deployed for all users who intend to collaborate
-- Currently not utilizing Office 365 Germany or Office 365 	operated by 21Vianet
-- Surface Hub needs to be updated to Windows 10, version 1607 or newer
-- Port 443 needs to be open since Whiteboard makes standard https requests
-- Whiteboard.ms, wbd.ms, \*.onenote.com, and your company's SharePoint tenant domain URLs need to be whitelisted for proxies
-
- 
->[!NOTE]
->Collaborative sessions can only take place between users within the same tenant, so users outside of your organization won’t be able to join even if they have a Surface Hub.
-
-## Using Whiteboard to Whiteboard collaboration (Microsoft Whiteboard 2016)
+## Collaborating with whiteboards
 
 To start a collaboration session:
 
-1.	In the Whiteboard app, tap the **Sign in** button.
-2.	Sign in with your organization ID.
-3.	Tap the **Invite** button next to your name at the top of the app.
-4.	Tap **Start session**. Whiteboard will generate a link that you can share.
+1. In the Whiteboard app, tap the **Sign in** button.
+2. Sign in with your organization ID.
+3. Tap the **Invite** button next to your name at the top of the app.
+4. Write or type the names of the colleagues you wish to collaborate with.
 
-    ![screenshot of the link dialog box on whiteboard](images/wb-collab-link.png)
-    
-5.	Copy and paste this link into a Skype chat with another Surface Hub
+On the other device, such as a Surface Hub, when you are signed in, the shared board will now appear in the board gallery.
 
-When the other Surface Hub receives the link, the recipient can tap on the link, sign in to Whiteboard, and then begin collaborating. You can copy and paste other content, use smart ink features like Ink to Shape, and co-author together.
-
-After you’re done, you can export a copy of the Whiteboard collaboration for yourself through the Share charm and leave the board for others to continue working. 
-
->[!TIP]
->When you start a collaboration session, Whiteboard creates a folder named **Whiteboard App Data** in your OneDrive for Business to store your shared whiteboards. After some collaboration sessions, this folder may continue to sync or process changes indefinitely. You can fix this by choosing to not sync the **Whiteboard App Data** folder to your device. Disabling sync for this folder won't limit your ability to use Whiteboard for collaboration sessions.
+### User tips
+- Log in to access your whiteboards. As you work, changes are saved automatically.
+- Name your whiteboards to help organize your content and find it quickly. Select the … to open the menu. Select the **Options** gear icon to access more tools and features of the Whiteboard.
+- Use **Ink to shape** to turn drawing into actual shapes like circles, squares, and triangles.
+- Use **Ink to table** to turn a drawn grid into a table with rows and columns.
+- You can also change the background color and design from solid to grid or dots. Pick the background, then choose the color from the wheel around it.
+- You can export a copy of the Whiteboard collaboration for yourself through the Share charm and leave the board for others to continue working.
 
+> [!NOTE]
+>  If you are using Whiteboard and cannot sign in, you can collaborate by joining a Teams or Skype for Business meeting, and then sharing your screen. After you’re done, tap **Settings** > **Export to email** or save a copy of the board. The SVG export provides higher resolution than PNG and can be opened in a web browser.
 
+## New features in Whiteboard
 
+The Microsoft Whiteboard app, updated for Surface Hub on July 1, 2019 includes a host of new features including:
 
+- **Automatic Saving** - Boards are saved to the cloud automatically when you sign in, and can be found in the board gallery. 
+- **Extended collaboration across devices** - You can collaborate using new apps for Windows 10 PC and iOS, and a web version for other devices.
+- **Richer canvas** - In addition to ink and images, Whiteboard now includes sticky notes, text and GIFs, with more objects coming soon.
+- **Intelligence** – In addition to ink to shape and table, Whiteboard now includes ink beautification to improve handwriting and ink grab to convert images to ink.
+- **More color and background options** - Whiteboard now includes more pen colors and thickness options along with additional background colors and designs.
+- **Teams Integration** – You can automatically launch Whiteboard from a Teams meeting and share with participants (currently in preview).
 
 
 ## Related topics
 
 - [Windows 10 Creators Update for Surface Hub](https://www.microsoft.com/surface/support/surface-hub/windows-10-creators-update-surface-hub)
-- [Support documentation for Microsoft Whiteboard](https://support.office.com/en-us/article/Whiteboard-Help-0c0f2aa0-b1bb-491c-b814-fd22de4d7c01)
\ No newline at end of file
+
+- [Support documentation for Microsoft Whiteboard](https://support.office.com/article/Whiteboard-Help-0c0f2aa0-b1bb-491c-b814-fd22de4d7c01)
diff --git a/devices/surface-hub/wireless-network-management-for-surface-hub.md b/devices/surface-hub/wireless-network-management-for-surface-hub.md
index 516ddeab67..0a314fe596 100644
--- a/devices/surface-hub/wireless-network-management-for-surface-hub.md
+++ b/devices/surface-hub/wireless-network-management-for-surface-hub.md
@@ -2,11 +2,13 @@
 title: Wireless network management (Surface Hub)
 description: Microsoft Surface Hub offers two options for network connectivity to your corporate network and Internet wireless, and wired. While both provide network access, we recommend you use a wired connection.
 ms.assetid: D2CFB90B-FBAA-4532-B658-9AA33CAEA31D
+ms.reviewer: 
+manager: dansimp
 keywords: network connectivity, wired connection
 ms.prod: surface-hub
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
 ms.localizationpriority: medium
diff --git a/devices/surface/TOC.md b/devices/surface/TOC.md
index c83a77a2bd..53918a7ad5 100644
--- a/devices/surface/TOC.md
+++ b/devices/surface/TOC.md
@@ -1,39 +1,69 @@
 # [Surface](index.md)
-## [Deploy Surface devices](deploy.md)
-### [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md)
+
+## [Get started](get-started.md)
+
+## Overview
+
+### [Surface Pro 7 for Business](https://www.microsoft.com/surface/business/surface-pro-7)
+### [Surface Pro X for Business](https://www.microsoft.com/surface/business/surface-pro-x)
+### [Surface Laptop 3 for Business](https://www.microsoft.com/surface/business/surface-laptop-3)
+### [Surface Book 2 for Business](https://www.microsoft.com/surface/business/surface-book-2)
+### [Surface Studio 2 for Business](https://www.microsoft.com/surface/business/surface-studio-2)
+### [Surface Go](https://www.microsoft.com/surface/business/surface-go)
+### [Secure, work-anywhere mobility with LTE Advanced](https://www.microsoft.com/surface/business/lte-laptops-and-tablets)
+
+## Plan
+
 ### [Surface device compatibility with Windows 10 Long-Term Servicing Branch](surface-device-compatibility-with-windows-10-ltsc.md)
-#### [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md)
+### [Long-Term Servicing Branch for Surface devices](ltsb-for-surface.md)
+### [Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md)
+### [Considerations for Surface and Endpoint Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md)
+### [Deploy Surface app with Microsoft Store for Business](deploy-surface-app-with-windows-store-for-business.md)
+### [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md)
+### [Ethernet adapters and Surface deployment](ethernet-adapters-and-surface-device-deployment.md)
+
+## Deploy
+
+### [Deploy Surface devices](deploy.md)
+### [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md)
+### [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)
+### [Surface Pro X app compatibility](surface-pro-arm-app-performance.md)
+### [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md)
+### [Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md)
+### [Step by step: Surface Deployment Accelerator](step-by-step-surface-deployment-accelerator.md)
 ### [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md)
+### [Enable the Surface Laptop keyboard during MDT deployment](enable-surface-keyboard-for-windows-pe-deployment.md)
 ### [Upgrade Surface devices to Windows 10 with MDT](upgrade-surface-devices-to-windows-10-with-mdt.md)
 ### [Customize the OOBE for Surface deployments](customize-the-oobe-for-surface-deployments.md)
-### [Ethernet adapters and Surface deployment](ethernet-adapters-and-surface-device-deployment.md)
-### [Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md)
-#### [Step by step: Surface Deployment Accelerator](step-by-step-surface-deployment-accelerator.md)
-#### [Using the Surface Deployment Accelerator deployment share](using-the-sda-deployment-share.md)
-### [Maintain optimal power settings on Surface devices](maintain-optimal-power-settings-on-Surface-devices.md)
+### [Using the Surface Deployment Accelerator deployment share](using-the-sda-deployment-share.md)
+### [Surface System SKU reference](surface-system-sku-reference.md)
+
+## Manage
+
+### [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md)
+### [Optimize Wi-Fi connectivity for Surface devices](surface-wireless-connect.md)
+### [Best practice power settings for Surface devices](maintain-optimal-power-settings-on-Surface-devices.md)
+### [Surface Dock Firmware Update](surface-dock-firmware-update.md)
 ### [Battery Limit setting](battery-limit.md)
 ### [Surface Brightness Control](microsoft-surface-brightness-control.md)
 ### [Surface Asset Tag](assettag.md)
-## [Surface firmware and driver updates](update.md)
-### [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)
-### [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md)
-### [Surface Dock Updater](surface-dock-updater.md)
-### [Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md)
-## [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md)
-## [Deploy Surface app with Microsoft Store for Business](deploy-surface-app-with-windows-store-for-business.md)
-## [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md)
-## [Manage Surface UEFI settings](manage-surface-uefi-settings.md)
+
+
+## Secure
+### [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md)
+### [Manage Surface UEFI settings](manage-surface-uefi-settings.md)
 ### [Advanced UEFI security features for Surface Pro 3](advanced-uefi-security-features-for-surface-pro-3.md)
-### [Surface System SKU reference](surface-system-sku-reference.md)
-## [Surface Enterprise Management Mode](surface-enterprise-management-mode.md)
+### [Surface Enterprise Management Mode](surface-enterprise-management-mode.md)
 ### [Enroll and configure Surface devices with SEMM](enroll-and-configure-surface-devices-with-semm.md)
 ### [Unenroll Surface devices from SEMM](unenroll-surface-devices-from-semm.md)
-### [Use System Center Configuration Manager to manage devices with SEMM](use-system-center-configuration-manager-to-manage-devices-with-semm.md)
-## [Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md)
-### [Use Surface Diagnostic Toolkit for Business in desktop mode](surface-diagnostic-toolkit-desktop-mode.md)
-### [Run Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md)
-## [Surface Data Eraser](microsoft-surface-data-eraser.md)
-## [Top support solutions for Surface devices](support-solutions-surface.md)
-## [Change history for Surface documentation](change-history-for-surface.md)
+### [Use Microsoft Endpoint Configuration Manager to manage devices with SEMM](use-system-center-configuration-manager-to-manage-devices-with-semm.md)
+### [Surface Data Eraser](microsoft-surface-data-eraser.md)
 
+## Troubleshoot
+### [Top support solutions for Surface devices](support-solutions-surface.md)
+### [Fix common Surface problems using the Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-for-business-intro.md)
+#### [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md)
+#### [Use Surface Diagnostic Toolkit for Business in desktop mode](surface-diagnostic-toolkit-desktop-mode.md)
+#### [Run Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md)
 
+### [Change history for Surface documentation](change-history-for-surface.md)
diff --git a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md b/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md
index d9d67fc9ab..c677b56488 100644
--- a/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md
+++ b/devices/surface/advanced-uefi-security-features-for-surface-pro-3.md
@@ -2,14 +2,16 @@
 title: Advanced UEFI security features for Surface Pro 3 (Surface)
 description: This article describes how to install and configure the v3.11.760.0 UEFI update to enable additional security options for Surface Pro 3 devices.
 ms.assetid: 90F790C0-E5FC-4482-AD71-60589E3C9C93
+ms.reviewer: 
+manager: dansimp
 keywords: security, features, configure, hardware, device, custom, script, update
 ms.localizationpriority: medium
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices, security
 ms.sitesec: library
-author: miladCA
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
 ---
diff --git a/devices/surface/advanced-uefi-security-features-for-surface.md b/devices/surface/advanced-uefi-security-features-for-surface.md
deleted file mode 100644
index 9c6edd4717..0000000000
--- a/devices/surface/advanced-uefi-security-features-for-surface.md
+++ /dev/null
@@ -1,3 +0,0 @@
----
-redirect_url: https://technet.microsoft.com/itpro/surface/advanced-uefi-security-features-for-surface-pro-3
----
\ No newline at end of file
diff --git a/devices/surface/assettag.md b/devices/surface/assettag.md
index 9771aacb0d..db6a63ad69 100644
--- a/devices/surface/assettag.md
+++ b/devices/surface/assettag.md
@@ -3,11 +3,14 @@ title: Surface Asset Tag Tool
 description: This topic explains how to use the Surface Asset Tag Tool.
 ms.prod: w10
 ms.mktglfcycl: manage
+ms.localizationpriority: medium
 ms.sitesec: library
-author: coveminer
-ms.author: v-jokai
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 02/01/2019
+ms.date: 10/21/2019
+ms.reviewer: hachidan
+manager: dansimp
 ---
 
 # Surface Asset Tag Tool
@@ -18,19 +21,22 @@ for Surface devices. It works on Surface Pro 3 and all newer Surface devices.
 
 ## System requirements
 
-  - Surface Pro 3 or later
+- Surface Pro 3 or later
 
-  - UEFI firmware version 3.9.150.0 or later
+- UEFI firmware version 3.9.150.0 or later
 
 ## Using Surface Asset Tag 
 
 To run Surface Asset Tag:
 
-1.  On the Surface device, download **Surface Pro 3 AssetTag.zip** from the [Microsoft Download
-    Center](http://www.microsoft.com/download/details.aspx?id=44076),
+1.  On the Surface device, download **Surface Asset Tag.zip** from the [Microsoft Download
+    Center](https://www.microsoft.com/download/details.aspx?id=46703),
     extract the zip file, and save AssetTag.exe in desired folder (in
     this example, C:\\assets).
 
+    > [!NOTE]
+    > For Surface Pro X, use the application named **AssetTag_x86**  in the ZIP file. 
+
 2.  Open a command console as an Administrator and run AssetTag.exe,
     entering the full path to the tool.
 
diff --git a/devices/surface/battery-limit.md b/devices/surface/battery-limit.md
index b1a34e4f19..c5d75cda00 100644
--- a/devices/surface/battery-limit.md
+++ b/devices/surface/battery-limit.md
@@ -5,21 +5,27 @@ ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: brecords
-ms.date: 10/02/2018
-ms.author: jdecker
+author: dansimp
+ms.date: 10/31/2019
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
+ms.localizationpriority: medium
+ms.audience: itpro
 ---
 
 # Battery Limit setting
 
 Battery Limit option is a UEFI setting that changes how the Surface device battery is charged and may prolong its longevity. This setting is recommended in  cases  in which the device is continuously connected to power, for example when devices are integrated into kiosk solutions.  
 
-## Battery Limit information
+## How Battery Limit works
 
 Setting the device on Battery Limit changes the protocol for charging the device battery. When Battery Limit is enabled, the battery charge will be limited to 50% of its maximum capacity. The charge level reported in Windows will reflect this limit. Therefore, it will show that the battery is charged up to 50% and will not charge beyond  this limit. If you enable Battery Limit while the device is above 50% charge, the Battery icon will show that the device is plugged in but discharging until the device reaches 50% of its maximum charge capacity.  
 
-Adding the Battery Limit option to Surface UEFI requires a [Surface UEFI firmware update](update.md), available through Windows Update or via the MSI driver and firmware packages on the Microsoft Download Center. Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each supported device. Currently, Battery Limit is supported on a subset of Surface devices and will be available in the future on other Surface device models. 
+## Supported devices
+The Battery Limit UEFI setting is built into the latest Surface devices including Surface Pro 7 and Surface Laptop 3. Earlier devices require a
+ [Surface UEFI firmware update](update.md), available through Windows Update or via the MSI driver and firmware packages on the [Surface Support site](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware-for-surface). Check [Enable "Battery Limit" for Surface devices that have to be plugged in for extended periods of time](https://support.microsoft.com/help/4464941) for the specific Surface UEFI version required for each supported device. 
 
 ## Enabling Battery Limit in Surface UEFI (Surface Pro 4 and later)
 
diff --git a/devices/surface/change-history-for-surface.md b/devices/surface/change-history-for-surface.md
index 271b1cc5e2..18fc041b85 100644
--- a/devices/surface/change-history-for-surface.md
+++ b/devices/surface/change-history-for-surface.md
@@ -1,23 +1,72 @@
 ---
 title: Change history for Surface documentation (Windows 10)
+ms.reviewer: 
+manager: dansimp
 description: This topic lists new and updated topics in the Surface documentation library.
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
 ---
 
 # Change history for Surface documentation
 
 This topic lists new and updated topics in the Surface documentation library.
 
+## January 2020
+| **New or changed topic** | **Description** |
+| ------------------------ | --------------- |
+| [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md)| Updated with the latest information and links to related articles.|
+
+
+## October 2019
+
+| **New or changed topic** | **Description** |
+| ------------------------ | --------------- |
+| [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md)| New document explaining how to configure a DFCI environment in Microsoft Intune and manage firmware settings for targeted Surface devices.|
+| [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)| New document highlighting key considerations for deploying, managing, and servicing Surface Pro X.|
+|Multiple topics| Updated with information on Surface Pro 7, Surface Pro X, and Surface Laptop 3.|
+
+## September 2019
+
+| **New or changed topic** | **Description** |
+| ------------------------ | --------------- |
+| [Surface Dock Firmware Update](surface-dock-firmware-update.md)| New document for Microsoft Surface Dock Firmware Update, newly redesigned to update Surface Dock firmware while running in the background on your Surface device.|
+
+## August 2019
+
+| **New or changed topic** | **Description** |
+| ------------------------ | --------------- |
+| [Optimizing wireless connectivity for Surface devices](surface-wireless-connect.md)             | New document highlights key wireless connectivity considerations for Surface devices in mobile scenarios. |
+| [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md)            | Updated to reflect minor changes in the file naming convention for Surface MSI files. |
+
+
+## July 2019
+
+| **New or changed topic** | **Description** |
+| ------------------------ | --------------- |
+| [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md)              | Renamed to reflect focus on deployment guidance for IT professionals. Covers minor changes in Version 2.41.139.0.   |
+
+
+
+## June 2019
+
+| **New or changed topic** | **Description** |
+| ------------------------ | --------------- |
+|[Fix common Surface problems using the Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-for-business-intro.md)             | New introductory page for the Surface Diagnostic Toolkit for Business.  |
+| [Best practice power settings for Surface devices](maintain-optimal-power-settings-on-Surface-devices.md)               |Updated with summary of recommendations for managing power settings and optimizing battery life.   |
+
+
 ## March 2019
 
-New or changed topic | Description
---- | ---
-[Surface System SKU reference](surface-system-sku-reference.md) | New
+| **New or changed topic** | **Description** |
+| ------------------------ | --------------- |
+| [Surface System SKU reference](surface-system-sku-reference.md) | New    |
 
 
 ## February 2019
@@ -33,14 +82,14 @@ New or changed topic | Description
 --- | ---
 [Surface Brightness Control](microsoft-surface-brightness-control.md) | New
 [Maintain optimal power settings on Surface devices](maintain-optimal-power-settings-on-Surface-devices.md) | New
-|[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) | Added Surface Studio 2  |
+|[Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) | Added Surface Studio 2  |
 
 
 ## November 2018
 
 New or changed topic | Description
 --- | ---
-|[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) | Added Surface Pro 6  |
+|[Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) | Added Surface Pro 6  |
 [Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md) | New
 [Use Surface Diagnostic Toolkit for Business in desktop mode](surface-diagnostic-toolkit-desktop-mode.md) | New
 [Run Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md) | New
@@ -50,7 +99,7 @@ New or changed topic | Description
 New or changed topic | Description
 --- | ---
 [Battery Limit setting](battery-limit.md) | New
-|[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) | Added Surface GO  |
+|[Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) | Added Surface GO  |
 
 ## May 2018
 
@@ -63,7 +112,6 @@ New or changed topic | Description
 
 |New or changed topic | Description |
 | --- | --- |
-|[Surface Dock Updater](surface-dock-updater.md) | Added version 2.12.136.0 information  |
 |[Microsoft Surface Data Eraser](microsoft-surface-data-eraser.md) | Added version 3.2.46.0 information  |
 
 ## January 2018
@@ -79,13 +127,7 @@ New or changed topic | Description
 
 |New or changed topic | Description |
 | --- | --- |
-|[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md) | Added Surface Book 2, Surface Laptop, Surface Pro, and Surface Pro with LTE Advanced information  |
-
-## November 2017
-
-|New or changed topic | Description |
-| --- | --- |
-|[Surface Dock Updater](surface-dock-updater.md) | Added version 2.7.136.0 information  |
+|[Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) | Added Surface Book 2, Surface Laptop, Surface Pro, and Surface Pro with LTE Advanced information  |
 
 ## October 2017
 
@@ -105,7 +147,6 @@ New or changed topic | Description
 | --- | --- |
 |[Surface Data Eraser](microsoft-surface-data-eraser.md) | Update compatible devices, added version 3.2.36 information  |
 |[Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md) | Added version 2.0.8.0 information  |
-|[Surface Dock Updater](surface-dock-updater.md) | Added version 2.1.15.0 information  |
 
 
 ## April 2017
@@ -125,14 +166,14 @@ New or changed topic | Description
 
 |New or changed topic | Description |
 | --- | --- |
-|[Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)  | Added driver info for Surface Studio; updated info for Surface Book and Surface Pro 4 (Windows 10 .zip cumulative update), Surface Pro 3 (Windows8.1-KB2969817-x64.msu), and Surface 3 (UEFI Asset Tag management tool)|
+|[Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md) | Added driver info for Surface Studio; updated info for Surface Book and Surface Pro 4 (Windows 10 .zip cumulative update), Surface Pro 3 (Windows8.1-KB2969817-x64.msu), and Surface 3 (UEFI Asset Tag management tool)|
 
 ## November 2016
 
 |New or changed topic | Description |
 | --- | --- |
 |[Surface Enterprise Management Mode](surface-enterprise-management-mode.md) | Added procedure for viewing certificate thumbprint. |
-|[Use System Center Configuration Manager to manage devices with SEMM](use-system-center-configuration-manager-to-manage-devices-with-semm.md) | New |
+|[Use Microsoft Endpoint Configuration Manager to manage devices with SEMM](use-system-center-configuration-manager-to-manage-devices-with-semm.md) | New |
 
 
 
@@ -140,7 +181,7 @@ New or changed topic | Description
 
 | New or changed topic | Description |
 | --- | --- |
-| [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md) | New |
+| [Considerations for Surface and Microsoft Endpoint Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md) | New |
 | [Long-term servicing branch for Surface devices](ltsb-for-surface.md) | New |
 
 
diff --git a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md
index 1160b8cacc..0b9915c4b0 100644
--- a/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md
+++ b/devices/surface/considerations-for-surface-and-system-center-configuration-manager.md
@@ -1,36 +1,38 @@
 ---
-title: Considerations for Surface and System Center Configuration Manager (Surface)
+title: Considerations for Surface and Microsoft Endpoint Configuration Manager
 description: The management and deployment of Surface devices with Configuration Manager is fundamentally the same as any other PC; this article describes scenarios that may require additional considerations.
 keywords: manage, deployment, updates, driver, firmware
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: Scottmca
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 10/16/2017
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 11/25/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
-# Considerations for Surface and System Center Configuration Manager
+# Considerations for Surface and Microsoft Endpoint Configuration Manager
 
-Fundamentally, management and deployment of Surface devices with System Center Configuration Manager is the same as the management and deployment of any other PC. Like any other PC, a deployment to Surface devices includes importing drivers, importing a Windows image, preparing a deployment task sequence, and then deploying the task sequence to a collection. After deployment, Surface devices are like any other Windows client – to publish apps, settings, and policies, you use the same process that you would use for any other device.
+Fundamentally, management and deployment of Surface devices with Microsoft Endpoint Configuration Manager is the same as the management and deployment of any other PC. Like any other PC, a deployment to Surface devices includes importing drivers, importing a Windows image, preparing a deployment task sequence, and then deploying the task sequence to a collection. After deployment, Surface devices are like any other Windows client; to publish apps, settings, and policies, you use the same process as you would use for any other device.
 
-You can find more information about how to use Configuration Manager to deploy and manage devices in the [Documentation for System Center Configuration Manager](https://docs.microsoft.com/sccm/index).
+You can find more information about how to use Configuration Manager to deploy and manage devices in the [Documentation for Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/sccm/index).
 
-Although the deployment and management of Surface devices is fundamentally the same as any other PC, there are some scenarios that may require additional considerations or steps. This article provides descriptions and guidance for these scenarios; the solutions documented in this article may apply to other devices and manufacturers as well.
+Although the deployment and management of Surface devices is fundamentally the same as any other PC, there are some scenarios that may require additional considerations or steps. This article provides descriptions and guidance for these scenarios. The solutions documented in this article may apply to other devices and manufacturers as well.
 
->[!NOTE]
->For management of Surface devices it is recommended that you use the Current Branch of System Center Configuration Manager.
+> [!NOTE]
+> For management of Surface devices it is recommended that you use the Current Branch of Microsoft Endpoint Configuration Manager.
 
 ## Updating Surface device drivers and firmware
 
-For devices that receive updates through Windows Update, drivers for Surface components – and even firmware updates – are applied automatically as part of the Windows Update process. For devices with managed updates, such as those updated through Windows Server Update Services (WSUS), the option to install drivers and firmware through Windows Update is not available. For these managed devices, the recommended driver management process is the deployment of driver and firmware updates using the Windows Installer (.msi) files, which are provided through the Microsoft Download Center. You can find a list of these downloads at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices).
+For devices that recieve updates through Windows Update, drivers for Surface components (and even firmware updates) are applied automatically as part of the Windows Update process. For devices with managed updates, such as those updated through Windows Server Update Services (WSUS) or Configuration Manager, see [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-driver-and-firmware-updates/).
 
-As .msi files, deployment of driver and firmware updates is performed in the same manner as deployment of an application. Instead of installing an application as would normally happen when an .msi file is run, the Surface driver and firmware .msi will apply the driver and firmware updates to the device. The single .msi file contains the driver and firmware updates required by each component of the Surface device. The updates for firmware are applied the next time the device reboots. You can read more about the .msi installation method for Surface drivers and firmware in [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates). For more information about how to deploy applications with Configuration Manager, see [Packages and programs in System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/packages-and-programs).
-
->[!NOTE]
->Surface device drivers and firmware are signed with SHA-256, which is not natively supported by Windows Server 2008 R2. A workaround is available for Configuration Manager environments running on Windows Server 2008 R2 – for more information see [Can't import drivers into System Center Configuration Manager (KB3025419)](https://support.microsoft.com/kb/3025419).
+> [!NOTE]
+> Surface device drivers and firmware are signed with SHA-256, which is not natively supported by Windows Server 2008 R2. A workaround is available for Configuration Manager environments running on Windows Server 2008 R2. For more information, see [Can't import drivers into Microsoft Endpoint Configuration Manager (KB3025419)](https://support.microsoft.com/kb/3025419).
 
 ## Surface Ethernet adapters and Configuration Manager deployment
 
@@ -38,9 +40,9 @@ The default mechanism that Configuration Manager uses to identify devices during
 
 To ensure that Surface devices using the same Ethernet adapter are identified as unique devices during deployment, you can instruct Configuration Manager to identify devices using another method. This other method could be the MAC address of the wireless network adapter or the System Universal Unique Identifier (System UUID). You can specify that Configuration Manager use other identification methods with the following options:
 
-* Add an exclusion for the MAC addresses of Surface Ethernet adapters, which forces Configuration Manager to overlook the MAC address in preference of the System UUID, as documented in the [Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manager OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post.
+* Add an exclusion for the MAC addresses of Surface Ethernet adapters, which forces Configuration Manager to overlook the MAC address in preference of the System UUID, as documented in the [Reusing the same NIC for multiple PXE initiated deployments in SMicrosoft Endpoint Configuration Manager OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post.
 
-* Prestage devices by System UUID as documented in the [Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manager OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post.
+* Prestage devices by System UUID as documented in the [Reusing the same NIC for multiple PXE initiated deployments in Microsoft Endpoint Configuration Manager OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd/) blog post.
 
 * Use a script to identify a newly deployed Surface device by the MAC address of its wireless adapter, as documented in the [How to Use The Same External Ethernet Adapter For Multiple SCCM OSD](https://blogs.technet.microsoft.com/askpfeplat/2014/07/27/how-to-use-the-same-external-ethernet-adapter-for-multiple-sccm-osd/) blog post.
 
@@ -56,15 +58,15 @@ With the release of Microsoft Store for Business, Surface app is no longer avail
 
 If your organization uses prestaged media to pre-load deployment resources on to machines prior to deployment with Configuration Manager, the nature of Surface devices as UEFI devices may require you to take additional steps. Specifically, a native UEFI environment requires that you create multiple partitions on the boot disk of the system. If you are following along with the [documentation for prestaged media](https://technet.microsoft.com/library/79465d90-4831-4872-96c2-2062d80f5583?f=255&MSPPError=-2147217396#BKMK_CreatePrestagedMedia), the instructions provide for only single partition boot disks and therefore will fail when applied to Surface devices.
 
-Instructions for applying prestaged media to UEFI devices, such as Surface devices, can be found in the [How to apply Task Sequence Prestaged Media on multi-partitioned disks for BIOS or UEFI PCs in System Center Configuration Manager](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2014/04/02/how-to-apply-task-sequence-prestaged-media-on-multi-partitioned-disks-for-bios-or-uefi-pcs-in-system-center-configuration-manager/) blog post.
+Instructions for applying prestaged media to UEFI devices, such as Surface devices, can be found in the [How to apply Task Sequence Prestaged Media on multi-partitioned disks for BIOS or UEFI PCs in Microsoft Endpoint Configuration Manager](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2014/04/02/how-to-apply-task-sequence-prestaged-media-on-multi-partitioned-disks-for-bios-or-uefi-pcs-in-system-center-configuration-manager/) blog post.
 
 ## Licensing conflicts with OEM Activation 3.0
 
 Surface devices come preinstalled with a licensed copy of Windows. For example, Surface Pro 4 is preinstalled with Windows 10 Professional. The license key for this preinstalled copy of Windows is embedded in the firmware of the device with OEM Activation 3.0 (OA 3.0). When you run Windows installation media on a device with an OA 3.0 key, Windows setup automatically reads the license key and uses it to install and activate Windows. In most situations, this simplifies the reinstallation of Windows, because the user does not have to find or enter a license key.
 
-When you reimage a device by using Windows Enterprise, this embedded license key does not cause a conflict. This is because the installation media for Windows Enterprise is configured to install only an Enterprise edition of Windows and therefore is incompatible with the license key embedded in the system firmware. If a product key is not specified (such as when you intend to activate with Key Management Services (KMS) or Active Directory Based Activation), a Generic Volume License Key (GVLK) is used until Windows is activated by one of those technologies.
+When you reimage a device by using Windows Enterprise, this embedded license key does not cause a conflict. This is because the installation media for Windows Enterprise is configured to install only an Enterprise edition of Windows and therefore is incompatible with the license key embedded in the system firmware. If a product key is not specified (such as when you intend to activate with Key Management Services [KMS] or Active Directory Based Activation), a Generic Volume License Key (GVLK) is used until Windows is activated by one of those technologies.
 
-However, issues may arise when organizations intend to use versions of Windows that are compatible with the firmware embedded key. For example, an organization that wants to install Windows 10 Professional on a Surface 3 device that originally shipped with Windows 10 Home edition may encounter difficulty when Windows setup automatically reads the Home edition key during installation and installs as Home edition rather than Professional. To avoid this conflict, you can use the Ei.cfg or Pid.txt file (see [Windows Setup Edition Configuration and Product ID Files](https://technet.microsoft.com/library/hh824952.aspx)) to explicitly instruct Windows setup to prompt for a product key, or you can enter a specific product key in the deployment task sequence. If you do not have a specific key, you can use the default product keys for Windows, which you can find in [Customize and deploy a Windows 10 operating system](https://dpcenter.microsoft.com/en/Windows/Build/cp-Windows-10-build) on the Device Partner Center.
+However, issues may arise when organizations intend to use versions of Windows that are compatible with the firmware embedded key. For example, an organization that wants to install Windows 10 Professional on a Surface 3 device that originally shipped with Windows 10 Home edition may encounter difficulty when Windows setup automatically reads the Home edition key during installation and installs as Home edition rather than Professional. To avoid this conflict, you can use the Ei.cfg or Pid.txt file to explicitly instruct Windows setup to prompt for a product key, or you can enter a specific product key in the deployment task sequence. For more information, see [Windows Setup Edition Configuration and Product ID Files](https://technet.microsoft.com/library/hh824952.aspx). If you do not have a specific key, you can use the default product keys for Windows, which you can find in [Customize and deploy a Windows 10 operating system](https://dpcenter.microsoft.com/en/Windows/Build/cp-Windows-10-build) on the Device Partner Center.
 
 ## Apply an asset tag during deployment
 
diff --git a/devices/surface/customize-the-oobe-for-surface-deployments.md b/devices/surface/customize-the-oobe-for-surface-deployments.md
index 4218ee9ba8..46c321367b 100644
--- a/devices/surface/customize-the-oobe-for-surface-deployments.md
+++ b/devices/surface/customize-the-oobe-for-surface-deployments.md
@@ -2,22 +2,24 @@
 title: Customize the OOBE for Surface deployments (Surface)
 description: This article will walk you through the process of customizing the Surface out-of-box experience for end users in your organization.
 ms.assetid: F6910315-9FA9-4297-8FA8-2C284A4B1D87
+ms.reviewer: 
+manager: dansimp
 keywords: deploy, customize, automate, network, Pen, pair, boot
 ms.localizationpriority: medium
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: jobotto
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 07/27/2017
+ms.audience: itpro
+ms.date: 10/21/2019
 ---
 
 # Customize the OOBE for Surface deployments
 
-
-This article walks you through the process of customizing the Surface out-of-box experience for end users in your organization.
+This article describes customizing the Surface out-of-box experience for end users in your organization.
 
 It is common practice in a Windows deployment to customize the user experience for the first startup of deployed computers — the out-of-box experience, or OOBE.
 
@@ -26,10 +28,13 @@ It is common practice in a Windows deployment to customize the user experience f
 
 In some scenarios, you may want to provide complete automation to ensure that at the end of a deployment, computers are ready for use without any interaction from the user. In other scenarios, you may want to leave key elements of the experience for users to perform necessary actions or select between important choices. For administrators deploying to Surface devices, each of these scenarios presents a unique challenge to overcome.
 
+> [!NOTE]
+> This article does not apply to Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)
+
 This article provides a summary of the scenarios where a deployment might require additional steps. It also provides the required information to ensure that the desired experience is achieved on any newly deployed Surface device. This article is intended for administrators who are familiar with the deployment process, as well as concepts such as answer files and [reference images](https://technet.microsoft.com/itpro/windows/deploy/create-a-windows-10-reference-image).
 
 >[!NOTE]
->Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=618117) or System Center Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:
            
+>Although the OOBE phase of setup is still run during a deployment with an automated deployment solution such as the [Microsoft Deployment Toolkit (MDT)](https://go.microsoft.com/fwlink/p/?LinkId=618117) or Microsoft Endpoint Configuration Manager Operating System Deployment (OSD), it is automated by the settings supplied in the Deployment Wizard and task sequence. For more information see:
            
 >- [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit)
 >- [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager)
 
@@ -55,7 +60,7 @@ To provide the factory Surface Pen pairing experience in OOBE, you must copy fou
 -   %windir%\\system32\\oobe\\info\\default\\1033\\PenSuccess\_en-US.png
 
 >[!NOTE]
->You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 3 to deploy to Surface Pro 3, and the files from Surface Book to deploy Surface Book, but you should not use the files from a Surface Pro 3 to deploy Surface Book or Surface Pro 4.
+>You should copy the files from a factory image for the same model Surface device that you intend to deploy to. For example, you should use the files from a Surface Pro 7 to deploy to Surface Pro 7, and the files from Surface Book 2 to deploy Surface Book 2, but you should not use the files from a Surface Pro 7 to deploy Surface Book or Surface Pro 6.
 
  
 
diff --git a/devices/surface/deploy-surface-app-with-windows-store-for-business.md b/devices/surface/deploy-surface-app-with-windows-store-for-business.md
index 491ca43c11..a03f6e46fa 100644
--- a/devices/surface/deploy-surface-app-with-windows-store-for-business.md
+++ b/devices/surface/deploy-surface-app-with-windows-store-for-business.md
@@ -6,21 +6,38 @@ ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, store
 ms.sitesec: library
-author: miladCA
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 09/21/2017
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
-#Deploy Surface app with Microsoft Store for Business and Education
+# Deploy Surface app with Microsoft Store for Business and Education
 
 **Applies to**
-* Surface Pro 4
-* Surface Book
-* Surface 3
 
->[!NOTE]
->The Surface app ships in Surface Studio.
+- Surface Pro 7
+- Surface Laptop 3
+- Surface Pro 6
+- Surface Laptop 2
+- Surface Go
+- Surface Go with LTE
+- Surface Book 2
+- Surface Pro with LTE Advanced (Model 1807)
+- Surface Pro (Model 1796)
+- Surface Laptop
+- Surface Studio
+- Surface Studio 2
+- Surface Book
+- Surface Pro 4
+- Surface 3 LTE
+- Surface 3
+- Surface Pro 3
+
 
 The Surface app is a lightweight Microsoft Store app that provides control of many Surface-specific settings and options, including: 
 
@@ -32,15 +49,18 @@ The Surface app is a lightweight Microsoft Store app that provides control of ma
 
 * Enable or disable Surface audio enhancements 
 
-* Quick access to support documentation and information for your device 
+* Quick access to support documentation and information for your device
 
-If your organization is preparing images that will be deployed to your Surface devices, you may want to include the Surface app (formerly called the Surface Hub) in your imaging and deployment process instead of requiring users of each individual device to download and install the app from the Microsoft Store or your Microsoft Store for Business. 
+Customers using Windows Update will ordinarily receive Surface app as part of automatic updates. But if your organization is preparing images for deployment to your Surface devices, you may want to include the Surface app (formerly called the Surface Hub) in your imaging and deployment process instead of requiring users of each individual device to download and install the app from the Microsoft Store or your Microsoft Store for Business. 
 
-##Surface app overview
+> [!NOTE]
+> This article does not apply to Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)
+
+## Surface app overview
 
 The Surface app is available as a free download from the [Microsoft Store](https://www.microsoft.com/store/apps/Surface/9WZDNCRFJB8P). Users can download and install it from the Microsoft Store, but if your organization uses Microsoft Store for Business instead, you will need to add it to your store’s inventory and possibly include the app as part of your Windows deployment process. These processes are discussed throughout this article. For more information about Microsoft Store for Business, see [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/) in the Windows TechCenter. 
 
-##Add Surface app to a Microsoft Store for Business account 
+## Add Surface app to a Microsoft Store for Business account 
 
 Before users can install or deploy an app from a company’s Microsoft Store for Business account, the desired app(s) must first be made available and licensed to the users of a business. 
 
@@ -52,7 +72,7 @@ Before users can install or deploy an app from a company’s Microsoft Store for
    ![Show offline licenses apps checkbox](images/deploysurfapp-figure1-enablingapps.png "Show offline licenses apps checkbox")
            
    *Figure 1. Enable apps for offline use*
 
-4.	Add Surface app to your Microsoft Store for Business account by following this procedure:
+4. Add Surface app to your Microsoft Store for Business account by following this procedure:
     * Click the **Shop** menu.
     * In the search box, type **Surface app**, and then click the search icon.
     * After the Surface app is presented in the search results, click the app’s icon.
@@ -70,18 +90,18 @@ Before users can install or deploy an app from a company’s Microsoft Store for
     *Figure 3. Offline-licensed app acknowledgement*
     * Click **OK**.
 
-##Download Surface app from a Microsoft Store for Business account
+## Download Surface app from a Microsoft Store for Business account
 After you add an app to the Microsoft Store for Business account in Offline mode, you can download and add the app as an AppxBundle to a deployment share.
 1. Log on to the Microsoft Store for Business account at https://businessstore.microsoft.com.
 2. Click **Manage->Apps & software**. A list of all of your company’s apps is displayed, including the Surface app you added in the [Add Surface app to a Microsoft Store for Business account](#add-surface-app-to-a-microsoft-store-for-business-account) section of this article.
 3. Under **Actions**, click the ellipsis (**…**), and then click **Download for offline use** for the Surface app.
 4. Select the desired **Platform** and **Architecture** options from the available selections for the selected app, as shown in Figure 4.
 
-    ![Example of the AppxBundle package](images\deploysurfapp-fig4-downloadappxbundle.png "Example of the AppxBundle package")
+    ![Example of the AppxBundle package](images/deploysurfapp-fig4-downloadappxbundle.png "Example of the AppxBundle package")
 
     *Figure 4. Download the AppxBundle package for an app*
 5. Click **Download**. The AppxBundle package will be downloaded. Make sure you note the path of the downloaded file because you’ll need that later in this article.
-6. Click either the **Encoded license** or **Unencoded license** option. Use the Encoded license option with management tools like System Center Configuration Manager or when you use Windows Configuration Designer to create a provisioning package. Select the Unencoded license option when you use Deployment Image Servicing and Management (DISM) or deployment solutions based on imaging, including the Microsoft Deployment Toolkit (MDT).
+6. Click either the **Encoded license** or **Unencoded license** option. Use the Encoded license option with management tools like Microsoft Endpoint Configuration Manager or when you use Windows Configuration Designer to create a provisioning package. Select the Unencoded license option when you use Deployment Image Servicing and Management (DISM) or deployment solutions based on imaging, including the Microsoft Deployment Toolkit (MDT).
 7. Click **Generate** to generate and download the license for the app. Make sure you note the path of the license file because you’ll need that later in this article.
 
 >[!NOTE]
@@ -89,7 +109,7 @@ After you add an app to the Microsoft Store for Business account in Offline mode
 
 Figure 5 shows the required frameworks for the Surface app.
 
-![Required frameworks for the Surface app](images\deploysurfapp-fig5-requiredframework.png "Required frameworks for the Surface app")
+![Required frameworks for the Surface app](images/deploysurfapp-fig5-requiredframework.png "Required frameworks for the Surface app")
 
 *Figure 5. Required frameworks for the Surface app*
 
@@ -97,21 +117,21 @@ Figure 5 shows the required frameworks for the Surface app.
 >The version numbers of the Surface app and required frameworks will change as the apps are updated. Check for the latest version of Surface app and each framework in Microsoft Store for Business. Always use the Surface app and recommended framework versions as provided by Microsoft Store for Business. Using outdated frameworks or the incorrect versions may result in errors or application crashes.
 
 To download the required frameworks for the Surface app, follow these steps:
-1.	Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder.
-2.	Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder.
+1. Click the **Download** button under **Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx file to your specified folder.
+2. Click the **Download** button under **Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe**. This downloads the Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx file to your specified folder.
 
 >[!NOTE]
 >Only the 64-bit (x64) version of each framework is required for Surface devices. Surface devices are native 64-bit UEFI devices and are not compatible with 32-bit (x86) versions of Windows that would require 32-bit frameworks. 
 
-##Install Surface app on your computer with PowerShell
+## Install Surface app on your computer with PowerShell
 The following procedure provisions the Surface app onto your computer and makes it available for any user accounts created on the computer afterwards.
-1.	Using the procedure described in the [How to download Surface app from a Microsoft Store for Business account](#download-surface-app-from-a-microsoft-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. 
-2.	Begin an elevated PowerShell session.
+1. Using the procedure described in the [How to download Surface app from a Microsoft Store for Business account](#download-surface-app-from-a-microsoft-store-for-business-account) section of this article, download the Surface app AppxBundle and license file. 
+2. Begin an elevated PowerShell session.
 
     >[!NOTE]
     >If you don’t run PowerShell as an Administrator, the session won’t have the required permissions to install the app.
     
-3.	In the elevated PowerShell session, copy and paste the following command:
+3. In the elevated PowerShell session, copy and paste the following command:
     ```
     Add-AppxProvisionedPackage –Online –PackagePath \ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath \ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml
     ```
@@ -123,44 +143,44 @@ The following procedure provisions the Surface app onto your computer and makes
     Add-AppxProvisionedPackage –Online –PackagePath c:\Temp\ Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle –LicensePath c:\Temp\ Microsoft.SurfaceHub_8wekyb3d8bbwe_a53ef8ab-9dbd-dec1-46c5-7b664d4dd003.xml
     ```
 
-4.	The Surface app will now be available on your current Windows computer. 
+4. The Surface app will now be available on your current Windows computer. 
 
 Before the Surface app is functional on the computer where it has been provisioned, you must also provision the frameworks described earlier in this article. To provision these frameworks, use the following procedure in the elevated PowerShell session you used to provision the Surface app.
 
-5.	In the elevated PowerShell session, copy and paste the following command:
-```
-    Add-AppxProvisionedPackage –Online –SkipLicense –PackagePath \Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx
-```
-6.	In the elevated PowerShell session, copy and paste the following command:
-    ```
-    Add-AppxProvisionedPackage –Online –SkipLicense –PackagePath \Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx
-    ```
+5. In the elevated PowerShell session, copy and paste the following command:
+   ```
+   Add-AppxProvisionedPackage –Online –SkipLicense –PackagePath \Microsoft.VCLibs.140.00_14.0.23816.0_x64__8wekyb3d8bbwe.Appx
+   ```
+6. In the elevated PowerShell session, copy and paste the following command:
+   ```
+   Add-AppxProvisionedPackage –Online –SkipLicense –PackagePath \Microsoft.NET.Native.Runtime.1.1_1.1.23406.0_x64__8wekyb3d8bbwe.Appx
+   ```
 
-##Install Surface app with MDT
+## Install Surface app with MDT
 The following procedure uses MDT to automate installation of the Surface app at the time of deployment. The application is provisioned automatically by MDT during deployment and thus you can use this process with existing images. This is the recommended process to deploy the Surface app as part of a Windows deployment to Surface devices because it does not reduce the cross platform compatibility of the Windows image.
-1.	Using the procedure described [earlier in this article](#download-surface-app-from-a-microsoft-store-for-business-account), download the Surface app AppxBundle and license file. 
-2.	Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**.
-3.	On the **Command Details** page of the New Application Wizard, specify the default **Working Directory** and for the **Command** specify the file name of the AppxBundle, as follows:
+1. Using the procedure described [earlier in this article](#download-surface-app-from-a-microsoft-store-for-business-account), download the Surface app AppxBundle and license file. 
+2. Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**.
+3. On the **Command Details** page of the New Application Wizard, specify the default **Working Directory** and for the **Command** specify the file name of the AppxBundle, as follows:
 
-    * Command:
-    ```
-    Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle
-    ```
-    * Working Directory: %DEPLOYROOT%\Applications\SurfaceApp
+   * Command:
+     ```
+     Microsoft.SurfaceHub_10.0.342.0_neutral_~_8wekyb3d8bbwe.AppxBundle
+     ```
+   * Working Directory: %DEPLOYROOT%\Applications\SurfaceApp
 
 For the Surface app to function on the target computer, it will also require the frameworks described earlier in this article. Use the following procedure to import the frameworks required for the Surface app into MDT and to configure them as dependencies.
-1.	Using the procedure described earlier in this article, download the framework files. Store each framework in a separate folder.
-2.	Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**.
-3.	On the **Command Details** page, type the file name of each application you downloaded in the **Command** field and the default Working Directory.
+1. Using the procedure described earlier in this article, download the framework files. Store each framework in a separate folder.
+2. Using the New Application Wizard in the MDT Deployment Workbench, import the downloaded files as a new **Application with source files**.
+3. On the **Command Details** page, type the file name of each application you downloaded in the **Command** field and the default Working Directory.
 
 To configure the frameworks as dependencies of the Surface app, use this process:
-1.	Open the properties of the Surface app in the MDT Deployment Workbench.
-2.	Click the **Dependencies** tab, and then click **Add**.
-3.	Select the check box for each framework using the name you provided in the New Application Wizard.
+1. Open the properties of the Surface app in the MDT Deployment Workbench.
+2. Click the **Dependencies** tab, and then click **Add**.
+3. Select the check box for each framework using the name you provided in the New Application Wizard.
 
 After import, the Surface app will be available for selection in the **Applications** step of the Windows Deployment Wizard. You can also install the application automatically by specifying the application in the deployment task sequence by following this process:
-1.	Open your deployment task sequence in the MDT Deployment Workbench.
-2.	Add a new **Install Application** task in the **State Restore** section of deployment.
-3.	Select **Install a single application** and specify the **Surface App** as the **Application to be installed**.
+1. Open your deployment task sequence in the MDT Deployment Workbench.
+2. Add a new **Install Application** task in the **State Restore** section of deployment.
+3. Select **Install a single application** and specify the **Surface App** as the **Application to be installed**.
 
 For more information about including apps into your Windows deployments, see [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-the-microsoft-deployment-toolkit).
diff --git a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md b/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md
deleted file mode 100644
index d0e16a8292..0000000000
--- a/devices/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices.md
+++ /dev/null
@@ -1,71 +0,0 @@
----
-title: Download the latest firmware and drivers for Surface devices (Surface)
-description: This article provides a list of the available downloads for Surface devices and links to download the drivers and firmware for your device.
-ms.assetid: 7662BF68-8BF7-43F7-81F5-3580A770294A
-keywords: update Surface, newest, latest, download, firmware, driver, tablet, hardware, device
-ms.localizationpriority: medium
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.pagetype: surface, devices
-ms.sitesec: library
-author: brecords
-ms.date: 11/15/2018
-ms.author: jdecker
-ms.topic: article
----
-
-# Deploying the latest firmware and drivers for Surface devices
-Although Surface devices are typically automatically updated with the latest device drivers and firmware via Windows Update, sometimes it's necessary to download and install updates manually, such as during a Windows deployment. 
-
-## Downloading MSI files
-To download MSI files, refer to the following Microsoft Support page:
- 
-- [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware-for-surface)
            
-Installation files for administrative tools, drivers for accessories, and updates for Windows are also available for some devices.
-
-## Deploying MSI files
-Driver and firmware updates for Surface devices containing all required cumulative updates are packaged in separate MSI files for specific versions of Windows 10. 
-In the name of each of these files you will find a Windows build number, this number indicates the minimum supported build required to install the drivers and firmware contained within. Refer to [Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information) for a list of the build numbers for each version. For example, to install the drivers contained in SurfacePro6_Win10_16299_1900307_0.msi file you must have Windows 10 Fall Creators Update version 1709, or newer installed on your Surface Pro 6.
-
-
-### Surface MSI naming convention
-Each .MSI file is named in accordance with a formula that begins with the product and Windows release information, followed by the Windows build  number and version number, and ending with the revision of version number.  SurfacePro6_Win10_16299_1900307_0.msi is classified as follows:
-
-**Example:**
-SurfacePro6_Win10_16299_1900307_0.msi :
-
-| Product     | Windows release | Build | Version |  Revision of version |
-| --- | --- | --- | --- | --- |
-| SurfacePro6 | Win10  | 16299  | 1900307 | 0  |
-|       |      |       | Indicates key date and sequence information  | Indicates release history of the MSI file   |
-|      |        |     | **19:** Signifies the year (2019)
            **003**: Signifies that it’s the third release of 2019
            **07**: Signifies the product version number. (Surface Pro 6 is officially the seventh version of Surface Pro.) | **0:** Signifies it's the first release of version 1900307 and has not been re-released for any reason. |
-
-Look to the **version** number to determine the latest files that contain the most recent security updates.  For example, you might need to install the newest file from the following list:
-
-
-- SurfacePro6_Win10_16299_1900307_0.msi
-- SurfacePro6_Win10_17134_1808507_3.msi
-- SurfacePro6_Win10_17763_1808707_3.msi
-
-The first file —  SurfacePro6_Win10_16299_1900307_0.msi  —  is the newest because its VERSION field has the newest build in 2019; the other files are from 2018.
-
-## Supported devices
-Downloadable MSI files are available for Surface devices from Surface Pro 2 and later. 
-
-
-[!NOTE]
-There are no downloadable firmware or driver updates available for Surface devices with Windows RT, including Surface RT and Surface 2. Updates can only be applied using Windows Update.
-
-For more information about deploying Surface drivers and firmware, refer to:
-
-- [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates).
-
-- [Microsoft Surface support for business](https://www.microsoft.com/surface/support/business).
-
-
- 
-
-
-
-
-
diff --git a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md
index 1f84f574f3..61fc8352df 100644
--- a/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md
+++ b/devices/surface/deploy-windows-10-to-surface-devices-with-mdt.md
@@ -6,22 +6,34 @@ ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface
 ms.sitesec: library
-author: Scottmca
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 10/16/2017
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 01/15/2020
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit
 
 **Applies to**
-- Surface Studio
-* Surface Pro 4
-* Surface Book
-* Surface 3
-* Windows 10
 
-This article walks you through the recommended process to deploy Windows 10 to Surface devices with Microsoft deployment technologies. The process described in this article yields a complete Windows 10 environment including updated firmware and drivers for your Surface device along with applications like Microsoft Office 365 and the Surface app. When the process is complete, the Surface device will be ready for use by the end user. You can customize this process to include your own applications and configuration to meet the needs of your organization. You can also follow the guidance provided in this article to integrate deployment to Surface devices into existing deployment strategies.
+- Surface Studio and later
+- Surface Pro 4 and later
+- Surface Book and later
+- Surface Laptop and later
+- Surface Go
+- Surface 3
+- Windows 10
+
+This article walks you through the recommended process to deploy Windows 10 to Surface devices with Microsoft deployment technologies. The process described in this article yields a complete Windows 10 environment including updated firmware and drivers for your Surface device along with applications like Microsoft Office 365 and the Surface app. 
+
+> [!NOTE]
+> MDT is not currently supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)
+
+When the process is complete, the Surface device will be ready for use by the end user. You can customize this process to include your own applications and configuration to meet the needs of your organization. You can also follow the guidance provided in this article to integrate deployment to Surface devices into existing deployment strategies.
 
 By following the procedures in this article, you can create an up-to-date reference image and deploy this image to your Surface devices, a process known as *reimaging*. Reimaging will erase and overwrite the existing environment on your Surface devices. This process allows you to rapidly configure your Surface devices with identical environments that can be configured to precisely fit your organization’s requirements. 
 
@@ -53,7 +65,7 @@ Before you can perform a deployment with MDT, you must first supply a set of ope
 
 
 >[!NOTE]
->The installation media generated from the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT.
+>The installation media generated from the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page differs from physical media or media downloaded from the VLSC, in that it contains an image file in Electronic Software Download (ESD) format rather than in the Windows Imaging (WIM) format. Installation media with an image file in WIM format is required for use with MDT. Installation media from the Get Windows 10 page cannot be used for Windows deployment with MDT.
 
 
 #### Windows Server
@@ -62,7 +74,7 @@ Although MDT can be installed on a Windows client, to take full advantage of Win
 
 
 >[!NOTE]
->To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/en-us/evalcenter).
+>To evaluate the deployment process for Surface devices or to test the deployment process described in this article with the upcoming release of Windows Server 2016, you can download evaluation and preview versions from the [TechNet Evaluation Center](https://www.microsoft.com/evalcenter).
 
 
 #### Windows Deployment Services
@@ -80,17 +92,14 @@ Because customizations are performed by MDT at the time of deployment, the goal
 
 
 >[!NOTE]
->Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library.  Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/en-us/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center.
+>Hyper-V is available not only on Windows Server, but also on Windows clients, including Professional and Enterprise editions of Windows 8, Windows 8.1, and Windows 10. Find out more at [Client Hyper-V on Windows 10](https://msdn.microsoft.com/virtualization/hyperv_on_windows/windows_welcome) and [Client Hyper-V on Windows 8 and Windows 8.1](https://technet.microsoft.com/library/hh857623) in the TechNet Library.  Hyper-V is also available as a standalone product, Microsoft Hyper-V Server, at no cost. You can download [Microsoft Hyper-V Server 2012 R2](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-2012-r2) or [Microsoft Hyper-V Server 2016 Technical Preview](https://www.microsoft.com/evalcenter/evaluate-hyper-v-server-technical-preview) from the TechNet Evaluation Center.
 
 
 #### Surface firmware and drivers
 
 For your deployed Windows environment to function correctly on your Surface devices, you will need to install the drivers used by Windows to communicate with the components of your device. These drivers are available for download in the Microsoft Download Center for each Surface device. You can find the correct Microsoft Download Center page for your device at [Download the latest firmware and drivers for Surface devices](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices).
 
-When you browse to the specific Microsoft Download Center page for your device, you will notice that there are two files available for download. One file is a Windows Installer (.msi) file. This file is used to update drivers on devices that are already running Windows or that have device management solutions. The other file is an archive (.zip) file. This file contains the individual driver files that are used during deployment, or for manual installation with Device Manager. The file that you will need to download is the .zip archive file. You can read more about the difference between the firmware and driver pack file types at [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates).
-
-
-In addition to the driver files that help Windows communicate with the hardware components of the Surface device, the .zip file you download will also contain firmware updates. These firmware updates will update the instructions used by the device hardware to communicate between components and Windows. The firmware of Surface device components is updated by installation of specific driver files and thus is installed along with the other drivers during deployment. The firmware of an out-of-date Surface device is thus updated when the device reboots during and after the Windows deployment process.
+When you browse to the specific Microsoft Download Center page for your device, you will find a Windows Installer (.msi) file. This file is used to update drivers on devices that are already running Windows or that have device management solutions. Firmware updates maintain the instructions used by the device hardware to communicate between components and Windows. The firmware of Surface device components is updated by installation of specific driver files and thus is installed along with the other drivers during deployment. For more information, see [Manage Surface driver and firmware updates](https://technet.microsoft.com/itpro/surface/manage-surface-pro-3-firmware-updates).
 
 >[!NOTE]
 >Beginning in Windows 10, the drivers for Surface devices are included in the Windows Preinstallation Environment (WinPE). In earlier versions of Windows, specific drivers (like network drivers) had to be imported and configured in MDT for use in WinPE to successfully deploy to Surface devices.
@@ -119,13 +128,13 @@ To boot from the network with either your reference virtual machines or your Sur
 
 Windows Deployment Services (WDS) is a Windows Server role. To add the WDS role to a Windows Server 2012 R2 environment, use the Add Roles and Features Wizard, as shown in Figure 1. Start the Add Roles and Features Wizard from the **Manage** button of **Server Manager**. Install both the Deployment Server and Transport Server role services.
 
-![Install the Windows Deployment Services role](images\surface-deploymdt-fig1.png "Install the Windows Deployment Services role")
+![Install the Windows Deployment Services role](images/surface-deploymdt-fig1.png "Install the Windows Deployment Services role")
 
 *Figure 1. Install the Windows Deployment Services server role*
 
 After the WDS role is installed, you need to configure WDS. You can begin the configuration process from the WDS node of Server Manager by right-clicking your server’s name and then clicking **Windows Deployment Services Management Console**. In the **Windows Deployment Services** window, expand the **Servers** node to find your server, right-click your server, and then click **Configure** in the menu to start the Windows Deployment Services Configuration Wizard, as shown in Figure 2.
 
-![Configure PXE response for Windows Deployment Services](images\surface-deploymdt-fig2.png "Configure PXE response for Windows Deployment Services")
+![Configure PXE response for Windows Deployment Services](images/surface-deploymdt-fig2.png "Configure PXE response for Windows Deployment Services")
 
 *Figure 2. Configure PXE response for Windows Deployment Services*
 
@@ -146,7 +155,7 @@ To install Windows ADK, run the Adksetup.exe file that you downloaded from [Down
 
 When you get to the **Select the features you want to install** page, you only need to select the **Deployment Tools** and **Windows Preinstallation Environment (Windows PE)** check boxes to deploy Windows 10 using MDT, as shown in Figure 3. 
 
-![Required options for deployment with MDT](images\surface-deploymdt-fig3.png "Required options for deployment with MDT")
+![Required options for deployment with MDT](images/surface-deploymdt-fig3.png "Required options for deployment with MDT")
 
 *Figure 3. Only Deployment Tools and Windows PE options are required for deployment with MDT*
 
@@ -176,24 +185,24 @@ To create the deployment share, follow these steps:
 
 1. Open the Deployment Workbench from your Start menu or Start screen, as shown in Figure 5.
 
-   ![The MDT Deployment Workbench](images\surface-deploymdt-fig5.png "The MDT Deployment Workbench")
+   ![The MDT Deployment Workbench](images/surface-deploymdt-fig5.png "The MDT Deployment Workbench")
 
    *Figure 5. The MDT Deployment Workbench*
 
 2. Right-click the **Deployment Shares** folder, and then click **New Deployment Share** to start the New Deployment Share Wizard, as shown in Figure 6.
 
-   ![Summary page of the New Deployment Share Wizard](images\surface-deploymdt-fig6.png "Summary page of the New Deployment Share Wizard")
+   ![Summary page of the New Deployment Share Wizard](images/surface-deploymdt-fig6.png "Summary page of the New Deployment Share Wizard")
 
    *Figure 6. The Summary page of the New Deployment Share Wizard*
 
 3. Create a new deployment share with New Deployment Share Wizard with the following steps:
 
-  * **Path** – Specify a local folder where the deployment share will reside, and then click **Next**.
+   * **Path** – Specify a local folder where the deployment share will reside, and then click **Next**.
 
       >[!NOTE]
       >Like the WDS remote installation folder, it is recommended that you put this folder on an NTFS volume that is not your system volume.
 
-  * **Share** – Specify a name for the network share under which the local folder specified on the **Path** page will be shared, and then click **Next**.
+   * **Share** – Specify a name for the network share under which the local folder specified on the **Path** page will be shared, and then click **Next**.
 
       >[!NOTE]
       >The share name cannot contain spaces.
@@ -201,11 +210,11 @@ To create the deployment share, follow these steps:
       >[!NOTE]
       >You can use a Dollar Sign (**$**) to hide your network share so that it will not be displayed when users browse the available network shares on the server in File Explorer.
 
-  * **Descriptive Name** – Enter a descriptive name for the network share (this descriptive name can contain spaces), and then click **Next**. The descriptive name will be the name of the folder as it appears in the Deployment Workbench.
-  * **Options** – You can accept the default options on this page. Click **Next**.
-  * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the deployment share.
-  * **Progress** – While the deployment share is being created, a progress bar is displayed on this page to indicate the status of the deployment share creation process.
-  * **Confirmation** – When the deployment share creation process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Deployment Share Wizard.
+   * **Descriptive Name** – Enter a descriptive name for the network share (this descriptive name can contain spaces), and then click **Next**. The descriptive name will be the name of the folder as it appears in the Deployment Workbench.
+   * **Options** – You can accept the default options on this page. Click **Next**.
+   * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the deployment share.
+   * **Progress** – While the deployment share is being created, a progress bar is displayed on this page to indicate the status of the deployment share creation process.
+   * **Confirmation** – When the deployment share creation process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Deployment Share Wizard.
 
 4. When the New Deployment Share Wizard is complete, you can expand the Deployment Shares folder to find your newly created deployment share.
 5. You can expand your deployment share, where you will find several folders for the resources, scripts, and components of your MDT deployment environment are stored.
@@ -222,36 +231,36 @@ You now have an empty deployment share that is ready for you to add the resource
 The first resources that are required to perform a deployment of Windows are the installation files from Windows 10 installation media. Even if you have an already prepared reference image, you still need to supply the unaltered installation files from your installation media. The source of these files can be a physical disk, or it can be an ISO file like the download from the Volume Licensing Service Center (VLSC).
 
 >[!NOTE]
->A 64-bit operating system is required for compatibility with Surface Studio, Surface Pro 4, Surface Book, Surface Pro 3, and Surface 3.
+>A 64-bit operating system is required for compatibility with Surface devices except Surface Pro X which cannot be managed with MDT.
 
 To import Windows 10 installation files, follow these steps:
 
 1. Right-click the **Operating Systems** folder under your deployment share in the Deployment Workbench, and then click **New Folder** to open the **New Folder** page, as shown in Figure 7.
 
-   ![Create a new folder on the New Folder page](images\surface-deploymdt-fig7.png "Create a new folder on the New Folder page")
+   ![Create a new folder on the New Folder page](images/surface-deploymdt-fig7.png "Create a new folder on the New Folder page")
    
    *Figure 7. Create a new folder on the New Folder page*
 
 2. On the **New Folder** page a series of steps is displayed, as follows:
-  * **General Settings** – Enter a name for the folder in the **Folder Name** field (for example, Windows 10 Enterprise), add any comments you want in the **Comments** field, and then click **Next**.
-  * **Summary** – Review the specified configuration of the new folder on this page, and then click **Next**.
-  * **Progress** – A progress bar will be displayed on this page while the folder is created. This page will likely pass very quickly.
-  * **Confirmation** – When the new folder has been created, a **Confirmation** page displays the success of the operation. Click **Finish** to close the **New Folder** page.
+   * **General Settings** – Enter a name for the folder in the **Folder Name** field (for example, Windows 10 Enterprise), add any comments you want in the **Comments** field, and then click **Next**.
+   * **Summary** – Review the specified configuration of the new folder on this page, and then click **Next**.
+   * **Progress** – A progress bar will be displayed on this page while the folder is created. This page will likely pass very quickly.
+   * **Confirmation** – When the new folder has been created, a **Confirmation** page displays the success of the operation. Click **Finish** to close the **New Folder** page.
 3. Expand the Operating Systems folder to see the newly created folder.
 4. Right-click the newly created folder, and then click **Import Operating System** to launch the Import Operating System Wizard, as shown in Figure 8.
 
-   ![Import source files with the Import Operating System Wizard](images\surface-deploymdt-fig8.png "Import source files with the Import Operating System Wizard")
+   ![Import source files with the Import Operating System Wizard](images/surface-deploymdt-fig8.png "Import source files with the Import Operating System Wizard")
 
    *Figure 8. Import source files with the Import Operating System Wizard*
 
 5. The Import Operating System Wizard walks you through the import of your operating system files, as follows:
-  * **OS Type** – Click **Full Set of Source Files** to specify that you are importing the Windows source files from installation media, and then click **Next**.
-  * **Source** – Click **Browse**, move to and select the folder or drive where your installation files are found, and then click **Next**.
-  * **Destination** – Enter a name for the new folder that will be created to hold the installation files, and then click **Next**.
-  * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
-  * **Progress** – While the installation files are imported, a progress bar is displayed on this page.
-  * **Confirmation** – When the operating system import process completes, the success of the process is displayed on this page. Click **Finish** to complete Import Operating System Wizard.
-6.	Expand the folder you created in Step 1 to see the entry for your newly imported installation files for Windows 10.
+   * **OS Type** – Click **Full Set of Source Files** to specify that you are importing the Windows source files from installation media, and then click **Next**.
+   * **Source** – Click **Browse**, move to and select the folder or drive where your installation files are found, and then click **Next**.
+   * **Destination** – Enter a name for the new folder that will be created to hold the installation files, and then click **Next**.
+   * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
+   * **Progress** – While the installation files are imported, a progress bar is displayed on this page.
+   * **Confirmation** – When the operating system import process completes, the success of the process is displayed on this page. Click **Finish** to complete Import Operating System Wizard.
+6. Expand the folder you created in Step 1 to see the entry for your newly imported installation files for Windows 10.
 
 Now that you’ve imported the installation files from the installation media, you have the files that MDT needs to create the reference image and you are ready to instruct MDT how to create the reference image to your specifications.
 
@@ -266,35 +275,35 @@ To create the reference image task sequence, follow these steps:
 
 1. Right-click the **Task Sequences** folder under your deployment share in the Deployment Workbench, and then click **New Task Sequence** to start the New Task Sequence Wizard, as shown in Figure 9.
 
-   ![Create new task sequence to deploy and update a Windows 10 reference environment](images\surface-deploymdt-fig9.png "Create new task sequence to deploy and update a Windows 10 reference environment")
+   ![Create new task sequence to deploy and update a Windows 10 reference environment](images/surface-deploymdt-fig9.png "Create new task sequence to deploy and update a Windows 10 reference environment")
 
    *Figure 9. Create a new task sequence to deploy and update a Windows 10 reference environment*
 
 2. The New Task Sequence Wizard presents a series of steps, as follows:
-  * **General Settings** – Enter an identifier for the reference image task sequence in the **Task Sequence ID** field, a name for the reference image task sequence in the **Task Sequence Name** field, and any comments for the reference image task sequence in the **Task Sequence Comments** field, and then click **Next**.
-  >[!NOTE]
-  >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
-  * **Select Template** – Select **Standard Client Task Sequence** from the drop-down menu, and then click **Next**.
-  * **Select OS** – Navigate to and select the Windows 10 image you imported with the Windows 10 installation files, and then click **Next**.
-  * **Specify Product Key** – Click **Do Not Specify a Product Key at This Time**, and then click **Next**.
-  * **OS Settings** – Enter a name, organization, and home page URL in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**.
-  * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**.
-  >[!NOTE]
-  >During creation of a reference image, any specified Administrator password will be automatically removed when the image is prepared for capture with Sysprep. During reference image creation, a password is not necessary, but is recommended to remain in line with best practices for production deployment environments.
-  * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence.
-  * **Progress** – While the task sequence is created, a progress bar is displayed on this page.
-  * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard.
-2. Select the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**.
-3. Select the **Task Sequence** tab to view the steps that are included in the Standard Client Task Sequence template, as shown in Figure 10.
+   * **General Settings** – Enter an identifier for the reference image task sequence in the **Task Sequence ID** field, a name for the reference image task sequence in the **Task Sequence Name** field, and any comments for the reference image task sequence in the **Task Sequence Comments** field, and then click **Next**.
+     >[!NOTE]
+     >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
+   * **Select Template** – Select **Standard Client Task Sequence** from the drop-down menu, and then click **Next**.
+   * **Select OS** – Navigate to and select the Windows 10 image you imported with the Windows 10 installation files, and then click **Next**.
+   * **Specify Product Key** – Click **Do Not Specify a Product Key at This Time**, and then click **Next**.
+   * **OS Settings** – Enter a name, organization, and home page URL in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**.
+   * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**.
+     >[!NOTE]
+     >During creation of a reference image, any specified Administrator password will be automatically removed when the image is prepared for capture with Sysprep. During reference image creation, a password is not necessary, but is recommended to remain in line with best practices for production deployment environments.
+   * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence.
+   * **Progress** – While the task sequence is created, a progress bar is displayed on this page.
+   * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard.
+3. Select the **Task Sequences** folder, right-click the new task sequence you created, and then click **Properties**.
+4. Select the **Task Sequence** tab to view the steps that are included in the Standard Client Task Sequence template, as shown in Figure 10.
 
-   ![Enable Windows Update in the reference image task sequence](images\surface-deploymdt-fig10.png "Enable Windows Update in the reference image task sequence")
+   ![Enable Windows Update in the reference image task sequence](images/surface-deploymdt-fig10.png "Enable Windows Update in the reference image task sequence")
 
    *Figure 10. Enable Windows Update in the reference image task sequence*
 
-4. Select the **Windows Update (Pre-Application Installation)** option, located under the **State Restore** folder.
-5. Click the **Options** tab, and then clear the **Disable This Step** check box.
-6. Repeat Step 4 and Step 5 for the **Windows Update (Post-Application Installation)** option.
-7. Click **OK** to apply changes to the task sequence, and then close the task sequence properties window.
+5. Select the **Windows Update (Pre-Application Installation)** option, located under the **State Restore** folder.
+6. Click the **Options** tab, and then clear the **Disable This Step** check box.
+7. Repeat Step 4 and Step 5 for the **Windows Update (Post-Application Installation)** option.
+8. Click **OK** to apply changes to the task sequence, and then close the task sequence properties window.
 
 ### Generate and import MDT boot media
 
@@ -304,25 +313,25 @@ To update the MDT boot media, follow these steps:
 
 1. Right-click the deployment share in the Deployment Workbench, and then click **Update Deployment Share** to start the Update Deployment Share Wizard, as shown in Figure 11.
 
-   ![Generate boot images with the Update Deployment Share Wizard](images\surface-deploymdt-fig11.png "Generate boot images with the Update Deployment Share Wizard")
+   ![Generate boot images with the Update Deployment Share Wizard](images/surface-deploymdt-fig11.png "Generate boot images with the Update Deployment Share Wizard")
 
    *Figure 11. Generate boot images with the Update Deployment Share Wizard*
 
 2. Use the Update Deployment Share Wizard to create boot images with the following process:
-  * **Options** – Click **Completely Regenerate the Boot Images**, and then click **Next**.
-  >[!NOTE]
-  >Because this is the first time the newly created deployment share has been updated, new boot images will be generated regardless of which option you select on the **Options** page.
-  * **Summary** – Review the specified options on this page before you click **Next** to begin generation of boot images.
-  * **Progress** – While the boot images are being generated, a progress bar is displayed on this page.
-  * **Confirmation** – When the boot images have been generated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard.
+   * **Options** – Click **Completely Regenerate the Boot Images**, and then click **Next**.
+     >[!NOTE]
+     >Because this is the first time the newly created deployment share has been updated, new boot images will be generated regardless of which option you select on the **Options** page.
+   * **Summary** – Review the specified options on this page before you click **Next** to begin generation of boot images.
+   * **Progress** – While the boot images are being generated, a progress bar is displayed on this page.
+   * **Confirmation** – When the boot images have been generated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard.
 3. Confirm that boot images have been generated by navigating to the deployment share in File Explorer and opening the Boot folder. The following files should be displayed, as shown in Figure 12:
-  * **LiteTouchPE_x86.iso**
-  * **LiteTouchPE_x86.wim**
-  * **LiteTouchPE_x64.iso**
-  * **LiteTouchPE_x64.wim**
+   * **LiteTouchPE_x86.iso**
+   * **LiteTouchPE_x86.wim**
+   * **LiteTouchPE_x64.iso**
+   * **LiteTouchPE_x64.wim**
 
 
-   ![Boot images in the Boot folder after Update Deployment Share Wizard completes](images\surface-deploymdt-fig12.png "Boot images in the Boot folder after Update Deployment Share Wizard completes")
+   ![Boot images in the Boot folder after Update Deployment Share Wizard completes](images/surface-deploymdt-fig12.png "Boot images in the Boot folder after Update Deployment Share Wizard completes")
 
    *Figure 12. Boot images displayed in the Boot folder after completion of the Update Deployment Share Wizard*
 
@@ -332,21 +341,21 @@ To import the MDT boot media into WDS for PXE boot, follow these steps:
 2. Expand **Servers** and your deployment server.
 3. Click the **Boot Images** folder, as shown in Figure 13.
 
-   ![Start the Add Image Wizard from the Boot Images folder](images\surface-deploymdt-fig13.png "Start the Add Image Wizard from the Boot Images folder")
+   ![Start the Add Image Wizard from the Boot Images folder](images/surface-deploymdt-fig13.png "Start the Add Image Wizard from the Boot Images folder")
 
    *Figure 13. Start the Add Image Wizard from the Boot Images folder*
 
 4. Right-click the **Boot Images** folder, and then click **Add Boot Image** to open the Add Image Wizard, as shown in Figure 14.
 
-   ![Import the LiteTouchPE_x86.wim MDT boot image](images\surface-deploymdt-fig14.png "Import the LiteTouchPE_x86.wim MDT boot image")
+   ![Import the LiteTouchPE_x86.wim MDT boot image](images/surface-deploymdt-fig14.png "Import the LiteTouchPE_x86.wim MDT boot image")
 
    *Figure 14. Import the LiteTouchPE_x86.wim MDT boot image*
 
 5. The Add Image Wizard displays a series of steps, as follows:
-  * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, click **LiteTouchPE_x86.wim**, click **Open**, and then click **Next**.
-  * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options.
-  * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**.
-  * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard.
+   * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, click **LiteTouchPE_x86.wim**, click **Open**, and then click **Next**.
+   * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options.
+   * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**.
+   * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard.
 
 >[!NOTE]
 >Only the 32-bit boot image, LiteTouchPE_x86.wim, is required to boot from BIOS devices, including Generation 1 Hyper-V virtual machines like the reference virtual machine.
@@ -377,7 +386,7 @@ Perform the reference image deployment and capture using the following steps:
 
 1. Start your virtual machine and press the F12 key when prompted to boot to the WDS server via PXE, as shown in Figure 15.
 
-   ![Start network boot by pressing the F12 key](images\surface-deploymdt-fig15.png "Start network boot by pressing the F12 key")
+   ![Start network boot by pressing the F12 key](images/surface-deploymdt-fig15.png "Start network boot by pressing the F12 key")
 
    *Figure 15. Start network boot by pressing the F12 key*
 
@@ -385,18 +394,18 @@ Perform the reference image deployment and capture using the following steps:
 3. Enter your MDT username and password, a user with rights to access the MDT deployment share over the network and with rights to write to the Captures folder in the deployment share.
 4. After your credentials are validated, the Windows Deployment Wizard will start and process the boot and deployment share rules.
 5. The Windows Deployment Wizard displays a series of steps, as follows:
-  * **Task Sequence** – Select the task sequence you created for reference image creation (it should be the only task sequence available), and then click **Next**.
-  * **Computer Details** – Leave the default computer name, workgroup name, and the **Join a Workgroup** option selected, and then click **Next**. The computer name and workgroup will be reset when the image is prepared by Sysprep and captured.
-  * **Move Data and Settings** – Leave the default option of **Do Not Move User Data and Settings** selected, and then click **Next**.
-  * **User Data (Restore)** – Leave the default option of **Do Not Restore User Data and Settings** selected, and then click **Next**.
-  * **Locale and Time** – Leave the default options for language and time settings selected. The locale and time settings will be specified during deployment of the image to other devices. Click **Next**.
-  * **Capture Image** – Click the **Capture an Image of this Reference Computer** option, as shown in Figure 16. In the **Location** field, keep the default location of the Captures folder. You can keep or change the name of the image file in the **File Name** field. When you are finished, click **Next**.
+   * **Task Sequence** – Select the task sequence you created for reference image creation (it should be the only task sequence available), and then click **Next**.
+   * **Computer Details** – Leave the default computer name, workgroup name, and the **Join a Workgroup** option selected, and then click **Next**. The computer name and workgroup will be reset when the image is prepared by Sysprep and captured.
+   * **Move Data and Settings** – Leave the default option of **Do Not Move User Data and Settings** selected, and then click **Next**.
+   * **User Data (Restore)** – Leave the default option of **Do Not Restore User Data and Settings** selected, and then click **Next**.
+   * **Locale and Time** – Leave the default options for language and time settings selected. The locale and time settings will be specified during deployment of the image to other devices. Click **Next**.
+   * **Capture Image** – Click the **Capture an Image of this Reference Computer** option, as shown in Figure 16. In the **Location** field, keep the default location of the Captures folder. You can keep or change the name of the image file in the **File Name** field. When you are finished, click **Next**.
   
-  ![Capture an image of the reference machine](images\surface-deploymdt-fig16.png "Capture an image of the reference machine")
+    ![Capture an image of the reference machine](images/surface-deploymdt-fig16.png "Capture an image of the reference machine")
     
-  *Figure 16. Use the Capture Image page to capture an image of the reference machine after deployment*
+    *Figure 16. Use the Capture Image page to capture an image of the reference machine after deployment*
 
-  * **Ready** – You can review your selections by expanding **Details** on the **Ready** page. Click **Begin** when you are ready to perform the deployment and capture of your reference image.
+   * **Ready** – You can review your selections by expanding **Details** on the **Ready** page. Click **Begin** when you are ready to perform the deployment and capture of your reference image.
 
 6. Your reference task sequence will run with the specified options.
 
@@ -425,14 +434,14 @@ To import the reference image for deployment, use the following steps:
 
 1. Right-click the **Operating Systems** folder under your deployment share in the Deployment Workbench or the folder you created in when you imported Windows 10 installation files, and then click **Import Operating System** to start the Import Operating System Wizard. 
 2. Import the custom image with the Import Operating System Wizard by using the following steps:
-  * **OS Type** – Select Custom Image File to specify that you are importing the Windows source files from installation media, and then click **Next**.
-  * **Image** – Click **Browse**, and then navigate to and select the image file in the **Captures** folder in your deployment share. Select the **Move the Files to the Deployment Share Instead of Copying Them** checkbox if desired. Click **Next**. 
-  * **Setup** – Click **Setup Files are not Neededf**, and then click **Next**.
-  * **Destination** – Enter a name for the new folder that will be created to hold the image file, and then click **Next**.
-  * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
-  * **Progress** – While the image is imported, a progress bar is displayed on this page.
-  * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Operating System Wizard.
-3.	Expand the folder in which you imported the image to verify that the import completed successfully.
+   * **OS Type** – Select Custom Image File to specify that you are importing the Windows source files from installation media, and then click **Next**.
+   * **Image** – Click **Browse**, and then navigate to and select the image file in the **Captures** folder in your deployment share. Select the **Move the Files to the Deployment Share Instead of Copying Them** checkbox if desired. Click **Next**. 
+   * **Setup** – Click **Setup Files are not Neededf**, and then click **Next**.
+   * **Destination** – Enter a name for the new folder that will be created to hold the image file, and then click **Next**.
+   * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
+   * **Progress** – While the image is imported, a progress bar is displayed on this page.
+   * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Operating System Wizard.
+3. Expand the folder in which you imported the image to verify that the import completed successfully.
 
 >[!NOTE]
 >You can import the reference image into the same deployment share that you used to create your reference image, or you could import the reference image into a new deployment share for deployment to your Surface devices. If you chose to create a new deployment share for deployment of your reference image, remember that you still need to import a full set of installation files from installation media.
@@ -456,24 +465,24 @@ To import the Surface drivers (in this example, Surface Pro 4) into MDT, follow
      * Microsoft Corporation
        * Surface Pro 4
 
-   ![Recommended folder structure for drivers](images\surface-deploymdt-fig17.png "Recommended folder structure for drivers")
+   ![Recommended folder structure for drivers](images/surface-deploymdt-fig17.png "Recommended folder structure for drivers")
 
    *Figure 17. The recommended folder structure for drivers*
 
 4. Right-click the **Surface Pro 4** folder, and then click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 18.
 
-   ![Progress page during drivers import](images\surface-deploymdt-fig18.png "Progress page during drivers import")
+   ![Progress page during drivers import](images/surface-deploymdt-fig18.png "Progress page during drivers import")
 
    *Figure 18. The Progress page during drivers import*
 
 5. The Import Driver Wizard displays a series of steps, as follows:
-  * **Specify Directory** – Click **Browse** and navigate to the folder where you extracted the Surface Pro 4 firmware and drivers in Step 1.
-  * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
-  * **Progress** – While the drivers are imported, a progress bar is displayed on this page.
-  * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Drivers Wizard.
-6.	Click the **Surface Pro 4** folder and verify that the folder now contains the drivers that were imported, as shown in Figure 19.
+   * **Specify Directory** – Click **Browse** and navigate to the folder where you extracted the Surface Pro 4 firmware and drivers in Step 1.
+   * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
+   * **Progress** – While the drivers are imported, a progress bar is displayed on this page.
+   * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Drivers Wizard.
+6. Click the **Surface Pro 4** folder and verify that the folder now contains the drivers that were imported, as shown in Figure 19.
 
-   ![Drivers for Surface Pro 4 imported and organized in the MDT deployment share](images\surface-deploymdt-fig19.png "Drivers for Surface Pro 4 imported and organized in the MDT deployment share")
+   ![Drivers for Surface Pro 4 imported and organized in the MDT deployment share](images/surface-deploymdt-fig19.png "Drivers for Surface Pro 4 imported and organized in the MDT deployment share")
 
    *Figure 19. Drivers for Surface Pro 4 imported and organized in the MDT deployment share*
 
@@ -491,7 +500,7 @@ After you have downloaded the source files for your version of Office Click-to-R
 
 1. Right-click the existing **Configuration.xml** file, and then click **Edit**.
 2. This action opens the file in Notepad. Replace the existing text with the following:
-  ```
+   ```
     
      
       
@@ -499,7 +508,7 @@ After you have downloaded the source files for your version of Office Click-to-R
       
     
     
-```
+   ```
 
 3. Save the file.
 
@@ -512,22 +521,22 @@ Now that the installation and configuration files are prepared, the application
 1. Open the Deployment Workbench. 
 2. Expand the deployment share, right-click the **Applications** folder, and then click **New Application** to start the New Application Wizard, as shown in Figure 20.
 
-   ![Enter the command and directory for Office 2016 Click-to-Run](images\surface-deploymdt-fig20.png "Enter the command and directory for Office 2016 Click-to-Run")
+   ![Enter the command and directory for Office 2016 Click-to-Run](images/surface-deploymdt-fig20.png "Enter the command and directory for Office 2016 Click-to-Run")
 
    *Figure 20. Enter the command and directory for Office 2016 Click-to-Run*
 
 3. The New Application Wizard walks you through importing the Office 2016 Click-to-Run files, as follows:
-  * **Application Type** – Click **Application with Source Files**, and then click **Next**.
-  * **Details** – Enter a name for the application (for example, Office 2016 Click-to-Run) in the **Application Name** field. Enter publisher, version, and language information in the **Publisher**, **Version**, and **Language** fields if desired. Click **Next**.
-  * **Source** – Click **Browse** to navigate to and select the folder where you downloaded the Office installation files with the Office Deployment Tool, and then click **Next**.
-  * **Destination** – Enter a name for the folder where the application files will be stored in the **Specify the Name of the Directory that Should Be Created** field or click **Next** to accept the default name.
-  * **Command Details** – Enter the Office Deployment Tool installation command line:
+   * **Application Type** – Click **Application with Source Files**, and then click **Next**.
+   * **Details** – Enter a name for the application (for example, Office 2016 Click-to-Run) in the **Application Name** field. Enter publisher, version, and language information in the **Publisher**, **Version**, and **Language** fields if desired. Click **Next**.
+   * **Source** – Click **Browse** to navigate to and select the folder where you downloaded the Office installation files with the Office Deployment Tool, and then click **Next**.
+   * **Destination** – Enter a name for the folder where the application files will be stored in the **Specify the Name of the Directory that Should Be Created** field or click **Next** to accept the default name.
+   * **Command Details** – Enter the Office Deployment Tool installation command line:
 
      `Setup.exe /configure configuration.xml`
 
-  * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
-  * **Progress** – While the installation files are imported, a progress bar is displayed on this page.
-  * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Application Wizard.
+   * **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
+   * **Progress** – While the installation files are imported, a progress bar is displayed on this page.
+   * **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Application Wizard.
 
 4. You should now see the **Office 2016 Click-to-Run** item under the **Applications** folder in the Deployment Workbench.
 
@@ -549,17 +558,17 @@ The next step in the process is to create the deployment task sequence. This tas
 To create the deployment task sequence, follow these steps:
 1. In the Deployment Workbench, under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard.
 2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard:
-  * **General Settings** – Enter an identifier for the deployment task sequence in the **Task Sequence ID** field, a name for the deployment task sequence in the **Task Sequence Name** field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, then click **Next**.
-  >[!NOTE]
-  >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
-  * **Select Template** – Click **Standard Client Task Sequence** from the drop-down menu, and then click **Next**.
-  * **Select OS** – Navigate to and select the reference image that you imported, and then click **Next**.
-  * **Specify Product Key** – Select the product key entry that fits your organization's licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**.
-  * **OS Settings** – Enter a name and organization for registration of Windows, and a home page URL for users when they browse the Internet in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**.
-  * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**.
-  * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence.
-  * **Progress** – While the task sequence is being created, a progress bar is displayed on this page.
-  * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard.
+   * **General Settings** – Enter an identifier for the deployment task sequence in the **Task Sequence ID** field, a name for the deployment task sequence in the **Task Sequence Name** field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, then click **Next**.
+     >[!NOTE]
+     >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
+   * **Select Template** – Click **Standard Client Task Sequence** from the drop-down menu, and then click **Next**.
+   * **Select OS** – Navigate to and select the reference image that you imported, and then click **Next**.
+   * **Specify Product Key** – Select the product key entry that fits your organization's licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**.
+   * **OS Settings** – Enter a name and organization for registration of Windows, and a home page URL for users when they browse the Internet in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**.
+   * **Admin Password** – Click **Use the Specified Local Administrator Password**, enter a password in the provided field, and then click **Next**.
+   * **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence.
+   * **Progress** – While the task sequence is being created, a progress bar is displayed on this page.
+   * **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete the New Task Sequence Wizard.
 
 After the task sequence is created it can be modified for increased automation, such as the installation of applications without user interaction, the selection of drivers, and the installation of Windows updates.
 
@@ -571,35 +580,35 @@ After the task sequence is created it can be modified for increased automation,
 6. Between the two **Windows Update** steps is the **Install Applications** step. Click the **Install Applications** step, and then click **Add**.
 7. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 21.
 
-   ![A new Install Application step in the deployment task sequence](images\surface-deploymdt-fig21.png "A new Install Application step in the deployment task sequence")
+   ![A new Install Application step in the deployment task sequence](images/surface-deploymdt-fig21.png "A new Install Application step in the deployment task sequence")
 
    *Figure 21. A new Install Application step in the deployment task sequence*
 
 8. On the **Properties** tab of the new **Install Application** step, enter **Install Microsoft Office 2016 Click-to-Run** in the **Name** field.
 9. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share.
-10.	Select Office 2016 Click-to-Run from the list of applications, and then click **OK**.
-11.	Repeat Steps 6 through 10 for the Surface app.
-12.	Expand the **Preinstall** folder, and then click the **Enable BitLocker (Offline)** step.
-13.	Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu.
+10. Select Office 2016 Click-to-Run from the list of applications, and then click **OK**.
+11. Repeat Steps 6 through 10 for the Surface app.
+12. Expand the **Preinstall** folder, and then click the **Enable BitLocker (Offline)** step.
+13. Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu.
 14. On the **Properties** tab of the new **Set Task Sequence Variable** step (as shown in Figure 22), configure the following options:
-  * **Name** – Set DriverGroup001
-  * **Task Sequence Variable** – DriverGroup001
-  * **Value** – Windows 10 x64\%Make%\%Model%
+    * **Name** – Set DriverGroup001
+    * **Task Sequence Variable** – DriverGroup001
+    * **Value** – Windows 10 x64\%Make%\%Model%
 
-   ![Configure a new Set Task Sequence Variable step in the deployment task sequence](images\surface-deploymdt-fig22.png "Configure a new Set Task Sequence Variable step in the deployment task sequence")
+    ![Configure a new Set Task Sequence Variable step in the deployment task sequence](images/surface-deploymdt-fig22.png "Configure a new Set Task Sequence Variable step in the deployment task sequence")
 
-   *Figure 22. Configure a new Set Task Sequence Variable step in the deployment task sequence*
+    *Figure 22. Configure a new Set Task Sequence Variable step in the deployment task sequence*
 
-15.	Select the **Inject Drivers** step, the next step in the task sequence.
-16.	On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 23), configure the following options:
-  * In the **Choose a selection profile** drop-down menu, select **Nothing**.
-  * Click the **Install all drivers from the selection profile** button.
+15. Select the **Inject Drivers** step, the next step in the task sequence.
+16. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 23), configure the following options:
+    * In the **Choose a selection profile** drop-down menu, select **Nothing**.
+    * Click the **Install all drivers from the selection profile** button.
 
-   ![Configure deployment task sequence not to choose the drivers to inject into Windows](images\surface-deploymdt-fig23.png "Configure deployment task sequence not to choose the drivers to inject into Windows")
+    ![Configure deployment task sequence not to choose the drivers to inject into Windows](images/surface-deploymdt-fig23.png "Configure deployment task sequence not to choose the drivers to inject into Windows")
 
-   *Figure 23. Configure the deployment task sequence not to choose the drivers to inject into Windows*
+    *Figure 23. Configure the deployment task sequence not to choose the drivers to inject into Windows*
 
-17.	Click **OK** to apply changes to the task sequence and close the task sequence properties window.
+17. Click **OK** to apply changes to the task sequence and close the task sequence properties window.
 
 ### Configure deployment share rules
 
@@ -615,20 +624,20 @@ To automate the boot media rules, follow these steps:
 2. Click the **Rules** tab, and then click **Edit Bootstrap.ini** to open Bootstrap.ini in Notepad.
 3. Replace the text of the Bootstrap.ini file with the following text:
 
-  ```
-  [Settings]
-  Priority=Model,Default
+   ```
+   [Settings]
+   Priority=Model,Default
 
-  [Surface Pro 4]
-  DeployRoot=\\STNDeployServer\DeploymentShare$
-  UserDomain=STNDeployServer
-  UserID=MDTUser
-  UserPassword=P@ssw0rd
-  SkipBDDWelcome=YES
+   [Surface Pro 4]
+   DeployRoot=\\STNDeployServer\DeploymentShare$
+   UserDomain=STNDeployServer
+   UserID=MDTUser
+   UserPassword=P@ssw0rd
+   SkipBDDWelcome=YES
 
-  [Surface Pro 4]
-  DeployRoot=\\STNDeployServer\DeploymentShare$
-  ```
+   [Surface Pro 4]
+   DeployRoot=\\STNDeployServer\DeploymentShare$
+   ```
 
 4. Press Ctrl+S to save Bootstrap.ini, and then close Notepad.
 
@@ -648,7 +657,7 @@ Rules used in the text shown in Step 3 include:
 
 The bulk of the rules used to automate the MDT deployment process are stored in the deployment share rules, or the Customsettings.ini file. In this file you can answer and hide all of the prompts from the Windows Deployment Wizard, which yields a deployment experience that mostly consists of a progress bar that displays the automated actions occurring on the device. The deployment share rules are shown directly in the **Rules** tab of the deployment share properties, as shown in Figure 24.
 
-![Deployment share rules configured for automation of the Windows Deployment Wizard](images\surface-deploymdt-fig24.png "Deployment share rules configured for automation of the Windows Deployment Wizard")
+![Deployment share rules configured for automation of the Windows Deployment Wizard](images/surface-deploymdt-fig24.png "Deployment share rules configured for automation of the Windows Deployment Wizard")
 
 *Figure 24. Deployment share rules configured for automation of the Windows Deployment Wizard*
 
@@ -738,10 +747,10 @@ To update the MDT boot media, follow these steps:
 
 1. Right-click the deployment share in the Deployment Workbench, and then click **Update Deployment Share** to start the Update Deployment Share Wizard.
 2. The Update Deployment Share Wizard displays a series of steps, as follows:
-  * **Options** – Choose between the **Completely Regenerate the Boot Images** or **Optimize the Boot Image Updating Process** options. Completely regenerating the boot images will take more time, but produces boot media that is not fragmented and does not contain out of date components. Optimizing the boot image updating process will proceed more quickly, but may result in longer load times when booting via PXE. Click **Next**.
-  * **Summary** – Review the specified options on this page before you click **Next** to begin the update of boot images.
-  * **Progress** – While the boot images are being updated a progress bar is displayed on this page.
-  * **Confirmation** – When the boot images have been updated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard.
+   * **Options** – Choose between the **Completely Regenerate the Boot Images** or **Optimize the Boot Image Updating Process** options. Completely regenerating the boot images will take more time, but produces boot media that is not fragmented and does not contain out of date components. Optimizing the boot image updating process will proceed more quickly, but may result in longer load times when booting via PXE. Click **Next**.
+   * **Summary** – Review the specified options on this page before you click **Next** to begin the update of boot images.
+   * **Progress** – While the boot images are being updated a progress bar is displayed on this page.
+   * **Confirmation** – When the boot images have been updated, the success of the process is displayed on this page. Click **Finish** to complete the Update Deployment Share Wizard.
 
 To import the updated MDT boot media into WDS for PXE boot, follow these steps:
 
@@ -750,17 +759,17 @@ To import the updated MDT boot media into WDS for PXE boot, follow these steps:
 3. Click the **Boot Images** folder.
 4. Right-click the existing MDT boot image, and then click **Replace Image** to open the Replace Boot Image Wizard.
 5. Replace the previously imported MDT boot image with the updated version by using these steps in the Replace Boot Image Wizard:
-  * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, click **LiteTouchPE_x86.wim**, and then click **Open**. Click **Next**.
-  * **Available Images** – Only one image should be listed and selected **LiteTouch Windows PE (x86)**, click **Next**.
-  * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options.
-  * **Summary** – Review your selections for importing a boot image into WDS, and then click **Next**.
-  * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Replace Boot Image Wizard.
+   * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, click **LiteTouchPE_x86.wim**, and then click **Open**. Click **Next**.
+   * **Available Images** – Only one image should be listed and selected **LiteTouch Windows PE (x86)**, click **Next**.
+   * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options.
+   * **Summary** – Review your selections for importing a boot image into WDS, and then click **Next**.
+   * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Replace Boot Image Wizard.
 6. Right-click the **Boot Images** folder, and then click **Add Image** to open the Add Image Wizard.
 7. Add the new 64-bit boot image for 64-bit UEFI device compatibility with the Add Image Wizard , as follows:
-  * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, select **LiteTouchPE_x64.wim**, and then click **Open**. Click **Next**.
-  * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options.
-  * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**.
-  * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard.
+   * **Image File** – Click **Browse** and navigate to the **Boot** folder in your deployment share, select **LiteTouchPE_x64.wim**, and then click **Open**. Click **Next**.
+   * **Image Metadata** – Enter a name and description for the MDT boot media, or click **Next** to accept the default options.
+   * **Summary** – Review your selections to import a boot image into WDS, and then click **Next**.
+   * **Task Progress** – A progress bar is displayed as the selected image file is copied into the WDS remote installation folder. Click **Finish** when the task is complete to close the Add Image Wizard.
 
 >[!NOTE]
 >Although it is a best practice to replace and update the boot images in WDS whenever the MDT deployment share is updated, for deployment to Surface devices the 32-bit boot image, LiteTouchPE_x86.wim, is not required. Only the 64-bit boot image is required for 64-bit UEFI devices.
@@ -772,7 +781,7 @@ With all of the automation provided by the deployment share rules and task seque
 >[!NOTE]
 >For the deployment to require only a single touch, the Surface devices must be connected to a keyboard, connected to the network with a Microsoft Surface USB Ethernet Adapter or Surface Dock, and configured with PXE boot as the first boot option, as shown in Figure 25.
 
-![Set boot priority for PXE boot](images\surface-deploymdt-fig25.png "Set boot priority for PXE boot")
+![Set boot priority for PXE boot](images/surface-deploymdt-fig25.png "Set boot priority for PXE boot")
 
 *Figure 25. Setting boot priority for PXE boot*
 
diff --git a/devices/surface/deploy.md b/devices/surface/deploy.md
index 69865822f6..68749b654c 100644
--- a/devices/surface/deploy.md
+++ b/devices/surface/deploy.md
@@ -5,17 +5,30 @@ ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: brecords
+author: dansimp
 ms.date: 10/02/2018
-ms.author: jdecker
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
+ms.localizationpriority: medium
+ms.audience: itpro
 ---
 
 # Deploy Surface devices
 
-Get deployment guidance for your Surface devices including information about Microsoft Deployment Toolkit (MDT), out-of-box-experience (OOBE) customization, Ethernet adaptors, Surface Deployment Accelerator, and the Battery Limit setting.
+Learn about about deploying ARM- and Intel-based Surface devices.
 
-## In this section
+## Deploying ARM-based devices
+
+| Topic | Description |
+| --- | --- |
+| [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md) | Get an overview of key considerations for deploying, managing, and servicing Surface Pro X running the Microsoft SQ1 ARM processor. |
+| [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) | Learn about Autopilot, the recommended method for deploying Surface Pro X. |
+| [Windows 10 ARM-based PC app compatibility](surface-pro-arm-app-performance.md) | Review app  compatibility guidance for Surface Pro X. |
+
+
+## Deploying Intel-based devices 
 
 | Topic | Description |
 | --- | --- |
@@ -28,22 +41,7 @@ Get deployment guidance for your Surface devices including information about Mic
 | [Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md)| See how Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices. |
 [Battery Limit setting](battery-limit.md) | Learn how to use Battery Limit, a UEFI setting that changes how the Surface device battery is charged and may prolong its longevity.
 
-
-
- 
-
 ## Related topics
 
-
-[Surface TechCenter](https://technet.microsoft.com/windows/surface)
-
-[Surface for IT pros blog](http://blogs.technet.com/b/surface/)
-
- 
-
- 
-
-
-
-
+[Surface IT Pro Blog](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/bg-p/SurfaceITPro)
 
diff --git a/devices/surface/docfx.json b/devices/surface/docfx.json
index 9bae9c245d..42faacbcac 100644
--- a/devices/surface/docfx.json
+++ b/devices/surface/docfx.json
@@ -1,39 +1,58 @@
 {
   "build": {
-    "content":
-      [
-        {
-          "files": ["**/**.md", "**/**.yml"],
-          "exclude": ["**/obj/**"]
-        }
-      ],
+    "content": [
+      {
+        "files": [
+          "**/**.md",
+          "**/**.yml"
+        ],
+        "exclude": [
+          "**/obj/**"
+        ]
+      }
+    ],
     "resource": [
-        {
-          "files": ["**/images/**"],
-          "exclude": ["**/obj/**"]
-        }
+      {
+        "files": [
+          "**/images/**"
+        ],
+        "exclude": [
+          "**/obj/**"
+        ]
+      }
     ],
     "globalMetadata": {
-		"uhfHeaderId": "MSDocsHeader-WindowsIT", 
-		"breadcrumb_path": "/surface/breadcrumb/toc.json",
-        "ROBOTS": "INDEX, FOLLOW",
-		"ms.technology": "windows",
-		"ms.topic": "article",
-		"ms.author": "jdecker",
-		"ms.date": "05/09/2017",
-		"feedback_system": "GitHub",
-		"feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
-		"feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
-		"_op_documentIdPathDepotMapping": {
-			"./": {
-			  "depot_name": "Win.surface"
-			}
-		}
+      "breadcrumb_path": "/surface/breadcrumb/toc.json",
+      "ROBOTS": "INDEX, FOLLOW",
+      "ms.technology": "windows",
+      "audience": "ITPro",
+      "ms.topic": "article",
+      "manager": "laurawi",
+      "ms.date": "05/09/2017",
+      "feedback_system": "GitHub",
+      "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
+      "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "Win.surface",
+          "folder_relative_path_in_docset": "./"
+        }
+      },
+      "contributors_to_exclude": [ 
+        "rjagiewich", 
+        "traya1", 
+        "rmca14", 
+        "claydetels19", 
+        "Kellylorenebaker",
+        "jborsecnik",
+        "tiburd",
+        "garycentric"
+      ],
+      "titleSuffix": "Surface"
     },
-    "externalReference": [
-    ],
+    "externalReference": [],
     "template": "op.html",
     "dest": "devices/surface",
-    "markdownEngineName": "dfm"
-  }
-}
\ No newline at end of file
+    "markdownEngineName": "markdig"
+}
+}
diff --git a/devices/surface/documentation/surface-system-sku-reference.md b/devices/surface/documentation/surface-system-sku-reference.md
new file mode 100644
index 0000000000..55a45cdd43
--- /dev/null
+++ b/devices/surface/documentation/surface-system-sku-reference.md
@@ -0,0 +1,55 @@
+---
+title: Surface System SKU reference
+description: This topic provides a reference of System SKU names that you can use to quickly determine the machine state of a specific device.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: coveminer
+ms.author: v-jokai
+ms.topic: article
+ms.date: 03/12/2019
+---
+# Surface System SKU Reference
+This document provides a reference of System SKU names that you can use to quickly determine the machine state of a specific device using PowerShell, WMI, and related tools. 
+
+System SKU is a variable (along with System Model and others) stored in System Management BIOS (SMBIOS) tables in the UEFI layer of Surface devices.  Use the System SKU name whenever you need to differentiate between devices with the same System Model name, such as Surface Pro and Surface Pro with LTE Advanced. 
+
+| **Device**| **System Model** | **System SKU**|
+| --- | ---| --- |
+| Surface 3 WiFI                                               | Surface 3        | Surface_3                        |
+| Surface 3 LTE AT&T                                           | Surface 3        | Surface_3_US1                    |
+| Surface 3 LTE Verizon                                        | Surface 3        | Surface_3_US2                    |
+| Surface 3 LTE North America                                  | Surface 3        | Surface_3_NAG                    |
+| Surface 3 LTE Outside of North America and T-Mobile In Japan | Surface 3        | Surface_3_ROW                    |
+| Surface Pro                                                  | Surface Pro      | Surface_Pro_1796                 |
+| Surface Pro with LTE Advanced                                | Surface Pro      | Surface_Pro_1807                 |
+| Surface Book 2 13inch                                        | Surface Book 2   | Surface_Book_1832                |
+| Surface Book 2 15inch                                        | Surface Book 2   | Surface_Book_1793                |
+| Surface Go Consumer                                          | Surface Go       | Surface_Go_1824_Consumer         |
+| Surface Go Commercial                                        | Surface Go       | Surface_Go_1824_Commercial       |
+| Surface Pro 6 Consumer                                       | Surface Pro 6    | Surface_Pro_6_1796_Consumer      |
+| Surface Pro 6 Commercial                                     | Surface Pro 6    | Surface_Pro_6_1796_Commercial    |
+| Surface Laptop 2 Consumer                                    | Surface Laptop 2 | Surface_Laptop_2_1769_Consumer   |
+| Surface Laptop 2 Commercial                                  | Surface Laptop 2 | Surface_Laptop_2_1769_Commercial |
+
+## Using System SKU variables 
+
+### PowerShell
+
+     gwmi -namespace root\wmi -class MS_SystemInformation | select SystemSKU 
+
+### System Information
+You can also find the System SKU and System Model for a device in System Information. 
+- Click **Start** >  **MSInfo32**.  
+
+### WMI
+You can use System SKU variables in a Task Sequence WMI Condition in the Microsoft Deployment Toolkit (MDT) or Microsoft Endpoint Configuration Manager. For example: 
+
+    - WMI Namespace – Root\WMI
+    - WQL Query – SELECT * FROM MS_SystemInformation WHERE SystemSKU = "Surface_Pro_1796"
+
+ 
+ 
+ 
+
+
diff --git a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md
index 7b2265c6f4..49e1bc555b 100644
--- a/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md
+++ b/devices/surface/enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md
@@ -2,14 +2,16 @@
 title: Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices (Surface)
 description: Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device.
 ms.assetid: A281EFA3-1552-467D-8A21-EB151E58856D
+ms.reviewer: 
+manager: dansimp
 keywords: network, wireless, device, deploy, authentication, protocol
 ms.localizationpriority: medium
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: miladCA
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
 ---
@@ -21,7 +23,7 @@ Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on yo
 
 If you use PEAP, EAP-FAST, or Cisco LEAP in your enterprise network, you probably already know that these three wireless authentication protocols are not supported by Surface devices out of the box. Some users may discover this when they attempt to connect to your wireless network; others may discover it when they are unable to gain access to resources inside the network, like file shares and internal sites. For more information, see [Extensible Authentication Protocol](https://technet.microsoft.com/network/bb643147).
 
-You can add support for each protocol by executing a small MSI package from a USB stick or from a file share. For organizations that want to enable EAP support on their Surface devices, the MSI package format supports deployment with many management and deployment tools, like the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager.
+You can add support for each protocol by executing a small MSI package from a USB stick or from a file share. For organizations that want to enable EAP support on their Surface devices, the MSI package format supports deployment with many management and deployment tools, like the Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager.
 
 ## Download PEAP, EAP-FAST, or Cisco LEAP installation files
 
diff --git a/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md b/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md
new file mode 100644
index 0000000000..b49b04d13a
--- /dev/null
+++ b/devices/surface/enable-surface-keyboard-for-windows-pe-deployment.md
@@ -0,0 +1,175 @@
+---
+title: How to enable the Surface Laptop keyboard during MDT deployment 
+description: When you use MDT to deploy Windows 10 to Surface laptops, you need to import keyboard drivers to use in the Windows PE environment.
+keywords: windows 10 surface, automate, customize, mdt
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.pagetype: surface
+ms.sitesec: library
+author: Teresa-Motiv
+ms.author: v-tea
+ms.topic: article
+ms.date: 01/30/2020
+ms.reviewer: scottmca
+ms.localizationpriority: medium
+ms.audience: itpro
+manager: jarrettr
+appliesto:
+- Surface Laptop (1st Gen)
+- Surface Laptop 2
+- Surface Laptop 3
+---
+
+# How to enable the Surface Laptop keyboard during MDT deployment
+
+This article addresses a deployment approach that uses Microsoft Deployment Toolkit (MDT). You can also apply this information to other deployment methodologies. On most types of Surface devices, the keyboard should work during Lite Touch Installation (LTI). However, Surface Laptop requires some additional drivers to enable the keyboard. For Surface Laptop (1st Gen) and Surface Laptop 2 devices, you must prepare the folder structure and selection profiles that allow you to specify keyboard drivers for use during the Windows Preinstallation Environment (Windows PE) phase of LTI. For more information about this folder structure, see [Deploy a Windows 10 image using MDT: Step 5: Prepare the drivers repository](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt?redirectedfrom=MSDN#step-5-prepare-the-drivers-repository).
+
+> [!NOTE]
+> It is currently not supported to add Surface Laptop 2 and Surface Laptop 3 keyboard drivers in the same Windows PE boot instance due to a driver conflict; use separate instances instead.
+
+> [!IMPORTANT]
+> If you are deploying a Windows 10 image to a Surface Laptop that has Windows 10 in S mode preinstalled, see KB [4032347, Problems when deploying Windows to Surface devices with preinstalled Windows 10 in S mode](https://support.microsoft.com/help/4032347/surface-preinstall-windows10-s-mode-issues).
+
+To add the keyboard drivers to the selection profile, follow these steps:
+
+1. Download the latest Surface Laptop MSI file from the appropriate locations:
+    - [Surface Laptop (1st Gen) Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=55489)
+    - [Surface Laptop 2 Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=57515)
+    - [Surface Laptop 3 with Intel Processor Drivers and Firmware](https://www.microsoft.com/download/details.aspx?id=100429)
+
+2. Extract the contents of the Surface Laptop MSI file to a folder that you can easily locate (for example, c:\surface_laptop_drivers). To extract the contents, open an elevated Command Prompt window and run the command from the following example:
+
+   ```cmd
+   Msiexec.exe /a SurfaceLaptop_Win10_15063_1703008_1.msi targetdir=c:\surface_laptop_drivers /qn
+   ```
+
+3. Open the Deployment Workbench and expand the **Deployment Shares** node and your deployment share, then navigate to the **WindowsPEX64** folder.
+
+   ![Image that shows the location of the WindowsPEX64 folder in the Deployment Workbench](./images/surface-laptop-keyboard-1.png)
+
+4. Right-click the **WindowsPEX64** folder and select **Import Drivers**.
+5. Follow the instructions in the Import Driver Wizard to import the driver folders into the WindowsPEX64 folder.  
+
+> [!NOTE]
+>  Check the downloaded MSI package to determine the format and directory structure.  The directory structure will start with either SurfacePlatformInstaller (older MSI files) or SurfaceUpdate (Newer MSI files) depending on when the MSI was released. 
+
+To support Surface Laptop (1st Gen), import the following folders:
+
+ - SurfacePlatformInstaller\Drivers\System\GPIO
+ - SurfacePlatformInstaller\Drivers\System\SurfaceHidMiniDriver
+ - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver
+ - SurfacePlatformInstaller\Drivers\System\PreciseTouch
+
+Or for newer MSI files beginning with "SurfaceUpdate", use:
+
+- SurfaceUpdate\SerialIOGPIO
+- SurfaceUpdate\SurfaceHidMiniDriver
+- SurfaceUpdate\SurfaceSerialHubDriver
+- SurfaceUpdate\Itouch
+
+To support Surface Laptop 2, import the following folders:
+
+ - SurfacePlatformInstaller\Drivers\System\GPIO
+ - SurfacePlatformInstaller\Drivers\System\SurfaceHIDMiniDriver
+ - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver
+ - SurfacePlatformInstaller\Drivers\System\I2C
+ - SurfacePlatformInstaller\Drivers\System\SPI
+ - SurfacePlatformInstaller\Drivers\System\UART
+ - SurfacePlatformInstaller\Drivers\System\PreciseTouch
+
+Or for newer MSI files beginning with "SurfaceUpdate", use:
+
+- SurfaceUpdate\SerialIOGPIO
+- SurfaceUpdate\IclSerialIOI2C
+- SurfaceUpdate\IclSerialIOSPI
+- SurfaceUpdate\IclSerialIOUART
+- SurfaceUpdate\SurfaceHidMini
+- SurfaceUpdate\SurfaceSerialHub
+- SurfaceUpdate\Itouch
+
+ 
+To support Surface Laptop 3 with Intel Processor, import the following folders:
+
+- SurfaceUpdate\IclSerialIOGPIO
+- SurfaceUpdate\IclSerialIOI2C
+- SurfaceUpdate\IclSerialIOSPI
+- SurfaceUpdate\IclSerialIOUART
+- SurfaceUpdate\SurfaceHidMini
+- SurfaceUpdate\SurfaceSerialHub
+- SurfaceUpdate\SurfaceHotPlug
+- SurfaceUpdate\Itouch
+    > [!NOTE]
+    >  Check the downloaded MSI package to determine the format and directory structure.  The directory structure will start with either SurfacePlatformInstaller (older MSI files) or SurfaceUpdate (Newer MSI files) depending on when the MSI was released. 
+
+    To support Surface Laptop (1st Gen), import the following folders:
+
+     - SurfacePlatformInstaller\Drivers\System\GPIO
+     - SurfacePlatformInstaller\Drivers\System\SurfaceHidMiniDriver
+     - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver
+     - SurfacePlatformInstaller\Drivers\System\PreciseTouch
+
+    Or for newer MSI files beginning with "SurfaceUpdate", use:
+
+    - SurfaceUpdate\SerialIOGPIO
+    - SurfaceUpdate\SurfaceHidMiniDriver
+    - SurfaceUpdate\SurfaceSerialHubDriver
+    - SurfaceUpdate\Itouch
+
+    To support Surface Laptop 2, import the following folders:
+
+     - SurfacePlatformInstaller\Drivers\System\GPIO
+     - SurfacePlatformInstaller\Drivers\System\SurfaceHIDMiniDriver
+     - SurfacePlatformInstaller\Drivers\System\SurfaceSerialHubDriver
+     - SurfacePlatformInstaller\Drivers\System\I2C
+     - SurfacePlatformInstaller\Drivers\System\SPI
+     - SurfacePlatformInstaller\Drivers\System\UART
+     - SurfacePlatformInstaller\Drivers\System\PreciseTouch
+
+    Or for newer MSI files beginning with "SurfaceUpdate", use:
+
+    - SurfaceUpdate\SerialIOGPIO
+    - SurfaceUpdate\IclSerialIOI2C
+    - SurfaceUpdate\IclSerialIOSPI
+    - SurfaceUpdate\IclSerialIOUART
+    - SurfaceUpdate\SurfaceHidMini
+    - SurfaceUpdate\SurfaceSerialHub
+    - SurfaceUpdate\Itouch
+
+    To support Surface Laptop 3 with Intel Processor, import the following folders:
+
+    - SurfaceUpdate\IclSerialIOGPIO
+    - SurfaceUpdate\IclSerialIOI2C
+    - SurfaceUpdate\IclSerialIOSPI
+    - SurfaceUpdate\IclSerialIOUART
+    - SurfaceUpdate\SurfaceHidMini
+    - SurfaceUpdate\SurfaceSerialHub
+    - SurfaceUpdate\SurfaceHotPlug
+    - SurfaceUpdate\Itouch
+
+    > [!NOTE]
+    > For Surface Laptop 3 with Intel processor, the model is Surface Laptop 3. The remaining Surface Laptop drivers are located in the \MDT Deployment Share\Out-of-Box Drivers\Windows10\X64\Surface Laptop 3 folder.
+
+6. Verify that the WindowsPEX64 folder now contains the imported drivers. The folder should resemble the following:  
+
+   ![Image that shows the newly imported drivers in the WindowsPEX64 folder of the Deployment Workbench](./images/surface-laptop-keyboard-2.png)
+
+7. Configure a selection profile that uses the WindowsPEX64 folder. The selection profile should resemble the following:  
+
+   ![Image that shows the WindowsPEX64 folder selected as part of a selection profile](./images/surface-laptop-keyboard-3.png)
+
+8. Configure the Windows PE properties of the MDT deployment share to use the new selection profile, as follows:  
+
+   - For **Platform**, select **x64**.
+   - For **Selection profile**, select the new profile.
+   - Select **Include all drivers from the selection profile**.
+   
+   ![Image that shows the Windows PE properties of the MDT Deployment Share](./images/surface-laptop-keyboard-4.png)
+
+9. Verify that you have configured the remaining Surface Laptop drivers by using either a selection profile or a **DriverGroup001** variable.  
+   - For Surface Laptop (1st Gen), the model is **Surface Laptop**. The remaining Surface Laptop drivers should reside in the \MDT Deployment Share\Out-of-Box Drivers\Windows10\X64\Surface Laptop folder as shown in the figure that follows this list.
+   - For Surface Laptop 2, the model is **Surface Laptop 2**. The remaining Surface Laptop drivers should reside in the \MDT Deployment Share\Out-of-Box Drivers\Windows10\X64\Surface Laptop 2 folder. 
+   - For Surface Laptop 3 with Intel processor, the model is Surface Laptop 3. The remaining Surface Laptop drivers are located in the \MDT Deployment Share\Out-of-Box Drivers\Windows10\X64\Surface Laptop 3 folder.
+
+   ![Image that shows the regular Surface Laptop (1st Gen) drivers in the Surface Laptop folder of the Deployment Workbench](./images/surface-laptop-keyboard-5.png)
+
+After configuring the MDT Deployment Share to use the new selection profile and related settings, continue the deployment process as described in [Deploy a Windows 10 image using MDT: Step 6: Create the deployment task sequence](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt#step-6-create-the-deployment-task-sequence).
diff --git a/devices/surface/enroll-and-configure-surface-devices-with-semm.md b/devices/surface/enroll-and-configure-surface-devices-with-semm.md
index 0c64b39169..50ecb3cb35 100644
--- a/devices/surface/enroll-and-configure-surface-devices-with-semm.md
+++ b/devices/surface/enroll-and-configure-surface-devices-with-semm.md
@@ -6,10 +6,14 @@ ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices, security
 ms.sitesec: library
-author: jobotto
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 01/06/2017
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Enroll and configure Surface devices with SEMM
@@ -18,6 +22,11 @@ With Microsoft Surface Enterprise Management Mode (SEMM), you can securely confi
 
 For a more high-level overview of SEMM, see [Microsoft Surface Enterprise Management Mode](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode).
 
+A streamlined method of managing firmware from the cloud on Surface Pro 7,Surface Pro X and Surface Laptop 3 is now available via public preview. For more information,refer to [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md).
+
+> [!NOTE]
+> SEMM is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md).
+
 #### Download and install Microsoft Surface UEFI Configurator
 The tool used to create SEMM packages is Microsoft Surface UEFI Configurator. You can download Microsoft Surface UEFI Configurator from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center.
 Run the Microsoft Surface UEFI Configurator Windows Installer (.msi) file to start the installation of the tool. When the installer completes, find Microsoft Surface UEFI Configurator in the All Apps section of your Start menu.
@@ -35,13 +44,13 @@ To create a Surface UEFI configuration package, follow these steps:
 2. Click **Start**.
 3. Click **Configuration Package**, as shown in Figure 1.
 
-   ![Create a package for SEMM enrollment](images\surface-ent-mgmt-fig1-uefi-configurator.png "Create a package for SEMM enrollment")
+   ![Create a package for SEMM enrollment](images/surface-ent-mgmt-fig1-uefi-configurator.png "Create a package for SEMM enrollment")
 
    *Figure 1. Select Configuration Package to create a package for SEMM enrollment and configuration*
 
 4. Click **Certificate Protection** to add your exported certificate file with private key (.pfx), as shown in Figure 2. Browse to the location of your certificate file, select the file, and then click **OK**.
 
-   ![Add the SEM certificate and Surface UEFI password to configuration package](images\surface-ent-mgmt-fig2-securepackage.png "Add the SEM certificate and Surface UEFI password to configuration package")
+   ![Add the SEM certificate and Surface UEFI password to configuration package](images/surface-ent-mgmt-fig2-securepackage.png "Add the SEM certificate and Surface UEFI password to configuration package")
 
    *Figure 2. Add the SEMM certificate and Surface UEFI password to a Surface UEFI configuration package*
 
@@ -50,31 +59,31 @@ To create a Surface UEFI configuration package, follow these steps:
 7. When you are prompted, enter and confirm your chosen password for Surface UEFI, and then click **OK**. If you want to clear an existing Surface UEFI password, leave the password field blank.
 8. If you do not want the Surface UEFI package to apply to a particular device, on the **Choose which Surface type you want to target** page, click the slider beneath the corresponding Surface Book or Surface Pro 4 image so that it is in the **Off** position. (As shown in Figure 3.)
 
-   ![Choose devices for package compatibility](images\surface-semm-enroll-fig3.png "Choose devices for package compatibility")
+   ![Choose devices for package compatibility](images/surface-semm-enroll-fig3.png "Choose devices for package compatibility")
 
    *Figure 3. Choose the devices for package compatibility*
 
 9. Click **Next**.
 10. If you want to deactivate a component on managed Surface devices, on the **Choose which components you want to activate or deactivate** page, click the slider next to any device or group of devices you want to deactivate so that the slider is in the **Off** position. (Shown in Figure 4.) The default configuration for each device is **On**. Click the **Reset** button if you want to return all sliders to the default position.
 
-   ![Disable or enable Surface components](images\surface-ent-mgmt-fig3-enabledisable.png "Disable or enable Surface components")
+    ![Disable or enable Surface components](images/surface-ent-mgmt-fig3-enabledisable.png "Disable or enable Surface components")
 
-   *Figure 4. Disable or enable individual Surface components*
+    *Figure 4. Disable or enable individual Surface components*
 
-11.	Click **Next**.
-12.	To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package.
+11. Click **Next**.
+12. To enable or disable advanced options in Surface UEFI or the display of Surface UEFI pages, on the **Choose the advanced settings for your devices** page, click the slider beside the desired setting to configure that option to **On** or **Off** (shown in Figure 5). In the **UEFI Front Page** section, you can use the sliders for **Security**, **Devices**, and **Boot** to control what pages are available to users who boot into Surface UEFI. (For more information about Surface UEFI settings, see [Manage Surface UEFI settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).) Click **Build** when you have finished selecting options to generate and save the package.
 
-   ![Control advanced Surface UEFI settings and Surface UEFI pages](images\surface-ent-mgmt-fig4-advancedsettings.png "Control advanced Surface UEFI settings and Surface UEFI pages")
+    ![Control advanced Surface UEFI settings and Surface UEFI pages](images/surface-ent-mgmt-fig4-advancedsettings.png "Control advanced Surface UEFI settings and Surface UEFI pages")
 
-   *Figure 5. Control advanced Surface UEFI settings and Surface UEFI pages with SEMM*
+    *Figure 5. Control advanced Surface UEFI settings and Surface UEFI pages with SEMM*
 
-13.	In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**.
-14.	When the package is created and saved, the **Successful** page is displayed.
+13. In the **Save As** dialog box, specify a name for the Surface UEFI configuration package, browse to the location where you would like to save the file, and then click **Save**.
+14. When the package is created and saved, the **Successful** page is displayed.
 
 >[!NOTE]
 >Record the certificate thumbprint characters that are displayed on this page, as shown in Figure 6. You will need these characters to confirm enrollment of new Surface devices in SEMM. Click **End** to complete package creation and close Microsoft Surface UEFI Configurator.
 
-![Display of certificate thumbprint characters](images\surface-ent-mgmt-fig5-success.png "Display of certificate thumbprint characters")
+![Display of certificate thumbprint characters](images/surface-ent-mgmt-fig5-success.png "Display of certificate thumbprint characters")
 
 *Figure 6. The last two characters of the certificate thumbprint are displayed on the Successful page*
 
@@ -86,7 +95,7 @@ Now that you have created your Surface UEFI configuration package, you can enrol
 ## Enroll a Surface device in SEMM
 When the Surface UEFI configuration package is executed, the SEMM certificate and Surface UEFI configuration files are staged in the firmware storage of the Surface device. When the Surface device reboots, Surface UEFI processes these files and begins the process of applying the Surface UEFI configuration or enrolling the Surface device in SEMM, as shown in Figure 7.
 
-![SEMM process for configuration of Surface UEFI or enrollment](images\surface-semm-enroll-fig7.png "SEMM process for configuration of Surface UEFI or enrollment")
+![SEMM process for configuration of Surface UEFI or enrollment](images/surface-semm-enroll-fig7.png "SEMM process for configuration of Surface UEFI or enrollment")
 
 *Figure 7. The SEMM process for configuration of Surface UEFI or enrollment of a Surface device*
 
@@ -98,12 +107,12 @@ To enroll a Surface device in SEMM with a Surface UEFI configuration package, fo
 2. Select the **I accept the terms in the License Agreement** check box to accept the End User License Agreement (EULA), and then click **Install** to begin the installation process.
 3. Click **Finish** to complete the Surface UEFI configuration package installation and restart the Surface device when you are prompted to do so.
 4. Surface UEFI will load the configuration file and determine that SEMM is not enabled on the device. Surface UEFI will then begin the SEMM enrollment process, as follows:
-  * Surface UEFI will verify that the SEMM configuration file contains a SEMM certificate.
-  * Surface UEFI will prompt you to enter to enter the last two characters of the certificate thumbprint to confirm enrollment of the Surface device in SEMM, as shown in Figure 8.
+   * Surface UEFI will verify that the SEMM configuration file contains a SEMM certificate.
+   * Surface UEFI will prompt you to enter to enter the last two characters of the certificate thumbprint to confirm enrollment of the Surface device in SEMM, as shown in Figure 8.
 
-  ![SEMM enrollment requires last two characters of certificate thumbprint](images\surface-semm-enroll-fig8.png "SEMM enrollment requires last two characters of certificate thumbprint")
+   ![SEMM enrollment requires last two characters of certificate thumbprint](images/surface-semm-enroll-fig8.png "SEMM enrollment requires last two characters of certificate thumbprint")
   
-  *Figure 8. Enrollment in SEMM requires the last two characters of the certificate thumbprint*
+   *Figure 8. Enrollment in SEMM requires the last two characters of the certificate thumbprint*
 
    * Surface UEFI will store the SEMM certificate in firmware and apply the configuration settings that are specified in the Surface UEFI configuration file.
    
@@ -111,31 +120,31 @@ To enroll a Surface device in SEMM with a Surface UEFI configuration package, fo
 
 You can verify that a Surface device has been successfully enrolled in SEMM by looking for **Microsoft Surface Configuration Package** in **Programs and Features** (as shown in Figure 9), or in the events stored in the **Microsoft Surface UEFI Configurator** log, found under **Applications and Services Logs** in Event Viewer (as shown in Figure 10).
 
-![Verify enrollment of Surface device in SEMM in Programs and Features](images\surface-semm-enroll-fig9.png "Verify enrollment of Surface device in SEMM in Programs and Features")
+![Verify enrollment of Surface device in SEMM in Programs and Features](images/surface-semm-enroll-fig9.png "Verify enrollment of Surface device in SEMM in Programs and Features")
 
 *Figure 9. Verify the enrollment of a Surface device in SEMM in Programs and Features*
 
-![Verify enrollment of Surface device in SEMM in Event Viewer](images\surface-semm-enroll-fig10.png "Verify enrollment of Surface device in SEMM in Event Viewer")
+![Verify enrollment of Surface device in SEMM in Event Viewer](images/surface-semm-enroll-fig10.png "Verify enrollment of Surface device in SEMM in Event Viewer")
 
 *Figure 10. Verify the enrollment of a Surface device in SEMM in Event Viewer*
 
 You can also verify that the device is enrolled in SEMM in Surface UEFI – while the device is enrolled, Surface UEFI will contain the **Enterprise management** page (as shown in Figure 11).
 
-![Surface UEFI Enterprise management page](images\surface-semm-enroll-fig11.png "Surface UEFI Enterprise management page")
+![Surface UEFI Enterprise management page](images/surface-semm-enroll-fig11.png "Surface UEFI Enterprise management page")
 
 *Figure 11. The Surface UEFI Enterprise management page*
 
 
 ## Configure Surface UEFI settings with SEMM
 
-After a device is enrolled in SEMM, you can run Surface UEFI configuration packages signed with the same SEMM certificate to apply new Surface UEFI settings. These settings are applied automatically the next time the device boots, without any interaction from the user. You can use application deployment solutions like System Center Configuration Manager to deploy Surface UEFI configuration packages to Surface devices to change or manage the settings in Surface UEFI.
+After a device is enrolled in SEMM, you can run Surface UEFI configuration packages signed with the same SEMM certificate to apply new Surface UEFI settings. These settings are applied automatically the next time the device boots, without any interaction from the user. You can use application deployment solutions like Microsoft Endpoint Configuration Manager to deploy Surface UEFI configuration packages to Surface devices to change or manage the settings in Surface UEFI.
 
-For more information about how to deploy Windows Installer (.msi) files with Configuration Manager, see [Deploy and manage applications with System Center Configuration Manager](https://technet.microsoft.com/library/mt627959).
+For more information about how to deploy Windows Installer (.msi) files with Configuration Manager, see [Deploy and manage applications with Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt627959).
 
 If you have secured Surface UEFI with a password, users without the password who attempt to boot to Surface UEFI will only have the **PC information**, **About**, **Enterprise management**, and **Exit** pages displayed to them.
 
 If you have not secured Surface UEFI with a password or a user enters the password correctly, settings that are configured with SEMM will be dimmed (unavailable) and the text Some settings are managed by your organization will be displayed at the top of the page, as shown in Figure 12.
 
-![Settings managed by SEMM disabled in Surface UEFI](images\surface-semm-enroll-fig12.png "Settings managed by SEMM disabled in Surface UEFI")
+![Settings managed by SEMM disabled in Surface UEFI](images/surface-semm-enroll-fig12.png "Settings managed by SEMM disabled in Surface UEFI")
 
 *Figure 12. Settings managed by SEMM will be disabled in Surface UEFI*
diff --git a/devices/surface/ethernet-adapters-and-surface-device-deployment.md b/devices/surface/ethernet-adapters-and-surface-device-deployment.md
index 46c4dda2d0..3c05a0d165 100644
--- a/devices/surface/ethernet-adapters-and-surface-device-deployment.md
+++ b/devices/surface/ethernet-adapters-and-surface-device-deployment.md
@@ -2,22 +2,25 @@
 title: Ethernet adapters and Surface deployment (Surface)
 description: This article provides guidance and answers to help you perform a network deployment to Surface devices.
 ms.assetid: 5273C59E-6039-4E50-96B3-426BB38A64C0
+ms.reviewer: 
+manager: dansimp
 keywords: ethernet, deploy, removable, network, connectivity, boot, firmware, device, adapter, PXE boot, USB
 ms.localizationpriority: medium
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: jobotto
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 07/27/2017
+ms.audience: itpro
+ms.date: 10/21/2019
 ---
 
 # Ethernet adapters and Surface deployment
 
 
-This article provides guidance and answers to help you perform a network deployment to Surface devices.
+This article provides guidance and answers to help you perform a network deployment to Surface devices including Surface Pro 3 and later.
 
 Network deployment to Surface devices can pose some unique challenges for system administrators. Due to the lack of a native wired Ethernet adapter, administrators must provide connectivity through a removable Ethernet adapter.
 
@@ -26,7 +29,7 @@ Network deployment to Surface devices can pose some unique challenges for system
 
 Before you can address the concerns of how you will boot to your deployment environment or how devices will be recognized by your deployment solution, you have to use a wired network adapter.
 
-The primary concern when selecting an Ethernet adapter is how that adapter will boot your Surface device from the network. If you are pre-staging clients with Windows Deployment Services (WDS) or if you are using System Center Configuration Manager, you may also want to consider whether the removable Ethernet adapters will be dedicated to a specific Surface device or shared among multiple devices. See the [Manage MAC addresses with removable Ethernet adapters](#manage-mac-addresses) section of this article for more information on potential conflicts with shared adapters.
+The primary concern when selecting an Ethernet adapter is how that adapter will boot your Surface device from the network. If you are pre-staging clients with Windows Deployment Services (WDS) or if you are using Microsoft Endpoint Configuration Manager, you may also want to consider whether the removable Ethernet adapters will be dedicated to a specific Surface device or shared among multiple devices. See the [Manage MAC addresses with removable Ethernet adapters](#manage-mac-addresses) section of this article for more information on potential conflicts with shared adapters.
 
 Booting from the network (PXE boot) is only supported when you use an Ethernet adapter or docking station from Microsoft. To boot from the network, the chipset in the Ethernet adapter or dock must be detected and configured as a boot device in the firmware of the Surface device. Microsoft Ethernet adapters, such as the Surface Ethernet Adapter and the [Surface Dock](https://www.microsoft.com/surface/accessories/surface-dock) use a chipset that is compatible with the Surface firmware.
 
@@ -48,7 +51,6 @@ Third-party Ethernet adapters are also supported for network deployment, althoug
 
 ## Boot Surface devices from the network
 
-
 To boot from the network or a connected USB stick, you must instruct the Surface device to boot from an alternate boot device. You can alter the boot order in the system firmware to prioritize USB boot devices, or you can instruct it to boot from an alternate boot device during the boot up process.
 
 To boot a Surface device from an alternative boot device, follow these steps:
diff --git a/devices/surface/get-started.md b/devices/surface/get-started.md
new file mode 100644
index 0000000000..c81e994d70
--- /dev/null
+++ b/devices/surface/get-started.md
@@ -0,0 +1,169 @@
+---
+title: Get started with Surface devices
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+layout: LandingPage
+ms.assetid: 
+ms.audience: itpro
+ms.tgt_pltfrm: na
+ms.devlang: na
+ms.topic: landing-page
+description: "Get started with Microsoft Surface devices"
+ms.localizationpriority: High
+---
+# Get started with Surface devices
+
+Harness the power of Surface, Windows, and Office connected together through the cloud. Find tools, step-by-step guides, and other resources to help you plan, deploy, and manage Surface for Business devices in your organization.
+
+
+
+
+---
+
+
\ No newline at end of file
diff --git a/devices/surface/images/Surface-Devices-400x140.svg b/devices/surface/images/Surface-Devices-400x140.svg
new file mode 100644
index 0000000000..4414de0f16
--- /dev/null
+++ b/devices/surface/images/Surface-Devices-400x140.svg
@@ -0,0 +1,25 @@
+
+
+
+
+Surface-Devices-400x140
+
+
+
+
+
+
+
+
+
+
+
diff --git a/devices/surface/images/Surface-Hub-400x140.svg b/devices/surface/images/Surface-Hub-400x140.svg
new file mode 100644
index 0000000000..f5a5c12a56
--- /dev/null
+++ b/devices/surface/images/Surface-Hub-400x140.svg
@@ -0,0 +1,51 @@
+
+
+
+
+win_it-pro-6
+
+
+
+
+
+
+
+
+
+
+
+
+	DevicesLaptopTablet-blue
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+	
+
+
diff --git a/devices/surface/images/Surface-Workplace-400x140.svg b/devices/surface/images/Surface-Workplace-400x140.svg
new file mode 100644
index 0000000000..9bb3779192
--- /dev/null
+++ b/devices/surface/images/Surface-Workplace-400x140.svg
@@ -0,0 +1,33 @@
+
+
+
+
+SharePoint_Doc_3_400x140
+
+	users_group
+	
+		
+			
+				
+				
+				
+				
+				
+				
+			
+		
+	
+
+
diff --git a/devices/surface/images/df1.png b/devices/surface/images/df1.png
new file mode 100644
index 0000000000..92aff587bc
Binary files /dev/null and b/devices/surface/images/df1.png differ
diff --git a/devices/surface/images/df2a.png b/devices/surface/images/df2a.png
new file mode 100644
index 0000000000..2a755ac374
Binary files /dev/null and b/devices/surface/images/df2a.png differ
diff --git a/devices/surface/images/df3.png b/devices/surface/images/df3.png
new file mode 100644
index 0000000000..c5263ce83f
Binary files /dev/null and b/devices/surface/images/df3.png differ
diff --git a/devices/surface/images/df3b.png b/devices/surface/images/df3b.png
new file mode 100644
index 0000000000..60370c5541
Binary files /dev/null and b/devices/surface/images/df3b.png differ
diff --git a/devices/surface/images/dfciconfig.png b/devices/surface/images/dfciconfig.png
new file mode 100644
index 0000000000..2e8b0b4fee
Binary files /dev/null and b/devices/surface/images/dfciconfig.png differ
diff --git a/devices/surface/images/fig1-downloads-msi.png b/devices/surface/images/fig1-downloads-msi.png
new file mode 100644
index 0000000000..4d8b1410ff
Binary files /dev/null and b/devices/surface/images/fig1-downloads-msi.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig10.png b/devices/surface/images/manage-surface-uefi-fig10.png
index 7d36f66808..daccc0efbb 100644
Binary files a/devices/surface/images/manage-surface-uefi-fig10.png and b/devices/surface/images/manage-surface-uefi-fig10.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig11.png b/devices/surface/images/manage-surface-uefi-fig11.png
index daccc0efbb..34d2dc5342 100644
Binary files a/devices/surface/images/manage-surface-uefi-fig11.png and b/devices/surface/images/manage-surface-uefi-fig11.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig12.png b/devices/surface/images/manage-surface-uefi-fig12.png
index 34d2dc5342..b7a58d16c2 100644
Binary files a/devices/surface/images/manage-surface-uefi-fig12.png and b/devices/surface/images/manage-surface-uefi-fig12.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig13.png b/devices/surface/images/manage-surface-uefi-fig13.png
index b7a58d16c2..ee4691bf9e 100644
Binary files a/devices/surface/images/manage-surface-uefi-fig13.png and b/devices/surface/images/manage-surface-uefi-fig13.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig14.png b/devices/surface/images/manage-surface-uefi-fig14.png
index 8845608fbd..8224fb5bab 100644
Binary files a/devices/surface/images/manage-surface-uefi-fig14.png and b/devices/surface/images/manage-surface-uefi-fig14.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig15.png b/devices/surface/images/manage-surface-uefi-fig15.png
new file mode 100644
index 0000000000..8973b83528
Binary files /dev/null and b/devices/surface/images/manage-surface-uefi-fig15.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig16.png b/devices/surface/images/manage-surface-uefi-fig16.png
new file mode 100644
index 0000000000..cac0f7c1c1
Binary files /dev/null and b/devices/surface/images/manage-surface-uefi-fig16.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig17.png b/devices/surface/images/manage-surface-uefi-fig17.png
new file mode 100644
index 0000000000..8b66d3605f
Binary files /dev/null and b/devices/surface/images/manage-surface-uefi-fig17.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig18.png b/devices/surface/images/manage-surface-uefi-fig18.png
new file mode 100644
index 0000000000..8845608fbd
Binary files /dev/null and b/devices/surface/images/manage-surface-uefi-fig18.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig19.png b/devices/surface/images/manage-surface-uefi-fig19.png
new file mode 100644
index 0000000000..8845608fbd
Binary files /dev/null and b/devices/surface/images/manage-surface-uefi-fig19.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig4.png b/devices/surface/images/manage-surface-uefi-fig4.png
index 67866fcbf0..e956cefeaf 100644
Binary files a/devices/surface/images/manage-surface-uefi-fig4.png and b/devices/surface/images/manage-surface-uefi-fig4.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig5.png b/devices/surface/images/manage-surface-uefi-fig5.png
index eae3212f76..00bb44ea76 100644
Binary files a/devices/surface/images/manage-surface-uefi-fig5.png and b/devices/surface/images/manage-surface-uefi-fig5.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig5a.png b/devices/surface/images/manage-surface-uefi-fig5a.png
new file mode 100644
index 0000000000..7baecb2fff
Binary files /dev/null and b/devices/surface/images/manage-surface-uefi-fig5a.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig6.png b/devices/surface/images/manage-surface-uefi-fig6.png
index a06c845a9c..e424e84f4b 100644
Binary files a/devices/surface/images/manage-surface-uefi-fig6.png and b/devices/surface/images/manage-surface-uefi-fig6.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig7.png b/devices/surface/images/manage-surface-uefi-fig7.png
index 9af6d1beed..b0a49134f3 100644
Binary files a/devices/surface/images/manage-surface-uefi-fig7.png and b/devices/surface/images/manage-surface-uefi-fig7.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig7a.png b/devices/surface/images/manage-surface-uefi-fig7a.png
new file mode 100644
index 0000000000..62e6536ea8
Binary files /dev/null and b/devices/surface/images/manage-surface-uefi-fig7a.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig8.png b/devices/surface/images/manage-surface-uefi-fig8.png
index d8c078cf59..2269fe6c17 100644
Binary files a/devices/surface/images/manage-surface-uefi-fig8.png and b/devices/surface/images/manage-surface-uefi-fig8.png differ
diff --git a/devices/surface/images/manage-surface-uefi-fig9.png b/devices/surface/images/manage-surface-uefi-fig9.png
index 2269fe6c17..7d36f66808 100644
Binary files a/devices/surface/images/manage-surface-uefi-fig9.png and b/devices/surface/images/manage-surface-uefi-fig9.png differ
diff --git a/devices/surface/images/manage-surface-uefi-figure-1.png b/devices/surface/images/manage-surface-uefi-figure-1.png
index b87279bdd5..cd5a789d70 100644
Binary files a/devices/surface/images/manage-surface-uefi-figure-1.png and b/devices/surface/images/manage-surface-uefi-figure-1.png differ
diff --git a/devices/surface/images/regeditDock.png b/devices/surface/images/regeditDock.png
new file mode 100644
index 0000000000..e074712665
Binary files /dev/null and b/devices/surface/images/regeditDock.png differ
diff --git a/devices/surface/images/sdt-install.png b/devices/surface/images/sdt-install.png
new file mode 100644
index 0000000000..ce0fe297d7
Binary files /dev/null and b/devices/surface/images/sdt-install.png differ
diff --git a/devices/surface/images/surface-laptop-keyboard-1.png b/devices/surface/images/surface-laptop-keyboard-1.png
new file mode 100644
index 0000000000..090ca2b58e
Binary files /dev/null and b/devices/surface/images/surface-laptop-keyboard-1.png differ
diff --git a/devices/surface/images/surface-laptop-keyboard-2.png b/devices/surface/images/surface-laptop-keyboard-2.png
new file mode 100644
index 0000000000..2a2cb8b3be
Binary files /dev/null and b/devices/surface/images/surface-laptop-keyboard-2.png differ
diff --git a/devices/surface/images/surface-laptop-keyboard-3.png b/devices/surface/images/surface-laptop-keyboard-3.png
new file mode 100644
index 0000000000..80ccc1fc3c
Binary files /dev/null and b/devices/surface/images/surface-laptop-keyboard-3.png differ
diff --git a/devices/surface/images/surface-laptop-keyboard-4.png b/devices/surface/images/surface-laptop-keyboard-4.png
new file mode 100644
index 0000000000..cf08e7a292
Binary files /dev/null and b/devices/surface/images/surface-laptop-keyboard-4.png differ
diff --git a/devices/surface/images/surface-laptop-keyboard-5.png b/devices/surface/images/surface-laptop-keyboard-5.png
new file mode 100644
index 0000000000..cf4bc9109c
Binary files /dev/null and b/devices/surface/images/surface-laptop-keyboard-5.png differ
diff --git a/devices/surface/images/uefidfci.png b/devices/surface/images/uefidfci.png
new file mode 100644
index 0000000000..ec95181145
Binary files /dev/null and b/devices/surface/images/uefidfci.png differ
diff --git a/devices/surface/images/wifi-band.png b/devices/surface/images/wifi-band.png
new file mode 100644
index 0000000000..38681a9dc8
Binary files /dev/null and b/devices/surface/images/wifi-band.png differ
diff --git a/devices/surface/images/wifi-roaming.png b/devices/surface/images/wifi-roaming.png
new file mode 100644
index 0000000000..eb539c9bd6
Binary files /dev/null and b/devices/surface/images/wifi-roaming.png differ
diff --git a/devices/surface/index.md b/devices/surface/index.md
index e559820d25..3d8e45e45e 100644
--- a/devices/surface/index.md
+++ b/devices/surface/index.md
@@ -1,63 +1,151 @@
+--- 
+title: Microsoft Surface documentation and resources
+layout: HubPage
+hide_bc: true
+description: Surface and Surface Hub documentation for admins & IT professionals
+author: greg-lindsay
+ms.author: greglin
+manager: laurawi
+ms.topic: hub-page
+keywords: Microsoft Surface, Microsoft Surface Hub, Surface documentation
+ms.localizationpriority: High
+audience: ITPro
+ms.prod: Surface
+description: Learn about Microsoft Surface and Surface Hub devices.
 ---
-title: Surface (Surface)
-description: 
-ms.assetid: 2a6aec85-b8e2-4784-8dc1-194ed5126a04
-ms.localizationpriority: high
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.pagetype: surface, devices
-ms.sitesec: library
-author: heatherpoulsen
-ms.author: jdecker
-ms.topic: article
-ms.date: 10/16/2017
----
-
-# Surface
-
-
-This library provides guidance to help you deploy Windows on Microsoft Surface devices, keep those devices up to date, and easily manage and support Surface devices in your organization.
-
-For more information on planning for, deploying, and managing Surface devices in your organization, see the [Surface TechCenter](https://technet.microsoft.com/windows/surface).
-
-## In this section
-
-| Topic | Description |
-| --- | --- |
-| [Deploy Surface devices](deploy.md) | Get deployment guidance for your Surface devices including information about MDT, OOBE customization, Ethernet adaptors, and Surface Deployment Accelerator. |
-| [Surface firmware and driver updates](update.md) | Find out how to download and manage the latest firmware and driver updates for your Surface device. |
-| [Considerations for Surface and System Center Configuration Manager](considerations-for-surface-and-system-center-configuration-manager.md) | Get guidance on how to deploy and manage Surface devices with System Center Configuration Manager. |
-| [Deploy Surface app with Microsoft Store for Business](deploy-surface-app-with-windows-store-for-business.md) | Find out how to add and download Surface app with Microsoft Store for Business, as well as install Surface app with PowerShell and MDT. |
-| [Enable PEAP, EAP-FAST, and Cisco LEAP on Surface devices](enable-peap-eap-fast-and-cisco-leap-on-surface-devices.md) | Find out how to enable support for PEAP, EAP-FAST, or Cisco LEAP protocols on your Surface device. |
-| [Manage Surface UEFI settings](manage-surface-uefi-settings.md) | Use Surface UEFI settings to enable or disable devices, configure security settings, and adjust Surface device boot settings. |
-| [Surface Enterprise Management Mode](surface-enterprise-management-mode.md) | See how this feature of Surface devices with Surface UEFI allows you to secure and manage firmware settings within your organization. |
-| [Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md) | Learn how to investigate, troubleshoot, and resolve hardware, software, and firmware issues with Surface devices. |
-| [Surface Data Eraser](microsoft-surface-data-eraser.md) | Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices. |
-| [Top support solutions for Surface devices](support-solutions-surface.md) | These are the top Microsoft Support solutions for common issues experienced using Surface devices in an enterprise. |
-| [Change history for Surface documentation](change-history-for-surface.md) | This topic lists new and updated topics in the Surface documentation library. |
-
-
-## Learn more
-
-[Certifying Surface Pro 4 and Surface Book as standard devices at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/849/Certifying-Surface-Pro-4-and-Surface-Book-as-standard-devices-at-Microsoft)
-
-
-
-
- 
-
-## Related topics
-
-
-[Surface TechCenter](https://technet.microsoft.com/windows/surface)
-
-[Surface for IT pros blog](http://blogs.technet.com/b/surface/)
-
- 
-
- 
-
-
-
-
-
+
diff --git a/devices/surface/ltsb-for-surface.md b/devices/surface/ltsb-for-surface.md
index 8c54cb0ffd..5e14c8444d 100644
--- a/devices/surface/ltsb-for-surface.md
+++ b/devices/surface/ltsb-for-surface.md
@@ -1,49 +1,36 @@
 ---
-title: Long-Term Servicing Branch for Surface devices (Surface)
+title: Long-Term Servicing Channel for Surface devices (Surface)
 description: LTSB is not supported for general-purpose Surface devices and should be used for specialized devices only.
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 04/25/2017
+ms.reviewer: 
+manager: dansimp
+ms.localizationpriority: medium
+ms.audience: itpro
 ---
 
-# Long-Term Servicing Branch (LTSB) for Surface devices
+# Long-Term Servicing Channel (LTSC) for Surface devices
 
 >[!WARNING]
 >For updated information on this topic, see [Surface device compatibility with Windows 10 Long-Term Servicing Channel](surface-device-compatibility-with-windows-10-ltsc.md). For additional information on this update, see the [Documentation Updates for Surface and Windows 10 LTSB Compatibility](https://blogs.technet.microsoft.com/surface/2017/04/11/documentation-updates-for-surface-and-windows-10-ltsb-compatibility) post on the Surface Blog for IT Pros.
 
-General-purpose Surface devices running Long-Term Servicing Branch (LTSB) are not supported. As a general guideline, if a Surface device runs productivity software, such as Microsoft Office, it is a general-purpose device that does not qualify for LTSB and should instead run Current Branch (CB) or Current Branch for Business (CBB). 
+General-purpose Surface devices in the Long-Term Servicing Channel (LTSC) are not supported. As a general guideline, if a Surface device runs productivity software, such as Microsoft Office, it is a general-purpose device that does not qualify for LTSC and should instead be on the Semi-Annual Channel. 
 
 >[!NOTE]
 >For more information about the servicing branches, see [Overview of Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview).
 
-LTSB prevents Surface devices from receiving critical Windows 10 feature updates and certain non-security servicing updates. Customers with poor experiences using Surface devices in the LTSB configuration will be instructed to upgrade to CB or CBB. Furthermore, the Windows 10 Enterprise LTSB edition removes core features of Surface devices, including seamless inking and touch-friendly applications. It does not contain key in-box applications including Microsoft Edge, OneNote, Calendar or Camera. Therefore, productivity is impacted and functionality is limited. LTSB is not supported as a suitable servicing solution for general-purpose Surface devices. 
-
-General-purpose Surface devices are intended to run CB or CBB to receive full servicing and firmware updates and forward compatibility with the introduction of new Surface features. With CB, feature updates are available as soon as Microsoft releases them. Customers in the CBB servicing model receive the same build of Windows 10 as those in CB, at a later date.
-
-Surface devices in specialized scenarios–such as PCs that control medical equipment, point-of-sale systems, and ATMs–may consider the use of LTSB. These special-purpose systems typically perform a single task and do not require feature updates as frequently as other devices in the organization. 
-
-
+LTSC prevents Surface devices from receiving critical Windows 10 feature updates and certain non-security servicing updates. Customers with poor experiences using Surface devices in the LTSC configuration will be instructed to switch to the Semi-Annual Channel. Furthermore, the Windows 10 Enterprise LTSB edition removes core features of Surface devices, including seamless inking and touch-friendly applications. It does not contain key in-box applications including Microsoft Edge, OneNote, Calendar or Camera. Therefore, productivity is impacted and functionality is limited. LTSC is not supported as a suitable servicing solution for general-purpose Surface devices. 
 
+General-purpose Surface devices are intended to run on the Semi-Annual Channel to receive full servicing and firmware updates and forward compatibility with the introduction of new Surface features. In the Semi-Annual Channel, feature updates are available as soon as Microsoft releases them.
 
+Surface devices in specialized scenarios–such as PCs that control medical equipment, point-of-sale systems, and ATMs–might consider the use of LTSC. These special-purpose systems typically perform a single task and do not require feature updates as frequently as other devices in the organization. 
 
 ## Related topics
 
-- [Surface TechCenter](https://technet.microsoft.com/windows/surface)
-
-- [Surface for IT pros blog](http://blogs.technet.com/b/surface/)
-
- 
-
- 
-
- 
-
-
-
-
+- [Surface IT Pro Blog](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/bg-p/SurfaceITPro)
 
diff --git a/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md b/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md
index ce172d5600..2631b5f837 100644
--- a/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md
+++ b/devices/surface/maintain-optimal-power-settings-on-Surface-devices.md
@@ -1,16 +1,20 @@
 ---
-title: Maintain optimal power settings 
-description: This topic provides best practice recommendations for maintaining optimal power settings and explains how Surface streamlines the power management experience. 
+title: Best practice power settings for Surface devices
+description: This topic provides best practice recommendations for maintaining optimal power settings and explains how Surface streamlines the power management experience. This article applies to all currently supported Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3. 
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
-author: coveminer
-ms.author: v-jokai
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 01/17/2019
+ms.reviewer: 
+manager: dansimp
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/28/2019
 ---
 
-# Maintain optimal power settings on Surface devices
+# Best practice power settings for Surface devices
 
 Surface devices are designed to take advantage of the latest advances in
 mobile device energy consumption to deliver a streamlined experience
@@ -20,9 +24,24 @@ components, momentarily waking up system components to handle background
 tasks -- such as an incoming email or network traffic -- before returning to a
 low power idle state (S0ix).
 
+## Summary of recommendations for IT administrators
+
+To ensure Surface devices across your organization fully benefit from Surface power optimization features:
+
+-  Install the latest  drivers and firmware from Windows Update or the Surface Driver and Firmware MSI. This creates the balanced power plan (aka power profile) by default and configures optimal power settings.  For more information, refer to [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md).
+- Avoid creating custom power profiles or adjusting advanced power settings not visible in the default UI  (**System** > **Power & sleep**).
+- If you must manage the power profile of devices across your network (such as in highly managed organizations), use the powercfg command tool to export the power plan from the factory image of the Surface device and then import it into the provisioning package for your Surface devices. 
+
+    >[!NOTE]
+    >You can only export a power plan across the same type of Surface device.  For example, you cannot export a power plan from Surface Laptop and import it on Surface Pro.  For more information, refer to [Configure power settings](https://docs.microsoft.com/windows-hardware/customize/power-settings/configure-power-settings).
+
+- Exclude Surface devices from any existing power management policy settings. 
+
+## Background
+
 The way Surface implements power management differs significantly from
 the earlier OS standard that gradually reduces and turns off power via a
-series of sleep states (S1, S2, S3).
+series of sleep states; for example, cycling through S1, S2, S3, and so on.
 
 Instead, Surface is imaged with a custom power profile that replaces
 legacy sleep and energy consumption functionality with modern standby
@@ -32,7 +51,12 @@ module (SAM). The SAM chip functions as the Surface device power-policy
 owner, using algorithms to calculate optimal power requirements. It
 works in conjunction with Windows power manager to allocate or throttle
 only the exact amount of power required for hardware components to
-function.
+function. This article applies to all currently supported Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3.
+
+## Utilizing the custom power profile in Surface
+
+If you go into the power options on a  surface device, you'll see that there's a single power plan available. This is the custom power profile. And if you go to the advanced power settings, you’ll see a much smaller subset of power options compared to a generic PC running Windows 10. Unlike generic devices, Surface has firmware and custom components to manage these power options.
+
 
 ## Modern Standby
 
@@ -42,14 +66,14 @@ instant on/instant off functionality typical of smartphones. S0ix, also
 known as Deepest Runtime Idle Platform State (DRIPS), is the default
 power mode for Surface devices. Modern standby has two modes:
 
-  - **Connected standby.** The default mode for up-to-the minute
-    delivery of emails, messaging, and cloud-synced data, connected
-    standby keeps Wi-Fi on and maintains network connectivity.
+- **Connected standby.** The default mode for up-to-the minute
+  delivery of emails, messaging, and cloud-synced data, connected
+  standby keeps Wi-Fi on and maintains network connectivity.
 
-  - **Disconnected standby.** An optional mode for extended battery
-    life, disconnected standby delivers the same instant-on experience
-    and saves power by turning off Wi-Fi, Bluetooth, and related network
-    connectivity.
+- **Disconnected standby.** An optional mode for extended battery
+  life, disconnected standby delivers the same instant-on experience
+  and saves power by turning off Wi-Fi, Bluetooth, and related network
+  connectivity.
 
 To learn more about modern standby, refer to the [Microsoft Hardware Dev
 Center](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby-wake-sources).
@@ -59,13 +83,13 @@ Center](https://docs.microsoft.com/windows-hardware/design/device-experiences/mo
 Surface integrates the following features designed to help users
 optimize the power management experience:
 
-  - [Singular power plan](#singular-power-plan)
+- [Singular power plan](#singular-power-plan)
 
-  - [Simplified power settings user
-    interface](#simplified-power-settings-user-interface)
+- [Simplified power settings user
+  interface](#simplified-power-settings-user-interface)
 
-  - [Windows performance power
-    slider](#windows-performance-power-slider)
+- [Windows performance power
+  slider](#windows-performance-power-slider)
 
 ### Singular power plan
 
@@ -76,6 +100,7 @@ experience by delivering a single power plan (balanced) that replaces
 the multiple power plans from standard Windows builds.
 
 ### Simplified power settings user interface
+
 Surface provides a simplified UI in accord with best practice power
 setting recommendations. In general, it's recommended to only adjust settings visible in the default user interface and avoid configuring advanced power settings or Group Policy settings. Using the default screen and sleep timeouts while avoiding maximum
 brightness levels are the most effective ways for users to maintain
@@ -101,7 +126,7 @@ Power slider enables four states as described in the following table:
 
 | Slider mode| Description |
 |---|---|
-| Battery saver| Helps conserve power and prolong battery life when the system is disconnected from a power source. When battery saver is on, some Windows features are disabled, throttled, or behave differently. Screen brightness is also reduced. Battery saver is only available when using battery power (DC). To learn more, see [Battery Saver](https://docs.microsoft.com/en-us/windows-hardware/design/component-guidelines/battery-saver).|
+| Battery saver| Helps conserve power and prolong battery life when the system is disconnected from a power source. When battery saver is on, some Windows features are disabled, throttled, or behave differently. Screen brightness is also reduced. Battery saver is only available when using battery power (DC). To learn more, see [Battery Saver](https://docs.microsoft.com/windows-hardware/design/component-guidelines/battery-saver).|
 | Recommended | Delivers longer battery life than the default settings in earlier versions of Windows. |
 | Better Performance | Slightly favors performance over battery life, functioning as the default slider mode. |
 | Best Performance | Favors performance over power for workloads requiring maximum performance and responsiveness, regardless of battery power consumption.|
@@ -141,15 +166,16 @@ To learn more, see:
 | Check app usage | Your apps | Close apps.|
 | Check your power cord for any damage.| Your power cord | Replace power cord if worn or damaged.|
 
-# Learn more 
+## Learn more 
 
--   [Modern
+- [Modern
     standby](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby-wake-sources)
 
 
 
--   [Customize the Windows performance power
+- [Customize the Windows performance power
     slider](https://docs.microsoft.com/windows-hardware/customize/desktop/customize-power-slider)
 
--   [Battery
+- [Battery
     saver](https://docs.microsoft.com/windows-hardware/design/component-guidelines/battery-saver)
+- [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md)
diff --git a/devices/surface/manage-surface-driver-and-firmware-updates.md b/devices/surface/manage-surface-driver-and-firmware-updates.md
new file mode 100644
index 0000000000..df0d5c2874
--- /dev/null
+++ b/devices/surface/manage-surface-driver-and-firmware-updates.md
@@ -0,0 +1,156 @@
+---
+title: Manage and deploy Surface driver and firmware updates 
+description: This article describes the available options to manage and deploy firmware and driver updates for Surface devices.
+ms.assetid: CD1219BA-8EDE-4BC8-BEEF-99B50C211D73
+ms.reviewer: 
+manager: dansimp
+keywords: Surface, Surface Pro 3, firmware, update, device, manage, deploy, driver, USB
+ms.localizationpriority: medium
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.pagetype: surface, devices
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.audience: itpro
+ms.date: 01/24/2020
+---
+
+# Manage and deploy Surface driver and firmware updates
+ 
+
+How you manage Surface driver and firmware updates varies depending on your environment and organizational requirements. On Surface devices, firmware is exposed to the operating system as a driver and is visible in Device Manager, enabling device firmware and drivers to be automatically updated using Windows Update or Windows Update for Business. Although this simplified approach may be feasible for startups and small or medium-sized businesses, larger organizations typically need IT admins to distributing updates internally. This may involve comprehensive planning, application compatibility testing, piloting and validating updates, before final approval and distribution across the network.
+
+> [!NOTE]
+> This article is intended for technical support agents and IT professionals and applies to Surface devices only. If you're looking for help to install Surface updates or firmware on a home device, see [Update Surface firmware and Windows 10](https://support.microsoft.com/help/4023505).
+ 
+While enterprise-grade software distribution solutions continue to evolve, the business rationale for centrally managing  updates remains the same: Maintain the security of Surface devices and keep them updated with the latest operating system and feature improvements. This is essential for maintaining the stability of your production environment and enabling users to stay productive. This article provides an overview of recommended tools and processes for larger organizations to accomplish these goals.
+
+## Central update management in commercial environments
+
+Microsoft has streamlined tools for managing devices – including driver and firmware updates -- into a single unified experience called [Microsoft Endpoint Manager admin center](https://devicemanagement.microsoft.com/) accessed from devicemanagement.microsoft.com.
+
+### Manage updates with Configuration Manager and Intune
+
+Microsoft Endpoint Configuration Manager allows you to synchronize and deploy Surface firmware and driver updates with the Configuration Manager client. Integration with Microsoft Intune lets you see all your managed, co-managed and partner-managed devices in one place. This is the recommended solution for large organizations to manage Surface updates.
+ 
+For detailed steps, see the following resources:
+
+- [How to manage Surface driver updates in Configuration Manager.](https://support.microsoft.com/help/4098906/manage-surface-driver-updates-in-configuration-manager)
+- [Deploy applications with Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/deploy-applications).
+- [Endpoint Configuration Manager documentation](https://docs.microsoft.com/configmgr/)
+
+
+### Manage updates with Microsoft Deployment Toolkit
+
+Included in Microsoft Endpoint Configuration Manager, the Microsoft Deployment Toolkit (MDT) contains optional deployment tools that you may wish to use depending on your environment. MDT includes the Windows Assessment and Deployment Kit (Windows ADK), Windows System Image Manager (Windows SIM), Deployment Image Servicing and Management (DISM), and User State Migration Tool (USMT). You can download the latest version of MDT from the [Microsoft Deployment Toolkit download page](https://www.microsoft.com/download/details.aspx?id=54259).
+ 
+For detailed steps, see the following resources:
+
+Surface driver and firmware updates are packaged as Windows Installer (MSI) files. To deploy these Windows Installer packages, you can use application deployment utilities such as the Microsoft Deployment Toolkit (MDT) or Microsoft Endpoint Configuration Manager. Such solutions provide the means for administrators to test and review updates before deploying them, and to centralize deployment. For each device, it is important to select the correct MSI file for the device and its operating system. For more information see [Deploy the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md).
+
+For instructions on how to deploy updates by using Microsoft Endpoint Configuration Manager refer to [Deploy applications with Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/deploy-applications). For instructions on how to deploy updates by using MDT, see [Deploy a Windows 10 image using MDT](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-a-windows-10-image-using-mdt).
+- [Microsoft Deployment Toolkit documentation](https://docs.microsoft.com/configmgr/mdt/)
+- [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit)
+- [Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit](https://docs.microsoft.com/surface/deploy-windows-10-to-surface-devices-with-mdt)  
+
+**WindowsPE and Surface firmware and drivers**
+
+Microsoft Endpoint Configuration Manager and MDT both use the Windows Preinstallation Environment (WindowsPE) during the deployment process. WindowsPE only supports a limited set of basic drivers such as those for network adapters and storage controllers. Drivers for Windows components that are not part of WindowsPE might produce errors. As a best practice, you can prevent such errors by configuring the deployment process to use only the required drivers during the WindowsPE phase.
+
+### Microsoft Endpoint Configuration Manager
+
+Starting in Microsoft Endpoint Configuration Manager, you can synchronize and deploy Microsoft Surface firmware and driver updates by using the Configuration Manager client. The process resembles that for deploying regular updates. For additional information, see KB 4098906, [How to manage Surface driver updates in Configuration Manager](https://support.microsoft.com/help/4098906/manage-surface-driver-updates-in-configuration-manager).
+## Supported devices
+Downloadable MSI files are available for Surface devices from Surface Pro 2 and later. Information about MSI files for the newest Surface devices such as Surface Pro 7, Surface Pro X, and Surface Laptop 3 will be available from this page upon release. 
+
+
+## Managing firmware with DFCI
+With Device Firmware Configuration Interface (DFCI) profiles built into Intune (now available in [public preview](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows)), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. For more information, see:
+ 
+
+- [Intune management of Surface UEFI settings](https://docs.microsoft.com/surface/surface-manage-dfci-guide)
+- [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333).
+
+## Best practices for update deployment processes
+
+To maintain a stable environment and keep users productive, it’s strongly recommended to maintain parity with the most recent version of Windows 10.  For best practice recommendations, see [Build deployment rings for Windows 10 updates](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates).
+
+## Downloadable Surface update packages
+
+Specific versions of Windows 10 have separate .msi files, each containing all required cumulative driver and firmware updates for Surface devices. Update packages may include some or all of the following components:
+
+- Wi-Fi and LTE
+- Video
+- Solid state drive
+- System aggregator module (SAM)
+- Battery
+- Keyboard controller
+- Embedded controller (EC)
+- Management engine (ME)
+- Unified extensible firmware interface (UEFI)
+
+
+### Downloading .msi files
+1. Browse to [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware) on the Microsoft Download Center.
+2. Select the .msi file name that matches the Surface model and version of Windows. The .msi file name includes the minimum supported Windows build number required to install the drivers and firmware. For example, as shown in the following figure, to update a Surface Book 2 with build 18362 of Windows 10, choose **SurfaceBook2_Win10_18362_19.101.13994.msi.** For a Surface Book 2 with build 16299 of Windows 10, choose **SurfaceBook2_Win10_16299_1803509_3.msi**.
+
+    ![Figure 1. Downloading Surface updates](images/fig1-downloads-msi.png)
+
+    *Figure 1. Downloading Surface updates*
+ 
+ 
+### Surface .msi naming convention
+Since August 2019, .msi files have used the following naming convention:
+
+- *Product*_*Windows release*_*Windows build number*_*Version number*_*Revision of version number (typically zero)*.
+
+**Example**
+
+- SurfacePro6_Win10_18362_19.073.44195_0.msi
+
+This file name provides the following information:
+
+- **Product:** SurfacePro6
+- **Windows release:** Win10
+- **Build:** 18362
+- **Version:** 19.073.44195 – This shows the date and time that the file was created, as follows:
+    - **Year:** 19 (2019)
+    - **Month and week:** 073 (third week of July)
+    - **Minute of the month:** 44195
+- **Revision of version:** 0 (first release of this version)
+
+### Legacy Surface .msi naming convention
+Legacy .msi files (files built before August 2019) followed the same overall naming formula but used a different method to derive the version number.
+ ****
+**Example**
+
+- SurfacePro6_Win10_16299_1900307_0.msi
+
+This file name provides the following information:
+
+- **Product:** SurfacePro6
+- **Windows release:** Win10
+- **Build:** 16299
+- **Version:** 1900307 – This shows the date that the file was created and its position in the release sequence, as follows:
+    - **Year:** 19 (2019)
+    - **Number of release:** 003 (third release of the year)
+    - **Product version number:** 07 (Surface Pro 6 is officially the seventh version of Surface Pro)
+- **Revision of version:** 0 (first release of this version)
+
+
+
+## Learn more
+
+- [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482/surface-download-drivers-and-firmware)
+- [How to manage Surface driver updates in Configuration Manager.](https://support.microsoft.com/help/4098906/manage-surface-driver-updates-in-configuration-manager)
+- [Deploy applications with Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/deploy-applications).
+- [Endpoint Configuration Manager documentation](https://docs.microsoft.com/configmgr/)
+- [Microsoft Deployment Toolkit documentation](https://docs.microsoft.com/configmgr/mdt/)
+- [Deploy Windows 10 with the Microsoft Deployment Toolkit](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit)
+- [Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit](https://docs.microsoft.com/surface/deploy-windows-10-to-surface-devices-with-mdt)  
+- [Intune management of Surface UEFI settings](https://docs.microsoft.com/surface/surface-manage-dfci-guide)
+- [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333).
+- [Build deployment rings for Windows 10 updates](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates)
+
diff --git a/devices/surface/manage-surface-pro-3-firmware-updates.md b/devices/surface/manage-surface-pro-3-firmware-updates.md
deleted file mode 100644
index 680e04d830..0000000000
--- a/devices/surface/manage-surface-pro-3-firmware-updates.md
+++ /dev/null
@@ -1,75 +0,0 @@
----
-title: Manage Surface driver and firmware updates (Surface)
-description: This article describes the available options to manage firmware and driver updates for Surface devices.
-ms.assetid: CD1219BA-8EDE-4BC8-BEEF-99B50C211D73
-keywords: Surface, Surface Pro 3, firmware, update, device, manage, deploy, driver, USB
-ms.localizationpriority: medium
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.pagetype: surface, devices
-ms.sitesec: library
-author: jobotto
-ms.author: jdecker
-ms.topic: article
-ms.date: 07/27/2017
----
-
-# Manage Surface driver and firmware updates
-
-
-This article describes the available options to manage firmware and driver updates for Surface devices.
-
-For a list of the available downloads for Surface devices and links to download the drivers and firmware for your device, see [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md).
-
-On Surface devices, the firmware is exposed to the operating system as a driver and is visible in Device Manager. This allows a Surface device firmware to be automatically updated along with all drivers through Windows Update. This mechanism provides a seamless, automatic experience to receive the latest firmware and driver updates. Although automatic updating is easy for end users, updating firmware and drivers automatically may not always apply to organizations and businesses. Automatic updates with Windows Update may not be applicable where updates are carefully managed, or when you deploy a new operating system to a Surface device.
-
-## Methods for firmware deployment
-
-
-Although firmware is provided automatically by Windows Update for computers that receive updates directly from Microsoft, in environments where updates are carefully managed by using Windows Server Update Services (WSUS), updating the firmware through Windows Update is not supported. For managed environments, there are a number of options you can use to deploy firmware updates.
-
-**Windows Update**
-
-The simplest solution to ensure that firmware on Surface devices in your organization is kept up to date is to allow Surface devices to receive updates directly from Microsoft. You can implement this solution easily by excluding Surface devices from Group Policy that directs computers to receive updates from WSUS.
-
-Although this solution ensures that firmware will be updated as new releases are made available to Windows Update, it does present potential drawbacks. Each Surface device that receives Windows Updates directly will separately download each update rather than accessing a central location, which increases demand on Internet connectivity and bandwidth. Updates are also provided automatically to devices, without being subjected to testing or review by administrators.
-
-For details about Group Policy for client configuration of WSUS or Windows Update, see [Step 5: Configure Group Policy Settings for Automatic Updates](https://technet.microsoft.com/library/dn595129).
-
-**Windows Installer Package**
-
-The firmware and driver downloads for Surface devices now include Windows Installer files for firmware and driver updates. These Windows Installer packages can be deployed with utilities that support application deployment, including the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. This solution allows for centralized deployment and for administrators to test and review firmware updates before they are deployed. For more information about the Windows Installer package delivery method for firmware and driver updates, including details on what drivers are updated by the package and why certain drivers and firmware are not updated by the Windows Installer package, see the [Surface Pro 3 MSI Now Available](https://blogs.technet.microsoft.com/surface/2015/03/04/surface-pro-3-msi-now-available/) blog post.
-
-For instructions on how to deploy with System Center Configuration Manager, refer to [How to Deploy Applications in Configuration Manager](https://technet.microsoft.com/library/gg682082). For deployment of applications with MDT, see [Step 4: Add an application in the Deploy a Windows 8.1 Image Using MDT 2013](https://technet.microsoft.com/library/dn744279#sec04). Note that you can deploy applications separately from an operating system deployment through MDT by using a Post OS Installation task sequence.
-
-**Provisioning packages**
-
-New in Windows 10, provisioning packages (PPKG files) provide a simple method to apply a configuration to a destination device. You can find out more about provisioning packages, including instructions for how to create your own, in [Provisioning packages](https://technet.microsoft.com/itpro/windows/deploy/provisioning-packages). For easy application of a complete set of drivers and firmware to devices running Windows 10, a provisioning package is supplied for Surface Pro 3 devices. This file contains all of the instructions and required assets to update a Surface Pro 3 device with Windows 10 to the latest drivers and firmware.
-
-**Windows PowerShell**
-
-Another method you can use to update the firmware when Windows Updates are managed in the organization is to install the firmware from the firmware and driver pack by using PowerShell. This method allows for a similar deployment experience to the Windows Installer package and can similarly be deployed as a package by using System Center Configuration Manager. You can find the PowerShell script and details on how to perform the firmware deployment in the [Deploying Drivers and Firmware to Surface Pro](https://blogs.technet.microsoft.com/deploymentguys/2013/05/16/deploying-drivers-and-firmware-to-surface-pro/) blog post.
-
-## Operating system deployment considerations
-
-
-The deployment of firmware updates during an operating system deployment is a straightforward process. The firmware and driver pack can be imported into either System Center Configuration Manager or MDT, and are used to deploy a fully updated environment, complete with firmware, to a target Surface device. For a complete step-by-step guide for deployment to Surface Pro 3 using either Configuration Manager or MDT, download the [Deployment and Administration Guide for Surface Pro 3](https://www.microsoft.com/download/details.aspx?id=45292) from the Microsoft Download Center.
-
-The individual driver files are also made available in the Microsoft Download Center if you are using deployment tools. The driver files are available in the ZIP archive file in the list of available downloads for your device.
-
-**Windows PE and Surface firmware and drivers**
-
-A best practice for deployment with any solution that uses the Windows Preinstallation Environment (WinPE), such as System Center Configuration Manager or MDT, is to configure WinPE with only the drivers that are required during the WinPE stage of deployment. These usually include drivers for network adapters and storage controllers. This best practice helps to prevent errors with more complex drivers that rely on components that are not present in WinPE. For Surface Pro 3 devices, this is especially true of the Touch Firmware. The Touch Firmware should never be loaded in a WinPE environment on Surface Pro 3.
-
-**Update Surface Pro 3 firmware offline through USB**
-
-In some early versions of Surface Pro 3 firmware, PXE boot performance can be quite slow. This has been resolved with updated firmware, but for organizations where firmware will be updated through operating system deployment, this issue is encountered before the updates can be deployed to the device. In this scenario, you can deploy updated firmware through a USB drive to ensure that when the operating system deployment is initiated, the network boot is quick, and deployment can complete in a timely fashion. To create a USB drive to update Surface Pro 3 firmware, see [How to Update the Surface Pro 3 Firmware Offline using a USB Drive](https://blogs.technet.microsoft.com/askpfeplat/2014/10/19/how-to-update-the-surface-pro-3-firmware-offline-using-a-usb-drive/) on the Ask Premier Field Engineering (PFE) Platforms TechNet Blog.
-
- 
-
- 
-
-
-
-
-
diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md
index aa003e15fa..d205908048 100644
--- a/devices/surface/manage-surface-uefi-settings.md
+++ b/devices/surface/manage-surface-uefi-settings.md
@@ -7,26 +7,35 @@ ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: devices, surface
-author: miladCA
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 07/27/2017
+ms.reviewer: 
+manager: dansimp
 ---
 
-#Manage Surface UEFI settings
+# Manage Surface UEFI settings
 
-Current and future generations of Surface devices, including Surface Pro 4, Surface Book, and Surface Studio, use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings. 
+All current and future generations of Surface devices use a unique Unified Extensible Firmware Interface (UEFI) engineered by Microsoft specifically for these devices. Surface UEFI settings provide the ability to enable or disable built-in devices and components, protect UEFI settings from being changed, and adjust the Surface device boot settings. 
 
->[!NOTE]
->Surface Pro 3, Surface 3, Surface Pro 2, Surface 2, Surface Pro, and Surface do not use the Surface UEFI and instead use firmware provided by third-party manufacturers, such as AMI.
+## Support for cloud-based management
 
-You can enter the Surface UEFI settings on your Surface device by pressing the **Volume Up** button and the **Power** button simultaneously. Hold the **Volume Up** button until the Surface logo is displayed, which indicates that the device has begun to boot. 
+With Device Firmware Configuration Interface (DFCI) profiles built into Microsoft Intune (now available in public preview), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. DFCI is currently available for Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information, refer to [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md).
 
-##PC information 
+## Open Surface UEFI menu
 
-On the **PC information** page, detailed information about your Surface device is provided: 
+To adjust UEFI settings during system startup:
 
-- **Model** – Your Surface device’s model will be displayed here, such as Surface Book or Surface Pro 4. The exact configuration of your device is not shown, (such as processor, disk size, or memory size). 
+1. Shut down your Surface and wait about 10 seconds to make sure it's off.
+2. Press and hold the **Volume-up** button  and - at the same time - press and release the **Power button.**
+3. As the Microsoft or Surface logo appears on your screen, continue to hold the **Volume-up** button until the UEFI screen appears.
+
+## UEFI PC information page
+
+The PC information page includes detailed information about your Surface device: 
+
+- **Model** – Your Surface device’s model will be displayed here, such as Surface Book 2 or Surface Pro 7. The exact configuration of your device is not shown, (such as processor, disk size, or memory size). 
 - **UUID** – This Universally Unique Identification number is specific to your device and is used to identify the device during deployment or management. 
 
 - **Serial Number** – This number is used to identify this specific Surface device for asset tagging and support scenarios.
@@ -50,9 +59,9 @@ You will also find detailed information about the firmware of your Surface devic
 
 You can find up-to-date information about the latest firmware version for your Surface device in the [Surface Update History](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) for your device. 
 
-##Security 
+## UEFI Security page 
 
-On the **Security** page of Surface UEFI settings, you can set a password to protect UEFI settings. This password must be entered when you boot the Surface device to UEFI. The password can contain the following characters (as shown in Figure 2): 
+The Security page allows you to set a password to protect UEFI settings. This password must be entered when you boot the Surface device to UEFI. The password can contain the following characters (as shown in Figure 2): 
 
 - Uppercase letters: A-Z 
 
@@ -68,21 +77,21 @@ The password must be at least 6 characters and is case sensitive.
 
 *Figure 2. Add a password to protect Surface UEFI settings*
 
-On the **Security** page you can also change the configuration of Secure Boot on your Surface device. Secure Boot technology prevents unauthorized boot code from booting on your Surface device, which protects against bootkit and rootkit-type malware infections. You can disable Secure Boot to allow your Surface device to boot third-party operating systems or bootable media. You can also configure Secure Boot to work with third-party certificates, as shown in Figure 3. Read more about [Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) in the TechNet Library.
+On the Security page you can also change the configuration of Secure Boot on your Surface device. Secure Boot technology prevents unauthorized boot code from booting on your Surface device, which protects against bootkit and rootkit-type malware infections. You can disable Secure Boot to allow your Surface device to boot third-party operating systems or bootable media. You can also configure Secure Boot to work with third-party certificates, as shown in Figure 3. Read more about [Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) in the TechNet Library.
 
 ![Configure Secure Boot](images/manage-surface-uefi-fig3.png "Configure Secure Boot")
 
 *Figure 3. Configure Secure Boot*
 
-You can also enable or disable the Trusted Platform Module (TPM) device on the **Security** page, as shown in Figure 4. The TPM is used to authenticate encryption for your device’s data with BitLocker. Read more about [BitLocker](https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-overview) in the TechNet Library. 
+You can also enable or disable the Trusted Platform Module (TPM) device on the Security page, as shown in Figure 4. The TPM is used to authenticate encryption for your device’s data with BitLocker. Read more about [BitLocker](https://technet.microsoft.com/itpro/windows/keep-secure/bitlocker-overview) in the TechNet Library. 
 
 ![Configure Surface UEFI security settings](images/manage-surface-uefi-fig4.png "Configure Surface UEFI security settings")
 
 *Figure 4. Configure Surface UEFI security settings*
 
-##Devices 
+## UEFI menu: Devices 
 
-On the **Devices** page you can enable or disable specific devices and components of your Surface device. Devices that you can enable or disable on this page include: 
+The Devices page allows you to  enable or disable specific devices and components including:
 
 - Docking and USB Ports 
 
@@ -100,13 +109,13 @@ On the **Devices** page you can enable or disable specific devices and component
 
 Each device is listed with a slider button that you can move to **On** (enabled) or **Off** (disabled) position, as shown in Figure 5. 
 
-![Enable and disable specific devices](images/manage-surface-uefi-fig5.png "Enable and disable specific devices")
+![Enable and disable specific devices](images/manage-surface-uefi-fig5a.png "Enable and disable specific devices")
 
 *Figure 5. Enable and disable specific devices*
 
-##Boot configuration 
+## UEFI menu: Boot configuration 
 
-On the **Boot Configuration** page, you can change the order of your boot devices and/or enable or disable boot of the following devices: 
+The Boot Configuration page allows you to change the order of your boot devices as well as enable or disable boot of the following devices: 
 
 - Windows Boot Manager 
 
@@ -126,52 +135,83 @@ For the specified boot order to take effect, you must set the **Enable Alternate
 
 You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE Network Boot** option, for example when performing a Windows deployment using PXE where the PXE server is configured for IPv4 only.  
 
-##About 
+## UEFI menu: Management
+The Management page allows you to manage use of Zero Touch UEFI Management and other features on eligible devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3.  
 
-The **About** page displays regulatory information, such as compliance with FCC rules, as shown in Figure 7. 
+![Manage access to Zero Touch UEFI Management and other features](images/manage-surface-uefi-fig7a.png "Manage access to Zero Touch UEFI Management and other features")
+*Figure 7. Manage access to Zero Touch UEFI Management and other features* 
 
-![Regulatory information displayed on the About page](images/manage-surface-uefi-fig7.png "Regulatory information displayed on the About page")
 
-*Figure 7. Regulatory information displayed on the About page*
+Zero Touch UEFI Management lets you remotely manage UEFI settings  by using a device profile within Intune called Device Firmware Configuration Interface (DFCI). If you do not configure this setting, the ability to manage eligible devices with DFCI is set to **Ready**. To prevent DFCI, select **Opt-Out**. 
 
-##Exit 
+> [!NOTE]
+> The UEFI Management settings page and use of DFCI is only available on Surface Pro 7, Surface Pro X, and Surface Laptop 3.  
+
+For more information, refer to [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md).
+
+## UEFI menu: Exit 
 
 Use the **Restart Now** button on the **Exit** page to exit UEFI settings, as shown in Figure 8. 
 
-![Exit Surface UEFI and restart the device](images/manage-surface-uefi-fig8.png "Exit Surface UEFI and restart the device")
+![Exit Surface UEFI and restart the device](images/manage-surface-uefi-fig7.png "Exit Surface UEFI and restart the device")
 
 *Figure 8. Click Restart Now to exit Surface UEFI and restart the device*
 
 ## Surface UEFI boot screens
 
-When you update Surface device firmware, by using either Windows Update or manual installation, the updates are not applied immediately to the device, but instead during the next reboot cycle. You can find out more about the Surface firmware update process in [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates). The progress of the firmware update is displayed on a screen with progress bars of differing colors to indicate the firmware for each component. Each component’s progress bar is shown in Figures 9 through 13.
+When you update Surface device firmware, by using either Windows Update or manual installation, the updates are not applied immediately to the device, but instead during the next reboot cycle. You can find out more about the Surface firmware update process in [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates). The progress of the firmware update is displayed on a screen with progress bars of differing colors to indicate the firmware for each component. Each component’s progress bar is shown in Figures 9 through 18.
 
-![Surface UEFI firmware update with blue progress bar](images/manage-surface-uefi-fig9.png "Surface UEFI firmware update with blue progress bar")
+![Surface UEFI firmware update with blue progress bar](images/manage-surface-uefi-fig8.png "Surface UEFI firmware update with blue progress bar")
 
 *Figure 9. The Surface UEFI firmware update displays a blue progress bar*
 
-![System Embedded Controller firmware with green progress bar](images/manage-surface-uefi-fig10.png "System Embedded Controller firmware with green progress bar")
+![System Embedded Controller firmware with green progress bar](images/manage-surface-uefi-fig9.png "System Embedded Controller firmware with green progress bar")
 
 *Figure 10. The System Embedded Controller firmware update displays a green progress bar*
 
-![SAM Controller firmware update with orange progress bar](images/manage-surface-uefi-fig11.png "SAM Controller firmware update with orange progress bar")
+![SAM Controller firmware update with orange progress bar](images/manage-surface-uefi-fig10.png "SAM Controller firmware update with orange progress bar")
 
 *Figure 11. The SAM Controller firmware update displays an orange progress bar*
 
-![Intel Management Engine firmware with red progress bar](images/manage-surface-uefi-fig12.png "Intel Management Engine firmware with red progress bar")
+![Intel Management Engine firmware with red progress bar](images/manage-surface-uefi-fig11.png "Intel Management Engine firmware with red progress bar")
 
 *Figure 12. The Intel Management Engine firmware update displays a red progress bar*
 
-![Surface touch firmware with gray progress bar](images/manage-surface-uefi-fig13.png "Surface touch firmware with gray progress bar")
+![Surface touch firmware with gray progress bar](images/manage-surface-uefi-fig12.png "Surface touch firmware with gray progress bar")
 
 *Figure 13. The Surface touch firmware update displays a gray progress bar*
+
+![Surface KIP firmware with light green progress bar](images/manage-surface-uefi-fig13.png "Surface touch firmware with light green progress bar")
+
+*Figure 14. The Surface KIP firmware update displays a light green progress bar*
+
+![Surface ISH firmware with pink progress bar](images/manage-surface-uefi-fig14.png "Surface ISH firmware with pink progress bar")
+
+*Figure 15. The Surface ISH firmware update displays a light pink progress bar*
+
+![Surface Trackpad firmware with gray progress bar](images/manage-surface-uefi-fig15.png "Surface Trackpad firmware with gray progress bar")
+
+*Figure 16. The Surface Trackpad firmware update displays a pink progress bar*
+
+![Surface TCON firmware with light gray progress bar](images/manage-surface-uefi-fig16.png "Surface TCON firmware with light gray progress bar")
+
+*Figure 17. The Surface TCON firmware update displays a light gray progress bar*
+
+
+![Surface TPM firmware with light purple progress bar](images/manage-surface-uefi-fig17.png "Surface TPM firmware with purple progress bar")
+
+*Figure 18. The Surface TPM firmware update displays a purple progress bar*
+
+
 >[!NOTE]
->An additional warning message that indicates Secure Boot is disabled is displayed, as shown in Figure 14.
+>An additional warning message that indicates Secure Boot is disabled is displayed, as shown in Figure 19.
 
-![Surface boot screen that indicates Secure Boot has been disabled](images/manage-surface-uefi-fig14.png "Surface boot screen that indicates Secure Boot has been disabled")
+![Surface boot screen that indicates Secure Boot has been disabled](images/manage-surface-uefi-fig18.png "Surface boot screen that indicates Secure Boot has been disabled")
 
-*Figure 14. Surface boot screen that indicates Secure Boot has been disabled in Surface UEFI settings*
+*Figure 19. Surface boot screen that indicates Secure Boot has been disabled in Surface UEFI settings*
 
 ## Related topics
 
-[Advanced UEFI security features for Surface Pro 3](advanced-uefi-security-features-for-surface-pro-3.md)
\ No newline at end of file
+- [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md)
+
+-  [Surface Enterprise Management Mode](surface-enterprise-management-mode.md)
\ No newline at end of file
diff --git a/devices/surface/microsoft-surface-brightness-control.md b/devices/surface/microsoft-surface-brightness-control.md
index b9910dfc97..1761581ced 100644
--- a/devices/surface/microsoft-surface-brightness-control.md
+++ b/devices/surface/microsoft-surface-brightness-control.md
@@ -5,10 +5,14 @@ ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: coveminer
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 1/15/2019
+ms.date: 10/31/2019
+ms.reviewer: hachidan
+manager: dansimp
+ms.localizationpriority: medium
+ms.audience: itpro
 ---
 
 # Surface Brightness Control
@@ -17,22 +21,21 @@ When deploying Surface devices in point of sale or other “always-on”
 kiosk scenarios, you can optimize power management using the new Surface
 Brightness Control app.
 
-Available for download with [Surface Tools for
-IT](https://www.microsoft.com/download/details.aspx?id=46703), Surface Brightness Control is
-designed to help reduce thermal load and lower the overall carbon
-footprint for deployed Surface devices. The tool automatically dims the screen when not in use and
-includes the following configuration options:
+Available for download with [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703).
+Surface Brightness Control is designed to help reduce thermal load and lower the overall carbon footprint for deployed Surface devices.
+If you plan to get only this tool from the download page, select the file **Surface_Brightness_Control_v1.16.137.0.msi** in the available list.
+The tool automatically dims the screen when not in use and includes the following configuration options:
 
-  - Period of inactivity before dimming the display.
+- Period of inactivity before dimming the display.
 
-  - Brightness level when dimmed.
+- Brightness level when dimmed.
 
-  - Maximum brightness level when in use.
+- Maximum brightness level when in use.
 
 **To run Surface Brightness Control:**
 
-  - Install surfacebrightnesscontrol.msi on the target device and Surface Brightness Control
-    will begin working immediately.
+- Install surfacebrightnesscontrol.msi on the target device and Surface Brightness Control
+  will begin working immediately.
 
 ## Configuring Surface Brightness Control
 
@@ -43,9 +46,14 @@ documentation](https://docs.microsoft.com/windows/desktop/sysinfo/registry).
 1.  Run regedit from a command prompt to open the Windows Registry
     Editor.
     
-      - Computer\HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Surface\Surface
+      - Computer\HKEY\_LOCAL\_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Surface\Surface
         Brightness Control\	
-		
+    
+    If you're running an older version of Surface Brightness control, run the following command instead:
+    
+      - Computer\HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Surface\Surface
+        Brightness Control\
+
 
 | Registry Setting | Data| Description  
 |-----------|------------|---------------
@@ -56,9 +64,19 @@ Full Brightness   | Default: 100  
            Option: Range of 0-100 percent of screen b
 | Inactivity Timeout| Default: 30 seconds 
            Option: Any numeric value  
            Data Type: Integer  
             Type: REG_DWORD | This setting allows you to manage the period of inactivity before dimming the device. If you do not configure this setting, the inactivity timeout is 30 seconds.|
 | Telemetry  Enabled | Default: 01 
            Option: 01, 00 
             Type: REG_BINARY  | This setting allows you to manage the sharing of app usage information to improve software and provide better user experience. To disable telemetry, set the value to 00. If you do not configure this setting, telemetry information is shared with Microsoft in accordance with the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). |
 
+## Changes and updates
+
+### Version 1.16.137
            
+*Release Date: 22 October 2019*
            
+This version of Surface Brightness Control adds support for the following:
+-Recompiled for x86, adding support for Surface Pro 7, Surface Pro X, and Surface Laptop 3. 
+
+### Version 1.12.239.0
+*Release Date: 26 April 2019*
            
+This version of Surface Brightness Control adds support for the following:
+- Touch delay fixes.
 
 
 ## Related topics
 
 - [Battery limit setting](battery-limit.md)
-
diff --git a/devices/surface/microsoft-surface-data-eraser.md b/devices/surface/microsoft-surface-data-eraser.md
index 23e0c2dd91..90b623c490 100644
--- a/devices/surface/microsoft-surface-data-eraser.md
+++ b/devices/surface/microsoft-surface-data-eraser.md
@@ -2,16 +2,19 @@
 title: Microsoft Surface Data Eraser (Surface)
 description: Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices.
 ms.assetid: 8DD3F9FE-5458-4467-BE26-E9200341CF10
+ms.reviewer: hachidan
+manager: dansimp
 ms.localizationpriority: medium
 keywords: tool, USB, data, erase
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices, security
 ms.sitesec: library
-author: brecords
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 05/15/2018
+ms.audience: itpro
+ms.date: 11/13/2019
 ---
 
 # Microsoft Surface Data Eraser
@@ -26,6 +29,9 @@ Find out how the Microsoft Surface Data Eraser tool can help you securely wipe d
 
 Compatible Surface devices include:
 
+* Surface Pro 7
+* Surface Pro X
+* Surface Laptop 3
 * Surface Pro 6
 * Surface Laptop 2
 * Surface Go
@@ -34,6 +40,7 @@ Compatible Surface devices include:
 * Surface Pro (Model 1796)
 * Surface Laptop
 * Surface Studio
+* Surface Studio 2
 * Surface Book
 * Surface Pro 4
 * Surface 3 LTE
@@ -66,7 +73,7 @@ Some scenarios where Microsoft Surface Data Eraser can be helpful include:
 
 To create a Microsoft Surface Data Eraser USB stick, first install the Microsoft Surface Data Eraser setup tool from the Microsoft Download Center using the link provided at the beginning of this article. You do not need a Surface device to *create* the USB stick. After you have downloaded the installation file to your computer, follow these steps to install the Microsoft Surface Data Eraser creation tool:
 
-1.  Run the DataEraserSetup.msi installation file that you downloaded from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=46703).
+1.  Run the DataEraserSetup.msi installation file that you downloaded from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=46703).
 
 2.  Select the check box to accept the terms of the license agreement, and then click **Install**.
 
@@ -74,77 +81,77 @@ To create a Microsoft Surface Data Eraser USB stick, first install the Microsoft
 
 After the creation tool is installed, follow these steps to create a Microsoft Surface Data Eraser USB stick. Before you begin these steps, ensure that you have a USB 3.0 stick that is 4 GB or larger connected to the computer.
 
-1.  Start Microsoft Surface Data Eraser from the Start menu or Start screen.
+1. Start Microsoft Surface Data Eraser from the Start menu or Start screen.
 
-2.  Click **Build** to begin the Microsoft Surface Data Eraser USB creation process.
+2. Click **Build** to begin the Microsoft Surface Data Eraser USB creation process.
 
-3.  Click **Start** to acknowledge that you have a USB stick of at least 4 GB connected, as shown in Figure 1.
+3. Click **Start** to acknowledge that you have a USB stick of at least 4 GB connected, as shown in Figure 1.
 
-    ![Start the Microsoft Surface Data Eraser tool](images/dataeraser-start-tool.png "Start the Microsoft Surface Data Eraser tool")
+   ![Start the Microsoft Surface Data Eraser tool](images/dataeraser-start-tool.png "Start the Microsoft Surface Data Eraser tool")
 
-    *Figure 1. Start the Microsoft Surface Data Eraser tool*
+   *Figure 1. Start the Microsoft Surface Data Eraser tool*
 
-4.  Select the USB drive of your choice from the **USB Thumb Drive Selection** page as shown in Figure 2, and then click **Start** to begin the USB creation process. The drive you select will be formatted and any existing data on this drive will be lost.
+4. Select the USB drive of your choice from the **USB Thumb Drive Selection** page as shown in Figure 2, and then click **Start** to begin the USB creation process. The drive you select will be formatted and any existing data on this drive will be lost.
 
-  >[!NOTE]
-  >If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB.
-  
-    ![USB thumb drive selection](images/dataeraser-usb-selection.png "USB thumb drive selection")
+   >[!NOTE]
+   >If the Start button is disabled, check that your removable drive has a total capacity of at least 4 GB.
+  
+   ![USB thumb drive selection](images/dataeraser-usb-selection.png "USB thumb drive selection")
 
-    *Figure 2. USB thumb drive selection*
+   *Figure 2. USB thumb drive selection*
 
-5.  After the creation process is finished, the USB drive has been formatted and all binaries are copied to the USB drive. Click **Success**.
+5. After the creation process is finished, the USB drive has been formatted and all binaries are copied to the USB drive. Click **Success**.
 
-6.  When the **Congratulations** screen is displayed, you can eject and remove the thumb drive. This thumb drive is now ready to be inserted into a Surface device, booted from, and wipe any data on the device. Click **Complete** to finish the USB creation process, as shown in Figure 3.
+6. When the **Congratulations** screen is displayed, you can eject and remove the thumb drive. This thumb drive is now ready to be inserted into a Surface device, booted from, and wipe any data on the device. Click **Complete** to finish the USB creation process, as shown in Figure 3.
 
-    ![Surface Data Eraser USB creation process](images/dataeraser-complete-process.png "Surface Data Eraser USB creation process")
+   ![Surface Data Eraser USB creation process](images/dataeraser-complete-process.png "Surface Data Eraser USB creation process")
 
-    *Figure 3. Complete the Microsoft Surface Data Eraser USB creation process*
+   *Figure 3. Complete the Microsoft Surface Data Eraser USB creation process*
 
-7.  Click **X** to close Microsoft Surface Data Eraser.
+7. Click **X** to close Microsoft Surface Data Eraser.
 
 ## How to use a Microsoft Surface Data Eraser USB stick
 
 
 After you create a Microsoft Surface Data Eraser USB stick, you can boot a supported Surface device from the USB stick by following this procedure:
 
-1.  Insert the bootable Microsoft Surface Data Eraser USB stick into the supported Surface device.
+1. Insert the bootable Microsoft Surface Data Eraser USB stick into the supported Surface device.
 
-2.  Boot your Surface device from the Microsoft Surface Data Eraser USB stick. To boot your device from the USB stick follow these steps:
+2. Boot your Surface device from the Microsoft Surface Data Eraser USB stick. To boot your device from the USB stick follow these steps:
 
-    a. Turn off your Surface device.
+   a. Turn off your Surface device.
 
-    b. Press and hold the **Volume Down** button.
+   b. Press and hold the **Volume Down** button.
 
-    c. Press and release the **Power** button.
+   c. Press and release the **Power** button.
 
-    d. Release the **Volume Down** button.
+   d. Release the **Volume Down** button.
     
-    >[!NOTE]
-    >If your device does not boot to USB using these steps, you may need to turn on the **Enable Alternate Boot Sequence** option in Surface UEFI. You can read more about Surface UEFI boot configuration in [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).
+   >[!NOTE]
+   >If your device does not boot to USB using these steps, you may need to turn on the **Enable Alternate Boot Sequence** option in Surface UEFI. You can read more about Surface UEFI boot configuration in [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).
 
-3.  When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed, as shown in Figure 4.
+3. When the Surface device boots, a **SoftwareLicenseTerms** text file is displayed, as shown in Figure 4.
 
-    ![Booting the Microsoft Surface Data Eraser USB stick](images/data-eraser-3.png "Booting the Microsoft Surface Data Eraser USB stick")
+   ![Booting the Microsoft Surface Data Eraser USB stick](images/data-eraser-3.png "Booting the Microsoft Surface Data Eraser USB stick")
 
-    *Figure 4. Booting the Microsoft Surface Data Eraser USB stick*
+   *Figure 4. Booting the Microsoft Surface Data Eraser USB stick*
 
-4.  Read the software license terms, and then close the Notepad file.
+4. Read the software license terms, and then close the Notepad file.
 
-5.  Accept or decline the software license terms by typing **Accept** or **Decline**. You must accept the license terms to continue.
+5. Accept or decline the software license terms by typing **Accept** or **Decline**. You must accept the license terms to continue.
 
-6.  The Microsoft Surface Data Eraser script detects the storage devices that are present in your Surface device and displays the details of the native storage device. To continue, press **Y** (this action runs Microsoft Surface Data Eraser and removes all data from the storage device) or press **N** (this action shuts down the device without removing data).
+6. The Microsoft Surface Data Eraser script detects the storage devices that are present in your Surface device and displays the details of the native storage device. To continue, press **Y** (this action runs Microsoft Surface Data Eraser and removes all data from the storage device) or press **N** (this action shuts down the device without removing data).
 
-  >[!NOTE]
-  >The Microsoft Surface Data Eraser tool will delete all data, including Windows operating system files required to boot the device, in a secure and unrecoverable way. To boot a Surface device that has been wiped with Microsoft Surface Data Eraser, you will first need to reinstall the Windows operating system. To remove data from a Surface device without removing the Windows operating system, you can use the **Reset your PC** function. However, this does not prevent your data from being recovered with forensic or data recovery capabilities. See [Recovery options in Windows 10](https://support.microsoft.com/help/12415/windows-10-recovery-options) for more information.
+   >[!NOTE]
+   >The Microsoft Surface Data Eraser tool will delete all data, including Windows operating system files required to boot the device, in a secure and unrecoverable way. To boot a Surface device that has been wiped with Microsoft Surface Data Eraser, you will first need to reinstall the Windows operating system. To remove data from a Surface device without removing the Windows operating system, you can use the **Reset your PC** function. However, this does not prevent your data from being recovered with forensic or data recovery capabilities. See [Recovery options in Windows 10](https://support.microsoft.com/help/12415/windows-10-recovery-options) for more information.
 
-  ![Partition to be erased is displayed](images/sda-fig5-erase.png "Partition to be erased is displayed")
+   ![Partition to be erased is displayed](images/sda-fig5-erase.png "Partition to be erased is displayed")
   
-  *Figure 5. Partition to be erased is displayed in Microsoft Surface Data Eraser*
+   *Figure 5. Partition to be erased is displayed in Microsoft Surface Data Eraser*
 
-7.  If you pressed **Y** in step 6, due to the destructive nature of the data erasure process, an additional dialog box is displayed to confirm your choice.
+7. If you pressed **Y** in step 6, due to the destructive nature of the data erasure process, an additional dialog box is displayed to confirm your choice.
 
-8.  Click the **Yes** button to continue erasing data on the Surface device.
+8. Click the **Yes** button to continue erasing data on the Surface device.
 
 >[!NOTE]
 >When you run Surface Data Eraser on the Surface Data Eraser USB drive, a log file is generated in the **SurfaceDataEraserLogs** folder.
@@ -153,6 +160,18 @@ After you create a Microsoft Surface Data Eraser USB stick, you can boot a suppo
 
 Microsoft Surface Data Eraser is periodically updated by Microsoft. For information about the changes provided in each new version, see the following:
 
+### 3.28.137
+*Release Date: 11 Nov 2019*
+This version of Surface Data Eraser:
+
+- Includes bug fixes
+
+### Version 3.21.137
+*Release Date: 21 Oct 2019*
+This version of Surface Data Eraser is compiled for x86 and adds support for the following devices:
+
+- Supports Surface Pro 7, Surface Pro X, and Surface Laptop 3
+
 ### Version 3.2.78.0
 *Release Date: 4 Dec 2018*
 
diff --git a/devices/surface/microsoft-surface-deployment-accelerator.md b/devices/surface/microsoft-surface-deployment-accelerator.md
index 8dfbc020a2..8fbc32d7df 100644
--- a/devices/surface/microsoft-surface-deployment-accelerator.md
+++ b/devices/surface/microsoft-surface-deployment-accelerator.md
@@ -2,29 +2,30 @@
 title: Microsoft Surface Deployment Accelerator (Surface)
 description: Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices.
 ms.assetid: E7991E90-4AAE-44B6-8822-58BFDE3EADE4
-ms.date: 07/27/2017
+ms.reviewer: hachidan
+manager: dansimp
+ms.date: 10/31/2019
 ms.localizationpriority: medium
 keywords: deploy, install, tool
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: miladCA
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
+ms.audience: itpro
 ---
 
 # Microsoft Surface Deployment Accelerator
 
+Microsoft Surface Deployment Accelerator (SDA) automates the creation and configuration of a Microsoft recommended deployment experience by using free Microsoft deployment tools. 
 
-Microsoft Surface Deployment Accelerator (SDA) provides a quick and simple deployment mechanism for organizations to reimage Surface devices.
-
-SDA includes a wizard that automates the creation and configuration of a Microsoft recommended deployment experience by using free Microsoft deployment tools. The resulting deployment solution is complete with everything you need to immediately begin the deployment of Windows to a Surface device. You can also use SDA to create and capture a Windows reference image and then deploy it with the latest Windows updates.
+> [!NOTE]
+> SDA is not supported on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information refer to [Deploy Surface devices](deploy.md).
 
 SDA is built on the powerful suite of deployment tools available from Microsoft including the Windows Assessment and Deployment Kit (ADK), the Microsoft Deployment Toolkit (MDT), and Windows Deployment Services (WDS). The resulting deployment share encompasses the recommended best practices for managing drivers during deployment and automating image creation and can serve as a starting point upon which you build your own customized deployment solution.
 
-You can find more information about how to deploy to Surface devices, including step-by-step walkthroughs of customized deployment solution implementation, on the Deploy page of the [Surface TechCenter](https://technet.microsoft.com/windows/dn913725).
-
 **Download Microsoft Surface Deployment Accelerator**
 
 You can download the installation files for SDA from the Microsoft Download Center. To download the installation files:
@@ -79,7 +80,7 @@ For environments where the SDA server will not be able to connect to the Interne
 
 *Figure 2. Specify a local source for Surface driver and app files*
 
-You can find a full list of available driver downloads at [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)
+You can find a full list of available driver downloads at [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md)
 
 >[!NOTE]
 >Downloaded files do not need to be extracted. The downloaded files can be left as .zip files as long as they are stored in one folder.
diff --git a/devices/surface/step-by-step-surface-deployment-accelerator.md b/devices/surface/step-by-step-surface-deployment-accelerator.md
index e239bcea68..04d78253ee 100644
--- a/devices/surface/step-by-step-surface-deployment-accelerator.md
+++ b/devices/surface/step-by-step-surface-deployment-accelerator.md
@@ -2,25 +2,28 @@
 title: Step by step Surface Deployment Accelerator (Surface)
 description: This article shows you how to install Microsoft Surface Deployment Accelerator (SDA), configure a deployment share for the deployment of Windows to Surface devices, and perform a deployment to Surface devices.
 ms.assetid: A944FB9C-4D81-4868-AFF6-B9D1F5CF1032
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 keywords: deploy, configure
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: miladCA
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 07/27/2017
+ms.date: 10/31/2019
 ---
 
 # Step by step: Surface Deployment Accelerator
 
-
 This article shows you how to install Microsoft Surface Deployment Accelerator (SDA), configure a deployment share for the deployment of Windows to Surface devices, and perform a deployment to Surface devices. This article also contains instructions on how to perform these tasks without an Internet connection or without support for Windows Deployment Services network boot (PXE).
 
-## How to install Surface Deployment Accelerator
+> [!NOTE]
+> SDA is not supported on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information refer to [Deploy Surface devices](deploy.md).
 
+## How to install Surface Deployment Accelerator
 
 For information about prerequisites and instructions for how to download and install SDA, see [Microsoft Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md).
 
@@ -45,63 +48,58 @@ The tool installs in the SDA program group, as shown in Figure 2.
 >[!NOTE]
 >At this point, the tool has not yet prepared any deployment environment or downloaded any materials from the Internet.
 
- 
-
 ## Create a deployment share
 
-
-The following steps show you how to create a deployment share for Windows 10 that supports Surface 3, Surface Pro 3, Surface Pro 4, Surface Book, the Surface Firmware Tool, the Surface Asset Tag Tool, and Office 365. As you follow the steps below, make the selections that are applicable for your organization. For example, you could choose to deploy Windows 10 to Surface Book only, without any of the Surface apps.
+The following steps show you how to create a deployment share for Windows 10 that supports Surface 3, Surface Pro 3, Surface Pro 4, Surface Book, the Surface Firmware Tool, the Surface Asset Tag Tool, and Office 365. As you follow the steps below, make the selections that are applicable for your organization. For example, you could choose to deploy Windows 10 to Surface Book only, without any of the Surface apps.
 
 >[!NOTE]
->SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice.
+>SDA lets you create deployment shares for both Windows 8.1 and Windows 10 deployments, but you can only create a single deployment share at a time. Therefore, to create both Windows 8.1 and Windows 10 deployment shares, you will need to run the tool twice.
 
- 
+1. Open the SDA wizard by double-clicking the icon in the **Surface Deployment Accelerator** program group on the Start screen.
 
-1.  Open the SDA wizard by double-clicking the icon in the **Surface Deployment Accelerator** program group on the Start screen.
+2. On the **Welcome** page, click **Next** to continue.
 
-2.  On the **Welcome** page, click **Next** to continue.
-
-3.  On the **Verify System** page, the SDA wizard verifies the prerequisites required for an SDA deployment share. This process also checks for the presence of the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10 and the Microsoft Deployment Toolkit (MDT) 2013 Update 2. If these tools are not detected, they are downloaded and installed automatically. Click **Next** to continue.
+3.  On the **Verify System** page, the SDA wizard verifies the prerequisites required for an SDA deployment share. This process also checks for the presence of the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10 and the Microsoft Deployment Toolkit (MDT) 2013 Update 2. If these tools are not detected, they are downloaded and installed automatically. Click **Next** to continue.
 
   >[!NOTE]
   >As of SDA version 1.96.0405, SDA will install only the components of the Windows ADK that are required for deployment, as follows:
   > * Deployment tools
-  >  * User State Migration Tool (USMT)
-  >  * Windows Preinstallation Environment (WinPE)

            
+  > * User State Migration Tool (USMT)
+  > * Windows Preinstallation Environment (WinPE)
 
-  >[!NOTE]
-  >As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1.
+  > [!NOTE]
+  > As of SDA version 1.96.0405, SDA will install and use MDT 2013 Update 2. Earlier versions of SDA are compatible only with MDT 2013 Update 1.
 
-4.  On the **Windows 8.1** page, to create a Windows 10 deployment share, do not select the **Would you like to support Windows 8.1** check box. Click **Next** to continue.
+4.  On the **Windows 8.1** page, to create a Windows 10 deployment share, do not select the **Would you like to support Windows 8.1** check box. Click **Next** to continue.
 
-5.  On the **Windows 10** page, to create a Windows 10 deployment share, select the **Would you like to support Windows 10** check box. Supply the following information before you click **Next** to continue:
+5.  On the **Windows 10** page, to create a Windows 10 deployment share, select the **Would you like to support Windows 10** check box. Supply the following information before you click **Next** to continue:
 
-    -   **Configure Deployment Share for Windows 10**
+    -   **Configure Deployment Share for Windows 10**
 
-        -   **Local Path** – Specify or browse to a location on the local storage device where you would like to store the deployment share files for the Windows 10 SDA deployment share. For example, **E:\\SDAWin10\\** is the location specified in Figure 3.
+        -   **Local Path** – Specify or browse to a location on the local storage device where you would like to store the deployment share files for the Windows 10 SDA deployment share. For example, **E:\\SDAWin10\\** is the location specified in Figure 3.
 
         -   **Share Name** – Specify a name for the file share that will be used to access the deployment share on this server from the network. For example, **SDAWin10** is the deployment share name shown in Figure 3. The local path folder is automatically shared by the SDA scripts under this name to the group **Everyone** with a permission level of **Full Control**.
 
-    -   **Windows 10 Deployment Services**
+    -   **Windows 10 Deployment Services**
 
         -   Select the **Import boot media into the local Windows Deployment Service** check box if you would like to boot your Surface devices from the network to perform the Windows deployment. Windows Deployment Services must be installed and configured to respond to PXE boot requests. See [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426.aspx) for more information about how to configure Windows Deployment Services for PXE boot.
 
-    -   **Windows 10 Source Files**
+    -   **Windows 10 Source Files**
 
-        -   **Local Path** – Specify or browse to the root directory of Windows 10 installation files. If you have an ISO file, mount it and browse to the root of the mounted drive. You must have a full set of source files, not just **Install.wim**.
+        -   **Local Path** – Specify or browse to the root directory of Windows 10 installation files. If you have an ISO file, mount it and browse to the root of the mounted drive. You must have a full set of source files, not just **Install.wim**.
 
-    ![Specify Windows 10 deployment share options](images/sdasteps-fig3.png "Specify Windows 10 deployment share options")
+    ![Specify Windows 10 deployment share options](images/sdasteps-fig3.png "Specify Windows 10 deployment share options")
 
-    *Figure 3. Specify Windows 10 deployment share options*
+    *Figure 3. Specify Windows 10 deployment share options*
 
-6.  On the **Configure** page, select the check box next to each device or app that you want to include in your deployment share. Note that Surface Pro 4 and Surface Book only support Windows 10 and are not available for the deployment of Windows 8.1. The Surface Firmware Tool is only applicable to Surface 3 and Surface Pro 3 and cannot be selected unless Surface 3 or Surface Pro 3 drivers are selected, as shown in Figure 4. Click **Next** to continue.
+6.  On the **Configure** page, select the check box next to each device or app that you want to include in your deployment share. Note that Surface Pro 4 and Surface Book only support Windows 10 and are not available for the deployment of Windows 8.1. The Surface Firmware Tool is only applicable to Surface 3 and Surface Pro 3 and cannot be selected unless Surface 3 or Surface Pro 3 drivers are selected, as shown in Figure 4. Click **Next** to continue.
 
-    ![Firmware tool selection](images/sdasteps-fig4-select.png "Firmware tool selection")
+   ![Firmware tool selection](images/sdasteps-fig4-select.png "Firmware tool selection")
 
-    *Figure 4. Selecting Surface Firmware Tool requires Surface Pro 3 drivers*
+   *Figure 4. Selecting Surface Firmware Tool requires Surface Pro 3 drivers*
 
-    >[!NOTE]
-    >You cannot select both Surface 3 and Surface 3 LTE models at the same time.
+   >[!NOTE]
+   >You cannot select both Surface 3 and Surface 3 LTE models at the same time.
 
 7.  On the **Summary** page confirm your selections and click **Finish** to begin the creation of your deployment share. The process can take several minutes as files are downloaded, the tools are installed, and the deployment share is created. While the SDA scripts are creating your deployment share, an **Installation Progress** window will be displayed, as shown in Figure 5. A typical SDA process includes:
 
@@ -123,84 +121,85 @@ The following steps show you how to create a deployment share for Windows 10 th
 
     -   Creation of rules and task sequences for Windows deployment
 
-    ![The installatin progress window](images/sdasteps-fig5-installwindow.png "The installatin progress window")
+    ![The installation progress window](images/sdasteps-fig5-installwindow.png "The installation progress window")
 
     *Figure 5. The Installation Progress window*
->[!NOTE]
->The following error message may be hit while Installing the latest ADK or MDT: "An exception occurred during a WebClient request.". This is due to incompatibility between SDA and BITS. Here is the workaround for this:
+    
+    ### Optional: Workaround for Webclient exception
+    
+    You may see this error message while installing the latest version of ADK or MDT: _An exception occurred during a WebClient request._ This is due to incompatibility between the Surface Deployment Accelerator (SDA) and Background Intelligent Transfer Service  (BITS). To work around this issue, do the following.
 
- ```
-In the following two PowerShell scripts:
-%ProgramFiles%\Microsoft\Surface\Deployment Accelerator\Data\PowerShell\Install-MDT.ps1
-%ProgramFiles%\Microsoft\Surface\Deployment Accelerator\Data\PowerShell\INSTALL-WindowsADK.ps1
+    In the two PowerShell scripts:
 
-Edit the $BITSTransfer variable in the input parameters to $False as shown below:
+    ```PowerShell
+    %ProgramFiles%\Microsoft\Surface\Deployment Accelerator\Data\PowerShell\Install-MDT.ps1
+    %ProgramFiles%\Microsoft\Surface\Deployment Accelerator\Data\PowerShell\INSTALL-WindowsADK.ps1
+    ```
 
-Param(
-    [Parameter(
-        Position=0,
-        Mandatory=$False,
-        HelpMessage="Download via BITS bool true/false"
+    Edit the $BITSTransfer variable in the input parameters to $False as shown below:
+
+    ```PowerShell
+    Param(
+        [Parameter(
+            Position=0,
+            Mandatory=$False,
+            HelpMessage="Download via BITS bool true/false"
         )]
         [string]$BITSTransfer = $False
     )
- ```
- 
-8.  When the SDA process completes the creation of your deployment share, a **Success** window is displayed. Click **Finish** to close the window. At this point your deployment share is now ready to perform a Windows deployment to Surface devices.
+    ```
 
-### Optional: Create a deployment share without an Internet connection
+8. When the SDA process completes the creation of your deployment share, a **Success** window is displayed. Click **Finish** to close the window. At this point your deployment share is now ready to perform a Windows deployment to Surface devices.
 
-If you are unable to connect to the Internet with your deployment server, or if you want to download the Surface drivers and apps separately, you can specify a local source for the driver an app files at the time of deployment share creation. On the **Configure** page of the SDA wizard, select the **Copy from a Local Directory** check box, as shown in Figure 6. The **Download from the Internet** check box will be automatically deselected. Enter the folder location where you have placed the driver and app files in the **Local Path** field, as shown in Figure 6.
+    ### Optional: Create a deployment share without an Internet connection
 
->[!NOTE]
->All of the downloaded driver and applications files must be located in the same folder. If a required driver or application file is missing from the selected folder when you click **Next**, a warning is displayed and the wizard will not proceed to the next step.
+    If you are unable to connect to the Internet with your deployment server, or if you want to download the Surface drivers and apps separately, you can specify a local source for the driver and app files at the time of deployment share creation. On the **Configure** page of the SDA wizard, select the **Copy from a Local Directory** check box, as shown in Figure 6. The **Download from the Internet** check box will be automatically deselected. Enter the folder location where you have placed the driver and app files in the **Local Path** field, as shown in Figure 6.
 
->[!NOTE]
->The driver and app files do not need to be extracted from the downloaded .zip files.
+    >[!NOTE]
+    >All of the downloaded driver and applications files must be located in the same folder. If a required driver or application file is missing from the selected folder when you click **Next**, a warning is displayed and the wizard will not proceed to the next step.
 
->[!NOTE]
->Including Office 365 in your deployment share requires an Internet connection and cannot be performed if you use local files.
+    >[!NOTE]
+    >The driver and app files do not need to be extracted from the downloaded .zip files.
 
-![Specify Surface driver and app files](images/sdasteps-fig6-specify-driver-app-files.png "Specify Surface driver and app files")
+    >[!NOTE]
+    >Including Office 365 in your deployment share requires an Internet connection and cannot be performed if you use local files.
 
-*Figure 6. Specify the Surface driver and app files from a local path*
+    ![Specify Surface driver and app files](images/sdasteps-fig6-specify-driver-app-files.png "Specify Surface driver and app files")
 
->[!NOTE]
->The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later.
+    *Figure 6. Specify the Surface driver and app files from a local path*
 
- 
+    >[!NOTE]
+    >The **Copy from a Local Directory** check box is only available in SDA version 1.90.0221 or later.
 
-### Optional: Prepare offline USB media
+    ### Optional: Prepare offline USB media
 
-You can use USB media to perform an SDA deployment if your Surface device is unable to boot from the network. For example, if you do not have a Microsoft Surface Ethernet Adapter or Microsoft Surface dock to facilitate network boot (PXE boot). The USB drive produced by following these steps includes a complete copy of the SDA deployment share and can be run on a Surface device without a network connection.
+    You can use USB media to perform an SDA deployment if your Surface device is unable to boot from the network. For example, if you do not have a Microsoft Surface Ethernet Adapter or Microsoft Surface dock to facilitate network boot (PXE boot). The USB drive produced by following these steps includes a complete copy of the SDA deployment share and can be run on a Surface device without a network connection.
 
->[!NOTE]
->The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended.
+    >[!NOTE]
+    >The offline media files for the complete SDA deployment share are approximately 9 GB in size. Your USB drive must be at least 9 GB in size. A 16 GB USB drive is recommended.
 
- 
+    Before you can create bootable media files within the MDT Deployment Workbench or copy those files to a USB drive, you must first configure that USB drive to be bootable. Using [DiskPart](https://go.microsoft.com/fwlink/p/?LinkId=761073), create a partition, format the partition as FAT32, and set the partition to be active. To run DiskPart, open an administrative PowerShell or Command Prompt window, and then run the following sequence of commands, as shown in Figure 7:
 
-Before you can create bootable media files within the MDT Deployment Workbench or copy those files to a USB drive, you must first configure that USB drive to be bootable. Using [DiskPart](https://go.microsoft.com/fwlink/p/?LinkId=761073), create a partition, format the partition as FAT32, and set the partition to be active. To run DiskPart, open an administrative PowerShell or Command Prompt window, and then run the following sequence of commands, as shown in Figure 7:
+    1.  **diskpart** – Opens DiskPart to manage disks and partitions.
 
-1.  **diskpart** – Opens DiskPart to manage disks and partitions.
+    2.  **list disk** – Displays a list of the disks available in your system; use this list to identify the disk number that corresponds with your USB drive.
 
-2.  **list disk** – Displays a list of the disks available in your system; use this list to identify the disk number that corresponds with your USB drive.
+    3.  **sel disk 2** – Selects your USB drive; use the number that corresponds with the disk in your system.
 
-3.  **sel disk 2** – Selects your USB drive; use the number that corresponds with the disk in your system.
-
-4.  **clean** – Removes all configuration from your USB drive.
+    4.  **clean** – Removes all configuration from your USB drive.
 
     >[!WARNING]
     >This step will remove all information from your drive. Verify that your USB drive does not contain any needed data before you perform the **clean** command.
 
-5.  **create part pri** – Creates a primary partition on the USB drive.
+    5.  **create part pri** – Creates a primary partition on the USB drive.
 
-6.  **format fs=fat32 quick** – Formats the partition with the FAT32 file system, performing a quick format. FAT32 is required to boot the device from UEFI systems like Surface devices.
+    6.  **format fs=fat32 quick** – Formats the partition with the FAT32 file system, performing a quick format. FAT32 is required to boot the device from UEFI systems like Surface devices.
 
-7.  **assign** – Assigns the next available drive letter to the newly created FAT32 volume.
+    7.  **assign** – Assigns the next available drive letter to the newly created FAT32 volume.
 
-8.  **active** – Sets the partition to be active, which is required to boot the volume.
+    8.  **active** – Sets the partition to be active, which is required to boot the volume.
 
-9.  **exit** – Exits DiskPart, after which you can close the PowerShell or Command Prompt window.
+    9.  **exit** – Exits DiskPart, after which you can close the PowerShell or Command Prompt window.
 
     ![Use DiskPart to prepare a USB drive for boot](images/sdasteps-fig7-diskpart.png "Use DiskPart to prepare a USB drive for boot")
 
@@ -209,15 +208,13 @@ Before you can create bootable media files within the MDT Deployment Workbench o
     >[!NOTE]
     >You can format your USB drive with FAT32 from Disk Management, but you must still use DiskPart to set the partition as active for the drive to boot properly.
 
-     
+    After you have prepared the USB drive for boot, the next step is to generate offline media from the SDA deployment share. To create this media, follow these steps:
 
-After you have prepared the USB drive for boot, the next step is to generate offline media from the SDA deployment share. To create this media, follow these steps:
+    1.  Open the **Deployment Workbench** from the **Microsoft Deployment Toolkit** group on your Start screen.
 
-1.  Open the **Deployment Workbench** from the **Microsoft Deployment Toolkit** group on your Start screen.
+    2.  Expand the **Deployment Shares** node and the **Microsoft Surface Deployment Accelerator** deployment share.
 
-2.  Expand the **Deployment Shares** node and the **Microsoft Surface Deployment Accelerator** deployment share.
-
-3.  Expand the folder **Advanced Configuration** and select the **Media** folder.
+    3.  Expand the folder **Advanced Configuration** and select the **Media** folder.
 
 4.  Right-click the **Media** folder and click **New Media** as shown in Figure 8 to start the New Media Wizard.
 
@@ -225,79 +222,78 @@ After you have prepared the USB drive for boot, the next step is to generate off
 
     *Figure 8. The Media folder of the SDA deployment share*
 
-5.  On the **General Settings** page in the **Media path** field, enter or browse to a folder where you will create the files for the new offline media. See the example **E:\\SDAMedia** in Figure 9. Leave the default profile **Everything** selected in the **Selection profile** drop-down menu, and then click **Next**.
+    5.  On the **General Settings** page in the **Media path** field, enter or browse to a folder where you will create the files for the new offline media. See the example **E:\\SDAMedia** in Figure 9. Leave the default profile **Everything** selected in the **Selection profile** drop-down menu, and then click **Next**.
 
     ![Specify a location and selection profile for your offline media](images/sdasteps-fig9-location.png "Specify a location and selection profile for your offline media")
 
     *Figure 9. Specify a location and selection profile for your offline media*
 
-6.  On the **Summary** page verify your selections, and then click **Next** to begin creation of the media.
+    6.  On the **Summary** page verify your selections, and then click **Next** to begin creation of the media.
 
-7.  A **Progress** page is displayed while the media is created.
+    7.  A **Progress** page is displayed while the media is created.
 
-8.  On the **Confirmation** page, click **Finish** to complete creation of the media.
+    8.  On the **Confirmation** page, click **Finish** to complete creation of the media.
 
-9.  Right-click the **Microsoft Surface Deployment Accelerator** deployment share folder, click **Properties**, and then click the **Rules** tab as shown in Figure 10.
+    9.  Right-click the **Microsoft Surface Deployment Accelerator** deployment share folder, click **Properties**, and then click the **Rules** tab as shown in Figure 10.
 
     ![Rules of the SDA deployment share](images/sdasteps-fig10-rules.png "Rules of the SDA deployment share")
 
     *Figure 10. Rules of the SDA deployment share*
 
-10. Use your mouse to highlight all of the text displayed in the text box of the **Rules** tab, and then press **Ctrl+C** to copy the text.
+    10. Use your mouse to highlight all of the text displayed in the text box of the **Rules** tab, and then press **Ctrl+C** to copy the text.
 
-11. Click **OK** to close the **Microsoft Surface Deployment Accelerator** deployment share properties.
+    11. Click **OK** to close the **Microsoft Surface Deployment Accelerator** deployment share properties.
 
-12. Right-click the newly created **MEDIA001** item in the **Media** folder, click **Properties**, and then click the **Rules** tab.
+    12. Right-click the newly created **MEDIA001** item in the **Media** folder, click **Properties**, and then click the **Rules** tab.
 
-13. Use your mouse to highlight all of the text displayed in the text box of the **Rules** tab, and then press **Ctrl+V** to paste the text you copied from the **Microsoft Surface Deployment Accelerator** deployment share rules.
+    13. Use your mouse to highlight all of the text displayed in the text box of the **Rules** tab, and then press **Ctrl+V** to paste the text you copied from the **Microsoft Surface Deployment Accelerator** deployment share rules.
 
-14. Right-click the **Microsoft Surface Deployment Accelerator** deployment share folder, click **Properties**, and then click the **Rules** tab again. Click the **Bootstrap.ini** button to open Bootstrap.ini in Notepad.
+    14. Right-click the **Microsoft Surface Deployment Accelerator** deployment share folder, click **Properties**, and then click the **Rules** tab again. Click the **Bootstrap.ini** button to open Bootstrap.ini in Notepad.
 
-15. Press **Ctrl+A** to select all of the text in the window, and then press **Ctrl+C** to copy the text.
+    15. Press **Ctrl+A** to select all of the text in the window, and then press **Ctrl+C** to copy the text.
 
-16. Close Bootstrap.ini and click **OK** in **Microsoft Surface Deployment Accelerator** deployment share properties to close the window.
+    16. Close Bootstrap.ini and click **OK** in **Microsoft Surface Deployment Accelerator** deployment share properties to close the window.
 
-17. Right-click the newly created **MEDIA001** item in the **Media** folder, click **Properties**, and then click the **Rules** tab again. Click the **Bootstrap.ini** button to open Bootstrap.ini in Notepad.
+    17. Right-click the newly created **MEDIA001** item in the **Media** folder, click **Properties**, and then click the **Rules** tab again. Click the **Bootstrap.ini** button to open Bootstrap.ini in Notepad.
 
-18. Press **Ctrl+A** to select all of the text in the window, then press **Ctrl+V** to paste the text from the SDA deployment share Bootstrap.ini file.
+    18. Press **Ctrl+A** to select all of the text in the window, then press **Ctrl+V** to paste the text from the SDA deployment share Bootstrap.ini file.
 
-19. Delete the following lines from the Bootstrap.ini as shown in Figure 11, and then save the file:
+    19. Delete the following lines from the Bootstrap.ini as shown in Figure 11, and then save the file:
 
-    ```
-    UserID=
-    UserDomain=
-    UserPassword=
-    DeployRoot=\\SDASERVER\SDAWin10
-    UserID=
-    UserDomain=
-    UserPassword=
-    ```
+        ```PowerShell
+        UserID=
+        UserDomain=
+        UserPassword=
+        DeployRoot=\\SDASERVER\SDAWin10
+        UserID=
+        UserDomain=
+        UserPassword=
+        ```
 
     ![The Bootstrap.ini file](images/sdasteps-fig11-bootstrap.ini.png "The Bootstrap.ini file")
 
     *Figure 11. The Bootstrap.ini file of MEDIA001*
 
-20. Close Bootstrap.ini and click **OK** in **MEDIA001** deployment share properties to close the window.
+    20. Close Bootstrap.ini and click **OK** in **MEDIA001** deployment share properties to close the window.
 
-21. In the **Deployment Workbench** under the **Media** folder, right-click the newly created **MEDIA001** and click **Update Media Content**, as shown in Figure 12. This will update the media files with the content of the **Microsoft Surface Deployment Accelerator** deployment share.
+    21. In the **Deployment Workbench** under the **Media** folder, right-click the newly created **MEDIA001** and click **Update Media Content**, as shown in Figure 12. This will update the media files with the content of the **Microsoft Surface Deployment Accelerator** deployment share.
 
     ![Select the Update Media Content option](images/sdasteps-fig12-updatemedia.png "Select the Update Media Content option")
 
     *Figure 12. Select the Update Media Content option*
 
-22. The **Update Media Content** window is displayed and shows the progress as the media files are created. When the process completes, click **Finish.**
+    22. The **Update Media Content** window is displayed and shows the progress as the media files are created. When the process completes, click **Finish.**
 
-The final step is to copy the offline media files to your USB drive.
+    The final step is to copy the offline media files to your USB drive.
 
-1.  In File Explorer, open the path you specified in Step 5, for example **E:\\SDAMedia**.
+    1.  In File Explorer, open the path you specified in Step 5, for example **E:\\SDAMedia**.
 
-2.  Copy all of the files from the Content folder to the root of the USB drive.
+    2.  Copy all of the files from the Content folder to the root of the USB drive.
 
-Your USB drive is now configured as bootable offline media that contains all of the resources required to perform a deployment to a Surface device.
+    Your USB drive is now configured as bootable offline media that contains all of the resources required to perform a deployment to a Surface device.
 
 ## SDA task sequences
 
-
 The SDA deployment share is configured with all of the resources required to perform a Windows deployment to a Surface device. These resources include Windows source files, image, Surface drivers, and Surface apps. The deployment share also contains two pre-configured task sequences, as shown in Figure 13. These task sequences contain the steps required to perform a deployment to a Surface device using the default Windows image from the installation media or to create a reference image complete with Windows updates and applications. To learn more about task sequences, see [MDT 2013 Update 2 Lite Touch components](https://technet.microsoft.com/itpro/windows/deploy/mdt-2013-lite-touch-components).
 
 ![Task sequences in the Deployment Workbench](images/sdasteps-fig13-taskseq.png "Task sequences in the Deployment Workbench")
@@ -332,8 +328,7 @@ The **2 – Create Windows Reference Image** task sequence is used to perform a
 Like the **1 – Deploy Microsoft Surface** task sequence, the **2 – Create Windows Reference Image** task sequence performs a deployment of the unaltered Windows image directly from the installation media. Creation of a reference image should always be performed on a virtual machine. Using a virtual machine as your reference system helps to ensure that the resulting image is compatible with different hardware configurations.
 
 >[!NOTE]
->Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and System Center Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt).
-
+>Using a virtual machine when you create a reference image for Windows deployment is a recommended practice for performing Windows deployments with Microsoft deployment tools including the Microsoft Deployment Toolkit and Microsoft Endpoint Configuration Manager. These Microsoft deployment technologies use the hardware agnostic images produced from a virtual machine and a collection of managed drivers to deploy to different configurations of hardware. For more information, see [Deploy a Windows 10 image using MDT 2013 Update 2](https://technet.microsoft.com/itpro/windows/deploy/deploy-a-windows-10-image-using-mdt).
 
 In addition to the information required by the **1 – Deploy Microsoft Surface** task sequence, you will also be prompted to capture an image when you run this task sequence on your reference virtual machine. The **Location** and **File name** fields are automatically populated with the proper information for your deployment share. All that you need to do is select the **Capture an image of this reference computer** option when you are prompted on the **Capture Image** page of the Windows Deployment Wizard.
 
@@ -354,7 +349,7 @@ To perform a deployment from the SDA deployment share, follow this process on th
 
 ### Boot the Surface device from the network
 
-To boot the Surface device from the network, the Microsoft Surface Deployment Accelerator wizard must have been run on a Windows Server 2012 R2 or later environment that was configured with the Windows Deployment Services (WDS). WDS must have been configured to respond to network boot (PXE boot) requests and the boot files must have been imported into WDS. The SDA wizard will import these file automatically if the **Import boot media into the local Windows Deployment Service** check box was selected on the page for the version of Windows you intend to deploy.
+To boot the Surface device from the network, the Microsoft Surface Deployment Accelerator wizard must have been run on a Windows Server 2012 R2 or later environment that was configured with the Windows Deployment Services (WDS). WDS must have been configured to respond to network boot (PXE boot) requests and the boot files must have been imported into WDS. The SDA wizard will import these file automatically if the **Import boot media into the local Windows Deployment Service** check box was selected on the page for the version of Windows you intend to deploy.
 
 To boot the Surface device from the network, you must also use a Microsoft Surface Ethernet Adapter or the Ethernet port on a Microsoft Surface Dock. Third-party Ethernet adapters are not supported for network boot (PXE boot). A keyboard is also required. Both the Microsoft Surface Type Cover and keyboards connected via USB to the device or dock are supported.
 
@@ -364,7 +359,7 @@ To instruct your Surface device to boot from the network, start with the device
 
 2.  Press **Enter** when prompted by the dialog on the screen. This prompt indicates that your device has found the WDS PXE server over the network.
 
-3.  If you have configured more than one deployment share on this device, you will be prompted to select between the boot images for each deployment share. For example, if you created both a Windows 10 and a Windows 8.1 deployment share, you will be prompted to choose between these two options.
+3.  If you have configured more than one deployment share on this device, you will be prompted to select between the boot images for each deployment share. For example, if you created both a Windows 10 and a Windows 8.1 deployment share, you will be prompted to choose between these two options.
 
 4.  Enter the domain credentials that you use to log on to the server where SDA is installed when you are prompted, as shown in Figure 14.
 
@@ -413,12 +408,3 @@ To run the Deploy Microsoft Surface task sequence:
     *Figure 17. The Installation Progress window*
 
 8.  When the deployment task sequence completes, a **Success** window is displayed. Click **Finish** to complete the deployment and begin using your Surface device.
-
- 
-
- 
-
-
-
-
-
diff --git a/devices/surface/support-solutions-surface.md b/devices/surface/support-solutions-surface.md
index 2ee030e7da..b311e28937 100644
--- a/devices/surface/support-solutions-surface.md
+++ b/devices/surface/support-solutions-surface.md
@@ -2,20 +2,26 @@
 title: Top support solutions for Surface devices
 description: Find top solutions for common issues using Surface devices in the enterprise.
 ms.assetid: CF58F74D-8077-48C3-981E-FCFDCA34B34A
+ms.reviewer: 
+manager: dansimp
 keywords: Troubleshoot common problems, setup issues
 ms.prod: w10
 ms.mktglfcycl: support
 ms.sitesec: library
 ms.pagetype: surfacehub
-author: kaushika-msft
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 09/08/2017
+ms.date: 09/26/2019
 ms.localizationpriority: medium
+ms.audience: itpro
 ---
 
 # Top support solutions for Surface devices
 
+> [!Note]
+> **Home users**: This article is only intended for use by IT professionals and  technical support agents, and applies only to Surface devices. If you're looking for help with a problem with your home device, please see [Surface Devices Help](https://support.microsoft.com/products/surface-devices).
+
 Microsoft regularly releases both updates and solutions for Surface devices. To ensure your devices can receive future updates, including security updates, it's important to keep your Surface devices updated.  For a complete listing of the update history, see [Surface update history](https://www.microsoft.com/surface/support/install-update-activate/surface-update-history) and [Install Surface and Windows updates](https://www.microsoft.com/surface/support/performance-and-maintenance/install-software-updates-for-surface?os=windows-10&=undefined).
 
 
@@ -23,43 +29,54 @@ These are the top Microsoft Support solutions for common issues experienced when
 
 ## Screen cracked or scratched issues
 
-- [Cracked screen and physical damage](https://www.microsoft.com/surface/support/warranty-service-and-recovery/surface-is-damaged)
+- [Contact Microsoft Support](https://support.microsoft.com/supportforbusiness/productselection) 
 
+## Surface Power or battery Issues
 
-##Device cover or keyboard issues
+- [How to Charge Surface(Surface PSU information)](https://support.microsoft.com/help/4023496)
+
+- [Surface battery won’t charge or Surface won’t run on battery](https://support.microsoft.com/help/4023536)
+
+- [Surface won’t turn on or wake from sleep](https://support.microsoft.com/help/4023537)
+
+- [Maximize your Surface battery life](https://support.microsoft.com/help/4483194)
+
+## Device cover or keyboard issues
 
 - [Troubleshoot your Surface Type Cover or keyboard](https://www.microsoft.com/surface/support/hardware-and-drivers/troubleshoot-surface-keyboards)
-- [Troubleshoot problems with Surface Keyboard, Surface Ergonomic Keyboard, and Microsoft Modern Keyboard with Fingerprint ID](https://www.microsoft.com/surface/support/touch-mouse-and-search/surface-keyboard-troubleshooting)
-- [Set up Microsoft Modern Keyboard with Fingerprint ID](https://www.microsoft.com/surface/support/touch-mouse-and-search/microsoft-modern-keyboard-fingerprintid-set-up)
-- [Enabling Surface Laptop keyboard during MDT deployment](https://blogs.technet.microsoft.com/askcore/2017/08/18/enabling-surface-laptop-keyboard-during-mdt-deployment/)
 
- 
-## Device won't wake from sleep or hibernation issues
+## Surface Dock Issues
 
-- [Surface won’t turn on or wake from sleep](https://www.microsoft.com/surface/support/warranty-service-and-recovery/surface-wont-turn-on-or-wake-from-sleep?os=windows-10&=undefined)
-- [Surface Pro 4 or Surface Book doesn't hibernate in Windows 10](https://support.microsoft.com/help/3122682)
-- [Surface Pro 3 doesn't hibernate after four hours in connected standby](https://support.microsoft.com/help/2998588/surface-pro-3-doesn-t-hibernate-after-four-hours-in-connected-standby)
-- [Surface Pro 3 Hibernation Doesn’t Occur on Enterprise Install](https://blogs.technet.microsoft.com/askcore/2014/11/05/surface-pro-3-hibernation-doesnt-occur-on-enterprise-install/)
+- [Troubleshoot Surface Dock and docking stations](https://support.microsoft.com/help/4023468/surface-troubleshoot-surface-dock-and-docking-stations)
 
+- [Troubleshoot connecting Surface to a second screen](https://support.microsoft.com/help/4023496)
 
-## Other common issues
+- [Microsoft Surface Dock Firmware Update](https://docs.microsoft.com/surface/surface-dock-updater)
 
-- [Trouble installing Surface updates](https://www.microsoft.com/surface/support/performance-and-maintenance/troubleshoot-updates?os=windows-10&=undefined)
-- [Troubleshooting common Surface Pro 3 issues post-deployment](http://blogs.technet.com/b/askcore/archive/2015/03/19/troubleshooting-common-surface-pro-3-issues-post-deployment.aspx)
-- [Surface Pro 3 hibernation doesn't occur on enterprise install](https://blogs.technet.microsoft.com/askcore/2014/11/05/surface-pro-3-hibernation-doesnt-occur-on-enterprise-install/)
-- [Reusing the same NIC for multiple PXE initiated deployments in System Center Configuration Manger OSD](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2015/08/27/reusing-the-same-nic-for-multiple-pxe-initiated-deployments-in-system-center-configuration-manger-osd)
-- [Troubleshoot docking stations for Surface Pro and Surface 3](https://www.microsoft.com/surface/support/hardware-and-drivers/troubleshoot-docking-station?os=windows-8.1-update-1&=undefined)
-- [What to do if Surface is running slower](https://www.microsoft.com/surface/support/performance-and-maintenance/what-to-do-if-surface-is-running-slower?os=windows-10&=undefined)
+## Surface Drivers and Firmware
 
+- [Surface Update History](https://support.microsoft.com/help/4036283)
 
+- [Download drivers and firmware for Surface](https://support.microsoft.com/help/4023482)
 
+- [Deploy the latest firmware and drivers for Surface devices](https://docs.microsoft.com/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices)
 
- 
+- [Manage Surface driver and firmware updates](https://docs.microsoft.com/surface/manage-surface-pro-3-firmware-updates)
 
+- [How to manage Surface driver updates in Configuration Manager](https://support.microsoft.com/help/4098906)
 
- 
+## Deployment Issues
 
+- [DISK0 not found when you deploy Windows on Surface Pro Model 1796 or Surface Laptop](https://support.microsoft.com/help/4046108)
 
+- [Surface Pro Model 1796 and Surface Laptop 1TB display two drives](https://support.microsoft.com/help/4046105)
 
+- [System SKU reference](https://docs.microsoft.com/surface/surface-system-sku-reference)
 
+## Reset device
 
+- [Creating and using a USB recovery drive for Surface](https://support.microsoft.com/help/4023512)
+
+- [FAQ:  Protecting your data if you send your Surface in for Service](https://support.microsoft.com/help/4023508)
+
+- [Microsoft Surface Data Eraser](https://docs.microsoft.com/surface/microsoft-surface-data-eraser)
diff --git a/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md b/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md
index 52bef60ccd..d57966b6cf 100644
--- a/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md
+++ b/devices/surface/surface-device-compatibility-with-windows-10-ltsc.md
@@ -6,10 +6,14 @@ ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: brecords
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 01/03/2018
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
+ms.reviewer: scottmca
+manager: dansimp
 ---
 
 # Surface device compatibility with Windows 10 Long-Term Servicing Channel (LTSC)
@@ -53,8 +57,8 @@ Before you choose to use Windows 10 Enterprise LTSC edition on Surface devices,
 * Surface device replacements (for example, devices replaced under warranty) may contain subtle variations in hardware components that require updated device drivers and firmware. Compatibility with these updates may require the installation of a more recent version of Windows 10 Enterprise LTSC or Windows 10 Pro or Enterprise with the SAC servicing option.
 
 >[!NOTE]
->Organizations that standardize on a specific version of Windows 10 Enterprise LTSC may be unable to adopt new generations of Surface hardware without also updating to a later version of Windows 10 Enterprise LTSC or Windows 10 Pro or Enterprise. For more information, see the **How will Windows 10 LTSBs be supported?** topic in the **Supporting the latest processor and chipsets on Windows** section of [Lifecycle Policy FAQ—Windows products](https://support.microsoft.com/help/18581/lifecycle-policy-faq-windows-products#b4).
+>Organizations that standardize on a specific version of Windows 10 Enterprise LTSC may be unable to adopt new generations of Surface hardware such as Surface Pro 7, Surface Pro X, or Surface Laptop 3 without also updating to a later version of Windows 10 Enterprise LTSC or Windows 10 Pro or Enterprise. For more information, see the **How will Windows 10 LTSBs be supported?** topic in the **Supporting the latest processor and chipsets on Windows** section of [Lifecycle Policy FAQ—Windows products](https://support.microsoft.com/help/18581/lifecycle-policy-faq-windows-products#b4).
 
 Surface devices running Windows 10 Enterprise LTSC edition will not receive new features. In many cases these features are requested by customers to improve the usability and capabilities of Surface hardware. For example, new improvements for High DPI applications in Windows 10, version 1703. Customers that use Surface devices in the LTSC configuration will not see the improvements until they either update to a new Windows 10 Enterprise LTSC release or upgrade to a version of Windows 10 with support for the SAC servicing option.
 
-Devices can be changed from Windows 10 Enterprise LTSC to a more recent version of Windows 10 Enterprise, with support for the SAC servicing option, without the loss of user data by performing an upgrade installation. You can also perform an upgrade installation on multiple devices by leveraging the Upgrade Task Sequence Templates available in the Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. For more information, see [Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/surface/upgrade-surface-devices-to-windows-10-with-mdt).
+Devices can be changed from Windows 10 Enterprise LTSC to a more recent version of Windows 10 Enterprise, with support for the SAC servicing option, without the loss of user data by performing an upgrade installation. You can also perform an upgrade installation on multiple devices by leveraging the Upgrade Task Sequence Templates available in the Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager. For more information, see [Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/surface/upgrade-surface-devices-to-windows-10-with-mdt).
diff --git a/devices/surface/surface-diagnostic-toolkit-business.md b/devices/surface/surface-diagnostic-toolkit-business.md
index 0a73499333..62c4129d08 100644
--- a/devices/surface/surface-diagnostic-toolkit-business.md
+++ b/devices/surface/surface-diagnostic-toolkit-business.md
@@ -1,16 +1,20 @@
 ---
-title: Surface Diagnostic Toolkit for Business
+title: Deploy Surface Diagnostic Toolkit for Business
 description: This topic explains how to use the Surface Diagnostic Toolkit for Business.
 ms.prod: w10
 ms.mktglfcycl: manage
+ms.localizationpriority: medium
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 11/15/2018
+ms.date: 10/31/2019
+ms.reviewer: hachidan
+manager: dansimp
+ms.audience: itpro
 ---
 
-# Surface Diagnostic Toolkit for Business
+# Deploy Surface Diagnostic Toolkit for Business
 
 The Microsoft Surface Diagnostic Toolkit for Business (SDT) enables IT administrators to quickly investigate, troubleshoot, and resolve hardware, software, and firmware issues with Surface devices. You can run a range of diagnostic tests and software repairs in addition to obtaining device health insights and guidance for resolving issues. 
 
@@ -27,18 +31,18 @@ Specifically, SDT for Business enables you to:
 
 To run SDT for Business, download the components listed in the following table.
 
->[!NOTE]
->In contrast to the way you typically install MSI packages, the SDT distributable MSI package can only be created by running Windows Installer (msiexec.exe) at a command prompt and setting the custom flag `ADMINMODE = 1`. For details, see [Run Surface Diagnostic Toolkit using commands](surface-diagnostic-toolkit-command-line.md).  
 
 Mode |	Primary scenarios | Download | Learn more
 --- | --- | --- | ---
 Desktop mode |	Assist users in running SDT on their Surface devices to troubleshoot issues.
            Create a custom package to deploy on one or more Surface devices allowing users to select specific logs to collect and analyze. | SDT distributable MSI package:
            Microsoft Surface Diagnostic Toolkit for Business Installer
            [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) | [Use Surface Diagnostic Toolkit in desktop mode](surface-diagnostic-toolkit-desktop-mode.md)
-Command line |	Directly troubleshoot Surface devices remotely without user interaction, using standard tools such as Configuration Manager. It includes the following commands:
            `-DataCollector` collects all log files
            `-bpa` runs health diagnostics using Best Practice Analyzer.
            `-windowsupdate` checks Windows update for missing firmware or driver updates.

            **Note:** Support for the ability to confirm warranty information will be available via the  command `-warranty`	| SDT console app:
            Microsoft Surface Diagnostics App Console
            [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) | [Run Surface Diagnostic Toolkit using commands](surface-diagnostic-toolkit-command-line.md)
+Command line |	Directly troubleshoot Surface devices remotely without user interaction, using standard tools such as Configuration Manager. It includes the following commands:
            `-DataCollector` collects all log files
            `-bpa` runs health diagnostics using Best Practice Analyzer.
            `-windowsupdate` checks Windows Update for missing firmware or driver updates.
            `-warranty` checks warranty information. 

            | SDT console app:
            Microsoft Surface Diagnostics App Console
            [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) | [Run Surface Diagnostic Toolkit using commands](surface-diagnostic-toolkit-command-line.md)
 
 ## Supported devices 
 
 SDT for Business is supported on Surface 3 and later devices, including:
 
+- Surface Pro 7
+- Surface Laptop 3
 - Surface Pro 6
 - Surface Laptop 2
 - Surface Go
@@ -57,16 +61,40 @@ SDT for Business is supported on Surface 3 and later devices, including:
 
 ## Installing Surface Diagnostic Toolkit for Business
 
-To create an SDT package that you can distribute to users in your organization, you first need to install SDT at a command prompt and set a custom flag to install the tool in admin mode. SDT contains the following install option flags:
+To create an SDT package that you can distribute to users in your organization:
+
+1. Sign in to your Surface device using the Administrator account.
+2. Download SDT Windows Installer Package (.msi) from the [Surface Tools for IT download page](https://www.microsoft.com/download/details.aspx?id=46703) and copy it to a preferred location on your Surface device, such as Desktop.
+3. The SDT setup wizard appears, as shown in figure 1. Click **Next**. 
+
+    >[!NOTE]
+    >If the setup wizard does not appear, ensure that you are signed into the Administrator account on your computer. 
+
+    ![welcome to the Surface Diagnostic Toolkit setup wizard](images/sdt-1.png)
+
+    *Figure 1. Surface Diagnostic Toolkit setup wizard*
+
+4. When the SDT setup wizard appears, click **Next**, accept the End User License Agreement (EULA)
+
+5. On the Install Options screen, change the default install location if desired. 
+6. Under Setup Type, select **Advanced**. 
+
+    >[!NOTE]
+    >The standard option allows users to run the diagnostic tool directly on their Surface device provided they are signed into their device using an Administrator account. 
+    
+     ![Install Options: Advanced](images/sdt-install.png)
+
+7. Click **Next** and then click **Install**. 
+
+## Installing using the command line
+If desired, you can install SDT at a command prompt and set a custom flag to install the tool in admin mode. SDT contains the following install option flags:
 
 - `SENDTELEMETRY` sends telemetry data to Microsoft. The flag accepts `0` for disabled or `1` for enabled. The default value is `1` to send telemetry.
 - `ADMINMODE` configures the tool to be installed in admin mode. The flag accepts `0` for client mode or `1` for IT Administrator mode. The default value is `0`.
 
-**To install SDT in ADMINMODE:**
+### To install SDT from the command line:
 
-1.	Sign in to your Surface device using the Administrator account.
-2.	Download SDT Windows Installer Package (.msi) from the [Surface Tools for IT download page](https://www.microsoft.com/download/details.aspx?id=46703) and copy it to a preferred location on your Surface device, such as Desktop.
-3.	Open a command prompt and enter:
+1. Open a command prompt and enter:
 
     ```
     msiexec.exe /i  ADMINMODE=1. 
@@ -77,19 +105,6 @@ To create an SDT package that you can distribute to users in your organization,
     C:\Users\Administrator> msiexec.exe/I"C:\Users\Administrator\Desktop\Microsoft_Surface_Diagnostic_Toolkit_for_Business_Installer.msi" ADMINMODE=1
     ```
 
-4.	The SDT setup wizard appears, as shown in figure 1. Click **Next**. 
-
-    >[!NOTE]
-    >If the setup wizard does not appear, ensure that you are signed into the Administrator account on your computer. 
-
-    ![welcome to the Surface Diagnostic Toolkit setup wizard](images/sdt-1.png)
-
-    *Figure 1. Surface Diagnostic Toolkit setup wizard*
-
-5. When the SDT setup wizard appears, click **Next**, accept the End User License Agreement (EULA), and select a location to install the package. 
-
-6.	Click **Next** and then click **Install**. 
-
 ## Locating SDT on your Surface device
 
 Both SDT and the SDT app console are installed at `C:\Program Files\Microsoft\Surface\Microsoft Surface Diagnostic Toolkit for Business`.
@@ -105,28 +120,29 @@ In addition to the .exe file, SDT installs a JSON file and an admin.dll file (mo
 
 Creating a custom package allows you to target the tool to specific known issues.
 
-1.	Click **Start > Run**, enter **Surface** and then click **Surface Diagnostic Toolkit for Business**. 
-2.	When the tool opens, click **Create Custom Package**, as shown in figure 3.
+1. Click **Start > Run**, enter **Surface** and then click **Surface Diagnostic Toolkit for Business**. 
+2. When the tool opens, click **Create Custom Package**, as shown in figure 3.
 
     ![Create custom package option](images/sdt-3.png)
 
     *Figure 3. Create custom package*
 
-### Language and telemetry page
+### Language and telemetry settings
 
-  
-When you start creating the custom package, you’re asked whether you agree to send data to Microsoft to help improve the application. For more information,see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). Sharing is on by default, so uncheck the box if you wish to decline.
+  When creating a package, you can select language settings or opt out of sending telemetry information to Microsoft. By default, SDT sends telemetry to Microsoft that is used to improve the application in accordance with the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement). If you wish to decline, clear the check box when creating a custom package, as shown below. Or clear the **Send telemetry to Microsoft** check box on the **Install Options** page during SDT Setup. 
 
 >[!NOTE]
->This setting is limited to only sharing data generated while running packages. 
+>This setting does not affect the minimal telemetry automatically stored on Microsoft servers when running tests and repairs that require an Internet connection, such as Windows Update and Software repair, or providing feedback using the Smile or Frown buttons in the app toolbar. 
+
 
 ![Select language and telemetry settings](images/sdt-4.png)
 
 *Figure 4. Select language and telemetry settings*
 
+
 ### Windows Update page
 
-Select the option appropriate for your organization. Most organizations with multiple users will typically select to receive updates via Windows Server Update Services (WSUS), as shown in figure 5. If using local Windows update packages or WSUS, enter the path as appropriate. 
+Select the option appropriate for your organization. Most organizations with multiple users will typically select to receive updates via Windows Server Update Services (WSUS), as shown in figure 5. If using local Windows Update packages or WSUS, enter the path as appropriate. 
 
 ![Select Windows Update option](images/sdt-5.png)
 
@@ -153,13 +169,31 @@ You can select to run a wide range of logs across applications, drivers, hardwar
 - [Use Surface Diagnostic Toolkit for Business in desktop mode](surface-diagnostic-toolkit-desktop-mode.md)
 - [Use Surface Diagnostic Toolkit for Business using commands](surface-diagnostic-toolkit-command-line.md)
 
+## Changes and updates
+### Version 2.43.139.0
+*Release date: October 21, 2019*
            
+This version of Surface Diagnostic Toolkit for Business adds support for the following:
+
+- Surface Pro 7
+- Surface Laptop 3
+
+### Version 2.42.139.0
+*Release date: September 24, 2019*
            
+This version of Surface Diagnostic Toolkit for Business adds support for the following: 
+- Ability to download hardware reports.
+- Ability to contact Microsoft Support directly from the tool. 
            
+
+### Version 2.41.139.0
+*Release date: June 24, 2019*
            
+This version of Surface Diagnostic Toolkit for Business adds support for the following: 
+- Driver version information included in logs and report.
+- Ability to provide feedback about the app.
            
 
 
-
-
-
-
-
-
-
-
+### Version 2.36.139.0
+*Release date: April 26, 2019*
            
+This version of Surface Diagnostic Toolkit for Business adds support for the following: 
+- Advanced Setup option to unlock admin capabilities through the installer UI, without requiring command line configuration.
+- Accessibility improvements.
+- Surface brightness control settings included in logs.
+- External monitor compatibility support link in report generator.
diff --git a/devices/surface/surface-diagnostic-toolkit-command-line.md b/devices/surface/surface-diagnostic-toolkit-command-line.md
index 8d5cf4009c..6ea9d9ac55 100644
--- a/devices/surface/surface-diagnostic-toolkit-command-line.md
+++ b/devices/surface/surface-diagnostic-toolkit-command-line.md
@@ -4,18 +4,22 @@ description: How to run Surface Diagnostic Toolkit in a command console
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 11/15/2018
+ms.reviewer: hachidan
+manager: dansimp
+ms.localizationpriority: medium
+ms.audience: itpro
 ---
 
 # Run Surface Diagnostic Toolkit for Business using commands
 
-Running the Surface Diagnostic Toolkit (SDT) at a command prompt requires downloading the STD app console. After it's installed, you can run SDT at a command prompt via the Windows command console (cmd.exe) or using Windows PowerShell, including PowerShell Integrated Scripting Environment (ISE), which provides support for autocompletion of commands, copy/paste, and other features. 
+Running the Surface Diagnostic Toolkit (SDT) at a command prompt requires downloading the STD app console. After it's installed, you can run SDT at a command prompt via the Windows command console (cmd.exe) or using Windows PowerShell, including PowerShell Integrated Scripting Environment (ISE), which provides support for autocompletion of commands, copy/paste, and other features.  For a list of supported Surface devices in SDT, refer to [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md).
 
 >[!NOTE]
->To run SDT using commands, you must be signed in to the Administrator account or signed in to an account that is a member of the Administrator group on your Surface device. 
+>To run SDT using commands, you must be signed in to the Administrator account or signed in to an account that is a member of the Administrator group on your Surface device.
 
 ## Running SDT app console
 
@@ -39,7 +43,7 @@ Command | Notes
 
 
 >[!NOTE]
->To run the SDT app console remotely on target devices, you can use a configuration management tool such as System Center Configuration Manager. Alternatively, you can create a .zip file containing the console app and appropriate console commands and deploy per your organization’s software distribution processes. 
+>To run the SDT app console remotely on target devices, you can use a configuration management tool such as Microsoft Endpoint Configuration Manager. Alternatively, you can create a .zip file containing the console app and appropriate console commands and deploy per your organization’s software distribution processes. 
 
 ## Running Best Practice Analyzer 
 
diff --git a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md b/devices/surface/surface-diagnostic-toolkit-desktop-mode.md
index ee76845656..738ec1ecae 100644
--- a/devices/surface/surface-diagnostic-toolkit-desktop-mode.md
+++ b/devices/surface/surface-diagnostic-toolkit-desktop-mode.md
@@ -4,35 +4,37 @@ description: How to use SDT to help users in your organization run the tool to i
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
-author: jdeckerms
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 11/15/2018
+ms.date: 10/31/2019
+ms.reviewer: hachidan
+manager: dansimp
+ms.localizationpriority: medium
+ms.audience: itpro
 ---
 
 # Use Surface Diagnostic Toolkit for Business in desktop mode
 
-This topic explains how to use the Surface Diagnostic Toolkit (SDT) to help users in your organization run the tool to identify and diagnose issues with the Surface device. Successfully running SDT can quickly determine if a reported issue is caused by failed hardware or user error.
+This topic explains how to use the Surface Diagnostic Toolkit (SDT) to help users in your organization run the tool to identify and diagnose issues with the Surface device. Successfully running SDT can quickly determine if a reported issue is caused by failed hardware or user error. For a list of supported Surface devices in SDT, refer to [Deploy Surface Diagnostic Toolkit for Business](surface-diagnostic-toolkit-business.md).
 
-1.	Direct the user to install [the SDT package](surface-diagnostic-toolkit-business.md#create-custom-sdt) from a software distribution point or network share. After it is installed, you’re ready to guide the user through a series of tests. 
 
-2.	Begin at the home page, which allows users to enter a description of the issue, and click **Continue**, as shown in figure 1.
+1. Direct the user to install [the SDT package](surface-diagnostic-toolkit-business.md#create-custom-sdt) from a software distribution point or network share. After it is installed, you’re ready to guide the user through a series of tests. 
+
+2. Begin at the home page, which allows users to enter a description of the issue, and click **Continue**, as shown in figure 1.
 
     ![Start SDT in desktop mode](images/sdt-desk-1.png)
-
-    *Figure 1. SDT in desktop mode*
+*Figure 1. SDT in desktop mode*
 
 3. When SDT indicates the device has the latest updates, click **Continue** to advance to the catalog of available tests, as shown in figure 2.
 
     ![Select from SDT options](images/sdt-desk-2.png)
-
-    *Figure 2. Select from SDT options*
+*Figure 2. Select from SDT options*
 
 4. You can choose to run all the diagnostic tests. Or, if you already suspect a particular issue such as a faulty display or a power supply problem, click **Select** to choose from the available tests and click **Run Selected**, as shown in figure 3. See the following table for details of each test. 
 
     ![Select hardware tests](images/sdt-desk-3.png)
-
-    *Figure 3. Select hardware tests*
+*Figure 3. Select hardware tests*
 
     Hardware test | Description
     --- | ---
@@ -51,6 +53,7 @@ This topic explains how to use the Surface Diagnostic Toolkit (SDT) to help user
 
 
 
+
 ## Running multiple hardware tests to troubleshoot issues
 
 SDT is designed as an interactive tool that runs a series of tests. For each test, SDT provides instructions summarizing  the nature of the test and what users should expect or look for in order for the test to be successful. For example, to diagnose if the display brightness is working properly, SDT starts at zero and increases the brightness to 100 percent, asking users to confirm – by answering **Yes** or **No** -- that brightness is functioning as expected, as shown in figure 4. 
@@ -58,12 +61,11 @@ SDT is designed as an interactive tool that runs a series of tests. For each tes
 For each test, if functionality does not work as expected and the user clicks **No**, SDT generates a report of the possible causes and ways to troubleshoot it. 
 
 ![Running hardware diagnostics](images/sdt-desk-4.png)
-
 *Figure 4. Running hardware diagnostics*
 
-1.	If the brightness successfully adjusts from 0-100 percent as expected, direct the user to click **Yes** and then click **Continue**. 
-2.	If the brightness fails to adjust from 0-100 percent as expected, direct the user to click **No** and then click **Continue**. 
-3.	Guide users through remaining tests as appropriate. When finished, SDT automatically provides a high-level summary of the report, including the possible causes of any hardware issues along with guidance for resolution.
+1. If the brightness successfully adjusts from 0-100 percent as expected, direct the user to click **Yes** and then click **Continue**. 
+2. If the brightness fails to adjust from 0-100 percent as expected, direct the user to click **No** and then click **Continue**. 
+3. Guide users through remaining tests as appropriate. When finished, SDT automatically provides a high-level summary of the report, including the possible causes of any hardware issues along with guidance for resolution.
 
 
 ### Repairing applications
@@ -71,24 +73,18 @@ For each test, if functionality does not work as expected and the user clicks **
 SDT enables you to diagnose and repair applications that may be causing issues, as shown in figure 5.
 
 ![Running repairs](images/sdt-desk-5.png)
-
 *Figure 5. Running repairs*
-
-
-
-
 
+
 ### Generating logs for analyzing issues 
 
 SDT provides extensive log-enabled diagnosis support across applications, drivers, hardware, and operating system issues, as shown in figure 6.
 
 ![Generating logs](images/sdt-desk-6.png)
-
 *Figure 6. Generating logs*
 
-
-
 
+
 ### Generating detailed report comparing device vs. optimal configuration
 
 Based on the logs, SDT generates a report for software- and firmware-based issues that you can save to a preferred location.
diff --git a/devices/surface/surface-diagnostic-toolkit-for-business-intro.md b/devices/surface/surface-diagnostic-toolkit-for-business-intro.md
new file mode 100644
index 0000000000..df3918d715
--- /dev/null
+++ b/devices/surface/surface-diagnostic-toolkit-for-business-intro.md
@@ -0,0 +1,43 @@
+---
+title: Fix common Surface problems using the Surface Diagnostic Toolkit for Business
+description: This page provides an introduction to the Surface Diagnostic Toolkit for Business for use in commercial environments.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.date: 06/11/2019
+ms.reviewer: cottmca
+manager: dansimp
+ms.localizationpriority: medium
+ms.audience: itpro
+---
+
+# Fix common Surface problems using the Surface Diagnostic Toolkit for Business
+
+If your Surface isn’t working properly, the Microsoft Surface Diagnostic Toolkit for Business can help you or your administrator find and solve problems.
+
+> [!NOTE]
+> Surface Diagnostic Toolkit for Business is built for commercial devices. If your device is a personal device and not managed by your work or school run the [Surface Diagnostic Toolkit](https://support.microsoft.com/en-us/help/4037239/surface-fix-common-surface-problems-using-surface-diagnostic-toolkit) instead.
+
+## Run the Surface Diagnostic Toolkit for Business
+
+Before you run the diagnostic tool, make sure you have the latest Windows updates. Go to [Install Surface and Windows 10 updates](https://support.microsoft.com/en-us/help/4023505/surface-install-surface-and-windows-updates) for more information. If that doesn't solve the problem, you'll need to run the diagnostic tool.
+
+> [!NOTE]
+> The Surface Diagnostic Toolkit for Business only works on Surface devices running Windows 10. It does  not work on Surface Pro, Surface Pro 2, or Surface devices configured in S mode.
+
+**To run the Surface Diagnostic Toolkit for Business:**
+
+1. Download the [Surface Diagnostic Toolkit for Business](https://aka.ms/SDT4B).
+2. Select Run and follow the on-screen instructions. For full details, refer to [Deploy Surface Diagnostic Toolkit for Business](https://docs.microsoft.com/surface/surface-diagnostic-toolkit-business).
+
+The diagnosis and repair time averages 15 minutes but could take an hour or longer, depending on internet connection speed and the number of updates or repairs required. 
+# If you still need help
+
+If the Surface Diagnostic Toolkit for Business didn’t fix the problem, you can also:
+
+- Make an in-store appointment: We might be able to fix the problem or provide a replacement Surface at your local Microsoft Store. [Locate a Microsoft Store near you](https://www.microsoft.com/store/locations/find-a-store?WT.mc_id=MSC_Solutions_en_us_scheduleappt).
+- Contact customer support: If you want to talk to someone about how to fix your problem, [contact us](https://support.microsoft.com/en-us/help/4037645/contact-surface-warranty-and-software-support-for-business).
+- Get your Surface serviced: If your Surface product needs service, [request it online](https://mybusinessservice.surface.com/). 
diff --git a/devices/surface/surface-dock-firmware-update.md b/devices/surface/surface-dock-firmware-update.md
new file mode 100644
index 0000000000..dc3e5b41f0
--- /dev/null
+++ b/devices/surface/surface-dock-firmware-update.md
@@ -0,0 +1,207 @@
+---
+title: Microsoft Surface Dock Firmware Update
+description: This article explains how to use Microsoft Surface Dock Firmware Update, newly redesigned to update Surface Dock firmware while running in the background on your Surface device.
+ms.localizationpriority: medium
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.date: 10/09/2019
+ms.reviewer: scottmca
+manager: dansimp
+ms.audience: itpro
+---
+# Microsoft Surface Dock Firmware Update
+
+This article explains how to use Microsoft Surface Dock Firmware Update, newly redesigned to update Surface Dock firmware while running in the background on your Surface device. Once installed, it will update any Surface Dock attached to your Surface device. 
+
+> [!NOTE]
+>Microsoft Surface Dock Firmware Update supersedes the earlier Microsoft Surface Dock Updater tool, previously available for download as part of Surface Tools for IT. It was named Surface_Dock_Updater_vx.xx.xxx.x.msi (where x indicates the version of the tool). The earlier tool has been retired, is no longer available for download, and should not be used.
+
+## To run Surface Dock Firmware Update
+
+1. Download and install [Microsoft Surface Dock Firmware Update](https://www.microsoft.com/download/details.aspx?id=46703).
+    - The file is released in the following naming format: **Surface_Dock_FwUpdate_X.XX.XXX_Win10_XXXXX_XX.XXX.XXXXX_X.MSI** and installs by default to C:\Program Files\SurfaceUpdate.
+    - Requires Surface devices running at least Windows 10 version 1803 or later.
+
+2. After you connect Surface Dock to your Surface device, the tool checks the firmware status while running in the background.
+ 
+4. After several seconds, disconnect your Surface Dock from your device and then wait for 5 seconds before reconnecting. The Surface Dock Firmware Update will normally update the dock silently in background after you disconnect from the dock and reconnect. The process can take a few minutes to complete and will continue even if interrupted. 
+
+### Manual installation
+If preferred, you can manually complete the update as follows:
+
+- Reconnect your Surface Dock for 2 minutes and then disconnect it from your device. The DisplayPort firmware update will be installed while the hardware is disconnected. The LED in the Ethernet port of the dock will blink while the update is in progress. Please wait until the LED stops blinking before you unplug your Surface Dock from power.
+
+> [!NOTE]
+>
+> - Manually installing the MSI file may prompt you to restart Surface; however, restarting is optional and not required.
+> - You will need to disconnect and reconnect the dock twice before the update fully completes.
+> - To create a log file, specify the path in the Msiexec command. For example, append /l*v %windir%\logs\ SurfaceDockFWI.log".
+
+## Network deployment
+
+You can use Windows Installer commands (Msiexec.exe) to deploy Surface Dock Firmware Update to multiple devices across your network. When using Microsoft Endpoint Configuration Manager or other deployment tool, enter the following syntax to ensure the installation is silent:
+
+- **Msiexec.exe /i  /quiet /norestart** 
+
+> [!NOTE]
+> A log file is not created by default. In order to create a log file, you will need to append "/l*v [path]"
+
+For more information, refer to [Command line options](https://docs.microsoft.com/windows/win32/msi/command-line-options) documentation.
+
+> [!IMPORTANT]
+> If you want to keep your Surface Dock updated using any other method, refer to [Update your Surface Dock](https://support.microsoft.com/help/4023478/surface-update-your-surface-dock) for details.
+
+## Intune deployment
+You can use Intune to distribute Surface Dock Firmware Update to your devices. First you will need to convert the MSI file to the .intunewin format, as described in the following documentation: [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps/apps-win32-app-management).
+
+Use the following command:
+  - **msiexec /i  /quiet /q**
+
+## How to verify completion of firmware update
+
+Surface dock firmware consists of two components:
+
+- **Component10:** Micro controller unit (MCU) firmware
+- **Component20:** Display port (DP) firmware.
+
+Successful completion of Surface Dock Firmware Update results in new registry key values for these firmware components.
+
+**To verify updates:**
+
+1. Open Regedit and navigate to the following registry path:
+
+- **HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WUDF\Services\SurfaceDockFwUpdate\Parameters**
+
+2. Look for the registry keys: **Component10CurrentFwVersion and Component20CurrentFwVersion**, which refer to the firmware that is currently on the device.
+
+ ![Surface Dock Firmware Update installation process](images/regeditDock.png)
+
+3. Verify the new registry key values match the updated registry key values listed in the Versions reference at the end of this document. If the values match, the firmware was updated successfully.
+
+4. If unable to verify, review Event logging and Troubleshooting tips in the next section.
+
+## Event logging
+
+**Table 1. Log files for Surface Dock Firmware Update**
+
+| Log                              | Location                               | Notes                                                                                                                                                                                                         |
+| -------------------------------- | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Surface Dock Firmware Update log | Path needs to be specified (see note) | Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater.                                                                                                  |
+| Windows Device Install log       | %windir%\inf\setupapi.dev.log           | For more information about using Device Install Log, refer to [SetupAPI Logging](https://docs.microsoft.com/windows-hardware/drivers/install/setupapi-logging--windows-vista-and-later-) documentation. |
+
+
+**Table 2. Event log IDs for Surface Dock Firmware Update**
            
+Events are logged in the Application Event Log.  Note:  Earlier versions of this tool wrote events to Applications and Services Logs\Microsoft Surface Dock Updater.
+
+| Event ID | Event type                                                           |
+| -------- | -------------------------------------------------------------------- |
+| 2001     | Dock firmware update has started.                                    |
+| 2002     | Dock firmware update skipped because dock is known to be up to date. |
+| 2003     | Dock firmware update failed to get firmware version.                 |
+| 2004     | Querying the firmware version.                                       |
+| 2005     | Dock firmware failed to start update.                                |
+| 2006     | Failed to send offer/payload pairs.                                  |
+| 2007     | Firmware update finished.                                            |
+| 2008     | BEGIN dock telemetry.                                                |
+| 2011     | END dock telemetry.                                                  |
+
+## Troubleshooting tips
+
+- Completely disconnect power for Surface dock from the AC power to reset the Surface Dock.
+- Disconnect all peripherals except for the Surface Dock.
+- Uninstall any current Surface Dock Firmware Update and then install the latest version.
+- Ensure that the Surface Dock is disconnected, and then allow enough time for the update to complete as monitored via an LED in the Ethernet port of the dock. Wait until the LED stops blinking before you unplug Surface Dock from power.
+- Connect the Surface Dock to a different device to see if it is able to update the dock.
+
+## Changes and updates
+
+Microsoft periodically releases new versions of Surface Dock Firmware Update.Note that the MSI file is not self-updating. If you have deployed the MSI to Surface devices and a new version of the firmware is released, you will need to deploy the new version of the MSI.
+
+## Versions reference
+### Version 1.42.139 
+*Release Date: September 18 2019*
+
+This version, contained in Surface_Dock_FwUpdate_1.42.139_Win10_17134_19.084.31680_0.MSI, updates firmware in the background. 
+**Updated registry key values:**
            
+
+- Component10CurrentFwVersion updated to **4ac3970**.
+- Component20CurrentFwVersion updated to **4a1d570**.
+
+It adds support for Surface Pro 7 and Surface Laptop 3.
+
+## Legacy versions
+
+### Version 2.23.139.0
+*Release Date: 10 October 2018*
+
+This version of Surface Dock Updater adds support for the following:
+
+- Add support for Surface Pro 6
+- Add support for Surface Laptop 2
+
+
+### Version 2.22.139.0
+*Release Date: 26 July 2018*
+
+This version of Surface Dock Updater adds support for the following:
+
+- Increase update reliability
+- Add support for Surface Go
+
+### Version 2.12.136.0
+*Release Date: 29 January 2018*
+
+This version of Surface Dock Updater adds support for the following:
+* Update for Surface Dock Main Chipset Firmware
+* Update for Surface Dock DisplayPort Firmware
+* Improved display stability for external displays when used with Surface Book or Surface Book 2
+
+Additionally, installation of this version of Surface Dock Updater on Surface Book devices includes the following:
+* Update for Surface Book Base Firmware
+* Added support for Surface Dock firmware updates with improvements targeted to Surface Book devices
+
+
+### Version 2.9.136.0
+*Release date: November 3, 2017*
+
+This version of Surface Dock Updater adds support for the following:
+
+* Update for Surface Dock DisplayPort Firmware
+* Resolves an issue with audio over passive display port adapters
+
+### Version 2.1.15.0
+*Release date: June 19, 2017*
+
+This version of Surface Dock Updater adds support for the following:
+
+* Surface Laptop
+* Surface Pro
+
+### Version 2.1.6.0
+*Release date: April 7, 2017*
+
+This version of Surface Dock Updater adds support for the following:
+
+* Update for Surface Dock DisplayPort firmware
+* Requires Windows 10
+
+### Version 2.0.22.0
+*Release date: October 21, 2016*
+
+This version of Surface Dock Updater adds support for the following:
+
+* Update for Surface Dock USB firmware
+* Improved reliability of Ethernet, audio, and USB ports
+
+### Version 1.0.8.0
+*Release date: April 26, 2016*
+
+This version of Surface Dock Updater adds support for the following:
+
+* Update for Surface Dock Main Chipset firmware
+* Update for Surface Dock DisplayPort firmware
+
diff --git a/devices/surface/surface-dock-updater.md b/devices/surface/surface-dock-updater.md
deleted file mode 100644
index 10b49c4719..0000000000
--- a/devices/surface/surface-dock-updater.md
+++ /dev/null
@@ -1,197 +0,0 @@
----
-title: Microsoft Surface Dock Updater (Surface)
-description: This article provides a detailed walkthrough of Microsoft Surface Dock Updater.
-ms.assetid: 1FEFF277-F7D1-4CB4-8898-FDFE8CBE1D5C
-keywords: install, update, firmware
-ms.localizationpriority: medium
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.pagetype: surface, devices
-ms.sitesec: library
-author: brecords
-ms.date: 02/23/2018
-ms.author: jdecker
-ms.topic: article
----
-
-# Microsoft Surface Dock Updater
-
-
-This article provides a detailed walkthrough of Microsoft Surface Dock Updater.
-
-The [Microsoft Surface Dock Updater](https://www.microsoft.com/download/details.aspx?id=46703) tool allows you to check the firmware status of a Surface Dock and to manually update the firmware of Surface Dock devices. It is most often used to update Surface Docks prior to deployment of those Surface Docks to end users or as a troubleshooting tool. Microsoft Surface Dock Updater walks you through the process of updating the firmware on one or more Surface Docks, including the required connect and disconnect steps to perform the complete firmware installation.
-
-When you run the Microsoft Surface Dock Updater installer you will be prompted to accept an End User License Agreement (EULA).
-
->[!NOTE]
->Updating Surface Dock firmware requires connectivity to the Surface Dock via the Surface Connect™ port. Installation of the Microsoft Surface Dock Updater is only supported on devices that feature the Surface Connect™ port.
-
->[!NOTE]
->The Surface Dock Updater tool is unable to run on Windows 10 S. To manually update a Surface Dock for use with Surface Laptop and Windows 10 S, connect the Surface Dock to another Surface device with a Windows 10 Pro or Windows 10 Enterprise environment.
-
-## Update a Surface Dock with Microsoft Surface Dock Updater
-
-
-After you install the [Microsoft Surface Dock Updater](https://www.microsoft.com/download/details.aspx?id=46703) tool, you can find Microsoft Surface Dock Updater under **All Apps** in your Start menu. Click **Microsoft Surface Dock Updater** to start the application.
-
-To update a Surface Dock with Microsoft Surface Dock Updater, follow these steps:
-
-1.  Click Start to begin the firmware update process. If you do not have a Surface Dock connected, you will be prompted to connect a Surface Dock.
-
-2.  Microsoft Surface Dock Updater checks the status of your Surface Dock firmware.
-
-    -   If the tool determines that the firmware of your Surface Dock is up to date, a **You have the latest firmware for this Surface Dock** message is displayed, as shown in Figure 1.
-
-        ![Screen that shows your Surface Dock firmware is up to date](images/surfacedockupdater-fig1-uptodate-568pix.png "Screen that shows your Surface Dock firmware is up to date")
-
-        *Figure 1. Your Surface Dock firmware is up to date*
-
-    -   If Microsoft Surface Dock Updater determines that the firmware of your Surface Dock is not up to date, a **This Surface Dock is not running the latest firmware** message is displayed, as shown in Figure 2.
-
-        ![Screen that shows your Surface Dock firmware needs to be updated](images/surfacedockupdater-fig2a-needsupdating.png "Screen that shows your Surface Dock firmware needs to be updated")
-
-        *Figure 2. Your Surface Dock firmware needs to be updated*
-
-3.  To begin the firmware update process, click **Update** on the **Surface Dock Firmware** page.
-
-4.  Before the firmware update process begins, you will be prompted for confirmation. Click **OK** to proceed or **Cancel** to return to the **Surface Dock Firmware** page displaying the status of your Surface Dock firmware.
-
-5.  As the firmware update is uploaded to the Surface Dock, a **Progress** page is displayed, as shown in Figure 3. Do not disconnect the Surface Dock while firmware is being uploaded.
-
-    ![Progress of firmware update upload](images/surfacedockupdater-fig3-progress.png "Progress of firmware update upload")
-
-    *Figure 3. Progress of firmware update upload to Surface Dock*
-
-6.  After the firmware update has successfully uploaded to the Surface Dock, you are prompted to disconnect and then reconnect the Surface Dock from the Surface device, as shown in Figure 4. The main chipset firmware update will be applied while the Surface Dock is disconnected.
-
-    ![Disconnect and reconnect Surface Dock when prompted](images/surfacedockupdater-fig4-disconnect.png "Disconnect and reconnect Surface Dock when prompted")
-
-    *Figure 4. Disconnect and reconnect Surface Dock when prompted*
-
-7.  When the main chipset firmware update is verified, the DisplayPort chipset firmware update will be uploaded to the Surface Dock. Upon completion, a **Success** page is displayed and you will again be prompted to disconnect the Surface Dock, as shown in Figure 5.
-
-    ![Screen showing successful upload](images/surfacedockupdater-fig5-success.png "Screen showing successful upload")
-
-    *Figure 5. Successful upload of Surface Dock firmware*
-
-8.  After you disconnect the Surface Dock the DisplayPort firmware update will be installed. This process occurs on the Surface Dock hardware while it is disconnected. The Surface Dock must remain powered for up to 3 minutes after it has been disconnected for the firmware update to successfully install. An **Update in Progress** page is displayed (as shown in Figure 6), with a countdown timer to show the estimated time remaining to complete the firmware update installation.
-
-    ![Countdown timer to complete firmware installation](images/surfacedockupdater-fig6-countdown.png "Countdown timer to complete firmware installation")
-
-    *Figure 6. Countdown timer to complete firmware installation on Surface Dock*
-
-9.  If you want to update multiple Surface Docks in one sitting, you can click the **Update another Surface Dock** button to begin the process on the next Surface Dock.
-
-    >[!NOTE]
-    >The LED in the Ethernet port of the dock will blink while the update is in progress. Please wait until the LED stops blinking before you unplug your Surface Dock from power.
-
-     
-
-## Troubleshooting Microsoft Surface Dock Updater
-
-
-If the Surface Dock firmware update process encounters an installation error with either firmware update, the **Encountered an unexpected error** page may be displayed, as shown in Figure 7.
-
-![Firmware update installation error](images/surfacedockupdater-fig7-error.png "Firmware update installation error")
-
-*Figure 7. Firmware update installation has encountered an error*
-
-Microsoft Surface Dock Updater logs its progress into the Event Log, as shown in Figure 8. If you need to troubleshoot an update through this tool, you will find Surface Dock events recorded with the following event IDs:
-
-| Event ID | Event type                                               |
-|----------|----------------------------------------------------------|
-| 12100    | Up-to-date confirmation                                  |
-| 12101    | Event in the main chipset firmware update process        |
-| 12102    | Event in the DisplayPort chipset firmware update process |
-| 12105    | Error                                                    |
-
-
-![Surface Dock Updater events in Event Viewer](images/surfacedockupdater-fig8-737test.png "Surface Dock Updater events in Event Viewer")
-
-*Figure 8. Surface Dock Updater events in Event Viewer*
-
-## Changes and updates
-
-Microsoft periodically updates Surface Dock Updater. 
-
->[!Note]
->Each update to Surface Dock firmware is included in a new version of Surface Dock Updater. To update a Surface Dock to the latest firmware, you must use the latest version of Surface Dock Updater.
-
-### Version 2.23.139.0
-*Release Date: 10 October 2018*
-
-This version of Surface Dock Updater adds support for the following:
-
-- Add support for Surface Pro 6
-- Add support for Surface Laptop 2
-
-
-### Version 2.22.139.0
-*Release Date: 26 July 2018*
-
-This version of Surface Dock Updater adds support for the following:
-
-- Increase update reliability
-- Add support for Surface Go
-
-### Version 2.12.136.0
-*Release Date: 29 January 2018*
-
-This version of Surface Dock Updater adds support for the following:
-* Update for Surface Dock Main Chipset Firmware
-* Update for Surface Dock DisplayPort Firmware
-* Improved display stability for external displays when used with Surface Book or Surface Book 2
-
-Additionally, installation of this version of Surface Dock Updater on Surface Book devices includes the following:
-* Update for Surface Book Base Firmware
-* Added support for Surface Dock firmware updates with improvements targeted to Surface Book devices
-
->[!Note]
->Before the Surface Dock firmware update applied by Surface Dock Updater v2.12.136.0 will take effect on a Surface Book device, a firmware update for the Surface Book Base is required. If you install Surface Dock Updater v2.12.136.0 on a Surface Book and update an attached Surface Dock from that same device, the firmware of the Surface Book Base will automatically be updated when installing the Surface Dock Updater. However, if you update a Surface Dock using Surface Dock Updater v2.12.136.0 on different device, and then connect that Surface Dock to a Surface Book where Surface Dock Updater v2.12.136.0 has not been installed, the benefits of the updated Surface Dock will not be enabled. To enable the benefits of the updated Surface Dock on a Surface Book device, Surface Book Base firmware must also be updated by installing Surface Dock Updater v2.12.136.0 on the Surface Book device. Surface Book Base firmware update is not required on a Surface Book 2 device.
-
-
-### Version 2.9.136.0
-*Release date: November 3, 2017*
-
-This version of Surface Dock Updater adds support for the following:
-
-* Update for Surface Dock DisplayPort Firmware
-* Resolves an issue with audio over passive display port adapters
-
-### Version 2.1.15.0
-*Release date: June 19, 2017*
-
-This version of Surface Dock Updater adds support for the following:
-
-* Surface Laptop
-* Surface Pro
-
-### Version 2.1.6.0
-*Release date: April 7, 2017*
-
-This version of Surface Dock Updater adds support for the following:
-
-* Update for Surface Dock DisplayPort firmware
-* Requires Windows 10
-
-### Version 2.0.22.0
-*Release date: October 21, 2016*
-
-This version of Surface Dock Updater adds support for the following:
-
-* Update for Surface Dock USB firmware
-* Improved reliability of Ethernet, audio, and USB ports
-
-### Version 1.0.8.0
-*Release date: April 26, 2016*
-
-This version of Surface Dock Updater adds support for the following:
-
-* Update for Surface Dock Main Chipset firmware
-* Update for Surface Dock DisplayPort firmware
-
-
-
-
-
-
diff --git a/devices/surface/surface-enterprise-management-mode.md b/devices/surface/surface-enterprise-management-mode.md
index e42a925b72..52e193b6dd 100644
--- a/devices/surface/surface-enterprise-management-mode.md
+++ b/devices/surface/surface-enterprise-management-mode.md
@@ -6,10 +6,14 @@ ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices, security
 ms.sitesec: library
-author: jobotto
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 01/06/2017
+ms.date: 12/02/2019
+ms.reviewer: scottmca
+manager: dansimp
+ms.localizationpriority: medium
+ms.audience: itpro
 ---
 
 # Microsoft Surface Enterprise Management Mode
@@ -17,22 +21,21 @@ ms.date: 01/06/2017
 Microsoft Surface Enterprise Management Mode (SEMM) is a feature of Surface devices with Surface UEFI that allows you to secure and manage firmware settings within your organization. With SEMM, IT professionals can prepare configurations of UEFI settings and install them on a Surface device. In addition to the ability to configure UEFI settings, SEMM also uses a certificate to protect the configuration from unauthorized tampering or removal.
 
 >[!NOTE]
->SEMM is only available on devices with Surface UEFI firmware such as Surface Pro 4 and later, Surface Go, Surface Laptop, Surface Book, and Surface Studio. For more information about Surface UEFI, see [Manage Surface UEFI Settings](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings).
+>SEMM is only available on devices with Surface UEFI firmware. This includes most Surface devices including Surface Pro 7, Surface Pro X, and Surface Laptop 3 commercial SKUs with an Intel processor. SEMM is not supported on the 15" Surface Laptop 3 SKU with AMD processor (only available as a retail SKU). 
 
 When Surface devices are configured by SEMM and secured with the SEMM certificate, they are considered *enrolled* in SEMM. When the SEMM certificate is removed and control of UEFI settings is returned to the user of the device, the Surface device is considered *unenrolled* in SEMM.
 
-There are two administrative options you can use to manage SEMM and enrolled Surface devices – a standalone tool or integration with System Center Configuration Manager. The SEMM standalone tool, called the Microsoft Surface UEFI Configurator, is described in this article. For more information about how to manage SEMM with System Center Configuration Manager, see [Use System Center Configuration Manager to manage devices with SEMM](https://technet.microsoft.com/itpro/surface/use-system-center-configuration-manager-to-manage-devices-with-semm).
+There are two administrative options you can use to manage SEMM and enrolled Surface devices – a standalone tool or integration with Microsoft Endpoint Configuration Manager. The SEMM standalone tool, called the Microsoft Surface UEFI Configurator, is described in this article. For more information about how to manage SEMM with Microsoft Endpoint Configuration Manager, see [Use Microsoft Endpoint Configuration Manager to manage devices with SEMM](https://technet.microsoft.com/itpro/surface/use-system-center-configuration-manager-to-manage-devices-with-semm).
+
 
 ## Microsoft Surface UEFI Configurator
 
 The primary workspace of SEMM is Microsoft Surface UEFI Configurator, as shown in Figure 1. Microsoft Surface UEFI Configurator is a tool that is used to create Windows Installer (.msi) packages or WinPE images that are used to enroll, configure, and unenroll SEMM on a Surface device. These packages contain a configuration file where the settings for UEFI are specified. SEMM packages also contain a certificate that is installed and stored in firmware and used to verify the signature of configuration files before UEFI settings are applied.
 
-![Microsoft Surface UEFI Configurator](images\surface-ent-mgmt-fig1-uefi-configurator.png "Microsoft Surface UEFI Configurator")
+![Microsoft Surface UEFI Configurator](images/surface-ent-mgmt-fig1-uefi-configurator.png "Microsoft Surface UEFI Configurator")
 
 *Figure 1. Microsoft Surface UEFI Configurator*
 
->[!NOTE]
->Windows 10 is required to run Microsoft Surface UEFI Configurator
 
 You can use the Microsoft Surface UEFI Configurator tool in three modes:
 
@@ -49,7 +52,7 @@ You can download Microsoft Surface UEFI Configurator from the [Surface Tools for
 
 Surface UEFI configuration packages are the primary mechanism to implement and manage SEMM on Surface devices. These packages contain a configuration file of UEFI settings specified during creation of the package in Microsoft Surface UEFI Configurator and a certificate file, as shown in Figure 2. When a configuration package is run for the first time on a Surface device that is not already enrolled in SEMM, it provisions the certificate file in the device’s firmware and enrolls the device in SEMM. When enrolling a device in SEMM, you will be prompted to confirm the operation by providing the last two digits of the SEMM certificate thumbprint before the certificate file is stored and the enrollment can complete. This confirmation requires that a user be present at the device at the time of enrollment to perform the confirmation.
 
-![Secure a SEMM configuration package with a certificate](images\surface-ent-mgmt-fig2-securepackage.png "Secure a SEMM configuration package with a certificate")
+![Secure a SEMM configuration package with a certificate](images/surface-ent-mgmt-fig2-securepackage.png "Secure a SEMM configuration package with a certificate")
 
 *Figure 2. Secure a SEMM configuration package with a certificate*
 
@@ -60,17 +63,9 @@ See the [Surface Enterprise Management Mode certificate requirements](#surface-e
 
 After a device is enrolled in SEMM, the configuration file is read and the settings specified in the file are applied to UEFI. When you run a configuration package on a device that is already enrolled in SEMM, the signature of the configuration file is checked against the certificate that is stored in the device firmware. If the signature does not match, no changes are applied to the device.
 
-You can use Surface UEFI settings to enable or disable the operation of individual components, such as cameras, wireless communication, or docking USB port (as shown in Figure 3), and configure advanced settings (as shown in Figure 4).
+### Enable or disable devices in Surface UEFI with SEMM
 
-![Enable or disable devices in Surface UEFI with SEMM](images\surface-ent-mgmt-fig3-enabledisable.png "Enable or disable devices in Surface UEFI with SEMM")
-
-*Figure 3. Enable or disable devices in Surface UEFI with SEMM*
-
-![Configure advanced settings in SEMM](images\surface-ent-mgmt-fig4-advancedsettings.png "Configure advanced settings in SEMM")
-
-*Figure 4. Configure advanced settings with SEMM*
-
-You can enable or disable the following devices with SEMM:
+The following list shows all the available devices you can manage in SEMM:
 
 * Docking USB Port
 * On-board Audio
@@ -84,31 +79,40 @@ You can enable or disable the following devices with SEMM:
 * Wi-Fi and Bluetooth
 * LTE
 
-You can configure the following advanced settings with SEMM:
+ >[!NOTE]
+>The built-in devices that appear in the UEFI Devices page may vary depending on your device or corporate environment. For example, the UEFI Devices page is not supported on Surface Pro X; LTE only appears on LTE-equipped devices. 
+### Configure advanced settings with SEMM
+**Table 1. Advanced settings**
+
+| Setting                            | Description                                                                                                                                                                                        |
+| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| IPv6 for PXE Boot                  | Allows you to manage Ipv6 support for PXE boot. If you do not configure this setting, IPv6 support for PXE boot is disabled.                                                                               |
+| Alternate Boot                     | Allows you to manage use of an Alternate boot order to boot directly to a USB or Ethernet device by pressing both the Volume Down button and Power button during boot. If you do not configure this setting, Alternate boot is enabled. |
+| Boot Order Lock                    | Allows you to lock the boot order to prevent changes. If you do not configure this setting, Boot Order Lock is disabled.                                                                                                        |
+| USB Boot                           | Allows you to manage booting to USB devices. If you do not configure this setting, USB Boot is enabled.                                                                                                                 |
+| Network Stack                      | Allows you to manage Network Stack boot settings. If you do not configure this setting,  the ability to manage Network Stack boot settings is disabled.                                                                                                           |
+| Auto Power On                      | Allows you to manage Auto Power On boot settings. If you do not configure this setting, Auto Power on is enabled.                                                                                                        |
+| Simultaneous Multi-Threading (SMT) | Allows you to manage Simultaneous Multi-Threading (SMT) to enable or disable hyperthreading. If you do not configure this setting, SMT is enabled.                                                  |
+|Enable Battery limit| Allows you to manage Battery limit functionality. If you do not configure this setting, Battery limit is enabled |
+| Security                           | Displays the Surface UEFI **Security** page. If you do not configure this setting, the Security page is displayed.                                                                                                                 |
+| Devices                            | Displays the Surface UEFI **Devices** page. If you do not configure this setting,  the Devices page is displayed.                                                                                                                     |
+| Boot                               | Displays the Surface UEFI **Boot** page. If you do not configure this setting, the DateTime page is displayed.                                                                                                                                                            |
+| DateTime                           | Displays the Surface UEFI **DateTime** page. If you do not configure this setting, the DateTime page is displayed.                                                                                                                |
+
 
-* IPv6 support for PXE boot
-* Alternate boot order, where the Volume Down button and Power button can be pressed together during boot, to boot directly to a USB or Ethernet device
-* Lock the boot order to prevent changes
-* Support for booting to USB devices
-* Enable Network Stack boot settings
-* Enable Auto Power On boot settings
-* Display of the Surface UEFI **Security** page
-* Display of the Surface UEFI **Devices** page
-* Display of the Surface UEFI **Boot** page
-* Display of the Surface UEFI **DateTime** page
 
 >[!NOTE]
->When you create a SEMM configuration package, two characters are shown on the **Successful** page, as shown in Figure 5.
+>When you create a SEMM configuration package, two characters are shown on the **Successful** page, as shown in Figure 3.
 
-![Certificate thumbprint display](images\surface-ent-mgmt-fig5-success.png "Certificate thumbprint display")
+![Certificate thumbprint display](images/surface-ent-mgmt-fig5-success.png "Certificate thumbprint display")
 
-*Figure 5. Display of the last two characters of the certificate thumbprint on the Successful page*
+*Figure 3. Display of the last two characters of the certificate thumbprint on the Successful page*
 
-These characters are the last two characters of the certificate thumbprint and should be written down or recorded. The characters are required to confirm enrollment in SEMM on a Surface device, as shown in Figure 6.
+These characters are the last two characters of the certificate thumbprint and should be written down or recorded. The characters are required to confirm enrollment in SEMM on a Surface device, as shown in Figure 4.
 
-![Enrollment confirmation in SEMM](images\surface-ent-mgmt-fig6-enrollconfirm.png "Enrollment confirmation in SEMM")
+![Enrollment confirmation in SEMM](images/surface-ent-mgmt-fig6-enrollconfirm.png "Enrollment confirmation in SEMM")
 
-*Figure 6. Enrollment confirmation in SEMM with the SEMM certificate thumbprint*
+*Figure 4. Enrollment confirmation in SEMM with the SEMM certificate thumbprint*
 
 >[!NOTE]
 >Administrators with access to the certificate file (.pfx) can read the thumbprint at any time by opening the .pfx file in CertMgr. To view the thumbprint with CertMgr, follow this process:
@@ -120,7 +124,7 @@ These characters are the last two characters of the certificate thumbprint and s
 >6. **All** or **Properties Only** must be selected in the **Show** drop-down menu.
 >7. Select the field **Thumbprint**.
 
-To enroll a Surface device in SEMM or to apply the UEFI configuration from a configuration package, all you need to do is run the .msi file with administrative privileges on the intended Surface device. You can use application deployment or operating system deployment technologies such as [System Center Configuration Manager](https://technet.microsoft.com/library/mt346023) or the [Microsoft Deployment Toolkit](https://technet.microsoft.com/windows/dn475741). When you enroll a device in SEMM you must be present to confirm the enrollment on the device. User interaction is not required when you apply a configuration to devices that are already enrolled in SEMM.
+To enroll a Surface device in SEMM or to apply the UEFI configuration from a configuration package, all you need to do is run the .msi file with administrative privileges on the intended Surface device. You can use application deployment or operating system deployment technologies such as [Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt346023) or the [Microsoft Deployment Toolkit](https://technet.microsoft.com/windows/dn475741). When you enroll a device in SEMM you must be present to confirm the enrollment on the device. User interaction is not required when you apply a configuration to devices that are already enrolled in SEMM.
 
 For a step-by-step walkthrough of how to enroll a Surface device in SEMM or apply a Surface UEFI configuration with SEMM, see [Enroll and configure Surface devices with SEMM](https://technet.microsoft.com/itpro/surface/enroll-and-configure-surface-devices-with-semm).
 
@@ -130,11 +134,11 @@ A Surface UEFI reset package is used to perform only one task — to unenroll a
 
 ### Recovery request
 
-In some scenarios, it may be impossible to use a Surface UEFI reset package. (For example, if Windows becomes unusable on the Surface device.) In these scenarios you can unenroll the Surface device from SEMM through the **Enterprise Management** page of Surface UEFI (shown in Figure 7) with a Recovery Request operation.
+In some scenarios, it may be impossible to use a Surface UEFI reset package. (For example, if Windows becomes unusable on the Surface device.) In these scenarios you can unenroll the Surface device from SEMM through the **Enterprise Management** page of Surface UEFI (shown in Figure 5) with a Recovery Request operation.
 
-![Initiate a SEMM recovery request](images\surface-ent-mgmt-fig7-semmrecovery.png "Initiate a SEMM recovery request")
+![Initiate a SEMM recovery request](images/surface-ent-mgmt-fig7-semmrecovery.png "Initiate a SEMM recovery request")
 
-*Figure 7. Initiate a SEMM recovery request on the Enterprise Management page*
+*Figure 5. Initiate a SEMM recovery request on the Enterprise Management page*
 
 When you use the process on the **Enterprise Management** page to reset SEMM on a Surface device, you are provided with a Reset Request. This Reset Request can be saved as a file to a USB drive, copied as text, or read as a QR Code with a mobile device to be easily emailed or messaged. Use the Microsoft Surface UEFI Configurator Reset Request option to load a Reset Request file or enter the Reset Request text or QR Code. Microsoft Surface UEFI Configurator will generate a verification code that can be entered on the Surface device. If you enter the code on the Surface device and click **Restart**, the device will be unenrolled from SEMM. 
 
@@ -154,7 +158,7 @@ Packages created with the Microsoft Surface UEFI Configurator tool are signed wi
 * **Key Length** – 2048
 * **Hash Algorithm** – SHA-256
 * **Type** – SSL Server Authentication
-* **Key Usage** – Key Encipherment
+* **Key Usage** – Digital signature, Key Encipherment
 * **Provider** – Microsoft Enhanced RSA and AES Cryptographic Provider
 * **Expiration Date** – 15 Months from certificate creation
 * **Key Export Policy** – Exportable
@@ -212,9 +216,7 @@ valid.
 machines that have it?**
 
 If you want SEMM reset or recovery to work, the certificate needs to be
-valid and not expired. You can use the current valid ownership
-certificate to sign a package that updates to a new certificate for
-ownership. You do not need to create a reset package. 
+valid and not expired. 
 
 **Can bulk reset packages be created for each surface that we order? Can
 one be built that resets all machines in our environment?**
@@ -226,8 +228,22 @@ create a reset package using PowerShell to reset SEMM.
 
 ## Version History
 
+### Version 2.59.
+* Support to Surface Pro 7, Surface Pro X,  and Surface Laptop 3 13.5" and 15" models with Intel processor. Note:  Surface Laptop 3 15" AMD processor is not supported.
+- Support to Wake on Power feature
+
+### Version 2.54.139.0
+* Support to Surface Hub 2S
+* Bug fixes
+
+### Version 2.43.136.0
+* Support to enable/disable simulatenous multithreating 
+* Separate options for WiFi and Bluetooth for some devices 
+* Battery Limit removed for Surface Studio 
+
 ### Version 2.26.136.0
 * Add support to Surface Studio 2
+* Battery Limit feature
 
 ### Version 2.21.136.0
 * Add support to Surface Pro 6
diff --git a/devices/surface/surface-manage-dfci-guide.md b/devices/surface/surface-manage-dfci-guide.md
new file mode 100644
index 0000000000..efb5fa93b5
--- /dev/null
+++ b/devices/surface/surface-manage-dfci-guide.md
@@ -0,0 +1,188 @@
+---
+title: Intune management of Surface UEFI settings
+description: This article explains how to configure a DFCI environment in Microsoft Intune and manage firmware settings for targeted Surface devices.
+ms.localizationpriority: medium
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.date: 11/13/2019
+ms.reviewer: jesko
+manager: dansimp
+ms.audience: itpro
+---
+# Intune management of Surface UEFI settings
+
+## Introduction
+
+The ability to manage devices from the cloud has dramatically simplified IT deployment and provisioning across the lifecycle. With Device Firmware Configuration Interface (DFCI) profiles built into Microsoft Intune (now available in [public preview](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows)), Surface UEFI management extends the modern management stack down to the UEFI hardware level. DFCI supports zero-touch provisioning, eliminates BIOS passwords, provides control of security settings including boot options and built-in peripherals, and lays the groundwork for advanced security scenarios in the future. For answers to frequently asked questions, see [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333).
+
+### Background
+
+Like any computer running Windows 10, Surface devices rely on code stored in the SoC that enables the CPU to interface with hard drives, display devices, USB ports, and other devices. The programs stored in this read-only memory (ROM) are known as firmware (while programs stored in dynamic media are known as software).
+
+In contrast to other Windows 10 devices available in the market today, Surface provides IT admins with the ability to configure and manage firmware through a rich set of UEFI configuration settings. This provides a layer of hardware control on top of software-based policy management as implemented via mobile device management (MDM) policies, Configuration Manager or Group Policy. For example, organizations deploying devices in highly secure areas with sensitive information can prevent camera use by removing functionality at the hardware level. From a device standpoint, turning the camera off via a firmware setting is equivalent to physically removing the camera. Compare the added security of managing at the firmware level to relying only on operating system software settings. For example, if you disable the Windows audio service via a policy setting in a domain environment, a local admin could still re-enable the service.
+
+### DFCI versus SEMM
+
+Until now, managing firmware required enrolling devices into Surface Enterprise Management Mode (SEMM) with the overhead of ongoing manual IT-intensive tasks. As an example, SEMM requires IT staff to physically access each PC to enter a two-digit pin as part of the certificate management process. Although SEMM remains a good solution for organizations in a strictly on-premises environment, its complexity and IT-intensive requirements make it costly to use.
+
+Now with newly integrated UEFI firmware management capabilities in Microsoft Intune, the ability to lock down hardware is simplified and easier to use with new features for provisioning, security, and streamlined updating all in a single console, now unified as [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager). The following figure shows UEFI settings viewed directly on the device (left) and viewed in the Endpoint Manager console (right).
+
+![UEFI settings shown on device (left) and in the Endpoint Manager console (right) ](images/uefidfci.png)
+
+Crucially, DFCI enables zero touch management, eliminating the need for manual interaction by IT admins. DFCI is deployed via Windows Autopilot using the device profiles capability in Intune. A device profile allows you to add and configure settings which can then be deployed to devices enrolled in management within your organization. Once the device receives the device profile, the features and settings are applied automatically. Examples of common device profiles include Email, Device restrictions, VPN, Wi-Fi, and Administrative templates. DFCI is simply an additional device profile that enables you to manage UEFI configuration settings from the cloud without having to maintain on-premises infrastructure.  
+
+## Supported devices
+
+At this time, DFCI is supported in the following devices:
+
+- Surface Pro 7
+- Surface Pro X
+- Surface Laptop 3
+
+> [!NOTE]
+> Surface Pro X does not support DFCI settings management for built-in camera, audio, and Wi-Fi/Bluetooth.
+
+## Prerequisites
+
+- Devices must be registered with Windows Autopilot by a [Microsoft Cloud Solution Provider (CSP) partner](https://partner.microsoft.com/membership/cloud-solution-provider) or OEM distributor.
+
+- Before configuring DFCI for Surface, you should be familiar with Autopilot configuration requirements in  [Microsoft Intune](https://docs.microsoft.com/intune/) and [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/) (Azure AD).
+
+## Before you begin
+
+Add your target Surface devices to an Azure AD security group. For more information about creating and managing security groups, refer to [Intune documentation](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows#create-your-azure-ad-security-groups).
+
+## Configure DFCI management for Surface devices
+
+A DFCI environment requires setting up a DFCI profile that contains  the settings and an Autopilot profile to apply the settings to registered devices. An enrollment status profile is also recommended to ensure settings are pushed down during OOBE setup when users first start the device. This guide explains how to configure the DFCI environment and manage UEFI configuration settings for targeted Surface devices.
+
+## Create DFCI profile
+
+Before configuring DFCI policy settings, first create a DFCI profile and assign it to the Azure AD security group that contains your target devices.
+
+1. Sign into your tenant at  devicemanagement.microsoft.com.
+2. In the Microsoft Endpoint Manager Admin Center, select **Devices > Configuration profiles > Create profile** and enter a name; for example, **DFCI Configuration Policy.**
+3. Select **Windows 10 and later** for platform type.
+4. In the Profile type drop down list, select **Device Firmware Configuration Interface** to open the DFCI blade containing all available policy settings. For information on DFCI settings, refer to Table 1 on this page or the [Intune documentation](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows). You can configure DFCI settings during the initial setup process or later by editing the DFCI profile.
+
+    ![Create DFCI profile](images/df1.png)
+
+5. Click **OK** and then select **Create**.
+6. Select **Assignments** and under **Select groups to include** select the Azure AD security group that contains your target devices, as shown in the following figure. Click **Save**.
+
+    ![Assign security group](images/df2a.png)
+
+## Create Autopilot profile
+
+1. In Endpoint Manager at  devicemanagement.microsoft.com, select **devices > Windows enrollment** and scroll down to **Deployment profiles**.
+2. Select **Create profile** and enter a name; for example, **My Autopilot profile**, and select **Next**.
+3. Select the following settings:
+
+    - Deployment mode: **User-Driven**.
+    - Join type: Azure **AD joined**.
+
+4. Leave the remaining default settings unchanged and select **Next**, as shown in the following figure.
+
+    ![Create Autopilot profile](images/df3b.png)
+
+5. On the Assignments page, choose **Select groups to include** and click your Azure AD security group. Select **Next**.
+6. Accept the summary and then select **Create**. The Autopilot profile is now created and assigned to the group.
+
+## Configure Enrollment Status Page
+
+To ensure that devices apply the DFCI configuration during OOBE before users sign in, you need to configure enrollment status.
+
+For more information, refer to [Set up an enrollment status page](https://docs.microsoft.com/intune/enrollment/windows-enrollment-status).
+
+
+## Configure DFCI settings on Surface devices
+
+DFCI includes a streamlined set of UEFI configuration policies that provide an extra level of security by locking down devices at the hardware level. DFCI is designed to be used in conjunction with mobile device management settings at the software level. Note that DFCI settings only affect hardware components built into Surface devices and do not extend to attached peripherals such as USB webcams. (However, you can use Device restriction policies in Intune to turn off access to attached peripherals at the software level).
+
+You configure DFCI policy settings by editing the DFCI profile from Endpoint Manager, as shown in the figure below. 
+
+- In Endpoint Manager at  devicemanagement.microsoft.com, select **Devices > Windows > Configuration Profiles > “DFCI profile name” > Properties > Settings**.
+
+    ![Configure DFCI settings](images/dfciconfig.png)
+
+### Block user access to UEFI settings
+
+For many customers, the ability to block users from changing UEFI settings is critically important and a primary reason to use DFCI. As listed in Table 1, this is managed via the setting **Allow local user to change UEFI settings**. If you do not edit or configure this setting, local users will be able to change any UEFI setting not managed by Intune. Therefore, it’s highly recommended to disable **Allow local user to change UEFI settings.**
+The rest of the DFCI settings enable you to turn off functionality that would otherwise be available to users. For example, if you need to protect sensitive information in highly secure areas, you can disable the camera, and if you don’t want users booting from USB drives, you can disable that also.
+
+### Table 1. DFCI scenarios
+
+| Device management goal                        | Configuration steps                                                                           |
+| --------------------------------------------- | --------------------------------------------------------------------------------------------- |
+| Block local users from changing UEFI settings | Under **Security Features > Allow local user to change UEFI settings**, select **None**.              |
+| Disable cameras                               | Under **Built in Hardware > Cameras**, select **Disabled**.                                       |
+| Disable Microphones and speakers              | Under **Built in Hardware > Microphones and speakers**, select **Disabled**.                      |
+| Disable radios (Bluetooth, Wi-Fi)             | Under **Built in Hardware > Radios (Bluetooth, Wi-Fi, etc…)**, select **Disabled**.                   |
+| Disable Boot from external media (USB, SD)    | Under **Built in Hardware > Boot Options > Boot from external media (USB, SD)**, select **Disabled**. |
+
+> [!CAUTION]
+> The **Disable radios (Bluetooth, Wi-Fi)** setting should only be used on devices that have a wired Ethernet connection.
+ 
+> [!NOTE]
+>  DFCI in Intune includes two settings that do not currently apply to Surface devices: (1) CPU and IO virtualization and (2) Disable Boot from network adapters.
+ 
+Intune provides Scope tags to delegate administrative rights and Applicability Rules to manage device types. For more information about policy management support and full details on all DFCI settings, refer to [Microsoft Intune documentation](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows).
+
+## Register devices in Autopilot
+
+As stated above, DFCI can only be applied on devices registered in Windows Autopilot by your reseller or distributor and is only supported, at this time, on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For security reasons, it’s not possible to “self-provision” your devices into Autopilot.
+
+## Manually Sync Autopilot devices
+
+Although Intune policy settings typically get applied almost immediately, there may be a delay of 10 minutes before the settings take effect on targeted devices. In rare circumstances, delays of up to 8 hours are possible. To ensure settings apply as soon as possible, (such as in test scenarios), you can manually sync the target devices.
+
+- In Endpoint Manager at  devicemanagement.microsoft.com, go to **Devices > Device enrollment > Windows enrollment > Windows Autopilot Devices** and select **Sync**.
+
+ For more information, refer to [Sync your Windows device manually](https://docs.microsoft.com/intune-user-help/sync-your-device-manually-windows).
+
+> [!NOTE]
+> When adjusting settings directly in UEFI, you need to ensure the device fully restarts to the standard Windows login.
+
+## Verifying UEFI settings on DFCI-managed devices
+
+In a test environment, you can verify settings in the Surface UEFI interface.
+
+1. Open Surface UEFI, which involves pressing the **Volume +** and **Power** buttons at the same time.
+2. Select **Devices**. The UEFI menu will reflect configured settings, as shown in the following figure.
+
+    ![Surface UEFI](images/df3.png)
+
+    Note how:
+
+      - The settings are greyed out because **Allow local user to change UEFI setting** is set to None.
+      - Audio is set to off because **Microphones and speakers** are set to **Disabled**.
+
+## Removing DFCI policy settings
+
+When you create a DFCI profile, all configured settings will remain in effect across all devices within the profile’s scope of management. You can only remove DFCI policy settings by editing the DFCI profile directly.
+
+If the original DFCI profile has been deleted, you can remove policy settings by creating a new profile and then editing the settings, as appropriate.
+
+## Removing DFCI management
+
+**To remove DFCI management and return device to factory new state:**
+
+1. Retire the device from Intune:
+    1. In Endpoint Manager at  devicemanagement.microsoft.com, choose **Groups > All Devices**. Select the devices you want to retire, and then choose **Retire/Wipe.** To learn more refer to [Remove devices by using wipe, retire, or manually unenrolling the device](https://docs.microsoft.com/intune/remote-actions/devices-wipe). 
+2. Delete the Autopilot registration from Intune:
+    1.  Choose **Device enrollment > Windows enrollment > Devices**.
+    2. Under Windows Autopilot devices, choose the devices you want to delete, and then choose **Delete**.
+3. Connect device to wired internet with Surface-branded ethernet adapter. Restart device and open the UEFI menu (press and hold the volume-up button while also pressing and releasing the power button).
+4. Select **Management > Configure > Refresh from Network** and then choose **Opt-out.**
+
+To keep managing the device with Intune, but without DFCI management, self-register the device to Autopilot and enroll it to Intune. DFCI will not be applied to self-registered devices.
+
+## Learn more
+- [Ignite 2019: Announcing remote management of Surface UEFI settings from Intune](https://techcommunity.microsoft.com/t5/Surface-IT-Pro-Blog/Ignite-2019-Announcing-remote-management-of-Surface-UEFI/ba-p/978333)
+[Windows Autopilot](https://www.microsoft.com/microsoft-365/windows/windows-autopilot)
+- [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md) 
+- [Use DFCI profiles on Windows devices in Microsoft Intune](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows)
diff --git a/devices/surface/surface-pro-arm-app-management.md b/devices/surface/surface-pro-arm-app-management.md
new file mode 100644
index 0000000000..fd98f72368
--- /dev/null
+++ b/devices/surface/surface-pro-arm-app-management.md
@@ -0,0 +1,174 @@
+---
+title: Deploying, managing, and servicing Surface Pro X
+description: This article provides an overview of key considerations for deploying, managing, and servicing Surface Pro X.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.localizationpriority: high
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.date: 1/22/2020
+ms.reviewer: jessko
+manager: dansimp
+ms.audience: itpro
+---
+# Deploying, managing, and servicing Surface Pro X
+
+## Introduction
+
+Built to handle high performance commercial requirements, Surface Pro X breaks new ground by incorporating the most powerful processor ever released on an ARM device, the Microsoft SQ1 ARM chipset.
+
+Powered by a 3GHz CPU and a 2.1 teraflop GPU, Surface Pro X provides a full Windows experience. Its 13-hour battery life and built-in 4G LTE make it ideally suited for mobile first-line workers and professionals across the financial, legal, and medical fields or any role demanding extended battery life and continuous connectivity capabilities.
+
+Surface Pro X is designed almost exclusively for a modern, cloud-based environment centered around Microsoft 365, Intune and Windows Autopilot. This article highlights what that looks like and outlines key considerations for deploying, managing, and servicing Surface Pro X.
+
+## Deploying Surface Pro X
+
+For the best experience, deploy Surface Pro X using Windows Autopilot either with the assistance of a Microsoft Cloud Solution Provider or self-provisioned using Autopilot deployment profiles and related features. For more information, refer to:
+
+- [Windows Autopilot and Surface devices](windows-autopilot-and-surface-devices.md)
+- [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot)
+
+Autopilot deployment has several advantages: It allows you to use the factory provisioned operating system, streamlined for zero-touch deployment, to include pre-installation of Office Pro Plus.
+
+Organizations already using modern management, security, and productivity solutions are well positioned to take advantage of the unique performance features in Surface Pro X. Customers using modernized line of business apps, Microsoft store (UWP) apps, or remote desktop solutions also stand to benefit.
+
+## Image-based deployment considerations
+
+Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager (formerly System Center Configuration Manager) currently do not support Surface Pro X for operating system deployment. Customers relying on image-based deployment should consider Surface Pro 7 while they continue to evaluate the right time to transition to the cloud.
+
+## Managing Surface Pro X devices
+
+### Intune
+
+A component of Microsoft Enterprise Mobility + Security, Intune integrates with Azure Active Directory for identity and access control and provides granular management of enrolled Surface Pro X devices. Intune mobile device management (MDM) policies have a number of advantages over older on-premises tools such as Windows Group Policy. This includes faster device login times and a more streamlined catalog of policies enabling full device management from the cloud. For example, you can manage LTE using eSIM profiles to configure data plans and deploy activation codes to multiple devices.
             
+
+For more information about setting up Intune, refer to the [Intune documentation](https://docs.microsoft.com/intune/).
+
+### Co-management
+
+Once deployed in Autopilot, you can join Surface Pro X devices to Azure AD or Active Directory (Hybrid Azure AD Join) where you will be able to manage the devices with Intune or co-manage them with Endpoint Configuration Manager, which will install the 32-bit x86 ConfigMgr client.
+
+### Third party MDM solutions
+
+You may be able to use third-party MDM tools to manage Surface Pro X devices. For details, contact your MDM provider.
+
+### Antivirus software
+
+Windows Defender will help protect Windows 10 on ARM-based PCs for the supported lifetime of the Windows 10 device. 
+
+Some third-party antivirus software cannot be installed on a Windows 10 PC running on an ARM-based processor. Collaboration with third-party antivirus software providers is continuing for AV app readiness on ARM-based PCs. Contact your antivirus software provider to understand when their apps will be available.
+
+## Servicing Surface Pro X
+
+Surface Pro X supports Windows 10, version 1903 and later. As an ARM-based device, it has specific requirements for maintaining the latest drivers and firmware. 
+
+Surface Pro X was designed to use Windows Update to simplify the process of keeping drivers and firmware up to date for both home users and small business users. Use the default settings to receive Automatic updates.  To verify:
+
+1. Go to **Start** > **Settings > Update & Security > Windows Update** > **Advanced Options.**
+2. Under **Choose how updates are installed,** select **Automatic (recommended)**.
+
+### Recommendations for commercial customers
+
+- Use Windows Update or Windows Update for Business for maintaining the latest drivers and firmware. For more information, see [Deploy Updates using Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb).
+- If your procedures require using a Windows Installer .msi file, contact [Surface for Business support](https://support.microsoft.com/help/4037645). 
+- For more information about deploying and managing updates on Surface devices, see [Manage and deploy Surface driver and firmware updates](manage-surface-driver-and-firmware-updates.md).
+- Note that Windows Server Update Services (WSUS) does not support the ability to deliver drivers and firmware to Surface Pro X.
+
+## Running apps on Surface Pro X
+
+Most apps run on ARM-based Windows 10 PCs with limited exclusions.
+
+### Supported apps
+
+- Most x86 Win32 apps run on Surface Pro X.
+- Native ARM64 and Microsoft Store UWP apps provide an excellent user experience utilizing the full native speed of the ARM-based processor while optimizing battery life.
+- Apps that use drivers designed for a Windows 10 PC running on an ARM-based processor.
+
+### Not supported
+
+- x64 apps won't run on a Windows 10 PC on an ARM-based processor.
+
+For more information about running apps on Surface Pro X, refer to:
+
+- [Windows 10 ARM-based PCs Support FAQ](https://support.microsoft.com/help/4521606)
+- [Windows 10 on ARM documentation](https://docs.microsoft.com/windows/arm)
+
+## Virtual Desktops (VDI)
+
+Windows Virtual Desktop enables access to Windows desktops,applications, and data on any computing device or platform, from any location. To learn more, refer to the [Windows Virtual Desktop site](https://aka.ms/wvd). 
+
+## Browsing with Surface Pro X
+
+Popular browsers run on Surface Pro X:
+
+- In-box Edge, Firefox, Chrome, and Internet Explorer all run on Surface Pro X.
+- In-box Edge and Firefox run natively and therefore have enhanced performance on a Windows 10 PC on an ARM-based processor.
+
+## Installing and using Microsoft Office
+
+- Use Office 365 for the best experience on a Windows 10 PC on an ARM-based processor.
+- Office 365 “click-to-run” installs Outlook, Word, Excel, and PowerPoint, optimized to run on a Windows 10 PC on an ARM-based processor.
+- Microsoft Teams runs great on Surface Pro X.
+- For “perpetual versions” of Office such as Office 2019, install the 32-bit version.
+
+## VPN
+
+To confirm if a specific third-party VPN supports a Windows 10 PC on an ARM-based processor, contact the VPN provider.
+
+## Comparing key features
+
+The following tables show the availability of selected key features on Surface Pro X with Windows 10 on ARM compared to Intel-based Surface Pro 7.
+
+| Deployment                              | Surface Pro 7 | Surface Pro X | Notes                                                                                                                           |
+| --------------------------------------- | ------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| Windows Autopilot                       | Yes           | Yes           |                                                                                                                                 |
+| Support for Network Boot (PXE)          | Yes           | No           |                                                                                                                                 |
+| Windows Configuration Designer          | Yes           | No            | Not recommended for Surface Pro X.                                                                                              |
+| WinPE                                   | Yes           | Yes           | Not recommended for Surface Pro X. Microsoft does not provide the necessary .ISO and drivers to support WinPE with Surface Pro X. |
+| Endpoint Configuration Manager: Operating System Deployment (OSD) | Yes           | No            | Not supported on Surface Pro X.                                                                                              |
+| MDT                                     | Yes           | No            | Not supported on Surface Pro X.                                                                                              |
+
+
+| Management                                    | Surface Pro 7       | Surface Pro X | Notes                                                                                 |
+| --------------------------------------------- | ------------------- | ------------- | ------------------------------------------------------------------------------------- |
+| Intune                                        | Yes                 | Yes           | Manage LTE with eSIM profiles.                                                        |
+| Windows Autopilot                             | Yes                 | Yes           |                                                                                       |
+| Azure AD (co-management)                      | Yes                 | Yes           | Ability to join Surface Pro X to Azure AD or Active Directory (Hybrid Azure AD Join). |
+| Endpoint Configuration Manager                                          | Yes               | Yes           |                                                                                       |
+| Power on When AC Restore                      | Yes                 | Yes           |                                                                                   |
+| Surface Diagnostic Toolkit (SDT) for Business | Yes                 | Yes           |                                                                                   |
+| Surface Dock Firmware Update                  | Yes                 | Yes           |                                                                                   |
+| Asset Tag Utility                             | Yes                 | Yes           |                                                                                   |
+| Surface Enterprise management Mode (SEMM)     | Yes | Partial       | No option to disable hardware on Surface Pro X at the firmware level.                 |
+| Surface UEFI Configurator                     | Yes |               | No option to disable hardware. on Surface Pro X at the firmware level.                |
+| Surface UEFI Manager                          | Yes | Partial       | No option to disable hardware on Surface Pro X at the firmware level.                 |
+
+
+| Security                          | Surface Pro 7 | Surface Pro X | Notes                                                                                                                                                                                                                                                                                                                                                |
+| --------------------------------- | ------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| BitLocker                         | Yes           | Yes           |                                                                                                                                                                                                                                                                                                                                                      |
+| Windows Defender                  | Yes           | Yes           |                                                                                                                                                                                                                                                                                                                                                      |
+| Support for third-party antivirus | Yes           | See note      |Some third-party antivirus software cannot be installed on a Windows 10 PC running on an ARM-based processor. Collaboration with third-party antivirus software providers is continuing for AV app readiness on ARM-based PCs. Contact your antivirus software provider to understand when their apps will be available. |
+| Conditional Access                | Yes           | Yes           |                                                                                                                                                                                                                                                                                                                                                      |
+| Secure Boot                       | Yes           | Yes           |                                                                                                                                                                                                                                                                                                                                                      |
+| Windows Information Protection    | Yes           | Yes           |                                                                                                                                                                                                                                                                                                                                                      |
+| Surface Data Eraser (SDE)         | Yes           | Yes           |                                                                                                                                                                                                                                                                                                                                                     
+## FAQ
+
+### Can I deploy Surface Pro X with MDT or Endpoint Configuration Manager?
+
+The Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager  currently do not support Surface Pro X for operating system deployment.Customers relying on image-based deployment should consider Surface Pro 7 while they continue to evaluate the right time to transition to the cloud.
+
+### How can I deploy Surface Pro X?
+
+Deploy Surface Pro X using Windows Autopilot.
+
+### Will a BMR be available?
+
+Yes.
+
+### Is Intune required to manage Surface Pro X?
+
+Intune is recommended but not required. Once deployed in Autopilot, you can join Surface Pro X devices to Azure AD or Active Directory (Hybrid Azure AD Join) where you will be able to manage the devices with Intune or co-manage them with Endpoint Configuration Manager, which will install the 32-bit x86 ConfigMgr client.
diff --git a/devices/surface/surface-pro-arm-app-performance.md b/devices/surface/surface-pro-arm-app-performance.md
new file mode 100644
index 0000000000..baa547d04b
--- /dev/null
+++ b/devices/surface/surface-pro-arm-app-performance.md
@@ -0,0 +1,27 @@
+---
+title: Surface Pro X app compatibility
+description: This article provides introductory app compatibility information for Surface Pro X ARM-based PCs.
+ms.prod: w10
+ms.localizationpriority: medium
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: dansimp
+ms.author: dansimp
+ms.topic: article
+ms.date: 10/03/2019
+ms.reviewer: jessko
+manager: dansimp
+ms.audience: itpro
+---
+# Surface Pro X app compatibility
+
+Applications run differently on ARM-based Windows 10 PCs such as Surface Pro X. Limitations include the following:
+
+- **Drivers for hardware, games and apps will only work if they're designed for a Windows 10 ARM-based PC**. For more info, check with the hardware manufacturer or the organization that developed the driver. Drivers are software programs that communicate with hardware devices—they're commonly used for antivirus and antimalware software, printing or PDF software, assistive technologies, CD and DVD utilities, and virtualization software. If a driver doesn’t work, the app or hardware that relies on it won’t work either (at least not fully). Peripherals and devices only work if the drivers they depend on are built into Windows 10, or if the hardware developer has released ARM64 drivers for the device.
+- **64-bit (x64) apps won’t work**. You'll need 64-bit (ARM64) apps, 32-bit (ARM32) apps, or 32-bit (x86) apps. You can usually find 32-bit (x86) versions of apps, but some app developers only offer 64-bit (x64) apps.
+- **Certain games won’t work**. Games and apps won't work if they use a version of OpenGL greater than 1.1, or if they rely on "anti-cheat" drivers that haven't been made for Windows 10 ARM-based PCs. Check with your game publisher to see if a game will work.
+- **Apps that customize the Windows experience might have problems**. This includes some input method editors (IMEs), assistive technologies, and cloud storage apps. The organization that develops the app determines whether their app will work on a Windows 10 ARM-based PC.
+- **Some third-party antivirus software can’t be installed**. You won't be able to install some third-party antivirus software on a Windows 10 ARM-based PC. However, Windows Security will help keep you safe for the supported lifetime of your Windows 10 device.
+- **Windows Fax and Scan isn’t available**. This feature isn’t available on a Windows 10 ARM-based PC.
+
+For more information about app compatibility, refer to [Windows 10 ARM-based PCs FAQ](https://support.microsoft.com/en-us/help/4521606)
diff --git a/devices/surface/surface-system-sku-reference.md b/devices/surface/surface-system-sku-reference.md
index cf5960ded6..dbcb9648b0 100644
--- a/devices/surface/surface-system-sku-reference.md
+++ b/devices/surface/surface-system-sku-reference.md
@@ -6,54 +6,69 @@ ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices, security
 ms.sitesec: library
-author: coveminer
-ms.author: v-jokai
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 03/20/2019
+ms.date: 10/31/2019
+ms.reviewer: 
+manager: dansimp
+ms.localizationpriority: medium
+ms.audience: itpro
 ---
 
 # System SKU reference
 
-This document provides a reference of System Model and System SKU names that you can use to quickly determine the machine state of a specific device using PowerShell or WMI.
+This document provides a reference of System Model and System SKU names that you can use to quickly determine the machine state of a specific device by using PowerShell or WMI.
 
-System Model and System SKU are variables stored in System Management BIOS (SMBIOS) tables in the UEFI layer of Surface devices.  The System SKU name is required to differentiate between devices with the same System Model name, such as Surface Pro and Surface Pro with LTE Advanced. 
+System Model and System SKU are variables that are stored in the System Management BIOS (SMBIOS) tables in the UEFI layer of Surface devices. The System SKU name is required to differentiate between devices that have the same System Model name, such as Surface Pro and Surface Pro with LTE Advanced. 
 
 | Device   | System Model | System SKU       |
 | ---------- | ----------- | -------------- |
+| AMD Surface Laptop 3                                         | Surface 3        | Surface_Laptop_3_1873       |
+| Surface Laptop 3                                             | Surface 3        | Surface_Laptop_3_1867:1868       |
+| Surface Laptop 3                                             | Surface 3        | Surface_3                   
 | Surface 3 WiFI                                               | Surface 3        | Surface_3                        |
 | Surface 3 LTE AT&T                                           | Surface 3        | Surface_3_US1                    |
 | Surface 3 LTE Verizon                                        | Surface 3        | Surface_3_US2                    |
 | Surface 3 LTE North America                                  | Surface 3        | Surface_3_NAG                    |
-| Surface 3 LTE Outside of North America and T-Mobile In Japan | Surface 3        | Surface_3_ROW                    |
+| Surface 3 LTE Outside of North America and Y!mobile In Japan | Surface 3        | Surface_3_ROW                    |
 | Surface Pro                                                  | Surface Pro      | Surface_Pro_1796                 |
 | Surface Pro with LTE Advanced                                | Surface Pro      | Surface_Pro_1807                 |
 | Surface Book 2 13inch                                        | Surface Book 2   | Surface_Book_1832                |
 | Surface Book 2 15inch                                        | Surface Book 2   | Surface_Book_1793                |
+| Surface Go LTE Consumer  | Surface Go | Surface_Go_1825_Consumer |
+| Surface Go LTE Commercial | System Go | Surface_Go_1825_Commercial |
 | Surface Go Consumer                                          | Surface Go       | Surface_Go_1824_Consumer         |
 | Surface Go Commercial                                        | Surface Go       | Surface_Go_1824_Commercial       |
 | Surface Pro 6 Consumer                                       | Surface Pro 6    | Surface_Pro_6_1796_Consumer      |
 | Surface Pro 6 Commercial                                     | Surface Pro 6    | Surface_Pro_6_1796_Commercial    |
 | Surface Laptop 2 Consumer                                    | Surface Laptop 2 | Surface_Laptop_2_1769_Consumer   |
 | Surface Laptop 2 Commercial                                  | Surface Laptop 2 | Surface_Laptop_2_1769_Commercial |
+| Surface Pro 7                 | Surface Pro 7    | Surface_Pro_7_1866         |
+| Surface Pro X                 | Surface Pro X    | Surface_Pro_X_1876         |
+| Surface Laptop 3 13" Intel | Surface Laptop 3 | Surface_Laptop_3_1867:1868 |
+| Surface Laptop 3 15" Intel | Surface Laptop 3 | Surface_Laptop_3_1872      |
+| Surface Laptop 3 15" AMD   | Surface Laptop 3 | Surface_Laptop_3_1873      | 
 
 ## Examples 
 
-**PowerShell**
- Use the following PowerShell command to pull System SKU:
+**Retrieving the SKU by using PowerShell**  
+Use the following PowerShell command to pull the System SKU information:
 
- ``` 
+ ``` powershell  
 gwmi -namespace root\wmi -class MS_SystemInformation | select SystemSKU 
 ```
 
-**System Information**
-You can also find the System SKU and System Model for a device in System Information. 
+**Retrieving the SKU by using System Information**  
+You can also find the System SKU and System Model for a device in **System Information**. To do this, follow these steps:
 
-- Go to **Start** >  **MSInfo32**.  
-
-One example of how you could use this in Microsoft Deployment Toolkit (MDT) or System Center Configuration Manager is as part of a Task Sequence WMI Condition. For example: 
-
-**Task Sequence WMI Condition**
+1. Select **Start**, and then type **MSInfo32** in the search box.  
+1. Select **System Information**.
 
+**Using the SKU in a task sequence WMI condition**  
+You can use the System SKU information in the Microsoft Deployment Toolkit (MDT) or Microsoft Endpoint Configuration Manager as part of a task sequence WMI condition.
 
+ ``` powershell  
     - WMI Namespace – Root\WMI
     - WQL Query – SELECT * FROM MS_SystemInformation WHERE SystemSKU = "Surface_Pro_1796"
+ ``` 
diff --git a/devices/surface/surface-wireless-connect.md b/devices/surface/surface-wireless-connect.md
new file mode 100644
index 0000000000..6e225137c2
--- /dev/null
+++ b/devices/surface/surface-wireless-connect.md
@@ -0,0 +1,84 @@
+---
+title: Optimize Wi-Fi connectivity for Surface devices
+description: This topic describes recommended Wi-Fi settings to ensure Surface devices stay connected in congested network environments and mobile scenarios.
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+author: dansimp
+ms.audience: itpro
+ms.localizationpriority: medium
+ms.author: dansimp
+ms.topic: article
+ms.date: 10/31/2019
+ms.reviewer: tokatz
+manager: dansimp
+---
+# Optimize Wi-Fi connectivity for Surface devices
+
+
+To stay connected with all-day battery life, Surface devices implement wireless connectivity settings that balance performance and power conservation. Outside of the most demanding mobility scenarios, users can maintain sufficient wireless connectivity without modifying default network adapter or related settings. 
+
+In congested network environments, organizations can implement purpose-built wireless protocols across multiple network access points to facilitate roaming. This page highlights key wireless connectivity considerations in mobile scenarios utilizing Surface Pro 3 and later, Surface Book, Surface Laptop, and Surface Go.
+
+## Prerequisites
+
+This document assumes you have successfully deployed a wireless network that supports 802.11n (Wi-Fi 4) or later in accordance with best practice recommendations from leading equipment vendors.
+
+## Configuring access points for optimal roaming capabilities
+
+If you’re managing a wireless network that’s typically accessed by many different types of client devices, it’s recommended to enable specific protocols on access points (APs) in your WLAN, as described in [Fast Roaming with 802.11k, 802.11v, and 802.11r](https://docs.microsoft.com/windows-hardware/drivers/network/fast-roaming-with-802-11k--802-11v--and-802-11r). Surface devices can take advantage of the following wireless protocols:
+
+- **802.11r.** “**Fast BSS Transition”** accelerates connecting to new wireless access points by reducing the number of frames required before your device can access another AP as you move around with your device.
+- **802.11k.** **“Neighbor Reports”** provides devices with information on current conditions at neighboring access points. It can help your Surface device choose the best AP using criteria other than signal strength such as AP utilization.
+
+Specific Surface devices can also use 802.11v “BSS Transition Management Frames,” which functions much like 802.11k in providing information on nearby candidate APs. These include Surface Go, Surface Pro 7, Surface Pro X, and Surface Laptop 3. 
+
+## Managing user settings
+
+You can achieve optimal roaming capabilities through a well-designed network that supports  802.11r and 802.11k across all access points. Ensuring that your network is properly configured to provide users with the best wireless experience is the recommended approach versus attempting to manage user settings on individual devices. Moreover, in many corporate environments Surface device users won’t be able to access advanced network adapter settings without explicit permissions or local admin rights. In other lightly managed networks, users can benefit by knowing how specific settings can impact their ability to remain connected.
+
+### Recommended user settings and best practices
+
+In certain situations, modifying advanced network adapter settings built into Surface devices may facilitate a more reliable connection. Keep in mind however that an inability to connect to wireless resources is more often due to an access point issue, networking design flaw, or environmental site issue.
+
+> [!NOTE]
+> How you hold your Surface Pro or Surface Go can also affect signal strength. If you’re experiencing a loss of bandwidth, check that you’re not holding the top of the display, where the Wi-Fi radio receiver is located. Although holding the top of the display does not block wireless signals, it can trigger the device driver to initiate changes that reduce connectivity.
+
+### Keep default Auto setting for dual bandwidth capability
+On most Surface devices, you can configure client network adapter settings to only connect to wireless APs over 5 gigahertz (GHz), only connect over 2.4 GHz, or let the operating system choose the best option (default Auto setting).
+
+**To access network adapter settings go to:**
+
+- **Start** > **Control panel** > **Network and Sharing Center** > **your Wi-Fi adapter** > **Properties** > **Configure** > **Advanced**.
+
+![* wifi-band settings*](images/wifi-band.png) 
            
+
+Keep in mind that 2.4 GHz has some advantages over 5 GHz: It extends further and more easily penetrates through walls or other solid objects. Unless you have a clear use case that warrants connecting to 5 GHz, it’s recommended to leave the Band setting in the default state to avoid possible adverse consequences. For example:
+
+
+- Many hotspots found in hotels, coffee shops, and airports still only use 2.4 GHz, effectively blocking access to devices if Band is set to 5 GHz Only.
+- Since Miracast wireless display connections require the initial handshake to be completed over 2.4 GHz channels, devices won’t be able to connect at 5 GHz Only.
+
+> [!NOTE]
+> By default Surface devices will prefer connecting to 5 GHz if available. However, to preserve power  in a low battery state, Surface will first look for a 2.4 GHz connection.
+
+You can also toggle the band setting as needed to suit your environment. For example, users living in high density apartment buildings with multiple Wi-Fi hotspots  —  amid the presence of consumer devices all broadcasting via 2.4 GHz  —  will likely benefit by setting their Surface device to connect on 5 GHz only and then revert to Auto when needed.
+
+### Roaming aggressiveness settings on Surface Go
+
+Front-line workers using Surface Go may wish to select a signal strength threshold that prompts the device to search for a new access point when signal strength drops (roaming aggressiveness). By default, Surface devices attempt to roam to a new access point if the signal strength drops below **Medium** (50 percent signal strength). Note that whenever you increase roaming aggressiveness, you accelerate battery power consumption.
+
+Leave the roaming aggressiveness setting in the default state unless you’re encountering connectivity issues in specific mobile scenarios such as conducting environmental site inspections while also maintaining voice and video connectivity during a conference meeting. If you don’t notice any improvement revert to the default **Medium** state.
+
+**To enable roaming aggressiveness on Surface Go:**
+
+1. Go to **Start > Control Panel** > **Network and Internet** > **Network and Sharing Center.**
+2. Under **Connections** select **Wi-Fi** and then select **Properties.**
+3. Select **Client for Microsoft Networks** and then select **Configure**
+4. Select **Advanced** > **Roaming Aggressiveness** and choose your preferred value from the drop-down menu.
+
+![* Roaming aggressiveness settings *](images/wifi-roaming.png) 
            
+
+## Conclusion
+
+Surface devices are designed with default settings for optimal wireless connectivity balanced alongside the need to preserve battery life. The most effective way of enabling reliable connectivity for Surface devices is through a well-designed network that supports 802.11r and 802.11k. Users can adjust network adapter settings or roaming aggressiveness but should only do so in response to specific environmental factors and revert to default state if there’s no noticeable improvement.
diff --git a/devices/surface/surface.yml b/devices/surface/surface.yml
deleted file mode 100644
index 8287763c1e..0000000000
--- a/devices/surface/surface.yml
+++ /dev/null
@@ -1,61 +0,0 @@
-### YamlMime:YamlDocument
-
-documentType: LandingData
-title: Surface devices
-metadata:
-  document_id: 
-  title: Surface devices
-  description: Find tools, step-by-step guides, and other resources to help you plan, deploy, and manage Surface devices in your organization. 
-  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
-  ms.localizationpriority: medium
-  author: lizap
-  ms.author: elizapo
-  manager: dougkim
-  ms.topic: article
-  ms.devlang: na
-
-sections:
-- items:
-  - type: markdown
-    text: "
-      Find tools, step-by-step guides, and other resources to help you plan, deploy, and manage Surface devices in your organization. 
-      "  
-- title: Explore
-- items:
-  - type: markdown
-    text: "
-      Evaluate the Surface device portfolio, review the tools and technologies for management of your Surface devices, and learn about Surface technologies and devices with engineering walkthroughs.
             
-      
-      

            **Surface Pro**
            Light enough to take anywhere. Powerful enough to use as a full desktop workstation.
            See spec
            **Surface Book**
            Built for extreme performance. Lightning fast access to apps. Up to 16 hours of battery life.
            See spec
            **Surface Studio**
            Professional-grade power and performance. Use it upright or draw on it like a drafting table.
            See spec
            
-      "
-- title: Plan
-- items:
-  - type: markdown
-    text: "
-      Explore essential concepts for the deployment of Windows 10 to Surface devices.
             
-      
-      

            **Try Windows 10 Enterprise free for 90 days**
            Try the latest features. Test your apps, hardware, and deployment strategies.
            Get started
            **Windows 10 upgrade paths**
            Upgrade to Windows 10 from a previous version, or from one edition to another.
            Explore paths
            **Prepare for Windows 10 deployment**
            Get familiar with current deployment options and best practices.
            Review options
            
-      "
-- title: Deploy
-- items:
-  - type: markdown
-    text: "
-      Download deployment tools and get step-by-step guidance on how to upgrade a Surface device or deploy a new image.
             
-      
-      

            **Microsoft Deployment Toolkit (MDT)**
            Automate Windows 10 deployment, and more easily manage security and configurations.
            Download the toolkit
            **System Center Configuration Manager**
            Use in tandem with MDT to deploy Windows 10 and manage PCs and devices moving forward.
            Download an eval
            **Surface Deployment Accelerator**
            Automate the creation and configuration of Windows images for Surface devices.
            Download the accelerator
            
-      "
-- title: Manage
-- items:
-  - type: markdown
-    text: "
-      Learn how to more easily manage and secure Surface devices in your organization.
             
-      
-      

            **Manage Surface firmware and driver updates**
            Download the latest firmware and drivers for Surface devices.
            Manage Surface Dock Updater.
            Surface update history
            **Discover Surface tools for IT**
            Surface Diagnostic Toolkit
            Surface Data Eraser
            Surface Enterprise Management Mode
            Surface Pro 3 Asset Tag CLI Utility
            **Manage settings and devices**
            Manage Windows corporate devices
            Manage Surface UEFI Settings
            Bitlocker PIN on Surface Pro 3 and other tablets
            Enroll and configure Surface devices with SEMM
            
-      "
-- title: Stay informed
-- items:
-  - type: markdown
-    text: "
-      
-      

            **Surface IT Pro Blog**
            Get insight into new Surface products plus tips and tricks for IT professionals.
            Learn more
            **Surface on Microsoft Mechanics**
            View technical demos and walkthroughs of Surface devices, features, and functionality.
            Get started
            **Follow us on Twitter**
            Keep up with the latest news and see the latest product demonstrations.
            Visit Twitter
            
-      "
diff --git a/devices/surface/unenroll-surface-devices-from-semm.md b/devices/surface/unenroll-surface-devices-from-semm.md
index 323624a34f..39b70f6006 100644
--- a/devices/surface/unenroll-surface-devices-from-semm.md
+++ b/devices/surface/unenroll-surface-devices-from-semm.md
@@ -6,10 +6,14 @@ ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices, security
 ms.sitesec: library
-author: jobotto
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
 ms.date: 01/06/2017
+ms.reviewer: 
+manager: dansimp
+ms.localizationpriority: medium
+ms.audience: itpro
 ---
 
 # Unenroll Surface devices from SEMM
@@ -27,7 +31,7 @@ The Surface UEFI reset package is the primary method you use to unenroll a Surfa
 
 Reset packages are created specifically for an individual Surface device. To begin the process of creating a reset package, you will need the serial number of the device you want to unenroll, as well as the SEMM certificate used to enroll the device. You can find the serial number of your Surface device on the **PC information** page of Surface UEFI, as shown in Figure 1. This page is displayed even if Surface UEFI is password protected and the incorrect password is entered.
 
-![Serial number of Surface device is displayed](images\surface-semm-unenroll-fig1.png "Serial number of Surface device is displayed")
+![Serial number of Surface device is displayed](images/surface-semm-unenroll-fig1.png "Serial number of Surface device is displayed")
 
 *Figure 1. The serial number of the Surface device is displayed on the Surface UEFI PC information page*
 
@@ -40,20 +44,20 @@ To create a Surface UEFI reset package, follow these steps:
 2. Click **Start**.
 3. Click **Reset Package**, as shown in Figure 2.
 
-   ![Select Reset Package to create a package to unenroll Surface device from SEMM](images\surface-semm-unenroll-fig2.png "Select Reset Package to create a package to unenroll Surface device from SEMM")
+   ![Select Reset Package to create a package to unenroll Surface device from SEMM](images/surface-semm-unenroll-fig2.png "Select Reset Package to create a package to unenroll Surface device from SEMM")
 
    *Figure 2. Click Reset Package to create a package to unenroll a Surface device from SEMM*
 
 4. Click **Certificate Protection** to add your SEMM certificate file with private key (.pfx), as shown in Figure 3. Browse to the location of your certificate file, select the file, and then click **OK**.
 
-   ![Add the SEMM certificate to Surface UEFI reset package](images\surface-semm-unenroll-fig3.png "Add the SEMM certificate to Surface UEFI reset package")
+   ![Add the SEMM certificate to Surface UEFI reset package](images/surface-semm-unenroll-fig3.png "Add the SEMM certificate to Surface UEFI reset package")
 
    *Figure 3. Add the SEMM certificate to a Surface UEFI reset package*
 
 5. Click **Next**.
 6. Type the serial number of the device you want to unenroll from SEMM (as shown in Figure 4), and then click **Build** to generate the Surface UEFI reset package.
 
-   ![Create a Surface UEFI reset package with serial number of Surface device](images\surface-semm-unenroll-fig4.png "Create a Surface UEFI reset package with serial number of Surface device")
+   ![Create a Surface UEFI reset package with serial number of Surface device](images/surface-semm-unenroll-fig4.png "Create a Surface UEFI reset package with serial number of Surface device")
 
    *Figure 4. Use the serial number of your Surface device to create a Surface UEFI reset package*
 
@@ -62,7 +66,7 @@ To create a Surface UEFI reset package, follow these steps:
 
 Run the Surface UEFI reset package Windows Installer (.msi) file on the Surface device to unenroll the device from SEMM. The reset package will require a reboot to perform the unenroll operation. After the device has been unenrolled, you can verify the successful removal by ensuring that the **Microsoft Surface Configuration Package** item in **Programs and Features** (shown in Figure 5) is no longer present.
 
-![Screen that shows device is enrolled in SEMM](images\surface-semm-unenroll-fig5.png "Screen that shows device is enrolled in SEMM")
+![Screen that shows device is enrolled in SEMM](images/surface-semm-unenroll-fig5.png "Screen that shows device is enrolled in SEMM")
 
 *Figure 5. The presence of the Microsoft Surface Configuration Package item in Programs and Features indicates that the device is enrolled in SEMM*
 
@@ -78,7 +82,7 @@ To initiate a Recovery Request, follow these steps:
 2. Type the Surface UEFI password if you are prompted to do so.
 3. Click the **Enterprise management** page, as shown in Figure 6.
 
-   ![Enterprise Management page](images\surface-semm-unenroll-fig6.png "Enterprise Management page")
+   ![Enterprise Management page](images/surface-semm-unenroll-fig6.png "Enterprise Management page")
 
    *Figure 6. The Enterprise management page is displayed in Surface UEFI on devices enrolled in SEMM*
 
@@ -88,17 +92,17 @@ To initiate a Recovery Request, follow these steps:
    >A Recovery Request expires two hours after it is created. If a Recovery Request is not completed in this time, you will have to restart the Recovery Request process.
 6. Select **SEMM Certificate** from the list of certificates displayed on the **Choose a SEMM reset key** page (shown in Figure 7), and then click or press **Next**.
 
-   ![Select SEMM certificate for your Recovery Request](images\surface-semm-unenroll-fig7.png "Select SEMM certificate for your Recovery Request")
+   ![Select SEMM certificate for your Recovery Request](images/surface-semm-unenroll-fig7.png "Select SEMM certificate for your Recovery Request")
 
    *Figure 7. Choose SEMM Certificate for your Recovery Request (Reset Request)*
 
 7. On the **Enter SEMM reset verification code** page you can click the **QR Code** or **Text** buttons to display your Recovery Request (Reset Request) as shown in Figure 8, or the **USB** button to save your Recovery Request (Reset Request) as a file to a USB drive, as shown in Figure 9.
 
-   ![Recovery Request displayed as a QR Code](images\surface-semm-unenroll-fig8.png "Recovery Request displayed as a QR Code")
+   ![Recovery Request displayed as a QR Code](images/surface-semm-unenroll-fig8.png "Recovery Request displayed as a QR Code")
 
    *Figure 8. A Recovery Request (Reset Request) displayed as a QR Code*
 
-   ![Save a recovery request to a USB drive](images\surface-semm-unenroll-fig9.png "Save a recovery request to a USB drive")
+   ![Save a recovery request to a USB drive](images/surface-semm-unenroll-fig9.png "Save a recovery request to a USB drive")
 
    *Figure 9. Save a Recovery Request (Reset Request) to a USB drive*
 
@@ -112,44 +116,44 @@ To initiate a Recovery Request, follow these steps:
 9. Click **Start**.
 10. Click **Recovery Request**, as shown in Figure 10.
 
-   ![Start process to approve a Recovery Request](images\surface-semm-unenroll-fig10.png "Start process to approve a Recovery Request")
+    ![Start process to approve a Recovery Request](images/surface-semm-unenroll-fig10.png "Start process to approve a Recovery Request")
 
-   *Figure 10. Click Recovery Request to begin the process to approve a Recovery Request*
+    *Figure 10. Click Recovery Request to begin the process to approve a Recovery Request*
 
-11.	Click **Certificate Protection** to authenticate the Recovery Request with the SEMM certificate.
-12.	Browse to and select your SEMM certificate file, and then click **OK**.
-13.	When you are prompted to enter the certificate password as shown in Figure 11, type and confirm the password for the certificate file, and then click **OK**.
+11. Click **Certificate Protection** to authenticate the Recovery Request with the SEMM certificate.
+12. Browse to and select your SEMM certificate file, and then click **OK**.
+13. When you are prompted to enter the certificate password as shown in Figure 11, type and confirm the password for the certificate file, and then click **OK**.
 
-   ![Type password for SEMM certificate](images\surface-semm-unenroll-fig11.png "Type password for SEMM certificate")
+    ![Type password for SEMM certificate](images/surface-semm-unenroll-fig11.png "Type password for SEMM certificate")
 
-   *Figure 11. Type the password for the SEMM certificate*
+    *Figure 11. Type the password for the SEMM certificate*
 
 14. Click **Next**.
 15. Enter the Recovery Request (Reset Request), and then click **Generate** to create a reset verification code (as shown in Figure 12).
 
-   ![Enter the recovery request](images\surface-semm-unenroll-fig12.png "Enter the recovery request")
+    ![Enter the recovery request](images/surface-semm-unenroll-fig12.png "Enter the recovery request")
 
-   *Figure 12. Enter the Recovery Request (Reset Request)*
+    *Figure 12. Enter the Recovery Request (Reset Request)*
 
-   * If you displayed the Recovery Request (Reset Request) as text on the Surface device being reset, use the keyboard to type the Recovery Request (Reset Request)  in the provided field.
-   * If you displayed the Recovery Request (Reset Request) as a QR Code and then used a messaging or email application to send the code to the computer with Microsoft Surface UEFI Configurator, copy and paste the code into the provided field.
-   * If you saved the Recovery Request (Reset Request) as a file to a USB drive, click the **Import** button, browse to and select the Recovery Request (Reset Request) file, and then click **OK**.
+    * If you displayed the Recovery Request (Reset Request) as text on the Surface device being reset, use the keyboard to type the Recovery Request (Reset Request)  in the provided field.
+    * If you displayed the Recovery Request (Reset Request) as a QR Code and then used a messaging or email application to send the code to the computer with Microsoft Surface UEFI Configurator, copy and paste the code into the provided field.
+    * If you saved the Recovery Request (Reset Request) as a file to a USB drive, click the **Import** button, browse to and select the Recovery Request (Reset Request) file, and then click **OK**.
 
-16.	The reset verification code is displayed in Microsoft Surface UEFI Configurator, as shown in Figure 13.
+16. The reset verification code is displayed in Microsoft Surface UEFI Configurator, as shown in Figure 13.
 
-   ![Display of the reset verification code](images\surface-semm-unenroll-fig13.png "Display of the reset verification code")
+    ![Display of the reset verification code](images/surface-semm-unenroll-fig13.png "Display of the reset verification code")
 
-   *Figure 13. The reset verification code displayed in Microsoft Surface UEFI Configurator*
+    *Figure 13. The reset verification code displayed in Microsoft Surface UEFI Configurator*
 
-   * Click the **Share** button to send the reset verification code by email.
+    * Click the **Share** button to send the reset verification code by email.
 
-17.	Enter the reset verification code in the provided field on the Surface device (shown in Figure 8), and then click or press **Verify** to reset the device and unenroll the device from SEMM.
-18.	Click or press **Restart now** on the **SEMM reset successful** page to complete the unenrollment from SEMM, as shown in Figure 14.
+17. Enter the reset verification code in the provided field on the Surface device (shown in Figure 8), and then click or press **Verify** to reset the device and unenroll the device from SEMM.
+18. Click or press **Restart now** on the **SEMM reset successful** page to complete the unenrollment from SEMM, as shown in Figure 14.
 
-   ![Example display of successful unenrollment from SEMM](images\surface-semm-unenroll-fig14.png "Example display of successful unenrollment from SEMM")
+    ![Example display of successful unenrollment from SEMM](images/surface-semm-unenroll-fig14.png "Example display of successful unenrollment from SEMM")
 
-   *Figure 14. Successful unenrollment from SEMM*
+    *Figure 14. Successful unenrollment from SEMM*
 
-19.	Click **End** in Microsoft Surface UEFI Configurator to complete the Recovery Request (Reset Request) process and close Microsoft Surface UEFI Configurator.
+19. Click **End** in Microsoft Surface UEFI Configurator to complete the Recovery Request (Reset Request) process and close Microsoft Surface UEFI Configurator.
 
 
diff --git a/devices/surface/update.md b/devices/surface/update.md
deleted file mode 100644
index df7a6e3c5d..0000000000
--- a/devices/surface/update.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-title: Surface firmware and driver updates (Surface)
-description: Find out how to download and manage the latest firmware and driver updates for your Surface device.
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.pagetype: surface, devices
-ms.sitesec: library
-author: heatherpoulsen
-ms.author: jdecker
-ms.topic: article
-ms.date: 11/13/2018
----
-
-# Surface firmware and driver updates
-
-Find out how to download and manage the latest firmware and driver updates for your Surface device.
-
-## In this section
-
-| Topic | Description |
-| --- | --- |
-|[Wake On LAN for Surface devices](wake-on-lan-for-surface-devices.md) | See how you can use Wake On LAN to remotely wake up devices to perform management or maintenance tasks, or to enable management solutions automatically. |
-| [Download the latest firmware and drivers for Surface devices](deploy-the-latest-firmware-and-drivers-for-surface-devices.md)| Get a list of the available downloads for Surface devices and links to download the drivers and firmware for your device.| 
-| [Manage Surface driver and firmware updates](manage-surface-pro-3-firmware-updates.md)| Explore the available options to manage firmware and driver updates for Surface devices.|
-| [Surface Dock Updater](surface-dock-updater.md)| Get a detailed walkthrough of Microsoft Surface Dock Updater.|
- 
-
-## Related topics
-
-[Surface TechCenter](https://technet.microsoft.com/windows/surface)
-
-[Surface for IT pros blog](http://blogs.technet.com/b/surface/)
-
- 
-
- 
-
-
-
-
-
diff --git a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md
index 996293cae5..ac6102c2ef 100644
--- a/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md
+++ b/devices/surface/upgrade-surface-devices-to-windows-10-with-mdt.md
@@ -6,20 +6,37 @@ ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface
 ms.sitesec: library
-author: Scottmca
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 10/16/2017
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
-#  Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit
+# Upgrade Surface devices to Windows 10 with Microsoft Deployment Toolkit
 
 #### Applies to
-* Surface Pro 3
-* Surface 3
-* Surface Pro 2
-* Surface Pro
-* Windows 10
+- Surface Pro 6
+- Surface Laptop 2
+- Surface Go
+- Surface Go with LTE
+- Surface Book 2
+- Surface Pro with LTE Advanced (Model 1807)
+- Surface Pro (Model 1796)
+- Surface Laptop
+- Surface Studio
+- Surface Studio 2
+- Surface Book
+- Surface Pro 4
+- Surface 3 LTE
+- Surface 3
+- Surface Pro 3
+- Surface Pro 2
+- Surface Pro
+- Windows 10
 
 In addition to the traditional deployment method of reimaging devices, administrators that want to upgrade Surface devices that are running Windows 8.1 or Windows 10 have the option of deploying upgrades. By performing an upgrade deployment, Windows 10 can be applied to devices without removing users, apps, or configuration. The users of the deployed devices can simply continue using the devices with the same apps and settings that they used prior to the upgrade. The process described in this article shows how to perform a Windows 10 upgrade deployment to Surface devices.
 
@@ -35,6 +52,9 @@ For versions of Windows prior to Windows 10, if you wanted to install a new vers
 
 Introduced with Windows 10 and MDT 2013 Update 1, you can use the upgrade installation path directly with Microsoft deployment technologies such as the Microsoft Deployment Toolkit (MDT). With an upgrade deployment you can use the same deployment technologies and process, but you can preserve users settings, and applications of the existing environment on the device.
 
+> [!NOTE]
+> MDT is not supported on Surface Pro X. For more information, refer to [Deploying, managing, and servicing Surface Pro X](surface-pro-arm-app-management.md)
+
 ## Deployment tools and resources
 
 Performing an upgrade deployment of Windows 10 requires the same tools and resources that are required for a traditional reimaging deployment. You can read about the tools required, including detailed explanations and installation instructions, in [Deploy Windows 10 to Surface devices with MDT](deploy-windows-10-to-surface-devices-with-mdt.md). To proceed with the upgrade deployment described in this article, you will need the following tools installed and configured:
@@ -50,7 +70,7 @@ You will also need to have available the following resources:
 * Windows 10 installation files, such as the installation media downloaded from the [Volume Licensing Service Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx)
 
    >[!NOTE]
-   >Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/en-us/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT.
+   >Installation media for use with MDT must contain a Windows image in Windows Imaging Format (.wim). Installation media produced by the [Get Windows 10](https://www.microsoft.com/software-download/windows10/) page does not use a .wim file, instead using an Electronic Software Download (.esd) file, which is not compatible with MDT.
 * [Surface firmware and drivers](https://technet.microsoft.com/itpro/surface/deploy-the-latest-firmware-and-drivers-for-surface-devices) for Windows 10
 
 * Application installation files for any applications you want to install, such as the Surface app
@@ -70,28 +90,28 @@ In the import process example shown in the [Deploy Windows 10 to Surface devices
 2. Extract the contents of the Surface Pro 3 firmware and driver pack archive file to a temporary folder. Keep the driver files separate from other drivers or files.
 3. Open the Deployment Workbench and expand the Deployment Shares node and your deployment share. 
 4. If you have not already created a folder structure by operating system version, you should do so next. Under the **Windows 10 x64** folder, create a new folder for Surface Pro 3 drivers named **Surface Pro 3**. Your Out-of-Box Drivers folder should resemble the following structure:
-  * WinPE x86
-  * WinPE x64
-  * Windows 10 x64
-    * Microsoft Corporation
-      * Surface Pro 4
-      * Surface Pro 3
+   * WinPE x86
+   * WinPE x64
+   * Windows 10 x64
+     * Microsoft Corporation
+       * Surface Pro 4
+       * Surface Pro 3
 5. Right-click the **Surface Pro 3** folder, and then click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 1.
 
-  ![Import Surface Pro 3 drivers for Windows 10](images\surface-upgrademdt-fig1.png "Import Surface Pro 3 drivers for Windows 10")
+   ![Import Surface Pro 3 drivers for Windows 10](images/surface-upgrademdt-fig1.png "Import Surface Pro 3 drivers for Windows 10")
 
-  *Figure 1. Import Surface Pro 3 drivers for Windows 10*
+   *Figure 1. Import Surface Pro 3 drivers for Windows 10*
 
 6. The Import Driver Wizard displays a series of steps, as follows:
-  - **Specify Directory** – Click **Browse** and navigate to the folder where you extracted the Surface Pro 3 firmware and drivers in Step 1.
-  - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
-  - **Progress** – While the drivers are imported, a progress bar is displayed on this page.
-  - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete Import Drivers Wizard.
+   - **Specify Directory** – Click **Browse** and navigate to the folder where you extracted the Surface Pro 3 firmware and drivers in Step 1.
+   - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
+   - **Progress** – While the drivers are imported, a progress bar is displayed on this page.
+   - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete Import Drivers Wizard.
 7. Select the **Surface Pro 3** folder and verify that the folder now contains the drivers that were imported, as shown in Figure 2.
 
-  ![Drivers for Surface Pro 3 imported and organized in the MDT deployment share](images\surface-upgrademdt-fig2.png "Drivers for Surface Pro 3 imported and organized in the MDT deployment share")
+   ![Drivers for Surface Pro 3 imported and organized in the MDT deployment share](images/surface-upgrademdt-fig2.png "Drivers for Surface Pro 3 imported and organized in the MDT deployment share")
 
-  *Figure 2. Drivers for Surface Pro 3 imported and organized in the MDT deployment share*
+   *Figure 2. Drivers for Surface Pro 3 imported and organized in the MDT deployment share*
 
 ### Import applications
 
@@ -107,17 +127,17 @@ Create the upgrade task sequence with the following process:
 
 1. In the Deployment Workbench under your Deployment Share, right-click the **Task Sequences** folder, and then click **New Task Sequence** to start the New Task Sequence Wizard.
 2. Use these steps to create the deployment task sequence with the New Task Sequence Wizard:
-  - **General Settings** – Enter an identifier for the deployment task sequence in the Task Sequence ID field, a name for the deployment task sequence in the Task Sequence Name field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, and then click **Next**.
-  >[!NOTE]
-  >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
-  - **Select Template** – Select **Standard Client Upgrade Task Sequence** from the drop-down menu, and then click **Next**.
-  - **Select OS** – Navigate to and select the Windows image that you imported, and then click **Next**.
-  - **Specify Product Key** – Select the product key entry that fits your organization’s licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**.
-  - **OS Settings** – Enter a name and organization for registration of Windows, and a home page URL for users when they browse the Internet in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**.
-  - **Admin Password** – Select **Use the Specified Local Administrator Password** and enter a password in the provided fields, and then click **Next**.
-  - **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence.
-  - **Progress** – While the task sequence is being created, a progress bar is displayed on this page.
-  - **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete New Task Sequence Wizard.
+   - **General Settings** – Enter an identifier for the deployment task sequence in the Task Sequence ID field, a name for the deployment task sequence in the Task Sequence Name field, and any comments for the deployment task sequence in the **Task Sequence Comments** field, and then click **Next**.
+     >[!NOTE]
+     >The **Task Sequence ID** field cannot contain spaces and can be a maximum of 16 characters.
+   - **Select Template** – Select **Standard Client Upgrade Task Sequence** from the drop-down menu, and then click **Next**.
+   - **Select OS** – Navigate to and select the Windows image that you imported, and then click **Next**.
+   - **Specify Product Key** – Select the product key entry that fits your organization’s licensing system. The **Do Not Specify a Product Key at This Time** option can be used for systems that will be activated via Key Management Services (KMS) or Active Directory Based Activation (ADBA). A product key can be specified specifically if your organization uses Multiple Activation Keys (MAK). Click **Next**.
+   - **OS Settings** – Enter a name and organization for registration of Windows, and a home page URL for users when they browse the Internet in the **Full Name**, **Organization**, and **Internet Explorer Home Page** fields, and then click **Next**.
+   - **Admin Password** – Select **Use the Specified Local Administrator Password** and enter a password in the provided fields, and then click **Next**.
+   - **Summary** – Review the specified configuration on this page before you click **Next** to begin creation of the task sequence.
+   - **Progress** – While the task sequence is being created, a progress bar is displayed on this page.
+   - **Confirmation** – When the task sequence creation completes, the success of the process is displayed on this page. Click **Finish** to complete New Task Sequence Wizard.
 
 After the task sequence is created, you can modify some additional settings to provide additional automation of the task sequence and require less interaction during deployment. Follow these steps to modify the task sequence:
 
@@ -129,9 +149,9 @@ After the task sequence is created, you can modify some additional settings to p
 6. Between the two Windows Update steps is an **Install Applications** step. Select that step and then click **Add**.
 7. Hover the mouse over **General** under the **Add** menu, and then choose **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3.
 
-  ![A new Install Application step in the deployment task sequence](images\surface-upgrademdt-fig3.png "A new Install Application step in the deployment task sequence")
+   ![A new Install Application step in the deployment task sequence](images/surface-upgrademdt-fig3.png "A new Install Application step in the deployment task sequence")
   
-  *Figure 3. A new Install Application step in the deployment task sequence*
+   *Figure 3. A new Install Application step in the deployment task sequence*
   
 8. On the **Properties** tab of the new **Install Application** step, enter **Install Surface App** in the **Name** field.
 9. Select **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share.
@@ -140,22 +160,22 @@ After the task sequence is created, you can modify some additional settings to p
 12. Open the **Add** menu again and choose **Set Task Sequence Variable** from under the **General** menu.
 13. On the **Properties** tab of the new **Set Task Sequence Variable** step (as shown in Figure 4) configure the following options:
 
-  - **Name** – Set DriverGroup001
-  - **Task Sequence Variable** – DriverGroup001
-  - **Value** – Windows 10 x64\%Make%\%Model%
+    - **Name** – Set DriverGroup001
+    - **Task Sequence Variable** – DriverGroup001
+    - **Value** – Windows 10 x64\%Make%\%Model%
 
-  ![Configure a new Set Task Sequence Variable step in the deployment task sequence](images\surface-upgrademdt-fig4.png "Configure a new Set Task Sequence Variable step in the deployment task sequence")
+    ![Configure a new Set Task Sequence Variable step in the deployment task sequence](images/surface-upgrademdt-fig4.png "Configure a new Set Task Sequence Variable step in the deployment task sequence")
   
-  *Figure 4. Configure a new Set Task Sequence Variable step in the deployment task sequence*
+    *Figure 4. Configure a new Set Task Sequence Variable step in the deployment task sequence*
   
 14. Select the **Inject Drivers** step, the next step in the task sequence.
 15. On the **Properties** tab of the **Inject Drivers** step (as shown in Figure 5) configure the following options:
-  * In the **Choose a selection profile** drop-down menu, select **Nothing**.
-  * Click the **Install all drivers from the selection profile** button.
+    * In the **Choose a selection profile** drop-down menu, select **Nothing**.
+    * Click the **Install all drivers from the selection profile** button.
   
-  ![Configure the deployment task sequence to not install drivers](images\surface-upgrademdt-fig5.png "Configure the deployment task sequence to not install drivers")
+    ![Configure the deployment task sequence to not install drivers](images/surface-upgrademdt-fig5.png "Configure the deployment task sequence to not install drivers")
   
-  *Figure 5. Configure the deployment task sequence to not install drivers*
+    *Figure 5. Configure the deployment task sequence to not install drivers*
 
 16. Click **OK** to apply changes to the task sequence and close the task sequence properties window.
 
diff --git a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md
index 381ba2d8e1..0cf1ab9bda 100644
--- a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md
+++ b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md
@@ -1,29 +1,33 @@
 ---
-title: Use System Center Configuration Manager to manage devices with SEMM (Surface)
-description: Find out how to use Microsoft Surface UEFI Manager to perform SEMM management with System Center Configuration Manager.
+title: Use Microsoft Endpoint Configuration Manager to manage devices with SEMM (Surface)
+description: Learn how to manage Microsoft Surface Enterprise Management Mode (SEMM) with Endpoint Configuration Manager.
 keywords: enroll, update, scripts, settings
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: KiranDavane
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 02/01/2017
+ms.date: 11/22/2019
+ms.reviewer: 
+manager: dansimp
+ms.localizationpriority: medium
+ms.audience: itpro
 ---
 
-# Use System Center Configuration Manager to manage devices with SEMM
+# Use Microsoft Endpoint Configuration Manager to manage devices with SEMM
 
-The Surface Enterprise Management Mode (SEMM) feature of Surface UEFI devices allows administrators to both manage and secure the configuration of Surface UEFI settings. For most organizations, this process is accomplished by creating Windows Installer (.msi) packages with the Microsoft Surface UEFI Configurator tool. These packages are then run or deployed to the client Surface devices to enroll the devices in SEMM and to update the Surface UEFI settings configuration.
+The Microsoft Surface Enterprise Management Mode (SEMM) feature of Surface UEFI devices lets administrators manage and help secure the configuration of Surface UEFI settings. For most organizations, this process is accomplished by creating Windows Installer (.msi) packages with the Microsoft Surface UEFI Configurator tool. These packages are then run or deployed to the client Surface devices to enroll the devices in SEMM and to update the Surface UEFI settings configuration.
 
-For organizations with System Center Configuration Manager, there is an alternative to using the Microsoft Surface UEFI Configurator .msi process to deploy and administer SEMM. Microsoft Surface UEFI Manager is a lightweight installer that makes required assemblies for SEMM management available on a device. By installing these assemblies with Microsoft Surface UEFI Manager on a managed client, SEMM can be administered by Configuration Manager with PowerShell scripts, deployed as applications. With this process, SEMM management is performed within Configuration Manager, which eliminates the need for the external Microsoft Surface UEFI Configurator tool.
+For organizations with Microsoft Endpoint Configuration Manager there is an alternative to using the Microsoft Surface UEFI Configurator .msi process to deploy and administer SEMM. Microsoft Surface UEFI Manager is a lightweight installer that makes required assemblies for SEMM management available on a device. By installing these assemblies with Microsoft Surface UEFI Manager on a managed client, SEMM can be administered by Configuration Manager with PowerShell scripts, deployed as applications. With this process, SEMM management is performed within Configuration Manager, which eliminates the need for the external Microsoft Surface UEFI Configurator tool.
 
->[!Note]
->Although the process described in this article may work with earlier versions of System Center Configuration Manager or with other third-party management solutions, management of SEMM with Microsoft Surface UEFI Manager and PowerShell is supported only with the Current Branch of System Center Configuration Manager.
+> [!Note]
+> Although the process described in this article may work with earlier versions of Endpoint Configuration Manager or with other third-party management solutions, management of SEMM with Microsoft Surface UEFI Manager and PowerShell is supported only with the Current Branch of Endpoint Configuration Manager.
 
 #### Prerequisites
 
-Before you begin the process outlined in this article, it is expected that you are familiar with the following technologies and tools:
+Before you begin the process outlined in this article, familiarize yourself with the following technologies and tools:
 
 * [Surface UEFI](https://technet.microsoft.com/itpro/surface/manage-surface-uefi-settings)
 * [Surface Enterprise Management Mode (SEMM)](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode)
@@ -31,10 +35,10 @@ Before you begin the process outlined in this article, it is expected that you a
 * [System Center Configuration Manager application deployment](https://docs.microsoft.com/sccm/apps/deploy-use/deploy-applications)
 * Certificate management
 
->[!Note]
->You will also need access to the certificate that you intend to use to secure SEMM. For details about the requirements for this certificate, see [Surface Enterprise Management Mode certificate requirements](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode#surface-enterprise-management-mode-certificate-requirements).
-
->It is very important that this certificate be kept in a safe location and properly backed up. If this certificate becomes lost or unusable, it is not possible to reset Surface UEFI, change managed Surface UEFI settings, or remove SEMM from an enrolled Surface device.
+> [!Note]
+> You will also need access to the certificate that you intend to use to secure SEMM. For details about the requirements for this certificate, see [Surface Enterprise Management Mode certificate requirements](https://technet.microsoft.com/itpro/surface/surface-enterprise-management-mode#surface-enterprise-management-mode-certificate-requirements).
+> 
+> It is very important that this certificate be kept in a safe location and properly backed up. If this certificate becomes lost or unusable, it is not possible to reset Surface UEFI, change managed Surface UEFI settings, or remove SEMM from an enrolled Surface device.
 
 #### Download Microsoft Surface UEFI Manager
 
@@ -42,155 +46,162 @@ Management of SEMM with Configuration Manager requires the installation of Micro
 
 #### Download SEMM scripts for Configuration Manager
 
-After Microsoft Surface UEFI Manager is installed on the client Surface device, SEMM is deployed and managed with PowerShell scripts. You can download samples of the [SEMM management scripts](https://www.microsoft.com/en-us/download/details.aspx?id=46703) from the Download Center.
+After Microsoft Surface UEFI Manager is installed on the client Surface device, SEMM is deployed and managed with PowerShell scripts. You can download samples of the [SEMM management scripts](https://www.microsoft.com/download/details.aspx?id=46703) from the Download Center.
 
 ## Deploy Microsoft Surface UEFI Manager
 
 Deployment of Microsoft Surface UEFI Manager is a typical application deployment. The Microsoft Surface UEFI Manager installer file is a standard Windows Installer file that you can install with the [standard quiet option](https://msdn.microsoft.com/library/windows/desktop/aa367988).
 
-The command to install Microsoft Surface UEFI Manager is:
+The command to install Microsoft Surface UEFI Manager is as follows.
 
 `msiexec /i "SurfaceUEFIManagerSetup.msi" /q`
 
-The command to uninstall Microsoft Surface UEFI Manager is:
+The command to uninstall Microsoft Surface UEFI Manager is as follows.
 
 `msiexec /x {541DA890-1AEB-446D-B3FD-D5B3BB18F9AF} /q`
 
 To create a new application and deploy it to a collection that contains your Surface devices, perform the following steps:
 
-1. Open Configuration Manager Console from the Start screen or Start menu.
-2. Click **Software Library** in the bottom left corner of the window.
-3. Expand the Application Management node of the Software Library, and then click **Applications**.
-4. Click the **Create Application** button under the **Home** tab at the top of the window. This starts the Create Application Wizard.
+1. Open Configuration Manager Console from the **Start** screen or **Start** menu.
+2. Select **Software Library** in the bottom left corner of the window.
+3. Expand the **Application Management** node of the Software Library, and then select **Applications**.
+4. Select the **Create Application** button under the **Home** tab at the top of the window. This starts the Create Application Wizard.
 5. The Create Application Wizard presents a series of steps:
 
-   * **General** – The **Automatically detect information about this application from installation files** option is selected by default. In the **Type** field, **Windows Installer (*.msi file)** is also selected by default. Click **Browse** to navigate to and select **SurfaceUEFIManagerSetup.msi**, and then click **Next**.
+   * **General** – The **Automatically detect information about this application from installation files** option is selected by default. In the **Type** field, **Windows Installer (.msi file)** is also selected by default. Select **Browse** to navigate to and select **SurfaceUEFIManagerSetup.msi**, and then select **Next**.
    
-      >[!Note]
-      >The location of SurfaceUEFIManagerSetup.msi must be on a network share and located in a folder that contains no other files. A local file location cannot be used.
+      > [!Note]
+      > The location of SurfaceUEFIManagerSetup.msi must be on a network share and located in a folder that contains no other files. A local file location cannot be used.
 
-   * **Import Information** – The Create Application Wizard will parse the .msi file and read the **Application Name** and **Product Code**. SurfaceUEFIManagerSetup.msi should be listed as the only file under the line **Content Files**, as shown in Figure 1. Click **Next** to proceed.
+   * **Import Information** – The Create Application Wizard will parse the .msi file and read the **Application Name** and **Product Code**. SurfaceUEFIManagerSetup.msi should be listed as the only file under the line **Content Files**, as shown in Figure 1. Select **Next** to proceed.
 
    
    ![Information from Surface UEFI Manager setup is automatically parsed](images/config-mgr-semm-fig1.png "Information from Surface UEFI Manager setup is automatically parsed")
    
    *Figure 1. Information from Microsoft Surface UEFI Manager setup is automatically parsed*
 
-   * **General Information** – You can modify the name of the application and information about the publisher and version, or add comments on this page. The installation command for Microsoft Surface UEFI Manager is displayed in the Installation Program field. The default installation behavior of Install for system will allow Microsoft Surface UEFI Manager to install the required assemblies for SEMM even if a user is not logged on to the Surface device. Click Next to proceed.
-   * **Summary** – The information that was parsed in the **Import Information** step and your selections from the **General Information** step is displayed on this page. Click **Next** to confirm your selections and create the application.
+   * **General Information** – You can modify the name of the application and information about the publisher and version, or add comments on this page. The installation command for Microsoft Surface UEFI Manager is displayed in the Installation Program field. The default installation behavior of Install for system will allow Microsoft Surface UEFI Manager to install the required assemblies for SEMM even if a user is not logged on to the Surface device. Select **Next** to proceed.
+   * **Summary** – The information that was parsed in the **Import Information** step and your selections from the **General Information** step is displayed on this page. Select **Next** to confirm your selections and create the application.
    * **Progress** – Displays a progress bar and status as the application is imported and added to the Software Library.
-   * **Completion** – Confirmation of the successful application creation is displayed when the application creation process is complete. Click **Close** to finish the Create Application Wizard.
+   * **Completion** – Confirmation of the successful application creation is displayed when the application creation process is complete. Select **Close** to finish the Create Application Wizard.
 
-After the application is created in Configuration Manager, you can distribute it to your distribution points and deploy it to the collections including your Surface devices. This application will not install or enable SEMM on the Surface device – it only provides the assemblies required for SEMM to be enabled via PowerShell script.
+After the application is created in Configuration Manager, you can distribute it to your distribution points and deploy it to the collections including your Surface devices. This application will not install or enable SEMM on the Surface device. It only provides the assemblies required for SEMM to be enabled using the PowerShell script.
 
 If you do not want to install the Microsoft Surface UEFI Manager assemblies on devices that will not be managed with SEMM, you can configure Microsoft Surface UEFI Manager as a dependency of the SEMM Configuration Manager scripts. This scenario is covered in the [Deploy SEMM Configuration Manager Scripts](#deploy-semm-configuration-manager-scripts) section later in this article.
 
 ## Create or modify the SEMM Configuration Manager scripts
 
-After the required assemblies have been installed on the devices, the process of enrolling the devices in SEMM and configuring Surface UEFI is done with PowerShell scripts and deployed as a script application with Configuration Manager. These scripts can be modified to fit the needs of your organization and environment. For example, you can create multiple configurations for managed Surface devices in different departments or roles. You can download samples of the scripts for SEMM and Configuration Manager at the link in the [Prerequisites](#prerequisites) section at the beginning of this article.
+After the required assemblies have been installed on the devices, the process of enrolling the devices in SEMM and configuring Surface UEFI is done with PowerShell scripts and deployed as a script application with Configuration Manager. These scripts can be modified to fit the needs of your organization and environment. For example, you can create multiple configurations for managed Surface devices in different departments or roles. You can download samples of the scripts for SEMM and Configuration Manager from the link in the [Prerequisites](#prerequisites) section at the beginning of this article.
 
-There are two primary scripts you will need to perform a SEMM deployment with Configuration Manager:
+There are two primary scripts you will need in order to perform a SEMM deployment with Configuration Manager:
 
-* **ConfigureSEMM.ps1** – Use this script to create configuration packages for your Surface devices with your desired Surface UEFI settings, to apply the specified settings to a Surface device, to enroll the device in SEMM, and to set a registry key used to identify the enrollment of the device in SEMM.
+* **ConfigureSEMM.ps1** – Use this script to create configuration packages for your Surface devices with your desired Surface UEFI settings to apply the specified settings to a Surface device, to enroll the device in SEMM, and to set a registry key used to identify the enrollment of the device in SEMM.
 * **ResetSEMM.ps1** – Use this script to reset SEMM on a Surface device, which unenrolls it from SEMM and removes the control over Surface UEFI settings.
 
 The sample scripts include examples of how to set Surface UEFI settings and how to control permissions to those settings. These settings can be modified to secure Surface UEFI and set Surface UEFI settings according to the needs of your environment. The following sections of this article explain the ConfigureSEMM.ps1 script and explore the modifications you need to make to the script to fit your requirements.
 
->[!NOTE]
->The SEMM Configuration Manager scripts and the exported SEMM certificate file (.pfx) should be placed in the same folder with no other files before they are added to Configuration Manager.
+> [!NOTE]
+> The SEMM Configuration Manager scripts and the exported SEMM certificate file (.pfx) should be placed in the same folder with no other files before they are added to Configuration Manager.
 
 ### Specify certificate and package names
 
-The first region of the script that you need to modify is the portion that specifies and loads the SEMM certificate, and also indicates the names for the SEMM configuration package and SEMM reset package. The certificate and package names are specified on lines 56 through 67 in the ConfigureSEMM.ps1 script:
+The first region of the script that you need to modify is the portion that specifies and loads the SEMM certificate, and also indicates SurfaceUEFIManager version, and the names for the SEMM configuration package and SEMM reset package. The certificate name and SurfaceUEFIManager version are specified on lines 56 through 73 in the ConfigureSEMM.ps1 script.
 
   ```
   56	$WorkingDirPath = split-path -parent $MyInvocation.MyCommand.Definition
   57	$packageRoot = "$WorkingDirPath\Config"
-  58	
-  59	if (-not (Test-Path $packageRoot))  { New-Item -ItemType Directory -Force -Path $packageRoot }
-  60	Copy-Item "$WorkingDirPath\FabrikamOwnerSigner.pfx" $packageRoot
-  61	
-  62	$privateOwnerKey = Join-Path -Path $packageRoot -ChildPath "FabrikamOwnerSigner.pfx"
-  63	$ownerPackageName = Join-Path -Path $packageRoot -ChildPath "FabrikamSignerProvisioningPackage.pkg"
-  64	$resetPackageName = Join-Path -Path $packageRoot -ChildPath "FabrikamUniversalResetPackage.pkg"
-  65	
-  66	# If your PFX file requires a password then it can be set here, otherwise use a blank string.
-  67	$password = "1234" 
+  58	$certName = "FabrikamSEMMSample.pfx"
+  59  $DllVersion = "2.26.136.0"
+  60
+  61  $certNameOnly = [System.IO.Path]::GetFileNameWithoutExtension($certName)
+  62  $ProvisioningPackage = $certNameOnly + "ProvisioningPackage.pkg"
+  63  $ResetPackage = $certNameOnly + "ResetPackage.pkg"
+  64
+  65	if (-not (Test-Path $packageRoot))  { New-Item -ItemType Directory -Force -Path $packageRoot }
+  66	Copy-Item "$WorkingDirPath\$certName" $packageRoot
+  67	
+  68	$privateOwnerKey = Join-Path -Path $packageRoot -ChildPath $certName
+  69	$ownerPackageName = Join-Path -Path $packageRoot -ChildPath $ProvisioningPackage
+  70	$resetPackageName = Join-Path -Path $packageRoot -ChildPath $ResetPackage
+  71	
+  72	# If your PFX file requires a password then it can be set here, otherwise use a blank string.
+  73	$password = "1234" 
   ```
 
-Replace the **FabrikamOwnerSigner.pfx** value for the **$privateOwnerKey** variable with the name of your SEMM Certificate file on both lines 60 and 62. The script will create a working directory (named Config) in the folder where your scripts are located, and will then copy the certificate file to this working directory.
+Replace the **FabrikamSEMMSample.pfx** value for the **$certName** variable with the name of your SEMM Certificate file on line 58. The script will create a working directory (named Config) in the folder where your scripts are located, and then copies the certificate file to this working directory.
 
-Replace the **FabrikamSignerProvisioningPackage.pkg** and **FabrikamUniversalResetPackage.pkg** values on lines 63 and 64 to define the **$ownerPackageName** and **$resetPackageName** variables with your desired names for the SEMM configuration and reset packages. These packages will also be created in the Config directory and hold the configuration for Surface UEFI settings and permissions generated by the script.
+Owner package and reset package will also be created in the Config directory and hold the configuration for Surface UEFI settings and permissions generated by the script.
 
-On line 67, replace the value of the **$password** variable, from 1234, to the password for your certificate file. If a password is not required, delete the **1234** text.
+On line 73, replace the value of the **$password** variable, from **1234** to the password for your certificate file. If a password is not required, delete the **1234** text.
 
->[!Note]
->The last two characters of the certificate thumbprint are required to enroll a device in SEMM. This script will display these digits to the user, which allows the user or technician to record these digits before the system reboots to enroll the device in SEMM. The script uses the following code, found on lines 144-149, to accomplish this:
+> [!Note]
+> The last two characters of the certificate thumbprint are required to enroll a device in SEMM. This script will display these digits to the user, which allows the user or technician to record these digits before the system reboots to enroll the device in SEMM. The script uses the following code, found on lines 150-155, to accomplish this.
 
 ```
-144	# Device owners will need the last two characters of the thumbprint to accept SEMM ownership.
-145	# For convenience we get the thumbprint here and present to the user.
-146	$pw = ConvertTo-SecureString $password -AsPlainText -Force
-147	$certPrint = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
-148	$certPrint.Import($privateOwnerKey, $pw, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::DefaultKeySet)
-149	Write-Host "Thumbprint =" $certPrint.Thumbprint
+150	# Device owners will need the last two characters of the thumbprint to accept SEMM ownership.
+151	# For convenience we get the thumbprint here and present to the user.
+152	$pw = ConvertTo-SecureString $password -AsPlainText -Force
+153	$certPrint = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
+154	$certPrint.Import($privateOwnerKey, $pw, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::DefaultKeySet)
+155	Write-Host "Thumbprint =" $certPrint.Thumbprint
 ```
 
 Administrators with access to the certificate file (.pfx) can read the thumbprint at any time by opening the .pfx file in CertMgr. To view the thumbprint with CertMgr, follow this process:
 
-1. Right-click the .pfx file, and then click **Open**.
+1. Right-click the .pfx file, and then select **Open**.
 2. Expand the folder in the navigation pane.
-3. Click **Certificates**.
-4. Right-click your certificate in the main pane, and then click **Open**.
-5. Click the **Details** tab.
+3. Select **Certificates**.
+4. Right-click your certificate in the main pane, and then select **Open**.
+5. Select the **Details** tab.
 6. **All** or **Properties Only** must be selected in the **Show** drop-down menu.
 7. Select the field **Thumbprint**.
 
->[!NOTE]
->The SEMM certificate name and password must also be entered in this section of the ResetSEMM.ps1 script to enable Configuration Manager to remove SEMM from the device with the uninstall action.
+> [!NOTE]
+> The SEMM certificate name and password must also be entered in this section of the ResetSEMM.ps1 script to enable Configuration Manager to remove SEMM from the device with the uninstall action.
 
 ### Configure permissions
 
-The first region of the script where you will specify the configuration for Surface UEFI is the **Configure Permissions** region. This region begins at line 202 in the sample script with the comment **# Configure Permissions** and continues to line 238. The following code fragment first sets permissions to all Surface UEFI settings so that they may be modified by SEMM only, then adds explicit permissions to allow the local user to modify the Surface UEFI password, TPM, and front and rear cameras:
+The first region of the script where you will specify the configuration for Surface UEFI is the **Configure Permissions** region. This region begins at line 210 in the sample script with the comment **# Configure Permissions** and continues to line 247. The following code fragment first sets permissions to all Surface UEFI settings so that they may be modified by SEMM only, then adds explicit permissions to allow the local user to modify the Surface UEFI password, TPM, and front and rear cameras.
 
 ```
-202	# Configure Permissions
-203	foreach ($uefiV2 IN $surfaceDevices.Values) {
-204	# Here we define which "identities" will be allowed to modify which settings
-205	#   PermissionSignerOwner = The primary SEMM enterprise owner identity
-206	#   PermissionLocal = The user when booting to the UEFI pre-boot GUI
-207	#   PermissionSignerUser, PermissionSignerUser1, PermissionSignerUser2 =
-208	#     Additional user identities created so that the signer owner
-209	#     can delegate permission control for some settings.
-210	$ownerOnly = [Microsoft.Surface.IUefiSetting]::PermissionSignerOwner
-211	$ownerAndLocalUser = ([Microsoft.Surface.IUefiSetting]::PermissionSignerOwner -bor [Microsoft.Surface.IUefiSetting]::PermissionLocal)
-212	
-213	# Make all permissions owner only by default
-214	foreach ($setting IN $uefiV2.Settings.Values) {
-215	$setting.ConfiguredPermissionFlags = $ownerOnly
-216	}
-217	# Allow the local user to change their own password
-218	$uefiV2.SettingsById[501].ConfiguredPermissionFlags = $ownerAndLocalUser
-219	
-220	# Allow the local user to change the state of the TPM
-221	$uefiV2.Settings["Trusted Platform Module (TPM)"].ConfiguredPermissionFlags = $ownerAndLocalUser
-222	
-223	# Allow the local user to change the state of the Front and Rear cameras
-224	$uefiV2.SettingsById[302].ConfiguredPermissionFlags = $ownerAndLocalUser
-225	$uefiV2.SettingsById[304].ConfiguredPermissionFlags = $ownerAndLocalUser
-226	 
-227	 
-228	# Create a unique package name based on family and LSV.
-229	# We will choose a name that can be parsed by later scripts.
-230	$packageName = $uefiV2.SurfaceUefiFamily + "^Permissions^" + $lsv + ".pkg"
-231	$fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName
-232	
-233	# Build and sign the Permission package then save it to a file.
-234	$permissionPackageStream =  $uefiV2.BuildAndSignPermissionPackage($privateOwnerKey, $password, "", $null, $lsv)
-235	$permissionPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write)
-236	$permissionPackageStream.CopyTo($permissionPackage)
-237	$permissionPackage.Close()
-238	}
+210	# Configure Permissions
+211	foreach ($uefiV2 IN $surfaceDevices.Values) {
+212 if ($uefiV2.SurfaceUefiFamily -eq $Device.Model) {
+213 Write-Host "Configuring permissions"
+214 Write-Host $Device.Model
+215 Write-Host "======================="
+216
+217	# Here we define which "identities" will be allowed to modify which settings
+218	#   PermissionSignerOwner = The primary SEMM enterprise owner identity
+219	#   PermissionLocal = The user when booting to the UEFI pre-boot GUI
+220	#   PermissionSignerUser, PermissionSignerUser1, PermissionSignerUser2 =
+221	#     Additional user identities created so that the signer owner
+222	#     can delegate permission control for some settings.
+223	$ownerOnly = [Microsoft.Surface.IUefiSetting]::PermissionSignerOwner
+224	$ownerAndLocalUser = ([Microsoft.Surface.IUefiSetting]::PermissionSignerOwner -bor [Microsoft.Surface.IUefiSetting]::PermissionLocal)
+225	
+226	# Make all permissions owner only by default
+227	foreach ($setting IN $uefiV2.Settings.Values) {
+228	$setting.ConfiguredPermissionFlags = $ownerOnly
+229	}
+230	
+231 # Allow the local user to change their own password
+232	$uefiV2.SettingsById[501].ConfiguredPermissionFlags = $ownerAndLocalUser
+233
+234	Write-Host ""
+235	 
+236	# Create a unique package name based on family and LSV.
+237	# We will choose a name that can be parsed by later scripts.
+238	$packageName = $uefiV2.SurfaceUefiFamily + "^Permissions^" + $lsv + ".pkg"
+239	$fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName
+240	
+241	# Build and sign the Permission package then save it to a file.
+242	$permissionPackageStream =  $uefiV2.BuildAndSignPermissionPackage($privateOwnerKey, $password, "", $null, $lsv)
+243	$permissionPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write)
+244	$permissionPackageStream.CopyTo($permissionPackage)
+245	$permissionPackage.Close()
+246	}
+247	}
 ```
 
 Each **$uefiV2** variable identifies a Surface UEFI setting by setting name or ID, and then configures the permissions to one of the following values:
@@ -202,78 +213,178 @@ You can find information about the available settings names and IDs for Surface
 
 ### Configure settings
 
-The second region of the script where you will specify the configuration for Surface UEFI is the **Configure Settings** region of the ConfigureSEMM.ps1 script, which configures whether each setting is enabled or disabled. The sample script includes instructions to set all settings to their default values. The script then provides explicit instructions to disable IPv6 for PXE Boot and to leave the Surface UEFI Administrator password unchanged. You can find this region beginning with the **# Configure Settings** comment at line 282 through line 312 in the sample script. The region appears as follows:
+The second region of the script where you will specify the configuration for Surface UEFI is the **Configure Settings** region of the ConfigureSEMM.ps1 script, which configures whether each setting is enabled or disabled. The sample script includes instructions to set all settings to their default values. The script then provides explicit instructions to disable IPv6 for PXE Boot and to leave the Surface UEFI Administrator password unchanged. You can find this region beginning with the **# Configure Settings** comment at line 291 through line 335 in the sample script. The region appears as follows.
 
 ```
-282	# Configure Settings
-283	foreach ($uefiV2 IN $surfaceDevices.Values) {
-284	# In this demo, we will start by setting every setting to the default factory setting.
-285	# You may want to start by doing this in your scripts
-286	# so that every setting gets set to a known state.
-287	foreach ($setting IN $uefiV2.Settings.Values) {
-288	$setting.ConfiguredValue = $setting.DefaultValue
-289	}
-290	
-291	# If you want to set something to a different value from the default,
-292	# here are examples of how to accomplish this.
-293	$uefiV2.Settings["IPv6 for PXE Boot"].ConfiguredValue = "Disabled"
-294	
-295	# If you want to leave the setting unmodified, set it to $null
-296	# PowerShell has issues setting things to $null so ClearConfiguredValue()
-297	# is supplied to do this explicitly.
-298	# Here is an example of leaving the UEFI administrator password as-is,
-299	# even after we initially set it to factory default above.
-300	$uefiV2.SettingsById[501].ClearConfiguredValue()
-301	
-302	# Create a unique package name based on family and LSV.
-303	# We will choose a name that can be parsed by later scripts.
-304	$packageName = $uefiV2.SurfaceUefiFamily + "^Settings^" + $lsv + ".pkg"
-305	$fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName
-306	
-307	# Build and sign the Settings package then save it to a file.
-308	$settingsPackageStream =  $uefiV2.BuildAndSignSecuredSettingsPackage($privateOwnerKey, $password, "", $null, $lsv)
-309	$settingsPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write)
-310	$settingsPackageStream.CopyTo($settingsPackage)
-311	$settingsPackage.Close()
-312	}
+291	# Configure Settings
+292	foreach ($uefiV2 IN $surfaceDevices.Values) {
+293 if ($uefiV2.SurfaceUefiFamily -eq $Device.Model) {
+294 Write-Host "Configuring settings"
+295 Write-Host $Device.Model
+296 Write-Host "===================="
+297
+298	# In this demo, we will start by setting every setting to the default factory setting.
+299	# You may want to start by doing this in your scripts
+300	# so that every setting gets set to a known state.
+301	foreach ($setting IN $uefiV2.Settings.Values) {
+302	$setting.ConfiguredValue = $setting.DefaultValue
+303	}
+304	
+305	$EnabledValue = "Enabled"
+306 $DisabledValue = "Disabled"
+307
+308 # If you want to set something to a different value from the default,
+309	# here are examples of how to accomplish this.
+310	# This disables IPv6 PXE boot by name:
+311 $uefiV2.Settings["IPv6 for PXE Boot"].ConfiguredValue = $DisabledValue
+312
+313 # This disables IPv6 PXE Boot by ID:
+314 $uefiV2.SettingsById[400].ConfiguredValue = $DisabledValue
+315
+316 Write-Host ""
+317
+318	# If you want to leave the setting unmodified, set it to $null
+319	# PowerShell has issues setting things to $null so ClearConfiguredValue()
+320	# is supplied to do this explicitly.
+321	# Here is an example of leaving the UEFI administrator password as-is,
+322	# even after we initially set it to factory default above.
+323	$uefiV2.SettingsById[501].ClearConfiguredValue()
+324	
+325	# Create a unique package name based on family and LSV.
+326	# We will choose a name that can be parsed by later scripts.
+327	$packageName = $uefiV2.SurfaceUefiFamily + "^Settings^" + $lsv + ".pkg"
+328	$fullPackageName = Join-Path -Path $packageRoot -ChildPath $packageName
+329	
+330	# Build and sign the Settings package then save it to a file.
+331	$settingsPackageStream =  $uefiV2.BuildAndSignSecuredSettingsPackage($privateOwnerKey, $password, "", $null, $lsv)
+332	$settingsPackage = New-Object System.IO.Filestream($fullPackageName, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write)
+333	$settingsPackageStream.CopyTo($settingsPackage)
+334	$settingsPackage.Close()
+335	}
 ```
 
 Like the permissions set in the **Configure Permissions** section of the script, the configuration of each Surface UEFI setting is performed by defining the **$uefiV2** variable. For each line defining the **$uefiV2** variable, a Surface UEFI setting is identified by setting name or ID and the configured value is set to **Enabled** or **Disabled**.
 
-If you do not want to alter the configuration of a Surface UEFI setting, for example to ensure that the Surface UEFI administrator password is not cleared by the action of resetting all Surface UEFI settings to their default, you can use **ClearConfiguredValue()** to enforce that this setting will not be altered. In the sample script, this is used on line 300 to prevent the clearing of the Surface UEFI Administrator password, identified in the sample script by its setting ID, **501**.
+If you do not want to alter the configuration of a Surface UEFI setting, for example to ensure that the Surface UEFI administrator password is not cleared by the action of resetting all Surface UEFI settings to their default, you can use **ClearConfiguredValue()** to enforce that this setting will not be altered. In the sample script, this is used on line 323 to prevent the clearing of the Surface UEFI Administrator password, identified in the sample script by its setting ID, **501**.
 
 You can find information about the available settings names and IDs for Surface UEFI in the [Settings Names and IDs](#settings-names-and-ids) section later in this article.
 
 ### Settings registry key
 
-To identify enrolled systems for Configuration Manager, the ConfigureSEMM.ps1 script writes a registry key that can be used to identify enrolled systems as having been installed with the SEMM configuration script. This key can be found at the following location:
+To identify enrolled systems for Configuration Manager, the ConfigureSEMM.ps1 script writes registry keys that can be used to identify enrolled systems as having been installed with the SEMM configuration script. These keys can be found at the following location.
 
-`HKLM\SOFTWARE\Microsoft\Surface\SEMM\Enabled_Version1000`
+`HKLM\SOFTWARE\Microsoft\Surface\SEMM`
 
-The following code fragment, found on lines 352-363, is used to write this registry key:
+The following code fragment, found on lines 380-477, is used to write these registry keys.
 
 ```
-352	$SurfaceRegKey = "HKLM:\SOFTWARE\Microsoft\Surface\SEMM"
-353	New-RegKey $SurfaceRegKey
-354	$SurfaceRegValue = Get-ItemProperty $SurfaceRegKey Enabled_Version1000 -ErrorAction SilentlyContinue
-355	
-356	If ($SurfaceRegValue -eq $null)
-357	{
-358	New-ItemProperty -Path $SurfaceRegKey -Name Enabled_Version1000 -PropertyType String -Value 1 | Out-Null
-359	}
-360	Else
-361	{
-362	Set-ItemProperty -Path $SurfaceRegKey -Name Enabled_Version1000 -Value 1
-363	}
+380	# For Endpoint Configuration Manager or other management solutions that wish to know what version is applied, tattoo the LSV and current DateTime (in UTC) to the registry:
+381	$UTCDate = (Get-Date).ToUniversalTime().ToString()
+382	$certIssuer = $certPrint.Issuer
+383	$certSubject = $certPrint.Subject
+384	
+385	$SurfaceRegKey = "HKLM:\SOFTWARE\Microsoft\Surface\SEMM"
+386	New-RegKey $SurfaceRegKey
+387	$LSVRegValue = Get-ItemProperty $SurfaceRegKey LSV -ErrorAction SilentlyContinue
+388	$DateTimeRegValue = Get-ItemProperty $SurfaceRegKey LastConfiguredUTC -ErrorAction SilentlyContinue
+389	$OwnershipSessionIdRegValue = Get-ItemProperty $SurfaceRegKey OwnershipSessionId -ErrorAction SilentlyContinue
+390	$PermissionSessionIdRegValue = Get-ItemProperty $SurfaceRegKey PermissionSessionId -ErrorAction SilentlyContinue
+391	$SettingsSessionIdRegValue = Get-ItemProperty $SurfaceRegKey SettingsSessionId -ErrorAction SilentlyContinue
+392	$IsResetRegValue = Get-ItemProperty $SurfaceRegKey IsReset -ErrorAction SilentlyContinue
+393	$certUsedRegValue = Get-ItemProperty $SurfaceRegKey CertName -ErrorAction SilentlyContinue
+394	$certIssuerRegValue = Get-ItemProperty $SurfaceRegKey CertIssuer -ErrorAction SilentlyContinue
+395	$certSubjectRegValue = Get-ItemProperty $SurfaceRegKey CertSubject -ErrorAction SilentlyContinue
+396	
+397	
+398	If ($LSVRegValue -eq $null)
+399	{
+400	    New-ItemProperty -Path $SurfaceRegKey -Name LSV -PropertyType DWORD -Value $lsv | Out-Null
+401	}
+402	Else
+403	{
+404	    Set-ItemProperty -Path $SurfaceRegKey -Name LSV -Value $lsv
+405	}
+406	
+407	If ($DateTimeRegValue -eq $null)
+408	{
+409	    New-ItemProperty -Path $SurfaceRegKey -Name LastConfiguredUTC -PropertyType String -Value $UTCDate | Out-Null
+410	}
+411	Else
+412	{
+413	    Set-ItemProperty -Path $SurfaceRegKey -Name LastConfiguredUTC -Value $UTCDate
+414	}
+415	
+416	If ($OwnershipSessionIdRegValue -eq $null)
+417	{
+418	    New-ItemProperty -Path $SurfaceRegKey -Name OwnershipSessionId -PropertyType String -Value $ownerSessionIdValue | Out-Null
+419	}
+420	Else
+421	{
+422	    Set-ItemProperty -Path $SurfaceRegKey -Name OwnershipSessionId -Value $ownerSessionIdValue
+423	}
+424	
+425	If ($PermissionSessionIdRegValue -eq $null)
+426	{
+427	    New-ItemProperty -Path $SurfaceRegKey -Name PermissionSessionId -PropertyType String -Value $permissionSessionIdValue | Out-Null
+428	}
+429	Else
+430	{
+431	    Set-ItemProperty -Path $SurfaceRegKey -Name PermissionSessionId -Value $permissionSessionIdValue
+432	}
+433	
+434	If ($SettingsSessionIdRegValue -eq $null)
+435	{
+436	    New-ItemProperty -Path $SurfaceRegKey -Name SettingsSessionId -PropertyType String -Value $settingsSessionIdValue | Out-Null
+437	}
+438	Else
+439	{
+440	    Set-ItemProperty -Path $SurfaceRegKey -Name SettingsSessionId -Value $settingsSessionIdValue
+441	}
+442	
+443	If ($IsResetRegValue -eq $null)
+444	{
+445	    New-ItemProperty -Path $SurfaceRegKey -Name IsReset -PropertyType DWORD -Value 0 | Out-Null
+446	}
+447	Else
+448	{
+449	    Set-ItemProperty -Path $SurfaceRegKey -Name IsReset -Value 0
+450	}
+451	
+452	If ($certUsedRegValue -eq $null)
+453	{
+454	    New-ItemProperty -Path $SurfaceRegKey -Name CertName -PropertyType String -Value $certName | Out-Null
+455	}
+456	Else
+457	{
+458	    Set-ItemProperty -Path $SurfaceRegKey -Name CertName -Value $certName
+459	}
+460	
+461	If ($certIssuerRegValue -eq $null)
+462	{
+463	    New-ItemProperty -Path $SurfaceRegKey -Name CertIssuer -PropertyType String -Value $certIssuer | Out-Null
+464	}
+465	Else
+466	{
+467	    Set-ItemProperty -Path $SurfaceRegKey -Name CertIssuer -Value $certIssuer
+468	}
+469	
+470	If ($certSubjectRegValue -eq $null)
+471	{
+472	    New-ItemProperty -Path $SurfaceRegKey -Name CertSubject -PropertyType String -Value $certSubject | Out-Null
+473	}
+474	Else
+475	{
+476	    Set-ItemProperty -Path $SurfaceRegKey -Name CertSubject -Value $certSubject
+477	}
 ```
 
 ### Settings names and IDs
 
-To configure Surface UEFI settings or permissions for Surface UEFI settings, you must refer to each setting by either its setting name or setting ID. With each new update for Surface UEFI, new settings may be added. The best way to get a complete list of the settings available on a Surface device, along with the settings name and settings IDs, is to use the ShowSettingsOptions.ps1 script from SEMM_Powershell.zip in [Surface Tools for IT Downloads](https://www.microsoft.com/en-us/download/details.aspx?id=46703) 
+To configure Surface UEFI settings or permissions for Surface UEFI settings, you must refer to each setting by either its setting name or setting ID. With each new update for Surface UEFI, new settings may be added. The best way to get a complete list of the settings available on a Surface device, along with the settings name and settings IDs, is to use the ShowSettingsOptions.ps1 script from SEMM_Powershell.zip in [Surface Tools for IT Downloads](https://www.microsoft.com/download/details.aspx?id=46703) 
 
 The computer where ShowSettingsOptions.ps1 is run must have Microsoft Surface UEFI Manager installed, but the script does not require a Surface device.
 
-The following tables show the available settings for Surface Pro 4 and Surface Book:
+The following tables show the available settings for Surface Pro 4 and later including Surface Pro 7, Surface Book, Surface Laptop 3, and Surface Go. 
 
 *Table 1. Surface UEFI settings for Surface Pro 4*
 
@@ -332,11 +443,11 @@ After your scripts are prepared to configure and enable SEMM on the client devic
 * ResetSEMM.ps1
 * Your SEMM certificate (for example SEMMCertificate.pfx)
 
-The SEMM Configuration Manager scripts will be added to Configuration Manager as a script application. The command to install SEMM with ConfigureSEMM.ps1 is:
+The SEMM Configuration Manager scripts will be added to Configuration Manager as a script application. The command to install SEMM with ConfigureSEMM.ps1 is as follows.
 
 `Powershell.exe -file ".\ConfigureSEMM.ps1"`
 
-The command to uninstall SEMM with ResetSEMM.ps1 is:
+The command to uninstall SEMM with ResetSEMM.ps1 is as follows.
 
 `Powershell.exe -file ".\ResetSEMM.ps1"`
 
@@ -346,82 +457,82 @@ To add the SEMM Configuration Manager scripts to Configuration Manager as an app
 
 2. Proceed through The Create Application Wizard as follows:
 
-   - **General** – Select **Manually specify the application information**, and then click **Next**.
+   - **General** – Select **Manually specify the application information**, and then select **Next**.
 
-   - **General Information** – Enter a name for the application (for example SEMM) and any other information you want such as publisher, version, or comments on this page. Click **Next** to proceed.
+   - **General Information** – Enter a name for the application (for example SEMM) and any other information you want such as publisher, version, or comments on this page. Select **Next** to proceed.
 
-   - **Application Catalog** – The fields on this page can be left with their default values. Click **Next**.
+   - **Application Catalog** – The fields on this page can be left with their default values. Select **Next**.
 
-   - **Deployment Types** – Click **Add** to start the Create Deployment Type Wizard.
+   - **Deployment Types** – Select **Add** to start the Create Deployment Type Wizard.
 
    - Proceed through the steps of the Create Deployment Type Wizard, as follows:
 
-     * **General** – Click **Script Installer** from the **Type** drop-down menu. The **Manually specify the deployment type information** option will automatically be selected. Click **Next** to proceed.
-     * **General Information** – Enter a name for the deployment type (for example SEMM Configuration Scripts), and then click **Next** to continue.
-     * **Content** – Click **Browse** next to the **Content Location** field, and then click the folder where your SEMM Configuration Manager scripts are located. In the **Installation Program** field, type the [installation command](#deploy-semm-configuration-manager-scripts) found earlier in this article. In the **Uninstall Program** field, enter the [uninstallation command](#deploy-semm-configuration-manager-scripts) found earlier in this article (shown in Figure 2). Click **Next** to move to the next page.
+     * **General** – Select **Script Installer** from the **Type** drop-down menu. The **Manually specify the deployment type information** option will automatically be selected. Select **Next** to proceed.
+     * **General Information** – Enter a name for the deployment type (for example SEMM Configuration Scripts), and then select **Next** to continue.
+     * **Content** – Select **Browse** next to the **Content Location** field, and then select the folder where your SEMM Configuration Manager scripts are located. In the **Installation Program** field, type the [installation command](#deploy-semm-configuration-manager-scripts) found earlier in this article. In the **Uninstall Program** field, enter the [uninstallation command](#deploy-semm-configuration-manager-scripts) found earlier in this article (shown in Figure 2). Select **Next** to move to the next page.
     
      ![Set the SEMM Configuration Manager scripts as the install and uninstall commands](images/config-mgr-semm-fig2.png "Set the SEMM Configuration Manager scripts as the install and uninstall commands")
 
      *Figure 2. Set the SEMM Configuration Manager scripts as the install and uninstall commands*
 
-     * **Detection Method** – Click **Add Clause** to add the SEMM Configuration Manager script registry key detection rule. The **Detection Rule** window is displayed, as shown in Figure 3. Use the following settings:
+     * **Detection Method** – Select **Add Clause** to add the SEMM Configuration Manager script registry key detection rule. The **Detection Rule** window is displayed, as shown in Figure 3. Use the following settings:
 
-       - Click **Registry** from the **Setting Type** drop-down menu.
-       - Click **HKEY_LOCAL_MACHINE** from the **Hive** drop-down menu.
+       - Select **Registry** from the **Setting Type** drop-down menu.
+       - Select **HKEY_LOCAL_MACHINE** from the **Hive** drop-down menu.
        - Enter **SOFTWARE\Microsoft\Surface\SEMM** in the **Key** field.
        - Enter **Enabled_Version1000** in the **Value** field.
-       - Click **String** from the **Data Type** drop-down menu.
-       - Click the **This registry setting must satisfy the following rule to indicate the presence of this application** button.
+       - Select **String** from the **Data Type** drop-down menu.
+       - Select the **This registry setting must satisfy the following rule to indicate the presence of this application** button.
        - Enter **1** in the **Value** field.
-       - Click **OK** to close the **Detection Rule** window.
+       - Select **OK** to close the **Detection Rule** window.
 
      ![Use a registry key to identify devices enrolled in SEMM](images/config-mgr-semm-fig3.png "Use a registry key to identify devices enrolled in SEMM")
      
      *Figure 3. Use a registry key to identify devices enrolled in SEMM*
 
-     * Click **Next** to proceed to the next page.
+     * Select **Next** to proceed to the next page.
      
-     * **User Experience** – Click **Install for system** from the **Installation Behavior** drop-down menu. If you want your users to record and enter the certificate thumbprint themselves, leave the logon requirement set to **Only when a user is logged on**. If you want your administrators to enter the thumbprint for users and the users do not need to see the thumbprint, click **Whether or not a user is logged on** from the **Logon Requirement** drop-down menu.
+     * **User Experience** – Select **Install for system** from the **Installation Behavior** drop-down menu. If you want your users to record and enter the certificate thumbprint themselves, leave the logon requirement set to **Only when a user is logged on**. If you want your administrators to enter the thumbprint for users and the users do not need to see the thumbprint, select **Whether or not a user is logged on** from the **Logon Requirement** drop-down menu.
 
-     * **Requirements** – The ConfigureSEMM.ps1 script automatically verifies that the device is a Surface device before attempting to enable SEMM. However, if you intend to deploy this script application to a collection with devices other than those to be managed with SEMM, you could add requirements here to ensure this application would run only on Surface devices or devices you intend to manage with SEMM. Click **Next** to continue.
+     * **Requirements** – The ConfigureSEMM.ps1 script automatically verifies that the device is a Surface device before attempting to enable SEMM. However, if you intend to deploy this script application to a collection with devices other than those to be managed with SEMM, you could add requirements here to ensure this application would run only on Surface devices or devices you intend to manage with SEMM. Select **Next** to continue.
      
-     * **Dependencies** – Click **Add** to open the **Add Dependency** window.
+     * **Dependencies** – Select **Add** to open the **Add Dependency** window.
 
-       * Click **Add** to open the **Specify Required Application** window.
+       * Select **Add** to open the **Specify Required Application** window.
 
           - Enter a name for the SEMM dependencies in the **Dependency Group Name** field (for example, *SEMM Assemblies*).
 
-          - Click **Microsoft Surface UEFI Manager** from the list of **Available Applications** and the MSI deployment type, and then click **OK** to close the **Specify Required Application** window.
+          - Select **Microsoft Surface UEFI Manager** from the list of **Available Applications** and the MSI deployment type, and then select **OK** to close the **Specify Required Application** window.
           
-        *	Keep the **Auto Install** check box selected if you want Microsoft Surface UEFI Manager installed automatically on devices when you attempt to enable SEMM with the Configuration Manager scripts. Click **OK** to close the **Add Dependency** window.
+         *   Keep the **Auto Install** check box selected if you want Microsoft Surface UEFI Manager installed automatically on devices when you attempt to enable SEMM with the Configuration Manager scripts. Select **OK** to close the **Add Dependency** window.
 
-     * Click **Next** to proceed.
+     * Select **Next** to proceed.
      
-     * **Summary** – The information you have entered throughout the Create Deployment Type wizard is displayed on this page. Click **Next** to confirm your selections.
+     * **Summary** – The information you have entered throughout the Create Deployment Type wizard is displayed on this page. Select **Next** to confirm your selections.
      
      * **Progress** – A progress bar and status as the deployment type is added for the SEMM script application is displayed on this page.
      
-     * **Completion** – Confirmation of the deployment type creation is displayed when the process is complete. Click **Close** to finish the Create Deployment Type Wizard.
+     * **Completion** – Confirmation of the deployment type creation is displayed when the process is complete. Select **Close** to finish the Create Deployment Type Wizard.
 
-   * **Summary** – The information that you entered throughout the Create Application Wizard is displayed. Click **Next** to create the application.
+   - **Summary** – The information that you entered throughout the Create Application Wizard is displayed. Select **Next** to create the application.
 
-   * **Progress** – A progress bar and status as the application is added to the Software Library is displayed on this page.
+   - **Progress** – A progress bar and status as the application is added to the Software Library is displayed on this page.
 
-   * **Completion** – Confirmation of the successful application creation is displayed when the application creation process is complete. Click **Close** to finish the Create Application Wizard.
+   - **Completion** – Confirmation of the successful application creation is displayed when the application creation process is complete. Select **Close** to finish the Create Application Wizard.
 
 After the script application is available in the Software Library of Configuration Manager, you can distribute and deploy SEMM using the scripts you prepared to devices or collections. If you have configured the Microsoft Surface UEFI Manager assemblies as a dependency that will be automatically installed, you can deploy SEMM in a single step. If you have not configured the assemblies as a dependency, they must be installed on the devices you intend to manage before you enable SEMM.
 
 When you deploy SEMM using this script application and with a configuration that is visible to the end user, the PowerShell script will start and the thumbprint for the certificate will be displayed by the PowerShell window. You can have your users record this thumbprint and enter it when prompted by Surface UEFI after the device reboots.
 
-Alternatively, you can configure the application installation to reboot automatically and to install invisibly to the user – in this scenario, a technician will be required to enter the thumbprint on each device as it reboots. Any technician with access to the certificate file can read the thumbprint by viewing the certificate with CertMgr. Instructions for viewing the thumbprint with CertMgr are in the [Create or modify the SEMM Configuration Manager scripts](#create-or-modify-the-semm-configuration-manager-scripts) section of this article.
+Alternatively, you can configure the application installation to reboot automatically and to install invisibly to the user. In this scenario, a technician will be required to enter the thumbprint on each device as it reboots. Any technician with access to the certificate file can read the thumbprint by viewing the certificate with CertMgr. Instructions for viewing the thumbprint with CertMgr are in the [Create or modify the SEMM Configuration Manager scripts](#create-or-modify-the-semm-configuration-manager-scripts) section of this article.
 
 Removal of SEMM from a device deployed with Configuration Manager using these scripts is as easy as uninstalling the application with Configuration Manager. This action starts the ResetSEMM.ps1 script and properly unenrolls the device with the same certificate file that was used during the deployment of SEMM.
 
->[!NOTE]
->Microsoft Surface recommends that you create reset packages only when you need to unenroll a device. These reset packages are typically valid for only one device, identified by its serial number. You can, however, create a universal reset package that would work for any device enrolled in SEMM with this certificate.
-
->We strongly recommend that you protect your universal reset package as carefully as the certificate you used to enroll devices in SEMM. Please remember that – just like the certificate itself – this universal reset package can be used to unenroll any of your organization’s Surface devices from SEMM.
-
->When you install a reset package, the Lowest Supported Value (LSV) is reset to a value of 1. You can reenroll a device by using an existing configuration package – the device will prompt for the certificate thumbprint before ownership is taken.
-
->For this reason, the reenrollment of a device in SEMM would require a new package to be created and installed on that device. Because this action is a new enrollment and not a change in configuration on a device already enrolled in SEMM, the device will prompt for the certificate thumbprint before ownership is taken.
+> [!NOTE]
+> Microsoft Surface recommends that you create reset packages only when you need to unenroll a device. These reset packages are typically valid for only one device, identified by its serial number. You can, however, create a universal reset package that would work for any device enrolled in SEMM with this certificate.
+> 
+> We strongly recommend that you protect your universal reset package as carefully as the certificate you used to enroll devices in SEMM. Please remember that, just like the certificate itself, this universal reset package can be used to unenroll any of your organization’s Surface devices from SEMM.
+> 
+> When you install a reset package, the Lowest Supported Value (LSV) is reset to a value of 1. You can reenroll a device by using an existing configuration package. The device will prompt for the certificate thumbprint before ownership is taken.
+> 
+> For this reason, the reenrollment of a device in SEMM would require a new package to be created and installed on that device. Because this action is a new enrollment and not a change in configuration on a device already enrolled in SEMM, the device will prompt for the certificate thumbprint before ownership is taken.
diff --git a/devices/surface/using-the-sda-deployment-share.md b/devices/surface/using-the-sda-deployment-share.md
index 75bb5c6f65..20ad4f6903 100644
--- a/devices/surface/using-the-sda-deployment-share.md
+++ b/devices/surface/using-the-sda-deployment-share.md
@@ -6,10 +6,14 @@ ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: Scottmca
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 10/16/2017
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 10/21/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Using the Microsoft Surface Deployment Accelerator deployment share
@@ -18,6 +22,9 @@ With Microsoft Surface Deployment Accelerator (SDA), you can quickly and easily
 
 For more information about SDA and information on how to download SDA, see [Microsoft Surface Deployment Accelerator (SDA)](https://technet.microsoft.com/itpro/surface/microsoft-surface-deployment-accelerator).
 
+> [!NOTE]
+> SDA is not supported on Surface Pro 7, Surface Pro X, and Surface Laptop 3. For more information refer to [Deploy Surface devices](deploy.md).
+
 Using SDA provides these primary benefits:
 
 * With SDA, you can create a ready-to-deploy environment that can deploy to target devices as fast as your download speeds allow. The wizard experience enables you to check a few boxes and then the automated process builds your deployment environment for you.
@@ -82,16 +89,16 @@ To import drivers for a peripheral device:
 
 6. Click **Import Drivers** to start the Import Drivers Wizard, as shown in Figure 1.
 
-  ![Provide the location of your driver files](images\using-sda-driverfiles-fig1.png "Provide the location of your driver files")
+   ![Provide the location of your driver files](images/using-sda-driverfiles-fig1.png "Provide the location of your driver files")
   
-  *Figure 1. Provide the location of your driver files*
+   *Figure 1. Provide the location of your driver files*
 
 7. The Import Drivers Wizard presents a series of steps:
 
-  - **Specify Directory** – Click **Browse** and navigate to the folder where you stored the drivers in Step 1.
-  - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
-  - **Progress** – While the drivers are imported, a progress bar is displayed on this page.
-  - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Drivers Wizard.
+   - **Specify Directory** – Click **Browse** and navigate to the folder where you stored the drivers in Step 1.
+   - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
+   - **Progress** – While the drivers are imported, a progress bar is displayed on this page.
+   - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the Import Drivers Wizard.
 
 8. Repeat Steps 5-7 for each Surface model on which you would like to include this driver.
 
@@ -108,54 +115,54 @@ As with drivers, the SDA deployment share can be pre-configured with apps like t
 
 In the previous example for including drivers for a POS system, you would also need to include POS software for processing transactions and recording the input from the barcode scanner and credit card reader. To import an application and prepare it for installation on your Surface devices during Windows deployment:
 
-1.	Download the application installation files or locate the installation media for your application.
+1. Download the application installation files or locate the installation media for your application.
 
-2.	Determine the command line instruction for silent installation, usually provided by the developer of the application. For Windows Installer files (.msi), see [Standard Installer Command-Line Options](https://msdn.microsoft.com/library/windows/desktop/aa372024) in the Windows Dev Center.
+2. Determine the command line instruction for silent installation, usually provided by the developer of the application. For Windows Installer files (.msi), see [Standard Installer Command-Line Options](https://msdn.microsoft.com/library/windows/desktop/aa372024) in the Windows Dev Center.
 
-3.	Open the MDT Deployment Workbench.
+3. Open the MDT Deployment Workbench.
 
-4.	Expand the **Deployment Shares** node and expand the SDA deployment share.
+4. Expand the **Deployment Shares** node and expand the SDA deployment share.
 
-5.	Expand the **Applications** folder.
+5. Expand the **Applications** folder.
 
-6.	Click **New Application** to start the New Application Wizard, as shown in Figure 2.
+6. Click **New Application** to start the New Application Wizard, as shown in Figure 2.
 
-  ![Provide the command to install your application](images\using-sda-installcommand-fig2.png "Provide the command to install your application")
+   ![Provide the command to install your application](images/using-sda-installcommand-fig2.png "Provide the command to install your application")
   
-  *Figure 2: Provide the command to install your application*
+   *Figure 2: Provide the command to install your application*
 
-7.	Follow the steps of the New Application Wizard:
+7. Follow the steps of the New Application Wizard:
 
-  - **Application Type** – Click **Application with Source Files**, and then click **Next**.
-  - **Details** – Enter a name for the application in the **Application Name** field. Enter publisher, version, and language information in the **Publisher**, **Version**, and **Language** fields if desired. Click **Next**.
-  - **Source** – Click **Browse** to navigate to and select the folder with the application installation files procured in Step 1, and then click **Next**.
-  - **Destination** – Enter a name for the folder where the application files will be stored in the **Specify the Name of the Directory that Should Be Created** field or click **Next** to accept the default name.
-  - **Command Details** – Enter the silent command-line instruction, for example `setup.msi /quiet /norestart`
-  - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
-  - **Progress** – While the installation files are imported, a progress bar is displayed on this page.
-  - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Application Wizard.
+   - **Application Type** – Click **Application with Source Files**, and then click **Next**.
+   - **Details** – Enter a name for the application in the **Application Name** field. Enter publisher, version, and language information in the **Publisher**, **Version**, and **Language** fields if desired. Click **Next**.
+   - **Source** – Click **Browse** to navigate to and select the folder with the application installation files procured in Step 1, and then click **Next**.
+   - **Destination** – Enter a name for the folder where the application files will be stored in the **Specify the Name of the Directory that Should Be Created** field or click **Next** to accept the default name.
+   - **Command Details** – Enter the silent command-line instruction, for example `setup.msi /quiet /norestart`
+   - **Summary** – Review the specified configuration on this page before you click **Next** to begin the import process.
+   - **Progress** – While the installation files are imported, a progress bar is displayed on this page.
+   - **Confirmation** – When the import process completes, the success of the process is displayed on this page. Click **Finish** to complete the New Application Wizard.
 
-8.	Click the **Task Sequences** folder, right-click **1 - Deploy Microsoft Surface**, and then click **Properties**.
+8. Click the **Task Sequences** folder, right-click **1 - Deploy Microsoft Surface**, and then click **Properties**.
 
-9.	Click the **Task Sequence** tab to view the steps that are included in the new task sequence.
+9. Click the **Task Sequence** tab to view the steps that are included in the new task sequence.
 
-10.	Select the **Windows Update (Pre-Application Installation)** step, and then click **Add**.
+10. Select the **Windows Update (Pre-Application Installation)** step, and then click **Add**.
 
-11.	Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3.
+11. Hover the mouse over **General** under the **Add** menu, and then click **Install Application**. This will add a new step after the selected step for the installation of a specific application as shown in Figure 3.
 
-  ![A new Install Application step for Sample POS App](images\using-sda-newinstall-fig3.png "A new Install Application step for Sample POS App")
+    ![A new Install Application step for Sample POS App](images/using-sda-newinstall-fig3.png "A new Install Application step for Sample POS App")
   
-  *Figure 3. A new Install Application step for Sample POS App*
+    *Figure 3. A new Install Application step for Sample POS App*
 
-12.	On the **Properties** tab of the new **Install Application** step, enter **Install - Sample POS App** in the **Name** field, where *Sample POS App* is the name of your app.
+12. On the **Properties** tab of the new **Install Application** step, enter **Install - Sample POS App** in the **Name** field, where *Sample POS App* is the name of your app.
 
-13.	Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share.
+13. Click **Install a Single Application**, and then click **Browse** to view available applications that have been imported into the deployment share.
 
-14.	Select your app from the list of applications, and then click **OK**.
+14. Select your app from the list of applications, and then click **OK**.
 
-15.	Click **OK** to close the task sequence properties.
+15. Click **OK** to close the task sequence properties.
 
-16.	Close the Deployment Workbench.
+16. Close the Deployment Workbench.
 
 ## Work with existing deployment shares
 
diff --git a/devices/surface/wake-on-lan-for-surface-devices.md b/devices/surface/wake-on-lan-for-surface-devices.md
index 907ab49ce6..53ff389c02 100644
--- a/devices/surface/wake-on-lan-for-surface-devices.md
+++ b/devices/surface/wake-on-lan-for-surface-devices.md
@@ -6,15 +6,19 @@ ms.prod: w10
 ms.mktglfcycl: manage
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: brecords
-ms.author: jdecker
+ms.localizationpriority: medium
+author: dansimp
+ms.author: dansimp
 ms.topic: article
-ms.date: 01/03/2018
+ms.date: 12/30/2019
+ms.reviewer: scottmca
+manager: dansimp
+ms.audience: itpro
 ---
 
 # Wake On LAN for Surface devices
 
-Surface devices that run Windows 10, version 1607 (also known as Windows 10 Anniversary Update) or later and use a Surface Ethernet adapter to connect to a wired network, are capable of Wake On LAN (WOL) from Connected Standby. With WOL, you can remotely wake up devices to perform management or maintenance tasks or enable management solutions (such as System Center Configuration Manager) automatically. For example, you can deploy applications to Surface devices left docked with a Surface Dock or Surface Pro 3 Docking Station by using System Center Configuration Manager during a window in the middle of the night, when the office is empty.
+Surface devices that run Windows 10, version 1607 (also known as Windows 10 Anniversary Update) or later and use a Surface Ethernet adapter to connect to a wired network, are capable of Wake On LAN (WOL) from Connected Standby. With WOL, you can remotely wake up devices to perform management or maintenance tasks or enable management solutions (such as Microsoft Endpoint Configuration Manager) automatically. For example, you can deploy applications to Surface devices left docked with a Surface Dock or Surface Pro 3 Docking Station by using Microsoft Endpoint Configuration Manager during a window in the middle of the night, when the office is empty.
 
 >[!NOTE]
 >Surface devices must be connected to AC power and in Connected Standby (Sleep) to support WOL. WOL is not possible from devices that are in hibernation or powered off.
@@ -39,22 +43,45 @@ The following devices are supported for WOL:
 * Surface Laptop 2
 * Surface Go
 * Surface Go with LTE Advanced
+* Surface Studio 2 (see Surface Studio 2 instructions below)
+* Surface Pro 7
+* Surface Laptop 3
 
 ## WOL driver
 
 To enable WOL support on Surface devices, a specific driver for the Surface Ethernet adapter is required. This driver is not included in the standard driver and firmware pack for Surface devices – you must download and install it separately. You can download the Surface WOL driver (SurfaceWOL.msi) from the [Surface Tools for IT](https://www.microsoft.com/download/details.aspx?id=46703) page in the Microsoft Download Center.
 
-You can run this Microsoft Windows Installer (.msi) file on a Surface device to install the Surface WOL driver, or you can distribute it to Surface devices with an application deployment solution, such as System Center Configuration Manager. To include the Surface WOL driver during deployment, you can install the .msi file as an application during the deployment process. You can also extract the Surface WOL driver files to include them in the deployment process. For example, you can include them in your Microsoft Deployment Toolkit (MDT) deployment share. You can read more about Surface deployment with MDT in [Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/surface/deploy-windows-10-to-surface-devices-with-mdt).
+You can run this Microsoft Windows Installer (.msi) file on a Surface device to install the Surface WOL driver, or you can distribute it to Surface devices with an application deployment solution, such as Microsoft Endpoint Configuration Manager. To include the Surface WOL driver during deployment, you can install the .msi file as an application during the deployment process. You can also extract the Surface WOL driver files to include them in the deployment process. For example, you can include them in your Microsoft Deployment Toolkit (MDT) deployment share. You can read more about Surface deployment with MDT in [Deploy Windows 10 to Surface devices with Microsoft Deployment Toolkit](https://technet.microsoft.com/itpro/surface/deploy-windows-10-to-surface-devices-with-mdt).
 
->[!NOTE]
->During the installation of SurfaceWOL.msi, the following registry key is set to a value of 1, which allows easy identification of systems where the WOL driver has been installed. If you chose to extract and install these drivers separately during deployment, this registry key will not be configured and must be configured manually or with a script.
-
->**HKLM\SYSTEM\CurrentControlSet\Control\Power AllowSystemRequiredPowerRequests** 
+> [!NOTE]
+> During the installation of SurfaceWOL.msi, the following registry key is set to a value of 1, which allows easy identification of systems where the WOL driver has been installed. If you chose to extract and install these drivers separately during deployment, this registry key will not be configured and must be configured manually or with a script.
+> 
+> **HKLM\SYSTEM\CurrentControlSet\Control\Power AllowSystemRequiredPowerRequests** 
 
 To extract the contents of SurfaceWOL.msi, use the MSIExec administrative installation option (**/a**), as shown in the following example, to extract the contents to the C:\WOL\ folder:
 
    `msiexec /a surfacewol.msi targetdir=C:\WOL /qn`
 
+## Surface Studio 2 instructions
+
+To enable WOL on Surface Studio 2, you must use the following procedure
+
+1. Create the following registry keys:
+
+   ```console
+   ; Set CONNECTIVITYINSTANDBY to 1:
+   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power\PowerSettings\F15576E8-98B7-4186-B944-EAFA664402D9]
+   "Attributes"=dword:00000001
+   ; Set EnforceDisconnectedStandby to 0 and AllowSystemRequiredPowerRequests to 1:
+   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power]
+   "EnforceDisconnectedStandby"=dword:00000000
+   "AllowSystemRequiredPowerRequests"=dword:00000001
+   ```
+
+2. Run the following command
+
+    ```powercfg /SETACVALUEINDEX SCHEME_BALANCED SUB_NONE CONNECTIVITYINSTANDBY 1```
+
 ## Using Surface WOL
 
 The Surface WOL driver conforms to the WOL standard, whereby the device is woken by a special network communication known as a magic packet. The magic packet consists of 6 bytes of 255 (or FF in hexadecimal) followed by 16 repetitions of the target computer’s MAC address. You can read more about the magic packet and the WOL standard on [Wikipedia](https://wikipedia.org/wiki/Wake-on-LAN#Magic_packet).
@@ -62,7 +89,7 @@ The Surface WOL driver conforms to the WOL standard, whereby the device is woken
 >[!NOTE]
 >To send a magic packet and wake up a device by using WOL, you must know the MAC address of the target device and Ethernet adapter. Because the magic packet does not use the IP network protocol, it is not possible to use the IP address or DNS name of the device.
 
-Many management solutions, such as System Center Configuration Manager, provide built-in support for WOL. There are also many solutions, including Microsoft Store apps, PowerShell modules, third-party applications, and third-party management solutions that allow you to send a magic packet to wake up a device. For example, you can use the [Wake On LAN PowerShell module](https://gallery.technet.microsoft.com/scriptcenter/Wake-On-Lan-815424c4) from the TechNet Script Center. 
+Many management solutions, such as Configuration Manager, provide built-in support for WOL. There are also many solutions, including Microsoft Store apps, PowerShell modules, third-party applications, and third-party management solutions that allow you to send a magic packet to wake up a device. For example, you can use the [Wake On LAN PowerShell module](https://gallery.technet.microsoft.com/scriptcenter/Wake-On-Lan-815424c4) from the TechNet Script Center. 
 
 >[!NOTE]
 >After a device has been woken up with a magic packet, the device will return to sleep if an application is not actively preventing sleep on the system or if the AllowSystemRequiredPowerRequests registry key is not configured to 1, which allows applications to prevent sleep. See the [WOL driver](#wol-driver) section of this article for more information about this registry key.
diff --git a/devices/surface/windows-autopilot-and-surface-devices.md b/devices/surface/windows-autopilot-and-surface-devices.md
index baef69db7c..36283c8d84 100644
--- a/devices/surface/windows-autopilot-and-surface-devices.md
+++ b/devices/surface/windows-autopilot-and-surface-devices.md
@@ -1,60 +1,58 @@
 ---
-title: Windows Autopilot and Surface Devices (Surface)
+title: Windows Autopilot and Surface devices
+ms.reviewer: 
+manager: dansimp
 description: Find out about Windows Autopilot deployment options for Surface devices.
 keywords: autopilot, windows 10, surface, deployment
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.pagetype: surface, devices
 ms.sitesec: library
-author: brecords
-ms.date: 09/12/2018
-ms.author: jdecker
+author: dansimp
+ms.author: dansimp
 ms.topic: article
+ms.localizationpriority: medium
+ms.audience: itpro
+ms.date: 11/26/2019
 ---
 
 # Windows Autopilot and Surface devices
 
-Windows Autopilot is a cloud-based deployment technology available in Windows 10. Using Windows Autopilot, you can remotely deploy and configure devices in a truly zero-touch process right out of the box. Windows Autopilot registered devices are identified over the internet at first boot using a unique device signature, known as the hardware hash, and automatically enrolled and configured using modern management solutions such as Azure Active Directory (AAD) and Mobile Device Management (MDM). 
+Windows Autopilot is a cloud-based deployment technology in Windows 10. You can use Windows Autopilot to remotely deploy and configure devices in a zero-touch process right out of the box.
 
-With Surface devices, you can choose to register your devices at the time of purchase when purchasing from a Surface partner enabled for Windows Autopilot. New devices can be shipped directly to your end-users and will be automatically enrolled and configured when the units are unboxed and turned on for the first time. This process can eliminate need to reimage your devices as part of your deployment process, reducing the work required of your deployment staff and opening up new, agile methods for device management and distribution.
+Windows Autopilot-registered devices are identified over the Internet at first startup through a unique device signature that's called a *hardware hash*. They're automatically enrolled and configured by using modern management solutions such as Azure Active Directory (Azure AD) and mobile device management.
 
-In this article learn how to enroll your Surface devices in Windows Autopilot with a Surface partner and the options and considerations you will need to know along the way. This article focuses specifically on Surface devices, for more information about using Windows Autopilot with other devices, or to read more about Windows Autopilot and its capabilities, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot) in the Windows Docs Library.
+You can register Surface devices at the time of purchase from a Surface partner that's enabled for Windows Autopilot. These partners can ship new devices directly to your users. The devices will be automatically enrolled and configured when they are first turned on. This process eliminates reimaging during deployment, which lets you implement new, agile methods of device management and distribution.
 
-## Prerequisites
-Enrollment of Surface devices in Windows Autopilot with a Surface partner enabled for Windows Autopilot has the following licensing requirements for each enrolled Surface device:
-* **Azure Active Directory Premium** – Required to enroll your devices in your organization and to automatically enroll devices in your organization’s mobile management solution.
-* **Mobile Device Management (such as Microsoft Intune)** – Required to remotely deploy applications, configure, and manage your enrolled devices.
-* **Office 365 ProPlus** – Required to deploy Microsoft Office to your enrolled devices.
+## Modern management
+Autopilot is the recommended deployment option for Surface devices, including Surface Pro 7, Surface Laptop 3, and Surface Pro X, which is specifically designed for deployment through Autopilot.
 
-These requirements are also met by the following solutions:
-* Microsoft 365 E3 or E5 (includes Azure Active Directory Premium, Microsoft Intune, and Office 365 ProPlus)
+ It's best to enroll your Surface devices with the help of a Microsoft Cloud Solution Provider. This step allows you to manage UEFI firmware settings on Surface directly from Intune. It eliminates the need to physically touch devices for certificate management. See [Intune management of Surface UEFI settings](surface-manage-dfci-guide.md) for details.
 
-Or
-* Enterprise Mobility + Security E3 or E5 (includes Azure Active Directory Premium and Microsoft Intune)
-* Office 365 ProPlus, E3, or E5 (includes Office 365 ProPlus)
+## Windows version considerations
+Broad deployment of Surface devices through Windows Autopilot, including enrollment by Surface partners at the time of purchase, requires Windows 10 Version 1709 (Fall Creators Update) or later.
 
->[!NOTE]
->Deployment of devices using Windows Autopilot to complete the Out-of-Box Experience (OOBE) is supported without these prerequisites, however will yield deployed devices without applications, configuration, or enrollment in a management solution and is highly discouraged.
-
-### Windows version considerations
-Support for broad deployments of Surface devices using Windows Autopilot, including enrollment performed by Surface partners at the time of purchase, requires devices manufactured with or otherwise installed with Windows 10 Version 1709 (Fall Creators Update). Windows 10 Version 1709 uses a secure 4096-bit (4k) hash value to uniquely identify devices for Windows Autopilot that is necessary for deployments at scale.
-
-### Surface device support
-Surface devices with support for out-of-box deployment with Windows Autopilot, enrolled during the purchase process with a Surface partner, include the following devices, where the devices ship from the factory with Windows 10 Version 1709:
-* Surface Pro (Model 1796)
-* Surface Book 2
-* Surface Laptop
-* Surface Studio
-* Surface Go
+These Windows versions support a 4,000-byte (4k) hash value that uniquely identifies devices for Windows Autopilot, which is necessary for deployments at scale. All new Surface devices, including Surface Pro 7, Surface Pro X, and Surface Laptop 3, ship with Windows 10 Version 1903 or later.
 
 ## Surface partners enabled for Windows Autopilot
-Enrolling Surface devices in Windows Autopilot at the time of purchase is a capability provided by select Surface partners that are enabled with the capability to identify individual Surface devices during the purchase process and perform enrollment on an organization’s behalf. Devices enrolled by a Surface partner at time of purchase can be shipped directly to users and configured entirely through the zero-touch process of Windows Autopilot, Azure Active Directory, and Mobile Device Management.
 
-When you purchase Surface devices from a Surface partner enabled for Windows Autopilot, your new devices can be enrolled in your Windows Autopilot deployment for you by the partner. Surface partners enabled for Windows Autopilot include: 
+Select Surface partners can enroll Surface devices in Windows Autopilot for you at the time of purchase. They can also ship enrolled devices directly to your users. The devices can be configured entirely through a zero-touch process by using Windows Autopilot, Azure AD, and mobile device management.
 
+Surface partners that are enabled for Windows Autopilot include:
+
+- [ALSO](https://www.also.com/ec/cms5/de_1010/1010_anbieter/microsoft/windows-autopilot/index.jsp) 
 - [Atea](https://www.atea.com/)
+- [Bechtle](https://www.bechtle.com/de-en) 
+- [Cancom](https://www.cancom.de/)
+- [CDW](https://www.cdw.com/)
+- [Computacenter](https://www.computacenter.com/uk)
 - [Connection](https://www.connection.com/brand/microsoft/microsoft-surface) 
 - [Insight](https://www.insight.com/en_US/buy/partner/microsoft/surface/windows-autopilot.html)
 - [SHI](https://www.shi.com/Surface)
+- [Synnex](https://www.synnexcorp.com/us/microsoft/surface-autopilot/)
+- [Techdata](https://www.techdata.com/)
 
-
+## Learn more
+For more information about Windows Autopilot, see:
+- [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot)
+- [Windows Autopilot requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot-requirements)
\ No newline at end of file
diff --git a/education/developers.yml b/education/developers.yml
new file mode 100644
index 0000000000..9e21b6d27f
--- /dev/null
+++ b/education/developers.yml
@@ -0,0 +1,33 @@
+### YamlMime:Hub
+
+title: Microsoft 365 Education Documentation for developers
+summary: Are you an app developer looking for information about developing solutions on Microsoft Education products? Start here.
+
+metadata:
+  title: Microsoft 365 Education Documentation for developers
+  description: Are you an app developer looking for information about developing solutions on Microsoft Education products? Start here.
+  ms.service: help
+  ms.topic: hub-page
+  author: LaurenMoynihan
+  ms.author: v-lamoyn
+  ms.date: 10/24/2019
+
+additionalContent:
+  sections:
+    - items:
+        # Card
+        - title: UWP apps for education
+          summary: Learn how to write universal apps for education.
+          url: https://docs.microsoft.com/en-us/windows/uwp/apps-for-education/
+        # Card
+        - title: Take a test API
+          summary: Learn how web applications can use the API to provide a locked down experience for taking tests.
+          url: https://docs.microsoft.com/en-us/windows/uwp/apps-for-education/take-a-test-api
+        # Card
+        - title: Office Education Dev center
+          summary: Integrate with Office 365 across devices and services to extend Microsoft enterprise-scale compliance and security to students, teachers, and staff in your education app
+          url: https://dev.office.com/industry-verticals/edu
+        # Card
+        - title: Data Streamer
+          summary: Bring new STEM experiences into the classroom with real-time data in Excel using Data Streamer. Data Streamer can send data to Excel from a sensor or application.
+          url: https://docs.microsoft.com/en-us/microsoft-365/education/data-streamer
\ No newline at end of file
diff --git a/education/docfx.json b/education/docfx.json
index 87d94a2065..809a2da28f 100644
--- a/education/docfx.json
+++ b/education/docfx.json
@@ -1,39 +1,59 @@
 {
   "build": {
-    "content":
-      [
-        {
-          "files": ["**/**.md", "**/**.yml"],
-          "exclude": ["**/obj/**"]
-        }
-      ],
+    "content": [
+      {
+        "files": [
+          "**/**.md",
+          "**/**.yml"
+        ],
+        "exclude": [
+          "**/obj/**"
+        ]
+      }
+    ],
     "resource": [
-        {
-          "files": ["**/images/**"],
-          "exclude": ["**/obj/**"]
-        }
+      {
+        "files": [
+          "**/*.png",
+          "**/*.jpg",
+          "**/*.svg"
+        ],
+        "exclude": [
+          "**/obj/**"
+        ]
+      }
     ],
     "globalMetadata": {
-		"uhfHeaderId": "MSDocsHeader-WindowsIT", 
-        "ROBOTS": "INDEX, FOLLOW",
-		"ms.author": "celested",
-		"audience": "windows-education",
-		"ms.topic": "article",
-		"breadcrumb_path": "/education/breadcrumb/toc.json",
-        "ms.date": "05/09/2017",
-		"feedback_system": "GitHub",
-		"feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
-		"feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
-        "_op_documentIdPathDepotMapping": {
-          "./": {
-            "depot_name": "Win.education"
-          }
-       }
+      "ROBOTS": "INDEX, FOLLOW",
+      "audience": "windows-education",
+      "ms.topic": "article",
+      "ms.technology": "windows",
+      "manager": "laurawi",
+      "audience": "ITPro",
+      "breadcrumb_path": "/education/breadcrumb/toc.json",
+      "ms.date": "05/09/2017",
+      "feedback_system": "None",
+      "hideEdit": true,
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "Win.education",
+          "folder_relative_path_in_docset": "./"
+        }
+      },
+      "contributors_to_exclude": [ 
+        "rjagiewich", 
+        "traya1", 
+        "rmca14", 
+        "claydetels19", 
+        "Kellylorenebaker",
+        "jborsecnik",
+        "tiburd",
+        "garycentric"
+      ]
     },
-    "externalReference": [
-    ],
+    "externalReference": [],
     "template": "op.html",
     "dest": "education",
-    "markdownEngineName": "dfm"
-  }
+    "markdownEngineName": "markdig"
+}
 }
diff --git a/education/get-started/TOC.md b/education/get-started/TOC.md
deleted file mode 100644
index 20de4cd93d..0000000000
--- a/education/get-started/TOC.md
+++ /dev/null
@@ -1,10 +0,0 @@
-# [Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md)
-## [Set up an Office 365 education tenant](set-up-office365-edu-tenant.md)
-## [Use School Data Sync to import student data](use-school-data-sync.md)
-## [Configure Microsoft Store for Education](configure-microsoft-store-for-education.md)
-## [Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md)
-## [Set up Windows 10 education devices](set-up-windows-10-education-devices.md)
-### [Set up Windows 10 devices using Windows OOBE](set-up-windows-education-devices.md)
-## [Finish Windows 10 device setup and other tasks](finish-setup-and-other-tasks.md)
-# [Change history for Microsoft Education Get Started](change-history-ms-edu-get-started.md)
-
diff --git a/education/get-started/change-history-ms-edu-get-started.md b/education/get-started/change-history-ms-edu-get-started.md
deleted file mode 100644
index 890ee785d2..0000000000
--- a/education/get-started/change-history-ms-edu-get-started.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
-title: Change history for Microsoft Education Get Started
-description: New and changed topics in the Microsoft Education get started guide.
-keywords: Microsoft Education get started guide, IT admin, IT pro, school, education, change history
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: edu
-author: CelesteDG
-ms.author: celested
-ms.date: 07/07/2017
----
-
-# Change history for Microsoft Education Get Started
-
-This topic lists the changes in the Microsoft Education IT admin get started.
-
-## July 2017
-
-| New or changed topic | Description |
-| --- | ---- |
-| [Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) | Broke up the get started guide to highlight each phase in the Microsoft Education deployment and management process. |
-| [Set up an Office 365 Education tenant](set-up-office365-edu-tenant.md) | New. Shows the video and step-by-step guide on how to set up an Office 365 for Education tenant. |
-| [Use School Data Sync to import student data](use-school-data-sync.md) | New. Shows the video and step-by-step guide on School Data Sync and sample CSV files to import student data in a trial environment. |
-| [Enable Microsoft Teams for your school](enable-microsoft-teams.md) | New. Shows how IT admins can enable and deploy Microsoft Teams in schools. |
-| [Configure Microsoft Store for Education](configure-microsoft-store-for-education.md) | New. Shows the video and step-by-step guide on how to accept the services agreement and ensure your Microsoft Store account is associated with Intune for Education. |
-| [Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md) | New. Shows the video and step-by-step guide on how to set up Intune for Education, buy apps from the Microsoft Store for Education, and install the apps for all users in your tenant. |
-| [Set up Windows 10 education devices](set-up-windows-10-education-devices.md) | New. Shows options available to you when you need to set up new Windows 10 devices and enroll them to your education tenant. Each option contains a video and step-by-step guide. |
-| [Finish Windows 10 device setup and other tasks](finish-setup-and-other-tasks.md) | New. Shows the video and step-by-step guide on how to finish preparing your Windows 10 devices for use in the classroom. |
-
-
-## June 2017
-
-| New or changed topic | Description |
-| --- | ---- |
-| [Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) | Includes the following updates:

             - New configuration guidance for IT administrators to deploy Microsoft Teams.
             - Updated steps for School Data Sync to show the latest workflow and user experience.
             - Updated steps for Option 2: Try out Microsoft Education in a trial environment. You no longer need the SDS promo code to try SDS in a trial environment. |
-
-## May 2017
-
-| New or changed topic | Description |
-| --- | ---- |
-| [Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md) | New. Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices. |
diff --git a/education/get-started/configure-microsoft-store-for-education.md b/education/get-started/configure-microsoft-store-for-education.md
deleted file mode 100644
index 6da930b66d..0000000000
--- a/education/get-started/configure-microsoft-store-for-education.md
+++ /dev/null
@@ -1,62 +0,0 @@
----
-title: Configure Microsoft Store for Education
-description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices.
-keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.topic: get-started
-ms.localizationpriority: medium
-ms.pagetype: edu
-author: CelesteDG
-ms.author: celested
-ms.date: 08/29/2017
----
-
-# Configure Microsoft Store for Education
-
-> [!div class="step-by-step"]
-[<< Use School Data Sync to import student data](use-school-data-sync.md)
-[Use Intune for Education to manage groups, apps, and settings >>](use-intune-for-education.md)
-
-You'll need to configure Microsoft Store for Education to accept the services agreement and make sure your Microsoft Store account is associated with Intune for Education.
-
-You can watch the video to see how this is done, or follow the step-by-step guide. 
            
-
-> [!VIDEO https://www.youtube.com/embed/Jnbssq0gC_g]
-
-You can watch the descriptive audio version here: [Microsoft Education: Configure Microsoft Store for Education (DA)](https://www.youtube.com/watch?v=bStgEpHbEXw)
-
-## Associate your Microsoft Store account with Intune for Education
-
-1. Sign in to Microsoft Store for Education.
-2. Accept the Microsoft Store for Business and Education Services Agreement. 
-
-  This will take you to the Microsoft Store for Education portal.
-
-  **Figure 1** - Microsoft Store for Education portal
-
-  ![Microsoft Store for Education portal](images/msfe_store_portal.png)
-
-3. In the Microsoft Store portal, click **Manage** to go to the Microsoft Store **Overview** page.
-4. Find the **Overview** page, find the **Store settings** tile and click **Management tools**.
-
-  **Figure 2** - Select management tools from the list of Store settings options
-
-  ![Select management tools from list of Store settings options](images/msfe_storesettings_select_managementtools.png)
-
-4. In the **Management tools** page, find **Microsoft Intune** on the list and click **Activate** to get Intune for Education ready for use with Microsoft Store for Education.
-
-  **Figure 3** - Activate Intune for Education as the management tool
-
-  ![Activate Intune for Education as the management tool](images/msfe_managementtools_activateintune.png) 
-
-Your Microsoft Store for Education account is now linked to Intune for Education so let's set that up next.
-
-> [!div class="step-by-step"]
-[<< Use School Data Sync to import student data](use-school-data-sync.md)
-[Use Intune for Education to manage groups, apps, and settings >>](use-intune-for-education.md)
-
-
-## Related topic
-[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md)
\ No newline at end of file
diff --git a/education/get-started/enable-microsoft-teams.md b/education/get-started/enable-microsoft-teams.md
deleted file mode 100644
index 5d3af7dc3d..0000000000
--- a/education/get-started/enable-microsoft-teams.md
+++ /dev/null
@@ -1,56 +0,0 @@
----
-title: Enable Microsoft Teams for your school
-description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices.
-keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.topic: get-started
-ms.localizationpriority: medium
-ms.pagetype: edu
-author: CelesteDG
-ms.author: celested
-ms.date: 07/28/2017
----
-
-# Enable Microsoft Teams for your school
-
-Microsoft Teams is a digital hub that brings conversations, content, and apps together in one place. Because it's built on Office 365, schools benefit from integration with their familiar Office apps and services. Your institution can use Microsoft Teams to create collaborative classrooms, connect in professional learning communities, and communicate with school staff all from a single experience in Office 365 for Education. 
-
-To get started, IT administrators need to use the Office 365 Admin Center to enable Microsoft Teams for your school. 
-
-## Enable Microsoft Teams for your school
-
-1. Sign in to Office 365 with your work or school account.
-2. Click **Admin** to go to the Office 365 admin center.
-3. Go to **Settings > Services & add-ins**.
-4. On the **Services & add-ins** page, select **Microsoft Teams**.
-
-  **Figure 1** - Select Microsoft Teams from the list of services & add-ins
-
-  ![Enable Microsoft Teams for your school](images/o365_settings_services_msteams.png)
-
-5. On the Microsoft Teams settings screen, select the license that you want to configure, **Student** or **Faculty and Staff**. Select **Faculty and Staff**.
-
-  **Figure 2** - Select the license that you want to configure
-
-  ![Select the Microsoft Teams license that you want to configure](images/o365_msteams_settings.png)
-
-6. After you select the license type, set the toggle to turn on Microsoft Teams for your organization.
-
-  **Figure 3** - Turn on Microsoft Teams for your organization
-
-  ![Turn on Microsoft Teams for your organization](images/o365_msteams_turnon.png)
-
-7. Click **Save**.
-
-You can find more info about how to control which users in your school can use Microsoft Teams, turn off group creation, configure tenant-level settings, and more by reading the *Guide for IT admins* getting started guide in the Meet Microsoft Teams page.
-
-
-> [!div class="step-by-step"]
-[<< Use School Data Sync to import student data](use-school-data-sync.md)
-[Configure Microsoft Store for Education >>](configure-microsoft-store-for-education.md)
-
-
-## Related topic
-[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md)
\ No newline at end of file
diff --git a/education/get-started/finish-setup-and-other-tasks.md b/education/get-started/finish-setup-and-other-tasks.md
deleted file mode 100644
index 120b357bc2..0000000000
--- a/education/get-started/finish-setup-and-other-tasks.md
+++ /dev/null
@@ -1,215 +0,0 @@
----
-title: Finish Windows 10 device setup and other tasks
-description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices.
-keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.topic: get-started
-ms.localizationpriority: medium
-ms.pagetype: edu
-author: CelesteDG
-ms.author: celested
-ms.date: 10/09/2017
----
-
-# Finish Windows 10 device setup and other tasks
-
-> [!div class="step-by-step"]
-[<< Set up Windows 10 education devices](set-up-windows-10-education-devices.md)
-
-Once you've set up your Windows 10 education device, it's worth checking to verify the following:
-
-> [!div class="checklist"]
-> * Correct device setup
-> * Device is Azure AD joined
-
-You can watch the video to see how this is done, or follow the step-by-step guide. 
            
-
-> [!VIDEO https://www.youtube.com/embed/nhQ_4okWFmk]
-
-You can watch the descriptive audio version here: [Microsoft Education: Verify Windows 10 education devices are Azure AD joined and managed (DA)](https://www.youtube.com/watch?v=_hVIxaEsu2Y)
-
-## Verify correct device setup
-Verify that the device is set up correctly and boots without any issues.
-
-**Verify that the device was set up correctly**
-1. Confirm that the Start menu contains a simple configuration.
-2. Confirm that the Store and built-in apps are installed and working. The apps pushed down from Intune for Education will appear under **Recently added**. 
-
-  > [!NOTE]  
-  > It may take some time before some apps are pushed down to your device from Intune for Education. Check again later if you don't see some of the apps you provisioned for the user.
-
-  **Figure 1** - Sample list of apps for a user
-
-  ![Apps list contains the apps provisioned for the user](images/win10_start_checkapps.png)
-
-## Verify the device is Azure AD joined
-Let's now verify that the device is joined to your organization's Azure AD and shows up as being managed in Microsoft Intune for Education.
-
-**Verify if the device is joined to Azure AD**
-1. Log in to the Intune for Education console.
-2. Select **Groups** and select **All Devices**.
-3. In the **All Devices** page, see the list of devices and verify that the device you're signed into appears on the list.
-
-  **Figure 2** - List of all managed devices
-
-  ![Verify that the device is managed in Intune for Education](images/i4e_groups_alldevices_listofaadjdevices.png)
-
-4. On the Windows 10 education device, click **Start** and go to **Settings**. 
-5. Select **Accounts > Access work or school**.
-6. In the **Access work or school** page, confirm that the device is connected to the organization's Azure AD.
-
-  **Figure 3** - Confirm that the Windows 10 device is joined to Azure AD
-
-  ![Confirm that the Windows 10 device is joined to Azure AD](images/win10_confirmaadj.png)
-
-**That's it! You're done!** You've completed basic cloud setup, deployment, and management using Microsoft Education. 
-
-You can follow the rest of the walkthrough to finish setup and complete other tasks, such as:
-
-> [!div class="checklist"]
-> * Update group settings in Intune for Education
-> * Configure Azure settings
-> * Complete Office 365 for Education setup
-> * Enable Microsoft teams for your school
-> * Add more users
-> * Connect other devices, like BYOD devices, to your cloud infrastructure
-
-You can watch the following video to see how to update group settings in Intune for Education and configure Azure settings. Or, you can follow the step-by-step guide for these tasks and the other tasks listed above.
-
-> [!VIDEO https://www.youtube.com/embed/M6-k73dZOfw]
-
-You can watch the descriptive audio version here: [Microsoft Education: Update settings, apps, and Azure AD settings for your education tenant (DA)](https://www.youtube.com/watch?v=-Rz3VcDXbzs)
-
-## Update group settings in Intune for Education
-If you need to make changes or updates to any of the apps or settings for the group(s), follow these steps.
-
-1. Log in to the Intune for Education console.
-2. Click **Groups** and then choose **Settings** in the taskbar at the top of the page.
-3. You will see the same settings groups that you saw in express setup for Intune for Education as well as other settings categories such as **Windows Defender settings**, **Device sharing**, **Edition upgrade**, and so on.
-
-  **Figure 4** - See the list of available settings in Intune for Education
-
-  ![See the list of available settings in Intune for Education](images/i4e_groups_settingslist_full.png)
-
-4. Keep the default settings or configure the settings according to your school's policies. 
-
-  For example, you can configure the diagnostic data sent to Microsoft in **Basic device settings > Send diagnostic data**. 
-
-5. Click **Save** or **Discard changes**.
-
-## Configure Azure settings
-After completing the basic setup for your cloud infrastructure and confirming that it is up and running, it's time to prepare for additional devices to be added and enable capabilities for the user to use.
-
-### Enable many devices to be added by a single person 
-When a device is owned by the school, you may need to have a single persion adding many devices to your cloud infrastructure. 
-
-Follow the steps in this section to enable a single person to add many devices to your cloud infrastructure.
-
-1. Sign in to the Office 365 admin center.
-2. Configure the device settings for the school's Active Directory. To do this, go to the new Azure portal, https://portal.azure.com.
-3. Select **Azure Active Directory > Users and groups > Device settings**.
-
-  **Figure 5** - Device settings in the new Azure portal
-
-  ![Configure device settings in the new Azure portal](images/azure_newportal_usersandgroups_devicesettings.png)
-
-4. Find the setting **Maximum number of devices per user** and change the value to **Unlimited**.
-5. Click **Save** to update device settings.
-
-### Enable roaming settings for users
-When students move from using one device to another, they may need to have their settings roam with them and be made available on other devices. 
-
-Follow the steps in this section to ensure that settings for the each user follow them when they move from one device to another.
-
-1. Sign in to the Office 365 admin center.
-3. Go to the new Azure portal, https://portal.azure.com.
-3. Select **Azure Active Directory > Users and groups > Device settings**.
-4. Find the setting **Users may sync settings and enterprise app data** and change the value to **All**.
-
-  **Figure 6** - Enable settings to roam with users
-
-  ![Enable settings to roam with users](images/azure_usersandgroups_devicesettings_ers.png)
-
-5. Click **Save** to update device settings.
-
-## Complete Office 365 for Education setup
-Now that your basic cloud infrastructure is up and running, it's time to complete the rest of the Office 365 for Education setup. You can find detailed information about completing Office 365 setup, services and applications, troubleshooting, and more by reading the Office 365 admin documentation.
-
-## Enable Microsoft Teams for your school
-Microsoft Teams is a digital hub that brings conversations, content, and apps together in one place. Because it's built on Office 365, schools benefit from integration with their familiar Office apps and services. Your institution can use Microsoft Teams to create collaborative classrooms, connect in professional learning communities, and communicate with school staff all from a single experience in Office 365 for Education. 
-
-To get started, IT administrators need to use the Office 365 Admin Center to enable Microsoft Teams for your school. 
-
-**To enable Microsoft Teams for your school**
-
-1. Sign in to Office 365 with your work or school account.
-2. Click **Admin** to go to the Office 365 admin center.
-3. Go to **Settings > Services & add-ins**.
-4. On the **Services & add-ins** page, select **Microsoft Teams**.
-
-  **Figure 1** - Select Microsoft Teams from the list of services & add-ins
-
-  ![Enable Microsoft Teams for your school](images/o365_settings_services_msteams.png)
-
-5. On the Microsoft Teams settings screen, select the license that you want to configure, **Student** or **Faculty and Staff**. Select **Faculty and Staff**.
-
-  **Figure 2** - Select the license that you want to configure
-
-  ![Select the Microsoft Teams license that you want to configure](images/o365_msteams_settings.png)
-
-6. After you select the license type, set the toggle to turn on Microsoft Teams for your organization.
-
-  **Figure 3** - Turn on Microsoft Teams for your organization
-
-  ![Turn on Microsoft Teams for your organization](images/o365_msteams_turnon.png)
-
-7. Click **Save**.
-
-You can find more info about how to control which users in your school can use Microsoft Teams, turn off group creation, configure tenant-level settings, and more by reading the *Guide for IT admins* getting started guide in the Meet Microsoft Teams page.
-
-## Add more users
-After your cloud infrastructure is set up and you have a device management strategy in place, you may need to add more users and you want the same policies to apply to these users. You can add new users to your tenant simply by adding them to the Office 365 groups. Adding new users to Office 365 groups automatically adds them to the corresponding groups in Intune for Education.
-
-See Add users to Office 365 to learn more. Once you're done adding new users, go to the Intune for Education console and verify that the same users were added to the Intune for Education groups as well.
-
-## Connect other devices to your cloud infrastructure
-Adding a new device to your cloud-based tenant is easy. For new devices, you can follow the steps in [Set up Windows 10 education devices](set-up-windows-10-education-devices.md). For other devices, such as those personally-owned by teachers who need to connect to the school network to access work or school resources (BYOD), you can follow the steps in this section to get these devices connected.
-
-  > [!NOTE]  
-  > These steps enable users to get access to the organization's resources, but it also gives the organization some control over the device.
-
-**To connect a personal device to your work or school**
-
-1. On your Windows device, go to **Settings > Accounts**.
-2. Select **Access work or school** and then click **Connect** in the **Connect to work or school** page.
-3. In the **Set up a work or school account** window, enter the user's account info.
-
-  For example, if a teacher connects their personal device to the school network, they'll see the following screen after typing in their account information.
-
-  **Figure 7** - Device is now managed by Intune for Education
-
-  ![Device is managed by Intune for Education](images/byob_aad_enrollment_intune.png)
-
-4. Enter the account password and then click **Sign in** to authenticate the user.
-
-   Depending on the organization's policy, the user may be asked to update the password.
-
-5. After the user's credentails are validated, the window will refresh and will now include an entry that shows the device is now connected to the organization's MDM. This means the device is now enrolled in Intune for Education MDM and the account should have access to the organization's resources.
-
-  **Figure 8** - Device is connected to organization's MDM
-
-  ![Device is connected to organization's MDM](images/win10_connectedtoorgmdm.png)
-
-6. You can confirm that the new device and user are showing up as Intune for Education-managed by going to the Intune for Education management portal and following the steps in [Verify the device is Azure AD joined](#verify-the-device-is-azure-ad-joined). 
-
-  It may take several minutes before the new device shows up so check again later.
-
-
-> [!div class="step-by-step"]
-[<< Set up Windows 10 education devices](set-up-windows-10-education-devices.md)
-
-  
-## Related topic
-[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md)
diff --git a/education/get-started/get-started-with-microsoft-education.md b/education/get-started/get-started-with-microsoft-education.md
deleted file mode 100644
index 6df81f8b27..0000000000
--- a/education/get-started/get-started-with-microsoft-education.md
+++ /dev/null
@@ -1,167 +0,0 @@
----
-title: Deploy and manage a full cloud IT solution with Microsoft Education
-description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices.
-keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.topic: hero-article
-ms.localizationpriority: medium
-ms.pagetype: edu
-author: CelesteDG
-ms.author: celested
-ms.date: 10/09/2017
----
-
-# Get started: Deploy and manage a full cloud IT solution with Microsoft Education
-
-![Learn how to deploy and manage a cloud solution with MSES!](images/mses_getstarted_banner.png)
-
-**Applies to:**
-
--   Office 365 for Education, School Data Sync, Microsoft Intune for Education, Microsoft Store for Education, Windows 10 Creators Update, Set up School PCs
-
-Hello, IT administrators! In this walkthrough, we'll show you how you can quickly and easily use the new Microsoft Education system, consisting of new and existing cloud services and tools, to implement a full IT cloud solution for your school.
-
-## What is Microsoft Education?
-**Microsoft Education** consists of these new and existing services and tools from Microsoft:
-- **Microsoft Intune for Education** for simple set up, control, and management of the resources for your school including apps, devices, and settings
-- **Office 365 for Education** provides online apps for work from anywhere and desktop apps for advanced functionality, built for working together and available across devices, and it's free for schools, teachers, and students
-  - **School Data Sync** to help automate the process for importing and integrating School Information System (SIS) data that you can use with Office 365
-  - **OneNote Class Notebook** to organize course content, create and deliver interactive lessons to some or all students, collaborate and provide private feedback to individual students, and connect with major LMS and SIS partners for assignment workflow
-- **Microsoft Teams** to bring conversations, content, and apps together in one place and create collaborate classrooms, connect in professional learning communities, and communicate with school staff 
-- **Learning Tools** are moving beyond the OneNote desktop app and is now available in Office Lens, OneNote Online, Word Online, and Word desktop
-- **Whiteboard** to create interactive lessons on the big screen, share and collaborate real-time by connecting to Class Notebook and Classroom
-- **Windows 10, version 1703 (Creators Update)** which brings 3D for everyone and other new and updated Windows features
-- **Minecraft: Education Edition** which provides an open and immersive environment to promote creativity, collaboration, and problem-solving 
-
-With Microsoft Education, schools can:
-- **Use affordable devices and simple setup** - Boost creativity and get started instantly with Windows 10 devices that support Windows Ink. Set up devices in minutes and stay in control with the new Intune for Education.
-- **Collaborate in a modern classroom** - Help students become career-ready with Office apps like Word, Excel, PowerPoint, and OneNote. Increase comprehension and outcomes with the most advanced teaching apps like integrated Learning Tools.
-- **Go beyond the browser with inspiring apps for classroom learning** - Inspire with Minecraft: Education Edition and innovative apps from the Microsoft Store for Education.
-
-Go to the Microsoft Education site to learn more. See How to buy to learn about pricing and purchasing options for schools, students, and teachers as well as academic pricing and offers for qualified K-12 and higher education institutions.
-
-## What we're doing
-The end-to-end process for deploying and managing a full cloud IT solution with Microsoft Education is outlined here. Depending on your [setup scenario](#setup-options), you may not need to implement all these steps. 
-
-Click the link to watch the video or follow the step-by-step guidance for each.
-
-1. [Set up an Office 365 education tenant](set-up-office365-edu-tenant.md)
-2. [Use School Data Sync to import student data](use-school-data-sync.md)
-3. [Configure Microsoft Store for Education](configure-microsoft-store-for-education.md)
-4. [Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md)
-5. [Set up Windows 10 education devices](set-up-windows-10-education-devices.md)
-6. [Finish Windows 10 device setup and other tasks](finish-setup-and-other-tasks.md)
-
-**Figure 1** - Microsoft Education IT administrator workflow
-
-![Deploy and manage a full cloud IT solution using Microsoft Education](images/MSES_Get_Started_IT_082917.png)
-
-## Prerequisites
-Complete these tasks before you start the walkthrough:
-- Make sure all the devices that you want to configure, such as student PCs, have the latest Windows 10, version 1703 image installed.
-
-  We recommend Windows 10, version 1703 to take advantage of all the new features and functionality that Windows supports. This version of Windows is also compatible with the latest version of the Set up School PCs app and the versions must match in order for Set up School PCs to provision the devices. 
-
-  If you don't have Windows 10, version 1703 installed on your devices, we recommend upgrading. This process takes a while so start this task before proceeding with this walkthrough. 
-
-- Have an education-verified tenant to qualify for an Office 365 for Education subscription. You also need to be education-verified to use School Data Sync and Intune for Education.
-
-  If you don't have an education-verified domain, don't worry. We'll show you the steps on how to do this. 
-
-  > [!NOTE] 
-  > If you need to get education-verified, it may take up to two weeks for the verification process to be completed.
-
-## Setup options
- To make sure you have a successful experience with deploying and managing a full cloud IT solution with Microsoft Education, select the scenario that best describes your school or how you'd like to get started.
-
-
-| [Get started with Microsoft Education in production environment](#noo365prodenv) | [Try out Microsoft Education in trial environment](#noo365trialenv) | [School uses Office 365, try out Intune for Education now](#schooluseso365tryi4e) | 
-| ----------------------------------------- | ------------------------------------------------ | ---------------------------------------------- |
-| * My school doesn't use Office 365 for Education | * My school doesn't use Office 365 for Education | * My school uses Office 365 for Education |
-| * My school is not an education-verified tenant | * My school is not an education-verified tenant | * My school is an education-verified tenant |
-| * I would like to get started with Microsoft Education in a production environment | * I would like to try out Microsoft Education in a trial environment | * I would like to apply the Intune for Education trial code to my school's production environment |
-| * Longest, need to start from scratch | * Simplest, but may take longer to start | * Fastest, Office 365 and SDS already set up |
-
-
-### Option 1: Get started with Microsoft Education in a production environment
-Trying out Microsoft Education in a production environment means you'll be using real school data as you evaluate the features and tools. This requires more time to get fully set up and going. 
-
-To get started with Microsoft Education in a production environment:
-
-* Go to https://aka.ms/sdssignup and fill out the form to sign up for School Data Sync and receive a free, one-on-one support from Microsoft.
-
-  A team from Microsoft will contact you to help get started with Microsoft Education. 
-
-If you want a quicker way to evaluate Microsoft Education, you can [use a trial environment instead](#noo365trialenv).
-
-### Option 2: Try out Microsoft Education in a trial environment
-Once you get an Office 365 education-verified tenant, trying out Microsoft Education in a trial environment is an easy way to evaluate all the features and tools. Here, you'll use promo codes and sample files as you follow the walkthrough. 
-
-To get started with Microsoft Education in a trial environment, follow these steps.
-
-1. [Set up a new Office 365 for Education tenant](set-up-office365-edu-tenant.md).
-
-  Wait for your tenant to be education-verified before proceeding with the next step. Verification can take up to a few days.
-
-2. Once you have an education-verified tenant, click https://aka.ms/intuneforedupreviewtrial to apply the Intune for Education trial promo code. 
-  1. In the Intune for Education Trial page, on the upper right, click **Sign in** next to **Want to add this to an existing subscription?**.
-  2. Sign in with your global admin credentials. 
-
-3. Sign in to Office 365 admin portal and:
-  1. Select **Admin > Users** and then search for your admin account. 
-  2. In the user page, select **Product licenses** and expand the **Office 365 Education** license you assigned to yourself. 
-  3. Confirm that School Data Sync is turned on.
-
-3. Skip ahead and follow the rest of the instructions in this walkthrough beginning with [Use School Data Sync to import student data](use-school-data-sync.md).
-
-### Option 3: Try out Intune for Education
-Already have an Office 365 for Education verified tenant? Just sign in with your global admin credentials to apply the Intune for Education preview trial code to your tenant and follow the rest of the walkthrough.
-
-1. Click https://aka.ms/intuneforedupreviewtrial to get started.
-2. In the **Intune for Education Trial** page, on the upper right, click **Sign in** next to **Want to add this to an existing subscription?**.
-
-  **Figure 2** - Intune for Education trial sign in page
-
-  ![Intune for Education trial sign in page](images/i4e_trialsigninpage.png)
-
-3. Enter your Office 365 global admin credentials to apply the Intune for Education trial to your tenant.
-4. If you don't already have Microsoft Teams deployed to your tenant, you can start with [Enable Microsoft Teams for your school](enable-microsoft-teams.md) and then follow the rest of the instructions in this walkthrough. 
-
-## Get more info
-
-### Microsoft Education documentation and resources hub
-See the Microsoft Education documentation and resources hub for links to more content for IT admins, teachers, students, and education app developers.
-
-### Info related to this walkthrough
-
-**For IT admins**
-
-To learn more about the services and tools mentioned in this walkthrough, and learn what other tasks you can do, follow these links:
-- Working with Microsoft Store for Education
-- *Resources for anyone who uses Office 365* and *Resources for admins* in Get started with Office 365 for Education
-- School Data Sync deployment options
-  - Deployment using CSV files: How to deploy School Data Sync by using CSV files and CSV files for School Data Sync
-  - Deployment using PowerSchool Sync: How to deploy School Data Sync by using PowerSchool Sync and School Data Sync required attributes for PowerSchool Sync
-  - Deployment using Clever Sync: How to deploy School Data Sync by using Clever Sync and School Data Sync required attributes for Clever sync
-  - Deployment using OneRoster CSV files: How to deploy School Data Sync by using OneRoster CSV files
-- Azure Active Directory features used by Intune for Education, including: 
-  - Single Sign-On (SSO) - Allow your Azure AD users to access SSO-enabled apps, so they don’t need to type in their credentials to access these apps. 
-  - MDM auto-enrollment - Devices are automatically enrolled with Intune upon being joined with Azure AD join. 
-- Enterprise state roaming - Keep school data and personal data separate on your devices. 
-  - Dynamic groups - You can use dynamic groups to create rules that populate your groups (for example, a group with all 9th graders) instead of having to manually add or remove members of the groups. The group stays updated by continually staying populated with members that fit the rules you pick. 
-  - Password write-back - Allows you to configure Azure AD to write passwords back to your on-premises Active Directory. It removes the need to set up and manage a complicated on-premises self-service password reset solution, and it provides a convenient cloud-based way for your users to reset their on-premises passwords wherever they are. 
-  - Administrative units
-  - Additional local administrators
-  - Self-service BitLocker recovery - A self-service portal that allows your employees to retrieve their BitLocker recovery key and avoid support calls.
-
-**For teachers**
-
-Whether it's in the classroom, getting the most out of your devices, or learning some of the cool things you can do, we've got teachers covered. Follow these links for more info:
-- *Resources for anyone who uses Office 365* in Get started with Office 365 for Education
-- Windows 10 online resources for teachers
-
-
-
-
diff --git a/education/get-started/images/03bfe22a-469b-4b73-ab8d-af5aaac8ff89.png b/education/get-started/images/03bfe22a-469b-4b73-ab8d-af5aaac8ff89.png
deleted file mode 100644
index 82aeef7c40..0000000000
Binary files a/education/get-started/images/03bfe22a-469b-4b73-ab8d-af5aaac8ff89.png and /dev/null differ
diff --git a/education/get-started/images/ICDstart-option.PNG b/education/get-started/images/ICDstart-option.PNG
deleted file mode 100644
index 1ba49bb261..0000000000
Binary files a/education/get-started/images/ICDstart-option.PNG and /dev/null differ
diff --git a/education/get-started/images/MSES_Get_Started_IT_082917.png b/education/get-started/images/MSES_Get_Started_IT_082917.png
deleted file mode 100644
index 5153524b43..0000000000
Binary files a/education/get-started/images/MSES_Get_Started_IT_082917.png and /dev/null differ
diff --git a/education/get-started/images/PCicon.png b/education/get-started/images/PCicon.png
deleted file mode 100644
index c97c137b83..0000000000
Binary files a/education/get-started/images/PCicon.png and /dev/null differ
diff --git a/education/get-started/images/TakeATestURL.png b/education/get-started/images/TakeATestURL.png
deleted file mode 100644
index b057763e8b..0000000000
Binary files a/education/get-started/images/TakeATestURL.png and /dev/null differ
diff --git a/education/get-started/images/allowcortana_gp.PNG b/education/get-started/images/allowcortana_gp.PNG
deleted file mode 100644
index 7adf1b7594..0000000000
Binary files a/education/get-started/images/allowcortana_gp.PNG and /dev/null differ
diff --git a/education/get-started/images/allowcortana_omauri.PNG b/education/get-started/images/allowcortana_omauri.PNG
deleted file mode 100644
index 303c89ed5f..0000000000
Binary files a/education/get-started/images/allowcortana_omauri.PNG and /dev/null differ
diff --git a/education/get-started/images/allowcortana_wcd.PNG b/education/get-started/images/allowcortana_wcd.PNG
deleted file mode 100644
index 5e62e0bb01..0000000000
Binary files a/education/get-started/images/allowcortana_wcd.PNG and /dev/null differ
diff --git a/education/get-started/images/app-distribution-options.PNG b/education/get-started/images/app-distribution-options.PNG
deleted file mode 100644
index 75b3374720..0000000000
Binary files a/education/get-started/images/app-distribution-options.PNG and /dev/null differ
diff --git a/education/get-started/images/app-privacy-group-policy.png b/education/get-started/images/app-privacy-group-policy.png
deleted file mode 100644
index 96a5f0380a..0000000000
Binary files a/education/get-started/images/app-privacy-group-policy.png and /dev/null differ
diff --git a/education/get-started/images/app1.jpg b/education/get-started/images/app1.jpg
deleted file mode 100644
index aef6c5c22e..0000000000
Binary files a/education/get-started/images/app1.jpg and /dev/null differ
diff --git a/education/get-started/images/assign_intune_classroom_licenses_to_users.png b/education/get-started/images/assign_intune_classroom_licenses_to_users.png
deleted file mode 100644
index 39885c5778..0000000000
Binary files a/education/get-started/images/assign_intune_classroom_licenses_to_users.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_apps_intune.png b/education/get-started/images/azure_ad_apps_intune.png
deleted file mode 100644
index ff703bd920..0000000000
Binary files a/education/get-started/images/azure_ad_apps_intune.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_configure_intune.png b/education/get-started/images/azure_ad_configure_intune.png
deleted file mode 100644
index 253ec99443..0000000000
Binary files a/education/get-started/images/azure_ad_configure_intune.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_first_signin.png b/education/get-started/images/azure_ad_first_signin.png
deleted file mode 100644
index 01e71111a2..0000000000
Binary files a/education/get-started/images/azure_ad_first_signin.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_intune_configuration_save.png b/education/get-started/images/azure_ad_intune_configuration_save.png
deleted file mode 100644
index a7feb3b75b..0000000000
Binary files a/education/get-started/images/azure_ad_intune_configuration_save.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_oops_subscription_message.png b/education/get-started/images/azure_ad_oops_subscription_message.png
deleted file mode 100644
index 2c6f751179..0000000000
Binary files a/education/get-started/images/azure_ad_oops_subscription_message.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_portal.png b/education/get-started/images/azure_ad_portal.png
deleted file mode 100644
index b06600f922..0000000000
Binary files a/education/get-started/images/azure_ad_portal.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_portal_old.png b/education/get-started/images/azure_ad_portal_old.png
deleted file mode 100644
index 4f48fdeaa2..0000000000
Binary files a/education/get-started/images/azure_ad_portal_old.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_portal_old_add_group_members.png b/education/get-started/images/azure_ad_portal_old_add_group_members.png
deleted file mode 100644
index 465b2d2c01..0000000000
Binary files a/education/get-started/images/azure_ad_portal_old_add_group_members.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_portal_old_intune_configuration.png b/education/get-started/images/azure_ad_portal_old_intune_configuration.png
deleted file mode 100644
index 6d48984601..0000000000
Binary files a/education/get-started/images/azure_ad_portal_old_intune_configuration.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_portal_old_intune_properties.png b/education/get-started/images/azure_ad_portal_old_intune_properties.png
deleted file mode 100644
index 3ce578a2e5..0000000000
Binary files a/education/get-started/images/azure_ad_portal_old_intune_properties.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_portal_old_intune_select_all_students.png b/education/get-started/images/azure_ad_portal_old_intune_select_all_students.png
deleted file mode 100644
index 0165d7b6b5..0000000000
Binary files a/education/get-started/images/azure_ad_portal_old_intune_select_all_students.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_portal_old_intune_select_groups.png b/education/get-started/images/azure_ad_portal_old_intune_select_groups.png
deleted file mode 100644
index 0165d7b6b5..0000000000
Binary files a/education/get-started/images/azure_ad_portal_old_intune_select_groups.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_portal_old_new_group.png b/education/get-started/images/azure_ad_portal_old_new_group.png
deleted file mode 100644
index 2c27738d26..0000000000
Binary files a/education/get-started/images/azure_ad_portal_old_new_group.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_portal_old_select_apps.png b/education/get-started/images/azure_ad_portal_old_select_apps.png
deleted file mode 100644
index 3c8d188d0c..0000000000
Binary files a/education/get-started/images/azure_ad_portal_old_select_apps.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_portal_old_select_directory.png b/education/get-started/images/azure_ad_portal_old_select_directory.png
deleted file mode 100644
index ba8d43dca8..0000000000
Binary files a/education/get-started/images/azure_ad_portal_old_select_directory.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_portal_old_select_domain.png b/education/get-started/images/azure_ad_portal_old_select_domain.png
deleted file mode 100644
index 4fcaeabbd6..0000000000
Binary files a/education/get-started/images/azure_ad_portal_old_select_domain.png and /dev/null differ
diff --git a/education/get-started/images/azure_ad_portal_overview.png b/education/get-started/images/azure_ad_portal_overview.png
deleted file mode 100644
index 99a8b3899f..0000000000
Binary files a/education/get-started/images/azure_ad_portal_overview.png and /dev/null differ
diff --git a/education/get-started/images/azure_classicportal_configure_devicesettings.PNG b/education/get-started/images/azure_classicportal_configure_devicesettings.PNG
deleted file mode 100644
index d9681e69d2..0000000000
Binary files a/education/get-started/images/azure_classicportal_configure_devicesettings.PNG and /dev/null differ
diff --git a/education/get-started/images/azure_newportal_usersandgroups_devicesettings.PNG b/education/get-started/images/azure_newportal_usersandgroups_devicesettings.PNG
deleted file mode 100644
index c73cf7a68b..0000000000
Binary files a/education/get-started/images/azure_newportal_usersandgroups_devicesettings.PNG and /dev/null differ
diff --git a/education/get-started/images/azure_usersandgroups_devicesettings_ers.PNG b/education/get-started/images/azure_usersandgroups_devicesettings_ers.PNG
deleted file mode 100644
index 2fa9c8dc74..0000000000
Binary files a/education/get-started/images/azure_usersandgroups_devicesettings_ers.PNG and /dev/null differ
diff --git a/education/get-started/images/azuread_usersandgroups_allusers_automaticaccounts.png b/education/get-started/images/azuread_usersandgroups_allusers_automaticaccounts.png
deleted file mode 100644
index f0549797a0..0000000000
Binary files a/education/get-started/images/azuread_usersandgroups_allusers_automaticaccounts.png and /dev/null differ
diff --git a/education/get-started/images/azuread_usersandgroups_devicesettings_maxnumberofdevicesperuser.png b/education/get-started/images/azuread_usersandgroups_devicesettings_maxnumberofdevicesperuser.png
deleted file mode 100644
index 37ea63cda2..0000000000
Binary files a/education/get-started/images/azuread_usersandgroups_devicesettings_maxnumberofdevicesperuser.png and /dev/null differ
diff --git a/education/get-started/images/azuread_usersandgroups_devicesettings_requiremultifactorauth.png b/education/get-started/images/azuread_usersandgroups_devicesettings_requiremultifactorauth.png
deleted file mode 100644
index 1b8389b1f5..0000000000
Binary files a/education/get-started/images/azuread_usersandgroups_devicesettings_requiremultifactorauth.png and /dev/null differ
diff --git a/education/get-started/images/azuread_usersandgroups_devicesettings_usersmayjoin.png b/education/get-started/images/azuread_usersandgroups_devicesettings_usersmayjoin.png
deleted file mode 100644
index 40a603cf64..0000000000
Binary files a/education/get-started/images/azuread_usersandgroups_devicesettings_usersmayjoin.png and /dev/null differ
diff --git a/education/get-started/images/azuread_video_thumbnail.PNG b/education/get-started/images/azuread_video_thumbnail.PNG
deleted file mode 100644
index e0723147f4..0000000000
Binary files a/education/get-started/images/azuread_video_thumbnail.PNG and /dev/null differ
diff --git a/education/get-started/images/byob_aad_enrollment_intune.png b/education/get-started/images/byob_aad_enrollment_intune.png
deleted file mode 100644
index fb6aaa4cd8..0000000000
Binary files a/education/get-started/images/byob_aad_enrollment_intune.png and /dev/null differ
diff --git a/education/get-started/images/checkmark.png b/education/get-started/images/checkmark.png
deleted file mode 100644
index f9f04cd6bd..0000000000
Binary files a/education/get-started/images/checkmark.png and /dev/null differ
diff --git a/education/get-started/images/choose-package-icd.png b/education/get-started/images/choose-package-icd.png
deleted file mode 100644
index 2bf7a18648..0000000000
Binary files a/education/get-started/images/choose-package-icd.png and /dev/null differ
diff --git a/education/get-started/images/choose-package.png b/education/get-started/images/choose-package.png
deleted file mode 100644
index 868407df56..0000000000
Binary files a/education/get-started/images/choose-package.png and /dev/null differ
diff --git a/education/get-started/images/chromebook-fig1-googleadmin.png b/education/get-started/images/chromebook-fig1-googleadmin.png
deleted file mode 100644
index b3d42e5ff2..0000000000
Binary files a/education/get-started/images/chromebook-fig1-googleadmin.png and /dev/null differ
diff --git a/education/get-started/images/clipboard.png b/education/get-started/images/clipboard.png
deleted file mode 100644
index bbfa2c9e8d..0000000000
Binary files a/education/get-started/images/clipboard.png and /dev/null differ
diff --git a/education/get-started/images/cloud-mode-graphic.png b/education/get-started/images/cloud-mode-graphic.png
deleted file mode 100644
index 53046c440f..0000000000
Binary files a/education/get-started/images/cloud-mode-graphic.png and /dev/null differ
diff --git a/education/get-started/images/cloud-mode-intro-banner.png b/education/get-started/images/cloud-mode-intro-banner.png
deleted file mode 100644
index 6ef1059262..0000000000
Binary files a/education/get-started/images/cloud-mode-intro-banner.png and /dev/null differ
diff --git a/education/get-started/images/cloud-mode-topic-banner.png b/education/get-started/images/cloud-mode-topic-banner.png
deleted file mode 100644
index 53046c440f..0000000000
Binary files a/education/get-started/images/cloud-mode-topic-banner.png and /dev/null differ
diff --git a/education/get-started/images/configure_store_for_business_app_sync.png b/education/get-started/images/configure_store_for_business_app_sync.png
deleted file mode 100644
index e56dc038f9..0000000000
Binary files a/education/get-started/images/configure_store_for_business_app_sync.png and /dev/null differ
diff --git a/education/get-started/images/connect-aad.png b/education/get-started/images/connect-aad.png
deleted file mode 100644
index 8583866165..0000000000
Binary files a/education/get-started/images/connect-aad.png and /dev/null differ
diff --git a/education/get-started/images/connect-ad.png b/education/get-started/images/connect-ad.png
deleted file mode 100644
index 4da67e8cdd..0000000000
Binary files a/education/get-started/images/connect-ad.png and /dev/null differ
diff --git a/education/get-started/images/connect_download_entry.jpg b/education/get-started/images/connect_download_entry.jpg
deleted file mode 100644
index 204b3ad6fa..0000000000
Binary files a/education/get-started/images/connect_download_entry.jpg and /dev/null differ
diff --git a/education/get-started/images/create_group_for_intune_management.png b/education/get-started/images/create_group_for_intune_management.png
deleted file mode 100644
index b886d12456..0000000000
Binary files a/education/get-started/images/create_group_for_intune_management.png and /dev/null differ
diff --git a/education/get-started/images/crossmark.png b/education/get-started/images/crossmark.png
deleted file mode 100644
index 69432ff71c..0000000000
Binary files a/education/get-started/images/crossmark.png and /dev/null differ
diff --git a/education/get-started/images/deploy-win-10-school-figure1.png b/education/get-started/images/deploy-win-10-school-figure1.png
deleted file mode 100644
index 66113dcce1..0000000000
Binary files a/education/get-started/images/deploy-win-10-school-figure1.png and /dev/null differ
diff --git a/education/get-started/images/deploy-win-10-school-figure2.png b/education/get-started/images/deploy-win-10-school-figure2.png
deleted file mode 100644
index 0227f8dbaa..0000000000
Binary files a/education/get-started/images/deploy-win-10-school-figure2.png and /dev/null differ
diff --git a/education/get-started/images/deploy-win-10-school-figure3.png b/education/get-started/images/deploy-win-10-school-figure3.png
deleted file mode 100644
index 1b39b5cc14..0000000000
Binary files a/education/get-started/images/deploy-win-10-school-figure3.png and /dev/null differ
diff --git a/education/get-started/images/deploy-win-10-school-figure4.png b/education/get-started/images/deploy-win-10-school-figure4.png
deleted file mode 100644
index 09552a448a..0000000000
Binary files a/education/get-started/images/deploy-win-10-school-figure4.png and /dev/null differ
diff --git a/education/get-started/images/deploy-win-10-school-figure5.png b/education/get-started/images/deploy-win-10-school-figure5.png
deleted file mode 100644
index 550386f1ce..0000000000
Binary files a/education/get-started/images/deploy-win-10-school-figure5.png and /dev/null differ
diff --git a/education/get-started/images/deploy-win-10-school-figure6.png b/education/get-started/images/deploy-win-10-school-figure6.png
deleted file mode 100644
index 09552a448a..0000000000
Binary files a/education/get-started/images/deploy-win-10-school-figure6.png and /dev/null differ
diff --git a/education/get-started/images/deploy-win-10-school-figure7.png b/education/get-started/images/deploy-win-10-school-figure7.png
deleted file mode 100644
index 8e7581007a..0000000000
Binary files a/education/get-started/images/deploy-win-10-school-figure7.png and /dev/null differ
diff --git a/education/get-started/images/edu-districtdeploy-fig1.png b/education/get-started/images/edu-districtdeploy-fig1.png
deleted file mode 100644
index a9ed962f95..0000000000
Binary files a/education/get-started/images/edu-districtdeploy-fig1.png and /dev/null differ
diff --git a/education/get-started/images/edu-districtdeploy-fig2.png b/education/get-started/images/edu-districtdeploy-fig2.png
deleted file mode 100644
index 3838c18153..0000000000
Binary files a/education/get-started/images/edu-districtdeploy-fig2.png and /dev/null differ
diff --git a/education/get-started/images/edu-districtdeploy-fig3.png b/education/get-started/images/edu-districtdeploy-fig3.png
deleted file mode 100644
index 0227f8dbaa..0000000000
Binary files a/education/get-started/images/edu-districtdeploy-fig3.png and /dev/null differ
diff --git a/education/get-started/images/edu-districtdeploy-fig4.png b/education/get-started/images/edu-districtdeploy-fig4.png
deleted file mode 100644
index c55ee20d47..0000000000
Binary files a/education/get-started/images/edu-districtdeploy-fig4.png and /dev/null differ
diff --git a/education/get-started/images/edu-districtdeploy-fig5.png b/education/get-started/images/edu-districtdeploy-fig5.png
deleted file mode 100644
index 09552a448a..0000000000
Binary files a/education/get-started/images/edu-districtdeploy-fig5.png and /dev/null differ
diff --git a/education/get-started/images/edu-districtdeploy-fig6.png b/education/get-started/images/edu-districtdeploy-fig6.png
deleted file mode 100644
index 550386f1ce..0000000000
Binary files a/education/get-started/images/edu-districtdeploy-fig6.png and /dev/null differ
diff --git a/education/get-started/images/edu-districtdeploy-fig7.png b/education/get-started/images/edu-districtdeploy-fig7.png
deleted file mode 100644
index 09552a448a..0000000000
Binary files a/education/get-started/images/edu-districtdeploy-fig7.png and /dev/null differ
diff --git a/education/get-started/images/edu-districtdeploy-fig8.png b/education/get-started/images/edu-districtdeploy-fig8.png
deleted file mode 100644
index 8e7581007a..0000000000
Binary files a/education/get-started/images/edu-districtdeploy-fig8.png and /dev/null differ
diff --git a/education/get-started/images/education.png b/education/get-started/images/education.png
deleted file mode 100644
index cc4f7fabb2..0000000000
Binary files a/education/get-started/images/education.png and /dev/null differ
diff --git a/education/get-started/images/enter-email.PNG b/education/get-started/images/enter-email.PNG
deleted file mode 100644
index 644d893f06..0000000000
Binary files a/education/get-started/images/enter-email.PNG and /dev/null differ
diff --git a/education/get-started/images/express-settings.png b/education/get-started/images/express-settings.png
deleted file mode 100644
index 99e9c4825a..0000000000
Binary files a/education/get-started/images/express-settings.png and /dev/null differ
diff --git a/education/get-started/images/fig2-locallyconfig.png b/education/get-started/images/fig2-locallyconfig.png
deleted file mode 100644
index d2fe9820da..0000000000
Binary files a/education/get-started/images/fig2-locallyconfig.png and /dev/null differ
diff --git a/education/get-started/images/get-app-store.png b/education/get-started/images/get-app-store.png
deleted file mode 100644
index 14ae888425..0000000000
Binary files a/education/get-started/images/get-app-store.png and /dev/null differ
diff --git a/education/get-started/images/get-the-app.PNG b/education/get-started/images/get-the-app.PNG
deleted file mode 100644
index 0692ae6f7f..0000000000
Binary files a/education/get-started/images/get-the-app.PNG and /dev/null differ
diff --git a/education/get-started/images/gp_letwinappsaccesscontacts.PNG b/education/get-started/images/gp_letwinappsaccesscontacts.PNG
deleted file mode 100644
index 0228c9474b..0000000000
Binary files a/education/get-started/images/gp_letwinappsaccesscontacts.PNG and /dev/null differ
diff --git a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-2a.PNG b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-2a.PNG
deleted file mode 100644
index 1dcae48622..0000000000
Binary files a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-2a.PNG and /dev/null differ
diff --git a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-3.PNG b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-3.PNG
deleted file mode 100644
index b366d25c4e..0000000000
Binary files a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-3.PNG and /dev/null differ
diff --git a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-4.PNG b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-4.PNG
deleted file mode 100644
index 60f4857c8e..0000000000
Binary files a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-4.PNG and /dev/null differ
diff --git a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-5.PNG b/education/get-started/images/how-to-deploy-SDS-using-CSV-files-5.PNG
deleted file mode 100644
index 56cd93787e..0000000000
Binary files a/education/get-started/images/how-to-deploy-SDS-using-CSV-files-5.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_admin_portal.png b/education/get-started/images/i4e_admin_portal.png
deleted file mode 100644
index c6f2b25d18..0000000000
Binary files a/education/get-started/images/i4e_admin_portal.png and /dev/null differ
diff --git a/education/get-started/images/i4e_apps_newstoreapp.PNG b/education/get-started/images/i4e_apps_newstoreapp.PNG
deleted file mode 100644
index 99af139e1d..0000000000
Binary files a/education/get-started/images/i4e_apps_newstoreapp.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_apps_newstoreapp_selected.png b/education/get-started/images/i4e_apps_newstoreapp_selected.png
deleted file mode 100644
index d4716d7574..0000000000
Binary files a/education/get-started/images/i4e_apps_newstoreapp_selected.png and /dev/null differ
diff --git a/education/get-started/images/i4e_apps_purchased_apps_list.PNG b/education/get-started/images/i4e_apps_purchased_apps_list.PNG
deleted file mode 100644
index 4440487d68..0000000000
Binary files a/education/get-started/images/i4e_apps_purchased_apps_list.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_apps_storeaboughtapps_nowsyncing.PNG b/education/get-started/images/i4e_apps_storeaboughtapps_nowsyncing.PNG
deleted file mode 100644
index 423e557d87..0000000000
Binary files a/education/get-started/images/i4e_apps_storeaboughtapps_nowsyncing.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_apps_storeapps_newappbutton.PNG b/education/get-started/images/i4e_apps_storeapps_newappbutton.PNG
deleted file mode 100644
index 4cb91536ac..0000000000
Binary files a/education/get-started/images/i4e_apps_storeapps_newappbutton.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_dashboard.PNG b/education/get-started/images/i4e_dashboard.PNG
deleted file mode 100644
index faced8b1f7..0000000000
Binary files a/education/get-started/images/i4e_dashboard.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_dashboard_afterconfiguration.PNG b/education/get-started/images/i4e_dashboard_afterconfiguration.PNG
deleted file mode 100644
index 7c736072af..0000000000
Binary files a/education/get-started/images/i4e_dashboard_afterconfiguration.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_dashboard_apps.PNG b/education/get-started/images/i4e_dashboard_apps.PNG
deleted file mode 100644
index 01bb4168f2..0000000000
Binary files a/education/get-started/images/i4e_dashboard_apps.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_dashboard_clickapps.PNG b/education/get-started/images/i4e_dashboard_clickapps.PNG
deleted file mode 100644
index e847279c38..0000000000
Binary files a/education/get-started/images/i4e_dashboard_clickapps.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_dashboard_clickapps_latest.PNG b/education/get-started/images/i4e_dashboard_clickapps_latest.PNG
deleted file mode 100644
index cec81cebc7..0000000000
Binary files a/education/get-started/images/i4e_dashboard_clickapps_latest.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_dashboard_latest.PNG b/education/get-started/images/i4e_dashboard_latest.PNG
deleted file mode 100644
index 131d285d86..0000000000
Binary files a/education/get-started/images/i4e_dashboard_latest.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_dashboard_newtenant.PNG b/education/get-started/images/i4e_dashboard_newtenant.PNG
deleted file mode 100644
index 3494a366b2..0000000000
Binary files a/education/get-started/images/i4e_dashboard_newtenant.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_dashboard_selectgroups.png b/education/get-started/images/i4e_dashboard_selectgroups.png
deleted file mode 100644
index 5d00c46121..0000000000
Binary files a/education/get-started/images/i4e_dashboard_selectgroups.png and /dev/null differ
diff --git a/education/get-started/images/i4e_expres_setup_option.PNG b/education/get-started/images/i4e_expres_setup_option.PNG
deleted file mode 100644
index e08f7ef18c..0000000000
Binary files a/education/get-started/images/i4e_expres_setup_option.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_express_configuration_welcometoi4e.PNG b/education/get-started/images/i4e_express_configuration_welcometoi4e.PNG
deleted file mode 100644
index 00626c574b..0000000000
Binary files a/education/get-started/images/i4e_express_configuration_welcometoi4e.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_express_setup_option.png b/education/get-started/images/i4e_express_setup_option.png
deleted file mode 100644
index e08f7ef18c..0000000000
Binary files a/education/get-started/images/i4e_express_setup_option.png and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_alldone.PNG b/education/get-started/images/i4e_expressconfiguration_alldone.PNG
deleted file mode 100644
index dfb6b51cf0..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_alldone.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_chooseapps.PNG b/education/get-started/images/i4e_expressconfiguration_chooseapps.PNG
deleted file mode 100644
index 2663b45d24..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_chooseapps.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_chooseapps_selected.PNG b/education/get-started/images/i4e_expressconfiguration_chooseapps_selected.PNG
deleted file mode 100644
index 70576b0d45..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_chooseapps_selected.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_chooseapps_selected_cropped.png b/education/get-started/images/i4e_expressconfiguration_chooseapps_selected_cropped.png
deleted file mode 100644
index 013468cc32..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_chooseapps_selected_cropped.png and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_choosebuttontogoback.PNG b/education/get-started/images/i4e_expressconfiguration_choosebuttontogoback.PNG
deleted file mode 100644
index 535a0cf01c..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_choosebuttontogoback.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings.PNG b/education/get-started/images/i4e_expressconfiguration_choosesettings.PNG
deleted file mode 100644
index 5883a00ced..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettings.PNG b/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettings.PNG
deleted file mode 100644
index fb3a0d3d71..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettings.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettings_cropped.PNG b/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettings_cropped.PNG
deleted file mode 100644
index 96e1e0452b..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettings_cropped.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettingsconfigured.PNG b/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettingsconfigured.PNG
deleted file mode 100644
index 011e91658d..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettingsconfigured.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettingsconfigured_cropped.png b/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettingsconfigured_cropped.png
deleted file mode 100644
index b9cc6885fc..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_additionalsettingsconfigured_cropped.png and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse.PNG b/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse.PNG
deleted file mode 100644
index 8a998070fa..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped.png b/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped.png
deleted file mode 100644
index 0d39ae2780..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped.png and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped_052217.PNG b/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped_052217.PNG
deleted file mode 100644
index e223b5a94c..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped_052217.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_review.PNG b/education/get-started/images/i4e_expressconfiguration_review.PNG
deleted file mode 100644
index bbc70f3a3f..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_review.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_sdsconfigured.PNG b/education/get-started/images/i4e_expressconfiguration_sdsconfigured.PNG
deleted file mode 100644
index 5a7b4ed672..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_sdsconfigured.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expressconfiguration_welcome.PNG b/education/get-started/images/i4e_expressconfiguration_welcome.PNG
deleted file mode 100644
index 019609fb3e..0000000000
Binary files a/education/get-started/images/i4e_expressconfiguration_welcome.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expresssetup_alldone.PNG b/education/get-started/images/i4e_expresssetup_alldone.PNG
deleted file mode 100644
index e53e4e1d3c..0000000000
Binary files a/education/get-started/images/i4e_expresssetup_alldone.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expresssetup_chooseapps.PNG b/education/get-started/images/i4e_expresssetup_chooseapps.PNG
deleted file mode 100644
index e7eeb0c59a..0000000000
Binary files a/education/get-started/images/i4e_expresssetup_chooseapps.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expresssetup_chooseapps_apps_chosen.PNG b/education/get-started/images/i4e_expresssetup_chooseapps_apps_chosen.PNG
deleted file mode 100644
index 1e5d6e53d1..0000000000
Binary files a/education/get-started/images/i4e_expresssetup_chooseapps_apps_chosen.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expresssetup_chooseapps_appschosen.PNG b/education/get-started/images/i4e_expresssetup_chooseapps_appschosen.PNG
deleted file mode 100644
index e08d5bd572..0000000000
Binary files a/education/get-started/images/i4e_expresssetup_chooseapps_appschosen.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expresssetup_chooseapps_new.PNG b/education/get-started/images/i4e_expresssetup_chooseapps_new.PNG
deleted file mode 100644
index 254f18813b..0000000000
Binary files a/education/get-started/images/i4e_expresssetup_chooseapps_new.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expresssetup_choosebuttontogoback.PNG b/education/get-started/images/i4e_expresssetup_choosebuttontogoback.PNG
deleted file mode 100644
index 1580c4382e..0000000000
Binary files a/education/get-started/images/i4e_expresssetup_choosebuttontogoback.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expresssetup_choosesettings.PNG b/education/get-started/images/i4e_expresssetup_choosesettings.PNG
deleted file mode 100644
index 16b2a086e7..0000000000
Binary files a/education/get-started/images/i4e_expresssetup_choosesettings.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expresssetup_choosesettings_additionalsettings.PNG b/education/get-started/images/i4e_expresssetup_choosesettings_additionalsettings.PNG
deleted file mode 100644
index 749823c21e..0000000000
Binary files a/education/get-started/images/i4e_expresssetup_choosesettings_additionalsettings.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expresssetup_endofsetup.PNG b/education/get-started/images/i4e_expresssetup_endofsetup.PNG
deleted file mode 100644
index e9f2fa4b24..0000000000
Binary files a/education/get-started/images/i4e_expresssetup_endofsetup.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expresssetup_getschoolinfo.PNG b/education/get-started/images/i4e_expresssetup_getschoolinfo.PNG
deleted file mode 100644
index e230f260c9..0000000000
Binary files a/education/get-started/images/i4e_expresssetup_getschoolinfo.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expresssetup_getstarted.PNG b/education/get-started/images/i4e_expresssetup_getstarted.PNG
deleted file mode 100644
index 6ce576aaa9..0000000000
Binary files a/education/get-started/images/i4e_expresssetup_getstarted.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_expresssetup_sdsconfigured.PNG b/education/get-started/images/i4e_expresssetup_sdsconfigured.PNG
deleted file mode 100644
index c9ef184d9d..0000000000
Binary files a/education/get-started/images/i4e_expresssetup_sdsconfigured.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups.PNG b/education/get-started/images/i4e_groups.PNG
deleted file mode 100644
index ed429844ae..0000000000
Binary files a/education/get-started/images/i4e_groups.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_alldevices_aadjoined_list.PNG b/education/get-started/images/i4e_groups_alldevices_aadjoined_list.PNG
deleted file mode 100644
index 6e87a4fa5a..0000000000
Binary files a/education/get-started/images/i4e_groups_alldevices_aadjoined_list.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_alldevices_list.PNG b/education/get-started/images/i4e_groups_alldevices_list.PNG
deleted file mode 100644
index 8fbf5ddd7b..0000000000
Binary files a/education/get-started/images/i4e_groups_alldevices_list.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_alldevices_listofaadjdevices.png b/education/get-started/images/i4e_groups_alldevices_listofaadjdevices.png
deleted file mode 100644
index d59b8a7b70..0000000000
Binary files a/education/get-started/images/i4e_groups_alldevices_listofaadjdevices.png and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_allusers_apps.PNG b/education/get-started/images/i4e_groups_allusers_apps.PNG
deleted file mode 100644
index 7047f51bc1..0000000000
Binary files a/education/get-started/images/i4e_groups_allusers_apps.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_allusers_apps_appstodeploy.PNG b/education/get-started/images/i4e_groups_allusers_apps_appstodeploy.PNG
deleted file mode 100644
index 3a0ae4645d..0000000000
Binary files a/education/get-started/images/i4e_groups_allusers_apps_appstodeploy.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_allusers_apps_edit.PNG b/education/get-started/images/i4e_groups_allusers_apps_edit.PNG
deleted file mode 100644
index cace903c13..0000000000
Binary files a/education/get-started/images/i4e_groups_allusers_apps_edit.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_allusers_apps_updatedlist.PNG b/education/get-started/images/i4e_groups_allusers_apps_updatedlist.PNG
deleted file mode 100644
index a25a1fb432..0000000000
Binary files a/education/get-started/images/i4e_groups_allusers_apps_updatedlist.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_allusers_appspage.PNG b/education/get-started/images/i4e_groups_allusers_appspage.PNG
deleted file mode 100644
index 5c81a54283..0000000000
Binary files a/education/get-started/images/i4e_groups_allusers_appspage.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_allusers_appspage_editapps.png b/education/get-started/images/i4e_groups_allusers_appspage_editapps.png
deleted file mode 100644
index 3935807ff8..0000000000
Binary files a/education/get-started/images/i4e_groups_allusers_appspage_editapps.png and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_allusers_list.PNG b/education/get-started/images/i4e_groups_allusers_list.PNG
deleted file mode 100644
index b28969d4e8..0000000000
Binary files a/education/get-started/images/i4e_groups_allusers_list.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_allusers_selectappstodeploy.PNG b/education/get-started/images/i4e_groups_allusers_selectappstodeploy.PNG
deleted file mode 100644
index 65c1dba1e2..0000000000
Binary files a/education/get-started/images/i4e_groups_allusers_selectappstodeploy.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_allusers_updatedappslist.PNG b/education/get-started/images/i4e_groups_allusers_updatedappslist.PNG
deleted file mode 100644
index 0c7bb32fa7..0000000000
Binary files a/education/get-started/images/i4e_groups_allusers_updatedappslist.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_allusers_users.PNG b/education/get-started/images/i4e_groups_allusers_users.PNG
deleted file mode 100644
index 8a94818fbc..0000000000
Binary files a/education/get-started/images/i4e_groups_allusers_users.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_allusers_users_steps.png b/education/get-started/images/i4e_groups_allusers_users_steps.png
deleted file mode 100644
index 2ce85659e0..0000000000
Binary files a/education/get-started/images/i4e_groups_allusers_users_steps.png and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_groups_blade.PNG b/education/get-started/images/i4e_groups_groups_blade.PNG
deleted file mode 100644
index d821aaad2c..0000000000
Binary files a/education/get-started/images/i4e_groups_groups_blade.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_settings_changes.PNG b/education/get-started/images/i4e_groups_settings_changes.PNG
deleted file mode 100644
index fe3c4dd610..0000000000
Binary files a/education/get-started/images/i4e_groups_settings_changes.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groups_settingslist_full.PNG b/education/get-started/images/i4e_groups_settingslist_full.PNG
deleted file mode 100644
index f3efbd9a04..0000000000
Binary files a/education/get-started/images/i4e_groups_settingslist_full.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_groupspage.PNG b/education/get-started/images/i4e_groupspage.PNG
deleted file mode 100644
index 7ee8affebc..0000000000
Binary files a/education/get-started/images/i4e_groupspage.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_new_store_app.PNG b/education/get-started/images/i4e_new_store_app.PNG
deleted file mode 100644
index 1e20501da2..0000000000
Binary files a/education/get-started/images/i4e_new_store_app.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_portal.PNG b/education/get-started/images/i4e_portal.PNG
deleted file mode 100644
index f234e60fff..0000000000
Binary files a/education/get-started/images/i4e_portal.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_takeatestprofile_accountsummary.PNG b/education/get-started/images/i4e_takeatestprofile_accountsummary.PNG
deleted file mode 100644
index e8feb9b5d7..0000000000
Binary files a/education/get-started/images/i4e_takeatestprofile_accountsummary.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_takeatestprofile_addnewprofile.PNG b/education/get-started/images/i4e_takeatestprofile_addnewprofile.PNG
deleted file mode 100644
index 401bccef4a..0000000000
Binary files a/education/get-started/images/i4e_takeatestprofile_addnewprofile.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_takeatestprofile_changegroup_selectgroup.PNG b/education/get-started/images/i4e_takeatestprofile_changegroup_selectgroup.PNG
deleted file mode 100644
index 4c8f0705ce..0000000000
Binary files a/education/get-started/images/i4e_takeatestprofile_changegroup_selectgroup.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_takeatestprofile_groupassignment_selected.PNG b/education/get-started/images/i4e_takeatestprofile_groupassignment_selected.PNG
deleted file mode 100644
index 8431e1d0cf..0000000000
Binary files a/education/get-started/images/i4e_takeatestprofile_groupassignment_selected.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_takeatestprofile_groups_changegroupassignments.PNG b/education/get-started/images/i4e_takeatestprofile_groups_changegroupassignments.PNG
deleted file mode 100644
index 914f0b4edd..0000000000
Binary files a/education/get-started/images/i4e_takeatestprofile_groups_changegroupassignments.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_takeatestprofile_newtestaccount.PNG b/education/get-started/images/i4e_takeatestprofile_newtestaccount.PNG
deleted file mode 100644
index 1ec2f0a2e2..0000000000
Binary files a/education/get-started/images/i4e_takeatestprofile_newtestaccount.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_tenant_settings_force_sync.PNG b/education/get-started/images/i4e_tenant_settings_force_sync.PNG
deleted file mode 100644
index 285c8b236b..0000000000
Binary files a/education/get-started/images/i4e_tenant_settings_force_sync.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_tenantsettings.PNG b/education/get-started/images/i4e_tenantsettings.PNG
deleted file mode 100644
index 90c1a0afde..0000000000
Binary files a/education/get-started/images/i4e_tenantsettings.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_tenantsettings_edit_syncwithstore_on.PNG b/education/get-started/images/i4e_tenantsettings_edit_syncwithstore_on.PNG
deleted file mode 100644
index d06bbde3ef..0000000000
Binary files a/education/get-started/images/i4e_tenantsettings_edit_syncwithstore_on.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_trialsigninpage.png b/education/get-started/images/i4e_trialsigninpage.png
deleted file mode 100644
index 5945ce3170..0000000000
Binary files a/education/get-started/images/i4e_trialsigninpage.png and /dev/null differ
diff --git a/education/get-started/images/i4e_video_thumbnail.PNG b/education/get-started/images/i4e_video_thumbnail.PNG
deleted file mode 100644
index fdec163bca..0000000000
Binary files a/education/get-started/images/i4e_video_thumbnail.PNG and /dev/null differ
diff --git a/education/get-started/images/i4e_video_thumbnail_app.PNG b/education/get-started/images/i4e_video_thumbnail_app.PNG
deleted file mode 100644
index f30ea26067..0000000000
Binary files a/education/get-started/images/i4e_video_thumbnail_app.PNG and /dev/null differ
diff --git a/education/get-started/images/icd-adv-shared-pc.PNG b/education/get-started/images/icd-adv-shared-pc.PNG
deleted file mode 100644
index a8da5fa78a..0000000000
Binary files a/education/get-started/images/icd-adv-shared-pc.PNG and /dev/null differ
diff --git a/education/get-started/images/icd-school-adv-edit.png b/education/get-started/images/icd-school-adv-edit.png
deleted file mode 100644
index 16843cc010..0000000000
Binary files a/education/get-started/images/icd-school-adv-edit.png and /dev/null differ
diff --git a/education/get-started/images/icd-school.PNG b/education/get-started/images/icd-school.PNG
deleted file mode 100644
index e6a944a193..0000000000
Binary files a/education/get-started/images/icd-school.PNG and /dev/null differ
diff --git a/education/get-started/images/icd-simple.PNG b/education/get-started/images/icd-simple.PNG
deleted file mode 100644
index 7ae8a1728b..0000000000
Binary files a/education/get-started/images/icd-simple.PNG and /dev/null differ
diff --git a/education/get-started/images/icdbrowse.png b/education/get-started/images/icdbrowse.png
deleted file mode 100644
index 53c91074c7..0000000000
Binary files a/education/get-started/images/icdbrowse.png and /dev/null differ
diff --git a/education/get-started/images/intune_admin_mdm_storeforbiz.png b/education/get-started/images/intune_admin_mdm_storeforbiz.png
deleted file mode 100644
index d67e95defb..0000000000
Binary files a/education/get-started/images/intune_admin_mdm_storeforbiz.png and /dev/null differ
diff --git a/education/get-started/images/intune_admin_workspace_configure_sync.PNG b/education/get-started/images/intune_admin_workspace_configure_sync.PNG
deleted file mode 100644
index a67c9a096c..0000000000
Binary files a/education/get-started/images/intune_admin_workspace_configure_sync.PNG and /dev/null differ
diff --git a/education/get-started/images/intune_app_deployment_action.png b/education/get-started/images/intune_app_deployment_action.png
deleted file mode 100644
index 7535cf2979..0000000000
Binary files a/education/get-started/images/intune_app_deployment_action.png and /dev/null differ
diff --git a/education/get-started/images/intune_create_general_win10_policy.png b/education/get-started/images/intune_create_general_win10_policy.png
deleted file mode 100644
index fed06848b5..0000000000
Binary files a/education/get-started/images/intune_create_general_win10_policy.png and /dev/null differ
diff --git a/education/get-started/images/intune_create_new_policy.png b/education/get-started/images/intune_create_new_policy.png
deleted file mode 100644
index 544ab5ef22..0000000000
Binary files a/education/get-started/images/intune_create_new_policy.png and /dev/null differ
diff --git a/education/get-started/images/intune_dashboard.png b/education/get-started/images/intune_dashboard.png
deleted file mode 100644
index b5c309259a..0000000000
Binary files a/education/get-started/images/intune_dashboard.png and /dev/null differ
diff --git a/education/get-started/images/intune_device_management_apply_groups.png b/education/get-started/images/intune_device_management_apply_groups.png
deleted file mode 100644
index 0178a26695..0000000000
Binary files a/education/get-started/images/intune_device_management_apply_groups.png and /dev/null differ
diff --git a/education/get-started/images/intune_force_sync.png b/education/get-started/images/intune_force_sync.png
deleted file mode 100644
index 9943be5b5b..0000000000
Binary files a/education/get-started/images/intune_force_sync.png and /dev/null differ
diff --git a/education/get-started/images/intune_management_console_apps_apps.png b/education/get-started/images/intune_management_console_apps_apps.png
deleted file mode 100644
index 5ee6354a01..0000000000
Binary files a/education/get-started/images/intune_management_console_apps_apps.png and /dev/null differ
diff --git a/education/get-started/images/intune_missing_ems_license_error_message.png b/education/get-started/images/intune_missing_ems_license_error_message.png
deleted file mode 100644
index ae441d47ba..0000000000
Binary files a/education/get-started/images/intune_missing_ems_license_error_message.png and /dev/null differ
diff --git a/education/get-started/images/intune_missing_ems_license_errormessage.png b/education/get-started/images/intune_missing_ems_license_errormessage.png
deleted file mode 100644
index e63ceb7b84..0000000000
Binary files a/education/get-started/images/intune_missing_ems_license_errormessage.png and /dev/null differ
diff --git a/education/get-started/images/intune_portal_apps_volume_purchased.png b/education/get-started/images/intune_portal_apps_volume_purchased.png
deleted file mode 100644
index 311fa6e4dd..0000000000
Binary files a/education/get-started/images/intune_portal_apps_volume_purchased.png and /dev/null differ
diff --git a/education/get-started/images/intune_portal_apps_volume_purchased_wsfb_apps.png b/education/get-started/images/intune_portal_apps_volume_purchased_wsfb_apps.png
deleted file mode 100644
index 9c5a2ffae4..0000000000
Binary files a/education/get-started/images/intune_portal_apps_volume_purchased_wsfb_apps.png and /dev/null differ
diff --git a/education/get-started/images/intune_portal_configure_wsfb_app_sync.png b/education/get-started/images/intune_portal_configure_wsfb_app_sync.png
deleted file mode 100644
index aa9b1e2f07..0000000000
Binary files a/education/get-started/images/intune_portal_configure_wsfb_app_sync.png and /dev/null differ
diff --git a/education/get-started/images/intune_portal_direct_managed_devices_list.png b/education/get-started/images/intune_portal_direct_managed_devices_list.png
deleted file mode 100644
index 41b1eddad2..0000000000
Binary files a/education/get-started/images/intune_portal_direct_managed_devices_list.png and /dev/null differ
diff --git a/education/get-started/images/intune_students_group_2.png b/education/get-started/images/intune_students_group_2.png
deleted file mode 100644
index 0d898047d5..0000000000
Binary files a/education/get-started/images/intune_students_group_2.png and /dev/null differ
diff --git a/education/get-started/images/it-get-app.PNG b/education/get-started/images/it-get-app.PNG
deleted file mode 100644
index 9740081ef4..0000000000
Binary files a/education/get-started/images/it-get-app.PNG and /dev/null differ
diff --git a/education/get-started/images/license-terms.png b/education/get-started/images/license-terms.png
deleted file mode 100644
index 8dd34b0a18..0000000000
Binary files a/education/get-started/images/license-terms.png and /dev/null differ
diff --git a/education/get-started/images/lightbulb.png b/education/get-started/images/lightbulb.png
deleted file mode 100644
index 95bea10957..0000000000
Binary files a/education/get-started/images/lightbulb.png and /dev/null differ
diff --git a/education/get-started/images/list.png b/education/get-started/images/list.png
deleted file mode 100644
index 089827c373..0000000000
Binary files a/education/get-started/images/list.png and /dev/null differ
diff --git a/education/get-started/images/mc-assign-to-others-admin.png b/education/get-started/images/mc-assign-to-others-admin.png
deleted file mode 100644
index 907f21d514..0000000000
Binary files a/education/get-started/images/mc-assign-to-others-admin.png and /dev/null differ
diff --git a/education/get-started/images/mc-assign-to-others-teacher.png b/education/get-started/images/mc-assign-to-others-teacher.png
deleted file mode 100644
index 2656e9c784..0000000000
Binary files a/education/get-started/images/mc-assign-to-others-teacher.png and /dev/null differ
diff --git a/education/get-started/images/mc-check-for-updates.png b/education/get-started/images/mc-check-for-updates.png
deleted file mode 100644
index a9a0fbae5f..0000000000
Binary files a/education/get-started/images/mc-check-for-updates.png and /dev/null differ
diff --git a/education/get-started/images/mc-dnld-others-admin.png b/education/get-started/images/mc-dnld-others-admin.png
deleted file mode 100644
index 5e253c20d1..0000000000
Binary files a/education/get-started/images/mc-dnld-others-admin.png and /dev/null differ
diff --git a/education/get-started/images/mc-dnld-others-teacher.png b/education/get-started/images/mc-dnld-others-teacher.png
deleted file mode 100644
index aa5df16595..0000000000
Binary files a/education/get-started/images/mc-dnld-others-teacher.png and /dev/null differ
diff --git a/education/get-started/images/mc-install-for-me-admin.png b/education/get-started/images/mc-install-for-me-admin.png
deleted file mode 100644
index f9194a6188..0000000000
Binary files a/education/get-started/images/mc-install-for-me-admin.png and /dev/null differ
diff --git a/education/get-started/images/mc-install-for-me-teacher.png b/education/get-started/images/mc-install-for-me-teacher.png
deleted file mode 100644
index e303e63660..0000000000
Binary files a/education/get-started/images/mc-install-for-me-teacher.png and /dev/null differ
diff --git a/education/get-started/images/mcee-add-payment-method.png b/education/get-started/images/mcee-add-payment-method.png
deleted file mode 100644
index e583b4eccc..0000000000
Binary files a/education/get-started/images/mcee-add-payment-method.png and /dev/null differ
diff --git a/education/get-started/images/mcee-auto-assign-bd.png b/education/get-started/images/mcee-auto-assign-bd.png
deleted file mode 100644
index b14990583f..0000000000
Binary files a/education/get-started/images/mcee-auto-assign-bd.png and /dev/null differ
diff --git a/education/get-started/images/mcee-auto-assign-legacy.png b/education/get-started/images/mcee-auto-assign-legacy.png
deleted file mode 100644
index 866b37395e..0000000000
Binary files a/education/get-started/images/mcee-auto-assign-legacy.png and /dev/null differ
diff --git a/education/get-started/images/mcee-invoice-bills.PNG b/education/get-started/images/mcee-invoice-bills.PNG
deleted file mode 100644
index 1a07ac3f01..0000000000
Binary files a/education/get-started/images/mcee-invoice-bills.PNG and /dev/null differ
diff --git a/education/get-started/images/mcee-invoice-info.png b/education/get-started/images/mcee-invoice-info.png
deleted file mode 100644
index f4bf29f8b2..0000000000
Binary files a/education/get-started/images/mcee-invoice-info.png and /dev/null differ
diff --git a/education/get-started/images/mcee-view-bills.png b/education/get-started/images/mcee-view-bills.png
deleted file mode 100644
index 5aeff48109..0000000000
Binary files a/education/get-started/images/mcee-view-bills.png and /dev/null differ
diff --git a/education/get-started/images/mes_banner.png b/education/get-started/images/mes_banner.png
deleted file mode 100644
index cc08f278e2..0000000000
Binary files a/education/get-started/images/mes_banner.png and /dev/null differ
diff --git a/education/get-started/images/microsoft-education-get-started-workflow.png b/education/get-started/images/microsoft-education-get-started-workflow.png
deleted file mode 100644
index 46051500a0..0000000000
Binary files a/education/get-started/images/microsoft-education-get-started-workflow.png and /dev/null differ
diff --git a/education/get-started/images/microsoft-education-workflow.png b/education/get-started/images/microsoft-education-workflow.png
deleted file mode 100644
index f15aa3f783..0000000000
Binary files a/education/get-started/images/microsoft-education-workflow.png and /dev/null differ
diff --git a/education/get-started/images/microsoft_education_get_started_workflow.png b/education/get-started/images/microsoft_education_get_started_workflow.png
deleted file mode 100644
index faa0579b44..0000000000
Binary files a/education/get-started/images/microsoft_education_get_started_workflow.png and /dev/null differ
diff --git a/education/get-started/images/microsoft_education_it_getstarted_workflow.png b/education/get-started/images/microsoft_education_it_getstarted_workflow.png
deleted file mode 100644
index ebcaa2add9..0000000000
Binary files a/education/get-started/images/microsoft_education_it_getstarted_workflow.png and /dev/null differ
diff --git a/education/get-started/images/minecraft-admin-permissions.png b/education/get-started/images/minecraft-admin-permissions.png
deleted file mode 100644
index 3051c3dd84..0000000000
Binary files a/education/get-started/images/minecraft-admin-permissions.png and /dev/null differ
diff --git a/education/get-started/images/minecraft-assign-roles-2.png b/education/get-started/images/minecraft-assign-roles-2.png
deleted file mode 100644
index 3ab1d6e072..0000000000
Binary files a/education/get-started/images/minecraft-assign-roles-2.png and /dev/null differ
diff --git a/education/get-started/images/minecraft-assign-roles.png b/education/get-started/images/minecraft-assign-roles.png
deleted file mode 100644
index 5dc396155c..0000000000
Binary files a/education/get-started/images/minecraft-assign-roles.png and /dev/null differ
diff --git a/education/get-started/images/minecraft-assign-to-others.png b/education/get-started/images/minecraft-assign-to-others.png
deleted file mode 100644
index 4e8fba6126..0000000000
Binary files a/education/get-started/images/minecraft-assign-to-others.png and /dev/null differ
diff --git a/education/get-started/images/minecraft-assign-to-people-name.png b/education/get-started/images/minecraft-assign-to-people-name.png
deleted file mode 100644
index 38994cc58f..0000000000
Binary files a/education/get-started/images/minecraft-assign-to-people-name.png and /dev/null differ
diff --git a/education/get-started/images/minecraft-assign-to-people.png b/education/get-started/images/minecraft-assign-to-people.png
deleted file mode 100644
index 0f0e3dcdff..0000000000
Binary files a/education/get-started/images/minecraft-assign-to-people.png and /dev/null differ
diff --git a/education/get-started/images/minecraft-get-the-app.png b/education/get-started/images/minecraft-get-the-app.png
deleted file mode 100644
index 47024aab6c..0000000000
Binary files a/education/get-started/images/minecraft-get-the-app.png and /dev/null differ
diff --git a/education/get-started/images/minecraft-in-windows-store-app.png b/education/get-started/images/minecraft-in-windows-store-app.png
deleted file mode 100644
index e25f2b4df3..0000000000
Binary files a/education/get-started/images/minecraft-in-windows-store-app.png and /dev/null differ
diff --git a/education/get-started/images/minecraft-my-library.png b/education/get-started/images/minecraft-my-library.png
deleted file mode 100644
index 1be1660adb..0000000000
Binary files a/education/get-started/images/minecraft-my-library.png and /dev/null differ
diff --git a/education/get-started/images/minecraft-perms.PNG b/education/get-started/images/minecraft-perms.PNG
deleted file mode 100644
index 1788d6b593..0000000000
Binary files a/education/get-started/images/minecraft-perms.PNG and /dev/null differ
diff --git a/education/get-started/images/minecraft-private-store.png b/education/get-started/images/minecraft-private-store.png
deleted file mode 100644
index 0194d4b955..0000000000
Binary files a/education/get-started/images/minecraft-private-store.png and /dev/null differ
diff --git a/education/get-started/images/minecraft.PNG b/education/get-started/images/minecraft.PNG
deleted file mode 100644
index c758c28ad5..0000000000
Binary files a/education/get-started/images/minecraft.PNG and /dev/null differ
diff --git a/education/get-started/images/mses_get_started_banner.png b/education/get-started/images/mses_get_started_banner.png
deleted file mode 100644
index ca188d738e..0000000000
Binary files a/education/get-started/images/mses_get_started_banner.png and /dev/null differ
diff --git a/education/get-started/images/mses_getstarted_banner.png b/education/get-started/images/mses_getstarted_banner.png
deleted file mode 100644
index 48dde0456c..0000000000
Binary files a/education/get-started/images/mses_getstarted_banner.png and /dev/null differ
diff --git a/education/get-started/images/mses_getstarted_workflow_e2e.png b/education/get-started/images/mses_getstarted_workflow_e2e.png
deleted file mode 100644
index afb328d27d..0000000000
Binary files a/education/get-started/images/mses_getstarted_workflow_e2e.png and /dev/null differ
diff --git a/education/get-started/images/msfe_manage_page.PNG b/education/get-started/images/msfe_manage_page.PNG
deleted file mode 100644
index 04bbc172c4..0000000000
Binary files a/education/get-started/images/msfe_manage_page.PNG and /dev/null differ
diff --git a/education/get-started/images/msfe_manageapps_inventory.PNG b/education/get-started/images/msfe_manageapps_inventory.PNG
deleted file mode 100644
index 20c8e6f750..0000000000
Binary files a/education/get-started/images/msfe_manageapps_inventory.PNG and /dev/null differ
diff --git a/education/get-started/images/msfe_manageapps_inventory_grouped.png b/education/get-started/images/msfe_manageapps_inventory_grouped.png
deleted file mode 100644
index e2376d90b2..0000000000
Binary files a/education/get-started/images/msfe_manageapps_inventory_grouped.png and /dev/null differ
diff --git a/education/get-started/images/msfe_manageapps_inventory_newappsselected.png b/education/get-started/images/msfe_manageapps_inventory_newappsselected.png
deleted file mode 100644
index 1ef47ea1b9..0000000000
Binary files a/education/get-started/images/msfe_manageapps_inventory_newappsselected.png and /dev/null differ
diff --git a/education/get-started/images/msfe_managementtools_activateintune.PNG b/education/get-started/images/msfe_managementtools_activateintune.PNG
deleted file mode 100644
index efae378abd..0000000000
Binary files a/education/get-started/images/msfe_managementtools_activateintune.PNG and /dev/null differ
diff --git a/education/get-started/images/msfe_managepage_storesettings_managementtools.png b/education/get-started/images/msfe_managepage_storesettings_managementtools.png
deleted file mode 100644
index ac88d8e30f..0000000000
Binary files a/education/get-started/images/msfe_managepage_storesettings_managementtools.png and /dev/null differ
diff --git a/education/get-started/images/msfe_managepage_storesettings_managementtoolspng.png b/education/get-started/images/msfe_managepage_storesettings_managementtoolspng.png
deleted file mode 100644
index 77512f45bd..0000000000
Binary files a/education/get-started/images/msfe_managepage_storesettings_managementtoolspng.png and /dev/null differ
diff --git a/education/get-started/images/msfe_services_agreement.PNG b/education/get-started/images/msfe_services_agreement.PNG
deleted file mode 100644
index 1c25eaea3b..0000000000
Binary files a/education/get-started/images/msfe_services_agreement.PNG and /dev/null differ
diff --git a/education/get-started/images/msfe_store_portal.PNG b/education/get-started/images/msfe_store_portal.PNG
deleted file mode 100644
index 51850223e5..0000000000
Binary files a/education/get-started/images/msfe_store_portal.PNG and /dev/null differ
diff --git a/education/get-started/images/msfe_storesettings_select_managementtools.png b/education/get-started/images/msfe_storesettings_select_managementtools.png
deleted file mode 100644
index 06fe6aa274..0000000000
Binary files a/education/get-started/images/msfe_storesettings_select_managementtools.png and /dev/null differ
diff --git a/education/get-started/images/o365_admincenter_gotosetup.PNG b/education/get-started/images/o365_admincenter_gotosetup.PNG
deleted file mode 100644
index aea6f7fdb2..0000000000
Binary files a/education/get-started/images/o365_admincenter_gotosetup.PNG and /dev/null differ
diff --git a/education/get-started/images/o365_admincenter_welcome.PNG b/education/get-started/images/o365_admincenter_welcome.PNG
deleted file mode 100644
index 3f0721263f..0000000000
Binary files a/education/get-started/images/o365_admincenter_welcome.PNG and /dev/null differ
diff --git a/education/get-started/images/o365_assignlicense.PNG b/education/get-started/images/o365_assignlicense.PNG
deleted file mode 100644
index fd33cd2211..0000000000
Binary files a/education/get-started/images/o365_assignlicense.PNG and /dev/null differ
diff --git a/education/get-started/images/o365_assignsdslicense.png b/education/get-started/images/o365_assignsdslicense.png
deleted file mode 100644
index 08b0c0749c..0000000000
Binary files a/education/get-started/images/o365_assignsdslicense.png and /dev/null differ
diff --git a/education/get-started/images/o365_createaccount.PNG b/education/get-started/images/o365_createaccount.PNG
deleted file mode 100644
index 5aa71c9cf9..0000000000
Binary files a/education/get-started/images/o365_createaccount.PNG and /dev/null differ
diff --git a/education/get-started/images/o365_msteams_settings.PNG b/education/get-started/images/o365_msteams_settings.PNG
deleted file mode 100644
index 0e3dab4886..0000000000
Binary files a/education/get-started/images/o365_msteams_settings.PNG and /dev/null differ
diff --git a/education/get-started/images/o365_msteams_turnon.PNG b/education/get-started/images/o365_msteams_turnon.PNG
deleted file mode 100644
index 95588d5031..0000000000
Binary files a/education/get-started/images/o365_msteams_turnon.PNG and /dev/null differ
diff --git a/education/get-started/images/o365_settings_services_msteams.PNG b/education/get-started/images/o365_settings_services_msteams.PNG
deleted file mode 100644
index ca4dee07ac..0000000000
Binary files a/education/get-started/images/o365_settings_services_msteams.PNG and /dev/null differ
diff --git a/education/get-started/images/o365_subscriptions_verifyclassroomsubscription.PNG b/education/get-started/images/o365_subscriptions_verifyclassroomsubscription.PNG
deleted file mode 100644
index 1331ff75ed..0000000000
Binary files a/education/get-started/images/o365_subscriptions_verifyclassroomsubscription.PNG and /dev/null differ
diff --git a/education/get-started/images/office365_admin_center.PNG b/education/get-started/images/office365_admin_center.PNG
deleted file mode 100644
index 099bc314f4..0000000000
Binary files a/education/get-started/images/office365_admin_center.PNG and /dev/null differ
diff --git a/education/get-started/images/office365_admin_center_assign_licenses.png b/education/get-started/images/office365_admin_center_assign_licenses.png
deleted file mode 100644
index 6d20208748..0000000000
Binary files a/education/get-started/images/office365_admin_center_assign_licenses.png and /dev/null differ
diff --git a/education/get-started/images/office365_admin_center_home.png b/education/get-started/images/office365_admin_center_home.png
deleted file mode 100644
index bd2ab02a2c..0000000000
Binary files a/education/get-started/images/office365_admin_center_home.png and /dev/null differ
diff --git a/education/get-started/images/office365_admin_center_product_licenses.png b/education/get-started/images/office365_admin_center_product_licenses.png
deleted file mode 100644
index 11ffabe3ee..0000000000
Binary files a/education/get-started/images/office365_admin_center_product_licenses.png and /dev/null differ
diff --git a/education/get-started/images/office365_admin_portal_add_new_user.png b/education/get-started/images/office365_admin_portal_add_new_user.png
deleted file mode 100644
index b10fbf7660..0000000000
Binary files a/education/get-started/images/office365_admin_portal_add_new_user.png and /dev/null differ
diff --git a/education/get-started/images/office365_create_new_class.png b/education/get-started/images/office365_create_new_class.png
deleted file mode 100644
index 5befb87b99..0000000000
Binary files a/education/get-started/images/office365_create_new_class.png and /dev/null differ
diff --git a/education/get-started/images/office365_start_page_classroom.png b/education/get-started/images/office365_start_page_classroom.png
deleted file mode 100644
index ab229cead1..0000000000
Binary files a/education/get-started/images/office365_start_page_classroom.png and /dev/null differ
diff --git a/education/get-started/images/office365_students_group_2.png b/education/get-started/images/office365_students_group_2.png
deleted file mode 100644
index 6526fd3c8f..0000000000
Binary files a/education/get-started/images/office365_students_group_2.png and /dev/null differ
diff --git a/education/get-started/images/oobe.jpg b/education/get-started/images/oobe.jpg
deleted file mode 100644
index 53a5dab6bf..0000000000
Binary files a/education/get-started/images/oobe.jpg and /dev/null differ
diff --git a/education/get-started/images/package.png b/education/get-started/images/package.png
deleted file mode 100644
index f5e975e3e9..0000000000
Binary files a/education/get-started/images/package.png and /dev/null differ
diff --git a/education/get-started/images/personalize_class_settings.png b/education/get-started/images/personalize_class_settings.png
deleted file mode 100644
index cbe88c9c73..0000000000
Binary files a/education/get-started/images/personalize_class_settings.png and /dev/null differ
diff --git a/education/get-started/images/privacy-contacts-marked.png b/education/get-started/images/privacy-contacts-marked.png
deleted file mode 100644
index 54a3116408..0000000000
Binary files a/education/get-started/images/privacy-contacts-marked.png and /dev/null differ
diff --git a/education/get-started/images/prov.jpg b/education/get-started/images/prov.jpg
deleted file mode 100644
index 1593ccb36b..0000000000
Binary files a/education/get-started/images/prov.jpg and /dev/null differ
diff --git a/education/get-started/images/reconfigure_intune_app_deployment_settings.png b/education/get-started/images/reconfigure_intune_app_deployment_settings.png
deleted file mode 100644
index 90491aacd1..0000000000
Binary files a/education/get-started/images/reconfigure_intune_app_deployment_settings.png and /dev/null differ
diff --git a/education/get-started/images/school.PNG b/education/get-started/images/school.PNG
deleted file mode 100644
index f8be255a05..0000000000
Binary files a/education/get-started/images/school.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_add_new_profile.png b/education/get-started/images/sds_add_new_profile.png
deleted file mode 100644
index 3728b2c8a8..0000000000
Binary files a/education/get-started/images/sds_add_new_profile.png and /dev/null differ
diff --git a/education/get-started/images/sds_add_new_profile_062017.PNG b/education/get-started/images/sds_add_new_profile_062017.PNG
deleted file mode 100644
index 84340eebb8..0000000000
Binary files a/education/get-started/images/sds_add_new_profile_062017.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_add_new_profile_062317.PNG b/education/get-started/images/sds_add_new_profile_062317.PNG
deleted file mode 100644
index 5732ad597d..0000000000
Binary files a/education/get-started/images/sds_add_new_profile_062317.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_add_newprofile.PNG b/education/get-started/images/sds_add_newprofile.PNG
deleted file mode 100644
index 377e82a29b..0000000000
Binary files a/education/get-started/images/sds_add_newprofile.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_addnewprofile_studentoptions.PNG b/education/get-started/images/sds_addnewprofile_studentoptions.PNG
deleted file mode 100644
index bacaed1642..0000000000
Binary files a/education/get-started/images/sds_addnewprofile_studentoptions.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_addnewprofile_syncoptions.PNG b/education/get-started/images/sds_addnewprofile_syncoptions.PNG
deleted file mode 100644
index 4d99545389..0000000000
Binary files a/education/get-started/images/sds_addnewprofile_syncoptions.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_addnewprofile_teacheroptions.PNG b/education/get-started/images/sds_addnewprofile_teacheroptions.PNG
deleted file mode 100644
index 0a4896048e..0000000000
Binary files a/education/get-started/images/sds_addnewprofile_teacheroptions.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_github_downloadsample.PNG b/education/get-started/images/sds_github_downloadsample.PNG
deleted file mode 100644
index f3f1d33065..0000000000
Binary files a/education/get-started/images/sds_github_downloadsample.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_github_downloadsampledata.PNG b/education/get-started/images/sds_github_downloadsampledata.PNG
deleted file mode 100644
index a83093879b..0000000000
Binary files a/education/get-started/images/sds_github_downloadsampledata.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_more_menu_items.PNG b/education/get-started/images/sds_more_menu_items.PNG
deleted file mode 100644
index 1cb1a083ee..0000000000
Binary files a/education/get-started/images/sds_more_menu_items.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_portal.PNG b/education/get-started/images/sds_portal.PNG
deleted file mode 100644
index c7a47f2d7d..0000000000
Binary files a/education/get-started/images/sds_portal.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_directoryoptions.PNG b/education/get-started/images/sds_profile_directoryoptions.PNG
deleted file mode 100644
index dc1925ecc5..0000000000
Binary files a/education/get-started/images/sds_profile_directoryoptions.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_profilepage.PNG b/education/get-started/images/sds_profile_profilepage.PNG
deleted file mode 100644
index 04e2193189..0000000000
Binary files a/education/get-started/images/sds_profile_profilepage.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_profilepage_062017.PNG b/education/get-started/images/sds_profile_profilepage_062017.PNG
deleted file mode 100644
index 8621592542..0000000000
Binary files a/education/get-started/images/sds_profile_profilepage_062017.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_profilepage_settingup_062317.PNG b/education/get-started/images/sds_profile_profilepage_settingup_062317.PNG
deleted file mode 100644
index 90fe34dbee..0000000000
Binary files a/education/get-started/images/sds_profile_profilepage_settingup_062317.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_ready_for_sync.png b/education/get-started/images/sds_profile_ready_for_sync.png
deleted file mode 100644
index f0d39b25c3..0000000000
Binary files a/education/get-started/images/sds_profile_ready_for_sync.png and /dev/null differ
diff --git a/education/get-started/images/sds_profile_readytosync.PNG b/education/get-started/images/sds_profile_readytosync.PNG
deleted file mode 100644
index 4e0c127208..0000000000
Binary files a/education/get-started/images/sds_profile_readytosync.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_reviewpage_062317.PNG b/education/get-started/images/sds_profile_reviewpage_062317.PNG
deleted file mode 100644
index 676bed0efc..0000000000
Binary files a/education/get-started/images/sds_profile_reviewpage_062317.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_settingup.PNG b/education/get-started/images/sds_profile_settingup.PNG
deleted file mode 100644
index 19f3666b96..0000000000
Binary files a/education/get-started/images/sds_profile_settingup.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_status_everythingok_062317.png b/education/get-started/images/sds_profile_status_everythingok_062317.png
deleted file mode 100644
index cdb487aced..0000000000
Binary files a/education/get-started/images/sds_profile_status_everythingok_062317.png and /dev/null differ
diff --git a/education/get-started/images/sds_profile_status_syncerrors_062317.PNG b/education/get-started/images/sds_profile_status_syncerrors_062317.PNG
deleted file mode 100644
index 6ae7ec5a31..0000000000
Binary files a/education/get-started/images/sds_profile_status_syncerrors_062317.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_status_syncerrors_highlighted_062317.png b/education/get-started/images/sds_profile_status_syncerrors_highlighted_062317.png
deleted file mode 100644
index 2cd58a3b21..0000000000
Binary files a/education/get-started/images/sds_profile_status_syncerrors_highlighted_062317.png and /dev/null differ
diff --git a/education/get-started/images/sds_profile_status_syncinprogress_062317.PNG b/education/get-started/images/sds_profile_status_syncinprogress_062317.PNG
deleted file mode 100644
index 2fd6208eca..0000000000
Binary files a/education/get-started/images/sds_profile_status_syncinprogress_062317.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_status_syncinprogress_highlighted_062317.png b/education/get-started/images/sds_profile_status_syncinprogress_highlighted_062317.png
deleted file mode 100644
index 407744d066..0000000000
Binary files a/education/get-started/images/sds_profile_status_syncinprogress_highlighted_062317.png and /dev/null differ
diff --git a/education/get-started/images/sds_profile_student_options_062017.PNG b/education/get-started/images/sds_profile_student_options_062017.PNG
deleted file mode 100644
index 4affc4dbfd..0000000000
Binary files a/education/get-started/images/sds_profile_student_options_062017.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_student_options_062317.PNG b/education/get-started/images/sds_profile_student_options_062317.PNG
deleted file mode 100644
index 0d2102be7d..0000000000
Binary files a/education/get-started/images/sds_profile_student_options_062317.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_studentoptions.PNG b/education/get-started/images/sds_profile_studentoptions.PNG
deleted file mode 100644
index 87558a3881..0000000000
Binary files a/education/get-started/images/sds_profile_studentoptions.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_sync_options_062017.PNG b/education/get-started/images/sds_profile_sync_options_062017.PNG
deleted file mode 100644
index 71df6f3d24..0000000000
Binary files a/education/get-started/images/sds_profile_sync_options_062017.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_sync_options_062317.PNG b/education/get-started/images/sds_profile_sync_options_062317.PNG
deleted file mode 100644
index 1d02a0659a..0000000000
Binary files a/education/get-started/images/sds_profile_sync_options_062317.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_syncenabled.PNG b/education/get-started/images/sds_profile_syncenabled.PNG
deleted file mode 100644
index 197d2f0851..0000000000
Binary files a/education/get-started/images/sds_profile_syncenabled.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_syncoptions.PNG b/education/get-started/images/sds_profile_syncoptions.PNG
deleted file mode 100644
index f7cd01262f..0000000000
Binary files a/education/get-started/images/sds_profile_syncoptions.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_teacher_options_062017.PNG b/education/get-started/images/sds_profile_teacher_options_062017.PNG
deleted file mode 100644
index 7c8bdfae25..0000000000
Binary files a/education/get-started/images/sds_profile_teacher_options_062017.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_teacher_options_062317.PNG b/education/get-started/images/sds_profile_teacher_options_062317.PNG
deleted file mode 100644
index ab9f2706b1..0000000000
Binary files a/education/get-started/images/sds_profile_teacher_options_062317.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_teacheroptions.PNG b/education/get-started/images/sds_profile_teacheroptions.PNG
deleted file mode 100644
index 0a01ed2f96..0000000000
Binary files a/education/get-started/images/sds_profile_teacheroptions.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profile_wizard_start.PNG b/education/get-started/images/sds_profile_wizard_start.PNG
deleted file mode 100644
index 7b2a797e5d..0000000000
Binary files a/education/get-started/images/sds_profile_wizard_start.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_profilepage.PNG b/education/get-started/images/sds_profilepage.PNG
deleted file mode 100644
index 6e0047a2b1..0000000000
Binary files a/education/get-started/images/sds_profilepage.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_sample_csv_files.PNG b/education/get-started/images/sds_sample_csv_files.PNG
deleted file mode 100644
index fbb37cec96..0000000000
Binary files a/education/get-started/images/sds_sample_csv_files.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_sample_csv_files_us_uk.PNG b/education/get-started/images/sds_sample_csv_files_us_uk.PNG
deleted file mode 100644
index 349ee1366d..0000000000
Binary files a/education/get-started/images/sds_sample_csv_files_us_uk.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_sample_csvfiles.PNG b/education/get-started/images/sds_sample_csvfiles.PNG
deleted file mode 100644
index e4932d9303..0000000000
Binary files a/education/get-started/images/sds_sample_csvfiles.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_sds_and_classroom_off.PNG b/education/get-started/images/sds_sds_and_classroom_off.PNG
deleted file mode 100644
index 0b5409752d..0000000000
Binary files a/education/get-started/images/sds_sds_and_classroom_off.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_sds_on_newmenu_items.PNG b/education/get-started/images/sds_sds_on_newmenu_items.PNG
deleted file mode 100644
index d6f2f9a79e..0000000000
Binary files a/education/get-started/images/sds_sds_on_newmenu_items.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_sds_on_newmenuitemsappear.PNG b/education/get-started/images/sds_sds_on_newmenuitemsappear.PNG
deleted file mode 100644
index bec27dc781..0000000000
Binary files a/education/get-started/images/sds_sds_on_newmenuitemsappear.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_settings_first_signin.png b/education/get-started/images/sds_settings_first_signin.png
deleted file mode 100644
index c60628fcd1..0000000000
Binary files a/education/get-started/images/sds_settings_first_signin.png and /dev/null differ
diff --git a/education/get-started/images/sds_settings_manage_sds_firstsignin.PNG b/education/get-started/images/sds_settings_manage_sds_firstsignin.PNG
deleted file mode 100644
index 6298721880..0000000000
Binary files a/education/get-started/images/sds_settings_manage_sds_firstsignin.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_settings_turnon_sds.png b/education/get-started/images/sds_settings_turnon_sds.png
deleted file mode 100644
index 53c0c144a2..0000000000
Binary files a/education/get-started/images/sds_settings_turnon_sds.png and /dev/null differ
diff --git a/education/get-started/images/sds_signin_settings.PNG b/education/get-started/images/sds_signin_settings.PNG
deleted file mode 100644
index 54ff453249..0000000000
Binary files a/education/get-started/images/sds_signin_settings.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_updated_addnewprofile.PNG b/education/get-started/images/sds_updated_addnewprofile.PNG
deleted file mode 100644
index a3e2f5cea2..0000000000
Binary files a/education/get-started/images/sds_updated_addnewprofile.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_updated_dashboard.PNG b/education/get-started/images/sds_updated_dashboard.PNG
deleted file mode 100644
index 8c5c21afb1..0000000000
Binary files a/education/get-started/images/sds_updated_dashboard.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_updated_menu.png b/education/get-started/images/sds_updated_menu.png
deleted file mode 100644
index d4e066300f..0000000000
Binary files a/education/get-started/images/sds_updated_menu.png and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_name_syncmethod.PNG b/education/get-started/images/sds_updated_newprofile_name_syncmethod.PNG
deleted file mode 100644
index 47c9906eb2..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_name_syncmethod.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_readytosync.png b/education/get-started/images/sds_updated_newprofile_readytosync.png
deleted file mode 100644
index e10d725544..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_readytosync.png and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_review_1.PNG b/education/get-started/images/sds_updated_newprofile_review_1.PNG
deleted file mode 100644
index f05ace66db..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_review_1.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_status_readytosync.png b/education/get-started/images/sds_updated_newprofile_status_readytosync.png
deleted file mode 100644
index e6424e3aa9..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_status_readytosync.png and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_studentmapping.PNG b/education/get-started/images/sds_updated_newprofile_studentmapping.PNG
deleted file mode 100644
index 97742bc9f1..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_studentmapping.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_studentmapping_1.PNG b/education/get-started/images/sds_updated_newprofile_studentmapping_1.PNG
deleted file mode 100644
index 21efeb8bd7..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_studentmapping_1.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_studentmapping_updated.png b/education/get-started/images/sds_updated_newprofile_studentmapping_updated.png
deleted file mode 100644
index 0a9a3682a0..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_studentmapping_updated.png and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_summary.PNG b/education/get-started/images/sds_updated_newprofile_summary.PNG
deleted file mode 100644
index 3aeb90d58d..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_summary.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_syncoptions.PNG b/education/get-started/images/sds_updated_newprofile_syncoptions.PNG
deleted file mode 100644
index 4deea4b14e..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_syncoptions.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_syncoptions_1.PNG b/education/get-started/images/sds_updated_newprofile_syncoptions_1.PNG
deleted file mode 100644
index 507eab115f..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_syncoptions_1.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_syncoptions_updated.png b/education/get-started/images/sds_updated_newprofile_syncoptions_updated.png
deleted file mode 100644
index ef36b45626..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_syncoptions_updated.png and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_teachermapping.PNG b/education/get-started/images/sds_updated_newprofile_teachermapping.PNG
deleted file mode 100644
index f99947e982..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_teachermapping.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_teachermapping_1.PNG b/education/get-started/images/sds_updated_newprofile_teachermapping_1.PNG
deleted file mode 100644
index 6f100a8afe..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_teachermapping_1.PNG and /dev/null differ
diff --git a/education/get-started/images/sds_updated_newprofile_teachermapping_updated.png b/education/get-started/images/sds_updated_newprofile_teachermapping_updated.png
deleted file mode 100644
index 6d625cc1a9..0000000000
Binary files a/education/get-started/images/sds_updated_newprofile_teachermapping_updated.png and /dev/null differ
diff --git a/education/get-started/images/set_up_school_pcs_app.png b/education/get-started/images/set_up_school_pcs_app.png
deleted file mode 100644
index b0a2a42112..0000000000
Binary files a/education/get-started/images/set_up_school_pcs_app.png and /dev/null differ
diff --git a/education/get-started/images/setedupolicies_omauri.PNG b/education/get-started/images/setedupolicies_omauri.PNG
deleted file mode 100644
index eb3d9e216c..0000000000
Binary files a/education/get-started/images/setedupolicies_omauri.PNG and /dev/null differ
diff --git a/education/get-started/images/setedupolicies_wcd.PNG b/education/get-started/images/setedupolicies_wcd.PNG
deleted file mode 100644
index e240063f68..0000000000
Binary files a/education/get-started/images/setedupolicies_wcd.PNG and /dev/null differ
diff --git a/education/get-started/images/settings-contacts-app-marked.png b/education/get-started/images/settings-contacts-app-marked.png
deleted file mode 100644
index 94523f1b36..0000000000
Binary files a/education/get-started/images/settings-contacts-app-marked.png and /dev/null differ
diff --git a/education/get-started/images/settings-privacy-marked.png b/education/get-started/images/settings-privacy-marked.png
deleted file mode 100644
index 513e9b1afc..0000000000
Binary files a/education/get-started/images/settings-privacy-marked.png and /dev/null differ
diff --git a/education/get-started/images/setup-app-1-access.png b/education/get-started/images/setup-app-1-access.png
deleted file mode 100644
index 1de1081d1d..0000000000
Binary files a/education/get-started/images/setup-app-1-access.png and /dev/null differ
diff --git a/education/get-started/images/setup-app-1-usb.png b/education/get-started/images/setup-app-1-usb.png
deleted file mode 100644
index b2d170244f..0000000000
Binary files a/education/get-started/images/setup-app-1-usb.png and /dev/null differ
diff --git a/education/get-started/images/setup-app-1-wifi-manual.png b/education/get-started/images/setup-app-1-wifi-manual.png
deleted file mode 100644
index 92de4f784c..0000000000
Binary files a/education/get-started/images/setup-app-1-wifi-manual.png and /dev/null differ
diff --git a/education/get-started/images/setup-app-1-wifi.png b/education/get-started/images/setup-app-1-wifi.png
deleted file mode 100644
index 9f305e081c..0000000000
Binary files a/education/get-started/images/setup-app-1-wifi.png and /dev/null differ
diff --git a/education/get-started/images/setup-app-1.PNG b/education/get-started/images/setup-app-1.PNG
deleted file mode 100644
index 1b88c5ac31..0000000000
Binary files a/education/get-started/images/setup-app-1.PNG and /dev/null differ
diff --git a/education/get-started/images/setup-app-2-directions.png b/education/get-started/images/setup-app-2-directions.png
deleted file mode 100644
index f245aafb2b..0000000000
Binary files a/education/get-started/images/setup-app-2-directions.png and /dev/null differ
diff --git a/education/get-started/images/setup-app-3-directions.png b/education/get-started/images/setup-app-3-directions.png
deleted file mode 100644
index f593ea7371..0000000000
Binary files a/education/get-started/images/setup-app-3-directions.png and /dev/null differ
diff --git a/education/get-started/images/setup-app-all-done.png b/education/get-started/images/setup-app-all-done.png
deleted file mode 100644
index af7343f0e5..0000000000
Binary files a/education/get-started/images/setup-app-all-done.png and /dev/null differ
diff --git a/education/get-started/images/setup-options.png b/education/get-started/images/setup-options.png
deleted file mode 100644
index 07d29576a0..0000000000
Binary files a/education/get-started/images/setup-options.png and /dev/null differ
diff --git a/education/get-started/images/setup_class_notebook.png b/education/get-started/images/setup_class_notebook.png
deleted file mode 100644
index 2ede37e177..0000000000
Binary files a/education/get-started/images/setup_class_notebook.png and /dev/null differ
diff --git a/education/get-started/images/setupmsg.jpg b/education/get-started/images/setupmsg.jpg
deleted file mode 100644
index 12935483c5..0000000000
Binary files a/education/get-started/images/setupmsg.jpg and /dev/null differ
diff --git a/education/get-started/images/sign-in-prov.png b/education/get-started/images/sign-in-prov.png
deleted file mode 100644
index 55c9276203..0000000000
Binary files a/education/get-started/images/sign-in-prov.png and /dev/null differ
diff --git a/education/get-started/images/signin.jpg b/education/get-started/images/signin.jpg
deleted file mode 100644
index ad31bb31c4..0000000000
Binary files a/education/get-started/images/signin.jpg and /dev/null differ
diff --git a/education/get-started/images/skype-manage-profile-pic.png b/education/get-started/images/skype-manage-profile-pic.png
deleted file mode 100644
index 4133ac9c60..0000000000
Binary files a/education/get-started/images/skype-manage-profile-pic.png and /dev/null differ
diff --git a/education/get-started/images/skype-profile-icon.png b/education/get-started/images/skype-profile-icon.png
deleted file mode 100644
index 7ccaaea693..0000000000
Binary files a/education/get-started/images/skype-profile-icon.png and /dev/null differ
diff --git a/education/get-started/images/skype_uwp_manageprofilepic.PNG b/education/get-started/images/skype_uwp_manageprofilepic.PNG
deleted file mode 100644
index bdcf23dbc2..0000000000
Binary files a/education/get-started/images/skype_uwp_manageprofilepic.PNG and /dev/null differ
diff --git a/education/get-started/images/skype_uwp_userprofile_icon.PNG b/education/get-started/images/skype_uwp_userprofile_icon.PNG
deleted file mode 100644
index ad36c7f886..0000000000
Binary files a/education/get-started/images/skype_uwp_userprofile_icon.PNG and /dev/null differ
diff --git a/education/get-started/images/store_for_business_management_tool_activation.png b/education/get-started/images/store_for_business_management_tool_activation.png
deleted file mode 100644
index 9c68d4efe6..0000000000
Binary files a/education/get-started/images/store_for_business_management_tool_activation.png and /dev/null differ
diff --git a/education/get-started/images/suspc_account_signin.PNG b/education/get-started/images/suspc_account_signin.PNG
deleted file mode 100644
index d045cff914..0000000000
Binary files a/education/get-started/images/suspc_account_signin.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_and_wcd_comparison.png b/education/get-started/images/suspc_and_wcd_comparison.png
deleted file mode 100644
index cff874ceb8..0000000000
Binary files a/education/get-started/images/suspc_and_wcd_comparison.png and /dev/null differ
diff --git a/education/get-started/images/suspc_choosesettings_apps.PNG b/education/get-started/images/suspc_choosesettings_apps.PNG
deleted file mode 100644
index babb55a445..0000000000
Binary files a/education/get-started/images/suspc_choosesettings_apps.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_choosesettings_settings.PNG b/education/get-started/images/suspc_choosesettings_settings.PNG
deleted file mode 100644
index bd556c0892..0000000000
Binary files a/education/get-started/images/suspc_choosesettings_settings.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_choosesettings_settings_updated.PNG b/education/get-started/images/suspc_choosesettings_settings_updated.PNG
deleted file mode 100644
index c62b4fa86f..0000000000
Binary files a/education/get-started/images/suspc_choosesettings_settings_updated.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_choosesettings_setuptakeatest.PNG b/education/get-started/images/suspc_choosesettings_setuptakeatest.PNG
deleted file mode 100644
index 8ffc3fe3e6..0000000000
Binary files a/education/get-started/images/suspc_choosesettings_setuptakeatest.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_choosesettings_signin.PNG b/education/get-started/images/suspc_choosesettings_signin.PNG
deleted file mode 100644
index a45a12fbf5..0000000000
Binary files a/education/get-started/images/suspc_choosesettings_signin.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_choosesettings_signin_final.PNG b/education/get-started/images/suspc_choosesettings_signin_final.PNG
deleted file mode 100644
index 3ec997cb73..0000000000
Binary files a/education/get-started/images/suspc_choosesettings_signin_final.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_choosesettings_summary.PNG b/education/get-started/images/suspc_choosesettings_summary.PNG
deleted file mode 100644
index c659a579e4..0000000000
Binary files a/education/get-started/images/suspc_choosesettings_summary.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_choosesettings_takeatest.PNG b/education/get-started/images/suspc_choosesettings_takeatest.PNG
deleted file mode 100644
index 9f9f028852..0000000000
Binary files a/education/get-started/images/suspc_choosesettings_takeatest.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_choosesettings_takeatest_updated.png b/education/get-started/images/suspc_choosesettings_takeatest_updated.png
deleted file mode 100644
index e44dd21207..0000000000
Binary files a/education/get-started/images/suspc_choosesettings_takeatest_updated.png and /dev/null differ
diff --git a/education/get-started/images/suspc_getpcsready.PNG b/education/get-started/images/suspc_getpcsready.PNG
deleted file mode 100644
index 1e2bfae0ff..0000000000
Binary files a/education/get-started/images/suspc_getpcsready.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_getpcsready_getpcsready.PNG b/education/get-started/images/suspc_getpcsready_getpcsready.PNG
deleted file mode 100644
index 6bb9ec078b..0000000000
Binary files a/education/get-started/images/suspc_getpcsready_getpcsready.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_getpcsready_installpackage.PNG b/education/get-started/images/suspc_getpcsready_installpackage.PNG
deleted file mode 100644
index c12bbe4de9..0000000000
Binary files a/education/get-started/images/suspc_getpcsready_installpackage.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_getstarted.PNG b/education/get-started/images/suspc_getstarted.PNG
deleted file mode 100644
index cbb3d4977c..0000000000
Binary files a/education/get-started/images/suspc_getstarted.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_getstarted_050817.PNG b/education/get-started/images/suspc_getstarted_050817.PNG
deleted file mode 100644
index 124905676a..0000000000
Binary files a/education/get-started/images/suspc_getstarted_050817.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_getstarted_final.PNG b/education/get-started/images/suspc_getstarted_final.PNG
deleted file mode 100644
index d533536ad1..0000000000
Binary files a/education/get-started/images/suspc_getstarted_final.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_getstarted_resized.png b/education/get-started/images/suspc_getstarted_resized.png
deleted file mode 100644
index c9c99d8555..0000000000
Binary files a/education/get-started/images/suspc_getstarted_resized.png and /dev/null differ
diff --git a/education/get-started/images/suspc_installsetupfile.PNG b/education/get-started/images/suspc_installsetupfile.PNG
deleted file mode 100644
index 61d0d9a3ad..0000000000
Binary files a/education/get-started/images/suspc_installsetupfile.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_ppkg_isready.PNG b/education/get-started/images/suspc_ppkg_isready.PNG
deleted file mode 100644
index e601a05a0f..0000000000
Binary files a/education/get-started/images/suspc_ppkg_isready.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_ppkgready.PNG b/education/get-started/images/suspc_ppkgready.PNG
deleted file mode 100644
index e285acdaee..0000000000
Binary files a/education/get-started/images/suspc_ppkgready.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_reviewsettings.PNG b/education/get-started/images/suspc_reviewsettings.PNG
deleted file mode 100644
index 0948dbccb1..0000000000
Binary files a/education/get-started/images/suspc_reviewsettings.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_reviewsettings_bluelinks.png b/education/get-started/images/suspc_reviewsettings_bluelinks.png
deleted file mode 100644
index 46c07c7a1a..0000000000
Binary files a/education/get-started/images/suspc_reviewsettings_bluelinks.png and /dev/null differ
diff --git a/education/get-started/images/suspc_savepackage_insertusb.PNG b/education/get-started/images/suspc_savepackage_insertusb.PNG
deleted file mode 100644
index e5f9968d7e..0000000000
Binary files a/education/get-started/images/suspc_savepackage_insertusb.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_savesettings.PNG b/education/get-started/images/suspc_savesettings.PNG
deleted file mode 100644
index f8338d3dec..0000000000
Binary files a/education/get-started/images/suspc_savesettings.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_setup_removemediamessage.png b/education/get-started/images/suspc_setup_removemediamessage.png
deleted file mode 100644
index 94e9ddb900..0000000000
Binary files a/education/get-started/images/suspc_setup_removemediamessage.png and /dev/null differ
diff --git a/education/get-started/images/suspc_setupfile_reviewsettings.PNG b/education/get-started/images/suspc_setupfile_reviewsettings.PNG
deleted file mode 100644
index c5f3425ff5..0000000000
Binary files a/education/get-started/images/suspc_setupfile_reviewsettings.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_setupfile_savesettings.PNG b/education/get-started/images/suspc_setupfile_savesettings.PNG
deleted file mode 100644
index 97ba234b8e..0000000000
Binary files a/education/get-started/images/suspc_setupfile_savesettings.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_setupfileready.PNG b/education/get-started/images/suspc_setupfileready.PNG
deleted file mode 100644
index 349acbaf9d..0000000000
Binary files a/education/get-started/images/suspc_setupfileready.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_signin_account.PNG b/education/get-started/images/suspc_signin_account.PNG
deleted file mode 100644
index 3f8b040f45..0000000000
Binary files a/education/get-started/images/suspc_signin_account.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_signin_addapps.PNG b/education/get-started/images/suspc_signin_addapps.PNG
deleted file mode 100644
index 93e572a043..0000000000
Binary files a/education/get-started/images/suspc_signin_addapps.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_signin_allowguests.PNG b/education/get-started/images/suspc_signin_allowguests.PNG
deleted file mode 100644
index 0bd0f69680..0000000000
Binary files a/education/get-started/images/suspc_signin_allowguests.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_signin_setuptakeatest.PNG b/education/get-started/images/suspc_signin_setuptakeatest.PNG
deleted file mode 100644
index 6c8ba1799b..0000000000
Binary files a/education/get-started/images/suspc_signin_setuptakeatest.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_start.PNG b/education/get-started/images/suspc_start.PNG
deleted file mode 100644
index ab34f99a6b..0000000000
Binary files a/education/get-started/images/suspc_start.PNG and /dev/null differ
diff --git a/education/get-started/images/suspc_studentpcsetup_installingsetupfile.png b/education/get-started/images/suspc_studentpcsetup_installingsetupfile.png
deleted file mode 100644
index bbd10c89c4..0000000000
Binary files a/education/get-started/images/suspc_studentpcsetup_installingsetupfile.png and /dev/null differ
diff --git a/education/get-started/images/suspc_wcd_featureslist.png b/education/get-started/images/suspc_wcd_featureslist.png
deleted file mode 100644
index 32b9211799..0000000000
Binary files a/education/get-started/images/suspc_wcd_featureslist.png and /dev/null differ
diff --git a/education/get-started/images/suspc_wcd_sidebyside.png b/education/get-started/images/suspc_wcd_sidebyside.png
deleted file mode 100644
index 7fc108133e..0000000000
Binary files a/education/get-started/images/suspc_wcd_sidebyside.png and /dev/null differ
diff --git a/education/get-started/images/suspc_win10v1703_getstarted.PNG b/education/get-started/images/suspc_win10v1703_getstarted.PNG
deleted file mode 100644
index 2777edfef9..0000000000
Binary files a/education/get-started/images/suspc_win10v1703_getstarted.PNG and /dev/null differ
diff --git a/education/get-started/images/take-a-test-flow.png b/education/get-started/images/take-a-test-flow.png
deleted file mode 100644
index a5135c1822..0000000000
Binary files a/education/get-started/images/take-a-test-flow.png and /dev/null differ
diff --git a/education/get-started/images/take_a_test_flow.png b/education/get-started/images/take_a_test_flow.png
deleted file mode 100644
index 261813c7f8..0000000000
Binary files a/education/get-started/images/take_a_test_flow.png and /dev/null differ
diff --git a/education/get-started/images/take_a_test_flow_dark.png b/education/get-started/images/take_a_test_flow_dark.png
deleted file mode 100644
index 98255e8694..0000000000
Binary files a/education/get-started/images/take_a_test_flow_dark.png and /dev/null differ
diff --git a/education/get-started/images/take_a_test_workflow.png b/education/get-started/images/take_a_test_workflow.png
deleted file mode 100644
index a4c7a84686..0000000000
Binary files a/education/get-started/images/take_a_test_workflow.png and /dev/null differ
diff --git a/education/get-started/images/tat_settingsapp_setupaccount_addtestaccount.PNG b/education/get-started/images/tat_settingsapp_setupaccount_addtestaccount.PNG
deleted file mode 100644
index 66c28eccc7..0000000000
Binary files a/education/get-started/images/tat_settingsapp_setupaccount_addtestaccount.PNG and /dev/null differ
diff --git a/education/get-started/images/tat_settingsapp_setuptesttakingaccount.PNG b/education/get-started/images/tat_settingsapp_setuptesttakingaccount.PNG
deleted file mode 100644
index 70a917d836..0000000000
Binary files a/education/get-started/images/tat_settingsapp_setuptesttakingaccount.PNG and /dev/null differ
diff --git a/education/get-started/images/tat_settingsapp_setuptesttakingaccount_1703.PNG b/education/get-started/images/tat_settingsapp_setuptesttakingaccount_1703.PNG
deleted file mode 100644
index deb04f2e74..0000000000
Binary files a/education/get-started/images/tat_settingsapp_setuptesttakingaccount_1703.PNG and /dev/null differ
diff --git a/education/get-started/images/tat_settingsapp_workorschoolaccess_setuptestaccount.PNG b/education/get-started/images/tat_settingsapp_workorschoolaccess_setuptestaccount.PNG
deleted file mode 100644
index c9221ed95a..0000000000
Binary files a/education/get-started/images/tat_settingsapp_workorschoolaccess_setuptestaccount.PNG and /dev/null differ
diff --git a/education/get-started/images/teacher-get-app.PNG b/education/get-started/images/teacher-get-app.PNG
deleted file mode 100644
index 329607edb9..0000000000
Binary files a/education/get-started/images/teacher-get-app.PNG and /dev/null differ
diff --git a/education/get-started/images/teacher.PNG b/education/get-started/images/teacher.PNG
deleted file mode 100644
index 286d515624..0000000000
Binary files a/education/get-started/images/teacher.PNG and /dev/null differ
diff --git a/education/get-started/images/test-account-icd.PNG b/education/get-started/images/test-account-icd.PNG
deleted file mode 100644
index 4fd9bf3f28..0000000000
Binary files a/education/get-started/images/test-account-icd.PNG and /dev/null differ
diff --git a/education/get-started/images/trust-package.png b/education/get-started/images/trust-package.png
deleted file mode 100644
index 8a293ea4da..0000000000
Binary files a/education/get-started/images/trust-package.png and /dev/null differ
diff --git a/education/get-started/images/uwp-dependencies.PNG b/education/get-started/images/uwp-dependencies.PNG
deleted file mode 100644
index 4e2563169f..0000000000
Binary files a/education/get-started/images/uwp-dependencies.PNG and /dev/null differ
diff --git a/education/get-started/images/uwp-family.PNG b/education/get-started/images/uwp-family.PNG
deleted file mode 100644
index bec731eec4..0000000000
Binary files a/education/get-started/images/uwp-family.PNG and /dev/null differ
diff --git a/education/get-started/images/uwp-license.PNG b/education/get-started/images/uwp-license.PNG
deleted file mode 100644
index ccb5cf7cf4..0000000000
Binary files a/education/get-started/images/uwp-license.PNG and /dev/null differ
diff --git a/education/get-started/images/verify_pc_aad_joined_and_intune_managed.png b/education/get-started/images/verify_pc_aad_joined_and_intune_managed.png
deleted file mode 100644
index 5ee6354a01..0000000000
Binary files a/education/get-started/images/verify_pc_aad_joined_and_intune_managed.png and /dev/null differ
diff --git a/education/get-started/images/wcd_accountmanagement.PNG b/education/get-started/images/wcd_accountmanagement.PNG
deleted file mode 100644
index 071522f906..0000000000
Binary files a/education/get-started/images/wcd_accountmanagement.PNG and /dev/null differ
diff --git a/education/get-started/images/wcd_exportpackage.PNG b/education/get-started/images/wcd_exportpackage.PNG
deleted file mode 100644
index 19a1c89703..0000000000
Binary files a/education/get-started/images/wcd_exportpackage.PNG and /dev/null differ
diff --git a/education/get-started/images/wcd_settings_assignedaccess.PNG b/education/get-started/images/wcd_settings_assignedaccess.PNG
deleted file mode 100644
index 443a5d0688..0000000000
Binary files a/education/get-started/images/wcd_settings_assignedaccess.PNG and /dev/null differ
diff --git a/education/get-started/images/wcd_setupdevice.PNG b/education/get-started/images/wcd_setupdevice.PNG
deleted file mode 100644
index 01422870d4..0000000000
Binary files a/education/get-started/images/wcd_setupdevice.PNG and /dev/null differ
diff --git a/education/get-started/images/wcd_setupnetwork.PNG b/education/get-started/images/wcd_setupnetwork.PNG
deleted file mode 100644
index f0be6908f5..0000000000
Binary files a/education/get-started/images/wcd_setupnetwork.PNG and /dev/null differ
diff --git a/education/get-started/images/wcd_win10v1703_start_newdesktopproject.PNG b/education/get-started/images/wcd_win10v1703_start_newdesktopproject.PNG
deleted file mode 100644
index f0ce8f6b93..0000000000
Binary files a/education/get-started/images/wcd_win10v1703_start_newdesktopproject.PNG and /dev/null differ
diff --git a/education/get-started/images/who-owns-pc.png b/education/get-started/images/who-owns-pc.png
deleted file mode 100644
index d3ce1def8d..0000000000
Binary files a/education/get-started/images/who-owns-pc.png and /dev/null differ
diff --git a/education/get-started/images/win-10-activated-enterprise-subscription-active.png b/education/get-started/images/win-10-activated-enterprise-subscription-active.png
deleted file mode 100644
index eb888b23b5..0000000000
Binary files a/education/get-started/images/win-10-activated-enterprise-subscription-active.png and /dev/null differ
diff --git a/education/get-started/images/win-10-activated-enterprise-subscription-not-active.png b/education/get-started/images/win-10-activated-enterprise-subscription-not-active.png
deleted file mode 100644
index e4ac7398be..0000000000
Binary files a/education/get-started/images/win-10-activated-enterprise-subscription-not-active.png and /dev/null differ
diff --git a/education/get-started/images/win-10-not-activated-enterprise-subscription-active.png b/education/get-started/images/win-10-not-activated-enterprise-subscription-active.png
deleted file mode 100644
index 5fedfe5d06..0000000000
Binary files a/education/get-started/images/win-10-not-activated-enterprise-subscription-active.png and /dev/null differ
diff --git a/education/get-started/images/win-10-not-activated-enterprise-subscription-not-active.png b/education/get-started/images/win-10-not-activated-enterprise-subscription-not-active.png
deleted file mode 100644
index 84e39071db..0000000000
Binary files a/education/get-started/images/win-10-not-activated-enterprise-subscription-not-active.png and /dev/null differ
diff --git a/education/get-started/images/win-10-pro-edu-activated-subscription-active.png b/education/get-started/images/win-10-pro-edu-activated-subscription-active.png
deleted file mode 100644
index d29fa0e0e5..0000000000
Binary files a/education/get-started/images/win-10-pro-edu-activated-subscription-active.png and /dev/null differ
diff --git a/education/get-started/images/win-10-pro-edu-not-activated-subscription-active.PNG b/education/get-started/images/win-10-pro-edu-not-activated-subscription-active.PNG
deleted file mode 100644
index 8e9242c0ba..0000000000
Binary files a/education/get-started/images/win-10-pro-edu-not-activated-subscription-active.PNG and /dev/null differ
diff --git a/education/get-started/images/win10-connect-to-work-or-school.png b/education/get-started/images/win10-connect-to-work-or-school.png
deleted file mode 100644
index 08afb5b092..0000000000
Binary files a/education/get-started/images/win10-connect-to-work-or-school.png and /dev/null differ
diff --git a/education/get-started/images/win10-lets-get-2.png b/education/get-started/images/win10-lets-get-2.png
deleted file mode 100644
index c2d3c3ba61..0000000000
Binary files a/education/get-started/images/win10-lets-get-2.png and /dev/null differ
diff --git a/education/get-started/images/win10-set-up-work-or-school.png b/education/get-started/images/win10-set-up-work-or-school.png
deleted file mode 100644
index 0ca83fb0e1..0000000000
Binary files a/education/get-started/images/win10-set-up-work-or-school.png and /dev/null differ
diff --git a/education/get-started/images/win10_1703_oobe_firstscreen.png b/education/get-started/images/win10_1703_oobe_firstscreen.png
deleted file mode 100644
index 0d5343d0b4..0000000000
Binary files a/education/get-started/images/win10_1703_oobe_firstscreen.png and /dev/null differ
diff --git a/education/get-started/images/win10_confirmaadj.png b/education/get-started/images/win10_confirmaadj.png
deleted file mode 100644
index 410d7a9c81..0000000000
Binary files a/education/get-started/images/win10_confirmaadj.png and /dev/null differ
diff --git a/education/get-started/images/win10_connectedtoorgmdm.png b/education/get-started/images/win10_connectedtoorgmdm.png
deleted file mode 100644
index ea1d0c0c26..0000000000
Binary files a/education/get-started/images/win10_connectedtoorgmdm.png and /dev/null differ
diff --git a/education/get-started/images/win10_letsgetyousignedin.png b/education/get-started/images/win10_letsgetyousignedin.png
deleted file mode 100644
index 8da483d1d3..0000000000
Binary files a/education/get-started/images/win10_letsgetyousignedin.png and /dev/null differ
diff --git a/education/get-started/images/win10_letsstartwithregion.png b/education/get-started/images/win10_letsstartwithregion.png
deleted file mode 100644
index 03b6cc3bbe..0000000000
Binary files a/education/get-started/images/win10_letsstartwithregion.png and /dev/null differ
diff --git a/education/get-started/images/win10_oobe_complete.png b/education/get-started/images/win10_oobe_complete.png
deleted file mode 100644
index 54677a6fc2..0000000000
Binary files a/education/get-started/images/win10_oobe_complete.png and /dev/null differ
diff --git a/education/get-started/images/win10_oobe_letsgetyousignedin.png b/education/get-started/images/win10_oobe_letsgetyousignedin.png
deleted file mode 100644
index fa7407a271..0000000000
Binary files a/education/get-started/images/win10_oobe_letsgetyousignedin.png and /dev/null differ
diff --git a/education/get-started/images/win10_recentlyaddedappslist.png b/education/get-started/images/win10_recentlyaddedappslist.png
deleted file mode 100644
index 2f56f8f500..0000000000
Binary files a/education/get-started/images/win10_recentlyaddedappslist.png and /dev/null differ
diff --git a/education/get-started/images/win10_settings_accounts_aadjoined_confirmation.png b/education/get-started/images/win10_settings_accounts_aadjoined_confirmation.png
deleted file mode 100644
index 0a188d75ed..0000000000
Binary files a/education/get-started/images/win10_settings_accounts_aadjoined_confirmation.png and /dev/null differ
diff --git a/education/get-started/images/win10_settings_privacy.PNG b/education/get-started/images/win10_settings_privacy.PNG
deleted file mode 100644
index 5285ce94f2..0000000000
Binary files a/education/get-started/images/win10_settings_privacy.PNG and /dev/null differ
diff --git a/education/get-started/images/win10_settings_privacy_contacts.PNG b/education/get-started/images/win10_settings_privacy_contacts.PNG
deleted file mode 100644
index f17ef60de0..0000000000
Binary files a/education/get-started/images/win10_settings_privacy_contacts.PNG and /dev/null differ
diff --git a/education/get-started/images/win10_settings_privacy_contacts_apps.png b/education/get-started/images/win10_settings_privacy_contacts_apps.png
deleted file mode 100644
index 774f18fad9..0000000000
Binary files a/education/get-started/images/win10_settings_privacy_contacts_apps.png and /dev/null differ
diff --git a/education/get-started/images/win10_setupforanorg.png b/education/get-started/images/win10_setupforanorg.png
deleted file mode 100644
index 517bf138fb..0000000000
Binary files a/education/get-started/images/win10_setupforanorg.png and /dev/null differ
diff --git a/education/get-started/images/win10_start_checkapps.png b/education/get-started/images/win10_start_checkapps.png
deleted file mode 100644
index 7fd7bd2219..0000000000
Binary files a/education/get-started/images/win10_start_checkapps.png and /dev/null differ
diff --git a/education/get-started/images/windows-10-for-education-banner.png b/education/get-started/images/windows-10-for-education-banner.png
deleted file mode 100644
index cf33adc9b6..0000000000
Binary files a/education/get-started/images/windows-10-for-education-banner.png and /dev/null differ
diff --git a/education/get-started/images/windows-ad-connect.png b/education/get-started/images/windows-ad-connect.png
deleted file mode 100644
index 97a69d1a6c..0000000000
Binary files a/education/get-started/images/windows-ad-connect.png and /dev/null differ
diff --git a/education/get-started/images/windows-choose-how.png b/education/get-started/images/windows-choose-how.png
deleted file mode 100644
index 8e84535bfd..0000000000
Binary files a/education/get-started/images/windows-choose-how.png and /dev/null differ
diff --git a/education/get-started/images/windows-connect-to-work-or-school.png b/education/get-started/images/windows-connect-to-work-or-school.png
deleted file mode 100644
index 90e1b1131f..0000000000
Binary files a/education/get-started/images/windows-connect-to-work-or-school.png and /dev/null differ
diff --git a/education/get-started/images/windows-lets-get-2.png b/education/get-started/images/windows-lets-get-2.png
deleted file mode 100644
index ef523d4af8..0000000000
Binary files a/education/get-started/images/windows-lets-get-2.png and /dev/null differ
diff --git a/education/get-started/images/windows-lets-get.png b/education/get-started/images/windows-lets-get.png
deleted file mode 100644
index 582da1ab2d..0000000000
Binary files a/education/get-started/images/windows-lets-get.png and /dev/null differ
diff --git a/education/get-started/images/windows-set-up-work-or-school.png b/education/get-started/images/windows-set-up-work-or-school.png
deleted file mode 100644
index cebd87cff8..0000000000
Binary files a/education/get-started/images/windows-set-up-work-or-school.png and /dev/null differ
diff --git a/education/get-started/images/windows-sign-in.png b/education/get-started/images/windows-sign-in.png
deleted file mode 100644
index 3029d3ef2b..0000000000
Binary files a/education/get-started/images/windows-sign-in.png and /dev/null differ
diff --git a/education/get-started/images/windows-who-owns.png b/education/get-started/images/windows-who-owns.png
deleted file mode 100644
index c3008869d2..0000000000
Binary files a/education/get-started/images/windows-who-owns.png and /dev/null differ
diff --git a/education/get-started/images/windows.png b/education/get-started/images/windows.png
deleted file mode 100644
index 9b312d7844..0000000000
Binary files a/education/get-started/images/windows.png and /dev/null differ
diff --git a/education/get-started/images/wsfb-minecraft-vl.png b/education/get-started/images/wsfb-minecraft-vl.png
deleted file mode 100644
index e3fe6de6d7..0000000000
Binary files a/education/get-started/images/wsfb-minecraft-vl.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_manage_inventory.PNG b/education/get-started/images/wsfb_manage_inventory.PNG
deleted file mode 100644
index 66bc03d301..0000000000
Binary files a/education/get-started/images/wsfb_manage_inventory.PNG and /dev/null differ
diff --git a/education/get-started/images/wsfb_manage_inventory_annotated.png b/education/get-started/images/wsfb_manage_inventory_annotated.png
deleted file mode 100644
index aa37e0a43f..0000000000
Binary files a/education/get-started/images/wsfb_manage_inventory_annotated.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_newportal.PNG b/education/get-started/images/wsfb_newportal.PNG
deleted file mode 100644
index 3ec546e8bc..0000000000
Binary files a/education/get-started/images/wsfb_newportal.PNG and /dev/null differ
diff --git a/education/get-started/images/wsfb_newportal_manage.PNG b/education/get-started/images/wsfb_newportal_manage.PNG
deleted file mode 100644
index 7aa94bccc9..0000000000
Binary files a/education/get-started/images/wsfb_newportal_manage.PNG and /dev/null differ
diff --git a/education/get-started/images/wsfb_newportal_manage_managementtools_activate.PNG b/education/get-started/images/wsfb_newportal_manage_managementtools_activate.PNG
deleted file mode 100644
index 74b7aec1ff..0000000000
Binary files a/education/get-started/images/wsfb_newportal_manage_managementtools_activate.PNG and /dev/null differ
diff --git a/education/get-started/images/wsfb_newportal_manage_storesettings.PNG b/education/get-started/images/wsfb_newportal_manage_storesettings.PNG
deleted file mode 100644
index 5278b9907e..0000000000
Binary files a/education/get-started/images/wsfb_newportal_manage_storesettings.PNG and /dev/null differ
diff --git a/education/get-started/images/wsfb_portal.png b/education/get-started/images/wsfb_portal.png
deleted file mode 100644
index 2d47885e97..0000000000
Binary files a/education/get-started/images/wsfb_portal.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_portal_activate_intune.PNG b/education/get-started/images/wsfb_portal_activate_intune.PNG
deleted file mode 100644
index 5c05362ebf..0000000000
Binary files a/education/get-started/images/wsfb_portal_activate_intune.PNG and /dev/null differ
diff --git a/education/get-started/images/wsfb_settings_management_tools.png b/education/get-started/images/wsfb_settings_management_tools.png
deleted file mode 100644
index afdb61150b..0000000000
Binary files a/education/get-started/images/wsfb_settings_management_tools.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_win10_pro_education_enabled_for_org.png b/education/get-started/images/wsfb_win10_pro_education_enabled_for_org.png
deleted file mode 100644
index ea3d582d79..0000000000
Binary files a/education/get-started/images/wsfb_win10_pro_education_enabled_for_org.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_win10_pro_education_launch.png b/education/get-started/images/wsfb_win10_pro_education_launch.png
deleted file mode 100644
index 4e7b741227..0000000000
Binary files a/education/get-started/images/wsfb_win10_pro_education_launch.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_win10_pro_education_order_confirmation.png b/education/get-started/images/wsfb_win10_pro_education_order_confirmation.png
deleted file mode 100644
index e35bbf64d5..0000000000
Binary files a/education/get-started/images/wsfb_win10_pro_education_order_confirmation.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_win10_pro_education_order_options.png b/education/get-started/images/wsfb_win10_pro_education_order_options.png
deleted file mode 100644
index eaf93ece33..0000000000
Binary files a/education/get-started/images/wsfb_win10_pro_education_order_options.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_win10_pro_education_refund_confirmation.png b/education/get-started/images/wsfb_win10_pro_education_refund_confirmation.png
deleted file mode 100644
index 4749dafc44..0000000000
Binary files a/education/get-started/images/wsfb_win10_pro_education_refund_confirmation.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_win10_pro_education_refund_order.png b/education/get-started/images/wsfb_win10_pro_education_refund_order.png
deleted file mode 100644
index 813cfce309..0000000000
Binary files a/education/get-started/images/wsfb_win10_pro_education_refund_order.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_disable.png b/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_disable.png
deleted file mode 100644
index 92aeb8ed19..0000000000
Binary files a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_disable.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_eligibility_page.png b/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_eligibility_page.png
deleted file mode 100644
index 177c6e36df..0000000000
Binary files a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_eligibility_page.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_email_global_admins.png b/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_email_global_admins.png
deleted file mode 100644
index 8044a4cc91..0000000000
Binary files a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_email_global_admins.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_enable.png b/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_enable.png
deleted file mode 100644
index 420b44513f..0000000000
Binary files a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_enable.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_summary.png b/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_summary.png
deleted file mode 100644
index a507f56694..0000000000
Binary files a/education/get-started/images/wsfb_win10_pro_to proedu_upgrade_summary.png and /dev/null differ
diff --git a/education/get-started/images/wsfb_win10_pro_to_proedu_email_upgrade_link.png b/education/get-started/images/wsfb_win10_pro_to_proedu_email_upgrade_link.png
deleted file mode 100644
index a30869b8ea..0000000000
Binary files a/education/get-started/images/wsfb_win10_pro_to_proedu_email_upgrade_link.png and /dev/null differ
diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md
deleted file mode 100644
index 5500fe19dc..0000000000
--- a/education/get-started/inclusive-classroom-it-admin.md
+++ /dev/null
@@ -1,82 +0,0 @@
----
-title: Inclusive Classroom IT Admin Guide
-description: Learning which Inclusive Classroom features are available in which apps and in which versions of Microsoft Office.
-keywords: Inclusive Classroom, Admin, Administrator, Microsoft Intune, Intune, Ease of Access, Office 365, account
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.topic: article
-ms.localizationpriority: medium
-ms.pagetype: edu
-ROBOTS: noindex,nofollow
-author: alhughes
-ms.author: alhughes
-ms.date: 06/12/2018
----
-
-# Inclusive Classroom IT Admin Guide
-The following guide will show you what Inclusive Classroom features are available in which apps and which versions of Microsoft Office. 
-You will also learn how to deploy apps using Microsoft Intune, turn on or off Ease of access settings for users, and change how you pay for your Office 365 subscription.
-
-1. [Inclusive Classroom features](#features)
-2. [Deploying apps with Microsoft Intune](#intune)
-3. [How to show/hide the Ease of Accesss settings for text in Windows 10](#ease)
-4. [How to change your Office 365 account from monthly, semi-annual, or yearly](#account)
-
-## Inclusive Classroom features
-|Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R)  | Office 365 ProPlus Semi Annual (C2R)  | Office 365 ProPlus Annual (C2R)  |
-|---|---|---|---|---|---|---|
-| Read aloud with simultaneous highlighting | 
            • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
            • Word 2016, Word Online, Word Mac, Word for iOS
            • Outlook 2016, Outlook Web Access
            • Office Lens on iOS, Android
              | 
            X
             
            (N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)
             | 
            X
             
            (N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)
              | 
            X
              | 
            X
             
            (N/A for Outlook PC)
              | 
            X
             
            (N/A for any OneNote apps or Outlook PC)
              | 
-| Adjustable text spacing and font size  | 
            • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
            • Word 2016, Word Online, Word Mac, Word for iPad
            • Outlook Web Access
            • Office Lens on iOS, Android
              | 
            X
             
            (N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)
              | 
            X
             
            (N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)
              |
            X
               | 
            X
              | 
            X
             
            (N/A for any OneNote apps)
              | 
-| Syllabification  | 
            • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
            • Word Online
            • Outlook Web Access
              |   | 
            X
             
            (N/A for Word for iOS, Word Online, Outlook Web Access)
              | 
            X
             
            (N/A for Word iOS)
              | 
            X
             
            (N/A for Word iOS)
              | 
            X
             
            (N/A for any OneNote apps or Word iOS)
              | 
-| Parts of speech identification  | 
            • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
            • Word 2016, Word Online, Word Mac, Word for iOS
            • Outlook 2016, Outlook Web Access
            • Office Lens on iOS, Android
              | 
            X
             
            (N/A for Word Online, Outlook Web Access)
              | 
            X
             
            (N/A for Word Online, Outlook Web Access)
              | 
            X
             
            (N/A for any OneNote apps)
              | 
            X
             
            (N/A for any OneNote apps)
              | 
            X
             
            (N/A for any OneNote apps)
              | 
-| Line focus mode  | 
            • Word 2016, Word Online, Word Mac, Word for iOS
            • Outlook 2016, Outlook Web Access
            • Office Lens on iOS, Android
              |   | 
            X
             
            (N/A for Word Online, Outlook Web Access)
              | 
            X
             
            (N/A for any OneNote apps)
              | 
            X
             
            (N/A for any OneNote apps)
              | 
            X
             
            (N/A for any OneNote apps)
              | 
-| Picture Dictionary  | 
            • Word 2016, Word Online, Word Mac, Word for iOS
            • Outlook 2016, Outlook Web Access
            • Office Lens on iOS, Android
              |   | 
            X
             
            (N/A for Word Online, Outlook Web Access)
              | 
            X
             
            (N/A for any OneNote apps)
              | 
            X
             
            (N/A for any OneNote apps)
              | 
            X
             
            (N/A for any OneNote apps)
              | 
-
            
-
-| Writing and proofing features  | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R)  | Office 365 ProPlus Semi Annual (C2R)  | Office 365 ProPlus Annual (C2R)  | 
-|---|---|---|---|---|---|---|
-| Dictation  | 
            • OneNote 2016, OneNote for Windows 10
            • Word 2016
            • Outlook 2016
            • PowerPoint 2016
               |   | 
            X
              | 
            X
              |   |   |  
-| Spelling suggestions for phonetic misspellings  | 
            • Word 2016, Word Online, Word for Mac
            • Outlook 2016
              |   | 
            X
              | 
            X
              | 
            X
              |   |  
-| Synonyms alongside spelling suggestions that can be read aloud  | 
            • Word 2016
            • Outlook 2016
              |   | 
            X
              | 
            X
              | 
            X
              |   |  
-| Grammar checks  | 
            • Word 2016, Word Online, Word for Mac
            • Outlook 2016
              |   | 
            X
              | 
            X
              |   |   |  
-| Customizable writing critiques  | 
            • Word 2016, Word for Mac
            • Outlook 2016
              | 
            X
              | 
            X
              | 
            X
              |   |   |  
-| Tell me what you want to do  | 
            • Office 2016
            • Office Online
            • Office on iOS, Android, Windows 10
              | 
            X
              | 
            X
              | 
            X
              | 
            X
              |   | 
-| Editor  | 
            • Word 2016
              |   | 
            X
              | 
            X
              |   |   |  
-
            
-
-| Creating accessible content features  |  Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R)  | Office 365 ProPlus Semi Annual (C2R)  | Office 365 ProPlus Annual (C2R)  | 
-|---|---|---|---|---|---|---|
-| Accessibility Checker  | 
            • All Office 365 authoring applications on PC, Mac, Web
              |   | 
            X
              | 
            X
              |   |   |  
-| Accessible Templates  | 
            • Word for PCs, Mac
            • Excel for PCs, Mac
            • PowerPoint for PCs, Mac
            • Sway on iOS, Web, Windows 10
              |   | 
            X
              | 
            X
              |   |   | 
-| Ability to add alt-text for images  | 
            • Word for PCs (includes automatic suggestions for image descriptions)
            • SharePoint Online (includes automatic suggestions for image descriptions)
            • PowerPoint for PCs (includes automatic suggestions for image descriptions)
            • OneNote (includes automatic extraction of text in images)
            • All Office 365 authoring applications (include ability to add alt-text manually)
              | 
            X
              | 
            X
              | 
            X
              |   |   | 
-| Ability to add captions to videos  | 
            • PowerPoint for PCs
            • Sway on iOS, Web, Windows 10
            • Microsoft Stream (includes ability to have captions auto-generated for videos in English and Spanish)
              |   | 
            X
              |   |   |   |  
-| Export as tagged PDF  | 
            • Word for PCs, Mac
            • Sway on iOS, Web, Windows 10
              |   | 
            X
              | 
            X
              |   |   |  
-| Ability to request accessible content  | 
            • Outlook Web Access
              |   |   |   |   |   |  
-
            
-
-| Communication features   | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R)  | Office 365 ProPlus Semi Annual (C2R)  | Office 365 ProPlus Annual (C2R)  | 
-|---|---|---|---|---|---|---|
-| Microsoft Translator  | 
            • Word 2016
            • Excel 2016
            • "Translator for Outlook" Add-in
            • PowerPoint 2016 (and PowerPoint Garage Add-in)
              | 
            X
              | 
            X
              | 
            X
              | 
            X
              | 
            X
              |  
-
            
-
-## Deploying apps with Microsoft Intune
-Microsoft Intune can be used to deploy apps such as Immersive Reader and Microsoft Translator to all the devices connected in the same groups.
-1. Go to the Intune for Education portal and log in with your account.
-2. Select the **Apps** page.
-3. Find the app you're looking for in the included list (if it's not there, you can select **Add app** and download it from the Microsoft Store). 
-4. Selecting your app will show you if it has been deployed to any of the groups that have been set up. From the **Groups** page you can select **Change group assignment** and choose which groups you want to deploy the app(s) to.
-
-## How to show/hide the Ease of access settings for text in Windows 10
-The Ease of access settings in Windows 10 are very useful accessibility tools, but having those options could be a bit much for everyone in a group to have in their device. With the following instructions you can chose to hide or show the Ease of access settings on users' devices.
-1. Go to the Intune for Education portal and login with your account.
-2. Select the **Groups** page and then select your desired group.
-3. Select **Settings** and under the **User access and device settings** section you will find the toggle to set **Ease of access** to **Blocked** or **Not blocked**.
-4. Select **Save** after making your selection.
-
-## How to change your Office 365 account from monthly, semi-annual, or yearly
-Depending on how you plan to do billing, you can have Office 365 accounts that are set to renew monthly, semi-annually, or yearly.
-1. Sign-in to your services and subscriptions with your Microsoft account.
-2. Find the subscription in the list, then select **Change how you pay**. 
-    >**Note:** If you don't see **Change how you pay**, it could be because auto-renew is not turned on. You won't be able to change how you pay if auto-renew is off because the subscription has already been paid and will end when its duration expires.
-3. Choose a new way to pay from the list or select **Add a new way to pay** and follow the instructions. 
diff --git a/education/get-started/set-up-office365-edu-tenant.md b/education/get-started/set-up-office365-edu-tenant.md
deleted file mode 100644
index 01a5f5b4a9..0000000000
--- a/education/get-started/set-up-office365-edu-tenant.md
+++ /dev/null
@@ -1,56 +0,0 @@
----
-title: Set up an Office 365 Education tenant
-description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices.
-keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.topic: get-started
-ms.localizationpriority: medium
-ms.pagetype: edu
-author: CelesteDG
-ms.author: celested
-ms.date: 10/09/2017
----
-
-# Set up an Office 365 Education tenant
-
-> [!div class="step-by-step"]
-[<< Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md)
-[Use School Data Sync to import student data >>](use-school-data-sync.md)
-
-Schools can use Office 365 to save time and be more productive. Built with powerful tools and accessible from any device, setting it up is the first step in getting your school to the cloud. 
-
-Don't have an Office 365 for Education verified tenant or just starting out? Follow these steps to set up an Office 365 for Education tenant. [Learn more about Office 365 for Education plans and pricing](https://products.office.com/academic/compare-office-365-education-plans). 
            
-
-> [!VIDEO https://www.youtube.com/embed/X7bscA-knaY]
-
-You can watch the descriptive audio version here: [Microsoft Education: Set up an Office 365 Education tenant (DA)](https://www.youtube.com/watch?v=d5tQ8KoB3ic)
-
-## To set up a new Office 365 Education tenant
-
-1. Go to the             Office 365 for Education sign up page to sign up for a free subscription for your school.
-2. Create an account and a user ID and password to use to sign into your account. 
-
-  **Figure 1** - Office 365 account creation
-
-  ![Create an Office 365 account](images/o365_createaccount.png)
-
-3. Save your sign-in info so you can use it to sign in to https://portal.office.com (the sign-in page). Click **You're ready to go...** 
-4. In the **Verify eligibility for Microsoft Office 365 for Education** screen:
-  1. Add your domain name and follow the steps to confirm ownership of the domain. 
-  2. Choose your DNS hosting provider to see step-by-step instructions on how to confirm that you own the domain.
- 
-    In some cases, you may need to wait several hours for the DNS verification to complete. You can click **I'll verify later** and come back later and log into the Office 365 portal and then go to the **Admin** center and select **Domains** to check the status entry for your domain.
-
-    You may need to fill in other information to provide that you qualify for an education tenant. Provide and submit the info to Microsoft to continue verification for your tenant.  
-
-As part of setting up a basic cloud infrastructure, you don't need to complete the rest of the Office 365 for Education setup so we will skip the rest of setup for now and start importing school data. You can pick up where you left off with Office 365 for Education setup once you've completed the rest of the steps in the walkthrough. See *Complete Office 365 for Education setup* in [Finish Windows 10 device setup and other tasks](finish-setup-and-other-tasks.md) for info.
-
-> [!div class="step-by-step"]
-[<< Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md)
-[Use School Data Sync to import student data >>](use-school-data-sync.md)
-
-
-## Related topic
-[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md)
\ No newline at end of file
diff --git a/education/get-started/set-up-windows-10-education-devices.md b/education/get-started/set-up-windows-10-education-devices.md
deleted file mode 100644
index a62a0e282d..0000000000
--- a/education/get-started/set-up-windows-10-education-devices.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: Set up Windows 10 education devices
-description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices.
-keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.topic: get-started
-ms.localizationpriority: medium
-ms.pagetype: edu
-author: CelesteDG
-ms.author: celested
-ms.date: 10/09/2017
----
-
-# Set up Windows 10 education devices
-
-> [!div class="step-by-step"]
-[<< Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md)
-[Finish setup and other tasks >>](finish-setup-and-other-tasks.md)
-
-We recommend using the latest build of Windows 10, version 1703 on your education devices. 
-
-To set up new Windows 10 devices and enroll them to your education tenant, choose from one of these options and follow the link to watch the video or follow the step-by-step guide:
-- **Option 1: [Use the Set up School PCs app](https://docs.microsoft.com/education/windows/use-set-up-school-pcs-app)** - You can use the app to create a setup file that you can use to quickly set up one or more Windows 10 devices.
-- **Option 2: [Go through Windows OOBE and join the device to Azure AD](set-up-windows-education-devices.md)** - You can go through a typical Windows 10 device setup or first-run experience to configure your device.
-
-> [!div class="step-by-step"]
-[<< Use Intune for Education to manage groups, apps, and settings](use-intune-for-education.md)
-[Finish setup and other tasks >>](finish-setup-and-other-tasks.md)
-
-
-
-## Related topic
-[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md)
diff --git a/education/get-started/set-up-windows-education-devices.md b/education/get-started/set-up-windows-education-devices.md
deleted file mode 100644
index e1f8ef557e..0000000000
--- a/education/get-started/set-up-windows-education-devices.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-title: Set up Windows 10 devices using Windows OOBE
-description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices.
-keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.topic: get-started
-ms.localizationpriority: medium
-ms.pagetype: edu
-author: CelesteDG
-ms.author: celested
-ms.date: 07/28/2017
----
-
-# Set up Windows 10 devices using Windows OOBE
-
-If you are setting up a Windows 10 device invidividually, and network bandwidth is not an issue, you can go through the Windows 10 first-run setup experience, also known as OOBE (out-of-box-experience) to set up the device, and join it to your school's Office 365 and Azure Active Directory.
-
-You can watch the video to see how this is done, or follow the step-by-step guide. 
            
-
-> [!VIDEO https://www.youtube.com/embed/nADWqBYvqXk]
-
-You can watch the descriptive audio version here: [Microsoft Education: Set up a new Windows 10 education devices using the Windows setup experience (DA)](https://www.youtube.com/watch?v=_UtS1Cz2Pno)
-
-## To set up Windows 10 devices using OOBE
-
-1. If you don't have a Wi-Fi network configured, make sure you connect the device to the Internet through a wired or Ethernet connection.
-2. Go through the Windows device setup experience. On a new or reset device, this starts with the **Let's start with region. Is this right?** screen.
-
-  **Figure 1** - Let's start with region
-
-  ![Let's start with region](images/win10_letsstartwithregion.png)
-
-3. Continue with setup. In the **How would you like to set up?** screen, select **Set up for an organization**.
-
-  **Figure 2** - Select setup for an organization
-
-  ![Select setup for an organization](images/win10_setupforanorg.png)
-
-4. Sign in using the user's account and password. Depending on the user password setting, you may be prompted to update the password.
-5. Choose privacy settings for the device. Location, speech recognition, diagnostics, and other settings are all on by default. Configure the settings based on the school's policies. 
-6. Click **Accept** to go through the rest of device setup.
-
-
-## Related topic
-[Set up Windows 10 education devices](set-up-windows-10-education-devices.md)
\ No newline at end of file
diff --git a/education/get-started/use-intune-for-education.md b/education/get-started/use-intune-for-education.md
deleted file mode 100644
index d1ab32cfa9..0000000000
--- a/education/get-started/use-intune-for-education.md
+++ /dev/null
@@ -1,222 +0,0 @@
----
-title: Use Intune for Education to manage groups, apps, and settings
-description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices.
-keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.topic: get-started
-ms.localizationpriority: medium
-ms.pagetype: edu
-author: CelesteDG
-ms.author: celested
-ms.date: 08/29/2017
----
-
-# Use Intune for Education to manage groups, apps, and settings
-
-> [!div class="step-by-step"]
-[<< Configure Microsoft Store for Education](configure-microsoft-store-for-education.md)
-[Set up Windows 10 education devices >>](set-up-windows-10-education-devices.md)
-
-Intune for Education is a streamlined device management solution for educational institutions that can be used to quickly set up and manage Windows 10 devices for your school. It provides a new streamlined UI with the enterprise readiness and resiliency of the Intune service. You can learn more about Intune for Education by reading the Intune for Education documentation. 
-
-## Example - Set up Intune for Education, buy apps from the Store, and install the apps
-In this walkthrough, we'll go through a sample scenario and walk you through the steps to:
-- [Use express configuration to quickly set up Intune for Education](#set-up-intune-for-education)
-- [Use Intune for Education to buy apps from the Microsoft Store for Education](#add-apps-bought-from-microsoft-store-for-education)
-- [Use Intune for Education to install the apps for all users in your tenant](#install-apps-for-all-users)
-
-Note that for verified education tenants, Microsoft automatically provisions your app catalog with these apps so you will see them appear on your Intune for Education catalog even before you've bought any apps:
-- Excel 
-- Fresh Paint
-- Minecraft: Education Edition
-- OneNote
-- PowerPoint
-- Sway
-- Word
-
-  > [!NOTE]
-  > Apps that you own in the Microsoft Store for Education are automatically available in Intune for Education. Any changes you make to your purchases get reflected in Intune for Education.
-
-You can watch the video to see how this is done, or follow the step-by-step guide. 
            
-
-> [!VIDEO https://www.youtube.com/embed/c3BLoZZw3TQ]
-
-You can watch the descriptive audio version here: [Microsoft Education: Use Intune for Education to manage groups, apps, and settings (DA)](https://youtu.be/Tejxfc4V7cQ)
-
-## Set up Intune for Education
-Intune for Education provides an **Express configuration** option so you can get going right away. We'll use that option here.
-
-1. Log into the Intune for Education console. You will see the Intune for Education dashboard once you're logged in.
-
-  **Figure 1** - Intune for Education dashboard
-
-  ![Intune for Education dashboard](images/i4e_portal.png)
-
-2. On the dashboard, click **Launch Express Configuration**, or select the **Express configuration** option on the menu on the left.
-3. In the **Welcome to Intune for Education** screen, click **Get started**.
-  
-  **Figure 2** - Click Get started to set up Intune for Education
-
-  ![Click Get Started to configure groups, apps, and settings](images/i4e_expressconfiguration_welcome.png)
-
-4. In the **Get school information (optional)** screen, it should indicate that SDS is already configured. Click **Next**.
-
-  **Figure 3** - SDS is configured
-
-  ![SDS is already configured](images/i4e_expressconfiguration_sdsconfigured.png)
-
-5. In the **Choose group** screen, select **All Users**. All apps and settings that we select during express setup will apply to this group. 
-
-  You can choose another group during this step, but note that your experience may vary from what we show in the walkthrough.
-
-6. The **Next** button will appear at the bottom of the screen after you select **All Users**. Click **Next**.
-
-  > [!TIP]
-  > At the top of the screen, did you notice the **Choose group** button change to a green check mark? This means we are done with that step. If you change your mind or need to make changes, simply click on the button to go back to that step. Try it!
-  >
-  > **Figure 4** - Click on the buttons to go back to that step
-  >
-  > ![Click on the buttons to back to that step](images/i4e_expressconfiguration_choosebuttontogoback.png)
-
-7. In the **Choose apps** screen, you will see a selection of Web apps, Microsoft Store apps, and desktop (Win32) apps. You will also see a list of popular apps from each category. 
-
-  - Add or remove apps by clicking on them. A blue checkmark means the app is added and will be installed for all members of the group selected in the **Choose group** step.
-  
-    In this walkthrough, it's up to you to select the apps you choose to install. Just remember what they are so that later in the walkthrough you can verify that the apps were installed correctly on the device.
-
-    > [!TIP]
-    > Web apps are pushed as links in the Windows Start menu under **All apps**. If you want apps to appear in Microsoft Edge browser tabs, use the **Homepages** setting for Microsoft Edge through **Express configuration** or **Manage Users and Devices**.
-
-  **Figure 5** - Choose the apps that you want to install for the group
-
-  ![Choose apps to install for the group](images/i4e_expressconfiguration_chooseapps_selected_cropped.png)
-
-8. When you're done choosing apps, click **Next** at the bottom of the screen.
-
-  If you select Microsoft Store apps, you will see a notification that Intune for Education is getting these apps.
-
-8. In the **Choose settings** screen, we will set the settings to apply to the group. Click the reverse caret (downward-facing arrow) to expand the settings group and get more information about each setting in that settings group.
-
-  **Figure 6** - Expand the settings group to get more details
-
-  ![Expand the settings group to get more info](images/i4e_expressconfiguration_choosesettings_expandcollapse_cropped_052217.png)
-
-9. For this walkthrough, set the following settings:
-  - In the **Microsoft Edge settings** group, change the **Do-Not-Track headers** setting to **Require**.
-  - In the **App settings** group, change the **Microsoft Store for Business apps** setting to **Block**, and then set the **Require Microsoft Store for Business apps to be installed from private store** to **Require**.
-
-  **Figure 28** - Set some additional settings
-
-  ![Set some additional settings](images/i4e_expressconfiguration_choosesettings_additionalsettings_cropped.png)
-
-10. Click **Next**. In the **Review** screen, you will see a summary of the apps and settings you selected to apply.
-
-  **Figure 7** - Review the group, apps, and settings you configured
-
-  ![Review the group, apps, and settings you configured](images/i4e_expressconfiguration_review.png)
-
-11. Click **Save** to end express configuration.
-12. You will see the **You're done!** screen which lets you choose one of two options. 
-
-  **Figure 8** - All done with Intune for Education express configuration
-
-  ![Done with Intune for Education express configuration](images/i4e_expressconfiguration_alldone.png)
-
-13. Click **All done** or click the **X** on the upper-right corner of the screen to dismiss this screen and go back to the dashboard.
-
-## Add apps bought from Microsoft Store for Education
-
-- **Example 1 - Minecraft: Education Edition**
-
-  If you would like to purchase Minecraft: Education Edition or want to learn how to get, distribute, and manage permissions for Minecraft: Education Edition, see For IT administrators - get Minecraft: Education Edition.
-
-- **Example 2 - Free educational/reference apps**
-
-  1. In the Intune for Education console, click **Apps** from the menu on the left.
-
-    **Figure 9** - Click on **Apps** to see the list of apps for your tenant
-
-    ![Click Apps to see the list of apps for your tenant](images/i4e_dashboard_clickapps.png)
-
-  2. In the **Store apps** section, click **+ New app**. This will take you to the Microsoft Store for Education portal and you will already be signed in.
-
-    **Figure 10** - Select the option to add a new Store app
-
-    ![Select the option to add a new Store app](images/i4e_apps_newstoreapp_selected.png)
-
-  3. In the Microsoft Store page, check some of the categories for suggested apps or search the Store for a free educational or reference app. Find ones that you haven't already installed during express setup for Intune for Education.
-  
-    For example, these apps are free:
-    - Duolingo - Learn Languages for Free
-    - Flashcards Pro 
-    - Khan Academy
-    - My Study Life
-
-  4. Find or select the app you want to install and click **Get the app**.
-  5. In the app's Store page, click the **...** button and select **Add to private store**.
-  6. Repeat steps 3-5 to install another app or move to the next step.
-  7. In the Microsoft Store for Education portal, select **Manage > Apps & software > Manage apps** to verify that the apps you purchased appear in your inventory.
-
-    For example, if you bought Duolingo and Khan Academy, they will show up in your inventory along with the apps that Microsoft automatically provisioned for your education tenant.
-
-    **Figure 11** - Apps inventory in Microsoft Store for Education
-
-    ![Apps inventory in Store for Business](images/msfe_manageapps_inventory_grouped.png)
-
-    In the **Private store** column of the **Apps & software** page, the status for some apps will indicate that it's "In private store" while others will say "Not in private store". We won't go over this in the walkthrough, but you can learn more about this in Distribute apps using your private store.
-
-    > [!NOTE]  
-    > You'll see in the above screenshot that some apps say that **Add is in progress**. Sync happens automatically, but it may take up to 24 hours for your organization's private store and 12 hours for Intune for Education to sync all your purchased apps. 
-
-## Install apps for all users
-
-Now that you've bought the apps, use Intune for Education to specify the group to install the apps for. Here, we'll show you how to install the apps you bought for all devices used by all users in your tenant. 
-
-1. In the Intune for Education console, click the **Groups** option from the menu on the left.
-
-  **Figure 12** - Groups page in Intune for Education
-
-  ![Groups page in Intune for Education](images/i4e_groupspage.png)
-
-2. In the **Groups** page, select **All Users** from the list of groups on the left, and then click **Users** in the taskbar at the top of the **All Users** page. 
-
-  **Figure 13** - List of all users in the tenant
-
-  ![List of all users in the tenant](images/i4e_groups_allusers_users_steps.png)
-
-3. In the taskbar at the top, select **Apps** and then click **Edit apps** to see a list of available apps.
-
-  **Figure 14** - Edit apps to assign them to users
-
-  ![Edit apps to assign them to users](images/i4e_groups_allusers_appspage_editapps.png)
-
-4. Select the apps to deploy to the group. A blue checkmark will appear next to the apps you select. 
-
-  **Figure 15** - Select the apps to deploy to the group
-
-  ![Select the apps to deploy to the group](images/i4e_groups_allusers_selectappstodeploy.png)
-
-5. Once you're done, click **Save** at the bottom of the page to deploy the selected apps to the group.
-6. You'll be notified that app assignments are being updated. The updated **All Users** groups page now include the apps you selected. 
-
-  **Figure 16** - Updated list of assigned apps
-
-  ![Updated list of assigned apps](images/i4e_groups_allusers_updatedappslist.png)
-
-You're now done assigning apps to all users in your tenant. It's time to set up your Windows 10 device(s) and check that your cloud infrastructure is correctly set up and your apps are being pushed to your devices from the cloud.
-
-
-
-> [!div class="step-by-step"]
-[<< Configure Microsoft Store for Education](configure-microsoft-store-for-education.md)
-[Set up Windows 10 education devices >>](set-up-windows-10-education-devices.md)
-
-
-
-## Related topic
-[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md)
\ No newline at end of file
diff --git a/education/get-started/use-school-data-sync.md b/education/get-started/use-school-data-sync.md
deleted file mode 100644
index f2bcfb50f9..0000000000
--- a/education/get-started/use-school-data-sync.md
+++ /dev/null
@@ -1,172 +0,0 @@
----
-title: Use School Data Sync to import student data
-description: Learn how to use the new Microsoft Education system to set up a cloud infrastructure for your school, acquire devices and apps, and configure and deploy policies to your Windows 10 devices.
-keywords: education, Microsoft Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, School Data Sync, Microsoft Teams, Microsoft Store for Education, Azure AD, Set up School PCs
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.topic: get-started
-ms.localizationpriority: medium
-ms.pagetype: edu
-author: CelesteDG
-ms.author: celested
-ms.date: 07/10/2017
----
-
-# Use School Data Sync to import student data
-
-> [!div class="step-by-step"]
-[<< Set up an Office 365 education tenant](set-up-office365-edu-tenant.md)
-[Configure Microsoft Store for Education >>](configure-microsoft-store-for-education.md)
-
-School Data Sync (SDS) helps you import Student Information System (SIS) data into Office 365. It helps automate the process for importing and integrating SIS data that you can use with Office 365 and apps like OneNote Class Notebooks. 
-
-Follow all the steps in this section to use SDS and sample CSV files in a trial environment. To use SDS in a production environment, see step 2 in [Try out Microsoft Education in a production environment](https://docs.microsoft.com/education/get-started/get-started-with-microsoft-education#setup-options) instead.
-
-You can watch the video to see how this is done, or follow the step-by-step guide.
            
-
-> [!VIDEO https://www.youtube.com/embed/ehSU8jr8T24]
-
-You can watch the descriptive audio version here: [Microsoft Education: Use School Data Sync to import student data (DA)](https://www.youtube.com/watch?v=l4b086IMtvc)
-
-## Download sample school data
-
-1. Go to the O365-EDU-Tools GitHub site.
-2. Click the green **Clone or download** button to download the SDS sample files.
-
-  **Figure 1** - Download the SDS sample files from GitHub
-
-  ![Download the SDS sample files from GitHub](images/sds_github_downloadsample.png)
-
-3. In the **Clone with HTTPS** pop-up window, choose **Download ZIP** and note the location where you're saving the folder.
-4. Go to the folder where you saved the .zip and unzip the files.
-5. Open the **O365-EDU-Tools-master** folder and then open the **CSV Samples** subfolder. Confirm that you can see the following sample CSV files.
-
-  **Figure 2** - Sample CSV files
-
-  ![Use the sample CSV files](images/sds_sample_csv_files_us_uk.png)
-
-  > [!NOTE] 
-  > - The sample CSV files uses sample accounts and passwords. If you are using the sample files for testing, remember the accounts and their corresponding passwords. You may be asked to change the password during your first sign in. 
-  > - If you are modifying the sample CSV files to use in your organization, change the accounts and passwords to match the user accounts and passwords in your organization.
-  > - If you are using CSV files from your existing production environment, see the detailed instructions in step 5 in the next section.
-
-To learn more about the CSV files that are required and the info you need to include in each file, see CSV files for School Data Sync. If you run into any issues, see School Data Sync errors and troubleshooting.
-
-## Use SDS to import student data
-
-1. If you haven't done so already, go to the SDS portal, https://sds.microsoft.com.
-2.  Click Sign in. Then enter your O365 Global Admin account credentials. 
-3. After logging in, click **+ Add Profile** in the left hand navigation pane to create a Sync Profile..  This opens up the new profile setup wizard within the main page.
-
-  **Figure 3** - New SDS profile setup wizard
-    
-  ![Screenshot that shows creating a new profile](images/03bfe22a-469b-4b73-ab8d-af5aaac8ff89.png)
-
-4. For the new profile, in the **How do you want to connect to your school?** screen:
-  
-    1. Enter a name for your profile, such as *Contoso_Elementary_Profile*.    
-    2. Select a sync method for your profile. For this walkthrough, select **Upload CSV Files**.    
-    3. Select the type of CSV files that you're using. For this walkthrough, select **CSV files: SDS Format**.     
-    4. Click **Start**.
-
-5. In the **Sync options** screen:
-
-  1. In the **Select new or existing users** section, you can select either **Existing users** or **New users** based on the scenaro that applies to you. For this walkthrough, select **New users**.
-  2. In the **Import data** section, click **Upload Files** to bring up the **Select data files to be uploaded** window.  
-  3. In the **Select data files to be uploaded** window, click **+ Add Files** and navigate to the directory where you saved the six CSV files required for data import.
-  4. In the File Explorer window, you will see a folder for the sample CSV files for the UK and six sample CSV files for the US. Select the CSV files that match your region/locale, and then click **Open**.
-  5. In the **Select data files to be uploaded** window, confirm that all six CSV files (School.csv, Section.csv, Student.csv, StudentEnrollment.csv, Teacher.csv, and TeacherRoster.csv) are listed and then click **Upload**.
-
-    > [!NOTE]
-    > After you click **Upload**, the status in the **Select data files to be uploaded** window will indicate that files are being uploaded and verified.
-
-  6. After all the files are successfully uploaded, click **OK**. 
-  7. In the **Select school and section properties** section, ensure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties, or deselect any properties, make sure you have the properties and values contained within the CSV files. For the walkthrough, you don't have to change the default.
-  8. In the Replace Unsupported Special Characters section, checking this box will allow SDS to automatically replace unsupported special characters while the sync is running. Special characters will be replaced with an "_", and no longer result in an error during the sync process for that object.
-  9. In the **Sync option for Section Group Display Name**, check the box if you want to allow teachers to overwrite the section names. Otherwise, SDS will always reset the display name value for sections to the value contained within the CSV files.
-  10. In the **Student enrollment option** section:
-    * If you want to sync your student roster data immediately, leave the box unchecked.
-    * If you prefer to sync student enrollment/rostering data at a later date, check this box and then pick a date by clicking the empty box and selecting the appropriate date in the calendar when you would like to begin syncing your student roster data. Some schools prefer to delay syncing student roster data so they don't expose rosters before the start of the new term, semester, or school year.  
-  11. In the Default Term Dates section, You can set default start and end dates for Section terms. These dates will only be used if you do not provide these dates in your CSV files.  If you upload files with Section start and end dates, you will be asked to select the format of the dates provided. If the format that you enter does not match the format of start and end dates in your files, you will receive an error message and need to edit the date format so that it matches the format in your files.
-  12. In the **License Options** section, check the box for **Intune for Education** to allow students and teachers to receive the Intune for Education license. This will also create the SDS dynamic groups and security groups, which will be used within Intune for Education.
-  13. Click **Next**.
-
-    **Figure 4** - Sync options for the new profile
-
-    ![Specify sync options for the new SDS profile](images/how-to-deploy-SDS-using-CSV-files-2a.PNG)
-
-6. In the **Teacher options** screen:
-
-  1. Select the domain for the teachers. SDS appends the selected domain suffix to the teacher's username attribute contained in the CSV file, to build the UserPrincipalName for each user in Office 365/Azure Active Directory during the account creation process. The teacher will log in to Office 365 with the UserPrincipalName once the account is created.
-    * Primary Key (Source Directory) - This is the Teacher attribute in the CSV file used for SDS Identity Matching. Watch the Identity Matching video for additional information on how to select the appropriate source directory attribute, and properly configure the identity matching settings for teacher.
-    * Primary Key (Target Directory) - This is the User attribute in Azure AD used for SDS Identity Matching. Watch the Identity Matching video for additional information on how to select the appropriate target directory attribute, and properly configure the identity matching settings for the teacher.
-    * Domain (optional) - This is an optional domain value that you can add to the selected Source Directory attribute to complete your Teacher Identity Matching. If you need to match to a UserPrincipalName or Mail attribute, you must have a domain included in the string. Your source attribute must either include the domain already or you can append the appropriate domain to the source attribute using this dropdown menu.
-
-  2. In the **Select teacher properties** section, make sure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties or deselect any properties, make sure you have the corresponding properties and values contained within the CSV files. For this walkthrough, you don't have to change the default.
-    
-  3. In the **License assignment** section, choose the SKU to assign licenses for teachers. 
-    
-  4. Click **Next**.
-
-    **Figure 5** - Specify options for teacher mapping
-
-    ![Specify options for teacher mapping](images/how-to-deploy-SDS-using-CSV-files-3.PNG)
-
-7. In the **Student options** screen:
-
-  1. Select the domain for the students. SDS appends the selected domain suffix to the student's username attribute contained in the CSV file, to build the UserPrincipalName for each user in Office 365/Azure Active Directory during the account creation process. The student will log in to Office 365 with the UserPrincipalName once the account is created.
-  2. In the **Select student properties** section, make sure the attributes that have been automatically selected for you align to your CSV files. If you select additional properties or deselect any properties, make sure you have the corresponding properties and values contained within the CSV files. For this walkthrough, you don't have to change the default.
-  3. In the **License assignment** section, choose the SKU to assign licenses for students. 
-  4. Click **Next**.
-
-    **Figure 6** - Specify options for student mapping
-
-    ![Specify options for student mapping](images/how-to-deploy-SDS-using-CSV-files-4.PNG)
-
-8. In the profile **Review** page, review the summary and confirm that the options selected are correct. 
-9. Click **Create profile**. You will see a notification that your profile is being submitted and then you will see a page for your profile. 
-
-  **Figure 7** - SDS profile page
- 
-  ![SDS profile page](images/how-to-deploy-SDS-using-CSV-files-5.png)
-
-10. After the profile is created and the status indicates as **Setting up**, refresh the page until you see the status change to **Sync in progress**. Beneath the **Sync in progress** status, you will see which of the 5 sync stages SDS is working on:
-  * Stage 1 - Validating data
-  * Stage 2 - Processing schools and sections
-  * Stage 3 - Processing students and teachers
-  * Stage 4 - Adding students and teachers into sections
-  * Stage 5 - Setting up security groups
-
-  If you don't see a **Sync in progress** status on the sync profile, and receive an error message instead, this indicates that SDS has encountered data issues during the pre-sync validation check and has not started syncing your data. This gives you the opportunity to fix the errors identified by the pre-sync validation checks before continuing. Once you've fixed any errors or if you prefer to continue with the errors and begin syncing your data anyway, click the **Resume sync** button to start the sync process.
-
-  Once you've completed all five sync stages, your profile status will update one final time. 
-    * If you haven't encountered any errors, you will see a green check mark which states **Everything is ok**, and the profile status will change to **Sync complete. Ready for more data.** 
-    * If SDS encountered sync errors, you will see a red status icon that indicates an error, and a profile status of **Sync complete. Profile contains multiple errors**. Download the available error report to identify and fix your sync errors. Once complete, upload new files as needed and re-sync your data until errors are resolved.
-
-  Here are some examples of what the sync status can look like:
-
-  **Figure 8** - New profile: Sync in progress
-
-  ![Sync in progress for the new profile](images/sds_profile_status_syncinprogress_062317.png)
-
-  **Figure 9** - New profile: Sync complete - no errors
-
-  ![New profile sync complete with no errors](images/sds_profile_status_everythingok_062317.png)
-
-  **Figure 10** - New profile: Sync complete - with errors
-
-  ![New profile sync complete with errors](images/sds_profile_status_syncerrors_062317.png)
-
-  Sync times, like file download times, can vary widely depending on when you start the sync, how much data you are syncing, the complexity of your data (such as the number of users, schools, and class enrollments), overall system/network load, and other factors. Two people who start a sync at the same time may not have their syncs complete at the same time.
-
-  You can refresh the page to confirm that your profile synced successfully.
-
-That's it for importing sample school data using SDS.
-
-> [!div class="step-by-step"]
-[<< Set up an Office 365 education tenant](set-up-office365-edu-tenant.md)
-[Configure Microsoft Store for Education >>](configure-microsoft-store-for-education.md)
-
-## Related topic
-[Get started: Deploy and manage a full cloud IT solution with Microsoft Education](get-started-with-microsoft-education.md)
diff --git a/education/images/EDU-Apps-Mgmt.svg b/education/images/EDU-Apps-Mgmt.svg
new file mode 100644
index 0000000000..862f0e12ff
--- /dev/null
+++ b/education/images/EDU-Apps-Mgmt.svg
@@ -0,0 +1 @@
+EDU-Apps-Mgmt-50px
\ No newline at end of file
diff --git a/education/images/EDU-Deploy.svg b/education/images/EDU-Deploy.svg
new file mode 100644
index 0000000000..1a0d67fd67
--- /dev/null
+++ b/education/images/EDU-Deploy.svg
@@ -0,0 +1 @@
+EDU-Deploy-50px
\ No newline at end of file
diff --git a/education/images/EDU-Device-Mgmt.svg b/education/images/EDU-Device-Mgmt.svg
new file mode 100644
index 0000000000..92fb95141f
--- /dev/null
+++ b/education/images/EDU-Device-Mgmt.svg
@@ -0,0 +1 @@
+EDU-Device-Mgmt-50px
\ No newline at end of file
diff --git a/education/images/EDU-Education.svg b/education/images/EDU-Education.svg
new file mode 100644
index 0000000000..146dd00257
--- /dev/null
+++ b/education/images/EDU-Education.svg
@@ -0,0 +1 @@
+EDU-Education-50px
\ No newline at end of file
diff --git a/education/images/EDU-FindHelp.svg b/education/images/EDU-FindHelp.svg
new file mode 100644
index 0000000000..fea3109134
--- /dev/null
+++ b/education/images/EDU-FindHelp.svg
@@ -0,0 +1,32 @@
+
+
+
+
+EDUAdmins-50px
+
+
+
+	toolbox
+	
+		
+			
+				
+					
+				
+			
+		
+	
+
+
diff --git a/education/images/EDU-ITJourney.svg b/education/images/EDU-ITJourney.svg
new file mode 100644
index 0000000000..e42fe12104
--- /dev/null
+++ b/education/images/EDU-ITJourney.svg
@@ -0,0 +1,31 @@
+
+
+
+
+EDUAdmins-50px
+
+
+
+	MapPin-blue
+	
+	
+	
+	
+	
+
+
diff --git a/education/images/EDU-Lockbox.svg b/education/images/EDU-Lockbox.svg
new file mode 100644
index 0000000000..8133127433
--- /dev/null
+++ b/education/images/EDU-Lockbox.svg
@@ -0,0 +1 @@
+EDU-Lockbox-50px
\ No newline at end of file
diff --git a/education/images/EDU-Tasks.svg b/education/images/EDU-Tasks.svg
new file mode 100644
index 0000000000..f1339ea705
--- /dev/null
+++ b/education/images/EDU-Tasks.svg
@@ -0,0 +1 @@
+EDU-Tasks-50px
\ No newline at end of file
diff --git a/education/images/EDU-Teachers.svg b/education/images/EDU-Teachers.svg
new file mode 100644
index 0000000000..4cdb2b3e7d
--- /dev/null
+++ b/education/images/EDU-Teachers.svg
@@ -0,0 +1,27 @@
+
+
+
+
+EDUAdmins-50px
+
+
+
+	PresenterPresentationChart-blue
+	
+	
+	
+
+
diff --git a/education/images/EDUAdmins.svg b/education/images/EDUAdmins.svg
new file mode 100644
index 0000000000..d512fb942f
--- /dev/null
+++ b/education/images/EDUAdmins.svg
@@ -0,0 +1 @@
+EDUAdmins-50px
\ No newline at end of file
diff --git a/education/images/EDUDevelopers.svg b/education/images/EDUDevelopers.svg
new file mode 100644
index 0000000000..900159699a
--- /dev/null
+++ b/education/images/EDUDevelopers.svg
@@ -0,0 +1 @@
+EDUDevelopers-50px
\ No newline at end of file
diff --git a/education/images/EDUPartners.svg b/education/images/EDUPartners.svg
new file mode 100644
index 0000000000..01b80c9a42
--- /dev/null
+++ b/education/images/EDUPartners.svg
@@ -0,0 +1 @@
+EDUPartners-50px
\ No newline at end of file
diff --git a/education/images/MSC17_cloud_005.png b/education/images/MSC17_cloud_005.png
new file mode 100644
index 0000000000..dfda08109c
Binary files /dev/null and b/education/images/MSC17_cloud_005.png differ
diff --git a/education/images/MSC17_cloud_012_merged.png b/education/images/MSC17_cloud_012_merged.png
new file mode 100644
index 0000000000..4defcaa59c
Binary files /dev/null and b/education/images/MSC17_cloud_012_merged.png differ
diff --git a/education/images/data-streamer.png b/education/images/data-streamer.png
new file mode 100644
index 0000000000..6473d9da33
Binary files /dev/null and b/education/images/data-streamer.png differ
diff --git a/education/images/education-partner-aep-2.svg b/education/images/education-partner-aep-2.svg
index 96ecbf019b..6bf0c2c3ac 100644
--- a/education/images/education-partner-aep-2.svg
+++ b/education/images/education-partner-aep-2.svg
@@ -1,4 +1,4 @@
-
+
   
     
            
-    
            
-        
            Microsoft Education documentation and resources
            
-        
            
-
            
diff --git a/education/index.yml b/education/index.yml
new file mode 100644
index 0000000000..80796a921a
--- /dev/null
+++ b/education/index.yml
@@ -0,0 +1,35 @@
+### YamlMime:Hub
+
+title: Microsoft 365 Education Documentation
+summary: Microsoft 365 Education empowers educators to unlock creativity, promote teamwork, and provide a simple and safe experience in a single, affordable solution built for education.
+
+metadata:
+  title: Microsoft 365 Education Documentation
+  description: Learn about product documentation and resources available for school IT administrators, teachers, students, and education app developers.
+  ms.service: help
+  ms.topic: hub-page
+  author: LaurenMoynihan
+  ms.author: v-lamoyn
+  ms.date: 10/24/2019
+
+productDirectory:
+  items:
+    # Card    
+    - title: IT Admins
+      # imageSrc should be square in ratio with no whitespace
+      imageSrc: ./images/EDUAdmins.svg
+      links:
+        - url: itadmins.yml
+          text: Get started with deploying and managing a full cloud IT solution for your school.
+    # Card
+    - title: Developers
+      imageSrc: ./images/EDUDevelopers.svg
+      links:
+        - url: developers.yml
+          text: Looking for information about developing solutions on Microsoft Education products? Start here. 
+    # Card    
+    - title: Partners
+      imageSrc: ./images/EDUPartners.svg
+      links:
+        - url: partners.yml
+          text: Looking for resources available to Microsoft Education partners? Start here.
\ No newline at end of file
diff --git a/education/itadmins.yml b/education/itadmins.yml
new file mode 100644
index 0000000000..4aa321c59c
--- /dev/null
+++ b/education/itadmins.yml
@@ -0,0 +1,120 @@
+### YamlMime:Hub
+
+title: Microsoft 365 Education Documentation for IT admins
+summary: Microsoft 365 Education consists of Office 365 Education, Windows 10 Education, and security and management tools such as Intune for Education and School Data Sync.
+
+metadata:
+  title: Microsoft 365 Education Documentation for IT admins
+  description: M365 Education consists of Office 365 Education, Windows 10 Education, and security and management tools such as Intune for Education and School Data Sync.
+  ms.service: help
+  ms.topic: hub-page
+  author: LaurenMoynihan
+  ms.author: v-lamoyn
+  ms.date: 10/24/2019
+
+productDirectory:
+  summary: This guide is designed for IT admins looking for the simplest way to move their platform to the cloud. It does not capture all the necessary steps for large scale or complex deployments.
+  items:
+    # Card    
+    - title: Phase 1 - Cloud deployment
+      imageSrc: ./images/EDU-Deploy.svg
+      links:
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/create-your-office-365-tenant
+          text: 1. Create your Office 365 tenant
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/secure-and-configure-your-network
+          text: 2. Secure and configure your network
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/aad-connect-and-adfs
+          text: 3. Sync your active directory
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/school-data-sync
+          text: 4. Sync you SIS using School Data Sync
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/license-users
+          text: 5. License users
+    # Card
+    - title: Phase 2 - Device management
+      imageSrc: ./images/EDU-Device-Mgmt.svg
+      links:
+        - url: https://docs.microsoft.com/en-us/education/windows/
+          text: 1. Get started with Windows 10 for Education
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/set-up-windows-10-education-devices
+          text: 2. Set up Windows 10 devices
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/intune-for-education
+          text: 3. Get started with Intune for Education
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/use-intune-for-education
+          text: 4. Use Intune to manage groups, apps, and settings
+        - url: https://docs.microsoft.com/en-us/intune/enrollment/enrollment-autopilot
+          text: 5. Enroll devices using Windows Autopilot
+    # Card    
+    - title: Phase 3 - Apps management
+      imageSrc: ./images/EDU-Apps-Mgmt.svg
+      links:
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/configure-admin-settings
+          text: 1. Configure admin settings
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/set-up-teams-for-education
+          text: 2. Set up Teams for Education
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-office-365
+          text: 3. Set up Office 365
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/microsoft-store-for-education     
+          text: 4. Install apps from Microsoft Store for Education
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/minecraft-for-education
+          text: 5. Install Minecraft - Education Edition
+    # Card    
+    - title: Complete your deployment
+      # imageSrc should be square in ratio with no whitespace
+      imageSrc: ./images/EDU-Tasks.svg
+      links:
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-exchange-online
+          text: Deploy Exchange Online
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-sharepoint-online-and-onedrive
+          text: Deploy SharePoint Online and OneDrive
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-exchange-server-hybrid
+          text: Deploy Exchange Server hybrid
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/deploy-sharepoint-server-hybrid
+          text: Deploy SharePoint Server Hybrid
+    # Card
+    - title: Security & compliance
+      imageSrc: ./images/EDU-Lockbox.svg
+      links:
+        - url: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-deployment-checklist-p2
+          text: AAD feature deployment guide
+        - url: https://techcommunity.microsoft.com/t5/Azure-Information-Protection/Azure-Information-Protection-Deployment-Acceleration-Guide/ba-p/334423
+          text: Azure information protection deployment acceleration guide
+        - url: https://docs.microsoft.com/en-us/cloud-app-security/getting-started-with-cloud-app-security
+          text: Microsoft Cloud app security
+        - url: https://docs.microsoft.com/microsoft-365/compliance/create-test-tune-dlp-policy
+          text: Office 365 data loss prevention
+        - url: https://docs.microsoft.com/microsoft-365/compliance/
+          text: Office 365 advanced compliance
+        - url: https://social.technet.microsoft.com/wiki/contents/articles/35748.office-365-what-is-customer-lockbox-and-how-to-enable-it.aspx
+          text: Deploying Lockbox
+    # Card    
+    - title: Analytics & insights
+      imageSrc: ./images/EDU-Education.svg
+      links:
+        - url: https://docs.microsoft.com/en-us/power-bi/service-admin-administering-power-bi-in-your-organization
+          text: Power BI for IT admins
+        - url: https://docs.microsoft.com/en-us/dynamics365/#pivot=get-started
+          text: Dynamics 365
+    # Card    
+    - title: Find deployment help
+      imageSrc: ./images/EDU-FindHelp.svg
+      links:
+        - url: https://docs.microsoft.com/microsoft-365/education/deploy/find-deployment-help
+          text: IT admin help
+        - url: https://social.technet.microsoft.com/forums/en-us/home
+          text: TechNet
+    # Card    
+    - title: Check out our education journey
+      imageSrc: ./images/EDU-ITJourney.svg
+      links:
+        - url: https://edujourney.microsoft.com/k-12/
+          text: K-12
+        - url: https://edujourney.microsoft.com/hed/
+          text: Higher education
+    # Card    
+    - title: Additional support resources
+      imageSrc: ./images/EDU-Teachers.svg
+      links:
+        - url: https://support.office.com/en-us/education
+          text: Education help center
+        - url: https://support.office.com/en-us/article/teacher-training-packs-7a9ee74a-8fe5-43d3-bc23-a55185896921
+          text: Teacher training packs
\ No newline at end of file
diff --git a/education/partners.yml b/education/partners.yml
new file mode 100644
index 0000000000..42925925f4
--- /dev/null
+++ b/education/partners.yml
@@ -0,0 +1,33 @@
+### YamlMime:Hub
+
+title: Microsoft 365 Education Documentation for partners
+summary: Looking for resources available to Microsoft Education partners? Start here.
+
+metadata:
+  title: Microsoft 365 Education Documentation for partners
+  description: Looking for resources available to Microsoft Education partners? Start here.
+  ms.service: help
+  ms.topic: hub-page
+  author: LaurenMoynihan
+  ms.author: v-lamoyn
+  ms.date: 10/24/2019
+
+additionalContent:
+  sections:
+    - items:
+        # Card
+        - title: Microsoft Partner Network
+          summary: Discover the latest news and resources for Microsoft Education products, solutions, licensing and readiness.
+          url: https://partner.microsoft.com/solutions/education
+        # Card
+        - title: Authorized Education Partner (AEP) program
+          summary: Become authorized to purchase and resell academic priced offers and products to Qualified Educational Users (QEUs).
+          url: https://www.mepn.com/
+        # Card
+        - title: Authorized Education Partner Directory
+          summary: Search through the list of Authorized Education Partners worldwide who can deliver on customer licensing requirements, and provide solutions and services to current and future school needs.
+          url: https://www.mepn.com/MEPN/AEPSearch.aspx
+        # Card
+        - title: Education Partner community Yammer group
+          summary: Sign in with your Microsoft Partner account and join the Education Partner community private group on Yammer.
+          url: https://www.yammer.com/mepn/
\ No newline at end of file
diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md
index 0861f90f74..aff8c085b5 100644
--- a/education/trial-in-a-box/educator-tib-get-started.md
+++ b/education/trial-in-a-box/educator-tib-get-started.md
@@ -9,9 +9,11 @@ ms.topic: article
 ms.localizationpriority: medium
 ms.pagetype: edu
 ROBOTS: noindex,nofollow
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 03/18/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Educator Trial in a Box Guide
@@ -76,15 +78,15 @@ Learning Tools and the Immersive Reader can be used in the Microsoft Edge browse
 
 4. Select the **Immersive Reader** button.
 
-  ![Word Online's Immersive Reader](images/word_online_immersive_reader.png)
+   ![Word's Immersive Reader](images/word_online_immersive_reader.png)
 
 5. Press the **Play** button to hear text read aloud.
 
 6. Select these various settings to see different ways to configure Immersive Reader for your students.
 
-  | Text to Speech | Text Preferences | Grammar Options | Line Focus |
-  | :------------: | :--------------: | :-------------: | :--------: |
-  | ![Word Online Text to Speech](images/wordonline_tts.png) | ![Word Online Text Preferences](images/wordonline_text_preferences.png) | ![Word Online Grammar Options](images/wordonline_grammar_options.png) | ![Word Online Line Focus](images/wordonline_line_focus.png) |
+   | Text to Speech | Text Preferences | Grammar Options | Line Focus |
+   | :------------: | :--------------: | :-------------: | :--------: |
+   | ![Word Text to Speech](images/wordonline_tts.png) | ![Word Text Preferences](images/wordonline_text_preferences.png) | ![Word Grammar Options](images/wordonline_grammar_options.png) | ![Word Line Focus](images/wordonline_line_focus.png) |
 
 
            
 
            
@@ -131,18 +133,18 @@ When you're not using the pen, just use the magnet to stick it to the left side
 2. Take the digital pen out of the box and make notes or draw.
 
 3. Follow the instructions for the project. Look for the **Try this!** callouts to experiment with these engaging activities.
-  - Discover the power of digital ink by selecting the Draw tab. Choose your pen and get scribbling.
+   - Discover the power of digital ink by selecting the Draw tab. Choose your pen and get scribbling.
 
-    ![OneNote Draw tab](images/onenote_draw.png)
+     ![OneNote Draw tab](images/onenote_draw.png)
 
-  - Type anywhere on the page! Just click your cursor where you want to place text.
-  - Use the checkmark in the **Home** tab to keep track of completed tasks.
+   - Type anywhere on the page! Just click your cursor where you want to place text.
+   - Use the checkmark in the **Home** tab to keep track of completed tasks.
 
-    ![OneNote To Do Tag](images/onenote_checkmark.png)
+     ![OneNote To Do Tag](images/onenote_checkmark.png)
 
-  - To find information without leaving OneNote, use the Researcher tool found under the Insert tab.
+   - To find information without leaving OneNote, use the Researcher tool found under the Insert tab.
 
-    ![OneNote Researcher](images/onenote_researcher.png)
+     ![OneNote Researcher](images/onenote_researcher.png)
 
 
            
 
            
@@ -168,7 +170,7 @@ Use video to create a project summary.
 4. In the **Start** menu, search for **Photos** or select the Photos tile to launch the app.
 
 5. Select the first video to preview it full screen. Select **Edit & Create**, then select **Create a video with text**.
-  1. If you don't see the **Edit & Create** menu, select the video and the menu will appear at the top of the screen.
+   1. If you don't see the **Edit & Create** menu, select the video and the menu will appear at the top of the screen.
 
 6. Name your project “Laser Maze Project.” Hit Enter to continue.
 
@@ -176,24 +178,24 @@ Use video to create a project summary.
 
 8. Drag the videos to the Storyboard, one by one. Your project should look roughly like this:
 
-  ![Photos app layout showing videos added in previous steps](images/photo_app_1.png)
+   ![Photos app layout showing videos added in previous steps](images/photo_app_1.png)
 
 9. Select the first card in the Storyboard (the video of the project materials) and select **Text**, type a title in, a text style, a layout, and select **Done**.
 
-10.	Select the third card in the Storyboard (the video of the children assembling the maze) and select **Trim**.  Drag the trim handle on the left to shorten the duration of the clip and select **Done**.
+10. Select the third card in the Storyboard (the video of the children assembling the maze) and select **Trim**.  Drag the trim handle on the left to shorten the duration of the clip and select **Done**.
 
-11.	Select the last card on the Storyboard and select **3D effects**.
-  1. Position the playback indicator to be roughly 1 second into the video clip, or when the boy moves down to examine the laser.
-  2. Find the **lightning bolt** effect and click or drag to add it to the scene.  Rotate, scale, and position the effect so it looks like the lightning is coming out of the laser beam and hitting the black back of the mirror.
-  3. Position the blue anchor over the end of the laser pointer in the video and toggle on **Attach to a point** for the lightning bolt effect to anchor the effect in the scene.
-  4. Play back your effect.
-  5. Select **Done** when you have it where you want it.
+11. Select the last card on the Storyboard and select **3D effects**.
+    1. Position the playback indicator to be roughly 1 second into the video clip, or when the boy moves down to examine the laser.
+    2. Find the **lightning bolt** effect and click or drag to add it to the scene.  Rotate, scale, and position the effect so it looks like the lightning is coming out of the laser beam and hitting the black back of the mirror.
+    3. Position the blue anchor over the end of the laser pointer in the video and toggle on **Attach to a point** for the lightning bolt effect to anchor the effect in the scene.
+    4. Play back your effect.
+    5. Select **Done** when you have it where you want it.
 
-  ![Lighting bolt effect being added to a video clip](images/photo_app_2.png)
+    ![Lighting bolt effect being added to a video clip](images/photo_app_2.png)
 
 12. Select **Music** and select a track from the **Recommended** music collection.
-  1. The music will update automatically to match the length of your video project, even as you make changes.
-  2. If you don’t see more than a few music options, confirm that you’re connected to Wi-Fi and then close and re-open Microsoft Photos (returning to your project via the **Albums** tab). Additional music files should download in the background.
+    1. The music will update automatically to match the length of your video project, even as you make changes.
+    2. If you don’t see more than a few music options, confirm that you’re connected to Wi-Fi and then close and re-open Microsoft Photos (returning to your project via the **Albums** tab). Additional music files should download in the background.
 
 13. You can adjust the volume for the background music using the **Music volume** button.
 
@@ -224,7 +226,7 @@ Today, we'll explore a Minecraft world through the eyes of a student.
 
 3. Scroll down to the **Details** section and select **Download World**.
 
-  ![Select the download world link](images/mcee_downloadworld.png)
+   ![Select the download world link](images/mcee_downloadworld.png)
 
 4. When prompted, save the world.
 
@@ -237,28 +239,28 @@ Today, we'll explore a Minecraft world through the eyes of a student.
 8. Click **Lesson Hub Vol 1** to enter the downloaded world.
 
 9. Explore the world by using the keys on your keyboard.
-  * **W** moves forward.
-  * **A** moves left.
-  * **S** moves right.
-  * **D** moves backward.
+   * **W** moves forward.
+   * **A** moves left.
+   * **S** moves right.
+   * **D** moves backward.
 
 10. Use your mouse as your "eyes". Just move it to look around.
 
 11. For a bird's eye view, double-tap the SPACE BAR. Now press the SPACE BAR to fly higher. And then hold the SHIFT key to safely land.
 
-  To try more advanced movements or building within Minecraft, use the Minecraft Controls Diagram.
+    To try more advanced movements or building within Minecraft, use the Minecraft Controls Diagram.
 
-  ![Minecraft mouse and keyboard controls](images/mcee_keyboard_mouse_controls.png)
+    ![Minecraft mouse and keyboard controls](images/mcee_keyboard_mouse_controls.png)
 
 12. Access and adapt over 300 lesson plans, spanning all grades and subjects, to meet your needs. Enjoy exploring new worlds and happy crafting.
 
-  **Try this!**
+    **Try this!**
 
-  1. Go to education.minecraft.net/.
-  2. Click **Class Resources**.
-  3. Click **Find a Lesson**.
+    1. Go to education.minecraft.net/.
+    2. Click **Class Resources**.
+    3. Click **Find a Lesson**.
 
-  ![Access and adapt over 300 Minecraft lesson plans](images/minecraft_lesson_plans.png)
+    ![Access and adapt over 300 Minecraft lesson plans](images/minecraft_lesson_plans.png)
 
 
            
 
            
@@ -267,21 +269,21 @@ Today, we'll explore a Minecraft world through the eyes of a student.
 ![Help students understand new math concepts with the Math Assistant in OneNote](images/Inking.png)
 ## 7. Use Windows Ink to provide a personal math tutor for your students
 
-The **Math Assistant** and **Ink Replay** features available in the OneNote app for Windows 10 and OneNote Online give your students step-by-step instructions on how to solve their math problems and help them visualize math functions on an interactive 2D graph.
+The **Math Assistant** and **Ink Replay** features available in the OneNote app give your students step-by-step instructions on how to solve their math problems and help them visualize math functions on an interactive 2D graph.
 
 **Let's solve 3x+4=7 in OneNote using the pen!**
 To get started:
 1. Open the OneNote app for Windows 10 (not OneNote 2016).
 
-  ![OneNote icon](images/OneNote_logo.png)
+   ![OneNote icon](images/OneNote_logo.png)
 
 2. In the top left corner, click on the **<** arrow to access your notebooks and pages.
 
-  ![OneNote back arrow navigation button](images/left_arrow.png)
+   ![OneNote back arrow navigation button](images/left_arrow.png)
 
 3. Click **Add Page** to launch a blank work space.
 
-  ![Select add page button](images/plus-page.png)
+   ![Select add page button](images/plus-page.png)
 
 4. Make sure your pen is paired to the device. To pair, see Connect to Bluetooth devices.
 
@@ -290,30 +292,30 @@ To solve the equation 3x+4=7, follow these instructions:
 
 2. If you wrote the equation using digital ink, use the **Lasso tool** to circle the equation. If you typed the equation, highlight it using your mouse.
 
-  ![Lasso button](images/lasso.png)
+   ![Lasso button](images/lasso.png)
 
 3. On the **Draw** tab, click the **Math** button.
 
-  ![Math button](images/math-button.png)
+   ![Math button](images/math-button.png)
 
 4. From the drop-down menu in the **Math** pane, select the option to **Solve for x**. You can now see the final solution of the equation.
 
-  ![Solve for x menu](images/solve-for-x.png)
+   ![Solve for x menu](images/solve-for-x.png)
 
 5. From the second drop-down below, choose **Steps for Solving Linear Formula**, which shows you the step-by-step solution of this equation.
 
 6. On the **View** tab, click the **Replay** button. Use your mouse to select the written equation and watch your text in replay. Replay is great for students to review how the teacher solved the equation and for teachers to review how students approached a problem.
 
-  ![Replay button](images/replay.png)
+   ![Replay button](images/replay.png)
 
 To graph the equation 3x+4=7, follow these instructions:
 1. From the drop-down menu in the **Math** pane, select the option to **Graph Both Sides in 2D**. You can play with the interactive graph of your equation - use a single finger to move the graph position or two fingers to change the **zoom** level.
 
-  ![Graph both sides in 2D](images/graph-for-x.png)
+   ![Graph both sides in 2D](images/graph-for-x.png)
 
 2. Click the **Insert on Page** button below the graph to add a screenshot of the graph to your page.
-
            
-
            
+   
            
+   
            
 
 **Watch what Educators say about Microsoft Education delivering better learning outcomes**
 Bring out the best in students by providing a platform for collaborating, exploring, personalized learning, and getting things done across all devices.
@@ -337,7 +339,7 @@ For more information about checking for updates, and how to optionally turn on a
 ## Get more info
 * Learn more at microsoft.com/education
 * Find out if your school is eligible for a device trial at aka.ms/EDUTrialInABox
-* Buy Windows 10 devices
+* Buy Windows 10 devices
 
 
            
 
            
@@ -345,4 +347,4 @@ For more information about checking for updates, and how to optionally turn on a
 
            
 
            
 
            
-1 OneNote in Education Learning Tools transform the student experience.
\ No newline at end of file
+1 OneNote in Education Learning Tools transform the student experience.
diff --git a/education/trial-in-a-box/images/Thumbs.db b/education/trial-in-a-box/images/Thumbs.db
deleted file mode 100644
index d36fc0c985..0000000000
Binary files a/education/trial-in-a-box/images/Thumbs.db and /dev/null differ
diff --git a/education/trial-in-a-box/index.md b/education/trial-in-a-box/index.md
index c91f1c0264..f21a0ddcf4 100644
--- a/education/trial-in-a-box/index.md
+++ b/education/trial-in-a-box/index.md
@@ -1,6 +1,6 @@
 ---
 title: Microsoft Education Trial in a Box
-description: For IT admins, educators, and students, discover what you can do with Microsoft 365 Education. Try it out with our Trial in a Box program. 
+description: For IT admins, educators, and students, discover what you can do with Microsoft 365 Education. Try it out with our Trial in a Box program.
 keywords: education, Microsoft 365 Education, trial, full cloud IT solution, school, deploy, setup, IT admin, educator, student, explore, Trial in a Box
 ms.prod: w10
 ms.mktglfcycl: deploy
@@ -9,8 +9,8 @@ ms.topic: article
 ms.localizationpriority: medium
 ms.pagetype: edu
 ROBOTS: noindex,nofollow
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 12/11/2017
 ---
 
diff --git a/education/trial-in-a-box/itadmin-tib-get-started.md b/education/trial-in-a-box/itadmin-tib-get-started.md
index 054ecc6647..1965c6abf7 100644
--- a/education/trial-in-a-box/itadmin-tib-get-started.md
+++ b/education/trial-in-a-box/itadmin-tib-get-started.md
@@ -5,13 +5,15 @@ keywords: education, Microsoft 365 Education, trial, full cloud IT solution, sch
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.topic: get-started
+ms.topic: quickstart
 ms.localizationpriority: medium
 ms.pagetype: edu
 ROBOTS: noindex,nofollow
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 03/18/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # IT Admin Trial in a Box Guide
@@ -30,7 +32,7 @@ ms.date: 03/18/2018
 |  |  |
 
 
            
-To get the most out of Microsoft Education, we've pre-configured your tenant for you so you don't need to set it up. A tenant is representative of an organization. It is a dedicated instance of the Azure AD service that an organization receives and owns when it signs up for a Microsoft cloud service such as Azure, Microsoft Intune, or Office 365. We've also pre-populated the tenant with fictitious Student Information System (SIS) data so you can work with this as you follow the guide.
+To get the most out of Microsoft Education, we've pre-configured your tenant for you so you don't need to set it up. A tenant is representative of an organization. It is a dedicated instance of the Azure AD service that an organization receives and owns when it signs up for a Microsoft cloud service such as Azure, Microsoft Intune, or Office 365. We've also pre-populated the tenant with fictitious Student Information System (SIS) data so you can work with this as you follow the guide.
 
 If you run into any problems while following the steps in this guide, or you have questions about Trial in a Box or Microsoft Education, see [Microsoft Education Trial in a Box Support](support-options.md).
 
@@ -95,26 +97,26 @@ If you've previously used Set up School PCs to provision student devices, you ca
 
     ![Configure student PC settings](images/suspc_configure_pcsettings_selected.png)
 
-  - **Remove apps pre-installed by the device manufacturer** - If you select this option, this will reset the machine and the provisioning process will take longer (about 30 minutes).
-  - **Allow local storage (not recommended for shared devices)** lets students save files to the **Desktop** and **Documents** folder on the student PC.
-  - **Optimize device for a single student, instead of a shared cart or lab** optimizes the device for use by a single student (1:1). 
-    - Set up School PCs will change some account management logic so that it sets the expiration time for an account to 180 days (without requiring sign-in). 
-    - This setting also increases the maximum storage to 100% of the available disk space. This prevents the student's account from being erased if the student stores a lot of files or data or if the student doesn't use the PC over a prolonged period.
-  - **Let guests sign-in to these PCs** allows guests to use student PCs without a school account. If you select this option, a **Guest** account button will be added in the PC's sign-in screen to allow anyone to use the PC.
-  - **Enable Windows 10 Autopilot Reset** enables IT admins to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen any time and apply original settings and management enrollment the student PC is returned to a fully configured or known approved state. For more info, see [Autopilot Reset](https://docs.microsoft.com/education/windows/autopilot-reset).
-  - **Lock screen background** shows the default backgroudn used for student PCs provisioned by Set up School PCs. Select **Browse** to change the default.
+   - **Remove apps pre-installed by the device manufacturer** - If you select this option, this will reset the machine and the provisioning process will take longer (about 30 minutes).
+   - **Allow local storage (not recommended for shared devices)** lets students save files to the **Desktop** and **Documents** folder on the student PC.
+   - **Optimize device for a single student, instead of a shared cart or lab** optimizes the device for use by a single student (1:1). 
+     - Set up School PCs will change some account management logic so that it sets the expiration time for an account to 180 days (without requiring sign-in). 
+     - This setting also increases the maximum storage to 100% of the available disk space. This prevents the student's account from being erased if the student stores a lot of files or data or if the student doesn't use the PC over a prolonged period.
+   - **Let guests sign-in to these PCs** allows guests to use student PCs without a school account. If you select this option, a **Guest** account button will be added in the PC's sign-in screen to allow anyone to use the PC.
+   - **Enable Windows 10 Autopilot Reset** enables IT admins to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen any time and apply original settings and management enrollment the student PC is returned to a fully configured or known approved state. For more info, see [Autopilot Reset](https://docs.microsoft.com/education/windows/autopilot-reset).
+   - **Lock screen background** shows the default background used for student PCs provisioned by Set up School PCs. Select **Browse** to change the default.
 
 7. **Set up the Take a Test app** configures the device for taking quizzes and high-stakes assessments by some providers like Smarter Balanced. Windows will lock down the student PC so that students can't access anything else while taking the test.
 
     ![Configure the Take a Test app](images/suspc_takeatest.png)
 
-  1. Specify if you want to create a Take a Test button on the students' sign-in screens.
-  2. Select **Advanced settings** to allow keyboard text suggestions to appear and to allow teachers to monitor online tests. 
+   1. Specify if you want to create a Take a Test button on the students' sign-in screens.
+   2. Select **Advanced settings** to allow keyboard text suggestions to appear and to allow teachers to monitor online tests. 
 
-    > [!NOTE]
-    > The Take a Test app doesn't provide monitoring capabilities, but it allows tools like AssistX ClassPolicy to see what is going on in the app.
+      > [!NOTE]
+      > The Take a Test app doesn't provide monitoring capabilities, but it allows tools like AssistX ClassPolicy to see what is going on in the app.
 
-  3. Enter the assessment URL. 
+   3. Enter the assessment URL. 
 
 8. **Add recommended apps** lets you choose from a set of recommended Microsoft Store apps to provision. 
 
@@ -255,7 +257,7 @@ Follow these instructions to confirm if you configured your tenant correctly and
     3. If you added **Office 365 for Windows 10 S (Education Preview)** to the package and provisioned **Device B** with it, you need to click on one of the Office apps in the **Start** menu to complete app registration. 
 
 * [Verify the device is Azure AD joined](https://docs.microsoft.com/education/get-started/finish-setup-and-other-tasks#verify-the-device-is-azure-ad-joined) - Confirm that your devices are being managed in Intune for Education.
-* [Add more users](https://docs.microsoft.com/education/get-started/finish-setup-and-other-tasks#add-more-users) - Go to the Office 365 admin center to add more users.
+* [Add more users](https://docs.microsoft.com/education/get-started/finish-setup-and-other-tasks#add-more-users) - Go to the Microsoft 365 admin center to add more users.
 * Get app updates (including updates for Office 365 for Windows 10 S)
     1. Open the **Start** menu and go to the **Microsoft Store**.
     2. From the **Microsoft Store**, click **...** (See more) and select **Downloads and updates**.
@@ -276,4 +278,4 @@ For more information about checking for updates, and how to optionally turn on a
 ## Get more info
 * Learn more at microsoft.com/education
 * Find out if your school is eligible for a device trial at aka.ms/EDUTrialInABox
-* Buy Windows 10 devices
+* Buy Windows 10 devices
diff --git a/education/trial-in-a-box/support-options.md b/education/trial-in-a-box/support-options.md
index cc82641391..9cb32351de 100644
--- a/education/trial-in-a-box/support-options.md
+++ b/education/trial-in-a-box/support-options.md
@@ -1,6 +1,6 @@
 ---
 title: Microsoft Education Trial in a Box Support
-description: Need help or have a question about using Microsoft Education Trial in a Box? Start here. 
+description: Need help or have a question about using Microsoft Education Trial in a Box? Start here.
 keywords: support, troubleshooting, education, Microsoft 365 Education, full cloud IT solution, school, deploy, setup, manage, Windows 10, Intune for Education, Office 365 for Education, Microsoft Store for Education, Set up School PCs
 ms.prod: w10
 ms.mktglfcycl: deploy
@@ -9,9 +9,11 @@ ms.topic: article
 ms.localizationpriority: medium
 ms.pagetype: edu
 ROBOTS: noindex,nofollow
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 03/18/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Microsoft Education Trial in a Box Support
@@ -29,14 +31,14 @@ For more information about checking for updates, and how to optionally turn on a
 
 ## 2. Confirm your admin contact information is current
 
-1. Go to the Office 365 admin center and sign in with your Office 365 admin credentials.
+1. Go to the admin center and sign in with your Office 365 admin credentials.
 2. In the admin center dashboard, select your profile on the upper righthand corner and select **My account** from the options.
 3. Select **Personal info** and then edit **Contact details** to update  your phone, primary email address, and alternate email address. 
 
-  > [!NOTE]
-  > For the alternate email address, make sure you use a different address from your Office 365 email address.
+   > [!NOTE]
+   > For the alternate email address, make sure you use a different address from your Office 365 email address.
 
-  ![Complete your contact details](images/o365_adminaccountinfo.png)
+   ![Complete your contact details](images/o365_adminaccountinfo.png)
 
 4. Click **Save**.
 
@@ -44,15 +46,15 @@ For more information about checking for updates, and how to optionally turn on a
 
 1. Click the **Need help?** button in the lower right-hand corner of the Office 365 console.
 
-  ![Select Need help to get support](images/o365_needhelp.png)
+   ![Select Need help to get support](images/o365_needhelp.png)
 
-  You will see a sidebar window open up on the right-hand side of the screen.
+   You will see a sidebar window open up on the right-hand side of the screen.
 
-  ![Option to have a support representative call you](images/o365_needhelp_callingoption.png)
+   ![Option to have a support representative call you](images/o365_needhelp_callingoption.png)
 
-  If you chose to have a support representative call you, a new support ticket will be opened and you can track these in **Support tickets**.
+   If you chose to have a support representative call you, a new support ticket will be opened and you can track these in **Support tickets**.
 
-  ![Track your support tickets](images/o365_needhelp_supporttickets.png)
+   ![Track your support tickets](images/o365_needhelp_supporttickets.png)
 
 2. Click the **question button** ![Question button](images/o365_needhelp_questionbutton.png) in the top navigation of the sidebar window.
 3. In the field below **Need help?**, enter a description of your help request.
@@ -67,10 +69,10 @@ Forget your password? Follow these steps to recover it.
 1. Go to https://portal.office.com
 2. Select **Can't access your account** and follow the prompts to get back into your account.
 
-  ![Recover your account](images/officeportal_cantaccessaccount.png)
+   ![Recover your account](images/officeportal_cantaccessaccount.png)
 
 
 
 
 ## Get more info
-[Microsoft Education Trial in a Box](index.md)
\ No newline at end of file
+[Microsoft Education Trial in a Box](index.md)
diff --git a/education/windows/TOC.md b/education/windows/TOC.md
index 1729553e5c..b55cbbfe02 100644
--- a/education/windows/TOC.md
+++ b/education/windows/TOC.md
@@ -8,10 +8,10 @@
 #### [Azure AD Join for school PCs](set-up-school-pcs-azure-ad-join.md)
 #### [Shared PC mode for school devices](set-up-school-pcs-shared-pc-mode.md)
 #### [Provisioning package settings](set-up-school-pcs-provisioning-package.md)
-### [Use the Set up School PCs app ](use-set-up-school-pcs-app.md)
+### [Use the Set up School PCs app](use-set-up-school-pcs-app.md)
 ### [Set up student PCs to join domain](set-up-students-pcs-to-join-domain.md)
 ### [Provision student PCs with apps](set-up-students-pcs-with-apps.md)
-## [Take tests in Windows 10 ](take-tests-in-windows-10.md)
+## [Take tests in Windows 10](take-tests-in-windows-10.md)
 ### [Set up Take a Test on a single PC](take-a-test-single-pc.md)
 ### [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md)
 ### [Take a Test app technical reference](take-a-test-app-technical.md)
diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md
index 3ab4c50a66..e74ce568f1 100644
--- a/education/windows/autopilot-reset.md
+++ b/education/windows/autopilot-reset.md
@@ -7,9 +7,11 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: edu
 ms.localizationpriority: medium
-author: greg-lindsay
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 06/27/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Reset devices with Autopilot Reset 
@@ -34,8 +36,7 @@ You can set the policy using one of these methods:
 
 - MDM provider
 
-    - Autopilot Reset in Intune for Education is coming soon. In a future update of Intune for Education, new tenants will automatically have the Autopilot Reset setting enabled by default on the **All devices** group as part of initial tenant configuration. You will also be able to manage this setting to target different groups in the admin console.
-    - If you're using an MDM provider other than Intune for Education, check your MDM provider documentation on how to set this policy. If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set.
+    -Check your MDM provider documentation on how to set this policy. If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set.
 
         For example, in Intune, create a new configuration policy and add an OMA-URI. 
         - OMA-URI:  ./Vendor/MSFT/Policy/Config/CredentialProviders/DisableAutomaticReDeploymentCredentials
@@ -49,12 +50,12 @@ You can set the policy using one of these methods:
 - Set up School PCs app
 
     Autopilot Reset in the Set up School PCs app is available in the latest release of the app. Make sure you are running Windows 10, version 1709 on the student PCs if you want to use Autopilot Reset through the Set up School PCs app. You can check the version several ways:
-    - Reach out to your device manufacturer.
-    - If you manage your PCs using Intune or Intune for Education, you can check the OS version by checking the **OS version** info for the device. If  you are using another MDM provider, check the documentation for the MDM provider to confirm the OS version.
-    - Log into the PCs, go to the **Settings > System > About** page, look in the **Windows specifications** section and confirm **Version** is set to 1709.
+  - Reach out to your device manufacturer.
+  - If you manage your PCs using Intune or Intune for Education, you can check the OS version by checking the **OS version** info for the device. If  you are using another MDM provider, check the documentation for the MDM provider to confirm the OS version.
+  - Log into the PCs, go to the **Settings > System > About** page, look in the **Windows specifications** section and confirm **Version** is set to 1709.
 
     To use the Autopilot Reset setting in the Set up School PCs app:
-    * When using [Set up School PCs](use-set-up-school-pcs-app.md), in the **Configure student PC settings** screen, select **Enable Windows 10 Autopilot Reset** among the list of settings for the student PC as shown in the following example:
+  - When using [Set up School PCs](use-set-up-school-pcs-app.md), in the **Configure student PC settings** screen, select **Enable Windows 10 Autopilot Reset** among the list of settings for the student PC as shown in the following example:
 
     ![Configure student PC settings in Set up School PCs](images/suspc_configure_pc2.jpg)
     
@@ -68,14 +69,14 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo
     ![Enter CTRL+Windows key+R on the Windows lockscreen](images/autopilot-reset-lockscreen.png)
 
     This will open up a custom login screen for Autopilot Reset. The screen serves two purposes:
-    1. Confirm/verify that the end user has the right to trigger Autopilot Reset
-    2. Notify the user in case a provisioning package, created using Windows Configuration Designer or Set up School PCs, will be used as part of the process.
+   1. Confirm/verify that the end user has the right to trigger Autopilot Reset
+   2. Notify the user in case a provisioning package, created using Windows Configuration Designer or Set up School PCs, will be used as part of the process.
 
-    ![Custom login screen for Autopilot Reset](images/autopilot-reset-customlogin.png)
+      ![Custom login screen for Autopilot Reset](images/autopilot-reset-customlogin.png)
 
 2. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger Autopilot Reset.
 
->[!IMPORTANT] 
+>[!IMPORTANT]
 >To reestablish Wi-Fi connectivity after reset, make sure the **Connect automatically** box is checked for the device's wireless network connection. 
 
     Once Autopilot Reset is triggered, the reset process starts. 
@@ -91,6 +92,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo
     Once provisioning is complete, the device is again ready for use.
 
 
+
 ## Troubleshoot Autopilot Reset
 
 Autopilot Reset will fail when the [Windows Recovery Environment (WinRE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) is not enabled on the device. You will see `Error code: ERROR_NOT_SUPPORTED (0x80070032)`.
diff --git a/education/windows/change-history-edu.md b/education/windows/change-history-edu.md
index 4185c9baae..9302c8fdb4 100644
--- a/education/windows/change-history-edu.md
+++ b/education/windows/change-history-edu.md
@@ -6,15 +6,23 @@ ms.prod: w10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: edu
-author: MikeBlodge
-ms.author: MikeBlodge
-ms.date: 05/07/2018
+author: dansimp
+ms.author: dansimp
+ms.date: 05/21/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Change history for Windows 10 for Education
 
 This topic lists new and updated topics in the [Windows 10 for Education](index.md) documentation.
 
+## May 2019
+
+|New or changed topic | Description|
+|-----------|-------------|
+|[Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation)|Subscription activation support for Windows 10 Pro Education to Windows 10 Education|
+
 ## April 2018
 New or changed topic | Description
 --- | ---
@@ -48,21 +56,21 @@ New or changed topic | Description
 
 | New or changed topic | Description |
 | --- | ---- |
-| [Use the Set up School PCs app ](use-set-up-school-pcs-app.md) | Updated the prerequisites to provide more clarification. |
+| [Use the Set up School PCs app](use-set-up-school-pcs-app.md) | Updated the prerequisites to provide more clarification. |
 
 ## August 2017
 
 | New or changed topic | Description |
 | --- | ---- |
 | [Test Windows 10 S on existing Windows 10 education devices](test-windows10s-for-edu.md) | New. Find out how you can test Windows 10 S on a variety of Windows 10 devices (except Windows 10 Home) in your school and share your feedback with us. |
-| [Use the Set up School PCs app ](use-set-up-school-pcs-app.md) | Updated the instructions to reflect the new or updated functionality in the latest version of the app. |
+| [Use the Set up School PCs app](use-set-up-school-pcs-app.md) | Updated the instructions to reflect the new or updated functionality in the latest version of the app. |
 
 ## July 2017
 
 | New or changed topic | Description |
 | --- | ---- |
 | [Get Minecraft: Education Edition with Windows 10 device promotion](get-minecraft-for-education.md)  | New information about redeeming Minecraft: Education Edition licenses with qualifying purchases of Windows 10 devices.  |
-| [Use the Set up School PCs app ](use-set-up-school-pcs-app.md) | Added the how-to video, which shows how to use the app to create a provisioning package that you can use to set up school PCs. |
+| [Use the Set up School PCs app](use-set-up-school-pcs-app.md) | Added the how-to video, which shows how to use the app to create a provisioning package that you can use to set up school PCs. |
 | [Take a Test app technical reference](take-a-test-app-technical.md) | Added a Group Policy section to inform you of any policies that affect the Take a Test app or functionality within the app. |
 
 ## June 2017
@@ -71,14 +79,14 @@ New or changed topic | Description
 | --- | ---- |
 | [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md)  | Includes the following updates:

             - New configuration guidance for IT administrators to enable students and school personnel, who use assistive technology apps not available in the Microsoft Store for Education and use devices running Windows 10 S, to be successful in the classroom and in their jobs.
             - New configuration information when using Windows 10 S for education. |
 | [Deployment recommendations for school IT administrators](edu-deployment-recommendations.md)  | New configuration guidance for IT administrators to enable students and school personnel, who use assistive technology apps not available in the Microsoft Store for Education and use devices running Windows 10 S, to be successful in the classroom and in their jobs. |
-| [Use the Set up School PCs app ](use-set-up-school-pcs-app.md) | Updated the recommended apps section to include information about Office 365 for Windows 10 S (Education Preview). |
+| [Use the Set up School PCs app](use-set-up-school-pcs-app.md) | Updated the recommended apps section to include information about Office 365 for Windows 10 S (Education Preview). |
 
 ## May 2017
 
 | New or changed topic | Description |
 | --- | ---- |
 | [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) | New. If you have an education tenant and use devices Windows 10 Pro or Windows 10 S in your schools, find out how you can opt-in to a free switch to Windows 10 Pro Education. |
-| [Use the Set up School PCs app ](use-set-up-school-pcs-app.md) | Updated. Now includes network tips and updated step-by-step instructions that show the latest updates to the app such as Wi-Fi setup. |
+| [Use the Set up School PCs app](use-set-up-school-pcs-app.md) | Updated. Now includes network tips and updated step-by-step instructions that show the latest updates to the app such as Wi-Fi setup. |
 
 ## RELEASE: Windows 10, version 1703 (Creators Update)
 
@@ -89,9 +97,9 @@ New or changed topic | Description
 | [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md)  | New. Provides guidance on ways to configure the OS diagnostic data, consumer experiences, Cortana, search, as well as some of the preinstalled apps, so that Windows is ready for your school. |
 | [Deployment recommendations for school IT administrators](edu-deployment-recommendations.md)  | Updated the screenshots and related instructions to reflect the current UI and experience.  |
 | [Set up Windows devices for education](set-up-windows-10.md) | Updated for Windows 10, version 1703. |
-| Set up School PCs app: 
             [Technical reference for the Set up School PCs app](set-up-school-pcs-technical.md) 
             [Use the Set up School PCs app ](use-set-up-school-pcs-app.md) | Updated. Describes the school-specific settings and policies that Set up School PC configures. Also provides step-by-step instructions for using the latest version of the app to create a provisioning package that you can use to set up student PCs. |
+| Set up School PCs app: 
             [Technical reference for the Set up School PCs app](set-up-school-pcs-technical.md) 
             [Use the Set up School PCs app](use-set-up-school-pcs-app.md) | Updated. Describes the school-specific settings and policies that Set up School PC configures. Also provides step-by-step instructions for using the latest version of the app to create a provisioning package that you can use to set up student PCs. |
 | Set up using Windows Configuration Designer: 
             [Set up student PCs to join domain](set-up-students-pcs-to-join-domain.md) 
             [Provision student PCs with apps](set-up-students-pcs-with-apps.md) | Updated the information for Windows 10, version 1703. |
-| [Take tests in Windows 10 ](take-tests-in-windows-10.md) 
             [Set up Take a Test on a single PC](take-a-test-single-pc.md) 
             [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) 
             [Take a Test app technical reference](take-a-test-app-technical.md) | Updated. Includes new information on ways you can set up the test account and assessment URL and methods for creating and distributing the link. Methods available to you vary depending on whether you're setting up Take a Test on a single PC or multiple PCs. |
+| [Take tests in Windows 10](take-tests-in-windows-10.md) 
             [Set up Take a Test on a single PC](take-a-test-single-pc.md) 
             [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md) 
             [Take a Test app technical reference](take-a-test-app-technical.md) | Updated. Includes new information on ways you can set up the test account and assessment URL and methods for creating and distributing the link. Methods available to you vary depending on whether you're setting up Take a Test on a single PC or multiple PCs. |
 
 ## January 2017
 
diff --git a/education/windows/change-to-pro-education.md b/education/windows/change-to-pro-education.md
index 58dcd89d1e..e40ce61ea7 100644
--- a/education/windows/change-to-pro-education.md
+++ b/education/windows/change-to-pro-education.md
@@ -7,9 +7,11 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: edu
 ms.localizationpriority: medium
-author: MikeBlodge
-ms.author: jaimeo
-ms.date: 04/30/2018
+author: dansimp
+ms.author: dansimp
+ms.date: 05/21/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Change to Windows 10 Pro Education from Windows 10 Pro
@@ -20,6 +22,9 @@ If you have an education tenant and use devices with Windows 10 Pro, global admi
 
 To take advantage of this offering, make sure you meet the [requirements for changing](#requirements-for-changing). For academic customers who are eligible to change to Windows 10 Pro Education, but are unable to use the above methods, contact Microsoft Support for assistance.
 
+>[!IMPORTANT]
+>If you change a Windows 10 Pro device to Windows 10 Pro Education using Microsoft Store for Education, [subscription activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation) won't work.
+
 ## Requirements for changing
 Before you change to Windows 10 Pro Education, make sure you meet these requirements:
 - Devices must be running Windows 10 Pro, version 1607 or higher.
@@ -32,7 +37,7 @@ Before you change to Windows 10 Pro Education, make sure you meet these requirem
 - The user making the changes must be a member of the Azure AD global administrator group.
 
 ## Compare Windows 10 Pro and Pro Education editions
-You can [compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare) to find out more about the features we support in other editions of Windows 10.
+You can [compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare) to find out more about the features we support in other editions of Windows 10.
 
 For more info about Windows 10 default settings and recommendations for education customers, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md).
 
@@ -96,8 +101,8 @@ When you change to Windows 10 Pro Education, you get the following benefits:
 - **Windows 10 Pro Education edition**. Devices currently running Windows 10 Pro, version 1607 or higher, or Windows 10 S mode, version 1703, can get Windows 10 Pro Education Current Branch (CB). This benefit does not include Long Term Service Branch (LTSB).
 - **Support from one to hundreds of users**. The Windows 10 Pro Education program does not have a limitation on the number of licenses an organization can have.
 - **Roll back options to Windows 10 Pro**
-    - When a user leaves the domain or you turn off the setting to automatically change to Windows 10 Pro Education, the device reverts seamlessly to Windows 10 Pro edition (after a grace period of up to 30 days). 
-    - For devices that originally had Windows 10 Pro edition installed, when a license expires or is transferred to another user, the Windows 10 Pro Education device seamlessly steps back down to Windows 10 Pro. 
+  - When a user leaves the domain or you turn off the setting to automatically change to Windows 10 Pro Education, the device reverts seamlessly to Windows 10 Pro edition (after a grace period of up to 30 days). 
+  - For devices that originally had Windows 10 Pro edition installed, when a license expires or is transferred to another user, the Windows 10 Pro Education device seamlessly steps back down to Windows 10 Pro. 
 
     See [Roll back Windows 10 Pro Education to Windows 10 Pro](#roll-back-windows-10-pro-education-to-windows-10-pro) for more info.
 
@@ -109,7 +114,7 @@ Once you enable the setting to change to Windows 10 Pro Education, the change wi
 
 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your work or school account.
 
-  If this is the first time you're signing into the Microsoft Store for Education, you'll be prompted to accept the Microsoft Store for Education Terms of Use.
+   If this is the first time you're signing into the Microsoft Store for Education, you'll be prompted to accept the Microsoft Store for Education Terms of Use.
 
 2. Click **Manage** from the top menu and then select the **Benefits tile**.
 3. In the **Benefits** tile, look for the **Change to Windows 10 Pro Education for free** link and then click it.
@@ -307,6 +312,8 @@ For more information about integrating on-premises AD DS domains with Azure AD,
 
 ## Related topics
 
-[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
             
-[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)
             
-[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare)
+[Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)  
+[Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)  
+[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)  
+[Windows 10 subscription activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation)
+
diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md
index e981deb743..cbbdb3502b 100644
--- a/education/windows/chromebook-migration-guide.md
+++ b/education/windows/chromebook-migration-guide.md
@@ -2,14 +2,16 @@
 title: Chromebook migration guide (Windows 10)
 description: In this guide you will learn how to migrate a Google Chromebook-based learning environment to a Windows 10-based learning environment.
 ms.assetid: 7A1FA48A-C44A-4F59-B895-86D4D77F8BEA
+ms.reviewer: 
+manager: dansimp
 keywords: migrate, automate, device, Chromebook migration
 ms.prod: w10
 ms.mktglfcycl: plan
 ms.sitesec: library
 ms.pagetype: edu, devices
 ms.localizationpriority: medium
-author: craigash
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 10/13/2017
 ---
 
@@ -41,7 +43,7 @@ Before you can do any analysis or make decisions about which apps to migrate or
 > [!NOTE]  
 > The majority of Chromebook apps are web apps. For these apps you need to first perform Microsoft Edge compatibility testing and then publish the web app URL to the Windows users. For more information, see the [Perform app compatibility testing for web apps](#perform-testing-webapps) section.
 
- 
+ 
 
 You can divide the apps into the following categories:
 
@@ -73,15 +75,15 @@ Table 1. Google App replacements
 
 | If you use this Google app on a Chromebook | Use this app on a Windows device     |
 |--------------------------------------------|--------------------------------------|
-| Google Docs                                | Word 2016 or Word Online             |
-| Google Sheets                              | Excel 2016 or Excel Online           |
-| Google Slides                              | PowerPoint 2016 or PowerPoint Online |
+| Google Docs                                | Word 2016 or Word for the web             |
+| Google Sheets                              | Excel 2016 or Excel for the web           |
+| Google Slides                              | PowerPoint 2016 or PowerPoint for the web |
 | Google Apps Gmail                          | Outlook 2016 or Outlook Web App      |
 | Google Hangouts                            | Microsoft Skype for Business         |
 | Chrome                                     | Microsoft Edge                       |
 | Google Drive                               | Microsoft OneDrive for Business      |
 
- 
+ 
 
 It may be that you will decide to replace Google Apps after you deploy Windows devices. For more information on making this decision, see the [Select cloud services migration strategy](#select-cs-migrationstrat) section of this guide.
 
@@ -162,7 +164,7 @@ Table 2. Settings in the Device Management node in the Google Admin Console
 
            These settings configure and manage companion devices (such as smartphones or tablets) that are used in conjunction with the Chromebook devices and include the following settings categories:
            
 
              
 
            • User settings. Configures user-based settings for the Chrome browser and Chromebook devices. Most of these Chromebook user-based settings can be mapped to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.
              • 
-
            • Public session settings. Configures Public Sessions for Chrome devices that are used as kiosks, loaner devices, shared computers, or for any other work or school-related purpose for which users don't need to sign in with their credentials. You can configure Windows devices similarly by using Assigned Access. Record the settings and apps that are available in Public Sessions so that you can provide similar configuration in Assigned Access.
              • 
+
            • Public session settings. Configures Public Sessions for Chrome devices that are used as kiosks, loaner devices, shared computers, or for any other work or school-related purpose for which users don't need to sign in with their credentials. You can configure Windows devices similarly by using Assigned Access. Record the settings and apps that are available in Public Sessions so that you can provide similar configuration in Assigned Access.
              • 
 
            • Device settings. Configures device-based settings for the Chrome browser and Chromebook devices. You can map most of these Chromebook device-based settings to a corresponding setting in Windows. Record the settings and then map them to settings in Group Policy or Intune.
              • 
 
            • Devices. Manages Chrome device management licenses. The number of licenses recorded here should correspond to the number of licenses you will need for your new management system, such as Intune. Record the number of licenses and use those to determine how many licenses you will need to manage your Windows devices.
              • 
 
            • App Management. Provides configuration settings for Chrome apps. Record the settings for any apps that you have identified that will run on Windows devices.
              • 
@@ -171,7 +173,7 @@ Table 2. Settings in the Device Management node in the Google Admin Console
 
 
 
- 
+ 
 
 Table 3 lists the settings in the Security node in the Google Admin Console. Review the settings and determine which settings you will migrate to Windows.
 
@@ -213,7 +215,7 @@ Table 3. Settings in the Security node in the Google Admin Console
 
 
 
- 
+ 
 
 **Identify locally-configured settings to migrate**
 
@@ -246,7 +248,7 @@ Table 4. Locally-configured settings
 | Powerwash              | This action removes all user accounts and resets the Chromebook device back to factory settings. You don’t have to migrate any settings in this section.                                                                                                                                                                                                                                                                                                                                                                     |
 | Reset settings         | This action retains all user accounts, but restores all settings back to their default values. You don’t have to migrate any settings in this section.                                                                                                                                                                                                                                                                                                                                                                       |
 
- 
+ 
 
 Determine how many users have similar settings and then consider managing those settings centrally. For example, a large number of users may have many of the same Chrome web browser settings. You can centrally manage these settings in Windows after migration.
 
@@ -349,7 +351,7 @@ Here is a list of reasons that describe why you might want to migrate from an ex
 
 -   **Better integration with Office 365.** If your long-term strategy is to migrate to Office 365 apps (such as Word 2016 or Excel 2016) then a migration to Microsoft cloud services will provide better integration with these apps. The use of existing cloud services may not be as intuitive for users. For example, Office 365 apps will integrate better with OneDrive for Business compared to Google Drive.
 
--   **Online apps offer better document compatibility.** Microsoft Office online apps (such as Word Online and Excel Online) provide the highest level of compatibility with Microsoft Office documents. The Office online apps allow you to open and edit documents directly from SharePoint or OneDrive for Business. Users can access the Office online app from any device with Internet connectivity.
+-   **Online apps offer better document compatibility.** Microsoft Office apps (such as Word and Excel for the web) provide the highest level of compatibility with Microsoft Office documents. The Office apps allow you to open and edit documents directly from SharePoint or OneDrive for Business. Users can access the Office app from any device with Internet connectivity.
 
 -   **Reduce licensing costs.** If you pay for Office 365 licenses, then Office 365 apps and cloud storage are included in those licenses. Although you could keep existing cloud services, you probably would pay more to keep those services.
 
@@ -455,7 +457,7 @@ Table 5. Select on-premises AD DS, Azure AD, or hybrid
 X
 
 
-Use System Center 2012 R2 Configuration Manager for management
+Use Microsoft Endpoint Configuration Manager for management
 X
 
 X
@@ -481,7 +483,7 @@ Table 5. Select on-premises AD DS, Azure AD, or hybrid
 
 
 
- 
+ 
 
 ### 
 
@@ -491,7 +493,7 @@ You may ask the question, “Why plan for device, user, and app management befor
 
 Also, planning management before deployment is essential to being ready to support the devices as you deploy them. You want to have your management processes and technology in place when the first teachers, facility, or students start using their new Windows device.
 
-Table 6 is a decision matrix that lists the device, user, and app management products and technologies and the features supported by each product or technology. The primary device, user, and app management products and technologies include Group Policy, System Center Configuration Manager, Intune, and the Microsoft Deployment Toolkit (MDT). Use this decision matrix to help you select the right combination of products and technologies for your plan.
+Table 6 is a decision matrix that lists the device, user, and app management products and technologies and the features supported by each product or technology. The primary device, user, and app management products and technologies include Group Policy, Microsoft Endpoint Configuration Manager, Intune, and the Microsoft Deployment Toolkit (MDT). Use this decision matrix to help you select the right combination of products and technologies for your plan.
 
 Table 6. Device, user, and app management products and technologies
 
@@ -601,7 +603,7 @@ Table 6. Device, user, and app management products and technologies
 
 
 
- 
+ 
 
 You can use Configuration Manager and Intune in conjunction with each other to provide features from both products and technologies. In some instances you may need only one of these products or technologies. In other instances, you may need two or more to meet the device, user, and app management needs for your institution.
 
@@ -678,21 +680,21 @@ Table 7. Network infrastructure products and technologies and deployment resourc
 
 DHCP
 
 
 
 DNS
 
 
 
 
 
- 
+ 
 
 If you use network infrastructure products and technologies from other vendors, refer to the vendor documentation on how to perform the necessary remediation. If you determined that no remediation is necessary, you can skip this section.
 
@@ -720,22 +722,22 @@ Table 8. AD DS, Azure AD and deployment resources
 
 AD DS
 
 
 
 Azure AD
 
 
 
 
 
- 
+ 
 
 If you decided not to migrate to AD DS or Azure AD as a part of the migration, or if you determined that no remediation is necessary, you can skip this section. If you use identity products and technologies from another vendor, refer to the vendor documentation on how to perform the necessary steps.
 
@@ -763,44 +765,44 @@ Table 9. Management systems and deployment resources
 
 Windows provisioning packages
 
 
 
 Group Policy
 
 
 
 Configuration Manager
 
 
 
 Intune
 
 
 
 MDT
 
 
 
 
 
- 
+ 
 
 If you determined that no new management system or no remediation of existing systems is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps.
 
@@ -828,29 +830,29 @@ Table 10. Management systems and app deployment resources
 
 Group Policy
 
 
 
 Configuration Manager
 
 
 
 Intune
 
 
 
 
 
- 
+ 
 
 If you determined that no deployment of apps is necessary, you can skip this section. If you use a management system from another vendor, refer to the vendor documentation on how to perform the necessary steps.
 
@@ -956,9 +958,9 @@ After you complete these steps, your management system should take over the day-
 
 [Try it out: Windows 10 in the classroom](https://go.microsoft.com/fwlink/p/?LinkId=623255)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md
index 9d1acc0a3c..688b66c92b 100644
--- a/education/windows/configure-windows-for-education.md
+++ b/education/windows/configure-windows-for-education.md
@@ -7,9 +7,11 @@ ms.sitesec: library
 ms.prod: w10
 ms.pagetype: edu
 ms.localizationpriority: medium
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 08/31/2017
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Windows 10 configuration recommendations for education customers
@@ -46,16 +48,16 @@ It is easy to be education ready when using Microsoft products. We recommend the
     You can [sign up to learn more about Intune for Education](https://info.microsoft.com/US-WNDWS-CNTNT-FY17-01Jan-17-IntuneforEducationlandingpageandnurture292531_01Registration-ForminBody.html).
 
 3. On PCs running Windows 10, version 1703:
-  1. Provision the PC using one of these methods:
-    * [Provision PCs with the Set up School PCs app](use-set-up-school-pcs-app.md) - This will automatically set both **SetEduPolicies** to True and **AllowCortana** to False.
-    * [Provision PCs with a custom package created with Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/configure/provisioning-create-package) - Make sure to set both **SetEduPolicies** to True and **AllowCortana** to False.
-  2. Join the PC to Azure Active Directory.
-    * Use Set up School PCs or Windows Configuration Designer to bulk enroll to Azure AD.
-    * Manually Azure AD join the PC during the Windows device setup experience.
-  3. Enroll the PCs in MDM.
-    * If you have activated Intune for Education in your Azure AD tenant, enrollment will happen automatically when the PC is joined to Azure AD. Intune for Education will automatically set **SetEduPolicies** to True and **AllowCortana** to False.
-  4. Ensure that needed assistive technology apps can be used.
-    * If you have students or school personnel who rely on assistive technology apps that are not available in the Microsoft Store for Education, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info.
+   1. Provision the PC using one of these methods:
+      * [Provision PCs with the Set up School PCs app](use-set-up-school-pcs-app.md) - This will automatically set both **SetEduPolicies** to True and **AllowCortana** to False.
+      * [Provision PCs with a custom package created with Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/configure/provisioning-create-package) - Make sure to set both **SetEduPolicies** to True and **AllowCortana** to False.
+   2. Join the PC to Azure Active Directory.
+      * Use Set up School PCs or Windows Configuration Designer to bulk enroll to Azure AD.
+      * Manually Azure AD join the PC during the Windows device setup experience.
+   3. Enroll the PCs in MDM.
+      * If you have activated Intune for Education in your Azure AD tenant, enrollment will happen automatically when the PC is joined to Azure AD. Intune for Education will automatically set **SetEduPolicies** to True and **AllowCortana** to False.
+   4. Ensure that needed assistive technology apps can be used.
+      * If you have students or school personnel who rely on assistive technology apps that are not available in the Microsoft Store for Education, and who are using a Windows 10 S device, configure their device to Windows 10 Pro Education to allow the download and use of non-Microsoft Store assistive technology apps. See [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md) for more info.
 
 4. Distribute the PCs to students.
 
@@ -85,14 +87,14 @@ Use one of these methods to set this policy.
 ### MDM
 - Intune for Education automatically sets this policy in the **All devices** group policy configuration.
 - If you're using an MDM provider other than Intune for Education, check your MDM provider documentation on how to set this policy.
-    - If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set.
+  - If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set.
 
-        For example, in Intune, create a new configuration policy and add an OMA-URI. 
-        - OMA-URI:  ./Vendor/MSFT/Policy/Config/Experience/AllowCortana
-        - Data type:  Integer
-        - Value:  0
+      For example, in Intune, create a new configuration policy and add an OMA-URI. 
+    - OMA-URI:  ./Vendor/MSFT/Policy/Config/Experience/AllowCortana
+    - Data type:  Integer
+    - Value:  0
 
-        ![Create an OMA URI for AllowCortana](images/allowcortana_omauri.png)
+      ![Create an OMA URI for AllowCortana](images/allowcortana_omauri.png)
 
 ### Group Policy
 Set **Computer Configuration > Administrative Templates > Windows Components > Search > AllowCortana** to **Disabled**.
@@ -114,14 +116,14 @@ Use one of these methods to set this policy.
 ### MDM
 - Intune for Education automatically sets this policy in the **All devices** group policy configuration.
 - If you're using an MDM provider other than Intune for Education, check your MDM provider documentation on how to set this policy.
-    - If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set.
+  - If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set.
 
-        For example, in Intune, create a new configuration policy and add an OMA-URI.
-        - OMA-URI:  ./Vendor/MSFT/SharedPC/SetEduPolicies
-        - Data type:  Boolean
-        - Value:  true
+      For example, in Intune, create a new configuration policy and add an OMA-URI.
+    - OMA-URI:  ./Vendor/MSFT/SharedPC/SetEduPolicies
+    - Data type:  Boolean
+    - Value:  true
 
-        ![Create an OMA URI for SetEduPolices](images/setedupolicies_omauri.png)
+      ![Create an OMA URI for SetEduPolices](images/setedupolicies_omauri.png)
 
 ### Group Policy
 **SetEduPolicies** is not natively supported in Group Policy. Instead, use the [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224(v=vs.85).aspx) to set the policy in [MDM SharedPC](https://msdn.microsoft.com/library/windows/desktop/mt779129(v=vs.85).aspx). 
diff --git a/education/windows/create-tests-using-microsoft-forms.md b/education/windows/create-tests-using-microsoft-forms.md
deleted file mode 100644
index f8c2aecdf4..0000000000
--- a/education/windows/create-tests-using-microsoft-forms.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-title: Create tests using Microsoft Forms
-description: Learn how to use Microsoft Forms with the Take a Test app to prevent access to other computers or online resources while completing a test.
-keywords: school, Take a Test, Microsoft Forms
-ms.prod: w10
-ms.mktglfcycl: plan
-ms.sitesec: library
-ms.pagetype: edu
-author: CelesteDG
-ms.author: celested
-redirect_url: https://support.microsoft.com/help/4000711/windows-10-create-tests-using-microsoft-forms
----
-
-# Create tests using Microsoft Forms
-**Applies to:**
-
--   Windows 10   
-
-
-For schools that have an Office 365 Education subscription, teachers can use [Microsoft Forms](https://support.office.com/article/What-is-Microsoft-Forms-6b391205-523c-45d2-b53a-fc10b22017c8) to create a test and then require that students use the Take a Test app to block access to other computers or online resources while completing the test created through Microsoft Forms.
-
-To do this, teachers can select a check box to make it a secure test. Microsoft Forms will generate a link that you can use to embed into your OneNote or class website. When students are ready to take a test, they can click on the link to start the test.
-
-Microsoft Forms will perform checks to ensure students are taking the test in a locked down Take a Test session. If not, students are not permitted access to the assessment.
-
-[Learn how to block Internet access while students complete your form](https://support.office.com/article/6bd7e31d-5be0-47c9-a0dc-c0a74fc48959)
-
-
-## Related topics
-
-[Take tests in Windows 10](take-tests-in-windows-10.md)
diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md
index 67bf3f18d4..c081cfa696 100644
--- a/education/windows/deploy-windows-10-in-a-school-district.md
+++ b/education/windows/deploy-windows-10-in-a-school-district.md
@@ -1,15 +1,16 @@
 ---
 title: Deploy Windows 10 in a school district (Windows 10)
-description: Learn how to deploy Windows 10 in a school district. Integrate the school environment with Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD), use System Center Configuration Manager, Intune, and Group Policy to manage devices.
+description: Learn how to deploy Windows 10 in a school district. Integrate the school environment with Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD), use Microsoft Endpoint Configuration Manager, Intune, and Group Policy to manage devices.
 keywords: configure, tools, device, school district, deploy Windows 10
 ms.prod: w10
 ms.mktglfcycl: plan
 ms.pagetype: edu
 ms.sitesec: library
 ms.localizationpriority: medium
-author: craigash
-ms.author: celested
-ms.date: 10/30/2017
+author: dansimp
+ms.author: dansimp
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Deploy Windows 10 in a school district
@@ -19,13 +20,13 @@ ms.date: 10/30/2017
 - Windows 10
 
 
-This guide shows you how to deploy the Windows 10 operating system in a school district. You learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. This guide also describes how to use Microsoft System Center Configuration Manager, Microsoft Intune, and Group Policy to manage devices. Finally, the guide discusses common, ongoing maintenance tasks that you will perform after initial deployment as well as the automated tools and built-in features of the operating system.
+This guide shows you how to deploy the Windows 10 operating system in a school district. You learn how to deploy Windows 10 in classrooms; integrate the school environment with Microsoft Office 365, Active Directory Domain Services (AD DS), and Microsoft Azure Active Directory (Azure AD); and deploy Windows 10 and your apps to new devices or upgrade existing devices to Windows 10. This guide also describes how to use Microsoft Endpoint Configuration Manager, Microsoft Intune, and Group Policy to manage devices. Finally, the guide discusses common, ongoing maintenance tasks that you will perform after initial deployment as well as the automated tools and built-in features of the operating system.
 
 ## Prepare for district deployment
 
 Proper preparation is essential for a successful district deployment. To avoid common mistakes, your first step is to plan a typical district configuration. Just as with building a house, you need a blueprint for what your district and individual schools should look like when it’s finished. The second step in preparation is to learn how you will manage the users, apps, and devices in your district. Just as a builder needs to have the right tools to build a house, you need the right set of tools to deploy your district.
 
->**Note**  This guide focuses on Windows 10 deployment and management in a district. For management of other devices and operating systems in education environments, see [Manage BYOD and corporate-owned devices with MDM solutions](https://www.microsoft.com/en-us/cloud-platform/mobile-device-management).
+>**Note**  This guide focuses on Windows 10 deployment and management in a district. For management of other devices and operating systems in education environments, see [Manage BYOD and corporate-owned devices with MDM solutions](https://www.microsoft.com/cloud-platform/mobile-device-management).
 
 ### Plan a typical district configuration
 
@@ -75,7 +76,7 @@ Use these characteristics at a minimum as you deploy your schools. If your distr
 
 Office 365 Education allows:
 
-* Students and faculty to use Microsoft Office Online to create and edit Microsoft Word, OneNote, PowerPoint, and Excel documents in a browser.
+* Students and faculty to use Microsoft Office to create and edit Microsoft Word, OneNote, PowerPoint, and Excel documents in a browser.
 * Teachers to use the [OneNote Class Notebook app](https://www.onenote.com/classnotebook) to share content and collaborate with students.
 * Faculty to use the [OneNote Staff Notebooks app](https://www.onenote.com/staffnotebookedu) to collaborate with other teachers, the administration, and faculty.
 * Teachers to employ Sway to create interactive educational digital storytelling.
@@ -98,9 +99,9 @@ Now that you have the plan (blueprint) for your district and individual schools
 
 The primary tool you will use to deploy Windows 10 in your school is MDT, which uses Windows ADK components to make deployment easier. You could just use the Windows ADK to perform your deployment, but MDT simplifies the process by providing an intuitive, wizard-driven user interface (UI).
 
-You can use MDT as a stand-alone tool or integrate it with System Center Configuration Manager. As a stand-alone tool, MDT performs Lite Touch Installation (LTI) deployments—deployments that require minimal infrastructure and allow you to control the level of automation. When integrated with System Center Configuration Manager, MDT performs Zero Touch Installation (ZTI) deployments, which require more infrastructure (such as System Center Configuration Manager) but result in fully automated deployments.
+You can use MDT as a stand-alone tool or integrate it with Microsoft Endpoint Configuration Manager. As a stand-alone tool, MDT performs Lite Touch Installation (LTI) deployments—deployments that require minimal infrastructure and allow you to control the level of automation. When integrated with Configuration Manager, MDT performs Zero Touch Installation (ZTI) deployments, which require more infrastructure (such as Configuration Manager) but result in fully automated deployments.
 
-This guide focuses on LTI deployments to deploy the reference device. You can use ZTI deployments with System Center Configuration Manager or LTI deployments to deploy the reference images to your faculty and student devices. If you want to only use MDT, see [Deploy Windows 10 in a school](https://technet.microsoft.com/edu/windows/deploy-windows-10-in-a-school).
+This guide focuses on LTI deployments to deploy the reference device. You can use ZTI deployments with Configuration Manager or LTI deployments to deploy the reference images to your faculty and student devices. If you want to only use MDT, see [Deploy Windows 10 in a school](https://technet.microsoft.com/edu/windows/deploy-windows-10-in-a-school).
 
 MDT includes the Deployment Workbench, a console from which you can manage the deployment of Windows 10 and your apps. You configure the deployment process in the Deployment Workbench, including the management of operating systems, device drivers, apps, and migration of user settings on existing devices.
 
@@ -108,13 +109,13 @@ LTI performs deployment from a *deployment share* — a network-shared folder on
 
 The focus of MDT is deployment, so you also need tools that help you manage your Windows 10 devices and apps. You can manage Windows 10 devices and apps with Intune, the Compliance Management feature in Office 365, or Group Policy in AD DS. You can use any combination of these tools based on your school requirements.
 
-ZTI performs fully automated deployments using System Center Configuration Manager and MDT. Although you could use System Center Configuration Manager by itself, using System Center Configuration Manager with MDT provides an easier process for deploying operating systems. MDT works with the operating system deployment feature in System Center Configuration Manager.
+ZTI performs fully automated deployments using Configuration Manager and MDT. Although you could use Configuration Manager by itself, using Configuration Manager with MDT provides an easier process for deploying operating systems. MDT works with the operating system deployment feature in Configuration Manager.
 
 The configuration process requires the following devices:
 
-* **Admin device.** This is the device you use for your day-to-day job functions. It’s also the one you use to create and manage the Windows 10 and app deployment process. You install the Windows ADK, MDT, and the System Center Configuration Manager Console on this device.
+* **Admin device.** This is the device you use for your day-to-day job functions. It’s also the one you use to create and manage the Windows 10 and app deployment process. You install the Windows ADK, MDT, and the Configuration Manager Console on this device.
 * **Reference devices.** These are the devices that you will use as a template for the faculty and student devices. You install Windows 10 and Windows desktop apps on these devices, and then capture an image (.wim file) of the devices.
-  You will have a reference device for each type of device in your district. For example, if your district has Surface, HP Stream, Dell Inspiron, and Lenovo Yoga devices, then you would have a reference device for each model. For more information about approved Windows 10 devices, see [Explore devices](https://www.microsoft.com/en-us/windows/view-all).
+  You will have a reference device for each type of device in your district. For example, if your district has Surface, HP Stream, Dell Inspiron, and Lenovo Yoga devices, then you would have a reference device for each model. For more information about approved Windows 10 devices, see [Explore devices](https://www.microsoft.com/windows/view-all).
 * **Faculty and staff devices.** These are the devices that the teachers, faculty, and staff use for their day-to-day job functions. You use the admin device to deploy (or upgrade) Windows 10 and apps to these devices.
 * **Student devices.** The students will use these devices. You will use the admin device deploy (or upgrade) Windows 10 and apps to them.
 
@@ -132,7 +133,7 @@ The high-level process for deploying and configuring devices within individual c
 
 6. On the reference devices, deploy Windows 10 and the Windows desktop apps on the device, and then capture the reference image from the devices.
 
-7. Import the captured reference images into MDT or System Center Configuration Manager.
+7. Import the captured reference images into MDT or Microsoft Endpoint Configuration Manager.
 
 8. On the student and faculty devices, deploy Windows 10 to new or existing devices, or upgrade eligible devices to Windows 10.
 
@@ -159,9 +160,9 @@ Before you select the deployment and management methods, you need to review the
 |Scenario feature |Cloud-centric|On-premises and cloud|
 |---|---|---|
 |Identity management | Azure AD (stand-alone or integrated with on-premises AD DS)  |  AD DS integrated with Azure AD |
-|Windows 10 deployment   | MDT only  |  System Center Configuration Manager with MDT |
+|Windows 10 deployment   | MDT only  |  Microsoft Endpoint Configuration Manager with MDT |
 |Configuration setting management  | Intune  |  Group Policy

              Intune|
-|App and update management |  Intune |System Center Configuration Manager

              Intune|
+|App and update management |  Intune |Microsoft Endpoint Configuration Manager

              Intune|
 
 *Table 1. Deployment and management scenarios*
 
@@ -173,14 +174,14 @@ These scenarios assume the need to support:
 Some constraints exist in these scenarios. As you select the deployment and management methods for your device, keep the following constraints in mind:
 
 * You can use Group Policy or Intune to manage configuration settings on a device but not both.
-* You can use System Center Configuration Manager or Intune to manage apps and updates on a device but not both.
+* You can use Microsoft Endpoint Configuration Manager or Intune to manage apps and updates on a device but not both.
 * You cannot manage multiple users on a device with Intune if the device is AD DS domain joined.
 
 Use the cloud-centric scenario and on-premises and cloud scenario as a guide for your district. You may need to customize these scenarios, however, based on your district. As you go through the [Select the deployment methods](#select-the-deployment-methods), [Select the configuration setting management methods](#select-the-configuration-setting-management-methods), and the [Select the app and update management products](#select-the-app-and-update-management-products) sections, remember these scenarios and use them as the basis for your district.
 
 ### Select the deployment methods
 
-To deploy Windows 10 and your apps, you can use MDT by itself or System Center Configuration Manager and MDT together. For a district, there are a few ways to deploy Windows 10 to devices. Table 2 lists the methods that this guide describes and recommends. Use this information to determine which combination of deployment methods is right for your institution.
+To deploy Windows 10 and your apps, you can use MDT by itself or Microsoft Endpoint Configuration Manager and MDT together. For a district, there are a few ways to deploy Windows 10 to devices. Table 2 lists the methods that this guide describes and recommends. Use this information to determine which combination of deployment methods is right for your institution.
 
 @@ -229,8 +230,8 @@ Select this method when you:
              
-
-
+
-
-
+
-
-
+
-
+
-
@@ -1132,10 +1133,10 @@ In addition, you must prepare your environment for sideloading Microsoft Store a
 
@@ -1159,7 +1160,7 @@ For more information about how to create an MDT application for Window desktop a
 
@@ -1170,38 +1171,38 @@ For more information about how to update a deployment share, see [Update a Deplo
 
 *Table 16. Tasks to configure the MDT deployment share*
 
-### Configure System Center Configuration Manager
+### Configure Microsoft Endpoint Configuration Manager
 
->**Note**  If you have already configured your System Center Configuration Manager infrastructure to support the operating system deployment feature or if you selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next section.
+>**Note**  If you have already configured your Microsoft Endpoint Configuration Manager infrastructure to support the operating system deployment feature or if you selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next section.
 
-Before you can use System Center Configuration Manager to deploy Windows 10 and manage your apps and devices, you must configure System Center Configuration Manager to support the operating system deployment feature. If you don’t have an existing System Center Configuration Manager infrastructure, you will need to deploy a new infrastructure.
+Before you can use Configuration Manager to deploy Windows 10 and manage your apps and devices, you must configure Configuration Manager to support the operating system deployment feature. If you don’t have an existing Configuration Manager infrastructure, you will need to deploy a new infrastructure.
 
-Deploying a new System Center Configuration Manager infrastructure is beyond the scope of this guide, but the following resources can help you deploy a new System Center Configuration Manager infrastructure:
+Deploying a new Configuration Manager infrastructure is beyond the scope of this guide, but the following resources can help you deploy a new Configuration Manager infrastructure:
 
-* [Get ready for System Center Configuration Manager](https://technet.microsoft.com/library/mt608540.aspx)
-* [Start using System Center Configuration Manager](https://technet.microsoft.com/library/mt608544.aspx)
+* [Get ready for Configuration Manager](https://technet.microsoft.com/library/mt608540.aspx)
+* [Start using Configuration Manager](https://technet.microsoft.com/library/mt608544.aspx)
 
 
-#### To configure an existing System Center Configuration Manager infrastructure for operating system deployment
+#### To configure an existing Microsoft Endpoint Configuration Manager infrastructure for operating system deployment
 
 1. Perform any necessary infrastructure remediation.
 
-    Ensure that your existing infrastructure can support the operating system deployment feature. For more information, see [Infrastructure requirements for operating system deployment in System Center Configuration Manager](https://technet.microsoft.com/library/mt627936.aspx).
+    Ensure that your existing infrastructure can support the operating system deployment feature. For more information, see [Infrastructure requirements for operating system deployment in Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt627936.aspx).
 2. Add the Windows PE boot images, Windows 10 operating systems, and other content.
 
     You need to add the Windows PE boot images, Windows 10 operating system images, and other deployment content that you will use to deploy Windows 10 with ZTI. To add this content, use the Create MDT Task Sequence Wizard.
 
-    You can add this content by using System Center Configuration Manager only (without MDT), but the Create MDT Task Sequence Wizard is the preferred method because the wizard prompts you for all the deployment content you need for a task sequence and provides a much more intuitive user experience. For more information, see [Create ZTI Task Sequences Using the Create MDT Task Sequence Wizard in Configuration Manager](https://technet.microsoft.com/library/dn759415.aspx#CreateZTITaskSequencesUsingtheCreateMDTTaskSequenceWizardinConfigurationManager).
+    You can add this content by using Microsoft Endpoint Configuration Manager only (without MDT), but the Create MDT Task Sequence Wizard is the preferred method because the wizard prompts you for all the deployment content you need for a task sequence and provides a much more intuitive user experience. For more information, see [Create ZTI Task Sequences Using the Create MDT Task Sequence Wizard in Configuration Manager](https://technet.microsoft.com/library/dn759415.aspx#CreateZTITaskSequencesUsingtheCreateMDTTaskSequenceWizardinConfigurationManager).
 3. Add device drivers.
 
     You must add device drivers for the different device types in your district. For example, if you have a mixture of Surface, HP Stream, Dell Inspiron, and Lenovo Yoga devices, then you must have the device drivers for each device.
 
-    Create a System Center Configuration Manager driver package for each device type in your district. For more information, see [Manage drivers in System Center Configuration Manager](https://technet.microsoft.com/library/mt627934.aspx).
+    Create a Microsoft Endpoint Configuration Manager driver package for each device type in your district. For more information, see [Manage drivers in Configuration Manager](https://technet.microsoft.com/library/mt627934.aspx).
 4. Add Windows apps.
 
     Install the Windows apps (Windows desktop and Microsoft Store apps) that you want to deploy after the task sequence deploys your customized image (a thick, reference image that include Windows 10 and your core Windows desktop apps). These apps are in addition to the apps included in your reference image. You can only deploy Microsoft Store apps after you deploy Windows 10 because you cannot capture Microsoft Store apps in a reference image. Microsoft Store apps target users, not devices.
 
-    Create a System Center Configuration Manager application for each Windows desktop or Microsoft Store app that you want to deploy after you apply the reference image to a device. For more information, see [Deploy and manage applications with System Center Configuration Manager](https://technet.microsoft.com/library/mt627959.aspx).
+    Create a Configuration Manager application for each Windows desktop or Microsoft Store app that you want to deploy after you apply the reference image to a device. For more information, see [Deploy and manage applications with Configuration Manager](https://technet.microsoft.com/library/mt627959.aspx).
 
 ### Configure Window Deployment Services for MDT
 
@@ -1225,13 +1226,13 @@ You can use Windows Deployment Services in conjunction with MDT to automatically
 
     For more information about how to perform this step, see [Add LTI Boot Images to Windows Deployment Services](https://technet.microsoft.com/library/dn759415.aspx#AddLTIBootImagestoWindowsDeploymentServices).
 
-### Configure Window Deployment Services for System Center Configuration Manager
+### Configure Window Deployment Services for Microsoft Endpoint Configuration Manager
 
->**Note**  If you have already configured your System Center Configuration Manager infrastructure to support PXE boot or selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next.
+>**Note**  If you have already configured your Microsoft Endpoint Configuration Manager infrastructure to support PXE boot or selected to deploy Windows 10 by using MDT only, then skip this section and continue to the next.
 
-You can use Windows Deployment Services in conjunction with System Center Configuration to automatically initiate boot images on target devices. These boot images are Windows PE images that you use to boot the target devices, and then initiate Windows 10, app, and device driver deployment.
+You can use Windows Deployment Services in conjunction with Configuration Manager to automatically initiate boot images on target devices. These boot images are Windows PE images that you use to boot the target devices, and then initiate Windows 10, app, and device driver deployment.
 
-#### To configure Windows Deployment Services for System Center Configuration Manager
+#### To configure Windows Deployment Services for Microsoft Endpoint Configuration Manager
 
 1. Set up and configure Windows Deployment Services.
 
@@ -1242,29 +1243,29 @@ You can use Windows Deployment Services in conjunction with System Center Config
     * The Windows Deployment Services Help file, included in Windows Deployment Services
     * [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426.aspx)
 
-2. Configure a distribution point to accept PXE requests in System Center Configuration Manager.
+2. Configure a distribution point to accept PXE requests in Configuration Manager.
 
     To support PXE boot requests, you install the PXE service point site system role. Then, you must configure one or more distribution points to respond to PXE boot request.
-    For more information about how to perform this step, see [Install site system roles for System Center Configuration Manager](https://technet.microsoft.com/library/mt704036.aspx), [Use PXE to deploy Windows over the network with System Center Configuration Manager](https://technet.microsoft.com/library/mt627940.aspx), and [Configuring distribution points to accept PXE requests](https://technet.microsoft.com/library/mt627944.aspx#BKMK_PXEDistributionPoint).
-3.	Configure the appropriate boot images (Windows PE images) to deploy from the PXE-enabled distribution point.
+    For more information about how to perform this step, see [Install site system roles for Configuration Manager](https://technet.microsoft.com/library/mt704036.aspx), [Use PXE to deploy Windows over the network with Configuration Manager](https://technet.microsoft.com/library/mt627940.aspx), and [Configuring distribution points to accept PXE requests](https://technet.microsoft.com/library/mt627944.aspx#BKMK_PXEDistributionPoint).
+3. Configure the appropriate boot images (Windows PE images) to deploy from the PXE-enabled distribution point.
 
     Before a device can start a boot image from a PXE-enabled distribution point, you must change the properties of the boot image to enable PXE booting. Typically, you create this boot image when you created your MDT task sequence in the Configuration Manager console.
 
-    For more information about how to perform this step, see [Configure a boot image to deploy from a PXE-enabled distribution point](https://technet.microsoft.com/library/mt627946.aspx#BKMK_BootImagePXE) and [Manage boot images with System Center Configuration Manager](https://technet.microsoft.com/library/mt627946.aspx).
+    For more information about how to perform this step, see [Configure a boot image to deploy from a PXE-enabled distribution point](https://technet.microsoft.com/library/mt627946.aspx#BKMK_BootImagePXE) and [Manage boot images with Configuration Manager](https://technet.microsoft.com/library/mt627946.aspx).
 
 #### Summary
 
-Your MDT deployment share and System Center Configuration Manager are now ready for deployment. Windows Deployment Services is ready to initiate the LTI or ZTI deployment process. You have set up and configured Windows Deployment Services for MDT and for System Center Configuration Manager. You have also ensured that your boot images are available to Windows Deployment Services (for LTI) or the distribution points (for ZTI and System Center Configuration Manager). Now, you’re ready to capture the reference images for the different devices you have in your district.
+Your MDT deployment share and Microsoft Endpoint Configuration Manager are now ready for deployment. Windows Deployment Services is ready to initiate the LTI or ZTI deployment process. You have set up and configured Windows Deployment Services for MDT and for Configuration Manager. You have also ensured that your boot images are available to Windows Deployment Services (for LTI) or the distribution points (for ZTI and Configuration Manager). Now, you’re ready to capture the reference images for the different devices you have in your district.
 
 ## Capture the reference image
 
 The reference device is a device that you use as the template for all the other devices in your district. On this device, you install any Windows desktop apps the classroom needs. For example, install the Windows desktop apps for Office 365 ProPlus if you selected that student license plan.
 
-After you deploy Windows 10 and the desktop apps to the reference device, you capture an image of the device (the reference image). You import the reference image to an MDT deployment share or into System Center Configuration Manager. Finally, you create a task sequence to deploy the reference image to faculty and student devices.
+After you deploy Windows 10 and the desktop apps to the reference device, you capture an image of the device (the reference image). You import the reference image to an MDT deployment share or into Configuration Manager. Finally, you create a task sequence to deploy the reference image to faculty and student devices.
 
 You will capture multiple reference images, one for each type of device that you have in your organization. You perform the steps in this section for each image (device) that you have in your district. Use LTI in MDT to automate the deployment and capture of the reference image.
 
->**Note**  You can use LTI in MDT or System Center Configuration Manager to automate the deployment and capture of the reference image, but this guide only discusses how to use LTI in MDT to capture the reference image.
+>**Note**  You can use LTI in MDT or Configuration Manager to automate the deployment and capture of the reference image, but this guide only discusses how to use LTI in MDT to capture the reference image.
 
 ### Customize the MDT deployment share
 
@@ -1316,14 +1317,14 @@ In most instances, deployments occur without incident. Only in rare occasions do
 
 ### Import reference image
 
-After you have captured the reference image (.wim file), import the image into the MDT deployment share or into System Center Configuration Manager (depending on which method you selected to perform Windows 10 deployments). You will deploy the reference image to the student and faculty devices in your district.
+After you have captured the reference image (.wim file), import the image into the MDT deployment share or into Configuration Manager (depending on which method you selected to perform Windows 10 deployments). You will deploy the reference image to the student and faculty devices in your district.
 
 Both the Deployment Workbench and the Configuration Manager console have wizards that help you import the reference image. After you import the reference image, you need to create a task sequence that will deploy the reference image.
 
 For more information about how to import the reference image into:
 
 * An MDT deployment share, see [Import a Previously Captured Image of a Reference Computer](https://technet.microsoft.com/library/dn759415.aspx#ImportaPreviouslyCapturedImageofaReferenceComputer).
-* System Center Configuration Manager, see [Manage operating system images with System Center Configuration Manager](https://technet.microsoft.com/library/mt627939.aspx) and [Customize operating system images with System Center Configuration Manager](https://technet.microsoft.com/library/mt627938.aspx).
+* Microsoft Endpoint Configuration Manager, see [Manage operating system images with Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt627939.aspx) and [Customize operating system images with Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt627938.aspx).
 
 ### Create a task sequence to deploy the reference image
 
@@ -1334,22 +1335,22 @@ As you might expect, both the Deployment Workbench and the Configuration Manager
 For more information about how to create a task sequence in the:
 
 * Deployment Workbench for a deployment share, see [Create a New Task Sequence in the Deployment Workbench](https://technet.microsoft.com/library/dn759415.aspx#CreateaNewTaskSequenceintheDeploymentWorkbench).
-* Configuration Manager console, see [Create a task sequence to install an operating system in System Center Configuration Manager](https://technet.microsoft.com/library/mt627927.aspx).
+* Configuration Manager console, see [Create a task sequence to install an operating system in Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt627927.aspx).
 
-####Summary
-In this section, you customized the MDT deployment share to deploy Windows 10 and desktop apps to one or more reference devices by creating and customizing MDT applications, device drivers, and applications. Next, you ran the task sequence, which deploys Windows 10, deploys your apps, deploys the appropriate device drivers, and captures an image of the reference device. Then, you imported the captured reference image into a deployment share or System Center Configuration Manager. Finally, you created a task sequence to deploy your captured reference image to faculty and student devices. At this point in the process, you’re ready to deploy Windows 10 and your apps to your devices.
+#### Summary
+In this section, you customized the MDT deployment share to deploy Windows 10 and desktop apps to one or more reference devices by creating and customizing MDT applications, device drivers, and applications. Next, you ran the task sequence, which deploys Windows 10, deploys your apps, deploys the appropriate device drivers, and captures an image of the reference device. Then, you imported the captured reference image into a deployment share or Microsoft Endpoint Configuration Manager. Finally, you created a task sequence to deploy your captured reference image to faculty and student devices. At this point in the process, you’re ready to deploy Windows 10 and your apps to your devices.
 
 ## Prepare for device management
 
 Before you deploy Windows 10 in your district, you must prepare for device management. You will deploy Windows 10 in a configuration that complies with your requirements, but you want to help ensure that your deployments remain compliant.
 
-You also want to deploy apps and software updates after you deploy Windows 10. You need to manage apps and updates by using System Center Configuration Manager, Intune, or a combination of both (hybrid model).
+You also want to deploy apps and software updates after you deploy Windows 10. You need to manage apps and updates by using Configuration Manager, Intune, or a combination of both (hybrid model).
 
 ### Select Microsoft-recommended settings
 
 Microsoft has several recommended settings for educational institutions. Table 17 lists them, provides a brief description of why you need to configure them, and recommends methods for configuring the settings. Review the settings in Table 17 and evaluate their relevancy to your institution.
 
->**Note**  The settings for Intune in Table 17 also apply to the System Center Configuration Manager and Intune management (hybrid) method.
+>**Note**  The settings for Intune in Table 17 also apply to the Configuration Manager and Intune management (hybrid) method.
 
 Use the information in Table 17 to help you determine whether you need to configure the setting and which method you will use to do so. At the end, you will have a list of settings that you want to apply to the Windows 10 devices and know which management method you will use to configure the settings.
 
@@ -1382,8 +1383,8 @@ Use the information in Table 17 to help you determine whether you need to config
 
@@ -1391,8 +1392,8 @@ Use the information in Table 17 to help you determine whether you need to config
 
@@ -1400,8 +1401,8 @@ Use the information in Table 17 to help you determine whether you need to config
 
@@ -1409,8 +1410,8 @@ Use the information in Table 17 to help you determine whether you need to config
 
@@ -1419,8 +1420,8 @@ Use the information in Table 17 to help you determine whether you need to config
 
@@ -1428,8 +1429,8 @@ Use the information in Table 17 to help you determine whether you need to config
 
@@ -1437,8 +1438,8 @@ Use the information in Table 17 to help you determine whether you need to config
 
@@ -1446,8 +1447,8 @@ Use the information in Table 17 to help you determine whether you need to config
 
@@ -1455,8 +1456,8 @@ Use the information in Table 17 to help you determine whether you need to config
 
@@ -1464,7 +1465,7 @@ Use the information in Table 17 to help you determine whether you need to config
 
              
 

 
 
 
              System Center Configuration Manager
              System Center Configuration Manager is an on-premises solution that supports operating system management throughout the entire operating system life cycle. You can use System Center Configuration Manager to deploy and upgrade Windows 10. In addition, you can manage Windows desktop and Microsoft Store apps and software updates as well as provide antivirus and antimalware protection.

              
+
              		Microsoft Endpoint Configuration Manager
              Configuration Manager is an on-premises solution that supports operating system management throughout the entire operating system life cycle. You can use Configuration Manager to deploy and upgrade Windows 10. In addition, you can manage Windows desktop and Microsoft Store apps and software updates as well as provide antivirus and antimalware protection.

              
 Select this method when you:
              
 
                
 
              • Want to deploy Windows 10 to institution-owned devices that are domain joined (personal devices are typically not domain joined).
                • 
@@ -248,7 +249,7 @@ Select this method when you:
                
 
              
 
              The disadvantages of this method are that it:
              
 
                
-
              • Carries an additional cost for System Center Configuration Manager server licenses (if the institution does not have System Center Configuration Manager already).
                • 
+
              • Carries an additional cost for Microsoft Endpoint Configuration Manager server licenses (if the institution does not have Configuration Manager already).
                • 
 
              • Can deploy Windows 10 only to domain-joined (institution-owned devices).
                • 
 
              • Requires an AD DS infrastructure (if the institution does not have AD DS already).
                • 
 
              
@@ -264,7 +265,7 @@ Record the deployment methods you selected in Table 3.
 |Selection | Deployment method|
 |--------- | -----------------|
 |   |MDT by itself |
-|   |System Center Configuration Manager and MDT|
+|   |Microsoft Endpoint Configuration Manager and MDT|
 
 *Table 3. Deployment methods selected*
 
@@ -319,7 +320,7 @@ Select this method when you:
              
 
              
 Intune
 
              Intune is a cloud-based management system that allows you to specify configuration settings for Windows 10, previous versions of Windows, and other operating systems (such as iOS or Android). Intune is a subscription-based cloud service that integrates with Office 365 and Azure AD.

              
-Intune is the cloud-based management system described in this guide, but you can use other MDM providers. If you use an MDM provider other than Intune, integration with System Center Configuration Manager is unavailable.

              
+Intune is the cloud-based management system described in this guide, but you can use other MDM providers. If you use an MDM provider other than Intune, integration with Configuration Manager is unavailable.

              
 Select this method when you:
              
 
 
                
@@ -363,7 +364,7 @@ Record the configuration setting management methods you selected in Table 5. Alt
 
 #### Select the app and update management products
 
-For a district, there are many ways to manage apps and software updates. Table 6 lists the products that this guide describes and recommends. Although you could manage updates by using [Windows Updates or Windows Server Update Services (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx), you still need to use System Center Configuration Manager or Intune to manage apps. Therefore, it only makes sense to use one or both of these tools for update management.
+For a district, there are many ways to manage apps and software updates. Table 6 lists the products that this guide describes and recommends. Although you could manage updates by using [Windows Updates or Windows Server Update Services (WSUS)](https://technet.microsoft.com/windowsserver/bb332157.aspx), you still need to Configuration Manager or Intune to manage apps. Therefore, it only makes sense to use one or both of these tools for update management.
 
 Use the information in Table 6 to determine which combination of app and update management products is right for your district.
 
@@ -381,10 +382,10 @@ Use the information in Table 6 to determine which combination of app and update
 
              
 
 
              System Center Configuration Manager
              System Center Configuration Manager is an on-premises solution that allows you to specify configuration settings for Windows 10; previous versions of Windows; and other operating systems, such as iOS or Android, through integration with Intune.

              System Center Configuration Manager supports application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using System Center Configuration Manager. You can also manage Windows desktop and Microsoft Store applications.

              Select this method when you:
              
+              		Microsoft Endpoint Configuration Manager
              Configuration Manager is an on-premises solution that allows you to specify configuration settings for Windows 10; previous versions of Windows; and other operating systems, such as iOS or Android, through integration with Intune.

              Configuration Manager supports application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager. You can also manage Windows desktop and Microsoft Store applications.

              Select this method when you:
              
 
                
-
              • Selected System Center Configuration Manager to deploy Windows 10.
                • 
+
              • Selected Configuration Manager to deploy Windows 10.
                • 
 
              • Want to manage institution-owned devices that are domain joined (personally owned devices are typically not domain joined).
                • 
 
              • Want to manage AD DS domain-joined devices.
                • 
 
              • Have an existing AD DS infrastructure.
                • 
@@ -403,7 +404,7 @@ Use the information in Table 6 to determine which combination of app and update
 
              
 
              The disadvantages of this method are that it:
              
 
                
-
              • Carries an additional cost for System Center Configuration Manager server licenses (if the institution does not have System Center Configuration Manager already).
                • 
+
              • Carries an additional cost for Configuration Manager server licenses (if the institution does not have Configuration Manager already).
                • 
 
              • Carries an additional cost for Windows Server licenses and the corresponding server hardware.
                • 
 
              • Can only manage domain-joined (institution-owned devices).
                • 
 
              • Requires an AD DS infrastructure (if the institution does not have AD DS already).
                • 
@@ -440,12 +441,12 @@ Select this method when you:
                
 
              
 
 
              System Center Configuration Manager and Intune (hybrid)
              System Center Configuration Manager and Intune together extend System Center Configuration Manager from an on-premises management system for domain-joined devices to a solution that can manage devices regardless of their location and connectivity options. This hybrid option provides the benefits of both System Center Configuration Manager and Intune.

              
-System Center Configuration Manager and Intune in the hybrid configuration allow you to support application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using System Center Configuration Manager, and you can manage Windows desktop and Microsoft Store applications for both institution-owned and personal devices.

              
+
              		Microsoft Endpoint Configuration Manager and Intune (hybrid)
              Configuration Manager and Intune together extend Configuration Manager from an on-premises management system for domain-joined devices to a solution that can manage devices regardless of their location and connectivity options. This hybrid option provides the benefits of both Configuration Manager and Intune.

              
+Configuration Manager and Intune in the hybrid configuration allow you to support application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager, and you can manage Windows desktop and Microsoft Store applications for both institution-owned and personal devices.

              
 Select this method when you:
              
 
                
-
              • Selected System Center Configuration Manager to deploy Windows 10.
                • 
+
              • Selected Microsoft Endpoint Configuration Manager to deploy Windows 10.
                • 
 
              • Want to manage institution-owned and personal devices (does not require that the device be domain joined).
                • 
 
              • Want to manage domain-joined devices.
                • 
 
              • Want to manage Azure AD domain-joined devices.
                • 
@@ -465,7 +466,7 @@ Select this method when you:
                
 
              
 
              The disadvantages of this method are that it:
              
 
                
-
              • Carries an additional cost for System Center Configuration Manager server licenses (if the institution does not have System Center Configuration Manager already).
                • 
+
              • Carries an additional cost for Configuration Manager server licenses (if the institution does not have Configuration Manager already).
                • 
 
              • Carries an additional cost for Windows Server licenses and the corresponding server hardware.
                • 
 
              • Carries an additional cost for Intune subscription licenses.
                • 
 
              • Requires an AD DS infrastructure (if the institution does not have AD DS already).
                • 
@@ -482,9 +483,9 @@ Record the app and update management methods that you selected in Table 7.
 
 |Selection | Management method|
 |----------|------------------|
-|   |System Center Configuration Manager by itself|
+|   |Microsoft Endpoint Configuration Manager by itself|
 |   |Intune by itself|
-|   |System Center Configuration Manager and Intune (hybrid mode)|
+|   |Microsoft Endpoint Configuration Manager and Intune (hybrid mode)|
 
 *Table 7. App and update management methods selected*
 
@@ -525,19 +526,19 @@ For more information about how to create a deployment share, see [Step 3-1: Crea
 
 ### Install the Configuration Manager console
 
->**Note**  If you selected System Center Configuration Manager to deploy Windows 10 or manage your devices (in the [Select the deployment methods](#select-the-deployment-methods) and [Select the configuration setting management methods](#select-the-configuration-setting-management-methods) sections, respectively), perform the steps in this section. Otherwise, skip this section and continue to the next.
+>**Note**  If you selected Microsoft Endpoint Configuration Manager to deploy Windows 10 or manage your devices (in the [Select the deployment methods](#select-the-deployment-methods) and [Select the configuration setting management methods](#select-the-configuration-setting-management-methods) sections, respectively), perform the steps in this section. Otherwise, skip this section and continue to the next.
 
-You can use System Center Configuration Manager to manage Windows 10 deployments, Windows desktop apps, Microsoft Store apps, and software updates. To manage System Center Configuration Manager, you use the Configuration Manager console. You must install the Configuration Manager console on every device you use to manage System Center Configuration Manager (specifically, the admin device). The Configuration Manager console is automatically installed when you install System Center Configuration Manager primary site servers.
+You can use Configuration Manager to manage Windows 10 deployments, Windows desktop apps, Microsoft Store apps, and software updates. To manage Configuration Manager, you use the Configuration Manager console. You must install the Configuration Manager console on every device you use to manage Configuration Manager (specifically, the admin device). The Configuration Manager console is automatically installed when you install Configuration Manager primary site servers.
 
-For more information about how to install the Configuration Manager console, see [Install System Center Configuration Manager consoles](https://technet.microsoft.com/library/mt590197.aspx#bkmk_InstallConsole).
+For more information about how to install the Configuration Manager console, see [Install Microsoft Endpoint Configuration Manager consoles](https://technet.microsoft.com/library/mt590197.aspx#bkmk_InstallConsole).
 
 ### Configure MDT integration with the Configuration Manager console
 
->**Note**  If you selected MDT only to deploy Windows 10 and your apps (and not System Center Configuration Manager) in the [Select the deployment methods](#select-the-deployment-methods) section, then skip this section and continue to the next.
+>**Note**  If you selected MDT only to deploy Windows 10 and your apps (and not Microsoft Endpoint Configuration Manager) in the [Select the deployment methods](#select-the-deployment-methods) section, then skip this section and continue to the next.
 
-You can use MDT with System Center Configuration Manager to make ZTI operating system deployment easier. To configure MDT integration with System Center Configuration Manager, run the Configure ConfigMgr Integration Wizard. This wizard is installed when you install MDT.
+You can use MDT with Configuration Manager to make ZTI operating system deployment easier. To configure MDT integration with Configuration Manager, run the Configure ConfigMgr Integration Wizard. This wizard is installed when you install MDT.
 
-In addition to the admin device, run the Configure ConfigMgr Integration Wizard on each device that runs the Configuration Manager console to ensure that all Configuration Manager console installation can use the power of MDT–System Center Configuration Manager integration.
+In addition to the admin device, run the Configure ConfigMgr Integration Wizard on each device that runs the Configuration Manager console to ensure that all Configuration Manager console installation can use the power of MDT–Configuration Manager integration.
 
 For more information, see [Enable Configuration Manager Console Integration for Configuration Manager](https://technet.microsoft.com/library/dn759415.aspx#EnableConfigurationManagerConsoleIntegrationforConfigurationManager).
 
@@ -549,7 +550,7 @@ In this section, you installed the Windows ADK and MDT on the admin device. You
 
 Office 365 is one of the core components of your classroom environment. You create and manage student identities in Office 365, and students and teachers use the suite as their email, contacts, and calendar system. They also use Office 365 collaboration features such as SharePoint, OneNote, and OneDrive for Business.
 
-As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/en-us/education/products/office-365-deployment-resources/default.aspx).
+As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/education/products/office-365-deployment-resources/default.aspx).
 
 ### Select the appropriate Office 365 Education license plan
 
@@ -594,8 +595,8 @@ To create a new Office 365 Education subscription for use in the classroom, use
 #### To create a new Office 365 subscription
 
 1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar.
-   >**Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window by using one of the following methods:
-      
                • In Microsoft Edge, open the Microsoft Edge app (press Ctrl+Shift+P, or click or tap **More actions**), and then click or tap **New InPrivate window**.
                • In Internet Explorer 11, open Internet Explorer 11 (press Ctrl+Shift+P, or click or tap **Settings**), click or tap **Safety**, and then click or tap **InPrivate Browsing**.
                
+   > **Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window by using one of the following methods:
+   >    
                • In Microsoft Edge, open the Microsoft Edge app (press Ctrl+Shift+P, or click or tap More actions), and then click or tap New InPrivate window.
                • In Internet Explorer 11, open Internet Explorer 11 (press Ctrl+Shift+P, or click or tap Settings), click or tap Safety, and then click or tap InPrivate Browsing.
                
 
 
 2. On the **Get started** page, in **Enter your school email address**, type your school email address, and then click **Sign up**.
@@ -614,7 +615,7 @@ Now that you have created your new Office 365 Education subscription, add the do
 
 #### To add additional domains and subdomains
 
-1. In the Office 365 admin center, in the list view, click **DOMAINS**.
+1. In the admin center, in the list view, click **DOMAINS**.
 
 2. In the details pane, above the list of domains, on the menu bar, click **Add domain**.
 
@@ -866,7 +867,7 @@ Now that you have created your new Office 365 Education subscription, you need t
 
 >**Note**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant.
 
-You can use the Office 365 admin center to add individual Office 365 accounts manually—a reasonable process when you’re adding only a few users. If you have many users, however, you can automate the process by creating a list of those users, and then use that list to create user accounts (that is, bulk-add users).
+You can use the Microsoft 365 admin center to add individual Office 365 accounts manually—a reasonable process when you’re adding only a few users. If you have many users, however, you can automate the process by creating a list of those users, and then use that list to create user accounts (that is, bulk-add users).
 
 The bulk-add process assigns the same Office 365 Education license plan to all users on the list. Therefore, you must create a separate list for each license plan you recorded in Table 9. Depending on the number of faculty members who need to use the classroom, you may want to add the faculty Office 365 accounts manually; however, use the bulk-add process to add student accounts.
 
@@ -960,7 +961,7 @@ Now that you have created your Microsoft Store for Business portal, you’re rea
 
 You can deploy apps to individual users or make apps available to users through your private store. Deploying apps to individual users restricts the app to those specified users. Making apps available through your private store allows all your users to install the apps.
 
-For more information about how to find, acquire, and distribute apps in the portal, see [App inventory management for Microsoft Store for Business](https://technet.microsoft.com/itpro/windows/manage/app-inventory-managemement-windows-store-for-business).
+For more information about how to find, acquire, and distribute apps in the portal, see [App inventory management for Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business).
 
 #### Summary
 
@@ -990,7 +991,7 @@ Depending on your school’s requirements, you may need any combination of the f
 
 >**Note**  Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Microsoft Store for Business—features not available in Windows 10 Home. For more information about how to upgrade Windows 10 Home to Windows 10 Pro or Windows 10 Education, see [Windows 10 edition upgrade](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades).
 
-For more information about the Windows 10 editions, see [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare).
+For more information about the Windows 10 editions, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare).
 
 One other consideration is the mix of processor architectures you will support. If you can, support only 64-bit versions of Windows 10. If you have devices that can run only 32-bit versions of Windows 10, you will need to import both 64-bit and 32-bit versions of the Windows 10 editions listed above.
 
@@ -1076,7 +1077,7 @@ At the end of this section, you should know the Windows 10 editions and processo
 
 ## Prepare for deployment
 
-Before you can deploy Windows 10 and your apps to devices, you need to prepare your MDT environment, Windows Deployment Services, and System Center Configuration Manager (if you selected it to do operating system deployment in the [Select the deployment methods](#select-the-deployment-methods) section). In this section, you ensure that the deployment methods you selected in the [Select the deployment methods](#select-the-deployment-methods) section have the necessary Windows 10 editions and versions, Windows desktop apps, Microsoft Store apps, and device drivers.
+Before you can deploy Windows 10 and your apps to devices, you need to prepare your MDT environment, Windows Deployment Services, and Microsoft Endpoint Configuration Manager (if you selected it to do operating system deployment in the [Select the deployment methods](#select-the-deployment-methods) section). In this section, you ensure that the deployment methods you selected in the [Select the deployment methods](#select-the-deployment-methods) section have the necessary Windows 10 editions and versions, Windows desktop apps, Microsoft Store apps, and device drivers.
 
 ### Configure the MDT deployment share
 
@@ -1100,30 +1101,30 @@ The first step in preparing for Windows 10 deployment is to configure—that is,
 
 
              
 1. Import operating systemsImport the operating systems that you selected in the [Select the operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import an Operating System into the Deployment Workbench](https://technet.microsoft.com/library/dn759415.aspx#ImportanOperatingSystemintotheDeploymentWorkbench).Import the operating systems that you selected in the Select the operating systems section into the deployment share. For more information about how to import operating systems, see Import an Operating System into the Deployment Workbench.
 
              
 
 
              
 2. Import device drivers
 Device drivers allow Windows 10 to know a device’s hardware resources and connected hardware accessories. Without the proper device drivers, certain features may be unavailable. For example, without the proper audio driver, a device cannot play sounds; without the proper camera driver, the device cannot take photos or use video chat.

              
-Import device drivers for each device in your institution. For more information about how to import device drivers, see [Import Device Drivers into the Deployment Workbench](https://technet.microsoft.com/library/dn759415.aspx#ImportDeviceDriversintotheDeploymentWorkbench).
+Import device drivers for each device in your institution. For more information about how to import device drivers, see Import Device Drivers into the Deployment Workbench.
               		
 
              
 
 
              
 3. Create MDT applications for Microsoft Store appsCreate an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using sideloading, which allows you to use the **Add-AppxPackage** Windows PowerShell cmdlet to deploy the .appx files associated with the app (called *provisioned apps*). Use this method to deploy up to 24 apps to Windows 10.

              
+              		Create an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using sideloading, which allows you to use the Add-AppxPackage Windows PowerShell cmdlet to deploy the .appx files associated with the app (called provisioned apps). Use this method to deploy up to 24 apps to Windows 10.

              
 
              Prior to sideloading the .appx files, obtain the Microsoft Store .appx files that you will use to deploy (sideload) the apps in your provisioning package. For apps in Microsoft Store, you will need to obtain the .appx files by performing one of the following tasks:
              
 
                
 
              • For offline-licensed apps, download the .appx files from the Microsoft Store for Business.
                • 
 
              • For apps that are not offline licensed, obtain the .appx files from the app software vendor directly.
                • 
 
              
 
              If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Microsoft Store or Microsoft Store for Business.

              
-If you have Intune or System Center Configuration Manager, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune) and [Deploy and manage apps by using System Center Configuration Manager](#deploy-and-manage-apps-by-using-system-center-configuration-manager) sections. This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This is the preferred method of deploying and managing Microsoft Store apps.

              
+If you have Intune or Microsoft Endpoint Configuration Manager, you can deploy Microsoft Store apps after you deploy Windows 10, as described in the Deploy and manage apps by using Intune and Deploy and manage apps by using Microsoft Endpoint Configuration Manager sections. This method provides granular deployment of Microsoft Store apps, and you can use it for ongoing management of Microsoft Store apps. This is the preferred method of deploying and managing Microsoft Store apps.

              
 In addition, you must prepare your environment for sideloading Microsoft Store apps. For more information about how to:

              
 
                
-
              • Prepare your environment for sideloading, see [Try it out: sideload Microsoft Store apps](https://technet.microsoft.com/windows/jj874388.aspx).
                • 
-
              • Create an MDT application, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench).
                • 
+
              • Prepare your environment for sideloading, see Try it out: sideload Microsoft Store apps.
                • 
+
              • Create an MDT application, see Create a New Application in the Deployment Workbench.
                • 
 
              
 
 
              
 4. Create MDT applications for Windows desktop apps
 You need to create an MDT application for each Windows desktop app you want to deploy. You can obtain the Windows desktop apps from any source, but ensure that you have sufficient licenses for them.

              
-To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in [Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](https://technet.microsoft.com/library/jj219423.aspx).

              
-If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.
+To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool.

              
+If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the Deploy and manage apps by using Intune section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.
 

              
-**Note**  You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy and manage apps by using Intune](#deploy-and-manage-apps-by-using-intune) section.
+Note  You can also deploy Windows desktop apps after you deploy Windows 10, as described in the Deploy and manage apps by using Intune section.
 
 For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/library/dn759415.aspx).
 
@@ -1151,7 +1152,7 @@ For more information about how to create an MDT application for Window desktop a
 
            • Upgrade existing devices to 64-bit Windows 10 Education.
              • 
 
            • Upgrade existing devices to 32-bit Windows 10 Education.
              • 
 
-
              Again, you will create the task sequences based on the operating systems that you imported in step 1. For more information about how to create a task sequence, see [Create a New Task Sequence in the Deployment Workbench](https://technet.microsoft.com/library/dn759415.aspx#CreateaNewTaskSequenceintheDeploymentWorkbench).
+
              Again, you will create the task sequences based on the operating systems that you imported in step 1. For more information about how to create a task sequence, see Create a New Task Sequence in the Deployment Workbench.
 
               		
 
              
 6. Update the deployment share
 Updating a deployment share generates the MDT boot images you use to initiate the Windows 10 deployment process. You can configure the process to create 32-bit and 64-bit versions of the .iso and .wim files you can use to create bootable media or in Windows Deployment Services.

              
-For more information about how to update a deployment share, see [Update a Deployment Share in the Deployment Workbench](https://technet.microsoft.com/library/dn759415.aspx#UpdateaDeploymentShareintheDeploymentWorkbench).
+For more information about how to update a deployment share, see Update a Deployment Share in the Deployment Workbench.
 
               		
 
              
 Restrict the local administrator accounts on the devices
 Ensure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.

              
-**Group Policy.** Create a **Local Group** Group Policy preference to limit the local administrators group membership. Select the Delete all member users and Delete all member groups check boxes to remove any existing members. For more information about how to configure Local Group preferences, see Configure a Local Group Item.

              
-**Intune.** Not available.
+Group Policy. Create a Local Group Group Policy preference to limit the local administrators group membership. Select the Delete all member users and Delete all member groups check boxes to remove any existing members. For more information about how to configure Local Group preferences, see Configure a Local Group Item.

              
+Intune. Not available.
 
               		
 
              
 Manage the built-in administrator account created during device deployment
 When you use MDT to deploy Windows 10, the MDT deployment process automatically creates a local Administrator account with the password you specified. As a security best practice, rename the built-in Administrator account and (optionally) disable it.

              
-**Group Policy.** To rename the built-in Administrator account, use the **Accounts: Rename administrator account** Group Policy setting. For more information about how to rename the built-in Administrator account, see [To rename the Administrator account using the Group Policy Management Console](https://technet.microsoft.com/library/cc747484.aspx). You specify the new name for the Administrator account. To disable the built-in Administrator account, use the **Accounts: Administrator account status** Group Policy setting. For more information about how to disable the built-in Administrator account, see [Accounts: Administrator account status](https://technet.microsoft.com/library/jj852165.aspx).

              
-**Intune.** Not available.
+Group Policy. To rename the built-in Administrator account, use the Accounts: Rename administrator account Group Policy setting. For more information about how to rename the built-in Administrator account, see To rename the Administrator account using the Group Policy Management Console. You specify the new name for the Administrator account. To disable the built-in Administrator account, use the Accounts: Administrator account status Group Policy setting. For more information about how to disable the built-in Administrator account, see Accounts: Administrator account status.

              
+Intune. Not available.
 
               		
 
              
 Control Microsoft Store access
 You can control access to Microsoft Store and whether existing Microsoft Store apps receive updates. You can only disable the Microsoft Store app in Windows 10 Education and Windows 10 Enterprise.

              
-**Group Policy.** To disable the Microsoft Store app, use the **Turn off the Store Application** group policy setting. To prevent Microsoft Store apps from receiving updates, use the **Turn off Automatic Download and Install of updates** Group Policy setting. For more information about configuring these settings, see [Can I use Group Policy to control the Microsoft Store in my enterprise environment?](https://technet.microsoft.com/library/hh832040.aspx#BKMK_UseGP).

              
-**Intune.** To enable or disable Microsoft Store access, use the **Allow application store** policy setting in the **Apps** section of a **Windows 10 General Configuration policy**.
+Group Policy. To disable the Microsoft Store app, use the Turn off the Store Application group policy setting. To prevent Microsoft Store apps from receiving updates, use the Turn off Automatic Download and Install of updates Group Policy setting. For more information about configuring these settings, see Can I use Group Policy to control the Microsoft Store in my enterprise environment?.

              
+Intune. To enable or disable Microsoft Store access, use the Allow application store policy setting in the Apps section of a Windows 10 General Configuration policy.
 
               		
 
              
 Use of Remote Desktop connections to devices
 Remote Desktop connections could allow unauthorized access to the device. Depending on your institution’s policies, you may want to disable Remote Desktop connections on your devices.

              
-**Group Policy.** To enable or disable Remote Desktop connections to devices, use the **Allow Users to connect remotely using Remote Desktop** setting in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections.

              
-**Intune.** Not available.
+Group Policy. To enable or disable Remote Desktop connections to devices, use the Allow Users to connect remotely using Remote Desktop setting in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections.

              
+Intune. Not available.
 
               		
 
              
 Use of camera
 A device’s camera can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the camera on your devices.

              
-**Group Policy.** Not available.

              
-**Intune.** To enable or disable the camera, use the **Allow camera** policy setting in the **Hardware** section of a **Windows 10 General Configuration** policy.
+Group Policy. Not available.

              
+Intune. To enable or disable the camera, use the Allow camera policy setting in the Hardware section of a Windows 10 General Configuration policy.
 
               		
 
              
 Use of audio recording
 Audio recording (by using the Sound Recorder app) can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the Sound Recorder app on your devices.

              
-**Group Policy.** To disable the Sound Recorder app, use the **Do not allow Sound Recorder to run** Group Policy setting. You can disable other audio recording apps by using AppLocker policies. To create AppLocker policies, use the information in [Editing an AppLocker Policy](https://technet.microsoft.com/library/ee791894.aspx) and [Create Your AppLocker Policies](https://technet.microsoft.com/library/ee791899.aspx).

              
-**Intune.** To enable or disable audio recording, use the **Allow voice recording** policy setting in the **Features** section of a **Windows 10 General Configuration** policy.
+Group Policy. To disable the Sound Recorder app, use the Do not allow Sound Recorder to run Group Policy setting. You can disable other audio recording apps by using AppLocker policies. To create AppLocker policies, use the information in Editing an AppLocker Policy and Create Your AppLocker Policies.

              
+Intune. To enable or disable audio recording, use the Allow voice recording policy setting in the Features section of a Windows 10 General Configuration policy.
 
               		
 
              
 Use of screen capture
 Screen captures can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the ability to perform screen captures on your devices.

              
-**Group Policy.** Not available.

              
-**Intune.** To enable or disable screen capture, use the **Allow screen capture** policy setting in the **System** section of a **Windows 10 General Configuration** policy.
+Group Policy. Not available.

              
+Intune. To enable or disable screen capture, use the Allow screen capture policy setting in the System section of a Windows 10 General Configuration policy.
 
               		
 
              
 Use of location services
 Providing a device’s location can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the location service on your devices.

              
-**Group Policy.** To enable or disable location services, use the **Turn off location** group policy setting in User Configuration\Windows Components\Location and Sensors.

              
-**Intune.** To enable or disable location services, use the **Allow geolocation** policy setting in the **Hardware** section of a **Windows 10 General Configuration** policy.
+Group Policy. To enable or disable location services, use the Turn off location group policy setting in User Configuration\Windows Components\Location and Sensors.

              
+Intune. To enable or disable location services, use the Allow geolocation policy setting in the Hardware section of a Windows 10 General Configuration policy.
 
               		
 
              
 Changing wallpaper
 Custom wallpapers can be a source of disclosure or privacy issues in an education environment (if the wallpaper displays information about the user or device). Depending on your institution’s policies, you may want to prevent users from changing the wallpaper on institution-owned devices.

              
-**Group Policy.** To configure the wallpaper, use the **Desktop WallPaper** setting in User Configuration\Administrative Templates\Desktop\Desktop.

              
-**Intune.** Not available.
+Group Policy. To configure the wallpaper, use the Desktop WallPaper setting in User Configuration\Administrative Templates\Desktop\Desktop.

              
+Intune. Not available.
 
               		
 
              
 
              
 
              
-*Table 17. Recommended settings for educational institutions*
+Table 17. Recommended settings for educational institutions
 
 ### Configure settings by using Group Policy
 
@@ -1498,7 +1499,7 @@ For more information about Intune, see [Microsoft Intune Documentation](https://
 
 ### Deploy and manage apps by using Intune
 
-If you selected to deploy and manage apps by using System Center Configuration Manager and Intune in a hybrid configuration, then skip this section and continue to the [Deploy and manage apps by using System Center Configuration Manager](#deploy-and-manage-apps-by-using-system-center-configuration-manager) section.
+If you selected to deploy and manage apps by using Microsoft Endpoint Configuration Manager and Intune in a hybrid configuration, then skip this section and continue to the [Deploy and manage apps by using Microsoft Endpoint Configuration Manager](#deploy-and-manage-apps-by-using-microsoft-endpoint-configuration-manager) section.
 
 You can use Intune to deploy Microsoft Store and Windows desktop apps. Intune provides improved control over which users receive specific apps. In addition, Intune allows you to deploy apps to companion devices (such as Windows 10 Mobile, iOS, or Android devices). Finally, Intune helps you manage app security and features, such as mobile application management policies that let you manage apps on devices that are not enrolled in Intune or that another solution manages.
 
@@ -1510,21 +1511,21 @@ For more information about how to configure Intune to manage your apps, see the
 - [Protect apps and data with Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/protect-apps-and-data-with-microsoft-intune)
 - [Help protect your data with full or selective wipe using Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/use-remote-wipe-to-help-protect-data-using-microsoft-intune)
 
-### Deploy and manage apps by using System Center Configuration Manager
+### Deploy and manage apps by using Microsoft Endpoint Configuration Manager
 
-You can use System Center Configuration Manager to deploy Microsoft Store and Windows desktop apps. System Center Configuration Manager allows you to create a System Center Configuration Manager application that you can use to deploy apps to different devices (such as Windows 10 desktop, Windows 10 Mobile, iOS, or Android devices) by using *deployment types*. You can think of a System Center Configuration Manager application as a box. You can think of deployment types as one or more sets of installation files and installation instructions within that box.
+You can use  Microsoft Endpoint Configuration Manager to deploy Microsoft Store and Windows desktop apps. Configuration Manager allows you to create a Configuration Manager application that you can use to deploy apps to different devices (such as Windows 10 desktop, Windows 10 Mobile, iOS, or Android devices) by using *deployment types*. You can think of a Configuration Manager application as a box. You can think of deployment types as one or more sets of installation files and installation instructions within that box.
 
 For example, you could create a Skype application that contains a deployment type for Windows 10 desktop, Windows 10 Mobile, iOS, and Android. You can deploy the one application to multiple device types.
 
->**Note**  When you configure System Center Configuration Manager and Intune in a hybrid model, you deploy apps by using System Center Configuration manager as described in this section.
+>**Note**  When you configure Configuration Manager and Intune in a hybrid model, you deploy apps by using Configuration Manager as described in this section.
 
-System Center Configuration Manager helps you manage apps by monitoring app installation. You can determine how many of your devices have a specific app installed. Finally, you can allow users to install apps at their discretion or make apps mandatory.
+Configuration Manager helps you manage apps by monitoring app installation. You can determine how many of your devices have a specific app installed. Finally, you can allow users to install apps at their discretion or make apps mandatory.
 
-For more information about how to configure System Center Configuration Manager to deploy and manage your apps, see [Deploy and manage applications with System Center Configuration Manager](https://technet.microsoft.com/library/mt627959.aspx).
+For more information about how to configure Configuration Manager to deploy and manage your apps, see [Deploy and manage applications with Configuration Manager](https://technet.microsoft.com/library/mt627959.aspx).
 
 ### Manage updates by using Intune
 
-If you selected to manage updates by using System Center Configuration Manager and Intune in a hybrid configuration, then skip this section and continue to the [Manage updates by using System Center Configuration Manager](#manage-updates-by-using-system-center-configuration-manager) section.
+If you selected to manage updates by using Configuration Manager and Intune in a hybrid configuration, then skip this section and continue to the [Manage updates by using Microsoft Endpoint Configuration Manager](#manage-updates-by-using-microsoft-endpoint-configuration-manager) section.
 
 To help ensure that your users have the most current features and security protection, keep Windows 10 and your apps current with updates. To configure Windows 10 and app updates, use the **Updates** workspace in Intune.
 
@@ -1535,19 +1536,19 @@ For more information about how to configure Intune to manage updates and malware
 - [Keep Windows PCs up to date with software updates in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/keep-windows-pcs-up-to-date-with-software-updates-in-microsoft-intune)
 - [Help secure Windows PCs with Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune)
 
-### Manage updates by using System Center Configuration Manager
+### Manage updates by using Microsoft Endpoint Configuration Manager
 
-To ensure that your users have the most current features and security protection, use the software updates feature in System Center Configuration Manager to manage updates. The software updates feature works in conjunction with WSUS to manage updates for Windows 10 devices.
+To ensure that your users have the most current features and security protection, use the software updates feature in Configuration Manager to manage updates. The software updates feature works in conjunction with WSUS to manage updates for Windows 10 devices.
 
 You configure the software updates feature to manage updates for specific versions of Windows and apps. Then, the software updates feature obtains the updates from Windows Updates by using the WSUS server in your environment. This integration provides greater granularity of control over updates and more specific targeting of updates to users and devices (compared to WSUS alone or Intune alone), which allows you to ensure that the right user or device gets the right updates.
 
->**Note**  When you configure System Center Configuration Manager and Intune in a hybrid model, you  use System Center Configuration manager to manage updates as described in this section.
+>**Note**  When you configure Configuration Manager and Intune in a hybrid model, you  use Configuration manager to manage updates as described in this section.
 
-For more information about how to configure System Center Configuration Manager to manage Windows 10 and app updates, see [Deploy and manage software updates in System Center Configuration Manager](https://technet.microsoft.com/library/mt634340.aspx).
+For more information about how to configure Configuration Manager to manage Windows 10 and app updates, see [Deploy and manage software updates in Configuration Manager](https://technet.microsoft.com/library/mt634340.aspx).
 
 #### Summary
 
-In this section, you prepared your institution for device management. You identified the configuration settings that you want to use to manage your users and devices. You configured Group Policy or Intune to manage these configuration settings. You configured Intune or System Center Configuration Manager to manage your apps. Finally, you configured Intune or System Center Configuration Manager to manage software updates for Windows 10 and your apps.
+In this section, you prepared your institution for device management. You identified the configuration settings that you want to use to manage your users and devices. You configured Group Policy or Intune to manage these configuration settings. You configured Intune or Microsoft Endpoint Configuration Manager to manage your apps. Finally, you configured Intune or Microsoft Endpoint Configuration Manager to manage software updates for Windows 10 and your apps.
 
 ## Deploy Windows 10 to devices
 
@@ -1560,8 +1561,8 @@ Prior to deployment of Windows 10, complete the tasks in Table 18. Most of these
 |Task|   |
 |----|----|
 |1. |Ensure that the target devices have sufficient system resources to run Windows 10.|
-|2. |Identify the necessary devices drivers, and then import them into the MDT deployment share or System Center Configuration Manager.|
-|3. |For each Microsoft Store and Windows desktop app, create an MDT application or System Center Configuration Manager application.|
+|2. |Identify the necessary devices drivers, and then import them into the MDT deployment share or Microsoft Endpoint Configuration Manager.|
+|3. |For each Microsoft Store and Windows desktop app, create an MDT application or Configuration Manager application.|
 |4. |Notify the students and faculty about the deployment.|
 
 *Table 18. Deployment preparation checklist*
@@ -1616,7 +1617,7 @@ As a final quality control step, verify the device configuration to ensure that
 * The device can connect to the Internet and view the appropriate web content in Microsoft Edge.
 * Windows Update is active and current with software updates.
 * Windows Defender is active and current with malware Security intelligence.
-* The SmartScreen Filter is active.
+* Windows Defender SmartScreen is active.
 * All Microsoft Store apps are properly installed and updated.
 * All Windows desktop apps are properly installed and updated.
 * Printers are properly configured.
@@ -1657,10 +1658,10 @@ Table 19 lists the school and individual classroom maintenance tasks, the resour
 Verify that Windows Update is active and current with operating system and software updates.

              
 For more information about completing this task when you have:
 
                
-
              • Intune, see [Keep Windows PCs up to date with software updates in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/keep-windows-pcs-up-to-date-with-software-updates-in-microsoft-intune).
                • 
-
              • Group Policy, see [Windows Update for Business](https://technet.microsoft.com/itpro/windows/plan/windows-update-for-business).
                • 
-
              • WSUS, see [Windows Server Update Services](https://msdn.microsoft.com/library/bb332157.aspx).
                • 
-
              • Neither Intune, Group Policy, nor WSUS, see “Install, upgrade, & activate” in [Windows 10 help](https://support.microsoft.com/products/windows?os=windows-10).
                • 
+
              • Intune, see Keep Windows PCs up to date with software updates in Microsoft Intune.
                • 
+
              • Group Policy, see Windows Update for Business.
                • 
+
              • WSUS, see Windows Server Update Services.
                • 
+
              • Neither Intune, Group Policy, nor WSUS, see “Install, upgrade, & activate” in Windows 10 help.
                • 
 
              
 
 x
@@ -1670,7 +1671,7 @@ For more information about completing this task when you have:
 
 
 Verify that Windows Defender is active and current with malware Security intelligence.

              
-For more information about completing this task, see [Turn Windows Defender on or off](https://support.microsoft.com/instantanswers/742778f2-6aad-4a8d-8f5d-db59cebc4f24/how-to-protect-your-windows-10-pc#v1h=tab02) and [Updating Windows Defender](https://support.microsoft.com/instantanswers/742778f2-6aad-4a8d-8f5d-db59cebc4f24/how-to-protect-your-windows-10-pc#v1h=tab03).
+For more information about completing this task, see Turn Windows Defender on or off and Updating Windows Defender.
 
 x
 x
@@ -1679,7 +1680,7 @@ For more information about completing this task, see [Turn Windows Defender on o
 
 
 Verify that Windows Defender has run a scan in the past week and that no viruses or malware were found.

              
-For more information about completing this task, see the “How do I find and remove a virus?” topic in [Protect my PC from viruses](https://support.microsoft.com/help/17228/windows-protect-my-pc-from-viruses).
+For more information about completing this task, see the “How do I find and remove a virus?” topic in Protect my PC from viruses.
 
 x
 x
@@ -1690,8 +1691,8 @@ For more information about completing this task, see the “How do I find and re
 Download and approve updates for Windows 10, apps, device driver, and other software.

              
 For more information, see:
 
 
 x
@@ -1701,7 +1702,7 @@ For more information, see:
 
 
 Verify that you’re using the appropriate Windows 10 servicing options for updates and upgrades (such as selecting whether you want to use Current Branch or Current Branch for Business).

              
-For more information about Windows 10 servicing options for updates and upgrades, see [Windows 10 servicing options](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing).
+For more information about Windows 10 servicing options for updates and upgrades, see Windows 10 servicing options.
 
 
 x
@@ -1712,9 +1713,9 @@ For more information about Windows 10 servicing options for updates and upgrades
 Refresh the operating system and apps on devices.

              
 For more information about completing this task, see the following resources:
 
 
 
@@ -1726,8 +1727,8 @@ For more information about completing this task, see the following resources:
 Install any new Windows desktop apps, or update any Windows desktop apps used in the curriculum.

              
 For more information, see:
 
 
 
@@ -1738,10 +1739,10 @@ For more information, see:
 
 Install new or update existing Microsoft Store apps used in the curriculum.

              
 Microsoft Store apps are automatically updated from Microsoft Store. The menu bar in the Microsoft Store app shows whether any Microsoft Store app updates are available for download.

              
-You can also deploy Microsoft Store apps directly to devices by using Intune, System Center Configuration Manager, or both in a hybrid configuration. For more information, see:
+You can also deploy Microsoft Store apps directly to devices by using Intune, Microsoft Endpoint Configuration Manager, or both in a hybrid configuration. For more information, see:
 
 
 
@@ -1753,8 +1754,8 @@ You can also deploy Microsoft Store apps directly to devices by using Intune, Sy
 Remove unnecessary user accounts (and corresponding licenses) from AD DS and Office 365 (if you have an on-premises AD DS infrastructure).

              
 For more information about how to:
 
                
-
              • Remove unnecessary user accounts, see [Active Directory Administrative Center](https://technet.microsoft.com/windows-server-docs/identity/ad-ds/get-started/adac/active-directory-administrative-center).
                • 
-
              • Remove licenses, see [Assign or remove licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-remove-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US).
                • 
+
              • Remove unnecessary user accounts, see Active Directory Administrative Center.
                • 
+
              • Remove licenses, see Assign or remove licenses for Office 365 for business.
                • 
 
              
 
 
@@ -1767,8 +1768,8 @@ For more information about how to:
 Add new accounts (and corresponding licenses) to AD DS (if you have an on-premises AD DS infrastructure).

              
 For more information about how to:
 
                
-
              • Add user accounts, see [Bulk-import user and group accounts into AD DS](#bulk-import-user-and-group-accounts-into-ad-ds).
                • 
-
              • Assign licenses, see [Assign or remove licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-remove-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US).
                • 
+
              • Add user accounts, see Bulk-import user and group accounts into AD DS.
                • 
+
              • Assign licenses, see Assign or remove licenses for Office 365 for business.
                • 
 
              
 
 
@@ -1780,8 +1781,8 @@ For more information about how to:
 Remove unnecessary user accounts (and corresponding licenses) from Office 365 (if you do not have an on-premises AD DS infrastructure).

              
 For more information about how to:
 
                
-
              • Remove unnecessary user accounts, see [Delete or restore users](https://support.office.com/en-us/article/Delete-or-restore-users-d5155593-3bac-4d8d-9d8b-f4513a81479e).
                • 
-
              • Remove licenses, see [Assign or remove licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-remove-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US).
                • 
+
              • Remove unnecessary user accounts, see Delete or restore users.
                • 
+
              • Remove licenses, see Assign or remove licenses for Office 365 for business.
                • 
 
              
 
 
@@ -1793,8 +1794,8 @@ For more information about how to:
 Add new accounts (and corresponding licenses) to Office 365 (if you don’t have an on-premises AD DS infrastructure).

              
 For more information about how to:
 
                
-
              • Add user accounts, see [Add users to Office 365 for business](https://support.office.com/en-us/article/Add-users-to-Office-365-for-business-435ccec3-09dd-4587-9ebd-2f3cad6bc2bc) and [Add users individually or in bulk to Office 365](https://www.youtube.com/watch?v=zDs3VltTJps).
                • 
-
              • Assign licenses, see [Assign or remove licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-remove-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US).
                • 
+
              • Add user accounts, see Add users to Office 365 for business and Add users individually or in bulk to Office 365.
                • 
+
              • Assign licenses, see Assign or remove licenses for Office 365 for business.
                • 
 
              
 
 
@@ -1806,8 +1807,8 @@ For more information about how to:
 Create or modify security groups, and manage group membership in Office 365.

              
 For more information about how to:
 
                
-
              • Create or modify security groups, see [Create an Office 365 Group in the admin center](https://support.office.com/en-us/article/Create-an-Office-365-Group-in-the-admin-center-74a1ef8b-3844-4d08-9980-9f8f7a36000f?ui=en-US&rs=en-001&ad=US).
                • 
-
              • Manage group membership, see [Manage Group membership in the Office 365 admin center](https://support.office.com/en-us/article/Manage-Group-membership-in-the-Office-365-admin-center-e186d224-a324-4afa-8300-0e4fc0c3000a).
                • 
+
              • Create or modify security groups, see Create an Office 365 Group in the admin center.
                • 
+
              • Manage group membership, see Manage Group membership in the admin center.
                • 
 
              
 
 
@@ -1817,7 +1818,7 @@ For more information about how to:
 
 
 Create or modify Exchange Online or Microsoft Exchange Server distribution lists in Office 365.

              
-For more information about how to create or modify Exchange Online or Exchange Server distribution lists in Office 365, see [Create and manage distribution groups](https://technet.microsoft.com/library/bb124513.aspx) and [Create, edit, or delete a security group](https://support.office.com/en-us/article/Create-edit-or-delete-a-security-group-55C96B32-E086-4C9E-948B-A018B44510CB).
+For more information about how to create or modify Exchange Online or Exchange Server distribution lists in Office 365, see Create and manage distribution groups and Create, edit, or delete a security group.
 
 
 x
@@ -1826,7 +1827,7 @@ For more information about how to create or modify Exchange Online or Exchange S
 
 
 Install new student devices.

              
-Follow the same steps you followed in the [Deploy Windows 10 to devices](#deploy-windows-10-to-devices) section.
+Follow the same steps you followed in the Deploy Windows 10 to devices section.
 
 
 
diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md
index 319f6b217d..f582026716 100644
--- a/education/windows/deploy-windows-10-in-a-school.md
+++ b/education/windows/deploy-windows-10-in-a-school.md
@@ -7,9 +7,10 @@ ms.mktglfcycl: plan
 ms.pagetype: edu
 ms.sitesec: library
 ms.localizationpriority: medium
-author: craigash
-ms.author: celested
-ms.date: 10/30/2017
+author: dansimp
+ms.author: dansimp
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Deploy Windows 10 in a school
@@ -64,7 +65,7 @@ This school configuration has the following characteristics:
 
 Office 365 Education allows:
 
-- Students and faculty to use Microsoft Office Online to create and edit Microsoft Word, OneNote, PowerPoint, and Excel documents in a browser.
+- Students and faculty to use Microsoft Office to create and edit Microsoft Word, OneNote, PowerPoint, and Excel documents in a browser.
 - Teachers to use the [OneNote Class Notebook app](https://www.onenote.com/classnotebook) to share content and collaborate with students.
 - Faculty to use the [OneNote Staff Notebooks app](https://www.onenote.com/staffnotebookedu) to collaborate with other teachers, administration, and faculty.
 - Teachers to employ Sway to create interactive educational digital storytelling.
@@ -87,7 +88,7 @@ Now that you have the plan (blueprint) for your classroom, you’re ready to lea
 
 The primary tool you will use to deploy Windows 10 in your school is MDT, which uses Windows ADK components to make deployment easier. You could just use the Windows ADK to perform your deployment, but MDT simplifies the process by providing an intuitive, wizard-driven user interface (UI).
 
-You can use MDT as a stand-alone tool or integrate it with Microsoft System Center Configuration Manager. As a stand-alone tool, MDT performs Lite Touch Installation (LTI) deployments—deployments that require minimal infrastructure and allow you to control the level of automation. When integrated with System Center Configuration Manager, MDT performs Zero Touch Installation (ZTI) deployments, which require more infrastructure (such as System Center Configuration Manager) but result in fully automated deployments.
+You can use MDT as a stand-alone tool or integrate it with Microsoft Endpoint Configuration Manager. As a stand-alone tool, MDT performs Lite Touch Installation (LTI) deployments—deployments that require minimal infrastructure and allow you to control the level of automation. When integrated with Configuration Manager, MDT performs Zero Touch Installation (ZTI) deployments, which require more infrastructure (such as Configuration Manager) but result in fully automated deployments.
 
 MDT includes the Deployment Workbench—a console from which you can manage the deployment of Windows 10 and your apps. You configure the deployment process in the Deployment Workbench, including the management of operating systems, device drivers, apps and migration of user settings on existing devices. 
 
@@ -163,7 +164,7 @@ In this section, you installed the Windows ADK and MDT on the admin device. You
 
 Office 365 is one of the core components of your classroom environment. You create and manage student identities in Office 365, and students and teachers use the suite as their email, contacts, and calendar system. Teachers and students use Office 365 collaboration features such as SharePoint, OneNote, and OneDrive for Business.
 
-As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/en-us/education/products/office-365-deployment-resources/default.aspx).
+As a first step in deploying your classroom, create an Office 365 Education subscription, and then configure Office 365 for the classroom. For more information about Office 365 Education deployment, see [School deployment of Office 365 Education](https://www.microsoft.com/education/products/office-365-deployment-resources/default.aspx).
 
 ### Select the appropriate Office 365 Education license plan
 
@@ -174,7 +175,7 @@ Complete the following steps to select the appropriate Office 365 Education lice
 
 
            • Determine the faculty members and students who need to install Office applications on devices (if any). Faculty and students can use Office applications online (standard plans) or run them locally (Office 365 ProPlus plans). Table 1 lists the advantages and disadvantages of standard and Office 365 ProPlus plans.
              • 
 
              
-*Table 1. Comparison of standard and Microsoft Office 365 ProPlus plans*
+Table 1. Comparison of standard and Microsoft Office 365 ProPlus plans
 
              
 @@ -198,7 +199,7 @@ Complete the following steps to select the appropriate Office 365 Education lice
 
              
 The best user experience is to run Office 365 ProPlus or use native Office apps on mobile devices. If neither of these options is available, use Office applications online. In addition, all Office 365 plans provide a better user experience by storing documents in OneDrive for Business, which is included in all Office 365 plans. OneDrive for Business keeps content in sync among devices and helps ensure that users always have access to their documents on any device.
 
              
-
            • Determine whether students or faculty need Azure Rights Management.
              You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see [Azure Rights Management](https://technet.microsoft.com/library/jj585024.aspx).
              • 
+
            • Determine whether students or faculty need Azure Rights Management.
              You can use Azure Rights Management to protect classroom information against unauthorized access. Azure Rights Management protects your information inside or outside the classroom through encryption, identity, and authorization policies, securing your files and email. You can retain control of the information, even when it’s shared with people outside the classroom or your educational institution. Azure Rights Management is free to use with all Office 365 Education license plans. For more information, see Azure Rights Management.
            • Record the Office 365 Education license plans needed for the classroom in Table 2.

              
 
 *Table 2. Office 365 Education license plans needed for the classroom*
@@ -222,7 +223,7 @@ The best user experience is to run Office 365 ProPlus or use native Office apps
 
 
              • 
 

 
              
 
              
-You will use the Office 365 Education license plan information you record in Table 2 in the [Create user accounts in Office 365](#create-user-accounts-in-office-365) section of this guide.
+You will use the Office 365 Education license plan information you record in Table 2 in the Create user accounts in Office 365 section of this guide.
 
 ### Create a new Office 365 Education subscription
 
@@ -233,11 +234,11 @@ To create a new Office 365 Education subscription for use in the classroom, use
 #### To create a new Office 365 subscription
 
 1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar.
-   
+
    **Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window in one of the following:
-  - Microsoft Edge by opening the Microsoft Edge app, either pressing Ctrl+Shift+P or clicking or tapping **More actions**, and then clicking or tapping **New InPrivate window**.
-  - Internet Explorer 11 by opening Internet Explorer 11, either pressing Ctrl+Shift+P or clicking or tapping **Settings**, clicking or tapping **Safety**, and then clicking or tapping **InPrivate Browsing**.
-  
+   - Microsoft Edge by opening the Microsoft Edge app, either pressing Ctrl+Shift+P or clicking or tapping **More actions**, and then clicking or tapping **New InPrivate window**.
+   - Internet Explorer 11 by opening Internet Explorer 11, either pressing Ctrl+Shift+P or clicking or tapping **Settings**, clicking or tapping **Safety**, and then clicking or tapping **InPrivate Browsing**.
+
 2. On the **Get started** page, type your school email address in the **Enter your school email address** box, and then click **Sign up**. You will receive an email in your school email account.
 3. Click the hyperlink in the email in your school email account.
 4. On the **One last thing** page, complete your user information, and then click **Start**. The wizard creates your new Office 365 Education subscription, and you are automatically signed in as the administrative user you specified when you created the subscription.
@@ -248,7 +249,7 @@ Now that you have created your new Office 365 Education subscription, add the do
 
 #### To add additional domains and subdomains
 
-1. In the Office 365 admin center, in the list view, click **DOMAINS**.
+1. In the admin center, in the list view, click **DOMAINS**.
 2. In the details pane, above the list of domains, on the menu bar, click **Add domain**.
 3. In the Add a New Domain in Office 365 Wizard, on the **Verify domain wizard** page, click **Let’s get started**.
 4. On the **Verify domain** wizard page, in the **Enter a domain you already own** box, type your domain name, and then click **Next**.
@@ -275,12 +276,13 @@ All new Office 365 Education subscriptions have automatic tenant join enabled by
 *Table 3. Windows PowerShell commands to enable or disable Automatic Tenant Join*
 
 
-| Action | Windows PowerShell command |
-|------- |----------------------------|
-| Enable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $true`|
-| Disable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $false`|
+| Action  |                Windows PowerShell command                 |
+|---------|-----------------------------------------------------------|
+| Enable  | `Set-MsolCompanySettings -AllowEmailVerifiedUsers $true`  |
+| Disable | `Set-MsolCompanySettings -AllowEmailVerifiedUsers $false` |
+
 
              
-**Note**  If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant.
+Note  If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant.
 
 ### Disable automatic licensing
 
@@ -292,11 +294,14 @@ Although all new Office 365 Education subscriptions have automatic licensing ena
 
 *Table 4. Windows PowerShell commands to enable or disable automatic licensing*
 
-| Action | Windows PowerShell command|
-| -------| --------------------------|
-| Enable |`Set-MsolCompanySettings -AllowAdHocSubscriptions $true`|
-|Disable | `Set-MsolCompanySettings -AllowAdHocSubscriptions $false`|
+
+| Action  |                Windows PowerShell command                 |
+|---------|-----------------------------------------------------------|
+| Enable  | `Set-MsolCompanySettings -AllowAdHocSubscriptions $true`  |
+| Disable | `Set-MsolCompanySettings -AllowAdHocSubscriptions $false` |
+
 
              
+
 ### Enable Azure AD Premium
 
 When you create your Office 365 subscription, you create an Office 365 tenant that includes an Azure AD directory. Azure AD is the centralized repository for all your student and faculty accounts in Office 365, Intune, and other Azure AD–integrated apps. Azure AD is available in Free, Basic, and Premium editions. Azure AD Free, which is included in Office 365 Education, has fewer features than Azure AD Basic, which in turn has fewer features than Azure AD Premium.
@@ -378,15 +383,15 @@ You can deploy the Azure AD Connect tool by using one of the following methods:
 
 - **On premises.** As shown in Figure 6, Azure AD Connect runs on premises, which has the advantage of not requiring a virtual private network (VPN) connection to Azure. It does, however, require a virtual machine (VM) or physical server.
 
- ![fig 6](images/deploy-win-10-school-figure6.png)
+  ![fig 6](images/deploy-win-10-school-figure6.png)
 
- *Figure 6. Azure AD Connect on premises*
+  *Figure 6. Azure AD Connect on premises*
 
 - **In Azure**. As shown in Figure 7, Azure AD Connect runs on a VM in Azure AD, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises.
 
- ![fig 7](images/deploy-win-10-school-figure7.png)
+  ![fig 7](images/deploy-win-10-school-figure7.png)
 
- *Figure 7. Azure AD Connect in Azure*
+  *Figure 7. Azure AD Connect in Azure*
 
 This guide describes how to run Azure AD Connect on premises. For information about running Azure AD Connect in Azure, see [Deploy Office 365 Directory Synchronization (DirSync) in Microsoft Azure](https://technet.microsoft.com/library/dn635310.aspx).
 
@@ -437,24 +442,30 @@ Several methods are available to bulk-import user accounts into AD DS domains. T
 
 *Table 5. AD DS bulk-import account methods*
 
-|Method | Description and reason to select this method |
-|-------| ---------------------------------------------|
-|Ldifde.exe |This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).|
-|VBScript | This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx) and [ADSI Scriptomatic](https://technet.microsoft.com/scriptcenter/dd939958.aspx).|
-|Windows PowerShell| This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).|
+
+|       Method       |                                                                                                                                                                                                                                                                                                                                         Description and reason to select this method                                                                                                                                                                                                                                                                                                                                         |
+|--------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+|     Ldifde.exe     | This command-line tool allows you to import and export objects (such as user accounts) from AD DS. Select this method if you aren’t comfortable with Microsoft Visual Basic Scripting Edition (VBScript), Windows PowerShell, or other scripting languages. For more information about using Ldifde.exe, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx). |
+|      VBScript      |                                                                                                             This scripting language uses the Active Directory Services Interfaces (ADSI) Component Object Model interface to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with VBScript. For more information about using VBScript and ADSI, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx) and [ADSI Scriptomatic](https://technet.microsoft.com/scriptcenter/dd939958.aspx).                                                                                                              |
+| Windows PowerShell |                                                                          This scripting language natively supports cmdlets to manage AD DS objects, including user and group objects. Select this method if you’re comfortable with Window PowerShell scripting. For more information about using Windows PowerShell, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).                                                                          |
+
 
              
+
 ### Create a source file that contains the user and group accounts
 
 After you have selected your user and group account bulk import method, you’re ready to create the source file that contains the user and group account. You’ll use the source file as the input to the import process. The source file format depends on the method you selected. Table 6 lists the source file format for the bulk import methods.
 
 *Table 6. Source file format for each bulk import method*
 
-| Method | Source file format |
-|--------| -------------------|
-|Ldifde.exe|Ldifde.exe requires a specific format for the source file. Use Ldifde.exe to export existing user and group accounts so that you can see the format. For examples of the format that Ldifde.exe requires, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx).|
-|VBScript | VBScript can use any .csv file format to create a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in comma-separated values (CSV) format, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx).|
-| Windows PowerShell| Windows PowerShell can use any .csv file format you want to create as a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in CSV format, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).|
+
+|       Method       |                                                                                                                                                                                                                                                                                                      Source file format                                                                                                                                                                                                                                                                                                       |
+|--------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+|     Ldifde.exe     | Ldifde.exe requires a specific format for the source file. Use Ldifde.exe to export existing user and group accounts so that you can see the format. For examples of the format that Ldifde.exe requires, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx), [LDIFDE—Export/Import data from Active Directory—LDIFDE commands](https://support.microsoft.com/kb/555636), [Import or Export Directory Objects Using Ldifde](https://technet.microsoft.com/library/cc816781.aspx), and [LDIFDE](https://technet.microsoft.com/library/cc755456.aspx). |
+|      VBScript      |                                                                                                                              VBScript can use any .csv file format to create a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in comma-separated values (CSV) format, see [Step-by-Step Guide to Bulk Import and Export to Active Directory](https://technet.microsoft.com/library/bb727091.aspx).                                                                                                                              |
+| Windows PowerShell |                               Windows PowerShell can use any .csv file format you want to create as a source file for the bulk-import process. To create the .csv file, use software such as Excel. For examples of how to format your source file in CSV format, see [Import Bulk Users to Active Directory](https://blogs.technet.microsoft.com/bettertogether/2011/01/09/import-bulk-users-to-active-directory/) and [PowerShell: Bulk create AD Users from CSV file](https://social.technet.microsoft.com/wiki/contents/articles/24541.powershell-bulk-create-ad-users-from-csv-file.aspx).                               |
+
 
              
+
 ### Import the user accounts into AD DS
 
 With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method.
@@ -479,7 +490,7 @@ You can bulk-import user and group accounts directly into Office 365, reducing t
 
 Now that you have created your new Office 365 Education subscription, you need to create user accounts. You can add user accounts for the teachers, other faculty, and students who will use the classroom.
 
-You can use the Office 365 admin center to add individual Office 365 accounts manually—a reasonable process when you’re adding only a few users. If you have many users, however, you can automate the process by creating a list of those users, and then use that list to create user accounts (that is, bulk-add users).
+You can use the Microsoft 365 admin center to add individual Office 365 accounts manually—a reasonable process when you’re adding only a few users. If you have many users, however, you can automate the process by creating a list of those users, and then use that list to create user accounts (that is, bulk-add users).
 
 The bulk-add process assigns the same Office 365 Education license plan to all users on the list. Therefore, you must create a separate list for each license plan you recorded in Table 2. Depending on the number of faculty members who need to use the classroom, you may want to add the faculty Office 365 accounts manually; however, use the bulk-add process to add student accounts.
 
@@ -554,16 +565,19 @@ After you create the Microsoft Store for Business portal, configure it by using
 
 *Table 7. Menu selections to configure Microsoft Store for Business settings*
 
-| Menu selection        | What you can do in this menu |
-|---------------| -------------------|
-|Account information|Displays information about your Microsoft Store for Business account (no settings can be changed). You make changes to this information in Office 365 or the Azure Portal. For more information, see [Update Microsoft Store for Business account settings](https://technet.microsoft.com/itpro/windows/manage/update-windows-store-for-business-account-settings).|
-|Device Guard signing|Allows you to upload and sign Device Guard catalog and policy files. For more information about Device Guard, see [Device Guard deployment guide](https://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide).|
-|LOB publishers| Allows you to add line-of-business (LOB) publishers that can then publish apps to your private store. LOB publishers are usually internal developers or software vendors that are working with your institution. For more information, see [Working with line-of-business apps](https://technet.microsoft.com/itpro/windows/manage/working-with-line-of-business-apps).|
-|Management tools| Allows you to add tools that you can use to distribute (deploy) apps in your private store. For more information, see [Distribute apps with a management tool](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-with-management-tool).|
-|Offline licensing|Allows you to show (or not show) offline licensed apps to people shopping in your private store. For more information, see [Licensing model: online and offline licenses](https://technet.microsoft.com/itpro/windows/manage/apps-in-windows-store-for-business#licensing-model).|
-|Permissions|Allows you to grant other users in your organization the ability to buy, manage, and administer your Microsoft Store for Business portal. You can also remove permissions you have previously granted. For more information, see [Roles and permissions in Microsoft Store for Business](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business).|
-|Private store|Allows you to change the organization name used in your Microsoft Store for Business portal. When you create your portal, the private store uses the organization name that you used to create your Office 365 subscription. For more information, see [Distribute apps using your private store](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-from-your-private-store).|
+
+|    Menu selection    |                                                                                                                                                                                  What you can do in this menu                                                                                                                                                                                  |
+|----------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Account information  |              Displays information about your Microsoft Store for Business account (no settings can be changed). You make changes to this information in Office 365 or the Azure Portal. For more information, see [Update Microsoft Store for Business account settings](https://technet.microsoft.com/itpro/windows/manage/update-windows-store-for-business-account-settings).               |
+| Device Guard signing |                                                                           Allows you to upload and sign Device Guard catalog and policy files. For more information about Device Guard, see [Device Guard deployment guide](https://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide).                                                                            |
+|    LOB publishers    |            Allows you to add line-of-business (LOB) publishers that can then publish apps to your private store. LOB publishers are usually internal developers or software vendors that are working with your institution. For more information, see [Working with line-of-business apps](https://technet.microsoft.com/itpro/windows/manage/working-with-line-of-business-apps).             |
+|   Management tools   |                                                                    Allows you to add tools that you can use to distribute (deploy) apps in your private store. For more information, see [Distribute apps with a management tool](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-with-management-tool).                                                                    |
+|  Offline licensing   |                                                       Allows you to show (or not show) offline licensed apps to people shopping in your private store. For more information, see [Licensing model: online and offline licenses](https://technet.microsoft.com/itpro/windows/manage/apps-in-windows-store-for-business#licensing-model).                                                        |
+|     Permissions      | Allows you to grant other users in your organization the ability to buy, manage, and administer your Microsoft Store for Business portal. You can also remove permissions you have previously granted. For more information, see [Roles and permissions in Microsoft Store for Business](https://technet.microsoft.com/itpro/windows/manage/roles-and-permissions-windows-store-for-business). |
+|    Private store     | Allows you to change the organization name used in your Microsoft Store for Business portal. When you create your portal, the private store uses the organization name that you used to create your Office 365 subscription. For more information, see [Distribute apps using your private store](https://technet.microsoft.com/itpro/windows/manage/distribute-apps-from-your-private-store). |
+
 
              
+
 ### Find, acquire, and distribute apps in the portal
 
 Now that you have created your Microsoft Store for Business portal, you’re ready to find, acquire, and distribute apps that you will add to your portal. You do this by using the Inventory page in Microsoft Store for Business.
@@ -572,7 +586,7 @@ Now that you have created your Microsoft Store for Business portal, you’re rea
 
 You can deploy apps to individual users or make apps available to users through your private store. Deploying apps to individual users restricts the app to those specified users. Making apps available through your private store allows all your users.
 
-For more information about how to find, acquire, and distribute apps in the portal, see [App inventory management for Microsoft Store for Business](https://technet.microsoft.com/itpro/windows/manage/app-inventory-managemement-windows-store-for-business).
+For more information about how to find, acquire, and distribute apps in the portal, see [App inventory management for Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business).
 
 ### Summary
 
@@ -593,11 +607,12 @@ Depending on your school’s requirements, you may need any combination of the f
 
 - **Windows 10 Home**. Use this operating system to upgrade existing eligible institution-owned and personal devices that are running Windows 8.1 Home or Windows 7 Home to Windows 10 Home.
 - **Windows 10 Pro**. Use this operating system to:
- - Upgrade existing eligible institution-owned and personal devices running Windows 8.1 Pro or Windows 7 Professional to Windows 10 Pro.
- - Deploy new instances of Windows 10 Pro to devices so that new devices have a known configuration.
+  - Upgrade existing eligible institution-owned and personal devices running Windows 8.1 Pro or Windows 7 Professional to Windows 10 Pro.
+  - Deploy new instances of Windows 10 Pro to devices so that new devices have a known configuration.
 - **Windows 10 Education**. Use this operating system to:
- - Upgrade institution-owned devices to Windows 10 Education.
- - Deploy new instances of Windows 10 Education so that new devices have a known configuration.
+  - Upgrade institution-owned devices to Windows 10 Education.
+  - Deploy new instances of Windows 10 Education so that new devices have a known configuration.
+- **Windows 10 Pro Education**. Use this operating system to upgrade existing eligible institution-owned devices running Windows 10 Pro Education, version 1903 or later, to Windows 10 Education using [subscription activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation).
 
 **Note**  Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Microsoft Store for Business. These features are not available in Windows 10 Home.
 
@@ -657,7 +672,7 @@ Select this method when you want to deploy Windows over-the-network and perform
 
            • Deploys images more slowly than when using local media.
              • 
 
            • Requires no additional infrastructure.
              • 
 
            
- 
+
 Select this method when you want to deploy Windows over-the-network and are willing to boot the target device from local media. The advantage of this method is that the media are generic and typically don’t require updates after you create them (the Deployment Wizard accesses the centrally located deployment share over the network). The disadvantage of this method is that over-the-network deployments are slower than deployment from local media.
 
 
@@ -704,7 +719,7 @@ The first step in preparation for Windows 10 deployment is to configure—that i
 
 
 1. Import operating systems
-Import the operating systems that you selected in the [Select operating systems](#select-the-operating-systems) section into the deployment share. For more information about how to import operating systems, see [Import an Operating System into the Deployment Workbench](https://technet.microsoft.com/library/dn759415.aspx#ImportanOperatingSystemintotheDeploymentWorkbench).
+Import the operating systems that you selected in the Select operating systems section into the deployment share. For more information about how to import operating systems, see Import an Operating System into the Deployment Workbench.
 
 
 
@@ -718,7 +733,7 @@ Import device drivers for each device in your institution. For more information
 
 
 3. Create MDT applications for Microsoft Store apps
-Create an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using *sideloading*, which allows you to use the **Add-AppxPackage** Windows PowerShell cmdlet to deploy the .appx files associated with the app (called *provisioned apps*). Use this method to deploy up to 24 apps to Windows 10.

            
+Create an MDT application for each Microsoft Store app you want to deploy. You can deploy Microsoft Store apps by using sideloading, which allows you to use the Add-AppxPackage Windows PowerShell cmdlet to deploy the .appx files associated with the app (called provisioned apps). Use this method to deploy up to 24 apps to Windows 10.

            
 
 Prior to sideloading the .appx files, obtain the Microsoft Store .appx files that you will use to deploy (sideload) the apps in your provisioning package. For apps in Microsoft Store, you will need to obtain the .appx files from the app software vendor directly. If you are unable to obtain the .appx files from the app software vendor, then you or the students will need to install the apps on the student devices directly from Microsoft Store or Microsoft Store for Business.

            
 
@@ -726,8 +741,8 @@ If you have Intune, you can deploy Microsoft Store apps after you deploy Windows
 
 In addition, you must prepare your environment for sideloading (deploying) Microsoft Store apps. For more information about how to:

            
 
              
-
            • Prepare your environment for sideloading, see [Sideload LOB apps in Windows 10](https://technet.microsoft.com/itpro/windows/deploy/sideload-apps-in-windows-10).
              • 
-
            • Create an MDT application, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench).
              • 
+
            • Prepare your environment for sideloading, see Sideload LOB apps in Windows 10.
              • 
+
            • Create an MDT application, see Create a New Application in the Deployment Workbench.
              • 
 
            
 
 
@@ -784,9 +799,9 @@ You can use Windows Deployment Services in conjunction with MDT to automatically
 
 1. Set up and configure Windows Deployment Services.
            Windows Deployment Services is a server role available in all Windows Server editions. You can enable the Windows Deployment Services server role on a new server or on any server running Windows Server in your institution. For more information about how to perform this step, see the following resources:
 
-  - [Windows Deployment Services overview](https://technet.microsoft.com/library/hh831764.aspx)
-  - The Windows Deployment Services Help file, included in Windows Deployment Services
-  - [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426.aspx)
+   - [Windows Deployment Services overview](https://technet.microsoft.com/library/hh831764.aspx)
+   - The Windows Deployment Services Help file, included in Windows Deployment Services
+   - [Windows Deployment Services Getting Started Guide for Windows Server 2012](https://technet.microsoft.com/library/jj648426.aspx)
 
 2. Add LTI boot images (Windows PE images) to Windows Deployment Services.
            The LTI boot images (.wim files) that you will add to Windows Deployment Services are in the MDT deployment share. Locate the .wim files in the Boot subfolder in the deployment share. For more information about how to perform this step, see [Add LTI Boot Images to Windows Deployment Services](https://technet.microsoft.com/library/dn759415.aspx#AddLTIBootImagestoWindowsDeploymentServices).
 
@@ -900,89 +915,89 @@ Microsoft has several recommended settings for educational institutions. Table 1
 
 Use of Microsoft accounts
 You want faculty and students to use only Azure AD accounts for institution-owned devices. For these devices, do not use Microsoft accounts or associate a Microsoft account with the Azure AD accounts.

            
-**Note**  Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices.

            
-**Group Policy.** Configure the [Accounts: Block Microsoft accounts](https://technet.microsoft.com/library/jj966262.aspx?f=255&MSPPError=-2147217396) Group Policy setting to use the Users can’t add Microsoft accounts setting option.

            
-**Intune.** Enable or disable the camera by using the **Allow Microsoft account**, **Allow adding non-Microsoft accounts manually**, and **Allow settings synchronization for Microsoft accounts** policy settings under the **Accounts and Synchronization** section of a **Windows 10 General Configuration** policy.
+Note  Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices.

            
+Group Policy. Configure the Accounts: Block Microsoft accounts Group Policy setting to use the Users can’t add Microsoft accounts setting option.

            
+Intune. Enable or disable the camera by using the Allow Microsoft account, Allow adding non-Microsoft accounts manually, and Allow settings synchronization for Microsoft accounts policy settings under the Accounts and Synchronization section of a Windows 10 General Configuration policy.
 
 
 
 
 Restrict local administrator accounts on the devices
 Ensure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.

            
-**Group Policy**. Create a **Local Group** Group Policy preference to limit the local administrators group membership. Select the **Delete all member users** and **Delete all member groups** check boxes to remove any existing members. For more information about how to configure Local Group preferences, see [Configure a Local Group Item](https://technet.microsoft.com/library/cc732525.aspx).

            
-**Intune**. Not available.
+Group Policy. Create a Local Group Group Policy preference to limit the local administrators group membership. Select the Delete all member users and Delete all member groups check boxes to remove any existing members. For more information about how to configure Local Group preferences, see Configure a Local Group Item.

            
+Intune. Not available.
 
 
 
 
 Restrict the local administrator accounts on the devices
 Ensure that only authorized users are local administrators on institution-owned devices. Typically, you don’t want students to be administrators on instruction-owned devices. Explicitly specify the users who will be local administrators on a group of devices.

            
-**Group Policy**. Create a **Local Group** Group Policy preference to limit the local administrators group membership. Select the **Delete all member users** and **Delete all member groups** check boxes to remove any existing members. For more information about how to configure Local Group preferences, see [Configure a Local Group Item](https://technet.microsoft.com/library/cc732525.aspx).

            
-**Intune**. Not available.
+Group Policy. Create a Local Group Group Policy preference to limit the local administrators group membership. Select the Delete all member users and Delete all member groups check boxes to remove any existing members. For more information about how to configure Local Group preferences, see Configure a Local Group Item.

            
+Intune. Not available.
 
 
 
 
 Manage the built-in administrator account created during device deployment
 When you use MDT to deploy Windows 10, the MDT deployment process automatically creates a local Administrator account with the password you specified. As a security best practice, rename the built-in Administrator account and optionally disable it.

            
-**Group Policy**. Rename the built-in Administrator account by using the **Accounts: Rename administrator account** Group Policy setting. For more information about how to rename the built-in Administrator account, see [To rename the Administrator account using the Group Policy Management Console](https://technet.microsoft.com/library/cc747484.aspx). You will specify the new name for the Administrator account. You can disable the built-in Administrator account by using the **Accounts: Administrator account status** Group Policy setting. For more information about how to disable the built-in Administrator account, see [Accounts: Administrator account status](https://technet.microsoft.com/library/jj852165.aspx).

            
-**Intune**. Not available.
+Group Policy. Rename the built-in Administrator account by using the Accounts: Rename administrator account Group Policy setting. For more information about how to rename the built-in Administrator account, see To rename the Administrator account using the Group Policy Management Console. You will specify the new name for the Administrator account. You can disable the built-in Administrator account by using the Accounts: Administrator account status Group Policy setting. For more information about how to disable the built-in Administrator account, see Accounts: Administrator account status.

            
+Intune. Not available.
 
 
 
 
 Control Microsoft Store access
 You can control access to Microsoft Store and whether existing Microsoft Store apps receive updates. You can only disable the Microsoft Store app in Windows 10 Education and Windows 10 Enterprise.

            
-**Group Policy**. You can disable the Microsoft Store app by using the **Turn off the Store Application** Group Policy setting. You can prevent Microsoft Store apps from receiving updates by using the **Turn off Automatic Download and Install of updates** Group Policy setting. For more information about configuring these settings, see [Can I use Group Policy to control the Microsoft Store in my enterprise environment?](https://technet.microsoft.com/library/hh832040.aspx#BKMK_UseGP).

            
-**Intune**. You can enable or disable the camera by using the **Allow application store** policy setting in the **Apps** section of a **Windows 10 General Configuration** policy.
+Group Policy. You can disable the Microsoft Store app by using the Turn off the Store Application Group Policy setting. You can prevent Microsoft Store apps from receiving updates by using the Turn off Automatic Download and Install of updates Group Policy setting. For more information about configuring these settings, see Can I use Group Policy to control the Microsoft Store in my enterprise environment?.

            
+Intune. You can enable or disable the camera by using the Allow application store policy setting in the Apps section of a Windows 10 General Configuration policy.
 
 
 
 
 Use of Remote Desktop connections to devices
 Remote Desktop connections could allow unauthorized access to the device. Depending on your institution’s policies, you may want to disable Remote Desktop connections on your devices.

            
-**Group Policy**. You can enable or disable Remote Desktop connections to devices by using the **Allow Users to connect remotely using Remote Desktop setting** in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections.

            
-**Intune**. Not available.
+Group Policy. You can enable or disable Remote Desktop connections to devices by using the Allow Users to connect remotely using Remote Desktop setting in Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections.

            
+Intune. Not available.
 
 
 
 
 Use of camera
 A device’s camera can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the camera on your devices.

            
-**Group Policy**. Not available.

            
-**Intune**. You can enable or disable the camera by using the **Allow camera** policy setting in the **Hardware** section of a **Windows 10 General Configuration** policy.
+Group Policy. Not available.

            
+Intune. You can enable or disable the camera by using the Allow camera policy setting in the Hardware section of a Windows 10 General Configuration policy.
 
 
 
 
 Use of audio recording
 Audio recording (by using the Sound Recorder app) can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the Sound Recorder app on your devices.

            
-**Group Policy**. You can disable the Sound Recorder app by using the **Do not allow Sound Recorder to run** Group Policy setting. You can disable other audio recording apps by using AppLocker policies. Create AppLocker policies by using the information in [Editing an AppLocker Policy](https://technet.microsoft.com/library/ee791894(v=ws.10).aspx) and [Create Your AppLocker Policies](https://technet.microsoft.com/library/ee791899.aspx).

            
-**Intune**. You can enable or disable the camera by using the **Allow voice recording** policy setting in the **Features** section of a **Windows 10 General Configuration** policy.
+Group Policy. You can disable the Sound Recorder app by using the Do not allow Sound Recorder to run Group Policy setting. You can disable other audio recording apps by using AppLocker policies. Create AppLocker policies by using the information in Editing an AppLocker Policy and Create Your AppLocker Policies.

            
+Intune. You can enable or disable the camera by using the Allow voice recording policy setting in the Features section of a Windows 10 General Configuration policy.
 
 
 
 
 Use of screen capture
 Screen captures can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the ability to perform screen captures on your devices.

            
-**Group Policy**. Not available.

            
-**Intune**. You can enable or disable the camera by using the **Allow screen capture** policy setting in the **System** section of a **Windows 10 General Configuration** policy.
+Group Policy. Not available.

            
+Intune. You can enable or disable the camera by using the Allow screen capture policy setting in the System section of a Windows 10 General Configuration policy.
 
 
 
 
 Use of location services
 Providing a device’s location can be a source of disclosure or privacy issues in an education environment. Depending on your institution’s policies, you may want to disable the location service on your devices.

            
-**Group Policy**. You can enable or disable location services by using the **Turn off location** Group Policy setting in User Configuration\Windows Components\Location and Sensors.

            
-**Intune**. You can enable or disable the camera by using the **Allow geolocation** policy setting in the **Hardware** section of a **Windows 10 General Configuration** policy.
+Group Policy. You can enable or disable location services by using the Turn off location Group Policy setting in User Configuration\Windows Components\Location and Sensors.

            
+Intune. You can enable or disable the camera by using the Allow geolocation policy setting in the Hardware section of a Windows 10 General Configuration policy.
 
 
 
 
 Changing wallpaper
 Displaying a custom wallpaper can be a source of disclosure or privacy issues in an education environment (if the wallpaper displays information about the user or the device). Depending on your institution’s policies, you may want to prevent users from changing the wallpaper on your devices.

            
-**Group Policy**. You can configure the wallpaper by using the **Desktop WallPaper** setting in User Configuration\Administrative Templates\Desktop\Desktop.

            
-**Intune**. Not available.
+Group Policy. You can configure the wallpaper by using the Desktop WallPaper setting in User Configuration\Administrative Templates\Desktop\Desktop.

            
+Intune. Not available.
 
 
 
@@ -1034,13 +1049,16 @@ Prior to deployment of Windows 10, ensure that you complete the tasks listed in
 
 *Table 12. Deployment preparation checklist*
 
-|Task |      |
-| ---| --- |
-|   |The target devices have sufficient system resources to run Windows 10. |
-|   | Identify the necessary devices drivers, and import them to the MDT deployment share.|
-|   | Create an MDT application for each Microsoft Store and Windows desktop app.|
-|   | Notify the students and faculty about the deployment.|
+
+| Task |                                                                                      |
+|------|--------------------------------------------------------------------------------------|
+|      |        The target devices have sufficient system resources to run Windows 10.        |
+|      | Identify the necessary devices drivers, and import them to the MDT deployment share. |
+|      |     Create an MDT application for each Microsoft Store and Windows desktop app.      |
+|      |                Notify the students and faculty about the deployment.                 |
+
 
            
+
 ### Perform the deployment
 
 Use the Deployment Wizard to deploy Windows 10. The LTI deployment process is almost fully automated: You provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated. 
@@ -1078,7 +1096,7 @@ As a final quality control step, verify the device configuration to ensure that
 - The device can connect to the Internet and view the appropriate web content in Microsoft Edge.
 - Windows Update is active and current with software updates.
 - Windows Defender is active and current with malware Security intelligence.
-- The SmartScreen Filter is active.
+- Windows Defender SmartScreen is active.
 - All Microsoft Store apps are properly installed and updated.
 - All Windows desktop apps are properly installed and updated.
 - Printers are properly configured.
@@ -1123,10 +1141,10 @@ Table 13 lists the school and individual classroom maintenance tasks, the resour
 Verify that Windows Update is active and current with operating system and software updates.

            
 For more information about completing this task when you have:
 
              
-
            • Intune, see [Keep Windows PCs up to date with software updates in Microsoft Intune](https://docs.microsoft.com/intune/deploy-use/keep-windows-pcs-up-to-date-with-software-updates-in-microsoft-intune).
              • 
-
            • Group Policy, see [Windows Update for Business](https://technet.microsoft.com/itpro/windows/plan/windows-update-for-business).
              • 
-
            • Windows Server Update Services (WSUS), see [Windows Server Update Services](https://msdn.microsoft.com/library/bb332157.aspx?f=255&MSPPError=-2147217396).
              • 
-
            • Neither Intune, Group Policy, or WSUS, see [Update Windows 10](https://windows.microsoft.com/en-id/windows-10/update-windows-10)
              • 
+
            • Intune, see Keep Windows PCs up to date with software updates in Microsoft Intune.
              • 
+
            • Group Policy, see Windows Update for Business.
              • 
+
            • Windows Server Update Services (WSUS), see Windows Server Update Services.
              • 
+
            • Neither Intune, Group Policy, or WSUS, see Update Windows 10
              • 
 
            
 
 X
@@ -1136,7 +1154,7 @@ For more information about completing this task when you have:
 
 
 Verify that Windows Defender is active and current with malware Security intelligence.

            
-For more information about completing this task, see [Turn Windows Defender on or off](https://windows.microsoft.com/en-us/windows-10/how-to-protect-your-windows-10-pc#v1h=tab01) and [Updating Windows Defender](https://windows.microsoft.com/en-us/windows-10/how-to-protect-your-windows-10-pc#v1h=tab03). 
+For more information about completing this task, see Turn Windows Defender on or off and Updating Windows Defender. 
 X
 X
 X
@@ -1144,7 +1162,7 @@ For more information about completing this task, see [Turn Windows Defender on o
 
 
 Verify that Windows Defender has run a scan in the past week and that no viruses or malware were found.

            
-For more information about completing this task, see [How do I find and remove a virus?](https://windows.microsoft.com/en-US/windows-8/how-find-remove-virus)
+For more information about completing this task, see How do I find and remove a virus?
 
 X
 X
@@ -1153,7 +1171,7 @@ For more information about completing this task, see [How do I find and remove a
 
 
 Verify that you are using the appropriate Windows 10 servicing options for updates and upgrades (such as selecting whether you want to use Current Branch or Current Branch for Business).

             
-For more information about Windows 10 servicing options for updates and upgrades, see [Windows 10 servicing options for updates and upgrades](https://technet.microsoft.com/itpro/windows/manage/introduction-to-windows-10-servicing).
+For more information about Windows 10 servicing options for updates and upgrades, see Windows 10 servicing options for updates and upgrades.
 
 X
 X
@@ -1161,7 +1179,7 @@ For more information about Windows 10 servicing options for updates and upgrades
 
 
 Refresh the operating system and apps on devices.

            
-For more information about completing this task, see the [Deploy Windows 10 to devices](#deploy-windows-10-to-devices) section.
+For more information about completing this task, see the Deploy Windows 10 to devices section.
 
 
 
@@ -1171,7 +1189,7 @@ For more information about completing this task, see the [Deploy Windows 10 to d
 
 
 Install any new Windows desktop apps or update any Windows desktop apps that are used in the curriculum.

            
-For more information, see the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.
+For more information, see the Deploy apps by using Intune section.
 
 
 
@@ -1182,7 +1200,7 @@ For more information, see the [Deploy apps by using Intune](#deploy-apps-by-usin
 
 Install new or update existing Microsoft Store apps that are used in the curriculum.

            
 Microsoft Store apps are automatically updated from Microsoft Store. The menu bar in the Microsoft Store app shows whether any Microsoft Store app updates are available for download.

            
-You can also deploy Microsoft Store apps directly to devices by using Intune. For more information, see the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.
+You can also deploy Microsoft Store apps directly to devices by using Intune. For more information, see the Deploy apps by using Intune section.
 
 
 
@@ -1194,8 +1212,8 @@ You can also deploy Microsoft Store apps directly to devices by using Intune. Fo
 Remove unnecessary user accounts (and corresponding licenses) from Office 365.

            
 For more information about how to:
 
              
-
            • Remove unnecessary user accounts, see [Delete or restore users](https://support.office.com/en-us/article/Delete-or-restore-users-d5155593-3bac-4d8d-9d8b-f4513a81479e?ui=en-US&rs=en-US&ad=US).
              • 
-
            • Unassign licenses, see [Assign or unassign licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-unassign-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US).
              • 
+
            • Remove unnecessary user accounts, see Delete or restore users.
              • 
+
            • Unassign licenses, see Assign or unassign licenses for Office 365 for business.
              • 
 
            
 
 
@@ -1208,8 +1226,8 @@ For more information about how to:
 Add new accounts (and corresponding licenses) to Office 365.

            
 For more information about how to:
 
              
-
            • Add user accounts, see [Add users to Office 365 for business](https://support.office.com/en-us/article/Add-users-to-Office-365-for-business-435ccec3-09dd-4587-9ebd-2f3cad6bc2bc) and [Add users individually or in bulk to Office 365](https://www.youtube.com/watch?v=zDs3VltTJps).
              • 
-
            • Assign licenses, see [Assign or unassign licenses for Office 365 for business](https://support.office.com/en-us/article/Assign-or-unassign-licenses-for-Office-365-for-business-997596b5-4173-4627-b915-36abac6786dc?ui=en-US&rs=en-US&ad=US).
              • 
+
            • Add user accounts, see Add users to Office 365 for business and Add users individually or in bulk to Office 365.
              • 
+
            • Assign licenses, see Assign or unassign licenses for Office 365 for business.
              • 
 
            
 
 
@@ -1221,8 +1239,8 @@ For more information about how to:
 Create or modify security groups and manage group membership in Office 365.

            
 For more information about how to:
 
              
-
            • Create or modify security groups, see [View, create, and delete Groups in the Office 365 admin center](https://support.office.com/en-us/article/View-create-and-delete-groups-in-the-Office-365-admin-center-a6360120-2fc4-46af-b105-6a04dc5461c7).
              • 
-
            • Manage group membership, see [Manage Group membership in the Office 365 admin center](https://support.office.com/en-us/article/Manage-Group-membership-in-the-Office-365-admin-center-e186d224-a324-4afa-8300-0e4fc0c3000a).
              • 
+
            • Create or modify security groups, see View, create, and delete Groups in the admin center.
              • 
+
            • Manage group membership, see Manage Group membership in the admin center.
              • 
 
            
 
 
@@ -1233,7 +1251,7 @@ For more information about how to:
 
 
 Create or modify Exchange Online or Microsoft Exchange Server distribution lists in Office 365.

            
-For more information about how to create or modify Exchange Online or Exchange Server distribution lists in Office 365, see [Manage Distribution Groups](https://technet.microsoft.com/library/bb124513.aspx) and [Groups in Exchange Online and SharePoint Online](https://support.office.com/en-us/article/Create-edit-or-delete-a-security-group-55C96B32-E086-4C9E-948B-A018B44510CB#__groups_in_exchange).
+For more information about how to create or modify Exchange Online or Exchange Server distribution lists in Office 365, see Manage Distribution Groups and Groups in Exchange Online and SharePoint Online.
 
 
 
@@ -1243,7 +1261,7 @@ For more information about how to create or modify Exchange Online or Exchange S
 
 
 Install new student devices

            
-Follow the same steps described in the [Deploy Windows 10 to devices](#deploy-windows-10-to-devices) section.
+Follow the same steps described in the Deploy Windows 10 to devices section.
 
 
 
@@ -1254,14 +1272,14 @@ Follow the same steps described in the [Deploy Windows 10 to devices](#deploy-wi
 
 
 
            
+
 ### Summary
 
 Now, you have identified the tasks you need to perform monthly, at the end of an academic year or semester, and as required. Your school configuration should match the typical school configuration that you saw in the [Plan a typical school configuration](#plan-a-typical-school-configuration) section. By performing these maintenance tasks you help ensure that your school stays secure and is configured as you specified. 
 
-##Related resources
+## Related resources
 
            
-
diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md
index 82c72e22f5..1f3bcffff3 100644
--- a/education/windows/edu-deployment-recommendations.md
+++ b/education/windows/edu-deployment-recommendations.md
@@ -5,9 +5,11 @@ keywords: Windows 10 deployment, recommendations, privacy settings, school
 ms.mktglfcycl: plan
 ms.sitesec: library
 ms.localizationpriority: medium
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 10/13/2017
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ---
 
@@ -89,19 +91,19 @@ If the school allows the use of personal or Microsoft account in addition to org
 Skype uses the user’s contact details to deliver important information about the account and it also lets friends find each other on Skype.
 
 To manage and edit your profile in the Skype UWP app, follow these steps:
-1.	In the Skype UWP app, select the user profile icon ![Skype profile icon](images/skype_uwp_userprofile_icon.png)  to go to the user’s profile page.
-2.	In the account page, select **Manage account** for the Skype account that you want to change. This will take you to the online Skype portal.
-3.	In the online Skype portal, scroll down to the **Account details** section. In **Settings and preferences**, click **Edit profile**.
+1. In the Skype UWP app, select the user profile icon ![Skype profile icon](images/skype_uwp_userprofile_icon.png)  to go to the user’s profile page.
+2. In the account page, select **Manage account** for the Skype account that you want to change. This will take you to the online Skype portal.
+3. In the online Skype portal, scroll down to the **Account details** section. In **Settings and preferences**, click **Edit profile**.
 
-    The profile page includes these sections:
+   The profile page includes these sections:
 
-        * Personal information
-        * Contact details
-        * Profile settings
+       * Personal information
+       * Contact details
+       * Profile settings
 
 4. Review the information in each section and click **Edit profile** in either or both the **Personal information** and **Contact details** sections to change the information being shared. You can also remove the checks in the **Profile settings** section to change settings on discoverability, notifications, and staying in touch.
-5.	If you do not wish the name to be included, edit the fields and replace the fields with **XXX**.
-6.	To change the profile picture, go to the Skype app and click on the current profile picture or avatar. The **Manage Profile Picture** window pops up.
+5. If you do not wish the name to be included, edit the fields and replace the fields with **XXX**.
+6. To change the profile picture, go to the Skype app and click on the current profile picture or avatar. The **Manage Profile Picture** window pops up.
 
    ![Skype profile icon](images/skype_uwp_manageprofilepic.png)
 
@@ -121,10 +123,10 @@ If you want to delete either (or both) the Skype and the Xbox accounts, here’s
 To delete a Skype account, you can follow the instructions here: [How do I close my Skype account?](https://go.microsoft.com/fwlink/?LinkId=816515)
 
 If you need help deleting the account, you can contact Skype customer service by going to the [Skype support request page](https://go.microsoft.com/fwlink/?LinkId=816519). You may need to sign in and specify a Skype account. Once you’ve signed in, you can:
-1.	Select a help topic (**Account and Password**)
-2.	Select a related problem (**Deleting an account**)
-3.	Click **Next**.
-4.	Select a contact method to get answers to your questions.
+1. Select a help topic (**Account and Password**)
+2. Select a related problem (**Deleting an account**)
+3. Click **Next**.
+4. Select a contact method to get answers to your questions.
 
 
 #### Xbox
diff --git a/education/windows/education-scenarios-store-for-business.md b/education/windows/education-scenarios-store-for-business.md
index af93be32ee..3149237ba1 100644
--- a/education/windows/education-scenarios-store-for-business.md
+++ b/education/windows/education-scenarios-store-for-business.md
@@ -6,11 +6,13 @@ ms.prod: w10
 ms.mktglfcycl: plan
 ms.sitesec: library
 ms.localizationpriority: medium
-searchScope:
+searchScope: 
   - Store
-author: trudyha
-ms.author: trudyha
+author: dansimp
+ms.author: dansimp
 ms.date: 03/30/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Working with Microsoft Store for Education
@@ -128,7 +130,7 @@ Teachers can:
  
 ## Distribute apps
 
-Manage and distribute apps to students and others in your organization. Different options are avaialble for admins and teachers. 
+Manage and distribute apps to students and others in your organization. Different options are available for admins and teachers. 
 
 Applies to: IT admins
 
@@ -172,4 +174,4 @@ You can manage your orders through Microsoft Store for Business. For info on ord
 It can take up to 24 hours after a purchase, before a receipt is available on your **Order history page**. 
 
 > [!NOTE]
-For **Minecraft: Education Edition**, you can request a refund through Microsoft Store for Business for two months from the purchase date. After two months, refunds require a support call. 
\ No newline at end of file
+> For **Minecraft: Education Edition**, you can request a refund through Microsoft Store for Business for two months from the purchase date. After two months, refunds require a support call. 
diff --git a/education/windows/enable-s-mode-on-surface-go-devices.md b/education/windows/enable-s-mode-on-surface-go-devices.md
index f58a24b82c..0b7fc8c617 100644
--- a/education/windows/enable-s-mode-on-surface-go-devices.md
+++ b/education/windows/enable-s-mode-on-surface-go-devices.md
@@ -7,9 +7,11 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: edu
 ms.localizationpriority: medium
-author: kaushika-msft
-ms.author: kaushik
+author: dansimp
+ms.author: dansimp
 ms.date: 07/30/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Surface Go for Education - Enabling S mode
@@ -34,30 +36,30 @@ Here are some things you’ll need before attempting any of these procedures:
 Like enterprise administrators performing large-scale deployment of customized Windows images, education customers can create their own customized Windows images for deployment to multiple classroom devices. An education customer who plans to follow [a traditional image-based deployment
 process](https://docs.microsoft.com/windows/deployment/windows-10-deployment-scenarios#traditional-deployment) using a Windows 10 Pro (1803) image for Surface Go devices can enable S mode as follows:
 
-1.  Use DISM to mount your offline Windows 10 Pro (1803) image.
+1. Use DISM to mount your offline Windows 10 Pro (1803) image.
 
    ```
    dism /Mount-image /imagefile:\ {/Index:\ | /Name:\} /MountDir:\
    ```
 
-2.  Create an unattend.xml answer file, adding the
-    amd64_Microsoft_Windows_CodeIntegrity component to Pass 2 offline Servicing
-    and setting amd64_Microsoft_Windows_CodeIntegrity\\SkuPolicyRequired to “1”.
-    The resulting xml should look like this…
+2. Create an unattend.xml answer file, adding the
+   amd64_Microsoft_Windows_CodeIntegrity component to Pass 2 offline Servicing
+   and setting amd64_Microsoft_Windows_CodeIntegrity\\SkuPolicyRequired to “1”.
+   The resulting xml should look like this…
 
    Copy
    ```
-    
-     
-         1
-      
-     
+   
+    
+        1
+     
+    
    ```
 3. Save the answer file in the **Windows\Panther** folder of your mounted image as unattend.xml.
 4. Use DISM to apply the unattend.xml file and enable S Mode:
@@ -75,7 +77,7 @@ process](https://docs.microsoft.com/windows/deployment/windows-10-deployment-sce
       ```
          dism /Unmount-image /MountDir:C:\\mount /Commit
       ```
->Note: don’t forget the /Commit parameter to ensure you don’t lose your
+   >Note: don’t forget the /Commit parameter to ensure you don’t lose your
     changes.
 
 Your Windows 10 Pro (1803) image now has S mode enabled and is ready to deploy to Surface Go devices.
diff --git a/education/windows/get-minecraft-device-promotion.md b/education/windows/get-minecraft-device-promotion.md
index d0b001b4b7..bafc4ed6ae 100644
--- a/education/windows/get-minecraft-device-promotion.md
+++ b/education/windows/get-minecraft-device-promotion.md
@@ -6,11 +6,13 @@ ms.prod: w10
 ms.mktglfcycl: plan
 ms.sitesec: library
 ms.localizationpriority: medium
-author: trudyha
-searchScope:
+author: dansimp
+searchScope: 
   - Store
-ms.author: trudyha
+ms.author: dansimp
 ms.date: 06/05/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Get Minecraft: Education Edition with Windows 10 device promotion
@@ -54,7 +56,7 @@ After that, we’ll add the appropriate number of Minecraft: Education Edition l
 **To redeem Minecraft: Education Edition licenses**
 1. Visit [Minecraft: Education Edition and Windows 10 device promotion](https://educationstore.microsoft.com/store/mee-device-promo?setflight=wsfb_devicepromo) in **Microsoft Store for Education**. 
 
-     ![Minecraft: Education Edition page in Microsoft Store for Education. ](images/get-mcee-promo.png)
+     ![Minecraft: Education Edition page in Microsoft Store for Education.](images/get-mcee-promo.png)
      
 2. Sign in to **Microsoft Store for Education** using a school account. If you don’t have one, we’ll help you set one up. 
            
 -or-
@@ -64,7 +66,7 @@ After that, we’ll add the appropriate number of Minecraft: Education Edition l
     
 3. **On Minecraft Windows 10 device special offer**, click **Submit a device purchase**. 
 
-    ![Windows 10 device special offer page for Minecraft: Education Edition. Submit a device purchase is highlighted to show customers how to submit info about the devices you purchased. ](images/mcee-benefits.png)
+    ![Windows 10 device special offer page for Minecraft: Education Edition. Submit a device purchase is highlighted to show customers how to submit info about the devices you purchased.](images/mcee-benefits.png)
     
 4. Provide info for **Proof of Purchase**. Be sure to include a .pdf or .jpg of your invoice, and then click **Next**.
 
@@ -85,4 +87,4 @@ After that, we’ll add the appropriate number of Minecraft: Education Edition l
 Teachers or admins can distribute the licenses:
 - [Learn how teachers can distribute **Minecraft: Education Edition**](teacher-get-minecraft.md#distribute-minecraft)
 - [Learn how IT administrators can distribute **Minecraft: Education Edition**](school-get-minecraft.md#distribute-minecraft)
--->
\ No newline at end of file
+-->
diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md
index 2f77a266c0..7037b5ce14 100644
--- a/education/windows/get-minecraft-for-education.md
+++ b/education/windows/get-minecraft-for-education.md
@@ -6,11 +6,13 @@ ms.prod: w10
 ms.mktglfcycl: plan
 ms.sitesec: library
 ms.localizationpriority: medium
-author: trudyha
-searchScope:
+author: dansimp
+searchScope: 
   - Store
-ms.author: trudyha
+ms.author: dansimp
 ms.date: 01/29/2019
+ms.reviewer: 
+manager: dansimp
 ms.topic: conceptual
 ---
 
@@ -33,9 +35,9 @@ Teachers and IT administrators can now get early access to **Minecraft: Educatio
  
 - **Minecraft: Education Edition** requires Windows 10.
 - Trials or subscriptions of **Minecraft: Education Edition** are offered to education tenants that are managed by Azure Active Directory (Azure AD).
-    - If your school doesn't have an Azure AD tenant, the [IT administrator can set one up](school-get-minecraft.md) as part of the process of getting **Minecraft: Education Edition**.
-    * Office 365 Education, which includes online versions of Office apps plus 1 TB online storage. [Sign up your school for Office 365 Education.](https://products.office.com/academic/office-365-education-plan)
-    * If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/library/windows/hardware/mt703369%28v=vs.85%29.aspx)
+  - If your school doesn't have an Azure AD tenant, the [IT administrator can set one up](school-get-minecraft.md) as part of the process of getting **Minecraft: Education Edition**.
+  - Office 365 Education, which includes online versions of Office apps plus 1 TB online storage. [Sign up your school for Office 365 Education.](https://products.office.com/academic/office-365-education-plan)
+  - If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](https://msdn.microsoft.com/library/windows/hardware/mt703369%28v=vs.85%29.aspx)
 
  
 
diff --git a/education/windows/index.md b/education/windows/index.md
index d30a753c88..b40b009575 100644
--- a/education/windows/index.md
+++ b/education/windows/index.md
@@ -7,8 +7,8 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: edu
 ms.localizationpriority: medium
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 10/13/2017
 ---
 
@@ -18,28 +18,28 @@ ms.date: 10/13/2017
 
 ## ![Learn more about Windows](images/education.png) Learn
 
-
            [Windows 10 editions for education customers](windows-editions-for-education-customers.md)
            Windows 10, version 1607 introduces two editions designed for the unique needs of K-12 institutions: Windows 10 Pro Education and Windows 10 Education. These editions provide education-specific default settings for the evolving landscape in K-12 education IT environments.
            
-
            [Compare each Windows edition](https://www.microsoft.com/en-us/WindowsForBusiness/Compare)
            Find out more about the features and functionality we support in each edition of Windows.
            
-
            [Get Windows 10 Education or Windows 10 Pro Education](https://www.microsoft.com/en-us/education/buy-license/overview-of-how-to-buy/default.aspx?tabshow=schools)
            When you've made your decision, find out how to buy Windows for your school.
            
+
            Windows 10 editions for education customers
            Windows 10, version 1607 introduces two editions designed for the unique needs of K-12 institutions: Windows 10 Pro Education and Windows 10 Education. These editions provide education-specific default settings for the evolving landscape in K-12 education IT environments.
            
+
            Compare each Windows edition
            Find out more about the features and functionality we support in each edition of Windows.
            
+
            Get Windows 10 Education or Windows 10 Pro Education
            When you've made your decision, find out how to buy Windows for your school.
            
 
 ## ![Plan for Windows 10 in your school](images/clipboard.png) Plan
 
-
            [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md)
            Provides guidance on ways to customize the OS diagnostic data, consumer experiences, Cortana, search, as well as some of the preinstalled apps, so that Windows is ready for your school.
            
-
            [Deployment recommendations for school IT administrators](edu-deployment-recommendations.md)
            Learn how to customize the OS privacy settings, Skype, and Xbox for Windows-based devices used in schools so that you can choose what information is shared with Microsoft.
            
-[Get Minecraft Education Edition](get-minecraft-for-education.md)
            Minecraft Education Edition is built for learning. Learn how to get early access and add it to your Microsoft Store for Business for distribution.
            
-
            [Take tests in Windows 10](take-tests-in-windows-10.md)
            Take a Test is a new app that lets you create the right environment for taking tests. Learn how to use and get it set up.
            
-
            [Chromebook migration guide](chromebook-migration-guide.md)
            Find out how you can migrate a Chromebook-based learning environment to a Windows 10-based learning environment.
            
+
            Windows 10 configuration recommendations for education customers
            Provides guidance on ways to customize the OS diagnostic data, consumer experiences, Cortana, search, as well as some of the preinstalled apps, so that Windows is ready for your school.
            
+
            Deployment recommendations for school IT administrators
            Learn how to customize the OS privacy settings, Skype, and Xbox for Windows-based devices used in schools so that you can choose what information is shared with Microsoft.
            
+Get Minecraft Education Edition
            Minecraft Education Edition is built for learning. Learn how to get early access and add it to your Microsoft Store for Business for distribution.
            
+
            Take tests in Windows 10
            Take a Test is a new app that lets you create the right environment for taking tests. Learn how to use and get it set up.
            
+
            Chromebook migration guide
            Find out how you can migrate a Chromebook-based learning environment to a Windows 10-based learning environment.
            
 
 ## ![Deploy Windows 10 for Education](images/PCicon.png) Deploy
 
-
            [Set up Windows devices for education](set-up-windows-10.md)
            Depending on your school's device management needs, you can use the Set up School PCs app or the Windows Configuration Designer tool to quickly set up student PCs.
            
-
            [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
            Get step-by-step guidance to help you deploy Windows 10 in a school environment.
            
-
            [Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md)
            Get step-by-step guidance on how to deploy Windows 10 to PCs and devices across a school district.
            
-
            [Test Windows 10 S on existing Windows 10 education devices](test-windows10s-for-edu.md)
            Test Windows 10 S on a variety of Windows 10 devices (except Windows 10 Home) in your school and share your feedback with us.
            
+
            Set up Windows devices for education
            Depending on your school's device management needs, you can use the Set up School PCs app or the Windows Configuration Designer tool to quickly set up student PCs.
            
+
            Deploy Windows 10 in a school
            Get step-by-step guidance to help you deploy Windows 10 in a school environment.
            
+
            Deploy Windows 10 in a school district
            Get step-by-step guidance on how to deploy Windows 10 to PCs and devices across a school district.
            
+
            Test Windows 10 S on existing Windows 10 education devices
            Test Windows 10 S on a variety of Windows 10 devices (except Windows 10 Home) in your school and share your feedback with us.
            
 
 ## ![Switch to Windows 10 for Education](images/windows.png) Switch
 
-
            [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md)
            If you have an education tenant and use Windows 10 Pro or Windows 10 S in your schools, find out how you can opt-in to a free switch to Windows 10 Pro Education.
            
+
            Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S
            If you have an education tenant and use Windows 10 Pro or Windows 10 S in your schools, find out how you can opt-in to a free switch to Windows 10 Pro Education.
            
 
 
 ## Windows 8.1
diff --git a/education/windows/s-mode-switch-to-edu.md b/education/windows/s-mode-switch-to-edu.md
index 363cc0b93e..4860249e19 100644
--- a/education/windows/s-mode-switch-to-edu.md
+++ b/education/windows/s-mode-switch-to-edu.md
@@ -1,6 +1,6 @@
 ---
 title: Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode
-description: Switching out of Windows 10 Pro in S mode to Windows 10 Pro Education in S mode. The S mode switch documentation describes the requirements and process for Switching to Windows 10 Pro Education in S mode. 
+description: Switching out of Windows 10 Pro in S mode to Windows 10 Pro Education in S mode. The S mode switch documentation describes the requirements and process for Switching to Windows 10 Pro Education in S mode.
 keywords: Windows 10 S switch, S mode Switch, switch in S mode, Switch S mode, Windows 10 Pro Education in S mode, S mode, system requirements, Overview, Windows 10 Pro in S mode, Education, EDU
 ms.mktglfcycl: deploy
 ms.localizationpriority: medium
@@ -8,7 +8,10 @@ ms.prod: w10
 ms.sitesec: library
 ms.pagetype: edu
 ms.date: 12/03/2018
-author: jaimeo
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
+author: dansimp
 ---
 
 # Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode
@@ -39,7 +42,7 @@ S mode is an enhanced security mode of Windows 10 – streamlined for security a
 |Credential Guard | | | | X |
 |Device Guard | | | | X |
 
-###  Windows 10 in S mode is safe, secure, and fast.  
+### Windows 10 in S mode is safe, secure, and fast.  
 However, in some limited scenarios, you might need to switch to Windows 10 Education. You can switch devices running Windows 10, version 1709 or later. Use the following information to switch to Windows 10 Pro through the Microsoft Store. 
 
 ## How to switch
@@ -68,4 +71,4 @@ Tenant-wide Windows 10 Pro > Pro Education
 [FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)
            
 [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md)
             
 [Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md) 
            
-[Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare)
\ No newline at end of file
+[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md
index 1437894aa9..515bfff44f 100644
--- a/education/windows/school-get-minecraft.md
+++ b/education/windows/school-get-minecraft.md
@@ -6,11 +6,13 @@ ms.prod: w10
 ms.mktglfcycl: plan
 ms.sitesec: library
 ms.localizationpriority: medium
-author: trudyha
-searchScope:
+author: dansimp
+searchScope: 
   - Store
-ms.author: trudyha
+ms.author: dansimp
 ms.date: 01/30/2019
+ms.reviewer: 
+manager: dansimp
 ms.topic: conceptual
 ---
 
@@ -115,7 +117,7 @@ After you've finished the purchase, you can find your invoice by checking **Mine
 
 4. On **Invoice Bills**, click the invoice number to view and download your invoice. It downloads as a .pdf.
 
-  ![Minecraft: Education Edition app details page with view bills link highlighted](images/mcee-invoice-bills.png)
+   ![Minecraft: Education Edition app details page with view bills link highlighted](images/mcee-invoice-bills.png)
 
 The **Payment Instructions** section on the first page of the invoice has information on invoice amount, due date, and how to pay with electronic funds transfer, or with a check. 
 
@@ -154,7 +156,7 @@ For Minecraft: Education Edition, you can use auto assign subscription to contro
      
     ![Minecraft Education Edition product page with auto assign control highlighted.](images/mcee-auto-assign-legacy.png)
  
- -Or-
+   -Or-
  
     ![Minecraft Education Edition product page with auto assign control highlighted.](images/mcee-auto-assign-bd.png)
     
diff --git a/education/windows/set-up-school-pcs-azure-ad-join.md b/education/windows/set-up-school-pcs-azure-ad-join.md
index 98cc4a6b9c..6d62b6bb55 100644
--- a/education/windows/set-up-school-pcs-azure-ad-join.md
+++ b/education/windows/set-up-school-pcs-azure-ad-join.md
@@ -1,20 +1,22 @@
----  
-title: Azure AD Join with Set up School PCs app  
-description: Describes how Azure AD Join is configured in the Set up School PCs app.  
-keywords: shared cart, shared PC, school, set up school pcs  
-ms.prod: w10  
-ms.mktglfcycl: plan  
-ms.sitesec: library  
-ms.pagetype: edu  
-ms.localizationpriority: medium  
-author: lenewsad  
-ms.author: lanewsad  
+---
+title: Azure AD Join with Set up School PCs app
+description: Describes how Azure AD Join is configured in the Set up School PCs app.
+keywords: shared cart, shared PC, school, set up school pcs
+ms.prod: w10
+ms.mktglfcycl: plan
+ms.sitesec: library
+ms.pagetype: edu
+ms.localizationpriority: medium
+author: dansimp
+ms.author: dansimp
 ms.date: 01/11/2019
+ms.reviewer: 
+manager: dansimp
 ---  
 
 # Azure AD Join for school PCs  
 
->   [!NOTE]  
+> [!NOTE]
 >   Set up School PCs app uses Azure AD Join to configure PCs. The app is helpful if you use the cloud based directory, Azure Active Directory (AD). If your organization uses Active Directory or requires no account to connect, install and use [Windows Configuration
 >   Designer](set-up-students-pcs-to-join-domain.md) to 
 >   join your PCs to your school's domain.
diff --git a/education/windows/set-up-school-pcs-provisioning-package.md b/education/windows/set-up-school-pcs-provisioning-package.md
index 030e698372..12bbf4fc89 100644
--- a/education/windows/set-up-school-pcs-provisioning-package.md
+++ b/education/windows/set-up-school-pcs-provisioning-package.md
@@ -1,15 +1,17 @@
----  
-title: What's in Set up School PCs provisioning package  
-description: Lists the provisioning package settings that are configured in the Set up School PCs app.  
-keywords: shared cart, shared PC, school, set up school pcs  
-ms.prod: w10  
-ms.mktglfcycl: plan  
-ms.sitesec: library  
-ms.pagetype: edu  
-ms.localizationpriority: medium  
-author: lenewsad  
-ms.author: lanewsad  
-ms.date: 10/17/2018  
+---
+title: What's in Set up School PCs provisioning package
+description: Lists the provisioning package settings that are configured in the Set up School PCs app.
+keywords: shared cart, shared PC, school, set up school pcs
+ms.prod: w10
+ms.mktglfcycl: plan
+ms.sitesec: library
+ms.pagetype: edu
+ms.localizationpriority: medium
+author: dansimp
+ms.author: dansimp
+ms.date: 10/17/2018
+ms.reviewer: 
+manager: dansimp
 ---  
 
 # What's in my provisioning package?
@@ -52,34 +54,34 @@ This section lists only the MDM and local group policies that are configured uni
 For a more detailed look of each policy listed, see [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) in the Windows IT Pro Center documentation.  
 
 
-|Policy name  |Default value |Description |
-|---------|---------|---------|
-|Authority|User-defined  | Authenticates the admin user. Value is set automatically when signed in to Azure AD.
-|BPRT|User-defined| Value is set automatically when signed in to Azure AD. Allows you to create the provisioning package. |
-|WLAN Setting| XML is generated from the Wi-Fi profile in the Set up School PCs app.| Configures settings for wireless connectivity.| 
-|Hide OOBE for desktop| True | Hides the interactive OOBE flow for Windows 10.|
-|Download Mode|1 - HTTP blended with peering behind the same NAT|Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps, and App updates|
-|Select when Preview Builds and Feature Updates are received | 32 - Semi-annual Channel. Device gets feature updates from Semi-annual Channel| Specifies how frequently devices receive preview builds and feature updates.|  
-|Allow auto update   | 4 - Auto-installs and restarts without device-user control    |  When an auto update is available, it auto-installs and restarts the device without any input or action from the device user.|
-|Configure automatic updates  | 3 - Set to install at 3am    |  Scheduled time to install updates.|
-|Update power policy for cart restarts   | 1 - Configured| Skips all restart checks to ensure that the reboot will happen at the scheduled install time. |  
-|Select when Preview Builds and Feature Updates are received   | 365 days | Defers Feature Updates for the specified number of days. When not specified, defaults to 365 days.|  
-|Allow all trusted apps |   Disabled      | Prevents untrusted apps from being installed to device        |
-|Allow developer unlock  |   Disabled     | Students cannot unlock the PC and use it in developer mode          |
-|Allow Cortana | Disabled | Cortana is not allowed on the device.
-|Allow manual MDM unenrollment   | Disabled          |   Students cannot remove the mobile device manager from their device.     |
-|Settings page visibility|Enabled |Specific pages in the System Settings app are not visible or accessible to students.|
-|Allow add provisioning package  |  Disabled         | Students cannot add and upload new provisioning packages to their device.        |
-|Allow remove provisioning package   | Disabled       | Students cannot remove packages that you've uploaded to their device, including the Set up School PCs app        |
-|Start Layout|Enabled |Lets you specify the Start layout for users and prevents them from changing the configuration.|
-|Import Edge Assets| Enabled| Import Microsoft Edge assets, such as PNG and JPG files, for secondary tiles on the Start layout. Tiles will appear as weblinks and will be tied to the relevant image asset files.|  
-|Allow pinned folder downloads|1 - The shortcut is visible and disables the setting in the Settings app |Makes the Downloads shortcut on the Start menu visible to students.|
-|Allow pinned folder File Explorer|1 - The shortcut is visible and disables the setting in the Settings app |Makes the File Explorer shortcut on the Start menu visible to students.|
-|Personalization  |     Deploy lock screen image  | Set to the image you picked when you customized the lock screen during device setup. If you didn't customize the image, the computer will show the default.     | Deploys a jpg, jpeg, or png image to be used as lock screen image on the device.
-|Personalization| Lock screen image URL| Image filename| You can specify a jpg, jpeg, or png image to be used as the device lock screen image. This setting can take an http or https URL to a remote image to be downloaded, or a file URLto an existing local image. 
-|Update|Active hours end    | 5 PM       | There will be no update reboots before this time.        |
-|Update|Active hours start     |  7 AM     |  There will be no update reboots after this time.      |    
-|Updates Windows    |  Nightly       |  Sets Windows to update on a nightly basis.       |  
+|                         Policy name                         |                                 Default value                                  |                                                                                     Description                                                                                     |
+|-------------------------------------------------------------|--------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+|                          Authority                          |                                  User-defined                                  |                                                Authenticates the admin user. Value is set automatically when signed in to Azure AD.                                                 |
+|                            BPRT                             |                                  User-defined                                  |                                        Value is set automatically when signed in to Azure AD. Allows you to create the provisioning package.                                        |
+|                        WLAN Setting                         |     XML is generated from the Wi-Fi profile in the Set up School PCs app.      |                                                                   Configures settings for wireless connectivity.                                                                    |
+|                    Hide OOBE for desktop                    |                                      True                                      |                                                                   Hides the interactive OOBE flow for Windows 10.                                                                   |
+|                        Download Mode                        |               1 - HTTP blended with peering behind the same NAT                |                               Specifies the download method that Delivery Optimization can use in downloads of Windows Updates, Apps, and App updates                               |
+| Select when Preview Builds and Feature Updates are received | 32 - Semi-annual Channel. Device gets feature updates from Semi-annual Channel |                                                    Specifies how frequently devices receive preview builds and feature updates.                                                     |
+|                      Allow auto update                      |           4 - Auto-installs and restarts without device-user control           |                            When an auto update is available, it auto-installs and restarts the device without any input or action from the device user.                             |
+|                 Configure automatic updates                 |                           3 - Set to install at 3am                            |                                                                         Scheduled time to install updates.                                                                          |
+|            Update power policy for cart restarts            |                                 1 - Configured                                 |                                            Skips all restart checks to ensure that the reboot will happen at the scheduled install time.                                            |
+| Select when Preview Builds and Feature Updates are received |                                    365 days                                    |                                         Defers Feature Updates for the specified number of days. When not specified, defaults to 365 days.                                          |
+|                   Allow all trusted apps                    |                                    Disabled                                    |                                                               Prevents untrusted apps from being installed to device                                                                |
+|                   Allow developer unlock                    |                                    Disabled                                    |                                                             Students cannot unlock the PC and use it in developer mode                                                              |
+|                        Allow Cortana                        |                                    Disabled                                    |                                                                        Cortana is not allowed on the device.                                                                        |
+|                Allow manual MDM unenrollment                |                                    Disabled                                    |                                                         Students cannot remove the mobile device manager from their device.                                                         |
+|                  Settings page visibility                   |                                    Enabled                                     |                                                Specific pages in the System Settings app are not visible or accessible to students.                                                 |
+|               Allow add provisioning package                |                                    Disabled                                    |                                                      Students cannot add and upload new provisioning packages to their device.                                                      |
+|              Allow remove provisioning package              |                                    Disabled                                    |                                      Students cannot remove packages that you've uploaded to their device, including the Set up School PCs app                                      |
+|                        Start Layout                         |                                    Enabled                                     |                                           Lets you specify the Start layout for users and prevents them from changing the configuration.                                            |
+|                     Import Edge Assets                      |                                    Enabled                                     | Import Microsoft Edge assets, such as PNG and JPG files, for secondary tiles on the Start layout. Tiles will appear as weblinks and will be tied to the relevant image asset files. |
+|                Allow pinned folder downloads                |    1 - The shortcut is visible and disables the setting in the Settings app    |                                                         Makes the Downloads shortcut on the Start menu visible to students.                                                         |
+|              Allow pinned folder File Explorer              |    1 - The shortcut is visible and disables the setting in the Settings app    |                                                       Makes the File Explorer shortcut on the Start menu visible to students.                                                       |
+|                       Personalization                       |                            Deploy lock screen image                            |             Set to the image you picked when you customized the lock screen during device setup. If you didn't customize the image, the computer will show the default.             |
+|                       Personalization                       |                             Lock screen image URL                              |                                                                                   Image filename                                                                                    |
+|                           Update                            |                                Active hours end                                |                                                                                        5 PM                                                                                         |
+|                           Update                            |                               Active hours start                               |                                                                                        7 AM                                                                                         |
+|                       Updates Windows                       |                                    Nightly                                     |                                                                     Sets Windows to update on a nightly basis.                                                                      |
 
 ## Apps uninstalled from Windows 10 devices
 Set up School PCs app uses the Universal app uninstall policy. This policy identifies default apps that are not relevant to the classroom experience, and uninstalls them from each device.  ALl apps uninstalled from Windows 10 devices include:  
diff --git a/education/windows/set-up-school-pcs-shared-pc-mode.md b/education/windows/set-up-school-pcs-shared-pc-mode.md
index 3b3a9148a0..2ac3eb11d0 100644
--- a/education/windows/set-up-school-pcs-shared-pc-mode.md
+++ b/education/windows/set-up-school-pcs-shared-pc-mode.md
@@ -1,15 +1,17 @@
----  
-title: Shared PC mode for school devices  
-description: Describes how shared PC mode is set for devices set up with the Set up School PCs app.  
-keywords: shared cart, shared PC, school, set up school pcs  
-ms.prod: w10  
-ms.mktglfcycl: plan  
-ms.sitesec: library  
-ms.pagetype: edu  
-ms.localizationpriority: medium  
-author: lenewsad  
-ms.author: lanewsad  
-ms.date: 07/13/2018  
+---
+title: Shared PC mode for school devices
+description: Describes how shared PC mode is set for devices set up with the Set up School PCs app.
+keywords: shared cart, shared PC, school, set up school pcs
+ms.prod: w10
+ms.mktglfcycl: plan
+ms.sitesec: library
+ms.pagetype: edu
+ms.localizationpriority: medium
+author: dansimp
+ms.author: dansimp
+ms.date: 07/13/2018
+ms.reviewer: 
+manager: dansimp
 ---  
 
 # Shared PC mode for school devices
diff --git a/education/windows/set-up-school-pcs-technical.md b/education/windows/set-up-school-pcs-technical.md
index 957af5e711..67c378fb9f 100644
--- a/education/windows/set-up-school-pcs-technical.md
+++ b/education/windows/set-up-school-pcs-technical.md
@@ -1,82 +1,84 @@
----
-title: Set up School PCs app technical reference overview
-description: Describes the purpose of the Set up School PCs app for Windows 10 devices.
-keywords: shared cart, shared PC, school, set up school pcs
-ms.prod: w10
-ms.mktglfcycl: plan
-ms.sitesec: library
-ms.pagetype: edu
-ms.localizationpriority: medium
-author: lenewsad
-ms.author: lanewsad
-ms.date: 07/11/2018
----
-
-What is Set up School PCs?
-=================================================
-
-**Applies to:**
-
--   Windows 10
-
-The **Set up School PCs** app helps you configure new Windows 10 PCs for school use. The
-app, which is available for Windows 10 version 1703 and later, configures and saves
-school-optimized settings, apps, and policies into a single provisioning package. You can then save the package to a USB drive and distribute it to your school PCs. 
-
-If your school uses Azure Active Directory (Azure AD) or Office 365, the Set up
-School PCs app will create a setup file. This file joins the PC to your Azure Active Directory tenant. The app also helps set up PCs for use with or without Internet connectivity.  
-
-
-## Join PC to Azure Active Directory
-If your school uses Azure Active Directory (Azure AD) or Office 365, the Set up
-School PCs app creates a setup file that joins your PC to your Azure Active
-Directory tenant. 
-
-The app also helps set up PCs for use with or without Internet connectivity.
-
-## List of Set up School PCs features
-The following table describes the Set up School PCs app features and lists each type of Intune subscription. An X indicates that the feature is available with the specific subscription.
-
-| Feature                                                                                                                                                                                                                                                               | No Internet | Azure AD | Office 365 | Azure AD Premium |
-|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------|----------|------------|------------------|
-| **Fast sign-in**                                                                                                                                                                                                                                                      | X           | X        | X          | X                |
-| Students sign in and start using the computer in under a minute, even on initial sign-in.                                                                                                                                                             |             |          |            |                  |
-| **Custom Start experience**                                                                                                                                                                                                                                           | X           | X        | X          | X                |
-| Necessary classroom apps are pinned to Start and unnecessary apps are removed.                                                                                                                                                                                         |             |          |            |                  |
-| **Guest account, no sign-in required**                                                                                                                                                                                                                                | X           | X        | X          | X                |
-| Set up computers for use by anyone with or without an account.                                                                                                                                                                         |             |          |            |                  |
-| **School policies**                                                                                                                                                                                                                                                   | X           | X        | X          | X                |
-| Settings create a relevant, useful learning environment and optimal computer performance.                                                                                                                                                                |             |          |            |                  |
-| **Azure AD Join**                                                                                                                                                                                                                                                     |             | X        | X          | X                |
-| Computers join with your existing Azure AD or Office 365 subscription for centralized management.                                                                                                                                                                      |             |          |            |                  |
-| **Single sign-on to Office 365**                                                                                                                                                                                                                                      |             |          | X          | X                |
-| Students sign in with their IDs to access all Office 365 web apps or installed Office apps.                                                                                                                                                            |             |          |            |                  |
-| **Take a Test app**                                                                                                                                                                                                                                                     |             |          |            | X                |
-| Administer quizzes and assessments through test providers such as Smarter Balanced.                                                                                                                                      |             |          |            |                  |
-| [Settings roaming](https://azure.microsoft.com/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) **via Azure AD**                                                                                                             |             |          |            | X                |
-| Synchronize student and application data across devices for a personalized experience.                                                                                                                                                          |             |          |            |                  |
-
->   [!NOTE]  
->   If your school uses Active Directory, use [Windows Configuration
->   Designer](set-up-students-pcs-to-join-domain.md) 
->   to configure your PCs to join the domain. You can only use the Set up School
->   PCs app to set up PCs that are connected to Azure AD.
-
-
-
-## Next steps  
-Learn more about setting up devices with the Set up School PCs app.  
-* [Azure AD Join with Set up School PCs](set-up-school-pcs-azure-ad-join.md)
-* [Shared PC mode for schools](set-up-school-pcs-shared-pc-mode.md)
-* [What's in my provisioning package](set-up-school-pcs-provisioning-package.md)
-* [Set up Windows 10 devices for education](set-up-windows-10.md) 
-
-When you're ready to create and apply your provisioning package, see [Use Set up School PCs app](use-set-up-school-pcs-app.md).
-
-
-
-
-
-
-
-
+---
+title: Set up School PCs app technical reference overview
+description: Describes the purpose of the Set up School PCs app for Windows 10 devices.
+keywords: shared cart, shared PC, school, set up school pcs
+ms.prod: w10
+ms.mktglfcycl: plan
+ms.sitesec: library
+ms.pagetype: edu
+ms.localizationpriority: medium
+author: dansimp
+ms.author: dansimp
+ms.date: 07/11/2018
+ms.reviewer: 
+manager: dansimp
+---
+
+What is Set up School PCs?
+=================================================
+
+**Applies to:**
+
+-   Windows 10
+
+The **Set up School PCs** app helps you configure new Windows 10 PCs for school use. The
+app, which is available for Windows 10 version 1703 and later, configures and saves
+school-optimized settings, apps, and policies into a single provisioning package. You can then save the package to a USB drive and distribute it to your school PCs. 
+
+If your school uses Azure Active Directory (Azure AD) or Office 365, the Set up
+School PCs app will create a setup file. This file joins the PC to your Azure Active Directory tenant. The app also helps set up PCs for use with or without Internet connectivity.  
+
+
+## Join PC to Azure Active Directory
+If your school uses Azure Active Directory (Azure AD) or Office 365, the Set up
+School PCs app creates a setup file that joins your PC to your Azure Active
+Directory tenant. 
+
+The app also helps set up PCs for use with or without Internet connectivity.
+
+## List of Set up School PCs features
+The following table describes the Set up School PCs app features and lists each type of Intune subscription. An X indicates that the feature is available with the specific subscription.
+
+| Feature                                                                                                                                                                                                                                                               | No Internet | Azure AD | Office 365 | Azure AD Premium |
+|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------|----------|------------|------------------|
+| **Fast sign-in**                                                                                                                                                                                                                                                      | X           | X        | X          | X                |
+| Students sign in and start using the computer in under a minute, even on initial sign-in.                                                                                                                                                             |             |          |            |                  |
+| **Custom Start experience**                                                                                                                                                                                                                                           | X           | X        | X          | X                |
+| Necessary classroom apps are pinned to Start and unnecessary apps are removed.                                                                                                                                                                                         |             |          |            |                  |
+| **Guest account, no sign-in required**                                                                                                                                                                                                                                | X           | X        | X          | X                |
+| Set up computers for use by anyone with or without an account.                                                                                                                                                                         |             |          |            |                  |
+| **School policies**                                                                                                                                                                                                                                                   | X           | X        | X          | X                |
+| Settings create a relevant, useful learning environment and optimal computer performance.                                                                                                                                                                |             |          |            |                  |
+| **Azure AD Join**                                                                                                                                                                                                                                                     |             | X        | X          | X                |
+| Computers join with your existing Azure AD or Office 365 subscription for centralized management.                                                                                                                                                                      |             |          |            |                  |
+| **Single sign-on to Office 365**                                                                                                                                                                                                                                      |             |          | X          | X                |
+| Students sign in with their IDs to access all Office 365 web apps or installed Office apps.                                                                                                                                                            |             |          |            |                  |
+| **Take a Test app**                                                                                                                                                                                                                                                     |             |          |            | X                |
+| Administer quizzes and assessments through test providers such as Smarter Balanced.                                                                                                                                      |             |          |            |                  |
+| [Settings roaming](https://azure.microsoft.com/documentation/articles/active-directory-windows-enterprise-state-roaming-overview/) **via Azure AD**                                                                                                             |             |          |            | X                |
+| Synchronize student and application data across devices for a personalized experience.                                                                                                                                                          |             |          |            |                  |
+
+> [!NOTE]
+>   If your school uses Active Directory, use [Windows Configuration
+>   Designer](set-up-students-pcs-to-join-domain.md) 
+>   to configure your PCs to join the domain. You can only use the Set up School
+>   PCs app to set up PCs that are connected to Azure AD.
+
+
+
+## Next steps  
+Learn more about setting up devices with the Set up School PCs app.  
+* [Azure AD Join with Set up School PCs](set-up-school-pcs-azure-ad-join.md)
+* [Shared PC mode for schools](set-up-school-pcs-shared-pc-mode.md)
+* [What's in my provisioning package](set-up-school-pcs-provisioning-package.md)
+* [Set up Windows 10 devices for education](set-up-windows-10.md) 
+
+When you're ready to create and apply your provisioning package, see [Use Set up School PCs app](use-set-up-school-pcs-app.md).
+
+
+
+
+
+
+
+
diff --git a/education/windows/set-up-school-pcs-whats-new.md b/education/windows/set-up-school-pcs-whats-new.md
index 4d555813ad..7d74f93c5d 100644
--- a/education/windows/set-up-school-pcs-whats-new.md
+++ b/education/windows/set-up-school-pcs-whats-new.md
@@ -1,24 +1,66 @@
----  
-title: What's new in the Windows Set up School PCs app 
-description: Find out about app updates and new features in Set up School PCs.  
-keywords: shared cart, shared PC, school, set up school pcs  
-ms.prod: w10  
-ms.mktglfcycl: plan  
-ms.sitesec: library  
-ms.pagetype: edu  
-ms.localizationpriority: medium  
-author: lenewsad  
-ms.author: lanewsad  
-ms.date: 01/11/2019 
+---
+title: What's new in the Windows Set up School PCs app
+description: Find out about app updates and new features in Set up School PCs.
+keywords: shared cart, shared PC, school, set up school pcs
+ms.prod: w10
+ms.mktglfcycl: plan
+ms.sitesec: library
+ms.pagetype: edu
+ms.localizationpriority: medium
+author: dansimp
+ms.author: dansimp
+ms.date: 09/25/2019
+ms.reviewer: 
+manager: dansimp
 ---  
 
 # What's new in Set up School PCs
-Learn what’s new with the Set up School PCs app each week. Find out about new app features and functionality, and see updated screenshots. You'll also find information about past releases.   
+Learn what’s new with the Set up School PCs app each week. Find out about new app features and functionality, see updated screenshots, and find information about past releases.   
 
-## Week of December 31, 2019
+
+## Week of September 23, 2019  
+
+### Easier way to deploy Office 365 to your classroom devices 
+ Microsoft Office now appears as an option on the **Apps** screen. Select the app to add it to your provisioning package. Devices install Office 365 ProPlus. This version includes the cloud-connected and most current versions of apps such as Word, PowerPoint, Excel, and Teams.   
+
+
+## Week of June 24, 2019  
+
+### Resumed support for Windows 10, version 1903 and later   
+The previously mentioned provisioning problem was resolved, so the Set up School PCs app once again supports Windows 10, version 1903 and later. The Windows 10 settings that were removed are now back in the app. 
+
+### Device rename made optional for Azure AD joined devices  
+When you set up your Azure AD join devices in the app, you no longer need to rename your devices. You can keep existing device names.  
+
+## Week of May 23, 2019   
+
+### Suspended support for Windows 10, version 1903 and later
+Due to a provisioning problem, Set up School PCs has temporarily stopped support for Windows 10, version 1903 and later. All settings in the app that were for Windows 10, version 1903 and later have been removed. When the problem is resolved, support will resume again.  
+
+### Mandatory device rename for Azure AD joined devices
+If you configure Azure AD Join, you're now required to rename your devices during setup. You can't keep existing device names.    
+
+## Week of April 15, 2019  
+
+### Support for Minecraft Education Edition upgrade
+ Set up School PCs only adds apps to the provisioning package that meet the minimum supported version for Windows 10. For example, Minecraft is the most recent store app to upgrade; it's only installed on devices running Windows 10, version 1709 and later. If you select an earlier version of Windows, Minecraft won't be included in the provisioning package.  
+
+## Week of April 8, 2019  
+
+### Apps configured as non-removeable  
+Apps that you deploy with Set up School PCs are configured as non-removable apps. This feature prevents students from unpinning or uninstalling the apps they need.  
+
+### Domain name automatically added during sign-in  
+Specify your preferred Azure Active Directory tenant domain name to automatically append it to the username on the sign-in screen. With this setting, students don't need to type out long school domain names. To sign in, they type only their unique usernames.  
+
+### Set up devices with hidden Wi-Fi network
+Set up devices so that they connect to a hidden Wi-Fi network. To configure a hidden network, open the app. When you get to **Wireless network**, choose **Add a Wi-Fi network**. Enter in your Wi-Fi information and select **Hidden network**.  
+
+
+## Week of December 31, 2018
 
 ### Add Microsoft Whiteboard to provisioning package  
-Microsoft Whiteboard has been added to the list of Microsoft-recommended apps for schools. Whiteboard is a freeform digital canvas where ideas, content, and people come together so students can create and collaborate in real time in the classroom. You can add Whiteboard to your provisioning package in Set up School PCs, on the **Add apps** page. For more information see [Use Set up School PCs app](use-set-up-school-pcs-app.md#create-the-provisioning-package).  
+Microsoft Whiteboard is now a Microsoft-recommended app for schools. Whiteboard is a freeform digital canvas where ideas, content, and people come together; students can create and collaborate in real time in the classroom. Add the app to your provisioning package on the **Add apps** page. For more information, see [Use Set up School PCs app](use-set-up-school-pcs-app.md#create-the-provisioning-package).  
 
 ## Week of November 5, 2018  
 
@@ -31,9 +73,9 @@ During setup, you can now add apps from your school's Microsoft Store inventory.
 The Set up School PCs app was updated with the following changes:
 
 ### Three new setup screens added to the app
-The following screens and functionality were added to the setup workflow. Select any screenname to view the relevant steps and screenshots in the Set Up School PCs docs.  
+The following screens and functionality were added to the setup workflow. Select a screen name to view the relevant steps and screenshots in the Set Up School PCs docs.  
 
-* [**Package name**](use-set-up-school-pcs-app.md#package-name): Customize a package name to make it easy to recognize it from your school's other packages. The name is generated by Azure Active Directory and appears as the filename and as the token name in Azure AD in the Azure portal.  
+* [**Package name**](use-set-up-school-pcs-app.md#package-name): Customize a package name to make it easy to recognize it from your school's other packages. Azure Active Directory generates the name. It appears as the filename, and as the token name in Azure AD in the Azure portal.  
 
 * [**Product key**](use-set-up-school-pcs-app.md#product-key): Enter a product key to upgrade your current edition of Windows 10, or change the existing product key. 
 
@@ -43,17 +85,17 @@ The following screens and functionality were added to the setup workflow. Select
 Packages now expire 180 days from the date you create them.  
 
 ### Updated apps with more helpful, descriptive text 
-We've updated the app's **Skip** buttons to clarify the intent of each action. You'll also see an **Exit** button on the last page of the app.  
+The **Skip** buttons in the app now communicate the intent of each action. An **Exit** button also appears on the last page of the app.  
 
 ### Option to keep existing device names
-The [**Name these devices** screen](use-set-up-school-pcs-app.md#device-names) now gives you the option to keep the orginal or existing names of your student devices.   
+The [**Name these devices** screen](use-set-up-school-pcs-app.md#device-names) now gives you the option to keep the original or existing names of your student devices.   
 
 ### Skype and Messaging apps to be removed from student PCs by default
-We've added the Skype and Messaging app to a selection of apps that are, by default, removed from student devices.  
+The Skype and Messaging apps are part of a selection of apps that are, by default, removed from student devices.  
 
 
 ## Next steps    
-Learn more about setting up devices with the Set up School PCs app.  
+Learn how to create provisioning packages and set up devices in the app.   
 * [What's in my provisioning package?](set-up-school-pcs-provisioning-package.md)
 * [Shared PC mode for schools](set-up-school-pcs-shared-pc-mode.md)
 * [Set up School PCs technical reference](set-up-school-pcs-technical.md)
diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md
index a14aa4c69b..0ebe308f14 100644
--- a/education/windows/set-up-students-pcs-to-join-domain.md
+++ b/education/windows/set-up-students-pcs-to-join-domain.md
@@ -6,9 +6,11 @@ ms.prod: w10
 ms.mktglfcycl: plan
 ms.sitesec: library
 ms.localizationpriority: medium
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 07/27/2017
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Set up student PCs to join domain
@@ -26,7 +28,7 @@ Follow the steps in [Provision PCs with common settings for initial deployment (
 
 1. In the **Account Management** step:
 
-    > [!WARNING]  
+    > [!WARNING] 
     > If you don't create a local administrator account and the device fails to enroll in Active Directory for any reason, you will have to reimage the device and start over. As a best practice, we recommend:
     >   - Use a least-privileged domain account to join the device to the domain.
     >   - Create a temporary administrator account to use for debugging or reprovisioning if the device fails to enroll successfully.
@@ -36,31 +38,31 @@ Follow the steps in [Provision PCs with common settings for initial deployment (
 3. Find the **SharedPC** settings group.
     - Set **EnableSharedPCMode** to **TRUE** to configure the PC for shared use.
 4. (Optional) To configure the PC for secure testing, follow these steps.
-  1. Under **Runtime settings**, go to **AssignedAccess > AssignedAccessSettings**.
-  2. Enter **{"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}**, using the account that you want to set up.
+   1. Under **Runtime settings**, go to **AssignedAccess > AssignedAccessSettings**.
+   2. Enter **{"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}**, using the account that you want to set up.
 
-    **Figure 7** - Add the account to use for test-taking
+      **Figure 7** - Add the account to use for test-taking
 
-    ![Add the account to use for test-taking](images/wcd_settings_assignedaccess.png)
+      ![Add the account to use for test-taking](images/wcd_settings_assignedaccess.png)
 
-    The account can be in one of the following formats:
-    - username
-    - domain\username
-    - computer name\\username
-    - username@tenant.com
+      The account can be in one of the following formats:
+      - username
+      - domain\username
+      - computer name\\username
+      - username@tenant.com
 
-  3. Under **Runtime settings**, go to **TakeATest** and configure the following settings:
-    1. In **LaunchURI**, enter the assessment URL.
-    2. In **TesterAccount**, enter the test account you entered in the previous step.
+   3. Under **Runtime settings**, go to **TakeATest** and configure the following settings:
+      1. In **LaunchURI**, enter the assessment URL.
+      2. In **TesterAccount**, enter the test account you entered in the previous step.
 
 5. To configure other settings to make Windows education ready, see [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md) and follow the guidance on what settings you can set using Windows Configuration Designer.
 
 6. Follow the steps to [build a package](https://technet.microsoft.com/itpro/windows/configure/provisioning-create-package#build-package). 
-    - You will see the file path for your provisioning package. By default, this is set to %windir%\Users\*your_username*\Windows Imaging and Configuration Designer (WICD)\*Project name*). 
-    - Copy the provisioning package to a USB drive.
+   - You will see the file path for your provisioning package. By default, this is set to %windir%\Users\*your_username\Windows Imaging and Configuration Designer (WICD)\*Project name). 
+   - Copy the provisioning package to a USB drive.
 
-    > [!IMPORTANT]
-    > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
+     > [!IMPORTANT]
+     > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed.
 
 
 ## Apply package
diff --git a/education/windows/set-up-students-pcs-with-apps.md b/education/windows/set-up-students-pcs-with-apps.md
index 77b6702db0..c711403393 100644
--- a/education/windows/set-up-students-pcs-with-apps.md
+++ b/education/windows/set-up-students-pcs-with-apps.md
@@ -7,9 +7,11 @@ ms.pagetype: edu
 ms.mktglfcycl: plan
 ms.sitesec: library
 ms.localizationpriority: medium
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 10/13/2017
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Provision student PCs with apps
diff --git a/education/windows/set-up-windows-10.md b/education/windows/set-up-windows-10.md
index f4f62a27f3..b401df97ef 100644
--- a/education/windows/set-up-windows-10.md
+++ b/education/windows/set-up-windows-10.md
@@ -7,9 +7,11 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: edu
 ms.localizationpriority: medium
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 07/27/2017
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Set up Windows devices for education
@@ -18,9 +20,9 @@ ms.date: 07/27/2017
 -   Windows 10 
 
 You have two tools to choose from to set up PCs for your classroom: 
-  * Set up School PCs 
-  * Windows Configuration Designer
-  
+* Set up School PCs 
+* Windows Configuration Designer
+
 Choose the tool that is appropriate for how your students will sign in (Active Directory, Azure Active Directory, or no account). 
 
 You can use the following diagram to compare the tools.
diff --git a/education/windows/take-a-test-app-technical.md b/education/windows/take-a-test-app-technical.md
index 8cfa0f104d..9f006e7a88 100644
--- a/education/windows/take-a-test-app-technical.md
+++ b/education/windows/take-a-test-app-technical.md
@@ -7,9 +7,11 @@ ms.mktglfcycl: plan
 ms.sitesec: library
 ms.pagetype: edu
 ms.localizationpriority: medium
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 11/28/2017
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Take a Test app technical reference 
diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md
index c08098f28d..c326ec1cba 100644
--- a/education/windows/take-a-test-multiple-pcs.md
+++ b/education/windows/take-a-test-multiple-pcs.md
@@ -7,9 +7,11 @@ ms.mktglfcycl: plan
 ms.sitesec: library
 ms.pagetype: edu
 ms.localizationpriority: medium
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 11/08/2017
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Set up Take a Test on multiple PCs
@@ -26,7 +28,7 @@ Follow the guidance in this topic to set up Take a Test on multiple PCs.
 To configure a dedicated test account on multiple PCs, select any of the following methods:
 - [Provisioning package created through the Set up School PCs app](#set-up-a-test-account-in-the-set-up-school-pcs-app)
 - [Configuration in Intune for Education](#set-up-a-test-account-in-intune-for-education)
-- [Mobile device management (MDM) or Microsoft System Center Configuration Manager](#set-up-a-test-account-in-mdm-or-configuration-manager)
+- [Mobile device management (MDM) or Microsoft Endpoint Configuration Manager](#set-up-a-test-account-in-mdm-or-configuration-manager)
 - [Provisioning package created through Windows Configuration Designer](#set-up-a-test-account-through-windows-configuration-designer)
 - [Group Policy to deploy a scheduled task that runs a Powershell script](https://docs.microsoft.com/education/windows/take-a-test-multiple-pcs#create-a-scheduled-task-in-group-policy) 
 
@@ -50,23 +52,23 @@ You can set up a test-taking account in Intune for Education. To do this, follow
     ![Add a test profile in Intune for Education](images/i4e_takeatestprofile_addnewprofile.png)
 
 3. In the new profile page:
-  1. Enter a name for the profile.
-  2. Enter the assessment URL.
-  3. Toggle the switch to **Allow screen capture**.
-  4. Select a user account to use as the test-taking account.
-  5. Click **Save**.
+   1. Enter a name for the profile.
+   2. Enter the assessment URL.
+   3. Toggle the switch to **Allow screen capture**.
+   4. Select a user account to use as the test-taking account.
+   5. Click **Save**.
 
-    **Figure 3** - Add information about the test profile
+      **Figure 3** - Add information about the test profile
 
-    ![Add information about the test profile](images/i4e_takeatestprofile_newtestaccount.png)
+      ![Add information about the test profile](images/i4e_takeatestprofile_newtestaccount.png)
 
-    After you save the test profile, you will see a summary of the settings that you configured for Take a Test. Next, you'll need to assign the test profile to a group that will be using the test account.
+      After you save the test profile, you will see a summary of the settings that you configured for Take a Test. Next, you'll need to assign the test profile to a group that will be using the test account.
     
-4.  In the test account page, click **Groups**.
+4. In the test account page, click **Groups**.
 
-    **Figure 4** - Assign the test account to a group
+   **Figure 4** - Assign the test account to a group
 
-    ![Assign the test account to a group](images/i4e_takeatestprofile_accountsummary.png)
+   ![Assign the test account to a group](images/i4e_takeatestprofile_accountsummary.png)
 
 5. In the **Groups** page, click **Change group assignments**.
 
@@ -75,12 +77,12 @@ You can set up a test-taking account in Intune for Education. To do this, follow
     ![Change group assignments](images/i4e_takeatestprofile_groups_changegroupassignments.png)
 
 6. In the **Change group assignments** page:
-  1. Select a group from the right column and click **Add Members** to select the group and assign the test-taking account to that group. You can select more than one group. 
-  2. Click **OK** when you're done making your selection.
+   1. Select a group from the right column and click **Add Members** to select the group and assign the test-taking account to that group. You can select more than one group. 
+   2. Click **OK** when you're done making your selection.
 
-    **Figure 6** - Select the group(s) that will use the test account
+      **Figure 6** - Select the group(s) that will use the test account
 
-    ![Select the groups that will use the test account](images/i4e_takeatestprofile_groupassignment_selected.png)
+      ![Select the groups that will use the test account](images/i4e_takeatestprofile_groupassignment_selected.png)
 
 And that's it! When the students from the selected group sign in to the student PCs using the Take a Test user name that you selected, the PC will be locked down and Take a Test will open the assessment URL and students can start taking tests.
 
@@ -89,8 +91,8 @@ You can configure a dedicated testing account through MDM or Configuration Manag
 
 **Best practice**
 - Create a single account in the directory specifically for test taking 
-    - Active Directory example: Contoso\TestAccount
-    - Azure Active Directory example: testaccount@contoso.com
+  - Active Directory example: Contoso\TestAccount
+  - Azure Active Directory example: testaccount@contoso.com
 
 - Deploy the policies to the group of test-taking devices
 
@@ -99,14 +101,14 @@ You can configure a dedicated testing account through MDM or Configuration Manag
 1. Launch your management console.
 2. Create a policy to set up single app kiosk mode using the following values:
 
-    - **Custom OMA-DM URI** = ./Vendor/MSFT/AssignedAccess/KioskModeApp
-    - **String value** = {"*Account*":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}
+   - **Custom OMA-DM URI** = ./Vendor/MSFT/AssignedAccess/KioskModeApp
+   - **String value** = {"*Account*":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}
 
-    *Account* can be in one of the following formats:
-      - username (not recommended)
-      - domain\username
-      - computer name\\username (not recommended)
-      - username@tenant.com
+     *Account* can be in one of the following formats:
+     - username (not recommended)
+     - domain\username
+     - computer name\\username (not recommended)
+     - username@tenant.com
 
 3. Create a policy to configure the assessment URL using the following values:
 
@@ -128,28 +130,28 @@ To set up a test account through Windows Configuration Designer, follow these st
 
 1. [Install Windows Configuration Designer](https://technet.microsoft.com/itpro/windows/configure/provisioning-install-icd).
 2. Create a provisioning package by following the steps in [Provision PCs with common settings for initial deployment (desktop wizard)](https://technet.microsoft.com/itpro/windows/configure/provision-pcs-for-initial-deployment). However, make a note of these other settings to customize the test account.
-  1. After you're done with the wizard, do not click **Create**. Instead, click the **Switch to advanced editor** to switch the project to the advanced editor to see all the available **Runtine settings**.
-  2. Under **Runtime settings**, go to **AssignedAccess > AssignedAccessSettings**.
-  3. Enter **{"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}**, using the account that you want to set up.
+   1. After you're done with the wizard, do not click **Create**. Instead, click the **Switch to advanced editor** to switch the project to the advanced editor to see all the available **Runtine settings**.
+   2. Under **Runtime settings**, go to **AssignedAccess > AssignedAccessSettings**.
+   3. Enter **{"Account":"*redmond\\kioskuser*","AUMID":” Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy!App "}**, using the account that you want to set up.
 
-    **Figure 7** - Add the account to use for test-taking
+      **Figure 7** - Add the account to use for test-taking
 
-    ![Add the account to use for test-taking](images/wcd_settings_assignedaccess.png)
+      ![Add the account to use for test-taking](images/wcd_settings_assignedaccess.png)
 
-    The account can be in one of the following formats:
-    - username
-    - domain\username
-    - computer name\\username
-    - username@tenant.com
+      The account can be in one of the following formats:
+      - username
+      - domain\username
+      - computer name\\username
+      - username@tenant.com
 
-  4. Under **Runtime settings**, go to **TakeATest** and configure the following settings:
-    1. In **LaunchURI**, enter the assessment URL.
-    2. In **TesterAccount**, enter the test account you entered in step 3.
+   4. Under **Runtime settings**, go to **TakeATest** and configure the following settings:
+      1. In **LaunchURI**, enter the assessment URL.
+      2. In **TesterAccount**, enter the test account you entered in step 3.
 
 3. Follow the steps to [build a package](https://technet.microsoft.com/itpro/windows/configure/provisioning-create-package#build-package). 
 
-    - You will see the file path for your provisioning package. By default, this is set to %windir%\Users\*your_username*\Windows Imaging and Configuration Designer (WICD)\*Project name*). 
-    - Copy the provisioning package to a USB drive.
+   - You will see the file path for your provisioning package. By default, this is set to %windir%\Users\*your_username\Windows Imaging and Configuration Designer (WICD)\*Project name). 
+   - Copy the provisioning package to a USB drive.
 
 4. Follow the steps in [Apply a provisioning package](https://technet.microsoft.com/itpro/windows/configure/provisioning-apply-package) to apply the package that you created.
 
@@ -189,7 +191,7 @@ Set-AssignedAccess -AppUserModelId Microsoft.Windows.SecureAssessmentBrowser_cw5
 12. Create a new **Action**.
 13. Configure the action to **Start a program**.
 14. In the **Program/script** field, enter **powershell**.
-15. In the **Add arguments** field, enter **-file ""**.
+15. In the **Add arguments** field, enter **-file "\"**.
 16. Click **OK**.
 17. Navigate to the **Triggers** tab and create a new trigger.
 18. Specify the trigger to be **On a schedule**.
@@ -205,17 +207,17 @@ Anything hosted on the web can be presented in a locked down manner, not just as
 **To provide a link to the test**
 
 1. Create the link to the test using schema activation.
-  - Create a link using a web UI
+   - Create a link using a web UI
 
-    For this option, you can just copy the assessment URL, select the options you want to allow during the test, and click a button to create the link. We recommend this for option for teachers.
+     For this option, you can just copy the assessment URL, select the options you want to allow during the test, and click a button to create the link. We recommend this for option for teachers.
 
-    To get started, go here: [Create a link using a web UI](https://education.microsoft.com/courses-and-resources/windows-10-create-a-take-a-test-link).
+     To get started, go here: [Create a link using a web UI](https://education.microsoft.com/courses-and-resources/windows-10-create-a-take-a-test-link).
 
-  - Create a link using schema activation
+   - Create a link using schema activation
 
-    You can accomplish the same thing as the first option (using a web UI), by manually embedding a URL with a specific prefix. You can select parameters depending on what you want to enable. 
+     You can accomplish the same thing as the first option (using a web UI), by manually embedding a URL with a specific prefix. You can select parameters depending on what you want to enable. 
 
-    For more info, see [Create a link using schema activation](#create-a-link-using-schema-activation).
+     For more info, see [Create a link using schema activation](#create-a-link-using-schema-activation).
 
 2. Distribute the link. 
 
@@ -230,20 +232,20 @@ One of the ways you can present content in a locked down manner is by embedding
 
 1. Embed a link or create a desktop shortcut with:
 
-  ```
-  ms-edu-secureassessment:#enforceLockdown
-  ```
+   ```
+   ms-edu-secureassessment:#enforceLockdown
+   ```
 
 2. To enable printing, screen capture, or both, use the above link and append one of these parameters:
 
-  - `&enableTextSuggestions` - Enables text suggestions
-  - `&requirePrinting` - Enables printing
-  - `&enableScreenCapture` - Enables screen capture
-  - `&requirePrinting&enableScreenCapture` - Enables printing and screen capture; you can use a combination of `&enableTextSuggestions`, `&requirePrinting`, and `&enableScreenCapture` if you want to enable more than one capability. 
+   - `&enableTextSuggestions` - Enables text suggestions
+   - `&requirePrinting` - Enables printing
+   - `&enableScreenCapture` - Enables screen capture
+   - `&requirePrinting&enableScreenCapture` - Enables printing and screen capture; you can use a combination of `&enableTextSuggestions`, `&requirePrinting`, and `&enableScreenCapture` if you want to enable more than one capability. 
 
-  If you exclude these parameters, the default behavior is disabled.
+   If you exclude these parameters, the default behavior is disabled.
 
-  For tests that utilizes the Windows lockdown API, which checks for running processes before locking down, remove `enforceLockdown`. Removing `enforceLockdown` will result in the app not locking down immediately, which allows you to close apps that are not allowed to run during lockdown. The test web application may lock down the device once you have closed the apps.
+   For tests that utilizes the Windows lockdown API, which checks for running processes before locking down, remove `enforceLockdown`. Removing `enforceLockdown` will result in the app not locking down immediately, which allows you to close apps that are not allowed to run during lockdown. The test web application may lock down the device once you have closed the apps.
 
     > [!NOTE] 
     > The Windows 10, version 1607 legacy configuration, `ms-edu-secureassessment:!enforcelockdown` is still supported, but not in combination with the new parameters.
diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md
index 43ab25e727..41fbb7b7fd 100644
--- a/education/windows/take-a-test-single-pc.md
+++ b/education/windows/take-a-test-single-pc.md
@@ -7,9 +7,11 @@ ms.mktglfcycl: plan
 ms.sitesec: library
 ms.pagetype: edu
 ms.localizationpriority: medium
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 11/08/2017
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Set up Take a Test on a single PC
@@ -26,31 +28,31 @@ To configure the assessment URL and a dedicated testing account on a single PC,
 2. Open the **Settings** app and go to **Accounts > Access work or school**.
 3. Click **Set up an account for taking tests**.
 
-  **Figure 1** - Use the Settings app to set up a test-taking account
+   **Figure 1** - Use the Settings app to set up a test-taking account
 
-  ![Use the Settings app to set up a test-taking account](images/tat_settingsapp_workorschoolaccess_setuptestaccount.png)
+   ![Use the Settings app to set up a test-taking account](images/tat_settingsapp_workorschoolaccess_setuptestaccount.png)
 
 4. In the **Set up an account for taking tests** window, choose an existing account to use as the dedicated testing account.
 
-  **Figure 2** - Choose the test-taking account
+   **Figure 2** - Choose the test-taking account
 
-  ![Choose the test-taking account](images/tat_settingsapp_setuptesttakingaccount_1703.png) 
+   ![Choose the test-taking account](images/tat_settingsapp_setuptesttakingaccount_1703.png) 
 
     > [!NOTE]  
     > If you don't have an account on the device, you can create a new account. To do this, go to **Settings > Accounts > Other people > Add someone else to this PC > I don’t have this person’s sign-in information > Add a user without a Microsoft account**.
 
 5. In the **Set up an account for taking tests**, enter the assessment URL in the field under **Enter the test's web address**. 
 6. Select the options you want to enable during the test.
-  - To enable printing, select **Require printing**. 
+   - To enable printing, select **Require printing**. 
 
       > [!NOTE]  
       > Make sure a printer is preconfigured on the Take a Test account if you're enabling this option.
 
-  - To enable teachers to monitor screens, select **Allow screen monitoring**.
-  - To allow text suggestions, select **Allow text suggestions**.
+   - To enable teachers to monitor screens, select **Allow screen monitoring**.
+   - To allow text suggestions, select **Allow text suggestions**.
 
-6. Click **Save**.
-7. To take the test, the student must sign in using the test-taking account that you created.
+7. Click **Save**.
+8. To take the test, the student must sign in using the test-taking account that you created.
 
 ## Provide a link to the test
 Anything hosted on the web can be presented in a locked down manner, not just assessments. To lock down online content, just embed a URL with a specific prefix and devices will be locked down when users follow the link. We recommend using this method for lower stakes assessments.
@@ -59,29 +61,29 @@ Anything hosted on the web can be presented in a locked down manner, not just as
 
 1. Create the link to the test. 
 
-  There are different ways you can do this:
-  - Create a link using a web UI
+   There are different ways you can do this:
+   - Create a link using a web UI
 
-    For this option, you can just copy the assessment URL, select the options you want to allow during the test, and click a button to create the link. We recommend this for option for teachers.
+     For this option, you can just copy the assessment URL, select the options you want to allow during the test, and click a button to create the link. We recommend this for option for teachers.
 
-    To get started, go here: [Create a link using a web UI](https://education.microsoft.com/courses-and-resources/windows-10-create-a-take-a-test-link).
+     To get started, go here: [Create a link using a web UI](https://education.microsoft.com/courses-and-resources/windows-10-create-a-take-a-test-link).
 
-  - Create a link using schema activation
+   - Create a link using schema activation
 
-    You can accomplish the same thing as the first option (using a web UI), by manually embedding a URL with a specific prefix. You can select parameters depending on what you want to enable. 
+     You can accomplish the same thing as the first option (using a web UI), by manually embedding a URL with a specific prefix. You can select parameters depending on what you want to enable. 
 
-    For more info, see [Create a link using schema activation](#create-a-link-using-schema-activation).
+     For more info, see [Create a link using schema activation](#create-a-link-using-schema-activation).
 
 2. Distribute the link.
 
-  Once the links are created, you can distribute them through the web, email, OneNote, or any other method of your choosing. 
+   Once the links are created, you can distribute them through the web, email, OneNote, or any other method of your choosing. 
 
-  You can also create shortcuts to distribute the link. For more info, see [Create a shortcut for the test link](#create-a-shortcut-for-the-test-link).
+   You can also create shortcuts to distribute the link. For more info, see [Create a shortcut for the test link](#create-a-shortcut-for-the-test-link).
 
 3. To take the test, have the students click on the link and provide user consent.
 
-  > [!NOTE] 
-  > If you enabled printing, the printer must be preconfigured for the account before the student takes the test.
+   > [!NOTE] 
+   > If you enabled printing, the printer must be preconfigured for the account before the student takes the test.
 
 
 ### Create a link using schema activation
@@ -91,20 +93,20 @@ One of the ways you can present content in a locked down manner is by embedding
 
 1. Embed a link or create a desktop shortcut with:
 
-  ```
-  ms-edu-secureassessment:#enforceLockdown
-  ```
+   ```
+   ms-edu-secureassessment:#enforceLockdown
+   ```
 
 2. To enable printing, screen capture, or both, use the above link and append one of these parameters:
 
-  - `&enableTextSuggestions` - Enables text suggestions
-  - `&requirePrinting` - Enables printing
-  - `&enableScreenCapture` - Enables screen capture
-  - `&requirePrinting&enableScreenCapture` - Enables printing and screen capture; you can use a combination of `&enableTextSuggestions`, `&requirePrinting`, and `&enableScreenCapture` if you want to enable more than one capability. 
+   - `&enableTextSuggestions` - Enables text suggestions
+   - `&requirePrinting` - Enables printing
+   - `&enableScreenCapture` - Enables screen capture
+   - `&requirePrinting&enableScreenCapture` - Enables printing and screen capture; you can use a combination of `&enableTextSuggestions`, `&requirePrinting`, and `&enableScreenCapture` if you want to enable more than one capability. 
 
-  If you exclude these parameters, the default behavior is disabled.
+   If you exclude these parameters, the default behavior is disabled.
 
-  For tests that utilizes the Windows lockdown API, which checks for running processes before locking down, remove `enforceLockdown`. Removing `enforceLockdown` will result in the app not locking down immediately, which allows you to close apps that are not allowed to run during lockdown. The test web application may lock down the device once you have closed the apps.
+   For tests that utilizes the Windows lockdown API, which checks for running processes before locking down, remove `enforceLockdown`. Removing `enforceLockdown` will result in the app not locking down immediately, which allows you to close apps that are not allowed to run during lockdown. The test web application may lock down the device once you have closed the apps.
 
     > [!NOTE] 
     > The Windows 10, version 1607 legacy configuration, `ms-edu-secureassessment:!enforcelockdown` is still supported, but not in combination with the new parameters.
diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md
index bede949a26..fed3ff8374 100644
--- a/education/windows/take-tests-in-windows-10.md
+++ b/education/windows/take-tests-in-windows-10.md
@@ -7,9 +7,11 @@ ms.mktglfcycl: plan
 ms.sitesec: library
 ms.pagetype: edu
 ms.localizationpriority: medium
-author: CelesteDG
-ms.author: celested
+author: dansimp
+ms.author: dansimp
 ms.date: 10/16/2017
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Take tests in Windows 10
@@ -39,22 +41,22 @@ There are several ways to configure devices for assessments. You can:
 
     There are different methods to configure the assessment URL and a dedicated testing account depending on whether you're setting up Take a Test on a single PC or multiple PCs.
 
-    - **For a single PC**
+  - **For a single PC**
         
-        You can use the Windows 10 **Settings** application. For more info, see [Set up Take a Test on a single PC](take-a-test-single-pc.md).
+      You can use the Windows 10 **Settings** application. For more info, see [Set up Take a Test on a single PC](take-a-test-single-pc.md).
 
-    - **For multiple PCs**
+  - **For multiple PCs**
     
-        You can use any of these methods:
-            - Mobile device management (MDM) or Microsoft System Center Configuration Manager
-            - A provisioning package created in Windows Configuration Designer
-            - Group Policy to deploy a scheduled task that runs a Powershell script
+      You can use any of these methods:
+    - Mobile device management (MDM) or Microsoft Endpoint Configuration Manager
+    - A provisioning package created in Windows Configuration Designer
+    - Group Policy to deploy a scheduled task that runs a Powershell script
 
-        Beginning with Windows 10 Creators Update (version 1703), you can also configure Take a Test using these options:
-            - Set up School PCs app
-            - Intune for Education
+      Beginning with Windows 10 Creators Update (version 1703), you can also configure Take a Test using these options:
+    - Set up School PCs app
+    - Intune for Education
 
-        For more info about these methods, see [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md).
+      For more info about these methods, see [Set up Take a Test on multiple PCs](take-a-test-multiple-pcs.md).
 
 - **Distribute the assessment URL through the web, email, OneNote, or any other method of your choosing. You can also create shortcuts to distribute the link**
 
diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md
index b5f3145c61..501e3f3249 100644
--- a/education/windows/teacher-get-minecraft.md
+++ b/education/windows/teacher-get-minecraft.md
@@ -6,11 +6,13 @@ ms.prod: w10
 ms.mktglfcycl: plan
 ms.sitesec: library
 ms.localizationpriority: medium
-author: trudyha
-searchScope:
+author: dansimp
+searchScope: 
   - Store
-ms.author: trudyha
+ms.author: dansimp
 ms.date: 01/05/2018
+ms.reviewer: 
+manager: dansimp
 ms.topic: conceptual
 ---
 
@@ -47,9 +49,9 @@ You can purchase individual Minecraft: Education Edition subscriptions for you a
 
 To purchase individual Minecraft: Education Edition subscriptions (i.e. direct purchase):
 
-1.	Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your Office 365 account.
-2.	Click on [Minecraft: Education Edition](https://educationstore.microsoft.com/en-us/store/details/minecraft-education-edition/9nblggh4r2r6) (or use Search the Store to find it)
-3.	Click **Buy**
+1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com/) with your Office 365 account.
+2. Click on [Minecraft: Education Edition](https://educationstore.microsoft.com/en-us/store/details/minecraft-education-edition/9nblggh4r2r6) (or use Search the Store to find it)
+3. Click **Buy**
 
 >[!Note]
 >Administrators can restrict the ability for teachers to purchase applications in the Microsoft Store for Education. If you do not have the ability to Buy, contact your school administration or IT administrator.
diff --git a/education/windows/test-windows10s-for-edu.md b/education/windows/test-windows10s-for-edu.md
index ac962a298b..2b64a32bd1 100644
--- a/education/windows/test-windows10s-for-edu.md
+++ b/education/windows/test-windows10s-for-edu.md
@@ -7,9 +7,11 @@ ms.prod: w10
 ms.pagetype: edu
 ms.sitesec: library
 ms.localizationpriority: medium
-author: MikeBlodge
-ms.author: MikeBlodge
-ms.date: 04/30/2018
+author: dansimp
+ms.author: dansimp
+ms.date: 07/30/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Test Windows 10 in S mode on existing Windows 10 education devices
@@ -21,7 +23,7 @@ The Windows 10 in S mode self-installer will allow you to test Windows 10 in S m
 
 Windows 10 in S mode is built to give schools the familiar, robust, and productive experiences you count on from Windows in an experience that's been streamlined for security and performance in the classroom, and built to work with Microsoft Education[2](#footnote2).
 
-Windows 10 in S mode is different from other editions of Windows 10 as everything that runs on the device is verfied by Microsoft for security and performance. Therefore, Windows 10 in S mode works exclusively with apps from the Microsoft Store. Some accessories and apps compatible with Windows 10 may not work and performance may vary. Certain default settings, features, and apps cannot be changed. When you install Windows 10 in S mode, your existing applications and settings will be deleted and you will only be able to install apps from the Microsoft Store.
+Windows 10 in S mode is different from other editions of Windows 10 as everything that runs on the device is verified by Microsoft for security and performance. Therefore, Windows 10 in S mode works exclusively with apps from the Microsoft Store. Some accessories and apps compatible with Windows 10 may not work and performance may vary. Certain default settings, features, and apps cannot be changed. When you install Windows 10 in S mode, your existing applications and settings will be deleted and you will only be able to install apps from the Microsoft Store.
 
 **Configuring Windows 10 in S mode for school use is easy:** Education customers must configure **SetEduPolicies** for use in K-12 schools. For more information on how to do these, see [Use the Set up School PCs app](use-set-up-school-pcs-app.md) and [Windows 10 configuration recommendations for education customers](configure-windows-for-education.md). 
 
@@ -49,7 +51,7 @@ Due to these reasons, we recommend that you use the installation tool and avoid
 Before you install Windows 10 in S mode on your existing Windows 10 Pro, Windows 10 Pro Education, Windows 10 Education, or Windows 10 Enterprise device:
 * Make sure that you updated your existing device to Windows 10, version 1703 (Creators Update).
 
-    See [Download Windows 10](https://www.microsoft.com/en-us/software-download/windows10) and follow the instructions to update your device to Windows 10, version 1703. You can verify your current version in **Settings > System > About**.
+    See [Download Windows 10](https://www.microsoft.com/software-download/windows10) and follow the instructions to update your device to Windows 10, version 1703. You can verify your current version in **Settings > System > About**.
 
 * Install the latest Windows Update.
 
@@ -88,7 +90,7 @@ Check with your device manufacturer before trying Windows 10 in S mode on your d
 | HP | Huawei | I Life |
 | iNET | Intel | LANIT Trading |
 | Lenovo | LG | MCJ | 
-| Micro P/Exertis | Microsoft | MSI | 
+| Micro P/Exertis | Microsoft | MSI | 
 | Panasonic | PC Arts | Positivo SA | 
 | Positivo da Bahia | Samsung | Teclast | 
 | Thirdwave | Tongfang | Toshiba | 
@@ -182,7 +184,7 @@ If you see this message, follow these steps to stop receiving the message:
 
 To use an installation media to reinstall Windows 10, follow these steps.
 
-1. On a working PC, go to the [Microsoft software download website](https://www.microsoft.com/en-us/software-download/windows10).
+1. On a working PC, go to the [Microsoft software download website](https://www.microsoft.com/software-download/windows10).
 2. Download the Media Creation Tool and then run it.
 3. Select **Create installation media for another PC**.
 4. Choose a language, edition, and architecture (64-bit or 32-bit).
@@ -240,7 +242,7 @@ For help with activation issues, click on the appropriate link below for support
 
 
            
 1 Internet access fees may apply.
            
-2 Devices must be configured for educational use by applying **[SetEduPolicies](https://docs.microsoft.com/education/windows/configure-windows-for-education#setedupolicies)** using the Set up School PCs app.
            
+2 Devices must be configured for educational use by applying SetEduPolicies using the Set up School PCs app.
            
 
 
            
 
diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md
index ccd3cd06b7..3f31119391 100644
--- a/education/windows/use-set-up-school-pcs-app.md
+++ b/education/windows/use-set-up-school-pcs-app.md
@@ -7,9 +7,11 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: edu
 ms.localizationpriority: medium
-author: lenewsad
-ms.author: lanewsad
+author: dansimp
+ms.author: dansimp
 ms.date: 10/23/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Use the Set up School PCs app  
@@ -87,8 +89,8 @@ We recommend that you:
 * Configure your DHCP so at least 200 IP addresses are available for your devices. Having available IP addresses will allow you to set up many devices simultaneously.  
 * Configure your IP addresses to expire after a short time--about 30 minutes. IP addresses will free up quickly so you can continue to set up devices without network issues.    
 
->> [!WARNING]
-> Only use the provisioning package on PCs that you want to configure and lock down for students. After you apply the provisioning package to a student PC, the PC must be reset to remove the settings.  
+> > [!WARNING]
+> > Only use the provisioning package on PCs that you want to configure and lock down for students. After you apply the provisioning package to a student PC, the PC must be reset to remove the settings.  
 
 ### Use an additional USB drive  
 To set up more than one PC at the same time, save the provisioning package to additional USB drives. Then plug the USBs in at the same time during setup. 
@@ -206,7 +208,7 @@ Set up the Take a Test app to give online quizzes and high-stakes assessments. D
 
     ![Set up Take a Test app page with "Yes" selected to create an app button. Page also has two checkboxes for additional settings and one text field for the assessment URL.](images/1810_SUSPC_Take_Test.png)   
 
-2. Select from the advanced settings. Available settings inclue:  
+2. Select from the advanced settings. Available settings include:  
     * Allow keyboard auto-suggestions: Allows app to suggest words as the student types on the PC's keyboard.  
     * Allow teachers to monitor online tests: Enables screen capture in the Take a Test app.  
 3. Enter the URL where the test is hosted. When students log in to the Take a Test account, they'll be able to click or enter the link to view the assessment.  
diff --git a/education/windows/windows-editions-for-education-customers.md b/education/windows/windows-editions-for-education-customers.md
index d37d3c1d20..80555a4b90 100644
--- a/education/windows/windows-editions-for-education-customers.md
+++ b/education/windows/windows-editions-for-education-customers.md
@@ -7,9 +7,11 @@ ms.mktglfcycl: plan
 ms.sitesec: library
 ms.pagetype: edu
 ms.localizationpriority: medium
-author: CelesteDG
-ms.author: celested
-ms.date: 10/13/2017
+author: dansimp
+ms.author: dansimp
+ms.date: 05/21/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Windows 10 editions for education customers
@@ -61,11 +63,12 @@ Customers who deploy Windows 10 Enterprise are able to configure the product to
 For any other questions, contact [Microsoft Customer Service and Support](https://support.microsoft.com/en-us).
 
 ## Related topics
-* [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md)
-* [Windows deployment for education](https://aka.ms/edudeploy)
-* [Windows 10 upgrade paths](https://go.microsoft.com/fwlink/?LinkId=822787)
-* [Volume Activation for Windows 10](https://go.microsoft.com/fwlink/?LinkId=822788)
-* [Plan for volume activation](https://go.microsoft.com/fwlink/?LinkId=822789)
+- [Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S](change-to-pro-education.md)
+- [Windows deployment for education](https://aka.ms/edudeploy)
+- [Windows 10 upgrade paths](https://go.microsoft.com/fwlink/?LinkId=822787)
+- [Volume Activation for Windows 10](https://go.microsoft.com/fwlink/?LinkId=822788)
+- [Plan for volume activation](https://go.microsoft.com/fwlink/?LinkId=822789)
+- [Windows 10 subscription activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation)
 
 
 
diff --git a/mdop/TOC.md b/mdop/TOC.md
index edac2c521e..91a625282c 100644
--- a/mdop/TOC.md
+++ b/mdop/TOC.md
@@ -1,21 +1,21 @@
 # [Microsoft Desktop Optimization Pack](index.md)
 ## [Advanced Group Policy Management](agpm/index.md)
-## [Application Virtualization]()
+## Application Virtualization
 ### [Application Virtualization 5](appv-v5/index.md)
 ### [Application Virtualization 4](appv-v4/index.md)
 ### [SoftGrid Application Virtualization](softgrid-application-virtualization.md)
-## [Diagnostics and Recovery Toolset]()
+## Diagnostics and Recovery Toolset
 ### [Diagnostics and Recovery Toolset 10](dart-v10/index.md)
 ### [Diagnostics and Recovery Toolset 8](dart-v8/index.md)
 ### [Diagnostics and Recovery Toolset 7](dart-v7/index.md)
 ### [Diagnostics and Recovery Toolset 6.5](dart-v65.md)
-## [Microsoft Bitlocker Administration and Monitoring]()
+## Microsoft Bitlocker Administration and Monitoring
 ### [Microsoft Bitlocker Administration and Monitoring 2.5](mbam-v25/index.md)
 ### [Microsoft Bitlocker Administration and Monitoring 2](mbam-v2/index.md)
 ### [Microsoft Bitlocker Administration and Monitoring 1](mbam-v1/index.md)
-## [Microsoft Enterprise Desktop Virtualization]()
+## Microsoft Enterprise Desktop Virtualization
 ### [Microsoft Enterprise Desktop Virtualization 2](medv-v2/index.md)
-## [User Experience Virtualization]()
+## User Experience Virtualization
 ### [User Experience Virtualization 2](uev-v2/index.md)
 ### [User Experience Virtualization 1](uev-v1/index.md)
 ## [MDOP Solutions and Scenarios](solutions/index.md)
\ No newline at end of file
diff --git a/mdop/agpm/TOC.md b/mdop/agpm/TOC.md
index 1443cf78ae..319eeaf746 100644
--- a/mdop/agpm/TOC.md
+++ b/mdop/agpm/TOC.md
@@ -240,5 +240,6 @@
 ###### [AGPM Server Connection Settings](agpm-server-connection-settings.md)
 ###### [Feature Visibility Settings](feature-visibility-settings.md)
 ##### [Other Enhancements to the GPMC](other-enhancements-to-the-gpmc.md)
+## [Troubleshooting AGPM Upgrades](troubleshooting-agpm40-upgrades.md)
 ## [Resources for AGPM](resources-for-agpm.md)
 
diff --git a/mdop/agpm/administrative-template-settings.md b/mdop/agpm/administrative-template-settings.md
index 7105d25515..7d675b587e 100644
--- a/mdop/agpm/administrative-template-settings.md
+++ b/mdop/agpm/administrative-template-settings.md
@@ -1,8 +1,11 @@
 ---
 title: Administrative Template Settings
 description: Administrative Template Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: 1abbf0c1-fd32-46a8-a3ba-c005f066523d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/administrative-templates-folder-agpm30ops.md b/mdop/agpm/administrative-templates-folder-agpm30ops.md
index 62bea2d0e8..357c524122 100644
--- a/mdop/agpm/administrative-templates-folder-agpm30ops.md
+++ b/mdop/agpm/administrative-templates-folder-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Administrative Templates Folder
 description: Administrative Templates Folder
-author: jamiejdt
+author: dansimp
 ms.assetid: 0cc5b570-b6d3-4841-9646-02521c13519c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/administrative-templates-folder-agpm40.md b/mdop/agpm/administrative-templates-folder-agpm40.md
index e71b223616..daec342d3b 100644
--- a/mdop/agpm/administrative-templates-folder-agpm40.md
+++ b/mdop/agpm/administrative-templates-folder-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Administrative Templates Folder
 description: Administrative Templates Folder
-author: jamiejdt
+author: dansimp
 ms.assetid: abc41968-4505-4b09-94f2-67ee0e6c9aaf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/advanced-group-policy-management-40.md b/mdop/agpm/advanced-group-policy-management-40.md
index 9338f4dc71..5fccc1a30d 100644
--- a/mdop/agpm/advanced-group-policy-management-40.md
+++ b/mdop/agpm/advanced-group-policy-management-40.md
@@ -1,8 +1,11 @@
 ---
 title: Advanced Group Policy Management 4.0
 description: Advanced Group Policy Management 4.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 9873a1f7-97fc-4546-9538-b4c0308529c0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/agpm-25-navengl.md b/mdop/agpm/agpm-25-navengl.md
index 81274eb864..3eab801c30 100644
--- a/mdop/agpm/agpm-25-navengl.md
+++ b/mdop/agpm/agpm-25-navengl.md
@@ -1,8 +1,11 @@
 ---
 title: AGPM 2.5
 description: AGPM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 6db42f2e-88b2-4305-ab6b-d3cd0c5d686c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/agpm-3-navengl.md b/mdop/agpm/agpm-3-navengl.md
index 3459ff0c04..b22f23bf00 100644
--- a/mdop/agpm/agpm-3-navengl.md
+++ b/mdop/agpm/agpm-3-navengl.md
@@ -1,8 +1,11 @@
 ---
 title: AGPM 3
 description: AGPM 3
-author: jamiejdt
+author: dansimp
 ms.assetid: b0d0051d-2900-4a0f-8307-552ad26b0e3b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/agpm-4-navengl.md b/mdop/agpm/agpm-4-navengl.md
index 44953f8ace..76b3146249 100644
--- a/mdop/agpm/agpm-4-navengl.md
+++ b/mdop/agpm/agpm-4-navengl.md
@@ -1,8 +1,11 @@
 ---
 title: AGPM 4
 description: AGPM 4
-author: jamiejdt
+author: dansimp
 ms.assetid: 81693f30-1b8e-4e63-b1ac-e6de1bc30cc0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/agpm-40-sp1-navengl.md b/mdop/agpm/agpm-40-sp1-navengl.md
index 69c013e7ce..94076ee683 100644
--- a/mdop/agpm/agpm-40-sp1-navengl.md
+++ b/mdop/agpm/agpm-40-sp1-navengl.md
@@ -1,8 +1,11 @@
 ---
 title: AGPM 4.0 SP1
 description: AGPM 4.0 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 4e55d9e6-635c-4ba6-acbb-ed1d1b580a5b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/agpm-40-sp2-navengl.md b/mdop/agpm/agpm-40-sp2-navengl.md
index f0a00f54e4..cc07406cc0 100644
--- a/mdop/agpm/agpm-40-sp2-navengl.md
+++ b/mdop/agpm/agpm-40-sp2-navengl.md
@@ -1,8 +1,11 @@
 ---
 title: AGPM 4.0 SP2
 description: AGPM 4.0 SP2
-author: jamiejdt
+author: dansimp
 ms.assetid: 915c9791-ac07-43db-bd53-957b641c700f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/agpm-40-sp3-navengl.md b/mdop/agpm/agpm-40-sp3-navengl.md
index 9be1899784..daf9dd9544 100644
--- a/mdop/agpm/agpm-40-sp3-navengl.md
+++ b/mdop/agpm/agpm-40-sp3-navengl.md
@@ -1,8 +1,11 @@
 ---
 title: AGPM 4.0 SP3
 description: AGPM 4.0 SP3
-author: jamiejdt
+author: dansimp
 ms.assetid: cd80eea9-601f-4e45-b89e-c3904addee37
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/agpm-server-connection-settings-agpm30ops.md b/mdop/agpm/agpm-server-connection-settings-agpm30ops.md
index 54a41f2c0d..bc916bbcd2 100644
--- a/mdop/agpm/agpm-server-connection-settings-agpm30ops.md
+++ b/mdop/agpm/agpm-server-connection-settings-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: AGPM Server Connection Settings
 description: AGPM Server Connection Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: 5f03e397-b868-4c49-9cbf-a5f5d0ddcc39
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/agpm-server-connection-settings-agpm40.md b/mdop/agpm/agpm-server-connection-settings-agpm40.md
index d34cd89fc2..c713631290 100644
--- a/mdop/agpm/agpm-server-connection-settings-agpm40.md
+++ b/mdop/agpm/agpm-server-connection-settings-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: AGPM Server Connection Settings
 description: AGPM Server Connection Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: cc67f122-6309-4820-92c2-f6a27d897123
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/agpm-server-connection-settings.md b/mdop/agpm/agpm-server-connection-settings.md
index 475a5c4267..a615120897 100644
--- a/mdop/agpm/agpm-server-connection-settings.md
+++ b/mdop/agpm/agpm-server-connection-settings.md
@@ -1,8 +1,11 @@
 ---
 title: AGPM Server Connection Settings
 description: AGPM Server Connection Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: faf78e5b-2b0d-4069-9b8c-910add892200
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/agpm-server-tab-agpm30ops.md b/mdop/agpm/agpm-server-tab-agpm30ops.md
index ff5621925a..1732bd6a6e 100644
--- a/mdop/agpm/agpm-server-tab-agpm30ops.md
+++ b/mdop/agpm/agpm-server-tab-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: AGPM Server Tab
 description: AGPM Server Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: fb3b0265-53ed-4bf6-88a4-c409f5f1bed4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ The maximum number of unique versions to store for each GPO does not include the
 
 When a GPO version is deleted, a record of that version remains in the history of the GPO, but the GPO version itself is deleted from the archive. You can prevent a GPO version from being deleted by marking it in the history as not deletable.
 
- 
+ 
 
 ### Additional references
 
@@ -43,9 +46,9 @@ When a GPO version is deleted, a record of that version remains in the history o
 
 -   [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/agpm-server-tab-agpm40.md b/mdop/agpm/agpm-server-tab-agpm40.md
index 1eacd1a759..b2974b2c84 100644
--- a/mdop/agpm/agpm-server-tab-agpm40.md
+++ b/mdop/agpm/agpm-server-tab-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: AGPM Server Tab
 description: AGPM Server Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: a6689437-233e-4f33-a0d6-f7d432c96c00
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ The maximum number of unique versions to store for each GPO does not include the
 
 When a GPO version is deleted, a record of that version remains in the history of the GPO, but the GPO version itself is deleted from the archive. You can prevent a GPO version from being deleted by marking it in the history as not deletable.
 
- 
+ 
 
 ### Additional references
 
@@ -43,9 +46,9 @@ When a GPO version is deleted, a record of that version remains in the history o
 
 -   [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/agpm-server-tab.md b/mdop/agpm/agpm-server-tab.md
index 1d53ad63c5..ad3006d8b0 100644
--- a/mdop/agpm/agpm-server-tab.md
+++ b/mdop/agpm/agpm-server-tab.md
@@ -1,8 +1,11 @@
 ---
 title: AGPM Server Tab
 description: AGPM Server Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: ce4490b7-b564-49af-8962-858ee39e0016
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md b/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md
index e7f0ebe676..3d7d96b30b 100644
--- a/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md
+++ b/mdop/agpm/approve-or-reject-a-pending-action-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Approve or Reject a Pending Action
 description: Approve or Reject a Pending Action
-author: jamiejdt
+author: dansimp
 ms.assetid: 6d78989a-b600-4876-9dd9-bc6207ff2ce7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -39,7 +42,7 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
     **Note**  
     If an Approver's e-mail address is included in the **To e-mail address** field on the **Domain** **Delegation** tab, the Approver will receive e-mail from the AGPM alias when an Editor or Reviewer submits a request.
 
-     
+     
 
 ### Additional considerations
 
@@ -49,9 +52,9 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
 
 -   [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md b/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md
index 474177c7f7..c03d30ec60 100644
--- a/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md
+++ b/mdop/agpm/approve-or-reject-a-pending-action-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Approve or Reject a Pending Action
 description: Approve or Reject a Pending Action
-author: jamiejdt
+author: dansimp
 ms.assetid: 078ea8b5-9ac5-45fc-9ac1-a1aa629c10b4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -39,7 +42,7 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
     **Note**  
     If an Approver's e-mail address is included in the **To e-mail address** field on the **Domain** **Delegation** tab, the Approver will receive e-mail from the AGPM alias when an Editor or Reviewer submits a request.
 
-     
+     
 
 ### Additional considerations
 
@@ -49,9 +52,9 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
 
 -   [Performing Approver Tasks](performing-approver-tasks-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/approve-or-reject-a-pending-action.md b/mdop/agpm/approve-or-reject-a-pending-action.md
index 27f53d2dd7..7d7dea9ee8 100644
--- a/mdop/agpm/approve-or-reject-a-pending-action.md
+++ b/mdop/agpm/approve-or-reject-a-pending-action.md
@@ -1,8 +1,11 @@
 ---
 title: Approve or Reject a Pending Action
 description: Approve or Reject a Pending Action
-author: jamiejdt
+author: dansimp
 ms.assetid: 22921a51-50fb-4a47-bec1-4f563f523675
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -39,7 +42,7 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
     **Note**  
     If an Approver's e-mail address is included in the **To** field on the **Domain** **Delegation** tab, the Approver will receive e-mail from the AGPM alias when an Editor or Reviewer submits a request.
 
-     
+     
 
 ### Additional considerations
 
@@ -49,9 +52,9 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
 
 -   [Performing Approver Tasks](performing-approver-tasks.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/back-up-the-archive-agpm40.md b/mdop/agpm/back-up-the-archive-agpm40.md
index 60d485f01f..af468e9671 100644
--- a/mdop/agpm/back-up-the-archive-agpm40.md
+++ b/mdop/agpm/back-up-the-archive-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Back Up the Archive
 description: Back Up the Archive
-author: jamiejdt
+author: dansimp
 ms.assetid: 538d85eb-3596-4c1d-bbd7-26bc28857c28
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -31,7 +34,7 @@ A user account that has access to both the AGPM Server—the computer on which t
 **Note**  
 If an AGPM Administrator backs up the archive infrequently, the Group Policy Objects (GPOs) in the archive backup will not be current. To better ensure that the archive backup is current, back up the archive as part of your organization’s daily backup strategy.
 
- 
+ 
 
 ### Additional references
 
@@ -41,9 +44,9 @@ If an AGPM Administrator backs up the archive infrequently, the Group Policy Obj
 
 -   [Managing the Archive](managing-the-archive-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/back-up-the-archive.md b/mdop/agpm/back-up-the-archive.md
index 806bb177d7..71c30b98c3 100644
--- a/mdop/agpm/back-up-the-archive.md
+++ b/mdop/agpm/back-up-the-archive.md
@@ -1,8 +1,11 @@
 ---
 title: Back Up the Archive
 description: Back Up the Archive
-author: jamiejdt
+author: dansimp
 ms.assetid: 400176da-3518-4475-ad19-c96cda6ca7ba
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -31,7 +34,7 @@ A user account that has access to both the AGPM Server—the computer on which t
 **Note**  
 If an AGPM Administrator backs up the archive infrequently, the Group Policy Objects (GPOs) in the archive backup will not be current. To better ensure that the archive backup is current, back up the archive as part of your organization’s daily backup strategy.
 
- 
+ 
 
 ### Additional references
 
@@ -41,9 +44,9 @@ If an AGPM Administrator backs up the archive infrequently, the Group Policy Obj
 
 -   [Managing the Archive](managing-the-archive.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/best-practices-for-version-control-agpm40.md b/mdop/agpm/best-practices-for-version-control-agpm40.md
index 67016e4bdd..59b5394a61 100644
--- a/mdop/agpm/best-practices-for-version-control-agpm40.md
+++ b/mdop/agpm/best-practices-for-version-control-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Best Practices for Version Control
 description: Best Practices for Version Control
-author: jamiejdt
+author: dansimp
 ms.assetid: 4a2a1ac7-67f3-4ba3-ab07-860d33da0efe
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/best-practices-for-version-control.md b/mdop/agpm/best-practices-for-version-control.md
index b8da8b24a4..e9e4d02c9b 100644
--- a/mdop/agpm/best-practices-for-version-control.md
+++ b/mdop/agpm/best-practices-for-version-control.md
@@ -1,8 +1,11 @@
 ---
 title: Best Practices for Version Control
 description: Best Practices for Version Control
-author: jamiejdt
+author: dansimp
 ms.assetid: 89067f6a-f7ea-4dad-999d-118284cf6c5a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/check-in-a-gpo-agpm30ops.md b/mdop/agpm/check-in-a-gpo-agpm30ops.md
index 4fb07fb8a5..f23e725ea1 100644
--- a/mdop/agpm/check-in-a-gpo-agpm30ops.md
+++ b/mdop/agpm/check-in-a-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Check In a GPO
 description: Check In a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 437397db-c94b-4940-b1a4-05442619ebee
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/check-in-a-gpo-agpm40.md b/mdop/agpm/check-in-a-gpo-agpm40.md
index 1798daa0f2..fb203386c7 100644
--- a/mdop/agpm/check-in-a-gpo-agpm40.md
+++ b/mdop/agpm/check-in-a-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Check In a GPO
 description: Check In a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: b838c8a2-eb9e-4e5b-8740-d7701a4294ac
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/check-in-a-gpo-approver.md b/mdop/agpm/check-in-a-gpo-approver.md
index 7ba8cd4232..7547a20849 100644
--- a/mdop/agpm/check-in-a-gpo-approver.md
+++ b/mdop/agpm/check-in-a-gpo-approver.md
@@ -1,8 +1,11 @@
 ---
 title: Check In a GPO
 description: Check In a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: e428cfff-651f-4903-bf01-d742714d2fa9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md b/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md
index 562fcda87a..f04859c49f 100644
--- a/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md
+++ b/mdop/agpm/checklist-administer-the-agpm-server-and-archive-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Checklist Administer the AGPM Server and Archive
 description: Checklist Administer the AGPM Server and Archive
-author: jamiejdt
+author: dansimp
 ms.assetid: d9c60203-90c2-48a7-9318-197e0ec5038b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -30,17 +33,17 @@ In Advanced Group Policy Management (AGPM), both the AGPM Service and the archiv
 
 
 
            Delegate access to Group Policy Objects (GPOs) in the archive.
            
-
            [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm40.md)
            
-
            [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md)
            
+
            Delegate Domain-Level Access to the Archive
            
+
            Delegate Access to an Individual GPO in the Archive
            
 
 
 
            Back up the archive to enable disaster recovery.
            
-
            [Back Up the Archive](back-up-the-archive-agpm40.md)
            
+
            Back Up the Archive
            
 
 
 
 
- 
+ 
 
 @@ -56,33 +59,33 @@ In Advanced Group Policy Management (AGPM), both the AGPM Service and the archiv
 
-
+
-
+
-
+
-
+
            
 

 
            
 
            Restore the archive from a backup to recover from a disaster.
            [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md)
            Restore the Archive from a Backup
            		
 
            
 
            
 
            Move the AGPM Service, the archive, or both to a different server.
            [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive-agpm40.md)
            Move the AGPM Server and the Archive
            		
 
            
 
            
 
            Change the archive path, the AGPM Service Account, or the port on which the AGPM Service listens.
            [Modify the AGPM Service](modify-the-agpm-service-agpm40.md)
            Modify the AGPM Service
            		
 
            
 
            
 
            Troubleshoot common problems with the AGPM Server.
            [Troubleshooting AGPM](troubleshooting-agpm-agpm40.md)
            
-
            [Configure Logging and Tracing](configure-logging-and-tracing-agpm40.md)
            Troubleshooting AGPM
            
+
            Configure Logging and Tracing
            		
 
            
             
 
            
 
- 
+ 
 
 ### Additional references
 
 -   [Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md b/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md
index 2ed6942664..ff4a199b6e 100644
--- a/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md
+++ b/mdop/agpm/checklist-administer-the-agpm-server-and-archive.md
@@ -1,8 +1,11 @@
 ---
 title: Checklist Administer the AGPM Server and Archive
 description: Checklist Administer the AGPM Server and Archive
-author: jamiejdt
+author: dansimp
 ms.assetid: 0b2eb536-c3cc-462f-a42f-27a53f57bc55
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -30,17 +33,17 @@ In Advanced Group Policy Management (AGPM), both the AGPM Service and the archiv
 
 
 
            Delegate access to Group Policy Objects (GPOs) in the archive.
            
-
            [Delegate Domain-Level Access to the Archive](delegate-domain-level-access-to-the-archive-agpm30ops.md)
            
-
            [Delegate Access to an Individual GPO in the Archive](delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md)
            
+
            Delegate Domain-Level Access to the Archive
            
+
            Delegate Access to an Individual GPO in the Archive
            
 
 
 
            Back up the archive to enable disaster recovery.
            
-
            [Back Up the Archive](back-up-the-archive.md)
            
+
            Back Up the Archive
            
 
 
 
 
- 
+ 
 
 @@ -56,33 +59,33 @@ In Advanced Group Policy Management (AGPM), both the AGPM Service and the archiv
 
-
+
-
+
-
+
-
+
            
 

 
            
 
            Restore the archive from a backup to recover from a disaster.
            [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md)
            Restore the Archive from a Backup
            		
 
            
 
            
 
            Move the AGPM Service, the archive, or both to a different server.
            [Move the AGPM Server and the Archive](move-the-agpm-server-and-the-archive.md)
            Move the AGPM Server and the Archive
            		
 
            
 
            
 
            Change the archive path, the AGPM Service Account, or the port on which the AGPM Service listens.
            [Modify the AGPM Service](modify-the-agpm-service-agpm30ops.md)
            Modify the AGPM Service
            		
 
            
 
            
 
            Troubleshoot common problems with the AGPM Server.
            [Troubleshooting Advanced Group Policy Management](troubleshooting-advanced-group-policy-management-agpm30ops.md)
            
-
            [Configure Logging and Tracing](configure-logging-and-tracing-agpm30ops.md)
            Troubleshooting Advanced Group Policy Management
            
+
            Configure Logging and Tracing
            		
 
            
             
 
            
 
- 
+ 
 
 ### Additional references
 
 -   [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md
index 2c39dedabf..5c37765df2 100644
--- a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md
+++ b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Checklist Create, Edit, and Deploy a GPO
 description: Checklist Create, Edit, and Deploy a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: a7a17706-304a-4455-9ada-52508ec620f1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -30,41 +33,41 @@ In an environment where multiple people make changes to Group Policy Objects (GP
 
 
 
            Editor requests the creation of a new GPO or an Approver creates a new GPO.
            
-
            [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md)
            
-
            [Create a New Controlled GPO](create-a-new-controlled-gpo-agpm30ops.md)
            
+
            Request the Creation of a New Controlled GPO
            
+
            Create a New Controlled GPO
            
 
 
 
            Approver approves the creation of the GPO if it was requested by an Editor.
            
-
            [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm30ops.md)
            
+
            Approve or Reject a Pending Action
            
 
 
 
            Editor checks out a copy of the GPO from the archive, so no one else can modify the GPO. Editor makes changes to the GPO, and then checks the modified GPO into the archive.
            
-
            [Edit a GPO Offline](edit-a-gpo-offline-agpm30ops.md)
            
+
            Edit a GPO Offline
            
 
 
 
            Editor requests deployment of the GPO to the production environment.
            
-
            [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm30ops.md)
            
+
            Request Deployment of a GPO
            
 
 
 
            Reviewers, such as Approvers or Editors, analyze the GPO.
            
-
            [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md)
            
+
            Performing Reviewer Tasks
            
 
 
 
            Approver approves and deploys the GPO to the production environment or rejects the GPO.
            
-
            [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm30ops.md)
            
+
            Approve or Reject a Pending Action
            
 
 
 
 
- 
+ 
 
 ### Additional references
 
 [Operations Guide for Microsoft Advanced Group Policy Management 3.0](operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md
index c4ca4f9cc3..7df4177133 100644
--- a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md
+++ b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Checklist Create, Edit, and Deploy a GPO
 description: Checklist Create, Edit, and Deploy a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 44631bed-16d2-4b5a-af70-17a73fb5f6af
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -30,45 +33,45 @@ In an environment where multiple people change Group Policy Objects (GPOs) by us
 
 
 
            Editor requests that a new GPO be created or an Approver creates a new GPO.
            
-
            [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm40.md)
            
-
            [Create a New Controlled GPO](create-a-new-controlled-gpo-agpm40.md)
            
+
            Request the Creation of a New Controlled GPO
            
+
            Create a New Controlled GPO
            
 
 
 
            Approver approves the creation of the GPO if it was requested by an Editor.
            
-
            [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm40.md)
            
+
            Approve or Reject a Pending Action
            
 
 
 
            Editor checks out a copy of the GPO from the archive so that no one else can modify the GPO. Editor makes changes to the GPO, and then checks the modified GPO into the archive.
            
-
            [Edit a GPO Offline](edit-a-gpo-offline-agpm40.md)
            
+
            Edit a GPO Offline
            
 
 
 
            If developing in a test forest, Editor exports the GPO to a file, transfers the file to the production forest, and imports the file. Additionally, an Editor can link the GPO to an organizational unit that contains test computers and users.
            
-
            [Using a Test Environment](using-a-test-environment.md)
            
+
            Using a Test Environment
            
 
 
 
            Editor requests deployment of the GPO to the production environment of the domain.
            
-
            [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm40.md)
            
+
            Request Deployment of a GPO
            
 
 
 
            Reviewers, such as Approvers or Editors, analyze the GPO.
            
-
            [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md)
            
+
            Performing Reviewer Tasks
            
 
 
 
            Approver approves and deploys the GPO to the production environment of the domain or rejects the GPO.
            
-
            [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm40.md)
            
+
            Approve or Reject a Pending Action
            
 
 
 
 
- 
+ 
 
 ### Additional references
 
 [Advanced Group Policy Management 4.0](advanced-group-policy-management-40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md
index 83af28fa98..a6b860cc5d 100644
--- a/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md
+++ b/mdop/agpm/checklist-create-edit-and-deploy-a-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Checklist Create, Edit, and Deploy a GPO
 description: Checklist Create, Edit, and Deploy a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 614e2d9a-c18b-4f62-99fd-e17a2ac8559d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -30,37 +33,37 @@ In an environment where multiple people make changes to Group Policy objects (GP
 
 
 
            Editor requests the creation of a new GPO or an Approver creates a new GPO.
            
-
            [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md)
            
-
            [Create a New Controlled GPO](create-a-new-controlled-gpo.md)
            
+
            Request the Creation of a New Controlled GPO
            
+
            Create a New Controlled GPO
            
 
 
 
            Approver approves the creation of the GPO if it was requested by an Editor.
            
-
            [Approve or Reject a Pending Action](approve-or-reject-a-pending-action.md)
            
+
            Approve or Reject a Pending Action
            
 
 
 
            Editor checks out a copy of the GPO from the archive, so no one else can modify the GPO. Editor makes changes to the GPO, and then checks the modified GPO into the archive.
            
-
            [Edit a GPO Offline](edit-a-gpo-offline.md)
            
+
            Edit a GPO Offline
            
 
 
 
            Editor requests deployment of the GPO to the production environment.
            
-
            [Request Deployment of a GPO](request-deployment-of-a-gpo.md)
            
+
            Request Deployment of a GPO
            
 
 
 
            Reviewers, such as Approvers or Editors, analyze the GPO.
            
-
            [Performing Reviewer Tasks](performing-reviewer-tasks.md)
            
+
            Performing Reviewer Tasks
            
 
 
 
            Approver approves and deploys the GPO to the production environment or rejects the GPO.
            
-
            [Approve or Reject a Pending Action](approve-or-reject-a-pending-action.md)
            
+
            Approve or Reject a Pending Action
            
 
 
 
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/choosing-which-version-of-agpm-to-install.md b/mdop/agpm/choosing-which-version-of-agpm-to-install.md
index beaa0c8299..792101fd83 100644
--- a/mdop/agpm/choosing-which-version-of-agpm-to-install.md
+++ b/mdop/agpm/choosing-which-version-of-agpm-to-install.md
@@ -1,8 +1,11 @@
 ---
 title: Choosing Which Version of AGPM to Install
 description: Choosing Which Version of AGPM to Install
-author: jamiejdt
+author: dansimp
 ms.assetid: 31357d2a-bc23-4e15-93f4-0beda8ab7a7b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -53,7 +56,7 @@ Table 1 lists the operating systems on which you can install AGPM 4.0 SP3, and
 
 
            Windows Server 2012 R2
            
 
            Windows 10
            
-
            Supported with the caveats outlined in [KB 4015786](https://support.microsoft.com/help/4015786/known-issues-managing-a-windows-10-group-policy-client-in-windows-serv)
+
            Supported with the caveats outlined in KB 4015786
 
            
 
 
@@ -89,7 +92,7 @@ Table 1 lists the operating systems on which you can install AGPM 4.0 SP3, and
 
 
 
- 
+ 
 
 ## AGPM 4.0 SP2
 
@@ -147,7 +150,7 @@ Table 1 lists the operating systems on which you can install AGPM 4.0 SP2, and
 
 
 
- 
+ 
 
 ## AGPM 4.0 SP1
 
@@ -198,7 +201,7 @@ Table 2 lists the operating systems on which you can install AGPM 4.0 SP1, and t
 
 
 
- 
+ 
 
 ## AGPM 4.0
 
@@ -244,7 +247,7 @@ Table 3 lists the operating systems on which you can install AGPM 4.0, and the p
 
 
 
- 
+ 
 
 ## Versions of AGPM that precede AGPM 4.0
 
@@ -284,7 +287,7 @@ Table 4 lists the operating systems on which you can install the versions of AGP
 
 
 
- 
+ 
 
 ## How to Get MDOP Technologies
 
@@ -296,9 +299,9 @@ AGPM 4.0 SP2 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP i
 
 [Advanced Group Policy Management](index.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/common-secondary-tab-features.md b/mdop/agpm/common-secondary-tab-features.md
index f297a49673..b54804d0eb 100644
--- a/mdop/agpm/common-secondary-tab-features.md
+++ b/mdop/agpm/common-secondary-tab-features.md
@@ -1,8 +1,11 @@
 ---
 title: Common Secondary Tab Features
 description: Common Secondary Tab Features
-author: jamiejdt
+author: dansimp
 ms.assetid: 44a15c28-944c-49c1-8534-115ce1c362ed
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configure-agpm-server-connections-agpm30ops.md b/mdop/agpm/configure-agpm-server-connections-agpm30ops.md
index 7ab152e0f9..01c078c958 100644
--- a/mdop/agpm/configure-agpm-server-connections-agpm30ops.md
+++ b/mdop/agpm/configure-agpm-server-connections-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Configure AGPM Server Connections
 description: Configure AGPM Server Connections
-author: jamiejdt
+author: dansimp
 ms.assetid: 6062b77b-2fd7-442c-ad1b-6f14419ebd5f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configure-agpm-server-connections-agpm40.md b/mdop/agpm/configure-agpm-server-connections-agpm40.md
index a9bccdb1a0..c41c27ec1a 100644
--- a/mdop/agpm/configure-agpm-server-connections-agpm40.md
+++ b/mdop/agpm/configure-agpm-server-connections-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Configure AGPM Server Connections
 description: Configure AGPM Server Connections
-author: jamiejdt
+author: dansimp
 ms.assetid: bbbb15e8-35e7-403c-b695-7a6ebeb87839
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configure-an-agpm-server-connection-agpm40.md b/mdop/agpm/configure-an-agpm-server-connection-agpm40.md
index 8ff9375089..3fec7b9300 100644
--- a/mdop/agpm/configure-an-agpm-server-connection-agpm40.md
+++ b/mdop/agpm/configure-an-agpm-server-connection-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Configure an AGPM Server Connection
 description: Configure an AGPM Server Connection
-author: jamiejdt
+author: dansimp
 ms.assetid: 409cbbcf-3b0e-459d-9bd2-75cb7b9430b0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md b/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md
index 9649ce9235..196bbbed79 100644
--- a/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md
+++ b/mdop/agpm/configure-an-agpm-server-connection-reviewer-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Configure an AGPM Server Connection
 description: Configure an AGPM Server Connection
-author: jamiejdt
+author: dansimp
 ms.assetid: ae78dc74-111d-4509-b0a6-e8b8b451c22a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configure-e-mail-notification-agpm30ops.md b/mdop/agpm/configure-e-mail-notification-agpm30ops.md
index b32a73989a..7a4f5887a8 100644
--- a/mdop/agpm/configure-e-mail-notification-agpm30ops.md
+++ b/mdop/agpm/configure-e-mail-notification-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Configure E-Mail Notification
 description: Configure E-Mail Notification
-author: jamiejdt
+author: dansimp
 ms.assetid: b32ce395-d1b9-4c5b-b765-97cdbf455f9e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configure-e-mail-notification-agpm40.md b/mdop/agpm/configure-e-mail-notification-agpm40.md
index fda5fd5e5b..19f24e340c 100644
--- a/mdop/agpm/configure-e-mail-notification-agpm40.md
+++ b/mdop/agpm/configure-e-mail-notification-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Configure E-Mail Notification
 description: Configure E-Mail Notification
-author: jamiejdt
+author: dansimp
 ms.assetid: 06f19556-f296-4a80-86a4-4f446c992204
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configure-e-mail-notification.md b/mdop/agpm/configure-e-mail-notification.md
index d8dd656865..7bda0b1a9c 100644
--- a/mdop/agpm/configure-e-mail-notification.md
+++ b/mdop/agpm/configure-e-mail-notification.md
@@ -1,8 +1,11 @@
 ---
 title: Configure E-Mail Notification
 description: Configure E-Mail Notification
-author: jamiejdt
+author: dansimp
 ms.assetid: 6e152de0-4376-4963-8d1a-3e7f5866d30f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md b/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md
index 8d319e968d..ed184df8d5 100644
--- a/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md
+++ b/mdop/agpm/configure-e-mail-security-for-agpm-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Configure E-Mail Security for AGPM
 description: Configure E-Mail Security for AGPM
-author: jamiejdt
+author: dansimp
 ms.assetid: 4850ed8e-a1c6-43f0-95c5-853aa66a94ae
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -21,7 +24,7 @@ By encrypting AGPM e-mail notifications, you can better protect those that could
 **Caution**  
 Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.
 
- 
+ 
 
 A user account that has the AGPM Administrator (Full Control) role, the user account of the Approver who created the Group Policy Object (GPO) used in these procedures, or a user account that has the necessary permissions in AGPM is required to complete these procedures. Review the details in "Additional considerations" in this topic.
 
@@ -79,9 +82,9 @@ A user account that has the AGPM Administrator (Full Control) role, the user acc
 
 -   [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md b/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md
index 085ba098d9..6b62a3bc2a 100644
--- a/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md
+++ b/mdop/agpm/configure-e-mail-security-for-agpm-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Configure E-Mail Security for AGPM
 description: Configure E-Mail Security for AGPM
-author: jamiejdt
+author: dansimp
 ms.assetid: b9c48894-0a10-4d03-8027-50ed3b02485a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -21,7 +24,7 @@ By encrypting AGPM e-mail notifications, you can better protect those that could
 **Caution**  
 Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.
 
- 
+ 
 
 A user account that has the AGPM Administrator (Full Control) role, the user account of the Approver who created the Group Policy Object (GPO) used in these procedures, or a user account that has the necessary permissions in AGPM is required to complete these procedures. Review the details in "Additional considerations" in this topic.
 
@@ -75,9 +78,9 @@ A user account that has the AGPM Administrator (Full Control) role, the user acc
 
 -   [Configuring Advanced Group Policy Management](configuring-advanced-group-policy-management-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/configure-logging-and-tracing-agpm30ops.md b/mdop/agpm/configure-logging-and-tracing-agpm30ops.md
index b3303207e4..dd666e4815 100644
--- a/mdop/agpm/configure-logging-and-tracing-agpm30ops.md
+++ b/mdop/agpm/configure-logging-and-tracing-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Configure Logging and Tracing
 description: Configure Logging and Tracing
-author: jamiejdt
+author: dansimp
 ms.assetid: 4f89552f-e949-48b0-9325-23746034eaa4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configure-logging-and-tracing-agpm40.md b/mdop/agpm/configure-logging-and-tracing-agpm40.md
index 132144d8f4..c1e150c7bd 100644
--- a/mdop/agpm/configure-logging-and-tracing-agpm40.md
+++ b/mdop/agpm/configure-logging-and-tracing-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Configure Logging and Tracing
 description: Configure Logging and Tracing
-author: jamiejdt
+author: dansimp
 ms.assetid: 2418cb6a-7189-4080-8fe2-9c8d47dec62c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configure-logging-and-tracing.md b/mdop/agpm/configure-logging-and-tracing.md
index 1cc6c31f8d..8f9b6b9e07 100644
--- a/mdop/agpm/configure-logging-and-tracing.md
+++ b/mdop/agpm/configure-logging-and-tracing.md
@@ -1,8 +1,11 @@
 ---
 title: Configure Logging and Tracing
 description: Configure Logging and Tracing
-author: jamiejdt
+author: dansimp
 ms.assetid: 419231f9-e9db-4f91-a7cf-a0a73db25256
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -48,7 +51,7 @@ A user account with the AGPM Administrator (Full Control) role, the user account
 
 ### Additional considerations
 
--   You must be able to edit and deploy a GPO to confige AGPM logging and tracing. See [Editing a GPO](editing-a-gpo.md) and [Deploy a GPO](deploy-a-gpo.md) for additional detail.
+-   You must be able to edit and deploy a GPO to configure AGPM logging and tracing. See [Editing a GPO](editing-a-gpo.md) and [Deploy a GPO](deploy-a-gpo.md) for additional detail.
 
 ### Additional references
 
diff --git a/mdop/agpm/configure-the-agpm-server-connection-reviewer.md b/mdop/agpm/configure-the-agpm-server-connection-reviewer.md
index d63d53eabf..ba9b7f9381 100644
--- a/mdop/agpm/configure-the-agpm-server-connection-reviewer.md
+++ b/mdop/agpm/configure-the-agpm-server-connection-reviewer.md
@@ -1,8 +1,11 @@
 ---
 title: Configure the AGPM Server Connection
 description: Configure the AGPM Server Connection
-author: jamiejdt
+author: dansimp
 ms.assetid: 74e8f348-a8ed-4d69-a8e0-9c974aaeca2d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configure-the-agpm-server-connection.md b/mdop/agpm/configure-the-agpm-server-connection.md
index c0b5da3de9..a6322bd687 100644
--- a/mdop/agpm/configure-the-agpm-server-connection.md
+++ b/mdop/agpm/configure-the-agpm-server-connection.md
@@ -1,8 +1,11 @@
 ---
 title: Configure the AGPM Server Connection
 description: Configure the AGPM Server Connection
-author: jamiejdt
+author: dansimp
 ms.assetid: 9a42b5bc-41be-44ef-a6e2-6f56e2cf1996
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md b/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md
index 077db2091e..837ee68502 100644
--- a/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md
+++ b/mdop/agpm/configuring-advanced-group-policy-management-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Configuring Advanced Group Policy Management
 description: Configuring Advanced Group Policy Management
-author: jamiejdt
+author: dansimp
 ms.assetid: 8c978ddf-2789-44e4-9c08-de7b4cd1afa0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/configuring-advanced-group-policy-management.md b/mdop/agpm/configuring-advanced-group-policy-management.md
index 60127ea9bf..2617957e16 100644
--- a/mdop/agpm/configuring-advanced-group-policy-management.md
+++ b/mdop/agpm/configuring-advanced-group-policy-management.md
@@ -1,8 +1,11 @@
 ---
 title: Configuring Advanced Group Policy Management
 description: Configuring Advanced Group Policy Management
-author: jamiejdt
+author: dansimp
 ms.assetid: 836f4a49-2c77-4f6b-8727-9df7ef443141
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/contents-tab-agpm30ops.md b/mdop/agpm/contents-tab-agpm30ops.md
index c5234d71fa..4e3f28a7a2 100644
--- a/mdop/agpm/contents-tab-agpm30ops.md
+++ b/mdop/agpm/contents-tab-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Contents Tab
 description: Contents Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 6ada6430-cd93-47aa-af6e-d7f5b5620132
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/contents-tab-agpm40.md b/mdop/agpm/contents-tab-agpm40.md
index 811b6c62e2..695acca3e9 100644
--- a/mdop/agpm/contents-tab-agpm40.md
+++ b/mdop/agpm/contents-tab-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Contents Tab
 description: Contents Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: cf9d1f17-3c3d-422f-bd6b-3db87be45554
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/contents-tab-features-agpm30ops.md b/mdop/agpm/contents-tab-features-agpm30ops.md
index a1e68588b4..b902fc0724 100644
--- a/mdop/agpm/contents-tab-features-agpm30ops.md
+++ b/mdop/agpm/contents-tab-features-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Contents Tab Features
 description: Contents Tab Features
-author: jamiejdt
+author: dansimp
 ms.assetid: 725f025a-c30a-4d07-add1-4e0ed9a1a5fd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/contents-tab-features-agpm40.md b/mdop/agpm/contents-tab-features-agpm40.md
index 3857c71a43..7b909fc508 100644
--- a/mdop/agpm/contents-tab-features-agpm40.md
+++ b/mdop/agpm/contents-tab-features-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Contents Tab Features
 description: Contents Tab Features
-author: jamiejdt
+author: dansimp
 ms.assetid: f1f4849d-bf94-47d5-ad81-0eee33abcaca
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/contents-tab.md b/mdop/agpm/contents-tab.md
index 9eb8c4ba87..4d154e05f6 100644
--- a/mdop/agpm/contents-tab.md
+++ b/mdop/agpm/contents-tab.md
@@ -1,8 +1,11 @@
 ---
 title: Contents Tab
 description: Contents Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 8a756bc1-3900-4d83-93c4-7ebc4705d956
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/control-a-previously-uncontrolled-gpo.md b/mdop/agpm/control-a-previously-uncontrolled-gpo.md
index 5792fd6292..6932d224a9 100644
--- a/mdop/agpm/control-a-previously-uncontrolled-gpo.md
+++ b/mdop/agpm/control-a-previously-uncontrolled-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Control a Previously Uncontrolled GPO
 description: Control a Previously Uncontrolled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 452689a9-4e32-4e3b-8208-56353a82bf36
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md b/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md
index 84a851641f..87d980d262 100644
--- a/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md
+++ b/mdop/agpm/control-an-uncontrolled-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Control an Uncontrolled GPO
 description: Control an Uncontrolled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 603f00f9-1e65-4b2f-902a-e53dafedbd8d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md b/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md
index 5f0fe6fb4f..438609f31c 100644
--- a/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md
+++ b/mdop/agpm/control-an-uncontrolled-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Control an Uncontrolled GPO
 description: Control an Uncontrolled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: dc81545c-8da5-4b6f-b266-f01a82e27c6b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/controlled-gpo-commands-agpm30ops.md b/mdop/agpm/controlled-gpo-commands-agpm30ops.md
index c4a51bc0d8..494e7b2c47 100644
--- a/mdop/agpm/controlled-gpo-commands-agpm30ops.md
+++ b/mdop/agpm/controlled-gpo-commands-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Controlled GPO Commands
 description: Controlled GPO Commands
-author: jamiejdt
+author: dansimp
 ms.assetid: 82db4772-154a-4a8d-99cd-2c69e1738698
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/controlled-gpo-commands-agpm40.md b/mdop/agpm/controlled-gpo-commands-agpm40.md
index d62fee921d..38253ca7d8 100644
--- a/mdop/agpm/controlled-gpo-commands-agpm40.md
+++ b/mdop/agpm/controlled-gpo-commands-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Controlled GPO Commands
 description: Controlled GPO Commands
-author: jamiejdt
+author: dansimp
 ms.assetid: 370d3db9-4efc-4799-983d-e29ba5f32b07
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/controlled-tab.md b/mdop/agpm/controlled-tab.md
index 84e99c288c..64d9853749 100644
--- a/mdop/agpm/controlled-tab.md
+++ b/mdop/agpm/controlled-tab.md
@@ -1,8 +1,11 @@
 ---
 title: Controlled Tab
 description: Controlled Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 8995a9e1-ace4-40b7-a47b-e1e9924541ba
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md b/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md
index 23d11c7fd7..2b6c82070c 100644
--- a/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md
+++ b/mdop/agpm/create-a-new-controlled-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Create a New Controlled GPO
 description: Create a New Controlled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: f89eaae8-7858-4222-ba3f-a93a9d7ea5a3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/create-a-new-controlled-gpo-agpm40.md b/mdop/agpm/create-a-new-controlled-gpo-agpm40.md
index 2a6df8279f..e688f80ebc 100644
--- a/mdop/agpm/create-a-new-controlled-gpo-agpm40.md
+++ b/mdop/agpm/create-a-new-controlled-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Create a New Controlled GPO
 description: Create a New Controlled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 5ce760f6-9f05-42b4-b787-7835ab8e324e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/create-a-new-controlled-gpo.md b/mdop/agpm/create-a-new-controlled-gpo.md
index 60a6bed93a..dc4d11b70b 100644
--- a/mdop/agpm/create-a-new-controlled-gpo.md
+++ b/mdop/agpm/create-a-new-controlled-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Create a New Controlled GPO
 description: Create a New Controlled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: b43ce0f4-4519-4278-83c4-c7d5163ddd11
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/create-a-template-agpm30ops.md b/mdop/agpm/create-a-template-agpm30ops.md
index 523db2a41f..0af27e71f6 100644
--- a/mdop/agpm/create-a-template-agpm30ops.md
+++ b/mdop/agpm/create-a-template-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Create a Template
 description: Create a Template
-author: jamiejdt
+author: dansimp
 ms.assetid: 8208f14a-5c18-43a7-8564-118230398cca
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ Creating a template enables you to save all of the settings of a particular vers
 **Note**  
 A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs.
 
- 
+ 
 
 A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic.
 
@@ -49,9 +52,9 @@ A user account with the Editor or AGPM Administrator (Full Control) role or nece
 
 -   [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/create-a-template-agpm40.md b/mdop/agpm/create-a-template-agpm40.md
index ae35953dbe..bb0d209a5b 100644
--- a/mdop/agpm/create-a-template-agpm40.md
+++ b/mdop/agpm/create-a-template-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Create a Template
 description: Create a Template
-author: jamiejdt
+author: dansimp
 ms.assetid: b38423af-7d24-437a-98bc-01f1ae891127
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ Creating a template enables you to save all of the settings of a particular vers
 **Note**  
 A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs.
 
- 
+ 
 
 A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic.
 
@@ -49,9 +52,9 @@ A user account with the Editor or AGPM Administrator (Full Control) role or nece
 
 -   [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/create-a-template.md b/mdop/agpm/create-a-template.md
index 85086f3c40..f25308b5ea 100644
--- a/mdop/agpm/create-a-template.md
+++ b/mdop/agpm/create-a-template.md
@@ -1,8 +1,11 @@
 ---
 title: Create a Template
 description: Create a Template
-author: jamiejdt
+author: dansimp
 ms.assetid: 6992bd55-4a4f-401f-9815-c468bac598ef
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ Creating a template enables you to save all of the settings of a particular vers
 **Note**  
 A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs.
 
- 
+ 
 
 A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic.
 
@@ -49,9 +52,9 @@ A user account with the Editor or AGPM Administrator (Full Control) role or nece
 
 -   [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md b/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md
index 013d0aa730..946f6e4a3c 100644
--- a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md
+++ b/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Creating a Template and Setting a Default Template
 description: Creating a Template and Setting a Default Template
-author: jamiejdt
+author: dansimp
 ms.assetid: acce0e0f-7e67-479c-9daa-e678fccd7ced
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -31,15 +34,15 @@ Some potential uses for a template include the following:
 **Note**  
 A template is a static version of a GPO that cannot be edited, yet can be used as a starting point for creating new, editable GPOs. Renaming or deleting a template does not affect GPOs created from that template.
 
- 
+ 
 
 -   [Create a Template](create-a-template-agpm30ops.md)
 
 -   [Set a Default Template](set-a-default-template-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md b/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md
index e90e3cfb7d..7b81b2a43d 100644
--- a/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md
+++ b/mdop/agpm/creating-a-template-and-setting-a-default-template-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Creating a Template and Setting a Default Template
 description: Creating a Template and Setting a Default Template
-author: jamiejdt
+author: dansimp
 ms.assetid: ffa72c2a-64eb-4492-8072-c3a66179b546
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -31,15 +34,15 @@ Some potential uses for a template include the following:
 **Note**  
 A template is a static version of a GPO that cannot be edited, yet can be used as a starting point for creating new, editable GPOs. Renaming or deleting a template does not affect GPOs created from that template.
 
- 
+ 
 
 -   [Create a Template](create-a-template-agpm40.md)
 
 -   [Set a Default Template](set-a-default-template-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/creating-a-template-and-setting-a-default-template.md b/mdop/agpm/creating-a-template-and-setting-a-default-template.md
index c3fca70641..049e02aff3 100644
--- a/mdop/agpm/creating-a-template-and-setting-a-default-template.md
+++ b/mdop/agpm/creating-a-template-and-setting-a-default-template.md
@@ -1,8 +1,11 @@
 ---
 title: Creating a Template and Setting a Default Template
 description: Creating a Template and Setting a Default Template
-author: jamiejdt
+author: dansimp
 ms.assetid: 8771b4b5-4dea-4be1-a675-f60cfd3ec5dc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,15 +22,15 @@ Creating a template enables you to save all of the settings of a particular vers
 **Note**  
 A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs. Renaming or deleting a template does not impact GPOs created from that template.
 
- 
+ 
 
 -   [Create a Template](create-a-template.md)
 
 -   [Set a Default Template](set-a-default-template.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md
index 4351376c13..5415bea6ec 100644
--- a/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md
+++ b/mdop/agpm/creating-controlling-or-importing-a-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Creating, Controlling, or Importing a GPO
 description: Creating, Controlling, or Importing a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: ce8b232e-7758-4a6a-9e2f-18967da6cdad
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md
index 8e8318dfa6..99e2495711 100644
--- a/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md
+++ b/mdop/agpm/creating-controlling-or-importing-a-gpo-approver.md
@@ -1,8 +1,11 @@
 ---
 title: Creating, Controlling, or Importing a GPO
 description: Creating, Controlling, or Importing a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: f2c8bef5-b654-4864-99d4-9207cfb0a137
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md
index e77b422bee..489ce5e692 100644
--- a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md
+++ b/mdop/agpm/creating-controlling-or-importing-a-gpo-editor-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Creating, Controlling, or Importing a GPO
 description: Creating, Controlling, or Importing a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 0cc1b6ee-3335-4d84-9e1c-d1aefabfef51
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md b/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md
index 0de3c626cd..39ac25e986 100644
--- a/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md
+++ b/mdop/agpm/creating-controlling-or-importing-a-gpo-editor.md
@@ -1,8 +1,11 @@
 ---
 title: Creating, Controlling, or Importing a GPO
 description: Creating, Controlling, or Importing a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 5259ce25-f570-4346-9f50-6b051724a998
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md b/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md
index 11940e0f01..2206a562b7 100644
--- a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md
+++ b/mdop/agpm/creating-or-controlling-a-gpo-agpm40-app.md
@@ -1,8 +1,11 @@
 ---
 title: Creating or Controlling a GPO
 description: Creating or Controlling a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: ca2fa40e-c6e9-4c57-9da1-e5375df4a2fd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md b/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md
index f03ca5f277..37b7564e65 100644
--- a/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md
+++ b/mdop/agpm/creating-or-controlling-a-gpo-agpm40-ed.md
@@ -1,8 +1,11 @@
 ---
 title: Creating or Controlling a GPO
 description: Creating or Controlling a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 807f3b3f-ad3d-4851-9772-7f54a065632a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/delegate-access-to-a-gpo.md b/mdop/agpm/delegate-access-to-a-gpo.md
index 1fd37f74fb..86bb7646c4 100644
--- a/mdop/agpm/delegate-access-to-a-gpo.md
+++ b/mdop/agpm/delegate-access-to-a-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Delegate Access to a GPO
 description: Delegate Access to a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: f1d6bb6c-d5bf-4080-a6cb-32774689f804
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md b/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md
index 7f01da9505..12617d0f27 100644
--- a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md
+++ b/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Delegate Access to an Individual GPO in the Archive
 description: Delegate Access to an Individual GPO in the Archive
-author: jamiejdt
+author: dansimp
 ms.assetid: 7b37b188-2b6b-4e52-be97-8ef899e9893b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -31,14 +34,14 @@ A user account with the AGPM Administrator (Full Control) role, the user account
         **Note**  
         If a user or group inherits domain-wide access, the **Remove** button is unavailable. You can modify domain-wide access on the **Domain Delegation** tab.
 
-         
+         
 
     3.  To modify the roles and permissions delegated to a user or group, click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and click **OK**.
 
         **Note**  
         Editor and Approver include Reviewer permissions.
 
-         
+         
 
 ### Additional considerations
 
@@ -54,9 +57,9 @@ A user account with the AGPM Administrator (Full Control) role, the user account
 
 -   [Managing the Archive](managing-the-archive.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md b/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md
index dadda27bb9..d8d548450f 100644
--- a/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md
+++ b/mdop/agpm/delegate-access-to-an-individual-gpo-in-the-archive-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Delegate Access to an Individual GPO in the Archive
 description: Delegate Access to an Individual GPO in the Archive
-author: jamiejdt
+author: dansimp
 ms.assetid: 284d2aa2-7c10-4ffa-8978-bbe30867c1c1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -31,14 +34,14 @@ A user account with the AGPM Administrator (Full Control) role, the user account
         **Note**  
         If a user or group inherits domain-wide access, the **Remove** button is unavailable. You can modify domain-wide access on the **Domain Delegation** tab.
 
-         
+         
 
     3.  To modify the roles and permissions delegated to a user or group, click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and click **OK**.
 
         **Note**  
         Editor and Approver include Reviewer permissions.
 
-         
+         
 
 ### Additional considerations
 
@@ -54,9 +57,9 @@ A user account with the AGPM Administrator (Full Control) role, the user account
 
 -   [Managing the Archive](managing-the-archive-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/delegate-access-to-an-individual-gpo.md b/mdop/agpm/delegate-access-to-an-individual-gpo.md
index c61abad081..ef1ebe53fa 100644
--- a/mdop/agpm/delegate-access-to-an-individual-gpo.md
+++ b/mdop/agpm/delegate-access-to-an-individual-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Delegate Access to an Individual GPO
 description: Delegate Access to an Individual GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: b2a7d550-14bf-4b41-b6e4-2cc091eedd2d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md b/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md
index 5ff92f7d83..6a0eaaf9c7 100644
--- a/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md
+++ b/mdop/agpm/delegate-access-to-the-production-environment-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Delegate Access to the Production Environment
 description: Delegate Access to the Production Environment
-author: jamiejdt
+author: dansimp
 ms.assetid: c1ebae2e-909b-4e64-b368-b7d3cc67b1eb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md b/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md
index 5e3952ae37..79476c9882 100644
--- a/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md
+++ b/mdop/agpm/delegate-access-to-the-production-environment-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Delegate Access to the Production Environment
 description: Delegate Access to the Production Environment
-author: jamiejdt
+author: dansimp
 ms.assetid: 4c670581-8c47-41ea-80eb-02846ff1ec1f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md b/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md
index ba47258fbd..367806c7ef 100644
--- a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md
+++ b/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Delegate Domain-Level Access to the Archive
 description: Delegate Domain-Level Access to the Archive
-author: jamiejdt
+author: dansimp
 ms.assetid: d232069e-71d5-4b4d-b22e-bef11de1cfd4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ A user account with the AGPM Administrator (Full Control) role or necessary perm
         **Note**  
         Editor and Approver include Reviewer permissions.
 
-         
+         
 
 ### Additional considerations
 
@@ -49,9 +52,9 @@ A user account with the AGPM Administrator (Full Control) role or necessary perm
 
 -   [Managing the Archive](managing-the-archive.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md b/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md
index b0b05042bf..2a6a673529 100644
--- a/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md
+++ b/mdop/agpm/delegate-domain-level-access-to-the-archive-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Delegate Domain-Level Access to the Archive
 description: Delegate Domain-Level Access to the Archive
-author: jamiejdt
+author: dansimp
 ms.assetid: 11ca1d40-4b5c-496e-8922-d01412717858
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ A user account with the AGPM Administrator (Full Control) role or necessary perm
         **Note**  
         Editor and Approver include Reviewer permissions.
 
-         
+         
 
 ### Additional considerations
 
@@ -49,9 +52,9 @@ A user account with the AGPM Administrator (Full Control) role or necessary perm
 
 -   [Managing the Archive](managing-the-archive-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/delegate-domain-level-access.md b/mdop/agpm/delegate-domain-level-access.md
index ff3f936cdb..3facfda7f0 100644
--- a/mdop/agpm/delegate-domain-level-access.md
+++ b/mdop/agpm/delegate-domain-level-access.md
@@ -1,8 +1,11 @@
 ---
 title: Delegate Domain-Level Access
 description: Delegate Domain-Level Access
-author: jamiejdt
+author: dansimp
 ms.assetid: 64c8e773-38cc-4991-9ed2-5a801094d06e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -29,7 +32,7 @@ A user account with the AGPM Administrator (Full Control) role or necessary perm
     **Note**  
     Editor and Approver include Reviewer permissions.
 
-     
+     
 
 4.  In the **Advanced Security Settings** dialog box, select a Group Policy administrator, and then click **Edit**.
 
@@ -53,9 +56,9 @@ A user account with the AGPM Administrator (Full Control) role or necessary perm
 
 -   [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md b/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md
index 89337b2164..20c4c7176a 100644
--- a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md
+++ b/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Delegate Management of a Controlled GPO
 description: Delegate Management of a Controlled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 509b02e7-ce0b-4919-b58a-c3a33051152e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -31,14 +34,14 @@ A user account with the AGPM Administrator (Full Control) role, the user account
         **Note**  
         If a user or group inherits domain-wide access, the **Remove** button is unavailable. You can modify domain-wide access on the **Domain Delegation** tab.
 
-         
+         
 
     3.  To modify the roles and permissions delegated to a user or group, click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and then click **OK**.
 
         **Note**  
         Editor and Approver include Reviewer permissions.
 
-         
+         
 
 ### Additional considerations
 
@@ -52,9 +55,9 @@ A user account with the AGPM Administrator (Full Control) role, the user account
 
 -   [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md b/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md
index a83b6f5347..6401b24ac5 100644
--- a/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md
+++ b/mdop/agpm/delegate-management-of-a-controlled-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Delegate Management of a Controlled GPO
 description: Delegate Management of a Controlled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 96b4bfb3-5657-4267-8326-85d7a0db87ce
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -31,14 +34,14 @@ A user account with the AGPM Administrator (Full Control) role, the user account
         **Note**  
         If a user or group inherits domain-wide access, the **Remove** button is unavailable. You can modify domain-wide access on the **Domain Delegation** tab.
 
-         
+         
 
     3.  To modify the roles and permissions delegated to a user or group, click the **Advanced** button. In the **Permissions** dialog box, select the user or group, select the check box for each role to be assigned to that user or group, and then click **OK**.
 
         **Note**  
         Editor and Approver include Reviewer permissions.
 
-         
+         
 
 ### Additional considerations
 
@@ -52,9 +55,9 @@ A user account with the AGPM Administrator (Full Control) role, the user account
 
 -   [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-app.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md b/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md
index 087950b66f..15a7b0ca84 100644
--- a/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md
+++ b/mdop/agpm/delete-a-controlled-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Delete a Controlled GPO
 description: Delete a Controlled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: f51c1737-c116-4faf-a6f6-c72303f60a3b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/delete-a-controlled-gpo-agpm40.md b/mdop/agpm/delete-a-controlled-gpo-agpm40.md
index 0629e33eef..df8fd91963 100644
--- a/mdop/agpm/delete-a-controlled-gpo-agpm40.md
+++ b/mdop/agpm/delete-a-controlled-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Delete a Controlled GPO
 description: Delete a Controlled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 2a461018-aa0b-4ae3-b079-efc554ca4a3d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/delete-a-gpo-approver.md b/mdop/agpm/delete-a-gpo-approver.md
index 2014a13ae3..b690ae67d6 100644
--- a/mdop/agpm/delete-a-gpo-approver.md
+++ b/mdop/agpm/delete-a-gpo-approver.md
@@ -1,8 +1,11 @@
 ---
 title: Delete a GPO
 description: Delete a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 85fca371-5707-49c1-aa51-813fc3a58dfc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/delete-a-gpo-editor.md b/mdop/agpm/delete-a-gpo-editor.md
index b5252c989e..151980b771 100644
--- a/mdop/agpm/delete-a-gpo-editor.md
+++ b/mdop/agpm/delete-a-gpo-editor.md
@@ -1,8 +1,11 @@
 ---
 title: Delete a GPO
 description: Delete a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 66be3dde-653e-4c25-8cb7-00e7090c8d31
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md b/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md
index 1ff67a0f89..b50eaff2eb 100644
--- a/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md
+++ b/mdop/agpm/deleting-or-restoring-a-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Deleting or Restoring a GPO
 description: Deleting or Restoring a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: ee4a467a-187a-48e3-8f0d-548de0606a56
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md b/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md
index 19b9de7078..f45ac8dc42 100644
--- a/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md
+++ b/mdop/agpm/deleting-or-restoring-a-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Deleting or Restoring a GPO
 description: Deleting or Restoring a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: d4f92f4d-eba7-4e6e-b166-13670864d298
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md b/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md
index 869477d761..2c2c5983b2 100644
--- a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md
+++ b/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Deleting, Restoring, or Destroying a GPO
 description: Deleting, Restoring, or Destroying a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 3e1b862e-007a-4b60-900f-0489069f5c75
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md b/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md
index 3daa52ad77..7373c4011f 100644
--- a/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md
+++ b/mdop/agpm/deleting-restoring-or-destroying-a-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Deleting, Restoring, or Destroying a GPO
 description: Deleting, Restoring, or Destroying a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 3af6c396-61c8-4b32-9fd8-28e9f15e575c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md b/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md
index e9fb3766a6..86d70a45a4 100644
--- a/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md
+++ b/mdop/agpm/deleting-restoring-or-destroying-a-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Deleting, Restoring, or Destroying a GPO
 description: Deleting, Restoring, or Destroying a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 089c68e7-c1a5-418a-8776-cf23960f10c4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/deploy-a-gpo-agpm30ops.md b/mdop/agpm/deploy-a-gpo-agpm30ops.md
index 33fb3fc58e..1e51162115 100644
--- a/mdop/agpm/deploy-a-gpo-agpm30ops.md
+++ b/mdop/agpm/deploy-a-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Deploy a GPO
 description: Deploy a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 3767b722-db43-40f1-a714-bb8e38bcaa10
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -39,7 +42,7 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
 **Note**  
 To verify whether the most recent version of a GPO has been deployed, on the **Controlled** tab, double-click the GPO to display its **History**. In the **History** for the GPO, the **State** column indicates whether a GPO has been deployed.
 
- 
+ 
 
 ### Additional considerations
 
@@ -49,9 +52,9 @@ To verify whether the most recent version of a GPO has been deployed, on the **C
 
 -   [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/deploy-a-gpo-agpm40.md b/mdop/agpm/deploy-a-gpo-agpm40.md
index ea0506484c..6c16327cc3 100644
--- a/mdop/agpm/deploy-a-gpo-agpm40.md
+++ b/mdop/agpm/deploy-a-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Deploy a GPO
 description: Deploy a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: a6febeaa-144b-4c02-99af-d972f0f2b544
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -39,7 +42,7 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
 **Note**  
 To verify whether the most recent version of a GPO has been deployed, on the **Controlled** tab, double-click the GPO to display its **History**. In the **History** for the GPO, the **State** column indicates whether a GPO has been deployed.
 
- 
+ 
 
 ### Additional considerations
 
@@ -49,9 +52,9 @@ To verify whether the most recent version of a GPO has been deployed, on the **C
 
 -   [Performing Approver Tasks](performing-approver-tasks-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/deploy-a-gpo.md b/mdop/agpm/deploy-a-gpo.md
index 0acb735724..fcb0ff6fe7 100644
--- a/mdop/agpm/deploy-a-gpo.md
+++ b/mdop/agpm/deploy-a-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Deploy a GPO
 description: Deploy a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: a0a3f292-e3ab-46ae-a0fd-d7b2b4ad8883
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -39,7 +42,7 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
 **Note**  
 To verify whether the most recent version of a GPO has been deployed, on the **Controlled** tab, double-click the GPO to display its **History**. In the **History** for the GPO, the **State** column indicates whether a GPO has been deployed.
 
- 
+ 
 
 ### Additional considerations
 
@@ -49,9 +52,9 @@ To verify whether the most recent version of a GPO has been deployed, on the **C
 
 -   [Performing Approver Tasks](performing-approver-tasks.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/destroy-a-gpo-agpm30ops.md b/mdop/agpm/destroy-a-gpo-agpm30ops.md
index 6c3e7be7f0..12697f828f 100644
--- a/mdop/agpm/destroy-a-gpo-agpm30ops.md
+++ b/mdop/agpm/destroy-a-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Destroy a GPO
 description: Destroy a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: bfabd71a-47f3-462e-b86f-5f15762b9e28
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/destroy-a-gpo-agpm40.md b/mdop/agpm/destroy-a-gpo-agpm40.md
index c34773a34e..9762120942 100644
--- a/mdop/agpm/destroy-a-gpo-agpm40.md
+++ b/mdop/agpm/destroy-a-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Destroy a GPO
 description: Destroy a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 09bce8c4-f75b-4633-b80b-d894bbec95c9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/destroy-a-gpo.md b/mdop/agpm/destroy-a-gpo.md
index 11a45186e8..f1b33449d2 100644
--- a/mdop/agpm/destroy-a-gpo.md
+++ b/mdop/agpm/destroy-a-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Destroy a GPO
 description: Destroy a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: d74941a3-beef-46cd-a4ca-80a324dcfadf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/domain-delegation-tab-agpm30ops.md b/mdop/agpm/domain-delegation-tab-agpm30ops.md
index 48550bb25b..d2989bdb1a 100644
--- a/mdop/agpm/domain-delegation-tab-agpm30ops.md
+++ b/mdop/agpm/domain-delegation-tab-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Domain Delegation Tab
 description: Domain Delegation Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 523cdf39-f4b8-4d20-a917-3485756658ce
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/domain-delegation-tab-agpm40.md b/mdop/agpm/domain-delegation-tab-agpm40.md
index 2df9df6ecb..4a847fcdba 100644
--- a/mdop/agpm/domain-delegation-tab-agpm40.md
+++ b/mdop/agpm/domain-delegation-tab-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Domain Delegation Tab
 description: Domain Delegation Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 5be5841e-92fb-4af6-aa68-0ae50f8d5141
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/domain-delegation-tab.md b/mdop/agpm/domain-delegation-tab.md
index 337c1e3a7f..01cb0b02be 100644
--- a/mdop/agpm/domain-delegation-tab.md
+++ b/mdop/agpm/domain-delegation-tab.md
@@ -1,8 +1,11 @@
 ---
 title: Domain Delegation Tab
 description: Domain Delegation Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 15a9bfff-e25b-4b62-9ebc-521a5f4eae96
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/edit-a-gpo-offline-agpm30ops.md b/mdop/agpm/edit-a-gpo-offline-agpm30ops.md
index 6cff2b03fd..8e84747307 100644
--- a/mdop/agpm/edit-a-gpo-offline-agpm30ops.md
+++ b/mdop/agpm/edit-a-gpo-offline-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Edit a GPO Offline
 description: Edit a GPO Offline
-author: jamiejdt
+author: dansimp
 ms.assetid: 51677d8a-6209-41b5-82ed-4f3be817abc0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -54,7 +57,7 @@ To edit a GPO, you check out the GPO from the archive, edit the GPO offline, and
     **Note**  
     To disable all Computer Configuration settings or all User Configuration settings, right-click the GPO in the **Group Policy Management Editor** window and click **Properties**. Select **Disable Computer Configuration settings** or **Disable User Configuration settings** as appropriate.
 
-     
+     
 
 3.  When you have finished modifying the GPO, close the **Group Policy Management Editor** window.
 
@@ -98,9 +101,9 @@ To edit a GPO, you check out the GPO from the archive, edit the GPO offline, and
 
     -   [Deploy a GPO](deploy-a-gpo-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/edit-a-gpo-offline-agpm40.md b/mdop/agpm/edit-a-gpo-offline-agpm40.md
index 099c52135e..6288426883 100644
--- a/mdop/agpm/edit-a-gpo-offline-agpm40.md
+++ b/mdop/agpm/edit-a-gpo-offline-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Edit a GPO Offline
 description: Edit a GPO Offline
-author: jamiejdt
+author: dansimp
 ms.assetid: 9c75eb3c-d4d5-41e0-b65e-8b4464a42cd9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -54,7 +57,7 @@ To edit a GPO, you check out the GPO from the archive, edit the GPO offline, and
     **Note**  
     To disable all Computer Configuration settings or all User Configuration settings, right-click the GPO in the **Group Policy Management Editor** window and click **Properties**. Select **Disable Computer Configuration settings** or **Disable User Configuration settings** as appropriate.
 
-     
+     
 
 3.  When you have finished modifying the GPO, close the **Group Policy Management Editor** window.
 
@@ -98,9 +101,9 @@ To edit a GPO, you check out the GPO from the archive, edit the GPO offline, and
 
     -   [Deploy a GPO](deploy-a-gpo-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/edit-a-gpo-offline.md b/mdop/agpm/edit-a-gpo-offline.md
index 798f01ebe3..bc1aba3836 100644
--- a/mdop/agpm/edit-a-gpo-offline.md
+++ b/mdop/agpm/edit-a-gpo-offline.md
@@ -1,8 +1,11 @@
 ---
 title: Edit a GPO Offline
 description: Edit a GPO Offline
-author: jamiejdt
+author: dansimp
 ms.assetid: 4a148952-9fe9-4ec4-8df1-b25e37c97a54
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/editing-a-gpo-agpm30ops.md b/mdop/agpm/editing-a-gpo-agpm30ops.md
index 753f7c337c..59b629a5c0 100644
--- a/mdop/agpm/editing-a-gpo-agpm30ops.md
+++ b/mdop/agpm/editing-a-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Editing a GPO
 description: Editing a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 3024051a-ff33-46d0-9c3e-68ebae7f6b60
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/editing-a-gpo-agpm40.md b/mdop/agpm/editing-a-gpo-agpm40.md
index bf8a240a68..affa8b706e 100644
--- a/mdop/agpm/editing-a-gpo-agpm40.md
+++ b/mdop/agpm/editing-a-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Editing a GPO
 description: Editing a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: ef42eefe-7705-46b2-954d-18966335cbbf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/editing-a-gpo.md b/mdop/agpm/editing-a-gpo.md
index fbdc6178e3..8569b51552 100644
--- a/mdop/agpm/editing-a-gpo.md
+++ b/mdop/agpm/editing-a-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Editing a GPO
 description: Editing a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: ec77d3bb-8a64-4d8e-9c28-87763de02ec0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/export-a-gpo-to-a-file.md b/mdop/agpm/export-a-gpo-to-a-file.md
index 91cb177d3a..6cbcfe2245 100644
--- a/mdop/agpm/export-a-gpo-to-a-file.md
+++ b/mdop/agpm/export-a-gpo-to-a-file.md
@@ -1,8 +1,11 @@
 ---
 title: Export a GPO to a File
 description: Export a GPO to a File
-author: jamiejdt
+author: dansimp
 ms.assetid: 0d01b1f7-a6a4-4d0d-9aa7-2d6f1ae93d9d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/feature-visibility-settings-agpm30ops.md b/mdop/agpm/feature-visibility-settings-agpm30ops.md
index b83c9ebb0c..5a6f4b5583 100644
--- a/mdop/agpm/feature-visibility-settings-agpm30ops.md
+++ b/mdop/agpm/feature-visibility-settings-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Feature Visibility Settings
 description: Feature Visibility Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: 6a844478-a6b0-490d-923f-5a6f82467831
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/feature-visibility-settings-agpm40.md b/mdop/agpm/feature-visibility-settings-agpm40.md
index 50e4df652a..126b1eb425 100644
--- a/mdop/agpm/feature-visibility-settings-agpm40.md
+++ b/mdop/agpm/feature-visibility-settings-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Feature Visibility Settings
 description: Feature Visibility Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: d3c0b02a-b943-4001-8b9c-dfac8fe58789
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/feature-visibility-settings.md b/mdop/agpm/feature-visibility-settings.md
index 75296a1cbb..7a3848854c 100644
--- a/mdop/agpm/feature-visibility-settings.md
+++ b/mdop/agpm/feature-visibility-settings.md
@@ -1,8 +1,11 @@
 ---
 title: Feature Visibility Settings
 description: Feature Visibility Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: 9db2ba03-fb75-4f95-9138-ec89b9fc8d01
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/history-window-agpm30ops.md b/mdop/agpm/history-window-agpm30ops.md
index a7cd61cd22..bc85f0fee8 100644
--- a/mdop/agpm/history-window-agpm30ops.md
+++ b/mdop/agpm/history-window-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: History Window
 description: History Window
-author: jamiejdt
+author: dansimp
 ms.assetid: 114f50a4-508d-4589-b006-6cd05cffe6b7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -46,7 +49,7 @@ The tabs within the **History** window filter the states in the history of the G
 
 
 
- 
+
 
 ## Event information
 
@@ -85,11 +88,10 @@ Information is provided for each state in the history of the GPO.
 
            Deletable
            
 
            Whether this version of the GPO can be deleted if the number of unique versions of each GPO retained in the archive is limited.
            
 
            
-Note  
-
            You can modify whether a version of a GPO is deletable by right-clicking it and then clicking Do Not Allow Deletion or Allow Deletion.
            
+Note
            You can modify whether a version of a GPO is deletable by right-clicking it and then clicking Do Not Allow Deletion or Allow Deletion.
            
 
            
 
            
- 
+
 
            
 
 
@@ -111,7 +113,7 @@ Information is provided for each state in the history of the GPO.
 
 
 
- 
+
 
 ## Reports
 
@@ -141,7 +143,7 @@ The **Settings** and **Differences** buttons display reports about GPO settings
 
 
 
- 
+
 
 ### Key to difference reports
 
@@ -182,7 +184,7 @@ The **Settings** and **Differences** buttons display reports about GPO settings
 
 
 
- 
+
 
 -   For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report.
 
@@ -192,9 +194,9 @@ The **Settings** and **Differences** buttons display reports about GPO settings
 
 -   [Contents Tab](contents-tab-agpm30ops.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/agpm/history-window-agpm40.md b/mdop/agpm/history-window-agpm40.md
index 7c145de0f0..0d1f91b021 100644
--- a/mdop/agpm/history-window-agpm40.md
+++ b/mdop/agpm/history-window-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: History Window
 description: History Window
-author: jamiejdt
+author: dansimp
 ms.assetid: 5bea62e7-d267-40b2-a66d-fb1be7373a1c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -46,7 +49,7 @@ The tabs within the **History** window filter the states in the history of the G
 
 
 
- 
+
 
 ## Event information
 
@@ -85,11 +88,10 @@ Information is provided for each state in the history of the GPO.
 
            Deletable
            
 
            Whether this version of the GPO can be deleted if the number of unique versions of each GPO retained in the archive is limited.
            
 
            
-Note  
-
            You can change whether a version of a GPO can be deleted by right-clicking the GPO and then clicking Do Not Allow Deletion or Allow Deletion.
            
+Note
            You can change whether a version of a GPO can be deleted by right-clicking the GPO and then clicking Do Not Allow Deletion or Allow Deletion.
            
 
            
 
            
- 
+
 
            
 
 
@@ -111,7 +113,7 @@ Information is provided for each state in the history of the GPO.
 
 
 
- 
+
 
 ## Reports
 
@@ -141,7 +143,7 @@ The **Settings** and **Differences** buttons display reports about GPO settings
 
 
 
- 
+
 
 ### Key to difference reports
 
@@ -182,7 +184,7 @@ The **Settings** and **Differences** buttons display reports about GPO settings
 
 
 
- 
+
 
 -   For items with changed settings, the changed settings are identified when the item is expanded. The value for the attribute in each GPO is displayed in the same order that the GPOs are displayed in the report.
 
@@ -192,9 +194,9 @@ The **Settings** and **Differences** buttons display reports about GPO settings
 
 -   [Contents Tab](contents-tab-agpm40.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/agpm/history-window.md b/mdop/agpm/history-window.md
index b79c525eaf..7de100917a 100644
--- a/mdop/agpm/history-window.md
+++ b/mdop/agpm/history-window.md
@@ -1,8 +1,11 @@
 ---
 title: History Window
 description: History Window
-author: jamiejdt
+author: dansimp
 ms.assetid: f11f9ad9-bffe-4c56-8c46-fe9c0a8e55c1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md
index 15684d3085..b7d575576e 100644
--- a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md
+++ b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Identify Differences Between GPOs, GPO Versions, or Templates
 description: Identify Differences Between GPOs, GPO Versions, or Templates
-author: jamiejdt
+author: dansimp
 ms.assetid: e391fa91-3956-4150-9d43-900cfc88d543
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md
index f58f985f26..6201499127 100644
--- a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md
+++ b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Identify Differences Between GPOs, GPO Versions, or Templates
 description: Identify Differences Between GPOs, GPO Versions, or Templates
-author: jamiejdt
+author: dansimp
 ms.assetid: 3f03c368-162b-450f-be6c-2807c3e8d741
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md
index 83ba8fada3..684eac2b0a 100644
--- a/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md
+++ b/mdop/agpm/identify-differences-between-gpos-gpo-versions-or-templates.md
@@ -1,8 +1,11 @@
 ---
 title: Identify Differences Between GPOs, GPO Versions, or Templates
 description: Identify Differences Between GPOs, GPO Versions, or Templates
-author: jamiejdt
+author: dansimp
 ms.assetid: 6320afc4-af81-47e8-9f4c-463ff99d5a53
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md b/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md
index 172d641e83..ae05829359 100644
--- a/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md
+++ b/mdop/agpm/import-a-gpo-from-a-file-agpmadmin.md
@@ -1,8 +1,11 @@
 ---
 title: Import a GPO from a File
 description: Import a GPO from a File
-author: jamiejdt
+author: dansimp
 ms.assetid: 2cbcda72-4de3-47ad-aaf8-4fc7341d5a00
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/import-a-gpo-from-a-file-ed.md b/mdop/agpm/import-a-gpo-from-a-file-ed.md
index ad52baee15..7029d3c69e 100644
--- a/mdop/agpm/import-a-gpo-from-a-file-ed.md
+++ b/mdop/agpm/import-a-gpo-from-a-file-ed.md
@@ -1,8 +1,11 @@
 ---
 title: Import a GPO from a File
 description: Import a GPO from a File
-author: jamiejdt
+author: dansimp
 ms.assetid: 6e901a52-1101-4fed-9f90-3819b573b378
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/import-a-gpo-from-production-agpm30ops.md b/mdop/agpm/import-a-gpo-from-production-agpm30ops.md
index 1b6fc4831e..7754206dd0 100644
--- a/mdop/agpm/import-a-gpo-from-production-agpm30ops.md
+++ b/mdop/agpm/import-a-gpo-from-production-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Import a GPO from Production
 description: Import a GPO from Production
-author: jamiejdt
+author: dansimp
 ms.assetid: 35c2a682-ece8-4577-a083-7e3e9facfd13
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/import-a-gpo-from-production-agpm40-app.md b/mdop/agpm/import-a-gpo-from-production-agpm40-app.md
index 0fc2a8a019..cc8288be07 100644
--- a/mdop/agpm/import-a-gpo-from-production-agpm40-app.md
+++ b/mdop/agpm/import-a-gpo-from-production-agpm40-app.md
@@ -1,8 +1,11 @@
 ---
 title: Import a GPO from Production
 description: Import a GPO from Production
-author: jamiejdt
+author: dansimp
 ms.assetid: c5b2f40d-1dc7-4dbf-b8b3-4d97ad73e1e5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md b/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md
index 75a1e93314..fcddfd97af 100644
--- a/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md
+++ b/mdop/agpm/import-a-gpo-from-production-agpm40-ed.md
@@ -1,8 +1,11 @@
 ---
 title: Import a GPO from Production
 description: Import a GPO from Production
-author: jamiejdt
+author: dansimp
 ms.assetid: ad14203a-2e6a-41d4-a05e-4508c80045fd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/import-a-gpo-from-production-approver.md b/mdop/agpm/import-a-gpo-from-production-approver.md
index 55fa048aaa..0f31b8a9c4 100644
--- a/mdop/agpm/import-a-gpo-from-production-approver.md
+++ b/mdop/agpm/import-a-gpo-from-production-approver.md
@@ -1,8 +1,11 @@
 ---
 title: Import a GPO from Production
 description: Import a GPO from Production
-author: jamiejdt
+author: dansimp
 ms.assetid: 071270fa-1890-40ce-ab89-ce070a54aa59
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md b/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md
index f3e5076171..272f402550 100644
--- a/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md
+++ b/mdop/agpm/import-a-gpo-from-production-editor-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Import a GPO from Production
 description: Import a GPO from Production
-author: jamiejdt
+author: dansimp
 ms.assetid: ad90f13e-e73c-400f-b86f-c12f2e75d19d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/import-a-gpo-from-production-editor.md b/mdop/agpm/import-a-gpo-from-production-editor.md
index 1ab8ff19b0..15f7c96a1f 100644
--- a/mdop/agpm/import-a-gpo-from-production-editor.md
+++ b/mdop/agpm/import-a-gpo-from-production-editor.md
@@ -1,8 +1,11 @@
 ---
 title: Import a GPO from Production
 description: Import a GPO from Production
-author: jamiejdt
+author: dansimp
 ms.assetid: ffa02b2a-2a43-4fc0-a06e-7d4b59022cc3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/index.md b/mdop/agpm/index.md
index c3b4414d7c..bd78561b83 100644
--- a/mdop/agpm/index.md
+++ b/mdop/agpm/index.md
@@ -1,7 +1,7 @@
 ---
 title: Advanced Group Policy Management
 description: Advanced Group Policy Management
-author: jamiejdt
+author: dansimp
 ms.assetid: 493ca3c3-c3d6-4bb1-9430-dc1e43c86bb0
 ms.pagetype: mdop
 ms.mktglfcycl: manage
@@ -19,7 +19,7 @@ Microsoft Advanced Group Policy Management (AGPM) extends the capabilities of th
 ## AGPM Version Information
 
 
-[AGPM 4.0 SP3](agpm-40-sp3-navengl.md) supports Windows 10, Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1.
+[AGPM 4.0 SP3](agpm-40-sp3-navengl.md) supports Windows 10, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1.
 
 [AGPM 4.0 SP2](agpm-40-sp2-navengl.md) supports Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows Server 2008 R2, Windows 7, Windows Server 2008, and Windows Vista with SP1.
 
@@ -44,17 +44,17 @@ In addition to the product documentation available online, supplemental product
 
 
 
            MDOP Virtual Labs
            
-
            For a list of available MDOP virtual labs, go to [Microsoft Desktop Optimization Pack (MDOP) Virtual Labs](https://go.microsoft.com/fwlink/?LinkId=234276) (https://go.microsoft.com/fwlink/?LinkId=234276).
            
+
            For a list of available MDOP virtual labs, go to Microsoft Desktop Optimization Pack (MDOP) Virtual Labs (https://go.microsoft.com/fwlink/?LinkId=234276).
            
 
 
 
            MDOP TechCenter
            
-
            For technical whitepapers, evaluation materials, blogs, and additional MDOP resources, go to [MDOP TechCenter](https://go.microsoft.com/fwlink/?LinkId=225286) (https://go.microsoft.com/fwlink/?LinkId=225286)
            
+
            For technical whitepapers, evaluation materials, blogs, and additional MDOP resources, go to MDOP TechCenter (https://go.microsoft.com/fwlink/?LinkId=225286)
            
 
            
 
 
 
 
- 
+ 
 
 ## How to Get MDOP
 
@@ -62,7 +62,7 @@ In addition to the product documentation available online, supplemental product
 MDOP is a suite of products that can help streamline desktop deployment, management, and support across the enterprise. MDOP is available as an additional subscription for Software Assurance customers.
 
 **Evaluate MDOP**
-MDOP is also available for test and evaluation to [MSDN](https://msdn.microsoft.com/subscriptions/downloads/default.aspx?PV=42:178) and [TechNet](https://technet.microsoft.com/subscriptions/downloads/default.aspx?PV=42:178) subscribers in accordance with MDSN and TechNet agreements.
+MDOP is also available for test and evaluation to [MSDN](https://msdn.microsoft.com/subscriptions/downloads/default.aspx?PV=42:178) and [TechNet](https://technet.microsoft.com/subscriptions/downloads/default.aspx?PV=42:178) subscribers in accordance with MSDN and TechNet agreements.
 
 **Download MDOP**
 MDOP subscribers can download the software at the [Microsoft Volume Licensing website (MVLS)](https://go.microsoft.com/fwlink/?LinkId=166331).
@@ -70,9 +70,9 @@ MDOP subscribers can download the software at the [Microsoft Volume Licensing we
 **Purchase MDOP**
 Visit the enterprise [Purchase Windows Enterprise Licensing](https://www.microsoft.com/windows/enterprise/how-to-buy.aspx) website to find out how to purchase MDOP for your business.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md b/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md
index ec3a87bbdc..12807c514e 100644
--- a/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md
+++ b/mdop/agpm/label-the-current-version-of-a-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Label the Current Version of a GPO
 description: Label the Current Version of a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 3845211a-0bc9-4875-9906-cb758c443825
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md b/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md
index fbe3c7b8f2..9374aa08cd 100644
--- a/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md
+++ b/mdop/agpm/label-the-current-version-of-a-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Label the Current Version of a GPO
 description: Label the Current Version of a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: cadc8769-21da-44b0-8122-6cafdb448913
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/label-the-current-version-of-a-gpo.md b/mdop/agpm/label-the-current-version-of-a-gpo.md
index 1c233077d6..e4608abdad 100644
--- a/mdop/agpm/label-the-current-version-of-a-gpo.md
+++ b/mdop/agpm/label-the-current-version-of-a-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Label the Current Version of a GPO
 description: Label the Current Version of a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 5e4e50f8-e4a8-4bda-aac4-1569d5fbd6a7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md b/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md
index a2baa4af41..35f49b04fd 100644
--- a/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md
+++ b/mdop/agpm/limit-the-gpo-versions-stored-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Limit the GPO Versions Stored
 description: Limit the GPO Versions Stored
-author: jamiejdt
+author: dansimp
 ms.assetid: da14edc5-0c36-4c54-b122-861c86b99eb1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -29,7 +32,7 @@ A user account with the AGPM Administrator (Full Control) role or necessary perm
     **Important**  
     Only GPO versions displayed on the **Unique Versions** tab of the **History** window count toward the limit.
 
-     
+     
 
 4.  Click the **Apply** button.
 
@@ -43,9 +46,9 @@ A user account with the AGPM Administrator (Full Control) role or necessary perm
 
 -   [Managing the Archive](managing-the-archive.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md b/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md
index 992a948ff1..6d48c8c1eb 100644
--- a/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md
+++ b/mdop/agpm/limit-the-gpo-versions-stored-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Limit the GPO Versions Stored
 description: Limit the GPO Versions Stored
-author: jamiejdt
+author: dansimp
 ms.assetid: d802c7b6-f303-4b23-aefd-f19f1300b0ff
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -29,7 +32,7 @@ A user account with the AGPM Administrator (Full Control) role or necessary perm
     **Important**  
     Only GPO versions displayed on the **Unique Versions** tab of the **History** window count toward the limit.
 
-     
+     
 
 4.  Click the **Apply** button.
 
@@ -43,9 +46,9 @@ A user account with the AGPM Administrator (Full Control) role or necessary perm
 
 -   [Managing the Archive](managing-the-archive-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/logging-and-tracing-settings-agpm30ops.md b/mdop/agpm/logging-and-tracing-settings-agpm30ops.md
index f6b44f355c..82b6e1ce94 100644
--- a/mdop/agpm/logging-and-tracing-settings-agpm30ops.md
+++ b/mdop/agpm/logging-and-tracing-settings-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Logging and Tracing Settings
 description: Logging and Tracing Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: 858b6fbf-65b4-42fa-95a9-69b04e5734d7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/logging-and-tracing-settings-agpm40.md b/mdop/agpm/logging-and-tracing-settings-agpm40.md
index 8dc6423659..fd2477a527 100644
--- a/mdop/agpm/logging-and-tracing-settings-agpm40.md
+++ b/mdop/agpm/logging-and-tracing-settings-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Logging and Tracing Settings
 description: Logging and Tracing Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: 66d03306-80d8-4132-bf71-2827157b1fc9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/logging-and-tracing-settings.md b/mdop/agpm/logging-and-tracing-settings.md
index 39ed63b471..ff3a6190db 100644
--- a/mdop/agpm/logging-and-tracing-settings.md
+++ b/mdop/agpm/logging-and-tracing-settings.md
@@ -1,8 +1,11 @@
 ---
 title: Logging and Tracing Settings
 description: Logging and Tracing Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: db6b43c7-fdde-4d11-b5ab-a81346e56940
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/managing-the-agpm-service-agpm30ops.md b/mdop/agpm/managing-the-agpm-service-agpm30ops.md
index 7a4e22cf3a..91793ce0d5 100644
--- a/mdop/agpm/managing-the-agpm-service-agpm30ops.md
+++ b/mdop/agpm/managing-the-agpm-service-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Managing the AGPM Service
 description: Managing the AGPM Service
-author: jamiejdt
+author: dansimp
 ms.assetid: a522b1f1-c57b-43aa-9d75-acc6f9bedbf9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ The AGPM Service is a Windows service that acts as a security proxy, managing cl
 **Caution**  
 Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting.
 
- 
+ 
 
 -   [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm30ops.md)
 
@@ -31,9 +34,9 @@ Do not modify settings for the AGPM Service through **Administrative Tools** and
 
 -   [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/managing-the-agpm-service-agpm40.md b/mdop/agpm/managing-the-agpm-service-agpm40.md
index 9d9ea8a720..01b91e94ad 100644
--- a/mdop/agpm/managing-the-agpm-service-agpm40.md
+++ b/mdop/agpm/managing-the-agpm-service-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Managing the AGPM Service
 description: Managing the AGPM Service
-author: jamiejdt
+author: dansimp
 ms.assetid: 48ca02aa-6acf-403b-afd4-66ae8a953246
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ The AGPM Service is a Windows service that acts as a security proxy, managing cl
 **Caution**  
 Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting.
 
- 
+ 
 
 -   [Start and Stop the AGPM Service](start-and-stop-the-agpm-service-agpm40.md)
 
@@ -31,9 +34,9 @@ Do not modify settings for the AGPM Service through **Administrative Tools** and
 
 -   [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/managing-the-agpm-service.md b/mdop/agpm/managing-the-agpm-service.md
index c1fdfc3d68..43064fd9ba 100644
--- a/mdop/agpm/managing-the-agpm-service.md
+++ b/mdop/agpm/managing-the-agpm-service.md
@@ -1,8 +1,11 @@
 ---
 title: Managing the AGPM Service
 description: Managing the AGPM Service
-author: jamiejdt
+author: dansimp
 ms.assetid: 331f64d2-1236-4711-81b4-1b92f019bfa5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ The AGPM Service is a Windows service that acts as a security proxy, managing cl
 **Caution**  
 Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting.
 
- 
+ 
 
 -   [Start and Stop the AGPM Service](start-and-stop-the-agpm-service.md)
 
@@ -29,9 +32,9 @@ Do not modify settings for the AGPM Service through **Administrative Tools** and
 
 -   [Modify the Port on Which the AGPM Service Listens](modify-the-port-on-which-the-agpm-service-listens.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/managing-the-archive-agpm40.md b/mdop/agpm/managing-the-archive-agpm40.md
index 7c7f6231e6..ea712c84ad 100644
--- a/mdop/agpm/managing-the-archive-agpm40.md
+++ b/mdop/agpm/managing-the-archive-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Managing the Archive
 description: Managing the Archive
-author: jamiejdt
+author: dansimp
 ms.assetid: b11a3d71-74ea-4dd7-b243-6f2880b7af2d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/managing-the-archive.md b/mdop/agpm/managing-the-archive.md
index 38c14277ec..eeacbaf3a0 100644
--- a/mdop/agpm/managing-the-archive.md
+++ b/mdop/agpm/managing-the-archive.md
@@ -1,8 +1,11 @@
 ---
 title: Managing the Archive
 description: Managing the Archive
-author: jamiejdt
+author: dansimp
 ms.assetid: 7c7654e9-ab0e-4531-8ef7-ae77ef391620
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/modify-the-agpm-service-account.md b/mdop/agpm/modify-the-agpm-service-account.md
index 207b0f5527..4481c6d031 100644
--- a/mdop/agpm/modify-the-agpm-service-account.md
+++ b/mdop/agpm/modify-the-agpm-service-account.md
@@ -1,8 +1,11 @@
 ---
 title: Modify the AGPM Service Account
 description: Modify the AGPM Service Account
-author: jamiejdt
+author: dansimp
 ms.assetid: 0d8d8c7b-f299-4fee-8414-406492156942
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -21,7 +24,7 @@ The archive path and AGPM Service Account are configured during the installation
 **Caution**  
 Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting.
 
- 
+ 
 
 A user account that is a member of the Domain Admins group and has access to the AGPM Server (the computer on which Microsoft Advanced Group Policy Management - Server is installed) is required to complete this procedure.
 
@@ -30,7 +33,7 @@ The AGPM Service Account must have full access to the GPOs that it will manage a
 
 If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains.
 
- 
+ 
 
 **To modify the AGPM Service Account**
 
@@ -54,9 +57,9 @@ If you will be managing GPOs on multiple domains or if a member server will be t
 
 -   [Managing the AGPM Service](managing-the-agpm-service.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/modify-the-agpm-service-agpm30ops.md b/mdop/agpm/modify-the-agpm-service-agpm30ops.md
index a111d6f4a5..814f3ad6d7 100644
--- a/mdop/agpm/modify-the-agpm-service-agpm30ops.md
+++ b/mdop/agpm/modify-the-agpm-service-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Modify the AGPM Service
 description: Modify the AGPM Service
-author: jamiejdt
+author: dansimp
 ms.assetid: 3485f85f-59d1-48dc-8748-36826214dcb1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ The AGPM Service is a Windows service that acts as a security proxy, managing cl
 **Caution**  
 Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting.
 
- 
+ 
 
 A user account that is a member of the Domain Admins group and has access to the AGPM Server (the computer on which Microsoft Advanced Group Policy Management - Server is installed) is required to complete this procedure. Additionally, you must provide credentials for the AGPM Service Account to complete this procedure.
 
@@ -42,7 +45,7 @@ A user account that is a member of the Domain Admins group and has access to the
         **Important**  
         The archive path can point to a folder on the AGPM Server or elsewhere, but the location should have sufficient space to store all GPOs and history data managed by this AGPM Server.
 
-         
+         
 
     2.  In the **AGPM Service Account** dialog box, enter credentials for a service account under which the AGPM Service will run, and click **Next**.
 
@@ -53,14 +56,14 @@ A user account that is a member of the Domain Admins group and has access to the
 
         If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains.
 
-         
+         
 
     3.  In the **Archive Owner** dialog box, enter the user name of an AGPM Administrator (Full Control) or group of AGPM Administrators, and click **Next**.
 
         **Note**  
         Modifying the installation clears the credentials for the Archive Owner. You must re-enter credentials, but they are not required to match the credentials used during the original installation.
 
-         
+         
 
     4.  In the **Port Configuration** dialog box, type a new port on which the AGPM Service should listen or confirm the port currently selected, and click **Next**.
 
@@ -69,7 +72,7 @@ A user account that is a member of the Domain Admins group and has access to the
 
         If you manually configure port exceptions or have rules configuring port exceptions, you can clear the **Add port exception to firewall** check box.
 
-         
+         
 
 5.  Click **Change**, and when the installation is complete click **Finish**.
 
@@ -81,9 +84,9 @@ A user account that is a member of the Domain Admins group and has access to the
 
 -   [Managing the AGPM Service](managing-the-agpm-service-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/modify-the-agpm-service-agpm40.md b/mdop/agpm/modify-the-agpm-service-agpm40.md
index 9c780a1547..31925f9da1 100644
--- a/mdop/agpm/modify-the-agpm-service-agpm40.md
+++ b/mdop/agpm/modify-the-agpm-service-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Modify the AGPM Service
 description: Modify the AGPM Service
-author: jamiejdt
+author: dansimp
 ms.assetid: 3239d088-bb86-4ec4-bc56-dbe8f1c710f5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ The AGPM Service is a Windows service that acts as a security proxy, managing cl
 **Caution**  
 Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting.
 
- 
+ 
 
 A user account that is a member of the Domain Admins group and has access to the AGPM Server (the computer on which Microsoft Advanced Group Policy Management - Server is installed) is required to complete this procedure. Additionally, you must provide credentials for the AGPM Service Account to complete this procedure.
 
@@ -38,7 +41,7 @@ A user account that is a member of the Domain Admins group and has access to the
         **Important**  
         The archive path can point to a folder on the AGPM Server or elsewhere, but the location should have sufficient space to store all GPOs and history data managed by this AGPM Server.
 
-         
+         
 
     2.  In the **AGPM Service Account** dialog box, enter credentials for a service account under which the AGPM Service will run, and click **Next**.
 
@@ -49,14 +52,14 @@ A user account that is a member of the Domain Admins group and has access to the
 
         If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains.
 
-         
+         
 
     3.  In the **Archive Owner** dialog box, enter the user name of an AGPM Administrator (Full Control) or group of AGPM Administrators, and click **Next**.
 
         **Note**  
         Modifying the installation clears the credentials for the Archive Owner. You must re-enter credentials, but they are not required to match the credentials used during the original installation.
 
-         
+         
 
     4.  In the **Port Configuration** dialog box, type a new port on which the AGPM Service should listen or confirm the port currently selected, and click **Next**.
 
@@ -65,7 +68,7 @@ A user account that is a member of the Domain Admins group and has access to the
 
         If you manually configure port exceptions or have rules configuring port exceptions, you can clear the **Add port exception to firewall** check box.
 
-         
+         
 
 5.  Click **Change**, and when the installation is complete click **Finish**.
 
@@ -77,9 +80,9 @@ A user account that is a member of the Domain Admins group and has access to the
 
 -   [Managing the AGPM Service](managing-the-agpm-service-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/modify-the-archive-path.md b/mdop/agpm/modify-the-archive-path.md
index 19775ccfa6..a442dba78a 100644
--- a/mdop/agpm/modify-the-archive-path.md
+++ b/mdop/agpm/modify-the-archive-path.md
@@ -1,8 +1,11 @@
 ---
 title: Modify the Archive Path
 description: Modify the Archive Path
-author: jamiejdt
+author: dansimp
 ms.assetid: 6d90daf9-58db-4166-b5b3-e84bb261164a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -41,7 +44,7 @@ A user account that is a member of the Domain Admins group and has access to the
 
         If you will be managing GPOs on multiple domains or if a member server will be the AGPM Server, you should configure a different account as the AGPM Service Account because the Local System account for one domain controller cannot access GPOs on other domains.
 
-         
+         
 
     3.  For the archive owner, enter the credentials of an AGPM Administrator (Full Control).
 
@@ -51,9 +54,9 @@ A user account that is a member of the Domain Admins group and has access to the
 
 -   [Managing the AGPM Service](managing-the-agpm-service.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md b/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md
index e96c539572..d4481a3d70 100644
--- a/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md
+++ b/mdop/agpm/modify-the-port-on-which-the-agpm-service-listens.md
@@ -1,8 +1,11 @@
 ---
 title: Modify the Port on Which the AGPM Service Listens
 description: Modify the Port on Which the AGPM Service Listens
-author: jamiejdt
+author: dansimp
 ms.assetid: a82c6873-e916-4a04-b263-aa612cd6956b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ The AGPM Service is a Windows service that acts as a security proxy, managing cl
 **Note**  
 Before modifying the port on which the AGPM Service listens, it is recommended that you back up the AGPM archive index file (gpostate.xml). This file is located in the folder entered as the archive path during the installation of Advanced Group Policy Management - Server. By default, this location of this file is %CommonAppData%\\Microsoft\\AGPM\\gpostate.xml on the AGPM Server. If you do not know which computer hosts the archive, you can follow the procedure for modifying the archive path to display the current archive path. For more information, see [Modify the Archive Path](modify-the-archive-path.md).
 
- 
+ 
 
 A user account with access to the AGPM Server (the computer on which the AGPM Service is installed) and the archive index file is required to complete this procedure.
 
@@ -41,9 +44,9 @@ A user account with access to the AGPM Server (the computer on which the AGPM Se
 
 -   [Managing the AGPM Service](managing-the-agpm-service.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md b/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md
index 14cfd0268c..065322c6a7 100644
--- a/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md
+++ b/mdop/agpm/move-the-agpm-server-and-the-archive-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Move the AGPM Server and the Archive
 description: Move the AGPM Server and the Archive
-author: jamiejdt
+author: dansimp
 ms.assetid: 9ec48d3a-c293-45f0-8939-32ccdc062303
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -21,7 +24,7 @@ If you are replacing the AGPM Server and the server on which the archive is host
 
 -   By default, the archive is hosted on the AGPM Server, but you can specify an archive path to host it on another server instead.
 
- 
+ 
 
 A user account that is a member of the Domain Admins group and has access to the previous and new AGPM Servers is required to complete this procedure. Additionally, you must provide credentials for the AGPM Service Account to be used by the new AGPM Server to complete this procedure.
 
@@ -40,7 +43,7 @@ A user account that is a member of the Domain Admins group and has access to the
         **Note**  
         As a best practice, you should uninstall Microsoft Advanced Group Policy Management – Server from the previous AGPM Server. This will ensure that the AGPM Service cannot be unintentionally restarted on that server and potentially cause confusion if any AGPM Server connections to it remain.
 
-         
+         
 
 3.  Copy the archive from the backup to the new server that will host the archive. For more information, see [Restore the Archive from a Backup](restore-the-archive-from-a-backup-agpm40.md).
 
@@ -51,7 +54,7 @@ A user account that is a member of the Domain Admins group and has access to the
 
     2.  You must re-enter and confirm the password on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm40.md).
 
-     
+     
 
 ### Additional references
 
@@ -69,9 +72,9 @@ A user account that is a member of the Domain Admins group and has access to the
 
 -   [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/move-the-agpm-server-and-the-archive.md b/mdop/agpm/move-the-agpm-server-and-the-archive.md
index c5fd297983..1c4ba6015e 100644
--- a/mdop/agpm/move-the-agpm-server-and-the-archive.md
+++ b/mdop/agpm/move-the-agpm-server-and-the-archive.md
@@ -1,8 +1,11 @@
 ---
 title: Move the AGPM Server and the Archive
 description: Move the AGPM Server and the Archive
-author: jamiejdt
+author: dansimp
 ms.assetid: 13cb83c4-bb42-4e81-8660-5b7540f473d8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -21,7 +24,7 @@ If you are replacing the AGPM Server and the server on which the archive is host
 
 -   By default, the archive is hosted on the AGPM Server, but you can specify an archive path to host it on another server instead.
 
- 
+ 
 
 A user account that is a member of the Domain Admins group and has access to the previous and new AGPM Servers is required to complete this procedure. Additionally, you must provide credentials for the AGPM Service Account to be used by the new AGPM Server to complete this procedure.
 
@@ -40,7 +43,7 @@ A user account that is a member of the Domain Admins group and has access to the
         **Note**  
         As a best practice, you should uninstall Microsoft Advanced Group Policy Management – Server from the previous AGPM Server. This will ensure that the AGPM Service cannot be unintentionally restarted on that server and potentially cause confusion if any AGPM Server connections to it remain.
 
-         
+         
 
 3.  Copy the archive from the backup to the new server that will host the archive. For more information, see [Restore the Archive from a Backup](restore-the-archive-from-a-backup.md).
 
@@ -51,7 +54,7 @@ A user account that is a member of the Domain Admins group and has access to the
 
     2.  You must re-enter and confirm the password on the **Domain Delegation** tab. For more information, see [Configure E-Mail Notification](configure-e-mail-notification-agpm30ops.md).
 
-     
+     
 
 ### Additional references
 
@@ -69,9 +72,9 @@ A user account that is a member of the Domain Admins group and has access to the
 
 -   [Performing AGPM Administrator Tasks](performing-agpm-administrator-tasks-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md
index b55f380d6c..d84f580b21 100644
--- a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md
+++ b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-25.md
@@ -1,8 +1,11 @@
 ---
 title: Operations Guide for Microsoft Advanced Group Policy Management 2.5
 description: Operations Guide for Microsoft Advanced Group Policy Management 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 005f0bb5-789f-42a9-bcaf-7e8c31a8df66
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md
index aba11693ff..1b9ebfc6e4 100644
--- a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md
+++ b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-30-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Operations Guide for Microsoft Advanced Group Policy Management 3.0
 description: Operations Guide for Microsoft Advanced Group Policy Management 3.0
-author: jamiejdt
+author: dansimp
 ms.assetid: aaefe6d1-a9e5-43eb-b4d8-85880798cb8b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md
index 4d10c6c54b..c4c260282d 100644
--- a/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md
+++ b/mdop/agpm/operations-guide-for-microsoft-advanced-group-policy-management-40.md
@@ -1,8 +1,11 @@
 ---
 title: Operations Guide for Microsoft Advanced Group Policy Management 4.0
 description: Operations Guide for Microsoft Advanced Group Policy Management 4.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 0bafeba3-20a9-4360-be5d-03f786df11ee
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/other-enhancements-to-the-gpmc.md b/mdop/agpm/other-enhancements-to-the-gpmc.md
index cf52c01209..b4bf662f24 100644
--- a/mdop/agpm/other-enhancements-to-the-gpmc.md
+++ b/mdop/agpm/other-enhancements-to-the-gpmc.md
@@ -1,8 +1,11 @@
 ---
 title: Other Enhancements to the GPMC
 description: Other Enhancements to the GPMC
-author: jamiejdt
+author: dansimp
 ms.assetid: ef344101-17e1-4e06-9dc8-2f20ca796774
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md b/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md
index 0f63c731ae..19cb9b5a66 100644
--- a/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md
+++ b/mdop/agpm/overview-of-advanced-group-policy-management-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Overview of Advanced Group Policy Management
 description: Overview of Advanced Group Policy Management
-author: jamiejdt
+author: dansimp
 ms.assetid: 3a8d1e58-12b9-42bd-898f-6d57514dfbb9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md b/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md
index 8f3cacc31b..a9b6c13c20 100644
--- a/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md
+++ b/mdop/agpm/overview-of-advanced-group-policy-management-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Overview of Advanced Group Policy Management
 description: Overview of Advanced Group Policy Management
-author: jamiejdt
+author: dansimp
 ms.assetid: 2c12f3b4-8472-4c5b-b7f8-1c98a80d6b47
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/overview-of-advanced-group-policy-management.md b/mdop/agpm/overview-of-advanced-group-policy-management.md
index 895f84b049..ab987de9d0 100644
--- a/mdop/agpm/overview-of-advanced-group-policy-management.md
+++ b/mdop/agpm/overview-of-advanced-group-policy-management.md
@@ -1,8 +1,11 @@
 ---
 title: Overview of Advanced Group Policy Management
 description: Overview of Advanced Group Policy Management
-author: jamiejdt
+author: dansimp
 ms.assetid: 028de9dd-848b-42bc-a982-65ba5c433772
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/pending-gpo-commands-agpm30ops.md b/mdop/agpm/pending-gpo-commands-agpm30ops.md
index f85e8c4a53..335ce54580 100644
--- a/mdop/agpm/pending-gpo-commands-agpm30ops.md
+++ b/mdop/agpm/pending-gpo-commands-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Pending GPO Commands
 description: Pending GPO Commands
-author: jamiejdt
+author: dansimp
 ms.assetid: 3868dda0-8a41-4bba-9b0c-9f656f9a3cd5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/pending-gpo-commands-agpm40.md b/mdop/agpm/pending-gpo-commands-agpm40.md
index b216a3e7ed..828e0f34aa 100644
--- a/mdop/agpm/pending-gpo-commands-agpm40.md
+++ b/mdop/agpm/pending-gpo-commands-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Pending GPO Commands
 description: Pending GPO Commands
-author: jamiejdt
+author: dansimp
 ms.assetid: b62f49e1-43ab-4c93-8102-96cd97a4adad
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/pending-tab.md b/mdop/agpm/pending-tab.md
index fc93c3d1c9..b3797e17cc 100644
--- a/mdop/agpm/pending-tab.md
+++ b/mdop/agpm/pending-tab.md
@@ -1,8 +1,11 @@
 ---
 title: Pending Tab
 description: Pending Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 54a9a977-c0bc-4553-922b-b2e10e162df9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md b/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md
index 00f29a8d57..d3dd8dcca6 100644
--- a/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md
+++ b/mdop/agpm/performing-agpm-administrator-tasks-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Performing AGPM Administrator Tasks
 description: Performing AGPM Administrator Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: 9678b0f4-70a5-411e-a896-afa4dc9ea6c4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md b/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md
index 3d4f052a7c..73153462b6 100644
--- a/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md
+++ b/mdop/agpm/performing-agpm-administrator-tasks-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Performing AGPM Administrator Tasks
 description: Performing AGPM Administrator Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: bc746f39-bdc9-4e2a-bc48-c3c7905de098
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -35,7 +38,7 @@ Because the AGPM Administrator role includes the permissions for all other roles
 
 [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md), such as reviewing settings and comparing GPOs
 
- 
+ 
 
 ### Additional considerations
 
@@ -65,9 +68,9 @@ By default, the AGPM Administrator role has Full Control—all AGPM permissions:
 
 The **Modify Options** and **Modify Security** permissions are unique to the role of AGPM Administrator.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/performing-agpm-administrator-tasks.md b/mdop/agpm/performing-agpm-administrator-tasks.md
index 038af8f501..621841c925 100644
--- a/mdop/agpm/performing-agpm-administrator-tasks.md
+++ b/mdop/agpm/performing-agpm-administrator-tasks.md
@@ -1,8 +1,11 @@
 ---
 title: Performing AGPM Administrator Tasks
 description: Performing AGPM Administrator Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: 32e694a7-be64-4943-bce2-2a3a15e5341f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/performing-approver-tasks-agpm30ops.md b/mdop/agpm/performing-approver-tasks-agpm30ops.md
index 71f239915c..354cf61ee9 100644
--- a/mdop/agpm/performing-approver-tasks-agpm30ops.md
+++ b/mdop/agpm/performing-approver-tasks-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Performing Approver Tasks
 description: Performing Approver Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: 9f711824-191b-4b4b-a1c6-a3b2116006a4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ An Approver is a person authorized by an AGPM Administrator (Full Control) to cr
 **Important**  
 Make sure that you are connecting to the central archive for GPOs. For more information, see [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md).
 
- 
+ 
 
 -   [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm30ops.md)
 
@@ -36,7 +39,7 @@ Make sure that you are connecting to the central archive for GPOs. For more info
 **Note**  
 Before approving a GPO, an Approver should review the policy settings that it contains. The Approver role includes the permissions for the Reviewer role, so that an Approver can review policy settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) for more information.
 
- 
+ 
 
 ### Additional considerations
 
@@ -54,9 +57,9 @@ By default, the following permissions are provided for the Approver role:
 
 Also, an Approver has full control over GPOs that he created or controlled.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/performing-approver-tasks-agpm40.md b/mdop/agpm/performing-approver-tasks-agpm40.md
index 5f672fa959..85377d6b65 100644
--- a/mdop/agpm/performing-approver-tasks-agpm40.md
+++ b/mdop/agpm/performing-approver-tasks-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Performing Approver Tasks
 description: Performing Approver Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: e0a4b7fe-ce69-4755-9104-c7f523ea6b62
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ An Approver is a person authorized by an AGPM Administrator (Full Control) to cr
 **Important**  
 Make sure that you are connecting to the central archive for GPOs. For more information, see [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md).
 
- 
+ 
 
 -   [Approve or Reject a Pending Action](approve-or-reject-a-pending-action-agpm40.md)
 
@@ -36,7 +39,7 @@ Make sure that you are connecting to the central archive for GPOs. For more info
 **Note**  
 Before approving a GPO, an Approver should review the policy settings that it contains. The Approver role includes the permissions for the Reviewer role, so that an Approver can review policy settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) for more information.
 
- 
+ 
 
 ### Additional considerations
 
@@ -54,9 +57,9 @@ By default, the following permissions are provided for the Approver role:
 
 Also, an Approver has full control over GPOs that he created or controlled.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/performing-approver-tasks.md b/mdop/agpm/performing-approver-tasks.md
index b3f77c0555..643f462b96 100644
--- a/mdop/agpm/performing-approver-tasks.md
+++ b/mdop/agpm/performing-approver-tasks.md
@@ -1,8 +1,11 @@
 ---
 title: Performing Approver Tasks
 description: Performing Approver Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: 6f6310b3-19c1-47c9-8615-964ddd10ce14
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ An Approver is a person authorized by an AGPM Administrator (Full Control) to cr
 **Important**  
 Ensure that you are connecting to the central archive for GPOs. For more information, see [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md).
 
- 
+ 
 
 -   [Approve or Reject a Pending Action](approve-or-reject-a-pending-action.md)
 
@@ -36,7 +39,7 @@ Ensure that you are connecting to the central archive for GPOs. For more informa
 **Note**  
 Because the Approver role includes the permissions for the Reviewer role, an Approver can also review settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks.md) for more information.
 
- 
+ 
 
 ### Additional considerations
 
@@ -54,9 +57,9 @@ By default, the following permissions are provided for the Approver role:
 
 Also, an Approver has full control over GPOs that he created or controlled.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/performing-editor-tasks-agpm30ops.md b/mdop/agpm/performing-editor-tasks-agpm30ops.md
index b23493f83f..56a79bf8fa 100644
--- a/mdop/agpm/performing-editor-tasks-agpm30ops.md
+++ b/mdop/agpm/performing-editor-tasks-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Performing Editor Tasks
 description: Performing Editor Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: d4ac3277-2557-41cf-ac90-5adb6c30687c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ An Editor is a person authorized by an AGPM Administrator (Full Control) to make
 **Important**  
 Ensure that you are connecting to the central archive for GPOs. For more information, see [Configure an AGPM Server Connection](configure-an-agpm-server-connection-reviewer-agpm30ops.md).
 
- 
+ 
 
 -   [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-agpm30ops.md)
 
@@ -32,7 +35,7 @@ Ensure that you are connecting to the central archive for GPOs. For more informa
 **Note**  
 Because the Editor role includes the permissions for the Reviewer role, an Editor can also review settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md) for more information.
 
- 
+ 
 
 ### Additional considerations
 
@@ -46,9 +49,9 @@ By default, the following permissions are provided for the Editor role:
 
 -   Create Template
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/performing-editor-tasks-agpm40.md b/mdop/agpm/performing-editor-tasks-agpm40.md
index dd4b932e6d..cdac449d72 100644
--- a/mdop/agpm/performing-editor-tasks-agpm40.md
+++ b/mdop/agpm/performing-editor-tasks-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Performing Editor Tasks
 description: Performing Editor Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: 81976a01-2a95-4256-b703-9fb3c884ef34
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ In Advanced Group Policy Management (AGPM), an Editor is a person authorized by
 **Important**  
 Make sure that you are connecting to the central archive for GPOs. For more information, see [Configure an AGPM Server Connection](configure-an-agpm-server-connection-agpm40.md).
 
- 
+ 
 
 -   [Creating or Controlling a GPO](creating-or-controlling-a-gpo-agpm40-ed.md)
 
@@ -36,7 +39,7 @@ Make sure that you are connecting to the central archive for GPOs. For more info
 **Note**  
 Because the Editor role includes the permissions for the Reviewer role, an Editor can also review settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md) for more information.
 
- 
+ 
 
 ### Additional considerations
 
@@ -54,9 +57,9 @@ By default, the following permissions are provided for the Editor role:
 
 -   Create Template
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/performing-editor-tasks.md b/mdop/agpm/performing-editor-tasks.md
index 6d0ec33db4..e2b158f4f9 100644
--- a/mdop/agpm/performing-editor-tasks.md
+++ b/mdop/agpm/performing-editor-tasks.md
@@ -1,8 +1,11 @@
 ---
 title: Performing Editor Tasks
 description: Performing Editor Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: b1e62615-2e02-460e-81d1-4a3fbe59f62d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ An Editor is a person authorized by an AGPM Administrator (Full Control) to make
 **Important**  
 Ensure that you are connecting to the central archive for GPOs. For more information, see [Configure the AGPM Server Connection](configure-the-agpm-server-connection-reviewer.md).
 
- 
+ 
 
 -   [Creating, Controlling, or Importing a GPO](creating-controlling-or-importing-a-gpo-editor.md)
 
@@ -32,7 +35,7 @@ Ensure that you are connecting to the central archive for GPOs. For more informa
 **Note**  
 Because the Editor role includes the permissions for the Reviewer role, an Editor can also review settings and compare GPOs. See [Performing Reviewer Tasks](performing-reviewer-tasks.md) for more information.
 
- 
+ 
 
 ### Additional considerations
 
@@ -46,9 +49,9 @@ By default, the following permissions are provided for the Editor role:
 
 -   Create Template
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/performing-reviewer-tasks-agpm30ops.md b/mdop/agpm/performing-reviewer-tasks-agpm30ops.md
index 9da7ecfaf4..dc9f09707d 100644
--- a/mdop/agpm/performing-reviewer-tasks-agpm30ops.md
+++ b/mdop/agpm/performing-reviewer-tasks-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Performing Reviewer Tasks
 description: Performing Reviewer Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: 1faf396d-be0d-49ac-b063-0722fda2e43d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/performing-reviewer-tasks-agpm40.md b/mdop/agpm/performing-reviewer-tasks-agpm40.md
index 9c9f34dd64..03929f7e0b 100644
--- a/mdop/agpm/performing-reviewer-tasks-agpm40.md
+++ b/mdop/agpm/performing-reviewer-tasks-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Performing Reviewer Tasks
 description: Performing Reviewer Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: b5f0805c-da55-45a5-a94c-2473af92b54a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/performing-reviewer-tasks.md b/mdop/agpm/performing-reviewer-tasks.md
index 9a7cfb77c2..efab9279e1 100644
--- a/mdop/agpm/performing-reviewer-tasks.md
+++ b/mdop/agpm/performing-reviewer-tasks.md
@@ -1,8 +1,11 @@
 ---
 title: Performing Reviewer Tasks
 description: Performing Reviewer Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: 4bdd43fa-5c73-4900-8947-b45906f47f60
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/production-delegation-tab-agpm30ops.md b/mdop/agpm/production-delegation-tab-agpm30ops.md
index 9525a5030f..a66636f4d2 100644
--- a/mdop/agpm/production-delegation-tab-agpm30ops.md
+++ b/mdop/agpm/production-delegation-tab-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Production Delegation Tab
 description: Production Delegation Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 9851637d-d5c1-4d29-8582-e8779500a14e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/production-delegation-tab-agpm40.md b/mdop/agpm/production-delegation-tab-agpm40.md
index 1e9a808eef..12e0ac126a 100644
--- a/mdop/agpm/production-delegation-tab-agpm40.md
+++ b/mdop/agpm/production-delegation-tab-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Production Delegation Tab
 description: Production Delegation Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 046bb9bc-769a-4306-bc49-c159a9533552
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/recycle-bin-commands-agpm30ops.md b/mdop/agpm/recycle-bin-commands-agpm30ops.md
index a26de82f05..7f252a28e7 100644
--- a/mdop/agpm/recycle-bin-commands-agpm30ops.md
+++ b/mdop/agpm/recycle-bin-commands-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Recycle Bin Commands
 description: Recycle Bin Commands
-author: jamiejdt
+author: dansimp
 ms.assetid: ffe8f020-7aa9-40ad-8019-cc99901a7840
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/recycle-bin-commands-agpm40.md b/mdop/agpm/recycle-bin-commands-agpm40.md
index ea9308d563..e25387fa75 100644
--- a/mdop/agpm/recycle-bin-commands-agpm40.md
+++ b/mdop/agpm/recycle-bin-commands-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Recycle Bin Commands
 description: Recycle Bin Commands
-author: jamiejdt
+author: dansimp
 ms.assetid: 347a101f-0ba0-4afc-bd59-752cc06bb904
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/recycle-bin-tab.md b/mdop/agpm/recycle-bin-tab.md
index 7e684f4fb5..5b47c0650b 100644
--- a/mdop/agpm/recycle-bin-tab.md
+++ b/mdop/agpm/recycle-bin-tab.md
@@ -1,8 +1,11 @@
 ---
 title: Recycle Bin Tab
 description: Recycle Bin Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 9ce62e98-c03e-4a75-90e0-51be83c6d2db
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md
index 5252da0ff0..d727f2d26b 100644
--- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md
+++ b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp1.md
@@ -1,8 +1,11 @@
 ---
 title: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1
 description: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 91835bf8-e53c-4202-986e-8d37050d1267
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md
index c417fd3031..5ce4c30b65 100644
--- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md
+++ b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp2.md
@@ -1,8 +1,11 @@
 ---
 title: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2
 description: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP2
-author: jamiejdt
+author: dansimp
 ms.assetid: 0593cd11-3308-4942-bf19-8a7bb9447f01
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md
index 876c5e1474..24f3ccb1f0 100644
--- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md
+++ b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40-sp3.md
@@ -1,8 +1,11 @@
 ---
 title: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3
 description: Release Notes for Microsoft Advanced Group Policy Management 4.0 SP3
-author: jamiejdt
+author: dansimp
 ms.assetid: 955d7674-a8d9-4fc5-b18a-5a1639e38014
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md
index 0fe9f4eaae..abe185ad6b 100644
--- a/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md
+++ b/mdop/agpm/release-notes-for-microsoft-advanced-group-policy-management-40.md
@@ -1,8 +1,11 @@
 ---
 title: Release Notes for Microsoft Advanced Group Policy Management 4.0
 description: Release Notes for Microsoft Advanced Group Policy Management 4.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 44c19e61-c8e8-48aa-a2c2-20396d14d5bb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md b/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md
index 6b1a3f3e3d..891a770b95 100644
--- a/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md
+++ b/mdop/agpm/rename-a-gpo-or-template-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Rename a GPO or Template
 description: Rename a GPO or Template
-author: jamiejdt
+author: dansimp
 ms.assetid: 19d17ddf-8b58-4677-929e-9550fa388b93
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/rename-a-gpo-or-template-agpm40.md b/mdop/agpm/rename-a-gpo-or-template-agpm40.md
index a8e3ddcc5b..6eddae8e9e 100644
--- a/mdop/agpm/rename-a-gpo-or-template-agpm40.md
+++ b/mdop/agpm/rename-a-gpo-or-template-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Rename a GPO or Template
 description: Rename a GPO or Template
-author: jamiejdt
+author: dansimp
 ms.assetid: 84293f7a-4ff7-497e-bdbc-cabb70189a03
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/rename-a-gpo-or-template.md b/mdop/agpm/rename-a-gpo-or-template.md
index 9e21324eea..b4f6b328cf 100644
--- a/mdop/agpm/rename-a-gpo-or-template.md
+++ b/mdop/agpm/rename-a-gpo-or-template.md
@@ -1,8 +1,11 @@
 ---
 title: Rename a GPO or Template
 description: Rename a GPO or Template
-author: jamiejdt
+author: dansimp
 ms.assetid: 64a1aaf4-f672-48b5-94c6-473bf1076cf3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md b/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md
index 7c7a7d2e52..48168f5274 100644
--- a/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md
+++ b/mdop/agpm/request-control-of-a-previously-uncontrolled-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Request Control of a Previously Uncontrolled GPO
 description: Request Control of a Previously Uncontrolled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 00e8725d-5d7f-4eed-a5e6-c3631632cfbd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md b/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md
index 9ed9338221..90dde7498f 100644
--- a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md
+++ b/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Request Control of an Uncontrolled GPO
 description: Request Control of an Uncontrolled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: b668a67a-5a2c-4f6a-8b1c-efa3ca0794d4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md b/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md
index 13d0c681fc..aca66f0620 100644
--- a/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md
+++ b/mdop/agpm/request-control-of-an-uncontrolled-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Request Control of an Uncontrolled GPO
 description: Request Control of an Uncontrolled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: a34e0aeb-33a1-4c9f-b187-1d08493a785c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md b/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md
index be73f3d7cc..6ef7e4a702 100644
--- a/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md
+++ b/mdop/agpm/request-deletion-of-a-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Request Deletion of a GPO
 description: Request Deletion of a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 576ece5c-dc6d-4b5e-8628-01c15ae2c9a8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/request-deletion-of-a-gpo-agpm40.md b/mdop/agpm/request-deletion-of-a-gpo-agpm40.md
index 0dacac9629..7d9ad25c8e 100644
--- a/mdop/agpm/request-deletion-of-a-gpo-agpm40.md
+++ b/mdop/agpm/request-deletion-of-a-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Request Deletion of a GPO
 description: Request Deletion of a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 2410f7a1-ccca-44cf-ab26-76ad474409e7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md b/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md
index cd06413149..7179891f76 100644
--- a/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md
+++ b/mdop/agpm/request-deployment-of-a-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Request Deployment of a GPO
 description: Request Deployment of a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: f44ae0fb-bcf7-477b-b99e-9dd6a55ee597
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/request-deployment-of-a-gpo-agpm40.md b/mdop/agpm/request-deployment-of-a-gpo-agpm40.md
index 351e8091fe..11a8af4db4 100644
--- a/mdop/agpm/request-deployment-of-a-gpo-agpm40.md
+++ b/mdop/agpm/request-deployment-of-a-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Request Deployment of a GPO
 description: Request Deployment of a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 5783cfd0-bd93-46b4-8fa0-684bd39aa8fc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/request-deployment-of-a-gpo.md b/mdop/agpm/request-deployment-of-a-gpo.md
index 031eb90227..6c6043c1c1 100644
--- a/mdop/agpm/request-deployment-of-a-gpo.md
+++ b/mdop/agpm/request-deployment-of-a-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Request Deployment of a GPO
 description: Request Deployment of a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 9aa9af29-4754-4f72-b624-bb3e1087cbe1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md b/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md
index 9a0ff2a46c..0b1f4ef213 100644
--- a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md
+++ b/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Request Restoration of a Deleted GPO
 description: Request Restoration of a Deleted GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: dcc3baea-8af7-4886-a301-98b6ac5819cd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ A user account with the Editor role or necessary permissions in Advanced Group P
 **Note**  
 If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md).
 
- 
+ 
 
 ### Additional considerations
 
@@ -45,9 +48,9 @@ If a GPO was deleted from the production environment, restoring it to the archiv
 
 -   [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md b/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md
index 92aaa88e07..2ce8f77638 100644
--- a/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md
+++ b/mdop/agpm/request-restoration-of-a-deleted-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Request Restoration of a Deleted GPO
 description: Request Restoration of a Deleted GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: bac5ca3b-be47-49b5-bf1b-96280625fda8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ A user account with the Editor role or necessary permissions in Advanced Group P
 **Note**  
 If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Request Deployment of a GPO](request-deployment-of-a-gpo-agpm40.md).
 
- 
+ 
 
 ### Additional considerations
 
@@ -45,9 +48,9 @@ If a GPO was deleted from the production environment, restoring it to the archiv
 
 -   [Deleting or Restoring a GPO](deleting-or-restoring-a-gpo-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md
index 428ab4dd91..7a8c1a3ab6 100644
--- a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md
+++ b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Request the Creation of a New Controlled GPO
 description: Request the Creation of a New Controlled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 4194c2f3-8116-4a35-be1a-81c84072daec
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md
index cbb1507a80..bee0c5410d 100644
--- a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md
+++ b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Request the Creation of a New Controlled GPO
 description: Request the Creation of a New Controlled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: cb265238-386f-4780-a59a-0c9a4a87d736
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md
index f582317b23..d7c1fe6de4 100644
--- a/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md
+++ b/mdop/agpm/request-the-creation-of-a-new-controlled-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Request the Creation of a New Controlled GPO
 description: Request the Creation of a New Controlled GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: e1875d81-8553-42ee-8f3a-023d6ced86ca
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/resources-for-agpm.md b/mdop/agpm/resources-for-agpm.md
index 034f124b5f..5aa2774df3 100644
--- a/mdop/agpm/resources-for-agpm.md
+++ b/mdop/agpm/resources-for-agpm.md
@@ -1,8 +1,11 @@
 ---
 title: Resources for AGPM
 description: Resources for AGPM
-author: jamiejdt
+author: dansimp
 ms.assetid: b44b58c0-2810-40d6-9677-f2f64e1add75
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -16,19 +19,19 @@ ms.date: 08/30/2016
 
 ### Documents for download
 
--   [Advanced Group Policy Management 4.0 documents](https://go.microsoft.com/fwlink/?LinkID=158931)
+-   [Advanced Group Policy Management 4.0 documents](https://www.microsoft.com/download/details.aspx?id=13975)
 
 ### Microsoft Desktop Optimization Pack resources
 
--   [Microsoft Desktop Optimization Pack (MDOP) for Software Assurance TechCenter](https://go.microsoft.com/fwlink/?LinkID=159870) (http://www.microsoft.com/technet/mdop): Links to MDOP videos and resources.
+-   [Microsoft Desktop Optimization Pack (MDOP) for Software Assurance TechCenter](https://go.microsoft.com/fwlink/?LinkID=159870) (https://www.microsoft.com/technet/mdop): Links to MDOP videos and resources.
 
 -   [Enterprise products: MDOP](https://go.microsoft.com/fwlink/?LinkID=160297): Overviews and information about the benefits of applications in MDOP.
 
 ### Group Policy resources
 
--   [Group Policy TechCenter](https://go.microsoft.com/fwlink/?LinkID=145531) (http://www.microsoft.com/grouppolicy): Links to Group Policy documentation, tools, and downloads.
+-   [Group Policy TechCenter](https://go.microsoft.com/fwlink/?LinkID=145531) (https://www.microsoft.com/grouppolicy): Links to Group Policy documentation, tools, and downloads.
 
--   [Group Policy Team Blog](https://go.microsoft.com/fwlink/?LinkID=75192) (http://blogs.technet.com/GroupPolicy): Stay current on the latest news about Group Policy with articles by the Group Policy Team and other experts.
+-   [Group Policy Team Blog](https://go.microsoft.com/fwlink/?LinkID=75192) (https://blogs.technet.com/GroupPolicy): Stay current on the latest news about Group Policy with articles by the Group Policy Team and other experts.
 
 -   [Group Policy Forum](https://go.microsoft.com/fwlink/?LinkID=145532): Do you have questions about Group Policy or AGPM? You can post your questions to the forum, and receive answers from the experts.
 
diff --git a/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md b/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md
index fac192ab4d..37a1bcf1c0 100644
--- a/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md
+++ b/mdop/agpm/restore-a-deleted-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Restore a Deleted GPO
 description: Restore a Deleted GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 853feb0a-d2d9-4be9-a07e-e113a56a9968
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
 **Note**  
 If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Deploy a GPO](deploy-a-gpo-agpm30ops.md).
 
- 
+ 
 
 ### Additional considerations
 
@@ -43,9 +46,9 @@ If a GPO was deleted from the production environment, restoring it to the archiv
 
 -   [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/restore-a-deleted-gpo-agpm40.md b/mdop/agpm/restore-a-deleted-gpo-agpm40.md
index 5574466f98..173a4d8932 100644
--- a/mdop/agpm/restore-a-deleted-gpo-agpm40.md
+++ b/mdop/agpm/restore-a-deleted-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Restore a Deleted GPO
 description: Restore a Deleted GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 0a131d26-a741-4a51-b612-c0bc7dbba06b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
 **Note**  
 If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Deploy a GPO](deploy-a-gpo-agpm40.md).
 
- 
+ 
 
 ### Additional considerations
 
@@ -43,9 +46,9 @@ If a GPO was deleted from the production environment, restoring it to the archiv
 
 -   [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/restore-a-deleted-gpo.md b/mdop/agpm/restore-a-deleted-gpo.md
index a1c6654b55..a70c7bb3ae 100644
--- a/mdop/agpm/restore-a-deleted-gpo.md
+++ b/mdop/agpm/restore-a-deleted-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Restore a Deleted GPO
 description: Restore a Deleted GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: e6953296-7b7d-4d1e-ad82-d4a23044cdd7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ A user account with the Editor, Approver, or AGPM Administrator (Full Control) r
 **Note**  
 If a GPO was deleted from the production environment, restoring it to the archive will not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO. For information, see [Deploy a GPO](deploy-a-gpo.md).
 
- 
+ 
 
 ### Additional considerations
 
@@ -43,9 +46,9 @@ If a GPO was deleted from the production environment, restoring it to the archiv
 
 -   [Deleting, Restoring, or Destroying a GPO](deleting-restoring-or-destroying-a-gpo.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md b/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md
index 949add81e2..48e9b29395 100644
--- a/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md
+++ b/mdop/agpm/restore-the-archive-from-a-backup-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Restore the Archive from a Backup
 description: Restore the Archive from a Backup
-author: jamiejdt
+author: dansimp
 ms.assetid: b83f6173-a236-4da2-b16e-8df20920d4cc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/restore-the-archive-from-a-backup.md b/mdop/agpm/restore-the-archive-from-a-backup.md
index 24f21d9bb0..14a140fd80 100644
--- a/mdop/agpm/restore-the-archive-from-a-backup.md
+++ b/mdop/agpm/restore-the-archive-from-a-backup.md
@@ -1,8 +1,11 @@
 ---
 title: Restore the Archive from a Backup
 description: Restore the Archive from a Backup
-author: jamiejdt
+author: dansimp
 ms.assetid: 49666337-d72c-4e44-99e4-9eb59b2355a9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/review-gpo-links-agpm30ops.md b/mdop/agpm/review-gpo-links-agpm30ops.md
index 2dc27c3645..344d2114e2 100644
--- a/mdop/agpm/review-gpo-links-agpm30ops.md
+++ b/mdop/agpm/review-gpo-links-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Review GPO Links
 description: Review GPO Links
-author: jamiejdt
+author: dansimp
 ms.assetid: 5ae95afc-2b89-45cf-916c-efe2d43b2211
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/review-gpo-links-agpm40.md b/mdop/agpm/review-gpo-links-agpm40.md
index b091fe7b5e..0aa1c8288a 100644
--- a/mdop/agpm/review-gpo-links-agpm40.md
+++ b/mdop/agpm/review-gpo-links-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Review GPO Links
 description: Review GPO Links
-author: jamiejdt
+author: dansimp
 ms.assetid: 3aaba9da-f0aa-466f-bd1c-49f11d00ea54
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/review-gpo-links.md b/mdop/agpm/review-gpo-links.md
index 744acfe88b..5df2d37d92 100644
--- a/mdop/agpm/review-gpo-links.md
+++ b/mdop/agpm/review-gpo-links.md
@@ -1,8 +1,11 @@
 ---
 title: Review GPO Links
 description: Review GPO Links
-author: jamiejdt
+author: dansimp
 ms.assetid: 3c472448-f16a-493c-a229-5ca60a470965
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/review-gpo-settings-agpm30ops.md b/mdop/agpm/review-gpo-settings-agpm30ops.md
index 8aa78566fc..e8287b80ff 100644
--- a/mdop/agpm/review-gpo-settings-agpm30ops.md
+++ b/mdop/agpm/review-gpo-settings-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Review GPO Settings
 description: Review GPO Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: bed956d0-082e-4fa9-bf1e-572d0d3d02ec
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/review-gpo-settings-agpm40.md b/mdop/agpm/review-gpo-settings-agpm40.md
index e0cc440c5a..86d54adf3c 100644
--- a/mdop/agpm/review-gpo-settings-agpm40.md
+++ b/mdop/agpm/review-gpo-settings-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Review GPO Settings
 description: Review GPO Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: c346bcde-dd6a-4775-aeab-721ca3a361b2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/review-gpo-settings.md b/mdop/agpm/review-gpo-settings.md
index a2b5ace52f..31cdb5b678 100644
--- a/mdop/agpm/review-gpo-settings.md
+++ b/mdop/agpm/review-gpo-settings.md
@@ -1,8 +1,11 @@
 ---
 title: Review GPO Settings
 description: Review GPO Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: e82570b2-d8ce-4bf0-8ad7-8910409f3041
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md b/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md
index 3df1a1b26e..5317c7cad8 100644
--- a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md
+++ b/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Roll Back to a Previous Version of a GPO
 description: Roll Back to a Previous Version of a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 2a98ad8f-32cb-41eb-ab99-0318f2a55d81
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
 **Note**  
 To verify that the version that has been redeployed matches the version intended, examine a difference report for the two versions. In the **History** window for the GPO, highlight the two versions, and then right-click and select **Difference** and either **HTML Report** or **XML Report**.
 
- 
+ 
 
 ### Additional considerations
 
@@ -43,9 +46,9 @@ To verify that the version that has been redeployed matches the version intended
 
 -   [Performing Approver Tasks](performing-approver-tasks-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md b/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md
index 423e99d924..1f984420dd 100644
--- a/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md
+++ b/mdop/agpm/roll-back-to-a-previous-version-of-a-gpo.md
@@ -1,8 +1,11 @@
 ---
 title: Roll Back to a Previous Version of a GPO
 description: Roll Back to a Previous Version of a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 028631c0-4cb9-4642-90ad-04cd813051b7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
 **Note**  
 To verify that the version that has been redeployed matches the version intended, examine a difference report for the two versions. In the **History** window for the GPO, highlight the two versions, and then right-click and select **Difference** and either **HTML Report** or **XML Report**.
 
- 
+ 
 
 ### Additional considerations
 
@@ -43,9 +46,9 @@ To verify that the version that has been redeployed matches the version intended
 
 -   [Performing Approver Tasks](performing-approver-tasks.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md b/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md
index 3ba1c30f3f..eda0e2c1fe 100644
--- a/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md
+++ b/mdop/agpm/roll-back-to-an-earlier-version-of-a-gpo-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Roll Back to an Earlier Version of a GPO
 description: Roll Back to an Earlier Version of a GPO
-author: jamiejdt
+author: dansimp
 ms.assetid: 06ce9251-95e0-46d0-99c2-b9a0690e5891
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ A user account with the Approver or AGPM Administrator (Full Control) role or ne
 **Note**  
 To verify that the version that has been redeployed matches the version intended, examine a difference report for the two versions. In the **History** window for the GPO, highlight the two versions, and then right-click and select **Difference** and either **HTML Report** or **XML Report**.
 
- 
+ 
 
 ### Additional considerations
 
@@ -43,9 +46,9 @@ To verify that the version that has been redeployed matches the version intended
 
 -   [Performing Approver Tasks](performing-approver-tasks-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/search-and-filter-the-list-of-gpos.md b/mdop/agpm/search-and-filter-the-list-of-gpos.md
index 05bea8ac48..0266fdfa89 100644
--- a/mdop/agpm/search-and-filter-the-list-of-gpos.md
+++ b/mdop/agpm/search-and-filter-the-list-of-gpos.md
@@ -1,8 +1,11 @@
 ---
 title: Search and Filter the List of GPOs
 description: Search and Filter the List of GPOs
-author: jamiejdt
+author: dansimp
 ms.assetid: 1bc58a38-033c-4aed-9eb4-c239827f5501
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/set-a-default-template-agpm30ops.md b/mdop/agpm/set-a-default-template-agpm30ops.md
index 002227f846..8da4e564b8 100644
--- a/mdop/agpm/set-a-default-template-agpm30ops.md
+++ b/mdop/agpm/set-a-default-template-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Set a Default Template
 description: Set a Default Template
-author: jamiejdt
+author: dansimp
 ms.assetid: 84edbd69-451b-4c10-a898-781d4b75d09c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ As an Editor, you can specify which of the available templates will be the defau
 **Note**  
 A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs.
 
- 
+ 
 
 A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic.
 
@@ -51,9 +54,9 @@ A user account with the Editor or AGPM Administrator (Full Control) role or nece
 
 -   [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/set-a-default-template-agpm40.md b/mdop/agpm/set-a-default-template-agpm40.md
index fb4bda9884..c6b0a93381 100644
--- a/mdop/agpm/set-a-default-template-agpm40.md
+++ b/mdop/agpm/set-a-default-template-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Set a Default Template
 description: Set a Default Template
-author: jamiejdt
+author: dansimp
 ms.assetid: 07208b6b-cb3a-4f6c-9c84-36d4dc1486d8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ As an Editor, you can specify which of the available templates will be the defau
 **Note**  
 A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs.
 
- 
+ 
 
 A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management (AGPM) is required to complete this procedure. Review the details in "Additional considerations" in this topic.
 
@@ -51,9 +54,9 @@ A user account with the Editor or AGPM Administrator (Full Control) role or nece
 
 -   [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/set-a-default-template.md b/mdop/agpm/set-a-default-template.md
index b73319daa1..26a7b044a5 100644
--- a/mdop/agpm/set-a-default-template.md
+++ b/mdop/agpm/set-a-default-template.md
@@ -1,8 +1,11 @@
 ---
 title: Set a Default Template
 description: Set a Default Template
-author: jamiejdt
+author: dansimp
 ms.assetid: e0acf980-437f-4357-b237-298aaebe490d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ As an Editor, you can specify which of the available templates will be the defau
 **Note**  
 A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs.
 
- 
+ 
 
 A user account with the Editor or AGPM Administrator (Full Control) role or necessary permissions in Advanced Group Policy Management is required to complete this procedure. Review the details in "Additional considerations" in this topic.
 
@@ -51,9 +54,9 @@ A user account with the Editor or AGPM Administrator (Full Control) role or nece
 
 -   [Request the Creation of a New Controlled GPO](request-the-creation-of-a-new-controlled-gpo.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md b/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md
index 8f8f7492a3..4618d3c9fd 100644
--- a/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md
+++ b/mdop/agpm/start-and-stop-the-agpm-service-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Start and Stop the AGPM Service
 description: Start and Stop the AGPM Service
-author: jamiejdt
+author: dansimp
 ms.assetid: b9d26920-c439-4992-9a78-73e4fba8309d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ The AGPM Service is a Windows service that acts as a security proxy, managing cl
 **Important**  
 Stopping or disabling the AGPM Service will prevent AGPM Clients from performing any operations (such as listing or editing GPOs) through the server.
 
- 
+ 
 
 A user account with access to the AGPM Server (the computer on which the AGPM Service is installed) is required to complete this procedure.
 
@@ -32,15 +35,15 @@ A user account with access to the AGPM Server (the computer on which the AGPM Se
     **Caution**  
     Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting.
 
-     
+     
 
 ### Additional references
 
 -   [Managing the AGPM Service](managing-the-agpm-service-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md b/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md
index 31041a8b38..3cc649d89b 100644
--- a/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md
+++ b/mdop/agpm/start-and-stop-the-agpm-service-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Start and Stop the AGPM Service
 description: Start and Stop the AGPM Service
-author: jamiejdt
+author: dansimp
 ms.assetid: dcc9566c-c515-4fbe-b7f5-8ac030141307
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ The AGPM Service is a Windows service that acts as a security proxy, managing cl
 **Important**  
 Stopping or disabling the AGPM Service will prevent AGPM Clients from performing any operations (such as listing or editing GPOs) through the server.
 
- 
+ 
 
 A user account with access to the AGPM Server (the computer on which the AGPM Service is installed) is required to complete this procedure.
 
@@ -32,15 +35,15 @@ A user account with access to the AGPM Server (the computer on which the AGPM Se
     **Caution**  
     Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting.
 
-     
+     
 
 ### Additional references
 
 -   [Managing the AGPM Service](managing-the-agpm-service-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/start-and-stop-the-agpm-service.md b/mdop/agpm/start-and-stop-the-agpm-service.md
index 6a84cc5488..e81cfefbbd 100644
--- a/mdop/agpm/start-and-stop-the-agpm-service.md
+++ b/mdop/agpm/start-and-stop-the-agpm-service.md
@@ -1,8 +1,11 @@
 ---
 title: Start and Stop the AGPM Service
 description: Start and Stop the AGPM Service
-author: jamiejdt
+author: dansimp
 ms.assetid: 769aa0ce-224a-446f-9958-9518af4ad159
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ The AGPM Service is a Windows service that acts as a security proxy, managing cl
 **Important**  
 Stopping or disabling the AGPM Service will prevent AGPM clients from performing any operations (such as listing or editing GPOs) through the server.
 
- 
+ 
 
 A user account with access to the AGPM Server (the computer on which the AGPM Service is installed) is required to complete this procedure.
 
@@ -32,15 +35,15 @@ A user account with access to the AGPM Server (the computer on which the AGPM Se
     **Caution**  
     Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. To modify settings for the service, see [Managing the AGPM Service](managing-the-agpm-service.md).
 
-     
+     
 
 ### Additional references
 
 -   [Managing the AGPM Service](managing-the-agpm-service.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md
index 4bb0a1432b..e177ef9954 100644
--- a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md
+++ b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-25.md
@@ -1,8 +1,11 @@
 ---
 title: Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5
 description: Step-by-Step Guide for Microsoft Advanced Group Policy Management 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 454298c9-0fab-497a-9808-c0246a4c8db5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -65,7 +68,7 @@ Archives cannot be migrated from an AGPM Server or a GPOVault Server running Win
 
 For Windows Server 2003, if GPOVault Server is installed on the computer on which you want to install AGPM Server, it is recommended that you do not uninstall GPOVault Server before beginning the installation. The installation of AGPM Server will uninstall GPOVault Server and automatically transfer your existing GPOVault archive data to an AGPM archive.
 
- 
+ 
 
 ### AGPM Client requirements
 
@@ -78,16 +81,16 @@ Before you begin this scenario, create four user accounts. During the scenario,
 **Note**  
 **Link GPOs** permission is assigned to members of Domain Administrators and Enterprise Administrators by default. To assign **Link GPOs** permission to additional users or groups (such as accounts with the roles of AGPM Administrator or Approver), click the node for the domain and then click the **Delegation** tab, select **Link GPOs**, click **Add**, and select users or groups to which to assign the permission.
 
- 
+ 
 
 For this scenario, you perform actions with different accounts. You can either log on with each account as indicated, or you can use the **Run as** command to start the GPMC with the indicated account.
 
 **Note**  
 To use the **Run as** command with GPMC on Windows Server 2003, click **Start**, point to **Administrative Tools**, right-click **Group Policy Management**, and click **Run as**. Click **The following user** and enter credentials for an account.
 
-To use the **Run as** command with GPMC on Windows Vista, click the **Start** button, point to **Run**, and type **runas /user:***DomainName\\UserName***"mmc %windir%\\system32\\gpmc.msc"**, and click **OK**. Type the password for the account when prompted.
+To use the **Run as** command with GPMC on Windows Vista, click the **Start** button, point to **Run**, and type **runas /user:**DomainName\\UserName**"mmc %windir%\\system32\\gpmc.msc"**, and click **OK**. Type the password for the account when prompted.
 
- 
+ 
 
 ## Steps for installing and configuring AGPM
 
@@ -131,7 +134,7 @@ In this step, you install AGPM Server on the member server or domain controller
     **Caution**  
     Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. For information on how to modify settings for the service, see Help for Advanced Group Policy Management.
 
-     
+     
 
 ### Step 2: Install AGPM Client
 
@@ -208,12 +211,12 @@ As an AGPM Administrator (Full Control), you delegate domain-level access to GPO
 **Note**  
 You can also delegate access at the GPO level rather than the domain level. For details, see Help for Advanced Group Policy Management.
 
- 
+ 
 
 **Important**  
 You should restrict membership in the Group Policy Creator Owners group, so it cannot be used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.)
 
- 
+ 
 
 **To delegate access to all GPOs throughout a domain**
 
@@ -509,7 +512,7 @@ Occasionally you may discover after deleting a GPO that it is still needed. In t
     **Note**  
     Restoring a GPO to the archive does not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO as in [Step 3: Review and deploy a GPO](#bkmk-manage3).
 
-     
+     
 
 After editing and deploying a GPO, you may discover that recent changes to the GPO are causing a problem. In this step, you act as an Approver to roll back to a previous version of the GPO. You can roll back to any version in the history of the GPO. You can use comments and labels to identify known good versions and when specific changes were made.
 
@@ -526,11 +529,11 @@ After editing and deploying a GPO, you may discover that recent changes to the G
     **Note**  
     To verify that the version that has been redeployed is the version intended, examine a difference report for the two versions. In the **History** window for the GPO, select the two versions, right-click them, point to **Difference**, and then click either **HTML Report** or **XML Report**.
 
-     
+     
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md
index f240a50bb0..f0fa732a4c 100644
--- a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md
+++ b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-30.md
@@ -1,8 +1,11 @@
 ---
 title: Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0
 description: Step-by-Step Guide for Microsoft Advanced Group Policy Management 3.0
-author: jamiejdt
+author: dansimp
 ms.assetid: d067f465-d7c8-4f6d-b311-66b9b06874f7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -53,7 +56,7 @@ Computers on which you want to install AGPM must meet the following requirements
 **Note**  
 If you have AGPM 2.5 installed and are upgrading from Windows Server® 2003 to Windows Server 2008 or Windows Vista® with no service packs installed to Windows Vista with Service Pack 1, you must upgrade the operating system before you can upgrade to AGPM 3.0.
 
- 
+ 
 
 ### AGPM Server requirements
 
@@ -102,7 +105,7 @@ Before you begin this scenario, create four user accounts. During the scenario,
 **Note**  
 **Link GPOs** permission is assigned to members of Domain Administrators and Enterprise Administrators by default. To assign **Link GPOs** permission to additional users or groups (such as accounts with the roles of AGPM Administrator or Approver), click the node for the domain and then click the **Delegation** tab, select **Link GPOs**, click **Add**, and select users or groups to which to assign the permission.
 
- 
+ 
 
 ## Steps for installing and configuring AGPM
 
@@ -150,7 +153,7 @@ In this step, you install AGPM Server on the member server or domain controller
     **Caution**  
     Do not modify settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing so can prevent the AGPM Service from starting. For information on how to modify settings for the service, see Help for Advanced Group Policy Management.
 
-     
+     
 
 ### Step 2: Install AGPM Client
 
@@ -217,12 +220,12 @@ As an AGPM Administrator (Full Control), you delegate domain-level access to GPO
 **Note**  
 You can also delegate access at the GPO level rather than the domain level. For details, see Help for Advanced Group Policy Management.
 
- 
+ 
 
 **Important**  
 You should restrict membership in the Group Policy Creator Owners group, so it cannot be used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.)
 
- 
+ 
 
 **To delegate access to all GPOs throughout a domain**
 
@@ -345,31 +348,31 @@ In this step, you act as an Approver, creating reports and analyzing the setting
 
 **To review settings in the GPO**
 
-1.  On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver in AGPM. (Any Group Policy administrator with the Reviewer role, which is included in all of the other roles, can review the settings in a GPO.)
+1. On a computer on which you have installed AGPM Client, log on with a user account that has been assigned the role of Approver in AGPM. (Any Group Policy administrator with the Reviewer role, which is included in all of the other roles, can review the settings in a GPO.)
 
-2.  Open the e-mail inbox for the account and note that you have received an e-mail message from the AGPM alias with an Editor's request to deploy a GPO.
+2. Open the e-mail inbox for the account and note that you have received an e-mail message from the AGPM alias with an Editor's request to deploy a GPO.
 
-3.  In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs.
+3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs.
 
-4.  On the **Contents** tab in the details pane, click the **Pending** tab.
+4. On the **Contents** tab in the details pane, click the **Pending** tab.
 
-5.  Double-click **MyGPO** to display its history.
+5. Double-click **MyGPO** to display its history.
 
-6.  Review the settings in the most recent version of MyGPO:
+6. Review the settings in the most recent version of MyGPO:
 
-    1.  In the **History** window, right-click the GPO version with the most recent timestamp, click **Settings**, and then click **HTML Report** to display a summary of the GPO's settings.
+   1.  In the **History** window, right-click the GPO version with the most recent timestamp, click **Settings**, and then click **HTML Report** to display a summary of the GPO's settings.
 
-    2.  In the Web browser, click **show all** to display all of the settings in the GPO. Close the browser.
+   2.  In the Web browser, click **show all** to display all of the settings in the GPO. Close the browser.
 
-7.  Compare the most recent version of MyGPO to the first version checked in to the archive:
+7. Compare the most recent version of MyGPO to the first version checked in to the archive:
 
-    1.  In the **History** window, click the GPO version with the most recent time stamp. Press CTRL and click the oldest GPO version for which the **Computer Version** is not **\***.
+   1. In the **History** window, click the GPO version with the most recent time stamp. Press CTRL and click the oldest GPO version for which the **Computer Version** is not **\\***.
 
-    2.  Click the **Differences** button. The **Account Policies/Password Policy** section is highlighted in green and preceded by **\[+\]**, indicating that this setting is configured only in the latter version of the GPO.
+   2. Click the **Differences** button. The **Account Policies/Password Policy** section is highlighted in green and preceded by **\[+\]**, indicating that this setting is configured only in the latter version of the GPO.
 
-    3.  Click **Account Policies/Password Policy**. The **Minimum password length** setting is also highlighted in green and preceded by **\[+\]**, indicating that it is configured only in the latter version of the GPO.
+   3. Click **Account Policies/Password Policy**. The **Minimum password length** setting is also highlighted in green and preceded by **\[+\]**, indicating that it is configured only in the latter version of the GPO.
 
-    4.  Close the Web browser.
+   4. Close the Web browser.
 
 **To deploy the GPO to the production environment**
 
@@ -498,7 +501,7 @@ Occasionally you may discover after deleting a GPO that it is still needed. In t
     **Note**  
     Restoring a GPO to the archive does not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO as in [Step 3: Review and deploy a GPO](#bkmk-manage3).
 
-     
+     
 
 After editing and deploying a GPO, you may discover that recent changes to the GPO are causing a problem. In this step, you act as an Approver to roll back to a previous version of the GPO. You can roll back to any version in the history of the GPO. You can use comments and labels to identify known good versions and when specific changes were made.
 
@@ -515,11 +518,11 @@ After editing and deploying a GPO, you may discover that recent changes to the G
     **Note**  
     To verify that the version that has been redeployed is the version intended, examine a difference report for the two versions. In the **History** window for the GPO, select the two versions, right-click them, point to **Difference**, and then click either **HTML Report** or **XML Report**.
 
-     
+     
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md
index a2a8a06001..fa3516b9a3 100644
--- a/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md
+++ b/mdop/agpm/step-by-step-guide-for-microsoft-advanced-group-policy-management-40.md
@@ -1,8 +1,11 @@
 ---
 title: Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0
 description: Step-by-Step Guide for Microsoft Advanced Group Policy Management 4.0
-author: jamiejdt
+author: dansimp
 ms.assetid: dc6f9b16-b1d4-48f3-88bb-f29301f0131c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -57,7 +60,7 @@ If you have AGPM 2.5 installed and are upgrading from Windows Server® 2003 to
 
 If you have AGPM 3.0 installed, you do not have to upgrade the operating system before you upgrade to AGPM 4.0
 
- 
+ 
 
 In a mixed environment that includes both newer and older operating systems, there are some limitations to functionality, as indicated in the following table.
 
@@ -98,7 +101,7 @@ In a mixed environment that includes both newer and older operating systems, the
 
 
 
- 
+ 
 
 ### AGPM Server requirements
 
@@ -159,7 +162,7 @@ Before you begin this scenario, create four user accounts. During the scenario,
 **Note**  
 **Link GPOs** permission is assigned to members of Domain Administrators and Enterprise Administrators by default. To assign **Link GPOs** permission to additional users or groups (such as accounts that have the roles of AGPM Administrator or Approver), click the node for the domain and then click the **Delegation** tab, select **Link GPOs**, click **Add**, and select users or groups to which you want to assign the permission.
 
- 
+ 
 
 ## Steps for installing and configuring AGPM
 
@@ -219,7 +222,7 @@ In this step, you install AGPM Server on the member server or domain controller
     **Caution**  
     Do not change settings for the AGPM Service through **Administrative Tools** and **Services** in the operating system. Doing this can prevent the AGPM Service from starting. For information about how to change settings for the service, see Help for Advanced Group Policy Management.
 
-     
+     
 
 ### Step 2: Install AGPM Client
 
@@ -269,15 +272,17 @@ As an AGPM Administrator (Full Control), you designate the e-mail addresses of A
 
 **To configure e-mail notification for AGPM**
 
-1.  In the details pane, click the **Domain Delegation** tab.
+1.  In **Group Policy Management Editor** , navigate to the **Change Control** folder 
 
-2.  In the **From e-mail address** field, type the e-mail alias for AGPM from which notifications should be sent.
+2.  In the details pane, click the **Domain Delegation** tab.
 
-3.  In the **To e-mail address** field, type the e-mail address for the user account to which you intend to assign the Approver role.
+3.  In the **From e-mail address** field, type the e-mail alias for AGPM from which notifications should be sent.
 
-4.  In the **SMTP server** field, type a valid SMTP mail server.
+4.  In the **To e-mail address** field, type the e-mail address for the user account to which you intend to assign the Approver role.
 
-5.  In the **User name** and **Password** fields, type the credentials of a user who has access to the SMTP service. Click **Apply**.
+5.  In the **SMTP server** field, type a valid SMTP mail server.
+
+6.  In the **User name** and **Password** fields, type the credentials of a user who has access to the SMTP service. Click **Apply**.
 
 ### Step 5: Delegate access
 
@@ -286,12 +291,12 @@ As an AGPM Administrator (Full Control), you delegate domain-level access to GPO
 **Note**  
 You can also delegate access at the GPO level instead of the domain level. For more information, see Help for Advanced Group Policy Management.
 
- 
+ 
 
 **Important**  
 You should restrict membership in the Group Policy Creator Owners group so that it cannot be used to circumvent AGPM management of access to GPOs. (In the **Group Policy Management Console**, click **Group Policy Objects** in the forest and domain in which you want to manage GPOs, click **Delegation**, and then configure the settings to meet the needs of your organization.)
 
- 
+ 
 
 **To delegate access to all GPOs throughout a domain**
 
@@ -414,31 +419,31 @@ In this step, you act as an Approver, creating reports and analyzing the setting
 
 **To review settings in the GPO**
 
-1.  On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Approver in AGPM. Any Group Policy administrator with the Reviewer role, which is included in all of the other roles, can review the settings in a GPO.
+1. On a computer on which you have installed AGPM Client, log on with a user account that is assigned the role of Approver in AGPM. Any Group Policy administrator with the Reviewer role, which is included in all of the other roles, can review the settings in a GPO.
 
-2.  Open the e-mail inbox for the account and notice that you have received an e-mail message from the AGPM alias with an Editor's request to deploy a GPO.
+2. Open the e-mail inbox for the account and notice that you have received an e-mail message from the AGPM alias with an Editor's request to deploy a GPO.
 
-3.  In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs.
+3. In the **Group Policy Management Console** tree, click **Change Control** in the forest and domain in which you want to manage GPOs.
 
-4.  On the **Contents** tab in the details pane, click the **Pending** tab.
+4. On the **Contents** tab in the details pane, click the **Pending** tab.
 
-5.  Double-click **MyGPO** to display its history.
+5. Double-click **MyGPO** to display its history.
 
-6.  Review the settings in the most recent version of MyGPO:
+6. Review the settings in the most recent version of MyGPO:
 
-    1.  In the **History** window, right-click the GPO version with the most recent time stamp, click **Settings**, and then click **HTML Report** to display a summary of the GPO's settings.
+   1.  In the **History** window, right-click the GPO version with the most recent time stamp, click **Settings**, and then click **HTML Report** to display a summary of the GPO's settings.
 
-    2.  In the Web browser, click **show all** to display all the settings in the GPO. Close the browser.
+   2.  In the Web browser, click **show all** to display all the settings in the GPO. Close the browser.
 
-7.  Compare the most recent version of MyGPO to the first version checked in to the archive:
+7. Compare the most recent version of MyGPO to the first version checked in to the archive:
 
-    1.  In the **History** window, click the GPO version with the most recent time stamp. Press CTRL and then click the oldest GPO version for which the **Computer Version** is not **\***.
+   1. In the **History** window, click the GPO version with the most recent time stamp. Press CTRL and then click the oldest GPO version for which the **Computer Version** is not **\\***.
 
-    2.  Click the **Differences** button. The **Account Policies/Password Policy** section is highlighted in green and preceded by **\[+\]**. This indicates that the setting is configured only in the latter version of the GPO.
+   2. Click the **Differences** button. The **Account Policies/Password Policy** section is highlighted in green and preceded by **\[+\]**. This indicates that the setting is configured only in the latter version of the GPO.
 
-    3.  Click **Account Policies/Password Policy**. The **Minimum password length** setting is also highlighted in green and preceded by **\[+\]**, indicating that it is configured only in the latter version of the GPO.
+   3. Click **Account Policies/Password Policy**. The **Minimum password length** setting is also highlighted in green and preceded by **\[+\]**, indicating that it is configured only in the latter version of the GPO.
 
-    4.  Close the Web browser.
+   4. Close the Web browser.
 
 **To deploy the GPO to the production environment**
 
@@ -567,7 +572,7 @@ Occasionally you may discover after you delete a GPO that it is still needed. In
     **Note**  
     Restoring a GPO to the archive does not automatically redeploy it to the production environment. To return the GPO to the production environment, deploy the GPO as in [Step 3: Review and deploy a GPO](#bkmk-manage3).
 
-     
+     
 
 After editing and deploying a GPO, you may discover that recent changes to the GPO are causing a problem. In this step, you act as an Approver to roll back to an earlier version of the GPO. You can roll back to any version in the history of the GPO. You can use comments and labels to identify known good versions and when specific changes were made.
 
@@ -584,11 +589,11 @@ After editing and deploying a GPO, you may discover that recent changes to the G
     **Note**  
     To verify that the version that was redeployed is the version intended, examine a difference report for the two versions. In the **History** window for the GPO, select the two versions, right-click them, point to **Difference**, and then click either **HTML Report** or **XML Report**.
 
-     
+     
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/technical-overview-of-agpm.md b/mdop/agpm/technical-overview-of-agpm.md
index 7fe3c69409..3ea90686e5 100644
--- a/mdop/agpm/technical-overview-of-agpm.md
+++ b/mdop/agpm/technical-overview-of-agpm.md
@@ -1,8 +1,11 @@
 ---
 title: Technical Overview of AGPM
 description: Technical Overview of AGPM
-author: jamiejdt
+author: dansimp
 ms.assetid: 36bc0ab5-f752-474c-8559-721ea95169c2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -98,7 +101,7 @@ Table 1 describes both the items that AGPM installs or creates and the parts of
 
 
 
- 
+ 
 
 ### Additional references
 
@@ -116,7 +119,7 @@ The gpostate.xml file records the state of each GPO in the archive. The file is
 **Caution**  
 Do not manually edit gpostate.xml or the GPOs the archive contains. This information is provided only to enhance understanding of the AGPM archive. Instead, use the AGPM snap-in to change GPOs.
 
- 
+ 
 
 When AGPM creates the archive, it gives Full Control to SYSTEM, Administrators, and the AGPM Service Account (specified in the setup of AGPM Server). Changing permissions by using the AGPM user interface on the AGPM snap-in does not alter permissions on the archive, because the AGPM Service Account performs all operations on behalf of the logged-on user.
 
@@ -258,22 +261,22 @@ AGPM gives AGPM Administrators the flexibility to configure permissions at a mor
 
 
 
- 
+ 
 
 **Note**  
 **Export GPO** and **Import GPO** permissions are not available in AGPM 3.0 or 2.5.
 
 The ability to delegate access to GPOs in the production environment for a domain and the ability to limit the number of GPO versions stored are not available in AGPM 2.5.
 
- 
+ 
 
 ### Additional references
 
 For information about what tasks can be performed by Group Policy administrators assigned a particular role or about which permissions are required to perform a specific task, see the [Operations Guide for AGPM](https://go.microsoft.com/fwlink/?LinkId=160061).
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/template-commands-agpm30ops.md b/mdop/agpm/template-commands-agpm30ops.md
index 66b4332721..cd6beac689 100644
--- a/mdop/agpm/template-commands-agpm30ops.md
+++ b/mdop/agpm/template-commands-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Template Commands
 description: Template Commands
-author: jamiejdt
+author: dansimp
 ms.assetid: 2ec11b3f-0c5c-4788-97bd-bd4bf64ba51a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -27,7 +30,7 @@ Because a template cannot be altered, templates have no history. However, like a
 **Note**  
 A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs.
 
- 
+ 
 
 Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable.
 
@@ -53,7 +56,7 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 
 
- 
+ 
 
 ## Reports
 
@@ -81,7 +84,7 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 
 
- 
+ 
 
 ## Template management
 
@@ -113,7 +116,7 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 
 
- 
+ 
 
 ## Miscellaneous
 
@@ -141,7 +144,7 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 
 
- 
+ 
 
 ### Additional references
 
@@ -151,9 +154,9 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 -   [Performing Reviewer Tasks](performing-reviewer-tasks-agpm30ops.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/template-commands-agpm40.md b/mdop/agpm/template-commands-agpm40.md
index ef54dd6dfa..ad999f7a40 100644
--- a/mdop/agpm/template-commands-agpm40.md
+++ b/mdop/agpm/template-commands-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Template Commands
 description: Template Commands
-author: jamiejdt
+author: dansimp
 ms.assetid: 243a9b18-bf3f-44fa-94d7-5c793f7322da
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -27,7 +30,7 @@ Because a template cannot be altered, templates have no history. However, like a
 **Note**  
 A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs.
 
- 
+ 
 
 Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable.
 
@@ -53,7 +56,7 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 
 
- 
+ 
 
 ## Reports
 
@@ -81,7 +84,7 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 
 
- 
+ 
 
 ## Template management
 
@@ -113,7 +116,7 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 
 
- 
+ 
 
 ## Miscellaneous
 
@@ -141,7 +144,7 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 
 
- 
+ 
 
 ### Additional references
 
@@ -151,9 +154,9 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 -   [Performing Reviewer Tasks](performing-reviewer-tasks-agpm40.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/templates-tab.md b/mdop/agpm/templates-tab.md
index 5185339d76..75b67d4b89 100644
--- a/mdop/agpm/templates-tab.md
+++ b/mdop/agpm/templates-tab.md
@@ -1,8 +1,11 @@
 ---
 title: Templates Tab
 description: Templates Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 5676e9f9-eb52-49e1-a55d-15c1059af368
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -27,7 +30,7 @@ Because a template cannot be altered, templates have no history. However, like a
 **Note**  
 A template is an uneditable, static version of a GPO for use as a starting point for creating new, editable GPOs.
 
- 
+ 
 
 Right-clicking the **Group Policy Objects** list on this tab displays a shortcut menu, including whichever of the following options are applicable.
 
@@ -53,7 +56,7 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 
 
- 
+ 
 
 ## Reports
 
@@ -81,7 +84,7 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 
 
- 
+ 
 
 ## Template management
 
@@ -113,7 +116,7 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 
 
- 
+ 
 
 ## Miscellaneous
 
@@ -141,7 +144,7 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 
 
- 
+ 
 
 ### Additional references
 
@@ -151,9 +154,9 @@ Right-clicking the **Group Policy Objects** list on this tab displays a shortcut
 
 -   [Performing Reviewer Tasks](performing-reviewer-tasks.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md b/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md
index 005d631176..e3ebc0c30b 100644
--- a/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md
+++ b/mdop/agpm/test-a-gpo-in-a-separate-organizational-unit-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Test a GPO in a Separate Organizational Unit
 description: Test a GPO in a Separate Organizational Unit
-author: jamiejdt
+author: dansimp
 ms.assetid: 9a9e6d22-74e6-41d8-ac2f-12a1b76ad5a0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md b/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md
index 9a27501a70..9b374f5a81 100644
--- a/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md
+++ b/mdop/agpm/troubleshooting-advanced-group-policy-management-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Troubleshooting Advanced Group Policy Management
 description: Troubleshooting Advanced Group Policy Management
-author: jamiejdt
+author: dansimp
 ms.assetid: f7ece97c-e9f8-4b18-8c7a-a615c98d5c60
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/troubleshooting-advanced-group-policy-management.md b/mdop/agpm/troubleshooting-advanced-group-policy-management.md
index dbd8c55459..4284e54ffd 100644
--- a/mdop/agpm/troubleshooting-advanced-group-policy-management.md
+++ b/mdop/agpm/troubleshooting-advanced-group-policy-management.md
@@ -1,8 +1,11 @@
 ---
 title: Troubleshooting Advanced Group Policy Management
 description: Troubleshooting Advanced Group Policy Management
-author: jamiejdt
+author: dansimp
 ms.assetid: f58849cf-6c5b-44d8-b356-0ed7a5b24cee
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/troubleshooting-agpm-agpm40.md b/mdop/agpm/troubleshooting-agpm-agpm40.md
index 79b3dd25fd..27451ca6e3 100644
--- a/mdop/agpm/troubleshooting-agpm-agpm40.md
+++ b/mdop/agpm/troubleshooting-agpm-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Troubleshooting AGPM
 description: Troubleshooting AGPM
-author: jamiejdt
+author: dansimp
 ms.assetid: bedcd817-beb2-47bf-aebd-e3923c4fd06f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/troubleshooting-agpm40-upgrades.md b/mdop/agpm/troubleshooting-agpm40-upgrades.md
new file mode 100644
index 0000000000..0275e8dc91
--- /dev/null
+++ b/mdop/agpm/troubleshooting-agpm40-upgrades.md
@@ -0,0 +1,56 @@
+---
+title: Troubleshooting AGPM Upgrades
+description: Troubleshooting AGPM Upgrades
+author: dansimp
+ms.assetid: 1abbf0c1-fd32-46a8-a3ba-c005f066523d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
+ms.pagetype: mdop
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.prod: w10
+ms.date: 06/16/2016
+---
+
+
+# Troubleshooting AGPM Upgrades
+
+This section lists common issues that you may encounter when you upgrade your Advanced Group Policy Management (AGPM) server to a newer version (e.g. AGPM 4.0 to AGPM 4.3). To diagnose issues not listed here, it may be helpful to view the [Troubleshooting AGPM](troubleshooting-agpm-agpm40.md) or for an AGPM Administrator (Full Control) to use logging and tracing. For more information, see [Configure Logging and Tracing](configure-logging-and-tracing-agpm40.md).
+
+## What problems are you having?
+
+-   [Failed to generate a HTML GPO difference report (Error code 80004003)](#bkmk-error-80004003)
+
+### Failed to generate a HTML GPO difference report (Error code 80004003)
+
+-   **Cause**: You have installed the AGPM upgrade package with an incorrect account.
+
+-   **Solution**: You will need to be an AGPM administrator in order to fix this issue.
+    
+    -   Ensure you know the username & password of your **AGPM service account**.
+
+    -   Log onto your AGPM server interactively as your AGPM service account.
+        
+        -   This is critically important, as the install will fail if you use a different account.
+
+    -   Shutdown the AGPM service.
+    
+    -   Install the required hotfix.
+    
+    -   Connect to AGPM using an AGPM client to test that your difference reports are now functioning.
+    
+## Install Hotfix Package 1 for Microsoft Advanced Group Policy Management 4.0 SP3
+    
+**Issue fixed in this hotfix**: AGPM can't generate difference reports when it controls or manages new Group Policy Objects (GPOs).
+
+**How to get this update**: Install the latest version of Microsoft Desktop Optimization Pack ([March 2017 Servicing Release](https://www.microsoft.com/download/details.aspx?id=54967)). See [KB 4014009](https://support.microsoft.com/help/4014009/) for more information.
+
+More specifically, you can choose to download only the first file, `AGPM4.0SP1_Server_X64_KB4014009.exe`, from the list presented after pressing the download button.
+      
+The download link to the Microsoft Desktop Optimization Pack (March 2017 Servicing Release) can be found [here](https://www.microsoft.com/download/details.aspx?id=54967).
+      
+      
+## Reference link
+https://support.microsoft.com/help/3127165/hotfix-package-1-for-microsoft-advanced-group-policy-management-4-0-sp
+      
diff --git a/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md b/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md
index 99d8023d4d..1ad9a2806a 100644
--- a/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md
+++ b/mdop/agpm/uncontrolled-gpo-commands-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Uncontrolled GPO Commands
 description: Uncontrolled GPO Commands
-author: jamiejdt
+author: dansimp
 ms.assetid: 94c07b09-cb96-4ff2-b963-b25f103e73e9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/uncontrolled-gpo-commands-agpm40.md b/mdop/agpm/uncontrolled-gpo-commands-agpm40.md
index 7f1d842e74..0b74dd5b18 100644
--- a/mdop/agpm/uncontrolled-gpo-commands-agpm40.md
+++ b/mdop/agpm/uncontrolled-gpo-commands-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: Uncontrolled GPO Commands
 description: Uncontrolled GPO Commands
-author: jamiejdt
+author: dansimp
 ms.assetid: 05a8050f-adc3-465b-8524-bbe95745165c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/uncontrolled-tab.md b/mdop/agpm/uncontrolled-tab.md
index bc66a72df2..49a863ddc3 100644
--- a/mdop/agpm/uncontrolled-tab.md
+++ b/mdop/agpm/uncontrolled-tab.md
@@ -1,8 +1,11 @@
 ---
 title: Uncontrolled Tab
 description: Uncontrolled Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: d7e658bf-a72b-4813-bdc8-2fdb7251e742
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/use-a-test-environment-agpm30ops.md b/mdop/agpm/use-a-test-environment-agpm30ops.md
index 448a6a6979..825a592d62 100644
--- a/mdop/agpm/use-a-test-environment-agpm30ops.md
+++ b/mdop/agpm/use-a-test-environment-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: Use a Test Environment
 description: Use a Test Environment
-author: jamiejdt
+author: dansimp
 ms.assetid: 86295084-b39e-4040-bb3f-15c3c1e99b1a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/use-a-test-environment.md b/mdop/agpm/use-a-test-environment.md
index a7ebad6170..ca6badb289 100644
--- a/mdop/agpm/use-a-test-environment.md
+++ b/mdop/agpm/use-a-test-environment.md
@@ -1,8 +1,11 @@
 ---
 title: Use a Test Environment
 description: Use a Test Environment
-author: jamiejdt
+author: dansimp
 ms.assetid: b8d7b3ee-030a-4b5b-8223-4a3276fd47a7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md b/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md
index 8cad21f079..870b709194 100644
--- a/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md
+++ b/mdop/agpm/user-interface-advanced-group-policy-management-agpm30ops.md
@@ -1,8 +1,11 @@
 ---
 title: User Interface Advanced Group Policy Management
 description: User Interface Advanced Group Policy Management
-author: jamiejdt
+author: dansimp
 ms.assetid: 19aab694-8283-4d97-9425-1845404b461f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md b/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md
index 6b1b40ac33..7104e96d2a 100644
--- a/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md
+++ b/mdop/agpm/user-interface-advanced-group-policy-management-agpm40.md
@@ -1,8 +1,11 @@
 ---
 title: User Interface Advanced Group Policy Management
 description: User Interface Advanced Group Policy Management
-author: jamiejdt
+author: dansimp
 ms.assetid: 1bf67f6a-4f24-4020-a8c1-fe440de9caa3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/user-interface-advanced-group-policy-management.md b/mdop/agpm/user-interface-advanced-group-policy-management.md
index a4ee48001a..b8a2fbc5b2 100644
--- a/mdop/agpm/user-interface-advanced-group-policy-management.md
+++ b/mdop/agpm/user-interface-advanced-group-policy-management.md
@@ -1,8 +1,11 @@
 ---
 title: User Interface Advanced Group Policy Management
 description: User Interface Advanced Group Policy Management
-author: jamiejdt
+author: dansimp
 ms.assetid: 73324c99-adca-46dc-b516-ef78b7235f59
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/using-a-test-environment.md b/mdop/agpm/using-a-test-environment.md
index 8cda60da55..37535bf276 100644
--- a/mdop/agpm/using-a-test-environment.md
+++ b/mdop/agpm/using-a-test-environment.md
@@ -1,8 +1,11 @@
 ---
 title: Using a Test Environment
 description: Using a Test Environment
-author: jamiejdt
+author: dansimp
 ms.assetid: fc5fcc7c-1ac8-483a-a6bd-2279ae2ee3fb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -25,11 +28,11 @@ Before you request that a Group Policy Object (GPO) be deployed to the productio
 **Note**  
 You can also import a GPO from the production environment of the domain. For more information, see [Import a GPO from Production](import-a-gpo-from-production-agpm40-ed.md).
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/agpm/whats-new-in-agpm-30.md b/mdop/agpm/whats-new-in-agpm-30.md
index d2e95ce243..0483edc1f5 100644
--- a/mdop/agpm/whats-new-in-agpm-30.md
+++ b/mdop/agpm/whats-new-in-agpm-30.md
@@ -1,8 +1,11 @@
 ---
 title: What's New in AGPM 3.0
 description: What's New in AGPM 3.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 0d082b86-63c5-45ce-9529-6e5f37254f9d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/whats-new-in-agpm-40-sp1.md b/mdop/agpm/whats-new-in-agpm-40-sp1.md
index d4995121dc..6151532df1 100644
--- a/mdop/agpm/whats-new-in-agpm-40-sp1.md
+++ b/mdop/agpm/whats-new-in-agpm-40-sp1.md
@@ -1,8 +1,11 @@
 ---
 title: What's New in AGPM 4.0 SP1
 description: What's New in AGPM 4.0 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: c6a3d94a-13c3-44e6-a466-c3011879999e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/whats-new-in-agpm-40-sp2.md b/mdop/agpm/whats-new-in-agpm-40-sp2.md
index e0d49899be..407487d485 100644
--- a/mdop/agpm/whats-new-in-agpm-40-sp2.md
+++ b/mdop/agpm/whats-new-in-agpm-40-sp2.md
@@ -1,8 +1,11 @@
 ---
 title: What's New in AGPM 4.0 SP2
 description: What's New in AGPM 4.0 SP2
-author: jamiejdt
+author: dansimp
 ms.assetid: 5c0dcab4-f27d-4153-8b8e-b280b080be51
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/agpm/whats-new-in-agpm-40-sp3.md b/mdop/agpm/whats-new-in-agpm-40-sp3.md
index 45c3c62588..d60031b011 100644
--- a/mdop/agpm/whats-new-in-agpm-40-sp3.md
+++ b/mdop/agpm/whats-new-in-agpm-40-sp3.md
@@ -1,8 +1,11 @@
 ---
 title: What's New in AGPM 4.0 SP3
 description: What's New in AGPM 4.0 SP3
-author: jamiejdt
+author: dansimp
 ms.assetid: df495d55-9fbf-4f7e-a7af-3905f4f8790e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -27,7 +30,7 @@ AGPM 4.0 SP3 adds support for the Windows 10 and Windows Server 2016 operating
 
 ### Support for PowerShell
 
-AGPM 4.0 SP3 adds support for PowerShell cmdlets. For a list of the cmdlets available in AGPM 4.0 SP3, including descriptions and syntax, see [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://technet.microsoft.com/library/dn520245.aspx).
+AGPM 4.0 SP3 adds support for PowerShell cmdlets. For a list of the cmdlets available in AGPM 4.0 SP3, including descriptions and syntax, see [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://docs.microsoft.com/powershell/mdop/get-started?view=win-mdop2-ps).
 
 ### Customer feedback and hotfix rollup
 
@@ -186,7 +189,7 @@ The following table describes the behavior of AGPM 4.0 SP3 Client and Server in
 ## How to Get MDOP Technologies
 
 
-AGPM 4.0 SP3 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049).
+AGPM 4.0 SP3 is a part of the Microsoft Desktop Optimization Pack (MDOP) since MDOP 2015. MDOP is part of Microsoft Software Assurance. For more information about Microsoft Software Assurance and acquiring MDOP, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049).
 
 ## Related topics
 
diff --git a/mdop/agpm/whats-new-in-agpm-40.md b/mdop/agpm/whats-new-in-agpm-40.md
index a194d9f799..280c395196 100644
--- a/mdop/agpm/whats-new-in-agpm-40.md
+++ b/mdop/agpm/whats-new-in-agpm-40.md
@@ -1,8 +1,11 @@
 ---
 title: What's New in AGPM 4.0
 description: What's New in AGPM 4.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 31775f7f-a59c-4e64-a875-0adc9f5bc835
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md b/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md
index e482e17d1e..638fd0e895 100644
--- a/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md
+++ b/mdop/appv-v4/about-app-v-package-accelerators--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: About App-V Package Accelerators (App-V 4.6 SP1)
 description: About App-V Package Accelerators (App-V 4.6 SP1)
-author: jamiejdt
+author: manikadhiman
 ms.assetid: fc2d2375-8f17-4a6d-b374-771cb947cb8c
+ms.reviewer: 
+manager: dansimp
+ms.author: v-madhi
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,14 +22,14 @@ You can use App-V Package Accelerators to automatically sequence large, complex
 **Note**  
 In some cases, you are prompted to install an application locally to the computer running the App-V Sequencer before you can use the Package Accelerator. If you have to install an application, you must install the application to the application’s default location. This installation is not monitored by App-V Sequencer. When the App-V Package Accelerator is created, the author of the Package Accelerator determines whether to install an application locally is required.
 
- 
+ 
 
 App-V Sequencer extracts the required files from the App-V Package Accelerator and associated installation media to create a virtual package without having to monitor the installation of the application.
 
 **Important**  
 Disclaimer: The Microsoft Application Virtualization Sequencer does not give you any license rights to the software application you are using to create a Package Accelerator. You must abide by all end user license terms for such application. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using Application Virtualization Sequencer.
 
- 
+ 
 
 App-V Package Accelerators and project templates differ from each other. Package Accelerators are application-specific. Project templates enable users to save commonly used settings specific to an organization and apply them to multiple applications. You can also create project templates at the command prompt, while in contrast, you must use the App-V Sequencer console to create Package Accelerators. Additionally, creating a package by using a Package Accelerator and applying a project template is not supported.
 
@@ -57,9 +60,9 @@ Always save App-V Package Accelerators and any associated installation media in
 
 [How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1)](how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/about-application-licensing.md b/mdop/appv-v4/about-application-licensing.md
index ca7bdd05d0..039444d39d 100644
--- a/mdop/appv-v4/about-application-licensing.md
+++ b/mdop/appv-v4/about-application-licensing.md
@@ -1,12 +1,15 @@
 ---
 title: About Application Licensing
 description: About Application Licensing
-author: jamiejdt
+author: dansimp
 ms.assetid: 6b487641-1627-4e91-b829-04f001008176
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/about-application-virtualization-applications.md b/mdop/appv-v4/about-application-virtualization-applications.md
index b46e61da80..81f4351171 100644
--- a/mdop/appv-v4/about-application-virtualization-applications.md
+++ b/mdop/appv-v4/about-application-virtualization-applications.md
@@ -1,12 +1,15 @@
 ---
 title: About Application Virtualization Applications
 description: About Application Virtualization Applications
-author: jamiejdt
+author: dansimp
 ms.assetid: 3bf833b7-d172-4eef-a9e8-4b4f0c7eb15b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/about-application-virtualization-packages.md b/mdop/appv-v4/about-application-virtualization-packages.md
index 23b3f2f6dd..63e1915d67 100644
--- a/mdop/appv-v4/about-application-virtualization-packages.md
+++ b/mdop/appv-v4/about-application-virtualization-packages.md
@@ -1,12 +1,15 @@
 ---
 title: About Application Virtualization Packages
 description: About Application Virtualization Packages
-author: jamiejdt
+author: dansimp
 ms.assetid: 69bd35c1-7af3-43db-931b-3074780aa926
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/about-application-virtualization-servers.md b/mdop/appv-v4/about-application-virtualization-servers.md
index c0dcb517c7..6078a1f5cb 100644
--- a/mdop/appv-v4/about-application-virtualization-servers.md
+++ b/mdop/appv-v4/about-application-virtualization-servers.md
@@ -1,12 +1,15 @@
 ---
 title: About Application Virtualization Servers
 description: About Application Virtualization Servers
-author: jamiejdt
+author: dansimp
 ms.assetid: 60a45509-2112-44ca-8e28-c73b0c2ff85e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ You can also stream applications to clients from Application Virtualization Stre
 
 You can stream applications to the client directly from a file or disk. Some application virtualization deployment scenarios, which are characterized by low or unreliable connectivity or where bandwidth is limited, are ideally suited for streaming from file or disk.
 
- 
+ 
 
 One or more Application Virtualization Management Servers that share a single data store make up an *Application Virtualization system*.
 
@@ -34,9 +37,9 @@ One or more Application Virtualization Management Servers that share a single da
 
 [How to Set Up Publishing Servers](how-to-set-up-publishing-servers.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md b/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md
index 32ea80d6fb..2379da3dff 100644
--- a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md
+++ b/mdop/appv-v4/about-microsoft-application-virtualization-45-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: About Microsoft Application Virtualization 4.5 SP1
 description: About Microsoft Application Virtualization 4.5 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: f5dcff12-5956-41ef-bc36-b59200f90807
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md b/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md
index 54fb77e2d7..80134f7a39 100644
--- a/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md
+++ b/mdop/appv-v4/about-microsoft-application-virtualization-45-sp2.md
@@ -1,12 +1,15 @@
 ---
 title: About Microsoft Application Virtualization 4.5 SP2
 description: About Microsoft Application Virtualization 4.5 SP2
-author: jamiejdt
+author: dansimp
 ms.assetid: c498adbe-e331-42c8-99fe-29623fae2345
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-45.md b/mdop/appv-v4/about-microsoft-application-virtualization-45.md
index 5f8e44147c..40b58ca9d6 100644
--- a/mdop/appv-v4/about-microsoft-application-virtualization-45.md
+++ b/mdop/appv-v4/about-microsoft-application-virtualization-45.md
@@ -1,12 +1,15 @@
 ---
 title: About Microsoft Application Virtualization 4.5
 description: About Microsoft Application Virtualization 4.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 39f45a6f-ac55-4fd7-8a83-865e1a7034f8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -24,7 +27,7 @@ Formerly known as SoftGrid Application Virtualization, Microsoft Application Vir
 
     2.  Application Virtualization Streaming Server, a lightweight version which also ships as part of the Microsoft Desktop Optimization Pack and Microsoft Application Virtualization for Remote Desktop Services packages, offers application streaming including package and active upgrades without the Active Directory Domain Services and database overheads, and enables administrators to deploy to existing servers or add streaming to Electronic Software Delivery (ESD) systems.
 
-    3.  Standalone mode enables virtual applications to run without streaming and is interoperable with Microsoft Systems Management Server and System Center Configuration Manager 2007 and third-party ESD systems.
+    3.  Standalone mode enables virtual applications to run without streaming and is interoperable with Microsoft Endpoint Configuration Manager and third-party ESD systems.
 
 -   Globalization: The product is localized across 11 languages, includes support for foreign language applications that use special characters, and supports foreign language Active Directory and servers and runtime locale detection.
 
diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md
index dddea4565c..f2d49596f4 100644
--- a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md
+++ b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: About Microsoft Application Virtualization 4.6 SP1
 description: About Microsoft Application Virtualization 4.6 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 20917eb6-c998-43f8-aefa-307eb322dc8d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md
index 86ee3d3959..ece900187a 100644
--- a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md
+++ b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp2.md
@@ -1,12 +1,15 @@
 ---
 title: About Microsoft Application Virtualization 4.6 SP2
 description: About Microsoft Application Virtualization 4.6 SP2
-author: jamiejdt
+author: dansimp
 ms.assetid: 1429e314-9c38-472b-8687-3bed6cf0015c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ Microsoft Application Virtualization (App-V) 4.6 SP2 provides several enhanceme
 **Caution**  
 This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk.
 
- 
+ 
 
 **Support for Windows 8 and Windows Server 2012**
 
@@ -58,12 +61,12 @@ Before launching the App-V Sequencer, create the following registry value under
 
 
 
- 
+ 
 
 **Note**  
 On a computer running a 64-bit operating system, create the registry value under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard\\Overrides.
 
- 
+ 
 
 For each OSD-file in your Adobe Reader X package, add the following items under the <POLICIES> element:
 
@@ -95,9 +98,9 @@ App-V 4.6 SP2 includes a rollup of fixes to address issues found since the App
 [App-V 4.6 SP2 Release Notes](https://go.microsoft.com/fwlink/?LinkId=267600)  
 Provides the most up-to-date information about known issues with App-V 4.6 SP2.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md
index 19c1aefb73..ef4f01c277 100644
--- a/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md
+++ b/mdop/appv-v4/about-microsoft-application-virtualization-46-sp3.md
@@ -1,12 +1,15 @@
 ---
 title: About Microsoft Application Virtualization 4.6 SP3
 description: About Microsoft Application Virtualization 4.6 SP3
-author: jamiejdt
+author: dansimp
 ms.assetid: a6374fb0-1dfa-41f7-9a6a-3d2688492a8b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/appv-v4/about-microsoft-application-virtualization-46.md b/mdop/appv-v4/about-microsoft-application-virtualization-46.md
index c926dd4276..4e2161b45f 100644
--- a/mdop/appv-v4/about-microsoft-application-virtualization-46.md
+++ b/mdop/appv-v4/about-microsoft-application-virtualization-46.md
@@ -1,12 +1,15 @@
 ---
 title: About Microsoft Application Virtualization 4.6
 description: About Microsoft Application Virtualization 4.6
-author: jamiejdt
+author: dansimp
 ms.assetid: 34150f34-ee74-45a6-957e-9ea6c5a497de
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -29,7 +32,7 @@ Microsoft Application Virtualization (App-V) 4.6 provides the following enhancem
 **Note**  
 The App-V Management Server and Streaming Server have not been updated to version 4.6. Until they are updated, use App-V Management Server and Streaming Server 4.5 with the most recent service pack.
 
- 
+ 
 
 ## In This Section
 
@@ -37,9 +40,9 @@ The App-V Management Server and Streaming Server have not been updated to versio
 [App-V 4.6 Release Notes](app-v-46-release-notes.md)  
 Provides the most up-to-date information about known issues with Microsoft Application Virtualization (App-V) 4.6.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/about-publishing.md b/mdop/appv-v4/about-publishing.md
index 32272189cb..0aab27b334 100644
--- a/mdop/appv-v4/about-publishing.md
+++ b/mdop/appv-v4/about-publishing.md
@@ -1,12 +1,15 @@
 ---
 title: About Publishing
 description: About Publishing
-author: jamiejdt
+author: dansimp
 ms.assetid: 295074d7-123f-4740-b938-e4a371ee72fd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can centrally manage publishing applications to the Application Virtualizati
 **Note**  
 Before the client can refresh the publishing information, the client must know about the Application Virtualization Management Server. You configure the client with the necessary information about the server when you install the client.
 
- 
+ 
 
 When a client contacts the server for application publishing information, the server provides the client with the list of applications that the user has permission to access and the location of the corresponding Open Software Descriptor (OSD) files. The server also provides the relevant information about icons, file type associations, and shortcuts.
 
@@ -30,9 +33,9 @@ When a client contacts the server for application publishing information, the se
 
 [About Application Virtualization Applications](about-application-virtualization-applications.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/about-sequencing-phases.md b/mdop/appv-v4/about-sequencing-phases.md
index ab2f3e3551..e9f821e89a 100644
--- a/mdop/appv-v4/about-sequencing-phases.md
+++ b/mdop/appv-v4/about-sequencing-phases.md
@@ -1,12 +1,15 @@
 ---
 title: About Sequencing Phases
 description: About Sequencing Phases
-author: jamiejdt
+author: dansimp
 ms.assetid: c1cb7b6c-204c-48f2-848c-4bd5a3d5ecb6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,7 +26,7 @@ The four phases to sequencing an application and creating a virtual application
     **Important**  
     To view the advanced options select **Show Advanced Monitoring Options** on the **Package Information** page.
 
-     
+     
 
 2.  **Launch phase**—During the launch phase, you can specify any required file associations and security descriptors that should be configured with the package. You should open the application as many times as necessary to ensure application functionality and stability.
 
@@ -36,9 +39,9 @@ The four phases to sequencing an application and creating a virtual application
 
 [Application Virtualization Sequencer](application-virtualization-sequencer.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/about-sharing-package-accelerators-page.md b/mdop/appv-v4/about-sharing-package-accelerators-page.md
index b261087e23..880688dd13 100644
--- a/mdop/appv-v4/about-sharing-package-accelerators-page.md
+++ b/mdop/appv-v4/about-sharing-package-accelerators-page.md
@@ -1,12 +1,15 @@
 ---
 title: About Sharing Package Accelerators Page
 description: About Sharing Package Accelerators Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 9630cde0-e2c3-476f-8fa1-58b3c9f7d3f7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/about-the-application-virtualization-sequencer.md b/mdop/appv-v4/about-the-application-virtualization-sequencer.md
index 06e0049a02..c51d335407 100644
--- a/mdop/appv-v4/about-the-application-virtualization-sequencer.md
+++ b/mdop/appv-v4/about-the-application-virtualization-sequencer.md
@@ -1,12 +1,15 @@
 ---
 title: About the Application Virtualization Sequencer
 description: About the Application Virtualization Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: bee193ca-58bd-40c9-b41a-310435633895
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The Microsoft Application Virtualization (App-V) Sequencer monitors and records
 **Important**  
 To run a virtual application package the target computer must be running the appropriate version of the App-V client.
 
- 
+ 
 
 Virtual application packages run on target computers without interacting with the underlying operating system on the target computer because each application runs in a virtual environment and is isolated from other applications that are installed or running on the target computer. This isolation can reduce application conflicts and can help decrease the required amount of application pre-deployment testing.
 
@@ -80,16 +83,16 @@ The App-V Sequencer runs all services detected at sequencing time using the Loca
 **Important**  
 You should always save virtual application packages in a secure location.
 
- 
+ 
 
 ## Related topics
 
 
 [Application Virtualization Sequencer Overview](application-virtualization-sequencer-overview.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/about-the-application-virtualization-server-management-console.md b/mdop/appv-v4/about-the-application-virtualization-server-management-console.md
index 414e83ae8b..e3654b07e0 100644
--- a/mdop/appv-v4/about-the-application-virtualization-server-management-console.md
+++ b/mdop/appv-v4/about-the-application-virtualization-server-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: About the Application Virtualization Server Management Console
 description: About the Application Virtualization Server Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 108d0e4b-08fa-47b4-a737-d2c36c2641de
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/about-the-deployment-tab.md b/mdop/appv-v4/about-the-deployment-tab.md
index cfb1590eef..7a0a6c25b4 100644
--- a/mdop/appv-v4/about-the-deployment-tab.md
+++ b/mdop/appv-v4/about-the-deployment-tab.md
@@ -1,12 +1,15 @@
 ---
 title: About the Deployment Tab
 description: About the Deployment Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 12891798-baa4-45a5-b845-b9505ab95633
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -47,16 +50,15 @@ Use the **Server URL** controls to specify the virtual application server config
 
            Hostname
            
 
            Enables you to select the virtual application server or the load balancer in front of a group of virtual application servers that will stream the software package to an Application Virtualization Desktop Client. You must complete this item to create a sequenced application package, but you can change from the default %SFT_SOFTGRIDSERVER% environment variable to the actual hostname or IP address of a virtual application server.
            
 
            
-Note  
-
            If you choose not to specify a static hostname or IP address, on each Application Virtualization Desktop Client you must set up an environment variable called SFT_SOFTGRIDSERVER. Its value must be the hostname or IP address of the virtual application server or load balancer that is this client's source of applications. You should make this environment variable a system variable rather than a user variable. Any Application Virtualization Desktop Client session that is running on this computer during your assignment of this variable must be closed and then opened so that the resumed session will be aware of its new application source.
            
+Note
            If you choose not to specify a static hostname or IP address, on each Application Virtualization Desktop Client you must set up an environment variable called SFT_SOFTGRIDSERVER. Its value must be the hostname or IP address of the virtual application server or load balancer that is this client's source of applications. You should make this environment variable a system variable rather than a user variable. Any Application Virtualization Desktop Client session that is running on this computer during your assignment of this variable must be closed and then opened so that the resumed session will be aware of its new application source.
            
 
            
 
            
- 
+
 
            
 
 
 
            Port
            
-
            Enables you to specify the port on which the virtual application server or the load balancer will listen for an Application Virtualization Desktop Client's request for the package. This information is required to create a package, but you can change it. The default port is 554.
            
+
            Enables you to specify the port on which the virtual application server or the load balancer will listen for an Application Virtualization Desktop Client's request for the package. This information is required to create a package, but you can change it. The default port is 554.
            
 
 
 
            Path
            
@@ -65,7 +67,7 @@ Use the **Server URL** controls to specify the virtual application server config
 
 
 
- 
+
 
 ## Operating Systems
 
@@ -95,7 +97,7 @@ Use the **Operating Systems** controls to specify the application's operating sy
 
 
 
- 
+
 
 ## Output Options
 
@@ -118,7 +120,7 @@ Use the **Output Options** controls to specify the output options for the applic
 
            Compression Algorithm
            
 
            Use to select the method for compressing the SFT file for streaming across a network. Select one of the following compression methods:
            
 
              
-
            • Compressed—Specifies that the SFT file be compressed in the [ZLIB](https://go.microsoft.com/fwlink/?LinkId=111475) format.
              • 
+
            • Compressed—Specifies that the SFT file be compressed in the ZLIB format.
              • 
 
            • Not Compressed—The default; specifies that the SFT file not be compressed.
              • 
 
            
 
@@ -133,7 +135,7 @@ Use the **Output Options** controls to specify the output options for the applic
 
 
 
- 
+
 
 ## Related topics
 
@@ -142,9 +144,9 @@ Use the **Output Options** controls to specify the output options for the applic
 
 [Sequencer Console](sequencer-console.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/about-the-files-tab.md b/mdop/appv-v4/about-the-files-tab.md
index 0d26f953e1..2281e4a415 100644
--- a/mdop/appv-v4/about-the-files-tab.md
+++ b/mdop/appv-v4/about-the-files-tab.md
@@ -1,12 +1,15 @@
 ---
 title: About the Files Tab
 description: About the Files Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 3c20e720-4b0f-465b-b7c4-3013dae1c815
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/about-the-osd-tab.md b/mdop/appv-v4/about-the-osd-tab.md
index 485ad0e842..cd15ddc088 100644
--- a/mdop/appv-v4/about-the-osd-tab.md
+++ b/mdop/appv-v4/about-the-osd-tab.md
@@ -1,12 +1,15 @@
 ---
 title: About the OSD Tab
 description: About the OSD Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 7c78cd3a-91f2-4377-8c62-e52912906197
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/about-the-properties-tab.md b/mdop/appv-v4/about-the-properties-tab.md
index 36c2280463..49f24affb3 100644
--- a/mdop/appv-v4/about-the-properties-tab.md
+++ b/mdop/appv-v4/about-the-properties-tab.md
@@ -1,12 +1,15 @@
 ---
 title: About the Properties Tab
 description: About the Properties Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: a6cf6f51-3778-4c8d-9632-3af4005775d2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -66,7 +69,7 @@ Specifies the size of the primary and secondary feature blocks into which the SF
 **Note**  
 After the initial package has been created, the block size value is not changeable.
 
- 
+ 
 
 ## Related topics
 
@@ -75,9 +78,9 @@ After the initial package has been created, the block size value is not changeab
 
 [Sequencer Console](sequencer-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/about-the-sequencer-console.md b/mdop/appv-v4/about-the-sequencer-console.md
index 959177c046..c9ade6aad8 100644
--- a/mdop/appv-v4/about-the-sequencer-console.md
+++ b/mdop/appv-v4/about-the-sequencer-console.md
@@ -1,12 +1,15 @@
 ---
 title: About the Sequencer Console
 description: About the Sequencer Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 36ecba89-a0f5-4d4d-981c-7f581aa43695
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/about-the-virtual-file-system-tab.md b/mdop/appv-v4/about-the-virtual-file-system-tab.md
index d77975980a..c63df76467 100644
--- a/mdop/appv-v4/about-the-virtual-file-system-tab.md
+++ b/mdop/appv-v4/about-the-virtual-file-system-tab.md
@@ -1,12 +1,15 @@
 ---
 title: About the Virtual File System Tab
 description: About the Virtual File System Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 4d2e344d-3f3b-49fd-bbbd-fa5177e7af50
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/appv-v4/about-the-virtual-registry-tab.md b/mdop/appv-v4/about-the-virtual-registry-tab.md
index be0c2ef3e4..580a4456c0 100644
--- a/mdop/appv-v4/about-the-virtual-registry-tab.md
+++ b/mdop/appv-v4/about-the-virtual-registry-tab.md
@@ -1,12 +1,15 @@
 ---
 title: About the Virtual Registry Tab
 description: About the Virtual Registry Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: ca8d837f-8218-4f86-95fd-13a44dccd022
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,9 +24,9 @@ You can also choose to ignore the hosting system’s keys by selecting **Overrid
 The changes to the virtual registry **Settings** tab affect applications that are part of the specific sequenced application package, but they do not affect the operation of other applications that are streamed to or locally installed on the Application Virtualization Desktop Client.
 
 **Note**  
-  Exercise caution when changing virtual registry keys and values. Changing these keys and values might render your sequenced application package inoperable.
+  Exercise caution when changing virtual registry keys and values. Changing these keys and values might render your sequenced application package inoperable.
 
- 
+ 
 
 The left pane of the **Virtual Registry** tab displays the full list of virtual registries created during the sequencing of an application.
 
@@ -49,9 +52,9 @@ Displays the file attributes.
 
 [Sequencer Console](sequencer-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/about-the-virtual-services-tab.md b/mdop/appv-v4/about-the-virtual-services-tab.md
index 51a8b03093..9da1a5c4f1 100644
--- a/mdop/appv-v4/about-the-virtual-services-tab.md
+++ b/mdop/appv-v4/about-the-virtual-services-tab.md
@@ -1,12 +1,15 @@
 ---
 title: About the Virtual Services Tab
 description: About the Virtual Services Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: d31eea1b-9a37-42f1-8d7c-95881716e753
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/about-using-the-sequencer-command-line.md b/mdop/appv-v4/about-using-the-sequencer-command-line.md
index d6baafcffd..b54eeb6152 100644
--- a/mdop/appv-v4/about-using-the-sequencer-command-line.md
+++ b/mdop/appv-v4/about-using-the-sequencer-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: About Using the Sequencer Command Line
 description: About Using the Sequencer Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: 0fd5f81b-17f9-4065-bce2-8785e8aac7c7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,7 +26,7 @@ You can use the command line to create sequenced application packages. Using the
 **Important**  
 Sequencing at the command prompt allows for default sequencing only. If you need to change default sequencing parameters, you must either manually modify a sequenced application package or re-sequence the application.
 
- 
+ 
 
 All subsequent modifications to existing sequenced application packages must be made using the sequencing wizard.
 
@@ -45,9 +48,9 @@ To sequence an application by using the command prompt, the following conditions
 
 [How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/about-virtual-environments.md b/mdop/appv-v4/about-virtual-environments.md
index e24d538683..263e550a58 100644
--- a/mdop/appv-v4/about-virtual-environments.md
+++ b/mdop/appv-v4/about-virtual-environments.md
@@ -1,12 +1,15 @@
 ---
 title: About Virtual Environments
 description: About Virtual Environments
-author: jamiejdt
+author: dansimp
 ms.assetid: e03a8c72-56c1-4ae9-aa45-0283c50a154c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/add-app.md b/mdop/appv-v4/add-app.md
index b4c36d2e7f..be8e8866ee 100644
--- a/mdop/appv-v4/add-app.md
+++ b/mdop/appv-v4/add-app.md
@@ -1,12 +1,15 @@
 ---
 title: ADD APP
 description: ADD APP
-author: jamiejdt
+author: dansimp
 ms.assetid: 329fd0c8-a795-49be-b0fd-1367c5b4a34b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -57,7 +60,7 @@ Adds an application record.
 
 
 
- 
+ 
 
 For version 4.6, the following option has been added.
 
@@ -74,21 +77,21 @@ For version 4.6, the following option has been added.
 
 
 
- 
+ 
 
 **Note**  
 The resulting name of the application will be taken from the OSD file and not from the name provided in APP:<application>.
 
- 
+ 
 
 ## Related topics
 
 
 [SFTMIME Command Reference](sftmime--command-reference.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/add-package.md b/mdop/appv-v4/add-package.md
index 5f9bb40898..80ed132da5 100644
--- a/mdop/appv-v4/add-package.md
+++ b/mdop/appv-v4/add-package.md
@@ -1,12 +1,15 @@
 ---
 title: ADD PACKAGE
 description: ADD PACKAGE
-author: jamiejdt
+author: dansimp
 ms.assetid: aa83928d-a234-4395-831e-2a7ef786ff53
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/add-server.md b/mdop/appv-v4/add-server.md
index 15247ab378..546c6c2e3a 100644
--- a/mdop/appv-v4/add-server.md
+++ b/mdop/appv-v4/add-server.md
@@ -1,12 +1,15 @@
 ---
 title: ADD SERVER
 description: ADD SERVER
-author: jamiejdt
+author: dansimp
 ms.assetid: 4be2ac2e-a410-4711-9f84-f305393c8fa7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/add-type.md b/mdop/appv-v4/add-type.md
index 9a1caa64af..cfcbb9e6fb 100644
--- a/mdop/appv-v4/add-type.md
+++ b/mdop/appv-v4/add-type.md
@@ -1,12 +1,15 @@
 ---
 title: ADD TYPE
 description: ADD TYPE
-author: jamiejdt
+author: dansimp
 ms.assetid: 8f1d3978-9977-4851-9f46-fee6aefa3535
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/administrators-node.md b/mdop/appv-v4/administrators-node.md
index 5755924b3b..633c1da358 100644
--- a/mdop/appv-v4/administrators-node.md
+++ b/mdop/appv-v4/administrators-node.md
@@ -1,12 +1,15 @@
 ---
 title: Administrators Node
 description: Administrators Node
-author: jamiejdt
+author: dansimp
 ms.assetid: 5f462a0d-af53-4464-9891-7b712193c7e8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/administrators-results-pane-columns.md b/mdop/appv-v4/administrators-results-pane-columns.md
index 4591905944..57de6d3cde 100644
--- a/mdop/appv-v4/administrators-results-pane-columns.md
+++ b/mdop/appv-v4/administrators-results-pane-columns.md
@@ -1,12 +1,15 @@
 ---
 title: Administrators Results Pane Columns
 description: Administrators Results Pane Columns
-author: jamiejdt
+author: dansimp
 ms.assetid: 2ac86625-15a8-471a-846b-a42eae37ed72
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/administrators-results-pane.md b/mdop/appv-v4/administrators-results-pane.md
index 1040b74560..88516a4348 100644
--- a/mdop/appv-v4/administrators-results-pane.md
+++ b/mdop/appv-v4/administrators-results-pane.md
@@ -1,12 +1,15 @@
 ---
 title: Administrators Results Pane
 description: Administrators Results Pane
-author: jamiejdt
+author: dansimp
 ms.assetid: 92f4f924-c73b-45d6-8905-26f0f30aa189
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md
index 72c631c464..4eec31af83 100644
--- a/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md
+++ b/mdop/appv-v4/antivirus-running-dialog-box--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Antivirus Running Dialog Box (App-V 4.6 SP1)
 description: Antivirus Running Dialog Box (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: b720e308-8597-4470-a03e-fc36ffef84aa
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,16 +26,16 @@ Use the following procedure to stop the antivirus software from running during s
     **Important**  
     Remember to restart the antivirus software when you have finished sequencing the application.
 
-     
+     
 
 ## Related topics
 
 
 [Dialog Boxes (AppV 4.6 SP1)](dialog-boxes--appv-46-sp1-.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/app-v-45-sp2-release-notes.md b/mdop/appv-v4/app-v-45-sp2-release-notes.md
index 5c6b89d307..ab0e856ca4 100644
--- a/mdop/appv-v4/app-v-45-sp2-release-notes.md
+++ b/mdop/appv-v4/app-v-45-sp2-release-notes.md
@@ -1,12 +1,15 @@
 ---
 title: App-V 4.5 SP2 Release Notes
 description: App-V 4.5 SP2 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: 1b3a8a83-4523-4634-9f75-29bc22ca5815
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ To search these Release Notes, press CTRL+F.
 **Important**  
 Read these Release Notes thoroughly before you install the Microsoft Application Virtualization Management System. These Release Notes contain information that you need to successfully install the Application Virtualization Management System. These Release Notes contain information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other Application Virtualization Management System documentation, the latest change should be considered authoritative.
 
- 
+ 
 
 For updated information about known issues, please visit the Microsoft TechNet Library at [App-V 4.5 SP2 Release Notes](https://go.microsoft.com/fwlink/?LinkId=184640) (https://go.microsoft.com/fwlink/?LinkId=184640).
 
@@ -70,18 +73,18 @@ When this has been completed, install the App-V 4.5 SP2 Clients by using Setup.m
 
 When installing Microsoft Application Error Reporting, use the following command if you are installing or upgrading to the App-V 4.5 SP2 Desktop Client:
 
-**    msiexec /i dw20shared.msi APPGUID={C6FC75B9-7D86-4C44-8BDB-EAFE1F0E200D}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus**
+**msiexec /i dw20shared.msi APPGUID={C6FC75B9-7D86-4C44-8BDB-EAFE1F0E200D}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus**
 
 Alternatively, if you are installing or upgrading to the App-V 4.5 SP2 Client for Remote Desktop Services (formerly Terminal Services), use the following command:
 
-**    msiexec /i dw20shared.msi APPGUID={ECF80BBA-CA07-4A74-9ED6-E064F38AF1F5} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus**
+**msiexec /i dw20shared.msi APPGUID={ECF80BBA-CA07-4A74-9ED6-E064F38AF1F5} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus**
 
 **Note**  
 -   The APPGUID parameter references the product code of the App-V Clients that you install or upgrade. The product code is unique for each Setup.msi. You can use the Orca Database Editor or a similar tool to examine Windows Installer files and determine the product code. This step is required for all installations or upgrades to App-V 4.5 SP2.
 
 -   This step is not required if you are upgrading and have previously installed Dw20shared.msi.
 
- 
+ 
 
 ### Improving performance when sequencing the .NET Framework
 
@@ -209,9 +212,9 @@ Microsoft, Active Directory, ActiveSync, MS-DOS, Windows, Windows Server, and W
 
 All other trademarks are property of their respective owners.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/app-v-46-release-notes.md b/mdop/appv-v4/app-v-46-release-notes.md
index 073252ddf4..08a8ca5d64 100644
--- a/mdop/appv-v4/app-v-46-release-notes.md
+++ b/mdop/appv-v4/app-v-46-release-notes.md
@@ -1,12 +1,15 @@
 ---
 title: App-V 4.6 Release Notes
 description: App-V 4.6 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: a3eba129-edac-48bf-a933-3bf43a9873e5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ To search these Release Notes, press CTRL+F.
 **Important**  
 Read these Release Notes thoroughly before you install the Microsoft Application Virtualization (App-V) Management System. These Release Notes contain information that you need to successfully install Application Virtualization (App-V) 4.6. This document contains information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other App-V documentation, the latest change should be considered authoritative.
 
- 
+ 
 
 ## Protect Against Security Vulnerabilities and Viruses
 
@@ -40,7 +43,7 @@ WORKAROUND   Open the old package with either the App-V 4.5 SP1 Sequencer or
 **Note**  
 Alternatively, at the command prompt, the App-V Sequencer can generate the new .msi file by using the */OPEN* and */MSI* parameters, for example, `SFTSequencer /Open:”package.sprj” /MSI`. For more information, see [How to Upgrade a Virtual Application by Using the Command Line](how-to-upgrade-a-virtual-application-by-using-the-command-line.md).
 
- 
+ 
 
 ### Release Notes Copyright Information
 
@@ -56,9 +59,9 @@ Microsoft, Active Directory, ActiveSync, ActiveX, Excel, SQL Server, Windows, Wi
 
 All other trademarks are property of their respective owners.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/app-v-46-sp1-release-notes.md b/mdop/appv-v4/app-v-46-sp1-release-notes.md
index 157b875063..dd7fa73a1b 100644
--- a/mdop/appv-v4/app-v-46-sp1-release-notes.md
+++ b/mdop/appv-v4/app-v-46-sp1-release-notes.md
@@ -1,12 +1,15 @@
 ---
 title: App-V 4.6 SP1 Release Notes
 description: App-V 4.6 SP1 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: aeb6784a-864a-4f4e-976b-40c34dcfd8d6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ To search these Release Notes, press CTRL+F.
 **Important**  
 Read these Release Notes thoroughly before you install the Microsoft Application Virtualization (App-V) Management System. These Release Notes contain information that helps you successfully install Application Virtualization (App-V) 4.6 SP1. This document contains information that is not available in the product documentation. If there is a difference between these Release Notes and other App-V documentation, the latest change should be considered authoritative.
 
- 
+ 
 
 ## Protect Against Security Vulnerabilities and Viruses
 
@@ -95,9 +98,9 @@ Microsoft, Active Directory, ActiveSync, ActiveX, Excel, SQL Server, Windows, Wi
 
 All other trademarks are property of their respective owners.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/app-v-46-sp2-release-notes.md b/mdop/appv-v4/app-v-46-sp2-release-notes.md
index 4078f1da7e..227967a34a 100644
--- a/mdop/appv-v4/app-v-46-sp2-release-notes.md
+++ b/mdop/appv-v4/app-v-46-sp2-release-notes.md
@@ -1,12 +1,15 @@
 ---
 title: App-V 4.6 SP2 Release Notes
 description: App-V 4.6 SP2 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: abb536f0-e187-4c5b-952a-f837abd10ad2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -33,7 +36,7 @@ We are interested in your feedback on App-V 4.6 SP2. You can send your feedbac
 **Note**  
 This email address is not a support channel, but your feedback will help us to plan future changes for our documentation and product releases.
 
- 
+ 
 
 For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page.
 
@@ -63,7 +66,7 @@ fsutil 8dot3name set Q: 0
 **Note**  
 You do not need to change this setting on the App-V client because the App-V file system properly handles short paths on Windows 8 or Windows Server 2012.
 
- 
+ 
 
 ###  App-V does not override the default handler for file type or protocol associations on Windows 8
 
@@ -101,9 +104,9 @@ Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Win
 
 [About Microsoft Application Virtualization 4.6 SP2](about-microsoft-application-virtualization-46-sp2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/app-v-46-sp3-release-notes.md b/mdop/appv-v4/app-v-46-sp3-release-notes.md
index 7544c3e742..d62afda16b 100644
--- a/mdop/appv-v4/app-v-46-sp3-release-notes.md
+++ b/mdop/appv-v4/app-v-46-sp3-release-notes.md
@@ -1,12 +1,15 @@
 ---
 title: App-V 4.6 SP3 Release Notes
 description: App-V 4.6 SP3 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: 206fadeb-59cc-47b4-836f-191ab1c27ff8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/appv-v4/app-v-application-wmi-class.md b/mdop/appv-v4/app-v-application-wmi-class.md
index 4b1cf3e3dd..3567a8da0e 100644
--- a/mdop/appv-v4/app-v-application-wmi-class.md
+++ b/mdop/appv-v4/app-v-application-wmi-class.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Application WMI Class
 description: App-V Application WMI Class
-author: jamiejdt
+author: dansimp
 ms.assetid: b79b0d5a-ba57-442f-8bb4-d7154fc056f9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/app-v-client-registry-values-sp1.md b/mdop/appv-v4/app-v-client-registry-values-sp1.md
index 883ac02651..5edc5870e2 100644
--- a/mdop/appv-v4/app-v-client-registry-values-sp1.md
+++ b/mdop/appv-v4/app-v-client-registry-values-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Client Registry Values
 description: App-V Client Registry Values
-author: jamiejdt
+author: dansimp
 ms.assetid: 46af5209-9762-47b9-afdb-9a2947e013f7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -14,12 +17,12 @@ ms.date: 08/30/2016
 # App-V Client Registry Values
 
 
-The Microsoft Application Virtualization (App-V) client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. This topic lists all the Application Virtualization (App-V) client registry keys and explains their uses.
+The Microsoft Application Virtualization (App-V) client stores its configuration in the registry. You can gather some useful information about the client if you understand the format of data in the registry. You can also configure many client actions by changing registry entries. This topic lists all the Application Virtualization (App-V) client registry keys and explains their uses.
 
-**Important**  
+**Important**  
 On a computer running a 64-bit operating system, the keys and values described in the following sections will be under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\Client.
 
- 
+
 
 ## Configuration Key
 
@@ -49,45 +52,44 @@ The following table provides information about the registry values associated wi
 
            Do not modify.
            
 
 
-
            Version 
            
-
            String 
            
-
            4.5.0.xxx 
            
-
            Do not modify. 
            
+
            Version 
            
+
            String 
            
+
            4.5.0.xxx 
            
+
            Do not modify. 
            
 
 
-
            Drivers 
            
-
            String 
            
-
            Sftfs.sys 
            
+
            Drivers 
            
+
            String 
            
+
            Sftfs.sys 
            
 
            If this key value is present, it contains the name of the driver that caused a stop error the last time the core was starting. After you have fixed the stop error, you must delete this key value so that sftlist can start.
            
 
 
-
            InstallPath 
            
-
            String 
            
+
            InstallPath 
            
+
            String 
            
 
            Default=C:\Program Files\Microsoft Application Virtualization Client
            
-
            The location where the client is installed. Do not modify. 
            
+
            The location where the client is installed. Do not modify. 
            
 
 
-
            LogFileName 
            
-
            String 
            
+
            LogFileName 
            
+
            String 
            
 
            Default=CSIDL_COMMON_APPDATA\Microsoft\Application Virtualization Client\sftlog.txt
            
 
            The path and name for the client log file.
            
 
            
-Note  
-
            If you are running an earlier version than App-V 4.6, SP1 and you modify the log file name or location, you must restart the sftlist service for the change to take effect.
            
+Note
            If you are running an earlier version than App-V 4.6, SP1 and you modify the log file name or location, you must restart the sftlist service for the change to take effect.
            
 
            
 
            
- 
+
 
            
 
            
 
 
-
            LogMinSeverity 
            
-
            DWORD 
            
+
            LogMinSeverity 
            
+
            DWORD 
            
 
            Default=4, Informational
            
 
            Controls which messages are written to the log. The value indicates a threshold of what is logged—everything less than or equal to that value is logged. For example, a value of 0x3 (Warning) indicates that Warnings (0x3), Errors (0x2), and Critical Errors (0x1) are logged.
            
 
            Value Range: 0x0 = None, 0x1 = Critical, 0x2 = Error, 0x3 = Warning, 0x4 = Information (Default), 0x5 = Verbose.
            
 
            The log level is configurable from the Application Virtualization (App-V) client console and from the command prompt. At a command prompt, the command sftlist.exe /verboselog will increase the log level to verbose. For more information on command-line details see
            
-
            https://go.microsoft.com/fwlink/?LinkId=141467https://go.microsoft.com/fwlink/?LinkId=141467
            
+
            https://go.microsoft.com/fwlink/?LinkId=141467https://go.microsoft.com/fwlink/?LinkId=141467
            
 
            .
            
 
 
@@ -128,31 +130,31 @@ The following table provides information about the registry values associated wi
 
            ApplicationSourceRoot
            
 
            String
            
 
            rtsps://mainserver:322/prodapps
            
-
            https://mainserver:443/prodapps
            
-
            file://\\uncserver\share\prodapps
            
-
            file://\\uncserver\share
            
+
            https://mainserver:443/prodapps
            
+
            file://\uncserver\share\prodapps
            
+
            file://\uncserver\share
            
 
            Enables an administrator or electronic software distribution (ESD) system to ensure application loading is performed according to the topology management scheme. Use this key value to override the OSD CODEBASE for the HREF element (for example, the source location) for an application. Application Source Root supports URLs and Universal Naming Convention (UNC) path formats.
            
-
            The correct format for the URL path is protocol://servername:[port][/path][/], where port and path are optional. If a port is not specified, the default port for the protocol is used. Only the protocol://server:port portion of the OSD URL is replaced. 
            
-
            The correct format for the UNC path is \\computername\sharefolder\[folder][\], where folder is optional. The computer name can be a fully qualified domain name (FQDN) or an IP address, and sharefolder can be a drive letter. Only the \\computername\sharefolder or drive letter portion of the OSD path is replaced. 
            
+
            The correct format for the URL path is protocol://servername:[port][/path][/], where port and path are optional. If a port is not specified, the default port for the protocol is used. Only the protocol://server:port portion of the OSD URL is replaced. 
            
+
            The correct format for the UNC path is \computername\sharefolder[folder][], where folder is optional. The computer name can be a fully qualified domain name (FQDN) or an IP address, and sharefolder can be a drive letter. Only the \computername\sharefolder or drive letter portion of the OSD path is replaced. 
            
 
 
 
            OSDSourceRoot
            
 
            String
            
-
            \\computername\sharefolder\resource
            
-
            \\computername\content
            
+
            \computername\sharefolder\resource
            
+
            \computername\content
            
 
            C:\foldername
            
-
            http://computername/productivity/
            
-
            https://computername/productivity/
            
+
            http://computername/productivity/
            
+
            https://computername/productivity/
            
 
            Enables an administrator to specify a source location for OSD file retrieval for a sequenced application package during publication. Acceptable formats for the OSDSourceRoot include UNC paths and URLs (http or https).
            
 
 
 
            IconSourceRoot
            
 
            String
            
-
            \\computername\sharefolder\resource
            
-
            \\computername\content
            
+
            \computername\sharefolder\resource
            
+
            \computername\content
            
 
            C:\foldername
            
-
            http://computername/productivity/
            
-
            https://computername/productivity/
            
+
            http://computername/productivity/
            
+
            https://computername/productivity/
            
 
            Enables an administrator to specify a source location for icon file retrieval for a sequenced application package during publication. Acceptable formats for the IconSourceRoot include UNC paths and URLs (http or https).
            
 
 
@@ -186,89 +188,89 @@ The following table provides information about the registry values associated wi
 
            Restart the sftlist service for the change to take effect.
            
 
 
-
            UserDataDirectory 
            
-
            String 
            
+
            UserDataDirectory 
            
+
            String 
            
 
            %APPDATA%
            
 
            Location where the icon cache and user settings are stored.
            
 
 
-
            GlobalDataDirectory 
            
-
            String 
            
-
            C:\Users\Public\Documents 
            
+
            GlobalDataDirectory 
            
+
            String 
            
+
            C:\Users\Public\Documents 
            
 
            Directory to use for global App-V data, including caches for OSD files, icon files, shortcut information, and SystemGuard resources such as .ini files.
            
 
 
-
            AllowCrashes 
            
-
            DWORD 
            
-
            0 or 1 
            
+
            AllowCrashes 
            
+
            DWORD 
            
+
            0 or 1 
            
 
            Default=0: A value of 0 means that the client tries to catch internal program exceptions so that other user applications can recover and continue when a crash happens. A value of 1 means that the client allows the internal program exceptions to occur so that they can be captured in a debugger.
            
 
 
-
            CoreInternalTimeout 
            
-
            DWORD 
            
+
            CoreInternalTimeout 
            
+
            DWORD 
            
 
            60
            
-
            Time-out in seconds for internal IPC requests between core and front-end. Do not modify. 
            
+
            Time-out in seconds for internal IPC requests between core and front-end. Do not modify. 
            
 
 
-
            DefaultSuiteCombineTime 
            
-
            DWORD 
            
+
            DefaultSuiteCombineTime 
            
+
            DWORD 
            
 
            10
            
-
            This value is used to indicate how soon after being started that a program can shut down and not generate any error messages when another application in the same suite is running. 
            
+
            This value is used to indicate how soon after being started that a program can shut down and not generate any error messages when another application in the same suite is running. 
            
 
 
-
            SerializedSuiteLaunchTimeout 
            
-
            DWORD 
            
+
            SerializedSuiteLaunchTimeout 
            
+
            DWORD 
            
 
            Default=60000
            
-
            Defines how long in milliseconds the client will wait as it tries to serialize program starts in the same suite. If the client times out, the program start will continue but it will not be serialized. 
            
+
            Defines how long in milliseconds the client will wait as it tries to serialize program starts in the same suite. If the client times out, the program start will continue but it will not be serialized. 
            
 
 
-
            ScriptTimeout 
            
-
            DWORD 
            
+
            ScriptTimeout 
            
+
            DWORD 
            
 
            300
            
-
            Default time-out in seconds for scripts in OSD file if WAIT=TRUE. You can specify per-script time-outs with TIMEOUT instead of WAIT. A value of 0 means no wait, and 0xFFFFFFFF means wait forever. 
            
+
            Default time-out in seconds for scripts in OSD file if WAIT=TRUE. You can specify per-script time-outs with TIMEOUT instead of WAIT. A value of 0 means no wait, and 0xFFFFFFFF means wait forever. 
            
 
 
-
            LaunchRecordLogPath 
            
-
            String 
            
+
            LaunchRecordLogPath 
            
+
            String 
            
 
            
 
            If, under either HKLM or HKCU, this value contains a valid path to a log file, SFTTray will write to this log when programs start, shut down, fail to launch, and enter or exit disconnected mode.
            
 
 
-
            LaunchRecordMask 
            
-
            DWORD 
            
+
            LaunchRecordMask 
            
+
            DWORD 
            
 
            0x1A (26) log launch errors and disconnected mode entry and exit activity.
            
 
            0x1F (31) logs everything.
            
-
            0x0 (0) logs nothing. 
            
+
            0x0 (0) logs nothing. 
            
 
            Specifies which of the five events are logged (bitmask values):
            
 
            1 for program starts
            
 
            2 for launch failure errors
            
 
            4 for shutdowns
            
 
            8 for entering disconnected mode
            
 
            16 for exiting disconnected mode to reconnect to a server
            
-
            Add any combination of those numbers to turn on the respective messages. Defaults to 0x1F if not in registry. 
            
+
            Add any combination of those numbers to turn on the respective messages. Defaults to 0x1F if not in registry. 
            
 
 
-
            LaunchRecordWriteTimeout 
            
-
            DWORD 
            
+
            LaunchRecordWriteTimeout 
            
+
            DWORD 
            
 
            Default=3000
            
 
            Specifies in milliseconds how long the tray will wait when trying to write to the launch record log if another process is using it.
            
 
 
-
            ImportSearchPath 
            
-
            String 
            
-
            d:\files\;C:\documents and settings\user1\SFTs 
            
+
            ImportSearchPath 
            
+
            String 
            
+
            d:\files;C:\documents and settings\user1\SFTs 
            
 
            A semicolon delimited list of up to five directories to search for portable SFT files before prompting the user to select a directory. Trailing backslash in paths is optional. This value is not present by default and must be set manually.
            
 
 
 
            UserImportPath
            
-
            String 
            
-
            D:\SFTs\ 
            
+
            String 
            
+
            D:\SFTs\ 
            
 
            Valid only under HKCU. The last location the user browsed to while finding a SFT file for package import. Set automatically if the SFT is found successfully. This is used on successive imports when trying to automatically locate SFT files.
            
 
 
 
 
- 
+
 
 ## Shared Key
 
@@ -284,29 +286,29 @@ The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Shared key control
 
 
 
-Name 
-Type 
-Data (Examples) 
-Description 
+Name 
+Type 
+Data (Examples) 
+Description 
 
 
 
 
-
            DumpPath 
            
-
            String 
            
-
            Default=C:\ 
            
-
            Default path to create dump files when generating a minidump on an exception. This defaults to C:\ if not specified. The Client installer sets this key to the <App Virtualization global data directory>\Dumps. The Sequencer installer sets this key to the installation directory. 
            
+
            DumpPath 
            
+
            String 
            
+
            Default=C:\ 
            
+
            Default path to create dump files when generating a minidump on an exception. This defaults to C:\ if not specified. The Client installer sets this key to the <App Virtualization global data directory>\Dumps. The Sequencer installer sets this key to the installation directory. 
            
 
 
-
            DumpPathSizeLimit 
            
-
            DWORD 
            
+
            DumpPathSizeLimit 
            
+
            DWORD 
            
 
            1000
            
 
            Specifies the maximum total amount of disk space in megabytes that can be used to store minidumps. Default = 1000 MB.
            
 
 
 
 
- 
+
 
 ## Network Key
 
@@ -322,10 +324,10 @@ The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network ke
 
 
 
-Name 
-Type 
-Data (Examples) 
-Description 
+Name 
+Type 
+Data (Examples) 
+Description 
 
 
 
@@ -336,8 +338,8 @@ The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network ke
 
            Enables or disables offline mode. If set to 0, the client will not communicate with App-V Management Servers or publishing servers. In disconnected operations, the client can start a loaded application even when it is not connected to an App-V Management Server. In offline mode, the client does not attempt to connect to an App-V Management Server or publishing server. You must allow disconnected operations to be able to work offline. Default value is 1 enabled (online), and 0 is disabled (offline).
            
 
 
-
            AllowDisconnectedOperation 
            
-
            DWORD 
            
+
            AllowDisconnectedOperation 
            
+
            DWORD 
            
 
            Default=1
            
 
            Enables or disables disconnected operation. Default value is 1 enabled, and 0 is disabled. When disconnected operations are enabled, the App-V client can start a loaded application even when it is not connected to an App-V Management Server.
            
 
@@ -345,12 +347,12 @@ The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network ke
 
            FastConnectTimeout
            
 
            DWORD
            
 
            Default=1000
            
-
            This value specifies the TCP connect time-out in milliseconds to determine when to go into disconnected operations mode. This value can be used to override the default ConnectTimeout of 20 seconds (App-V connect time-out for network transactions) or the system’s TCP time-out of approximately 25 seconds. This brings the client into disconnected operations mode quickly. Applied on the next connect.
            
+
            This value specifies the TCP connect time-out in milliseconds to determine when to go into disconnected operations mode. This value can be used to override the default ConnectTimeout of 20 seconds (App-V connect time-out for network transactions) or the system’s TCP time-out of approximately 25 seconds. This brings the client into disconnected operations mode quickly. Applied on the next connect.
            
 
 
 
            LimitDisconnectedOperation
            
 
            DWORD
            
-
            Default=1 
            
+
            Default=1 
            
 
            Applicable only if AllowDisconnectedOperation is 1, enabled. This value determines whether there will be a time limit for how long the client will be allowed to operate in disconnected operations. 1=limited. 0=unlimited.
            
 
 
@@ -404,7 +406,7 @@ The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network ke
 
 
 
- 
+
 
 ## Http Key
 
@@ -420,10 +422,10 @@ The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\H
 
 
 
-Name 
-Type 
-Data (Examples) 
-Description 
+Name 
+Type 
+Data (Examples) 
+Description 
 
 
 
@@ -442,7 +444,7 @@ The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Network\\H
 
 
 
- 
+
 
 ## File System Key
 
@@ -458,53 +460,53 @@ The values that are contained under the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsof
 
 
 
-Name 
-Type 
-Data (Examples) 
-Description 
+Name 
+Type 
+Data (Examples) 
+Description 
 
 
 
 
-
            FileSize 
            
-
            DWORD 
            
+
            FileSize 
            
+
            DWORD 
            
 
            4096
            
-
            Maximum size in megabytes of file system cache file. If you change this value in the registry, you must set State to 0 and reboot. 
            
+
            Maximum size in megabytes of file system cache file. If you change this value in the registry, you must set State to 0 and reboot. 
            
 
 
-
            FileName 
            
-
            String 
            
-
            C:\Users\Public\Documents\SoftGrid Client\sftfs.fsd 
            
-
            Location of file system cache file. If you change this value in the registry, you must either leave FileSize the same and reboot or set State to 0 and reboot. 
            
+
            FileName 
            
+
            String 
            
+
            C:\Users\Public\Documents\SoftGrid Client\sftfs.fsd 
            
+
            Location of file system cache file. If you change this value in the registry, you must either leave FileSize the same and reboot or set State to 0 and reboot. 
            
 
 
-
            DriveLetter 
            
-
            String 
            
-
            Q: 
            
-
            Drive where App-V file system will be mounted, if it is available. This value is set either by the listener or the installer, and it is read by the file system. 
            
+
            DriveLetter 
            
+
            String 
            
+
            Q: 
            
+
            Drive where App-V file system will be mounted, if it is available. This value is set either by the listener or the installer, and it is read by the file system. 
            
 
 
-
            State 
            
-
            DWORD 
            
-
            0x100 
            
-
            State of file system. Set to 0 and reboot to completely clear the file system cache. 
            
+
            State 
            
+
            DWORD 
            
+
            0x100 
            
+
            State of file system. Set to 0 and reboot to completely clear the file system cache. 
            
 
 
-
            FileSystemStorage 
            
-
            String 
            
-
            C:\Profiles\Joe\SG 
            
-
            Path for symlinks, set under HKCU. Do not modify (use data directory under Configuration to change). 
            
+
            FileSystemStorage 
            
+
            String 
            
+
            C:\Profiles\Joe\SG 
            
+
            Path for symlinks, set under HKCU. Do not modify (use data directory under Configuration to change). 
            
 
 
-
            GlobalFileSystemStorage 
            
-
            String 
            
-
            C:\Users\Public\Documents\SoftGrid Client\AppFS Storage 
            
-
            Path for global file system data. Do not modify. 
            
+
            GlobalFileSystemStorage 
            
+
            String 
            
+
            C:\Users\Public\Documents\SoftGrid Client\AppFS Storage 
            
+
            Path for global file system data. Do not modify. 
            
 
 
-
            MaxPercentToLockInCache 
            
-
            DWORD 
            
-
            Default=90 
            
+
            MaxPercentToLockInCache 
            
+
            DWORD 
            
+
            Default=90 
            
 
            Specifies the maximum percentage of the file system cache file that can be locked. Do not modify.
            
 
 
@@ -522,19 +524,19 @@ The values that are contained under the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsof
 
 
 
- 
+
 
 ## Permissions Key
 
 
-To help to prevent users from making mistakes, administrators can use the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Permissions key to control access to some actions for non-administrative users—for example, to prevent users from accidentally unloading programs. Users with administrative rights can give themselves any of these permissions. On shared systems, such as a Remote Desktop Session Host (RD Session Host) server (formerly Terminal Server) system, be careful when granting additional permissions to users because some of these permissions would enable users to control the applications used by all users on the system. Possible values for these settings are 1 (allow) and 0 (disallow).
+To help to prevent users from making mistakes, administrators can use the HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Permissions key to control access to some actions for non-administrative users—for example, to prevent users from accidentally unloading programs. Users with administrative rights can give themselves any of these permissions. On shared systems, such as a Remote Desktop Session Host (RD Session Host) server (formerly Terminal Server) system, be careful when granting additional permissions to users because some of these permissions would enable users to control the applications used by all users on the system. Possible values for these settings are 1 (allow) and 0 (disallow).
 
 The Permissions key settings control all interfaces that enable the named actions. This includes the Options Dialog, SFTTray, and SFTMime. These settings do not affect administrators. The following table provides information about the registry values associated with the Permissions key.
 
-Name 
-Type 
-Data (Examples) 
-Description 
+Name 
+Type 
+Data (Examples) 
+Description 
 ChangeFSDrive
 
 DWORD
@@ -567,21 +569,21 @@ Default=0
 
 A value of 1 allows users to add applications explicitly. This does not affect applications that are added through publishing refresh nor does it prevent users from starting (and thereby implicitly adding) applications that have not already been added. Values are 0 or 1.
 
-LoadApp 
+LoadApp 
 
-DWORD 
+DWORD 
 
 0
 
-Does not allow a user to load an application. This is the default for RD Session Hosts. If you are a mobile user, you might want to fully load your applications in the cache to use them during disconnected operation or offline mode. To stream applications from the App-V Management Server or the App-V Streaming Server, you must be connected to a server to load applications.
+Does not allow a user to load an application. This is the default for RD Session Hosts. If you are a mobile user, you might want to fully load your applications in the cache to use them during disconnected operation or offline mode. To stream applications from the App-V Management Server or the App-V Streaming Server, you must be connected to a server to load applications.
 
 1
 
-Allows a user to load an application. This is the default for Windows desktops. 
+Allows a user to load an application. This is the default for Windows desktops. 
 
-UnloadApp 
+UnloadApp 
 
-DWORD 
+DWORD 
 
 0
 
@@ -589,43 +591,43 @@ Does not allow a user to unload an application. When you load or unload a packag
 
 1
 
-Allows a user to unload an application. 
+Allows a user to unload an application. 
 
-LockApp 
+LockApp 
 
-DWORD 
+DWORD 
 
 0
 
-Does not allow a user to lock and unlock an application. This is the default for RD Session Hosts. A locked application cannot be removed from the cache to make room for new applications. To remove a locked application from the App-V Desktop or Client for Remote Desktop Services (formerly Terminal Services) cache, you must unlock it.
+Does not allow a user to lock and unlock an application. This is the default for RD Session Hosts. A locked application cannot be removed from the cache to make room for new applications. To remove a locked application from the App-V Desktop or Client for Remote Desktop Services (formerly Terminal Services) cache, you must unlock it.
 
 1
 
-Allows a user to lock and unlock an application. This is the default for Windows Desktops. 
+Allows a user to lock and unlock an application. This is the default for Windows Desktops. 
 
-ManageTypes 
+ManageTypes 
 
-DWORD 
+DWORD 
 
 0
 
-Does not allow a user to add, edit, or remove file type associations for that User alone. This is the default for RD Session Hosts. 
+Does not allow a user to add, edit, or remove file type associations for that User alone. This is the default for RD Session Hosts. 
 
 1
 
-Allows a user to add, edit, and remove file type associations for that user only and not globally. This is the default for Windows Desktops. 
+Allows a user to add, edit, and remove file type associations for that user only and not globally. This is the default for Windows Desktops. 
 
-RefreshServer 
+RefreshServer 
 
-DWORD 
+DWORD 
 
 0
 
-Does not allow a user to trigger a refresh of MIME settings. This is the default for RD Session Hosts. 
+Does not allow a user to trigger a refresh of MIME settings. This is the default for RD Session Hosts. 
 
 1
 
-Enables a user to trigger a refresh of MIME settings. This is the default for Windows Desktops. 
+Enables a user to trigger a refresh of MIME settings. This is the default for Windows Desktops. 
 
 UpdateOSDFile
 
@@ -635,17 +637,17 @@ Default= 0
 
 A value of 1 enables a user to use a modified OSD file.
 
-ImportApp 
+ImportApp 
 
-DWORD 
+DWORD 
 
 0
 
-Does not allow a user to import applications into cache. The difference between Load and Import is that when a Load is triggered, the client gets the package from the currently configured location contained in the OSD, ASR, or Override URL. When using Import, a location to get the package from must be specified. 
+Does not allow a user to import applications into cache. The difference between Load and Import is that when a Load is triggered, the client gets the package from the currently configured location contained in the OSD, ASR, or Override URL. When using Import, a location to get the package from must be specified. 
 
 1
 
-Allows a user to import applications into cache. 
+Allows a user to import applications into cache. 
 
 ChangeRefreshSettings
 
@@ -711,7 +713,7 @@ DWORD
 
 A value of 1 allows the users to select to run the client in Offline Mode. In Offline Mode, the Application Virtualization client can start a loaded application even when it is not connected to an Application Virtualization Server.
 
- 
+
 
 ## Custom Settings
 
@@ -727,24 +729,24 @@ The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\CustomSett
 
 
 
-Name 
-Type 
-Data (Examples) 
-Description 
+Name 
+Type 
+Data (Examples) 
+Description 
 
 
 
 
-
            TrayErrorDelay 
            
-
            DWORD 
            
-
            Default=30 
            
-
            Time in seconds that the Application Virtualization notification area will display error messages like "Launch failed". Minimum value of 1. 
            
+
            TrayErrorDelay 
            
+
            DWORD 
            
+
            Default=30 
            
+
            Time in seconds that the Application Virtualization notification area will display error messages like "Launch failed". Minimum value of 1. 
            
 
 
-
            TraySuccessDelay 
            
-
            DWORD 
            
-
            Default=10 
            
-
            Time in seconds that the appvmed notification area will display success messages like "Word launched" or "Excel shut down". If 0, those messages will be suppressed. 
            
+
            TraySuccessDelay 
            
+
            DWORD 
            
+
            Default=10 
            
+
            Time in seconds that the appvmed notification area will display success messages like "Word launched" or "Excel shut down". If 0, those messages will be suppressed. 
            
 
 
 
            TrayVisibility
            
@@ -769,7 +771,7 @@ The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\CustomSett
 
 
 
- 
+
 
 ## Reporting Settings
 
@@ -785,10 +787,10 @@ The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Reporting
 
 
 
-Name 
-Type 
-Data (Examples) 
-Description 
+Name 
+Type 
+Data (Examples) 
+Description 
 
 
 
@@ -807,16 +809,16 @@ The HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Reporting
 
 
 
- 
+
 
 ## Related topics
 
 
 [Application Virtualization Client Reference](application-virtualization-client-reference.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/app-v-desktop-client-security.md b/mdop/appv-v4/app-v-desktop-client-security.md
index 6e6eb58648..2bf8723032 100644
--- a/mdop/appv-v4/app-v-desktop-client-security.md
+++ b/mdop/appv-v4/app-v-desktop-client-security.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Desktop Client Security
 description: App-V Desktop Client Security
-author: jamiejdt
+author: dansimp
 ms.assetid: 216b9c16-7bb4-4f94-b9d8-810501285008
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ The App-V Desktop Client provides many security enhancements that were not avail
 **Note**  
 When you install the App-V Desktop Client on a computer, the software defaults to the most secure settings. However, when upgrading, the previous settings of the client persist.
 
- 
+ 
 
 By default, the App-V Desktop Client is configured only with the permissions required to allow a non-administrative user to perform a publishing refresh and stream applications. Additional security enhancements provided in the App-V Desktop Client include the following:
 
@@ -41,12 +44,12 @@ After you install the Desktop Client, you can configure other security settings
 **Important**  
 Carefully consider the consequences of changing access rights, especially on systems that are shared by multiple users, such as Terminal Servers.
 
- 
+ 
 
 **Note**  
 If users in the environment have local administrator privileges for their computers, the permissions are ignored.
 
- 
+ 
 
 ### ADM Template
 
@@ -55,7 +58,7 @@ Microsoft Application Virtualization (App-V) introduces an ADM Template that you
 **Important**  
 When using the ADM Template, remember that the settings are Group Policy preference settings and not fully managed Group Policies.
 
- 
+ 
 
 For a full description of the ADM Template, the specific settings, and guidance to successfully deploy clients in your environment, see the App-V ADM Template white paper at [https://go.microsoft.com/fwlink/LinkId=122063](https://go.microsoft.com/fwlink/?LinkId=122063).
 
@@ -64,9 +67,9 @@ For a full description of the ADM Template, the specific settings, and guidance
 
 If your organization does not require users to open applications directly from an OSD file, you can enhance security by removing the file type associations on the client. Remove the `HKEY_CURRENT_USERS` keys for OSD and `Softgird.osd.file` by using the registry editor. You can put this process into a logon script or into a post-installation script to automate these changes.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/app-v-installation-checklist.md b/mdop/appv-v4/app-v-installation-checklist.md
index 1a916f52c7..68208f051d 100644
--- a/mdop/appv-v4/app-v-installation-checklist.md
+++ b/mdop/appv-v4/app-v-installation-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Installation Checklist
 description: App-V Installation Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: b17efaab-cd6d-4c30-beb7-c6e7c9c87657
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,43 +33,43 @@ The following checklist is intended to provide a high-level list of items to con
 
 
 
            Install the App-V Management Server. If you are installing the Management Web Service, Management Console, or the Data Store on different servers, you can use the custom installation option.
            
-
            [How to Install Application Virtualization Management Server](how-to-install-application-virtualization-management-server.md)
            
+
            How to Install Application Virtualization Management Server
            
 
 
 
            Install the App-V Management Web Service. (Optional ¹)
            
-
            [How to Install the Management Web Service](how-to-install-the-management-web-service.md)
            
+
            How to Install the Management Web Service
            
 
 
 
            Install the App-V Management Console. (Optional ¹)
            
-
            [How to Install the Management Console](how-to-install-the-management-console.md)
            
+
            How to Install the Management Console
            
 
 
 
            Install the App-V Data Store. (Optional ¹)
            
-
            [How to Install a Database](how-to-install-a-database.md)
            
+
            How to Install a Database
            
 
 
 
            Install the App-V client.
            
-
            [How to Manually Install the Application Virtualization Client](how-to-manually-install-the-application-virtualization-client.md)
            
+
            How to Manually Install the Application Virtualization Client
            
 
 
 
            Install the App-V Sequencer.
            
-
            [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md)
            
+
            How to Install the Application Virtualization Sequencer
            
 
 
 
            Install the App-V Streaming Server. (This is optional and required only if you are installing the Streaming Server).
            
-
            [How to Install the Application Virtualization Streaming Server](how-to-install-the-application-virtualization-streaming-server.md)
            
+
            How to Install the Application Virtualization Streaming Server
            
 
 
 
            Create Content directories on the servers that will be used for streaming applications to users’ computers.
            
-
            [How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md)
            
-
            [How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md)
            
-
            [How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md)
            
-
            [How to Configure the File Server](how-to-configure-the-file-server.md)
            
+
            How to Configure the Application Virtualization Management Servers
            
+
            How to Configure the Application Virtualization Streaming Servers
            
+
            How to Configure the Server for IIS
            
+
            How to Configure the File Server
            
 
 
 
 
- 
+ 
 
 ¹ This is required only if you are installing the App-V Management Web Service, Management Console, or the Data Store on a different computer.
 
@@ -77,9 +80,9 @@ The following checklist is intended to provide a high-level list of items to con
 
 [App-V Postinstallation Checklist](app-v-postinstallation-checklist.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md b/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md
index 198861885a..b4fc7f6ba0 100644
--- a/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md
+++ b/mdop/appv-v4/app-v-interoperability-with-windows-applocker.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Interoperability with Windows AppLocker
 description: App-V Interoperability with Windows AppLocker
-author: jamiejdt
+author: dansimp
 ms.assetid: 9a488034-607d-411c-b495-ff184c726f49
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ Version 4.5 SP1 of the Microsoft Application Virtualization (App-V) client suppo
 **Note**  
 Windows AppLocker must first be enabled before configuring Windows AppLocker rules for virtual applications. For more information about enabling Windows AppLocker, [Windows AppLocker](https://go.microsoft.com/fwlink/?LinkId=156732) (https://go.microsoft.com/fwlink/?LinkId=156732).
 
- 
+ 
 
 ## Configuring Windows AppLocker Rules for Virtual Applications
 
@@ -28,9 +31,9 @@ Local administrators can create Windows AppLocker rules that restrict the runnin
 
 When you browse to find a directory path or specific file for which you want to create a rule, you can access the App-V drive by using the path to the hidden share. For example, you can browse to \\\\localhost\\Q$, where the App-V drive is drive Q. However, to create the rule, you must edit the path to remove the reference to \\\\localhost\\Q$ and use Q:\\ instead. You must start each application on the reference computer to access the application’s files, and administrative rights are required to browse to \\\\localhost\\Q$.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/app-v-package-wmi-class.md b/mdop/appv-v4/app-v-package-wmi-class.md
index 3a48b5747a..f9efeee4ce 100644
--- a/mdop/appv-v4/app-v-package-wmi-class.md
+++ b/mdop/appv-v4/app-v-package-wmi-class.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Package WMI Class
 description: App-V Package WMI Class
-author: jamiejdt
+author: dansimp
 ms.assetid: 0fc26c3b-9706-4804-be2d-645771dc33ae
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/app-v-postinstallation-checklist.md b/mdop/appv-v4/app-v-postinstallation-checklist.md
index f86bfdf207..814811b75f 100644
--- a/mdop/appv-v4/app-v-postinstallation-checklist.md
+++ b/mdop/appv-v4/app-v-postinstallation-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Postinstallation Checklist
 description: App-V Postinstallation Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 74db297e-a744-4287-bcc6-0e096ca8b57a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,37 +33,37 @@ The following checklist provides a high-level list of items to consider and outl
 
 
 
            Create firewall exceptions for the App-V Management Server or Streaming Server services.
            
-
            [Configuring the Firewall for the App-V Servers](configuring-the-firewall-for-the-app-v-servers.md)
            
+
            Configuring the Firewall for the App-V Servers
            
 
 
 
            Verify that the App-V system is functioning correctly by publishing, streaming, and testing the default application.
            
-
            [How to Install and Configure the Default Application](how-to-install-and-configure-the-default-application.md)
            
+
            How to Install and Configure the Default Application
            
 
 
 
            Configure the App-V Client to use the App-V Streaming Server or other server for streaming by means of the ApplicationSourceRoot, IconSourceRoot, and OSDSourceRoot settings.
            
-
            [How to Configure the Client for Application Package Retrieval](how-to-configure-the-client-for-application-package-retrieval.md)
            
+
            How to Configure the Client for Application Package Retrieval
            
 
 
 
            Understand how to use the .msi file version of sequenced application packages for offline deployment.
            
-
            [How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md)
            
+
            How to Publish a Virtual Application on the Client
            
 
 
 
            (Optional) Configure SQL Server database mirroring for the App-V database.
            
-
            [How to Configure Microsoft SQL Server Mirroring Support for App-V](how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md)
            
+
            How to Configure Microsoft SQL Server Mirroring Support for App-V
            
 
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [Application Virtualization Deployment and Upgrade Checklists](application-virtualization-deployment-and-upgrade-checklists.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/app-v-pre-installation-checklist.md b/mdop/appv-v4/app-v-pre-installation-checklist.md
index e2fb7810b1..4de02e6032 100644
--- a/mdop/appv-v4/app-v-pre-installation-checklist.md
+++ b/mdop/appv-v4/app-v-pre-installation-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Pre-Installation Checklist
 description: App-V Pre-Installation Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 3af609b1-2c09-4edb-b083-b913b6d5e8c4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -30,35 +33,34 @@ The following checklist is intended to provide a high-level list of items to con
 
 
 
            Ensure your computing environment meets the supported configurations required for App-V.
            
-
            [Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md)
            
+
            Application Virtualization Deployment Requirements
            
 
 
 
            Configure the necessary Active Directory groups and accounts.
            
-
            [Configuring Prerequisite Groups in Active Directory for App-V](configuring-prerequisite-groups-in-active-directory-for-app-v.md)
            
+
            Configuring Prerequisite Groups in Active Directory for App-V
            
 
 
 
            Configure the Internet Information Services (IIS) settings on the server that is running IIS.
            
-
            [How to Configure Windows Server 2008 for App-V Management Servers](how-to-configure-windows-server-2008-for-app-v-management-servers.md)
            
+
            How to Configure Windows Server 2008 for App-V Management Servers
            
 
 
 
            Configure the server that is running IIS to be trusted for delegation.
            
 
            
-Note  
-
            This is required only if you are installing the App-V Management Server by using a distributed system architecture, that is, if you install the App-V Management Console, the Management Web Service, and the database on different computers.
            
+Note
            This is required only if you are installing the App-V Management Server by using a distributed system architecture, that is, if you install the App-V Management Console, the Management Web Service, and the database on different computers.
            
 
            
 
            
- 
+
 
            
-
            [How to Configure the Server to be Trusted for Delegation](how-to-configure-the-server-to-be-trusted-for-delegation.md)
            
+
            How to Configure the Server to be Trusted for Delegation
            
 
 
 
            Install Microsoft SQL Server 2008.
            
-
            [Install SQL Server 2008](https://go.microsoft.com/fwlink/?LinkId=181924) (https://go.microsoft.com/fwlink/?LinkId=181924).
            
+
            Install SQL Server 2008 (https://go.microsoft.com/fwlink/?LinkId=181924).
            
 
 
 
 
- 
+
 
 ## Related topics
 
@@ -67,9 +69,9 @@ The following checklist is intended to provide a high-level list of items to con
 
 [App-V Installation Checklist](app-v-installation-checklist.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/app-v-upgrade-checklist.md b/mdop/appv-v4/app-v-upgrade-checklist.md
index d9ddeef65f..b81818e567 100644
--- a/mdop/appv-v4/app-v-upgrade-checklist.md
+++ b/mdop/appv-v4/app-v-upgrade-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Upgrade Checklist
 description: App-V Upgrade Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 64e317d2-d260-4b67-8a49-ba9ac513087a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -14,7 +17,7 @@ ms.date: 08/30/2016
 # App-V Upgrade Checklist
 
 
-Before trying to upgrade to Microsoft Application Virtualization (App-V) 4.5 or later versions, any version earlier than App-V 4.1 must be upgraded to App-V 4.1. You should plan to upgrade clients first, and then upgrade the server components. App-V clients that have been upgraded to App-V 4.5 continue to work with App-V servers that have not yet been upgraded. Earlier versions of the client are not supported on servers that have been upgraded to App-V 4.5.
+Before trying to upgrade to Microsoft Application Virtualization (App-V) 4.5 or later versions, any version earlier than App-V 4.1 must be upgraded to App-V 4.1. You should plan to upgrade clients first, and then upgrade the server components. App-V clients that have been upgraded to App-V 4.5 continue to work with App-V servers that have not yet been upgraded. Earlier versions of the client are not supported on servers that have been upgraded to App-V 4.5.
 
 @@ -30,64 +33,63 @@ Before trying to upgrade to Microsoft Application Virtualization (App-V) 4.5 or
 
-
+
-
+
-
+
-
+
-
+
            
 

 
            
 
            Upgrade the App-V clients.
            [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md)
            How to Upgrade the Application Virtualization Client
            		
 
            
 
            
 
            Upgrade the App-V servers and database.
            
 
            
-Important  
-
            If you have more than one server sharing access to the App-V database, all those servers must be taken offline while the database is being upgraded. You should follow your regular business practices for the database upgrade, but we recommend that you test the database upgrade by using a backup copy of the database first on a test server. Then, you should select one of the servers for the first upgrade, which will upgrade the database schema. After the production database has been successfully upgraded, you can upgrade the App-V software on the other servers.
            
+Important
            If you have more than one server sharing access to the App-V database, all those servers must be taken offline while the database is being upgraded. You should follow your regular business practices for the database upgrade, but we recommend that you test the database upgrade by using a backup copy of the database first on a test server. Then, you should select one of the servers for the first upgrade, which will upgrade the database schema. After the production database has been successfully upgraded, you can upgrade the App-V software on the other servers.
            
 
            
 
            
- 
+
 
            [How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md)
            How to Upgrade the Servers and System Components
            		
 
            
 
            
 
            Upgrade the App-V Management Web Service.
            
 
            This step applies only if the Management Web Service is on a separate server, which would require that you run the server installer program on that separate server to upgrade the Management Web service. Otherwise, the previous server upgrade step will automatically upgrade the Management Web Service.
            [How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md)
            How to Upgrade the Servers and System Components
            		
 
            
 
            
 
            Upgrade the App-V Management Console.
            
 
            This step applies only if the Management Console is on a separate computer, which would require that you run the server installer program on that separate computer to upgrade the console. Otherwise, the previous server upgrade step will upgrade the Management Console.
            [How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md)
            How to Upgrade the Servers and System Components
            		
 
            
 
            
 
            Upgrade the App-V Sequencer.
            [How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md)
            How to Upgrade the Application Virtualization Sequencer
            		
 
            
             
 
            
 
- 
+
 
 ## Additional Upgrade Considerations
 
 
--   Any virtual application packages sequenced in version 4.2 will not have to be sequenced again for use with version 4.5. However, you should consider upgrading the virtual packages to the Microsoft Application Virtualization 4.5 format if you want to apply default access control lists (ACLs) or generate a Windows Installer file. This is a simple process and requires only that the existing virtual application package be opened and saved with the App-V 4.5 Sequencer. This can be automated by using the App-VSequencer command-line interface. For more information, see [How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md)
+-   Any virtual application packages sequenced in version 4.2 will not have to be sequenced again for use with version 4.5. However, you should consider upgrading the virtual packages to the Microsoft Application Virtualization 4.5 format if you want to apply default access control lists (ACLs) or generate a Windows Installer file. This is a simple process and requires only that the existing virtual application package be opened and saved with the App-V 4.5 Sequencer. This can be automated by using the App-VSequencer command-line interface. For more information, see [How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md)
 
--   One of the features of the 4.5 Sequencer is the ability to create Windows Installer (.msi) files as control points for virtual application package interoperability with electronic software distribution (ESD) systems, such as Microsoft System Center Configuration Manager 2007. Previous Windows Installer files created with the MSI tool for Application Virtualization that were installed on a App-V 4.1 or 4.2 client that is subsequently upgraded to App-V 4.5 will continue to work, although they cannot be installed on the App-V 4.5 client. However, they cannot be removed or upgraded unless they are upgraded in the App-V 4.5 Sequencer. The original App-V package earlier than 4.5 has to be opened in the App-V 4.5 Sequencer and then saved as a Windows Installer File.
+-   One of the features of the 4.5 Sequencer is the ability to create Windows Installer (.msi) files as control points for virtual application package interoperability with electronic software distribution (ESD) systems, such as Microsoft Endpoint Configuration Manager. Previous Windows Installer files created with the MSI tool for Application Virtualization that were installed on a App-V 4.1 or 4.2 client that is subsequently upgraded to App-V 4.5 will continue to work, although they cannot be installed on the App-V 4.5 client. However, they cannot be removed or upgraded unless they are upgraded in the App-V 4.5 Sequencer. The original App-V package earlier than 4.5 has to be opened in the App-V 4.5 Sequencer and then saved as a Windows Installer File.
 
-    **Note**  
-    If the App-V 4.2 Client has already been upgraded to App-V 4.5, it is possible to script a workaround to preserve the version 4.2 packages on version 4.5 clients and allow them to be managed. This script must copy two files, msvcp71.dll and msvcr71.dll, to the App-V installation folder and set the following registry key values under the registry key:\[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\]:
+    **Note**  
+    If the App-V 4.2 Client has already been upgraded to App-V 4.5, it is possible to script a workaround to preserve the version 4.2 packages on version 4.5 clients and allow them to be managed. This script must copy two files, msvcp71.dll and msvcr71.dll, to the App-V installation folder and set the following registry key values under the registry key:\[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\]:
 
     "ClientVersion"="4.2.1.20"
 
     "GlobalDataDirectory"="C:\\\\Documents and Settings\\\\All Users\\\\Documents\\\\" (a globally writeable location)
 
-     
+
 
 -   Windows Installer files generated by the App-V 4.5 Sequencer display the error message "This package requires Microsoft Application Virtualization Client 4.5 or later" when trying to run them on an App-V 4.6 Client. Open the old package with either the App-V 4.5 SP1 Sequencer or the App-V 4.6 Sequencer and generate a new .msi file for the package.
 
--   Any version 4.2 reports that were created and saved will be overwritten when the server is upgraded to version 4.5. If you have to keep these reports, you must save a backup copy of the SftMMC.msc file located in the SoftGrid Management Console folder on the server and use that copy to replace the new SftMMC.msc that is installed during the upgrade.
+-   Any version 4.2 reports that were created and saved will be overwritten when the server is upgraded to version 4.5. If you have to keep these reports, you must save a backup copy of the SftMMC.msc file located in the SoftGrid Management Console folder on the server and use that copy to replace the new SftMMC.msc that is installed during the upgrade.
 
 -   For additional information about upgrading from previous versions, see [Upgrading to Microsoft Application Virtualization 4.5 FAQ](https://go.microsoft.com/fwlink/?LinkId=120358) (https://go.microsoft.com/fwlink/?LinkId=120358).
 
-## App-V 4.6 Client Package Support
+## App-V 4.6 Client Package Support
 
 
-You can deploy packages created in previous versions of App-V to App-V 4.6 clients. However, you must modify the associated .osd file so that it includes the appropriate operating system and chip architecture information. The following values can be used:
+You can deploy packages created in previous versions of App-V to App-V 4.6 clients. However, you must modify the associated .osd file so that it includes the appropriate operating system and chip architecture information. The following values can be used:
 
 @@ -135,16 +137,16 @@ You can deploy packages created in previous versions of App-V to App-V 4.6 cli
 
            
 

 
            
 
- 
 
-To run a newly created 32-bit package, you must sequence the application on a computer running a 32-bit operating system with the App-V 4.6 Sequencer installed. After you have sequenced the application, in the Sequencer console, click the **Deployment** tab and then specify the appropriate operating system and chip architecture as required.
 
-**Important**  
-Applications sequenced on a computer running a 64-bit operating system must be deployed to computers running a 64-bit operating system. New 32-bit packages created by using the App-V 4.6 Sequencer do not run on computers running the App-V 4.5 client.
+To run a newly created 32-bit package, you must sequence the application on a computer running a 32-bit operating system with the App-V 4.6 Sequencer installed. After you have sequenced the application, in the Sequencer console, click the **Deployment** tab and then specify the appropriate operating system and chip architecture as required.
 
- 
+**Important**  
+Applications sequenced on a computer running a 64-bit operating system must be deployed to computers running a 64-bit operating system. New 32-bit packages created by using the App-V 4.6 Sequencer do not run on computers running the App-V 4.5 client.
 
-To run new 64-bit packages on the App-V 4.6 Client, you must sequence the application on a computer running the App-V 4.6 Sequencer and that is running a 64-bit operating system. After you have sequenced the application, in the Sequencer console, click the **Deployment** tab, and then specify the appropriate operating system and chip architecture as required.
+
+
+To run new 64-bit packages on the App-V 4.6 Client, you must sequence the application on a computer running the App-V 4.6 Sequencer and that is running a 64-bit operating system. After you have sequenced the application, in the Sequencer console, click the **Deployment** tab, and then specify the appropriate operating system and chip architecture as required.
 
 The following table lists which client versions will run packages created by using the various versions of the sequencer.
 
@@ -159,36 +161,36 @@ The following table lists which client versions will run packages created by usi
 
 
 
-Sequenced by using the App-V 4.2 Sequencer
-Sequenced by using the App-V 4.5 Sequencer
-Sequenced by using the 32-bit App-V 4.6 Sequencer
-Sequenced by using the 64-bit App-V 4.6 Sequencer
+Sequenced by using the App-V 4.2 Sequencer
+Sequenced by using the App-V 4.5 Sequencer
+Sequenced by using the 32-bit App-V 4.6 Sequencer
+Sequenced by using the 64-bit App-V 4.6 Sequencer
 
 
 
 
-
            4.2 Client
            
+
            4.2 Client
            
 
            Yes
            
 
            No
            
 
            No
            
 
            No
            
 
 
-
            4.5 Client ¹
            
+
            4.5 Client ¹
            
 
            Yes
            
 
            Yes
            
 
            No
            
 
            No
            
 
 
-
            4.6 Client (32-bit)
            
+
            4.6 Client (32-bit)
            
 
            Yes
            
 
            Yes
            
 
            Yes
            
 
            No
            
 
 
-
            4.6 Client (64-bit)
            
+
            4.6 Client (64-bit)
            
 
            Yes
            
 
            Yes
            
 
            Yes
            
@@ -197,13 +199,13 @@ The following table lists which client versions will run packages created by usi
 
 
 
- 
 
-¹Applies to all versions of the App-V 4.5 client, including App-V 4.5, App-V 4.5 CU1, and App-V 4.5 SP1.
 
- 
-
- 
+¹Applies to all versions of the App-V 4.5 client, including App-V 4.5, App-V 4.5 CU1, and App-V 4.5 SP1.
+
+
+
+
 
 
 
diff --git a/mdop/appv-v4/application-utilization-reportserver.md b/mdop/appv-v4/application-utilization-reportserver.md
index ccac73ba60..78ed55aaad 100644
--- a/mdop/appv-v4/application-utilization-reportserver.md
+++ b/mdop/appv-v4/application-utilization-reportserver.md
@@ -1,12 +1,15 @@
 ---
 title: Application Utilization Report
 description: Application Utilization Report
-author: jamiejdt
+author: dansimp
 ms.assetid: cb961969-c9a3-4d46-8303-121d737d76d8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md b/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md
index 4f285ff5cf..e7bf14bd06 100644
--- a/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md
+++ b/mdop/appv-v4/application-virtualization-client-hardware-and-software-requirements.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Client Hardware and Software Requirements
 description: Application Virtualization Client Hardware and Software Requirements
-author: jamiejdt
+author: dansimp
 ms.assetid: 8b877a2c-5721-4b22-a47f-e2838d58ab12
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -24,7 +27,7 @@ The following list includes the recommended minimum hardware and software requir
 **Note**  
 The Application Virtualization (App-V) Desktop Client requires no additional processor or RAM resources beyond the requirements of the host operating system.
 
- 
+ 
 
 ### Hardware Requirements
 
@@ -50,7 +53,7 @@ The hardware requirements are applicable to all versions.
 Operating System
 Edition
 Service Pack
-Achitectural SKU
+Architectural SKU
 
 
 
@@ -82,8 +85,8 @@ The hardware requirements are applicable to all versions.
 
 
 The following software prerequisites are installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, the following products must be installed first.
--   **Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360).
- -   **Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)**—For more information about installing Microsoft Core XML Services (MSXML) 6.0 SP1 (x86), see [Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)](https://go.microsoft.com/fwlink/?LinkId=63266) (https://go.microsoft.com/fwlink/?LinkId=63266).
+- **Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360).
+  -   **Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)**—For more information about installing Microsoft Core XML Services (MSXML) 6.0 SP1 (x86), see [Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)](https://go.microsoft.com/fwlink/?LinkId=63266) (https://go.microsoft.com/fwlink/?LinkId=63266).
 
 For the Application Virtualization (App-V) 4.6 Desktop Client, the following additional software prerequisite is installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, you must also install with the other prerequisites listed.
 
@@ -103,7 +106,7 @@ For the Application Virtualization (App-V) 4.6 Desktop Client, the following add
 Operating System
 Edition
 Service Pack
-Achitectural SKU
+Architectural SKU
 
 
 
@@ -133,19 +136,19 @@ The Application Virtualization (App-V) 4.6 Desktop Client supports x86 and x64 S
 
 The following software prerequisites are installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, the following products must be installed first.
 
--   **Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360).
+-   Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)—For more information about installing Microsoft Visual C++ 2005 SP1 Redistributable Package (x86), see Microsoft Visual C++ 2005 SP1 Redistributable Package (x86) (https://go.microsoft.com/fwlink/?LinkId=119961). For version 4.5 SP2 of the App-V client, download Vcredist_x86.exe from Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update (https://go.microsoft.com/fwlink/?LinkId=169360).
 
--   **Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)**—For more information about installing Microsoft Core XML Services (MSXML) 6.0 SP1 (x86), see [Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)](https://go.microsoft.com/fwlink/?LinkId=63266) (https://go.microsoft.com/fwlink/?LinkId=63266).
+-   Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)—For more information about installing Microsoft Core XML Services (MSXML) 6.0 SP1 (x86), see Microsoft Core XML Services (MSXML) 6.0 SP1 (x86) (https://go.microsoft.com/fwlink/?LinkId=63266).
 
--   **Microsoft Application Error Reporting**—The installation program for this software is included in the **Support\\Watson** folder in the self-extracting archive file.
+-   Microsoft Application Error Reporting—The installation program for this software is included in the Support\Watson folder in the self-extracting archive file.
 
 For the Application Virtualization (App-V) 4.6 Desktop Client, the following additional software prerequisite is installed automatically if you are using the Setup.exe method. If you are using the Setup.msi installation program, you must also install with the other prerequisites listed.
 
--   **Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)**—For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see [Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=150700) (https://go.microsoft.com/fwlink/?LinkId=150700).
+-   Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)—For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see Microsoft Visual C++ 2008 SP1 Redistributable Package (x86) (https://go.microsoft.com/fwlink/?LinkId=150700).
 
 ## Application Virtualization Client for Remote Desktop Services
 
-Following are the recommended hardware and software requirements for the Application Virtualization Client for Remote Desktop Services. The requirements are listed first for appv461\_3, followed by the requirements for versions that preceded App-V 4.6 SP2.
+Following are the recommended hardware and software requirements for the Application Virtualization Client for Remote Desktop Services. The requirements are listed first for appv461_3, followed by the requirements for versions that preceded App-V 4.6 SP2.
 
 The Application Virtualization (App-V) Client for Remote Desktop Services requires no additional processor or RAM resources beyond the requirements of the host operating system.
 
@@ -173,7 +176,7 @@ The hardware requirements are applicable to all versions.
 Operating System
 Edition
 Service Pack
-Achitectural SKU
+Architectural SKU
 
 
 
@@ -230,7 +233,7 @@ For the Application Virtualization (App-V) 4.6 Desktop Client, the following add
 Operating System
 Edition
 Service Pack
-Achitectural SKU
+Architectural SKU
 
 
 
diff --git a/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md b/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md
index afde6ebaa3..2f13cd29a0 100644
--- a/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md
+++ b/mdop/appv-v4/application-virtualization-client-installer-command-line-parameters.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Client Installer Command-Line Parameters
 description: Application Virtualization Client Installer Command-Line Parameters
-author: jamiejdt
+author: dansimp
 ms.assetid: 508fa404-52a5-4919-8788-2a3dfb00639b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -16,12 +19,12 @@ ms.date: 08/30/2016
 
 The following table lists all available Microsoft Application Virtualization Client installer command-line parameters, their values, and a brief description of each parameter. Parameters are case-sensitive and must be entered as all-uppercase letters. All parameter values must be enclosed in double quotes.
 
-**Note**  
--   For App-V version 4.6, command-line parameters cannot be used during a client upgrade.
+**Note**  
+-   For App-V version 4.6, command-line parameters cannot be used during a client upgrade.
 
 -   The *SWICACHESIZE* and *MINFREESPACEMB* parameters cannot be combined on the command line. If both are used, the *SWICACHESIZE* parameter will be ignored.
 
- 
+
 
 @@ -56,14 +59,13 @@ The following table lists all available Microsoft Application Virtualization Cli
 
            A URL has several parts:
            <protocol>://<server>:<port>/<path>/<?query><#fragment>
            A UNC path has three parts:
            
-
            \\<computername>\<share folder>\<resource>
            
+
            &lt;computername>&lt;share folder>&lt;resource>
            If the APPLICATIONSOURCEROOT parameter is specified on a client, the client will break the URL or UNC path from an OSD file into its constituent parts and replace the OSD sections with the corresponding APPLICATIONSOURCEROOT sections.
            
-Important  
-
            Be sure to use the correct format when using file:// with a UNC path. The correct format is file://\\<server>\<share>.
            
+Important
            Be sure to use the correct format when using file:// with a UNC path. The correct format is file://&lt;server>&lt;share>.
            
 
            
- 
+
 
            
@@ -74,13 +76,12 @@ The following table lists all available Microsoft Application Virtualization Cli
 
            A URL has several parts:
            <protocol>://<server>:<port>/<path>/<?query><#fragment>
            A UNC path has three parts:
            
-
            \\<computername>\<share folder>\<resource>
            
+
            &lt;computername>&lt;share folder>&lt;resource>
            
-Important  
-
            Be sure to use the correct format when using a UNC path. Acceptable formats are \\<server>\<share> or <drive letter>:\<folder>.
            
+Important
            Be sure to use the correct format when using a UNC path. Acceptable formats are &lt;server>&lt;share> or <drive letter>:&lt;folder>.
            
 
            
- 
+
 
            
@@ -91,13 +92,12 @@ The following table lists all available Microsoft Application Virtualization Cli
 
            A URL has several parts:
            <protocol>://<server>:<port>/<path>/<?query><#fragment>
            A UNC path has three parts:
            
-
            \\<computername>\<share folder>\<resource>
            
+
            &lt;computername>&lt;share folder>&lt;resource>
            
-Important  
-
            Be sure to use the correct format when using a UNC path. Acceptable formats are \\<server>\<share> or <drive letter>:\<folder>.
            
+Important
            Be sure to use the correct format when using a UNC path. Acceptable formats are &lt;server>&lt;share> or <drive letter>:&lt;folder>.
            
 
            
- 
+
 
            
@@ -108,11 +108,10 @@ The following table lists all available Microsoft Application Virtualization Cli
 
@@ -141,20 +139,18 @@ The following table lists all available Microsoft Application Virtualization Cli
 
          • NONE—No auto-loading, regardless of what triggers might be set.
          • ALL—If any AutoLoad trigger is enabled, all packages are automatically loaded, whether or not they have ever been launched.
            
 
            
-Note  
-
            This setting is configured for individual packages by using the SFTMIME ADD PACKAGE and CONFIGURE PACKAGE commands. For more information about these commands, see [SFTMIME Command Reference](sftmime--command-reference.md).
            
+Note
            This setting is configured for individual packages by using the SFTMIME ADD PACKAGE and CONFIGURE PACKAGE commands. For more information about these commands, see SFTMIME Command Reference.
            
 
            
 
            
- 
+
 
          • PREVUSED—If any AutoLoad trigger is enabled, load only the packages where at least one application in the package has been previously used (that is, launched or precached).
            • 
-Note  
-
            When you install the App-V client to use a read-only cache, (for example, as a VDI server implementation), you must set the AUTOLOADTARGET parameter to NONE to prevent the client from trying to update applications in the read-only cache.
            
+Note
            When you install the App-V client to use a read-only cache, (for example, as a VDI server implementation), you must set the AUTOLOADTARGET parameter to NONE to prevent the client from trying to update applications in the read-only cache.
            
 
            
- 
+
 
            
@@ -214,7 +210,7 @@ The following table lists all available Microsoft Application Virtualization Cli
 
-
@@ -283,19 +279,18 @@ The following table lists all available Microsoft Application Virtualization Cli
 
            
 

 
 
 
 
 
 
 
            
 
 
 
 
 
            
 
            
 
 
 
 
 
            
 
            The AutoLoad triggers that define the events that initiate auto-loading of applications. AutoLoad implicitly uses background streaming to enable the application to be fully loaded into cache.
            
 
            The primary feature block will be loaded as quickly as possible. Remaining feature blocks will be loaded in the background to enable foreground operations, such as user interaction with applications, to take priority and provide optimal performance.
            
 
            
-Note  
-
            The AUTOLOADTARGET parameter determines which applications are auto-loaded. By default, packages that have been used are auto-loaded unless AUTOLOADTARGET is set.
            
+Note
            The AUTOLOADTARGET parameter determines which applications are auto-loaded. By default, packages that have been used are auto-loaded unless AUTOLOADTARGET is set.
            
 
            
 
            
- 
+
 
            
 
            Each parameter affects loading behavior as follows:
            
 
              
@@ -123,11 +122,10 @@ The following table lists all available Microsoft Application Virtualization Cli
 
              The three values can be combined. In the following example, AutoLoad triggers are enabled both at user login and when publishing refresh occurs:
              
 
              AUTOLOADONLOGIN AUTOLOADONREFRESH
              
 
              
-Note  
-
              If the client is configured with these values at first install, Autoload will not be triggered until the next time the user logs off and logs back on.
              
+Note
              If the client is configured with these values at first install, Autoload will not be triggered until the next time the user logs off and logs back on.
              
 
              
 
              
- 
+
 
            		
 
            
 
            
 
 
 
 
 
 
            
 
            
 
            SWIPUBSVRHOST
            		
 
            IP address|host name
            Specifies either the IP address of the Application Virtualization Server or a host name of the server that resolves into the server's IP address; required when SWIPUBSVRDISPLAY is used.
            
+
            Specifies either the IP address of the Application Virtualization Server or a host name of the server that resolves into the server's IP address; required when SWIPUBSVRDISPLAY is used.
            
 
            Example: SWIPUBSVRHOST="SERVER01"
            		
 
            
 
            [0|1]
            		
 
            Used when you have applied registry settings prior to deploying a client—for example, by using Group Policy. When a client is deployed, set this parameter to a value of 1 so that it will not overwrite the registry settings.
            
 
            
-Important  
-
            If set to a value of 1, the following client installer command-line parameters are ignored:
            
+Important
            If set to a value of 1, the following client installer command-line parameters are ignored:
            
 
            SWICACHESIZE, MINFREESPACEMB, ALLOWINDEPENDENTFILESTREAMING, APPLICATIONSOURCEROOT, ICONSOURCEROOT, OSDSOURCEROOT, SYSTEMEVENTLOGLEVEL, SWIGLOBALDATA, DOTIMEOUTMINUTES, SWIFSDRIVE, AUTOLOADTARGET, AUTOLOADTRIGGERS, and SWIUSERDATA.
            
-
            For further information about setting these values after installation, see “How to Configure the App-V Client Registry Settings by Using the Command Line” in the Application Virtualization (App-V) Operations Guide ([https://go.microsoft.com/fwlink/?LinkId=122939](https://go.microsoft.com/fwlink/?LinkId=122939)).
            
+
            For further information about setting these values after installation, see “How to Configure the App-V Client Registry Settings by Using the Command Line” in the Application Virtualization (App-V) Operations Guide (https://go.microsoft.com/fwlink/?LinkId=122939).
            
 
            
 
            
- 
+
 
            		
 
            
             
 
            
 
- 
+
 
 ## Related topics
 
@@ -306,9 +301,9 @@ The following table lists all available Microsoft Application Virtualization Cli
 
 [SFTMIME Command Reference](sftmime--command-reference.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/application-virtualization-client-management-console-overview.md b/mdop/appv-v4/application-virtualization-client-management-console-overview.md
index a6c537240c..1f514c7ba3 100644
--- a/mdop/appv-v4/application-virtualization-client-management-console-overview.md
+++ b/mdop/appv-v4/application-virtualization-client-management-console-overview.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Client Management Console Overview
 description: Application Virtualization Client Management Console Overview
-author: jamiejdt
+author: dansimp
 ms.assetid: 21d648cc-eca5-475c-be42-228879b7a45a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-client-management-console-reference.md b/mdop/appv-v4/application-virtualization-client-management-console-reference.md
index aa1dd22200..e13ceabe61 100644
--- a/mdop/appv-v4/application-virtualization-client-management-console-reference.md
+++ b/mdop/appv-v4/application-virtualization-client-management-console-reference.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Client Management Console Reference
 description: Application Virtualization Client Management Console Reference
-author: jamiejdt
+author: dansimp
 ms.assetid: aa27537d-e053-45b5-b0ee-cf6606849e0c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md b/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md
index cb27823b9d..a65de90286 100644
--- a/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md
+++ b/mdop/appv-v4/application-virtualization-client-management-console-roadmap.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Client Management Console Roadmap
 description: Application Virtualization Client Management Console Roadmap
-author: jamiejdt
+author: dansimp
 ms.assetid: 3aca02c4-728c-4c34-b90f-4e6f188937b0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-client-management-console.md b/mdop/appv-v4/application-virtualization-client-management-console.md
index 1c701579d1..e8e5980d13 100644
--- a/mdop/appv-v4/application-virtualization-client-management-console.md
+++ b/mdop/appv-v4/application-virtualization-client-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Client Management Console
 description: Application Virtualization Client Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 18635688-8cbe-40d1-894e-acb2749b4e69
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-client-reference.md b/mdop/appv-v4/application-virtualization-client-reference.md
index ccc4e6c92e..bc3dbef0d8 100644
--- a/mdop/appv-v4/application-virtualization-client-reference.md
+++ b/mdop/appv-v4/application-virtualization-client-reference.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Client Reference
 description: Application Virtualization Client Reference
-author: jamiejdt
+author: dansimp
 ms.assetid: 5107f567-9ac8-43e1-89c8-5e0762e3ddd8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-client-wmi-provider.md b/mdop/appv-v4/application-virtualization-client-wmi-provider.md
index 3025258d50..dd3b3f8eae 100644
--- a/mdop/appv-v4/application-virtualization-client-wmi-provider.md
+++ b/mdop/appv-v4/application-virtualization-client-wmi-provider.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Client WMI Provider
 description: Application Virtualization Client WMI Provider
-author: jamiejdt
+author: dansimp
 ms.assetid: 384e33e0-6689-4e28-af84-53acee8a5c24
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-client.md b/mdop/appv-v4/application-virtualization-client.md
index d31cebbf26..819dd8bed1 100644
--- a/mdop/appv-v4/application-virtualization-client.md
+++ b/mdop/appv-v4/application-virtualization-client.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Client
 description: Application Virtualization Client
-author: jamiejdt
+author: dansimp
 ms.assetid: d9e1939b-eb9c-49a0-855d-f4c323b84c2f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md
index f0934b8e1a..4bd4d4fe49 100644
--- a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md
+++ b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-checklists.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Deployment and Upgrade Checklists
 description: Application Virtualization Deployment and Upgrade Checklists
-author: jamiejdt
+author: dansimp
 ms.assetid: 462e5119-cb83-4548-98f2-df668aa0958b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md
index 693077f351..d71379b47f 100644
--- a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md
+++ b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Deployment and Upgrade Considerations
 description: Application Virtualization Deployment and Upgrade Considerations
-author: jamiejdt
+author: dansimp
 ms.assetid: c3c38930-0da3-43e6-b240-945edfd00a01
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md
index 37bbb869da..c09ced741d 100644
--- a/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md
+++ b/mdop/appv-v4/application-virtualization-deployment-and-upgrade-considerations.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Deployment and Upgrade Considerations
 description: Application Virtualization Deployment and Upgrade Considerations
-author: jamiejdt
+author: dansimp
 ms.assetid: adc562ee-7276-4b14-b10a-da17f05e1682
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-deployment-requirements.md b/mdop/appv-v4/application-virtualization-deployment-requirements.md
index cd1da33519..9baee67d59 100644
--- a/mdop/appv-v4/application-virtualization-deployment-requirements.md
+++ b/mdop/appv-v4/application-virtualization-deployment-requirements.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Deployment Requirements
 description: Application Virtualization Deployment Requirements
-author: jamiejdt
+author: dansimp
 ms.assetid: 9564e974-a853-45ae-b605-0a2e3e5cf212
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-glossary.md b/mdop/appv-v4/application-virtualization-glossary.md
index f43aebc300..3669509527 100644
--- a/mdop/appv-v4/application-virtualization-glossary.md
+++ b/mdop/appv-v4/application-virtualization-glossary.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Glossary
 description: Application Virtualization Glossary
-author: jamiejdt
+author: dansimp
 ms.assetid: 9eb71774-e288-4f94-8f94-5b98e0d012a7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md b/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md
index 8dfc1b4b2a..9b480ae5f3 100644
--- a/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md
+++ b/mdop/appv-v4/application-virtualization-properties-connectivity-tab.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Properties Connectivity Tab
 description: Application Virtualization Properties Connectivity Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: e07c1352-a2be-4d99-9968-daba515bcde2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-properties-file-system-tab.md b/mdop/appv-v4/application-virtualization-properties-file-system-tab.md
index cfee97c8f4..fe4acb134a 100644
--- a/mdop/appv-v4/application-virtualization-properties-file-system-tab.md
+++ b/mdop/appv-v4/application-virtualization-properties-file-system-tab.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Properties File System Tab
 description: Application Virtualization Properties File System Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: c7d56d36-8c50-4dfc-afee-83dea06376d4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-properties-general-tab.md b/mdop/appv-v4/application-virtualization-properties-general-tab.md
index 68c42054e6..375209e344 100644
--- a/mdop/appv-v4/application-virtualization-properties-general-tab.md
+++ b/mdop/appv-v4/application-virtualization-properties-general-tab.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Properties General Tab
 description: Application Virtualization Properties General Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: be7449d9-171a-4a11-9382-83b7008ccbdd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -37,7 +40,7 @@ Select the level from the drop-down list. The default level is **Warning**.
 **Note**  
 The **System Log Level** setting controls the level of messages sent to the system event log. The logged messages are identical to the messages that get logged to the client event log, but they are stored in a different location that does not have the space limitations of the client event log. Because the system event log does not have space limitations, it is ideally suited for situations where verbose logging is necessary.
 
- 
+ 
 
 **Global Data Directory**  
 Enter or browse to the location of the directory of the log file. The default locations are as follows:
@@ -54,9 +57,9 @@ Enter or browse to the location of the directory where user-specific data is sto
 
 [Client Management Console: Application Virtualization Properties](client-management-console-application-virtualization-properties.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md b/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md
index 5ee10019b3..ada91ffa6f 100644
--- a/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md
+++ b/mdop/appv-v4/application-virtualization-properties-import-search-path-tab.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Properties Import Search Path Tab
 description: Application Virtualization Properties Import Search Path Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 7f94d472-1d0a-49d8-b307-330936071e13
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-properties-interface-tab.md b/mdop/appv-v4/application-virtualization-properties-interface-tab.md
index e7bd619e81..fedbe93af5 100644
--- a/mdop/appv-v4/application-virtualization-properties-interface-tab.md
+++ b/mdop/appv-v4/application-virtualization-properties-interface-tab.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Properties Interface Tab
 description: Application Virtualization Properties Interface Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: bb9cb54e-315a-48bf-a396-b33e2cbd030a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-properties-permissions-tab.md b/mdop/appv-v4/application-virtualization-properties-permissions-tab.md
index bedc27d46b..b830275c12 100644
--- a/mdop/appv-v4/application-virtualization-properties-permissions-tab.md
+++ b/mdop/appv-v4/application-virtualization-properties-permissions-tab.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Properties Permissions Tab
 description: Application Virtualization Properties Permissions Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 5219bc7c-7c7a-4e2f-8fba-7039933d1124
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-reference.md b/mdop/appv-v4/application-virtualization-reference.md
index 37233206f9..11b374d4e3 100644
--- a/mdop/appv-v4/application-virtualization-reference.md
+++ b/mdop/appv-v4/application-virtualization-reference.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Reference
 description: Application Virtualization Reference
-author: jamiejdt
+author: dansimp
 ms.assetid: 5f994be7-41fa-416b-8a4c-6ed52fcd9b72
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-report-types.md b/mdop/appv-v4/application-virtualization-report-types.md
index dca30f5bc9..3e81bdd8f6 100644
--- a/mdop/appv-v4/application-virtualization-report-types.md
+++ b/mdop/appv-v4/application-virtualization-report-types.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Report Types
 description: Application Virtualization Report Types
-author: jamiejdt
+author: dansimp
 ms.assetid: 232ef25e-11a0-49fb-b4b3-54ac83577383
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencer-command-line.md b/mdop/appv-v4/application-virtualization-sequencer-command-line.md
index f4a10043ff..abbc660844 100644
--- a/mdop/appv-v4/application-virtualization-sequencer-command-line.md
+++ b/mdop/appv-v4/application-virtualization-sequencer-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencer Command Line
 description: Application Virtualization Sequencer Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: a6d5ec9f-cc66-4869-9250-5c65d7e1e58e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencer-console-overview.md b/mdop/appv-v4/application-virtualization-sequencer-console-overview.md
index 3ec1ac30ae..1669e0fe12 100644
--- a/mdop/appv-v4/application-virtualization-sequencer-console-overview.md
+++ b/mdop/appv-v4/application-virtualization-sequencer-console-overview.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencer Console Overview
 description: Application Virtualization Sequencer Console Overview
-author: jamiejdt
+author: dansimp
 ms.assetid: 681bb40d-2937-4645-82aa-4a44775232d8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md b/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md
index 9186e17f03..cc7fa3c205 100644
--- a/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md
+++ b/mdop/appv-v4/application-virtualization-sequencer-hardware-and-software-requirements.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencer Hardware and Software Requirements
 description: Application Virtualization Sequencer Hardware and Software Requirements
-author: jamiejdt
+author: dansimp
 ms.assetid: c88a1b5b-23e1-4460-afa9-a5f37e32eb05
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ This topic describes the minimum recommended hardware and software requirements
 **Important**  
 You must run the App-V sequencer (**SFTSequencer.exe**) using an account that has administrator privileges because of the changes the sequencer makes to the local system. These changes can include writing files to the **C:\\Program Files** directory, making registry changes, starting and stopping services, updating security descriptors for files, and changing permissions.
 
- 
+ 
 
 Before you install the Sequencer and after you sequence each application, you must restore a clean operating system image to the sequencing computer. You can use one of the following methods to restore the computer running the Sequencer:
 
@@ -44,7 +47,7 @@ The requirements are listed first for Microsoft Application Virtualization (App-
     **Note**  
     Sequencing requires heavy disk usage. A fast disk speed can decrease the sequencing time.
 
-     
+     
 
 ### Software Requirements for App-V 4.6 SP2
 
@@ -93,12 +96,12 @@ The following list outlines the supported operating systems for running the App-
 
 
 
- 
+ 
 
 **Note**  
 The Application Virtualization (App-V) 4.6 SP2 Sequencer supports 32-bit and 64-bit versions of these operating systems.
 
- 
+ 
 
 You should configure computers running the Sequencer with the same applications that are installed on targeted computers.
 
@@ -143,14 +146,14 @@ The following list outlines the supported operating systems for running the Sequ
 
 
 
- 
+ 
 
 ¹Supported for App-V 4.5 with SP1 or SP2, and App-V 4.6 only
 
 **Note**  
 The Application Virtualization (App-V) 4.6 Sequencer supports 32-bit and 64-bit versions of these operating systems.
 
- 
+ 
 
 You should configure computers running the Sequencer with the same applications that are installed on targeted computers.
 
@@ -199,12 +202,12 @@ You should configure computers running the Sequencer with the same applications
 
 
 
- 
+ 
 
 **Note**  
 Application Virtualization (App-V) 4.6 SP2 for Remote Desktop Services supports 32-bit and 64-bit versions of these operating systems.
 
- 
+ 
 
 ### Software Requirements for Remote Desktop Services for Versions that Precede App-V 4.6 SP2
 
@@ -251,12 +254,12 @@ Application Virtualization (App-V) 4.6 SP2 for Remote Desktop Services supports
 
 
 
- 
+ 
 
 **Note**  
 Application Virtualization (App-V) 4.6 SP2 for Remote Desktop Services supports 32-bit and 64-bit versions of these operating systems.
 
- 
+ 
 
 ## Related topics
 
@@ -269,9 +272,9 @@ Application Virtualization (App-V) 4.6 SP2 for Remote Desktop Services supports
 
 [How to Upgrade the Application Virtualization Sequencer](how-to-upgrade-the-application-virtualization-sequencer.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/application-virtualization-sequencer-online-help.md b/mdop/appv-v4/application-virtualization-sequencer-online-help.md
index d8ffc5e9ee..3164dedaf1 100644
--- a/mdop/appv-v4/application-virtualization-sequencer-online-help.md
+++ b/mdop/appv-v4/application-virtualization-sequencer-online-help.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencer Online Help
 description: Application Virtualization Sequencer Online Help
-author: jamiejdt
+author: dansimp
 ms.assetid: 0ddeae59-314f-4c61-b85f-6b137b959fa6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md
index 99d3714dcf..894504a132 100644
--- a/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md
+++ b/mdop/appv-v4/application-virtualization-sequencer-options-dialog-box.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencer Options Dialog Box
 description: Application Virtualization Sequencer Options Dialog Box
-author: jamiejdt
+author: dansimp
 ms.assetid: f71eda8d-8270-439f-a093-867b3a43ebff
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencer-overview.md b/mdop/appv-v4/application-virtualization-sequencer-overview.md
index 3638b814cd..efe77f6f0e 100644
--- a/mdop/appv-v4/application-virtualization-sequencer-overview.md
+++ b/mdop/appv-v4/application-virtualization-sequencer-overview.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencer Overview
 description: Application Virtualization Sequencer Overview
-author: jamiejdt
+author: dansimp
 ms.assetid: e6422a28-633e-4dff-8abb-7cf6a5468112
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencer-reference.md b/mdop/appv-v4/application-virtualization-sequencer-reference.md
index 676361d795..69240cc62a 100644
--- a/mdop/appv-v4/application-virtualization-sequencer-reference.md
+++ b/mdop/appv-v4/application-virtualization-sequencer-reference.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencer Reference
 description: Application Virtualization Sequencer Reference
-author: jamiejdt
+author: dansimp
 ms.assetid: a2aef256-98c0-4f81-83a2-af4b64208088
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md b/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md
index 97ec81c142..36c372bd1c 100644
--- a/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md
+++ b/mdop/appv-v4/application-virtualization-sequencer-technical-reference-keep.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencer Technical Reference
 description: Application Virtualization Sequencer Technical Reference
-author: jamiejdt
+author: dansimp
 ms.assetid: 4aa515ce-64f0-4998-8100-f87dc77aed70
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencer.md b/mdop/appv-v4/application-virtualization-sequencer.md
index 199f81a525..3f31f87b42 100644
--- a/mdop/appv-v4/application-virtualization-sequencer.md
+++ b/mdop/appv-v4/application-virtualization-sequencer.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencer
 description: Application Virtualization Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: f078f3c9-7b5c-4ff1-b319-4c076b88bc39
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md
index c2e4650873..e3b9b48948 100644
--- a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md
+++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-application-dialog-box.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencing Wizard-Add Application Dialog Box
 description: Application Virtualization Sequencing Wizard-Add Application Dialog Box
-author: jamiejdt
+author: dansimp
 ms.assetid: 247eac0e-830d-4d72-be48-af7d1525eefd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md
index 3c4db7eb87..7d58727b72 100644
--- a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md
+++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-file-type-association-dialog-box.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencing Wizard-Add File Type Association Dialog Box
 description: Application Virtualization Sequencing Wizard-Add File Type Association Dialog Box
-author: jamiejdt
+author: dansimp
 ms.assetid: f7656053-3d92-448e-8759-b6b09cef6025
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md
index bbbc0fae3b..1a7aceec55 100644
--- a/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md
+++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-add-files-to-virtual-file-system-page.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencing Wizard Add Files to Virtual File System Page
 description: Application Virtualization Sequencing Wizard Add Files to Virtual File System Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 6b01333b-08bd-4b96-a123-a07a7aafddd1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md
index 04ff4ed10c..c195624f90 100644
--- a/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md
+++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-advanced-options-page.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencing Wizard Advanced Options Page
 description: Application Virtualization Sequencing Wizard Advanced Options Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 2c4c5d95-d55e-463d-a851-8486f6a724f2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -38,16 +41,15 @@ Use the **Advanced Options** page of the Application Virtualization (App-V) Sequ
 
          • 64 KB
            • 
 
          
 
          
-Note  
-
          When you select a block size, consider the size of the SFT file and your network bandwidth. A file with a smaller block size takes longer to stream over the network but is less bandwidth-intensive. Files with larger block sizes might stream faster, but they use more network bandwidth. Through experimentation, you can discover the optimum block size for streaming applications on your network.
          
+Note
          When you select a block size, consider the size of the SFT file and your network bandwidth. A file with a smaller block size takes longer to stream over the network but is less bandwidth-intensive. Files with larger block sizes might stream faster, but they use more network bandwidth. Through experimentation, you can discover the optimum block size for streaming applications on your network.
          
 
          
 
          
- 
+
 
          
 
 
 
          Enable Microsoft Update During Monitoring
          
-
          Enables installation of Microsoft Updates during the Sequencing Wizard's monitoring phase.
          
+
          Enables installation of Microsoft Updates during the Sequencing Wizard's monitoring phase.
          
 
 
 
          Rebase DLLs
          
@@ -55,11 +57,11 @@ Use the **Advanced Options** page of the Application Virtualization (App-V) Sequ
 
 
 
          Back
          
-
          Accesses the Sequencing Wizard's previous page.
          
+
          Accesses the Sequencing Wizard's previous page.
          
 
 
 
          Next
          
-
          Accesses the Sequencing Wizard's next page.
          
+
          Accesses the Sequencing Wizard's next page.
          
 
 
 
          Cancel
          
@@ -68,7 +70,7 @@ Use the **Advanced Options** page of the Application Virtualization (App-V) Sequ
 
 
 
- 
+
 
 \[Template Token Value\]
 
@@ -109,7 +111,7 @@ Use the **Advanced Options** page of the App-V Sequencing Wizard to specify adva
 
 
 
- 
+
 
 \[Template Token Value\]
 
@@ -118,9 +120,9 @@ Use the **Advanced Options** page of the App-V Sequencing Wizard to specify adva
 
 [Sequencing Wizard](sequencing-wizard.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md
index 83d0a4906f..0fa1b9ca03 100644
--- a/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md
+++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-configure-application-page-keep.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencing Wizard Configure Application Page
 description: Application Virtualization Sequencing Wizard Configure Application Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 2927debd-de4b-41d2-9e1c-e8927231f4cc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md
index 2033a87c77..995ae0facc 100644
--- a/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md
+++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-launch-applications-page.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencing Wizard Launch Applications Page
 description: Application Virtualization Sequencing Wizard Launch Applications Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 69b1d6e1-00ff-49e3-a245-a4aca225d681
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md
index 296ae7e55d..8f834f6d26 100644
--- a/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md
+++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-monitor-installation-page.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencing Wizard Monitor Installation Page
 description: Application Virtualization Sequencing Wizard Monitor Installation Page
-author: jamiejdt
+author: dansimp
 ms.assetid: b54b8145-a57e-4d0d-b776-b5319aadb78e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -32,31 +35,29 @@ Use the **Monitor Installation** page of the Application Virtualization Sequenci
 
          Begin Monitoring
          
 
          Starts the monitoring of the sequencing process.
          
 
          
-Note  
-
          The Sequencer will minimize so that you can run your application's installer, except on Vista.
          
+Note
          The Sequencer will minimize so that you can run your application's installer, except on Vista.
          
 
          
 
          
- 
+
 
          
 
 
 
          Stop Monitoring
          
 
          Stops the monitoring of the sequencing process.
          
 
          
-Note  
-
          The Stop Monitoring button is displayed only after the monitoring process starts.
          
+Note
          The Stop Monitoring button is displayed only after the monitoring process starts.
          
 
          
 
          
- 
+
 
          
 
 
 
          Back
          
-
          Accesses the Sequencing Wizard's previous page.
          
+
          Accesses the Sequencing Wizard's previous page.
          
 
 
 
          Next
          
-
          Accesses the Sequencing Wizard's next page.
          
+
          Accesses the Sequencing Wizard's next page.
          
 
 
 
          Cancel
          
@@ -65,7 +66,7 @@ Use the **Monitor Installation** page of the Application Virtualization Sequenci
 
 
 
- 
+
 
 \[Template Token Value\]
 
@@ -106,7 +107,7 @@ Use the **Monitor Installation** page of the App-V sequencing wizard to monitor
 
 
 
- 
+
 
 \[Template Token Value\]
 
@@ -115,9 +116,9 @@ Use the **Monitor Installation** page of the App-V sequencing wizard to monitor
 
 [Sequencing Wizard](sequencing-wizard.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md
index 38156fac6d..996fff81b1 100644
--- a/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md
+++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-package-information-page-keep.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencing Wizard Package Information Page
 description: Application Virtualization Sequencing Wizard Package Information Page
-author: jamiejdt
+author: dansimp
 ms.assetid: e52efd08-1b05-4bd6-a6e7-5f6bdbde7df7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md
index e0af4c968c..6a9437812a 100644
--- a/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md
+++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-sequence-package-page.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencing Wizard Sequence Package Page
 description: Application Virtualization Sequencing Wizard Sequence Package Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 4c603d6a-9139-4867-a085-c6d6b517917e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md b/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md
index 723b880775..87689f417f 100644
--- a/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md
+++ b/mdop/appv-v4/application-virtualization-sequencing-wizard-shortcut-locations-dialog-box.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Sequencing Wizard-Shortcut Locations Dialog Box
 description: Application Virtualization Sequencing Wizard-Shortcut Locations Dialog Box
-author: jamiejdt
+author: dansimp
 ms.assetid: d79d7085-228e-4be2-abe6-2760b9b983d5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md b/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md
index cf10b2b73e..8a53cc64f2 100644
--- a/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md
+++ b/mdop/appv-v4/application-virtualization-server-based-scenario-overview.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Server-Based Scenario Overview
 description: Application Virtualization Server-Based Scenario Overview
-author: jamiejdt
+author: dansimp
 ms.assetid: 2d91392b-5085-4a5d-94f2-15eed1ed2928
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,7 +19,7 @@ ms.date: 06/16/2016
 
 If you plan to use a server-based deployment scenario for your Microsoft Application Virtualization environment, it is important to understand the differences between the *Application Virtualization Management Server* and the *Application Virtualization Streaming Server*. This topic describes those differences and also provides information about package delivery methods, transmission protocols, and external components that you will need to consider as you proceed with your deployment.
 
-##  Application Virtualization Management Server
+## Application Virtualization Management Server
 
 
 The Application Virtualization Management Server performs both the publishing function and the streaming function. The server publishes application icons, shortcuts, and file type associations to the App-V clients for authorized users. When user requests for applications are received the server streams that data on-demand to authorized users using RTSP or RTSPS protocols. In most configurations using this server, one or more Management Servers share a common data store for configuration and package information.
@@ -25,7 +28,7 @@ The Application Virtualization Management Servers use Active Directory groups to
 
 Because the Application Virtualization Management Servers stream applications to end-users on demand, these servers are ideally suited for system configurations that have reliable, high-bandwidth LANs.
 
-##  Application Virtualization Streaming Server
+## Application Virtualization Streaming Server
 
 
 The Application Virtualization Streaming Server delivers the same streaming and package upgrade capabilities provided by the Management Server, but without its Active Directory or SQL Server requirements. However, the Streaming Server does not have a publishing service, nor does it have licensing or metering capabilities. The publishing service of a separate App-V Management Server is used in conjunction with the App-V Streaming Server. The App-V Streaming Server addresses the needs of businesses that want to use Application Virtualization in multiple locations with the streaming capabilities of the classic server configuration but might not have the infrastructure to support App-V Management Servers in every location.
@@ -52,7 +55,7 @@ For load from file package delivery, the server delivers the entire virtualized
 **Note**  
 For each delivery method, the initial virtual application delivery process and the virtual application update process are the same; the updated virtual application package replaces the original application package.
 
- 
+ 
 
 The following table compares the advantages and disadvantages of each package delivery method.
 
@@ -95,7 +98,7 @@ The following table compares the advantages and disadvantages of each package de
 
 
 
- 
+ 
 
 ## Server-Related Protocols and External Components
 
@@ -154,7 +157,7 @@ The following table lists the server types that can be used in an Application Vi
 
 
 
- 
+ 
 
 ## Related topics
 
@@ -165,9 +168,9 @@ The following table lists the server types that can be used in an Application Vi
 
 [How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/application-virtualization-server-based-scenario.md b/mdop/appv-v4/application-virtualization-server-based-scenario.md
index 34638870e9..84336dad16 100644
--- a/mdop/appv-v4/application-virtualization-server-based-scenario.md
+++ b/mdop/appv-v4/application-virtualization-server-based-scenario.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Server-Based Scenario
 description: Application Virtualization Server-Based Scenario
-author: jamiejdt
+author: dansimp
 ms.assetid: 10ed0b18-087d-470f-951b-5083f4cb076f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-server-management-console-reference.md b/mdop/appv-v4/application-virtualization-server-management-console-reference.md
index 43aaba4de2..c36cd7f3fd 100644
--- a/mdop/appv-v4/application-virtualization-server-management-console-reference.md
+++ b/mdop/appv-v4/application-virtualization-server-management-console-reference.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Server Management Console Reference
 description: Application Virtualization Server Management Console Reference
-author: jamiejdt
+author: dansimp
 ms.assetid: 7c9890f4-7230-44dd-bbe8-95a4b65dc796
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-server-management-help.md b/mdop/appv-v4/application-virtualization-server-management-help.md
index f58b64b917..7ae7b3aab4 100644
--- a/mdop/appv-v4/application-virtualization-server-management-help.md
+++ b/mdop/appv-v4/application-virtualization-server-management-help.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Server Management Help
 description: Application Virtualization Server Management Help
-author: jamiejdt
+author: dansimp
 ms.assetid: 4f67265c-58f5-4d77-bfff-95474d8f1bb6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-server.md b/mdop/appv-v4/application-virtualization-server.md
index 1031a2665d..db3ac34238 100644
--- a/mdop/appv-v4/application-virtualization-server.md
+++ b/mdop/appv-v4/application-virtualization-server.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Server
 description: Application Virtualization Server
-author: jamiejdt
+author: dansimp
 ms.assetid: feea99b2-5e3d-42b1-ad41-157429e5fceb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/application-virtualization-system-requirements.md b/mdop/appv-v4/application-virtualization-system-requirements.md
index fcdb31944d..d912bfff73 100644
--- a/mdop/appv-v4/application-virtualization-system-requirements.md
+++ b/mdop/appv-v4/application-virtualization-system-requirements.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization System Requirements
 description: Application Virtualization System Requirements
-author: jamiejdt
+author: dansimp
 ms.assetid: a2798dd9-168e-45eb-8103-e12e128fae7c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -86,7 +89,7 @@ The following list includes the minimum recommended hardware and software requir
 
 
 
- 
+ 
 
 ¹Applies to App-V 4.5 SP1 and SP2 only.
 
@@ -160,7 +163,7 @@ The following list includes the minimum recommended hardware and software requir
 
 
 
- 
+ 
 
 ¹Applies to App-V 4.5 SP1 and SP2 only.
 
@@ -240,7 +243,7 @@ The following list includes the minimum recommended hardware and software requir
 
 
 
- 
+ 
 
 ¹Applies to App-V 4.5 SP1 and SP2 only.
 
@@ -324,7 +327,7 @@ The following list includes the minimum recommended hardware and software requir
 
 
 
- 
+ 
 
 ¹Applies to App-V 4.5 SP1 and SP2 only.
 
@@ -335,7 +338,7 @@ The following list includes the minimum recommended hardware and software requir
     **Important**  
     The minimum requirement is .NET Framework 2.0 SP2 if you must install App-V hotfix KB980850 or subsequent App-V hotfixes on the computer that is running the App-V Management Console.
 
-     
+     
 
 ## Related topics
 
@@ -350,9 +353,9 @@ The following list includes the minimum recommended hardware and software requir
 
 [How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md b/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md
index c470338eac..3420240770 100644
--- a/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md
+++ b/mdop/appv-v4/application-virtualization-technical-publications-white-papers.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization Technical Publications
 description: Application Virtualization Technical Publications
-author: jamiejdt
+author: dansimp
 ms.assetid: 86606647-3b9b-4459-9638-64626051ac94
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/applications-licenses-node.md b/mdop/appv-v4/applications-licenses-node.md
index ea2fbc6412..3bc727a6b1 100644
--- a/mdop/appv-v4/applications-licenses-node.md
+++ b/mdop/appv-v4/applications-licenses-node.md
@@ -1,12 +1,15 @@
 ---
 title: Applications Licenses Node
 description: Applications Licenses Node
-author: jamiejdt
+author: dansimp
 ms.assetid: 2b8752ff-aa56-483e-b844-966941af2d94
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -25,7 +28,7 @@ The **Applications Licenses** node is one level below the Application Virtualiza
 **Note**  
 You can combine concurrent and named licenses for the same application.
 
- 
+ 
 
 Right-click the **Applications Licenses** node to display a pop-up menu that contains the following elements.
 
@@ -113,9 +116,9 @@ Displays the help system for the Application Virtualization Server Management Co
 
 [Server Management Console: Application Licenses Node](server-management-console-application-licenses-node.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/applications-licenses-results-pane-columns.md b/mdop/appv-v4/applications-licenses-results-pane-columns.md
index 7d162df66c..9fe5dbaaf8 100644
--- a/mdop/appv-v4/applications-licenses-results-pane-columns.md
+++ b/mdop/appv-v4/applications-licenses-results-pane-columns.md
@@ -1,12 +1,15 @@
 ---
 title: Applications Licenses Results Pane Columns
 description: Applications Licenses Results Pane Columns
-author: jamiejdt
+author: dansimp
 ms.assetid: bd56b36a-655e-4fc4-9f83-d2ed68882402
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/applications-licenses-results-pane.md b/mdop/appv-v4/applications-licenses-results-pane.md
index eb0f4c8053..3339644301 100644
--- a/mdop/appv-v4/applications-licenses-results-pane.md
+++ b/mdop/appv-v4/applications-licenses-results-pane.md
@@ -1,12 +1,15 @@
 ---
 title: Applications Licenses Results Pane
 description: Applications Licenses Results Pane
-author: jamiejdt
+author: dansimp
 ms.assetid: 8b519715-b2fe-451e-ad9b-e9b73f454961
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/applications-node-in-server-management-console.md b/mdop/appv-v4/applications-node-in-server-management-console.md
index 9f484ffa6a..0dd4066e35 100644
--- a/mdop/appv-v4/applications-node-in-server-management-console.md
+++ b/mdop/appv-v4/applications-node-in-server-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: Applications Node in Server Management Console
 description: Applications Node in Server Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 27edbd83-0fc2-4a40-9834-d5db5be06681
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/applications-node.md b/mdop/appv-v4/applications-node.md
index e81599900a..760ebc733a 100644
--- a/mdop/appv-v4/applications-node.md
+++ b/mdop/appv-v4/applications-node.md
@@ -1,12 +1,15 @@
 ---
 title: Applications Node
 description: Applications Node
-author: jamiejdt
+author: dansimp
 ms.assetid: ded79569-8a3f-47ab-b135-0836bbb039f3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md b/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md
index 67ec28d6db..55a7172da2 100644
--- a/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md
+++ b/mdop/appv-v4/applications-results-pane-columns-in-server-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: Applications Results Pane Columns in Server Management Console
 description: Applications Results Pane Columns in Server Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 8757e3bc-450b-4550-81d2-624906523147
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/applications-results-pane-columns.md b/mdop/appv-v4/applications-results-pane-columns.md
index 4c669aaded..c7c7c41ec3 100644
--- a/mdop/appv-v4/applications-results-pane-columns.md
+++ b/mdop/appv-v4/applications-results-pane-columns.md
@@ -1,12 +1,15 @@
 ---
 title: Applications Results Pane Columns
 description: Applications Results Pane Columns
-author: jamiejdt
+author: dansimp
 ms.assetid: abae5ce2-40df-4f47-8062-f5eb6295c88c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The **Results** pane of the **Applications** node in the Application Virtualizat
 **Note**  
 You can add or remove columns by right-clicking in the **Results** pane, selecting **View**, and then selecting **Add/Remove Columns**.
 
- 
+ 
 
 The list can be sorted by any column. Columns that contain dates and times are sorted in chronological order, not alphabetical. For columns that contain a mix of dates and times and text, dates and times are considered to come before any other text.
 
@@ -124,9 +127,9 @@ The application version.
 
 [Application Virtualization Client Management Console Reference](application-virtualization-client-management-console-reference.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/applications-results-pane-in-server-management-console.md b/mdop/appv-v4/applications-results-pane-in-server-management-console.md
index 65aaf16f6d..ea36979d73 100644
--- a/mdop/appv-v4/applications-results-pane-in-server-management-console.md
+++ b/mdop/appv-v4/applications-results-pane-in-server-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: Applications Results Pane in Server Management Console
 description: Applications Results Pane in Server Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 686218bc-6156-40e2-92aa-90981c3d112a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -33,8 +36,6 @@ Organizes the icons in the **Results** pane.
 **Help**  
 Displays the help system for the Application Virtualization Management Console.
 
-[]()  
-
 Right-click any application in the **Results** pane to display a pop-up menu that contains the following elements.
 
 **Move**  
diff --git a/mdop/appv-v4/applications-results-pane.md b/mdop/appv-v4/applications-results-pane.md
index 3715f0ac45..ad52fe65d1 100644
--- a/mdop/appv-v4/applications-results-pane.md
+++ b/mdop/appv-v4/applications-results-pane.md
@@ -1,12 +1,15 @@
 ---
 title: Applications Results Pane
 description: Applications Results Pane
-author: jamiejdt
+author: dansimp
 ms.assetid: 977a4d35-5344-41fa-af66-14957b38ed47
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md b/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md
index f36bf3a87b..8ac9a89ec9 100644
--- a/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md
+++ b/mdop/appv-v4/best-practices-for-the-application-virtualization-sequencer-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: Best Practices for the Application Virtualization Sequencer
 description: Best Practices for the Application Virtualization Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: 95e5e216-864f-41a1-90d4-b8d7e1eb42a0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -65,7 +68,7 @@ The following best practices should be considered when sequencing a new applicat
     **Note**  
     If you are running App-V 4.6 SP1 you do not need to sequence to a directory that follows the 8.3 naming convention.
 
-     
+     
 
 -   **Sequence to a unique directory that follows the 8.3 naming convention.**
 
@@ -92,9 +95,9 @@ The following best practices should be considered when sequencing a new applicat
 
 [Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/change-history-tab-keep.md b/mdop/appv-v4/change-history-tab-keep.md
index 561d662ddf..7de068d479 100644
--- a/mdop/appv-v4/change-history-tab-keep.md
+++ b/mdop/appv-v4/change-history-tab-keep.md
@@ -1,12 +1,15 @@
 ---
 title: Change History Tab
 description: Change History Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 652ef2f0-3a3e-4844-a472-9fa99ec5ee32
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/clear-app.md b/mdop/appv-v4/clear-app.md
index f0894b3362..ce8c9d4c5f 100644
--- a/mdop/appv-v4/clear-app.md
+++ b/mdop/appv-v4/clear-app.md
@@ -1,12 +1,15 @@
 ---
 title: CLEAR APP
 description: CLEAR APP
-author: jamiejdt
+author: dansimp
 ms.assetid: c2e63031-5941-45e4-9863-127231cfa25b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/clear-obj.md b/mdop/appv-v4/clear-obj.md
index ce49ae7dae..33dfd04705 100644
--- a/mdop/appv-v4/clear-obj.md
+++ b/mdop/appv-v4/clear-obj.md
@@ -1,12 +1,15 @@
 ---
 title: CLEAR OBJ
 description: CLEAR OBJ
-author: jamiejdt
+author: dansimp
 ms.assetid: 1e50b33f-6324-4eae-8573-75c153f786cd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/client-management-console-about-dialog-boxes.md b/mdop/appv-v4/client-management-console-about-dialog-boxes.md
index 0e20237b0c..67b7ff9eaa 100644
--- a/mdop/appv-v4/client-management-console-about-dialog-boxes.md
+++ b/mdop/appv-v4/client-management-console-about-dialog-boxes.md
@@ -1,12 +1,15 @@
 ---
 title: Client Management Console About Dialog Boxes
 description: Client Management Console About Dialog Boxes
-author: jamiejdt
+author: dansimp
 ms.assetid: eaf4a05e-513d-4eac-a549-76e63a70893d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/client-management-console-application-virtualization-node.md b/mdop/appv-v4/client-management-console-application-virtualization-node.md
index 81a48908f9..9ea64120a9 100644
--- a/mdop/appv-v4/client-management-console-application-virtualization-node.md
+++ b/mdop/appv-v4/client-management-console-application-virtualization-node.md
@@ -1,12 +1,15 @@
 ---
 title: Client Management Console Application Virtualization Node
 description: Client Management Console Application Virtualization Node
-author: jamiejdt
+author: dansimp
 ms.assetid: cf74e112-ddff-4e30-a3cc-7f4c643366c6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/client-management-console-application-virtualization-properties.md b/mdop/appv-v4/client-management-console-application-virtualization-properties.md
index a3fac23fda..85513a0959 100644
--- a/mdop/appv-v4/client-management-console-application-virtualization-properties.md
+++ b/mdop/appv-v4/client-management-console-application-virtualization-properties.md
@@ -1,12 +1,15 @@
 ---
 title: Client Management Console Application Virtualization Properties
 description: Client Management Console Application Virtualization Properties
-author: jamiejdt
+author: dansimp
 ms.assetid: 70319e4c-5032-4cb3-bbb8-4292809dcea2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/client-management-console-applications-node.md b/mdop/appv-v4/client-management-console-applications-node.md
index 6f2b30981a..6661141ad2 100644
--- a/mdop/appv-v4/client-management-console-applications-node.md
+++ b/mdop/appv-v4/client-management-console-applications-node.md
@@ -1,12 +1,15 @@
 ---
 title: Client Management Console Applications Node
 description: Client Management Console Applications Node
-author: jamiejdt
+author: dansimp
 ms.assetid: 20cf533c-e0b0-4b81-af4b-b5b519594d1e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/client-management-console-file-type-associations-node.md b/mdop/appv-v4/client-management-console-file-type-associations-node.md
index c16d7674a9..f0c5570f3c 100644
--- a/mdop/appv-v4/client-management-console-file-type-associations-node.md
+++ b/mdop/appv-v4/client-management-console-file-type-associations-node.md
@@ -1,12 +1,15 @@
 ---
 title: Client Management Console File Type Associations Node
 description: Client Management Console File Type Associations Node
-author: jamiejdt
+author: dansimp
 ms.assetid: f0bc05ce-2cb2-4b06-961b-6c42d0274d28
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/client-management-console-publishing-servers-node.md b/mdop/appv-v4/client-management-console-publishing-servers-node.md
index 2c5491a980..f863e5d717 100644
--- a/mdop/appv-v4/client-management-console-publishing-servers-node.md
+++ b/mdop/appv-v4/client-management-console-publishing-servers-node.md
@@ -1,12 +1,15 @@
 ---
 title: Client Management Console Publishing Servers Node
 description: Client Management Console Publishing Servers Node
-author: jamiejdt
+author: dansimp
 ms.assetid: 03f2038f-b5f7-4e5b-a8f0-98f5e9d5f644
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/command-line-errors.md b/mdop/appv-v4/command-line-errors.md
index 3abc4aaaca..3da8e0d9f9 100644
--- a/mdop/appv-v4/command-line-errors.md
+++ b/mdop/appv-v4/command-line-errors.md
@@ -1,12 +1,15 @@
 ---
 title: Command-Line Errors
 description: Command-Line Errors
-author: jamiejdt
+author: dansimp
 ms.assetid: eea62568-4e90-4877-9cc7-e27ef5c05068
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Use the following list of errors to identify the reasons why command-line sequen
 **Note**  
 More than one error might be displayed when sequencing. Furthermore, the error code displayed might be the sum of two error codes. For example, if the */InstallPath* and */OutputFile* parameters are missing, the Microsoft System Center Application Virtualization Sequencer will return 96—the sum of the two error codes.
 
- 
+ 
 
 01  
 There is an unspecified error.
@@ -61,7 +64,7 @@ The sequenced application package cannot be saved.
 The specified package name (/PACKAGENAME) is not valid.
 
 8192  
-The specified block size (/BLOCKSIZE*)* is not valid.
+The specified block size (/BLOCKSIZE) is not valid.
 
 16384  
 The specified compression type (/COMPRESSION) is not valid.
@@ -88,9 +91,9 @@ The package name was not specified.
 
 [Command-Line Parameters](command-line-parameters.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/command-line-parameters.md b/mdop/appv-v4/command-line-parameters.md
index 80aa27962c..2c67aced2f 100644
--- a/mdop/appv-v4/command-line-parameters.md
+++ b/mdop/appv-v4/command-line-parameters.md
@@ -1,12 +1,15 @@
 ---
 title: Command-Line Parameters
 description: Command-Line Parameters
-author: jamiejdt
+author: dansimp
 ms.assetid: d90a0591-f1ce-4cb8-b244-85cc70461922
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -31,7 +34,7 @@ Use to specify the path and file name of the SPRJ file that will be generated.
 **Important**  
 The */OUTPUTFILE* parameter is not available when opening a package that you do not intend to upgrade.
 
- 
+ 
 
 */FULLLOAD* or */F*  
 Use to specify whether to put everything in the primary feature block.
@@ -84,9 +87,9 @@ Specifies the directory on the sequencing computer where the files associated wi
 
 [How to Upgrade a Package Using the Open Package Command](how-to-upgrade-a-package-using-the-open-package-command.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/completion-page-package-accelerator.md b/mdop/appv-v4/completion-page-package-accelerator.md
index 49e876d8ea..7542c71906 100644
--- a/mdop/appv-v4/completion-page-package-accelerator.md
+++ b/mdop/appv-v4/completion-page-package-accelerator.md
@@ -1,12 +1,15 @@
 ---
 title: Completion Page
 description: Completion Page
-author: jamiejdt
+author: dansimp
 ms.assetid: b2c7776c-2c35-4d25-92b4-6cd8c2bdff42
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/completion-page.md b/mdop/appv-v4/completion-page.md
index 4cf1c0254a..c733a56d5d 100644
--- a/mdop/appv-v4/completion-page.md
+++ b/mdop/appv-v4/completion-page.md
@@ -1,12 +1,15 @@
 ---
 title: Completion Page
 description: Completion Page
-author: jamiejdt
+author: dansimp
 ms.assetid: b284d362-b9e1-4d04-88cd-fe9980652188
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configure-app.md b/mdop/appv-v4/configure-app.md
index f0981bf413..407824e6a0 100644
--- a/mdop/appv-v4/configure-app.md
+++ b/mdop/appv-v4/configure-app.md
@@ -1,12 +1,15 @@
 ---
 title: CONFIGURE APP
 description: CONFIGURE APP
-author: jamiejdt
+author: dansimp
 ms.assetid: fcfb4f86-8b7c-4208-bca3-955fd067079f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configure-package.md b/mdop/appv-v4/configure-package.md
index f98fd0b57b..2bccdbf61d 100644
--- a/mdop/appv-v4/configure-package.md
+++ b/mdop/appv-v4/configure-package.md
@@ -1,12 +1,15 @@
 ---
 title: CONFIGURE PACKAGE
 description: CONFIGURE PACKAGE
-author: jamiejdt
+author: dansimp
 ms.assetid: acc7eaa8-6ada-47b9-a655-2ca2537605b9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configure-server.md b/mdop/appv-v4/configure-server.md
index 9e7cc0d818..ed7f5ca4d8 100644
--- a/mdop/appv-v4/configure-server.md
+++ b/mdop/appv-v4/configure-server.md
@@ -1,12 +1,15 @@
 ---
 title: CONFIGURE SERVER
 description: CONFIGURE SERVER
-author: jamiejdt
+author: dansimp
 ms.assetid: c916eddd-74f2-46e4-953d-120b23284e37
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configure-software-page--learn-more-.md b/mdop/appv-v4/configure-software-page--learn-more-.md
index 7b3f1d7e83..87abcb67dd 100644
--- a/mdop/appv-v4/configure-software-page--learn-more-.md
+++ b/mdop/appv-v4/configure-software-page--learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Configure Software Page (Learn More)
 description: Configure Software Page (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: 9a0cd4a5-88da-4897-a13a-5d21fc04afda
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configure-software-page-app-v-46-sp1.md b/mdop/appv-v4/configure-software-page-app-v-46-sp1.md
index ee0ecb558e..7d201afb8d 100644
--- a/mdop/appv-v4/configure-software-page-app-v-46-sp1.md
+++ b/mdop/appv-v4/configure-software-page-app-v-46-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: Configure Software Page
 description: Configure Software Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 50596eba-ce20-4d36-8e57-bd4b6c6cf92e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configure-type.md b/mdop/appv-v4/configure-type.md
index e34180c292..42307e58cb 100644
--- a/mdop/appv-v4/configure-type.md
+++ b/mdop/appv-v4/configure-type.md
@@ -1,12 +1,15 @@
 ---
 title: CONFIGURE TYPE
 description: CONFIGURE TYPE
-author: jamiejdt
+author: dansimp
 ms.assetid: 2caf9433-5449-486f-ab94-83ee8e44d7f1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md b/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md
index 14c0fbbbb5..1fe3f100c5 100644
--- a/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md
+++ b/mdop/appv-v4/configuring-app-v-administration-for-a-distributed-environment.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring App-V Administration for a Distributed Environment
 description: Configuring App-V Administration for a Distributed Environment
-author: jamiejdt
+author: dansimp
 ms.assetid: 53971fa9-8319-435c-be74-c37feb9af1da
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/appv-v4/configuring-app-v-for-secure-administration.md b/mdop/appv-v4/configuring-app-v-for-secure-administration.md
index 5ad39eb778..a71fffa3c7 100644
--- a/mdop/appv-v4/configuring-app-v-for-secure-administration.md
+++ b/mdop/appv-v4/configuring-app-v-for-secure-administration.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring App-V for Secure Administration
 description: Configuring App-V for Secure Administration
-author: jamiejdt
+author: dansimp
 ms.assetid: 4543fa81-c8cc-4b10-83b7-060778eb1349
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md b/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md
index 2c84bfdbb1..fe8ec7d8bc 100644
--- a/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md
+++ b/mdop/appv-v4/configuring-certificates-to-support-app-v-management-server-or-streaming-server.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring Certificates to Support App-V Management Server or Streaming Server
 description: Configuring Certificates to Support App-V Management Server or Streaming Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 2f24e550-585e-4b7e-b486-22a3f181f543
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,12 +22,12 @@ After you complete the certificate provisioning process and change the private k
 **Note**  
 Select the certificate that was configured for App-V if there is more than one certificate provisioned for this server.
 
- 
+ 
 
 **Important**  
 When upgrading from version  4.2 to version  4.5, the setup has an option for **Use enhanced security**; however, selecting this option will not disable streaming over RTSP. You must use the Management Console to disable RTSP after installation.
 
- 
+ 
 
 Select the TCP port that the service will use for client communications. The default port is TCP 322; however, you can change the port to a custom port for your environment.
 
@@ -48,9 +51,9 @@ For more detailed information about configuring certificates with the SAN attrib
 
 [How to Modify Private Key Permissions to Support Management Server or Streaming Server](how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md b/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md
index 23bd3bfc8a..86f2485e5c 100644
--- a/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md
+++ b/mdop/appv-v4/configuring-certificates-to-support-secure-streaming.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring Certificates to Support Secure Streaming
 description: Configuring Certificates to Support Secure Streaming
-author: jamiejdt
+author: dansimp
 ms.assetid: 88dc76d8-7745-4729-92a1-af089c921244
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -32,7 +35,7 @@ The scenarios for obtaining and installing a certificate for App-V are as follow
     **Note**  
     If you need to obtain a certificate from a third-party CA, follow the documentation available on that CA’s Web site.
 
-     
+     
 
 If a PKI infrastructure has been deployed, consult with the PKI administrators to acquire a certificate that complies with the requirements described in this topic. If a PKI infrastructure is not available, use a third-party CA to obtain a valid certificate.
 
@@ -44,9 +47,9 @@ For step-by-step guidance for obtaining and installing a certificate, see .
 
@@ -38,9 +41,9 @@ App-V can use IIS servers to support different infrastructure configurations. Fo
 
 [How to Install and Configure the App-V Management Console for a More Secure Environment](how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/configuring-iis-for-secure-streaming.md b/mdop/appv-v4/configuring-iis-for-secure-streaming.md
index 66d9ad8a10..1e5c0be5b8 100644
--- a/mdop/appv-v4/configuring-iis-for-secure-streaming.md
+++ b/mdop/appv-v4/configuring-iis-for-secure-streaming.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring IIS for Secure Streaming
 description: Configuring IIS for Secure Streaming
-author: jamiejdt
+author: dansimp
 ms.assetid: 9a80a703-4642-4bec-b7af-dc7cb6b76925
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -23,7 +26,7 @@ If you want to stream applications from a file server, you should enhance the se
 
 -   For Windows Server 2008, 
 
- 
+ 
 
 ## MIME Types
 
@@ -52,9 +55,9 @@ To create an SPN, run `setspn.exe` from a command prompt while logged in as a me
 
 [Configuring Management or Streaming Server for Secure Communications Post-Installation](configuring-management-or-streaming-server-for-secure-communications-post-installation.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md b/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md
index 8f240e413a..022b096208 100644
--- a/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md
+++ b/mdop/appv-v4/configuring-management-or-streaming-server-for-secure-communications-post-installation.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring Management or Streaming Server for Secure Communications Post-Installation
 description: Configuring Management or Streaming Server for Secure Communications Post-Installation
-author: jamiejdt
+author: dansimp
 ms.assetid: 1062a213-470b-4ae2-b12f-b3e28a6ab745
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md b/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md
index f4062089e9..92700f1f2a 100644
--- a/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md
+++ b/mdop/appv-v4/configuring-prerequisite-groups-in-active-directory-for-app-v.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring Prerequisite Groups in Active Directory for App-V
 description: Configuring Prerequisite Groups in Active Directory for App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 0010d534-46c0-44a3-b5c1-621b4d5e2c31
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md b/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md
index 6be2a4fd15..f8ec256bdd 100644
--- a/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md
+++ b/mdop/appv-v4/configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring the Application Virtualization Sequencer (App-V 4.6 SP1)
 description: Configuring the Application Virtualization Sequencer (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: af775165-5b99-4c74-807f-f504377c7be4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md b/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md
index 46e15e58c0..571b263abc 100644
--- a/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md
+++ b/mdop/appv-v4/configuring-the-application-virtualization-sequencer.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring the Application Virtualization Sequencer
 description: Configuring the Application Virtualization Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: cae1c368-9fcd-454e-8fc9-0893345d55bf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md b/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md
index cf6febb6b0..688c137ae2 100644
--- a/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md
+++ b/mdop/appv-v4/configuring-the-firewall-for-the-app-v-servers.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring the Firewall for the App-V Servers
 description: Configuring the Firewall for the App-V Servers
-author: jamiejdt
+author: dansimp
 ms.assetid: f779c450-6c6f-46a8-ac66-5e82e0689d55
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/configuring-windows-firewall-for-app-v.md b/mdop/appv-v4/configuring-windows-firewall-for-app-v.md
index c924bf037c..f97d412295 100644
--- a/mdop/appv-v4/configuring-windows-firewall-for-app-v.md
+++ b/mdop/appv-v4/configuring-windows-firewall-for-app-v.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring Windows Firewall for App-V
 description: Configuring Windows Firewall for App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 6b5e253c-473f-4afc-a48b-631eda11d9ca
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md b/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md
index 8269ad2d41..11cb5f957c 100644
--- a/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md
+++ b/mdop/appv-v4/create-new-package-wizard---appv-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Create New Package Wizard (AppV 4.6 SP1)
 description: Create New Package Wizard (AppV 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 1f73d044-b364-4c95-8ae1-daedd316d87e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/create-package-accelerator--review-errors--page.md b/mdop/appv-v4/create-package-accelerator--review-errors--page.md
index c6b375dd72..63cdf9f7e1 100644
--- a/mdop/appv-v4/create-package-accelerator--review-errors--page.md
+++ b/mdop/appv-v4/create-package-accelerator--review-errors--page.md
@@ -1,12 +1,15 @@
 ---
 title: Create Package Accelerator (Review Errors) Page
 description: Create Package Accelerator (Review Errors) Page
-author: jamiejdt
+author: dansimp
 ms.assetid: ea3f531d-1887-4b42-a30f-b875d0ccb916
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/create-package-accelerator-page.md b/mdop/appv-v4/create-package-accelerator-page.md
index 0c3e1694ed..2d86172bf5 100644
--- a/mdop/appv-v4/create-package-accelerator-page.md
+++ b/mdop/appv-v4/create-package-accelerator-page.md
@@ -1,12 +1,15 @@
 ---
 title: Create Package Accelerator Page
 description: Create Package Accelerator Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 51cdc262-beda-4a4f-bb3e-66458062a7bd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md b/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md
index 801d0695c8..65aba0176a 100644
--- a/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md
+++ b/mdop/appv-v4/create-package-accelerator-wizard--appv-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Create Package Accelerator Wizard (AppV 4.6 SP1)
 description: Create Package Accelerator Wizard (AppV 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 976d84e1-86d7-4a9b-a747-2b6eef790c1f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/create-package-page--app-v-46-sp1.md b/mdop/appv-v4/create-package-page--app-v-46-sp1.md
index bfedd7a691..cfd5f7b2fc 100644
--- a/mdop/appv-v4/create-package-page--app-v-46-sp1.md
+++ b/mdop/appv-v4/create-package-page--app-v-46-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: Create Package Page
 description: Create Package Page
-author: jamiejdt
+author: dansimp
 ms.assetid: dd7a8709-74cc-459a-88ac-b63d8dcf2ddf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,16 +33,16 @@ Select the **Compress Package** check box to compress the package, which can hel
 **Note**  
 If the original package size is more than 4 GB and compressed, by default, the checkbox is checked and cannot be changed. If the original package is compressed and less than 4 GB, the check box is checked, but can be cleared.
 
- 
+ 
 
 ## Related topics
 
 
 [Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)](sequencer-wizard---package-accelerator--appv-46-sp1-.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/customize-page--learn-more-.md b/mdop/appv-v4/customize-page--learn-more-.md
index 1508aeed0f..0bed35f090 100644
--- a/mdop/appv-v4/customize-page--learn-more-.md
+++ b/mdop/appv-v4/customize-page--learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Customize Page (Learn More)
 description: Customize Page (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: 893df614-7058-4fcf-ba34-d0f16c856374
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md
index c5fdc8f79d..a4d6ce5126 100644
--- a/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md
+++ b/mdop/appv-v4/defender-running-dialog-box--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Defender Running Dialog Box (App-V 4.6 SP1)
 description: Defender Running Dialog Box (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 716ec7f9-ddad-45dd-a3c7-4a9d81cfcfd0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md
index 0108c3332a..0fc1fd41be 100644
--- a/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md
+++ b/mdop/appv-v4/defrag-running-dialog-box--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Defrag Running Dialog Box (App-V 4.6 SP1)
 description: Defrag Running Dialog Box (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 0ceb0897-377e-4754-a7ab-3bc2b5af1452
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/delete-app.md b/mdop/appv-v4/delete-app.md
index d27d4e5405..a5a5189fe4 100644
--- a/mdop/appv-v4/delete-app.md
+++ b/mdop/appv-v4/delete-app.md
@@ -1,12 +1,15 @@
 ---
 title: DELETE APP
 description: DELETE APP
-author: jamiejdt
+author: dansimp
 ms.assetid: 2f89c0c0-373b-4389-a26d-67b3f9712957
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/delete-obj.md b/mdop/appv-v4/delete-obj.md
index 5e6f873001..e0e1085ae9 100644
--- a/mdop/appv-v4/delete-obj.md
+++ b/mdop/appv-v4/delete-obj.md
@@ -1,12 +1,15 @@
 ---
 title: DELETE OBJ
 description: DELETE OBJ
-author: jamiejdt
+author: dansimp
 ms.assetid: fb17a261-f378-4ce6-a538-ab2f0ada0f2d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/delete-package.md b/mdop/appv-v4/delete-package.md
index 496134edc0..f89b69d461 100644
--- a/mdop/appv-v4/delete-package.md
+++ b/mdop/appv-v4/delete-package.md
@@ -1,12 +1,15 @@
 ---
 title: DELETE PACKAGE
 description: DELETE PACKAGE
-author: jamiejdt
+author: dansimp
 ms.assetid: 8f7a4598-610d-490e-a224-426acce01a9f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,7 +19,7 @@ ms.date: 06/16/2016
 
 Removes a package record and the applications associated with it.
 
-` SFTMIME DELETE PACKAGE:package-name                 [/LOG log-pathname | /CONSOLE | /GUI]`
+`SFTMIME DELETE PACKAGE:package-name                 [/LOG log-pathname | /CONSOLE | /GUI]`
 
 @@ -49,7 +52,7 @@ Removes a package record and the applications associated with it.
 
          
 

 
          
 
- 
+ 
 
 For version 4.6, the following option has been added.
 
@@ -66,23 +69,23 @@ For version 4.6, the following option has been added.
 
 
 
- 
+ 
 
 **Important**  
 The DELETE PACKAGE command always performs a global delete of the package and deletes only global file types and shortcuts.
 
 If the package is global, this command must be run as local Administrator; otherwise, only **DeleteApp** permission is needed.
 
- 
+ 
 
 ## Related topics
 
 
 [SFTMIME Command Reference](sftmime--command-reference.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/delete-server.md b/mdop/appv-v4/delete-server.md
index 95bc74d1d3..7425b0751b 100644
--- a/mdop/appv-v4/delete-server.md
+++ b/mdop/appv-v4/delete-server.md
@@ -1,12 +1,15 @@
 ---
 title: DELETE SERVER
 description: DELETE SERVER
-author: jamiejdt
+author: dansimp
 ms.assetid: 4c929639-1c1d-47c3-9225-cc4d7a8736f0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Removes a publishing server.
 **Note**  
 This command does not remove any applications or packages published to the client by the server. For each application, use the SFTMIME **CLEAR APP** command followed by the **DELETE PACKAGE** command to completely remove those applications and packages from the client.
 
- 
+ 
 
 `SFTMIME DELETE SERVER:server-name [/LOG log-pathname | /CONSOLE | /GUI]`
 
@@ -54,7 +57,7 @@ This command does not remove any applications or packages published to the clien
 
 
 
- 
+ 
 
 For version 4.6, the following option has been added.
 
@@ -71,16 +74,16 @@ For version 4.6, the following option has been added.
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [SFTMIME Command Reference](sftmime--command-reference.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/delete-type.md b/mdop/appv-v4/delete-type.md
index 9860c735c8..62cbd9b1c7 100644
--- a/mdop/appv-v4/delete-type.md
+++ b/mdop/appv-v4/delete-type.md
@@ -1,12 +1,15 @@
 ---
 title: DELETE TYPE
 description: DELETE TYPE
-author: jamiejdt
+author: dansimp
 ms.assetid: f2852723-c894-49f3-a3c5-56f9648bb9ca
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/deployment-tab.md b/mdop/appv-v4/deployment-tab.md
index db39ed078a..0b872aa0ce 100644
--- a/mdop/appv-v4/deployment-tab.md
+++ b/mdop/appv-v4/deployment-tab.md
@@ -1,12 +1,15 @@
 ---
 title: Deployment Tab
 description: Deployment Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 4510188b-eade-445d-a90f-b9127dd479a7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/determine-your-publishing-method.md b/mdop/appv-v4/determine-your-publishing-method.md
index dc50b8dd81..683549aa16 100644
--- a/mdop/appv-v4/determine-your-publishing-method.md
+++ b/mdop/appv-v4/determine-your-publishing-method.md
@@ -1,12 +1,15 @@
 ---
 title: Determine Your Publishing Method
 description: Determine Your Publishing Method
-author: jamiejdt
+author: dansimp
 ms.assetid: 1f2d0d39-5d65-457a-b826-4f45b00c8c85
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/determine-your-streaming-method.md b/mdop/appv-v4/determine-your-streaming-method.md
index 63985a43f9..0033aa3003 100644
--- a/mdop/appv-v4/determine-your-streaming-method.md
+++ b/mdop/appv-v4/determine-your-streaming-method.md
@@ -1,12 +1,15 @@
 ---
 title: Determine Your Streaming Method
 description: Determine Your Streaming Method
-author: jamiejdt
+author: dansimp
 ms.assetid: 50d5e0ec-7f48-4cea-8711-5882bd89153b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,14 +22,14 @@ The first time that a user double-clicks the icon that has been placed on a comp
 **Note**  
 *Streaming* is the term used to describe the process of obtaining content from a sequenced application package, starting with the primary feature block and then obtaining additional blocks as needed.
 
- 
+ 
 
-The streaming source location is usually a server that is accessible by the user’s computer; however, some electronic distribution systems, such as Microsoft System Center Configuration Manager, can distribute the SFT file to the user’s computer and then stream the virtual application package locally from that computer’s cache.
+The streaming source location is usually a server that is accessible by the user’s computer; however, some electronic distribution systems, such as Microsoft Endpoint Configuration Manager, can distribute the SFT file to the user’s computer and then stream the virtual application package locally from that computer’s cache.
 
 **Note**  
 A streaming source location for virtual packages can be set up on a computer that is not a server. This is especially useful in a small branch office that has no server.
 
- 
+ 
 
 The streaming sources that can be used to store sequenced applications are described in the following table.
 
@@ -57,7 +60,7 @@ The streaming sources that can be used to store sequenced applications are descr
 
            
 
          • No active upgrade
            • 
 
          
-
          [How to Configure the File Server](how-to-configure-the-file-server.md)
          
+
          How to Configure the File Server
          
 
 
 
          IIS server
          
@@ -73,7 +76,7 @@ The streaming sources that can be used to store sequenced applications are descr
 
        • Need to manage IIS
          • 
 
        • No active upgrade
          • 
 
        
-
        [How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md)
        
+
        How to Configure the Server for IIS
        
 
 
 
        Application Virtualization Streaming Server
        
@@ -87,12 +90,12 @@ The streaming sources that can be used to store sequenced applications are descr
 
      • Dual infrastructure
        • 
 
      • Server administration requirement
        • 
 
      
-
      [How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md)
      
+
      How to Configure the Application Virtualization Management Servers
      
 
 
 
 
- 
+ 
 
 ## Related topics
 
@@ -103,9 +106,9 @@ The streaming sources that can be used to store sequenced applications are descr
 
 [Determine Your Publishing Method](determine-your-publishing-method.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md b/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md
index c50d2a2d12..a61b7c716f 100644
--- a/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md
+++ b/mdop/appv-v4/dialog-boxes--appv-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Dialog Boxes (AppV 4.6 SP1)
 description: Dialog Boxes (AppV 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: f76b95df-cba4-4a69-8cd8-a888edf437be
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/disconnected-operation-mode.md b/mdop/appv-v4/disconnected-operation-mode.md
index 51e1c11782..b123b249f9 100644
--- a/mdop/appv-v4/disconnected-operation-mode.md
+++ b/mdop/appv-v4/disconnected-operation-mode.md
@@ -1,12 +1,15 @@
 ---
 title: Disconnected Operation Mode
 description: Disconnected Operation Mode
-author: jamiejdt
+author: dansimp
 ms.assetid: 3f9849ea-ba53-4c68-85d3-87a4218f59c6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md b/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md
index 79f7b7f8e8..7abf4bd3a7 100644
--- a/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md
+++ b/mdop/appv-v4/domain-joined-and-non-domain-joined-clients.md
@@ -1,12 +1,15 @@
 ---
 title: Domain-Joined and Non-Domain-Joined Clients
 description: Domain-Joined and Non-Domain-Joined Clients
-author: jamiejdt
+author: dansimp
 ms.assetid: a935dc98-de60-45f3-ab74-2444ce082e88
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/edit-shortcuts-learn-more.md b/mdop/appv-v4/edit-shortcuts-learn-more.md
index 382b004494..830abacbd3 100644
--- a/mdop/appv-v4/edit-shortcuts-learn-more.md
+++ b/mdop/appv-v4/edit-shortcuts-learn-more.md
@@ -1,12 +1,15 @@
 ---
 title: Edit Shortcuts
 description: Edit Shortcuts
-author: jamiejdt
+author: dansimp
 ms.assetid: a0ca75aa-1059-4d0c-894c-2e3474e9f519
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md b/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md
index 4108d81f97..ebdfacc6c9 100644
--- a/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md
+++ b/mdop/appv-v4/electronic-software-distribution-based-scenario-overview.md
@@ -1,12 +1,15 @@
 ---
 title: Electronic Software Distribution-Based Scenario Overview
 description: Electronic Software Distribution-Based Scenario Overview
-author: jamiejdt
+author: dansimp
 ms.assetid: e9e94b8a-6cba-4de8-9b57-73897796b6a0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -17,9 +20,9 @@ ms.date: 08/30/2016
 If you plan to use an electronic software distribution (ESD) solution to deploy virtual applications, it is important to understand the factors that go into and are affected by that decision. This topic describes the benefits of using an ESD-based scenario and provides information about the publishing and package streaming methods that you will need to consider as you proceed with your deployment.
 
 **Important**  
-Whichever ESD solution you use, you must be familiar with the requirements of your particular solution. If you are using System Center Configuration Manager 2007 R2 or later, see the System Center Configuration Manager documentation at .
+Whichever ESD solution you use, you must be familiar with the requirements of your particular solution. If you are using Microsoft Endpoint Configuration Manager, see the Configuration Manager documentation at .
 
- 
+ 
 
 Using an existing ESD system provides you with the following benefits:
 
@@ -72,9 +75,9 @@ For more detailed information about the preceding streaming methods, see [Determ
 
 [SFTMIME Command Reference](sftmime--command-reference.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/electronic-software-distribution-based-scenario.md b/mdop/appv-v4/electronic-software-distribution-based-scenario.md
index 2c0d7af12a..d99c4ce90f 100644
--- a/mdop/appv-v4/electronic-software-distribution-based-scenario.md
+++ b/mdop/appv-v4/electronic-software-distribution-based-scenario.md
@@ -1,12 +1,15 @@
 ---
 title: Electronic Software Distribution-Based Scenario
 description: Electronic Software Distribution-Based Scenario
-author: jamiejdt
+author: dansimp
 ms.assetid: 18be0f8d-60ee-449b-aa83-93c86d1a908e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/exclusion-item-dialog-box.md b/mdop/appv-v4/exclusion-item-dialog-box.md
index fe34166204..250a430862 100644
--- a/mdop/appv-v4/exclusion-item-dialog-box.md
+++ b/mdop/appv-v4/exclusion-item-dialog-box.md
@@ -1,12 +1,15 @@
 ---
 title: Exclusion Item Dialog Box
 description: Exclusion Item Dialog Box
-author: jamiejdt
+author: dansimp
 ms.assetid: 5523c6d4-95f2-47af-8c06-3ab18004a207
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Use the **Exclusion Item** dialog box to assign or change a mapping rule and to
 **Important**  
 Adding files from an excluded directory to the virtual files system is not supported.
 
- 
+ 
 
 **Exclude Path**  
 Use to specify variable name that the Application Virtualization Sequencer will exclude if encountered while parsing virtual file system items or virtual registry items.
@@ -38,9 +41,9 @@ Use to select the mapping rules the Application Virtualization Sequencer will ap
 
 [Sequencer Dialog Boxes](sequencer-dialog-boxes.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/exclusion-items-tab-keep.md b/mdop/appv-v4/exclusion-items-tab-keep.md
index 56879bea8e..e4dcff97c2 100644
--- a/mdop/appv-v4/exclusion-items-tab-keep.md
+++ b/mdop/appv-v4/exclusion-items-tab-keep.md
@@ -1,12 +1,15 @@
 ---
 title: Exclusion Items Tab
 description: Exclusion Items Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 864e46dd-3d6e-4a1b-acf4-9dc00548117e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md
index f4742c44c0..a08aea1e5d 100644
--- a/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md
+++ b/mdop/appv-v4/failed-launch-dialog-box--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Failed Launch Dialog Box (App-V 4.6 SP1)
 description: Failed Launch Dialog Box (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 55669552-51b4-48aa-8bd0-6d78c2c930d9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/file-type-association-results-pane-columns.md b/mdop/appv-v4/file-type-association-results-pane-columns.md
index c4e314081c..1cdc78f1cc 100644
--- a/mdop/appv-v4/file-type-association-results-pane-columns.md
+++ b/mdop/appv-v4/file-type-association-results-pane-columns.md
@@ -1,12 +1,15 @@
 ---
 title: File Type Association Results Pane Columns
 description: File Type Association Results Pane Columns
-author: jamiejdt
+author: dansimp
 ms.assetid: eab48e20-9c92-459d-a06b-8e20202d73f6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ In the Application Virtualization Client Management Console, the **Results** pan
 **Note**  
 You can add or remove a column simply by right-clicking in the **Results** pane, selecting **View**, then selecting **Add/Remove Columns**.
 
- 
+ 
 
 The list can be sorted by any of the columns. Columns that contain dates and times are sorted in chronological order, not alphabetical. For columns that contain a mix of dates and times and text, dates and times are considered to come before any other text.
 
@@ -83,9 +86,9 @@ The perceived type or blank.
 
 [File Type Association Results Pane](file-type-association-results-pane.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/file-type-association-results-pane.md b/mdop/appv-v4/file-type-association-results-pane.md
index 2e1db0ce38..3b6a32eb71 100644
--- a/mdop/appv-v4/file-type-association-results-pane.md
+++ b/mdop/appv-v4/file-type-association-results-pane.md
@@ -1,12 +1,15 @@
 ---
 title: File Type Association Results Pane
 description: File Type Association Results Pane
-author: jamiejdt
+author: dansimp
 ms.assetid: bc5ceb48-1b9f-45d9-a770-1bac90629c76
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/file-type-associations-node-client.md b/mdop/appv-v4/file-type-associations-node-client.md
index 9a8a1185b9..4182a0dbbf 100644
--- a/mdop/appv-v4/file-type-associations-node-client.md
+++ b/mdop/appv-v4/file-type-associations-node-client.md
@@ -1,12 +1,15 @@
 ---
 title: File Type Associations Node
 description: File Type Associations Node
-author: jamiejdt
+author: dansimp
 ms.assetid: 48e4d9eb-00bd-4231-a68a-f8597ab683ff
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/file-type-associations-node.md b/mdop/appv-v4/file-type-associations-node.md
index 696509629f..f739cf0208 100644
--- a/mdop/appv-v4/file-type-associations-node.md
+++ b/mdop/appv-v4/file-type-associations-node.md
@@ -1,12 +1,15 @@
 ---
 title: File Type Associations Node
 description: File Type Associations Node
-author: jamiejdt
+author: dansimp
 ms.assetid: a3f35562-32d0-4a43-8604-3a54189ade92
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/file-type-associations-results-pane-columns.md b/mdop/appv-v4/file-type-associations-results-pane-columns.md
index 79041c1d6f..1458316d50 100644
--- a/mdop/appv-v4/file-type-associations-results-pane-columns.md
+++ b/mdop/appv-v4/file-type-associations-results-pane-columns.md
@@ -1,12 +1,15 @@
 ---
 title: File Type Associations Results Pane Columns
 description: File Type Associations Results Pane Columns
-author: jamiejdt
+author: dansimp
 ms.assetid: 8cbb63e4-f93b-4066-ba06-30103e6d0c3e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/file-type-associations-results-pane.md b/mdop/appv-v4/file-type-associations-results-pane.md
index e3a95c450f..b1f2badd96 100644
--- a/mdop/appv-v4/file-type-associations-results-pane.md
+++ b/mdop/appv-v4/file-type-associations-results-pane.md
@@ -1,12 +1,15 @@
 ---
 title: File Type Associations Results Pane
 description: File Type Associations Results Pane
-author: jamiejdt
+author: dansimp
 ms.assetid: 881d7fa7-ecde-4a05-b6ee-132fe2c09900
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md
index 8e5d68b4c7..c994c8d5e0 100644
--- a/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md
+++ b/mdop/appv-v4/files-excluded-page-dialog-box--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Files Excluded Page Dialog Box (App-V 4.6 SP1)
 description: Files Excluded Page Dialog Box (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 9718c7bf-7ed2-44d8-bdac-df013cd0d6c6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/files-tab-keep.md b/mdop/appv-v4/files-tab-keep.md
index 030112fc89..aaeebd7805 100644
--- a/mdop/appv-v4/files-tab-keep.md
+++ b/mdop/appv-v4/files-tab-keep.md
@@ -1,12 +1,15 @@
 ---
 title: Files Tab
 description: Files Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 14191e51-11a2-40ab-8855-3408a4bc5a9d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/g b/mdop/appv-v4/g
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/mdop/appv-v4/gathering-information-page--learn-more-.md b/mdop/appv-v4/gathering-information-page--learn-more-.md
index be82b01436..2fb6c6cc6f 100644
--- a/mdop/appv-v4/gathering-information-page--learn-more-.md
+++ b/mdop/appv-v4/gathering-information-page--learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Gathering Information Page (Learn More)
 description: Gathering Information Page (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: f8d5ec6b-a3d3-4e80-b1c2-3f8441b04aaa
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/general-tab-keep.md b/mdop/appv-v4/general-tab-keep.md
index cf23253bf5..58ae9340d1 100644
--- a/mdop/appv-v4/general-tab-keep.md
+++ b/mdop/appv-v4/general-tab-keep.md
@@ -1,12 +1,15 @@
 ---
 title: General Tab
 description: General Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: aeefae39-60cd-4ad4-9575-c07d7e2b1e59
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/guidance-page-app-v-46-sp1.md b/mdop/appv-v4/guidance-page-app-v-46-sp1.md
index 831df6d2e5..6af524a1e1 100644
--- a/mdop/appv-v4/guidance-page-app-v-46-sp1.md
+++ b/mdop/appv-v4/guidance-page-app-v-46-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: Guidance Page
 description: Guidance Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 2d461f7e-bde0-4f20-bfc1-46d52feb701e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/help.md b/mdop/appv-v4/help.md
index 5f4f495f73..1b14a81bf2 100644
--- a/mdop/appv-v4/help.md
+++ b/mdop/appv-v4/help.md
@@ -1,12 +1,15 @@
 ---
 title: HELP
 description: HELP
-author: jamiejdt
+author: dansimp
 ms.assetid: 0ddb5f18-0c0a-45ea-b7c7-2d4749e3d35d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-add-a-file-type-association.md b/mdop/appv-v4/how-to-add-a-file-type-association.md
index fbb18b2b33..bd5e1a7cb5 100644
--- a/mdop/appv-v4/how-to-add-a-file-type-association.md
+++ b/mdop/appv-v4/how-to-add-a-file-type-association.md
@@ -1,12 +1,15 @@
 ---
 title: How to Add a File Type Association
 description: How to Add a File Type Association
-author: jamiejdt
+author: dansimp
 ms.assetid: cccfbd00-51ba-4a60-a598-ee97f5ea1215
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md b/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md
index 7159d7873c..6b9c002b72 100644
--- a/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md
+++ b/mdop/appv-v4/how-to-add-a-package-by-using-the-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: How to Add a Package by Using the Command Line
 description: How to Add a Package by Using the Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: e75af49e-811a-407a-a7f0-6de8562b9188
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-add-a-package-version.md b/mdop/appv-v4/how-to-add-a-package-version.md
index e9f97dcad2..6a4b7c4372 100644
--- a/mdop/appv-v4/how-to-add-a-package-version.md
+++ b/mdop/appv-v4/how-to-add-a-package-version.md
@@ -1,12 +1,15 @@
 ---
 title: How to Add a Package Version
 description: How to Add a Package Version
-author: jamiejdt
+author: dansimp
 ms.assetid: dbb829c1-e5cb-4a2f-bc17-9a9bb50c671c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ In the Application Virtualization Server Management Console, when you resequence
 **Note**  
 When you upgrade a package with a new version, you can leave the existing version in place or delete it and leave only the newest one. You might want to leave the old version in place for compatibility with legacy documents or so that you can test the new version before making it available to all users.
 
- 
+ 
 
 **To add a package version**
 
@@ -44,9 +47,9 @@ When you upgrade a package with a new version, you can leave the existing versio
 
 [How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-add-a-package.md b/mdop/appv-v4/how-to-add-a-package.md
index 87aa513ecb..b9f409c2cb 100644
--- a/mdop/appv-v4/how-to-add-a-package.md
+++ b/mdop/appv-v4/how-to-add-a-package.md
@@ -1,12 +1,15 @@
 ---
 title: How to Add a Package
 description: How to Add a Package
-author: jamiejdt
+author: dansimp
 ms.assetid: 5407fdbe-e658-44f6-a9b8-a566b81dedce
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -35,7 +38,7 @@ It is recommended that you import applications instead of adding them manually.
 
     In dialog boxes that refer to Virtual Application Servers, you must use a network location, such as the server's static host name or IP address, that your users can access. The application's Open Software Descriptor (OSD) file can replace the placeholder variable *%SFT\_SOFTGRIDSERER%* with the server's static host name or IP address. If you leave the placeholder variable, you must set this variable on each client computer that will access that server. Set a User or System variable on each computer for SFT\_SOFTGRIDSERVER. The variable value must be the server's static host name or IP address. If you set a variable, exit the Client session, log out of and back into Microsoft Windows, and then restart the session on each computer that had a session running and had the variable set.
 
-     
+     
 
 4.  Click **Next**.
 
@@ -44,7 +47,7 @@ It is recommended that you import applications instead of adding them manually.
     **Note**  
     If you are managing applications on a remote server, in the next dialog box, type only the path of the file relative to the server's content root.
 
-     
+     
 
 ## Related topics
 
@@ -53,9 +56,9 @@ It is recommended that you import applications instead of adding them manually.
 
 [How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-add-a-server.md b/mdop/appv-v4/how-to-add-a-server.md
index 1e84d5f93d..0fb467e68f 100644
--- a/mdop/appv-v4/how-to-add-a-server.md
+++ b/mdop/appv-v4/how-to-add-a-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Add a Server
 description: How to Add a Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 1f31678a-8edf-4d35-a812-e4a2abfd979b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ To help you manage your Application Virtualization Management Servers more effic
 **Note**  
 All servers in a server group must be connected to the same data store.
 
- 
+ 
 
 **To add a server to a group**
 
@@ -48,9 +51,9 @@ All servers in a server group must be connected to the same data store.
 
 [How to Remove a Server](how-to-remove-a-server.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-add-an-administrator-group.md b/mdop/appv-v4/how-to-add-an-administrator-group.md
index 30e2284939..27067fbc52 100644
--- a/mdop/appv-v4/how-to-add-an-administrator-group.md
+++ b/mdop/appv-v4/how-to-add-an-administrator-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Add an Administrator Group
 description: How to Add an Administrator Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 2611f33e-6082-4269-b0ba-394174701492
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -25,14 +28,14 @@ From the **Administrators** node of the Application Virtualization Server Manage
     **Important**  
     When completing the **Select Groups** dialog box, you might see the **Multiple Names Found** dialog box, which can display multiple group names. To add more than one group at a time, press **Ctrl** and click the name of each group you want to add. Click **OK** to exit the **Multiple Names Found** dialog box.
 
-     
+     
 
 3.  Click **OK**.
 
     **Note**  
     To add administrator groups to the Application Virtualization Management Server, you must have system administrator or security administrator privileges on the associated data store. If you attempt to create a group without sufficient privileges, the system generates an error message.
 
-     
+     
 
 ## Related topics
 
@@ -41,9 +44,9 @@ From the **Administrators** node of the Application Virtualization Server Manage
 
 [How to Delete an Administrator Group](how-to-delete-an-administrator-group.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-add-an-application.md b/mdop/appv-v4/how-to-add-an-application.md
index ed990397b3..760c7f8540 100644
--- a/mdop/appv-v4/how-to-add-an-application.md
+++ b/mdop/appv-v4/how-to-add-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Add an Application
 description: How to Add an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 0147233d-f369-4796-8e34-fb1d894af732
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md b/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md
index c5ec733bae..2616fee08d 100644
--- a/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md
+++ b/mdop/appv-v4/how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1)
 description: How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: ca0bd514-2bbf-4130-8c77-98d991cbe016
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,77 +19,79 @@ ms.date: 06/16/2016
 
 You can use App-V Package Accelerators to automatically generate a new virtual application package. For more information about Package Accelerators, see [About App-V Package Accelerators (App-V 4.6 SP1)](about-app-v-package-accelerators--app-v-46-sp1-.md).
 
-**Important**  
+**Important**  
 Disclaimer: The Application Virtualization Sequencer does not give you any license rights to the software application you are using to create a Package Accelerator. You must abide by all end user license terms for such application. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using Application Virtualization Sequencer.
 
- 
 
-**Note**  
+
+**Note**  
 Before starting this procedure, copy the required Package Accelerator locally to the computer running the App-V Sequencer. You should also copy all required installation files for the package to a local directory on the computer running the Sequencer. This is the directory that you have to specify in step 5 of this procedure.
 
- 
+
 
 Use the following procedure to create a virtual application package by using a Package Accelerator.
 
 **To create a virtual application package by using an App-V Package Accelerator**
 
-1.  To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**.
+1. To start the App-V Sequencer, on the computer that is running the App-V Sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**.
 
-2.  To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select the **Create Package using a Package Accelerator** check box, and then click **Next**.
+2. To start the **Create New Package Wizard**, click **Create a New Virtual Application Package**. To create the package, select the **Create Package using a Package Accelerator** check box, and then click **Next**.
 
-3.  On the **Select Package Accelerator** page, to specify the Package Accelerator that will be used to create the new virtual application package, click **Browse** to locate the Package Accelerator that you want to use. Click **Next**.
+3. On the **Select Package Accelerator** page, to specify the Package Accelerator that will be used to create the new virtual application package, click **Browse** to locate the Package Accelerator that you want to use. Click **Next**.
 
-    **Important**  
-    If the publisher of the Package Accelerator cannot be verified and does not contain a valid digital signature, in the **Security Warning** dialog box, you must confirm that you trust the source of the Package Accelerator before you click **Run**.
+   **Important**  
+   If the publisher of the Package Accelerator cannot be verified and does not contain a valid digital signature, in the **Security Warning** dialog box, you must confirm that you trust the source of the Package Accelerator before you click **Run**.
 
-     
 
-4.  On the **Guidance** page, review the publishing guidance information displayed in the information pane. The information displayed was added when the Package Accelerator was created and contains information about creating and publishing the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**.
 
-5.  On the **Select Installation Files** page, to create a local folder that contains all required installation files for the package, click **Make New Folder** and specify where the folder should be saved. You must also specify a name to be assigned to the folder. You must then copy all required installation files to the location that you specified. If the folder that contains the installation files already exists on the computer running the Sequencer, click **Browse** to select the folder.
+4. On the **Guidance** page, review the publishing guidance information displayed in the information pane. The information displayed was added when the Package Accelerator was created and contains information about creating and publishing the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**.
 
-    Alternatively, if you have already copied the installation files to a directory on this computer, click **Make New Folder**, browse to the folder that contains the installation files, and then click **Next**.
+5. On the **Select Installation Files** page, to create a local folder that contains all required installation files for the package, click **Make New Folder** and specify where the folder should be saved. You must also specify a name to be assigned to the folder. You must then copy all required installation files to the location that you specified. If the folder that contains the installation files already exists on the computer running the Sequencer, click **Browse** to select the folder.
 
-    **Note**  
-    You can specify the following types of supported installation files:
+   Alternatively, if you have already copied the installation files to a directory on this computer, click **Make New Folder**, browse to the folder that contains the installation files, and then click **Next**.
 
-    -   Windows Installer files(**.msi**
+   **Note**  
+   You can specify the following types of supported installation files:
 
-    -   .cab files
+   -   Windows Installer files(**.msi**
 
-    -   Compressed files with a .zip file name extension
+   -   .cab files
 
-    -   The actual application files
+   -   Compressed files with a .zip file name extension
 
-    The following file types are not supported: **.msp** and**.exe** files. If you specify an **.exe** file you must extract the installation files manually.
+   -   The actual application files
 
-     
+   The following file types are not supported: **.msp** and.exe files. If you specify an **.exe** file you must extract the installation files manually.
 
-    If the Package Accelerator requires an application be installed prior to applying the Package Accelerator and you have installed the application, on the **Local Installation** page, select the check box **I have installed all applications**, and then click **Next**.
 
-6.  On the **Package Name** page, specify a name that will be associated with the package. The name specified identifies the package in the App-V Management Console. Click **Next**.
 
-7.  On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package you are creating. To confirm the location where the package is created, review the information displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB.
+~~~
+If the Package Accelerator requires an application be installed prior to applying the Package Accelerator and you have installed the application, on the **Local Installation** page, select the check box **I have installed all applications**, and then click **Next**.
+~~~
 
-    To create the package, click **Create**. After the package has been created, click **Next**.
+6. On the **Package Name** page, specify a name that will be associated with the package. The name specified identifies the package in the App-V Management Console. Click **Next**.
 
-8.  On the **Configure Software** page, to enable the Sequencer to configure the applications contained in the package, select **Configure Software**. This step is useful for configuring any associated tasks that must be completed to run the application on target computers, such as configuring any associated license agreements.
+7. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package you are creating. To confirm the location where the package is created, review the information displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB.
 
-    If you select **Configure Software**, the following items are configured by the Sequencer as part of this step:
+   To create the package, click **Create**. After the package has been created, click **Next**.
 
-    -   **Load Package**. The Sequencer loads the files associated with the package. It can take several seconds to up to an hour to decode the package.
+8. On the **Configure Software** page, to enable the Sequencer to configure the applications contained in the package, select **Configure Software**. This step is useful for configuring any associated tasks that must be completed to run the application on target computers, such as configuring any associated license agreements.
 
-    -   **Run Each Program**. Optionally run the programs contained in the package. This step is helpful for completing any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**.
+   If you select **Configure Software**, the following items are configured by the Sequencer as part of this step:
 
-    -   **Save Package**. The Sequencer saves the package.
+   -   **Load Package**. The Sequencer loads the files associated with the package. It can take several seconds to up to an hour to decode the package.
 
-    -   **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block.
+   -   **Run Each Program**. Optionally run the programs contained in the package. This step is helpful for completing any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**.
 
-    If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**.
+   -   **Save Package**. The Sequencer saves the package.
 
-9.  On the **Completion** page, after you have reviewed the information displayed in the **Virtual Application Package Report** pane, click **Close**.
+   -   **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block.
 
-    The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md).
+   If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**.
+
+9. On the **Completion** page, after you have reviewed the information displayed in the **Virtual Application Package Report** pane, click **Close**.
+
+   The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md).
 
 ## Related topics
 
@@ -95,9 +100,9 @@ Use the following procedure to create a virtual application package by using a P
 
 [How to Create App-V Package Accelerators (App-V 4.6 SP1)](how-to-create-app-v-package-accelerators--app-v-46-sp1-.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md b/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md
index 8dac52b922..ca8c706037 100644
--- a/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md
+++ b/mdop/appv-v4/how-to-apply-an-app-v-project-template--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Apply an App-V Project Template (App-V 4.6 SP1)
 description: How to Apply an App-V Project Template (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 8ef120ab-8cfb-438c-8136-671167b7bd9d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can use an App-V project template to apply common settings associated with a
 **Note**  
 You can only apply an App-V project template when you are creating a new virtual application package. Applying project templates to existing virtual application packages is not supported. Additionally, you cannot use a project template in conjunction with a Package Accelerator.
 
- 
+ 
 
 For more information about creating App-V project templates, see [How to Create an App-V Project Template (App-V 4.6 SP1)](how-to-create-an-app-v-project-template--app-v-46-sp1-.md).
 
@@ -40,9 +43,9 @@ For more information about creating App-V project templates, see [How to Create
 
 [How to Create an App-V Project Template (App-V 4.6 SP1)](how-to-create-an-app-v-project-template--app-v-46-sp1-.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md b/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md
index c4b1a96966..f24d17b75f 100644
--- a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md
+++ b/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-vista.md
@@ -1,12 +1,15 @@
 ---
 title: How to Assign the Proper Credentials for Windows Vista
 description: How to Assign the Proper Credentials for Windows Vista
-author: jamiejdt
+author: dansimp
 ms.assetid: cc11d2af-a350-4d16-ba7b-f9c1d89e14b4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Use the following procedure to configure the App-V Desktop Client for proper Win
 **Note**  
 This procedure must be completed on each non-domain joined computer. Depending on the number of non-domain joined computers in your environment, this could be a very tedious operation. You can use scripts and the command-line interface for Credential Manager to help administrators automate this process.
 
- 
+ 
 
 **To assign the proper credentials for App-V clients running Windows Vista**
 
@@ -48,9 +51,9 @@ This procedure must be completed on each non-domain joined computer. Depending o
 
 [How to Assign the Proper Credentials for Windows XP](how-to-assign--the-proper-credentials-for-windows-xp.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md b/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md
index 265cd4aac5..9e1d52e3fc 100644
--- a/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md
+++ b/mdop/appv-v4/how-to-assign--the-proper-credentials-for-windows-xp.md
@@ -1,12 +1,15 @@
 ---
 title: How to Assign the Proper Credentials for Windows XP
 description: How to Assign the Proper Credentials for Windows XP
-author: jamiejdt
+author: dansimp
 ms.assetid: cddbd556-d8f9-4981-a947-6e8e3f552b70
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Use the following procedure to configure the App-V Desktop Client for proper Win
 **Note**  
 After finishing this procedure, the non-domain joined client can perform a publishing refresh without being joined to a domain.
 
- 
+ 
 
 **To assign the proper credentials for App-V clients running Windows XP**
 
@@ -46,9 +49,9 @@ After finishing this procedure, the non-domain joined client can perform a publi
 
 [How to Assign the Proper Credentials for Windows Vista](how-to-assign--the-proper-credentials-for-windows-vista.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md b/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md
index 38d1cf7646..84d62ca579 100644
--- a/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md
+++ b/mdop/appv-v4/how-to-associate-an-application-with-a-license-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Associate an Application with a License Group
 description: How to Associate an Application with a License Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 85639db3-5751-497e-a9e7-ce4770c0b55f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can enforce licensing restrictions on an application by associating the appl
 **Important**  
 One or more application license groups must exist for you to associate an application with a license group.
 
- 
+ 
 
 **To associate an application with a license group**
 
@@ -32,9 +35,9 @@ One or more application license groups must exist for you to associate an applic
 4.  Click **OK**.
 
     **Note**  
-       You can alter the **Properties** tab of one application at a time.
+       You can alter the **Properties** tab of one application at a time.
 
-     
+     
 
 ## Related topics
 
@@ -45,9 +48,9 @@ One or more application license groups must exist for you to associate an applic
 
 [How to Manage Reports in the Server Management Console](how-to-manage-reports-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-branch-a-package.md b/mdop/appv-v4/how-to-branch-a-package.md
index d6c12f3572..9b2ab8c069 100644
--- a/mdop/appv-v4/how-to-branch-a-package.md
+++ b/mdop/appv-v4/how-to-branch-a-package.md
@@ -1,12 +1,15 @@
 ---
 title: How to Branch a Package
 description: How to Branch a Package
-author: jamiejdt
+author: dansimp
 ms.assetid: bfe46a8a-f0ee-4a71-9e9c-64ac08aac9c1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -26,23 +29,25 @@ Use the following procedure to branch a sequenced virtual application package.
 
 3.  To save a copy of the package, in the App-V Sequencer, select **File**, **Save As**. Specify a new, unique name, and specify a new unique package root directory for the copy of the package. Click **Save**.
 
-    **Important**  
+    **Important**  
     You must specify a new package name or you will overwrite the existing version of the package.
 
-     
 
-    The sequencer will automatically generate new GUID files for the new package. The version number associated with the package will also be automatically appended to the OSD file name.
 
-4.  After you save the new version you can apply the required configuration changes and save the associated ICO, OSD, SFT, and SPRJ files to correct location on the Application Virtualization (App-V) server.
+~~~
+The sequencer will automatically generate new GUID files for the new package. The version number associated with the package will also be automatically appended to the OSD file name.
+~~~
+
+4. After you save the new version you can apply the required configuration changes and save the associated ICO, OSD, SFT, and SPRJ files to correct location on the Application Virtualization (App-V) server.
 
 ## Related topics
 
 
 [Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md b/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md
index bd23fdf1d6..32dfc28858 100644
--- a/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md
+++ b/mdop/appv-v4/how-to-cancel-loading-of-virtual-applications-from-the-desktop-notification-area.md
@@ -1,12 +1,15 @@
 ---
 title: How to Cancel Loading of Virtual Applications from the Desktop Notification Area
 description: How to Cancel Loading of Virtual Applications from the Desktop Notification Area
-author: jamiejdt
+author: dansimp
 ms.assetid: 4420a091-a344-48e9-a354-93bc0e2470eb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-change-an-application-icon.md b/mdop/appv-v4/how-to-change-an-application-icon.md
index 02df9111cf..9e9dbf95b0 100644
--- a/mdop/appv-v4/how-to-change-an-application-icon.md
+++ b/mdop/appv-v4/how-to-change-an-application-icon.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change an Application Icon
 description: How to Change an Application Icon
-author: jamiejdt
+author: dansimp
 ms.assetid: bd6cfb22-086b-43fd-b6f9-1907b5f16e83
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-change-an-application-iconserver.md b/mdop/appv-v4/how-to-change-an-application-iconserver.md
index de7be67d3d..19445774d2 100644
--- a/mdop/appv-v4/how-to-change-an-application-iconserver.md
+++ b/mdop/appv-v4/how-to-change-an-application-iconserver.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change an Application Icon
 description: How to Change an Application Icon
-author: jamiejdt
+author: dansimp
 ms.assetid: 52c870eb-4a54-410b-8abf-79395a53f846
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-change-deployment-properties.md b/mdop/appv-v4/how-to-change-deployment-properties.md
index 5d7dd808c2..f9eb0b5d3f 100644
--- a/mdop/appv-v4/how-to-change-deployment-properties.md
+++ b/mdop/appv-v4/how-to-change-deployment-properties.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change Deployment Properties
 description: How to Change Deployment Properties
-author: jamiejdt
+author: dansimp
 ms.assetid: 0a214a7a-cc83-4d04-89f9-5727153be918
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-change-import-search-paths.md b/mdop/appv-v4/how-to-change-import-search-paths.md
index bf9168377b..fef1c273d9 100644
--- a/mdop/appv-v4/how-to-change-import-search-paths.md
+++ b/mdop/appv-v4/how-to-change-import-search-paths.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change Import Search Paths
 description: How to Change Import Search Paths
-author: jamiejdt
+author: dansimp
 ms.assetid: 0125f2bf-4958-4854-a5a4-a63afe5bb986
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-change-package-properties.md b/mdop/appv-v4/how-to-change-package-properties.md
index 6552231511..565e4c27e9 100644
--- a/mdop/appv-v4/how-to-change-package-properties.md
+++ b/mdop/appv-v4/how-to-change-package-properties.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change Package Properties
 description: How to Change Package Properties
-author: jamiejdt
+author: dansimp
 ms.assetid: 6050916a-d4fe-4dac-8f2a-47308dbbf481
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ If this is the first time the package has been created, you can also change the
 **Note**  
 When selecting a block size, consider the size of the SFT file and your network bandwidth. A file with a smaller block size takes longer to stream over the network, but it is less bandwidth intensive. Files with larger block sizes might stream faster, but they use more network bandwidth. Through experimentation, you can discover the optimum block size for streaming applications on your network.
 
- 
+ 
 
 The remainder of the package properties on the **Properties** tab is automatically generated and cannot be modified on this tab.
 
@@ -50,9 +53,9 @@ The remainder of the package properties on the **Properties** tab is automatical
 
 [Sequencer Console](sequencer-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md b/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md
index 9c1eebdb7c..0aed8a88e3 100644
--- a/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md
+++ b/mdop/appv-v4/how-to-change-the-cache-size-and-the-drive-letter-designation.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change the Cache Size and the Drive Letter Designation
 description: How to Change the Cache Size and the Drive Letter Designation
-author: jamiejdt
+author: dansimp
 ms.assetid: e7d7b635-079e-41aa-a5e6-655f33b4e317
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 You can change the cache size and drive letter designation directly from the **Application Virtualization** node in the Application Virtualization Client Management Console.
 
-**Note**  
+**Note**  
 After the cache size has been set, it cannot be made smaller.
 
- 
+
 
 **To change the cache size**
 
@@ -27,20 +30,22 @@ After the cache size has been set, it cannot be made smaller.
 
 2.  Select the **File System** tab on the **Properties** dialog box. In the **Client Cache Configuration Settings** section, click one of the following radio buttons to choose how to manage the cache space:
 
-    **Important**  
+    **Important**  
     If you select the **Use free disk space threshold** setting, the value you enter will set the cache size to the total disk size minus the free disk space threshold number you entered. If you then want revert to using the **Use maximum cache size** setting, you must specify a larger number than the existing cache size. Otherwise, the error “New size must be larger than the existing cache size” will appear.
 
-     
 
-    -   **Use maximum cache size**
 
-        Enter a numeric value from 100 to 1,048,576 (1 TB) in the **Maximum size (MB)** field to specify the maximum size of the cache. The value shown in **Reserved Cache Size** indicates the amount of cache in use.
+~~~
+-   **Use maximum cache size**
 
-    -   **Use free disk space threshold**
+    Enter a numeric value from 100 to 1,048,576 (1 TB) in the **Maximum size (MB)** field to specify the maximum size of the cache. The value shown in **Reserved Cache Size** indicates the amount of cache in use.
 
-        Enter a numeric value to specify the amount of free disk space, in MB, that the cache must leave available on the disk. This allows the cache to grow until the amount of free disk space reaches this limit. The value shown in **Free disk space remaining** indicates how much disk space is unused.
+-   **Use free disk space threshold**
 
-3.  Click **OK** or **Apply** to change the setting.
+    Enter a numeric value to specify the amount of free disk space, in MB, that the cache must leave available on the disk. This allows the cache to grow until the amount of free disk space reaches this limit. The value shown in **Free disk space remaining** indicates how much disk space is unused.
+~~~
+
+3. Click **OK** or **Apply** to change the setting.
 
 **To change the drive letter designation**
 
@@ -55,9 +60,9 @@ After the cache size has been set, it cannot be made smaller.
 
 [How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md b/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md
index 6f30faa888..4c3247ee57 100644
--- a/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md
+++ b/mdop/appv-v4/how-to-change-the-log-reporting-levels-and-reset-the-log-files.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change the Log Reporting Levels and Reset the Log Files
 description: How to Change the Log Reporting Levels and Reset the Log Files
-author: jamiejdt
+author: dansimp
 ms.assetid: 9561d6fb-b35c-491b-a355-000064583194
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -25,14 +28,14 @@ You can use the following procedure to change the log reporting level from the *
     **Note**  
     If you choose **Verbose** as the logging level, the log files will grow large very quickly. This might inhibit client performance, so best practice is to use this log level only for diagnosing specific problems.
 
-     
+     
 
 3.  On the **General** tab in the **Properties** dialog box, from the **System Log Level** drop-down list, select the desired log level.
 
     **Note**  
     The **System Log Level** setting controls the level of messages sent to the system event log. The logged messages are identical to the messages that get logged to the client event log, but they are stored in a different location.
 
-     
+     
 
 4.  Click **OK** or **Apply** to change the setting.
 
@@ -51,9 +54,9 @@ You can use the following procedure to change the log reporting level from the *
 
 [User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-change-the-server-cache-size.md b/mdop/appv-v4/how-to-change-the-server-cache-size.md
index 3687c7e7a6..5b61e12a03 100644
--- a/mdop/appv-v4/how-to-change-the-server-cache-size.md
+++ b/mdop/appv-v4/how-to-change-the-server-cache-size.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change the Server Cache Size
 description: How to Change the Server Cache Size
-author: jamiejdt
+author: dansimp
 ms.assetid: 24e63744-21c3-458e-b137-9592f4fe785c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can use the following procedure to change the cache size for any server dire
 **Note**  
 Although you can change the cache size, unless your configuration specifically requires you to change the size, it is recommended that you leave the cache size set to the default values.
 
- 
+ 
 
 **To change the server cache size**
 
@@ -44,9 +47,9 @@ Although you can change the cache size, unless your configuration specifically r
 
 [How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md b/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md
index 4dd2ea6d8e..baeeef43e1 100644
--- a/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md
+++ b/mdop/appv-v4/how-to-change-the-server-logging-level-and-the-database-parameters.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change the Server Logging Level and the Database Parameters
 description: How to Change the Server Logging Level and the Database Parameters
-author: jamiejdt
+author: dansimp
 ms.assetid: e3ebaee5-6c4c-4aa8-9766-c5aeb00f477a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -33,7 +36,7 @@ The following logging levels are available:
 **Note**  
 Because of the size of the log file produced when you use **Verbose** mode, the recommendation is that you do not run production servers with this level of logging set.
 
- 
+ 
 
 The database logging parameters determine the database driver type, access credentials, and location of the logging database.
 
@@ -100,7 +103,7 @@ The database logging parameters determine the database driver type, access crede
     
     
 
-     
+     
 
 **To change database log parameters**
 
@@ -129,9 +132,9 @@ The database logging parameters determine the database driver type, access crede
 
 [How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-change-the-server-port.md b/mdop/appv-v4/how-to-change-the-server-port.md
index 6f97e5a2aa..14d1933fb9 100644
--- a/mdop/appv-v4/how-to-change-the-server-port.md
+++ b/mdop/appv-v4/how-to-change-the-server-port.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change the Server Port
 description: How to Change the Server Port
-author: jamiejdt
+author: dansimp
 ms.assetid: 0b4a262c-4816-48d0-b7c6-e496bb0d7370
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -31,7 +34,7 @@ From the Application Virtualization Server Management Console, you can use the f
     **Note**  
     The port number can be any value between 1 and 65,535. The default values are 554 for RTSP and 322 for RTSPS.
 
-     
+     
 
 6.  Click **OK** to change the port number.
 
@@ -46,9 +49,9 @@ From the Application Virtualization Server Management Console, you can use the f
 
 [How to Manage Servers in the Server Management Console](how-to-manage-servers-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md b/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md
index c9aed501f1..db72c07843 100644
--- a/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md
+++ b/mdop/appv-v4/how-to-change-the-size-of-the-filesystem-cache.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change the Size of the FileSystem Cache
 description: How to Change the Size of the FileSystem Cache
-author: jamiejdt
+author: dansimp
 ms.assetid: 6ed17ba3-293b-4482-b3fa-31e5f606dad6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-change-user-access-permissions.md b/mdop/appv-v4/how-to-change-user-access-permissions.md
index 9e2f967104..e935af3cad 100644
--- a/mdop/appv-v4/how-to-change-user-access-permissions.md
+++ b/mdop/appv-v4/how-to-change-user-access-permissions.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change User Access Permissions
 description: How to Change User Access Permissions
-author: jamiejdt
+author: dansimp
 ms.assetid: 21b60cc7-5395-401e-a374-6ef0d58872b7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Use the following procedure to change user access permissions in the Application
 **Note**  
 Before changing users access permissions, ensure that any permissions changes are consistent with the organization's guidelines for granting user access.
 
- 
+ 
 
 **To change user access permissions**
 
@@ -36,9 +39,9 @@ Before changing users access permissions, ensure that any permissions changes ar
 
 [User Access Permissions in Application Virtualization Client](user-access-permissions-in-application-virtualization-client.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-clear-an-application.md b/mdop/appv-v4/how-to-clear-an-application.md
index f9ec60a5c1..2fba3e47a3 100644
--- a/mdop/appv-v4/how-to-clear-an-application.md
+++ b/mdop/appv-v4/how-to-clear-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Clear an Application
 description: How to Clear an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 247b8f40-531c-413e-a2e5-fc990ed0a51a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can clear an application from the console directly from the **Results** pane
 **Note**  
 When you clear an application from the console, you can no longer use that application. However, the application remains in cache and is still available to other users on the same system. After a publishing refresh, the cleared applications will again become available to you. If there are multiple applications in a package, the user's settings are not removed until all of the applications are cleared.
 
- 
+ 
 
 **To clear an application from the console**
 
@@ -27,9 +30,9 @@ When you clear an application from the console, you can no longer use that appli
 
 2.  At the confirmation prompt, click **Yes** to remove the application or click **No** to cancel the operation.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md b/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md
index eec4c7053e..0a694a6795 100644
--- a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md
+++ b/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--rds--sp1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure a Read-only Cache on the App-V Client (RDS)
 description: How to Configure a Read-only Cache on the App-V Client (RDS)
-author: jamiejdt
+author: dansimp
 ms.assetid: b6607fe2-6f92-4567-99f1-d8e3c8a591e0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -17,14 +20,14 @@ ms.date: 08/30/2016
 **Important**  
 You must be running App-V 4.6, SP1 to use this procedure.
 
- 
+ 
 
 You can deploy the App-V client by using a shared cache that is populated with all the applications required for all users. Then you configure the App-V Remote Desktop Services (RDS) Clients to use the same cache file. Users are granted access to specific applications by using the App-V publishing process. Because the cache is already preloaded with all applications, no streaming occurs when a user starts an application. However, the packages used to prepopulate the cache must be put on an App-V server that supports Real Time Streaming Protocol (RTSP) streaming and that grants access permissions to the App-V Clients. If you publish the applications by using an App-V Management Server, you can use it to provide this streaming function.
 
 **Note**  
 The details outlined in these procedures are intended as examples only. You might use different methods to complete the overall process.
 
- 
+ 
 
 ## Deploying the App-V Client in an RDS Scenario
 
@@ -44,77 +47,77 @@ These tasks require careful planning. We recommend that you prepare and document
 **Note**  
 Although you can publish the applications by using several different methods, the following procedures are based on your using an App-V Management Server for publishing.
 
- 
+ 
 
 **To configure the read-only cache for initial deployment**
 
-1.  Set up and configure an App-V Management Server to provide user authentication and publishing support.
+1. Set up and configure an App-V Management Server to provide user authentication and publishing support.
 
-2.  Populate the Content folder of this Management Server with all the application packages required for all users.
+2. Populate the Content folder of this Management Server with all the application packages required for all users.
 
-3.  Set up a staging computer that has the App-V Client installed. Log on to the staging computer by using an account that has access to all applications so that the complete set of applications are published to the computer, and then stream the applications to cache so that they are fully loaded.
+3. Set up a staging computer that has the App-V Client installed. Log on to the staging computer by using an account that has access to all applications so that the complete set of applications are published to the computer, and then stream the applications to cache so that they are fully loaded.
 
-    **Important**  
-    The staging computer must use the same operating system type and system architecture as those used by the VMs on which the App-V Client will run.
+   **Important**  
+   The staging computer must use the same operating system type and system architecture as those used by the VMs on which the App-V Client will run.
 
-     
+     
 
-4.  Restart the staging computer in safe mode to make sure that the drivers are not started, because this would lock the cache file.
+4. Restart the staging computer in safe mode to make sure that the drivers are not started, because this would lock the cache file.
 
-    **Note**  
-    Or, you can stop and disable the Application Virtualization service, and then restart the computer. After the file is copied, remember to enable and start the service again.
+   **Note**  
+   Or, you can stop and disable the Application Virtualization service, and then restart the computer. After the file is copied, remember to enable and start the service again.
 
-     
+     
 
-5.  Copy the Sftfs.fsd cache file to a SAN where all the RDS servers can access it, such as in a shared folder. Set the folder access permissions to Read-only for the group Everyone and to Full Control for administrators who will manage the cache file updates. The location of the cache file can be obtained from the registry AppFS\\FileName.
+5. Copy the Sftfs.fsd cache file to a SAN where all the RDS servers can access it, such as in a shared folder. Set the folder access permissions to Read-only for the group Everyone and to Full Control for administrators who will manage the cache file updates. The location of the cache file can be obtained from the registry AppFS\\FileName.
 
-    **Important**  
-    You must put the FSD file in a location that has the responsiveness and reliability equal to locally attached storage performance, for example, a SAN.
+   **Important**  
+   You must put the FSD file in a location that has the responsiveness and reliability equal to locally attached storage performance, for example, a SAN.
 
-     
+     
 
-6.  Install the App-V RDS Client on each RDS server, and then configure it to use the read-only cache by adding the following registry key values to the AppFS key on the client. The AppFS key is located at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\\]Microsoft\\SoftGrid\\4.5\\Client\\AppFS for 32-bit computers and at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS for 64-bit computers.
+6. Install the App-V RDS Client on each RDS server, and then configure it to use the read-only cache by adding the following registry key values to the AppFS key on the client. The AppFS key is located at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\\]Microsoft\\SoftGrid\\4.5\\Client\\AppFS for 32-bit computers and at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\Client\\AppFS for 64-bit computers.
 
-    
-    -    -    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
      





      KeyTypeValuePurpose
      FileName
      String
      path of FSD
      Specifies the path of the shared cache file, for example, \\RDSServername\Sharefolder\SFTFS.FSD (Required).
      ReadOnlyFSD
      DWORD
      1
      Configures the client to operate in Read-Only mode. This ensures that the client will not try to stream updates to the package cache. (Required)
      ErrorLogLocation
      String
      path of error log (.etl) file
      Entry used to specify the path of the error log. (Recommended. Use a local path such as C:\Logs\Sftfs.etl).
      
+   
+   +   +   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
      





      KeyTypeValuePurpose
      FileName
      String
      path of FSD
      Specifies the path of the shared cache file, for example, \RDSServername\Sharefolder\SFTFS.FSD (Required).
      ReadOnlyFSD
      DWORD
      1
      Configures the client to operate in Read-Only mode. This ensures that the client will not try to stream updates to the package cache. (Required)
      ErrorLogLocation
      String
      path of error log (.etl) file
      Entry used to specify the path of the error log. (Recommended. Use a local path such as C:\Logs\Sftfs.etl).
      
 
-     
+     
 
-7.  Configure each RDS server in the farm to use the publishing server and to use publishing update when users log on. As users log on to the RDS servers, a publishing update cycle occurs and publishes all the applications for which their account is authorized. These applications are run from the shared cache.
+7. Configure each RDS server in the farm to use the publishing server and to use publishing update when users log on. As users log on to the RDS servers, a publishing update cycle occurs and publishes all the applications for which their account is authorized. These applications are run from the shared cache.
 
 **To configure the RDS client for package upgrade**
 
@@ -127,7 +130,7 @@ Although you can publish the applications by using several different methods, th
     **Note**  
     Or, you can first stop and then disable the Application Virtualization service in the Services.msc, and restart the computer. After the file has been copied, remember to enable and start the service again.
 
-     
+     
 
 4.  Copy the Sftfs.fsd cache file to a SAN where all the RDS servers can access it, such as in a shared folder. You can use a different file name, for example, SFTFS\_V2.FSD, to distinguish the new version.
 
@@ -136,7 +139,7 @@ Although you can publish the applications by using several different methods, th
     **Important**  
     You must restart the RDS servers in order to use the updated shared cache file.
 
-     
+     
 
 ## How to Use Symbolic Links when Upgrading the Cache
 
@@ -153,12 +156,12 @@ Instead of changing the AppFS key FILENAME value every time that a new cache fil
 
 3.  On the VDI Master VM Image, open a Command Prompt window by using the **Run as administrator** option and grant remote link permissions so that the VM can access the symbolic link on the VDI Host operating system. By default, remote link permissions are disabled.
 
-    **     fsutil behavior set SymlinkEvaluation R2R:1**
+    **fsutil behavior set SymlinkEvaluation R2R:1**
 
     **Note**  
     On the storage server, appropriate link permissions must be enabled. Depending on the location of link and the Sftfs.fsd file, the permissions are **L2L:1** or **L2R:1** or **R2L:1** or **R2R:1**.
 
-     
+     
 
 4.  When you configure the App-V RDS Client, set the AppFS key FILENAME value equal to the UNC path of the FSD file that is using the symbolic link. For example, set the file name to \\\\VDIHostserver\\Symlinkname. When the App-V client first accesses the cache, the symbolic link passes to the client a handle to the cache file. The client continues to use that handle as long as the client is running. The value of the symbolic link can safely be updated even if existing clients have the old shared cache open.
 
@@ -173,9 +176,9 @@ Instead of changing the AppFS key FILENAME value every time that a new cache fil
 
 [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md b/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md
index 7a26ca6403..8fd997eafd 100644
--- a/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md
+++ b/mdop/appv-v4/how-to-configure-a-read-only-cache-on-the-app-v-client--vdi-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure a Read-only Cache on the App-V Client (VDI)
 description: How to Configure a Read-only Cache on the App-V Client (VDI)
-author: jamiejdt
+author: dansimp
 ms.assetid: 7a41e017-9e23-4a6a-a659-04d23f008b83
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ In Microsoft Application Virtualization (App-V) 4.6 the Client supports using a
 **Note**  
 The details outlined in these procedures are intended as examples only. You might use different methods to complete the overall process.
 
- 
+ 
 
 ## Deploying the App-V Client in a VDI Scenario
 
@@ -41,77 +44,77 @@ These tasks require careful planning. We recommend that you prepare and document
 **Note**  
 Although you can publish the applications by using several different methods, the following procedures are based on the use of an App-V Management Server for publishing.
 
- 
+ 
 
 **To configure the read-only cache for initial deployment in a Pooled VM VDI or Static VM VDI scenario**
 
-1.  Set up and configure an App-V Management Server in a VM on the VDI server to provide user authentication and publishing support.
+1. Set up and configure an App-V Management Server in a VM on the VDI server to provide user authentication and publishing support.
 
-2.  Populate the Content folder of this Management Server with all the application packages required for all users.
+2. Populate the Content folder of this Management Server with all the application packages required for all users.
 
-3.  Set up a staging computer that has the App-V Client installed. Log on to the staging computer with an account that has access to all applications so that the complete set of applications are published to the computer, and then stream the applications to cache so that they are fully loaded.
+3. Set up a staging computer that has the App-V Client installed. Log on to the staging computer with an account that has access to all applications so that the complete set of applications are published to the computer, and then stream the applications to cache so that they are fully loaded.
 
-    **Important**  
-    The staging computer must use the same operating system type and system architecture as those used by the VMs on which the App-V Client will run.
+   **Important**  
+   The staging computer must use the same operating system type and system architecture as those used by the VMs on which the App-V Client will run.
 
-     
+     
 
-4.  Restart the staging computer in Safe Mode to ensure the drivers are not started, which would lock the cache file.
+4. Restart the staging computer in Safe Mode to ensure the drivers are not started, which would lock the cache file.
 
-    **Note**  
-    Alternatively, you can stop and disable the Application Virtualization service, and then restart the computer. After the file has been copied, remember to enable and start the service again.
+   **Note**  
+   Alternatively, you can stop and disable the Application Virtualization service, and then restart the computer. After the file has been copied, remember to enable and start the service again.
 
-     
+     
 
-5.  Copy the Sftfs.fsd cache file to the VDI server’s SAN where all the VMs can access it, such as in a shared folder. Set the folder access permissions to Read-only for the group Everyone and to Full Control for administrators who will manage the cache file updates. The location of the cache file can be obtained from the registry AppFS\\FileName.
+5. Copy the Sftfs.fsd cache file to the VDI server’s SAN where all the VMs can access it, such as in a shared folder. Set the folder access permissions to Read-only for the group Everyone and to Full Control for administrators who will manage the cache file updates. The location of the cache file can be obtained from the registry AppFS\\FileName.
 
-    **Important**  
-    You must put the FSD file in a location that has the responsiveness and reliability equivalent to locally attached storage performance, for example, a SAN.
+   **Important**  
+   You must put the FSD file in a location that has the responsiveness and reliability equivalent to locally attached storage performance, for example, a SAN.
 
-     
+     
 
-6.  Install the App-V Desktop Client on the VDI Master VM Image, and then configure it to use the read-only cache by adding the following registry key values to the AppFS key on the client. The AppFS key is located at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\\[Wow6432Node\\\]Microsoft\\SoftGrid\\4.5\\Client\\AppFS.
+6. Install the App-V Desktop Client on the VDI Master VM Image, and then configure it to use the read-only cache by adding the following registry key values to the AppFS key on the client. The AppFS key is located at HKEY\_LOCAL\_MACHINE\\SOFTWARE\\\[Wow6432Node\\\]Microsoft\\SoftGrid\\4.5\\Client\\AppFS.
 
-    
-    -    -    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
      





      KeyTypeValuePurpose
      FileName
      String
      path to FSD
      Specifies the path to the shared cache file, for example, \\VDIServername\Sharefolder\SFTFS.FSD (Required).
      ReadOnlyFSD
      DWORD
      1
      Configures the client to operate in Read-Only mode. This ensures that the client will not attempt to stream updates to the package cache. (Required)
      ErrorLogLocation
      String
      path to error log (.etl) file
      Entry used to specify the path to the error log. (Recommended. Use a local path such as C:\Logs\Sftfs.etl).
      
+   
+   +   +   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
      





      KeyTypeValuePurpose
      FileName
      String
      path to FSD
      Specifies the path to the shared cache file, for example, \VDIServername\Sharefolder\SFTFS.FSD (Required).
      ReadOnlyFSD
      DWORD
      1
      Configures the client to operate in Read-Only mode. This ensures that the client will not attempt to stream updates to the package cache. (Required)
      ErrorLogLocation
      String
      path to error log (.etl) file
      Entry used to specify the path to the error log. (Recommended. Use a local path such as C:\Logs\Sftfs.etl).
      
 
-     
+     
 
-7.  Configure the Master VM Image client to use the publishing server and to use publishing refresh at logon. As users log on to the VDI system and their VM is built from the Master VM Image, a publishing refresh cycle occurs and publishes all the applications for which their account is authorized. These applications are run from the shared cache.
+7. Configure the Master VM Image client to use the publishing server and to use publishing refresh at logon. As users log on to the VDI system and their VM is built from the Master VM Image, a publishing refresh cycle occurs and publishes all the applications for which their account is authorized. These applications are run from the shared cache.
 
 **To configure the client for package upgrade in a Pooled VM scenario**
 
@@ -124,7 +127,7 @@ Although you can publish the applications by using several different methods, th
     **Note**  
     Alternatively, you can stop and disable the Application Virtualization service in the Services.msc, and then restart the computer. After the file has been copied, remember to enable and start the service again.
 
-     
+     
 
 4.  Copy the Sftfs.fsd cache file to the VDI server’s SAN where all the VMs can access it, such as in a shared folder. You can use a different filename, for example, SFTFS\_V2.FSD, to distinguish the new version.
 
@@ -141,7 +144,7 @@ Although you can publish the applications by using several different methods, th
     **Note**  
     Alternatively, you can stop and disable the Application Virtualization service in the Services.msc, and then restart the computer. After the file has been copied, remember to enable and start the service again.
 
-     
+     
 
 4.  Copy the Sftfs.fsd cache file to the VDI server’s SAN where all the VMs can access it, such as in a shared folder. You can use a different filename, for example, SFTFS\_V2.FSD, to distinguish the new version.
 
@@ -164,12 +167,12 @@ Instead of modifying the AppFS key FILENAME value every time that a new cache fi
 
 3.  On the VDI Master VM Image, open a Command Prompt window by using the **Run as administrator** option and grant remote link permissions so that the VM can access the symbolic link on the VDI Host operating system. By default, remote link permissions are disabled.
 
-    **     fsutil behavior set SymlinkEvaluation R2R:1**
+    **fsutil behavior set SymlinkEvaluation R2R:1**
 
     **Note**  
     On the storage server, appropriate link permissions must be enabled. Depending on the location of link and the Sftfs.fsd file, the permissions are **L2L:1** or **L2R:1** or **R2L:1** or **R2R:1**.
 
-     
+     
 
 4.  When you configure the App-V Desktop Client on the VDI Master VM Image, set the AppFS key FILENAME value equal to the UNC path of the FSD file that is using the symbolic link; for example, set it to \\\\VDIHostserver\\Symlinkname. When the App-V client first accesses the cache, the symbolic link passes to the client a handle to the cache file. The client continues to use that handle as long as the client is running. The value of the symbolic link can safely be updated even if existing clients have the old shared cache open.
 
@@ -184,9 +187,9 @@ Instead of modifying the AppFS key FILENAME value every time that a new cache fi
 
 [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md b/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md
index d4beadda98..c14a8c48a6 100644
--- a/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md
+++ b/mdop/appv-v4/how-to-configure-management-server-security-post-installation.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Management Server Security Post-Installation
 description: How to Configure Management Server Security Post-Installation
-author: jamiejdt
+author: dansimp
 ms.assetid: 71979fa6-3d0b-4a8b-994e-cb728d013090
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -29,7 +32,7 @@ Use the App-V Management Console to add the certificate and configure the App-V
     **Note**  
     If no certificates are displayed in the wizard, a certificate has not been provisioned or the certificate does meet the requirements of App-V.
 
-     
+     
 
 5.  Click **Next** to continue on to the **Welcome To Certificate Wizard** page.
 
@@ -48,9 +51,9 @@ Use the App-V Management Console to add the certificate and configure the App-V
 
 [Troubleshooting Certificate Permission Issues](troubleshooting-certificate-permission-issues.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md b/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md
index a3807324db..2b4a53819a 100644
--- a/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md
+++ b/mdop/appv-v4/how-to-configure-microsoft-sql-server-mirroring-support-for-app-v.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Microsoft SQL Server Mirroring Support for App-V
 description: How to Configure Microsoft SQL Server Mirroring Support for App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 6d069eb5-109f-460a-836a-de49473b7035
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -16,18 +19,18 @@ ms.date: 08/30/2016
 
 You can use the following procedure to configure your Microsoft Application Virtualization (App-V) environment to use Microsoft SQL Server database mirroring. Configuring database mirroring can help with disaster recovery and failover scenarios. App-V 4.5 SP2 supports all modes of database mirroring currently available for Microsoft SQL Server 2005 and SQL Server 2008.
 
-**Note**  
+**Note**  
 This procedure is written for administrators who are familiar with setting up and configuring SQL Server databases and database mirroring with Microsoft SQL Server, and therefore covers only the specific configuration settings that are unique to App-V.
 
- 
+
 
 **To configure your App-V environment to use Microsoft SQL Server database mirroring**
 
 1.  Set up SQL Server database mirroring of the App-V database following your standard business practices for database mirroring. Use the following links for general information about implementing Microsoft SQL Server database mirroring:
 
-    -   **Microsoft SQL 2005**—[Setting Up Database Mirroring](https://go.microsoft.com/fwlink/?LinkId=187478) (https://go.microsoft.com/fwlink/?LinkId=187478)
+    -   **Microsoft SQL 2005**—[Setting Up Database Mirroring](https://go.microsoft.com/fwlink/?LinkId=187478) (https://go.microsoft.com/fwlink/?LinkId=187478)
 
-    -   **Microsoft SQL 2008**—[Setting Up Database Mirroring](https://go.microsoft.com/fwlink/?LinkId=187477) (https://go.microsoft.com/fwlink/?LinkId=187477)
+    -   **Microsoft SQL 2008**—[Setting Up Database Mirroring](https://go.microsoft.com/fwlink/?LinkId=187477) (https://go.microsoft.com/fwlink/?LinkId=187477)
 
     In addition, you can find Best Practices information in [Database Mirroring Best Practices and Performance Considerations](https://go.microsoft.com/fwlink/?LinkId=190270) (https://go.microsoft.com/fwlink/?LinkId=190270).
 
@@ -39,10 +42,10 @@ This procedure is written for administrators who are familiar with setting up an
 
 5.  Check the registry key **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Softgrid\\4.5\\Server\\SQLServerName** and make sure that it contains only the host name of the SQL Server. If it includes an instance name, for example *serverhostname\\instancename*, the instance name must be removed.
 
-    **Important**  
+    **Important**  
     The App-V Management Server uses the TCP/IP networking library to communicate with the SQL Server when database mirroring is enabled, and therefore instance names cannot be used. The port numbers must be specified in the registry keys instead.
 
-     
+
 
 6.  Check the registry key **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Softgrid\\4.5\\Server\\SQLServerPort** and make sure that it contains the port number that is used for SQL on the SQL Server computer. If you are using a named instance this key value must be set to the port that is used for the named instance.
 
@@ -58,28 +61,30 @@ This procedure is written for administrators who are familiar with setting up an
 
     -   Click the **All** tab, and then select the entry **Failover Partner**. Click **Edit Value**, and then enter the server name of the failover SQL Server. Click **OK**.
 
-    **Important**  
+    **Important**  
     The App-V system uses Kerberos authentication. Therefore, when you configure SQL mirroring where Kerberos Authentication is enabled on the SQL Server and the SQL Server service runs under a domain user account, you must manually configure an SPN. For more information, see “When SQL Service Uses Domain-Based Account” in the article [Configuring App-V Administration for a Distributed Environment](https://go.microsoft.com/fwlink/?LinkId=203186) (https://go.microsoft.com/fwlink/?LinkId=203186).
 
-     
+
 
 10. To verify that database mirroring is running correctly, test the failover and confirm that the App-V Management Server continues to function correctly.
 
-    **Important**  
+    **Important**  
     Proceed with care, and follow your standard business practices to ensure that system operations are not disrupted in the event of a failure.
 
-     
 
-    After the failover has occurred successfully, as verified by using the SQL Server status monitoring information, right-click the **Applications** node in the App-V Management Console, and then select **Refresh**. The list of applications should display normally if the system is working correctly.
+
+~~~
+After the failover has occurred successfully, as verified by using the SQL Server status monitoring information, right-click the **Applications** node in the App-V Management Console, and then select **Refresh**. The list of applications should display normally if the system is working correctly.
+~~~
 
 ## Related topics
 
 
 [How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md b/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md
index 3560100875..1c79254fd6 100644
--- a/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md
+++ b/mdop/appv-v4/how-to-configure-servers-for-esd-based-deployment.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Servers for ESD-Based Deployment
 description: How to Configure Servers for ESD-Based Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 96208522-3a0c-4606-a10b-fc0ec0a12021
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md b/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md
index 9899d3547a..5a4d8e1932 100644
--- a/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md
+++ b/mdop/appv-v4/how-to-configure-servers-for-server-based-deployment.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Servers for Server-Based Deployment
 description: How to Configure Servers for Server-Based Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 6371c37a-46eb-44e8-ad6b-4430c866c8b4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md b/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md
index 5853fc63d0..c668b902eb 100644
--- a/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md
+++ b/mdop/appv-v4/how-to-configure-shortcut-and-file-type-association-behavior-46-only.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Shortcut and File Type Association Behavior
 description: How to Configure Shortcut and File Type Association Behavior
-author: jamiejdt
+author: dansimp
 ms.assetid: d6fd1728-4de6-4066-b36b-d4837d593d40
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -60,16 +63,16 @@ There are four policy values defined in the following table and these apply to b
 
 
 
- 
+ 
 
 **Note**  
 The text values refer to the values for the XML attributes in the publishing XML file.  You can set these values manually if you have implemented a custom HTTP publishing solution.
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md b/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md
index 7038049961..afe7d0a2da 100644
--- a/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md
+++ b/mdop/appv-v4/how-to-configure-streaming-server-security-post-installation.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Streaming Server Security Post-Installation
 description: How to Configure Streaming Server Security Post-Installation
-author: jamiejdt
+author: dansimp
 ms.assetid: 9bde3677-d1aa-4dcc-904e-bb49a268d748
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md b/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md
index cf1547bbe9..03e3ac7409 100644
--- a/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md
+++ b/mdop/appv-v4/how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the App-V Client Registry Settings by Using the Command Line
 description: How to Configure the App-V Client Registry Settings by Using the Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: 3e3d873f-13d2-402f-97b4-f62d0c399171
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -27,7 +30,7 @@ There is also an ADM template that you can use. For more information about the A
 **Caution**  
 Use care when you edit the registry because errors can leave the computer in an unusable state. Be sure to follow your standard business practices that relate to registry edits. Thoroughly test all proposed changes in a test environment before you deploy them to production computers.
 
- 
+ 
 
 ## In This Section
 
@@ -35,7 +38,7 @@ Use care when you edit the registry because errors can leave the computer in an
 **Important**  
 On a 64-bit computer, the keys and values described in the following sections will be under HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\Client.
 
- 
+ 
 
 [How to Reset the FileSystem Cache](how-to-reset-the-filesystem-cache.md)  
 Provides the information that is required to reset the FileSystem cache.
@@ -66,9 +69,9 @@ Describes the registry key values that control shortcuts and file type associati
 
 [Application Virtualization Client](application-virtualization-client.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md b/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md
index 8ca46a9f80..615d3a60b6 100644
--- a/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md
+++ b/mdop/appv-v4/how-to-configure-the-app-v-sequencer.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the App-V Sequencer
 description: How to Configure the App-V Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: 0f43f618-80b0-4715-af17-90f5c673d838
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md b/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md
index 6146ea24d9..85ccb5fd59 100644
--- a/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md
+++ b/mdop/appv-v4/how-to-configure-the-app-v-system-for-package-upgrade.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the App-V System for Package Upgrade
 description: How to Configure the App-V System for Package Upgrade
-author: jamiejdt
+author: dansimp
 ms.assetid: de133898-f887-46c1-9bc9-fbb03feac66a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md b/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md
index 0fd6b3a317..5dab5d7b35 100644
--- a/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md
+++ b/mdop/appv-v4/how-to-configure-the-application-virtualization-client-settings-manually.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Application Virtualization Client Settings Manually
 description: How to Configure the Application Virtualization Client Settings Manually
-author: jamiejdt
+author: dansimp
 ms.assetid: 53bd21d8-49eb-4c77-9692-c093ffe4c17c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md b/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md
index 0aed3c1fe9..8225fe37da 100644
--- a/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md
+++ b/mdop/appv-v4/how-to-configure-the-application-virtualization-management-servers.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Application Virtualization Management Servers
 description: How to Configure the Application Virtualization Management Servers
-author: jamiejdt
+author: dansimp
 ms.assetid: a9f96148-bf2d-486f-98c2-23409bfb0935
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Before virtualized applications can be streamed to the Application Virtualizatio
 **Important**  
 Application Virtualization Servers stream SFT files to the Desktop Client and the Client for Remote Desktop Services using only RTSP or RTSPS protocols. The ICO (icon) file and the OSD (open software descriptor) file can be configured to stream from a different file or HTTP server.
 
- 
+ 
 
 **To configure the Application Virtualization Management Server**
 
@@ -30,7 +33,7 @@ Application Virtualization Servers stream SFT files to the Desktop Client and th
     **Note**  
     During the installation procedure, you specify the location of the \\Content directory on the **Content Path** screen.
 
-     
+     
 
 2.  Navigate to the location that you specified for the \\Content directory, and if necessary, create the directory.
 
@@ -47,9 +50,9 @@ Application Virtualization Servers stream SFT files to the Desktop Client and th
 
 [How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md b/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md
index a1c28b5df3..8671c8e401 100644
--- a/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md
+++ b/mdop/appv-v4/how-to-configure-the-application-virtualization-streaming-servers.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Application Virtualization Streaming Servers
 description: How to Configure the Application Virtualization Streaming Servers
-author: jamiejdt
+author: dansimp
 ms.assetid: 3e2dde35-9d72-40ba-9fdf-d0338bd4d561
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Before virtual applications can be streamed to the Application Virtualization De
 **Important**  
 Application Virtualization Servers stream SFT files to the Desktop Client and the Client for Remote Desktop Services using only RTSP or RTSPS protocols. The ICO (icon) file and the OSD (open software descriptor) file can be configured to stream from a different file or HTTP server.
 
- 
+ 
 
 **To configure the Application Virtualization Streaming Servers**
 
@@ -44,9 +47,9 @@ Application Virtualization Servers stream SFT files to the Desktop Client and th
 
 [How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md b/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md
index 63246aa503..04f4c05542 100644
--- a/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md
+++ b/mdop/appv-v4/how-to-configure-the-client-for-application-package-retrieval.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Client for Application Package Retrieval
 description: How to Configure the Client for Application Package Retrieval
-author: jamiejdt
+author: dansimp
 ms.assetid: 891f2739-da7a-46da-b452-b8c0af075525
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -20,12 +23,12 @@ If you want the client to obtain the package content (SFT file) from a local App
 
 You can also configure the OSDSourceRoot and IconSourceRoot registry key values if you want to override those settings in the package manifest file or in the paths sent by a publishing server. The OSDSourceRoot specifies a source location for OSD file retrieval for an application package during publication. The IconSourceRoot specifies a source location for icon retrieval for an application package during publication.
 
-**Note**  
+**Note**  
 -   The IconSourceRoot and OSDSourceRoot settings override the values in the package manifest file, so if you try to deploy a package by using the Windows Installer (.msi) file method, it will also override the values in the package manifest file that is contained within that .msi file.
 
 -   During both the publishing and HTTP(S) streaming operations,App-V 4.5 SP1 clients use the proxy server settings that are configured in Internet Explorer on the user’s computer.
 
- 
+
 
 **To configure the ApplicationSourceRoot registry key value**
 
@@ -37,93 +40,95 @@ You can also configure the OSDSourceRoot and IconSourceRoot registry key values
 
     The correct format for the URL path is **protocol://servername:\[port\]\[/path\]\[/\]**, where **port** and **path** are optional. If **port** is not specified, the default port for the protocol is used. Only the **protocol://server:port** portion of the OSD URL is replaced.
 
-    **Important**  
+    **Important**  
     Environment variables are not supported in the ApplicationSourceRoot definition.
 
-     
 
-    The following table lists examples of acceptable URL and UNC path formats.
 
-    
-    -    -    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
      





      ApplicationSourceRootOSD File HREF PathResultComments
      rtsps://mainserver:322
      rtsp://appserver/productivity/office2k3.sft?customer=seq
      rtsps://mainserver:322/productivity/office2k3.sft?customer=seq
      rtsps://mainserver:322/prodapps
      rtsp://appserver/productivity/office2k3.sft?customer=seq
      rtsps://mainserver:322/prodapps/productivity/office2k3.sft?customer=seq
      https://mainserver:443/prodapps
      rtsp://appserver/productivity/office2k3.sft?customer=seq
      https://mainserver:443/prodapps/productivity/office2k3.sft?customer=seq
      rtsps://mainserver:322/prodapps
      rtsp://%SFT_APPVSERVER%:554/productivity/office2k3.sft?customer=seq
      rtsps://mainserver:322/prodapps/productivity/office2k3.sft?customer=seq
      rtsps://mainserver:322
      \\uncserver\share\productivity\office2k3.sft
      rtsps://mainserver:322/productivity/office2k3.sft
      ‘\’ converted to ‘/’
      rtsps://mainserver:322
      file://\\uncserver\share\productivity\office2k3.sft
      rtsps://mainserver:322/productivity/office2k3.sft
      ‘\’ converted to ‘/’
      \\uncserver\share
      rtsp://appserver/productivity/office2k3.sft?customer=seq
      \\uncserver\share\productivity\office2k3.sft
      ‘/’ converted to ‘\’ and parameter dropped when converting to UNC path
      \\uncserver\share\prodapps
      rtsp://appserver/productivity/office2k3.sft?customer=seq
      \\uncserver\share\prodapps\productivity\office2k3.sft
      ‘/’ converted to ‘\’ and parameter dropped when converting to UNC path
      M:
      \\uncserver\share\productivity\office2k3.sft
      M:\productivity\office2k3.sft
      M:\prodapps
      \\uncserver\share\productivity\office2k3.sft
      M:\prodapps\productivity\office2k3.sft
      
+~~~
+The following table lists examples of acceptable URL and UNC path formats.
+
+
++++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
      





      ApplicationSourceRootOSD File HREF PathResultComments
      rtsps://mainserver:322
      rtsp://appserver/productivity/office2k3.sft?customer=seq
      rtsps://mainserver:322/productivity/office2k3.sft?customer=seq
      rtsps://mainserver:322/prodapps
      rtsp://appserver/productivity/office2k3.sft?customer=seq
      rtsps://mainserver:322/prodapps/productivity/office2k3.sft?customer=seq
      https://mainserver:443/prodapps
      rtsp://appserver/productivity/office2k3.sft?customer=seq
      https://mainserver:443/prodapps/productivity/office2k3.sft?customer=seq
      rtsps://mainserver:322/prodapps
      rtsp://%SFT_APPVSERVER%:554/productivity/office2k3.sft?customer=seq
      rtsps://mainserver:322/prodapps/productivity/office2k3.sft?customer=seq
      rtsps://mainserver:322
      \\uncserver\share\productivity\office2k3.sft
      rtsps://mainserver:322/productivity/office2k3.sft
      ‘\’ converted to ‘/’
      rtsps://mainserver:322
      file://\\uncserver\share\productivity\office2k3.sft
      rtsps://mainserver:322/productivity/office2k3.sft
      ‘\’ converted to ‘/’
      \\uncserver\share
      rtsp://appserver/productivity/office2k3.sft?customer=seq
      \\uncserver\share\productivity\office2k3.sft
      ‘/’ converted to ‘\’ and parameter dropped when converting to UNC path
      \\uncserver\share\prodapps
      rtsp://appserver/productivity/office2k3.sft?customer=seq
      \\uncserver\share\prodapps\productivity\office2k3.sft
      ‘/’ converted to ‘\’ and parameter dropped when converting to UNC path
      M:
      \\uncserver\share\productivity\office2k3.sft
      M:\productivity\office2k3.sft
      M:\prodapps
      \\uncserver\share\productivity\office2k3.sft
      M:\prodapps\productivity\office2k3.sft
      
+~~~
+
 
-     
 
 **To configure the OSDSourceRoot value**
 
@@ -154,9 +159,9 @@ You can also configure the OSDSourceRoot and IconSourceRoot registry key values
 
 [How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md b/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md
index f4c7b97649..fe5c5331d3 100644
--- a/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md
+++ b/mdop/appv-v4/how-to-configure-the-client-for-disconnected-operation-mode.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Client for Disconnected Operation Mode
 description: How to Configure the Client for Disconnected Operation Mode
-author: jamiejdt
+author: dansimp
 ms.assetid: 3b48464a-b8b4-494b-93e3-9a6d9bd74652
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The disconnected operation mode enables the Application Virtualization (App-V) D
 **Important**  
 In a large organization where multiple Remote Desktop Session Host (RD°Session Host) servers (formerly Terminal Servers) are linked in a farm to support many users, using a single App-V Management Server to support the farm represents a single point of failure. To provide high availability to support the RD Session Host farm, consider linking two or more App-V Management Servers to use the same database.
 
- 
+ 
 
 **To enable disconnected operation mode**
 
@@ -56,9 +59,9 @@ In a large organization where multiple Remote Desktop Session Host (RD°Session
 
 [How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md b/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md
index 96a22d6817..ee1c92f759 100644
--- a/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md
+++ b/mdop/appv-v4/how-to-configure-the-client-for-mit-kerberos-realm-support.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Client for MIT Kerberos Realm Support
 description: How to Configure the Client for MIT Kerberos Realm Support
-author: jamiejdt
+author: dansimp
 ms.assetid: 46102f4c-270c-4115-8eb4-7ff5ae3be32d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md b/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md
index a74f09107a..951cbbb2d7 100644
--- a/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md
+++ b/mdop/appv-v4/how-to-configure-the-client-in-the-application-virtualization-client-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Client in the Application Virtualization Client Management Console
 description: How to Configure the Client in the Application Virtualization Client Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: d0868c9f-8fe9-442f-a9ad-ef30efb0f6b1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-configure-the-client-log-file.md b/mdop/appv-v4/how-to-configure-the-client-log-file.md
index 440171d152..e4a46cd129 100644
--- a/mdop/appv-v4/how-to-configure-the-client-log-file.md
+++ b/mdop/appv-v4/how-to-configure-the-client-log-file.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Client Log File
 description: How to Configure the Client Log File
-author: jamiejdt
+author: dansimp
 ms.assetid: dd79f8ce-61e2-4dc8-af03-2a353554a1b2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -37,7 +40,7 @@ You can use the following procedures to configure the Application Virtualization
     **Caution**  
     This registry key value must be set to a value greater than zero to ensure the log file does get reset.
 
-     
+     
 
 **To change the number of backup copies**
 
@@ -90,16 +93,16 @@ You can use the following procedures to configure the Application Virtualization
     
     
 
-     
+     
 
 ## Related topics
 
 
 [How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-the-file-server.md b/mdop/appv-v4/how-to-configure-the-file-server.md
index 35061111a7..c9d01b4dba 100644
--- a/mdop/appv-v4/how-to-configure-the-file-server.md
+++ b/mdop/appv-v4/how-to-configure-the-file-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the File Server
 description: How to Configure the File Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 0977554c-1741-411b-85e7-7e1cd017542f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ If you are using an Application Virtualization Management Server as a distributi
 **Important**  
 For applications to stream properly to the Application Virtualization Desktop Client and the Client for Remote Desktop Services, the SFT file streams from the content directory on the server where you store the virtual application; the ICO (icon) file and the OSD (open software descriptor) file can be configured to stream from a different server.
 
- 
+ 
 
 **To configure the Application Virtualization file server**
 
@@ -32,14 +35,14 @@ For applications to stream properly to the Application Virtualization Desktop Cl
     **Note**  
     During the installation procedure, you specify the location of the \\Content directory on the **Content Path** screen.
 
-     
+     
 
 2.  Create a \\Content directory, which corresponds to the directory you specified when you installed the server, on each computer that you are using as a file share.
 
     **Important**  
     Configure the Application Virtualization Desktop Clients to stream applications from the computer you are using as a file share rather than from an Application Virtualization Server or IIS server.
 
-     
+     
 
 3.  When the \\Content directory is created, configure this directory as a standard file share.
 
@@ -56,9 +59,9 @@ For applications to stream properly to the Application Virtualization Desktop Cl
 
 [How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-the-server-for-iis.md b/mdop/appv-v4/how-to-configure-the-server-for-iis.md
index 06a8ac3e32..4290cc9bf5 100644
--- a/mdop/appv-v4/how-to-configure-the-server-for-iis.md
+++ b/mdop/appv-v4/how-to-configure-the-server-for-iis.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Server for IIS
 description: How to Configure the Server for IIS
-author: jamiejdt
+author: dansimp
 ms.assetid: 1fcfc583-322f-4a38-90d0-e64bfa9ee3d8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -31,7 +34,7 @@ Before virtual applications can be streamed to the Application Virtualization De
 **Note**  
 If you are using IIS to publish the ICO and OSD files, you must configure a MIME type for OSD=TXT; otherwise, IIS will not serve the ICO and OSD files to clients. If you are using IIS to publish packages (SFT files), you must configure a MIME type for SFT=Binary; otherwise, IIS will not serve the SFT files to clients.
 
- 
+ 
 
 ## Related topics
 
@@ -46,9 +49,9 @@ If you are using IIS to publish the ICO and OSD files, you must configure a MIME
 
 [How to Configure the File Server](how-to-configure-the-file-server.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md b/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md
index cd01cd456c..fec2c858fe 100644
--- a/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md
+++ b/mdop/appv-v4/how-to-configure-the-server-to-be-trusted-for-delegation.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Server to be Trusted for Delegation
 description: How to Configure the Server to be Trusted for Delegation
-author: jamiejdt
+author: dansimp
 ms.assetid: d8d11588-17c0-4bcb-a7e6-86b5e4ba7e1c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ When you install the Microsoft Application Virtualization (App-V) Management Ser
 **Note**  
 If you install the App-V Management Server software on a single server and place the data store on a separate server, there is one situation in which you must still configure the server to be trusted for delegation even though the Management Web Service and Management Console are on the same server. This situation occurs if you need to connect to the Management Web Service in the console by using the **Use Alternate Credentials** option.
 
- 
+ 
 
 The type of delegation that you can use depends on the Domain Functional Level that you have configured in your Active Directory Domain Services (AD DS) infrastructure. The following table lists the types of delegation that can be configured for each Domain Functional Level for App-V. Detailed instructions follow the table.
 
@@ -54,7 +57,7 @@ The type of delegation that you can use depends on the Domain Functional Level t
 
 
 
- 
+ 
 
 ¹ Not recommended.
 
@@ -123,9 +126,9 @@ If you are running the Management Web Service on an IIS 7 server, you must compl
 
 3.  Type **appcmd.exe set config -section:system.webServer/security/authentication/windowsAuthentication -useAppPoolCredentials:true**, and then press ENTER.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-user-permissions.md b/mdop/appv-v4/how-to-configure-user-permissions.md
index b993f4fc67..88e1049577 100644
--- a/mdop/appv-v4/how-to-configure-user-permissions.md
+++ b/mdop/appv-v4/how-to-configure-user-permissions.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure User Permissions
 description: How to Configure User Permissions
-author: jamiejdt
+author: dansimp
 ms.assetid: 54e69f46-b028-4ad1-9b80-f06ef5c8f559
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md b/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md
index 6b168497bb..3ec2889648 100644
--- a/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md
+++ b/mdop/appv-v4/how-to-configure-windows-server-2003-firewall-for-app-v.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Windows Server 2003 Firewall for App-V
 description: How to Configure Windows Server 2003 Firewall for App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 2c0e80f8-41e9-4164-ac83-b23b132b489a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,14 +26,14 @@ Use the following procedure to configure the Windows Server 2003 firewall for A
     **Note**  
     If the server has not been configured to run the firewall service before this step, you will be prompted to start the firewall service.
 
-     
+     
 
 2.  If ICO and OSD files are published through SMB, ensure that **File and Printer Sharing** is enabled on the **Exceptions** tab.
 
     **Note**  
     If ICO and OSD files are published through HTTP/HTTPS on the Management Server, you might need to add an exception for HTTP or HTTPS. If the IIS server hosting the ICO and OSD files is hosted on a computer separate from the Management Server, you need to add the exception to that computer. To maximize performance, it is recommended that you host the ICO and OSD files on a separate server from the Management Server.
 
-     
+     
 
 3.  Add a program exception for `sghwdsptr.exe`, which is the Management Server service executable. The default path to this executable is `%ProgramFiles%\Microsoft System Center App Virt Management Server\App Virt Management Server\bin`.
 
@@ -39,7 +42,7 @@ Use the following procedure to configure the Windows Server 2003 firewall for A
 
     The App-V Streaming Server requires a program exception `sglwdsptr.exe` for RTSPS communication. The App-V Streaming Server that uses RTSP for communication also requires a program exception for `sglwsvr.exe`.
 
-     
+     
 
 4.  Ensure that the proper scope is configured for each exception. To reduce risk, remove any computer and strictly limit the IP addresses to which the server will respond.
 
@@ -48,9 +51,9 @@ Use the following procedure to configure the Windows Server 2003 firewall for A
 
 [How to Configure Windows Server 2008 Firewall for App-V](how-to-configure-windows-server-2008-firewall-for-app-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md b/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md
index 7e262b2024..7e516a89fd 100644
--- a/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md
+++ b/mdop/appv-v4/how-to-configure-windows-server-2008-firewall-for-app-v.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Windows Server 2008 Firewall for App-V
 description: How to Configure Windows Server 2008 Firewall for App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 57f4ed17-0651-4a3c-be1e-29d9520c6aeb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -23,7 +26,7 @@ If the Management Server is configured to use RTSP, repeat this procedure to add
 
 The App-V Streaming Server requires the program exception `sglwdsptr.exe` for RTSPS communication. An App-V Streaming Server that uses RTSP for communication also requires a program exception for `sglwsvr.exe`.
 
- 
+ 
 
 **To configure Windows Server 2008 firewall for App-V**
 
@@ -46,9 +49,9 @@ The App-V Streaming Server requires the program exception `sglwdsptr.exe` for RT
 
 [How to Configure Windows Server 2003 Firewall for App-V](how-to-configure-windows-server-2003-firewall-for-app-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md b/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md
index f185fe428f..8368dd56f8 100644
--- a/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md
+++ b/mdop/appv-v4/how-to-configure-windows-server-2008-for-app-v-management-servers.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Windows Server 2008 for App-V Management Servers
 description: How to Configure Windows Server 2008 for App-V Management Servers
-author: jamiejdt
+author: dansimp
 ms.assetid: 38b4016f-de82-4209-9159-387d20ddee25
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md b/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md
index 3cd9f48609..169761167e 100644
--- a/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md
+++ b/mdop/appv-v4/how-to-connect-to-an-application-virtualization-system.md
@@ -1,12 +1,15 @@
 ---
 title: How to Connect to an Application Virtualization System
 description: How to Connect to an Application Virtualization System
-author: jamiejdt
+author: dansimp
 ms.assetid: ac38216c-5464-4c0b-a4d3-3949ba6358ac
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -18,49 +21,49 @@ You must connect the Application Virtualization Server Management Console to an
 
 **To connect to an Application Virtualization System**
 
-1.  Right-click the Application Virtualization System node in the **Scope** pane, and select **Connect to Application Virtualization System** from the pop-up menu.
+1. Right-click the Application Virtualization System node in the **Scope** pane, and select **Connect to Application Virtualization System** from the pop-up menu.
 
-    **Note**  
-    There are three components to Application Virtualization server management: the Application Virtualization Management Console, the Management Web Service, and the SQL Datastore. If these components are distributed across different physical machines, you must configure security properly for the components to communicate across the system. For more information, see the following manuals and articles:
+   **Note**  
+   There are three components to Application Virtualization server management: the Application Virtualization Management Console, the Management Web Service, and the SQL Datastore. If these components are distributed across different physical machines, you must configure security properly for the components to communicate across the system. For more information, see the following manuals and articles:
 
-    [How to Configure the Server to be Trusted for Delegation](https://go.microsoft.com/fwlink/?LinkID=166682) (https://go.microsoft.com/fwlink/?LinkID=166682)
+   [How to Configure the Server to be Trusted for Delegation](https://go.microsoft.com/fwlink/?LinkID=166682) (https://go.microsoft.com/fwlink/?LinkID=166682)
 
-    [Planning and Deployment Guide for the Application Virtualization System](https://go.microsoft.com/fwlink/?LinkID=122063) (https://go.microsoft.com/fwlink/?LinkID=122063)
+   [Planning and Deployment Guide for the Application Virtualization System](https://go.microsoft.com/fwlink/?LinkID=122063) (https://go.microsoft.com/fwlink/?LinkID=122063)
 
-    [Operations Guide for the Application Virtualization System](https://go.microsoft.com/fwlink/?LinkID=133129) (https://go.microsoft.com/fwlink/?LinkID=133129)
+   [Operations Guide for the Application Virtualization System](https://go.microsoft.com/fwlink/?LinkID=133129) (https://go.microsoft.com/fwlink/?LinkID=133129)
 
-    [Article 930472](https://go.microsoft.com/fwlink/?LinkId=114647) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=114647)
+   [Article 930472](https://go.microsoft.com/fwlink/?LinkId=114647) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=114647)
 
-    [Article 930565](https://go.microsoft.com/fwlink/?LinkId=114648) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=114648)
+   [Article 930565](https://go.microsoft.com/fwlink/?LinkId=114648) in the Microsoft Knowledge Base (https://go.microsoft.com/fwlink/?LinkId=114648)
 
-     
+     
 
-2.  Complete the fields in the **Connect to Application Virtualization System** dialog box:
+2. Complete the fields in the **Connect to Application Virtualization System** dialog box:
 
-    1.  **Web Service Host Name**—Enter the name of the Application Virtualization System to which you want to connect, or enter **localhost** to connect to the local server.
+   1. **Web Service Host Name**—Enter the name of the Application Virtualization System to which you want to connect, or enter **localhost** to connect to the local server.
 
-    2.  **Use Secure Connection**—Select this check box if you want to connect to the server with a secure connection.
+   2. **Use Secure Connection**—Select this check box if you want to connect to the server with a secure connection.
 
-    3.  **Port**—Enter the port number you want to use for the connection. **80** is the default regular port number, and **443** is the secure-port number.
+   3. **Port**—Enter the port number you want to use for the connection. **80** is the default regular port number, and **443** is the secure-port number.
 
-    4.  **Use Current Windows Account**—Select this radio button to use the current Windows account credentials.
+   4. **Use Current Windows Account**—Select this radio button to use the current Windows account credentials.
 
-    5.  **Specify Windows Account**—Select this radio button when you want to connect to the server as a different user.
+   5. **Specify Windows Account**—Select this radio button when you want to connect to the server as a different user.
 
-    6.  **Name**—Enter the name of the new user by using either the *DOMAIN\\username* or the *username@domain* format.
+   6. **Name**—Enter the name of the new user by using either the *DOMAIN\\username* or the username@domain format.
 
-    7.  **Password**—Enter the password that corresponds to the new user.
+   7. **Password**—Enter the password that corresponds to the new user.
 
-3.  Click **OK**.
+3. Click **OK**.
 
 ## Related topics
 
 
 [How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-create-a-reportserver.md b/mdop/appv-v4/how-to-create-a-reportserver.md
index 9c6d7df2c3..abdfd7298e 100644
--- a/mdop/appv-v4/how-to-create-a-reportserver.md
+++ b/mdop/appv-v4/how-to-create-a-reportserver.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create a Report
 description: How to Create a Report
-author: jamiejdt
+author: dansimp
 ms.assetid: 70938167-d3b9-45ce-b459-a953c93769b0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -17,9 +20,9 @@ ms.date: 06/16/2016
 The process for creating a report from the Application Virtualization Server Management Console is the same regardless of the report type. When you select a report type, the window displays a brief description of the selected report.
 
 **Note**  
-  When you create a report, you specify the parameters that are used for collecting the data when the report is run. Until you run a report, no data is collected.
+  When you create a report, you specify the parameters that are used for collecting the data when the report is run. Until you run a report, no data is collected.
 
- 
+ 
 
 **To create a report**
 
@@ -48,9 +51,9 @@ The process for creating a report from the Application Virtualization Server Man
 
 [How to Run a Report](how-to-run-a-reportserver.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-create-a-server-group.md b/mdop/appv-v4/how-to-create-a-server-group.md
index a6aaab96d4..bc12c0bd0a 100644
--- a/mdop/appv-v4/how-to-create-a-server-group.md
+++ b/mdop/appv-v4/how-to-create-a-server-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create a Server Group
 description: How to Create a Server Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 29ada98b-1024-483d-a3ee-67d4bb263df7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md b/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md
index 9741e22e24..23e2b3570b 100644
--- a/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md
+++ b/mdop/appv-v4/how-to-create-a-virtual-environment-for-a-web-based-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create a Virtual Environment for a Web-Based Application
 description: How to Create a Virtual Environment for a Web-Based Application
-author: jamiejdt
+author: dansimp
 ms.assetid: d2b16e9d-369c-4bd6-b2a0-16dd24c0e32c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md b/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md
index dd06f93229..26aae4b1ea 100644
--- a/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md
+++ b/mdop/appv-v4/how-to-create-an-app-v-project-template--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create an App-V Project Template (App-V 4.6 SP1)
 description: How to Create an App-V Project Template (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 7e87fba2-b72a-4bc9-92b8-220e25aae99a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can use an App-V project template to save commonly applied settings associat
 **Note**  
 You can only apply an App-V project template when you are creating a new virtual application package. Applying project templates to existing virtual application packages is not supported.
 
- 
+ 
 
 For more information about applying an App-V project template, see [How to Apply an App-V Project Template (App-V 4.6 SP1)](how-to-apply-an-app-v-project-template--app-v-46-sp1-.md).
 
@@ -52,9 +55,9 @@ The following general settings are saved with an App-V project template:
 
 [How to Apply an App-V Project Template (App-V 4.6 SP1)](how-to-apply-an-app-v-project-template--app-v-46-sp1-.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-create-an-application-group.md b/mdop/appv-v4/how-to-create-an-application-group.md
index 37f0a14dc5..ac2fba82be 100644
--- a/mdop/appv-v4/how-to-create-an-application-group.md
+++ b/mdop/appv-v4/how-to-create-an-application-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create an Application Group
 description: How to Create an Application Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 32751511-3d1e-40e5-b21f-d88ea39c76a3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-create-an-application-license-group.md b/mdop/appv-v4/how-to-create-an-application-license-group.md
index 01f92da9f8..76da2668b9 100644
--- a/mdop/appv-v4/how-to-create-an-application-license-group.md
+++ b/mdop/appv-v4/how-to-create-an-application-license-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create an Application License Group
 description: How to Create an Application License Group
-author: jamiejdt
+author: dansimp
 ms.assetid: b385324a-8a11-41ee-86e8-8f809235454c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md b/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md
index 77bfa2b677..bf6769fb47 100644
--- a/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md
+++ b/mdop/appv-v4/how-to-create-app-v-package-accelerators--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create App-V Package Accelerators (App-V 4.6 SP1)
 description: How to Create App-V Package Accelerators (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 585e692e-cebb-48ac-93ab-b2e7eb7ae7ad
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -18,19 +21,19 @@ You can use App-V Package Accelerators to automatically generate a new virtual a
 
 In some situations, to create the Package Accelerator, you might have to install the application locally on the computer running the Sequencer. First try to create the Package Accelerator by using the installation media, and if there are a number of missing files that are required, install the application locally to the computer running the Sequencer, and then create the Package Accelerator.
 
-**Important**  
+**Important**  
 Before you begin the following procedure, you should do the following:
 
 -   Copy the virtual application package that you must use to create the Package Accelerator locally to the computer running the Sequencer.
 
 -   Copy all required installation files associated with the virtual application package to the computer running the Sequencer.
 
- 
 
-**Important**  
+
+**Important**  
 Disclaimer: The Microsoft Application Virtualization Sequencer does not give you any license rights to the software application you are using to create a Package Accelerator. You must abide by all end user license terms for such application. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using Application Virtualization Sequencer.
 
- 
+
 
 **To create an App-V Package Accelerator**
 
@@ -40,45 +43,49 @@ Disclaimer: The Microsoft Application Virtualization Sequencer does not give you
 
 3.  On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.sprj file).
 
-    **Tip**  
+    **Tip**  
     Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer.
 
-     
 
-    Click **Next**.
 
-4.  On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files.
+~~~
+Click **Next**.
+~~~
 
-    **Tip**  
-    Copy the folder that contains the required installation files to the computer running the Sequencer.
+4. On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files.
 
-     
+   **Tip**  
+   Copy the folder that contains the required installation files to the computer running the Sequencer.
 
-    If the application is already installed on the computer running the Sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location.
 
-5.  On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page.
 
-    **Note**  
-    You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard.
+~~~
+If the application is already installed on the computer running the Sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location.
+~~~
 
-     
+5. On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page.
 
-6.  On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the Package Accelerator. Select only files that are required for the application to run successfully, and then click **Next**.
+   **Note**  
+   You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard.
 
-7.  On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package.
 
-    If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**.
 
-8.  On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**.
+6. On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the Package Accelerator. Select only files that are required for the application to run successfully, and then click **Next**.
 
-9.  On the **Create Package Accelerator** page, to specify where to save the Package Accelerator, click **Browse** and select the directory.
+7. On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package.
+
+   If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**.
+
+8. On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**.
+
+9. On the **Create Package Accelerator** page, to specify where to save the Package Accelerator, click **Browse** and select the directory.
 
 10. On the **Completion** page, to close the **Create Package Accelerator** wizard, click **Close**.
 
-    **Important**  
-    To help ensure that the Package Accelerator is as secure as possible, and so that the publisher can be verified when the Package Accelerator is applied, you should always digitally sign the Package Accelerator.
+   **Important**  
+   To help ensure that the Package Accelerator is as secure as possible, and so that the publisher can be verified when the Package Accelerator is applied, you should always digitally sign the Package Accelerator.
+
 
-     
 
 ## Related topics
 
@@ -86,9 +93,9 @@ Disclaimer: The Microsoft Application Virtualization Sequencer does not give you
 Configuring the Application Virtualization Sequencer (App-V 4.6 SP1)
 [How to Apply a Package Accelerator to Create a Virtual Application Package (App-V 4.6 SP1)](how-to-apply-a-package-accelerator-to-create-a-virtual-application-package---app-v-46-sp1-.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md b/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md
index 6eadeb3912..c4db220dcf 100644
--- a/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md
+++ b/mdop/appv-v4/how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create or Upgrade Virtual Applications Using the App-V Sequencer
 description: How to Create or Upgrade Virtual Applications Using the App-V Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: 661d4f8c-2527-4654-9d92-15ecc652c0db
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-create-the-package-root-directory.md b/mdop/appv-v4/how-to-create-the-package-root-directory.md
index 514d146b36..8e00793ee2 100644
--- a/mdop/appv-v4/how-to-create-the-package-root-directory.md
+++ b/mdop/appv-v4/how-to-create-the-package-root-directory.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create the Package Root Directory
 description: How to Create the Package Root Directory
-author: jamiejdt
+author: dansimp
 ms.assetid: bcfe3bd4-6c60-409a-8ffa-cc22f27194b1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -27,16 +30,16 @@ After you have created the package root directory, you can begin sequencing appl
     **Important**  
     The name you assign to virtual application files that will be saved in the package root directory should use the 8.3 naming format. The file names should be no longer than 8 characters with a three-character file name extension.
 
-     
+     
 
 ## Related topics
 
 
 [Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md b/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md
index 84092cee4d..b745ddf86a 100644
--- a/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md
+++ b/mdop/appv-v4/how-to-create-the-sequencer-package-root-directory.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create the Sequencer Package Root Directory
 description: How to Create the Sequencer Package Root Directory
-author: jamiejdt
+author: dansimp
 ms.assetid: 23fe28f1-c284-43ee-b8b7-1dfbed94eea5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -27,7 +30,7 @@ After you have created the package root directory, you can begin sequencing appl
     **Important**  
     The name you assign to virtual application files that will be saved in the package root directory should use the 8.3 naming format. The file names should be no longer than 8 characters with a three-character file name extension.
 
-     
+     
 
 ## Related topics
 
@@ -38,9 +41,9 @@ After you have created the package root directory, you can begin sequencing appl
 
 [How to Modify the Scratch Directory Location](how-to-modify-the-scratch-directory-location.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md b/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md
index e35e881bb5..f1e04f6d1e 100644
--- a/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md
+++ b/mdop/appv-v4/how-to-customize-an-application-virtualization-system-in-the-server-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Customize an Application Virtualization System in the Server Management Console
 description: How to Customize an Application Virtualization System in the Server Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: e3a51d1d-451d-46a5-8ae5-f5792d49495b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-delete-a-file-type-association.md b/mdop/appv-v4/how-to-delete-a-file-type-association.md
index 4c11d9bcec..16c96b8513 100644
--- a/mdop/appv-v4/how-to-delete-a-file-type-association.md
+++ b/mdop/appv-v4/how-to-delete-a-file-type-association.md
@@ -1,12 +1,15 @@
 ---
 title: How to Delete a File Type Association
 description: How to Delete a File Type Association
-author: jamiejdt
+author: dansimp
 ms.assetid: bb2dd1cf-9a5d-45a9-aca1-3c53144b73ec
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-delete-a-package-version.md b/mdop/appv-v4/how-to-delete-a-package-version.md
index c4ae2a7bd8..c1d92e1264 100644
--- a/mdop/appv-v4/how-to-delete-a-package-version.md
+++ b/mdop/appv-v4/how-to-delete-a-package-version.md
@@ -1,12 +1,15 @@
 ---
 title: How to Delete a Package Version
 description: How to Delete a Package Version
-author: jamiejdt
+author: dansimp
 ms.assetid: a55adb9d-ffa6-4df3-a2d1-5e0c73c35e1b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ From the Application Virtualization Server Management Console, for a package tha
 **Note**  
 When you choose to delete a version, a confirmation box reminds you that client computers might still be using it. You should advise users to exit and unload any applications before you remove a version that is in use.
 
- 
+ 
 
 **To delete a package version**
 
@@ -34,7 +37,7 @@ When you choose to delete a version, a confirmation box reminds you that client
     **Note**  
     If you have users in disconnected operation, their applications will be replaced with the new versions the next time they connect to the servers. After you are sure all users have updated applications, you can delete old versions.
 
-     
+     
 
 ## Related topics
 
@@ -43,9 +46,9 @@ When you choose to delete a version, a confirmation box reminds you that client
 
 [How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-delete-a-packageserver.md b/mdop/appv-v4/how-to-delete-a-packageserver.md
index 3d38149924..7f2bd13bae 100644
--- a/mdop/appv-v4/how-to-delete-a-packageserver.md
+++ b/mdop/appv-v4/how-to-delete-a-packageserver.md
@@ -1,12 +1,15 @@
 ---
 title: How to Delete a Package
 description: How to Delete a Package
-author: jamiejdt
+author: dansimp
 ms.assetid: 23f9c0e9-8910-47df-9fc0-7bbb5bbf2dc9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can use the following procedure to delete a package, including all versions
 **Important**  
 When you choose to delete a package, a confirmation box reminds you that this action deletes all its versions. The server will no longer be able to stream the application.
 
- 
+ 
 
 **To delete a package**
 
@@ -36,9 +39,9 @@ When you choose to delete a package, a confirmation box reminds you that this ac
 
 [How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-delete-a-reportserver.md b/mdop/appv-v4/how-to-delete-a-reportserver.md
index 672580ca14..14ac327bbf 100644
--- a/mdop/appv-v4/how-to-delete-a-reportserver.md
+++ b/mdop/appv-v4/how-to-delete-a-reportserver.md
@@ -1,12 +1,15 @@
 ---
 title: How to Delete a Report
 description: How to Delete a Report
-author: jamiejdt
+author: dansimp
 ms.assetid: 53350b71-1fb5-4f7e-a684-9ea1116c5c3f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md b/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md
index 5d362ad27f..1fdb2c31c6 100644
--- a/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md
+++ b/mdop/appv-v4/how-to-delete-all-virtual-applications-by-using-the-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: How to Delete All Virtual Applications by Using the Command Line
 description: How to Delete All Virtual Applications by Using the Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: bfe13b5c-825a-4eb1-a979-6c4b8d8b2a9c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can use the following procedure to delete all virtual applications from a sp
 **Note**  
 When all applications are deleted from a package, the Application Virtualization (App-V) Client also deletes the package.
 
- 
+ 
 
 **To delete all applications**
 
@@ -30,7 +33,7 @@ When all applications are deleted from a package, the Application Virtualization
     **Note**  
     When all applications are deleted from a package, the Application Virtualization (App-V) Client also deletes the package.
 
-     
+     
 
 ## Related topics
 
@@ -39,9 +42,9 @@ When all applications are deleted from a package, the Application Virtualization
 
 [How to Remove a Package by Using the Command Line](how-to-remove-a-package-by-using-the-command-line.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-delete-an-administrator-group.md b/mdop/appv-v4/how-to-delete-an-administrator-group.md
index 06eff4cec6..d538220e01 100644
--- a/mdop/appv-v4/how-to-delete-an-administrator-group.md
+++ b/mdop/appv-v4/how-to-delete-an-administrator-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Delete an Administrator Group
 description: How to Delete an Administrator Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 398a8028-e128-4020-bbe2-59ba63b5cd48
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-delete-an-application-server.md b/mdop/appv-v4/how-to-delete-an-application-server.md
index 7c0af9be22..55f77b412f 100644
--- a/mdop/appv-v4/how-to-delete-an-application-server.md
+++ b/mdop/appv-v4/how-to-delete-an-application-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Delete an Application
 description: How to Delete an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 421e7df0-fea3-4cb2-a884-3d04f2223da7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can delete an application through the Application Virtualization Server Mana
 **Note**  
 If this is the only application in a package, deleting it also removes related package data and file associations.
 
- 
+ 
 
 **To delete an application**
 
@@ -38,9 +41,9 @@ If this is the only application in a package, deleting it also removes related p
 
 [How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-delete-an-application.md b/mdop/appv-v4/how-to-delete-an-application.md
index 50130374b0..c1e441347c 100644
--- a/mdop/appv-v4/how-to-delete-an-application.md
+++ b/mdop/appv-v4/how-to-delete-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Delete an Application
 description: How to Delete an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 03b0912d-b14a-4522-916d-71f8b77a8a82
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ When you delete an application, the selected application will no longer be avail
 
 After a publishing refresh, the deleted applications will again become available to you.
 
- 
+ 
 
 **To delete an application**
 
@@ -29,9 +32,9 @@ After a publishing refresh, the deleted applications will again become available
 
 2.  At the confirmation prompt, click **Yes** to remove the application or click **No** to cancel the operation.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-deny-access-to-an-application.md b/mdop/appv-v4/how-to-deny-access-to-an-application.md
index 8c29d340d0..1dd6b7fdf5 100644
--- a/mdop/appv-v4/how-to-deny-access-to-an-application.md
+++ b/mdop/appv-v4/how-to-deny-access-to-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deny Access to an Application
 description: How to Deny Access to an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 14f5e201-7265-462c-b738-57938dc3fc30
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -29,7 +32,7 @@ Users must be in an application's **Access Permissions** list to load and use th
     **Note**  
     To control access to applications, you can also limit the application licenses. Setting up the proper user groups in Active Directory Domain Services provides the easiest way to grant and deny access to specific sets of users.
 
-     
+     
 
 ## Related topics
 
@@ -40,9 +43,9 @@ Users must be in an application's **Access Permissions** list to load and use th
 
 [How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md b/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md
index b3eea268fd..6fda63581a 100644
--- a/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md
+++ b/mdop/appv-v4/how-to-determine-whether-to-edit-or-upgrade-a-virtual-application-package.md
@@ -1,12 +1,15 @@
 ---
 title: How to Determine Whether to Edit or Upgrade a Virtual Application Package
 description: How to Determine Whether to Edit or Upgrade a Virtual Application Package
-author: jamiejdt
+author: dansimp
 ms.assetid: 33dd5332-6802-46e0-9748-43fcc8f80aa3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md b/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md
index da0b38d834..5394ec7bb3 100644
--- a/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md
+++ b/mdop/appv-v4/how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)
 description: How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 936abee2-98f1-45fb-9f0d-786e1d7464b1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -38,31 +41,31 @@ Use the following table to determine which type of application you should sequen
 
 
      Standard
      
 
      Select this option to create a package that contains an application or a suite of applications. You should select this option for most applications that you plan to sequence.
      
-
      [How to Sequence a New Standard Application (App-V 4.6 SP1)](how-to-sequence-a-new-standard-application--app-v-46-sp1-.md)
      
+
      How to Sequence a New Standard Application (App-V 4.6 SP1)
      
 
 
 
      Add-on or Plug-in
      
-
      Select this option to create a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or another package that is linked by using Dynamic Suite Composition. For more information about Dynamic Suite Composition, see [How To Use Dynamic Suite Composition](https://go.microsoft.com/fwlink/?LinkId=203804) (https://go.microsoft.com/fwlink/?LinkId=203804).
      
-
      [How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1)](how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md)
      
+
      Select this option to create a package that extends the functionality of a standard application, for example, a plug-in for Microsoft Excel. Additionally, you can use plug-ins for natively installed applications, or another package that is linked by using Dynamic Suite Composition. For more information about Dynamic Suite Composition, see How To Use Dynamic Suite Composition (https://go.microsoft.com/fwlink/?LinkId=203804).
      
+
      How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1)
      
 
 
 
      Middleware
      
-
      Select this option to create a package that is required by a standard application, for example, the Microsoft .NET Framework. Middleware packages are used for linking to other packages by using Dynamic Suite Composition. For more information about Dynamic Suite Composition, see [How To Use Dynamic Suite Composition](https://go.microsoft.com/fwlink/?LinkId=203804) (https://go.microsoft.com/fwlink/?LinkId=203804).
      
-
      [How to Sequence a New Middleware Application (App-V 4.6 SP1)](how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md)
      
+
      Select this option to create a package that is required by a standard application, for example, the Microsoft .NET Framework. Middleware packages are used for linking to other packages by using Dynamic Suite Composition. For more information about Dynamic Suite Composition, see How To Use Dynamic Suite Composition (https://go.microsoft.com/fwlink/?LinkId=203804).
      
+
      How to Sequence a New Middleware Application (App-V 4.6 SP1)
      
 
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md b/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md
index d76c9ba4a8..fc1d34c067 100644
--- a/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md
+++ b/mdop/appv-v4/how-to-disable-or-modify-disconnected-operation-mode-settings.md
@@ -1,12 +1,15 @@
 ---
 title: How to Disable or Modify Disconnected Operation Mode Settings
 description: How to Disable or Modify Disconnected Operation Mode Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: 39f166d7-2d25-4899-8405-b45f051facb8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md b/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md
index 531239f910..822fe72dd9 100644
--- a/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md
+++ b/mdop/appv-v4/how-to-edit-an-existing-virtual-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Edit an Existing Virtual Application
 description: How to Edit an Existing Virtual Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 358b9a69-5695-4c6f-92e1-7ed2b69a2def
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md b/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md
index 2b183ba29a..41b7631eb1 100644
--- a/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md
+++ b/mdop/appv-v4/how-to-edit-an-osd-file-using-a-text-editor.md
@@ -1,12 +1,15 @@
 ---
 title: How to Edit an OSD File Using a Text Editor
 description: How to Edit an OSD File Using a Text Editor
-author: jamiejdt
+author: dansimp
 ms.assetid: f4263a1b-824f-49b9-8060-b8229c9d9960
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,7 +26,7 @@ Use the following procedure to edit an Open Software Descriptor (OSD) file by us
     **Note**  
     Before modifying the OSD file, read the schema prescribed by the XSD file in the install directory. Failing to follow this schema might introduce errors that prevent a sequenced application from starting successfully.
 
-     
+     
 
 2.  Edit the OSD file using your XML or ASCII text editor of choice, adhering to the prescribed schema and the following guidelines:
 
@@ -44,9 +47,9 @@ Use the following procedure to edit an Open Software Descriptor (OSD) file by us
 
 [OSD File Elements](osd-file-elements.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-edit-an-osd-file.md b/mdop/appv-v4/how-to-edit-an-osd-file.md
index 547645c46f..6f19e9a7b7 100644
--- a/mdop/appv-v4/how-to-edit-an-osd-file.md
+++ b/mdop/appv-v4/how-to-edit-an-osd-file.md
@@ -1,12 +1,15 @@
 ---
 title: How to Edit an OSD File
 description: How to Edit an OSD File
-author: jamiejdt
+author: dansimp
 ms.assetid: 0d126ba7-72fb-42ce-982e-90ed01a852c8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -17,14 +20,14 @@ ms.date: 06/16/2016
 Use the following procedures to modify a sequenced application package's Open Software Descriptor (OSD) file by adding or deleting an element or an attribute.
 
 **Note**  
-  Some elements do not have an attribute, so it is not possible to add an attribute to every element.
+  Some elements do not have an attribute, so it is not possible to add an attribute to every element.
 
- 
+ 
 
 **Important**  
 If you use the OSD editor to change the .sft file name, the HREF attribute of the CODEBASE element in the OSD file, you must use the **Save As** command to save the change to the project files.
 
- 
+ 
 
 **To add an element**
 
@@ -79,9 +82,9 @@ If you use the OSD editor to change the .sft file name, the HREF attribute of th
 
 [Sequencer Console](sequencer-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md b/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md
index 43590eea76..480c2d8d34 100644
--- a/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md
+++ b/mdop/appv-v4/how-to-exit-the-app-v-client-from-the-notification-area.md
@@ -1,12 +1,15 @@
 ---
 title: How to Exit the App-V Client from the Notification Area
 description: How to Exit the App-V Client from the Notification Area
-author: jamiejdt
+author: dansimp
 ms.assetid: 71ebf88b-ef51-41a5-ae34-4e197d9d6ee6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-export-a-reportserver.md b/mdop/appv-v4/how-to-export-a-reportserver.md
index 2f32510db2..f7eb70e1aa 100644
--- a/mdop/appv-v4/how-to-export-a-reportserver.md
+++ b/mdop/appv-v4/how-to-export-a-reportserver.md
@@ -1,12 +1,15 @@
 ---
 title: How to Export a Report
 description: How to Export a Report
-author: jamiejdt
+author: dansimp
 ms.assetid: 2f917130-db02-4c72-a45a-7928e51e689e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-grant-access-to-an-application.md b/mdop/appv-v4/how-to-grant-access-to-an-application.md
index a11e351cd0..89a6cf8277 100644
--- a/mdop/appv-v4/how-to-grant-access-to-an-application.md
+++ b/mdop/appv-v4/how-to-grant-access-to-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Grant Access to an Application
 description: How to Grant Access to an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: e54d9e84-21f5-488f-b040-25f374d9289f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -33,7 +36,7 @@ As the administrator, you can use the Application Virtualization Server Manageme
     **Note**  
     You must set up your groups in Active Directory Domain Services before you attempt to grant access to applications.
 
-     
+     
 
 ## Related topics
 
@@ -46,9 +49,9 @@ As the administrator, you can use the Application Virtualization Server Manageme
 
 [How to Manually Add an Application](how-to-manually-add-an-application.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-import-an-application.md b/mdop/appv-v4/how-to-import-an-application.md
index ad86691bbc..2fc950a033 100644
--- a/mdop/appv-v4/how-to-import-an-application.md
+++ b/mdop/appv-v4/how-to-import-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Import an Application
 description: How to Import an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 85aaf5d8-489c-4929-996f-f15d2dab1ad8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -25,11 +28,11 @@ You can use the following procedure to import an application into the cache dire
     **Note**  
     If you have already configured an import search path or if the SFT file is in the same path as the last successful import, step 2 is not required.
 
-     
+     
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-import-an-applicationserver.md b/mdop/appv-v4/how-to-import-an-applicationserver.md
index 499d7f4655..66852c68c1 100644
--- a/mdop/appv-v4/how-to-import-an-applicationserver.md
+++ b/mdop/appv-v4/how-to-import-an-applicationserver.md
@@ -1,12 +1,15 @@
 ---
 title: How to Import an Application
 description: How to Import an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: ab40acad-1025-478d-8e13-0e1ff1bd37e4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Typically, you import applications to make them available to stream from an Appl
 **Note**  
 To import an application, you must have its sequenced Open Software Descriptor (OSD) file or its Sequencer Project (SPRJ) file available on the server.
 
- 
+ 
 
 When importing an application, you should make sure the server is configured with a value in the **Default Content Path** field on the **General** tab of the **System Options** dialog (accessible by right-clicking the **Application Virtualization System** node in the App-V Server Console). The default content path value defines where the applications will be imported, and during the import process, this value is used to modify the paths defined in the OSD file for the SFT file and for the icon shortcuts. In the OSD file, the path for the SFT file is specified in the CODEBASE HREF entry and the path for the icons is specified in the SHORTCUTS entry.
 
@@ -40,14 +43,14 @@ During the import process, the protocol, server, and, if present, port specified
 
 
 
-
      \\server\content\
      
-
      http://WebServer/myFolder/package.sft
      
-
      \\server\content\myFolder\package.sft
      
+
      \server\content</p>
+
      http://WebServer/myFolder/package.sft
      
+
      \server\content\myFolder\package.sft
      
 
 
 
 
- 
+ 
 
 **To import an application**
 
@@ -68,7 +71,7 @@ During the import process, the protocol, server, and, if present, port specified
     **Note**  
     Applications sequenced with Sequencer 4.0 populate the **File Associations** dialog box when you import or create them through the management console. Applications with previous Sequencer version packages do not.
 
-     
+     
 
 8.  Click **Next**.
 
@@ -89,9 +92,9 @@ During the import process, the protocol, server, and, if present, port specified
 
 [How to Manually Add an Application](how-to-manually-add-an-application.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-install-a-database.md b/mdop/appv-v4/how-to-install-a-database.md
index 9068458e9b..da440a18ff 100644
--- a/mdop/appv-v4/how-to-install-a-database.md
+++ b/mdop/appv-v4/how-to-install-a-database.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install a Database
 description: How to Install a Database
-author: jamiejdt
+author: dansimp
 ms.assetid: 52e3a19d-b7cf-4f2c-8268-0f8361cc9766
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ You can use the following procedure to install a database for your server-based
 **Important**  
 To install the database, you must use a network account with the appropriate permissions. If your organization requires that only database administrators are allowed to create and conduct database upgrades, scripts are available that allow this task to be performed.
 
- 
+ 
 
 **To install a database**
 
@@ -38,7 +41,7 @@ To install the database, you must use a network account with the appropriate per
     **Note**  
     If a component is already installed on the computer, by deselecting it on the **Custom Setup** screen it will automatically be uninstalled.
 
-     
+     
 
 7.  On the **Database Server** page, type the passwords, assign an installation path, save the information, and click **Next**.
 
@@ -47,44 +50,44 @@ To install the database, you must use a network account with the appropriate per
     **Note**  
     If error 25109 is displayed when you try to complete this step, you have incorrectly set up the permissions necessary to install the database. For details on setting up the necessary SQL permissions, please see .
 
-     
+     
 
 9.  On the **Directory Server** screen, enter a domain name and credentials that Application Virtualization Servers and the Management Web Service will use to access your domain controller, save this information, and then click **Next**.
 
     **Note**  
     The installation will default to the domain of the current computer.
 
-     
+     
 
 10. On the **Administrator Group** page, enter the name of a group that will have Administrator privileges, save this information, and then click **Next**.
 
     **Note**  
     You can also enter the first few characters of the name of a group that will have Administration privileges, click **Next**, and on the **Select Administrator Group** screen, select the group from the resulting list. Then save this information and click **Next**.
 
-     
+     
 
 11. On the **Default Provider Group** page, enter the complete name of a group that will control access to applications, save this information, and then click **Next**.
 
     **Note**  
     You can also enter the first few characters of the name of a group that will control access to applications, click **Next**, and on the **Select Default Provider Group** screen, select the group in the list. Then save this information and click **Next**.
 
-     
+     
 
 12. On the **Installation Wizard Completed** page, to close the wizard, click **Finish**.
 
     **Important**  
     The installation can take a few minutes to finish. A status message will flash above the Windows desktop notification area, indicating whether the installation succeeded.
 
-     
+     
 
 ## Related topics
 
 
 [How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md b/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md
index bd6c0e94d6..ba2ed5bf33 100644
--- a/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md
+++ b/mdop/appv-v4/how-to-install-and-configure-the-app-v-management-console-for-a-more-secure-environment.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install and Configure the App-V Management Console for a More Secure Environment
 description: How to Install and Configure the App-V Management Console for a More Secure Environment
-author: jamiejdt
+author: dansimp
 ms.assetid: 9d89ef09-cdbf-48fc-99da-b24fc987ef8f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -27,7 +30,7 @@ The default installation of the App-V Management Console includes support for se
     **Important**  
     The name provided in the Web Service Host Name must match the common name on the certificate, or the connection will fail.
 
-     
+     
 
 4.  Select the appropriate login credentials, and click **OK**.
 
@@ -36,9 +39,9 @@ The default installation of the App-V Management Console includes support for se
 
 [Configuring Certificates to Support the App-V Web Management Service](configuring-certificates-to-support-the-app-v-web-management-service.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-install-and-configure-the-default-application.md b/mdop/appv-v4/how-to-install-and-configure-the-default-application.md
index 3ab24bffab..529a24aadc 100644
--- a/mdop/appv-v4/how-to-install-and-configure-the-default-application.md
+++ b/mdop/appv-v4/how-to-install-and-configure-the-default-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install and Configure the Default Application
 description: How to Install and Configure the Default Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 5c5d5ad1-af40-4f83-8234-39e972f2c29a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -33,7 +36,7 @@ Use the following procedures to publish the default application and to stream it
     **Note**  
     You can also use **localhost** for the Web Service Host name if it is installed on the Management Server.
 
-     
+     
 
 6.  In the App-V Management Console, right-click the **Server** node, and click **System Options**.
 
@@ -42,7 +45,7 @@ Use the following procedures to publish the default application and to stream it
     **Important**  
     Use the FQDN for the server name so that the client can resolve the name correctly.
 
-     
+     
 
 8.  In the App-V Management Console, in the navigation pane, expand the **Server** node, and then click **Applications**.
 
@@ -55,7 +58,7 @@ Use the following procedures to publish the default application and to stream it
     **Important**  
     Ensure that the values in both the **OSD Path** and **Icon Path** boxes are in UNC format (for example, \\\\<Server Name>\\Content\\DefaultApp.ico), and point to the Content folder you created when installing the server. Do not use **localhost** or a file path containing a drive letter such as C:\\Program Files\\..\\..\\Content.
 
-     
+     
 
 12. Select the DefaultApp.osd file, and click **Open**.
 
@@ -71,11 +74,11 @@ Use the following procedures to publish the default application and to stream it
 
 18. Locate the line that contains the **HREF** tag, and change it to the following code:
 
-         `CODEBASEHREF=”RTSP://:554/DefaultApp.sft”`
+         `CODEBASEHREF=”RTSP://:554/DefaultApp.sft”`
 
     Or, if you are using RTSPS:
 
-         `CODEBASEHREF=”RTSPS://:322/DefaultApp.sft”`
+         `CODEBASEHREF=”RTSPS://:322/DefaultApp.sft”`
 
 19. Close the DefaultApp.osd file, and save the changes.
 
@@ -92,9 +95,9 @@ Use the following procedures to publish the default application and to stream it
 
 [How to Configure Servers for Server-Based Deployment](how-to-configure-servers-for-server-based-deployment.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-install-application-virtualization-management-server.md b/mdop/appv-v4/how-to-install-application-virtualization-management-server.md
index 1ce9715315..9fff92bc25 100644
--- a/mdop/appv-v4/how-to-install-application-virtualization-management-server.md
+++ b/mdop/appv-v4/how-to-install-application-virtualization-management-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install Application Virtualization Management Server
 description: How to Install Application Virtualization Management Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 8184be79-8c27-4328-a3c1-183791b5556c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -18,10 +21,10 @@ The Application Virtualization Management Server publishes its applications to c
 
 If you have designated a target computer on the network, with a login account having local Administrator privileges, you can use the following procedure to install the Application Virtualization Management Server and assign it to the appropriate server group.
 
-**Note**  
+**Note**  
 The Installation Wizard can create a server group record, if one does not exist, as well as a record of the Application Virtualization Management Server's membership in this group.
 
- 
+
 
 After you complete the installation process, reboot the server.
 
@@ -39,40 +42,42 @@ After you complete the installation process, reboot the server.
 
 6.  On the **Setup Type** page, select **Custom**. Click **Next**. On the **Custom Setup** page, deselect all Application Virtualization System components except **Application Virtualization Server**, and then click **Next**.
 
-    **Caution**  
+    **Caution**  
     If a component is already installed on the computer, when you deselect it in the **Custom Setup** window, the component is automatically uninstalled.
 
-     
+
 
 7.  On the **Configuration Database** page, select a database server from the list of available servers or add a server by selecting **Use the following host name** and specifying the **Server Name** and **Port Number** data. Click **Next**.
 
-    **Note**  
+    **Note**  
     The Application Virtualization Management Server does not support case sensitive SQL.
 
-     
 
-    If a database is available, click the radio button, select the database from the list, and then click **Next**. Setup will upgrade it to this newer version. If the name does not appear in the list, enter the name in the space provided.
 
-    **Note**  
-    When naming a server, do not use the backslash character (/) in the server name.
+~~~
+If a database is available, click the radio button, select the database from the list, and then click **Next**. Setup will upgrade it to this newer version. If the name does not appear in the list, enter the name in the space provided.
 
-    If you need to install a database, see [How to Install a Database](how-to-install-a-database.md). If you would like to create a new database for this version, select **Create a new database** and specify the name that will be assigned to the new database. You can also specify a new location for the database by selecting the check box and entering the path.
+**Note**  
+When naming a server, do not use the backslash character (/) in the server name.
 
-     
+If you need to install a database, see [How to Install a Database](how-to-install-a-database.md). If you would like to create a new database for this version, select **Create a new database** and specify the name that will be assigned to the new database. You can also specify a new location for the database by selecting the check box and entering the path.
+~~~
 
-8.  On the **Connection Security Mode** page, select the desired certificate from the drop-down list. Click **Next**.
 
-    **Note**  
-    The **Secure Connection Mode** setting requires the server to have a server certificate provisioned to it from a public key infrastructure. If a server certificate is not installed on the server, this option is unavailable and cannot be selected. You must grant the Network Service account read access to the certificate being used.
 
-     
+8. On the **Connection Security Mode** page, select the desired certificate from the drop-down list. Click **Next**.
 
-9.  On the **TCP Port Configuration** page, to use the default port (554), select **Use default port (554)**. To specify a custom port, select **Use custom port** and specify the port number that will be used. Click **Next**.
+   **Note**  
+   The **Secure Connection Mode** setting requires the server to have a server certificate provisioned to it from a public key infrastructure. If a server certificate is not installed on the server, this option is unavailable and cannot be selected. You must grant the Network Service account read access to the certificate being used.
+
+
+
+9. On the **TCP Port Configuration** page, to use the default port (554), select **Use default port (554)**. To specify a custom port, select **Use custom port** and specify the port number that will be used. Click **Next**.
+
+   **Note**  
+   When you install the server in a nonsecure environment, you can use the default port (554) or you can define a custom port.
 
-    **Note**  
-    When you install the server in a nonsecure environment, you can use the default port (554) or you can define a custom port.
 
-     
 
 10. On the **Administrator Group** page, specify the name of the security group authorized to manage this server in **Group Name**. Click **Next**. Confirm the group specified and click **Next**.
 
@@ -80,37 +85,37 @@ After you complete the installation process, reboot the server.
 
 12. On the **Content Path** page, specify the location on the target computer where SFT files will be saved, and then click **Next**.
 
-    **Note**  
-    If the HTTP or RTSP port for the Management Server is already allocated, you will be prompted to choose a new port. Select the desired port, and then click **Next**.
+   **Note**  
+   If the HTTP or RTSP port for the Management Server is already allocated, you will be prompted to choose a new port. Select the desired port, and then click **Next**.
+
 
-     
 
 13. On the **Ready to Install the Program** page, to install the Application Virtualization Management Server, click **Install**.
 
-    **Note**  
-    If error 25120 is displayed when you try to complete this step, you need to enable IIS **Management Scripts and Tools**. To enable this Windows feature, open the **Programs and Features** control panel, select **Turn Windows features on or off**, and navigate to **Internet Information Services.**
+   **Note**  
+   If error 25120 is displayed when you try to complete this step, you need to enable IIS **Management Scripts and Tools**. To enable this Windows feature, open the **Programs and Features** control panel, select **Turn Windows features on or off**, and navigate to **Internet Information Services.**
+
+   Under **Web Management Tools**, enable **IIS Management Scripts and Tools**.
 
-    Under **Web Management Tools**, enable **IIS Management Scripts and Tools**.
 
-     
 
 14. On the **Installation Wizard Completed** screen, to close the wizard, click **Finish**.
 
-    **Important**  
-    The installation can take a few minutes to finish. A status message will flash above the Windows desktop notification area, indicating that the installation succeeded.
+   **Important**  
+   The installation can take a few minutes to finish. A status message will flash above the Windows desktop notification area, indicating that the installation succeeded.
+
+   It is not necessary to reboot the computer when prompted. However, to optimize system performance, a reboot is recommended.
 
-    It is not necessary to reboot the computer when prompted. However, to optimize system performance, a reboot is recommended.
 
-     
 
 ## Related topics
 
 
 [How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md b/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md
index 39fa69f86b..37596836cd 100644
--- a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md
+++ b/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupexe-new.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the App-V Client by Using Setup.exe
 description: How to Install the App-V Client by Using Setup.exe
-author: jamiejdt
+author: dansimp
 ms.assetid: 106a5d97-b5f6-4a16-bf52-a84f4d558c74
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md b/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md
index 66e297f4d5..5485cfe6f6 100644
--- a/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md
+++ b/mdop/appv-v4/how-to-install-the-app-v-client-by-using-setupmsi-new.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the App-V Client by Using Setup.msi
 description: How to Install the App-V Client by Using Setup.msi
-author: jamiejdt
+author: dansimp
 ms.assetid: 7221f384-36d6-409a-94a2-86f54fd75322
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -24,22 +27,22 @@ You can use the following procedures to install the prerequisite software. You c
 **Note**  
 The x86 versions of the following software are required for both x86 and x64 versions of the App-V client.
 
- 
+ 
 
 **To install Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)**
 
-1.  Download the [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) software package from the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=119961). \[Template Token Value\] For version 4.5 SP2 and later of the App-V client, download vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360).\[Template Token Value\]
+1. Download the [Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=119961) software package from the Microsoft Download Center (). \[Template Token Value\] For version 4.5 SP2 and later of the App-V client, download vcredist\_x86.exe from [Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package ATL Security Update](https://go.microsoft.com/fwlink/?LinkId=169360) (https://go.microsoft.com/fwlink/?LinkId=169360).\[Template Token Value\]
 
-2.  To install silently, use the command-line option “/Q” with vcredist\_x86.exe—for example, **vcredist\_x86.exe /Q**.
+2. To install silently, use the command-line option “/Q” with vcredist\_x86.exe—for example, **vcredist\_x86.exe /Q**.
 
-3.  To install the software by using the vcredist\_x86.msi file, use the command-line option “/C /T:<fullpathtofolder>” to extract the files vcredist.msi and vcredis1.cab from vcredist\_x86.exe to a temporary folder. To install silently, use the command-line option /quiet—for example, **msiexec /i vcredist.msi** /quiet.
+3. To install the software by using the vcredist\_x86.msi file, use the command-line option “/C /T:<fullpathtofolder>” to extract the files vcredist.msi and vcredis1.cab from vcredist\_x86.exe to a temporary folder. To install silently, use the command-line option /quiet—for example, **msiexec /i vcredist.msi** /quiet.
 
 ### To install Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)
 
 **Important**  
 For version 4.6 and later of the App-V client, you must also install the Microsoft Visual C++ 2008 Service Pack 1 Redistributable Package ATL Security Update.
 
- 
+ 
 
 ****
 
@@ -62,7 +65,7 @@ When installing Microsoft Application Error Reporting, you must use the *APPGUID
 **Important**  
 For App-V 4.6 SP2 and later, you no longer need to install Microsoft Application Error Reporting (dw20shared.msi). App-V now uses Microsoft Error Reporting.
 
- 
+ 
 
 @@ -126,14 +129,14 @@ For App-V 4.6 SP2 and later, you no longer need to install Microsoft Applicati
 
      
 

 
      
 
- 
+ 
 
 ¹ App-V “Languages” release.
 
 **Note**  
 If you need to find the product code, you can use the Orca.exe database editor or a similar tool to examine Windows Installer files to find the value of the *ProductCode* property. For more information about using Orca.exe, see [Windows Installer Development Tools](https://go.microsoft.com/fwlink/?LinkId=150008) (https://go.microsoft.com/fwlink/?LinkId=150008).
 
- 
+ 
 
 ****
 
@@ -141,7 +144,7 @@ If you need to find the product code, you can use the Orca.exe database editor o
 
 2.  To install the software, run the following command:
 
-         **msiexec /i dw20shared.msi APPGUID={valuefromtable} REBOOT=Suppress REINSTALL=ALL REINSTALLMODE=vomus**
+         **msiexec /i dw20shared.msi APPGUID={valuefromtable} REBOOT=Suppress REINSTALL=ALL REINSTALLMODE=vomus**
 
 ## Installing the App-V Client by Using the Setup.msi Program
 
@@ -167,16 +170,16 @@ Use the following procedure to install the App-V client. Ensure that any necessa
 
     -   To turn on installation logging, use the msiexec switch **/l\*v filename.log**.
 
-     
+     
 
 ## Related topics
 
 
 [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md b/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md
index 07a3629e4f..5cf9e908d7 100644
--- a/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md
+++ b/mdop/appv-v4/how-to-install-the-application-virtualization-sequencer.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the Application Virtualization Sequencer
 description: How to Install the Application Virtualization Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: 89cdf60d-18b0-4204-aa9f-b402610f8f0e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ You must have administrative rights on the computer you are using to sequence th
 **Important**  
 After you have sequenced an application, before you can properly sequence a new application you must reinstall the operating system and the Sequencer on the computer you are using to sequence applications.
 
- 
+ 
 
 **To install the Microsoft Application Virtualization Sequencer**
 
@@ -46,9 +49,9 @@ After you have sequenced an application, before you can properly sequence a new
 
 [Application Virtualization Deployment Requirements](application-virtualization-deployment-requirements.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md b/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md
index 7f24b3d96d..b6facad249 100644
--- a/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md
+++ b/mdop/appv-v4/how-to-install-the-application-virtualization-streaming-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the Application Virtualization Streaming Server
 description: How to Install the Application Virtualization Streaming Server
-author: jamiejdt
+author: dansimp
 ms.assetid: a3065257-fb5a-4d92-98f8-7ef996c61db9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ If you have designated a target computer on the network, with a logon account ha
 **Note**  
 The Installation Wizard can create a server group record, if one does not exist, and a record of the Application Virtualization Streaming Server membership in this group.
 
- 
+ 
 
 After you complete the installation process, restart the server.
 
@@ -32,7 +35,7 @@ After you complete the installation process, restart the server.
     **Important**  
     Make sure that the App-V Management Server is not installed on this computer. The two products cannot be installed on the same computer.
 
-     
+     
 
 2.  Navigate to the location of the Application Virtualization System Setup program on the network, either run this program from the network or copy its directory to the target computer, and then double-click the **Setup.exe** file.
 
@@ -49,21 +52,21 @@ After you complete the installation process, restart the server.
     **Note**  
     The **Secure Connection Mode** setting requires the server to have a server certificate provisioned to it from a public key infrastructure. If a server certificate is not installed on the server, this option is unavailable and cannot be selected. You must grant the Network Service account read access to the certificate being used.
 
-     
+     
 
 8.  On the **TCP Port Configuration** page, to use the standard port (554), select **Use default port (554)**. To specify a custom port, select **Use custom port**, specify the port number in the field provided, and then click **Next**.
 
     **Note**  
     When you install the server in a nonsecure scenario, you can use the default port (554), or you can define a custom port.
 
-     
+     
 
 9.  On the **Content Root** page, specify the location on the target computer where SFT files will be saved, and then click **Next**.
 
     **Note**  
     If the HTTP or RTSP port for the Virtual Application Streaming Server is already allocated, you will be prompted to select a new port. Specify the desired port, and then click **Next**.
 
-     
+     
 
 10. On the **Advanced Setting** screen, enter the following information:
 
@@ -90,7 +93,7 @@ After you complete the installation process, restart the server.
     **Note**  
     The App-V Streaming Server uses NTFS file system permissions to control access to the applications under the Content share. Use **Enable User authentication** and **Enable User authorization** to control whether the server checks and enforces those access control lists (ACLs) or not.
 
-     
+     
 
 11. On the **Ready to Install the Program** page, to start the installation, click **Install**.
 
@@ -101,7 +104,7 @@ After you complete the installation process, restart the server.
 
     It is not required to restart the computer when you are prompted. However, to optimize system performance, we recommend a restart.
 
-     
+     
 
 13. Repeat Steps 1–12 for each Virtual Application Server that you have to install.
 
@@ -110,9 +113,9 @@ After you complete the installation process, restart the server.
 
 [How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md b/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md
index a5d11fe84d..69e3331059 100644
--- a/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md
+++ b/mdop/appv-v4/how-to-install-the-client-by-using-the-command-line-new.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the Client by Using the Command Line
 description: How to Install the Client by Using the Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: ed372403-64ff-48ff-a3cd-a46cad04a4d5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -21,21 +24,21 @@ You can use optional command-line parameters to apply specific configuration set
 **Note**  
 When you install the App-V client to use with a read-only cache, for example with a VDI server implementation, you must set the *AUTOLOADTARGET* parameter to NONE to prevent the client from trying to update applications when the cache is read-only.
 
- 
+ 
 
 For more information about setting these parameter values after installation, see [How to Configure the App-V Client Registry Settings by Using the Command Line](https://go.microsoft.com/fwlink/?LinkId=169355) (https://go.microsoft.com/fwlink/?LinkId=169355) in the Application Virtualization (App-V) Operations Guide.
 
 **Note**  
 If a configuration setting on the user’s computer depends on the client installation path, note that the Application Virtualization (App-V) 4.5 client copies its installation files to a different folder than previous versions did. By default, a new installation of the App-V 4.5 client will copy its installation files to the \\Program Files\\Microsoft Application Virtualization Client folder. If an earlier version of the client is already installed, running the App-V 4.5 client installer will perform an upgrade of the existing client using the existing installation folder.
 
- 
+ 
 
 \[Template Token Value\]
 
 **Note**  
 For App-V version 4.6 and later, when the App-V client is installed, SFTLDR.DLL is copied to the Windows\\system32 directory. If the App-V client is installed on a 64-bit system, SFTLDR\_WOW64.DLL is copied to the Windows\\SysWOW64 directory.
 
- 
+ 
 
 \[Template Token Value\]
 
@@ -61,9 +64,9 @@ Provides step-by-step procedures for installing any prerequisite software and al
 
 [How to Uninstall the App-V Client](how-to-uninstall-the-app-v-client.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-install-the-management-console.md b/mdop/appv-v4/how-to-install-the-management-console.md
index ceca43b0e3..df74e0f969 100644
--- a/mdop/appv-v4/how-to-install-the-management-console.md
+++ b/mdop/appv-v4/how-to-install-the-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the Management Console
 description: How to Install the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 586d99c8-bca6-42e2-a39c-a696053142f1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -37,14 +40,14 @@ Before you can complete this procedure, you must install the Application Virtual
     **Note**  
     If a component is already installed on the computer, by deselecting it on the Custom Setup screen, it will automatically be uninstalled.
 
-     
+     
 
 8.  On the **Ready to Modify the Program** screen, click **Install**.
 
     **Note**  
     If this is the first component you install, the **Ready to Install the Program** page is displayed. To start the installation, click **Install**.
 
-     
+     
 
 9.  On the **Installation Wizard Completed** screen, click **Finish**. Click **Okay** to restart the computer and complete the installation.
 
@@ -61,9 +64,9 @@ Before you can complete this procedure, you must install the Application Virtual
 
 [How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-install-the-management-web-service.md b/mdop/appv-v4/how-to-install-the-management-web-service.md
index 798238bc4a..72f0d59456 100644
--- a/mdop/appv-v4/how-to-install-the-management-web-service.md
+++ b/mdop/appv-v4/how-to-install-the-management-web-service.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the Management Web Service
 description: How to Install the Management Web Service
-author: jamiejdt
+author: dansimp
 ms.assetid: cac296f5-8ca0-4ce7-afdb-859ae207d2f1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -33,21 +36,21 @@ Use the following procedure to install the Application Virtualization Management
     **Note**  
     If this is not the first component you installed on this computer, the **Program Maintenance** page is displayed. On the **Program Maintenance** page, click **Modify**.
 
-     
+     
 
 7.  On the **Custom Setup** page, clear all Application Virtualization System components except **App Virt Management Service**, and then click **Next**.
 
     **Note**  
     If a component is already installed on the computer, by clearing it on the **Custom Setup** page, you will automatically uninstall it.
 
-     
+     
 
 8.  On the **Database Server** page, click **Connect to available database**, and then click **Next**.
 
     **Note**  
     In a production environment, Microsoft assumes that you will connect to an existing database. If you want to install a database, see [How to Install a Database](how-to-install-a-database.md). After installing the database, continue with step 13.
 
-     
+     
 
 9.  On the **Database Server Type** page, select a database type from the list, and then click **Next**.
 
@@ -62,7 +65,7 @@ Use the following procedure to install the Application Virtualization Management
     **Note**  
     If this is the first component you install, the **Ready to Install the Program** page is displayed. On the page, click **Install**.
 
-     
+     
 
 14. On the **Installation Wizard Completed** page, click **Finish**.
 
@@ -71,9 +74,9 @@ Use the following procedure to install the Application Virtualization Management
 
 [How to Install the Servers and System Components](how-to-install-the-servers-and-system-components.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md b/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md
index 497af4346f..ea900036a2 100644
--- a/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md
+++ b/mdop/appv-v4/how-to-install-the-sequencer---app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the Sequencer (App-V 4.6 SP1)
 description: How to Install the Sequencer (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: fe8eb876-28fb-46ae-b592-da055107e639
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -18,10 +21,10 @@ The Microsoft Application Virtualization (App-V) Sequencer monitors and records
 
 You must have administrative credentials on the computer you are using to sequence the application, and the computer must not be running any version of App-V client. Creating a virtual application by using the App-V Sequencer requires multiple operations, so it is important that you install the Sequencer on a computer that meets or exceeds the [Application Virtualization Sequencer Hardware and Software Requirements](application-virtualization-sequencer-hardware-and-software-requirements.md).
 
-**Note**  
+**Note**  
 Running the App-V sequencer in Safe Mode is not supported.
 
- 
+
 
 **To install the Microsoft Application Virtualization Sequencer**
 
@@ -37,38 +40,40 @@ Running the App-V sequencer in Safe Mode is not supported.
 
 6.  On the **Virtual Drive** page, to configure the Application Virtualization default drive **Q:\\** (default) as the drive that all sequenced applications will run from, click **Next**. If you want to specify a different drive letter, use the list and select the drive letter that you want to use by selecting the appropriate drive letter, and then click **Next**.
 
-    **Important**  
+    **Important**  
     The Application Virtualization drive letter specified with this step is the drive letter that virtual applications will be run from on target computers. The drive letter specified must be available, and not currently in use on the computers running the App-V client. If the specified drive is already in use, the virtual application fails on the target computer.
 
-     
+
 
 7.  On the **Ready to Install the Program** page, to start the installation, click **Install**.
 
 8.  On the **InstallShield Wizard Completed** page, to close the installation wizard and open the App-V Sequencer, click **Finish**. To close the installation wizard without opening the Sequencer, clear **Launch the program**, and then click **Finish**.
 
-    **Note**  
+    **Note**  
     If you installed the App-V Sequencer on a computer running a virtual environment, for example a virtual machine, you must now take a snapshot. After you sequence an application, you can revert to this image, so you can sequence the next application.
 
-     
 
-    When you uninstall the Sequencer, the following registry keys are not removed from the computer that the Sequencer was installed on. Additionally, you must restart the computer after you have uninstalled the Sequencer so that all associated drivers can be stopped and the operation can be completed.
 
-    -   **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid**
+~~~
+When you uninstall the Sequencer, the following registry keys are not removed from the computer that the Sequencer was installed on. Additionally, you must restart the computer after you have uninstalled the Sequencer so that all associated drivers can be stopped and the operation can be completed.
 
-    -   **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5**
+-   **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid**
 
-    -   **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard**
+-   **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5**
 
-    -   **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard\\SecKey**
+-   **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard**
+
+-   **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard\\SecKey**
+~~~
 
 ## Related topics
 
 
 [Configuring the Application Virtualization Sequencer (App-V 4.6 SP1)](configuring-the-application-virtualization-sequencer--app-v-46-sp1-.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-install-the-sequencer.md b/mdop/appv-v4/how-to-install-the-sequencer.md
index 664a0a4e21..decce9699a 100644
--- a/mdop/appv-v4/how-to-install-the-sequencer.md
+++ b/mdop/appv-v4/how-to-install-the-sequencer.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the Sequencer
 description: How to Install the Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: 2cd16427-a0ba-4870-82d1-3e3c79e1959b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-install-the-servers-and-system-components.md b/mdop/appv-v4/how-to-install-the-servers-and-system-components.md
index adc9632f14..d8d537d0e8 100644
--- a/mdop/appv-v4/how-to-install-the-servers-and-system-components.md
+++ b/mdop/appv-v4/how-to-install-the-servers-and-system-components.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the Servers and System Components
 description: How to Install the Servers and System Components
-author: jamiejdt
+author: dansimp
 ms.assetid: c6f5fef0-522a-4ef1-8585-05b292d0289b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Before you can deliver applications to users, you must install the Microsoft App
 **Note**  
 The procedures in this section take you through a customized installation, where you pick and choose components to install on separate computers, as recommended in a production environment. However, your operating procedures might dictate a different approach, and during the installation process you might want to group components together. Regardless of where you install the components, you can install them in any order.
 
- 
+ 
 
 ## In This Section
 
@@ -51,9 +54,9 @@ Provides step-by-step procedures to remove all or selected Application Virtualiz
 
 [How to Upgrade the Servers and System Components](how-to-upgrade-the-servers-and-system-components.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-load-files-and-packages.md b/mdop/appv-v4/how-to-load-files-and-packages.md
index 3c2911f088..f70cbf6dc3 100644
--- a/mdop/appv-v4/how-to-load-files-and-packages.md
+++ b/mdop/appv-v4/how-to-load-files-and-packages.md
@@ -1,12 +1,15 @@
 ---
 title: How to Load Files and Packages
 description: How to Load Files and Packages
-author: jamiejdt
+author: dansimp
 ms.assetid: f86f5bf1-99a4-44d7-ae2f-e6049c482f68
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can use the following procedure to load files and packages on Application Vi
 **Note**  
 During the installation process, you specified the location of the \\Content directory on the **Content Path** page. This directory should be created and configured as a standard file share before you point to its location.
 
- 
+ 
 
 **To load files and packages**
 
@@ -38,16 +41,16 @@ During the installation process, you specified the location of the \\Content dir
 
         The App-V Clients must be properly configured to retrieve applications and packages from Web servers and file servers. For more information, see [How to Configure the Client for Application Package Retrieval](how-to-configure-the-client-for-application-package-retrieval.md).
 
-         
+         
 
 ## Related topics
 
 
 [Application Virtualization Server](application-virtualization-server.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-load-or-unload-an-application.md b/mdop/appv-v4/how-to-load-or-unload-an-application.md
index de88b69c47..5dd97091a1 100644
--- a/mdop/appv-v4/how-to-load-or-unload-an-application.md
+++ b/mdop/appv-v4/how-to-load-or-unload-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Load or Unload an Application
 description: How to Load or Unload an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 8c149761-c591-433f-972b-91793a69c654
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can use the following procedures to load or unload an application from the c
 **Note**  
 When you load or unload a package, all the applications in the package are loaded into or removed from cache. When loading a package, if you do not have adequate space in cache to load the applications, increase your cache size. For more information about cache size, see [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md).
 
- 
+ 
 
 **To load an application**
 
@@ -38,9 +41,9 @@ When you load or unload a package, all the applications in the package are loade
 
 [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md b/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md
index 1268f7e43e..c089ce97ab 100644
--- a/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md
+++ b/mdop/appv-v4/how-to-load-virtual-applications-from-the-desktop-notification-area.md
@@ -1,12 +1,15 @@
 ---
 title: How to Load Virtual Applications from the Desktop Notification Area
 description: How to Load Virtual Applications from the Desktop Notification Area
-author: jamiejdt
+author: dansimp
 ms.assetid: f52758eb-8b81-4b3c-9bc3-adcf7c00c238
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ The applications are loaded one application at a time. The progress bar shows yo
 **Note**  
 If your system encounters an error while loading an application, it reports the error to you. You must dismiss the error dialog before it will load the next application.
 
- 
+ 
 
 **To load all applications**
 
@@ -46,9 +49,9 @@ If your system encounters an error while loading an application, it reports the
 
 [How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-lock-or-unlock-an-application.md b/mdop/appv-v4/how-to-lock-or-unlock-an-application.md
index 8231f3d1b1..1b2b033d69 100644
--- a/mdop/appv-v4/how-to-lock-or-unlock-an-application.md
+++ b/mdop/appv-v4/how-to-lock-or-unlock-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Lock or Unlock an Application
 description: How to Lock or Unlock an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 8c65d4fd-f336-447f-8c0a-6d65aec9fd00
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md
index 0f94beae1e..a48df6078f 100644
--- a/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md
+++ b/mdop/appv-v4/how-to-manage-application-groups-in-the-server-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Application Groups in the Server Management Console
 description: How to Manage Application Groups in the Server Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 46997971-bdc8-4565-aefd-f47e90d6d7a6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -31,7 +34,7 @@ You can create a group, place it where you would like in the console's **Applica
 **Note**  
 Moving applications into groups does not affect the locations of their files (SFT, OSD, or SPRJ) on the server's file system.
 
- 
+ 
 
 ## In This Section
 
@@ -55,9 +58,9 @@ Provides step-by-step instructions for removing or deleting an application group
 
 [How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md
index b08b55ef46..89c0f06825 100644
--- a/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md
+++ b/mdop/appv-v4/how-to-manage-application-licenses-in-the-server-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Application Licenses in the Server Management Console
 description: How to Manage Application Licenses in the Server Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 48503b04-0de7-48de-98ee-4623a712a341
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The Application Virtualization Server Management Console is the interface you us
 **Important**  
 If the App-V client Application Source Root (ASR) setting is configured to use any type of streaming source other than the Management Server, for example a Streaming Server, an IIS server, or a File server, then the Management Server is unable to enforce its licensing policy.
 
- 
+ 
 
 ## In This Section
 
@@ -50,9 +53,9 @@ Provides a procedure for creating a new unlimited license group, allowing specif
 
 [How to Perform Administrative Tasks in the Application Virtualization Server Management Console](how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md b/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md
index 2a5d5c75b8..caa426f56a 100644
--- a/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md
+++ b/mdop/appv-v4/how-to-manage-applications-in-the-client-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Applications in the Client Management Console
 description: How to Manage Applications in the Client Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 15cb5133-539b-499d-adca-ed02da20194a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md
index 2f8009de9e..bfae14c37b 100644
--- a/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md
+++ b/mdop/appv-v4/how-to-manage-applications-in-the-server-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Applications in the Server Management Console
 description: How to Manage Applications in the Server Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 21139a77-9f0f-4787-8173-a7766966ff7f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md
index 88410561d7..920445161f 100644
--- a/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md
+++ b/mdop/appv-v4/how-to-manage-packages-in-the-server-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Packages in the Server Management Console
 description: How to Manage Packages in the Server Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: d13d3896-8575-4d2a-8bb4-1fe15d79c390
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md
index 28716cef38..cfd2debb42 100644
--- a/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md
+++ b/mdop/appv-v4/how-to-manage-reports-in-the-server-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Reports in the Server Management Console
 description: How to Manage Reports in the Server Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 28d99620-6339-43f6-9288-4aa958607c59
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md b/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md
index 0c860be72f..9287af4caa 100644
--- a/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md
+++ b/mdop/appv-v4/how-to-manage-servers-in-the-server-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Servers in the Server Management Console
 description: How to Manage Servers in the Server Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 6e851c74-ea86-4fef-bb0c-e690e8e7e7eb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md b/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md
index 2776040187..b3050789b3 100644
--- a/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md
+++ b/mdop/appv-v4/how-to-manage-the-app-v-client-cache-using-performance-counters.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage the App-V Client Cache Using Performance Counters
 description: How to Manage the App-V Client Cache Using Performance Counters
-author: jamiejdt
+author: dansimp
 ms.assetid: 49d6c3f2-68b8-4c69-befa-7598a8737d05
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -29,16 +32,16 @@ You can use the following procedure to determine how much free space is availabl
     **Important**  
     The App-V performance counters are implemented in a 32-bit DLL, so to see them, you must use the following command to start the 32-bit version of Performance Monitor: **mmc /32 perfmon.msc**. This command must be run directly on the computer being monitored and cannot be used to monitor a remote computer running a 64-bit operating system.
 
-     
+     
 
 ## Related topics
 
 
 [How to Manage Virtual Applications by Using the Command Line](how-to-manage-virtual-applications-by-using-the-command-line.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md b/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md
index b684e13c53..c88c2c0a2e 100644
--- a/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md
+++ b/mdop/appv-v4/how-to-manage-virtual-applications-by-using-the-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Virtual Applications by Using the Command Line
 description: How to Manage Virtual Applications by Using the Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: 88c61c20-5243-4862-83eb-5b30825f8bbf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-manage-virtual-applications-manually.md b/mdop/appv-v4/how-to-manage-virtual-applications-manually.md
index 0d70f51823..1e5aa136e6 100644
--- a/mdop/appv-v4/how-to-manage-virtual-applications-manually.md
+++ b/mdop/appv-v4/how-to-manage-virtual-applications-manually.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Virtual Applications Manually
 description: How to Manage Virtual Applications Manually
-author: jamiejdt
+author: dansimp
 ms.assetid: 583c5255-d3f4-4197-85cd-2a59868d85de
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -24,7 +27,7 @@ You can use the following procedures to load or unload an application from the c
 **Note**  
 When you load or unload a package, all the applications in the package are loaded into or removed from cache. When loading a package, if you do not have adequate space in cache to load the applications, increase your cache size. For more information about cache size, see [How to Change the Cache Size and the Drive Letter Designation](how-to-change-the-cache-size-and-the-drive-letter-designation.md).
 
- 
+ 
 
 **To load an App-V application**
 
@@ -46,7 +49,7 @@ You can clear an application from the console directly from the **Results** pane
 **Note**  
 When you clear an application from the console, you can no longer use that application. However, the application remains in cache and is still available to other users on the same system. After a publishing refresh, the cleared applications will again become available to you. If there are multiple applications in a package, the user's settings are not removed until all of the applications are cleared.
 
- 
+ 
 
 **To clear an application from the console**
 
@@ -81,7 +84,7 @@ You can use the following procedure to import an application into the cache dire
     **Note**  
     If you have already configured an import search path or if the SFT file is in the same path as the last successful import, step 2 is not required.
 
-     
+     
 
 ## How to lock or unlock an App-V application
 
@@ -110,7 +113,7 @@ When you delete an application, the selected application will no longer be avail
 
 After a publishing refresh, the deleted applications will again become available to you.
 
- 
+ 
 
 **To delete an application**
 
@@ -228,9 +231,9 @@ You can use the following procedure to delete a file type association. The **Fil
 
 [Application Virtualization Client](application-virtualization-client.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md b/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md
index b9add15307..49b1512034 100644
--- a/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md
+++ b/mdop/appv-v4/how-to-manage-virtual-applications-using-the-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Virtual Applications Using the Command Line
 description: How to Manage Virtual Applications Using the Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: 9394f34d-2b1e-4ea7-bf6f-1f56101ab4de
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-manually-add-an-application.md b/mdop/appv-v4/how-to-manually-add-an-application.md
index 0065407e6b..b503780e0d 100644
--- a/mdop/appv-v4/how-to-manually-add-an-application.md
+++ b/mdop/appv-v4/how-to-manually-add-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manually Add an Application
 description: How to Manually Add an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: c635b07a-5c7f-4ab2-ba18-366457146cb9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md b/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md
index 3d83f8c071..3df7f2a0ee 100644
--- a/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md
+++ b/mdop/appv-v4/how-to-manually-install-the-application-virtualization-client.md
@@ -1,69 +1,64 @@
 ---
 title: How to Manually Install the Application Virtualization Client
 description: How to Manually Install the Application Virtualization Client
-author: jamiejdt
+author: dansimp
 ms.assetid: bb67f70b-d525-4317-b254-e4f084c717ab
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
-
 # How to Manually Install the Application Virtualization Client
 
+There are two types of Application Virtualization Client components: the Application Virtualization Desktop Client, which is designed for installation on desktop computers, and the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services), which you can install on Remote Desktop Session Host (RD Session Host) servers . Although the two client installer programs are different, you can use the following procedure to manually install either the Application Virtualization Desktop Client on a single desktop computer or the Application Virtualization Client for Remote Desktop Services on a single RD Session Host server. In a production environment, you most likely will install the Application Virtualization Desktop Client on multiple desktop computers with an automated scripted installation process. For information about how to install multiple clients by using a scripted installation process, see [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md).
 
-There are two types of Application Virtualization Client components: the Application Virtualization Desktop Client, which is designed for installation on desktop computers, and the Application Virtualization Client for Remote Desktop Services (formerly Terminal Services), which you can install on Remote Desktop Session Host (RD Session Host) servers . Although the two client installer programs are different, you can use the following procedure to manually install either the Application Virtualization Desktop Client on a single desktop computer or the Application Virtualization Client for Remote Desktop Services on a single RD Session Host server. In a production environment, you most likely will install the Application Virtualization Desktop Client on multiple desktop computers with an automated scripted installation process. For information about how to install multiple clients by using a scripted installation process, see [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md).
+**Note**  
+1. If you are installing the Application Virtualization Client for Remote Desktop Services software on a RD Session Host server, advise users who have an open RDP or ICA client session with the RD Session Host server that they must save their work and close their sessions. In a Remote Desktop session, you can install the client the client manually. For more information about upgrading the client, see [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md).
 
-**Note**  
-1.  If you are installing the Application Virtualization Client for Remote Desktop Services software on a RD Session Host server, advise users who have an open RDP or ICA client session with the RD Session Host server that they must save their work and close their sessions. In a Remote Desktop session, you can install the client the client manually. For more information about upgrading the client, see [How to Upgrade the Application Virtualization Client](how-to-upgrade-the-application-virtualization-client.md).
+2. If you have any configuration on the user’s computer that depends on the client install path, note that the Application Virtualization (App-V) 4.5 client uses a different install folder than previous versions. By default, a new install of the Application Virtualization (App-V) 4.5 client will install to the \\Program Files\\Microsoft Application Virtualization Client folder. If an earlier version of the client is already installed, installing the App-V client will perform an upgrade into the existing installation folder.
 
-2.  If you have any configuration on the user’s computer that depends on the client install path, note that the Application Virtualization (App-V) 4.5 client uses a different install folder than previous versions. By default, a new install of the Application Virtualization (App-V) 4.5 client will install to the \\Program Files\\Microsoft Application Virtualization Client folder. If an earlier version of the client is already installed, installing the App-V client will perform an upgrade into the existing installation folder.
-
- 
-
-**Note**  
-For App-V version 4.6 and later, when the App-V client is installed, SFTLDR.DLL is installed in the Windows\\system32 directory. If the App-V client is installed on a 64-bit system, SFTLDR\_WOW64.DLL is installed in the Windows\\SysWOW64 directory.
-
- 
+**Note**  
+For App-V version 4.6 and later, when the App-V client is installed, SFTLDR.DLL is installed in the Windows\\system32 directory. If the App-V client is installed on a 64-bit system, SFTLDR\_WOW64.DLL is installed in the Windows\\SysWOW64 directory.
 
 **To manually install Application Virtualization Desktop Client**
 
-1.  After you have obtained the correct installer archive file and saved it to your computer, make sure you are logged on with an account having administrator rights on the computer and double-click the file to expand the archive.
+1. After you have obtained the correct installer archive file and saved it to your computer, make sure you are logged on with an account having administrator rights on the computer and double-click the file to expand the archive.
 
-2.  Choose the folder in which to save the files, and then open the folder after the files have been copied to it.
+2. Choose the folder in which to save the files, and then open the folder after the files have been copied to it.
 
-3.  Review the Release Notes if appropriate.
+3. Review the Release Notes if appropriate.
 
-4.  Browse to find the setup.exe file, and double-click setup.exe to start the installation.
+4. Browse to find the setup.exe file, and double-click setup.exe to start the installation.
 
-5.  The wizard checks the system to ensure that all prerequisite software is installed, and if any of the following are missing, the wizard will automatically prompt you to install them:
+5. The wizard checks the system to ensure that all prerequisite software is installed, and if any of the following are missing, the wizard will automatically prompt you to install them:
 
-    -   Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)
+    - Microsoft Visual C++ 2005 SP1 Redistributable Package (x86)
 
-    -   Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)
+    - Microsoft Core XML Services (MSXML) 6.0 SP1 (x86)
 
-    -   Microsoft Application Error Reporting
+    - Microsoft Application Error Reporting
 
-    **Note**  
-    For App-V version 4.6 and later, the wizard will also install Microsoft Visual C++ 2008 SP1 Redistributable Package (x86).
+    **Note**  
+    For App-V version 4.6 and later, the wizard will also install Microsoft Visual C++ 2008 SP1 Redistributable Package (x86).
 
-    For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see  (https://go.microsoft.com/fwlink/?LinkId=150700).
-
-     
+    For more information about installing Microsoft Visual C++ 2008 SP1 Redistributable Package (x86), see [https://go.microsoft.com/fwlink/?LinkId=150700](https://go.microsoft.com/fwlink/?LinkId=150700).
 
     If prompted, click **Install**. Installation progress is displayed, and the status changes from **Pending** to **Installing**. Installation status changes to **Succeeded** as each step is completed successfully.
 
-6.  When the **Microsoft Application Virtualization Desktop Client – InstallShield Wizard** is displayed, click **Next**.
+6. When the **Microsoft Application Virtualization Desktop Client – InstallShield Wizard** is displayed, click **Next**.
 
-7.  The **License Agreement** screen is displayed. Read the license agreement, and if you agree, click **I accept the terms in the license agreement** and then click **Next**.
+7. The **License Agreement** screen is displayed. Read the license agreement, and if you agree, click **I accept the terms in the license agreement** and then click **Next**.
 
-    Optionally, you can click the button to read the Privacy Statement. You must be connected to the Internet to access the Privacy Statement.
+   Optionally, you can click the button to read the Privacy Statement. You must be connected to the Internet to access the Privacy Statement.
 
-8.  On the **Setup Type** screen, select the setup type. Click **Typical** to use the default program values, or click **Custom** if you want to configure the program settings during installation.
+8. On the **Setup Type** screen, select the setup type. Click **Typical** to use the default program values, or click **Custom** if you want to configure the program settings during installation.
 
-9.  If you choose **Typical**, the next screen displays **Ready to Install the Program**. Click **Install** to begin the installation.
+9. If you choose **Typical**, the next screen displays **Ready to Install the Program**. Click **Install** to begin the installation.
 
 10. If you choose **Custom**, the **Destination Folder** screen appears.
 
@@ -71,84 +66,66 @@ For App-V version 4.6 and later, when the App-V client is installed, SFTLDR.DLL
 
 12. On the **Application Virtualization Data Location** screen, click **Next** to accept the default data locations or complete the following actions to change where the data is stored:
 
-    1.  Click **Change**, and then browse to or, in the **Global Data Location** field, enter the destination folder for the global data location, and click **OK**. The Global Data Directory is where the Application Virtualization Desktop Client caches data shared by all users on the computer, like OSD files and SFT file data.
+    1. Click **Change**, and then browse to or, in the **Global Data Location** field, enter the destination folder for the global data location, and click **OK**. The Global Data Directory is where the Application Virtualization Desktop Client caches data shared by all users on the computer, like OSD files and SFT file data.
 
-    2.  If you want to change the drive letter to be used, select the preferred drive letter from the drop-down list.
+    2. If you want to change the drive letter to be used, select the preferred drive letter from the drop-down list.
 
-    3.  Enter a new path to store the user-specific data in the **User-specific Data Location** field if you want to change the data location. The User Data Directory is where the Application Virtualization Desktop Client stores user-specific information, like personal settings for virtualized applications.
+    3. Enter a new path to store the user-specific data in the **User-specific Data Location** field if you want to change the data location. The User Data Directory is where the Application Virtualization Desktop Client stores user-specific information, like personal settings for virtualized applications.
 
-        **Note**  
-        This path must be different for every user, so it should include a user-specific environment variable or a mapped drive or something else that will resolve to a unique path for each user.
+       **Note**  
+       This path must be different for every user, so it should include a user-specific environment variable or a mapped drive or something else that will resolve to a unique path for each user.
 
-         
-
-    4.  When you have finished making the changes, click **Next**.
+    4. When you have finished making the changes, click **Next**.
 
 13. On the **Cache Size Settings** screen, you can accept or change the default cache size. Click one of the following radio buttons to choose how to manage the cache space:
 
-    1.  **Use maximum cache size**. Enter a numeric value from 100–1,048,576 (1 TB) in the **Maximum size (MB)** field to specify the maximum size of the cache.
+    1. **Use maximum cache size**. Enter a numeric value from 100–1,048,576 (1 TB) in the **Maximum size (MB)** field to specify the maximum size of the cache.
 
-    2.  **Use free disk space threshold**. Enter a numeric value to specify the amount of free disk space, in MB, that the Application Virtualization Client must leave available on the disk. This allows the cache to grow until the amount of free disk space reaches this limit. The value shown in **Free disk space remaining** indicates how much disk space is currently unused.
+    2. **Use free disk space threshold**. Enter a numeric value to specify the amount of free disk space, in MB, that the Application Virtualization Client must leave available on the disk. This allows the cache to grow until the amount of free disk space reaches this limit. The value shown in **Free disk space remaining** indicates how much disk space is currently unused.
 
-    **Important**  
+    **Important**  
     To ensure that the cache has sufficient space allocated for all packages that might be deployed, use the **Use free disk space threshold** setting when you configure the client so that the cache can grow as needed. Alternatively, determine in advance how much disk space will be needed for the App-V cache, and at installation time, set the cache size accordingly. For more information about the cache space management feature, in the Microsoft Application Virtualization (App-V) Operations Guide, see **How to Use the Cache Space Management Feature**.
 
-     
-
     Click **Next** to continue.
 
 14. In the following sections of the **Runtime Package Policy Configuration** screen, you can change the parameters that affect how the Application Virtualization client behaves during runtime:
 
-    1.  **Application Source Root**. Specifies the location of SFT files. If used, overrides the protocol, server, and port portions of the CODEBASE HREF URL in the OSD file.
+    1. **Application Source Root**. Specifies the location of SFT files. If used, overrides the protocol, server, and port portions of the CODEBASE HREF URL in the OSD file.
 
-    2.  **Application Authorization**. When **Require User authorization even when cached** is checked, users are required to connect to a server and validate their credentials at least once before they are allowed to start each virtual application.
+    2. **Application Authorization**. When **Require User authorization even when cached** is checked, users are required to connect to a server and validate their credentials at least once before they are allowed to start each virtual application.
 
-    3.  **Allow streaming from file**. Indicates whether streaming from file will be enabled, regardless of how the **Application Source Root** field is used. If not checked, streaming from files is disabled. This must be checked if **Application Source Root** contains a UNC path in the form \\\\server\\share.
+    3. **Allow streaming from file**. Indicates whether streaming from file will be enabled, regardless of how the **Application Source Root** field is used. If not checked, streaming from files is disabled. This must be checked if **Application Source Root** contains a UNC path in the form \\\\server\\share.
 
-    4.  **Automatically Load Application**. Controls when and how automatic background loading of applications occurs.
+    4. **Automatically Load Application**. Controls when and how automatic background loading of applications occurs.
 
-        **Note**  
-        When you install the App-V client to use with a read-only cache, for example, with a VDI server implementation, set **What applications to Auto Load** to **Do not automatically load applications** to prevent the client from trying to update applications in the read-only cache.
-
-         
+       **Note**  
+       When you install the App-V client to use with a read-only cache, for example, with a VDI server implementation, set **What applications to Auto Load** to **Do not automatically load applications** to prevent the client from trying to update applications in the read-only cache.
 
     Click **Next** to continue.
 
 15. On the **Publishing Server** screen, select the **Set up a Publishing Server now** check box if you want to define a publishing server, or click **Next** if you want to complete this later. To define a publishing server, specify the following information:
 
-    1.  **Display Name**—Enter the name you want to display for the server.
+    1. **Display Name**—Enter the name you want to display for the server.
 
-    2.  **Type**—Select the server type from the drop-down list of server types.
+    2. **Type**—Select the server type from the drop-down list of server types.
 
-    3.  **Host Name** and **Port**—Enter the host name and the port in the corresponding fields. When you select a server type in the drop-down list, the port field will automatically fill with the standard port numbers. To change a port number, click the server type in the list and change the port number according to your needs.
+    3. **Host Name** and **Port**—Enter the host name and the port in the corresponding fields. When you select a server type in the drop-down list, the port field will automatically fill with the standard port numbers. To change a port number, click the server type in the list and change the port number according to your needs.
 
-    4.  **Path**—If you have selected either **Standard HTTP Server** or **Enhanced Security HTTP Server**, you must enter the complete path to the XML file containing publishing data in this field. If you select either **Application Virtualization Server** or **Enhanced Security Application Virtualization Server**, this field is not active.
+    4. **Path**—If you have selected either **Standard HTTP Server** or **Enhanced Security HTTP Server**, you must enter the complete path to the XML file containing publishing data in this field. If you select either **Application Virtualization Server** or **Enhanced Security Application Virtualization Server**, this field is not active.
 
-    5.  **Automatically contact this server to update settings when a user logs in**—Select this check box if you want this server to be queried automatically when users log in to their account on the Application Virtualization Client.
+    5. **Automatically contact this server to update settings when a user logs in**—Select this check box if you want this server to be queried automatically when users log in to their account on the Application Virtualization Client.
 
-    6.  When finished with the configuration steps, click **Next**.
+    6. When finished with the configuration steps, click **Next**.
 
 16. On the **Ready to Install the Program** screen, click **Install**. A screen is displayed that shows the progress of the installation.
 
 17. On the **Install Wizard Completed** screen, click **Finish**.
 
-    **Note**  
+    **Note**  
     If the installation fails for any reason, you might need to restart the computer before trying the install again.
 
-     
-
 ## Related topics
 
-
 [How to Install the Client by Using the Command Line](how-to-install-the-client-by-using-the-command-line-new.md)
 
 [Stand-Alone Delivery Scenario Overview](stand-alone-delivery-scenario-overview.md)
-
- 
-
- 
-
-
-
-
-
diff --git a/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md b/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md
index 77867470cd..4302487ce2 100644
--- a/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md
+++ b/mdop/appv-v4/how-to-manually-manage-applications-in-the-client-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manually Manage Applications in the Client Management Console
 description: How to Manually Manage Applications in the Client Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: e29caa22-325d-457b-a177-a11f8a8ad57c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md b/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md
index 337d7e6c61..f4e1e2a14e 100644
--- a/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md
+++ b/mdop/appv-v4/how-to-migrate-the-app-v-sql-database-to-a-different-sql-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Migrate the App-V SQL Database to a Different SQL Server
 description: How to Migrate the App-V SQL Database to a Different SQL Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 353892a1-9327-4489-a19c-4ec7bd1b736f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The following procedures describe in detail how to migrate the SQL database of t
 **Important**  
 This procedure requires that the App-V server service is stopped and this will prevent end-users from using their applications.
 
- 
+ 
 
 **To back up the App-V SQL database**
 
@@ -107,9 +110,9 @@ This procedure requires that the App-V server service is stopped and this will p
 
 7.  Open the App-V Management Console, right-click the **Applications** node and select **Refresh**. The list of applications should be displayed as before.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md b/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md
index 2c20fd4f76..98641cae37 100644
--- a/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md
+++ b/mdop/appv-v4/how-to-modify-a-virtual-application-package--app-v-46-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify a Virtual Application Package (App-V 4.6)
 description: How to Modify a Virtual Application Package (App-V 4.6)
-author: jamiejdt
+author: dansimp
 ms.assetid: 346ec470-3822-48a7-95e7-61f46eb38dc2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md b/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md
index b60b6bbe41..9ef7b06355 100644
--- a/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md
+++ b/mdop/appv-v4/how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)
 description: How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: f43a9927-4325-4b2d-829f-3068e4e84349
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -39,7 +42,7 @@ You must have the App-V Sequencer installed to modify a virtual application pack
     **Important**  
     If you are required to disable virus scanning software, scan the computer running the sequencer to ensure that no unwanted or malicious files are added to the package.
 
-     
+     
 
 6.  On the **Select Installer** page, click **Browse** and specify the update installation file for the application. If the update does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
 
@@ -48,7 +51,7 @@ You must have the App-V Sequencer installed to modify a virtual application pack
     **Note**  
     The sequencer monitors all changes and installations to the computer running the sequencer, including the changes and installations that are performed outside of the sequencing wizard.
 
-     
+     
 
 8.  On the **Installation Report** page, you can review information about the virtual application you just updated. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**.
 
@@ -57,7 +60,7 @@ You must have the App-V Sequencer installed to modify a virtual application pack
     **Note**  
     If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop**, and then click one of the following options, **Stop all applications** or **Stop this application only**, depending on what you want.
 
-     
+     
 
 10. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. When you select this option, the package in the Sequencer console opens so that you can modify the package before it is saved. Click **Next**.
 
@@ -118,7 +121,7 @@ You must have the App-V Sequencer installed to modify a virtual application pack
     **Important**  
     If you are required to disable virus scanning software, scan the computer running the sequencer to ensure that no unwanted or malicious files can be added to the package.
 
-     
+     
 
 6.  On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
 
@@ -127,7 +130,7 @@ You must have the App-V Sequencer installed to modify a virtual application pack
     **Note**  
     All changes and installations to the computer running the sequencer are monitored by the sequencer, including the changes and installations that are performed outside of the sequencing wizard.
 
-     
+     
 
 8.  On the **Configure Software** page, optionally run the programs contained in the package. This step helps complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at the same time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**.
 
@@ -148,7 +151,7 @@ You must have the App-V Sequencer installed to modify a virtual application pack
     **Note**  
     If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop** and select either the **Stop all applications** or the **Stop this application only** check box, depending on what you want.
 
-     
+     
 
 13. On the **Create Package** page, select the **Continue to modify package without saving using the package editor** check box, to modify the package without saving it. When you select this option, the package in the sequencer console opens so that you can modify the package before it is saved. Click **Next**.
 
@@ -161,9 +164,9 @@ You must have the App-V Sequencer installed to modify a virtual application pack
 
 [Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)](tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md b/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md
index e43a82d37f..98cb2e695d 100644
--- a/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md
+++ b/mdop/appv-v4/how-to-modify-attributes-of-embedded-services.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify Attributes of Embedded Services
 description: How to Modify Attributes of Embedded Services
-author: jamiejdt
+author: dansimp
 ms.assetid: b4057d3f-2e8f-4b1f-9ed5-b65f3da8631a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-modify-file-mapping-information.md b/mdop/appv-v4/how-to-modify-file-mapping-information.md
index dcd62ff3c3..8fdeaaf6cd 100644
--- a/mdop/appv-v4/how-to-modify-file-mapping-information.md
+++ b/mdop/appv-v4/how-to-modify-file-mapping-information.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify File-Mapping Information
 description: How to Modify File-Mapping Information
-author: jamiejdt
+author: dansimp
 ms.assetid: d3a9d10a-6cc8-4399-9479-b20f729c4dd9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md b/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md
index f60177eccf..f4c26c1e0a 100644
--- a/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md
+++ b/mdop/appv-v4/how-to-modify-private-key-permissions-to-support-management-server-or-streaming-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify Private Key Permissions to Support Management Server or Streaming Server
 description: How to Modify Private Key Permissions to Support Management Server or Streaming Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 1ebe86fa-0fbc-4512-aebc-0a5da991cd43
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -23,7 +26,7 @@ In Windows Server 2008, the process of changing the ACLs on the private key is
 **Note**  
 The default security context is Network Service; however, a domain account can be used instead.
 
- 
+ 
 
 **To manage private keys in Windows Server 2003**
 
@@ -54,9 +57,9 @@ The default security context is Network Service; however, a domain account can b
 
 [Configuring Certificates to Support Secure Streaming](configuring-certificates-to-support-secure-streaming.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md b/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md
index 6df2be98dd..2b1f6f9355 100644
--- a/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md
+++ b/mdop/appv-v4/how-to-modify-the-files-included-in-a-package.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify the Files Included in a Package
 description: How to Modify the Files Included in a Package
-author: jamiejdt
+author: dansimp
 ms.assetid: e331ac85-1c9c-49be-9d96-5444de38fd56
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md b/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md
index 330446289e..884b299f77 100644
--- a/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md
+++ b/mdop/appv-v4/how-to-modify-the-location-of-the-log-directory.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify the Location of the Log Directory
 description: How to Modify the Location of the Log Directory
-author: jamiejdt
+author: dansimp
 ms.assetid: 8e222d29-6f58-43bb-9ea7-da9a2ebfa48c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md b/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md
index b8509091f4..db5ae76ad1 100644
--- a/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md
+++ b/mdop/appv-v4/how-to-modify-the-location-of-the-scratch-directory.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify the Location of the Scratch Directory
 description: How to Modify the Location of the Scratch Directory
-author: jamiejdt
+author: dansimp
 ms.assetid: 25ebc2fa-d532-4800-9825-9d08306fc2e0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-modify-the-log-directory-location.md b/mdop/appv-v4/how-to-modify-the-log-directory-location.md
index e2a090e08c..59765268ac 100644
--- a/mdop/appv-v4/how-to-modify-the-log-directory-location.md
+++ b/mdop/appv-v4/how-to-modify-the-log-directory-location.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify the Log Directory Location
 description: How to Modify the Log Directory Location
-author: jamiejdt
+author: dansimp
 ms.assetid: 203c674f-8d46-4d42-9af0-245a2681fc0f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The log directory location is where the Application Virtualization (App-V) Seque
 **Important**  
 The log location directory must be located on the computer running the App-V Sequencer.
 
- 
+ 
 
 Use the following procedure to change the location of the directory where the App-V Sequencer will save associated logs.
 
@@ -38,9 +41,9 @@ Use the following procedure to change the location of the directory where the Ap
 
 [How to Configure the App-V Sequencer](how-to-configure-the-app-v-sequencer.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md b/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md
index 37e0ab9951..910e66507f 100644
--- a/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md
+++ b/mdop/appv-v4/how-to-modify-the-operating-systems-associated-with-an-existing-windows-installer-file.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify the Operating Systems Associated With an Existing Windows Installer File
 description: How to Modify the Operating Systems Associated With an Existing Windows Installer File
-author: jamiejdt
+author: dansimp
 ms.assetid: 0633f7e2-aebf-4e00-be02-35bc59dec420
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -33,7 +36,7 @@ Use the following procedure to modify the operating system versions associated w
     **Note**  
     If you select **Tools** / **Create MSI** to create a new Windows Installer file, you can skip **Step 6** of this procedure.
 
-     
+     
 
 6.  To save the virtual application package, select **Package** / **Save**.
 
@@ -42,9 +45,9 @@ Use the following procedure to modify the operating system versions associated w
 
 [Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md b/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md
index 77bd3c7642..55a1689ba0 100644
--- a/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md
+++ b/mdop/appv-v4/how-to-modify-the-scratch-directory-location.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify the Scratch Directory Location
 description: How to Modify the Scratch Directory Location
-author: jamiejdt
+author: dansimp
 ms.assetid: 61ecb379-85be-4316-8023-a2c1811504e5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The scratch directory is used by the App-V Sequencer to save temporary files dur
 **Important**  
 The specified scratch directory location should be located on the computer running the App-V Sequencer.
 
- 
+ 
 
 Use the following procedure to modify the scratch directory location.
 
@@ -40,9 +43,9 @@ Use the following procedure to modify the scratch directory location.
 
 [How to Modify the Log Directory Location](how-to-modify-the-log-directory-location.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md b/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md
index 8edd38239f..717a3d0b0b 100644
--- a/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md
+++ b/mdop/appv-v4/how-to-modify-virtual-registry-key-information.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify Virtual Registry Key Information
 description: How to Modify Virtual Registry Key Information
-author: jamiejdt
+author: dansimp
 ms.assetid: cf2559f2-a8cc-4fc7-916e-8368843c7ebc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-move-an-application-group.md b/mdop/appv-v4/how-to-move-an-application-group.md
index 2f8c8462a5..8ea5ba9d04 100644
--- a/mdop/appv-v4/how-to-move-an-application-group.md
+++ b/mdop/appv-v4/how-to-move-an-application-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Move an Application Group
 description: How to Move an Application Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 7f9f9f2e-f394-4ad3-8615-4237a7dcfb95
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -31,7 +34,7 @@ In the Application Virtualization Server Management Console, you can use the fol
     **Note**  
     You can select and move multiple application groups simultaneously. In the right pane, use the **CTRL**-click or **Shift**-click key combinations to select more than one group.
 
-     
+     
 
 ## Related topics
 
@@ -42,9 +45,9 @@ In the Application Virtualization Server Management Console, you can use the fol
 
 [How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-move-an-application.md b/mdop/appv-v4/how-to-move-an-application.md
index 8a0747f2dd..09e30ae09f 100644
--- a/mdop/appv-v4/how-to-move-an-application.md
+++ b/mdop/appv-v4/how-to-move-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Move an Application
 description: How to Move an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 3ebbf30c-b435-4a69-a0ba-2313aaf0017c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ If you have application groups under the **Applications** node in the Applicatio
 **Important**  
 You must have one or more application groups under the **Applications** node to move applications.
 
- 
+ 
 
 **To move an application**
 
@@ -38,7 +41,7 @@ You must have one or more application groups under the **Applications** node to
     **Note**  
     You can select and move multiple application groups simultaneously. In the right pane, use the **CTRL**-click or **Shift**-click key combinations to select more than one group.
 
-     
+     
 
 ## Related topics
 
@@ -47,9 +50,9 @@ You must have one or more application groups under the **Applications** node to
 
 [How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md b/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md
index c8771fb948..21dbdb2640 100644
--- a/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md
+++ b/mdop/appv-v4/how-to-open-a-sequenced-application-using-the-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: How to Open a Sequenced Application Using the Command Line
 description: How to Open a Sequenced Application Using the Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: dc23ee65-8aea-470e-bb3f-a2f2b06cb241
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -43,16 +46,16 @@ Use the following procedure to open sequenced application packages using the com
     **Note**  
     If the installer or Windows Installer package has a graphical user interface, it will be displayed after you specify the command-line parameters.
 
-     
+     
 
 ## Related topics
 
 
 [How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md b/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md
index 6fb913d4cc..9c58f5b780 100644
--- a/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md
+++ b/mdop/appv-v4/how-to-perform-administrative-tasks-in-the-application-virtualization-server-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Perform Administrative Tasks in the Application Virtualization Server Management Console
 description: How to Perform Administrative Tasks in the Application Virtualization Server Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: b80e39eb-4b2a-4f66-8c85-dd5712efed33
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md b/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md
index 8d97b663dc..343308dd05 100644
--- a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md
+++ b/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-app-v-client-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Perform General Administrative Tasks in the App-V Client Management Console
 description: How to Perform General Administrative Tasks in the App-V Client Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 22abdb1e-ab35-440d-bf74-d358dd1a6558
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md b/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md
index 78917db58c..6680c9eb75 100644
--- a/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md
+++ b/mdop/appv-v4/how-to-perform-general-administrative-tasks-in-the-client-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Perform General Administrative Tasks in the Client Management Console
 description: How to Perform General Administrative Tasks in the Client Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 90bb7101-1075-4654-8a5e-ad08374e381f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-print-a-reportserver.md b/mdop/appv-v4/how-to-print-a-reportserver.md
index b218ebf38b..b5032610a5 100644
--- a/mdop/appv-v4/how-to-print-a-reportserver.md
+++ b/mdop/appv-v4/how-to-print-a-reportserver.md
@@ -1,12 +1,15 @@
 ---
 title: How to Print a Report
 description: How to Print a Report
-author: jamiejdt
+author: dansimp
 ms.assetid: 9cb3a2f1-69bf-47b2-b2cf-8afdcd77138f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md b/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md
index 4cc324ceb2..50cea0dd3a 100644
--- a/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md
+++ b/mdop/appv-v4/how-to-publish-a-virtual-application-on-the-client.md
@@ -1,12 +1,15 @@
 ---
 title: How to Publish a Virtual Application on the Client
 description: How to Publish a Virtual Application on the Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 90af843e-b5b3-4a71-a3a1-fa5f4c087f28
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -37,7 +40,7 @@ When you deploy Application Virtualization by using an electronic software distr
     **Important**  
     For OVERRIDEURL all backslash characters must be escaped using a preceding backslash, or the OVERRIDEURL path will not be parsed correctly. Also, properties and values must be entered as uppercase except where the value is a path to a file.
 
-     
+     
 
 **To publish a package using SFTMIME**
 
@@ -58,9 +61,9 @@ When you deploy Application Virtualization by using an electronic software distr
 
 [Stand-Alone Delivery Scenario for Application Virtualization Clients](stand-alone-delivery-scenario-for-application-virtualization-clients.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-publish-application-shortcuts.md b/mdop/appv-v4/how-to-publish-application-shortcuts.md
index 2ba65d4ece..6d4a244cfe 100644
--- a/mdop/appv-v4/how-to-publish-application-shortcuts.md
+++ b/mdop/appv-v4/how-to-publish-application-shortcuts.md
@@ -1,12 +1,15 @@
 ---
 title: How to Publish Application Shortcuts
 description: How to Publish Application Shortcuts
-author: jamiejdt
+author: dansimp
 ms.assetid: fc5efe86-1bbe-438b-b7d8-4f9b815cc58e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-refresh-the-publishing-servers.md b/mdop/appv-v4/how-to-refresh-the-publishing-servers.md
index 8988ef2dff..a0e9a2926b 100644
--- a/mdop/appv-v4/how-to-refresh-the-publishing-servers.md
+++ b/mdop/appv-v4/how-to-refresh-the-publishing-servers.md
@@ -1,12 +1,15 @@
 ---
 title: How to Refresh the Publishing Servers
 description: How to Refresh the Publishing Servers
-author: jamiejdt
+author: dansimp
 ms.assetid: 92e1d7b0-10ee-4531-9049-1056b44934e2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ After you request access to additional applications and permission is granted by
 **Note**  
 By default, publishing information is refreshed on user log in.
 
- 
+ 
 
 **To refresh the publishing information**
 
@@ -34,7 +37,7 @@ By default, publishing information is refreshed on user log in.
 
     -   Right-click the server in the **Results** pane, and then select **Properties** from the pop-up menu. Select the **Refresh** tab, and then click the **Refresh** button.
 
-     
+     
 
 ## Related topics
 
@@ -43,9 +46,9 @@ By default, publishing information is refreshed on user log in.
 
 [How to Set Up Publishing Refresh on Login](how-to-set-up-publishing-refresh-on-login.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md b/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md
index 10249a9edc..7933691955 100644
--- a/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md
+++ b/mdop/appv-v4/how-to-refresh-virtual-applications-from-the-desktop-notification-area.md
@@ -1,12 +1,15 @@
 ---
 title: How to Refresh Virtual Applications from the Desktop Notification Area
 description: How to Refresh Virtual Applications from the Desktop Notification Area
-author: jamiejdt
+author: dansimp
 ms.assetid: 801610d9-e89c-48bb-972c-20e37b945a02
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md b/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md
index 2a6072d5a0..d0f45a1774 100644
--- a/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md
+++ b/mdop/appv-v4/how-to-remove-a-package-by-using-the-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: How to Remove a Package by Using the Command Line
 description: How to Remove a Package by Using the Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: 47697ec7-20e5-4258-8865-a0a710d41d5a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-remove-a-server-group.md b/mdop/appv-v4/how-to-remove-a-server-group.md
index 82ad51b5ad..e7575feff4 100644
--- a/mdop/appv-v4/how-to-remove-a-server-group.md
+++ b/mdop/appv-v4/how-to-remove-a-server-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Remove a Server Group
 description: How to Remove a Server Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 3017f4f4-614b-4db4-834c-b6fd9b45f10c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-remove-a-server.md b/mdop/appv-v4/how-to-remove-a-server.md
index 7121490f2c..bccd5fb64d 100644
--- a/mdop/appv-v4/how-to-remove-a-server.md
+++ b/mdop/appv-v4/how-to-remove-a-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Remove a Server
 description: How to Remove a Server
-author: jamiejdt
+author: dansimp
 ms.assetid: afb2a889-733c-4058-9a50-caa2ca10bd58
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md b/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md
index c7cfee67ca..8d0d072de5 100644
--- a/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md
+++ b/mdop/appv-v4/how-to-remove-an-application-from-a-license-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Remove an Application from a License Group
 description: How to Remove an Application from a License Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 973dfb11-b4d1-4b79-8f6a-aaea3e52b04f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -27,18 +30,18 @@ You can use the following procedure to remove an application from its assigned l
 4.  Click **OK**.
 
     **Note**  
-      You can alter the **Properties** tab of one application at a time.
+      You can alter the **Properties** tab of one application at a time.
 
-     
+     
 
 ## Related topics
 
 
 [How to Associate an Application with a License Group](how-to-associate-an-application-with-a-license-group.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-remove-an-application-group.md b/mdop/appv-v4/how-to-remove-an-application-group.md
index 15c7303af5..04c1069006 100644
--- a/mdop/appv-v4/how-to-remove-an-application-group.md
+++ b/mdop/appv-v4/how-to-remove-an-application-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Remove an Application Group
 description: How to Remove an Application Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 3016b373-f5a0-4c82-96e8-e5e7960f0cc4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can use the following procedures to remove an application group in the Appli
 **Caution**  
 Deleting a group with its applications deletes those applications from the Application Virtualization Management Server. When you try to do this, you must confirm the deletion in a pop-up window.
 
- 
+ 
 
 **To empty and then delete an application group**
 
@@ -46,7 +49,7 @@ Deleting a group with its applications deletes those applications from the Appli
     **Note**  
     You can select and remove multiple application groups simultaneously. In the right pane, use the **CTRL**-click or **Shift**-click key combinations to select more than one group.
 
-     
+     
 
 ## Related topics
 
@@ -55,9 +58,9 @@ Deleting a group with its applications deletes those applications from the Appli
 
 [How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-remove-an-application-license-group.md b/mdop/appv-v4/how-to-remove-an-application-license-group.md
index 148b0478fb..6e686e7f7b 100644
--- a/mdop/appv-v4/how-to-remove-an-application-license-group.md
+++ b/mdop/appv-v4/how-to-remove-an-application-license-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Remove an Application License Group
 description: How to Remove an Application License Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 35830916-7015-44cd-829b-23599a5029a7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ In the Application Virtualization Server Management Console, you can use the fol
 **Important**  
 Before you can remove a license group, you must remove any licenses associated with the group.
 
- 
+ 
 
 **To remove a license group**
 
@@ -48,9 +51,9 @@ Before you can remove a license group, you must remove any licenses associated w
 
 [How to Set Up an Unlimited License Group](how-to-set-up-an-unlimited-license-group.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md b/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md
index ce153c734b..40b1a72de1 100644
--- a/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md
+++ b/mdop/appv-v4/how-to-remove-the-application-virtualization-system-components.md
@@ -1,12 +1,15 @@
 ---
 title: How to Remove the Application Virtualization System Components
 description: How to Remove the Application Virtualization System Components
-author: jamiejdt
+author: dansimp
 ms.assetid: 45bb1e43-8708-48b7-9169-e3659f32686f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-rename-an-application-group.md b/mdop/appv-v4/how-to-rename-an-application-group.md
index c70f4209a8..a1ee2619d3 100644
--- a/mdop/appv-v4/how-to-rename-an-application-group.md
+++ b/mdop/appv-v4/how-to-rename-an-application-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Rename an Application Group
 description: How to Rename an Application Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 4dfd3336-ea9a-4a56-91e1-7e9d742c7b9a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-rename-an-application.md b/mdop/appv-v4/how-to-rename-an-application.md
index ea630b5cea..d039ae22e5 100644
--- a/mdop/appv-v4/how-to-rename-an-application.md
+++ b/mdop/appv-v4/how-to-rename-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Rename an Application
 description: How to Rename an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 983136b7-66bf-49f6-8dea-8933b622072d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -27,16 +30,16 @@ You can rename an application through the Application Virtualization Server Mana
     **Note**  
     You can also highlight the application in the right pane and press **F2**.
 
-     
+     
 
 ## Related topics
 
 
 [How to Manage Applications in the Server Management Console](how-to-manage-applications-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-repair-an-application.md b/mdop/appv-v4/how-to-repair-an-application.md
index c987f06230..a6a164f1df 100644
--- a/mdop/appv-v4/how-to-repair-an-application.md
+++ b/mdop/appv-v4/how-to-repair-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Repair an Application
 description: How to Repair an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 80b08416-ad86-4ed6-966a-b943e3efb951
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-reset-the-filesystem-cache.md b/mdop/appv-v4/how-to-reset-the-filesystem-cache.md
index 4b81dcaf6a..f419abda81 100644
--- a/mdop/appv-v4/how-to-reset-the-filesystem-cache.md
+++ b/mdop/appv-v4/how-to-reset-the-filesystem-cache.md
@@ -1,12 +1,15 @@
 ---
 title: How to Reset the FileSystem Cache
 description: How to Reset the FileSystem Cache
-author: jamiejdt
+author: dansimp
 ms.assetid: 7777259d-8c21-4c06-9384-9599b69f9828
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-run-a-reportserver.md b/mdop/appv-v4/how-to-run-a-reportserver.md
index e21fd21621..989628b502 100644
--- a/mdop/appv-v4/how-to-run-a-reportserver.md
+++ b/mdop/appv-v4/how-to-run-a-reportserver.md
@@ -1,12 +1,15 @@
 ---
 title: How to Run a Report
 description: How to Run a Report
-author: jamiejdt
+author: dansimp
 ms.assetid: 72a5419b-aa65-4e60-b23e-3751186b7aed
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The process for running a report is the same regardless of the report type. When
 **Note**  
 Reports are not run automatically; you must run them explicitly to generate output data. The length of time it takes to run a report is determined by the amount of data collected in the data store.
 
- 
+ 
 
 **To run a report**
 
@@ -52,9 +55,9 @@ Reports are not run automatically; you must run them explicitly to generate outp
 
 [How to Print a Report](how-to-print-a-reportserver.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md b/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md
index 7704dc4006..71f9b1e3fe 100644
--- a/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md
+++ b/mdop/appv-v4/how-to-sequence-a-new-add-on-or-plug-in-application--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1)
 description: How to Sequence a New Add-on or Plug-in Application (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 2c018215-66e5-4301-8481-159891a6b35b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 Use the following procedure to create a new add-on or plug-in virtual application package by using the Application Virtualization (App-V) Sequencer. An add-on or plug-in application is an application that extends the functionality of an application, for example, a plug-in for Microsoft Excel. For more information about the types of applications you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md).
 
-**Important**  
+**Important**  
 Before performing the following procedure, install the parent application locally on the computer that is running the sequencer. For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that is running the sequencer. Also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package.
 
- 
+
 
 You can also use an existing virtual application package as the parent application. To use an existing virtual application package, use the following procedure before sequencing the new add-on or plug-in.
 
@@ -37,10 +40,10 @@ You can also use an existing virtual application package as the parent applicati
 
 3.  On the **Prepare Computer** page, review the issues that might cause the package creation to fail, or for the package to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information displayed, click **Refresh**. After you have resolved all potential issues, click **Next**.
 
-    **Important**  
+    **Important**  
     If you are required to disable virus scanning software, scan the computer running the sequencer to ensure that no unwanted or malicious files could be added to the package.
 
-     
+
 
 4.  On the **Type of Application** page, select **Add-on or Plug-in**, and then click **Next**.
 
@@ -50,25 +53,29 @@ You can also use an existing virtual application package as the parent applicati
 
 6.  On the **Select Primary** page, click **Browse** and specify the parent application.
 
-    **Important**  
+    **Important**  
     If the parent application that the add-on or plug-in you are installing is going to support has not been installed locally, stop here and install the application on the computer running the sequencer. For example, the **Excel.exe** program file must be installed locally for a Microsoft Excel plug-in.
 
-     
 
-    Click **Next**.
 
-7.  On the **Package Name** page, specify a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will also be displayed in the App-V management console. The **Installation Location** displays the Application Virtualization path where the application will be installed. To edit this location, select **Edit (Advanced)**.
+~~~
+Click **Next**.
+~~~
 
-    **Important**  
-    Editing the Application Virtualization path is an advanced configuration task. You should fully understand the implications of changing the path. For most applications, we recommend the default path.
+7. On the **Package Name** page, specify a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will also be displayed in the App-V management console. The **Installation Location** displays the Application Virtualization path where the application will be installed. To edit this location, select **Edit (Advanced)**.
 
-     
+   **Important**  
+   Editing the Application Virtualization path is an advanced configuration task. You should fully understand the implications of changing the path. For most applications, we recommend the default path.
 
-    Click **Next**.
 
-8.  On the **Installation** page, when the sequencer and application installer are ready, install the plug-in or add-in application so the sequencer can monitor the installation process. Perform the installation by using the application’s installation process. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**.
 
-9.  On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**.
+~~~
+Click **Next**.
+~~~
+
+8. On the **Installation** page, when the sequencer and application installer are ready, install the plug-in or add-in application so the sequencer can monitor the installation process. Perform the installation by using the application’s installation process. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**.
+
+9. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**.
 
 10. On the **Customize** page, if you are finished installing and configuring the virtual application, select **Stop now** and skip to step 14 of this procedure. If you want to customize any of the items in the following list, select **Customize**.
 
@@ -84,25 +91,25 @@ You can also use an existing virtual application package as the parent applicati
 
 12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**.
 
-    **Note**  
-    If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop** and select one of the check boxes, **Stop all applications** or **Stop this application only**.
+   **Note**  
+   If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop** and select one of the check boxes, **Stop all applications** or **Stop this application only**.
+
 
-     
 
 13. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Click **Next**.
 
 14. On the **Create Package** page, to modify the package without saving it, select **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the Sequencer console so that you can modify the package before it is saved. Click **Next**.
 
-    To save the package immediately, select the default **Save the package now**. Optionally, select **Comments** to add comments that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**.
+   To save the package immediately, select the default **Save the package now**. Optionally, select **Comments** to add comments that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**.
 
 15. On the **Completion** page, after you have reviewed the information that is displayed in the **Successful Virtual Application Package Report** pane, click **Close**. The information displayed in the **Successful Virtual Application Package Report** pane is also available in the directory specified in step 14 of this procedure, in a file named **Reports.xml**.
 
-    The package is now available in the sequencer. Click **Edit \[Package Name\]** to edit the package properties. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md).
+   The package is now available in the sequencer. Click **Edit \[Package Name\]** to edit the package properties. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md).
+
+   **Important**  
+   After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer.
 
-    **Important**  
-    After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer.
 
-     
 
 ## Related topics
 
@@ -111,9 +118,9 @@ You can also use an existing virtual application package as the parent applicati
 
 [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md b/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md
index 25445965d8..d519abb772 100644
--- a/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md
+++ b/mdop/appv-v4/how-to-sequence-a-new-application--app-v-46-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Sequence a New Application (App-V 4.6)
 description: How to Sequence a New Application (App-V 4.6)
-author: jamiejdt
+author: dansimp
 ms.assetid: f2c398c6-9200-4be3-b502-e00386fcd150
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,19 +19,19 @@ ms.date: 06/16/2016
 
 Use the following procedure to create a new virtual application by using the Application Virtualization (App-V) Sequencer. You can also use the App-V Sequencer to configure which files and configurations are applicable to all users and which files and configurations users can customize. After you successfully sequence the application, it is available in the App-V Sequencer.
 
-**Important**  
-During sequencing, if the computer running the sequencer is running Windows Vista or Windows 7, and a restart is initiated outside of the virtual environment, for example, by clicking **Start** / **Shut Down**, you must click **Cancel** when prompted to close the program that is preventing Windows from shutting down. If you click **Force shut down**, the package creation will fail, and the computer will restart. When you click **Cancel**, the sequencer successfully records the restart while the application is being sequenced.
+**Important**  
+During sequencing, if the computer running the sequencer is running Windows Vista or Windows 7, and a restart is initiated outside of the virtual environment, for example, by clicking **Start** / **Shut Down**, you must click **Cancel** when prompted to close the program that is preventing Windows from shutting down. If you click **Force shut down**, the package creation will fail, and the computer will restart. When you click **Cancel**, the sequencer successfully records the restart while the application is being sequenced.
+
 
- 
 
 **To sequence a new application**
 
 1.  To create the App-V drive, configure drive Q as the location that can be used to save files while you are sequencing an application. You must then create individual directories for each application that you plan to sequence on drive Q. You can create the virtual application targeted folders before you sequence an application, or you can create them in step 5 of this procedure.
 
-    **Note**  
+    **Note**  
     The App-V drive you specify must be accessible on targeted computers. If drive Q is not accessible, you can choose a different drive letter.
 
-     
+
 
 2.  To start the App-V Sequencer Console, on the computer that is running the App-V Sequencer, select **Start** / **Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**. To start the Sequencing Wizard, click **Create a Package**.
 
@@ -38,34 +41,36 @@ During sequencing, if the computer running the sequencer is running Windows Vis
 
 5.  On the **Monitor Installation** page, when you are ready to install the application, click **Begin Monitoring**, and in the **Browse for Folder** dialog box, specify the directory on drive Q where the application will be installed. If you did not configure drive Q and used a different drive letter for the application virtualization drive, select the drive letter you specified in step 1 of this procedure. To install the application to a folder that has not been created on the application virtualization drive, click **Make New Folder**. After you specify the folder, wait while the Sequencer configures the computer for sequencing.
 
-    **Important**  
+    **Important**  
     You must install each application that you sequence into a separate directory on the virtual application drive, and the associated folder name must not be longer than eight characters.
 
-     
 
-    After the computer has been configured for sequencing, install the application so that the App-V Sequencer can monitor the installation; when you are finished, click **Stop Monitoring**, and then click **Next**.
 
-6.  On the **Configure Applications** page, if necessary, configure the shortcuts and file type associations that will be associated with the virtual application. To add a new file type association or shortcut, click **Add**, and in the **Add Application** dialog box, specify the new element. To remove an existing shortcut or file type association, click **Remove**. To edit an existing element, select the element you want to modify, and then click **Edit**. Specify the configurations in the **Edit Application** dialog box. Click **Save**, and then click **Next**.
+~~~
+After the computer has been configured for sequencing, install the application so that the App-V Sequencer can monitor the installation; when you are finished, click **Stop Monitoring**, and then click **Next**.
+~~~
 
-7.  On the **Launch Applications** page, to start the application to ensure that the package has been installed correctly and is optimized for streaming, select the package, and then click **Launch**. This step is useful for configuring how the application initially runs on targeted computers and for accepting any associated license agreements before the package becomes available to App-V clients. If multiple applications are associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**.
+6. On the **Configure Applications** page, if necessary, configure the shortcuts and file type associations that will be associated with the virtual application. To add a new file type association or shortcut, click **Add**, and in the **Add Application** dialog box, specify the new element. To remove an existing shortcut or file type association, click **Remove**. To edit an existing element, select the element you want to modify, and then click **Edit**. Specify the configurations in the **Edit Application** dialog box. Click **Save**, and then click **Next**.
 
-8.  After you have successfully created the package, in the App-V Sequencer Console, select **File** / **Save** and specify the name and the virtual drive location where the package will be saved.
+7. On the **Launch Applications** page, to start the application to ensure that the package has been installed correctly and is optimized for streaming, select the package, and then click **Launch**. This step is useful for configuring how the application initially runs on targeted computers and for accepting any associated license agreements before the package becomes available to App-V clients. If multiple applications are associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**.
 
-    You can optionally create an associated Windows Installer file (**.msi**) to install the virtual application package on targeted computers. To create a Windows Installer file, open the package in the Sequencer and select **Tools** / **Create MSI**. The Windows Installer file will be created and saved in the directory where the virtual application package is saved.
+8. After you have successfully created the package, in the App-V Sequencer Console, select **File** / **Save** and specify the name and the virtual drive location where the package will be saved.
+
+   You can optionally create an associated Windows Installer file (**.msi**) to install the virtual application package on targeted computers. To create a Windows Installer file, open the package in the Sequencer and select **Tools** / **Create MSI**. The Windows Installer file will be created and saved in the directory where the virtual application package is saved.
+
+   **Important**  
+   After you have successfully created a virtual application package, you cannot run the virtual application package on the computer running the sequencer.
 
-    **Important**  
-    After you have successfully created a virtual application package, you cannot run the virtual application package on the computer running the sequencer.
 
-     
 
 ## Related topics
 
 
 [How to Upgrade a Virtual Application Package (App-V 4.6)](how-to-upgrade-a-virtual-application-package--app-v-46-.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md b/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md
index 14a90fff05..493a114518 100644
--- a/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md
+++ b/mdop/appv-v4/how-to-sequence-a-new-application-by-using-the-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: How to Sequence a New Application by Using the Command Line
 description: How to Sequence a New Application by Using the Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: c3b5c842-6a91-4d0a-9a22-c7b8d1aeb09a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 You can use a command line to sequence a new application. Using a command line is useful when you have to create a large number of virtual applications or when you need to create sequenced applications on a recurring basis.
 
-**Important**  
+**Important**  
 Command-line sequencing allows for default sequencing only. If you need to change default installation settings for the application you are sequencing, you must either manually modify the virtual application or update the virtual application by using the Application Virtualization (App-V) Sequencer. For more information about updating a virtual application by using the App-V Sequencer, see [How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md).
 
- 
+
 
 Use the following procedure to create a virtual application by using the command line.
 
@@ -33,43 +36,45 @@ Use the following procedure to create a virtual application by using the command
 
     `SFTSequencer /INSTALLPACKAGE:"pathtoMSI" /INSTALLPATH:"pathtopackageroot" /OUTPUTFILE:"pathtodestinationSPRJ"`
 
-    **Note**  
+    **Note**  
     You can specify additional parameters by using the command line, depending on the complexity of the application you are sequencing. For a complete list of parameters that are available for use with the App-V Sequencer, see [Sequencer Command-Line Parameters](sequencer-command-line-parameters.md).
 
-     
 
-    Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
      



      ValueDescription
      pathtoMSI
      Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced.
      pathtopackageroot
      Specify the package root directory.
      pathtodestinationSPRJ
      Specifies the path and file name of the SPRJ file that will be created.
      
+~~~
+Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command.
 
-     
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
      



      ValueDescription
      pathtoMSI
      Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced.
      pathtopackageroot
      Specify the package root directory.
      pathtodestinationSPRJ
      Specifies the path and file name of the SPRJ file that will be created.
      
+~~~
 
-4.  Press **Enter**.
+
+
+4. Press **Enter**.
 
 ## Related topics
 
@@ -80,9 +85,9 @@ Use the following procedure to create a virtual application by using the command
 
 [Sequencer Command-Line Parameters](sequencer-command-line-parameters.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md b/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md
index 1c45f57281..3271202faa 100644
--- a/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md
+++ b/mdop/appv-v4/how-to-sequence-a-new-application-package-using-the-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: How to Sequence a New Application Package Using the Command Line
 description: How to Sequence a New Application Package Using the Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: de72912b-d9e7-45b5-a601-12528f1a4cac
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 You can use a command line to sequence a new application. Using a command line is useful when you have to create a large number of virtual applications or when you need to create sequenced applications on a recurring basis.
 
-**Important**  
+**Important**  
 Command-line sequencing allows for default sequencing only. If you need to change default installation settings for the application you are sequencing, you must either manually modify the virtual application or update the virtual application by using the Application Virtualization (App-V) Sequencer. For more information about updating a virtual application by using the App-V Sequencer, see [How to Upgrade an Existing Virtual Application](how-to-upgrade-an-existing-virtual-application.md).
 
- 
+
 
 Use the following procedure to create a virtual application by using the command line.
 
@@ -33,52 +36,54 @@ Use the following procedure to create a virtual application by using the command
 
     `SFTSequencer /INSTALLPACKAGE:"pathtoMSI" /INSTALLPATH:"pathtopackageroot" /OUTPUTFILE:"pathtodestinationSPRJ"`
 
-    **Note**  
+    **Note**  
     You can specify additional parameters by using the command line, depending on the complexity of the application you are sequencing. For a complete list of parameters that are available for use with the App-V Sequencer, see [Application Virtualization Sequencer Command Line](application-virtualization-sequencer-command-line.md).
 
-     
 
-    Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
      



      ValueDescription
      pathtoMSI
      Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced.
      pathtopackageroot
      Specifies the package root directory.
      pathtodestinationSPRJ
      Specifies the path and file name of the SPRJ file that will be created.
      
+~~~
+Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command.
 
-     
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
      



      ValueDescription
      pathtoMSI
      Specifies the Windows Installer or a batch file that will be used to install an application so that it can be sequenced.
      pathtopackageroot
      Specifies the package root directory.
      pathtodestinationSPRJ
      Specifies the path and file name of the SPRJ file that will be created.
      
+~~~
 
-4.  Press **Enter**.
+
+
+4. Press **Enter**.
 
 ## Related topics
 
 
 [How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-sequence-a-new-application.md b/mdop/appv-v4/how-to-sequence-a-new-application.md
index efd21ec2e3..8897653dba 100644
--- a/mdop/appv-v4/how-to-sequence-a-new-application.md
+++ b/mdop/appv-v4/how-to-sequence-a-new-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Sequence a New Application
 description: How to Sequence a New Application
-author: jamiejdt
+author: dansimp
 ms.assetid: e01e98cd-2378-478f-9739-f72c465bf79a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -28,29 +31,31 @@ After you successfully sequence the application, it is available in the App-V Se
 
 3.  On the **Package Information** page, specify the **Package Name** that will be assigned to the virtual application. The package name is required for generating the associated Windows Installer file. You should also add an optional comment that will be assigned to the package and that provides detailed information about the virtual application. To display the **Advanced Options** page, select **Show Advanced Monitoring Options**. Click **Next**.
 
-    **Note**  
+    **Note**  
     To display the **Advanced Options** page, you must select **Show Advanced Monitoring Options**. If you do not require the **Advanced Options** page, skip to step 4.
 
-     
+
 
 4.  On the **Advanced Options** page, to specify the **Block Size** for the virtual application, select the size you want. The block size determines how the **.sft** file will be divided for streaming the package across the network to target computers. To allow Microsoft Update to update the application as it is being sequenced; select **Allow Microsoft Update to run during monitoring**. If you select this option, Microsoft Updates are allowed to be installed during the monitoring phase and you will need to accept the associated updates for them to be installed. To remap the supported dynamic link library (.dll) files so that they use a contiguous space of RAM, select **Rebase DLLs**. Selecting this option can conserve memory and help improve performance. Many applications do not support this option, but it is useful in environments with limited RAM such as in Terminal Server scenarios. Click **Next**.
 
-5.  On the **Monitor Installation** page, to monitor the installation of an application, click **Begin Monitoring**. After you click **Begin Monitoring**, specify the directory on the Q:\\ drive where the application will be installed. To install the application to a folder that has not been ccreated, click **Make New Folder**. You must install each application that you sequence into a separate directory.
+5.  On the **Monitor Installation** page, to monitor the installation of an application, click **Begin Monitoring**. After you click **Begin Monitoring**, specify the directory on the Q:\\ drive where the application will be installed. To install the application to a folder that has not been created, click **Make New Folder**. You must install each application that you sequence into a separate directory.
 
-    **Important**  
+    **Important**  
     The folder name you specify must not be longer than 8 characters.
 
-     
 
-    Wait for the virtual environment to load, and then install the application so that the App-V Sequencer can monitor the process. When you have completed the installation, click **Stop Monitoring** and then click **Next**.
 
-6.  On the **Additional Files to Map to Virtual File System (VFS)** page, to specify additional files to be added to the Virtual File System (VFS), click **Add**. Browse to the file you want to add, and click **Open**. To clear existing files that have been added, click **Reset** and then click **Next**.
+~~~
+Wait for the virtual environment to load, and then install the application so that the App-V Sequencer can monitor the process. When you have completed the installation, click **Stop Monitoring** and then click **Next**.
+~~~
 
-7.  On the **Configure Applications** page, configure the shortcuts and file type associations that will be associated with the virtual application. Select the element you want to update, and then click **Edit Locations**. Specify the configurations in the **Shortcut Locations** dialog box. Click **OK** and then click **Next**.
+6. On the **Additional Files to Map to Virtual File System (VFS)** page, to specify additional files to be added to the Virtual File System (VFS), click **Add**. Browse to the file you want to add, and click **Open**. To clear existing files that have been added, click **Reset** and then click **Next**.
 
-8.  On the **Launch Applications** page, to start the application to ensure that the package is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to clients. If there are multiple applications associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**.
+7. On the **Configure Applications** page, configure the shortcuts and file type associations that will be associated with the virtual application. Select the element you want to update, and then click **Edit Locations**. Specify the configurations in the **Shortcut Locations** dialog box. Click **OK** and then click **Next**.
 
-9.  On the **Sequence Package** page, to close the wizard, click **Finish**.
+8. On the **Launch Applications** page, to start the application to ensure that the package is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to clients. If there are multiple applications associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**.
+
+9. On the **Sequence Package** page, to close the wizard, click **Finish**.
 
 10. After you have successfully created the package, to save the package, in the App-V Sequencer Console, select **File** / **Save** and specify the name and the location where the package will be saved.
 
@@ -59,9 +64,9 @@ After you successfully sequence the application, it is available in the App-V Se
 
 [Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md b/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md
index dde25d7e12..70ccc6f38a 100644
--- a/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md
+++ b/mdop/appv-v4/how-to-sequence-a-new-middleware-application--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Sequence a New Middleware Application (App-V 4.6 SP1)
 description: How to Sequence a New Middleware Application (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 304045c2-5e5e-4c91-b59e-a91fdf2500fb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -18,10 +21,10 @@ Use the following procedure to create a new middleware virtual application packa
 
 Use this type of package by using Dynamic Suite Composition in App-V. Dynamic Suite Composition enables you to define a virtual application package as being dependent on another virtual application package. The dependency enables the application to interact with the middleware or plug-in in the virtual environment, where typically this interaction is prevented. This is useful because a secondary application package can be used with several other primary applications, which enables each primary application to reference the same secondary package. For more information about how to use Dynamic Suite Composition, see [How To Use Dynamic Suite Composition](https://go.microsoft.com/fwlink/?LinkID=203804&clcid=0x409) in the Microsoft Technical Library (https://go.microsoft.com/fwlink/?LinkID=203804&clcid=0x409).
 
-**Important**  
-During sequencing, if the computer running the App-V Sequencer is running Windows Vista or Windows 7 and a restart is initiated outside of the virtual environment, for example, **Start** / **Shut Down**, you must click **Cancel** when prompted to close the program that is preventing Windows from shutting down. If you click **Force shut down**, the package creation fails. When you click **Cancel**, App-V Sequencer successfully records the restart while the application is being sequenced.
+**Important**  
+During sequencing, if the computer running the App-V Sequencer is running Windows Vista or Windows 7 and a restart is initiated outside of the virtual environment, for example, **Start** / **Shut Down**, you must click **Cancel** when prompted to close the program that is preventing Windows from shutting down. If you click **Force shut down**, the package creation fails. When you click **Cancel**, App-V Sequencer successfully records the restart while the application is being sequenced.
+
 
- 
 
 **To sequence a new middleware application**
 
@@ -31,10 +34,10 @@ During sequencing, if the computer running the App-V Sequencer is running Window
 
 3.  On the **Prepare Computer** page, review the issues that might cause the package creation to fail, or for the package to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information displayed, click **Refresh**. After you have resolved all potential issues, click **Next**.
 
-    **Important**  
+    **Important**  
     If you are required to disable virus scanning software, you must scan the computer running the App-VSequencer to ensure that no unwanted or malicious files can be added to the package.
 
-     
+
 
 4.  On the **Type of Application** page, select **Middleware**, and then click **Next**.
 
@@ -44,33 +47,35 @@ During sequencing, if the computer running the App-V Sequencer is running Window
 
 6.  On the **Package Name** page, specify a name that will be associated with the package. The name helps identify the purpose and version of the application that will be added to the package. The package name is also displayed in the App-V Management Console. The **Installation Location** displays the application virtualization path where the application will be installed. To edit this location, select **Edit (Advanced)**.
 
-    **Important**  
+    **Important**  
     Editing the Application Virtualization path is an advanced configuration task. You should fully understand the implications of changing the path. For most applications, we recommend the default path.
 
-     
 
-    Click **Next**.
 
-7.  On the **Installation** page, when the Sequencer and middleware application installer are ready, install the application so that the Sequencer can monitor the installation process. Perform the installation by using the application’s installation process. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**.
+~~~
+Click **Next**.
+~~~
 
-8.  On the **Installation** page, wait while the Sequencer configures the virtual application package.
+7. On the **Installation** page, when the Sequencer and middleware application installer are ready, install the application so that the Sequencer can monitor the installation process. Perform the installation by using the application’s installation process. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**.
 
-9.  On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**.
+8. On the **Installation** page, wait while the Sequencer configures the virtual application package.
+
+9. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**.
 
 10. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box and select the operating systems that can run this package. Click **Next**.
 
 11. On the **Create Package** page, to modify the package without saving it, select the **Continue to modify package without saving using the package editor** check box. Selecting this option opens the package in the Sequencer console so that you can modify the package before it is saved. Click **Next**.
 
-    To save the package immediately, select the default, the **Save the package now** check box. Add optional comments in the **Comments** box that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse**, and then specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**.
+   To save the package immediately, select the default, the **Save the package now** check box. Add optional comments in the **Comments** box that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse**, and then specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**.
 
 12. On the **Completion** page, after you have reviewed the information displayed in the **Virtual Application Package Report** pane, click **Close**. The information displayed in the **Virtual Application Package Report** pane is also available in the directory specified in step 11 of this procedure, in a file named **Report.xml**.
 
-    The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md)
+   The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md)
+
+   **Important**  
+   After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the Sequencer.
 
-    **Important**  
-    After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the Sequencer.
 
-     
 
 ## Related topics
 
@@ -79,9 +84,9 @@ During sequencing, if the computer running the App-V Sequencer is running Window
 
 [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md b/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md
index ba0cbf5519..91c5c8dae1 100644
--- a/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md
+++ b/mdop/appv-v4/how-to-sequence-a-new-standard-application--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Sequence a New Standard Application (App-V 4.6 SP1)
 description: How to Sequence a New Standard Application (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: c4a2eb33-def8-4535-b93a-3d2de21ce29f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,15 +19,15 @@ ms.date: 06/16/2016
 
 Use the following procedure to create a new standard virtual application package by using the Application Virtualization (App-V) Sequencer. This procedure applies to most applications that you sequence. For more information about the types of applications you can sequence, see [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md). You must run the sequencer (**SFTSequencer.exe**) using an account that has administrator privileges because of the changes the sequencer makes to the local system. These changes can include writing files to the **C:\\Program Files** directory, making registry changes, starting and stopping services, updating security descriptors for files, and changing permissions.
 
-**Important**  
-During sequencing, if the computer running the Sequencer is running Windows Vista or Windows 7 and a restart is initiated outside of the virtual environment, for example, **Start** / **Shut Down**, you must click **Cancel** when prompted to close the program that is preventing Windows Vista or Windows from shutting down. If you click **Force shut down**, the package creation fails. When you click **Cancel**, the Sequencer successfully records the restart while the application is being sequenced.
+**Important**  
+During sequencing, if the computer running the Sequencer is running Windows Vista or Windows 7 and a restart is initiated outside of the virtual environment, for example, **Start** / **Shut Down**, you must click **Cancel** when prompted to close the program that is preventing Windows Vista or Windows from shutting down. If you click **Force shut down**, the package creation fails. When you click **Cancel**, the Sequencer successfully records the restart while the application is being sequenced.
 
- 
 
-**Note**  
+
+**Note**  
 Running the App-V sequencer in Safe Mode is not supported.
 
- 
+
 
 **To sequence a new standard application**
 
@@ -34,10 +37,10 @@ Running the App-V sequencer in Safe Mode is not supported.
 
 3.  On the **Prepare Computer** page, review the issues that could cause the package creation to fail, or for the package to contain unnecessary data. We strongly recommend that you resolve all potential issues before you continue. After you have fixed the conflicts, to update the information that is displayed, click **Refresh**. After you have resolved all potential issues, click **Next**.
 
-    **Important**  
+    **Important**  
     If you are required to disable virus scanning software, scan the computer running the Sequencer to ensure that no unwanted or malicious files could be added to the package.
 
-     
+
 
 4.  On the **Type of Application** page, click **Standard Application (default)** check box, and then click **Next**.
 
@@ -47,18 +50,20 @@ Running the App-V sequencer in Safe Mode is not supported.
 
 6.  On the **Package Name** page, specify a name that will be associated with the package. The name helps identify the purpose and version of the application that are added to the package. The package name is also displayed in the App-V management console. The **Primary Virtual Application Directory** displays the Application Virtualization path where the application will be installed on target computers. To edit this location, select **Edit (Advanced)**.
 
-    **Important**  
+    **Important**  
     Editing the Application Virtualization path is an advanced configuration task. You should fully understand the implications of changing the path. For most applications, the default path is recommended.
 
-     
 
-    Click **Next**.
 
-7.  On the **Installation** page, when the Sequencer and application installer are ready, install the application so that the Sequencer can monitor the installation process. Perform the installation by using the application’s installation process. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**.
+~~~
+Click **Next**.
+~~~
 
-8.  On the **Installation** page, wait while the Sequencer configures the virtual application package.
+7. On the **Installation** page, when the Sequencer and application installer are ready, install the application so that the Sequencer can monitor the installation process. Perform the installation by using the application’s installation process. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**.
 
-9.  On the **Configure Software** page, optionally run the programs contained in the package. This step helps complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**.
+8. On the **Installation** page, wait while the Sequencer configures the virtual application package.
+
+9. On the **Configure Software** page, optionally run the programs contained in the package. This step helps complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs you want to run, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. It can take several minutes for all programs to run. Click **Next**.
 
 10. On the **Installation Report** page, you can review information about the virtual application package you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**.
 
@@ -76,30 +81,30 @@ Running the App-V sequencer in Safe Mode is not supported.
 
 13. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**.
 
-    **Note**  
-    If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop**, and select one of the check boxes, **Stop all applications** or **Stop this application only**, depending on what you want.
+   **Note**  
+   If you want to stop an application from loading during this step, in the **Application Launch** dialog box, click **Stop**, and select one of the check boxes, **Stop all applications** or **Stop this application only**, depending on what you want.
+
 
-     
 
 14. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and specify the operating systems that can run this package. Click **Next**.
 
-    **Important**  
-    The operating systems specified during this step reflect the operating systems on target computers that are enabled to run the package. You must ensure that the operating systems specified are supported by the application you are sequencing.
+   **Important**  
+   The operating systems specified during this step reflect the operating systems on target computers that are enabled to run the package. You must ensure that the operating systems specified are supported by the application you are sequencing.
+
 
-     
 
 15. On the **Create Package** page, to modify the package without saving it, select **Continue to modify package without saving using the package editor**. Selecting this option opens the package in the Sequencer console so that you can modify the package before it is saved. Click **Next**.
 
-    To save the package immediately, select the default **Save the package now**. Add optional **Comments** that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**.
+   To save the package immediately, select the default **Save the package now**. Add optional **Comments** that will be associated with the package. Comments are useful for identifying version and other information about the package. The default **Save Location** is also displayed. To change the default location, click **Browse** and specify the new location. The uncompressed package size is displayed. If the package size exceeds 4 GB (uncompressed) and you plan to stream the package to target computers, you must select **Compress Package**. Click **Create**.
 
 16. On the **Completion** page, after you have reviewed the information displayed in the **Virtual Application Package Report** pane, click **Close**. The information displayed in the **Virtual Application Package Report** pane is also available in the directory specified in step 15 of this procedure, in a file named **Report.xml**.
 
     The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about modifying a package, see [How to Modify an Existing Virtual Application Package (App-V 4.6 SP1)](how-to-modify-an-existing-virtual-application-package--app-v-46-sp1-.md)
 
-    **Important**  
+    **Important**  
     After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the Sequencer.
 
-     
+
 
 ## Related topics
 
@@ -108,9 +113,9 @@ Running the App-V sequencer in Safe Mode is not supported.
 
 [How to Determine Which Type of Application to Sequence (App-V 4.6 SP1)](how-to-determine-which-type-of-application-to-sequence---app-v-46-sp1-.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-sequence-an-application.md b/mdop/appv-v4/how-to-sequence-an-application.md
index c527198805..c920cb5280 100644
--- a/mdop/appv-v4/how-to-sequence-an-application.md
+++ b/mdop/appv-v4/how-to-sequence-an-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Sequence an Application
 description: How to Sequence an Application
-author: jamiejdt
+author: dansimp
 ms.assetid: bd643dd6-dbf6-4469-bc70-c43ad9c69da9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -28,29 +31,31 @@ After you successfully sequence the application, it is available in the App-V Se
 
 3.  On the **Package Information** page, specify the **Package Name** that will be assigned to the virtual application. The package name is required for generating the associated Windows Installer file. You should also add an optional comment that will be assigned to the package and that provides detailed information about the virtual application. To display the **Advanced Options** page, select **Show Advanced Monitoring Options**. Click **Next**.
 
-    **Note**  
+    **Note**  
     To display the **Advanced Options** page, you must select **Show Advanced Monitoring Options**. If you do not require the **Advanced Options** page, skip to step 4.
 
-     
 
-4.  On the **Advanced Options** page, to specify the **Block Size** for the virtual application, select the size you want. The block size determines how the **.sft** file will be divided for streaming the package across the network to target computers. To allow Microsoft Update to update the application as it is being sequenced; select **Allow Microsoft Update to run during monitoring**. If you select this option, Microsoft Updates are allowed to be installed during the monitoring phase and you will need to accept the associated updates for them to be installed. To remap the supported dynamic link library (.dll) files so that they use a contiguous space of RAM, select **Rebase DLLs**. Selecting this option can conserve memory and help improve performance. Many applications do not support this option, but it is useful in environments with limited RAM such as in Remote Desktop Session Host (RD Session Host) Server scenarios. Click **Next**.
+
+4.  On the **Advanced Options** page, to specify the **Block Size** for the virtual application, select the size you want. The block size determines how the **.sft** file will be divided for streaming the package across the network to target computers. To allow Microsoft Update to update the application as it is being sequenced; select **Allow Microsoft Update to run during monitoring**. If you select this option, Microsoft Updates are allowed to be installed during the monitoring phase and you will need to accept the associated updates for them to be installed. To remap the supported dynamic link library (.dll) files so that they use a contiguous space of RAM, select **Rebase DLLs**. Selecting this option can conserve memory and help improve performance. Many applications do not support this option, but it is useful in environments with limited RAM such as in Remote Desktop Session Host (RD Session Host) Server scenarios. Click **Next**.
 
 5.  On the **Monitor Installation** page, to monitor the installation of an application, click **Begin Monitoring**. After you click **Begin Monitoring**, specify the directory on the Q:\\ drive where the application will be installed. To install the application to a folder that has not been created, click **Make New Folder**. You must install each application that you sequence into a separate directory.
 
-    **Important**  
+    **Important**  
     The folder name you specify must not be longer than 8 characters.
 
-     
 
-    Wait for the virtual environment to load, and then install the application so that the App-V Sequencer can monitor the process. When you have completed the installation, click **Stop Monitoring**, and then click **Next**.
 
-6.  On the **Additional Files to Map to Virtual File System (VFS)** page, to specify additional files to be added to the Virtual File System (VFS), click **Add**. Browse to the file you want to add and click **Open**. To clear existing files that have been added, click **Reset**, and then click **Next**.
+~~~
+Wait for the virtual environment to load, and then install the application so that the App-V Sequencer can monitor the process. When you have completed the installation, click **Stop Monitoring**, and then click **Next**.
+~~~
 
-7.  On the **Configure Applications** page, configure the shortcuts and file type associations that will be associated with the virtual application. Select the element that you want to update, and then click **Edit Locations**. Specify the configurations in the Shortcut Locations dialog box. Click **OK**, and then click **Next**.
+6. On the **Additional Files to Map to Virtual File System (VFS)** page, to specify additional files to be added to the Virtual File System (VFS), click **Add**. Browse to the file you want to add and click **Open**. To clear existing files that have been added, click **Reset**, and then click **Next**.
 
-8.  On the **Launch Applications** page, to start the application to ensure that the package is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to clients. If there are multiple applications associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**.
+7. On the **Configure Applications** page, configure the shortcuts and file type associations that will be associated with the virtual application. Select the element that you want to update, and then click **Edit Locations**. Specify the configurations in the Shortcut Locations dialog box. Click **OK**, and then click **Next**.
 
-9.  On the **Sequence Package** page, to close the wizard, click **Finish**.
+8. On the **Launch Applications** page, to start the application to ensure that the package is optimized for streaming, select the package and click **Launch**. This step is useful for configuring how the application initially runs on target computers and for accepting any associated license agreements before the package is made available to clients. If there are multiple applications associated with this package, you can select **Launch All** to open all of the applications. To sequence the package, click **Next**.
+
+9. On the **Sequence Package** page, to close the wizard, click **Finish**.
 
 10. After you have successfully created the package, to save the package, in the App-V Sequencer Console, select **File** / **Save** and specify the name and the location where the package will be saved.
 
@@ -61,9 +66,9 @@ After you successfully sequence the application, it is available in the App-V Se
 
 [How to Sequence a New Application by Using the Command Line](how-to-sequence-a-new-application-by-using-the-command-line.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md b/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md
index 105387f44b..6a4304627f 100644
--- a/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md
+++ b/mdop/appv-v4/how-to-set-up-a-concurrent-license-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set Up a Concurrent License Group
 description: How to Set Up a Concurrent License Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 031abcf6-d8ed-49be-bddb-91b2c695d411
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-set-up-a-named-license-group.md b/mdop/appv-v4/how-to-set-up-a-named-license-group.md
index 3dba8deeea..4077c745cd 100644
--- a/mdop/appv-v4/how-to-set-up-a-named-license-group.md
+++ b/mdop/appv-v4/how-to-set-up-a-named-license-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set Up a Named License Group
 description: How to Set Up a Named License Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 8ef6716c-0cb7-4706-ad3b-ac6f27b2e7ad
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md b/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md
index b03f41cc86..4da9b85aa9 100644
--- a/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md
+++ b/mdop/appv-v4/how-to-set-up-an-unlimited-license-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set Up an Unlimited License Group
 description: How to Set Up an Unlimited License Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 0c37c7b7-aba9-4c03-9e0e-94c966f874cf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md b/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md
index c6dbf15e3b..66c1796f86 100644
--- a/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md
+++ b/mdop/appv-v4/how-to-set-up-and-enable-or-disable-authentication.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set Up and Enable or Disable Authentication
 description: How to Set Up and Enable or Disable Authentication
-author: jamiejdt
+author: dansimp
 ms.assetid: 1e43d0c5-a467-4a8b-b656-93f75d7deb82
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -17,9 +20,9 @@ ms.date: 06/16/2016
 The Application Virtualization Server Management Console lets you enable or disable Windows authentication, which lets you to define who has access to the system. You can use the following procedures to set up and disable authentication from the **Provider Policies Results** pane of the console.
 
 **Note**  
-  Normally, you set up authentication when you add a provider policy through the New Provider Policy Wizard.
+  Normally, you set up authentication when you add a provider policy through the New Provider Policy Wizard.
 
- 
+ 
 
 **To set up authentication**
 
@@ -50,9 +53,9 @@ The Application Virtualization Server Management Console lets you enable or disa
 
 [How to Customize an Application Virtualization System in the Server Management Console](how-to-customize-an-application-virtualization-system-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md b/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md
index 441ee67f73..9e7b1e615b 100644
--- a/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md
+++ b/mdop/appv-v4/how-to-set-up-or-disable-application-licensing.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set Up or Disable Application Licensing
 description: How to Set Up or Disable Application Licensing
-author: jamiejdt
+author: dansimp
 ms.assetid: 7c00b531-ec41-4970-b0fc-d84225ce3bb2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-set-up-or-disable-database-size.md b/mdop/appv-v4/how-to-set-up-or-disable-database-size.md
index a9d6e881df..f6db631033 100644
--- a/mdop/appv-v4/how-to-set-up-or-disable-database-size.md
+++ b/mdop/appv-v4/how-to-set-up-or-disable-database-size.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set Up or Disable Database Size
 description: How to Set Up or Disable Database Size
-author: jamiejdt
+author: dansimp
 ms.assetid: 4abaf349-132d-4186-8873-a0e515593b93
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ When the size of the stored data reaches 95% (the high watermark) of the specifi
 **Note**  
 The **No Size Limit** and **Keep All Usage** options are provided so that you can disable usage reporting and database cleanup. Selecting these items will clean up the database transaction log as well. (All committed Microsoft SQL Server transactions will be removed from the database log.)
 
- 
+ 
 
 **To set up database size**
 
@@ -52,9 +55,9 @@ The **No Size Limit** and **Keep All Usage** options are provided so that you ca
 
 [How to Set Up or Disable Usage Reporting](how-to-set-up-or-disable-usage-reporting.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md b/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md
index b50b3a12e4..1dc1ac12a1 100644
--- a/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md
+++ b/mdop/appv-v4/how-to-set-up-or-disable-usage-reporting.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set Up or Disable Usage Reporting
 description: How to Set Up or Disable Usage Reporting
-author: jamiejdt
+author: dansimp
 ms.assetid: 8587003a-128d-4b5d-ac70-5b9eddddd3dc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -17,9 +20,9 @@ ms.date: 06/16/2016
 You can use the following procedures in the Application Virtualization Server Management Console to specify the duration (in months) of Application Virtualization System usage information you want to store in the database.
 
 **Note**  
- To store usage information, you must select the **Log Usage Information** check box on the **Provider Pipeline** tab. To display this tab, right-click the provider policy in the **Provider Policies Results** pane and select **Properties**.
+ To store usage information, you must select the **Log Usage Information** check box on the **Provider Pipeline** tab. To display this tab, right-click the provider policy in the **Provider Policies Results** pane and select **Properties**.
 
- 
+ 
 
 **To set up usage reporting**
 
@@ -52,9 +55,9 @@ You can use the following procedures in the Application Virtualization Server Ma
 
 [How to Set Up or Disable Database Size](how-to-set-up-or-disable-database-size.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md b/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md
index 43c71f8bf4..4aaf75708f 100644
--- a/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md
+++ b/mdop/appv-v4/how-to-set-up-periodic-publishing-refresh.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set Up Periodic Publishing Refresh
 description: How to Set Up Periodic Publishing Refresh
-author: jamiejdt
+author: dansimp
 ms.assetid: c358c765-cb88-4881-b4e7-0a2e87304870
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can use the following procedure to configure the client to periodically refr
 **Note**  
 After you have performed this procedure, the publishing information will be refreshed according to the new settings after the first refresh at login. When this first refresh occurs, the server might override the computer settings with different settings, depending on how it is configured. The **Refresh** tab in the **Properties** dialog box shows the locally configured client computer settings and any settings that might have been configured for the user by the publishing server.
 
- 
+ 
 
 **To periodically refresh the publishing information from the Application Virtualization Servers**
 
@@ -32,7 +35,7 @@ After you have performed this procedure, the publishing information will be refr
     **Note**  
     This setting will cause the client to refresh publishing information every time the configured period elapses. If the user is not logged in when it's time to do a refresh, the refresh will take place when the user next logs in. The timer is then started again for the next period.
 
-     
+     
 
 4.  Click **Apply** to change the configuration.
 
@@ -43,9 +46,9 @@ After you have performed this procedure, the publishing information will be refr
 
 [How to Configure the Client in the Application Virtualization Client Management Console](how-to-configure-the-client-in-the-application-virtualization-client-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md b/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md
index ec0a6741d4..0c4fc3c8e1 100644
--- a/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md
+++ b/mdop/appv-v4/how-to-set-up-publishing-refresh-on-login.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set Up Publishing Refresh on Login
 description: How to Set Up Publishing Refresh on Login
-author: jamiejdt
+author: dansimp
 ms.assetid: 196448db-7645-4fd5-a854-ef6405b15db4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-set-up-publishing-servers.md b/mdop/appv-v4/how-to-set-up-publishing-servers.md
index 65f0e68880..08ed01a0ed 100644
--- a/mdop/appv-v4/how-to-set-up-publishing-servers.md
+++ b/mdop/appv-v4/how-to-set-up-publishing-servers.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set Up Publishing Servers
 description: How to Set Up Publishing Servers
-author: jamiejdt
+author: dansimp
 ms.assetid: 2111f079-c202-4c49-b2a6-f4237068b2dc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-uninstall-the-app-v-client.md b/mdop/appv-v4/how-to-uninstall-the-app-v-client.md
index d4c419ebb5..6a88f59a7d 100644
--- a/mdop/appv-v4/how-to-uninstall-the-app-v-client.md
+++ b/mdop/appv-v4/how-to-uninstall-the-app-v-client.md
@@ -1,12 +1,15 @@
 ---
 title: How to Uninstall the App-V Client
 description: How to Uninstall the App-V Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 07591270-9651-4bb5-a5b3-e0fc009bd9e2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -25,14 +28,14 @@ Use the following procedure to uninstall the Application Virtualization Client f
     **Important**  
     The uninstall process cannot be canceled or interrupted.
 
-     
+     
 
 3.  When a message stating that the Microsoft Application Virtualization Client Tray application must be closed before continuing appears, right-click the App-V icon in the notification area and select **Exit** to close the application. Then click **Retry** to continue with the uninstall process.
 
     **Important**  
     You might see a message stating that one or more virtual applications are in use. Close any open applications and save your data before you continue. Then click **OK** to continue with the uninstall process.
 
-     
+     
 
 4.  A progress bar shows the time remaining. When this step finishes, you must restart the computer so that all associated drivers can be stopped to complete the uninstall process.
 
@@ -47,7 +50,7 @@ Use the following procedure to uninstall the Application Virtualization Client f
 
     -   HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\SoftGrid\\4.5\\SystemGuard\\SecKey
 
-     
+     
 
 ## Related topics
 
@@ -58,9 +61,9 @@ Use the following procedure to uninstall the Application Virtualization Client f
 
 [How to Publish a Virtual Application on the Client](how-to-publish-a-virtual-application-on-the-client.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md b/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md
index 1ac62d003e..a5bf655e68 100644
--- a/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md
+++ b/mdop/appv-v4/how-to-upgrade-a-package-using-the-open-package-command.md
@@ -1,12 +1,15 @@
 ---
 title: How to Upgrade a Package Using the Open Package Command
 description: How to Upgrade a Package Using the Open Package Command
-author: jamiejdt
+author: dansimp
 ms.assetid: 67c10440-de8a-4547-a34b-f83206d0cc3b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -27,16 +30,16 @@ Use the Open Package command to upgrade or apply an update to a sequenced applic
     **Important**  
     Updating the file name with the package version is essential to successfully completing the upgrade.
 
-     
+     
 
 ## Related topics
 
 
 [How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-upgrade-a-package.md b/mdop/appv-v4/how-to-upgrade-a-package.md
index 687cb1246b..5c88a1bf32 100644
--- a/mdop/appv-v4/how-to-upgrade-a-package.md
+++ b/mdop/appv-v4/how-to-upgrade-a-package.md
@@ -1,12 +1,15 @@
 ---
 title: How to Upgrade a Package
 description: How to Upgrade a Package
-author: jamiejdt
+author: dansimp
 ms.assetid: 831c7556-6f6c-4b3a-aefb-26889094dc1a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -25,7 +28,7 @@ When you upgrade a package with a new version, you can leave the existing versio
     **Note**  
     If resequencing did not add features that changed the Open Software Descriptor (OSD), icon (ICO), or Sequencer Project (SPRJ) files, you do not need to copy those. You can include these files if you want all these files to display the same date.
 
-     
+     
 
 2.  In left pane of the Application Virtualization Server Management Console, expand **Packages**.
 
@@ -44,9 +47,9 @@ When you upgrade a package with a new version, you can leave the existing versio
 
 [How to Manage Packages in the Server Management Console](how-to-manage-packages-in-the-server-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md b/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md
index ac16495e5e..0ac6b50d84 100644
--- a/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md
+++ b/mdop/appv-v4/how-to-upgrade-a-sequenced-application-package-using-the-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: How to Upgrade a Sequenced Application Package Using the Command Line
 description: How to Upgrade a Sequenced Application Package Using the Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: 682fac46-c71d-4731-831b-81bfd5032764
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -26,56 +29,58 @@ Use the following procedure to upgrade a virtual application by using a command
 
     `SFTSequencer /UPGRADE:"pathtosourceSPRJ" /INSTALLPACKAGE:"pathtoUpgradeInstaller" /DECODEPATH:"pathtodecodefolder" /OUTPUTFILE:"pathtodestinationSPRJ"`
 
-    **Note**  
+    **Note**  
     You can specify additional parameters by using the command line, depending on the complexity of the application you are upgrading. For a complete list of parameters that are available for use with the App-V Sequencer, see [Command-Line Parameters](command-line-parameters.md).
 
-     
 
-    Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
      



      ValueDescription
      pathtosourceSPRJ
      Specifies the directory location of the virtual application to be upgraded.
      pathtoUpgradeInstaller
      Specifies the Windows Installer or a batch file that will be used to install an upgrade to the application.
      pathtodecodefolder
      Specify the directory in which to unpack the SFT file.
      pathtodestinationSPRJ
      Specifies the path and file name of the SPRJ file that will be created.
      
+~~~
+Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command.
 
-     
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
      



      ValueDescription
      pathtosourceSPRJ
      Specifies the directory location of the virtual application to be upgraded.
      pathtoUpgradeInstaller
      Specifies the Windows Installer or a batch file that will be used to install an upgrade to the application.
      pathtodecodefolder
      Specify the directory in which to unpack the SFT file.
      pathtodestinationSPRJ
      Specifies the path and file name of the SPRJ file that will be created.
      
+~~~
 
-4.  Press **Enter**.
+
+
+4. Press **Enter**.
 
 ## Related topics
 
 
 [How to Manage Virtual Applications Using the Command Line](how-to-manage-virtual-applications-using-the-command-line.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md b/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md
index 06734f2891..131400d266 100644
--- a/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md
+++ b/mdop/appv-v4/how-to-upgrade-a-sequenced-virtual-application-package.md
@@ -1,12 +1,15 @@
 ---
 title: How to Upgrade a Sequenced Virtual Application Package
 description: How to Upgrade a Sequenced Virtual Application Package
-author: jamiejdt
+author: dansimp
 ms.assetid: ffa989f3-6621-4c59-9599-e3c3b3332f67
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can upgrade an existing virtual application to a new version by using the Ap
 **Caution**  
 You should not reference a previous version of the Windows Installer (.msi) file when you upgrade an existing virtual application package because the previous version of the .sft file will be modified during the upgrade.
 
- 
+ 
 
 Use the following procedure to upgrade an existing virtual application.
 
@@ -34,7 +37,7 @@ Use the following procedure to upgrade an existing virtual application.
     **Important**  
     The directory that you specify must be located in the package root directory on the Q:\\ drive. You can create a new folder, or you can create a subfolder under the directory where the original virtual application is saved. The name assigned to the new folder must not be longer than 8 eight characters.
 
-     
+     
 
 4.  To open the Sequencing Wizard, select **Tools**/**Sequencing Wizard**. On the **Package Information** page, optionally specify the new **Package Name** and add optional comments that will be associated with the updated virtual application. Click **Next**.
 
@@ -55,9 +58,9 @@ Use the following procedure to upgrade an existing virtual application.
 
 [Tasks for the Application Virtualization Sequencer](tasks-for-the-application-virtualization-sequencer.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md b/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md
index a2983eaa8f..8557a608b7 100644
--- a/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md
+++ b/mdop/appv-v4/how-to-upgrade-a-virtual-application-by-using-the-command-line.md
@@ -1,12 +1,15 @@
 ---
 title: How to Upgrade a Virtual Application by Using the Command Line
 description: How to Upgrade a Virtual Application by Using the Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: 83c97767-6ea1-42aa-b411-ccc9fa61cf81
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -26,47 +29,49 @@ Use the following procedure to upgrade a virtual application by using a command
 
     `SFTSequencer /UPGRADE:"pathtosourceSPRJ" /INSTALLPACKAGE:"pathtoUpgradeInstaller" /DECODEPATH:"pathtodecodefolder" /OUTPUTFILE:"pathtodestinationSPRJ"`
 
-    **Note**  
+    **Note**  
     You can specify additional parameters by using the command line, depending on the complexity of the application you are upgrading. For a complete list of parameters that are available for use with the App-V Sequencer, see [Sequencer Command-Line Parameters](sequencer-command-line-parameters.md).
 
-     
 
-    Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
      



      ValueDescription
      pathtosourceSPRJ
      Specifies the directory location of the virtual application to be upgraded.
      pathtoUpgradeInstaller
      Specifies the Windows Installer or a batch file that will be used to install an upgrade to the application.
      pathtodecodefolder
      Specify the directory in which to unpack the SFT file.
      pathtodestinationSPRJ
      Specifies the path and file name of the SPRJ file that will be created.
      
+~~~
+Use the value descriptions in the following table to help you determine the actual text you will use in the preceding command.
 
-     
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
      



      ValueDescription
      pathtosourceSPRJ
      Specifies the directory location of the virtual application to be upgraded.
      pathtoUpgradeInstaller
      Specifies the Windows Installer or a batch file that will be used to install an upgrade to the application.
      pathtodecodefolder
      Specify the directory in which to unpack the SFT file.
      pathtodestinationSPRJ
      Specifies the path and file name of the SPRJ file that will be created.
      
+~~~
 
-4.  Press **Enter**.
+
+
+4. Press **Enter**.
 
 ## Related topics
 
@@ -77,9 +82,9 @@ Use the following procedure to upgrade a virtual application by using a command
 
 [Sequencer Command-Line Parameters](sequencer-command-line-parameters.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md b/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md
index 75d9da6514..043776bf7d 100644
--- a/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md
+++ b/mdop/appv-v4/how-to-upgrade-a-virtual-application-package--app-v-46-.md
@@ -1,12 +1,15 @@
 ---
 title: How to Upgrade a Virtual Application Package (App-V 4.6)
 description: How to Upgrade a Virtual Application Package (App-V 4.6)
-author: jamiejdt
+author: dansimp
 ms.assetid: 3566227e-f3dc-4c32-af1f-e0211588118c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -25,7 +28,7 @@ Use the following procedure to upgrade an existing virtual application by using
     **Warning**  
     You must specify the root folder of the existing virtual application. Do not manually create a subfolder or the upgrade will fail.
 
-     
+     
 
 3.  On the **Package Information** page, specify the **Package Name** that will be assigned to the updated package. The package name is required for generating the associated Windows Installer file. You should also add an optional comment that will be assigned to the package and that provides detailed information about the virtual application—for example, a version number. To display the **Advanced Options** page, select **Show Advanced Monitoring Options** and click **Next**; otherwise, proceed to step 5.
 
@@ -48,9 +51,9 @@ Use the following procedure to upgrade an existing virtual application by using
 
 [How to Sequence a New Application (App-V 4.6)](how-to-sequence-a-new-application--app-v-46-.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md b/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md
index ba0dbd48c9..f56ab1c22a 100644
--- a/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md
+++ b/mdop/appv-v4/how-to-upgrade-an-existing-virtual-application.md
@@ -1,12 +1,15 @@
 ---
 title: How to Upgrade an Existing Virtual Application
 description: How to Upgrade an Existing Virtual Application
-author: jamiejdt
+author: dansimp
 ms.assetid: ec531576-2423-4c2c-9b9f-da74174a6858
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md b/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md
index 340821d1cc..2441e92fe0 100644
--- a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md
+++ b/mdop/appv-v4/how-to-upgrade-the-application-virtualization-client.md
@@ -1,12 +1,15 @@
 ---
 title: How to Upgrade the Application Virtualization Client
 description: How to Upgrade the Application Virtualization Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 2a75d8b5-da88-456c-85bb-f5bd3d470f7f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,12 +22,12 @@ You can use the following procedures to upgrade the Application Virtualization (
 **Note**  
 During the upgrade to Application Virtualization (App-V) 4.5 or later versions, the permissions to the HKCU registry key are changed. Because of this, users will lose user configurations that were set previously, such as user-configured Disconnected Mode settings. If the user is not actively restricted from configuring client user interface behavior through a permission lockdown, the user can reset these preferences after a publishing refresh.
 
- 
+ 
 
 **Important**  
 When upgrading to version 4.6 or a later version of the App-V Client, you must use the correct installer for the computer’s operating system, 32-bit or 64-bit. The installation will fail and an error message will be displayed if you use the wrong installer.
 
- 
+ 
 
 **To upgrade the Application Virtualization Desktop Client**
 
@@ -47,7 +50,7 @@ When upgrading to version 4.6 or a later version of the App-V Client, you must
 
     -   Microsoft Visual C++ 2008 SP1 Redistributable Package (x86)
 
-     
+     
 
 5.  Click **Install**. Installation progress is displayed, and the status changes from **Pending** to **Installing**. Installation status changes to **Succeeded** as each step is completed successfully.
 
@@ -60,14 +63,14 @@ When upgrading to version 4.6 or a later version of the App-V Client, you must
     **Warning**  
     If you did not shut down the client program in step 1, you might see a **Files In Use** warning displayed. If this happens, right-click the App-V Client icon displayed in the desktop notification area and select **Exit** to shut down the existing client. Then click **Retry** to continue.
 
-     
+     
 
 9.  When the installation completes successfully, you will be prompted to restart the computer. You need to restart the computer to complete the installation.
 
     **Caution**  
     If the upgrade fails for any reason, you will need to restart the computer before attempting the upgrade again.
 
-     
+     
 
 **To upgrade the Application Virtualization Client by Using the Command Line**
 
@@ -78,7 +81,7 @@ When upgrading to version 4.6 or a later version of the App-V Client, you must
 
     -   For App-V version 4.6, command-line parameters cannot be used during an upgrade and will be ignored.
 
-     
+     
 
 2.  The following command-line example uses the setup.msi file to upgrade the App-V Client. You will need to use the correct client installer program depending on whether you are upgrading the App-V Desktop Client or the App-V Client for Remote Desktop Services (formerly Terminal Services).
 
@@ -87,7 +90,7 @@ When upgrading to version 4.6 or a later version of the App-V Client, you must
     **Important**  
     The quotation marks are required only when the value contains a space. For consistency, all instances in the preceding example are shown as having quotation marks.
 
-     
+     
 
 **To upgrade the Application Virtualization Client for Remote Desktop Services**
 
@@ -98,7 +101,7 @@ When upgrading to version 4.6 or a later version of the App-V Client, you must
     **Note**  
     In App-V version 4.6 and later, in addition to using the command line to upgrade the client, you can also use a Remote Desktop session. No special parameters are required to start the Remote Desktop session.
 
-     
+     
 
 3.  After the Client for Remote Desktop Services upgrade is complete, restart and log in to the RD Session Host.
 
@@ -107,16 +110,16 @@ When upgrading to version 4.6 or a later version of the App-V Client, you must
     **Caution**  
     If the upgrade fails for any reason, you will need to restart the computer before attempting the upgrade again.
 
-     
+     
 
 ## Related topics
 
 
 [Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md b/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md
index 6673dc69ab..2842d352f7 100644
--- a/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md
+++ b/mdop/appv-v4/how-to-upgrade-the-application-virtualization-sequencer.md
@@ -1,12 +1,15 @@
 ---
 title: How to Upgrade the Application Virtualization Sequencer
 description: How to Upgrade the Application Virtualization Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: 7f85f140-5034-4227-85ef-81f205e722ef
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md b/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md
index 4987d0aa3d..924c233ee0 100644
--- a/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md
+++ b/mdop/appv-v4/how-to-upgrade-the-servers-and-system-components.md
@@ -1,12 +1,15 @@
 ---
 title: How to Upgrade the Servers and System Components
 description: How to Upgrade the Servers and System Components
-author: jamiejdt
+author: dansimp
 ms.assetid: 7d8374fe-5897-452e-923e-556a854b2024
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,7 +26,7 @@ Use the following procedure to upgrade software components installed on all Appl
 
 -   You can upgrade to Microsoft Application Virtualization (App-V) 4.5 only from Microsoft Application Virtualization (App-V) 4.1 or 4.1 SP1. App-V 4.0 and earlier must be uninstalled or upgraded to 4.1 or 4.1 SP1 before upgrading to App-V 4.5.
 
- 
+ 
 
 **To upgrade software components on Application Virtualization System computers**
 
@@ -48,7 +51,7 @@ Use the following procedure to upgrade software components installed on all Appl
 
     When you want to restore a database with VSS, you must first stop the App-V Server Service on the Management Server. This should be done on every Management server if there is more than one server connected to the same database.
 
-     
+     
 
 9.  On the first **Package Validation** page, read the content and then click **Next**.
 
@@ -67,9 +70,9 @@ Use the following procedure to upgrade software components installed on all Appl
 
 [Application Virtualization Deployment and Upgrade Considerations](application-virtualization-deployment-and-upgrade-considerations.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-use-dynamic-suite-composition.md b/mdop/appv-v4/how-to-use-dynamic-suite-composition.md
index e2b0d5259f..e6841ce254 100644
--- a/mdop/appv-v4/how-to-use-dynamic-suite-composition.md
+++ b/mdop/appv-v4/how-to-use-dynamic-suite-composition.md
@@ -1,12 +1,15 @@
 ---
 title: How To Use Dynamic Suite Composition
 description: How To Use Dynamic Suite Composition
-author: jamiejdt
+author: dansimp
 ms.assetid: 24147feb-a0a8-4791-a8e5-cbe5fe13c762
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -27,7 +30,7 @@ If you plan to make several primary applications dependent on a single middlewar
 **Important**  
 Package dependencies can be specified as mandatory for a primary application. If a secondary package is flagged as mandatory and it cannot be accessed for some reason during loading, the load of the secondary package will fail. Also, the primary application will fail when the user tries to start it.
 
- 
+ 
 
 You can use the following procedures to create a secondary package, for either a plug-in or a middleware component, and then you can use the final procedure to define the dependency in the OSD file of the secondary package.
 
@@ -44,7 +47,7 @@ You can use the following procedures to create a secondary package, for either a
     **Important**  
     You must specify a new package root for the secondary package.
 
-     
+     
 
 5.  Start the sequencer monitoring phase.
 
@@ -59,7 +62,7 @@ You can use the following procedures to create a secondary package, for either a
     **Note**  
     To assist with management of secondary packages, it is recommended that the package name include the term “Secondary package” to emphasize that this is a package that will not function as a stand-alone application—for example, **\[Plug In Name\] Secondary package**.
 
-     
+     
 
 **To create a secondary package for middleware by using Dynamic Suite Composition**
 
@@ -84,56 +87,56 @@ You can use the following procedures to create a secondary package, for either a
     **Note**  
     To assist with management of secondary packages, it is recommended that the package name include the term “Secondary package” to emphasize that this is a package that will not function as a stand-alone application—for example, **\[Middleware Name\] Secondary package**.
 
-     
+     
 
 **To define the dependency in the primary package**
 
-1.  On the server, open the OSD file of the secondary package for editing. (It is a good idea to use an XML editor to make changes to the OSD file; however, you can use Notepad as an alternative.)
+1. On the server, open the OSD file of the secondary package for editing. (It is a good idea to use an XML editor to make changes to the OSD file; however, you can use Notepad as an alternative.)
 
-2.  Copy the **CODEBASE HREF** line from that file.
+2. Copy the **CODEBASE HREF** line from that file.
 
-3.  Open the OSD file of the primary package for editing.
+3. Open the OSD file of the primary package for editing.
 
-4.  Insert the **<DEPENDENCIES>**tag after the close of **</ENVLIST>** tag at the end of the **<VIRTUALENV>** section just before the **</VIRTUALENV>** tag.
+4. Insert the <DEPENDENCIES>tag after the close of **</ENVLIST>** tag at the end of the **<VIRTUALENV>** section just before the **</VIRTUALENV>** tag.
 
-5.  Paste the **CODEBASE HREF** line from the secondary package after the **<DEPENDENCIES>** tag you just created.
+5. Paste the **CODEBASE HREF** line from the secondary package after the **<DEPENDENCIES>** tag you just created.
 
-6.  If the secondary package is a mandatory package, which means that it must be started before the primary package is started, add the **MANDATORY=”TRUE”** property inside the **CODEBASE** tag. If it is not mandatory, the property can be omitted.
+6. If the secondary package is a mandatory package, which means that it must be started before the primary package is started, add the **MANDATORY=”TRUE”** property inside the **CODEBASE** tag. If it is not mandatory, the property can be omitted.
 
-7.  Close the **<DEPENDENCIES>** tag by inserting the following:
+7. Close the **<DEPENDENCIES>** tag by inserting the following:
 
-    **</DEPENDENCIES>**
+   **</DEPENDENCIES>**
 
-8.  Review the changes that you made to the OSD file, and then save and close the file. The following example shows how the added section should appear. The tag values shown here are for example only.
+8. Review the changes that you made to the OSD file, and then save and close the file. The following example shows how the added section should appear. The tag values shown here are for example only.
 
-    **<VIRTUALENV>**
+   **<VIRTUALENV>**
 
-         **<ENVLIST>**
+        **<ENVLIST>**
 
-    **…**
+   **…**
 
-         **</ENVLIST>**
+        **</ENVLIST>**
 
-         **<DEPENDENCIES>**
+        **<DEPENDENCIES>**
 
-              **<CODEBASE HREF="rtsp://virt\_apps/package.1/package.1.sft" GUID="D54C80FA-9DFF-459D-AA33-DD852C9FBFBA" SYSGUARDFILE="package.1\\osguard.cp"/>**
+             **<CODEBASE HREF="rtsp://virt\_apps/package.1/package.1.sft" GUID="D54C80FA-9DFF-459D-AA33-DD852C9FBFBA" SYSGUARDFILE="package.1\\osguard.cp"/>**
 
-              **<CODEBASE HREF="rtsp://sample\_apps/package.2/sample.sft" GUID="D54C80FA-9DFF-459D-AA33-DD852C9FBFBA" SYSGUARDFILE="package.2\\osguard.cp" MANDATORY="TRUE" />**
+             **<CODEBASE HREF="rtsp://sample\_apps/package.2/sample.sft" GUID="D54C80FA-9DFF-459D-AA33-DD852C9FBFBA" SYSGUARDFILE="package.2\\osguard.cp" MANDATORY="TRUE" />**
 
-         **</DEPENDENCIES>**
+        **</DEPENDENCIES>**
 
-    **</VIRTUALENV>**
+   **</VIRTUALENV>**
 
-9.  If the secondary package has any entries in the **<ENVLIST>** section of the OSD file, you must copy those entries to the same section in the primary package.
+9. If the secondary package has any entries in the **<ENVLIST>** section of the OSD file, you must copy those entries to the same section in the primary package.
 
 ## Related topics
 
 
 [How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md b/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md
index 6432a2ff86..a457af6266 100644
--- a/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md
+++ b/mdop/appv-v4/how-to-use-the-cache-space-management-feature.md
@@ -1,12 +1,15 @@
 ---
 title: How to Use the Cache Space Management Feature
 description: How to Use the Cache Space Management Feature
-author: jamiejdt
+author: dansimp
 ms.assetid: 60965660-c015-46a8-88ac-54cbc050fe33
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ More than one package is deleted if necessary. Packages that are locked are not
 **Note**  
 To ensure that the cache has sufficient space allocated for all packages that might be deployed, use the **Use free disk space threshold** setting when you configure the client so that the cache can grow as needed. Alternatively, determine in advance how much disk space will be needed for the App-V cache, and at installation time, set the cache size accordingly.
 
- 
+ 
 
 The cache space management feature is controlled by the UnloadLeastRecentlyUsed registry value. A value of 1 enables the feature, and a value of 0 (zero) disables it.
 
@@ -40,16 +43,16 @@ The cache space management feature is controlled by the UnloadLeastRecentlyUsed
     **Caution**  
     The maximum value for this registry key is 0x00011111. Larger values will prevent the correct operation of the cache space management feature.
 
-     
+     
 
 ## Related topics
 
 
 [How to Configure the App-V Client Registry Settings by Using the Command Line](how-to-configure-the-app-v-client-registry-settings-by-using-the-command-line.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md b/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md
index 8cb669a1da..a8943af3a2 100644
--- a/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md
+++ b/mdop/appv-v4/how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md
@@ -1,12 +1,15 @@
 ---
 title: How to Use the Desktop Notification Area for Application Virtualization Client Management
 description: How to Use the Desktop Notification Area for Application Virtualization Client Management
-author: jamiejdt
+author: dansimp
 ms.assetid: 75b2e636-7669-4e1e-8368-8b9fca567a84
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/how-to-use-the-differential-sft-file.md b/mdop/appv-v4/how-to-use-the-differential-sft-file.md
index 347d12e4ce..963df8c7b7 100644
--- a/mdop/appv-v4/how-to-use-the-differential-sft-file.md
+++ b/mdop/appv-v4/how-to-use-the-differential-sft-file.md
@@ -1,12 +1,15 @@
 ---
 title: How to Use the Differential SFT File
 description: How to Use the Differential SFT File
-author: jamiejdt
+author: dansimp
 ms.assetid: 607e30fd-2f0e-4e2f-b669-0b3f010aebb0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -25,7 +28,7 @@ For more information about upgrading a package, see “How to Upgrade an Existin
 **Note**  
 As a prerequisite, all user computers being targeted by the ESD must have the V1.sft file fully loaded into their local cache, and file streaming must be enabled on all computers.
 
- 
+ 
 
 **To use the Differential SFT file**
 
@@ -52,16 +55,16 @@ As a prerequisite, all user computers being targeted by the ESD must have the V1
 
 -   The **Generate Microsoft Windows Installer (MSI) Package** capability in the Sequencer cannot be used with the Differential SFT file.
 
- 
+ 
 
 ## Related topics
 
 
 [How to Create or Upgrade Virtual Applications Using the App-V Sequencer](how-to-create-or-upgrade-virtual-applications-using--the-app-v-sequencer.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md b/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md
index 67f46a3539..06576c4ec4 100644
--- a/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md
+++ b/mdop/appv-v4/how-to-work-offline-or-online-with-application-virtualization.md
@@ -1,12 +1,15 @@
 ---
 title: How to Work Offline or Online with Application Virtualization
 description: How to Work Offline or Online with Application Virtualization
-author: jamiejdt
+author: dansimp
 ms.assetid: aa532b37-8a00-4db4-9b51-e1e8354b2495
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ If you plan to be disconnected from the network for an extended period of time,
 **Note**  
 By default, **Work Offline** is disabled for the Client for Remote Desktop Services (formerly Terminal Services). Your system administrator must change your user permissions to allow you to use this setting on a Client for Remote Desktop Services.
 
- 
+ 
 
 **To work offline**
 
@@ -34,9 +37,9 @@ By default, **Work Offline** is disabled for the Client for Remote Desktop Servi
 
 [How to Use the Desktop Notification Area for Application Virtualization Client Management](how-to-use-the-desktop-notification-area-for-application-virtualization-client-management.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/i b/mdop/appv-v4/i
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/mdop/appv-v4/improving-security-during-app-v-sequencing.md b/mdop/appv-v4/improving-security-during-app-v-sequencing.md
index 534b8b9a09..2336ea5569 100644
--- a/mdop/appv-v4/improving-security-during-app-v-sequencing.md
+++ b/mdop/appv-v4/improving-security-during-app-v-sequencing.md
@@ -1,12 +1,15 @@
 ---
 title: Improving Security During App-V Sequencing
 description: Improving Security During App-V Sequencing
-author: jamiejdt
+author: dansimp
 ms.assetid: f30206dd-5749-4a27-bbaf-61fc21b9c663
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -31,13 +34,13 @@ This feature also enables the sequencing engineer to capture the security settin
 **Important**  
 Although the sequencer captures the NTFS ACLs while monitoring the installation phase of sequencing, it does not capture the ACLs for the registry. Users have full access to all registry keys for virtual applications except for services. However, if a user modifies the registry of a virtual application, that change is stored in a specific location (`uservol_sftfs_v1.pkg`) and won’t affect other users.
 
- 
+ 
 
 During the installation phase, a sequencing engineer can modify the default permissions of the files if necessary. After the sequencing process is complete, but before saving the package, the sequencing engineer can then choose to enforce security descriptors that were captured during the installation phase. It is a best practice to enforce security descriptors if no other solution allows the application to run properly once virtualized.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md
index 056b30d465..fd19796eb2 100644
--- a/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md
+++ b/mdop/appv-v4/incompatible-installer-dialog-box--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Incompatible Installer Dialog Box (App-V 4.6 SP1)
 description: Incompatible Installer Dialog Box (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 45d465b1-ee49-4274-8234-71dd031a07b6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/index.md b/mdop/appv-v4/index.md
index 8f75ce1701..02747f94e3 100644
--- a/mdop/appv-v4/index.md
+++ b/mdop/appv-v4/index.md
@@ -1,12 +1,12 @@
 ---
 title: Application Virtualization 4
 description: Application Virtualization 4
-author: jamiejdt
+author: dansimp
 ms.assetid: 9da557bc-f433-47d3-8af7-68ec4ff9bd3f
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/installation-files-page.md b/mdop/appv-v4/installation-files-page.md
index 7a91f8eec1..0825e6eddc 100644
--- a/mdop/appv-v4/installation-files-page.md
+++ b/mdop/appv-v4/installation-files-page.md
@@ -1,12 +1,15 @@
 ---
 title: Installation Files Page
 description: Installation Files Page
-author: jamiejdt
+author: dansimp
 ms.assetid: b0aad26f-b143-4f09-87a1-9f016a23cb62
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -27,7 +30,7 @@ Click **Browse** to specify the installation files that have been installed loca
 **Note**  
 The default installation location you provide depends on the following conditions:
 
- 
+ 
 
 -   The package root specified when the package was originally created.
 
@@ -46,9 +49,9 @@ When you create a package using a package accelerator, each file in the package,
 
 [Create Package Accelerator Wizard (AppV 4.6 SP1)](create-package-accelerator-wizard--appv-46-sp1-.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/installation-page--learn-more-.md b/mdop/appv-v4/installation-page--learn-more-.md
index a943280834..2979a1cb34 100644
--- a/mdop/appv-v4/installation-page--learn-more-.md
+++ b/mdop/appv-v4/installation-page--learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Installation Page (Learn More)
 description: Installation Page (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: a53b8330-dfc3-4540-b147-7c10529f403a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/installation-report-page--learn-more-.md b/mdop/appv-v4/installation-report-page--learn-more-.md
index 62b09d8cdf..b35a3f1345 100644
--- a/mdop/appv-v4/installation-report-page--learn-more-.md
+++ b/mdop/appv-v4/installation-report-page--learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Installation Report Page (Learn More)
 description: Installation Report Page (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: 499cf4db-a39c-4dcf-b1cf-85fd7da11701
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md b/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md
index 1d396e4a37..c7ef697fc2 100644
--- a/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md
+++ b/mdop/appv-v4/installing-app-v-management-server-or-streaming-server-securely.md
@@ -1,12 +1,15 @@
 ---
 title: Installing App-V Management Server or Streaming Server Securely
 description: Installing App-V Management Server or Streaming Server Securely
-author: jamiejdt
+author: dansimp
 ms.assetid: d2a51a81-a80f-427c-a727-611e1eb74f02
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ The topics in this section provide information for installing an enhanced securi
 **Note**  
 Installing or configuring an App-V Management or Streaming Server to use enhanced security (for example, Transport Layer Security, or TLS) requires that an X.509 V3 certificate has been provisioned to the App-V server.
 
- 
+ 
 
 When you prepare to install or configure a secure Management or Streaming Server, consider the following technical requirements:
 
@@ -32,7 +35,7 @@ When you prepare to install or configure a secure Management or Streaming Server
     **Note**  
     If you are using App-V in a Network Load Balancing cluster, you must configure the certificate with Subject Alternate Names (SANs) to support RTSPS. For information about configuring the certification authority (CA) and creating certificates with SANs, see .
 
-     
+     
 
 -   The client and the server need to trust the root CA—The CA issuing the certificate to the App-V server must by trusted by the client connecting to the server. If not, the client ends the connection.
 
@@ -50,9 +53,9 @@ Provides procedures you can use to modify keys in Windows Server 2003 and Windo
 [Configuring Certificates to Support App-V Management Server or Streaming Server](configuring-certificates-to-support-app-v-management-server-or-streaming-server.md)  
 Provides information about configuring certificates for the App-V Management or Streaming Servers, including information about configuring certificates for Network Load Balancing environments.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md b/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md
index 68a52aba6d..9821a7ba66 100644
--- a/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md
+++ b/mdop/appv-v4/internet-facing-considerations-for-app-v-clients.md
@@ -1,12 +1,15 @@
 ---
 title: Internet-Facing Considerations for App-V Clients
 description: Internet-Facing Considerations for App-V Clients
-author: jamiejdt
+author: dansimp
 ms.assetid: 261acde3-7112-492e-8b11-934ae45adc5f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md b/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md
index c8b49013da..5d2b394c68 100644
--- a/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md
+++ b/mdop/appv-v4/internet-facing-server-scenarios-for-perimeter-networks.md
@@ -1,12 +1,15 @@
 ---
 title: Internet-Facing Server Scenarios for Perimeter Networks
 description: Internet-Facing Server Scenarios for Perimeter Networks
-author: jamiejdt
+author: dansimp
 ms.assetid: 8a4da6e6-82c7-49e5-b9b1-1666cba02f65
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -39,7 +42,7 @@ Place the following servers in the perimeter network:
 **Note**  
 It is a best practice to place the Management Server and IIS server on separate computers.
 
- 
+ 
 
 Place the following servers in the internal network:
 
@@ -77,7 +80,7 @@ The following tables list the traffic requirements for communication from the In
 
 
 
- 
+ 
 
 @@ -114,11 +117,11 @@ The following tables list the traffic requirements for communication from the In
 
      
 

 
      
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md b/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md
index d6d324ec9d..b621871cef 100644
--- a/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md
+++ b/mdop/appv-v4/introduction-to-the-application-virtualization-security-guide.md
@@ -1,12 +1,15 @@
 ---
 title: Introduction to the Application Virtualization Security Guide
 description: Introduction to the Application Virtualization Security Guide
-author: jamiejdt
+author: dansimp
 ms.assetid: 50e1d220-7a95-45b8-933b-3dadddebe26f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ This Microsoft Application Virtualization (App-V) security guide provides instru
 **Note**  
 This documentation does not provide guidance for choosing the specific security options. That information is provided in the App-V Security Best Practices white paper available at .
 
- 
+ 
 
 As an App-V administrator using this guide, you should be familiar with the following security-related technologies:
 
@@ -45,7 +48,7 @@ For more information about App-V infrastructure models, see the following docume
 
 -   [Infrastructure Planning and Design Guide Series](https://go.microsoft.com/fwlink/?LinkId=151986)
 
- 
+ 
 
 These models utilize some but possibly not all of the App-V components depicted in the following illustration.
 
@@ -72,9 +75,9 @@ The App-V Sequencer monitors and captures the installation of applications and c
 Application Virtualization (App-V) Client  
 The App-V Client is installed on the App-V Desktop Client computer or on the App-V Terminal Services Client computer. It provides the virtual environment for the virtual application packages. The App-V Client manages the package streaming to the cache, virtual application publishing refresh, and interaction with the Application Virtualization Servers.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/load-app.md b/mdop/appv-v4/load-app.md
index bb9d56c819..8b07665623 100644
--- a/mdop/appv-v4/load-app.md
+++ b/mdop/appv-v4/load-app.md
@@ -1,12 +1,15 @@
 ---
 title: LOAD APP
 description: LOAD APP
-author: jamiejdt
+author: dansimp
 ms.assetid: 7b727d0c-5423-419d-92ef-7ebbc6343e79
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Loads the specified application and all other applications in the package into t
 **Note**  
 The **LOAD APP** command starts the load process and a progress bar is displayed in the Desktop Notification Area. The command exits immediately after starting this process, so any load errors are displayed in the same location. Use the **LOAD PACKAGE** command if you want to start the load process from the command line without using the Desktop Notification Area.
 
- 
+ 
 
 `SFTMIME LOAD APP:application [/LOG log-pathname | /GUI]`
 
@@ -50,7 +53,7 @@ The **LOAD APP** command starts the load process and a progress bar is displayed
 
 
 
- 
+ 
 
 For version 4.6, the following option has been added.
 
@@ -67,16 +70,16 @@ For version 4.6, the following option has been added.
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [SFTMIME Command Reference](sftmime--command-reference.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/load-package.md b/mdop/appv-v4/load-package.md
index fd38513dc7..025e980fda 100644
--- a/mdop/appv-v4/load-package.md
+++ b/mdop/appv-v4/load-package.md
@@ -1,12 +1,15 @@
 ---
 title: LOAD PACKAGE
 description: LOAD PACKAGE
-author: jamiejdt
+author: dansimp
 ms.assetid: eb19116d-e5d0-445c-b2f0-3116a09384d7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -53,7 +56,7 @@ Loads the specified package into the file system cache.
 
 
 
- 
+ 
 
 For version 4.6, the following option has been added.
 
@@ -70,23 +73,23 @@ For version 4.6, the following option has been added.
 
 
 
- 
+ 
 
 **Note**  
 If no SFTPATH is specified, the client will load the package by using the path it has been configured to use, based on the OSD file, the ApplicationSourceRoot registry key value, or the OverrideURL setting.
 
 The **LOAD PACKAGE** command performs a synchronous load and will not be complete until the package is fully loaded or until it encounters an error condition.
 
- 
+ 
 
 ## Related topics
 
 
 [SFTMIME Command Reference](sftmime--command-reference.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/lock-app.md b/mdop/appv-v4/lock-app.md
index 818c7e2da7..1032c581d6 100644
--- a/mdop/appv-v4/lock-app.md
+++ b/mdop/appv-v4/lock-app.md
@@ -1,12 +1,15 @@
 ---
 title: LOCK APP
 description: LOCK APP
-author: jamiejdt
+author: dansimp
 ms.assetid: 30673433-4364-499f-8116-cb135fe2716f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/log-file-for-the-application-virtualization-client.md b/mdop/appv-v4/log-file-for-the-application-virtualization-client.md
index d8dab66cef..1dec527a68 100644
--- a/mdop/appv-v4/log-file-for-the-application-virtualization-client.md
+++ b/mdop/appv-v4/log-file-for-the-application-virtualization-client.md
@@ -1,12 +1,15 @@
 ---
 title: Log File for the Application Virtualization Client
 description: Log File for the Application Virtualization Client
-author: jamiejdt
+author: dansimp
 ms.assetid: ac4b3e4a-a220-4c06-bd60-af7dc318b3a9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md b/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md
index ddc703ef03..fd8062d829 100644
--- a/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md
+++ b/mdop/appv-v4/log-files-for-the-application-virtualization-sequencer.md
@@ -1,12 +1,15 @@
 ---
 title: Log Files for the Application Virtualization Sequencer
 description: Log Files for the Application Virtualization Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: 1a296544-eab4-46f9-82ce-3136f8b578af
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md b/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md
index df41075652..fe711b15c3 100644
--- a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md
+++ b/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-1-privacy-statement.md
@@ -1,12 +1,15 @@
 ---
 title: Microsoft Application Virtualization 4.6 Service Pack 1 Privacy Statement
 description: Microsoft Application Virtualization 4.6 Service Pack 1 Privacy Statement
-author: jamiejdt
+author: dansimp
 ms.assetid: e82c57ea-885d-4761-96db-4d80b1c3e1ae
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md b/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md
index 41caf5044b..55db6ca874 100644
--- a/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md
+++ b/mdop/appv-v4/microsoft-application-virtualization-46-service-pack-2-privacy-statement.md
@@ -1,12 +1,15 @@
 ---
 title: Microsoft Application Virtualization 4.6 Service Pack 2 Privacy Statement
 description: Microsoft Application Virtualization 4.6 Service Pack 2 Privacy Statement
-author: jamiejdt
+author: dansimp
 ms.assetid: 4ee569b2-7711-475a-9f17-70247f00b1b7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -65,7 +68,7 @@ The remainder of this document will address the following specific features:
 **Note**  
 This section is divided into two parts: (1) features in all versions of App-V and (2) features in App-V 4.6 SP1 and later.
 
- 
+ 
 
 ### Microsoft Error Reporting
 
@@ -73,7 +76,7 @@ This section is divided into two parts: (1) features in all versions of App-V an
 
 Microsoft Error Reporting provides a service that allows you to report problems you may be having with App-V to Microsoft and to receive information that may help you avoid or solve such problems.
 
-**Information Collected, Processed, or Transmitted: **
+**Information Collected, Processed, or Transmitted:**
 
 For information about the information collected, processed, or transmitted by Microsoft Error Reporting, see the Microsoft Error Reporting privacy statement at .
 
@@ -81,13 +84,13 @@ For information about the information collected, processed, or transmitted by Mi
 
 We use the error reporting data to solve customer problems and improve our software and services.
 
-**Choice/Control: **
+**Choice/Control:**
 
 App-V does not change your Microsoft Error Reporting settings. If you previously turned on error reporting, it will send Microsoft the information about the errors you encountered. When Microsoft needs additional data to analyze the problem, you will be prompted to review the data and choose whether or not to send it.  App-V will always respect your Microsoft Error Reporting settings.
 
 **Important Information:**
 
-Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their computers. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available at .
+Enterprise customers can use Group Policy to configure how Microsoft Error Reporting behaves on their computers. Configuration options include the ability to turn off Microsoft Error Reporting. If you are an administrator and wish to configure Group Policy for Microsoft Error Reporting, technical details are available at .
 
 ### Microsoft Update
 
@@ -95,7 +98,7 @@ Enterprise customers can use Group Policy to configure how Microsoft Error Repor
 
 Microsoft Update is a service that provides Windows updates as well as updates for other Microsoft software, including App-V.  For details about what information is collected, how it is used and how to change your settings, see the Update Services Privacy Statement at .
 
-**Choice/Control: **
+**Choice/Control:**
 
 If Microsoft Update is not enabled, you can opt-in during setup and subsequent checks for updates will follow the machine-wide schedule. You can update this option from the Microsoft Update Control Panel item.
 
@@ -105,7 +108,7 @@ If Microsoft Update is not enabled, you can opt-in during setup and subsequent c
 
 The product will collect various configuration items, including UserID, MachineID and SecurityGroup details, to be able to enforce settings on managed nodes. The data is stored in the App-V SQL database and transmitted across the App-V server and client components to enforce the configuration on the managed node.
 
-**Information Collected, Processed, or Transmitted: **
+**Information Collected, Processed, or Transmitted:**
 
 User and machine information and configuration content
 
@@ -113,7 +116,7 @@ User and machine information and configuration content
 
 The information is used to enforce the application access configuration on the managed nodes within the enterprise. The information does not leave the enterprise.
 
-**Choice/Control: **
+**Choice/Control:**
 
 By default, the product does not have any data. All data is entered and enabled by the admin and can be viewed in the Management console. The feature cannot be disabled as this is the product functionality. To disable this, App-V will need to be uninstalled.
 
@@ -127,7 +130,7 @@ None of this information is sent out of the enterprise.
 
 It captures package history and asset information as part of the package.
 
-**Information Collected, Processed, or Transmitted: **
+**Information Collected, Processed, or Transmitted:**
 
 Information about the package and the sequencing environment is collected and stored in the package manifest during sequencing.
 
@@ -135,7 +138,7 @@ Information about the package and the sequencing environment is collected and st
 
 The information will be used by the admin to track the updates done to a package during its lifecycle. It will also be used by software deployment systems to track the package deployments within the organization.
 
-**Choice/Control: **
+**Choice/Control:**
 
 This feature is always enabled and cannot be turned off.
 
@@ -149,7 +152,7 @@ This administrator information will be stored in the package and can be viewed b
 
 The product will collect a variety of reporting data points, including the username, to allow reporting on the usage of the product.
 
-**Information Collected, Processed, or Transmitted: **
+**Information Collected, Processed, or Transmitted:**
 
 Information about the machine, package and application usage are collected from every machine that reporting is enabled on.
 
@@ -157,7 +160,7 @@ Information about the machine, package and application usage are collected from
 
 The information is used to report on application usage within the enterprise. The information does not leave the enterprise.
 
-**Choice/Control: **
+**Choice/Control:**
 
 By default, the product does not have any data. Data is only collected once the reporting feature is enabled on the App-V Client. To disable the collection of reporting data, the reporting feature must be disabled on all clients.
 
@@ -175,7 +178,7 @@ This section addresses specific features available in App-V 4.6 SP1 and later.
 
 The Customer Experience Improvement Program (“CEIP”) collects basic information about your hardware configuration and how you use our software and services in order to identify trends and usage patterns. CEIP also collects the type and number of errors you encounter, software and hardware performance, and the speed of services. We will not collect your name, address, or other contact information.
 
-**Information Collected, Processed, or Transmitted: **
+**Information Collected, Processed, or Transmitted:**
 
 For more information about the information collected, processed, or transmitted by CEIP, see the CEIP privacy statement at .
 
@@ -183,7 +186,7 @@ For more information about the information collected, processed, or transmitted
 
 We use this information to improve the quality, reliability, and performance of Microsoft software and services.
 
-**Choice/Control: **
+**Choice/Control:**
 
 CEIP is optional and the opt-in status can be updated during install or post install from the GUI.  
 
@@ -193,7 +196,7 @@ CEIP is optional and the opt-in status can be updated during install or post ins
 
 Customers can use Application Package Accelerators to automatically package complex applications without installing the application. The App-V sequencer allows you to create package accelerators for each virtual package. You can then use these package accelerators to automatically re-create the same virtual package in the future. You may also use package accelerators released by Microsoft or other third parties to simplify and automate packaging of complex applications.
 
-**Information Collected, Processed, or Transmitted: **
+**Information Collected, Processed, or Transmitted:**
 
 Application Package Accelerators may contain information such as computer names, user account information, and information about applications included in the Package Accelerator file.
 
@@ -214,9 +217,9 @@ No information is sent to Microsoft through customers’ use of the Application
 
 [About Microsoft Application Virtualization 4.6 SP2](about-microsoft-application-virtualization-46-sp2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md b/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md
index 9e2c944136..c0c55aa648 100644
--- a/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md
+++ b/mdop/appv-v4/microsoft-application-virtualization-client-management-help.md
@@ -1,12 +1,15 @@
 ---
 title: Microsoft Application Virtualization Client Management Help
 description: Microsoft Application Virtualization Client Management Help
-author: jamiejdt
+author: dansimp
 ms.assetid: 449eebda-70eb-48b7-855a-db965a680923
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md b/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md
index c2189264f6..6f19e8f359 100644
--- a/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md
+++ b/mdop/appv-v4/microsoft-application-virtualization-getting-started-guide.md
@@ -1,12 +1,15 @@
 ---
 title: Microsoft Application Virtualization Getting Started Guide
 description: Microsoft Application Virtualization Getting Started Guide
-author: jamiejdt
+author: dansimp
 ms.assetid: 6cd9a212-e270-4d7c-bd0a-bd6af9a5c3ba
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md b/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md
index 1b0d7df769..2add0e46ac 100644
--- a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md
+++ b/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes-45-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: Microsoft Application Virtualization Management System Release Notes 4.5 SP1
 description: Microsoft Application Virtualization Management System Release Notes 4.5 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 5d6b11ea-7b87-4084-9a7c-0d831f247aa3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ To search these Release Notes, press CTRL+F.
 **Important**  
 Read these Release Notes thoroughly before you install the Application Virtualization Management System. These Release Notes contain information that you need to successfully install the Application Virtualization Management System. These Release Notes contain information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other Application Virtualization Management System documentation, the latest change should be considered authoritative.
 
- 
+ 
 
 For updated information about known issues, please visit the Microsoft TechNet Library at .
 
@@ -72,16 +75,16 @@ When this has been completed, install the App-V 4.5 SP1 client by using setup.ms
 
 When installing Microsoft Application Error Reporting, use the following command if you are installing or upgrading to the App-V 4.5 SP1 Desktop client:
 
-    msiexec /i dw20shared.msi APPGUID={93468B43-C19D-44F9-8BCC-114076DB0443}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus
+    msiexec /i dw20shared.msi APPGUID={93468B43-C19D-44F9-8BCC-114076DB0443}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus
 
 Alternatively, if you are installing or upgrading to the App-V 4.5 SP1 Client for Remote Desktop Services (formerly Terminal Services), use the following command:
 
-    msiexec /i dw20shared.msi APPGUID={0042AD3C-99A4-4E58-B5F0-744D5AD96E1C} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus
+    msiexec /i dw20shared.msi APPGUID={0042AD3C-99A4-4E58-B5F0-744D5AD96E1C} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus
 
 **Note**  
 The APPGUID parameter references the product code of the App-V client that you install or upgrade. The product code is unique for each setup.msi. You can use the Orca database editor or a similar tool to examine Windows Installer files and determine the product code. This step is required for all installations or upgrades to App-V 4.5 SP1.
 
- 
+ 
 
 ### Improving performance when sequencing the .NET Framework
 
@@ -208,9 +211,9 @@ Microsoft, Active Directory, ActiveSync, MS-DOS, Windows, Windows Server, and W
 
 All other trademarks are property of their respective owners.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md b/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md
index 726ac5b392..c97f47acca 100644
--- a/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md
+++ b/mdop/appv-v4/microsoft-application-virtualization-management-system-release-notes.md
@@ -1,12 +1,15 @@
 ---
 title: Microsoft Application Virtualization Management System Release Notes
 description: Microsoft Application Virtualization Management System Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: e1a4d5ee-53c7-4b48-814c-a34ce0e698dc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ To search these Release Notes, press CTRL+F.
 **Important**  
 Read these Release Notes thoroughly before you install the Application Virtualization Management System. These Release Notes contain information that you need to successfully install the Application Virtualization Management System. This document contains information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other Application Virtualization Management System documentation, the latest change should be considered authoritative. These Release Notes supersede the content included with this product.
 
- 
+ 
 
 For updated information about known issues, please visit the Microsoft TechNet Library at .
 
@@ -33,7 +36,7 @@ These Release Notes have been updated to reflect the changes introduced with Mic
     **Important**  
     Running App-V 4.5 CU1 on any version of Windows 7 or Windows Server 2008 R2 in a live operating environment is not supported.
 
-     
+     
 
 -   Improved support for sequencing the .NET Framework: App-V 4.5 CU1 addresses previous issues with sequencing the .NET Framework 3.5 and earlier on Windows XP (SP2 or later). For more information about the new capabilities, see the TechNet article at .
 
@@ -71,16 +74,16 @@ When this has been completed, install the App-V 4.5 CU1 client by using setup.m
 
 When installing Microsoft Application Error Reporting, use the following command if you are installing or upgrading to the App-V 4.5 CU1 Desktop client:
 
-    msiexec /i dw20shared.msi APPGUID={FE495DBC-6D42-4698-B61F-86E655E0796D}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus
+    msiexec /i dw20shared.msi APPGUID={FE495DBC-6D42-4698-B61F-86E655E0796D}  allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus
 
 Alternatively, if you are installing or upgrading to the App-V 4.5 CU1 Terminal Services client, use the following command:
 
-    msiexec /i dw20shared.msi APPGUID={8A97C241-D92A-47DC-B360-E716C1AAA929} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus
+    msiexec /i dw20shared.msi APPGUID={8A97C241-D92A-47DC-B360-E716C1AAA929} allusers=1 reboot=suppress REINSTALL=all REINSTALLMODE=vomus
 
 **Note**  
 The APPGUID parameter references the product code of the App-V client that you install or upgrade to. The product code is unique for each setup.msi. You can use the Orca database editor or similar tool to examine Windows Installer files and determine the product code. This step is required for all installs or upgrades to App-V 4.5 CU1.
 
- 
+ 
 
 ### Some applications might fail to install during the monitoring phase when sequencing on Windows 7 Beta
 
@@ -88,12 +91,12 @@ When sequencing on Windows 7 Beta or on a computer with Windows Installer 5.0,
 
 WORKAROUND   You must manually grant the Everyone group Full Control permissions to the following registry key:
 
-    HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\SystemGuard
+    HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\SystemGuard
 
 **Important**  
 You must use the **Advanced** button to set the “Include inheritable permissions from this object’s parent” option.
 
- 
+ 
 
 ### Unable to save packages when sequencing on Windows 7 Beta
 
@@ -232,7 +235,7 @@ WORKAROUND   After installing the application on the sequencing computer, whi
 **Important**  
 This issue has been fixed in Microsoft Application Virtualization 4.5 Cumulative Update 1.
 
- 
+ 
 
 ### When the server installer is run in silent mode, it does not correctly check for MSXML6
 
@@ -259,7 +262,7 @@ When using Symantec Endpoint Protection with the Application and Device Control
 **Important**  
 This issue has been fixed in Microsoft Application Virtualization 4.5 Cumulative Update 1.
 
- 
+ 
 
 ## Release Notes Copyright Information
 
@@ -274,9 +277,9 @@ Microsoft, MS-DOS, Windows, Windows Server, Windows Vista, Active Directory, an
 
 The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/microsoft-application-virtualization-security-guide.md b/mdop/appv-v4/microsoft-application-virtualization-security-guide.md
index b2f5e6cfb6..8b8cf618b5 100644
--- a/mdop/appv-v4/microsoft-application-virtualization-security-guide.md
+++ b/mdop/appv-v4/microsoft-application-virtualization-security-guide.md
@@ -1,12 +1,15 @@
 ---
 title: Microsoft Application Virtualization Security Guide
 description: Microsoft Application Virtualization Security Guide
-author: jamiejdt
+author: dansimp
 ms.assetid: 5e794316-cc4f-459e-90ef-79fc9841ba4e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/monitoring-application-virtualization-servers.md b/mdop/appv-v4/monitoring-application-virtualization-servers.md
index 13acd7523b..c778742dcd 100644
--- a/mdop/appv-v4/monitoring-application-virtualization-servers.md
+++ b/mdop/appv-v4/monitoring-application-virtualization-servers.md
@@ -1,12 +1,15 @@
 ---
 title: Monitoring Application Virtualization Servers
 description: Monitoring Application Virtualization Servers
-author: jamiejdt
+author: dansimp
 ms.assetid: d84355ae-4fe4-41d9-ac3a-3eaa32d9a61f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/online-help-for-application-virtualization.md b/mdop/appv-v4/online-help-for-application-virtualization.md
index 6b7275ca50..91d7d2784f 100644
--- a/mdop/appv-v4/online-help-for-application-virtualization.md
+++ b/mdop/appv-v4/online-help-for-application-virtualization.md
@@ -1,12 +1,15 @@
 ---
 title: Online Help for Application Virtualization
 description: Online Help for Application Virtualization
-author: jamiejdt
+author: dansimp
 ms.assetid: 261ede48-976f-473c-84bc-452577efdcdf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md b/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md
index faa4d4f1c4..0bf23f9812 100644
--- a/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md
+++ b/mdop/appv-v4/open-package-wizard---appv-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Open Package Wizard (AppV 4.6 SP1)
 description: Open Package Wizard (AppV 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 26bdef59-2ea3-4e30-9095-0ee0d0085b2d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md b/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md
index 0ec87c9cbc..fa836b09a6 100644
--- a/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md
+++ b/mdop/appv-v4/operations-guide-for-the-application-virtualization-system.md
@@ -1,12 +1,15 @@
 ---
 title: Operations Guide for the Application Virtualization System
 description: Operations Guide for the Application Virtualization System
-author: jamiejdt
+author: dansimp
 ms.assetid: 686f2b75-7fba-4410-89b2-a539984b6ef2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/appv-v4/osd-file-elements.md b/mdop/appv-v4/osd-file-elements.md
index a01ed85d98..96422a7568 100644
--- a/mdop/appv-v4/osd-file-elements.md
+++ b/mdop/appv-v4/osd-file-elements.md
@@ -1,12 +1,15 @@
 ---
 title: OSD File Elements
 description: OSD File Elements
-author: jamiejdt
+author: dansimp
 ms.assetid: 8211b562-7549-4331-8321-144f52574e99
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/osd-tab-keep.md b/mdop/appv-v4/osd-tab-keep.md
index f2675560d4..dd06e42a12 100644
--- a/mdop/appv-v4/osd-tab-keep.md
+++ b/mdop/appv-v4/osd-tab-keep.md
@@ -1,12 +1,15 @@
 ---
 title: OSD Tab
 description: OSD Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: e66f1384-1753-4216-b9ee-77e99af93c74
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md
index dfa346490a..6a802d1959 100644
--- a/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md
+++ b/mdop/appv-v4/oversized-package-dialog-box--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Oversized Package Dialog Box (App-V 4.6 SP1)
 description: Oversized Package Dialog Box (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 8973a493-6509-4d52-afb6-a9f47d1c5c26
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/overview-of-application-virtualization.md b/mdop/appv-v4/overview-of-application-virtualization.md
index 65979abce4..356e53e996 100644
--- a/mdop/appv-v4/overview-of-application-virtualization.md
+++ b/mdop/appv-v4/overview-of-application-virtualization.md
@@ -1,12 +1,15 @@
 ---
 title: Overview of Application Virtualization
 description: Overview of Application Virtualization
-author: jamiejdt
+author: dansimp
 ms.assetid: 80545ef4-cf4c-420c-88d6-48e9f226051f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -18,7 +21,7 @@ Microsoft Application Virtualization (App-V) can make applications available to
 
 The App-V client is the feature that lets the end user interact with the applications after they have been published to the computer. The client manages the virtual environment in which the virtualized applications run on each computer. After the client has been installed on a computer, the applications must be made available to the computer through a process known as *publishing*, which enables the end user to run the virtual applications. The publishing process copies the virtual application icons and shortcuts to the computer—typically on the Windows desktop or on the **Start** menu—and also copies the package definition and file type association information to the computer. Publishing also makes the application package content available to the end user’s computer.
 
-The virtual application package content can be copied onto one or more Application Virtualization servers so that it can be streamed down to the clients on demand and cached locally. File servers and Web servers can also be used as streaming servers, or the content can be copied directly to the end user’s computer—for example, if you are using an electronic software distribution system, such as Microsoft System Center Configuration Manager 2007. In a multi-server implementation, maintaining the package content and keeping it up to date on all the streaming servers requires a comprehensive package management solution. Depending on the size of your organization, you might need to have many virtual applications available to end users located all over the world. Managing the packages to ensure that the appropriate applications are available to all users where and when they need access to them is therefore an important requirement.
+The virtual application package content can be copied onto one or more Application Virtualization servers so that it can be streamed down to the clients on demand and cached locally. File servers and Web servers can also be used as streaming servers, or the content can be copied directly to the end user’s computer—for example, if you are using an electronic software distribution system, such as Microsoft Endpoint Configuration Manager. In a multi-server implementation, maintaining the package content and keeping it up to date on all the streaming servers requires a comprehensive package management solution. Depending on the size of your organization, you might need to have many virtual applications available to end users located all over the world. Managing the packages to ensure that the appropriate applications are available to all users where and when they need access to them is therefore an important requirement.
 
 ## Microsoft Application Virtualization System Features
 
diff --git a/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md b/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md
index e9b5960aed..d0436a2494 100644
--- a/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md
+++ b/mdop/appv-v4/overview-of-the-application-virtualization-system-components.md
@@ -1,12 +1,15 @@
 ---
 title: Overview of the Application Virtualization System Components
 description: Overview of the Application Virtualization System Components
-author: jamiejdt
+author: dansimp
 ms.assetid: 75d88ef7-44d8-4fa7-b7f5-9153f37e570d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/package-name-page---learn-more-.md b/mdop/appv-v4/package-name-page---learn-more-.md
index 279d0a351d..5a371c35ca 100644
--- a/mdop/appv-v4/package-name-page---learn-more-.md
+++ b/mdop/appv-v4/package-name-page---learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Package Name Page (Learn More)
 description: Package Name Page (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: ee75b8f0-bd9d-4460-a256-016ff97c2386
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Use the **Package Name** page to specify a name for the virtual application pack
 **Note**  
 Editing the primary virtual application directory is an advanced task.
 
- 
+ 
 
 This page contains the following elements:
 
@@ -34,9 +37,9 @@ Select this option to change the location of where the virtual application will
 
 [Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/package-name-page--app-v-46-sp1.md b/mdop/appv-v4/package-name-page--app-v-46-sp1.md
index 302e29a5e0..18593c1fbe 100644
--- a/mdop/appv-v4/package-name-page--app-v-46-sp1.md
+++ b/mdop/appv-v4/package-name-page--app-v-46-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: Package Name Page
 description: Package Name Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 1cea36b7-737d-4c5e-9294-5feba02a3e7d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/package-results-pane-columns.md b/mdop/appv-v4/package-results-pane-columns.md
index 301daf9c68..65f4510c3f 100644
--- a/mdop/appv-v4/package-results-pane-columns.md
+++ b/mdop/appv-v4/package-results-pane-columns.md
@@ -1,12 +1,15 @@
 ---
 title: Package Results Pane Columns
 description: Package Results Pane Columns
-author: jamiejdt
+author: dansimp
 ms.assetid: 4ed3a06a-656d-497a-b62d-21684396e2b0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/package-results-pane.md b/mdop/appv-v4/package-results-pane.md
index 1b446b15ad..ed92ee0b14 100644
--- a/mdop/appv-v4/package-results-pane.md
+++ b/mdop/appv-v4/package-results-pane.md
@@ -1,12 +1,15 @@
 ---
 title: Package Results Pane
 description: Package Results Pane
-author: jamiejdt
+author: dansimp
 ms.assetid: 07b7f737-f26f-4feb-88aa-3d8009c5622d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/packages-node.md b/mdop/appv-v4/packages-node.md
index 8e706f35fd..b293c3d8b7 100644
--- a/mdop/appv-v4/packages-node.md
+++ b/mdop/appv-v4/packages-node.md
@@ -1,12 +1,15 @@
 ---
 title: Packages Node
 description: Packages Node
-author: jamiejdt
+author: dansimp
 ms.assetid: 3465168c-012f-4e9f-905d-611418d2975a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/packaging-method--learn-more-.md b/mdop/appv-v4/packaging-method--learn-more-.md
index 4a504de42d..8fd5449b82 100644
--- a/mdop/appv-v4/packaging-method--learn-more-.md
+++ b/mdop/appv-v4/packaging-method--learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Packaging Method (Learn More)
 description: Packaging Method (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: 3975a640-1ffd-4b4c-95fd-608469f4c205
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/packaging-method-page--learn-more-.md b/mdop/appv-v4/packaging-method-page--learn-more-.md
index 5b23c4cee1..41103433f7 100644
--- a/mdop/appv-v4/packaging-method-page--learn-more-.md
+++ b/mdop/appv-v4/packaging-method-page--learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Packaging Method Page (Learn More)
 description: Packaging Method Page (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: f405a293-bcd4-48a1-b4d9-b5e4cf73c5f4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/parse-items-tab-keep.md b/mdop/appv-v4/parse-items-tab-keep.md
index a1a69ede9c..e4f0a9b72f 100644
--- a/mdop/appv-v4/parse-items-tab-keep.md
+++ b/mdop/appv-v4/parse-items-tab-keep.md
@@ -1,12 +1,15 @@
 ---
 title: Parse Items Tab
 description: Parse Items Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: bdf3fe0d-404a-4745-af52-f415fa321564
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md b/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md
index af83104855..a3718091a0 100644
--- a/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md
+++ b/mdop/appv-v4/planning-and-deployment-guide-for-the-application-virtualization-system.md
@@ -1,12 +1,15 @@
 ---
 title: Planning and Deployment Guide for the Application Virtualization System
 description: Planning and Deployment Guide for the Application Virtualization System
-author: jamiejdt
+author: dansimp
 ms.assetid: 6c012e33-9ac6-4cd8-84ff-54f40973833f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -18,7 +21,7 @@ Microsoft Application Virtualization Management provides the capability to make
 
 The Application Virtualization Client is the Application Virtualization system component that enables the end user to interact with the applications after they have been published to the computer. The client manages the virtual environment in which the virtualized applications run on each computer. After the client has been installed on a computer, the applications must be made available to the computer through a process known as *publishing*, which enables the end user to run the virtual applications. The publishing process places the virtual application icons and shortcuts on the computer—typically on the Windows desktop or on the **Start** menu—and also places the package definition and file type association information on the computer. Publishing also makes the application package content available to the end user’s computer.
 
-The virtual application package content can be placed on one or more Application Virtualization servers so that it can be streamed down to the clients on demand and cached locally. File servers and Web servers can also be used as streaming servers, or the content can be placed directly on the end user’s computer—for example, if you are using an electronic software distribution system, such as Microsoft System Center Configuration Manager 2007. In a multi-server implementation, maintaining the package content and keeping it up to date on all the streaming servers requires a comprehensive package management solution. Depending on the size of your organization, you might need to have many virtual applications accessible to end users located all over the world. Managing the packages to ensure that the right applications are available to all users where and when they need access to them is therefore an essential requirement.
+The virtual application package content can be placed on one or more Application Virtualization servers so that it can be streamed down to the clients on demand and cached locally. File servers and Web servers can also be used as streaming servers, or the content can be placed directly on the end user’s computer—for example, if you are using an electronic software distribution system, such as Microsoft Endpoint Configuration Manager. In a multi-server implementation, maintaining the package content and keeping it up to date on all the streaming servers requires a comprehensive package management solution. Depending on the size of your organization, you might need to have many virtual applications accessible to end users located all over the world. Managing the packages to ensure that the right applications are available to all users where and when they need access to them is therefore an essential requirement.
 
 The Application Virtualization Planning and Deployment Guide provides information to help you better understand and deploy the Microsoft Application Virtualization application and its components. It also provides step-by-step procedures for implementing the key deployment scenarios.
 
diff --git a/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md b/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md
index c068f230fa..4b56a86f3a 100644
--- a/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md
+++ b/mdop/appv-v4/planning-for-application-virtualization-client-deployment.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for Application Virtualization Client Deployment
 description: Planning for Application Virtualization Client Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: a352f80f-f0f9-4fbf-ac10-24c510b2d6be
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md b/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md
index 52e5568752..7ac4ec4db2 100644
--- a/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md
+++ b/mdop/appv-v4/planning-for-application-virtualization-system-deployment.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for Application Virtualization System Deployment
 description: Planning for Application Virtualization System Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 8215269f-c083-468a-bf0b-886b0d2dd69e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/planning-for-client-security.md b/mdop/appv-v4/planning-for-client-security.md
index 279b96234d..e47a871c34 100644
--- a/mdop/appv-v4/planning-for-client-security.md
+++ b/mdop/appv-v4/planning-for-client-security.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for Client Security
 description: Planning for Client Security
-author: jamiejdt
+author: dansimp
 ms.assetid: 4840a60f-4c91-489c-ad0b-6671882abf9b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -31,13 +34,13 @@ By default, at installation the App-V client is configured with the minimum perm
 
 By default, the installation of the client registers file type associations (FTAs) for OSD files, which enables users to start applications directly from OSD files instead of the published shortcuts. If a user with local administrator rights receives an OSD file containing malicious code, either in e-mail or downloaded from a Web site, the user can open the OSD file and start the application even if the client has been set to restrict the **Add Application** permission. You can unregister the FTAs for the OSD to reduce this risk. Also, consider blocking this extension in the e-mail system and at the firewall. For more information about configuring Outlook to block extensions, see .
 
-**Security Note:  **
+**Security Note:**
 
 Starting with App-V version 4.6, the file type association is no longer created for OSD files during a new installation of the client, although the existing settings will be maintained during an upgrade from version 4.2 or 4.5 of the App-V client. If for any reason it is essential to create the file type association, you can create the following registry keys and set their values as shown:
 
-    Create HKEY\_CLASSES\_ROOT\\.osd with a default value of SoftGrid.osd.File
+    Create HKEY\_CLASSES\_ROOT\\.osd with a default value of SoftGrid.osd.File
 
-    Under HKEY\_LOCAL\_MACHINE\\software\\classes\\Softgrid.osd.file, create a string value named AppUserModelID with a data value of Microsoft.AppV.Client.Tray
+    Under HKEY\_LOCAL\_MACHINE\\software\\classes\\Softgrid.osd.file, create a string value named AppUserModelID with a data value of Microsoft.AppV.Client.Tray
 
 ### Authorization
 
@@ -47,7 +50,7 @@ During installation, you can use the **RequireAuthorizationIfCached** parameter
 
 Antivirus software running on an App-V Client computer can detect and report an infected file in the virtual environment. However, it cannot disinfect the file. If a virus is detected in the virtual environment, the antivirus software would perform the configured quarantine or repair operation in the cache, not in the actual package. Configure the antivirus software with an exception for the sftfs.fsd file. This file is the cache file that stores packages on the App-V Client.
 
-**Security Note:  **
+**Security Note:**
 
 If a virus is detected in an application or package deployed in the production environment, replace the application or package with a virus-free version.
 
@@ -63,7 +66,7 @@ When the client communicates with the server to perform a publishing refresh, it
 **Note**  
 If you are using IIS to publish the ICO and OSD files, configure a MIME type for OSD=TXT; otherwise, IIS will refuse to serve the ICO and OSD files to clients.
 
- 
+ 
 
 ### Package Streaming
 
@@ -72,7 +75,7 @@ When a user launches an application for the first time, or if auto-loading param
 **Note**  
 If you are using IIS to publish packages (SFT files), configure a MIME type for SFT=Binary; otherwise, IIS will refuse to serve the SFT files to clients.
 
- 
+ 
 
 ### Roaming Profiles and Folder Redirection
 
@@ -96,9 +99,9 @@ If a user is home-based and the computer is not joined to the company domain, Ap
 
 [Planning for Security and Protection](planning-for-security-and-protection.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/planning-for-migration-from-previous-versions.md b/mdop/appv-v4/planning-for-migration-from-previous-versions.md
index b30d38e1cc..2e96c0f008 100644
--- a/mdop/appv-v4/planning-for-migration-from-previous-versions.md
+++ b/mdop/appv-v4/planning-for-migration-from-previous-versions.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for Migration from Previous Versions
 description: Planning for Migration from Previous Versions
-author: jamiejdt
+author: dansimp
 ms.assetid: 62967bf1-542f-41b0-838f-c62f3430ac73
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -25,7 +28,7 @@ To help ensure a successful migration, the Application Virtualization system com
     **Note**  
     If you have more than one server sharing access to the Application Virtualization database, all those servers must be taken offline while the database is being upgraded. You should follow your normal business practices for the database upgrade, but it is highly advisable that you test the database upgrade by using a backup copy of the database first on a test server. Then, you should select one of the servers for the first upgrade, which will upgrade the database schema. After the production database has been successfully upgraded, you can upgrade the other servers.
 
-     
+     
 
 3.  **Microsoft Application Virtualization Management Web Service.** This step applies only if the Management Web Service is on a separate server, which would require that you run the server installer program on that separate server to upgrade the Web service. Otherwise, the previous server upgrade step will automatically upgrade the Management Web Service.
 
@@ -84,14 +87,14 @@ You can deploy packages created in previous versions of App-V to App-V 4.6 Clie
 
 
 
- 
+ 
 
 To run a newly created 32-bit package, you must sequence the application on a computer running a 32-bit operating system with the App-V 4.6 Sequencer installed. After you have sequenced the application, in the Sequencer console, select the **Deployment** tab and then specify the appropriate operating system and chip architecture as required.
 
 **Important**  
 Applications sequenced on a computer running a 64-bit operating system must be deployed to computers running a 64-bit operating system. New 32-bit packages created by using the App-V 4.6 Sequencer will not run on computers running the App-V 4.5 Client.
 
- 
+ 
 
 To run new 64-bit packages on the App-V 4.6 Client, you must sequence the application on a computer running the App-V 4.6 Sequencer and that is running a 64-bit operating system. After you have sequenced the application, in the Sequencer console, select the **Deployment** tab and then specify the appropriate operating system and chip architecture as required.
 
@@ -176,14 +179,14 @@ The following table lists which client versions will run packages created by usi
 
 
 
- 
+ 
 
 ¹Applies to all versions of the App-V 4.5 Client, including App-V 4.5, App-V 4.5 CU1 and App-V 4.5 SP1.
 
 ## Additional Migration Considerations
 
 
-One of the features of the App-V 4.5 Sequencer is the ability to create Windows Installer files (.msi) as control points for virtual application package interoperability with electronic software distribution (ESD) systems such as Microsoft System Center Configuration Manager. Previous Windows Installer files created with the .msi tool for Application Virtualization that were installed on a App-V 4.1 or 4.2 Client that is subsequently upgraded to 4.5 continue to work, although they cannot be installed on the 4.5 Client. However, they cannot be removed or upgraded unless they are upgraded in the 4.5 Sequencer. The original pre-4.5 virtual application package would need to be opened in the 4.5 Sequencer and then saved as a Windows Installer File.
+One of the features of the App-V 4.5 Sequencer is the ability to create Windows Installer files (.msi) as control points for virtual application package interoperability with electronic software distribution (ESD) systems such as Microsoft Endpoint Configuration Manager. Previous Windows Installer files created with the .msi tool for Application Virtualization that were installed on a App-V 4.1 or 4.2 Client that is subsequently upgraded to 4.5 continue to work, although they cannot be installed on the 4.5 Client. However, they cannot be removed or upgraded unless they are upgraded in the 4.5 Sequencer. The original pre-4.5 virtual application package would need to be opened in the 4.5 Sequencer and then saved as a Windows Installer File.
 
 **Note**  
 If the App-V 4.2 Client has already been upgraded to 4.5, it is possible to use script as a workaround to preserve the 4.2 packages on 4.5 clients and allow them to be managed. This script must copy two files, msvcp71.dll and msvcr71.dll, to the App-V installation folder and set the following registry key values under the registry key \[HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\SoftGrid\\4.5\\Client\\Configuration\]:
@@ -192,7 +195,7 @@ If the App-V 4.2 Client has already been upgraded to 4.5, it is possible to us
 
 "GlobalDataDirectory"="C:\\\\Documents and Settings\\\\All Users\\\\Documents\\\\" (a globally writeable location)
 
- 
+ 
 
 Windows Installer files generated by the App-V 4.5 Sequencer display the error message "This package requires Microsoft Application Virtualization Client 4.5 or later" when you try to run them on an App-V 4.6 Client. Open the old package with either the App-V 4.5 SP1 Sequencer or the App-V 4.6 Sequencer and generate a new .msi for the package.
 
@@ -205,9 +208,9 @@ For additional information about upgrading from previous versions, see [Upgradin
 
 [Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/planning-for-security-and-protection.md b/mdop/appv-v4/planning-for-security-and-protection.md
index 8abc6fa6fa..dd42746a18 100644
--- a/mdop/appv-v4/planning-for-security-and-protection.md
+++ b/mdop/appv-v4/planning-for-security-and-protection.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for Security and Protection
 description: Planning for Security and Protection
-author: jamiejdt
+author: dansimp
 ms.assetid: d0e2ef81-c197-4020-ad85-8d66fe5c178f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/planning-for-sequencer-security.md b/mdop/appv-v4/planning-for-sequencer-security.md
index 36681dd4e6..63b4815f06 100644
--- a/mdop/appv-v4/planning-for-sequencer-security.md
+++ b/mdop/appv-v4/planning-for-sequencer-security.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for Sequencer Security
 description: Planning for Sequencer Security
-author: jamiejdt
+author: dansimp
 ms.assetid: 8043cb02-476d-4c28-a850-903a8ac5b2d3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 Incorporate recommended implementation practices as early as possible when configuring Application Virtualization (App-V) so that your Sequencer implementation is functional and more secure. If you have already configured the Sequencer, use the following best-practice guidelines to revisit your design decisions and analyze them from a security perspective.
 
-**Important**  
+**Important**  
 The App-V Sequencer collects and deploys all application information recorded on the computer running the sequencer. You should ensure that all users accessing the computer running the Sequencer have administrative credentials. Users with user account credentials should not have access to control package contents and package files. If you are sequencing on a computer running Remote Desktop Services (formerly Terminal Services), make sure it is a computer that is dedicated to sequencing and that users with user account credentials are not connected to it during sequencing.
 
- 
+
 
 ## Sequencer Security Best Practices
 
@@ -28,19 +31,21 @@ Consider the following scenarios and the associated best practices when implemen
 
 -   **Virus scanning on the computer running the Sequencer**—It is recommended that you scan the computer running the Sequencer for viruses and then disable all antivirus and malware detection software on the computer running the Sequencer during the sequencing process. This will speed the sequencing process and prevent the antivirus and anti-malware software components from interfering with the sequencing process. Next install the sequenced package on a computer not running the Sequencer, and after successful installation, scan that computer for viruses. If viruses are found, the manufacturer of the software should be contacted to inform them of the infected source files and request an updated installation source without viruses. Optionally, the Sequencer could be scanned after the installation phase and if a virus is found, the software manufacturer should be contacted as mentioned above.
 
-    **Note**  
+    **Note**  
     If a virus is detected in an application, the application should not be deployed to target computers.
 
-     
+
 
 -   **Capturing access control lists (ACLs) on NTFS files**—The App-V Sequencer captures NTFS file system permissions for the files that are monitored during the installation of the product. This capability allows you to more accurately replicate the intended behavior of the application, as if it were installed locally and not virtualized. In some scenarios, an application might store information that users were not intended to access within the application files. For example, an application could store credentials information in a file inside of the application. If ACLs are not enforced on the package, a user could potentially view and then use this information outside of the application.
 
-    **Note**  
+    **Note**  
     You should not sequence applications that store unencrypted security-specific information, such as passwords, and so on.
 
-     
 
-    During the installation phase, you can modify the default permissions of the files if necessary. After completion of the sequencing process, but before saving the package, you can choose whether to enforce security descriptors that were captured during the installation of the application. By default, App-V will enforce the security descriptors specified during the installation of the application. If you turn off security descriptor enforcement, you should test the application to ensure the removal of associated Access Control Lists (ACL) will not cause the application to perform unexpectedly.
+
+~~~
+During the installation phase, you can modify the default permissions of the files if necessary. After completion of the sequencing process, but before saving the package, you can choose whether to enforce security descriptors that were captured during the installation of the application. By default, App-V will enforce the security descriptors specified during the installation of the application. If you turn off security descriptor enforcement, you should test the application to ensure the removal of associated Access Control Lists (ACL) will not cause the application to perform unexpectedly.
+~~~
 
 -   **Sequencer doesn’t capture registry ACLs**—Although the Sequencer captures the NTFS file system ACLs during the installation phase of sequencing, it does not capture the ACLs for the registry. Users will have full access to all registry keys for virtual applications except for services. However, if a user modifies the registry of a virtual application, the change will be stored in a specific store (**uservol\_sftfs\_v1.pkg**) and will not affect other users.
 
@@ -55,9 +60,9 @@ Consider the following scenarios and the associated best practices when implemen
 
 [Planning for Security and Protection](planning-for-security-and-protection.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v4/planning-for-server-security.md b/mdop/appv-v4/planning-for-server-security.md
index 501abea4b3..289d44d508 100644
--- a/mdop/appv-v4/planning-for-server-security.md
+++ b/mdop/appv-v4/planning-for-server-security.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for Server Security
 description: Planning for Server Security
-author: jamiejdt
+author: dansimp
 ms.assetid: c7cd8227-b359-41e7-a8ae-d0d5718a76a2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -28,7 +31,7 @@ The content directory contains all of the packages that are to be streamed to cl
 
 Keep the number of users with administrative privileges to a minimum to reduce possible threats to the data in the data store and to avoid publishing malicious applications into the infrastructure.
 
-##  Application Virtualization Security
+## Application Virtualization Security
 
 
 App-V uses several methods of communication between the various components of the infrastructure. When you plan your App-V infrastructure, securing the communications between servers can reduce the security risks that might already be present on the existing network.
@@ -68,7 +71,7 @@ Installing or configuring an App-V Management Server or Streaming Server to use
     **Note**  
     If you use App-V in a network load balanced cluster, the certificate must be configured with *Subject Alternate Names* (SANs) to support RTSPS. For information about configuring the certification authority (CA) and creating certificates with SANs, see  (https://go.microsoft.com/fwlink/?LinkId=133228).
 
-     
+     
 
 -   The CA issuing the certificate to the App-V server must be trusted by the client connecting to the server. Otherwise, the client terminates the connection.
 
@@ -77,7 +80,7 @@ Installing or configuring an App-V Management Server or Streaming Server to use
     **Note**  
     For information about configuring a public key infrastructure (PKI), see  (https://go.microsoft.com/fwlink/?LinkId=133229).
 
-     
+     
 
 ### Configuring IIS Servers with HTTPS
 
@@ -86,7 +89,7 @@ App-V might use IIS servers in certain infrastructure configurations. For more i
 **Note**  
 If you are using IIS to publish the ICO and OSD files, configure a MIME type for OSD=TXT; otherwise, IIS will refuse to serve the ICO and OSD files to clients.
 
- 
+ 
 
 ### Application-Level Security
 
@@ -112,9 +115,9 @@ For the infrastructure to operate correctly, separating the App-V Management Con
 
 [Planning for Security and Protection](planning-for-security-and-protection.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md b/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md
index c5983a16c9..f330eaca98 100644
--- a/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md
+++ b/mdop/appv-v4/planning-the-application-virtualization-sequencer-implementation.md
@@ -1,12 +1,15 @@
 ---
 title: Planning the Application Virtualization Sequencer Implementation
 description: Planning the Application Virtualization Sequencer Implementation
-author: jamiejdt
+author: dansimp
 ms.assetid: 052f32fe-ad13-4921-a8ce-4a657eb2b2bf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -25,7 +28,7 @@ For step-by-step information about installing the Sequencer, see [How to Install
 **Important**  
 The entire sequencing process plan should be reviewed and approved by your corporate security team. Sequencer operations would usually be kept separate from the production environment in a lab. This can be as simple or as comprehensive as necessary, based on your business requirements. The sequencing computers will need connectivity to the corporate network to copy finished packages over to the production servers. However, because they are typically operated without antivirus protection, they must not be on the corporate network unprotected—for example, you might be able to operate behind a firewall or on an isolated network segment. Using Virtual Machines configured to share an isolated virtual network might also be an acceptable approach. Follow your corporate security policies to safely address this situation.
 
- 
+ 
 
 Key steps for planning the sequencing process include the following:
 
@@ -38,7 +41,7 @@ Key steps for planning the sequencing process include the following:
     **Important**  
     Running the App-V sequencer in Safe Mode is not supported.
 
-     
+     
 
 -   Verify that you understand the sequenced application’s operating environment, including integration elements such as Microsoft Office or the Java Runtime Environment, because this will often determine whether anything has to be installed on the sequencing computer prior to sequencing the application.
 
@@ -61,9 +64,9 @@ Key steps for planning the sequencing process include the following:
 
 [Security and Protection Overview](security-and-protection-overview.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md b/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md
index 6fc72f141d..6a03d508c0 100644
--- a/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md
+++ b/mdop/appv-v4/planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md
@@ -1,12 +1,15 @@
 ---
 title: Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation
 description: Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation
-author: jamiejdt
+author: dansimp
 ms.assetid: 3a57306e-5c54-4fde-8593-fe3b788f18d3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ The supported options include using a file server, an IIS server, or an Applicat
 **Note**  
 The active upgrade feature enables a new version of an application to be added to an App-V Management Server or Streaming Server without affecting users currently running the application. The App-V clients will automatically receive the latest version of the application from the App-V Management Server or Streaming Server the next time the user starts the application. Use of the RTSP(S) protocol is required for this feature.
 
- 
+ 
 
 @@ -50,7 +53,7 @@ The active upgrade feature enables a new version of an application to be added t
 
-
+
@@ -66,7 +69,7 @@ The active upgrade feature enables a new version of an application to be added t
 
    • Need to manage IIS
    • No active upgrade
      • 
-
+
@@ -80,7 +83,7 @@ The active upgrade feature enables a new version of an application to be added t
 
    • Dual infrastructure
    • Server administration requirement
      • 
-
+
@@ -94,12 +97,12 @@ The active upgrade feature enables a new version of an application to be added t
 
    • Dual infrastructure
    • Server administration requirement
      • 
-
+
      
 

        
 
      • No active upgrade
        • 
 
      [How to Configure the File Server](how-to-configure-the-file-server.md)
      How to Configure the File Server
      		
 
      
 
      
 
      IIS server
      		
 
 
      [How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md)
      How to Configure the Server for IIS
      		
 
      
 
      
 
      Application Virtualization Streaming Server
      		
 
 
      [How to Configure the Application Virtualization Streaming Servers](how-to-configure-the-application-virtualization-streaming-servers.md)
      How to Configure the Application Virtualization Streaming Servers
      		
 
      
 
      
 
      Application Virtualization Management Server
      		
 
 
      [How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md)
      How to Configure the Application Virtualization Management Servers
      		
 
      
       
 
      
 
- 
+ 
 
 ## Related topics
 
@@ -110,9 +113,9 @@ The active upgrade feature enables a new version of an application to be added t
 
 [Publishing Virtual Applications Using Application Virtualization Management Servers](publishing-virtual-applications-using-application-virtualization-management-servers.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md b/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md
index d71b6f8d26..f0e61dd69e 100644
--- a/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md
+++ b/mdop/appv-v4/planning-your-streaming-solution-in-an-electronic-software-distribution-implementation.md
@@ -1,12 +1,15 @@
 ---
 title: Planning Your Streaming Solution in an Electronic Software Distribution Implementation
 description: Planning Your Streaming Solution in an Electronic Software Distribution Implementation
-author: jamiejdt
+author: dansimp
 ms.assetid: bc18772a-f169-486f-adb1-7af1a31845aa
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ The Application Virtualization Streaming Server provides support for the active
 **Note**  
 Access to the applications is controlled by means of Security Groups in Active Directory Domain Services, so you will need to plan a process for setting up a security group for each virtual application and for managing which users are added to each group. The Application Virtualization system administrator configures each streaming server to use these Active Directory groups by applying ACLs to the application directories under the CONTENT share, which controls access to the packages based on Active Directory group membership.
 
- 
+ 
 
 The characteristics of the available streaming options are summarized in the following table.
 
@@ -52,7 +55,7 @@ The characteristics of the available streaming options are summarized in the fol
 
        
 
      • No active upgrade
        • 
 
      
-
      [How to Configure the File Server](how-to-configure-the-file-server.md)
      
+
      How to Configure the File Server
      
 
 
 
      IIS server
      
@@ -68,7 +71,7 @@ The characteristics of the available streaming options are summarized in the fol
 
    • Need to manage IIS
      • 
 
    • No active upgrade
      • 
 
    
-
    [How to Configure the Server for IIS](how-to-configure-the-server-for-iis.md)
    
+
    How to Configure the Server for IIS
    
 
 
 
    Application Virtualization Streaming Server
    
@@ -82,12 +85,12 @@ The characteristics of the available streaming options are summarized in the fol
 
  • Dual infrastructure
    • 
 
  • Server administration requirement
    • 
 

-
[How to Configure the Application Virtualization Management Servers](how-to-configure-the-application-virtualization-management-servers.md)

+
How to Configure the Application Virtualization Management Servers

 
 
 
 
- 
+ 
 
 ## Related topics
 
@@ -98,9 +101,9 @@ The characteristics of the available streaming options are summarized in the fol
 
 [Publishing Virtual Applications Using Electronic Software Distribution](publishing-virtual-applications-using-electronic-software-distribution.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/prepare-computer-page--learn-more-.md b/mdop/appv-v4/prepare-computer-page--learn-more-.md
index 485921ad56..ae4493a4e7 100644
--- a/mdop/appv-v4/prepare-computer-page--learn-more-.md
+++ b/mdop/appv-v4/prepare-computer-page--learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Prepare Computer Page (Learn More)
 description: Prepare Computer Page (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: a401ce3d-b8f7-4b3f-9be9-ecf6d8b544fd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/properties-tab-keep.md b/mdop/appv-v4/properties-tab-keep.md
index 069cef4a9a..3631579f1f 100644
--- a/mdop/appv-v4/properties-tab-keep.md
+++ b/mdop/appv-v4/properties-tab-keep.md
@@ -1,12 +1,15 @@
 ---
 title: Properties Tab
 description: Properties Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 6ff20678-6766-4f0d-8bbb-f19b224682a1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/provider-policies-node.md b/mdop/appv-v4/provider-policies-node.md
index 01a6e311b7..bbe803ac9f 100644
--- a/mdop/appv-v4/provider-policies-node.md
+++ b/mdop/appv-v4/provider-policies-node.md
@@ -1,12 +1,15 @@
 ---
 title: Provider Policies Node
 description: Provider Policies Node
-author: jamiejdt
+author: dansimp
 ms.assetid: 89b47076-7732-4128-93cc-8e6d5b671c8e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/provider-policies-results-pane-columns.md b/mdop/appv-v4/provider-policies-results-pane-columns.md
index 88b603b18e..984d407ee3 100644
--- a/mdop/appv-v4/provider-policies-results-pane-columns.md
+++ b/mdop/appv-v4/provider-policies-results-pane-columns.md
@@ -1,12 +1,15 @@
 ---
 title: Provider Policies Results Pane Columns
 description: Provider Policies Results Pane Columns
-author: jamiejdt
+author: dansimp
 ms.assetid: f9456f17-3106-4e5a-9a8c-df3af66986e1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/provider-policies-results-pane.md b/mdop/appv-v4/provider-policies-results-pane.md
index 77b7329e95..efb2984428 100644
--- a/mdop/appv-v4/provider-policies-results-pane.md
+++ b/mdop/appv-v4/provider-policies-results-pane.md
@@ -1,12 +1,15 @@
 ---
 title: Provider Policies Results Pane
 description: Provider Policies Results Pane
-author: jamiejdt
+author: dansimp
 ms.assetid: 17ea0836-bfb5-4966-8778-155444d81e64
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/publish-app.md b/mdop/appv-v4/publish-app.md
index 42499aefdb..3248daad68 100644
--- a/mdop/appv-v4/publish-app.md
+++ b/mdop/appv-v4/publish-app.md
@@ -1,12 +1,15 @@
 ---
 title: PUBLISH APP
 description: PUBLISH APP
-author: jamiejdt
+author: dansimp
 ms.assetid: f25f06a8-ca23-435b-a0c2-16a5f39b6b97
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/publish-package.md b/mdop/appv-v4/publish-package.md
index 03c251ae5e..facdb61e5c 100644
--- a/mdop/appv-v4/publish-package.md
+++ b/mdop/appv-v4/publish-package.md
@@ -1,12 +1,15 @@
 ---
 title: PUBLISH PACKAGE
 description: PUBLISH PACKAGE
-author: jamiejdt
+author: dansimp
 ms.assetid: a33e72dd-194f-4283-8e99-4584ab13de53
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -57,7 +60,7 @@ Publishes the contents of an entire package.
 
 
 
- 
+ 
 
 For version 4.6, the following option has been added.
 
@@ -74,7 +77,7 @@ For version 4.6, the following option has been added.
 
 
 
- 
+ 
 
 **Important**  
 The package must already have been added to the Application Virtualization Client, and the manifest file is required.
@@ -87,16 +90,16 @@ Publishing with the **GLOBAL** parameter adds the file types and shortcuts liste
 
 If the package is not global before the call and the **GLOBAL** parameter is used, the package is made global and available to all users.
 
- 
+ 
 
 ## Related topics
 
 
 [SFTMIME Command Reference](sftmime--command-reference.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/publishing-servers-node.md b/mdop/appv-v4/publishing-servers-node.md
index 1c7fe00539..980c07416d 100644
--- a/mdop/appv-v4/publishing-servers-node.md
+++ b/mdop/appv-v4/publishing-servers-node.md
@@ -1,12 +1,15 @@
 ---
 title: Publishing Servers Node
 description: Publishing Servers Node
-author: jamiejdt
+author: dansimp
 ms.assetid: b5823c6c-15bc-4e8d-aeeb-acc366ffedd1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/publishing-servers-results-pane-columns.md b/mdop/appv-v4/publishing-servers-results-pane-columns.md
index 206754d680..42862c4a61 100644
--- a/mdop/appv-v4/publishing-servers-results-pane-columns.md
+++ b/mdop/appv-v4/publishing-servers-results-pane-columns.md
@@ -1,12 +1,15 @@
 ---
 title: Publishing Servers Results Pane Columns
 description: Publishing Servers Results Pane Columns
-author: jamiejdt
+author: dansimp
 ms.assetid: ad875715-50b3-4881-a6b3-586238d12527
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The **Publishing Servers Results** pane can display a variety of columns. **Name
 **Note**  
 You can add or remove a column simply by right-clicking in the **Results** pane, selecting **View**, then selecting **Add/Remove Columns**.
 
- 
+ 
 
 The list can be sorted by any of the columns. Columns that contain dates and times are sorted in chronological order, not alphabetical. For columns that contain a mix of dates and times and text (for example, **Next Refresh**), dates and times are considered to come before any other text.
 
@@ -62,9 +65,9 @@ The last time a refresh happened from this server for any user.
 
 [Publishing Servers Results Pane](publishing-servers-results-pane.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/publishing-servers-results-pane.md b/mdop/appv-v4/publishing-servers-results-pane.md
index 690a189e79..27745a94ba 100644
--- a/mdop/appv-v4/publishing-servers-results-pane.md
+++ b/mdop/appv-v4/publishing-servers-results-pane.md
@@ -1,12 +1,15 @@
 ---
 title: Publishing Servers Results Pane
 description: Publishing Servers Results Pane
-author: jamiejdt
+author: dansimp
 ms.assetid: ee0662e8-9623-4a7c-b6dc-657fa3f56161
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md b/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md
index e6db0bd239..53570b3732 100644
--- a/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md
+++ b/mdop/appv-v4/publishing-virtual-applications-using-application-virtualization-management-servers.md
@@ -1,12 +1,15 @@
 ---
 title: Publishing Virtual Applications Using Application Virtualization Management Servers
 description: Publishing Virtual Applications Using Application Virtualization Management Servers
-author: jamiejdt
+author: dansimp
 ms.assetid: f3d79284-3f82-4ca3-b741-1a80b61490da
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,14 +22,14 @@ In an Application Virtualization Server-based deployment, virtual application pa
 **Note**  
 The CONTENT share should be located on the server’s attached disk storage. Using a network storage device such as a SAN or a DFS share should be considered carefully because of the network impact.
 
- 
+ 
 
 Applications are provisioned to Active Directory groups. Typically, the Application Virtualization administrator will create Active Directory groups for each virtual application to be published and then add the appropriate users to those groups. When the users log on to their workstations, the Application Virtualization Client, by default, performs a publishing refresh using the credentials of the logged on user. The user can then start applications from wherever the shortcuts have been placed. The Application Virtualization administrator determines where and how many shortcuts are located on the client system during the sequencing of the application.
 
 **Note**  
 A *publishing refresh* is a call to the Application Virtualization Server that is defined on the Application Virtualization Client, to determine which virtual application shortcuts are sent to the client for use by the end user.
 
- 
+ 
 
 ## Related topics
 
@@ -39,9 +42,9 @@ A *publishing refresh* is a call to the Application Virtualization Server that i
 
 [Planning Your Streaming Solution in an Application Virtualization Server-Based Implementation](planning-your-streaming-solution-in-an-application-virtualization-server-based-implementation.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md b/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md
index 963307349a..5a56209bc5 100644
--- a/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md
+++ b/mdop/appv-v4/publishing-virtual-applications-using-electronic-software-distribution.md
@@ -1,12 +1,15 @@
 ---
 title: Publishing Virtual Applications Using Electronic Software Distribution
 description: Publishing Virtual Applications Using Electronic Software Distribution
-author: jamiejdt
+author: dansimp
 ms.assetid: 295fbc1d-ed1c-43b4-aeee-0df384d4e630
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/query-obj.md b/mdop/appv-v4/query-obj.md
index b77dad4ab4..a137e1cbda 100644
--- a/mdop/appv-v4/query-obj.md
+++ b/mdop/appv-v4/query-obj.md
@@ -1,12 +1,15 @@
 ---
 title: QUERY OBJ
 description: QUERY OBJ
-author: jamiejdt
+author: dansimp
 ms.assetid: 55abf0d1-c779-4172-8357-552ab010933b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -65,7 +68,7 @@ Returns a tab-delimited list of current applications, packages, file type associ
 
 
 
- 
+ 
 
 For version 4.6, the following option has been added.
 
@@ -82,7 +85,7 @@ For version 4.6, the following option has been added.
 
 
 
- 
+ 
 
 **Note**  
 In version 4.6, a new column has been added to the output of SFTMIME QUERY OBJ:APP \[/GLOBAL\]. The last column of the output is a numeric value that indicates whether an application is published or not.
@@ -93,7 +96,7 @@ PUBLISHED=0 means the application has not been published or it is no longer publ
 
 If you use the /GLOBAL parameter, the PUBLISHED state will be 1 for applications that were published globally and 0 for those applications that were published under user contexts. Without the /GLOBAL parameter, a PUBLISHED state of 1 is returned for applications published in the context of the user running the command, and a state of 0 is returned for those applications that are published globally.
 
- 
+ 
 
 The SFTMIME QUERY OBJ command can be used to query for information on all of the objects shown above—applications, packages, file type associations, and servers. To show how you might use the SFTMIME QUERY OBJ command in your normal operations tasks, the following example demonstrates the process you would follow if you wanted to set the OVERRIDEURL parameter value for a specific package to specify a new path to the package content. 
 
@@ -122,16 +125,16 @@ For version 4.6 SP2, the following option has been added.
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [SFTMIME Command Reference](sftmime--command-reference.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/refresh-server.md b/mdop/appv-v4/refresh-server.md
index ba5ac10b8c..8cbd8928df 100644
--- a/mdop/appv-v4/refresh-server.md
+++ b/mdop/appv-v4/refresh-server.md
@@ -1,12 +1,15 @@
 ---
 title: REFRESH SERVER
 description: REFRESH SERVER
-author: jamiejdt
+author: dansimp
 ms.assetid: 232df842-a160-46cd-b60b-f464cd9a0086
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/repair-app.md b/mdop/appv-v4/repair-app.md
index 144b56ec51..2b9e6f53f2 100644
--- a/mdop/appv-v4/repair-app.md
+++ b/mdop/appv-v4/repair-app.md
@@ -1,12 +1,15 @@
 ---
 title: REPAIR APP
 description: REPAIR APP
-author: jamiejdt
+author: dansimp
 ms.assetid: 892b556b-612d-4531-890e-4cfc2ac88d9f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/reports-node.md b/mdop/appv-v4/reports-node.md
index 42b885058a..d691eb3d1c 100644
--- a/mdop/appv-v4/reports-node.md
+++ b/mdop/appv-v4/reports-node.md
@@ -1,12 +1,15 @@
 ---
 title: Reports Node
 description: Reports Node
-author: jamiejdt
+author: dansimp
 ms.assetid: b7fdc52d-f112-4a65-af25-134398810e9b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/reports-results-pane-columns.md b/mdop/appv-v4/reports-results-pane-columns.md
index 178f13e230..a7abb0ae55 100644
--- a/mdop/appv-v4/reports-results-pane-columns.md
+++ b/mdop/appv-v4/reports-results-pane-columns.md
@@ -1,12 +1,15 @@
 ---
 title: Reports Results Pane Columns
 description: Reports Results Pane Columns
-author: jamiejdt
+author: dansimp
 ms.assetid: 907360ca-6a55-4e42-88d2-db1a24cd2a28
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/reports-results-pane.md b/mdop/appv-v4/reports-results-pane.md
index 909e77a1e8..77e23a88cc 100644
--- a/mdop/appv-v4/reports-results-pane.md
+++ b/mdop/appv-v4/reports-results-pane.md
@@ -1,12 +1,15 @@
 ---
 title: Reports Results Pane
 description: Reports Results Pane
-author: jamiejdt
+author: dansimp
 ms.assetid: 66beac62-fa55-4ab9-ac19-b9e1772e2d20
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md
index 6bdc90eb7b..2a2fbe0e8d 100644
--- a/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md
+++ b/mdop/appv-v4/restart-task-failure-dialog-box--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Restart Task Failure Dialog Box (App-V 4.6 SP1)
 description: Restart Task Failure Dialog Box (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 1933fe71-8aa0-4e43-b6f7-060050001edd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md b/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md
index 088399c940..2a93fe0947 100644
--- a/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md
+++ b/mdop/appv-v4/run-each-program-page-app-v-46-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: Run Each Program Page
 description: Run Each Program Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 4f09a64e-9545-47aa-bc43-fda0089f7adb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/security-and-protection-overview.md b/mdop/appv-v4/security-and-protection-overview.md
index a729904347..99c0632836 100644
--- a/mdop/appv-v4/security-and-protection-overview.md
+++ b/mdop/appv-v4/security-and-protection-overview.md
@@ -1,12 +1,15 @@
 ---
 title: Security and Protection Overview
 description: Security and Protection Overview
-author: jamiejdt
+author: dansimp
 ms.assetid: a43e1c53-7936-4d48-a110-0be26c8e9d97
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -18,7 +21,7 @@ Microsoft Application Virtualization 4.5 provides the following enhanced securi
 
 -   Application Virtualization now supports Transport Layer Security (TLS) using X.509 V3 certificates. Provided that a server certificate has been provisioned to the planned Application Virtualization Management or Streaming Server, the installation will default to secure, using the RTSPS protocol over port 322. Using RTSPS ensures that communication between the Application Virtualization Servers and the Application Virtualization Clients is signed and encrypted. If no certificate is assigned to the server during the Application Virtualization Server installation, the communication will be set to RTSP over port 554.
 
-    **Security Note:  **
+    **Security Note:**
 
     To help provide a secure setup of the server, you must make sure that RTSP ports are disabled even if you have all packages configured to use RTSPS.
 
diff --git a/mdop/appv-v4/select-files-page.md b/mdop/appv-v4/select-files-page.md
index 1501a9fa3b..f68466b525 100644
--- a/mdop/appv-v4/select-files-page.md
+++ b/mdop/appv-v4/select-files-page.md
@@ -1,12 +1,15 @@
 ---
 title: Select Files Page
 description: Select Files Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 6d1524ca-6306-4a28-b65f-3ded9d487e75
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/select-guidance-page--package-accelerators-.md b/mdop/appv-v4/select-guidance-page--package-accelerators-.md
index 8db0ff9e08..387de4bfaf 100644
--- a/mdop/appv-v4/select-guidance-page--package-accelerators-.md
+++ b/mdop/appv-v4/select-guidance-page--package-accelerators-.md
@@ -1,12 +1,15 @@
 ---
 title: Select Guidance Page (Package Accelerators)
 description: Select Guidance Page (Package Accelerators)
-author: jamiejdt
+author: dansimp
 ms.assetid: 608b8823-6eac-40c0-a6dc-2f0bfc0d42a1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md b/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md
index f981faa4fd..08bd4bf267 100644
--- a/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md
+++ b/mdop/appv-v4/select-installation-files-page-app-v-46-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: Select Installation Files Page
 description: Select Installation Files Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 4c8cd49e-ba39-4918-9863-5b3c315d14a5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/select-installer-page--learn-more-.md b/mdop/appv-v4/select-installer-page--learn-more-.md
index 99ba482afa..6a57a0227a 100644
--- a/mdop/appv-v4/select-installer-page--learn-more-.md
+++ b/mdop/appv-v4/select-installer-page--learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Select Installer Page (Learn More)
 description: Select Installer Page (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: da05e756-d23e-4557-8ff6-313d695a78a1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/select-package--learn-more--page.md b/mdop/appv-v4/select-package--learn-more--page.md
index 7f2a535b4c..24f631fd1d 100644
--- a/mdop/appv-v4/select-package--learn-more--page.md
+++ b/mdop/appv-v4/select-package--learn-more--page.md
@@ -1,12 +1,15 @@
 ---
 title: Select Package (Learn More) Page
 description: Select Package (Learn More) Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 0b3d4ca4-ff65-4aa5-87a9-61cbe2ffc8be
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/select-package-accelerator--learn-more--page.md b/mdop/appv-v4/select-package-accelerator--learn-more--page.md
index 9f52d39fdd..18ce0df5a2 100644
--- a/mdop/appv-v4/select-package-accelerator--learn-more--page.md
+++ b/mdop/appv-v4/select-package-accelerator--learn-more--page.md
@@ -1,12 +1,15 @@
 ---
 title: Select Package Accelerator (Learn More) Page
 description: Select Package Accelerator (Learn More) Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 2db51514-8695-4b5e-b3e5-1e96e3ee4cc7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/select-package-accelerator-page.md b/mdop/appv-v4/select-package-accelerator-page.md
index 930ca2149a..b1b04254d7 100644
--- a/mdop/appv-v4/select-package-accelerator-page.md
+++ b/mdop/appv-v4/select-package-accelerator-page.md
@@ -1,12 +1,15 @@
 ---
 title: Select Package Accelerator Page
 description: Select Package Accelerator Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 865c2702-4dfd-41ae-8cfc-3514d5f41f76
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/select-primary-page--learn-more-.md b/mdop/appv-v4/select-primary-page--learn-more-.md
index 75982776db..cf6a9e41a9 100644
--- a/mdop/appv-v4/select-primary-page--learn-more-.md
+++ b/mdop/appv-v4/select-primary-page--learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Select Primary Page (Learn More)
 description: Select Primary Page (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: 17c779da-f683-4967-b136-94fe65373c1b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/select-task-page--learn-more-.md b/mdop/appv-v4/select-task-page--learn-more-.md
index ebbcacc034..60b28a83fa 100644
--- a/mdop/appv-v4/select-task-page--learn-more-.md
+++ b/mdop/appv-v4/select-task-page--learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Select Task Page (Learn More)
 description: Select Task Page (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: 09534c40-bf6c-4b3f-be9a-8624965c9c18
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/sequencer-command-line-error-codes.md b/mdop/appv-v4/sequencer-command-line-error-codes.md
index 493850e7d8..73d55eebce 100644
--- a/mdop/appv-v4/sequencer-command-line-error-codes.md
+++ b/mdop/appv-v4/sequencer-command-line-error-codes.md
@@ -1,12 +1,15 @@
 ---
 title: Sequencer Command-Line Error Codes
 description: Sequencer Command-Line Error Codes
-author: jamiejdt
+author: dansimp
 ms.assetid: 3d491314-4923-45fd-9839-c541c5e620bd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Use the following list to help identify errors that are related to sequencing ap
 **Note**  
 Multiple errors can occur during sequencing, and if this happens, the error code that is displayed might be the sum of two error codes. For example, if the */InstallPath* and */OutputFile* parameters are missing, the App-V Sequencer will return **96**—the sum of the two error codes.
 
- 
+ 
 
 01  
 There is an unspecified error.
@@ -88,9 +91,9 @@ The package name is not specified.
 
 [Sequencer Command-Line Parameters](sequencer-command-line-parameters.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/sequencer-command-line-parameters.md b/mdop/appv-v4/sequencer-command-line-parameters.md
index 34d6c40fc7..11ecdb06c4 100644
--- a/mdop/appv-v4/sequencer-command-line-parameters.md
+++ b/mdop/appv-v4/sequencer-command-line-parameters.md
@@ -1,12 +1,15 @@
 ---
 title: Sequencer Command-Line Parameters
 description: Sequencer Command-Line Parameters
-author: jamiejdt
+author: dansimp
 ms.assetid: 28fb875a-c302-4d95-b2e0-8dc0c5dbb0f8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/sequencer-console.md b/mdop/appv-v4/sequencer-console.md
index bede974fb1..661a880497 100644
--- a/mdop/appv-v4/sequencer-console.md
+++ b/mdop/appv-v4/sequencer-console.md
@@ -1,12 +1,15 @@
 ---
 title: Sequencer Console
 description: Sequencer Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 69e0202d-be2c-41cc-99cb-2a08a034e804
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/sequencer-dialog-boxes.md b/mdop/appv-v4/sequencer-dialog-boxes.md
index ba699cc4c5..deba694e0e 100644
--- a/mdop/appv-v4/sequencer-dialog-boxes.md
+++ b/mdop/appv-v4/sequencer-dialog-boxes.md
@@ -1,12 +1,15 @@
 ---
 title: Sequencer Dialog Boxes
 description: Sequencer Dialog Boxes
-author: jamiejdt
+author: dansimp
 ms.assetid: f660d56b-0244-4167-b077-96ad482e6b36
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/sequencer-hardware-and-software-requirements.md b/mdop/appv-v4/sequencer-hardware-and-software-requirements.md
index 5ff8f33421..40fe62a7a2 100644
--- a/mdop/appv-v4/sequencer-hardware-and-software-requirements.md
+++ b/mdop/appv-v4/sequencer-hardware-and-software-requirements.md
@@ -1,12 +1,15 @@
 ---
 title: Sequencer Hardware and Software Requirements
 description: Sequencer Hardware and Software Requirements
-author: jamiejdt
+author: dansimp
 ms.assetid: 36084e12-831d-452f-a4a4-45f07f9ce471
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -35,7 +38,7 @@ The following list outlines the recommended hardware requirements for running th
     **Note**  
     Sequencing requires heavy disk usage. A fast disk speed can decrease the sequencing time.
 
-     
+     
 
 ### Software Requirements
 
@@ -78,14 +81,14 @@ The following list outlines the supported operating systems for running the Sequ
 
 
 
- 
+ 
 
 ¹Supported for App-V 4.5 with SP1 or SP2, and App-V 4.6 only
 
 **Note**  
 The Application Virtualization (App-V) 4.6 Sequencer supports 32-bit and 64-bit versions of these operating systems.
 
- 
+ 
 
 You should configure computers running the Sequencer with the same applications that are installed on target computers.
 
@@ -128,21 +131,21 @@ You should configure computers running the Sequencer with the same applications
 
 
 
- 
+ 
 
 **Note**  
 Application Virtualization (App-V) 4.6 for Remote Desktop Services supports 32-bit and 64-bit versions of these operating systems.
 
- 
+ 
 
 ## Related topics
 
 
 [Application Virtualization Sequencer Overview](application-virtualization-sequencer-overview.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md b/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md
index 3c4e950712..6da8f78d45 100644
--- a/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md
+++ b/mdop/appv-v4/sequencer-wizard---package-accelerator--appv-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)
 description: Sequencer Wizard - Package Accelerator (AppV 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 1f75f5ba-0707-48fb-b0b8-ba94a5159e36
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/sequencing-wizard.md b/mdop/appv-v4/sequencing-wizard.md
index f20d1ba841..4db54af6bc 100644
--- a/mdop/appv-v4/sequencing-wizard.md
+++ b/mdop/appv-v4/sequencing-wizard.md
@@ -1,12 +1,15 @@
 ---
 title: Sequencing Wizard
 description: Sequencing Wizard
-author: jamiejdt
+author: dansimp
 ms.assetid: 81e2f4fa-b06e-4cbe-aeb8-6ceb8f0543a5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/server-groups-node.md b/mdop/appv-v4/server-groups-node.md
index e2c59ab9f1..95137d7733 100644
--- a/mdop/appv-v4/server-groups-node.md
+++ b/mdop/appv-v4/server-groups-node.md
@@ -1,12 +1,15 @@
 ---
 title: Server Groups Node
 description: Server Groups Node
-author: jamiejdt
+author: dansimp
 ms.assetid: 6b2ed086-9100-47d0-be7f-0c5fb4fa55c6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/server-groups-results-pane-columns.md b/mdop/appv-v4/server-groups-results-pane-columns.md
index 90cae8a935..9a40ac8e31 100644
--- a/mdop/appv-v4/server-groups-results-pane-columns.md
+++ b/mdop/appv-v4/server-groups-results-pane-columns.md
@@ -1,12 +1,15 @@
 ---
 title: Server Groups Results Pane Columns
 description: Server Groups Results Pane Columns
-author: jamiejdt
+author: dansimp
 ms.assetid: e91b1b9b-e58c-4274-ad18-8b157936b9be
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/server-groups-results-pane.md b/mdop/appv-v4/server-groups-results-pane.md
index 85b8195f67..e8558e68c8 100644
--- a/mdop/appv-v4/server-groups-results-pane.md
+++ b/mdop/appv-v4/server-groups-results-pane.md
@@ -1,12 +1,15 @@
 ---
 title: Server Groups Results Pane
 description: Server Groups Results Pane
-author: jamiejdt
+author: dansimp
 ms.assetid: ac7b0525-5946-4728-9cf1-c65007852ebe
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -74,7 +77,7 @@ Deletes an Application Virtualization Management Server.
 Changes the name of an Application Virtualization Management Server.
 
 **Properties**  
-Displays the **Propertie**s dialog box for the selected server. The **Properties** dialog box has the following tabs:
+Displays the **Properties** dialog box for the selected server. The **Properties** dialog box has the following tabs:
 
 -   **General**—Enables you to select the provider policy from the **Provider Policies** drop-down list and to enable or disable the server by selecting or clearing the **Enable** check box.
 
diff --git a/mdop/appv-v4/server-management-console-about-dialog-boxes.md b/mdop/appv-v4/server-management-console-about-dialog-boxes.md
index 8670b79892..c40139a8da 100644
--- a/mdop/appv-v4/server-management-console-about-dialog-boxes.md
+++ b/mdop/appv-v4/server-management-console-about-dialog-boxes.md
@@ -1,12 +1,15 @@
 ---
 title: Server Management Console About Dialog Boxes
 description: Server Management Console About Dialog Boxes
-author: jamiejdt
+author: dansimp
 ms.assetid: b5fdee0b-4269-4a48-98a0-ed3f06cff041
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/server-management-console-administrators-node.md b/mdop/appv-v4/server-management-console-administrators-node.md
index 14d560d133..0ed24e294f 100644
--- a/mdop/appv-v4/server-management-console-administrators-node.md
+++ b/mdop/appv-v4/server-management-console-administrators-node.md
@@ -1,12 +1,15 @@
 ---
 title: Server Management Console Administrators Node
 description: Server Management Console Administrators Node
-author: jamiejdt
+author: dansimp
 ms.assetid: ab421454-69d1-4c10-8f58-2a35ae89c8b1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/server-management-console-application-licenses-node.md b/mdop/appv-v4/server-management-console-application-licenses-node.md
index eeba65a481..9d37dd63fa 100644
--- a/mdop/appv-v4/server-management-console-application-licenses-node.md
+++ b/mdop/appv-v4/server-management-console-application-licenses-node.md
@@ -1,12 +1,15 @@
 ---
 title: Server Management Console Application Licenses Node
 description: Server Management Console Application Licenses Node
-author: jamiejdt
+author: dansimp
 ms.assetid: ad3fa486-2b3c-4efd-91f5-507e9c5057d5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/server-management-console-application-virtualization-system-node.md b/mdop/appv-v4/server-management-console-application-virtualization-system-node.md
index b60114b7c2..b52204a63d 100644
--- a/mdop/appv-v4/server-management-console-application-virtualization-system-node.md
+++ b/mdop/appv-v4/server-management-console-application-virtualization-system-node.md
@@ -1,12 +1,15 @@
 ---
 title: Server Management Console Application Virtualization System Node
 description: Server Management Console Application Virtualization System Node
-author: jamiejdt
+author: dansimp
 ms.assetid: 9450832e-335c-41e7-af24-fddb8ffc327c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,19 +24,19 @@ You can right-click the Application Virtualization System node to display the fo
 **Configure Connection**  
 In this dialog box, you can modify the following settings:
 
--   **Web Service Host Name**—Enables you to enter the name of the Application Virtualization System to which you want to connect, or you can enter **localhost** to connect to the local computer.
+- **Web Service Host Name**—Enables you to enter the name of the Application Virtualization System to which you want to connect, or you can enter **localhost** to connect to the local computer.
 
--   **Use Secure Connection**—Select if you want to connect to the server with a secure connection.
+- **Use Secure Connection**—Select if you want to connect to the server with a secure connection.
 
--   **Port**—Enables you to enter the port number you want to use for the connection. 80 is the default regular port number, and 443 is default secure port number.
+- **Port**—Enables you to enter the port number you want to use for the connection. 80 is the default regular port number, and 443 is default secure port number.
 
--   **Use Current Windows Account**—Select to use the current Windows account credentials.
+- **Use Current Windows Account**—Select to use the current Windows account credentials.
 
--   **Specify Windows Account**—Select when you want to connect to the server as a different user.
+- **Specify Windows Account**—Select when you want to connect to the server as a different user.
 
--   **Name**—Enables you to enter the name of the new user by using either the *DOMAIN\\username* or the *username@domain* format.
+- **Name**—Enables you to enter the name of the new user by using either the *DOMAIN\\username* or the username@domain format.
 
--   **Password**—Enables you to enter the password that corresponds to the new user.
+- **Password**—Enables you to enter the password that corresponds to the new user.
 
 **System Options**  
 On the following tabs on this dialog box, you can modify the associated settings:
@@ -59,9 +62,9 @@ Starts the management console help file.
 
 [Application Virtualization Server Management Console Reference](application-virtualization-server-management-console-reference.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/server-management-console-applications-node.md b/mdop/appv-v4/server-management-console-applications-node.md
index 0200cecd03..4b72b9cea2 100644
--- a/mdop/appv-v4/server-management-console-applications-node.md
+++ b/mdop/appv-v4/server-management-console-applications-node.md
@@ -1,12 +1,15 @@
 ---
 title: Server Management Console Applications Node
 description: Server Management Console Applications Node
-author: jamiejdt
+author: dansimp
 ms.assetid: e465f816-032d-4824-9924-f2dcf30f2a2c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/server-management-console-file-type-associations-node.md b/mdop/appv-v4/server-management-console-file-type-associations-node.md
index 11b009c969..30911041dd 100644
--- a/mdop/appv-v4/server-management-console-file-type-associations-node.md
+++ b/mdop/appv-v4/server-management-console-file-type-associations-node.md
@@ -1,12 +1,15 @@
 ---
 title: Server Management Console File Type Associations Node
 description: Server Management Console File Type Associations Node
-author: jamiejdt
+author: dansimp
 ms.assetid: c22168be-6601-4154-b36b-9ca0fa87e5e0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/server-management-console-packages-node.md b/mdop/appv-v4/server-management-console-packages-node.md
index aa19449087..dc6de0a83f 100644
--- a/mdop/appv-v4/server-management-console-packages-node.md
+++ b/mdop/appv-v4/server-management-console-packages-node.md
@@ -1,12 +1,15 @@
 ---
 title: Server Management Console Packages Node
 description: Server Management Console Packages Node
-author: jamiejdt
+author: dansimp
 ms.assetid: 458424f6-d586-4fa8-bf61-44c5028a4490
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/server-management-console-provider-policies-node.md b/mdop/appv-v4/server-management-console-provider-policies-node.md
index 1a1bcfbe28..e48e539846 100644
--- a/mdop/appv-v4/server-management-console-provider-policies-node.md
+++ b/mdop/appv-v4/server-management-console-provider-policies-node.md
@@ -1,12 +1,15 @@
 ---
 title: Server Management Console Provider Policies Node
 description: Server Management Console Provider Policies Node
-author: jamiejdt
+author: dansimp
 ms.assetid: a5b99158-9af8-45bb-b3b8-61e220529e14
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/server-management-console-reports-node.md b/mdop/appv-v4/server-management-console-reports-node.md
index a44430f7e2..5cda771115 100644
--- a/mdop/appv-v4/server-management-console-reports-node.md
+++ b/mdop/appv-v4/server-management-console-reports-node.md
@@ -1,12 +1,15 @@
 ---
 title: Server Management Console Reports Node
 description: Server Management Console Reports Node
-author: jamiejdt
+author: dansimp
 ms.assetid: 9dde6332-5882-40dd-8a8f-857216df80ed
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/server-management-console-server-groups-node.md b/mdop/appv-v4/server-management-console-server-groups-node.md
index e375e14026..4b657466b4 100644
--- a/mdop/appv-v4/server-management-console-server-groups-node.md
+++ b/mdop/appv-v4/server-management-console-server-groups-node.md
@@ -1,12 +1,15 @@
 ---
 title: Server Management Console Server Groups Node
 description: Server Management Console Server Groups Node
-author: jamiejdt
+author: dansimp
 ms.assetid: 83b86fc5-3f77-4470-985a-cf0bb8686067
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/sftmime--command-reference.md b/mdop/appv-v4/sftmime--command-reference.md
index 96c8d95e2d..732b47bafc 100644
--- a/mdop/appv-v4/sftmime--command-reference.md
+++ b/mdop/appv-v4/sftmime--command-reference.md
@@ -1,12 +1,15 @@
 ---
 title: SFTMIME Command Reference
 description: SFTMIME Command Reference
-author: jamiejdt
+author: dansimp
 ms.assetid: a4a69228-9dd3-4623-b773-899d03c0cf10
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/sfttray-command-reference.md b/mdop/appv-v4/sfttray-command-reference.md
index 3e36ea9f21..9e7dc93e91 100644
--- a/mdop/appv-v4/sfttray-command-reference.md
+++ b/mdop/appv-v4/sfttray-command-reference.md
@@ -1,12 +1,15 @@
 ---
 title: SFTTRAY Command Reference
 description: SFTTRAY Command Reference
-author: jamiejdt
+author: dansimp
 ms.assetid: 6fa3a939-b047-4d6c-bd1d-dfb93e065eb2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,28 +26,28 @@ By default, the icon is displayed whenever a virtual application is started, alt
 
 The list of commands and command-line switches can be displayed by running the following command from a command window.
 
-**Note**  
+**Note**  
 There is only one Application Virtualization Client Tray instance for each user context, so if you start a new SFTTRAY command, it will be passed to the program that is already running.
 
- 
 
-`     Sfttray.exe /?`
+
+`Sfttray.exe /?`
 
 ### Command Usage
 
-`     Sfttray.exe [/HIDE | /SHOW]`
+`Sfttray.exe [/HIDE | /SHOW]`
 
-`     Sfttray.exe [/HIDE | /SHOW] [/QUIET] [/EXE alternate-exe] /LAUNCH app [args]`
+`Sfttray.exe [/HIDE | /SHOW] [/QUIET] [/EXE alternate-exe] /LAUNCH app [args]`
 
-`     Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOAD app [/SFTFILE sft]`
+`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOAD app [/SFTFILE sft]`
 
-`     Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOADALL`
+`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LOADALL`
 
-`     Sfttray.exe [/HIDE | /SHOW] [/QUIET] /REFRESHALL`
+`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /REFRESHALL`
 
-`     Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LAUNCHRESULT   /LAUNCH app [args]`
+`Sfttray.exe [/HIDE | /SHOW] [/QUIET] /LAUNCHRESULT   /LAUNCH app [args]`
 
-`     Sfttray.exe /EXIT`
+`Sfttray.exe /EXIT`
 
 ### Command-Line Switches
 
@@ -78,22 +81,20 @@ The SFTTRAY command-line switches are described in the following table.
 
/EXE <alternate-exe>

 
Used with /LAUNCH to specify that an executable program is to be started in the virtual environment when a virtual application is started in place of the target file specified in the OSD.

 

-Note  
-
For example, use “SFTTRAY.EXE /EXE REGEDIT.EXE /LAUNCH <app>” to enable you to examine the registry of the virtual environment in which the application is running.

+Note
For example, use “SFTTRAY.EXE /EXE REGEDIT.EXE /LAUNCH <app>” to enable you to examine the registry of the virtual environment in which the application is running.

 

 

- 
+
 

 
 
 
/LAUNCH <app> [<args>]

 
Starts a virtual application. Specify the name and version of an application or the path to an OSD file. Optionally, command-line arguments can be passed to the virtual application.

 

-Note  
-
Use the command “SFTMIME.EXE /QUERY OBJ:APP /SHORT” to obtain a list of the names and versions of available virtual applications.

+Note
Use the command “SFTMIME.EXE /QUERY OBJ:APP /SHORT” to obtain a list of the names and versions of available virtual applications.

 

 

- 
+
 

 
 
@@ -123,20 +124,20 @@ The SFTTRAY command-line switches are described in the following table.
 
 
 
- 
 
-**Note**  
+
+**Note**  
 ¹ The */LAUNCHRESULT* command line parameter provides a means for the process that launches sfttray.exe to specify the root name for a global event and a memory mapped file that are used to return the launch result code to the process. The unique identifier name should start with “SFT-” to prevent the event name from getting virtualized when the launching process is invoked within a virtual environment. The memory mapped region will be 64 bits in size.
 
 To use this parameter, the launching process creates an event with the name “<UNIQUE ID>-result\_event”, a memory mapped file with the name “<UNIQUE ID>-result\_value”, and optionally an event with the name “<UNIQUE ID>-shutdown\_event”, and then the launching process launches sfttray.exe and waits on the event to be signaled. After the event “<UNIQUE ID>-result\_event” is signaled, the launching process retrieves the 64-bit return code from the memory mapped region.
 
 If the optional event “<UNIQUE ID>-shutdown\_event” exists when the virtual application exits, sfttray.exe opens and signals the event. The launching process waits on this shutdown event if it needs to determine when the virtual application exits.
 
- 
-
- 
-
- 
+
+
+
+
+
 
 
 
diff --git a/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md
index 8244897419..ced6882390 100644
--- a/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md
+++ b/mdop/appv-v4/side-by-side-privatization-failed-dialog-box--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1)
 description: Side-by-side Privatization Failed Dialog Box (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: bcdb9b82-b53d-4a36-9f5d-71c021d4be28
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/software-audit-reportserver.md b/mdop/appv-v4/software-audit-reportserver.md
index 0570d32c39..9efbb49955 100644
--- a/mdop/appv-v4/software-audit-reportserver.md
+++ b/mdop/appv-v4/software-audit-reportserver.md
@@ -1,12 +1,15 @@
 ---
 title: Software Audit Report
 description: Software Audit Report
-author: jamiejdt
+author: dansimp
 ms.assetid: 55a49ed2-f331-40d3-add6-8e5fcd6816fd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md b/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md
index 436e56486a..224b3b7a04 100644
--- a/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md
+++ b/mdop/appv-v4/stand-alone-delivery-scenario-for-application-virtualization-clients.md
@@ -1,12 +1,15 @@
 ---
 title: Stand-Alone Delivery Scenario for Application Virtualization Clients
 description: Stand-Alone Delivery Scenario for Application Virtualization Clients
-author: jamiejdt
+author: dansimp
 ms.assetid: 7545b468-f58a-4504-a6d5-3c2d303731c4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The Stand-Alone Delivery Scenario enables you to realize the benefits of Microso
 **Note**  
 It is assumed that you have already installed the Application Virtualization Sequencer in preparation for the stand-alone scenario. For more information, see [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md).
 
- 
+ 
 
 ## In This Section
 
@@ -45,9 +48,9 @@ Provides command-line procedures for publishing an application package, using ei
 
 [How to Install the Application Virtualization Sequencer](how-to-install-the-application-virtualization-sequencer.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/stand-alone-delivery-scenario-overview.md b/mdop/appv-v4/stand-alone-delivery-scenario-overview.md
index 899574396e..d01a132c43 100644
--- a/mdop/appv-v4/stand-alone-delivery-scenario-overview.md
+++ b/mdop/appv-v4/stand-alone-delivery-scenario-overview.md
@@ -1,12 +1,15 @@
 ---
 title: Stand-Alone Delivery Scenario Overview
 description: Stand-Alone Delivery Scenario Overview
-author: jamiejdt
+author: dansimp
 ms.assetid: b109f309-f3c1-43af-996f-2a9b138dd171
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/streaming-page-learn-more.md b/mdop/appv-v4/streaming-page-learn-more.md
index d0a4723be5..f46ecd595d 100644
--- a/mdop/appv-v4/streaming-page-learn-more.md
+++ b/mdop/appv-v4/streaming-page-learn-more.md
@@ -1,12 +1,15 @@
 ---
 title: Streaming Page
 description: Streaming Page
-author: jamiejdt
+author: dansimp
 ms.assetid: a69a57a0-1bbe-4604-840d-bfa87ec463e1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Use the **Streaming** page to optimize the virtual application package. During t
 **Note**  
 You only have to perform the following tasks if you plan to stream the package across the network.
 
- 
+ 
 
 This page contains the following elements:
 
@@ -34,9 +37,9 @@ Runs all the programs saved in the virtual application package.
 
 [Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/support-for-client-reporting-over-http.md b/mdop/appv-v4/support-for-client-reporting-over-http.md
index b4123e148c..23aa56eca5 100644
--- a/mdop/appv-v4/support-for-client-reporting-over-http.md
+++ b/mdop/appv-v4/support-for-client-reporting-over-http.md
@@ -1,12 +1,15 @@
 ---
 title: Support for Client Reporting over HTTP
 description: Support for Client Reporting over HTTP
-author: jamiejdt
+author: dansimp
 ms.assetid: 4a26ac80-1fb5-4c05-83de-4d06793f7bf2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -31,7 +34,7 @@ The client starts collecting data when it receives a “REPORTING=”TRUE””a
 
 The following schema gives specific details of the package and the application data that is sent to the server.
 
-``` syntax
+```xml
 
 
 
diff --git a/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md b/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md
index 002369e7a1..8e3965c0c2 100644
--- a/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md
+++ b/mdop/appv-v4/sxs-conflict-detected-dialog-box--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: SXS Conflict Detected Dialog Box (App-V 4.6 SP1)
 description: SXS Conflict Detected Dialog Box (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 7cbb67ba-cc11-4f10-b903-4a6af233eacb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/system-error-reportserver.md b/mdop/appv-v4/system-error-reportserver.md
index 1e805f67c3..b94b419d2f 100644
--- a/mdop/appv-v4/system-error-reportserver.md
+++ b/mdop/appv-v4/system-error-reportserver.md
@@ -1,12 +1,15 @@
 ---
 title: System Error Report
 description: System Error Report
-author: jamiejdt
+author: dansimp
 ms.assetid: 4081db2f-92a6-4928-a26b-757048159094
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/system-utilization-reportserver.md b/mdop/appv-v4/system-utilization-reportserver.md
index 2fd1a565ee..5bccc4c9ab 100644
--- a/mdop/appv-v4/system-utilization-reportserver.md
+++ b/mdop/appv-v4/system-utilization-reportserver.md
@@ -1,12 +1,15 @@
 ---
 title: System Utilization Report
 description: System Utilization Report
-author: jamiejdt
+author: dansimp
 ms.assetid: 4d490d15-2d1f-4f2c-99bb-0685447c0672
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -39,7 +42,7 @@ After you run a report and the output is displayed in the Application Virtualiza
 **Note**  
 The App-V server name reported from the clients must be part of the Default Server Group in order for the System Utilization report to show data. For example, if you are using multiple servers with a Network Load Balancer (NLB), you must add the NLB cluster name to the Default Server Group.
 
- 
+ 
 
 ## Related topics
 
@@ -54,9 +57,9 @@ The App-V server name reported from the clients must be part of the Default Serv
 
 [How to Run a Report](how-to-run-a-reportserver.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/target-os-page-learn-more.md b/mdop/appv-v4/target-os-page-learn-more.md
index 5d51c3d8b4..34db517496 100644
--- a/mdop/appv-v4/target-os-page-learn-more.md
+++ b/mdop/appv-v4/target-os-page-learn-more.md
@@ -1,12 +1,15 @@
 ---
 title: Target OS Page
 description: Target OS Page
-author: jamiejdt
+author: dansimp
 ms.assetid: 003fd992-0a7e-494e-9e75-4dd5e0927e15
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Use the **Target OS** page to specify which operating systems in your environmen
 **Note**  
 The operating systems specified on this page can only run this virtual application package if the application you are sequencing supports the operating systems specified. Review the supported operating systems for the application you are sequencing to ensure compatibility.
 
- 
+ 
 
 This page contains the following elements:
 
@@ -34,9 +37,9 @@ Enables the virtual application package to be installed and run only on the sele
 
 [Create New Package Wizard (AppV 4.6 SP1)](create-new-package-wizard---appv-46-sp1-.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md b/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md
index 527ef48d61..f3df4eb7f8 100644
--- a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md
+++ b/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer--app-v-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)
 description: Tasks for the Application Virtualization Sequencer (App-V 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: 58597af9-6a62-4588-ab41-dbf6b7026267
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md b/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md
index 6bccc3ba96..88d5d425f0 100644
--- a/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md
+++ b/mdop/appv-v4/tasks-for-the-application-virtualization-sequencer.md
@@ -1,12 +1,15 @@
 ---
 title: Tasks for the Application Virtualization Sequencer
 description: Tasks for the Application Virtualization Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: 398018f4-297a-440d-b614-23f0ab03e7bd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md b/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md
index 44bf05fc2b..c7285083d5 100644
--- a/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md
+++ b/mdop/appv-v4/troubleshooting-application-virtualization-sequencer-issues.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting Application Virtualization Sequencer Issues
 description: Troubleshooting Application Virtualization Sequencer Issues
-author: jamiejdt
+author: dansimp
 ms.assetid: 2712094b-a0bc-4643-aced-5415535f3fec
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/troubleshooting-certificate-permission-issues.md b/mdop/appv-v4/troubleshooting-certificate-permission-issues.md
index a78bc7639b..9b05d6624b 100644
--- a/mdop/appv-v4/troubleshooting-certificate-permission-issues.md
+++ b/mdop/appv-v4/troubleshooting-certificate-permission-issues.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting Certificate Permission Issues
 description: Troubleshooting Certificate Permission Issues
-author: jamiejdt
+author: dansimp
 ms.assetid: 06b8cbbc-93fd-44aa-af39-2d780792d3c3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md b/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md
index d4f6f401e0..a8b8781132 100644
--- a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md
+++ b/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-client.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting Information for the Application Virtualization Client
 description: Troubleshooting Information for the Application Virtualization Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 260a8dad-847f-4ec0-b7dd-6e6bc52017ed
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md b/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md
index ee3056a9fb..df335aaec7 100644
--- a/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md
+++ b/mdop/appv-v4/troubleshooting-information-for-the-application-virtualization-server.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting Information for the Application Virtualization Server
 description: Troubleshooting Information for the Application Virtualization Server
-author: jamiejdt
+author: dansimp
 ms.assetid: e9d43d9b-84f2-4d1b-bb90-a13740151e0c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md b/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md
index 09784812cd..c832ebe830 100644
--- a/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md
+++ b/mdop/appv-v4/troubleshooting-the-application-virtualization-sequencer.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting the Application Virtualization Sequencer
 description: Troubleshooting the Application Virtualization Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: 12ea8367-0b84-44e1-a885-e0539486556b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/type-of-application-page--learn-more-.md b/mdop/appv-v4/type-of-application-page--learn-more-.md
index 1087abc616..529c2aac7d 100644
--- a/mdop/appv-v4/type-of-application-page--learn-more-.md
+++ b/mdop/appv-v4/type-of-application-page--learn-more-.md
@@ -1,12 +1,15 @@
 ---
 title: Type of Application Page (Learn More)
 description: Type of Application Page (Learn More)
-author: jamiejdt
+author: dansimp
 ms.assetid: d1262d16-7b14-441e-8500-7974bf68d196
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/unload-app.md b/mdop/appv-v4/unload-app.md
index d52bd595cc..e9b1a2c013 100644
--- a/mdop/appv-v4/unload-app.md
+++ b/mdop/appv-v4/unload-app.md
@@ -1,12 +1,15 @@
 ---
 title: UNLOAD APP
 description: UNLOAD APP
-author: jamiejdt
+author: dansimp
 ms.assetid: f0d729ae-8772-498b-be11-1a4b35499c53
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/unload-package.md b/mdop/appv-v4/unload-package.md
index f3bf99f1c4..8c8678569e 100644
--- a/mdop/appv-v4/unload-package.md
+++ b/mdop/appv-v4/unload-package.md
@@ -1,12 +1,15 @@
 ---
 title: UNLOAD PACKAGE
 description: UNLOAD PACKAGE
-author: jamiejdt
+author: dansimp
 ms.assetid: a076eb5a-ce3d-49e4-ac7a-4d4df10e3477
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/unlock-app.md b/mdop/appv-v4/unlock-app.md
index 7668634ac9..91940cb378 100644
--- a/mdop/appv-v4/unlock-app.md
+++ b/mdop/appv-v4/unlock-app.md
@@ -1,12 +1,15 @@
 ---
 title: UNLOCK APP
 description: UNLOCK APP
-author: jamiejdt
+author: dansimp
 ms.assetid: 91fc8ceb-b4f5-4a06-8193-05189f830943
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/unpublish-package.md b/mdop/appv-v4/unpublish-package.md
index 1097aeefc7..34f5a16083 100644
--- a/mdop/appv-v4/unpublish-package.md
+++ b/mdop/appv-v4/unpublish-package.md
@@ -1,12 +1,15 @@
 ---
 title: UNPUBLISH PACKAGE
 description: UNPUBLISH PACKAGE
-author: jamiejdt
+author: dansimp
 ms.assetid: 1651427c-72a5-4701-bb57-71e14a7a3803
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -57,7 +60,7 @@ Enables you to remove the shortcuts and file types for an entire package.
 
 
 
- 
+ 
 
 For version 4.6, the following option has been added.
 
@@ -74,7 +77,7 @@ For version 4.6, the following option has been added.
 
 
 
- 
+ 
 
 **Important**  
 Before you can run the **UNPUBLISH PACKAGE** command, the package must already have been added to the Application Virtualization Client.
@@ -89,16 +92,16 @@ Using **UNPUBLISH PACKAGE** without **GLOBAL** removes the user shortcuts and fi
 
 **UNPUBLISH PACKAGE** always clears all the user settings, shortcuts, and file types regardless of the use of the /CLEAR switch.
 
- 
+ 
 
 ## Related topics
 
 
 [SFTMIME Command Reference](sftmime--command-reference.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md b/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md
index 6d952a7c1c..b5823c5aa0 100644
--- a/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md
+++ b/mdop/appv-v4/user-access-permissions-in-application-virtualization-client.md
@@ -1,12 +1,15 @@
 ---
 title: User Access Permissions in Application Virtualization Client
 description: User Access Permissions in Application Virtualization Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 7459374c-810c-45e3-b205-fdd1f8514f80
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ On the **Permissions** tab on the **Properties** dialog box, accessible by right
 **Note**  
 Before changing users permissions, ensure that any permissions changes are consistent with the organization's guidelines for granting user permissions.
 
- 
+ 
 
 The following table lists and describes the permissions that can be granted to users.
 
@@ -114,16 +117,16 @@ The following table lists and describes the permissions that can be granted to u
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [How to Change User Access Permissions](how-to-change-user-access-permissions.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md b/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md
index 9f9e1977c9..e41d0cb21b 100644
--- a/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md
+++ b/mdop/appv-v4/using-application-virtualization-servers-as-a-package-management-solution.md
@@ -1,12 +1,15 @@
 ---
 title: Using Application Virtualization Servers as a Package Management Solution
 description: Using Application Virtualization Servers as a Package Management Solution
-author: jamiejdt
+author: dansimp
 ms.assetid: 41597355-e7bb-45e2-b300-7b1724419975
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ If you do not have an existing ESD system to deploy your Application Virtualizat
 **Note**  
 Access to the applications is controlled by means of Security Groups in Active Directory Domain Services, so you will need to plan a process to set up a security group for each virtualized application and for managing which users are added to each group. The Application Virtualization Management Server administrator configures the server to use these Active Directory groups, and the server then automatically controls access to the packages based on Active Directory group membership.
 
- 
+ 
 
 ## In This Section
 
@@ -40,9 +43,9 @@ Describes available options for using Application Virtualization Streaming Serve
 
 [Planning for Application Virtualization System Deployment](planning-for-application-virtualization-system-deployment.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md b/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md
index 953ee3e0bf..7106bf01e0 100644
--- a/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md
+++ b/mdop/appv-v4/using-electronic-software-distribution-as-a-package-management-solution.md
@@ -1,12 +1,15 @@
 ---
 title: Using Electronic Software Distribution as a Package Management Solution
 description: Using Electronic Software Distribution as a Package Management Solution
-author: jamiejdt
+author: dansimp
 ms.assetid: 7d96ea70-3e7e-49fa-89cc-586804a10657
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,7 +19,7 @@ ms.date: 06/16/2016
 
 In Application Virtualization, after you have sequenced and tested a package, you need to deploy the virtual application package to the target computers. To accomplish this, you will need to determine where to put the package content and how to deliver it to the end user computers. An efficient, effective electronic software distribution–based deployment plan will help you avoid the situation where large numbers of end users computers need to retrieve the package content over slow network connections.
 
-If you currently have an electronic software distribution (ESD) system in daily operation, you can use it to handle all necessary management tasks in Application Virtualization. This means that you can effectively use your existing infrastructure to the best advantage, without the need to add new servers and application software or incur the additional administrative overhead that these would require. Ideally, if you have System Center Configuration Manager 2007 R2 deployed and operational, you will find that Configuration Manager has built-in capability for performing the Application Virtualization management tasks.
+If you currently have an electronic software distribution (ESD) system in daily operation, you can use it to handle all necessary management tasks in Application Virtualization. This means that you can effectively use your existing infrastructure to the best advantage, without the need to add new servers and application software or incur the additional administrative overhead that these would require. Ideally, if you have Microsoft Endpoint Configuration Manager deployed and operational, you will find that Configuration Manager has built-in capability for performing the Application Virtualization management tasks.
 
 For in-depth information about performing an ESD-based deployment, [Electronic Software Distribution-Based Scenario](electronic-software-distribution-based-scenario.md).
 
diff --git a/mdop/appv-v4/verify-applications-page--package-accelerators-.md b/mdop/appv-v4/verify-applications-page--package-accelerators-.md
index 804e90f8de..fa38068d5e 100644
--- a/mdop/appv-v4/verify-applications-page--package-accelerators-.md
+++ b/mdop/appv-v4/verify-applications-page--package-accelerators-.md
@@ -1,12 +1,15 @@
 ---
 title: Verify Applications Page (Package Accelerators)
 description: Verify Applications Page (Package Accelerators)
-author: jamiejdt
+author: dansimp
 ms.assetid: e58a37db-d042-453f-aa0d-2f324600a35b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/virtual-application-package-additional-components.md b/mdop/appv-v4/virtual-application-package-additional-components.md
index 759bd861cf..8fe48620bc 100644
--- a/mdop/appv-v4/virtual-application-package-additional-components.md
+++ b/mdop/appv-v4/virtual-application-package-additional-components.md
@@ -1,12 +1,15 @@
 ---
 title: Virtual Application Package Additional Components
 description: Virtual Application Package Additional Components
-author: jamiejdt
+author: dansimp
 ms.assetid: 476b0f40-ebd6-4296-92fa-61fa9495c03c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/appv-v4/virtual-file-system-tab-keep.md b/mdop/appv-v4/virtual-file-system-tab-keep.md
index 30fb804f15..290e0a1d2a 100644
--- a/mdop/appv-v4/virtual-file-system-tab-keep.md
+++ b/mdop/appv-v4/virtual-file-system-tab-keep.md
@@ -1,12 +1,15 @@
 ---
 title: Virtual File System Tab
 description: Virtual File System Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 9d084e2a-720d-4a25-9cd5-d0d70868b413
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/virtual-registry-tab-keep.md b/mdop/appv-v4/virtual-registry-tab-keep.md
index fb51eca7dc..cd9e9a01da 100644
--- a/mdop/appv-v4/virtual-registry-tab-keep.md
+++ b/mdop/appv-v4/virtual-registry-tab-keep.md
@@ -1,12 +1,15 @@
 ---
 title: Virtual Registry Tab
 description: Virtual Registry Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 25833383-24c4-40a1-b34c-73b2bd3f11e1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/virtual-services-tab-keep.md b/mdop/appv-v4/virtual-services-tab-keep.md
index 0f572ad4cc..360df6d0a5 100644
--- a/mdop/appv-v4/virtual-services-tab-keep.md
+++ b/mdop/appv-v4/virtual-services-tab-keep.md
@@ -1,12 +1,15 @@
 ---
 title: Virtual Services Tab
 description: Virtual Services Tab
-author: jamiejdt
+author: dansimp
 ms.assetid: 9fc4679d-ccb5-4df7-99de-dd7d3a367ecc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v4/wizard-pages--appv-46-sp1-.md b/mdop/appv-v4/wizard-pages--appv-46-sp1-.md
index ee5b03c3a0..a0a4219295 100644
--- a/mdop/appv-v4/wizard-pages--appv-46-sp1-.md
+++ b/mdop/appv-v4/wizard-pages--appv-46-sp1-.md
@@ -1,12 +1,15 @@
 ---
 title: Wizard Pages (AppV 4.6 SP1)
 description: Wizard Pages (AppV 4.6 SP1)
-author: jamiejdt
+author: dansimp
 ms.assetid: dadab8cf-fe6d-4cff-8f6c-e9676f244872
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/appv-v5/TOC.md b/mdop/appv-v5/TOC.md
index db147e8a98..6f2058280a 100644
--- a/mdop/appv-v5/TOC.md
+++ b/mdop/appv-v5/TOC.md
@@ -62,7 +62,7 @@
 ##### [How to Create a Custom Configuration File by Using the App-V 5.1 Management Console](how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md)
 ##### [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console 5.1](how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md)
 ##### [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console 5.1](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md)
-##### [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console  5.1](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md)
+##### [Configure Applications and Default Virtual Application Extensions in Management Console](configure-applications-and-default-virtual-application-extensions-in-management-console.md)
 #### [Managing Connection Groups 5.1](managing-connection-groups51.md)
 ##### [About the Connection Group Virtual Environment 5.1](about-the-connection-group-virtual-environment51.md)
 ##### [About the Connection Group File 5.1](about-the-connection-group-file51.md)
diff --git a/mdop/appv-v5/about-app-v-50-dynamic-configuration.md b/mdop/appv-v5/about-app-v-50-dynamic-configuration.md
index 87c3a92fd0..8a54d8a0da 100644
--- a/mdop/appv-v5/about-app-v-50-dynamic-configuration.md
+++ b/mdop/appv-v5/about-app-v-50-dynamic-configuration.md
@@ -1,8 +1,11 @@
 ---
 title: About App-V 5.0 Dynamic Configuration
 description: About App-V 5.0 Dynamic Configuration
-author: jamiejdt
+author: dansimp
 ms.assetid: 88afaca1-68c5-45c4-a074-9371c56b5804
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -32,7 +35,7 @@ The previous .xml files specify package settings and allow for packages to be cu
 **Note**  
 The following information can only be used to modify sequencer generated configuration files to customize packages to meet specific user or group requirements.
 
- 
+ 
 
 ### Dynamic Configuration file contents
 
@@ -55,7 +58,7 @@ All of the additions, deletions, and updates in the configuration files need to
 
 
 
- 
+ 
 
 The previous table represents how the files will be read. The first entry represents what will be read last, therefore, its content takes precedence. Therefore, all packages inherently contain and provide default settings from the package manifest. If a deployment configuration .xml file with customized settings is applied, it will override the package manifest defaults. If a user configuration .xml file with customized settings is applied prior to that, it will override both the deployment configuration and the package manifest defaults.
 
@@ -99,477 +102,477 @@ The structure of the App-V 5.0 Dynamic Configuration file is explained in the fo
 
 **Header** - the header of a dynamic user configuration file is as follows:
 
-<?xml version="1.0" encoding="utf-8"?><UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="http://schemas.microsoft.com/appv/2010/userconfiguration">
+<?xml version="1.0" encoding="utf-8"?><UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns=";
 
 The **PackageId** is the same value as exists in the Manifest file.
 
 **Body** - the body of the Dynamic User Configuration file can include all the app extension points that are defined in the Manifest file, as well as information to configure virtual applications. There are four subsections allowed in the body:
 
-1.  **Applications** - All app-extensions that are contained in the Manifest file within a package are assigned with an Application ID, which is also defined in the manifest file. This allows you to enable or disable all the extensions for a given application within a package. The **Application ID** must exist in the Manifest file or it will be ignored.
+1. **Applications** - All app-extensions that are contained in the Manifest file within a package are assigned with an Application ID, which is also defined in the manifest file. This allows you to enable or disable all the extensions for a given application within a package. The **Application ID** must exist in the Manifest file or it will be ignored.
 
-    <UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="http://schemas.microsoft.com/appv/2010/userconfiguration">
+   <UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns=";
 
-    <Applications>
+   <Applications>
 
-    <!-- No new application can be defined in policy. AppV Client will ignore any application ID that is not also in the Manifest file -->
+   <!-- No new application can be defined in policy. AppV Client will ignore any application ID that is not also in the Manifest file -->
 
-    <Application Id="{a56fa627-c35f-4a01-9e79-7d36aed8225a}" Enabled="false">
+   <Application Id="{a56fa627-c35f-4a01-9e79-7d36aed8225a}" Enabled="false">
 
-    </Application>
+   </Application>
 
-    </Applications>
+   </Applications>
 
-    …
+   …
 
-    </UserConfiguration>
+   </UserConfiguration>
 
-2.  **Subsystems** - AppExtensions and other subsystems are arranged as subnodes under the <Subsystems>:
+2. **Subsystems** - AppExtensions and other subsystems are arranged as subnodes under the <Subsystems>:
 
-    <UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="http://schemas.microsoft.com/appv/2010/userconfiguration">
+   <UserConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns=";
 
-    <Subsystems>
+   <Subsystems>
 
-    ..
+   ..
 
-    </Subsystems>
+   </Subsystems>
 
-    ..
+   ..
 
-    </UserConfiguration>
+   </UserConfiguration>
 
-    Each subsystem can be enabled/disabled using the “**Enabled**” attribute. Below are the various subsystems and usage samples.
+   Each subsystem can be enabled/disabled using the “**Enabled**” attribute. Below are the various subsystems and usage samples.
 
-    **Extensions:**
+   **Extensions:**
 
-    Some subsystems (Extension Subsystems) control Extensions. Those subsystems are:- shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients and COM
+   Some subsystems (Extension Subsystems) control Extensions. Those subsystems are:- shortcuts, File-Type associations, URL Protocols, AppPaths, Software Clients and COM
 
-    Extension Subsystems can be enabled and disabled independently of the content.  Thus if Shortcuts are enabled, The client will use the shortcuts contained within the manifest by default. Each Extension Subsystem can contain an <Extensions> node. If this child element is present, the client will ignore the content in the Manifest file for that subsystem and only use the content in the configuration file.
+   Extension Subsystems can be enabled and disabled independently of the content.  Thus if Shortcuts are enabled, The client will use the shortcuts contained within the manifest by default. Each Extension Subsystem can contain an <Extensions> node. If this child element is present, the client will ignore the content in the Manifest file for that subsystem and only use the content in the configuration file.
 
-    Example using the shortcuts subsystem:
+   Example using the shortcuts subsystem:
 
-    1.  If the user defined this in either the dynamic or deployment config file:
+   1.  If the user defined this in either the dynamic or deployment config file:
 
-                                     **<Shortcuts  Enabled="true">**
+                                    **<Shortcuts  Enabled="true">**
 
-                                                 **<Extensions>**
+                                                **<Extensions>**
 
-                                                  ...
+                                                 ...
 
-                                                 **</Extensions>**
+                                                **</Extensions>**
 
-                                     **</Shortcuts>**
+                                    **</Shortcuts>**
 
-                          Content in the manifest will be ignored.   
+                         Content in the manifest will be ignored.   
 
-    2.  If the user defined only the following:
+   2.  If the user defined only the following:
 
-                                    **<Shortcuts  Enabled="true"/>**
+                                   **<Shortcuts  Enabled="true"/>**
 
-                          Then the content in the Manifest will be integrated during publishing.
+                         Then the content in the Manifest will be integrated during publishing.
 
-    3.  If the user defines the following
+   3.  If the user defines the following
 
-                                   **<Shortcuts  Enabled="true">**
+                                  **<Shortcuts  Enabled="true">**
 
-                                                 **<Extensions/>**
+                                                **<Extensions/>**
 
-                                     **</Shortcuts>**
+                                    **</Shortcuts>**
 
-    Then all the shortcuts within the manifest will still be ignored. There will be no shortcuts integrated.
+   Then all the shortcuts within the manifest will still be ignored. There will be no shortcuts integrated.
 
-    The supported Extension Subsystems are:
+   The supported Extension Subsystems are:
 
-    **Shortcuts:** This controls shortcuts that will be integrated into the local system. Below is a sample with 2 shortcuts:
+   **Shortcuts:** This controls shortcuts that will be integrated into the local system. Below is a sample with 2 shortcuts:
 
-    <Subsystems>
+   <Subsystems>
 
-    <Shortcuts Enabled="true">
+   <Shortcuts Enabled="true">
 
-      <Extensions>
+     <Extensions>
 
-        <Extension Category="AppV.Shortcut">
+       <Extension Category="AppV.Shortcut">
 
-          <Shortcut>
+         <Shortcut>
 
-            <File>\[{Common Programs}\]\\Microsoft Contoso\\Microsoft ContosoApp Filler 2010.lnk</File>
+           <File>\[{Common Programs}\]\\Microsoft Contoso\\Microsoft ContosoApp Filler 2010.lnk</File>
 
-            <Target>\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE</Target>
+           <Target>\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE</Target>
 
-            <Icon>\[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\inficon.exe</Icon>
+           <Icon>\[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\inficon.exe</Icon>
 
-            <Arguments />
+           <Arguments />
 
-            <WorkingDirectory />
+           <WorkingDirectory />
 
-            <AppUserModelId>ContosoApp.Filler.3</AppUserModelId>
+           <AppUserModelId>ContosoApp.Filler.3</AppUserModelId>
 
-            <Description>Fill out dynamic forms to gather and reuse information throughout the organization using Microsoft ContosoApp.</Description>
+           <Description>Fill out dynamic forms to gather and reuse information throughout the organization using Microsoft ContosoApp.</Description>
 
-            <Hotkey>0</Hotkey>
+           <Hotkey>0</Hotkey>
 
-            <ShowCommand>1</ShowCommand>
+           <ShowCommand>1</ShowCommand>
 
-            <ApplicationId>\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE</ApplicationId>
+           <ApplicationId>\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE</ApplicationId>
 
-          </Shortcut>
+         </Shortcut>
 
-      </Extension>
+     </Extension>
 
-      <Extension Category="AppV.Shortcut">
+     <Extension Category="AppV.Shortcut">
 
-        <Shortcut>
+       <Shortcut>
 
-          <File>\[{AppData}\]\\Microsoft\\Contoso\\Recent\\Templates.LNK</File>
+         <File>\[{AppData}\]\\Microsoft\\Contoso\\Recent\\Templates.LNK</File>
 
-          <Target>\[{AppData}\]\\Microsoft\\Templates</Target>
+         <Target>\[{AppData}\]\\Microsoft\\Templates</Target>
 
-          <Icon />
+         <Icon />
 
-          <Arguments />
+         <Arguments />
 
-          <WorkingDirectory />
+         <WorkingDirectory />
 
-          <AppUserModelId />
+         <AppUserModelId />
 
-          <Description />
+         <Description />
 
-          <Hotkey>0</Hotkey>
+         <Hotkey>0</Hotkey>
 
-          <ShowCommand>1</ShowCommand>
+         <ShowCommand>1</ShowCommand>
 
-          <!-- Note the ApplicationId is optional -->
+         <!-- Note the ApplicationId is optional -->
 
-        </Shortcut>
+       </Shortcut>
 
-      </Extension>
-
-     </Extensions>
-
-    </Shortcuts>
-
-    **File-Type Associations:** Associates File-types with programs to open by default as well as setup the context menu. (MIME types can also be setup using this susbsystem). Sample File-type Association is below:
-
-    <FileTypeAssociations Enabled="true">
-
-    <Extensions>
-
-      <Extension Category="AppV.FileTypeAssociation">
-
-        <FileTypeAssociation>
-
-          <FileExtension MimeAssociation="true">
-
-          <Name>.docm</Name>
-
-          <ProgId>contosowordpad.DocumentMacroEnabled.12</ProgId>
-
-          <PerceivedType>document</PerceivedType>
-
-          <ContentType>application/vnd.ms-contosowordpad.document.macroEnabled.12</ContentType>
-
-          <OpenWithList>
-
-            <ApplicationName>wincontosowordpad.exe</ApplicationName>
-
-          </OpenWithList>
-
-         <OpenWithProgIds>
-
-            <ProgId>contosowordpad.8</ProgId>
-
-          </OpenWithProgIds>
-
-          <ShellNew>
-
-            <Command />
-
-            <DataBinary />
-
-            <DataText />
-
-            <FileName />
-
-            <NullFile>true</NullFile>
-
-            <ItemName />
-
-            <IconPath />
-
-            <MenuText />
-
-            <Handler />
-
-          </ShellNew>
-
-        </FileExtension>
-
-        <ProgId>
-
-           <Name>contosowordpad.DocumentMacroEnabled.12</Name>
-
-            <DefaultIcon>\[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\contosowordpadicon.exe,15</DefaultIcon>
-
-            <Description>Blah Blah Blah</Description>
-
-            <FriendlyTypeName>\[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,9182</FriendlyTypeName>
-
-            <InfoTip>\[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,1424</InfoTip>
-
-            <EditFlags>0</EditFlags>
-
-            <ShellCommands>
-
-              <DefaultCommand>Open</DefaultCommand>
-
-              <ShellCommand>
-
-                 <ApplicationId>{e56fa627-c35f-4a01-9e79-7d36aed8225a}</ApplicationId>
-
-                 <Name>Edit</Name>
-
-                 <FriendlyName>&Edit</FriendlyName>
-
-                 <CommandLine>"\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /vu "%1"</CommandLine>
-
-              </ShellCommand>
-
-              </ShellCommand>
-
-                <ApplicationId>{e56fa627-c35f-4a01-9e79-7d36aed8225a}</ApplicationId>
-
-                <Name>Open</Name>
-
-                <FriendlyName>&Open</FriendlyName>
-
-                <CommandLine>"\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /n "%1"</CommandLine>
-
-                <DropTargetClassId />
-
-                <DdeExec>
-
-                  <Application>mscontosowordpad</Application>
-
-                  <Topic>ShellSystem</Topic>
-
-                  <IfExec>\[SHELLNOOP\]</IfExec>
-
-                  <DdeCommand>\[SetForeground\]\[ShellNewDatabase "%1"\]</DdeCommand>
-
-                </DdeExec>
-
-              </ShellCommand>
-
-            </ShellCommands>
-
-          </ProgId>
-
-         </FileTypeAssociation>
-
-       </Extension>
-
-      </Extensions>
-
-      </FileTypeAssociations>
-
-    **URL Protocols**: This controls the URL Protocols that are integrated into the local registry of the client machine e.g. “mailto:”.
-
-    <URLProtocols Enabled="true">
-
-    <Extensions>
-
-    <Extension Category="AppV.URLProtocol">
-
-    <URLProtocol>
-
-      <Name>mailto</Name>
-
-      <ApplicationURLProtocol>
-
-      <DefaultIcon>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE,-9403</DefaultIcon>
-
-      <EditFlags>2</EditFlags>
-
-      <Description />
-
-      <AppUserModelId />
-
-      <FriendlyTypeName />
-
-      <InfoTip />
-
-    <SourceFilter />
-
-      <ShellFolder />
-
-      <WebNavigableCLSID />
-
-      <ExplorerFlags>2</ExplorerFlags>
-
-      <CLSID />
-
-      <ShellCommands>
-
-      <DefaultCommand>open</DefaultCommand>
-
-      <ShellCommand>
-
-      <ApplicationId>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationId>
-
-      <Name>open</Name>
-
-      <CommandLine>\[{ProgramFilesX86}\\Microsoft Contoso\\Contoso\\contosomail.EXE" -c OEP.Note /m "%1"</CommandLine>
-
-      <DropTargetClassId />
-
-      <FriendlyName />
-
-      <Extended>0</Extended>
-
-      <LegacyDisable>0</LegacyDisable>
-
-      <SuppressionPolicy>2</SuppressionPolicy>
-
-       <DdeExec>
-
-      <NoActivateHandler />
-
-      <Application>contosomail</Application>
-
-      <Topic>ShellSystem</Topic>
-
-      <IfExec>\[SHELLNOOP\]</IfExec>
-
-      <DdeCommand>\[SetForeground\]\[ShellNewDatabase "%1"\]</DdeCommand>
-
-      </DdeExec>
-
-      </ShellCommand>
-
-      </ShellCommands>
-
-      </ApplicationURLProtocol>
-
-      </URLProtocol>
-
-      </Extension>
-
-      </Extension>
-
-      </URLProtocols>
-
-    **Software Clients**: Allows the app to register as an Email client, news reader, media player and makes the app visible in the Set Program Access and Computer Defaults UI. In most cases you should only need to enable and disable it. There is also a control to enable and disable the email client specifically if you want the other clients still enabled except for that client.
-
-    <SoftwareClients Enabled="true">
-
-      <ClientConfiguration EmailEnabled="false" />
-
-    </SoftwareClients>
-
-    AppPaths:- If an application for example contoso.exe is registered with an apppath name of “myapp”, it allows you type “myapp” under the run menu and it will open contoso.exe.
-
-    <AppPaths Enabled="true">
-
-    <Extensions>
-
-    <Extension Category="AppV.AppPath">
-
-    <AppPath>
-
-      <ApplicationId>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationId>
-
-      <Name>contosomail.exe</Name>
-
-      <ApplicationPath>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationPath>
-
-      <PATHEnvironmentVariablePrefix />
-
-      <CanAcceptUrl>false</CanAcceptUrl>
-
-      <SaveUrl />
-
-    </AppPath>
-
-    </Extension>
+     </Extension>
 
     </Extensions>
 
-    </AppPaths>
+   </Shortcuts>
 
-    **COM**: Allows an Application register Local COM servers. Mode can be Integration, Isolated or Off. When Isol.
+   **File-Type Associations:** Associates File-types with programs to open by default as well as setup the context menu. (MIME types can also be setup using this susbsystem). Sample File-type Association is below:
 
-    <COM Mode="Isolated"/>
+   <FileTypeAssociations Enabled="true">
 
-    **Other Settings**:
+   <Extensions>
 
-    In addition to Extensions, other subsystems can be enabled/disabled and edited:
+     <Extension Category="AppV.FileTypeAssociation">
 
-    **Virtual Kernel Objects**:
+       <FileTypeAssociation>
 
-    <Objects Enabled="false" />
+         <FileExtension MimeAssociation="true">
 
-    **Virtual Registry**: Used if you want to set a registry in the Virtual Registry within HKCU
+         <Name>.docm</Name>
 
-    <Registry Enabled="true">
+         <ProgId>contosowordpad.DocumentMacroEnabled.12</ProgId>
 
-    <Include>
+         <PerceivedType>document</PerceivedType>
 
-    <Key Path="\\REGISTRY\\USER\\\[{AppVCurrentUserSID}\]\\Software\\ABC">
+         <ContentType>application/vnd.ms-contosowordpad.document.macroEnabled.12</ContentType>
 
-    <Value Type="REG\_SZ" Name="Bar" Data="NewValue" />
+         <OpenWithList>
 
-     </Key>
+           <ApplicationName>wincontosowordpad.exe</ApplicationName>
 
-      <Key Path="\\REGISTRY\\USER\\\[{AppVCurrentUserSID}\]\\Software\\EmptyKey" />
+         </OpenWithList>
 
-     </Include>
+        <OpenWithProgIds>
 
-    <Delete>
+           <ProgId>contosowordpad.8</ProgId>
 
-      </Registry>
+         </OpenWithProgIds>
 
-    **Virtual File System**
+         <ShellNew>
 
-          <FileSystem Enabled="true" />
+           <Command />
 
-    **Virtual Fonts**
+           <DataBinary />
 
-          <Fonts Enabled="false" />
+           <DataText />
 
-    **Virtual Environment Variables**
+           <FileName />
 
-    <EnvironmentVariables Enabled="true">
+           <NullFile>true</NullFile>
 
-    <Include>
+           <ItemName />
 
-           <Variable Name="UserPath" Value="%path%;%UserProfile%" />
+           <IconPath />
 
-           <Variable Name="UserLib" Value="%UserProfile%\\ABC" />
+           <MenuText />
 
-           </Include>
+           <Handler />
 
-          <Delete>
+         </ShellNew>
 
-           <Variable Name="lib" />
+       </FileExtension>
 
-            </Delete>
+       <ProgId>
 
-            </EnvironmentVariables>
+          <Name>contosowordpad.DocumentMacroEnabled.12</Name>
 
-    **Virtual services**
+           <DefaultIcon>\[{Windows}\]\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\contosowordpadicon.exe,15</DefaultIcon>
 
-          <Services Enabled="false" />
+           <Description>Blah Blah Blah</Description>
 
-3.  **UserScripts** – Scripts can be used to setup or alter the virtual environment as well as execute scripts at time of deployment or removal, before an application executes, or they can be used to “clean up” the environment after the application terminates. Please reference a sample User configuration file that is output by the sequencer to see a sample script. The Scripts section below provides more information on the various triggers that can be used.
+           <FriendlyTypeName>\[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,9182</FriendlyTypeName>
 
-4.  **ManagingAuthority** – Can be used when 2 versions of your package are co-existing on the same machine, one deployed to App-V 4.6 and the other deployed on App-V 5.0. To Allow App-V vNext to take over App-V 4.6 extension points for the named package enter the following in the UserConfig file (where PackageName is the Package GUID in App-V 4.6:
+           <InfoTip>\[{FOLDERID\_ProgramFilesX86}\]\\Microsoft Contoso 14\\res.dll,1424</InfoTip>
 
-    <ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName="032630c0-b8e2-417c-acef-76fc5297fe81" />
+           <EditFlags>0</EditFlags>
+
+           <ShellCommands>
+
+             <DefaultCommand>Open</DefaultCommand>
+
+             <ShellCommand>
+
+                <ApplicationId>{e56fa627-c35f-4a01-9e79-7d36aed8225a}</ApplicationId>
+
+                <Name>Edit</Name>
+
+                <FriendlyName>&Edit</FriendlyName>
+
+                <CommandLine>"\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /vu "%1"</CommandLine>
+
+             </ShellCommand>
+
+             </ShellCommand>
+
+               <ApplicationId>{e56fa627-c35f-4a01-9e79-7d36aed8225a}</ApplicationId>
+
+               <Name>Open</Name>
+
+               <FriendlyName>&Open</FriendlyName>
+
+               <CommandLine>"\[{PackageRoot}\]\\Contoso\\WINcontosowordpad.EXE" /n "%1"</CommandLine>
+
+               <DropTargetClassId />
+
+               <DdeExec>
+
+                 <Application>mscontosowordpad</Application>
+
+                 <Topic>ShellSystem</Topic>
+
+                 <IfExec>\[SHELLNOOP\]</IfExec>
+
+                 <DdeCommand>\[SetForeground\]\[ShellNewDatabase "%1"\]</DdeCommand>
+
+               </DdeExec>
+
+             </ShellCommand>
+
+           </ShellCommands>
+
+         </ProgId>
+
+        </FileTypeAssociation>
+
+      </Extension>
+
+     </Extensions>
+
+     </FileTypeAssociations>
+
+   **URL Protocols**: This controls the URL Protocols that are integrated into the local registry of the client machine e.g. “mailto:”.
+
+   <URLProtocols Enabled="true">
+
+   <Extensions>
+
+   <Extension Category="AppV.URLProtocol">
+
+   <URLProtocol>
+
+     <Name>mailto</Name>
+
+     <ApplicationURLProtocol>
+
+     <DefaultIcon>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE,-9403</DefaultIcon>
+
+     <EditFlags>2</EditFlags>
+
+     <Description />
+
+     <AppUserModelId />
+
+     <FriendlyTypeName />
+
+     <InfoTip />
+
+   <SourceFilter />
+
+     <ShellFolder />
+
+     <WebNavigableCLSID />
+
+     <ExplorerFlags>2</ExplorerFlags>
+
+     <CLSID />
+
+     <ShellCommands>
+
+     <DefaultCommand>open</DefaultCommand>
+
+     <ShellCommand>
+
+     <ApplicationId>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationId>
+
+     <Name>open</Name>
+
+     <CommandLine>\[{ProgramFilesX86}\\Microsoft Contoso\\Contoso\\contosomail.EXE" -c OEP.Note /m "%1"</CommandLine>
+
+     <DropTargetClassId />
+
+     <FriendlyName />
+
+     <Extended>0</Extended>
+
+     <LegacyDisable>0</LegacyDisable>
+
+     <SuppressionPolicy>2</SuppressionPolicy>
+
+      <DdeExec>
+
+     <NoActivateHandler />
+
+     <Application>contosomail</Application>
+
+     <Topic>ShellSystem</Topic>
+
+     <IfExec>\[SHELLNOOP\]</IfExec>
+
+     <DdeCommand>\[SetForeground\]\[ShellNewDatabase "%1"\]</DdeCommand>
+
+     </DdeExec>
+
+     </ShellCommand>
+
+     </ShellCommands>
+
+     </ApplicationURLProtocol>
+
+     </URLProtocol>
+
+     </Extension>
+
+     </Extension>
+
+     </URLProtocols>
+
+   **Software Clients**: Allows the app to register as an Email client, news reader, media player and makes the app visible in the Set Program Access and Computer Defaults UI. In most cases you should only need to enable and disable it. There is also a control to enable and disable the email client specifically if you want the other clients still enabled except for that client.
+
+   <SoftwareClients Enabled="true">
+
+     <ClientConfiguration EmailEnabled="false" />
+
+   </SoftwareClients>
+
+   AppPaths:- If an application for example contoso.exe is registered with an apppath name of “myapp”, it allows you type “myapp” under the run menu and it will open contoso.exe.
+
+   <AppPaths Enabled="true">
+
+   <Extensions>
+
+   <Extension Category="AppV.AppPath">
+
+   <AppPath>
+
+     <ApplicationId>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationId>
+
+     <Name>contosomail.exe</Name>
+
+     <ApplicationPath>\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE</ApplicationPath>
+
+     <PATHEnvironmentVariablePrefix />
+
+     <CanAcceptUrl>false</CanAcceptUrl>
+
+     <SaveUrl />
+
+   </AppPath>
+
+   </Extension>
+
+   </Extensions>
+
+   </AppPaths>
+
+   **COM**: Allows an Application register Local COM servers. Mode can be Integration, Isolated or Off. When Isol.
+
+   <COM Mode="Isolated"/>
+
+   **Other Settings**:
+
+   In addition to Extensions, other subsystems can be enabled/disabled and edited:
+
+   **Virtual Kernel Objects**:
+
+   <Objects Enabled="false" />
+
+   **Virtual Registry**: Used if you want to set a registry in the Virtual Registry within HKCU
+
+   <Registry Enabled="true">
+
+   <Include>
+
+   <Key Path="\\REGISTRY\\USER\\\[{AppVCurrentUserSID}\]\\Software\\ABC">
+
+   <Value Type="REG\_SZ" Name="Bar" Data="NewValue" />
+
+    </Key>
+
+     <Key Path="\\REGISTRY\\USER\\\[{AppVCurrentUserSID}\]\\Software\\EmptyKey" />
+
+    </Include>
+
+   <Delete>
+
+     </Registry>
+
+   **Virtual File System**
+
+         <FileSystem Enabled="true" />
+
+   **Virtual Fonts**
+
+         <Fonts Enabled="false" />
+
+   **Virtual Environment Variables**
+
+   <EnvironmentVariables Enabled="true">
+
+   <Include>
+
+          <Variable Name="UserPath" Value="%path%;%UserProfile%" />
+
+          <Variable Name="UserLib" Value="%UserProfile%\\ABC" />
+
+          </Include>
+
+         <Delete>
+
+          <Variable Name="lib" />
+
+           </Delete>
+
+           </EnvironmentVariables>
+
+   **Virtual services**
+
+         <Services Enabled="false" />
+
+3. **UserScripts** – Scripts can be used to setup or alter the virtual environment as well as execute scripts at time of deployment or removal, before an application executes, or they can be used to “clean up” the environment after the application terminates. Please reference a sample User configuration file that is output by the sequencer to see a sample script. The Scripts section below provides more information on the various triggers that can be used.
+
+4. **ManagingAuthority** – Can be used when 2 versions of your package are co-existing on the same machine, one deployed to App-V 4.6 and the other deployed on App-V 5.0. To Allow App-V vNext to take over App-V 4.6 extension points for the named package enter the following in the UserConfig file (where PackageName is the Package GUID in App-V 4.6:
+
+   <ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName="032630c0-b8e2-417c-acef-76fc5297fe81" />
 
 ### Dynamic Deployment Configuration file
 
 **Header** - The header of a Deployment Configuration file is as follows:
 
-<?xml version="1.0" encoding="utf-8"?><DeploymentConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="http://schemas.microsoft.com/appv/2010/deploymentconfiguration">
+<?xml version="1.0" encoding="utf-8"?><DeploymentConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns=";
 
 The **PackageId** is the same value as exists in the manifest file.
 
@@ -579,11 +582,11 @@ The **PackageId** is the same value as exists in the manifest file.
 
 -   Machine Configuration section–contains information that can be configured only for an entire machine, not for a specific user on the machine. For example, HKEY\_LOCAL\_MACHINE registry keys in the VFS.
 
-<DeploymentConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns="http://schemas.microsoft.com/appv/2010/deploymentconfiguration">
+<DeploymentConfiguration **PackageId**="1f8488bf-2257-46b4-b27f-09c9dbaae707" DisplayName="Reserved" xmlns=";
 
 <UserConfiguration>
 
-  ..
+  ..
 
 </UserConfiguration>
 
@@ -607,11 +610,11 @@ Machine Configuration - the Machine configuration section of the Deployment Conf
 
     <MachineConfiguration>
 
-      <Subsystems>
+      <Subsystems>
 
-      ..
+      ..
 
-      </Subsystems>
+      </Subsystems>
 
     ..
 
@@ -627,65 +630,65 @@ Machine Configuration - the Machine configuration section of the Deployment Conf
 
     <ApplicationCapabilities Enabled="true">
 
-      <Extensions>
+      <Extensions>
 
-       <Extension Category="AppV.ApplicationCapabilities">
+       <Extension Category="AppV.ApplicationCapabilities">
 
-        <ApplicationCapabilities>
+        <ApplicationCapabilities>
 
-         <ApplicationId>\[{PackageRoot}\]\\LitView\\LitViewBrowser.exe</ApplicationId>
+         <ApplicationId>\[{PackageRoot}\]\\LitView\\LitViewBrowser.exe</ApplicationId>
 
-         <Reference>
+         <Reference>
 
-          <Name>LitView Browser</Name>
+          <Name>LitView Browser</Name>
 
-          <Path>SOFTWARE\\LitView\\Browser\\Capabilities</Path>
+          <Path>SOFTWARE\\LitView\\Browser\\Capabilities</Path>
 
-         </Reference>
+         </Reference>
 
-       <CapabilityGroup>
+       <CapabilityGroup>
 
-        <Capabilities>
+        <Capabilities>
 
-         <Name>@\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12345</Name>
+         <Name>@\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12345</Name>
 
-         <Description>@\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12346</Description>
+         <Description>@\[{ProgramFilesX86}\]\\LitView\\LitViewBrowser.exe,-12346</Description>
 
-         <Hidden>0</Hidden>
+         <Hidden>0</Hidden>
 
-         <EMailSoftwareClient>Lit View E-Mail Client</EMailSoftwareClient>
+         <EMailSoftwareClient>Lit View E-Mail Client</EMailSoftwareClient>
 
-         <FileAssociationList>
+         <FileAssociationList>
 
-          <FileAssociation Extension=".htm" ProgID="LitViewHTML" />
+          <FileAssociation Extension=".htm" ProgID="LitViewHTML" />
 
-          <FileAssociation Extension=".html" ProgID="LitViewHTML" />
+          <FileAssociation Extension=".html" ProgID="LitViewHTML" />
 
-          <FileAssociation Extension=".shtml" ProgID="LitViewHTML" />
+          <FileAssociation Extension=".shtml" ProgID="LitViewHTML" />
 
-         </FileAssociationList>
+         </FileAssociationList>
 
-         <MIMEAssociationList>
+         <MIMEAssociationList>
 
-          <MIMEAssociation Type="audio/mp3" ProgID="LitViewHTML" />
+          <MIMEAssociation Type="audio/mp3" ProgID="LitViewHTML" />
 
-          <MIMEAssociation Type="audio/mpeg" ProgID="LitViewHTML" />
+          <MIMEAssociation Type="audio/mpeg" ProgID="LitViewHTML" />
 
-         </MIMEAssociationList>
+         </MIMEAssociationList>
 
-        <URLAssociationList>
+        <URLAssociationList>
 
-          <URLAssociation Scheme="http" ProgID="LitViewHTML.URL.http" />
+          <URLAssociation Scheme="http" ProgID="LitViewHTML.URL.http" />
 
-         </URLAssociationList>
+         </URLAssociationList>
 
-         </Capabilities>
+         </Capabilities>
 
-      </CapabilityGroup>
+      </CapabilityGroup>
 
-       </ApplicationCapabilities>
+       </ApplicationCapabilities>
 
-      </Extension>
+      </Extension>
 
     </Extensions>
 
@@ -701,15 +704,15 @@ Machine Configuration - the Machine configuration section of the Deployment Conf
 
     <Include>
 
-      <Key Path="\\REGISTRY\\Machine\\Software\\ABC">
+      <Key Path="\\REGISTRY\\Machine\\Software\\ABC">
 
-        <Value Type="REG\_SZ" Name="Bar" Data="Baz" />
+        <Value Type="REG\_SZ" Name="Bar" Data="Baz" />
 
-       </Key>
+       </Key>
 
-      <Key Path="\\REGISTRY\\Machine\\Software\\EmptyKey" />
+      <Key Path="\\REGISTRY\\Machine\\Software\\EmptyKey" />
 
-     </Include>
+     </Include>
 
     <Delete>
 
@@ -721,9 +724,9 @@ Machine Configuration - the Machine configuration section of the Deployment Conf
 
     <NotIsolate>
 
-       <Object Name="testObject" />
+       <Object Name="testObject" />
 
-     </NotIsolate>
+     </NotIsolate>
 
     </Objects>
 
@@ -731,11 +734,11 @@ Machine Configuration - the Machine configuration section of the Deployment Conf
 
     <MachineConfiguration>
 
-      .. 
+      .. 
 
-      <ProductSourceURLOptOut Enabled="true" />
+      <ProductSourceURLOptOut Enabled="true" />
 
-      ..
+      ..
 
     </MachineConfiguration>
 
@@ -745,19 +748,19 @@ Machine Configuration - the Machine configuration section of the Deployment Conf
 
     <MachineConfiguration>
 
-      ..   
+      ..   
 
-      <TerminateChildProcesses>
+      <TerminateChildProcesses>
 
-        <Application Path="\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE" />
+        <Application Path="\[{PackageRoot}\]\\Contoso\\ContosoApp.EXE" />
 
-        <Application Path="\[{PackageRoot}\]\\LitView\\LitViewBrowser.exe" />
+        <Application Path="\[{PackageRoot}\]\\LitView\\LitViewBrowser.exe" />
 
-        <Application Path="\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE" />
+        <Application Path="\[{ProgramFilesX86}\]\\Microsoft Contoso\\Contoso\\contosomail.EXE" />
 
-      </TerminateChildProcesses>
+      </TerminateChildProcesses>
 
-      ..
+      ..
 
     </MachineConfiguration>
 
@@ -852,7 +855,7 @@ The following table describes the various script events and the context under wh
 
 
 
- 
+ 
 
 ### Create a Dynamic Configuration file using an App-V 5.0 Manifest file
 
@@ -876,9 +879,9 @@ To create the file manually, the information above in previous sections can be c
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/about-app-v-50-reporting.md b/mdop/appv-v5/about-app-v-50-reporting.md
index e8d03cb385..f5bce3e29a 100644
--- a/mdop/appv-v5/about-app-v-50-reporting.md
+++ b/mdop/appv-v5/about-app-v-50-reporting.md
@@ -1,8 +1,11 @@
 ---
 title: About App-V 5.0 Reporting
 description: About App-V 5.0 Reporting
-author: jamiejdt
+author: dansimp
 ms.assetid: 27c33dda-f017-41e3-8a78-1b681543ec4f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -38,7 +41,7 @@ The following list displays the end–to-end high-level workflow for reporting i
     **Note**  
     If you are using the Configuration Manager integration with App-V 5.0, most reports are generated from Configuration Manager rather than from App-V 5.0.
 
-     
+     
 
 4.  After importing the App-V 5.0 PowerShell module using `Import-Module AppvClient` as administrator, enable the App-V 5.0 client. This sample PowerShell cmdlet enables App-V 5.0 reporting:
 
@@ -57,9 +60,11 @@ The following list displays the end–to-end high-level workflow for reporting i
     **Note**  
     By default the cache is cleared after the server confirms receipt of data. You can manually configure the client to save the data cache.
 
-     
+     
 
-    If the App-V 5.0 client device does not receive a success notification from the server, it retains data in the cache and tries to resend data at the next configured interval. Clients continue to collect data and add it to the cache.
+~~~
+If the App-V 5.0 client device does not receive a success notification from the server, it retains data in the cache and tries to resend data at the next configured interval. Clients continue to collect data and add it to the cache.
+~~~
 
 ###  App-V 5.0 reporting server frequently asked questions
 
@@ -107,24 +112,23 @@ The following table displays answers to common questions about App-V 5.0 reporti
 
Yes. Besides manually sending reporting using PowerShell Cmdlets (Send-AppvClientReport), the task can be scheduled so it will happen automatically. There are two ways to schedule the reporting:

 
    
 
  1. Using PowerShell cmdlets - Set-AppvClientConfiguration. For example:
    
-
    Set-AppvClientConfiguration -ReportingEnabled 1 - ReportingServerURL http://any.com/appv-reporting
    
+
    Set-AppvClientConfiguration -ReportingEnabled 1 - ReportingServerURL http://any.com/appv-reporting
    
 
    
-
    For a complete list of client configuration settings see [About Client Configuration Settings](about-client-configuration-settings.md) and look for the following entries: ReportingEnabled, ReportingServerURL, ReportingDataCacheLimit, ReportingDataBlockSize, ReportingStartTime, ReportingRandomDelay, ReportingInterval.
    
+
    For a complete list of client configuration settings see About Client Configuration Settings and look for the following entries: ReportingEnabled, ReportingServerURL, ReportingDataCacheLimit, ReportingDataBlockSize, ReportingStartTime, ReportingRandomDelay, ReportingInterval.
    
 
    2. 
 
  2. By using Group Policy. If distributed using the domain controller, the settings are the same as previously listed.
    
 
    
-Note  
-
    Group Policy settings override local settings configured using PowerShell.
    
+Note
    Group Policy settings override local settings configured using PowerShell.
    
 
    
 
    
- 
+
 
    3. 
 

 
 
 
+ 
 
- 
 
 ##  App-V 5.0 Client Reporting
 
@@ -135,10 +139,10 @@ To use App-V 5.0 reporting you must install and configure the App-V 5.0 client.
 
 The following examples show how PowerShell parameters can configure the reporting features of the App-V 5.0 client.
 
-**Note**  
+**Note**  
 The following configuration task can also be configured using Group Policy settings in the App-V 5.0 ADMX template. For more information about using the ADMX template, see [How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md).
+ 
 
- 
 
 **To enable reporting and to initiate data collection on the computer running the App-V 5.0 client**:
 
@@ -152,7 +156,7 @@ Set-AppVClientConfiguration –ReportingServerURL http://MyReportingServer:MyPor
 
 `-ReportingInterval 1 -ReportingRandomDelay 30`
 
-This example configures the client to automatically send the reporting data to the reporting server URL **http://MyReportingServer:MyPort/**. Additionally, the reporting data will be sent daily between 8:00 and 8:30 PM, depending on the random delay generated for the session.
+This example configures the client to automatically send the reporting data to the reporting server URL http://MyReportingServer:MyPort/. Additionally, the reporting data will be sent daily between 8:00 and 8:30 PM, depending on the random delay generated for the session.
 
 **To limit the size of the data cache on the client**:
 
@@ -221,8 +225,8 @@ The following table displays the types of information you can collect by using A
 
 
 
+ 
 
- 
 
 The client collects and saves this data in an **.xml** format. The data cache is hidden by default and requires administrator rights to open the XML file.
 
@@ -267,20 +271,19 @@ You can also use the **Send-AppVClientReport** cmdlet to manually collect data.
 
 
If you have an existing App-V 5.0 reporting Server, create a customized scheduled task or script. Specify that the client send the data to the specified location with the desired frequency.

 
If you do not have an existing App-V 5.0 reporting Server, use the –URL parameter to send the data to a specified share. For example:

-
Send-AppVClientReport –URL \\Myshare\MyData\ -DeleteOnSuccess

-
The previous example will send the reporting data to \\MyShare\MyData\ location indicated by the -URL parameter. After the data has been sent, the cache is cleared.

+
Send-AppVClientReport –URL \Myshare\MyData\ -DeleteOnSuccess

+
The previous example will send the reporting data to \MyShare\MyData</strong> location indicated by the -URL parameter. After the data has been sent, the cache is cleared.

 

-Note  
-
If a location other than the Reporting Server is specified, the data is sent using .xml format with no additional processing.

+Note
If a location other than the Reporting Server is specified, the data is sent using .xml format with no additional processing.

 

 

- 
+ 
 

 
 
 
 
- 
+ 
 
 ### Creating Reports
 
@@ -314,9 +317,9 @@ You should also ensure that the reporting server web service’s **Maximum Concu
 
 [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/about-app-v-50-sp1.md b/mdop/appv-v5/about-app-v-50-sp1.md
index 7abef85fc1..2222333447 100644
--- a/mdop/appv-v5/about-app-v-50-sp1.md
+++ b/mdop/appv-v5/about-app-v-50-sp1.md
@@ -1,8 +1,11 @@
 ---
 title: About App-V 5.0 SP1
 description: About App-V 5.0 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 2848a51b-452e-4c70-b465-f6717cfa667f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -29,7 +32,7 @@ This service pack contains the following changes:
 
     -   Reporting - **HKEY\_LOCAL\_MACHINE** \\ **SOFTWARE** \\ **Microsoft** \\ **AppV** \\ **Server** \\ **ReportingService** \\ **REPORTING\_DB\_NAME**
 
-     
+     
 
 ## How to Get MDOP Technologies
 
@@ -48,9 +51,9 @@ App-V 5.0 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is p
 
 [Release Notes for App-V 5.0 SP1](release-notes-for-app-v-50-sp1.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/about-app-v-50-sp2.md b/mdop/appv-v5/about-app-v-50-sp2.md
index bf06ad558b..f3f167d10a 100644
--- a/mdop/appv-v5/about-app-v-50-sp2.md
+++ b/mdop/appv-v5/about-app-v-50-sp2.md
@@ -1,8 +1,11 @@
 ---
 title: About App-V 5.0 SP2
 description: About App-V 5.0 SP2
-author: jamiejdt
+author: dansimp
 ms.assetid: 16ca8452-cef2-464e-b4b5-c10d4630fa6a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -58,7 +61,7 @@ Tasks that have been placed in a pending state will be performed according to th
 
 
 
- 
+ 
 
 When a task is placed in a pending state, the App-V client also generates a registry key for the pending task, as follows:
 
@@ -85,7 +88,7 @@ When a task is placed in a pending state, the App-V client also generates a regi
 
 
 
- 
+ 
 
 ### Virtualizing Microsoft Office 2013 and Microsoft Office 2010 using App-V 5.0
 
@@ -96,7 +99,7 @@ Use the following link for more information about App-V 5.0 supported Microsoft
 **Note**  
 This document focuses on creating a Microsoft Office 2013 App-V 5.0 Package. However, it also provides information about scenarios for Microsoft Office 2010 with App-V 5.0.
 
- 
+ 
 
 ###  App-V 5.0 Client Management User Interface Application
 
@@ -170,9 +173,9 @@ App-V 5.0 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is p
 
 [Release Notes for App-V 5.0 SP2](release-notes-for-app-v-50-sp2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/about-app-v-50-sp3.md b/mdop/appv-v5/about-app-v-50-sp3.md
index 17c1fbf0a3..a784b0b574 100644
--- a/mdop/appv-v5/about-app-v-50-sp3.md
+++ b/mdop/appv-v5/about-app-v-50-sp3.md
@@ -1,8 +1,11 @@
 ---
 title: About App-V 5.0 SP3
 description: About App-V 5.0 SP3
-author: jamiejdt
+author: dansimp
 ms.assetid: 67b5268b-edc1-4027-98b0-b3937dd70a6b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -56,17 +59,17 @@ See the following links for the App-V 5.0 SP3 software prerequisites and support
 
 
 
-
[App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md)

+
App-V 5.0 SP3 Prerequisites

 
Prerequisite software that you must install before starting the App-V 5.0 SP3 installation

 
 
-
[App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md)

+
App-V 5.0 SP3 Supported Configurations

 
Supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client components

 
 
 
 
- 
+
 
 ## Migrating to App-V 5.0 SP3
 
@@ -98,11 +101,10 @@ Review the following information before you start the upgrade:
 
  • Connection groups
    • 
 
 
    
-Note  
-
    To use the App-V client user interface, download the existing version from [Microsoft Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/download/details.aspx?id=41186).
    
+Note
    To use the App-V client user interface, download the existing version from Microsoft Application Virtualization 5.0 Client UI Application.
    
 
    
 
    
- 
+
 
    
 
 
@@ -110,8 +112,8 @@ Review the following information before you start the upgrade:
 
    You must first upgrade to App-V 5.0. You cannot upgrade directly from App-V 4.x to App-V 5.0 SP3.
    
 
    For more information, see:
    
 
 
    
 
@@ -132,7 +134,7 @@ Review the following information before you start the upgrade:
 
 
 
- 
+
 
 ### Steps to upgrade the App-V infrastructure
 
@@ -154,15 +156,14 @@ Complete the following steps to upgrade each component of the App-V infrastructu
 
    Step 1: Upgrade the App-V Server.
    
 
    If you are not using the App-V Server, skip this step and go to the next step.
    
 
    
-Note  
-
    The App-V 5.0 SP3 client is compatible with the App-V 5.0 SP1 Server.
    
+Note
    The App-V 5.0 SP3 client is compatible with the App-V 5.0 SP1 Server.
    
 
    
 
    
- 
+
 
    
 
    Follow these steps:
    
 
      
-
    1. Review the [Release Notes for App-V 5.0 SP3](release-notes-for-app-v-50-sp3.md) for issues that may affect the App-V Server installation.
      2. 
+
    2. Review the Release Notes for App-V 5.0 SP3 for issues that may affect the App-V Server installation.
      3. 
 
    3. Do one of the following, depending on the method you are using to upgrade the Management database and/or Reporting database:
      
 @@ -190,35 +191,35 @@ Complete the following steps to upgrade each component of the App-V infrastructu
 
-
+
-
+
      
 

 
      
 
      Management database
      To install or upgrade, see [SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail](https://support.microsoft.com/kb/3031340).
      To install or upgrade, see SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail.
      		
 
      
 
      
 
      Reporting database
      Follow the steps in [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts.md).
      Follow the steps in How to Deploy the App-V Databases by Using SQL Scripts.
      		
 
      
       
 
      
-
       
      
+
       
      
 
 
 
-
       
      4. 
-
    4. If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section [Check registry keys after installing the App-V 5.0 SP3 Server](#bkmk-check-reg-key-svr).
      5. 
-
    5. Follow the steps in [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md).
      6. 
+
       
      
+
    6. If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section Check registry keys after installing the App-V 5.0 SP3 Server.
      7. 
+
    7. Follow the steps in How to Deploy the App-V 5.0 Server.
      8. 
 
    
 
 
 
    Step 2: Upgrade the App-V Sequencer.
    
-
    See [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md).
    
+
    See How to Install the Sequencer.
    
 
 
 
    Step 3: Upgrade the App-V client or App-V RDS client.
    
-
    See [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md).
    
+
    See How to Deploy the App-V Client.
    
 
 
 
 
- 
+
 
 ### Check registry keys before installing the App-V 5.0 SP3 Server
 
@@ -249,7 +250,7 @@ This is step 3 from the previous table.
 
 
 
- 
+
 
 **ManagementDatabase key**
 
@@ -317,7 +318,7 @@ If you are installing the Management database, set these registry keys under `HK
 
 
 
- 
+
 
 **ManagementService key**
 
@@ -352,7 +353,7 @@ If you are installing the Management server, set these registry keys under `HKLM
 
 
 
- 
+
 
 **ReportingDatabase key**
 
@@ -420,7 +421,7 @@ If you are installing the Reporting database, set these registry keys under `HKL
 
 
 
- 
+
 
 **ReportingService key**
 
@@ -451,7 +452,7 @@ If you are installing the Reporting server, set these registry keys under `HKLM\
 
 
 
- 
+
 
 ## Manually created connection group xml file requires update to schema
 
@@ -486,27 +487,27 @@ You can manage connection groups more easily by using optional packages and othe
 
    Including optional packages in a connection group enables you to dynamically determine which applications will be included in the connection group’s virtual environment, based on the applications that users are entitled to.
    
 
    You don’t need to manage as many connection groups because you can mix optional and non-optional packages in the same connection group. Mixing packages allows different groups of users to use the same connection group, even though users might have only one package in common.
    
 
    Example: You can enable a package with Microsoft Office for all users, but enable different optional packages, which contain different Office plug-ins, to different subsets of users.
    
-
    [How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups.md#bkmk-apps-plugs-optional)
    
+
    How to Use Optional Packages in Connection Groups
    
 
 
 
    Unpublish or delete an optional package without changing the connection group
    
 
    Unpublish or delete, or unpublish and republish an optional package, which is in a connection group, without having to disable or re-enable the connection group on the App-V client.
    
-
    [How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups.md#bkmk-apps-plugs-optional)
    
+
    How to Use Optional Packages in Connection Groups
    
 
 
 
    Publish connection groups that contain user-published and globally published packages
    
 
    Create a user-published connection group that contains user-published and globally published packages.
    
-
    [How to Create a Connection Group with User-Published and Globally Published Packages](how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md)
    
+
    How to Create a Connection Group with User-Published and Globally Published Packages
    
 
 
 
    Make a connection group ignore the package version
    
 
    Configure a connection group to accept any version of a package, which enables you to upgrade a package without having to disable the connection group. In addition, if there is an optional package with an incorrect version in the connection group, the package is ignored and won’t block the connection group’s virtual environment from being created.
    
-
    [How to Make a Connection Group Ignore the Package Version](how-to-make-a-connection-group-ignore-the-package-version.md)
    
+
    How to Make a Connection Group Ignore the Package Version
    
 
 
 
    Limit end users’ publishing capabilities
    
 
    Enable only administrators (not end users) to publish packages and to enable connection groups.
    
-
    For information about connection groups, see [How to Allow Only Administrators to Enable Connection Groups](how-to-allow-only-administrators-to-enable-connection-groups.md)
    
+
    For information about connection groups, see How to Allow Only Administrators to Enable Connection Groups
    
 
    For information about packages, see the following articles:
    
 @@ -522,19 +523,19 @@ You can manage connection groups more easily by using optional packages and othe
 
-
+
-
+
-
+
    
 

 
    
 
    Management console
    [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md)
    How to Publish a Package by Using the Management Console
    		
 
    
 
    
 
    PowerShell
    [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admin-only-posh-topic-cg)
    How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell
    		
 
    
 
    
 
    Third-party electronic software delivery system
    [How to Enable Only Administrators to Publish Packages by Using an ESD](how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md)
    How to Enable Only Administrators to Publish Packages by Using an ESD
    		
 
    
     
 
    
-
     
    
+
     
    
 
 
 
    Enable or disable a connection group for a specific user
    
@@ -543,18 +544,18 @@ You can manage connection groups more easily by using optional packages and othe
 
  • Enable-AppVClientConnectionGroup
    • 
 
  • Disable-AppVClientConnectionGroup
    • 
 
-
    [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md#bkmk-enable-cg-for-user-poshtopic)
    
+
    How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell
    
 
 
 
    Merging identical package paths into one virtual directory in connection groups
    
 
    If two or more packages in a connection group contain identical directory paths, the paths are merged into a single virtual directory inside the connection group virtual environment.
    
 
    This merging of paths allows an application in one package to access files that are in a different package.
    
-
    [About the Connection Group Virtual Environment](about-the-connection-group-virtual-environment.md#bkmk-merged-root-ve-exp)
    
+
    About the Connection Group Virtual Environment
    
 
 
 
 
- 
+
 
 ## Administrators can publish and unpublish packages for a specific user
 
@@ -588,7 +589,7 @@ Administrators can use the following cmdlets to publish or unpublish packages fo
 
 
 
- 
+
 
 ## Enable only administrators to publish and unpublish packages
 
@@ -615,12 +616,12 @@ You can enable only administrators (not end users) to publish and unpublish pack
 
 
 
    PowerShell
    
-
    [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs)
    
+
    How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell
    
 
 
 
 
- 
+
 
 ## RunVirtual registry key supports packages that are published to the user
 
@@ -652,7 +653,7 @@ New Windows PowerShell cmdlets for the App-V Server have been added to help you
 
 
 
    Add-AppvServerConnectionGroupPackage
    
-
    Appends a package to the end of a connection group's package list and enables you to configure the package as optional and/or with no version within the connection group.
    
+
    Appends a package to the end of a connection group's package list and enables you to configure the package as optional and/or with no version within the connection group.
    
 
 
 
    Set-AppvServerConnectionGroupPackage
    
@@ -665,7 +666,7 @@ New Windows PowerShell cmdlets for the App-V Server have been added to help you
 
 
 
- 
+
 
 ### Getting help for the PowerShell cmdlets
 
@@ -716,16 +717,16 @@ Cmdlet help is available in the following formats:
 
 
 
-
     
    
+
     
    
 
 
 
    On TechNet as web pages
    
-
    See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://technet.microsoft.com/library/dn520245.aspx).
    
+
    See the App-V node under Microsoft Desktop Optimization Pack Automation with Windows PowerShell.
    
 
 
 
 
- 
+
 
 For more information, see [How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md).
 
@@ -755,11 +756,10 @@ The primary virtual application directory (PVAD) is hidden in App-V 5.0 SP3, but
 
      
 
    1. In the Registry Editor, navigate to: HKLM\SOFTWARE\Microsoft\AppV\Sequencer\Compatibility
      
 
      
-Note  
-
      If the Compatability subkey doesn’t exist, you must create it.
      
+Note
      If the Compatibility subkey doesn’t exist, you must create it.
      
 
      
 
      
- 
+
 
      2. 
 
    2. Create a DWORD Value named EnablePVADControl, and set the value to 1.
      
 
      A value of 0 means that PVAD is hidden.
      3. 
@@ -768,7 +768,7 @@ The primary virtual application directory (PVAD) is hidden in App-V 5.0 SP3, but
 
 
 
- 
+
 
 **More about PVAD:** When you use the Sequencer to create a package, you can enter any installation path for the package. In past versions of App-V, you were required to specify the primary virtual application directory (PVAD) of the application as the path. PVAD is the directory to which you would typically install an application on your local computer if you weren’t using App-V. For example, if you were installing Office on a computer, the PVAD typically would be C:\\Program Files\\Microsoft Office\\.
 
@@ -801,7 +801,7 @@ In App-V 5.0 SP3, you must provide the following values in the address when you
 
 
 
- 
+
 
 For syntax and examples of this query, see [Viewing App-V Server Publishing Metadata](viewing-app-v-server-publishing-metadata.md).
 
@@ -829,9 +829,9 @@ App-V is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part
 
 [Release Notes for App-V 5.0 SP3](release-notes-for-app-v-50-sp3.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/about-app-v-50.md b/mdop/appv-v5/about-app-v-50.md
index 53a5118e94..a81421348c 100644
--- a/mdop/appv-v5/about-app-v-50.md
+++ b/mdop/appv-v5/about-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: About App-V 5.0
 description: About App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 5799141b-44bc-4033-afcc-212235e15f00
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -53,7 +56,7 @@ The following table displays some of the differences between App-V 4.6 and App-V
 
 
 
-
      Must Use a dedicated drive letter (Q:\).
      
+
      Must Use a dedicated drive letter (Q:</strong>).
      
 
      No dedicated drive letter required.
      
 
 
@@ -66,7 +69,7 @@ The following table displays some of the differences between App-V 4.6 and App-V
 
 
 
      Dynamic Suite Composition enabled interaction with middleware applications.
      
-
      Peer applications are shared using connection groups. For more information about connection groups see, [Managing Connection Groups](managing-connection-groups.md).
      
+
      Peer applications are shared using connection groups. For more information about connection groups see, Managing Connection Groups.
      
 
 
 
      VDI/RDS environments required a read-only shared cache.
      
@@ -83,7 +86,7 @@ The following table displays some of the differences between App-V 4.6 and App-V
 
 
 
- 
+ 
 
 ## How to Get MDOP Technologies
 
@@ -100,9 +103,9 @@ App-V 5.0 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is p
 
 [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/about-app-v-51-dynamic-configuration.md b/mdop/appv-v5/about-app-v-51-dynamic-configuration.md
index b208eda474..663c596d68 100644
--- a/mdop/appv-v5/about-app-v-51-dynamic-configuration.md
+++ b/mdop/appv-v5/about-app-v-51-dynamic-configuration.md
@@ -1,14 +1,16 @@
 ---
 title: About App-V 5.1 dynamic configuration
 description: You can use the dynamic configuration to customize an App-V 5.1 package for a user. Use the following information to create or edit an existing dynamic configuration file.
-author: jamiejdt
+author: dansimp
 ms.assetid: 35bc9908-d502-4a9c-873f-8ee17b6d9d74
+ms.reviewer: 
+manager: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 08/28/2018
-ms.author: pashort
+ms.author: dansimp
 ---
 
 # About App-V 5.1 dynamic configuration 
@@ -48,10 +50,10 @@ The **PackageId** is the same value as exists in the manifest file.
 
 The body of the dynamic user configuration file can include all the app extension points defined in the manifest file, as well as information to configure virtual applications. There are four subsections allowed in the body:
 
-1.	**[Applications](#applications)** 
-2.	**[Subsystems](#subsystems)**
-3.	**[UserScripts](#userscripts)**
-4.	**[ManagingAuthority](#managingauthority)**
+1.  **[Applications](#applications)** 
+2.  **[Subsystems](#subsystems)**
+3.  **[UserScripts](#userscripts)**
+4.  **[ManagingAuthority](#managingauthority)**
 
 #### Applications
 
@@ -73,7 +75,6 @@ All app-extensions contained in the manifest file within a package have an Appli
 ..
 
 
-
 ```
 
 #### Subsystems
@@ -92,7 +93,6 @@ AppExtensions and other subsystems arranged as subnodes.
 ..
 
 
-
 ```
 
 You can enable or disable each subsystem using the **Enabled** attribute.
@@ -105,40 +105,37 @@ Extension subsystems can be enabled and disabled independently of the content. F
 
 _**Examples:**_ 
 
--	If you define this in either the user or deployment config file, the content in the manifest gets ignored.
+- If you define this in either the user or deployment config file, the content in the manifest gets ignored.
 
-   ```XML
+  ```XML
 
-   
+  
 
-   
+  
 
-   ...
+  ...
 
-   
+  
 
-   
+  
+  ```
+- If you define only the following, the content in the manifest gets integrated during publishing.
 
-   ```
--	If you define only the following, the content in the manifest gets integrated during publishing.
-   
-   ```XML
+  ```XML
 
-   
+  
+  ```
 
-   ```
+- If you define the following, all Shortcuts within the manifest still get ignored. In other words, no Shortcuts get integrated.
 
--	If you define the following, all Shortcuts within the manifest still get ignored. In other words, no Shortcuts get integrated.
+  ```XML
 
-   ```XML
+  
 
-   
+     
 
-       
-
-   
-
-   ```
+  
+  ```
 
 _**Supported extension subsystems:**_ 
 
@@ -160,7 +157,7 @@ _**Supported extension subsystems:**_
 
         [{PackageRoot}]\Contoso\ContosoApp.EXE
 
- 
+
       [{Windows}]\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe
 
         
@@ -174,7 +171,7 @@ _**Supported extension subsystems:**_
         0
 
         1
- 
+
       [{PackageRoot}]\Contoso\ContosoApp.EXE
 
       
@@ -184,7 +181,7 @@ _**Supported extension subsystems:**_
   
 
     
- 
+
     [{AppData}]\Microsoft\Contoso\Recent\Templates.LNK
 
       [{AppData}]\Microsoft\Templates
@@ -212,7 +209,6 @@ _**Supported extension subsystems:**_
  
 
 
-
 ```
 
 **File-Type Associates** extension subsystem associates file types with programs to open by default as well as set up the context menu. 
@@ -237,7 +233,7 @@ _**Supported extension subsystems:**_
       contosowordpad.DocumentMacroEnabled.12
 
       document
- 
+
     application/vnd.ms-contosowordpad.document.macroEnabled.12
 
       
@@ -279,7 +275,7 @@ _**Supported extension subsystems:**_
     
 
        contosowordpad.DocumentMacroEnabled.12
- 
+
       [{Windows}]\Installer\{90140000-0011-0000-0000-000000FF1CE}\contosowordpadicon.exe,15
 
         Blah Blah Blah
@@ -295,19 +291,19 @@ _**Supported extension subsystems:**_
           Open
 
           
- 
+
            {e56fa627-c35f-4a01-9e79-7d36aed8225a}
 
              Edit
 
              &Edit
- 
+
            "[{PackageRoot}]\Contoso\WINcontosowordpad.EXE" /vu "%1"
 
           
 
           
- 
+
           {e56fa627-c35f-4a01-9e79-7d36aed8225a}
 
             Open
@@ -343,7 +339,6 @@ _**Supported extension subsystems:**_
   
 
   
-
 ```
 
 **URL Protocols** extension subsystem controls the URL protocols integrated into the local registry of the client machine, for example, _mailto:_. 
@@ -433,7 +428,6 @@ _**Supported extension subsystems:**_
   
 
   
-
 ```
 
 **Software Clients** extension subsystem allows the app to register as an email client, news reader, media player and makes the app visible in the Set program access and Computer defaults UI. In most cases, you should only need to enable and disable it. There is also a control to enable and disable the email client specifically if you want the other clients still enabled except for that client.
@@ -445,7 +439,6 @@ _**Supported extension subsystems:**_
   
 
 
-
 ```
 
 **AppPaths** extension subsystem opens apps registered with an application path. For example, if contoso.exe has an apppath name of _myapp_, users can type _myapp_ from the run menu, opening contoso.exe.
@@ -479,19 +472,17 @@ _**Supported extension subsystems:**_
 
 
 
-
 ```
 
 **COM** extensions subsystem allows an application registered to local COM servers. The mode can be:
 
--	Integration
--	Isolated 
--	Off
+-   Integration
+-   Isolated 
+-   Off
 
 ```XML
 
 
-
 ```
 
 **Virtual Kernel Objects**
@@ -499,7 +490,6 @@ _**Supported extension subsystems:**_
 ```XML
 
 
-
 ```
 
 **Virtual Registry** sets a registry in the virtual registry within HKCU.
@@ -523,7 +513,6 @@ _**Supported extension subsystems:**_
 
 
 
-
 ```
 
 **Virtual File System**
@@ -531,7 +520,6 @@ _**Supported extension subsystems:**_
 ```XML
 
     
-
 ```
 
 **Virtual Fonts**
@@ -539,7 +527,6 @@ _**Supported extension subsystems:**_
 ```XML
 
       
-
 ```
 
 **Virtual Environment Variables**
@@ -563,7 +550,6 @@ _**Supported extension subsystems:**_
         
 
         
-
 ```
 
 **Virtual services**
@@ -571,7 +557,6 @@ _**Supported extension subsystems:**_
 ```XML
 
       
-
 ```
 
 #### UserScripts
@@ -586,7 +571,6 @@ Use ManagingAuthority when two versions of your package co-exist on the same mac
 ```XML
 
 
-
 ```
 
 ## Deployment configuration file (DeploymentConfig.xml)
@@ -641,7 +625,6 @@ The body of the dynamic deployment configuration file includes two sections:
 
 
 
-
 ```
 
 ### UserConfiguration
@@ -652,10 +635,10 @@ Refer to [User configuration file contents (UserConfig.xml)](#user-configuration
 
 Use the MachineConfiguration section to configure information for an entire machine; not for a specific user on the computer. For example, HKEY_LOCAL_MACHINE registry keys in the virtual registry. There are four subsections allowed in under this element:
 
-1.	**[Subsystems](#subsystems-1)**
-2.	**[ProductSourceURLOptOut](#productsourceurloptout)**
-3.	**[MachineScripts](#machinescripts)**
-4.	**[TerminateChildProcess](#terminatechildprocess)**
+1.  **[Subsystems](#subsystems-1)**
+2.  **[ProductSourceURLOptOut](#productsourceurloptout)**
+3.  **[MachineScripts](#machinescripts)**
+4.  **[TerminateChildProcess](#terminatechildprocess)**
 
 #### Subsystems
 
@@ -674,7 +657,6 @@ AppExtensions and other subsystems arranged as subnodes.
 …
 
 
-
 ```
 
 You can enable or disable each subsystem using the **Enabled** attribute.
@@ -701,7 +683,7 @@ This extension also makes the virtual application visible in the Set default pro
 
     
 
- 
+
    [{PackageRoot}]\LitView\LitViewBrowser.exe
 
      
@@ -716,10 +698,10 @@ This extension also makes the virtual application visible in the Set default pro
 
     
 
- 
+
    @[{ProgramFilesX86}]\LitView\LitViewBrowser.exe,-12345
 
- 
+
    @[{ProgramFilesX86}]\LitView\LitViewBrowser.exe,-12346
 
      0
@@ -761,7 +743,6 @@ This extension also makes the virtual application visible in the Set default pro
 
 
 
-
 ```
 
 _**Supported extension subsystems:**_ 
@@ -787,7 +768,6 @@ _**Supported extension subsystems:**_
 
 
 
-
 ```
 
 **Machine Wide Virtual Kernel Objects**
@@ -803,7 +783,6 @@ _**Supported extension subsystems:**_
  
 
 
-
 ```
 
 #### ProductSourceURLOptOut
@@ -821,7 +800,6 @@ Use ProductSourceURLOptOut to indicate that the URL for the package can be modif
   ...
 
 
-
 ```
 
 #### MachineScripts
@@ -853,7 +831,6 @@ An application executable can be specified, whose child processes get terminated
   ...
 
 
-
 ```
 
 
@@ -888,11 +865,11 @@ ScriptRunner.exe application. The application then runs each script separately,
 along with the arguments that you specify for each script. Use only one script
 (ScriptRunner.exe) per trigger.
 
->[!NOTE]
-
->We recommended that you run the multi-script line from a command prompt
-first to make sure that all arguments are built correctly before adding them to
-the deployment configuration file.
+> [!NOTE]
+> 
+> We recommended that you run the multi-script line from a command prompt
+> first to make sure that all arguments are built correctly before adding them to
+> the deployment configuration file.
 
 ### Example script and parameter descriptions
 
@@ -924,9 +901,9 @@ Name of the event trigger for which you are running a script, such as adding a p
 
 The script launcher application that is installed as part of the App-V client installation.
 
->[!NOTE]
-
->Although ScriptRunner.exe is installed as part of the App-V client, the location of the App-V client must be in %path% or ScriptRunner will not run. ScriptRunner.exe is typically located in the C:FilesApplication Virtualizationfolder.
+> [!NOTE]
+> 
+> Although ScriptRunner.exe is installed as part of the App-V client, the location of the App-V client must be in %path% or ScriptRunner will not run. ScriptRunner.exe is typically located in the C:FilesApplication Virtualizationfolder.
 
 #### \
 
@@ -973,4 +950,4 @@ To create the file manually, the information above in previous sections can be c
 
 - [Operations for App-V 5.1](operations-for-app-v-51.md)
 
----
\ No newline at end of file
+---
diff --git a/mdop/appv-v5/about-app-v-51-reporting.md b/mdop/appv-v5/about-app-v-51-reporting.md
index f4114c9174..b37f88f1db 100644
--- a/mdop/appv-v5/about-app-v-51-reporting.md
+++ b/mdop/appv-v5/about-app-v-51-reporting.md
@@ -1,8 +1,11 @@
 ---
 title: About App-V 5.1 Reporting
 description: About App-V 5.1 Reporting
-author: jamiejdt
+author: dansimp
 ms.assetid: 385dca00-7178-4e35-8d86-c58867ebd65c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -38,7 +41,7 @@ The following list displays the end–to-end high-level workflow for reporting i
     **Note**  
     If you are using the Configuration Manager integration with App-V 5.1, most reports are generated from Configuration Manager rather than from App-V 5.1.
 
-     
+     
 
 4.  After importing the App-V 5.1 PowerShell module using `Import-Module AppvClient` as administrator, enable the App-V 5.1 client. This sample PowerShell cmdlet enables App-V 5.1 reporting:
 
@@ -57,9 +60,11 @@ The following list displays the end–to-end high-level workflow for reporting i
     **Note**  
     By default the cache is cleared after the server confirms receipt of data. You can manually configure the client to save the data cache.
 
-     
+     
 
-    If the App-V 5.1 client device does not receive a success notification from the server, it retains data in the cache and tries to resend data at the next configured interval. Clients continue to collect data and add it to the cache.
+~~~
+If the App-V 5.1 client device does not receive a success notification from the server, it retains data in the cache and tries to resend data at the next configured interval. Clients continue to collect data and add it to the cache.
+~~~
 
 ###  App-V 5.1 reporting server frequently asked questions
 
@@ -107,24 +112,23 @@ The following table displays answers to common questions about App-V 5.1 reporti
 
      Yes. Besides manually sending reporting using PowerShell Cmdlets (Send-AppvClientReport), the task can be scheduled so it will happen automatically. There are two ways to schedule the reporting:
      
 
        
 
      1. Using PowerShell cmdlets - Set-AppvClientConfiguration. For example:
        
-
        Set-AppvClientConfiguration -ReportingEnabled 1 - ReportingServerURL http://any.com/appv-reporting
        
+
        Set-AppvClientConfiguration -ReportingEnabled 1 - ReportingServerURL http://any.com/appv-reporting
        
 
        
-
        For a complete list of client configuration settings see [About Client Configuration Settings](about-client-configuration-settings51.md) and look for the following entries: ReportingEnabled, ReportingServerURL, ReportingDataCacheLimit, ReportingDataBlockSize, ReportingStartTime, ReportingRandomDelay, ReportingInterval.
        
+
        For a complete list of client configuration settings see About Client Configuration Settings and look for the following entries: ReportingEnabled, ReportingServerURL, ReportingDataCacheLimit, ReportingDataBlockSize, ReportingStartTime, ReportingRandomDelay, ReportingInterval.
        
 
        2. 
 
      2. By using Group Policy. If distributed using the domain controller, the settings are the same as previously listed.
        
 
        
-Note  
-
        Group Policy settings override local settings configured using PowerShell.
        
+Note
        Group Policy settings override local settings configured using PowerShell.
        
 
        
 
        
- 
+
 
        3. 
 
      
 
 
 
+ 
 
- 
 
 ##  App-V 5.1 Client Reporting
 
@@ -135,10 +139,10 @@ To use App-V 5.1 reporting you must install and configure the App-V 5.1 client.
 
 The following examples show how PowerShell parameters can configure the reporting features of the App-V 5.1 client.
 
-**Note**  
+**Note**  
 The following configuration task can also be configured using Group Policy settings in the App-V 5.1 ADMX template. For more information about using the ADMX template, see [How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy](how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md).
+ 
 
- 
 
 **To enable reporting and to initiate data collection on the computer running the App-V 5.1 client**:
 
@@ -152,7 +156,7 @@ Set-AppVClientConfiguration –ReportingServerURL http://MyReportingServer:MyPor
 
 `-ReportingInterval 1 -ReportingRandomDelay 30`
 
-This example configures the client to automatically send the reporting data to the reporting server URL **http://MyReportingServer:MyPort/**. Additionally, the reporting data will be sent daily between 8:00 and 8:30 PM, depending on the random delay generated for the session.
+This example configures the client to automatically send the reporting data to the reporting server URL http://MyReportingServer:MyPort/. Additionally, the reporting data will be sent daily between 8:00 and 8:30 PM, depending on the random delay generated for the session.
 
 **To limit the size of the data cache on the client**:
 
@@ -221,8 +225,8 @@ The following table displays the types of information you can collect by using A
 
 
 
+ 
 
- 
 
 The client collects and saves this data in an **.xml** format. The data cache is hidden by default and requires administrator rights to open the XML file.
 
@@ -267,20 +271,19 @@ You can also use the **Send-AppVClientReport** cmdlet to manually collect data.
 
 
      If you have an existing App-V 5.1 reporting Server, create a customized scheduled task or script. Specify that the client send the data to the specified location with the desired frequency.
      
 
      If you do not have an existing App-V 5.1 reporting Server, use the –URL parameter to send the data to a specified share. For example:
      
-
      Send-AppVClientReport –URL \\Myshare\MyData\ -DeleteOnSuccess
      
-
      The previous example will send the reporting data to \\MyShare\MyData\ location indicated by the -URL parameter. After the data has been sent, the cache is cleared.
      
+
      Send-AppVClientReport –URL \Myshare\MyData\ -DeleteOnSuccess
      
+
      The previous example will send the reporting data to \MyShare\MyData</strong> location indicated by the -URL parameter. After the data has been sent, the cache is cleared.
      
 
      
-Note  
-
      If a location other than the Reporting Server is specified, the data is sent using .xml format with no additional processing.
      
+Note
      If a location other than the Reporting Server is specified, the data is sent using .xml format with no additional processing.
      
 
      
 
      
- 
+ 
 
      
 
 
 
 
- 
+ 
 
 ### Creating Reports
 
@@ -314,9 +317,9 @@ You should also ensure that the reporting server web service’s **Maximum Concu
 
 [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/about-app-v-51.md b/mdop/appv-v5/about-app-v-51.md
index c942fd6e40..f52bcf1b64 100644
--- a/mdop/appv-v5/about-app-v-51.md
+++ b/mdop/appv-v5/about-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: About App-V 5.1
 description: About App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 35bc9908-d502-4a9c-873f-8ee17b6d9d74
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -52,17 +55,17 @@ See the following links for the App-V 5.1 software prerequisites and supported c
 
 
 
-
      [App-V 5.1 Prerequisites](app-v-51-prerequisites.md)
      
+
      App-V 5.1 Prerequisites
      
 
      Prerequisite software that you must install before starting the App-V 5.1 installation
      
 
 
-
      [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md)
      
+
      App-V 5.1 Supported Configurations
      
 
      Supported operating systems and hardware requirements for the App-V Server, Sequencer, and Client components
      
 
 
 
 
- 
+
 
 **Support for using Configuration Manager with App-V:** App-V 5.1 supports System Center 2012 R2 Configuration Manager SP1. See [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx) for information about integrating your App-V environment with Configuration Manager and Configuration Manager.
 
@@ -95,19 +98,18 @@ Review the following information before you start the upgrade:
 
    3. App-V Client or App-V Remote Desktop Services (RDS) Client
      4. 
 
    
 
    
-Note  
-
    Prior to App-V 5.0 SP2, the Client Management User Interface (UI) was provided with the App-V Client installation. For App-V 5.0 SP2 installations (or later), you can use the Client Management UI by downloading from [Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/download/details.aspx?id=41186).
    
+Note
    Prior to App-V 5.0 SP2, the Client Management User Interface (UI) was provided with the App-V Client installation. For App-V 5.0 SP2 installations (or later), you can use the Client Management UI by downloading from Application Virtualization 5.0 Client UI Application.
    
 
    
 
    
- 
+
 
    
 
 
 
    Upgrading from App-V 4.x
    
 
    You must first upgrade to App-V 5.0. You cannot upgrade directly from App-V 4.x to App-V 5.1. For more information, see:
    
 
 
    
 
@@ -126,7 +128,7 @@ Review the following information before you start the upgrade:
 
 
 
- 
+
 
 ### Steps to upgrade the App-V infrastructure
 
@@ -147,11 +149,10 @@ Complete the following steps to upgrade each component of the App-V infrastructu
 
 
    Step 1: Upgrade the App-V Server.
    
 
    
-Note  
-
    If you are not using the App-V Server, skip this step and go to the next step.
    
+Note
    If you are not using the App-V Server, skip this step and go to the next step.
    
 
    
 
    
- 
+
 
    
 
    Follow these steps:
    
 
      
@@ -174,36 +175,36 @@ Complete the following steps to upgrade each component of the App-V infrastructu
 
 
 
      SQL scripts
      
-
      Follow the steps in [How to Deploy the App-V Databases by Using SQL Scripts](how-to-deploy-the-app-v-databases-by-using-sql-scripts.md).
      
+
      Follow the steps in How to Deploy the App-V Databases by Using SQL Scripts.
      
 
 
 
-
    1. If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section [Check registry keys after installing the App-V 5.0 SP3 Server](check-reg-key-svr.md).
      2. 
-
    2. Follow the steps in [How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md)
      3. 
-
       
      
+
    3. If you are upgrading the App-V Server from App-V 5.0 SP1 Hotfix Package 3 or later, complete the steps in section Check registry keys after installing the App-V 5.0 SP3 Server.
      4. 
+
    4. Follow the steps in How to Deploy the App-V 5.1 Server
      5. 
+
       
      
 
    
 
 
 
    Step 2: Upgrade the App-V Sequencer.
    
-
    See [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md).
    
+
    See How to Install the Sequencer.
    
 
 
 
    Step 3: Upgrade the App-V Client or App-V RDS Client.
    
-
    See [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md).
    
+
    See How to Deploy the App-V Client.
    
 
 
 
 
- 
+
 
 ### Converting packages created using a prior version of App-V
 
 Use the package converter utility to upgrade virtual application packages created using versions of App-V prior to App-V 5.0. The package converter uses PowerShell to convert packages and can help automate the process if you have many packages that require conversion.
 
-**Note**  
+**Note**  
 App-V 5.1 packages are exactly the same as App-V 5.0 packages. There has been no change in the package format between the versions and so there is no need to convert App-V 5.0 packages to App-V 5.1 packages.
 
- 
+
 
 ## What’s New in App-V 5.1
 
@@ -246,7 +247,7 @@ The following table lists the Windows 10 support for App-V. Windows 10 is not su
 
 
 
- 
+
 
 ### App-V Management Console Changes
 
@@ -291,7 +292,7 @@ The Management Console UI no longer requires Silverlight. The 5.1 Management Con
 
 
 
- 
+
 
 ### Console pages are now separate URLs
 
@@ -315,7 +316,7 @@ The Management Console UI no longer requires Silverlight. The 5.1 Management Con
 
 
 
- 
+
 
 ### New, separate CONNECTION GROUPS page and menu option
 
@@ -338,7 +339,7 @@ The Management Console UI no longer requires Silverlight. The 5.1 Management Con
 
 
 
- 
+
 
 ### Menu options for packages have changed
 
@@ -394,7 +395,7 @@ The Management Console UI no longer requires Silverlight. The 5.1 Management Con
 
 
 
- 
+
 
 ### Icons in left pane have new colors and text
 
@@ -414,10 +415,10 @@ You can import and export the AppxManifest.xml file. To export the manifest file
 
 After you make your changes, click **Import...** and select the file you edited. After you successfully import it back in, the manifest file is immediately updated within the package editor.
 
-**Caution**  
+**Caution**  
 When you import the file, your changes are validated against the XML schema. If the file is not valid, you will receive an error. Be aware that it is possible to import a file that is validated against the XML schema, but that might still fail to run for other reasons.
 
- 
+
 
 ### Addition of Windows 10 to operating systems list
 
@@ -516,9 +517,9 @@ App-V is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part
 
 [Release Notes for App-V 5.1](release-notes-for-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/about-client-configuration-settings.md b/mdop/appv-v5/about-client-configuration-settings.md
index 11e4f02114..9ba08f850a 100644
--- a/mdop/appv-v5/about-client-configuration-settings.md
+++ b/mdop/appv-v5/about-client-configuration-settings.md
@@ -1,8 +1,11 @@
 ---
 title: About Client Configuration Settings
 description: About Client Configuration Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: cc7ae28c-b2ac-4f68-b992-5ccdbd5316a4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -124,153 +127,143 @@ The following table displays information about the App-V 5.0 client configuratio
 
 
    Name
    
 
    
-Note  
-
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
+Note
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
 
    
 
    
- 
+
 
    
 
    PUBLISHINGSERVERNAME
    
 
    Displays the name of publishing server.
    
 
    String
    
-
    Publishing\Servers\{serverId}\FriendlyName
    
+
    Publishing\Servers{serverId}\FriendlyName
    
 
    Policy value not written (same as Not Configured)
    
 
 
 
    URL
    
 
    
-Note  
-
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
+Note
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
 
    
 
    
- 
+
 
    
 
    PUBLISHINGSERVERURL
    
 
    Displays the URL of publishing server.
    
 
    String
    
-
    Publishing\Servers\{serverId}\URL
    
+
    Publishing\Servers{serverId}\URL
    
 
    Policy value not written (same as Not Configured)
    
 
 
 
    GlobalRefreshEnabled
    
 
    
-Note  
-
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
+Note
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
 
    
 
    
- 
+
 
    
 
    GLOBALREFRESHENABLED
    
 
    Enables global publishing refresh (Boolean)
    
 
    True(enabled); False(Disabled state)
    
-
    Publishing\Servers\{serverId}\GlobalEnabled
    
+
    Publishing\Servers{serverId}\GlobalEnabled
    
 
    False
    
 
 
 
    GlobalRefreshOnLogon
    
 
    
-Note  
-
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
+Note
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
 
    
 
    
- 
+
 
    
 
    GLOBALREFRESHONLOGON
    
 
    Triggers a global publishing refresh on logon. ( Boolean)
    
 
    True(enabled); False(Disabled state)
    
-
    Publishing\Servers\{serverId}\GlobalLogonRefresh
    
+
    Publishing\Servers{serverId}\GlobalLogonRefresh
    
 
    False
    
 
 
 
    GlobalRefreshInterval
    
 
    
-Note  
-
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
+Note
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
 
    
 
    
- 
+
 
    
-
    GLOBALREFRESHINTERVAL  
    
+
    GLOBALREFRESHINTERVAL  
    
 
    Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, select 0.
    
 
    Integer (0-744
    
-
    Publishing\Servers\{serverId}\GlobalPeriodicRefreshInterval
    
+
    Publishing\Servers{serverId}\GlobalPeriodicRefreshInterval
    
 
    0
    
 
 
 
    GlobalRefreshIntervalUnit
    
 
    
-Note  
-
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
+Note
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
 
    
 
    
- 
+
 
    
 
    GLOBALREFRESHINTERVALUNI
    
-
    Specifies the interval unit (Hour 0-23, Day 0-31). 
    
+
    Specifies the interval unit (Hour 0-23, Day 0-31). 
    
 
    0 for hour, 1 for day
    
-
    Publishing\Servers\{serverId}\GlobalPeriodicRefreshIntervalUnit
    
+
    Publishing\Servers{serverId}\GlobalPeriodicRefreshIntervalUnit
    
 
    1
    
 
 
 
    UserRefreshEnabled
    
 
    
-Note  
-
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
+Note
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
 
    
 
    
- 
+
 
    
-
    USERREFRESHENABLED 
    
+
    USERREFRESHENABLED 
    
 
    Enables user publishing refresh (Boolean)
    
 
    True(enabled); False(Disabled state)
    
-
    Publishing\Servers\{serverId}\UserEnabled
    
+
    Publishing\Servers{serverId}\UserEnabled
    
 
    False
    
 
 
 
    UserRefreshOnLogon
    
 
    
-Note  
-
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
+Note
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
 
    
 
    
- 
+
 
    
 
    USERREFRESHONLOGON
    
 
    Triggers a user publishing refresh onlogon. ( Boolean)
    
 
    Word count (with spaces): 60
    
 
    True(enabled); False(Disabled state)
    
-
    Publishing\Servers\{serverId}\UserLogonRefresh
    
+
    Publishing\Servers{serverId}\UserLogonRefresh
    
 
    False
    
 
 
 
    UserRefreshInterval
    
 
    
-Note  
-
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
+Note
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
 
    
 
    
- 
+
 
    
-
    USERREFRESHINTERVAL     
    
+
    USERREFRESHINTERVAL     
    
 
    Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0.
    
 
    Word count (with spaces): 85
    
 
    Integer (0-744 Hours)
    
-
    Publishing\Servers\{serverId}\UserPeriodicRefreshInterval
    
+
    Publishing\Servers{serverId}\UserPeriodicRefreshInterval
    
 
    0
    
 
 
 
    UserRefreshIntervalUnit
    
 
    
-Note  
-
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
+Note
    This setting cannot be modified using the set-AppvclientConfiguration cmdLet. You must use the Set-AppvPublishingServer cmdlet.
    
 
    
 
    
- 
+
 
    
-
    USERREFRESHINTERVALUNIT  
    
-
    Specifies the interval unit (Hour 0-23, Day 0-31). 
    
+
    USERREFRESHINTERVALUNIT  
    
+
    Specifies the interval unit (Hour 0-23, Day 0-31). 
    
 
    0 for hour, 1 for day
    
-
    Publishing\Servers\{serverId}\UserPeriodicRefreshIntervalUnit
    
+
    Publishing\Servers{serverId}\UserPeriodicRefreshIntervalUnit
    
 
    1
    
 
 
@@ -300,7 +293,7 @@ The following table displays information about the App-V 5.0 client configuratio
 
 
    RoamingFileExclusions
    
 
    ROAMINGFILEEXCLUSIONS
    
-
    Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage:  /ROAMINGFILEEXCLUSIONS='desktop;my pictures'
    
+
    Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage:  /ROAMINGFILEEXCLUSIONS='desktop;my pictures'
    
 
    
 
    
 
    
@@ -308,9 +301,9 @@ The following table displays information about the App-V 5.0 client configuratio
 
 
    RoamingRegistryExclusions
    
 
    ROAMINGREGISTRYEXCLUSIONS
    
-
    Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients
    
+
    Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients
    
 
    String
    
-
    Integration\RoamingReglstryExclusions
    
+
    Integration\RoamingRegistryExclusions
    
 
    Policy value not written (same as Not Configured)
    
 
 
@@ -334,7 +327,7 @@ The following table displays information about the App-V 5.0 client configuratio
 
    Not available.
    
 
    A comma -delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment.
    
 
    When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application that is associated with the extension point is locally installed. If the extension is located, the RunVirtual command line parameter will be added, and the application will run virtually.
    
-
    For more information about the RunVirtual parameter, see [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md).
    
+
    For more information about the RunVirtual parameter, see Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications.
    
 
    String
    
 
    Integration\VirtualizableExtensions
    
 
    Policy value not written
    
@@ -376,11 +369,10 @@ The following table displays information about the App-V 5.0 client configuratio
 
    Not available.
    
 
    Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0-23 corresponding to the hour of the day. By default the ReportingStartTime will start on the current day at 10 P.M.or 22.
    
 
    
-Note  
-
    You should configure this setting to a time when computers running the App-V 5.0 client are least likely to be offline.
    
+Note
    You should configure this setting to a time when computers running the App-V 5.0 client are least likely to be offline.
    
 
    
 
    
- 
+
 
    
 
    Integer (0 – 23)
    
 
    Reporting\ StartTime
    
@@ -405,11 +397,10 @@ The following table displays information about the App-V 5.0 client configuratio
 
 
    EnableDynamicVirtualization
    
 
    
-Important  
-
    This setting is available only with App-V 5.0 SP2 or later.
    
+Important
    This setting is available only with App-V 5.0 SP2 or later.
    
 
    
 
    
- 
+
 
    
 
    Not available.
    
 
    Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications.
    
@@ -420,11 +411,10 @@ The following table displays information about the App-V 5.0 client configuratio
 
 
    EnablePublishingRefreshUI
    
 
    
-Important  
-
    This setting is available only with App-V 5.0 SP2.
    
+Important
    This setting is available only with App-V 5.0 SP2.
    
 
    
 
    
- 
+
 
    
 
    Not available.
    
 
    Enables the publishing refresh progress bar for the computer running the App-V 5.0 Client.
    
@@ -435,11 +425,10 @@ The following table displays information about the App-V 5.0 client configuratio
 
 
    HideUI
    
 
    
-Important  
-
    This setting is available only with App-V 5.0 SP2.
    
+Important
    This setting is available only with App-V 5.0 SP2.
    
 
    
 
    
- 
+
 
    
 
    Not available.
    
 
    Hides the publishing refresh progress bar.
    
@@ -458,7 +447,7 @@ The following table displays information about the App-V 5.0 client configuratio
 
 
 
- 
+
 
 
 
@@ -474,9 +463,9 @@ The following table displays information about the App-V 5.0 client configuratio
 
 [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/about-client-configuration-settings51.md b/mdop/appv-v5/about-client-configuration-settings51.md
index 8ec20efe37..0ea5586f2b 100644
--- a/mdop/appv-v5/about-client-configuration-settings51.md
+++ b/mdop/appv-v5/about-client-configuration-settings51.md
@@ -1,8 +1,11 @@
 ---
 title: About Client Configuration Settings
 description: About Client Configuration Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: 18bb307a-7eda-4dd6-a83e-6afaefd99470
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -46,7 +49,7 @@ The following table displays information about the App-V 5.1 client configuratio
 | CEIPOPTIN | CEIPOPTIN | Allows the computer running the App-V 5.1 Client to collect and return certain usage information to help allow us to further improve the application. | 0 for disabled; 1 for enabled | SOFTWARE/Microsoft/AppV/CEIP/CEIPEnable | 0 | 
 | EnablePackageScripts | ENABLEPACKAGESCRIPTS | Enables scripts defined in the package manifest of configuration files that should run. | True(enabled); False(Disabled state) | \Scripting\EnablePackageScripts | | 
 | RoamingFileExclusions | ROAMINGFILEEXCLUSIONS | Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage:  /ROAMINGFILEEXCLUSIONS='desktop;my pictures' | | | |
-| RoamingRegistryExclusions | ROAMINGREGISTRYEXCLUSIONS | Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients | String | Integration\RoamingReglstryExclusions | Policy value not written (same as Not Configured) |
+| RoamingRegistryExclusions | ROAMINGREGISTRYEXCLUSIONS | Specifies the registry paths that do not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients | String | Integration\RoamingRegistryExclusions | Policy value not written (same as Not Configured) |
 | IntegrationRootUser | Not available. | Specifies the location to create symbolic links associated with the current version of a per-user published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %localappdata%\Microsoft\AppV\Client\Integration.| String | Integration\IntegrationRootUser | Policy value not written (same as Not Configured) |
 |IntegrationRootGlobal | Not available.| Specifies the location to create symbolic links associated with the current version of a globally published package. all virtual application extensions, for example shortcuts and file type associations, will point to this path. If you do not specify a path, symbolic links will not be used when you publish the package. For example: %allusersprofile%\Microsoft\AppV\Client\Integration | String | Integration\IntegrationRootGlobal | Policy value not written (same as Not Configured) |
 | VirtualizableExtensions | Not available. | A comma -delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment.
    When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application that is associated with the extension point is locally installed. If the extension is located, the **RunVirtual** command line parameter will be added, and the application will run virtually.
    For more information about the **RunVirtual** parameter, see [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md). | String | Integration\VirtualizableExtensions | Policy value not written |
diff --git a/mdop/appv-v5/about-the-connection-group-file.md b/mdop/appv-v5/about-the-connection-group-file.md
index 3719b1a019..6052eca8c9 100644
--- a/mdop/appv-v5/about-the-connection-group-file.md
+++ b/mdop/appv-v5/about-the-connection-group-file.md
@@ -1,8 +1,11 @@
 ---
 title: About the Connection Group File
 description: About the Connection Group File
-author: jamiejdt
+author: dansimp
 ms.assetid: bfeb6013-a7ca-4e36-9fe3-229702e83f0d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -44,12 +47,12 @@ ms.date: 06/16/2016
 
 
 
    Example file path
    
-
    %APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups\{6CCC7575-162E-4152-9407-ED411DA138F4}\{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}.
    
+
    %APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups{6CCC7575-162E-4152-9407-ED411DA138F4}{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}.
    
 
 
 
 
- 
+ 
 
 ## Structure of the connection group XML file
 
@@ -84,7 +87,7 @@ The following table describes the parameters in the XML file that define the con
 
    Schema name
    
 
    Name of the schema.
    
 
    Applicable starting in App-V 5.0 SP3: If you want to use the new “optional packages” and “use any version” features that are described in this table, you must specify the following schema in the XML file:
    
-
    xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup"
    
+
    xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup";
    
 
 
 
    AppConnectionGroupId
    
@@ -109,7 +112,7 @@ The following table describes the parameters in the XML file that define the con
 
 
 
- 
+ 
 
 ### Parameters that define the packages in the connection group
 
@@ -143,24 +146,66 @@ In the <Packages> section of the connection group XML file, you list the m
 
  • “true” – package is optional in the connection group
    • 
 
  • “false” – package is required in the connection group
    • 
 
-
    See [How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups.md).
    
+
    See How to Use Optional Packages in Connection Groups.
    
 
 
 
 
- 
+ 
 
 ### App-V 5.0 SP3 example connection group XML file
 
 The following example connection group XML file shows examples of the fields in the previous tables and highlights the items that are new for App-V 5.0 SP3.
 
-`````  ``    ``    ``  `
+```XML
+
+
+   
+          
+       
+   
+
+```
 
 ### App-V 5.0 through App-V 5.0 SP2 example connection group XML file
 
 The following example connection group XML file applies to App-V 5.0 through App-V 5.0 SP2. It shows examples of the fields in the previous table, but it excludes the changes described above for App-V 5.0 SP3.
 
-`````  ``    ``    ``  `
+```XML
+
+
+   
+      
+      
+   
+Configuring the priority of packages in a connection group
 
@@ -176,7 +221,7 @@ You can use the connection group file to configure each connection group by usin
     **Note**  
     Priority is required only if the package is associated with more than one connection group.
 
-     
+     
 
 -   Specify package precedence within the connection group.
 
@@ -271,7 +316,7 @@ The virtual application Microsoft Outlook is running in virtual environment **XY
 
 
 
- 
+ 
 
 
 
@@ -283,9 +328,9 @@ The virtual application Microsoft Outlook is running in virtual environment **XY
 
 [Managing Connection Groups](managing-connection-groups.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/about-the-connection-group-file51.md b/mdop/appv-v5/about-the-connection-group-file51.md
index 4d840f5286..4b7274562f 100644
--- a/mdop/appv-v5/about-the-connection-group-file51.md
+++ b/mdop/appv-v5/about-the-connection-group-file51.md
@@ -1,8 +1,11 @@
 ---
 title: About the Connection Group File
 description: About the Connection Group File
-author: jamiejdt
+author: dansimp
 ms.assetid: 1f4df515-f5f6-4b58-91a8-c71598cb3ea4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -44,12 +47,12 @@ ms.date: 06/16/2016
 
 
 
    Example file path
    
-
    %APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups\{6CCC7575-162E-4152-9407-ED411DA138F4}\{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}.
    
+
    %APPDATA%\Microsoft\AppV\Client\Catalog\PackageGroups{6CCC7575-162E-4152-9407-ED411DA138F4}{4D1E16E1-8EF8-41ED-92D5-8910A8527F96}.
    
 
 
 
 
- 
+ 
 
 ## Structure of the connection group XML file
 
@@ -84,7 +87,7 @@ The following table describes the parameters in the XML file that define the con
 
    Schema name
    
 
    Name of the schema.
    
 
    Applicable starting in App-V 5.0 SP3: If you want to use the new “optional packages” and “use any version” features that are described in this table, you must specify the following schema in the XML file:
    
-
    xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup"
    
+
    xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup";
    
 
 
 
    AppConnectionGroupId
    
@@ -109,7 +112,7 @@ The following table describes the parameters in the XML file that define the con
 
 
 
- 
+ 
 
 ### Parameters that define the packages in the connection group
 
@@ -143,24 +146,66 @@ In the <Packages> section of the connection group XML file, you list the m
 
  • “true” – package is optional in the connection group
    • 
 
  • “false” – package is required in the connection group
    • 
 
-
    See [How to Use Optional Packages in Connection Groups](how-to-use-optional-packages-in-connection-groups51.md).
    
+
    See How to Use Optional Packages in Connection Groups.
    
 
 
 
 
- 
+ 
 
 ### App-V example connection group XML file
 
 The following example connection group XML file shows examples of the fields in the previous tables and highlights the items that are new starting in App-V 5.0 SP3.
 
-`````  ``    ``    ``  `
+```XML
+
+
+      
+    
+      
+  
+
+```
 
 ### App-V 5.0 through App-V 5.0 SP2 example connection group XML file
 
 The following example connection group XML file applies to App-V 5.0 through App-V 5.0 SP2. It shows examples of the fields in the previous table, but it excludes the changes described above for App-V 5.0 SP3.
 
-`````  ``    ``    ``  `
+```XML
+
+
+  
+    
+    
+ 
+
+```
 
 ## Configuring the priority of packages in a connection group
 
@@ -176,7 +221,7 @@ You can use the connection group file to configure each connection group by usin
     **Note**  
     Priority is required only if the package is associated with more than one connection group.
 
-     
+     
 
 -   Specify package precedence within the connection group.
 
@@ -271,7 +316,7 @@ The virtual application Microsoft Outlook is running in virtual environment **XY
 
 
 
- 
+ 
 
 
 
@@ -283,9 +328,9 @@ The virtual application Microsoft Outlook is running in virtual environment **XY
 
 [Managing Connection Groups](managing-connection-groups51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/about-the-connection-group-virtual-environment.md b/mdop/appv-v5/about-the-connection-group-virtual-environment.md
index d53f043ea0..5b7e566fae 100644
--- a/mdop/appv-v5/about-the-connection-group-virtual-environment.md
+++ b/mdop/appv-v5/about-the-connection-group-virtual-environment.md
@@ -1,8 +1,11 @@
 ---
 title: About the Connection Group Virtual Environment
 description: About the Connection Group Virtual Environment
-author: jamiejdt
+author: dansimp
 ms.assetid: 535fa640-cbd9-425e-8437-94650a70c264
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -35,7 +38,7 @@ The connection group that is used is based on the order in which a package appea
 
 Consider the following example section:
 
-``` syntax
+```xml
 
 ```
 
diff --git a/mdop/appv-v5/about-the-connection-group-virtual-environment51.md b/mdop/appv-v5/about-the-connection-group-virtual-environment51.md
index 860efa5550..3acd54097c 100644
--- a/mdop/appv-v5/about-the-connection-group-virtual-environment51.md
+++ b/mdop/appv-v5/about-the-connection-group-virtual-environment51.md
@@ -1,8 +1,11 @@
 ---
 title: About the Connection Group Virtual Environment
 description: About the Connection Group Virtual Environment
-author: jamiejdt
+author: dansimp
 ms.assetid: b7bb0e3d-8cd5-45a9-b84e-c9ab4196a18c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -35,7 +38,7 @@ The connection group that is used is based on the order in which a package appea
 
 Consider the following example section:
 
-``` syntax
+```xml
 
 ```
 
diff --git a/mdop/appv-v5/accessibility-for-app-v-50.md b/mdop/appv-v5/accessibility-for-app-v-50.md
index 409f0e4558..4cc6cd8431 100644
--- a/mdop/appv-v5/accessibility-for-app-v-50.md
+++ b/mdop/appv-v5/accessibility-for-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: Accessibility for App-V 5.0
 description: Accessibility for App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 56696523-6332-4bbe-8ddf-32b1dfe38131
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -22,7 +25,7 @@ Microsoft is committed to making its products and services easier for everyone t
 **Important**  
 The information in this section only applies to the App-V 5.0 sequencer. For specific information about the App-V 5.0 server, see the Keyboard Shortcuts for the App-V 5.0 Management Server section of this document.
 
- 
+ 
 
 Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key:
 
@@ -35,7 +38,7 @@ Access keys let you quickly use a command by pressing a few keys. You can get to
 **Note**  
 To cancel the action that you are taking and hide the keyboard shortcuts, press ALT.
 
- 
+ 
 
 ## Keyboard Shortcuts for the App-V 5.0 Management Server
 
@@ -77,7 +80,7 @@ Keyboard Shortcuts for the App-V 5.0 Management Server:
 
 
 
- 
+ 
 
 ## Documentation in Alternative Formats
 
@@ -111,13 +114,13 @@ For information about the availability of Microsoft product documentation and bo
 
    (609) 987-8116
    
 
 
-
    [http://www.learningally.org/](https://go.microsoft.com/fwlink/?linkid=239)
    
+
    http://www.learningally.org/
    
 
    Web addresses can change, so you might be unable to connect to the website or sites mentioned here.
    
 
 
 
 
- 
+ 
 
 ## Customer Service for People with Hearing Impairments
 
@@ -140,9 +143,9 @@ For more information about how accessible technology for computers helps to impr
 
 [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/accessibility-for-app-v-51.md b/mdop/appv-v5/accessibility-for-app-v-51.md
index bf57157a1d..30d29b8cd1 100644
--- a/mdop/appv-v5/accessibility-for-app-v-51.md
+++ b/mdop/appv-v5/accessibility-for-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: Accessibility for App-V 5.1
 description: Accessibility for App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: ef3f7742-f2e9-4748-ad60-74e0961b1bd9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -48,7 +51,7 @@ Following are the keyboard Shortcuts for the App-V 5.1 Management Server:
 
 
 
- 
+ 
 
 ## Keyboard Shortcuts for the App-V 5.1 Sequencer
 
@@ -78,14 +81,14 @@ Following are the keyboard shortcuts for the Virtual Registry tab in the package
 
 
 
- 
+ 
 
 ### Access Any Command with a Few Keystrokes
 
 **Important**  
 The information in this section only applies to the App-V 5.1 sequencer. For specific information about the App-V 5.1 server, see the Keyboard Shortcuts for the App-V 5.1 Management Server section of this document.
 
- 
+ 
 
 Access keys let you quickly use a command by pressing a few keys. You can get to most commands by using two keystrokes. To use an access key:
 
@@ -98,7 +101,7 @@ Access keys let you quickly use a command by pressing a few keys. You can get to
 **Note**  
 To cancel the action that you are taking and hide the keyboard shortcuts, press ALT.
 
- 
+ 
 
 ## Documentation in Alternative Formats
 
@@ -132,13 +135,13 @@ For information about the availability of Microsoft product documentation and bo
 
    (609) 987-8116
    
 
 
-
    [http://www.learningally.org/](https://go.microsoft.com/fwlink/?linkid=239)
    
+
    http://www.learningally.org/
    
 
    Web addresses can change, so you might be unable to connect to the website or sites mentioned here.
    
 
 
 
 
- 
+ 
 
 ## Customer Service for People with Hearing Impairments
 
@@ -161,9 +164,9 @@ For more information about how accessible technology for computers helps to impr
 
 [Getting Started with App-V 5.1](getting-started-with-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md b/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md
index 9a03e5912d..50214f1054 100644
--- a/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md
+++ b/mdop/appv-v5/administering-app-v-50-virtual-applications-by-using-the-management-console.md
@@ -1,13 +1,16 @@
 ---
 title: Administering App-V 5.0 Virtual Applications by Using the Management Console
 description: Administering App-V 5.0 Virtual Applications by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: e9280dbd-782b-493a-b495-daab25247795
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
-ms.date: 06/16/2016
+ms.date: 10/03/2016
 ---
 
 
@@ -51,7 +54,7 @@ The most common tasks that you can perform with the App-V 5.0 Management console
 
 -   [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md)
 
--   [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md)
+-   [Configure Applications and Default Virtual Application Extensions in Management Console](configure-applications-and-default-virtual-application-extensions-in-management-console.md)
 
 The main elements of the App-V 5.0 Management Console are:
 
diff --git a/mdop/appv-v5/administering-app-v-51-by-using-powershell.md b/mdop/appv-v5/administering-app-v-51-by-using-powershell.md
index 9bc74c04be..be798c4983 100644
--- a/mdop/appv-v5/administering-app-v-51-by-using-powershell.md
+++ b/mdop/appv-v5/administering-app-v-51-by-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: Administering App-V 5.1 by Using PowerShell
 description: Administering App-V 5.1 by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 9e10ff07-2cd9-4dc1-9e99-582f90c36081
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -34,54 +37,54 @@ Use the following PowerShell procedures to perform various App-V 5.1 tasks.
 
 
 
-
    [How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md)
    
+
    How to Load the PowerShell Cmdlets and Get Cmdlet Help
    
 
    Describes how to install the PowerShell cmdlets and find cmdlet help and examples.
    
 
 
-
    [How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md)
    
+
    How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell
    
 
    Describes how to manage the client package lifecycle on a stand-alone computer using PowerShell.
    
 
 
-
    [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md)
    
+
    How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell
    
 
    Describes how to manage connection groups using PowerShell.
    
 
 
-
    [How to Modify Client Configuration by Using PowerShell](how-to-modify-client-configuration-by-using-powershell51.md)
    
+
    How to Modify Client Configuration by Using PowerShell
    
 
    Describes how to modify the client using PowerShell.
    
 
 
-
    [How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell51.md)
    
+
    How to Apply the User Configuration File by Using PowerShell
    
 
    Describes how to apply a user configuration file using PowerShell.
    
 
 
-
    [How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell51.md)
    
+
    How to Apply the Deployment Configuration File by Using PowerShell
    
 
    Describes how to apply a deployment configuration file using PowerShell.
    
 
 
-
    [How to Sequence a Package by Using PowerShell](how-to-sequence-a-package--by-using-powershell-51.md)
    
+
    How to Sequence a Package by Using PowerShell
    
 
    Describes how to create a new package using PowerShell.
    
 
 
-
    [How to Create a Package Accelerator by Using PowerShell](how-to-create-a-package-accelerator-by-using-powershell51.md)
    
+
    How to Create a Package Accelerator by Using PowerShell
    
 
    Describes how to create a package accelerator using PowerShell. You can use package accelerators automatically sequence large, complex applications.
    
 
 
-
    [How to Enable Reporting on the App-V 5.1 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md)
    
+
    How to Enable Reporting on the App-V 5.1 Client by Using PowerShell
    
 
    Describes how to enable the computer running the App-V 5.1 to send reporting information.
    
 
 
-
    [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md)
    
+
    How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell
    
 
    Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.
    
 
 
 
 
- 
+ 
 
 **Important**  
 Make sure that any script you execute with your App-V packages matches the execution policy that you have configured for PowerShell.
 
- 
+ 
 
 ## PowerShell Error Handling
 
@@ -118,7 +121,7 @@ Use the following table for information about App-V 5.1 PowerShell error handlin
 
 
 
- 
+ 
 
 
 
@@ -130,9 +133,9 @@ Use the following table for information about App-V 5.1 PowerShell error handlin
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md b/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md
index cdba1e3c73..26ff07008e 100644
--- a/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md
+++ b/mdop/appv-v5/administering-app-v-51-virtual-applications-by-using-the-management-console.md
@@ -1,8 +1,11 @@
 ---
 title: Administering App-V 5.1 Virtual Applications by Using the Management Console
 description: Administering App-V 5.1 Virtual Applications by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: a4d078aa-ec54-4fa4-9463-bfb3b971d724
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -51,7 +54,7 @@ The most common tasks that you can perform with the App-V 5.1 Management console
 
 -   [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md)
 
--   [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md)
+-   [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md)
 
 The main elements of the App-V 5.1 Management Console are:
 
@@ -86,12 +89,12 @@ The main elements of the App-V 5.1 Management Console are:
 
 
 
- 
+ 
 
 **Important**  
 JavaScript must be enabled on the browser that opens the Web Management Console.
 
- 
+ 
 
 
 
@@ -105,9 +108,9 @@ JavaScript must be enabled on the browser that opens the Web Management Console.
 
 -   [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/administering-app-v-by-using-powershell.md b/mdop/appv-v5/administering-app-v-by-using-powershell.md
index 2e57a49140..8d6b8071a3 100644
--- a/mdop/appv-v5/administering-app-v-by-using-powershell.md
+++ b/mdop/appv-v5/administering-app-v-by-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: Administering App-V by Using PowerShell
 description: Administering App-V by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 1ff4686a-1e19-4eff-b648-ada091281094
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -34,49 +37,49 @@ Use the following PowerShell procedures to perform various App-V 5.0 tasks.
 
 
 
-
    [How to Load the PowerShell Cmdlets and Get Cmdlet Help](how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md)
    
+
    How to Load the PowerShell Cmdlets and Get Cmdlet Help
    
 
    Describes how to install the PowerShell cmdlets and find cmdlet help and examples.
    
 
 
-
    [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md)
    
+
    How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell
    
 
    Describes how to manage the client package lifecycle on a stand-alone computer using PowerShell.
    
 
 
-
    [How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell](how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md)
    
+
    How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell
    
 
    Describes how to manage connection groups using PowerShell.
    
 
 
-
    [How to Modify Client Configuration by Using PowerShell](how-to-modify-client-configuration-by-using-powershell.md)
    
+
    How to Modify Client Configuration by Using PowerShell
    
 
    Describes how to modify the client using PowerShell.
    
 
 
-
    [How to Apply the User Configuration File by Using PowerShell](how-to-apply-the-user-configuration-file-by-using-powershell.md)
    
+
    How to Apply the User Configuration File by Using PowerShell
    
 
    Describes how to apply a user configuration file using PowerShell.
    
 
 
-
    [How to Apply the Deployment Configuration File by Using PowerShell](how-to-apply-the-deployment-configuration-file-by-using-powershell.md)
    
+
    How to Apply the Deployment Configuration File by Using PowerShell
    
 
    Describes how to apply a deployment configuration file using PowerShell.
    
 
 
-
    [How to Sequence a Package by Using PowerShell](how-to-sequence-a-package--by-using-powershell-50.md)
    
+
    How to Sequence a Package by Using PowerShell
    
 
    Describes how to create a new package using PowerShell.
    
 
 
-
    [How to Create a Package Accelerator by Using PowerShell](how-to-create-a-package-accelerator-by-using-powershell.md)
    
+
    How to Create a Package Accelerator by Using PowerShell
    
 
    Describes how to create a package accelerator using PowerShell. You can use package accelerators automatically sequence large, complex applications.
    
 
 
-
    [How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md)
    
+
    How to Enable Reporting on the App-V 5.0 Client by Using PowerShell
    
 
    Describes how to enable the computer running the App-V 5.0 to send reporting information.
    
 
 
-
    [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md)
    
+
    How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell
    
 
    Describes how to take an array of account names and to convert each of them to the corresponding SID in standard and hexadecimal formats.
    
 
 
 
 
- 
+ 
 
 ## PowerShell Error Handling
 
@@ -113,7 +116,7 @@ Use the following table for information about App-V 5.0 PowerShell error handlin
 
 
 
- 
+ 
 
 
 
@@ -125,9 +128,9 @@ Use the following table for information about App-V 5.0 PowerShell error handlin
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/app-v-50-capacity-planning.md b/mdop/appv-v5/app-v-50-capacity-planning.md
index f390bd34b8..3fe507eacf 100644
--- a/mdop/appv-v5/app-v-50-capacity-planning.md
+++ b/mdop/appv-v5/app-v-50-capacity-planning.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.0 Capacity Planning
 description: App-V 5.0 Capacity Planning
-author: jamiejdt
+author: dansimp
 ms.assetid: 56f48b00-cd91-4280-9481-5372a0e2e792
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ The following recommendations can be used as a baseline to help determine capaci
 **Important**  
 Use the information in this section only as a general guide for planning your App-V 5.0 deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary.
 
- 
+ 
 
 ## Determine the Project Scope
 
@@ -49,7 +52,7 @@ Before you design the App-V 5.0 infrastructure, you must determine the project
 
 
 
- 
+ 
 
 ## Determine Which App-V 5.0 Infrastructure is Required
 
@@ -59,7 +62,7 @@ Both of the following models require the App-V 5.0 client to be installed on the
 
 You can also manage your App-V 5.0 environment using an Electronic Software Distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information see [Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md).
 
- 
+ 
 
 -   **Standalone Model** - The standalone model allows virtual applications to be Windows Installer-enabled for distribution without streaming. App-V 5.0 in Standalone Mode consists of the sequencer and the client; no additional components are required. Applications are prepared for virtualization using a process called sequencing. For more information see, [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md). The stand-alone model is recommended for the following scenarios:
 
@@ -74,7 +77,7 @@ You can also manage your App-V 5.0 environment using an Electronic Software Dist
     **Important**  
     The App-V 5.0 full infrastructure model requires Microsoft SQL Server to store configuration data. For more information see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md).
 
-     
+     
 
     -   When you want to use the Management Server to publish the application to target computers.
 
@@ -90,7 +93,7 @@ The following section provides information about end-to-end App-V 5.0 sizing and
 **Note**  
 Round trip response time on the client is the time taken by the computer running the App-V 5.0 client to receive a successful notification from the publishing server. Round trip response time on the publishing server is the time taken by the computer running the publishing server to receive a successful package metadata update from the management server.
 
- 
+ 
 
 -   20,000 clients can target a single publishing server to obtain the package refreshes in an acceptable round trip time. (<3 seconds)
 
@@ -104,7 +107,7 @@ The App-V 5.0 publishing servers require the management server for package refre
 **Note**  
 The default refresh time on the App-V 5.0 publishing server is ten minutes.
 
- 
+ 
 
 When multiple simultaneous publishing servers contact a single management server for package metadata refreshes, the following three factors influence the round trip response time on the publishing server:
 
@@ -119,7 +122,7 @@ The following table displays more information about each factor that impacts rou
 **Note**  
 Round trip response time is the time taken by the computer running the App-V 5.0 publishing server to receive a successful package metadata update from the management server.
 
- 
+ 
 
 @@ -163,7 +166,7 @@ Round trip response time is the time taken by the computer running the App-V 5.0
 
    
 

 
    
 
- 
+ 
 
 The following table displays sample values for each of the previous factors. In each variation, 120 packages are refreshed from the App-V 5.0management server.
 
@@ -356,7 +359,7 @@ The following table displays sample values for each of the previous factors. In
 
 
 
- 
+ 
 
 The CPU utilization of the computer running the management server is around 25% irrespective of the number of publishing servers targeting it. The Microsoft SQL Server database transactions/sec, batch requests/sec and user connections are identical irrespective of the number of publishing servers. For example: Transactions/sec is ~30, batch requests ~200, and user connects ~6.
 
@@ -457,7 +460,7 @@ Using a geographically distributed deployment, where the management server & pub
 
 
 
- 
+ 
 
 Whether the management server and publishing servers are connected over a slow link network, or a high speed network, the management server can handle approximately 15,000 package refresh requests in 30 minutes.
 
@@ -469,7 +472,7 @@ App-V 5.0 clients send reporting data to the reporting server. The reporting ser
 **Note**  
 Round trip response time is the time taken by the computer running the App-V 5.0 client to send the reporting information to the reporting server and receive a successful notification from the reporting server.
 
- 
+ 
 
 @@ -515,7 +518,7 @@ Round trip response time is the time taken by the computer running the App-V 5.0
 
    
 

 
    
 
- 
+ 
 
 **Calculating random delay**:
 
@@ -539,7 +542,7 @@ The following list displays the main factors to consider when setting up the App
 
 -   The available network bandwidth in your environment between the client and the App-V 5.0 publishing server.
 
- 
+ 
 
 @@ -582,12 +585,12 @@ The following list displays the main factors to consider when setting up the App
 
    
 

 
    
 
- 
+ 
 
 **Note**  
 The publishing server CPU usage is always high during the time interval when it has to process simultaneous requests (>90% in most cases). The publishing server can handle ~1500 client requests in 1 second.
 
- 
+ 
 
 @@ -729,7 +732,7 @@ The publishing server CPU usage is always high during the time interval when it
 
    
 

 
    
 
- 
+ 
 
 ##  App-V 5.0 Streaming Capacity Planning Recommendations
 
@@ -745,7 +748,7 @@ The following list identifies the main factors to consider when setting up the A
 
 -   The available network bandwidth in your environment between the client and the streaming server.
 
- 
+ 
 
 @@ -785,7 +788,7 @@ The following list identifies the main factors to consider when setting up the A
 
    
 

 
    
 
- 
+ 
 
 The following table displays sample values for each of the factors in the previous list:
 
@@ -914,14 +917,14 @@ The following table displays sample values for each of the factors in the previo
 
 
 
- 
+ 
 
 Each App-V 5.0 streaming server should be able to handle a minimum of 200 clients concurrently streaming virtualized applications.
 
 **Note**  
 The actual time to it will take to stream is determined primarily by the number of clients streaming simultaneously, number of packages, package size, the server’s network activity, and network conditions.
 
- 
+ 
 
 For example, an average user can stream a 100 MB package in less than 2 minutes, when 100 simultaneous clients are streaming from the server. However, a package of size 1 GB could take up to 30 minutes. In most real world environments streaming demand is not uniformly distributed, you will need to understand the approximate peak streaming requirements present in your environment in order to properly size the number of required streaming servers.
 
@@ -950,9 +953,9 @@ Although there are a number of fault-tolerance strategies and technologies avail
 
 [Planning to Deploy App-V](planning-to-deploy-app-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/app-v-50-deployment-checklist.md b/mdop/appv-v5/app-v-50-deployment-checklist.md
index 07e3aaa3b1..2b84226c10 100644
--- a/mdop/appv-v5/app-v-50-deployment-checklist.md
+++ b/mdop/appv-v5/app-v-50-deployment-checklist.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.0 Deployment Checklist
 description: App-V 5.0 Deployment Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: d6d93152-82b4-4b02-8b11-ed21d3331f00
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 This checklist can be used to help you during Microsoft Application Virtualization (App-V) 5.0 deployment.
 
-**Note**  
+**Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when deploying App-V 5.0 features. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+
 
 @@ -40,37 +43,36 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
    
 

    
 Checklist box
 
    Complete the planning phase to prepare the computing environment for App-V 5.0 deployment.
    [App-V 5.0 Planning Checklist](app-v-50-planning-checklist.md)
    App-V 5.0 Planning Checklist
    		
 
    		
 
    
 
    
 Checklist box
 
    Review the App-V 5.0 supported configurations information to make sure selected client and server computers are supported for App-V 5.0 feature installation.
    [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md)
    App-V 5.0 Supported Configurations
    		
 
    		
 
    
 
    
 Checklist box
 
    Run App-V 5.0 Setup to deploy the required App-V 5.0 features for your environment.
    
 
    
-Note  
-
    Keep track of the names of the servers and associated URL’s created during installation. This information will be used throughout the installation process.
    
+Note
    Keep track of the names of the servers and associated URL’s created during installation. This information will be used throughout the installation process.
    
 
    
 
    
- 
+
 
    		
 
    
     		
 
    		
 
    
     
 
    
 
- 
+
 
 
 
@@ -82,9 +84,9 @@ This checklist outlines the recommended steps and a high-level list of items to
 
 [Deploying App-V 5.0](deploying-app-v-50.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/app-v-50-planning-checklist.md b/mdop/appv-v5/app-v-50-planning-checklist.md
index 58eeb4965b..3eeb21f0b8 100644
--- a/mdop/appv-v5/app-v-50-planning-checklist.md
+++ b/mdop/appv-v5/app-v-50-planning-checklist.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.0 Planning Checklist
 description: App-V 5.0 Planning Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 81d3fa62-3c9e-4de7-a9da-cd13112b0862
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ This checklist can be used to help you plan for preparing your computing environ
 **Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when planning for an App-V 5.0 deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+ 
 
 @@ -40,43 +43,43 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
-
+
-
+
-
+
-
+
    
 

    
 Checklist box
 
    Review the getting started information about App-V 5.0 to gain a basic understanding of the product before beginning deployment planning.
    [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md)
    Getting Started with App-V 5.0
    		
 
    		
 
    
 
    
 Checklist box
 
    Plan for App-V 5.0 1.0 Deployment Prerequisites and prepare your computing environment.
    [App-V 5.0 Prerequisites](app-v-50-prerequisites.md)
    App-V 5.0 Prerequisites
    		
 
    		
 
    
 
    
 Checklist box
 
    If you plan to use the App-V 5.0 management server, plan for the required roles.
    [Planning for the App-V 5.0 Server Deployment](planning-for-the-app-v-50-server-deployment.md)
    Planning for the App-V 5.0 Server Deployment
    		
 
    		
 
    
 
    
 Checklist box
 
    Plan for the App-V 5.0 sequencer and client so you to create and run virtualized applications.
    [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md)
    Planning for the App-V 5.0 Sequencer and Client Deployment
    		
 
    		
 
    
 
    
 Checklist box
 
    If applicable, review the options and steps for migrating from a previous version of App-V.
    [Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v.md)
    Planning for Migrating from a Previous Version of App-V
    		
 
    		
 
    
 
    
 Checklist box
 
    Plan for running App-V 5.0 clients using in shared content store mode.
    [How to Install the App-V 5.0 Client for Shared Content Store Mode](how-to-install-the-app-v-50-client-for-shared-content-store-mode.md)
    How to Install the App-V 5.0 Client for Shared Content Store Mode
    		
 
    		
 
    
     
 
    
 
- 
+ 
 
 
 
@@ -88,9 +91,9 @@ This checklist outlines the recommended steps and a high-level list of items to
 
 [Planning for App-V 5.0](planning-for-app-v-50-rc.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/app-v-50-prerequisites.md b/mdop/appv-v5/app-v-50-prerequisites.md
index 122f51ecd4..1d1dcd7770 100644
--- a/mdop/appv-v5/app-v-50-prerequisites.md
+++ b/mdop/appv-v5/app-v-50-prerequisites.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.0 Prerequisites
 description: App-V 5.0 Prerequisites
-author: jamiejdt
+author: dansimp
 ms.assetid: 9756b571-c785-4ce6-a95c-d4e134e89429
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,7 +19,7 @@ ms.date: 08/30/2016
 
 Before you begin the Microsoft Application Virtualization (App-V) 5.0 Setup, you should make sure that you have met the prerequisites to install the product. This topic contains information to help you successfully plan for preparing your computing environment before you deploy the App-V 5.0 features.
 
-**Important**  
+**Important**  
 **The prerequisites in this article apply only to App-V 5.0**. For additional prerequisites that apply to App-V 5.0 Service Packs, see the following web pages:
 
 -   [What's new in App-V 5.0 SP1](whats-new-in-app-v-50-sp1.md)
@@ -25,7 +28,7 @@ Before you begin the Microsoft Application Virtualization (App-V) 5.0 Setup, you
 
 -   [App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md)
 
- 
+
 
 The following table lists prerequisite information that pertains to specific operating systems.
 
@@ -50,7 +53,7 @@ The following table lists prerequisite information that pertains to specific ope
 
    The following prerequisites are already installed:
    
 
      
 
    • Microsoft .NET Framework 4.5 – you do not need Microsoft .NET Framework 4
      • 
-
    • Windows PowerShell 3.0
      • 
+
    • Windows PowerShell 3.0
      • 
 
    
 
 
@@ -60,21 +63,21 @@ The following table lists prerequisite information that pertains to specific ope
 
  • Windows Server 2008
    • 
 
 
    You may want to download the following KB:
    
-
    [Microsoft Security Advisory: Insecure library loading could allow remote code execution](https://support.microsoft.com/kb/2533623)
    
+
    Microsoft Security Advisory: Insecure library loading could allow remote code execution
    
 
    Be sure to check for subsequent KBs that have superseded this one, and note that some KBs may require that you uninstall previous updates.
    
 
 
 
 
- 
+
 
 ## Installation prerequisites for App-V 5.0
 
 
-**Note**  
-The following prerequisites are already installed for computers that run Windows 8.
+**Note**  
+The following prerequisites are already installed for computers that run Windows 8.
+
 
- 
 
 Each of the App-V 5.0 features have specific prerequisites that must be met before the App-V 5.0 features can be successfully installed.
 
@@ -97,48 +100,46 @@ The following table lists the installation prerequisites for the App-V 5.0 clien
 
 
    Software requirements
    
 
 
 
 
 
- 
+
 
 ### Prerequisites for the App-V 5.0 Remote Desktop Services client
 
-**Note**  
-The following prerequisites are already installed for computers that run Windows Server 2012.
+**Note**  
+The following prerequisites are already installed for computers that run Windows Server 2012.
+
 
- 
 
 The following table lists the installation prerequisites for the App-V 5.0 Remote Desktop Services client:
 
@@ -157,55 +158,53 @@ The following table lists the installation prerequisites for the App-V 5.0 Remot
 
 
    Software requirements
    
 
 
 
 
 
- 
+
 
 ### Prerequisites for the App-V 5.0 Sequencer
 
-**Note**  
-The following prerequisites are already installed for computers that run Windows 8 and Windows Server 2012.
+**Note**  
+The following prerequisites are already installed for computers that run Windows 8 and Windows Server 2012.
+
 
- 
 
 The following table lists the installation prerequisites for the App-V 5.0 Sequencer. If possible, the computer that runs the Sequencer should have the same hardware and software configurations as the computers that will run the virtual applications.
 
-**Note**  
+**Note**  
 If the system requirements of a locally installed application exceed the requirements of the Sequencer, you must meet the requirements of that application. Additionally, because the sequencing process is system resource-intensive, we recommend that the computer that runs the Sequencer has plenty of memory, a fast processor, and a fast hard drive. For more information see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md).
 
- 
+
 
 @@ -222,62 +221,61 @@ If the system requirements of a locally installed application exceed the require
 
    
 

    
 
    Software requirements
    		
 
 
    
     
 
    
 
- 
+
 
 ### Prerequisites for the App-V 5.0 server
 
-**Note**  
-The following prerequisites are already installed for computers that run Windows Server 2012:
+**Note**  
+The following prerequisites are already installed for computers that run Windows Server 2012:
 
 -   Microsoft .NET Framework 4.5. This eliminates the Microsoft .NET Framework 4 requirement.
 
--   Windows PowerShell 3.0
+-   Windows PowerShell 3.0
 
 -   Download and install [KB2533623](https://support.microsoft.com/kb/2533623) (http://support.microsoft.com/kb/2533623)
 
-    **Important**  
+    **Important**  
     You can still download install the previous KB. However, it may have been replaced with a more recent version.
 
-     
 
- 
+
+
 
 The following table lists the installation prerequisites for the App-V 5.0 server. The account that you use to install the server components must have administrative rights on the computer that you are installing on. This account must also have the ability to query Active Directory Directory Services. Before you install and configure the App-V 5.0 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to the specified ports.
 
-**Note**  
+**Note**  
 Web Distributed Authoring and Versioning (WebDAV) is automatically disabled for the Management Service.
 
- 
+
 
 The App-V 5.0 server is supported for a standalone deployment, where all the components are deployed on the same server, and a distributed deployment. Depending on the topology that you use to deploy the App-V 5.0 server, the data that you will need for each component will slightly change.
 
-**Important**  
+**Important**  
 The installation of the App-V 5.0 server on a computer that runs any previous version or component of App-V is not supported. Additionally, the installation of the server components on a computer that runs Server Core or a Domain Controller is also not supported.
 
- 
+
 
 @@ -294,27 +292,25 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
 
@@ -420,7 +412,7 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
 
    
 

    
 
    Management Server
    		
 
 
    The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management server.
    
@@ -323,11 +319,10 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
 
  • Location of the App-V 5.0 management database - SQL Server Name, SQL Instance Name, Database Name.
    • 
 
  • Access rights for the App-V 5.0 management console - This is the user or the group that should be granted access to the management console at the end of the deployment. After the deployment, only these users will have access to the management console until additional administrators are added through the management console.
    
 
    
-Note  
-
    Security groups and single users are not supported. You must specify an AD DS group.
    
+Note
    Security groups and single users are not supported. You must specify an AD DS group.
    
 
    
 
    
- 
+
 
    • 
 
  • App-V 5.0 management service website name – specify a name for the website or use the default name.
    • 
 
  • App-V 5.0 management service port binding - this should be a unique port number that is not used by another website on the computer.
    • 
@@ -338,15 +333,14 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
 
    Management Database
    		
 
    
 
    
-Note  
-
    The database is required only when using the App-V 5.0 management server.
    
+Note
    The database is required only when using the App-V 5.0 management server.
    
 
    
 
    
- 
+
 
    
 
 
    The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 management database.
    
 
      
@@ -355,20 +349,19 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
 
    • Custom App-V 5.0 database name (if applicable) – you must specify a unique database name. The default value for the management database is AppVManagement.
      • 
 
    • App-V 5.0 management server location – specifies the machine account on which the management server is deployed. This should be specified in the following format Domain\MachineAccount.
      • 
 
    • App-V 5.0 management server installation administrator - specifies the account that will be used to install the App-V 5.0 management server. You should use the following format: Domain\AdministratorLoginName.
      • 
-
    • Microsoft SQL Server Service Agent - configure the computer running the App-V 5.0 Management Database so that Microsoft SQL Server Agent service is restarted automatically. For more information see [Configure SQL Server Agent to Restart Services Automatically](https://go.microsoft.com/fwlink/?LinkId=273725) (https://go.microsoft.com/fwlink/?LinkId=273725).
      • 
+
    • Microsoft SQL Server Service Agent - configure the computer running the App-V 5.0 Management Database so that Microsoft SQL Server Agent service is restarted automatically. For more information see Configure SQL Server Agent to Restart Services Automatically (https://go.microsoft.com/fwlink/?LinkId=273725).
      • 
 
    		
 
    
 
    
 
    Reporting Server
    		
 
      
-
    • [Microsoft .NET Framework 4 (Full Package)](https://www.microsoft.com/download/details.aspx?id=17718) (http://www.microsoft.com/download/details.aspx?id=17718)
      • 
-
    • [Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)](https://go.microsoft.com/fwlink/?LinkId=267110)(https://go.microsoft.com/fwlink/?LinkId=267110)
      • 
+
    • Microsoft .NET Framework 4 (Full Package) (http://www.microsoft.com/download/details.aspx?id=17718)
      • 
+
    • Microsoft Visual C++ 2010 SP1 Redistributable Package (x86)(https://go.microsoft.com/fwlink/?LinkId=267110)
      • 
 
    • 
-Note  
-
      To help reduce the risk of unwanted or malicious data being sent to the reporting server, you should restrict access to the Reporting Web Service per your corporate security policy.
      
+Note
      To help reduce the risk of unwanted or malicious data being sent to the reporting server, you should restrict access to the Reporting Web Service per your corporate security policy.
      
 
      
 
      
- 
+
 
      
 
      Windows Web Server with the IIS role with the following features: Common HTTP Features (static content and default document), Application Development (ASP.NET, .NET Extensibility, ISAPI Extensions and ISAPI Filters), Security (Windows Authentication, Request Filtering), Security (Windows Authentication, Request Filtering), Management Tools (IIS Management Console)
      • 
 
    • 64-bit ASP.NET registration
      • 
@@ -381,15 +374,14 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
 
    Reporting Database
    		
 
    
 
    
-Note  
-
    The database is required only when using the App-V 5.0 reporting server.
    
+Note
    The database is required only when using the App-V 5.0 reporting server.
    
 
    
 
    
- 
+
 
    
 
 
    The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 reporting database.
    
 
      
@@ -404,15 +396,15 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
 
    
 
    Publishing Server
    		
 
 
    The App-V 5.0 server components are dependent but they have varying requirements and installation options that must be deployed. Use the following information to prepare your environment to run the App-V 5.0 publishing server.
    
 
      
 
    • Installation location - by default this component is installed to %PROGRAMFILES%\Microsoft Application Virtualization Server.
      • 
-
    • App-V 5.0 management service URL – specifies the URL of the App-V 5.0 management service. This is the port that the publishing server communicates with, and it should be specified using the following format: http://localhost:12345.
      • 
+
    • App-V 5.0 management service URL – specifies the URL of the App-V 5.0 management service. This is the port that the publishing server communicates with, and it should be specified using the following format: http://localhost:12345.
      • 
 
    • App-V 5.0 publishing service website name – specifies the name of the website or the default name that will be used.
      • 
 
    • App-V 5.0 publishing service port binding - This should be a unique port number that is not already used by another website that runs on the computer.
      • 
 
    
 
    
 
- 
+
 
 
 
@@ -434,9 +426,9 @@ The installation of the App-V 5.0 server on a computer that runs any previous ve
 
 [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/app-v-50-security-considerations.md b/mdop/appv-v5/app-v-50-security-considerations.md
index bc02f92332..3425e93637 100644
--- a/mdop/appv-v5/app-v-50-security-considerations.md
+++ b/mdop/appv-v5/app-v-50-security-considerations.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.0 Security Considerations
 description: App-V 5.0 Security Considerations
-author: jamiejdt
+author: dansimp
 ms.assetid: 1e7292a0-7972-4b4f-85a9-eaf33f6c563a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 08/30/2016
 
 This topic contains a brief overview of the accounts and groups, log files, and other security-related considerations for App-V 5.0.
 
-**Important**  
+**Important**  
 App-V 5.0 is not a security product and does not provide any guarantees for a secure environment.
 
- 
+
 
 ## PackageStoreAccessControl (PSAC) feature has been deprecated
 
@@ -42,14 +45,14 @@ Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature that wa
 
 A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary App-V 5.0 local groups on the App-V 5.0 servers.
 
-**Note**  
+**Note**  
 App-V client computer accounts that need to connect to the publishing server must be part of the publishing server’s **Users** local group. By default, all computers in the domain are part of the **Authorized Users** group, which is part of the **Users** local group.
 
- 
+
 
 ###  App-V 5.0 server security
 
-No groups are created automatically during App-V 5.0 Setup. You should create the following Active Directory Domain Services global groups to manage App-V 5.0 server operations.
+No groups are created automatically during App-V 5.0 Setup. You should create the following Active Directory Domain Services global groups to manage App-V 5.0 server operations.
 
 @@ -67,11 +70,10 @@ No groups are created automatically during App-V 5.0 Setup. You should create th
 
@@ -81,38 +83,36 @@ No groups are created automatically during App-V 5.0 Setup. You should create th
 
    
 

    App-V Management Admin group
    		
 
    Used to manage the App-V 5.0 management server. This group is created during the App-V 5.0 Management Server installation.
    
 
    
-Important  
-
    There is no method to create the group using the management console after you have completed the installation.
    
+Important
    There is no method to create the group using the management console after you have completed the installation.
    
 
    
 
    
- 
+
 
    		
 
    
 
    
 
    App-V Management Service install admin account
    
 
    
-Note  
-
    This is only required if management database is being installed separately from the service.
    
+Note
    This is only required if management database is being installed separately from the service.
    
 
    
 
    
- 
+
 
    		
 
    Provides public access to schema-version table in management database. This account should be created during the App-V 5.0 management database installation.
    		
 
    
 
    
 
    App-V Reporting Service install admin account
    
 
    
-Note  
-
    This is only required if reporting database is being installed separately from the service.
    
+Note
    This is only required if reporting database is being installed separately from the service.
    
 
    
 
    
- 
+
 
    		
 
    Public access to schema-version table in reporting database. This account should be created during the App-V 5.0 reporting database installation.
    		
 
    
     
 
    
 
- 
+
 
 Consider the following additional information:
 
 -   Access to the package shares - If a share exists on the same computer as the management Server, the **Network** service requires read access to the share. In addition, each App-V client computer must have read access to the package share.
 
-    **Note**  
+    **Note**  
     In previous versions of App-V, package share was referred to as content share.
 
-     
+
 
 -   Registering publishing servers with Management Server - A publishing server must be registered with the Management server. For example, it must be added to the database, so that the Publishing server machine accounts are able to call into the Management service API.
 
@@ -126,35 +126,3 @@ The following will help you plan how to ensure that virtualized packages are sec
 
 
 During App-V 5.0 Setup, setup log files are created in the **%temp%** folder of the installing user.
-
-[]()  
-
-[]()  
-
-[]()  
-
-[]()  
-
-[]()  
-
-[]()  
-
-[]()  
-
-****
-
-[]()  
-
-
-
-
-
-
- 
-
- 
-
-
-
-
-
diff --git a/mdop/appv-v5/app-v-50-sp3-prerequisites.md b/mdop/appv-v5/app-v-50-sp3-prerequisites.md
index b3b1e67d35..4b92ce66e0 100644
--- a/mdop/appv-v5/app-v-50-sp3-prerequisites.md
+++ b/mdop/appv-v5/app-v-50-sp3-prerequisites.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.0 SP3 Prerequisites
 description: App-V 5.0 SP3 Prerequisites
-author: jamiejdt
+author: dansimp
 ms.assetid: fa8d5578-3a53-4e8a-95c7-e7a5f6e4a31c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -45,13 +48,12 @@ The following table indicates the software that is already installed for differe
 
    The following prerequisite software is already installed:
    
 
      
 
    • Microsoft .NET Framework 4.5
      • 
-
    • Windows PowerShell 3.0
      
+
    • Windows PowerShell 3.0
      
 
      
-Note  
-
      Installing PowerShell 3.0 requires a restart.
      
+Note
      Installing PowerShell 3.0 requires a restart.
      
 
      
 
      
- 
+
 
      • 
 
    
 
@@ -62,7 +64,7 @@ The following table indicates the software that is already installed for differe
 
 
 
- 
+
 
 ## App-V Server prerequisite software
 
@@ -114,7 +116,7 @@ Install the required prerequisite software for the App-V 5.0 SP3 Server componen
 
 
 
- 
+
 
 ### Management server prerequisite software
 
@@ -132,22 +134,22 @@ Install the required prerequisite software for the App-V 5.0 SP3 Server componen
 
 
 
    Supported version of SQL Server
    
-
    For supported versions, see [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md).
    
+
    For supported versions, see App-V 5.0 SP3 Supported Configurations.
    
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Windows PowerShell 3.0](https://www.microsoft.com/download/details.aspx?id=34595)
    
-
    Installing PowerShell 3.0 requires a restart.
    
+
    Windows PowerShell 3.0
    
+
    Installing PowerShell 3.0 requires a restart.
    
 
 
-
    Download and install [KB2533623](https://support.microsoft.com/kb/2533623)
    
+
    Download and install KB2533623
    
 
    Applies to Windows 7 only.
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
@@ -213,7 +215,7 @@ Install the required prerequisite software for the App-V 5.0 SP3 Server componen
 
 
 
- 
+
 
 ### Management server database prerequisite software
 
@@ -232,11 +234,11 @@ The Management database is required only if you are using the App-V 5.0 SP3 Mana
 
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
@@ -266,12 +268,12 @@ The Management database is required only if you are using the App-V 5.0 SP3 Mana
 
 
 
    Microsoft SQL Server Service Agent
    
-
    Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see [Configure SQL Server Agent to Restart Services Automatically](https://technet.microsoft.com/magazine/gg313742.aspx).
    
+
    Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see Configure SQL Server Agent to Restart Services Automatically.
    
 
 
 
 
- 
+
 
 ### Publishing server prerequisite software
 
@@ -288,11 +290,11 @@ The Management database is required only if you are using the App-V 5.0 SP3 Mana
 
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
@@ -352,15 +354,15 @@ The Management database is required only if you are using the App-V 5.0 SP3 Mana
 
 
 
    Management server and Publishing server are installed on the same server
    
-
    http://localhost:12345
    
+
    http://localhost:12345
    
 
 
 
    Management server and Publishing server are installed on different servers
    
-
    http://MyAppvServer.MyDomain.com
    
+
    http://MyAppvServer.MyDomain.com
    
 
 
 
-
     
    
+
     
    
 
    
 
 
@@ -374,7 +376,7 @@ The Management database is required only if you are using the App-V 5.0 SP3 Mana
 
 
 
- 
+
 
 ### Reporting server prerequisite software
 
@@ -392,14 +394,14 @@ The Management database is required only if you are using the App-V 5.0 SP3 Mana
 
 
 
    Supported version of SQL Server
    
-
    For supported versions, see [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md).
    
+
    For supported versions, see App-V 5.0 SP3 Supported Configurations.
    
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
@@ -454,7 +456,7 @@ The Management database is required only if you are using the App-V 5.0 SP3 Mana
 
 
 
- 
+
 
 ### Reporting database prerequisite software
 
@@ -473,11 +475,11 @@ The Reporting database is required only if you are using the App-V 5.0 SP3 Repor
 
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
@@ -512,7 +514,7 @@ The Reporting database is required only if you are using the App-V 5.0 SP3 Repor
 
 
 
- 
+
 
 ## App-V client prerequisite software
 
@@ -532,26 +534,26 @@ Install the following prerequisite software for the App-V client.
 
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Windows PowerShell 3.0](https://www.microsoft.com/download/details.aspx?id=34595)
    
+
    Windows PowerShell 3.0
    
 
    
-
    Installing PowerShell 3.0 requires a restart.
    
+
    Installing PowerShell 3.0 requires a restart.
    
 
 
-
    [KB2533623](https://support.microsoft.com/kb/2533623)
    
+
    KB2533623
    
 
    Applies to Windows 7 only: Download and install the KB.
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
 
 
- 
+
 
 ## Remote Desktop Services client prerequisite software
 
@@ -571,26 +573,26 @@ Install the following prerequisite software for the App-V Remote Desktop Service
 
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Windows PowerShell 3.0](https://www.microsoft.com/download/details.aspx?id=34595)
    
+
    Windows PowerShell 3.0
    
 
    
-
    Installing PowerShell 3.0 requires a restart.
    
+
    Installing PowerShell 3.0 requires a restart.
    
 
 
-
    [KB2533623](https://support.microsoft.com/kb/2533623)
    
+
    KB2533623
    
 
    Applies to Windows 7 only: Download and install the KB.
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
 
 
- 
+
 
 ## Sequencer prerequisite software
 
@@ -614,26 +616,26 @@ Install the following prerequisite software for the App-V Remote Desktop Service
 
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Windows PowerShell 3.0](https://www.microsoft.com/download/details.aspx?id=34595)
    
+
    Windows PowerShell 3.0
    
 
    
-
    Installing PowerShell 3.0 requires a restart.
    
+
    Installing PowerShell 3.0 requires a restart.
    
 
 
-
    [KB2533623](https://support.microsoft.com/kb/2533623)
    
+
    KB2533623
    
 
    Applies to Windows 7 only: Download and install the KB.
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
 
 
- 
+
 
 
 
@@ -647,9 +649,9 @@ Install the following prerequisite software for the App-V Remote Desktop Service
 
 [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/app-v-50-sp3-supported-configurations.md b/mdop/appv-v5/app-v-50-sp3-supported-configurations.md
index 92d0906da7..8341bc668d 100644
--- a/mdop/appv-v5/app-v-50-sp3-supported-configurations.md
+++ b/mdop/appv-v5/app-v-50-sp3-supported-configurations.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.0 SP3 Supported Configurations
 description: App-V 5.0 SP3 Supported Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: 08ced79a-0ed3-43c3-82e7-de01c1f33e81
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -44,7 +47,7 @@ The following table lists the operating systems that are supported for the App-V
 **Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). See [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976) for more information.
 
- 
+ 
 
 @@ -78,12 +81,12 @@ Microsoft provides support for the current service pack and, in some cases, the
 
    
 

 
    
 
- 
+ 
 
 **Important**  
 Deployment of the Management server role to a computer with Remote Desktop Sharing (RDS) enabled is not supported.
 
- 
+ 
 
 ### Management server hardware requirements
 
@@ -129,7 +132,7 @@ The following table lists the SQL Server versions that are supported for the App
 
 
 
- 
+ 
 
 ### Publishing server operating system requirements
 
@@ -167,7 +170,7 @@ The following table lists the operating systems that are supported for the App-V
 
 
 
- 
+ 
 
 ### Publishing server hardware requirements
 
@@ -215,7 +218,7 @@ The following table lists the operating systems that are supported for the App-V
 
 
 
- 
+ 
 
 ### Reporting server hardware requirements
 
@@ -263,7 +266,7 @@ The following table lists the SQL Server versions that are supported for the App
 
 
 
- 
+ 
 
 ## App-V client system requirements
 
@@ -302,7 +305,7 @@ The following table lists the operating systems that are supported for the App-V
 
 
 
- 
+ 
 
 The following App-V client installation scenarios are not supported, except as noted:
 
@@ -359,7 +362,7 @@ The following table lists the operating systems that are supported for App-V 5.0
 
 
 
- 
+ 
 
 ### Remote Desktop Services client hardware requirements
 
@@ -423,7 +426,7 @@ The following table lists the operating systems that are supported for the App-V
 
 
 
- 
+ 
 
 ### Sequencer hardware requirements
 
@@ -454,9 +457,9 @@ For more information about how Configuration Manager integrates with App-V, see
 
 [App-V 5.0 SP3 Prerequisites](app-v-50-sp3-prerequisites.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/app-v-50-supported-configurations.md b/mdop/appv-v5/app-v-50-supported-configurations.md
index f2e59289eb..4b23a3738a 100644
--- a/mdop/appv-v5/app-v-50-supported-configurations.md
+++ b/mdop/appv-v5/app-v-50-supported-configurations.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.0 Supported Configurations
 description: App-V 5.0 Supported Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: 3787ff63-7ce7-45a8-8f01-81b4b6dced34
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,7 +19,7 @@ ms.date: 08/30/2016
 
 This topic specifies the requirements that are necessary to install and run Microsoft Application Virtualization (App-V) 5.0 in your environment.
 
-**Important**  
+**Important**  
 **The supported configurations in this article apply only to App-V 5.0**. For supported configurations that apply to App-V 5.0 Service Packs, see the following web pages:
 
 -   [What's new in App-V 5.0 SP1](whats-new-in-app-v-50-sp1.md)
@@ -25,24 +28,24 @@ This topic specifies the requirements that are necessary to install and run Micr
 
 -   [App-V 5.0 SP3 Supported Configurations](app-v-50-sp3-supported-configurations.md)
 
- 
+
 
 ##  App-V 5.0 server system requirements
 
 
-**Important**  
+**Important**  
 The App-V 5.0 server does not support the following scenarios:
 
- 
+
 
 -   Deployment to a computer that runs Microsoft Windows Server Core.
 
 -   Deployment to a computer that runs a previous version of App-V 5.0 server components.
 
-    **Note**  
-    You can install App-V 5.0 side-by-side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V 5.0 side-by-side with the App-V 4.5 Application Virtualization Management Service (HWS) server is not supported.
+    **Note**  
+    You can install App-V 5.0 side-by-side with the App-V 4.5 Lightweight Streaming Server (LWS) server only. Deployment of App-V 5.0 side-by-side with the App-V 4.5 Application Virtualization Management Service (HWS) server is not supported.
+
 
-     
 
 -   Deployment to a computer that runs Microsoft SQL Server Express edition.
 
@@ -56,10 +59,10 @@ The App-V 5.0 server does not support the following scenarios:
 
 The following table lists the operating systems that are supported for the App-V 5.0 management server installation.
 
-**Note**  
+**Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+
 
 @@ -78,19 +81,19 @@ Microsoft provides support for the current service pack and, in some cases, the
 
-
+
-
+
-
+
@@ -98,12 +101,12 @@ Microsoft provides support for the current service pack and, in some cases, the
 
    
 

 
 
    Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server)
    Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server)
    		
 
    R2
    		
 
    SP1 and higher
    		
 
    64-bit
    		
 
    
 
    Microsoft Windows Server 2012 (Standard, Datacenter)
    Microsoft Windows Server 2012 (Standard, Datacenter)
    		
 
    		
 
 
    64-bit
    		
 
    
 
    Microsoft Windows Server 2012 (Standard, Datacenter)
    Microsoft Windows Server 2012 (Standard, Datacenter)
    		
 
    R2
    		
 
 
    64-bit
    
 
    
 
- 
 
-**Important**  
+
+**Important**  
 Deployment of the management server role to a computer with Remote Desktop Sharing (RDS) enabled is not supported.
 
- 
+
 
 ### Management Server hardware requirements
 
@@ -117,10 +120,10 @@ Deployment of the management server role to a computer with Remote Desktop Shari
 
 The following table lists the operating systems that are supported for the App-V 5.0 publishing server installation.
 
-**Note**  
+**Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+
 
 @@ -139,19 +142,19 @@ Microsoft provides support for the current service pack and, in some cases, the
 
-
+
-
+
-
+
@@ -159,7 +162,7 @@ Microsoft provides support for the current service pack and, in some cases, the
 
    
 

 
 
    Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server)
    Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server)
    		
 
    R2
    		
 
    		
 
    64-bit
    		
 
    
 
    Microsoft Windows Server 2012 (Standard, Datacenter)
    Microsoft Windows Server 2012 (Standard, Datacenter)
    		
 
    		
 
 
    64-bit
    		
 
    
 
    Microsoft Windows Server 2012 (Standard, Datacenter)
    Microsoft Windows Server 2012 (Standard, Datacenter)
    		
 
    R2
    		
 
 
    64-bit
    
 
    
 
- 
+
 
 ### Publishing Server hardware requirements
 
@@ -173,10 +176,10 @@ Microsoft provides support for the current service pack and, in some cases, the
 
 The following table lists the operating systems that are supported for the App-V 5.0 reporting server installation.
 
-**Note**  
+**Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+
 
 @@ -195,19 +198,19 @@ Microsoft provides support for the current service pack and, in some cases, the
 
-
+
-
+
-
+
@@ -215,7 +218,7 @@ Microsoft provides support for the current service pack and, in some cases, the
 
    
 

 
 
    Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server)
    Microsoft Windows Server 2008 (Standard, Enterprise, Datacenter, or Web Server)
    		
 
    R2
    		
 
    		
 
    64-bit
    		
 
    
 
    Microsoft Windows Server 2012 (Standard, Datacenter)
    Microsoft Windows Server 2012 (Standard, Datacenter)
    		
 
    		
 
 
    64-bit
    		
 
    
 
    Microsoft Windows Server 2012 (Standard, Datacenter)
    Microsoft Windows Server 2012 (Standard, Datacenter)
    		
 
    R2
    		
 
 
    64-bit
    
 
    
 
- 
+
 
 ### Reporting Server hardware requirements
 
@@ -225,9 +228,9 @@ Microsoft provides support for the current service pack and, in some cases, the
 
 -   Disk space—200 MB available hard disk space
 
-### SQL Server database requirements
+### SQL Server database requirements
 
-The following table lists the SQL Server versions that are supported for the App-V 5.0 database and server installation.
+The following table lists the SQL Server versions that are supported for the App-V 5.0 database and server installation.
 
 @@ -249,7 +252,7 @@ The following table lists the SQL Server versions that are supported for the Ap
 
-
@@ -257,7 +260,7 @@ The following table lists the SQL Server versions that are supported for the Ap
 
-
@@ -265,7 +268,7 @@ The following table lists the SQL Server versions that are supported for the Ap
 
-
@@ -274,17 +277,17 @@ The following table lists the SQL Server versions that are supported for the Ap
 
    
 

 
    
 
    Management / Reporting
    Microsoft SQL Server 2008
    
+
    Microsoft SQL Server 2008
    
 
    (Standard, Enterprise, Datacenter, or the Developer Edition with the following feature: Database Engine Services.)
    		
 
    		
 
    
 
    
 
    Management / Reporting
    Microsoft SQL Server 2008 
    
+
    Microsoft SQL Server 2008 
    
 
    (Standard, Enterprise, Datacenter, or the Developer Edition with the following feature: Database Engine Services.)
    		
 
    R2
    		
 
    SP2
    
 
    
 
    Management / Reporting
    Microsoft SQL Server 2012
    
+
    Microsoft SQL Server 2012
    
 
    (Standard, Enterprise, Datacenter, or the Developer Edition with the following feature: Database Engine Services.)
    		
 
    		
 
    
 
    
 
- 
+
 
 ##  App-V 5.0 client system requirements
 
 
 The following table lists the operating systems that are supported for the App-V 5.0 client installation.
 
-**Note**  
+**Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+
 
 @@ -301,22 +304,21 @@ Microsoft provides support for the current service pack and, in some cases, the
 
-
+
-
+
@@ -325,13 +327,13 @@ Microsoft provides support for the current service pack and, in some cases, the
 
    
 

 
 
    Microsoft Windows 7
    Microsoft Windows 7
    		
 
    SP1
    		
 
    32-bit or 64-bit
    		
 
    
 
    Microsoft Windows 8
    Microsoft Windows 8
    		
 
    		
 
    32-bit or 64-bit
    		
 
    
 
    
 
    
-Important  
-
    Windows 8.1 is only supported by App-V 5.0 SP2
    
+Important
    Windows 8.1 is only supported by App-V 5.0 SP2
    
 
    
 
    
- 
+
 
    
 
    Windows 8.1
    		
 
    
 
    
 
- 
+
 
 The following App-V client installation scenarios are not supported, except as noted:
 
 -   Computers that run Windows Server
 
--   Computers that run App-V 4.6 SP1 or earlier versions
+-   Computers that run App-V 4.6 SP1 or earlier versions
 
 -   The App-V 5.0 Remote Desktop services client is supported only for RDS-enabled servers
 
@@ -350,34 +352,34 @@ The following list displays the supported hardware configuration for the App-V 5
 
 The following table lists the operating systems that are supported for App-V 5.0 Remote Desktop client installation.
 
-**Note**  
+**Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+
 
 Operating system
 Edition
 Service pack
-Microsoft Windows Server 2008
+Microsoft Windows Server 2008
 
 R2
 
 SP1
 
-Microsoft Windows Server 2012
+Microsoft Windows Server 2012
 
-**Important**  
-Windows Server 2012 R2 is only supported by App-V 5.0 SP2
+**Important**  
+Windows Server 2012 R2 is only supported by App-V 5.0 SP2
 
- 
 
-Microsoft Windows Server 2012 (Standard, Datacenter)
+
+Microsoft Windows Server 2012 (Standard, Datacenter)
 
 R2
 
 64-bit
 
- 
+
 
 ### Remote Desktop client hardware requirements
 
@@ -394,10 +396,10 @@ The following list displays the supported hardware configuration for the App-V 5
 
 The following table lists the operating systems that are supported for App-V 5.0 Sequencer installation.
 
-**Note**  
+**Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+
 
 @@ -416,24 +418,23 @@ Microsoft provides support for the current service pack and, in some cases, the
 
-
+
-
+
@@ -441,26 +442,25 @@ Microsoft provides support for the current service pack and, in some cases, the
 
-
+
-
+
+
    Microsoft Windows Server 2012
    
@@ -468,12 +468,12 @@ Microsoft provides support for the current service pack and, in some cases, the
 
    
 

 
 
    Microsoft Windows 7
    Microsoft Windows 7
    		
 
 
    SP1
    		
 
    32-bit and 64-bit
    		
 
    
 
    Microsoft Windows 8
    Microsoft Windows 8
    		
 
 
    		
 
    32-bit and 64-bit
    		
 
    
 
    
 
    
-Important  
-
    Windows 8.1 is only supported by App-V 5.0 SP2
    
+Important
    Windows 8.1 is only supported by App-V 5.0 SP2
    
 
    
 
    
- 
+
 
    
 
    Windows 8.1
    		
 
    32-bit or 64-bit
    		
 
    
 
    Microsoft Windows Server 2008
    Microsoft Windows Server 2008
    		
 
    R2
    		
 
    SP1
    		
 
    32-bit and 64-bit
    		
 
    
 
    Microsoft Windows Server 2012
    Microsoft Windows Server 2012
    		
 
 
    		
 
    32-bit and 64-bit
    		
 
    
 
    
 
    
-Important  
-
    Windows Server 2012 R2 is only supported by App-V 5.0 SP2
    
+Important
    Windows Server 2012 R2 is only supported by App-V 5.0 SP2
    
 
    
 
    
- 
+
 
    
-
    Microsoft Windows Server 2012
    		
 
    R2
    		
 
 
    64-bit
    
 
    
 
- 
+
 
 ## Supported versions of System Center Configuration Manager
 
 
-You can use Microsoft System Center 2012 Configuration Manager or System Center 2012 R2 Configuration Manager to manage App-V virtual applications, reporting, and other functions. The following table lists the supported versions of Configuration Manager for each applicable version of App-V.
+You can use Microsoft System Center 2012 Configuration Manager or System Center 2012 R2 Configuration Manager to manage App-V virtual applications, reporting, and other functions. The following table lists the supported versions of Configuration Manager for each applicable version of App-V.
 
 @@ -488,7 +488,7 @@ You can use Microsoft System Center 2012 Configuration Manager or System Cen
 
-
+
    
 

 
 
    Microsoft System Center 2012 Configuration Manager
    Microsoft System Center 2012 Configuration Manager
    		
 
      
 
    • App-V 5.0
      • 
 
    • App-V 5.0 SP1
      • 
@@ -506,7 +506,7 @@ You can use Microsoft System Center 2012 Configuration Manager or System Cen
 
    
 
    
 
- 
+
 
 For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx).
 
@@ -522,9 +522,9 @@ For more information about how Configuration Manager integrates with App-V, see
 
 [App-V 5.0 Prerequisites](app-v-50-prerequisites.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/app-v-51-capacity-planning.md b/mdop/appv-v5/app-v-51-capacity-planning.md
index 7a95357504..0473ec9858 100644
--- a/mdop/appv-v5/app-v-51-capacity-planning.md
+++ b/mdop/appv-v5/app-v-51-capacity-planning.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.1 Capacity Planning
 description: App-V 5.1 Capacity Planning
-author: jamiejdt
+author: dansimp
 ms.assetid: 7a98062f-5a60-49d6-ab40-dc6057e1dd5a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ The following recommendations can be used as a baseline to help determine capaci
 **Important**  
 Use the information in this section only as a general guide for planning your App-V 5.1 deployment. Your system capacity requirements will depend on the specific details of your hardware and application environment. Additionally, the performance numbers displayed in this document are examples and your results may vary.
 
- 
+ 
 
 ## Determine the Project Scope
 
@@ -49,7 +52,7 @@ Before you design the App-V 5.1 infrastructure, you must determine the project
 
 
 
- 
+ 
 
 ## Determine Which App-V 5.1 Infrastructure is Required
 
@@ -59,7 +62,7 @@ Both of the following models require the App-V 5.1 client to be installed on the
 
 You can also manage your App-V 5.1 environment using an Electronic Software Distribution (ESD) solution such as Microsoft Systems Center Configuration Manager. For more information see [How to deploy App-V 5.1 Packages Using Electronic Software Distribution](how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md).
 
- 
+ 
 
 -   **Standalone Model** - The standalone model allows virtual applications to be Windows Installer-enabled for distribution without streaming. App-V 5.1 in Standalone Mode consists of the sequencer and the client; no additional components are required. Applications are prepared for virtualization using a process called sequencing. For more information see, [Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md). The stand-alone model is recommended for the following scenarios:
 
@@ -74,7 +77,7 @@ You can also manage your App-V 5.1 environment using an Electronic Software Dist
     **Important**  
     The App-V 5.1 full infrastructure model requires Microsoft SQL Server to store configuration data. For more information see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md).
 
-     
+     
 
     -   When you want to use the Management Server to publish the application to target computers.
 
@@ -90,7 +93,7 @@ The following section provides information about end-to-end App-V 5.1 sizing and
 **Note**  
 Round trip response time on the client is the time taken by the computer running the App-V 5.1 client to receive a successful notification from the publishing server. Round trip response time on the publishing server is the time taken by the computer running the publishing server to receive a successful package metadata update from the management server.
 
- 
+ 
 
 -   20,000 clients can target a single publishing server to obtain the package refreshes in an acceptable round trip time. (<3 seconds)
 
@@ -104,7 +107,7 @@ The App-V 5.1 publishing servers require the management server for package refre
 **Note**  
 The default refresh time on the App-V 5.1 publishing server is ten minutes.
 
- 
+ 
 
 When multiple simultaneous publishing servers contact a single management server for package metadata refreshes, the following three factors influence the round trip response time on the publishing server:
 
@@ -119,7 +122,7 @@ The following table displays more information about each factor that impacts rou
 **Note**  
 Round trip response time is the time taken by the computer running the App-V 5.1 publishing server to receive a successful package metadata update from the management server.
 
- 
+ 
 
 @@ -163,7 +166,7 @@ Round trip response time is the time taken by the computer running the App-V 5.1
 
    
 

 
    
 
- 
+ 
 
 The following table displays sample values for each of the previous factors. In each variation, 120 packages are refreshed from the App-V 5.1management server.
 
@@ -356,7 +359,7 @@ The following table displays sample values for each of the previous factors. In
 
 
 
- 
+ 
 
 The CPU utilization of the computer running the management server is around 25% irrespective of the number of publishing servers targeting it. The Microsoft SQL Server database transactions/sec, batch requests/sec and user connections are identical irrespective of the number of publishing servers. For example: Transactions/sec is ~30, batch requests ~200, and user connects ~6.
 
@@ -457,7 +460,7 @@ Using a geographically distributed deployment, where the management server & pub
 
 
 
- 
+ 
 
 Whether the management server and publishing servers are connected over a slow link network, or a high speed network, the management server can handle approximately 15,000 package refresh requests in 30 minutes.
 
@@ -469,7 +472,7 @@ App-V 5.1 clients send reporting data to the reporting server. The reporting ser
 **Note**  
 Round trip response time is the time taken by the computer running the App-V 5.1 client to send the reporting information to the reporting server and receive a successful notification from the reporting server.
 
- 
+ 
 
 @@ -515,7 +518,7 @@ Round trip response time is the time taken by the computer running the App-V 5.1
 
    
 

 
    
 
- 
+ 
 
 **Calculating random delay**:
 
@@ -539,7 +542,7 @@ The following list displays the main factors to consider when setting up the App
 
 -   The available network bandwidth in your environment between the client and the App-V 5.1 publishing server.
 
- 
+ 
 
 @@ -582,12 +585,12 @@ The following list displays the main factors to consider when setting up the App
 
    
 

 
    
 
- 
+ 
 
 **Note**  
 The publishing server CPU usage is always high during the time interval when it has to process simultaneous requests (>90% in most cases). The publishing server can handle ~1500 client requests in 1 second.
 
- 
+ 
 
 @@ -729,7 +732,7 @@ The publishing server CPU usage is always high during the time interval when it
 
    
 

 
    
 
- 
+ 
 
 ##  App-V 5.1 Streaming Capacity Planning Recommendations
 
@@ -745,7 +748,7 @@ The following list identifies the main factors to consider when setting up the A
 
 -   The available network bandwidth in your environment between the client and the streaming server.
 
- 
+ 
 
 @@ -785,7 +788,7 @@ The following list identifies the main factors to consider when setting up the A
 
    
 

 
    
 
- 
+ 
 
 The following table displays sample values for each of the factors in the previous list:
 
@@ -914,14 +917,14 @@ The following table displays sample values for each of the factors in the previo
 
 
 
- 
+ 
 
 Each App-V 5.1 streaming server should be able to handle a minimum of 200 clients concurrently streaming virtualized applications.
 
 **Note**  
 The actual time to it will take to stream is determined primarily by the number of clients streaming simultaneously, number of packages, package size, the server’s network activity, and network conditions.
 
- 
+ 
 
 For example, an average user can stream a 100 MB package in less than 2 minutes, when 100 simultaneous clients are streaming from the server. However, a package of size 1 GB could take up to 30 minutes. In most real world environments streaming demand is not uniformly distributed, you will need to understand the approximate peak streaming requirements present in your environment in order to properly size the number of required streaming servers.
 
@@ -950,9 +953,9 @@ Although there are a number of fault-tolerance strategies and technologies avail
 
 [Planning to Deploy App-V](planning-to-deploy-app-v51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/app-v-51-deployment-checklist.md b/mdop/appv-v5/app-v-51-deployment-checklist.md
index 2ba65578f0..955988dde1 100644
--- a/mdop/appv-v5/app-v-51-deployment-checklist.md
+++ b/mdop/appv-v5/app-v-51-deployment-checklist.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.1 Deployment Checklist
 description: App-V 5.1 Deployment Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 44bed85a-e4f5-49d7-a308-a2b681f76372
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 This checklist can be used to help you during Microsoft Application Virtualization (App-V) 5.1 deployment.
 
-**Note**  
+**Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when deploying App-V 5.1 features. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+
 
 @@ -40,37 +43,36 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
    
 

    
 Checklist box
 
    Complete the planning phase to prepare the computing environment for App-V 5.1 deployment.
    [App-V 5.1 Planning Checklist](app-v-51-planning-checklist.md)
    App-V 5.1 Planning Checklist
    		
 
    		
 
    
 
    
 Checklist box
 
    Review the App-V 5.1 supported configurations information to make sure selected client and server computers are supported for App-V 5.1 feature installation.
    [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md)
    App-V 5.1 Supported Configurations
    		
 
    		
 
    
 
    
 Checklist box
 
    Run App-V 5.1 Setup to deploy the required App-V 5.1 features for your environment.
    
 
    
-Note  
-
    Keep track of the names of the servers and associated URL’s created during installation. This information will be used throughout the installation process.
    
+Note
    Keep track of the names of the servers and associated URL’s created during installation. This information will be used throughout the installation process.
    
 
    
 
    
- 
+
 
    		
 
    
     		
 
    		
 
    
     
 
    
 
- 
+
 
 
 
@@ -82,9 +84,9 @@ This checklist outlines the recommended steps and a high-level list of items to
 
 [Deploying App-V 5.1](deploying-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/app-v-51-planning-checklist.md b/mdop/appv-v5/app-v-51-planning-checklist.md
index e5b4625455..52ac3984ce 100644
--- a/mdop/appv-v5/app-v-51-planning-checklist.md
+++ b/mdop/appv-v5/app-v-51-planning-checklist.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.1 Planning Checklist
 description: App-V 5.1 Planning Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 1e26a861-0612-43a6-972f-375a40a8dcbc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ This checklist can be used to help you plan for preparing your computing environ
 **Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when planning for an App-V 5.1 deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+ 
 
 @@ -40,43 +43,43 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
-
+
-
+
-
+
-
+
    
 

    
 Checklist box
 
    Review the getting started information about App-V 5.1 to gain a basic understanding of the product before beginning deployment planning.
    [Getting Started with App-V 5.1](getting-started-with-app-v-51.md)
    Getting Started with App-V 5.1
    		
 
    		
 
    
 
    
 Checklist box
 
    Plan for App-V 5.1 1.0 Deployment Prerequisites and prepare your computing environment.
    [App-V 5.1 Prerequisites](app-v-51-prerequisites.md)
    App-V 5.1 Prerequisites
    		
 
    		
 
    
 
    
 Checklist box
 
    If you plan to use the App-V 5.1 management server, plan for the required roles.
    [Planning for the App-V 5.1 Server Deployment](planning-for-the-app-v-51-server-deployment.md)
    Planning for the App-V 5.1 Server Deployment
    		
 
    		
 
    
 
    
 Checklist box
 
    Plan for the App-V 5.1 sequencer and client so you to create and run virtualized applications.
    [Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md)
    Planning for the App-V 5.1 Sequencer and Client Deployment
    		
 
    		
 
    
 
    
 Checklist box
 
    If applicable, review the options and steps for migrating from a previous version of App-V.
    [Planning for Migrating from a Previous Version of App-V](planning-for-migrating-from-a-previous-version-of-app-v51.md)
    Planning for Migrating from a Previous Version of App-V
    		
 
    		
 
    
 
    
 Checklist box
 
    Plan for running App-V 5.1 clients using in shared content store mode.
    [How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md)
    How to Install the App-V 5.1 Client for Shared Content Store Mode
    		
 
    		
 
    
     
 
    
 
- 
+ 
 
 
 
@@ -88,9 +91,9 @@ This checklist outlines the recommended steps and a high-level list of items to
 
 [Planning for App-V 5.1](planning-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/app-v-51-prerequisites.md b/mdop/appv-v5/app-v-51-prerequisites.md
index d1b12390d3..f9709263ec 100644
--- a/mdop/appv-v5/app-v-51-prerequisites.md
+++ b/mdop/appv-v5/app-v-51-prerequisites.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.1 Prerequisites
 description: App-V 5.1 Prerequisites
-author: jamiejdt
+author: dansimp
 ms.assetid: 1bfa03c1-a4ae-45ec-8a2b-b10c2b94bfb0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -43,11 +46,10 @@ The following table indicates the software that is already installed for differe
 
    Windows 8.1
    
 
    All of the prerequisite software is already installed.
    
 
    
-Note  
-
    If you are running Windows 8, upgrade to Windows 8.1 before using App-V 5.1.
    
+Note
    If you are running Windows 8, upgrade to Windows 8.1 before using App-V 5.1.
    
 
    
 
    
- 
+
 
    
 
 
@@ -55,13 +57,12 @@ The following table indicates the software that is already installed for differe
 
    The following prerequisite software is already installed:
    
 
      
 
    • Microsoft .NET Framework 4.5
      • 
-
    • Windows PowerShell 3.0
      
+
    • Windows PowerShell 3.0
      
 
      
-Note  
-
      Installing PowerShell 3.0 requires a restart.
      
+Note
      Installing PowerShell 3.0 requires a restart.
      
 
      
 
      
- 
+
 
      • 
 
    
 
@@ -72,7 +73,7 @@ The following table indicates the software that is already installed for differe
 
 
 
- 
+
 
 ## App-V Server prerequisite software
 
@@ -124,7 +125,7 @@ Install the required prerequisite software for the App-V 5.1 Server components.
 
 
 
- 
+
 
 ### Management server prerequisite software
 
@@ -142,22 +143,22 @@ Install the required prerequisite software for the App-V 5.1 Server components.
 
 
 
    Supported version of SQL Server
    
-
    For supported versions, see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md).
    
+
    For supported versions, see App-V 5.1 Supported Configurations.
    
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Windows PowerShell 3.0](https://www.microsoft.com/download/details.aspx?id=34595)
    
-
    Installing PowerShell 3.0 requires a restart.
    
+
    Windows PowerShell 3.0
    
+
    Installing PowerShell 3.0 requires a restart.
    
 
 
-
    Download and install [KB2533623](https://support.microsoft.com/kb/2533623)
    
+
    Download and install KB2533623
    
 
    Applies to Windows 7 only.
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
@@ -219,12 +220,12 @@ Install the required prerequisite software for the App-V 5.1 Server components.
 
 
 
- 
 
-**Important**  
+
+**Important**  
 JavaScript must be enabled on the browser that opens the Web Management Console.
 
- 
+
 
 ### Management server database prerequisite software
 
@@ -243,11 +244,11 @@ The Management database is required only if you are using the App-V 5.1 Manageme
 
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
@@ -277,12 +278,12 @@ The Management database is required only if you are using the App-V 5.1 Manageme
 
 
 
    Microsoft SQL Server Service Agent
    
-
    Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see [Configure SQL Server Agent to Restart Services Automatically](https://technet.microsoft.com/magazine/gg313742.aspx).
    
+
    Configure the Management database computer so that the Microsoft SQL Server Agent service is restarted automatically. For instructions, see Configure SQL Server Agent to Restart Services Automatically.
    
 
 
 
 
- 
+
 
 ### Publishing server prerequisite software
 
@@ -299,11 +300,11 @@ The Management database is required only if you are using the App-V 5.1 Manageme
 
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
@@ -363,15 +364,15 @@ The Management database is required only if you are using the App-V 5.1 Manageme
 
 
 
    Management server and Publishing server are installed on the same server
    
-
    http://localhost:12345
    
+
    http://localhost:12345
    
 
 
 
    Management server and Publishing server are installed on different servers
    
-
    http://MyAppvServer.MyDomain.com
    
+
    http://MyAppvServer.MyDomain.com
    
 
 
 
-
     
    
+
     
    
 
    
 
 
@@ -385,7 +386,7 @@ The Management database is required only if you are using the App-V 5.1 Manageme
 
 
 
- 
+
 
 ### Reporting server prerequisite software
 
@@ -403,14 +404,14 @@ The Management database is required only if you are using the App-V 5.1 Manageme
 
 
 
    Supported version of SQL Server
    
-
    For supported versions, see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md).
    
+
    For supported versions, see App-V 5.1 Supported Configurations.
    
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
@@ -465,7 +466,7 @@ The Management database is required only if you are using the App-V 5.1 Manageme
 
 
 
- 
+
 
 ### Reporting database prerequisite software
 
@@ -484,11 +485,11 @@ The Reporting database is required only if you are using the App-V 5.1 Reporting
 
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
@@ -523,7 +524,7 @@ The Reporting database is required only if you are using the App-V 5.1 Reporting
 
 
 
- 
+
 
 ## App-V client prerequisite software
 
@@ -543,26 +544,26 @@ Install the following prerequisite software for the App-V client.
 
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Windows PowerShell 3.0](https://www.microsoft.com/download/details.aspx?id=34595)
    
+
    Windows PowerShell 3.0
    
 
    
-
    Installing PowerShell 3.0 requires a restart.
    
+
    Installing PowerShell 3.0 requires a restart.
    
 
 
-
    [KB2533623](https://support.microsoft.com/kb/2533623)
    
+
    KB2533623
    
 
    Applies to Windows 7 only: Download and install the KB.
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
 
 
- 
+
 
 ## Remote Desktop Services client prerequisite software
 
@@ -582,26 +583,26 @@ Install the following prerequisite software for the App-V Remote Desktop Service
 
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Windows PowerShell 3.0](https://www.microsoft.com/download/details.aspx?id=34595)
    
+
    Windows PowerShell 3.0
    
 
    
-
    Installing PowerShell 3.0 requires a restart.
    
+
    Installing PowerShell 3.0 requires a restart.
    
 
 
-
    [KB2533623](https://support.microsoft.com/kb/2533623)
    
+
    KB2533623
    
 
    Applies to Windows 7 only: Download and install the KB.
    
 
 
-
    [Visual C++ Redistributable Packages for Visual Studio 2013](https://www.microsoft.com/download/details.aspx?id=40784)
    
+
    Visual C++ Redistributable Packages for Visual Studio 2013
    
 
    
 
 
 
 
- 
+
 
 ## Sequencer prerequisite software
 
@@ -625,22 +626,22 @@ Install the following prerequisite software for the App-V Remote Desktop Service
 
 
 
-
    [Microsoft .NET Framework 4.5.1 (Web Installer)](https://www.microsoft.com//download/details.aspx?id=40773)
    
+
    Microsoft .NET Framework 4.5.1 (Web Installer)
    
 
    
 
 
-
    [Windows PowerShell 3.0](https://www.microsoft.com/download/details.aspx?id=34595)
    
+
    Windows PowerShell 3.0
    
 
    
-
    Installing PowerShell 3.0 requires a restart.
    
+
    Installing PowerShell 3.0 requires a restart.
    
 
 
-
    [KB2533623](https://support.microsoft.com/kb/2533623)
    
+
    KB2533623
    
 
    Applies to Windows 7 only: Download and install the KB.
    
 
 
 
 
- 
+
 
 
 
@@ -654,9 +655,9 @@ Install the following prerequisite software for the App-V Remote Desktop Service
 
 [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/app-v-51-security-considerations.md b/mdop/appv-v5/app-v-51-security-considerations.md
index 0129e9c720..cf442e5690 100644
--- a/mdop/appv-v5/app-v-51-security-considerations.md
+++ b/mdop/appv-v5/app-v-51-security-considerations.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.1 Security Considerations
 description: App-V 5.1 Security Considerations
-author: jamiejdt
+author: dansimp
 ms.assetid: 6bc6c1fc-f813-47d4-b763-06fd4faf6a72
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 08/30/2016
 
 This topic contains a brief overview of the accounts and groups, log files, and other security-related considerations for Microsoft Application Virtualization (App-V) 5.1.
 
-**Important**  
+**Important**  
 App-V 5.1 is not a security product and does not provide any guarantees for a secure environment.
 
- 
+
 
 ## PackageStoreAccessControl (PSAC) feature has been deprecated
 
@@ -42,14 +45,14 @@ Effective as of June, 2014, the PackageStoreAccessControl (PSAC) feature that wa
 
 A best practice for user account management is to create domain global groups and add user accounts to them. Then, add the domain global accounts to the necessary App-V 5.1 local groups on the App-V 5.1 servers.
 
-**Note**  
+**Note**  
 App-V client computer accounts that need to connect to the publishing server must be part of the publishing server’s **Users** local group. By default, all computers in the domain are part of the **Authorized Users** group, which is part of the **Users** local group.
 
- 
+
 
 ###  App-V 5.1 server security
 
-No groups are created automatically during App-V 5.1 Setup. You should create the following Active Directory Domain Services global groups to manage App-V 5.1 server operations.
+No groups are created automatically during App-V 5.1 Setup. You should create the following Active Directory Domain Services global groups to manage App-V 5.1 server operations.
 
 @@ -67,11 +70,10 @@ No groups are created automatically during App-V 5.1 Setup. You should create th
 
@@ -81,38 +83,36 @@ No groups are created automatically during App-V 5.1 Setup. You should create th
 
    
 

    App-V Management Admin group
    		
 
    Used to manage the App-V 5.1 management server. This group is created during the App-V 5.1 Management Server installation.
    
 
    
-Important  
-
    There is no method to create the group using the management console after you have completed the installation.
    
+Important
    There is no method to create the group using the management console after you have completed the installation.
    
 
    
 
    
- 
+
 
    		
 
    
 
    
 
    App-V Management Service install admin account
    
 
    
-Note  
-
    This is only required if management database is being installed separately from the service.
    
+Note
    This is only required if management database is being installed separately from the service.
    
 
    
 
    
- 
+
 
    		
 
    Provides public access to schema-version table in management database. This account should be created during the App-V 5.1 management database installation.
    		
 
    
 
    
 
    App-V Reporting Service install admin account
    
 
    
-Note  
-
    This is only required if reporting database is being installed separately from the service.
    
+Note
    This is only required if reporting database is being installed separately from the service.
    
 
    
 
    
- 
+
 
    		
 
    Public access to schema-version table in reporting database. This account should be created during the App-V 5.1 reporting database installation.
    		
 
    
     
 
    
 
- 
+
 
 Consider the following additional information:
 
 -   Access to the package shares - If a share exists on the same computer as the management Server, the **Network** service requires read access to the share. In addition, each App-V client computer must have read access to the package share.
 
-    **Note**  
+    **Note**  
     In previous versions of App-V, package share was referred to as content share.
 
-     
+
 
 -   Registering publishing servers with Management Server - A publishing server must be registered with the Management server. For example, it must be added to the database, so that the Publishing server machine accounts are able to call into the Management service API.
 
@@ -137,9 +137,9 @@ During App-V 5.1 Setup, setup log files are created in the **%temp%** folder of
 
 [Preparing Your Environment for App-V 5.1](preparing-your-environment-for-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/app-v-51-supported-configurations.md b/mdop/appv-v5/app-v-51-supported-configurations.md
index edb7f51bfb..aa2a35a202 100644
--- a/mdop/appv-v5/app-v-51-supported-configurations.md
+++ b/mdop/appv-v5/app-v-51-supported-configurations.md
@@ -1,8 +1,11 @@
 ---
 title: App-V 5.1 Supported Configurations
 description: App-V 5.1 Supported Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: 8b8db63b-f71c-4ae9-80e7-a6752334e1f6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -42,7 +45,7 @@ The following table lists the operating systems that are supported for the App-V
 **Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). See [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976) for more information.
 
- 
+ 
 
 @@ -81,12 +84,12 @@ Microsoft provides support for the current service pack and, in some cases, the
 
    
 

 
    
 
- 
+ 
 
 **Important**  
 Deployment of the Management server role to a computer with Remote Desktop Sharing (RDS) enabled is not supported.
 
- 
+ 
 
 ### Management server hardware requirements
 
@@ -115,11 +118,21 @@ The following table lists the SQL Server versions that are supported for the App
 
 
 
-
    Microsoft SQL Server 2014
    
+
    Microsoft SQL Server 2017
    
 
    
 
    32-bit or 64-bit
    
 
 
+
    Microsoft SQL Server 2016
    
+
    SP2
    
+
    32-bit or 64-bit
    
+
+
+
    Microsoft SQL Server 2014
    
+
    SP2
    
+
    32-bit or 64-bit
    
+
+
 
    Microsoft SQL Server 2012
    
 
    SP2
    
 
    32-bit or 64-bit
    
@@ -132,7 +145,7 @@ The following table lists the SQL Server versions that are supported for the App
 
 
 
- 
+ 
 
 ### Publishing server operating system requirements
 
@@ -175,7 +188,7 @@ The following table lists the operating systems that are supported for the App-V
 
 
 
- 
+ 
 
 ### Publishing server hardware requirements
 
@@ -228,7 +241,7 @@ The following table lists the operating systems that are supported for the App-V
 
 
 
- 
+ 
 
 ### Reporting server hardware requirements
 
@@ -259,11 +272,21 @@ The following table lists the SQL Server versions that are supported for the App
 
 
 
-
    Microsoft SQL Server 2014
    
+
    Microsoft SQL Server 2017
    
 
    
 
    32-bit or 64-bit
    
 
 
+
    Microsoft SQL Server 2016
    
+
    SP2
    
+
    32-bit or 64-bit
    
+
+
+
    Microsoft SQL Server 2014
    
+
    SP2
    
+
    32-bit or 64-bit
    
+
+
 
    Microsoft SQL Server 2012
    
 
    SP2
    
 
    32-bit or 64-bit
    
@@ -276,7 +299,7 @@ The following table lists the SQL Server versions that are supported for the App
 
 
 
- 
+ 
 
 ## App-V client system requirements
 
@@ -317,7 +340,7 @@ The following table lists the operating systems that are supported for the App-V
 
 
 
- 
+ 
 
 The following App-V client installation scenarios are not supported, except as noted:
 
@@ -379,7 +402,7 @@ The following table lists the operating systems that are supported for App-V 5.1
 
 
 
- 
+ 
 
 ### Remote Desktop Services client hardware requirements
 
@@ -448,7 +471,7 @@ The following table lists the operating systems that are supported for the App-V
 
 
 
- 
+ 
 
 ### Sequencer hardware requirements
 
@@ -516,7 +539,7 @@ The following App-V and System Center Configuration Manager version matrix shows
 
 
 
- 
+ 
 
 For more information about how Configuration Manager integrates with App-V, see [Planning for App-V Integration with Configuration Manager](https://technet.microsoft.com/library/jj822982.aspx).
 
@@ -532,9 +555,9 @@ For more information about how Configuration Manager integrates with App-V, see
 
 [App-V 5.1 Prerequisites](app-v-51-prerequisites.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/application-publishing-and-client-interaction.md b/mdop/appv-v5/application-publishing-and-client-interaction.md
index 8671541943..6c060982f7 100644
--- a/mdop/appv-v5/application-publishing-and-client-interaction.md
+++ b/mdop/appv-v5/application-publishing-and-client-interaction.md
@@ -1,8 +1,11 @@
 ---
 title: Application Publishing and Client Interaction
 description: Application Publishing and Client Interaction
-author: jamiejdt
+author: dansimp
 ms.assetid: c69a724a-85d1-4e2d-94a2-7ffe0b47d971
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -91,7 +94,7 @@ The Sequencer creates App-V packages and produces a virtualized application. The
 
 
 
- 
+ 
 
 For information about sequencing, see [Application Virtualization 5.0 Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760).
 
@@ -161,7 +164,7 @@ The appv file contains the following folder and files, which are used when creat
 
 
 
- 
+ 
 
 ## App-V client data storage locations
 
@@ -230,7 +233,7 @@ The App-V client performs tasks to ensure that virtual applications run properly
 
 
 
- 
+ 
 
 Additional details for the table are provided in the section below and throughout the document.
 
@@ -253,7 +256,7 @@ If the App-V Client is configured in Shared Content Store mode, no data is writt
 **Note**  
 The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client.
 
- 
+ 
 
 ### Package catalogs
 
@@ -279,7 +282,7 @@ The App-V Client manages the following two file-based locations:
 
 
 
    Default storage location
    
-
    %programdata%\Microsoft\AppV\Client\Catalog\
    
+
    %programdata%\Microsoft\AppV\Client\Catalog</code>
    
 
    This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.
    
 
 
@@ -306,7 +309,7 @@ The App-V Client manages the following two file-based locations:
 
 
 
- 
+ 
 
 ### User catalog
 
@@ -324,7 +327,7 @@ The App-V Client manages the following two file-based locations:
 
 
 
    Default storage location
    
-
    ppdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID
    
+
    appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID
    
 
 
 
    Files in the user catalog
    
@@ -345,7 +348,7 @@ The App-V Client manages the following two file-based locations:
 
 
 
- 
+ 
 
 ### Shortcut backups
 
@@ -380,12 +383,12 @@ When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file
 
 
    Registry.dat from Package Store
    
 
     > 
    
-
    %ProgramData%\Microsoft\AppV\Client\Vreg\{VersionGuid}.dat
    
+
    %ProgramData%\Microsoft\AppV\Client\Vreg{VersionGuid}.dat
    
 
 
 
 
- 
+ 
 
 When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY`. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a userspecific location `HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User`. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation.
 
@@ -439,9 +442,9 @@ There are two package registry locations and two connection group locations wher
 
 
 
- 
+ 
 
- 
+ 
 
 **Connection Group VReg:**
 
@@ -479,9 +482,9 @@ There are two package registry locations and two connection group locations wher
 
 
 
- 
+ 
 
- 
+ 
 
 There are two COW locations for HKLM; elevated and non-elevated processes. Elevated processes always write HKLM changes to the secure COW under HKLM. Non-elevated processes always write HKLM changes to the non-secure COW under HKCU\\Software\\Classes. When an application reads changes from HKLM, elevated processes will read changes from the secure COW under HKLM. Non-elevated reads from both, favoring the changes made in the unsecure COW first.
 
@@ -566,9 +569,9 @@ The App-V Client can be configured to change the default behavior of streaming.
 
 
 
- 
+ 
 
- 
+ 
 
 These settings affect the behavior of streaming App-V package assets to the client. By default, App-V only downloads the assets required after downloading the initial publishing and primary feature blocks. There are three specific behaviors around streaming packages that must be explained:
 
@@ -620,7 +623,7 @@ Together, these files and registry settings represent the user’s catalog, so e
 **Note**  
 The **Repair-AppvClientPackage** cmdlet does not repair the publishing state of packages, where the user’s App-V state under `HKEY_CURRENT_USER` is missing or mismatched with the data in %appdata%.
 
- 
+ 
 
 ### Registry-based data
 
@@ -642,8 +645,8 @@ App-V registry roaming falls into two scenarios, as shown in the following table
 
    Applications that are run as standard users
    
 
    When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:
    
 
      
-
    • HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages\{PkgGUID}\REGISTRY\MACHINE\SOFTWARE
      • 
-
    • HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\{PkgGUID}\REGISTRY\USER\{UserSID}\SOFTWARE
      • 
+
    • HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages{PkgGUID}\REGISTRY\MACHINE\SOFTWARE
      • 
+
    • HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}\REGISTRY\USER{UserSID}\SOFTWARE
      • 
 
    
 
    The locations are enabled for roaming based on the operating system settings.
    
 
@@ -656,14 +659,14 @@ App-V registry roaming falls into two scenarios, as shown in the following table
 
 
    In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location:
    
 
      
-
    • HKLM\SOFTWARE\Microsoft\AppV\Client\Packages\{PkgGUID}\{UserSID}\REGISTRY\MACHINE\SOFTWARE
      • 
-
    • HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\{PkgGUID}\Registry\User\{UserSID}\SOFTWARE
      • 
+
    • HKLM\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}{UserSID}\REGISTRY\MACHINE\SOFTWARE
      • 
+
    • HKCU\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}\Registry\User{UserSID}\SOFTWARE
      • 
 
    
 
 
 
 
- 
+ 
 
 ### App-V and folder redirection
 
@@ -687,30 +690,30 @@ The following table shows local and roaming locations, when folder redirection h
 
 
 
    ProgramFilesX86
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\ProgramFilesX86
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\ProgramFilesX86
    
 
 
 
    SystemX86
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\SystemX86
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\SystemX86
    
 
 
 
    Windows
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\Windows
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\Windows
    
 
 
 
    appv_ROOT
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\appv_ROOT
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\appv_ROOT
    
 
 
 
    AppData
    
-
    C:\users\jsmith\AppData\Roaming\Microsoft\AppV\Client\VFS\<GUID>\AppData
    
+
    C:\users\jsmith\AppData<strong>Roaming\Microsoft\AppV\Client\VFS&lt;GUID>\AppData
    
 
 
 
 
- 
+ 
 
- 
+ 
 
 The following table shows local and roaming locations, when folder redirection has been implemented for %AppData%, and the location has been redirected (typically to a network location).
 
@@ -728,30 +731,30 @@ The following table shows local and roaming locations, when folder redirection h
 
 
 
    ProgramFilesX86
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\ProgramFilesX86
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\ProgramFilesX86
    
 
 
 
    SystemX86
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\SystemX86
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\SystemX86
    
 
 
 
    Windows
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\Windows
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\Windows
    
 
 
 
    appv_ROOT
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\appv_ROOT
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\appv_ROOT
    
 
 
 
    AppData
    
-
    \\Fileserver\users\jsmith\roaming\Microsoft\AppV\Client\VFS\<GUID>\AppData
    
+
    \Fileserver\users\jsmith\roaming\Microsoft\AppV\Client\VFS&lt;GUID>\AppData
    
 
 
 
 
- 
+ 
 
- 
+ 
 
 The current App-V Client VFS driver cannot write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. The detailed steps of the processes are:
 
@@ -808,7 +811,7 @@ This document focuses on App-V Full Infrastructure solutions. For specific infor
 
 The App-V application lifecycle tasks are triggered at user login (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured during setup of the client or post-setup with PowerShell commands. See the How to Deploy the Client section on TechNet at: [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md) or utilize the PowerShell:
 
-``` syntax
+```powershell
 get-command *appv*
 ```
 
@@ -874,7 +877,7 @@ Adding an App-V package to the client is the first step of the publishing refres
 
     7.  Create the Registry.dat file from the package store to %ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat
 
-    8.  Register the package with the App-V Kernal Mode Driver HKLM\\Microsoft\\Software\\AppV\\MAV
+    8.  Register the package with the App-V Kernel Mode Driver HKLM\\Microsoft\\Software\\AppV\\MAV
 
     9.  Invoke scripting from the AppxManifest.xml or DeploymentConfig.xml file for Package Add timing.
 
@@ -885,7 +888,7 @@ Adding an App-V package to the client is the first step of the publishing refres
     **Note**  
     This will not perform a package deletion but rather remove integration points for the specific target (user or machine) and remove user catalog files (machine catalog files for globally published).
 
-     
+     
 
 6.  Invoke background load mounting based on client configuration.
 
@@ -894,7 +897,7 @@ Adding an App-V package to the client is the first step of the publishing refres
     **Note**  
     This condition occurs as a product of removal without unpublishing with background addition of the package.
 
-     
+     
 
 This completes an App-V package add of the publishing refresh process. The next step is publishing the package to the specific target (machine or user).
 
@@ -923,7 +926,7 @@ During the Publishing Refresh operation, the specific publishing operation (Publ
         **Note**  
         This enables restore extension points if the package is unpublished.
 
-         
+         
 
     3.  Run scripts targeted for publishing timing.
 
@@ -1014,7 +1017,7 @@ The App-V 5 package upgrade process differs from the older versions of App-V. Ap
 
 
 
- 
+ 
 
 When a task is placed in a pending state, the App-V client also generates a registry key for the pending task, as follows:
 
@@ -1041,7 +1044,7 @@ When a task is placed in a pending state, the App-V client also generates a regi
 
 
 
- 
+ 
 
 The following operations must be completed before users can use the newer version of the package:
 
@@ -1068,7 +1071,7 @@ The following operations must be completed before users can use the newer versio
 
 
 
- 
+ 
 
 Use the following example scenarios as a guide for updating packages.
 
@@ -1098,7 +1101,7 @@ Use the following example scenarios as a guide for updating packages.
 
 
 
- 
+ 
 
 ### Global vs user publishing
 
@@ -1171,7 +1174,7 @@ The short cut is one of the basic elements of integration with the OS and is the
 
 From the package manifest and dynamic configuration XML files, the path to a specific application executable can be found in a section similar to the following:
 
-``` syntax
+```xml
 
           
             [{Common Desktop}]\Adobe Reader 9.lnk
@@ -1191,7 +1194,7 @@ As mentioned previously, the App-V shortcuts are placed by default in the user
 
 The App-V Client manages the local operating system File Type Associations during publishing, which enables users to use file type invocations or to open a file with a specifically registered extension (.docx) to start an App-V application. File type associations are present in the manifest and dynamic configuration files as represented in the example below:
 
-``` syntax
+```xml
 
           
             
@@ -1237,7 +1240,7 @@ In this example:
 
 -   `"[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1"` is the command line, which points to the application executable
 
- 
+ 
 
 ### Shell extensions
 
@@ -1304,7 +1307,7 @@ The following table displays the supported shell extensions.
 
 
 
- 
+ 
 
 ### COM
 
@@ -1320,7 +1323,7 @@ App-V supports specific software clients and application capabilities extension
 
 Example of software client registration of an App-V based mail client.
 
-``` syntax
+```xml
     
       
       
@@ -1369,7 +1372,7 @@ In this example:
 
 -   `[{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll` is the MAPI dll registration
 
- 
+ 
 
 ### URL Protocol handler
 
@@ -1490,7 +1493,7 @@ Extension points are not all published the same way, where some extension points
 
 
 
- 
+ 
 
 ## Dynamic configuration processing
 
@@ -1507,7 +1510,7 @@ The example below shows the combination of the Manifest, Deployment Configuratio
 
 **Manifest**
 
-``` syntax
+```xml
 
      
           [{Common Programs}]\7-Zip\7-Zip File Manager.lnk
@@ -1519,7 +1522,7 @@ The example below shows the combination of the Manifest, Deployment Configuratio
 
 **Deployment Configuration**
 
-``` syntax
+```xml
 
      
           
@@ -1534,7 +1537,7 @@ The example below shows the combination of the Manifest, Deployment Configuratio
 
 **User Configuration**
 
-``` syntax
+```xml
 
      
 
@@ -1551,12 +1554,12 @@ The example below shows the combination of the Manifest, Deployment Configuratio
      
           [{Desktop}]\7-Zip\7-Zip File Manager.lnk
           [{AppVPackageRoot}]\7zFM.exe
-          [{AppVPackageRoot}]\7zFM.exe.O.ico
+          [{AppVPackageRoot}]\7zFM.exe.O.ico
      
      
           [{Common Programs}]\7-Zip\7-Zip File Manager.Ink
           [{AppVPackageRoot}]\7zFM.exe
-          [{AppVPackageRoot)]\7zFM.exe.O.ico
+          [{AppVPackageRoot)]\7zFM.exe.O.ico
      
 
      
@@ -1593,7 +1596,7 @@ During publishing of an App-V package with SxS assemblies the App-V Client will
 **Note**  
 UnPublishing or removing a package with an assembly does not remove the assemblies for that package.
 
- 
+ 
 
 ## Client logging
 
@@ -1607,7 +1610,7 @@ In App-V 5.0 SP3, some logs have been consolidated and moved to the following lo
 
 For a list of the moved logs, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved).
 
- 
+ 
 
 There are three specific categories of events recorded described below.
 
@@ -1622,9 +1625,9 @@ There are three specific categories of events recorded described below.
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/application-publishing-and-client-interaction51.md b/mdop/appv-v5/application-publishing-and-client-interaction51.md
index 0f95287f8c..ba6d7e8fe7 100644
--- a/mdop/appv-v5/application-publishing-and-client-interaction51.md
+++ b/mdop/appv-v5/application-publishing-and-client-interaction51.md
@@ -1,8 +1,11 @@
 ---
 title: Application Publishing and Client Interaction
 description: Application Publishing and Client Interaction
-author: jamiejdt
+author: dansimp
 ms.assetid: 36a4bf6f-a917-41a6-9856-6248686df352
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -91,7 +94,7 @@ The Sequencer creates App-V packages and produces a virtualized application. The
 
 
 
- 
+ 
 
 For information about sequencing, see [Application Virtualization Sequencing Guide](https://go.microsoft.com/fwlink/?LinkID=269810).
 
@@ -161,7 +164,7 @@ The appv file contains the following folder and files, which are used when creat
 
 
 
- 
+ 
 
 ## App-V client data storage locations
 
@@ -230,7 +233,7 @@ The App-V client performs tasks to ensure that virtual applications run properly
 
 
 
- 
+ 
 
 Additional details for the table are provided in the section below and throughout the document.
 
@@ -253,7 +256,7 @@ If the App-V Client is configured in Shared Content Store mode, no data is writt
 **Note**  
 The machine and package store must be located on a local drive, even when you’re using Shared Content Store configurations for the App-V Client.
 
- 
+ 
 
 ### Package catalogs
 
@@ -279,7 +282,7 @@ The App-V Client manages the following two file-based locations:
 
 
 
    Default storage location
    
-
    %programdata%\Microsoft\AppV\Client\Catalog\
    
+
    %programdata%\Microsoft\AppV\Client\Catalog</code>
    
 
    This location is not the same as the Package Store location. The Package Store is the golden or pristine copy of the package files.
    
 
 
@@ -306,7 +309,7 @@ The App-V Client manages the following two file-based locations:
 
 
 
- 
+ 
 
 ### User catalog
 
@@ -324,7 +327,7 @@ The App-V Client manages the following two file-based locations:
 
 
 
    Default storage location
    
-
    ppdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID
    
+
    appdata\roaming\Microsoft\AppV\Client\Catalog\Packages\PkgGUID\VerGUID
    
 
 
 
    Files in the user catalog
    
@@ -345,7 +348,7 @@ The App-V Client manages the following two file-based locations:
 
 
 
- 
+ 
 
 ### Shortcut backups
 
@@ -380,12 +383,12 @@ When a new package is added to the App-V Client, a copy of the REGISTRY.DAT file
 
 
    Registry.dat from Package Store
    
 
     > 
    
-
    %ProgramData%\Microsoft\AppV\Client\Vreg\{VersionGuid}.dat
    
+
    %ProgramData%\Microsoft\AppV\Client\Vreg{VersionGuid}.dat
    
 
 
 
 
- 
+ 
 
 When the first application from the package is launched on the client, the client stages or copies the contents out of the hive file, re-creating the package registry data in an alternate location `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Packages\PackageGuid\Versions\VersionGuid\REGISTRY`. The staged registry data has two distinct types of machine data and user data. Machine data is shared across all users on the machine. User data is staged for each user to a userspecific location `HKCU\Software\Microsoft\AppV\Client\Packages\PackageGuid\Registry\User`. The machine data is ultimately removed at package removal time, and the user data is removed on a user unpublish operation.
 
@@ -439,9 +442,9 @@ There are two package registry locations and two connection group locations wher
 
 
 
- 
+ 
 
- 
+ 
 
 **Connection Group VReg:**
 
@@ -479,9 +482,9 @@ There are two package registry locations and two connection group locations wher
 
 
 
- 
+ 
 
- 
+ 
 
 There are two COW locations for HKLM; elevated and non-elevated processes. Elevated processes always write HKLM changes to the secure COW under HKLM. Non-elevated processes always write HKLM changes to the non-secure COW under HKCU\\Software\\Classes. When an application reads changes from HKLM, elevated processes will read changes from the secure COW under HKLM. Non-elevated reads from both, favoring the changes made in the unsecure COW first.
 
@@ -566,9 +569,9 @@ The App-V Client can be configured to change the default behavior of streaming.
 
 
 
- 
+ 
 
- 
+ 
 
 These settings affect the behavior of streaming App-V package assets to the client. By default, App-V only downloads the assets required after downloading the initial publishing and primary feature blocks. There are three specific behaviors around streaming packages that must be explained:
 
@@ -620,7 +623,7 @@ Together, these files and registry settings represent the user’s catalog, so e
 **Note**  
 The **Repair-AppvClientPackage** cmdlet does not repair the publishing state of packages, where the user’s App-V state under `HKEY_CURRENT_USER` is missing or mismatched with the data in %appdata%.
 
- 
+ 
 
 ### Registry-based data
 
@@ -642,8 +645,8 @@ App-V registry roaming falls into two scenarios, as shown in the following table
 
    Applications that are run as standard users
    
 
    When a standard user launches an App-V application, both HKLM and HKCU for App-V applications are stored in the HKCU hive on the machine. This presents as two distinct paths:
    
 
      
-
    • HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages\{PkgGUID}\REGISTRY\MACHINE\SOFTWARE
      • 
-
    • HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\{PkgGUID}\REGISTRY\USER\{UserSID}\SOFTWARE
      • 
+
    • HKLM: HKCU\SOFTWARE\Classes\AppV\Client\Packages{PkgGUID}\REGISTRY\MACHINE\SOFTWARE
      • 
+
    • HKCU: HKCU\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}\REGISTRY\USER{UserSID}\SOFTWARE
      • 
 
    
 
    The locations are enabled for roaming based on the operating system settings.
    
 
@@ -656,14 +659,14 @@ App-V registry roaming falls into two scenarios, as shown in the following table
 
 
    In this scenario, these settings are not roamed with normal operating system roaming configurations, and the resulting registry keys and values are stored in the following location:
    
 
      
-
    • HKLM\SOFTWARE\Microsoft\AppV\Client\Packages\{PkgGUID}\{UserSID}\REGISTRY\MACHINE\SOFTWARE
      • 
-
    • HKCU\SOFTWARE\Microsoft\AppV\Client\Packages\{PkgGUID}\Registry\User\{UserSID}\SOFTWARE
      • 
+
    • HKLM\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}{UserSID}\REGISTRY\MACHINE\SOFTWARE
      • 
+
    • HKCU\SOFTWARE\Microsoft\AppV\Client\Packages{PkgGUID}\Registry\User{UserSID}\SOFTWARE
      • 
 
    
 
 
 
 
- 
+ 
 
 ### App-V and folder redirection
 
@@ -687,30 +690,30 @@ The following table shows local and roaming locations, when folder redirection h
 
 
 
    ProgramFilesX86
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\ProgramFilesX86
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\ProgramFilesX86
    
 
 
 
    SystemX86
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\SystemX86
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\SystemX86
    
 
 
 
    Windows
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\Windows
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\Windows
    
 
 
 
    appv_ROOT
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\appv_ROOT
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\appv_ROOT
    
 
 
 
    AppData
    
-
    C:\users\jsmith\AppData\Roaming\Microsoft\AppV\Client\VFS\<GUID>\AppData
    
+
    C:\users\jsmith\AppData<strong>Roaming\Microsoft\AppV\Client\VFS&lt;GUID>\AppData
    
 
 
 
 
- 
+ 
 
- 
+ 
 
 The following table shows local and roaming locations, when folder redirection has been implemented for %AppData%, and the location has been redirected (typically to a network location).
 
@@ -728,30 +731,30 @@ The following table shows local and roaming locations, when folder redirection h
 
 
 
    ProgramFilesX86
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\ProgramFilesX86
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\ProgramFilesX86
    
 
 
 
    SystemX86
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\SystemX86
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\SystemX86
    
 
 
 
    Windows
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\Windows
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\Windows
    
 
 
 
    appv_ROOT
    
-
    C:\users\jsmith\AppData\Local\Microsoft\AppV\Client\VFS\<GUID>\appv_ROOT
    
+
    C:\users\jsmith\AppData<strong>Local\Microsoft\AppV\Client\VFS&lt;GUID>\appv_ROOT
    
 
 
 
    AppData
    
-
    \\Fileserver\users\jsmith\roaming\Microsoft\AppV\Client\VFS\<GUID>\AppData
    
+
    \Fileserver\users\jsmith\roaming\Microsoft\AppV\Client\VFS&lt;GUID>\AppData
    
 
 
 
 
- 
+ 
 
- 
+ 
 
 The current App-V Client VFS driver cannot write to network locations, so the App-V Client detects the presence of folder redirection and copies the data on the local drive during publishing and when the virtual environment starts. After the user closes the App-V application and the App-V Client closes the virtual environment, the local storage of the VFS AppData is copied back to the network, enabling roaming to additional machines, where the process will be repeated. The detailed steps of the processes are:
 
@@ -808,7 +811,7 @@ This document focuses on App-V Full Infrastructure solutions. For specific infor
 
 The App-V application lifecycle tasks are triggered at user login (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured during setup of the client or post-setup with PowerShell commands. See the How to Deploy the Client section on TechNet at: [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md) or utilize the PowerShell:
 
-``` syntax
+```powershell
 get-command *appv*
 ```
 
@@ -874,7 +877,7 @@ Adding an App-V package to the client is the first step of the publishing refres
 
     7.  Create the Registry.dat file from the package store to %ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat
 
-    8.  Register the package with the App-V Kernal Mode Driver HKLM\\Microsoft\\Software\\AppV\\MAV
+    8.  Register the package with the App-V Kernel Mode Driver HKLM\\Microsoft\\Software\\AppV\\MAV
 
     9.  Invoke scripting from the AppxManifest.xml or DeploymentConfig.xml file for Package Add timing.
 
@@ -885,7 +888,7 @@ Adding an App-V package to the client is the first step of the publishing refres
     **Note**  
     This will not perform a package deletion but rather remove integration points for the specific target (user or machine) and remove user catalog files (machine catalog files for globally published).
 
-     
+     
 
 6.  Invoke background load mounting based on client configuration.
 
@@ -894,7 +897,7 @@ Adding an App-V package to the client is the first step of the publishing refres
     **Note**  
     This condition occurs as a product of removal without unpublishing with background addition of the package.
 
-     
+     
 
 This completes an App-V package add of the publishing refresh process. The next step is publishing the package to the specific target (machine or user).
 
@@ -923,7 +926,7 @@ During the Publishing Refresh operation, the specific publishing operation (Publ
         **Note**  
         This enables restore extension points if the package is unpublished.
 
-         
+         
 
     3.  Run scripts targeted for publishing timing.
 
@@ -1014,7 +1017,7 @@ The App-V 5 package upgrade process differs from the older versions of App-V. Ap
 
 
 
- 
+ 
 
 When a task is placed in a pending state, the App-V client also generates a registry key for the pending task, as follows:
 
@@ -1041,7 +1044,7 @@ When a task is placed in a pending state, the App-V client also generates a regi
 
 
 
- 
+ 
 
 The following operations must be completed before users can use the newer version of the package:
 
@@ -1068,7 +1071,7 @@ The following operations must be completed before users can use the newer versio
 
 
 
- 
+ 
 
 Use the following example scenarios as a guide for updating packages.
 
@@ -1098,7 +1101,7 @@ Use the following example scenarios as a guide for updating packages.
 
 
 
- 
+ 
 
 ### Global vs user publishing
 
@@ -1171,7 +1174,7 @@ The short cut is one of the basic elements of integration with the OS and is the
 
 From the package manifest and dynamic configuration XML files, the path to a specific application executable can be found in a section similar to the following:
 
-``` syntax
+```xml
 
           
             [{Common Desktop}]\Adobe Reader 9.lnk
@@ -1191,7 +1194,7 @@ As mentioned previously, the App-V shortcuts are placed by default in the user
 
 The App-V Client manages the local operating system File Type Associations during publishing, which enables users to use file type invocations or to open a file with a specifically registered extension (.docx) to start an App-V application. File type associations are present in the manifest and dynamic configuration files as represented in the example below:
 
-``` syntax
+```xml
 
           
             
@@ -1237,7 +1240,7 @@ In this example:
 
 -   `"[{AppVPackageRoot}]\Reader\AcroRd32.exe" "%1"` is the command line, which points to the application executable
 
- 
+ 
 
 ### Shell extensions
 
@@ -1304,7 +1307,7 @@ The following table displays the supported shell extensions.
 
 
 
- 
+ 
 
 ### COM
 
@@ -1320,7 +1323,7 @@ App-V supports specific software clients and application capabilities extension
 
 Example of software client registration of an App-V based mail client.
 
-``` syntax
+```xml
     
       
       
@@ -1369,7 +1372,7 @@ In this example:
 
 -   `[{ProgramFilesX86}]\Mozilla Thunderbird\mozMapi32_InUse.dll` is the MAPI dll registration
 
- 
+ 
 
 ### URL Protocol handler
 
@@ -1490,7 +1493,7 @@ Extension points are not all published the same way, where some extension points
 
 
 
- 
+ 
 
 ## Dynamic configuration processing
 
@@ -1507,7 +1510,7 @@ The example below shows the combination of the Manifest, Deployment Configuratio
 
 **Manifest**
 
-``` syntax
+```xml
 
      
           [{Common Programs}]\7-Zip\7-Zip File Manager.lnk
@@ -1519,7 +1522,7 @@ The example below shows the combination of the Manifest, Deployment Configuratio
 
 **Deployment Configuration**
 
-``` syntax
+```xml
 
      
           
@@ -1534,7 +1537,7 @@ The example below shows the combination of the Manifest, Deployment Configuratio
 
 **User Configuration**
 
-``` syntax
+```xml
 
      
 
@@ -1551,12 +1554,12 @@ The example below shows the combination of the Manifest, Deployment Configuratio
      
           [{Desktop}]\7-Zip\7-Zip File Manager.lnk
           [{AppVPackageRoot}]\7zFM.exe
-          [{AppVPackageRoot}]\7zFM.exe.O.ico
+          [{AppVPackageRoot}]\7zFM.exe.O.ico
      
      
           [{Common Programs}]\7-Zip\7-Zip File Manager.Ink
           [{AppVPackageRoot}]\7zFM.exe
-          [{AppVPackageRoot)]\7zFM.exe.O.ico
+          [{AppVPackageRoot)]\7zFM.exe.O.ico
      
 
      
@@ -1593,7 +1596,7 @@ During publishing of an App-V package with SxS assemblies the App-V Client will
 **Note**  
 UnPublishing or removing a package with an assembly does not remove the assemblies for that package.
 
- 
+ 
 
 ## Client logging
 
@@ -1607,7 +1610,7 @@ In App-V 5.0 SP3, some logs were consolidated and moved to the following locatio
 
 For a list of the moved logs, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved).
 
- 
+ 
 
 There are three specific categories of events recorded described below.
 
@@ -1622,9 +1625,9 @@ There are three specific categories of events recorded described below.
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/check-reg-key-svr.md b/mdop/appv-v5/check-reg-key-svr.md
index ec6c292ca4..44498c1829 100644
--- a/mdop/appv-v5/check-reg-key-svr.md
+++ b/mdop/appv-v5/check-reg-key-svr.md
@@ -1,12 +1,15 @@
 ---
 title: Check Registry Keys before installing App-V 5.x Server
 description: Check Registry Keys before installing App-V 5.x Server
-author: jamiejdt
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/16/2016
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 
diff --git a/mdop/appv-v5/configure-applications-and-default-virtual-application-extensions-in-management-console.md b/mdop/appv-v5/configure-applications-and-default-virtual-application-extensions-in-management-console.md
new file mode 100644
index 0000000000..c96dff8cbe
--- /dev/null
+++ b/mdop/appv-v5/configure-applications-and-default-virtual-application-extensions-in-management-console.md
@@ -0,0 +1,52 @@
+---
+title: Configure Applications and Default Virtual Application Extensions in Management Console
+description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console
+author: dansimp
+ms.assetid: 1e1941d3-fb22-4077-8ec6-7a0cb80335d8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
+ms.pagetype: mdop, appcompat, virtualization
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.prod: w10
+ms.date: 09/26/2019
+---
+
+# 	Configure Applications and Default Virtual Application Extensions in Management Console
+
+Use the following procedure to *view* and *configure* default package extensions.
+
+**To view and configure default virtual application extensions**
+
+1.  To view the package that you want to configure, open the App-V 5.1 Management Console. Select the package that you want to configure, right-click the package name and select **edit default configuration**.
+
+2.  To view the applications contained in the specified package, in the **Default Configuration** pane, click **Applications**. To view the shortcuts for that package, click **Shortcuts**. To view the file type associations for that package, click **File Types**.
+
+3.  To enable the application extensions, select **ENABLE**.
+
+    To enable shortcuts, select **ENABLE SHORTCUTS**. To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane and select **Remove Shortcut**. To edit an existing shortcut, right-click the application and select **Edit Shortcut**.
+
+4.  To view any other application extensions, click **Advanced** and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions associated with the package using the configuration file.
+
+5.  To edit other application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog box, click **Overwrite** to complete the process.
+
+>**Note** If the upload fails and the size of your configuration file is above 4MB, you will need to increase the maximum file size allowed by the server. This can be done by adding the maxRequestLength attribute with a value greater than the size of your configuration file (in KB) to the httpRuntime element on line 26 of `C:\Program Files\Microsoft Application Virtualization Server\ManagementService\Web.config`.  
+For example, changing `` to `` will increase the maximum size to 8MB
+
+
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+## Related topics
+
+
+[Operations for App-V 5.1](operations-for-app-v-51.md)
+
+ 
+
+ 
+
+
+
+
+
diff --git a/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md b/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md
index 354f623a8c..56bd58a27e 100644
--- a/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md
+++ b/mdop/appv-v5/creating-and-managing-app-v-50-virtualized-applications.md
@@ -1,8 +1,11 @@
 ---
 title: Creating and Managing App-V 5.0 Virtualized Applications
 description: Creating and Managing App-V 5.0 Virtualized Applications
-author: jamiejdt
+author: dansimp
 ms.assetid: 66bab403-d7e0-4e7b-bc8f-a29a98a7160a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -17,9 +20,9 @@ ms.date: 06/16/2016
 After you have properly deployed the Microsoft Application Virtualization (App-V) 5.0 sequencer, you can use it to monitor and record the installation and setup process for an application to be run as a virtualized application.
 
 **Note**  
-For more information about configuring the Microsoft Application Virtualization (App-V) 5.0 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx) (http://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx).
+For more information about configuring the Microsoft Application Virtualization (App-V) 5.0 sequencer, sequencing best practices, and an example of creating and updating a virtual application, see the [Microsoft Application Virtualization 5.0 Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx) (https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V 5.0 Sequencing Guide.docx).
 
- 
+ 
 
 ## Sequencing an application
 
@@ -35,7 +38,7 @@ You can use the App-V 5.0 Sequencer to perform the following tasks:
     **Note**  
     You must create shortcuts and save them to an available network location to allow roaming. If a shortcut is created and saved in a private location, the package must be published locally to the computer running the App-V 5.0 client.
 
-     
+     
 
 -   Convert existing virtual packages.
 
@@ -56,7 +59,7 @@ When you use the sequencer to create a new virtual application, the following li
 **Important**  
 You must configure the %TMP% and %TEMP% folders that the package converter uses to be a secure location and directory. A secure location is only accessible by an administrator. Additionally, when you sequence the package you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion and monitoring process.
 
- 
+ 
 
 The **Options** dialog box in the sequencer console contains the following tabs:
 
@@ -65,7 +68,7 @@ The **Options** dialog box in the sequencer console contains the following tabs:
     **Important**  
     Package Accelerators created using App-V 4.6 are not supported by App-V 5.0.
 
-     
+     
 
 -   **Parse Items**. This tab displays the associated file path locations that will be parsed or tokenized into in the virtual environment. Tokens are useful for adding files using the **Package Files** tab in **Advanced Editing**.
 
@@ -143,7 +146,7 @@ The following table lists the supported shell extensions:
 
 
 
- 
+ 
 
 ## Copy on Write (CoW) file extension support
 
@@ -270,7 +273,7 @@ The following table displays the file types that can exist in a virtual package
 
 .wsh
 
- 
+ 
 
 ## Modifying an existing virtual application package
 
@@ -302,7 +305,7 @@ A template can specify and store multiple settings as follows:
 **Note**  
 Package accelerators created using a previous version of App-V must be recreated using App-V 5.0.
 
- 
+ 
 
 You can use App-V 5.0 package accelerators to automatically generate a new virtual application packages. After you have successfully created a package accelerator, you can reuse and share the package accelerator.
 
@@ -331,9 +334,9 @@ You can also find additional information about sequencing errors using the Windo
 
 -   [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md b/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md
index 4062dd1379..c781eb4fea 100644
--- a/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md
+++ b/mdop/appv-v5/creating-and-managing-app-v-51-virtualized-applications.md
@@ -1,8 +1,11 @@
 ---
 title: Creating and Managing App-V 5.1 Virtualized Applications
 description: Creating and Managing App-V 5.1 Virtualized Applications
-author: jamiejdt
+author: dansimp
 ms.assetid: 26be4331-88eb-4cfb-9d82-e63d7ee54576
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -35,7 +38,7 @@ You can use the App-V 5.1 Sequencer to perform the following tasks:
 
     **Note**  
     You must create shortcuts and save them to an available network location to allow roaming. If a shortcut is created and saved in a private location, the package must be published locally to the computer running the App-V 5.1 client.
- 
+ 
 -   Convert existing virtual packages.
 
 The sequencer uses the **%TMP% \\ Scratch** or **%TEMP% \\ Scratch** directory and the **Temp** directory to store temporary files during sequencing. On the computer that runs the sequencer, you should configure these directories with free disk space equivalent to the estimated application installation requirements. Configuring the temp directories and the Temp directory on different hard drive partitions can help improve performance during sequencing.
diff --git a/mdop/appv-v5/deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md b/mdop/appv-v5/deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md
index ff5df535b5..4490ab666a 100644
--- a/mdop/appv-v5/deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md
+++ b/mdop/appv-v5/deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)
 description: Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)
-author: jamiejdt
+author: dansimp
 ms.assetid: d1d74af4-229f-4578-8c95-554a3d7cd2f3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/deploying-app-v-50.md b/mdop/appv-v5/deploying-app-v-50.md
index 770bd500c6..5f13c3d291 100644
--- a/mdop/appv-v5/deploying-app-v-50.md
+++ b/mdop/appv-v5/deploying-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying App-V 5.0
 description: Deploying App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 77cb19d7-00e6-4b39-b35a-e8a8ca0b807b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md b/mdop/appv-v5/deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md
index 04909d257a..de4772c416 100644
--- a/mdop/appv-v5/deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md
+++ b/mdop/appv-v5/deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD)
 description: Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD)
-author: jamiejdt
+author: dansimp
 ms.assetid: c2e4d176-460d-44ca-9a1d-69d2a733aa42
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/deploying-app-v-51.md b/mdop/appv-v5/deploying-app-v-51.md
index 0ba705d646..719dc32571 100644
--- a/mdop/appv-v5/deploying-app-v-51.md
+++ b/mdop/appv-v5/deploying-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying App-V 5.1
 description: Deploying App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: af8742bf-e24b-402a-bcf4-0f2297f26bc4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v.md
index b079ba6b69..88c3436957 100644
--- a/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v.md
+++ b/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying Microsoft Office 2010 by Using App-V
 description: Deploying Microsoft Office 2010 by Using App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 0a9e496e-82a1-4dc0-a496-7b21eaa00f53
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -67,7 +70,7 @@ The following table shows the App-V versions, methods of Office package creation
 
 
 
- 
+ 
 
 ## Creating Office 2010 App-V 5.0 using the sequencer
 
@@ -179,7 +182,7 @@ The following table provides a full list of supported integration points for Off
 
 
 
    Active X Controls:
    
-
    For more information on ActiveX controls, refer to [ActiveX Control API Reference](https://go.microsoft.com/fwlink/p/?LinkId=331361).
    
+
    For more information on ActiveX controls, refer to ActiveX Control API Reference.
    
 
    
 
 
@@ -270,7 +273,7 @@ The following table provides a full list of supported integration points for Off
 
 
 
- 
+ 
 
 ## Additional resources
 
@@ -302,9 +305,9 @@ The following table provides a full list of supported integration points for Off
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v51.md
index add55ebcc0..8e68496eec 100644
--- a/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v51.md
+++ b/mdop/appv-v5/deploying-microsoft-office-2010-by-using-app-v51.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying Microsoft Office 2010 by Using App-V
 description: Deploying Microsoft Office 2010 by Using App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: ae0b0459-c0d6-4946-b62d-ff153f52d1fb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -68,7 +71,7 @@ The following table shows the App-V versions, methods of Office package creation
 
 
 
- 
+ 
 
 ## Creating Office 2010 App-V 5.1 using the sequencer
 
@@ -180,7 +183,7 @@ The following table provides a full list of supported integration points for Off
 
 
 
    Active X Controls:
    
-
    For more information on ActiveX controls, refer to [ActiveX Control API Reference](https://go.microsoft.com/fwlink/p/?LinkId=331361).
    
+
    For more information on ActiveX controls, refer to ActiveX Control API Reference.
    
 
    
 
 
@@ -271,7 +274,7 @@ The following table provides a full list of supported integration points for Off
 
 
 
- 
+ 
 
 ## Additional resources
 
@@ -303,9 +306,9 @@ The following table provides a full list of supported integration points for Off
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md
index 4563729fa2..6ac193ddbc 100644
--- a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md
+++ b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying Microsoft Office 2013 by Using App-V
 description: Deploying Microsoft Office 2013 by Using App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 02df5dc8-79e2-4c5c-8398-dbfb23344ab3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -48,7 +51,7 @@ Use the following table to get information about supported versions of Office an
 
 
 
-
    [Planning for Using App-V with Office](planning-for-using-app-v-with-office.md#bkmk-office-vers-supp-appv)
    
+
    Planning for Using App-V with Office
    
 
      
 
    • Supported versions of Office
      • 
 
    • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)
      • 
@@ -56,13 +59,13 @@ Use the following table to get information about supported versions of Office an
 
    
 
 
-
    [Planning for Using App-V with Office](planning-for-using-app-v-with-office.md#bkmk-plan-coexisting)
    
+
    Planning for Using App-V with Office
    
 
    Considerations for installing different versions of Office on the same computer
    
 
 
 
 
- 
+
 
 ### Packaging, publishing, and deployment requirements
 
@@ -85,7 +88,7 @@ Before you deploy Office by using App-V, review the following requirements.
 
      
 
    • All of the Office applications that you want to deploy to users must be in a single package.
      • 
 
    • In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.
      • 
-
    • If you are deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2013 and Project 2013 with Office](#bkmk-deploy-visio-project).
      • 
+
    • If you are deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see Deploying Visio 2013 and Project 2013 with Office.
      • 
 
    
 
 
@@ -102,7 +105,7 @@ Before you deploy Office by using App-V, review the following requirements.
 
  • Visio Pro for Office 365
    • 
 
  • Project Pro for Office 365
    • 
 
-
    You must enable [shared computer activation](https://technet.microsoft.com/library/dn782860.aspx).
    
+
    You must enable shared computer activation.
    
 
    You don’t use shared computer activation if you’re deploying a volume licensed product, such as:
    
 
      
 
    • Office Professional Plus 2013
      • 
@@ -113,7 +116,7 @@ Before you deploy Office by using App-V, review the following requirements.
 
 
 
- 
+
 
 ### Excluding Office applications from a package
 
@@ -135,27 +138,27 @@ The following table describes the recommended methods for excluding specific Off
 
      Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.
      
 
        
 
      • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.
        • 
-
      • For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).
        • 
+
      • For more information, see ExcludeApp element.
        • 
 
      
 
 
 
      Modify the DeploymentConfig.xml file
      
 
        
 
      • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.
        • 
-
      • For more information, see [Disabling Office 2013 applications](#bkmk-disable-office-apps).
        • 
+
      • For more information, see Disabling Office 2013 applications.
        • 
 
      
 
 
 
 
- 
+
 
 ## Creating an Office 2013 package for App-V with the Office Deployment Tool
 
 
 Complete the following steps to create an Office 2013 package for App-V 5.0 or later.
 
-**Important**  
+**Important**  
 In App-V 5.0 and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages.
 
 
@@ -190,9 +193,9 @@ The computer on which you are installing the Office Deployment Tool must have:
 
 
 
-**Note**  
+**Note**  
 In this topic, the term “Office 2013 App-V package” refers to subscription licensing and volume licensing.
- 
+
 
 ### Create Office 2013 App-V Packages Using Office Deployment Tool
 
@@ -218,120 +221,120 @@ After you download the Office Deployment Tool, you can use it to get the latest
 
 The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included.
 
-1.  **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications:
+1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications:
 
-    1.  Open the sample XML file in Notepad or your favorite text editor.
+   1. Open the sample XML file in Notepad or your favorite text editor.
 
-    2.  With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2013 applications. The following is a basic example of the configuration.xml file:
+   2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2013 applications. The following is a basic example of the configuration.xml file:
 
-        ``` syntax
-        
-           
-            
-              
-            
-            
-              
-            
-          
-        
-        ```
+      ```xml
+      
+         
+          
+            
+          
+          
+            
+          
+        
+      
+      ```
 
-        **Note**  
-        The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file.
+      **Note**  
+      The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file.
 
-        The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file:
+      The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file:
 
-        
-        -        -        -        -        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
      




      InputDescriptionExample
      Add element
      Specifies the products and languages to include in the package.
      N/A
      OfficeClientEdition (attribute of Add element)
      Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.
      OfficeClientEdition="32"
      
-        
      OfficeClientEdition="64"
      Product element
      Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.
      Product ID ="O365ProPlusRetail "
      
-        
      Product ID ="VisioProRetail"
      
-        
      Product ID ="ProjectProRetail"
      
-        
      Product ID ="ProPlusVolume"
      
-        
      Product ID ="VisioProVolume"
      
-        
      Product ID = "ProjectProVolume"
      Language element
      Specifies the language supported in the applications
      Language ID="en-us"
      Version (attribute of Add element)
      Optional. Specifies a build to use for the package
      
-        
      Defaults to latest advertised build (as defined in v32.CAB at the Office source).
      15.1.2.3
      SourcePath (attribute of Add element)
      Specifies the location in which the applications will be saved to.
      Sourcepath = "\\Server\Office2013”
      
+      
+      +      +      +      +      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
      




      InputDescriptionExample
      Add element
      Specifies the products and languages to include in the package.
      N/A
      OfficeClientEdition (attribute of Add element)
      Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.
      OfficeClientEdition="32"
      
+      
      OfficeClientEdition="64"
      Product element
      Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.
      Product ID ="O365ProPlusRetail "
      
+      
      Product ID ="VisioProRetail"
      
+      
      Product ID ="ProjectProRetail"
      
+      
      Product ID ="ProPlusVolume"
      
+      
      Product ID ="VisioProVolume"
      
+      
      Product ID = "ProjectProVolume"
      Language element
      Specifies the language supported in the applications
      Language ID="en-us"
      Version (attribute of Add element)
      Optional. Specifies a build to use for the package
      
+      
      Defaults to latest advertised build (as defined in v32.CAB at the Office source).
      15.1.2.3
      SourcePath (attribute of Add element)
      Specifies the location in which the applications will be saved to.
      Sourcepath = "\Server\Office2013”
      
 
-        After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml.
+      After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml.
 
-2.  **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2013 applications that will later be converted into an App-V package. Below is an example command with description of details:
+2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2013 applications that will later be converted into an App-V package. Below is an example command with description of details:
 
-    ``` syntax
-    \\server\Office2013\setup.exe /download \\server\Office2013\Customconfig.xml
-    ```
+   ``` syntax
+   \\server\Office2013\setup.exe /download \\server\Office2013\Customconfig.xml
+   ```
 
-    In the example:
+   In the example:
+
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
      



      \server\Office2013
      is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
      Setup.exe
      is the Office Deployment Tool.
      /download
      downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing.
      \server\Office2013\Customconfig.xml
      passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \Server\Office2013.
      
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
      



      \\server\Office2013
      is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
      Setup.exe
      is the Office Deployment Tool.
      /download
      downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing.
      \\server\Office2013\Customconfig.xml
      passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \\Server\Office2013.
      
 
-     
 
 ### Convert the Office applications into an App-V package
 
@@ -383,180 +386,181 @@ After you download the Office 2013 applications through the Office Deployment To
 
 
 
- 
+
 
 **How to convert the Office applications into an App-V package**
 
-1.  In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
+1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
      



      ParameterWhat to change the value to
      SourcePath
      Point to the Office applications downloaded earlier.
      ProductID
      Specify the type of licensing, as shown in the following examples:
      
-    
        
-    
      • Subscription Licensing
        
-    
        <Configuration>
-       <Add SourcePath= "\\server\Office 2013" OfficeClientEdition="32" >
-        <Product ID="O365ProPlusRetail">
-          <Language ID="en-us" />
-        </Product>
-        <Product ID="VisioProRetail">
-          <Language ID="en-us" />
-        </Product>
-      </Add>
-    </Configuration> 
        
-    
        In this example, the following changes were made to create a package with Subscription licensing:
        
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
        



        SourcePath
        is the path, which was changed to point to the Office applications that were downloaded earlier.
        Product ID
        for Office was changed to O365ProPlusRetail.
        Product ID
        for Visio was changed to VisioProRetail.
        
-    
         
        
-    
        • 
-    
      • Volume Licensing
        
-    
        <Configuration>
-       <Add SourcePath= "\\Server\Office2013" OfficeClientEdition="32" >
-        <Product ID="ProPlusVolume">
-          <Language ID="en-us" />
-        </Product>
-        <Product ID="VisioProVolume">
-          <Language ID="en-us" />
-        </Product>
-      </Add>
-    </Configuration>
        
-    
        In this example, the following changes were made to create a package with Volume licensing:
        
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
        



        SourcePath
        is the path, which was changed to point to the Office applications that were downloaded earlier.
        Product ID
        for Office was changed to ProPlusVolume.
        Product ID
        for Visio was changed to VisioProVolume.
        
-    
         
        
-    
        • 
-    
      ExcludeApp (optional)
      Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
      PACKAGEGUID (optional)
      By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
      
-    
      An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users.
      
-    
      
-    Note  
-    
      Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
      
-    
      
-    
      
-     
-    
      
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
      



      ParameterWhat to change the value to
      SourcePath
      Point to the Office applications downloaded earlier.
      ProductID
      Specify the type of licensing, as shown in the following examples:
      
+   
        
+   
      • Subscription Licensing
        
+   
        <Configuration>
+      <Add SourcePath= "\server\Office 2013" OfficeClientEdition="32" >
+       <Product ID="O365ProPlusRetail">
+         <Language ID="en-us" />
+       </Product>
+       <Product ID="VisioProRetail">
+         <Language ID="en-us" />
+       </Product>
+     </Add>
+   </Configuration> 
        
+   
        In this example, the following changes were made to create a package with Subscription licensing:
        
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
        



        SourcePath
        is the path, which was changed to point to the Office applications that were downloaded earlier.
        Product ID
        for Office was changed to O365ProPlusRetail.
        Product ID
        for Visio was changed to VisioProRetail.
        
+   
         
        
+   
        • 
+   
      • Volume Licensing
        
+   
        <Configuration>
+      <Add SourcePath= "\Server\Office2013" OfficeClientEdition="32" >
+       <Product ID="ProPlusVolume">
+         <Language ID="en-us" />
+       </Product>
+       <Product ID="VisioProVolume">
+         <Language ID="en-us" />
+       </Product>
+     </Add>
+   </Configuration>
        
+   
        In this example, the following changes were made to create a package with Volume licensing:
        
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
        



        SourcePath
        is the path, which was changed to point to the Office applications that were downloaded earlier.
        Product ID
        for Office was changed to ProPlusVolume.
        Product ID
        for Visio was changed to VisioProVolume.
        
+   
         
        
+   
        • 
+   
      ExcludeApp (optional)
      Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
      PACKAGEGUID (optional)
      By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
      
+   
      An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users.
      
+   
      
+   Note
      Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
      
+   
      
+   
      
 
-     
+   
      
 
-2.  Use the /packager command to convert the Office applications to an Office 2013 App-V package.
 
-    For example:
 
-    ``` syntax
-    \\server\Office2013\setup.exe /packager \\server\Office2013\Customconfig.xml  \\server\share\Office2013AppV
-    ```
+2. Use the /packager command to convert the Office applications to an Office 2013 App-V package.
 
-    In the example:
+   For example:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
      



      \\server\Office2013
      is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
      Setup.exe
      is the Office Deployment Tool.
      /packager
      creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file.
      \\server\Office2013\Customconfig.xml
      passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.
      \\server\share\Office 2013AppV
      specifies the location of the newly created Office App-V package.
      
+   ``` syntax
+   \\server\Office2013\setup.exe /packager \\server\Office2013\Customconfig.xml  \\server\share\Office2013AppV
+   ```
 
-     
+   In the example:
 
-    After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved:
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
      



      \server\Office2013
      is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
      Setup.exe
      is the Office Deployment Tool.
      /packager
      creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file.
      \server\Office2013\Customconfig.xml
      passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.
      \server\share\Office 2013AppV
      specifies the location of the newly created Office App-V package.
      
 
-    -   **App-V Packages** – contains an Office 2013 App-V package and two deployment configuration files.
 
-    -   **WorkingDir**
 
-    **Note**  
-    To troubleshoot any issues, see the log files in the %temp% directory (default).
+~~~
+After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved:
 
-     
+-   **App-V Packages** – contains an Office 2013 App-V package and two deployment configuration files.
 
-3.  Verify that the Office 2013 App-V package works correctly:
+-   **WorkingDir**
 
-    1.  Publish the Office 2013 App-V package, which you created globally, to a test computer, and verify that the Office 2013 shortcuts appear.
+**Note**  
+To troubleshoot any issues, see the log files in the %temp% directory (default).
+~~~
 
-    2.  Start a few Office 2013 applications, such as Excel or Word, to ensure that your package is working as expected.
+
+
+3. Verify that the Office 2013 App-V package works correctly:
+
+   1.  Publish the Office 2013 App-V package, which you created globally, to a test computer, and verify that the Office 2013 shortcuts appear.
+
+   2.  Start a few Office 2013 applications, such as Excel or Word, to ensure that your package is working as expected.
 
 ## Publishing the Office package for App-V 5.0
 
@@ -601,7 +605,7 @@ Deploy the App-V package for Office 2013 by using the same methods you use for a
 
 
 
- 
+
 
 ### How to publish an Office package
 
@@ -644,10 +648,10 @@ Use the steps in this section to enable Office plug-ins with your Office package
 
 5.  Add the Office 2013 App-V package and the plug-ins package you sequenced to the Connection Group you created.
 
-    **Important**  
+    **Important**  
     The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2013 App-V package first, and then add the plug-in App-V package.
 
-     
+
 
 6.  Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2013 App-V package.
 
@@ -667,10 +671,10 @@ Use the steps in this section to enable Office plug-ins with your Office package
 
 You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2013 App-V package has been published, you will save the changes, add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications.
 
-**Note**  
+**Note**  
 To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. For more information, see [Reference for Click-to-Run configuration.xml file](https://technet.microsoft.com/library/jj219426.aspx).
 
- 
+
 
 **To disable an Office 2013 application**
 
@@ -684,7 +688,7 @@ To exclude specific Office applications (for example, Access and InfoPath) when
 
 5.  Add the Office 2013 App-V Package with the new Deployment Configuration File.
 
-    ``` syntax
+    ```xml
     
       
         InfoPath Filler 2013
@@ -692,7 +696,7 @@ To exclude specific Office applications (for example, Access and InfoPath) when
         
       
     
-    
+    
       
         Lync 2013
         
@@ -734,10 +738,10 @@ You may want to disable shortcuts for certain Office applications instead of unp
            
            
            Microsoft.Office.MSACCESS.EXE.15
-           true
+           true
            Build a professional app quickly to manage data.
            l
-           [{AppVPackageRoot}]\officel5\MSACCESS.EXE
+           [{AppVPackageRoot}]\office15\MSACCESS.EXE
         
     ```
 
@@ -755,14 +759,14 @@ To upgrade an Office 2013 package, use the Office Deployment Tool. To upgrade a
 
 1.  Create a new Office 2013 package through the Office Deployment Tool that uses the most recent Office 2013 application software. The most recent Office 2013 bits can always be obtained through the download stage of creating an Office 2013 App-V Package. The newly created Office 2013 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage.
 
-    **Note**  
+    **Note**  
     Office App-V packages have two Version IDs:
 
     -   An Office 2013 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
 
     -   A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2013 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2013 package.
 
-     
+
 
 2.  Globally publish the newly created Office 2013 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2013 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast.
 
@@ -805,7 +809,7 @@ The following table describes the requirements and options for deploying Visio 2
 
 
      How do I package and publish Visio 2013 and Project 2013 with Office?
      
 
      You must include Visio 2013 and Project 2013 in the same package with Office.
      
-
      If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow [Deploying Microsoft Office 2010 by Using App-V](../appv-v5/deploying-microsoft-office-2010-by-using-app-v.md).
      
+
      If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow Deploying Microsoft Office 2010 by Using App-V.
      
 
 
 
      How can I deploy Visio 2013 and Project 2013 to specific users?
      
@@ -836,17 +840,17 @@ The following table describes the requirements and options for deploying Visio 2
 
        
 
      1. Create a package that contains Office, Visio, and Project.
        2. 
 
      2. Deploy the package to all users.
        3. 
-
      3. Use [Microsoft AppLocker](https://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.
        4. 
+
      4. Use Microsoft AppLocker to prevent specific users from using Visio and Project.
        5. 
 
      
 
 
 
-
       
      
+
       
      
 
 
 
 
- 
+
 
 ## Additional resources
 
@@ -880,9 +884,9 @@ The following table describes the requirements and options for deploying Visio 2
 
 
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md
index 8ff13f6470..2e781bfa2b 100644
--- a/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md
+++ b/mdop/appv-v5/deploying-microsoft-office-2013-by-using-app-v51.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying Microsoft Office 2013 by Using App-V
 description: Deploying Microsoft Office 2013 by Using App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 9a7be05e-2a7a-4874-af25-09c0f5037876
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -48,7 +51,7 @@ Use the following table to get information about supported versions of Office an
 
 
 
-
      [Planning for Using App-V with Office](planning-for-using-app-v-with-office51.md#bkmk-office-vers-supp-appv)
      
+
      Planning for Using App-V with Office
      
 
        
 
      • Supported versions of Office
        • 
 
      • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)
        • 
@@ -56,13 +59,13 @@ Use the following table to get information about supported versions of Office an
 
      
 
 
-
      [Planning for Using App-V with Office](planning-for-using-app-v-with-office51.md#bkmk-plan-coexisting)
      
+
      Planning for Using App-V with Office
      
 
      Considerations for installing different versions of Office on the same computer
      
 
 
 
 
- 
+
 ### Packaging, publishing, and deployment requirements
 
 Before you deploy Office by using App-V, review the following requirements.
@@ -84,7 +87,7 @@ Before you deploy Office by using App-V, review the following requirements.
 
        
 
      • All of the Office applications that you want to deploy to users must be in a single package.
        • 
 
      • In App-V 5.1 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.
        • 
-
      • If you are deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2013 and Project 2013 with Office](#bkmk-deploy-visio-project).
        • 
+
      • If you are deploying Microsoft Visio 2013 and Microsoft Project 2013 along with Office, you must include them in the same package with Office. For more information, see Deploying Visio 2013 and Project 2013 with Office.
        • 
 
      
 
 
@@ -101,7 +104,7 @@ Before you deploy Office by using App-V, review the following requirements.
 
    • Visio Pro for Office 365
      • 
 
    • Project Pro for Office 365
      • 
 
    
-
    You must enable [shared computer activation](https://technet.microsoft.com/library/dn782860.aspx).
    
+
    You must enable shared computer activation.
    
 
    You don’t use shared computer activation if you’re deploying a volume licensed product, such as:
    
 
      
 
    • Office Professional Plus 2013
      • 
@@ -112,7 +115,7 @@ Before you deploy Office by using App-V, review the following requirements.
 
 
 
- 
+
 
 ### Excluding Office applications from a package
 
@@ -134,30 +137,30 @@ The following table describes the recommended methods for excluding specific Off
 
      Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.
      
 
        
 
      • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.
        • 
-
      • For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).
        • 
+
      • For more information, see ExcludeApp element.
        • 
 
      
 
 
 
      Modify the DeploymentConfig.xml file
      
 
        
 
      • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.
        • 
-
      • For more information, see [Disabling Office 2013 applications](#bkmk-disable-office-apps).
        • 
+
      • For more information, see Disabling Office 2013 applications.
        • 
 
      
 
 
 
 
- 
+
 
 ## Creating an Office 2013 package for App-V with the Office Deployment Tool
 
 
 Complete the following steps to create an Office 2013 package for App-V 5.1 or later.
 
-**Important**  
+**Important**  
 In App-V 5.1 and later, you must the Office Deployment Tool to create a package. You cannot use the Sequencer to create packages.
 
- 
+
 
 ### Review prerequisites for using the Office Deployment Tool
 
@@ -189,12 +192,12 @@ The computer on which you are installing the Office Deployment Tool must have:
 
 
 
- 
 
-**Note**  
+
+**Note**  
 In this topic, the term “Office 2013 App-V package” refers to subscription licensing and volume licensing.
 
- 
+
 
 ### Create Office 2013 App-V Packages Using Office Deployment Tool
 
@@ -226,7 +229,7 @@ The XML file that is included in the Office Deployment Tool specifies the produc
 
     2.  With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2013 applications. The following is a basic example of the configuration.xml file:
 
-        ``` syntax
+        ```xml
         
            
             
@@ -239,105 +242,107 @@ The XML file that is included in the Office Deployment Tool specifies the produc
         
         ```
 
-        **Note**  
+        **Note**  
         The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file.
 
-         
 
-        The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file:
 
-        
-        -        -        -        -        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
      




      InputDescriptionExample
      Add element
      Specifies the products and languages to include in the package.
      N/A
      OfficeClientEdition (attribute of Add element)
      Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.
      OfficeClientEdition="32"
      
-        
      OfficeClientEdition="64"
      Product element
      Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.
      Product ID ="O365ProPlusRetail "
      
-        
      Product ID ="VisioProRetail"
      
-        
      Product ID ="ProjectProRetail"
      
-        
      Product ID ="ProPlusVolume"
      
-        
      Product ID ="VisioProVolume"
      
-        
      Product ID = "ProjectProVolume"
      Language element
      Specifies the language supported in the applications
      Language ID="en-us"
      Version (attribute of Add element)
      Optional. Specifies a build to use for the package
      
-        
      Defaults to latest advertised build (as defined in v32.CAB at the Office source).
      15.1.2.3
      SourcePath (attribute of Add element)
      Specifies the location in which the applications will be saved to.
      Sourcepath = "\\Server\Office2013”
      
-
-         
-
-        After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml.
-
-2.  **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2013 applications that will later be converted into an App-V package. Below is an example command with description of details:
-
-    ``` syntax
-    \\server\Office2013\setup.exe /download \\server\Office2013\Customconfig.xml
-    ```
-
-    In the example:
+~~~
+    The above XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file:
 
     -    -    +    +    +    
+    
+    
+    
+    
+    
+    
+    
-    
-    
+    
+    
+    
-    
-    
+    
+    
+    
-    
-    
+    
+    
+    
-    
-    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
      
     





     
      InputDescriptionExample
      
     
     
      \\server\Office2013
      is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
      Add element
      Specifies the products and languages to include in the package.
      N/A
      		
     
      
     
      Setup.exe
      is the Office Deployment Tool.
      OfficeClientEdition (attribute of Add element)
      Specifies the edition of Office 2013 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.
      OfficeClientEdition="32"
      
+    
      OfficeClientEdition="64"
      		
     
      
     
      /download
      downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing.
      Product element
      Specifies the application. Project 2013 and Visio 2013 must be specified here as an added product to be included in the applications.
      Product ID ="O365ProPlusRetail "
      
+    
      Product ID ="VisioProRetail"
      
+    
      Product ID ="ProjectProRetail"
      
+    
      Product ID ="ProPlusVolume"
      
+    
      Product ID ="VisioProVolume"
      
+    
      Product ID = "ProjectProVolume"
      		
     
      
     
      \\server\Office2013\Customconfig.xml
      passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \\Server\Office2013.
      Language element
      Specifies the language supported in the applications
      Language ID="en-us"
      Version (attribute of Add element)
      Optional. Specifies a build to use for the package
      
+    
      Defaults to latest advertised build (as defined in v32.CAB at the Office source).
      15.1.2.3
      SourcePath (attribute of Add element)
      Specifies the location in which the applications will be saved to.
      Sourcepath = "\\Server\Office2013”
      		
     
      
           
     
      
 
-     
+
+
+    After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2013 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml.
+~~~
+
+2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2013 applications that will later be converted into an App-V package. Below is an example command with description of details:
+
+   ``` syntax
+   \\server\Office2013\setup.exe /download \\server\Office2013\Customconfig.xml
+   ```
+
+   In the example:
+
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
      



      \server\Office2013
      is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
      Setup.exe
      is the Office Deployment Tool.
      /download
      downloads the Office 2013 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2013 App-V package with Volume Licensing.
      \server\Office2013\Customconfig.xml
      passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \Server\Office2013.
      
+
+
 
 ### Convert the Office applications into an App-V package
 
@@ -389,180 +394,181 @@ After you download the Office 2013 applications through the Office Deployment To
 
 
 
- 
+
 
 **How to convert the Office applications into an App-V package**
 
-1.  In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
+1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
      



      ParameterWhat to change the value to
      SourcePath
      Point to the Office applications downloaded earlier.
      ProductID
      Specify the type of licensing, as shown in the following examples:
      
-    
        
-    
      • Subscription Licensing
        
-    
        <Configuration>
-       <Add SourcePath= "\\server\Office 2013" OfficeClientEdition="32" >
-        <Product ID="O365ProPlusRetail">
-          <Language ID="en-us" />
-        </Product>
-        <Product ID="VisioProRetail">
-          <Language ID="en-us" />
-        </Product>
-      </Add>
-    </Configuration> 
        
-    
        In this example, the following changes were made to create a package with Subscription licensing:
        
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
        



        SourcePath
        is the path, which was changed to point to the Office applications that were downloaded earlier.
        Product ID
        for Office was changed to O365ProPlusRetail.
        Product ID
        for Visio was changed to VisioProRetail.
        
-    
         
        
-    
        • 
-    
      • Volume Licensing
        
-    
        <Configuration>
-       <Add SourcePath= "\\Server\Office2013" OfficeClientEdition="32" >
-        <Product ID="ProPlusVolume">
-          <Language ID="en-us" />
-        </Product>
-        <Product ID="VisioProVolume">
-          <Language ID="en-us" />
-        </Product>
-      </Add>
-    </Configuration>
        
-    
        In this example, the following changes were made to create a package with Volume licensing:
        
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
        



        SourcePath
        is the path, which was changed to point to the Office applications that were downloaded earlier.
        Product ID
        for Office was changed to ProPlusVolume.
        Product ID
        for Visio was changed to VisioProVolume.
        
-    
         
        
-    
        • 
-    
      ExcludeApp (optional)
      Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
      PACKAGEGUID (optional)
      By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
      
-    
      An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users.
      
-    
      
-    Note  
-    
      Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
      
-    
      
-    
      
-     
-    
      
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
      



      ParameterWhat to change the value to
      SourcePath
      Point to the Office applications downloaded earlier.
      ProductID
      Specify the type of licensing, as shown in the following examples:
      
+   
        
+   
      • Subscription Licensing
        
+   
        <Configuration>
+      <Add SourcePath= "\server\Office 2013" OfficeClientEdition="32" >
+       <Product ID="O365ProPlusRetail">
+         <Language ID="en-us" />
+       </Product>
+       <Product ID="VisioProRetail">
+         <Language ID="en-us" />
+       </Product>
+     </Add>
+   </Configuration> 
        
+   
        In this example, the following changes were made to create a package with Subscription licensing:
        
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
        



        SourcePath
        is the path, which was changed to point to the Office applications that were downloaded earlier.
        Product ID
        for Office was changed to O365ProPlusRetail.
        Product ID
        for Visio was changed to VisioProRetail.
        
+   
         
        
+   
        • 
+   
      • Volume Licensing
        
+   
        <Configuration>
+      <Add SourcePath= "\Server\Office2013" OfficeClientEdition="32" >
+       <Product ID="ProPlusVolume">
+         <Language ID="en-us" />
+       </Product>
+       <Product ID="VisioProVolume">
+         <Language ID="en-us" />
+       </Product>
+     </Add>
+   </Configuration>
        
+   
        In this example, the following changes were made to create a package with Volume licensing:
        
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
        



        SourcePath
        is the path, which was changed to point to the Office applications that were downloaded earlier.
        Product ID
        for Office was changed to ProPlusVolume.
        Product ID
        for Visio was changed to VisioProVolume.
        
+   
         
        
+   
        • 
+   
      ExcludeApp (optional)
      Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
      PACKAGEGUID (optional)
      By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
      
+   
      An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users.
      
+   
      
+   Note
      Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
      
+   
      
+   
      
 
-     
+   
      
 
-2.  Use the /packager command to convert the Office applications to an Office 2013 App-V package.
 
-    For example:
 
-    ``` syntax
-    \\server\Office2013\setup.exe /packager \\server\Office2013\Customconfig.xml  \\server\share\Office2013AppV
-    ```
+2. Use the /packager command to convert the Office applications to an Office 2013 App-V package.
 
-    In the example:
+   For example:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
      



      \\server\Office2013
      is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
      Setup.exe
      is the Office Deployment Tool.
      /packager
      creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file.
      \\server\Office2013\Customconfig.xml
      passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.
      \\server\share\Office 2013AppV
      specifies the location of the newly created Office App-V package.
      
+   ``` syntax
+   \\server\Office2013\setup.exe /packager \\server\Office2013\Customconfig.xml  \\server\share\Office2013AppV
+   ```
 
-     
+   In the example:
 
-    After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved:
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
      



      \server\Office2013
      is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
      Setup.exe
      is the Office Deployment Tool.
      /packager
      creates the Office 2013 App-V package with Volume Licensing as specified in the customConfig.xml file.
      \server\Office2013\Customconfig.xml
      passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.
      \server\share\Office 2013AppV
      specifies the location of the newly created Office App-V package.
      
 
-    -   **App-V Packages** – contains an Office 2013 App-V package and two deployment configuration files.
 
-    -   **WorkingDir**
 
-    **Note**  
-    To troubleshoot any issues, see the log files in the %temp% directory (default).
+~~~
+After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved:
 
-     
+-   **App-V Packages** – contains an Office 2013 App-V package and two deployment configuration files.
 
-3.  Verify that the Office 2013 App-V package works correctly:
+-   **WorkingDir**
 
-    1.  Publish the Office 2013 App-V package, which you created globally, to a test computer, and verify that the Office 2013 shortcuts appear.
+**Note**  
+To troubleshoot any issues, see the log files in the %temp% directory (default).
+~~~
 
-    2.  Start a few Office 2013 applications, such as Excel or Word, to ensure that your package is working as expected.
+
+
+3. Verify that the Office 2013 App-V package works correctly:
+
+   1.  Publish the Office 2013 App-V package, which you created globally, to a test computer, and verify that the Office 2013 shortcuts appear.
+
+   2.  Start a few Office 2013 applications, such as Excel or Word, to ensure that your package is working as expected.
 
 ## Publishing the Office package for App-V 5.1
 
@@ -607,7 +613,7 @@ Deploy the App-V package for Office 2013 by using the same methods you use for a
 
 
 
- 
+
 
 ### How to publish an Office package
 
@@ -650,10 +656,10 @@ Use the steps in this section to enable Office plug-ins with your Office package
 
 5.  Add the Office 2013 App-V package and the plug-ins package you sequenced to the Connection Group you created.
 
-    **Important**  
+    **Important**  
     The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2013 App-V package first, and then add the plug-in App-V package.
 
-     
+
 
 6.  Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2013 App-V package.
 
@@ -673,10 +679,10 @@ Use the steps in this section to enable Office plug-ins with your Office package
 
 You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2013 App-V package has been published, you will save the changes, add the Office 2013 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2013 App-V Package applications.
 
-**Note**  
+**Note**  
 To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting. For more information, see [Reference for Click-to-Run configuration.xml file](https://technet.microsoft.com/library/jj219426.aspx).
 
- 
+
 
 **To disable an Office 2013 application**
 
@@ -690,7 +696,7 @@ To exclude specific Office applications (for example, Access and InfoPath) when
 
 5.  Add the Office 2013 App-V Package with the new Deployment Configuration File.
 
-    ``` syntax
+    ```xml
     
       
         InfoPath Filler 2013
@@ -698,7 +704,7 @@ To exclude specific Office applications (for example, Access and InfoPath) when
         
       
     
-    
+    
       
         Lync 2013
         
@@ -740,10 +746,10 @@ You may want to disable shortcuts for certain Office applications instead of unp
            
            
            Microsoft.Office.MSACCESS.EXE.15
-           true
+           true
            Build a professional app quickly to manage data.
            l
-           [{AppVPackageRoot}]\officel5\MSACCESS.EXE
+           [{AppVPackageRoot}]\office15\MSACCESS.EXE
         
     ```
 
@@ -761,14 +767,14 @@ To upgrade an Office 2013 package, use the Office Deployment Tool. To upgrade a
 
 1.  Create a new Office 2013 package through the Office Deployment Tool that uses the most recent Office 2013 application software. The most recent Office 2013 bits can always be obtained through the download stage of creating an Office 2013 App-V Package. The newly created Office 2013 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage.
 
-    **Note**  
+    **Note**  
     Office App-V packages have two Version IDs:
 
     -   An Office 2013 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
 
     -   A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2013 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2013 package.
 
-     
+
 
 2.  Globally publish the newly created Office 2013 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2013 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast.
 
@@ -811,7 +817,7 @@ The following table describes the requirements and options for deploying Visio 2
 
 
      How do I package and publish Visio 2013 and Project 2013 with Office?
      
 
      You must include Visio 2013 and Project 2013 in the same package with Office.
      
-
      If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow [Deploying Microsoft Office 2010 by Using App-V](../appv-v5/deploying-microsoft-office-2010-by-using-app-v.md).
      
+
      If you aren’t deploying Office, you can create a package that contains Visio and/or Project, as long as you follow Deploying Microsoft Office 2010 by Using App-V.
      
 
 
 
      How can I deploy Visio 2013 and Project 2013 to specific users?
      
@@ -842,17 +848,17 @@ The following table describes the requirements and options for deploying Visio 2
 
        
 
      1. Create a package that contains Office, Visio, and Project.
        2. 
 
      2. Deploy the package to all users.
        3. 
-
      3. Use [Microsoft AppLocker](https://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.
        4. 
+
      4. Use Microsoft AppLocker to prevent specific users from using Visio and Project.
        5. 
 
      
 
 
 
-
       
      
+
       
      
 
 
 
 
- 
+
 
 ## Additional resources
 
@@ -886,9 +892,9 @@ The following table describes the requirements and options for deploying Visio 2
 
 
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md
index dc3be9799d..f66484192f 100644
--- a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md
+++ b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying Microsoft Office 2016 by Using App-V
 description: Deploying Microsoft Office 2016 by Using App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: cc675cde-cb8d-4b7c-a700-6104b78f1d89
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -48,7 +51,7 @@ Use the following table to get information about supported versions of Office an
 
 
 
-
      [Supported versions of Microsoft Office](planning-for-using-app-v-with-office.md#bkmk-office-vers-supp-appv)
      
+
      Supported versions of Microsoft Office
      
 
        
 
      • Supported versions of Office
        • 
 
      • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)
        • 
@@ -56,13 +59,13 @@ Use the following table to get information about supported versions of Office an
 
      
 
 
-
      [Planning for Using App-V with coexisting versions of Office](planning-for-using-app-v-with-office.md#bkmk-plan-coexisting)
      
+
      Planning for Using App-V with coexisting versions of Office
      
 
      Considerations for installing different versions of Office on the same computer
      
 
 
 
 
- 
+
 
 ### Packaging, publishing, and deployment requirements
 
@@ -86,7 +89,7 @@ Before you deploy Office by using App-V, review the following requirements.
 
        
 
      • All of the Office applications that you want to deploy to users must be in a single package.
        • 
 
      • In App-V 5.0 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.
        • 
-
      • If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#bkmk-deploy-visio-project).
        • 
+
      • If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see Deploying Visio 2016 and Project 2016 with Office.
        • 
 
      
 
 
@@ -103,13 +106,13 @@ Before you deploy Office by using App-V, review the following requirements.
 
    • Visio Pro for Office 365
      • 
 
    • Project Pro for Office 365
      • 
 
    
-
    You must enable [shared computer activation](https://technet.microsoft.com/library/dn782860.aspx).
    
+
    You must enable shared computer activation.
    
 
 
 
 
 
- 
+
 
 ### Excluding Office applications from a package
 
@@ -131,20 +134,20 @@ The following table describes the recommended methods for excluding specific Off
 
    Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.
    
 
      
 
    • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.
      • 
-
    • For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).
      • 
+
    • For more information, see ExcludeApp element.
      • 
 
    
 
 
 
    Modify the DeploymentConfig.xml file
    
 
      
 
    • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.
      • 
-
    • For more information, see [Disabling Office 2016 applications](#bkmk-disable-office-apps).
      • 
+
    • For more information, see Disabling Office 2016 applications.
      • 
 
    
 
 
 
 
- 
+
 
 ## Creating an Office 2016 package for App-V with the Office Deployment Tool
 
@@ -185,8 +188,8 @@ The computer on which you are installing the Office Deployment Tool must have:
 
 
 
->**Note**  In this topic, the term “Office 2016 App-V package” refers to subscription licensing.
- 
+>**Note**  In this topic, the term “Office 2016 App-V package” refers to subscription licensing.
+
 
 ### Create Office 2016 App-V Packages Using Office Deployment Tool
 
@@ -200,12 +203,12 @@ Office 2016 App-V Packages are created using the Office Deployment Tool, which g
 
 1.  Download the [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117).
 
->**Important** You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages.
-2.  Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved.
+> **Important** You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages.
+> 2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved.
 
     Example: \\\\Server\\Office2016
 
-3.  Check that a setup.exe and a configuration.xml file exist and are in the location you specified.
+3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified.
 
 ### Download Office 2016 applications
 
@@ -213,125 +216,125 @@ After you download the Office Deployment Tool, you can use it to get the latest
 
 The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included.
 
-1.  **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications:
+1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications:
 
-    1.  Open the sample XML file in Notepad or your favorite text editor.
+   1. Open the sample XML file in Notepad or your favorite text editor.
 
-    2.  With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the configuration.xml file:
+   2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the configuration.xml file:
 
-        ``` syntax
-        
-           
-            
-              
-            
-            
-              
-            
-          
-        
-        ```
+      ```xml
+      
+         
+          
+            
+          
+          
+            
+          
+        
+      
+      ```
 
-        >**Note**  The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. To “uncomment” these lines, remove the "" from the end of the line.
+      >**Note**  The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. To “uncomment” these lines, remove the "" from the end of the line.
 
-        The above XML configuration file specifies that Office 2016 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2016, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2016 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file:
+      The above XML configuration file specifies that Office 2016 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2016, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2016 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file:
 
-        
-        -        -        -        -        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
    




    InputDescriptionExample
    Add element
    Specifies the products and languages to include in the package.
    N/A
    OfficeClientEdition (attribute of Add element)
    Specifies the edition of Office 2016 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.
    OfficeClientEdition="32"
    
-        
    OfficeClientEdition="64"
    Product element
    Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications.
+      
+      +      +      +      +      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
    




    InputDescriptionExample
    Add element
    Specifies the products and languages to include in the package.
    N/A
    OfficeClientEdition (attribute of Add element)
    Specifies the edition of Office 2016 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.
    OfficeClientEdition="32"
    
+      
    OfficeClientEdition="64"
    Product element
    Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications.
 
-        For more information about the product IDs, see [Product IDs that are supported by the Office Deployment Tool for Click-to-Run](https://support.microsoft.com/kb/2842297)
-        
    Product ID ="O365ProPlusRetail "
    
-        
    Product ID ="VisioProRetail"
    
-        
    Product ID ="ProjectProRetail"
    
-        
    Language element
    Specifies the language supported in the applications
    Language ID="en-us"
    Version (attribute of Add element)
    Optional. Specifies a build to use for the package
    
-        
    Defaults to latest advertised build (as defined in v32.CAB at the Office source).
    16.1.2.3
    SourcePath (attribute of Add element)
    Specifies the location in which the applications will be saved to.
    Sourcepath = "\\Server\Office2016”
    Channel (attribute of Add element)
    Optional. Specifies the update channel for the product that you want to download or install. 
    For more information about update channels, see Overview of update channels for Office 365 ProPlus.
    Channel="Deferred"
    
+      For more information about the product IDs, see Product IDs that are supported by the Office Deployment Tool for Click-to-Run
+      
    Product ID ="O365ProPlusRetail "
    
+      
    Product ID ="VisioProRetail"
    
+      
    Product ID ="ProjectProRetail"
    
+      
    Language element
    Specifies the language supported in the applications
    Language ID="en-us"
    Version (attribute of Add element)
    Optional. Specifies a build to use for the package
    
+      
    Defaults to latest advertised build (as defined in v32.CAB at the Office source).
    16.1.2.3
    SourcePath (attribute of Add element)
    Specifies the location in which the applications will be saved to.
    Sourcepath = "\Server\Office2016”
    Channel (attribute of Add element)
    Optional. Specifies the update channel for the product that you want to download or install. 
    For more information about update channels, see Overview of update channels for Office 365 ProPlus.
    Channel="Deferred"
    
 
-        After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2016 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml.
+      After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2016 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml.
 
-2.  **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2016 applications that will later be converted into an App-V package. Below is an example command with a description of details:
+2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2016 applications that will later be converted into an App-V package. Below is an example command with a description of details:
 
-    ``` syntax
-    \\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml
-    ```
+   ``` syntax
+   \\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml
+   ```
 
-    In the example:
+   In the example:
+
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    \server\Office2016
    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
    Setup.exe
    is the Office Deployment Tool.
    /download
    downloads the Office 2016 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2016 App-V package with Volume Licensing.
    \server\Office2016\Customconfig.xml
    passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \Server\Office2016.
    
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    \\server\Office2016
    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
    Setup.exe
    is the Office Deployment Tool.
    /download
    downloads the Office 2016 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2016 App-V package with Volume Licensing.
    \\server\Office2016\Customconfig.xml
    passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \\Server\Office2016.
    
 
-     
 
 ### Convert the Office applications into an App-V package
 
@@ -377,135 +380,137 @@ After you download the Office 2016 applications through the Office Deployment To
 
 
 
- 
+
 
 **How to convert the Office applications into an App-V package**
 
-1.  In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
+1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    ParameterWhat to change the value to
    SourcePath
    Point to the Office applications downloaded earlier.
    ProductID
    Specify Subscription licensing, as shown in the following example:
    
-    
    <Configuration>
-       <Add SourcePath= "\\server\Office 2016" OfficeClientEdition="32" >
-        <Product ID="O365ProPlusRetail">
-          <Language ID="en-us" />
-        </Product>
-        <Product ID="VisioProRetail">
-          <Language ID="en-us" />
-        </Product>
-      </Add>
-    </Configuration> 
    
-    
    In this example, the following changes were made to create a package with Subscription licensing:
    
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    SourcePath
    is the path, which was changed to point to the Office applications that were downloaded earlier.
    Product ID
    for Office was changed to O365ProPlusRetail.
    Product ID
    for Visio was changed to VisioProRetail.
    
-    
    
-    
    ExcludeApp (optional)
    Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
    PACKAGEGUID (optional)
    By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
    
-    
    An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.
    
->**Note** Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
-    
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    ParameterWhat to change the value to
    SourcePath
    Point to the Office applications downloaded earlier.
    ProductID
    Specify Subscription licensing, as shown in the following example:
    
+   
    <Configuration>
+      <Add SourcePath= "\server\Office 2016" OfficeClientEdition="32" >
+       <Product ID="O365ProPlusRetail">
+         <Language ID="en-us" />
+       </Product>
+       <Product ID="VisioProRetail">
+         <Language ID="en-us" />
+       </Product>
+     </Add>
+   </Configuration> 
    
+   
    In this example, the following changes were made to create a package with Subscription licensing:
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    SourcePath
    is the path, which was changed to point to the Office applications that were downloaded earlier.
    Product ID
    for Office was changed to O365ProPlusRetail.
    Product ID
    for Visio was changed to VisioProRetail.
    
+   
    
+   
    ExcludeApp (optional)
    Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
    PACKAGEGUID (optional)
    By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
    
+   
    An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.
    
+   >Note Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
+   
    
 
-     
 
-2.  Use the /packager command to convert the Office applications to an Office 2016 App-V package.
 
-    For example:
+2. Use the /packager command to convert the Office applications to an Office 2016 App-V package.
 
-    ``` syntax
-    \\server\Office2016\setup.exe /packager \\server\Office2016\Customconfig.xml  \\server\share\Office2016AppV
-    ```
+   For example:
 
-    In the example:
+   ``` syntax
+   \\server\Office2016\setup.exe /packager \\server\Office2016\Customconfig.xml  \\server\share\Office2016AppV
+   ```
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    \\server\Office2016
    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
    Setup.exe
    is the Office Deployment Tool.
    /packager
    creates the Office 2016 App-V package with the type of licensing specified in the customConfig.xml file.
    \\server\Office2016\Customconfig.xml
    passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.
    \\server\share\Office 2016AppV
    specifies the location of the newly created Office App-V package.
    
+   In the example:
 
-     
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    \server\Office2016
    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
    Setup.exe
    is the Office Deployment Tool.
    /packager
    creates the Office 2016 App-V package with the type of licensing specified in the customConfig.xml file.
    \server\Office2016\Customconfig.xml
    passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.
    \server\share\Office 2016AppV
    specifies the location of the newly created Office App-V package.
    
 
-    After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved:
 
-    -   **App-V Packages** – contains an Office 2016 App-V package and two deployment configuration files.
 
-    -   **WorkingDir**
+~~~
+After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved:
 
-    **Note** To troubleshoot any issues, see the log files in the %temp% directory (default).
+-   **App-V Packages** – contains an Office 2016 App-V package and two deployment configuration files.
 
-     
+-   **WorkingDir**
 
-3.  Verify that the Office 2016 App-V package works correctly:
+**Note** To troubleshoot any issues, see the log files in the %temp% directory (default).
+~~~
 
-    1.  Publish the Office 2016 App-V package, which you created globally, to a test computer, and verify that the Office 2016 shortcuts appear.
 
-    2.  Start a few Office 2016 applications, such as Excel or Word, to ensure that your package is working as expected.
+
+3. Verify that the Office 2016 App-V package works correctly:
+
+   1.  Publish the Office 2016 App-V package, which you created globally, to a test computer, and verify that the Office 2016 shortcuts appear.
+
+   2.  Start a few Office 2016 applications, such as Excel or Word, to ensure that your package is working as expected.
 
 ## Publishing the Office package for App-V
 
@@ -550,7 +555,7 @@ Deploy the App-V package for Office 2016 by using the same methods you use for a
 
 
 
- 
+
 
 ### How to publish an Office package
 
@@ -591,9 +596,9 @@ Use the steps in this section to enable Office plug-ins with your Office package
 
 5.  Add the Office 2016 App-V package and the plug-ins package you sequenced to the Connection Group you created.
 
-    >**Important** The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2016 App-V package first, and then add the plug-in App-V package.
+    >**Important** The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2016 App-V package first, and then add the plug-in App-V package.
+
 
-     
 
 6.  Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2016 App-V package.
 
@@ -613,8 +618,8 @@ Use the steps in this section to enable Office plug-ins with your Office package
 
 You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2016 App-V package has been published, you will save the changes, add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications.
 
->**Note** To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting.
- 
+>**Note** To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting.
+
 
 **To disable an Office 2016 application**
 
@@ -628,8 +633,8 @@ You may want to disable specific applications in your Office App-V package. For
 
 5.  Add the Office 2016 App-V Package with the new Deployment Configuration File.
 
-    ``` syntax
-    
+    ```xml
+    
       
         Lync 2016
         
@@ -671,10 +676,10 @@ You may want to disable shortcuts for certain Office applications instead of unp
            
            
            Microsoft.Office.MSACCESS.EXE.15
-           true
+           true
            Build a professional app quickly to manage data.
            l
-           [{AppVPackageRoot}]\officel6\MSACCESS.EXE
+           [{AppVPackageRoot}]\office16\MSACCESS.EXE
             
     ```
 
@@ -690,18 +695,18 @@ To upgrade an Office 2016 package, use the Office Deployment Tool. To upgrade a
 
 **How to upgrade a previously deployed Office 2016 package**
 
-1.  Create a new Office 2016 package through the Office Deployment Tool that uses the most recent Office 2016 application software. The most recent Office 2016 bits can always be obtained through the download stage of creating an Office 2016 App-V Package. The newly created Office 2016 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage.
+1. Create a new Office 2016 package through the Office Deployment Tool that uses the most recent Office 2016 application software. The most recent Office 2016 bits can always be obtained through the download stage of creating an Office 2016 App-V Package. The newly created Office 2016 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage.
 
-    >**Note** Office App-V packages have two Version IDs:
-    
      
-    
    • An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
      • 
-    
    • A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package.
      • 
-    
    
-     
+   > **Note** Office App-V packages have two Version IDs:
+   > 
      
+   > 
    • An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
      • 
+   > 
    • A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package.
      • 
+   > 
    
 
-2.  Globally publish the newly created Office 2016 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2016 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast.
 
-3.  Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted.
+2. Globally publish the newly created Office 2016 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2016 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast.
+
+3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted.
 
 
 ### Deploying Visio 2016 and Project 2016 with Office
@@ -754,17 +759,17 @@ The following table describes the requirements and options for deploying Visio 2
 
      
 
    1. Create a package that contains Office, Visio, and Project.
      2. 
 
    2. Deploy the package to all users.
      3. 
-
    3. Use [Microsoft AppLocker](https://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.
      4. 
+
    4. Use Microsoft AppLocker to prevent specific users from using Visio and Project.
      5. 
 
    
 
 
 
-
     
    
+
     
    
 
 
 
 
- 
+
 
 ## Additional resources
 
diff --git a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md
index be3dcbac56..317e8df4e7 100644
--- a/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md
+++ b/mdop/appv-v5/deploying-microsoft-office-2016-by-using-app-v51.md
@@ -1,8 +1,11 @@
----
+---
 title: Deploying Microsoft Office 2016 by Using App-V
 description: Deploying Microsoft Office 2016 by Using App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: e0f4876-da99-4b89-977e-2fb6e89ea3d3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -48,7 +51,7 @@ Use the following table to get information about supported versions of Office an
 
 
 
-
    [Supported versions of Microsoft Office](planning-for-using-app-v-with-office.md#bkmk-office-vers-supp-appv)
    
+
    Supported versions of Microsoft Office
    
 
      
 
    • Supported versions of Office
      • 
 
    • Supported deployment types (for example, desktop, personal Virtual Desktop Infrastructure (VDI), pooled VDI)
      • 
@@ -56,13 +59,13 @@ Use the following table to get information about supported versions of Office an
 
    
 
 
-
    [Planning for Using App-V with coexisting versions of Office](planning-for-using-app-v-with-office.md#bkmk-plan-coexisting)
    
+
    Planning for Using App-V with coexisting versions of Office
    
 
    Considerations for installing different versions of Office on the same computer
    
 
 
 
 
- 
+
 
 ### Packaging, publishing, and deployment requirements
 
@@ -86,7 +89,7 @@ Before you deploy Office by using App-V, review the following requirements.
 
      
 
    • All of the Office applications that you want to deploy to users must be in a single package.
      • 
 
    • In App-V 5.1 and later, you must use the Office Deployment Tool to create packages. You cannot use the Sequencer.
      • 
-
    • If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see [Deploying Visio 2016 and Project 2016 with Office](#bkmk-deploy-visio-project).
      • 
+
    • If you are deploying Microsoft Visio 2016 and Microsoft Project 2016 along with Office, you must include them in the same package with Office. For more information, see Deploying Visio 2016 and Project 2016 with Office.
      • 
 
    
 
 
@@ -103,13 +106,13 @@ Before you deploy Office by using App-V, review the following requirements.
 
  • Visio Pro for Office 365
    • 
 
  • Project Pro for Office 365
    • 
 
-
    You must enable [shared computer activation](https://technet.microsoft.com/library/dn782860.aspx).
    
+
    You must enable shared computer activation.
    
 
 
 
 
 
- 
+
 
 ### Excluding Office applications from a package
 
@@ -131,20 +134,20 @@ The following table describes the recommended methods for excluding specific Off
 
    Use the ExcludeApp setting when you create the package by using the Office Deployment Tool.
    
 
      
 
    • Enables you to exclude specific Office applications from the package when the Office Deployment Tool creates the package. For example, you can use this setting to create a package that contains only Microsoft Word.
      • 
-
    • For more information, see [ExcludeApp element](https://technet.microsoft.com/library/jj219426.aspx#bkmk-excludeappelement).
      • 
+
    • For more information, see ExcludeApp element.
      • 
 
    
 
 
 
    Modify the DeploymentConfig.xml file
    
 
      
 
    • Modify the DeploymentConfig.xml file after the package has been created. This file contains the default package settings for all users on a computer that is running the App-V Client.
      • 
-
    • For more information, see [Disabling Office 2016 applications](#bkmk-disable-office-apps).
      • 
+
    • For more information, see Disabling Office 2016 applications.
      • 
 
    
 
 
 
 
- 
+
 
 ## Creating an Office 2016 package for App-V with the Office Deployment Tool
 
@@ -185,8 +188,8 @@ The computer on which you are installing the Office Deployment Tool must have:
 
 
 
->**Note**  In this topic, the term “Office 2016 App-V package” refers to subscription licensing.
- 
+>**Note**  In this topic, the term “Office 2016 App-V package” refers to subscription licensing.
+
 
 ### Create Office 2016 App-V Packages Using Office Deployment Tool
 
@@ -200,12 +203,12 @@ Office 2016 App-V Packages are created using the Office Deployment Tool, which g
 
 1.  Download the [Office 2016 Deployment Tool for Click-to-Run](https://www.microsoft.com/download/details.aspx?id=49117).
 
->**Important** You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages.
-2.  Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved.
+> **Important** You must use the Office 2016 Deployment Tool to create Office 2016 App-V Packages.
+> 2. Run the .exe file and extract its features into the desired location. To make this process easier, you can create a shared network folder where the features will be saved.
 
     Example: \\\\Server\\Office2016
 
-3.  Check that a setup.exe and a configuration.xml file exist and are in the location you specified.
+3. Check that a setup.exe and a configuration.xml file exist and are in the location you specified.
 
 ### Download Office 2016 applications
 
@@ -213,125 +216,125 @@ After you download the Office Deployment Tool, you can use it to get the latest
 
 The XML file that is included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included.
 
-1.  **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications:
+1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications:
 
-    1.  Open the sample XML file in Notepad or your favorite text editor.
+   1. Open the sample XML file in Notepad or your favorite text editor.
 
-    2.  With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the configuration.xml file:
+   2. With the sample configuration.xml file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the configuration.xml file:
 
-        ``` syntax
-        
-           
-            
-              
-            
-            
-              
-            
-          
-        
-        ```
+      ```xml
+      
+         
+          
+            
+          
+          
+            
+          
+        
+      
+      ```
 
-        >**Note**  The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. To “uncomment” these lines, remove the "" from the end of the line.
+      >**Note**  The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. To “uncomment” these lines, remove the "" from the end of the line.
 
-        The above XML configuration file specifies that Office 2016 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2016, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2016 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file:
+      The above XML configuration file specifies that Office 2016 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2016, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2016 App-V packages with various licensing can be created from the same applications through specifying licensing in a later stage. The table below summarizes the customizable attributes and elements of XML file:
 
-        
-        -        -        -        -        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
    




    InputDescriptionExample
    Add element
    Specifies the products and languages to include in the package.
    N/A
    OfficeClientEdition (attribute of Add element)
    Specifies the edition of Office 2016 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.
    OfficeClientEdition="32"
    
-        
    OfficeClientEdition="64"
    Product element
    Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications.
+      
+      +      +      +      +      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
    




    InputDescriptionExample
    Add element
    Specifies the products and languages to include in the package.
    N/A
    OfficeClientEdition (attribute of Add element)
    Specifies the edition of Office 2016 product to use: 32-bit or 64-bit. The operation fails if OfficeClientEdition is not set to a valid value.
    OfficeClientEdition="32"
    
+      
    OfficeClientEdition="64"
    Product element
    Specifies the application. Project 2016 and Visio 2016 must be specified here as an added product to be included in the applications.
 
-        For more information about the product IDs, see [Product IDs that are supported by the Office Deployment Tool for Click-to-Run](https://support.microsoft.com/kb/2842297)
-        
    Product ID ="O365ProPlusRetail "
    
-        
    Product ID ="VisioProRetail"
    
-        
    Product ID ="ProjectProRetail"
    
-        
    Language element
    Specifies the language supported in the applications
    Language ID="en-us"
    Version (attribute of Add element)
    Optional. Specifies a build to use for the package
    
-        
    Defaults to latest advertised build (as defined in v32.CAB at the Office source).
    16.1.2.3
    SourcePath (attribute of Add element)
    Specifies the location in which the applications will be saved to.
    Sourcepath = "\\Server\Office2016”
    Branch (attribute of Add element)
    Optional. Specifies the update branch for the product that you want to download or install. 
    For more information about update branches, see Overview of update branches for Office 365 ProPlus.
    Branch = "Business"
    
+      For more information about the product IDs, see Product IDs that are supported by the Office Deployment Tool for Click-to-Run
+      
    Product ID ="O365ProPlusRetail "
    
+      
    Product ID ="VisioProRetail"
    
+      
    Product ID ="ProjectProRetail"
    
+      
    Language element
    Specifies the language supported in the applications
    Language ID="en-us"
    Version (attribute of Add element)
    Optional. Specifies a build to use for the package
    
+      
    Defaults to latest advertised build (as defined in v32.CAB at the Office source).
    16.1.2.3
    SourcePath (attribute of Add element)
    Specifies the location in which the applications will be saved to.
    Sourcepath = "\Server\Office2016”
    Branch (attribute of Add element)
    Optional. Specifies the update branch for the product that you want to download or install. 
    For more information about update branches, see Overview of update branches for Office 365 ProPlus.
    Branch = "Business"
    
 
-        After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2016 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml.
+      After editing the configuration.xml file to specify the desired product, languages, and also the location which the Office 2016 applications will be saved onto, you can save the configuration file, for example, as Customconfig.xml.
 
-2.  **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2016 applications that will later be converted into an App-V package. Below is an example command with a description of details:
+2. **Download the applications into the specified location:** Use an elevated command prompt and a 64 bit operating system to download the Office 2016 applications that will later be converted into an App-V package. Below is an example command with a description of details:
 
-    ``` syntax
-    \\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml
-    ```
+   ``` syntax
+   \\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml
+   ```
 
-    In the example:
+   In the example:
+
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    \server\Office2016
    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
    Setup.exe
    is the Office Deployment Tool.
    /download
    downloads the Office 2016 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2016 App-V package with Volume Licensing.
    \server\Office2016\Customconfig.xml
    passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \Server\Office2016.
    
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    \\server\Office2016
    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
    Setup.exe
    is the Office Deployment Tool.
    /download
    downloads the Office 2016 applications that you specify in the customConfig.xml file. These bits can be later converted in an Office 2016 App-V package with Volume Licensing.
    \\server\Office2016\Customconfig.xml
    passes the XML configuration file required to complete the download process, in this example, customconfig.xml. After using the download command, Office applications should be found in the location specified in the configuration xml file, in this example \\Server\Office2016.
    
 
-     
 
 ### Convert the Office applications into an App-V package
 
@@ -377,135 +380,137 @@ After you download the Office 2016 applications through the Office Deployment To
 
 
 
- 
+
 
 **How to convert the Office applications into an App-V package**
 
-1.  In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
+1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
+   
+   
+   
    



    ParameterWhat to change the value to
    SourcePath
    Point to the Office applications downloaded earlier.
    ProductID
    Specify Subscription licensing, as shown in the following example:
    
-    
    <Configuration>
-       <Add SourcePath= "\\server\Office 2016" OfficeClientEdition="32" >
-        <Product ID="O365ProPlusRetail">
-          <Language ID="en-us" />
-        </Product>
-        <Product ID="VisioProRetail">
-          <Language ID="en-us" />
-        </Product>
-      </Add>
-    </Configuration> 
    
-    
    In this example, the following changes were made to create a package with Subscription licensing:
    
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    SourcePath
    is the path, which was changed to point to the Office applications that were downloaded earlier.
    Product ID
    for Office was changed to O365ProPlusRetail.
    Product ID
    for Visio was changed to VisioProRetail.
    
-    
    
-    
    ExcludeApp (optional)
    Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
    PACKAGEGUID (optional)
    By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
    
-    
    An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
-    
-    
-    
    



    ParameterWhat to change the value to
    SourcePath
    Point to the Office applications downloaded earlier.
    ProductID
    Specify Subscription licensing, as shown in the following example:
    
+   
    <Configuration>
+      <Add SourcePath= "\server\Office 2016" OfficeClientEdition="32" >
+       <Product ID="O365ProPlusRetail">
+         <Language ID="en-us" />
+       </Product>
+       <Product ID="VisioProRetail">
+         <Language ID="en-us" />
+       </Product>
+     </Add>
+   </Configuration> 
    
+   
    In this example, the following changes were made to create a package with Subscription licensing:
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    SourcePath
    is the path, which was changed to point to the Office applications that were downloaded earlier.
    Product ID
    for Office was changed to O365ProPlusRetail.
    Product ID
    for Visio was changed to VisioProRetail.
    
+   
    
+   
    ExcludeApp (optional)
    Lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
    PACKAGEGUID (optional)
    By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
    
+   
    An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.
    
 
-    >**Note** Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
-    
    
+   >Note Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
+   
    
 
-     
-2.  Use the /packager command to convert the Office applications to an Office 2016 App-V package.
 
-    For example:
+2. Use the /packager command to convert the Office applications to an Office 2016 App-V package.
 
-    ``` syntax
-    \\server\Office2016\setup.exe /packager \\server\Office2016\Customconfig.xml  \\server\share\Office2016AppV
-    ```
+   For example:
 
-    In the example:
+   ``` syntax
+   \\server\Office2016\setup.exe /packager \\server\Office2016\Customconfig.xml  \\server\share\Office2016AppV
+   ```
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    \\server\Office2016
    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
    Setup.exe
    is the Office Deployment Tool.
    /packager
    creates the Office 2016 App-V package with the type of licensing specified in the customConfig.xml file.
    \\server\Office2016\Customconfig.xml
    passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.
    \\server\share\Office 2016AppV
    specifies the location of the newly created Office App-V package.
    
+   In the example:
 
-     
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    \server\Office2016
    is the network share location that contains the Office Deployment Tool and the custom Configuration.xml file, Customconfig.xml.
    Setup.exe
    is the Office Deployment Tool.
    /packager
    creates the Office 2016 App-V package with the type of licensing specified in the customConfig.xml file.
    \server\Office2016\Customconfig.xml
    passes the configuration XML file (in this case customConfig) that has been prepared for the packaging stage.
    \server\share\Office 2016AppV
    specifies the location of the newly created Office App-V package.
    
 
-    After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved:
 
-    -   **App-V Packages** – contains an Office 2016 App-V package and two deployment configuration files.
 
-    -   **WorkingDir**
+~~~
+After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved:
 
-    **Note** To troubleshoot any issues, see the log files in the %temp% directory (default).
+-   **App-V Packages** – contains an Office 2016 App-V package and two deployment configuration files.
 
-     
+-   **WorkingDir**
 
-3.  Verify that the Office 2016 App-V package works correctly:
+**Note** To troubleshoot any issues, see the log files in the %temp% directory (default).
+~~~
 
-    1.  Publish the Office 2016 App-V package, which you created globally, to a test computer, and verify that the Office 2016 shortcuts appear.
 
-    2.  Start a few Office 2016 applications, such as Excel or Word, to ensure that your package is working as expected.
+
+3. Verify that the Office 2016 App-V package works correctly:
+
+   1.  Publish the Office 2016 App-V package, which you created globally, to a test computer, and verify that the Office 2016 shortcuts appear.
+
+   2.  Start a few Office 2016 applications, such as Excel or Word, to ensure that your package is working as expected.
 
 ## Publishing the Office package for App-V
 
@@ -550,7 +555,7 @@ Deploy the App-V package for Office 2016 by using the same methods you use for a
 
 
 
- 
+
 
 ### How to publish an Office package
 
@@ -591,9 +596,9 @@ Use the steps in this section to enable Office plug-ins with your Office package
 
 5.  Add the Office 2016 App-V package and the plug-ins package you sequenced to the Connection Group you created.
 
-    >**Important** The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2016 App-V package first, and then add the plug-in App-V package.
+    >**Important** The order of the packages in the Connection Group determines the order in which the package contents are merged. In your Connection group descriptor file, add the Office 2016 App-V package first, and then add the plug-in App-V package.
+
 
-     
 
 6.  Ensure that both packages are published to the target computer and that the plug-in package is published globally to match the global settings of the published Office 2016 App-V package.
 
@@ -613,8 +618,8 @@ Use the steps in this section to enable Office plug-ins with your Office package
 
 You may want to disable specific applications in your Office App-V package. For instance, you can disable Access, but leave all other Office application main available. When you disable an application, the end user will no longer see the shortcut for that application. You do not have to re-sequence the application. When you change the Deployment Configuration File after the Office 2016 App-V package has been published, you will save the changes, add the Office 2016 App-V package, and then republish it with the new Deployment Configuration File to apply the new settings to Office 2016 App-V Package applications.
 
->**Note** To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting.
- 
+>**Note** To exclude specific Office applications (for example, Access and InfoPath) when you create the App-V package with the Office Deployment Tool, use the **ExcludeApp** setting.
+
 
 **To disable an Office 2016 application**
 
@@ -628,8 +633,8 @@ You may want to disable specific applications in your Office App-V package. For
 
 5.  Add the Office 2016 App-V Package with the new Deployment Configuration File.
 
-    ``` syntax
-    
+    ```xml
+    
       
         Lync 2016
         
@@ -671,10 +676,10 @@ You may want to disable shortcuts for certain Office applications instead of unp
            
            
            Microsoft.Office.MSACCESS.EXE.15
-           true
+           true
            Build a professional app quickly to manage data.
            l
-           [{AppVPackageRoot}]\officel6\MSACCESS.EXE
+           [{AppVPackageRoot}]\office16\MSACCESS.EXE
             
     ```
 
@@ -690,18 +695,18 @@ To upgrade an Office 2016 package, use the Office Deployment Tool. To upgrade a
 
 **How to upgrade a previously deployed Office 2016 package**
 
-1.  Create a new Office 2016 package through the Office Deployment Tool that uses the most recent Office 2016 application software. The most recent Office 2016 bits can always be obtained through the download stage of creating an Office 2016 App-V Package. The newly created Office 2016 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage.
+1. Create a new Office 2016 package through the Office Deployment Tool that uses the most recent Office 2016 application software. The most recent Office 2016 bits can always be obtained through the download stage of creating an Office 2016 App-V Package. The newly created Office 2016 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage.
 
-    >**Note** Office App-V packages have two Version IDs:
-    
      
-    
    • An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
      • 
-    
    • A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package.
      • 
-    
    
-     
+   > **Note** Office App-V packages have two Version IDs:
+   > 
      
+   > 
    • An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
      • 
+   > 
    • A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package.
      • 
+   > 
    
 
-2.  Globally publish the newly created Office 2016 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2016 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast.
 
-3.  Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted.
+2. Globally publish the newly created Office 2016 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2016 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast.
+
+3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted.
 
 
 ### Deploying Visio 2016 and Project 2016 with Office
@@ -754,12 +759,12 @@ The following table describes the requirements and options for deploying Visio 2
 
      
 
    1. Create a package that contains Office, Visio, and Project.
      2. 
 
    2. Deploy the package to all users.
      3. 
-
    3. Use [Microsoft AppLocker](https://technet.microsoft.com/library/dd723678.aspx) to prevent specific users from using Visio and Project.
      4. 
+
    4. Use Microsoft AppLocker to prevent specific users from using Visio and Project.
      5. 
 
    
 
 
 
-
     
    
+
     
    
 
 
 
diff --git a/mdop/appv-v5/deploying-the-app-v-50-sequencer-and-client.md b/mdop/appv-v5/deploying-the-app-v-50-sequencer-and-client.md
index 9124dd0305..1ad01a6915 100644
--- a/mdop/appv-v5/deploying-the-app-v-50-sequencer-and-client.md
+++ b/mdop/appv-v5/deploying-the-app-v-50-sequencer-and-client.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying the App-V 5.0 Sequencer and Client
 description: Deploying the App-V 5.0 Sequencer and Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 84cc84bd-5bc0-41aa-9519-0ded2932c078
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -42,7 +45,7 @@ You can use the Microsoft ADMX template to configure the client settings for the
 **Important**  
 You can obtain the App-V 5.0 ADMX template from the Microsoft Download Center.
 
- 
+ 
 
 After you download and install the ADMX template, perform the following steps on the computer that you will use to manage Group Policy. This is typically the Domain Controller.
 
@@ -64,7 +67,7 @@ The App-V 5.0 Shared Content Store (SCS) mode enables the SCS App-V 5.0 clients
 **Important**  
 If the App-V 5.0 client is configured to run in the SCS mode, the location where the App-V 5.0 packages are streamed from must be available, otherwise, the virtualized package will fail. Additionally, we do not recommend deployment of virtualized applications to computers that run the App-V 5.0 client in the SCS mode across the internet.
 
- 
+ 
 
 Additionally, the SCS is not a physical location that contains virtualized packages. It is a mode that allows the App-V 5.0 client to stream the required virtualized package data across the network.
 
@@ -112,9 +115,9 @@ In App-V 5.0 SP3, some logs have been consolidated. See [About App-V 5.0 SP3](ab
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/deploying-the-app-v-50-server.md b/mdop/appv-v5/deploying-the-app-v-50-server.md
index 5381037f48..a9c5cecc6e 100644
--- a/mdop/appv-v5/deploying-the-app-v-50-server.md
+++ b/mdop/appv-v5/deploying-the-app-v-50-server.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying the App-V 5.0 Server
 description: Deploying the App-V 5.0 Server
-author: jamiejdt
+author: dansimp
 ms.assetid: a47f0dc8-2971-4e4d-8d57-6b69bbed4b63
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -21,7 +24,7 @@ For information about deploying the App-V 5.0 SP3 Server, see [About App-V 5.0 S
 **Important**  
 Before you install and configure the App-V 5.0 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings.
 
- 
+ 
 
 ##  App-V 5.0 Server overview
 
@@ -70,7 +73,7 @@ You can also deploy the App-V 5.0 clients and packages by using an ESD without h
 **Note**  
 The App-V 5.0 reporting server and reporting database can still be deployed alongside the ESD to collect the reporting data from the App-V 5.0 clients. However, the other three server components should not be deployed, because they will conflict with the ESD functionality.
 
- 
+ 
 
 [Deploying App-V 5.0 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-50-packages-by-using-electronic-software-distribution--esd-.md)
 
@@ -116,9 +119,9 @@ Use the following link for more information [About App-V 5.0 Reporting](about-ap
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/deploying-the-app-v-51-sequencer-and-client.md b/mdop/appv-v5/deploying-the-app-v-51-sequencer-and-client.md
index 4e19a4e5ab..0811cc8ca8 100644
--- a/mdop/appv-v5/deploying-the-app-v-51-sequencer-and-client.md
+++ b/mdop/appv-v5/deploying-the-app-v-51-sequencer-and-client.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying the App-V 5.1 Sequencer and Client
 description: Deploying the App-V 5.1 Sequencer and Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 74f32794-4c76-436f-a542-f9e95d89063d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -42,7 +45,7 @@ You can use the Microsoft ADMX template to configure the client settings for the
 **Important**  
 You can obtain the App-V 5.1 ADMX template from the Microsoft Download Center.
 
- 
+ 
 
 After you download and install the ADMX template, perform the following steps on the computer that you will use to manage Group Policy. This is typically the Domain Controller.
 
@@ -64,7 +67,7 @@ The App-V 5.1 Shared Content Store (SCS) mode enables the SCS App-V 5.1 clients
 **Important**  
 If the App-V 5.1 client is configured to run in the SCS mode, the location where the App-V 5.1 packages are streamed from must be available, otherwise, the virtualized package will fail. Additionally, we do not recommend deployment of virtualized applications to computers that run the App-V 5.1 client in the SCS mode across the internet.
 
- 
+ 
 
 Additionally, the SCS is not a physical location that contains virtualized packages. It is a mode that allows the App-V 5.1 client to stream the required virtualized package data across the network.
 
@@ -110,9 +113,9 @@ You can use the App-V 5.1 Sequencer log information to help troubleshoot the Seq
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/deploying-the-app-v-51-server.md b/mdop/appv-v5/deploying-the-app-v-51-server.md
index aff7bdb99b..10380a684e 100644
--- a/mdop/appv-v5/deploying-the-app-v-51-server.md
+++ b/mdop/appv-v5/deploying-the-app-v-51-server.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying the App-V 5.1 Server
 description: Deploying the App-V 5.1 Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 987b61dc-00d6-49ba-8f1b-92d7b948e702
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -21,7 +24,7 @@ For information about deploying the App-V Server, see [About App-V 5.1](about-ap
 **Important**  
 Before you install and configure the App-V 5.1 servers, you must specify a port where each component will be hosted. You must also add the associated firewall rules to allow incoming requests to access the specified ports. The installer does not modify firewall settings.
 
- 
+ 
 
 ##  App-V 5.1 Server overview
 
@@ -70,7 +73,7 @@ You can also deploy the App-V 5.1 clients and packages by using an ESD without h
 **Note**  
 The App-V 5.1 reporting server and reporting database can still be deployed alongside the ESD to collect the reporting data from the App-V 5.1 clients. However, the other three server components should not be deployed, because they will conflict with the ESD functionality.
 
- 
+ 
 
 [Deploying App-V 5.1 Packages by Using Electronic Software Distribution (ESD)](deploying-app-v-51-packages-by-using-electronic-software-distribution--esd-.md)
 
@@ -116,9 +119,9 @@ Use the following link for more information [About App-V 5.1 Reporting](about-ap
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/evaluating-app-v-50.md b/mdop/appv-v5/evaluating-app-v-50.md
index 972342d307..1b2cc2ac24 100644
--- a/mdop/appv-v5/evaluating-app-v-50.md
+++ b/mdop/appv-v5/evaluating-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: Evaluating App-V 5.0
 description: Evaluating App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 0b4a6b12-559d-429f-9659-dc8f4883feab
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/evaluating-app-v-51.md b/mdop/appv-v5/evaluating-app-v-51.md
index 41aad1077c..84facb34f4 100644
--- a/mdop/appv-v5/evaluating-app-v-51.md
+++ b/mdop/appv-v5/evaluating-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: Evaluating App-V 5.1
 description: Evaluating App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 92d80b23-3eca-4be3-a771-e700ad1470db
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/getting-started-with-app-v-50--rtm.md b/mdop/appv-v5/getting-started-with-app-v-50--rtm.md
index 621eb9a3f4..861662bca5 100644
--- a/mdop/appv-v5/getting-started-with-app-v-50--rtm.md
+++ b/mdop/appv-v5/getting-started-with-app-v-50--rtm.md
@@ -1,8 +1,11 @@
 ---
 title: Getting Started with App-V 5.0
 description: Getting Started with App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 3e16eafb-ce95-4d06-b214-fe0f4b1b495f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -53,7 +56,7 @@ App-V consists of the following elements:
 
  • Retrieves virtual applications
    • 
 
  • Publishes the applications on the clients
    • 
 
  • Automatically sets up and manages virtual environments at runtime on Windows endpoints.
    • 
-
  • Stores user-specific virtual application settings, such as registry and file changes, in each user's profile.
    • 
+
  • Stores user-specific virtual application settings, such as registry and file changes, in each user's profile.
    • 
 
 
 
@@ -75,7 +78,7 @@ App-V consists of the following elements:
 
 
 
- 
+ 
 
 For more information about these elements, see [High Level Architecture for App-V 5.0](high-level-architecture-for-app-v-50.md).
 
@@ -84,7 +87,7 @@ If you are new to this product, we recommend that you read the documentation tho
 **Note**  
 A downloadable version of this administrator’s guide is not available. However, you can learn about a special mode of the TechNet Library that allows you to select articles, group them in a collection, and print them or export them to a file at  (https://go.microsoft.com/fwlink/?LinkId=272491).
 
- 
+ 
 
 This section of the App-V 5.0 Administrator’s Guide includes high-level information about App-V 5.0 to provide you with a basic understanding of the product before you begin the deployment planning.
 
@@ -137,9 +140,9 @@ This section of the App-V 5.0 Administrator’s Guide includes high-level inform
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/getting-started-with-app-v-51.md b/mdop/appv-v5/getting-started-with-app-v-51.md
index 5729e3b1ac..f508e2c3a6 100644
--- a/mdop/appv-v5/getting-started-with-app-v-51.md
+++ b/mdop/appv-v5/getting-started-with-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: Getting Started with App-V 5.1
 description: Getting Started with App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 49a20e1f-0566-4e53-a417-1521393fc974
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -53,7 +56,7 @@ App-V consists of the following elements:
 
  • Retrieves virtual applications
    • 
 
  • Publishes the applications on the clients
    • 
 
  • Automatically sets up and manages virtual environments at runtime on Windows endpoints.
    • 
-
  • Stores user-specific virtual application settings, such as registry and file changes, in each user's profile.
    • 
+
  • Stores user-specific virtual application settings, such as registry and file changes, in each user's profile.
    • 
 
 
 
@@ -75,7 +78,7 @@ App-V consists of the following elements:
 
 
 
- 
+ 
 
 For more information about these elements, see [High Level Architecture for App-V 5.1](high-level-architecture-for-app-v-51.md).
 
@@ -84,7 +87,7 @@ If you are new to this product, we recommend that you read the documentation tho
 **Note**  
 A downloadable version of this administrator’s guide is not available. However, you can learn about a special mode of the TechNet Library that allows you to select articles, group them in a collection, and print them or export them to a file at  (https://go.microsoft.com/fwlink/?LinkId=272491).
 
- 
+ 
 
 This section of the App-V 5.1 Administrator’s Guide includes high-level information about App-V 5.1 to provide you with a basic understanding of the product before you begin the deployment planning.
 
@@ -127,9 +130,9 @@ This section of the App-V 5.1 Administrator’s Guide includes high-level inform
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/high-level-architecture-for-app-v-50.md b/mdop/appv-v5/high-level-architecture-for-app-v-50.md
index 3f7b38c37a..e23df5f0a1 100644
--- a/mdop/appv-v5/high-level-architecture-for-app-v-50.md
+++ b/mdop/appv-v5/high-level-architecture-for-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: High Level Architecture for App-V 5.0
 description: High Level Architecture for App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: fdf8b841-918f-4672-b352-0f2b9519581b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -61,12 +64,12 @@ A typical App-V 5.0 implementation consists of the following elements.
 
 
 
- 
+ 
 
 **Note**  
 If you are using App-V 5.0 with Electronic Software Distribution (ESD) you are not required to use the App-V 5.0 Management server, however you can still utilize the reporting and streaming functionality of App-V 5.0.
 
- 
+ 
 
 
 
@@ -78,9 +81,9 @@ If you are using App-V 5.0 with Electronic Software Distribution (ESD) you are n
 
 [Getting Started with App-V 5.0](getting-started-with-app-v-50--rtm.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/high-level-architecture-for-app-v-51.md b/mdop/appv-v5/high-level-architecture-for-app-v-51.md
index dc5140b458..af616233b3 100644
--- a/mdop/appv-v5/high-level-architecture-for-app-v-51.md
+++ b/mdop/appv-v5/high-level-architecture-for-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: High Level Architecture for App-V 5.1
 description: High Level Architecture for App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 90406361-55b8-40b7-85c0-449436789d4c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -61,12 +64,12 @@ A typical App-V 5.1 implementation consists of the following elements.
 
 
 
- 
+ 
 
 **Note**  
 If you are using App-V 5.1 with Electronic Software Distribution (ESD) you are not required to use the App-V 5.1 Management server, however you can still utilize the reporting and streaming functionality of App-V 5.1.
 
- 
+ 
 
 
 
@@ -78,9 +81,9 @@ If you are using App-V 5.1 with Electronic Software Distribution (ESD) you are n
 
 [Getting Started with App-V 5.1](getting-started-with-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-access-the-client-management-console.md b/mdop/appv-v5/how-to-access-the-client-management-console.md
index 0e5f9cbf10..90164220e0 100644
--- a/mdop/appv-v5/how-to-access-the-client-management-console.md
+++ b/mdop/appv-v5/how-to-access-the-client-management-console.md
@@ -1,8 +1,11 @@
 ---
 title: How to Access the Client Management Console
 description: How to Access the Client Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 3f6303c7-f953-4623-8211-c20d1faa846b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Use the App-V 5.0 client management console to manage packages on the computer r
 **Note**  
 To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V 5.0 client.
 
- 
+ 
 
 Use the following procedure to access the client management console.
 
@@ -30,20 +33,20 @@ Use the following procedure to access the client management console.
     **Note**  
     For computers running the App-V 5.0 Remote Desktop Services client version, to access client management console follow step 1 of this procedure on the server running the client.
 
-     
+     
 
 2.  When the App-V 5.0 client management console is displayed, click the tab you want to review and perform any required tasks. For more information about the client management console tasks see, [Using the App-V 5.0 Client Management Console](using-the-app-v-50-client-management-console.md).
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-access-the-client-management-console51.md b/mdop/appv-v5/how-to-access-the-client-management-console51.md
index 8e275a30ff..e98a45a0a3 100644
--- a/mdop/appv-v5/how-to-access-the-client-management-console51.md
+++ b/mdop/appv-v5/how-to-access-the-client-management-console51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Access the Client Management Console
 description: How to Access the Client Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 22131251-acd5-44e7-a30b-7d389c518b6f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Use the App-V 5.1 client management console to manage packages on the computer r
 **Note**  
 To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V 5.1 client.
 
- 
+ 
 
 Use the following procedure to access the client management console.
 
@@ -30,7 +33,7 @@ Use the following procedure to access the client management console.
     **Note**  
     For computers running the App-V 5.1 Remote Desktop Services client version, to access client management console follow step 1 of this procedure on the server running the client.
 
-     
+     
 
 2.  When the App-V 5.1 client management console is displayed, click the tab you want to review and perform any required tasks. For more information about the client management console tasks see, [Using the App-V 5.1 Client Management Console](using-the-app-v-51-client-management-console.md).
 
@@ -41,9 +44,9 @@ Use the following procedure to access the client management console.
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console.md b/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console.md
index 480ef440af..7f2daaca8d 100644
--- a/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console.md
+++ b/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console.md
@@ -1,8 +1,11 @@
 ---
 title: How to Add or Remove an Administrator by Using the Management Console
 description: How to Add or Remove an Administrator by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 0e8ab443-1931-4b1a-95df-6ccbecc9efc5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -30,7 +33,7 @@ Use the following procedures to add or remove an administrator on the App-V 5.0
 
 2.  Right-click the account to be removed from the list of administrators and select **Remove**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console51.md b/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console51.md
index 0d4f699331..e4d9c802e9 100644
--- a/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console51.md
+++ b/mdop/appv-v5/how-to-add-or-remove-an-administrator-by-using-the-management-console51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Add or Remove an Administrator by Using the Management Console
 description: How to Add or Remove an Administrator by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 7ff8c436-9d2e-446a-9ea2-bbab7e25bf21
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md b/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md
index 26833153ad..0d643c8054 100644
--- a/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md
+++ b/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md
@@ -1,8 +1,11 @@
 ---
 title: How to Add or Upgrade Packages by Using the Management Console
 description: How to Add or Upgrade Packages by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 62417b63-06b2-437c-8584-523e1dea97c3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -31,7 +34,7 @@ You can the following procedure to add or upgrade a package to the App-V 5.1 Man
     **Important**  
     You must select a package with the **.appv** file name extension.
 
-     
+     
 
 4.  The page displays the status message **Adding <Packagename>**. Click **IMPORT STATUS** to check the status of a package that you have imported.
 
@@ -46,9 +49,9 @@ You can the following procedure to add or upgrade a package to the App-V 5.1 Man
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md b/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md
index 716eda585a..ac3caca510 100644
--- a/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md
+++ b/mdop/appv-v5/how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md
@@ -1,8 +1,11 @@
 ---
 title: How to Add or Upgrade Packages by Using the Management Console
 description: How to Add or Upgrade Packages by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 4e389d7e-f402-44a7-bc4c-42c2a8440573
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -31,7 +34,7 @@ You can the following procedure to add or upgrade a package to the App-V 5.0 Man
     **Important**  
     You must select a package with the **.appv** file name extension.
 
-     
+     
 
 4.  The page displays the status message **Adding <Packagename>**. Click **IMPORT STATUS** to check the status of a package that you have imported.
 
@@ -39,16 +42,16 @@ You can the following procedure to add or upgrade a package to the App-V 5.0 Man
 
 5.  Click **Close** to close the **Add or Upgrade Packages** page.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups.md b/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups.md
index 765b4e34da..ac99282ee1 100644
--- a/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups.md
+++ b/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups.md
@@ -1,8 +1,11 @@
 ---
 title: How to Allow Only Administrators to Enable Connection Groups
 description: How to Allow Only Administrators to Enable Connection Groups
-author: jamiejdt
+author: dansimp
 ms.assetid: 60e62426-624f-4f26-851e-41cd78520883
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ You can configure the App-V client so that only administrators (not end users) c
 **Note**  
 **This feature is supported starting in App-V 5.0 SP3.**
 
- 
+ 
 
 Use one of the following methods to allow only administrators to enable or disable connection groups.
 
@@ -53,18 +56,18 @@ Use one of the following methods to allow only administrators to enable or disab
 
 
 
- 
+ 
 
-**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Managing Connection Groups](managing-connection-groups.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups51.md b/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups51.md
index 09f8061b96..1a6a35f007 100644
--- a/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups51.md
+++ b/mdop/appv-v5/how-to-allow-only-administrators-to-enable-connection-groups51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Allow Only Administrators to Enable Connection Groups
 description: How to Allow Only Administrators to Enable Connection Groups
-author: jamiejdt
+author: dansimp
 ms.assetid: 42ca3157-5d85-467b-a148-09404f8f737a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ You can configure the App-V client so that only administrators (not end users) c
 **Note**  
 **This feature is supported starting in App-V 5.0 SP3.**
 
- 
+ 
 
 Use one of the following methods to allow only administrators to enable or disable connection groups.
 
@@ -53,7 +56,7 @@ Use one of the following methods to allow only administrators to enable or disab
 
 
 
- 
+ 
 
 **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
@@ -62,9 +65,9 @@ Use one of the following methods to allow only administrators to enable or disab
 
 [Managing Connection Groups](managing-connection-groups51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell.md b/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell.md
index 9ac359896e..3f0b9b7a68 100644
--- a/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell.md
+++ b/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: How to Apply the Deployment Configuration File by Using PowerShell
 description: How to Apply the Deployment Configuration File by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 5df5d5bc-6c72-4087-8b93-d6d4b502a1f4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -26,23 +29,25 @@ The dynamic deployment configuration file is applied when a package is added or
 
     **Add-AppVClientPackage –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml**
 
-    **Note**  
+    **Note**  
     This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document:
 
     **Set-AppVClientPackage –Name Myapp –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml**
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell51.md b/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell51.md
index b1549d824b..dac9fedce1 100644
--- a/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell51.md
+++ b/mdop/appv-v5/how-to-apply-the-deployment-configuration-file-by-using-powershell51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Apply the Deployment Configuration File by Using PowerShell
 description: How to Apply the Deployment Configuration File by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 78fe0f15-4a36-41e3-96d6-7d5aa77c1e06
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -26,23 +29,25 @@ The dynamic deployment configuration file is applied when a package is added or
 
     **Add-AppVClientPackage –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml**
 
-    **Note**  
+    **Note**  
     This command captures the resulting object into $pkg. If the package is already present on the computer, the **Set-AppVclientPackage** cmdlet can be used to apply the deployment configuration document:
 
     **Set-AppVClientPackage –Name Myapp –Path c:\\Packages\\Contoso\\MyApp.appv -DynamicDeploymentConfiguration c:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml**
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell.md b/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell.md
index a156f5e21d..bf8e5bc775 100644
--- a/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell.md
+++ b/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: How to Apply the User Configuration File by Using PowerShell
 description: How to Apply the User Configuration File by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: f7d7c595-4fdd-4096-b53d-9eead111c339
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -30,7 +33,7 @@ Use the following procedure to specify a user-specific configuration file. The f
 
     **Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath c:\\Packages\\Contoso\\config.xml**
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell51.md b/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell51.md
index 7846cdfac7..9ef045bf7b 100644
--- a/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell51.md
+++ b/mdop/appv-v5/how-to-apply-the-user-configuration-file-by-using-powershell51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Apply the User Configuration File by Using PowerShell
 description: How to Apply the User Configuration File by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 986e638c-4a0c-4a7e-be73-f4615e8b8000
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-50.md b/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-50.md
index 80248ff8ea..b09260f550 100644
--- a/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-50.md
+++ b/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-50.md
@@ -1,8 +1,11 @@
 ---
 title: How to Configure Access to Packages by Using the Management Console
 description: How to Configure Access to Packages by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 8f4c91e4-f4e6-48cf-aa94-6085a054e8f7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -35,7 +38,7 @@ Use the following procedure to configure access to virtualized packages.
         **Note**  
         Ensure that you provide an associated domain name for the group that you are searching for.
 
-         
+         
 
 3.  To grant access to the package, select the desired group and click **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane.
 
@@ -57,16 +60,16 @@ Use the following procedure to configure access to virtualized packages.
 
 3.  To close the **AD ACCESS** page, click **Close**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-51.md b/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-51.md
index d722e69366..b7683c7b78 100644
--- a/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-51.md
+++ b/mdop/appv-v5/how-to-configure-access-to-packages-by-using-the-management-console-51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Configure Access to Packages by Using the Management Console
 description: How to Configure Access to Packages by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 4fd39bc2-d814-46de-a108-1c21fa404e8a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -35,7 +38,7 @@ Use the following procedure to configure access to virtualized packages.
         **Note**  
         Ensure that you provide an associated domain name for the group that you are searching for.
 
-         
+         
 
 3.  To grant access to the package, select the desired group and click **Grant Access**. The newly added group is displayed in the **AD ENTITIES WITH ACCESS** pane.
 
@@ -64,9 +67,9 @@ Use the following procedure to configure access to virtualized packages.
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md b/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md
index ad12ad980d..8e6b0c9389 100644
--- a/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md
+++ b/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server
 description: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 23b2d03a-20ce-4973-99ee-748f3b682207
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -21,7 +24,7 @@ Use the following steps to configure the App-V 5.1 client to receive updates fro
 **Note**  
 For the following procedures the management server was installed on a computer named **MyMgmtSrv**, and the publishing server was installed on a computer named **MyPubSrv**.
 
- 
+ 
 
 **To configure the App-V 5.1 client to receive updates from the publishing server**
 
@@ -74,9 +77,9 @@ For the following procedures the management server was installed on a computer n
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md b/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md
index 1577651cb6..fd12886881 100644
--- a/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md
+++ b/mdop/appv-v5/how-to-configure-the-client-to-receive-package-and-connection-groups-updates-from-the-publishing-server-beta.md
@@ -1,8 +1,11 @@
 ---
 title: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server
 description: How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server
-author: jamiejdt
+author: dansimp
 ms.assetid: f5dfd96d-4b63-468c-8d93-9dfdf47c28fd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -21,7 +24,7 @@ Use the following steps to configure the App-V 5.0 client to receive updates fro
 **Note**  
 For the following procedures the management server was installed on a computer named **MyMgmtSrv**, and the publishing server was installed on a computer named **MyPubSrv**.
 
- 
+ 
 
 **To configure the App-V 5.0 client to receive updates from the publishing server**
 
@@ -67,16 +70,16 @@ For the following procedures the management server was installed on a computer n
 
     The command will query the publishing server for the packages and connection groups that need to be added or removed for this particular client based on the entitlements for the packages and connection groups as configured on the management server.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-connect-to-the-management-console-51.md b/mdop/appv-v5/how-to-connect-to-the-management-console-51.md
index f9cabe35af..b6144f08ac 100644
--- a/mdop/appv-v5/how-to-connect-to-the-management-console-51.md
+++ b/mdop/appv-v5/how-to-connect-to-the-management-console-51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Connect to the Management Console
 description: How to Connect to the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 5a15ed86-7db7-4df3-80ca-bde26f3285e1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-connect-to-the-management-console-beta.md b/mdop/appv-v5/how-to-connect-to-the-management-console-beta.md
index 0558f39097..a460c12f62 100644
--- a/mdop/appv-v5/how-to-connect-to-the-management-console-beta.md
+++ b/mdop/appv-v5/how-to-connect-to-the-management-console-beta.md
@@ -1,8 +1,11 @@
 ---
 title: How to Connect to the Management Console
 description: How to Connect to the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 67dfdfa1-e7dd-4c5e-aa50-f016bd1dc643
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -22,7 +25,7 @@ Use the following procedure to connect to the App-V 5.0 Management Console.
 
 2.  To view different sections of the console, click the desired section in the navigation pane.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md
index a3969a0d7f..e1e6432a8a 100644
--- a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md
+++ b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v.md
@@ -1,8 +1,11 @@
 ---
 title: How to Convert a Package Created in a Previous Version of App-V
 description: How to Convert a Package Created in a Previous Version of App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: b092a5f8-cc5f-4df8-a5a2-0a68fd7bd5b2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,19 +19,19 @@ ms.date: 06/16/2016
 
 You can use the package converter utility to upgrade virtual application packages that have been created with previous versions of App-V.
 
-**Note**  
+**Note**  
 If you are running a computer with a 64-bit architecture, you must use the x86 version of PowerShell.
 
- 
 
-The package converter can only directly convert packages that were created by using the App-V 4.5 sequencer or a subsequent version. Packages that were created using a version prior to App-V 4.5 must be upgraded to the App-V 4.5 or App-V 4.6 format before conversion.
+
+The package converter can only directly convert packages that were created by using the App-V 4.5 sequencer or a subsequent version. Packages that were created using a version prior to App-V 4.5 must be upgraded to the App-V 4.5 or App-V 4.6 format before conversion.
 
 The following information provides direction for converting existing virtual application packages.
 
-**Important**  
+**Important**  
 You must configure the package converter to always save the package ingredients file to a secure location and directory. A secure location is accessible only by an administrator. Additionally, when you deploy the package, you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion process.
 
- 
+
 
 **Getting started**
 
@@ -40,39 +43,39 @@ You must configure the package converter to always save the package ingredients
 Import-Module AppVPkgConverter
 ```
 
-3.  
+3. The following cmdlets are available:
 
-    The following cmdlets are available:
+   -   Test-AppvLegacyPackage – This cmdlet is designed to check packages. It will return information about any failures with the package such as missing **.sft** files, an invalid source, **.osd** file errors, or invalid package version. This cmdlet will not parse the **.sft** file or do any in depth validation. For information about options and basic functionality for this cmdlet, using the PowerShell cmdline, type `Test-AppvLegacyPackage -?`.
 
-    -   Test-AppvLegacyPackage – This cmdlet is designed to check packages. It will return information about any failures with the package such as missing **.sft** files, an invalid source, **.osd** file errors, or invalid package version. This cmdlet will not parse the **.sft** file or do any in depth validation. For information about options and basic functionality for this cmdlet, using the PowerShell cmdline, type `Test-AppvLegacyPackage -?`.
+   -   ConvertFrom-AppvLegacyPackage – To convert an existing package, type `ConvertFrom-AppvLegacyPackage c:\contentStore c:\convertedPackages`. In this command, `c:\contentStore` represents the location of the existing package and `c:\convertedPackages` is the output directory to which the resulting App-V 5.0 virtual application package file will be saved. By default, if you do not specify a new name, the old package name will be used for the App-V 5.0 filename.
 
-    -   ConvertFrom-AppvLegacyPackage – To convert an existing package, type `ConvertFrom-AppvLegacyPackage c:\contentStore c:\convertedPackages`. In this command, `c:\contentStore` represents the location of the existing package and `c:\convertedPackages` is the output directory to which the resulting App-V 5.0 virtual application package file will be saved. By default, if you do not specify a new name, the old package name will be used for the App-V 5.0 filename.
+       Additionally, the package converter optimizes performance of packages in App-V 5.0 by setting the package to stream fault the App-V package.  This is more performant than the primary feature block and fully downloading the package. The flag **DownloadFullPackageOnFirstLaunch** allows you to convert the package and set the package to be fully downloaded by default.
 
-        Additionally, the package converter optimizes performance of packages in App-V 5.0 by setting the package to stream fault the App-V package.  This is more performant than the primary feature block and fully downloading the package. The flag **DownloadFullPackageOnFirstLaunch** allows you to convert the package and set the package to be fully downloaded by default.
+       **Note**  
+       Before you specify the output directory, you must create the output directory.
 
-        **Note**  
-        Before you specify the output directory, you must create the output directory.
 
-         
 
-    **Advanced Conversion Tips**
+~~~
+**Advanced Conversion Tips**
 
-    -   Piping - PowerShell supports piping. Piping allows you to call `dir c:\contentStore\myPackage | Test-AppvLegacyPackage`. In this example, the directory object that represents `myPackage` will be given as input to the `Test-AppvLegacyPackage` command and bound to the `-Source` parameter. Piping like this is especially useful when you want to batch commands together; for example, `dir .\ | Test-AppvLegacyPackage | ConvertFrom-AppvLegacyAppvPackage -Target .\ConvertedPackages`. This piped command would test the packages and then pass those objects on to actually be converted. You can also apply a filter on packages without errors or only specify a directory which contains an **.sprj** file or pipe them to another cmdlet that adds the filtered package to the server or publishes them to the App-V 5.0 client.
+-   Piping - PowerShell supports piping. Piping allows you to call `dir c:\contentStore\myPackage | Test-AppvLegacyPackage`. In this example, the directory object that represents `myPackage` will be given as input to the `Test-AppvLegacyPackage` command and bound to the `-Source` parameter. Piping like this is especially useful when you want to batch commands together; for example, `dir .\ | Test-AppvLegacyPackage | ConvertFrom-AppvLegacyAppvPackage -Target .\ConvertedPackages`. This piped command would test the packages and then pass those objects on to actually be converted. You can also apply a filter on packages without errors or only specify a directory which contains an **.sprj** file or pipe them to another cmdlet that adds the filtered package to the server or publishes them to the App-V 5.0 client.
 
-    -   Batching - The PowerShell command enables batching. More specifically, the cmdlets support taking a string\[\] object for the `-Source` parameter which represents a list of directory paths. This allows you to enter `$packages = dir c:\contentStore` and then call `ConvertFrom-AppvLegacyAppvPackage-Source $packages -Target c:\ConvertedPackages` or to use piping and call `dir c:\ContentStore | ConvertFrom-AppvLegacyAppvPackage -Target C:\ConvertedPackages`.
+-   Batching - The PowerShell command enables batching. More specifically, the cmdlets support taking a string\[\] object for the `-Source` parameter which represents a list of directory paths. This allows you to enter `$packages = dir c:\contentStore` and then call `ConvertFrom-AppvLegacyAppvPackage-Source $packages -Target c:\ConvertedPackages` or to use piping and call `dir c:\ContentStore | ConvertFrom-AppvLegacyAppvPackage -Target C:\ConvertedPackages`.
 
-    -   Other functionality - PowerShell has other built-in functionality for features such as aliases, piping, lazy-binding, .NET object, and many others. All of these are usable in PowerShell and can help you create advanced scenarios for the Package Converter.
+-   Other functionality - PowerShell has other built-in functionality for features such as aliases, piping, lazy-binding, .NET object, and many others. All of these are usable in PowerShell and can help you create advanced scenarios for the Package Converter.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md
index 8a07e352fe..b146f4dd7f 100644
--- a/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md
+++ b/mdop/appv-v5/how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Convert a Package Created in a Previous Version of App-V
 description: How to Convert a Package Created in a Previous Version of App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 3366d399-2891-491d-8de1-f8cfdf39bbab
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,19 +19,19 @@ ms.date: 06/16/2016
 
 You can use the package converter utility to upgrade virtual application packages that have been created with previous versions of App-V.
 
-**Note**  
+**Note**  
 If you are running a computer with a 64-bit architecture, you must use the x86 version of PowerShell.
 
- 
 
-The package converter can only directly convert packages that were created by using the App-V 4.5 sequencer or a subsequent version. Packages that were created using a version prior to App-V 4.5 must be upgraded to the App-V 4.5 or App-V 4.6 format before conversion.
+
+The package converter can only directly convert packages that were created by using the App-V 4.5 sequencer or a subsequent version. Packages that were created using a version prior to App-V 4.5 must be upgraded to the App-V 4.5 or App-V 4.6 format before conversion.
 
 The following information provides direction for converting existing virtual application packages.
 
-**Important**  
+**Important**  
 You must configure the package converter to always save the package ingredients file to a secure location and directory. A secure location is accessible only by an administrator. Additionally, when you deploy the package, you should save the package to a location that is secure, or make sure that no other user is allowed to be logged in during the conversion process.
 
- 
+
 
 **App-V 4.6 installation folder is redirected to virtual file system root**
 
@@ -50,31 +53,33 @@ Prior to App-V 5.1, the 4.6 root folder was not recognized and could not be acce
 
     -   ConvertFrom-AppvLegacyPackage – To convert an existing package, type `ConvertFrom-AppvLegacyPackage c:\contentStore c:\convertedPackages`. In this command, `c:\contentStore` represents the location of the existing package and `c:\convertedPackages` is the output directory to which the resulting App-V 5.1 virtual application package file will be saved. By default, if you do not specify a new name, the old package name will be used for the App-V 5.1 filename.
 
-        Additionally, the package converter optimizes performance of packages in App-V 5.1 by setting the package to stream fault the App-V package.  This is more performant than the primary feature block and fully downloading the package. The flag **DownloadFullPackageOnFirstLaunch** allows you to convert the package and set the package to be fully downloaded by default.
+        Additionally, the package converter optimizes performance of packages in App-V 5.1 by setting the package to stream fault the App-V package.  This is more performant than the primary feature block and fully downloading the package. The flag **DownloadFullPackageOnFirstLaunch** allows you to convert the package and set the package to be fully downloaded by default.
 
-        **Note**  
+        **Note**  
         Before you specify the output directory, you must create the output directory.
 
-         
 
-    **Advanced Conversion Tips**
 
-    -   Piping - PowerShell supports piping. Piping allows you to call `dir c:\contentStore\myPackage | Test-AppvLegacyPackage`. In this example, the directory object that represents `myPackage` will be given as input to the `Test-AppvLegacyPackage` command and bound to the `-Source` parameter. Piping like this is especially useful when you want to batch commands together; for example, `dir .\ | Test-AppvLegacyPackage | ConvertFrom-AppvLegacyAppvPackage -Target .\ConvertedPackages`. This piped command would test the packages and then pass those objects on to actually be converted. You can also apply a filter on packages without errors or only specify a directory which contains an **.sprj** file or pipe them to another cmdlet that adds the filtered package to the server or publishes them to the App-V 5.1 client.
+~~~
+**Advanced Conversion Tips**
 
-    -   Batching - The PowerShell command enables batching. More specifically, the cmdlets support taking a string\[\] object for the `-Source` parameter which represents a list of directory paths. This allows you to enter `$packages = dir c:\contentStore` and then call `ConvertFrom-AppvLegacyAppvPackage-Source $packages -Target c:\ConvertedPackages` or to use piping and call `dir c:\ContentStore | ConvertFrom-AppvLegacyAppvPackage -Target C:\ConvertedPackages`.
+-   Piping - PowerShell supports piping. Piping allows you to call `dir c:\contentStore\myPackage | Test-AppvLegacyPackage`. In this example, the directory object that represents `myPackage` will be given as input to the `Test-AppvLegacyPackage` command and bound to the `-Source` parameter. Piping like this is especially useful when you want to batch commands together; for example, `dir .\ | Test-AppvLegacyPackage | ConvertFrom-AppvLegacyAppvPackage -Target .\ConvertedPackages`. This piped command would test the packages and then pass those objects on to actually be converted. You can also apply a filter on packages without errors or only specify a directory which contains an **.sprj** file or pipe them to another cmdlet that adds the filtered package to the server or publishes them to the App-V 5.1 client.
 
-    -   Other functionality - PowerShell has other built-in functionality for features such as aliases, piping, lazy-binding, .NET object, and many others. All of these are usable in PowerShell and can help you create advanced scenarios for the Package Converter.
+-   Batching - The PowerShell command enables batching. More specifically, the cmdlets support taking a string\[\] object for the `-Source` parameter which represents a list of directory paths. This allows you to enter `$packages = dir c:\contentStore` and then call `ConvertFrom-AppvLegacyAppvPackage-Source $packages -Target c:\ConvertedPackages` or to use piping and call `dir c:\ContentStore | ConvertFrom-AppvLegacyAppvPackage -Target C:\ConvertedPackages`.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+-   Other functionality - PowerShell has other built-in functionality for features such as aliases, piping, lazy-binding, .NET object, and many others. All of these are usable in PowerShell and can help you create advanced scenarios for the Package Converter.
+
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md b/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md
index 92dcf1e47a..f9ce72926a 100644
--- a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md
+++ b/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create a Connection Group with User-Published and Globally Published Packages
 description: How to Create a Connection Group with User-Published and Globally Published Packages
-author: jamiejdt
+author: dansimp
 ms.assetid: 82f7ea7f-7b14-4506-8940-fdcd6c3e117f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -49,9 +52,9 @@ You can create user-entitled connection groups that contain both user-published
 
 1.  Add and publish packages by using the following commands:
 
-    **Add-AppvClientPackage Pacakage1\_AppV\_file\_Path**
+    **Add-AppvClientPackage Package1\_AppV\_file\_Path**
 
-    **Add-AppvClientPackage Pacakage2\_AppV\_file\_Path**
+    **Add-AppvClientPackage Package2\_AppV\_file\_Path**
 
     **Publish-AppvClientPackage -PackageId Package1\_ID -VersionId Package1\_Version ID -Global**
 
@@ -73,7 +76,7 @@ You can create user-entitled connection groups that contain both user-published
 
 3.  Follow the instructions in [How to Create a Connection Group](how-to-create-a-connection-group.md) to create the connection group, and add the user-published and globally published packages.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md b/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md
index cc25866145..fe42b5278b 100644
--- a/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md
+++ b/mdop/appv-v5/how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create a Connection Group with User-Published and Globally Published Packages
 description: How to Create a Connection Group with User-Published and Globally Published Packages
-author: jamiejdt
+author: dansimp
 ms.assetid: 851b8742-0283-4aa6-b3a3-f7f6289824c3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -50,9 +53,9 @@ You can create user-entitled connection groups that contain both user-published
 
 1.  Add and publish packages by using the following commands:
 
-    **Add-AppvClientPackage Pacakage1\_AppV\_file\_Path**
+    **Add-AppvClientPackage Package1\_AppV\_file\_Path**
 
-    **Add-AppvClientPackage Pacakage2\_AppV\_file\_Path**
+    **Add-AppvClientPackage Package2\_AppV\_file\_Path**
 
     **Publish-AppvClientPackage -PackageId Package1\_ID -VersionId Package1\_Version ID -Global**
 
diff --git a/mdop/appv-v5/how-to-create-a-connection-group.md b/mdop/appv-v5/how-to-create-a-connection-group.md
index 090d7acfdc..70a482f2c4 100644
--- a/mdop/appv-v5/how-to-create-a-connection-group.md
+++ b/mdop/appv-v5/how-to-create-a-connection-group.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create a Connection Group
 description: How to Create a Connection Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 9d272052-2d28-4e41-989c-89610482a0ca
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -39,11 +42,11 @@ When you place packages in a connection group, their package root paths are merg
     **Important**  
     By default, the Active Directory Domain Services access configurations that are associated with a specific application are not added to the connection group. To transfer the Active Directory access configuration, select **ADD PACKAGE ACCESS TO GROUP ACCESS**, which is located in the **PACKAGES IN** pane.
 
-     
+     
 
 7.  After adding all the applications and configuring Active Directory access, click **Apply**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
@@ -52,9 +55,9 @@ When you place packages in a connection group, their package root paths are merg
 
 [Managing Connection Groups](managing-connection-groups.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-create-a-connection-group51.md b/mdop/appv-v5/how-to-create-a-connection-group51.md
index 1e55e23904..f5605affe1 100644
--- a/mdop/appv-v5/how-to-create-a-connection-group51.md
+++ b/mdop/appv-v5/how-to-create-a-connection-group51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create a Connection Group
 description: How to Create a Connection Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 221e2eed-7ebb-42e3-b3d6-11c37c0578e6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -37,7 +40,7 @@ When you place packages in a connection group, their package root paths are merg
     **Important**  
     By default, the Active Directory Domain Services access configurations that are associated with a specific application are not added to the connection group. To transfer the Active Directory access configuration, select **ADD PACKAGE ACCESS TO GROUP ACCESS**, which is located in the **PACKAGES IN** pane.
 
-     
+     
 
 6.  After adding all the applications and configuring Active Directory access, click **Apply**.
 
@@ -50,9 +53,9 @@ When you place packages in a connection group, their package root paths are merg
 
 [Managing Connection Groups](managing-connection-groups51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md b/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md
index c247febbaf..4837568ff0 100644
--- a/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md
+++ b/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-50-management-console.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create a Custom Configuration File by Using the App-V 5.0 Management Console
 description: How to Create a Custom Configuration File by Using the App-V 5.0 Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 0d1f6768-be30-4682-8eeb-aa95918b24c3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -28,7 +31,7 @@ Use the following procedure to create a Dynamic User Configuration file by using
 
 4.  Click **Advanced**, and then click **Export Configuration**. Type in a filename and click **Save**. Now you can edit the file to configure a package for a user.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md b/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md
index 094206053c..eb1da74435 100644
--- a/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md
+++ b/mdop/appv-v5/how-to-create-a-custom-configuration-file-by-using-the-app-v-51-management-console.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create a Custom Configuration File by Using the App-V 5.1 Management Console
 description: How to Create a Custom Configuration File by Using the App-V 5.1 Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: f5ab426a-f49a-47b3-93f3-b9d60aada8f4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -28,21 +31,23 @@ Use the following procedure to create a Dynamic User Configuration file by using
 
 4.  Click **Advanced**, and then click **Export Configuration**. Type in a filename and click **Save**. Now you can edit the file to configure a package for a user.
 
-    **Note**  
+    **Note**  
     To export a configuration while running on Windows Server, you must disable "IE Enhanced Security Configuration". If this is enabled and set to block downloads, you cannot download anything from the App-V Server.
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell.md b/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell.md
index 5432331c70..0f7df5d66c 100644
--- a/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell.md
+++ b/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create a Package Accelerator by Using PowerShell
 description: How to Create a Package Accelerator by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 8e527363-d961-4153-826a-446a4ad8d980
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -40,7 +43,7 @@ App-V 5.0 package accelerators automatically sequence large, complex application
 
     -   **AcceleratorDescriptionFile** - specifies the path to user created package accelerator instructions. The package accelerator instructions are **.txt** or **.rtf** description files that will be packaged with the package created using the package accelerator.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell51.md b/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell51.md
index 50aeafba9b..ef6e767d58 100644
--- a/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell51.md
+++ b/mdop/appv-v5/how-to-create-a-package-accelerator-by-using-powershell51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create a Package Accelerator by Using PowerShell
 description: How to Create a Package Accelerator by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 0cb98394-4477-4193-8c5f-1c1773c7263a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-create-a-package-accelerator.md b/mdop/appv-v5/how-to-create-a-package-accelerator.md
index f535031df4..b823c813a0 100644
--- a/mdop/appv-v5/how-to-create-a-package-accelerator.md
+++ b/mdop/appv-v5/how-to-create-a-package-accelerator.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create a Package Accelerator
 description: How to Create a Package Accelerator
-author: jamiejdt
+author: dansimp
 ms.assetid: dfe305e5-7cf8-498f-9581-4805ffc722bd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,81 +19,87 @@ ms.date: 06/16/2016
 
 App-V 5.0 package accelerators automatically generate new virtual application packages.
 
-**Note**  
+**Note**  
 You can use PowerShell to create a package accelerator. For more information see [How to Create a Package Accelerator by Using PowerShell](how-to-create-a-package-accelerator-by-using-powershell.md).
 
- 
+
 
 Use the following procedure to create a package accelerator.
 
-**Important**  
+**Important**  
 Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V 5.0 Package Accelerator is applied.
 
- 
 
-**Important**  
+
+**Important**  
 Before you begin the following procedure, you should perform the following:
 
 -   Copy the virtual application package that you will use to create the package accelerator locally to the computer running the sequencer.
 
 -   Copy all required installation files associated with the virtual application package to the computer running the sequencer.
 
- 
+
 
 **To create a package accelerator**
 
-1.  **Important**  
+1.  **Important**  
     The App-V 5.0 Sequencer does not grant any license rights to the software application you are using to create the Package Accelerator. You must abide by all end user license terms for the application you are using. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using App-V 5.0 Sequencer.
 
-     
 
-    To start the App-V 5.0 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**.
 
-2.  To start the App-V 5.0 **Create Package Accelerator** wizard, in the App-V 5.0 sequencer console, click **Tools** / **Create Accelerator**.
+~~~
+To start the App-V 5.0 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**.
+~~~
 
-3.  On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.appv file).
+2. To start the App-V 5.0 **Create Package Accelerator** wizard, in the App-V 5.0 sequencer console, click **Tools** / **Create Accelerator**.
 
-    **Tip**  
-    Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer.
+3. On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.appv file).
 
-     
+   **Tip**  
+   Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer.
 
-    Click **Next**.
 
-4.  On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files.
 
-    **Tip**  
-    Copy the folder that contains the required installation files to the computer running the Sequencer.
+~~~
+Click **Next**.
+~~~
 
-     
+4. On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files.
 
-5.  If the application is already installed on the computer running the sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location.
+   **Tip**  
+   Copy the folder that contains the required installation files to the computer running the Sequencer.
 
-6.  On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page.
 
-    **Note**  
-    You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard.
 
-     
+5. If the application is already installed on the computer running the sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location.
 
-7.  On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the package accelerator. Select only files that are required for the application to run successfully, and then click **Next**.
+6. On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page.
 
-8.  On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package.
+   **Note**  
+   You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard.
 
-    If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**.
 
-9.  On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**.
+
+7. On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the package accelerator. Select only files that are required for the application to run successfully, and then click **Next**.
+
+8. On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package.
+
+   If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**.
+
+9. On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**.
 
 10. On the **Create Package Accelerator** page, to specify where to save the Package Accelerator, click **Browse** and select the directory.
 
 11. On the **Completion** page, to close the **Create Package Accelerator** wizard, click **Close**.
 
-    **Important**  
-    To help ensure that the package accelerator is as secure as possible, and so that the publisher can be verified when the package accelerator is applied, you should always digitally sign the package accelerator.
+   **Important**  
+   To help ensure that the package accelerator is as secure as possible, and so that the publisher can be verified when the package accelerator is applied, you should always digitally sign the package accelerator.
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
@@ -99,9 +108,9 @@ Before you begin the following procedure, you should perform the following:
 
 [How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-create-a-package-accelerator51.md b/mdop/appv-v5/how-to-create-a-package-accelerator51.md
index 9c192fc0ac..45092fa865 100644
--- a/mdop/appv-v5/how-to-create-a-package-accelerator51.md
+++ b/mdop/appv-v5/how-to-create-a-package-accelerator51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create a Package Accelerator
 description: How to Create a Package Accelerator
-author: jamiejdt
+author: dansimp
 ms.assetid: b61f3581-7933-443e-b872-a96bed9ff8d7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,81 +19,87 @@ ms.date: 06/16/2016
 
 App-V 5.1 package accelerators automatically generate new virtual application packages.
 
-**Note**  
+**Note**  
 You can use PowerShell to create a package accelerator. For more information see [How to Create a Package Accelerator by Using PowerShell](how-to-create-a-package-accelerator-by-using-powershell51.md).
 
- 
+
 
 Use the following procedure to create a package accelerator.
 
-**Important**  
+**Important**  
 Package Accelerators can contain password and user-specific information. Therefore you must save Package Accelerators and the associated installation media in a secure location, and you should digitally sign the Package Accelerator after you create it so that the publisher can be verified when the App-V 5.1 Package Accelerator is applied.
 
- 
 
-**Important**  
+
+**Important**  
 Before you begin the following procedure, you should perform the following:
 
 -   Copy the virtual application package that you will use to create the package accelerator locally to the computer running the sequencer.
 
 -   Copy all required installation files associated with the virtual application package to the computer running the sequencer.
 
- 
+
 
 **To create a package accelerator**
 
-1.  **Important**  
+1.  **Important**  
     The App-V 5.1 Sequencer does not grant any license rights to the software application you are using to create the Package Accelerator. You must abide by all end user license terms for the application you are using. It is your responsibility to make sure the software application’s license terms allow you to create a Package Accelerator using App-V 5.1 Sequencer.
 
-     
 
-    To start the App-V 5.1 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**.
 
-2.  To start the App-V 5.1 **Create Package Accelerator** wizard, in the App-V 5.1 sequencer console, click **Tools** / **Create Accelerator**.
+~~~
+To start the App-V 5.1 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**.
+~~~
 
-3.  On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.appv file).
+2. To start the App-V 5.1 **Create Package Accelerator** wizard, in the App-V 5.1 sequencer console, click **Tools** / **Create Accelerator**.
 
-    **Tip**  
-    Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer.
+3. On the **Select Package** page, to specify an existing virtual application package to use to create the Package Accelerator, click **Browse**, and locate the existing virtual application package (.appv file).
 
-     
+   **Tip**  
+   Copy the files associated with the virtual application package you plan to use locally to the computer running the Sequencer.
 
-    Click **Next**.
 
-4.  On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files.
 
-    **Tip**  
-    Copy the folder that contains the required installation files to the computer running the Sequencer.
+~~~
+Click **Next**.
+~~~
 
-     
+4. On the **Installation Files** page, to specify the folder that contains the installation files that you used to create the original virtual application package, click **Browse**, and then select the directory that contains the installation files.
 
-5.  If the application is already installed on the computer running the sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location.
+   **Tip**  
+   Copy the folder that contains the required installation files to the computer running the Sequencer.
 
-6.  On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page.
 
-    **Note**  
-    You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard.
 
-     
+5. If the application is already installed on the computer running the sequencer, to specify the installation file, select **Files installed on local system**. To use this option, the application must already be installed in the default installation location.
 
-7.  On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the package accelerator. Select only files that are required for the application to run successfully, and then click **Next**.
+6. On the **Gathering Information** page, review the files that were not found in the location specified on the **Installation Files** page of this wizard. If the files displayed are not required, select **Remove these files**, and then click **Next**. If the files are required, click **Previous** and copy the required files to the directory specified on the **Installation Files** page.
 
-8.  On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package.
+   **Note**  
+   You must either remove the unrequired files, or click **Previous** and locate the required files to advance to the next page of this wizard.
 
-    If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**.
 
-9.  On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**.
+
+7. On the **Select Files** page, carefully review the files that were detected, and clear any file that should be removed from the package accelerator. Select only files that are required for the application to run successfully, and then click **Next**.
+
+8. On the **Verify Applications** page, confirm that all installation files that are required to build the package are displayed. When the Package Accelerator is used to create a new package, all installation files displayed in the **Applications** pane are required to create the package.
+
+   If necessary, to add additional Installer files, click **Add**. To remove unnecessary installation files, select the Installer file, and then click **Delete**. To edit the properties associated with an installer, click **Edit**. The installation files specified in this step will be required when the Package Accelerator is used to create a new virtual application package. After you have confirmed the information displayed, click **Next**.
+
+9. On the **Select Guidance** page, to specify a file that contains information about how the Package Accelerator, click **Browse**. For example, this file can contain information about how the computer running the Sequencer should be configured, application prerequisite information for target computers, and general notes. You should provide all required information for the Package Accelerator to be successfully applied. The file you select must be in rich text (.rtf) or text file (.txt) format. Click **Next**.
 
 10. On the **Create Package Accelerator** page, to specify where to save the Package Accelerator, click **Browse** and select the directory.
 
 11. On the **Completion** page, to close the **Create Package Accelerator** wizard, click **Close**.
 
-    **Important**  
-    To help ensure that the package accelerator is as secure as possible, and so that the publisher can be verified when the package accelerator is applied, you should always digitally sign the package accelerator.
+   **Important**  
+   To help ensure that the package accelerator is as secure as possible, and so that the publisher can be verified when the package accelerator is applied, you should always digitally sign the package accelerator.
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
@@ -99,9 +108,9 @@ Before you begin the following procedure, you should perform the following:
 
 [How to Create a Virtual Application Package Using an App-V Package Accelerator](how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md b/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md
index e5a5e52e28..d6752dc7b3 100644
--- a/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md
+++ b/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create a Virtual Application Package Using an App-V Package Accelerator
 description: How to Create a Virtual Application Package Using an App-V Package Accelerator
-author: jamiejdt
+author: dansimp
 ms.assetid: 715e7526-e100-419c-8fc1-75cbfe433835
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -14,17 +17,17 @@ ms.date: 06/16/2016
 # How to Create a Virtual Application Package Using an App-V Package Accelerator
 
 
-**Important**  
+**Important**  
 The App-V 5.0 Sequencer does not grant any license rights to the software application that you use to create the Package Accelerator. You must abide by all end user license terms for the application that you use. It is your responsibility to make sure that the software application’s license terms allow you to create a Package Accelerator with the App-V 5.0 Sequencer.
 
- 
+
 
 Use the following procedure to create a virtual application package with the App-V 5.0 Package Accelerator.
 
-**Note**  
+**Note**  
 Before you start this procedure, copy the required Package Accelerator locally to the computer that runs the App-V 5.0 Sequencer. You should also copy all required installation files for the package to a local directory on the computer that runs the Sequencer. This is the directory that you have to specify in step 5 of this procedure.
 
- 
+
 
 **To create a virtual application package with an App-V 5.0 Package Accelerator**
 
@@ -34,10 +37,10 @@ Before you start this procedure, copy the required Package Accelerator locally t
 
 3.  To specify the package accelerator that will be used to create the new virtual application package, click **Browse** on the **Select Package Accelerator** page. Click **Next**.
 
-    **Important**  
+    **Important**  
     If the publisher of the package accelerator cannot be verified and does not contain a valid digital signature, then before you click **Run**, you must confirm that you trust the source of the package accelerator. Confirm your choice in the **Security Warning** dialog box.
 
-     
+
 
 4.  On the **Guidance** page, review the publishing guidance information that is displayed in the information pane. This information was added when the Package Accelerator was created and it contains guidance about how to create and publish the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**.
 
@@ -45,7 +48,7 @@ Before you start this procedure, copy the required Package Accelerator locally t
 
     Alternatively, if you have already copied the installation files to a directory on this computer, click **Make New Folder**, browse to the folder that contains the installation files, and then click **Next**.
 
-    **Note**  
+    **Note**  
     You can specify the following types of supported installation files:
 
     -   Windows Installer files (**.msi**)
@@ -58,44 +61,46 @@ Before you start this procedure, copy the required Package Accelerator locally t
 
     The following file types are not supported: **.msp** and **.exe** files. If you specify an **.exe** file, you must extract the installation files manually.
 
-     
 
-    If the package accelerator requires an application to be installed before you apply the Package Accelerator, and if you have already installed the required application, select **I have installed all applications**, and then click **Next** on the **Local Installation** page.
 
-6.  On the **Package Name** page, specify a name that will be associated with the package. The name that you specify identifies the package in the App-V Management Console. Click **Next**.
+~~~
+If the package accelerator requires an application to be installed before you apply the Package Accelerator, and if you have already installed the required application, select **I have installed all applications**, and then click **Next** on the **Local Installation** page.
+~~~
 
-7.  On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package that you are creating. To confirm the location where the package is created, review the information that is displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB.
+6. On the **Package Name** page, specify a name that will be associated with the package. The name that you specify identifies the package in the App-V Management Console. Click **Next**.
 
-    To create the package, click **Create**. After the package is created, click **Next**.
+7. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package that you are creating. To confirm the location where the package is created, review the information that is displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB.
 
-8.  On the **Configure Software** page, to enable the Sequencer to configure the applications that are contained in the package, select **Configure Software**. In this step you can configure any associated tasks that must be completed in order to run the application on the target computers. For example, you can configure any associated license agreements.
+   To create the package, click **Create**. After the package is created, click **Next**.
 
-    If you select **Configure Software**, the following items can be configured using the Sequencer as part of this step:
+8. On the **Configure Software** page, to enable the Sequencer to configure the applications that are contained in the package, select **Configure Software**. In this step you can configure any associated tasks that must be completed in order to run the application on the target computers. For example, you can configure any associated license agreements.
 
-    -   **Load Package**. The Sequencer loads the files that are associated with the package. It can take several seconds to an hour to decode the package.
+   If you select **Configure Software**, the following items can be configured using the Sequencer as part of this step:
 
-    -   **Run Each Program**. Optionally run the programs that are contained in the package. This step is helpful to complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at once, select at least one program, and then click **Run All**. To run specific programs, select the program or programs that you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**.
+   -   **Load Package**. The Sequencer loads the files that are associated with the package. It can take several seconds to an hour to decode the package.
 
-    -   **Save Package**. The Sequencer saves the package.
+   -   **Run Each Program**. Optionally run the programs that are contained in the package. This step is helpful to complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at once, select at least one program, and then click **Run All**. To run specific programs, select the program or programs that you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**.
 
-    -   **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block.
+   -   **Save Package**. The Sequencer saves the package.
 
-    If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**.
+   -   **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block.
 
-9.  On the **Completion** page, after you review the information that is displayed in the **Virtual Application Package Report** pane, click **Close**.
+   If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**.
 
-    The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about how to modify a package, see [How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-beta.md).
+9. On the **Completion** page, after you review the information that is displayed in the **Virtual Application Package Report** pane, click **Close**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+   The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about how to modify a package, see [How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-beta.md).
+
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md b/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md
index 9e32de10cc..2552432acc 100644
--- a/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md
+++ b/mdop/appv-v5/how-to-create-a-virtual-application-package-using-an-app-v-package-accelerator51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create a Virtual Application Package Using an App-V Package Accelerator
 description: How to Create a Virtual Application Package Using an App-V Package Accelerator
-author: jamiejdt
+author: dansimp
 ms.assetid: eae1e4f8-f14f-4bc8-9867-052561c37297
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -14,17 +17,17 @@ ms.date: 06/16/2016
 # How to Create a Virtual Application Package Using an App-V Package Accelerator
 
 
-**Important**  
+**Important**  
 The App-V 5.1 Sequencer does not grant any license rights to the software application that you use to create the Package Accelerator. You must abide by all end user license terms for the application that you use. It is your responsibility to make sure that the software application’s license terms allow you to create a Package Accelerator with the App-V 5.1 Sequencer.
 
- 
+
 
 Use the following procedure to create a virtual application package with the App-V 5.1 Package Accelerator.
 
-**Note**  
+**Note**  
 Before you start this procedure, copy the required Package Accelerator locally to the computer that runs the App-V 5.1 Sequencer. You should also copy all required installation files for the package to a local directory on the computer that runs the Sequencer. This is the directory that you have to specify in step 5 of this procedure.
 
- 
+
 
 **To create a virtual application package with an App-V 5.1 Package Accelerator**
 
@@ -34,10 +37,10 @@ Before you start this procedure, copy the required Package Accelerator locally t
 
 3.  To specify the package accelerator that will be used to create the new virtual application package, click **Browse** on the **Select Package Accelerator** page. Click **Next**.
 
-    **Important**  
+    **Important**  
     If the publisher of the package accelerator cannot be verified and does not contain a valid digital signature, then before you click **Run**, you must confirm that you trust the source of the package accelerator. Confirm your choice in the **Security Warning** dialog box.
 
-     
+
 
 4.  On the **Guidance** page, review the publishing guidance information that is displayed in the information pane. This information was added when the Package Accelerator was created and it contains guidance about how to create and publish the package. To export the guidance information to a text (.txt) file, click **Export** and specify the location where the file should be saved, and then click **Next**.
 
@@ -45,7 +48,7 @@ Before you start this procedure, copy the required Package Accelerator locally t
 
     Alternatively, if you have already copied the installation files to a directory on this computer, click **Make New Folder**, browse to the folder that contains the installation files, and then click **Next**.
 
-    **Note**  
+    **Note**  
     You can specify the following types of supported installation files:
 
     -   Windows Installer files (**.msi**)
@@ -58,44 +61,46 @@ Before you start this procedure, copy the required Package Accelerator locally t
 
     The following file types are not supported: **.msp** and **.exe** files. If you specify an **.exe** file, you must extract the installation files manually.
 
-     
 
-    If the package accelerator requires an application to be installed before you apply the Package Accelerator, and if you have already installed the required application, select **I have installed all applications**, and then click **Next** on the **Local Installation** page.
 
-6.  On the **Package Name** page, specify a name that will be associated with the package. The name that you specify identifies the package in the App-V Management Console. Click **Next**.
+~~~
+If the package accelerator requires an application to be installed before you apply the Package Accelerator, and if you have already installed the required application, select **I have installed all applications**, and then click **Next** on the **Local Installation** page.
+~~~
 
-7.  On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package that you are creating. To confirm the location where the package is created, review the information that is displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB.
+6. On the **Package Name** page, specify a name that will be associated with the package. The name that you specify identifies the package in the App-V Management Console. Click **Next**.
 
-    To create the package, click **Create**. After the package is created, click **Next**.
+7. On the **Create Package** page, provide comments that will be associated with the package. The comments should contain identifying information about the package that you are creating. To confirm the location where the package is created, review the information that is displayed in **Save Location**. To compress the package, select **Compress Package**. Select the **Compress Package** check box if the package will be streamed across the network, or when the package size exceeds 4 GB.
 
-8.  On the **Configure Software** page, to enable the Sequencer to configure the applications that are contained in the package, select **Configure Software**. In this step you can configure any associated tasks that must be completed in order to run the application on the target computers. For example, you can configure any associated license agreements.
+   To create the package, click **Create**. After the package is created, click **Next**.
 
-    If you select **Configure Software**, the following items can be configured using the Sequencer as part of this step:
+8. On the **Configure Software** page, to enable the Sequencer to configure the applications that are contained in the package, select **Configure Software**. In this step you can configure any associated tasks that must be completed in order to run the application on the target computers. For example, you can configure any associated license agreements.
 
-    -   **Load Package**. The Sequencer loads the files that are associated with the package. It can take several seconds to an hour to decode the package.
+   If you select **Configure Software**, the following items can be configured using the Sequencer as part of this step:
 
-    -   **Run Each Program**. Optionally run the programs that are contained in the package. This step is helpful to complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at once, select at least one program, and then click **Run All**. To run specific programs, select the program or programs that you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**.
+   -   **Load Package**. The Sequencer loads the files that are associated with the package. It can take several seconds to an hour to decode the package.
 
-    -   **Save Package**. The Sequencer saves the package.
+   -   **Run Each Program**. Optionally run the programs that are contained in the package. This step is helpful to complete any associated license or configuration tasks that are required to run the application before you deploy and run the package on target computers. To run all the programs at once, select at least one program, and then click **Run All**. To run specific programs, select the program or programs that you want to run, and then click **Run Selected**. Complete the required configuration tasks, and then close the applications. It can take several minutes for all programs to run. Click **Next**.
 
-    -   **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block.
+   -   **Save Package**. The Sequencer saves the package.
 
-    If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**.
+   -   **Primary Feature Block**. The Sequencer optimizes the package for streaming by rebuilding the primary feature block.
 
-9.  On the **Completion** page, after you review the information that is displayed in the **Virtual Application Package Report** pane, click **Close**.
+   If you do not want to configure the applications, click **Skip this step**, and to go to step 9 of this procedure, and then click **Next**.
 
-    The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about how to modify a package, see [How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-beta.md).
+9. On the **Completion** page, after you review the information that is displayed in the **Virtual Application Package Report** pane, click **Close**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+   The package is now available in the Sequencer. To edit the package properties, click **Edit \[Package Name\]**. For more information about how to modify a package, see [How to Modify an Existing Virtual Application Package](how-to-modify-an-existing-virtual-application-package-beta.md).
+
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-create-and-use-a-project-template.md b/mdop/appv-v5/how-to-create-and-use-a-project-template.md
index 89e44e559b..514740a212 100644
--- a/mdop/appv-v5/how-to-create-and-use-a-project-template.md
+++ b/mdop/appv-v5/how-to-create-and-use-a-project-template.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create and Use a Project Template
 description: How to Create and Use a Project Template
-author: jamiejdt
+author: dansimp
 ms.assetid: 2063f0b3-47a1-4090-bf99-0f26b107331c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -30,10 +33,10 @@ Use the following procedures to create and apply a new template.
 **Note**  
     If the virtual application package is currently open in the App-V 5.0 Sequencer console, skip to step 3 of this procedure.
 
-2.  To open the existing virtual application package that contains the settings you want to save with the App-V 5.0 project template, click **File** / **Open**, and then click **Edit Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**.
+2. To open the existing virtual application package that contains the settings you want to save with the App-V 5.0 project template, click **File** / **Open**, and then click **Edit Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**.
 
-3.  In the App-V 5.0 Sequencer console, to save the template file, click **File** / **Save As Template**. After you have reviewed the settings that will be saved with the new template, click **OK**. Specify a name that will be associated with the new App-V 5.0 project template. Click Save.
-The new App-V 5.0 project template is saved in the directory specified in step 3 of this procedure.
+3. In the App-V 5.0 Sequencer console, to save the template file, click **File** / **Save As Template**. After you have reviewed the settings that will be saved with the new template, click **OK**. Specify a name that will be associated with the new App-V 5.0 project template. Click Save.
+   The new App-V 5.0 project template is saved in the directory specified in step 3 of this procedure.
 
 **To apply a project template**
 
@@ -48,7 +51,7 @@ The new App-V 5.0 project template is saved in the directory specified in step 3
 
     Create the new virtual application package. The settings saved with the specified template will be applied to the new virtual application package that you are creating.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-create-and-use-a-project-template51.md b/mdop/appv-v5/how-to-create-and-use-a-project-template51.md
index 4d518b4889..cc1d47dba3 100644
--- a/mdop/appv-v5/how-to-create-and-use-a-project-template51.md
+++ b/mdop/appv-v5/how-to-create-and-use-a-project-template51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Create and Use a Project Template
 description: How to Create and Use a Project Template
-author: jamiejdt
+author: dansimp
 ms.assetid: e5ac1dc8-a88f-4b16-8e3c-df07ef5e4c3b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 You can use an App-V 5.1 project template to save commonly applied settings associated with an existing virtual application package. These settings can then be applied when you create new virtual application packages in your environment. Using a project template can streamline the process of creating virtual application packages.
 
-**Note**  
+**Note**  
 You can, and often should apply an App-V 5.1 project template during a package upgrade. For example, if you sequenced an application with a custom exclusion list, it is recommended that an associated template is created and saved for later use while upgrading the sequenced application.
 
- 
+
 
 App-V 5.1 project templates differ from App-V 5.1 Application Accelerators because App-V 5.1 Application Accelerators are application-specific, and App-V 5.1 project templates can be applied to multiple applications.
 
@@ -29,42 +32,46 @@ Use the following procedures to create and apply a new template.
 
 1.  To start the App-V 5.1 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**.
 
-2.  **Note**  
+2.  **Note**  
     If the virtual application package is currently open in the App-V 5.1 Sequencer console, skip to step 3 of this procedure.
 
-     
 
-    To open the existing virtual application package that contains the settings you want to save with the App-V 5.1 project template, click **File** / **Open**, and then click **Edit Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**.
 
-3.  In the App-V 5.1 Sequencer console, to save the template file, click **File** / **Save As Template**. After you have reviewed the settings that will be saved with the new template, click **OK**. Specify a name that will be associated with the new App-V 5.1 project template. Click Save.
+~~~
+To open the existing virtual application package that contains the settings you want to save with the App-V 5.1 project template, click **File** / **Open**, and then click **Edit Package**. On the **Select Package** page, click **Browse** and locate the virtual application package that you want to open. Click **Edit**.
+~~~
 
-    The new App-V 5.1 project template is saved in the directory specified in step 3 of this procedure.
+3. In the App-V 5.1 Sequencer console, to save the template file, click **File** / **Save As Template**. After you have reviewed the settings that will be saved with the new template, click **OK**. Specify a name that will be associated with the new App-V 5.1 project template. Click Save.
+
+   The new App-V 5.1 project template is saved in the directory specified in step 3 of this procedure.
 
 **To apply a project template**
 
-1.  **Important**  
+1.  **Important**  
     Creating a virtual application package using a project template in conjunction with a Package Accelerator is not supported.
 
-     
 
-    To start the App-V 5.1 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**.
 
-2.  To create or upgrade a new virtual application package by using an App-V 5.1 project template, click **File** / **New From Template**.
+~~~
+To start the App-V 5.1 sequencer, on the computer that is running the sequencer, click **Start** / **All Programs** / **Microsoft Application Virtualization** / **Microsoft Application Virtualization Sequencer**.
+~~~
 
-3.  To select the project template that you want to use, browse to the directory where the project template is saved, select the project template, and then click **Open**.
+2. To create or upgrade a new virtual application package by using an App-V 5.1 project template, click **File** / **New From Template**.
 
-    Create the new virtual application package. The settings saved with the specified template will be applied to the new virtual application package that you are creating.
+3. To select the project template that you want to use, browse to the directory where the project template is saved, select the project template, and then click **Open**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+   Create the new virtual application package. The settings saved with the specified template will be applied to the new virtual application package that you are creating.
+
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md b/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md
index 73b2d6cd58..110fce61e0 100644
--- a/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md
+++ b/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console.md
@@ -1,8 +1,11 @@
 ---
 title: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console
 description: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 4f249ee3-cc2d-4b1e-afe5-d1cbf9cabd88
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -30,7 +33,7 @@ Use the following procedure to customize the virtual application extensions for
 
 5.  To edit additional application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog, click **Overwrite** to complete the process.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md b/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md
index 1f1e5a0d91..4d7754f265 100644
--- a/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md
+++ b/mdop/appv-v5/how-to-customize-virtual-applications-extensions-for-a-specific-ad-group-by-using-the-management-console51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console
 description: How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: dd71df05-512f-4eb4-a55f-e5b93601323d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-delete-a-connection-group.md b/mdop/appv-v5/how-to-delete-a-connection-group.md
index 2a5eb2b2c9..8d3a29dee3 100644
--- a/mdop/appv-v5/how-to-delete-a-connection-group.md
+++ b/mdop/appv-v5/how-to-delete-a-connection-group.md
@@ -1,8 +1,11 @@
 ---
 title: How to Delete a Connection Group
 description: How to Delete a Connection Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 92654019-a5ad-4ed7-8c39-45f658f60196
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -22,7 +25,7 @@ Use the following procedure to delete an existing App-V connection group.
 
 2.  Right-click the connection group to be removed, and select **delete**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-delete-a-connection-group51.md b/mdop/appv-v5/how-to-delete-a-connection-group51.md
index 9d5bb1f3a0..90aec39b89 100644
--- a/mdop/appv-v5/how-to-delete-a-connection-group51.md
+++ b/mdop/appv-v5/how-to-delete-a-connection-group51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Delete a Connection Group
 description: How to Delete a Connection Group
-author: jamiejdt
+author: dansimp
 ms.assetid: dfdfb507-8891-4f17-9125-5759c9b74483
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-51.md b/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-51.md
index c059473a85..51e1ae3be1 100644
--- a/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-51.md
+++ b/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Delete a Package in the Management Console
 description: How to Delete a Package in the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 4a2be40b-bbb8-4fab-992d-7466df432858
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-beta.md b/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-beta.md
index c9d9c559c5..a9a1d7847a 100644
--- a/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-beta.md
+++ b/mdop/appv-v5/how-to-delete-a-package-in-the-management-console-beta.md
@@ -1,8 +1,11 @@
 ---
 title: How to Delete a Package in the Management Console
 description: How to Delete a Package in the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: d780aafb-4097-4417-8ecc-30efac73c33a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -22,7 +25,7 @@ Use the following procedure to delete an App-V 5.0 package.
 
 2.  Right-click the package, and select **delete** to remove the package.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md b/mdop/appv-v5/how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md
index e7312a70b2..c84a1d788d 100644
--- a/mdop/appv-v5/how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md
+++ b/mdop/appv-v5/how-to-deploy-app-v-50-packages-using-electronic-software-distribution.md
@@ -1,8 +1,11 @@
 ---
 title: How to deploy App-V 5.0 Packages Using Electronic Software Distribution
 description: How to deploy App-V 5.0 Packages Using Electronic Software Distribution
-author: jamiejdt
+author: dansimp
 ms.assetid: 08e5e05b-dbb8-4be7-b2d8-721ef627da81
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -42,12 +45,12 @@ Use one of the following methods to publish packages to App-V client computers w
 
 
 
    PowerShell
    
-
    Use PowerShell cmdlets to deploy virtualized applications. For more information about using PowerShell and App-V 5.0, see [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md).
    
+
    Use PowerShell cmdlets to deploy virtualized applications. For more information about using PowerShell and App-V 5.0, see Administering App-V by Using PowerShell.
    
 
 
 
 
- 
+ 
 
 **To deploy App-V 5.0 packages by using an ESD**
 
@@ -59,16 +62,16 @@ Use one of the following methods to publish packages to App-V client computers w
 
     If you are using System Center Configuration Manager, start by reviewing [Introduction to Application Management in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=281816) for information about using App-V 5.0 and System Center 2012 Configuration Manager.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md b/mdop/appv-v5/how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md
index 209ec60d49..6171caac63 100644
--- a/mdop/appv-v5/how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md
+++ b/mdop/appv-v5/how-to-deploy-app-v-51-packages-using-electronic-software-distribution.md
@@ -1,8 +1,11 @@
 ---
 title: How to deploy App-V 5.1 Packages Using Electronic Software Distribution
 description: How to deploy App-V 5.1 Packages Using Electronic Software Distribution
-author: jamiejdt
+author: dansimp
 ms.assetid: e1957a5a-1f18-42da-b2c1-a5ae5a4cca7a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -42,12 +45,12 @@ Use one of the following methods to publish packages to App-V client computers w
 
 
 
    PowerShell
    
-
    Use PowerShell cmdlets to deploy virtualized applications. For more information about using PowerShell and App-V 5.1, see [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md).
    
+
    Use PowerShell cmdlets to deploy virtualized applications. For more information about using PowerShell and App-V 5.1, see Administering App-V 5.1 by Using PowerShell.
    
 
 
 
 
- 
+ 
 
 **To deploy App-V 5.1 packages by using an ESD**
 
@@ -66,9 +69,9 @@ Use one of the following methods to publish packages to App-V client computers w
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md b/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md
index b9dfd5d542..b201ab4069 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md
@@ -2,7 +2,10 @@
 title: How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer
 description: How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer
 ms.assetid: 5b7e27e4-4360-464c-b832-f1c7939e5485
-author: jamiejdt
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
+author: dansimp
 ms.date: 06/21/2016
 ---
 
@@ -36,7 +39,7 @@ Use the following information to install the App-V 5.0 client (preferably, with
 
 5.  Test that your App-V 5.0 packages are successful, and then remove the 4.6 packages. To check the user state of your client computers, we recommend that you use [User Experience Virtualization](https://technet.microsoft.com/library/dn458947.aspx) or another user environment management tool.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md b/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md
index e617718801..90cb9db9a7 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md
@@ -2,7 +2,10 @@
 title: How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer
 description: How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer
 ms.assetid: 498d50c7-f13d-4fbb-8ea1-b959ade26fdf
-author: jamiejdt
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-50-server-50sp3.md b/mdop/appv-v5/how-to-deploy-the-app-v-50-server-50sp3.md
index e58de2e0a9..b58dcbe9cc 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-50-server-50sp3.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-50-server-50sp3.md
@@ -1,8 +1,11 @@
 ---
 title: How to Deploy the App-V 5.0 Server
 description: How to Deploy the App-V 5.0 Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 4f8f16af-7d74-42b4-84b8-b04ce668225d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -30,126 +33,126 @@ Use the following procedure to install the App-V 5.0 server. For information abo
 
 **To install the App-V 5.0 server**
 
-1.  Copy the App-V 5.0 server installation files to the computer on which you want to install it.
+1. Copy the App-V 5.0 server installation files to the computer on which you want to install it.
 
-2.  Start the App-V 5.0 server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**.
+2. Start the App-V 5.0 server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**.
 
-3.  Review and accept the license terms, and choose whether to enable Microsoft updates.
+3. Review and accept the license terms, and choose whether to enable Microsoft updates.
 
-4.  On the **Feature Selection** page, select all of the following components.
+4. On the **Feature Selection** page, select all of the following components.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    ComponentDescription
    Management server
    Provides overall management functionality for the App-V infrastructure.
    Management database
    Facilitates database predeployments for App-V management.
    Publishing server
    Provides hosting and streaming functionality for virtual applications.
    Reporting server
    Provides App-V 5.0 reporting services.
    Reporting database
    Facilitates database predeployments for App-V reporting.
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    ComponentDescription
    Management server
    Provides overall management functionality for the App-V infrastructure.
    Management database
    Facilitates database predeployments for App-V management.
    Publishing server
    Provides hosting and streaming functionality for virtual applications.
    Reporting server
    Provides App-V 5.0 reporting services.
    Reporting database
    Facilitates database predeployments for App-V reporting.
    
 
-     
+     
 
-5.  On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line.
+5. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line.
 
-6.  On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below.
+6. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    MethodWhat you need to do
    You are using a custom Microsoft SQL Server instance.
    Select Use the custom instance, and type the name of the instance.
    
-    
    Use the format INSTANCENAME. The assumed installation location is the local computer.
    
-    
    Not supported: A server name using the format ServerName\INSTANCE.
    You are using a custom database name.
    Select Custom configuration and type the database name.
    
-    
    The database name must be unique, or the installation will fail.
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    MethodWhat you need to do
    You are using a custom Microsoft SQL Server instance.
    Select Use the custom instance, and type the name of the instance.
    
+   
    Use the format INSTANCENAME. The assumed installation location is the local computer.
    
+   
    Not supported: A server name using the format ServerName<strong>INSTANCE.
    You are using a custom database name.
    Select Custom configuration and type the database name.
    
+   
    The database name must be unique, or the installation will fail.
    
 
-     
+     
 
-7.  On the **Configure** page, accept the default value **Use this local computer**.
+7. On the **Configure** page, accept the default value **Use this local computer**.
 
-    **Note**  
-    If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed.
+   **Note**  
+   If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed.
 
-     
+     
 
-8.  On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below.
+8. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    MethodWhat you need to do
    You are using a custom Microsoft SQL Server instance.
    Select Use the custom instance, and type the name of the instance.
    
-    
    Use the format INSTANCENAME. The assumed installation location is the local computer.
    
-    
    Not supported: A server name using the format ServerName\INSTANCE.
    You are using a custom database name.
    Select Custom configuration and type the database name.
    
-    
    The database name must be unique, or the installation will fail.
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    MethodWhat you need to do
    You are using a custom Microsoft SQL Server instance.
    Select Use the custom instance, and type the name of the instance.
    
+   
    Use the format INSTANCENAME. The assumed installation location is the local computer.
    
+   
    Not supported: A server name using the format ServerName<strong>INSTANCE.
    You are using a custom database name.
    Select Custom configuration and type the database name.
    
+   
    The database name must be unique, or the installation will fail.
    
 
-     
+     
 
-9.  On the **Configure** page, accept the default value: **Use this local computer**.
+9. On the **Configure** page, accept the default value: **Use this local computer**.
 
-    **Note**  
-    If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed.
+   **Note**  
+   If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed.
 
-     
+     
 
 10. On the **Configure** (Management Server Configuration) page, specify the following:
 
@@ -182,7 +185,7 @@ Use the following procedure to install the App-V 5.0 server. For information abo
     
     
 
-     
+     
 
 11. On the **Configure** **Publishing Server Configuration** page, specify the following:
 
@@ -200,7 +203,7 @@ Use the following procedure to install the App-V 5.0 server. For information abo
     
     
     
    Specify the URL for the management service.
    
-    
    Example: http://localhost:12345
    
+    
    Example: http://localhost:12345
    
     
     
     
    Website name: Specify the custom name that will be used to run the publishing service.
    
@@ -214,7 +217,7 @@ Use the following procedure to install the App-V 5.0 server. For information abo
     
     
 
-     
+     
 
 12. On the **Reporting Server** page, specify the following:
 
@@ -242,7 +245,7 @@ Use the following procedure to install the App-V 5.0 server. For information abo
     
     
 
-     
+     
 
 13. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page.
 
@@ -252,7 +255,7 @@ Use the following procedure to install the App-V 5.0 server. For information abo
 
     Example: **http://localhost:12345/console.html**. If the installation succeeded, the App-V Management console is displayed with no errors.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
@@ -267,9 +270,9 @@ Use the following procedure to install the App-V 5.0 server. For information abo
 
 [How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-50-server-using-a-script.md b/mdop/appv-v5/how-to-deploy-the-app-v-50-server-using-a-script.md
index 403b4c37a9..03f183eae8 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-50-server-using-a-script.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-50-server-using-a-script.md
@@ -1,8 +1,11 @@
 ---
 title: How to Deploy the App-V 5.0 Server Using a Script
 description: How to Deploy the App-V 5.0 Server Using a Script
-author: jamiejdt
+author: dansimp
 ms.assetid: b91a35c8-df9e-4065-9187-abafbe565b84
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -18,8 +21,8 @@ In order to complete the **appv\_server\_setup.exe** Server setup successfully u
 
 Use the following tables for more information about installing the App-V 5.0 server using the command line.
 
->[!NOTE]  
->The information in the following tables can also be accessed using the command line by typing the following command:
+>[!NOTE]
+> The information in the following tables can also be accessed using the command line by typing the following command:
 >```
 > appv\_server\_setup.exe /?
 >```
@@ -66,7 +69,7 @@ Use the following tables for more information about installing the App-V 5.0 ser
     
     
     
-     
+     
 @@ -148,7 +151,7 @@ Use the following tables for more information about installing the App-V 5.0 ser
     
    
     
     

     
     
    
-    
+    
 @@ -620,7 +623,7 @@ Use the following tables for more information about installing the App-V 5.0 ser
     
    
     
     

     
    
 
-     
+     
 
 ### Parameters for using an Existing Reporting Server Database
 
@@ -645,16 +648,16 @@ Use the following tables for more information about installing the App-V 5.0 ser
     
    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"
    
     
     
-    
    /EXISTING_ REPORTING _DB_SQLINSTANCE_USE_DEFAULT
    
+    
    /EXISTING_ REPORTING DB_SQLINSTANCE_USE_DEFAULT
    
     
    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected.
    
     
     
-    
    /EXISTING_ REPORTING_DB_CUSTOM_SQLINSTANCE
    
+    
    /EXISTING REPORTING_DB_CUSTOM_SQLINSTANCE
    
     
    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"
    
     
     
     
    /EXISTING_ REPORTING _DB_NAME
    
-    
    Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISITING_REPORTING_DB_NAME="AppVReporting"
    
+    
    Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_NAME="AppVReporting"
    
     
     
     
@@ -732,21 +735,21 @@ Use the following tables for more information about installing the App-V 5.0 ser
     
     
     
    /EXISTING_MANAGEMENT_DB_NAME
    
-    
    Specifies the name of the existing management database that should be used. Example usage: /EXISITING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.
    
+    
    Specifies the name of the existing management database that should be used. Example usage: /EXISTING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.
    
     
    
-    
    Got a suggestion for App-V? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). Got an App-V issue? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
    
+    
    Got a suggestion for App-V? Add or vote on suggestions here. Got an App-V issue? Use the App-V TechNet Forum.
    
 
 
 
-  
+  
 
 ## Related topics
 
 [Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md b/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md
index 3eb5565576..e3c13b3c79 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-51-server-using-a-script.md
@@ -1,8 +1,11 @@
 ---
 title: How to Deploy the App-V 5.1 Server Using a Script
 description: How to Deploy the App-V 5.1 Server Using a Script
-author: jamiejdt
+author: dansimp
 ms.assetid: 15c33d7b-9b61-4dbc-8674-399bb33e5f7e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -20,770 +23,772 @@ In order to complete the **appv\_server\_setup.exe** Server setup successfully u
 
 -   Use the following tables for more information about installing the App-V 5.1 server using the command line.
 
-    **Note**  
+    **Note**  
     The information in the following tables can also be accessed using the command line by typing the following command: **appv\_server\_setup.exe /?**.
 
-     
 
-    **Common parameters and Examples**
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
    



    To Install the Management server and Management database on a local machine.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
-    
      
-    
    • /MANAGEMENT_SERVER
      • 
-    
    • /MANAGEMENT_ADMINACCOUNT
      • 
-    
    • /MANAGEMENT_WEBSITE_NAME
      • 
-    
    • /MANAGEMENT_WEBSITE_PORT
      • 
-    
    • /DB_PREDEPLOY_MANAGEMENT
      • 
-    
    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
      • 
-    
    • /MANAGEMENT_DB_NAME
      • 
-    
    
-    
    To use a custom instance of Microsoft SQL Server, use the following parameters:
    
-    
      
-    
    • /MANAGEMENT_SERVER
      • 
-    
    • /MANAGEMENT_ADMINACCOUNT
      • 
-    
    • /MANAGEMENT_WEBSITE_NAME
      • 
-    
    • /MANAGEMENT_WEBSITE_PORT
      • 
-    
    • /DB_PREDEPLOY_MANAGEMENT
      • 
-    
    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE
      • 
-    
    • /MANAGEMENT_DB_NAME
      • 
-    
    
-    
    Using a custom instance of Microsoft SQL Server example:
    
-    
    /appv_server_setup.exe /QUIET
    
-    
    /MANAGEMENT_SERVER
    
-    
    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”
    
-    
    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”
    
-    
    /MANAGEMENT_WEBSITE_PORT=”8080”
    
-    
    /DB_PREDEPLOY_MANAGEMENT
    
-    
    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
-    
    /MANAGEMENT_DB_NAME=”AppVManagement”
    
+~~~
+**Common parameters and Examples**
 
-     
+
++++
+
+
+
+
+
+
+
    



    To Install the Management server and Management database on a local machine.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
+
      
+
    • /MANAGEMENT_SERVER
      • 
+
    • /MANAGEMENT_ADMINACCOUNT
      • 
+
    • /MANAGEMENT_WEBSITE_NAME
      • 
+
    • /MANAGEMENT_WEBSITE_PORT
      • 
+
    • /DB_PREDEPLOY_MANAGEMENT
      • 
+
    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
      • 
+
    • /MANAGEMENT_DB_NAME
      • 
+
    
+
    To use a custom instance of Microsoft SQL Server, use the following parameters:
    
+
      
+
    • /MANAGEMENT_SERVER
      • 
+
    • /MANAGEMENT_ADMINACCOUNT
      • 
+
    • /MANAGEMENT_WEBSITE_NAME
      • 
+
    • /MANAGEMENT_WEBSITE_PORT
      • 
+
    • /DB_PREDEPLOY_MANAGEMENT
      • 
+
    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE
      • 
+
    • /MANAGEMENT_DB_NAME
      • 
+
    
+
    Using a custom instance of Microsoft SQL Server example:
    
+
    /appv_server_setup.exe /QUIET
    
+
    /MANAGEMENT_SERVER
    
+
    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”
    
+
    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”
    
+
    /MANAGEMENT_WEBSITE_PORT=”8080”
    
+
    /DB_PREDEPLOY_MANAGEMENT
    
+
    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
+
    /MANAGEMENT_DB_NAME=”AppVManagement”
    
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
    



    To Install the Management server using an existing Management database on a local machine.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
-    
      
-    
    • /MANAGEMENT_SERVER
      • 
-    
    • /MANAGEMENT_ADMINACCOUNT
      • 
-    
    • /MANAGEMENT_WEBSITE_NAME
      • 
-    
    • /MANAGEMENT_WEBSITE_PORT
      • 
-    
    • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
      • 
-    
    • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
      • 
-    
    • /EXISTING_MANAGEMENT_DB_NAME
      • 
-    
    
-    
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
-    
      
-    
    • /MANAGEMENT_SERVER
      • 
-    
    • /MANAGEMENT_ADMINACCOUNT
      • 
-    
    • /MANAGEMENT_WEBSITE_NAME
      • 
-    
    • /MANAGEMENT_WEBSITE_PORT
      • 
-    
    • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
      • 
-    
    • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE
      • 
-    
    • /EXISTING_MANAGEMENT_DB_NAME
      • 
-    
    
-    
    Using a custom instance of Microsoft SQL Server example:
    
-    
    /appv_server_setup.exe /QUIET
    
-    
    /MANAGEMENT_SERVER
    
-    
    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”
    
-    
    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”
    
-    
    /MANAGEMENT_WEBSITE_PORT=”8080”
    
-    
    /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
    
-    
    /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”
    
-    
    /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”
    
 
-     
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
    



    To install the Management server using an existing Management database on a remote machine.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
-    
      
-    
    • /MANAGEMENT_SERVER
      • 
-    
    • /MANAGEMENT_ADMINACCOUNT
      • 
-    
    • /MANAGEMENT_WEBSITE_NAME
      • 
-    
    • /MANAGEMENT_WEBSITE_PORT
      • 
-    
    • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME
      • 
-    
    • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
      • 
-    
    • /EXISTING_MANAGEMENT_DB_NAME
      • 
-    
    
-    
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
-    
      
-    
    • /MANAGEMENT_SERVER
      • 
-    
    • /MANAGEMENT_ADMINACCOUNT
      • 
-    
    • /MANAGEMENT_WEBSITE_NAME
      • 
-    
    • /MANAGEMENT_WEBSITE_PORT
      • 
-    
    • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME
      • 
-    
    • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE
      • 
-    
    • /EXISTING_MANAGEMENT_DB_NAME
      • 
-    
    
-    
    Using a custom instance of Microsoft SQL Server example:
    
-    
    /appv_server_setup.exe /QUIET
    
-    
    /MANAGEMENT_SERVER
    
-    
    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”
    
-    
    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”
    
-    
    /MANAGEMENT_WEBSITE_PORT=”8080”
    
-    
    /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME=”SqlServermachine.domainName”
    
-    
    /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”
    
-    
    /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”
    
+
++++
+
+
+
+
+
+
+
    



    To Install the Management server using an existing Management database on a local machine.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
+
      
+
    • /MANAGEMENT_SERVER
      • 
+
    • /MANAGEMENT_ADMINACCOUNT
      • 
+
    • /MANAGEMENT_WEBSITE_NAME
      • 
+
    • /MANAGEMENT_WEBSITE_PORT
      • 
+
    • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
      • 
+
    • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
      • 
+
    • /EXISTING_MANAGEMENT_DB_NAME
      • 
+
    
+
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
+
      
+
    • /MANAGEMENT_SERVER
      • 
+
    • /MANAGEMENT_ADMINACCOUNT
      • 
+
    • /MANAGEMENT_WEBSITE_NAME
      • 
+
    • /MANAGEMENT_WEBSITE_PORT
      • 
+
    • /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
      • 
+
    • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE
      • 
+
    • /EXISTING_MANAGEMENT_DB_NAME
      • 
+
    
+
    Using a custom instance of Microsoft SQL Server example:
    
+
    /appv_server_setup.exe /QUIET
    
+
    /MANAGEMENT_SERVER
    
+
    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”
    
+
    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”
    
+
    /MANAGEMENT_WEBSITE_PORT=”8080”
    
+
    /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
    
+
    /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”
    
+
    /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”
    
 
-     
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
    



    To Install the Management database and the Management Server on the same computer.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
-    
      
-    
    • /DB_PREDEPLOY_MANAGEMENT
      • 
-    
    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
      • 
-    
    • /MANAGEMENT_DB_NAME
      • 
-    
    • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL
      • 
-    
    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
-    
    
-    
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
-    
      
-    
    • /DB_PREDEPLOY_MANAGEMENT
      • 
-    
    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE
      • 
-    
    • /MANAGEMENT_DB_NAME
      • 
-    
    • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL
      • 
-    
    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
-    
    
-    
    Using a custom instance of Microsoft SQL Server example:
    
-    
    /appv_server_setup.exe /QUIET
    
-    
    /DB_PREDEPLOY_MANAGEMENT
    
-    
    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
-    
    /MANAGEMENT_DB_NAME=”AppVManagement”
    
-    
    /MANAGEMENT_SERVER_MACHINE_USE_LOCAL
    
-    
    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”
    
 
-     
+
++++
+
+
+
+
+
+
+
    



    To install the Management server using an existing Management database on a remote machine.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
+
      
+
    • /MANAGEMENT_SERVER
      • 
+
    • /MANAGEMENT_ADMINACCOUNT
      • 
+
    • /MANAGEMENT_WEBSITE_NAME
      • 
+
    • /MANAGEMENT_WEBSITE_PORT
      • 
+
    • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME
      • 
+
    • /EXISTING_MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
      • 
+
    • /EXISTING_MANAGEMENT_DB_NAME
      • 
+
    
+
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
+
      
+
    • /MANAGEMENT_SERVER
      • 
+
    • /MANAGEMENT_ADMINACCOUNT
      • 
+
    • /MANAGEMENT_WEBSITE_NAME
      • 
+
    • /MANAGEMENT_WEBSITE_PORT
      • 
+
    • /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME
      • 
+
    • /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE
      • 
+
    • /EXISTING_MANAGEMENT_DB_NAME
      • 
+
    
+
    Using a custom instance of Microsoft SQL Server example:
    
+
    /appv_server_setup.exe /QUIET
    
+
    /MANAGEMENT_SERVER
    
+
    /MANAGEMENT_ADMINACCOUNT=”Domain\AdminGroup”
    
+
    /MANAGEMENT_WEBSITE_NAME=”Microsoft AppV Management Service”
    
+
    /MANAGEMENT_WEBSITE_PORT=”8080”
    
+
    /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME=”SqlServermachine.domainName”
    
+
    /EXISTING_MANAGEMENT_DB_CUSTOM_SQLINSTANCE =”SqlInstanceName”
    
+
    /EXISTING_MANAGEMENT_DB_NAME =”AppVManagement”
    
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
    



    To install the Management database on a different computer than the Management server.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
-    
      
-    
    • /DB_PREDEPLOY_MANAGEMENT
      • 
-    
    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
      • 
-    
    • /MANAGEMENT_DB_NAME
      • 
-    
    • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT
      • 
-    
    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
-    
    
-    
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
-    
      
-    
    • /DB_PREDEPLOY_MANAGEMENT
      • 
-    
    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE
      • 
-    
    • /MANAGEMENT_DB_NAME
      • 
-    
    • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT
      • 
-    
    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
-    
    
-    
    Using a custom instance of Microsoft SQL Server example:
    
-    
    /appv_server_setup.exe /QUIET
    
-    
    /DB_PREDEPLOY_MANAGEMENT
    
-    
    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
-    
    /MANAGEMENT_DB_NAME=”AppVManagement”
    
-    
    /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”
    
-    
    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”
    
 
-     
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
    



    To Install the publishing server.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
-    
      
-    
    • /PUBLISHING_SERVER
      • 
-    
    • /PUBLISHING_MGT_SERVER
      • 
-    
    • /PUBLISHING_WEBSITE_NAME
      • 
-    
    • /PUBLISHING_WEBSITE_PORT
      • 
-    
    
-    
    Using a custom instance of Microsoft SQL Server example:
    
-    
    /appv_server_setup.exe /QUIET
    
-    
    /PUBLISHING_SERVER
    
-    
    /PUBLISHING_MGT_SERVER=”http://ManagementServerName:ManagementPort”
    
-    
    /PUBLISHING_WEBSITE_NAME=”Microsoft AppV Publishing Service”
    
-    
    /PUBLISHING_WEBSITE_PORT=”8081”
    
+
++++
+
+
+
+
+
+
+
    



    To Install the Management database and the Management Server on the same computer.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
+
      
+
    • /DB_PREDEPLOY_MANAGEMENT
      • 
+
    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
      • 
+
    • /MANAGEMENT_DB_NAME
      • 
+
    • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL
      • 
+
    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
+
    
+
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
+
      
+
    • /DB_PREDEPLOY_MANAGEMENT
      • 
+
    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE
      • 
+
    • /MANAGEMENT_DB_NAME
      • 
+
    • /MANAGEMENT_SERVER_MACHINE_USE_LOCAL
      • 
+
    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
+
    
+
    Using a custom instance of Microsoft SQL Server example:
    
+
    /appv_server_setup.exe /QUIET
    
+
    /DB_PREDEPLOY_MANAGEMENT
    
+
    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
+
    /MANAGEMENT_DB_NAME=”AppVManagement”
    
+
    /MANAGEMENT_SERVER_MACHINE_USE_LOCAL
    
+
    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”
    
 
-     
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
    



    To Install the Reporting server and Reporting database on a local machine.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
-    
      
-    
    • /REPORTING _SERVER
      • 
-    
    • /REPORTING _WEBSITE_NAME
      • 
-    
    • /REPORTING _WEBSITE_PORT
      • 
-    
    • /DB_PREDEPLOY_REPORTING
      • 
-    
    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT
      • 
-    
    • /REPORTING _DB_NAME
      • 
-    
    
-    
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
-    
      
-    
    • /REPORTING _SERVER
      • 
-    
    • /REPORTING _ADMINACCOUNT
      • 
-    
    • /REPORTING _WEBSITE_NAME
      • 
-    
    • /REPORTING _WEBSITE_PORT
      • 
-    
    • /DB_PREDEPLOY_REPORTING
      • 
-    
    • /REPORTING _DB_CUSTOM_SQLINSTANCE
      • 
-    
    • /REPORTING _DB_NAME
      • 
-    
    
-    
    Using a custom instance of Microsoft SQL Server example:
    
-    
      
-    
    • /appv_server_setup.exe /QUIET
      • 
-    
    • /REPORTING_SERVER
      • 
-    
    • /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”
      • 
-    
    • /REPORTING_WEBSITE_PORT=”8082”
      • 
-    
    • /DB_PREDEPLOY_REPORTING
      • 
-    
    • /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
      • 
-    
    • /REPORTING_DB_NAME=”AppVReporting”
      • 
-    
    
 
-     
+
++++
+
+
+
+
+
+
+
    



    To install the Management database on a different computer than the Management server.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
+
      
+
    • /DB_PREDEPLOY_MANAGEMENT
      • 
+
    • /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
      • 
+
    • /MANAGEMENT_DB_NAME
      • 
+
    • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT
      • 
+
    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
+
    
+
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
+
      
+
    • /DB_PREDEPLOY_MANAGEMENT
      • 
+
    • /MANAGEMENT_DB_CUSTOM_SQLINSTANCE
      • 
+
    • /MANAGEMENT_DB_NAME
      • 
+
    • /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT
      • 
+
    • /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
+
    
+
    Using a custom instance of Microsoft SQL Server example:
    
+
    /appv_server_setup.exe /QUIET
    
+
    /DB_PREDEPLOY_MANAGEMENT
    
+
    /MANAGEMENT_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
+
    /MANAGEMENT_DB_NAME=”AppVManagement”
    
+
    /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”
    
+
    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”
    
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
    



    To Install the Reporting server and using an existing Reporting database on a local machine.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
-    
      
-    
    • /REPORTING _SERVER
      • 
-    
    • /REPORTING _WEBSITE_NAME
      • 
-    
    • /REPORTING _WEBSITE_PORT
      • 
-    
    • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
      • 
-    
    • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT
      • 
-    
    • /EXISTING_REPORTING _DB_NAME
      • 
-    
    
-    
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
-    
      
-    
    • /REPORTING _SERVER
      • 
-    
    • /REPORTING _ADMINACCOUNT
      • 
-    
    • /REPORTING _WEBSITE_NAME
      • 
-    
    • /REPORTING _WEBSITE_PORT
      • 
-    
    • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
      • 
-    
    • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE
      • 
-    
    • /EXISTING_REPORTING _DB_NAME
      • 
-    
    
-    
    Using a custom instance of Microsoft SQL Server example:
    
-    
    /appv_server_setup.exe /QUIET
    
-    
    /REPORTING_SERVER
    
-    
    /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”
    
-    
    /REPORTING_WEBSITE_PORT=”8082”
    
-    
    /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
    
-    
    /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
-    
    /EXITING_REPORTING_DB_NAME=”AppVReporting”
    
 
-     
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
    



    To Install the Reporting server using an existing Reporting database on a remote machine.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
-    
      
-    
    • /REPORTING _SERVER
      • 
-    
    • /REPORTING _WEBSITE_NAME
      • 
-    
    • /REPORTING _WEBSITE_PORT
      • 
-    
    • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME
      • 
-    
    • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT
      • 
-    
    • /EXISTING_REPORTING _DB_NAME
      • 
-    
    
-    
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
-    
      
-    
    • /REPORTING _SERVER
      • 
-    
    • /REPORTING _ADMINACCOUNT
      • 
-    
    • /REPORTING _WEBSITE_NAME
      • 
-    
    • /REPORTING _WEBSITE_PORT
      • 
-    
    • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME
      • 
-    
    • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE
      • 
-    
    • /EXISTING_REPORTING _DB_NAME
      • 
-    
    
-    
    Using a custom instance of Microsoft SQL Server example:
    
-    
    /appv_server_setup.exe /QUIET
    
-    
    /REPORTING_SERVER
    
-    
    /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”
    
-    
    /REPORTING_WEBSITE_PORT=”8082”
    
-    
    /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME=”SqlServerMachine.DomainName”
    
-    
    /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
-    
    /EXITING_REPORTING_DB_NAME=”AppVReporting”
    
+
++++
+
+
+
+
+
+
+
    



    To Install the publishing server.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
+
      
+
    • /PUBLISHING_SERVER
      • 
+
    • /PUBLISHING_MGT_SERVER
      • 
+
    • /PUBLISHING_WEBSITE_NAME
      • 
+
    • /PUBLISHING_WEBSITE_PORT
      • 
+
    
+
    Using a custom instance of Microsoft SQL Server example:
    
+
    /appv_server_setup.exe /QUIET
    
+
    /PUBLISHING_SERVER
    
+
    /PUBLISHING_MGT_SERVER=”http://ManagementServerName:ManagementPort”
    
+
    /PUBLISHING_WEBSITE_NAME=”Microsoft AppV Publishing Service”
    
+
    /PUBLISHING_WEBSITE_PORT=”8081”
    
 
-     
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
    



    To install the Reporting database on the same computer as the Reporting server.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
-    
      
-    
    • /DB_PREDEPLOY_REPORTING
      • 
-    
    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT
      • 
-    
    • /REPORTING _DB_NAME
      • 
-    
    • /REPORTING_SERVER_MACHINE_USE_LOCAL
      • 
-    
    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
-    
    
-    
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
-    
      
-    
    • /DB_PREDEPLOY_REPORTING
      • 
-    
    • /REPORTING _DB_CUSTOM_SQLINSTANCE
      • 
-    
    • /REPORTING _DB_NAME
      • 
-    
    • /REPORTING_SERVER_MACHINE_USE_LOCAL
      • 
-    
    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
-    
    
-    
    Using a custom instance of Microsoft SQL Server example:
    
-    
    /appv_server_setup.exe /QUIET
    
-    
    /DB_PREDEPLOY_REPORTING
    
-    
    /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
-    
    /REPORTING_DB_NAME=”AppVReporting”
    
-    
    /REPORTING_SERVER_MACHINE_USE_LOCAL
    
-    
    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”
    
 
-     
+
++++
+
+
+
+
+
+
+
    



    To Install the Reporting server and Reporting database on a local machine.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
+
      
+
    • /REPORTING _SERVER
      • 
+
    • /REPORTING _WEBSITE_NAME
      • 
+
    • /REPORTING _WEBSITE_PORT
      • 
+
    • /DB_PREDEPLOY_REPORTING
      • 
+
    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT
      • 
+
    • /REPORTING _DB_NAME
      • 
+
    
+
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
+
      
+
    • /REPORTING _SERVER
      • 
+
    • /REPORTING _ADMINACCOUNT
      • 
+
    • /REPORTING _WEBSITE_NAME
      • 
+
    • /REPORTING _WEBSITE_PORT
      • 
+
    • /DB_PREDEPLOY_REPORTING
      • 
+
    • /REPORTING _DB_CUSTOM_SQLINSTANCE
      • 
+
    • /REPORTING _DB_NAME
      • 
+
    
+
    Using a custom instance of Microsoft SQL Server example:
    
+
      
+
    • /appv_server_setup.exe /QUIET
      • 
+
    • /REPORTING_SERVER
      • 
+
    • /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”
      • 
+
    • /REPORTING_WEBSITE_PORT=”8082”
      • 
+
    • /DB_PREDEPLOY_REPORTING
      • 
+
    • /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
      • 
+
    • /REPORTING_DB_NAME=”AppVReporting”
      • 
+
    
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
    



    To install the Reporting database on a different computer than the Reporting server.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
-    
      
-    
    • /DB_PREDEPLOY_REPORTING
      • 
-    
    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT
      • 
-    
    • /REPORTING _DB_NAME
      • 
-    
    • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT
      • 
-    
    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
-    
    
-    
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
-    
      
-    
    • /DB_PREDEPLOY_REPORTING
      • 
-    
    • /REPORTING _DB_CUSTOM_SQLINSTANCE
      • 
-    
    • /REPORTING _DB_NAME
      • 
-    
    • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT
      • 
-    
    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
-    
    
-    
    Using a custom instance of Microsoft SQL Server example:
    
-    
    /appv_server_setup.exe /QUIET
    
-    
    /DB_PREDEPLOY_REPORTING
    
-    
    /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
-    
    /REPORTING_DB_NAME=”AppVReporting”
    
-    
    /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”
    
-    
    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”
    
 
-     
 
-    **Parameter Definitions**
+
++++
+
+
+
+
+
+
+
    



    To Install the Reporting server and using an existing Reporting database on a local machine.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
+
      
+
    • /REPORTING _SERVER
      • 
+
    • /REPORTING _WEBSITE_NAME
      • 
+
    • /REPORTING _WEBSITE_PORT
      • 
+
    • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
      • 
+
    • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT
      • 
+
    • /EXISTING_REPORTING _DB_NAME
      • 
+
    
+
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
+
      
+
    • /REPORTING _SERVER
      • 
+
    • /REPORTING _ADMINACCOUNT
      • 
+
    • /REPORTING _WEBSITE_NAME
      • 
+
    • /REPORTING _WEBSITE_PORT
      • 
+
    • /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
      • 
+
    • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE
      • 
+
    • /EXISTING_REPORTING _DB_NAME
      • 
+
    
+
    Using a custom instance of Microsoft SQL Server example:
    
+
    /appv_server_setup.exe /QUIET
    
+
    /REPORTING_SERVER
    
+
    /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”
    
+
    /REPORTING_WEBSITE_PORT=”8082”
    
+
    /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
    
+
    /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
+
    /EXITING_REPORTING_DB_NAME=”AppVReporting”
    
 
-    **General Parameters**
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    ParameterInformation
    /QUIET
    Specifies silent install.
    /UNINSTALL
    Specifies an uninstall.
    /LAYOUT
    Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected.
    /LAYOUTDIR
    Specifies the layout directory. Takes a string. For example, /LAYOUTDIR=”C:\Application Virtualization Server”
    /INSTALLDIR
    Specifies the installation directory. Takes a string. E.g. /INSTALLDIR=”C:\Program Files\Application Virtualization\Server”
    /MUOPTIN
    Enables Microsoft Update. No value is expected
    /ACCEPTEULA
    Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.
    
 
-     
+
++++
+
+
+
+
+
+
+
    



    To Install the Reporting server using an existing Reporting database on a remote machine.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
+
      
+
    • /REPORTING _SERVER
      • 
+
    • /REPORTING _WEBSITE_NAME
      • 
+
    • /REPORTING _WEBSITE_PORT
      • 
+
    • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME
      • 
+
    • /EXISTING_REPORTING _DB_SQLINSTANCE_USE_DEFAULT
      • 
+
    • /EXISTING_REPORTING _DB_NAME
      • 
+
    
+
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
+
      
+
    • /REPORTING _SERVER
      • 
+
    • /REPORTING _ADMINACCOUNT
      • 
+
    • /REPORTING _WEBSITE_NAME
      • 
+
    • /REPORTING _WEBSITE_PORT
      • 
+
    • /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME
      • 
+
    • /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE
      • 
+
    • /EXISTING_REPORTING _DB_NAME
      • 
+
    
+
    Using a custom instance of Microsoft SQL Server example:
    
+
    /appv_server_setup.exe /QUIET
    
+
    /REPORTING_SERVER
    
+
    /REPORTING_WEBSITE_NAME=”Microsoft AppV Reporting Service”
    
+
    /REPORTING_WEBSITE_PORT=”8082”
    
+
    /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME=”SqlServerMachine.DomainName”
    
+
    /EXISTING_REPORTING _DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
+
    /EXITING_REPORTING_DB_NAME=”AppVReporting”
    
 
-    **Management Server Installation Parameters**
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    ParameterInformation
    /MANAGEMENT_SERVER
    Specifies that the management server will be installed. No value is expected
    /MANAGEMENT_ADMINACCOUNT
    Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: /MANAGEMENT_ADMINACCOUNT=”mydomain\admin”. If /MANAGEMENT_SERVER is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, /MANAGEMENT_ADMINACCOUNT="mydomain\admin".
    /MANAGEMENT_WEBSITE_NAME
    Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME=”Microsoft App-V Management Service”
    MANAGEMENT_WEBSITE_PORT
    Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82.
    
 
-     
+
++++
+
+
+
+
+
+
+
    



    To install the Reporting database on the same computer as the Reporting server.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
+
      
+
    • /DB_PREDEPLOY_REPORTING
      • 
+
    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT
      • 
+
    • /REPORTING _DB_NAME
      • 
+
    • /REPORTING_SERVER_MACHINE_USE_LOCAL
      • 
+
    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
+
    
+
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
+
      
+
    • /DB_PREDEPLOY_REPORTING
      • 
+
    • /REPORTING _DB_CUSTOM_SQLINSTANCE
      • 
+
    • /REPORTING _DB_NAME
      • 
+
    • /REPORTING_SERVER_MACHINE_USE_LOCAL
      • 
+
    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
+
    
+
    Using a custom instance of Microsoft SQL Server example:
    
+
    /appv_server_setup.exe /QUIET
    
+
    /DB_PREDEPLOY_REPORTING
    
+
    /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
+
    /REPORTING_DB_NAME=”AppVReporting”
    
+
    /REPORTING_SERVER_MACHINE_USE_LOCAL
    
+
    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”
    
 
-    **Parameters for the Management Server Database**
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    ParameterInformation
    /DB_PREDEPLOY_MANAGEMENT
    Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected
    /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
    Indicates that the default SQL instance should be used. No value is expected.
    /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE
    Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”MYSQLSERVER”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.
    /MANAGEMENT_DB_NAME
    Specifies the name of the new management database that should be created. Example usage: /MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.
    /MANAGEMENT_SERVER_MACHINE_USE_LOCAL
    Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.
    /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT
    Specifies the machine account of the remote machine that the management server will be installed on. Example usage: /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”domain\computername”
    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
    Indicates the Administrator account that will be used to install the management server. Example usage: /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT =”domain\alias”
    
 
-     
+
++++
+
+
+
+
+
+
+
    



    To install the Reporting database on a different computer than the Reporting server.
    To use the default instance of Microsoft SQL Server, use the following parameters:
    
+
      
+
    • /DB_PREDEPLOY_REPORTING
      • 
+
    • /REPORTING _DB_SQLINSTANCE_USE_DEFAULT
      • 
+
    • /REPORTING _DB_NAME
      • 
+
    • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT
      • 
+
    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
+
    
+
    To use a custom instance of Microsoft SQL Server, use these parameters:
    
+
      
+
    • /DB_PREDEPLOY_REPORTING
      • 
+
    • /REPORTING _DB_CUSTOM_SQLINSTANCE
      • 
+
    • /REPORTING _DB_NAME
      • 
+
    • /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT
      • 
+
    • /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
      • 
+
    
+
    Using a custom instance of Microsoft SQL Server example:
    
+
    /appv_server_setup.exe /QUIET
    
+
    /DB_PREDEPLOY_REPORTING
    
+
    /REPORTING_DB_CUSTOM_SQLINSTANCE=”SqlInstanceName”
    
+
    /REPORTING_DB_NAME=”AppVReporting”
    
+
    /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT=”Domain\MachineAccount”
    
+
    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT=”Domain\InstallAdminAccount”
    
 
-    **Parameters for Installing Publishing Server**
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    ParameterInformation
    /PUBLISHING_SERVER
    Specifies that the Publishing Server will be installed. No value is expected
    /PUBLISHING_MGT_SERVER
    Specifies the URL to Management Service the Publishing server will connect to. Example usage: http://<management server name>:<Management server port number>. If /PUBLISHING_SERVER is not used, this parameter will be ignored
    /PUBLISHING_WEBSITE_NAME
    Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME=”Microsoft App-V Publishing Service”
    /PUBLISHING_WEBSITE_PORT
    Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83
    
 
-     
+**Parameter Definitions**
 
-    **Parameters for Reporting Server**
+**General Parameters**
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    ParameterInformation
    /REPORTING_SERVER
    Specifies that the Reporting Server will be installed. No value is expected
    /REPORTING_WEBSITE_NAME
    Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService"
    /REPORTING_WEBSITE_PORT
    Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82
    
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
    



    ParameterInformation
    /QUIET
    Specifies silent install.
    /UNINSTALL
    Specifies an uninstall.
    /LAYOUT
    Specifies layout action. This extracts the MSIs and script files to a folder without actually installing the product. No value is expected.
    /LAYOUTDIR
    Specifies the layout directory. Takes a string. For example, /LAYOUTDIR=”C:\Application Virtualization Server”
    /INSTALLDIR
    Specifies the installation directory. Takes a string. E.g. /INSTALLDIR=”C:\Program Files\Application Virtualization\Server”
    /MUOPTIN
    Enables Microsoft Update. No value is expected
    /ACCEPTEULA
    Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.
    
 
-     
 
-    **Parameters for using an Existing Reporting Server Database**
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    ParameterInformation
    /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
    Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected.
    /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME
    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"
    /EXISTING_ REPORTING _DB_SQLINSTANCE_USE_DEFAULT
    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected.
    /EXISTING_ REPORTING_DB_CUSTOM_SQLINSTANCE
    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"
    /EXISTING_ REPORTING _DB_NAME
    Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISITING_REPORTING_DB_NAME="AppVReporting"
    
+**Management Server Installation Parameters**
 
-     
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
    



    ParameterInformation
    /MANAGEMENT_SERVER
    Specifies that the management server will be installed. No value is expected
    /MANAGEMENT_ADMINACCOUNT
    Specifies the account that will be allowed to Administrator access to the management server This account can be an individual user account or a group. Example usage: /MANAGEMENT_ADMINACCOUNT=”mydomain\admin”. If /MANAGEMENT_SERVER is not specified, this will be ignored. Specifies the account that will be allowed to Administrator access to the management server. This can be a user account or a group. For example, /MANAGEMENT_ADMINACCOUNT="mydomain\admin".
    /MANAGEMENT_WEBSITE_NAME
    Specifies name of the website that will be created for the management service. For example, /MANAGEMENT_WEBSITE_NAME=”Microsoft App-V Management Service”
    MANAGEMENT_WEBSITE_PORT
    Specifies the port number that will be used by the management service will use. For example, /MANAGEMENT_WEBSITE_PORT=82.
    
 
-    **Parameters for installing Reporting Server Database**
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    ParameterInformation
    /DB_PREDEPLOY_REPORTING
    Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected
    /REPORTING_DB_SQLINSTANCE_USE_DEFAULT
    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"
    /REPORTING_DB_NAME
    Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB"
    /REPORTING_SERVER_MACHINE_USE_LOCAL
    Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.
    /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT
    Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername"
    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
    Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias"
    
 
-     
+**Parameters for the Management Server Database**
 
-    **Parameters for using an existing Management Server Database**
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
    



    ParameterInformation
    /DB_PREDEPLOY_MANAGEMENT
    Specifies that the management database will be installed. You must have sufficient database permissions to complete this installation. No value is expected
    /MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
    Indicates that the default SQL instance should be used. No value is expected.
    /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE
    Specifies the name of the custom SQL instance that should be used to create a new database. Example usage: /MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”MYSQLSERVER”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.
    /MANAGEMENT_DB_NAME
    Specifies the name of the new management database that should be created. Example usage: /MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is not specified, this will be ignored.
    /MANAGEMENT_SERVER_MACHINE_USE_LOCAL
    Indicates if the management server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.
    /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT
    Specifies the machine account of the remote machine that the management server will be installed on. Example usage: /MANAGEMENT_REMOTE_SERVER_MACHINE_ACCOUNT=”domain\computername”
    /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT
    Indicates the Administrator account that will be used to install the management server. Example usage: /MANAGEMENT_SERVER_INSTALL_ADMIN_ACCOUNT =”domain\alias”
    
+
+
+
+**Parameters for Installing Publishing Server**
+
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
    



    ParameterInformation
    /PUBLISHING_SERVER
    Specifies that the Publishing Server will be installed. No value is expected
    /PUBLISHING_MGT_SERVER
    Specifies the URL to Management Service the Publishing server will connect to. Example usage: http://<management server name>:<Management server port number>. If /PUBLISHING_SERVER is not used, this parameter will be ignored
    /PUBLISHING_WEBSITE_NAME
    Specifies name of the website that will be created for the publishing service. For example, /PUBLISHING_WEBSITE_NAME=”Microsoft App-V Publishing Service”
    /PUBLISHING_WEBSITE_PORT
    Specifies the port number used by the publishing service. For example, /PUBLISHING_WEBSITE_PORT=83
    
+
+
+
+**Parameters for Reporting Server**
+
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
    



    ParameterInformation
    /REPORTING_SERVER
    Specifies that the Reporting Server will be installed. No value is expected
    /REPORTING_WEBSITE_NAME
    Specifies name of the website that will be created for the Reporting Service. E.g. /REPORTING_WEBSITE_NAME="Microsoft App-V ReportingService"
    /REPORTING_WEBSITE_PORT
    Specifies the port number that the Reporting Service will use. E.g. /REPORTING_WEBSITE_PORT=82
    
+
+
+
+**Parameters for using an Existing Reporting Server Database**
+
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
    



    ParameterInformation
    /EXISTING_REPORTING_DB_SQL_SERVER_USE_LOCAL
    Indicates that the Microsoft SQL Server is installed on the local server. Switch parameter so no value is expected.
    /EXISTING_REPORTING_DB_REMOTE_SQL_SERVER_NAME
    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_REPORTING_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"
    /EXISTING_ REPORTING _DB_SQLINSTANCE_USE_DEFAULT
    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected.
    /EXISTING_ REPORTING_DB_CUSTOM_SQLINSTANCE
    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"
    /EXISTING_ REPORTING _DB_NAME
    Specifies the name of the existing Reporting database that should be used. Takes a string. E.g. /EXISTING_REPORTING_DB_NAME="AppVReporting"
    
+
+
+
+**Parameters for installing Reporting Server Database**
+
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
    



    ParameterInformation
    /DB_PREDEPLOY_REPORTING
    Specifies that the Reporting Database will be installed. DBA permissions are required for this installation. No value is expected
    /REPORTING_DB_SQLINSTANCE_USE_DEFAULT
    Specifies the name of the custom SQL instance that should be used. Takes a string. E.g. /REPORTING_DB_ CUSTOM_SQLINSTANCE="MYSQLSERVER"
    /REPORTING_DB_NAME
    Specifies the name of the new Reporting database that should be created. Takes a string. E.g. /REPORTING_DB_NAME="AppVMgmtDB"
    /REPORTING_SERVER_MACHINE_USE_LOCAL
    Indicates that the Reporting server that will be accessing the database is installed on the local server. Switch parameter so no value is expected.
    /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT
    Specifies the machine account of the remote machine that the Reporting server will be installed on. Takes a string. E.g. /REPORTING_REMOTE_SERVER_MACHINE_ACCOUNT = "domain\computername"
    /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT
    Indicates the Administrator account that will be used to install the App-V Reporting Server. Takes a string. E.g. /REPORTING_SERVER_INSTALL_ADMIN_ACCOUNT = "domain\alias"
    
+
+
+
+**Parameters for using an existing Management Server Database**
+
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
    



    ParameterInformation
    /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
    Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.
    /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME
    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"
    /EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.
    /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE
    Specifies the name of the custom SQL instance that will be used. Example usage /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”AppVManagement”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.
    /EXISTING_MANAGEMENT_DB_NAME
    Specifies the name of the existing management database that should be used. Example usage: /EXISTING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.
    
+
    
+
    Got a suggestion for App-V? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). Got an App-V issue? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
    
+~~~
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    ParameterInformation
    /EXISTING_MANAGEMENT_DB_SQL_SERVER_USE_LOCAL
    Indicates that the SQL Server is installed on the local server. Switch parameter so no value is expected.If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.
    /EXISTING_MANAGEMENT_DB_REMOTE_SQL_SERVER_NAME
    Specifies the name of the remote computer that SQL Server is installed on. Takes a string. E.g. /EXISTING_MANAGEMENT_DB_ REMOTE_SQL_SERVER_NAME="mycomputer1"
    /EXISTING_ MANAGEMENT_DB_SQLINSTANCE_USE_DEFAULT
    Indicates that the default SQL instance is to be used. Switch parameter so no value is expected. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.
    /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE
    Specifies the name of the custom SQL instance that will be used. Example usage /EXISTING_MANAGEMENT_DB_ CUSTOM_SQLINSTANCE=”AppVManagement”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.
    /EXISTING_MANAGEMENT_DB_NAME
    Specifies the name of the existing management database that should be used. Example usage: /EXISITING_MANAGEMENT_DB_NAME=”AppVMgmtDB”. If /DB_PREDEPLOY_MANAGEMENT is specified, this will be ignored.
    
-    
    
-    
    Got a suggestion for App-V? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). Got an App-V issue? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
    
 
-     
 
 ## Related topics
 
 
 [Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-51-server.md b/mdop/appv-v5/how-to-deploy-the-app-v-51-server.md
index 544fdab456..97b1877022 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-51-server.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-51-server.md
@@ -1,8 +1,11 @@
 ---
 title: How to Deploy the App-V 5.1 Server
 description: How to Deploy the App-V 5.1 Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 4729beda-b98f-481b-ae74-ad71c59b1d69
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -30,126 +33,126 @@ Use the following procedure to install the Microsoft Application Virtualization
 
 **To install the App-V 5.1 server**
 
-1.  Copy the App-V 5.1 server installation files to the computer on which you want to install it.
+1. Copy the App-V 5.1 server installation files to the computer on which you want to install it.
 
-2.  Start the App-V 5.1 server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**.
+2. Start the App-V 5.1 server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**.
 
-3.  Review and accept the license terms, and choose whether to enable Microsoft updates.
+3. Review and accept the license terms, and choose whether to enable Microsoft updates.
 
-4.  On the **Feature Selection** page, select all of the following components.
+4. On the **Feature Selection** page, select all of the following components.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    ComponentDescription
    Management server
    Provides overall management functionality for the App-V infrastructure.
    Management database
    Facilitates database predeployments for App-V management.
    Publishing server
    Provides hosting and streaming functionality for virtual applications.
    Reporting server
    Provides App-V 5.1 reporting services.
    Reporting database
    Facilitates database predeployments for App-V reporting.
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    ComponentDescription
    Management server
    Provides overall management functionality for the App-V infrastructure.
    Management database
    Facilitates database predeployments for App-V management.
    Publishing server
    Provides hosting and streaming functionality for virtual applications.
    Reporting server
    Provides App-V 5.1 reporting services.
    Reporting database
    Facilitates database predeployments for App-V reporting.
    
 
-     
+     
 
-5.  On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line.
+5. On the **Installation Location** page, accept the default location where the selected components will be installed, or change the location by typing a new path on the **Installation Location** line.
 
-6.  On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below.
+6. On the initial **Create New Management Database** page, configure the **Microsoft SQL Server instance** and **Management Server database** by selecting the appropriate option below.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    MethodWhat you need to do
    You are using a custom Microsoft SQL Server instance.
    Select Use the custom instance, and type the name of the instance.
    
-    
    Use the format INSTANCENAME. The assumed installation location is the local computer.
    
-    
    Not supported: A server name using the format ServerName\INSTANCE.
    You are using a custom database name.
    Select Custom configuration and type the database name.
    
-    
    The database name must be unique, or the installation will fail.
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    MethodWhat you need to do
    You are using a custom Microsoft SQL Server instance.
    Select Use the custom instance, and type the name of the instance.
    
+   
    Use the format INSTANCENAME. The assumed installation location is the local computer.
    
+   
    Not supported: A server name using the format ServerName<strong>INSTANCE.
    You are using a custom database name.
    Select Custom configuration and type the database name.
    
+   
    The database name must be unique, or the installation will fail.
    
 
-     
+     
 
-7.  On the **Configure** page, accept the default value **Use this local computer**.
+7. On the **Configure** page, accept the default value **Use this local computer**.
 
-    **Note**  
-    If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed.
+   **Note**  
+   If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed.
 
-     
+     
 
-8.  On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below.
+8. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    MethodWhat you need to do
    You are using a custom Microsoft SQL Server instance.
    Select Use the custom instance, and type the name of the instance.
    
-    
    Use the format INSTANCENAME. The assumed installation location is the local computer.
    
-    
    Not supported: A server name using the format ServerName\INSTANCE.
    You are using a custom database name.
    Select Custom configuration and type the database name.
    
-    
    The database name must be unique, or the installation will fail.
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    MethodWhat you need to do
    You are using a custom Microsoft SQL Server instance.
    Select Use the custom instance, and type the name of the instance.
    
+   
    Use the format INSTANCENAME. The assumed installation location is the local computer.
    
+   
    Not supported: A server name using the format ServerName<strong>INSTANCE.
    You are using a custom database name.
    Select Custom configuration and type the database name.
    
+   
    The database name must be unique, or the installation will fail.
    
 
-     
+     
 
-9.  On the **Configure** page, accept the default value: **Use this local computer**.
+9. On the **Configure** page, accept the default value: **Use this local computer**.
 
-    **Note**  
-    If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed.
+   **Note**  
+   If you are installing the Management server and Management database side by side, some options on this page are not available. In this case, the appropriate options are selected by default and cannot be changed.
 
-     
+     
 
 10. On the **Configure** (Management Server Configuration) page, specify the following:
 
@@ -182,7 +185,7 @@ Use the following procedure to install the Microsoft Application Virtualization
     
     
 
-     
+     
 
 11. On the **Configure** **Publishing Server Configuration** page, specify the following:
 
@@ -200,7 +203,7 @@ Use the following procedure to install the Microsoft Application Virtualization
     
     
     
    Specify the URL for the management service.
    
-    
    Example: http://localhost:12345
    
+    
    Example: http://localhost:12345
    
     
     
     
    Website name: Specify the custom name that will be used to run the publishing service.
    
@@ -214,7 +217,7 @@ Use the following procedure to install the Microsoft Application Virtualization
     
     
 
-     
+     
 
 12. On the **Reporting Server** page, specify the following:
 
@@ -242,7 +245,7 @@ Use the following procedure to install the Microsoft Application Virtualization
     
     
 
-     
+     
 
 13. To start the installation, click **Install** on the **Ready** page, and then click **Close** on the **Finished** page.
 
@@ -265,9 +268,9 @@ Use the following procedure to install the Microsoft Application Virtualization
 
 [How to Deploy the App-V 5.1 Server Using a Script](how-to-deploy-the-app-v-51-server-using-a-script.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md b/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md
index 644225452a..f89ee280f9 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-client-51gb18030.md
@@ -1,8 +1,11 @@
 ---
 title: How to Deploy the App-V Client
 description: How to Deploy the App-V Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 981f57c9-56c3-45da-8261-0972bfad3e5b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -18,36 +21,36 @@ Use the following procedure to install the Microsoft Application Virtualization
 
 **What to do before you start**
 
-1.  Review and install the software prerequisites:
+1. Review and install the software prerequisites:
 
-    Install the prerequisite software that corresponds to the version of App-V that you are installing:
+   Install the prerequisite software that corresponds to the version of App-V that you are installing:
 
-    -   [About App-V 5.1](about-app-v-51.md)
+   -   [About App-V 5.1](about-app-v-51.md)
 
-    -   [App-V 5.1 Prerequisites](app-v-51-prerequisites.md)
+   -   [App-V 5.1 Prerequisites](app-v-51-prerequisites.md)
 
-2.  Review the client coexistence and unsupported scenarios, as applicable to your installation:
+2. Review the client coexistence and unsupported scenarios, as applicable to your installation:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    Deploying coexisting App-V clients
    [Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md)
    Unsupported or limited installation scenarios
    See the client section in [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md)
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    Deploying coexisting App-V clients
    Planning for the App-V 5.1 Sequencer and Client Deployment
    Unsupported or limited installation scenarios
    See the client section in App-V 5.1 Supported Configurations
    
 
-     
 
-3.  Review the locations for client registry, log, and troubleshooting information:
+
+3. Review the locations for client registry, log, and troubleshooting information:
 
 @@ -73,9 +76,9 @@ Use the following procedure to install the Microsoft Application Virtualization
 
    Event logs / Applications and Services Logs / Microsoft / AppV
  • In App-V 5.0 SP3, some logs were consolidated and moved to the following location:
    
 
    Event logs/Applications and Services Logs/Microsoft/AppV/ServiceLog
    
-
    For a list of the moved logs, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved).
    • 
+
    For a list of the moved logs, see About App-V 5.0 SP3.
  • Packages that are currently stored on computers that run the App-V 5.1 Client are saved to the following location:
    
-
    C:\ProgramData\App-V\<package id>\<version id>
    • 
+
    C:\ProgramData\App-V&lt;package id>&lt;version id>
    
@@ -85,7 +88,7 @@ Use the following procedure to install the Microsoft Application Virtualization
 
    
 

 
 
 
 
 
    
 
    
 
- 
+
 
 **To install the App-V 5.1 Client**
 
@@ -114,7 +117,7 @@ Use the following procedure to install the Microsoft Application Virtualization
     
     
 
-     
+
 
 2.  Double-click the installation file, and click **Install**. Before the installation begins, the installer checks the computer for any missing [App-V 5.1 Prerequisites](app-v-51-prerequisites.md).
 
@@ -130,151 +133,151 @@ Use the following procedure to install the Microsoft Application Virtualization
 
     -   **language pack**
 
-        **Note**  
+        **Note**  
         After the installation, only the .exe file can be uninstalled.
 
-         
+
 
 **To install the App-V 5.1 client using a script**
 
-1.  Install all of the required prerequisite software on the target computers. See [What to do before you start](#bkmk-clt-install-prereqs). If you install the client by using an .msi file, the installation will fail if any prerequisites are missing.
+1. Install all of the required prerequisite software on the target computers. See [What to do before you start](#bkmk-clt-install-prereqs). If you install the client by using an .msi file, the installation will fail if any prerequisites are missing.
 
-2.  To use a script to install the App-V 5.1 client, use the following parameters with **appv\_client\_setup.exe**.
+2. To use a script to install the App-V 5.1 client, use the following parameters with **appv\_client\_setup.exe**.
 
-    **Note**  
-    The client Windows Installer (.msi) supports the same set of switches, except for the **/LOG** parameter.
+   **Note**  
+   The client Windows Installer (.msi) supports the same set of switches, except for the **/LOG** parameter.
+
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    /INSTALLDIR
    Specifies the installation directory. Example usage: /INSTALLDIR=C:\Program Files\AppV Client
    /CEIPOPTIN
    Enables participation in the Customer Experience Improvement Program. Example usage: /CEIPOPTIN=[0|1]
    /MUOPTIN
    Enables Microsoft Update. Example usage: /MUOPTIN=[0|1]
    /PACKAGEINSTALLATIONROOT
    Specifies the directory in which to install all new applications and updates. Example usage: /PACKAGEINSTALLATIONROOT='C:\App-V Packages'
    /PACKAGESOURCEROOT
    Overrides the source location for downloading package content. Example usage: /PACKAGESOURCEROOT='http://packageStore'
    /AUTOLOAD
    Specifies how new packages will be loaded by App-V 5.1 on a specific computer. The following options are enabled: [1]; automatically load all packages [2]; or automatically load no packages [0].Example usage: /AUTOLOAD=[0|1|2]
    /SHAREDCONTENTSTOREMODE
    Specifies that streamed package contents will be not be saved to the local hard disk. Example usage: /SHAREDCONTENTSTOREMODE=[0|1]
    /MIGRATIONMODE
    Allows the App-V 5.1 client to modify the shortcuts and FTAs that are associated with the packages that are created with a previous version. Example usage: /MIGRATIONMODE=[0|1]
    /ENABLEPACKAGESCRIPTS
    Enables the scripts that are defined in the package manifest file or configuration files that should run. Example usage: /ENABLEPACKAGESCRIPTS=[0|1]
    /ROAMINGREGISTRYEXCLUSIONS
    Specifies the registry paths that will not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients
    /ROAMINGFILEEXCLUSIONS
    Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS 'desktop;my pictures'
    /S[1-5]PUBLISHINGSERVERNAME
    Displays the name of the publishing server. Example usage: /S2PUBLISHINGSERVERNAME=MyPublishingServer
    /S[1-5]PUBLISHINGSERVERURL
    Displays the URL of the publishing server. Example usage: /S2PUBLISHINGSERVERURL=\pubserver
    /S[1-5]GLOBALREFRESHENABLED -
    Enables a global publishing refresh. Example usage: /S2GLOBALREFRESHENABLED=[0|1]
    /S[1-5]GLOBALREFRESHONLOGON
    Initiates a global publishing refresh when a user logs on. Example usage: /S2LOGONREFRESH=[0|1]
    /S[1-5]GLOBALREFRESHINTERVAL -
    Specifies the publishing refresh interval, where 0 indicates do not periodically refresh. Example usage: /S2PERIODICREFRESHINTERVAL=[0-744]
    /S[1-5]GLOBALREFRESHINTERVALUNIT
    Specifies the interval unit (Hours[0], Days[1]). Example usage: /S2GLOBALREFRESHINTERVALUNIT=[0|1]
    /S[1-5]USERREFRESHENABLED
    Enables user publishing refresh. Example usage: /S2USERREFRESHENABLED=[0|1]
    /S[1-5]USERREFRESHONLOGON
    Initiates a user publishing refresh when a user logs on. Example usage: /S2LOGONREFRESH=[0|1]
    /S[1-5]USERREFRESHINTERVAL -
    Specifies the publishing refresh interval, where 0 indicates do not periodically refresh. Example usage: /S2PERIODICREFRESHINTERVAL=[0-744]
    /S[1-5]USERREFRESHINTERVALUNIT
    Specifies the interval unit (Hours[0], Days[1]). Example usage: /S2USERREFRESHINTERVALUNIT=[0|1]
    /Log
    Specifies a location where the log information is saved. The default location is %Temp%. Example usage: /log C:\logs\log.log
    /q
    Specifies an unattended installation.
    /REPAIR
    Repairs a previous client installation.
    /NORESTART
    Prevents the computer from rebooting after the client installation.
    
+   
    The parameter prevents the end-user computer from rebooting after each update is installed and lets you schedule the reboot at your convenience. For example, you can install App-V 5.1 and then install Hotfix Package Y without rebooting after the Service Pack installation. After the installation, you must reboot before you start using App-V.
    /UNINSTALL
    Uninstalls the client.
    /ACCEPTEULA
    Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.
    /LAYOUT
    Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.1. No value is expected.
    /LAYOUTDIR
    Specifies the layout directory. Requires a string value. Example usage: /LAYOUTDIR=”C:\Application Virtualization Client”.
    /?, /h, /help
    Requests help about the previous installation parameters.
    
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    /INSTALLDIR
    Specifies the installation directory. Example usage: /INSTALLDIR=C:\Program Files\AppV Client
    /CEIPOPTIN
    Enables participation in the Customer Experience Improvement Program. Example usage: /CEIPOPTIN=[0|1]
    /MUOPTIN
    Enables Microsoft Update. Example usage: /MUOPTIN=[0|1]
    /PACKAGEINSTALLATIONROOT
    Specifies the directory in which to install all new applications and updates. Example usage: /PACKAGEINSTALLATIONROOT='C:\App-V Packages'
    /PACKAGESOURCEROOT
    Overrides the source location for downloading package content. Example usage: /PACKAGESOURCEROOT='http://packageStore'
    /AUTOLOAD
    Specifies how new packages will be loaded by App-V 5.1 on a specific computer. The following options are enabled: [1]; automatically load all packages [2]; or automatically load no packages [0].Example usage: /AUTOLOAD=[0|1|2]
    /SHAREDCONTENTSTOREMODE
    Specifies that streamed package contents will be not be saved to the local hard disk. Example usage: /SHAREDCONTENTSTOREMODE=[0|1]
    /MIGRATIONMODE
    Allows the App-V 5.1 client to modify the shortcuts and FTAs that are associated with the packages that are created with a previous version. Example usage: /MIGRATIONMODE=[0|1]
    /ENABLEPACKAGESCRIPTS
    Enables the scripts that are defined in the package manifest file or configuration files that should run. Example usage: /ENABLEPACKAGESCRIPTS=[0|1]
    /ROAMINGREGISTRYEXCLUSIONS
    Specifies the registry paths that will not roam with a user profile. Example usage: /ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients
    /ROAMINGFILEEXCLUSIONS
    Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: /ROAMINGFILEEXCLUSIONS 'desktop;my pictures'
    /S[1-5]PUBLISHINGSERVERNAME
    Displays the name of the publishing server. Example usage: /S2PUBLISHINGSERVERNAME=MyPublishingServer
    /S[1-5]PUBLISHINGSERVERURL
    Displays the URL of the publishing server. Example usage: /S2PUBLISHINGSERVERURL=\\pubserver
    /S[1-5]GLOBALREFRESHENABLED -
    Enables a global publishing refresh. Example usage: /S2GLOBALREFRESHENABLED=[0|1]
    /S[1-5]GLOBALREFRESHONLOGON
    Initiates a global publishing refresh when a user logs on. Example usage: /S2LOGONREFRESH=[0|1]
    /S[1-5]GLOBALREFRESHINTERVAL -
    Specifies the publishing refresh interval, where 0 indicates do not periodically refresh. Example usage: /S2PERIODICREFRESHINTERVAL=[0-744]
    /S[1-5]GLOBALREFRESHINTERVALUNIT
    Specifies the interval unit (Hours[0], Days[1]). Example usage: /S2GLOBALREFRESHINTERVALUNIT=[0|1]
    /S[1-5]USERREFRESHENABLED
    Enables user publishing refresh. Example usage: /S2USERREFRESHENABLED=[0|1]
    /S[1-5]USERREFRESHONLOGON
    Initiates a user publishing refresh when a user logs on. Example usage: /S2LOGONREFRESH=[0|1]
    /S[1-5]USERREFRESHINTERVAL -
    Specifies the publishing refresh interval, where 0 indicates do not periodically refresh. Example usage: /S2PERIODICREFRESHINTERVAL=[0-744]
    /S[1-5]USERREFRESHINTERVALUNIT
    Specifies the interval unit (Hours[0], Days[1]). Example usage: /S2USERREFRESHINTERVALUNIT=[0|1]
    /Log
    Specifies a location where the log information is saved. The default location is %Temp%. Example usage: /log C:\logs\log.log
    /q
    Specifies an unattended installation.
    /REPAIR
    Repairs a previous client installation.
    /NORESTART
    Prevents the computer from rebooting after the client installation.
    
-    
    The parameter prevents the end-user computer from rebooting after each update is installed and lets you schedule the reboot at your convenience. For example, you can install App-V 5.1 and then install Hotfix Package Y without rebooting after the Service Pack installation. After the installation, you must reboot before you start using App-V.
    /UNINSTALL
    Uninstalls the client.
    /ACCEPTEULA
    Accepts the license agreement. This is required for an unattended installation. Example usage: /ACCEPTEULA or /ACCEPTEULA=1.
    /LAYOUT
    Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.1. No value is expected.
    /LAYOUTDIR
    Specifies the layout directory. Requires a string value. Example usage: /LAYOUTDIR=”C:\Application Virtualization Client”.
    /?, /h, /help
    Requests help about the previous installation parameters.
    
 
-     
 
 **To install the App-V 5.1 client by using the Windows Installer (.msi) file**
 
@@ -311,7 +314,7 @@ Use the following procedure to install the Microsoft Application Virtualization
     
     
 
-     
+
 
 4.  Using the information in the following table, select the appropriate language pack **.msi** to install, based on the desired language for the target computer. The **xxxx** in the table refers to the target locale of the language pack.
 
@@ -346,9 +349,11 @@ Use the following procedure to install the Microsoft Application Virtualization
     
     
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
@@ -359,9 +364,9 @@ Use the following procedure to install the Microsoft Application Virtualization
 
 [How to Uninstall the App-V 5.1 Client](how-to-uninstall-the-app-v-51-client.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md b/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md
index 143ee0777c..3197e02c38 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-client-gb18030.md
@@ -1,9 +1,11 @@
 ---
 title: How to Deploy the App-V Client
 description: How to Deploy the App-V Client
-ms.author: pashort
-author: jamiejdt
+ms.author: dansimp
+author: dansimp
 ms.assetid: 9c4e67ae-ddaf-4e23-8c16-72d029a74a27
+ms.reviewer: 
+manager: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -31,30 +33,36 @@ Use the following procedure to install the Microsoft Application Virtualization
 
 2. Review the client coexistence and unsupported scenarios, as applicable to your installation:
 
-   | | |
-   |---|---|
-   |Deploying coexisting App-V clients |[Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md) |
-   |Unsupported or limited installation scenarios |[App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md) |
+
+   |                                               |                                                                                                                            |
+   |-----------------------------------------------|----------------------------------------------------------------------------------------------------------------------------|
+   |      Deploying coexisting App-V clients       | [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md) |
+   | Unsupported or limited installation scenarios |                         [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md)                         |
+
    ---
-   
+
 3. Review the locations for client registry, log, and troubleshooting information:
 
-   | | |
-   |---|---|
-   |Client registry information |
    • By default, after you install the App-V 5.0 client, the client information is stored in the registry in the following registry key:
      HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\APPV\CLIENT
    • When you deploy a virtualized package to a computer that is running the App-V client, the associated package data is stored in the following location:
      C:\ProgramData\App-V
      However, you can reconfigure this location with the following registry key:
      HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SOFTWARE\MICROSOFT\APPV\CLIENT\STREAMING\PACKAGEINSTALLATIONROOT
     |
-   |Client log files |
    • For log file information that is associated with the App-V 5.0 Client, search in the following log:
      Event logs/Applications and Services Logs/Microsoft/AppV
    • In App-V 5.0 SP3, some logs have been consolidated and moved to the following location:
      Event logs/Applications and Services Logs/Microsoft/AppV/ServiceLog
      For a list of the moved logs, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved).
    • Packages that are currently stored on computers that run the App-V 5.0 Client are saved to the following location:
      C:\ProgramData\App-V\<_package id_>\<_version id_>
     |
-   |Client installation troubleshooting information |See the error log in the **%temp%** folder. To review the log files, click **Start**, type **%temp%**, and then look for the **appv_ log**. |
-   ---
-   
+#### Client registry information
+
    • By default, after you install the App-V 5.0 client, the client information is stored in the registry in the following registry key:
      HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\APPV\CLIENT
    • When you deploy a virtualized package to a computer that is running the App-V client, the associated package data is stored in the following location:
      C:\ProgramData\App-V
      However, you can reconfigure this location with the following registry key:
      HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\SOFTWARE\MICROSOFT\APPV\CLIENT\STREAMING\PACKAGEINSTALLATIONROOT
    
 
-**To install the App-V 5.0 Client**
+#### Client log files                  
+
    • For log file information that is associated with the App-V 5.0 Client, search in the following log:
      Event logs/Applications and Services Logs/Microsoft/AppV
    • In App-V 5.0 SP3, some logs have been consolidated and moved to the following location:
      Event logs/Applications and Services Logs/Microsoft/AppV/ServiceLog
      For a list of the moved logs, see [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-event-logs-moved).
    • Packages that are currently stored on computers that run the App-V 5.0 Client are saved to the following location:
      C:\ProgramData\App-V\<package id>\<version id>
    
+
+#### Client installation troubleshooting information
+- See the error log in the **%temp%** folder. 
+- To review the log files, click **Start**, type **%temp%**, and then look for the **appv_ log**. 
+
+## To install the App-V 5.0 Client
 
 1. Copy the App-V 5.0 client installation file to the computer on which it will be installed.
    Choose from the following client types:
 
-   |Client type |File to use |
-   |---|---|
-   |Standard version of the client   |**appv_client_setup.exe**  |
-   |Remote Desktop Services version of the client   |**appv_client_setup_rds.exe**   |
+
+   |                  Client type                  |          File to use          |
+   |-----------------------------------------------|-------------------------------|
+   |        Standard version of the client         |   **appv_client_setup.exe**   |
+   | Remote Desktop Services version of the client | **appv_client_setup_rds.exe** |
+
    ---
 
 2. Double-click the installation file, and click **Install**. Before the installation begins, the installer checks the computer for any missing [App-V 5.0 Prerequisites](app-v-50-prerequisites.md).
@@ -70,12 +78,12 @@ Use the following procedure to install the Microsoft Application Virtualization
    -   **.msi**
 
    -   **language pack**
-   
+
    >[!NOTE]
    >After the installation, only the .exe file can be uninstalled.
 
 
-**To install the App-V 5.0 client using a script**
+## To install the App-V 5.0 client using a script
 
 1. Install all of the required prerequisite software on the target computers. See [What to do before you start](#bkmk-clt-install-prereqs). If you install the client by using an .msi file, the installation will fail if any prerequisites are missing.
 
@@ -84,41 +92,42 @@ Use the following procedure to install the Microsoft Application Virtualization
    >[!NOTE]
    >The client Windows Installer (.msi) supports the same set of switches, except for the **/LOG** parameter.
 
-   | | |
-   |---|---|
-   |/INSTALLDIR |Specifies the installation directory. Example usage:
    **/INSTALLDIR=C:\Program Files\AppV Client** |
-   |/CEIPOPTIN |Enables participation in the Customer Experience Improvement Program. Example usage:
    **/CEIPOPTIN=[0\|1\]** |
-   |/MUOPTIN |Enables Microsoft Update. Example usage:
    **/MUOPTIN=[0\|1\]** |
-   |/PACKAGEINSTALLATIONROOT |Specifies the directory in which to install all new applications and updates. Example usage: 
    **/PACKAGEINSTALLATIONROOT='C:\App-V Packages'** |
-   |/PACKAGESOURCEROOT |Overrides the source location for downloading package content. Example usage:
    **/PACKAGESOURCEROOT='http://packageStore'** |
-   |/AUTOLOAD |Specifies how new packages will be loaded by App-V 5.0 on a specific computer. The following options are enabled: [1]; automatically load all packages [2]; or automatically load no packages [0]. Example usage:
    **/AUTOLOAD=[0\|1\|2\]** |
-   |/SHAREDCONTENTSTOREMODE |Specifies that streamed package contents will be not be saved to the local hard disk. Example usage: 
    **/SHAREDCONTENTSTOREMODE=[0\|1\]** |
-   |/MIGRATIONMODE |Allows the App-V 5.0 client to modify the shortcuts and FTAs that are associated with the packages that are created with a previous version. Example usage:
    **/MIGRATIONMODE=[0\|1\]** |
-   |/ENABLEPACKAGESCRIPTS |Enables the scripts that are defined in the package manifest file or configuration files that should run. Example usage:
    **/ENABLEPACKAGESCRIPTS=[0\|1\]** |
-   |/ROAMINGREGISTRYEXCLUSIONS |Specifies the registry paths that will not roam with a user profile. Example usage:
    **/ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients** |
-   |/ROAMINGFILEEXCLUSIONS |Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: 
    **/ROAMINGFILEEXCLUSIONS 'desktop;my pictures'** |
-   |/S[1-5]PUBLISHINGSERVERNAME |Displays the name of the publishing server. Example usage:
    **/S2PUBLISHINGSERVERNAME=MyPublishingServer** |
-   |/S[1-5]PUBLISHINGSERVERURL |Displays the URL of the publishing server. Example usage:
    **/S2PUBLISHINGSERVERURL=\\pubserver** |
-   |/S[1-5]GLOBALREFRESHENABLED|Enables a global publishing refresh. Example usage:
    **/S2GLOBALREFRESHENABLED=[0\|1\]** |
-   |/S[1-5]GLOBALREFRESHONLOGON |Initiates a global publishing refresh when a user logs on. Example usage:
    **/S2LOGONREFRESH=[0\|1\]** |
-   |/S[1-5]GLOBALREFRESHINTERVAL |Specifies the publishing refresh interval, where **0** indicates do not periodically refresh. Example usage: **/S2PERIODICREFRESHINTERVAL=[0-744]** |
-   |/S[1-5]GLOBALREFRESHINTERVALUNIT |Specifies the interval unit (Hours[0], Days[1]). Example usage:
    **/S2GLOBALREFRESHINTERVALUNIT=[0\|1\]** |
-   |/S[1-5]USERREFRESHENABLED |Enables user publishing refresh. Example usage: **/S2USERREFRESHENABLED=[0\|1\]** |
-   |/S[1-5]USERREFRESHONLOGON |Initiates a user publishing refresh when a user logs on. Example usage:
    **/S2LOGONREFRESH=[0\|1\]** |
-   |/S[1-5]USERREFRESHINTERVAL |Specifies the publishing refresh interval, where **0** indicates do not periodically refresh. Example usage: **/S2PERIODICREFRESHINTERVAL=[0-744]** |
-   |/S[1-5]USERREFRESHINTERVALUNIT |Specifies the interval unit (Hours[0], Days[1]). Example usage:
    **/S2USERREFRESHINTERVALUNIT=[0\|1\]** |
-   |/Log |Specifies a location where the log information is saved. The default location is %Temp%. Example usage:
    **/log C:\logs\log.log** |
-   |/q |Specifies an unattended installation. |
-   |/REPAIR |Repairs a previous client installation. |
-   |/NORESTART |Prevents the computer from rebooting after the client installation.
    The parameter prevents the end-user computer from rebooting after each update is installed and lets you schedule the reboot at your convenience. For example, you can install App-V 5.0 SPX and then install Hotfix Package Y without rebooting after the Service Pack installation. After the installation, you must reboot before you start using App-V. |
-   |/UNINSTALL |Uninstalls the client. |
-   |/ACCEPTEULA |Accepts the license agreement. This is required for an unattended installation. Example usage:
    **/ACCEPTEULA** or **/ACCEPTEULA=1** |
-   |/LAYOUT |Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.0. No value is expected. |
-   |/LAYOUTDIR |Specifies the layout directory. Requires a string value. Example usage:
    **/LAYOUTDIR=”C:\Application Virtualization Client”** |
-   |/?, /h, /help |Requests help about the previous installation parameters. |
+   |                                  |                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+   |----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+   |           /INSTALLDIR            |                                                                                                                                                               Specifies the installation directory. Example usage:
    **/INSTALLDIR=C:\Program Files\AppV Client**                                                                                                                                                                |
+   |            /CEIPOPTIN            |                                                                                                                                                          Enables participation in the Customer Experience Improvement Program. Example usage:
    **/CEIPOPTIN=[0\|1\]**                                                                                                                                                           |
+   |             /MUOPTIN             |                                                                                                                                                                                 Enables Microsoft Update. Example usage:
    **/MUOPTIN=[0\|1\]**                                                                                                                                                                                  |
+   |     /PACKAGEINSTALLATIONROOT     |                                                                                                                                         Specifies the directory in which to install all new applications and updates. Example usage: 
    **/PACKAGEINSTALLATIONROOT='C:\App-V Packages'**                                                                                                                                         |
+   |        /PACKAGESOURCEROOT        |                                                                                                                                                  Overrides the source location for downloading package content. Example usage:
    **/PACKAGESOURCEROOT=''**                                                                                                                                                  |
+   |            /AUTOLOAD             |                                                                                           Specifies how new packages will be loaded by App-V 5.0 on a specific computer. The following options are enabled: [1]; automatically load all packages [2]; or automatically load no packages [0]. Example usage:
    **/AUTOLOAD=[0\|1\|2\]**                                                                                           |
+   |     /SHAREDCONTENTSTOREMODE      |                                                                                                                                           Specifies that streamed package contents will be not be saved to the local hard disk. Example usage: 
    **/SHAREDCONTENTSTOREMODE=[0\|1\]**                                                                                                                                            |
+   |          /MIGRATIONMODE          |                                                                                                                     Allows the App-V 5.0 client to modify the shortcuts and FTAs that are associated with the packages that are created with a previous version. Example usage:
    **/MIGRATIONMODE=[0\|1\]**                                                                                                                     |
+   |      /ENABLEPACKAGESCRIPTS       |                                                                                                                                   Enables the scripts that are defined in the package manifest file or configuration files that should run. Example usage:
    **/ENABLEPACKAGESCRIPTS=[0\|1\]**                                                                                                                                   |
+   |    /ROAMINGREGISTRYEXCLUSIONS    |                                                                                                                                      Specifies the registry paths that will not roam with a user profile. Example usage:
    **/ROAMINGREGISTRYEXCLUSIONS=software\classes;software\clients**                                                                                                                                      |
+   |      /ROAMINGFILEEXCLUSIONS      |                                                                                                                                  Specifies the file paths relative to %userprofile% that do not roam with a user's profile. Example usage: 
    **/ROAMINGFILEEXCLUSIONS 'desktop;my pictures'**                                                                                                                                   |
+   |   /S[1-5]PUBLISHINGSERVERNAME    |                                                                                                                                                           Displays the name of the publishing server. Example usage:
    **/S2PUBLISHINGSERVERNAME=MyPublishingServer**                                                                                                                                                            |
+   |    /S[1-5]PUBLISHINGSERVERURL    |                                                                                                                                                                Displays the URL of the publishing server. Example usage:
    **/S2PUBLISHINGSERVERURL=\\pubserver**                                                                                                                                                                |
+   |   /S[1-5]GLOBALREFRESHENABLED    |                                                                                                                                                                    Enables a global publishing refresh. Example usage:
    **/S2GLOBALREFRESHENABLED=[0\|1\]**                                                                                                                                                                     |
+   |   /S[1-5]GLOBALREFRESHONLOGON    |                                                                                                                                                             Initiates a global publishing refresh when a user logs on. Example usage:
    **/S2LOGONREFRESH=[0\|1\]**                                                                                                                                                              |
+   |   /S[1-5]GLOBALREFRESHINTERVAL   |                                                                                                                                         Specifies the publishing refresh interval, where **0** indicates do not periodically refresh. Example usage: **/S2PERIODICREFRESHINTERVAL=[0-744]**                                                                                                                                         |
+   | /S[1-5]GLOBALREFRESHINTERVALUNIT |                                                                                                                                                            Specifies the interval unit (Hours[0], Days[1]). Example usage:
    **/S2GLOBALREFRESHINTERVALUNIT=[0\|1\]**                                                                                                                                                            |
+   |    /S[1-5]USERREFRESHENABLED     |                                                                                                                                                                          Enables user publishing refresh. Example usage: **/S2USERREFRESHENABLED=[0\|1\]**                                                                                                                                                                          |
+   |    /S[1-5]USERREFRESHONLOGON     |                                                                                                                                                              Initiates a user publishing refresh when a user logs on. Example usage:
    **/S2LOGONREFRESH=[0\|1\]**                                                                                                                                                               |
+   |    /S[1-5]USERREFRESHINTERVAL    |                                                                                                                                         Specifies the publishing refresh interval, where **0** indicates do not periodically refresh. Example usage: **/S2PERIODICREFRESHINTERVAL=[0-744]**                                                                                                                                         |
+   |  /S[1-5]USERREFRESHINTERVALUNIT  |                                                                                                                                                             Specifies the interval unit (Hours[0], Days[1]). Example usage:
    **/S2USERREFRESHINTERVALUNIT=[0\|1\]**                                                                                                                                                             |
+   |               /Log               |                                                                                                                                                Specifies a location where the log information is saved. The default location is %Temp%. Example usage:
    **/log C:\logs\log.log**                                                                                                                                                |
+   |                /q                |                                                                                                                                                                                                Specifies an unattended installation.                                                                                                                                                                                                |
+   |             /REPAIR              |                                                                                                                                                                                               Repairs a previous client installation.                                                                                                                                                                                               |
+   |            /NORESTART            | Prevents the computer from rebooting after the client installation.
    The parameter prevents the end-user computer from rebooting after each update is installed and lets you schedule the reboot at your convenience. For example, you can install App-V 5.0 SPX and then install Hotfix Package Y without rebooting after the Service Pack installation. After the installation, you must reboot before you start using App-V. |
+   |            /UNINSTALL            |                                                                                                                                                                                                       Uninstalls the client.                                                                                                                                                                                                        |
+   |           /ACCEPTEULA            |                                                                                                                                              Accepts the license agreement. This is required for an unattended installation. Example usage:
    **/ACCEPTEULA** or **/ACCEPTEULA=1**                                                                                                                                               |
+   |             /LAYOUT              |                                                                                                                               Specifies the associated layout action. It also extracts the Windows Installer (.msi) and script files to a folder without installing App-V 5.0. No value is expected.                                                                                                                                |
+   |            /LAYOUTDIR            |                                                                                                                                                 Specifies the layout directory. Requires a string value. Example usage:
    **/LAYOUTDIR=”C:\Application Virtualization Client”**                                                                                                                                                  |
+   |          /?, /h, /help           |                                                                                                                                                                                      Requests help about the previous installation parameters.                                                                                                                                                                                      |
+
    ---
 
-**To install the App-V 5.0 client by using the Windows Installer (.msi) file**
+## To install the App-V 5.0 client by using the Windows Installer (.msi) file
 
 1. Install the required prerequisites on the target computers. See [What to do before you start](#bkmk-clt-install-prereqs). If any prerequisites are not met, the installation will fail.
 
@@ -126,13 +135,15 @@ Use the following procedure to install the Microsoft Application Virtualization
 
 3. Deploy one of the following Windows Installer files to the target computer. The file that you specify must match the configuration of the target computer.
 
-   |Type of deployment |Deploy this file |
-   |---|---|
-   |Computer is running a 32-bit Microsoft Windows operating system |appv_client_MSI_x86.msi |
-   |Computer is running a 64-bit Microsoft Windows operating system |appv_client_MSI_x64.msi |
-   |You are deploying the App-V 5.0 Remote Desktop Services client |appv_client_rds_MSI_x64.msi |
+
+   |                       Type of deployment                        |      Deploy this file       |
+   |-----------------------------------------------------------------|-----------------------------|
+   | Computer is running a 32-bit Microsoft Windows operating system |   appv_client_MSI_x86.msi   |
+   | Computer is running a 64-bit Microsoft Windows operating system |   appv_client_MSI_x64.msi   |
+   | You are deploying the App-V 5.0 Remote Desktop Services client  | appv_client_rds_MSI_x64.msi |
+
    ---
- 
+
 4. Using the information in the following table, select the appropriate language pack **.msi** to install, based on the desired language for the target computer. The **xxxx** in the table refers to the target locale of the language pack.
 
    **What to know before you start:** 
@@ -143,12 +154,13 @@ Use the following procedure to install the Microsoft Application Virtualization
 
    -  To deploy additional language packs on a target computer, use the procedure **To install the App-V 5.0 client by using Windows Installer (.msi) file**.
 
-   |Type of deployment |Deploy this file |
-   |---|---|
-   |Computer is running a 32-bit Microsoft Windows operating system |appv_client_LP_xxxx_ x86.msi |
-   |Computer is running a 64-bit Microsoft Windows operating system |appv_client_LP_xxxx_ x64.msi |
+   |                       Type of deployment                        |       Deploy this file       |
+   |-----------------------------------------------------------------|------------------------------|
+   | Computer is running a 32-bit Microsoft Windows operating system | appv_client_LP_xxxx_ x86.msi |
+   | Computer is running a 64-bit Microsoft Windows operating system | appv_client_LP_xxxx_ x64.msi |
+
    ---
-   
+
    **Got a suggestion for App-V**? Add or vote on [suggestions](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). 
    **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md b/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md
index cfd6725e5d..0427b800e1 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts.md
@@ -1,8 +1,11 @@
 ---
 title: How to Deploy the App-V Databases by Using SQL Scripts
 description: How to Deploy the App-V Databases by Using SQL Scripts
-author: jamiejdt
+author: dansimp
 ms.assetid: 23637936-475f-4ca5-adde-76bb27d2372b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -22,49 +25,50 @@ Use the following instructions to use SQL scripts, rather than the Windows Insta
 
 **How to install the App-V databases by using SQL scripts**
 
-1.  Before you install the database scripts, review and keep a copy of the App-V license terms. By running the database scripts, you are agreeing to the license terms. If you do not accept them, you should not use this software.
+1. Before you install the database scripts, review and keep a copy of the App-V license terms. By running the database scripts, you are agreeing to the license terms. If you do not accept them, you should not use this software.
 
-2.  Copy the **appv\_server\_setup.exe** from the App-V release media to a temporary location.
+2. Copy the **appv\_server\_setup.exe** from the App-V release media to a temporary location.
 
-3.  From a command prompt, run **appv\_server\_setup.exe** and specify a temporary location for extracting the database scripts.
+3. From a command prompt, run **appv\_server\_setup.exe** and specify a temporary location for extracting the database scripts.
 
-    Example: appv\_server\_setup.exe /layout c:\\<temporary location path>
+   Example: appv\_server\_setup.exe /layout c:\\<temporary location path>
 
-4.  Browse to the temporary location that you created, open the extracted **DatabaseScripts** folder, and review the appropriate Readme.txt file for instructions:
+4. Browse to the temporary location that you created, open the extracted **DatabaseScripts** folder, and review the appropriate Readme.txt file for instructions:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    DatabaseLocation of Readme.txt file to use
    Management database
    ManagementDatabase subfolder
    
-    
    
-    Important  
-    
    If you are upgrading to or installing the App-V 5.0 SP3 Management database, see [SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail](https://support.microsoft.com/kb/3031340).
    
-    
    
-    
    
-     
-    
    Reporting database
    ReportingDatabase subfolder
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    DatabaseLocation of Readme.txt file to use
    Management database
    ManagementDatabase subfolder
    
+   
    
+   Important
    If you are upgrading to or installing the App-V 5.0 SP3 Management database, see SQL scripts to install or upgrade the App-V 5.0 SP3 Management Server database fail.
    
+   
    
+   
    
 
-     
+   
    Reporting database
    ReportingDatabase subfolder
    
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
@@ -73,9 +77,9 @@ Use the following instructions to use SQL scripts, rather than the Windows Insta
 
 [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md b/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md
index 7ecebe1f65..c8faae6bae 100644
--- a/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md
+++ b/mdop/appv-v5/how-to-deploy-the-app-v-databases-by-using-sql-scripts51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Deploy the App-V Databases by Using SQL Scripts
 description: How to Deploy the App-V Databases by Using SQL Scripts
-author: jamiejdt
+author: dansimp
 ms.assetid: 1183b1bc-d4d7-4914-a049-06e82bf2d96d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -20,10 +23,10 @@ Use the following instructions to use SQL scripts, rather than the Windows Insta
 
 -   Upgrade the App-V databases to a later version
 
-**Note**  
+**Note**  
 If you have already deployed the App-V 5.0 SP3 database, the SQL scripts are not required to upgrade to App-V 5.1.
 
- 
+
 
 **How to install the App-V databases by using SQL scripts**
 
@@ -60,19 +63,21 @@ If you have already deployed the App-V 5.0 SP3 database, the SQL scripts are not
     
     
 
-     
 
-    **Caution**  
-    The readme.txt file in the ManagementDatabase subfolder is out of date. The information in the updated readme files below is the most current and should supersede the readme information provided in the **DatabaseScripts** folders.
 
-     
+~~~
+**Caution**  
+The readme.txt file in the ManagementDatabase subfolder is out of date. The information in the updated readme files below is the most current and should supersede the readme information provided in the **DatabaseScripts** folders.
 
-    **Important**  
-    The InsertVersionInfo.sql script is not required for versions of the App-V management database later than App-V 5.0 SP3.
 
-    The Permissions.sql script should be updated according to **Step 2** in [KB article 3031340](https://support.microsoft.com/kb/3031340). **Step 1** is not required for versions of App-V later than App-V 5.0 SP3.
 
-     
+**Important**  
+The InsertVersionInfo.sql script is not required for versions of the App-V management database later than App-V 5.0 SP3.
+
+The Permissions.sql script should be updated according to **Step 2** in [KB article 3031340](https://support.microsoft.com/kb/3031340). **Step 1** is not required for versions of App-V later than App-V 5.0 SP3.
+~~~
+
+
 
 **Updated management database README file content**
 
@@ -206,7 +211,7 @@ Steps to install "AppVReporting" schema in SQL SERVER.
 
  2. Run the following scripts against the "AppVReporting" database using the 
     same account as above in order.
-    
+
     CreateTables.sql
     CreateReportingStoredProcs.sql
     CreateStoredProcs.sql
@@ -226,9 +231,9 @@ Steps to install "AppVReporting" schema in SQL SERVER.
 
 [How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md b/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md
index 03d2cad8f2..094eff2814 100644
--- a/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md
+++ b/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd.md
@@ -1,8 +1,11 @@
 ---
 title: How to Enable Only Administrators to Publish Packages by Using an ESD
 description: How to Enable Only Administrators to Publish Packages by Using an ESD
-author: jamiejdt
+author: dansimp
 ms.assetid: 03367b26-83d5-4299-ad52-b9177b9cf9a8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -26,7 +29,7 @@ Starting in App-V 5.0 SP3, you can configure the App-V client so that only admin
 
     To alternatively use PowerShell to set this item, see [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs).
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
  
 
diff --git a/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md b/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md
index 8025404b55..475dc5d892 100644
--- a/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md
+++ b/mdop/appv-v5/how-to-enable-only-administrators-to-publish-packages-by-using-an-esd51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Enable Only Administrators to Publish Packages by Using an ESD
 description: How to Enable Only Administrators to Publish Packages by Using an ESD
-author: jamiejdt
+author: dansimp
 ms.assetid: bbc9fda2-fc09-4d72-8d9a-e83d2fcfe234
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md b/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md
index 30f1331680..128470febf 100644
--- a/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md
+++ b/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: How to Enable Reporting on the App-V 5.0 Client by Using PowerShell
 description: How to Enable Reporting on the App-V 5.0 Client by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: a7aaf553-0f83-4cd0-8df8-93a5f1ebe497
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -18,76 +21,75 @@ Use the following procedure to configure the App-V 5.0 for reporting.
 
 **To configure the computer running the App-V 5.0 client for reporting**
 
-1.  Install the App-V 5.0 client. For more information about installing the client see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md).
+1. Install the App-V 5.0 client. For more information about installing the client see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md).
 
-2.  After you have installed the App-V 5.0 client, use the **Set-AppvClientConfiguration** PowerShell to configure appropriate Reporting Configuration settings:
+2. After you have installed the App-V 5.0 client, use the **Set-AppvClientConfiguration** PowerShell to configure appropriate Reporting Configuration settings:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    SettingDescription
    ReportingEnabled
    Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.
    ReportingServerURL
    Specifies the location on the reporting server where client information is saved. For example, http://<reportingservername>:<reportingportnumber>.
    
-    
    
-    Note  
-    
    This is the port number that was assigned during the Reporting Server setup
    
-    
    
-    
    
-     
-    
    Reporting Start Time
    This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.
    ReportingRandomDelay
    Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.
    ReportingInterval
    Specifies the retry interval that the client will use to resend data to the reporting server.
    ReportingDataCacheLimit
    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.
    ReportingDataBlockSize
    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    SettingDescription
    ReportingEnabled
    Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.
    ReportingServerURL
    Specifies the location on the reporting server where client information is saved. For example, http://<reportingservername>:<reportingportnumber>.
    
+   
    
+   Note
    This is the port number that was assigned during the Reporting Server setup
    
+   
    
+   
    
 
-     
+   
    Reporting Start Time
    This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.
    ReportingRandomDelay
    Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.
    ReportingInterval
    Specifies the retry interval that the client will use to resend data to the reporting server.
    ReportingDataCacheLimit
    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.
    ReportingDataBlockSize
    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.
    
 
-3.  After the appropriate settings have been configured, the computer running the App-V 5.0 client will automatically collect data and will send the data back to the reporting server.
 
-    Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** PowerShell cmdlet.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+3. After the appropriate settings have been configured, the computer running the App-V 5.0 client will automatically collect data and will send the data back to the reporting server.
+
+   Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** PowerShell cmdlet.
+
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md b/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md
index 89e9b127d9..0bbe4ac487 100644
--- a/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md
+++ b/mdop/appv-v5/how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: How to Enable Reporting on the App-V 5.1 Client by Using PowerShell
 description: How to Enable Reporting on the App-V 5.1 Client by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: c4c58be6-cc50-44f6-bf4f-8346fc5d0c0e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -18,76 +21,75 @@ Use the following procedure to configure the App-V 5.1 for reporting.
 
 **To configure the computer running the App-V 5.1 client for reporting**
 
-1.  Install the App-V 5.1 client. For more information about installing the client see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md).
+1. Install the App-V 5.1 client. For more information about installing the client see [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md).
 
-2.  After you have installed the App-V 5.1 client, use the **Set-AppvClientConfiguration** PowerShell to configure appropriate Reporting Configuration settings:
+2. After you have installed the App-V 5.1 client, use the **Set-AppvClientConfiguration** PowerShell to configure appropriate Reporting Configuration settings:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    SettingDescription
    ReportingEnabled
    Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.
    ReportingServerURL
    Specifies the location on the reporting server where client information is saved. For example, http://<reportingservername>:<reportingportnumber>.
    
-    
    
-    Note  
-    
    This is the port number that was assigned during the Reporting Server setup
    
-    
    
-    
    
-     
-    
    Reporting Start Time
    This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.
    ReportingRandomDelay
    Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.
    ReportingInterval
    Specifies the retry interval that the client will use to resend data to the reporting server.
    ReportingDataCacheLimit
    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.
    ReportingDataBlockSize
    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    SettingDescription
    ReportingEnabled
    Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.
    ReportingServerURL
    Specifies the location on the reporting server where client information is saved. For example, http://<reportingservername>:<reportingportnumber>.
    
+   
    
+   Note
    This is the port number that was assigned during the Reporting Server setup
    
+   
    
+   
    
 
-     
+   
    Reporting Start Time
    This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.
    ReportingRandomDelay
    Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.
    ReportingInterval
    Specifies the retry interval that the client will use to resend data to the reporting server.
    ReportingDataCacheLimit
    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.
    ReportingDataBlockSize
    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.
    
 
-3.  After the appropriate settings have been configured, the computer running the App-V 5.1 client will automatically collect data and will send the data back to the reporting server.
 
-    Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** PowerShell cmdlet.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+3. After the appropriate settings have been configured, the computer running the App-V 5.1 client will automatically collect data and will send the data back to the reporting server.
+
+   Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** PowerShell cmdlet.
+
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-install-the-app-v-50-client-for-shared-content-store-mode.md b/mdop/appv-v5/how-to-install-the-app-v-50-client-for-shared-content-store-mode.md
index c30e3a75b1..b9405a9529 100644
--- a/mdop/appv-v5/how-to-install-the-app-v-50-client-for-shared-content-store-mode.md
+++ b/mdop/appv-v5/how-to-install-the-app-v-50-client-for-shared-content-store-mode.md
@@ -1,8 +1,11 @@
 ---
 title: How to Install the App-V 5.0 Client for Shared Content Store Mode
 description: How to Install the App-V 5.0 Client for Shared Content Store Mode
-author: jamiejdt
+author: dansimp
 ms.assetid: 88f09e6f-19e7-48ea-965a-907052d1a02f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Use the following procedure to install the Microsoft Application Virtualization
 **Note**  
 Before performing this procedure if necessary uninstall any existing version of the App-V 5.0 client.
 
- 
+ 
 
 For more information about SCS mode, see [Shared Content Store in Microsoft App-V 5.0 – Behind the Scenes](https://go.microsoft.com/fwlink/?LinkId=316879) (https://go.microsoft.com/fwlink/?LinkId=316879).
 
@@ -34,20 +37,20 @@ For more information about SCS mode, see [Shared Content Store in Microsoft App-
         **Important**  
         You must perform a silent installation or the installation will fail.
 
-         
+         
 
 2.  After you have completed the installation you can deploy packages to the computer running the client and all package contents will be streamed across the network.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Deploying the App-V 5.0 Sequencer and Client](deploying-the-app-v-50-sequencer-and-client.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-install-the-app-v-51-client-for-shared-content-store-mode.md b/mdop/appv-v5/how-to-install-the-app-v-51-client-for-shared-content-store-mode.md
index 318c5b853a..25741ffb48 100644
--- a/mdop/appv-v5/how-to-install-the-app-v-51-client-for-shared-content-store-mode.md
+++ b/mdop/appv-v5/how-to-install-the-app-v-51-client-for-shared-content-store-mode.md
@@ -1,8 +1,11 @@
 ---
 title: How to Install the App-V 5.1 Client for Shared Content Store Mode
 description: How to Install the App-V 5.1 Client for Shared Content Store Mode
-author: jamiejdt
+author: dansimp
 ms.assetid: 6f3ecb1b-b5b5-4ae0-8de9-b4ffdfd2c216
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Use the following procedure to install the Microsoft Application Virtualization
 **Note**  
 Before performing this procedure if necessary uninstall any existing version of the App-V 5.1 client.
 
- 
+ 
 
 For more information about SCS mode, see [Shared Content Store in Microsoft App-V 5.0 – Behind the Scenes](https://go.microsoft.com/fwlink/?LinkId=316879) (https://go.microsoft.com/fwlink/?LinkId=316879).
 
@@ -34,7 +37,7 @@ For more information about SCS mode, see [Shared Content Store in Microsoft App-
         **Important**  
         You must perform a silent installation or the installation will fail.
 
-         
+         
 
 2.  After you have completed the installation you can deploy packages to the computer running the client and all package contents will be streamed across the network.
 
@@ -45,9 +48,9 @@ For more information about SCS mode, see [Shared Content Store in Microsoft App-
 
 [Deploying the App-V 5.1 Sequencer and Client](deploying-the-app-v-51-sequencer-and-client.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md b/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md
index 2714943e8a..22ca05448e 100644
--- a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md
+++ b/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell
 description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 9399342b-1ea7-41df-b988-33e302f9debe
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -34,359 +37,137 @@ Before attempting this procedure, you should read and understand the information
 
 **To convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs)**
 
-1.  Copy the following script into a text editor and save it as a PowerShell script file, for example **ConvertToSIDs.ps1**.
+1. Copy the following script into a text editor and save it as a PowerShell script file, for example **ConvertToSIDs.ps1**.
 
-2.  To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**.
+2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**.
 
-    ``` syntax
-    <#
-    ```
+   ```powershell
+   <#
+   .SYNOPSIS
+   This PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats.
 
-    ``` syntax
-    .SYNOPSIS
-    ```
+   .DESCRIPTION
+   This is a PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts.
 
-    ``` syntax
-    This PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats.
-    ```
+   .INPUTS
+   The account(s) to convert to SID format. This can be a single account name or an array of account names. Please see examples below.
 
-    ``` syntax
-    .DESCRIPTION
-    ```
+   .OUTPUTS
+   A list of account names with the corresponding SID in standard and hexadecimal formats
 
-    ``` syntax
-    This is a PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts.
-    ```
+   .EXAMPLE
+   .\ConvertToSID.ps1 DOMAIN\user_account1 DOMAIN\machine_account1$ DOMAIN\user_account2 | Format-List
 
-    ``` syntax
-    .INPUTS
-    ```
+   .EXAMPLE
+   $accountsArray = @("DOMAIN\user_account1", "DOMAIN\machine_account1$", "DOMAIN_user_account2")
 
-    ``` syntax
-    The account(s) to convert to SID format. This can be a single account name or an array of account names. Please see examples below.
-    ```
+   .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200
+   #>
 
-    ``` syntax
-    .OUTPUTS
-    ```
+   function ConvertSIDToHexFormat
+   {
+      param([System.Security.Principal.SecurityIdentifier]$sidToConvert)
 
-    ``` syntax
-    A list of account names with the corresponding SID in standard and hexadecimal formats
-    ```
+      $sb = New-Object System.Text.StringBuilder
 
-    ``` syntax
-    .EXAMPLE
-    ```
+      [int] $binLength = $sidToConvert.BinaryLength
 
-    ``` syntax
-    .\ConvertToSID.ps1 DOMAIN\user_account1 DOMAIN\machine_account1$ DOMAIN\user_account2 | Format-List
-    ```
+      [Byte[]] $byteArray = New-Object Byte[] $binLength
 
-    ``` syntax
-    .EXAMPLE
-    ```
+      $sidToConvert.GetBinaryForm($byteArray, 0)
 
-    ``` syntax
-    $accountsArray = @("DOMAIN\user_account1", "DOMAIN\machine_account1$", "DOMAIN_user_account2")
-    ```
+      foreach($byte in $byteArray)
+      {
+          $sb.Append($byte.ToString("X2")) |Out-Null
+      }
+      return $sb.ToString()
+   }
 
-    ``` syntax
-    .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200
-    ```
+   [string[]]$myArgs = $args
 
-    ``` syntax
-#>
-    ```
 
-    ``` syntax
-    ```
 
-    []()  
+   if(($myArgs.Length -lt 1) -or ($myArgs[0].CompareTo("/?") -eq 0))
+   {
+       [string]::Format("{0}====== Description ======{0}{0}" +
+                  "  Converts any number of user or machine account names to string and hexadecimal SIDs.{0}" +
+                  "  Pass the account(s) as space separated command line parameters. (For example 'ConvertToSID.exe DOMAIN\\Account1 DOMAIN\\Account2 ...'){0}" +
+                  "  The output is written to the console in the format 'Account name    SID as string   SID as hexadecimal'{0}" +
+                  "  And can be written out to a file using standard PowerShell redirection{0}" +
+                  "  Please specify user accounts in the format 'DOMAIN\username'{0}" +
+                  "  Please specify machine accounts in the format 'DOMAIN\machinename$'{0}" +
+                  "  For more help content, please run 'Get-Help ConvertToSID.ps1'{0}" +
+                  "{0}====== Arguments ======{0}" +
 
-    []()  
 
-    ``` syntax
-    function ConvertSIDToHexFormat
-    ```
 
-    {
+                  "{0}  /?    Show this help message", [Environment]::NewLine)
+   }
+   else
+   {
+       #If an array was passed in, try to split it
+       if($myArgs.Length -eq 1)
+       {
+           $myArgs = $myArgs.Split(' ')
+       }
 
-       param(\[System.Security.Principal.SecurityIdentifier\]$sidToConvert)
+       #Parse the arguments for account names
+       foreach($accountName in $myArgs)
+       {
+           [string[]] $splitString = $accountName.Split('\')  # We're looking for the format "DOMAIN\Account" so anything that does not match, we reject
 
-    ``` syntax
-    ```
+           if($splitString.Length -ne 2)
+           {
+               $message = [string]::Format("{0} is not a valid account name. Expected format 'Domain\username' for user accounts or 'DOMAIN\machinename$' for machine accounts.", $accountName)
 
-    ``` syntax
-       $sb = New-Object System.Text.StringBuilder
-    ```
+               Write-Error -Message $message
+               continue
+           }
 
-    ``` syntax
-        [int] $binLength = $sidToConvert.BinaryLength
-    ```
+           #Convert any account names to SIDs
+           try
+           {
+               [System.Security.Principal.NTAccount] $account = New-Object System.Security.Principal.NTAccount($splitString[0], $splitString[1])
 
-    ``` syntax
-        [Byte[]] $byteArray = New-Object Byte[] $binLength
-    ```
+               [System.Security.Principal.SecurityIdentifier] $SID = [System.Security.Principal.SecurityIdentifier]($account.Translate([System.Security.Principal.SecurityIdentifier]))
+           }
+           catch [System.Security.Principal.IdentityNotMappedException]
+           {
+               $message = [string]::Format("Failed to translate account object '{0}' to a SID. Please verify that this is a valid user or machine account.", $account.ToString())
 
-    ``` syntax
-       $sidToConvert.GetBinaryForm($byteArray, 0)
-    ```
+               Write-Error -Message $message
 
-    ``` syntax
-       foreach($byte in $byteArray)
-    ```
+               continue
+           }
 
-    ``` syntax
-       {
-    ```
+           #Convert regular SID to binary format used by SQL
 
-    ``` syntax
-       $sb.Append($byte.ToString("X2")) |Out-Null
-    ```
+           $hexSIDString = ConvertSIDToHexFormat $SID
 
-    ``` syntax
-       }
-    ```
+           $SIDs = New-Object PSObject
 
-    ``` syntax
-       return $sb.ToString()
-    ```
+           $SIDs | Add-Member NoteProperty Account $accountName
 
-    ``` syntax
-    }
-    ```
+           $SIDs | Add-Member NoteProperty SID $SID.ToString()
 
-    ``` syntax
-     [string[]]$myArgs = $args
-    ```
+           $SIDs | Add-Member NoteProperty Hexadecimal $hexSIDString
 
-    ``` syntax
-    if(($myArgs.Length -lt 1) -or ($myArgs[0].CompareTo("/?") -eq 0))
-    ```
+           Write-Output $SIDs
+       }
+   }
+   ```
 
-    {
+3. Run the script you saved in step one of this procedure passing the accounts to convert as arguments.
 
-    ``` syntax
-     [string]::Format("{0}====== Description ======{0}{0}" +
-    ```
+   For example,
 
-    ``` syntax
-    "  Converts any number of user or machine account names to string and hexadecimal SIDs.{0}" +
-    ```
+   **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List” or “$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")**
 
-    ``` syntax
-                   "  Pass the account(s) as space separated command line parameters. (For example 'ConvertToSID.exe DOMAIN\\Account1 DOMAIN\\Account2 ...'){0}" +
-    ```
+   **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200”**
 
-    ``` syntax
-                   "  The output is written to the console in the format 'Account name    SID as string   SID as hexadecimal'{0}" +
-    ```
-
-    ``` syntax
-                   "  And can be written out to a file using standard PowerShell redirection{0}" +
-    ```
-
-    ``` syntax
-                   "  Please specify user accounts in the format 'DOMAIN\username'{0}" + 
-    ```
-
-    ``` syntax
-                   "  Please specify machine accounts in the format 'DOMAIN\machinename$'{0}" +
-    ```
-
-    ``` syntax
-                   "  For more help content, please run 'Get-Help ConvertToSID.ps1'{0}" + 
-    ```
-
-    ``` syntax
-                   "{0}====== Arguments ======{0}" +
-    ```
-
-    ``` syntax
-                   "{0}  /?    Show this help message", [Environment]::NewLine) 
-    ```
-
-    ``` syntax
-    {
-    ```
-
-    ``` syntax
-    else
-    ```
-
-    ``` syntax
-    {  
-        #If an array was passed in, try to split it
-    ```
-
-    ``` syntax
-        if($myArgs.Length -eq 1)
-    ```
-
-    ``` syntax
-        {
-    ```
-
-    ``` syntax
-            $myArgs = $myArgs.Split(' ')
-    ```
-
-    ``` syntax
-        }
-    ```
-
-    ``` syntax
-
-        #Parse the arguments for account names
-    ```
-
-    ``` syntax
-        foreach($accountName in $myArgs)
-    ```
-
-    ``` syntax
-        {    
-    ```
-
-    ``` syntax
-            [string[]] $splitString = $accountName.Split('\')  # We're looking for the format "DOMAIN\Account" so anything that does not match, we reject
-    ```
-
-    ``` syntax
-            if($splitString.Length -ne 2)
-    ```
-
-    ``` syntax
-            {
-    ```
-
-    ``` syntax
-                $message = [string]::Format("{0} is not a valid account name. Expected format 'Domain\username' for user accounts or 'DOMAIN\machinename$' for machine accounts.", $accountName)
-    ```
-
-    ``` syntax
-                Write-Error -Message $message
-    ```
-
-    ``` syntax
-                continue
-    ```
-
-    ``` syntax
-            }
-    ```
-
-    ``` syntax
-            
-    ```
-
-    ``` syntax
-            #Convert any account names to SIDs
-    ```
-
-    ``` syntax
-            try
-    ```
-
-    ``` syntax
-            {
-    ```
-
-    ``` syntax
-                [System.Security.Principal.NTAccount] $account = New-Object System.Security.Principal.NTAccount($splitString[0], $splitString[1])
-    ```
-
-    ``` syntax
-                [System.Security.Principal.SecurityIdentifier] $SID = [System.Security.Principal.SecurityIdentifier]($account.Translate([System.Security.Principal.SecurityIdentifier]))
-    ```
-
-    ``` syntax
-            }
-    ```
-
-    ``` syntax
-            catch [System.Security.Principal.IdentityNotMappedException]
-    ```
-
-    ``` syntax
-            {
-    ```
-
-    ``` syntax
-                $message = [string]::Format("Failed to translate account object '{0}' to a SID. Please verify that this is a valid user or machine account.", $account.ToString())
-    ```
-
-    ``` syntax
-                Write-Error -Message $message
-    ```
-
-    ``` syntax
-                continue
-    ```
-
-    ``` syntax
-            }
-    ```
-
-    ``` syntax
-
-            #Convert regular SID to binary format used by SQL
-    ```
-
-    ``` syntax
-            $hexSIDString = ConvertSIDToHexFormat $SID
-    ```
-
-    ``` syntax
-            
-            $SIDs = New-Object PSObject
-    ```
-
-    ``` syntax
-            $SIDs | Add-Member NoteProperty Account $accountName
-    ```
-
-    ``` syntax
-            $SIDs | Add-Member NoteProperty SID $SID.ToString()
-    ```
-
-    ``` syntax
-            $SIDs | Add-Member NoteProperty Hexadecimal $hexSIDString
-    ```
-
-    ``` syntax
-
-            Write-Output $SIDs
-    ```
-
-    ``` syntax
-        }
-    ```
-
-    ``` syntax
-    }
-    ```
-
-3.  Run the script you saved in step one of this procedure passing the accounts to convert as arguments.
-
-    For example,
-
-    **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List” or “$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")**
-
-    **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200”**
-
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md)
-
- 
-
- 
-
-
-
-
-
diff --git a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md b/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md
index 36dd8b94c1..ed4ef04eb0 100644
--- a/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md
+++ b/mdop/appv-v5/how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell
 description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 2be6fb72-f3a6-4550-bba1-6defa78ca08a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -34,359 +37,111 @@ Before attempting this procedure, you should read and understand the information
 
 **To convert any number of Active Directory Domain Services (AD DS) user or machine accounts into formatted Security Identifiers (SIDs)**
 
-1.  Copy the following script into a text editor and save it as a PowerShell script file, for example **ConvertToSIDs.ps1**.
-
-2.  To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**.
-
-    ``` syntax
-    <#
-    ```
-
-    ``` syntax
-    .SYNOPSIS
-    ```
-
-    ``` syntax
-    This PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats.
-    ```
-
-    ``` syntax
-    .DESCRIPTION
-    ```
-
-    ``` syntax
-    This is a PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts.
-    ```
-
-    ``` syntax
-    .INPUTS
-    ```
-
-    ``` syntax
-    The account(s) to convert to SID format. This can be a single account name or an array of account names. Please see examples below.
-    ```
-
-    ``` syntax
-    .OUTPUTS
-    ```
-
-    ``` syntax
-    A list of account names with the corresponding SID in standard and hexadecimal formats
-    ```
-
-    ``` syntax
-    .EXAMPLE
-    ```
-
-    ``` syntax
-    .\ConvertToSID.ps1 DOMAIN\user_account1 DOMAIN\machine_account1$ DOMAIN\user_account2 | Format-List
-    ```
-
-    ``` syntax
-    .EXAMPLE
-    ```
-
-    ``` syntax
-    $accountsArray = @("DOMAIN\user_account1", "DOMAIN\machine_account1$", "DOMAIN_user_account2")
-    ```
-
-    ``` syntax
-    .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200
-    ```
-
-    ``` syntax
-#>
-    ```
-
-    ``` syntax
-    ```
-
-    []()  
-
-    []()  
-
-    ``` syntax
-    function ConvertSIDToHexFormat
-    ```
-
-    {
-
-       param(\[System.Security.Principal.SecurityIdentifier\]$sidToConvert)
-
-    ``` syntax
-    ```
-
-    ``` syntax
-       $sb = New-Object System.Text.StringBuilder
-    ```
-
-    ``` syntax
-        [int] $binLength = $sidToConvert.BinaryLength
-    ```
-
-    ``` syntax
-        [Byte[]] $byteArray = New-Object Byte[] $binLength
-    ```
-
-    ``` syntax
-       $sidToConvert.GetBinaryForm($byteArray, 0)
-    ```
-
-    ``` syntax
-       foreach($byte in $byteArray)
-    ```
-
-    ``` syntax
-       {
-    ```
-
-    ``` syntax
-       $sb.Append($byte.ToString("X2")) |Out-Null
-    ```
-
-    ``` syntax
-       }
-    ```
-
-    ``` syntax
-       return $sb.ToString()
-    ```
-
-    ``` syntax
-    }
-    ```
-
-    ``` syntax
-     [string[]]$myArgs = $args
-    ```
-
-    ``` syntax
-    if(($myArgs.Length -lt 1) -or ($myArgs[0].CompareTo("/?") -eq 0))
-    ```
-
-    {
-
-    ``` syntax
-     [string]::Format("{0}====== Description ======{0}{0}" +
-    ```
-
-    ``` syntax
-    "  Converts any number of user or machine account names to string and hexadecimal SIDs.{0}" +
-    ```
-
-    ``` syntax
-                   "  Pass the account(s) as space separated command line parameters. (For example 'ConvertToSID.exe DOMAIN\\Account1 DOMAIN\\Account2 ...'){0}" +
-    ```
-
-    ``` syntax
-                   "  The output is written to the console in the format 'Account name    SID as string   SID as hexadecimal'{0}" +
-    ```
-
-    ``` syntax
-                   "  And can be written out to a file using standard PowerShell redirection{0}" +
-    ```
-
-    ``` syntax
-                   "  Please specify user accounts in the format 'DOMAIN\username'{0}" + 
-    ```
-
-    ``` syntax
-                   "  Please specify machine accounts in the format 'DOMAIN\machinename$'{0}" +
-    ```
-
-    ``` syntax
-                   "  For more help content, please run 'Get-Help ConvertToSID.ps1'{0}" + 
-    ```
-
-    ``` syntax
-                   "{0}====== Arguments ======{0}" +
-    ```
-
-    ``` syntax
-                   "{0}  /?    Show this help message", [Environment]::NewLine) 
-    ```
-
-    ``` syntax
-    {
-    ```
-
-    ``` syntax
-    else
-    ```
-
-    ``` syntax
-    {  
-        #If an array was passed in, try to split it
-    ```
-
-    ``` syntax
-        if($myArgs.Length -eq 1)
-    ```
-
-    ``` syntax
-        {
-    ```
-
-    ``` syntax
-            $myArgs = $myArgs.Split(' ')
-    ```
-
-    ``` syntax
-        }
-    ```
-
-    ``` syntax
-
-        #Parse the arguments for account names
-    ```
-
-    ``` syntax
-        foreach($accountName in $myArgs)
-    ```
-
-    ``` syntax
-        {    
-    ```
-
-    ``` syntax
-            [string[]] $splitString = $accountName.Split('\')  # We're looking for the format "DOMAIN\Account" so anything that does not match, we reject
-    ```
-
-    ``` syntax
-            if($splitString.Length -ne 2)
-    ```
-
-    ``` syntax
-            {
-    ```
-
-    ``` syntax
-                $message = [string]::Format("{0} is not a valid account name. Expected format 'Domain\username' for user accounts or 'DOMAIN\machinename$' for machine accounts.", $accountName)
-    ```
-
-    ``` syntax
-                Write-Error -Message $message
-    ```
-
-    ``` syntax
-                continue
-    ```
-
-    ``` syntax
-            }
-    ```
-
-    ``` syntax
-            
-    ```
-
-    ``` syntax
-            #Convert any account names to SIDs
-    ```
-
-    ``` syntax
-            try
-    ```
-
-    ``` syntax
-            {
-    ```
-
-    ``` syntax
-                [System.Security.Principal.NTAccount] $account = New-Object System.Security.Principal.NTAccount($splitString[0], $splitString[1])
-    ```
-
-    ``` syntax
-                [System.Security.Principal.SecurityIdentifier] $SID = [System.Security.Principal.SecurityIdentifier]($account.Translate([System.Security.Principal.SecurityIdentifier]))
-    ```
-
-    ``` syntax
-            }
-    ```
-
-    ``` syntax
-            catch [System.Security.Principal.IdentityNotMappedException]
-    ```
-
-    ``` syntax
-            {
-    ```
-
-    ``` syntax
-                $message = [string]::Format("Failed to translate account object '{0}' to a SID. Please verify that this is a valid user or machine account.", $account.ToString())
-    ```
-
-    ``` syntax
-                Write-Error -Message $message
-    ```
-
-    ``` syntax
-                continue
-    ```
-
-    ``` syntax
-            }
-    ```
-
-    ``` syntax
-
-            #Convert regular SID to binary format used by SQL
-    ```
-
-    ``` syntax
-            $hexSIDString = ConvertSIDToHexFormat $SID
-    ```
-
-    ``` syntax
-            
-            $SIDs = New-Object PSObject
-    ```
-
-    ``` syntax
-            $SIDs | Add-Member NoteProperty Account $accountName
-    ```
-
-    ``` syntax
-            $SIDs | Add-Member NoteProperty SID $SID.ToString()
-    ```
-
-    ``` syntax
-            $SIDs | Add-Member NoteProperty Hexadecimal $hexSIDString
-    ```
-
-    ``` syntax
-
-            Write-Output $SIDs
-    ```
-
-    ``` syntax
-        }
-    ```
-
-    ``` syntax
-    }
-    ```
-
-3.  Run the script you saved in step one of this procedure passing the accounts to convert as arguments.
-
-    For example,
-
-    **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List” or “$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")**
-
-    **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200”**
-
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+1. Copy the following script into a text editor and save it as a PowerShell script file, for example **ConvertToSIDs.ps1**.
+
+2. To open a PowerShell console click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**.
+
+   ```powershell
+   <#
+   .SYNOPSIS
+   This PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats.
+   .DESCRIPTION
+   This is a PowerShell script that converts any number of Active Directory (AD) user or machine accounts into formatted Security Identifiers (SIDs) both in the standard format and in the hexadecimal format used by SQL server when running SQL scripts.
+   .INPUTS
+   The account(s) to convert to SID format. This can be a single account name or an array of account names. Please see examples below.
+   .OUTPUTS
+   A list of account names with the corresponding SID in standard and hexadecimal formats
+   .EXAMPLE
+   .\ConvertToSID.ps1 DOMAIN\user_account1 DOMAIN\machine_account1$ DOMAIN\user_account2 | Format-List
+   .EXAMPLE
+   $accountsArray = @("DOMAIN\user_account1", "DOMAIN\machine_account1$", "DOMAIN_user_account2")
+   .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200
+   #>
+
+   function ConvertSIDToHexFormat
+   {
+
+      param(\[System.Security.Principal.SecurityIdentifier\]$sidToConvert)
+
+      $sb = New-Object System.Text.StringBuilder
+      [int] $binLength = $sidToConvert.BinaryLength
+      [Byte[]] $byteArray = New-Object Byte[] $binLength
+      $sidToConvert.GetBinaryForm($byteArray, 0)
+      foreach($byte in $byteArray)
+      {
+          $sb.Append($byte.ToString("X2")) |Out-Null
+      }
+      return $sb.ToString()
+   }
+    [string[]]$myArgs = $args
+   if(($myArgs.Length -lt 1) -or ($myArgs[0].CompareTo("/?") -eq 0))
+   {
+
+    [string]::Format("{0}====== Description ======{0}{0}" +
+                  "  Converts any number of user or machine account names to string and hexadecimal SIDs.{0}" +
+                  "  Pass the account(s) as space separated command line parameters. (For example 'ConvertToSID.exe DOMAIN\\Account1 DOMAIN\\Account2 ...'){0}" +
+                  "  The output is written to the console in the format 'Account name    SID as string   SID as hexadecimal'{0}" +
+                  "  And can be written out to a file using standard PowerShell redirection{0}" +
+                  "  Please specify user accounts in the format 'DOMAIN\username'{0}" +
+                  "  Please specify machine accounts in the format 'DOMAIN\machinename$'{0}" +
+                  "  For more help content, please run 'Get-Help ConvertToSID.ps1'{0}" +
+                  "{0}====== Arguments ======{0}" +
+                  "{0}  /?    Show this help message", [Environment]::NewLine)
+   }
+   else
+   {
+       #If an array was passed in, try to split it
+       if($myArgs.Length -eq 1)
+       {
+           $myArgs = $myArgs.Split(' ')
+       }
+
+       #Parse the arguments for account names
+       foreach($accountName in $myArgs)
+       {
+           [string[]] $splitString = $accountName.Split('\')  # We're looking for the format "DOMAIN\Account" so anything that does not match, we reject
+           if($splitString.Length -ne 2)
+           {
+               $message = [string]::Format("{0} is not a valid account name. Expected format 'Domain\username' for user accounts or 'DOMAIN\machinename$' for machine accounts.", $accountName)
+               Write-Error -Message $message
+               continue
+           }
+
+           #Convert any account names to SIDs
+           try
+           {
+               [System.Security.Principal.NTAccount] $account = New-Object System.Security.Principal.NTAccount($splitString[0], $splitString[1])
+               [System.Security.Principal.SecurityIdentifier] $SID = [System.Security.Principal.SecurityIdentifier]($account.Translate([System.Security.Principal.SecurityIdentifier]))
+           }
+           catch [System.Security.Principal.IdentityNotMappedException]
+           {
+               $message = [string]::Format("Failed to translate account object '{0}' to a SID. Please verify that this is a valid user or machine account.", $account.ToString())
+               Write-Error -Message $message
+               continue
+           }
+
+           #Convert regular SID to binary format used by SQL
+           $hexSIDString = ConvertSIDToHexFormat $SID
+
+           $SIDs = New-Object PSObject
+           $SIDs | Add-Member NoteProperty Account $accountName
+           $SIDs | Add-Member NoteProperty SID $SID.ToString()
+           $SIDs | Add-Member NoteProperty Hexadecimal $hexSIDString
+
+           Write-Output $SIDs
+       }
+   }
+3. Run the script you saved in step one of this procedure passing the accounts to convert as arguments.
+
+   For example,
+
+   **.\\ConvertToSID.ps1 DOMAIN\\user\_account1 DOMAIN\\machine\_account1$ DOMAIN\\user\_account2 | Format-List” or “$accountsArray = @("DOMAIN\\user\_account1", "DOMAIN\\machine\_account1$", "DOMAIN\_user\_account2")**
+
+   **.\\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\\SIDs.txt -Width 200”**
+
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md)
-
- 
-
- 
-
-
-
-
-
diff --git a/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md b/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md
index 9add857c73..924e89d919 100644
--- a/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md
+++ b/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services.md
@@ -1,8 +1,11 @@
 ---
 title: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services
 description: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services
-author: jamiejdt
+author: dansimp
 ms.assetid: 02afd6d6-4c33-4c0b-bd88-ae167b786fdf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail.
 
-**Note**  
+**Note**  
 After you complete the deployment, the **Microsoft SQL Server name**, **instance name** and **database name** will be required by the administrator installing the service to be able to connect to these databases.
 
- 
+
 
 **To install the management database and the management server on separate computers**
 
@@ -41,14 +44,16 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance
 
 7.  On the next **Create New Management Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**.
 
-    **Note**  
+    **Note**  
     If you plan to deploy the management server on the same computer you must select **Use this local computer**.
 
-     
 
-    Specify the user name for the management server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**.
 
-8.  To start the installation, click **Install**.
+~~~
+Specify the user name for the management server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**.
+~~~
+
+8. To start the installation, click **Install**.
 
 **To install the reporting database and the reporting server on separate computers**
 
@@ -70,14 +75,16 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance
 
 7.  On the next **Create New Reporting Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**.
 
-    **Note**  
+    **Note**  
     If you plan to deploy the reporting server on the same computer you must select **Use this local computer**.
 
-     
 
-    Specify the user name for the reporting server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**.
 
-8.  To start the installation, click **Install**.
+~~~
+Specify the user name for the reporting server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**.
+~~~
+
+8. To start the installation, click **Install**.
 
 **To install the management and reporting databases using App-V 5.0 database scripts**
 
@@ -95,23 +102,23 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance
 
 4.  For each database, copy the scripts to a share and modify them following the instructions in the readme file.
 
-    **Note**  
+    **Note**  
     For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell.md).
 
-     
+
 
 5.  Run the scripts on the computer running Microsoft SQL Server.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Deploying App-V 5.0](deploying-app-v-50.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md b/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md
index b1b3b394b9..77c7a3fd6a 100644
--- a/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md
+++ b/mdop/appv-v5/how-to-install-the-management-and-reporting-databases-on-separate-computers-from-the-management-and-reporting-services51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services
 description: How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services
-author: jamiejdt
+author: dansimp
 ms.assetid: 2a67402e-3119-40ea-a247-24d166af1ced
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 Use the following procedure to install the database server and management server on different computers. The computer you plan to install the database server on must be running a supported version of Microsoft SQL or the installation will fail.
 
-**Note**  
+**Note**  
 After you complete the deployment, the **Microsoft SQL Server name**, **instance name** and **database name** will be required by the administrator installing the service to be able to connect to these databases.
 
- 
+
 
 **To install the management database and the management server on separate computers**
 
@@ -41,14 +44,16 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance
 
 7.  On the next **Create New Management Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**.
 
-    **Note**  
+    **Note**  
     If you plan to deploy the management server on the same computer you must select **Use this local computer**.
 
-     
 
-    Specify the user name for the management server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**.
 
-8.  To start the installation, click **Install**.
+~~~
+Specify the user name for the management server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**.
+~~~
+
+8. To start the installation, click **Install**.
 
 **To install the reporting database and the reporting server on separate computers**
 
@@ -70,14 +75,16 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance
 
 7.  On the next **Create New Reporting Server Database** page, select **Use a remote computer**, and type the remote machine account using the following format: **Domain\\MachineAccount**.
 
-    **Note**  
+    **Note**  
     If you plan to deploy the reporting server on the same computer you must select **Use this local computer**.
 
-     
 
-    Specify the user name for the reporting server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**.
 
-8.  To start the installation, click **Install**.
+~~~
+Specify the user name for the reporting server **Install Administrator** using the following format: **Domain\\AdministratorLoginName**. Click **Next**.
+~~~
+
+8. To start the installation, click **Install**.
 
 **To install the management and reporting databases using App-V 5.1 database scripts**
 
@@ -95,10 +102,10 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance
 
 4.  For each database, copy the scripts to a share and modify them following the instructions in the readme file.
 
-    **Note**  
+    **Note**  
     For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using PowerShell](how-to-install-the-app-v-databases-and-convert-the-associated-security-identifiers--by-using-powershell51.md).
 
-     
+
 
 5.  Run the scripts on the computer running Microsoft SQL Server.
 
@@ -109,9 +116,9 @@ After you complete the deployment, the **Microsoft SQL Server name**, **instance
 
 [Deploying App-V 5.1](deploying-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md b/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md
index 24cf9266b8..c27949ba3d 100644
--- a/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md
+++ b/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md
@@ -1,8 +1,11 @@
 ---
 title: How to install the Management Server on a Standalone Computer and Connect it to the Database
 description: How to install the Management Server on a Standalone Computer and Connect it to the Database
-author: jamiejdt
+author: dansimp
 ms.assetid: 95281287-cb56-4117-befd-854268ea147c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -30,33 +33,35 @@ Use the following procedure to install the management server on a standalone com
 
 6.  On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL SQL, for example **SqlServerMachine**.
 
-    **Note**  
+    **Note**  
     If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**.
 
-     
 
-    For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance.
 
-    Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**.
+~~~
+For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance.
 
-7.  On the **Configure Management Server Configuration** page, specify the AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation
+Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**.
+~~~
 
-    Specify the **Website Name** that you want to use for the management service. Accept the default if you do not have a custom name. For the **Port Binding**, specify a unique port number to be used, for example **12345**.
+7. On the **Configure Management Server Configuration** page, specify the AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation
 
-8.  Click **Install**.
+   Specify the **Website Name** that you want to use for the management service. Accept the default if you do not have a custom name. For the **Port Binding**, specify a unique port number to be used, for example **12345**.
 
-9.  To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console.html if the installation was successful you should see the **Silverlight Management Console** appear without any error messages or warnings being displayed.
+8. Click **Install**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+9. To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console.html if the installation was successful you should see the **Silverlight Management Console** appear without any error messages or warnings being displayed.
+
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Deploying App-V 5.0](deploying-app-v-50.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md b/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md
index 9b6f45ddf2..988a91b3ff 100644
--- a/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md
+++ b/mdop/appv-v5/how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database51.md
@@ -1,8 +1,11 @@
 ---
 title: How to install the Management Server on a Standalone Computer and Connect it to the Database
 description: How to install the Management Server on a Standalone Computer and Connect it to the Database
-author: jamiejdt
+author: dansimp
 ms.assetid: 3f83c335-d976-4abd-b8f8-d7f5e50b4318
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -30,33 +33,35 @@ Use the following procedure to install the management server on a standalone com
 
 6.  On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL SQL, for example **SqlServerMachine**.
 
-    **Note**  
+    **Note**  
     If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**.
 
-     
 
-    For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance.
 
-    Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**.
+~~~
+For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance.
 
-7.  On the **Configure Management Server Configuration** page, specify the AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation
+Specify the **SQL Server Database name** that this management server will use, for example **AppvManagement**.
+~~~
 
-    Specify the **Website Name** that you want to use for the management service. Accept the default if you do not have a custom name. For the **Port Binding**, specify a unique port number to be used, for example **12345**.
+7. On the **Configure Management Server Configuration** page, specify the AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation
 
-8.  Click **Install**.
+   Specify the **Website Name** that you want to use for the management service. Accept the default if you do not have a custom name. For the **Port Binding**, specify a unique port number to be used, for example **12345**.
 
-9.  To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings being displayed.
+8. Click **Install**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+9. To confirm that the setup has completed successfully, open a web browser, and type the following URL: http://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings being displayed.
+
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Deploying App-V 5.1](deploying-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md
index f82ddf86a2..ee45693fca 100644
--- a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md
+++ b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer.md
@@ -1,8 +1,11 @@
 ---
 title: How to Install the Publishing Server on a Remote Computer
 description: How to Install the Publishing Server on a Remote Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: 37970706-54ff-4799-9485-b9b49fd50f37
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -18,62 +21,57 @@ Use the following procedure to install the publishing server on a separate compu
 
 **To install the publishing server on a separate computer**
 
-1.  Copy the App-V 5.0 server installation files to the computer on which you want to install it on. To start the App-V 5.0 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**.
+1. Copy the App-V 5.0 server installation files to the computer on which you want to install it on. To start the App-V 5.0 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**.
 
-2.  On the **Getting Started** page, review and accept the license terms, and click **Next**.
+2. On the **Getting Started** page, review and accept the license terms, and click **Next**.
 
-3.  On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**.
+3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**.
 
-4.  On the **Feature Selection** page, select the **Publishing Server** checkbox and click **Next**.
+4. On the **Feature Selection** page, select the **Publishing Server** checkbox and click **Next**.
 
-5.  On the **Installation Location** page, accept the default location and click **Next**.
+5. On the **Installation Location** page, accept the default location and click **Next**.
 
-6.  On the **Configure Publishing Server Configuration** page, specify the following items:
+6. On the **Configure Publishing Server Configuration** page, specify the following items:
 
-    -   The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**.
+   -   The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**.
 
-    -   Specify the website name that you want to use for the publishing service. Accept the default if you do not have a custom name.
+   -   Specify the website name that you want to use for the publishing service. Accept the default if you do not have a custom name.
 
-    -   For the **Port Binding**, specify a unique port number that will be used by App-V 5.0, for example **54321**.
+   -   For the **Port Binding**, specify a unique port number that will be used by App-V 5.0, for example **54321**.
 
-7.  On the **Ready to Install** page, click **Install**.
+7. On the **Ready to Install** page, click **Install**.
 
-8.  After the installation is complete, the publishing server must be registered with the management server. In the App-V 5.0 management console, use the following steps to register the server:
+8. After the installation is complete, the publishing server must be registered with the management server. In the App-V 5.0 management console, use the following steps to register the server:
 
-    1.  Open the App-V 5.0 management server console.
+   1.  Open the App-V 5.0 management server console.
 
-    2.  In the left pane, select **Servers**, and then select **Register New Server**.
+   2.  In the left pane, select **Servers**, and then select **Register New Server**.
 
-    3.  Type the name of this server and a description (if required) and click **Add**.
+   3.  Type the name of this server and a description (if required) and click **Add**.
 
-9.  To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: **http://publishingserver:pubport**. If the server is running correctly information similar to the following will be displayed:
+9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: http://publishingserver:pubport. If the server is running correctly information similar to the following will be displayed:
 
-    ``
+   ```xml
+   
+     
+       
+     
+     
+       
+     
+   
+   ```
 
-    `  `
-
-    `  `
-
-    `  `
-
-    `  `
-
-    `  `
-
-    `  `
-
-    ``
-
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Deploying App-V 5.0](deploying-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md
index 36ac999bb7..c9ed253251 100644
--- a/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md
+++ b/mdop/appv-v5/how-to-install-the-publishing-server-on-a-remote-computer51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Install the Publishing Server on a Remote Computer
 description: How to Install the Publishing Server on a Remote Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: 1c903f78-0558-458d-a149-d5f6fb55aefb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -18,62 +21,57 @@ Use the following procedure to install the publishing server on a separate compu
 
 **To install the publishing server on a separate computer**
 
-1.  Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**.
+1. Copy the App-V 5.1 server installation files to the computer on which you want to install it on. To start the App-V 5.1 server installation right-click and run **appv\_server\_setup.exe** as an administrator. Click **Install**.
 
-2.  On the **Getting Started** page, review and accept the license terms, and click **Next**.
+2. On the **Getting Started** page, review and accept the license terms, and click **Next**.
 
-3.  On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**.
+3. On the **Use Microsoft Update to help keep your computer secure and up-to-date** page, to enable Microsoft updates, select **Use Microsoft Update when I check for updates (recommended).** To disable Microsoft updates, select **I don’t want to use Microsoft Update**. Click **Next**.
 
-4.  On the **Feature Selection** page, select the **Publishing Server** checkbox and click **Next**.
+4. On the **Feature Selection** page, select the **Publishing Server** checkbox and click **Next**.
 
-5.  On the **Installation Location** page, accept the default location and click **Next**.
+5. On the **Installation Location** page, accept the default location and click **Next**.
 
-6.  On the **Configure Publishing Server Configuration** page, specify the following items:
+6. On the **Configure Publishing Server Configuration** page, specify the following items:
 
-    -   The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**.
+   -   The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**.
 
-    -   Specify the website name that you want to use for the publishing service. Accept the default if you do not have a custom name.
+   -   Specify the website name that you want to use for the publishing service. Accept the default if you do not have a custom name.
 
-    -   For the **Port Binding**, specify a unique port number that will be used by App-V 5.1, for example **54321**.
+   -   For the **Port Binding**, specify a unique port number that will be used by App-V 5.1, for example **54321**.
 
-7.  On the **Ready to Install** page, click **Install**.
+7. On the **Ready to Install** page, click **Install**.
 
-8.  After the installation is complete, the publishing server must be registered with the management server. In the App-V 5.1 management console, use the following steps to register the server:
+8. After the installation is complete, the publishing server must be registered with the management server. In the App-V 5.1 management console, use the following steps to register the server:
 
-    1.  Open the App-V 5.1 management server console.
+   1.  Open the App-V 5.1 management server console.
 
-    2.  In the left pane, select **Servers**, and then select **Register New Server**.
+   2.  In the left pane, select **Servers**, and then select **Register New Server**.
 
-    3.  Type the name of this server and a description (if required) and click **Add**.
+   3.  Type the name of this server and a description (if required) and click **Add**.
 
-9.  To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: **http://publishingserver:pubport**. If the server is running correctly information similar to the following will be displayed:
+9. To verify if the publishing server is running correctly, you should import a package to the management server, entitle the package to an AD group, and publish the package. Using an internet browser, open the following URL: http://publishingserver:pubport. If the server is running correctly information similar to the following will be displayed:
 
-    ``
+   ```xml
+   
+     
+       
+     
+     
+       
+     
+   
+   ```
 
-    `  `
-
-    `  `
-
-    `  `
-
-    `  `
-
-    `  `
-
-    `  `
-
-    ``
-
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Deploying App-V 5.1](deploying-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md b/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md
index 00465edd97..4285fdefd0 100644
--- a/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md
+++ b/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database.md
@@ -1,8 +1,11 @@
 ---
 title: How to install the Reporting Server on a Standalone Computer and Connect it to the Database
 description: How to install the Reporting Server on a Standalone Computer and Connect it to the Database
-author: jamiejdt
+author: dansimp
 ms.assetid: d186bdb7-e522-4124-bc6d-7d5a41ba8266
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 Use the following procedure to install the reporting server on a standalone computer and connect it to the database.
 
-**Important**  
+**Important**  
 Before performing the following procedure you should read and understand [About App-V 5.0 Reporting](about-app-v-50-reporting.md).
 
- 
+
 
 **To install the reporting server on a standalone computer and connect it to the database**
 
@@ -35,24 +38,26 @@ Before performing the following procedure you should read and understand [About
 
 6.  On the **Configure Existing Reporting Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL Server, for example **SqlServerMachine**.
 
-    **Note**  
+    **Note**  
     If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**.
 
-     
 
-    For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance.
 
-    Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**.
+~~~
+For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance.
 
-7.  On the **Configure Reporting Server Configuration** page.
+Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**.
+~~~
 
-    -   Specify the Website Name that you want to use for the Reporting Service. Leave the default unchanged if you do not have a custom name.
+7. On the **Configure Reporting Server Configuration** page.
 
-    -   For the **Port binding**, specify a unique port number that will be used by App-V 5.0, for example **55555**. You should also ensure that the port specified is not being used by another website.
+   -   Specify the Website Name that you want to use for the Reporting Service. Leave the default unchanged if you do not have a custom name.
 
-8.  Click **Install**.
+   -   For the **Port binding**, specify a unique port number that will be used by App-V 5.0, for example **55555**. You should also ensure that the port specified is not being used by another website.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+8. Click **Install**.
+
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
@@ -63,9 +68,9 @@ Before performing the following procedure you should read and understand [About
 
 [How to Enable Reporting on the App-V 5.0 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-50-client-by-using-powershell.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md b/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md
index c8b4f8739e..4d6223aabf 100644
--- a/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md
+++ b/mdop/appv-v5/how-to-install-the-reporting-server-on-a-standalone-computer-and-connect-it-to-the-database51.md
@@ -1,8 +1,11 @@
 ---
 title: How to install the Reporting Server on a Standalone Computer and Connect it to the Database
 description: How to install the Reporting Server on a Standalone Computer and Connect it to the Database
-author: jamiejdt
+author: dansimp
 ms.assetid: 11f07750-4045-4c8d-a583-7d70c9e9aa7b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 Use the following procedure to install the reporting server on a standalone computer and connect it to the database.
 
-**Important**  
+**Important**  
 Before performing the following procedure you should read and understand [About App-V 5.1 Reporting](about-app-v-51-reporting.md).
 
- 
+
 
 **To install the reporting server on a standalone computer and connect it to the database**
 
@@ -35,24 +38,26 @@ Before performing the following procedure you should read and understand [About
 
 6.  On the **Configure Existing Reporting Database** page, select **Use a remote SQL Server**, and type the machine name of the computer running Microsoft SQL Server, for example **SqlServerMachine**.
 
-    **Note**  
+    **Note**  
     If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**.
 
-     
 
-    For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance.
 
-    Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**.
+~~~
+For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance** and then type the name of the instance.
 
-7.  On the **Configure Reporting Server Configuration** page.
+Specify the **SQL Server Database name** that this reporting server will use, for example **AppvReporting**.
+~~~
 
-    -   Specify the Website Name that you want to use for the Reporting Service. Leave the default unchanged if you do not have a custom name.
+7. On the **Configure Reporting Server Configuration** page.
 
-    -   For the **Port binding**, specify a unique port number that will be used by App-V 5.1, for example **55555**. You should also ensure that the port specified is not being used by another website.
+   -   Specify the Website Name that you want to use for the Reporting Service. Leave the default unchanged if you do not have a custom name.
 
-8.  Click **Install**.
+   -   For the **Port binding**, specify a unique port number that will be used by App-V 5.1, for example **55555**. You should also ensure that the port specified is not being used by another website.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+8. Click **Install**.
+
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
@@ -63,9 +68,9 @@ Before performing the following procedure you should read and understand [About
 
 [How to Enable Reporting on the App-V 5.1 Client by Using PowerShell](how-to-enable-reporting-on-the-app-v-51-client-by-using-powershell.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-install-the-sequencer-51beta-gb18030.md b/mdop/appv-v5/how-to-install-the-sequencer-51beta-gb18030.md
index b4a5e6540a..dac6a4e3dc 100644
--- a/mdop/appv-v5/how-to-install-the-sequencer-51beta-gb18030.md
+++ b/mdop/appv-v5/how-to-install-the-sequencer-51beta-gb18030.md
@@ -1,8 +1,11 @@
 ---
 title: How to Install the Sequencer
 description: How to Install the Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: 5e8f1696-9bc0-4f44-8cb7-b809b2daae10
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -21,7 +24,7 @@ Upgrading a previous installation of the App-V sequencer is not supported.
 **Important**  
 For a full list of the sequencer requirements see sequencer sections of [App-V 5.1 Prerequisites](app-v-51-prerequisites.md) and [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md).
 
- 
+ 
 
 You can also use the command line to install the App-V 5.1 sequencer. The following list displays information about options for installing the sequencer using the command line and **appv\_sequencer\_setup.exe**:
 
@@ -76,7 +79,7 @@ You can also use the command line to install the App-V 5.1 sequencer. The follow
 
 
 
- 
+ 
 
 **To install the App-V 5.1 sequencer**
 
@@ -101,9 +104,9 @@ You can also use the command line to install the App-V 5.1 sequencer. The follow
 
 [Planning to Deploy App-V](planning-to-deploy-app-v51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-install-the-sequencer-beta-gb18030.md b/mdop/appv-v5/how-to-install-the-sequencer-beta-gb18030.md
index fdab9d8ec3..c02d94ec51 100644
--- a/mdop/appv-v5/how-to-install-the-sequencer-beta-gb18030.md
+++ b/mdop/appv-v5/how-to-install-the-sequencer-beta-gb18030.md
@@ -1,8 +1,11 @@
 ---
 title: How to Install the Sequencer
 description: How to Install the Sequencer
-author: jamiejdt
+author: dansimp
 ms.assetid: a122caf0-f408-458c-b119-dc84123c1d58
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -21,7 +24,7 @@ Upgrading a previous installation of the App-V sequencer is not supported.
 **Important**  
 For a full list of the sequencer requirements see sequencer sections of [App-V 5.0 Prerequisites](app-v-50-prerequisites.md) and [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md).
 
- 
+ 
 
 You can also use the command line to install the App-V 5.0 sequencer. The following list displays information about options for installing the sequencer using the command line and **appv\_sequencer\_setup.exe**:
 
@@ -76,7 +79,7 @@ You can also use the command line to install the App-V 5.0 sequencer. The follow
 
 
 
- 
+ 
 
 **To install the App-V 5.0 sequencer**
 
@@ -94,16 +97,16 @@ You can also use the command line to install the App-V 5.0 sequencer. The follow
 
 -   For more information regarding the sequencer installation, you can view the error log in the **%temp%** folder. To review the log files, click **Start**, type **%temp%**, and then look for the **appv\_ log**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Planning to Deploy App-V](planning-to-deploy-app-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md b/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md
index c552e9a3a8..e24a590f0a 100644
--- a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md
+++ b/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-50-sp3.md
@@ -1,8 +1,11 @@
 ---
 title: How to Load the PowerShell Cmdlets and Get Cmdlet Help
 description: How to Load the PowerShell Cmdlets and Get Cmdlet Help
-author: jamiejdt
+author: dansimp
 ms.assetid: 0624495b-943e-485b-9e54-b50e4ee6591c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -45,9 +48,9 @@ Review the following requirements for using the App-V PowerShell cmdlets:
 
    Users can run App-V Server cmdlets only if you grant them access by using one of the following methods:
    
 
      
 
    • When you are deploying and configuring the App-V Server:
      
-
      Specify an Active Directory group or individual user that has permissions to manage the App-V environment. See [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md).
      • 
+
      Specify an Active Directory group or individual user that has permissions to manage the App-V environment. See How to Deploy the App-V 5.0 Server.
      
 
    • After you’ve deployed the App-V Server:
      
-
      Use the App-V Management console to add an additional Active Directory group or user. See [How to Add or Remove an Administrator by Using the Management Console](how-to-add-or-remove-an-administrator-by-using-the-management-console.md).
      • 
+
      Use the App-V Management console to add an additional Active Directory group or user. See How to Add or Remove an Administrator by Using the Management Console.
      
 
    
 
 
@@ -88,13 +91,13 @@ Review the following requirements for using the App-V PowerShell cmdlets:
 
 
    Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.
    
 
 
 
 
    Enable the “Require publish as administrator” Group Policy setting for App-V Clients.
    
-
    [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md) 
    
+
    How to Publish a Package by Using the Management Console 
    
 
 
 
@@ -103,7 +106,7 @@ Review the following requirements for using the App-V PowerShell cmdlets:
 
 
 
- 
+ 
 
 ## Loading the PowerShell cmdlets
 To load the PowerShell cmdlet modules:
@@ -139,7 +142,7 @@ To load the PowerShell cmdlet modules:
 
 
 
- 
+ 
 
 ## Getting help for the PowerShell cmdlets
 Starting in App-V 5.0 SP3, cmdlet help is available in two formats:
@@ -193,12 +196,12 @@ Starting in App-V 5.0 SP3, cmdlet help is available in two formats:
 
 
 
    On TechNet as web pages
    
-
    See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://technet.microsoft.com/library/dn520245.aspx).
    
+
    See the App-V node under Microsoft Desktop Optimization Pack Automation with Windows PowerShell.
    
 
 
 
 
- 
+ 
 
 ## Displaying the help for a PowerShell cmdlet
 To display help for a specific PowerShell cmdlet:
@@ -209,9 +212,9 @@ To display help for a specific PowerShell cmdlet:
 
 **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue**? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md b/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md
index 253c7dc664..c8f34160ab 100644
--- a/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md
+++ b/mdop/appv-v5/how-to-load-the-powershell-cmdlets-and-get-cmdlet-help-51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Load the PowerShell Cmdlets and Get Cmdlet Help
 description: How to Load the PowerShell Cmdlets and Get Cmdlet Help
-author: jamiejdt
+author: dansimp
 ms.assetid: b6ae5460-2c3a-4030-b132-394d9d5a541e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -45,9 +48,9 @@ Review the following requirements for using the App-V PowerShell cmdlets:
 
    Users can run App-V Server cmdlets only if you grant them access by using one of the following methods:
    
 
      
 
    • When you are deploying and configuring the App-V Server:
      
-
      Specify an Active Directory group or individual user that has permissions to manage the App-V environment. See [How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md).
      • 
+
      Specify an Active Directory group or individual user that has permissions to manage the App-V environment. See How to Deploy the App-V 5.1 Server.
      
 
    • After you’ve deployed the App-V Server:
      
-
      Use the App-V Management console to add an additional Active Directory group or user. See [How to Add or Remove an Administrator by Using the Management Console](how-to-add-or-remove-an-administrator-by-using-the-management-console51.md).
      • 
+
      Use the App-V Management console to add an additional Active Directory group or user. See How to Add or Remove an Administrator by Using the Management Console.
      
 
    
 
 
@@ -88,13 +91,13 @@ Review the following requirements for using the App-V PowerShell cmdlets:
 
 
    Run the Set-AppvClientConfiguration cmdlet with the -RequirePublishAsAdmin parameter.
    
 
 
 
 
    Enable the “Require publish as administrator” Group Policy setting for App-V Clients.
    
-
    [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-51.md)
    
+
    How to Publish a Package by Using the Management Console
    
 
 
 
@@ -103,7 +106,7 @@ Review the following requirements for using the App-V PowerShell cmdlets:
 
 
 
- 
+ 
 
 ## Loading the PowerShell cmdlets
 
@@ -192,7 +195,7 @@ Starting in App-V 5.0 SP3, cmdlet help is available in two formats:
 
 
 
    On TechNet as web pages
    
-
    See the App-V node under [Microsoft Desktop Optimization Pack Automation with Windows PowerShell](https://technet.microsoft.com/library/dn520245.aspx).
    
+
    See the App-V node under Microsoft Desktop Optimization Pack Automation with Windows PowerShell.
    
 
 
 
@@ -206,9 +209,9 @@ To display help for a specific PowerShell cmdlet:
 
 **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version.md b/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version.md
index ab28dd48a0..5cfa258188 100644
--- a/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version.md
+++ b/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version.md
@@ -1,8 +1,11 @@
 ---
 title: How to Make a Connection Group Ignore the Package Version
 description: How to Make a Connection Group Ignore the Package Version
-author: jamiejdt
+author: dansimp
 ms.assetid: 6ebc1bff-d190-4f4c-a6da-e09a4cca7874
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -58,7 +61,7 @@ To upgrade a package in earlier versions of App-V, you had to perform several st
 
  • Click EDIT in the CONNECTED PACKAGES pane.
    • 
 
  • Select Use Any Version check box next to the package name, and click Apply.
    • 
 
-
    For more about adding or upgrading packages, see [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-beta-gb18030.md).
    
+
    For more about adding or upgrading packages, see How to Add or Upgrade Packages by Using the Management Console.
    
 
 
 
    App-V Client on a Stand-alone computer
    
@@ -76,8 +79,8 @@ To upgrade a package in earlier versions of App-V, you had to perform several st
 
 
    For more information, see:
    
 
 
 
@@ -87,7 +90,7 @@ To upgrade a package in earlier versions of App-V, you had to perform several st
 
 
 
- 
+ 
 
 
 
@@ -99,9 +102,9 @@ To upgrade a package in earlier versions of App-V, you had to perform several st
 
 [Managing Connection Groups](managing-connection-groups.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version51.md b/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version51.md
index 13df4fafc6..dd0494ceee 100644
--- a/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version51.md
+++ b/mdop/appv-v5/how-to-make-a-connection-group-ignore-the-package-version51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Make a Connection Group Ignore the Package Version
 description: How to Make a Connection Group Ignore the Package Version
-author: jamiejdt
+author: dansimp
 ms.assetid: db16b095-dbe2-42c7-863d-b0d5d91b2f4c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -58,7 +61,7 @@ To upgrade a package in some earlier versions of App-V, you had to perform sever
 
  • Click EDIT in the CONNECTED PACKAGES pane.
    • 
 
  • Select Use Any Version check box next to the package name, and click Apply.
    • 
 
-
    For more about adding or upgrading packages, see [How to Add or Upgrade Packages by Using the Management Console](how-to-add-or-upgrade-packages-by-using-the-management-console-51-gb18030.md).
    
+
    For more about adding or upgrading packages, see How to Add or Upgrade Packages by Using the Management Console.
    
 
 
 
    App-V Client on a Stand-alone computer
    
@@ -76,8 +79,8 @@ To upgrade a package in some earlier versions of App-V, you had to perform sever
 
 
    For more information, see:
    
 
 
 
@@ -87,7 +90,7 @@ To upgrade a package in some earlier versions of App-V, you had to perform sever
 
 
 
- 
+ 
 
 
 
@@ -99,9 +102,9 @@ To upgrade a package in some earlier versions of App-V, you had to perform sever
 
 [Managing Connection Groups](managing-connection-groups51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md b/mdop/appv-v5/how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md
index 69d1542e03..ef45d7b6df 100644
--- a/mdop/appv-v5/how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md
+++ b/mdop/appv-v5/how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell
 description: How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 1d6c2d25-81ec-4ff8-9262-6b4cf484a376
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -55,7 +58,7 @@ Use the following information to add a package to a computer.
 **Important**  
 This example only adds a package. It does not publish the package to the user or the computer.
 
- 
+ 
 
 **Cmdlet**: Add-AppvClientPackage
 
@@ -91,7 +94,7 @@ Use the following information to publish a package that has been added to a spec
 
 
 
- 
+ 
 
 ## To publish a package to a specific user
 
@@ -99,7 +102,7 @@ Use the following information to publish a package that has been added to a spec
 **Note**  
 You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter.
 
- 
+ 
 
 An administrator can publish a package to a specific user by specifying the optional **–UserSID** parameter with the **Publish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID).
 
@@ -141,7 +144,7 @@ Use the following information to unpublish a package which has been entitled to
 **Note**  
 You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter.
 
- 
+ 
 
 An administrator can unpublish a package for a specific user by using the optional **–UserSID** parameter with the **Unpublish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID).
 
@@ -171,7 +174,7 @@ Use the following information to remove a package from the computer.
 **Note**  
 App-V cmdlets have been assigned to variables for the previous examples for clarity only; assignment is not a requirement. Most cmdlets can be combined as displayed in [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh). For a detailed tutorial, see [App-V 5.0 Client PowerShell Deep Dive](https://go.microsoft.com/fwlink/?LinkId=324466).
 
- 
+ 
 
 ## To enable only administrators to publish or unpublish packages
 
@@ -179,7 +182,7 @@ App-V cmdlets have been assigned to variables for the previous examples for clar
 **Note**  
 **This feature is supported starting in App-V 5.0 SP3.**
 
- 
+ 
 
 Use the following cmdlet and parameter to enable only administrators (not end users) to publish or unpublish packages:
 
@@ -206,7 +209,7 @@ Use the following cmdlet and parameter to enable only administrators (not end us
 
 
 
- 
+ 
 
 To use the App-V Management console to set this configuration, see [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-50.md).
 
@@ -246,7 +249,7 @@ To use the App-V Management console to set this configuration, see [How to Publi
 
 
 
- 
+ 
 
 The pending task will run later, according to the following rules:
 
@@ -273,11 +276,11 @@ The pending task will run later, according to the following rules:
 
 
 
- 
+ 
 
 For more information about pending tasks, see [About App-V 5.0 SP2](about-app-v-50-sp2.md#bkmk-pkg-upgr-pendg-tasks).
 
-**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
@@ -286,9 +289,9 @@ For more information about pending tasks, see [About App-V 5.0 SP2](about-app-v-
 
 [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md b/mdop/appv-v5/how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md
index 9fff909058..fe66e53ac9 100644
--- a/mdop/appv-v5/how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md
+++ b/mdop/appv-v5/how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell
 description: How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: c3fd06f6-102f-43d1-a577-d5ced6ac537d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -55,7 +58,7 @@ Use the following information to add a package to a computer.
 **Important**  
 This example only adds a package. It does not publish the package to the user or the computer.
 
- 
+ 
 
 **Cmdlet**: Add-AppvClientPackage
 
@@ -91,7 +94,7 @@ Use the following information to publish a package that has been added to a spec
 
 
 
- 
+ 
 
 ## To publish a package to a specific user
 
@@ -99,7 +102,7 @@ Use the following information to publish a package that has been added to a spec
 **Note**  
 You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter.
 
- 
+ 
 
 An administrator can publish a package to a specific user by specifying the optional **–UserSID** parameter with the **Publish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID).
 
@@ -141,7 +144,7 @@ Use the following information to unpublish a package which has been entitled to
 **Note**  
 You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter.
 
- 
+ 
 
 An administrator can unpublish a package for a specific user by using the optional **–UserSID** parameter with the **Unpublish-AppvClientPackage** cmdlet, where **-UserSID** represents the end user’s security identifier (SID).
 
@@ -171,7 +174,7 @@ Use the following information to remove a package from the computer.
 **Note**  
 App-V cmdlets have been assigned to variables for the previous examples for clarity only; assignment is not a requirement. Most cmdlets can be combined as displayed in [To add and publish a package](#bkmk-add-pub-pkg-standalone-posh). For a detailed tutorial, see [App-V 5.0 Client PowerShell Deep Dive](https://go.microsoft.com/fwlink/?LinkId=324466).
 
- 
+ 
 
 ## To enable only administrators to publish or unpublish packages
 
@@ -179,7 +182,7 @@ App-V cmdlets have been assigned to variables for the previous examples for clar
 **Note**  
 **This feature is supported starting in App-V 5.0 SP3.**
 
- 
+ 
 
 Use the following cmdlet and parameter to enable only administrators (not end users) to publish or unpublish packages:
 
@@ -206,7 +209,7 @@ Use the following cmdlet and parameter to enable only administrators (not end us
 
 
 
- 
+ 
 
 To use the App-V Management console to set this configuration, see [How to Publish a Package by Using the Management Console](how-to-publish-a-package-by-using-the-management-console-51.md).
 
@@ -246,7 +249,7 @@ To use the App-V Management console to set this configuration, see [How to Publi
 
 
 
- 
+ 
 
 The pending task will run later, according to the following rules:
 
@@ -273,7 +276,7 @@ The pending task will run later, according to the following rules:
 
 
 
- 
+ 
 
 For more information about pending tasks, see [About App-V 5.0 SP2](about-app-v-50-sp2.md#bkmk-pkg-upgr-pendg-tasks).
 
@@ -286,9 +289,9 @@ For more information about pending tasks, see [About App-V 5.0 SP2](about-app-v-
 
 [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md b/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md
index 77f184b695..742f6905de 100644
--- a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md
+++ b/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell
 description: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: b73ae74d-8a6f-4bb3-b1f2-0067c7bd5212
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -125,7 +128,7 @@ This topic explains the following procedures:
     
     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md b/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md
index f1f5f5dd83..fb63bd845f 100644
--- a/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md
+++ b/mdop/appv-v5/how-to-manage-connection-groups-on-a-stand-alone-computer-by-using-powershell51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell
 description: How to Manage Connection Groups on a Stand-alone Computer by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: e1589eff-d306-40fb-a0ae-727190dafe26
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -125,9 +128,11 @@ This topic explains the following procedures:
     
     
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
@@ -136,9 +141,9 @@ This topic explains the following procedures:
 
 [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md
index 801f596755..02c3ed99ef 100644
--- a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md
+++ b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md
@@ -2,7 +2,10 @@
 title: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer
 description: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer
 ms.assetid: 3ae9996f-71d9-4ca1-9aab-25b599158e55
-author: jamiejdt
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,43 +22,43 @@ Use the following procedure to migrate extension points from an App-V 4.6 pack
 **Note**  
 The following procedure does not require an App-V 5.0 management server.
 
- 
+ 
 
 **To migrate extension points from a package from an App-V 4.6 package to a converted App-V 5.0 package using the deployment configuration file**
 
-1.  Locate the directory that contains the deployment configuration file for the package you want to migrate. To set the policy, make the following update to the **userConfiguration** section:
+1. Locate the directory that contains the deployment configuration file for the package you want to migrate. To set the policy, make the following update to the **userConfiguration** section:
 
-    **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**
+   **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**
 
-    The following is an example of content from a deployment configuration file:
+   The following is an example of content from a deployment configuration file:
 
-    <?xml version="1.0" ?>
+   <?xml version="1.0" ?>
 
-    <DeploymentConfiguration
+   <DeploymentConfiguration
 
-    xmlns="http://schemas.microsoft.com/appv/2010/deploymentconfiguration" PackageId=<Package ID> DisplayName=<Display Name>
+   xmlns="" PackageId=<Package ID> DisplayName=<Display Name>
 
-    <MachineConfiguration/>
+   <MachineConfiguration/>
 
-    <UserConfiguration>
+   <UserConfiguration>
 
-    <ManagingAuthority TakeoverExtensionPointsFrom46="true"
+   <ManagingAuthority TakeoverExtensionPointsFrom46="true"
 
-    PackageName=<Package ID>
+   PackageName=<Package ID>
 
-    </UserConfiguration>
+   </UserConfiguration>
 
-    </DeploymentConfiguration>
+   </DeploymentConfiguration>
 
-2.  To add the App-V 5.0 package, in an elevated PowerShell command prompt type:
+2. To add the App-V 5.0 package, in an elevated PowerShell command prompt type:
 
-    PS>**$pkg= Add-AppvClientPackage** **–Path** <Path to package location> -**DynamicDeploymentConfiguration** <Path to the deployment configuration file>
+   PS>**$pkg= Add-AppvClientPackage** **–Path** <Path to package location> -**DynamicDeploymentConfiguration** <Path to the deployment configuration file>
 
-    PS>**Publish-AppVClientPackage $pkg**
+   PS>**Publish-AppVClientPackage $pkg**
 
-3.  To test the migration, open the virtual application using asscoaited FTAs or shortcuts. The application opens with App-V 5.0. Both, the App-V 4.6 package and the converted App-V 5.0 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.0 package.
+3. To test the migration, open the virtual application using associated FTAs or shortcuts. The application opens with App-V 5.0. Both, the App-V 4.6 package and the converted App-V 5.0 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.0 package.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
@@ -64,9 +67,9 @@ The following procedure does not require an App-V 5.0 management server.
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md
index 8da5b9bf34..19ee17d2ed 100644
--- a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md
+++ b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md
@@ -1,8 +1,11 @@
 ---
 title: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer
 description: How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: 4ef823a5-3106-44c5-aecc-29edf69c2fbb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -20,43 +23,43 @@ Use the following procedure to migrate extension points from an App-V 4.6 packa
 This procedure assumes that you are running the latest version of App-V 4.6.  
 The following procedure does not require an App-V 5.1 management server.
 
- 
+ 
 
 **To migrate extension points from a package from an App-V 4.6 package to a converted App-V 5.1 package using the deployment configuration file**
 
-1.  Locate the directory that contains the deployment configuration file for the package you want to migrate. To set the policy, make the following update to the **userConfiguration** section:
+1. Locate the directory that contains the deployment configuration file for the package you want to migrate. To set the policy, make the following update to the **userConfiguration** section:
 
-    **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**
+   **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**
 
-    The following is an example of content from a deployment configuration file:
+   The following is an example of content from a deployment configuration file:
 
-    <?xml version="1.0" ?>
+   <?xml version="1.0" ?>
 
-    <DeploymentConfiguration
+   <DeploymentConfiguration
 
-    xmlns="http://schemas.microsoft.com/appv/2010/deploymentconfiguration" PackageId=<Package ID> DisplayName=<Display Name>
+   xmlns="" PackageId=<Package ID> DisplayName=<Display Name>
 
-    <MachineConfiguration/>
+   <MachineConfiguration/>
 
-    <UserConfiguration>
+   <UserConfiguration>
 
-    <ManagingAuthority TakeoverExtensionPointsFrom46="true"
+   <ManagingAuthority TakeoverExtensionPointsFrom46="true"
 
-    PackageName=<Package ID>
+   PackageName=<Package ID>
 
-    </UserConfiguration>
+   </UserConfiguration>
 
-    </DeploymentConfiguration>
+   </DeploymentConfiguration>
 
-2.  To add the App-V 5.1 package, in an elevated PowerShell command prompt type:
+2. To add the App-V 5.1 package, in an elevated PowerShell command prompt type:
 
-    PS>**$pkg= Add-AppvClientPackage** **–Path** <Path to package location> -**DynamicDeploymentConfiguration** <Path to the deployment configuration file>
+   PS>**$pkg= Add-AppvClientPackage** **–Path** <Path to package location> -**DynamicDeploymentConfiguration** <Path to the deployment configuration file>
 
-    PS>**Publish-AppVClientPackage $pkg**
+   PS>**Publish-AppVClientPackage $pkg**
 
-3.  To test the migration, open the virtual application using associated FTAs or shortcuts. The application opens with App-V 5.1. Both, the App-V 4.6 package and the converted App-V 5.1 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.1 package.
+3. To test the migration, open the virtual application using associated FTAs or shortcuts. The application opens with App-V 5.1. Both, the App-V 4.6 package and the converted App-V 5.1 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.1 package.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
@@ -65,9 +68,9 @@ The following procedure does not require an App-V 5.1 management server.
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md
index 90045e1bab..5221f2f8c7 100644
--- a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md
+++ b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md
@@ -2,7 +2,10 @@
 title: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User
 description: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User
 ms.assetid: dad25992-3c75-4b7d-b4c6-c2edf43baaea
-author: jamiejdt
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -18,40 +21,40 @@ Use the following procedure to migrate packages created with App-V using the use
 
 **To convert a package**
 
-1.  Locate the user configuration file for the package you want to convert. To set the policy, perform the following updates in the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**.
+1. Locate the user configuration file for the package you want to convert. To set the policy, perform the following updates in the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**.
 
-    The following is an example of a user configuration file:
+   The following is an example of a user configuration file:
 
-    <?xml version="1.0" ?>
+   <?xml version="1.0" ?>
 
-    <UserConfiguration PackageId=<Package ID> DisplayName=<Name of the Package>
+   <UserConfiguration PackageId=<Package ID> DisplayName=<Name of the Package>
 
-    xmlns="http://schemas.microsoft.com/appv/2010/userconfiguration"> <ManagingAuthority TakeoverExtensionPointsFrom46="true"
+   xmlns="; <ManagingAuthority TakeoverExtensionPointsFrom46="true"
 
-    PackageName=<Package ID>
+   PackageName=<Package ID>
 
-    </UserConfiguration>
+   </UserConfiguration>
 
-2.  To add the App-V 5.0 package type the following in an elavted PowerShell command prompt:
+2. To add the App-V 5.0 package type the following in an elevated PowerShell command prompt:
 
-    PS>**$pkg= Add-AppvClientPackage –Path** <Path to package location>
+   PS>**$pkg= Add-AppvClientPackage –Path** <Path to package location>
 
-    PS>**Publish-AppVClientPackage $pkg -DynamicUserConfiguration** <Path to the user configuration file>
+   PS>**Publish-AppVClientPackage $pkg -DynamicUserConfiguration** <Path to the user configuration file>
 
-3.  Open the application using FTAs or shortcuts now. The application should open using App-V 5.0.
+3. Open the application using FTAs or shortcuts now. The application should open using App-V 5.0.
 
-    The App-V SP2 package and the converted App-V 5.0 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.0 package.
+   The App-V SP2 package and the converted App-V 5.0 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.0 package.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md
index 01138ec710..ddcc67a299 100644
--- a/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md
+++ b/mdop/appv-v5/how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md
@@ -1,8 +1,11 @@
 ---
 title: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User
 description: How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User
-author: jamiejdt
+author: dansimp
 ms.assetid: 19da3776-5ebe-41e1-9890-12b84ef3c1c7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -21,31 +24,31 @@ This procedure assumes that you are running the latest version of App-V 4.6.
 
 **To convert a package**
 
-1.  Locate the user configuration file for the package you want to convert. To set the policy, perform the following updates in the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**.
+1. Locate the user configuration file for the package you want to convert. To set the policy, perform the following updates in the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="true" PackageName=<Package ID>**.
 
-    The following is an example of a user configuration file:
+   The following is an example of a user configuration file:
 
-    <?xml version="1.0" ?>
+   <?xml version="1.0" ?>
 
-    <UserConfiguration PackageId=<Package ID> DisplayName=<Name of the Package>
+   <UserConfiguration PackageId=<Package ID> DisplayName=<Name of the Package>
 
-    xmlns="http://schemas.microsoft.com/appv/2010/userconfiguration"> <ManagingAuthority TakeoverExtensionPointsFrom46="true"
+   xmlns="; <ManagingAuthority TakeoverExtensionPointsFrom46="true"
 
-    PackageName=<Package ID>
+   PackageName=<Package ID>
 
-    </UserConfiguration>
+   </UserConfiguration>
 
-2.  To add the App-V 5.1 package, type the following in an elevated PowerShell command prompt window:
+2. To add the App-V 5.1 package, type the following in an elevated PowerShell command prompt window:
 
-    PS>**$pkg= Add-AppvClientPackage –Path** <Path to package location>
+   PS>**$pkg= Add-AppvClientPackage –Path** <Path to package location>
 
-    PS>**Publish-AppVClientPackage $pkg -DynamicUserConfiguration** <Path to the user configuration file>
+   PS>**Publish-AppVClientPackage $pkg -DynamicUserConfiguration** <Path to the user configuration file>
 
-3.  Open the application using FTAs or shortcuts now. The application should open using App-V 5.1.
+3. Open the application using FTAs or shortcuts now. The application should open using App-V 5.1.
 
-    The App-V 4.6 package and the converted App-V 5.1 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.1 package.
+   The App-V 4.6 package and the converted App-V 5.1 package are published to the user, but the FTAs and shortcuts for the applications have been assumed by the App-V 5.1 package.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+   **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
@@ -54,9 +57,9 @@ This procedure assumes that you are running the latest version of App-V 4.6.
 
 [How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User](how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md b/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md
index 7f54cff991..8a537ea939 100644
--- a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md
+++ b/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Modify an Existing Virtual Application Package
 description: How to Modify an Existing Virtual Application Package
-author: jamiejdt
+author: dansimp
 ms.assetid: 6cdeec00-e4fe-4210-b4c7-6ca1ac643ddd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -155,9 +158,9 @@ This topic explains how to:
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md b/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md
index a7cc455490..cb4d6428ca 100644
--- a/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md
+++ b/mdop/appv-v5/how-to-modify-an-existing-virtual-application-package-beta.md
@@ -1,8 +1,11 @@
 ---
 title: How to Modify an Existing Virtual Application Package
 description: How to Modify an Existing Virtual Application Package
-author: jamiejdt
+author: dansimp
 ms.assetid: 86b0fe21-52b0-4a9c-9a66-c78935fe74f1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -139,15 +142,15 @@ This topic explains how to:
 
 13. On the **Completion** page, click **Close**. The package is now available in the sequencer.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md b/mdop/appv-v5/how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md
index 03da949bdc..8ad3680354 100644
--- a/mdop/appv-v5/how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md
+++ b/mdop/appv-v5/how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md
@@ -1,8 +1,11 @@
 ---
 title: How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy
 description: How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy
-author: jamiejdt
+author: dansimp
 ms.assetid: 79d03a2b-2586-4ca7-bbaa-bdeb0a694279
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -23,7 +26,7 @@ Use the App-V 5.0 ADMX template to configure App-V 5.0 client settings using the
     **Note**  
     Use the following link to download the App-V 5.0 **ADMX Templates**: .
 
-     
+     
 
 2.  On the computer where you manage group Policy, typically the domain controller, copy the template **.admx** file to the following directory: **<Installation Drive> \\ Windows \\ PolicyDefinitions**.
 
@@ -31,7 +34,7 @@ Use the App-V 5.0 ADMX template to configure App-V 5.0 client settings using the
 
 3.  After you have copied the files open the Group Policy Management Console, to modify the policies associated with your App-V 5.0 clients browse to **Computer Configuration** / **Policies** / **Administrative Templates** / **System** / **App-V**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
@@ -40,9 +43,9 @@ Use the App-V 5.0 ADMX template to configure App-V 5.0 client settings using the
 
 [About Client Configuration Settings](about-client-configuration-settings.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md b/mdop/appv-v5/how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md
index 28801d394b..b316fe6660 100644
--- a/mdop/appv-v5/how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md
+++ b/mdop/appv-v5/how-to-modify-app-v-51-client-configuration-using-the-admx-template-and-group-policy.md
@@ -1,8 +1,11 @@
 ---
 title: How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy
 description: How to Modify App-V 5.1 Client Configuration Using the ADMX Template and Group Policy
-author: jamiejdt
+author: dansimp
 ms.assetid: 0d9cf13a-b29c-4c87-a776-15fea34027dd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -23,7 +26,7 @@ Use the Microsoft Application Virtualization (App-V) 5.1 ADMX template to config
     **Note**  
     Use the following link to download the App-V 5.1 **ADMX Templates**: .
 
-     
+     
 
 2.  On the computer where you manage group Policy, typically the domain controller, copy the template **.admx** file to the following directory: **<Installation Drive> \\ Windows \\ PolicyDefinitions**.
 
@@ -40,9 +43,9 @@ Use the Microsoft Application Virtualization (App-V) 5.1 ADMX template to config
 
 [About Client Configuration Settings](about-client-configuration-settings51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell.md b/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell.md
index ded98a3926..b51429c229 100644
--- a/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell.md
+++ b/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: How to Modify Client Configuration by Using PowerShell
 description: How to Modify Client Configuration by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 53ccb2cf-ef81-4310-a853-efcb395f006e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -28,7 +31,7 @@ Use the following procedure to configure the App-V 5.0 client configuration.
 
     `Set-AppvClientConfiguration –AutoLoad 2`
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell51.md b/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell51.md
index af53d695b0..ba031caf40 100644
--- a/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell51.md
+++ b/mdop/appv-v5/how-to-modify-client-configuration-by-using-powershell51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Modify Client Configuration by Using PowerShell
 description: How to Modify Client Configuration by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: c3a59592-bb0d-43b6-8f4e-44f3a2d5b7ea
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer.md b/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer.md
index 46ca0c4f93..75439a513b 100644
--- a/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer.md
+++ b/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer.md
@@ -1,8 +1,11 @@
 ---
 title: How to Move the App-V Server to Another Computer
 description: How to Move the App-V Server to Another Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: 4fda21be-4d6b-499c-a38a-5afd57b34a47
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -25,7 +28,7 @@ The following list displays the steps necessary to create a new management serve
 
 2.  After you have completed the installation, use the following link to connect it to the App-V 5.0 database - [How to install the Management Server on a Standalone Computer and Connect it to the Database](how-to-install-the-management-server-on-a-standalone-computer-and-connect-it-to-the-database.md).
 
-**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer51.md b/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer51.md
index 32073ac0ea..65179dff17 100644
--- a/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer51.md
+++ b/mdop/appv-v5/how-to-move-the-app-v-server-to-another-computer51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Move the App-V Server to Another Computer
 description: How to Move the App-V Server to Another Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: 853af9eb-db5b-421d-a0fe-79ded8752cef
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-publish-a-connection-group.md b/mdop/appv-v5/how-to-publish-a-connection-group.md
index 34ff5d9a90..d3e96c272e 100644
--- a/mdop/appv-v5/how-to-publish-a-connection-group.md
+++ b/mdop/appv-v5/how-to-publish-a-connection-group.md
@@ -1,8 +1,11 @@
 ---
 title: How to Publish a Connection Group
 description: How to Publish a Connection Group
-author: jamiejdt
+author: dansimp
 ms.assetid: c61db00a-8393-485c-949e-af2098b9e258
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -22,7 +25,7 @@ After you create a connection group, you must publish it to computers that run t
 
 2.  Right-click the connection group to be published, and select **publish**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-publish-a-connection-group51.md b/mdop/appv-v5/how-to-publish-a-connection-group51.md
index 0fb2920e53..523eb51739 100644
--- a/mdop/appv-v5/how-to-publish-a-connection-group51.md
+++ b/mdop/appv-v5/how-to-publish-a-connection-group51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Publish a Connection Group
 description: How to Publish a Connection Group
-author: jamiejdt
+author: dansimp
 ms.assetid: fe89601c-23c6-4b7c-a61b-4ca50908f1b4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-50.md b/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-50.md
index 847b0ca33d..99df93599f 100644
--- a/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-50.md
+++ b/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-50.md
@@ -1,8 +1,11 @@
 ---
 title: How to Publish a Package by Using the Management Console
 description: How to Publish a Package by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 7c6930fc-5c89-4519-a901-512dae155fd2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Use the following procedure to publish an App-V 5.0 package. Once you publish a
 **Note**  
 The ability to enable only administrators to publish or unpublish packages (described below) is supported starting in App-V 5.0 SP3.
 
- 
+ 
 
 **To publish an App-V 5.0 package**
 
@@ -39,7 +42,7 @@ The ability to enable only administrators to publish or unpublish packages (desc
 
     To alternatively use PowerShell to set this item, see [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md#bkmk-admins-pub-pkgs).
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
@@ -48,9 +51,9 @@ The ability to enable only administrators to publish or unpublish packages (desc
 
 [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-51.md b/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-51.md
index 43bc2923ec..9a64b6ff65 100644
--- a/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-51.md
+++ b/mdop/appv-v5/how-to-publish-a-package-by-using-the-management-console-51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Publish a Package by Using the Management Console
 description: How to Publish a Package by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: e34d2bcf-15ac-4a75-9dc8-79380b36a25f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Use the following procedure to publish an App-V 5.1 package. Once you publish a
 **Note**  
 The ability to enable only administrators to publish or unpublish packages (described below) is supported starting in App-V 5.0 SP3.
 
- 
+ 
 
 **To publish an App-V 5.1 package**
 
@@ -48,9 +51,9 @@ The ability to enable only administrators to publish or unpublish packages (desc
 
 [How to Configure Access to Packages by Using the Management Console](how-to-configure-access-to-packages-by-using-the-management-console-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md b/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md
index c972efc7b7..abd93c7e0a 100644
--- a/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md
+++ b/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console.md
@@ -1,8 +1,11 @@
 ---
 title: How to Register and Unregister a Publishing Server by Using the Management Console
 description: How to Register and Unregister a Publishing Server by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: c24f3b43-4888-41a9-9a39-973657f2b917
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -36,7 +39,7 @@ Use the following procedure to register or unregister a publishing server.
 
 3.  To unregister the server, right-click the computer name and select the computer name and select **unregister server**.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md b/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md
index d039d54dac..7e06b09dbc 100644
--- a/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md
+++ b/mdop/appv-v5/how-to-register-and-unregister-a-publishing-server-by-using-the-management-console51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Register and Unregister a Publishing Server by Using the Management Console
 description: How to Register and Unregister a Publishing Server by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 69cef0a8-8102-4697-b1ba-f16e0f25216b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md
index ab65dfde38..76656d39e1 100644
--- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md
+++ b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-a-specific-user.md
@@ -1,8 +1,9 @@
 ---
+ms.reviewer: 
 title: How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User
 description: How to Revert Extension Points From an App-V 5.0 Package to an App-V 4.6 Package for a Specific User
 ms.assetid: f1d2ab1f-0831-4976-b49f-169511d3382a
-author: jamiejdt
+author: dansimp
 ms.assetid: f1d2ab1f-0831-4976-b49f-169511d3382a
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
@@ -19,7 +20,7 @@ Use the following procedure to revert an App-V 5.0 package to the App-V file for
 
 **To revert a package**
 
-1.  Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.0 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md).
+1.  Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.0 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.0 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-50-for-a-specific-user.md).
 
     In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>**
 
@@ -27,23 +28,28 @@ Use the following procedure to revert an App-V 5.0 package to the App-V file for
 
     PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath** <path to user configuration file>
 
-3.  Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6. Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6 SP2.
+3.  Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6. Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6 SP2.
 
-    **Note**  
+    **Note**  
     If you do not need the App-V 5.0 package anymore, you can unpublish the App-V 5.0 package and the extension points will automatically revert to App-V 4.6.
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
-
- 
+
+
+
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md
index fd56229409..d8bed1b729 100644
--- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md
+++ b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-50-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md
@@ -1,8 +1,11 @@
 ---
-title: How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer
+title: "How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer"
 description: How to Revert Extension Points from an App-V 5.0 Package to an App-V 4.6 Package For All Users on a Specific Computer
 ms.assetid: 2a43ca1b-6847-4dd1-ade2-336ac4ac6af0
-author: jamiejdt
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -14,11 +17,11 @@ ms.date: 06/21/2016
 
 *Note:** App-V 4.6 has exited Mainstream support. The following assumes that the App-V 4.6 SP3 client is already installed.
 
-Use the following procedure to revert extension points from an App-V 5.0 package to the App-V 4.6 file format using the deployment configuration file.
+Use the following procedure to revert extension points from an App-V 5.0 package to the App-V 4.6 file format using the deployment configuration file.
 
 **To revert a package**
 
-1.  Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.0 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md).
+1.  Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.0 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.0 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-50-package-for-all-users-on-a-specific-computer.md).
 
     In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>**
 
@@ -28,25 +31,27 @@ Use the following procedure to revert extension points from an App-V 5.0 package
 
     PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationType useDeploymentConfiguration**
 
-3.  Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6 SP2 package.
+3.  Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6 SP2 package.
 
     Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6.
 
-    **Note**  
-    If you do not need the App-V 5.0 package anymore, you can unpublish the App-V 5.0 package and the extension points will automatically revert to App-V 4.6.
+    **Note**  
+    If you do not need the App-V 5.0 package anymore, you can unpublish the App-V 5.0 package and the extension points will automatically revert to App-V 4.6.
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md
index c977b9dc23..b62aea5290 100644
--- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md
+++ b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-a-specific-user.md
@@ -1,8 +1,11 @@
 ---
 title: How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User
 description: How to Revert Extension Points From an App-V 5.1 Package to an App-V 4.6 Package for a Specific User
-author: jamiejdt
+author: dansimp
 ms.assetid: bd53c5d6-7fd2-4816-b03b-d59da0a35819
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -18,7 +21,7 @@ Use the following procedure to revert an App-V 5.1 package to the App-V file for
 
 **To revert a package**
 
-1.  Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.1 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md).
+1.  Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.1 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to App-V 5.1 for a Specific User](how-to-migrate-extension-points-from-an-app-v-46-package-to-app-v-51-for-a-specific-user.md).
 
     In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>**
 
@@ -26,23 +29,25 @@ Use the following procedure to revert an App-V 5.1 package to the App-V file for
 
     PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationPath** <path to user configuration file>
 
-3.  Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6. Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6.
+3.  Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6. Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6.
 
-    **Note**  
+    **Note**  
     If you do not need the App-V 5.1 package anymore, you can unpublish the App-V 5.1 package and the extension points will automatically revert to App-V 4.6.
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md
index 3046969544..7c6b1455cf 100644
--- a/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md
+++ b/mdop/appv-v5/how-to-revert-extension-points-from-an-app-v-51-package-to-an-app-v-46-package-for-all-users-on-a-specific-computer.md
@@ -1,8 +1,11 @@
 ---
 title: How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer
 description: How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: 64640b8e-de6b-4006-a33e-353d285af15e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -14,11 +17,11 @@ ms.date: 06/21/2016
 # How to Revert Extension Points from an App-V 5.1 Package to an App-V 4.6 Package For All Users on a Specific Computer
 
 
-Use the following procedure to revert extension points from an App-V 5.1 package to the App-V 4.6 file format using the deployment configuration file.
+Use the following procedure to revert extension points from an App-V 5.1 package to the App-V 4.6 file format using the deployment configuration file.
 
 **To revert a package**
 
-1.  Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.1 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md).
+1.  Ensure that App-V 4.6 package is published to the users but the FTAs and shortcuts have been assumed by App-V 5.1 package using the following migration method, [How to Migrate Extension Points From an App-V 4.6 Package to a Converted App-V 5.1 Package for All Users on a Specific Computer](how-to-migrate-extension-points-from-an-app-v-46-package-to-a-converted-app-v-51-package-for-all-users-on-a-specific-computer.md).
 
     In the **userConfiguration** section of the deployment configuration file for the converted package, to set the policy, make the following update to the **userConfiguration** section: **ManagingAuthority TakeoverExtensionPointsFrom46="false" PackageName=<Package ID>**
 
@@ -28,25 +31,27 @@ Use the following procedure to revert extension points from an App-V 5.1 package
 
     PS>**Publish-AppVClientPackage $pkg –DynamicUserConfigurationType useDeploymentConfiguration**
 
-3.  Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6 package.
+3.  Perform a publishing refresh, or wait for the next scheduled publishing refresh for the App-V 4.6 package.
 
     Open the application using FTAs or shortcuts. The Application should now open using App-V 4.6.
 
-    **Note**  
-    If you do not need the App-V 5.1 package anymore, you can unpublish the App-V 5.1 package and the extension points will automatically revert to App-V 4.6.
+    **Note**  
+    If you do not need the App-V 5.1 package anymore, you can unpublish the App-V 5.1 package and the extension points will automatically revert to App-V 4.6.
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md b/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md
index 8f7efaee49..8652ce06d6 100644
--- a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md
+++ b/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md
@@ -1,8 +1,11 @@
 ---
 title: How to Sequence a New Application with App-V 5.0
 description: How to Sequence a New Application with App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: a263fa84-cd6d-4219-a5c2-eb6a553b826c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -45,7 +48,7 @@ ms.date: 06/16/2016
     
     
 
-     
+
 
 2.  Copy all required installation files to the computer that is running the sequencer.
 
@@ -67,66 +70,74 @@ ms.date: 06/16/2016
 
 3.  On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**.
 
-    **Important**  
+    **Important**  
     If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package.
 
-     
+
 
 4.  On the **Type of Application** page, click the **Standard Application (default)** check box, and then click **Next**.
 
 5.  On the **Select Installer** page, click **Browse** and specify the installation file for the application.
 
-    **Note**  
+    **Note**  
     If the specified application installer modifies security access to a file or directory, existing or new, the associated changes will not be captured into the package.
 
-     
 
-    If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then Click **Next**.
 
-6.  On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console.
+~~~
+If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then Click **Next**.
+~~~
 
-    The **Primary Virtual Application Directory** displays the path where the application will be installed on target computers. To specify this location, select **Browse**.
+6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console.
 
-    **Note**  
-    Starting in App-V 5.0 SP3, the primary virtual application directory (PVAD) is hidden, but you can turn it back on. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-pvad-hidden).
+   The **Primary Virtual Application Directory** displays the path where the application will be installed on target computers. To specify this location, select **Browse**.
 
-     
+   **Note**  
+   Starting in App-V 5.0 SP3, the primary virtual application directory (PVAD) is hidden, but you can turn it back on. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-pvad-hidden).
 
-    **Important**  
-    The primary application virtual directory should match the installation location for the application that is being sequenced. For example, if you install Notepad to **C:\\Program Files\\Notepad**; you should configure **C:\\Program Files\\Notepad** as your primary virtual directory. Alternatively, you can choose to set **C:\\Notepad** as the primary virtual application directory, as long as during installation time, you configure the installer to install to **C:\\Notepad**. Editing the Application Virtualization path is an advanced configuration task. For most applications, the default path is recommended for the following reasons:
 
-    -   Application Compatibility. Some virtualized applications will not function correctly, or will fail to open if the directories are not configured with identical virtual directory paths.
 
-    -   Performance. Since no file system redirection is required, the runtime performance can improve.
+~~~
+**Important**  
+The primary application virtual directory should match the installation location for the application that is being sequenced. For example, if you install Notepad to **C:\\Program Files\\Notepad**; you should configure **C:\\Program Files\\Notepad** as your primary virtual directory. Alternatively, you can choose to set **C:\\Notepad** as the primary virtual application directory, as long as during installation time, you configure the installer to install to **C:\\Notepad**. Editing the Application Virtualization path is an advanced configuration task. For most applications, the default path is recommended for the following reasons:
 
-     
+-   Application Compatibility. Some virtualized applications will not function correctly, or will fail to open if the directories are not configured with identical virtual directory paths.
 
-    **Tip**  
-    It is recommended that prior to Sequencing an application, you open the associated installer to determine the default installation directory, and then configure that location as the **Primary Virtual Application Directory**.
+-   Performance. Since no file system redirection is required, the runtime performance can improve.
 
-     
 
-    Click **Next**.
 
-7.  On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process.
+**Tip**  
+It is recommended that prior to Sequencing an application, you open the associated installer to determine the default installation directory, and then configure that location as the **Primary Virtual Application Directory**.
 
-    **Important**  
-    You should always install applications to a secure location and make sure no other users are logged on to the computer running the sequencer during monitoring.
 
-     
 
-    Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**.
+Click **Next**.
+~~~
 
-8.  On the **Installation** page, wait while the sequencer configures the virtualized application package.
+7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process.
 
-9.  On the **Configure Software** page, optionally run the programs contained in the package. This step allows you to complete any necessary license or configuration tasks before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. You may need to wait several minutes for all programs to run.
+   **Important**  
+   You should always install applications to a secure location and make sure no other users are logged on to the computer running the sequencer during monitoring.
 
-    **Note**  
-    To run first-use tasks for any application that is not available in the list, open the application. The associated information will be captured during this step.
 
-     
 
-    Click **Next**.
+~~~
+Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**.
+~~~
+
+8. On the **Installation** page, wait while the sequencer configures the virtualized application package.
+
+9. On the **Configure Software** page, optionally run the programs contained in the package. This step allows you to complete any necessary license or configuration tasks before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. You may need to wait several minutes for all programs to run.
+
+   **Note**  
+   To run first-use tasks for any application that is not available in the list, open the application. The associated information will be captured during this step.
+
+
+
+~~~
+Click **Next**.
+~~~
 
 10. On the **Installation Report** page, you can review information about the virtualized application package you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**.
 
@@ -140,80 +151,86 @@ ms.date: 06/16/2016
 
 12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**.
 
-    **Note**  
-    If you do not open any applications during this step, the default streaming method is on-demand streaming delivery. This means applications will be downloaded bit by bit until it can be opened, and then depending on how the background loading is configured, will load the rest of the application.
+   **Note**  
+   If you do not open any applications during this step, the default streaming method is on-demand streaming delivery. This means applications will be downloaded bit by bit until it can be opened, and then depending on how the background loading is configured, will load the rest of the application.
+
 
-     
 
 13. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and select the operating systems that can run this package. Click **Next**.
 
-    **Important**  
-    Make sure that the operating systems you specify here are supported by the application you are sequencing.
+   **Important**  
+   Make sure that the operating systems you specify here are supported by the application you are sequencing.
+
 
-     
 
 14. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**.
 
-    To save the package immediately, select **Save the package now** (default). Add optional **Comments** to be associated with the package. Comments are useful for identifying the program version and other information about the package.
+   To save the package immediately, select **Save the package now** (default). Add optional **Comments** to be associated with the package. Comments are useful for identifying the program version and other information about the package.
 
-    **Important**  
-    The system does not support non-printable characters in **Comments** and **Descriptions**.
+   **Important**  
+   The system does not support non-printable characters in **Comments** and **Descriptions**.
 
-     
 
-    The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**.
+
+~~~
+The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**.
+~~~
 
 15. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory where the package was created.
 
-    The package is now available in the sequencer.
+   The package is now available in the sequencer.
+
+   **Important**  
+   After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer.
 
-    **Important**  
-    After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer.
 
-     
 
 **To sequence an add-on or plug-in application**
 
 1.  
 
-    **Note**  
+    **Note**  
     Before performing the following procedure, install the parent application locally on the computer that is running the sequencer. Or if you have the parent application virtualized, you can follow the steps in the add-on or plug-in workflow to unpack the parent application on the computer.
 
     For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that is running the sequencer. Also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package.
 
-     
 
-    On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
 
-2.  ****In the sequencer, click **Create a New Virtual Application Package**. Select **Create Package (default)**, and then click **Next**.
+~~~
+On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
+~~~
 
-3.  On the **Prepare Computer** page, review the issues that might cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**.
+2. *In the sequencer, click *Create a New Virtual Application Package. Select **Create Package (default)**, and then click **Next**.
 
-    **Important**  
-    If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package.
+3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**.
 
-     
+   **Important**  
+   If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package.
 
-4.  On the **Type of Application** page, select **Add-on or Plug-in**, and then click **Next**.
 
-5.  On the **Select Installer** page, click **Browse** and specify the installation file for the add-on or plug-in. If the add-on or plug-in does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
 
-6.  On the **Install Primary** page, ensure that the primary application is installed on the computer that runs the sequencer. Alternatively, you can expand an existing package that has been saved locally on the computer that runs the sequencer. To do this, click **Expand Package**, and then select the package. After you have expanded or installed the parent program, select **I have installed the primary parent program**.
+4. On the **Type of Application** page, select **Add-on or Plug-in**, and then click **Next**.
 
-    Click **Next**.
+5. On the **Select Installer** page, click **Browse** and specify the installation file for the add-on or plug-in. If the add-on or plug-in does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
 
-7.  On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V 5.0 Management Console. The **Primary Virtual Application Directory** displays the path where the application will be installed. To specify this location, type the path, or click **Browse**.
+6. On the **Install Primary** page, ensure that the primary application is installed on the computer that runs the sequencer. Alternatively, you can expand an existing package that has been saved locally on the computer that runs the sequencer. To do this, click **Expand Package**, and then select the package. After you have expanded or installed the parent program, select **I have installed the primary parent program**.
 
-    **Note**  
-    Starting in App-V 5.0 SP3, the primary virtual application directory (PVAD) is hidden, but you can turn it back on. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-pvad-hidden).
+   Click **Next**.
 
-     
+7. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V 5.0 Management Console. The **Primary Virtual Application Directory** displays the path where the application will be installed. To specify this location, type the path, or click **Browse**.
 
-    Click **Next**.
+   **Note**  
+   Starting in App-V 5.0 SP3, the primary virtual application directory (PVAD) is hidden, but you can turn it back on. See [About App-V 5.0 SP3](about-app-v-50-sp3.md#bkmk-pvad-hidden).
 
-8.  On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the plug-in or add-in application so the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**.
 
-9.  On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**.
+
+~~~
+Click **Next**.
+~~~
+
+8. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the plug-in or add-in application so the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**.
+
+9. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**.
 
 10. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 12 of this procedure. To perform either of the following customizations, select **Customize**.
 
@@ -225,50 +242,52 @@ ms.date: 06/16/2016
 
 11. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. Streaming improves the experience when the virtual application package is run on target computers on high-latency networks. It can take several minutes for all the applications to run. After all applications have run, close each of the applications. You can also configure the package to be required to be fully downloaded before opening by selecting the **Force applications to be downloaded** check-box. Click **Next**.
 
-    **Note**  
-    If necessary, you can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and select one of the check boxes: **Stop all applications** or **Stop this application only**.
+   **Note**  
+   If necessary, you can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and select one of the check boxes: **Stop all applications** or **Stop this application only**.
+
 
-     
 
 12. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Click **Next**.
 
 13. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor** check box. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**.
 
-    To save the package immediately, select **Save the package now**. Optionally, add a **Description** that will be associated with the package. Descriptions are useful for identifying the version and other information about the package.
+   To save the package immediately, select **Save the package now**. Optionally, add a **Description** that will be associated with the package. Descriptions are useful for identifying the version and other information about the package.
 
-    **Important**  
-    The system does not support non-printable characters in Comments and Descriptions.
+   **Important**  
+   The system does not support non-printable characters in Comments and Descriptions.
 
-     
 
-    The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**.
+
+~~~
+The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**.
+~~~
 
 **To sequence a middleware application**
 
-1.  On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
+1. On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
 
-2.  ****In the sequencer, click **Create a New Virtual Application Package**. Select **Create Package (default)**, and then click **Next**.
+2. *In the sequencer, click *Create a New Virtual Application Package. Select **Create Package (default)**, and then click **Next**.
 
-3.  On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**.
+3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**.
 
-    **Important**  
-    If you are required to disable virus scanning software, you should first scan the computer that runs the App-V 5.0 Sequencer in order to ensure that no unwanted or malicious files can be added to the package.
+   **Important**  
+   If you are required to disable virus scanning software, you should first scan the computer that runs the App-V 5.0 Sequencer in order to ensure that no unwanted or malicious files can be added to the package.
 
-     
 
-4.  On the **Type of Application** page, select **Middleware**, and then click **Next**.
 
-5.  On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
+4. On the **Type of Application** page, select **Middleware**, and then click **Next**.
 
-6.  On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console. The **Primary Virtual Application Directory** displays the path where the application will be installed. To specify this location, type the path or click **Browse**.
+5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
 
-    Click **Next**.
+6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console. The **Primary Virtual Application Directory** displays the path where the application will be installed. To specify this location, type the path or click **Browse**.
 
-7.  On the **Installation** page, when the sequencer and middleware application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**.
+   Click **Next**.
 
-8.  On the **Installation** page, wait while the sequencer configures the virtual application package.
+7. On the **Installation** page, when the sequencer and middleware application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**.
 
-9.  On the **Installation Report** page, you can review information about the virtual application package that you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**.
+8. On the **Installation** page, wait while the sequencer configures the virtual application package.
+
+9. On the **Installation Report** page, you can review information about the virtual application package that you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**.
 
 10. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box and select the operating systems that can run this package. Click **Next**.
 
@@ -276,32 +295,36 @@ ms.date: 06/16/2016
 
     To save the package immediately, select **Save the package now**. Optionally, add a **Description** to be associated with the package. Descriptions are useful for identifying the program version and other information about the package.
 
-    **Important**  
+    **Important**  
     The system does not support non-printable characters in Comments and Descriptions.
 
-     
 
-    The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**.
+
+~~~
+The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**.
+~~~
 
 12. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory specified in step 11 of this procedure.
 
-    The package is now available in the sequencer. To edit the package properties, click **Edit \[Package Name\]**.
+   The package is now available in the sequencer. To edit the package properties, click **Edit \[Package Name\]**.
 
-    **Important**  
-    After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer.
+   **Important**  
+   After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer.
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md b/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md
index fef2c2c8fd..ba6d5a807d 100644
--- a/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md
+++ b/mdop/appv-v5/how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md
@@ -1,8 +1,11 @@
 ---
 title: How to Sequence a New Application with App-V 5.1
 description: How to Sequence a New Application with App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 7d7699b1-0cb8-450d-94e7-5af937e16c21
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -45,7 +48,7 @@ ms.date: 06/16/2016
     
     
 
-     
+
 
 2.  Copy all required installation files to the computer that is running the sequencer.
 
@@ -68,50 +71,58 @@ ms.date: 06/16/2016
 
 3.  On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**.
 
-    > [!IMPORTANT]  
+    > [!IMPORTANT]
     > If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package.
 
-     
 
-    > [!NOTE]  
-    > There is currently no way to disable Windows Defender in Windows 10. If you receive a warning, you can safely ignore it. It is unlikely that Windows Defender will affect sequencing at all.
 
-     
+~~~
+> [!NOTE]  
+> There is currently no way to disable Windows Defender in Windows 10. If you receive a warning, you can safely ignore it. It is unlikely that Windows Defender will affect sequencing at all.
+~~~
 
-4.  On the **Type of Application** page, click the **Standard Application (default)** check box, and then click **Next**.
 
-5.  On the **Select Installer** page, click **Browse** and specify the installation file for the application.
 
-    > [!NOTE]  
-    > If the specified application installer modifies security access to a file or directory, existing or new, the associated changes will not be captured into the package.
+4. On the **Type of Application** page, click the **Standard Application (default)** check box, and then click **Next**.
 
-     
+5. On the **Select Installer** page, click **Browse** and specify the installation file for the application.
 
-    If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then Click **Next**.
+   > [!NOTE]  
+   > If the specified application installer modifies security access to a file or directory, existing or new, the associated changes will not be captured into the package.
 
-6.  On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console.
 
-    Click **Next**.
 
-7.  On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process.
+~~~
+If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then Click **Next**.
+~~~
 
-    > [!IMPORTANT]  
-    > You should always install applications to a secure location and make sure no other users are logged on to the computer running the sequencer during monitoring.
+6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console.
 
-     
+   Click **Next**.
 
-    Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**.
+7. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process.
 
-8.  On the **Installation** page, wait while the sequencer configures the virtualized application package.
+   > [!IMPORTANT]
+   > You should always install applications to a secure location and make sure no other users are logged on to the computer running the sequencer during monitoring.
 
-9.  On the **Configure Software** page, optionally run the programs contained in the package. This step allows you to complete any necessary license or configuration tasks before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. You may need to wait several minutes for all programs to run.
 
-    > [!NOTE]  
-    > To run first-use tasks for any application that is not available in the list, open the application. The associated information will be captured during this step.
 
-     
+~~~
+Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** to locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**. Click **Next**.
+~~~
 
-    Click **Next**.
+8. On the **Installation** page, wait while the sequencer configures the virtualized application package.
+
+9. On the **Configure Software** page, optionally run the programs contained in the package. This step allows you to complete any necessary license or configuration tasks before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then click **Run All**. To run specific programs, select the program or programs, and then click **Run Selected**. Complete the required configuration tasks and then close the applications. You may need to wait several minutes for all programs to run.
+
+   > [!NOTE]  
+   > To run first-use tasks for any application that is not available in the list, open the application. The associated information will be captured during this step.
+
+
+
+~~~
+Click **Next**.
+~~~
 
 10. On the **Installation Report** page, you can review information about the virtualized application package you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**.
 
@@ -125,73 +136,77 @@ ms.date: 06/16/2016
 
 12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then click **Next**.
 
-    > [!NOTE]  
-    > If you do not open any applications during this step, the default streaming method is on-demand streaming delivery. This means applications will be downloaded bit by bit until it can be opened, and then depending on how the background loading is configured, will load the rest of the application.
+   > [!NOTE]  
+   > If you do not open any applications during this step, the default streaming method is on-demand streaming delivery. This means applications will be downloaded bit by bit until it can be opened, and then depending on how the background loading is configured, will load the rest of the application.
+
 
-     
 
 13. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and select the operating systems that can run this package. Click **Next**.
 
-    > [!IMPORTANT]  
-    > Make sure that the operating systems you specify here are supported by the application you are sequencing.
+   > [!IMPORTANT]
+   > Make sure that the operating systems you specify here are supported by the application you are sequencing.
+
 
-     
 
 14. The **Create Package** page is displayed. To modify the package without saving it, select **Continue to modify package without saving using the package editor**. This option opens the package in the sequencer console so that you can modify the package before it is saved. Click **Next**.
 
-    To save the package immediately, select **Save the package now** (default). Add optional **Comments** to be associated with the package. Comments are useful for identifying the program version and other information about the package.
+   To save the package immediately, select **Save the package now** (default). Add optional **Comments** to be associated with the package. Comments are useful for identifying the program version and other information about the package.
 
-    > [!IMPORTANT]  
-    > The system does not support non-printable characters in **Comments** and **Descriptions**.
+   > [!IMPORTANT]
+   > The system does not support non-printable characters in **Comments** and **Descriptions**.
 
-     
 
-    The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**.
+
+~~~
+The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**.
+~~~
 
 15. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory where the package was created.
 
-    The package is now available in the sequencer.
+   The package is now available in the sequencer.
+
+   > [!IMPORTANT]
+   > After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer.
 
-    > [!IMPORTANT]  
-    > After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer.
 
-     
 
 **To sequence an add-on or plug-in application**
 
-1.  > [!NOTE]  
-    > Before performing the following procedure, install the parent application locally on the computer that is running the sequencer. Or if you have the parent application virtualized, you can follow the steps in the add-on or plug-in workflow to unpack the parent application on the computer.
-    >
-    > For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that is running the sequencer. Also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package.
+1. > [!NOTE]  
+   > Before performing the following procedure, install the parent application locally on the computer that is running the sequencer. Or if you have the parent application virtualized, you can follow the steps in the add-on or plug-in workflow to unpack the parent application on the computer.
+   >
+   > For example, if you are sequencing a plug-in for Microsoft Excel, install Microsoft Excel locally on the computer that is running the sequencer. Also install the parent application in the same directory where the application is installed on target computers. If the plug-in or add-on is going to be used with an existing virtual application package, install the application on the same virtual application drive that was used when you created the parent virtual application package.
 
-     
 
-    On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
 
-2.  ****In the sequencer, click **Create a New Virtual Application Package**. Select **Create Package (default)**, and then click **Next**.
+~~~
+On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
+~~~
 
-3.  On the **Prepare Computer** page, review the issues that might cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**.
+2. *In the sequencer, click *Create a New Virtual Application Package. Select **Create Package (default)**, and then click **Next**.
 
-    > [!IMPORTANT]  
-    > If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package.
+3. On the **Prepare Computer** page, review the issues that might cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**.
 
-     
+   > [!IMPORTANT]
+   > If you are required to disable virus scanning software, you should first scan the computer that runs the sequencer in order to ensure that no unwanted or malicious files could be added to the package.
 
-4.  On the **Type of Application** page, select **Add-on or Plug-in**, and then click **Next**.
 
-5.  On the **Select Installer** page, click **Browse** and specify the installation file for the add-on or plug-in. If the add-on or plug-in does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
 
-6.  On the **Install Primary** page, ensure that the primary application is installed on the computer that runs the sequencer. Alternatively, you can expand an existing package that has been saved locally on the computer that runs the sequencer. To do this, click **Expand Package**, and then select the package. After you have expanded or installed the parent program, select **I have installed the primary parent program**.
+4. On the **Type of Application** page, select **Add-on or Plug-in**, and then click **Next**.
 
-    Click **Next**.
+5. On the **Select Installer** page, click **Browse** and specify the installation file for the add-on or plug-in. If the add-on or plug-in does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
 
-7.  On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V 5.0 Management Console.
+6. On the **Install Primary** page, ensure that the primary application is installed on the computer that runs the sequencer. Alternatively, you can expand an existing package that has been saved locally on the computer that runs the sequencer. To do this, click **Expand Package**, and then select the package. After you have expanded or installed the parent program, select **I have installed the primary parent program**.
 
-    Click **Next**.
+   Click **Next**.
 
-8.  On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the plug-in or add-in application so the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**.
+7. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name will be displayed in the App-V 5.0 Management Console.
 
-9.  On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**.
+   Click **Next**.
+
+8. On the **Installation** page, when the sequencer and application installer are ready you can proceed to install the plug-in or add-in application so the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run** and locate and run the additional installation files. When you are finished with the installation, select **I am finished installing**, and then click **Next**.
+
+9. On the **Installation Report** page, you can review information about the virtual application package that you just sequenced. For a more detailed explanation about the information displayed in **Additional Information**, double-click the event. After you have reviewed the information, click **Next**.
 
 10. The **Customize** page is displayed. If you are finished installing and configuring the virtual application, select **Stop now** and skip to step 12 of this procedure. To perform either of the following customizations, select **Customize**.
 
@@ -206,7 +221,7 @@ ms.date: 06/16/2016
     > [!NOTE]  
     > If necessary, you can stop an application from loading during this step. In the **Application Launch** dialog box, click **Stop** and select one of the check boxes: **Stop all applications** or **Stop this application only**.
 
-     
+
 
 12. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Click **Next**.
 
@@ -214,39 +229,41 @@ ms.date: 06/16/2016
 
     To save the package immediately, select **Save the package now**. Optionally, add a **Description** that will be associated with the package. Descriptions are useful for identifying the version and other information about the package.
 
-    > [!IMPORTANT]  
+    > [!IMPORTANT]
     > The system does not support non-printable characters in Comments and Descriptions.
 
-     
 
-    The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**.
+
+~~~
+The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**.
+~~~
 
 **To sequence a middleware application**
 
-1.  On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
+1. On the computer that runs the sequencer, click **All Programs**, and then Click **Microsoft Application Virtualization**, and then click **Microsoft Application Virtualization Sequencer**.
 
-2.  ****In the sequencer, click **Create a New Virtual Application Package**. Select **Create Package (default)**, and then click **Next**.
+2. *In the sequencer, click *Create a New Virtual Application Package. Select **Create Package (default)**, and then click **Next**.
 
-3.  On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**.
+3. On the **Prepare Computer** page, review the issues that could cause the package creation to fail or could cause the package to contain unnecessary data. You should resolve all potential issues before you continue. After making any corrections, click **Refresh** to display the updated information. After you have resolved all potential issues, click **Next**.
 
-    > [!IMPORTANT]  
-    > If you are required to disable virus scanning software, you should first scan the computer that runs the App-V 5.0 Sequencer in order to ensure that no unwanted or malicious files can be added to the package.
+   > [!IMPORTANT]
+   > If you are required to disable virus scanning software, you should first scan the computer that runs the App-V 5.0 Sequencer in order to ensure that no unwanted or malicious files can be added to the package.
 
-     
 
-4.  On the **Type of Application** page, select **Middleware**, and then click **Next**.
 
-5.  On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
+4. On the **Type of Application** page, select **Middleware**, and then click **Next**.
 
-6.  On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console.
+5. On the **Select Installer** page, click **Browse** and specify the installation file for the application. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Select this option to perform a custom installation** check box, and then click **Next**.
 
-    Click **Next**.
+6. On the **Package Name** page, type a name that will be associated with the package. Use a name that helps identify the purpose and version of the application that will be added to the package. The package name is displayed in the App-V 5.0 Management Console.
 
-7.  On the **Installation** page, when the sequencer and middleware application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**.
+   Click **Next**.
 
-8.  On the **Installation** page, wait while the sequencer configures the virtual application package.
+7. On the **Installation** page, when the sequencer and middleware application installer are ready you can proceed to install the application so that the sequencer can monitor the installation process. Use the application's installation process to perform the installation. If additional installation files must be run as part of the installation, click **Run**, to locate and run the additional installation files. When you are finished with the installation, select the **I am finished installing** check box, and then click **Next**.
 
-9.  On the **Installation Report** page, you can review information about the virtual application package that you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**.
+8. On the **Installation** page, wait while the sequencer configures the virtual application package.
+
+9. On the **Installation Report** page, you can review information about the virtual application package that you have just sequenced. In **Additional Information**, double-click an event to obtain more detailed information. To proceed, click **Next**.
 
 10. On the **Target OS** page, specify the operating systems that can run this package. To enable all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box and select the operating systems that can run this package. Click **Next**.
 
@@ -254,32 +271,36 @@ ms.date: 06/16/2016
 
     To save the package immediately, select **Save the package now**. Optionally, add a **Description** to be associated with the package. Descriptions are useful for identifying the program version and other information about the package.
 
-    > [!IMPORTANT]  
+    > [!IMPORTANT]
     > The system does not support non-printable characters in Comments and Descriptions.
 
-     
 
-    The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**.
+
+~~~
+The default **Save Location** is also displayed on this page. To change the default location, click **Browse** and specify the new location. Click **Create**.
+~~~
 
 12. The **Completion** page is displayed. Review the information in the **Virtual Application Package Report** pane as needed, then click **Close**. This information is also available in the **Report.xml** file that is located in the directory specified in step 11 of this procedure.
 
-    The package is now available in the sequencer. To edit the package properties, click **Edit \[Package Name\]**.
+   The package is now available in the sequencer. To edit the package properties, click **Edit \[Package Name\]**.
 
-    > [!IMPORTANT]  
-    > After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer.
+   > [!IMPORTANT]
+   > After you have successfully created a virtual application package, you cannot run the virtual application package on the computer that is running the sequencer.
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-50.md b/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-50.md
index f4b088d730..d9728ec6c1 100644
--- a/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-50.md
+++ b/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-50.md
@@ -1,8 +1,11 @@
 ---
 title: How to Sequence a Package by Using PowerShell
 description: How to Sequence a Package by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: b41feed9-d1c5-48a3-940c-9a21d594f4f8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Use the following procedure to create a new App-V 5.0 package using PowerShell.
 **Note**  
 Before you use this procedure you must copy the associated installer files to the computer running the sequencer and you have read and understand the sequencer section of [Planning for the App-V 5.0 Sequencer and Client Deployment](planning-for-the-app-v-50-sequencer-and-client-deployment.md).
 
- 
+ 
 
 **To create a new virtual application using PowerShell**
 
@@ -53,20 +56,20 @@ Before you use this procedure you must copy the associated installer files to th
 
     -   InstallMediaPath - specifies the path to where the installation media is
 
-    -   TemplateFilePath - specifies the path to a template fileif you want to customize the sequencing process.
+    -   TemplateFilePath - specifies the path to a template file if you want to customize the sequencing process.
 
     -   FullLoad - specifies that the package must be fully downloaded to the computer running the App-V 5.0 before it can be opened.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
 
 [Administering App-V by Using PowerShell](administering-app-v-by-using-powershell.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-51.md b/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-51.md
index 998425d501..8a8c74258e 100644
--- a/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-51.md
+++ b/mdop/appv-v5/how-to-sequence-a-package--by-using-powershell-51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Sequence a Package by Using PowerShell
 description: How to Sequence a Package by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 6134c6be-937d-4609-a516-92d49154b290
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Use the following procedure to create a new App-V 5.1 package using PowerShell.
 **Note**  
 Before you use this procedure you must copy the associated installer files to the computer running the sequencer and you have read and understand the sequencer section of [Planning for the App-V 5.1 Sequencer and Client Deployment](planning-for-the-app-v-51-sequencer-and-client-deployment.md).
 
- 
+ 
 
 **To create a new virtual application using PowerShell**
 
@@ -53,7 +56,7 @@ Before you use this procedure you must copy the associated installer files to th
 
     -   InstallMediaPath - specifies the path to where the installation media is
 
-    -   TemplateFilePath - specifies the path to a template fileif you want to customize the sequencing process.
+    -   TemplateFilePath - specifies the path to a template file if you want to customize the sequencing process.
 
     -   FullLoad - specifies that the package must be fully downloaded to the computer running the App-V 5.1 before it can be opened.
 
@@ -64,9 +67,9 @@ Before you use this procedure you must copy the associated installer files to th
 
 [Administering App-V 5.1 by Using PowerShell](administering-app-v-51-by-using-powershell.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md b/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md
index 67e316e135..1979f1b044 100644
--- a/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md
+++ b/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console.md
@@ -1,8 +1,11 @@
 ---
 title: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console
 description: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: d41d64a0-0333-4951-ab27-db595bf0f634
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -26,7 +29,7 @@ Use the following procedure to transfer the access and default package configura
 
     If you select **transfer access and configurations from**, then all access permissions, as well as the configuration settings, will be copied.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md b/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md
index bf5b6f591c..17e0975836 100644
--- a/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md
+++ b/mdop/appv-v5/how-to-transfer-access-and-configurations-to-another-version-of-a-package-by-using-the-management-console51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console
 description: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: bf53f064-76ae-4eac-9266-d087c480cda7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/how-to-uninstall-the-app-v-50-client.md b/mdop/appv-v5/how-to-uninstall-the-app-v-50-client.md
index b2dde99a04..b30443d81b 100644
--- a/mdop/appv-v5/how-to-uninstall-the-app-v-50-client.md
+++ b/mdop/appv-v5/how-to-uninstall-the-app-v-50-client.md
@@ -1,8 +1,11 @@
 ---
 title: How to Uninstall the App-V 5.0 Client
 description: How to Uninstall the App-V 5.0 Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 7566fb19-8d52-439a-be42-e004d95fed6f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 Use the following procedure to uninstall the App-V 5.0 client from a computer. When you uninstall the App-V 5.0 client all packages published to the computer running the client are also removed. If the uninstall operation does not complete the packages will need to be re-published to the computer running the App-V 5.0 client.
 
-**Important**  
+**Important**  
 You should ensure that the App-V 5.0 client service is running prior to performing the uninstall procedure.
 
- 
+
 
 **To uninstall the App-V 5.0 Client**
 
@@ -27,28 +30,30 @@ You should ensure that the App-V 5.0 client service is running prior to performi
 
 2.  In the dialog box that appears, click **Yes** to continue with the uninstall process.
 
-    **Important**  
+    **Important**  
     The uninstall process cannot be canceled or interrupted.
 
-     
+
 
 3.  A progress bar shows the time remaining. When this step finishes, you must restart the computer so that all associated drivers can be stopped to complete the uninstall process.
 
-    **Note**  
+    **Note**  
     You can also use the command line to uninstall the App-V 5.0 client with the following switch: **/UNINSTALL**.
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Deploying App-V 5.0](deploying-app-v-50.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-uninstall-the-app-v-51-client.md b/mdop/appv-v5/how-to-uninstall-the-app-v-51-client.md
index 5a77f880e1..119e3fda37 100644
--- a/mdop/appv-v5/how-to-uninstall-the-app-v-51-client.md
+++ b/mdop/appv-v5/how-to-uninstall-the-app-v-51-client.md
@@ -1,8 +1,11 @@
 ---
 title: How to Uninstall the App-V 5.1 Client
 description: How to Uninstall the App-V 5.1 Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 21f2d946-fc9f-4cd3-899b-ac52b3fbc306
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 Use the following procedure to uninstall the Microsoft Application Virtualization (App-V) 5.1 client from a computer. When you uninstall the App-V 5.1 client all packages published to the computer running the client are also removed. If the uninstall operation does not complete the packages will need to be re-published to the computer running the App-V 5.1 client.
 
-**Important**  
+**Important**  
 You should ensure that the App-V 5.1 client service is running prior to performing the uninstall procedure.
 
- 
+
 
 **To uninstall the App-V 5.1 Client**
 
@@ -27,28 +30,30 @@ You should ensure that the App-V 5.1 client service is running prior to performi
 
 2.  In the dialog box that appears, click **Yes** to continue with the uninstall process.
 
-    **Important**  
+    **Important**  
     The uninstall process cannot be canceled or interrupted.
 
-     
+
 
 3.  A progress bar shows the time remaining. When this step finishes, you must restart the computer so that all associated drivers can be stopped to complete the uninstall process.
 
-    **Note**  
+    **Note**  
     You can also use the command line to uninstall the App-V 5.1 client with the following switch: **/UNINSTALL**.
 
-     
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+
+~~~
+**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+~~~
 
 ## Related topics
 
 
 [Deploying App-V 5.1](deploying-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-50-application.md b/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-50-application.md
index a22b03afe0..0345a45113 100644
--- a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-50-application.md
+++ b/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-50-application.md
@@ -1,8 +1,9 @@
 ---
+ms.reviewer: 
 title: How to Use an App-V 4.6 Application From an App-V 5.0 Application
 description: How to Use an App-V 4.6 Application From an App-V 5.0 Application
 ms.assetid: 4e78cb32-9c8b-478e-ae8b-c474a7e42487
-author: jamiejdt
+author: msfttracyp
 ms.assetid: 4e78cb32-9c8b-478e-ae8b-c474a7e42487
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
@@ -27,7 +28,7 @@ Use the following procedure to run an App-V 4.6 application with App-V 5.0 appl
 
 4.  The converted application now runs using App-V 5.0 and you can open one application from the other. For example, if you converted a Microsoft Office package to an App-V 5.0 package and Adobe Acrobat is still running as an App-V 4.6 package, you can open an Adobe Acrobat Reader attachment using Microsoft Outlook.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
@@ -42,3 +43,6 @@ Use the following procedure to run an App-V 4.6 application with App-V 5.0 appl
 
 
 
+
+
+
diff --git a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md b/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md
index e1f20fa65c..ea81880476 100644
--- a/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md
+++ b/mdop/appv-v5/how-to-use-an-app-v-46-sp1-application-from-an-app-v-51-application.md
@@ -1,8 +1,11 @@
 ---
 title: How to Use an App-V 4.6 Application From an App-V 5.1 Application
 description: How to Use an App-V 4.6 Application From an App-V 5.1 Application
-author: jamiejdt
+author: dansimp
 ms.assetid: 909b4391-762b-4988-b0cf-32b67f1fcf0e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -37,9 +40,9 @@ This procedure assumes that you are running the latest version of App-V 4.6.
 
 [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md b/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md
index 91b56c8a74..d8239f46ed 100644
--- a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md
+++ b/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups.md
@@ -1,8 +1,11 @@
 ---
 title: How to Use Optional Packages in Connection Groups
 description: How to Use Optional Packages in Connection Groups
-author: jamiejdt
+author: dansimp
 ms.assetid: 4d08a81b-55e5-471a-91dc-9a684fb3c9a1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Starting in Microsoft Application Virtualization (App-V) 5.0 SP3, you can add op
 **Note**  
 **Optional packages are supported only in App-V 5.0 SP3.**
 
- 
+ 
 
 Before using optional packages, see [Requirements for using optional packages in connection groups](#bkmk-reqs-using-cg).
 
@@ -36,19 +39,19 @@ Before using optional packages, see [Requirements for using optional packages in
 
 
 
-
    [Use one connection group, with optional packages, for multiple users who have different packages entitled to them](#bkmk-apps-plugs-optional)
    
+
    Use one connection group, with optional packages, for multiple users who have different packages entitled to them
    
 
    Use a single connection group to make different groups of applications and plug-ins available to different end users.
    
 
    For example, you want to distribute Microsoft Office to all end users, but distribute different plug-ins to different subsets of users.
    
 
 
-
    [Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group](#bkmk-unpub-del-optl-pkg)
    
+
    Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group
    
 
    Unpublish, delete, or republish an optional package without having to disable, remove, edit, add, and re-enable the connection group on the App-V Client.
    
 
    You can also unpublish the optional package and republish it later without having to disable or republish the connection group.
    
 
 
 
 
- 
+ 
 
 ## Use one connection group, with optional packages, for multiple users with different packages entitled to them
 
@@ -116,7 +119,7 @@ Before using optional packages, see [Requirements for using optional packages in
 
    Example connection group XML document with optional packages:
    
 
    <?xml version="1.0" ?>
 <AppConnectionGroup
-   xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup"
+   xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup";
    AppConnectionGroupId="8105CCD5-244B-4BA1-8888-E321E688D2CB"
    VersionId="84CE3797-F1CB-4475-A223-757918929EB4"
    DisplayName="Contoso Software Connection Group" >
@@ -162,7 +165,7 @@ Before using optional packages, see [Requirements for using optional packages in
 
 
 
- 
+ 
 
 ## Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group
 
@@ -210,7 +213,7 @@ Before using optional packages, see [Requirements for using optional packages in
 
  • Unpublish-AppvClientPackage
    • 
 
  • Remove-AppvClientPackage
    • 
 
-
    For more information, see [How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-50-packages-running-on-a-stand-alone-computer-by-using-powershell.md).
    
+
    For more information, see How to Manage App-V 5.0 Packages Running on a Stand-Alone Computer by Using PowerShell.
    
 
 
 
@@ -229,7 +232,7 @@ Before using optional packages, see [Requirements for using optional packages in
 
 
 
- 
+ 
 
 ## Requirements for using optional packages in connection groups
 
@@ -276,7 +279,7 @@ Review the following requirements before using optional packages in connection g
 
 
 
- 
+ 
 
 
 
@@ -288,9 +291,9 @@ Review the following requirements before using optional packages in connection g
 
 [Managing Connection Groups](managing-connection-groups.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md b/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md
index c43e18358d..8a87b7ff92 100644
--- a/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md
+++ b/mdop/appv-v5/how-to-use-optional-packages-in-connection-groups51.md
@@ -1,8 +1,11 @@
 ---
 title: How to Use Optional Packages in Connection Groups
 description: How to Use Optional Packages in Connection Groups
-author: jamiejdt
+author: dansimp
 ms.assetid: 67666f18-b704-4852-a1e4-d13633bd2baf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Starting in Microsoft Application Virtualization (App-V) 5.0 SP3, you can add op
 **Note**  
 **Optional packages are not supported in releases prior to App-V 5.0 SP3.**
 
- 
+ 
 
 Before using optional packages, see [Requirements for using optional packages in connection groups](#bkmk-reqs-using-cg).
 
@@ -36,19 +39,19 @@ Before using optional packages, see [Requirements for using optional packages in
 
 
 
-
    [Use one connection group, with optional packages, for multiple users who have different packages entitled to them](#bkmk-apps-plugs-optional)
    
+
    Use one connection group, with optional packages, for multiple users who have different packages entitled to them
    
 
    Use a single connection group to make different groups of applications and plug-ins available to different end users.
    
 
    For example, you want to distribute Microsoft Office to all end users, but distribute different plug-ins to different subsets of users.
    
 
 
-
    [Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group](#bkmk-unpub-del-optl-pkg)
    
+
    Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group
    
 
    Unpublish, delete, or republish an optional package without having to disable, remove, edit, add, and re-enable the connection group on the App-V Client.
    
 
    You can also unpublish the optional package and republish it later without having to disable or republish the connection group.
    
 
 
 
 
- 
+ 
 
 ## Use one connection group, with optional packages, for multiple users with different packages entitled to them
 
@@ -115,7 +118,7 @@ Before using optional packages, see [Requirements for using optional packages in
 
    Example connection group XML document with optional packages:
    
 
    <?xml version="1.0" ?>
 <AppConnectionGroup
-   xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup"
+   xmlns="http://schemas.microsoft.com/appv/2014/virtualapplicationconnectiongroup";
    AppConnectionGroupId="8105CCD5-244B-4BA1-8888-E321E688D2CB"
    VersionId="84CE3797-F1CB-4475-A223-757918929EB4"
    DisplayName="Contoso Software Connection Group" >
@@ -161,7 +164,7 @@ Before using optional packages, see [Requirements for using optional packages in
 
 
 
- 
+ 
 
 ## Unpublish or delete an optional package, or unpublish an optional package and republish it later, without changing the connection group
 
@@ -209,7 +212,7 @@ Before using optional packages, see [Requirements for using optional packages in
 
  • Unpublish-AppvClientPackage
    • 
 
  • Remove-AppvClientPackage
    • 
 
-
    For more information, see [How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell](how-to-manage-app-v-51-packages-running-on-a-stand-alone-computer-by-using-powershell.md).
    
+
    For more information, see How to Manage App-V 5.1 Packages Running on a Stand-Alone Computer by Using PowerShell.
    
 
 
 
@@ -228,7 +231,7 @@ Before using optional packages, see [Requirements for using optional packages in
 
 
 
- 
+ 
 
 ## Requirements for using optional packages in connection groups
 
@@ -275,7 +278,7 @@ Review the following requirements before using optional packages in connection g
 
 
 
- 
+ 
 
 
 
@@ -287,9 +290,9 @@ Review the following requirements before using optional packages in connection g
 
 [Managing Connection Groups](managing-connection-groups51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md b/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md
deleted file mode 100644
index 88eb54d480..0000000000
--- a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-51.md
+++ /dev/null
@@ -1,51 +0,0 @@
----
-title: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console
-description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console
-author: jamiejdt
-ms.assetid: 1e1941d3-fb22-4077-8ec6-7a0cb80335d8
-ms.pagetype: mdop, appcompat, virtualization
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.prod: w10
-ms.date: 03/16/2017
----
-
-
-# How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console
-
-
-Use the following procedure to view and configure default package extensions.
-
-**To view and configure default virtual application extensions**
-
-1.  To view the package that you want to configure, open the App-V 5.1 Management Console. Select the package that you want to configure, right-click the package name and select **edit default configuration**.
-
-2.  To view the applications contained in the specified package, in the **Default Configuration** pane, click **Applications**. To view the shortcuts for that package, click **Shortcuts**. To view the file type associations for that package, click **File Types**.
-
-3.  To enable the application extensions, select **ENABLE**.
-
-    To enable shortcuts, select **ENABLE SHORTCUTS**. To add a new shortcut for the selected application, right-click the application in the **SHORTCUTS** pane and select **Add new shortcut**. To remove a shortcut, right-click the application in the **SHORTCUTS** pane and select **Remove Shortcut**. To edit an existing shortcut, right-click the application and select **Edit Shortcut**.
-
-4.  To view any other application extensions, click **Advanced** and click **Export Configuration**. Type in a filename and click **Save**. You can view all application extensions associated with the package using the configuration file.
-
-5.  To edit other application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog box, click **Overwrite** to complete the process.
-
->**Note** If the upload fails and the size of your configuration file is above 4MB, you will need to increase the maximum file size allowed by the server. This can be done by adding the maxRequestLength attribute with a value greater than the size of your configuration file (in KB) to the httpRuntime element on line 26 of `C:\Program Files\Microsoft Application Virtualization Server\ManagementService\Web.config`.  
-For example, changing `` to `` will increase the maximum size to 8MB
-
-
-**Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
-
-## Related topics
-
-
-[Operations for App-V 5.1](operations-for-app-v-51.md)
-
- 
-
- 
-
-
-
-
-
diff --git a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md b/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md
index c0c8af3a23..96723eea3e 100644
--- a/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md
+++ b/mdop/appv-v5/how-to-view-and-configure-applications-and-default-virtual-application-extensions-by-using-the-management-console-beta.md
@@ -1,8 +1,11 @@
 ---
 title: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console
 description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: c77e6662-7a18-4da1-8da8-b58068b65fa1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -30,7 +33,7 @@ Use the following procedure to view and configure default package extensions.
 
 5.  To edit other application extensions, modify the configuration file and click **Import and Overwrite this Configuration**. Select the modified file and click **Open**. In the dialog box, click **Overwrite** to complete the process.
 
-    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issu**e? Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
+    **Got a suggestion for App-V**? Add or vote on suggestions [here](http://appv.uservoice.com/forums/280448-microsoft-application-virtualization). **Got an App-V issue?** Use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopappv).
 
 ## Related topics
 
diff --git a/mdop/appv-v5/index.md b/mdop/appv-v5/index.md
index ca33b4be38..c51ad7bc30 100644
--- a/mdop/appv-v5/index.md
+++ b/mdop/appv-v5/index.md
@@ -1,7 +1,7 @@
 ---
 title: Application Virtualization 5
 description: Application Virtualization 5
-author: jamiejdt
+author: dansimp
 ms.assetid: e82eb44b-9ccd-41aa-923b-71400230ad23
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
diff --git a/mdop/appv-v5/maintaining-app-v-50.md b/mdop/appv-v5/maintaining-app-v-50.md
index 0abd36efa4..a8cfb7715b 100644
--- a/mdop/appv-v5/maintaining-app-v-50.md
+++ b/mdop/appv-v5/maintaining-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: Maintaining App-V 5.0
 description: Maintaining App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 66851ec3-c674-493b-ad6d-db8fcbf1956c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -14,7 +17,7 @@ ms.date: 06/16/2016
 # Maintaining App-V 5.0
 
 
-After you have completed all the necessary planning, and then deployment of App-V 5.0, you can use the following information to maiantain the App-V 5.0 infrastructure.
+After you have completed all the necessary planning, and then deployment of App-V 5.0, you can use the following information to maintain the App-V 5.0 infrastructure.
 
 ## Move the App-V 5.0 Server
 
diff --git a/mdop/appv-v5/maintaining-app-v-51.md b/mdop/appv-v5/maintaining-app-v-51.md
index 94b2057911..005a024a2b 100644
--- a/mdop/appv-v5/maintaining-app-v-51.md
+++ b/mdop/appv-v5/maintaining-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: Maintaining App-V 5.1
 description: Maintaining App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 5abd17d3-e8af-4261-b914-741ae116b0e7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/managing-connection-groups.md b/mdop/appv-v5/managing-connection-groups.md
index a1c4180e77..1c3c341ef5 100644
--- a/mdop/appv-v5/managing-connection-groups.md
+++ b/mdop/appv-v5/managing-connection-groups.md
@@ -1,8 +1,11 @@
 ---
 title: Managing Connection Groups
 description: Managing Connection Groups
-author: jamiejdt
+author: dansimp
 ms.assetid: 1a9c8f26-f421-4b70-b7e2-da8118e8198c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Connection groups enable the applications within a package to interact with each
 **Note**  
 In previous versions of App-V 5.0, connection groups were referred to as Dynamic Suite Composition.
 
- 
+ 
 
 **In this topic:**
 
@@ -30,33 +33,33 @@ In previous versions of App-V 5.0, connection groups were referred to as Dynamic
 
 
 
-
    [About the Connection Group Virtual Environment](about-the-connection-group-virtual-environment.md)
    
+
    About the Connection Group Virtual Environment
    
 
    Describes the connection group virtual environment.
    
 
 
-
    [About the Connection Group File](about-the-connection-group-file.md)
    
+
    About the Connection Group File
    
 
    Describes the connection group file.
    
 
 
-
    [How to Create a Connection Group](how-to-create-a-connection-group.md)
    
+
    How to Create a Connection Group
    
 
    Explains how to create a new connection group.
    
 
 
-
    [How to Create a Connection Group with User-Published and Globally Published Packages](how-to-create-a-connection-group-with-user-published-and-globally-published-packages.md)
    
+
    How to Create a Connection Group with User-Published and Globally Published Packages
    
 
    Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally.
    
 
 
-
    [How to Delete a Connection Group](how-to-delete-a-connection-group.md)
    
+
    How to Delete a Connection Group
    
 
    Explains how to delete a connection group.
    
 
 
-
    [How to Publish a Connection Group](how-to-publish-a-connection-group.md)
    
+
    How to Publish a Connection Group
    
 
    Explains how to publish a connection group.
    
 
 
 
 
- 
+ 
 
 
 
@@ -68,9 +71,9 @@ In previous versions of App-V 5.0, connection groups were referred to as Dynamic
 
 -   [Operations for App-V 5.0](operations-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/managing-connection-groups51.md b/mdop/appv-v5/managing-connection-groups51.md
index c325456217..43554b1ff9 100644
--- a/mdop/appv-v5/managing-connection-groups51.md
+++ b/mdop/appv-v5/managing-connection-groups51.md
@@ -1,8 +1,11 @@
 ---
 title: Managing Connection Groups
 description: Managing Connection Groups
-author: jamiejdt
+author: dansimp
 ms.assetid: 22c9d3cb-7246-4173-9742-4ba1c24b0a6a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Connection groups enable the applications within a package to interact with each
 **Note**  
 In some previous versions of App-V, connection groups were referred to as Dynamic Suite Composition.
 
- 
+ 
 
 **In this topic:**
 
@@ -30,33 +33,33 @@ In some previous versions of App-V, connection groups were referred to as Dynami
 
 
 
-
    [About the Connection Group Virtual Environment](about-the-connection-group-virtual-environment51.md)
    
+
    About the Connection Group Virtual Environment
    
 
    Describes the connection group virtual environment.
    
 
 
-
    [About the Connection Group File](about-the-connection-group-file51.md)
    
+
    About the Connection Group File
    
 
    Describes the connection group file.
    
 
 
-
    [How to Create a Connection Group](how-to-create-a-connection-group51.md)
    
+
    How to Create a Connection Group
    
 
    Explains how to create a new connection group.
    
 
 
-
    [How to Create a Connection Group with User-Published and Globally Published Packages](how-to-create-a-connection-group-with-user-published-and-globally-published-packages51.md)
    
+
    How to Create a Connection Group with User-Published and Globally Published Packages
    
 
    Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally.
    
 
 
-
    [How to Delete a Connection Group](how-to-delete-a-connection-group51.md)
    
+
    How to Delete a Connection Group
    
 
    Explains how to delete a connection group.
    
 
 
-
    [How to Publish a Connection Group](how-to-publish-a-connection-group51.md)
    
+
    How to Publish a Connection Group
    
 
    Explains how to publish a connection group.
    
 
 
 
 
- 
+ 
 
 
 
@@ -68,9 +71,9 @@ In some previous versions of App-V, connection groups were referred to as Dynami
 
 -   [Operations for App-V 5.1](operations-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md b/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md
index a1be89fa9a..fdfc5ef202 100644
--- a/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md
+++ b/mdop/appv-v5/microsoft-application-virtualization-50-administrators-guide.md
@@ -1,8 +1,11 @@
 ---
 title: Microsoft Application Virtualization 5.0 Administrator's Guide
 description: Microsoft Application Virtualization 5.0 Administrator's Guide
-author: jamiejdt
+author: dansimp
 ms.assetid: c46e94b5-32cd-4377-8dc3-8163539be897
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md b/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md
index 4df47b66b2..b5120b6279 100644
--- a/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md
+++ b/mdop/appv-v5/microsoft-application-virtualization-51-administrators-guide.md
@@ -1,8 +1,11 @@
 ---
 title: Microsoft Application Virtualization 5.1 Administrator's Guide
 description: Microsoft Application Virtualization 5.1 Administrator's Guide
-author: jamiejdt
+author: dansimp
 ms.assetid: 3049996a-7253-4599-a29a-1b58f9ab14a4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md b/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md
index 210fd210db..c3d4ae514c 100644
--- a/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md
+++ b/mdop/appv-v5/migrating-from-a-previous-version-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: Migrating from a Previous Version
 description: Migrating from a Previous Version
-author: jamiejdt
+author: dansimp
 ms.assetid: a13cd353-b22a-48f7-af1e-5d54ede2a7e5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -21,7 +24,7 @@ Consider the following sections when you plan your migration strategy:
 **Note**  
 For more information about the differences between App-V 4.6 and App-V 5.0, see the **Differences between App-V 4.6 and App-V 5.0 section** of [About App-V 5.0](about-app-v-50.md).
 
- 
+ 
 
 ## Converting packages created using a prior version of App-V
 
@@ -31,7 +34,7 @@ Use the package converter utility to upgrade virtual application packages create
 **Important**  
 After you convert an existing package you should test the package prior to deploying the package to ensure the conversion process was successful.
 
- 
+ 
 
 **What to know before you convert existing packages**
 
@@ -57,7 +60,7 @@ After you convert an existing package you should test the package prior to deplo
 
 
 
    Virtual packages using DSC are not linked after conversion.
    
-
    Link the packages using connection groups. See [Managing Connection Groups](managing-connection-groups.md).
    
+
    Link the packages using connection groups. See Managing Connection Groups.
    
 
 
 
    Environment variable conflicts are detected during conversion.
    
@@ -70,7 +73,7 @@ After you convert an existing package you should test the package prior to deplo
 
 
 
- 
+ 
 
 When converting a package check for failing files or shortcuts. Locate the item in App-V 4.6 package. It could possibly be hard-coded path. Convert the path.
 
@@ -79,7 +82,7 @@ It is recommended that you use the App-V 5.0 sequencer for converting critical a
 
 If a converted package does not open after you convert it, it is also recommended that you re-sequence the application using the App-V 5.0 sequencer.
 
- 
+ 
 
 [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v.md)
 
@@ -102,25 +105,25 @@ The following table displays the recommended method for upgrading clients.
 
 
 
    Upgrade your environment to App-V 4.6 SP2
    
-
    [Application Virtualization Deployment and Upgrade Considerations](../appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md).
    
+
    Application Virtualization Deployment and Upgrade Considerations.
    
 
 
 
    Install the App-V 5.0 client with co-existence enabled.
    
-
    [How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--50-client-on-the-same-computer.md).
    
+
    How to Deploy the App-V 4.6 and the App-V 5.0 Client on the Same Computer.
    
 
 
 
    Sequence and roll out App-V 5.0 packages. As needed, unpublish App-V 4.6 packages.
    
-
    [How to Sequence a New Application with App-V 5.0](how-to-sequence-a-new-application-with-app-v-50-beta-gb18030.md).
    
+
    How to Sequence a New Application with App-V 5.0.
    
 
 
 
 
- 
+ 
 
 **Important**  
 You must be running App-V 4.6 SP3 to use coexistence mode. Additionally, when you sequence a package, you must configure the Managing Authority setting, which is in the **User Configuration** is located in the **User Configuration** section.
 
- 
+ 
 
 ## Migrating the App-V 5.0 Server Full Infrastructure
 
@@ -141,15 +144,15 @@ There is no direct method to upgrade to a full App-V 5.0 infrastructure. Use the
 
 
 
    Upgrade your environment to App-V 4.6 SP3.
    
-
    [Application Virtualization Deployment and Upgrade Considerations](../appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md).
    
+
    Application Virtualization Deployment and Upgrade Considerations.
    
 
 
 
    Deploy App-V 5.0 version of the client.
    
-
    [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-gb18030.md).
    
+
    How to Deploy the App-V Client.
    
 
 
 
    Install App-V 5.0 server.
    
-
    [How to Deploy the App-V 5.0 Server](how-to-deploy-the-app-v-50-server-50sp3.md).
    
+
    How to Deploy the App-V 5.0 Server.
    
 
 
 
    Migrate existing packages.
    
@@ -158,7 +161,7 @@ There is no direct method to upgrade to a full App-V 5.0 infrastructure. Use the
 
 
 
- 
+ 
 
 ## Additional Migration tasks
 
@@ -186,9 +189,9 @@ You can also perform additional migration tasks such as reconfiguring end points
 
 [A simplified Microsoft App-V 5.1 Management Server upgrade procedure](https://go.microsoft.com/fwlink/p/?LinkId=786330)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md b/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md
index 325d571bbf..3692e67c10 100644
--- a/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md
+++ b/mdop/appv-v5/migrating-to-app-v-51-from-a-previous-version.md
@@ -1,8 +1,11 @@
 ---
 title: Migrating to App-V 5.1 from a Previous Version
 description: Migrating to App-V 5.1 from a Previous Version
-author: jamiejdt
+author: dansimp
 ms.assetid: e7ee0edc-7544-4c0a-aaca-d922a33bc1bb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -22,7 +25,7 @@ App-V 5.1 packages are exactly the same as App-V 5.0 packages. There has been no
 
 For more information about the differences between App-V 4.6 and App-V 5.1, see the **Differences between App-V 4.6 and App-V 5.0 section** of [About App-V 5.0](about-app-v-50.md).
 
- 
+ 
 
 ## Improvements to the App-V 5.1 Package Converter
 
@@ -59,7 +62,7 @@ You can also use the `–OSDsToIncludeInPackage` parameter with the `ConvertFrom
 
 
 
- 
+ 
 
 ### Example conversion statement
 
@@ -165,7 +168,7 @@ ConvertFrom-AppvLegacyPackage –SourcePath \\OldPkgStore\ContosoApp\
 
 
 
- 
+ 
 
 ## Converting packages created using a prior version of App-V
 
@@ -175,7 +178,7 @@ Use the package converter utility to upgrade virtual application packages create
 **Important**  
 After you convert an existing package you should test the package prior to deploying the package to ensure the conversion process was successful.
 
- 
+ 
 
 **What to know before you convert existing packages**
 
@@ -193,7 +196,7 @@ After you convert an existing package you should test the package prior to deplo
 
 
 
    Virtual packages using DSC are not linked after conversion.
    
-
    Link the packages using connection groups. See [Managing Connection Groups](managing-connection-groups51.md).
    
+
    Link the packages using connection groups. See Managing Connection Groups.
    
 
 
 
    Environment variable conflicts are detected during conversion.
    
@@ -206,7 +209,7 @@ After you convert an existing package you should test the package prior to deplo
 
 
 
- 
+ 
 
 When converting a package check for failing files or shortcuts. Locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path.
 
@@ -215,7 +218,7 @@ It is recommended that you use the App-V 5.1 sequencer for converting critical a
 
 If a converted package does not open after you convert it, it is also recommended that you re-sequence the application using the App-V 5.1 sequencer.
 
- 
+ 
 
 [How to Convert a Package Created in a Previous Version of App-V](how-to-convert-a-package-created-in-a-previous-version-of-app-v51.md)
 
@@ -238,25 +241,25 @@ The following table displays the recommended method for upgrading clients.
 
 
 
    Upgrade your environment to the latest version of App-V 4.6
    
-
    [Application Virtualization Deployment and Upgrade Considerations](../appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md).
    
+
    Application Virtualization Deployment and Upgrade Considerations.
    
 
 
 
    Install the App-V 5.1 client with co-existence enabled.
    
-
    [How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer](how-to-deploy-the-app-v-46-and-the-app-v--51-client-on-the-same-computer.md).
    
+
    How to Deploy the App-V 4.6 and the App-V 5.1 Client on the Same Computer.
    
 
 
 
    Sequence and roll out App-V 5.1 packages. As needed, unpublish App-V 4.6 packages.
    
-
    [How to Sequence a New Application with App-V 5.1](how-to-sequence-a-new-application-with-app-v-51-beta-gb18030.md).
    
+
    How to Sequence a New Application with App-V 5.1.
    
 
 
 
 
- 
+ 
 
 **Important**  
 You must be running the latest version of App-V 4.6 to use coexistence mode. Additionally, when you sequence a package, you must configure the Managing Authority setting, which is in the **User Configuration** is located in the **User Configuration** section.
 
- 
+ 
 
 ## Migrating the App-V 5.1 Server Full Infrastructure
 
@@ -277,15 +280,15 @@ There is no direct method to upgrade to a full App-V 5.1 infrastructure. Use the
 
 
 
    Upgrade your environment to the latest version of App-V 4.6.
    
-
    [Application Virtualization Deployment and Upgrade Considerations](../appv-v4/application-virtualization-deployment-and-upgrade-considerations-copy.md).
    
+
    Application Virtualization Deployment and Upgrade Considerations.
    
 
 
 
    Deploy App-V 5.1 version of the client.
    
-
    [How to Deploy the App-V Client](how-to-deploy-the-app-v-client-51gb18030.md).
    
+
    How to Deploy the App-V Client.
    
 
 
 
    Install App-V 5.1 server.
    
-
    [How to Deploy the App-V 5.1 Server](how-to-deploy-the-app-v-51-server.md).
    
+
    How to Deploy the App-V 5.1 Server.
    
 
 
 
    Migrate existing packages.
    
@@ -294,7 +297,7 @@ There is no direct method to upgrade to a full App-V 5.1 infrastructure. Use the
 
 
 
- 
+ 
 
 ## Additional Migration tasks
 
@@ -322,9 +325,9 @@ You can also perform additional migration tasks such as reconfiguring end points
 
 [A simplified Microsoft App-V 5.1 Management Server upgrade procedure](https://go.microsoft.com/fwlink/p/?LinkId=786330)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/operations-for-app-v-50.md b/mdop/appv-v5/operations-for-app-v-50.md
index c5bd02a3de..3df456161b 100644
--- a/mdop/appv-v5/operations-for-app-v-50.md
+++ b/mdop/appv-v5/operations-for-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: Operations for App-V 5.0
 description: Operations for App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 4d0d41a6-f7da-4a2f-8ac9-2d67cc18ea93
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/operations-for-app-v-51.md b/mdop/appv-v5/operations-for-app-v-51.md
index e289af08ec..8a97413907 100644
--- a/mdop/appv-v5/operations-for-app-v-51.md
+++ b/mdop/appv-v5/operations-for-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: Operations for App-V 5.1
 description: Operations for App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: dd13b5c9-2d1e-442f-91e4-43dec7f17ea2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md b/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md
index 538d1e5db2..d8aa6ae42a 100644
--- a/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md
+++ b/mdop/appv-v5/performance-guidance-for-application-virtualization-50.md
@@ -1,8 +1,11 @@
 ---
 title: Performance Guidance for Application Virtualization 5.0
 description: Performance Guidance for Application Virtualization 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 6b3a3255-b957-4b9b-8bfc-a93fe8438a81
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -26,10 +29,10 @@ You should read and understand the following information before reading this doc
 
 -   [Microsoft Application Virtualization 5.0 Sequencing Guide](https://go.microsoft.com/fwlink/?LinkId=269953)
 
-**Note**  
-Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk **\*** review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document.
+**Note**  
+Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk **\\*** review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document.
+
 
- 
 
 Finally, this document will provide you with the information to configure the computer running App-V 5.0 client and the environment for optimal performance. Optimize your virtual application packages for performance using the sequencer, and to understand how to use User Experience Virtualization (UE-V) or other user environment management technologies to provide the optimal user experience with App-V 5.0 in both Remote Desktop Services (RDS) and non-persistent virtual desktop infrastructure (VDI).
 
@@ -52,7 +55,7 @@ Use the information in the following section for more information:
 
 -   Steps to Prepare the Base Image – Whether in a non-persistent VDI or RDSH environment, only a few steps must be completed in the base image to enable this approach.
 
--   Use UE-V 2.0 as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution.
+-   Use UE-V 2.0 as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution.
 
 [User Experience Walk-through](#bkmk-uewt)
 
@@ -85,7 +88,7 @@ Deployment Environment
 
 
 
- 
+
 
 Expected Configuration
 
@@ -106,7 +109,7 @@ Expected Configuration
 
 
 
- 
+
 
 IT Administration
 
@@ -123,7 +126,7 @@ IT Administration
 
 
 
- 
+
 
 ### Usage Scenario
 
@@ -150,7 +153,7 @@ As you review the two scenarios, keep in mind that these approach the extremes.
 
 
 
- 
+
 
 ### Preparing your Environment
 
@@ -175,7 +178,7 @@ The following table displays the required steps to prepare the base image and th
 
      
 
    • Install the Hotfix Package 4 for Application Virtualization 5.0 SP2 client version of the client.
      • 
 
    • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.
      • 
-
    • Configure for Shared Content Store (SCS) mode. For more information see [How to Install the App-V 5.0 Client for Shared Content Store Mode](how-to-install-the-app-v-50-client-for-shared-content-store-mode.md).
      • 
+
    • Configure for Shared Content Store (SCS) mode. For more information see How to Install the App-V 5.0 Client for Shared Content Store Mode.
      • 
 
    • Configure Preserve User Integrations on Login Registry DWORD.
      • 
 
    • Pre-configure all user- and global-targeted packages for example, Add-AppvClientPackage.
      • 
 
    • Pre-configure all user- and global-targeted connection groups for example, Add-AppvClientConnectionGroup.
      • 
@@ -195,7 +198,7 @@ The following table displays the required steps to prepare the base image and th
 
        
 
      • Install the Hotfix Package 4 for Application Virtualization 5.0 SP2 client version of the client.
        • 
 
      • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.
        • 
-
      • Configure for Shared Content Store (SCS) mode. For more information see [How to Install the App-V 5.0 Client for Shared Content Store Mode](how-to-install-the-app-v-50-client-for-shared-content-store-mode.md).
        • 
+
      • Configure for Shared Content Store (SCS) mode. For more information see How to Install the App-V 5.0 Client for Shared Content Store Mode.
        • 
 
      • Configure Preserve User Integrations on Login Registry DWORD.
        • 
 
      • Pre-configure all global-targeted packages for example, Add-AppvClientPackage.
        • 
 
      • Pre-configure all global-targeted connection groups for example, Add-AppvClientConnectionGroup.
        • 
@@ -206,7 +209,7 @@ The following table displays the required steps to prepare the base image and th
 
 
 
- 
+
 
 **Configurations** - For critical App-V Client configurations and for a little more context and how-to, review the following information:
 
@@ -248,7 +251,7 @@ The following table displays the required steps to prepare the base image and th
 
 
        MaxConcurrentPublishingRefresh
        
 
          
-
        • Configure in the Registry under HKEY_LOCAL_MACHINE \Software \ Microsoft \ AppV \Client \ Publishing.
          • 
+
        • Configure in the Registry under HKEY_LOCAL_MACHINE <strong>Software \ Microsoft \ AppV <strong>Client \ Publishing.
          • 
 
        • Create the DWORD value MaxConcurrentPublishingrefresh with the desired maximum number of concurrent publishing refreshes.
          • 
 
        • The App-V client service and computer do not need to be restarted.
          • 
 
        
@@ -259,7 +262,7 @@ The following table displays the required steps to prepare the base image and th
 
 
 
- 
+
 
 ### Configure UE-V solution for App-V Approach
 
@@ -269,7 +272,7 @@ For more information see [Getting Started With User Experience Virtualization 2.
 
 In essence all that is required is to install the UE-V client and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](https://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information around UE-V templates see [The UE-V specific resource for acquiring and registering the template](https://technet.microsoft.com/library/dn458936.aspx).
 
-**Note**  
+**Note**  
 Without performing an additional configuration step, the Microsoft User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default.
 
 UE-V will only support removing the .lnk file type from the exclusion list in the RDS and VDI scenarios, where every user’s device will have the same set of applications installed to the same location and every .lnk file is valid for all the users’ devices. For example, UE-V would not currently support the following 2 scenarios, because the net result will be that the shortcut will be valid on one but not all devices.
@@ -278,12 +281,12 @@ UE-V will only support removing the .lnk file type from the exclusion list in th
 
 -   If a user has an application installed on one device but not another with .lnk files enabled.
 
- 
 
-**Important**  
+
+**Important**  
 This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk.
 
- 
+
 
 Using the Microsoft Registry Editor (regedit.exe), navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **UEV** \\ **Agent** \\ **Configuration** \\ **ExcludedFileTypes** and remove **.lnk** from the excluded file types.
 
@@ -398,7 +401,7 @@ This following is a step-by-step walk-through of the App-V and UPM operations an
 
 
 
- 
+
 
 @@ -423,13 +426,13 @@ This following is a step-by-step walk-through of the App-V and UPM operations an
 
        
 

 
        
 
- 
+
 
 ### Impact to Package Life Cycle
 
 Upgrading a package is a crucial aspect of the package lifecycle. To help guarantee users have access to the appropriate upgraded (published) or downgraded (un-published) virtual application packages, it is recommended you update the base image to reflect these changes. To understand why review the following section:
 
-App-V 5.0 SP2 introduced the concept of pending states. In the past,
+App-V 5.0 SP2 introduced the concept of pending states. In the past,
 
 -   If an administrator changed entitlements or created a new version of a package (upgraded) and during a publishing/refresh that package was in-use, the un-publish or publish operation, respectively, would fail.
 
@@ -445,7 +448,7 @@ The following section contains lists with information about Microsoft documentat
 
 About NGEN technology
 
--   [How to speed up NGEN optimaztion](https://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx)
+-   [How to speed up NGEN optimization](https://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx)
 
 -   [Script](https://aka.ms/DrainNGenQueue)
 
@@ -453,11 +456,11 @@ About NGEN technology
 
 Server Performance Tuning Guidelines for
 
--   [Microsoft Windows Server 2012 R2](https://msdn.microsoft.com/library/windows/hardware/dn529133.aspx)
+-   [Microsoft Windows Server 2012 R2](https://msdn.microsoft.com/library/windows/hardware/dn529133.aspx)
 
--   [Microsoft Windows Server 2012](https://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx)
+-   [Microsoft Windows Server 2012](https://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx)
 
--   [Microsoft Windows Server 2008 R2](https://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx)
+-   [Microsoft Windows Server 2008 R2](https://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx)
 
 **Server Roles**
 
@@ -471,18 +474,18 @@ Server Performance Tuning Guidelines for
 
 **Windows Client (Guest OS) Performance Tuning Guidance**
 
--   [Microsoft Windows 7](https://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx)
+-   [Microsoft Windows 7](https://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx)
 
 -   [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2012/10/15/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density.aspx)
 
--   [Microsoft Windows 8](https://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf)
+-   [Microsoft Windows 8](https://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf)
 
 -   [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2013/04/09/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe.aspx)
 
 ## Sequencing Steps to Optimize Packages for Publishing Performance
 
 
-App-V 5.0 and App-V 5.0 SP2 provide significant value in their respective releases. Several features facilitate new scenarios or enabled new customer deployment scenarios. These following features can impact the performance of the publishing and launch operations.
+App-V 5.0 and App-V 5.0 SP2 provide significant value in their respective releases. Several features facilitate new scenarios or enabled new customer deployment scenarios. These following features can impact the performance of the publishing and launch operations.
 
 @@ -513,7 +516,7 @@ App-V 5.0 and App-V 5.0 SP2 provide significant value in their respective relea
 
        
 

 
        
 
- 
+
 
 ### Removing FB1
 
@@ -549,10 +552,10 @@ Removing FB1 does not require the original application installer. After completi
 
     "C:\\UpgradedPackages"
 
-    **Note**  
+    **Note**  
     This cmdlet requires an executable (.exe) or batch file (.bat). You must provide an empty (does nothing) executable or batch file.
 
-     
+
 
 @@ -579,7 +582,7 @@ Removing FB1 does not require the original application installer. After completi
 
        
 

 
        
 
- 
+
 
 ### Creating a new virtual application package on the sequencer
 
@@ -587,7 +590,7 @@ If, during sequencer monitoring, an SxS Assembly (such as a VC++ Runtime) is ins
 
 **Client Side**:
 
-When publishing a virtual application package, the App-V 5.0 SP2 Client will detect if a required SxS dependency is already installed. If the dependency is unavailable on the computer and it is included in the package, a traditional Windows Insataller (.**msi**) installation of the SxS assembly will be initiated. As previously documented, simply install the dependency on the computer running the client to ensure that the Windows Installer (.msi) installation will not occur.
+When publishing a virtual application package, the App-V 5.0 SP2 Client will detect if a required SxS dependency is already installed. If the dependency is unavailable on the computer and it is included in the package, a traditional Windows Installer (.**msi**) installation of the SxS assembly will be initiated. As previously documented, simply install the dependency on the computer running the client to ensure that the Windows Installer (.msi) installation will not occur.
 
 @@ -616,7 +619,7 @@ When publishing a virtual application package, the App-V 5.0 SP2 Client will de
 
        
 

 
        
 
- 
+
 
 ### Disabling a Dynamic Configuration using Powershell
 
@@ -666,7 +669,7 @@ For documentation on How to Apply a Dynamic Configuration, see:
 
 
 
- 
+
 
 ### Determining what virtual fonts exist in the package
 
@@ -682,12 +685,14 @@ For documentation on How to Apply a Dynamic Configuration, see:
 
     <appv:Font Path="\[{Fonts}\]\\private\\CalibriL.ttf" DelayLoad="true"></appv:Font>
 
-    **Note**  
+    **Note**  
     If there are fonts marked as **DelayLoad**, those will not impact first launch.
 
-     
 
-    </appv:Fonts>
+
+~~~
+</appv:Fonts>
+~~~
 
 ### Excluding virtual fonts from the package
 
@@ -746,9 +751,9 @@ The following terms are used when describing concepts and actions related to App
 
 [Microsoft Application Virtualization 5.0 Administrator's Guide](microsoft-application-virtualization-50-administrators-guide.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md b/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md
index 978deed7ea..936a78123f 100644
--- a/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md
+++ b/mdop/appv-v5/performance-guidance-for-application-virtualization-51.md
@@ -1,8 +1,11 @@
 ---
 title: Performance Guidance for Application Virtualization 5.1
 description: Performance Guidance for Application Virtualization 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 5f2643c7-5cf7-4a29-adb7-45bf9f5b0364
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -26,10 +29,10 @@ You should read and understand the following information before reading this doc
 
 -   [Microsoft Application Virtualization Sequencing Guide](https://go.microsoft.com/fwlink/?LinkId=269953)
 
-**Note**  
-Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk **\*** review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document.
+**Note**  
+Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk **\\*** review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document.
+
 
- 
 
 Finally, this document will provide you with the information to configure the computer running App-V 5.1 client and the environment for optimal performance. Optimize your virtual application packages for performance using the sequencer, and to understand how to use User Experience Virtualization (UE-V) or other user environment management technologies to provide the optimal user experience with App-V 5.1 in both Remote Desktop Services (RDS) and non-persistent virtual desktop infrastructure (VDI).
 
@@ -52,7 +55,7 @@ Use the information in the following section for more information:
 
 -   Steps to Prepare the Base Image – Whether in a non-persistent VDI or RDSH environment, only a few steps must be completed in the base image to enable this approach.
 
--   Use UE-V 2.1 as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution.
+-   Use UE-V 2.1 as the User Profile Management (UPM) solution for the App-V approach – the cornerstone of this approach is the ability of a UEM solution to persist the contents of just a few registry and file locations. These locations constitute the user integrations\*. Be sure to review the specific requirements for the UPM solution.
 
 [User Experience Walk-through](#bkmk-uewt)
 
@@ -85,7 +88,7 @@ Deployment Environment
 
 
 
- 
+
 
 Expected Configuration
 
@@ -106,7 +109,7 @@ Expected Configuration
 
 
 
- 
+
 
 IT Administration
 
@@ -123,7 +126,7 @@ IT Administration
 
 
 
- 
+
 
 ### Usage Scenario
 
@@ -150,7 +153,7 @@ As you review the two scenarios, keep in mind that these approach the extremes.
 
 
 
- 
+
 
 ### Preparing your Environment
 
@@ -175,7 +178,7 @@ The following table displays the required steps to prepare the base image and th
 
          
 
        • Install the App-V 5.1 client version of the client.
          • 
 
        • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.
          • 
-
        • Configure for Shared Content Store (SCS) mode. For more information see [How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md).
          • 
+
        • Configure for Shared Content Store (SCS) mode. For more information see How to Install the App-V 5.1 Client for Shared Content Store Mode.
          • 
 
        • Configure Preserve User Integrations on Login Registry DWORD.
          • 
 
        • Pre-configure all user- and global-targeted packages for example, Add-AppvClientPackage.
          • 
 
        • Pre-configure all user- and global-targeted connection groups for example, Add-AppvClientConnectionGroup.
          • 
@@ -195,7 +198,7 @@ The following table displays the required steps to prepare the base image and th
 
            
 
          • Install the App-V 5.1 client version of the client.
            • 
 
          • Install UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.
            • 
-
          • Configure for Shared Content Store (SCS) mode. For more information see [How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md).
            • 
+
          • Configure for Shared Content Store (SCS) mode. For more information see How to Install the App-V 5.1 Client for Shared Content Store Mode.
            • 
 
          • Configure Preserve User Integrations on Login Registry DWORD.
            • 
 
          • Pre-configure all global-targeted packages for example, Add-AppvClientPackage.
            • 
 
          • Pre-configure all global-targeted connection groups for example, Add-AppvClientConnectionGroup.
            • 
@@ -206,7 +209,7 @@ The following table displays the required steps to prepare the base image and th
 
 
 
- 
+
 
 **Configurations** - For critical App-V Client configurations and for a little more context and how-to, review the following information:
 
@@ -248,7 +251,7 @@ The following table displays the required steps to prepare the base image and th
 
 
            MaxConcurrentPublishingRefresh
            
 
              
-
            • Configure in the Registry under HKEY_LOCAL_MACHINE \Software \ Microsoft \ AppV \Client \ Publishing.
              • 
+
            • Configure in the Registry under HKEY_LOCAL_MACHINE <strong>Software \ Microsoft \ AppV <strong>Client \ Publishing.
              • 
 
            • Create the DWORD value MaxConcurrentPublishingrefresh with the desired maximum number of concurrent publishing refreshes.
              • 
 
            • The App-V client service and computer do not need to be restarted.
              • 
 
            
@@ -259,7 +262,7 @@ The following table displays the required steps to prepare the base image and th
 
 
 
- 
+
 
 ### Configure UE-V solution for App-V Approach
 
@@ -269,7 +272,7 @@ For more information see [Getting Started With User Experience Virtualization 2.
 
 In essence all that is required is to install the UE-V client and download the following Microsoft authored App-V settings template from the [Microsoft User Experience Virtualization (UE-V) template gallery](https://gallery.technet.microsoft.com/Authored-UE-V-Settings-bb442a33). Register the template. For more information around UE-V templates see [The UE-V specific resource for acquiring and registering the template](https://technet.microsoft.com/library/dn458926.aspx).
 
-**Note**  
+**Note**  
 Without performing an additional configuration step, the Microsoft User Environment Virtualization (UE-V) will not be able to synchronize the Start menu shortcuts (.lnk files) on the target computer. The .lnk file type is excluded by default.
 
 UE-V will only support removing the .lnk file type from the exclusion list in the RDS and VDI scenarios, where every user’s device will have the same set of applications installed to the same location and every .lnk file is valid for all the users’ devices. For example, UE-V would not currently support the following 2 scenarios, because the net result will be that the shortcut will be valid on one but not all devices.
@@ -278,12 +281,12 @@ UE-V will only support removing the .lnk file type from the exclusion list in th
 
 -   If a user has an application installed on one device but not another with .lnk files enabled.
 
- 
 
-**Important**  
+
+**Important**  
 This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk.
 
- 
+
 
 Using the Microsoft Registry Editor (regedit.exe), navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **UEV** \\ **Agent** \\ **Configuration** \\ **ExcludedFileTypes** and remove **.lnk** from the excluded file types.
 
@@ -301,12 +304,12 @@ To enable an optimized login experience, for example the App-V 5.1 approach for
 
 -   Attaching and detaching a user profile disk (UPD) or similar technology that contains the user integrations.
 
-    **Note**  
+    **Note**  
     App-V is supported when using UPD only when the entire profile is stored on the user profile disk.
 
     App-V packages are not supported when using UPD with selected folders stored in the user profile disk. The Copy on Write driver does not handle UPD selected folders.
 
-     
+
 
 -   Capturing changes to the locations, which constitute the user integrations, prior to session logoff.
 
@@ -405,7 +408,7 @@ This following is a step-by-step walk-through of the App-V and UPM operations an
 
 
 
- 
+
 
 @@ -430,13 +433,13 @@ This following is a step-by-step walk-through of the App-V and UPM operations an
 
            
 

 
            
 
- 
+
 
 ### Impact to Package Life Cycle
 
 Upgrading a package is a crucial aspect of the package lifecycle. To help guarantee users have access to the appropriate upgraded (published) or downgraded (un-published) virtual application packages, it is recommended you update the base image to reflect these changes. To understand why review the following section:
 
-App-V 5.0 SP2 introduced the concept of pending states. In the past,
+App-V 5.0 SP2 introduced the concept of pending states. In the past,
 
 -   If an administrator changed entitlements or created a new version of a package (upgraded) and during a publishing/refresh that package was in-use, the un-publish or publish operation, respectively, would fail.
 
@@ -452,7 +455,7 @@ The following section contains lists with information about Microsoft documentat
 
 About NGEN technology
 
--   [How to speed up NGEN optimaztion](https://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx)
+-   [How to speed up NGEN optimization](https://blogs.msdn.com/b/dotnet/archive/2013/08/06/wondering-why-mscorsvw-exe-has-high-cpu-usage-you-can-speed-it-up.aspx)
 
 -   [Script](https://aka.ms/DrainNGenQueue)
 
@@ -460,11 +463,11 @@ About NGEN technology
 
 Server Performance Tuning Guidelines for
 
--   [Microsoft Windows Server 2012 R2](https://msdn.microsoft.com/library/windows/hardware/dn529133.aspx)
+-   [Microsoft Windows Server 2012 R2](https://msdn.microsoft.com/library/windows/hardware/dn529133.aspx)
 
--   [Microsoft Windows Server 2012](https://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx)
+-   [Microsoft Windows Server 2012](https://download.microsoft.com/download/0/0/B/00BE76AF-D340-4759-8ECD-C80BC53B6231/performance-tuning-guidelines-windows-server-2012.docx)
 
--   [Microsoft Windows Server 2008 R2](https://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx)
+-   [Microsoft Windows Server 2008 R2](https://download.microsoft.com/download/6/B/2/6B2EBD3A-302E-4553-AC00-9885BBF31E21/Perf-tun-srv-R2.docx)
 
 **Server Roles**
 
@@ -478,11 +481,11 @@ Server Performance Tuning Guidelines for
 
 **Windows Client (Guest OS) Performance Tuning Guidance**
 
--   [Microsoft Windows 7](https://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx)
+-   [Microsoft Windows 7](https://download.microsoft.com/download/E/5/7/E5783D68-160B-4366-8387-114FC3E45EB4/Performance Tuning Guidelines for Windows 7 Desktop Virtualization v1.9.docx)
 
 -   [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2012/10/15/the-microsoft-premier-field-engineer-pfe-view-on-virtual-desktop-vdi-density.aspx)
 
--   [Microsoft Windows 8](https://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf)
+-   [Microsoft Windows 8](https://download.microsoft.com/download/6/0/1/601D7797-A063-4FA7-A2E5-74519B57C2B4/Windows_8_VDI_Image_Client_Tuning_Guide.pdf)
 
 -   [Optimization Script: (Provided by Microsoft Support)](http://blogs.technet.com/b/jeff_stokes/archive/2013/04/09/hot-off-the-presses-get-it-now-the-windows-8-vdi-optimization-script-courtesy-of-pfe.aspx)
 
@@ -520,7 +523,7 @@ Several App-V features facilitate new scenarios or enable new customer deploymen
 
 
 
- 
+
 
 ### Removing FB1
 
@@ -556,10 +559,10 @@ Removing FB1 does not require the original application installer. After completi
 
     "C:\\UpgradedPackages"
 
-    **Note**  
+    **Note**  
     This cmdlet requires an executable (.exe) or batch file (.bat). You must provide an empty (does nothing) executable or batch file.
 
-     
+
 
 @@ -586,7 +589,7 @@ Removing FB1 does not require the original application installer. After completi
 
            
 

 
            
 
- 
+
 
 ### Creating a new virtual application package on the sequencer
 
@@ -594,7 +597,7 @@ If, during sequencer monitoring, an SxS Assembly (such as a VC++ Runtime) is ins
 
 **Client Side**:
 
-When publishing a virtual application package, the App-V Client will detect if a required SxS dependency is already installed. If the dependency is unavailable on the computer and it is included in the package, a traditional Windows Insataller (.**msi**) installation of the SxS assembly will be initiated. As previously documented, simply install the dependency on the computer running the client to ensure that the Windows Installer (.msi) installation will not occur.
+When publishing a virtual application package, the App-V Client will detect if a required SxS dependency is already installed. If the dependency is unavailable on the computer and it is included in the package, a traditional Windows Installer (.**msi**) installation of the SxS assembly will be initiated. As previously documented, simply install the dependency on the computer running the client to ensure that the Windows Installer (.msi) installation will not occur.
 
 @@ -623,7 +626,7 @@ When publishing a virtual application package, the App-V Client will detect if a
 
            
 

 
            
 
- 
+
 
 ### Disabling a Dynamic Configuration using Powershell
 
@@ -673,7 +676,7 @@ For documentation on How to Apply a Dynamic Configuration, see:
 
 
 
- 
+
 
 ### Determining what virtual fonts exist in the package
 
@@ -689,12 +692,14 @@ For documentation on How to Apply a Dynamic Configuration, see:
 
     <appv:Font Path="\[{Fonts}\]\\private\\CalibriL.ttf" DelayLoad="true"></appv:Font>
 
-    **Note**  
+    **Note**  
     If there are fonts marked as **DelayLoad**, those will not impact first launch.
 
-     
 
-    </appv:Fonts>
+
+~~~
+</appv:Fonts>
+~~~
 
 ### Excluding virtual fonts from the package
 
@@ -753,9 +758,9 @@ The following terms are used when describing concepts and actions related to App
 
 [Microsoft Application Virtualization 5.1 Administrator's Guide](microsoft-application-virtualization-51-administrators-guide.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/planning-for-app-v-50-rc.md b/mdop/appv-v5/planning-for-app-v-50-rc.md
index 79444cbce4..1d4bd7a75c 100644
--- a/mdop/appv-v5/planning-for-app-v-50-rc.md
+++ b/mdop/appv-v5/planning-for-app-v-50-rc.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for App-V 5.0
 description: Planning for App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 69df85b3-06c7-4123-af05-29d537a687ec
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/planning-for-app-v-51.md b/mdop/appv-v5/planning-for-app-v-51.md
index d42ae9c0bf..302d550ef0 100644
--- a/mdop/appv-v5/planning-for-app-v-51.md
+++ b/mdop/appv-v5/planning-for-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for App-V 5.1
 description: Planning for App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 8d84e679-0bd3-4864-976b-a3cbe6eafba6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md b/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md
index e342ac8d3b..d23fc021f8 100644
--- a/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md
+++ b/mdop/appv-v5/planning-for-high-availability-with-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for High Availability with App-V 5.0
 description: Planning for High Availability with App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 6d9a6492-23f8-465c-82e5-49c863594156
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -55,7 +58,7 @@ Review the following for more information about configuring IIS and Network Load
     **Note**  
     The IIS Network Load Balancing functionality in Windows Server 2012 is generally the same as in Windows Server 2008 R2. However, some task details are changed in Windows Server 2012. For information on new ways to do tasks, see [Common Management Tasks and Navigation in Windows Server 2012 R2 Preview and Windows Server 2012](https://go.microsoft.com/fwlink/?LinkId=316371) (https://go.microsoft.com/fwlink/?LinkId=316371).
 
-     
+     
 
 ## Support for clustered file servers when running (SCS) mode
 
@@ -108,7 +111,7 @@ Use the following steps to modify the connection string to include **failover pa
 **Important**  
 This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk.
 
- 
+ 
 
 1.  Login to the management server and open **regedit**.
 
@@ -121,7 +124,7 @@ This topic describes how to change the Windows registry by using Registry Editor
     **Note**  
     Database Mirroring is on the list of Deprecated Database Engine Features for Microsoft SQL Server 2012 due to the **AlwaysOn** feature available with Microsoft SQL Server 2012.
 
-     
+     
 
 Click any of the following links for more information:
 
@@ -143,9 +146,9 @@ The App-V 5.0 management server database supports deployments to computers runni
 
 [Planning to Deploy App-V](planning-to-deploy-app-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md b/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md
index f6b15844ca..a0cfecee7c 100644
--- a/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md
+++ b/mdop/appv-v5/planning-for-high-availability-with-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for High Availability with App-V 5.1
 description: Planning for High Availability with App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 1f190a0e-10ee-4fbe-a602-7e807e943033
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -55,7 +58,7 @@ Review the following for more information about configuring IIS and Network Load
     **Note**  
     The IIS Network Load Balancing functionality in Windows Server 2012 is generally the same as in Windows Server 2008 R2. However, some task details are changed in Windows Server 2012. For information on new ways to do tasks, see [Common Management Tasks and Navigation in Windows Server 2012 R2 Preview and Windows Server 2012](https://go.microsoft.com/fwlink/?LinkId=316371) (https://go.microsoft.com/fwlink/?LinkId=316371).
 
-     
+     
 
 ## Support for clustered file servers when running (SCS) mode
 
@@ -108,7 +111,7 @@ Use the following steps to modify the connection string to include **failover pa
 **Important**  
 This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk.
 
- 
+ 
 
 1.  Login to the management server and open **regedit**.
 
@@ -121,7 +124,7 @@ This topic describes how to change the Windows registry by using Registry Editor
     **Note**  
     Database Mirroring is on the list of Deprecated Database Engine Features for Microsoft SQL Server 2012 due to the **AlwaysOn** feature available with Microsoft SQL Server 2012.
 
-     
+     
 
 Click any of the following links for more information:
 
@@ -148,9 +151,9 @@ The App-V 5.1 management server database supports deployments to computers runni
 
 [Planning to Deploy App-V](planning-to-deploy-app-v51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md
index 054ef35b28..b802e65076 100644
--- a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md
+++ b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for Migrating from a Previous Version of App-V
 description: Planning for Migrating from a Previous Version of App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: d4ca8f09-86fd-456f-8ec2-242ff94ae9a0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -66,7 +69,7 @@ The following table shows the supported App-V coexistence scenarios. We recommen
 
 
 
- 
+ 
 
 ### Requirements for running coexisting clients
 
@@ -94,16 +97,16 @@ The following table provides link to the TechNet documentation about the release
 
 
 
            App-V 4.6 SP3
            
-
            [About Microsoft Application Virtualization 4.6 SP3](https://technet.microsoft.com/library/dn511019.aspx)
            
+
            About Microsoft Application Virtualization 4.6 SP3
            
 
 
 
            App-V 5.0 SP3
            
-
            [About Microsoft Application Virtualization 5.0 SP3](about-app-v-50-sp3.md)
            
+
            About Microsoft Application Virtualization 5.0 SP3
            
 
 
 
 
- 
+ 
 
 For more information about how to configure App-V 5.0 client coexistence, see:
 
@@ -132,9 +135,9 @@ For more information about using the package converter to convert a package, see
 
 [Planning to Deploy App-V](planning-to-deploy-app-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md
index 231df856fe..583f61a259 100644
--- a/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md
+++ b/mdop/appv-v5/planning-for-migrating-from-a-previous-version-of-app-v51.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for Migrating from a Previous Version of App-V
 description: Planning for Migrating from a Previous Version of App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 4a058047-9674-41bc-8050-c58c97a80a9b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -66,7 +69,7 @@ The following table shows the supported App-V coexistence scenarios. We recommen
 
 
 
- 
+ 
 
 ### Requirements for running coexisting clients
 
@@ -79,7 +82,7 @@ To run coexisting clients, you must:
 **Note**  
 App-V 5.1 packages can run side by side with App-V 4.6 packages if you have coexisting installations of App-V 5.1 and 4.6. However, App-V 5.1 packages cannot interact with App-V 4.6 packages in the same virtual environment.
 
- 
+ 
 
 ### Client downloads and documentation
 
@@ -99,16 +102,16 @@ The following table provides links to the App-V 4.6 client downloads and to the
 
 
 
            App-V 4.6 SP3
            
-
            [About Microsoft Application Virtualization 4.6 SP3](https://technet.microsoft.com/library/dn511019.aspx)
            
+
            About Microsoft Application Virtualization 4.6 SP3
            
 
 
 
            App-V 4.6 SP3
            
-
            [About Microsoft Application Virtualization 5.1](about-app-v-51.md)
            
+
            About Microsoft Application Virtualization 5.1
            
 
 
 
 
- 
+ 
 
 For more information about how to configure App-V 5.1 client coexistence, see:
 
@@ -137,9 +140,9 @@ For more information about using the package converter to convert a package, see
 
 [Planning to Deploy App-V](planning-to-deploy-app-v51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md b/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md
index 04f45a5dbf..dda2baef42 100644
--- a/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md
+++ b/mdop/appv-v5/planning-for-the-app-v-50-sequencer-and-client-deployment.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for the App-V 5.0 Sequencer and Client Deployment
 description: Planning for the App-V 5.0 Sequencer and Client Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 57a604ad-90e1-4d32-86bb-eafff59aa43a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -24,7 +27,7 @@ App-V 5.0 uses a process called sequencing to create virtualized applications an
 **Note**  
 For information about the new functionality of App-V 5.0 sequencer, see the **Changes to the sequencer** section of [What's New in App-V 5.0](whats-new-in-app-v-50.md).
 
- 
+ 
 
 The computer that runs the App-V 5.0 sequencer must meet the minimum system requirements. For a list of these requirements, see [App-V 5.0 Supported Configurations](app-v-50-supported-configurations.md).
 
@@ -39,7 +42,7 @@ Ideally, you should install the sequencer on a computer running as a virtual mac
 **Important**  
 You should have your corporate security team review and approve the sequencing process plan. For security reasons, you should keep the sequencer operations in a lab that is separate from the production environment. The separation arrangement can be as simple or as comprehensive as necessary, based on your business requirements. The sequencing computers must be able to connect to the corporate network to copy finished packages to the production servers. However, because the sequencing computers are typically operated without antivirus protection, they must not be on the corporate network unprotected. For example, you might be able to operate behind a firewall or on an isolated network segment. You might also be able to use virtual machines that are configured to share an isolated virtual network. Follow your corporate security policies to safely address these concerns.
 
- 
+ 
 
 [How to Install the Sequencer](how-to-install-the-sequencer-beta-gb18030.md)
 
@@ -94,9 +97,9 @@ The following list displays some of the benefits of using the App-V 5.0 shared c
 
 [Planning to Deploy App-V](planning-to-deploy-app-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md b/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md
index 9099adcfe8..cfbadbc58c 100644
--- a/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md
+++ b/mdop/appv-v5/planning-for-the-app-v-50-server-deployment.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for the App-V 5.0 Server Deployment
 description: Planning for the App-V 5.0 Server Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: fd89b324-3961-471a-ad90-c8f9ae7a8155
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -51,7 +54,7 @@ The App-V 5.0 Management Server contains the repository of packages and their as
 **Note**  
 The Management Server does not perform any load balancing. The associated metadata is simply passed to the publishing server for use when processing client requests.
 
- 
+ 
 
 ## Server-Related Protocols and External Features
 
@@ -94,7 +97,7 @@ The following displays information about server-related protocols used by the Ap
 
 
 
- 
+ 
 
 
 
@@ -108,9 +111,9 @@ The following displays information about server-related protocols used by the Ap
 
 [Deploying the App-V 5.0 Server](deploying-the-app-v-50-server.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md b/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md
index c99f940821..2dc56979b0 100644
--- a/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md
+++ b/mdop/appv-v5/planning-for-the-app-v-51-sequencer-and-client-deployment.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for the App-V 5.1 Sequencer and Client Deployment
 description: Planning for the App-V 5.1 Sequencer and Client Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: d92f8773-fa7d-4926-978a-433978f91202
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -24,7 +27,7 @@ App-V 5.1 uses a process called sequencing to create virtualized applications an
 **Note**  
 For information about the new functionality of App-V 5.1 sequencer, see the **Sequencer Improvements** section of [About App-V 5.1](about-app-v-51.md).
 
- 
+ 
 
 The computer that runs the App-V 5.1 sequencer must meet the minimum system requirements. For a list of these requirements, see [App-V 5.1 Supported Configurations](app-v-51-supported-configurations.md).
 
@@ -39,7 +42,7 @@ Ideally, you should install the sequencer on a computer running as a virtual mac
 **Important**  
 You should have your corporate security team review and approve the sequencing process plan. For security reasons, you should keep the sequencer operations in a lab that is separate from the production environment. The separation arrangement can be as simple or as comprehensive as necessary, based on your business requirements. The sequencing computers must be able to connect to the corporate network to copy finished packages to the production servers. However, because the sequencing computers are typically operated without antivirus protection, they must not be on the corporate network unprotected. For example, you might be able to operate behind a firewall or on an isolated network segment. You might also be able to use virtual machines that are configured to share an isolated virtual network. Follow your corporate security policies to safely address these concerns.
 
- 
+ 
 
 ## Planning for App-V 5.1 client deployment
 
@@ -97,9 +100,9 @@ The following list displays some of the benefits of using the App-V 5.1 shared c
 
 [How to Install the App-V 5.1 Client for Shared Content Store Mode](how-to-install-the-app-v-51-client-for-shared-content-store-mode.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md b/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md
index 89bcb718f8..cbba13e491 100644
--- a/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md
+++ b/mdop/appv-v5/planning-for-the-app-v-51-server-deployment.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for the App-V 5.1 Server Deployment
 description: Planning for the App-V 5.1 Server Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: eedd97c9-bee0-4749-9d1e-ab9528fba398
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -51,7 +54,7 @@ The App-V 5.1 Management Server contains the repository of packages and their as
 **Note**  
 The Management Server does not perform any load balancing. The associated metadata is simply passed to the publishing server for use when processing client requests.
 
- 
+ 
 
 ## Server-Related Protocols and External Features
 
@@ -94,7 +97,7 @@ The following displays information about server-related protocols used by the Ap
 
 
 
- 
+ 
 
 
 
@@ -108,9 +111,9 @@ The following displays information about server-related protocols used by the Ap
 
 [Deploying the App-V 5.1 Server](deploying-the-app-v-51-server.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/planning-for-using-app-v-with-office.md b/mdop/appv-v5/planning-for-using-app-v-with-office.md
index e294521ae9..7f570f7070 100644
--- a/mdop/appv-v5/planning-for-using-app-v-with-office.md
+++ b/mdop/appv-v5/planning-for-using-app-v-with-office.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for Using App-V with Office
 description: Planning for Using App-V with Office
-author: jamiejdt
+author: dansimp
 ms.assetid: c4371869-4bfc-4d13-9198-ef19f99fc192
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -32,7 +35,7 @@ You can use the App-V 5.0 Sequencer to create plug-in packages for Language Pack
 **Note**  
 Microsoft Visio and Microsoft Project do not provide support for the Thai Language Pack.
 
- 
+ 
 
 ## Supported versions of Microsoft Office
 
@@ -102,7 +105,7 @@ The following table lists the versions of Microsoft Office that App-V supports,
 
 
 
- 
+ 
 
 ## Planning for using App-V with coexisting versions of Office
 
@@ -129,16 +132,16 @@ Before implementing Office coexistence, review the following Office documentatio
 
 
 
            Office 2013
            
-
            [Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office](https://support.microsoft.com/kb/2784668)
            
+
            Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office
            
 
 
 
            Office 2010
            
-
            [Information about how to use Office 2010 suites and programs on a computer that is running another version of Office](https://support.microsoft.com/kb/2121447)
            
+
            Information about how to use Office 2010 suites and programs on a computer that is running another version of Office
            
 
 
 
 
- 
+ 
 
 The Office documentation provides extensive guidance on coexistence for Windows Installer-based (MSi) and Click-to-Run installations of Office. This App-V topic on coexistence supplements the Office guidance with information that is more specific to App-V deployments.
 
@@ -149,7 +152,7 @@ The following tables summarize the supported coexistence scenarios. They are org
 **Note**  
 Microsoft does not support the use of multiple versions of Office in Windows Server environments that have the Remote Desktop Session Host role service enabled. To run Office coexistence scenarios, you must disable this role service.
 
- 
+ 
 
 ### Windows integrations & Office coexistence
 
@@ -182,7 +185,7 @@ The Windows Installer-based and Click-to-Run Office installation methods integra
 
 
 
- 
+ 
 
 Microsoft recommends that you deploy Office coexistence with only one integrated Office instance. For example, if you’re using App-V to deploy Office 2010 and Office 2013, you should sequence Office 2010 in non-integrated mode. For more information about sequencing Office in non-integration (isolated) mode, see [How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/kb/2830069).
 
@@ -293,7 +296,7 @@ The Office 2013 App-V package supports the following integration points with the
 
 
 
            Active X Controls:
            
-
            For more information on ActiveX controls, refer to [ActiveX Control API Reference](https://go.microsoft.com/fwlink/p/?LinkId=331361).
            
+
            For more information on ActiveX controls, refer to ActiveX Control API Reference.
            
 
 
 
               Groove.SiteClient
            
@@ -378,16 +381,16 @@ The Office 2013 App-V package supports the following integration points with the
 
 
 
- 
+ 
 
 
 
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/planning-for-using-app-v-with-office51.md b/mdop/appv-v5/planning-for-using-app-v-with-office51.md
index 7dc75eda7b..6564a0e784 100644
--- a/mdop/appv-v5/planning-for-using-app-v-with-office51.md
+++ b/mdop/appv-v5/planning-for-using-app-v-with-office51.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for Using App-V with Office
 description: Planning for Using App-V with Office
-author: jamiejdt
+author: dansimp
 ms.assetid: e7a19b43-1746-469f-bad6-8e75cf4b3f67
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -32,14 +35,14 @@ You can use the App-V 5.1 Sequencer to create plug-in packages for Language Pack
 >**Note**  
 Microsoft Visio and Microsoft Project do not provide support for the Thai Language Pack.
 
- 
+ 
 
 ## Supported versions of Microsoft Office
 
 See [Microsoft Office Product IDs that App-V supports](https://support.microsoft.com/help/2842297/product-ids-that-are-supported-by-the-office-deployment-tool-for-click) for a list of supported Office products.
 >**Note**  You must use the Office Deployment Tool to create App-V packages for Office 365 ProPlus. Creating packages for the volume-licensed versions of Office Professional Plus or Office Standard is not supported. You cannot use the App-V Sequencer.
 
- 
+ 
 
 ## Planning for using App-V with coexisting versions of Office
 
@@ -66,16 +69,16 @@ Before implementing Office coexistence, review the following Office documentatio
 
 
 
            Office 2013
            
-
            [Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office](https://support.microsoft.com/kb/2784668)
            
+
            Information about how to use Office 2013 suites and programs (MSI deployment) on a computer that is running another version of Office
            
 
 
 
            Office 2010
            
-
            [Information about how to use Office 2010 suites and programs on a computer that is running another version of Office](https://support.microsoft.com/kb/2121447)
            
+
            Information about how to use Office 2010 suites and programs on a computer that is running another version of Office
            
 
 
 
 
- 
+ 
 
 The Office documentation provides extensive guidance on coexistence for Windows Installer-based (MSi) and Click-to-Run installations of Office. This App-V topic on coexistence supplements the Office guidance with information that is more specific to App-V deployments.
 
@@ -86,7 +89,7 @@ The following tables summarize the supported coexistence scenarios. They are org
 >**Note**  
 Microsoft does not support the use of multiple versions of Office in Windows Server environments that have the Remote Desktop Session Host role service enabled. To run Office coexistence scenarios, you must disable this role service.
 
- 
+ 
 
 ### Windows integrations & Office coexistence
 
@@ -119,7 +122,7 @@ The Windows Installer-based and Click-to-Run Office installation methods integra
 
 
 
- 
+ 
 
 Microsoft recommends that you deploy Office coexistence with only one integrated Office instance. For example, if you’re using App-V to deploy Office 2010 and Office 2013, you should sequence Office 2010 in non-integrated mode. For more information about sequencing Office in non-integration (isolated) mode, see [How to sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/kb/2830069).
 
@@ -230,7 +233,7 @@ The Office 2013 App-V package supports the following integration points with the
 
 
 
            Active X Controls:
            
-
            For more information on ActiveX controls, refer to [ActiveX Control API Reference](https://go.microsoft.com/fwlink/p/?LinkId=331361).
            
+
            For more information on ActiveX controls, refer to ActiveX Control API Reference.
            
 
 
 
               Groove.SiteClient
            
@@ -315,16 +318,16 @@ The Office 2013 App-V package supports the following integration points with the
 
 
 
- 
+ 
 
 
 
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md b/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md
index 094d3b8da9..0cc8198165 100644
--- a/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md
+++ b/mdop/appv-v5/planning-to-deploy-app-v-50-with-an-electronic-software-distribution-system.md
@@ -1,8 +1,11 @@
 ---
 title: Planning to Deploy App-V 5.0 with an Electronic Software Distribution System
 description: Planning to Deploy App-V 5.0 with an Electronic Software Distribution System
-author: jamiejdt
+author: dansimp
 ms.assetid: 8cd3f1fb-b84e-4260-9e72-a14d01e7cadf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md b/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md
index 4379f770b5..6033a54f5b 100644
--- a/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md
+++ b/mdop/appv-v5/planning-to-deploy-app-v-51-with-an-electronic-software-distribution-system.md
@@ -1,8 +1,11 @@
 ---
 title: Planning to Deploy App-V 5.1 with an Electronic Software Distribution System
 description: Planning to Deploy App-V 5.1 with an Electronic Software Distribution System
-author: jamiejdt
+author: dansimp
 ms.assetid: c26602c2-5e8d-44e6-90df-adacc593607e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/planning-to-deploy-app-v.md b/mdop/appv-v5/planning-to-deploy-app-v.md
index af61d99dc7..c12ddb523d 100644
--- a/mdop/appv-v5/planning-to-deploy-app-v.md
+++ b/mdop/appv-v5/planning-to-deploy-app-v.md
@@ -1,8 +1,11 @@
 ---
 title: Planning to Deploy App-V
 description: Planning to Deploy App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 28d3035c-3805-4339-90fc-6c3fd3b1123e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/planning-to-deploy-app-v51.md b/mdop/appv-v5/planning-to-deploy-app-v51.md
index 08f3e2b722..dc0bca0071 100644
--- a/mdop/appv-v5/planning-to-deploy-app-v51.md
+++ b/mdop/appv-v5/planning-to-deploy-app-v51.md
@@ -1,8 +1,11 @@
 ---
 title: Planning to Deploy App-V
 description: Planning to Deploy App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 39cbf981-d9c6-457f-b047-f9046e1a6442
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md
index 965c5d7d71..5d2759961a 100644
--- a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md
+++ b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v.md
@@ -1,8 +1,11 @@
 ---
 title: Planning to Use Folder Redirection with App-V
 description: Planning to Use Folder Redirection with App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 2a4deeed-fdc0-465c-b88a-3a2fbbf27436
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -45,11 +48,11 @@ This topic contains the following sections:
 
              
 
            • Files under %appdata%\Microsoft\AppV\Client\Catalog
              • 
 
            • Registry settings under HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages
              
-
              For more detail, see [Application Publishing and Client Interaction](application-publishing-and-client-interaction.md#bkmk-clt-inter-roam-reqs).
              • 
+
              For more detail, see Application Publishing and Client Interaction.
              
 
            
 
          • Ensure that the following folders are available to each user who logs into the computer that is running the App-V 5.0 SP2 or later client:
            
 
              
-
            • %AppData% is configured to the desired network location (with or without [Offline Files](https://technet.microsoft.com/library/cc780552.aspx) support).
              • 
+
            • %AppData% is configured to the desired network location (with or without Offline Files support).
              • 
 
            • %LocalAppData% is configured to the desired local folder.
              • 
 
            • 
 
          
@@ -82,13 +85,13 @@ This topic contains the following sections:
 
 
 
-
           
          
+
           
          
 
        
 
 
 
 
- 
+
 
 ## How to configure folder redirection for use with App-V
 
@@ -123,23 +126,22 @@ The following table describes how folder redirection works when %AppData% is red
 
      • Entries to the AppData folder are made using the user context, not the system context.
        • 
 
      
 
      
-Note  
-
      The App-V client folder redirection sometimes fails to move files from %AppData% to %LocalAppData%. See [Release Notes for App-V 5.0 SP2](release-notes-for-app-v-50-sp2.md#bkmk-folderredirection).
      
+Note
      The App-V client folder redirection sometimes fails to move files from %AppData% to %LocalAppData%. See Release Notes for App-V 5.0 SP2.
      
 
      
 
      
- 
+
 
      
 
 
 
      When the virtual environment shuts down
      
 
      The local cached data in AppData (roaming) is zipped up and copied to the “real” roaming AppData folder in %AppData%. A time stamp, which indicates the last known upload, is simultaneously saved as a registry key under:
      
-
      HKCU\Software\Microsoft\AppV\Client\Packages\<PACKAGE_GUID>\AppDataTime
      
+
      HKCU\Software\Microsoft\AppV\Client\Packages&lt;PACKAGE_GUID>\AppDataTime
      
 
      To provide redundancy, App-V 5.0 keeps the three most recent copies of the compressed data under %AppData%.
      
 
 
 
 
- 
+
 
 ## Overview of folder redirection
 
@@ -165,25 +167,25 @@ The following table describes how folder redirection works when %AppData% is red
 
 
 
      Usage example
      
-
      You can redirect the Documents folder, which is usually stored on the computer's local hard disk, to a network location. The user can access the documents in the folder from any computer on the network.
      
+
      You can redirect the Documents folder, which is usually stored on the computer's local hard disk, to a network location. The user can access the documents in the folder from any computer on the network.
      
 
 
 
      More resources
      
-
      [Folder redirection overview](https://technet.microsoft.com/library/cc778976.aspx)
      
+
      Folder redirection overview
      
 
 
 
 
- 
 
 
 
 
 
 
- 
-
- 
+
+
+
+
 
 
 
diff --git a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md
index 1da6047c3f..adf150f3e1 100644
--- a/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md
+++ b/mdop/appv-v5/planning-to-use-folder-redirection-with-app-v51.md
@@ -1,8 +1,11 @@
 ---
 title: Planning to Use Folder Redirection with App-V
 description: Planning to Use Folder Redirection with App-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 6bea9a8f-a915-4d7d-be67-ef1cca1398ed
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -45,11 +48,11 @@ This topic contains the following sections:
 
        
 
      • Files under %appdata%\Microsoft\AppV\Client\Catalog
        • 
 
      • Registry settings under HKEY_CURRENT_USER\Software\Microsoft\AppV\Client\Packages
        
-
        For more detail, see [Application Publishing and Client Interaction](application-publishing-and-client-interaction.md#bkmk-clt-inter-roam-reqs).
        • 
+
        For more detail, see Application Publishing and Client Interaction.
        
 
      
 
    • Ensure that the following folders are available to each user who logs into the computer that is running the App-V 5.0 SP2 or later client:
      
 
        
-
      • %AppData% is configured to the desired network location (with or without [Offline Files](https://technet.microsoft.com/library/cc780552.aspx) support).
        • 
+
      • %AppData% is configured to the desired network location (with or without Offline Files support).
        • 
 
      • %LocalAppData% is configured to the desired local folder.
        • 
 
      • 
 
    
@@ -82,13 +85,13 @@ This topic contains the following sections:
 
 
 
-
     
    
+
     
    
 
 
 
 
 
- 
+
 
 ## How to configure folder redirection for use with App-V
 
@@ -123,23 +126,22 @@ The following table describes how folder redirection works when %AppData% is red
 
  • Entries to the AppData folder are made using the user context, not the system context.
    • 
 
 
    
-Note  
-
    The App-V client folder redirection sometimes fails to move files from %AppData% to %LocalAppData%. See [Release Notes for App-V 5.0 SP2](release-notes-for-app-v-50-sp2.md#bkmk-folderredirection).
    
+Note
    The App-V client folder redirection sometimes fails to move files from %AppData% to %LocalAppData%. See Release Notes for App-V 5.0 SP2.
    
 
    
 
    
- 
+
 
    
 
 
 
    When the virtual environment shuts down
    
 
    The local cached data in AppData (roaming) is zipped up and copied to the “real” roaming AppData folder in %AppData%. A time stamp, which indicates the last known upload, is simultaneously saved as a registry key under:
    
-
    HKCU\Software\Microsoft\AppV\Client\Packages\<PACKAGE_GUID>\AppDataTime
    
+
    HKCU\Software\Microsoft\AppV\Client\Packages&lt;PACKAGE_GUID>\AppDataTime
    
 
    To provide redundancy, App-V keeps the three most recent copies of the compressed data under %AppData%.
    
 
 
 
 
- 
+
 
 ## Overview of folder redirection
 
@@ -165,25 +167,25 @@ The following table describes how folder redirection works when %AppData% is red
 
 
 
    Usage example
    
-
    You can redirect the Documents folder, which is usually stored on the computer's local hard disk, to a network location. The user can access the documents in the folder from any computer on the network.
    
+
    You can redirect the Documents folder, which is usually stored on the computer's local hard disk, to a network location. The user can access the documents in the folder from any computer on the network.
    
 
 
 
    More resources
    
-
    [Folder redirection overview](https://technet.microsoft.com/library/cc778976.aspx)
    
+
    Folder redirection overview
    
 
 
 
 
- 
 
 
 
 
 
 
- 
-
- 
+
+
+
+
 
 
 
diff --git a/mdop/appv-v5/preparing-your-environment-for-app-v-50.md b/mdop/appv-v5/preparing-your-environment-for-app-v-50.md
index 3bc788d92f..aa0bb21af5 100644
--- a/mdop/appv-v5/preparing-your-environment-for-app-v-50.md
+++ b/mdop/appv-v5/preparing-your-environment-for-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: Preparing Your Environment for App-V 5.0
 description: Preparing Your Environment for App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 119d990e-a6c6-47b7-a7b0-52f88205e5ec
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/preparing-your-environment-for-app-v-51.md b/mdop/appv-v5/preparing-your-environment-for-app-v-51.md
index b72ed1d762..05f376d410 100644
--- a/mdop/appv-v5/preparing-your-environment-for-app-v-51.md
+++ b/mdop/appv-v5/preparing-your-environment-for-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: Preparing Your Environment for App-V 5.1
 description: Preparing Your Environment for App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 64b2e1ac-1561-4c99-9815-b4688a0ff48a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp1.md b/mdop/appv-v5/release-notes-for-app-v-50-sp1.md
index 6074975fb7..a24b405c96 100644
--- a/mdop/appv-v5/release-notes-for-app-v-50-sp1.md
+++ b/mdop/appv-v5/release-notes-for-app-v-50-sp1.md
@@ -1,8 +1,11 @@
 ---
 title: Release Notes for App-V 5.0 SP1
 description: Release Notes for App-V 5.0 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 21a859cd-41b4-4cc4-9c9c-7ba236084bb0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -33,7 +36,7 @@ We are interested in your feedback on App-V 5.0. You can send your feedback to <
 **Note**  
 This email address is not a support channel, but your feedback will help us to plan for future changes in our documentation and product releases.
 
- 
+ 
 
 For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page.
 
@@ -61,9 +64,9 @@ Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Win
 
 [About App-V 5.0](about-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp2.md b/mdop/appv-v5/release-notes-for-app-v-50-sp2.md
index c5b1e8f26c..8a8faa9757 100644
--- a/mdop/appv-v5/release-notes-for-app-v-50-sp2.md
+++ b/mdop/appv-v5/release-notes-for-app-v-50-sp2.md
@@ -1,8 +1,11 @@
 ---
 title: Release Notes for App-V 5.0 SP2
 description: Release Notes for App-V 5.0 SP2
-author: jamiejdt
+author: dansimp
 ms.assetid: fe73139d-240c-4ed5-8e59-6ae76ee8e80c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -33,7 +36,7 @@ We are interested in your feedback on App-V 5.0. You can send your feedback to <
 **Note**  
 This email address is not a support channel, but your feedback will help us to plan for future changes in our documentation and product releases.
 
- 
+ 
 
 For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page.
 
@@ -55,7 +58,7 @@ If the following folder exists, then you must delete it:
 **Note**  
 You must have elevated privileges to delete this folder.
 
- 
+ 
 
 To use a script, for each user account on the computer and for each package id that was published after installing Hotfix Package 4 for Application Virtualization 5.0 SP2:
 
@@ -157,9 +160,9 @@ Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Win
 
 [About App-V 5.0 SP2](about-app-v-50-sp2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/release-notes-for-app-v-50-sp3.md b/mdop/appv-v5/release-notes-for-app-v-50-sp3.md
index 10f588bb25..9eb47a741d 100644
--- a/mdop/appv-v5/release-notes-for-app-v-50-sp3.md
+++ b/mdop/appv-v5/release-notes-for-app-v-50-sp3.md
@@ -1,8 +1,11 @@
 ---
 title: Release Notes for App-V 5.0 SP3
 description: Release Notes for App-V 5.0 SP3
-author: jamiejdt
+author: dansimp
 ms.assetid: bc4806e0-2aba-4c7b-9ecc-1b2cc54af1d0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/release-notes-for-app-v-50.md b/mdop/appv-v5/release-notes-for-app-v-50.md
index 53b1e5ba8b..417148f521 100644
--- a/mdop/appv-v5/release-notes-for-app-v-50.md
+++ b/mdop/appv-v5/release-notes-for-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: Release Notes for App-V 5.0
 description: Release Notes for App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 68a6a5a1-4b3c-4c09-b00c-9ca4237695d5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -33,7 +36,7 @@ We are interested in your feedback on App-V 5.0. You can send your feedback to <
 **Note**  
 This email address is not a support channel, but your feedback will help us to plan for future changes in our documentation and product releases.
 
- 
+ 
 
 For the latest information about MDOP and additional learning resources, see the [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032) page.
 
@@ -73,9 +76,9 @@ Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Win
 
 [About App-V 5.0](about-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/release-notes-for-app-v-51.md b/mdop/appv-v5/release-notes-for-app-v-51.md
index e74981af10..f96c8ae1d2 100644
--- a/mdop/appv-v5/release-notes-for-app-v-51.md
+++ b/mdop/appv-v5/release-notes-for-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: Release Notes for App-V 5.1
 description: Release Notes for App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 62c5be3b-0a46-4512-93ed-97c23184f343
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -128,7 +131,7 @@ The Permissions.sql script should be updated according to **Step 2** in [KB arti
 **Important**  
 **Step 1** is not required for versions of App-V later than App-V 5.0 SP3.
 
- 
+ 
 
 ## Microsoft Visual Studio 2012 not supported
 
@@ -147,7 +150,7 @@ The App-V 5.x Sequencer cannot sequence applications with filenames matching "CO
 ## Intermittent "File Not Found" error when Mounting a Package
 
 
-Occassionally when mounting a package, a "File Not Found" (0x80070002) error is generated. Typically, this occurs when a folder in an App-V package contains many files ( i.e. 20K or more). This can cause streaming to take longer than expected and to time out which generates the "File Not Found" error.
+Occasionally when mounting a package, a "File Not Found" (0x80070002) error is generated. Typically, this occurs when a folder in an App-V package contains many files ( i.e. 20K or more). This can cause streaming to take longer than expected and to time out which generates the "File Not Found" error.
 
 **Workaround**: Starting with HF06, a new registry key has been introduced to enable extending this time-out period.
 
@@ -176,7 +179,7 @@ Occassionally when mounting a package, a "File Not Found" (0x80070002) error is
 
 Default
 5
    
-**Note**: this value is the default if the registry key is not defined or a value <=5 is specified.
+Note: this value is the default if the registry key is not defined or a value <=5 is specified.
 
 
 
@@ -192,9 +195,9 @@ Occassionally when mounting a package, a "File Not Found" (0x80070002) error is
 
 [About App-V 5.1](about-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md b/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md
index 09f1efd097..6a49308d73 100644
--- a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md
+++ b/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications.md
@@ -1,8 +1,11 @@
 ---
 title: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications
 description: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications
-author: jamiejdt
+author: dansimp
 ms.assetid: a8affa46-f1f7-416c-8125-9595cfbfdbc7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -64,7 +67,7 @@ There is no Group Policy setting available to manage this registry key, so you h
 
 
 
- 
+ 
 
 ### Steps to create the subkey
 
@@ -109,7 +112,7 @@ There is no Group Policy setting available to manage this registry key, so you h
     
     
 
-     
+     
 
 2.  Set the new registry subkey’s value to the PackageId and VersionId of the package, separating the values with an underscore.
 
@@ -138,7 +141,7 @@ Use the following example syntax, and substitute the name of your package for **
 
 `Start-AppvVirtualProcess -AppvClientObject $AppVName cmd.exe`
 
-If you don’t know the exact name of your package, you can use the command line **Get-AppvClientPackage \*executable\***, where **executable** is the name of the application, for example: Get-AppvClientPackage \*Word\*.
+If you don’t know the exact name of your package, you can use the command line **Get-AppvClientPackage \*executable\\**, where **executable* is the name of the application, for example: Get-AppvClientPackage \*Word\*.
 
 ## Command line switch /appvpid:<PID>
 
@@ -168,7 +171,7 @@ To get the package GUID and version GUID of your application, run the **Get-Appv
 
 -   Version ID of the desired package
 
-If you don’t know the exact name of your package, use the command line **Get-AppvClientPackage \*executable\***, where **executable** is the name of the application, for example: Get-AppvClientPackage \*Word\*.
+If you don’t know the exact name of your package, use the command line **Get-AppvClientPackage \*executable\\**, where **executable* is the name of the application, for example: Get-AppvClientPackage \*Word\*.
 
 This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running.
 
@@ -182,9 +185,9 @@ This method lets you launch any command within the context of an App-V package,
 
 [Technical Reference for App-V 5.0](technical-reference-for-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md b/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md
index 2dfb9a76cf..26f9693b4b 100644
--- a/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md
+++ b/mdop/appv-v5/running-a-locally-installed-application-inside-a-virtual-environment-with-virtualized-applications51.md
@@ -1,8 +1,11 @@
 ---
 title: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications
 description: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications
-author: jamiejdt
+author: dansimp
 ms.assetid: 71baf193-a9e8-4ffa-aa7f-e0bffed2e4b2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -64,7 +67,7 @@ There is no Group Policy setting available to manage this registry key, so you h
 
 
 
- 
+ 
 
 ### Steps to create the subkey
 
@@ -109,7 +112,7 @@ There is no Group Policy setting available to manage this registry key, so you h
     
     
 
-     
+     
 
 2.  Set the new registry subkey’s value to the PackageId and VersionId of the package, separating the values with an underscore.
 
@@ -138,7 +141,7 @@ Use the following example syntax, and substitute the name of your package for **
 
 `Start-AppvVirtualProcess -AppvClientObject $AppVName cmd.exe`
 
-If you don’t know the exact name of your package, you can use the command line **Get-AppvClientPackage \*executable\***, where **executable** is the name of the application, for example: Get-AppvClientPackage \*Word\*.
+If you don’t know the exact name of your package, you can use the command line **Get-AppvClientPackage \*executable\\**, where **executable* is the name of the application, for example: Get-AppvClientPackage \*Word\*.
 
 ## Command line switch /appvpid:<PID>
 
@@ -168,7 +171,7 @@ To get the package GUID and version GUID of your application, run the **Get-Appv
 
 -   Version ID of the desired package
 
-If you don’t know the exact name of your package, use the command line **Get-AppvClientPackage \*executable\***, where **executable** is the name of the application, for example: Get-AppvClientPackage \*Word\*.
+If you don’t know the exact name of your package, use the command line **Get-AppvClientPackage \*executable\\**, where **executable* is the name of the application, for example: Get-AppvClientPackage \*Word\*.
 
 This method lets you launch any command within the context of an App-V package, regardless of whether the package is currently running.
 
@@ -182,9 +185,9 @@ This method lets you launch any command within the context of an App-V package,
 
 [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/appv-v5/technical-reference-for-app-v-50.md b/mdop/appv-v5/technical-reference-for-app-v-50.md
index 0d8c094017..4edd02b6e7 100644
--- a/mdop/appv-v5/technical-reference-for-app-v-50.md
+++ b/mdop/appv-v5/technical-reference-for-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: Technical Reference for App-V 5.0
 description: Technical Reference for App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: aa899158-41e8-47d3-882c-8c5b96018308
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/technical-reference-for-app-v-51.md b/mdop/appv-v5/technical-reference-for-app-v-51.md
index 54e325ba1a..4a5b670357 100644
--- a/mdop/appv-v5/technical-reference-for-app-v-51.md
+++ b/mdop/appv-v5/technical-reference-for-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: Technical Reference for App-V 5.1
 description: Technical Reference for App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 2b9e8b2b-4cd1-46f3-ba08-e3bc8d5c6127
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/troubleshooting-app-v-50.md b/mdop/appv-v5/troubleshooting-app-v-50.md
index 6e168ec818..7fde4fd864 100644
--- a/mdop/appv-v5/troubleshooting-app-v-50.md
+++ b/mdop/appv-v5/troubleshooting-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: Troubleshooting App-V 5.0
 description: Troubleshooting App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: a713b345-25b7-4cdf-ba55-66df672a1f3a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/troubleshooting-app-v-51.md b/mdop/appv-v5/troubleshooting-app-v-51.md
index 98f87e4069..27ce45c67f 100644
--- a/mdop/appv-v5/troubleshooting-app-v-51.md
+++ b/mdop/appv-v5/troubleshooting-app-v-51.md
@@ -1,8 +1,11 @@
 ---
 title: Troubleshooting App-V 5.1
 description: Troubleshooting App-V 5.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 435d0e56-0aa2-4168-b5a7-2f03a1f273d4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/using-the-app-v-50-client-management-console.md b/mdop/appv-v5/using-the-app-v-50-client-management-console.md
index 5895a83355..2ab6dea613 100644
--- a/mdop/appv-v5/using-the-app-v-50-client-management-console.md
+++ b/mdop/appv-v5/using-the-app-v-50-client-management-console.md
@@ -1,8 +1,11 @@
 ---
 title: Using the App-V 5.0 Client Management Console
 description: Using the App-V 5.0 Client Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 36398307-57dd-40f3-9d4f-b09f44fd37c3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/using-the-app-v-51-client-management-console.md b/mdop/appv-v5/using-the-app-v-51-client-management-console.md
index a7c2241534..427f3aa60c 100644
--- a/mdop/appv-v5/using-the-app-v-51-client-management-console.md
+++ b/mdop/appv-v5/using-the-app-v-51-client-management-console.md
@@ -1,8 +1,11 @@
 ---
 title: Using the App-V 5.1 Client Management Console
 description: Using the App-V 5.1 Client Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: be6d4e35-5701-4f9a-ba8a-bede12662cf1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md b/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md
index 512ce4468b..218bac0f4f 100644
--- a/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md
+++ b/mdop/appv-v5/viewing-app-v-server-publishing-metadata.md
@@ -1,8 +1,11 @@
 ---
 title: Viewing App-V Server Publishing Metadata
 description: Viewing App-V Server Publishing Metadata
-author: jamiejdt
+author: dansimp
 ms.assetid: 048dd42a-24d4-4cc4-81f6-7a919aadd9b2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -55,7 +58,7 @@ In App-V 5.0 SP3, you must provide the following values in the address when you
 
 
 
- 
+
 
 ## Query syntax for viewing publishing metadata
 
@@ -111,9 +114,9 @@ The following table provides the syntax and query examples.
 
 
 
-
     
    
+
     
    
 
    To get the name of the Publishing server and the port number (http://<PubServer>:<Publishing Port#>) from the App-V Client, look at the URL configuration of the Get-AppvPublishingServer PowerShell cmdlet.
    
-
    http://pubsvr01:2718/?clientversion=5.0.10066.0&clientos=WindowsClient_6.2_x64
    
+
    http://pubsvr01:2718/?clientversion=5.0.10066.0&clientos=WindowsClient_6.2_x64
    
 
    In the example:
    
 
      
 
    • A Windows Server 2012 R2 named “pubsvr01” hosts the Publishing service.
      • 
@@ -124,20 +127,19 @@ The following table provides the syntax and query examples.
 
      App-V 5.0 through App-V 5.0 SP2
      
 
      http://<PubServer>:<Publishing Port#>/ 
      
 
      
-Note  
-
      ClientVersion and ClientOS are supported only in App-V 5.0 SP3.
      
+Note
      ClientVersion and ClientOS are supported only in App-V 5.0 SP3.
      
 
      
 
      
- 
+
 
      
 
      See the information for App-V 5.0 SP3.
      
-
      http://pubsvr01:2718
      
+
      http://pubsvr01:2718
      
 
      In the example, A Windows Server 2012 R2 named “pubsvr01” hosts the Management and Publishing services.
      
 
 
 
 
- 
+
 
 ## Query values for client operating system and version
 
@@ -221,7 +223,7 @@ In your publishing metadata query, enter the string values that correspond to th
 
 
 
- 
+
 
 ## Definition of publishing metadata
 
@@ -246,9 +248,9 @@ You can view the metadata for each request in an Internet browser by using a que
 
 [Technical Reference for App-V 5.0](technical-reference-for-app-v-50.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md b/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md
index f1506ca3e6..5971f5c937 100644
--- a/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md
+++ b/mdop/appv-v5/viewing-app-v-server-publishing-metadata51.md
@@ -1,8 +1,11 @@
 ---
 title: Viewing App-V Server Publishing Metadata
 description: Viewing App-V Server Publishing Metadata
-author: jamiejdt
+author: dansimp
 ms.assetid: d5fa9eb5-647c-478d-8a4d-0ecda018bce6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -55,7 +58,7 @@ In App-V 5.1, you must provide the following values in the address when you quer
 
 
 
- 
+
 
 ## Query syntax for viewing publishing metadata
 
@@ -111,9 +114,9 @@ The following table provides the syntax and query examples.
 
 
 
-
       
      
+
       
      
 
      To get the name of the Publishing server and the port number (http://<PubServer>:<Publishing Port#>) from the App-V Client, look at the URL configuration of the Get-AppvPublishingServer PowerShell cmdlet.
      
-
      http://pubsvr01:2718/?clientversion=5.0.10066.0&clientos=WindowsClient_6.2_x64
      
+
      http://pubsvr01:2718/?clientversion=5.0.10066.0&clientos=WindowsClient_6.2_x64
      
 
      In the example:
      
 
        
 
      • A Windows Server 2012 R2 named “pubsvr01” hosts the Publishing service.
        • 
@@ -124,20 +127,19 @@ The following table provides the syntax and query examples.
 
        App-V 5.0 through App-V 5.0 SP2
        
 
        http://<PubServer>:<Publishing Port#>/ 
        
 
        
-Note  
-
        ClientVersion and ClientOS are supported only in App-V 5.0 SP3 and App-V 5.1.
        
+Note
        ClientVersion and ClientOS are supported only in App-V 5.0 SP3 and App-V 5.1.
        
 
        
 
        
- 
+
 
        
 
        See the information for App-V 5.0 SP3 and App-V 5.1.
        
-
        http://pubsvr01:2718
        
+
        http://pubsvr01:2718
        
 
        In the example, A Windows Server 2012 R2 named “pubsvr01” hosts the Management and Publishing services.
        
 
 
 
 
- 
+
 
 ## Query values for client operating system and version
 
@@ -231,7 +233,7 @@ In your publishing metadata query, enter the string values that correspond to th
 
 
 
- 
+
 
 ## Definition of publishing metadata
 
@@ -256,9 +258,9 @@ You can view the metadata for each request in an Internet browser by using a que
 
 [Technical Reference for App-V 5.1](technical-reference-for-app-v-51.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/appv-v5/whats-new-in-app-v-50-sp1.md b/mdop/appv-v5/whats-new-in-app-v-50-sp1.md
index d2f510a0eb..6968160074 100644
--- a/mdop/appv-v5/whats-new-in-app-v-50-sp1.md
+++ b/mdop/appv-v5/whats-new-in-app-v-50-sp1.md
@@ -1,8 +1,11 @@
 ---
 title: What's new in App-V 5.0 SP1
 description: What's new in App-V 5.0 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: e97c2dbb-7b40-46a0-8137-9ee4fc2bd071
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/appv-v5/whats-new-in-app-v-50.md b/mdop/appv-v5/whats-new-in-app-v-50.md
index 6b82f04ffb..7d5f3286a2 100644
--- a/mdop/appv-v5/whats-new-in-app-v-50.md
+++ b/mdop/appv-v5/whats-new-in-app-v-50.md
@@ -1,8 +1,11 @@
 ---
 title: What's New in App-V 5.0
 description: What's New in App-V 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 79ff6e02-e926-4803-87d8-248a6b28099d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -107,13 +110,13 @@ The following table displays information about what has changed with the App-V 5
 
        If no stream optimization is performed, packages are stream faulted when they are requested by computers running the App-V 5.0 client until they can launch.
        
 
 
-
        Q:\
        
-
        App-V 5.0 uses the native file system and no longer requires a Q:\.
        
+
        Q:</p>
+
        App-V 5.0 uses the native file system and no longer requires a Q:.
        
 
 
 
 
- 
+ 
 
 ## Sequencing error detection
 
@@ -161,9 +164,9 @@ There is no file or application cache available with App-V 5.0.
 
 [About App-V 5.0](about-app-v-50.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/about-dart-10.md b/mdop/dart-v10/about-dart-10.md
index 009bacab2e..bc738c6bd9 100644
--- a/mdop/dart-v10/about-dart-10.md
+++ b/mdop/dart-v10/about-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: About DaRT 10
 description: About DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 02378035-58d1-4095-82fe-d60734a746fb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -26,7 +29,7 @@ DaRT 10 includes the following enhancements and changes as described in this top
     **Note**  
     For earlier versions of the Windows operating systems, continue to use the earlier versions of DaRT.
 
-     
+     
 
 -   **Windows Defender**
 
@@ -42,7 +45,7 @@ DaRT 10 includes the following enhancements and changes as described in this top
     **Note**  
     Windows ADK 10.0 is not required if you are installing only Remote Connection Viewer or Crash Analyzer.
 
-     
+     
 
 -   **Windows 10 Debugging Tools**
 
@@ -85,9 +88,9 @@ DaRT 10 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is par
 
 [Release Notes for DaRT 10](release-notes-for-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/accessibility-for-dart-10.md b/mdop/dart-v10/accessibility-for-dart-10.md
index 448fd5f04f..d6f65c76e7 100644
--- a/mdop/dart-v10/accessibility-for-dart-10.md
+++ b/mdop/dart-v10/accessibility-for-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Accessibility for DaRT 10
 description: Accessibility for DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 61d7a30c-3551-440d-bdcd-36333052c7b4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -30,7 +33,7 @@ Access keys let you quickly use a command by pressing a few keys. You can get to
 **Note**  
 To cancel the action that you are taking and hide the keyboard shortcuts, press ALT.
 
- 
+ 
 
 ## Documentation in alternative formats
 
@@ -64,13 +67,13 @@ For information about the availability of Microsoft product documentation and bo
 
        (609) 987-8116
        
 
 
-
        [http://www.learningally.org/](https://go.microsoft.com/fwlink/?linkid=239)
        
+
        http://www.learningally.org/
        
 
        Web addresses can change, so you might be unable to connect to the website or sites mentioned here.
        
 
 
 
 
- 
+ 
 
 ## Customer service for people with hearing impairments
 
@@ -93,9 +96,9 @@ For more information about how accessible technology for computers helps to impr
 
 [Getting Started with DaRT 10](getting-started-with-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/administering-dart-10-using-powershell.md b/mdop/dart-v10/administering-dart-10-using-powershell.md
index ba22bf1a11..566da0b7e9 100644
--- a/mdop/dart-v10/administering-dart-10-using-powershell.md
+++ b/mdop/dart-v10/administering-dart-10-using-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: Administering DaRT 10 Using PowerShell
 description: Administering DaRT 10 Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: eefe992f-077b-4e4b-8a5d-45b451614d7b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/creating-the-dart-10-recovery-image.md b/mdop/dart-v10/creating-the-dart-10-recovery-image.md
index d52b0749fb..01bc58f01f 100644
--- a/mdop/dart-v10/creating-the-dart-10-recovery-image.md
+++ b/mdop/dart-v10/creating-the-dart-10-recovery-image.md
@@ -1,8 +1,11 @@
 ---
 title: Creating the DaRT 10 Recovery Image
 description: Creating the DaRT 10 Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 173556de-2f20-4ea6-9e29-fc5ccc71ebd7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -89,7 +92,7 @@ On the Drivers tab of the Advanced Options page, you can add additional device d
 **Important**  
 When you select drivers to include, be aware that wireless connectivity (such as Bluetooth or 802.11a/b/g/n) is not supported in DaRT.
 
- 
+ 
 
 **To add drivers to the recovery image**
 
@@ -102,7 +105,7 @@ When you select drivers to include, be aware that wireless connectivity (such as
     **Note**  
     The driver file is provided by the manufacturer of the storage or network controller.
 
-     
+     
 
 4.  Repeat Steps 2 and 3 for every driver that you want to include.
 
@@ -141,7 +144,7 @@ The DaRT wizard checks for the tools in the `HKLM\Software\Microsoft\Windows Kit
 
 `%ProgramFilesX86%\Windows Kits\10.0\Debuggers\x86`
 
- 
+ 
 
 **To add the debugging tools for Crash Analyzer**
 
@@ -179,7 +182,7 @@ If you select the Edit Image check box on this page, you can customize the recov
     **Note**  
     The size of the image will vary, depending on the tools that you select and the files that you add in the wizard.
 
-     
+     
 
 2.  In the **Image name** box, enter a name for the DaRT recovery image, or accept the default name, which is DaRT10.
 
@@ -229,7 +232,7 @@ On the Create Bootable Media page, you can optionally copy the image file to a C
 **Note**  
 The Preboot execution environment (PXE) and local image deployment are not supported natively by this tool since they require additional enterprise tools, such as System Center Configuration Manager server and Microsoft Development Toolkit.
 
- 
+ 
 
 **To copy the recovery image to a CD, DVD, or USB**
 
@@ -240,7 +243,7 @@ The Preboot execution environment (PXE) and local image deployment are not suppo
     **Note**  
     If a drive is not recognized and you install a new drive, you can click **Refresh** to force the wizard to update the list of available drives.
 
-     
+     
 
 3.  Click the **Create Bootable Media** button.
 
@@ -253,9 +256,9 @@ The Preboot execution environment (PXE) and local image deployment are not suppo
 
 [Deploying DaRT 10](deploying-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/dart-10--c--page.md b/mdop/dart-v10/dart-10--c--page.md
index 32b6e4f24b..edbc333edd 100644
--- a/mdop/dart-v10/dart-10--c--page.md
+++ b/mdop/dart-v10/dart-10--c--page.md
@@ -1,8 +1,11 @@
 ---
 title: DaRT 10
 description: DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 4f62abe6-d971-44b4-b1e7-9dcaf199ca31
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/dart-10-cover-page.md b/mdop/dart-v10/dart-10-cover-page.md
index 234835b57c..93162131d7 100644
--- a/mdop/dart-v10/dart-10-cover-page.md
+++ b/mdop/dart-v10/dart-10-cover-page.md
@@ -1,8 +1,11 @@
 ---
 title: DaRT 10
 description: DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 875f6dc4-13f4-4625-8c6a-38215c2daf01
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/dart-10-deployment-checklist.md b/mdop/dart-v10/dart-10-deployment-checklist.md
index fad8dd8688..51c0fb097f 100644
--- a/mdop/dart-v10/dart-10-deployment-checklist.md
+++ b/mdop/dart-v10/dart-10-deployment-checklist.md
@@ -1,8 +1,11 @@
 ---
 title: DaRT 10 Deployment Checklist
 description: DaRT 10 Deployment Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: a6b7ba27-a969-4da9-bef0-d019739413cc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -19,7 +22,7 @@ This checklist can be used to help you during Microsoft Diagnostics and Recovery
 **Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+ 
 
 @@ -38,31 +41,31 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
-
+
        
 

        
 Checklist box
 
        Decide on the best DaRT 10 deployment option for your requirements and deploy it.
        [Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md)
        Deploying DaRT 10 to Administrator Computers
        		
 
        
 
        
 Checklist box
 
        Use the DaRT Recovery Image wizard to create the DaRT recovery image ISO.
        [Creating the DaRT 10 Recovery Image](creating-the-dart-10-recovery-image.md)
        Creating the DaRT 10 Recovery Image
        		
 
        
 
        
 Checklist box
 
        Decide on the best DaRT 10 recovery image deployment option for your requirements and deploy it.
        [Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-10.md)
        Deploying the DaRT Recovery Image
        		
 
        
         
 
        
 
- 
+ 
 
 ## Related topics
 
 
 [Deploying DaRT 10](deploying-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/dart-10-planning-checklist.md b/mdop/dart-v10/dart-10-planning-checklist.md
index a1c6877613..5db8a262f5 100644
--- a/mdop/dart-v10/dart-10-planning-checklist.md
+++ b/mdop/dart-v10/dart-10-planning-checklist.md
@@ -1,8 +1,11 @@
 ---
 title: DaRT 10 Planning Checklist
 description: DaRT 10 Planning Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: d6482534-cdf3-4997-bec0-33d0edf6924a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -19,7 +22,7 @@ This checklist can be used to help you plan for preparing your computing environ
 **Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+ 
 
 @@ -38,31 +41,31 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
-
+
        
 

        
 Checklist box
 
        Review the DaRT 10 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements.
        [DaRT 10 Supported Configurations](dart-10-supported-configurations.md)
        DaRT 10 Supported Configurations
        		
 
        
 
        
 Checklist box
 
        Understand the deployment prerequisites and decide which tools to include on the DaRT recovery image.
        [Planning to Create the DaRT 10 Recovery Image](planning-to-create-the-dart-10-recovery-image.md)
        Planning to Create the DaRT 10 Recovery Image
        		
 
        
 
        
 Checklist box
 
        Determine which method, or methods, you will use to deploy the DaRT recovery image.
        [Planning How to Save and Deploy the DaRT 10 Recovery Image](planning-how-to-save-and-deploy-the-dart-10-recovery-image.md)
        Planning How to Save and Deploy the DaRT 10 Recovery Image
        		
 
        
         
 
        
 
- 
+ 
 
 ## Related topics
 
 
 [Planning for DaRT 10](planning-for-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/dart-10-privacy-statement.md b/mdop/dart-v10/dart-10-privacy-statement.md
index f6f0ede217..ee32260042 100644
--- a/mdop/dart-v10/dart-10-privacy-statement.md
+++ b/mdop/dart-v10/dart-10-privacy-statement.md
@@ -1,8 +1,11 @@
 ---
 title: DaRT 10 Privacy Statement
 description: DaRT 10 Privacy Statement
-author: jamiejdt
+author: dansimp
 ms.assetid: 27ad36fe-6816-4fe8-8838-500c05b5b184
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/dart-10-supported-configurations.md b/mdop/dart-v10/dart-10-supported-configurations.md
index 993d899941..0a20396771 100644
--- a/mdop/dart-v10/dart-10-supported-configurations.md
+++ b/mdop/dart-v10/dart-10-supported-configurations.md
@@ -1,8 +1,11 @@
 ---
 title: DaRT 10 Supported Configurations
 description: DaRT 10 Supported Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: a07d6562-1fa9-499f-829c-9cc487ede0b7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -56,7 +59,7 @@ The following table lists the installation prerequisites for the administrator c
 
 
 
- 
+ 
 
 ### Help desk computer prerequisites
 
@@ -85,7 +88,7 @@ The following table lists the installation prerequisites for the help desk compu
 
 
 
- 
+ 
 
 ### End-user computer prerequisites
 
@@ -101,12 +104,12 @@ The following table lists the operating systems that are supported for the DaRT
 **Note**  
 Make sure that you allocate enough space for any additional tools that you want to install on the administrator computer.
 
- 
+ 
 
 **Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+ 
 
 @@ -147,7 +150,7 @@ Microsoft provides support for the current service pack and, in some cases, the
 
        
 

 
        
 
- 
+ 
 
 ###  DaRT help desk computer system requirements
 
@@ -236,7 +239,7 @@ The following table lists the operating systems that are supported for the DaRT
 
 
 
- 
+ 
 
 DaRT also has the following minimum hardware requirements for the end-user computer:
 
@@ -287,16 +290,16 @@ The Diagnostics and Recovery Toolset window in DaRT 10 requires that the end-use
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md b/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md
index 7897ed346a..84b8e13959 100644
--- a/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md
+++ b/mdop/dart-v10/deploying-dart-10-to-administrator-computers.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying DaRT 10 to Administrator Computers
 description: Deploying DaRT 10 to Administrator Computers
-author: jamiejdt
+author: dansimp
 ms.assetid: c1981cbe-10f8-41f6-8989-bcc9d57a2aa8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/deploying-dart-10.md b/mdop/dart-v10/deploying-dart-10.md
index 33031ba0bd..ba270e3a87 100644
--- a/mdop/dart-v10/deploying-dart-10.md
+++ b/mdop/dart-v10/deploying-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying DaRT 10
 description: Deploying DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 92cf70fd-006f-4fdc-9fb3-78d9d223148d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md b/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md
index b4b30b9e06..8bdf2391c1 100644
--- a/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md
+++ b/mdop/dart-v10/deploying-the-dart-recovery-image-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying the DaRT Recovery Image
 description: Deploying the DaRT Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 2b859da6-e31a-4240-8868-93a754328cf2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -27,7 +30,7 @@ Extract the boot.wim file from the ISO image and deploy in the recovery partitio
 **Important**  
 The **DaRT Recovery Image Wizard** provides the option to burn the image to a CD, DVD or UFD, but the other methods of saving and deploying the recovery image require additional steps that involve tools that are not included in DaRT. Some guidance and links for these other methods are provided in this section.
 
- 
+ 
 
 ## Deploy the DaRT recovery image as part of a recovery partition
 
@@ -48,9 +51,9 @@ You can host the recovery image on a central network boot server, such as Window
 
 [Deploying DaRT 10](deploying-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md b/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md
index ad7d0e6dd6..a13df573f8 100644
--- a/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md
+++ b/mdop/dart-v10/diagnosing-system-failures-with-crash-analyzer-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Diagnosing System Failures with Crash Analyzer
 description: Diagnosing System Failures with Crash Analyzer
-author: jamiejdt
+author: dansimp
 ms.assetid: 7ebef49e-a294-4173-adb1-7e6994aa01ad
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/getting-started-with-dart-10.md b/mdop/dart-v10/getting-started-with-dart-10.md
index daca6358aa..f81b153367 100644
--- a/mdop/dart-v10/getting-started-with-dart-10.md
+++ b/mdop/dart-v10/getting-started-with-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Getting Started with DaRT 10
 description: Getting Started with DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 593dd317-4fba-4d51-8a80-951590acede6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -16,11 +19,11 @@ ms.date: 08/30/2016
 
 Microsoft Diagnostics and Recovery Toolset (DaRT) 10 requires thorough planning before you deploy it or use its features. If you are new to this product, we recommend that you read the documentation carefully. Before you deploy the product to a production environment, we also recommend that you validate your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. 
 
->[!NOTE]  
->A downloadable version of this administrator’s guide is not available. However, you can click **Download PDF** at the bottom of the Table of Contents pane to get a PDF version of this guide.
+>[!NOTE]
+> A downloadable version of this administrator’s guide is not available. However, you can click **Download PDF** at the bottom of the Table of Contents pane to get a PDF version of this guide.
 >
 >Additional information about this product can also be found on the [Diagnostics and Recovery Toolset documentation download page.](https://www.microsoft.com/download/details.aspx?id=27754)
- 
+ 
 
 ## Getting started with DaRT 10
 
@@ -55,9 +58,9 @@ DaRT 10 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is par
 
 [Troubleshooting DaRT 10](troubleshooting-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md b/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md
index 56fa7d8505..8bc407173f 100644
--- a/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md
+++ b/mdop/dart-v10/how-to-change-repair-or-remove-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: How to Change, Repair, or Remove DaRT 10
 description: How to Change, Repair, or Remove DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: e7718c6f-06a1-48bb-b04b-1a0f659a0337
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/how-to-deploy-dart-10.md b/mdop/dart-v10/how-to-deploy-dart-10.md
index ede4cb677b..f911f88b74 100644
--- a/mdop/dart-v10/how-to-deploy-dart-10.md
+++ b/mdop/dart-v10/how-to-deploy-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: How to Deploy DaRT 10
 description: How to Deploy DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 13e8ba20-21c3-4870-94ed-6d3106d69f21
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -19,7 +22,7 @@ The following instructions explain how to deploy Microsoft Diagnostics and Recov
 **Important**  
 Before you install DaRT, see [DaRT 10 Supported Configurations](dart-10-supported-configurations.md) to ensure that you have installed all of the prerequisite software and that the computer meets the minimum system requirements. The computer onto which you install DaRT must be running Windows 10.
 
- 
+ 
 
 You can install DaRT using one of two different configurations:
 
@@ -83,7 +86,7 @@ msiexec.exe /i MSDaRT.msi /l*v log.txt
 **Note**  
 You can add /qn or /qb to perform a silent installation.
 
- 
+ 
 
 **To validate the DaRT installation**
 
@@ -98,9 +101,9 @@ You can add /qn or /qb to perform a silent installation.
 
 [Deploying DaRT 10 to Administrator Computers](deploying-dart-10-to-administrator-computers.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md b/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md
index 880b638ebc..8d2a4a4426 100644
--- a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md
+++ b/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: How to Deploy the DaRT Recovery Image as a Remote Partition
 description: How to Deploy the DaRT Recovery Image as a Remote Partition
-author: jamiejdt
+author: dansimp
 ms.assetid: 06a5e250-b992-4f6a-ad74-e7715f9e96e7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -27,7 +30,7 @@ After you have finished running the Microsoft Diagnostics and Recovery Toolset (
         **Note**  
         If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the boot.wim file from the \\sources folder. This lets you skip the need to mount the image.
 
-         
+         
 
 2.  Deploy the boot.wim file to a WDS server that can be accessed from end-user computers in your enterprise.
 
@@ -44,9 +47,9 @@ For more information about how to deploy DaRT as a remote partition, see [Walkth
 
 [Planning for DaRT 10](planning-for-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md b/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md
index 06c53b218f..a147d07a7b 100644
--- a/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md
+++ b/mdop/dart-v10/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition
 description: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition
-author: jamiejdt
+author: dansimp
 ms.assetid: 0d2192c1-4058-49fb-b0b6-baf4699ac7f5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -31,7 +34,7 @@ After you have finished running the Microsoft Diagnostics and Recovery Toolset (
         **Note**  
         If you burned a CD, DVD, or USB of the recovery image, you can open the files on the removable media and copy the boot.wim file from the \\sources folder. If you copy boot.wim file, you don’t need to mount the image.
 
-         
+         
 
 3.  Use the boot.wim file to create a bootable recovery partition by using your company’s standard method for creating a custom Windows RE image.
 
@@ -50,9 +53,9 @@ After you have finished running the Microsoft Diagnostics and Recovery Toolset (
 
 [Planning for DaRT 10](planning-for-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md b/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md
index 18cda6691b..4d6c8d968c 100644
--- a/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md
+++ b/mdop/dart-v10/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: How to Ensure that Crash Analyzer Can Access Symbol Files
 description: How to Ensure that Crash Analyzer Can Access Symbol Files
-author: jamiejdt
+author: dansimp
 ms.assetid: 39e307bd-5d21-4e44-bed6-bf532f580775
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md b/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md
index 71fc3577c2..f53350ad55 100644
--- a/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md
+++ b/mdop/dart-v10/how-to-perform-dart-tasks-by-using-powershell-commands-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: How to Perform DaRT Tasks by Using PowerShell Commands
 description: How to Perform DaRT Tasks by Using PowerShell Commands
-author: jamiejdt
+author: dansimp
 ms.assetid: f5a5c5f9-d667-4c85-9e82-7baf0b2aec6e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md b/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md
index 5ee106b2af..443db6f54f 100644
--- a/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md
+++ b/mdop/dart-v10/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: How to Recover Local Computers by Using the DaRT Recovery Image
 description: How to Recover Local Computers by Using the DaRT Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: a6adc717-827c-45e8-b9c3-06d0e919e0bd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -36,18 +39,20 @@ Use these instructions to recover a computer when you are physically present at
 
 6.  Select the installation that you want to repair or diagnose, and then click **Next**.
 
-    **Note**  
+    **Note**  
     If the Windows Recovery Environment (WinRE) detects or suspects that Windows 10 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically.
 
-     
 
-    If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available.
 
-    The **System Recovery Options** window appears and lists various recovery tools.
+~~~
+If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available.
 
-7.  On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset**.
+The **System Recovery Options** window appears and lists various recovery tools.
+~~~
 
-    The **Diagnostics and Recovery Toolset** window opens. You can now run any of the individual tools or wizards that were included when the DaRT recovery image was created.
+7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset**.
+
+   The **Diagnostics and Recovery Toolset** window opens. You can now run any of the individual tools or wizards that were included when the DaRT recovery image was created.
 
 You can click **Help** on the **Diagnostics and Recovery Toolset** window to open the client Help file that provides detailed instruction and information needed to run the individual DaRT tools. You can also click the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to choose the best tool for the situation, based on a brief interview that the wizard provides.
 
@@ -55,41 +60,40 @@ For general information about any of the DaRT tools, see [Overview of the Tools
 
 **How to run DaRT at the command prompt**
 
--   To run DaRT at the command prompt, specify the **netstart.exe** command then use any of the following parameters:
+- To run DaRT at the command prompt, specify the **netstart.exe** command then use any of the following parameters:
+
+  
+  +  +  +  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
        



        Parameter
        Description
        -network
        Initializes the network services.
        -remount
        Remaps the drive letters.
        -prompt
        Displays messages that ask the end user to specify whether to initialize the network and remap the drives.
        
+  
        
+  Warning
        The end user’s response to the prompt overrides the –network and –remount switches.
        
+  
        
+  
        
+
+  
        
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
        



        Parameter
        Description
        -network
        Initializes the network services.
        -remount
        Remaps the drive letters.
        -prompt
        Displays messages that ask the end user to specify whether to initialize the network and remap the drives.
        
-    
        
-    Warning  
-    
        The end user’s response to the prompt overrides the –network and –remount switches.
        
-    
        
-    
        
-     
-    
        
 
-     
 
 ## Related topics
 
@@ -98,9 +102,9 @@ For general information about any of the DaRT tools, see [Overview of the Tools
 
 [Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md b/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md
index 9ced74cb37..90f2db33d1 100644
--- a/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md
+++ b/mdop/dart-v10/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: How to Recover Remote Computers by Using the DaRT Recovery Image
 description: How to Recover Remote Computers by Using the DaRT Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: c0062208-39cd-4e01-adf8-36a11386e2ea
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -32,113 +35,116 @@ If you disabled the DaRT tools when you created the recovery image, you still ha
 
     Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user.
 
-    **Note**  
+    **Note**  
     Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization.
 
-     
 
-    As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears.
 
-2.  When you are asked whether you want to initialize network services, select one of the following:
+~~~
+As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears.
+~~~
 
-    **Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address.
+2. When you are asked whether you want to initialize network services, select one of the following:
 
-    **No** - skip the network initialization process.
+   **Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address.
 
-3.  Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process.
+   **No** - skip the network initialization process.
 
-4.  On the **System Recovery Options** dialog box, select a keyboard layout.
+3. Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process.
 
-5.  Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver.
+4. On the **System Recovery Options** dialog box, select a keyboard layout.
 
-6.  Select the installation that you want to repair or diagnose, and then click **Next**.
+5. Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver.
 
-    **Note**  
-    If the Windows Recovery Environment (WinRE) detects or suspects that Windows 10 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. For information about how to resolve this issue, see [Troubleshooting DaRT 10](troubleshooting-dart-10.md).
+6. Select the installation that you want to repair or diagnose, and then click **Next**.
 
-     
+   **Note**  
+   If the Windows Recovery Environment (WinRE) detects or suspects that Windows 10 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. For information about how to resolve this issue, see [Troubleshooting DaRT 10](troubleshooting-dart-10.md).
 
-    If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available.
 
-    The **System Recovery Options** window appears and lists various recovery tools.
 
-7.  On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset**.
+~~~
+If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available.
 
-8.  On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**.
+The **System Recovery Options** window appears and lists various recovery tools.
+~~~
 
-    The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information.
+7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset**.
 
-9.  On the help desk computer, open the **DaRT Remote Connection Viewer**.
+8. On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**.
+
+   The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information.
+
+9. On the help desk computer, open the **DaRT Remote Connection Viewer**.
 
 10. Click **Start**, click **All Programs**, click **Microsoft DaRT 10**, and then click **DaRT Remote Connection Viewer**.
 
 11. In the **DaRT Remote Connection** window, enter the required ticket, IP address, and port information.
 
-    **Note**  
-    This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer.
+   **Note**  
+   This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer.
+
 
-     
 
 12. Click **Connect**.
 
 The IT administrator now assumes control of the end-user computer and can run the DaRT tools remotely.
 
-**Note**  
+**Note**  
 A file is provided that is named inv32.xml and contains remote connection information, such as the port number and IP address. By default, the file is typically located at %windir%\\system32.
 
- 
+
 
 **To customize the Remote Connection process**
 
-1.  You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413).
+1. You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413).
 
-    Specify the following commands and parameters to customize how a remote connection is established with an end-user computer:
+   Specify the following commands and parameters to customize how a remote connection is established with an end-user computer:
 
-    
-    -    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
        




        CommandParameterDescription
        RemoteRecovery.exe
        -nomessage
        Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt.
        WaitForConnection.exe
        none
        Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer.
        
-    
        
-    Important  
-    
        This command serves no function if it is specified independently. It must be specified in a script to function correctly.
        
-    
        
-    
        
-     
-    
        
+   
+   +   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
        




        CommandParameterDescription
        RemoteRecovery.exe
        -nomessage
        Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt.
        WaitForConnection.exe
        none
        Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer.
        
+   
        
+   Important
        This command serves no function if it is specified independently. It must be specified in a script to function correctly.
        
+   
        
+   
        
 
-     
+   
        
 
-2.  The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT:
 
-    ``` syntax
-    [LaunchApps]
-    "%windir%\system32\netstart.exe -network -remount"
-    "cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage"
-    "%windir%\system32\WaitForConnection.exe"
-    "%SYSTEMDRIVE%\sources\recovery\recenv.exe"
-    ```
+
+2. The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT:
+
+   ```ini
+   [LaunchApps]
+   "%windir%\system32\netstart.exe -network -remount"
+   "cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage"
+   "%windir%\system32\WaitForConnection.exe"
+   "%SYSTEMDRIVE%\sources\recovery\recenv.exe"
+   ```
 
 When DaRT starts, it creates the file inv32.xml in \\Windows\\System32\\ on the RAM disk. This file contains connection information: IP address, port, and ticket number. You can copy this file to a network share to trigger a Help desk workflow. For example, a custom program can check the network share for connection files, and then create a support ticket or send email notifications.
 
@@ -173,14 +179,16 @@ When DaRT starts, it creates the file inv32.xml in \\Windows\\System32\\ on the
     
     
 
-     
 
-    **Note**  
-    The variables for these parameters are created on the end-user computer and must be provided by the end user.
 
-     
+~~~
+**Note**  
+The variables for these parameters are created on the end-user computer and must be provided by the end user.
+~~~
 
-2.  If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified.
+
+
+2. If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified.
 
 ## Related topics
 
@@ -189,9 +197,9 @@ When DaRT starts, it creates the file inv32.xml in \\Windows\\System32\\ on the
 
 [Recovering Computers Using DaRT 10](recovering-computers-using-dart-10.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md b/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md
index 2f720d2d24..1d01911abd 100644
--- a/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md
+++ b/mdop/dart-v10/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer
 description: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: 27c1e1c6-123a-4f8a-b7d2-5bddc9ca3249
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md b/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md
index 44d50c9191..7f67229645 100644
--- a/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md
+++ b/mdop/dart-v10/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: How to Run the Crash Analyzer on an End-user Computer
 description: How to Run the Crash Analyzer on an End-user Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: 10334800-ff8e-43ac-a9c2-d28807473ec2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md b/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md
index 3e9c97bec1..0b1feb848a 100644
--- a/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md
+++ b/mdop/dart-v10/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: How to Use a PowerShell Script to Create the Recovery Image
 description: How to Use a PowerShell Script to Create the Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: cf5b0814-71a8-4f0b-b1f1-1ac6d8b51c4f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/index.md b/mdop/dart-v10/index.md
index ca199090fb..5d88fce5c0 100644
--- a/mdop/dart-v10/index.md
+++ b/mdop/dart-v10/index.md
@@ -1,7 +1,7 @@
 ---
 title: Diagnostics and Recovery Toolset 10
 description: Diagnostics and Recovery Toolset 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 64403eca-ff05-4327-ac33-bdcc96e706c8
 ms.pagetype: mdop
 ms.mktglfcycl: support
diff --git a/mdop/dart-v10/operations-for-dart-10.md b/mdop/dart-v10/operations-for-dart-10.md
index 8923801ee1..6e12927ca8 100644
--- a/mdop/dart-v10/operations-for-dart-10.md
+++ b/mdop/dart-v10/operations-for-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Operations for DaRT 10
 description: Operations for DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 1776d5ed-96c6-4841-a097-721d8cf5c7f7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/overview-of-the-tools-in-dart-10.md b/mdop/dart-v10/overview-of-the-tools-in-dart-10.md
index 3b04364d2d..d5908052a6 100644
--- a/mdop/dart-v10/overview-of-the-tools-in-dart-10.md
+++ b/mdop/dart-v10/overview-of-the-tools-in-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Overview of the Tools in DaRT 10
 description: Overview of the Tools in DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 752467dd-b646-4335-82ce-9090d4651f65
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -30,7 +33,7 @@ A description of the DaRT 10 tools follows.
 **Note**  
 The recovery of dynamic disks with DaRT is not supported.
 
- 
+ 
 
 ### Crash Analyzer
 
@@ -57,12 +60,12 @@ For more information about **Crash Analyzer**, see [Diagnosing System Failures w
 **Warning**  
 We recommend that you back up a disk before you use **Disk Commander** to repair it. By using **Disk Commander**, you can potentially damage volumes and make them inaccessible. Additionally, changes to one volume can affect other volumes because volumes on a disk share a partition table.
 
- 
+ 
 
 **Note**  
 The recovery of dynamic disks with DaRT is not supported.
 
- 
+ 
 
 ### Disk Wipe
 
@@ -71,7 +74,7 @@ You can use **Disk Wipe** to delete all data from a disk or volume, even the dat
 **Warning**  
 After wiping a disk or volume, you cannot recover the data. Verify the size and label of a volume before erasing it.
 
- 
+ 
 
 ### Explorer
 
@@ -84,7 +87,7 @@ The **Explorer** tool lets you browse the computer’s file system and network s
 **Note**  
 The recovery of dynamic disks with DaRT is not supported.
 
- 
+ 
 
 ### File Search
 
@@ -101,7 +104,7 @@ We recommend that you uninstall only one hotfix at a time, even though the tool
 **Important**  
 Programs that were installed or updated after a hotfix was installed might not work correctly after you uninstall a hotfix.
 
- 
+ 
 
 ### Locksmith
 
@@ -116,7 +119,7 @@ You can use **Registry Editor** to access and change the registry of the Windows
 **Warning**  
 Serious problems can occur if you change the registry incorrectly by using **Registry Editor**. These problems might require you to reinstall the operating system. Before you make changes to the registry, you should back up any valued data on the computer. Change the registry at your own risk.
 
- 
+ 
 
 ### SFC Scan
 
@@ -135,9 +138,9 @@ When you boot a problem computer into DaRT, it is set to automatically obtain it
 
 [Getting Started with DaRT 10](getting-started-with-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/planning-for-dart-10.md b/mdop/dart-v10/planning-for-dart-10.md
index 123f2b0c69..d907bb9ecc 100644
--- a/mdop/dart-v10/planning-for-dart-10.md
+++ b/mdop/dart-v10/planning-for-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for DaRT 10
 description: Planning for DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 2ca0249a-6a9f-4b4e-91f1-f1b34be7b16c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md b/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md
index 5b0f70935e..f76a87d4d5 100644
--- a/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md
+++ b/mdop/dart-v10/planning-how-to-save-and-deploy-the-dart-10-recovery-image.md
@@ -1,8 +1,11 @@
 ---
 title: Planning How to Save and Deploy the DaRT 10 Recovery Image
 description: Planning How to Save and Deploy the DaRT 10 Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 9a3e5413-2621-49ce-8bd2-992616691703
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -21,7 +24,7 @@ If your organization uses Active Directory Domain Services (AD DS), you may want
 **Note**  
 You may want to use more than one method in your organization. For example, you can boot into DaRT from a remote partition for most situations and have a USB flash drive available in case the end-user computer cannot connect to the network.
 
- 
+ 
 
 The following table shows some advantages and disadvantages of each method of using DaRT in your organization.
 
@@ -77,16 +80,16 @@ The following table shows some advantages and disadvantages of each method of us
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md b/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md
index 0ad9cb0ea7..7089ba0bff 100644
--- a/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md
+++ b/mdop/dart-v10/planning-to-create-the-dart-10-recovery-image.md
@@ -1,8 +1,11 @@
 ---
 title: Planning to Create the DaRT 10 Recovery Image
 description: Planning to Create the DaRT 10 Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: a0087d93-b88f-454b-81b2-3c7ce3718023
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -46,26 +49,24 @@ The following items are required or recommended for creating the DaRT recovery i
 
 
 
        Windows Debugging Tools for your platform
        
-
        Required when you run the Crash Analyzer to determine the cause of a computer failure. We recommend that you specify the path of the Windows Debugging Tools at the time that you create the DaRT recovery image. You can download the Windows Debugging Tools here: [Download and Install Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=99934).
        
+
        Required when you run the Crash Analyzer to determine the cause of a computer failure. We recommend that you specify the path of the Windows Debugging Tools at the time that you create the DaRT recovery image. You can download the Windows Debugging Tools here: Download and Install Debugging Tools for Windows.
        
 
 
 
        Optional: Windows symbols files for use with Crash Analyzer
        
-
        Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding, for example, if it stopped working. For more information, see [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer-dart-10.md).
        
+
        Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding, for example, if it stopped working. For more information, see Diagnosing System Failures with Crash Analyzer.
        
 
 
 
 
- 
+ 
 
 ## Related topics
 
-
 [Planning to Deploy DaRT 10](planning-to-deploy-dart-10.md)
 
- 
-
- 
+ 
 
+ 
 
 
 
diff --git a/mdop/dart-v10/planning-to-deploy-dart-10.md b/mdop/dart-v10/planning-to-deploy-dart-10.md
index 12f51c9595..a3f8fabb1c 100644
--- a/mdop/dart-v10/planning-to-deploy-dart-10.md
+++ b/mdop/dart-v10/planning-to-deploy-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Planning to Deploy DaRT 10
 description: Planning to Deploy DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 32a39e97-a889-4aae-982c-b85cdc3d9134
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/recovering-computers-using-dart-10.md b/mdop/dart-v10/recovering-computers-using-dart-10.md
index c665c2754e..a8d8499941 100644
--- a/mdop/dart-v10/recovering-computers-using-dart-10.md
+++ b/mdop/dart-v10/recovering-computers-using-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Recovering Computers Using DaRT 10
 description: Recovering Computers Using DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 2ad7fab0-c22d-4171-8b5a-b2b7d7c0ad2d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -31,7 +34,7 @@ Whichever method that you use to boot into DaRT, you must enable the boot device
 **Note**  
 Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization.
 
- 
+ 
 
 ## Recover a local computer by using the DaRT recovery image
 
@@ -48,7 +51,7 @@ The Remote Connection feature in DaRT lets an IT administrator run the DaRT tool
 **Important**  
 The two computers establishing a remote connection must be part of the same network.
 
- 
+ 
 
 The **Diagnostics and Recovery Toolset** window includes the option to run DaRT on an end-user computer remotely from an administrator computer. The end user opens the DaRT tools on the problem computer and starts the remote session by clicking **Remote Connection**.
 
@@ -63,9 +66,9 @@ The IT administrator or help desk worker enters this information into the **DaRT
 
 [Operations for DaRT 10](operations-for-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/release-notes-for-dart-10.md b/mdop/dart-v10/release-notes-for-dart-10.md
index d7c7a58914..422e6479b3 100644
--- a/mdop/dart-v10/release-notes-for-dart-10.md
+++ b/mdop/dart-v10/release-notes-for-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Release Notes for DaRT 10
 description: Release Notes for DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: eb996980-f9c4-42cb-bde9-6b3d4b82b58c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/security-and-privacy-for-dart-10.md b/mdop/dart-v10/security-and-privacy-for-dart-10.md
index 4ec961acaf..8a01341fe5 100644
--- a/mdop/dart-v10/security-and-privacy-for-dart-10.md
+++ b/mdop/dart-v10/security-and-privacy-for-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Security and Privacy for DaRT 10
 description: Security and Privacy for DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 9ce5d555-c4e9-4482-a147-27b26579c935
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v10/security-considerations-for-dart-10.md b/mdop/dart-v10/security-considerations-for-dart-10.md
index 12a26a2faf..41712c5ad9 100644
--- a/mdop/dart-v10/security-considerations-for-dart-10.md
+++ b/mdop/dart-v10/security-considerations-for-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Security Considerations for DaRT 10
 description: Security Considerations for DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: c653daf1-f12a-4667-98cc-f0c89fa38e3f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
@@ -35,7 +38,7 @@ You can even configure the DaRT image so that the option to start a remote conne
 **Important**  
 After the remote connection is established, all the tools that you included in the recovery image, including those unavailable to the end user, will become available to any help desk worker who is working on the end–user computer.
 
- 
+ 
 
 For more information about including tools in the DaRT recovery image, see [Overview of the Tools in DaRT 10](overview-of-the-tools-in-dart-10.md).
 
@@ -47,7 +50,7 @@ If you deploy the DaRT recovery image by saving it to a USB flash drive or by cr
 **Note**  
 DaRT 10 supports BitLocker natively.
 
- 
+ 
 
 To include drive encryption, add the encryption solution files when you create the recovery image. Your encryption solution must be able to run on WinPE. End users who boot from the ISO are then able to access that encryption solution and unblock the drive.
 
@@ -61,9 +64,9 @@ By default, the communication between two computers that have established a **Re
 
 [Security and Privacy for DaRT 10](security-and-privacy-for-dart-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v10/troubleshooting-dart-10.md b/mdop/dart-v10/troubleshooting-dart-10.md
index d644576254..2ba6f1ddfb 100644
--- a/mdop/dart-v10/troubleshooting-dart-10.md
+++ b/mdop/dart-v10/troubleshooting-dart-10.md
@@ -1,8 +1,11 @@
 ---
 title: Troubleshooting DaRT 10
 description: Troubleshooting DaRT 10
-author: jamiejdt
+author: dansimp
 ms.assetid: 76d42a00-3f6b-4730-8857-39fe49535d37
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
diff --git a/mdop/dart-v65.md b/mdop/dart-v65.md
index 21aca15b8d..ef08a90758 100644
--- a/mdop/dart-v65.md
+++ b/mdop/dart-v65.md
@@ -1,14 +1,17 @@
 ---
 title: Diagnostics and Recovery Toolset 6.5
 description: Diagnostics and Recovery Toolset 6.5
-author: jamiejdt
+author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 # Diagnostics and Recovery Toolset 6.5
 
-Selecting the link for [Diagnostics and Recovery Toolset 6.5 documentation](https://technet.microsoft.com/library/jj713388.aspx) will take you to another website. Use your browser's **Back** button to return to this page.   
\ No newline at end of file
+Selecting the link for [Diagnostics and Recovery Toolset 6.5 documentation](https://technet.microsoft.com/library/jj713388.aspx) will take you to another website. Use your browser's **Back** button to return to this page.   
diff --git a/mdop/dart-v7/TOC.md b/mdop/dart-v7/TOC.md
index e96ad44e5f..5688dce81f 100644
--- a/mdop/dart-v7/TOC.md
+++ b/mdop/dart-v7/TOC.md
@@ -26,7 +26,7 @@
 ### [Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md)
 #### [How to Recover Local Computers Using the DaRT Recovery Image](how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md)
 #### [How to Recover Remote Computers Using the DaRT Recovery Image](how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md)
-### [Diagnosing System Failures with Crash Analyzer ](diagnosing-system-failures-with-crash-analyzer--dart-7.md)
+### [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md)
 #### [How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md)
 #### [How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md)
 #### [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md)
diff --git a/mdop/dart-v7/about-dart-70-new-ia.md b/mdop/dart-v7/about-dart-70-new-ia.md
index 72f6ebf53f..bad11f06bb 100644
--- a/mdop/dart-v7/about-dart-70-new-ia.md
+++ b/mdop/dart-v7/about-dart-70-new-ia.md
@@ -1,12 +1,15 @@
 ---
 title: About DaRT 7.0
 description: About DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 217ffafc-6d73-4b80-88d9-71870460d4ab
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v7/accessibility-for-dart-70.md b/mdop/dart-v7/accessibility-for-dart-70.md
index 469929df6d..728b5a9f48 100644
--- a/mdop/dart-v7/accessibility-for-dart-70.md
+++ b/mdop/dart-v7/accessibility-for-dart-70.md
@@ -1,12 +1,15 @@
 ---
 title: Accessibility for DaRT 7.0
 description: Accessibility for DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 41f7bb72-4f1d-44fb-bc3f-8b66557fec2f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -30,7 +33,7 @@ Access keys let you quickly use a command by pressing a few keys. You can get to
 **Note**  
 To cancel the action that you are taking and hide the keyboard shortcuts, press ALT.
 
- 
+ 
 
 ## Documentation in Alternative Formats
 
@@ -64,13 +67,13 @@ For information about the availability of Microsoft product documentation and bo
 
        (609) 987-8116
        
 
 
-
        [http://www.learningally.org/](https://go.microsoft.com/fwlink/?linkid=239)
        
+
        http://www.learningally.org/
        
 
        Web addresses can change, so you might be unable to connect to the website or sites mentioned here.
        
 
 
 
 
- 
+ 
 
 ## Customer Service for People with Hearing Impairments
 
@@ -93,9 +96,9 @@ For more information about how accessible technology for computers helps to impr
 
 [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md b/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md
index c8bba81fae..7158d4abbf 100644
--- a/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md
+++ b/mdop/dart-v7/creating-the-dart-70-recovery-image-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: Creating the DaRT 7.0 Recovery Image
 description: Creating the DaRT 7.0 Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: ebb2ec58-0349-469d-a23f-3f944fe4c1fa
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -26,7 +29,7 @@ You can write the ISO to a recordable CD or DVD, save it to a USB flash drive, o
 **Note**  
 If your computer includes a CD-RW drive, the wizard offers to burn the ISO image to a blank CD or DVD. If your computer does not include a drive that is supported by the wizard, you can burn the ISO image onto a CD or DVD by using most programs that can burn a CD or DVD.
 
- 
+ 
 
 To create a bootable CD or DVD from the ISO image, you must have:
 
@@ -39,7 +42,7 @@ To create a bootable CD or DVD from the ISO image, you must have:
     **Important**  
     Test the CD or DVD that you create on all the different kinds of computers that you intend to support because some computers cannot start from all kinds of recordable media.
 
-     
+     
 
 To save the ISO image to a USB flash drive (UFD), you must have:
 
@@ -61,9 +64,9 @@ You can create a DaRT recovery image that can only be used for a certain number
 
 -   [Deploying DaRT 7.0](deploying-dart-70-new-ia.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md b/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md
index e489ffeed5..ab0a13cab2 100644
--- a/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md
+++ b/mdop/dart-v7/dart-70-deployment-checklist-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: DaRT 7.0 Deployment Checklist
 description: DaRT 7.0 Deployment Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 2c68ec15-0624-4a75-8237-05c68b61ad07
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ This checklist can be used to help you during Microsoft Diagnostics and Recovery
 **Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+ 
 
 @@ -38,31 +41,31 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
-
+
        
 

        
 Checklist box
 
        Decide on the best DaRT 7 deployment option for your requirements and deploy it.
        [Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md)
        Deploying DaRT 7.0 to Administrator Computers
        		
 
        
 
        
 Checklist box
 
        Use the DaRT Recovery Image Wizard to create the DaRT recovery image ISO.
        [Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md)
        Creating the DaRT 7.0 Recovery Image
        		
 
        
 
        
 Checklist box
 
        Decide on the best DaRT 7 recovery image deployment option for your requirements and deploy it.
        [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md)
        Deploying the DaRT 7.0 Recovery Image
        		
 
        
         
 
        
 
- 
+ 
 
 ## Related topics
 
 
 [Deploying DaRT 7.0](deploying-dart-70-new-ia.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/dart-70-planning-checklist-dart-7.md b/mdop/dart-v7/dart-70-planning-checklist-dart-7.md
index 33aa2a6df1..8c9dbcaa92 100644
--- a/mdop/dart-v7/dart-70-planning-checklist-dart-7.md
+++ b/mdop/dart-v7/dart-70-planning-checklist-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: DaRT 7.0 Planning Checklist
 description: DaRT 7.0 Planning Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: f97a2318-6597-4774-a854-bb546279a8fd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ This checklist can be used to help you plan for preparing your computing environ
 **Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+ 
 
 @@ -38,31 +41,31 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
-
+
        
 

        
 Checklist box
 
        Review the DaRT 7 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements.
        [DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md)
        DaRT 7.0 Supported Configurations
        		
 
        
 
        
 Checklist box
 
        Understand the deployment prerequisites and decide which tools to include on the DaRT recovery image.
        [Planning to Create the DaRT 7.0 Recovery Image](planning-to-create-the-dart-70-recovery-image.md)
        Planning to Create the DaRT 7.0 Recovery Image
        		
 
        
 
        
 Checklist box
 
        Determine which method, or methods, you will use to deploy the DaRT recovery image.
        [Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md)
        Planning How to Save and Deploy the DaRT 7.0 Recovery Image
        		
 
        
         
 
        
 
- 
+ 
 
 ## Related topics
 
 
 [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/dart-70-supported-configurations-dart-7.md b/mdop/dart-v7/dart-70-supported-configurations-dart-7.md
index 835b955fa4..790c2e9077 100644
--- a/mdop/dart-v7/dart-70-supported-configurations-dart-7.md
+++ b/mdop/dart-v7/dart-70-supported-configurations-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: DaRT 7.0 Supported Configurations
 description: DaRT 7.0 Supported Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: e9ee87b0-3254-4625-b178-17b2f5b8f8c8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v7/deploying-dart-70-new-ia.md b/mdop/dart-v7/deploying-dart-70-new-ia.md
index 54c3257e58..4b535951b5 100644
--- a/mdop/dart-v7/deploying-dart-70-new-ia.md
+++ b/mdop/dart-v7/deploying-dart-70-new-ia.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying DaRT 7.0
 description: Deploying DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 7bc99bce-b94f-4074-ba88-986ed76f8a6c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md b/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md
index 26e6517c66..107a1f0256 100644
--- a/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md
+++ b/mdop/dart-v7/deploying-dart-70-to-administrator-computers-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying DaRT 7.0 to Administrator Computers
 description: Deploying DaRT 7.0 to Administrator Computers
-author: jamiejdt
+author: dansimp
 ms.assetid: 8baf26aa-b168-463c-810f-a165918b9d9f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md b/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md
index 3ec80e4db5..d5be1d6f03 100644
--- a/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md
+++ b/mdop/dart-v7/deploying-the-dart-70-recovery-image-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the DaRT 7.0 Recovery Image
 description: Deploying the DaRT 7.0 Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 6bba7bff-800f-44e4-bcfc-e143115607ca
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -27,7 +30,7 @@ After you have created the International Organization for Standardization (ISO)
 **Important**  
 The **DaRT Recovery Image Wizard** only provides the option to burn a CD or DVD. All other methods of saving and deploying the recovery image require additional steps that involve tools that are not included in DaRT. Some guidance and links for these other methods are provided in this section.
 
- 
+ 
 
 ## Deploy the DaRT Recovery Image Using a USB Flash Drive
 
@@ -55,9 +58,9 @@ After you have finished running the DaRT Recovery Image Wizard and created the r
 
 -   [Deploying DaRT 7.0](deploying-dart-70-new-ia.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md b/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md
index fd668ac07b..793f1a332e 100644
--- a/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md
+++ b/mdop/dart-v7/diagnosing-system-failures-with-crash-analyzer--dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: Diagnosing System Failures with Crash Analyzer
 description: Diagnosing System Failures with Crash Analyzer
-author: jamiejdt
+author: dansimp
 ms.assetid: 170d40ef-4edb-4a32-a349-c285c0ea5e56
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v7/getting-started-with-dart-70-new-ia.md b/mdop/dart-v7/getting-started-with-dart-70-new-ia.md
index 178ece1f8e..4a0b5db556 100644
--- a/mdop/dart-v7/getting-started-with-dart-70-new-ia.md
+++ b/mdop/dart-v7/getting-started-with-dart-70-new-ia.md
@@ -1,12 +1,15 @@
 ---
 title: Getting Started with DaRT 7.0
 description: Getting Started with DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 796f52ce-0935-4d3d-9437-289b4c7b16c3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -21,7 +24,7 @@ This section provides general information for administrators who are evaluating
 **Note**  
 A downloadable version of this document and the DaRT 7 Evaluation Guide can be downloaded from .
 
- 
+ 
 
 ## Getting Started With DaRT 7
 
@@ -51,9 +54,9 @@ A downloadable version of this document and the DaRT 7 Evaluation Guide can be d
 
 -   [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md b/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md
index b9c284b714..07c0c01702 100644
--- a/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md
+++ b/mdop/dart-v7/how-to-change-repair-or-remove-dart-70.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change, Repair, or Remove DaRT 7.0
 description: How to Change, Repair, or Remove DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: a65ff4f3-2b6d-4105-a7a0-67c87e8e7300
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md b/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md
index 4fb4b2d576..91c0b79888 100644
--- a/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md
+++ b/mdop/dart-v7/how-to-create-a-time-limited-recovery-image-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create a Time Limited Recovery Image
 description: How to Create a Time Limited Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: d2e29cac-c24c-4239-997f-0320b8a830ae
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v7/how-to-deploy-dart-70.md b/mdop/dart-v7/how-to-deploy-dart-70.md
index 87fd57d726..23d20d5d80 100644
--- a/mdop/dart-v7/how-to-deploy-dart-70.md
+++ b/mdop/dart-v7/how-to-deploy-dart-70.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy DaRT 7.0
 description: How to Deploy DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 30522441-40cb-4eca-99b4-dff758f5c647
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ This topic provides instructions to deploy Microsoft Diagnostics and Recovery To
 **Important**  
 Before you install DaRT, ensure that the computer meets the minimum system requirements listed in [DaRT 7.0 Supported Configurations](dart-70-supported-configurations-dart-7.md).
 
- 
+ 
 
 **To install DaRT on an administrator computer**
 
@@ -74,16 +77,16 @@ Before you install DaRT, ensure that the computer meets the minimum system requi
 **Note**  
 You can add /qn or /qb to any of the DaRT installation command prompt options to perform a silent installation.
 
- 
+ 
 
 ## Related topics
 
 
 [Deploying DaRT 7.0 to Administrator Computers](deploying-dart-70-to-administrator-computers-dart-7.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md
index 9d0f31bc17..39343027eb 100644
--- a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md
+++ b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy the DaRT Recovery Image as a Remote Partition
 description: How to Deploy the DaRT Recovery Image as a Remote Partition
-author: jamiejdt
+author: dansimp
 ms.assetid: 757c9340-8eac-42e8-85de-4302e436713a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -27,7 +30,7 @@ After you have finished running the DaRT Recovery Image Wizard and created the r
         **Note**  
         If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the boot.wim file from the \\sources folder. This lets you skip the need to mount the image.
 
-         
+         
 
 2.  Deploy the boot.wim file to a WDS server that can be accessed from end-user computers in your enterprise.
 
@@ -44,9 +47,9 @@ For more information about how to deploy DaRT as a remote partition, see the fol
 
 [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md
index 59e87dc1ea..3ec6953ff3 100644
--- a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md
+++ b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition
 description: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition
-author: jamiejdt
+author: dansimp
 ms.assetid: 462f2d08-f03b-4a07-b2d3-c69205dc6f70
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -31,7 +34,7 @@ After you have finished running the DaRT Recovery Image Wizard and created the r
         **Note**  
         If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the boot.wim file from the \\sources folder. This lets you skip the need to mount the image.
 
-         
+         
 
 3.  Use the boot.wim file to create a bootable recovery partition by using your company’s standard method for creating a custom Windows RE image.
 
@@ -48,9 +51,9 @@ For more information about how to deploy a recovery solution to reinstall the fa
 
 [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md
index 72dd6df1b7..aebbdbfef1 100644
--- a/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md
+++ b/mdop/dart-v7/how-to-deploy-the-dart-recovery-image-using-a-usb-flash-drive-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy the DaRT Recovery Image Using a USB Flash Drive
 description: How to Deploy the DaRT Recovery Image Using a USB Flash Drive
-author: jamiejdt
+author: dansimp
 ms.assetid: 5b7aa843-731e-47e7-b5f9-48d08da732d6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -44,7 +47,7 @@ You can also manually copy the ISO image file to a UFD by following the steps pr
         **Note**  
         The previous code example assumes Disk 1 is the UFD. If it is necessary, replace DISK 1 with your disk number.
 
-         
+         
 
 2.  By using your company’s preferred method of mounting an image, mount the ISO image file that you created in the **Create Startup Image** dialog box of the **DaRT Recovery Image Wizard**. This requires that you have a method available to mount an image file.
 
@@ -53,16 +56,16 @@ You can also manually copy the ISO image file to a UFD by following the steps pr
     **Note**  
     If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the contents to the UFD. This lets you skip the need to mount the image.
 
-     
+     
 
 ## Related topics
 
 
 [Deploying the DaRT 7.0 Recovery Image](deploying-the-dart-70-recovery-image-dart-7.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md b/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md
index 1535f0a13c..a241116de7 100644
--- a/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md
+++ b/mdop/dart-v7/how-to-ensure-that-crash-analyzer-can-access-symbol-files-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: How to Ensure that Crash Analyzer Can Access Symbol Files
 description: How to Ensure that Crash Analyzer Can Access Symbol Files
-author: jamiejdt
+author: dansimp
 ms.assetid: 150a2f88-68a5-40eb-8471-e5008488ab6e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md b/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md
index 5e017673f6..f7bab54d96 100644
--- a/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md
+++ b/mdop/dart-v7/how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: How to Recover Local Computers Using the DaRT Recovery Image
 description: How to Recover Local Computers Using the DaRT Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: be29b5a8-be08-4cf2-822e-77a51d3f3b65
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -14,30 +17,32 @@ ms.date: 06/16/2016
 # How to Recover Local Computers Using the DaRT Recovery Image
 
 
-To recover a local computer by using Microsoft Diagnostics and Recovery Toolset (DaRT) 7, you must be physically present at the end-user computer that is experiencing problems that require DaRT. You can also run DaRT remotely by following the instructions at [How to Recover Remote Computers Using the DaRT Recovery Image](how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md).
+To recover a local computer by using Microsoft Diagnostics and Recovery Toolset (DaRT) 7, you must be physically present at the end-user computer that is experiencing problems that require DaRT. You can also run DaRT remotely by following the instructions at [How to Recover Remote Computers Using the DaRT Recovery Image](how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md).
 
 **To recover a local computer by using DaRT**
 
 1.  As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears. You are asked whether you want to initialize network services. If you click **Yes**, it is assumed that a DHCP server is present on the network and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address.
 
-    To skip the network initialization process, click **No**.
+    To skip the network initialization process, click **No**.
 
 2.  Following the network initialization dialog box, you are asked whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process.
 
 3.  Following the remapping dialog box, a **System Recovery Options** dialog box appears and asks you to select a keyboard layout. Then it displays the system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers. This prompts you to insert the installation media for the device and to select the driver. Select the installation that you want to repair or diagnose, and then click **Next**.
 
-    **Note**  
+    **Note**  
     If the Windows Recovery Environment (WinRE) detects or suspects that Windows 7 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically.
 
-     
 
-    If any of the registry hives are corrupted or missing, Registry Editor, and several other DaRT utilities, will have limited functionality. If no operating system is selected, some tools will not be available.
 
-    The **System Recovery Options** window appears and lists various recovery tools.
+~~~
+If any of the registry hives are corrupted or missing, Registry Editor, and several other DaRT utilities, will have limited functionality. If no operating system is selected, some tools will not be available.
 
-4.  On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset**.
+The **System Recovery Options** window appears and lists various recovery tools.
+~~~
 
-    The **Diagnostics and Recovery Toolset** window opens. You can now run any of the individual tools or wizards that were included when the DaRT recovery image was created.
+4. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset**.
+
+   The **Diagnostics and Recovery Toolset** window opens. You can now run any of the individual tools or wizards that were included when the DaRT recovery image was created.
 
 You can click **Help** on the **Diagnostics and Recovery Toolset** window to open the client Help file that provides detailed instruction and information needed to run the individual DaRT tools. You can also click the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to choose the best tool for the situation, based on a brief interview that the wizard provides.
 
@@ -45,54 +50,53 @@ For general information about any of the DaRT tools, see [Overview of the Tools
 
 **To run DaRT at the command prompt**
 
-1.  You can run DaRT at the command prompt by specifying the **netstart.exe** command and by using any of the following parameters:
+1. You can run DaRT at the command prompt by specifying the **netstart.exe** command and by using any of the following parameters:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
        



        ParameterDescription
        -network
        Initializes the network services.
        -remount
        Remaps the drive letters.
        -prompt
        Displays messages asking the end user to specify whether to initialize the network and remap the drives.
        
-    
        
-    Important  
-    
        The end user’s response to the prompts overrides the -network and -remount switches.
        
-    
        
-    
        
-     
-    
        
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
        



        ParameterDescription
        -network
        Initializes the network services.
        -remount
        Remaps the drive letters.
        -prompt
        Displays messages asking the end user to specify whether to initialize the network and remap the drives.
        
+   
        
+   Important
        The end user’s response to the prompts overrides the -network and -remount switches.
        
+   
        
+   
        
 
-     
+   
        
 
-2.  You can customize DaRT so that a computer that boots into DaRT automatically opens the **Remote Connection** tool that is used to establish a remote connection with the help desk.
+
+
+2. You can customize DaRT so that a computer that boots into DaRT automatically opens the **Remote Connection** tool that is used to establish a remote connection with the help desk.
 
 ## Related topics
 
 
 [Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md b/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md
index 6d02a0a311..4ed0e0e5ec 100644
--- a/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md
+++ b/mdop/dart-v7/how-to-recover-remote-computers-using-the-dart-recovery-image-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: How to Recover Remote Computers Using the DaRT Recovery Image
 description: How to Recover Remote Computers Using the DaRT Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 66bc45fb-dc40-4d47-b583-5bb1ff5c97a7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -14,12 +17,12 @@ ms.date: 08/30/2016
 # How to Recover Remote Computers Using the DaRT Recovery Image
 
 
-The Remote Connection feature in Microsoft Diagnostics and Recovery Toolset (DaRT) 7 lets an IT administrator run the DaRT tools remotely on an end-user computer. After certain information is provided by the end user (or by a helpdesk professional working on the end-user computer), the IT administrator or helpdesk agent can take control of the end user's computer and run the necessary DaRT tools remotely.
+The Remote Connection feature in Microsoft Diagnostics and Recovery Toolset (DaRT) 7 lets an IT administrator run the DaRT tools remotely on an end-user computer. After certain information is provided by the end user (or by a helpdesk professional working on the end-user computer), the IT administrator or helpdesk agent can take control of the end user's computer and run the necessary DaRT tools remotely.
 
-**Important**  
+**Important**  
 The two computers establishing a remote connection must be part of the same network.
 
- 
+
 
 **To recover a remote computer by using DaRT**
 
@@ -35,105 +38,106 @@ The two computers establishing a remote connection must be part of the same netw
 
     Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user.
 
-    **Note**  
+    **Note**  
     Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization.
 
-     
+
 
 2.  As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears. You are asked whether you want to initialize network services. If you click **Yes**, it is assumed that a DHCP server is present on the network and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address.
 
-    To skip the network initialization process, click **No**.
+    To skip the network initialization process, click **No**.
 
 3.  Following the network initialization dialog box, you are asked whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process.
 
 4.  Following the remapping dialog box, a **System Recovery Options** dialog box appears and asks you to select a keyboard layout. Then it displays the system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers. This prompts you to insert the installation media for the device and to select the driver. Select the installation that you want to repair or diagnose, and then click **Next**.
 
-    **Note**  
+    **Note**  
     If the Windows Recovery Environment (WinRE) detects or suspects that Windows 7 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. For information about this situation including how to resolve it, see [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md).
 
-     
 
-    If any of the registry hives are corrupted or missing, Registry Editor, and several other DaRT utilities, will have limited functionality. If no operating system is selected, some tools will not be available.
 
-    The **System Recovery Options** window appears and lists various recovery tools.
+~~~
+If any of the registry hives are corrupted or missing, Registry Editor, and several other DaRT utilities, will have limited functionality. If no operating system is selected, some tools will not be available.
 
-5.  On the **System Recovery Options** window, select **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset** window.
+The **System Recovery Options** window appears and lists various recovery tools.
+~~~
 
-6.  On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**.
+5. On the **System Recovery Options** window, select **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset** window.
 
-    The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information.
+6. On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**.
 
-7.  On the helpdesk agent computer, open the **DaRT Remote Connection Viewer**.
+   The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information.
 
-    Click **Start**, click **All Programs**, click **Microsoft DaRT 7**, and then click **DaRT Remote Connection Viewer**.
+7. On the helpdesk agent computer, open the **DaRT Remote Connection Viewer**.
 
-8.  In the **DaRT Remote Connection** window, enter the required ticket, IP address, and port information.
+   Click **Start**, click **All Programs**, click **Microsoft DaRT 7**, and then click **DaRT Remote Connection Viewer**.
 
-    **Note**  
-    This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer.
+8. In the **DaRT Remote Connection** window, enter the required ticket, IP address, and port information.
 
-     
+   **Note**  
+   This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer.
 
-9.  Click **Connect**.
+
+
+9. Click **Connect**.
 
 The IT administrator now assumes control of the end-user computer and can run the DaRT tools remotely.
 
-**Note**  
+**Note**  
 A file is provided that is named inv32.xml and contains remote connection information, such as the port number and IP address. By default, the file is typically located at %windir%\\system32.
 
- 
+
 
 **To customize the Remote Connection process**
 
-1.  You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413).
+1. You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413).
 
-    Specify the following commands and parameters to customize how a remote connection is established with an end-user computer:
+   Specify the following commands and parameters to customize how a remote connection is established with an end-user computer:
 
-    
-    -    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
        




        CommandParameterDescription
        RemoteRecovery.exe
        -nomessage
        Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt.
        WaitForConnection.exe
        none
        Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer.
        
-    
        
-    Important  
-    
        This command serves no function if it is specified independently. It must be specified in a script to function correctly.
        
-    
        
-    
        
-     
-    
        
+   
+   +   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
        




        CommandParameterDescription
        RemoteRecovery.exe
        -nomessage
        Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt.
        WaitForConnection.exe
        none
        Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer.
        
+   
        
+   Important
        This command serves no function if it is specified independently. It must be specified in a script to function correctly.
        
+   
        
+   
        
 
-     
+   
        
 
-2.  The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT:
 
-    ``` syntax
-    [LaunchApps]
-    "%windir%\system32\netstart.exe -network -remount"
-    "cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage"
-    "%windir%\system32\WaitForConnection.exe"
-    "%SYSTEMDRIVE%\sources\recovery\recenv.exe"
-    ```
+
+2. The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT:
+
+   ```ini
+   [LaunchApps]
+   "%windir%\system32\netstart.exe -network -remount"
+   "cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage"
+   "%windir%\system32\WaitForConnection.exe"
+   "%SYSTEMDRIVE%\sources\recovery\recenv.exe"
+   ```
 
 **To run the Remote Connection Viewer at the command prompt**
 
@@ -166,23 +170,25 @@ A file is provided that is named inv32.xml and contains remote connection inform
     
     
 
-     
 
-    **Note**  
-    The variables for these parameters are created on the end-user computer and must be provided by the end user.
 
-     
+~~~
+**Note**  
+The variables for these parameters are created on the end-user computer and must be provided by the end user.
+~~~
 
-2.  If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified.
+
+
+2. If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified.
 
 ## Related topics
 
 
 [Recovering Computers Using DaRT 7.0](recovering-computers-using-dart-70-dart-7.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md b/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md
index 3c84baa490..943522849f 100644
--- a/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md
+++ b/mdop/dart-v7/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer
 description: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: 881d573f-2f18-4c5f-838e-2f5320179f94
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -33,7 +36,7 @@ If you cannot access the Microsoft Debugging Tools for Windows or the symbol fil
         **Note**  
         Use the Search tool in DaRT 7 to locate the copied crash dump file.
 
-         
+         
 
 3.  The **Crash Analyzer** scans the crash dump file and reports a probable cause of the crash. You can view more information about the crash, such as the specific crash message and description, the drivers loaded at the time of the crash, and the full output of the analysis.
 
@@ -44,9 +47,9 @@ If you cannot access the Microsoft Debugging Tools for Windows or the symbol fil
 
 [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md b/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md
index 6f232fa2e0..857157396c 100644
--- a/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md
+++ b/mdop/dart-v7/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: How to Run the Crash Analyzer on an End-user Computer
 description: How to Run the Crash Analyzer on an End-user Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: 40af4ead-6588-4a81-8eaa-3dc00c397e1d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -43,7 +46,7 @@ Typically, you run Microsoft Diagnostics and Recovery Toolset (DaRT) 7 Crash An
         **Note**  
         If you do not have access to the **System Properties** window, you can search for dump files on the end-user computer by using the **Search** tool in DaRT.
 
-         
+         
 
 3.  The **Crash Analyzer** scans the crash dump file and reports a probable cause of the crash. You can view more information about the crash, such as the specific crash message and description, the drivers loaded at the time of the crash, and the full output of the analysis.
 
@@ -54,9 +57,9 @@ Typically, you run Microsoft Diagnostics and Recovery Toolset (DaRT) 7 Crash An
 
 [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-7.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md b/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md
index eab232ace9..28abed205c 100644
--- a/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md
+++ b/mdop/dart-v7/how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: How to Use the DaRT Recovery Image Wizard to Create the Recovery Image
 description: How to Use the DaRT Recovery Image Wizard to Create the Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 1b8ef983-fff9-4d75-a2f6-53120c5c00c9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -39,7 +42,7 @@ The **DaRT Recovery Image Wizard** requires the following information:
 **Note**  
 The ISO image size can vary, depending on the tools that were selected in the **DaRT Recovery Image Wizard**.
 
- 
+ 
 
 ## To create the recovery image using the DaRT Recovery Image Wizard
 
@@ -71,7 +74,7 @@ You can either specify the location of the debugging tools on the computer where
 **Note**  
 If you include the **Crash Analyzer** in the ISO image, we recommend that you also include the Debugging Tools for Windows.
 
- 
+ 
 
 Follow these steps to add the Debugging Tools for Windows:
 
@@ -98,7 +101,7 @@ If you decide not to include the latest definitions on the recovery image, or if
 **Important**  
 You cannot scan if there are no definitions.
 
- 
+ 
 
 After you have finished, click **Next**.
 
@@ -107,14 +110,14 @@ After you have finished, click **Next**.
 **Caution**  
 By default, when you add a driver to the DaRT recovery image, all additional files and subfolders that are located in that folder are added into the recovery image. For more information, see [Troubleshooting DaRT 7.0](troubleshooting-dart-70-new-ia.md).
 
- 
+ 
 
 You should include additional drivers on the recovery image for DaRT 7 that you may need when repairing a computer. These may typically include storage or network controllers that are not included on the Windows DVD.
 
 **Important**  
 When you select drivers to include, be aware that wireless connectivity (such as Bluetooth or 802.11a/b/g/n) is not supported in DaRT.
 
- 
+ 
 
 **To add a storage or network controller driver to the recovery image**
 
@@ -125,7 +128,7 @@ When you select drivers to include, be aware that wireless connectivity (such as
     **Note**  
     The **driver** file is provided by the manufacturer of the storage or network controller.
 
-     
+     
 
 3.  Repeat Steps 1 and 2 for every driver that you want to include.
 
@@ -168,7 +171,7 @@ If the **DaRT Recovery Image Wizard** detects a compatible CD-RW drive on your c
     **Note**  
     If a drive is not recognized and you install a new drive, you can click **Refresh Drive List** to force the wizard to update the list of available drives.
 
-     
+     
 
 3.  Click **Next**.
 
@@ -177,9 +180,9 @@ If the **DaRT Recovery Image Wizard** detects a compatible CD-RW drive on your c
 
 [Creating the DaRT 7.0 Recovery Image](creating-the-dart-70-recovery-image-dart-7.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/index.md b/mdop/dart-v7/index.md
index 9dfe1fceaf..ba12a07c9d 100644
--- a/mdop/dart-v7/index.md
+++ b/mdop/dart-v7/index.md
@@ -1,12 +1,12 @@
 ---
 title: Diagnostics and Recovery Toolset 7 Administrator's Guide
 description: Diagnostics and Recovery Toolset 7 Administrator's Guide
-author: jamiejdt
+author: dansimp
 ms.assetid: bf89eccd-fc03-48ff-9019-a8640e11dd99
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 04/19/2017
 ---
 
diff --git a/mdop/dart-v7/operations-for-dart-70-new-ia.md b/mdop/dart-v7/operations-for-dart-70-new-ia.md
index a7f3abd71c..1a7b02146b 100644
--- a/mdop/dart-v7/operations-for-dart-70-new-ia.md
+++ b/mdop/dart-v7/operations-for-dart-70-new-ia.md
@@ -1,12 +1,15 @@
 ---
 title: Operations for DaRT 7.0
 description: Operations for DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 5566d817-fc14-4408-ba01-1d87fbc132d9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md b/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md
index ffbf551335..30c1b4a4a7 100644
--- a/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md
+++ b/mdop/dart-v7/overview-of-the-tools-in-dart-70-new-ia.md
@@ -1,12 +1,15 @@
 ---
 title: Overview of the Tools in DaRT 7.0
 description: Overview of the Tools in DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 67c5991e-cbe6-4ce9-9fe5-f1761369d1fe
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,7 +33,7 @@ You can use **Registry Editor** to access and change the registry of the Windows
 **Caution**  
 This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk.
 
- 
+ 
 
 ### Locksmith
 
@@ -67,7 +70,7 @@ For more information about **Crash Analyzer**, see [Diagnosing System Failures w
 **Warning**  
 We recommend that you back up a disk before you use **Disk Commander** to repair it. By using **Disk Commander**, you can potentially damage volumes and make them inaccessible. Additionally, changes to one volume can affect other volumes because volumes on a disk share a partition table.
 
- 
+ 
 
 ### Disk Wipe
 
@@ -76,7 +79,7 @@ You can use **Disk Wipe** to delete all data from a disk or volume, even the dat
 **Warning**  
 After wiping a disk or volume, you cannot recover the data. Verify the size and label of a volume before erasing it.
 
- 
+ 
 
 ### Computer Management
 
@@ -103,7 +106,7 @@ We recommend that you uninstall only one hotfix at a time, even though the tool
 **Important**  
 Programs that were installed or updated after a hotfix was installed might not work correctly after you uninstall a hotfix.
 
- 
+ 
 
 ### SFC Scan
 
@@ -120,7 +123,7 @@ The **Search** tool opens a **File Search** window that you can use to find docu
 **Important**  
 Environments with the Standalone System Sweeper deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. Because of how the Standalone System Sweeper tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images.
 
- 
+ 
 
 The **Standalone System Sweeper** can help detect malware and unwanted software and warn you of security risks. You can use this tool to scan a computer for and remove malware even when the installed Windows operating system is not running. When the **Standalone System Sweeper** detects malicious or unwanted software, it prompts you to remove, quarantine, or allow for each item.
 
@@ -133,16 +136,16 @@ The **Remote Connection** tool in DaRT lets you remotely run the DaRT tools on a
 **Important**  
 The two computers establishing a remote connection must be part of the same network.
 
- 
+ 
 
 ## Related topics
 
 
 [Getting Started with DaRT 7.0](getting-started-with-dart-70-new-ia.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/planning-for-dart-70-new-ia.md b/mdop/dart-v7/planning-for-dart-70-new-ia.md
index 98476abcaa..0e8009edfe 100644
--- a/mdop/dart-v7/planning-for-dart-70-new-ia.md
+++ b/mdop/dart-v7/planning-for-dart-70-new-ia.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for DaRT 7.0
 description: Planning for DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 9a60cb08-5efb-40fe-b1e3-9ece831f3b43
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md b/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md
index 815111bfad..ef95afbef5 100644
--- a/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md
+++ b/mdop/dart-v7/planning-how-to-save-and-deploy-the-dart-70-recovery-image.md
@@ -1,12 +1,15 @@
 ---
 title: Planning How to Save and Deploy the DaRT 7.0 Recovery Image
 description: Planning How to Save and Deploy the DaRT 7.0 Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: d96e9363-6186-4fc3-9b83-ba15ed9694a5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -24,7 +27,7 @@ You can save and deploy the DaRT recovery image by using the following methods.
 **Note**  
 You might want to use more than one method in your organization. For example, you can boot into DaRT from a remote partition for most situations and have a USB flash drive available in case the end-user computer cannot connect to the network.
 
- 
+ 
 
 The following table shows some advantages and disadvantages of each method of using DaRT in your organization.
 
@@ -68,16 +71,16 @@ The following table shows some advantages and disadvantages of each method of us
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [Planning to Deploy DaRT 7.0](planning-to-deploy-dart-70.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md b/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md
index dc60a82839..fb3aeeb596 100644
--- a/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md
+++ b/mdop/dart-v7/planning-to-create-the-dart-70-recovery-image.md
@@ -1,12 +1,15 @@
 ---
 title: Planning to Create the DaRT 7.0 Recovery Image
 description: Planning to Create the DaRT 7.0 Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: e5d49bee-ae4e-467b-9976-c1203f6355f9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/dart-v7/planning-to-deploy-dart-70.md b/mdop/dart-v7/planning-to-deploy-dart-70.md
index 2497dbc283..27eb83e0aa 100644
--- a/mdop/dart-v7/planning-to-deploy-dart-70.md
+++ b/mdop/dart-v7/planning-to-deploy-dart-70.md
@@ -1,12 +1,15 @@
 ---
 title: Planning to Deploy DaRT 7.0
 description: Planning to Deploy DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 05e97cdb-a8c2-46e4-9c75-a7d12fe26fe8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -48,7 +51,7 @@ Several methods can be used to save and deploy the DaRT recovery image. When you
 **Note**  
 You might want to use more than one method in your organization. For example, you can boot into DaRT from a remote partition for most situations and have a USB flash drive available in case the end-user computer cannot connect to the network.
 
- 
+ 
 
 [Planning How to Save and Deploy the DaRT 7.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-70-recovery-image.md)
 
@@ -57,9 +60,9 @@ You might want to use more than one method in your organization. For example, yo
 
 [Planning for DaRT 7.0](planning-for-dart-70-new-ia.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md b/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md
index ddea601e88..fb6d52dd23 100644
--- a/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md
+++ b/mdop/dart-v7/recovering-computers-using-dart-70-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: Recovering Computers Using DaRT 7.0
 description: Recovering Computers Using DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: bcded7ca-237b-4971-ac34-4394b05cbc50
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -36,7 +39,7 @@ Whichever method that you use to boot into DaRT, you must enable the boot device
 **Note**  
 Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization.
 
- 
+ 
 
 [How to Recover Local Computers Using the DaRT Recovery Image](how-to-recover-local-computers-using-the-dart-recovery-image-dart-7.md)
 
@@ -48,7 +51,7 @@ The Remote Connection feature in DaRT lets an IT administrator run the DaRT tool
 **Important**  
 The two computers establishing a remote connection must be part of the same network.
 
- 
+ 
 
 The **Diagnostics and Recovery Toolset** window includes the option to run DaRT on an end-user computer remotely from an administrator computer. The end user opens the DaRT tools on the problem computer and starts the remote session by clicking **Remote Connection**.
 
@@ -63,9 +66,9 @@ The IT administrator or helpdesk agent enters this information into the **DaRT R
 
 [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/release-notes-for-dart-70-new-ia.md b/mdop/dart-v7/release-notes-for-dart-70-new-ia.md
index e1b35be047..19faaa9de5 100644
--- a/mdop/dart-v7/release-notes-for-dart-70-new-ia.md
+++ b/mdop/dart-v7/release-notes-for-dart-70-new-ia.md
@@ -1,12 +1,15 @@
 ---
 title: Release Notes for DaRT 7.0
 description: Release Notes for DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: fad227d0-5c22-4efd-9187-0e5922f7250b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -105,9 +108,9 @@ All other trademarks are property of their respective owners.
 
 [About DaRT 7.0](about-dart-70-new-ia.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md b/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md
index 45d6ce5d29..bba2b7aa94 100644
--- a/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md
+++ b/mdop/dart-v7/security-considerations-for-dart-70-dart-7.md
@@ -1,12 +1,15 @@
 ---
 title: Security Considerations for DaRT 7.0
 description: Security Considerations for DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 52ad7e6c-c169-4ba4-aa76-56335a585eb8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -32,7 +35,7 @@ You can even configure the DaRT image so that the option to start a remote conne
 **Important**  
 After the remote connection is established, all the tools that you included in the recovery image, including those unavailable to the end user, will become available to the helpdesk agent working on the end–user computer.
 
- 
+ 
 
 For more information about including tools in the DaRT recovery image, see [How to Use the DaRT Recovery Image Wizard to Create the Recovery Image](how-to-use-the-dart-recovery-image-wizard-to-create-the-recovery-image-dart-7.md).
 
@@ -46,7 +49,7 @@ Your encryption method should be deployed and enabled in all computers.
 **Note**  
 DaRT 7 supports BitLocker natively.
 
- 
+ 
 
 ## To help maintain security between two computers during Remote Connection
 
@@ -58,9 +61,9 @@ By default, the communication between two computers that have established a **Re
 
 [Operations for DaRT 7.0](operations-for-dart-70-new-ia.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md b/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md
index 6436d50a4d..71ac50f9ae 100644
--- a/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md
+++ b/mdop/dart-v7/technical-reference-for-dart-70-new-ia.md
@@ -1,12 +1,15 @@
 ---
 title: Technical Reference for DaRT 7.0
 description: Technical Reference for DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: f55c7e5e-713a-42d1-84c9-88370155f934
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v7/troubleshooting-dart-70-new-ia.md b/mdop/dart-v7/troubleshooting-dart-70-new-ia.md
index a06dac4191..6c38d06409 100644
--- a/mdop/dart-v7/troubleshooting-dart-70-new-ia.md
+++ b/mdop/dart-v7/troubleshooting-dart-70-new-ia.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting DaRT 7.0
 description: Troubleshooting DaRT 7.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 24c50efa-e9ac-45c4-aca2-b1dcfe834fdd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/dart-v8/TOC.md b/mdop/dart-v8/TOC.md
index b27e1ffa91..b2c907364b 100644
--- a/mdop/dart-v8/TOC.md
+++ b/mdop/dart-v8/TOC.md
@@ -1,7 +1,7 @@
 # [Diagnostics and Recovery Toolset 8](index.md)
 ## [Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md)
 ### [About DaRT 8.0](about-dart-80-dart-8.md)
-#### [Release Notes for DaRT 8.0 ](release-notes-for-dart-80--dart-8.md)
+#### [Release Notes for DaRT 8.0](release-notes-for-dart-80--dart-8.md)
 ### [About DaRT 8.0 SP1](about-dart-80-sp1.md)
 #### [Release Notes for DaRT 8.0 SP1](release-notes-for-dart-80-sp1.md)
 ### [About DaRT 8.1](about-dart-81.md)
@@ -27,17 +27,17 @@
 ### [Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md)
 #### [How to Recover Local Computers by Using the DaRT Recovery Image](how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md)
 #### [How to Recover Remote Computers by Using the DaRT Recovery Image](how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md)
-### [Diagnosing System Failures with Crash Analyzer ](diagnosing-system-failures-with-crash-analyzer--dart-8.md)
+### [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md)
 #### [How to Run the Crash Analyzer on an End-user Computer](how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md)
 #### [How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer](how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md)
 #### [How to Ensure that Crash Analyzer Can Access Symbol Files](how-to-ensure-that-crash-analyzer-can-access-symbol-files.md)
 ### [Security and Privacy for DaRT 8.0](security-and-privacy-for-dart-80-dart-8.md)
-#### [Security Considerations for DaRT 8.0 ](security-considerations-for-dart-80--dart-8.md)
+#### [Security Considerations for DaRT 8.0](security-considerations-for-dart-80--dart-8.md)
 #### [DaRT 8.0 Privacy Statement](dart-80-privacy-statement-dart-8.md)
 ### [Administering DaRT 8.0 Using PowerShell](administering-dart-80-using-powershell-dart-8.md)
 #### [How to Perform DaRT Tasks by Using PowerShell Commands](how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md)
 #### [How to Use a PowerShell Script to Create the Recovery Image](how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md)
 ## [Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md)
 ## [Technical Reference for DaRT 8.0](technical-reference-for-dart-80-new-ia.md)
-### [Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection](microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md)
+### [Use Windows Defender Offline (WDO) for malware protection, not DaRT ](use-windows-defender-offline-wdo-for-malware-protection-not-dart.md)
 
diff --git a/mdop/dart-v8/about-dart-80-dart-8.md b/mdop/dart-v8/about-dart-80-dart-8.md
index 4cb8f87148..9820c5e742 100644
--- a/mdop/dart-v8/about-dart-80-dart-8.md
+++ b/mdop/dart-v8/about-dart-80-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: About DaRT 8.0
 description: About DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: ce91efd6-7d78-44cb-bb8f-1f43f768ebaa
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ Microsoft Diagnostics and Recovery Toolset (DaRT) 8.0 helps you troubleshoot and
 **Note**  
 DaRT does not support the recovery of dynamic disks.
 
- 
+ 
 
 DaRT also provides tools to help you fix a problem as soon as you determine the cause. For example, you can use the tools in DaRT to disable a faulty device driver, remove hotfixes, restore deleted files, and scan the computer for malware even when you cannot or should not start the installed Windows operating system.
 
@@ -70,9 +73,9 @@ This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). MDO
 
 [Release Notes for DaRT 8.0](release-notes-for-dart-80--dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/about-dart-80-sp1.md b/mdop/dart-v8/about-dart-80-sp1.md
index 307f3a0c9c..e44c7a09be 100644
--- a/mdop/dart-v8/about-dart-80-sp1.md
+++ b/mdop/dart-v8/about-dart-80-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: About DaRT 8.0 SP1
 description: About DaRT 8.0 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 2e166444-4097-4b23-9f50-d8819f1f4960
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/dart-v8/about-dart-81.md b/mdop/dart-v8/about-dart-81.md
index ba9aa61695..b6da659173 100644
--- a/mdop/dart-v8/about-dart-81.md
+++ b/mdop/dart-v8/about-dart-81.md
@@ -1,12 +1,15 @@
 ---
 title: About DaRT 8.1
 description: About DaRT 8.1
-author: jamiejdt
+author: dansimp
 ms.assetid: dcaddc57-0111-4a9d-8be9-f5ada0eefa7d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -33,10 +36,10 @@ Microsoft Diagnostics and Recovery Toolset (DaRT) 8.1 provides the following enh
 
     You can create DaRT images by using Windows Server 2012 R2 or Windows 8.1.
 
-    **Note**  
+    **Note**  
     For earlier versions of the Windows Server and Windows operating systems, continue to use the earlier versions of DaRT.
 
-     
+
 
 -   **Customer feedback**
 
@@ -49,16 +52,18 @@ Microsoft Diagnostics and Recovery Toolset (DaRT) 8.1 provides the following enh
 ## Requirements
 
 
--   **Windows Assessment and Development Kit 8.1**
+-   **Windows Assessment and Development Kit 8.1**
 
-    Windows Assessment and Development Kit (ADK) 8.1 is a required prerequisite for the DaRT Recovery Image Wizard. Windows ADK 8.1 contains deployment tools that are used to customize, deploy, and service Windows images. It also contains the Windows Preinstallation Environment (Windows PE).
+    Windows Assessment and Development Kit (ADK) 8.1 is a required prerequisite for the DaRT Recovery Image Wizard. Windows ADK 8.1 contains deployment tools that are used to customize, deploy, and service Windows images. It also contains the Windows Preinstallation Environment (Windows PE).
 
-    **Note**  
-    Windows ADK 8.1 is not required if you are installing only Remote Connection Viewer or Crash Analyzer.
+    **Note**  
+    Windows ADK 8.1 is not required if you are installing only Remote Connection Viewer or Crash Analyzer.
 
-     
 
-    To download Windows ADK 8.1, see [Windows Assessment and Deployment Kit (Windows ADK) for Windows 8.1](https://www.microsoft.com/download/details.aspx?id=39982) in the Microsoft Download Center.
+
+~~~
+To download Windows ADK 8.1, see [Windows Assessment and Deployment Kit (Windows ADK) for Windows 8.1](https://www.microsoft.com/download/details.aspx?id=39982) in the Microsoft Download Center.
+~~~
 
 -   **Microsoft .NET Framework 4.5.1**
 
@@ -107,9 +112,9 @@ DaRT 8.1 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is pa
 
 [Release Notes for DaRT 8.1](release-notes-for-dart-81.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/dart-v8/accessibility-for-dart-80-dart-8.md b/mdop/dart-v8/accessibility-for-dart-80-dart-8.md
index 5ad466dbd1..6980d28973 100644
--- a/mdop/dart-v8/accessibility-for-dart-80-dart-8.md
+++ b/mdop/dart-v8/accessibility-for-dart-80-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Accessibility for DaRT 8.0
 description: Accessibility for DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 95f426de-222c-4ec0-9b9b-af817c7fff9b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -30,7 +33,7 @@ Access keys let you quickly use a command by pressing a few keys. You can get to
 **Note**  
 To cancel the action that you are taking and hide the keyboard shortcuts, press ALT.
 
- 
+ 
 
 ## Documentation in alternative formats
 
@@ -64,13 +67,13 @@ For information about the availability of Microsoft product documentation and bo
 
        (609) 987-8116
        
 
 
-
        [http://www.learningally.org/](https://go.microsoft.com/fwlink/?linkid=239)
        
+
        http://www.learningally.org/
        
 
        Web addresses can change, so you might be unable to connect to the website or sites mentioned here.
        
 
 
 
 
- 
+ 
 
 ## Customer service for people with hearing impairments
 
@@ -93,9 +96,9 @@ For more information about how accessible technology for computers helps to impr
 
 [Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md b/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md
index f28d53a283..49ed66516c 100644
--- a/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md
+++ b/mdop/dart-v8/administering-dart-80-using-powershell-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Administering DaRT 8.0 Using PowerShell
 description: Administering DaRT 8.0 Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 776430e0-d5c9-4919-877a-fab503451b37
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md b/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md
index c055b3d88d..9284d0c20e 100644
--- a/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md
+++ b/mdop/dart-v8/creating-the-dart-80-recovery-image-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Creating the DaRT 8.0 Recovery Image
 description: Creating the DaRT 8.0 Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 39001b8e-86c0-45ef-8f34-2d6199f9922d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/21/2017
 ---
 
@@ -89,7 +92,7 @@ On the Drivers tab of the Advanced Options page, you can add additional device d
 **Important**  
 When you select drivers to include, be aware that wireless connectivity (such as Bluetooth or 802.11a/b/g/n) is not supported in DaRT.
 
- 
+ 
 
 **To add drivers to the recovery image**
 
@@ -102,7 +105,7 @@ When you select drivers to include, be aware that wireless connectivity (such as
     **Note**  
     The driver file is provided by the manufacturer of the storage or network controller.
 
-     
+     
 
 4.  Repeat Steps 2 and 3 for every driver that you want to include.
 
@@ -141,7 +144,7 @@ The DaRT wizard checks for the tools in the `HKLM\Software\Microsoft\Windows Kit
 
 `%ProgramFilesX86%\Windows Kits\8.0\Debuggers\x86`
 
- 
+ 
 
 **To add the debugging tools for Crash Analyzer**
 
@@ -177,7 +180,7 @@ On the Defender tab of the Advanced Options page, you add definitions, which are
         **Important**  
         You cannot scan if there are no definitions.
 
-         
+         
 
 3.  Click **Next**.
 
@@ -203,7 +206,7 @@ If you select the Edit Image check box on this page, you can customize the recov
     **Note**  
     The size of the image will vary, depending on the tools that you select and the files that you add in the wizard.
 
-     
+     
 
 2.  In the **Image name** box, enter a name for the DaRT recovery image, or accept the default name, which is DaRT8.
 
@@ -253,7 +256,7 @@ On the Create Bootable Media page, you can optionally copy the image file to a C
 **Note**  
 The Preboot execution environment (PXE) and local image deployment are not supported natively by this tool since they require additional enterprise tools, such as System Center Configuration Manager server and Microsoft Development Toolkit.
 
- 
+ 
 
 **To copy the recovery image to a CD, DVD, or USB**
 
@@ -264,7 +267,7 @@ The Preboot execution environment (PXE) and local image deployment are not suppo
     **Note**  
     If a drive is not recognized and you install a new drive, you can click **Refresh** to force the wizard to update the list of available drives.
 
-     
+     
 
 3.  Click the **Create Bootable Media** button.
 
@@ -277,9 +280,9 @@ The Preboot execution environment (PXE) and local image deployment are not suppo
 
 [Deploying DaRT 8.0](deploying-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md b/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md
index 7cf1797280..b0585c84fc 100644
--- a/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md
+++ b/mdop/dart-v8/dart-80-deployment-checklist-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: DaRT 8.0 Deployment Checklist
 description: DaRT 8.0 Deployment Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 74e071fb-697c-463f-adce-d09b8d86495f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ This checklist can be used to help you during Microsoft Diagnostics and Recovery
 **Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+ 
 
 @@ -38,31 +41,31 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
-
+
        
 

        
 Checklist box
 
        Decide on the best DaRT 8.0 deployment option for your requirements and deploy it.
        [Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md)
        Deploying DaRT 8.0 to Administrator Computers
        		
 
        
 
        
 Checklist box
 
        Use the DaRT Recovery Image wizard to create the DaRT recovery image ISO.
        [Creating the DaRT 8.0 Recovery Image](creating-the-dart-80-recovery-image-dart-8.md)
        Creating the DaRT 8.0 Recovery Image
        		
 
        
 
        
 Checklist box
 
        Decide on the best DaRT 8.0 recovery image deployment option for your requirements and deploy it.
        [Deploying the DaRT Recovery Image](deploying-the-dart-recovery-image-dart-8.md)
        Deploying the DaRT Recovery Image
        		
 
        
         
 
        
 
- 
+ 
 
 ## Related topics
 
 
 [Deploying DaRT 8.0](deploying-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/dart-80-planning-checklist-dart-8.md b/mdop/dart-v8/dart-80-planning-checklist-dart-8.md
index 1ebfd3d8b9..ceb155c30e 100644
--- a/mdop/dart-v8/dart-80-planning-checklist-dart-8.md
+++ b/mdop/dart-v8/dart-80-planning-checklist-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: DaRT 8.0 Planning Checklist
 description: DaRT 8.0 Planning Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 0a0f5a71-b1d6-424c-8174-fc5aad506928
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ This checklist can be used to help you plan for preparing your computing environ
 **Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when planning for product deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+ 
 
 @@ -38,31 +41,31 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
-
+
        
 

        
 Checklist box
 
        Review the DaRT 8.0 Supported Configurations information to confirm that the computers you have selected for client or feature installation meet the minimum hardware and operating system requirements.
        [DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md)
        DaRT 8.0 Supported Configurations
        		
 
        
 
        
 Checklist box
 
        Understand the deployment prerequisites and decide which tools to include on the DaRT recovery image.
        [Planning to Create the DaRT 8.0 Recovery Image](planning-to-create-the-dart-80-recovery-image-dart-8.md)
        Planning to Create the DaRT 8.0 Recovery Image
        		
 
        
 
        
 Checklist box
 
        Determine which method, or methods, you will use to deploy the DaRT recovery image.
        [Planning How to Save and Deploy the DaRT 8.0 Recovery Image](planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md)
        Planning How to Save and Deploy the DaRT 8.0 Recovery Image
        		
 
        
         
 
        
 
- 
+ 
 
 ## Related topics
 
 
 [Planning for DaRT 8.0](planning-for-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/dart-80-privacy-statement-dart-8.md b/mdop/dart-v8/dart-80-privacy-statement-dart-8.md
index 4a578cdb99..73939a6af0 100644
--- a/mdop/dart-v8/dart-80-privacy-statement-dart-8.md
+++ b/mdop/dart-v8/dart-80-privacy-statement-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: DaRT 8.0 Privacy Statement
 description: DaRT 8.0 Privacy Statement
-author: jamiejdt
+author: dansimp
 ms.assetid: db474241-e44e-4bca-9be4-3557a3614c2a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/dart-v8/dart-80-supported-configurations-dart-8.md b/mdop/dart-v8/dart-80-supported-configurations-dart-8.md
index fe0e399bc8..ba3ca72434 100644
--- a/mdop/dart-v8/dart-80-supported-configurations-dart-8.md
+++ b/mdop/dart-v8/dart-80-supported-configurations-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: DaRT 8.0 Supported Configurations
 description: DaRT 8.0 Supported Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: 95d68e5c-d202-4f4a-adef-d2098328172e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -60,7 +63,7 @@ The following table lists the installation prerequisites for the administrator c
 
 
 
- 
+ 
 
 ### Help desk computer prerequisites
 
@@ -93,7 +96,7 @@ The following table lists the installation prerequisites for the help desk compu
 
 
 
- 
+ 
 
 ### End-user computer prerequisites
 
@@ -109,12 +112,12 @@ The following table lists the operating systems that are supported for the DaRT
 **Note**  
 Make sure that you allocate enough space for any additional tools that you want to install on the administrator computer.
 
- 
+ 
 
 **Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+ 
 
 @@ -163,7 +166,7 @@ Microsoft provides support for the current service pack and, in some cases, the
 
        
 

 
        
 
- 
+ 
 
 ###  DaRT help desk computer system requirements
 
@@ -228,7 +231,7 @@ The following table lists the operating systems that are supported for the DaRT
 
 
 
- 
+ 
 
 DaRT also has the following minimum hardware requirements for the end-user computer:
 
@@ -287,16 +290,16 @@ The Diagnostics and Recovery Toolset window in DaRT requires that the end-user c
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/deploying-dart-80-dart-8.md b/mdop/dart-v8/deploying-dart-80-dart-8.md
index dc16ec45b6..0bfff42e41 100644
--- a/mdop/dart-v8/deploying-dart-80-dart-8.md
+++ b/mdop/dart-v8/deploying-dart-80-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying DaRT 8.0
 description: Deploying DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 5a976d4e-3372-4ef6-9095-1b48e99af21b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md b/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md
index 0a286d920a..9a76b0e3ae 100644
--- a/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md
+++ b/mdop/dart-v8/deploying-dart-80-to-administrator-computers-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying DaRT 8.0 to Administrator Computers
 description: Deploying DaRT 8.0 to Administrator Computers
-author: jamiejdt
+author: dansimp
 ms.assetid: f918ead8-742e-464a-8bf6-1fcedde66cae
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md b/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md
index 484bd4b007..38d53ac43d 100644
--- a/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md
+++ b/mdop/dart-v8/deploying-the-dart-recovery-image-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the DaRT Recovery Image
 description: Deploying the DaRT Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: df5cb54a-be8c-4ed2-89ea-d3c67c2ef4d4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -27,7 +30,7 @@ Extract the boot.wim file from the ISO image and deploy in the recovery partitio
 **Important**  
 The **DaRT Recovery Image Wizard** provides the option to burn the image to a CD, DVD or UFD, but the other methods of saving and deploying the recovery image require additional steps that involve tools that are not included in DaRT. Some guidance and links for these other methods are provided in this section.
 
- 
+ 
 
 ## Deploy the DaRT recovery image as part of a recovery partition
 
@@ -48,9 +51,9 @@ You can host the recovery image on a central network boot server, such as Window
 
 [Deploying DaRT 8.0](deploying-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md b/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md
index b0d42098bf..4553af5ce2 100644
--- a/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md
+++ b/mdop/dart-v8/diagnosing-system-failures-with-crash-analyzer--dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Diagnosing System Failures with Crash Analyzer
 description: Diagnosing System Failures with Crash Analyzer
-author: jamiejdt
+author: dansimp
 ms.assetid: ce3d3186-54fb-45b2-b5ce-9bb7841db28f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v8/getting-started-with-dart-80-dart-8.md b/mdop/dart-v8/getting-started-with-dart-80-dart-8.md
index 13c8a6fb56..66f6c6ad7d 100644
--- a/mdop/dart-v8/getting-started-with-dart-80-dart-8.md
+++ b/mdop/dart-v8/getting-started-with-dart-80-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Getting Started with DaRT 8.0
 description: Getting Started with DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 579d18c5-7434-4a0e-9725-fb81ca5e3c6d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -21,7 +24,7 @@ A downloadable version of this administrator’s guide is not available. However
 
 Additional downloadable information about this product can also be found at .
 
- 
+ 
 
 ## Getting started with DaRT 8.0
 
@@ -56,9 +59,9 @@ DaRT 8.0 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is pa
 
 [Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md b/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md
index 79b027f96c..07b0c8b5bf 100644
--- a/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md
+++ b/mdop/dart-v8/how-to-change-repair-or-remove-dart-80-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: How to Change, Repair, or Remove DaRT 8.0
 description: How to Change, Repair, or Remove DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: a9737635-aaf5-45bd-861f-f9dff4f02336
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md b/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md
index c681d10487..64defad414 100644
--- a/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md
+++ b/mdop/dart-v8/how-to-deploy-dart-80-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy DaRT 8.0
 description: How to Deploy DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: ab772e7a-c02f-4847-acdf-8bd362769a77
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ The following instructions explain how to deploy Microsoft Diagnostics and Recov
 **Important**  
 Before you install DaRT, see [DaRT 8.0 Supported Configurations](dart-80-supported-configurations-dart-8.md) to ensure that you have installed all of the prerequisite software and that the computer meets the minimum system requirements. The computer onto which you install DaRT must be running Windows 8 or Windows Server 2012.
 
- 
+ 
 
 You can install DaRT using one of two different configurations:
 
@@ -83,7 +86,7 @@ msiexec.exe /i MSDaRT80.msi /l*v log.txt
 **Note**  
 You can add /qn or /qb to perform a silent installation.
 
- 
+ 
 
 **To validate the DaRT installation**
 
@@ -98,9 +101,9 @@ You can add /qn or /qb to perform a silent installation.
 
 [Deploying DaRT 8.0 to Administrator Computers](deploying-dart-80-to-administrator-computers-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md b/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md
index 72eef6ae82..db1b6db9c4 100644
--- a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md
+++ b/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-a-remote-partition-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy the DaRT Recovery Image as a Remote Partition
 description: How to Deploy the DaRT Recovery Image as a Remote Partition
-author: jamiejdt
+author: dansimp
 ms.assetid: 58f4a6c6-6193-42bd-a095-0de868711af9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -27,7 +30,7 @@ After you have finished running the Microsoft Diagnostics and Recovery Toolset (
         **Note**  
         If you burned a CD or DVD of the recovery image, you can open the files on the CD or DVD and copy the boot.wim file from the \\sources folder. This lets you skip the need to mount the image.
 
-         
+         
 
 2.  Deploy the boot.wim file to a WDS server that can be accessed from end-user computers in your enterprise.
 
@@ -44,9 +47,9 @@ For more information about how to deploy DaRT as a remote partition, see [Walkth
 
 [Planning for DaRT 8.0](planning-for-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md b/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md
index b9ed176f5e..2f572440c7 100644
--- a/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md
+++ b/mdop/dart-v8/how-to-deploy-the-dart-recovery-image-as-part-of-a-recovery-partition-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition
 description: How to Deploy the DaRT Recovery Image as Part of a Recovery Partition
-author: jamiejdt
+author: dansimp
 ms.assetid: 07c5d539-51d9-4759-adc7-72b40d5d7bb3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -31,7 +34,7 @@ After you have finished running the Microsoft Diagnostics and Recovery Toolset (
         **Note**  
         If you burned a CD, DVD, or USB of the recovery image, you can open the files on the removable media and copy the boot.wim file from the \\sources folder. If you copy boot.wim file, you don’t need to mount the image.
 
-         
+         
 
 3.  Use the boot.wim file to create a bootable recovery partition by using your company’s standard method for creating a custom Windows RE image.
 
@@ -50,9 +53,9 @@ After you have finished running the Microsoft Diagnostics and Recovery Toolset (
 
 [Planning for DaRT 8.0](planning-for-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md b/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md
index 312fe03a19..e6b4f6ad25 100644
--- a/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md
+++ b/mdop/dart-v8/how-to-ensure-that-crash-analyzer-can-access-symbol-files.md
@@ -1,12 +1,15 @@
 ---
 title: How to Ensure that Crash Analyzer Can Access Symbol Files
 description: How to Ensure that Crash Analyzer Can Access Symbol Files
-author: jamiejdt
+author: dansimp
 ms.assetid: 99839013-1cd8-44d1-8484-0e15261c5a4b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md b/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md
index d84f1001b3..8e49329140 100644
--- a/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md
+++ b/mdop/dart-v8/how-to-perform-dart-tasks-by-using-powershell-commands-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: How to Perform DaRT Tasks by Using PowerShell Commands
 description: How to Perform DaRT Tasks by Using PowerShell Commands
-author: jamiejdt
+author: dansimp
 ms.assetid: bc788b00-38c7-4f57-a832-916b68264d89
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md b/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md
index 6fc91964ab..fc95efeecd 100644
--- a/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md
+++ b/mdop/dart-v8/how-to-recover-local-computers-by-using-the-dart-recovery-image-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: How to Recover Local Computers by Using the DaRT Recovery Image
 description: How to Recover Local Computers by Using the DaRT Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: f679d522-49ab-429c-93d0-294c3f3e5639
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -36,18 +39,20 @@ Use these instructions to recover a computer when you are physically present at
 
 6.  Select the installation that you want to repair or diagnose, and then click **Next**.
 
-    **Note**  
+    **Note**  
     If the Windows Recovery Environment (WinRE) detects or suspects that Windows 8 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically.
 
-     
 
-    If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available.
 
-    The **System Recovery Options** window appears and lists various recovery tools.
+~~~
+If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available.
 
-7.  On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset**.
+The **System Recovery Options** window appears and lists various recovery tools.
+~~~
 
-    The **Diagnostics and Recovery Toolset** window opens. You can now run any of the individual tools or wizards that were included when the DaRT recovery image was created.
+7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset**.
+
+   The **Diagnostics and Recovery Toolset** window opens. You can now run any of the individual tools or wizards that were included when the DaRT recovery image was created.
 
 You can click **Help** on the **Diagnostics and Recovery Toolset** window to open the client Help file that provides detailed instruction and information needed to run the individual DaRT tools. You can also click the **Solution Wizard** on the **Diagnostics and Recovery Toolset** window to choose the best tool for the situation, based on a brief interview that the wizard provides.
 
@@ -55,41 +60,40 @@ For general information about any of the DaRT tools, see [Overview of the Tools
 
 **How to run DaRT at the command prompt**
 
--   To run DaRT at the command prompt, specify the **netstart.exe** command then use any of the following parameters:
+- To run DaRT at the command prompt, specify the **netstart.exe** command then use any of the following parameters:
+
+  
+  +  +  +  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
        



        Parameter
        Description
        -network
        Initializes the network services.
        -remount
        Remaps the drive letters.
        -prompt
        Displays messages that ask the end user to specify whether to initialize the network and remap the drives.
        
+  
        
+  Warning
        The end user’s response to the prompt overrides the –network and –remount switches.
        
+  
        
+  
        
+
+  
        
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
        



        Parameter
        Description
        -network
        Initializes the network services.
        -remount
        Remaps the drive letters.
        -prompt
        Displays messages that ask the end user to specify whether to initialize the network and remap the drives.
        
-    
        
-    Warning  
-    
        The end user’s response to the prompt overrides the –network and –remount switches.
        
-    
        
-    
        
-     
-    
        
 
-     
 
 ## Related topics
 
@@ -98,9 +102,9 @@ For general information about any of the DaRT tools, see [Overview of the Tools
 
 [Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md b/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md
index e972616f19..e8ceaf560b 100644
--- a/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md
+++ b/mdop/dart-v8/how-to-recover-remote-computers-by-using-the-dart-recovery-image-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: How to Recover Remote Computers by Using the DaRT Recovery Image
 description: How to Recover Remote Computers by Using the DaRT Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 363ccd48-6820-4b5b-a43a-323c0b208a9d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -32,113 +35,116 @@ If you disabled the DaRT tools when you created the recovery image, you still ha
 
     Whichever method that you use to boot into DaRT, you must enable the boot device in the BIOS for the boot option or options that you want to make available to the end user.
 
-    **Note**  
+    **Note**  
     Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization.
 
-     
 
-    As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears.
 
-2.  When you are asked whether you want to initialize network services, select one of the following:
+~~~
+As the computer is booting into the DaRT recovery image, the **NetStart** dialog box appears.
+~~~
 
-    **Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address.
+2. When you are asked whether you want to initialize network services, select one of the following:
 
-    **No** - skip the network initialization process.
+   **Yes** - it is assumed that a DHCP server is present on the network, and an attempt is made to obtain an IP address from the server. If the network uses static IP addresses instead of DHCP, you can later use the **TCP/IP Configuration** tool in DaRT to specify a static IP address.
 
-3.  Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process.
+   **No** - skip the network initialization process.
 
-4.  On the **System Recovery Options** dialog box, select a keyboard layout.
+3. Indicate whether you want to remap the drive letters. When you run Windows online, the system volume is typically mapped to drive C. However, when you run Windows offline under WinRE, the original system volume might be mapped to another drive, and this can cause confusion. If you decide to remap, DaRT tries to map the offline drive letters to match the online drive letters. Remapping is performed only if an offline operating system is selected later in the startup process.
 
-5.  Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver.
+4. On the **System Recovery Options** dialog box, select a keyboard layout.
 
-6.  Select the installation that you want to repair or diagnose, and then click **Next**.
+5. Check the displayed system root directory, the kind of operating system installed, and the partition size. If you do not see your operating system listed, and suspect that the lack of drivers is a possible cause of the failure, click **Load Drivers** to load the suspect drivers, and then insert the installation media for the device and select the driver.
 
-    **Note**  
-    If the Windows Recovery Environment (WinRE) detects or suspects that Windows 8 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. For information about how to resolve this issue, see [Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md).
+6. Select the installation that you want to repair or diagnose, and then click **Next**.
 
-     
+   **Note**  
+   If the Windows Recovery Environment (WinRE) detects or suspects that Windows 8 did not start correctly the last time that it was tried, **Startup Repair** might start to run automatically. For information about how to resolve this issue, see [Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md).
 
-    If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available.
 
-    The **System Recovery Options** window appears and lists various recovery tools.
 
-7.  On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset**.
+~~~
+If any of the registry hives are corrupted or missing, Registry Editor and several other DaRT utilities will have limited functionality. If no operating system is selected, some tools will not be available.
 
-8.  On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**.
+The **System Recovery Options** window appears and lists various recovery tools.
+~~~
 
-    The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information.
+7. On the **System Recovery Options** window, click **Microsoft Diagnostics and Recovery Toolset** to open the **Diagnostics and Recovery Toolset**.
 
-9.  On the help desk computer, open the **DaRT Remote Connection Viewer**.
+8. On the **Diagnostics and Recovery Toolset** window, click **Remote Connection** to open the **DaRT Remote Connection** window. If you are prompted to give the help desk remote access, click **OK**.
+
+   The DaRT Remote Connection window opens and displays a ticket number, IP address, and port information.
+
+9. On the help desk computer, open the **DaRT Remote Connection Viewer**.
 
 10. Click **Start**, click **All Programs**, click **Microsoft DaRT 8.0**, and then click **DaRT Remote Connection Viewer**.
 
 11. In the **DaRT Remote Connection** window, enter the required ticket, IP address, and port information.
 
-    **Note**  
-    This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer.
+   **Note**  
+   This information is created on the end-user computer and must be provided by the end user. There might be multiple IP addresses to choose from, depending on how many are available on the end-user computer.
+
 
-     
 
 12. Click **Connect**.
 
 The IT administrator now assumes control of the end-user computer and can run the DaRT tools remotely.
 
-**Note**  
+**Note**  
 A file is provided that is named inv32.xml and contains remote connection information, such as the port number and IP address. By default, the file is typically located at %windir%\\system32.
 
- 
+
 
 **To customize the Remote Connection process**
 
-1.  You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413).
+1. You can customize the Remote Connection process by editing the winpeshl.ini file. For more information about how to edit the winpeshl.ini file, see [Winpeshl.ini Files](https://go.microsoft.com/fwlink/?LinkId=219413).
 
-    Specify the following commands and parameters to customize how a remote connection is established with an end-user computer:
+   Specify the following commands and parameters to customize how a remote connection is established with an end-user computer:
 
-    
-    -    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
        




        CommandParameterDescription
        RemoteRecovery.exe
        -nomessage
        Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt.
        WaitForConnection.exe
        none
        Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer.
        
-    
        
-    Important  
-    
        This command serves no function if it is specified independently. It must be specified in a script to function correctly.
        
-    
        
-    
        
-     
-    
        
+   
+   +   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
        




        CommandParameterDescription
        RemoteRecovery.exe
        -nomessage
        Specifies that the confirmation prompt is not displayed. Remote Connection continues just as if the end user had responded "Yes" to the confirmation prompt.
        WaitForConnection.exe
        none
        Prevents a custom script from continuing until either Remote Connection is not running or a valid connection is established with the end-user computer.
        
+   
        
+   Important
        This command serves no function if it is specified independently. It must be specified in a script to function correctly.
        
+   
        
+   
        
 
-     
+   
        
 
-2.  The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT:
 
-    ``` syntax
-    [LaunchApps]
-    "%windir%\system32\netstart.exe -network -remount"
-    "cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage"
-    "%windir%\system32\WaitForConnection.exe"
-    "%SYSTEMDRIVE%\sources\recovery\recenv.exe"
-    ```
+
+2. The following is an example of a winpeshl.ini file that is customized to open the **Remote Connection** tool as soon as an attempt is made to boot into DaRT:
+
+   ```ini
+   [LaunchApps]
+   "%windir%\system32\netstart.exe -network -remount"
+   "cmd /C start %windir%\system32\RemoteRecovery.exe -nomessage"
+   "%windir%\system32\WaitForConnection.exe"
+   "%SYSTEMDRIVE%\sources\recovery\recenv.exe"
+   ```
 
 When DaRT starts, it creates the file inv32.xml in \\Windows\\System32\\ on the RAM disk. This file contains connection information: IP address, port, and ticket number. You can copy this file to a network share to trigger a Help desk workflow. For example, a custom program can check the network share for connection files, and then create a support ticket or send email notifications.
 
@@ -173,14 +179,16 @@ When DaRT starts, it creates the file inv32.xml in \\Windows\\System32\\ on the
     
     
 
-     
 
-    **Note**  
-    The variables for these parameters are created on the end-user computer and must be provided by the end user.
 
-     
+~~~
+**Note**  
+The variables for these parameters are created on the end-user computer and must be provided by the end user.
+~~~
 
-2.  If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified.
+
+
+2. If all three parameters are specified and the data is valid, a connection is immediately tried when the program starts. If any parameter is not valid, the program starts as if there were no parameters specified.
 
 ## Related topics
 
@@ -189,9 +197,9 @@ When DaRT starts, it creates the file inv32.xml in \\Windows\\System32\\ on the
 
 [Recovering Computers Using DaRT 8.0](recovering-computers-using-dart-80-dart-8.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md b/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md
index 56dbb996ef..8f3cdb66ed 100644
--- a/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md
+++ b/mdop/dart-v8/how-to-run-the-crash-analyzer-in-stand-alone-mode-on-a-computer-other-than-an-end-user-computer-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer
 description: How to Run the Crash Analyzer in Stand-alone Mode on a Computer Other than an End-user Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: b2f87144-6379-478a-802b-9cfef5242f34
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md b/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md
index 17f36999d6..82ae23319c 100644
--- a/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md
+++ b/mdop/dart-v8/how-to-run-the-crash-analyzer-on-an-end-user-computer-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: How to Run the Crash Analyzer on an End-user Computer
 description: How to Run the Crash Analyzer on an End-user Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: d36213e5-7719-44d7-be65-971c3ef7df2c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md b/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md
index d59e5a25bd..33e32407c5 100644
--- a/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md
+++ b/mdop/dart-v8/how-to-use-a-powershell-script-to-create-the-recovery-image-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: How to Use a PowerShell Script to Create the Recovery Image
 description: How to Use a PowerShell Script to Create the Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: d0c71092-535e-43b1-9b1d-6ac819508348
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v8/index.md b/mdop/dart-v8/index.md
index 4f39c5a258..d51694005d 100644
--- a/mdop/dart-v8/index.md
+++ b/mdop/dart-v8/index.md
@@ -1,13 +1,13 @@
 ---
 title: Diagnostics and Recovery Toolset 8 Administrator's Guide
 description: Diagnostics and Recovery Toolset 8 Administrator's Guide
-author: jamiejdt
+author: dansimp
 ms.assetid: 33685dd7-844f-4864-b504-3ef384ef01de
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
-ms.date: 04/19/2017
+ms.prod: w10
+ms.date: 10/03/2017
 ---
 
 
@@ -38,7 +38,7 @@ DaRT 8.0 is an important part of the Microsoft Desktop Optimization Pack (MDOP),
 
 [Technical Reference for DaRT 8.0](technical-reference-for-dart-80-new-ia.md)  
 
-[Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection](microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md)
+[Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection-->](use-windows-defender-offline-wdo-for-malware-protection-not-dart.md)
 
 [Troubleshooting DaRT 8.0](troubleshooting-dart-80-dart-8.md)  
 
@@ -54,7 +54,7 @@ View updated product information and known issues for DaRT 8.0.
 Learn about the latest MDOP information and resources.
 
 [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032)  
-Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447).
+Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com), or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447).
 
  
 
diff --git a/mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md b/mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md
deleted file mode 100644
index cff8d991a3..0000000000
--- a/mdop/dart-v8/microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-title: Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection
-description: Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection
-author: jamiejdt
-ms.assetid: 59678283-4b44-4d02-ba8f-0e7315efd5d1
-ms.pagetype: mdop
-ms.mktglfcycl: support
-ms.sitesec: library
-ms.prod: w8
-ms.date: 08/30/2016
----
-
-
-# Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection
-
-
-Environments that have the Microsoft Diagnostics and Recovery Toolset (DaRT) Defender tool deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. This applies to all currently supported versions of DaRT. These versions include DaRT 7, DaRT 8, and DaRT 8.1, together with their service packs.
-
-## About Windows Defender
-
-
-The Windows Defender tool distributes anti-malware updates more frequently than the DaRT Defender tool. Because of how the Defender tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images. Without these updates, the DaRT Defender tool quickly becomes outdated. To make sure of up-to-date protection at scan time, you should download Windows Defender Offline to create a bootable image for scanning.
-
-Currently deployed DaRT images do not have to be removed or updated. We recommend that you deploy the bootable image that is provided by Windows Defender Offline for all future malware scans. Using an outdated version of the DaRT Defender tool could result in undetected malware.
-
-For more information about Windows Defender Offline downloads and FAQs, go to the following website: [What is Windows Defender Offline?](https://go.microsoft.com/fwlink/p/?LinkId=394127).
-
- 
-
- 
-
-
-
-
-
diff --git a/mdop/dart-v8/operations-for-dart-80-dart-8.md b/mdop/dart-v8/operations-for-dart-80-dart-8.md
index 9092e122c7..a629db0966 100644
--- a/mdop/dart-v8/operations-for-dart-80-dart-8.md
+++ b/mdop/dart-v8/operations-for-dart-80-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Operations for DaRT 8.0
 description: Operations for DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: a31615de-eb6e-41af-909c-d0b6f3eb3f2f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md b/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md
index 04662c206f..ec7b892511 100644
--- a/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md
+++ b/mdop/dart-v8/overview-of-the-tools-in-dart-80-dart-8.md
@@ -1,13 +1,16 @@
 ---
 title: Overview of the Tools in DaRT 8.0
 description: Overview of the Tools in DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 1766c82e-c099-47d4-b186-4689b026a7e0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
-ms.date: 06/16/2016
+ms.prod: w10
+ms.date: 10/03/2016
 ---
 
 
@@ -30,7 +33,7 @@ A description of the DaRT 8.0 tools follows.
 **Note**  
 The recovery of dynamic disks with DaRT is not supported.
 
- 
+ 
 
 ### Crash Analyzer
 
@@ -45,9 +48,9 @@ For more information about **Crash Analyzer**, see [Diagnosing System Failures w
 ### Defender
 
 **Important**  
-Environments with the DaRT Defender deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. Because of how the Defender tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images. For more information, see [Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection](microsoft-diagnostics-and-recovery-toolset--dart--users-should-use-windows-defender-offline--wdo--for-malware-detection.md).
+Environments with the DaRT Defender deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. Because of how the Defender tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images. For more information, see  [Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection-->](use-windows-defender-offline-wdo-for-malware-protection-not-dart.md).
 
- 
+ 
 
 **Defender** can help detect malware and unwanted software and warn you of security risks. You can use this tool to scan a computer for and remove malware even when the installed Windows operating system is not running. When **Defender** detects malicious or unwanted software, it prompts you to remove, quarantine, or allow for each item.
 
@@ -68,12 +71,12 @@ Malware that uses rootkits can mask itself from the running operating system. If
 **Warning**  
 We recommend that you back up a disk before you use **Disk Commander** to repair it. By using **Disk Commander**, you can potentially damage volumes and make them inaccessible. Additionally, changes to one volume can affect other volumes because volumes on a disk share a partition table.
 
- 
+ 
 
 **Note**  
 The recovery of dynamic disks with DaRT is not supported.
 
- 
+ 
 
 ### Disk Wipe
 
@@ -82,7 +85,7 @@ You can use **Disk Wipe** to delete all data from a disk or volume, even the dat
 **Warning**  
 After wiping a disk or volume, you cannot recover the data. Verify the size and label of a volume before erasing it.
 
- 
+ 
 
 ### Explorer
 
@@ -95,7 +98,7 @@ The **Explorer** tool lets you browse the computer’s file system and network s
 **Note**  
 The recovery of dynamic disks with DaRT is not supported.
 
- 
+ 
 
 ### File Search
 
@@ -112,7 +115,7 @@ We recommend that you uninstall only one hotfix at a time, even though the tool
 **Important**  
 Programs that were installed or updated after a hotfix was installed might not work correctly after you uninstall a hotfix.
 
- 
+ 
 
 ### Locksmith
 
@@ -127,7 +130,7 @@ You can use **Registry Editor** to access and change the registry of the Windows
 **Warning**  
 Serious problems can occur if you change the registry incorrectly by using **Registry Editor**. These problems might require you to reinstall the operating system. Before you make changes to the registry, you should back up any valued data on the computer. Change the registry at your own risk.
 
- 
+ 
 
 ### SFC Scan
 
@@ -146,9 +149,9 @@ When you boot a problem computer into DaRT, it is set to automatically obtain it
 
 [Getting Started with DaRT 8.0](getting-started-with-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/planning-for-dart-80-dart-8.md b/mdop/dart-v8/planning-for-dart-80-dart-8.md
index 310d58b028..79fd2ee510 100644
--- a/mdop/dart-v8/planning-for-dart-80-dart-8.md
+++ b/mdop/dart-v8/planning-for-dart-80-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for DaRT 8.0
 description: Planning for DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: c8be3ab3-dc54-43b9-b9ff-fbd5e1ef29a7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md b/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md
index 50290559fc..cebf48b625 100644
--- a/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md
+++ b/mdop/dart-v8/planning-how-to-save-and-deploy-the-dart-80-recovery-image-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Planning How to Save and Deploy the DaRT 8.0 Recovery Image
 description: Planning How to Save and Deploy the DaRT 8.0 Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 939fbe17-0e30-4c85-8782-5b84d69442a7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ If your organization uses Active Directory Domain Services (AD DS), you may want
 **Note**  
 You may want to use more than one method in your organization. For example, you can boot into DaRT from a remote partition for most situations and have a USB flash drive available in case the end-user computer cannot connect to the network.
 
- 
+ 
 
 The following table shows some advantages and disadvantages of each method of using DaRT in your organization.
 
@@ -77,16 +80,16 @@ The following table shows some advantages and disadvantages of each method of us
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md b/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md
index 69a4a66f44..c75e4671f5 100644
--- a/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md
+++ b/mdop/dart-v8/planning-to-create-the-dart-80-recovery-image-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Planning to Create the DaRT 8.0 Recovery Image
 description: Planning to Create the DaRT 8.0 Recovery Image
-author: jamiejdt
+author: dansimp
 ms.assetid: cfd0e1e2-c379-4460-b545-3f7be9f33583
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -46,7 +49,7 @@ The following items are required or recommended for creating the DaRT recovery i
 
 
 
        Windows Debugging Tools for your platform
        
-
        Required when you run the Crash Analyzer to determine the cause of a computer failure. We recommend that you specify the path of the Windows Debugging Tools at the time that you create the DaRT recovery image. You can download the Windows Debugging Tools here: [Download and Install Debugging Tools for Windows](https://go.microsoft.com/fwlink/?LinkId=99934).
        
+
        Required when you run the Crash Analyzer to determine the cause of a computer failure. We recommend that you specify the path of the Windows Debugging Tools at the time that you create the DaRT recovery image. You can download the Windows Debugging Tools here: Download and Install Debugging Tools for Windows.
        
 
 
 
        Optional: Defender definitions
        
@@ -54,21 +57,21 @@ The following items are required or recommended for creating the DaRT recovery i
 
 
 
        Optional: Windows symbols files for use with Crash Analyzer
        
-
        Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding, for example, if it stopped working. For more information, see [Diagnosing System Failures with Crash Analyzer](diagnosing-system-failures-with-crash-analyzer--dart-8.md).
        
+
        Typically, debugging information is stored in a symbol file that is separate from the program. You must have access to the symbol information when you debug an application that has stopped responding, for example, if it stopped working. For more information, see Diagnosing System Failures with Crash Analyzer.
        
 
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [Planning to Deploy DaRT 8.0](planning-to-deploy-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md b/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md
index 09ee54baf4..dd46acd8ee 100644
--- a/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md
+++ b/mdop/dart-v8/planning-to-deploy-dart-80-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Planning to Deploy DaRT 8.0
 description: Planning to Deploy DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 36f2babb-9ac5-4ea2-932c-12c6211f5be2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md b/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md
index e5c34aa044..0cec24ac75 100644
--- a/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md
+++ b/mdop/dart-v8/recovering-computers-using-dart-80-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Recovering Computers Using DaRT 8.0
 description: Recovering Computers Using DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 0caeb7d9-c1e6-4f32-bc27-157b91630989
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -31,7 +34,7 @@ Whichever method that you use to boot into DaRT, you must enable the boot device
 **Note**  
 Configuring the BIOS is unique, depending on the kind of hard disk drive, network adapters, and other hardware that is used in your organization.
 
- 
+ 
 
 ## Recover a local computer by using the DaRT recovery image
 
@@ -48,7 +51,7 @@ The Remote Connection feature in DaRT lets an IT administrator run the DaRT tool
 **Important**  
 The two computers establishing a remote connection must be part of the same network.
 
- 
+ 
 
 The **Diagnostics and Recovery Toolset** window includes the option to run DaRT on an end-user computer remotely from an administrator computer. The end user opens the DaRT tools on the problem computer and starts the remote session by clicking **Remote Connection**.
 
@@ -63,9 +66,9 @@ The IT administrator or help desk worker enters this information into the **DaRT
 
 [Operations for DaRT 8.0](operations-for-dart-80-dart-8.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/dart-v8/release-notes-for-dart-80--dart-8.md b/mdop/dart-v8/release-notes-for-dart-80--dart-8.md
index ed6f807ef4..501dfef1e7 100644
--- a/mdop/dart-v8/release-notes-for-dart-80--dart-8.md
+++ b/mdop/dart-v8/release-notes-for-dart-80--dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Release Notes for DaRT 8.0
 description: Release Notes for DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: e8b373c8-7aa5-4930-a8f9-743d26145dad
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -37,7 +40,7 @@ We are interested in your feedback on DaRT 8.0. You can send your feedback to ](use-windows-defender-offline-wdo-for-malware-protection-not-dart.md)
 
     Environments with the Microsoft Diagnostics and Recovery Toolset (DaRT) Defender tool deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection.
 
diff --git a/mdop/dart-v8/troubleshooting-dart-80-dart-8.md b/mdop/dart-v8/troubleshooting-dart-80-dart-8.md
index 65ae296b20..1ad577b12a 100644
--- a/mdop/dart-v8/troubleshooting-dart-80-dart-8.md
+++ b/mdop/dart-v8/troubleshooting-dart-80-dart-8.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting DaRT 8.0
 description: Troubleshooting DaRT 8.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 0444a390-3251-47f4-b6c8-828d4a2e8af4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: support
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/dart-v8/use-windows-defender-offline-wdo-for-malware-protection-not-dart.md b/mdop/dart-v8/use-windows-defender-offline-wdo-for-malware-protection-not-dart.md
new file mode 100644
index 0000000000..6265073d6b
--- /dev/null
+++ b/mdop/dart-v8/use-windows-defender-offline-wdo-for-malware-protection-not-dart.md
@@ -0,0 +1,38 @@
+---
+title: Use Windows Defender Offline (WDO) for malware protection not DaRT
+description: Microsoft Diagnostics and Recovery Toolset (DaRT) users should use Windows Defender Offline (WDO) for malware detection
+author: dansimp
+ms.assetid: 59678283-4b44-4d02-ba8f-0e7315efd5d1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
+ms.pagetype: mdop
+ms.mktglfcycl: support
+ms.sitesec: library
+ms.prod: w10
+ms.date: 09/25/2019
+---
+
+
+# Use Windows Defender Offline (WDO) for malware protection, not DaRT.
+
+Environments that have the Microsoft Diagnostics and Recovery Toolset (DaRT) Defender tool deployed should instead use the Windows Defender Offline (WDO) protection image for malware detection. This applies to all currently supported versions of DaRT. These versions include DaRT 7, DaRT 8, and DaRT 8.1, together with their service packs.
+
+## About Windows Defender
+
+
+The Windows Defender tool distributes anti-malware updates more frequently than the DaRT Defender tool. Because of how the Defender tool integrates into DaRT, all supported DaRT version deployments cannot apply these anti-malware updates to their DaRT images. Without these updates, the DaRT Defender tool quickly becomes outdated. To make sure of up-to-date protection at scan time, you should download Windows Defender Offline to create a bootable image for scanning.
+
+Currently deployed DaRT images do not have to be removed or updated. We recommend that you deploy the bootable image that is provided by Windows Defender Offline for all future malware scans. Using an outdated version of the DaRT Defender tool could result in undetected malware.
+
+For more information about Windows Defender Offline downloads and FAQs, go to the following website: [What is Windows Defender Offline?](https://go.microsoft.com/fwlink/p/?LinkId=394127).
+
+ 
+
+ 
+
+
+
+
+
diff --git a/mdop/docfx.json b/mdop/docfx.json
index 38b354ec49..e6f79ff24a 100644
--- a/mdop/docfx.json
+++ b/mdop/docfx.json
@@ -1,40 +1,62 @@
 {
   "build": {
-    "content":
-      [
-        {
-          "files": ["**/**.md", "**/**.yml"],
-          "exclude": ["**/obj/**"]
-        }
-      ],
+    "content": [
+      {
+        "files": [
+          "**/**.md",
+          "**/**.yml"
+        ],
+        "exclude": [
+          "**/obj/**"
+        ]
+      }
+    ],
     "resource": [
-        {
-          "files": ["**/images/**"],
-          "exclude": ["**/obj/**"]
-        }
+      {
+        "files": [
+          "**/images/**"
+        ],
+        "exclude": [
+          "**/obj/**"
+        ]
+      }
     ],
     "globalMetadata": {
-		"uhfHeaderId": "MSDocsHeader-WindowsIT", 
-		"breadcrumb_path": "/microsoft-desktop-optimization-pack/breadcrumb/toc.json",
-        "ROBOTS": "INDEX, FOLLOW",
-		"ms.technology": "mdop",
-		"ms.sitesec": "library",
-		"ms.topic": "article",
-		"ms.author": "jamiet",
-		"ms.date": "04/05/2017",
-		"feedback_system": "GitHub",
-		"feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
-		"feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
-		"_op_documentIdPathDepotMapping": {
-			"./": {
-			  "depot_name": "Win.mdop"
-			}
-		}
+      "breadcrumb_path": "/microsoft-desktop-optimization-pack/breadcrumb/toc.json",
+      "ROBOTS": "INDEX, FOLLOW",
+      "ms.technology": "windows",
+      "audience": "ITPro",
+      "manager": "dansimp",
+      "ms.prod": "w10",
+      "ms.author": "dansimp",
+      "author": "dansimp",
+      "ms.sitesec": "library",
+      "ms.topic": "article",
+      "ms.date": "04/05/2017",
+      "feedback_system": "GitHub",
+      "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
+      "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "Win.mdop",
+          "folder_relative_path_in_docset": "./"
+        }
+      },
+      "contributors_to_exclude": [ 
+        "rjagiewich", 
+        "traya1", 
+        "rmca14", 
+        "claydetels19", 
+        "Kellylorenebaker",
+        "jborsecnik",
+        "tiburd",
+        "garycentric"
+      ],
+      "titleSuffix": "Microsoft Desktop Optimization Pack"
     },
-    "externalReference": [
-    ],
+    "externalReference": [],
     "template": "op.html",
     "dest": "mdop",
-    "markdownEngineName": "dfm"
-  }
-}
\ No newline at end of file
+    "markdownEngineName": "markdig"
+    }
+}
diff --git a/mdop/index.md b/mdop/index.md
index 4764ce169b..93ce634a80 100644
--- a/mdop/index.md
+++ b/mdop/index.md
@@ -2,7 +2,7 @@
 title: MDOP Information Experience
 description: MDOP Information Experience
 ms.assetid: 12b8ab56-3267-450d-bb22-1c7e44cb8e52
-author: jamiejdt
+author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -36,40 +36,40 @@ The following table provides links to the product documentation for the MDOP pro
 
        AGPM 4.0 - Windows Vista SP1, Windows 7, Windows Server 2008, Windows Server 2008 R2
        
 
        AGPM 3.0- Windows Vista SP1, Windows Server 2008
        
 
        AGPM 2.5 - Windows Vista, Windows Server 2003
        
-
        [Overview of Microsoft Advanced Group Policy Management](agpm/index.md)
        
-
        [AGPM 4.0 SP3](agpm/whats-new-in-agpm-40-sp3.md)
        
-
        [AGPM 4.0 SP2](agpm/whats-new-in-agpm-40-sp2.md)
        
-
        [AGPM 4.0 SP1](https://go.microsoft.com/fwlink/p/?LinkId=286715) (https://go.microsoft.com/fwlink/p/?LinkId=286715)
        
-
        [AGPM 4.0](agpm/whats-new-in-agpm-40-sp1.md)
        
-
        [AGPM 3.0](agpm/whats-new-in-agpm-30.md)
        
-
        [AGPM 2.5](agpm/agpm-25-navengl.md)
        
-
        [AGPM Whitepapers on the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=232275)
        
+
        Overview of Microsoft Advanced Group Policy Management
        
+
        AGPM 4.0 SP3
        
+
        AGPM 4.0 SP2
        
+
        AGPM 4.0 SP1 (https://go.microsoft.com/fwlink/p/?LinkId=286715)
        
+
        AGPM 4.0
        
+
        AGPM 3.0
        
+
        AGPM 2.5
        
+
        AGPM Whitepapers on the Microsoft Download Center
        
 
 
 
        Microsoft Application Virtualization (App-V) lets you make applications available to end user computers without installing the applications directly on those computers.
        
-
        [Microsoft Application Virtualization 5.1 Administrator's Guide](appv-v5/microsoft-application-virtualization-51-administrators-guide.md)
        
-
        [About App-V 5.0 SP3](appv-v5/about-app-v-50-sp3.md)
        
-
        [About App-V 5.0 SP2](appv-v5/about-app-v-50-sp2.md)
        
-
        [About App-V 5.0 SP1](appv-v5/about-app-v-50-sp1.md)
        
-
        [Microsoft Application Virtualization 5.0 Administrator's Guide](appv-v5/microsoft-application-virtualization-50-administrators-guide.md)
        
-
        [About Microsoft Application Virtualization 4.6 SP3](appv-v4/about-microsoft-application-virtualization-46-sp3.md)
        
-
        [About Microsoft Application Virtualization 4.6 SP2](appv-v4/about-microsoft-application-virtualization-46-sp2.md)
        
-
        [About Microsoft Application Virtualization 4.6 SP1](appv-v4/about-microsoft-application-virtualization-46-sp1.md)
        
-
        [About Microsoft Application Virtualization 4.6](appv-v4/about-microsoft-application-virtualization-46.md)
        
-
        [About Microsoft Application Virtualization 4.5](appv-v4/about-microsoft-application-virtualization-45.md)
        
-
        [App-V Whitepapers on the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=231902)
        
-
        [App-V 5.0 eBooks](https://go.microsoft.com/fwlink/p/?LinkId=309570) (https://go.microsoft.com/fwlink/p/?LinkId=309570)
        
+
        Microsoft Application Virtualization 5.1 Administrator's Guide
        
+
        About App-V 5.0 SP3
        
+
        About App-V 5.0 SP2
        
+
        About App-V 5.0 SP1
        
+
        Microsoft Application Virtualization 5.0 Administrator's Guide
        
+
        About Microsoft Application Virtualization 4.6 SP3
        
+
        About Microsoft Application Virtualization 4.6 SP2
        
+
        About Microsoft Application Virtualization 4.6 SP1
        
+
        About Microsoft Application Virtualization 4.6
        
+
        About Microsoft Application Virtualization 4.5
        
+
        App-V Whitepapers on the Microsoft Download Center
        
+
        App-V 5.0 eBooks (https://go.microsoft.com/fwlink/p/?LinkId=309570)
        
 
 
 
        Microsoft BitLocker Administration and Monitoring (MBAM) provides an administrative interface to enterprise-wide BitLocker drive encryption.
        
-
        [Microsoft BitLocker Administration and Monitoring 2.5](mbam-v25/index.md)
        
-
        [MBAM 2.5 Video Demonstration: Deploying MBAM 2.5](https://go.microsoft.com/fwlink/?LinkId=518206) 
        
-
        [About MBAM 2.5 SP1](mbam-v25/about-mbam-25-sp1.md)
        
-
        [About MBAM 2.0 SP1](mbam-v2/about-mbam-20-sp1.md)
        
-
        [Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide](mbam-v2/index.md)
        
-
        [Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide](mbam-v1/index.md)
        
-
        [MBAM Whitepapers on the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=231905) (https://go.microsoft.com/fwlink/p/?LinkId=231905)
        
-
        [MBAM 1.0 eBooks](https://go.microsoft.com/fwlink/p/?LinkId=309571) (https://go.microsoft.com/fwlink/p/?LinkId=309571)
        
+
        Microsoft BitLocker Administration and Monitoring 2.5
        
+
        MBAM 2.5 Video Demonstration: Deploying MBAM 2.5 
        
+
        About MBAM 2.5 SP1
        
+
        About MBAM 2.0 SP1
        
+
        Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide
        
+
        Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide
        
+
        MBAM Whitepapers on the Microsoft Download Center (https://go.microsoft.com/fwlink/p/?LinkId=231905)
        
+
        MBAM 1.0 eBooks (https://go.microsoft.com/fwlink/p/?LinkId=309571)
        
 
 
 
        Microsoft Diagnostics and Recovery Toolset (DaRT) helps troubleshoot and repair Windows-based computers.
        
@@ -81,53 +81,53 @@ The following table provides links to the product documentation for the MDOP pro
 
        DaRT 6.5 - Windows 7, Windows Server 2008 R2
        
 
        DaRT 6.0 - Windows Vista, Windows Server 2008
        
 
        DaRT 5.0 - Windows 2000, Windows XP, Windows Server 2003
        
-
        [Diagnostics and Recovery Toolset 10](dart-v10/index.md)
        
-
        [About DaRT 8.1](dart-v8/about-dart-81.md)
        
-
        [About DaRT 8.0 SP1](dart-v8/about-dart-80-sp1.md)
        
-
        [Diagnostics and Recovery Toolset 8 Administrator's Guide](dart-v8/index.md)
        
-
        [Diagnostics and Recovery Toolset 7 Administrator's Guide](dart-v7/index.md)
        
-
        [DaRT 6.5](https://go.microsoft.com/fwlink/p/?LinkId=232983) (https://go.microsoft.com/fwlink/p/?LinkId=232983)
        
-
        [DaRT Whitepapers on the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=232274) (https://go.microsoft.com/fwlink/p/?LinkId=232274)
        
-
        [DaRT 8.0 eBook](https://go.microsoft.com/fwlink/p/?LinkId=309573) (https://go.microsoft.com/fwlink/p/?LinkId=309573)
        
-
        [DaRT 7.0 eBook](https://go.microsoft.com/fwlink/p/?LinkId=309572) (https://go.microsoft.com/fwlink/p/?LinkId=309572)
        
+
        Diagnostics and Recovery Toolset 10
        
+
        About DaRT 8.1
        
+
        About DaRT 8.0 SP1
        
+
        Diagnostics and Recovery Toolset 8 Administrator's Guide
        
+
        Diagnostics and Recovery Toolset 7 Administrator's Guide
        
+
        DaRT 6.5 (https://go.microsoft.com/fwlink/p/?LinkId=232983)
        
+
        DaRT Whitepapers on the Microsoft Download Center (https://go.microsoft.com/fwlink/p/?LinkId=232274)
        
+
        DaRT 8.0 eBook (https://go.microsoft.com/fwlink/p/?LinkId=309573)
        
+
        DaRT 7.0 eBook (https://go.microsoft.com/fwlink/p/?LinkId=309572)
        
 
 
 
        Microsoft Desktop Enterprise Monitoring (DEM) monitors and reports enterprise-wide desktop application and system failures.
        
-
        [DEM 3.5](https://go.microsoft.com/fwlink/p/?LinkId=232985) (https://go.microsoft.com/fwlink/p/?LinkId=232985)
        
-
        [DEM Whitepapers on the Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=232276) (https://go.microsoft.com/fwlink/p/?LinkId=232276)
        
+
        DEM 3.5 (https://go.microsoft.com/fwlink/p/?LinkId=232985)
        
+
        DEM Whitepapers on the Microsoft Download Center (https://go.microsoft.com/fwlink/p/?LinkId=232276)
        
 
 
 
        Microsoft Enterprise Desktop Virtualization (MED-V) uses Microsoft Virtual PC to provide an enterprise solution for desktop virtualization.
        
 
        MED-V 2.0 - Windows 7
        
 
        MED-V 1.0 SP1 - Windows 7, Windows Vista, Windows XP
        
 
        MED-V 1.0 - Windows Vista, Windows XP
        
-
        [Microsoft Enterprise Desktop Virtualization 2.0](medv-v2/index.md)
        
-
        [About MED-V 1.0 SP1](medv-v1/about-med-v-10-sp1.md)
        
-
        [Microsoft Enterprise Desktop Virtualization 1.0](medv-v1/index.md)
        
+
        Microsoft Enterprise Desktop Virtualization 2.0
        
+
        About MED-V 1.0 SP1
        
+
        Microsoft Enterprise Desktop Virtualization 1.0
        
 
 
 
 
        Microsoft User Experience Virtualization (UE-V) captures settings to apply to computers accessed by the user including desktop computers, laptop computers, and VDI sessions.
        
-
        [Microsoft User Experience Virtualization (UE-V) 2.x](uev-v2/index.md)
        
-
        [What's New in UE-V 2.1 SP1](uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md)
        
-
        [What's New in UE-V 2.1](uev-v2/whats-new-in-ue-v-21-new-uevv2.md)
        
-
        [What's New in UE-V 2.0](uev-v2/whats-new-in-ue-v-20-new-uevv2.md)
        
-
        [About User Experience Virtualization 1.0 SP1](uev-v1/about-user-experience-virtualization-10-sp1.md)
        
-
        [Microsoft User Experience Virtualization (UE-V) 1.0](uev-v1/index.md)
        
-
        [UE-V 1.0 eBooks](https://go.microsoft.com/fwlink/p/?LinkId=309574) (https://go.microsoft.com/fwlink/p/?LinkId=309574)
        
+
        Microsoft User Experience Virtualization (UE-V) 2.x
        
+
        What's New in UE-V 2.1 SP1
        
+
        What's New in UE-V 2.1
        
+
        What's New in UE-V 2.0
        
+
        About User Experience Virtualization 1.0 SP1
        
+
        Microsoft User Experience Virtualization (UE-V) 1.0
        
+
        UE-V 1.0 eBooks (https://go.microsoft.com/fwlink/p/?LinkId=309574)
        
 
 
-
        [MDOP Solutions and Scenarios](solutions/index.md)
        
-
        [Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0](solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md)
        
-
        [Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0](solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md)
        
-
        [Creating App-V 4.5 Databases Using SQL Scripting](solutions/creating-app-v-45-databases-using-sql-scripting.md)
        
-
        [Application Publishing and Client Interaction for App-V 5](solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md)
        
-
        [How to Download and Deploy MDOP Group Policy (.admx) Templates](solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md)
        
+
        MDOP Solutions and Scenarios
        
+
        Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0
        
+
        Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0
        
+
        Creating App-V 4.5 Databases Using SQL Scripting
        
+
        Application Publishing and Client Interaction for App-V 5
        
+
        How to Download and Deploy MDOP Group Policy (.admx) Templates
        
 
 
 
 
- 
+ 
 
 ## Supplemental MDOP Product Guidance
 
@@ -142,21 +142,21 @@ In addition to the product documentation available online, supplemental product
 
 
 
        MDOP Virtual Labs
        
-
        For a list of available MDOP virtual labs, go to [Microsoft Desktop Optimization Pack (MDOP) Virtual Labs](https://go.microsoft.com/fwlink/p/?LinkId=234276) (https://go.microsoft.com/fwlink/p/?LinkId=234276).
        
+
        For a list of available MDOP virtual labs, go to Microsoft Desktop Optimization Pack (MDOP) Virtual Labs (https://go.microsoft.com/fwlink/p/?LinkId=234276).
        
 
 
 
        MDOP TechCenter
        
-
        For technical whitepapers, evaluation materials, blogs, and additional MDOP resources, go to [MDOP TechCenter](https://go.microsoft.com/fwlink/p/?LinkId=225286) (https://go.microsoft.com/fwlink/p/?LinkId=225286)
        
+
        For technical whitepapers, evaluation materials, blogs, and additional MDOP resources, go to MDOP TechCenter (https://go.microsoft.com/fwlink/p/?LinkId=225286)
        
 
        
 
 
 
        MDOP Forums
        
-
        Join in the MDOP community where you can ask and answer questions at the [MDOP TechNet Forum](https://go.microsoft.com/fwlink/p/?LinkId=286973) (https://go.microsoft.com/fwlink/p/?LinkId=286973).
        
+
        Join in the MDOP community where you can ask and answer questions at the MDOP TechNet Forum (https://go.microsoft.com/fwlink/p/?LinkId=286973).
        
 
 
 
 
- 
+ 
 
 ## How to Get MDOP
 
@@ -169,9 +169,9 @@ MDOP subscribers can download the software at the [Microsoft Volume Licensing we
 **Purchase MDOP**
 Visit the enterprise [Purchase Windows Enterprise Licensing](https://www.microsoft.com/licensing/how-to-buy/how-to-buy) website to find out how to purchase MDOP for your business.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/about-mbam-10.md b/mdop/mbam-v1/about-mbam-10.md
index fad97c1223..3d6a3f705f 100644
--- a/mdop/mbam-v1/about-mbam-10.md
+++ b/mdop/mbam-v1/about-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: About MBAM 1.0
 description: About MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 99254aaa-2b30-4b2e-8365-0d4b67a89a0c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -21,7 +24,7 @@ With Microsoft BitLocker Administration and Monitoring, you can select the BitLo
 **Note**  
 BitLocker is not covered in detail in this guide. For an overview of BitLocker, see [BitLocker Drive Encryption Overview](https://go.microsoft.com/fwlink/p/?LinkId=225013).
 
- 
+ 
 
 The following groups might be interested in using MBAM to manage BitLocker:
 
@@ -43,9 +46,9 @@ For more information and for latest updates, see [Release Notes for MBAM 1.0](re
 
 [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/accessibility-for-mbam-10.md b/mdop/mbam-v1/accessibility-for-mbam-10.md
index 4fb9ce04ea..bfe5549622 100644
--- a/mdop/mbam-v1/accessibility-for-mbam-10.md
+++ b/mdop/mbam-v1/accessibility-for-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Accessibility for MBAM 1.0
 description: Accessibility for MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 5c1bf1a3-76cf-458c-ac4a-cd343aace4de
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -30,7 +33,7 @@ Access keys let you quickly use a command by pressing a few keys. You can get to
 **Note**  
 To cancel the action that you are taking and hide the keyboard shortcuts, press ALT.
 
- 
+ 
 
 ## Documentation in Alternative Formats
 
@@ -64,13 +67,13 @@ For information about the availability of Microsoft product documentation and bo
 
        (609) 987-8116
        
 
 
-
        [http://www.learningally.org/](https://go.microsoft.com/fwlink/?linkid=239)
        
+
        http://www.learningally.org/
        
 
        Web addresses can change, so you might be unable to connect to the website or sites mentioned here.
        
 
 
 
 
- 
+ 
 
 ## Customer Service for People with Hearing Impairments
 
@@ -93,9 +96,9 @@ For more information about how accessible technology for computers helps to impr
 
 [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md b/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md
index a2e3aeb732..1609db7fb7 100644
--- a/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md
+++ b/mdop/mbam-v1/administering-mbam-10-by-using-powershell.md
@@ -1,12 +1,15 @@
 ---
 title: Administering MBAM 1.0 by Using PowerShell
 description: Administering MBAM 1.0 by Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 3bf2eca5-4ab7-4e84-9e80-c0c7d709647b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/administering-mbam-10-features.md b/mdop/mbam-v1/administering-mbam-10-features.md
index 9cfda1fe2a..5f4fbb0244 100644
--- a/mdop/mbam-v1/administering-mbam-10-features.md
+++ b/mdop/mbam-v1/administering-mbam-10-features.md
@@ -1,12 +1,15 @@
 ---
 title: Administering MBAM 1.0 Features
 description: Administering MBAM 1.0 Features
-author: jamiejdt
+author: dansimp
 ms.assetid: dd9a9eff-f1ad-4af3-85d9-c19131a4ad22
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -31,7 +34,7 @@ The MBAM Hardware Compatibility feature can help you to ensure that only the com
 **Important**  
 When this feature is turned off, all computers where the MBAM policy is deployed will be encrypted.
 
- 
+ 
 
 MBAM can collect information on both the make and model of client computers if you deploy the “Allow Hardware Compatibility Checking” Group Policy. If you configure this policy, the MBAM agent reports the computer make and model information to the MBAM Server when the MBAM Client is deployed on a client computer.
 
@@ -58,9 +61,9 @@ If enabled through a Group Policy Objects (GPO), a custom MBAM control panel tha
 
 [Operations for MBAM 1.0](operations-for-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md b/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md
index 63a75e2f02..37436151d6 100644
--- a/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md
+++ b/mdop/mbam-v1/deploying-mbam-10-group-policy-objects.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying MBAM 1.0 Group Policy Objects
 description: Deploying MBAM 1.0 Group Policy Objects
-author: jamiejdt
+author: dansimp
 ms.assetid: 2129291e-d2b2-41ed-b643-1e311c49fee7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/deploying-mbam-10.md b/mdop/mbam-v1/deploying-mbam-10.md
index 6e416db1e6..ab3420e5c6 100644
--- a/mdop/mbam-v1/deploying-mbam-10.md
+++ b/mdop/mbam-v1/deploying-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying MBAM 1.0
 description: Deploying MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: ff952ed6-08b2-4ed0-97b8-bf89f22cccbc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/deploying-the-mbam-10-client.md b/mdop/mbam-v1/deploying-the-mbam-10-client.md
index 833fa771de..cba12f248f 100644
--- a/mdop/mbam-v1/deploying-the-mbam-10-client.md
+++ b/mdop/mbam-v1/deploying-the-mbam-10-client.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the MBAM 1.0 Client
 description: Deploying the MBAM 1.0 Client
-author: jamiejdt
+author: dansimp
 ms.assetid: f7ca233f-5035-4ff9-ab3a-f2453b4929d1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md b/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md
index c478873a50..22cac957e6 100644
--- a/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md
+++ b/mdop/mbam-v1/deploying-the-mbam-10-language-release-update.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the MBAM 1.0 Language Release Update
 description: Deploying the MBAM 1.0 Language Release Update
-author: jamiejdt
+author: dansimp
 ms.assetid: 9dbd85c3-e470-4752-a90f-25754dd46dab
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md b/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md
index 6ba49c968b..22d1fabb5c 100644
--- a/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md
+++ b/mdop/mbam-v1/deploying-the-mbam-10-server-infrastructure.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the MBAM 1.0 Server Infrastructure
 description: Deploying the MBAM 1.0 Server Infrastructure
-author: jamiejdt
+author: dansimp
 ms.assetid: 90529379-b70e-4c92-b188-3d7aaf1844af
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -24,7 +27,7 @@ In this configuration, all MBAM features are installed on a single server. This
 **Important**  
 This configuration is supported, but we recommend it for testing only.
 
- 
+ 
 
 The procedures in this section describe the full installation of the MBAM features on a single server.
 
@@ -90,9 +93,9 @@ In this configuration, MBAM features are installed in the following configuratio
 
 [Deploying MBAM 1.0](deploying-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/evaluating-mbam-10.md b/mdop/mbam-v1/evaluating-mbam-10.md
index d61e8f68bd..c7a6729376 100644
--- a/mdop/mbam-v1/evaluating-mbam-10.md
+++ b/mdop/mbam-v1/evaluating-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Evaluating MBAM 1.0
 description: Evaluating MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: a1e2b674-eda9-4e1c-9b4c-e748470c71f2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -44,63 +47,62 @@ Even when you set up a non-production instance of MBAM to evaluate in a lab envi
 
 Checklist box
 
        Review the Getting Started information about MBAM to gain a basic understanding of the product before you begin your deployment planning.
        
-
        [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md)
        
+
        Getting Started with MBAM 1.0
        
 
        
 
 
 Checklist box
 
        
-
        Prepare your computing environment for the MBAM installation. To do so, you must enable the Transparent Data Encryption (TDE) on the SQL Server instances that will host MBAM databases. To enable TDE in your lab environment, you can create a .sql file to run against the master database that is hosted on the instance of the SQL Server that MBAM will use.
        
+
        Prepare your computing environment for the MBAM installation. To do so, you must enable the Transparent Data Encryption (TDE) on the SQL Server instances that will host MBAM databases. To enable TDE in your lab environment, you can create a .sql file to run against the master database that is hosted on the instance of the SQL Server that MBAM will use.
        
 
        
-Note  
-
        You can use the following example to create a .sql file for your lab environment to quickly enable TDE on the SQL Server instance that will host the MBAM databases. These SQL Server commands will enable TDE by using a locally signed SQL Server certificate. Make sure to back up the TDE certificate and its associated encryption key to the example local backup path of C:\Backup\. The TDE certificate and key are required when recover the database or move the certificate and key to another server that has TDE encryption in place.
        
+Note
        You can use the following example to create a .sql file for your lab environment to quickly enable TDE on the SQL Server instance that will host the MBAM databases. These SQL Server commands will enable TDE by using a locally signed SQL Server certificate. Make sure to back up the TDE certificate and its associated encryption key to the example local backup path of C:\Backup</em>. The TDE certificate and key are required when recover the database or move the certificate and key to another server that has TDE encryption in place.
        
 
        
 
        
- 
+
 
        
 
        USE master;
 GO
-CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'P@55w0rd';
+CREATE MASTER KEY ENCRYPTION BY PASSWORD = &amp;#39;P@55w0rd';
 GO
 CREATE CERTIFICATE tdeCert WITH SUBJECT = 'TDE Certificate';
 GO
 BACKUP CERTIFICATE tdeCert TO FILE = 'C:\Backup\TDECertificate.cer'
    WITH PRIVATE KEY (
          FILE = 'C:\Backup\TDECertificateKey.pvk',
-         ENCRYPTION BY PASSWORD = 'P@55w0rd');
+         ENCRYPTION BY PASSWORD = &amp;#39;P@55w0rd');
 GO
        
-
        [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md)
        
-
        [Database Encryption in SQL Server 2008 Enterprise Edition](https://go.microsoft.com/fwlink/?LinkId=269703)
        
+
        MBAM 1.0 Deployment Prerequisites
        
+
        Database Encryption in SQL Server 2008 Enterprise Edition
        
 
        
 
 
 Checklist box
 
        Plan for and configure MBAM Group Policy requirements.
        
-
        [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md)
        
+
        Planning for MBAM 1.0 Group Policy Requirements
        
 
        
 
 
 Checklist box
-
        Plan for and create the necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.
        
-
        [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md)
        
+
        Plan for and create the necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.
        
+
        Planning for MBAM 1.0 Administrator Roles
        
 
        
 
 
 Checklist box
 
        Plan for MBAM Server feature deployment.
        
-
        [Planning for MBAM 1.0 Server Deployment](planning-for-mbam-10-server-deployment.md)
        
+
        Planning for MBAM 1.0 Server Deployment
        
 
        
 
 
 Checklist box
 
        Plan for MBAM Client deployment.
        
-
        [Planning for MBAM 1.0 Client Deployment](planning-for-mbam-10-client-deployment.md)
        
+
        Planning for MBAM 1.0 Client Deployment
        
 
        
 
 
 
 
- 
+
 
 ### Perform an MBAM Evaluation Deployment
 
@@ -117,47 +119,47 @@ After you complete the necessary planning and software prerequisite installation
 
 Checklist box
 
        Review the MBAM supported configurations information to make sure that the selected client and server computers are supported for the MBAM feature installation.
        
-
        [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md)
        
+
        MBAM 1.0 Supported Configurations
        
 
        
 
 
 Checklist box
 
        Run MBAM Setup to deploy MBAM Server features on a single server for evaluation purposes.
        
-
        [How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md)
        
+
        How to Install and Configure MBAM on a Single Server
        
 
        
 
 
 Checklist box
-
        Add the Active Directory Domain Services security groups that you created during the planning phase to the appropriate local MBAM Server feature local groups on the new MBAM server.
        
-
        [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md) and [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-1.md)
        
+
        Add the Active Directory Domain Services security groups that you created during the planning phase to the appropriate local MBAM Server feature local groups on the new MBAM server.
        
+
        Planning for MBAM 1.0 Administrator Roles and How to Manage MBAM Administrator Roles
        
 
        
 
 
 Checklist box
 
        Create and deploy the required MBAM Group Policy Objects.
        
-
        [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md)
        
+
        Deploying MBAM 1.0 Group Policy Objects
        
 
        
 
 
 Checklist box
 
        Deploy the MBAM Client software.
        
-
        [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md)
        
+
        Deploying the MBAM 1.0 Client
        
 
        
 
 
 
 
- 
+
 
 ## Configure Lab Computers for MBAM Evaluation
 
 
 You can change the frequency settings on the MBAM Client status reporting by using Registry Editor. However, these modifications should be used for testing purposes only.
 
-**Warning**  
+**Warning**  
 This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk.
 
- 
+
 
 ### Modify the Frequency Settings on MBAM Client Status Reporting
 
@@ -172,9 +174,9 @@ In addition to the MBAM Client wakeup and status reporting frequencies, there is
 
 [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v1/getting-started-with-mbam-10.md b/mdop/mbam-v1/getting-started-with-mbam-10.md
index 7964813ec1..7d1f4c4060 100644
--- a/mdop/mbam-v1/getting-started-with-mbam-10.md
+++ b/mdop/mbam-v1/getting-started-with-mbam-10.md
@@ -1,18 +1,24 @@
 ---
 title: Getting Started with MBAM 1.0
 description: Getting Started with MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 4fab4e4a-d25e-4661-b235-2b45bf5ac3e4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
-
 # Getting Started with MBAM 1.0
 
+> **IMPORTANT**
+> MBAM 1.0 will reach end of support on September 14, 2021. 
+> See our [lifecycle page](https://support.microsoft.com/lifecycle/search?alpha=Microsoft%20BitLocker%20Administration%20and%20Monitoring%201.0) for more information. We recommend [migrating to MBAM 2.5](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions) or another supported version of MBAM, or migrating your BitLocker management to [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager).
+
 
 Microsoft BitLocker Administration and Monitoring (MBAM) requires thorough planning before you deploy it or use its features. Because this product can affect every computer in your organization, you might disrupt your entire network if you do not plan your deployment carefully. However, if you plan your deployment carefully and manage it so that it meets your business needs, MBAM can help reduce your administrative overhead and total cost of ownership.
 
@@ -21,7 +27,7 @@ If you are new to this product, we recommend that you read the documentation tho
 **Note**  
 You can find a downloadable version of this documentation and the MBAM Evaluation Guide at .
 
- 
+ 
 
 This section of the MBAM Administrator’s Guide includes high-level information about MBAM to provide you with a basic understanding of the product before you begin the deployment planning. Additional MBAM documentation can be found on the MBAM Documentation Resources Download page at .
 
@@ -57,9 +63,9 @@ This section of the MBAM Administrator’s Guide includes high-level information
 
 -   [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/high-availability-for-mbam-10.md b/mdop/mbam-v1/high-availability-for-mbam-10.md
index 7e937b41e0..90c23329c3 100644
--- a/mdop/mbam-v1/high-availability-for-mbam-10.md
+++ b/mdop/mbam-v1/high-availability-for-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: High Availability for MBAM 1.0
 description: High Availability for MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 5869ecf8-1056-4c32-aecb-838a37e05d39
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/mbam-v1/high-level-architecture-for-mbam-10.md b/mdop/mbam-v1/high-level-architecture-for-mbam-10.md
index b401b20c7c..4b98af6d48 100644
--- a/mdop/mbam-v1/high-level-architecture-for-mbam-10.md
+++ b/mdop/mbam-v1/high-level-architecture-for-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: High Level Architecture for MBAM 1.0
 description: High Level Architecture for MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: b1349196-88ed-4d6c-8a1d-998f18127b6b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -26,7 +29,7 @@ The following diagram displays the MBAM architecture. The single-server MBAM dep
 **Note**  
 At least a three-computer MBAM deployment topology is recommended for a production deployment. For more information about MBAM deployment topologies, see [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md).
 
- 
+ 
 
 ![mbam single server deployment topology](images/mbam-1-server.jpg)
 
@@ -55,9 +58,9 @@ At least a three-computer MBAM deployment topology is recommended for a producti
 
 [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md b/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md
index c05f830a9d..aa02943b12 100644
--- a/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md
+++ b/mdop/mbam-v1/how-to-configure-network-load-balancing-for-mbam.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Network Load Balancing for MBAM
 description: How to Configure Network Load Balancing for MBAM
-author: jamiejdt
+author: dansimp
 ms.assetid: df2208c3-352b-4a48-9722-237b0c8cd6a5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -21,7 +24,7 @@ To obtain the setup log files, you must install Microsoft BitLocker Administrati
 
 Additional setup log files are created in the %temp% folder of the user who installs MBAM.
 
- 
+ 
 
 The Network Load Balancing (NLB) clusters for the Administration and Monitoring Server feature provides scalability in MBAM and it should support more than 55,000 MBAM client computers.
 
@@ -38,7 +41,7 @@ All computers that will be part of a NLB cluster have the following requirements
 
 -   The NLB cluster requires a static IP address, and a host record must be manually created in the domain name system (DNS).
 
- 
+ 
 
 ## Configuring Network Load Balancing for MBAM Administration and Monitoring Servers
 
@@ -50,7 +53,7 @@ Before you begin the procedures described in this topic, you must have the MBAM
 **Note**  
 This topic describes the basic process of using Network Load Balancing Manager to create an NLB Cluster. The exact steps to configure a Windows Server as part of an NLB cluster depend on the Windows Server version in use.. For more information about how to create NLBs on Windows Server 2008, see [Creating Network Load Balancing Clusters](https://go.microsoft.com/fwlink/?LinkId=197176) in the Windows Server 2008 TechNet library.
 
- 
+ 
 
 **To configure an NLB Cluster Virtual Name and IP address for two MBAM Administration and Monitoring Servers**
 
@@ -59,7 +62,7 @@ This topic describes the basic process of using Network Load Balancing Manager t
     **Note**  
     If the NLB Manager is not present, you can install it as a Windows Server feature. You must install this feature on both MBAM Administration and Monitoring servers if you want to configure it into the NLB cluster.
 
-     
+     
 
 2.  On the menu bar, click **Cluster**, and then click **New** to open the **Cluster Parameters** dialog box.
 
@@ -80,7 +83,7 @@ This topic describes the basic process of using Network Load Balancing Manager t
     **Note**  
     Ensure that **Affinity** is set to **Single**.
 
-     
+     
 
 7.  On the **Connect** page, enter an MBAM Administration and Monitoring server instance host name that will be part of the NLB cluster in **Host**, and then click **Connect**.
 
@@ -91,7 +94,7 @@ This topic describes the basic process of using Network Load Balancing Manager t
     **Note**  
     The **Host Parameters** page also displays the NLB cluster host priority, which is 1 through 32. As new hosts are added to the NLB cluster, the host priority must differ from the previously added hosts. The priority is automatically incremented when you use the Network Load Balancing Manager.
 
-     
+     
 
 10. Click **<NLB cluster name>** and ensure that the NLB host interface **Status** displays **Converged** before you continue. This step might require that you refresh the NLB cluster display as the host TCP/IP configuration that is being modified by the NLB Manager.
 
@@ -106,9 +109,9 @@ This topic describes the basic process of using Network Load Balancing Manager t
 
 [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md b/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md
index eea98e59a1..0653f76736 100644
--- a/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md
+++ b/mdop/mbam-v1/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy the MBAM Client as Part of a Windows Deployment
 description: How to Deploy the MBAM Client as Part of a Windows Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 8704bf33-535d-41da-b9b2-45b60754367e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,17 +19,17 @@ ms.date: 06/16/2016
 
 The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker Client can be integrated into an organization by enabling BitLocker management and encryption on client computers during the computer imaging and Windows deployment process.
 
-**Note**  
+**Note**  
 To review the MBAM Client system requirements, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md).
 
- 
+
 
 Encryption of client computers with BitLocker during the initial imaging stage of a Windows deployment can lower the administrative overhead for MBAM implementation. This approach also ensures that every computer that is deployed already has BitLocker running and is configured correctly.
 
-**Warning**  
+**Warning**  
 This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk.
 
- 
+
 
 **To encrypt a computer as part of Windows deployment**
 
@@ -80,24 +83,26 @@ This topic describes how to change the Windows registry by using Registry Editor
 
     Example: http://<computer name>/MBAMRecoveryAndHardwareService/CoreService.svc.
 
-     
 
-    **Note**  
-    MBAM policy or registry values can be set here to override the previously set values.
 
-     
+~~~
+**Note**  
+MBAM policy or registry values can be set here to override the previously set values.
+~~~
 
-7.  The MBAM agent restarts the system during MBAM client deployment. When you are ready for this reboot, run the following command at a command prompt as an administrator:
 
-    **net start mbamagent**
 
-8.  When the computers restarts and the BIOS prompts you to accept a TPM change, accept the change.
+7. The MBAM agent restarts the system during MBAM client deployment. When you are ready for this reboot, run the following command at a command prompt as an administrator:
 
-9.  During the Windows client operating system imaging process, when you are ready to start encryption, restart the MBAM agent service. Then, to set start to **automatic**, open a command prompt as an administrator and run the following commands:
+   **net start mbamagent**
 
-    **sc config mbamagent start= auto**
+8. When the computers restarts and the BIOS prompts you to accept a TPM change, accept the change.
 
-    **net start mbamagent**
+9. During the Windows client operating system imaging process, when you are ready to start encryption, restart the MBAM agent service. Then, to set start to **automatic**, open a command prompt as an administrator and run the following commands:
+
+   **sc config mbamagent start= auto**
+
+   **net start mbamagent**
 
 10. Remove the bypass registry values. To do this, run regedit, browse to the HKLM\\SOFTWARE\\Microsoft registry entry, right-click the **MBAM** node, and then click **Delete**.
 
@@ -106,9 +111,9 @@ This topic describes how to change the Windows registry by using Registry Editor
 
 [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md b/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md
index bab36d4a01..be6480250c 100644
--- a/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md
+++ b/mdop/mbam-v1/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy the MBAM Client to Desktop or Laptop Computers
 description: How to Deploy the MBAM Client to Desktop or Laptop Computers
-author: jamiejdt
+author: dansimp
 ms.assetid: f32927a2-4c05-4da8-acca-1108d1dfdb7e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables admi
 **Note**  
 To review the MBAM Client system requirements, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md).
 
- 
+ 
 
 **To deploy the MBAM Client to desktop or laptop computers**
 
@@ -30,23 +33,23 @@ To review the MBAM Client system requirements, see [MBAM 1.0 Supported Configura
     **Note**  
     You should not use Group Policy to deploy the Windows Installer package.
 
-     
+     
 
 3.  Configure the distribution settings or Group Policy to run the MBAM Client installation file. After successful installation, the MBAM Client applies the Group Policy settings that are received from a domain controller to begin BitLocker encryption and management functions. For more information about MBAM Group Policy settings, see [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md).
 
     **Important**  
     The MBAM Client will not start BitLocker encryption actions if a remote desktop protocol connection is active. All remote console connections must be closed before BitLocker encryption will begin.
 
-     
+     
 
 ## Related topics
 
 
 [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md b/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md
index 0dca407a39..218739fbbf 100644
--- a/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md
+++ b/mdop/mbam-v1/how-to-determine-the-bitlocker-encryption-state-of-a-lost-computers-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Determine the BitLocker Encryption State of a Lost Computers
 description: How to Determine the BitLocker Encryption State of a Lost Computers
-author: jamiejdt
+author: dansimp
 ms.assetid: 9440890a-9c63-463b-9113-f46071446388
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,7 +26,7 @@ Microsoft BitLocker Administration and Monitoring (MBAM) enables you to determin
     **Note**  
     The default address for the MBAM website is http://*<computername>*. Use the fully qualified server name for faster browsing results.
 
-     
+     
 
 2.  Select the **Report** node from the navigation pane, and then select the **Computer Compliance Report**.
 
@@ -34,16 +37,16 @@ Microsoft BitLocker Administration and Monitoring (MBAM) enables you to determin
     **Note**  
     Device compliance is determined by the deployed BitLocker policies. You should verify these deployed policies when you are trying to determine the BitLocker encryption state of a device.
 
-     
+     
 
 ## Related topics
 
 
 [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md b/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md
index 521cf77e97..96e8628560 100644
--- a/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md
+++ b/mdop/mbam-v1/how-to-edit-mbam-10-gpo-settings.md
@@ -1,12 +1,15 @@
 ---
 title: How to Edit MBAM 1.0 GPO Settings
 description: How to Edit MBAM 1.0 GPO Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: 03d12fbc-4302-43fc-9b38-440607d778a1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -64,21 +67,23 @@ The following steps describe how to configure the basic, recommended Group Polic
 
     Set **Choose how BitLocker-protected drives can be recovered** and **Allow data recovery agent**.
 
-     
 
-    **Important**  
-    Depending on the policies that your organization decides to deploy, you may have to configure additional policies. See [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md) for Group Policy configuration details for all of the available MBAM GPO policy options.
 
-     
+~~~
+**Important**  
+Depending on the policies that your organization decides to deploy, you may have to configure additional policies. See [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md) for Group Policy configuration details for all of the available MBAM GPO policy options.
+~~~
+
+
 
 ## Related topics
 
 
 [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md b/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md
index 19eacd4dfd..19ff56c01c 100644
--- a/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md
+++ b/mdop/mbam-v1/how-to-generate-mbam-reports-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Generate MBAM Reports
 description: How to Generate MBAM Reports
-author: jamiejdt
+author: dansimp
 ms.assetid: cdf4ae76-040c-447c-8736-c9e57068d221
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Microsoft BitLocker Administration and Monitoring (MBAM) generates various repor
 **Note**  
 To run the reports, you must be a member of the **Report Users** role on the computers where you have installed the Administration and Monitoring Server features, Compliance and Audit Database, and Compliance and Audit Reports.
 
- 
+ 
 
 **To open the MBAM Administration website**
 
@@ -28,14 +31,14 @@ To run the reports, you must be a member of the **Report Users** role on the com
     **Note**  
     If the MBAM administration website was installed on a port other than port 80, you must specify that port number in the URL. For example, *http://<computername>:<port>*. If you specified a Host Name for the MBAM administration website during the installation, the URL would be *http://<hostname>*.
 
-     
+     
 
 2.  In the navigation pane, click **Reports**. In the main pane, click the tab for your report type: **Enterprise Compliance Report**, **Computer Compliance Report**, **Hardware Audit Report**, or **Recovery Audit Report**.
 
     **Note**  
     Historical MBAM Client data is retained in the compliance database. This retained data may be needed in case a computer is lost or stolen. When running enterprise reports, you should use appropriate start and end dates to scope the time frames for the reports from one to two weeks to increase the reporting data accuracy.
 
-     
+     
 
 **To generate an enterprise Compliance Report**
 
@@ -52,7 +55,7 @@ To run the reports, you must be a member of the **Report Users** role on the com
     **Note**  
     The Enterprise Compliance report is generated by a SQL job that runs every six hours. Therefore, the first time you try to view the report you may find that some data is missing.
 
-     
+     
 
 3.  To view information about a computer in the Computer Compliance Report, select the computer name.
 
@@ -73,7 +76,7 @@ To run the reports, you must be a member of the **Report Users** role on the com
     **Note**  
     An MBAM Client computer is considered compliant if the computer matches the requirements of the MBAM policy settings or the computer’s hardware model is set to incompatible. Therefore, when you are viewing detailed information about the disk volumes associated with the computer, computers that are exempt from BitLocker encryption due to hardware compatibility can be displayed as compliant even though their drive volume encryption status is displayed as noncompliant.
 
-     
+     
 
 **To generate the Hardware Compatibility Audit Report**
 
@@ -116,9 +119,9 @@ To run the reports, you must be a member of the **Report Users** role on the com
 
 [Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md b/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md
index f9df0a1669..4eab4444f5 100644
--- a/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md
+++ b/mdop/mbam-v1/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel.md
@@ -1,12 +1,15 @@
 ---
 title: How to Hide Default BitLocker Encryption in The Windows Control Panel
 description: How to Hide Default BitLocker Encryption in The Windows Control Panel
-author: jamiejdt
+author: dansimp
 ms.assetid: c8503743-220c-497c-9785-e2feeca484d6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md b/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md
index 599eb04686..b4654bbd91 100644
--- a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md
+++ b/mdop/mbam-v1/how-to-install-and-configure-mbam-on-a-single-server-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install and Configure MBAM on a Single Server
 description: How to Install and Configure MBAM on a Single Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 55841c63-bad9-44e7-b7fd-ea7037febbd7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,7 +26,7 @@ To obtain the setup log files, you must install MBAM by using the **msiexec** pa
 
 Additional setup log files are created in the %temp% folder of the user who is installing MBAM.
 
- 
+ 
 
 ## To install MBAM Server features on a single server
 
@@ -33,7 +36,7 @@ The following steps describe how to install general MBAM features.
 **Note**  
 Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers.
 
- 
+ 
 
 **To start MBAM Server features installation**
 
@@ -56,7 +59,7 @@ Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup o
     **Note**  
     The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you must resolve the missing prerequisites, and then click **Check prerequisites again**. After all prerequisites are met, the installation resumes.
 
-     
+     
 
 4.  You are prompted to configure the network communication security. MBAM can encrypt the communication between the Recovery and Hardware Database, the Administration and Monitoring Server, and the clients. If you decide to encrypt the communication, you are asked to select the authority-provisioned certificate that will be used for encryption.
 
@@ -83,7 +86,7 @@ Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup o
     **Warning**  
     The port number that you specify must be an unused port number on the Administration and Monitoring server, unless a unique host header name is specified.
 
-     
+     
 
 8.  Click **Next** to continue.
 
@@ -114,7 +117,7 @@ Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup o
 
     To maintain identical memberships on all computers, you should create a domain security group and add that domain group to each local MBAM Report Users group. When you do this, you can manage the group memberships by using the domain group.
 
-     
+     
 
 ## Validating the MBAM Server feature installation
 
@@ -123,57 +126,57 @@ When the MBAM installation is complete, validate that the installation has succe
 
 **To validate MBAM Server feature installation**
 
-1.  On each server where an MBAM feature is deployed, open **Control Panel**. Click **Programs**, and then click **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list.
+1. On each server where an MBAM feature is deployed, open **Control Panel**. Click **Programs**, and then click **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list.
 
-    **Note**  
-    To validate the installation, you must use a Domain Account that has local computer administrative credentials on each server.
+   **Note**  
+   To validate the installation, you must use a Domain Account that has local computer administrative credentials on each server.
 
-     
+     
 
-2.  On the server where the Recovery and Hardware Database is installed, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is installed.
+2. On the server where the Recovery and Hardware Database is installed, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is installed.
 
-3.  On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio and verify that the **MBAM Compliance and Audit Database** is installed.
+3. On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio and verify that the **MBAM Compliance and Audit Database** is installed.
 
-4.  On the server where the Compliance and Audit Reports are installed, open a web browser with administrative privileges and browse to the “Home” of the SQL Server Reporting Services site.
+4. On the server where the Compliance and Audit Reports are installed, open a web browser with administrative privileges and browse to the “Home” of the SQL Server Reporting Services site.
 
-    The default Home location of a SQL Server Reporting Services site instance is at http://*<NameofMBAMReportsServer>*/Reports. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances specified during setup.
+   The default Home location of a SQL Server Reporting Services site instance is at http://<NameofMBAMReportsServer>/Reports. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances specified during setup.
 
-    Confirm that a folder named **Malta Compliance Reports** is listed and that it contains five reports and one data source.
+   Confirm that a folder named **Malta Compliance Reports** is listed and that it contains five reports and one data source.
 
-    **Note**  
-    If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>*
+   **Note**  
+   If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>*
 
-     
+     
 
-5.  On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**, select **Web Server (IIS)**, and click **Internet Information Services (IIS) Manager**
+5. On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**, select **Web Server (IIS)**, and click **Internet Information Services (IIS) Manager**
 
-6.  In **Connections**, browse to *<computername>*, select **Sites**, and select **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed.
+6. In **Connections**, browse to *<computername>*, select **Sites**, and select **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed.
 
-7.  On the server where the Administration and Monitoring feature is installed, open a web browser with administrative privileges, and then browse to the following locations in the MBAM website to verify that they load successfully:
+7. On the server where the Administration and Monitoring feature is installed, open a web browser with administrative privileges, and then browse to the following locations in the MBAM website to verify that they load successfully:
 
-    -   *http://<computername>/default.aspx* and confirm each of the links for navigation and reports
+   -   *http://<computername>/default.aspx* and confirm each of the links for navigation and reports
 
-    -   *http://<computername>/MBAMAdministrationService/AdministrationService.svc*
+   -   *http://<computername>/MBAMAdministrationService/AdministrationService.svc*
 
-    -   *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc*
+   -   *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc*
 
-    -   *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc*
+   -   *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc*
 
-    **Note**  
-    Typically, the services are installed on the default port 80 without network encryption. If the services are installed on a different port, change the URLs to include the appropriate port. For example, http://*<computername>:<port>*/default.aspx or http://*<hostheadername>/*default.aspx.
+   **Note**  
+   Typically, the services are installed on the default port 80 without network encryption. If the services are installed on a different port, change the URLs to include the appropriate port. For example, http://*<computername>:<port>*/default.aspx or http://<hostheadername>/default.aspx.
 
-    If the services are installed with network encryption, change http:// to https://.
+   If the services are installed with network encryption, change http:// to https://.
 
-     
+     
 
 ## Related topics
 
 
 [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md b/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md
index 385beb0d78..5801740a1e 100644
--- a/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md
+++ b/mdop/mbam-v1/how-to-install-and-configure-mbam-on-distributed-servers-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install and Configure MBAM on Distributed Servers
 description: How to Install and Configure MBAM on Distributed Servers
-author: jamiejdt
+author: dansimp
 ms.assetid: 9ee766aa-6339-422a-8d00-4f58e4646a5e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -18,22 +21,22 @@ The procedures in this topic describe the full installation of the Microsoft Bit
 
 Each server feature has certain prerequisites. To verify that you have met the prerequisites and hardware and software requirements, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) and [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md). In addition, some features require that you provide certain information during the installation process to successfully deploy the feature.
 
-**Note**  
+**Note**  
 To obtain the setup log files, you have to install MBAM by using the **msiexec** package and the **/l <location>** option. Log files are created in the location that you specify.
 
 Additional setup log files are created in the %temp% folder of the user that runs the MBAM installation.
 
- 
+
 
 ## Deploy the MBAM Server features
 
 
 The following steps describe how to install the general MBAM features.
 
-**Note**  
+**Note**  
 Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers.
 
- 
+
 
 **To Deploy MBAM Server features**
 
@@ -53,107 +56,109 @@ Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup o
 
     -   MBAM Group Policy Template
 
-    **Note**  
+    **Note**  
     The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation will resume.
 
-     
+
 
 4.  The MBAM Setup wizard will display the installation pages for the selected features. The following sections describe the installation procedures for each feature.
 
-    **Note**  
+    **Note**  
     Typically, each feature is installed on a separate server. If you want to install multiple features on a single server, you may change or eliminate some of the following steps.
 
-     
 
-    **To install the Recovery and Hardware Database**
 
-    1.  Choose an option for MBAM communication encryption. MBAM can encrypt the communication between the Recovery and Hardware Database and the Administration and Monitoring servers. If you choose the option to encrypt communication, you are asked to select the authority-provisioned certificate that is used for encryption.
+~~~
+**To install the Recovery and Hardware Database**
 
-    2.  Click **Next** to continue.
+1.  Choose an option for MBAM communication encryption. MBAM can encrypt the communication between the Recovery and Hardware Database and the Administration and Monitoring servers. If you choose the option to encrypt communication, you are asked to select the authority-provisioned certificate that is used for encryption.
 
-    3.  Specify the names of the computers that will be running the Administration and Monitoring Server feature, to configure access to the Recovery and Hardware Database.. Once the Administration and Monitoring Server feature is deployed, it connects to the database by using its domain account.
+2.  Click **Next** to continue.
 
-    4.  Click **Next** to continue.
+3.  Specify the names of the computers that will be running the Administration and Monitoring Server feature, to configure access to the Recovery and Hardware Database.. Once the Administration and Monitoring Server feature is deployed, it connects to the database by using its domain account.
 
-    5.  Specify the **Database Configuration** for the SQL Server instance that stores the recovery and hardware data. You must also specify where the database will be located and where the log information will be located.
+4.  Click **Next** to continue.
 
-    6.  Click **Next** to continue with the MBAM Setup wizard.
+5.  Specify the **Database Configuration** for the SQL Server instance that stores the recovery and hardware data. You must also specify where the database will be located and where the log information will be located.
 
-    **To install the Compliance and Audit Database**
+6.  Click **Next** to continue with the MBAM Setup wizard.
 
-    1.  Choose an option for the MBAM communication encryption. MBAM can encrypt the communication between the Compliance and Audit Database and the Administration and Monitoring servers. If you choose the option to encrypt communication, you are asked to select the authority-provisioned certificate that will be used for encryption.
+**To install the Compliance and Audit Database**
 
-    2.  Click **Next** to continue.
+1.  Choose an option for the MBAM communication encryption. MBAM can encrypt the communication between the Compliance and Audit Database and the Administration and Monitoring servers. If you choose the option to encrypt communication, you are asked to select the authority-provisioned certificate that will be used for encryption.
 
-    3.  Specify the user account that will be used to access the database for reports.
+2.  Click **Next** to continue.
 
-    4.  Click **Next** to continue.
+3.  Specify the user account that will be used to access the database for reports.
 
-    5.  Specify the computer names of the computers that you want to run the Administration and Monitoring Server and the Compliance and Audit Reports, to configure the access to the Compliance and Audit Database.. After the Administration and Monitoring and the Compliance and Audit Reports Server are deployed, they will connect to the databases by using their domain accounts.
+4.  Click **Next** to continue.
 
-    6.  Specify the **Database Configuration** for the SQL Server instance that will store the compliance and audit data. You must also specify where the database will be located and where the log information will be located.
+5.  Specify the computer names of the computers that you want to run the Administration and Monitoring Server and the Compliance and Audit Reports, to configure the access to the Compliance and Audit Database.. After the Administration and Monitoring and the Compliance and Audit Reports Server are deployed, they will connect to the databases by using their domain accounts.
 
-    7.  Click **Next** to continue with the MBAM Setup wizard.
+6.  Specify the **Database Configuration** for the SQL Server instance that will store the compliance and audit data. You must also specify where the database will be located and where the log information will be located.
 
-    **To install the Compliance and Audit Reports**
+7.  Click **Next** to continue with the MBAM Setup wizard.
 
-    1.  Specify the remote SQL Server instance. For example, *<ServerName>*,where the Compliance and Audit Database are installed.
+**To install the Compliance and Audit Reports**
 
-    2.  Specify the name of the Compliance and Audit Database. By default, the database name is “MBAM Compliance Status”, but you can change the name when you install the Compliance and Audit Database.
+1.  Specify the remote SQL Server instance. For example, *<ServerName>*,where the Compliance and Audit Database are installed.
 
-    3.  Click **Next** to continue.
+2.  Specify the name of the Compliance and Audit Database. By default, the database name is “MBAM Compliance Status”, but you can change the name when you install the Compliance and Audit Database.
 
-    4.  Select the SQL Server Reporting Services instance where the Compliance and Audit Reports will be installed. Provide the username and password used to access the compliance database.
+3.  Click **Next** to continue.
 
-    5.  Click **Next** to continue with the MBAM Setup wizard.
+4.  Select the SQL Server Reporting Services instance where the Compliance and Audit Reports will be installed. Provide the username and password used to access the compliance database.
 
-    **To install the Administration and Monitoring Server feature**
+5.  Click **Next** to continue with the MBAM Setup wizard.
 
-    1.  Choose an option for the MBAM communication encryption. MBAM can encrypt the communication between the Recovery and Hardware Database and the Administration and Monitoring servers. If you choose the option to encrypt communication, you are asked to select the authority-provisioned certificate that is used for encryption.
+**To install the Administration and Monitoring Server feature**
 
-    2.  Click **Next** to continue.
+1.  Choose an option for the MBAM communication encryption. MBAM can encrypt the communication between the Recovery and Hardware Database and the Administration and Monitoring servers. If you choose the option to encrypt communication, you are asked to select the authority-provisioned certificate that is used for encryption.
 
-    3.  Specify the remote SQL Server instance, For example, *<ServerName>*, where the Compliance and Audit Database are installed.
+2.  Click **Next** to continue.
 
-    4.  Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status, but, you can change the name when you install the Compliance and Audit Database.
+3.  Specify the remote SQL Server instance, For example, *<ServerName>*, where the Compliance and Audit Database are installed.
 
-    5.  Click **Next** to continue.
+4.  Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status, but, you can change the name when you install the Compliance and Audit Database.
 
-    6.  Specify the remote SQL Server instance. For example, *<ServerName>*,where the Recovery and Hardware Database are installed.
+5.  Click **Next** to continue.
 
-    7.  Specify the name of the Recovery and Hardware Database. By default, the database name is **MBAM Recovery and Hardware**, but you can change the name when you install the Recovery and Hardware Database feature.
+6.  Specify the remote SQL Server instance. For example, *<ServerName>*,where the Recovery and Hardware Database are installed.
 
-    8.  Click **Next** to continue.
+7.  Specify the name of the Recovery and Hardware Database. By default, the database name is **MBAM Recovery and Hardware**, but you can change the name when you install the Recovery and Hardware Database feature.
 
-    9.  Specify the URL for the “Home” of the SQL Server Reporting Services (SRS) site. The default Home location of a SQL Server Reporting Services site instance is at:
+8.  Click **Next** to continue.
 
-        http://*<NameofMBAMReportsServer>/*ReportServer
+9.  Specify the URL for the “Home” of the SQL Server Reporting Services (SRS) site. The default Home location of a SQL Server Reporting Services site instance is at:
 
-        **Note**  
-        If you configured the SQL Server Reporting Services as a named instance, the URL resembles the following:http://*<NameofMBAMReportsServer>*/ReportServer\_*<SRSInstanceName>*
+    http://*<NameofMBAMReportsServer>/*ReportServer
 
-         
+    **Note**  
+    If you configured the SQL Server Reporting Services as a named instance, the URL resembles the following:http://*<NameofMBAMReportsServer>*/ReportServer\_*<SRSInstanceName>*
 
-    10. Click **Next** to continue.
 
-    11. Enter the **Port Number**, the **Host Name** (optional), and the **Installation Path** for the MBAM Administration and Monitoring server
 
-        **Warning**  
-        The port number that you specify must be an unused port number on the Administration and Monitoring server, unless you specify a unique host header name.
+10. Click **Next** to continue.
 
-         
+11. Enter the **Port Number**, the **Host Name** (optional), and the **Installation Path** for the MBAM Administration and Monitoring server
 
-    12. Click **Next** to continue with the MBAM Setup wizard.
+    **Warning**  
+    The port number that you specify must be an unused port number on the Administration and Monitoring server, unless you specify a unique host header name.
 
-5.  
 
-    Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**.
 
-6.  When the selected MBAM feature information is complete, you are ready to start the MBAM installation by using the Setup wizard. Click **Back** to move through the wizard if you have to review or change your installation settings. Click **Install** to begin the installation. Click **Cancel** to exit the Wizard. Setup installs the MBAM features that you selected and notifies you that the installation is finished.
+12. Click **Next** to continue with the MBAM Setup wizard.
+~~~
 
-7.  Click **Finish** to exit the wizard.
+5. 
 
-8.  Add users to appropriate MBAM roles, after the MBAM server features are installed.. For more information, see [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md).
+   Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**.
+
+6. When the selected MBAM feature information is complete, you are ready to start the MBAM installation by using the Setup wizard. Click **Back** to move through the wizard if you have to review or change your installation settings. Click **Install** to begin the installation. Click **Cancel** to exit the Wizard. Setup installs the MBAM features that you selected and notifies you that the installation is finished.
+
+7. Click **Finish** to exit the wizard.
+
+8. Add users to appropriate MBAM roles, after the MBAM server features are installed.. For more information, see [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md).
 
 **Post-installation configuration**
 
@@ -169,10 +174,10 @@ Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup o
 
     -   **MBAM Report Users**: Members of this local group can access the Reports in the MBAM administration website.
 
-    **Note**  
+    **Note**  
     Identical user or group membership of the **MBAM Report Users** local group must be maintained on all computers where the MBAM Administration and Monitoring Server features, Compliance and Audit Database, and the Compliance and Audit Reports are installed.
 
-     
+
 
 ## Validate the MBAM Server feature installation
 
@@ -181,57 +186,59 @@ When the MBAM Server feature installation is complete, you should validate that
 
 **To validate an MBAM installation**
 
-1.  On each server, where an MBAM feature is deployed, open **Control Panel**, click **Programs**, and then click **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list.
+1. On each server, where an MBAM feature is deployed, open **Control Panel**, click **Programs**, and then click **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list.
 
-    **Note**  
-    To validate the MBAM installation, you must use a Domain Account that has local computer administrative credentials on each server.
+   **Note**  
+   To validate the MBAM installation, you must use a Domain Account that has local computer administrative credentials on each server.
 
-     
 
-2.  On the server where the Recovery and Hardware Database is installed, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is installed.
 
-3.  On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio and verify that the **MBAM Compliance Status** database is installed.
+2. On the server where the Recovery and Hardware Database is installed, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is installed.
 
-4.  On the server where the Compliance and Audit Reports are installed, open a web browser with administrative privileges and browse to the “Home” of the SQL Server Reporting Services site.
+3. On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio and verify that the **MBAM Compliance Status** database is installed.
 
-    The default Home location of a SQL Server Reporting Services site instance can be found at http://*<NameofMBAMReportsServer>*/Reports.aspx. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances specified during setup.
+4. On the server where the Compliance and Audit Reports are installed, open a web browser with administrative privileges and browse to the “Home” of the SQL Server Reporting Services site.
 
-    Confirm that a folder named **Malta Compliance Reports** is listed and that it contains five reports and one data source.
+   The default Home location of a SQL Server Reporting Services site instance can be found at http://<NameofMBAMReportsServer>/Reports.aspx. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances specified during setup.
 
-    **Note**  
-    If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>*
+   Confirm that a folder named **Malta Compliance Reports** is listed and that it contains five reports and one data source.
 
-     
+   **Note**  
+   If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>*
 
-5.  On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**, select **Web Server (IIS)**, and then click **Internet Information Services (IIS) Manager**. In **Connections** browse to *<computername>*, click **Sites**, and click **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed.
 
-6.  On the server where the Administration and Monitoring feature is installed, open a web browser with administrative privileges and browse to the following locations in the MBAM web site, to verify that they load successfully:
 
-    -   *http://<computername>/default.aspx* and confirm each of the links for navigation and reports
+5. On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**, select **Web Server (IIS)**, and then click **Internet Information Services (IIS) Manager**. In **Connections** browse to *<computername>*, click **Sites**, and click **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed.
 
-    -   *http://<computername>/MBAMAdministrationService/AdministrationService.svc*
+6. On the server where the Administration and Monitoring feature is installed, open a web browser with administrative privileges and browse to the following locations in the MBAM web site, to verify that they load successfully:
 
-    -   *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc*
+   -   *http://<computername>/default.aspx* and confirm each of the links for navigation and reports
 
-    -   *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc*
+   -   *http://<computername>/MBAMAdministrationService/AdministrationService.svc*
 
-    **Note**  
-    Typically, services are installed on the default port 80 without network encryption. If the services are installed on a different port, change the URLs to include the appropriate port. For example, http://*<computername>:<port>*/default.aspx or http://*<hostheadername>/*default.aspx
+   -   *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc*
 
-    If the services were installed with network encryption, change http:// to https://.
+   -   *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc*
 
-     
+   **Note**  
+   Typically, services are installed on the default port 80 without network encryption. If the services are installed on a different port, change the URLs to include the appropriate port. For example, http://*<computername>:<port>*/default.aspx or http://<hostheadername>/default.aspx
 
-    Verify that each web page loads successfully.
+   If the services were installed with network encryption, change http:// to https://.
+
+
+
+~~~
+Verify that each web page loads successfully.
+~~~
 
 ## Related topics
 
 
 [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md b/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md
index 98b6f192c9..47f9d4d6f4 100644
--- a/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md
+++ b/mdop/mbam-v1/how-to-install-the-mbam-10-group-policy-template.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the MBAM 1.0 Group Policy Template
 description: How to Install the MBAM 1.0 Group Policy Template
-author: jamiejdt
+author: dansimp
 ms.assetid: 451a50b0-939c-47ad-9248-a138deade550
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ The following steps describe how to install the MBAM Group Policy template.
 **Note**  
 Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers.
 
- 
+ 
 
 **To install the MBAM Group Policy template**
 
@@ -34,7 +37,7 @@ Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup o
     **Note**  
     The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you must resolve the missing prerequisite and then click **Check prerequisites again**. Once all prerequisites are met, the installation will resume.
 
-     
+     
 
 4.  After the MBAM Setup wizard displays installation pages for the selected features, click **Finish** to close MBAM Setup.
 
@@ -43,9 +46,9 @@ Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup o
 
 [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md b/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md
index 01a65fde95..ae463cffe6 100644
--- a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md
+++ b/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-a-single-server-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the MBAM Language Update on a Single Server
 description: How to Install the MBAM Language Update on a Single Server
-author: jamiejdt
+author: dansimp
 ms.assetid: e6fe59a3-a3e1-455c-a059-1f23ee083cf6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -33,7 +36,7 @@ Microsoft BitLocker Administration and Monitoring (MBAM) includes four server ro
     **Important**  
     The MBAM server features must be updated in the following order: Compliance and Audit Reports first, then Administration and Monitoring Server. The Group Policy templates can be updated at any time without concern for sequence.
 
-     
+     
 
 4.  After you upgrade the server database, open the IIS Management Console and review the bindings of the Microsoft BitLocker Administration and Monitoring website.
 
@@ -50,16 +53,16 @@ Microsoft BitLocker Administration and Monitoring (MBAM) includes four server ro
         **Note**  
         The MBAM client opens only if it can communicate with the Recovery and Hardware database.
 
-         
+         
 
 ## Related topics
 
 
 [Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md b/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md
index e83d09c2d4..8a88aa7e8a 100644
--- a/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md
+++ b/mdop/mbam-v1/how-to-install-the-mbam-language-update-on-distributed-servers-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the MBAM Language Update on Distributed Servers
 description: How to Install the MBAM Language Update on Distributed Servers
-author: jamiejdt
+author: dansimp
 ms.assetid: 5ddc64c6-0417-4a04-843e-b5e18d9f1a52
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,7 +26,7 @@ Microsoft BitLocker Administration and Monitoring (MBAM) includes four server ro
 **Important**  
 The MBAM server features must be updated in this order: Compliance and Audit Reports first, and then the Administration and Monitoring Server. The MBAM Group Policy templates can be updated at any time without concern for sequence.
 
- 
+ 
 
 **To install the MBAM Language Update on the MBAM Compliance and Audit Report Server feature**
 
@@ -54,16 +57,16 @@ The MBAM server features must be updated in this order: Compliance and Audit Rep
         **Note**  
         The MBAM client opens only if it can communicate with the Recovery and Hardware database.
 
-         
+         
 
 ## Related topics
 
 
 [Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md b/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md
index be84e0ac31..15689e60c3 100644
--- a/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md
+++ b/mdop/mbam-v1/how-to-manage-computer-bitlocker-encryption-exemptions.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Computer BitLocker Encryption Exemptions
 description: How to Manage Computer BitLocker Encryption Exemptions
-author: jamiejdt
+author: dansimp
 ms.assetid: d4400a0d-b36b-4cf5-a294-1f53ec47f9ee
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ To exempt a computer from BitLocker encryption, you must add the computer to a s
 **Note**  
 If the computer is already BitLocker-protected, the computer exemption policy has no effect.
 
- 
+ 
 
 **To exempt a computer from BitLocker encryption**
 
@@ -36,9 +39,9 @@ If the computer is already BitLocker-protected, the computer exemption policy ha
 
 [Administering MBAM 1.0 Features](administering-mbam-10-features.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md b/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md
index fcde03ee6b..0072ad71f7 100644
--- a/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md
+++ b/mdop/mbam-v1/how-to-manage-hardware-compatibility-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Hardware Compatibility
 description: How to Manage Hardware Compatibility
-author: jamiejdt
+author: dansimp
 ms.assetid: c74b96b9-8161-49bc-b5bb-4838734e7df5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ The Hardware Compatibility feature is helpful when your organization has older c
 **Note**  
 By default, MBAM Hardware Compatibility feature is not enabled. To enable it, select the **Hardware Compatibility** feature under the **Administration and Monitoring Server** feature during setup. For more information about how to set up and configure Hardware Compatibility, see [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md).
 
- 
+ 
 
 The Hardware Compatibility feature works in the following way.
 
@@ -44,7 +47,7 @@ The Hardware Compatibility feature works in the following way.
 **Warning**  
 If the MBAM client agent tries to encrypt a computer that does not support BitLocker drive encryption, there is a possibility that the computer will become corrupted. Ensure that the hardware compatibility feature is correctly configured when your organization has older hardware that does not support BitLocker.
 
- 
+ 
 
 **To manage hardware compatibility**
 
@@ -59,7 +62,7 @@ If the MBAM client agent tries to encrypt a computer that does not support BitLo
     **Note**  
     After you set a computer model as compatible, it can take more than twenty-four hours for the MBAM Client to begin BitLocker encryption on the computers matching that hardware model.
 
-     
+     
 
 5.  Administrators should regularly monitor the hardware compatibility list to review new models that are discovered by the MBAM agent, and then update their compatibility setting to **Compatible** or **Incompatible** as appropriate.
 
@@ -68,9 +71,9 @@ If the MBAM client agent tries to encrypt a computer that does not support BitLo
 
 [Administering MBAM 1.0 Features](administering-mbam-10-features.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md b/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md
index 16b72a3627..748fa21f52 100644
--- a/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md
+++ b/mdop/mbam-v1/how-to-manage-mbam-administrator-roles-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage MBAM Administrator Roles
 description: How to Manage MBAM Administrator Roles
-author: jamiejdt
+author: dansimp
 ms.assetid: c0f25a42-dbff-418d-a776-4fe23ee07d16
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md b/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md
index bda989c8f2..0812e74168 100644
--- a/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md
+++ b/mdop/mbam-v1/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel
 description: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel
-author: jamiejdt
+author: dansimp
 ms.assetid: c08077e1-5529-468f-9370-c3b33fc258f3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ A Microsoft BitLocker Administration and Monitoring (MBAM) control panel applica
 **Note**  
 For the BitLocker client, the Admin and Operational log files are located in Event Viewer, under **Application and Services Logs** / **Microsoft** / **Windows** / **BitLockerManagement**.
 
- 
+ 
 
 **To use the MBAM Client Control Panel**
 
@@ -38,9 +41,9 @@ For the BitLocker client, the Admin and Operational log files are located in Eve
 
 [Administering MBAM 1.0 Features](administering-mbam-10-features.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md b/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md
index 391c3bd185..9dee32aef0 100644
--- a/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md
+++ b/mdop/mbam-v1/how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage User BitLocker Encryption Exemptions
 description: How to Manage User BitLocker Encryption Exemptions
-author: jamiejdt
+author: dansimp
 ms.assetid: 48d69721-504f-4524-8a04-b9ce213ac9b4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ To exempt users from BitLocker protection, an organization must first create an
 **Note**  
 If the computer is already BitLocker-protected, the user exemption policy has no effect.
 
- 
+ 
 
 The following table shows how BitLocker protection is applied based on how exemptions are set.
 
@@ -52,7 +55,7 @@ The following table shows how BitLocker protection is applied based on how exemp
 
 
 
- 
+ 
 
 **To exempt a user from BitLocker Encryption**
 
@@ -65,7 +68,7 @@ The following table shows how BitLocker protection is applied based on how exemp
     **Note**  
     Shared computer scenarios require special consideration regarding user exemption. If a non-exempt user logs on to a computer shared with an exempt user, the computer may be encrypted.
 
-     
+     
 
 **To enable users to request exemption from BitLocker Encryption**
 
@@ -76,7 +79,7 @@ The following table shows how BitLocker protection is applied based on how exemp
     **Note**  
     Selecting **Request Exemption** will postpone the BitLocker protection until the maximum time set in the User Exemption Policy.
 
-     
+     
 
 3.  When a user selects **Request Exemption**, the user is notified to contact the organization's BitLocker administration group. Depending on how the Configure User Exemption Policy is configured, users are provided with one or more of the following contact methods:
 
@@ -91,16 +94,16 @@ The following table shows how BitLocker protection is applied based on how exemp
     **Note**  
     Once the postpone time limit from the User Exemption Policy has expired, users will not see the option to request exemption to the encryption policy. At this point, users must contact the MBAM administrator directly in order to receive exemption from BitLocker Protection.
 
-     
+     
 
 ## Related topics
 
 
 [Administering MBAM 1.0 Features](administering-mbam-10-features.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md b/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md
index 065f628183..c691779c7b 100644
--- a/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md
+++ b/mdop/mbam-v1/how-to-move-mbam-10-features-to-another-computer.md
@@ -1,12 +1,15 @@
 ---
 title: How to Move MBAM 1.0 Features to Another Computer
 description: How to Move MBAM 1.0 Features to Another Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: e1907d92-6b42-4ba3-b0e4-60a9cc8285cc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -55,10 +58,10 @@ You can use the following procedure to move the MBAM Recovery and Hardware Datab
 
     `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”`
 
-    **Note**  
+    **Note**  
     To run this PowerShell command prompt, you must add the IIS Module for PowerShell to the current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable the execution of scripts.
 
-     
+
 
 **To run MBAM setup on Server B**
 
@@ -68,14 +71,14 @@ You can use the following procedure to move the MBAM Recovery and Hardware Datab
 
     `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=KeyDatabase ADMINANDMON_MACHINENAMES=$DOMAIN$\$SERVERNAME$$ RECOVERYANDHWDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$`
 
-    **Note**  
+    **Note**  
     Replace the following values in the example above with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and instance to which the Recovery and Hardware database will be moved.
 
     -   $DOMAIN$\\$SERVERNAME$ - Enter the domain and server names of each MBAM Application and Monitoring Server that will contact the Recovery and Hardware database. If there are multiple domain and server names, use a semicolon to separate each one of them in the list. For example, $DOMAIN\\SERVERNAME$;$DOMAIN\\$SERVERNAME$$. Additionally, each server name must be followed by a **$**. For example, MyDomain\\MyServerName1$, MyDomain\\MyServerName2$.
 
-     
+
 
 **To back up the Database on Server A**
 
@@ -85,67 +88,73 @@ You can use the following procedure to move the MBAM Recovery and Hardware Datab
 
     Modify the MBAM Recovery and Hardware Database to use the full recovery mode.
 
-    `USE master;`
+    ```sql
+    USE master;
 
-    `GO`
+    GO
 
-    `ALTER DATABASE "MBAM Recovery and Hardware"`
+    ALTER DATABASE "MBAM Recovery and Hardware"
 
-    `   SET RECOVERY FULL;`
+       SET RECOVERY FULL;
 
-    `GO`
+    GO
+    ```
 
     Create MBAM Recovery and Hardware Database Data and MBAM Recovery logical backup devices.
 
-    `USE master`
+    ```sql
+    USE master
 
-    `GO`
+    GO
 
-    `EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device',`
+    EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device',
 
-    `'Z:\MBAM Recovery and Hardware Database Data.bak';`
+    'Z:\MBAM Recovery and Hardware Database Data.bak';
 
-    `GO`
+    GO
+    ```
 
     Back up the full MBAM Recovery and Hardware database.
 
-    `BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device];`
+    ```sql
+    BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device];
 
-    `GO`
+    GO
 
-    `BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate]`
+    BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate]
 
-    `TO FILE = 'Z:\SQLServerInstanceCertificateFile'`
+    TO FILE = 'Z:\SQLServerInstanceCertificateFile'
 
-    `WITH PRIVATE KEY`
+    WITH PRIVATE KEY
 
-    `(`
+    (
 
-    `    FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',`
+        FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',
 
-    `    ENCRYPTION BY PASSWORD = '$PASSWORD$'`
+        ENCRYPTION BY PASSWORD = '$PASSWORD$'
 
-    `);`
+    );
 
-    `GO`
+    GO
+    ```
 
-    **Note**  
+    **Note**  
     Replace the values from the preceding example with those that match your environment:
 
     -   $PASSWORD$ - Enter a password that you will use to encrypt the Private Key file.
 
-     
+
 
 3.  Execute the SQL file by using SQL Server PowerShell and a command that is similar to the following:
 
     `PS C:\> Invoke-Sqlcmd -InputFile 'Z:\BackupMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$`
 
-    **Note**  
+    **Note**  
     Replace the value in the previous example with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and the instance from which you back up the Recovery and Hardware database.
 
-     
+
 
 **To move the Database and Certificate from Server A to B**
 
@@ -159,14 +168,14 @@ You can use the following procedure to move the MBAM Recovery and Hardware Datab
 
     `PS C:\> Copy-Item “Z:\SQLServerInstanceCertificateFilePrivateKey” \\$SERVERNAME$\$DESTINATIONSHARE$`
 
-    **Note**  
+    **Note**  
     Replace the value from the preceding example with those that match your environment:
 
     -   $SERVERNAME$ - Enter the name of the server to which the files will be copied.
 
     -   $DESTINATIONSHARE$ - Enter the name of the share and path to which the files will be copied.
 
-     
+
 
 **To restore the Database on Server B**
 
@@ -178,61 +187,69 @@ You can use the following procedure to move the MBAM Recovery and Hardware Datab
 
 4.  To automate this procedure, create a SQL file (.sql) that contains the following SQL script:
 
-    `-- Restore MBAM Recovery and Hardware Database. `
+    ```sql
+    -- Restore MBAM Recovery and Hardware Database. 
 
-    `USE master`
+    USE master
 
-    `GO`
+    GO
+    ```
 
     Drop the certificate created by MBAM Setup.
 
-    `DROP CERTIFICATE [MBAM Recovery Encryption Certificate]`
+    ```sql
+    DROP CERTIFICATE [MBAM Recovery Encryption Certificate]
 
-    `GO`
+    GO
+    ```
 
     Add certificate
 
-    `CREATE CERTIFICATE [MBAM Recovery Encryption Certificate]`
+    ```sql
+    CREATE CERTIFICATE [MBAM Recovery Encryption Certificate]
 
-    `FROM FILE = 'Z: \SQLServerInstanceCertificateFile'`
+    FROM FILE = 'Z: \SQLServerInstanceCertificateFile'
 
-    `WITH PRIVATE KEY`
+    WITH PRIVATE KEY
 
-    `(`
+    (
 
-    `    FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',`
+        FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',
 
-    `    DECRYPTION BY PASSWORD = '$PASSWORD$'`
+        DECRYPTION BY PASSWORD = '$PASSWORD$'
 
-    `);`
+    );
 
-    `GO`
+    GO
+    ```
 
     Restore the MBAM Recovery and Hardware database data and the log files.
 
-    `RESTORE DATABASE [MBAM Recovery and Hardware]`
+    ```sql
+    RESTORE DATABASE [MBAM Recovery and Hardware]
 
-    `   FROM DISK = 'Z:\MBAM Recovery and Hardware Database Data.bak'`
+       FROM DISK = 'Z:\MBAM Recovery and Hardware Database Data.bak'
 
-    `   WITH REPLACE`
+       WITH REPLACE
+    ```
 
-    **Note**  
+    **Note**  
     Replace the values from the preceding example with those that match your environment:
 
     -   $PASSWORD$ - Enter the password that you used to encrypt the Private Key file.
 
-     
+
 
 5.  Use Windows PowerShell to enter a command line that is similar to the following:
 
     `PS C:\> Invoke-Sqlcmd -InputFile 'Z:\RestoreMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$`
 
-    **Note**  
+    **Note**  
     Replace the value from the receding example with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and the instance to which the Recovery and Hardware Database will be restored.
 
-     
+
 
 **Configure the access to the Database on Server B**
 
@@ -242,45 +259,47 @@ You can use the following procedure to move the MBAM Recovery and Hardware Datab
 
     `PS C:\> net localgroup "MBAM Recovery and Hardware DB Access" $DOMAIN$\$SERVERNAME$$  /add`
 
-    **Note**  
+    **Note**  
     Replace the values from the preceding example with the applicable values for your environment:
 
     -   $DOMAIN$\\$SERVERNAME$$ - Enter the domain name and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a **$**, for example, MyDomain\\MyServerName1$.
 
-     
 
-    You must run the command for each Administration and Monitoring Server that will be accessing the database in your environment.
+
+~~~
+You must run the command for each Administration and Monitoring Server that will be accessing the database in your environment.
+~~~
 
 **To update the Database Connection data on MBAM Administration and Monitoring Servers**
 
-1.  On each of the servers that run the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to update the Connection String information for the following applications, which are hosted in the Microsoft BitLocker Administration and Monitoring website:
+1. On each of the servers that run the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to update the Connection String information for the following applications, which are hosted in the Microsoft BitLocker Administration and Monitoring website:
 
-    -   MBAM Administration Service
+   -   MBAM Administration Service
 
-    -   MBAM Recovery And Hardware Service
+   -   MBAM Recovery And Hardware Service
 
-2.  Select each application and use the **Configuration Editor** feature, which is located under the **Management** section of the **Feature View**.
+2. Select each application and use the **Configuration Editor** feature, which is located under the **Management** section of the **Feature View**.
 
-3.  Select the **configurationStrings** option from the Section list control.
+3. Select the **configurationStrings** option from the Section list control.
 
-4.  Choose the row named **(Collection)**, and open the **Collection Editor** by selecting the button on the right side of the row.
+4. Choose the row named **(Collection)**, and open the **Collection Editor** by selecting the button on the right side of the row.
 
-5.  In the **Collection Editor**, choose the row named **KeyRecoveryConnectionString** when you updated the configuration for the ‘MBAMAdministrationService’ application, or choose the row named **Microsoft.Mbam.RecoveryAndHardwareDataStore.**ConnectionString, when updating the configuration for the ‘MBAMRecoveryAndHardwareService’.
+5. In the **Collection Editor**, choose the row named **KeyRecoveryConnectionString** when you updated the configuration for the ‘MBAMAdministrationService’ application, or choose the row named Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString, when updating the configuration for the ‘MBAMRecoveryAndHardwareService’.
 
-6.  Update the **Data Source=** value for the **configurationStrings** property to list the server name and the instance where the Recovery and Hardware Database was moved to. For example, $SERVERNAME$\\$SQLINSTANCENAME$.
+6. Update the **Data Source=** value for the **configurationStrings** property to list the server name and the instance where the Recovery and Hardware Database was moved to. For example, $SERVERNAME$\\$SQLINSTANCENAME$.
 
-7.  To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell on each Administration and Monitoring Server:
+7. To automate this procedure, you can use a command that is similar to the following one, by using Windows PowerShell on each Administration and Monitoring Server:
 
-    `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="KeyRecoveryConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMAdministrationService" -Name "connectionString" -Value “Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;”`
+   `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="KeyRecoveryConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMAdministrationService" -Name "connectionString" -Value “Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;”`
 
-    `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMRecoveryAndHardwareService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;"`
+   `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMRecoveryAndHardwareService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;"`
 
-    **Note**  
-    Replace the value from the preceding example with those that match your environment:
+   **Note**  
+   Replace the value from the preceding example with those that match your environment:
+
+   -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Recovery and Hardware database is.
 
-    -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Recovery and Hardware database is.
 
-     
 
 **To resume all instances of the MBAM Administration and Monitoring website**
 
@@ -319,10 +338,10 @@ If you choose to move the MBAM Compliance Status Database feature from one compu
 
     `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”`
 
-    **Note**  
+    **Note**  
     To execute this command, you must add the IIS Module for PowerShell to current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable the execution of scripts.
 
-     
+
 
 **To run MBAM Setup on Server B**
 
@@ -332,7 +351,7 @@ If you choose to move the MBAM Compliance Status Database feature from one compu
 
     `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal= ReportsDatabase ADMINANDMON_MACHINENAMES=$DOMAIN$\$SERVERNAME$ COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ REPORTS_USERACCOUNT=$DOMAIN$\$USERNAME$`
 
-    **Note**  
+    **Note**  
     Replace the values from the preceding example with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance Status Database will be moved to.
@@ -341,7 +360,7 @@ If you choose to move the MBAM Compliance Status Database feature from one compu
 
     -   $DOMAIN$\\$USERNAME$ - Enter the domain and user name that will be used by the Compliance and Audit reports feature to connect to the Compliance Status Database.
 
-     
+
 
 **To back up the Compliance Database on Server A**
 
@@ -349,46 +368,48 @@ If you choose to move the MBAM Compliance Status Database feature from one compu
 
 2.  To automate this procedure, create a SQL file (.sql) that contains the following-SQL script:
 
-    `-- Modify the MBAM Compliance Status Database to use the full recovery model.`
+    ```sql
+    -- Modify the MBAM Compliance Status Database to use the full recovery model.
 
-    `USE master;`
+    USE master;
 
-    `GO`
+    GO
 
-    `ALTER DATABASE "MBAM Compliance Status"`
+    ALTER DATABASE "MBAM Compliance Status"
 
-    `   SET RECOVERY FULL;`
+       SET RECOVERY FULL;
 
-    `GO`
+    GO
 
-    `-- Create MBAM Compliance Status Data logical backup devices.`
+    -- Create MBAM Compliance Status Data logical backup devices.
 
-    `USE master`
+    USE master
 
-    `GO`
+    GO
 
-    `EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device',`
+    EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device',
 
-    `'Z: \MBAM Compliance Status Database Data.bak';`
+    'Z: \MBAM Compliance Status Database Data.bak';
 
-    `GO`
+    GO
 
     -- Back up the full MBAM Recovery and Hardware database.
 
-    `BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device];`
+    BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device];
 
-    `GO`
+    GO
+    ```
 
 3.  Run the SQL file with a command that is similar to the following one, by using the SQL Server PowerShell:
 
     `PS C:\> Invoke-Sqlcmd -InputFile "Z:\BackupMBAMComplianceStatusDatabaseScript.sql" –ServerInstance $SERVERNAME$\$SQLINSTANCENAME$`
 
-    **Note**  
+    **Note**  
     Replace the value from the preceding example with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and the instance from where the Compliance Status database will be backed up.
 
-     
+
 
 **To move the Database from Server A to B**
 
@@ -400,14 +421,14 @@ If you choose to move the MBAM Compliance Status Database feature from one compu
 
     `PS C:\> Copy-Item “Z:\MBAM Compliance Status Database Data.bak” \\$SERVERNAME$\$DESTINATIONSHARE$`
 
-    **Note**  
+    **Note**  
     Replace the value from the preceding example with those that match your environment:
 
     -   $SERVERNAME$ - Enter the server name where the files will be copied to.
 
     -   $DESTINATIONSHARE$ - Enter the name of share and path where the files will be copied to.
 
-     
+
 
 **To restore the Database on Server B**
 
@@ -417,30 +438,32 @@ If you choose to move the MBAM Compliance Status Database feature from one compu
 
 3.  To automate this procedure, create a SQL file (.sql) that contains the following-SQL script:
 
-    `-- Create MBAM Compliance Status Database Data logical backup devices. `
+    ```sql
+    -- Create MBAM Compliance Status Database Data logical backup devices. 
 
-    `Use master`
+    Use master
 
-    `GO`
+    GO
 
     -- Restore the MBAM Compliance Status database data files.
 
-    `RESTORE DATABASE [MBAM Compliance Status Database]`
+    RESTORE DATABASE [MBAM Compliance Status Database]
 
-    `   FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak'`
+       FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak'
 
-    `   WITH REPLACE`
+       WITH REPLACE
+    ```
 
 4.  Run the SQL File with a command that is similar to the following one, by using the SQL Server PowerShell:
 
     `PS C:\> Invoke-Sqlcmd -InputFile "Z:\RestoreMBAMComplianceStatusDatabaseScript.sql" -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$`
 
-    **Note**  
+    **Note**  
     Replace the value from the preceding example with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance Status Database will be restored to.
 
-     
+
 
 **To configure the Access to the Database on Server B**
 
@@ -452,16 +475,18 @@ If you choose to move the MBAM Compliance Status Database feature from one compu
 
     `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$REPORTSUSERNAME$  /add`
 
-    **Note**  
+    **Note**  
     Replace the value from the preceding example with the applicable values for your environment:
 
     -   $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a **$**.For example, MyDomain\\MyServerName1$.
 
     -   $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit reports
 
-     
 
-    For each Administration and Monitoring Server that will access the database of your environment, you must run the command that will add the servers to the MBAM Compliance Auditing DB Access local group.
+
+~~~
+For each Administration and Monitoring Server that will access the database of your environment, you must run the command that will add the servers to the MBAM Compliance Auditing DB Access local group.
+~~~
 
 **To update the database connection data on MBAM Administration and Monitoring servers**
 
@@ -487,12 +512,12 @@ If you choose to move the MBAM Compliance Status Database feature from one compu
 
     `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Windows.Mdop.BitLockerManagement.StatusReportDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring\MBAMComplianceStatusService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME;Initial Catalog=MBAM Compliance Status;Integrated Security=SSPI;"`
 
-    **Note**  
+    **Note**  
     Replace the value from the preceding example with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance name where the Recovery and Hardware Database is located.
 
-     
+
 
 **To resume all instances of the MBAM Administration and Monitoring website**
 
@@ -525,7 +550,7 @@ If you choose to move the MBAM Compliance and Audit Reports from one computer to
 
     `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=Reports COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ REPORTS_USERACCOUNTPW=$PASSWORD$`
 
-    **Note**  
+    **Note**  
     Replace the values from the preceding example with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance Status Database is located.
@@ -534,7 +559,7 @@ If you choose to move the MBAM Compliance and Audit Reports from one computer to
 
     -   $PASSWORD$ - Enter the password of the user account that will be used to connect to the Compliance Status Database.
 
-     
+
 
 **To configure the access to the Compliance and Audit Reports on Server B**
 
@@ -544,14 +569,16 @@ If you choose to move the MBAM Compliance and Audit Reports from one computer to
 
     `PS C:\> net localgroup "MBAM Report Users" $DOMAIN$\$REPORTSUSERNAME$  /add`
 
-    **Note**  
+    **Note**  
     Replace the following value from the preceding example with the applicable values for your environment:
 
     -   $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit reports
 
-     
 
-    The command to add the users to the MBAM Report Users local group must be run for each user that will be accessing the reports in your environment.
+
+~~~
+The command to add the users to the MBAM Report Users local group must be run for each user that will be accessing the reports in your environment.
+~~~
 
 **To stop all instances of the MBAM Administration and Monitoring website**
 
@@ -563,30 +590,30 @@ If you choose to move the MBAM Compliance and Audit Reports from one computer to
 
 **To update the Database Connection Data on MBAM Administration and Monitoring Servers**
 
-1.  On each of the servers that run the MBAM Administration and Monitoring Feature, use the Internet Information Services (IIS) Manager console to update the Compliance Reports URL.
+1. On each of the servers that run the MBAM Administration and Monitoring Feature, use the Internet Information Services (IIS) Manager console to update the Compliance Reports URL.
 
-2.  Select the **Microsoft BitLocker Administration and Monitoring** website and use the **Configuration Editor** feature which can be found under the **Management** section of the **Feature View**.
+2. Select the **Microsoft BitLocker Administration and Monitoring** website and use the **Configuration Editor** feature which can be found under the **Management** section of the **Feature View**.
 
-3.  Select the **appSettings** option from the Section list control.
+3. Select the **appSettings** option from the Section list control.
 
-4.  From here, select the row named **(Collection)**, and open the **Collection Editor** by selecting the button on the right side of the row.
+4. From here, select the row named **(Collection)**, and open the **Collection Editor** by selecting the button on the right side of the row.
 
-5.  In the **Collection Editor**, select the row named “Microsoft.Mbam.Reports.Url”.
+5. In the **Collection Editor**, select the row named “Microsoft.Mbam.Reports.Url”.
 
-6.  Update the value for Microsoft.Mbam.Reports.Url to reflect the server name for Server B. If the Compliance and Audit reports feature was installed on a named SQL Reporting Services instance, make sure that you add or update the name of the instance to the URL. For example, http://$SERVERNAME$/ReportServer\_$SQLSRSINSTANCENAME$/Pages....
+6. Update the value for Microsoft.Mbam.Reports.Url to reflect the server name for Server B. If the Compliance and Audit reports feature was installed on a named SQL Reporting Services instance, make sure that you add or update the name of the instance to the URL. For example, http://$SERVERNAME$/ReportServer\_$SQLSRSINSTANCENAME$/Pages....
 
-7.  To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following one on each Administration and Monitoring Server:
+7. To automate this procedure, you can use Windows PowerShell to enter a command that is similar to the following one on each Administration and Monitoring Server:
 
-    `PS C:\> Set-WebConfigurationProperty '/appSettings/add[@key="Microsoft.Mbam.Reports.Url"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring" -Name "Value" -Value “http://$SERVERNAME$/ReportServer_$SRSINSTANCENAME$/Pages/ReportViewer.aspx?/Malta+Compliance+Reports/”`
+   `PS C:\> Set-WebConfigurationProperty '/appSettings/add[@key="Microsoft.Mbam.Reports.Url"]' -PSPath "IIS:\sites\Microsoft BitLocker Administration and Monitoring" -Name "Value" -Value “http://$SERVERNAME$/ReportServer_$SRSINSTANCENAME$/Pages/ReportViewer.aspx?/Malta+Compliance+Reports/”`
 
-    **Note**  
-    Replace the value from the preceding example with those that match your environment:
+   **Note**  
+   Replace the value from the preceding example with those that match your environment:
 
-    -   $SERVERNAME$ - Enter the name of the server to which the Compliance and Audit Reports were installed.
+   -   $SERVERNAME$ - Enter the name of the server to which the Compliance and Audit Reports were installed.
+
+   -   $SRSINSTANCENAME$ - Enter the name of the SQL Reporting Services instance to which the Compliance and Audit Reports were installed.
 
-    -   $SRSINSTANCENAME$ - Enter the name of the SQL Reporting Services instance to which the Compliance and Audit Reports were installed.
 
-     
 
 **To resume all instances of the MBAM Administration and Monitoring website**
 
@@ -596,10 +623,10 @@ If you choose to move the MBAM Compliance and Audit Reports from one computer to
 
     `PS C:\> Start-Website “Microsoft BitLocker Administration and Monitoring”`
 
-    **Note**  
+    **Note**  
     To execute this command, the IIS Module for PowerShell must be added to the current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable execution of scripts.
 
-     
+
 
 ## To move the Administration and Monitoring feature
 
@@ -618,7 +645,7 @@ If you choose to move the MBAM Administration and Monitoring Reports feature fro
 
     `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=AdministrationMonitoringServer,HardwareCompatibility COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ RECOVERYANDHWDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ SRS_REPORTSITEURL=$REPORTSSERVERURL$`
 
-    **Note**  
+    **Note**  
     Replace the values from the preceding example with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - For the COMPLIDB\_SQLINSTANCE parameter, input the server name and instance where the Compliance Status Database is located. For the RECOVERYANDHWDB\_SQLINSTANCE parameter, input the server name and instance where the Recovery and Hardware Database is located.
@@ -627,7 +654,7 @@ If you choose to move the MBAM Administration and Monitoring Reports feature fro
 
     -   $ REPORTSSERVERURL$ - Enter the URL for the Home location of the SQL Reporting Service website. If the reports were installed to a default SRS instance the URL format will formatted “http:// $SERVERNAME$/ReportServer”. If the reports were installed to a default SRS instance, the URL format will be formatted to “http://$SERVERNAME$/ReportServer\_$SQLINSTANCENAME$”.
 
-     
+
 
 **To configure the Access to the Databases**
 
@@ -643,25 +670,27 @@ If you choose to move the MBAM Administration and Monitoring Reports feature fro
 
     `PS C:\> net localgroup "MBAM Recovery and Hardware DB Access" $DOMAIN$\$SERVERNAME$$  /add`
 
-    **Note**  
+    **Note**  
     Replace the value from the preceding example with the applicable values for your environment:
 
     -   $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a **$**. For example, MyDomain\\MyServerName1$)
 
     -   $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit reports.
 
-     
 
-    The commands listed for adding the server computer accounts to the MBAM local groups must be run for each Administration and Monitoring Server that will be accessing the databases in your environment.
+
+~~~
+The commands listed for adding the server computer accounts to the MBAM local groups must be run for each Administration and Monitoring Server that will be accessing the databases in your environment.
+~~~
 
 ## Related topics
 
 
 [Administering MBAM 1.0 Features](administering-mbam-10-features.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md b/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md
index d4429e4d2f..b0dee3080f 100644
--- a/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md
+++ b/mdop/mbam-v1/how-to-recover-a-corrupted-drive-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Recover a Corrupted Drive
 description: How to Recover a Corrupted Drive
-author: jamiejdt
+author: dansimp
 ms.assetid: 715491ae-69c0-4fae-ad3f-3bd19a0db2f2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -25,7 +28,7 @@ To recover a corrupted drive that has been protected by BitLocker, a Microsoft B
     **Note**  
     If you are a member of the Help Desk Administrators role, you do not have to enter the user’s domain name or user name.
 
-     
+     
 
 3.  Click **Submit**. The recovery key will be displayed.
 
@@ -42,16 +45,16 @@ To recover a corrupted drive that has been protected by BitLocker, a Microsoft B
     **Note**  
     For the <fixed drive> in the command, specify an available storage device that has free space equal to or larger than the data on the corrupted drive. Data on the corrupted drive is recovered and moved to the specified fixed drive.
 
-     
+     
 
 ## Related topics
 
 
 [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md b/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md
index ff0069c71c..fe926539db 100644
--- a/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md
+++ b/mdop/mbam-v1/how-to-recover-a-drive-in-recovery-mode-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Recover a Drive in Recovery Mode
 description: How to Recover a Drive in Recovery Mode
-author: jamiejdt
+author: dansimp
 ms.assetid: 09d27e4b-57fa-47c7-a004-8b876a49f27e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ Use this procedure to access the centralized Key Recovery data system that can p
 **Important**  
 MBAM generates single-use recovery keys. Under this limitation, a recovery key can be used only once and then it is no longer valid. The single use of a recovery password is automatically applied to operating system drives and fixed drives. On removable drives, the single use is applied when the drive is removed and then re-inserted and unlocked on a computer that has the group policy settings activated to manage removable drives.
 
- 
+ 
 
 **To recover a drive in Recovery Mode**
 
@@ -34,7 +37,7 @@ MBAM generates single-use recovery keys. Under this limitation, a recovery key c
     **Note**  
     If you are an MBAM Advanced Helpdesk User, the user domain and user ID entries are not required.
 
-     
+     
 
 4.  MBAM returns the following:
 
@@ -47,7 +50,7 @@ MBAM generates single-use recovery keys. Under this limitation, a recovery key c
         **Note**  
         If you are recovering a damaged drive, the recovery package option provides BitLocker with the critical information necessary to attempt the recovery.
 
-         
+         
 
 5.  After the recovery password and recovery package are retrieved, the recovery password is displayed. To copy the password, click **Copy Key**, and then paste the recovery password into an email or other text file for temporary storage. Or, to save the recovery password to a file, click **Save**.
 
@@ -58,9 +61,9 @@ MBAM generates single-use recovery keys. Under this limitation, a recovery key c
 
 [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md b/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md
index c0cd5a62de..77052fa258 100644
--- a/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md
+++ b/mdop/mbam-v1/how-to-recover-a-moved-drive-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Recover a Moved Drive
 description: How to Recover a Moved Drive
-author: jamiejdt
+author: dansimp
 ms.assetid: 0c7199d8-9463-4f44-9af3-b70eceeaff1d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -25,7 +28,7 @@ When you move an operating system drive that has been previously encrypted by us
     **Note**  
     In some cases, you might be able to click **I forget the PIN** during the startup process to enter the recovery mode. This also displays the recovery key ID.
 
-     
+     
 
 3.  On the MBAM administration website, use the recovery key ID to retrieve the recovery password and unlock the drive.
 
@@ -38,9 +41,9 @@ When you move an operating system drive that has been previously encrypted by us
 
 [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md b/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md
index d91e575485..0dd2c800ef 100644
--- a/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md
+++ b/mdop/mbam-v1/how-to-reset-a-tpm-lockout-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: How to Reset a TPM Lockout
 description: How to Reset a TPM Lockout
-author: jamiejdt
+author: dansimp
 ms.assetid: 91ec6666-1ae2-4e76-9459-ad65c405f639
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -35,7 +38,7 @@ A TPM lockout can occur if a user enters an incorrect PIN too many times. The nu
     **Note**  
     If you are an Advanced Helpdesk User, the user domain and user ID fields are not required.
 
-     
+     
 
 5.  Upon retrieval, the owner password is displayed. To save this password to a .tpm file, click the **Save** button.
 
@@ -46,9 +49,9 @@ A TPM lockout can occur if a user enters an incorrect PIN too many times. The nu
 
 [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/index.md b/mdop/mbam-v1/index.md
index f7646af27e..b25186a196 100644
--- a/mdop/mbam-v1/index.md
+++ b/mdop/mbam-v1/index.md
@@ -1,55 +1,45 @@
 ---
 title: Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide
 description: Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide
-author: jamiejdt
+author: dansimp
 ms.assetid: 4086e721-db24-4439-bdcd-ac5ef901811f
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 04/19/2017
 ---
 
-
 # Microsoft BitLocker Administration and Monitoring 1 Administrator's Guide
 
-
 Microsoft BitLocker Administration and Monitoring (MBAM) provides a simplified administrative interface that you can use to manage BitLocker drive encryption. With MBAM, you can select BitLocker encryption policy options that are appropriate to your enterprise and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the entire enterprise. In addition, you can access recovery key information when users forget their PIN or password, or when their BIOS or boot record changes.
 
-[Getting Started with MBAM 1.0](getting-started-with-mbam-10.md)  
-
-[About MBAM 1.0](about-mbam-10.md)**|**[Evaluating MBAM 1.0](evaluating-mbam-10.md)**|**[High Level Architecture for MBAM 1.0](high-level-architecture-for-mbam-10.md)**|**[Accessibility for MBAM 1.0](accessibility-for-mbam-10.md)**|**[Privacy Statement for MBAM 1.0](privacy-statement-for-mbam-10.md)
-
-[Planning for MBAM 1.0](planning-for-mbam-10.md)  
-
-[Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md)**|**[MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md)**|**[Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md)**|**[MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md)**|**[MBAM 1.0 Planning Checklist](mbam-10-planning-checklist.md)
-
-[Deploying MBAM 1.0](deploying-mbam-10.md)  
-
-[Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md)**|**[Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md)**|**[Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md)**|**[Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md)**|**[MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md)
-
-[Operations for MBAM 1.0](operations-for-mbam-10.md)  
-
-[Administering MBAM 1.0 Features](administering-mbam-10-features.md)**|**[Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md)**|**[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md)**|**[Administering MBAM 1.0 by Using PowerShell](administering-mbam-10-by-using-powershell.md)
-
-[Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md)  
-
-### More Information
-
-[Release Notes for MBAM 1.0](release-notes-for-mbam-10.md)  
-View updated product information and known issues for MBAM 1.0.
-
-[MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286)  
-Learn about the latest MDOP information and resources.
-
-[MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032)  
-Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447).
-
- 
-
- 
-
-
-
-
+- [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md)  
+  - [About MBAM 1.0](about-mbam-10.md)
+  - [Release Notes for MBAM 1.0](release-notes-for-mbam-10.md)
+  - [Evaluating MBAM 1.0](evaluating-mbam-10.md)
+  - [High Level Architecture for MBAM 1.0](high-level-architecture-for-mbam-10.md)
+  - [Accessibility for MBAM 1.0](accessibility-for-mbam-10.md)
+  - [Privacy Statement for MBAM 1.0](privacy-statement-for-mbam-10.md)
+- [Planning for MBAM 1.0](planning-for-mbam-10.md)  
+  - [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md)
+  - [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md)
+  - [Planning to Deploy MBAM 1.0](planning-to-deploy-mbam-10.md)
+  - [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md)
+  - [MBAM 1.0 Planning Checklist](mbam-10-planning-checklist.md)
+- [Deploying MBAM 1.0](deploying-mbam-10.md)  
+  - [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md)
+  - [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md)
+  - [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md)
+  - [Deploying the MBAM 1.0 Language Release Update](deploying-the-mbam-10-language-release-update.md)
+  - [MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md)
+- [Operations for MBAM 1.0](operations-for-mbam-10.md)  
+  - [Administering MBAM 1.0 Features](administering-mbam-10-features.md)
+  - [Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md)
+  - [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam.md)
+  - [Administering MBAM 1.0 by Using PowerShell](administering-mbam-10-by-using-powershell.md)
+- [Troubleshooting MBAM 1.0](troubleshooting-mbam-10.md)  
 
+## More Information
+- [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032)  
+  Find documentation, videos, and other resources for MDOP technologies.
diff --git a/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md b/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md
index 5193c1c997..965278e188 100644
--- a/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md
+++ b/mdop/mbam-v1/known-issues-in-the-mbam-international-release-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: Known Issues in the MBAM International Release
 description: Known Issues in the MBAM International Release
-author: jamiejdt
+author: dansimp
 ms.assetid: bbf888dc-93c1-4323-b43c-0ded098e9b93
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/mbam-v1/maintaining-mbam-10.md b/mdop/mbam-v1/maintaining-mbam-10.md
index bb2fab9d98..ed8099b713 100644
--- a/mdop/mbam-v1/maintaining-mbam-10.md
+++ b/mdop/mbam-v1/maintaining-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Maintaining MBAM 1.0
 description: Maintaining MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 02ffb093-c364-4837-bbe8-23d4c09fbd3d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/mbam-v1/mbam-10-deployment-checklist.md b/mdop/mbam-v1/mbam-10-deployment-checklist.md
index d10db302be..8b7b659b06 100644
--- a/mdop/mbam-v1/mbam-10-deployment-checklist.md
+++ b/mdop/mbam-v1/mbam-10-deployment-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: MBAM 1.0 Deployment Checklist
 description: MBAM 1.0 Deployment Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 7e00be23-36a0-4b0f-8663-3c4f2c71546d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 This checklist is designed to facilitate your deployment of Microsoft BitLocker Administration and Monitoring (MBAM).
 
-**Note**  
+**Note**  
 This checklist outlines the recommended steps and provides a high-level list of items to consider when you deploy the MBAM features. We recommend that you copy this checklist into a spreadsheet program and customize it for your specific needs.
 
- 
+
 
 @@ -40,13 +43,13 @@ This checklist outlines the recommended steps and provides a high-level list of
 
-
+
-
+
@@ -60,46 +63,45 @@ This checklist outlines the recommended steps and provides a high-level list of
 
      • MBAM Group Policy Template
        • 
-Note  
-
        Keep track of the names of the servers each feature is installed on. You will use this information throughout the installation process.
        
+Note
        Keep track of the names of the servers each feature is installed on. You will use this information throughout the installation process.
        
 
        
- 
+
 
        
-
+
-
-
+
+
-
+
-
+
        
 

        
 Checklist box
 
        Complete the planning phase to prepare the computing environment for MBAM deployment.
        [MBAM 1.0 Planning Checklist](mbam-10-planning-checklist.md)
        MBAM 1.0 Planning Checklist
        		
 
        		
 
        
 
        
 Checklist box
 
        Review the information on MBAM supported configurations to make sure that your selected client and server computers are supported for MBAM feature installation.
        [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md)
        MBAM 1.0 Supported Configurations
        		
 
        		
 
        
 
        
 
 
 
        [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md)
        Deploying the MBAM 1.0 Server Infrastructure
        		
 
        		
 
        
 
        
 Checklist box
        Add Active Directory Domain Services security groups created during the planning phase to the appropriate local MBAM Server feature administrators groups on the appropriate servers.
        [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md) and [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-1.md)
        Add Active Directory Domain Services security groups created during the planning phase to the appropriate local MBAM Server feature administrators groups on the appropriate servers.
        Planning for MBAM 1.0 Administrator Roles and How to Manage MBAM Administrator Roles
        		
 
        		
 
        
 
        
 Checklist box
 
        Create and deploy the required MBAM Group Policy Objects.
        [Deploying MBAM 1.0 Group Policy Objects](deploying-mbam-10-group-policy-objects.md)
        Deploying MBAM 1.0 Group Policy Objects
        		
 
        		
 
        
 
        
 Checklist box
 
        Deploy the MBAM Client software.
        [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md)
        Deploying the MBAM 1.0 Client
        		
 
        		
 
        
         
 
        
 
- 
+
 
 ## Related topics
 
 
 [Deploying MBAM 1.0](deploying-mbam-10.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v1/mbam-10-deployment-prerequisites.md b/mdop/mbam-v1/mbam-10-deployment-prerequisites.md
index b26a995579..0b59eb0f40 100644
--- a/mdop/mbam-v1/mbam-10-deployment-prerequisites.md
+++ b/mdop/mbam-v1/mbam-10-deployment-prerequisites.md
@@ -1,12 +1,15 @@
 ---
 title: MBAM 1.0 Deployment Prerequisites
 description: MBAM 1.0 Deployment Prerequisites
-author: jamiejdt
+author: dansimp
 ms.assetid: bd9e1010-7d25-43e7-8dc6-b521226a659d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -86,12 +89,12 @@ The following table contains the installation prerequisites for the MBAM Adminis
 
 
 
- 
+ 
 
 **Note**  
 For a list of supported operating systems, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md).
 
- 
+ 
 
 ### Installation prerequisites for the Compliance and Audit Reports
 
@@ -102,7 +105,7 @@ SSRS must be installed and running during MBAM server installation. SSRS should
 **Note**  
 For a list of supported operating systems and SQL Server versions, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md).
 
- 
+ 
 
 ### Installation prerequisites for the Recovery and Hardware Database
 
@@ -113,14 +116,14 @@ SQL Server must have Database Engine Services installed and running during the M
 **Note**  
 For a list of supported operating systems and SQL Server versions, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md).
 
- 
+ 
 
 The TDE SQL Server feature performs real-time input/output (I/O) encryption and decryption of the data and log files. TDE protects data that is "at rest,” which include the data and the log files. It provides the ability to comply with many laws, regulations, and guidelines that are established in various industries.
 
 **Note**  
 Because TDE performs real-time decryption of database information, the recovery key information will be visible if the account under which you are logged in has permissions to the database when you view the recovery key information SQL tables.
 
- 
+ 
 
 ### Installation prerequisites for the Compliance and Audit Database
 
@@ -131,7 +134,7 @@ SQL Server must have Database Engine Services installed and running during MBAM
 **Note**  
 For a list of supported operating systems and SQL Server versions, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md).
 
- 
+ 
 
 ## Installation prerequisites for MBAM Clients
 
@@ -145,7 +148,7 @@ The necessary prerequisites that you must meet before you begin the MBAM Client
 **Warning**  
 Ensure that the keyboard, mouse, and video are directly connected to the computer, instead of to a keyboard, video, mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware.
 
- 
+ 
 
 ## Related topics
 
@@ -154,9 +157,9 @@ Ensure that the keyboard, mouse, and video are directly connected to the compute
 
 [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/mbam-10-planning-checklist.md b/mdop/mbam-v1/mbam-10-planning-checklist.md
index 1ecd02262c..0324216e06 100644
--- a/mdop/mbam-v1/mbam-10-planning-checklist.md
+++ b/mdop/mbam-v1/mbam-10-planning-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: MBAM 1.0 Planning Checklist
 description: MBAM 1.0 Planning Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: e9439f16-d68b-48ed-99ce-5949356b180b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ You can use this checklist to plan and prepare your computing environment for Mi
 **Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when you plan for an MBAM deployment. We recommend that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+ 
 
 @@ -40,64 +43,64 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
        
 

        
 Checklist box
 
        Review the “getting started” information about MBAM to gain a basic understanding of the product before you begin the deployment planning.
        [Getting Started with MBAM 1.0](getting-started-with-mbam-10.md)
        Getting Started with MBAM 1.0
        		
 
        		
 
        
 
        
 Checklist box
 
        Plan for MBAM 1.0 Deployment Prerequisites and prepare your computing environment.
        [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md)
        MBAM 1.0 Deployment Prerequisites
        		
 
        		
 
        
 
        
 Checklist box
 
        Plan for and configure MBAM Group Policy requirements.
        [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md)
        Planning for MBAM 1.0 Group Policy Requirements
        		
 
        		
 
        
 
        
 Checklist box
 
        Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.
        [Planning for MBAM 1.0 Administrator Roles](planning-for-mbam-10-administrator-roles.md)
        Planning for MBAM 1.0 Administrator Roles
        		
 
        		
 
        
 
        
 Checklist box
 
        Review the MBAM 1.0 Supported Configurations documentation to ensure hardware that meets MBAM installation system requirements is available.
        [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md)
        MBAM 1.0 Supported Configurations
        		
 
        		
 
        
 
        
 Checklist box
 
        Plan for MBAM Server feature deployment.
        [Planning for MBAM 1.0 Server Deployment](planning-for-mbam-10-server-deployment.md)
        Planning for MBAM 1.0 Server Deployment
        		
 
        		
 
        
 
        
 Checklist box
 
        Plan for MBAM Client deployment.
        [Planning for MBAM 1.0 Client Deployment](planning-for-mbam-10-client-deployment.md)
        Planning for MBAM 1.0 Client Deployment
        		
 
        		
 
        
 
        
 Checklist box
 
        Validate your deployment plan in a lab environment.
        [Evaluating MBAM 1.0](evaluating-mbam-10.md)
        Evaluating MBAM 1.0
        		
 
        		
 
        
         
 
        
 
- 
+ 
 
 ## Related topics
 
 
 [Planning for MBAM 1.0](planning-for-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/mbam-10-supported-configurations.md b/mdop/mbam-v1/mbam-10-supported-configurations.md
index 4a2bb2223e..80ed363018 100644
--- a/mdop/mbam-v1/mbam-10-supported-configurations.md
+++ b/mdop/mbam-v1/mbam-10-supported-configurations.md
@@ -1,12 +1,15 @@
 ---
 title: MBAM 1.0 Supported Configurations
 description: MBAM 1.0 Supported Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: 1f5ac58e-6a3f-47df-8a9b-4b57631ab9ee
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -23,10 +26,10 @@ This topic specifies the necessary requirements to install and run Microsoft Bit
 
 The following table lists the operating systems that are supported for the Microsoft BitLocker Administration and Monitoring Server installation.
 
-**Note**  
+**Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+
 
 @@ -45,13 +48,13 @@ Microsoft provides support for the current service pack and, in some cases, the
 
-
+
-
+
@@ -59,20 +62,20 @@ Microsoft provides support for the current service pack and, in some cases, the
 
        
 

 
 
        Windows Server 2008
        Windows Server 2008
        		
 
        Standard, Enterprise, Datacenter, or Web Server
        		
 
        SP2 only
        		
 
        32-bit or 64-bit
        		
 
        
 
        Windows Server 2008 R2
        Windows Server 2008 R2
        		
 
        Standard, Enterprise, Datacenter, or Web Server
        		
 
 
        64-bit
        
 
        
 
- 
 
-**Warning**  
+
+**Warning**  
 There is no support for installing MBAM services, reports, or databases on a domain controller computer.
 
- 
+
 
 ### Server random access memory (RAM) requirements
 
 There are no RAM requirements that are specific to MBAM Server installation.
 
-### SQL Server Database requirements
+### SQL Server Database requirements
 
-The following table lists the SQL Server versions that are supported for the MBAM Server feature installation.
+The following table lists the SQL Server versions that are supported for the MBAM Server feature installation.
 
 @@ -94,28 +97,27 @@ The following table lists the SQL Server versions that are supported for the MB
 
-
+
-
+
-
+
@@ -123,7 +125,7 @@ The following table lists the SQL Server versions that are supported for the MB
 
        
 

 
        
 
        Compliance and Audit Reports
        Microsoft SQL Server 2008 
        Microsoft SQL Server 2008 
        		
 
        R2, Standard, Enterprise, Datacenter, or Developer Edition
        		
 
        SP2
        		
 
        32-bit or 64-bit
        		
 
        
 
        
 
        Recovery and Hardware Database
        Microsoft SQL Server 2008 
        Microsoft SQL Server 2008 
        		
 
        R2, Enterprise, Datacenter, or Developer Edition
        
 
        
-Important  
-
        SQL Server Standard Editions are not supported for MBAM Recovery and Hardware Database Server feature installation.
        
+Important
        SQL Server Standard Editions are not supported for MBAM Recovery and Hardware Database Server feature installation.
        
 
        
 
        
- 
+
 
        		
 
        SP2
        		
 
        32-bit or 64-bit
        		
 
        
 
        
 
        Compliance and Audit Database
        Microsoft SQL Server 2008 
        Microsoft SQL Server 2008 
        		
 
        R2, Standard, Enterprise, Datacenter, or Developer Edition
        		
 
        SP2
        		
 
        32-bit or 64-bit
        
 
        
 
- 
+
 
 ##  MBAM Client system requirements
 
@@ -132,10 +134,10 @@ The following table lists the SQL Server versions that are supported for the MB
 
 The following table lists the operating systems that are supported for MBAM Client installation.
 
-**Note**  
+**Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+
 
 @@ -154,13 +156,13 @@ Microsoft provides support for the current service pack and, in some cases, the
 
-
+
-
+
@@ -168,7 +170,7 @@ Microsoft provides support for the current service pack and, in some cases, the
 
        
 

 
 
        Windows 7
        Windows 7
        		
 
        Enterprise Edition
        		
 
        None, SP1
        		
 
        32-bit or 64-bit
        		
 
        
 
        Windows 7
        Windows 7
        		
 
        Ultimate Edition
        		
 
        None, SP1
        		
 
        32-bit or 64-bit
        
 
        
 
- 
+
 
 ### Client RAM requirements
 
@@ -181,9 +183,9 @@ There are no RAM requirements that are specific to the MBAM Client installation.
 
 [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md b/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md
index afa4bb1fd2..beb0deea35 100644
--- a/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md
+++ b/mdop/mbam-v1/monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Monitoring and Reporting BitLocker Compliance with MBAM 1.0
 description: Monitoring and Reporting BitLocker Compliance with MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: fb497d3f-ff33-4747-8e34-366440ee25c2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/operations-for-mbam-10.md b/mdop/mbam-v1/operations-for-mbam-10.md
index cf16ed277d..560b76d3ff 100644
--- a/mdop/mbam-v1/operations-for-mbam-10.md
+++ b/mdop/mbam-v1/operations-for-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Operations for MBAM 1.0
 description: Operations for MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 2c358fa1-4795-45ab-9316-02db4aaa6d5f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md b/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md
index 55fdc98190..b37c05e208 100644
--- a/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md
+++ b/mdop/mbam-v1/performing-bitlocker-management-with-mbam.md
@@ -1,12 +1,15 @@
 ---
 title: Performing BitLocker Management with MBAM
 description: Performing BitLocker Management with MBAM
-author: jamiejdt
+author: dansimp
 ms.assetid: 2d24390a-87bf-48b3-96a9-3882d6f2a15c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md b/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md
index 3e0ed8dbc4..6ed9a49fe7 100644
--- a/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md
+++ b/mdop/mbam-v1/planning-for-mbam-10-administrator-roles.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for MBAM 1.0 Administrator Roles
 description: Planning for MBAM 1.0 Administrator Roles
-author: jamiejdt
+author: dansimp
 ms.assetid: 95be0eb4-25e9-43ca-a8e7-27373d35544d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,7 +19,7 @@ ms.date: 06/16/2016
 
 This topic includes and describes the administrator roles that are available in Microsoft BitLocker Administration and Monitoring (MBAM), as well as the server locations where the local groups are created.
 
-##  MBAM Administrator roles
+## MBAM Administrator roles
 
 
  **MBAM System Administrators**  
@@ -37,16 +40,16 @@ Administrators in this role have increased access to the Helpdesk features from
 **Important**  
 To view the reports, an administrative user must be a member of the **MBAM Report Users** security group on the Administration and Monitoring Server, Compliance and Audit Database, and on the server that hosts the Compliance and Reports feature. As a best practice, create a security group in Active Directory with rights on the local **MBAM Report Users** security group on both the Administration and Monitoring Server and on the server that hosts the Compliance and Reports.
 
- 
+ 
 
 ## Related topics
 
 
 [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md b/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md
index 3be3031615..352f0f8fba 100644
--- a/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md
+++ b/mdop/mbam-v1/planning-for-mbam-10-client-deployment.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for MBAM 1.0 Client Deployment
 description: Planning for MBAM 1.0 Client Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 3af2e7f3-134b-4ab9-9847-b07474ca6ac3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ You can use one or both methods in your organization. If you use both methods, y
 **Note**  
 To review the MBAM Client system requirements, see [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md).
 
- 
+ 
 
 ## Deploying the MBAM Client to enable BitLocker encryption after computer distribution to end users
 
@@ -33,7 +36,7 @@ When you deploy the MBAM Client, after you distribute the computers to end users
 **Note**  
 In this approach, users are prompted to activate and initialize the Trusted Platform Module (TPM) chip, if it has not been previously activated.
 
- 
+ 
 
 ## Using the MBAM Client to enable BitLocker encryption before computer distribution to end users
 
@@ -45,7 +48,7 @@ If your organization wants to use (TPM) to encrypt computers, the administrator
 **Note**  
 The TPM protector option requires for the administrator to accept the BIOS prompt to activate and initialize the TPM before delivering the computer to the user.
 
- 
+ 
 
 ## Related topics
 
@@ -54,9 +57,9 @@ The TPM protector option requires for the administrator to accept the BIOS promp
 
 [Deploying the MBAM 1.0 Client](deploying-the-mbam-10-client.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md b/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md
index 90395e88ee..4b825a4bea 100644
--- a/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md
+++ b/mdop/mbam-v1/planning-for-mbam-10-group-policy-requirements.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for MBAM 1.0 Group Policy Requirements
 description: Planning for MBAM 1.0 Group Policy Requirements
-author: jamiejdt
+author: dansimp
 ms.assetid: 0fc9c509-7850-4a8e-bb82-b949025bcb02
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,19 +19,19 @@ ms.date: 06/16/2016
 
 Microsoft BitLocker Administration and Monitoring (MBAM) Client management requires custom Group Policy settings to be applied. This topic describes the available policy options for Group Policy Object (GPO) when you use MBAM to manage BitLocker Drive Encryption in the enterprise.
 
-**Important**  
+**Important**  
 MBAM does not use the default GPO settings for Windows BitLocker drive encryption. If the default settings are enabled, they can cause conflicting behavior. To enable MBAM to manage BitLocker, you must define the GPO policy settings after you install the MBAM Group Policy Template.
 
- 
+
 
 After you install the MBAM Group Policy template, you can view and modify the available custom MBAM GPO policy settings that enable MBAM to manage the enterprise BitLocker encryption. The MBAM Group Policy template must be installed on a computer that is capable of running the Group Policy Management Console (GPMC) or the Advanced Group Policy Management (AGPM) MDOP technology. Next, to edit the applicable GPO, open the GPMC or AGPM, and then navigate to the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**.
 
 The MDOP MBAM (BitLocker Management) GPO node contains four global policy settings and four child GPO setting nodes, respectively. The four GPO global policy settings are: Client Management, Fixed Drive, Operating System Drive, and Removable Drive. The following sections provide policy definitions and suggested policy settings to help you plan for the MBAM GPO policy setting requirements.
 
-**Note**  
+**Note**  
 For more information about configuring the minimum suggested GPO settings to enable MBAM to manage BitLocker encryption, see [How to Edit MBAM 1.0 GPO Settings](how-to-edit-mbam-10-gpo-settings.md).
 
- 
+
 
 ## Global policy definitions
 
@@ -75,7 +78,7 @@ This section describes the MBAM Global policy definitions, which can be found at
 
 
 
- 
+
 
 ## Client Management policy definitions
 
@@ -113,11 +116,10 @@ This section describes the Client Management policy definitions for MBAM, found
 
        You should enable this policy option if your enterprise has older computer hardware or computers that do not support Trusted Platform Module (TPM). If either of these criteria is true, enable the hardware compatibility verification to make sure that MBAM is applied only to computer models that support BitLocker. If all computers in your organization support BitLocker, you do not have to deploy the Hardware Compatibility, and you can set this policy to Not Configured.
        
 
        If you enable this policy setting, the model of the computer is validated against the hardware compatibility list once every 24 hours, before the policy enables BitLocker protection on a computer drive.
        
 
        
-Note  
-
        Before enabling this policy setting, make sure that you have configured the MBAM Recovery and Hardware service endpoint setting in the Configure MBAM Services policy options.
        
+Note
        Before enabling this policy setting, make sure that you have configured the MBAM Recovery and Hardware service endpoint setting in the Configure MBAM Services policy options.
        
 
        
 
        
- 
+
 
        
 
        If you either disable or do not configure this policy setting, the computer model is not validated against the hardware compatibility list.
        
 
@@ -125,22 +127,21 @@ This section describes the Client Management policy definitions for MBAM, found
 
        Configure user exemption policy
        
 
        Suggested Configuration: Not Configured
        
 
        This policy setting lets you configure a web site address, email address, or phone number that will instruct a user to request an exemption from BitLocker encryption.
        
-
        If you enable this policy setting and provide a web site address, email address, or phone number, users will see a dialog with instructions on how to apply for an exemption from BitLocker protection. For more information about how to enable BitLocker encryption exemptions for users, see [How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-1.md).
        
+
        If you enable this policy setting and provide a web site address, email address, or phone number, users will see a dialog with instructions on how to apply for an exemption from BitLocker protection. For more information about how to enable BitLocker encryption exemptions for users, see How to Manage User BitLocker Encryption Exemptions.
        
 
        If you either disable or do not configure this policy setting, the instructions about how to apply for an exemption request will not be presented to users.
        
 
        
-Note  
-
        User exemption is managed per user, not per computer. If multiple users log on to the same computer and one user is not exempt, the computer will be encrypted.
        
+Note
        User exemption is managed per user, not per computer. If multiple users log on to the same computer and one user is not exempt, the computer will be encrypted.
        
 
        
 
        
- 
+
 
        
 
 
 
 
- 
 
-##  Fixed Drive policy definitions
+
+## Fixed Drive policy definitions
 
 
 This section describes the Fixed Drive policy definitions for MBAM, which can be found at the following GPO node: **Computer Configuration**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)** \\ **Fixed Drive**.
@@ -197,7 +198,7 @@ This section describes the Fixed Drive policy definitions for MBAM, which can be
 
 
 
- 
+
 
 ## Operating System Drive policy definitions
 
@@ -253,7 +254,7 @@ This section describes the Operating System Drive policy definitions for MBAM, f
 
 
 
- 
+
 
 ## Removable Drive policy definitions
 
@@ -310,16 +311,16 @@ This section describes the Removable Drive Policy definitions for MBAM, found at
 
 
 
- 
+
 
 ## Related topics
 
 
 [Preparing your Environment for MBAM 1.0](preparing-your-environment-for-mbam-10.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md b/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md
index 1541ceade7..fe9b06d826 100644
--- a/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md
+++ b/mdop/mbam-v1/planning-for-mbam-10-server-deployment.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for MBAM 1.0 Server Deployment
 description: Planning for MBAM 1.0 Server Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 3cbef284-3092-4c42-9234-2826b18ddef1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -34,7 +37,7 @@ MBAM server databases and features can be installed in different configurations,
 **Note**  
 For more information about performance scalability of MBAM and recommended deployment topologies, see the MBAM Scalability and High-Availability Guide white paper at .
 
- 
+ 
 
 Each MBAM feature has specific prerequisites. For a full list of server feature prerequisites and hardware and software requirements, see [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md) and [MBAM 1.0 Supported Configurations](mbam-10-supported-configurations.md).
 
@@ -58,7 +61,7 @@ When you deploy the MBAM Server features, install the features in the following
 **Note**  
 Keep track of the names of the computers on which you install each feature. You will use this information throughout the installation process. You can print and use a deployment checklist to assist you in the installation process. For more information about the MBAM deployment checklist, see [MBAM 1.0 Deployment Checklist](mbam-10-deployment-checklist.md).
 
- 
+ 
 
 ## Related topics
 
@@ -67,9 +70,9 @@ Keep track of the names of the computers on which you install each feature. You
 
 [Deploying the MBAM 1.0 Server Infrastructure](deploying-the-mbam-10-server-infrastructure.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/planning-for-mbam-10.md b/mdop/mbam-v1/planning-for-mbam-10.md
index 0a28496000..53583513c7 100644
--- a/mdop/mbam-v1/planning-for-mbam-10.md
+++ b/mdop/mbam-v1/planning-for-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for MBAM 1.0
 description: Planning for MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: d4e8a42f-2836-48c8-83c1-40bd58270e19
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/planning-to-deploy-mbam-10.md b/mdop/mbam-v1/planning-to-deploy-mbam-10.md
index a0479b0674..c35e32933a 100644
--- a/mdop/mbam-v1/planning-to-deploy-mbam-10.md
+++ b/mdop/mbam-v1/planning-to-deploy-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Planning to Deploy MBAM 1.0
 description: Planning to Deploy MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 30ad4304-45c6-427d-8e33-ebe8053c7871
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md b/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md
index 3de04b4582..931b7c9924 100644
--- a/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md
+++ b/mdop/mbam-v1/preparing-your-environment-for-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Preparing your Environment for MBAM 1.0
 description: Preparing your Environment for MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 915f7c3c-70ad-4a90-a434-73e7fba97ecb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -26,7 +29,7 @@ To ensure successful installation of MBAM Clients and MBAM Server features, you
 **Note**  
 MBAM Setup verifies if all prerequisites are met before installation starts. If they are not met, Setup will fail.
 
- 
+ 
 
 [MBAM 1.0 Deployment Prerequisites](mbam-10-deployment-prerequisites.md)
 
@@ -38,7 +41,7 @@ Before MBAM can manage clients in the enterprise, you must define the Group Poli
 **Important**  
 MBAM will not work with policies for stand-alone BitLocker drive encryption. Group Policy must be defined for MBAM; otherwise, the BitLocker encryption and enforcement will fail.
 
- 
+ 
 
 [Planning for MBAM 1.0 Group Policy Requirements](planning-for-mbam-10-group-policy-requirements.md)
 
@@ -56,9 +59,9 @@ The membership of MBAM roles can be managed more effectively if you create secur
 
 [Planning for MBAM 1.0](planning-for-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/privacy-statement-for-mbam-10.md b/mdop/mbam-v1/privacy-statement-for-mbam-10.md
index e4de0d0c5b..f54a72fb5e 100644
--- a/mdop/mbam-v1/privacy-statement-for-mbam-10.md
+++ b/mdop/mbam-v1/privacy-statement-for-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Privacy Statement for MBAM 1.0
 description: Privacy Statement for MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: db18cc93-a1c1-44da-a450-a5399a4427b9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/release-notes-for-mbam-10.md b/mdop/mbam-v1/release-notes-for-mbam-10.md
index 32cf3c9bd1..61041c666a 100644
--- a/mdop/mbam-v1/release-notes-for-mbam-10.md
+++ b/mdop/mbam-v1/release-notes-for-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Release Notes for MBAM 1.0
 description: Release Notes for MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: d82fddde-c360-48ef-86a0-d9b5fe066861
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -35,7 +38,7 @@ We are interested in your feedback on MBAM. You can send your feedback to ' to group 'MBAM Report Users'
 Locating group 'MBAM Recovery and Hardware DB Access'
 Adding 'S-1-5-20' to group 'MBAM Recovery and Hardware DB Access'
 Exception: A new member could not be added to a local group because the member has the wrong account type.
- 
-  StackTrace:    at System.DirectoryServices.AccountManagement.SAMStoreCtx.UpdateGroupMembership(Principal group, DirectoryEntry de, NetCred credentials, AuthenticationTypes authTypes)
-   at System.DirectoryServices.AccountManagement.SDSUtils.ApplyChangesToDirectory(Principal p, StoreCtx storeCtx, GroupMembershipUpdater updateGroupMembership, NetCred credentials, AuthenticationTypes authTypes)
-   at System.DirectoryServices.AccountManagement.SAMStoreCtx.Update(Principal p)
-   at Microsoft.Windows.Mdop.BitlockerManagement.Setup.Groups.CreateGroupsDeferred(Session session)
-  InnerException:Exception: A new member could not be added to a local group because the member has the wrong account type.
- 
-    InnerException:StackTrace:    at System.DirectoryServices.AccountManagement.UnsafeNativeMethods.IADsGroup.Add(String bstrNewItem)
-   at System.DirectoryServices.AccountManagement.SAMStoreCtx.UpdateGroupMembership(Principal group, DirectoryEntry de, NetCred credentials, AuthenticationTypes authTypes)
+ 
+  StackTrace:    at System.DirectoryServices.AccountManagement.SAMStoreCtx.UpdateGroupMembership(Principal group, DirectoryEntry de, NetCred credentials, AuthenticationTypes authTypes)
+   at System.DirectoryServices.AccountManagement.SDSUtils.ApplyChangesToDirectory(Principal p, StoreCtx storeCtx, GroupMembershipUpdater updateGroupMembership, NetCred credentials, AuthenticationTypes authTypes)
+   at System.DirectoryServices.AccountManagement.SAMStoreCtx.Update(Principal p)
+   at Microsoft.Windows.Mdop.BitlockerManagement.Setup.Groups.CreateGroupsDeferred(Session session)
+  InnerException:Exception: A new member could not be added to a local group because the member has the wrong account type.
+ 
+    InnerException:StackTrace:    at System.DirectoryServices.AccountManagement.UnsafeNativeMethods.IADsGroup.Add(String bstrNewItem)
+   at System.DirectoryServices.AccountManagement.SAMStoreCtx.UpdateGroupMembership(Principal group, DirectoryEntry de, NetCred credentials, AuthenticationTypes authTypes)
 CustomAction MbamCreateGroupsDeferred returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox)
 Action ended 11:41:29: InstallExecute. Return value 3.
 ```
@@ -147,9 +150,9 @@ Microsoft, Active Directory, ActiveX, Bing, Excel, Silverlight, SQL Server, Win
 
 [About MBAM 1.0](about-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/security-and-privacy-for-mbam-10.md b/mdop/mbam-v1/security-and-privacy-for-mbam-10.md
index c91aa2e1b0..8ef48ada78 100644
--- a/mdop/mbam-v1/security-and-privacy-for-mbam-10.md
+++ b/mdop/mbam-v1/security-and-privacy-for-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Security and Privacy for MBAM 1.0
 description: Security and Privacy for MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: ba4497f1-b9e3-41be-8953-3637d1f83f01
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v1/security-considerations-for-mbam-10.md b/mdop/mbam-v1/security-considerations-for-mbam-10.md
index 75fab3c79a..340bd2e376 100644
--- a/mdop/mbam-v1/security-considerations-for-mbam-10.md
+++ b/mdop/mbam-v1/security-considerations-for-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Security Considerations for MBAM 1.0
 description: Security Considerations for MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 5e1c8b8c-235b-4a92-8b0b-da50dca17353
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -83,7 +86,7 @@ No groups are created automatically during MBAM Setup. However, you should creat
 
 
 
- 
+ 
 
 ### MBAM Server Local Groups
 
@@ -132,7 +135,7 @@ MBAM Setup creates local groups to support MBAM operations. You should add the A
 
 
 
- 
+ 
 
 ### SSRS Reports Access Account
 
@@ -145,7 +148,7 @@ During MBAM Setup, the following MBAM Setup log files are created in the %temp%
 
 **MBAM Server Setup log files**
 
-MSI*<five random characters>*.log  
+MSI<five random characters>.log  
 Logs the actions taken during MBAM Setup and MBAM Server Feature installation.
 
 InstallComplianceDatabase.log  
@@ -169,11 +172,11 @@ Logs the actions taken to authorize web services to MBAM Recovery and Hardware d
 **Note**  
 In order to obtain additional MBAM Setup log files, you must install Microsoft BitLocker Administration and Monitoring by using the **msiexec** package and the **/l** <location> option. Log files are created in the location specified.
 
- 
+ 
 
 **MBAM Client Setup log files**
 
-MSI*<five random characters>*.log  
+MSI<five random characters>.log  
 Logs the actions taken during MBAM Client installation.
 
 ## MBAM Database TDE considerations
@@ -194,9 +197,9 @@ For more information about TDE in SQL Server 2008, see [Database Encryption in
 
 [Security and Privacy for MBAM 1.0](security-and-privacy-for-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v1/troubleshooting-mbam-10.md b/mdop/mbam-v1/troubleshooting-mbam-10.md
index 8b439e5fdf..bcf03fa8b3 100644
--- a/mdop/mbam-v1/troubleshooting-mbam-10.md
+++ b/mdop/mbam-v1/troubleshooting-mbam-10.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting MBAM 1.0
 description: Troubleshooting MBAM 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 7d47fbfe-51c0-4619-bed3-163dfd18cdec
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md b/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md
index 566b8c945d..eb7557d3a6 100644
--- a/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md
+++ b/mdop/mbam-v1/understanding-mbam-reports-mbam-1.md
@@ -1,12 +1,15 @@
 ---
 title: Understanding MBAM Reports
 description: Understanding MBAM Reports
-author: jamiejdt
+author: dansimp
 ms.assetid: 34e4aaeb-7f89-41a1-b816-c6fe8397b060
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -70,7 +73,7 @@ An Enterprise Compliance Report provides information on overall BitLocker compli
 
 
 
- 
+ 
 
 **Enterprise Compliance Report Compliance states**
 
@@ -117,7 +120,7 @@ An Enterprise Compliance Report provides information on overall BitLocker compli
 
 
 
- 
+ 
 
 ### Computer Compliance Report
 
@@ -128,7 +131,7 @@ The Computer Compliance Report provides detailed encryption information and appl
 **Note**  
 This report does not provide encryption status for Removable Data Volumes.
 
- 
+ 
 
 **Computer Compliance Report fields**
 
@@ -207,7 +210,7 @@ This report does not provide encryption status for Removable Data Volumes.
 
 
 
- 
+ 
 
 **Computer Compliance Report Drive fields**
 
@@ -258,7 +261,7 @@ This report does not provide encryption status for Removable Data Volumes.
 
 
 
- 
+ 
 
 ### Hardware Audit Report
 
@@ -301,7 +304,7 @@ This report can help you audit changes to the Hardware Compatibility status of s
 
 
 
- 
+ 
 
 ### Recovery Audit Report
 
@@ -364,21 +367,21 @@ The Recovery Audit Report can help you audit users who have requested access to
 
 
 
- 
+ 
 
 **Note**  
 To save report results to a file, click the **Export** button on the reports menu bar.
 
- 
+ 
 
 ## Related topics
 
 
 [Monitoring and Reporting BitLocker Compliance with MBAM 1.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/TOC.md b/mdop/mbam-v2/TOC.md
index ee098e3a8b..4bb822bfb4 100644
--- a/mdop/mbam-v2/TOC.md
+++ b/mdop/mbam-v2/TOC.md
@@ -36,8 +36,8 @@
 ## [Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md)
 ### [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md)
 #### [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md)
-#### [Planning to Deploy MBAM with Configuration Manager [2 [MBAM_2](planning-to-deploy-mbam-with-configuration-manager-2.md)
-#### [Deploying MBAM with Configuration Manager [MBAM2 [MBAM_2](deploying-mbam-with-configuration-manager-mbam2.md)
+#### [Planning to Deploy MBAM with Configuration Manager](planning-to-deploy-mbam-with-configuration-manager-2.md)
+#### [Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md)
 ##### [How to Create or Edit the mof Files](how-to-create-or-edit-the-mof-files.md)
 ###### [Edit the Configuration.mof File](edit-the-configurationmof-file.md)
 ###### [Create or Edit the Sms_def.mof File](create-or-edit-the-sms-defmof-file.md)
diff --git a/mdop/mbam-v2/about-mbam-20-mbam-2.md b/mdop/mbam-v2/about-mbam-20-mbam-2.md
index a2304dbbce..9fb055be15 100644
--- a/mdop/mbam-v2/about-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/about-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: About MBAM 2.0
 description: About MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: b43a0ba9-1c83-4854-a2c5-14eea0070e36
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -24,7 +27,7 @@ BitLocker Administration and Monitoring 2.0 enforces the BitLocker encryption
 **Note**  
 BitLocker is not covered in detail in this guide. For an overview of BitLocker, see [BitLocker Drive Encryption Overview](https://go.microsoft.com/fwlink/p/?LinkId=225013).
 
- 
+ 
 
 The following groups might be interested in using MBAM to manage BitLocker:
 
@@ -102,9 +105,9 @@ This technology is a part of the Microsoft Desktop Optimization Pack (MDOP). Ent
 
 [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/about-mbam-20-sp1.md b/mdop/mbam-v2/about-mbam-20-sp1.md
index b382c075e4..ab210f8c1c 100644
--- a/mdop/mbam-v2/about-mbam-20-sp1.md
+++ b/mdop/mbam-v2/about-mbam-20-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: About MBAM 2.0 SP1
 description: About MBAM 2.0 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 5ba89ed8-bb6e-407b-82c2-e2e36dd1078e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -25,13 +28,13 @@ This version of MBAM provides the following new features and functionality.
 
 Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1) adds support for Windows 8.1, Windows Server 2012 R2, and System Center 2012 R2 Configuration Manager.
 
-### Support for Microsoft SQL Server 2008 R2 SP2
+### Support for Microsoft SQL Server 2008 R2 SP2
 
-Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1) adds support for Microsoft SQL Server 2008 R2 SP2. You must use Microsoft SQL Server 2008 R2 or higher if you are running Microsoft System Center Configuration Manager 2007 R2.
+Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 Service Pack 1 (SP1) adds support for Microsoft SQL Server 2008 R2 SP2. You must use Microsoft SQL Server 2008 R2 or higher if you are running Microsoft System Center Configuration Manager 2007 R2.
 
 ### Customer feedback rollup
 
-MBAM 2.0 SP1 includes a rollup of fixes to address issues that were found since the Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 release. As part of these changes, the Computer Name field now appears in the BitLocker Computer Compliance and BitLocker Enterprise Compliance Details reports when you run MBAM with Microsoft System Center Configuration Manager 2007.
+MBAM 2.0 SP1 includes a rollup of fixes to address issues that were found since the Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 release. As part of these changes, the Computer Name field now appears in the BitLocker Computer Compliance and BitLocker Enterprise Compliance Details reports when you run MBAM with Microsoft System Center Configuration Manager 2007.
 
 ### Firewall exception must be set on ports for the Self-Service Portal and the Administration and Monitoring website
 
@@ -45,16 +48,16 @@ MBAM reports for the Configuration Manager integrated topology are now available
 
 You can install MBAM on a primary site server or a central administration site server when you install MBAM with the Configuration Manager integrated topology. Previously, you were required to install MBAM on a central administration site server.
 
-**Important**  
+**Important**  
 The server on which you install MBAM must be the top-tier server in your hierarchy.
 
- 
 
-The MBAM installation works differently for Microsoft System Center Configuration Manager 2007 and Microsoft System Center 2012 Configuration Manager as follows:
+
+The MBAM installation works differently for Microsoft System Center Configuration Manager 2007 and Microsoft System Center 2012 Configuration Manager as follows:
 
 -   **Configuration Manager 2007** : If you install MBAM on a primary site server that is part of a larger Configuration Manager hierarchy and has a central site parent server, MBAM resolves the central site parent server and performs all of the installation actions on that parent server. The installation actions include checking prerequisites and installing the Configuration Manager objects and reports. For example, if you install MBAM on a primary site server that is a child of a central site parent server, MBAM installs all of the Configuration Manager objects and reports on the parent server. If you install MBAM on the parent server, MBAM performs all of the installation actions on that parent server.
 
--   **System Center 2012 Configuration Manager** : If you install MBAM on a primary site server or on a central administration server, MBAM performs all of the installation actions on that site server.
+-   **System Center 2012 Configuration Manager** : If you install MBAM on a primary site server or on a central administration server, MBAM performs all of the installation actions on that site server.
 
 ###  Configuration Manager Console must be installed on the computer on which you install the MBAM Server
 
@@ -85,11 +88,10 @@ When you install MBAM with the Configuration Manager integrated topology, you mu
 
        CM_REPORTS_ONLY
        
 
        Enables you to install only the Configuration Manager reports, without other Configuration Manager objects, such as the baseline, collection, and configuration items.
        
 
        
-Note  
-
        You must combine this parameter with the CM_REPORTS_COLLECTION_ID parameter.
        
+Note
        You must combine this parameter with the CM_REPORTS_COLLECTION_ID parameter.
        
 
        
 
        
- 
+
 
        
 
        Valid parameter values:
        
 
          
@@ -110,7 +112,7 @@ When you install MBAM with the Configuration Manager integrated topology, you mu
 
 
 
- 
+
 
 ### Ability to turn Self-Service Portal notice text on or off
 
@@ -168,12 +170,12 @@ MBAM displays the notice text, based on the following rules:
 
 -   If MBAM does not find a default notice.txt file, it displays the default text in the Self-Service Portal.
 
-**Note**  
+**Note**  
 If an end user’s browser is set to a language that does not have a corresponding language subfolder or notice.txt, the text that is in the notice.txt file in the following root directory is displayed:
 
 <*MBAM Self-Service Install Directory*>\\Self Service Website\\
 
- 
+
 
 **To create a localized notice.txt file**
 
@@ -181,10 +183,10 @@ If an end user’s browser is set to a language that does not have a correspondi
 
     <*MBAM Self-Service Install Directory*>\\Self Service Website\\
 
-    **Note**  
+    **Note**  
     Some language folders already exist, so you may not have to create one. If you do need to create a language folder, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947) for a list of the valid names that you can use for the <*language*> folder.
 
-     
+
 
 2.  Create a notice.txt file that contains the localized notice text.
 
@@ -255,8 +257,8 @@ If you are upgrading to MBAM 2.0 SP1 and you are using MBAM with Configuration M
     // Microsoft BitLocker Administration and Monitoring 
     //===================================================
 
-#pragma namespace ("\\\\.\\root\\cimv2")
-#pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) 
+# pragma namespace ("\\\\.\\root\\cimv2")
+# pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) 
     [Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")]
     class Win32_BitLockerEncryptionDetails
     {
@@ -288,19 +290,19 @@ If you are upgrading to MBAM 2.0 SP1 and you are using MBAM with Configuration M
         Boolean     IsAutoUnlockEnabled;
     };
 
-#pragma namespace ("\\\\.\\root\\cimv2")
-#pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL)
+# pragma namespace ("\\\\.\\root\\cimv2")
+# pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL)
      [DYNPROPS]
     Class Win32Reg_MBAMPolicy
     {
         [key]
         string KeyName;
-        
+
         //General encryption requirements
         UInt32    OsDriveEncryption;
         UInt32    FixedDataDriveEncryption;
         UInt32    EncryptionMethod;
-        
+
         //Required protectors properties
         UInt32    OsDriveProtector;
         UInt32    FixedDataDriveAutoUnlock;
@@ -320,7 +322,7 @@ If you are upgrading to MBAM 2.0 SP1 and you are using MBAM with Configuration M
     Instance of Win32Reg_MBAMPolicy
     {
         KeyName="BitLocker policy";
-        
+
         //General encryption requirements
         [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")]
         OsDriveEncryption;
@@ -328,7 +330,7 @@ If you are upgrading to MBAM 2.0 SP1 and you are using MBAM with Configuration M
         FixedDataDriveEncryption;
         [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")]
         EncryptionMethod;
-        
+
         //Required protectors properties
         [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")]
         OsDriveProtector;
@@ -350,19 +352,19 @@ If you are upgrading to MBAM 2.0 SP1 and you are using MBAM with Configuration M
         EncodedComputerName;
     };
 
-#pragma namespace ("\\\\.\\root\\cimv2")
-#pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL)
+# pragma namespace ("\\\\.\\root\\cimv2")
+# pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL)
     [DYNPROPS]
     Class Win32Reg_MBAMPolicy_64
     {
         [key]
         string KeyName;
-        
+
         //General encryption requirements
         UInt32    OsDriveEncryption;
         UInt32    FixedDataDriveEncryption;
         UInt32    EncryptionMethod;
-        
+
         //Required protectors properties
         UInt32    OsDriveProtector;
         UInt32    FixedDataDriveAutoUnlock;
@@ -382,7 +384,7 @@ If you are upgrading to MBAM 2.0 SP1 and you are using MBAM with Configuration M
     Instance of Win32Reg_MBAMPolicy_64
     {
         KeyName="BitLocker policy 64";
-        
+
         //General encryption requirements
         [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")]
         OsDriveEncryption;
@@ -390,7 +392,7 @@ If you are upgrading to MBAM 2.0 SP1 and you are using MBAM with Configuration M
         FixedDataDriveEncryption;
         [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")]
         EncryptionMethod;
-        
+
         //Required protectors properties
         [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")]
         OsDriveProtector;
@@ -412,8 +414,8 @@ If you are upgrading to MBAM 2.0 SP1 and you are using MBAM with Configuration M
         EncodedComputerName;
     };
 
-#pragma namespace ("\\\\.\\root\\cimv2")
-#pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL)
+# pragma namespace ("\\\\.\\root\\cimv2")
+# pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL)
     [Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"},
     dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")]
     class CCM_OperatingSystemExtended
@@ -424,8 +426,8 @@ If you are upgrading to MBAM 2.0 SP1 and you are using MBAM with Configuration M
         uint32     SKU;
     };
 
-#pragma namespace ("\\\\.\\root\\cimv2")
-#pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL)
+# pragma namespace ("\\\\.\\root\\cimv2")
+# pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL)
     [Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"},
     dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")]
     class CCM_ComputerSystemExtended
@@ -478,9 +480,9 @@ MBAM 2.0 SP1 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP i
 
 [Release Notes for MBAM 2.0 SP1](release-notes-for-mbam-20-sp1.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/about-the-computer-tpm-chip.md b/mdop/mbam-v2/about-the-computer-tpm-chip.md
index ca9b55f6f4..8c951c73f2 100644
--- a/mdop/mbam-v2/about-the-computer-tpm-chip.md
+++ b/mdop/mbam-v2/about-the-computer-tpm-chip.md
@@ -1,12 +1,15 @@
 ---
 title: About the Computer TPM Chip
 description: About the Computer TPM Chip
-author: jamiejdt
+author: dansimp
 ms.assetid: 6f1cf18c-277a-4932-886d-14202ca8d175
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -26,7 +29,7 @@ After BitLocker is configured, you can access additional information about the T
 **Note**  
 You must have administrative credentials on your computer to access this tool.
 
- 
+ 
 
 In a TPM failure, a change in the BIOS, or certain Windows Updates, BitLocker will lock your computer and require you to contact your Help Desk to unlock it. You have to provide the name of your computer as well as your computer’s domain. Help Desk can give you a password file that can be used to unlock your computer.
 
@@ -42,9 +45,9 @@ If a TPM failure, change in the BIOS, or certain Windows Updates occur, BitLocke
 
 [Using Your PIN or Password](using-your-pin-or-password.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md b/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md
index f4215c49ea..0103e4791e 100644
--- a/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/accessibility-for-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Accessibility for MBAM 2.0
 description: Accessibility for MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 9cd628f1-f594-43ab-8095-4663272940a9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -30,7 +33,7 @@ Access keys let you quickly use a command by pressing a few keys. You can get to
 **Note**  
 To cancel the action that you are taking and hide the keyboard shortcuts, press ALT.
 
- 
+ 
 
 ## Documentation in Alternative Formats
 
@@ -64,13 +67,13 @@ For information about the availability of Microsoft product documentation and bo
 
          (609) 987-8116
          
 
 
-
          [http://www.learningally.org/](https://go.microsoft.com/fwlink/?linkid=239)
          
+
          http://www.learningally.org/
          
 
          Web addresses can change, so you might be unable to connect to the website or sites mentioned here.
          
 
 
 
 
- 
+ 
 
 ## Customer Service for People with Hearing Impairments
 
@@ -93,9 +96,9 @@ For more information about how accessible technology for computers helps to impr
 
 [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md b/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md
index 95fbd3b46a..fc6335b69f 100644
--- a/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md
+++ b/mdop/mbam-v2/administering-mbam-20-features-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Administering MBAM 2.0 Features
 description: Administering MBAM 2.0 Features
-author: jamiejdt
+author: dansimp
 ms.assetid: 065e0704-069e-4372-9b86-0b57dd7638dd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -38,7 +41,7 @@ MBAM provides a custom control panel, called BitLocker Encryption Options, that
 **Note**  
 This customized control panel does not replace the default Windows BitLocker control panel.
 
- 
+ 
 
 [How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel](how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md)
 
@@ -47,9 +50,9 @@ This customized control panel does not replace the default Windows BitLocker con
 
 [Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md b/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md
index 33e355889e..87d58f9e89 100644
--- a/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md
+++ b/mdop/mbam-v2/administering-mbam-20-using-powershell-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Administering MBAM 2.0 Using PowerShell
 description: Administering MBAM 2.0 Using PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: d785a8df-0a8c-4d70-abd2-93a762b4f3de
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md b/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md
index e63a58503e..9d05e02689 100644
--- a/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md
+++ b/mdop/mbam-v2/create-or-edit-the-sms-defmof-file.md
@@ -1,12 +1,15 @@
 ---
 title: Create or Edit the Sms\_def.mof File
 description: Create or Edit the Sms\_def.mof File
-author: jamiejdt
+author: dansimp
 ms.assetid: d1747e43-484e-4031-a63b-6342fe588aa2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/04/2017
 ---
 
diff --git a/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md b/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md
index 4e9af48d46..da944127c7 100644
--- a/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md
+++ b/mdop/mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying MBAM 2.0 Group Policy Objects
 description: Deploying MBAM 2.0 Group Policy Objects
-author: jamiejdt
+author: dansimp
 ms.assetid: f17f3897-73ab-431b-a6ec-5a6cff9f279a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/deploying-mbam-20-mbam-2.md b/mdop/mbam-v2/deploying-mbam-20-mbam-2.md
index 49853a0cfc..6f40b9722f 100644
--- a/mdop/mbam-v2/deploying-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/deploying-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying MBAM 2.0
 description: Deploying MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 4b0eaf10-81b4-427e-9d43-eb833de935a3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md b/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md
index aa1d1b5c42..ae87ad3b57 100644
--- a/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md
+++ b/mdop/mbam-v2/deploying-mbam-with-configuration-manager-mbam2.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying MBAM with Configuration Manager
 description: Deploying MBAM with Configuration Manager
-author: jamiejdt
+author: dansimp
 ms.assetid: 89d03e29-457a-471d-b893-e0b74a83ec50
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md b/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md
index 2d84616906..66a8831e05 100644
--- a/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md
+++ b/mdop/mbam-v2/deploying-the-mbam-20-client-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the MBAM 2.0 Client
 description: Deploying the MBAM 2.0 Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 3dd584fe-2a54-40f0-9bab-13ea74040b01
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md b/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md
index b82a55af14..ba8831debe 100644
--- a/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md
+++ b/mdop/mbam-v2/deploying-the-mbam-20-server-infrastructure-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the MBAM 2.0 Server Infrastructure
 description: Deploying the MBAM 2.0 Server Infrastructure
-author: jamiejdt
+author: dansimp
 ms.assetid: 52e68d94-e2b4-4b06-ae55-f900ea6cc59f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/edit-the-configurationmof-file.md b/mdop/mbam-v2/edit-the-configurationmof-file.md
index c84189e893..d1b6c423a7 100644
--- a/mdop/mbam-v2/edit-the-configurationmof-file.md
+++ b/mdop/mbam-v2/edit-the-configurationmof-file.md
@@ -1,12 +1,15 @@
 ---
 title: Edit the Configuration.mof File
 description: Edit the Configuration.mof File
-author: jamiejdt
+author: dansimp
 ms.assetid: 23e50ec9-4083-4b12-ad96-626cf30960bb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/03/2017
 ---
 
@@ -23,7 +26,7 @@ If you are installing Microsoft BitLocker Administration and Monitoring (MBAM) 2
 
 -   For an upgrade to MBAM 2.0 SP1, see **Update the configuration.mof file if you upgrade to MBAM 2.0 SP1 and you are using MBAM with Configuration Manager 2007**.
 
- 
+ 
 
 **To create the configuration.mof file if you are using MBAM 2.0 SP1 with Configuration Manager**
 
@@ -376,9 +379,9 @@ If you are installing Microsoft BitLocker Administration and Monitoring (MBAM) 2
 
 [Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md b/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md
index 3372d0022d..9381657ebb 100644
--- a/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/evaluating-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Evaluating MBAM 2.0
 description: Evaluating MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: bfc77eec-0fd7-4fec-9c78-6870afa87152
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -44,43 +47,43 @@ Even though you are setting up a non-production instance of MBAM to evaluate in
 
 Checklist box
 
          Review the Getting Started information about MBAM to gain a basic understanding of the product before beginning deployment planning.
          
-
          [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md)
          
+
          Getting Started with MBAM 2.0
          
 
          
 
 
 Checklist box
 
          Plan for MBAM 2.0 Deployment Prerequisites and prepare your computing environment.
          
-
          [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md)
          
+
          MBAM 2.0 Deployment Prerequisites
          
 
          
 
 
 Checklist box
 
          Plan for and configure MBAM Group Policy requirements.
          
-
          [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md)
          
+
          Planning for MBAM 2.0 Group Policy Requirements
          
 
          
 
 
 Checklist box
 
          Plan for and create necessary Active Directory Domain Services security groups, and plan for MBAM local security group membership requirements.
          
-
          [Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md)
          
+
          Planning for MBAM 2.0 Administrator Roles
          
 
          
 
 
 Checklist box
 
          Plan for deploying MBAM Server feature deployment.
          
-
          [Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md)
          
+
          Planning for MBAM 2.0 Server Deployment
          
 
          
 
 
 Checklist box
 
          Plan for deploying MBAM Client deployment.
          
-
          [Planning for MBAM 2.0 Client Deployment](planning-for-mbam-20-client-deployment-mbam-2.md)
          
+
          Planning for MBAM 2.0 Client Deployment
          
 
          
 
 
 
 
- 
+ 
 
 ### Perform an MBAM Evaluation Deployment
 
@@ -97,37 +100,37 @@ After completing the necessary planning and software prerequisite installations
 
 Checklist box
 
          Review the MBAM supported configurations information to make sure that selected client and server computers are supported for MBAM feature installation.
          
-
          [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md)
          
+
          MBAM 2.0 Supported Configurations
          
 
          
 
 
 Checklist box
 
          Run MBAM Setup to deploy MBAM Server features on a single server for evaluation purposes.
          
-
          [How to Install and Configure MBAM on a Single Server](how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md)
          
+
          How to Install and Configure MBAM on a Single Server
          
 
          
 
 
 Checklist box
 
          Add Active Directory Domain Services security groups, that you created during the planning phase, to the appropriate local MBAM Server feature local groups on the new MBAM Server.
          
-
          [Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md) and [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md)
          
+
          Planning for MBAM 2.0 Administrator Roles and How to Manage MBAM Administrator Roles
          
 
          
 
 
 Checklist box
 
          Create and deploy required MBAM Group Policy Objects.
          
-
          [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md)
          
+
          Deploying MBAM 2.0 Group Policy Objects
          
 
          
 
 
 Checklist box
 
          Deploy the MBAM Client software.
          
-
          [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md)
          
+
          Deploying the MBAM 2.0 Client
          
 
          
 
 
 
 
- 
+ 
 
 ## Configure Lab Computers for MBAM Evaluation
 
@@ -137,7 +140,7 @@ This section contains information that can be used to speed up the MBAM Client s
 **Note**  
 The information in following section describes how to modify the Windows registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall Windows. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.
 
- 
+ 
 
 ### Modify MBAM Client Status Reporting Frequency Settings
 
@@ -154,7 +157,7 @@ To modify the MBAM Client status reporting frequency settings:
 **Note**  
 To set values that are this low, you must set them in the registry manually.
 
- 
+ 
 
 ### Modify MBAM Client Service Startup Delay
 
@@ -165,9 +168,9 @@ In addition to the MBAM Client wakeup and status reporting frequencies, there is
 
 [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md b/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md
index 602db947ed..a2a80d1262 100644
--- a/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md
+++ b/mdop/mbam-v2/getting-started---using-mbam-with-configuration-manager.md
@@ -1,12 +1,15 @@
 ---
 title: Getting Started - Using MBAM with Configuration Manager
 description: Getting Started - Using MBAM with Configuration Manager
-author: jamiejdt
+author: dansimp
 ms.assetid: b0a1d3cc-0b01-4b69-a2cd-fd09fb3beda4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ When you install Microsoft BitLocker Administration and Monitoring (MBAM), you c
 **Important**  
 Windows To Go is not supported when you install the integrated topology of MBAM with Configuration Manager 2007.
 
- 
+ 
 
 ## Using MBAM with Configuration Manager
 
@@ -94,9 +97,9 @@ A description of the servers, databases, and features of this architecture follo
 
 [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md b/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md
index 3344fab13c..0183c9e902 100644
--- a/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/getting-started-with-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Getting Started with MBAM 2.0
 description: Getting Started with MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 29f5c9af-5bbf-4d37-aa0f-0716046904af
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/mbam-v2/helping-end-users-manage-bitlocker.md b/mdop/mbam-v2/helping-end-users-manage-bitlocker.md
index 65850cd2a5..b3c0e338c5 100644
--- a/mdop/mbam-v2/helping-end-users-manage-bitlocker.md
+++ b/mdop/mbam-v2/helping-end-users-manage-bitlocker.md
@@ -1,12 +1,15 @@
 ---
 title: Helping End Users Manage BitLocker
 description: Helping End Users Manage BitLocker
-author: jamiejdt
+author: dansimp
 ms.assetid: 47776fb3-2d94-4970-b687-c35ec3dd6c64
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -36,7 +39,7 @@ You can turn off BitLocker, either temporarily, by suspending it, or permanently
 **Note**  
 Because BitLocker encrypts the whole drive and not just the individual files themselves, be careful when you move sensitive data between drives. If you move a file from a BitLocker-protected drive to a nonencrypted drive, the file will no longer be encrypted.
 
- 
+ 
 
 ## About the BitLocker Encryption Options Application
 
@@ -78,9 +81,9 @@ In this section, you can view information about external drives (such as a USB t
 
 -   **Disk Management** -open the Disk Management tool. From here you can view the information for all hard drives connected to the computer and configure partitions and drive options. You must have administrative rights on your computer to access this tool.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md b/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md
index ec4172028d..810ca0e569 100644
--- a/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/high-availability-for-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: High Availability for MBAM 2.0
 description: High Availability for MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 244ee013-9e2a-48d2-b842-4e10594fd74f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md b/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md
index 682798b403..99d1616b22 100644
--- a/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/high-level-architecture-for-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: High-Level Architecture for MBAM 2.0
 description: High-Level Architecture for MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 7f73dd3a-0b1f-4af6-a2f0-d0c5bc5d183a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,7 +26,7 @@ The following diagram shows the MBAM recommended architecture for a production e
 **Note**  
 A single-server architecture should be used only in test environments.
 
- 
+ 
 
 ![mbam 2 two-server deployment topology](images/mbam2-3-servers.gif)
 
@@ -70,9 +73,9 @@ The MBAM Client is installed on a Windows computer and has the following charact
 
 [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/how-to-brand-the-self-service-portal.md b/mdop/mbam-v2/how-to-brand-the-self-service-portal.md
index 6b6eda7259..e7b09a94a5 100644
--- a/mdop/mbam-v2/how-to-brand-the-self-service-portal.md
+++ b/mdop/mbam-v2/how-to-brand-the-self-service-portal.md
@@ -1,12 +1,15 @@
 ---
 title: How to Brand the Self-Service Portal
 description: How to Brand the Self-Service Portal
-author: jamiejdt
+author: dansimp
 ms.assetid: 3ef9e951-7c42-4f7f-b131-3765d39b3207
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -28,71 +31,73 @@ After you install the Microsoft BitLocker Administration and Monitoring (MBAM) S
 
 5.  From the **Name** column, select the item that you want to change, and change the default value to reflect the name that you want to use. The following table lists the values that you can set.
 
-    **Caution**  
+    **Caution**  
     Do not change the value in the Name column (CompanyName\*), as it will cause the Self-Service Portal to stop working.
 
-     
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
          



          NameDefault Value
          CompanyName*
          Contoso IT
          HelpdeskText*
          Contact Help Desk or IT Department
          HelpdeskUrl*
          Http://www.microsoft.com
          jQueryPath
          //ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js
          MicrosoftAjaxPath
          //ajax.aspnetcdn.com/ajax/3.5/MicrosoftAjax.js
          MicrosoftMvcAjaxPath
          //ajax.aspnetcdn.com/ajax/mvc/2.0/MicrosoftMvcValidation.js
          NoticeTextPath
          Notice.txt
          
-    
          
-    Note  
-    
          You can edit the Notice text either by using the IIS Manager or by opening and changing the Notice.txt file in the installation directory.
          
-    
          
-    
          
-     
-    
          
 
-     
+~~~
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
          



          NameDefault Value
          CompanyName*
          Contoso IT
          HelpdeskText*
          Contact Help Desk or IT Department
          HelpdeskUrl*
          Http://www.microsoft.com
          jQueryPath
          //ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.2.min.js
          MicrosoftAjaxPath
          //ajax.aspnetcdn.com/ajax/3.5/MicrosoftAjax.js
          MicrosoftMvcAjaxPath
          //ajax.aspnetcdn.com/ajax/mvc/2.0/MicrosoftMvcValidation.js
          NoticeTextPath
          Notice.txt
          
+
          
+Note  
+
          You can edit the Notice text either by using the IIS Manager or by opening and changing the Notice.txt file in the installation directory.
          
+
          
+
          
+
+
          
+~~~
+
+
 
 ## Related topics
 
 
 [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md b/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md
index b5c82d7821..c74822c16c 100644
--- a/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md
+++ b/mdop/mbam-v2/how-to-create-or-edit-the-mof-files.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create or Edit the mof Files
 description: How to Create or Edit the mof Files
-author: jamiejdt
+author: dansimp
 ms.assetid: 4d19d707-b90f-4057-a6e9-e4221a607190
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md b/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md
index 6f8061bf9c..59996d8297 100644
--- a/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md
+++ b/mdop/mbam-v2/how-to-deploy-the-mbam-client-as-part-of-a-windows-deployment-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy the MBAM Client as Part of a Windows Deployment
 description: How to Deploy the MBAM Client as Part of a Windows Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 67387de7-8b02-4412-9850-3b8d8e5c18af
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,26 +19,26 @@ ms.date: 06/16/2016
 
 The Microsoft BitLocker Administration and Monitoring (MBAM) Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. If computers that have a Trusted Platform Module (TPM) chip, the BitLocker client can be integrated into an organization by enabling BitLocker management and encryption on client computers as part of the imaging and Windows deployment process.
 
-**Note**  
+**Note**  
 To review the Microsoft BitLocker Administration and Monitoring Client system requirements, see [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md).
 
- 
+
 
 Encrypting client computers with BitLocker during the initial imaging stage of a Windows deployment can lower the administrative overhead necessary for implementing MBAM in an organization. It also ensures that every computer that is deployed already has BitLocker running and is configured correctly.
 
-**Note**  
+**Note**  
 The procedure in this topic describes modifying the Windows registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall Windows. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.
 
- 
+
 
 **To encrypt a computer as part of Windows deployment**
 
 1.  If your organization is planning to use the Trusted Platform Module (TPM) protector or the TPM + PIN protector options in BitLocker, you must activate the TPM chip before the initial deployment of MBAM. When you activate the TPM chip, you avoid a reboot later in the process, and you ensure that the TPM chips are correctly configured according to the requirements of your organization. You must activate the TPM chip manually in the BIOS of the computer.
 
-    **Note**  
+    **Note**  
     Some vendors provide tools to turn on and activate the TPM chip in the BIOS from within the operating system. Refer to the manufacturer documentation for more details about how to configure the TPM chip.
 
-     
+
 
 2.  Install the Microsoft BitLocker Administration and Monitoring client agent.
 
@@ -83,24 +86,26 @@ The procedure in this topic describes modifying the Windows registry. Using Regi
 
     Set this value to the URL for the Key Recovery web server, for example, http://<computer name>/MBAMRecoveryAndHardwareService/CoreService.svc.
 
-     
 
-    **Note**  
-    MBAM policy or registry values can be set here to override previously set values.
 
-     
+~~~
+**Note**  
+MBAM policy or registry values can be set here to override previously set values.
+~~~
 
-7.  The MBAM agent restarts the system during MBAM client deployment. When you are ready for this reboot, run the following command at a command prompt as an administrator:
 
-    **net start mbamagent**
 
-8.  When the computers restarts, and the BIOS prompts you to accept a TPM change, accept the change.
+7. The MBAM agent restarts the system during MBAM client deployment. When you are ready for this reboot, run the following command at a command prompt as an administrator:
 
-9.  During the Windows client operating system imaging process, when you are ready to start encryption, restart the MBAM agent service, and set start to **automatic** by running a command prompt as an administrator and typing the following commands:
+   **net start mbamagent**
 
-    **sc config mbamagent start= auto**
+8. When the computers restarts, and the BIOS prompts you to accept a TPM change, accept the change.
 
-    **net start mbamagent**
+9. During the Windows client operating system imaging process, when you are ready to start encryption, restart the MBAM agent service, and set start to **automatic** by running a command prompt as an administrator and typing the following commands:
+
+   **sc config mbamagent start= auto**
+
+   **net start mbamagent**
 
 10. Remove the bypass registry values by running Regedit and going to the HKLM\\SOFTWARE\\Microsoft registry entry. To delete the **MBAM** node, right-click the node and click **Delete**.
 
@@ -109,9 +114,9 @@ The procedure in this topic describes modifying the Windows registry. Using Regi
 
 [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md b/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md
index 825dc107df..c7b5c03238 100644
--- a/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md
+++ b/mdop/mbam-v2/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy the MBAM Client to Desktop or Laptop Computers
 description: How to Deploy the MBAM Client to Desktop or Laptop Computers
-author: jamiejdt
+author: dansimp
 ms.assetid: 56744922-bfdd-48f6-ae01-645ff53b64a8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The Microsoft BitLocker Administration and Monitoring (MBAM) client enables admi
 **Note**  
 To review the Microsoft BitLocker Administration and Monitoring Client system requirements, see [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md).
 
- 
+ 
 
 **To deploy the MBAM Client to desktop or laptop computers**
 
@@ -32,16 +35,16 @@ To review the Microsoft BitLocker Administration and Monitoring Client system re
     **Important**  
     The MBAM Client will not start BitLocker encryption actions if a remote desktop protocol connection is active. All remote console connections must be closed before BitLocker encryption will begin.
 
-     
+     
 
 ## Related topics
 
 
 [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md b/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md
index c238edfb99..46c10f9c67 100644
--- a/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md
+++ b/mdop/mbam-v2/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Determine BitLocker Encryption State of Lost Computers
 description: How to Determine BitLocker Encryption State of Lost Computers
-author: jamiejdt
+author: dansimp
 ms.assetid: dbd23b64-dff3-4913-9acd-affe67b9462e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,7 +26,7 @@ You can use Microsoft BitLocker Administration and Monitoring (MBAM) to determin
     **Note**  
     Note: The default address for the Administration and Monitoring website is http://*<computername>*. Using the fully qualified server name will yield faster browsing results.
 
-     
+     
 
 2.  Selects the **Report** node from the navigation pane, and select the **Computer Compliance Report**.
 
@@ -34,16 +37,16 @@ You can use Microsoft BitLocker Administration and Monitoring (MBAM) to determin
     **Note**  
     Device compliance is determined by the BitLocker policies that your enterprise has deployed. You may want to verify your deployed policies before you try to determine the BitLocker encryption state of a device.
 
-     
+     
 
 ## Related topics
 
 
 [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md b/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md
index 4760062caf..457d479a15 100644
--- a/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md
+++ b/mdop/mbam-v2/how-to-edit-mbam-20-gpo-settings-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Edit MBAM 2.0 GPO Settings
 description: How to Edit MBAM 2.0 GPO Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: f5ffa93d-b4d2-4317-8a1c-7d2be0264fe3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -64,21 +67,23 @@ You can use the following steps to configure the basic, recommended GPO settings
     
     
 
-     
 
-    **Important**  
-    Depending on the policies that your organization decides to deploy, you may have to configure additional policies. See [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) for Group Policy configuration details for all of the available MBAM GPO policy options.
 
-     
+~~~
+**Important**  
+Depending on the policies that your organization decides to deploy, you may have to configure additional policies. See [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md) for Group Policy configuration details for all of the available MBAM GPO policy options.
+~~~
+
+
 
 ## Related topics
 
 
 [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md b/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md
index 97e353b4fd..601184d6e5 100644
--- a/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md
+++ b/mdop/mbam-v2/how-to-generate-mbam-reports-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Generate MBAM Reports
 description: How to Generate MBAM Reports
-author: jamiejdt
+author: dansimp
 ms.assetid: 083550cb-8c3f-49b3-a30e-97d85374d2f4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ When you install Microsoft BitLocker Administration and Monitoring (MBAM) with t
 **Note**  
 To run the reports, you must be a member of the **Report Users Role** on the computers where the Administration and Monitoring Server features, Compliance and Audit Database, and Compliance and Audit Reports are installed.
 
- 
+ 
 
 **To open the Administration and Monitoring website**
 
@@ -28,7 +31,7 @@ To run the reports, you must be a member of the **Report Users Role** on the com
     **Note**  
     If the Administration and Monitoring website was installed on a port other than 80, you have to specify the port in the URL (for example, *http://<computername>:<port>*. If you specified a host name for the Administration and Monitoring website during the installation, the URL is *http://<hostname>*.
 
-     
+     
 
 2.  In the left pane, click **Reports** and then select the report you want to run from the top menu bar.
 
@@ -37,7 +40,7 @@ To run the reports, you must be a member of the **Report Users Role** on the com
     **Note**  
     If SSRS was not configured to use Secure Socket Layer, the URL for the reports will be set to HTTP instead of to HTTPS when you install the MBAM Server. If you then go to the Help Desk portal and select a report, the following message displays: “Only Secure Content is Displayed.” To show the report, click **Show All Content**.
 
-     
+     
 
 **To generate an Enterprise Compliance Report**
 
@@ -54,7 +57,7 @@ To run the reports, you must be a member of the **Report Users Role** on the com
     **Note**  
     The Enterprise Compliance report is generated by a SQL job that runs every six hours. Therefore, the first time you view the report, you may find that some data is missing. You can generate updated report data manually by using SQL Management Studio. From the **Object Explorer** window, expand **SQL Server Agent**, expand **Jobs**, right-click the **CreateCache** job, and select **Start Job at Step….**
 
-     
+     
 
 3.  Select a computer name to view information about the computer in the Computer Compliance Report.
 
@@ -75,7 +78,7 @@ To run the reports, you must be a member of the **Report Users Role** on the com
     **Note**  
     An MBAM client computer is considered compliant if the computer matches the requirements of the MBAM policy settings.
 
-     
+     
 
 **To generate the Recovery Key Audit Report**
 
@@ -102,9 +105,9 @@ To run the reports, you must be a member of the **Report Users Role** on the com
 
 [Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md b/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md
index 016b3d8291..73915791b9 100644
--- a/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md
+++ b/mdop/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Hide Default BitLocker Encryption in the Windows Control Panel
 description: How to Hide Default BitLocker Encryption in the Windows Control Panel
-author: jamiejdt
+author: dansimp
 ms.assetid: 6674aa51-2b5d-4e4a-8b43-2cc18d008285
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md b/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md
index bd592ec1ee..593e8d34e5 100644
--- a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md
+++ b/mdop/mbam-v2/how-to-install-and-configure-mbam-on-a-single-server-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install and Configure MBAM on a Single Server
 description: How to Install and Configure MBAM on a Single Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 45e6a012-6c8c-4d90-902c-d09de9a0cbea
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -22,12 +25,12 @@ The following diagram shows an example of a single-server architecture. For a de
 
 Each server feature has certain prerequisites. To verify that you have met the prerequisites and hardware and software requirements, see [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) and [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). In addition, some features also have information that must be provided during the installation process to successfully deploy the feature. You should also review [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md) before you start MBAM deployment.
 
-**Note**  
+**Note**  
 To obtain the setup log files, you have use the Msiexec package and the **/L** <location> option to install MBAM. Log files are created in the location that you specify.
 
 Additional setup log files are created in the %temp% folder on the server of the user who is installing MBAM.
 
- 
+
 
 ## To install MBAM Server features on a single server
 
@@ -58,17 +61,17 @@ The following steps describe how to install general MBAM features.
 
     -   MBAM Group Policy template
 
-    **Note**  
+    **Note**  
     The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all of the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation resumes.
 
-     
+
 
 6.  On the **Configure network communication security** page, choose whether to encrypt the communication between the Web Services on the Administration and Monitoring Server and the clients. If you decide to encrypt the communication, select the certification authority-provisioned certificate to use for encryption. The certificate must be created prior to this step to enable you to select it on this page.
 
-    **Note**  
+    **Note**  
     This page appears only if you selected the Self-Service Portal or the Administration and Monitoring Server feature on the **Select features to install** page.
 
-     
+
 
 7.  Click **Next**, and then continue to the next set of steps to configure the MBAM Server features.
 
@@ -88,10 +91,10 @@ The following steps describe how to install general MBAM features.
 
 7.  On the **Configure the Self-Service Portal** page, enter the port number, host name, virtual directory name, and installation path for the Self-Service Portal.
 
-    **Note**  
+    **Note**  
     The port number that you specify must be an unused port number on the Administration and Monitoring Server unless you specify a unique host header name. If you are using Windows Firewall, the port will be opened automatically.
 
-     
+
 
 8.  Click **Next** to continue.
 
@@ -99,10 +102,10 @@ The following steps describe how to install general MBAM features.
 
 10. On the **Configure the Administration and Monitoring Server** page, enter the port number, host name, virtual directory name, and installation path for the Help Desk website.
 
-    **Note**  
+    **Note**  
     The port number that you specify must be an unused port number on the Administration and Monitoring Server unless you specify a unique host header name. If you are using Windows Firewall, the port will be opened automatically.
 
-     
+
 
 11. On the **Installation Summary** page, review the list of features that will be installed, and click **Install** to start installing the MBAM features. Click **Back** to move back through the wizard if you have to review or change your installation settings, or click **Cancel** to exit Setup. Setup installs the MBAM features and notifies you that the installation is complete.
 
@@ -122,10 +125,10 @@ The following steps describe how to install general MBAM features.
 
     -   Brand the Self-Service Portal with your company name, notice text, and other company-specific information. For instructions, see [How to Brand the Self-Service Portal](how-to-brand-the-self-service-portal.md).
 
-    **Note**  
+    **Note**  
     Identical user or group membership of the **MBAM Report Users** local group must be maintained on all computers where the MBAM Administration and Monitoring Server features, Compliance and Audit Database, and Compliance and Audit Reports are installed. The recommended way to do this is to create a domain security group and add that domain group to each local MBAM Report Users group. When you use this process, manage the group memberships by way of the domain group.
 
-     
+
 
 ## Validating the MBAM Server feature installation
 
@@ -134,66 +137,68 @@ When the Microsoft BitLocker Administration and Monitoring installation is compl
 
 **To validate the MBAM Server feature installation**
 
-1.  On each server where a MBAM feature is deployed, open **Control Panel**. Select **Programs**, and then select **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list.
+1. On each server where a MBAM feature is deployed, open **Control Panel**. Select **Programs**, and then select **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list.
 
-    **Note**  
-    To validate the installation, you must use a domain account that has local computer administrative credentials on each server.
+   **Note**  
+   To validate the installation, you must use a domain account that has local computer administrative credentials on each server.
 
-     
 
-2.  On the server where the Recovery Database is installed, open SQL Server Management Studio, and verify that the **MBAM Recovery and Hardware** database is installed.
 
-3.  On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio, and verify that the **MBAM Compliance Status Database** is installed.
+2. On the server where the Recovery Database is installed, open SQL Server Management Studio, and verify that the **MBAM Recovery and Hardware** database is installed.
 
-4.  On the server where the Compliance and Audit Reports are installed, open a web browser with administrative credentials and browse to the “Home” of the SQL Server Reporting Services site.
+3. On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio, and verify that the **MBAM Compliance Status Database** is installed.
 
-    The default Home location of a SQL Server Reporting Services site instance is at http://*<NameofMBAMReportsServer>*/Reports. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances that are specified during setup.
+4. On the server where the Compliance and Audit Reports are installed, open a web browser with administrative credentials and browse to the “Home” of the SQL Server Reporting Services site.
 
-    Confirm that a Reports folder named Microsoft BitLocker Administration and Monitoring contains a data source called **MaltaDataSource** and that an **en-us** folder contains four reports.
+   The default Home location of a SQL Server Reporting Services site instance is at http://<NameofMBAMReportsServer>/Reports. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances that are specified during setup.
 
-    **Note**  
-    If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following: http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>*
+   Confirm that a Reports folder named Microsoft BitLocker Administration and Monitoring contains a data source called **MaltaDataSource** and that an **en-us** folder contains four reports.
 
-     
+   **Note**  
+   If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following: http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>*
 
-    **Note**  
-    If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then go to the Administration and Monitoring website and select a report, the following message appears: “Only Secure Content is Displayed.” To show the report, click **Show All Content**.
 
-     
 
-5.  On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**. Select **Web Server (IIS)**, and then click **Internet Information Services (IIS) Manager.**
+~~~
+**Note**  
+If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then go to the Administration and Monitoring website and select a report, the following message appears: “Only Secure Content is Displayed.” To show the report, click **Show All Content**.
+~~~
 
-6.  In **Connections,** browse to *<computername>*, select **Sites**, and then select **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMUserSupportService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed.
 
-7.  On the server where the Administration and Monitoring features and Self-Service Portal are installed, open a web browser with administrative credentials and browse to the following locations to verify that they load successfully:
 
-    -   *http://<hostname>/HelpDesk/default.aspx* and confirm each of the links for navigation and reports
+5. On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**. Select **Web Server (IIS)**, and then click **Internet Information Services (IIS) Manager.**
 
-    -   *http://<hostname>/SelfService>/*
+6. In **Connections,** browse to *<computername>*, select **Sites**, and then select **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMUserSupportService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed.
 
-    -   *http://<computername>/MBAMAdministrationService/AdministrationService.svc*
+7. On the server where the Administration and Monitoring features and Self-Service Portal are installed, open a web browser with administrative credentials and browse to the following locations to verify that they load successfully:
 
-    -   *http://<hostname>/MBAMUserSupportService/UserSupportService.svc*
+   -   *http://<hostname>/HelpDesk/default.aspx* and confirm each of the links for navigation and reports
 
-    -   *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc*
+   -   *http://<hostname>/SelfService>/*
 
-    -   *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc*
+   -   *http://<computername>/MBAMAdministrationService/AdministrationService.svc*
 
-    **Note**  
-    It is assumed that the server features were installed on the default port without network encryption. If you installed the server features on a different port or virtual directory, change the URLs to include the appropriate port, for example, *http://<hostname>:<port>/HelpDesk/default.asp*x or*http://<hostname>:<port>/<virtualdirectory>/default.aspx*
+   -   *http://<hostname>/MBAMUserSupportService/UserSupportService.svc*
+
+   -   *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc*
+
+   -   *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc*
+
+   **Note**  
+   It is assumed that the server features were installed on the default port without network encryption. If you installed the server features on a different port or virtual directory, change the URLs to include the appropriate port, for example, *http://<hostname>:<port>/HelpDesk/default.asp*x or*http://<hostname>:<port>/<virtualdirectory>/default.aspx*
+
+   If the server features were installed with network encryption, change http:// to https://.
 
-    If the server features were installed with network encryption, change http:// to https://.
 
-     
 
 ## Related topics
 
 
 [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md b/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md
index e188506848..c4e74fd53a 100644
--- a/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md
+++ b/mdop/mbam-v2/how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install and Configure MBAM on Distributed Servers
 description: How to Install and Configure MBAM on Distributed Servers
-author: jamiejdt
+author: dansimp
 ms.assetid: 67b91e6b-ae2e-4e47-9ef2-6819aba95976
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -18,12 +21,12 @@ The procedures in this topic describe how to install Microsoft BitLocker Adminis
 
 Each server feature has certain prerequisites. To verify that you have met the prerequisites and hardware and software requirements, see [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md) and [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md). In addition, some features require that you provide certain information during the installation process to successfully deploy the feature. You should also review [Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md) before you start the MBAM deployment.
 
-**Note**  
+**Note**  
 To obtain the setup log files, you have to use the Msiexec package and the **/L** <location> option to install MBAM. Log files are created in the location that you specify.
 
 Additional setup log files are created in the %temp% folder on the server of the user who is installing MBAM.
 
- 
+
 
 ## Deploying MBAM Server Features
 
@@ -40,10 +43,10 @@ The following steps describe how to install general MBAM features.
 
 4.  On the **Topology Selection** page, select the **Stand-alone** topology, and then click **Next**.
 
-    **Note**  
+    **Note**  
     If you want to install MBAM with the Configuration Manager integrated topology, see [Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md).
 
-     
+
 
 5.  Select the features that you want to install. By default, all MBAM features are selected for installation. Clear the features that you want to install elsewhere. Features that will be installed on the same computer must be installed together at the same time. You must install MBAM features in the following order:
 
@@ -59,17 +62,19 @@ The following steps describe how to install general MBAM features.
 
     -   MBAM Group Policy template
 
-    **Note**  
+    **Note**  
     The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all of the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation resumes.
 
-     
 
-    The MBAM Setup wizard displays installation pages for the features that you select. The following sections describe the installation procedures for each feature.
 
-    **Note**  
-    For the following instructions, it is assumed that each feature is to be installed on a separate server. If you install multiple features on a single server, you can change or eliminate some steps.
+~~~
+The MBAM Setup wizard displays installation pages for the features that you select. The following sections describe the installation procedures for each feature.
+
+**Note**  
+For the following instructions, it is assumed that each feature is to be installed on a separate server. If you install multiple features on a single server, you can change or eliminate some steps.
+~~~
+
 
-     
 
 **To install the Recovery Database**
 
@@ -87,10 +92,10 @@ The following steps describe how to install general MBAM features.
 
 2.  Specify the computer names of the computers that will be running the Administration and Monitoring Server and the Compliance and Audit Reports. After the Administration and Monitoring and the Compliance and Audit Reports Server are deployed, they use their domain accounts to connect to the databases.
 
-    **Note**  
+    **Note**  
     If you are installing the Compliance and Audit Database without the Compliance and Audit Reports feature, you must add an exception on the Compliance and Audit Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433.
 
-     
+
 
 3.  Specify the SQL Server instance name and the name of the database that will store the compliance and audit data. You must also specify where the database and log information will be located.
 
@@ -100,10 +105,10 @@ The following steps describe how to install general MBAM features.
 
 1.  On the **Configure the Compliance and Audit Reports** page, specify the remote SQL Server instance name (for example, <ServerName>) where the Compliance and Audit Database was installed.
 
-    **Note**  
+    **Note**  
     If you are installing the Compliance and Audit Reports without the Administration and Monitoring Server, you must add an exception on the Compliance and Audit Report computer to enable inbound traffic on the Reporting Server port (the default port is 80).
 
-     
+
 
 2.  Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status, although you can change the name when you install the Compliance and Audit Database.
 
@@ -133,10 +138,10 @@ The following steps describe how to install general MBAM features.
 
 9.  Enter the **Port Number**, the **Host Name** (optional), and the **Installation Path** for the MBAM Administration and Monitoring Server.
 
-    **Note**  
+    **Note**  
     The port number that you specify must be an unused port number on the Administration and Monitoring server unless you specify a unique host header name. If you are using Windows Firewall, the port will be opened automatically.
 
-     
+
 
 10. To optionally register a Service Principal Name (SPN) for the Self-Service Portal, select **Register this machine’s Service Principal Names (SPN) with Active Directory (Required for Windows Authentication)**. If you select this check box, MBAM Setup will not try to register the existing SPNs, and you can manually register the SPN before or after the MBAM installation. For instructions on registering the SPN manually, see [Manual SPN Registration](https://go.microsoft.com/fwlink/?LinkId=286758).
 
@@ -148,85 +153,85 @@ The following steps describe how to install general MBAM features.
 
 14. Click **Finish** to exit the wizard.
 
-    **Note**  
+    **Note**  
     To configure the Self-Service Portal after you installed it, brand the Self-Service Portal with your company name and other company-specific information, see [How to Brand the Self-Service Portal](how-to-brand-the-self-service-portal.md) for instructions.
 
-     
+
 
 15. If the client computers have access to the Microsoft Content Delivery Network (CDN), which gives the Self-Service Portal the required access to certain JavaScript files, you are finished with the Self-Service Portal installation. If the client computers does not have access to the Microsoft CDN, complete the steps in the next section to configure the Self-Service Portal to reference the JavaScript files from an accessible source.
 
 **To configure the Self-Service Portal when end users cannot access the Microsoft Content Delivery Network**
 
-1.  If the client computers have access to the Microsoft Content Delivery Network (CDN), which gives the Self-Service Portal the required access to certain JavaScript files, the Self-Service Portal installation is completed. If the client computers do not have access to the Microsoft CDN, complete the remaining steps in this section to configure the Self-Service Portal to reference the JavaScript files from an accessible source.
+1. If the client computers have access to the Microsoft Content Delivery Network (CDN), which gives the Self-Service Portal the required access to certain JavaScript files, the Self-Service Portal installation is completed. If the client computers do not have access to the Microsoft CDN, complete the remaining steps in this section to configure the Self-Service Portal to reference the JavaScript files from an accessible source.
 
-2.  Download the four JavaScript files from the Microsoft CDN:
+2. Download the four JavaScript files from the Microsoft CDN:
 
-    -   jQuery-1.7.2.min.js - [https://go.microsoft.com/p/fwlink/?LinkID=271736](https://go.microsoft.com/fwlink/p/?LinkID=271736)
+   -   jQuery-1.7.2.min.js - [https://go.microsoft.com/p/fwlink/?LinkID=271736](https://go.microsoft.com/fwlink/p/?LinkID=271736)
 
-    -   MicrosoftAjax.js –[https://go.microsoft.com/p/fwlink/?LinkId=272283](https://go.microsoft.com/fwlink/p/?LinkId=272283)
+   -   MicrosoftAjax.js –[https://go.microsoft.com/p/fwlink/?LinkId=272283](https://go.microsoft.com/fwlink/p/?LinkId=272283)
 
-    -   MicrosoftMvcAjax.js - [https://go.microsoft.com/p/fwlink/?LinkId=272284](https://go.microsoft.com/fwlink/p/?LinkId=272284)
+   -   MicrosoftMvcAjax.js - [https://go.microsoft.com/p/fwlink/?LinkId=272284](https://go.microsoft.com/fwlink/p/?LinkId=272284)
 
-    -   MicrosoftMvcValidation.js - 
+   -   MicrosoftMvcValidation.js - 
 
-3.  Copy the JavaScript files to the **Scripts** directory of the Self-Service Portal. This directory is located in *<MBAM Self-Service Install Directory>\\*Self Service Website\\Scripts.
+3. Copy the JavaScript files to the **Scripts** directory of the Self-Service Portal. This directory is located in <MBAM Self-Service Install Directory>\\Self Service Website\\Scripts.
 
-4.  Open **Internet Information Services (IIS) Manager**.
+4. Open **Internet Information Services (IIS) Manager**.
 
-5.  Expand **Sites** > **Microsoft BitLocker Administration and Monitoring**, and highlight **SelfService**.
+5. Expand **Sites** > **Microsoft BitLocker Administration and Monitoring**, and highlight **SelfService**.
 
-    **Note**  
-    *SelfService* is the default virtual directory name. If you chose a different name for this directory during installation, remember to replace *SelfService* in the rest of these instructions with the name you chose.
+   **Note**  
+   *SelfService* is the default virtual directory name. If you chose a different name for this directory during installation, remember to replace *SelfService* in the rest of these instructions with the name you chose.
 
-     
 
-6.  In the middle pane, double-click **Application Settings**.
 
-7.  For each item in the following list, edit the application settings to reference the new location by replacing <virtual directory> with /SelfService/ (or the name you chose during installation). For example, the virtual directory path will be similar to /selfservice/scripts/jquery-1.7.2.min.js.
+6. In the middle pane, double-click **Application Settings**.
 
-    -   jQueryPath: /<virtual directory>/Scripts/ jQuery-1.7.2.min.js
+7. For each item in the following list, edit the application settings to reference the new location by replacing <virtual directory> with /SelfService/ (or the name you chose during installation). For example, the virtual directory path will be similar to /selfservice/scripts/jquery-1.7.2.min.js.
 
-    -   MicrosoftAjaxPath: /<virtual directory>/Scripts/ MicrosoftAjax.js
+   -   jQueryPath: /<virtual directory>/Scripts/ jQuery-1.7.2.min.js
 
-    -   MicrosoftMvcAjaxPath: /<virtual directory>/Scripts/ MicrosoftMvcAjax.js
+   -   MicrosoftAjaxPath: /<virtual directory>/Scripts/ MicrosoftAjax.js
 
-    -   MicrosoftMvcValidationPath: /<virtual directory>/Scripts/ MicrosoftMvcValidation.js
+   -   MicrosoftMvcAjaxPath: /<virtual directory>/Scripts/ MicrosoftMvcAjax.js
+
+   -   MicrosoftMvcValidationPath: /<virtual directory>/Scripts/ MicrosoftMvcValidation.js
 
 **To install the Administration and Monitoring Server feature**
 
-1.  MBAM can encrypt the communication between the Web Services and the Administration and Monitoring servers. If you choose the option to encrypt the communication, you are prompted to select the certification authority-provisioned certificate to use for encryption.
+1. MBAM can encrypt the communication between the Web Services and the Administration and Monitoring servers. If you choose the option to encrypt the communication, you are prompted to select the certification authority-provisioned certificate to use for encryption.
 
-2.  Click **Next** to continue.
+2. Click **Next** to continue.
 
-3.  Specify the remote instance of SQL Server (for example: *<ServerName>*) where the Compliance and Audit Database was installed.
+3. Specify the remote instance of SQL Server (for example: *<ServerName>*) where the Compliance and Audit Database was installed.
 
-4.  Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status. However, you can change the name when you install the Compliance and Audit Database.
+4. Specify the name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status. However, you can change the name when you install the Compliance and Audit Database.
 
-5.  Click **Next** to continue.
+5. Click **Next** to continue.
 
-6.  Specify the remote instance of SQL Server (for example: *<ServerName>*) where the Recovery Database was installed.
+6. Specify the remote instance of SQL Server (for example: *<ServerName>*) where the Recovery Database was installed.
 
-7.  Specify the name of the Recovery Database. By default, the database name is **MBAM Recovery and Hardware**. However, you can change the name when you install the Recovery Database feature.
+7. Specify the name of the Recovery Database. By default, the database name is **MBAM Recovery and Hardware**. However, you can change the name when you install the Recovery Database feature.
 
-8.  Click **Next** to continue.
+8. Click **Next** to continue.
 
-9.  Specify the URL for the “Home” of the SQL Server Reporting Services (SRS) site. The default Home location of a SQL Server Reporting Services site instance is at:
+9. Specify the URL for the “Home” of the SQL Server Reporting Services (SRS) site. The default Home location of a SQL Server Reporting Services site instance is at:
 
-    http://*<NameofMBAMReportsServer>/*ReportServer
+   http://<NameofMBAMReportsServer>/ReportServer
+
+   **Note**  
+   If SQL Server Reporting Services was configured as a named instance, the URL resembles the following: http://*<NameofMBAMReportsServer>*/ReportServer\_*<SRSInstanceName>*.
 
-    **Note**  
-    If SQL Server Reporting Services was configured as a named instance, the URL resembles the following: http://*<NameofMBAMReportsServer>*/ReportServer\_*<SRSInstanceName>*.
 
-     
 
 10. Click **Next** to continue.
 
 11. Enter the **Port Number**, the **Host Name** (optional), and the **Installation Path** for the MBAM Administration and Monitoring Server.
 
-    **Note**  
+    **Note**  
     The port number that you specify must be an unused port number on the Administration and Monitoring server unless you specify a unique host header name. If you are using Windows Firewall, the port will be opened automatically.
 
-     
+
 
 12. To optionally register a Service Principal Name (SPN) for the Self-Service Portal, select **Register this machine’s Service Principal Names (SPN) with Active Directory (Required for Windows Authentication)**. If you select this check box, MBAM Setup will not try to register the existing SPNs, and you can manually register the SPN before or after the MBAM installation. For instructions on registering the SPN manually, see [Manual SPN Registration](https://go.microsoft.com/fwlink/?LinkId=286758).
 
@@ -250,10 +255,10 @@ The following steps describe how to install general MBAM features.
 
     -   **MBAM Report Users**: Members of this local group can access the reports on the MBAM Administration and Monitoring website.
 
-    **Note**  
+    **Note**  
     Identical user or group membership of the **MBAM Report Users** local group must be maintained on all computers where the MBAM Administration and Monitoring Server features, Compliance and Audit Database, and the Compliance and Audit Reports are installed.
 
-     
+
 
 ## Validating the MBAM Server Feature Installation
 
@@ -262,73 +267,77 @@ When Microsoft BitLocker Administration and Monitoring Server feature installati
 
 **To validate an MBAM Server installation**
 
-1.  On each server where an MBAM feature is deployed, open **Control Panel**, select **Programs**, and then select **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list.
+1. On each server where an MBAM feature is deployed, open **Control Panel**, select **Programs**, and then select **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list.
 
-    **Note**  
-    To validate the MBAM installation, you must use a domain account that has local computer administrative credentials on each server.
+   **Note**  
+   To validate the MBAM installation, you must use a domain account that has local computer administrative credentials on each server.
 
-     
 
-2.  On the server where the Recovery Database is installed, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is installed.
 
-3.  On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio and verify that the **MBAM Compliance Status Database** is installed.
+2. On the server where the Recovery Database is installed, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is installed.
 
-4.  On the server where the Compliance and Audit Reports are installed, open a web browser with administrative credentials and browse to the “Home” of the SQL Server Reporting Services site.
+3. On the server where the Compliance and Audit Database is installed, open SQL Server Management Studio and verify that the **MBAM Compliance Status Database** is installed.
 
-    The default Home location of a SQL Server Reporting Services site instance can be found is at http://*<NameofMBAMReportsServer>*/Reports.aspx. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances that were specified during setup.
+4. On the server where the Compliance and Audit Reports are installed, open a web browser with administrative credentials and browse to the “Home” of the SQL Server Reporting Services site.
 
-    Confirm that a reports folder named **Microsoft BitLocker Administration and Monitoring** contains a data source called **MaltaDataSource** and that an **en-us** folder contains four reports.
+   The default Home location of a SQL Server Reporting Services site instance can be found is at http://<NameofMBAMReportsServer>/Reports.aspx. To find the actual URL, use the Reporting Services Configuration Manager tool and select the instances that were specified during setup.
 
-    **Note**  
-    If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>*
+   Confirm that a reports folder named **Microsoft BitLocker Administration and Monitoring** contains a data source called **MaltaDataSource** and that an **en-us** folder contains four reports.
 
-     
+   **Note**  
+   If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:http://*<NameofMBAMReportsServer>*/Reports\_*<SRSInstanceName>*
 
-    **Note**  
-    If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then go to the Administration and Monitoring website and select a report, the following message appears: “Only Secure Content is Displayed.” To show the report, click **Show All Content**.
 
-     
 
-5.  On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**. Select **Web Server (IIS)**, and then click **Internet Information Services (IIS) Manager**.
+~~~
+**Note**  
+If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then go to the Administration and Monitoring website and select a report, the following message appears: “Only Secure Content is Displayed.” To show the report, click **Show All Content**.
+~~~
 
-6.  In **Connections**, browse to *<computername>*, select **Sites**, and select **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed.
 
-7.  On the server where the Administration and Monitoring features and Self-Service Portal are installed, open a web browser with administrative credentials and browse to the following locations to verify that they load successfully.
 
-    **Note**  
-    The URLs ending in “.svc” do not display a website. Success is indicated by the message “Metadata publishing for this service is currently disabled” or by information resembling code. If you see some other error message or if the page cannot be found, the page has not loaded successfully.
+5. On the server where the Administration and Monitoring feature is installed, run **Server Manager** and browse to **Roles**. Select **Web Server (IIS)**, and then click **Internet Information Services (IIS) Manager**.
 
-     
+6. In **Connections**, browse to *<computername>*, select **Sites**, and select **Microsoft BitLocker Administration and Monitoring**. Verify that **MBAMAdministrationService**, **MBAMComplianceStatusService**, and **MBAMRecoveryAndHardwareService** are listed.
 
-    -   *http://<hostname>/HelpDesk/default.aspx* and confirm each of the links for navigation and reports
+7. On the server where the Administration and Monitoring features and Self-Service Portal are installed, open a web browser with administrative credentials and browse to the following locations to verify that they load successfully.
 
-    -   *http://<hostname>/SelfService>/*
+   **Note**  
+   The URLs ending in “.svc” do not display a website. Success is indicated by the message “Metadata publishing for this service is currently disabled” or by information resembling code. If you see some other error message or if the page cannot be found, the page has not loaded successfully.
 
-    -   *http://<computername>/MBAMAdministrationService/AdministrationService.svc*
 
-    -   *http://<hostname>/MBAMUserSupportService/UserSupportService.svc*
 
-    -   *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc*
+~~~
+-   *http://<hostname>/HelpDesk/default.aspx* and confirm each of the links for navigation and reports
 
-    -   *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc*
+-   *http://<hostname>/SelfService>/*
 
-    **Note**  
-    It is assumed that the server features were installed on the default port without network encryption. If you installed the server features on a different port or virtual directory, change the URLs to include the appropriate port, for example, *http://<hostname>:<port>/HelpDesk/default.aspx* or*http://<hostname>:<port>/<virtualdirectory>/default.aspx*
+-   *http://<computername>/MBAMAdministrationService/AdministrationService.svc*
 
-    If the server features were installed with network encryption, change http:// to https://.
+-   *http://<hostname>/MBAMUserSupportService/UserSupportService.svc*
 
-     
+-   *http://<computername>/MBAMComplianceStatusService/StatusReportingService.svc*
 
-8.  Verify that each webpage loads successfully.
+-   *http://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc*
+
+**Note**  
+It is assumed that the server features were installed on the default port without network encryption. If you installed the server features on a different port or virtual directory, change the URLs to include the appropriate port, for example, *http://<hostname>:<port>/HelpDesk/default.aspx* or*http://<hostname>:<port>/<virtualdirectory>/default.aspx*
+
+If the server features were installed with network encryption, change http:// to https://.
+~~~
+
+
+
+8. Verify that each webpage loads successfully.
 
 ## Related topics
 
 
 [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md b/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md
index 155f6db7ef..ef5c19da6f 100644
--- a/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md
+++ b/mdop/mbam-v2/how-to-install-mbam-with-configuration-manager.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install MBAM with Configuration Manager
 description: How to Install MBAM with Configuration Manager
-author: jamiejdt
+author: dansimp
 ms.assetid: fd0832e4-3b79-4e56-9550-d2f396be6d09
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -29,7 +32,7 @@ If you are using a non-default SQL Server Reporting Services (SSRS) instance, yo
 
 `MbamSetup.exe CM_SSRS_INSTANCE_NAME=`
 
- 
+ 
 
 **To install MBAM on the Configuration Manager Server**
 
@@ -40,7 +43,7 @@ If you are using a non-default SQL Server Reporting Services (SSRS) instance, yo
 
     Additional setup log files are created in the %temp% folder on the computer of the user who is installing Configuration Manager.
 
-     
+     
 
 2.  On the **Welcome** page, optionally select the **Customer Experience Improvement Program**, and then click **Start**.
 
@@ -53,7 +56,7 @@ If you are using a non-default SQL Server Reporting Services (SSRS) instance, yo
     **Note**  
     On the **Checking Prerequisites** page, click **Next** after the installation wizard checks the prerequisites for your installation and confirms that none are missing. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again.**
 
-     
+     
 
 6.  Specify whether to use Microsoft Updates to help keep your computer secure, and then click **Next**. Using Microsoft Updates does not turn on Automatic Updates in Windows.
 
@@ -78,7 +81,7 @@ If you are using a non-default SQL Server Reporting Services (SSRS) instance, yo
     **Note**  
     The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all of the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation resumes.
 
-     
+     
 
 6.  On the **Configure the Recovery Database** page, specify the names of the computers that will be running the Administration and Monitoring Server feature. After the Administration and Monitoring Server feature is deployed, it uses its domain account to connect to the database.
 
@@ -95,7 +98,7 @@ If you are using a non-default SQL Server Reporting Services (SSRS) instance, yo
     **Note**  
     If you are installing the Audit Database without the Audit Reports feature, you must add an exception on the Audit Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433.
 
-     
+     
 
 12. Specify the SQL Server instance name and the name of the database that will store the audit data. You must also specify where the database and log information will be located.
 
@@ -116,14 +119,14 @@ If you are using a non-default SQL Server Reporting Services (SSRS) instance, yo
     **Note**  
     The installation wizard checks the prerequisites for your installation and displays the prerequisites that are missing. If all of the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. If all prerequisites are met this time, the installation resumes.
 
-     
+     
 
 6.  Install the Self-Service Portal by following the steps in the **To install the Self-Service Portal** section in [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md).
 
     **Note**  
     If the client computers will not have access to the Microsoft Content Delivery Network (CDN), which gives the Self-Service Portal the required access to certain JavaScript files, complete the steps in the **To configure the Self-Service Portal when end users cannot access the Microsoft Content Delivery Network** section [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md) to configure the Self-Service Portal to reference the JavaScript files from an accessible source.
 
-     
+     
 
 7.  Install the Administration and Monitoring Server features by following the steps in the **To install the Administration and Monitoring Server feature** section in [How to Install and Configure MBAM on Distributed Servers](how-to-install-and-configure-mbam-on-distributed-servers-mbam-2.md).
 
@@ -136,9 +139,9 @@ If you are using a non-default SQL Server Reporting Services (SSRS) instance, yo
 
 [Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md b/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md
index 23cbf71a1e..88d1e84dc4 100644
--- a/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md
+++ b/mdop/mbam-v2/how-to-install-the-mbam-20-group-policy-template-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the MBAM 2.0 Group Policy Template
 description: How to Install the MBAM 2.0 Group Policy Template
-author: jamiejdt
+author: dansimp
 ms.assetid: bc193232-d060-4285-842e-d194a74dd3c9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ The following steps describe how to install the MBAM Group Policy template.
 **Note**  
 Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers.
 
- 
+ 
 
 **To install the MBAM Group Policy template**
 
@@ -36,7 +39,7 @@ Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup o
     **Note**  
     The installation wizard checks the prerequisites for your installation and displays prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click **Check prerequisites again**. Once all prerequisites are met, the installation will resume.
 
-     
+     
 
 5.  For specific steps about how and where to install the templates, see [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://technet.microsoft.com/library/dn659707.aspx).
 
@@ -47,9 +50,9 @@ Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup o
 
 [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md b/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md
index ded893ffa2..4f2389ef54 100644
--- a/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md
+++ b/mdop/mbam-v2/how-to-manage-mbam-administrator-roles-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage MBAM Administrator Roles
 description: How to Manage MBAM Administrator Roles
-author: jamiejdt
+author: dansimp
 ms.assetid: 813ac0c4-3cf9-47af-b4cb-9395fd915e5c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md b/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md
index b6e7348e9b..fafcf4f205 100644
--- a/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md
+++ b/mdop/mbam-v2/how-to-manage-mbam-client-bitlocker-encryption-options-by-using-the-control-panel-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel
 description: How to Manage MBAM Client BitLocker Encryption Options by Using the Control Panel
-author: jamiejdt
+author: dansimp
 ms.assetid: e2ff153e-5770-4a12-b79d-cda998b8a8ab
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md b/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md
index c38109829c..a19aea482c 100644
--- a/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md
+++ b/mdop/mbam-v2/how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage User BitLocker Encryption Exemptions
 description: How to Manage User BitLocker Encryption Exemptions
-author: jamiejdt
+author: dansimp
 ms.assetid: 1bfd9d66-6a9a-4d0e-b54a-e5a6627f5ada
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ To exempt users from BitLocker protection, an organization will have to create a
 **Note**  
 If the computer is already BitLocker-protected, the user exemption policy has no effect.
 
- 
+ 
 
 The following table shows how BitLocker protection is applied based on how exemptions are set.
 
@@ -52,7 +55,7 @@ The following table shows how BitLocker protection is applied based on how exemp
 
 
 
- 
+ 
 
 **To exempt a user from BitLocker encryption**
 
@@ -65,7 +68,7 @@ The following table shows how BitLocker protection is applied based on how exemp
     **Important**  
     Shared computer scenarios require special consideration when using user exemptions. If a non-exempt user logs on to a computer shared with an exempt user, the computer may be encrypted.
 
-     
+     
 
 **To enable users to request an exemption from BitLocker encryption**
 
@@ -76,7 +79,7 @@ The following table shows how BitLocker protection is applied based on how exemp
     **Note**  
     Selecting **Request Exemption** postpones the BitLocker protection until the maximum time that is set in the User Exemption Policy.
 
-     
+     
 
 3.  If users select **Request Exemption**, they receive a notification telling them to contact your organization’s BitLocker administration group. Depending on how the Configure User Exemption Policy is configured, users are provided with one or more of the following contact methods:
 
@@ -91,16 +94,16 @@ The following table shows how BitLocker protection is applied based on how exemp
     **Note**  
     Once a user submits an exemption request, the MBAM agent reports the user as “temporarily exempt” and then waits a configurable number of days before it checks the computer’s compliance again. If the MBAM administrator rejects the exemption request, the exemption request option is deactivated, which prevents the user from being able to request the exemption again.
 
-     
+     
 
 ## Related topics
 
 
 [Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md b/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md
index 81cd446452..353753ffd1 100644
--- a/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md
+++ b/mdop/mbam-v2/how-to-move-mbam-20-features-to-another-computer-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Move MBAM 2.0 Features to Another Computer
 description: How to Move MBAM 2.0 Features to Another Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: 49bc0792-60a4-473f-89cc-ada30191e04a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -53,10 +56,10 @@ To move the Recovery Database from one computer to another (for example, from Se
 
     `PS C:\> Stop-Website “Microsoft BitLocker Administration and Monitoring”`
 
-    **Note**  
+    **Note**  
     To run this PowerShell command line, the IIS Module for PowerShell must be added to current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable execution of scripts.
 
-     
+
 
 **Run MBAM Setup on Server B**
 
@@ -66,7 +69,7 @@ To move the Recovery Database from one computer to another (for example, from Se
 
     `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=KeyDatabase ADMINANDMON_MACHINENAMES=$DOMAIN$\$SERVERNAME$$ RECOVERYANDHWDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ TOPOLOGY=$X$`
 
-    **Note**  
+    **Note**  
     Replace the following values in the example above with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and instance to which the Recovery Database will be moved.
@@ -75,7 +78,7 @@ To move the Recovery Database from one computer to another (for example, from Se
 
     -   $X$ - Enter **0** if you are installing the MBAM Stand-alone topology, or **1** if you are installing the MBAM Configuration Manager topology.
 
-     
+
 
 **Back Up the Recovery Database on Server A**
 
@@ -85,67 +88,69 @@ To move the Recovery Database from one computer to another (for example, from Se
 
     Modify the MBAM Recovery Database to use the full recovery mode.
 
-    `USE master;`
+    ```sql
+    USE master;
 
-    `GO`
+    GO
 
-    `ALTER DATABASE "MBAM Recovery and Hardware"`
+    ALTER DATABASE "MBAM Recovery and Hardware"
 
-    `   SET RECOVERY FULL;`
+       SET RECOVERY FULL;
 
-    `GO`
+    GO
 
     -- Create MBAM Recovery Database Data and MBAM Recovery logical backup devices.
 
-    `USE master`
+    USE master
 
-    `GO`
+    GO
 
-    `EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device',`
+    EXEC sp_addumpdevice 'disk', 'MBAM Recovery and Hardware Database Data Device',
 
-    `'Z:\MBAM Recovery Database Data.bak';`
+    'Z:\MBAM Recovery Database Data.bak';
 
-    `GO`
+    GO
 
     -- Back up the full MBAM Recovery Database.
 
-    `BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device];`
+    BACKUP DATABASE [MBAM Recovery and Hardware] TO [MBAM Recovery and Hardware Database Data Device];
 
-    `GO`
+    GO
 
-    `BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate]`
+    BACKUP CERTIFICATE [MBAM Recovery Encryption Certificate]
 
-    `TO FILE = 'Z:\SQLServerInstanceCertificateFile'`
+    TO FILE = 'Z:\SQLServerInstanceCertificateFile'
 
-    `WITH PRIVATE KEY`
+    WITH PRIVATE KEY
 
-    `(`
+    (
 
-    `    FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',`
+        FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',
 
-    `    ENCRYPTION BY PASSWORD = '$PASSWORD$'`
+        ENCRYPTION BY PASSWORD = '$PASSWORD$'
 
-    `);`
+    );
 
-    `GO`
+    GO
+    ```
 
-    **Note**  
+    **Note**  
     Replace the following values in the example above with those that match your environment:
 
     -   $PASSWORD$ - Enter a password that you will use to encrypt the Private Key file.
 
-     
+
 
 3.  Run the SQL File by using SQL Server PowerShell and a command line that is similar to the following:
 
     `PS C:\> Invoke-Sqlcmd -InputFile 'Z:\BackupMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$`
 
-    **Note**  
+    **Note**  
     Replace the following values in the example above with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and instance from which the Recovery Database will be backed up.
 
-     
+
 
 **Move the Recovery Database and Certificate from Server A to Server B**
 
@@ -161,14 +166,14 @@ To move the Recovery Database from one computer to another (for example, from Se
 
     `PS C:\> Copy-Item “Z:\SQLServerInstanceCertificateFilePrivateKey” \\$SERVERNAME$\$DESTINATIONSHARE$`
 
-    **Note**  
+    **Note**  
     Replace the following value in the example above with those that match your environment:
 
     -   $SERVERNAME$ - Enter the name of the server to which the files will be copied.
 
     -   $DESTINATIONSHARE$ - Enter the name of the share and path to which the files will be copied.
 
-     
+
 
 **Restore the Recovery Database on Server B**
 
@@ -180,61 +185,63 @@ To move the Recovery Database from one computer to another (for example, from Se
 
 4.  To automate this procedure, create a SQL file (.sql) that contains the following-SQL script:
 
-    `-- Restore MBAM Recovery Database. `
+    ```sql
+    -- Restore MBAM Recovery Database. 
 
-    `USE master`
+    USE master
 
-    `GO`
+    GO
 
     -- Drop certificate created by MBAM Setup.
 
-    `DROP CERTIFICATE [MBAM Recovery Encryption Certificate]`
+    DROP CERTIFICATE [MBAM Recovery Encryption Certificate]
 
-    `GO`
+    GO
 
     --Add certificate
 
-    `CREATE CERTIFICATE [MBAM Recovery Encryption Certificate]`
+    CREATE CERTIFICATE [MBAM Recovery Encryption Certificate]
 
-    `FROM FILE = 'Z: \SQLServerInstanceCertificateFile'`
+    FROM FILE = 'Z: \SQLServerInstanceCertificateFile'
 
-    `WITH PRIVATE KEY`
+    WITH PRIVATE KEY
 
-    `(`
+    (
 
-    `    FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',`
+        FILE = ' Z:\SQLServerInstanceCertificateFilePrivateKey',
 
-    `    DECRYPTION BY PASSWORD = '$PASSWORD$'`
+        DECRYPTION BY PASSWORD = '$PASSWORD$'
 
-    `);`
+    );
 
-    `GO`
+    GO
 
     -- Restore the MBAM Recovery Database data and log files.
 
-    `RESTORE DATABASE [MBAM Recovery and Hardware]`
+    RESTORE DATABASE [MBAM Recovery and Hardware]
 
-    `   FROM DISK = 'Z:\MBAM Recovery Database Data.bak'`
+       FROM DISK = 'Z:\MBAM Recovery Database Data.bak'
 
-    `   WITH REPLACE`
+       WITH REPLACE
+    ```
 
-    **Note**  
+    **Note**  
     Replace the following values in the example above with those that match your environment:
 
     -   $PASSWORD$ - Enter a password that you used to encrypt the Private Key file.
 
-     
+
 
 5.  You can use Windows PowerShell to enter a command line that is similar to the following:
 
     `PS C:\> Invoke-Sqlcmd -InputFile 'Z:\RestoreMBAMRecoveryandHardwarDatabaseScript.sql' -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$`
 
-    **Note**  
+    **Note**  
     Replace the following value in the example above with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the name of the server and instance to which the Recovery Database will be restored.
 
-     
+
 
 **Configure Access to the Recovery Database on Server B**
 
@@ -246,45 +253,47 @@ To move the Recovery Database from one computer to another (for example, from Se
 
     `PS C:\> net localgroup "MBAM Recovery and Hardware DB Access" $DOMAIN$\$SERVERNAME$$  /add`
 
-    **Note**  
+    **Note**  
     Replace the following values in the example above with the applicable values for your environment:
 
     -   $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a $, as shown in the example (for example, MyDomain\\MyServerName1$).
 
-     
 
-    This command line must be run for each Administration and Monitoring Server that will be accessing the database in your environment.
+
+~~~
+This command line must be run for each Administration and Monitoring Server that will be accessing the database in your environment.
+~~~
 
 **Update the Recovery Database Connection Data on the MBAM Administration and Monitoring Servers**
 
-1.  On each of the servers running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to update the Connection String information for the following applications, which are hosted in the Administration and Monitoring website:
+1. On each of the servers running the MBAM Administration and Monitoring feature, use the Internet Information Services (IIS) Manager console to update the Connection String information for the following applications, which are hosted in the Administration and Monitoring website:
 
-    -   MBAMAdministrationService
+   -   MBAMAdministrationService
 
-    -   MBAMRecoveryAndHardwareService
+   -   MBAMRecoveryAndHardwareService
 
-2.  Select each application and use the **Configuration Editor** feature, which is located under the **Management** section of the **Feature View**.
+2. Select each application and use the **Configuration Editor** feature, which is located under the **Management** section of the **Feature View**.
 
-3.  Select the **configurationStrings** option from the **Section list** control.
+3. Select the **configurationStrings** option from the **Section list** control.
 
-4.  Select the row named **(Collection)** and open the **Collection Editor** by selecting the button on the right side of the row.
+4. Select the row named **(Collection)** and open the **Collection Editor** by selecting the button on the right side of the row.
 
-5.  In the **Collection Editor**, select the row named **KeyRecoveryConnectionString** when updating the configuration for the MBAMAdministrationService application or the row named **Microsoft.Mbam.RecoveryAndHardwareDataStore.**ConnectionString when updating the configuration for the MBAMRecoveryAndHardwareService.
+5. In the **Collection Editor**, select the row named **KeyRecoveryConnectionString** when updating the configuration for the MBAMAdministrationService application or the row named Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString when updating the configuration for the MBAMRecoveryAndHardwareService.
 
-6.  Update the **Data Source=** value for the **configurationStrings** property to list the server name and instance (for example, $SERVERNAME$\\$SQLINSTANCENAME$) where the Recovery Database was moved to.
+6. Update the **Data Source=** value for the **configurationStrings** property to list the server name and instance (for example, $SERVERNAME$\\$SQLINSTANCENAME$) where the Recovery Database was moved to.
 
-7.  To automate this procedure, you can use Windows to enter a command line, that is similar to the following, on each Administration and Monitoring Server:
+7. To automate this procedure, you can use Windows to enter a command line, that is similar to the following, on each Administration and Monitoring Server:
 
-    `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="KeyRecoveryConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMAdministrationService" -Name "connectionString" -Value “Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;”`
+   `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="KeyRecoveryConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMAdministrationService" -Name "connectionString" -Value “Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;”`
 
-    `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMRecoveryAndHardwareService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;"`
+   `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMRecoveryAndHardwareService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and Hardware;Integrated Security=SSPI;"`
 
-    **Note**  
-    Replace the following value in the example above with those that match your environment:
+   **Note**  
+   Replace the following value in the example above with those that match your environment:
+
+   -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Recovery Database is.
 
-    -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Recovery Database is.
 
-     
 
 **Resume all Instances of the MBAM Administration and Monitoring Website**
 
@@ -325,10 +334,10 @@ If you want to move the MBAM Compliance and Audit Database from one computer to
 
     `PS C:\> Stop-s “Microsoft BitLocker Administration and Monitoring”`
 
-    **Note**  
+    **Note**  
     To run this command line, you must add the IIS Module for PowerShell to the current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable scripts to be run.
 
-     
+
 
 **Run MBAM Setup on Server B**
 
@@ -338,7 +347,7 @@ If you want to move the MBAM Compliance and Audit Database from one computer to
 
     `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal= ReportsDatabase ADMINANDMON_MACHINENAMES=$DOMAIN$\$SERVERNAME$ COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ REPORTS_USERACCOUNT=$DOMAIN$\$USERNAME$ TOPOLOGY=$X$`
 
-    **Note**  
+    **Note**  
     Note: Replace the following values in the example above with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance and Audit Database will be moved to.
@@ -349,7 +358,7 @@ If you want to move the MBAM Compliance and Audit Database from one computer to
 
     -   $X$ - Enter **0** if you are installing the MBAM Stand-alone topology, or **1** if you are installing the MBAM Configuration Manager topology.
 
-     
+
 
 **Back Up the Compliance and Audit Database on Server A**
 
@@ -357,46 +366,48 @@ If you want to move the MBAM Compliance and Audit Database from one computer to
 
 2.  To automate this procedure, create a SQL file (.sql) that contains the following-SQL script:
 
-    `-- Modify the MBAM Compliance Status Database to use the full recovery model.`
+    ```sql
+    -- Modify the MBAM Compliance Status Database to use the full recovery model.
 
-    `USE master;`
+    USE master;
 
-    `GO`
+    GO
 
-    `ALTER DATABASE "MBAM Compliance Status"`
+    ALTER DATABASE "MBAM Compliance Status"
 
-    `   SET RECOVERY FULL;`
+       SET RECOVERY FULL;
 
-    `GO`
+    GO
 
-    `-- Create MBAM Compliance Status Data logical backup devices.`
+    -- Create MBAM Compliance Status Data logical backup devices.
 
-    `USE master`
+    USE master
 
-    `GO`
+    GO
 
-    `EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device',`
+    EXEC sp_addumpdevice 'disk', 'MBAM Compliance Status Database Data Device',
 
-    `'Z: \MBAM Compliance Status Database Data.bak';`
+    'Z: \MBAM Compliance Status Database Data.bak';
 
-    `GO`
+    GO
 
     -- Back up the full MBAM Recovery database.
 
-    `BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device];`
+    BACKUP DATABASE [MBAM Compliance Status] TO [MBAM Compliance Status Database Data Device];
 
-    `GO`
+    GO
+    ```
 
 3.  Run the SQL file by using a Windows PowerShell command line that is similar to the following:
 
     `PS C:\> Invoke-Sqlcmd -InputFile "Z:\BackupMBAMComplianceStatusDatabaseScript.sql" –ServerInstance $SERVERNAME$\$SQLINSTANCENAME$`
 
-    **Note**  
+    **Note**  
     Replace the following value in the example above with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance and Audit database will be backed up from.
 
-     
+
 
 **Move the Compliance and Audit Database from Server A to B**
 
@@ -408,14 +419,14 @@ If you want to move the MBAM Compliance and Audit Database from one computer to
 
     `PS C:\> Copy-Item “Z:\MBAM Compliance Status Database Data.bak” \\$SERVERNAME$\$DESTINATIONSHARE$`
 
-    **Note**  
+    **Note**  
     Replace the following values in the example above with those that match your environment:
 
     -   $SERVERNAME$ - Enter the server name where the files will be copied to.
 
     -   $DESTINATIONSHARE$ - Enter the name of share and path where the files will be copied to.
 
-     
+
 
 **Restore the Compliance and Audit Database on Server B**
 
@@ -425,30 +436,32 @@ If you want to move the MBAM Compliance and Audit Database from one computer to
 
 3.  To automate this procedure, create a SQL file (.sql) that contains the following-SQL script:
 
-    `-- Create MBAM Compliance Status Database Data logical backup devices. `
+    ```sql
+    -- Create MBAM Compliance Status Database Data logical backup devices. 
 
-    `Use master`
+    Use master
 
-    `GO`
+    GO
 
     -- Restore the MBAM Compliance Status database data files.
 
-    `RESTORE DATABASE [MBAM Compliance Status]`
+    RESTORE DATABASE [MBAM Compliance Status]
 
-    `   FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak'`
+       FROM DISK = 'C:\test\MBAM Compliance Status Database Data.bak'
 
-    `   WITH REPLACE`
+       WITH REPLACE
+    ```
 
 4.  Run the SQL File by using a Windows PowerShell command line that is similar to the following:
 
     `PS C:\> Invoke-Sqlcmd -InputFile "Z:\RestoreMBAMComplianceStatusDatabaseScript.sql" -ServerInstance $SERVERNAME$\$SQLINSTANCENAME$`
 
-    **Note**  
+    **Note**  
     Replace the following value in the example above with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance and Audit Database will be restored to.
 
-     
+
 
 **Configure Access to the Compliance and Audit Database on Server B**
 
@@ -462,16 +475,18 @@ If you want to move the MBAM Compliance and Audit Database from one computer to
 
     `PS C:\> net localgroup "MBAM Compliance Auditing DB Access" $DOMAIN$\$REPORTSUSERNAME$  /add`
 
-    **Note**  
+    **Note**  
     Replace the following values in the example above with the applicable values for your environment:
 
     -   $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the MBAM Administration and Monitoring Server. The server name must be followed by a “$” as shown in the example. (for example, MyDomain\\MyServerName1$)
 
     -   $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit Reports.
 
-     
 
-    The command line for adding the servers to the MBAM Compliance and Audit Database access local group must be run for each Administration and Monitoring Server that will be accessing the database in your environment.
+
+~~~
+The command line for adding the servers to the MBAM Compliance and Audit Database access local group must be run for each Administration and Monitoring Server that will be accessing the database in your environment.
+~~~
 
 **Update the Database Connection Data on MBAM Administration and Monitoring Servers**
 
@@ -497,12 +512,12 @@ If you want to move the MBAM Compliance and Audit Database from one computer to
 
     `PS C:\> Set-WebConfigurationProperty '/connectionStrings/add[@name="Microsoft.Windows.Mdop.BitLockerManagement.StatusReportDataStore.ConnectionString"]' -PSPath "IIS:\sites\Microsoft Bitlocker Administration and Monitoring\MBAMComplianceStatusService" -Name "connectionString" -Value "Data Source=$SERVERNAME$\$SQLINSTANCENAME;Initial Catalog=MBAM Compliance Status;Integrated Security=SSPI;"`
 
-    **Note**  
+    **Note**  
     Replace the following values in the example above with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Recovery Database is located.
 
-     
+
 
 **Resume All Instances of the MBAM Administration and Monitoring Website**
 
@@ -535,7 +550,7 @@ If you want to move the MBAM Compliance and Audit Reports from one computer to a
 
     `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=Reports COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ REPORTS_USERACCOUNTPW=$PASSWORD$ TOPOLOGY=$X$`
 
-    **Note**  
+    **Note**  
     Replace the following values in the example above with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - Enter the server name and instance where the Compliance and Audit Database is located.
@@ -546,7 +561,7 @@ If you want to move the MBAM Compliance and Audit Reports from one computer to a
 
     -   $X$ - Enter **0** if you are installing the MBAM Stand-alone topology, or **1** if you are installing the MBAM Configuration Manager topology.
 
-     
+
 
 **Configure Access to the Compliance and Audit Reports on Server B**
 
@@ -556,14 +571,16 @@ If you want to move the MBAM Compliance and Audit Reports from one computer to a
 
     `PS C:\> net localgroup "MBAM Report Users" $DOMAIN$\$REPORTSUSERNAME$  /add`
 
-    **Note**  
+    **Note**  
     Replace the following values in the example above with the applicable values for your environment:
 
     -   $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit reports.
 
-     
 
-    The command line for adding the users to the MBAM Report Users local group must be run for each user that will be accessing the reports in your environment.
+
+~~~
+The command line for adding the users to the MBAM Report Users local group must be run for each user that will be accessing the reports in your environment.
+~~~
 
 **Stop All Instances of the MBAM Administration and Monitoring Website**
 
@@ -575,30 +592,30 @@ If you want to move the MBAM Compliance and Audit Reports from one computer to a
 
 **Update the Database Connection Data on the MBAM Administration and Monitoring Servers**
 
-1.  On each server that is running the MBAM Administration and Monitoring Server feature, use the Internet Information Services (IIS) Manager console to update the Compliance and Audit Reports URL.
+1. On each server that is running the MBAM Administration and Monitoring Server feature, use the Internet Information Services (IIS) Manager console to update the Compliance and Audit Reports URL.
 
-2.  Select the **Microsoft BitLocker Administration and Monitoring** website, and use the **Configuration Editor** feature that is location under the **Management** section of the **Feature View**.
+2. Select the **Microsoft BitLocker Administration and Monitoring** website, and use the **Configuration Editor** feature that is location under the **Management** section of the **Feature View**.
 
-3.  Select the **appSettings** option from the **Section list** control.
+3. Select the **appSettings** option from the **Section list** control.
 
-4.  Select the row named **(Collection)** and open the **Collection Editor** by selecting the button on the right side of the row.
+4. Select the row named **(Collection)** and open the **Collection Editor** by selecting the button on the right side of the row.
 
-5.  In the **Collection Editor**, select the row named **Microsoft.Mbam.Reports.Url**.
+5. In the **Collection Editor**, select the row named **Microsoft.Mbam.Reports.Url**.
 
-6.  Update the value for **Microsoft.Mbam.Reports.Url** to reflect the server name for Server B. If the Compliance and Audit Reports feature was installed on a named SQL Reporting Services instance, be sure to add or update the name of the instance to the URL (for example, http://$SERVERNAME$/ReportServer\_$SQLSRSINSTANCENAME$/Pages....)
+6. Update the value for **Microsoft.Mbam.Reports.Url** to reflect the server name for Server B. If the Compliance and Audit Reports feature was installed on a named SQL Reporting Services instance, be sure to add or update the name of the instance to the URL (for example, http://$SERVERNAME$/ReportServer\_$SQLSRSINSTANCENAME$/Pages....)
 
-7.  To automate this procedure, you can use Windows PowerShell to enter a command line on each Administration and Monitoring Server that is similar to the following:
+7. To automate this procedure, you can use Windows PowerShell to enter a command line on each Administration and Monitoring Server that is similar to the following:
 
-    `PS C:\> Set-WebConfigurationProperty '/appSettings/add[@key="Microsoft.Mbam.Reports.Url"]' -PSPath "IIS:\ \sites\Microsoft Bitlocker Administration and Monitoring\HelpDesk" -Name "Value" -Value “http://$SERVERNAME$/ReportServer_$SRSINSTANCENAME$/Pages/ReportViewer.aspx?/ Microsoft+BitLocker+Administration+and+Monitoring/”`
+   `PS C:\> Set-WebConfigurationProperty '/appSettings/add[@key="Microsoft.Mbam.Reports.Url"]' -PSPath "IIS:\ \sites\Microsoft Bitlocker Administration and Monitoring\HelpDesk" -Name "Value" -Value “http://$SERVERNAME$/ReportServer_$SRSINSTANCENAME$/Pages/ReportViewer.aspx?/ Microsoft+BitLocker+Administration+and+Monitoring/”`
 
-    **Note**  
-    Replace the following values in the example above with those that match your environment:
+   **Note**  
+   Replace the following values in the example above with those that match your environment:
 
-    -   $SERVERNAME$ - Enter the name of the server name to which the Compliance and Audit Reports were installed.
+   -   $SERVERNAME$ - Enter the name of the server name to which the Compliance and Audit Reports were installed.
+
+   -   $SRSINSTANCENAME$ - Enter the name of the SQL Reporting Services instance to which the Compliance and Audit Reports were installed.
 
-    -   $SRSINSTANCENAME$ - Enter the name of the SQL Reporting Services instance to which the Compliance and Audit Reports were installed.
 
-     
 
 **Resume All Instances of the MBAM Administration and Monitoring Website**
 
@@ -608,10 +625,10 @@ If you want to move the MBAM Compliance and Audit Reports from one computer to a
 
     `PS C:\> Start-Website “Microsoft BitLocker Administration and Monitoring”`
 
-    **Note**  
+    **Note**  
     To run this command line, you must add the IIS Module for PowerShell to current instance of PowerShell. In addition, you must update the PowerShell execution policy to enable scripts to be run.
 
-     
+
 
 ## Moving the Administration and Monitoring Feature
 
@@ -630,7 +647,7 @@ If you want to move the MBAM Administration and Monitoring Reports feature from
 
     `PS C:\> MbamSetup.exe /qn I_ACCEPT_ENDUSER_LICENSE_AGREEMENT=1 AddLocal=AdministrationMonitoringServer, COMPLIDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ RECOVERYANDHWDB_SQLINSTANCE=$SERVERNAME$\$SQLINSTANCENAME$ SRS_REPORTSITEURL=$REPORTSSERVERURL$ TOPOLOGY=$X$`
 
-    **Note**  
+    **Note**  
     Replace the following values in the example above with those that match your environment:
 
     -   $SERVERNAME$\\$SQLINSTANCENAME$ - For the COMPLIDB\_SQLINSTANCE parameter, enter the server name and instance where the Compliance and Audit Database is located. For the RECOVERYANDHWDB\_SQLINSTANCE parameter, enter the server name and instance where the Recovery Database is located.
@@ -641,7 +658,7 @@ If you want to move the MBAM Administration and Monitoring Reports feature from
 
     -   $X$ - Enter **0** if you are installing the MBAM Stand-alone topology, or **1** if you are installing the MBAM Configuration Manager topology.
 
-     
+
 
 **Configure Access to the Databases**
 
@@ -655,25 +672,27 @@ If you want to move the MBAM Administration and Monitoring Reports feature from
 
     `PS C:\> net localgroup "MBAM Recovery and Hardware DB Access" $DOMAIN$\$SERVERNAME$$  /add`
 
-    **Note**  
+    **Note**  
     Replace the following value in the example above with the applicable values for your environment:
 
     -   $DOMAIN$\\$SERVERNAME$$ - Enter the domain and machine name of the Administration and Monitoring Server. The server name must be followed by a “$” symbol, as shown in the example (for example, MyDomain\\MyServerName1$).
 
     -   $DOMAIN$\\$REPORTSUSERNAME$ - Enter the user account name that was used to configure the data source for the Compliance and Audit Reports.
 
-     
 
-    The command lines that are listed for adding server computer accounts to the MBAM local groups must be run for each Administration and Monitoring Server that will be accessing the databases in your environment.
+
+~~~
+The command lines that are listed for adding server computer accounts to the MBAM local groups must be run for each Administration and Monitoring Server that will be accessing the databases in your environment.
+~~~
 
 ## Related topics
 
 
 [Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md b/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md
index 46f377f7b0..0bc49581fa 100644
--- a/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md
+++ b/mdop/mbam-v2/how-to-recover-a-corrupted-drive-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Recover a Corrupted Drive
 description: How to Recover a Corrupted Drive
-author: jamiejdt
+author: dansimp
 ms.assetid: b0457a00-f72e-4ad8-ab3b-7701851ca87e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ To recover a corrupted drive protected by BitLocker, a Microsoft BitLocker Admin
 **Important**  
 To avoid a potential loss of data, it is strongly recommended that you read the “repair-bde” help and clearly understand how to use the command before completing the following instructions.
 
- 
+ 
 
 **To recover a corrupted drive**
 
@@ -30,7 +33,7 @@ To avoid a potential loss of data, it is strongly recommended that you read the
     **Note**  
     If you are a member of the Help Desk Administrators role, you do not have to enter the user’s domain name or user name.
 
-     
+     
 
 3.  Click **Submit**. The recovery key will be displayed.
 
@@ -47,16 +50,16 @@ To avoid a potential loss of data, it is strongly recommended that you read the
     **Note**  
     Replace <fixed drive> with an available hard disk drive that has free space equal to or larger than the data on the corrupted drive. Data on the corrupted drive is recovered and moved to the specified hard disk drive.
 
-     
+     
 
 ## Related topics
 
 
 [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md b/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md
index 540f4086f2..a4e2df88a3 100644
--- a/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md
+++ b/mdop/mbam-v2/how-to-recover-a-drive-in-recovery-mode-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Recover a Drive in Recovery Mode
 description: How to Recover a Drive in Recovery Mode
-author: jamiejdt
+author: dansimp
 ms.assetid: 8b792bc8-b671-4345-9d37-0208db3e5b03
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -18,10 +21,10 @@ The encrypted drive recovery features of Microsoft BitLocker Administration and
 
 Use this procedure to access the centralized key recovery data system, which can provide a recovery password if a recovery password ID and associated user identifier are supplied.
 
-**Important**  
+**Important**  
 Microsoft BitLocker Administration and Monitoring uses single-use recovery keys that expire upon use. The single use of a recovery password is automatically applied to operating system drives and fixed drives. On removable drives, it is applied when the drive is removed and then re-inserted and unlocked on a computer that has Group Policy settings activated to manage removable drives.
 
- 
+
 
 **To recover a drive in recovery mode**
 
@@ -33,38 +36,40 @@ Microsoft BitLocker Administration and Monitoring uses single-use recovery keys
 
 4.  Select one of the predefined options from the **Reason for Drive Unlock** list, and then click **Submit**.
 
-    **Note**  
+    **Note**  
     If you are an MBAM Advanced Helpdesk user, the user domain and user ID entries are not required.
 
-     
 
-    MBAM returns the following:
 
-    -   An error message if no matching recovery password is found
+~~~
+MBAM returns the following:
 
-    -   Multiple possible matches if the user has multiple matching recovery passwords
+-   An error message if no matching recovery password is found
 
-    -   The recovery password and recovery package for the submitted user
+-   Multiple possible matches if the user has multiple matching recovery passwords
 
-        **Note**  
-        If you are recovering a damaged drive, the recovery package option provides BitLocker with critical information that it needs to recover the drive.
+-   The recovery password and recovery package for the submitted user
 
-         
+    **Note**  
+    If you are recovering a damaged drive, the recovery package option provides BitLocker with critical information that it needs to recover the drive.
 
-    After the recovery password and recovery package are retrieved, the recovery password is displayed.
 
-5.  To copy the password, click **Copy Key**, and then paste the recovery password into an email message. Alternatively, click **Save** to save the recovery password to a file.
 
-    When the user types the recovery password into the system or uses the recovery package, the drive is unlocked.
+After the recovery password and recovery package are retrieved, the recovery password is displayed.
+~~~
+
+5. To copy the password, click **Copy Key**, and then paste the recovery password into an email message. Alternatively, click **Save** to save the recovery password to a file.
+
+   When the user types the recovery password into the system or uses the recovery package, the drive is unlocked.
 
 ## Related topics
 
 
 [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md b/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md
index 80c704ba6f..8c02d3e434 100644
--- a/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md
+++ b/mdop/mbam-v2/how-to-recover-a-moved-drive-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Recover a Moved Drive
 description: How to Recover a Moved Drive
-author: jamiejdt
+author: dansimp
 ms.assetid: 697cd78d-962c-411e-901a-2e9220ba6552
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -25,7 +28,7 @@ When you move an operating system drive that is encrypted by using Microsoft Bit
     **Note**  
     In some cases, you may be able to click **I forgot the PIN** during the startup process, and then enter the recovery mode to display the recovery key ID.
 
-     
+     
 
 3.  Use the recovery key ID to retrieve the recovery password and unlock the drive from the Administration and Monitoring website.
 
@@ -38,9 +41,9 @@ When you move an operating system drive that is encrypted by using Microsoft Bit
 
 [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md b/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md
index a81fcfacd6..b41efb0bd6 100644
--- a/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md
+++ b/mdop/mbam-v2/how-to-reset-a-tpm-lockout-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Reset a TPM Lockout
 description: How to Reset a TPM Lockout
-author: jamiejdt
+author: dansimp
 ms.assetid: 20719ab2-18ae-4d3b-989a-539341909816
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -36,30 +39,32 @@ You can reset a TPM lockout only if MBAM owns the TPM.
 
     -   The TPM owner password file for the submitted computer
 
-    **Note**  
+    **Note**  
     If you are an Advanced Helpdesk user, the user domain and user ID fields are not required.
 
-     
 
-    After the TPM owner password is retrieved, the owner password is displayed.
 
-5.  To save the password to a .tpm file, click the **Save** button.
+~~~
+After the TPM owner password is retrieved, the owner password is displayed.
+~~~
 
-    The user will run the TPM management console, select the **Reset TPM lockout** option, and provide the TPM owner password file to reset the TPM lockout.
+5. To save the password to a .tpm file, click the **Save** button.
+
+   The user will run the TPM management console, select the **Reset TPM lockout** option, and provide the TPM owner password file to reset the TPM lockout.
+
+   **Important**  
+   Help Desk administrators should not give the TPM hash value or TPM owner password file to end users. The TPM information does not change, so it could pose a security risk if the file is given to end users.
 
-    **Important**  
-    Help Desk administrators should not give the TPM hash value or TPM owner password file to end users. The TPM information does not change, so it could pose a security risk if the file is given to end users.
 
-     
 
 ## Related topics
 
 
 [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md b/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md
index 5524d28bc3..b28772f06b 100644
--- a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md
+++ b/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-client.md
@@ -1,12 +1,15 @@
 ---
 title: How to Use a Command Line to Install the MBAM Client
 description: How to Use a Command Line to Install the MBAM Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 4dc8f944-c2fd-4d89-aed6-e9dc77de3ae4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md b/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md
index e0e5b3519f..856a5c7584 100644
--- a/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md
+++ b/mdop/mbam-v2/how-to-use-a-command-line-to-install-the-mbam-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Use a Command Line to Install the MBAM Server
 description: How to Use a Command Line to Install the MBAM Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 6ffc6d41-a793-42c2-b997-95ba47550648
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -88,7 +91,7 @@ The following table describes the command line parameters for deploying the MBAM
 
 
 
          REPORTS_USERACCOUNT
          
-
          [UserDomain]\[UserName1]
          
+
          [UserDomain][UserName1]
          
 
          Domain and user account of the Reporting Services service account that will access the Compliance and Audit database
          
 
 
@@ -124,7 +127,7 @@ The following table describes the command line parameters for deploying the MBAM
 
 
 
- 
+ 
 
 ## Command Line for Deploying the MBAM 2.0 Server with the Configuration Manager Topology
 
@@ -178,7 +181,7 @@ The following table describes the command line parameters for installing the MBA
 
 
 
          REPORTS_USERACCOUNT
          
-
          [UserDomain]\[UserName1]
          
+
          [UserDomain][UserName1]
          
 
          Domain and user account of the Reporting Services service account that will access the Compliance and Audit database
          
 
 
@@ -199,16 +202,16 @@ The following table describes the command line parameters for installing the MBA
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/how-to-use-the-help-desk-portal.md b/mdop/mbam-v2/how-to-use-the-help-desk-portal.md
index f94d8bbb0d..4b4a4b1d73 100644
--- a/mdop/mbam-v2/how-to-use-the-help-desk-portal.md
+++ b/mdop/mbam-v2/how-to-use-the-help-desk-portal.md
@@ -1,12 +1,15 @@
 ---
 title: How to Use the Help Desk Portal
 description: How to Use the Help Desk Portal
-author: jamiejdt
+author: dansimp
 ms.assetid: c27f7737-10c8-4164-9de8-57987292c89c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -57,7 +60,7 @@ You can use the Administration and Monitoring website for many administrative ta
 **Note**  
 To access the various features offered by the Administration and Monitoring website, you must have the appropriate roles associated with your user account. For more information about understanding user roles, see [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md).
 
- 
+ 
 
 Use the following links to find information about the tasks that you can perform by using the Administration and Monitoring website:
 
@@ -71,9 +74,9 @@ Use the following links to find information about the tasks that you can perform
 
 -   [How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md b/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md
index 8d0fd5e6b0..bb6cf70424 100644
--- a/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md
+++ b/mdop/mbam-v2/how-to-use-the-self-service-portal-to-regain-access-to-a-computer.md
@@ -1,12 +1,15 @@
 ---
 title: How to Use the Self-Service Portal to Regain Access to a Computer
 description: How to Use the Self-Service Portal to Regain Access to a Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: bcf095de-0237-4bb0-b450-da8fb6d6f3d0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,12 +22,12 @@ If end users get locked out of Windows by BitLocker because they forgot their pa
 **Note**  
 If the IT administrator configured an IIS Session State time-out, a message is displayed 60 seconds prior to the time-out.
 
- 
+ 
 
 **Note**  
 These instructions are written for and from the perspective of end users.
 
- 
+ 
 
 **To use the Self-Service Portal to regain access to a computer**
 
@@ -33,7 +36,7 @@ These instructions are written for and from the perspective of end users.
     **Note**  
     If the first eight digits match multiple keys, a message displays that requires you to enter all 32 digits of the recovery key ID.
 
-     
+     
 
 2.  In the **Reason** field, select a reason for your request for the recovery key.
 
@@ -46,9 +49,9 @@ These instructions are written for and from the perspective of end users.
 
 [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md b/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md
index 78e6044a28..ad2f0f4528 100644
--- a/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md
+++ b/mdop/mbam-v2/how-to-validate-the-mbam-installation-with-configuration-manager.md
@@ -1,12 +1,15 @@
 ---
 title: How to Validate the MBAM Installation with Configuration Manager
 description: How to Validate the MBAM Installation with Configuration Manager
-author: jamiejdt
+author: dansimp
 ms.assetid: 8e268539-91c3-4e8a-baae-faf3605da818
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,7 +26,7 @@ After installing Microsoft BitLocker Administration and Monitoring (MBAM) with C
     **Note**  
     To validate the installation, you must use a domain account that has local computer administrative credentials on each server.
 
-     
+     
 
 2.  Use the Configuration Manager console to confirm that a new collection, called “MBAM Supported Computers,” is displayed.
 
@@ -66,9 +69,9 @@ After installing Microsoft BitLocker Administration and Monitoring (MBAM) with C
 
 [Deploying MBAM with Configuration Manager](deploying-mbam-with-configuration-manager-mbam2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/index.md b/mdop/mbam-v2/index.md
index 5337db9b65..ba76b06b55 100644
--- a/mdop/mbam-v2/index.md
+++ b/mdop/mbam-v2/index.md
@@ -1,52 +1,56 @@
 ---
 title: Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide
 description: Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide
-author: jamiejdt
+author: dansimp
 ms.assetid: fdb43f62-960a-4811-8802-50efdf04b4af
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 04/19/2017
 ---
 
-
 # Microsoft BitLocker Administration and Monitoring 2 Administrator's Guide
 
-
 Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 provides a simplified administrative interface that you can use to manage BitLocker drive encryption. In BitLocker Administration and Monitoring 2.0, you can select BitLocker drive encryption policy options that are appropriate for your enterprise, and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the enterprise as a whole. In addition, you can access recovery key information when users forget their PIN or password or when their BIOS or boot record changes.
 
-[Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md)  
+## Outline
 
-[About MBAM 2.0](about-mbam-20-mbam-2.md)**|**[Release Notes for MBAM 2.0](release-notes-for-mbam-20-mbam-2.md)**|**[About MBAM 2.0 SP1](about-mbam-20-sp1.md)**|**[Release Notes for MBAM 2.0 SP1](release-notes-for-mbam-20-sp1.md)**|**[Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md)**|**[High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md)**|**[Accessibility for MBAM 2.0](accessibility-for-mbam-20-mbam-2.md)
+- [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md)
+  - [About MBAM 2.0](about-mbam-20-mbam-2.md)
+  - [Release Notes for MBAM 2.0](release-notes-for-mbam-20-mbam-2.md)
+  - [About MBAM 2.0 SP1](about-mbam-20-sp1.md)
+  - [Release Notes for MBAM 2.0 SP1](release-notes-for-mbam-20-sp1.md)
+  - [Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md)
+  - [High-Level Architecture for MBAM 2.0](high-level-architecture-for-mbam-20-mbam-2.md)
+  - [Accessibility for MBAM 2.0](accessibility-for-mbam-20-mbam-2.md)
+- [Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md)
+  - [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md)
+  - [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md)
+  - [Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md)
+  - [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md)
+  - [MBAM 2.0 Planning Checklist](mbam-20-planning-checklist-mbam-2.md)
+- [Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md)
+  - [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md)
+  - [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md)
+  - [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md)
+  - [MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md)
+  - [Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md)
+- [Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md)
+  - [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md)
+  - [Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md)
+  - [Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md)
+  - [Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md)
+  - [Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md)
+  - [Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md)
+  - [Administering MBAM 2.0 Using PowerShell](administering-mbam-20-using-powershell-mbam-2.md)
+- [Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md)
 
-[Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md)  
+## More Information
 
-[Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md)**|**[MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md)**|**[Planning to Deploy MBAM 2.0](planning-to-deploy-mbam-20-mbam-2.md)**|**[MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md)**|**[MBAM 2.0 Planning Checklist](mbam-20-planning-checklist-mbam-2.md)
+- [MDOP Information Experience](index.md)
 
-[Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md)  
-
-[Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md)**|**[Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md)**|**[Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md)**|**[MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md)**|**[Upgrading from Previous Versions of MBAM](upgrading-from-previous-versions-of-mbam.md)
-
-[Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md)  
-
-[Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md)**|**[Administering MBAM 2.0 Features](administering-mbam-20-features-mbam-2.md)**|**[Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md)**|**[Performing BitLocker Management with MBAM](performing-bitlocker-management-with-mbam-mbam-2.md)**|**[Maintaining MBAM 2.0](maintaining-mbam-20-mbam-2.md)**|**[Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md)**|** [Administering MBAM 2.0 Using PowerShell](administering-mbam-20-using-powershell-mbam-2.md)
-
-[Troubleshooting MBAM 2.0](troubleshooting-mbam-20-mbam-2.md)  
-
-### More Information
-
--   [Release Notes for MBAM 2.0](release-notes-for-mbam-20-mbam-2.md)
-
-    View updated product information and known issues for MBAM 2.0.
-
--   [MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286)
-
-    Learn about the latest MDOP information and resources.
-
--   [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032)
-
-    Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447).
+  Find documentation, videos, and other resources for MDOP technologies.
 
  
 
diff --git a/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md b/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md
index 7ad10b81cc..d83b165ded 100644
--- a/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/maintaining-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Maintaining MBAM 2.0
 description: Maintaining MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 6479e093-840d-45d5-b759-1179aeeeefeb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md b/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md
index 43c3897209..74f3cbeaca 100644
--- a/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md
+++ b/mdop/mbam-v2/mbam-20-deployment-checklist-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: MBAM 2.0 Deployment Checklist
 description: MBAM 2.0 Deployment Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 7905d31d-f21c-4683-b9c4-95b815e08fab
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 This checklist can be used to help you during Microsoft BitLocker Administration and Monitoring (MBAM) deployment with a Stand-alone topology.
 
-**Note**  
+**Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when deploying Microsoft BitLocker Administration and Monitoring features. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+
 
 @@ -40,13 +43,13 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
@@ -61,46 +64,45 @@ This checklist outlines the recommended steps and a high-level list of items to
 
        • MBAM Group Policy template
          • 
-Note  
-
          Keep track of the names of the servers each feature is installed on. This information will be used throughout the installation process.
          
+Note
          Keep track of the names of the servers each feature is installed on. This information will be used throughout the installation process.
          
 
          
- 
+
 
          
-
+
-
-
+
+
-
+
-
+
          
 

          
 Checklist box
 
          Complete the planning phase to prepare the computing environment for MBAM deployment.
          [MBAM 2.0 Planning Checklist](mbam-20-planning-checklist-mbam-2.md)
          MBAM 2.0 Planning Checklist
          		
 
          		
 
          
 
          
 Checklist box
 
          Review the MBAM supported configurations information to make sure selected client and server computers are supported for MBAM feature installation.
          [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md)
          MBAM 2.0 Supported Configurations
          		
 
          		
 
          
 
          
 
 
 
          [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md)
          Deploying the MBAM 2.0 Server Infrastructure
          		
 
          		
 
          
 
          
 Checklist box
          Add Active Directory Domain Services security groups created during the planning phase to the appropriate local MBAM Server feature administrators groups on appropriate servers.
          [Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md) and [How to Manage MBAM Administrator Roles](how-to-manage-mbam-administrator-roles-mbam-2.md)
          Add Active Directory Domain Services security groups created during the planning phase to the appropriate local MBAM Server feature administrators groups on appropriate servers.
          Planning for MBAM 2.0 Administrator Roles and How to Manage MBAM Administrator Roles
          		
 
          		
 
          
 
          
 Checklist box
 
          Create and deploy required MBAM Group Policy Objects.
          [Deploying MBAM 2.0 Group Policy Objects](deploying-mbam-20-group-policy-objects-mbam-2.md)
          Deploying MBAM 2.0 Group Policy Objects
          		
 
          		
 
          
 
          
 Checklist box
 
          Deploy the MBAM Client software.
          [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md)
          Deploying the MBAM 2.0 Client
          		
 
          		
 
          
           
 
          
 
- 
+
 
 ## Related topics
 
 
 [Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md b/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md
index 7d4809eac0..4901f54cfe 100644
--- a/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md
+++ b/mdop/mbam-v2/mbam-20-deployment-prerequisites-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: MBAM 2.0 Deployment Prerequisites
 description: MBAM 2.0 Deployment Prerequisites
-author: jamiejdt
+author: dansimp
 ms.assetid: 57d1c2bb-5ea3-457e-badd-dd9206ff0f20
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -88,12 +91,12 @@ Each of the MBAM Server features has specific prerequisites that must be met bef
 
 
 
- 
 
-**Note**  
+
+**Note**  
 For a list of supported operating systems, see [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md).
 
- 
+
 
 ### Prerequisites for the Compliance and Audit Reports
 
@@ -111,7 +114,7 @@ For a list of supported operating systems, see [MBAM 2.0 Supported Configuration
 
 
 
          Supported version of SQL Server
          
-
          See [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) for supported versions.
          
+
          See MBAM 2.0 Supported Configurations for supported versions.
          
 
          Install SQL Server with:
          
 
            
 
          • SQL_Latin1_General_CP1_CI_AS collation
            • 
@@ -133,7 +136,7 @@ For a list of supported operating systems, see [MBAM 2.0 Supported Configuration
 
 
 
- 
+
 
 ### Prerequisites for the Recovery Database
 
@@ -151,7 +154,7 @@ For a list of supported operating systems, see [MBAM 2.0 Supported Configuration
 
 
 
            Supported version of SQL Server
            
-
            See [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) for supported versions.
            
+
            See MBAM 2.0 Supported Configurations for supported versions.
            
 
            Install SQL Server with:
            
 
              
 
            • SQL_Latin1_General_CP1_CI_AS collation
              • 
@@ -176,20 +179,19 @@ For a list of supported operating systems, see [MBAM 2.0 Supported Configuration
 
 
 
              Optional - Install Transparent Data Encryption (TDE) feature available in SQL Server
              
-
              The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with many laws, regulations, and guidelines established in various industries.
              
+
              The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with many laws, regulations, and guidelines established in various industries.
              
 
              
-Note  
-
              TDE performs real-time decryption of database information, which means that, if the account under which you are logged on has permissions to the database while you are viewing the recovery key information in the SQL Server tables, the recovery key information is visible.
              
+Note
              TDE performs real-time decryption of database information, which means that, if the account under which you are logged on has permissions to the database while you are viewing the recovery key information in the SQL Server tables, the recovery key information is visible.
              
 
              
 
              
- 
+
 
              
-
              More about TDE: [MBAM 2.0 Security Considerations](mbam-20-security-considerations-mbam-2.md).
              
+
              More about TDE: MBAM 2.0 Security Considerations.
              
 
 
 
 
- 
+
 
 ### Prerequisites for the Compliance and Audit Database
 
@@ -207,7 +209,7 @@ For a list of supported operating systems, see [MBAM 2.0 Supported Configuration
 
 
 
              Supported version of SQL Server
              
-
              See [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) for supported versions.
              
+
              See MBAM 2.0 Supported Configurations for supported versions.
              
 
              Install SQL Server with:
              
 
                
 
              • SQL_Latin1_General_CP1_CI_AS collation
                • 
@@ -232,15 +234,14 @@ For a list of supported operating systems, see [MBAM 2.0 Supported Configuration
 
 
 
                Optional - Install Transparent Data Encryption (TDE) feature in SQL Server.
                
-
                The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with many laws, regulations, and guidelines established in various industries.
                
+
                The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with many laws, regulations, and guidelines established in various industries.
                
 
                
-Note  
-
                TDE performs real-time decryption of database information, which means that, if the account under which you are logged on has permissions to the database while you are viewing the recovery key information in the SQL Server tables, the recovery key information is visible.
                
+Note
                TDE performs real-time decryption of database information, which means that, if the account under which you are logged on has permissions to the database while you are viewing the recovery key information in the SQL Server tables, the recovery key information is visible.
                
 
                
 
                
- 
+
 
                
-
                More about TDE: [MBAM 2.0 Security Considerations](mbam-20-security-considerations-mbam-2.md)
                
+
                More about TDE: MBAM 2.0 Security Considerations
                
 
 
 
                SQL Server must have Database Engine Services installed and running during MBAM Server installation.
                
@@ -253,7 +254,7 @@ For a list of supported operating systems, see [MBAM 2.0 Supported Configuration
 
 
 
- 
+
 
 ### Prerequisites for the Self-Service Portal
 
@@ -271,12 +272,12 @@ For a list of supported operating systems, see [MBAM 2.0 Supported Configuration
 
 
 
                Supported version of Windows Server
                
-
                See [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md) for supported versions.
                
+
                See MBAM 2.0 Supported Configurations for supported versions.
                
 
                
 
 
 
                ASP.NET MVC 2.0
                
-
                [ASP.NET MVC 2 download](https://go.microsoft.com/fwlink/?LinkId=392270)
                
+
                ASP.NET MVC 2 download
                
 
 
 
                Web Service IIS Management Tools
                
@@ -285,7 +286,7 @@ For a list of supported operating systems, see [MBAM 2.0 Supported Configuration
 
 
 
- 
+
 
 ## Prerequisites for MBAM Clients
 
@@ -311,24 +312,23 @@ For a list of supported operating systems, see [MBAM 2.0 Supported Configuration
 
                For more information, see the BIOS documentation.
                
 
 
-
                Windows 8 clients only: To have MBAM store and manage the TPM recovery keys: TPM auto-provisioning must be turned off, and MBAM must be set as the owner of the TPM before you deploy MBAM. To turn off TPM auto-provisioning, see [Disable-TpmAutoProvisioning](https://go.microsoft.com/fwlink/?LinkId=286468).
                
+
                Windows 8 clients only: To have MBAM store and manage the TPM recovery keys: TPM auto-provisioning must be turned off, and MBAM must be set as the owner of the TPM before you deploy MBAM. To turn off TPM auto-provisioning, see Disable-TpmAutoProvisioning.
                
 
                  
 
                • TPM auto-provisioning must be turned off.
                  • 
 
                • MBAM must be set as the owner of the TPM before you deploy MBAM.
                  • 
 
                
-
                To turn off TPM auto-provisioning, see [Disable-TpmAutoProvisioning](https://go.microsoft.com/fwlink/?LinkId=286468).
                
+
                To turn off TPM auto-provisioning, see Disable-TpmAutoProvisioning.
                
 
                
-Note  
-
                Ensure that the keyboard, video, or mouse are directly connected and not managed through a keyboard, video, or mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware.
                
+Note
                Ensure that the keyboard, video, or mouse are directly connected and not managed through a keyboard, video, or mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware.
                
 
                
 
                
- 
+
 
                
 
 
 
 
- 
+
 
 ## Related topics
 
@@ -337,9 +337,9 @@ For a list of supported operating systems, see [MBAM 2.0 Supported Configuration
 
 [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md b/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md
index 0b31b7f6a2..dd323a9429 100644
--- a/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md
+++ b/mdop/mbam-v2/mbam-20-planning-checklist-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: MBAM 2.0 Planning Checklist
 description: MBAM 2.0 Planning Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 16b27c27-5f5e-41e2-b526-89a036672fb8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ This checklist can be used to help you plan for preparing your computing environ
 **Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when planning for an Microsoft BitLocker Administration and Monitoring deployment. It is recommended that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+ 
 
 @@ -40,64 +43,64 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
                
 

                
 Checklist box
 
                Review the getting started information about MBAM to gain a basic understanding of the product before beginning deployment planning.
                [Getting Started with MBAM 2.0](getting-started-with-mbam-20-mbam-2.md)
                Getting Started with MBAM 2.0
                		
 
                		
 
                
 
                
 Checklist box
 
                Plan for MBAM 2.0 Deployment Prerequisites and prepare your computing environment.
                [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md)
                MBAM 2.0 Deployment Prerequisites
                		
 
                		
 
                
 
                
 Checklist box
 
                Plan for and configure MBAM Group Policy requirements.
                [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md)
                Planning for MBAM 2.0 Group Policy Requirements
                		
 
                		
 
                
 
                
 Checklist box
 
                Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.
                [Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md)
                Planning for MBAM 2.0 Administrator Roles
                		
 
                		
 
                
 
                
 Checklist box
 
                Review the MBAM 2.0 Supported Configurations documentation to ensure that hardware that meets MBAM installation system requirements is available.
                [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md)
                MBAM 2.0 Supported Configurations
                		
 
                		
 
                
 
                
 Checklist box
 
                Plan for deploying MBAM Server feature deployment.
                [Planning for MBAM 2.0 Server Deployment](planning-for-mbam-20-server-deployment-mbam-2.md)
                Planning for MBAM 2.0 Server Deployment
                		
 
                		
 
                
 
                
 Checklist box
 
                Plan for deploying MBAM Client deployment.
                [Planning for MBAM 2.0 Client Deployment](planning-for-mbam-20-client-deployment-mbam-2.md)
                Planning for MBAM 2.0 Client Deployment
                		
 
                		
 
                
 
                
 Checklist box
 
                Validate your deployment plan in a test environment.
                [Evaluating MBAM 2.0](evaluating-mbam-20-mbam-2.md)
                Evaluating MBAM 2.0
                		
 
                		
 
                
                 
 
                
 
- 
+ 
 
 ## Related topics
 
 
 [Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md b/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md
index 113fd20178..2c93b51293 100644
--- a/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md
+++ b/mdop/mbam-v2/mbam-20-privacy-statement-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: MBAM 2.0 Privacy Statement
 description: MBAM 2.0 Privacy Statement
-author: jamiejdt
+author: dansimp
 ms.assetid: fce72ad4-a837-4d17-8d3b-4d93f1a399be
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md b/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md
index 17b527d4b9..74670be60b 100644
--- a/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md
+++ b/mdop/mbam-v2/mbam-20-security-considerations-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: MBAM 2.0 Security Considerations
 description: MBAM 2.0 Security Considerations
-author: jamiejdt
+author: dansimp
 ms.assetid: 0aa5c6e2-d92c-4e30-9f6a-b48abb667ae5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -79,7 +82,7 @@ No Active Directory groups are created automatically during the MBAM setup proce
 
 
 
- 
+ 
 
 ###  MBAM Server Local Groups
 
@@ -124,7 +127,7 @@ MBAM Setup creates local groups to support MBAM operations. You should add the A
 
 
 
- 
+ 
 
 ### SSRS Reports Service Account
 
@@ -135,7 +138,7 @@ When you configure the SSRS Reports service account, specify a domain user accou
 **Note**  
 If you change the name of the service account after you deploy MBAM, you must reconfigure the reporting data source to use the new service account credentials. Otherwise, you will not be able to access the Help Desk Portal.
 
- 
+ 
 
 ##  MBAM Log Files
 
@@ -144,7 +147,7 @@ The following MBAM Setup log files are created in the installing user’s %temp%
 
 **MBAM Server Setup log files**
 
-MSI*<five random characters>*.log  
+MSI<five random characters>.log  
 Logs the actions taken during MBAM Setup and MBAM Server Feature installation.
 
 InstallComplianceDatabase.log  
@@ -168,11 +171,11 @@ Logs actions taken to authorize web services to the MBAM Recovery database for k
 **Note**  
 In order to obtain additional MBAM Setup log files, you have to install MBAM by using the msiexec package and the /L <location> option. Log files are created in the location specified.
 
- 
+ 
 
 **MBAM Client Setup log files**
 
-MSI*<five random characters>*.log  
+MSI<five random characters>.log  
 Logs the actions taken during MBAM Client installation.
 
 ##  MBAM Database TDE Considerations
@@ -193,9 +196,9 @@ For more information about TDE in SQL Server 2008, see [SQL Server Encryption](
 
 [Security and Privacy for MBAM 2.0](security-and-privacy-for-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md b/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md
index 6daffd3739..43687475bb 100644
--- a/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md
+++ b/mdop/mbam-v2/mbam-20-supported-configurations-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: MBAM 2.0 Supported Configurations
 description: MBAM 2.0 Supported Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: dca63391-39fe-4273-a570-76d0a2f8a0fd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -23,7 +26,7 @@ The recommended configuration for running MBAM in a production environment is wi
 **Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+ 
 
 ##  MBAM Server System Requirements
 
@@ -63,12 +66,12 @@ The following table lists the operating systems that are supported for the Micro
 
 
 
- 
+ 
 
 **Note**  
 There is no support for installing MBAM services, reports, or databases on a domain controller computer.
 
- 
+ 
 
 ### Server Processor, RAM, and Disk Space Requirements
 
@@ -104,7 +107,7 @@ There is no support for installing MBAM services, reports, or databases on a dom
 
 
 
- 
+ 
 
 ### SQL Server Database Requirements
 
@@ -113,7 +116,7 @@ The following table lists the SQL Server versions that are supported for the Ad
 **Note**  
 MBAM does not natively support SQL clustering, mirroring, or Availability Groups. To install the databases, you must run the MBAM Server installation on a stand-alone SQL server.
 
- 
+ 
 
 @@ -146,7 +149,7 @@ MBAM does not natively support SQL clustering, mirroring, or Availability Groups
 
                
 

 
                
 
- 
+ 
 
 @@ -180,7 +183,7 @@ MBAM does not natively support SQL clustering, mirroring, or Availability Groups
 
                
 

 
                
 
- 
+ 
 
 ##  MBAM Client System Requirements
 
@@ -226,7 +229,7 @@ The following table lists the operating systems that are supported for Microsoft
 
 
 
- 
+ 
 
 ### Client RAM Requirements
 
@@ -280,7 +283,7 @@ The following table lists the operating systems that are supported for Microsoft
 
 
 
- 
+ 
 
 ## Related topics
 
@@ -289,9 +292,9 @@ The following table lists the operating systems that are supported for Microsoft
 
 [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md b/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md
index 28b734eb4c..be5f19b3a8 100644
--- a/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Monitoring and Reporting BitLocker Compliance with MBAM 2.0
 description: Monitoring and Reporting BitLocker Compliance with MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 0b9ba701-0aad-4e16-9b32-73d358047ccc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md b/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md
index 0d40b11e54..5de22fee46 100644
--- a/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/operations-for-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Operations for MBAM 2.0
 description: Operations for MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: ece72016-4ffa-48df-8c12-1e442ee9e980
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md b/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md
index db4931a08f..c132428d23 100644
--- a/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md
+++ b/mdop/mbam-v2/performing-bitlocker-management-with-mbam-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Performing BitLocker Management with MBAM
 description: Performing BitLocker Management with MBAM
-author: jamiejdt
+author: dansimp
 ms.assetid: 9bfc6c67-f12c-4daa-8f08-5884fb47443c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md
index f45551b51c..dcc4dfb344 100644
--- a/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md
+++ b/mdop/mbam-v2/planning-for-mbam-20-administrator-roles-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for MBAM 2.0 Administrator Roles
 description: Planning for MBAM 2.0 Administrator Roles
-author: jamiejdt
+author: dansimp
 ms.assetid: 6f813297-6479-42d3-a21b-896d54466b5b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,7 +19,7 @@ ms.date: 06/16/2016
 
 This topic lists and describes the available administrator roles that are available in Microsoft BitLocker Administration and Monitoring (MBAM) as well as the server locations where the local groups are created.
 
-##  MBAM Administrator Roles
+## MBAM Administrator Roles
 
 
  **MBAM System Administrators**  
@@ -34,16 +37,16 @@ Administrators in this role have increased access to the Help Desk features from
 **Important**  
 To view reports, an administrative user must be a member of the **MBAM Report Users** security group on the Administration and Monitoring Server, Compliance and Audit Database, and on the server that hosts the Compliance and Audit Reports feature. As a best practice, create a security group in Active Directory Domain Services with rights on the local **MBAM Report Users** security group on both the Administration and Monitoring Server and the server that hosts the Compliance and Audit Reports.
 
- 
+ 
 
 ## Related topics
 
 
 [Preparing your Environment for MBAM 2.0](preparing-your-environment-for-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md
index 41837ee12a..cc8dfa17dc 100644
--- a/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md
+++ b/mdop/mbam-v2/planning-for-mbam-20-client-deployment-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for MBAM 2.0 Client Deployment
 description: Planning for MBAM 2.0 Client Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 3a92cf29-092f-4cad-bdfa-d5f6aafe554b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,7 +26,7 @@ If you deploy MBAM with the Configuration Manager topology, you can use Configur
 **Note**  
 Windows To Go is not supported for integrated Configuration Manager installations of MBAM if you are using Configuration Manager 2007.
 
- 
+ 
 
 ## Deploying the MBAM Client to Enable BitLocker Encryption After Computer Distribution to End Users
 
@@ -35,7 +38,7 @@ When you deploy the MBAM Client after you distribute computers to client compute
 **Note**  
 In this approach, users who have computers with a TPM chip are prompted to activate and initialize the TPM chip if the chip has not been previously activated.
 
- 
+ 
 
 ## Using the MBAM Client to Enable BitLocker Encryption Before Computer Distribution to End Users
 
@@ -47,7 +50,7 @@ If your organization wants to use the TPM chip to encrypt computers, the adminis
 **Note**  
 The TPM protector option requires the administrator to accept the BIOS prompt to activate and initialize the TPM before the computer is delivered to the user.
 
- 
+ 
 
 ## Related topics
 
@@ -56,9 +59,9 @@ The TPM protector option requires the administrator to accept the BIOS prompt to
 
 [Deploying the MBAM 2.0 Client](deploying-the-mbam-20-client-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md
index 2589044572..d5311487bf 100644
--- a/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md
+++ b/mdop/mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for MBAM 2.0 Group Policy Requirements
 description: Planning for MBAM 2.0 Group Policy Requirements
-author: jamiejdt
+author: dansimp
 ms.assetid: f5e19dcb-eb15-4722-bb71-0734b3799eb8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -22,10 +25,10 @@ MBAM supports the following types of BitLocker protectors for fixed data drives:
 
 The numeric password protector is applied automatically as part of volume encryption and does not need to be configured.
 
-**Important**  
+**Important**  
 The default Windows BitLocker drive encryption Group Policy Object (GPO) settings are not used by MBAM and can cause conflicting behavior if they are enabled. To enable MBAM to manage BitLocker, you must define the MBAM Group Policy settings only after installing the MBAM Group Policy template.
 
- 
+
 
 Enhanced startup PINs can contain characters, such as uppercase and lowercase letters, and numbers. Unlike BitLocker, MBAM does not support the use of symbols and spaces for enhanced PINs.
 
@@ -33,10 +36,10 @@ Install the MBAM Group Policy template on a computer that is capable of running
 
 The MDOP MBAM (BitLocker Management) GPO node contains four global policy settings and four child GPO settings nodes: Client Management, Fixed Drive, Operating System Drive, and Removable Drive. The following sections provide policy definitions and suggested policy settings to assist you in planning for MBAM GPO policy setting requirements.
 
-**Note**  
+**Note**  
 For more information about configuring the minimum, recommended GPO settings to enable MBAM to manage BitLocker encryption, see [How to Edit MBAM 2.0 GPO Settings](how-to-edit-mbam-20-gpo-settings-mbam-2.md).
 
- 
+
 
 ## Global Policy Definitions
 
@@ -83,7 +86,7 @@ This section describes MBAM Global policy definitions found at the following GPO
 
 
 
- 
+
 
 ## Client Management Policy Definitions
 
@@ -118,14 +121,13 @@ This section describes Client Management policy definitions for Microsoft BitLoc
 
                Configure user exemption policy
                
 
                Suggested Configuration: Not Configured
                
 
                This policy setting lets you configure a web site address, email address, or phone number that will instruct a user to request an exemption from BitLocker encryption.
                
-
                If you enable this policy setting and provide a web site address, email address, or phone number, users will see a dialog that gives them instructions on how to apply for an exemption from BitLocker protection. For more information about enabling BitLocker encryption exemptions for users, see [How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-2.md).
                
+
                If you enable this policy setting and provide a web site address, email address, or phone number, users will see a dialog that gives them instructions on how to apply for an exemption from BitLocker protection. For more information about enabling BitLocker encryption exemptions for users, see How to Manage User BitLocker Encryption Exemptions.
                
 
                If you either disable or do not configure this policy setting, the exemption request instructions will not be presented to users.
                
 
                
-Note  
-
                User exemption is managed per user, not per computer. If multiple users log on to the same computer and any one user is not exempt, the computer will be encrypted.
                
+Note
                User exemption is managed per user, not per computer. If multiple users log on to the same computer and any one user is not exempt, the computer will be encrypted.
                
 
                
 
                
- 
+
 
                
 
 
@@ -138,9 +140,9 @@ This section describes Client Management policy definitions for Microsoft BitLoc
 
 
 
- 
 
-##  Fixed Drive Policy Definitions
+
+## Fixed Drive Policy Definitions
 
 
 This section describes Fixed Drive policy definitions for Microsoft BitLocker Administration and Monitoring found at the following GPO node: **Computer Configuration**\\**Policies**\\**Administrative Templates**\\**Windows Components**\\**MDOP MBAM (BitLocker Management)**\\**Fixed Drive**.
@@ -202,7 +204,7 @@ This section describes Fixed Drive policy definitions for Microsoft BitLocker Ad
 
 
 
- 
+
 
 ## Operating System Drive Policy Definitions
 
@@ -230,7 +232,7 @@ This section describes Operating System Drive policy definitions for Microsoft B
 
              • Allow Standby States (S1-S3) When Sleeping (Plugged In)
                • 
 
              • Allow Standby States (S1-S3) When Sleeping (On Battery)
                • 
 
              
-
              If you are running Microsoft Windows 8 or later, and you want to use BitLocker on a computer without a TPM, select the Allow BitLocker without a compatible TPM check box. In this mode, a password is required for startup. If you forget the password, you have to use one of the BitLocker recovery options to access the drive.
              
+
              If you are running Microsoft Windows 8 or later, and you want to use BitLocker on a computer without a TPM, select the Allow BitLocker without a compatible TPM check box. In this mode, a password is required for startup. If you forget the password, you have to use one of the BitLocker recovery options to access the drive.
              
 
              On a computer with a compatible TPM, two types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require the entry of a personal identification number (PIN).
              
 
              If you enable this policy setting, users have to put the operating system drive under BitLocker protection, and the drive will be encrypted.
              
 
              If you disable this policy, users will not be able to put the operating system drive under BitLocker protection. If you apply this policy after the operating system drive is encrypted, the drive will be decrypted.
              
@@ -252,7 +254,7 @@ This section describes Operating System Drive policy definitions for Microsoft B
 
 
 
- 
+
 
 ## Removable Drive Policy Definitions
 
@@ -309,16 +311,16 @@ This section describes Removable Drive Policy definitions for Microsoft BitLocke
 
 
 
- 
+
 
 ## Related topics
 
 
 [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md
index 0be6ff9603..32ad03c576 100644
--- a/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/planning-for-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for MBAM 2.0
 description: Planning for MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 1206bd18-05ea-4ca8-9362-07e512503c3f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md b/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md
index 73292042ec..c345da750c 100644
--- a/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md
+++ b/mdop/mbam-v2/planning-for-mbam-20-server-deployment-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for MBAM 2.0 Server Deployment
 description: Planning for MBAM 2.0 Server Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: b57f1a42-134f-4997-8697-7fbed08e2fc4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The Microsoft BitLocker Administration and Monitoring (MBAM) server infrastructu
 **Note**  
 Installations of Microsoft BitLocker Administration and Monitoring on a single server are recommended only for test environments.
 
- 
+ 
 
 ## Planning for MBAM Server Deployment
 
@@ -66,7 +69,7 @@ To deploy MBAM features on multiple servers, you have to install the features in
 **Note**  
 Keep track of the names of the computers on which you install each feature. You have to use this information throughout the installation process. You can print and use a deployment checklist to assist in this effort. For more information about the MBAM Deployment Checklist, see [MBAM 2.0 Deployment Checklist](mbam-20-deployment-checklist-mbam-2.md).
 
- 
+ 
 
 ## Related topics
 
@@ -75,9 +78,9 @@ Keep track of the names of the computers on which you install each feature. You
 
 [Deploying the MBAM 2.0 Server Infrastructure](deploying-the-mbam-20-server-infrastructure-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md b/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md
index 5a04a9f727..118968c502 100644
--- a/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/planning-to-deploy-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Planning to Deploy MBAM 2.0
 description: Planning to Deploy MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 2dc05fcd-aed9-4315-aeaf-92aaa9e0e955
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -31,7 +34,7 @@ The MBAM Server infrastructure depends on a set of server features that can be i
 **Note**  
 An MBAM installation on a single server is recommended only for lab environments.
 
- 
+ 
 
 The MBAM Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through an enterprise software delivery system or by installing the client agent on client computers as part of the initial imaging process.
 
@@ -46,9 +49,9 @@ With MBAM, you can encrypt a computer in your organization either before the end
 
 [Planning for MBAM 2.0](planning-for-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md b/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md
index 34909723c3..59aa487003 100644
--- a/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md
+++ b/mdop/mbam-v2/planning-to-deploy-mbam-with-configuration-manager-2.md
@@ -1,12 +1,15 @@
 ---
 title: Planning to Deploy MBAM with Configuration Manager
 description: Planning to Deploy MBAM with Configuration Manager
-author: jamiejdt
+author: dansimp
 ms.assetid: fb768306-48c2-40b4-ac4e-c279db987391
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -16,10 +19,10 @@ ms.date: 08/30/2016
 
 To deploy MBAM with the Configuration Manager topology, a three-server architecture, which supports 200,000 clients, is recommended. Use a separate server to run Configuration Manager, and install the basic Administration and Monitoring features on two servers, as shown in the architecture image in [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md).
 
-**Important**  
+**Important**  
 Windows To Go is not supported when you install the integrated topology of MBAM with Configuration Manager 2007.
 
- 
+
 
 ## Deployment Prerequisites for Installing MBAM with Configuration Manager
 
@@ -44,23 +47,23 @@ Ensure that you have met the following prerequisites before you install MBAM wit
 
 
 
              Enable the Hardware Inventory Client Agent on the Configuration Manager Server.
              
-
              For Configuration Manager 2007, see [How to Configure Hardware Inventory for a Site](https://go.microsoft.com/fwlink/?LinkId=301656).
              
-
              For System Center 2012 Configuration Manager, see [How to Configure Hardware Inventory in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=301685).
              
+
              For Configuration Manager 2007, see How to Configure Hardware Inventory for a Site.
              
+
              For System Center 2012 Configuration Manager, see How to Configure Hardware Inventory in Configuration Manager.
              
 
 
 
              Enable the Desired Configuration Management (DCM) agent or the compliance settings, depending on the version of Configuration Manager that you are using.
              
-
              For Configuration Manager 2007, enable the see [Desired Configuration Management Client Agent Properties](https://go.microsoft.com/fwlink/?LinkId=301686).
              
-
              For System Center 2012 Configuration Manager, see [Configuring Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=301687).
              
+
              For Configuration Manager 2007, enable the see Desired Configuration Management Client Agent Properties.
              
+
              For System Center 2012 Configuration Manager, see Configuring Compliance Settings in Configuration Manager.
              
 
 
 
              Define a reporting services point in Configuration Manager. Required for SQL Reporting Services.
              
-
              For Configuration Manager 2007, see [How to Create a Reporting Services Point for SQL Reporting Services](https://go.microsoft.com/fwlink/?LinkId=301688).
              
-
              For System Center 2012 Configuration Manager, see [Prerequisites for Reporting in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=301689).
              
+
              For Configuration Manager 2007, see How to Create a Reporting Services Point for SQL Reporting Services.
              
+
              For System Center 2012 Configuration Manager, see Prerequisites for Reporting in Configuration Manager.
              
 
 
 
 
- 
+
 
 ##  Configuration Manager Supported Versions
 
@@ -86,22 +89,21 @@ MBAM supports the following versions of Configuration Manager:
 
              SP1 or later
              
 
              64-bit
              
 
              
-Note  
-
              Although Configuration Manager 2007 is 32 bit, you must install it and SQL Server on a 64-bit operating system in order to match the 64-bit MBAM software.
              
+Note
              Although Configuration Manager 2007 is 32 bit, you must install it and SQL Server on a 64-bit operating system in order to match the 64-bit MBAM software.
              
 
              
 
              
- 
+
 
              
 
 
-
              Microsoft System Center 2012 Configuration Manager
              
+
              Microsoft System Center 2012 Configuration Manager
              
 
              SP1
              
 
              64-bit
              
 
 
 
 
- 
+
 
 For a list of supported configurations for the Configuration Manager Server, see the appropriate webpage for the version of Configuration Manager that you are using. MBAM has no additional system requirements for the Configuration Manager Server.
 
@@ -147,9 +149,9 @@ The following table lists the server processor, RAM, and disk space requirements
 
 
 
- 
 
-## SQL Server Processor, RAM, and Disk Space Requirements
+
+## SQL Server Processor, RAM, and Disk Space Requirements
 
 
 The following table lists the server processor, RAM, and disk space requirements for the SQL Server computer when you are using the Configuration Manager Integration topology.
@@ -186,7 +188,7 @@ The following table lists the server processor, RAM, and disk space requirements
 
 
 
- 
+
 
 ## Required permissions to install the MBAM Server
 
@@ -216,9 +218,9 @@ To install MBAM with Configuration Manager, you must have an administrative user
 
 
 
- 
 
-**System Center 2012 Configuration Manager**
+
+**System Center 2012 Configuration Manager**
 
 @@ -247,7 +249,7 @@ To install MBAM with Configuration Manager, you must have an administrative user
 
              
 

 
              
 
- 
+
 
 **Configuration Manager 2007**
 
@@ -278,7 +280,7 @@ To install MBAM with Configuration Manager, you must have an administrative user
 
 
 
- 
+
 
 ## Order of Deployment of MBAM Features for the Configuration Manager Topology
 
@@ -319,7 +321,7 @@ This checklist outlines the recommended steps and a high-level list of items to
 
 Checklist box
 
              Review the getting started information, which describes how Configuration Manager works with MBAM and shows the recommended high-level architecture.
              
-
              [Getting Started - Using MBAM with Configuration Manager](getting-started---using-mbam-with-configuration-manager.md)
              
+
              Getting Started - Using MBAM with Configuration Manager
              
 
              
 
 
@@ -331,34 +333,34 @@ This checklist outlines the recommended steps and a high-level list of items to
 
 Checklist box
 
              Plan for and configure MBAM Group Policy requirements.
              
-
              [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md)
              
+
              Planning for MBAM 2.0 Group Policy Requirements
              
 
              
 
 
 Checklist box
-
              Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.
              
-
              [Planning for MBAM 2.0 Administrator Roles](planning-for-mbam-20-administrator-roles-mbam-2.md)
              
+
              Plan for and create necessary Active Directory Domain Services security groups and plan for MBAM local security group membership requirements.
              
+
              Planning for MBAM 2.0 Administrator Roles
              
 
              
 
 
 Checklist box
 
              Plan for deploying MBAM Client deployment.
              
-
              [Planning for MBAM 2.0 Client Deployment](planning-for-mbam-20-client-deployment-mbam-2.md)
              
+
              Planning for MBAM 2.0 Client Deployment
              
 
              
 
 
 
 
- 
+
 
 ## Related topics
 
 
 [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md b/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md
index 98e75c6262..c726106add 100644
--- a/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/preparing-your-environment-for-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Preparing your Environment for MBAM 2.0
 description: Preparing your Environment for MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 5fb01da9-620e-4992-9e54-2ed3fb69e6af
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -28,7 +31,7 @@ To ensure successful installation of MBAM Clients and MBAM Server features, ensu
 **Note**  
 MBAM Setup checks that all prerequisites are met before installation starts. If all prerequisites are not met, Setup will fail.
 
- 
+ 
 
 [MBAM 2.0 Deployment Prerequisites](mbam-20-deployment-prerequisites-mbam-2.md)
 
@@ -40,7 +43,7 @@ Before MBAM can manage clients in the enterprise, you must define Group Policy f
 **Important**  
 MBAM will not work with policies for stand-alone BitLocker drive encryption. Group Policy settings must be defined for MBAM, or BitLocker encryption and enforcement will fail.
 
- 
+ 
 
 [Planning for MBAM 2.0 Group Policy Requirements](planning-for-mbam-20-group-policy-requirements-mbam-2.md)
 
@@ -58,9 +61,9 @@ The membership of Microsoft BitLocker Administration and Monitoring roles can be
 
 [MBAM 2.0 Supported Configurations](mbam-20-supported-configurations-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md b/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md
index 098ae2f798..2bbbd782ed 100644
--- a/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/release-notes-for-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Release Notes for MBAM 2.0
 description: Release Notes for MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: c3f16cf3-94f2-47ac-b3a4-3dc505c6a8dd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -35,7 +38,7 @@ If you are using the MBAM Stand-alone topology, and you upgrade the server infra
 
 WORKAROUND: After the upgrade, run the following script on the Compliance and Audit Database:
 
-``` syntax
+```sql
 -- =============================================
 -- Script Template
 -- =============================================
@@ -196,96 +199,96 @@ This section contains hotfixes and KB articles for MBAM 2.0.
 
 
              2831166
              
 
              Installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 fails with "System Center CM Objects Already Installed"
              
-
              [support.microsoft.com/kb/2831166/EN-US](https://support.microsoft.com/kb/2831166/EN-US)
              
+
              support.microsoft.com/kb/2831166/EN-US
              
 
 
 
              2870849
              
 
              Users cannot retrieve BitLocker Recovery key using MBAM 2.0 Self Service Portal
              
-
              [support.microsoft.com/kb/2870849/EN-US](https://support.microsoft.com/kb/2870849/EN-US)
              
+
              support.microsoft.com/kb/2870849/EN-US
              
 
 
 
              2756402
              
 
              MBAM client would fail with Event ID 4 and error code 0x8004100E in the Event description
              
-
              [support.microsoft.com/kb/2756402/EN-US](https://support.microsoft.com/kb/2756402/EN-US)
              
+
              support.microsoft.com/kb/2756402/EN-US
              
 
 
 
              2620287
              
 
              Error Message “Server Error in ‘/Reports’ Application” When You Click Reports Tab in MBAM
              
-
              [support.microsoft.com/kb/2620287/EN-US](https://support.microsoft.com/kb/2620287/EN-US)
              
+
              support.microsoft.com/kb/2620287/EN-US
              
 
 
 
              2639518
              
 
              Error opening Enterprise or Computer Compliance Reports in MBAM
              
-
              [support.microsoft.com/kb/2639518/EN-US](https://support.microsoft.com/kb/2639518/EN-US)
              
+
              support.microsoft.com/kb/2639518/EN-US
              
 
 
 
              2620269
              
 
              MBAM Enterprise Reporting Not Getting Updated
              
-
              [support.microsoft.com/kb/2620269/EN-US](https://support.microsoft.com/kb/2620269/EN-US)
              
+
              support.microsoft.com/kb/2620269/EN-US
              
 
 
 
              2712461
              
 
              Installing MBAM on a Domain Controller is not supported
              
-
              [support.microsoft.com/kb/2712461/EN-US](https://support.microsoft.com/kb/2712461/EN-US)
              
+
              support.microsoft.com/kb/2712461/EN-US
              
 
 
 
              2876732
              
 
              You receive error code 0x80071a90 during Standalone or Configuration Manager Integration setup of MBAM 2.0
              
-
              [support.microsoft.com/kb/2876732/EN-US](https://support.microsoft.com/kb/2876732/EN-US)
              
+
              support.microsoft.com/kb/2876732/EN-US
              
 
 
 
              2754259
              
 
              MBAM and Secure Network Communication
              
-
              [support.microsoft.com/kb/2754259/EN-US](https://support.microsoft.com/kb/2754259/EN-US)
              
+
              support.microsoft.com/kb/2754259/EN-US
              
 
 
 
              2870842
              
 
              MBAM 2.0 Setup fails during Configuration Manager Integration Scenario with SQL Server 2008
              
-
              [support.microsoft.com/kb/2870842/EN-US](https://support.microsoft.com/kb/2870842/EN-US)
              
+
              support.microsoft.com/kb/2870842/EN-US
              
 
 
 
              2668533
              
 
              MBAM Setup fails if SQL SSRS is not configured properly
              
-
              [support.microsoft.com/kb/2668533/EN-US](https://support.microsoft.com/kb/2668533/EN-US)
              
+
              support.microsoft.com/kb/2668533/EN-US
              
 
 
 
              2870847
              
-
              MBAM 2.0 Setup fails with "Error retrieving Configuration Manager Server role settings for 'Reporting Services Point' role"
              
-
              [support.microsoft.com/kb/2870847/EN-US](https://support.microsoft.com/kb/2870847/EN-US)
              
+
              MBAM 2.0 Setup fails with "Error retrieving Configuration Manager Server role settings for 'Reporting Services Point' role"
              
+
              support.microsoft.com/kb/2870847/EN-US
              
 
 
 
              2870839
              
 
              MBAM 2.0 Enterprise Reports are not refreshed in MBAM 2.0 Standalone topology due to SQL job CreateCache failure
              
-
              [support.microsoft.com/kb/2870839/EN-US](https://support.microsoft.com/kb/2870839/EN-US)
              
+
              support.microsoft.com/kb/2870839/EN-US
              
 
 
 
              2620269
              
 
              MBAM Enterprise Reporting Not Getting Updated
              
-
              [support.microsoft.com/kb/2620269/EN-US](https://support.microsoft.com/kb/2620269/EN-US)
              
+
              support.microsoft.com/kb/2620269/EN-US
              
 
 
 
              2935997
              
 
              MBAM Supported Computers compliance reporting incorrectly includes unsupported products
              
-
              [support.microsoft.com/kb/2935997/EN-US](https://support.microsoft.com/kb/2935997/EN-US)
              
+
              support.microsoft.com/kb/2935997/EN-US
              
 
 
 
              2612822
              
 
              Computer Record is Rejected in MBAM
              
-
              [support.microsoft.com/kb/2612822/EN-US](https://support.microsoft.com/kb/2612822/EN-US)
              
+
              support.microsoft.com/kb/2612822/EN-US
              
 
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [About MBAM 2.0](about-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md b/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md
index 2dd39e48fb..9fb4028a56 100644
--- a/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md
+++ b/mdop/mbam-v2/release-notes-for-mbam-20-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: Release Notes for MBAM 2.0 SP1
 description: Release Notes for MBAM 2.0 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: b39002ba-33c6-45ec-9d1b-464327b60f5c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -34,7 +37,7 @@ If you are using MBAM with Configuration Manager, and you want to upgrade to MBA
     **Note**  
     All existing BitLocker compliance data will be deleted when you delete the existing baseline in Configuration Manager. The data will be regenerated over time, but it is recommended that you save a copy of the data in case you need the compliance data for a particular computer before the compliance data has been regenerated.
 
-     
+     
 
     1.  To save historical BitLocker compliance data, open the **BitLocker Enterprise Compliance Details** Report.
 
@@ -144,96 +147,96 @@ This section contains hotfixes and KB articles for MBAM 2.0 SP1.
 
 
              2831166
              
 
              Installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.0 fails with "System Center CM Objects Already Installed"
              
-
              [support.microsoft.com/kb/2831166/EN-US](https://support.microsoft.com/kb/2831166/EN-US)
              
+
              support.microsoft.com/kb/2831166/EN-US
              
 
 
 
              2870849
              
 
              Users cannot retrieve BitLocker Recovery key using MBAM 2.0 Self Service Portal
              
-
              [support.microsoft.com/kb/2870849/EN-US](https://support.microsoft.com/kb/2870849/EN-US)
              
+
              support.microsoft.com/kb/2870849/EN-US
              
 
 
 
              2756402
              
 
              MBAM client would fail with Event ID 4 and error code 0x8004100E in the Event description
              
-
              [support.microsoft.com/kb/2756402/EN-US](https://support.microsoft.com/kb/2756402/EN-US)
              
+
              support.microsoft.com/kb/2756402/EN-US
              
 
 
 
              2620287
              
 
              Error Message “Server Error in ‘/Reports’ Application” When You Click Reports Tab in MBAM
              
-
              [support.microsoft.com/kb/2620287/EN-US](https://support.microsoft.com/kb/2620287/EN-US)
              
+
              support.microsoft.com/kb/2620287/EN-US
              
 
 
 
              2639518
              
 
              Error opening Enterprise or Computer Compliance Reports in MBAM
              
-
              [support.microsoft.com/kb/2639518/EN-US](https://support.microsoft.com/kb/2639518/EN-US)
              
+
              support.microsoft.com/kb/2639518/EN-US
              
 
 
 
              2620269
              
 
              MBAM Enterprise Reporting Not Getting Updated
              
-
              [support.microsoft.com/kb/2620269/EN-US](https://support.microsoft.com/kb/2620269/EN-US)
              
+
              support.microsoft.com/kb/2620269/EN-US
              
 
 
 
              2712461
              
 
              Installing MBAM on a Domain Controller is not supported
              
-
              [support.microsoft.com/kb/2712461/EN-US](https://support.microsoft.com/kb/2712461/EN-US)
              
+
              support.microsoft.com/kb/2712461/EN-US
              
 
 
 
              2876732
              
 
              You receive error code 0x80071a90 during Standalone or Configuration Manager Integration setup of MBAM 2.0
              
-
              [support.microsoft.com/kb/2876732/EN-US](https://support.microsoft.com/kb/2876732/EN-US)
              
+
              support.microsoft.com/kb/2876732/EN-US
              
 
 
 
              2754259
              
 
              MBAM and Secure Network Communication
              
-
              [support.microsoft.com/kb/2754259/EN-US](https://support.microsoft.com/kb/2754259/EN-US)
              
+
              support.microsoft.com/kb/2754259/EN-US
              
 
 
 
              2870842
              
 
              MBAM 2.0 Setup fails during Configuration Manager Integration Scenario with SQL Server 2008
              
-
              [support.microsoft.com/kb/2870842/EN-US](https://support.microsoft.com/kb/2870842/EN-US)
              
+
              support.microsoft.com/kb/2870842/EN-US
              
 
 
 
              2668533
              
 
              MBAM Setup fails if SQL SSRS is not configured properly
              
-
              [support.microsoft.com/kb/2668533/EN-US](https://support.microsoft.com/kb/2668533/EN-US)
              
+
              support.microsoft.com/kb/2668533/EN-US
              
 
 
 
              2870847
              
-
              MBAM 2.0 Setup fails with "Error retrieving Configuration Manager Server role settings for 'Reporting Services Point' role"
              
-
              [support.microsoft.com/kb/2870847/EN-US](https://support.microsoft.com/kb/2870847/EN-US)
              
+
              MBAM 2.0 Setup fails with "Error retrieving Configuration Manager Server role settings for 'Reporting Services Point' role"
              
+
              support.microsoft.com/kb/2870847/EN-US
              
 
 
 
              2870839
              
 
              MBAM 2.0 Enterprise Reports are not refreshed in MBAM 2.0 Standalone topology due to SQL job CreateCache failure
              
-
              [support.microsoft.com/kb/2870839/EN-US](https://support.microsoft.com/kb/2870839/EN-US)
              
+
              support.microsoft.com/kb/2870839/EN-US
              
 
 
 
              2620269
              
 
              MBAM Enterprise Reporting Not Getting Updated
              
-
              [support.microsoft.com/kb/2620269/EN-US](https://support.microsoft.com/kb/2620269/EN-US)
              
+
              support.microsoft.com/kb/2620269/EN-US
              
 
 
 
              2935997
              
 
              MBAM Supported Computers compliance reporting incorrectly includes unsupported products
              
-
              [support.microsoft.com/kb/2935997/EN-US](https://support.microsoft.com/kb/2935997/EN-US)
              
+
              support.microsoft.com/kb/2935997/EN-US
              
 
 
 
              2612822
              
 
              Computer Record is Rejected in MBAM
              
-
              [support.microsoft.com/kb/2612822/EN-US](https://support.microsoft.com/kb/2612822/EN-US)
              
+
              support.microsoft.com/kb/2612822/EN-US
              
 
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [About MBAM 2.0 SP1](about-mbam-20-sp1.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md b/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md
index 129cb910ad..0a0a6f60c0 100644
--- a/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/security-and-privacy-for-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Security and Privacy for MBAM 2.0
 description: Security and Privacy for MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 1b2859f8-2381-4ad7-8744-2caed88570ad
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md b/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md
index 3a808cbed7..7ea7004d1c 100644
--- a/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md
+++ b/mdop/mbam-v2/troubleshooting-mbam-20-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting MBAM 2.0
 description: Troubleshooting MBAM 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 43933ec7-b5b8-49c5-813f-4c06aa7314ed
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md b/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md
index c4acba5af7..4e367f90d7 100644
--- a/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md
+++ b/mdop/mbam-v2/understanding-mbam-reports-in-configuration-manager.md
@@ -1,12 +1,15 @@
 ---
 title: Understanding MBAM Reports in Configuration Manager
 description: Understanding MBAM Reports in Configuration Manager
-author: jamiejdt
+author: dansimp
 ms.assetid: b2582190-c9de-4e64-bd5a-f31ac1916f53
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -142,7 +145,7 @@ This report shows information about the overall BitLocker compliance across your
 
 
 
- 
+ 
 
 **BitLocker Enterprise Compliance Details Report - Compliance States**
 
@@ -173,7 +176,7 @@ This report shows information about the overall BitLocker compliance across your
 
 
 
- 
+ 
 
 ### BitLocker Enterprise Compliance Summary Report
 
@@ -240,7 +243,7 @@ Use this report type to show information about the overall BitLocker compliance
 
 
 
- 
+ 
 
 **BitLocker Enterprise Compliance Summary Report - Computer Details**
 
@@ -287,7 +290,7 @@ Use this report type to show information about the overall BitLocker compliance
 
 
 
- 
+ 
 
 ### BitLocker Computer Compliance Report
 
@@ -296,7 +299,7 @@ Use this report type to collect information that is specific to a computer. The
 **Note**  
 Removable Data Volume encryption status is not shown in the report.
 
- 
+ 
 
 **BitLocker Computer Compliance Report – Computer Details Fields**
 
@@ -387,7 +390,7 @@ Removable Data Volume encryption status is not shown in the report.
 
 
 
- 
+ 
 
 **BitLocker Computer Compliance Report – Computer Volume Fields**
 
@@ -430,16 +433,16 @@ Removable Data Volume encryption status is not shown in the report.
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [Using MBAM with Configuration Manager](using-mbam-with-configuration-manager.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md b/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md
index 7dffbbbb92..4e1f2addc4 100644
--- a/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md
+++ b/mdop/mbam-v2/understanding-mbam-reports-mbam-2.md
@@ -1,12 +1,15 @@
 ---
 title: Understanding MBAM Reports
 description: Understanding MBAM Reports
-author: jamiejdt
+author: dansimp
 ms.assetid: 8778f333-760e-4f26-acb4-4e73b6fbb536
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ If you chose the Stand-alone topology when you installed Microsoft BitLocker Adm
 **Note**  
 If you chose the Configuration Manager topology when you installed Microsoft BitLocker Administration and Monitoring (MBAM), reports are generated from Configuration Manager rather than from MBAM. For more information about reports that are run from Configuration Manager, see [Understanding MBAM Reports in Configuration Manager](understanding-mbam-reports-in-configuration-manager.md).
 
- 
+ 
 
 ## Understanding Reports
 
@@ -67,7 +70,7 @@ Use this report type to collect information on overall BitLocker compliance in y
 
 
 
- 
+ 
 
 **Enterprise Compliance Report Compliance States**
 
@@ -102,7 +105,7 @@ Use this report type to collect information on overall BitLocker compliance in y
 
 
 
- 
+ 
 
 ### Computer Compliance Report
 
@@ -113,7 +116,7 @@ This report can be viewed by clicking the computer name in the Enterprise Compli
 **Note**  
 Removable Data Volume encryption status will not be shown in the report.
 
- 
+ 
 
 **Computer Compliance Report Fields**
 
@@ -188,7 +191,7 @@ Removable Data Volume encryption status will not be shown in the report.
 
 
 
- 
+ 
 
 **Computer Compliance Report Drive Fields**
 
@@ -239,7 +242,7 @@ Removable Data Volume encryption status will not be shown in the report.
 
 
 
- 
+ 
 
 ### Recovery Audit Report
 
@@ -301,21 +304,21 @@ Use this report type to audit users who have requested access to recovery keys.
 
 
 
- 
+ 
 
 **Note**  
 Report results can be saved to a file by clicking the **Export** button on the reports menu bar. For more information about how to run MBAM reports, see [How to Generate MBAM Reports](how-to-generate-mbam-reports-mbam-2.md).
 
- 
+ 
 
 ## Related topics
 
 
 [Monitoring and Reporting BitLocker Compliance with MBAM 2.0](monitoring-and-reporting-bitlocker-compliance-with-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md b/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md
index 71aedb9209..ab076703c4 100644
--- a/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md
+++ b/mdop/mbam-v2/upgrading-from-previous-versions-of-mbam.md
@@ -1,12 +1,15 @@
 ---
 title: Upgrading from Previous Versions of MBAM
 description: Upgrading from Previous Versions of MBAM
-author: jamiejdt
+author: dansimp
 ms.assetid: 73b425cf-9cd9-4ebc-a35e-1b3bf18596ce
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -80,7 +83,7 @@ Use the following instructions to upgrade from a previous version of MBAM when y
     **Note**  
     The certificate must be created before this step to enable you to select it on this page.
 
-     
+     
 
 8.  On the **Configure the location of the Compliance Status database** page, specify the SQL Server instance name and the name of the database that stores the compliance and audit data. You must also specify where the database files and log information will be located.
 
@@ -99,7 +102,7 @@ Use the following instructions to upgrade from a previous version of MBAM when y
     **Note**  
     The port number that you specify must be an unused port number on the Administration and Monitoring Server unless you specify a unique host header name.
 
-     
+     
 
 15. On the **Configure the Administration and Monitoring Server** page, specify the desired virtual directory for the Help Desk website.
 
@@ -127,9 +130,9 @@ To validate the Client upgrade, do the following:
 
 [Deploying MBAM 2.0](deploying-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/using-mbam-with-configuration-manager.md b/mdop/mbam-v2/using-mbam-with-configuration-manager.md
index 80e6d97c23..10be5afa15 100644
--- a/mdop/mbam-v2/using-mbam-with-configuration-manager.md
+++ b/mdop/mbam-v2/using-mbam-with-configuration-manager.md
@@ -1,12 +1,15 @@
 ---
 title: Using MBAM with Configuration Manager
 description: Using MBAM with Configuration Manager
-author: jamiejdt
+author: dansimp
 ms.assetid: 03868717-4aa7-4897-8166-9a3df5e9519e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ This integration moves the Microsoft BitLocker Administration and Monitoring com
 **Important**  
 Windows To Go is not supported when you install the integrated topology of MBAM with Configuration Manager 2007.
 
- 
+ 
 
 ## Getting Started – Using MBAM with Configuration Manager
 
@@ -56,9 +59,9 @@ This section describes the MBAM reports that you can run from Configuration Mana
 
 [Operations for MBAM 2.0](operations-for-mbam-20-mbam-2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v2/using-your-pin-or-password.md b/mdop/mbam-v2/using-your-pin-or-password.md
index 200bfc060d..b2e8471007 100644
--- a/mdop/mbam-v2/using-your-pin-or-password.md
+++ b/mdop/mbam-v2/using-your-pin-or-password.md
@@ -1,12 +1,15 @@
 ---
 title: Using Your PIN or Password
 description: Using Your PIN or Password
-author: jamiejdt
+author: dansimp
 ms.assetid: 7fe2aef4-d3e0-49c8-877d-7fee13dc5b7b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -26,7 +29,7 @@ The password is used to unlock drives on your computer that do not contain the o
 **Note**  
 Your Help Desk may set drives to unlock automatically. This eliminates the need to provide a PIN or password to view the information on the drives.
 
- 
+ 
 
 ## Unlocking Your Computer if You Forget Your PIN or Password
 
@@ -68,9 +71,9 @@ Before you can change the password on a BitLocker protected drive, you must unlo
 
     -   To change your password, select **Manage Your Password**. Enter your new password into both fields and select **Reset Password**.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/TOC.md b/mdop/mbam-v25/TOC.md
index 22008a42bb..8a6984ffb5 100644
--- a/mdop/mbam-v25/TOC.md
+++ b/mdop/mbam-v25/TOC.md
@@ -83,6 +83,10 @@
 #### [Monitoring Web Service Request Performance Counters](monitoring-web-service-request-performance-counters.md)
 ### [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md)
 ## [Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md)
+### [Upgrade from MBAM 2.5 to MBAM 2.5 SP1](upgrade-mbam2.5-sp1.md)
+### [Troubleshooting MBAM 2.5 installation problems](troubleshooting-mbam-installation.md)
+### [Deploying MBAM 2.5 in a stand-alone configuration](deploy-mbam.md)
+## [Applying hotfixes on MBAM 2.5 SP1](apply-hotfix-for-mbam-25-sp1.md)
 ## [Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md)
 ### [Client Event Logs](client-event-logs.md)
 ### [Server Event Logs](server-event-logs.md)
diff --git a/mdop/mbam-v25/about-mbam-25-sp1.md b/mdop/mbam-v25/about-mbam-25-sp1.md
index dacedac502..e9fefc297b 100644
--- a/mdop/mbam-v25/about-mbam-25-sp1.md
+++ b/mdop/mbam-v25/about-mbam-25-sp1.md
@@ -1,8 +1,11 @@
 ---
 title: About MBAM 2.5 SP1
 description: About MBAM 2.5 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 6f12e605-44e6-4646-9c20-aee89c8ff0b7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -48,7 +51,7 @@ The following groups might be interested in using MBAM to manage BitLocker:
 **Note**  
 BitLocker is not explained in detail in this MBAM documentation. For more information, see [BitLocker Drive Encryption Overview](https://go.microsoft.com/fwlink/p/?LinkId=225013).
 
- 
+ 
 
 ## What’s new in MBAM 2.5 SP1
 
@@ -126,7 +129,7 @@ The Windows team has backported FIPS-compliant recovery keys with a hotfix, and
 **Note**  
 Client computers that are running the Windows 8 operating system still require a DRA protector since the hotfix was not backported to that OS. See [Hotfix Package 2 for BitLocker Administration and Monitoring 2.5](https://support.microsoft.com/kb/3015477) to download and install the BitLocker hotfix for Windows 7 and Windows 8 computers. For information about DRA, see [Using Data Recovery Agents with BitLocker](https://go.microsoft.com/fwlink/?LinkId=393557).
 
- 
+ 
 
 To enable FIPS compliance in your organization, you must configure the Federal Information Processing Standard (FIPS) Group Policy settings. For configuration instructions, see [BitLocker Group Policy Settings](https://go.microsoft.com/fwlink/?LinkId=393560).
 
@@ -240,9 +243,9 @@ For more information and late-breaking news that is not included in this documen
 
 [Getting Started with MBAM 2.5](getting-started-with-mbam-25.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/about-mbam-25.md b/mdop/mbam-v25/about-mbam-25.md
index cbde231c72..7afb0c3d9f 100644
--- a/mdop/mbam-v25/about-mbam-25.md
+++ b/mdop/mbam-v25/about-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: About MBAM 2.5
 description: About MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 1ce218ec-4d2e-4a75-8d1a-68d737a8f3c9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -48,7 +51,7 @@ The following groups might be interested in using MBAM to manage BitLocker:
 **Note**  
 BitLocker is not explained in detail in this MBAM documentation. For more information, see [BitLocker Drive Encryption Overview](https://go.microsoft.com/fwlink/p/?LinkId=225013).
 
- 
+ 
 
 ## What’s new in MBAM 2.5
 
@@ -66,7 +69,7 @@ The MBAM Group Policy Templates must be downloaded separately from the MBAM inst
 **Important**  
 Do not change the Group Policy settings in the **BitLocker Drive Encryption** node, or MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the BitLocker Drive Encryption settings for you.
 
- 
+ 
 
 The template files that you need to copy to a server or workstation are:
 
@@ -80,59 +83,59 @@ The template files that you need to copy to a server or workstation are:
 
 Copy the template files to the location that best meets your needs. For the language-specific files, which must be copied to a language-specific folder, the Group Policy Management Console is required to view the files.
 
--   To install the template files locally on a server or workstation, copy the files to one of the following locations.
+- To install the template files locally on a server or workstation, copy the files to one of the following locations.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
              



              File typeFile location
              language neutral (.admx)
              %systemroot%\policyDefinitions
              language specific (.adml)
              %systemroot%\policyDefinitions\[MUIculture] (for example, the U.S. English language specific file will be stored in %systemroot%\policyDefinitions\en-us)
              
+  
+  +  +  +  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
              



              File typeFile location
              language neutral (.admx)
              %systemroot%\policyDefinitions
              language specific (.adml)
              %systemroot%\policyDefinitions[MUIculture] (for example, the U.S. English language specific file will be stored in %systemroot%</em>policyDefinitions\en-us)
              
 
-     
+     
 
--   To make the templates available to all Group Policy administrators in a domain, copy the files to one of the following locations on a domain controller.
+- To make the templates available to all Group Policy administrators in a domain, copy the files to one of the following locations on a domain controller.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
              



              File typeDomain controller file location
              Language neutral (.admx)
              %systemroot%sysvol\domain\policies\PolicyDefinitions
              Language specific (.adml)
              %systemroot%\sysvol\domain\policies\PolicyDefinitions\[MUIculture] (for example, the U.S. English language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us)
              
+  
+  +  +  +  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
+  
              



              File typeDomain controller file location
              Language neutral (.admx)
              %systemroot%sysvol\domain\policies\PolicyDefinitions
              Language specific (.adml)
              %systemroot%\sysvol\domain\policies\PolicyDefinitions[MUIculture] (for example, the U.S. English language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us)
              
 
-     
+     
 
 For more information about template files, see [Managing Group Policy ADMX Files Step-by-Step Guide](https://go.microsoft.com/fwlink/?LinkId=392818).
 
@@ -176,7 +179,7 @@ To enable you to configure encryption policy enforcement, a new Group Policy set
 
 
 
- 
+ 
 
 ### Ability to provide a URL in the BitLocker Drive Encryption wizard to point to your security policy
 
@@ -247,7 +250,7 @@ The following table lists the security groups that you must create in AD DS. You
 
 
 
- 
+ 
 
 After you create the security groups in AD DS, assign users and/or groups to the appropriate security group to enable the corresponding level of access to the Administration and Monitoring Website. To enable individuals with each role to access the Administration and Monitoring Website, you must also specify each security group when you are configuring the Administration and Monitoring Website.
 
@@ -283,20 +286,20 @@ Windows PowerShell Help for MBAM is available in the following formats:
 
 
 
              On TechNet as webpages
              
-
              https://go.microsoft.com/fwlink/?LinkId=393498
              
+
              https://go.microsoft.com/fwlink/?LinkId=393498
              
 
 
 
              On the Download Center as a Word .docx file
              
-
              https://go.microsoft.com/fwlink/?LinkId=393497
              
+
              https://go.microsoft.com/fwlink/?LinkId=393497
              
 
 
 
              On the Download Center as a .pdf file
              
-
              https://go.microsoft.com/fwlink/?LinkId=393499
              
+
              https://go.microsoft.com/fwlink/?LinkId=393499
              
 
 
 
 
- 
+ 
 
 ### Support for ASCII-only and enhanced PINs and ability to prevent sequential and repeating characters
 
@@ -355,7 +358,7 @@ MBAM is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is part o
 For more information and late-breaking news that is not included in this documentation, see [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md).
 
 ## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
+- Send your feedback [here](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
 
 ## Related topics
@@ -365,9 +368,9 @@ For more information and late-breaking news that is not included in this documen
 
 [Getting Started with MBAM 2.5](getting-started-with-mbam-25.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/accessibility-for-mbam-25.md b/mdop/mbam-v25/accessibility-for-mbam-25.md
index 006f3acba5..5618291576 100644
--- a/mdop/mbam-v25/accessibility-for-mbam-25.md
+++ b/mdop/mbam-v25/accessibility-for-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Accessibility for MBAM 2.5
 description: Accessibility for MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 03b343a6-9e8e-4868-a52b-cedf0b696d56
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -30,7 +33,7 @@ Access keys let you quickly use a command by pressing a few keys. You can get to
 **Note**  
 To cancel the action that you are taking and hide the keyboard shortcuts, press ALT.
 
- 
+ 
 
 ## Documentation in alternative formats
 
@@ -64,13 +67,13 @@ For information about the availability of Microsoft product documentation and bo
 
              (609) 987-8116
              
 
 
-
              [http://www.learningally.org/](https://go.microsoft.com/fwlink/?linkid=239)
              
+
              http://www.learningally.org/
              
 
              Web addresses can change, so you might be unable to connect to the website or sites mentioned here.
              
 
 
 
 
- 
+ 
 
 ## Customer service for people with hearing impairments
 
@@ -97,9 +100,9 @@ For more information about how accessible technology for computers helps to impr
 
 [Getting Started with MBAM 2.5](getting-started-with-mbam-25.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/administering-mbam-25-features.md b/mdop/mbam-v25/administering-mbam-25-features.md
index 4b0fad8bfc..ba93616f8c 100644
--- a/mdop/mbam-v25/administering-mbam-25-features.md
+++ b/mdop/mbam-v25/administering-mbam-25-features.md
@@ -1,8 +1,11 @@
 ---
 title: Administering MBAM 2.5 Features
 description: Administering MBAM 2.5 Features
-author: jamiejdt
+author: dansimp
 ms.assetid: ca15f818-cf07-4437-8ffa-425af603a3c8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -31,7 +34,7 @@ MBAM provides a custom control panel, called BitLocker Encryption Options, that
 **Note**  
 This customized control panel does not replace the default Windows BitLocker control panel.
 
- 
+ 
 
 [Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel](understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md)
 
@@ -44,9 +47,9 @@ This customized control panel does not replace the default Windows BitLocker con
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md b/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md
index 7ca9dcb801..3ed2c2c111 100644
--- a/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md
+++ b/mdop/mbam-v25/apply-hotfix-for-mbam-25-sp1.md
@@ -2,8 +2,10 @@
 title: Applying hotfixes on MBAM 2.5 SP1
 description: Applying hotfixes on MBAM 2.5 SP1
 ms.author: ppriya-msft
-author: intothedarkness 
+author: dansimp
 ms.assetid: 
+ms.reviewer: 
+manager: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -17,7 +19,7 @@ author: shortpatti
 This topic describes the process for applying the hotfixes for Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 SP1
 
 ### Before you begin, download the latest hotfix of Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 SP1
-[Desktop Optimization Pack](https://www.microsoft.com/en-us/download/details.aspx?id=57157)
+[Desktop Optimization Pack](https://www.microsoft.com/download/details.aspx?id=58345)
 
 #### Steps to update the MBAM Server for existing MBAM environment 
 1. Remove MBAM server feature (do this by opening the MBAM Server Configuration Tool, then selecting Remove Features).
diff --git a/mdop/mbam-v25/client-event-logs.md b/mdop/mbam-v25/client-event-logs.md
index f8d2dc07c4..747ad55211 100644
--- a/mdop/mbam-v25/client-event-logs.md
+++ b/mdop/mbam-v25/client-event-logs.md
@@ -1,8 +1,11 @@
 ---
 title: Client Event Logs
 description: Client Event Logs
-author: jamiejdt
+author: dansimp
 ms.assetid: d5c2f270-db6a-45f1-8557-8c6fb28fd568
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -13,7 +16,7 @@ ms.date: 06/16/2016
 
 # Client Event Logs
 
-
+MBAM Client event logs are located in Event Viewer – Applications and Services Logs – Microsoft – Windows – MBAM - Operational path.
 The following table contains event IDs that can occur on the MBAM Client.
 
 
diff --git a/mdop/mbam-v25/configuring-mbam-25-server-features-by-using-windows-powershell.md b/mdop/mbam-v25/configuring-mbam-25-server-features-by-using-windows-powershell.md
index 330377d65b..3e68d38e01 100644
--- a/mdop/mbam-v25/configuring-mbam-25-server-features-by-using-windows-powershell.md
+++ b/mdop/mbam-v25/configuring-mbam-25-server-features-by-using-windows-powershell.md
@@ -1,8 +1,11 @@
 ---
 title: Configuring MBAM 2.5 Server Features by Using Windows PowerShell
 description: Configuring MBAM 2.5 Server Features by Using Windows PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 826429fd-29bb-44be-b47e-5f5c7d20dd1d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -69,20 +72,20 @@ Windows PowerShell Help for MBAM is available in the following formats:
 
-
+
-
+
-
+
              
 
              
 
              On TechNet as webpages
              https://go.microsoft.com/fwlink/?LinkId=393498
              https://go.microsoft.com/fwlink/?LinkId=393498
              		
 
              
 
              
 
              On the Download Center as a Word .docx file
              https://go.microsoft.com/fwlink/?LinkId=393497
              https://go.microsoft.com/fwlink/?LinkId=393497
              		
 
              
 
              
 
              On the Download Center as a .pdf file
              https://go.microsoft.com/fwlink/?LinkId=393499
              https://go.microsoft.com/fwlink/?LinkId=393499
              		
 
              
               
 
              
 
- 
+ 
 
 ## Configurations that you can do only with Windows PowerShell but not with the MBAM Server Configuration wizard
 
@@ -122,12 +125,12 @@ Windows PowerShell Help for MBAM is available in the following formats:
 
 
 
- 
+ 
 
 **Note**  
 You cannot disable the MBAM databases with a Windows PowerShell cmdlet or the MBAM Server Configuration wizard. To prevent the accidental removal of your compliance and audit data, database administrators must remove databases manually.
 
- 
+ 
 
 ## Prerequisites and requirements for using Windows PowerShell to configure MBAM Server features
 
@@ -164,7 +167,7 @@ Before starting the configuration, complete the following prerequisites.
 
 
 
- 
+ 
 
 **Permission-related prerequisites**
 
@@ -194,7 +197,7 @@ Before starting the configuration, complete the following prerequisites.
 
              This user account must be a part of the local administrators group or the Backup Operators group to register the MBAM Volume Shadow Copy Service (VSS) Writer.
              
 
              By default, the database administrator or system administrator has the required "create any database" permissions.
              
 
              
-
              For more information about VSS Writer, see [Volume Shadow Copy Service](https://go.microsoft.com/fwlink/?LinkId=392814).
              
+
              For more information about VSS Writer, see Volume Shadow Copy Service.
              
 
 
 
              For the System Center Configuration Manager Integration feature only:
              
@@ -231,7 +234,7 @@ Before starting the configuration, complete the following prerequisites.
 
 
 
- 
+ 
 
 ## Using Windows PowerShell to configure MBAM on a remote computer
 
@@ -252,7 +255,7 @@ Before starting the configuration, complete the following prerequisites.
 
                
 
              • Ensure that the MBAM 2.5 Server software has been installed on the remote computer.
                • 
 
              • Use the Credential Security Support Provider (CredSSP) Protocol to open the Windows PowerShell session.
                • 
-
              • Enable Windows Remote Management (WinRM). If you fail to enable WinRM and to configure it correctly, the New-PSSession cmdlet that is described in this table displays an error and describes how to fix the issue. For more information about WinRM, see [Using Windows Remote Management](https://go.microsoft.com/fwlink/?LinkId=393064).
                • 
+
              • Enable Windows Remote Management (WinRM). If you fail to enable WinRM and to configure it correctly, the New-PSSession cmdlet that is described in this table displays an error and describes how to fix the issue. For more information about WinRM, see Using Windows Remote Management.
                • 
 
              
 
 
@@ -270,7 +273,7 @@ Before starting the configuration, complete the following prerequisites.
 
 
 
- 
+ 
 
 ## Required accounts and corresponding Windows PowerShell cmdlet parameters
 
@@ -306,7 +309,7 @@ Specifies the administrative credential that the local SSRS instance uses to con
 **Important**  
 The account specified in the administrative credentials should have limited user rights for improved security. Also, the password of the account should be set to not expire.
 
- 
+ 
 
 ReportsReadOnlyAccessGroup
 
@@ -345,9 +348,9 @@ For improved security, set the account that is specified in the administrative c
 
 To view the local security setting, open the **Local Security Policy editor**, expand the **Local Policies** node, select the **User Rights Assignment** node, and then double-click the **Impersonate a client after authentication** and **Log on as a batch job** Group Policy settings in the details pane.
 
- 
+ 
 
- 
+ 
 
 
 
@@ -361,11 +364,11 @@ To view the local security setting, open the **Local Security Policy editor**, e
 
 [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md)
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/configuring-the-mbam-25-server-features.md b/mdop/mbam-v25/configuring-the-mbam-25-server-features.md
index 49b94f770e..d5431e95f6 100644
--- a/mdop/mbam-v25/configuring-the-mbam-25-server-features.md
+++ b/mdop/mbam-v25/configuring-the-mbam-25-server-features.md
@@ -1,8 +1,11 @@
 ---
 title: Configuring the MBAM 2.5 Server Features
 description: Configuring the MBAM 2.5 Server Features
-author: jamiejdt
+author: dansimp
 ms.assetid: 894d1080-5f13-48f7-8fde-82f8d440a4ed
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -39,31 +42,31 @@ Review and complete the following steps before you start configuring the MBAM Se
 
 
 
              Review the recommended architecture for MBAM.
              
-
              [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md)
              
+
              High-Level Architecture for MBAM 2.5
              
 
 
 
              Review the supported configurations for MBAM.
              
-
              [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)
              
+
              MBAM 2.5 Supported Configurations
              
 
 
 
              Complete the required prerequisites on each server.
              
 
 
 
 
              Install the MBAM Server software on each server where you will configure an MBAM Server feature.
              
-
              [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md)
              
+
              Installing the MBAM 2.5 Server Software
              
 
 
 
              Review the prerequisites for using Windows PowerShell to configure MBAM Server features (if you are using this method to configure MBAM Server features).
              
-
              [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md)
              
+
              Configuring MBAM 2.5 Server Features by Using Windows PowerShell
              
 
 
 
 
- 
+ 
 
 ## Steps for configuring MBAM Server features
 
@@ -84,24 +87,24 @@ Each row in the following table describes the features that you will configure o
 
 
 
              Configure the databases.
              
-
              [How to Configure the MBAM 2.5 Databases](how-to-configure-the-mbam-25-databases.md)
              
+
              How to Configure the MBAM 2.5 Databases
              
 
 
 
              Configure the reports.
              
-
              [How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md)
              
+
              How to Configure the MBAM 2.5 Reports
              
 
 
 
              Configure the web applications.
              
-
              [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md)
              
+
              How to Configure the MBAM 2.5 Web Applications
              
 
 
 
              Configure the System Center Configuration Manager Integration (if applicable).
              
-
              [How to Configure the MBAM 2.5 System Center Configuration Manager Integration](how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md)
              
+
              How to Configure the MBAM 2.5 System Center Configuration Manager Integration
              
 
 
 
 
- 
+ 
 
 For a list of events about MBAM Server feature configuration, see [Server Event Logs](server-event-logs.md).
 
@@ -111,9 +114,9 @@ For a list of events about MBAM Server feature configuration, see [Server Event
 
 
 Configuring the MBAM 2.5 Server Features
- 
+ 
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md b/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md
index 79e1582f84..166bfb30c5 100644
--- a/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md
+++ b/mdop/mbam-v25/copying-the-mbam-25-group-policy-templates.md
@@ -1,8 +1,11 @@
 ---
 title: Copying the MBAM 2.5 Group Policy Templates
 description: Copying the MBAM 2.5 Group Policy Templates
-author: jamiejdt
+author: dansimp
 ms.assetid: e526ecec-07ff-435e-bc90-3084b617b84b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -23,80 +26,81 @@ MDOP Group Policy templates are available for download in a self-extracting, com
 
 **How to download and deploy the MDOP Group Policy templates**
 
-1.  Download the MDOP Group Policy templates from [Microsoft Desktop Optimization Pack Group Policy Administrative Templates
-](https://www.microsoft.com/en-us/download/details.aspx?id=55531).
+1. Download the MDOP Group Policy templates from [Microsoft Desktop Optimization Pack Group Policy Administrative Templates](https://www.microsoft.com/download/details.aspx?id=55531).
 
-2.  Run the downloaded file to extract the template folders.
+2. Run the downloaded file to extract the template folders.
 
-    **Warning**  
-    Do not extract the templates directly to the Group Policy deployment directory. Multiple technologies and versions are bundled in this file.
+   **Warning**  
+   Do not extract the templates directly to the Group Policy deployment directory. Multiple technologies and versions are bundled in this file.
 
-     
 
-3.  In the extracted folder, locate the technology-version .admx file. Certain MDOP technologies have multiple sets of Group Policy Objects (GPOs). For example, MBAM includes MBAM Management settings and MBAM User settings.
 
-4.  Locate the appropriate .adml file by language-culture (that is, *en* for English-United States).
+3. In the extracted folder, locate the technology-version .admx file. Certain MDOP technologies have multiple sets of Group Policy Objects (GPOs). For example, MBAM includes MBAM Management settings and MBAM User settings.
 
-5.  Copy the .admx and .adml files to a policy definition folder. Depending on where you store the templates, you can configure Group Policy settings from the local device or from any computer on the domain.
+4. Locate the appropriate .adml file by language-culture (that is, *en* for English-United States).
 
-    **Local files.** To configure Group Policy settings from the local device, copy template files to the following locations:
+5. Copy the .admx and .adml files to a policy definition folder. Depending on where you store the templates, you can configure Group Policy settings from the local device or from any computer on the domain.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
              



              File typeFile location
              Group Policy template (.admx)
              %systemroot%\policyDefinitions
              Group Policy language file (.adml)
              %systemroot%\policyDefinitions\[MUIculture]
              
+   **Local files.** To configure Group Policy settings from the local device, copy template files to the following locations:
 
-     
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
              



              File typeFile location
              Group Policy template (.admx)
              %systemroot%<strong>policyDefinitions
              Group Policy language file (.adml)
              %systemroot%<strong>policyDefinitions[MUIculture]
              
 
-    **Domain central store.** To enable Group Policy settings configuration by a Group Policy administrator from any computer on the domain, copy files to the following locations on the domain controller:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
              



              File typeFile location
              Group Policy template (.admx)
              %systemroot%\sysvol\domain\policies\PolicyDefinitions
              Group Policy language file (.adml)
              %systemroot%\sysvol\domain\policies\PolicyDefinitions\[MUIculture]\[MUIculture]
              
-    
              For example, the U.S. English ADML language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us.
              
 
-     
+~~~
+**Domain central store.** To enable Group Policy settings configuration by a Group Policy administrator from any computer on the domain, copy files to the following locations on the domain controller:
 
-6.  Edit the Group Policy settings using Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM) to configure Group Policy settings for the MDOP technology. See [Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md) for more information.
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
              



              File typeFile location
              Group Policy template (.admx)
              %systemroot%\sysvol\domain\policies\PolicyDefinitions
              Group Policy language file (.adml)
              %systemroot%\sysvol\domain\policies\PolicyDefinitions\[MUIculture]\[MUIculture]
              
+
              For example, the U.S. English ADML language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us.
              
+~~~
 
-    For descriptions of the Group Policy settings, see [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md).
+
+
+6. Edit the Group Policy settings using Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM) to configure Group Policy settings for the MDOP technology. See [Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md) for more information.
+
+   For descriptions of the Group Policy settings, see [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md).
 
 
 ## Related topics
@@ -104,11 +108,11 @@ MDOP Group Policy templates are available for download in a self-extracting, com
 
 [Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md)
 
- 
+
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+
 
 
 
diff --git a/mdop/mbam-v25/create-or-edit-the-sms-defmof-file-mbam-25.md b/mdop/mbam-v25/create-or-edit-the-sms-defmof-file-mbam-25.md
index 75f0c5dd3c..efae4b682d 100644
--- a/mdop/mbam-v25/create-or-edit-the-sms-defmof-file-mbam-25.md
+++ b/mdop/mbam-v25/create-or-edit-the-sms-defmof-file-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Create or Edit the Sms\_def.mof File
 description: Create or Edit the Sms\_def.mof File
-author: jamiejdt
+author: dansimp
 ms.assetid: 0bc5e7d8-9747-4da6-a1b3-38d8f27ba121
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/customizing-the-self-service-portal-for-your-organization.md b/mdop/mbam-v25/customizing-the-self-service-portal-for-your-organization.md
index 87f74c21ad..b5343853e6 100644
--- a/mdop/mbam-v25/customizing-the-self-service-portal-for-your-organization.md
+++ b/mdop/mbam-v25/customizing-the-self-service-portal-for-your-organization.md
@@ -1,8 +1,11 @@
 ---
 title: Customizing the Self-Service Portal for Your Organization
 description: Customizing the Self-Service Portal for Your Organization
-author: jamiejdt
+author: dansimp
 ms.assetid: f007e02b-e2df-47a9-9762-5909e230aa3f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -35,28 +38,28 @@ You can customize the Self-Service Portal in the following ways:
 
 
 
              You can brand the Self-Service Portal with your company name, Help Desk URL, and can change the Session Time-out setting to make the end user’s session expire after a specified period of inactivity.
              
-
              [How to Set the Self-Service Portal Branding and Session Time-out](how-to-set-the-self-service-portal-branding-and-session-time-out.md)
              
+
              How to Set the Self-Service Portal Branding and Session Time-out
              
 
 
 
              You can turn the Self-Service Portal notice text on or off.
              
-
              [How to Turn the Self-Service Portal Notice Text On or Off](how-to-turn-the-self-service-portal-notice-text-on-or-off.md)
              
+
              How to Turn the Self-Service Portal Notice Text On or Off
              
 
 
 
              You can configure a localized version of the Self-Service Portal "HelpdeskText" statement, which tells end users how to get additional help when they are using the Self-Service Portal.
              
-
              [How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information](how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md)
              
+
              How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information
              
 
 
 
              You can configure a localized version of the Self-Service Portal "HelpdeskURL" to display to end users by default.
              
-
              [How to Localize the Self-Service Portal “HelpdeskURL”](how-to-localize-the-self-service-portal-helpdeskurl.md)
              
+
              How to Localize the Self-Service Portal “HelpdeskURL”
              
 
 
 
              You can configure localized notice text to display to end users by default in the Self-Service Portal.
              
-
              [How to Localize the Self-Service Portal Notice Text](how-to-localize-the-self-service-portal-notice-text.md)
              
+
              How to Localize the Self-Service Portal Notice Text
              
 
 
 
 
- 
+ 
 
 
 
@@ -65,7 +68,7 @@ You can customize the Self-Service Portal in the following ways:
 
 [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/deploy-mbam.md b/mdop/mbam-v25/deploy-mbam.md
new file mode 100644
index 0000000000..a921105176
--- /dev/null
+++ b/mdop/mbam-v25/deploy-mbam.md
@@ -0,0 +1,595 @@
+---
+title: Deploying MBAM 2.5 in a stand-alone configuration
+description: Introducing how to deploy MBAM 2.5 in a stand-alone configuration.
+author: Deland-Han
+ms.reviewer: dcscontentpm
+manager: dansimp
+ms.author: delhan
+ms.sitesec: library
+ms.prod: w10
+ms.date: 09/16/2019
+manager: dcscontentpm
+--- 
+
+# Deploying MBAM 2.5 in a standalone configuration
+
+This article provides step-by-step instructions for installing Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 in a standalone configuration. In this guide we will use a two-server configuration. One of the two servers will be a database server running Microsoft SQL Server 2012. This server will host the MBAM databases and reports. The additional server will be a Windows Server 2012 web server hosting "Administration and Monitoring Server" and "Self-Service Portal."
+
+## Preparation steps before installing MBAM 2.5 server software
+
+### Step 1: Installation and configuration of servers
+
+Before we start configuring MBAM 2.5, we have to make sure that both servers are configured as per MBAM system requirements. See the [MBAM minimum system requirements](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/mbam-25-supported-configurations#-mbam-server-system-requirements), and select a configuration that meets these requirements. 
+
+#### Step 1.1: Deploying prerequisites for database and reporting server
+
+1. Install and configure a server running Windows Server 2008 R2 (or later) operating system.
+
+2. Install Windows PowerShell 3.0.
+
+3. Install Microsoft SQL Server 2008 R2 or a later version that includes the latest service pack. If you are installing a new instance of SQL Server for MBAM, make sure the SQL Server you install includes the SQL_Latin1_General_CP1_CI_AS collation. You’ll have to install the following SQL Server features:
+
+    * Database Engine
+    * Reporting Services
+    * Client Tools Connectivity
+    * Management Tools – Complete
+
+    > [!Note]
+    > Optionally, you can also install the [Transparent Data Encryption (TDE) feature in SQL Server](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/mbam-25-security-considerations).
+
+    SQL Server Reporting Services must be installed and configured in "native" mode and not in unconfigured or "SharePoint" mode.
+
+    ![The required SQL Server features](images/deploying-MBAM-1.png)
+
+4. If you plan to use SSL for the Administration and Monitoring website, make sure that you configure SQL Server Reporting Services (SSRS) to use the Secure Sockets Layer (SSL) protocol before you configure the Administration and Monitoring website. Otherwise, the Reports feature will use unencrypted (HTTP) data transport instead of encrypted (HTTPS).
+
+    You can follow [Configure SSL Connections](https://docs.microsoft.com/sql/reporting-services/security/configure-ssl-connections-on-a-native-mode-report-server?view=sql-server-2017) on a Native Mode Report Server to configure SSL on Report Server.
+    
+    > [!Note]
+    > You can follow the SQL Server Installation Guide for your respective version of SQL Server to install SQL Server. The links are as follows:
+        > * [SQL Server 2014](https://docs.microsoft.com/sql/sql-server/install/planning-a-sql-server-installation?view=sql-server-2014)
+        > * [SQL Server 2012](https://docs.microsoft.com/previous-versions/sql/sql-server-2012/bb500442(v=sql.110))
+        > * [SQL Server 2008 R2](https://docs.microsoft.com/previous-versions/sql/sql-server-2012/bb500442(v=sql.110))
+
+5. In the post-installation of SQL Server, make sure that you provision the user account in SQL Server, and assign the following permissions to the user who will configure the MBAM database and reporting roles on the database server.
+
+    Roles for the instance of SQL Server:
+        
+    * dbcreator
+    * processadmin
+
+    Rights for the instance of SQL Server Reporting Services:
+    
+    * Create Folders
+    * Publish Reports
+
+Your database server is ready for configuration of MBAM 2.5 roles. Let’s move to the next server.
+
+#### Step 1.2: Deploying prerequisites for administration and monitoring server
+
+Choose a server that meets the hardware configuration as explained in the [MBAM system requirements document](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/mbam-25-supported-configurations#-mbam-server-system-requirements). It must be running Windows Server 2008 R2 or a later operating system together with latest service pack and updates. After the server is ready, install the following roles and features:
+
+##### Roles
+
+* Web Server (IIS) Management Tools (Select IIS Management Scripts and Tools.)
+
+* Web Server Role Services
+
+    * Common HTTP features
              
+      Static Content
              
+      Default Document
+
+    * Application development
              
+      ASP.NET
              
+      .NET Extensibility
              
+      ISAPI Extensions
              
+      ISAPI Filters
              
+      Security
              
+      Windows Authentication
              
+      Request Filtering
+
+    * Web Service IIS Management Tools
+
+##### Feature
+
+* .NET Framework 4.5 features
+  
+  * Microsoft .NET Framework 4.5
+  
+    For Windows Server 2012 or Windows Server 2012 R2, .NET Framework 4.5 is already installed for these versions of Windows Server. However, you must enable it.
+  
+    For Windows Server 2008 R2, .NET Framework 4.5 is not included with Windows Server 2008 R2. So, you must download .NET Framework 4.5 and install it separately.
+  
+  * WCF Activation
              
+    HTTP Activation
              
+    Non-HTTP Activation
+  
+  * TCP Activation
+  
+  * Windows Process Activation Service:
              
+    Process Model
              
+    .NET Framework Environment
              
+    Configuration APIs
+
+For the self-service portal to work, you should also [download and install ASP.NET MVC 4.0](https://go.microsoft.com/fwlink/?linkid=392271).
+
+The next step is to create the required MBAM users and groups in Active Directory.
+
+### Step 2: Creating users and groups in Active Directory Domain Services
+ 
+As part of the prerequisites, you must define certain roles and accounts that are used in MBAM to provide security and access rights to specific servers and features, such as the databases that are running on the instance of SQL Server and the web applications that are running on the Administration and Monitoring Server.
+
+Create the following groups and users in Active Directory. (You can use any name for the groups and users.) Users do not have to have greater user rights. A domain user account is sufficient. You’ll have to specify the name of these groups during configuration of MBAM 2.5:
+
+* **MBAMAppPool**  
+
+  **Type**: Domain User
+
+  **Description**: Domain user who has Read or Write permission to the Compliance and Audit Database and the Recovery Database to enable the web applications to access the data and reports in these databases. It will also be used by the application pool for the web applications.
+
+  **Account Roles (During Configuration of MBAM)**:
+
+  1. Web service application pool domain account
+
+  2. Compliance and Audit Database and Recovery Database read/write user for reports
+
+* **MBAMROUser**
+
+  **Type**: Domain User
+
+  **Description**: Domain user who will have Read-Only access to the Compliance and Audit Database to enable the reports to access the compliance and audit data in this database. It will also be the domain user account that the local SQL Server Reporting Services instance uses to access the Compliance and Audit Database.
+
+  **Account Roles (During Configuration of MBAM)**:
+
+  1. Compliance and Audit Database read-only user for reports
+
+  2. Compliance and Audit Database domain user account
+
+* **MBAMAdvHelpDsk**
+
+  **Type**: Domain Group
+
+  **Description**: MBAM Advanced Helpdesk Users access group: Domain user group whose members have access to all areas of the Administration and Monitoring Website. Users who have this role have to enter only the recovery key, not the user’s domain and user name, when they are helping users recover their drives. If a user is a member of both the MBAM Helpdesk Users group and the MBAM Advanced Helpdesk Users group, the MBAM Advanced Helpdesk Users group permissions override the MBAM Helpdesk Group permissions.
+
+  **Account Roles (During Configuration of MBAM)**: MBAM Advanced Helpdesk Users
+
+* **MBAMHelpDsk**
+
+  **Type**: Domain Group
+
+  **Description**: MBAM Helpdesk Users access group: Domain user group whose members have access to the Manage TPM and Drive Recovery areas of the MBAM Administration and Monitoring Website. People who have this role must fill in all fields when they use either option. This includes the user’s domain and account name.
+
+  **Account Roles (During Configuration of MBAM)**: MBAM Helpdesk Users
+
+* **MBAMRUGrp**
+
+  **Type**: Domain Group
+
+  **Description**: Domain user group whose members have read-only access to the reports in the Reports area of the Administration and Monitoring Website.
+
+  **Account Roles (During Configuration of MBAM)**:
+
+  1. Reports read-only domain access group
+
+  2. MBAM Report Users access group
+
+### Step 3 (Optional): Configure and install SSL certificate on administration and monitoring server
+
+Although it’s optional, we highly recommend that you use a certificate to help secure the communication between the MBAM Client and the Administration and Monitoring Website and the Self-Service Portal websites. We do not recommend that you use self-signed certificates because of obvious security reasons. We suggest that you use a Web Server Type Certificate from a trusted Certification Authority. To do this, you can refer the "Using Certificate Approved by Certificate Authority" section from [KB 2754259](https://support.microsoft.com/help/2754259).
+
+After the certificate is issued, you should add the certificate to the personal store of the Administration and Monitoring Server. To add the certificate, open the Certificates store on the local computer. To do this, follow these steps:
+
+1. Right-select Start, and then select Run.
+
+   ![Select ](images/deploying-MBAM-2.png)
+
+2. Type "MMC.EXE" (without the quotation marks), and then select **OK**.
+
+   ![Run box](images/deploying-MBAM-3.png) 
+
+3. Select **File** in the new MMC that you opened, and then select **Add/Remove Snap-in**.
+   
+   ![Select](images/deploying-MBAM-4.png)
+
+4. Highlight the **Certificates** snap-in, and then select **Add**.
+
+   ![Add or Remove Snap-ins window](images/deploying-MBAM-5.png)
+
+5. Select the **Computer account** option, and then select **Next**.
+   
+   ![Certificates snap-in window](images/deploying-MBAM-6.png)
+
+6. Select **Local Computer** on the next screen, and then select **Finish**.
+   
+   ![Select Computer window](images/deploying-MBAM-7.png)
+
+7. You have now added the Certificates snap-in. This will enable you to work with any certificates in your computer's certificate store.
+
+   ![Add or Remove Snap-ins window](images/deploying-MBAM-8.png)
+
+8. Import the web server certificate into your computer's certificate store.
+
+   Now that you have access to the Certificates snap-in, you can import the web server certificate into your computer's certificate store. To do this, follow the next steps.
+
+9. Open the Certificates (Local Computer) snap-in, and browse to **Personal** and then **Certificates**.
+   
+   ![Certificates (Local Computer) snap-in window](images/deploying-MBAM-9.png)
+
+   > [!Note]
+   > The Certificates snap-in may not be listed. If it is not, no certificates are installed.
+
+10. Right-select **Certificates**, select **All Tasks**, and then select **Import**.
+
+    ![Certificates (Local Computer) snap-in window](images/deploying-MBAM-10.png)
+
+11. When the wizard starts, select **Next**. Browse to the file that you created that contains your server certificate and private key, and then select **Next**.
+
+    ![Certificate Import Wizard window](images/deploying-MBAM-11.png)
+
+12. Enter the password if you specified one for the file when you created it.
+
+   ![Enter password window](images/deploying-MBAM-12.png)
+
+   > [!Note]
+   > Make sure that the **Mark the key as exportable** option is selected if you want to be able to export the key pair again from this computer. As an added security measure, you may want to leave this option cleared to make sure that no one can make a backup of your private key.
+ 
+13. Select **Next**, and then select the **Certificate Store** to which you want to save the certificate.
+
+    ![Certificate Import Wizard window](images/deploying-MBAM-13.png)
+
+    > [!Note]
+    > You should select **Personal**, because it is a web server certificate. If you included the certificate in the certification hierarchy, it will also be added to this store.
+ 
+14. Select **Next**, and then select **Finish**.
+
+    ![Certificate Import Wizard window](images/deploying-MBAM-14.png)
+
+You will now see the server certificate for your web server in the Personal Certificates list. It will be denoted by the common name of the server. (You can find this in the subject section of the certificate.)
+
+For further reference:
+
+[MBAM 2.5 Security Considerations](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/mbam-25-security-considerations)
+
+[Planning How to Secure the MBAM Websites](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-how-to-secure-the-mbam-websites)
+
+The next step is to register a service principle name for the application pool account.
+
+### Step 4: Configuring SSL certificate for MBAM Web Server
+
+If you are using SSL communication between the client and server, you should make sure that the certificate has Enhanced Key Usage OIDs (1.3.6.1.5.5.7.3.1) and (1.3.6.1.5.5.7.3.2). That is, you should make sure that Server Authentication and Client Authentication are added.
+
+If you receive a certificate error when you try to browse service URLs, you are using a certificate that was issued to a different name, or you are browsing by using an incorrect URL.
+
+Although the browser may prompt you with a certificate error message but let you continue, the MBAM web service will not ignore certificate errors and will block the connection. You will notice certificate-related errors in the MBAM client’s MBAM Admin event log. If you are using an alias to connect to the Administration and Monitoring server, you should issue a certificate to the alias name. That is, the subject name of the certificate should be the alias name, and the local server’s DNS name should be added to the **Subject Alternative Name** field of the certificate.
+
+Example:
+
+If the virtual name is "bitlocker.contoso.com" and the MBAM Administration and Monitoring server name is "adminserver.contoso.com," the certificate should be issued to bitlocker.contoso.com (subject name), and adminserver.contoso.com should be added to **Subject Alternative Name** field of the certificate.
+
+Similarly, if you have multiple Administration and Monitoring servers installed to balance the load by using a load balancer, you should issue the SSL certificate to the virtual name. That is, the subject name field of the certificate should have the virtual name, and the names of all the local servers should be added in the **Subject Alternative Name** field of the certificate.
+
+Example:
+
+If the virtual name is "bitlocker.contoso.com" and the servers are "adminserver1.contoso.com" and "adminiserver2.contoso.com," the certificate should be issued to bitlocker.contoso.com (subject name) and adminserver1.contoso.com, and adminiserver2.contoso.com should be added to the **Subject Alternative Name** field of the certificate.
+
+The steps to configure SSL communication by using MBAM are described in the following Knowledge Base article: [KB 2754259](https://support.microsoft.com/help/2754259).
+
+### Step 5: Register SPNS for the application pool account and configure constrained delegation
+
+> [!Note]
+> Constrained delegation is required only for 2.5 and is not required for 2.5 Service Pack 1 and later.
+
+To enable the MBAM servers to authenticate communication from the Administration and Monitoring Website and the Self-Service Portal, you must register a Service Principal Name (SPN) for the host name under the domain account that you are using for the web application pool. The following article contains step-by-step instructions to register SPNs: [Planning How to Secure the MBAM Websites](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-how-to-secure-the-mbam-websites)
+
+After you have the SPN configured, you should set up constrained delegation on the SPN. To do this, follow these steps:
+
+1. Go to Active Directory, and find the app pool credentials that you configured for MBAM websites in the previous steps.
+
+2. Right-click the credentials, and then select **properties**.
+
+3. Select the **delegation** tab.
+
+4. Select the option for Kerberos authentication.
+
+5. Select **browse**, and browse again for your app pool credentials. You should then see the all the SPNs that are set up on the app pool creds account. (The SPN should resemble "http/bitlocker.fqdn.com"). Highlight the SPN that is the same as the host name that you specified during the MBAM installation.
+
+6. Select **OK**.
+
+Now you are good with prerequisites. In the next steps, you will install the MBAM software on the servers and configure it.
+
+## Installing and configuring MBAM 2.5 server software
+
+### Step 6: Install MBAM 2.5 server software 
+
+To install the MBAM Server software by using the Microsoft BitLocker Administration and Monitoring Setup wizard both on Database Server and on Administration and Monitoring Server, follow these steps.
+
+1. On the server on which you want to install MBAM, run MBAMserversetup.exe to start the Microsoft BitLocker Administration and Monitoring Setup wizard.
+
+2. On the Welcome page, select **Next**.
+
+3. Read and accept the Microsoft Software License Agreement, and then select **Next** to continue the installation.
+
+4. Decide whether to use Microsoft Update when you check for updates, and then select **Next**.
+
+5. Decide whether to participate in the Customer Experience Improvement Program, and then select **Next**.
+
+6. To start the installation, select **Install**.
+
+7. To configure the server features after the MBAM Server software finishes installing, select the **Run MBAM Server Configuration after the wizard closes** check box. Or, you can configure MBAM later by using the **MBAM Server Configuration** shortcut that the server installation creates on your **Start** menu.
+
+8. Select **Finish**.
+
+For more information, see [Installing the MBAM 2.5 Server Software](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/installing-the-mbam-25-server-software).
+
+### Step 7: Configure MBAM 2.5 database and reports role
+
+In this step, we will configure the MBAM 2.5 databases and reporting component by using the MBAM Wizard:
+
+1. Configure the Compliance and Audit Database and the Recovery Database by using the wizard:
+   
+   1. On the server on which you want to configure the databases, start the **MBAM Server Configuration wizard**. You can select **MBAM Server Configuration** on the **Start** menu to open the wizard.
+
+   2. Select **Add New Features**, select **Compliance and Audit Database**, **Recovery Database and Reports**, and then select **Next**. The wizard checks that all prerequisites for the databases are met.
+
+   3. If the prerequisite check is successful, select **Next** to continue. Otherwise, resolve any missing prerequisites, and then select **Check prerequisites again**.
+   
+   4. Using the following descriptions, enter the field values in the wizard:
+
+2. Compliance and audit database
+
+   |Field	|Description|
+   |-------|-------|
+   |SQL Server name	|Name of the server on which you are configuring the Compliance and Audit Database. 
               You must add an exception on the Compliance and Audit Database computer to enable incoming inbound traffic on the SQL Server port. The default port number is 1433.|
+   |SQL Server database instance	|Name of the database instance where the compliance and audit data will be stored. If you are using the default instance, you must leave this field blank. You must also specify where the database information will be located.|
+   |Database name	|Name of the database that will store the compliance data. You must note the name of the database that you are specifying here because you will have to provide this information in later steps.|
+   |Read/write permission domain user or group	|Specify the name of the MBAMAppPool user as configured in step 2.|
+   |Read-only access domain user or group	|Specify the name of the MBAMROUser user as configured in step 2.|
+
+3. Recovery database.
+
+   |Field	|Description|
+   |-----|-----|
+   |SQL Server name	|Name of the server on which you are configuring the Recovery Database. You must add an exception on the Recovery Database computer to enable incoming inbound traffic on the SQL Server port. The default port number is 1433.|
+   |SQL Server database instance	|Name of the database instance where the recovery data will be stored. If you are using the default instance, you must leave this field blank. You must also specify where the database information will be located.|
+   |Database name	|Name of the database that will store the recovery data.|
+   |Read/write permission domain user or group	|Domain user or group that has read/write permission to this database to enable the web applications to access the data and reports in this database. 
              If you enter a user in this field, it must be the same value as the value in the **Web service application pool domain account** field on the **Configure Web Applications** page. 
              If you enter a group in this field, the value in the **Web service application pool domain account** field on the **Configure Web Applications** page must be a member of the group that you enter in this field.|
+   
+   When you finish your entries, select **Next**. The wizard checks that all prerequisites for the databases are met.
+   
+   If the prerequisite check is successful, select **Next** to continue. Otherwise, resolve any missing prerequisites, and then select **Next** again.
+
+4. Reports.
+
+   |Field	|Description|
+   |----|----|
+   |SQL Server Reporting Services instance	|Instance of SQL Server Reporting Services where the reports will be configured. If you are using the default instance, you must leave this field blank.|
+   |Reporting role domain group	|Specify the name of the MBAMRUGrp as mentioned in step 2.|
+   |SQL Server name	|Name of the server on which the Compliance and Audit Database is configured.|
+   |SQL Server database instance	|Name of the database instance where the compliance and audit data is configured. If you are using the default instance, you must leave this field blank. 
              You must add an exception on the Reports computer to enable incoming traffic on the port of the Reporting Server. (The default port is 80.)|
+   |Database name|	Name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status.|
+   |Compliance and Audit Database domain account	|Specify the name of the MBAMROUser user as configured in step 2.|
+   
+   When you finish your entries, select **Next**. The wizard checks that all prerequisites for the Reports feature are met. Select Next to continue. On the **Summary** page, review the features that will be added.
+   
+   For more information, see the following article: [How to Configure the MBAM 2.5 Databases](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-configure-the-mbam-25-databases).
+
+### Step 8: Configure the MBAM 2.5 Web applications role
+
+1. On the server on which you want to configure the web applications, start the MBAM Server Configuration wizard. You can select **MBAM Server Configuration** on the **Start** menu to open the wizard.
+
+2. Select **Add New Features**, select **Administration and Monitoring Website** and **Self-Service Portal**, and then select **Next**. The wizard checks that all prerequisites for the databases are met.
+
+3. If the prerequisite check is successful, select **Next** to continue. Otherwise, resolve any missing prerequisites, and then select **Check prerequisites again**.
+
+4. Use the following descriptions to enter the field values in the wizard.
+
+   |Field	|Description|
+   |-----|-----|
+   |Security certificate	|Select a previously created certificate in step 3 to optionally encrypt the communication between the web services and the server on which you are configuring the Administration and Monitoring Website. If you select Do not use a certificate, your web communication may not be secure.|
+   |Host name	|Name of the host computer on which you are configuring the Administration and Monitoring Website. 
              It does not have to be the hostname of the machine, it could be anything. However, if the hostname is different than the netbios name of the computer, you have to create an A record and make sure the SPN uses the custom hostname, not the netbios name. This is common on load balancing scenarios.|
+   |Installation path	|Path on which you are installing the Administration and Monitoring Website.|
+   |Port	|Port number to use for website communication. 
               You must set a firewall exception to enable communication through the specified port.|
+   |Web service application pool domain account and password	|Specify the user account and password of the MBAMAppPool user as configured in step 2. 
               For improved security, set the account that is specified in the credentials to have limited user rights. Also, set the password of the account to never expire.|
+
+5. Verify that the built-in IIS_IUSRS account or the application pool account was added to the **Impersonate a client after authentication** and the **Log on as a batch job** local security settings.
+
+   To check whether the account was added to the local security settings, open the **Local Security Policy editor**, expand the **Local Policies** node, select the **User Rights Assignment** node, and double-select **Impersonate a client after authentication** and **Log on as a batch job** policies in the right-side pane.
+
+6. Use the following field descriptions to configure the connection information in the wizard for the Compliance and Audit Database.
+   |Field	|Description|
+   |------|------|
+   |SQL Server name	|Name of the server on which the Compliance and Audit Database is configured.|
+   |SQL Server database instance	|Name of the instance of SQL Server (for example, \) and on which the Compliance and Audit Database is configured. Leave this blank if you are using the default instance.|
+   |Database name	|Name of the Compliance and Audit Database. By default, it’s "MBAM Compliance Status".|
+
+7. Use the following field descriptions to configure the connection information in the wizard for the Recovery Database.
+   |Field	|Description|
+   |----|----|
+   |SQL Server name	|Name of the server on which the Recovery Database is configured.|
+   |SQL Server database instance	|Name of the instance of SQL Server (for example, \) on which the Recovery Database is configured. Leave this blank if you are using the default instance.|
+   |Database name	|Name of the Recovery Database. By default, it’s "MBAM Recovery and Hardware".|
+
+8. Use the following descriptions to enter the field values in the wizard to configure the Administration and Monitoring Website.
+   |Field	|Description|
+   |----|----|
+   |Advanced Helpdesk role domain group	|Specify the name of the MBAMAdvHelpDsk Group as configured in step 2.|
+   |Helpdesk role domain group	|Specify the name of the MBAMHelpDsk Group as configured in step 2.|
+   |Use System Center Configuration Manager Integration	|Select to clear this check box.	 |
+   |Reporting role domain group	|Specify the name of the MBAMRUGrp Group as configured in step 2.	 |
+   |SQL Server Reporting Services URL	|Specify the Web Service URL for the SSRS server on which the MBAM reports are configured. You can find this information by logging in to Reporting Services Configuration Manager on the Database Server. 
               Example of a fully qualified domain name: https://MyReportServer.Contoso.com/ReportServer 
              Example of a custom host name: https://MyReportServer/ReportServer|
+   |Virtual directory	|Virtual directory of the Administration and Monitoring Website. This name corresponds to the website’s physical directory on the server and is appended to the website’s host name. For example: 
              http(s)://*\*:*\*/HelpDesk/ 
              If you do not specify a virtual directory, the value HelpDesk will be used.	 |
+
+9. Use the following description to enter the field values in the wizard to configure the Self-Service Portal.
+
+   |Field	|Description|
+   |----|----|
+   |Virtual directory	|Virtual directory of the web application. This name corresponds to the website’s physical directory on the server and is appended to the website’s host name. For example:
              http(s)://*\*:*\*/SelfService/
               If you do not specify a virtual directory, the value "SelfService" will be used.|
+
+10. When you finish your entries, select **Next**. The wizard checks that all prerequisites for the web applications are met.
+
+11. Select **Next** to continue.
+
+12. On the **Summary** page, review the features that will be added.
+
+13. Select **Add** to add the web applications to the server, and then select **Close**.
+
+## Customizing and validating steps after installing MBAM 2.5 server software
+
+### Step 9: Customizing the self-server portal for your organization
+
+To customize the Self-Service Portal by adding custom notice text, your company name, pointers to more information, and so on, see [Customizing the Self-Service Portal for Your Organization](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/customizing-the-self-service-portal-for-your-organization).
+ 
+### Step 10: Configure the self-server portal if client computers cannot access the CDN 
+
+Determine whether your client computers have access to the Microsoft AJAX Content Delivery Network (CDN). The CDN gives the Self-Service Portal the access it requires to certain JavaScript files. If you don’t configure the Self-Service Portal when client computers cannot access the CDN, only the company name and the account under which the user signed in will be displayed. No error message will be shown.
+
+Do one of the following:
+
+* If your client computers have access to the CDN, do nothing. Your Self-Service Portal configuration is complete.
+
+* If your client computers do not have access to the CDN, follow the steps in [How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network).
+
+### Step 11: Validate the MBAM 2.5 server feature configuration 
+
+To validate your MBAM Server deployment to use the standalone topology, follow these steps.
+
+1. On each server on which an MBAM feature is deployed, select **Control Panel** > **Programs** > **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list.
+   > [!Note]
+   > To perform the validation, you must use a domain account that has local computer administrative credentials on each server.
+
+2. On the server on which the Recovery Database is configured, open SQL Server Management Studio, and verify that the **MBAM Recovery and Hardware** database is configured.
+
+3. On the server om which the Compliance and Audit Database is configured, open SQL Server Management Studio, and verify that the MBAM Compliance Status Database is configured.
+
+4. On the server onm which the Reports feature is configured, open a web browser by using administrative credentials, and browse to the homepage of the SQL Server Reporting Services site.
+   
+   The default homepage location of a SQL Server Reporting Services site instance is as follows:
+   http(s)://*\*:*\*/Reports.aspx
+   
+   To find the actual URL, use the Reporting Services Configuration Manager tool, and select the instances that you specified during setup.
+   
+5. Verify that a reports folder that is named Microsoft BitLocker Administration and Monitoring contains a data source that is named MaltaDataSource. This data source contains folders that have names that represent language locales (for example, en-us). The reports are in the language folders.
+
+   > [!Note]
+   > If SQL Server Reporting Services (SSRS) was configured as a named instance, the URL should resemble the following:
+   > http(s)://\:\/Reports_\
+   >
+   > If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to "HTTP" instead of "HTTPS" when you install the MBAM server. If you then go to the Administration and Monitoring Website (also known as Helpdesk) and select a report, you receive the following message: "Only Secure Content is Displayed." To show the report, select **Show All Content**.
+
+6. On the server on which the Administration and Monitoring Website feature is configured, run Server Manager, browse to **Roles**, and then select **Web Server (IIS)** > **Internet Information Services (IIS)** Manager.
+
+7. In **Connections**, browse to \ and then select **Sites** > **Microsoft BitLocker Administration and Monitoring**. Verify that the following are listed:
+
+   * MBAMAdministrationService
+   * MBAMComplianceStatusService
+   * MBAMRecoveryAndHardwareService
+
+8. On the server on which the Administration and Monitoring Website and Self-Service Portal are configured, open a web browser by using administrative credentials.
+
+9. Browse to the following websites to verify that they load successfully:
+   * https(s)://\:\/HelpDesk/ (confirm each link for navigation and reports)
+   * http(s)://\:\/SelfService/
+
+   > [!Note]
+   > It is assumed that you configured the server features on the default port without network encryption. If you configured the server features on a different port or virtual directory, change the URLs to include the appropriate port. For example:
+   > http(s)://\:\/HelpDesk/
+   > http(s)://\:\/\/
+   > If the server features were configured to use network encryption, change http:// to https://.
+   
+10. Browse to the following web services to verify that they load successfully. A page opens to indicate that the service is running. However, the page displays no metadata.
+
+    * http(s)://\:\/MBAMAdministrationService/AdministrationService.svc
+    * http(s)://\:\/MBAMUserSupportService/UserSupportService.svc
+    * http(s)://\:\/MBAMComplianceStatusService/StatusReportingService.svc
+    * http(s)://\:\/MBAMRecoveryAndHardwareService/CoreService.svc
+
+### Step 12: Configure the MBAM Group policy templates
+
+To deploy MBAM, you have to set Group Policy settings that define MBAM implementation settings for BitLocker Drive Encryption. To complete this task, you must copy the MBAM Group Policy templates to a server or workstation that can run Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM), and then edit the settings.
+
+> [!Important]
+> Do not change the Group Policy settings in the **BitLocker Drive Encryption** node or MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the **BitLocker Drive Encryption** settings for you.
+ 
+#### Copying the MBAM 2.5 Group Policy templates
+
+Before you install the MBAM Client, you must copy MBAM-specific Group Policy Objects (GPOs) to the management workstation. These GPOs define MBAM implementation settings for BitLocker. You can copy the Group Policy templates to any server or workstation that is a supported Windows-based server or client computer and that can run the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM).
+
+For more information, see [Copying the MBAM 2.5 Group Policy Templates](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/copying-the-mbam-25-group-policy-templates).
+ 
+#### Editing MBAM 2.5 GPO settings
+
+After you create the necessary GPOs, you must deploy the MBAM Group Policy settings to your organization’s client computers. To view and create GPOs, you must have Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM) installed.
+
+For more information, see [Editing the MBAM 2.5 Group Policy Settings](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/editing-the-mbam-25-group-policy-settings) and [Planning for MBAM 2.5 Group Policy Requirements](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-for-mbam-25-group-policy-requirements).
+ 
+### Step 13: Deploying the MBAM 2.5 Client
+
+Depending on when you deploy the Microsoft BitLocker Administration and Monitoring Client software, you can enable BitLocker on a computer in your organization either before the user receives the computer or afterward by configuring Group Policy and deploying the MBAM Client software by using an enterprise software deployment system.
+ 
+#### Deploy the MBAM Client to desktop or portable computers
+
+After you configure Group Policy settings, you can use an enterprise software deployment system product such as Microsoft System Center 2012 Configuration Manager or Active Directory Domain Services (AD DS) to deploy the MBAM client installation Windows Installer files to target computers. You can use either the 32-bit or 64-bit MbamClientSetup.exe files or the 32-bit or 64-bit MBAMClient.msi files. These are provided together with the MBAM Client software.
+
+For more information, see [How to Deploy the MBAM Client to Desktop or Laptop Computers](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25).
+ 
+#### Deploy the MBAM Client as part of a Windows deployment
+
+In organizations in which computers are received and configured centrally, you can install the MBAM Client to manage BitLocker Drive Encryption on each computer before any user data is written to it. The benefit of this process is that every computer is then BitLocker-compliant. This method does not rely on user action because the administrator has already encrypted the computer. A key assumption for this scenario is that the policy of the organization is to install a corporate Windows image before the computer is delivered to the user. If the Group Policy settings are configured to require a PIN, users are prompted to set a PIN after they receive the policy.
+
+For more information, see [How to Deploy the MBAM Client as Part of a Windows Deployment](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25).
+ 
+#### How to deploy the MBAM Client by using a command line
+
+For more information see [How to Deploy the MBAM Client by Using a Command Line](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/how-to-deploy-the-mbam-client-by-using-a-command-line).
+
+#### Post-deployment of clients
+
+Now that you have finished the deployment activity, you should review the following logs and determine whether the clients are reporting successfully to the MBAM database.
+
+## FAQ
+
+### How to create a Load balanced IIS servers
+
+* SPN must be registered only to the friendly name (for example: bitlocker.corp.net), and must not be registered to individual IIS servers.
+
+* If a certificate is used, the certificate must have both FQDN and NetBIOS names entered into the **Subject Alternative Name** field for all IIS servers in the load balance group and also as the Friendly Name (for example: bitlocker.corp.net). Otherwise, the certificate will be reported as not trusted by the browser when you browse load-balanced addresses.
+
+For more information, see [IIS Network Load Balancing](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-for-mbam-25-high-availability#a-href-idbkmk-load-balanceaiis-network-load-balancing) and [Registering SPNs for the application pool account](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-how-to-secure-the-mbam-websites#registering-spns-for-the-application-pool-account).
+
+### How to configure a certificate
+
+* You’ll have to have two certificates. One certificate is used for SQL server, and the other is used for IIS. They must be installed before starting MBAM installation.
+
+* We recommend that you use the installer to add the certificate to the IIS configuration instead of manually editing the web.config file.
+
+* The certificate will not be accepted by the MBAM Configurator if the “Issued To” field on the certificate does not match the name of the server. In this case, temporarily create a self-signed certificate from the IIS Console, and use it in the Configurator. This will make nsure that the Web Apps are installed for SSL and HTTPS. After that, you can change the certificate to one from IIS bindings for the MBAM Website.
+
+### The SQL permissions requirement for installation
+
+Create an account for MBAM App Pool, and give it only SecurityAdmin, Public, and DBCreator permissions.
+
+See [MBAM Database configuration – minimum permissions](https://blogs.technet.microsoft.com/dubaisec/2016/02/02/mbam-database-configuration-minimum-permissions/) for more information.
+
+> [!Note]
+> * In some situations, more permissions are required for the initial installation and upgrade operations.
+> * Use an account that has temporary SA for the installation.
+> * Do not start the Configurator in the context of a user account (Run As) that does not have enough permissions to make changes to SQL Server because this will cause installation errors.
+> * You must be logged on by using an account that has permissions on SQL Server. Only SQL Server databases can be created or updated by running MBAM Configurator remotely. For SSRS server, you must install MBAM and run Configurator locally to install or update the MBAM SSRS reports.
+
+### The permission required for SPN Registration
+
+An account that's used for IIS portal installation must have Write ServicePrincipalName and Write Validated SPN permissions. Without these permissions, the installation will return a warning message that states that it cannot register the SPN.
+
+> [!Note]
+> You will this receive this warning message twice. This does not mean that the SPN must have two objects registered to it.
+
+For more information, see [MBAM Setup fails with “Register SPN Deferred” error message](https://support.microsoft.com/help/2754138/).
+
+### Did I have to update the ADMX templates to the latest version?
+
+You'll see multiple OS options in the MBAM root node for GPO after you update the ADMX templates to their latest versions. For example, Windows 7, Windows 8.1, and Windows 10, version 1511 and later versions.
+
+For more information about how to update the ADMX templates, see the following articles:
+* [How to Download and Deploy MDOP Group Policy (.admx) Templates](https://docs.microsoft.com/microsoft-desktop-optimization-pack/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates)
+* [Planning for MBAM 2.5 Group Policy Requirements](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/planning-for-mbam-25-group-policy-requirements)
+* [Microsoft Desktop Optimization Pack Group Policy Administrative Templates](https://www.microsoft.com/en-us/download/details.aspx?id=55531)
diff --git a/mdop/mbam-v25/deploying-mbam-25-group-policy-objects.md b/mdop/mbam-v25/deploying-mbam-25-group-policy-objects.md
index 160b9ab0b2..ea0c9dff8f 100644
--- a/mdop/mbam-v25/deploying-mbam-25-group-policy-objects.md
+++ b/mdop/mbam-v25/deploying-mbam-25-group-policy-objects.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying MBAM 2.5 Group Policy Objects
 description: Deploying MBAM 2.5 Group Policy Objects
-author: jamiejdt
+author: dansimp
 ms.assetid: 4b835054-6846-463d-af58-8ac4639a1188
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ To deploy MBAM, you have to set Group Policy settings that define MBAM implement
 **Important**  
 Do not change the Group Policy settings in the **BitLocker Drive Encryption** node, or MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the **BitLocker Drive Encryption** settings for you.
 
- 
+ 
 
 ## Copying the MBAM 2.5 Group Policy Templates
 
@@ -51,9 +54,9 @@ Since MBAM offers a customized MBAM control panel that can replace the default W
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/deploying-mbam-25.md b/mdop/mbam-v25/deploying-mbam-25.md
index f1c1cff37e..48ab4bb17d 100644
--- a/mdop/mbam-v25/deploying-mbam-25.md
+++ b/mdop/mbam-v25/deploying-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying MBAM 2.5
 description: Deploying MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 45403607-1f4d-42fe-8413-0d4da01808a6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -37,32 +40,32 @@ Use this information to identify the procedures you can follow to deploy and con
 
            • How to install the MBAM Server software.
              • 
 
            • How to configure the MBAM Server features.
              • 
 
            
-
            [Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md)
            
+
            Deploying the MBAM 2.5 Server Infrastructure
            
 
 
 
            How to download and deploy the MBAM Group Policy Templates, which are required to manage MBAM Clients and BitLocker encryption policies in the enterprise.
            
-
            [Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md)
            
+
            Deploying MBAM 2.5 Group Policy Objects
            
 
 
 
            How to use the MBAM Client Windows Installer files to deploy the MBAM Client software.
            
-
            [Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md)
            
+
            Deploying the MBAM 2.5 Client
            
 
 
 
            Checklist that can assist you in deploying the MBAM Server features and MBAM Client.
            
-
            [MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md)
            
+
            MBAM 2.5 Deployment Checklist
            
 
 
 
            How to upgrade MBAM from previous versions.
            
-
            [Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions](upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md)
            
+
            Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions
            
 
 
 
            How to remove MBAM Server features or software.
            
-
            [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md)
            
+
            Removing MBAM Server Features or Software
            
 
 
 
 
- 
+ 
 
 ## Other resources for deploying MBAM
 
@@ -85,9 +88,9 @@ Use this information to identify the procedures you can follow to deploy and con
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/deploying-the-mbam-25-client.md b/mdop/mbam-v25/deploying-the-mbam-25-client.md
index 5c05697ce7..0a20208aa0 100644
--- a/mdop/mbam-v25/deploying-the-mbam-25-client.md
+++ b/mdop/mbam-v25/deploying-the-mbam-25-client.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying the MBAM 2.5 Client
 description: Deploying the MBAM 2.5 Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 0a96a0ee-f280-49d9-a244-88f4147fe9fd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -26,7 +29,7 @@ After configuring Group Policy settings, you can use an enterprise software depl
 **Note**  
 Beginning in MBAM 2.5 SP1, a separate MSI is no longer included with the MBAM product. However, you can extract the MSI from the executable file (.exe) that is included with the product.
 
- 
+ 
 
 [How to Deploy the MBAM Client to Desktop or Laptop Computers](how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md)
 
@@ -58,11 +61,11 @@ This section explains how to install the MBAM Client by using a command line.
 
 [Planning for MBAM 2.5](planning-for-mbam-25.md)
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/deploying-the-mbam-25-server-infrastructure.md b/mdop/mbam-v25/deploying-the-mbam-25-server-infrastructure.md
index 47c09e74df..d60e1044e5 100644
--- a/mdop/mbam-v25/deploying-the-mbam-25-server-infrastructure.md
+++ b/mdop/mbam-v25/deploying-the-mbam-25-server-infrastructure.md
@@ -1,8 +1,11 @@
 ---
 title: Deploying the MBAM 2.5 Server Infrastructure
 description: Deploying the MBAM 2.5 Server Infrastructure
-author: jamiejdt
+author: dansimp
 ms.assetid: e85a60cf-4cc1-4906-8da3-442232c374af
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -30,32 +33,32 @@ To deploy the Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 Serve
 
 
 
            Install the MBAM 2.5 Server software on each server where you want to configure an MBAM Server feature.
            
-
            [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md)
            
+
            Installing the MBAM 2.5 Server Software
            
 
 
 
            Configure the databases, reports, web applications, and the optional System Center Configuration Manager Integration topology.
            
 
            You can use the MBAM Server Configuration wizard or Windows PowerShell cmdlets to do the configuration.
            
-
            [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md)
            
+
            Configuring the MBAM 2.5 Server Features
            
 
 
 
            Validate the MBAM Server configuration.
            
-
            [Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md)
            
+
            Validating the MBAM 2.5 Server Feature Configuration
            
 
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [Deploying MBAM 2.5](deploying-mbam-25.md)
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md b/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md
index e1dbf01ed9..9ce836f5eb 100644
--- a/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md
+++ b/mdop/mbam-v25/determining-why-a-device-receives-a-noncompliance-message.md
@@ -1,8 +1,11 @@
 ---
 title: Determining why a Device Receives a Noncompliance Message
 description: Determining why a Device Receives a Noncompliance Message
-author: jamiejdt
+author: dansimp
 ms.assetid: 793df330-a0ee-4759-b53a-95618ac74428
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/edit-the-configurationmof-file-mbam-25.md b/mdop/mbam-v25/edit-the-configurationmof-file-mbam-25.md
index f4616b4724..a3a45c975d 100644
--- a/mdop/mbam-v25/edit-the-configurationmof-file-mbam-25.md
+++ b/mdop/mbam-v25/edit-the-configurationmof-file-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Edit the Configuration.mof File
 description: Edit the Configuration.mof File
-author: jamiejdt
+author: dansimp
 ms.assetid: 5d8cd76b-8ffc-4d46-b761-1b8350310c48
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/editing-the-mbam-25-group-policy-settings.md b/mdop/mbam-v25/editing-the-mbam-25-group-policy-settings.md
index 543f7e2ff6..8e285009f6 100644
--- a/mdop/mbam-v25/editing-the-mbam-25-group-policy-settings.md
+++ b/mdop/mbam-v25/editing-the-mbam-25-group-policy-settings.md
@@ -1,8 +1,11 @@
 ---
 title: Editing the MBAM 2.5 Group Policy Settings
 description: Editing the MBAM 2.5 Group Policy Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: a50b6b0c-6818-4419-8447-d0520a533dba
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -30,11 +33,11 @@ To successfully deploy Microsoft BitLocker Administration and Monitoring (MBAM),
 
 
 
            Copy the MBAM 2.5 Group Policy Templates.
            
-
            [Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md)
            
+
            Copying the MBAM 2.5 Group Policy Templates
            
 
 
 
            Determine which Group Policy Objects (GPOs) you want to use in your MBAM implementation. Based on the needs of your organization, you might have to configure additional Group Policy settings.
            
-
            [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md) – contains descriptions of the GPOs
            
+
            Planning for MBAM 2.5 Group Policy Requirements – contains descriptions of the GPOs
            
 
 
 
            Set the Group Policy settings for your organization.
            
@@ -43,12 +46,12 @@ To successfully deploy Microsoft BitLocker Administration and Monitoring (MBAM),
 
 
 
- 
+ 
 
 **Important**  
 Do not change the Group Policy settings in the **BitLocker Drive Encryption** node, or MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the **BitLocker Drive Encryption** settings for you.
 
- 
+ 
 
 **To edit MBAM Client Group Policy settings**
 
@@ -89,7 +92,7 @@ Do not change the Group Policy settings in the **BitLocker Drive Encryption** no
     
     
 
-     
+     
 
 ## Related topics
 
@@ -98,11 +101,11 @@ Do not change the Group Policy settings in the **BitLocker Drive Encryption** no
 
 [Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md)
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md b/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md
index 875d8cccb0..67c54060da 100644
--- a/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md
+++ b/mdop/mbam-v25/evaluating-mbam-25-in-a-test-environment.md
@@ -1,8 +1,11 @@
 ---
 title: Evaluating MBAM 2.5 in a Test Environment
 description: Evaluating MBAM 2.5 in a Test Environment
-author: jamiejdt
+author: dansimp
 ms.assetid: 72959b7a-e55f-4797-91b3-5be23c8c2844
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -23,241 +26,240 @@ To evaluate MBAM by using the Stand-alone topology, use the information in the f
 
 **To evaluate MBAM 2.5 by using the Stand-alone topology**
 
-1.  Before installing MBAM, do the following:
+1. Before installing MBAM, do the following:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            TaskWhere to get instructions
            Ensure that you have installed all of the prerequisite software.
            [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md)
            Check the required hardware, RAM, and other specifications.
            [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)
            Review the prerequisites for using Windows PowerShell if you plan to use the cmdlets to configure MBAM.
            [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md)
            
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            TaskWhere to get instructions
            Ensure that you have installed all of the prerequisite software.
            MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies
            Check the required hardware, RAM, and other specifications.
            MBAM 2.5 Supported Configurations
            Review the prerequisites for using Windows PowerShell if you plan to use the cmdlets to configure MBAM.
            Configuring MBAM 2.5 Server Features by Using Windows PowerShell
            
 
-     
 
-2.  Install the MBAM Server software, and then configure the features you want.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            TaskWhere to get instructions
            Install the MBAM Server software on each server where you want to configure an MBAM Server feature.
            [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md)
            Configure the Compliance and Audit Database and the Recovery Database.
            [How to Configure the MBAM 2.5 Databases](how-to-configure-the-mbam-25-databases.md)
            Configure the Reports feature.
            [How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md)
            Configure the web applications.
            [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md)
            
+2. Install the MBAM Server software, and then configure the features you want.
 
-     
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            TaskWhere to get instructions
            Install the MBAM Server software on each server where you want to configure an MBAM Server feature.
            Installing the MBAM 2.5 Server Software
            Configure the Compliance and Audit Database and the Recovery Database.
            How to Configure the MBAM 2.5 Databases
            Configure the Reports feature.
            How to Configure the MBAM 2.5 Reports
            Configure the web applications.
            How to Configure the MBAM 2.5 Web Applications
            
 
-3.  On a client computer, do the following:
 
-    1.  Install the MBAM Client on a client computer.
 
-    2.  Apply the MBAM Group Policy Objects (GPOs) to the computer.
+3. On a client computer, do the following:
 
-    3.  Set the following registry keys to force the MBAM Client to wake up faster and at regular intervals:
+   1.  Install the MBAM Client on a client computer.
 
-        ``` syntax
-        [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement
-        "ClientWakeupFrequency"=dword:00000001
-        "StatusReportingFrequency"=dword:00000001
-        ```
+   2.  Apply the MBAM Group Policy Objects (GPOs) to the computer.
 
-        ``` syntax
-        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
-        "NoStartupDelay"=dword:00000001
-        ```
+   3.  Set the following registry keys to force the MBAM Client to wake up faster and at regular intervals:
 
-        **Note**  
-        Because these keys wake up the MBAM Client every minute, we recommend that you use these registry key settings only in a test environment.
+       ``` syntax
+       [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement
+       "ClientWakeupFrequency"=dword:00000001
+       "StatusReportingFrequency"=dword:00000001
+       ```
 
-         
+       ``` syntax
+       [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
+       "NoStartupDelay"=dword:00000001
+       ```
 
-    4.  Restart the **BitLocker Management Client Service**.
+       **Note**  
+       Because these keys wake up the MBAM Client every minute, we recommend that you use these registry key settings only in a test environment.
 
-## Evaluating MBAM 2.5 by using the System Center 2012 Configuration Manager Integration topology
+
+
+   4.  Restart the **BitLocker Management Client Service**.
+
+## Evaluating MBAM 2.5 by using the System Center 2012 Configuration Manager Integration topology
 
 
 To evaluate MBAM by using the Configuration Manager Integration topology, use the information in the following tables to install the MBAM Server software, and then configure the MBAM Server features in your test environment. After installing the MBAM Client on a client computer, you will complete additional steps to force the MBAM Client to report the computer’s status to MBAM more quickly.
 
-**To evaluate MBAM 2.5 by using the System Center 2012 Configuration Manager Integration topology**
+**To evaluate MBAM 2.5 by using the System Center 2012 Configuration Manager Integration topology**
 
-1.  Before installing MBAM, review the prerequisite software and supported configuration.
+1. Before installing MBAM, review the prerequisite software and supported configuration.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            TaskWhere to get instructions
            Ensure that you have installed all of the prerequisite software.
            [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md)
            
-    
            [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md)
            Check the required hardware, RAM, and other specifications.
            [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)
            Review the prerequisites for using Windows PowerShell if you plan to use the cmdlets to configure MBAM.
            [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md)
            Create or edit the .mof files.
            [Edit the Configuration.mof File](edit-the-configurationmof-file-mbam-25.md)
            
-    
            [Create or Edit the Sms_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md)
            
-
-     
-
-2.  Install the MBAM Server software, and then configure the features you want.
-
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            TaskWhere to get instructions
            Install the MBAM Server software on each server where you want to configure an MBAM Server feature.
            
-    
            
-    Note  
-    
            You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see [Data-tier Applications](https://technet.microsoft.com/library/ee210546.aspx).
            
-    
            
-    
            
-     
-    
            [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md)
            Configure the Compliance and Audit Database and the Recovery Database.
            [How to Configure the MBAM 2.5 Databases](how-to-configure-the-mbam-25-databases.md)
            Configure the Reports feature.
            [How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md)
            Configure the web applications.
            [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md)
            Configure the System Center Configuration Manager to install the Configuration Manager objects.
            [How to Configure the MBAM 2.5 System Center Configuration Manager Integration](how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md)
            
-
-     
-
-3.  On a client computer, do the following:
-
-    1.  Install the MBAM Client and the Configuration Manager Client on a client computer.
-
-    2.  Apply the MBAM Group Policy Objects to the computer.
-
-    3.  Set the following registry keys to force the MBAM Client to wake up faster and at regular intervals:
-
-        ``` syntax
-        [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement
-        "ClientWakeupFrequency"=dword:00000001
-        "StatusReportingFrequency"=dword:00000001
-        ```
-
-        ``` syntax
-        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
-        "NoStartupDelay"=dword:00000001
-        ```
-
-        **Note**  
-        Because these keys wake up the MBAM Client every minute, we recommend that you use these registry key settings only in a test environment.
-
-         
-
-    4.  Restart the **BitLocker Management Client Service**.
-
-    5.  In Control Panel, open **Configuration Manager**, and then click the **Actions** tab.
-    
-    6.  Select **Hardware Inventory Cycle**, and then click **Run Now**. This step runs the hardware inventory by using the new classes that you imported to your .mof files, and then sends the data to the Configuration Manager server.
-
-    7.  Select **Machine Policy Retrieval & Evaluation Cycle**, and then click **Run Now** to apply the Group Policy Objects that are relevant to that client computer.
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            TaskWhere to get instructions
            Ensure that you have installed all of the prerequisite software.
            MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies
            
+   
            MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology
            Check the required hardware, RAM, and other specifications.
            MBAM 2.5 Supported Configurations
            Review the prerequisites for using Windows PowerShell if you plan to use the cmdlets to configure MBAM.
            Configuring MBAM 2.5 Server Features by Using Windows PowerShell
            Create or edit the .mof files.
            Edit the Configuration.mof File
            
+   
            Create or Edit the Sms_def.mof File
            
 
 
 
-4.  In the Configuration Manager console, do the following:
+2. Install the MBAM Server software, and then configure the features you want.
 
-    1.  In the navigation pane, right-click **MBAM Supported Computers**, click **Update Membership**, and then click **Yes** to force the client computer to report its membership immediately.
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            TaskWhere to get instructions
            Install the MBAM Server software on each server where you want to configure an MBAM Server feature.
            
+   
            
+   Note
            You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see Data-tier Applications.
            
+   
            
+   
            
 
-    2.  In the navigation pane, click **MBAM Supported Computers** to verify that the client computer appears in the collection.
+   
            Installing the MBAM 2.5 Server Software
            Configure the Compliance and Audit Database and the Recovery Database.
            How to Configure the MBAM 2.5 Databases
            Configure the Reports feature.
            How to Configure the MBAM 2.5 Reports
            Configure the web applications.
            How to Configure the MBAM 2.5 Web Applications
            Configure the System Center Configuration Manager to install the Configuration Manager objects.
            How to Configure the MBAM 2.5 System Center Configuration Manager Integration
            
 
-5.  On the client computer, in Control Panel, reopen **Configuration Manager** again, and do the following:
 
-    1.  Click the **Actions** tab, and then rerun **Machine Policy Retrieval & Evaluation Cycle**.
 
-    2.  Click the **Configurations** tab, select the BitLocker baseline, and then click **Evaluate**.
+3. On a client computer, do the following:
 
-6.  In the Configuration Manager console, verify that the client computer appears on the Enterprise Compliance Report: as follows:
+   1.  Install the MBAM Client and the Configuration Manager Client on a client computer.
 
-    1.  In the navigation pane, select the **Monitoring** workspace.
+   2.  Apply the MBAM Group Policy Objects to the computer.
 
-    2.  In the console tree, expand **Overview** > **Reporting** > **Reports** > **MBAM**.
+   3.  Set the following registry keys to force the MBAM Client to wake up faster and at regular intervals:
 
-    3.  Select the folder that represents the language in which you want to view reports, and then select the report in the results pane.
+       ``` syntax
+       [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement
+       "ClientWakeupFrequency"=dword:00000001
+       "StatusReportingFrequency"=dword:00000001
+       ```
+
+       ``` syntax
+       [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
+       "NoStartupDelay"=dword:00000001
+       ```
+
+       **Note**  
+       Because these keys wake up the MBAM Client every minute, we recommend that you use these registry key settings only in a test environment.
+
+
+
+   4.  Restart the **BitLocker Management Client Service**.
+
+   5.  In Control Panel, open **Configuration Manager**, and then click the **Actions** tab.
+
+   6.  Select **Hardware Inventory Cycle**, and then click **Run Now**. This step runs the hardware inventory by using the new classes that you imported to your .mof files, and then sends the data to the Configuration Manager server.
+
+   7.  Select **Machine Policy Retrieval & Evaluation Cycle**, and then click **Run Now** to apply the Group Policy Objects that are relevant to that client computer.
+
+
+
+4. In the Configuration Manager console, do the following:
+
+   1.  In the navigation pane, right-click **MBAM Supported Computers**, click **Update Membership**, and then click **Yes** to force the client computer to report its membership immediately.
+
+   2.  In the navigation pane, click **MBAM Supported Computers** to verify that the client computer appears in the collection.
+
+5. On the client computer, in Control Panel, reopen **Configuration Manager** again, and do the following:
+
+   1.  Click the **Actions** tab, and then rerun **Machine Policy Retrieval & Evaluation Cycle**.
+
+   2.  Click the **Configurations** tab, select the BitLocker baseline, and then click **Evaluate**.
+
+6. In the Configuration Manager console, verify that the client computer appears on the Enterprise Compliance Report: as follows:
+
+   1.  In the navigation pane, select the **Monitoring** workspace.
+
+   2.  In the console tree, expand **Overview** > **Reporting** > **Reports** > **MBAM**.
+
+   3.  Select the folder that represents the language in which you want to view reports, and then select the report in the results pane.
 
 ## Evaluating MBAM 2.5 by using the System Center Configuration Manager 2007 Integration topology
 
@@ -266,134 +268,133 @@ To evaluate MBAM by using the Configuration Manager Integration topology, follow
 
 **To evaluate MBAM by using the Configuration Manager 2007 Integration topology**
 
-1.  Before you install MBAM, do the following:
+1. Before you install MBAM, do the following:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            TaskWhere to get instructions
            Ensure that you have installed all of the prerequisite software.
            [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md)
            
-    
            [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md)
            Check the required hardware, RAM, and other specifications.
            [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)
            Create or edit the .mof files.
            [Edit the Configuration.mof File](edit-the-configurationmof-file-mbam-25.md)
            
-    
            [Create or Edit the Sms_def.mof File](create-or-edit-the-sms-defmof-file-mbam-25.md)
            
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            TaskWhere to get instructions
            Ensure that you have installed all of the prerequisite software.
            MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies
            
+   
            MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology
            Check the required hardware, RAM, and other specifications.
            MBAM 2.5 Supported Configurations
            Create or edit the .mof files.
            Edit the Configuration.mof File
            
+   
            Create or Edit the Sms_def.mof File
            
 
-     
 
-2.  Install the MBAM Server software, and then configure the features you want.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            TaskWhere to get instructions
            Install the MBAM Server software on each server where you want to configure an MBAM Server feature.
            
-    
            
-    Note  
-    
            You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see [Data-tier Applications](https://technet.microsoft.com/library/ee210546.aspx).
            
-    
            
-    
            
-     
-    
            [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md)
            Configure the Compliance and Audit Database and the Recovery Database.
            [How to Configure the MBAM 2.5 Databases](how-to-configure-the-mbam-25-databases.md)
            Configure the Reports feature.
            [How to Configure the MBAM 2.5 Reports](how-to-configure-the-mbam-25-reports.md)
            Configure the web applications.
            [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md)
            Configure the System Center Configuration Manager to install the Configuration Manager objects.
            [How to Configure the MBAM 2.5 System Center Configuration Manager Integration](how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md)
            
+2. Install the MBAM Server software, and then configure the features you want.
 
-     
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            TaskWhere to get instructions
            Install the MBAM Server software on each server where you want to configure an MBAM Server feature.
            
+   
            
+   Note
            You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see Data-tier Applications.
            
+   
            
+   
            
 
-3.  On a client computer, do the following:
+   
            Installing the MBAM 2.5 Server Software
            Configure the Compliance and Audit Database and the Recovery Database.
            How to Configure the MBAM 2.5 Databases
            Configure the Reports feature.
            How to Configure the MBAM 2.5 Reports
            Configure the web applications.
            How to Configure the MBAM 2.5 Web Applications
            Configure the System Center Configuration Manager to install the Configuration Manager objects.
            How to Configure the MBAM 2.5 System Center Configuration Manager Integration
            
 
-    1.  Install the MBAM Client on a client computer.
 
-    2.  Apply the MBAM Group Policy Objects to the computer.
 
-    3.  Set the following registry keys to force the MBAM Client to wake up more quickly and at faster intervals:
+3. On a client computer, do the following:
 
-        ``` syntax
-        [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement
-        "ClientWakeupFrequency"=dword:00000001
-        "StatusReportingFrequency"=dword:00000001
-        ```
+   1.  Install the MBAM Client on a client computer.
 
-        ``` syntax
-        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
-        "NoStartupDelay"=dword:00000001
-        ```
+   2.  Apply the MBAM Group Policy Objects to the computer.
 
-        **Note**  
-        Because these keys wake up the MBAM Client every minute, we recommend that you use these registry key settings only in an evaluation environment.
+   3.  Set the following registry keys to force the MBAM Client to wake up more quickly and at faster intervals:
 
-         
+       ``` syntax
+       [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement
+       "ClientWakeupFrequency"=dword:00000001
+       "StatusReportingFrequency"=dword:00000001
+       ```
 
-    4.  Restart the **BitLocker Management Client Service**.
+       ``` syntax
+       [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
+       "NoStartupDelay"=dword:00000001
+       ```
 
-    5.  In Control Panel, open **Configuration Manager**, and then click the **Actions** tab.
+       **Note**  
+       Because these keys wake up the MBAM Client every minute, we recommend that you use these registry key settings only in an evaluation environment.
 
-    6.  Select **Machine Policy Retrieval & Evaluation Cycle**, and then click **Run Now** to apply the Group Policy Objects that are relevant to that client computer.
 
-    7.  Select **Hardware Inventory Cycle**, and then click **Run Now**. This step runs the hardware inventory by using the new classes that you imported to your .mof files and then sends the data to the Configuration Manager server.
 
-4.  In the Configuration Manager console, do the following:
+   4.  Restart the **BitLocker Management Client Service**.
 
-    1.  In the navigation pane, right-click **MBAM Supported Computers**, click **Update Membership**, and then click **Yes** to force the client computer to report its membership immediately.
+   5.  In Control Panel, open **Configuration Manager**, and then click the **Actions** tab.
 
-    2.  In the navigation pane, click **MBAM Supported Computers** to verify that the client computer appears in the collection.
+   6.  Select **Machine Policy Retrieval & Evaluation Cycle**, and then click **Run Now** to apply the Group Policy Objects that are relevant to that client computer.
 
-5.  On the client computer, in Control Panel, reopen **Configuration Manager** again, and do the following:
+   7.  Select **Hardware Inventory Cycle**, and then click **Run Now**. This step runs the hardware inventory by using the new classes that you imported to your .mof files and then sends the data to the Configuration Manager server.
 
-    1.  Click the **Actions** tab, and then rerun **Machine Policy Retrieval & Evaluation Cycle**.
+4. In the Configuration Manager console, do the following:
 
-    2.  Click the **Configurations** tab, select the BitLocker baseline, and click **Evaluate**.
+   1.  In the navigation pane, right-click **MBAM Supported Computers**, click **Update Membership**, and then click **Yes** to force the client computer to report its membership immediately.
 
-6.  In the Configuration Manager console, verify that the client computer appears on the Enterprise Compliance Report, as follows
+   2.  In the navigation pane, click **MBAM Supported Computers** to verify that the client computer appears in the collection.
 
-    1.  In the navigation pane, expand **Computer Management** > **Reporting** > **Reporting Services** > **<server name>MBAM**.
+5. On the client computer, in Control Panel, reopen **Configuration Manager** again, and do the following:
 
-    2.  Within the **MBAM** node, select the folder that represents the language in which you want to view reports, and then select the report from the results pane.
+   1.  Click the **Actions** tab, and then rerun **Machine Policy Retrieval & Evaluation Cycle**.
+
+   2.  Click the **Configurations** tab, select the BitLocker baseline, and click **Evaluate**.
+
+6. In the Configuration Manager console, verify that the client computer appears on the Enterprise Compliance Report, as follows
+
+   1.  In the navigation pane, expand **Computer Management** > **Reporting** > **Reporting Services** > **<server name>MBAM**.
+
+   2.  Within the **MBAM** node, select the folder that represents the language in which you want to view reports, and then select the report from the results pane.
 
 
 ## Related topics
@@ -401,7 +402,7 @@ To evaluate MBAM by using the Configuration Manager Integration topology, follow
 
 [Getting Started with MBAM 2.5](getting-started-with-mbam-25.md)
 
- 
+
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md b/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md
index 311409761a..9fe1680548 100644
--- a/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md
+++ b/mdop/mbam-v25/generating-mbam-25-stand-alone-reports.md
@@ -1,8 +1,11 @@
 ---
 title: Generating MBAM 2.5 Stand-alone Reports
 description: Generating MBAM 2.5 Stand-alone Reports
-author: jamiejdt
+author: dansimp
 ms.assetid: 0ec623ff-5155-4906-aef2-20cdc0f84667
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -29,7 +32,7 @@ For descriptions of the Stand-alone reports, see [Understanding MBAM 2.5 Stand-a
 **Note**  
 To run the reports, you must be a member of the **MBAM Report Users** group, which you configure in Active Directory Domain Services. For more information, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md).
 
- 
+ 
 
 **To open the Administration and Monitoring Website**
 
@@ -46,7 +49,7 @@ To run the reports, you must be a member of the **MBAM Report Users** group, whi
     **Note**  
     Configure SQL Server Reporting Services (SSRS) to use Secure Sockets Layer (SSL) before configuring the Administration and Monitoring Website. If, for any reason, SSRS is not configured to use SSL, the URL for the Reports will be set to HTTP instead of to HTTPS when you configure the Administration and Monitoring Website. If you then go to the Administration and Monitoring Website and select a report, the following message displays: “Only Secure Content is Displayed.” To show the report, click **Show All Content**.
 
-     
+     
 
 **To generate an Enterprise Compliance Report**
 
@@ -102,7 +105,7 @@ To run the reports, you must be a member of the **MBAM Report Users** group, whi
 
 [Understanding MBAM 2.5 Stand-alone Reports](understanding-mbam-25-stand-alone-reports.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/getting-started-with-mbam-25.md b/mdop/mbam-v25/getting-started-with-mbam-25.md
index a7ba39d226..27038fd66a 100644
--- a/mdop/mbam-v25/getting-started-with-mbam-25.md
+++ b/mdop/mbam-v25/getting-started-with-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Getting Started with MBAM 2.5
 description: Getting Started with MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 23d0cfbb-e2ef-4c34-bf29-1b7ab4c48f00
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -41,32 +44,32 @@ Before you start planning your MBAM deployment, review the following topics.
 
 
 
            High-level overview of MBAM 2.5 that describes how you can use it in your organization.
            
-
            [About MBAM 2.5](about-mbam-25.md)
            
+
            About MBAM 2.5
            
 
 
 
            Release notes, which lists known issues in the product.
            
-
            [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md)
            
+
            Release Notes for MBAM 2.5
            
 
 
 
            Information about how you can evaluate MBAM 2.5 in a test environment.
            
-
            [Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md)
            
+
            Evaluating MBAM 2.5 in a Test Environment
            
 
 
 
            Description of the MBAM 2.5 features and the recommended architecture of the Stand-alone and Configuration Manager Integration topologies in a production environment.
            
-
            [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md)
            
+
            High-Level Architecture for MBAM 2.5
            
 
 
 
            Description and illustration of each MBAM Server feature, without the recommended architecture.
            
-
            [Illustrated Features of an MBAM 2.5 Deployment](illustrated-features-of-an-mbam-25-deployment.md)
            
+
            Illustrated Features of an MBAM 2.5 Deployment
            
 
 
 
            Describes the keyboard shortcuts that are available for MBAM 2.5.
            
-
            [Accessibility for MBAM 2.5](accessibility-for-mbam-25.md)
            
+
            Accessibility for MBAM 2.5
            
 
 
 
 
- 
+ 
 
 ## How to get MDOP technologies
 
@@ -92,9 +95,9 @@ MBAM 2.5 is a part of the Microsoft Desktop Optimization Pack (MDOP). MDOP is pa
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md b/mdop/mbam-v25/hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md
index e91ed7e0c7..5ef9f09421 100644
--- a/mdop/mbam-v25/hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md
+++ b/mdop/mbam-v25/hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Hiding the Default BitLocker Drive Encryption Item in Control Panel
 description: Hiding the Default BitLocker Drive Encryption Item in Control Panel
-author: jamiejdt
+author: dansimp
 ms.assetid: 6e2a9a02-a809-43a1-80a3-1b03c7192c89
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ This topic describes how to hide the **BitLocker Drive Encryption** Control Pane
 **Note**  
 Microsoft BitLocker Administration and Monitoring (MBAM) creates an additional, custom Control Panel item, called **BitLocker Encryption Options**, which enables end users to manage their PIN and password, turn on BitLocker for a drive, and check encryption.
 
- 
+ 
 
 See [Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel](understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md) to read about:
 
@@ -30,7 +33,7 @@ See [Understanding the BitLocker Encryption Options and BitLocker Drive Encrypti
 **Important**  
 Do not change the Group Policy settings in the **BitLocker Drive Encryption** node. If you do, MBAM will not work correctly. When you configure the Group Policy settings in the **MDOP MBAM (BitLocker Management)** node, MBAM automatically configures the **BitLocker Drive Encryption** settings for you.
 
- 
+ 
 
 **To hide the default BitLocker Drive Encryption item in Control Panel**
 
@@ -49,7 +52,7 @@ Do not change the Group Policy settings in the **BitLocker Drive Encryption** no
 
 [Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/high-level-architecture-for-mbam-25.md b/mdop/mbam-v25/high-level-architecture-for-mbam-25.md
index 4b67d0891b..10db3f3710 100644
--- a/mdop/mbam-v25/high-level-architecture-for-mbam-25.md
+++ b/mdop/mbam-v25/high-level-architecture-for-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: High-Level Architecture for MBAM 2.5
 description: High-Level Architecture for MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: b42af25c-961b-4a6a-92d2-916a373eb68b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md b/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md
index 3e9aff0890..3f47fccbd0 100644
--- a/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md
+++ b/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md
@@ -1,14 +1,16 @@
 ---
 title: High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology
 description: High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology
-author: jamiejdt
+author: dansimp
 ms.assetid: 075bafa1-792b-4c24-9d8e-5d3153e2112c
+ms.reviewer: 
+manager: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
 ms.prod: w10
 ms.date: 08/23/2018
-ms.author: pashort
+ms.author: dansimp
 ---
 
 
@@ -21,7 +23,7 @@ For a list of the supported versions of the software mentioned in this topic, se
 **Important**  
 Windows To Go is not supported for the Configuration Manager Integration topology installation when you are using Configuration Manager 2007.
 
- 
+ 
 
 ## Recommended number of servers and supported number of clients
 
@@ -52,7 +54,7 @@ The recommended number of servers and supported number of clients in a productio
 
 
 
- 
+ 
 
 ## Differences between Configuration Manager Integration and stand-alone topologies
 
@@ -128,7 +130,7 @@ The **monitoring web services** are used by the MBAM Client and the websites to
 
 **Important**
            The Monitoring Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 since the MBAM websites communicate directly with the Recovery Database. 
 
- 
+ 
 
 ### Management workstation
 
@@ -140,7 +142,7 @@ The **monitoring web services** are used by the MBAM Client and the websites to
 
     **NOTE**
            The workstation does not have to be a dedicated computer.
 
-     
+     
 
 ### MBAM Client and Configuration Manager Client computer
 
@@ -158,7 +160,7 @@ The **MBAM Client**:
 
 The **Configuration Manager Client** enables Configuration Manager to collect hardware compatibility data about the client computers and report compliance information.
 
- 
+ 
 
 ## Differences in MBAM deployment for supported Configuration Manager versions
 
@@ -191,7 +193,7 @@ When you deploy MBAM with the Configuration Manager Integration topology, you ca
 
 
 
- 
+ 
 
 ## How MBAM works with Configuration Manager
 
@@ -271,7 +273,7 @@ The integration of MBAM with Configuration Manager is based on a configuration p
 
 
 
- 
+ 
 
 
 ## Related topics
@@ -283,9 +285,9 @@ The integration of MBAM with Configuration Manager is based on a configuration p
 
 [Illustrated Features of an MBAM 2.5 Deployment](illustrated-features-of-an-mbam-25-deployment.md)
 
- 
+ 
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-stand-alone-topology.md b/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-stand-alone-topology.md
index 1287ee6b02..48a70ddaaa 100644
--- a/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-stand-alone-topology.md
+++ b/mdop/mbam-v25/high-level-architecture-of-mbam-25-with-stand-alone-topology.md
@@ -1,8 +1,11 @@
 ---
 title: High-Level Architecture of MBAM 2.5 with Stand-alone Topology
 description: High-Level Architecture of MBAM 2.5 with Stand-alone Topology
-author: jamiejdt
+author: dansimp
 ms.assetid: 35f8c5f6-8be3-443d-baf0-56d68b08f3bc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -21,7 +24,7 @@ For a list of the supported versions of the software mentioned in this topic, se
 **Note**  
 We recommend you use a single-server architecture in test environments only.
 
- 
+ 
 
 ## Recommended number of servers and supported number of clients
 
@@ -52,7 +55,7 @@ The recommended number of servers and supported number of clients in a productio
 
 
 
- 
+ 
 
 ## Recommended MBAM high-level architecture with the Stand-alone topology
 
@@ -111,7 +114,7 @@ The **monitoring web services** are used by the MBAM Client and the websites to
 **Important**  
 The Monitoring Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 since the MBAM websites communicate directly with the Recovery Database.
 
- 
+ 
 
 Management workstation
 
@@ -146,7 +149,7 @@ The MBAM Client:
 
 [Illustrated Features of an MBAM 2.5 Deployment](illustrated-features-of-an-mbam-25-deployment.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md
index 151b5e2b55..1c818b89dc 100644
--- a/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md
+++ b/mdop/mbam-v25/how-to-configure-the-mbam-25-databases.md
@@ -1,8 +1,11 @@
 ---
 title: How to Configure the MBAM 2.5 Databases
 description: How to Configure the MBAM 2.5 Databases
-author: jamiejdt
+author: dansimp
 ms.assetid: 66e1c81b-f785-4398-9175-bb5f112c2a35
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -38,38 +41,37 @@ The instructions are based on the recommended architecture in [High-Level Archit
 
 
 
            Review the recommended architecture for MBAM.
            
-
            [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md)
            
+
            High-Level Architecture for MBAM 2.5
            
 
 
 
            Review the supported configurations for MBAM.
            
-
            [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)
            
+
            MBAM 2.5 Supported Configurations
            
 
 
 
            Complete the required prerequisites on each server.
            
 
 
 
 
            Install the MBAM Server software on each server where you plan to configure an MBAM Server feature.
            
 
            
-Note  
-
            You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see [Data-tier Applications](https://technet.microsoft.com/library/ee210546.aspx).
            
+Note
            You can install the databases to a remote SQL Server computer by using Windows PowerShell or an exported data-tier application (DAC) package. For more information about DAC packages, see Data-tier Applications.
            
 
            
 
            
- 
+
 
            
-
            [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md)
            
+
            Installing the MBAM 2.5 Server Software
            
 
 
 
            Review the prerequisites for using Windows PowerShell if you plan to use Windows PowerShell cmdlets to configure MBAM Server features.
            
-
            [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md)
            
+
            Configuring MBAM 2.5 Server Features by Using Windows PowerShell
            
 
 
 
 
- 
+
 
 **To configure the databases by using Windows PowerShell**
 
@@ -79,138 +81,134 @@ The instructions are based on the recommended architecture in [High-Level Archit
 
 **To configure the Compliance and Audit Database by using the wizard**
 
-1.  On the server where you want to configure the databases, start the **MBAM Server Configuration** wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard.
+1. On the server where you want to configure the databases, start the **MBAM Server Configuration** wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard.
 
-2.  Click **Add New Features**, select **Compliance and Audit Database** and **Recovery Database**, and then click **Next**. The wizard checks that all prerequisites for the databases have been met.
+2. Click **Add New Features**, select **Compliance and Audit Database** and **Recovery Database**, and then click **Next**. The wizard checks that all prerequisites for the databases have been met.
 
-3.  If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Check prerequisites again**.
+3. If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Check prerequisites again**.
 
-4.  Using the following descriptions, enter the field values in the wizard:
+4. Using the following descriptions, enter the field values in the wizard:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            FieldDescription
            SQL Server name
            Name of the server where you are configuring the Compliance and Audit Database.
            
-    
            
-    Note  
-    
            You must add an exception on the Compliance and Audit Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433.
            
-    
            
-    
            
-     
-    
            SQL Server database instance
            Name of the database instance where the compliance and audit data will be stored. You must also specify where the database information will be located.
            Database name
            Name of the database that will store the compliance data.
            
-    
            
-    Note  
-    
            If you are upgrading from a previous version of MBAM, you must use the same database name as the name that was used in your previous deployment.
            
-    
            
-    
            
-     
-    
            Read/write access domain user or group
            Domain user or group that has read/write permission to this database to enable the web applications to access the data and reports in this database.
            
-    
            If you enter a user in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page.
            
-    
            If you enter a group in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field.
            Read-only access domain user or group
            Name of the user or group that will have read-only permission to this database to enable the reports to access the compliance data in this database.
            
-    
            If you enter a user in this field, it must be the same user as the one you specify in the Compliance and Audit Database domain account field on the Configure Reports page.
            
-    
            If you enter a group in this field, the value that you specify in the Compliance and Audit Database domain account field on the Configure Reports page must be a member of the group that you specify in this field.
            
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            FieldDescription
            SQL Server name
            Name of the server where you are configuring the Compliance and Audit Database.
            
+   
            
+   Note
            You must add an exception on the Compliance and Audit Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433.
            
+   
            
+   
            
 
-     
+   
            SQL Server database instance
            Name of the database instance where the compliance and audit data will be stored. You must also specify where the database information will be located.
            Database name
            Name of the database that will store the compliance data.
            
+   
            
+   Note
            If you are upgrading from a previous version of MBAM, you must use the same database name as the name that was used in your previous deployment.
            
+   
            
+   
            
 
-5.  Continue to the next section to configure the Recovery Database.
+   
            Read/write access domain user or group
            Domain user or group that has read/write permission to this database to enable the web applications to access the data and reports in this database.
            
+   
            If you enter a user in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page.
            
+   
            If you enter a group in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field.
            Read-only access domain user or group
            Name of the user or group that will have read-only permission to this database to enable the reports to access the compliance data in this database.
            
+   
            If you enter a user in this field, it must be the same user as the one you specify in the Compliance and Audit Database domain account field on the Configure Reports page.
            
+   
            If you enter a group in this field, the value that you specify in the Compliance and Audit Database domain account field on the Configure Reports page must be a member of the group that you specify in this field.
            
+
+
+
+5. Continue to the next section to configure the Recovery Database.
 
 **To configure the Recovery Database by using the wizard**
 
-1.  Using the following descriptions, enter the field values in the wizard:
+1. Using the following descriptions, enter the field values in the wizard:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            FieldDescription
            SQL Server name
            Name of the server where you are configuring the Recovery Database.
            
-    
            
-    Note  
-    
            You must add an exception on the Recovery Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433.
            
-    
            
-    
            
-     
-    
            SQL Server database instance
            Name of the database instance where the recovery data will be stored. You must also specify where the database information will be located.
            Database name
            Name of the database that will store the recovery data.
            
-    
            
-    Note  
-    
            If you are upgrading from a previous version of MBAM, you must use the same database name as the name that was used in your previous deployment.
            
-    
            
-    
            
-     
-    
            Read/write access domain user or group
            Domain user or group that has read/write permission to this database to enable the web applications to access the data and reports in this database.
            
-    
            If you enter a user in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page.
            
-    
            If you enter a group in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field.
            
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            FieldDescription
            SQL Server name
            Name of the server where you are configuring the Recovery Database.
            
+   
            
+   Note
            You must add an exception on the Recovery Database computer to enable inbound traffic on the Microsoft SQL Server port. The default port number is 1433.
            
+   
            
+   
            
 
-     
+   
            SQL Server database instance
            Name of the database instance where the recovery data will be stored. You must also specify where the database information will be located.
            Database name
            Name of the database that will store the recovery data.
            
+   
            
+   Note
            If you are upgrading from a previous version of MBAM, you must use the same database name as the name that was used in your previous deployment.
            
+   
            
+   
            
 
-2.  When you finish your entries, click **Next**.
+   
            Read/write access domain user or group
            Domain user or group that has read/write permission to this database to enable the web applications to access the data and reports in this database.
            
+   
            If you enter a user in this field, it must be the same value as the value in the Web service application pool domain account field on the Configure Web Applications page.
            
+   
            If you enter a group in this field, the value in the Web service application pool domain account field on the Configure Web Applications page must be a member of the group you enter in this field.
            
 
-    The wizard checks that all prerequisites for the databases have been met.
 
-3.  If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Next** again.
 
-4.  On the **Summary** page, review the features that will be added.
+2. When you finish your entries, click **Next**.
 
-    **Note**  
-    To create a Windows PowerShell script of the entries that you just made, click **Export PowerShell Script**, and then save the script.
+   The wizard checks that all prerequisites for the databases have been met.
 
-     
+3. If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Next** again.
 
-5.  Click **Add** to add the MBAM databases on the server, and then click **Close**.
+4. On the **Summary** page, review the features that will be added.
+
+   **Note**  
+   To create a Windows PowerShell script of the entries that you just made, click **Export PowerShell Script**, and then save the script.
+
+
+
+5. Click **Add** to add the MBAM databases on the server, and then click **Close**.
 
 
 
@@ -227,11 +225,11 @@ The instructions are based on the recommended architecture in [High-Level Archit
 
 [Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md)
 
- 
+
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
-- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
+- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
 
 
 
diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-reports.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-reports.md
index 10ac435c9b..b76b25843c 100644
--- a/mdop/mbam-v25/how-to-configure-the-mbam-25-reports.md
+++ b/mdop/mbam-v25/how-to-configure-the-mbam-25-reports.md
@@ -1,8 +1,11 @@
 ---
 title: How to Configure the MBAM 2.5 Reports
 description: How to Configure the MBAM 2.5 Reports
-author: jamiejdt
+author: dansimp
 ms.assetid: ec462879-0253-4d9c-83c7-a9bcad479725
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -38,31 +41,31 @@ The instructions are based on the recommended architecture in [High-Level Archit
 
 
 
            Review the recommended architecture for MBAM.
            
-
            [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md)
            
+
            High-Level Architecture for MBAM 2.5
            
 
 
 
            Review the supported configurations for MBAM.
            
-
            [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)
            
+
            MBAM 2.5 Supported Configurations
            
 
 
 
            Complete the required prerequisites on each server.
            
 
 
 
 
            Install the MBAM Server software on each server where you plan to configure an MBAM Server feature.
            
-
            [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md)
            
+
            Installing the MBAM 2.5 Server Software
            
 
 
 
            Review the prerequisites for using Windows PowerShell if you plan to use Windows PowerShell cmdlets to configure MBAM Server features.
            
-
            [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md)
            
+
            Configuring MBAM 2.5 Server Features by Using Windows PowerShell
            
 
 
 
 
- 
+
 
 **To configure the Reports by using Windows PowerShell**
 
@@ -72,86 +75,84 @@ The instructions are based on the recommended architecture in [High-Level Archit
 
 **To configure the Reports by using the wizard**
 
-1.  On the server where you want to configure the Reports, start the **MBAM Server Configuration** wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard.
+1. On the server where you want to configure the Reports, start the **MBAM Server Configuration** wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard.
 
-2.  Click **Add New Features**, select **Reports**, and then click **Next**. The wizard checks that all prerequisites for the Reports have been met.
+2. Click **Add New Features**, select **Reports**, and then click **Next**. The wizard checks that all prerequisites for the Reports have been met.
 
-3.  Click **Next** to continue.
+3. Click **Next** to continue.
 
-4.  Using the following descriptions, enter the field values in the wizard:
+4. Using the following descriptions, enter the field values in the wizard:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            FieldDescription
            SQL Server Reporting Services instance
            Instance of SQL Server Reporting Services where the Reports will be configured.
            Reporting role domain group
            Name of the domain Users group whose members have rights to access the reports on the Administration and Monitoring Server.
            SQL Server name
            Name of the server where the Compliance and Audit Database is configured.
            SQL Server database instance
            Name of the instance of SQL Server (for example, MSSQLSERVER) where the Compliance and Audit Database is configured.
            
-    
            
-    Note  
-    
            You must add an exception on the Reports computer to enable inbound traffic on the port of the Reporting Server (the default port is 80).
            
-    
            
-    
            
-     
-    
            Database name
            Name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status, although you can change the name when you configure the Compliance and Audit Database.
            
-    
            
-    Note  
-    
            If you are upgrading from a previous version of MBAM, you must use the same database name as the name used in your previous deployment.
            
-    
            
-    
            
-     
-    
            Compliance and Audit Database domain account
            Domain user account and password to access the Compliance and Audit Database.
            
-    
            If the value you enter in the Read-only access domain user or group field on the Configure Databases page is a user, you must enter that same value in this field.
            
-    
            If the value that you enter in the Read-only access domain user or group field on the Configure Databases page is a group, the value that you enter in this field must be a member of that group.
            
-    
            Configure the password for this account to never expire. The user account should be able to access all data that is available to the MBAM Reports Users group.
            
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            FieldDescription
            SQL Server Reporting Services instance
            Instance of SQL Server Reporting Services where the Reports will be configured.
            Reporting role domain group
            Name of the domain Users group whose members have rights to access the reports on the Administration and Monitoring Server.
            SQL Server name
            Name of the server where the Compliance and Audit Database is configured.
            SQL Server database instance
            Name of the instance of SQL Server (for example, MSSQLSERVER) where the Compliance and Audit Database is configured.
            
+   
            
+   Note
            You must add an exception on the Reports computer to enable inbound traffic on the port of the Reporting Server (the default port is 80).
            
+   
            
+   
            
 
-     
+   
            Database name
            Name of the Compliance and Audit Database. By default, the database name is MBAM Compliance Status, although you can change the name when you configure the Compliance and Audit Database.
            
+   
            
+   Note
            If you are upgrading from a previous version of MBAM, you must use the same database name as the name used in your previous deployment.
            
+   
            
+   
            
 
-5.  When you finish your entries, click **Next**.
+   
            Compliance and Audit Database domain account
            Domain user account and password to access the Compliance and Audit Database.
            
+   
            If the value you enter in the Read-only access domain user or group field on the Configure Databases page is a user, you must enter that same value in this field.
            
+   
            If the value that you enter in the Read-only access domain user or group field on the Configure Databases page is a group, the value that you enter in this field must be a member of that group.
            
+   
            Configure the password for this account to never expire. The user account should be able to access all data that is available to the MBAM Reports Users group.
            
 
-    The wizard checks that all prerequisites for the Reports feature have been met.
 
-6.  Click **Next** to continue.
 
-7.  On the **Summary** page, review the features that will be added.
+5. When you finish your entries, click **Next**.
 
-    **Note**  
-    To create a Windows PowerShell script of the entries that you just made, click **Export PowerShell Script**, and then save the script.
+   The wizard checks that all prerequisites for the Reports feature have been met.
 
-     
+6. Click **Next** to continue.
 
-8.  Click **Add** to add the Reports on the server, and then click **Close**.
+7. On the **Summary** page, review the features that will be added.
+
+   **Note**  
+   To create a Windows PowerShell script of the entries that you just made, click **Export PowerShell Script**, and then save the script.
+
+
+
+8. Click **Add** to add the Reports on the server, and then click **Close**.
 
 
 
@@ -166,11 +167,11 @@ The instructions are based on the recommended architecture in [High-Level Archit
 
 [Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md)
 
- 
+
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+
 
 
 
diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md
index 596b57c08d..38766dc323 100644
--- a/mdop/mbam-v25/how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md
+++ b/mdop/mbam-v25/how-to-configure-the-mbam-25-system-center-configuration-manager-integration.md
@@ -1,8 +1,11 @@
 ---
 title: How to Configure the MBAM 2.5 System Center Configuration Manager Integration
 description: How to Configure the MBAM 2.5 System Center Configuration Manager Integration
-author: jamiejdt
+author: dansimp
 ms.assetid: 2b8a4c13-1dad-41e8-89ac-6889c5f7e051
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -40,38 +43,37 @@ The instructions are based on the recommended architecture in [High-Level Archit
 
 
 
            Review the recommended architecture for MBAM.
            
-
            [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md)
            
+
            High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology
            
 
 
 
            Review the supported configurations for MBAM.
            
-
            [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)
            
+
            MBAM 2.5 Supported Configurations
            
 
 
 
            Complete the required prerequisites on each server.
            
 
 
 
 
            Install the MBAM Server software on each server where you will configure an MBAM Server feature.
            
 
            
-Note  
-
            For this topology, you must install the Configuration Manager console on the computer where you are installing the MBAM Server software.
            
+Note
            For this topology, you must install the Configuration Manager console on the computer where you are installing the MBAM Server software.
            
 
            
 
            
- 
+
 
            
-
            [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md)
            
+
            Installing the MBAM 2.5 Server Software
            
 
 
 
            Review Windows PowerShell prerequisites (applicable only if you are going to use Windows PowerShell cmdlets to configure MBAM).
            
-
            [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md)
            
+
            Configuring MBAM 2.5 Server Features by Using Windows PowerShell
            
 
 
 
 
- 
+
 
 **To configure Configuration Manager Integration by using Windows PowerShell**
 
@@ -116,14 +118,14 @@ The instructions are based on the recommended architecture in [High-Level Archit
     
     
 
-     
+
 
 5.  On the **Summary** page, review the features that will be added.
 
-    **Note**  
+    **Note**  
     To create a Windows PowerShell script of the entries you just made, click **Export PowerShell Script** and save the script.
 
-     
+
 
 6.  Click **Add** to add the Configuration Manager Integration feature to the server, and then click **Close**.
 
@@ -136,11 +138,11 @@ The instructions are based on the recommended architecture in [High-Level Archit
 
 [Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md)
 
- 
+
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+
 
 
 
diff --git a/mdop/mbam-v25/how-to-configure-the-mbam-25-web-applications.md b/mdop/mbam-v25/how-to-configure-the-mbam-25-web-applications.md
index 144484a16f..dba8888b3b 100644
--- a/mdop/mbam-v25/how-to-configure-the-mbam-25-web-applications.md
+++ b/mdop/mbam-v25/how-to-configure-the-mbam-25-web-applications.md
@@ -1,8 +1,11 @@
 ---
 title: How to Configure the MBAM 2.5 Web Applications
 description: How to Configure the MBAM 2.5 Web Applications
-author: jamiejdt
+author: dansimp
 ms.assetid: 909bf2d3-028c-4ac1-9247-171532a1eeae
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -45,7 +48,7 @@ The web applications comprise the following websites and their corresponding web
 
 
 
- 
+
 
 **Before you start the configuration:**
 
@@ -63,49 +66,47 @@ The web applications comprise the following websites and their corresponding web
 
 
 
            Review the recommended architecture for MBAM.
            
-
            [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md)
            
+
            High-Level Architecture for MBAM 2.5
            
 
 
 
            Review the supported configurations for MBAM.
            
-
            [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)
            
+
            MBAM 2.5 Supported Configurations
            
 
 
 
            Complete the required prerequisites on each server.
            
 
            
-Note  
-
            Ensure that you configure SQL ServerReporting Services (SSRS) to use the Secure Sockets Layer (SSL) before you configure the Administration and Monitoring Website. Otherwise, the Reports feature will use HTTP instead of HTTPS.
            
+Note
            Ensure that you configure SQL ServerReporting Services (SSRS) to use the Secure Sockets Layer (SSL) before you configure the Administration and Monitoring Website. Otherwise, the Reports feature will use HTTP instead of HTTPS.
            
 
            
 
            
- 
+
 
            
 
 
 
 
            Register service principal names (SPNs) for the application pool account for the websites. You need to do this step only if you do not have administrative domain rights in Active Directory Domain Services (AD DS). If you do have these rights in AD DS, MBAM will create the SPNs for you.
            
-
            [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md#bkmk-regvirtualspn)
            
+
            Planning How to Secure the MBAM Websites
            
 
 
 
            Install the MBAM Server software on each server where you will configure an MBAM Server feature.
            
 
            
-Note  
-
            If you plan to install the websites on one server and the web services on another, you will be able to configure them only by using the Enable-MbamWebApplication Windows PowerShell cmdlet. The MBAM Server Configuration wizard does not support configuring these items on separate servers.
            
+Note
            If you plan to install the websites on one server and the web services on another, you will be able to configure them only by using the Enable-MbamWebApplication Windows PowerShell cmdlet. The MBAM Server Configuration wizard does not support configuring these items on separate servers.
            
 
            
 
            
- 
+
 
            
-
            [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md)
            
+
            Installing the MBAM 2.5 Server Software
            
 
 
 
            Review the prerequisites for using Windows PowerShell if you plan to use cmdlets to configure MBAM Server features.
            
-
            [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md)
            
+
            Configuring MBAM 2.5 Server Features by Using Windows PowerShell
            
 
 
 
 
- 
+
 
 **To configure the web applications by using Windows PowerShell**
 
@@ -115,71 +116,69 @@ The web applications comprise the following websites and their corresponding web
 
 **To configure the settings for all web applications using the wizard**
 
-1.  On the server where you want to configure the web applications, start the MBAM Server Configuration wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard.
+1. On the server where you want to configure the web applications, start the MBAM Server Configuration wizard. You can select **MBAM Server Configuration** from the **Start** menu to open the wizard.
 
-2.  Click **Add New Features**, select **Administration and Monitoring Website** and **Self-Service Portal**, and then click **Next**. The wizard checks that all prerequisites for the web applications have been met.
+2. Click **Add New Features**, select **Administration and Monitoring Website** and **Self-Service Portal**, and then click **Next**. The wizard checks that all prerequisites for the web applications have been met.
 
-3.  If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Check prerequisites again**.
+3. If the prerequisite check is successful, click **Next** to continue. Otherwise, resolve any missing prerequisites, and then click **Check prerequisites again**.
 
-4.  Use the following descriptions to enter the field values in the wizard.
+4. Use the following descriptions to enter the field values in the wizard.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            FieldDescription
            Security certificate
            Select a previously created certificate to optionally encrypt the communication between the web services and the server on which you are configuring the websites. If you choose Do not use a certificate, your web communication may not be secure.
            Host name
            Name of the host computer where you are configuring the websites.
            Installation path
            Path where you are installing the websites.
            Port
            Port number to use for website and service communication.
            
-    
            
-    Note  
-    
            You must set a firewall exception to enable communication through the specified port.
            
-    
            
-    
            
-     
-    
            Web service application pool domain account and password
            Domain user account and password for the web service application pool.
            
-    
            If you enter a user name in the Read/write access domain user or group field on the Configure Databases page, you must enter that same value in this field.
            
-    
            If you enter a group name in the Read/write access domain user or group field on the Configure Databases page, the value you enter in this field must be a member of that group.
            
-    
            If you do not specify credentials, the credentials that were specified for any previously enabled web application will be used. All web applications must use the same application pool credentials. If you specify different credentials for different web applications, the most recently specified value will be used.
            
-    
            
-    Important  
-    
            For improved security, set the account that is specified in the credentials to have limited user rights. Also, set the password of the account to never expire.
            
-    
            
-    
            
-     
-    
            
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            FieldDescription
            Security certificate
            Select a previously created certificate to optionally encrypt the communication between the web services and the server on which you are configuring the websites. If you choose Do not use a certificate, your web communication may not be secure.
            Host name
            Name of the host computer where you are configuring the websites.
            Installation path
            Path where you are installing the websites.
            Port
            Port number to use for website and service communication.
            
+   
            
+   Note
            You must set a firewall exception to enable communication through the specified port.
            
+   
            
+   
            
 
-     
+   
            Web service application pool domain account and password
            Domain user account and password for the web service application pool.
            
+   
            If you enter a user name in the Read/write access domain user or group field on the Configure Databases page, you must enter that same value in this field.
            
+   
            If you enter a group name in the Read/write access domain user or group field on the Configure Databases page, the value you enter in this field must be a member of that group.
            
+   
            If you do not specify credentials, the credentials that were specified for any previously enabled web application will be used. All web applications must use the same application pool credentials. If you specify different credentials for different web applications, the most recently specified value will be used.
            
+   
            
+   Important
            For improved security, set the account that is specified in the credentials to have limited user rights. Also, set the password of the account to never expire.
            
+   
            
+   
            
 
-5.  Verify that the built-in IIS\_IUSRS account or the application pool account has been added to the **Impersonate a client after authentication** and the **Log on as a batch job** local security settings.
+   
            
 
-    To check whether it has been added to the local security settings, open the **Local Security Policy editor**, expand the **Local Policies** node, click the **User Rights Assignment** node, and double-click **Impersonate a client after authentication** and **Log on as a batch job** policies in the right pane.
+
+
+5. Verify that the built-in IIS\_IUSRS account or the application pool account has been added to the **Impersonate a client after authentication** and the **Log on as a batch job** local security settings.
+
+   To check whether it has been added to the local security settings, open the **Local Security Policy editor**, expand the **Local Policies** node, click the **User Rights Assignment** node, and double-click **Impersonate a client after authentication** and **Log on as a batch job** policies in the right pane.
 
 **To configure connection information for the databases by using the wizard**
 
@@ -212,7 +211,7 @@ The web applications comprise the following websites and their corresponding web
     
     
 
-     
+
 
 2.  Use the following field descriptions to configure the connection information in the wizard for the Recovery Database.
 
@@ -243,157 +242,157 @@ The web applications comprise the following websites and their corresponding web
     
     
 
-     
+
 
 **To configure the web applications by using the wizard**
 
-1.  Use the following descriptions to enter the field values in the wizard to configure the Administration and Monitoring Website.
+1. Use the following descriptions to enter the field values in the wizard to configure the Administration and Monitoring Website.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            FieldDescription
            Advanced Helpdesk role domain group
            Domain user group whose members have access to all areas of the Administration and Monitoring Website except the Reports area.
            Helpdesk role domain group
            Domain user group whose members have access to the Manage TPM and Drive Recovery areas of the Administration and Monitoring Website.
            Use System Center Configuration Manager Integration
            Select this check box if you are configuring MBAM with the Configuration Manager Integration topology. Selecting this check box makes all reports, except the Recovery Audit report, appear in Configuration Manager instead of in the Administration and Monitoring Website.
            Reporting role domain group
            Domain user group whose members have read-only access to the Reports area of the Administration and Monitoring Website.
            SQL Server Reporting Services URL
            URL for the SSRS server where the MBAM Reports are configured.
            
-    
            Examples of report URLs:
            
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            Type of host nameExample
            Example with a fully qualified domain name
            https://MyReportServer.Contoso.com/ReportServer
            Example with a custom host name
            https://MyReportServer/ReportServer
            
-    
             
            Virtual directory
            Virtual directory of the Administration and Monitoring Website. This name corresponds to the website’s physical directory on the server and is appended to the website’s host name, for example:
            
-    
            http(s)://<hostname>:<port>/HelpDesk/
            
-    
            If you do not specify a virtual directory, the value HelpDesk will be used.
            Data Migration role domain group (optional)
            Domain user group whose members have access to use the Write-Mbam*Information Cmdlets to write recovery information via this endpoint.
            
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            FieldDescription
            Advanced Helpdesk role domain group
            Domain user group whose members have access to all areas of the Administration and Monitoring Website except the Reports area.
            Helpdesk role domain group
            Domain user group whose members have access to the Manage TPM and Drive Recovery areas of the Administration and Monitoring Website.
            Use System Center Configuration Manager Integration
            Select this check box if you are configuring MBAM with the Configuration Manager Integration topology. Selecting this check box makes all reports, except the Recovery Audit report, appear in Configuration Manager instead of in the Administration and Monitoring Website.
            Reporting role domain group
            Domain user group whose members have read-only access to the Reports area of the Administration and Monitoring Website.
            SQL Server Reporting Services URL
            URL for the SSRS server where the MBAM Reports are configured.
            
+   
            Examples of report URLs:
            
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            Type of host nameExample
            Example with a fully qualified domain name
            https://MyReportServer.Contoso.com/ReportServer
            Example with a custom host name
            https://MyReportServer/ReportServer
            
+   
             
            Virtual directory
            Virtual directory of the Administration and Monitoring Website. This name corresponds to the website’s physical directory on the server and is appended to the website’s host name, for example:
            
+   
            http(s)://<hostname>:<port>/HelpDesk/
            
+   
            If you do not specify a virtual directory, the value HelpDesk will be used.
            Data Migration role domain group (optional)
            Domain user group whose members have access to use the Write-Mbam*Information Cmdlets to write recovery information via this endpoint.
            
 
-     
 
-2.  Use the following description to enter the field values in the wizard to configure the Self-Service Portal.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            FieldDescription
            Virtual directory
            Virtual directory of the web application. This name corresponds to the website’s physical directory on the server, and is appended to the website’s host name, for example:
            
-    
            http(s)://<hostname>:<port>/SelfService/
            
-    
            If you do not specify a virtual directory, the value SelfService will be used.
            Company name
            Specify a company name for the Self-Service Portal, for example:
            
-    
            Contoso IT
            
-    
            This company name is viewed by all Self-Service Portal users.
            Helpdesk URL text
            Specify a text statement that directs users to your organization's Helpdesk website, for example:
            
-    
            Contact Helpdesk or IT department
            Helpdesk URL
            Specify the URL for your organization's Helpdesk website, for example:
            
-    
            http(s)://<companyHelpdeskURL>/
            Notice text file
            Select a file that contains the notice you want displayed to users on the Self-Service Portal landing page.
            Do not display notice text to users
            Select this check box to specify that the notice text is not displayed to users.
            
+2. Use the following description to enter the field values in the wizard to configure the Self-Service Portal.
 
-     
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
            



            FieldDescription
            Virtual directory
            Virtual directory of the web application. This name corresponds to the website’s physical directory on the server, and is appended to the website’s host name, for example:
            
+   
            http(s)://<hostname>:<port>/SelfService/
            
+   
            If you do not specify a virtual directory, the value SelfService will be used.
            Company name
            Specify a company name for the Self-Service Portal, for example:
            
+   
            Contoso IT
            
+   
            This company name is viewed by all Self-Service Portal users.
            Helpdesk URL text
            Specify a text statement that directs users to your organization's Helpdesk website, for example:
            
+   
            Contact Helpdesk or IT department
            Helpdesk URL
            Specify the URL for your organization's Helpdesk website, for example:
            
+   
            http(s)://<companyHelpdeskURL>/
            Notice text file
            Select a file that contains the notice you want displayed to users on the Self-Service Portal landing page.
            Do not display notice text to users
            Select this check box to specify that the notice text is not displayed to users.
            
 
-3.  When you finish your entries, click **Next**.
 
-    The wizard checks that all prerequisites for the web applications have been met.
 
-4.  Click **Next** to continue.
+3. When you finish your entries, click **Next**.
 
-5.  On the **Summary** page, review the features that will be added.
+   The wizard checks that all prerequisites for the web applications have been met.
 
-    **Note**  
-    To create a Windows PowerShell script for the entries you made, click **Export PowerShell Script** and save the script.
+4. Click **Next** to continue.
 
-     
+5. On the **Summary** page, review the features that will be added.
 
-6.  Click **Add** to add the web applications to the server, and then click **Close**.
+   **Note**  
+   To create a Windows PowerShell script for the entries you made, click **Export PowerShell Script** and save the script.
 
-    To customize the Self-Service Portal by adding custom notice text, your company name, pointers to more information, and so on, see [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md).
+
+
+6. Click **Add** to add the web applications to the server, and then click **Close**.
+
+   To customize the Self-Service Portal by adding custom notice text, your company name, pointers to more information, and so on, see [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md).
 
 **To configure the Self-Service Portal if client computers cannot access the CDN**
 
 1.  Determine whether you are running Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1. If so, do nothing. Your Self-Service Portal configuration is complete.
 
-    **Note**  
+    **Note**  
     Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 installs the JavaScript files in setup, and so does not need to be connected to the Microsoft Ajax Content Delivery Network in order to configure the Self-Service Portal. The following steps are necessary only if you are using a version of Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 previous to SP1.
 
-     
+
 
 2.  Determine if your client computers have access to the Microsoft Ajax Content Delivery Network (CDN).
 
@@ -419,11 +418,11 @@ The web applications comprise the following websites and their corresponding web
 
 [Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md)
 
- 
+
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
-- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
+- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
 
 
 
diff --git a/mdop/mbam-v25/how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md b/mdop/mbam-v25/how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md
index 95f7fcdc46..c187bc1e3c 100644
--- a/mdop/mbam-v25/how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md
+++ b/mdop/mbam-v25/how-to-configure-the-self-service-portal-when-client-computers-cannot-access-the-microsoft-content-delivery-network.md
@@ -1,8 +1,11 @@
 ---
 title: How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network
 description: How to Configure the Self-Service Portal When Client Computers Cannot Access the Microsoft Content Delivery Network
-author: jamiejdt
+author: dansimp
 ms.assetid: 90ee76db-9876-41b5-994a-118556d5ed3b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -23,38 +26,38 @@ Your client computers need access to the CDN, which gives the Self-Service Porta
 **Note**  
 In MBAM 2.5 SP1, the JavaScript files are included in the product, and you do not need to follow the instructions in this section to configure the SSP to support clients that cannot access the internet.
 
- 
+ 
 
 **How to configure the Self-Service Portal when client computers cannot access the CDN**
 
-1.  Download the following JavaScript files from the CDN:
+1. Download the following JavaScript files from the CDN:
 
-    -   [jQuery-1.10.2.min.js](https://go.microsoft.com/fwlink/?LinkID=390515)
+   -   [jQuery-1.10.2.min.js](https://go.microsoft.com/fwlink/?LinkID=390515)
 
-    -   [jQuery.validate.min.js](https://go.microsoft.com/fwlink/?LinkID=390516)
+   -   [jQuery.validate.min.js](https://go.microsoft.com/fwlink/?LinkID=390516)
 
-    -   [jQuery.validate.unobtrusive.min.js](https://go.microsoft.com/fwlink/?LinkID=390517)
+   -   [jQuery.validate.unobtrusive.min.js](https://go.microsoft.com/fwlink/?LinkID=390517)
 
-2.  Copy the JavaScript files to the **Scripts** directory of the Self-Service Portal. This directory is located in *<MBAM Self-Service Install Directory>\\*Self Service Website\\Scripts.
+2. Copy the JavaScript files to the **Scripts** directory of the Self-Service Portal. This directory is located in <MBAM Self-Service Install Directory>\\Self Service Website\\Scripts.
 
-3.  Open Internet Information Services (IIS) Manager.
+3. Open Internet Information Services (IIS) Manager.
 
-4.  Expand **Sites** > **Microsoft BitLocker Administration and Monitoring**, and highlight **SelfService**.
+4. Expand **Sites** > **Microsoft BitLocker Administration and Monitoring**, and highlight **SelfService**.
 
-    **Note**  
-    *SelfService* is the default virtual directory name. If you chose a different name for this directory during the configuration, remember to replace *SelfService* in these instructions with the name you chose.
+   **Note**  
+   *SelfService* is the default virtual directory name. If you chose a different name for this directory during the configuration, remember to replace *SelfService* in these instructions with the name you chose.
 
-     
+     
 
-5.  In the middle pane, double-click **Application Settings**.
+5. In the middle pane, double-click **Application Settings**.
 
-6.  For each item in the following list, edit the application settings to reference the new location by replacing /<*virtual directory*>/ with /SelfService/ (or whatever name you chose during configuration). For example, the virtual directory path will be similar to /selfservice/Scripts/ jQuery-1.10.2.min.js.
+6. For each item in the following list, edit the application settings to reference the new location by replacing /<*virtual directory*>/ with /SelfService/ (or whatever name you chose during configuration). For example, the virtual directory path will be similar to /selfservice/Scripts/ jQuery-1.10.2.min.js.
 
-    -   jQueryPath: /<*virtual directory*>/Scripts/jQuery-1.10.2.min.js
+   -   jQueryPath: /<*virtual directory*>/Scripts/jQuery-1.10.2.min.js
 
-    -   jQueryValidatePath: /<*virtual directory*>/Scripts/jQuery.validate.min.js
+   -   jQueryValidatePath: /<*virtual directory*>/Scripts/jQuery.validate.min.js
 
-    -   jQueryValidateUnobtrusivePath: /<*virtual directory*>/Scripts/jQuery.validate.unobtrusive.min.js
+   -   jQueryValidateUnobtrusivePath: /<*virtual directory*>/Scripts/jQuery.validate.unobtrusive.min.js
 
 
 
@@ -63,7 +66,7 @@ In MBAM 2.5 SP1, the JavaScript files are included in the product, and you do no
 
 [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/how-to-deploy-the-mbam-client-by-using-a-command-line.md b/mdop/mbam-v25/how-to-deploy-the-mbam-client-by-using-a-command-line.md
index 7cea28e8c8..27bfffcf2d 100644
--- a/mdop/mbam-v25/how-to-deploy-the-mbam-client-by-using-a-command-line.md
+++ b/mdop/mbam-v25/how-to-deploy-the-mbam-client-by-using-a-command-line.md
@@ -1,8 +1,11 @@
 ---
 title: How to Deploy the MBAM Client by Using a Command Line
 description: How to Deploy the MBAM Client by Using a Command Line
-author: jamiejdt
+author: dansimp
 ms.assetid: ac1d4ffe-c26d-41c9-9737-a4f2b37fde24
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -26,7 +29,7 @@ Type the following command at the command prompt to automatically accept the end
 **Note**  
 The **/ju** and **/jm** command-line options are not supported and cannot be used to install the MBAM Client software.
 
- 
+ 
 
 Type the following command at the command prompt to extract and install the MSP:
 
@@ -39,7 +42,7 @@ Then, install the MSI silently by running the following command:
 **Note**  
 Beginning in MBAM 2.5 SP1, a separate MSI is no longer included with the MBAM product. However, you can extract the MSI from the executable file (.exe) that is included with the product, after accepting the EULA.
 
- 
+ 
 
 ## OPTIN\_FOR\_MICROSOFT\_UPDATES=1 command-line option
 
@@ -71,7 +74,7 @@ You can use this command-line option with either of the following installation m
 
 
 
- 
+ 
 
 
 ## Related topics
@@ -79,9 +82,9 @@ You can use this command-line option with either of the following installation m
 
 [Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md)
 
- 
+ 
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md b/mdop/mbam-v25/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md
index 9e9d2160e5..04cb113b89 100644
--- a/mdop/mbam-v25/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md
+++ b/mdop/mbam-v25/how-to-deploy-the-mbam-client-to-desktop-or-laptop-computers-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: How to Deploy the MBAM Client to Desktop or Laptop Computers
 description: How to Deploy the MBAM Client to Desktop or Laptop Computers
-author: jamiejdt
+author: dansimp
 ms.assetid: 3a7639e0-468e-4496-8be2-ed29b8e07c53
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -33,7 +36,7 @@ Before you start the MBAM Client deployment, review the [MBAM 2.5 Supported Conf
     **Important**  
     The MBAM Client does not start BitLocker Drive Encryption actions if a remote desktop protocol connection is active. All remote console connections must be closed and a user must be logged on to a physical console session before BitLocker Drive Encryption begins.
 
-     
+     
 
 
 ## Related topics
@@ -41,7 +44,7 @@ Before you start the MBAM Client deployment, review the [MBAM 2.5 Supported Conf
 
 [Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md b/mdop/mbam-v25/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md
index b7434dc064..58fc45a61e 100644
--- a/mdop/mbam-v25/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md
+++ b/mdop/mbam-v25/how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: How to Determine BitLocker Encryption State of Lost Computers
 description: How to Determine BitLocker Encryption State of Lost Computers
-author: jamiejdt
+author: dansimp
 ms.assetid: 4f4bec1b-df3e-40ee-b431-291440268d64
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -25,7 +28,7 @@ To complete this task, you need access to the **Reports** area of the Administra
 **Note**  
 Device compliance is determined by the BitLocker policies that your enterprise has deployed. You may want to verify your deployed policies before you try to determine the BitLocker encryption state of a device.
 
- 
+ 
 
 **To determine the last known BitLocker encryption state of lost computers**
 
@@ -46,11 +49,11 @@ Device compliance is determined by the BitLocker policies that your enterprise h
 
 [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md)
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md b/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md
index 7c9ec9ded2..1eacd30123 100644
--- a/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md
+++ b/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: How to Enable BitLocker by Using MBAM as Part of a Windows Deployment
 description: How to Enable BitLocker by Using MBAM as Part of a Windows Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 7609ad7a-bb06-47be-b186-0a2db787c8a5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -14,7 +17,7 @@ ms.date: 04/23/2017
 # How to Enable BitLocker by Using MBAM as Part of a Windows Deployment
 
 
-This topic explains how to enable BitLocker on an end user's computer by using MBAM as part of your Windows imaging and deployment process. If you see a black screen at restart (after Install phase concludes) indicating that the drive cannot be unlocked, see [Windows versions prior Windows 10 build 1511 fail to start after "Setup Windows and Configuration Manager" step when Pre-Provision BitLocker is used with Windows PE 10.0.586.0 (1511)](https://blogs.technet.microsoft.com/system_center_configuration_manager_operating_system_deployment_support_blog/2016/03/30/windows-versions-prior-windows-10-build-1511-fail-to-start-after-setup-windows-and-configuration-manager-step-when-pre-provision-bitlocker-is-used-with-windows-pe-10-0-586-0-1511/).
+This topic explains how to enable BitLocker on an end user's computer by using MBAM as part of your Windows imaging and deployment process. If you see a black screen at restart (after Install phase concludes) indicating that the drive cannot be unlocked, see [Earlier Windows versions don't start after "Setup Windows and Configuration Manager" step if Pre-Provision BitLocker is used with Windows 10, version 1511](https://support.microsoft.com/en-us/help/4494799/earlier-windows-versions-don-t-start-after-you-use-pre-provision-bitlo).
 
 **Prerequisites:**
 
@@ -30,34 +33,34 @@ This topic explains how to enable BitLocker on an end user's computer by using M
 
 **To enable BitLocker using MBAM 2.5 SP1 as part of a Windows deployment**
 
-1.  In MBAM 2.5 SP1, the recommended approach to enable BitLocker during a Windows Deployment is by using the `Invoke-MbamClientDeployment.ps1` PowerShell script.
+1. In MBAM 2.5 SP1, the recommended approach to enable BitLocker during a Windows Deployment is by using the `Invoke-MbamClientDeployment.ps1` PowerShell script.
 
-    -   The `Invoke-MbamClientDeployment.ps1` script enacts BitLocker during the imaging process. When required by BitLocker policy, the MBAM agent immediately prompts the domain user to create a PIN or password when the domain user first logs on after imaging.
+   -   The `Invoke-MbamClientDeployment.ps1` script enacts BitLocker during the imaging process. When required by BitLocker policy, the MBAM agent immediately prompts the domain user to create a PIN or password when the domain user first logs on after imaging.
 
-    -   Easy to use with MDT, System Center Configuration Manager, or standalone imaging processes
+   -   Easy to use with MDT, System Center Configuration Manager, or standalone imaging processes
 
-    -   Compatible with PowerShell 2.0 or higher
+   -   Compatible with PowerShell 2.0 or higher
 
-    -   Encrypt OS volume with TPM key protector
+   -   Encrypt OS volume with TPM key protector
 
-    -   Fully support BitLocker pre-provisioning
+   -   Fully support BitLocker pre-provisioning
 
-    -   Optionally encrypt FDDs
+   -   Optionally encrypt FDDs
 
-    -   Escrow TPM OwnerAuth
-    For Windows 7, MBAM must own the TPM for escrow to occur.
-    For Windows 8.1, Windows 10 RTM and Windows 10 version 1511, escrow of TPM OwnerAuth is supported.
-    For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/en-us/windows/security/hardware-protection/tpm/change-the-tpm-owner-password) for further details.
+   -   Escrow TPM OwnerAuth
+   For Windows 7, MBAM must own the TPM for escrow to occur.
+   For Windows 8.1, Windows 10 RTM and Windows 10 version 1511, escrow of TPM OwnerAuth is supported.
+   For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/hardware-protection/tpm/change-the-tpm-owner-password) for further details.
 
-    -   Escrow recovery keys and recovery key packages
+   -   Escrow recovery keys and recovery key packages
 
-    -   Report encryption status immediately
+   -   Report encryption status immediately
 
-    -   New WMI providers
+   -   New WMI providers
 
-    -   Detailed logging
+   -   Detailed logging
 
-    -   Robust error handling
+   -   Robust error handling
 
    You can download the `Invoke-MbamClientDeployment.ps1` script from [Microsoft.com Download Center](https://www.microsoft.com/download/details.aspx?id=54439). This is the main script that your deployment system will call to configure BitLocker drive encryption and record recovery keys with the MBAM Server.
 
@@ -66,7 +69,7 @@ This topic explains how to enable BitLocker on an end user's computer by using M
    **MBAM\_Machine WMI Class**
    **PrepareTpmAndEscrowOwnerAuth:** Reads the TPM OwnerAuth and sends it to the MBAM recovery database by using the MBAM recovery service. If the TPM is not owned and auto-provisioning is not on, it generates a TPM OwnerAuth and takes ownership. If it fails, an error code is returned for troubleshooting.
 
-   **Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/en-us/windows/security/hardware-protection/tpm/change-the-tpm-owner-password) for further details.
+   **Note** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/hardware-protection/tpm/change-the-tpm-owner-password) for further details.
 
 | Parameter | Description |
 | -------- | ----------- |
@@ -128,127 +131,127 @@ Here are a list of common error messages:
    | **WS_E_ENDPOINT_UNREACHABLE**
            2151481360 (0x803D0010) | The remote endpoint was not reachable. |
    | **WS_E_ENDPOINT_FAULT_RECEIVED**
            2151481363 (0x803D0013) | A message containing a fault was received from the remote endpoint. Make sure you are connecting to the correct service endpoint. |
    | **WS_E_INVALID_ENDPOINT_URL**
            2151481376 (0x803D0020) | The endpoint address URL is not valid. The URL must start with “http” or “https”. |
-     
+     
 
-2.  **Deploy MBAM by using Microsoft Deployment Toolkit (MDT) and PowerShell**
+2. **Deploy MBAM by using Microsoft Deployment Toolkit (MDT) and PowerShell**
 
-    1.  In MDT, create a new deployment share or open an existing deployment share.
+   1.  In MDT, create a new deployment share or open an existing deployment share.
 
-        **Note**  
-        The `Invoke-MbamClientDeployment.ps1` PowerShell script can be used with any imaging process or tool. This section shows how to integrate it by using MDT, but the steps are similar to integrating it with any other process or tool.
+       **Note**  
+       The `Invoke-MbamClientDeployment.ps1` PowerShell script can be used with any imaging process or tool. This section shows how to integrate it by using MDT, but the steps are similar to integrating it with any other process or tool.
 
-        **Caution**  
-        If you are using BitLocker pre-provisioning (WinPE) and want to maintain the TPM owner authorization value, you must add the `SaveWinPETpmOwnerAuth.wsf` script in WinPE immediately before the installation reboots into the full operating system. **If you do not use this script, you will lose the TPM owner authorization value on reboot.**
+       **Caution**  
+       If you are using BitLocker pre-provisioning (WinPE) and want to maintain the TPM owner authorization value, you must add the `SaveWinPETpmOwnerAuth.wsf` script in WinPE immediately before the installation reboots into the full operating system. **If you do not use this script, you will lose the TPM owner authorization value on reboot.**
 
-    2.  Copy `Invoke-MbamClientDeployment.ps1` to **<DeploymentShare>\\Scripts**. If you are using pre-provisioning, copy the `SaveWinPETpmOwnerAuth.wsf` file into **<DeploymentShare>\\Scripts**.
+   2.  Copy `Invoke-MbamClientDeployment.ps1` to **<DeploymentShare>\\Scripts**. If you are using pre-provisioning, copy the `SaveWinPETpmOwnerAuth.wsf` file into **<DeploymentShare>\\Scripts**.
 
-    3.  Add the MBAM 2.5 SP1 client application to the Applications node in the deployment share.
+   3.  Add the MBAM 2.5 SP1 client application to the Applications node in the deployment share.
 
-        1.  Under the **Applications** node, click **New Application**.
+       1.  Under the **Applications** node, click **New Application**.
 
-        2.  Select **Application with Source Files**. Click **Next**.
+       2.  Select **Application with Source Files**. Click **Next**.
 
-        3.  In **Application Name**, type “MBAM 2.5 SP1 Client”. Click **Next**.
+       3.  In **Application Name**, type “MBAM 2.5 SP1 Client”. Click **Next**.
 
-        4.  Browse to the directory containing `MBAMClientSetup-.msi`. Click **Next**.
+       4.  Browse to the directory containing `MBAMClientSetup-.msi`. Click **Next**.
 
-        5.  Type “MBAM 2.5 SP1 Client” as the directory to create. Click **Next**.
+       5.  Type “MBAM 2.5 SP1 Client” as the directory to create. Click **Next**.
 
-        6.  Enter `msiexec /i MBAMClientSetup-.msi /quiet` at the command line. Click **Next**.
+       6.  Enter `msiexec /i MBAMClientSetup-.msi /quiet` at the command line. Click **Next**.
 
-        7.  Accept the remaining defaults to complete the New Application wizard.
+       7.  Accept the remaining defaults to complete the New Application wizard.
 
-    4.  In MDT, right-click the name of the deployment share and click **Properties**. Click the **Rules** tab. Add the following lines:
+   4.  In MDT, right-click the name of the deployment share and click **Properties**. Click the **Rules** tab. Add the following lines:
 
-        `SkipBitLocker=YES``BDEInstall=TPM``BDEInstallSuppress=NO``BDEWaitForEncryption=YES`
+       `SkipBitLocker=YES``BDEInstall=TPM``BDEInstallSuppress=NO``BDEWaitForEncryption=YES`
 
-        Click OK to close the window.
+       Click OK to close the window.
 
-    5.  Under the Task Sequences node, edit an existing task sequence used for Windows Deployment. If you want, you can create a new task sequence by right-clicking the **Task Sequences** node, selecting **New Task Sequence**, and completing the wizard.
+   5.  Under the Task Sequences node, edit an existing task sequence used for Windows Deployment. If you want, you can create a new task sequence by right-clicking the **Task Sequences** node, selecting **New Task Sequence**, and completing the wizard.
 
-        On the **Task Sequence** tab of the selected task sequence, perform these steps:
+       On the **Task Sequence** tab of the selected task sequence, perform these steps:
 
-        1.  Under the **Preinstall** folder, enable the optional task **Enable BitLocker (Offline)** if you want BitLocker enabled in WinPE, which encrypts used space only.
+       1.  Under the **Preinstall** folder, enable the optional task **Enable BitLocker (Offline)** if you want BitLocker enabled in WinPE, which encrypts used space only.
 
-        2.  To persist TPM OwnerAuth when using pre-provisioning, allowing MBAM to escrow it later, do the following:
+       2.  To persist TPM OwnerAuth when using pre-provisioning, allowing MBAM to escrow it later, do the following:
 
-            1.  Find the **Install Operating System** step
+           1.  Find the **Install Operating System** step
 
-            2.  Add a new **Run Command Line** step after it
+           2.  Add a new **Run Command Line** step after it
 
-            3.  Name the step **Persist TPM OwnerAuth**
+           3.  Name the step **Persist TPM OwnerAuth**
 
-            4.  Set the command line to `cscript.exe "%SCRIPTROOT%/SaveWinPETpmOwnerAuth.wsf"`
-            **Note:** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/en-us/windows/security/hardware-protection/tpm/change-the-tpm-owner-password) for further details.
+           4.  Set the command line to `cscript.exe "%SCRIPTROOT%/SaveWinPETpmOwnerAuth.wsf"`
+           **Note:** For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM. See [TPM owner password](https://docs.microsoft.com/windows/security/hardware-protection/tpm/change-the-tpm-owner-password) for further details.
 
-        3.  In the **State Restore** folder, delete the **Enable BitLocker** task.
+       3.  In the **State Restore** folder, delete the **Enable BitLocker** task.
 
-        4.  In the **State Restore** folder under **Custom Tasks**, create a new **Install Application** task and name it **Install MBAM Agent**. Click the **Install Single Application** radio button and browse to the MBAM 2.5 SP1 client application created earlier.
+       4.  In the **State Restore** folder under **Custom Tasks**, create a new **Install Application** task and name it **Install MBAM Agent**. Click the **Install Single Application** radio button and browse to the MBAM 2.5 SP1 client application created earlier.
 
-        5.  In the **State Restore** folder under **Custom Tasks**, create a new **Run PowerShell Script** task (after the MBAM 2.5 SP1 Client application step) with the following settings (update the parameters as appropriate for your environment):
+       5.  In the **State Restore** folder under **Custom Tasks**, create a new **Run PowerShell Script** task (after the MBAM 2.5 SP1 Client application step) with the following settings (update the parameters as appropriate for your environment):
 
-            -   Name: Configure BitLocker for MBAM
+           -   Name: Configure BitLocker for MBAM
 
-            -   PowerShell script: `Invoke-MbamClientDeployment.ps1`
+           -   PowerShell script: `Invoke-MbamClientDeployment.ps1`
 
-            -   Parameters:
+           -   Parameters:
 
-                
-                -                -                -                -                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
-                
            




            -RecoveryServiceEndpoint
            Required
            MBAM recovery service endpoint
            -StatusReportingServiceEndpoint
            Optional
            MBAM status reporting service endpoint
            -EncryptionMethod
            Optional
            Encryption method (default: AES 128)
            -EncryptAndEscrowDataVolume
            Switch
            Specify to encrypt data volume(s) and escrow data volume recovery key(s)
            -WaitForEncryptionToComplete
            Switch
            Specify to wait for the encryption to complete
            -DoNotResumeSuspendedEncryption
            Switch
            Specify that the deployment script will not resume suspended encryption
            -IgnoreEscrowOwnerAuthFailure
            Switch
            Specify to ignore TPM owner-auth escrow failure. It should be used in the scenarios where MBAM is not able to read the TPM owner-auth, e.g. if TPM auto provisioning is enabled
            -IgnoreEscrowRecoveryKeyFailure
            Switch
            Specify to ignore volume recovery key escrow failure
            -IgnoreReportStatusFailure
            Switch
            Specify to ignore status reporting failure
            
+               
+               +               +               +               +               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
+               
            




            -RecoveryServiceEndpoint
            Required
            MBAM recovery service endpoint
            -StatusReportingServiceEndpoint
            Optional
            MBAM status reporting service endpoint
            -EncryptionMethod
            Optional
            Encryption method (default: AES 128)
            -EncryptAndEscrowDataVolume
            Switch
            Specify to encrypt data volume(s) and escrow data volume recovery key(s)
            -WaitForEncryptionToComplete
            Switch
            Specify to wait for the encryption to complete
            -DoNotResumeSuspendedEncryption
            Switch
            Specify that the deployment script will not resume suspended encryption
            -IgnoreEscrowOwnerAuthFailure
            Switch
            Specify to ignore TPM owner-auth escrow failure. It should be used in the scenarios where MBAM is not able to read the TPM owner-auth, e.g. if TPM auto provisioning is enabled
            -IgnoreEscrowRecoveryKeyFailure
            Switch
            Specify to ignore volume recovery key escrow failure
            -IgnoreReportStatusFailure
            Switch
            Specify to ignore status reporting failure
            
 
-                 
+                 
 
 **To enable BitLocker using MBAM 2.5 or earlier as part of a Windows deployment**
 
@@ -330,4 +333,4 @@ Here are a list of common error messages:
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
-- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
\ No newline at end of file
+- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md b/mdop/mbam-v25/how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md
index 74cb3987aa..ff06699bd3 100644
--- a/mdop/mbam-v25/how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md
+++ b/mdop/mbam-v25/how-to-localize-the-helpdesktext-statement-that-points-users-to-more-self-service-portal-information.md
@@ -1,8 +1,11 @@
 ---
 title: How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information
 description: How to Localize the “HelpdeskText” Statement that Points Users to More Self-Service Portal Information
-author: jamiejdt
+author: dansimp
 ms.assetid: 09ba2a07-3186-45d9-adef-4034c70ae7cf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ You can configure a localized version of the Self-Service Portal "HelpdeskText"
 **Note**  
 In the following instructions, *SelfService* is the default virtual directory name for the Self-Service Portal. You might have used a different name when you configured the Self-Service Portal.
 
- 
+ 
 
 **To display a localized version of the HelpdeskText statement**
 
@@ -44,9 +47,9 @@ In the following instructions, *SelfService* is the default virtual directory na
 
 [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md)
 
- 
+ 
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/how-to-localize-the-self-service-portal-helpdeskurl.md b/mdop/mbam-v25/how-to-localize-the-self-service-portal-helpdeskurl.md
index 03920986d6..39f6b21718 100644
--- a/mdop/mbam-v25/how-to-localize-the-self-service-portal-helpdeskurl.md
+++ b/mdop/mbam-v25/how-to-localize-the-self-service-portal-helpdeskurl.md
@@ -1,8 +1,11 @@
 ---
 title: How to Localize the Self-Service Portal “HelpdeskURL”
 description: How to Localize the Self-Service Portal “HelpdeskURL”
-author: jamiejdt
+author: dansimp
 ms.assetid: 86798460-077b-459b-8d54-4b605e07d2f1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -21,7 +24,7 @@ If you create a localized version, as described in the following instructions, M
 **Note**  
 In the following instructions, *SelfService* is the default virtual directory name for the Self-Service Portal. You might have used a different name when you configured the Self-Service Portal.
 
- 
+ 
 
 **To localize the Self-Service Portal URL**
 
@@ -46,9 +49,9 @@ In the following instructions, *SelfService* is the default virtual directory na
 
 [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md)
 
- 
+ 
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/how-to-localize-the-self-service-portal-notice-text.md b/mdop/mbam-v25/how-to-localize-the-self-service-portal-notice-text.md
index a4cfaa869c..65d97745b3 100644
--- a/mdop/mbam-v25/how-to-localize-the-self-service-portal-notice-text.md
+++ b/mdop/mbam-v25/how-to-localize-the-self-service-portal-notice-text.md
@@ -1,8 +1,11 @@
 ---
 title: How to Localize the Self-Service Portal Notice Text
 description: How to Localize the Self-Service Portal Notice Text
-author: jamiejdt
+author: dansimp
 ms.assetid: a4c878b7-e5c8-45af-a537-761bb2991659
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -25,7 +28,7 @@ To display localized notice text, you create a localized Notice.txt file, and th
 **Note**  
 You can configure the path by using the **NoticeTextPath** item in **Application Settings**.
 
- 
+ 
 
 MBAM displays the notice text, based on the following rules:
 
@@ -40,7 +43,7 @@ If an end user’s browser is set to a language that does not have a correspondi
 
 <*MBAM Self-Service Install Directory*>\\Self Service Website\\
 
- 
+ 
 
 **To create a localized Notice.txt file**
 
@@ -51,7 +54,7 @@ If an end user’s browser is set to a language that does not have a correspondi
     **Note**  
     Some language folders already exist, so you might not have to create a folder. If you do have to create a language folder, see [National Language Support (NLS) API Reference](https://go.microsoft.com/fwlink/?LinkId=317947) for a list of the valid names that you can use for the <*Language*> folder.
 
-     
+     
 
 2.  Create a Notice.txt file that contains the localized notice text.
 
@@ -68,7 +71,7 @@ If an end user’s browser is set to a language that does not have a correspondi
 
 [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md b/mdop/mbam-v25/how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md
index 3337c2bd83..5cb63887d0 100644
--- a/mdop/mbam-v25/how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md
+++ b/mdop/mbam-v25/how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: How to Manage User BitLocker Encryption Exemptions
 description: How to Manage User BitLocker Encryption Exemptions
-author: jamiejdt
+author: dansimp
 ms.assetid: f582ab82-5bb5-4cd3-ad7c-483240533cf9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -38,26 +41,25 @@ To exempt users from BitLocker protection, you have to:
 
            Add the exempted user to a security group for a Group Policy Object that is configured specifically for exempted users.
            
 
            When members of this security group sign in to a computer, the user’s Group Policy setting exempts the user from BitLocker protection. The user’s Group Policy setting overwrites the computer policy, and the computer will remain exempt from BitLocker encryption.
            
 
            
-Note  
-
            MBAM does not enact the encryption policy if the computer is already BitLocker-protected and the user is exempted. However, if another user who is not exempt from the encryption policy signs in to the computer, encryption will take place.
            
+Note
            MBAM does not enact the encryption policy if the computer is already BitLocker-protected and the user is exempted. However, if another user who is not exempt from the encryption policy signs in to the computer, encryption will take place.
            
 
            
 
            
- 
+
 
            
 
 
 
 
- 
+
 
 The following steps describe what occurs when end users request an exemption from the BitLocker Drive Encryption exemption process through the MBAM Client or through whatever process your organization uses. You must configure MBAM Group Policy settings to allow end users to request an exemption from BitLocker Drive Encryption.
 
 1.  When end users sign in to a computer that is required to be encrypted, they receive a notification that their computer is going to be encrypted. They can select **Request Exemption** and postpone the encryption by selecting **Postpone**, or they can select **Start Encryption** to accept the BitLocker encryption.
 
-    **Note**  
+    **Note**  
     Selecting **Request Exemption** postpones the BitLocker protection until the maximum time that is set in the User Exemption Policy.
 
-     
+
 
 2.  If end users select **Request Exemption**, they receive a notification telling them to contact the organization’s BitLocker administration group. Depending on how the **Configure User Exemption Policy** is configured, users are provided with one or more of the following contact methods:
 
@@ -95,26 +97,25 @@ To exempt users from BitLocker protection, you have to:
 
            Add the exempted user to a security group for a Group Policy Object that is configured specifically for exempted users.
            
 
            When members of this security group sign in to a computer, the user’s Group Policy setting exempts the user from BitLocker protection. The user’s Group Policy setting overwrites the computer policy, and the computer will remain exempt from BitLocker encryption.
            
 
            
-Note  
-
            If the computer is already BitLocker-protected, the User Exemption Policy has no effect. In addition, if another user signs in to a computer that is not exempt from the encryption policy, encryption will take place.
            
+Note
            If the computer is already BitLocker-protected, the User Exemption Policy has no effect. In addition, if another user signs in to a computer that is not exempt from the encryption policy, encryption will take place.
            
 
            
 
            
- 
+
 
            
 
 
 
 
- 
+
 
 The following steps describe what occurs when end users request an exemption from the BitLocker Drive Encryption exemption process through the MBAM Client or through whatever process your organization uses. You must configure MBAM Group Policy settings to allow end users to request an exemption from BitLocker Drive Encryption.
 
 1.  When end users sign in to a computer that is required to be encrypted, they receive a notification that their computer is going to be encrypted. They can select **Request Exemption** and postpone the encryption by selecting **Postpone**, or they can select **Start Encryption** to accept the BitLocker encryption.
 
-    **Note**  
+    **Note**  
     Selecting **Request Exemption** postpones the BitLocker protection until the maximum time that is set in the User Exemption Policy.
 
-     
+
 
 2.  If end users select **Request Exemption**, they receive a notification telling them to contact the organization’s BitLocker administration group. Depending on how the **Configure User Exemption Policy** is configured, users are provided with one or more of the following contact methods:
 
@@ -140,10 +141,10 @@ The following steps describe what occurs when end users request an exemption fro
 
     When a user signs in to a computer controlled by BitLocker, the MBAM Client checks the User Exemption Policy setting. If the computer is already encrypted, BitLocker protection is not suspended. If the computer is not encrypted, MBAM does not prompt the user to encrypt.
 
-    **Important**  
+    **Important**  
     Shared computer scenarios require special consideration when you are using BitLocker user exemptions. If a non-exempt user signs in to a computer that is shared with an exempt user, the computer may be encrypted.
 
-     
+
 
 
 ## Related topics
@@ -153,9 +154,9 @@ The following steps describe what occurs when end users request an exemption fro
 
 [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md)
 
- 
 
- 
+
+
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md b/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md
index 37c9efa664..2500ec0e02 100644
--- a/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md
+++ b/mdop/mbam-v25/how-to-move-the-mbam-25-databases.md
@@ -1,8 +1,11 @@
 ---
 title: How to Move the MBAM 2.5 Databases
 description: How to Move the MBAM 2.5 Databases
-author: jamiejdt
+author: dansimp
 ms.assetid: 34b46f2d-0add-4377-8e4e-04b628fdfcf1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -66,7 +69,6 @@ To automate this procedure, you can use Windows PowerShell to enter a command th
 
 ```powershell
 Stop-Website "Microsoft BitLocker Administration and Monitoring"
-
 ```
 
 >[!NOTE]
@@ -140,7 +142,7 @@ Stop-Website "Microsoft BitLocker Administration and Monitoring"
 
 ### Move the Recovery Database from Server A to Server B
 
-Use Windows Explorer to move the **MBAM Compliance Status Database Data.bak** file from Server A to Server B.
+Use Windows Explorer to move the **MBAM Recovery Database Data.bak** file from Server A to Server B.
 
 To automate this procedure, you can use Windows PowerShell to run a command that is similar to the following:
 
@@ -153,7 +155,6 @@ Copy-Item "Z:\SQLServerInstanceCertificateFile"
 
 Copy-Item "Z:\SQLServerInstanceCertificateFilePrivateKey"
 \\$SERVERNAME$\$DESTINATIONSHARE$
-
 ```
 Use the information in the following table to replace the values in the code example with values that match your environment.
 
@@ -228,48 +229,48 @@ Use the information in the following table to replace the values in the code exa
 
 ### Configure access to the Database on Server B and update connection data
 
-1.  Verify that the Microsoft SQL Server user login that enables Recovery Database access on the restored database is mapped to the access account that you provided during the configuration process.
+1. Verify that the Microsoft SQL Server user login that enables Recovery Database access on the restored database is mapped to the access account that you provided during the configuration process.
 
-    >[!NOTE]
-    >If the login is not the same, create a login by using SQL Server Management Studio, and map it to the existing database user.
+   >[!NOTE]
+   >If the login is not the same, create a login by using SQL Server Management Studio, and map it to the existing database user.
 
-2.  On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to update the connection string information for the MBAM websites.
+2. On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to update the connection string information for the MBAM websites.
 
-3.  Edit the following registry key:
+3. Edit the following registry key:
 
-    **HKLM\\Software\\Microsoft\\MBAM Server\\Web\\RecoveryDBConnectionString**
+   **HKLM\\Software\\Microsoft\\MBAM Server\\Web\\RecoveryDBConnectionString**
 
-4.  Update the **Data Source** value with the name of the server and instance (for example, \$SERVERNAME\$\\\$SQLINSTANCENAME) to which the Recovery Database was moved.
+4. Update the **Data Source** value with the name of the server and instance (for example, \$SERVERNAME\$\\\$SQLINSTANCENAME) to which the Recovery Database was moved.
 
-5.  Update the **Initial Catalog** value with the recovered database name.
+5. Update the **Initial Catalog** value with the recovered database name.
 
-6.  To automate this process, you can use the Windows PowerShell command prompt to enter a command line on the Administration and Monitoring Server that is similar to the following:
+6. To automate this process, you can use the Windows PowerShell command prompt to enter a command line on the Administration and Monitoring Server that is similar to the following:
 
-    ```powershell
-    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\MBAM Server\\Web" /v
-    RecoveryDBConnectionString /t REG_SZ /d "Integrated Security=SSPI;Initial
-    Catalog=$DATABASE$;Data Source=$SERVERNAME$\$SQLINSTANCENAME$" /f
+   ```powershell
+   reg add "HKEY_LOCAL_MACHINE\SOFTWARE\\Microsoft\MBAM Server\\Web" /v
+   RecoveryDBConnectionString /t REG_SZ /d "Integrated Security=SSPI;Initial
+   Catalog=$DATABASE$;Data Source=$SERVERNAME$\$SQLINSTANCENAME$" /f
 
-    Set-WebConfigurationProperty
-    'connectionStrings/add[@name="KeyRecoveryConnectionString"]' -PSPath
-    "IIS:\sites\Microsoft Bitlocker Administration and
-    Monitoring\MBAMAdministrationService" -Name "connectionString" -Value "Data
-    Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and
-    Hardware;Integrated Security=SSPI;"
+   Set-WebConfigurationProperty
+   'connectionStrings/add[@name="KeyRecoveryConnectionString"]' -PSPath
+   "IIS:\sites\Microsoft Bitlocker Administration and
+   Monitoring\MBAMAdministrationService" -Name "connectionString" -Value "Data
+   Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery and
+   Hardware;Integrated Security=SSPI;"
 
-    Set-WebConfigurationProperty
-    'connectionStrings/add[\@name="Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString"]'
-    -PSPath "IIS:\sites\Microsoft Bitlocker Administration and
-    Monitoring\MBAMRecoveryAndHardwareService" -Name "connectionString" -Value
-    "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery
-    and Hardware;Integrated Security=SSPI;"
-    ```
+   Set-WebConfigurationProperty
+   'connectionStrings/add[\@name="Microsoft.Mbam.RecoveryAndHardwareDataStore.ConnectionString"]'
+   -PSPath "IIS:\sites\Microsoft Bitlocker Administration and
+   Monitoring\MBAMRecoveryAndHardwareService" -Name "connectionString" -Value
+   "Data Source=$SERVERNAME$\$SQLINSTANCENAME$;Initial Catalog=MBAM Recovery
+   and Hardware;Integrated Security=SSPI;"
+   ```
 
-    >[!Note]
-    >This connection string is shared by all local MBAM web applications. Therefore, it needs to be updated only once per server.
+   >[!Note]
+   >This connection string is shared by all local MBAM web applications. Therefore, it needs to be updated only once per server.
 
 
-7.  Use the following table to replace the values in the code example with values that match your environment.
+7. Use the following table to replace the values in the code example with values that match your environment.
 
    |Parameter|Description|
    |---------|-----------|
@@ -327,7 +328,6 @@ To automate this procedure, you can use Windows PowerShell to enter a command th
 
 ```powershell
 Stop-Website "Microsoft BitLocker Administration and Monitoring"
-
 ```
 
 >[!NOTE]
@@ -440,34 +440,33 @@ Stop-Website "Microsoft BitLocker Administration and Monitoring"
 
 ### Configure access to the Database on Server B and update connection data
 
-1.  Verify that the Microsoft SQL Server user login that enables Compliance and Audit Database access on the restored database is mapped to the access account that you provided during the configuration process.
+1. Verify that the Microsoft SQL Server user login that enables Compliance and Audit Database access on the restored database is mapped to the access account that you provided during the configuration process.
 
-    >[!NOTE]
-    >If the login is not the same, create a login by using SQL Server Management Studio, and map it to the existing database user.
+   >[!NOTE]
+   >If the login is not the same, create a login by using SQL Server Management Studio, and map it to the existing database user.
 
-2.  On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to update the connection string information for the Website.
+2. On the server that is running the Administration and Monitoring Website, use the Internet Information Services (IIS) Manager console to update the connection string information for the Website.
 
-3.  Edit the following registry key:
+3. Edit the following registry key:
 
-    **HKLM\\Software\\Microsoft\\MBAM Server\\Web\\ComplianceDBConnectionString**
+   **HKLM\\Software\\Microsoft\\MBAM Server\\Web\\ComplianceDBConnectionString**
 
-4.  Update the **Data Source** value with the name of the server and instance (for example, \$SERVERNAME\$\\\$SQLINSTANCENAME) to which the Recovery Database was moved.
+4. Update the **Data Source** value with the name of the server and instance (for example, \$SERVERNAME\$\\\$SQLINSTANCENAME) to which the Recovery Database was moved.
 
-5.  Update the **Initial Catalog** value with the recovered database name.
+5. Update the **Initial Catalog** value with the recovered database name.
 
-6.  To automate this process, you can use the Windows PowerShell command prompt to enter a command line on the Administration and Monitoring Server that is similar to the following:
+6. To automate this process, you can use the Windows PowerShell command prompt to enter a command line on the Administration and Monitoring Server that is similar to the following:
 
-    ```powershell
-    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server\Web" /v
-    ComplianceDBConnectionString /t REG_SZ /d "Integrated Security=SSPI;Initial
-    Catalog=$DATABASE$;Data Source=$SERVERNAME$\$SQLINSTANCENAME$" /f
-
-    ```
-    >[!NOTE]
-    >This connection string is shared by all local MBAM web applications. Therefore, it needs to be updated only once per server.
+   ```powershell
+   reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server\Web" /v
+   ComplianceDBConnectionString /t REG_SZ /d "Integrated Security=SSPI;Initial
+   Catalog=$DATABASE$;Data Source=$SERVERNAME$\$SQLINSTANCENAME$" /f
+   ```
+   >[!NOTE]
+   >This connection string is shared by all local MBAM web applications. Therefore, it needs to be updated only once per server.
 
 
-7.  Using the following table, replace the values in the code example with values that match your environment.
+7. Using the following table, replace the values in the code example with values that match your environment.
 
    |Parameter | Description |
    |---------|------------|
@@ -492,7 +491,6 @@ To automate this procedure, you can use Windows PowerShell to run a command that
 
 ```powershell
 Start-Website "Microsoft BitLocker Administration and Monitoring"
-
 ```
 
 >[!NOTE]
diff --git a/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md b/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md
index 52af44d82d..c77b29982c 100644
--- a/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md
+++ b/mdop/mbam-v25/how-to-move-the-mbam-25-reports.md
@@ -1,8 +1,11 @@
 ---
 title: How to Move the MBAM 2.5 Reports
 description: How to Move the MBAM 2.5 Reports
-author: jamiejdt
+author: dansimp
 ms.assetid: c8223656-ca9d-41c8-94a3-64d07a6b99e9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -29,7 +32,7 @@ The high-level steps for moving the Reports feature are:
 **Note**  
 To run the example Windows PowerShell scripts in this topic, you must update the Windows PowerShell execution policy to enable scripts to be run. See [Running Windows PowerShell Scripts](https://technet.microsoft.com/library/ee176949.aspx) for instructions.
 
- 
+ 
 
 **Stop the MBAM Administration and Monitoring Website**
 
@@ -100,7 +103,7 @@ To run the example Windows PowerShell scripts in this topic, you must update the
     
     
 
-     
+     
 
 **Resume the instance of the Administration and Monitoring Website**
 
@@ -115,7 +118,7 @@ To run the example Windows PowerShell scripts in this topic, you must update the
     **Note**  
     To run this command, you must add the IIS module for Windows PowerShell to the current instance of Windows PowerShell.
 
-     
+     
 
 
 
@@ -128,11 +131,11 @@ To run the example Windows PowerShell scripts in this topic, you must update the
 
 [Moving MBAM 2.5 Features to Another Server](moving-mbam-25-features-to-another-server.md)
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/how-to-move-the-mbam-25-websites.md b/mdop/mbam-v25/how-to-move-the-mbam-25-websites.md
index a95d698126..6b57070737 100644
--- a/mdop/mbam-v25/how-to-move-the-mbam-25-websites.md
+++ b/mdop/mbam-v25/how-to-move-the-mbam-25-websites.md
@@ -1,8 +1,11 @@
 ---
 title: How to Move the MBAM 2.5 Websites
 description: How to Move the MBAM 2.5 Websites
-author: jamiejdt
+author: dansimp
 ms.assetid: 71af9a54-c27b-408f-9d75-37c0d02e730e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -23,7 +26,7 @@ Use these procedures to move the following MBAM websites from one computer to an
 **Important**  
 During the configuration of both websites, you must provide the same connection string, Reports URL, group accounts, and web service application pool domain account as the ones that you are currently using. If you don’t use the same values, you cannot access some of the servers. To get the current values, use the **Get-MbamWebApplication** Windows PowerShell cmdlet.
 
- 
+ 
 
 **To move the Administration and Monitoring Website to another server**
 
@@ -60,7 +63,7 @@ During the configuration of both websites, you must provide the same connection
 
 [Moving MBAM 2.5 Features to Another Server](moving-mbam-25-features-to-another-server.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/how-to-recover-a-corrupted-drive-mbam-25.md b/mdop/mbam-v25/how-to-recover-a-corrupted-drive-mbam-25.md
index dc18c38f3d..5ee41f6f49 100644
--- a/mdop/mbam-v25/how-to-recover-a-corrupted-drive-mbam-25.md
+++ b/mdop/mbam-v25/how-to-recover-a-corrupted-drive-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: How to Recover a Corrupted Drive
 description: How to Recover a Corrupted Drive
-author: jamiejdt
+author: dansimp
 ms.assetid: fa5b846b-dda6-4ae4-bf6c-39e4f1d8aa00
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -30,7 +33,7 @@ You can use this procedure with the Administration and Monitoring Website (also
 
 
 
            Create a recovery key package file by accessing the Drive Recovery area of the Administration and Monitoring Website.
            
-
            To access the Drive Recovery area, you must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role. You may have given these roles different names when you created them. For more information, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles).
            
+
            To access the Drive Recovery area, you must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role. You may have given these roles different names when you created them. For more information, see Planning for MBAM 2.5 Groups and Accounts.
            
 
 
 
            Copy the package file to the computer that contains the corrupted drive.
            
@@ -38,12 +41,12 @@ You can use this procedure with the Administration and Monitoring Website (also
 
 
 
            Use the repair-bde command to complete the recovery process.
            
-
            To avoid a potential loss of data, it is strongly recommended that you review the [Manage-bde](https://go.microsoft.com/fwlink/?LinkId=393567) command before using it.
            
+
            To avoid a potential loss of data, it is strongly recommended that you review the Manage-bde command before using it.
            
 
 
 
 
- 
+ 
 
 **To recover a corrupted drive**
 
@@ -56,7 +59,7 @@ You can use this procedure with the Administration and Monitoring Website (also
     **Note**  
     If you are a member of the Advanced Helpdesk Users access group, you do not have to enter the user’s domain name or user name.
 
-     
+     
 
 4.  Click **Submit**. The recovery key will be displayed.
 
@@ -73,7 +76,7 @@ You can use this procedure with the Administration and Monitoring Website (also
     **Note**  
     Replace <*fixed drive*> with an available hard disk drive that has free space equal to or larger than the data on the corrupted drive. Data on the corrupted drive is recovered and moved to the specified hard disk drive.
 
-     
+     
 
 
 ## Related topics
@@ -81,11 +84,11 @@ You can use this procedure with the Administration and Monitoring Website (also
 
 [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md)
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/how-to-recover-a-drive-in-recovery-mode-mbam-25.md b/mdop/mbam-v25/how-to-recover-a-drive-in-recovery-mode-mbam-25.md
index c6565a7304..9dec2442fb 100644
--- a/mdop/mbam-v25/how-to-recover-a-drive-in-recovery-mode-mbam-25.md
+++ b/mdop/mbam-v25/how-to-recover-a-drive-in-recovery-mode-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: How to Recover a Drive in Recovery Mode
 description: How to Recover a Drive in Recovery Mode
-author: jamiejdt
+author: dansimp
 ms.assetid: e126eaf8-9ae7-40fe-a28e-dbd78d26859e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -18,15 +21,15 @@ This topic explains how to use the Administration and Monitoring Website (also r
 
 To get a recovery password, use the **Drive Recovery** area of the Administration and Monitoring Website. You must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role to access this area of the website.
 
-**Note**  
+**Note**  
 You may have given these roles different names when you created them. For more information, see [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md#bkmk-helpdesk-roles).
 
- 
 
-**Important**  
+
+**Important**  
 Recovery passwords expire after a single use. On operating system drives and fixed data drives, the single-use rule is applied automatically. On removable drives, it is applied when the drive is removed and then reinserted and unlocked on a computer that has Group Policy settings activated to manage removable drives.
 
- 
+
 
 **To recover a drive in recovery mode**
 
@@ -36,10 +39,10 @@ Recovery passwords expire after a single use. On operating system drives and fix
 
 3.  Enter the end user’s Windows log-on domain and user name to view recovery information.
 
-    **Note**  
+    **Note**  
     If you are in the MBAM Advanced Helpdesk Users group, the user domain and user ID fields are not required.
 
-     
+
 
 4.  Enter the first eight digits of the recovery key ID to see a list of possible matching recovery keys, or enter the entire recovery key ID to get the exact recovery key.
 
@@ -53,16 +56,18 @@ Recovery passwords expire after a single use. On operating system drives and fix
 
     -   The recovery password and recovery package for the submitted user
 
-        **Note**  
+        **Note**  
         If you are recovering a damaged drive, the recovery package option provides BitLocker with critical information that it needs to recover the drive.
 
-         
 
-    After the recovery password and recovery package are retrieved, the recovery password is displayed.
 
-6.  To copy the password, click **Copy Key**, and then paste the recovery password into an email message. Alternatively, click **Save** to save the recovery password to a file.
+~~~
+After the recovery password and recovery package are retrieved, the recovery password is displayed.
+~~~
 
-    When the user types the recovery password into the system or uses the recovery package, the drive is unlocked.
+6. To copy the password, click **Copy Key**, and then paste the recovery password into an email message. Alternatively, click **Save** to save the recovery password to a file.
+
+   When the user types the recovery password into the system or uses the recovery package, the drive is unlocked.
 
 
 
@@ -71,11 +76,11 @@ Recovery passwords expire after a single use. On operating system drives and fix
 
 [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md)
 
- 
+
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
-- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
+- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
 
 
 
diff --git a/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md b/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md
index fe98ceee20..59ee1c423d 100644
--- a/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md
+++ b/mdop/mbam-v25/how-to-recover-a-moved-drive-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: How to Recover a Moved Drive
 description: How to Recover a Moved Drive
-author: jamiejdt
+author: dansimp
 ms.assetid: 0d38ce7e-bc64-473e-ae85-99b7099ca758
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -24,7 +27,7 @@ To recover a moved drive, you must use the **Drive Recovery** area of the Admini
     **Note**  
     In some cases, you may be able to click **I forgot the PIN** during the startup process, and then enter the recovery mode to display the recovery key ID.
 
-     
+     
 
 3.  Use the recovery key ID to retrieve the recovery password and unlock the drive from the Administration and Monitoring Website. For instructions, see [How to Recover a Drive in Recovery Mode](how-to-recover-a-drive-in-recovery-mode-mbam-25.md).
 
@@ -41,7 +44,7 @@ To recover a moved drive, you must use the **Drive Recovery** area of the Admini
 
 [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/how-to-reset-a-tpm-lockout-mbam-25.md b/mdop/mbam-v25/how-to-reset-a-tpm-lockout-mbam-25.md
index 9303a8e597..fc80c4324c 100644
--- a/mdop/mbam-v25/how-to-reset-a-tpm-lockout-mbam-25.md
+++ b/mdop/mbam-v25/how-to-reset-a-tpm-lockout-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: How to Reset a TPM Lockout
 description: How to Reset a TPM Lockout
-author: jamiejdt
+author: dansimp
 ms.assetid: dd20a728-c52e-48e6-9f6c-1311c71dee74
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -35,7 +38,7 @@ For information about MBAM and TPM ownership, see [MBAM 2.5 Security Considerati
     **Note**  
     If you are in the MBAM Advanced Helpdesk Users group, the user domain and user ID fields are not required.
 
-     
+     
 
 5.  From the **Reason for requesting TPM owner password file** list, select a reason for the request, and click **Submit**.
 
@@ -56,7 +59,7 @@ For information about MBAM and TPM ownership, see [MBAM 2.5 Security Considerati
     **Important**  
     Do not give the TPM hash value or TPM owner password file to end users. Because the TPM information does not change, giving the file to end users creates a security risk.
 
-     
+     
 
 
 
@@ -65,7 +68,7 @@ For information about MBAM and TPM ownership, see [MBAM 2.5 Security Considerati
 
 [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/how-to-set-the-self-service-portal-branding-and-session-time-out.md b/mdop/mbam-v25/how-to-set-the-self-service-portal-branding-and-session-time-out.md
index 4a5e23195c..67f433c862 100644
--- a/mdop/mbam-v25/how-to-set-the-self-service-portal-branding-and-session-time-out.md
+++ b/mdop/mbam-v25/how-to-set-the-self-service-portal-branding-and-session-time-out.md
@@ -1,8 +1,11 @@
 ---
 title: How to Set the Self-Service Portal Branding and Session Time-out
 description: How to Set the Self-Service Portal Branding and Session Time-out
-author: jamiejdt
+author: dansimp
 ms.assetid: 031eedfc-fade-4d2f-8771-b329e1d38c0d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -16,15 +19,15 @@ ms.date: 06/16/2016
 
 After you configure the Self-Service Portal, you can brand it with your company name, Help Desk URL, and "notice" text. You can also change the Session Time-out setting to make the end user’s session expire after a specified period of inactivity.
 
-**Note**  
+**Note**  
 You can also brand the Self-Service Portal by using the **Enable-MbamWebApplication** Windows PowerShell cmdlet or the MBAM Server Configuration wizard. For instructions on using the wizard, see [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md).
 
- 
 
-**Note**  
+
+**Note**  
 In the following instructions, *SelfService* is the default virtual directory name for the Self-Service Portal. You might have used a different name when you configured the Self-Service Portal.
 
- 
+
 
 **To set the session time-out and branding for the Self-Service Portal**
 
@@ -38,102 +41,104 @@ In the following instructions, *SelfService* is the default virtual directory na
 
 5.  In the **Name** column, select the item that you want to change, and change the default value to reflect the name that you want to use. The following table lists the values that you can set.
 
-    **Caution**  
+    **Caution**  
     Do not change the value in the Name column (CompanyName\*), as it will cause Self-Service Portal to stop working.
 
-     
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
            



            NameDefault value
            ClientValidationEnabled
            true
            CompanyName
            Contoso IT
            DisplayNotice
            true
            HelpdeskText
            Contact Helpdesk or IT Department
            HelpdeskUrl
            #
            
-    
            
-    Note  
-    
            In MBAM 2.5 SP1, the HelpdeskUrl default value is empty.
            
-    
            
-    
            
-     
-    
            jQueryPath
            [//go.microsoft.com/fwlink/?LinkID=390515](//go.microsoft.com/fwlink/?LinkID=390515)
            
-    
            
-    Note  
-    
            In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery-1.10.2.min.js
            
-    
            
-    
            
-     
-    
            jQueryValidatePath
            [//go.microsoft.com/fwlink/?LinkID=390516](//go.microsoft.com/fwlink/?LinkID=390516)
            
-    
            
-    Note  
-    
            In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery.validate.min.js
            
-    
            
-    
            
-     
-    
            jQueryValidateUnobtrusivePath
            [//go.microsoft.com/fwlink/?LinkID=390517](//go.microsoft.com/fwlink/?LinkID=390517)
            
-    
            
-    Note  
-    
            In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery.validate.unobtrusive.min.js
            
-    
            
-    
            
-     
-    
            NoticeTextPath
            Notice.txt
            
-    
            
-    Note  
-    
            You can edit the notice text either by using the Internet Information Services (IIS) Manager or by opening and changing the Notice.txt file in the installation directory.
            
-    
            
-    
            
-     
-    
            UnobtrusiveJavaScriptEnabled
            true
            
 
-     
+~~~
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
            



            NameDefault value
            ClientValidationEnabled
            true
            CompanyName
            Contoso IT
            DisplayNotice
            true
            HelpdeskText
            Contact Helpdesk or IT Department
            HelpdeskUrl
            #
            
+
            
+Note  
+
            In MBAM 2.5 SP1, the HelpdeskUrl default value is empty.
            
+
            
+
            
+
+
            jQueryPath
            [//go.microsoft.com/fwlink/?LinkID=390515](//go.microsoft.com/fwlink/?LinkID=390515)
            
+
            
+Note  
+
            In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery-1.10.2.min.js
            
+
            
+
            
+
+
            jQueryValidatePath
            [//go.microsoft.com/fwlink/?LinkID=390516](//go.microsoft.com/fwlink/?LinkID=390516)
            
+
            
+Note  
+
            In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery.validate.min.js
            
+
            
+
            
+
+
            jQueryValidateUnobtrusivePath
            [//go.microsoft.com/fwlink/?LinkID=390517](//go.microsoft.com/fwlink/?LinkID=390517)
            
+
            
+Note  
+
            In MBAM 2.5 SP1, this has been changed to a local JavaScript file shipped with the product, located at ~/Scripts/jquery.validate.unobtrusive.min.js
            
+
            
+
            
+
+
            NoticeTextPath
            Notice.txt
            
+
            
+Note  
+
            You can edit the notice text either by using the Internet Information Services (IIS) Manager or by opening and changing the Notice.txt file in the installation directory.
            
+
            
+
            
+
+
            UnobtrusiveJavaScriptEnabled
            true
            
+~~~
+
+
 
 
 
@@ -142,11 +147,11 @@ In the following instructions, *SelfService* is the default virtual directory na
 
 [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md)
 
- 
+
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
-- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
+- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
 
 
 
diff --git a/mdop/mbam-v25/how-to-turn-the-self-service-portal-notice-text-on-or-off.md b/mdop/mbam-v25/how-to-turn-the-self-service-portal-notice-text-on-or-off.md
index c2e1679a7c..015d00c47f 100644
--- a/mdop/mbam-v25/how-to-turn-the-self-service-portal-notice-text-on-or-off.md
+++ b/mdop/mbam-v25/how-to-turn-the-self-service-portal-notice-text-on-or-off.md
@@ -1,8 +1,11 @@
 ---
 title: How to Turn the Self-Service Portal Notice Text On or Off
 description: How to Turn the Self-Service Portal Notice Text On or Off
-author: jamiejdt
+author: dansimp
 ms.assetid: e786685b-ffdb-4557-ae71-e79528097264
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ You can turn the Self-Service Portal notice text on or off. By default, the noti
 **Note**  
 In the following instructions, *SelfService* is the default virtual directory name for the Self-Service Portal. You might have used a different name when you configured the Self-Service Portal.
 
- 
+ 
 
 **To turn off the notice text**
 
@@ -34,9 +37,9 @@ In the following instructions, *SelfService* is the default virtual directory na
 
 [Customizing the Self-Service Portal for Your Organization](customizing-the-self-service-portal-for-your-organization.md)
 
- 
+ 
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/how-to-use-the-administration-and-monitoring-website.md b/mdop/mbam-v25/how-to-use-the-administration-and-monitoring-website.md
index e5107a9650..6999def5bb 100644
--- a/mdop/mbam-v25/how-to-use-the-administration-and-monitoring-website.md
+++ b/mdop/mbam-v25/how-to-use-the-administration-and-monitoring-website.md
@@ -1,8 +1,11 @@
 ---
 title: How to Use the Administration and Monitoring Website
 description: How to Use the Administration and Monitoring Website
-author: jamiejdt
+author: dansimp
 ms.assetid: bb96a4e8-d4f4-4e6f-b7db-82d96998bfa6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ The Administration and Monitoring Website, also referred to as the Help Desk, is
 **Note**  
 If you are using MBAM in the Stand-alone topology, you view all reports from the Administration and Monitoring Website. If you are using the Configuration Manager Integration topology, you view all reports in Configuration Manager, except the Recovery Audit report, which you continue to view from the Administration and Monitoring Website. For more information about reports, see [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md).
 
- 
+ 
 
 ## Required roles for using the Administration and Monitoring Website
 
@@ -55,7 +58,7 @@ To access specific areas of the Administration and Monitoring Website, you must
 
 
 
- 
+ 
 
 ## Tasks you can perform on the Administration and Monitoring Website
 
@@ -82,13 +85,13 @@ The following table summarizes the tasks you can perform on the Administration a
 
            View reports
            
 
            Reports
            
 
            Enables you to run reports to monitor BitLocker usage, compliance, and key recovery activity. Reports provide data about enterprise compliance, individual computers, and who requested recovery keys or the TPM OwnerAuth package for a specific computer.
            
-
            [Viewing MBAM 2.5 Reports for the Stand-alone Topology](viewing-mbam-25-reports-for-the-stand-alone-topology.md)
            
+
            Viewing MBAM 2.5 Reports for the Stand-alone Topology
            
 
 
 
            Determine the BitLocker encryption status of lost or stolen computers
            
 
            Reports
            
 
            Determine if a volume was encrypted if the computer is lost or stolen.
            
-
            [How to Determine BitLocker Encryption State of Lost Computers](how-to-determine-bitlocker-encryption-state-of-lost-computers-mbam-25.md)
            
+
            How to Determine BitLocker Encryption State of Lost Computers
            
 
 
 
            Recover lost drives
            
@@ -100,21 +103,21 @@ The following table summarizes the tasks you can perform on the Administration a
 
          • Are corrupted
            • 
 
          
 
 
 
 
          Reset a TPM lockout
          
 
          Manage TPM
          
 
          Provides access to TPM data that has been collected by the MBAM Client. In a TPM lockout, use the Administration and Monitoring Website to retrieve the necessary password file to unlock the TPM.
          
-
          [How to Reset a TPM Lockout](how-to-reset-a-tpm-lockout-mbam-25.md)
          
+
          How to Reset a TPM Lockout
          
 
 
 
 
- 
+ 
 
 
 ## Related topics
@@ -122,7 +125,7 @@ The following table summarizes the tasks you can perform on the Administration a
 
 [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md b/mdop/mbam-v25/how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md
index 188b547452..3be2d5cf4a 100644
--- a/mdop/mbam-v25/how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md
+++ b/mdop/mbam-v25/how-to-use-the-self-service-portal-to-regain-access-to-a-computer-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: How to Use the Self-Service Portal to Regain Access to a Computer
 description: How to Use the Self-Service Portal to Regain Access to a Computer
-author: jamiejdt
+author: dansimp
 ms.assetid: 3c24b13a-d1b1-4763-8ac0-0b2db46267e3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -21,7 +24,7 @@ The following instructions are written from the perspective of end users, but th
 **Important**  
 An end user must have physically logged on to the computer (not remotely) at least one time successfully to be able to recover their key using the Self-Service Portal. Otherwise, they must use the Helpdesk Portal for key recovery.
 
- 
+ 
 
 End users may experience lockouts if they:
 
@@ -32,7 +35,7 @@ End users may experience lockouts if they:
 **Note**  
 If the IT administrator configured an IIS Session State time-out, a message is displayed in the Self-Service Portal 60 seconds prior to the time-out.
 
- 
+ 
 
 **To use the Self-Service Portal to regain access to a computer**
 
@@ -51,11 +54,11 @@ If the IT administrator configured an IIS Session State time-out, a message is d
 
 [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md)
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/illustrated-features-of-an-mbam-25-deployment.md b/mdop/mbam-v25/illustrated-features-of-an-mbam-25-deployment.md
index 81fdf55268..7d2a8d5f0e 100644
--- a/mdop/mbam-v25/illustrated-features-of-an-mbam-25-deployment.md
+++ b/mdop/mbam-v25/illustrated-features-of-an-mbam-25-deployment.md
@@ -1,8 +1,11 @@
 ---
 title: Illustrated Features of an MBAM 2.5 Deployment
 description: Illustrated Features of an MBAM 2.5 Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 7b5eff42-af8c-4bd0-a20a-18cc2e779f01
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -20,10 +23,10 @@ This topic describes the individual features that make up a Microsoft BitLocker
 
 -   System Center Configuration Manager Integration
 
-**Important**  
+**Important**  
 These features do not represent the recommended architecture for deploying MBAM. Use this information only as a guide to understand the individual features that make up an MBAM deployment. See [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md) for the recommended architecture for MBAM.
 
- 
+
 
 For a list of the supported versions of the software mentioned in this topic, see [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md).
 
@@ -48,12 +51,12 @@ The following image and table explain the features in an MBAM Stand-alone topolo
 |Administration and Monitoring Server|||
 |Administration and Monitoring Web Service|The Monitoring Web Service is used by the MBAM Client and the websites to communicate to the databases.|This feature is installed on a computer running Windows Server.|
 
-**Important**  
+**Important**  
 The Self-Service Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1, in which the MBAM Client, the Administration and Monitoring Website, and the Self-Service Portal communicate directly with the Recovery Database.
 
-**Important**  
+**Important**  
 The Monitoring Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 since the MBAM Client and the websites communicate directly with the Recovery Database.
- 
+
 
 ## System Center Configuration Manager Integration topology
 
@@ -61,27 +64,28 @@ The following image and table explain the features in the System Center Configur
 
 ![mbam2\-5](images/mbam2-5-cmcomponents.png)
 
-**Important**  
+**Important**  
 The Self-Service Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1, in which the MBAM Client, the Administration and Monitoring Website, and the Self-Service Portal communicate directly with the Recovery Database.
 
-**Warning**  
+**Warning**  
 The Monitoring Web Service is no longer available in Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 SP1 since the MBAM Client and the websites communicate directly with the Recovery Database.
 
-|Feature type|Description|
-|-|-|
-|Self-Service Server|||
-|Self-Service Web Service|This web service is used by the MBAM Client and the Self-Service Portal to communicate to the Recovery Database.|This feature is installed on a computer running Windows Server.|
-|Self-Service Website|This website enables end users on client computers to independently sign in to a website to get a recovery key if they lose or forget their BitLocker password.|This feature is configured on a computer running Windows Server.|
-|Administration and Monitoring Server/Recovery Audit Report|||
-|Administration and Monitoring Web Service|This web service enables communication between the Administration and Monitoring Website and the SQL Server databases where reporting data is stored.|This feature is installed on a server running Windows Server.|
-|Administration and Monitoring Website|The Recovery Audit report is viewed from the Administration and Monitoring Website. Use the Configuration Manager console to view all other reports, or view reports directly from SQL Server Reporting Services.|This feature is configured on a server running Windows Server.|
-|Databases|||
-|Recovery Database|This database stores recovery data that is collected from MBAM client computers.|This feature is configured on a server running Windows Server and a supported SQL Server instance.|
-|Audit Database|This database stores audit information about recovery attempts and activity.|This feature is configured on a server running Windows Server and a supported SQL Server instance.|
-|Configuration Manager Features|||
-|Configuration Manager Management console|This console is built into Configuration Manager and is used to view reports.|For viewing reports only, this feature can be installed on any server or client computer.|
-|Configuration Manager Reports|Reports show compliance and recovery audit data for client computers in your enterprise.|The Reports feature is installed on a server running Windows Server and SSRS, and Reports run on a supported SQL Server instance. A reporting services point must be defined in Configuration Manager on the server that is running SSRS.|
-|SQL Server Reporting Services|SSRS enables the MBAM Reports. Reports can be viewed directly from SSRS or from the Configuration Manager console.|SSRS is installed on a server running Windows Server. A reporting services point must be defined in Configuration Manager on the server that is running SSRS.|
+
+|                        Feature type                        |                                                                                                    Description                                                                                                    |
+|------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+|                    Self-Service Server                     |                                                                                                                                                                                                                   |
+|                  Self-Service Web Service                  |                                                 This web service is used by the MBAM Client and the Self-Service Portal to communicate to the Recovery Database.                                                  |
+|                    Self-Service Website                    |                          This website enables end users on client computers to independently sign in to a website to get a recovery key if they lose or forget their BitLocker password.                          |
+| Administration and Monitoring Server/Recovery Audit Report |                                                                                                                                                                                                                   |
+|         Administration and Monitoring Web Service          |                               This web service enables communication between the Administration and Monitoring Website and the SQL Server databases where reporting data is stored.                               |
+|           Administration and Monitoring Website            | The Recovery Audit report is viewed from the Administration and Monitoring Website. Use the Configuration Manager console to view all other reports, or view reports directly from SQL Server Reporting Services. |
+|                         Databases                          |                                                                                                                                                                                                                   |
+|                     Recovery Database                      |                                                                 This database stores recovery data that is collected from MBAM client computers.                                                                  |
+|                       Audit Database                       |                                                                   This database stores audit information about recovery attempts and activity.                                                                    |
+|               Configuration Manager Features               |                                                                                                                                                                                                                   |
+|          Configuration Manager Management console          |                                                                   This console is built into Configuration Manager and is used to view reports.                                                                   |
+|               Configuration Manager Reports                |                                                             Reports show compliance and recovery audit data for client computers in your enterprise.                                                              |
+|               SQL Server Reporting Services                |                                                SSRS enables the MBAM Reports. Reports can be viewed directly from SSRS or from the Configuration Manager console.                                                 |
 
 ## Related topics
 
diff --git a/mdop/mbam-v25/images/deploying-MBAM-1.png b/mdop/mbam-v25/images/deploying-MBAM-1.png
new file mode 100644
index 0000000000..eeb70cba71
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-1.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-10.png b/mdop/mbam-v25/images/deploying-MBAM-10.png
new file mode 100644
index 0000000000..69c5ddf7c5
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-10.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-11.png b/mdop/mbam-v25/images/deploying-MBAM-11.png
new file mode 100644
index 0000000000..6a33a96097
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-11.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-12.png b/mdop/mbam-v25/images/deploying-MBAM-12.png
new file mode 100644
index 0000000000..c21dda4c80
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-12.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-13.png b/mdop/mbam-v25/images/deploying-MBAM-13.png
new file mode 100644
index 0000000000..3fec7c2d3a
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-13.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-14.png b/mdop/mbam-v25/images/deploying-MBAM-14.png
new file mode 100644
index 0000000000..514a80cce5
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-14.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-2.png b/mdop/mbam-v25/images/deploying-MBAM-2.png
new file mode 100644
index 0000000000..c7f7bc2b42
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-2.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-3.png b/mdop/mbam-v25/images/deploying-MBAM-3.png
new file mode 100644
index 0000000000..a4c20e2096
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-3.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-4.png b/mdop/mbam-v25/images/deploying-MBAM-4.png
new file mode 100644
index 0000000000..e1f8c45c3f
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-4.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-5.png b/mdop/mbam-v25/images/deploying-MBAM-5.png
new file mode 100644
index 0000000000..93886bc19e
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-5.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-6.png b/mdop/mbam-v25/images/deploying-MBAM-6.png
new file mode 100644
index 0000000000..4822eaf50b
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-6.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-7.png b/mdop/mbam-v25/images/deploying-MBAM-7.png
new file mode 100644
index 0000000000..11232fc2ed
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-7.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-8.png b/mdop/mbam-v25/images/deploying-MBAM-8.png
new file mode 100644
index 0000000000..707cf78794
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-8.png differ
diff --git a/mdop/mbam-v25/images/deploying-MBAM-9.png b/mdop/mbam-v25/images/deploying-MBAM-9.png
new file mode 100644
index 0000000000..cdd490f4d5
Binary files /dev/null and b/mdop/mbam-v25/images/deploying-MBAM-9.png differ
diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-1.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-1.png
new file mode 100644
index 0000000000..3ae07ddf32
Binary files /dev/null and b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-1.png differ
diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-10.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-10.png
new file mode 100644
index 0000000000..d4f0ccd596
Binary files /dev/null and b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-10.png differ
diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-11.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-11.png
new file mode 100644
index 0000000000..c6835166f1
Binary files /dev/null and b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-11.png differ
diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-2.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-2.png
new file mode 100644
index 0000000000..488b60ea4c
Binary files /dev/null and b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-2.png differ
diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-3.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-3.png
new file mode 100644
index 0000000000..3ad922e3a5
Binary files /dev/null and b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-3.png differ
diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-4.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-4.png
new file mode 100644
index 0000000000..3bfaf4918a
Binary files /dev/null and b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-4.png differ
diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-5.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-5.png
new file mode 100644
index 0000000000..1cf43b2ba3
Binary files /dev/null and b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-5.png differ
diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-6.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-6.png
new file mode 100644
index 0000000000..8aab8a27a5
Binary files /dev/null and b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-6.png differ
diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-7.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-7.png
new file mode 100644
index 0000000000..35d487937f
Binary files /dev/null and b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-7.png differ
diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-8.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-8.png
new file mode 100644
index 0000000000..11a30cde0f
Binary files /dev/null and b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-8.png differ
diff --git a/mdop/mbam-v25/images/troubleshooting-MBAM-installation-9.png b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-9.png
new file mode 100644
index 0000000000..0c7ab8f429
Binary files /dev/null and b/mdop/mbam-v25/images/troubleshooting-MBAM-installation-9.png differ
diff --git a/mdop/mbam-v25/index.md b/mdop/mbam-v25/index.md
index 9e5c96e03d..3f71f9edd8 100644
--- a/mdop/mbam-v25/index.md
+++ b/mdop/mbam-v25/index.md
@@ -1,7 +1,7 @@
 ---
 title: Microsoft BitLocker Administration and Monitoring 2.5
 description: Microsoft BitLocker Administration and Monitoring 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: fd81d7de-b166-47e8-b6c7-d984830762b6
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
@@ -10,67 +10,61 @@ ms.prod: w10
 ms.date: 04/19/2017
 ---
 
-
 # Microsoft BitLocker Administration and Monitoring 2.5
 
-
 Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 provides a simplified administrative interface that you can use to manage BitLocker Drive Encryption. You configure MBAM Group Policy Templates that enable you to set BitLocker Drive Encryption policy options that are appropriate for your enterprise, and then use them to monitor client compliance with those policies. You can also report on the encryption status of an individual computer and on the enterprise as a whole. In addition, you can access recovery key information when users forget their PIN or password or when their BIOS or boot record changes. For a more detailed description of MBAM, see [About MBAM 2.5](about-mbam-25.md).
 
-To get the MBAM software, see [How Do I Get MDOP](https://go.microsoft.com/fwlink/?LinkId=322049) (https://go.microsoft.com/fwlink/?LinkId=322049).
+To obtain MBAM, see [How Do I Get MDOP](https://docs.microsoft.com/microsoft-desktop-optimization-pack/index#how-to-get-mdop).
 
-[Getting Started with MBAM 2.5](getting-started-with-mbam-25.md)
+## Outline
 
-[About MBAM 2.5](about-mbam-25.md)**|**[Release Notes for MBAM 2.5](release-notes-for-mbam-25.md)**|**[About MBAM 2.5 SP1](about-mbam-25-sp1.md)**|**[Release Notes for MBAM 2.5 SP1](release-notes-for-mbam-25-sp1.md)**|**[Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md)**|**[High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md)**|**[Accessibility for MBAM 2.5](accessibility-for-mbam-25.md)
+- [Getting Started with MBAM 2.5](getting-started-with-mbam-25.md)
+  - [About MBAM 2.5](about-mbam-25.md)
+  - [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md)
+  - [About MBAM 2.5 SP1](about-mbam-25-sp1.md)
+  - [Release Notes for MBAM 2.5 SP1](release-notes-for-mbam-25-sp1.md)
+  - [Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md)
+  - [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md)
+  - [Accessibility for MBAM 2.5](accessibility-for-mbam-25.md)
+- [Planning for MBAM 2.5](planning-for-mbam-25.md)
+  - [Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md)
+  - [MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md)
+  - [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md)
+  - [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md)
+  - [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md)
+  - [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md)
+  - [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)
+  - [Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md)
+  - [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md)
+  - [MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md)
+- [Deploying MBAM 2.5](deploying-mbam-25.md)
+  - [Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md)
+  - [Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md)
+  - [Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md)
+  - [MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md)
+  - [Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions](upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md)
+  - [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md)
+- [Operations for MBAM 2.5](operations-for-mbam-25.md)
+  - [Administering MBAM 2.5 Features](administering-mbam-25-features.md)
+  - [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md)
+  - [Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md)
+  - [Maintaining MBAM 2.5](maintaining-mbam-25.md)
+  - [Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md)
+- [Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md)
+- [Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md)
+  - [Client Event Logs](client-event-logs.md)
+  - [Server Event Logs](server-event-logs.md)
 
-[Planning for MBAM 2.5](planning-for-mbam-25.md)
-
-[Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md)**|**[MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md)**|**[Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md)**|**[Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md)**|**[Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md)**|**[Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md)**|**[MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)**|**[Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md)**|**[MBAM 2.5 Security Considerations](mbam-25-security-considerations.md)**|**[MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md)
-
-[Deploying MBAM 2.5](deploying-mbam-25.md)
-
-[Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md)**|**[Deploying MBAM 2.5 Group Policy Objects](deploying-mbam-25-group-policy-objects.md)**|**[Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md)**|**[MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md)**|**[Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions](upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md)**|**[Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md)
-
-[Operations for MBAM 2.5](operations-for-mbam-25.md)
-
-[Administering MBAM 2.5 Features](administering-mbam-25-features.md)**|**[Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md)**|**[Performing BitLocker Management with MBAM 2.5](performing-bitlocker-management-with-mbam-25.md)**|**[Maintaining MBAM 2.5](maintaining-mbam-25.md)**|**[Using Windows PowerShell to Administer MBAM 2.5](using-windows-powershell-to-administer-mbam-25.md)
-
-[Troubleshooting MBAM 2.5](troubleshooting-mbam-25.md)
-
-[Technical Reference for MBAM 2.5](technical-reference-for-mbam-25.md)
-
-[Client Event Logs](client-event-logs.md)**|**[Server Event Logs](server-event-logs.md)
-
-### More Information
-
--   [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md)
-
-    View updated product information and known issues for MBAM 2.5.
-
--   [MDOP TechCenter Page](https://go.microsoft.com/fwlink/p/?LinkId=225286)
-
-    Learn about the latest MDOP information and resources.
-
--   [MDOP Information Experience](https://go.microsoft.com/fwlink/p/?LinkId=236032)
-
-    Find documentation, videos, and other resources for MDOP technologies. You can also [send us feedback](mailto:MDOPDocs@microsoft.com) or learn about updates by following us on [Facebook](https://go.microsoft.com/fwlink/p/?LinkId=242445) or [Twitter](https://go.microsoft.com/fwlink/p/?LinkId=242447).
-
--   [MBAM Deployment Guide](https://www.microsoft.com/download/details.aspx?id=38398)
-
-    Get help in choosing a deployment method for MBAM, including step-by-step instructions for each method.
-
--   [Apply Hotfixes on MBAM 2.5 SP1 Server](apply-hotfix-for-mbam-25-sp1.md)
-
-    Guide of how to apply MBAM 2.5 SP1 Server hotfixes
-
-## Got a suggestion for MBAM?
-- Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
-- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
-
- 
-
- 
+## More Information
 
+- [MDOP Information Experience](index.md)
 
+  Find documentation, videos, and other resources for MDOP technologies.
 
+- [MBAM Deployment Guide](https://www.microsoft.com/download/details.aspx?id=38398)
 
+  Get help in choosing a deployment method for MBAM, including step-by-step instructions for each method.
+    
+- [Apply Hotfixes on MBAM 2.5 SP1 Server](apply-hotfix-for-mbam-25-sp1.md)
 
+  Guide of how to apply MBAM 2.5 SP1 Server hotfixes
diff --git a/mdop/mbam-v25/installing-the-mbam-25-server-software.md b/mdop/mbam-v25/installing-the-mbam-25-server-software.md
index 341600418b..d238b982fe 100644
--- a/mdop/mbam-v25/installing-the-mbam-25-server-software.md
+++ b/mdop/mbam-v25/installing-the-mbam-25-server-software.md
@@ -1,8 +1,11 @@
 ---
 title: Installing the MBAM 2.5 Server Software
 description: Installing the MBAM 2.5 Server Software
-author: jamiejdt
+author: dansimp
 ms.assetid: b9dbe697-5400-4bac-acfb-ee6dc6586c30
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -31,9 +34,9 @@ This topic describes how to install the Microsoft BitLocker Administration and M
 
 
          Review the MBAM 2.5 planning information
          
 
 
 
@@ -44,7 +47,7 @@ This topic describes how to install the Microsoft BitLocker Administration and M
 
 
 
- 
+ 
 
 ## Installing the MBAM 2.5 Server software by using the Microsoft BitLocker Administration and Monitoring Setup wizard
 
@@ -124,7 +127,7 @@ The following table describes the command-line parameters for installing the MBA
 
 
 
- 
+ 
 
 
 
@@ -135,7 +138,7 @@ The following table describes the command-line parameters for installing the MBA
 
 [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/maintaining-mbam-25.md b/mdop/mbam-v25/maintaining-mbam-25.md
index 6b07d362cf..56128367b9 100644
--- a/mdop/mbam-v25/maintaining-mbam-25.md
+++ b/mdop/mbam-v25/maintaining-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Maintaining MBAM 2.5
 description: Maintaining MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 44d398a0-2ca0-4d47-943c-322345409b59
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/mbam-25-deployment-checklist.md b/mdop/mbam-v25/mbam-25-deployment-checklist.md
index 8169a4c870..660b1ebf79 100644
--- a/mdop/mbam-v25/mbam-25-deployment-checklist.md
+++ b/mdop/mbam-v25/mbam-25-deployment-checklist.md
@@ -1,8 +1,11 @@
 ---
 title: MBAM 2.5 Deployment Checklist
 description: MBAM 2.5 Deployment Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 2ba7de17-e3a4-4798-99e0-cd1dc28c5b76
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 You can use this checklist to help you during Microsoft BitLocker Administration and Monitoring (MBAM) deployment with a Stand-alone topology.
 
-**Note**  
+**Note**  
 This checklist outlines the recommended steps and a high-level list of items to consider when you deploy Microsoft BitLocker Administration and Monitoring features. We recommend that you copy this checklist into a spreadsheet program and customize it for your use.
 
- 
+
 
 @@ -40,19 +43,19 @@ This checklist outlines the recommended steps and a high-level list of items to
 
-
+
-
+
-
+
@@ -65,37 +68,36 @@ This checklist outlines the recommended steps and a high-level list of items to
 
        • Configuration Manager Integration topology (needed only if you are running MBAM with this topology)
          • 
-Note  
-
          Note the names of the servers on which you configure each feature. You will use this information throughout the configuration process.
          
+Note
          Note the names of the servers on which you configure each feature. You will use this information throughout the configuration process.
          
 
          
- 
+
 
          
-
+
-
+
-
+
-
+
          
 

          
 Checklist box
 
          Review and complete all planning steps to prepare your environment for MBAM deployment.
          [MBAM 2.5 Planning Checklist](mbam-25-planning-checklist.md)
          MBAM 2.5 Planning Checklist
          		
 
          		
 
          
 
          
 Checklist box
 
          Review the supported configurations information to ensure that MBAM supports the selected client and server computers.
          [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)
          MBAM 2.5 Supported Configurations
          		
 
          		
 
          
 
          
 Checklist box
 
          Install the MBAM Server software.
          [Installing the MBAM 2.5 Server Software](installing-the-mbam-25-server-software.md)
          Installing the MBAM 2.5 Server Software
          		
 
          		
 
          
 
          
 
 
 
          [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md)
          Configuring the MBAM 2.5 Server Features
          		
 
          		
 
          
 
          
 Checklist box
 
          Validate the MBAM configuration.
          [Validating the MBAM 2.5 Server Feature Configuration](validating-the-mbam-25-server-feature-configuration.md)
          Validating the MBAM 2.5 Server Feature Configuration
          		
 
          		
 
          
 
          
 Checklist box
 
          Copy the MBAM Group Policy Template and edit the Group Policy settings.
          [Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md) and [Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md)
          Copying the MBAM 2.5 Group Policy Templates and Editing the MBAM 2.5 Group Policy Settings
          		
 
          		
 
          
 
          
 Checklist box
 
          Deploy the MBAM Client software.
          [Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md)
          Deploying the MBAM 2.5 Client
          		
 
          		
 
          
           
 
          
 
- 
+
 
 
 ## Related topics
@@ -103,9 +105,9 @@ This checklist outlines the recommended steps and a high-level list of items to
 
 [Deploying MBAM 2.5](deploying-mbam-25.md)
 
- 
 
- 
+
+
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/mbam-25-deployment-prerequisites.md b/mdop/mbam-v25/mbam-25-deployment-prerequisites.md
index fd80f252ae..aecfb3c56b 100644
--- a/mdop/mbam-v25/mbam-25-deployment-prerequisites.md
+++ b/mdop/mbam-v25/mbam-25-deployment-prerequisites.md
@@ -1,8 +1,11 @@
 ---
 title: MBAM 2.5 Deployment Prerequisites
 description: MBAM 2.5 Deployment Prerequisites
-author: jamiejdt
+author: dansimp
 ms.assetid: a7b02d01-d182-4031-b373-0271177af14e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/mbam-25-planning-checklist.md b/mdop/mbam-v25/mbam-25-planning-checklist.md
index a62ddee30b..015403224b 100644
--- a/mdop/mbam-v25/mbam-25-planning-checklist.md
+++ b/mdop/mbam-v25/mbam-25-planning-checklist.md
@@ -1,8 +1,11 @@
 ---
 title: MBAM 2.5 Planning Checklist
 description: MBAM 2.5 Planning Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: ffe11eb8-44db-4886-8300-6dffec8bcfa4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -37,92 +40,92 @@ You can use the following checklists to help you prepare your computing environm
 
 Checklist box
 
          Review the "Getting started" information to understand the product before you start deployment planning.
          
-
          [Getting Started with MBAM 2.5](getting-started-with-mbam-25.md)
          
+
          Getting Started with MBAM 2.5
          
 
          
 
 
 Checklist box
 
          Review the recommended high-level architecture for an MBAM deployment. You might also want to review an illustration and description of the individual parts (databases, websites, Reports) of an MBAM deployment.
          
-
          [High-Level Architecture for MBAM 2.5](high-level-architecture-for-mbam-25.md)
          
-
          [Illustrated Features of an MBAM 2.5 Deployment](illustrated-features-of-an-mbam-25-deployment.md)
          
+
          High-Level Architecture for MBAM 2.5
          
+
          Illustrated Features of an MBAM 2.5 Deployment
          
 
          
 
 
 Checklist box
 
          Review and complete the prerequisites for the MBAM Stand-alone and Configuration Manager Integration topologies.
          
-
          [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md)
          
+
          MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies
          
 
          
 
 
 Checklist box
 
          If you plan to use the Configuration Manager Integration topology, complete the additional prerequisites that apply only to this topology.
          
-
          [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md)
          
+
          MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology
          
 
          
 
 
 Checklist box
 
          Review and meet the MBAM 2.5 prerequisites for the MBAM Client.
          
-
          [Prerequisites for MBAM 2.5 Clients](prerequisites-for-mbam-25-clients.md)
          
+
          Prerequisites for MBAM 2.5 Clients
          
 
          
 
 
 Checklist box
 
          Plan for and configure MBAM Group Policy requirements.
          
-
          [Planning for MBAM 2.5 Group Policy Requirements](planning-for-mbam-25-group-policy-requirements.md)
          
+
          Planning for MBAM 2.5 Group Policy Requirements
          
 
          
 
 
 Checklist box
 
          Plan for and create the necessary Active Directory Domain Services security groups.
          
-
          [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md)
          
+
          Planning for MBAM 2.5 Groups and Accounts
          
 
          
 
 
 Checklist box
 
          Plan how you will secure the MBAM websites.
          
-
          [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md)
          
+
          Planning How to Secure the MBAM Websites
          
 
          
 
 
 Checklist box
 
          Review the MBAM Supported Configurations to ensure that your hardware meets the installation system requirements.
          
-
          [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)
          
+
          MBAM 2.5 Supported Configurations
          
 
          
 
 
 Checklist box
 
          Review the considerations for deploying the MBAM Server features.
          
-
          [Planning for MBAM 2.5 Server Deployment](planning-for-mbam-25-server-deployment.md)
          
+
          Planning for MBAM 2.5 Server Deployment
          
 
          
 
 
 Checklist box
 
          Review the considerations for deploying the MBAM Client.
          
-
          [Planning for MBAM 2.5 Client Deployment](planning-for-mbam-25-client-deployment.md)
          
+
          Planning for MBAM 2.5 Client Deployment
          
 
          
 
 
 Checklist box
 
          Review the requirements and steps to deploy MBAM in a highly available configuration.
          
-
          [Planning for MBAM 2.5 High Availability](planning-for-mbam-25-high-availability.md)
          
+
          Planning for MBAM 2.5 High Availability
          
 
          
 
 
 Checklist box
 
          Review the MBAM security considerations that pertain to the Trusted Platform Module, log files, and transparent data encryption.
          
-
          [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md)
          
+
          MBAM 2.5 Security Considerations
          
 
          
 
 
 Checklist box
 
          Optionally, review the steps to evaluate MBAM in a test environment.
          
-
          [Evaluating MBAM 2.5 in a Test Environment](evaluating-mbam-25-in-a-test-environment.md)
          
+
          Evaluating MBAM 2.5 in a Test Environment
          
 
          
 
 
 
 
- 
+ 
 
 
 ## Related topics
@@ -130,9 +133,9 @@ You can use the following checklists to help you prepare your computing environm
 
 [Planning for MBAM 2.5](planning-for-mbam-25.md)
 
- 
+ 
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/mbam-25-security-considerations.md b/mdop/mbam-v25/mbam-25-security-considerations.md
index 37c627b035..05695a6beb 100644
--- a/mdop/mbam-v25/mbam-25-security-considerations.md
+++ b/mdop/mbam-v25/mbam-25-security-considerations.md
@@ -1,8 +1,11 @@
 ---
 title: MBAM 2.5 Security Considerations
 description: MBAM 2.5 Security Considerations
-author: jamiejdt
+author: dansimp
 ms.assetid: f6613c63-b32b-45fb-a6e8-673d6dae7d16
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -69,14 +72,14 @@ To enable MBAM to escrow and then store TPM OwnerAuth passwords, you must config
 
 
 
- 
+ 
 
 The location of these Group Policy settings is **Computer Configuration** > **Administrative Templates** > **System** > **Trusted Platform Module Services**.
 
 **Note**  
 Windows removes the OwnerAuth locally after MBAM successfully escrows it with these settings.
 
- 
+ 
 
 ### Escrowing TPM OwnerAuth in Windows 7
 
@@ -117,7 +120,7 @@ To create user-to-computer associations after you have installed the MBAM server
 **Note**  
 The MBAM agent will override user-to-computer associations when that computer begins reporting up to the server.
 
- 
+ 
 
 **Prerequisites:** The Read-AD\* cmdlets can retrieve information from AD only if they are either run as a highly privileged user account, such as a Domain Administrator, or run as an account in a custom security group granted read access to the information (recommended).
 
@@ -131,7 +134,7 @@ You can configure the MBAM Recovery and Hardware Service with the name of this s
 
 -   Configure the group after the MBAM Recovery and Hardware Service has been installed by editing the web.config file in the <inetpub>\\Microsoft Bitlocker Management Solution\\Recovery and Hardware Service\\ folder.
 
-    ``` syntax
+    ```xml
     
     ```
 
@@ -168,7 +171,7 @@ The Read-AD\* cmdlets do not have the ability to discover the user accounts that
 
 -   Users who are not in the MBAM Advanced Helpdesk Users security group as defined during installation, recovering on behalf of other users
 
- 
+ 
 
 ## Configure MBAM to automatically unlock the TPM after a lockout
 
@@ -178,7 +181,7 @@ You can configure MBAM 2.5 SP1 to automatically unlock the TPM in case of a lock
 **Important**  
 To enable TPM lockout auto reset, you must configure this feature on both the server side and in Group Policy on the client side.
 
- 
+ 
 
 -   To enable TPM lockout auto reset on the client side, configure the Group Policy setting "Configure TPM lockout auto reset" located at **Computer Configuration** > **Administrative Templates** > **Windows Components** > **MDOP MBAM** > **Client Management**.
 
@@ -193,7 +196,7 @@ TPM lockout auto reset is disabled by default.
 **Note**  
 TPM lockout auto reset is only supported on computers running TPM version 1.2. TPM 2.0 provides built-in lockout auto reset functionality.
 
- 
+ 
 
 **The Recovery Audit Report** includes events related to TPM lockout auto reset. If a request is made from the MBAM client to retrieve a TPM OwnerAuth password, an event is logged to indicate recovery. Audit entries will include the following events:
 
@@ -224,7 +227,7 @@ TPM lockout auto reset is only supported on computers running TPM version 1.2. T
 
 
 
- 
+ 
 
 ## Secure connections to SQL Server
 
@@ -302,11 +305,11 @@ For an example of how to enable TDE for MBAM database instances, see [Understand
 
 [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md)
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md b/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md
index 0dc592b269..b95c5a854c 100644
--- a/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md
+++ b/mdop/mbam-v25/mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md
@@ -1,8 +1,11 @@
 ---
 title: MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies
 description: MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies
-author: jamiejdt
+author: dansimp
 ms.assetid: 76a6047a-5c6e-42ff-af09-a6f382a69537
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -20,10 +23,10 @@ If you are deploying MBAM with System Center Configuration Manager, you must com
 
 For a list of the supported hardware and operating systems for MBAM, see [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md).
 
-**Important**  
+**Important**  
 If BitLocker was used without MBAM, you must decrypt the drive and then clear TPM using tpm.msc. MBAM cannot take ownership of TPM if the client PC is already encrypted and the TPM owner password created.
 
- 
+
 
 ## Required MBAM roles and accounts
 
@@ -42,12 +45,12 @@ If BitLocker was used without MBAM, you must decrypt the drive and then clear TP
 
 
 
          Groups created in Active Directory Domain Services (AD DS)
          
-
          See [Planning for MBAM 2.5 Groups and Accounts](planning-for-mbam-25-groups-and-accounts.md) for a description of these groups and accounts.
          
+
          See Planning for MBAM 2.5 Groups and Accounts for a description of these groups and accounts.
          
 
 
 
 
- 
+
 
 ## Prerequisites for the Recovery Database
 
@@ -67,7 +70,7 @@ If BitLocker was used without MBAM, you must decrypt the drive and then clear TP
 
 
          Supported version of SQL Server
          
 
          Install Microsoft SQL Server with SQL_Latin1_General_CP1_CI_AS collation.
          
-
          See [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) for supported versions.
          
+
          See MBAM 2.5 Supported Configurations for supported versions.
          
 
 
 
          Required SQL Server permissions
          
@@ -87,13 +90,12 @@ If BitLocker was used without MBAM, you must decrypt the drive and then clear TP
 
 
 
          Optional - Install the Transparent Data Encryption (TDE) feature available in SQL Server
          
-
          The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with laws, regulations, and guidelines that apply to various industries.
          
+
          The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with laws, regulations, and guidelines that apply to various industries.
          
 
          
-Note  
-
          TDE performs real-time decryption of database information. This means that, if you are viewing recovery key information in the SQL Server database and you are logged on under an account that has permissions to the database, the recovery key information is visible. To read more about TDE, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md).
          
+Note
          TDE performs real-time decryption of database information. This means that, if you are viewing recovery key information in the SQL Server database and you are logged on under an account that has permissions to the database, the recovery key information is visible. To read more about TDE, see MBAM 2.5 Security Considerations.
          
 
          
 
          
- 
+
 
          
 
 
@@ -107,7 +109,7 @@ If BitLocker was used without MBAM, you must decrypt the drive and then clear TP
 
 
 
- 
+
 
 ## Prerequisites for the Compliance and Audit Database
 
@@ -127,7 +129,7 @@ If BitLocker was used without MBAM, you must decrypt the drive and then clear TP
 
 
          Supported version of SQL Server
          
 
          Install SQL Server with SQL_Latin1_General_CP1_CI_AS collation.
          
-
          See [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) for supported versions.
          
+
          See MBAM 2.5 Supported Configurations for supported versions.
          
 
 
 
          Required SQL Server permissions
          
@@ -147,8 +149,8 @@ If BitLocker was used without MBAM, you must decrypt the drive and then clear TP
 
 
 
          Optional - Install the Transparent Data Encryption (TDE) feature in SQL Server
          
-
          The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with laws, regulations, and guidelines that apply to various industries.
          
-
          TDE performs real-time decryption of database information. This means that, if you are viewing recovery key information in the SQL Server database and you are logged on under an account that has permissions to the database, the recovery key information is visible. To read more about TDE, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md).
          
+
          The TDE SQL Server feature performs real-time I/O encryption and decryption of the data and log files, which can help you to comply with laws, regulations, and guidelines that apply to various industries.
          
+
          TDE performs real-time decryption of database information. This means that, if you are viewing recovery key information in the SQL Server database and you are logged on under an account that has permissions to the database, the recovery key information is visible. To read more about TDE, see MBAM 2.5 Security Considerations.
          
 
 
 
          SQL Server Database Engine Services
          
@@ -161,7 +163,7 @@ If BitLocker was used without MBAM, you must decrypt the drive and then clear TP
 
 
 
- 
+
 
 ## Prerequisites for the Reports
 
@@ -181,7 +183,7 @@ If BitLocker was used without MBAM, you must decrypt the drive and then clear TP
 
 
          Supported version of SQL Server
          
 
          Install SQL Server with SQL_Latin1_General_CP1_CI_AS collation.
          
-
          See [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) for supported versions.
          
+
          See MBAM 2.5 Supported Configurations for supported versions.
          
 
 
 
          SQL Server Reporting Services (SSRS)
          
@@ -203,7 +205,7 @@ If BitLocker was used without MBAM, you must decrypt the drive and then clear TP
 
 
 
- 
+
 
 ## Prerequisites for the Administration and Monitoring Server
 
@@ -258,22 +260,22 @@ The following table lists the installation prerequisites for the MBAM Administra
 
          Windows Server Features
          
 
          .NET Framework 4.5 features:
          
 
            
-
          • .NET Framework 4.5
            
+
          • .NET Framework 4.5 or 4.6
            
 
              
+
            • Windows Server 2016 - .NET Framework 4.6 is already installed for these versions of Windows Server, but you must enable it.
              •   
 
            • Windows Server 2012 or Windows Server 2012 R2 - .NET Framework 4.5 is already installed for these versions of Windows Server, but you must enable it.
              • 
-
            • Windows Server 2008 R2 - .NET Framework 4.5 is not included with Windows Server 2008 R2, so you must [download Microsoft .NET Framework 4.5](https://go.microsoft.com/fwlink/?LinkId=392318) and install it separately.
              
+
            • Windows Server 2008 R2 - .NET Framework 4.5 is not included with Windows Server 2008 R2, so you must download Microsoft .NET Framework 4.5 and install it separately.
              
 
              
-Note  
-
              If you are upgrading from MBAM 2.0 or MBAM 2.0 SP1 and need to install .NET Framework 4.5, see [Release Notes for MBAM 2.5](release-notes-for-mbam-25.md) for an additional required step to make the websites work.
              
+Note
              If you are upgrading from MBAM 2.0 or MBAM 2.0 SP1 and need to install .NET Framework 4.5, see Release Notes for MBAM 2.5 for an additional required step to make the websites work.
              
 
              
 
              
- 
+
 
              • 
 
            • 
 
          • WCF Activation
            
 
              
 
            • HTTP Activation
              • 
-
            • Non-HTTP Activation
              
+
            • Non-HTTP Activation (Only for Windows Server 2008, 2012, and 2012 R2)
              
 
              • 
 
            • 
 
          • TCP Activation
            • 
@@ -286,30 +288,29 @@ The following table lists the installation prerequisites for the MBAM Administra
 
          
 
 
-
          ASP.NET MVC 4.0
          
-
          [ASP.NET MVC 4 download](https://go.microsoft.com/fwlink/?LinkId=392271)
          
+
          ASP.NET MVC 4.0
          
+
          ASP.NET MVC 4 download
          
 
 
 
          Service Principal Name (SPN)
          
 
          The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools.
          
-
          If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See [Setspn](https://technet.microsoft.com/library/cc731241.aspx) for information about the rights required to create SPNs.
          
+
          If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See Setspn for information about the rights required to create SPNs.
          
 
          If you do not have administrative rights to create SPNs, you must ask the Active Directory administrators in your organization to create the SPN for you by using the following command.
          
 
          Setspn -s http/mbamvirtual contoso\mbamapppooluser
 Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser
          
 
          In the code example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pools is contoso\mbamapppooluser.
          
 
          
-Note  
-
          If you are setting up Load Balancing, use the same application pool account on all servers.
          
+Note
          If you are setting up Load Balancing, use the same application pool account on all servers.
          
 
          
 
          
- 
+
 
          
-
          For more information about registering SPNs for fully qualified, NetBIOS, and custom host names, see [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md).
          
+
          For more information about registering SPNs for fully qualified, NetBIOS, and custom host names, see Planning How to Secure the MBAM Websites.
          
 
 
 
 
- 
+
 
 ## Prerequisites for the Self-Service Portal
 
@@ -328,11 +329,11 @@ Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser
    
 
 
 
    Supported version of Windows Server
    
-
    See [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md) for supported versions.
    
+
    See MBAM 2.5 Supported Configurations for supported versions.
    
 
 
-
    ASP.NET MVC 4.0
    
-
    [ASP.NET MVC 4 download](https://go.microsoft.com/fwlink/?LinkId=392271)
    
+
    ASP.NET MVC 4.0
    
+
    ASP.NET MVC 4 download
    
 
 
 
    Web Service IIS Management Tools
    
@@ -341,24 +342,23 @@ Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser
    
 
 
    Service Principal Name (SPN)
    
 
    The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools.
    
-
    If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See [Setspn](https://technet.microsoft.com/library/cc731241.aspx) for information about the rights required to create SPNs.
    
+
    If your administrative rights permit you to create SPNs in Active Directory Domain Services, MBAM creates the SPN for you. See Setspn for information about the rights required to create SPNs.
    
 
    If you do not have administrative rights to create SPNs, you must ask the Active Directory administrators in your organization administrators in your organization to create the SPN for you by using the following command.
    
 
    Setspn -s http/mbamvirtual contoso\mbamapppooluser
 Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser
    
 
    In the code example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pools is contoso\mbamapppooluser.
    
 
    
-Note  
-
    If you are setting up Load Balancing, use the same application pool account on all servers.
    
+Note
    If you are setting up Load Balancing, use the same application pool account on all servers.
    
 
    
 
    
- 
+
 
    
-
    For more information about registering SPNs for fully qualified, NetBIOS, and custom host names, see [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md).
    
+
    For more information about registering SPNs for fully qualified, NetBIOS, and custom host names, see Planning How to Secure the MBAM Websites.
    
 
 
 
 
- 
+
 
 ## Prerequisites for the Management Workstation
 
@@ -376,7 +376,7 @@ Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser
    
 
 
 
-
    Before installing the MBAM Client, download the MBAM Group Policy Templates from [How to Get MDOP Group Policy (.admx) Templates](https://go.microsoft.com/fwlink/p/?LinkId=393941) and configure them with the settings that you want to implement in your enterprise for BitLocker Drive Encryption.
    
+
    Before installing the MBAM Client, download the MBAM Group Policy Templates from How to Get MDOP Group Policy (.admx) Templates and configure them with the settings that you want to implement in your enterprise for BitLocker Drive Encryption.
    
 
    Before installing the MBAM Client, do the following:
    
 @@ -392,20 +392,20 @@ Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser
-
+
-
+
    
 

 
 
    
 
    Copy the MBAM Group Policy Templates
    [Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md)
    Copying the MBAM 2.5 Group Policy Templates
    		
 
    
 
    
 
    Edit the Group Policy settings
    [Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md)
    Editing the MBAM 2.5 Group Policy Settings
    		
 
    
     
 
    
-
     
    
+
     
    
 
 
 
 
- 
+
 
 
 
@@ -418,9 +418,9 @@ Setspn -s http/mbamvirtual.contoso.com contoso\mbamapppooluser
    
 
 [MBAM 2.5 Supported Configurations](mbam-25-supported-configurations.md)
 
- 
 
- 
+
+
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md b/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md
index 93707f9f9d..58cc6cf2fe 100644
--- a/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md
+++ b/mdop/mbam-v25/mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md
@@ -1,8 +1,11 @@
 ---
 title: MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology
 description: MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology
-author: jamiejdt
+author: dansimp
 ms.assetid: 74180d8d-7b0f-460f-b301-53595cde8381
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/mbam-25-supported-configurations.md b/mdop/mbam-v25/mbam-25-supported-configurations.md
index 070552040e..95405633b3 100644
--- a/mdop/mbam-v25/mbam-25-supported-configurations.md
+++ b/mdop/mbam-v25/mbam-25-supported-configurations.md
@@ -1,8 +1,11 @@
 ---
 title: MBAM 2.5 Supported Configurations
 description: MBAM 2.5 Supported Configurations
-author: shortpatti
+author: dansimp
 ms.assetid: ce689aff-9a55-4ae7-a968-23c7bda9b4d6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -18,10 +21,10 @@ You can run Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 in a St
 
 For additional configurations that are specific to the Configuration Manager Integration topology, see [Versions of Configuration Manager that MBAM supports](#bkmk-cm-ramreqs).
 
-**Note**  
+**Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+
 
 ## MBAM Supported Languages
 
@@ -84,7 +87,7 @@ The following tables show the languages that are supported for the MBAM Client (
 
 
 
- 
+
 
 **Supported Languages in MBAM 2.5:**
 
@@ -131,14 +134,14 @@ The following tables show the languages that are supported for the MBAM Client (
 
 
 
- 
+
 
 ##  MBAM Server system requirements
 
 
 ### MBAM Server operating system requirements
 
-We strongly recommend that you run the MBAM Client and MBAM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on.
+We strongly recommend that you run the MBAM Client and MBAM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on.
 
 The following table lists the operating systems that are supported for the MBAM Server installation.
 
@@ -159,7 +162,7 @@ The following table lists the operating systems that are supported for the MBAM
 
 
 
-
    Windows Server 2016
    
+
    Windows Server 2016
    
 
    Standard or Datacenter
    
 
 
    64-bit
    
@@ -177,7 +180,7 @@ The following table lists the operating systems that are supported for the MBAM
 
    64-bit
    
 
 
-
    Windows Server 2008 R2
    
+
    Windows Server 2008 R2
    
 
    Standard, Enterprise, or Datacenter
    
 
    SP1
    
 
    64-bit
    
@@ -185,7 +188,7 @@ The following table lists the operating systems that are supported for the MBAM
 
 
 
- 
+
 
 The enterprise domain must contain at least one Windows Server 2008 (or later) domain controller.
 
@@ -225,7 +228,7 @@ These requirements are for the MBAM Stand-alone topology. For the requirements f
 
 
 
- 
+
 
 ### MBAM Server processor, RAM, and disk space requirements - Configuration Manager Integration topology
 
@@ -263,7 +266,7 @@ The following table lists the server processor, RAM, and disk space requirements
 
 
 
- 
+
 
 ### Versions of Configuration Manager that MBAM supports
 
@@ -283,8 +286,14 @@ MBAM supports the following versions of Configuration Manager.
 
 
 
+
+
    Microsoft System Center Configuration Manager (Current Branch), versions up to 1902
    
+
    
+
    64-bit
    
+
+
 
-
    Microsoft System Center Configuration Manager (Current Branch), versions up to 1806
    
+
    Microsoft System Center Configuration Manager 1806
    
 
    
 
    64-bit
    
 
@@ -294,7 +303,7 @@ MBAM supports the following versions of Configuration Manager.
 
    64-bit
    
 
 
-
    Microsoft System Center 2012 Configuration Manager
    
+
    Microsoft System Center 2012 Configuration Manager
    
 
    SP1
    
 
    64-bit
    
 
@@ -303,21 +312,21 @@ MBAM supports the following versions of Configuration Manager.
 
    
 
    64-bit
    
 
->**Note** Although Configuration Manager 2007 R2 is 32 bit, you must install it and SQL Server on a 64-bit operating system in order to match the 64-bit MBAM software.
+>Note Although Configuration Manager 2007 R2 is 32 bit, you must install it and SQL Server on a 64-bit operating system in order to match the 64-bit MBAM software.
 
 
 
 
 
- 
+
 
 For a list of supported configurations for the Configuration Manager Server, see the appropriate TechNet documentation for the version of Configuration Manager that you are using. MBAM has no additional system requirements for the Configuration Manager Server.
 
-### SQL Server database requirements
+### SQL Server database requirements
 
 The following table lists the Microsoft SQL Server versions that are supported for the MBAM Server features, which include the Recovery Database, Compliance and Audit Database, and the Reports feature. The required versions apply to the Stand-alone or the Configuration Manager Integration topologies.
 
-You must install SQL Server with the **SQL\_Latin1\_General\_CP1\_CI\_AS** collation.
+You must install SQL Server with the **SQL\_Latin1\_General\_CP1\_CI\_AS** collation.
 
 @@ -339,24 +348,23 @@ You must install SQL Server with the **SQL\_Latin1\_General\_CP1\_CI\_AS** coll
 
-    
-
+
    
-https://www.microsoft.com/en-us/download/details.aspx?id=54967
+https://www.microsoft.com/download/details.aspx?id=54967
-
+
-
+
@@ -365,8 +373,8 @@ https://www.microsoft.com/en-us/download/details.aspx?id=54967
    
 

    Microsoft SQL Server 2017
    		
 
    Standard, Enterprise, or Datacenter
    		
 
    64-bit
    64-bit
    
 
    Microsoft SQL Server 2016
    		
 
    Standard, Enterprise, or Datacenter
    		
 
    SP1
    64-bit
    64-bit
    		
 
    
 
    Microsoft SQL Server 2014
    		
 
    Standard, Enterprise, or Datacenter
    		
 
    SP1, SP2
    		
 
    64-bit
    		
 
    Microsoft SQL Server 2012
    Microsoft SQL Server 2012
    		
 
    Standard, Enterprise, or Datacenter
    		
 
    SP3
    		
 
    64-bit
    		
 
    Microsoft SQL Server 2008 R2
    Microsoft SQL Server 2008 R2
    		
 
    Standard or Enterprise
    		
 
    SP3
    		
 
    64-bit
    		<
 
    
 
 **Note**  
-In order to support SQL 2016 you must install the March 2017 Servicing Release for MDOP https://www.microsoft.com/en-us/download/details.aspx?id=54967  and to support SQL 2017 you must install the July 2018 Servicing Release for MDOP https://www.microsoft.com/en-us/download/details.aspx?id=57157. In general stay current by always using the most recent servicing update as it also includes all bugfixes and new features.
- 
+In order to support SQL 2016 you must install the March 2017 Servicing Release for MDOP https://www.microsoft.com/download/details.aspx?id=54967  and to support SQL 2017 you must install the July 2018 Servicing Release for MDOP https://www.microsoft.com/download/details.aspx?id=57157. In general stay current by always using the most recent servicing update as it also includes all bugfixes and new features.
+
 
 ### SQL Server processor, RAM, and disk space requirements – Stand-alone topology
 
@@ -404,7 +412,7 @@ The following table lists the recommended server processor, RAM, and disk space
 
 
 
- 
+
 
 ### SQL Server processor, RAM, and disk space requirements - Configuration Manager Integration topology
 
@@ -442,14 +450,14 @@ The following table lists the server processor, RAM, and disk space requirements
 
 
 
- 
+
 
 ##  MBAM Client system requirements
 
 
 ### Client operating system requirements
 
-We strongly recommend that you run the MBAM Client and MBAM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on.
+We strongly recommend that you run the MBAM Client and MBAM Server on the same line of operating systems. For example, Windows 10 with Windows Server 2016, Windows 8.1 with Windows Server 2012 R2, and so on.
 
 The following table lists the operating systems that are supported for MBAM Client installation. The same requirements apply to the Stand-alone and the Configuration Manager Integration topologies.
 
@@ -474,8 +482,7 @@ The following table lists the operating systems that are supported for MBAM Clie
     
    Enterprise
    
     
    
     
    32-bit or 64-bit
    
-  
-
+
    
 
    Windows 10
    
 
    Enterprise
    
 
    
@@ -488,7 +495,7 @@ The following table lists the operating systems that are supported for MBAM Clie
 
    32-bit or 64-bit
    
 
 
-
    Windows 7
    
+
    Windows 7
    
 
    Enterprise or Ultimate
    
 
    SP1
    
 
    32-bit or 64-bit
    
@@ -502,7 +509,7 @@ The following table lists the operating systems that are supported for MBAM Clie
 
 
 
- 
+
 
 ### Client RAM requirements
 
@@ -548,7 +555,7 @@ The following table lists the operating systems that are supported for MBAM Grou
 
    32-bit or 64-bit
    
 
 
-
    Windows 7
    
+
    Windows 7
    
 
    Enterprise, or Ultimate
    
 
    SP1
    
 
    32-bit or 64-bit
    
@@ -566,7 +573,7 @@ The following table lists the operating systems that are supported for MBAM Grou
 
    64-bit
    
 
 
-
    Windows Server 2008 R2
    
+
    Windows Server 2008 R2
    
 
    Standard, Enterprise, or Datacenter
    
 
    SP1
    
 
    64-bit
    
@@ -591,6 +598,7 @@ The MBAM client is not supported on virtual machines and is also not supported o
 - [September 2017](https://support.microsoft.com/en-ie/help/4041137/september-2017-servicing-release-for-microsoft-desktop-optimization)
 - [March 2018](https://support.microsoft.com/help/4074878/march-2018-servicing-release-for-microsoft-desktop-optimization-pack)
 - [July 2018](https://support.microsoft.com/help/4340040/july-2018-servicing-release-for-microsoft-desktop-optimization-pack)
+- [May 2019](https://support.microsoft.com/help/4505175/may-2019-servicing-release-for-microsoft-desktop-optimization-pack)
 
 ## Related topics
 
@@ -599,9 +607,9 @@ The MBAM client is not supported on virtual machines and is also not supported o
 
 [Preparing your Environment for MBAM 2.5](preparing-your-environment-for-mbam-25.md)
 
- 
 
- 
+
+
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md b/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md
index e7f1395a8b..45f2ee0794 100644
--- a/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md
+++ b/mdop/mbam-v25/monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Monitoring and Reporting BitLocker Compliance with MBAM 2.5
 description: Monitoring and Reporting BitLocker Compliance with MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 24a3bccd-8b67-4baa-a181-e4572eaba5bf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md b/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md
index 6376939620..6a03158661 100644
--- a/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md
+++ b/mdop/mbam-v25/monitoring-web-service-request-performance-counters.md
@@ -1,8 +1,11 @@
 ---
 title: Monitoring Web Service Request Performance Counters
 description: Monitoring Web Service Request Performance Counters
-author: jamiejdt
+author: dansimp
 ms.assetid: bdb812a1-465a-4098-b4c0-cb99890d1b0d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md b/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md
index 00fdddca93..75b47a4907 100644
--- a/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md
+++ b/mdop/mbam-v25/moving-mbam-25-features-to-another-server.md
@@ -1,8 +1,11 @@
 ---
 title: Moving MBAM 2.5 Features to Another Server
 description: Moving MBAM 2.5 Features to Another Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 9767a0e4-e8ab-49f0-98c5-5cd671975501
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/operations-for-mbam-25.md b/mdop/mbam-v25/operations-for-mbam-25.md
index 5a895028c3..e318d1bba3 100644
--- a/mdop/mbam-v25/operations-for-mbam-25.md
+++ b/mdop/mbam-v25/operations-for-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Operations for MBAM 2.5
 description: Operations for MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: da0e35be-2dc4-4a24-b69a-530436eb48fc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md b/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md
index 37802d9fc1..d6ef03091b 100644
--- a/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md
+++ b/mdop/mbam-v25/performing-bitlocker-management-with-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Performing BitLocker Management with MBAM 2.5
 description: Performing BitLocker Management with MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 068f3ee0-300c-4083-ba18-7065eef997ad
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md b/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md
index 54bddfa55e..6fce394daa 100644
--- a/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md
+++ b/mdop/mbam-v25/planning-for-mbam-25-client-deployment.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for MBAM 2.5 Client Deployment
 description: Planning for MBAM 2.5 Client Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 23c89976-af24-4753-9412-ce0ea42d1964
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -23,7 +26,7 @@ If you deploy MBAM with the Configuration Manager Integration topology, you can
 **Note**  
 Windows To Go is not supported for the Configuration Manager Integration topology installation when you are using Configuration Manager 2007.
 
- 
+ 
 
 ## Deploying the MBAM Client to enable BitLocker Drive Encryption after computer distribution to end users
 
@@ -33,14 +36,14 @@ After you configure Group Policy, you can use an enterprise software deployment
 **Note**  
 Beginning in MBAM 2.5 SP1, a separate MSI is no longer included with the MBAM product. However, you can extract the MSI from the executable file (.exe) that is included with the product.
 
- 
+ 
 
 When you deploy the MBAM Client after you distribute computers to client computers, end users are prompted to encrypt their computer. This action enables MBAM to collect the data, which includes the PIN and password (if required by policy), and then to begin the encryption process.
 
 **Note**  
 In this approach, end users who have computers with a TPM chip are prompted to activate and initialize the TPM chip if the chip has not been previously activated.
 
- 
+ 
 
 ## Using the MBAM Client to enable BitLocker Drive Encryption before computer distribution to end users
 
@@ -52,7 +55,7 @@ If your organization wants to use the TPM chip to encrypt computers, the adminis
 **Note**  
 The TPM protector option requires the administrator to accept the BIOS prompt to activate and initialize the TPM before the computer is delivered to the end user.
 
- 
+ 
 
 ## MBAM Client support for Encrypted Hard Drives
 
@@ -67,9 +70,9 @@ MBAM supports BitLocker on Encrypted Hard Drives that meet TCG specification req
 
 [Deploying the MBAM 2.5 Client](deploying-the-mbam-25-client.md)
 
- 
+ 
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
diff --git a/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md b/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md
index c016d3779d..9003490cee 100644
--- a/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md
+++ b/mdop/mbam-v25/planning-for-mbam-25-group-policy-requirements.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for MBAM 2.5 Group Policy Requirements
 description: Planning for MBAM 2.5 Group Policy Requirements
-author: jamiejdt
+author: dansimp
 ms.assetid: 82d545dc-3fbf-4b46-b62f-47fe178a7c44
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -41,7 +44,7 @@ MBAM supports the following types of BitLocker protectors.
 
  • TPM + USB key – supported only when the operating system volume is encrypted before MBAM is installed
    • 
 
  • TPM + PIN + USB key - supported only when the operating system volume is encrypted before MBAM is installed
    • 
 
  • Password - supported only for Windows To Go devices, fixed data drives, and Windows 8, Windows 8.1, and Windows 10 devices that do not have a TPM
    • 
-
  • Numerical password - applied automatically as part of volume encryption and does not need to be configured except in FIPS mode on Windows 7
    • 
+
  • Numerical password - applied automatically as part of volume encryption and does not need to be configured except in FIPS mode on Windows 7
    • 
 
  • Data recovery agent (DRA)
    • 
 
 
@@ -50,7 +53,7 @@ MBAM supports the following types of BitLocker protectors.
 
      
 
    • Password
      • 
 
    • Auto-unlock
      • 
-
    • Numerical password - applied automatically as part of volume encryption and does not need to be configured except in FIPS mode on Windows 7
      • 
+
    • Numerical password - applied automatically as part of volume encryption and does not need to be configured except in FIPS mode on Windows 7
      • 
 
    • Data recovery agent (DRA)
      • 
 
    
 
@@ -66,7 +69,7 @@ MBAM supports the following types of BitLocker protectors.
 
 
 
- 
+
 
 ### Support for the Used Space Encryption BitLocker policy
 
@@ -92,27 +95,27 @@ When you are ready to configure the MBAM Group Policy settings you want, do the
 
 
 
-
    Copy the MBAM Group Policy Templates from [How to Get MDOP Group Policy (.admx) Templates](https://go.microsoft.com/fwlink/p/?LinkId=393941) and install them on a computer that is capable of running the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM).
    
-
    [Copying the MBAM 2.5 Group Policy Templates](copying-the-mbam-25-group-policy-templates.md)
    
+
    Copy the MBAM Group Policy Templates from How to Get MDOP Group Policy (.admx) Templates and install them on a computer that is capable of running the Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM).
    
+
    Copying the MBAM 2.5 Group Policy Templates
    
 
 
 
    Configure the Group Policy settings that you want to use in your enterprise.
    
-
    [Editing the MBAM 2.5 Group Policy Settings](editing-the-mbam-25-group-policy-settings.md)
    
+
    Editing the MBAM 2.5 Group Policy Settings
    
 
 
 
 
- 
+
 
 ## Descriptions of the MBAM Group Policy settings
 
 
 The **MDOP MBAM (BitLocker Management)** GPO node contains four global policy settings and four child GPO nodes: **Client Management**, **Fixed Drive**, **Operating System Drive**, and **Removable Drive**. The following sections describe and suggest settings for the MBAM Group Policy settings.
 
-**Important**  
+**Important**  
 Do not change the Group Policy settings in the **BitLocker Drive Encryption** node, or MBAM will not work correctly. MBAM automatically configures the settings in this node for you when you configure the settings in the **MDOP MBAM (BitLocker Management)** node.
 
- 
+
 
 ### Global Group Policy definitions
 
@@ -136,14 +139,13 @@ This section describes MBAM Global Group Policy definitions at the following GPO
 
    Configure this policy to use a specific encryption method and cipher strength.
    
 
    When this policy is not configured, BitLocker uses the default encryption method: AES 128-bit with Diffuser.
    
 
    
-Note  
-
    An issue with the BitLocker Computer Compliance report causes it to display "unknown" for the cipher strength, even if you are using the default value. To work around this issue, make sure you enable this setting and set a value for cipher strength.
    
+Note
    An issue with the BitLocker Computer Compliance report causes it to display "unknown" for the cipher strength, even if you are using the default value. To work around this issue, make sure you enable this setting and set a value for cipher strength.
    
 
    
 
    
- 
+
 
    
 
      
-
    • AES 128-bit with Diffuser – for Windows 7 only
      • 
+
    • AES 128-bit with Diffuser – for Windows 7 only
      • 
 
    • AES 128 for Windows 8, Windows 8.1, and Windows 10
      • 
 
    
 
@@ -169,7 +171,7 @@ This section describes MBAM Global Group Policy definitions at the following GPO
 
 
 
- 
+
 
 ### Client Management Group Policy definitions
 
@@ -209,14 +211,13 @@ You can set the same Group Policy settings for the Stand-alone and System Center
 
    Configure user exemption policy
    
 
    Suggested configuration: Not Configured
    
 
    This policy setting lets you configure a website address, email address, or phone number that instructs a user to request an exemption from BitLocker encryption.
    
-
    If you enable this policy setting and provide a website address, email address, or phone number, users see a dialog box with instructions on how to apply for an exemption from BitLocker protection. For more information about enabling BitLocker encryption exemptions for users, see [How to Manage User BitLocker Encryption Exemptions](how-to-manage-user-bitlocker-encryption-exemptions-mbam-25.md).
    
+
    If you enable this policy setting and provide a website address, email address, or phone number, users see a dialog box with instructions on how to apply for an exemption from BitLocker protection. For more information about enabling BitLocker encryption exemptions for users, see How to Manage User BitLocker Encryption Exemptions.
    
 
    If you either disable or do not configure this policy setting, the exemption request instructions are not displayed to users.
    
 
    
-Note  
-
    User exemption is managed per user, not per computer. If multiple users log on to the same computer and any one user is not exempt, the computer is encrypted.
    
+Note
    User exemption is managed per user, not per computer. If multiple users log on to the same computer and any one user is not exempt, the computer is encrypted.
    
 
    
 
    
- 
+
 
    
 
 
@@ -237,7 +238,7 @@ You can set the same Group Policy settings for the Stand-alone and System Center
 
 
 
- 
+
 
 ### Fixed Drive Group Policy definitions
 
@@ -275,9 +276,9 @@ This section describes Fixed Drive policy definitions for Microsoft BitLocker Ad
 
 
    Allow access to BitLocker-protected fixed drives from earlier versions of Windows
    
 
    Suggested configuration: Not Configured
    
-
    Enable this policy so that fixed drives with the FAT file system can be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.
    
-
    When the policy is enabled or not configured, fixed drives that are formatted with the FAT file system can be unlocked and their content can be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. These operating systems have read-only permission to BitLocker-protected drives.
    
-
    When the policy is disabled, fixed drives that are formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.
    
+
    Enable this policy so that fixed drives with the FAT file system can be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.
    
+
    When the policy is enabled or not configured, fixed drives that are formatted with the FAT file system can be unlocked and their content can be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2. These operating systems have read-only permission to BitLocker-protected drives.
    
+
    When the policy is disabled, fixed drives that are formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.
    
 
 
 
    Configure use of password for fixed drives
    
@@ -309,7 +310,7 @@ This section describes Fixed Drive policy definitions for Microsoft BitLocker Ad
 
 
 
- 
+
 
 ### Operating System Drive Group Policy definitions
 
@@ -336,7 +337,7 @@ This section describes Operating System Drive policy definitions for Microsoft B
 
  • Allow Standby States (S1-S3) When Sleeping (Plugged In)
    • 
 
  • Allow Standby States (S1-S3) When Sleeping (On Battery)
    • 
 
-
    If you are running Microsoft Windows 8 or later, and you want to use BitLocker on a computer without a TPM, select the Allow BitLocker without a compatible TPM check box. In this mode, a password is required for startup. If you forget the password, you have to use one of the BitLocker recovery options to access the drive.
    
+
    If you are running Microsoft Windows 8 or later, and you want to use BitLocker on a computer without a TPM, select the Allow BitLocker without a compatible TPM check box. In this mode, a password is required for startup. If you forget the password, you have to use one of the BitLocker recovery options to access the drive.
    
 
    On a computer with a compatible TPM, two types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use only the TPM for authentication, or it can also require the entry of a personal identification number (PIN).
    
 
    If you enable this policy setting, users have to put the operating system drive under BitLocker protection, and the drive is then encrypted.
    
 
    If you disable this policy, users cannot put the operating system drive under BitLocker protection. If you apply this policy after the operating system drive is encrypted, the drive is then decrypted.
    
@@ -362,24 +363,22 @@ This section describes Operating System Drive policy definitions for Microsoft B
 
    Suggested configuration: Not Configured
    
 
    Use this policy setting to set the constraints for passwords that are used to unlock BitLocker-protected operating system drives. If non-TPM protectors are allowed on operating system drives, you can provision a password, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective, you must also enable the Group Policy setting "Password must meet complexity requirements" located in Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy.
    
 
    
-Note  
-
    These settings are enforced when you turn on BitLocker, not when you unlock a volume. BitLocker lets you unlock a drive with any of the protectors that are available on the drive.
    
+Note
    These settings are enforced when you turn on BitLocker, not when you unlock a volume. BitLocker lets you unlock a drive with any of the protectors that are available on the drive.
    
 
    
 
    
- 
+
 
    
 
    If you enable this policy setting, users can configure a password that meets the requirements that you define. To enforce complexity requirements on the password, click Require password complexity.
    
 
 
 
    Configure TPM platform validation profile for BIOS-based firmware configurations
    
 
    Suggested configuration: Not Configured
    
-
    This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.
    
+
    This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.
    
 
    
-Important  
-
    This Group Policy setting applies only to computers with BIOS configurations or to computers with UEFI firmware with a Compatibility Service Module (CSM) enabled. Computers that use a native UEFI firmware configuration store different values into the Platform Configuration Registers (PCRs). Use the "Configure TPM platform validation profile for native UEFI firmware configurations" Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware.
    
+Important
    This Group Policy setting applies only to computers with BIOS configurations or to computers with UEFI firmware with a Compatibility Service Module (CSM) enabled. Computers that use a native UEFI firmware configuration store different values into the Platform Configuration Registers (PCRs). Use the "Configure TPM platform validation profile for native UEFI firmware configurations" Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware.
    
 
    
 
    
- 
+
 
    
 
    If you enable this policy setting before you turn on BitLocker, you can configure the boot components that the TPM validates before you unlock access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive and the computer instead displays the BitLocker Recovery console and requires that you provide either the recovery password or recovery key to unlock the drive.
    
 
    If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile that is specified by the Setup script.
    
@@ -387,20 +386,19 @@ This section describes Operating System Drive policy definitions for Microsoft B
 
 
    Configure TPM platform validation profile
    
 
    Suggested configuration: Not Configured
    
-
    This policy setting enables you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.
    
+
    This policy setting enables you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.
    
 
    If you enable this policy setting before you turn on BitLocker, you can configure the boot components that the TPM validates before you unlock access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive and the computer instead displays the BitLocker Recovery console and requires that you provide either the recovery password or recovery key to unlock the drive.
    
 
    If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.
    
 
 
 
    Configure TPM platform validation profile for native UEFI firmware configurations
    
 
    Suggested configuration: Not Configured
    
-
    This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.
    
+
    This policy setting allows you to configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key. This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection.
    
 
    
-Important  
-
    This Group Policy setting applies only to computers with a native UEFI firmware configuration.
    
+Important
    This Group Policy setting applies only to computers with a native UEFI firmware configuration.
    
 
    
 
    
- 
+
 
    
 
    If you enable this policy setting before you turn on BitLocker, you can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive and the computer instead displays the BitLocker Recovery console and requires that you provide either the recovery password or recovery key to unlock the drive.
    
 
    If you disable or do not configure this policy setting, BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.
    
@@ -415,13 +413,12 @@ This section describes Operating System Drive policy definitions for Microsoft B
 
    Use enhanced Boot Configuration Data validation profile
    
 
    Suggested configuration: Not Configured
    
 
    This policy setting allows you to choose specific Boot Configuration Data (BCD) settings to verify during platform validation.
    
-
    If you enable this policy setting, you can add additional settings, remove the default settings, or both. If you disable this policy setting, the computer reverts to a BCD profile similar to the default BCD profile that is used by Windows 7. If you do not configure this policy setting, the computer verifies the default Windows BCD settings.
    
+
    If you enable this policy setting, you can add additional settings, remove the default settings, or both. If you disable this policy setting, the computer reverts to a BCD profile similar to the default BCD profile that is used by Windows 7. If you do not configure this policy setting, the computer verifies the default Windows BCD settings.
    
 
    
-Note  
-
    When BitLocker uses Secure Boot for platform and Boot Configuration Data (BCD) integrity validation, as defined by the "Allow Secure Boot for integrity validation" policy, the "Use enhanced Boot Configuration Data validation profile" policy is ignored.
    
+Note
    When BitLocker uses Secure Boot for platform and Boot Configuration Data (BCD) integrity validation, as defined by the "Allow Secure Boot for integrity validation" policy, the "Use enhanced Boot Configuration Data validation profile" policy is ignored.
    
 
    
 
    
- 
+
 
    
 
    The setting that controls boot debugging (0x16000010) is always validated and has no effect if it is included in the provided fields.
    
 
@@ -444,17 +441,16 @@ This section describes Operating System Drive policy definitions for Microsoft B
 
  • Use default recovery message and URL: Select this option to display the default BitLocker recovery message and URL in the pre-boot BitLocker recovery screen. If you previously configured a custom recovery message or URL and want to revert to the default message, you must enable this policy and select the Use default recovery message and URL option.
    • 
 
 
    
-Note  
-
    Not all characters and languages are supported in pre-boot. We recommend that you test that the characters you use for the custom message or URL appear correctly on the pre-boot BitLocker recovery screen.
    
+Note
    Not all characters and languages are supported in pre-boot. We recommend that you test that the characters you use for the custom message or URL appear correctly on the pre-boot BitLocker recovery screen.
    
 
    
 
    
- 
+
 
    
 
 
 
 
- 
+
 
 ### Removable Drive Group Policy definitions
 
@@ -489,9 +485,9 @@ This section describes Removable Drive Group Policy definitions for Microsoft Bi
 
 
    Allow access to BitLocker-protected removable drives from earlier versions of Windows
    
 
    Suggested configuration: Not Configured
    
-
    Enable this policy to allow fixed drives with the FAT file system to be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.
    
-
    When this policy is not configured, removable drives that are formatted with the FAT file system can be unlocked on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have read-only permission to BitLocker-protected drives.
    
-
    When the policy is disabled, removable drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.
    
+
    Enable this policy to allow fixed drives with the FAT file system to be unlocked and viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.
    
+
    When this policy is not configured, removable drives that are formatted with the FAT file system can be unlocked on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have read-only permission to BitLocker-protected drives.
    
+
    When the policy is disabled, removable drives formatted with the FAT file system cannot be unlocked and their content cannot be viewed on computers that are running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2.
    
 
 
 
    Configure use of password for removable data drives
    
@@ -510,7 +506,7 @@ This section describes Removable Drive Group Policy definitions for Microsoft Bi
 
 
 
- 
+
 
 
 ## Related topics
@@ -520,11 +516,11 @@ This section describes Removable Drive Group Policy definitions for Microsoft Bi
 
 [MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md)
 
- 
+
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+
 
 
 
diff --git a/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md b/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md
index e03e834e82..7f91892a01 100644
--- a/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md
+++ b/mdop/mbam-v25/planning-for-mbam-25-groups-and-accounts.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for MBAM 2.5 Groups and Accounts
 description: Planning for MBAM 2.5 Groups and Accounts
-author: jamiejdt
+author: dansimp
 ms.assetid: 73bb9fe5-5900-4b6f-b271-ade62991fca1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -14,12 +17,12 @@ ms.date: 11/02/2016
 # Planning for MBAM 2.5 Groups and Accounts
 
 
-This topic lists the roles and accounts that you must create in Active Directory Domain Services (AD DS) to provide security and access rights for the Microsoft BitLocker Administration and Monitoring (MBAM) databases, reports, and web applications. For each role and account, the corresponding field in the MBAM Server Configuration wizard is provided. For a list of Windows PowerShell cmdlets and parameters that correspond to these accounts, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md#bkmk-reqd-posh-accts).
+This topic lists the roles and accounts that you must create in Active Directory Domain Services (AD DS) to provide security and access rights for the Microsoft BitLocker Administration and Monitoring (MBAM) databases, reports, and web applications. For each role and account, the corresponding field in the MBAM Server Configuration wizard is provided. For a list of Windows PowerShell cmdlets and parameters that correspond to these accounts, see [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md#bkmk-reqd-posh-accts).
 
-**Note**  
+**Note**  
 MBAM does not support the use of managed service accounts.
 
- 
+
 
 ## Database accounts
 
@@ -61,7 +64,7 @@ Create the following accounts for the Compliance and Audit Database and the Reco
 
 
 
- 
+
 
 ## Reporting accounts
 
@@ -102,7 +105,7 @@ Create the following accounts for the Reports feature.
 
 
 
- 
+
 
 ## Administration and Monitoring Website (Help Desk) accounts
 
@@ -134,11 +137,10 @@ Create the following accounts for the Administration and Monitoring Website.
 
    If you enter a group name in the Read/write access domain user or group field on the Configure Databases page, the value you enter in this field must be a member of that group.
    
 
    If you do not specify credentials, the credentials that were specified for any previously enabled web application will be used. All web applications must use the same application pool credentials. If you specify different credentials for different web applications, the most recently specified value will be used.
    
 
    
-Important  
-
    For improved security, set the account that is specified in the credentials to have limited user rights.
    
+Important
    For improved security, set the account that is specified in the credentials to have limited user rights.
    
 
    
 
    
- 
+
 
    
 
 
@@ -165,12 +167,12 @@ Create the following accounts for the Administration and Monitoring Website.
 
    Group
    
 
    MBAM Data Migration Users
    
 
    Optional domain user group whose members have permissions to write data to MBAM by using the MBAM Recovery and Hardware Service running on the MBAM server. This account is generally used with the Write-Mbam* cmdlets to write recovery and TPM data from Active Directory into the MBAM database.
    
-
    For more information, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md).
    
+
    For more information, see MBAM 2.5 Security Considerations.
    
 
 
 
 
- 
+
 
 
 ## Related topics
@@ -180,11 +182,11 @@ Create the following accounts for the Administration and Monitoring Website.
 
 [MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md)
 
- 
+
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
-- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
+- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
 
 
 
diff --git a/mdop/mbam-v25/planning-for-mbam-25-high-availability.md b/mdop/mbam-v25/planning-for-mbam-25-high-availability.md
index 801ea71276..0a95efbd31 100644
--- a/mdop/mbam-v25/planning-for-mbam-25-high-availability.md
+++ b/mdop/mbam-v25/planning-for-mbam-25-high-availability.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for MBAM 2.5 High Availability
 description: Planning for MBAM 2.5 High Availability
-author: jamiejdt
+author: dansimp
 ms.assetid: 1e29b30c-33f1-4a52-9442-8c1391f0049c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md b/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md
index 6fc0c1b5d5..41ccde26df 100644
--- a/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md
+++ b/mdop/mbam-v25/planning-for-mbam-25-server-deployment.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for MBAM 2.5 Server Deployment
 description: Planning for MBAM 2.5 Server Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: 88774c89-31c8-4eb8-a845-a00bbec8c870
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -34,8 +37,8 @@ This topic lists the features that you deploy for the MBAM Stand-alone and Confi
 
 
    Review the following before you start the deployment:
    
 
 
    Each MBAM feature has specific prerequisites that must be met before you start the MBAM installation.
    
 
@@ -45,7 +48,7 @@ This topic lists the features that you deploy for the MBAM Stand-alone and Confi
 
 
 
    Keep track of the names of the computers on which you configure each feature. You will use this information throughout the configuration process.
    
-
    You may want to use the [MBAM 2.5 Deployment Checklist](mbam-25-deployment-checklist.md) for this purpose.
    
+
    You may want to use the MBAM 2.5 Deployment Checklist for this purpose.
    
 
 
 
    Configure only the Group Policy settings in the MDOP MBAM (BitLocker Management) node. Do not change the Group Policy settings in the BitLocker Drive Encryption node.
    
@@ -54,7 +57,7 @@ This topic lists the features that you deploy for the MBAM Stand-alone and Confi
 
 
 
- 
+ 
 
 ## Planning for MBAM Server deployment – Stand-alone topology
 
@@ -105,7 +108,7 @@ For a description of these features, see [High-Level Architecture of MBAM 2.5 wi
 
 [Deploying the MBAM 2.5 Server Infrastructure](deploying-the-mbam-25-server-infrastructure.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/planning-for-mbam-25.md b/mdop/mbam-v25/planning-for-mbam-25.md
index bbf4e631bb..5be4741f7c 100644
--- a/mdop/mbam-v25/planning-for-mbam-25.md
+++ b/mdop/mbam-v25/planning-for-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Planning for MBAM 2.5
 description: Planning for MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: aebe82c0-e3b6-4bfb-beb0-b99f9c5c5267
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md b/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md
index 500b84672e..56e258088e 100644
--- a/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md
+++ b/mdop/mbam-v25/planning-how-to-secure-the-mbam-websites.md
@@ -1,8 +1,11 @@
 ---
 title: Planning How to Secure the MBAM Websites
 description: Planning How to Secure the MBAM Websites
-author: jamiejdt
+author: dansimp
 ms.assetid: aea1d137-62cf-4da4-9989-541e0b5ad8d8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -39,7 +42,7 @@ This topic describes the following methods for securing the Microsoft BitLocker
 
 
 
- 
+
 
 For more information about how to secure your MBAM deployment, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md).
 
@@ -54,10 +57,10 @@ We recommend that you use a certificate to secure the communication between the:
 
 For information about requesting and installing a certificate, see [Configuring Internet Server Certificates](https://technet.microsoft.com/library/cc731977.aspx).
 
-**Note**  
+**Note**  
 You can configure the websites and web services on different servers only if you are using Windows PowerShell. If you use the MBAM Server Configuration wizard to configure the websites, you must configure the websites and the web services on the same server.
 
- 
+
 
 To secure the communication between the web services and the databases, we also recommend that you force encryption in SQL Server. For information about securing all connections to SQL Server, including communication between the web services and SQL Server, see [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md#bkmk-secure-databases).
 
@@ -91,14 +94,13 @@ Review the information in the following table before you start creating SPNs.
 
 
 
-
    Create a service account in Active Directory Domain Services (AD DS).
    
+
    Create a service account in Active Directory Domain Services (AD DS).
    
 
    The service account is a user account that you create in AD DS to provide security for the MBAM websites. The MBAM websites run under an application pool, whose identity is the name of the service account. The SPNs are then registered in the application pool account.
    
 
    
-Note  
-
    You must use the same application pool account for all web servers.
    
+Note
    You must use the same application pool account for all web servers.
    
 
    
 
    
- 
+
 
    
 
 
@@ -116,7 +118,7 @@ Review the information in the following table before you start creating SPNs.
 
 
 
- 
+
 
 ### Registering SPNs when you use a fully qualified domain host name
 
@@ -141,13 +143,13 @@ If you use a fully qualified domain host name when you configure MBAM, you have
 
 
 
    Configure constrained delegation for the SPN that you are registering for the application pool account.
    
-
    [Configuring Constrained Delegation](https://go.microsoft.com/fwlink/?LinkId=394335)
    
+
    Configuring Constrained Delegation
    
 
    This requirement only applies to MBAM 2.5; it is not necessary in MBAM 2.5 SP1.
    
 
 
 
 
- 
+
 
 ### Registering SPNs when you use a NetBIOS host name
 
@@ -177,13 +179,13 @@ If you use a NetBIOS host name when you configure MBAM, register one SPN for the
 
 
 
    Configure constrained delegation for the SPNs that you are registering for the application pool account.
    
-
    [Configuring Constrained Delegation](https://go.microsoft.com/fwlink/?LinkId=394335)
    
+
    Configuring Constrained Delegation
    
 
    This requirement only applies to MBAM 2.5; it is not necessary in MBAM 2.5 SP1.
    
 
 
 
 
- 
+
 
 ### Registering SPNs when you use a virtual host name
 
@@ -218,18 +220,18 @@ If you configure MBAM with a virtual host name that is a fully qualified domain
 
 
 
    On the Domain Name Server (DNS) server, create an “A record” for the custom host name and point it to a web server or a load balancer.
    
-
    See the “To configure DNS Host A Records” section in [Configure DNS Host Records](https://go.microsoft.com/fwlink/?LinkId=394337).
    
+
    See the “To configure DNS Host A Records” section in Configure DNS Host Records.
    
 
    We recommend that you use A records instead of CNAMES. If you use CNAMES to point to the domain address, you must also register SPNs for the web server name in the application pool account.
    
 
 
 
    Configure constrained delegation for the SPNs that you are registering for the application pool account.
    
-
    [Configuring Constrained Delegation](https://go.microsoft.com/fwlink/?LinkId=394335)
    
+
    Configuring Constrained Delegation
    
 
    This requirement only applies to MBAM 2.5; it is not necessary in MBAM 2.5 SP1.
    
 
 
 
 
- 
+
 
 ### Registering an SPN when you upgrade from previous versions of MBAM
 
@@ -237,7 +239,7 @@ Complete the steps in this section only if you want to:
 
 -   Upgrade from a previous version of MBAM.
 
--   Run the websites in MBAM 2.5 in a load-balanced or distributed configuration, and you are currently running in a configuration that is not load balanced.
+-   Run the websites in MBAM 2.5 in a load-balanced or distributed configuration, and you are currently running in a configuration that is not load balanced.
 
 If you already registered SPNs on the machine account rather than in an application pool account, MBAM uses the existing SPNs, and you cannot configure the websites in a load-balanced or distributed configuration.
 
@@ -254,12 +256,12 @@ If you already registered SPNs on the machine account rather than in an applicat
 
 
 
-
    Create an application pool account in Active Directory Domain Services (AD DS).
    
+
    Create an application pool account in Active Directory Domain Services (AD DS).
    
 
    
 
 
 
    Remove the currently installed websites and web services.
    
-
    [Removing MBAM Server Features or Software](removing-mbam-server-features-or-software.md)
    
+
    Removing MBAM Server Features or Software
    
 
 
 
    Remove SPNs from the machine account.
    
@@ -268,11 +270,11 @@ If you already registered SPNs on the machine account rather than in an applicat
 
 
 
    Register SPNs in the application pool account.
    
-
    Follow the steps for [Registering SPNs when you use a virtual host name](#bkmk-regvirtualspn).
    
+
    Follow the steps for Registering SPNs when you use a virtual host name.
    
 
 
 
    Reconfigure the web applications and web services.
    
-
    [How to Configure the MBAM 2.5 Web Applications](how-to-configure-the-mbam-25-web-applications.md)
    
+
    How to Configure the MBAM 2.5 Web Applications
    
 
 
 
    Do one of the following, depending on the method you use for the configuration:
    
@@ -298,20 +300,21 @@ If you already registered SPNs on the machine account rather than in an applicat
 
 
 
-
     
    
+
     
    
 
    
-Important  
-
    The host name that you enter must be the same name as the virtual host name for which you are creating the SPNs. Also, in your web farm, the host names and the application pool credentials must be the same on every server that you are configuring.
    
+Important
    The host name that you enter must be the same name as the virtual host name for which you are creating the SPNs. Also, in your web farm, the host names and the application pool credentials must be the same on every server that you are configuring.
    
 
    
 
    
- 
+
 
    
 
    When MBAM configures the web applications, it will try to register the SPNs for you, but it can do so only if you have Domain Admin rights on the server on which you are installing MBAM. If you do not have these rights, you can complete the configuration, but you will have to set the SPNs before or after you configure MBAM.
    
 
 
 
 
- 
+## Required Request Filtering Settings
+
+ 'Allow unlisted file name extensions' is required for the application to operate as expected.  This can be found by navigating to the 'Microsoft BitLocker Administration and Monitoring' -> Request Filtering -> Edit Feature Settings.
 
 
 ## Related topics
@@ -321,9 +324,9 @@ If you already registered SPNs on the machine account rather than in an applicat
 
 [MBAM 2.5 Deployment Prerequisites](mbam-25-deployment-prerequisites.md)
 
- 
 
- 
+
+
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
diff --git a/mdop/mbam-v25/planning-to-deploy-mbam-25.md b/mdop/mbam-v25/planning-to-deploy-mbam-25.md
index 4d0379428b..e0e73d9033 100644
--- a/mdop/mbam-v25/planning-to-deploy-mbam-25.md
+++ b/mdop/mbam-v25/planning-to-deploy-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Planning to Deploy MBAM 2.5
 description: Planning to Deploy MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 1343b80c-d87a-42e7-b912-e84ba997d7e3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -31,7 +34,7 @@ The MBAM Server infrastructure depends on a set of server features that can be c
 **Note**  
 An MBAM installation on a single server is recommended only for lab environments.
 
- 
+ 
 
 The MBAM Client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can be integrated into an organization by deploying the client through an enterprise software delivery system or by installing the Client on client computers as part of the initial imaging process.
 
@@ -50,9 +53,9 @@ With MBAM, you can encrypt a computer in your organization either before the end
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md b/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md
index cccc386d97..bfc0fff5d3 100644
--- a/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md
+++ b/mdop/mbam-v25/preparing-your-environment-for-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Preparing your Environment for MBAM 2.5
 description: Preparing your Environment for MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 7552ba08-9dbf-40cd-8920-203d733fd242
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md b/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md
index 24e0ea2b36..2329a20a37 100644
--- a/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md
+++ b/mdop/mbam-v25/prerequisites-for-mbam-25-clients.md
@@ -1,8 +1,11 @@
 ---
 title: Prerequisites for MBAM 2.5 Clients
 description: Prerequisites for MBAM 2.5 Clients
-author: jamiejdt
+author: dansimp
 ms.assetid: fc230679-9c84-4b99-a77c-bae7e7bf8145
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -37,19 +40,19 @@ Before you install the MBAM Client software on end users' computers, ensure that
 
    
 
 
-
    For Windows 7 client computers only: Each client must have Trusted Platform Module (TPM) capability (TPM 1.2 or later).
    
+
    For Windows 7 client computers only: Each client must have Trusted Platform Module (TPM) capability (TPM 1.2 or later).
    
 
    
 
 
 
    For Windows 8.1, Windows 10 RTM or Windows 10 version 1511 client computers only: If you want MBAM to be able to store and manage the TPM recovery keys, TPM auto-provisioning must be turned off, and MBAM must be set as the owner of the TPM before you deploy MBAM.
    
 
    In MBAM 2.5 SP1 only, you no longer need to turn off TPM auto-provisioning, but you must make sure that the TPM Group Policy Objects are set to not escrow TPM OwnerAuth to Active Directory.
    
-
    [MBAM 2.5 Security Considerations](mbam-25-security-considerations.md#bkmk-tpm)
    
+
    MBAM 2.5 Security Considerations
    
 
 
 
    For Windows 10, version 1607 or later, only Windows can take ownership of the TPM. In addiiton, Windows will not retain the TPM owner password when provisioning the TPM.
    
 
    In MBAM 2.5 SP1, you must turn on auto-provisioning.
    
 
    
-
    See [TPM owner password](https://technet.microsoft.com/itpro/windows/keep-secure/change-the-tpm-owner-password) for further details.
+
    See TPM owner password for further details.
 
    
 
 
@@ -63,11 +66,10 @@ Before you install the MBAM Client software on end users' computers, ensure that
 
 
    The computer’s hard disk must have a BIOS that is compatible with TPM and that supports USB devices during computer startup.
    
 
    
-Note  
-
    Ensure that the keyboard, video, or mouse are directly connected and not managed through a keyboard, video, or mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware.
    
+Note
    Ensure that the keyboard, video, or mouse are directly connected and not managed through a keyboard, video, or mouse (KVM) switch. A KVM switch can interfere with the ability of the computer to detect the physical presence of hardware.
    
 
    
 
    
- 
+
 
    
 
 
@@ -77,11 +79,11 @@ Before you install the MBAM Client software on end users' computers, ensure that
 
 
 
- 
 
-**Important**  
+
+**Important**  
 If BitLocker was used without MBAM, MBAM can be installed and utilize the existing TPM information.
- 
+
 
 
 
@@ -92,11 +94,11 @@ If BitLocker was used without MBAM, MBAM can be installed and utilize the existi
 
 [Planning to Deploy MBAM 2.5](planning-to-deploy-mbam-25.md)
 
- 
+
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+
 
 
 
diff --git a/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md b/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md
index f00c62f502..f7ff13527a 100644
--- a/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md
+++ b/mdop/mbam-v25/prerequisites-for-the-configuration-manager-integration-feature.md
@@ -1,8 +1,11 @@
 ---
 title: Prerequisites for the Configuration Manager Integration Feature
 description: Prerequisites for the Configuration Manager Integration Feature
-author: jamiejdt
+author: dansimp
 ms.assetid: b318cbd3-b009-44b8-991b-f7364c1cae88
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 08/30/2016
 
 If you deploy MBAM with the System Center Configuration Manager Integration topology, we recommend a three-server architecture, as described in [High-Level Architecture of MBAM 2.5 with Configuration Manager Integration Topology](high-level-architecture-of-mbam-25-with-configuration-manager-integration-topology.md). This architecture can support 500,000 client computers.
 
-**Important**  
+**Important**  
 Windows To Go is not supported for the Configuration Manager Integration topology installation when you are using Configuration Manager 2007.
 
- 
+
 
 ## General prerequisites for the Configuration Manager Integration feature
 
@@ -44,38 +47,37 @@ When you install MBAM with Configuration Manager, the following additional prere
 
 
 
    The Hardware Inventory Client Agent is on the Configuration Manager Server.
    
-
    For System Center 2012 Configuration Manager, see [How to Configure Hardware Inventory in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=301685).
    
-
    For Configuration Manager 2007, see [How to Configure Hardware Inventory for a Site](https://go.microsoft.com/fwlink/?LinkId=301656).
    
+
    For System Center 2012 Configuration Manager, see How to Configure Hardware Inventory in Configuration Manager.
    
+
    For Configuration Manager 2007, see How to Configure Hardware Inventory for a Site.
    
 
 
 
    One of the following is enabled, depending on the version of Configuration Manager that you are using:
    
 
      
-
    • Compliance Settings - (System Center 2012 Configuration Manager)
      • 
+
    • Compliance Settings - (System Center 2012 Configuration Manager)
      • 
 
    • Desired Configuration Management (DCM) Client Agent – (Configuration Manager 2007)
      • 
 
    
-
    For System Center 2012 Configuration Manager, see [Configuring Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=301687).
    
-
    For Configuration Manager 2007, see [Desired Configuration Management Client Agent Properties](https://go.microsoft.com/fwlink/?LinkId=301686).
    
+
    For System Center 2012 Configuration Manager, see Configuring Compliance Settings in Configuration Manager.
    
+
    For Configuration Manager 2007, see Desired Configuration Management Client Agent Properties.
    
 
 
 
    A reporting services point is defined in Configuration Manager. Required for SQL Server Reporting Services (SSRS).
    
-
    For System Center 2012 Configuration Manager, see [Prerequisites for Reporting in Configuration Manager](https://go.microsoft.com/fwlink/?LinkId=301689).
    
-
    For Configuration Manager 2007, see [How to Create a Reporting Services Point for SQL Reporting Services](https://go.microsoft.com/fwlink/?LinkId=301688).
    
+
    For System Center 2012 Configuration Manager, see Prerequisites for Reporting in Configuration Manager.
    
+
    For Configuration Manager 2007, see How to Create a Reporting Services Point for SQL Reporting Services.
    
 
 
 
    Configuration Manager 2007 requires Microsoft .NET Framework 2.0
    
 
    The Desired Configuration Management (DCM) Client Agent in Configuration Manager 2007 requires .NET Framework 2.0 to report compliance.
    
 
    
-Note  
-
    Installing .NET Framework 3.5 automatically installs .NET Framework 2.0.
    
+Note
    Installing .NET Framework 3.5 automatically installs .NET Framework 2.0.
    
 
    
 
    
- 
+
 
    
 
 
 
 
- 
+
 
 ## Required permissions to install MBAM with Configuration Manager
 
@@ -107,9 +109,9 @@ To install MBAM with Configuration Manager, you must have an administrative user
 
 
 
- 
 
-**System Center 2012 Configuration Manager**
+
+**System Center 2012 Configuration Manager**
 
 @@ -138,7 +140,7 @@ To install MBAM with Configuration Manager, you must have an administrative user
 
    
 

 
    
 
- 
+
 
 **Configuration Manager 2007**
 
@@ -169,12 +171,12 @@ To install MBAM with Configuration Manager, you must have an administrative user
 
 
 
- 
+
 
 ## Required changes for the .mof files
 
 
-To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the Configuration.mof file and Sms\_def.mof file for System Center 2012 Configuration Manager and Microsoft System Center Configuration Manager 2007. For instructions, see [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md).
+To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the Configuration.mof file and Sms\_def.mof file for System Center 2012 Configuration Manager and Microsoft System Center Configuration Manager 2007. For instructions, see [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md).
 
 
 
@@ -185,11 +187,11 @@ To enable the client computers to report BitLocker compliance details through th
 
 [MBAM 2.5 Server Prerequisites that Apply Only to the Configuration Manager Integration Topology](mbam-25-server-prerequisites-that-apply-only-to-the-configuration-manager-integration-topology.md)
 
- 
+
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
-- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
+- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
 
 
 
diff --git a/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md b/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md
index a39802e24b..3e71f9ec51 100644
--- a/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md
+++ b/mdop/mbam-v25/release-notes-for-mbam-25-sp1.md
@@ -1,8 +1,11 @@
 ---
 title: Release Notes for MBAM 2.5 SP1
 description: Release Notes for MBAM 2.5 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 3ac424c8-c490-4d62-aba4-1b462c02e962
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/release-notes-for-mbam-25.md b/mdop/mbam-v25/release-notes-for-mbam-25.md
index 5ed4366556..ca65e45a7a 100644
--- a/mdop/mbam-v25/release-notes-for-mbam-25.md
+++ b/mdop/mbam-v25/release-notes-for-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Release Notes for MBAM 2.5
 description: Release Notes for MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: fcaf03e6-5e39-4771-af3c-a3cd468f3961
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -32,7 +35,7 @@ Help links in the MBAM Server Configuration tool can cause browser windows to op
 **Note**  
 This is fixed in MBAM 2.5 SP1.
 
- 
+ 
 
 ###  MBAM reports as noncompliant a client encrypted with AES 256-bit encryption keys and Diffuser
 
@@ -128,42 +131,42 @@ This table lists the hotfixes and KB articles for MBAM 2.5.
 
 
    2975636
    
 
    Hotfix Package 1 for Microsoft BitLocker Administration and Monitoring 2.5
    
-
    [support.microsoft.com/kb/2975636/EN-US](https://support.microsoft.com/kb/2975636/EN-US)
    
+
    support.microsoft.com/kb/2975636/EN-US
    
 
 
 
    3015477
    
 
    Hotfix Package 2 for BitLocker Administration and Monitoring 2.5
    
-
    [support.microsoft.com/kb/3015477](https://support.microsoft.com/kb/3015477)
    
+
    support.microsoft.com/kb/3015477
    
 
 
 
    3011022
    
 
    MBAM 2.5 installation or Configuration Manager reporting fails if the name of SSRS instance contains an underscore
    
-
    [support.microsoft.com/kb/3011022/EN-US](https://support.microsoft.com/kb/3011022/EN-US)
    
+
    support.microsoft.com/kb/3011022/EN-US
    
 
 
 
    2756402
    
 
    MBAM client would fail with Event ID 4 and error code 0x8004100E in the Event description
    
-
    [support.microsoft.com/kb/2756402/EN-US](https://support.microsoft.com/kb/2756402/EN-US)
    
+
    support.microsoft.com/kb/2756402/EN-US
    
 
 
 
    2639518
    
 
    Error opening Enterprise or Computer Compliance Reports in MBAM
    
-
    [support.microsoft.com/kb/2639518/EN-US](https://support.microsoft.com/kb/2639518/EN-US)
    
+
    support.microsoft.com/kb/2639518/EN-US
    
 
 
 
    2870842
    
 
    MBAM 2.0 Setup fails during Configuration Manager Integration Scenario with SQL Server 2008
    
-
    [support.microsoft.com/kb/2870842/EN-US](https://support.microsoft.com/kb/2870842/EN-US)
    
+
    support.microsoft.com/kb/2870842/EN-US
    
 
 
 
    2975472
    
 
    SQL deadlocks when many MBAM clients connect to the MBAM recovery database
    
-
    [support.microsoft.com/kb/2975472/EN-US](https://support.microsoft.com/kb/2975472/EN-US)
    
+
    support.microsoft.com/kb/2975472/EN-US
    
 
 
 
 
- 
+ 
 
 
 ## Related topics
@@ -171,7 +174,7 @@ This table lists the hotfixes and KB articles for MBAM 2.5.
 
 [About MBAM 2.5](about-mbam-25.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
diff --git a/mdop/mbam-v25/removing-mbam-server-features-or-software.md b/mdop/mbam-v25/removing-mbam-server-features-or-software.md
index bf66d191ab..640588cc30 100644
--- a/mdop/mbam-v25/removing-mbam-server-features-or-software.md
+++ b/mdop/mbam-v25/removing-mbam-server-features-or-software.md
@@ -1,8 +1,11 @@
 ---
 title: Removing MBAM Server Features or Software
 description: Removing MBAM Server Features or Software
-author: jamiejdt
+author: dansimp
 ms.assetid: 5212ba3f-124d-43c5-824a-608e9a192e86
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ These instructions explain how to remove software and features from Microsoft Bi
 **Note**  
 To prevent the accidental removal of data, MBAM provides no mechanism for removing the databases; you must do that manually.
 
- 
+ 
 
 ## Removing MBAM Server features
 
@@ -78,9 +81,9 @@ Use the following steps to remove the MBAM Server software and any MBAM Server f
 
 [Deploying MBAM 2.5](deploying-mbam-25.md)
 
- 
+ 
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/server-event-logs.md b/mdop/mbam-v25/server-event-logs.md
index c2d73ac15e..b02ad84d6d 100644
--- a/mdop/mbam-v25/server-event-logs.md
+++ b/mdop/mbam-v25/server-event-logs.md
@@ -1,8 +1,11 @@
 ---
 title: Server Event Logs
 description: Server Event Logs
-author: jamiejdt
+author: dansimp
 ms.assetid: 04e724d2-28cc-4fa8-86a1-0d4ab0234b11
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -301,10 +304,10 @@ The following table contains messages and troubleshooting information for event
 
    ReportProviderUnexpectedError
    
 
    Report provider unexpected error.
    
 
    Report provider unexpected error. {Description} {exceptionDetails} These are some of the possible exception details:
    
-
    An error occurred while getting the name of directory '{directoryName}'
    
-
    An exception occurred while getting files for directory '{directoryName}'
    
-
    An exception occurred while enumerating directories in directory '{directoryName}'
    
-
    An exception occurred while reading all bytes for file '{fileName}'
    
+
    An error occurred while getting the name of directory '{directoryName}'
    
+
    An exception occurred while getting files for directory '{directoryName}'
    
+
    An exception occurred while enumerating directories in directory '{directoryName}'
    
+
    An exception occurred while reading all bytes for file '{fileName}'
    
 
    During MBAM installation, MBAM setup unzips all the report files to the specified installation path. As a part of report installation, install module tries to access the unzipped report files at installation path and communicates with SQL Reporting services to publish the report files. The above errors occur when MBAM cannot access the files/folders at unzipped Installation path. These are some tips to troubleshoot this issue:
    
 
      
 
    • Verify that MBAM is installed.
      • 
@@ -320,7 +323,7 @@ The following table contains messages and troubleshooting information for event
 
    • Using SSRS console verify that SSRS is enabled and running.
      • 
 
    • Verify that user running the setup is authorized to access SSRS.
      • 
 
    
-
    Failed to remove the MBAM Reports using Reporting Services instance URL '{SSRSInstanceUrl}'.Make sure the SSRS instance required for MBAM Reports is running and configured correctly.
    
+
    Failed to remove the MBAM Reports using Reporting Services instance URL '{SSRSInstanceUrl}'.Make sure the SSRS instance required for MBAM Reports is running and configured correctly.
    
 
    When MBAM installation fails or When user disables MBAM Reporting features, setup module removes SSRS reports. The above message indicates that MBAM failed to remove SSRS reports. These are some tips to troubleshoot this issue:
    
 
      
 
    • Verify that SSRS is installed on the specified machine.
      • 
@@ -333,8 +336,8 @@ The following table contains messages and troubleshooting information for event
 
    • Using SSRS console verify that SSRS is enabled and running.
      • 
 
    • Verify that the user running the setup is authorized to access/publish reports to SSRS.
      • 
 
    
-
    A policy for group user name '{userName}' already exists. In case this is not correct, manually revise the Reporting Service for duplicate or invalid policies.
    
-
    After Publishing MBAM reports, MBAM setup tries to create a MBAM Report Users roles (if it does not exist already) and sets corresponding user policy. The above error indicates that SSRS web service threw an exception while setting up report user role policy. Follow the instructions in the event message and refer to "https://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=SQL+Server+Reporting+Services&ProdVer=8.00&EvtID=rsInvalidPolicyDefinition&EvtSrc=Microsoft.ReportingServices.Diagnostics.ErrorStrings.resources.Strings&LCID=1033" for more help.
    
+
    A policy for group user name '{userName}' already exists. In case this is not correct, manually revise the Reporting Service for duplicate or invalid policies.
    
+
    After Publishing MBAM reports, MBAM setup tries to create a MBAM Report Users roles (if it does not exist already) and sets corresponding user policy. The above error indicates that SSRS web service threw an exception while setting up report user role policy. Follow the instructions in the event message and refer to "https://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=SQL+Server+Reporting+Services&ProdVer=8.00&EvtID=rsInvalidPolicyDefinition&EvtSrc=Microsoft.ReportingServices.Diagnostics.ErrorStrings.resources.Strings&LCID=1033"; for more help.
    
 
    An error occurred while validating access to SSRS {exceptionDetails}.
    
 
    As part of prerequisite check, MBAM setup verifies if the user has necessary permissions to access/create folder under SSRS. The error message indicates that an exception has occurred while verifying access to SSRS. Refer to the exception details for debugging tips.
    
 
    A SOAP error occurred while checking the SSRS URL.{exceptionDetails}
    
@@ -354,12 +357,12 @@ The following table contains messages and troubleshooting information for event
 
  • Using SSRS console verify that SSRS is enabled and running.
    • 
 
  • Verify that the user executing the setup is authorized to query SSRS class under WMI namespace.
    • 
 
-
    The current user is not authorized to access the WMI namespace '{ssrsWMINamespace}'.
    
-
    An error occurred while enumerating the namespace '{ssrsWMINamespace}'. RPC server for SSRS WMI provider on the local host is not found.
    
-
    An error occurred while enumerating the namespace '{ssrsNamespace}'. Unable to find an instance of SSRS on the local host.
    
-
    An error occurred while accessing WMI. RPC server for instance '{ssrsInstance}' was not found.
    
-
    An error occurred while accessing WMI. Instance name '{ssrsInstanceName}' is not correct.
    
-
    An error occurred while accessing WMI. Unable to find instance '{ssrsInstanceName}' on the local host.
    
+
    The current user is not authorized to access the WMI namespace '{ssrsWMINamespace}'.
    
+
    An error occurred while enumerating the namespace '{ssrsWMINamespace}'. RPC server for SSRS WMI provider on the local host is not found.
    
+
    An error occurred while enumerating the namespace '{ssrsNamespace}'. Unable to find an instance of SSRS on the local host.
    
+
    An error occurred while accessing WMI. RPC server for instance '{ssrsInstance}' was not found.
    
+
    An error occurred while accessing WMI. Instance name '{ssrsInstanceName}' is not correct.
    
+
    An error occurred while accessing WMI. Unable to find instance '{ssrsInstanceName}' on the local host.
    
 
    As part of prerequisite check, MBAM setup queries WMI to retrieve WMI namespace associated to given instance. The above error message indicates that and exception was occurred while querying WMI. Refer to exceptionDetails for more information. These are some checks you can perform:
    
 
      
 
    • Verify that SSRS with given instance name is installed on the specified machine.
      • 
@@ -443,7 +446,7 @@ The following table contains messages and troubleshooting information for event
 
 
 
- 
+ 
 
 ## Operation
 
@@ -472,9 +475,9 @@ The following table contains messages and troubleshooting information for event
 
      1
      
 
      Microsoft-Windows-MBAM-Web/Admin
      
 
      WebAppSpnError
      
-
      Application: {SiteName}\{VirtualDirectory} is missing the following Service Principal Names (SPNs):{ListOfSpns} Register the required SPNs on the account: {ExecutionAccount}.
      
+
      Application: {SiteName}{VirtualDirectory} is missing the following Service Principal Names (SPNs):{ListOfSpns} Register the required SPNs on the account: {ExecutionAccount}.
      
 
      For Integrated Windows Authentication to succeed, necessary SPNs needs to be in place. This message indicates that the SPN required for MBAM application has not been correctly configured. Details contained in this event should provide more information.
      
-
      See “Service Principal Name (SPN)” in [MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies](mbam-25-server-prerequisites-for-stand-alone-and-configuration-manager-integration-topologies.md#bkmk-prereqsams) for more information.
      
+
      See “Service Principal Name (SPN)” in MBAM 2.5 Server Prerequisites for Stand-alone and Configuration Manager Integration Topologies for more information.
      
 
 
 
      4
      
@@ -510,7 +513,7 @@ The following table contains messages and troubleshooting information for event
 
      QueryRecoveryKeyIdsForUser: An error occurred while getting recovery key Ids from the database. Message:{message} -or-
      
 
      QueryVolumeUsers: An error occurred while getting user information from the database.
      
 
      This message is logged whenever there is an exception while communicating with the MBAM recovery database. Read through the information contained in the trace to get specific details about the exception.
      
-
      For detailed troubleshooting steps, see the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx).
      
+
      For detailed troubleshooting steps, see the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine.
      
 
 
 
      101
      
@@ -522,7 +525,7 @@ The following table contains messages and troubleshooting information for event
 
      QueryRecoveryKeyIdsForUser: An error occurred while logging an audit event to the compliance database. Message:{message} -or-
      
 
      QueryDriveRecoveryData: An error occurred while logging an audit event to the compliance database. Message:{message}
      
 
      This message is logged whenever there is an exception while communicating the MBAM compliance database. Read through the information contained in the trace to get specific details about the exception.
      
-
      For detailed troubleshooting steps, see the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx).
      
+
      For detailed troubleshooting steps, see the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine.
      
 
 
 
      102
      
@@ -530,7 +533,7 @@ The following table contains messages and troubleshooting information for event
 
      AgentServiceRecoveryDbError
      
 
      
 
      This message indicates an exception when MBAM Agent service tries to communicate with the recovery database. Read through the message contained in the event to get specific information about the exception.
      
-
      See the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify whether the MBAM app pool account has required permissions in place to connect or execute on MBAM recovery database.
      
+
      See the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify whether the MBAM app pool account has required permissions in place to connect or execute on MBAM recovery database.
      
 
 
 
      103
      
@@ -555,7 +558,7 @@ The following table contains messages and troubleshooting information for event
 
      StatusServiceComplianceDbError
      
 
      
 
      This error indicates that MBAM websites/web services were unable to connect to the MBAMCompliance database.
      
-
      See the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify that the IIS app pool account could connect to the MBAM compliance database.
      
+
      See the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify that the IIS app pool account could connect to the MBAM compliance database.
      
 
 
 
      106
      
@@ -598,7 +601,7 @@ The following table contains messages and troubleshooting information for event
 
      QueryRecoveryKeyIdsForUser: an error occurred while getting recovery key Ids for a user. Message:{message} -or-
      
 
      An error occurred while getting TPM password hash from the Recovery database. EventDetails:{ExceptionMessage}
      
 
      This message indicates that recovery database connection string information at "HKLM\Software\Microsoft\MBAM Server\Web\RecoveryDBConnectionString" is invalid. Verify the given registry key value. –or-
      
-
      If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify whether a connection could be made to the MBAM Recovery database from IIS server using app pool credentials.
      
+
      If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify whether a connection could be made to the MBAM Recovery database from IIS server using app pool credentials.
      
 
 
 
      110
      
@@ -609,7 +612,7 @@ The following table contains messages and troubleshooting information for event
 
      QueryRecoveryKeyIdsForUser: an error occurred while logging an audit event to the Compliance database. Message:{message} -or-
      
 
      QueryRecoveryKeyIdsForUser: an error occurred while logging an audit event to the compliance database. Message:{message}
      
 
      This message indicates that compliance db connection string information at "HKLM\Software\Microsoft\MBAM Server\Web\ComplianceDBConnectionString" is invalid. Verify the value corresponding to above registry key. –or-
      
-
      If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify whether a connection could be made to the MBAM Compliance database from IIS server using app pool credentials.
      
+
      If any of the remaining messages are logged, refer to the troubleshooting steps listed at the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify whether a connection could be made to the MBAM Compliance database from IIS server using app pool credentials.
      
 
 
 
      111
      
@@ -622,7 +625,7 @@ The following table contains messages and troubleshooting information for event
 
    • MBAM websites/webservices execution account(app pool account) could not run the GetVersion stored procedure on MBAMCompliance OR MBAMRecovery database
      • 
 
    
 
    The message contained in the event will provide more details about the exception.
    
-
    Refer to the troubleshooting steps listed at the TechNet article [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx) to verify that the MBAM execution account (app pool account) could connect to MBAM compliance/recovery database and it has permissions in place to execute GetVersion stored procedure.
    
+
    Refer to the troubleshooting steps listed at the TechNet article How to Troubleshoot Connecting to the SQL Server Database Engine to verify that the MBAM execution account (app pool account) could connect to MBAM compliance/recovery database and it has permissions in place to execute GetVersion stored procedure.
    
 
 
 
    112
    
@@ -658,7 +661,7 @@ The following table contains messages and troubleshooting information for event
 
 
 
- 
+ 
 
 
 ## Related topics
@@ -668,11 +671,11 @@ The following table contains messages and troubleshooting information for event
 
 [Client Event Logs](client-event-logs.md)
 
- 
+ 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+ 
 
 
 
diff --git a/mdop/mbam-v25/technical-reference-for-mbam-25.md b/mdop/mbam-v25/technical-reference-for-mbam-25.md
index d09d2963c8..a8b62bb56d 100644
--- a/mdop/mbam-v25/technical-reference-for-mbam-25.md
+++ b/mdop/mbam-v25/technical-reference-for-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Technical Reference for MBAM 2.5
 description: Technical Reference for MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: da77a5b6-d5cf-4bae-9475-13a75088ab23
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/troubleshooting-mbam-25.md b/mdop/mbam-v25/troubleshooting-mbam-25.md
index cb05acd2bf..e756c4cc34 100644
--- a/mdop/mbam-v25/troubleshooting-mbam-25.md
+++ b/mdop/mbam-v25/troubleshooting-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Troubleshooting MBAM 2.5
 description: Troubleshooting MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: f35e7aef-2c3c-4d43-b170-6830d2756063
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/mdop/mbam-v25/troubleshooting-mbam-installation.md b/mdop/mbam-v25/troubleshooting-mbam-installation.md
new file mode 100644
index 0000000000..f2d0494b7f
--- /dev/null
+++ b/mdop/mbam-v25/troubleshooting-mbam-installation.md
@@ -0,0 +1,645 @@
+---
+title: Troubleshooting MBAM 2.5 installation problems
+description: Introducing how to troubleshoot MBAM 2.5 installation problems.
+author: Deland-Han
+ms.reviewer: dcscontentpm
+manager: dansimp
+ms.author: delhan
+ms.sitesec: library
+ms.prod: w10
+ms.date: 09/16/2019
+manager: dcscontentpm
+--- 
+
+# Troubleshooting MBAM 2.5 installation problems
+
+This article introduces how to troubleshoot Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 installation issues in a standalone configuration.
+
+## Referring MBAM log files for troubleshooting
+
+MBAM includes logging for server installation, client installation, and events. This logging should be referred to for troubleshooting. 
+ 
+### MBAM server installation log files
+
+MBAMServerSetup.exe generates the following log files in the user’s %temp% folder during MBAM installation:
     **Microsoft_BitLocker_Administration_and_Monitoring_<14 numbers>.log**
+
+MBAMServerSetup.exe logs the actions that were taken during MBAM setup and MBAM server feature installation:
     **Microsoft_BitLocker_Administration_and_Monitoring_<14_numbers>_0_MBAMServer.msi.log**
+
+MBAMServerSetup.exe logs additional actions that were taken during installation.
+
+### MBAM client installation log file
+
+The client installation is recorded in the following log file in the %temp% folder (or a custom location, depending on how the client was installed): 
    **MSI\.log**
+
+This log contains the actions that are taken during MBAM client installation.
+ 
+### MBAM client event-logging channel
+
+MBAM has separate event-logging channels. The Admin, Analytical, and Operational log files are located in Event Viewer, under **Application and Services Logs** > **Microsoft** > **Windows** > **MBAM**.
+
+The following table provides a brief description of each event log.
+ 
+|Event log|	Description|
+|----------|-------|
+|Microsoft-Windows-MBAM/Admin|	Contains error messages|
+|Microsoft-Windows-MBAM/Analytic|	Contains advanced logging information|
+|Microsoft-Windows-MBAM/Operational|	Contains success messages|
+
+### MBAM server event-logging channel
+
+The log files are located in Event Viewer, under **Application and Services Logs** > **Microsoft** > **Windows** > **MBAM**. The following table includes server event logs that were introduced in MBAM 2.5:
+
+|Event log|	Description|
+|--------|-------------|
+|Microsoft-Windows-MBAM/Admin|	Contains error messages|
+|Microsoft-Windows-MBAM/Analytic|	Contains advanced logging information|
+|Microsoft-Windows-MBAM/Operational|	Contains success messages|
+
+### MBAM web service logs
+
+Each MBAM web service log writes logging information to an SVCLOG file. By default, each web service writes the trace file under a folder that uses its name in the C:\inetpub\Microsoft BitLocker Management Solution\Logs folder.
+
+You can use the service trace viewer tool (part of Microsoft Visual Studio) to review the svclog traces.
+
+## Troubleshooting encryption and reporting issues
+
+This section contains troubleshooting information for server functionality, client functionality, configuration settings, and known issues:
+ 
+### MBAM client installation, Group Policy settings
+
+Determine whether the MBAM agent is installed on the client computer. When MBAM is installed, it creates a service that is named BitLocker Management Client Service. This service is configured to start automatically. Determine whether the service is running.
+
+Make sure that MBAM Group Policy settings are applied on the client computer. The following registry subkey is created if the Group Policy settings were applied on the client computer:
+**HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement**
+
+Verify that this key exists and is populated by using values per Group Policy settings.
+
+### MBAM Agent in the initial delay period
+
+The MBAM client doesn't start the operation immediately after installation. There is an initial random delay of 1–18 minutes before the MBAM Agent starts its operation. In addition to the initial delay, there is a delay of at least 90 minutes. (The delay depends on the Group Policy settings that are configured for the frequency of checking the client status.) Therefore, the total delay before a client starts operation is *random startup delay* + *client checking frequency delay*.
+
+If the Operational and Admin event logs are blank, the client has not started the operation yet and is in the delay period that was mentioned earlier. If you want to bypass the delay, follow these steps:
+ 
+1. Stop the BitLocker Management Client Service service.
+
+2. Under the **HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM** registry subkey, create the **NoStartupDelay** registry value, set its type to **REG_DWORD**, and then set its value to **1**.
+
+3. Under **HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement**, set the **ClientWakeupFrequency** and **StatusReportingFrequency** values to **1**. These values will revert to their original settings after Group Policy updates are on the computer.
+
+4. Start the BitLocker Management Client Service service.
+
+After the service starts, if you log in locally on the computer and there are no errors, you should receive a request to encrypt the computer within one minute. If you do not receive a request, you should review the MBAM Admin logs for any error entries.
+
+### Computer does not have a TPM device, or the TPM device is not enabled in the BIOS
+
+Review the MBAM Admin event log. You will see an event entry that resembles the following in the MBAM Admin event log:
+
+    Log Name:      Microsoft-Windows-MBAM/Admin
+    Source:        Microsoft-Windows-MBAM
+    Date:          8/3/2013 12:31:10 PM
+    Event ID:      9
+    Task Category: None
+    Level:         Error
+    Keywords:      
+    User:          SYSTEM
+    Computer:      Mbamclient.contoso.com
+    Description:
+    The TPM hardware is missing.
+    TPM is needed to encrypt the operating system drive with any TPM protector.
+
+Open TPM Management (tpm.msc), and check whether the computer has a TPM device. If tpm.msc does not show a device, open Device Manager (devmgmt.msc), and check for a Trusted Platform Module under Security Devices. If you do not see a Trusted Platform Module device, this might be true for one of the following reasons:
+
+* Your system doesn't have a Trusted Platform Module (TPM/Security) device.
+
+* The TPM device is disabled in the BIOS.
+
+* TPM Device is enabled in the BIOS, but management of the TPM device from the operating system setting is disabled in the BIOS.
+
+* You aren't using a Microsoft driver for the TPM device. Review the devices that are listed in device manager to identify the Microsoft TPM device driver.
+
+If the TPM device is not using the C:\Windows\System32\tpm.sys driver, you should update the driver by selecting the C:\Windows\Inf\tpm.inf file.
+
+### Computer does not have a valid SYSTEM partition
+
+Review the MBAM Admin event log. You will see an event entry that resembles the following in the MBAM Admin event log:
+
+    Log Name:      Microsoft-Windows-MBAM/Admin
+    Source:        Microsoft-Windows-MBAM
+    Date:          8/3/2013 4:13:37 AM
+    Event ID:      8
+    Task Category: None
+    Level:         Error
+    Keywords:      
+    User:          SYSTEM
+    Computer:      BITTESTVM.xtremelabs.com
+    Description:
+    The system volume is missing.
+    SystemVolume is needed to encrypt the operating system drive.
+
+BitLocker requires a SYSTEM partition to enable encryption ([BitLocker Drive Encryption in Windows 7: Frequently Asked Questions](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-7/ee449438(v=ws.10)?redirectedfrom=MSDN#bkmk_partitions)).
+
+MBAM doesn't create the system partition automatically. You can use the BitLocker drive preparation utility (bdehdcfg.exe) to create the system partition and move the required startup files.
+
+For example, you can use the command **%windir%\system32\bdeHdCfg.exe -target default -size 300 –quiet** to prepare the drive silently before you deploy MBAM to encrypt the drives. This requires a restart. You can also script the action if this is required. The following document describes the BitLocker Drive Preparation Tool:
+
+[Description of the BitLocker Drive Preparation Tool](https://support.microsoft.com/help/933246)
+
+### Drives are not formatted to have a compatible file system
+
+See the [TechNet article for file system requirements for BitLocker](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-7/ee449438(v=ws.10)?redirectedfrom=MSDN#bkmk_hsrequirements).
+
+### Group Policy conflict
+
+You will see an event entry that resembles the following in the MBAM Admin event log:
+
+    Log Name:      Microsoft-Windows-MBAM/Admin
+    Source:        Microsoft-Windows-MBAM
+    Date:          7/25/2013 9:27:58 PM
+    Event ID:      22
+    Task Category: None
+    Level:         Error
+    Keywords:      
+    User:          SYSTEM
+    Computer:      Mbamclient.contoso.com
+    Description:
+    Detected Fixed Data Drive volume encryption policies conflict.
+    Check BitLocker and MBAM policies related to FDD drive protectors.
+
+Verify your Group Policy settings to make sure that you do not have a conflicting setting among the MBAM Group Policy settings.
+
+You should configure Group Policy by using the MDOP MBAM template and not the BitLocker Drive Encryption template.
+
+For example:
+
+Under Operating system drive encryption settings, you selected TPM as the protector, and you also selected **Allow enhanced PINs for startup**. These are conflicting settings because TPM-only protection doesn't require a PIN. Therefore, you should disable the enhanced PINs setting.
+
+### User may have requested an exemption
+
+If you enabled the Computer Configuration\Administrative Templates\Windows Components\MDOP MBAM (BitLocker Management)\Client Management\Configure user exemption policy Group Policy setting, users will be offered the option to request an exemption.
+
+By default, if the user requests an exemption, the exemption will be valid for 7 days, and the user will not receive prompts to encrypt during this period. (The default value can be increased or decreased during policy configuration.) After the exemption period is over, the user is prompted to encrypt.
+
+You will see the following entry in the MBAM Admin event log when a computer is under user exemption:
+
+    Log Name:      Microsoft-Windows-MBAM/Admin
+    Source:        Microsoft-Windows-MBAM
+    Date:          8/3/2013 3:06:40 PM
+    Event ID:      13
+    Task Category: None
+    Level:         Warning
+    Keywords:      
+    User:          SYSTEM
+    Computer:      MBAMCLIENT.contoso.com
+    Description:
+    The user is exempt from encryption.
+
+If you want to manually override user exemption for a computer, follow these steps:
+ 
+1. Set the AllowUserExemption value to **0** under the following registry subkey: 
    
+**HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement**
+
+2. Delete all the registry values under the following registry subkey except for **AgentVersion**, **EncodedComputerName**, and **Installed**:
    
+**HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM**
+
+    **Note** You must restart the MBAM agent for the changes to take effect.
+
+Be aware that after you apply Group Policy to the computer, these values may revert to their original settings.
+
+### WMI issue
+
+MBAM uses methods of the win32_encryptablevolume class to manage BitLocker. If this module is unregistered or corrupted, the MBAM client will not operate correctly, and you will see the following event entry in the MBAM Admin event log:
+
+    Log Name:      Microsoft-Windows-MBAM/Admin
+    Source:        Microsoft-Windows-MBAM
+    Date:          7/27/2013 11:18:51 PM
+    Event ID:      4
+    Task Category: None
+    Level:         Error
+    Keywords:      
+    User:          SYSTEM
+    Computer:      BITTEST.xtremelabs.com
+    Description:
+    An error occurred while sending encryption status data.
+    Error code:
+    0x80041016 
+    Details:
+    NULL
+
+Additionally, you may notice that the Recovery and Hardware policies do not apply with Error Code 0x8007007e. This translates to "The specified module could not be found."
+
+To resolve this issue, you should reregister the **win32_encryptablevolume** class by using the following command:
+
+```cmd
+mofcomp c:\Windows\System32\wbem\win32_encryptablevolume.mof
+```
+
+## Troubleshooting MBAM Agent communication issues
+
+This section contains troubleshooting information for the following issues that are related to MBAM agent communication:
+
+### Incorrect MBAM service URL
+
+If the value of MBAM Compliance Status Service or Recovery and Hardware Service is incorrect, you'll see an event entry that resembles the following in the MBAM Admin event log on the client computer:
+
+    Log Name:      Microsoft-Windows-MBAM/Admin
+    Source:        Microsoft-Windows-MBAM
+    Date:          8/3/2013 4:13:36 PM
+    Event ID:      4
+    Task Category: None
+    Level:         Error
+    Keywords:     
+    User:          SYSTEM
+    Computer:      Mbamclient.contoso.com
+    Description:
+    An error occurred while sending encryption status data.
+    Error code:
+    0x803d0010
+    Details:
+    The remote endpoint was not reachable.
+
+    Log Name:      Microsoft-Windows-MBAM/Admin
+    Source:        Microsoft-Windows-MBAM
+    Date:          8/3/2013 4:13:33 PM
+    Event ID:      18
+    Task Category: None
+    Level:         Error
+    Keywords:     
+    User:          SYSTEM
+    Computer:      Mbamclient.contoso.com
+    Description:
+    Unable to connect to the MBAM Recovery and Hardware service.
+    Error code:
+    0x803d0010
+    Details:
+    The remote endpoint was not reachable.
+
+    Log Name:      Microsoft-Windows-MBAM/Admin
+    Source:        Microsoft-Windows-MBAM
+    Date:          8/3/2013 4:20:32 PM
+    Event ID:      4
+    Task Category: None
+    Level:         Error
+    Keywords:     
+    User:          SYSTEM
+    Computer:      Mbamclient.contoso.com
+    Description:
+    An error occurred while sending encryption status data.
+    Error code:
+    0x803d0020
+    Details:
+    The endpoint address URL is invalid.
+
+    Log Name:      Microsoft-Windows-MBAM/Admin
+    Source:        Microsoft-Windows-MBAM
+    Date:          8/3/2013 4:20:32 PM
+    Event ID:      18
+    Task Category: None
+    Level:         Error
+    Keywords:     
+    User:          SYSTEM
+    Computer:      Mbamclient.contoso.com
+    Description:
+    Unable to connect to the MBAM Recovery and Hardware service.
+    Error code:
+    0x803d0020
+    Details:
+    The endpoint address URL is invalid.
+
+Verify the values of **KeyRecoveryServiceEndPoint** and **StatusReportingServiceEndpoint** under the following registry subkey on the client computer: 
    
+**HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement**
+
+By default, the URL for KeyRecoveryServiceEndPoint (MBAM Recovery and Hardware service endpoint) is in the following format: 
    
+**http://\:\/MBAMRecoveryAndHardwareService/CoreService.svc**
+
+By default, the URL for StatusReportingServiceEndpoint (MBAM Status reporting service endpoint) is in the following format:
    
+**http://\:\/MBAMComplianceStatusService/StatusReportingService.svc**
+
+> [!Note]
+> There should be no spaces in the URL.
+
+If the service URL is incorrect, you should correct the service URL in the following Group Policy setting:
+
+**Computer configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDOP MBAM (BitLocker Management)** > **Client Management** > **Configure MBAM Services**
+
+### Connectivity issue that affects the MBAM administration server
+
+The MBAM agent will be unable to post any updates to the database if connectivity issues exist between the client agent and the MBAM administration server. In this case, you will notice connectivity failure entries in the MBAM Admin event log on the client computer:
+
+    Log Name:      Microsoft-Windows-MBAM/Admin
+    Source:        Microsoft-Windows-MBAM
+    Date:          29-04-2014 18:21:22
+    Event ID:      2
+    Task Category: None
+    Level:         Error
+    Keywords:     
+    User:          SYSTEM
+    Computer:      TESTLABS.CONTOSO.COM
+    Description:
+    An error occurred while applying MBAM policies.
+    Volume ID:\\?\Volume{871c5858-2467-4d0b-8c83-d68af8ce10e5}\ 
+    Error code:
+    0x803D0010 
+    Details:
+    The remote endpoint was not reachable.
+ 
+    Log Name:      Microsoft-Windows-MBAM/Admin
+    Source:        Microsoft-Windows-MBAM
+    Date:          29-04-2014 23:06:48
+    Event ID:      2
+    Task Category: None
+    Level:         Error
+    Keywords:     
+    User:          SYSTEM
+    Computer:      TESTLABS.CONTOSO.COM
+    Description:
+    An error occurred while applying MBAM policies.
+    Volume ID:\\?\Volume{871c5858-2467-4d0b-8c83-d68af8ce10e5}\ 
+    Error code:
+    0x803D0006 
+    Details:
+    The operation did not complete within the time allotted.
+
+    Log Name:      Microsoft-Windows-MBAM/Admin
+    Source:        Microsoft-Windows-MBAM
+    Date:          02-09-2013 02:02:04
+    Event ID:      18
+    Task Category: None
+    Level:         Error
+    Keywords:     
+    User:          SYSTEM
+    Computer:      TESTLABS.CONTOSO.COM
+    Description:
+    Unable to connect to the MBAM Recovery and Hardware service.
+    Error code:
+    0x803D0010 
+    Details:
+    The remote endpoint was not reachable.
+
+Basic checks:
+
+* Verify basic connectivity by pinging the MBAM administration server by name and IP. Check whether you can connect to the MBAM administration website or service port by using telnet or portqry.
+
+* Verify that the IIS service is running on the MBAM administration and monitoring server and that the MBAM web service is listening on the same port that is configured on the MBAM client computer (`netstat –ano | find "portnumber"`).
+
+* Verify that the port number that is configured for the MBAM website is using IIS Manager (inetmgr). Make sure that the port number is the same as the port number on which the client is listening. Make sure that the port number is not shared by another application. For example, another application on the server should not be using the same port.
+
+* If there is a firewall, make sure that the port is open in the firewall or proxy server.
+
+* If the communication between client and server is secure, make sure that you are using a valid SSL certificate.
+
+* Verify network connectivity between the web server and the database server to which the data is sent for insertion. You can check database connectivity from the web server to the database server by using ODBC Data Source Administrator. Detailed SQL Server connection troubleshooting information is available in [How to Troubleshoot Connecting to the SQL Server Database Engine](https://social.technet.microsoft.com/wiki/contents/articles/2102.how-to-troubleshoot-connecting-to-the-sql-server-database-engine.aspx).
+
+#### Troubleshooting the connectivity issue
+
+Make sure that the service URL that is configured on the client is correct. Copy the value of the URL for KeyRecoveryServiceEndPoint (**HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement**) from the registry, and open it in Internet Explorer.
+
+Similarly, copy the value of the URL for StatusReportingServiceEndpoint (**HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement**), and open it in Internet Explorer.
+
+> [!Note]
+> If you cannot browse to the URL from the client computer, you should test basic network connectivity from the client to the server that is running IIS. See points 1, 2, 3, and 4 in the previous section.
+
+Additionally, review the Application logs on the administration and monitoring server for any errors.
+
+You can make a concurrent network trace between the client and the server, and review the trace to determine the cause of connection failure between the client agent and the MBAM administration server.
+
+> [!Note]
+> If you can browse to the service URLs from the client computer and there are connectivity error entries in the MBAM admin event logs, this might be because of a connectivity failure between the administration server and the database server.
+
+If you can successfully browse to both service URLs, and there is connectivity between the client and the server that is running, IIS is working. However, there may be a problem in communication between the server that is running IIS and the database server.
+
+The MBAM services may be unable to connect to the database server because of a network issue or an incorrect database connection string setting. Review the Application logs on the administration and monitoring server. You might see errors entries or warnings from source ASP.NET 2.0.50727.0 that resemble the following log entry:
+
+    Log Name:      Application
+    Source:        ASP.NET 2.0.50727.0
+    Date:          7/11/2013 6:16:34 PM
+    Event ID:      1310
+    Task Category: Web Event
+    Level:         Warning
+    Keywords:      Classic
+    User:          N/A
+    Computer:      MBAM2-Admin.contoso.com
+    Description:
+    Event code: 100001
+    Event message: SQL error occurred
+    Event time: 7/11/2013 6:16:34 PM
+    Event time (UTC): 7/11/2013 12:46:34 PM
+    Event ID: 6615fb8eb9d54e778b933d5bb7ca91ed
+    Event sequence: 2
+    Event occurrence: 1
+    Event detail code: 0 
+    Application information:
+        Application domain: /LM/W3SVC/2/ROOT/MBAMAdministrationService-1-130180202570338699
+        Trust level: Full
+        Application Virtual Path: /MBAMAdministrationService
+        Application Path: C:\inetpub\Microsoft BitLocker Management Solution\Administration Service\
+        Machine name: MBAM2-ADMIN 
+    
+    Process information:
+        Process ID: 1940
+        Process name: w3wp.exe
+        Account name: NT AUTHORITY\NETWORK SERVICE 
+    
+    Exception information:
+        Exception type: SqlException
+        Exception message: A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server) 
+    
+    Request information:
+        Request URL: 
+        Request path: 
+        User host address: 
+        User: 
+        Is authenticated: False
+        Authentication Type: 
+        Thread account name: NT AUTHORITY\NETWORK SERVICE 
+    
+    Thread information:
+        Thread ID: 7
+        Thread account name: NT AUTHORITY\NETWORK SERVICE
+        Is impersonating: False
+        Stack trace:    at System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection)
+       at System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj)
+       at System.Data.SqlClient.TdsParser.Connect(ServerInfo serverInfo, SqlInternalConnectionTds connHandler, Boolean ignoreSniOpenTimeout, Int64 timerExpire, Boolean encrypt, Boolean trustServerCert, Boolean integratedSecurity, SqlConnection owningObject)
+       at System.Data.SqlClient.SqlInternalConnectionTds.AttemptOneLogin(ServerInfo serverInfo, String newPassword, Boolean ignoreSniOpenTimeout, Int64 timerExpire, SqlConnection owningObject)
+       at System.Data.SqlClient.SqlInternalConnectionTds.LoginNoFailover(String host, String newPassword, Boolean redirectedUserInstance, SqlConnection owningObject, SqlConnectionString connectionOptions, Int64 timerStart)
+       at System.Data.SqlClient.SqlInternalConnectionTds.OpenLoginEnlist(SqlConnection owningObject, SqlConnectionString connectionOptions, String newPassword, Boolean redirectedUserInstance)
+       at System.Data.SqlClient.SqlInternalConnectionTds..ctor(DbConnectionPoolIdentity identity, SqlConnectionString connectionOptions, Object providerInfo, String newPassword, SqlConnection owningObject, Boolean redirectedUserInstance)
+       at System.Data.SqlClient.SqlConnectionFactory.CreateConnection(DbConnectionOptions options, Object poolGroupProviderInfo, DbConnectionPool pool, DbConnection owningConnection)
+       at System.Data.ProviderBase.DbConnectionFactory.CreatePooledConnection(DbConnection owningConnection, DbConnectionPool pool, DbConnectionOptions options)
+       at System.Data.ProviderBase.DbConnectionPool.CreateObject(DbConnection owningObject)
+       at System.Data.ProviderBase.DbConnectionPool.UserCreateRequest(DbConnection owningObject)
+       at System.Data.ProviderBase.DbConnectionPool.GetConnection(DbConnection owningObject)
+       at System.Data.ProviderBase.DbConnectionFactory.GetConnection(DbConnection owningConnection)
+       at System.Data.ProviderBase.DbConnectionClosed.OpenConnection(DbConnection outerConnection, DbConnectionFactory connectionFactory)
+       at System.Data.SqlClient.SqlConnection.Open()
+       at System.Data.Linq.SqlClient.SqlConnectionManager.UseConnection(IConnectionUser user)
+       at System.Data.Linq.SqlClient.SqlProvider.get_IsSqlCe()
+       at System.Data.Linq.SqlClient.SqlProvider.InitializeProviderMode()
+       at System.Data.Linq.SqlClient.SqlProvider.System.Data.Linq.Provider.IProvider.Execute(Expression query)
+       at System.Data.Linq.DataContext.ExecuteMethodCall(Object instance, MethodInfo methodInfo, Object[] parameters)
+       at Microsoft.Mbam.Server.ServiceCommon.KeyRecoveryModelDataContext.GetRecoveryKeyIds(String partialRecoveryKeyId, String reason)
+       at Microsoft.Mbam.ApplicationSupportService.AdministrationService.GetRecoveryKeyIds(String partialRecoveryKeyId, String reasonCode)
+    
+    Custom event details:
+        Application: MBAMAdministrationService
+        Sql Server:
+        Database: MBAM Recovery and Hardware
+        Database: MBAM Compliance Status
+        Sql ErrorCode: 5
+        Error Message: A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server)
+
+#### Possible causes
+
+##### Cause 1
+
+The administrator may have specified an invalid database instance name/database name during installation of administration and monitoring server components.
+
+You can verify and correct the database connection strings by using the IIS Management console. To do this, open IIS Manager, and browse to Microsoft BitLocker Administration and Monitoring. For each service that is listed on the left side, follow these steps to change the database connection strings:
+
+1. In **Features View**, double-select **Connection Strings**.
+
+2. On the **Connection Strings** page, select the connection string that you want to change.
+
+3. In the **Actions** pane, select **Edit**.
+
+4. In the **Edit Connection String** dialog box, change the properties that you want to change, and then select **OK**.
+
+##### Cause 2
+
+SQL Server port blocked in firewall. Verify the port number to which SQL Server is configured to listen, and make sure that the port is open in the firewall between the administration server and database server.
+
+##### Cause 3
+
+Incorrect SQL server TCP/IP bindings. Verify SQL TCP/IP bindings in SQL Server Configuration Manager on the database server. MBAM requires that the TCP/IP and Named Pipes protocols are enabled to connect to the database.
+
+##### Cause 4
+
+The NT Authority\Network Service account or the MBAM Administration Server’s computer account doesn't have the required permissions to connect to the SQL database.
+
+During the installation of database components on the database server, the installer creates two local groups: MBAM Compliance Auditing DB Access and MBAM Recovery and Hardware DB Access.
+
+The NT Authority\Network Service account, the MBAM administration server’s computer account, and the user who installs the database components are automatically added to these groups.
+
+These groups are granted the required permissions on the database during the installation. All users who are part of this group automatically receive the required permissions on the database.
+
+The web service may not connect to the database server because of a permissions issue if one or more of the following conditions are true:
+
+* The groups that were mentioned earlier are removed from the local groups on the database server.
+
+* The NT Authority\Network Service account and the MBAM administration server’s computer account are not members of these groups.
+
+* These groups do not have the required permissions on the database.
+
+You will notice permissions-related errors in the Application logs on the MBAM administration and monitoring server if any of the previous conditions are true. In that case, you should manually add the NT Authority\Network Service account and MBAM administration server’s computer account and grant them a server-wide public role on the SQL database server that is using SQL Server Management Studio (https://msdn.microsoft.com/library/aa337562.aspx).
+
+#### Review the web service logs
+
+If no events are logged in the Application logs on the MBAM administration server, it’s time to review the web service logs (.svclog) of the MBAM web service that is hosted on the MBAM administration and monitoring server. You will have to use the Service Trace Viewer Tool (SvcTraceViewer.exe) https://msdn.microsoft.com/library/ms732023.aspx to view the log file.
+
+You should primarily investigate the service trace logs of RecoveryandHardwareService and ComplianceStatusService. By default, web service logs are located in the C:\inetpub\Microsoft BitLocker Management Solution\Logs folder. There, each service writes its .svclog file under its own folder.
+
+Review the activity in the service trace log for any error or warning entries. By default, error entries are highlighted in red. Select the error description on the right pane of the trace viewer to view detailed information about the error entry. The following is a sample error entry from the trace log:
+
+    
+    
+    15183
+    3
+    0
+    2
+    
+    
+    
+    
+    
+    XXXXXXXXXXX
+    
+    AddUpdateVolume: While executing sql transaction for add volume to store exception occurred Key Recovery Data Store processing error: Violation of UNIQUE KEY constraint 'UniqueRecoveryKeyId'. Cannot insert duplicate key in object 'RecoveryAndHardwareCore.Keys'. The duplicate key value is (8637036e-b379-4798-bd9e-5a0b36296de3).
+    
+    
+
+## Re-installation or reconfiguration of MBAM infrastructure
+
+To re-install or reconfigure MBAM infrastructure, you must know the following things:
+
+* Application Pool account
+
+* MBAM Groups (Helpdesk, Advanced, Report Users Group)
+
+* MBAM Reports URL
+
+* SQL Server name and database names
+
+* MBAM ReadWrite and ReadOnly Accounts
+
+### Application Pool account
+
+To find the Application Pool account, log on to the MBAM Web Server, open **Internet Information Services (IIS) Manager**, and then select **Application Pools**:
+
+![application pools](images/troubleshooting-MBAM-installation-1.png)
+
+The Service Principal Name (SPN) must be set in this account. This setting is very important to the functionality of MBAM.
+
+### MBAM Groups (Helpdesk, Advanced, Report Users Group and Reports URL)
+
+![MBAM Groups](images/troubleshooting-MBAM-installation-2.png)
+
+This provides information such as Helpdesk Group, Advanced Helpdesk Group, Report Users group, and MBAM Reports URL. The MBAM Reports URL must be provided in the MBAM setup and should read as: http(s)://servername/ReportServer.
+
+### SQL Server name and database (DB) names
+
+To find the SQL Server names and instances hosting the MBAM DBs, log on to the MBAM Web (IIS) server and browse to the folowing registry subkey:
+
+**HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM Server\Web**
+
+![Regedit](images/troubleshooting-MBAM-installation-3.png)
+
+The highlighted portions are connection strings. These should have the SQL Server name, database names, and instances (if named).
+
+### MBAM ReadWrite and ReadOnly accounts
+
+This information will be in the SQL Server database, for which we already found the name from the web server.
+
+#### ReadWrite account
+
+1. Log in to the SQL Management Studio.
+
+2. Right-click **MBAM Recovery and Hardware**, select **Properties**, and then select **Permissions**.
+
+For example, The the lab account name is **MBAMWrite**. The Application Pool and ReadWrite accounts are set to be the same.
+
+![SQL DB](images/troubleshooting-MBAM-installation-4.png)
+
+![DB properties](images/troubleshooting-MBAM-installation-5.png)
+
+Browse to **Security** and then **Logins** in SQL Management Studio. Browse to the account shown in the previous screenshot.
+
+![SQL Security](images/troubleshooting-MBAM-installation-6.png)
+
+Right-click the accounts, go to **Properties User Mapping**, and locate the MBAM Recovery and Hardware database:
+
+![User Mapping](images/troubleshooting-MBAM-installation-7.png)
+
+#### ReadOnly account
+
+Open SQL Server Reporting Services Configuration Manager on the SSRS Server. Select **Report Manager URL**, and then browse the **URLs**:
+
+![Report Manager](images/troubleshooting-MBAM-installation-8.png)
+
+Select **Microsoft Bitlocker Administration and Monitoring**:
+
+![Bitlocker Administration and Monitoring](images/troubleshooting-MBAM-installation-9.png)
+
+Select **MaltaDatasource**:
+
+![DBs](images/troubleshooting-MBAM-installation-10.png)
+
+![MaltaDatasource](images/troubleshooting-MBAM-installation-11.png)
+
+MaltaDataSource should have the ReadOnly Account name and should be used in MBAM setup.
+
+## Reference
+
+For more information, see the following articles:
+
+[Deploying MBAM 2.5 in a standalone configuration](https://support.microsoft.com/help/3046555)
+
+[Microsoft BitLocker Administration and Monitoring 2.5](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/)
diff --git a/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md b/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md
index 508b82dd72..5f546b0f97 100644
--- a/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md
+++ b/mdop/mbam-v25/understanding-mbam-25-stand-alone-reports.md
@@ -1,8 +1,11 @@
 ---
 title: Understanding MBAM 2.5 Stand-alone Reports
 description: Understanding MBAM 2.5 Stand-alone Reports
-author: jamiejdt
+author: dansimp
 ms.assetid: 78b5aaf4-8257-4722-8eb9-e0de48db6a11
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 This topic describes the reports that are available when you are running Microsoft BitLocker Administration and Monitoring (MBAM) in the Stand-alone topology.
 
-**Note**  
+**Note**  
 If you are running MBAM with the Configuration Manager Integration topology, you generate reports from Configuration Manager rather than from MBAM. See [Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology](viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md) for more information about these reports.
 
- 
+
 
 ## Understanding the MBAM Stand-alone topology reports
 
@@ -91,7 +94,7 @@ Use this report type to collect information about overall BitLocker compliance i
 
 
 
- 
+
 
 **Enterprise Compliance Computer Details**
 
@@ -134,7 +137,7 @@ Use this report type to collect information about overall BitLocker compliance i
 
 
 
- 
+
 
 ### Computer Compliance Report
 
@@ -142,10 +145,10 @@ Use this report type to collect information that is specific to a computer or us
 
 View this report by clicking the computer name in the Enterprise Compliance Report, or by typing the computer name in the Computer Compliance Report. This report shows detailed encryption information about each drive (operating system and fixed data drives) on a computer. It also indicates the policy that is applied to each drive type on the computer. To view the details of each drive, expand the Computer Name entry.
 
-**Note**  
+**Note**  
 Removable Data Volume encryption status is not shown in this report.
 
- 
+
 
 **Computer Compliance Report Fields**
 
@@ -225,7 +228,7 @@ Removable Data Volume encryption status is not shown in this report.
 
 
 
- 
+
 
 **Computer Compliance Report Drive Fields**
 
@@ -276,7 +279,7 @@ Removable Data Volume encryption status is not shown in this report.
 
 
 
- 
+
 
 ### Recovery Audit Report
 
@@ -312,12 +315,11 @@ Use this report type to audit users who have requested access to BitLocker recov
 
    Helpdesk User
    
 
    Help Desk user who initiated the request for key retrieval.
    
 
    
-Note  
-
    If an Advanced Helpdesk User recovers the key without specifying the end user, the End User field will be blank. A standard Helpdesk User must specify the end user, and that user will appear in this field.
    
+Note
    If an Advanced Helpdesk User recovers the key without specifying the end user, the End User field will be blank. A standard Helpdesk User must specify the end user, and that user will appear in this field.
    
 
    A recovery via the Self-Service Portal will list the requesting end user both in this field and in the End User field.
    
 
    
 
    
- 
+
 
    
 
 
@@ -359,12 +361,12 @@ Use this report type to audit users who have requested access to BitLocker recov
 
 
 
- 
 
-**Note**  
+
+**Note**  
 Report results can be saved to a file by clicking the **Export** button on the **Reports** menu bar.
 
- 
+
 
 
 ## Related topics
@@ -374,11 +376,11 @@ Report results can be saved to a file by clicking the **Export** button on the *
 
 [Generating MBAM 2.5 Stand-alone Reports](generating-mbam-25-stand-alone-reports.md)
 
- 
+
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
-- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
+- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
 
 
 
diff --git a/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md b/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md
index 6a9f2918f6..39cd813d57 100644
--- a/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md
+++ b/mdop/mbam-v25/understanding-the-bitlocker-encryption-options-and-bitlocker-drive-encryption-items-in-control-panel.md
@@ -1,8 +1,11 @@
 ---
 title: Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel
 description: Understanding the BitLocker Encryption Options and BitLocker Drive Encryption Items in Control Panel
-author: jamiejdt
+author: dansimp
 ms.assetid: f8a01cc2-0c77-48b9-8351-8194e80b0cf8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -63,19 +66,18 @@ The following table lists the tasks you can perform from each Control Panel item
 
    How the Control Panel item is created
    
 
    Created in Control Panel when you install the MBAM Client. This item cannot be hidden.
    
 
    
-Note  
-
    This item appears in addition to, but does not replace, the default BitLocker Drive Encryption Control Panel item.
    
+Note
    This item appears in addition to, but does not replace, the default BitLocker Drive Encryption Control Panel item.
    
 
    
 
    
- 
+
 
    
 
    Appears by default in Control Panel as part of the Windows operating system, but you can hide it.
    
-
    To hide it, see [Hiding the Default BitLocker Drive Encryption Item in Control Panel](hiding-the-default-bitlocker-drive-encryption-item-in-control-panel-mbam-25.md).
    
+
    To hide it, see Hiding the Default BitLocker Drive Encryption Item in Control Panel.
    
 
 
 
 
- 
+
 
 ## “Manage BitLocker” shortcut menu
 
@@ -111,7 +113,7 @@ The following table describes how the **Manage BitLocker** shortcut menu differs
 
 
 
- 
+
 
 
 ## Related topics
@@ -119,11 +121,11 @@ The following table describes how the **Manage BitLocker** shortcut menu differs
 
 [Administering MBAM 2.5 Features](administering-mbam-25-features.md)
 
- 
+
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
-- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
+- For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam). 
 
 
 
diff --git a/mdop/mbam-v25/upgrade-mbam2.5-sp1.md b/mdop/mbam-v25/upgrade-mbam2.5-sp1.md
new file mode 100644
index 0000000000..153757ee67
--- /dev/null
+++ b/mdop/mbam-v25/upgrade-mbam2.5-sp1.md
@@ -0,0 +1,68 @@
+---
+title: Upgrading from MBAM 2.5 to MBAM 2.5 SP1 Servicing Release Update
+author: dansimp
+ms.author: ksharma
+manager: 
+audience: ITPro  
+ms.topic: article  
+ms.prod: w10
+manager: miaposto
+ms.localizationpriority: Normal
+--- 
+
+# Upgrade from MBAM 2.5 to MBAM 2.5 SP1 Servicing Release Update
+
+This article provides step-by-step instructions to upgrade Microsoft BitLocker Administration and Monitoring (MBAM) 2.5 to MBAM 2.5 Service Pack 1 (SP1) together with the [Microsoft Desktop Optimization Pack (MDOP) May 2019 servicing update](https://support.microsoft.com/help/4505175/may-2019-servicing-release-for-microsoft-desktop-optimization-pack) in a standalone configuration.
+
+In this guide, we will use a two-server configuration. One server will be a database server that's running Microsoft SQL Server 2016. This server will host the MBAM databases and reports. The other server will be a Windows Server 2012 R2 web server. This server will host "Administration and Monitoring" and "Self-Service Portal."
+
+## Prepare to upgrade MBAM 2.5 SP1
+
+### Know the MBAM servers in your environment
+
+1. SQL Server Database Engine: Server that hosts the MBAM databases.
+2. SQL Server Reporting Services: Server that hosts the MBAM reports.
+3. Internet Information Services (IIS) web servers: Server that hosts MBAM Web Applications and MBAM services.
+4. (Optional) Microsoft System Center Configuration Manager primary site server: The MBAM configuration application is run on this server to integrate MBAM reports with Configuration Manager. These reports are then merged with existing Configuration Manager reports on the Configuration Manager SQL Server Reporting Services (SSRS) instance.
+
+### Identify service accounts, groups, server name, and reports URL
+
+1. Identify the MBAM application pool service account that's used by IIS web servers to read and write data to MBAM databases.
+2. Identify the groups that are used during the MBAM web features configuration and the reports web service URL.
+3. Identify the SQL Server name and instance name. Watch this video to learn more.
+
+    > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE3ANP1]
+
+4. Identify the SQL Server Reporting Services Account that's used for reading compliance data from the Compliance and Audit database. Watch this video to learn more.
+
+    > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE3ALdZ]
+
+## Upgrade the MBAM infrastructure to the latest version available
+
+MBAM Server infrastructure installation or upgrade is always performed in the order listed below:
+
+- SQL Server Database Engine: Databases
+- SQL Server Reporting Services: Reports
+- Web Server: Web Applications
+- SCCM Server: SCCM Integrated Reports if applicable
+- Clients: MBAM Agent or Client Update
+- Group Policy Templates: Update the existing Group Policy with new templates and enable new settings on existing MBAM Group Policy
+
+> [!NOTE]
+> We recommend that you create a full database backup of the MBAM databases before you run the upgrades.
+
+### Upgrade the MBAM SQL Server
+
+Watch this video to learn how to upgrade the MBAM SQL Server:
+
+   > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE3ALew]
+
+### Upgrade the MBAM Web Server
+
+Watch this video to learn how to upgrade the MBAM Web Server:
+
+   > [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE3ALex]
+
+## More information
+
+For more information about known issues in MBAM 2.5 SP1, see [Release Notes for MBAM 2.5 SP1](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/release-notes-for-mbam-25-sp1).
diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md b/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md
index 9332d62940..eb867b9ba1 100644
--- a/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md
+++ b/mdop/mbam-v25/upgrading-to-mbam-25-or-mbam-25-sp1-from-previous-versions.md
@@ -1,8 +1,11 @@
 ---
 title: Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions
 description: Upgrading to MBAM 2.5 or MBAM 2.5 SP1 from Previous Versions
-author: jamiejdt
+author: dansimp
 ms.assetid: a9edb4b8-5d5e-42ab-8db6-619db2878e50
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -19,7 +22,7 @@ This topic describes the process for upgrading the Microsoft BitLocker Administr
 **Note**  
 You can upgrade directly to MBAM 2.5 or MBAM 2.5 SP1 from any previous version of MBAM.
 
- 
+ 
 
 ## Before you start the upgrade
 
@@ -49,7 +52,7 @@ Review the following information before you start the upgrade.
 
    To resolve this issue:
    
 
    Run aspnet_regiis –i from the following location:
    
 
    C:\windows\microsoft.net\Framework\v4.0.30319
    
-
    For more information, see: [ASP.NET IIS Registration Tool](https://go.microsoft.com/fwlink/?LinkId=393272).
    
+
    For more information, see: ASP.NET IIS Registration Tool.
    
 
 
 
    Register an SPN on the application pool account if all of the following are true:
    
@@ -57,7 +60,7 @@ Review the following information before you start the upgrade.
 
  • You are upgrading from a previous version of MBAM.
    • 
 
  • Currently, you are not running the MBAM websites in a load-balanced or distributed configuration, but you would like to do so when you upgrade to MBAM 2.5 or 2.5 SP1.
    • 
 
-
    For instructions, see [Planning How to Secure the MBAM Websites](planning-how-to-secure-the-mbam-websites.md#bkmk-registerspn).
    
+
    For instructions, see Planning How to Secure the MBAM Websites.
    
 @@ -83,7 +86,7 @@ Review the following information before you start the upgrade.
 
    
 
 

 
    
 
- 
+ 
 
 ## Steps to upgrade the MBAM Server infrastructure
 
@@ -101,7 +104,7 @@ Use the steps in the following sections to upgrade MBAM for the Stand-alone topo
     **Note**  
     The databases will not be removed, and all compliance and recovery data is maintained in the database.
 
-     
+     
 
 4.  Install and configure the MBAM 2.5 or 2.5 SP1 databases, reports, and web applications, in that order. The databases are upgraded in place.
 
@@ -124,7 +127,7 @@ Use the steps in the following sections to upgrade MBAM for the Stand-alone topo
     **Note**  
     The databases and the Configuration Manager objects (baseline, MBAM supported computers collection, and Reports) will not be removed, and all compliance and recovery data is maintained in the database.
 
-     
+     
 
 5.  Update the .mof files.
 
@@ -158,7 +161,7 @@ MBAM supports upgrades to the MBAM 2.5 Client from any earlier version of the M
 
 [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring).
diff --git a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md
index 8cf42399fe..4e0f5b098c 100644
--- a/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md
+++ b/mdop/mbam-v25/upgrading-to-mbam-25-sp1-from-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Upgrading to MBAM 2.5 SP1 from MBAM 2.5
 description: Upgrading to MBAM 2.5 SP1 from MBAM 2.5
-author: kaushika-msft
+author: dansimp
 ms.assetid: 
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -14,8 +17,8 @@ ms.date: 2/16/2018
 This topic describes the process for upgrading the Microsoft BitLocker Administration and Monitoring (MBAM) Server 2.5 and the MBAM Client from 2.5 to MBAM 2.5 SP1.
 
 ### Before you begin
-#### Download the July 2018 servicing release
-[Desktop Optimization Pack](https://www.microsoft.com/download/details.aspx?id=57157)
+#### Download the May 2019 servicing release
+[Desktop Optimization Pack](https://www.microsoft.com/download/details.aspx?id=58345)
 
 #### Verify the installation documentaion
 Verify you have a current documentation of your MBAM environment, including all server names, database names, service accounts and their passwords.
@@ -23,27 +26,27 @@ Verify you have a current documentation of your MBAM environment, including all
 ### Upgrade steps
 #### Steps to upgrade the MBAM Database (SQL Server)
 1. Using the MBAM Configurator; remove the Reports role from the SQL server, or wherever the SSRS database is hosted. Depending on your environment, this can be the same server or a separate one.
-Note: You will not see an option to remove the Databases; this is expected.  
+   Note: You will not see an option to remove the Databases; this is expected.  
 2. Install 2.5 SP1 (Located with MDOP - Microsoft Desktop Optimization Pack 2015 from the Volume Licensing Service Center site:  
 3. Do not configure it at this time 
-4. Install the July 2018 Rollup: https://www.microsoft.com/download/details.aspx?id=57157
+4. Install the May 2019 Rollup: https://www.microsoft.com/download/details.aspx?id=58345
 5. Using the MBAM Configurator; re-add the Reports role
 6. This will configure the SSRS connection using the latest MBAM code from the rollup 
 7. Using the MBAM Configurator; re-add the SQL Database role on the SQL Server.
-- At the end, you will be warned that the DBs already exist and  weren’t created, but this is expected.
-- This process updates the existing databases to the current version  being installed                  
+8. At the end, you will be warned that the DBs already exist and  weren’t created, but this is expected.
+9. This process updates the existing databases to the current version  being installed                  
 
 #### Steps to upgrade the MBAM Server (Running MBAM and IIS)
 1. Using the MBAM Configurator; remove the Admin and Self Service Portals from  the IIS server
 2. Install MBAM 2.5 SP1
 3. Do not configure it at this time  
-4. Install the July 2018 Rollup on the IIS server(https://www.microsoft.com/download/details.aspx?id=57157)
+4. Install the May 2019 Rollup on the IIS server(https://www.microsoft.com/download/details.aspx?id=58345)
 5. Using the MBAM Configurator; re-add the Admin and Self Service Portals to the IIS server 
-6. This will configure the sites using the latest MBAM code from the July 2018 Rollup
-- Open an elevated command prompt, Type: **IISRESET** and Hit Enter.
+6. This will configure the sites using the latest MBAM code from the May 2019 Rollup
+7. Open an elevated command prompt, Type: **IISRESET** and Hit Enter.
  
 #### Steps to upgrade the MBAM Clients/Endpoints
 1. Uninstall the 2.5 Agent from client endpoints
 2. Install the 2.5 SP1 Agent on the client endpoints
-3. Push out the July 2018 Rollup Client update to clients running the 2.5 SP1 Agent 
-4. There is no need to uninstall the existing client prior to installing the July 2018 Rollup.  
+3. Push out the May 2019 Rollup Client update to clients running the 2.5 SP1 Agent 
+4. There is no need to uninstall the existing client prior to installing the May 2019 Rollup.  
diff --git a/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md b/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md
index 56da96c821..33509cf80e 100644
--- a/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md
+++ b/mdop/mbam-v25/using-windows-powershell-to-administer-mbam-25.md
@@ -1,8 +1,11 @@
 ---
 title: Using Windows PowerShell to Administer MBAM 2.5
 description: Using Windows PowerShell to Administer MBAM 2.5
-author: jamiejdt
+author: dansimp
 ms.assetid: 64668e76-2cba-433d-8d2d-50df0a4b2997
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -46,7 +49,7 @@ Use the following Windows PowerShell cmdlets to recover computers or drives that
 
 
 
- 
+ 
 
 ##  MBAM cmdlet Help
 
@@ -67,24 +70,24 @@ Windows PowerShell Help for MBAM cmdlets is available in the following formats:
 
 
 
    At a Windows PowerShell command prompt, type Get-Help <cmdlet>
    
-
    To upload the latest Windows PowerShell cmdlets, follow the instructions in [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md)
    
+
    To upload the latest Windows PowerShell cmdlets, follow the instructions in Configuring MBAM 2.5 Server Features by Using Windows PowerShell
    
 
 
 
    On TechNet as webpages
    
-
    https://go.microsoft.com/fwlink/?LinkId=393498
    
+
    https://go.microsoft.com/fwlink/?LinkId=393498
    
 
 
 
    On the Download Center as a Word .docx file
    
-
    https://go.microsoft.com/fwlink/?LinkId=393497
    
+
    https://go.microsoft.com/fwlink/?LinkId=393497
    
 
 
 
    On the Download Center as a .pdf file
    
-
    https://go.microsoft.com/fwlink/?LinkId=393499
    
+
    https://go.microsoft.com/fwlink/?LinkId=393499
    
 
 
 
 
- 
+ 
 
 
 
@@ -95,7 +98,7 @@ Windows PowerShell Help for MBAM cmdlets is available in the following formats:
 
 [Configuring MBAM 2.5 Server Features by Using Windows PowerShell](configuring-mbam-25-server-features-by-using-windows-powershell.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md b/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md
index c7b9098597..76b918713f 100644
--- a/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md
+++ b/mdop/mbam-v25/validating-the-mbam-25-server-feature-configuration.md
@@ -1,8 +1,11 @@
 ---
 title: Validating the MBAM 2.5 Server Feature Configuration
 description: Validating the MBAM 2.5 Server Feature Configuration
-author: jamiejdt
+author: dansimp
 ms.assetid: f4983a33-ce18-4186-a471-dd6415940504
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -25,10 +28,10 @@ Use the following steps to validate your MBAM Server deployment with the Stand-a
 
 1.  On each server where an MBAM feature is deployed, click **Control Panel** > **Programs** > **Programs and Features**. Verify that **Microsoft BitLocker Administration and Monitoring** appears in the **Programs and Features** list.
 
-    **Note**  
+    **Note**  
     To do the validation, you must use a domain account that has local computer administrative credentials on each server.
 
-     
+
 
 2.  On the server where the Recovery Database is configured, open SQL Server Management Studio and verify that the **MBAM Recovery and Hardware** database is configured.
 
@@ -44,44 +47,46 @@ Use the following steps to validate your MBAM Server deployment with the Stand-a
 
 5.  Confirm that a reports folder named **Microsoft BitLocker Administration and Monitoring** contains a data source called **MaltaDataSource** as well as the language folders. The data source contains folders with names that represent languages (for example, en-us). The reports are in the language folders.
 
-    **Note**  
+    **Note**  
     If SQL Server Reporting Services (SSRS) was configured as a named instance, the URL should resemble the following: http(s)://< *MBAMReportsServerName*>:<*port*>/Reports\_<*SSRSInstanceName*>
 
-     
 
-    **Note**  
-    If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then go to the Administration and Monitoring Website (also known as Help Desk) and select a report, the following message appears: "Only Secure Content is Displayed." To show the report, click **Show All Content**.
 
-     
+~~~
+**Note**  
+If SSRS was not configured to use Secure Socket Layer (SSL), the URL for the reports will be set to HTTP instead of HTTPS when you install the MBAM Server. If you then go to the Administration and Monitoring Website (also known as Help Desk) and select a report, the following message appears: "Only Secure Content is Displayed." To show the report, click **Show All Content**.
+~~~
 
-6.  On the server where the Administration and Monitoring Website feature is configured, run **Server Manager**, browse to **Roles**, and then select **Web Server (IIS)** > **Internet Information Services (IIS) Manager**.
 
-7.  In **Connections**, browse to *<computer name>* and select **Sites** > **Microsoft BitLocker Administration and Monitoring**. Verify that the following are listed:
 
-    -   **MBAMAdministrationService**
+6. On the server where the Administration and Monitoring Website feature is configured, run **Server Manager**, browse to **Roles**, and then select **Web Server (IIS)** > **Internet Information Services (IIS) Manager**.
 
-    -   **MBAMComplianceStatusService**
+7. In **Connections**, browse to *<computer name>* and select **Sites** > **Microsoft BitLocker Administration and Monitoring**. Verify that the following are listed:
 
-    -   **MBAMRecoveryAndHardwareService**
+   -   **MBAMAdministrationService**
 
-8.  On the server where the Administration and Monitoring Website and Self-Service Portal are configured, open a web browser with administrative credentials.
+   -   **MBAMComplianceStatusService**
 
-9.  Browse to the following websites to verify that they load successfully:
+   -   **MBAMRecoveryAndHardwareService**
 
-    -   https(s)://<*MBAMAdministrationServerName*>:<*port*>/HelpDesk/ - confirm each of the links for navigation and reports
+8. On the server where the Administration and Monitoring Website and Self-Service Portal are configured, open a web browser with administrative credentials.
 
-    -   http(s)://< *MBAMAdministrationServerName*>:<*port*>/SelfService/
+9. Browse to the following websites to verify that they load successfully:
 
-    **Note**  
-    It is assumed that you configured the server features on the default port without network encryption. If you configured the server features on a different port or virtual directory, change the URLs to include the appropriate port, for example:
+   -   https(s)://<*MBAMAdministrationServerName*>:<*port*>/HelpDesk/ - confirm each of the links for navigation and reports
 
-    http(s)://< *host name*>:<*port*>/HelpDesk/
+   -   http(s)://< *MBAMAdministrationServerName*>:<*port*>/SelfService/
 
-    http(s)://< *host name*>:<*port*>/<*virtualdirectory*>/
+   **Note**  
+   It is assumed that you configured the server features on the default port without network encryption. If you configured the server features on a different port or virtual directory, change the URLs to include the appropriate port, for example:
+
+   http(s)://< *host name*>:<*port*>/HelpDesk/
+
+   http(s)://< *host name*>:<*port*>/<*virtualdirectory*>/
+
+   If the server features were configured with network encryption, change http:// to https://.
 
-    If the server features were configured with network encryption, change http:// to https://.
 
-     
 
 10. Browse to the following web services to verify that they load successfully. A page opens to indicate that the service is running, but the page does not display any metadata.
 
@@ -98,18 +103,18 @@ Use the following steps to validate your MBAM Server deployment with the Stand-a
 
 Use the following steps to validate your MBAM deployment with the Configuration Manager Integration topology. Complete the validation steps that match the version of Configuration Manager that you are using.
 
-### Validating the MBAM Server deployment with System Center 2012 Configuration Manager
+### Validating the MBAM Server deployment with System Center 2012 Configuration Manager
 
-Use these steps to validate your MBAM Server deployment when you are using MBAM with System Center 2012 Configuration Manager.
+Use these steps to validate your MBAM Server deployment when you are using MBAM with System Center 2012 Configuration Manager.
 
-**To validate a Configuration Manager Integration MBAM Server deployment – System Center 2012 Configuration Manager**
+**To validate a Configuration Manager Integration MBAM Server deployment – System Center 2012 Configuration Manager**
 
-1.  On the server where System Center 2012 Configuration Manager is deployed, open **Programs and Features** in **Control Panel**, and verify that **Microsoft BitLocker Administration and Monitoring** appears.
+1.  On the server where System Center 2012 Configuration Manager is deployed, open **Programs and Features** in **Control Panel**, and verify that **Microsoft BitLocker Administration and Monitoring** appears.
 
-    **Note**  
+    **Note**  
     To validate the configuration, you must use a domain account that has local computer administrative credentials on each server.
 
-     
+
 
 2.  In the Configuration Manager console, click the **Assets and Compliance** workspace > **Device Collections**, and confirm that a new collection called **MBAM Supported Computers** is displayed.
 
@@ -141,10 +146,10 @@ Use these steps to validate your MBAM Server deployment when you are using MBAM
 
 1.  On the server where Configuration Manager 2007 is deployed, open **Programs and Features** on **Control Panel** , and verify that **Microsoft BitLocker Administration and Monitoring** appears.
 
-    **Note**  
+    **Note**  
     To validate the configuration, you must use a domain account that has local computer administrative credentials on each server.
 
-     
+
 
 2.  In the Configuration Manager console, click **Site Database <SiteCode> - <ServerName>, <SiteName>), Computer Management**, and confirm that a new collection called **MBAM Supported Computers** is displayed.
 
@@ -175,11 +180,11 @@ Use these steps to validate your MBAM Server deployment when you are using MBAM
 
 [Configuring the MBAM 2.5 Server Features](configuring-the-mbam-25-server-features.md)
 
- 
+
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
 - For MBAM issues, use the [MBAM TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopmbam).
- 
+
 
 
 
diff --git a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md b/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md
index b8c9ce465b..66de3b12f9 100644
--- a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md
+++ b/mdop/mbam-v25/viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md
@@ -1,8 +1,11 @@
 ---
 title: Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology
 description: Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology
-author: jamiejdt
+author: dansimp
 ms.assetid: 60d11b2f-3a76-4023-8da4-f89e9f35b790
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -55,7 +58,7 @@ To access the Reports feature in Configuration Manager:
 
 
 
- 
+ 
 
 ## Description of reports in Configuration Manager
 
@@ -183,7 +186,7 @@ This report shows information about the overall BitLocker compliance across your
 
 
 
- 
+ 
 
 **BitLocker Enterprise Compliance Details States**
 
@@ -214,7 +217,7 @@ This report shows information about the overall BitLocker compliance across your
 
 
 
- 
+ 
 
 ### BitLocker Enterprise Compliance Summary
 
@@ -281,7 +284,7 @@ Use this report type to show information about the overall BitLocker compliance
 
 
 
- 
+ 
 
 **BitLocker Enterprise Compliance Summary Computer Details**
 
@@ -328,7 +331,7 @@ Use this report type to show information about the overall BitLocker compliance
 
 
 
- 
+ 
 
 ### BitLocker Computer Compliance Report
 
@@ -337,7 +340,7 @@ Use this report type to collect information that is specific to a computer. The
 **Note**  
 The Removable Data Volume encryption status is not shown in this report.
 
- 
+ 
 
 **BitLocker Computer Compliance Report: Computer Details Fields**
 
@@ -428,7 +431,7 @@ The Removable Data Volume encryption status is not shown in this report.
 
 
 
- 
+ 
 
 **BitLocker Computer Compliance Report: Computer Volume Fields**
 
@@ -471,14 +474,14 @@ The Removable Data Volume encryption status is not shown in this report.
 
 
 
- 
+ 
 
 ## Related topics
 
 
 [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md)
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md b/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md
index 98fca5e3d3..9de3997194 100644
--- a/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md
+++ b/mdop/mbam-v25/viewing-mbam-25-reports-for-the-stand-alone-topology.md
@@ -1,8 +1,11 @@
 ---
 title: Viewing MBAM 2.5 Reports for the Stand-alone Topology
 description: Viewing MBAM 2.5 Reports for the Stand-alone Topology
-author: jamiejdt
+author: dansimp
 ms.assetid: 50e93c3a-baf1-4378-8fc0-74dd65d76306
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, security
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -32,21 +35,21 @@ See the following topics for information about Stand-alone reports:
 
 
 
    Report descriptions - MBAM Stand-alone topology
    
-
    [Understanding MBAM 2.5 Stand-alone Reports](understanding-mbam-25-stand-alone-reports.md)
    
+
    Understanding MBAM 2.5 Stand-alone Reports
    
 
 
 
    Instructions for generating reports - MBAM Stand-alone topology
    
-
    [Generating MBAM 2.5 Stand-alone Reports](generating-mbam-25-stand-alone-reports.md)
    
+
    Generating MBAM 2.5 Stand-alone Reports
    
 
 
 
 
- 
+ 
 
 **Note**  
 If you are using the Configuration Manager Integration topology, most reports are generated from Configuration Manager rather than from MBAM. See [Viewing MBAM 2.5 Reports for the Configuration Manager Integration Topology](viewing-mbam-25-reports-for-the-configuration-manager-integration-topology.md).
 
- 
+ 
 
 
 ## Related topics
@@ -54,9 +57,9 @@ If you are using the Configuration Manager Integration topology, most reports ar
 
 [Monitoring and Reporting BitLocker Compliance with MBAM 2.5](monitoring-and-reporting-bitlocker-compliance-with-mbam-25.md)
 
- 
+ 
 
- 
+ 
 
 ## Got a suggestion for MBAM?
 - Add or vote on suggestions [here](http://mbam.uservoice.com/forums/268571-microsoft-bitlocker-administration-and-monitoring). 
diff --git a/mdop/medv-v1/TOC.md b/mdop/medv-v1/TOC.md
index a07eff22f1..c6dd794c5c 100644
--- a/mdop/medv-v1/TOC.md
+++ b/mdop/medv-v1/TOC.md
@@ -73,9 +73,9 @@
 ## [Troubleshooting MED-V](troubleshooting-med-v.md)
 ## [Technical Reference](technical-referencemedv-10-sp1.md)
 ### [MED-V Reporting](med-v-reporting.md)
-#### [How to Generate Reports ](how-to-generate-reports-medvv2.md)
+#### [How to Generate Reports](how-to-generate-reports-medvv2.md)
 #### [How to Work with Reports](how-to-work-with-reports.md)
-### [MED-V Trim Transfer Technology ](med-v-trim-transfer-technology-medvv2.md)
+### [MED-V Trim Transfer Technology](med-v-trim-transfer-technology-medvv2.md)
 ### [How to Back Up and Restore a MED-V Server](how-to-back-up-and-restore-a-med-v-server.md)
 ### [How to Share Folders Between the Host and the MED-V Workspace](how-to-share-folders-between-the-host-and-the-med-v-workspace.md)
 ### [How to Set MED-V Workspace Deletion Options](how-to-set-med-v-workspace-deletion-options.md)
diff --git a/mdop/medv-v1/about-med-v-10-sp1.md b/mdop/medv-v1/about-med-v-10-sp1.md
index e8ee1728e1..f9d3fc4573 100644
--- a/mdop/medv-v1/about-med-v-10-sp1.md
+++ b/mdop/medv-v1/about-med-v-10-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: About MED-V 1.0 SP1
 description: About MED-V 1.0 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 4c16e935-46c4-49c3-9e53-c60404d5da0c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/about-med-v-10.md b/mdop/medv-v1/about-med-v-10.md
index fb900f587a..8a99314de9 100644
--- a/mdop/medv-v1/about-med-v-10.md
+++ b/mdop/medv-v1/about-med-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: About MED-V 1.0
 description: About MED-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 89651022-a2ba-4d8a-a3ff-68539ea7a235
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/about-this-guidemedv.md b/mdop/medv-v1/about-this-guidemedv.md
index bcbe6524fd..cf20d13c06 100644
--- a/mdop/medv-v1/about-this-guidemedv.md
+++ b/mdop/medv-v1/about-this-guidemedv.md
@@ -1,12 +1,15 @@
 ---
 title: About This Guide
 description: About This Guide
-author: jamiejdt
+author: dansimp
 ms.assetid: 17d8f150-226e-45f8-87e3-f425a77243e4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/client-installation-command-line-reference.md b/mdop/medv-v1/client-installation-command-line-reference.md
index f7843677f9..44326e2a47 100644
--- a/mdop/medv-v1/client-installation-command-line-reference.md
+++ b/mdop/medv-v1/client-installation-command-line-reference.md
@@ -1,12 +1,15 @@
 ---
 title: Client Installation Command Line Reference
 description: Client Installation Command Line Reference
-author: jamiejdt
+author: dansimp
 ms.assetid: 122a593d-3314-4e9b-858a-08a25ed00c32
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -90,11 +93,10 @@ ms.date: 06/16/2016
 
    Default: 1
    
 
    Starts MED-V at the completion of the MED-V installation.
    
 
    
-Note  
-
    It is recommended to set START_MEDV=0 in case MED-V is installed by the system.
    
+Note
    It is recommended to set START_MEDV=0 in case MED-V is installed by the system.
    
 
    
 
    
- 
+
 
    
 
 
@@ -116,11 +118,11 @@ ms.date: 06/16/2016
 
 
 
- 
-
- 
-
- 
+
+
+
+
+
 
 
 
diff --git a/mdop/medv-v1/configuring-med-v-for-remote-networks.md b/mdop/medv-v1/configuring-med-v-for-remote-networks.md
index 636bf205a1..cdb27ae2fd 100644
--- a/mdop/medv-v1/configuring-med-v-for-remote-networks.md
+++ b/mdop/medv-v1/configuring-med-v-for-remote-networks.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring MED-V for Remote Networks
 description: Configuring MED-V for Remote Networks
-author: jamiejdt
+author: dansimp
 ms.assetid: 4d2f0081-622f-4a6f-8d73-f8c2108036e0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -46,11 +49,11 @@ You can configure MED-V to work from inside a network, remotely, or both from in
 **Note**  
 When applying new settings, the service must be restarted.
 
- 
+ 
 
 -   You can change the IIS authentication scheme to one of the following: BASIC, DIGEST, NTLM, or NEGOTIATE. The default is NEGOTIATE and uses the following entry:
 
-    ``` syntax
+    ```xml
     
     
        
@@ -69,9 +72,9 @@ When applying new settings, the service must be restarted.
 
 [MED-V Infrastructure Planning and Design](med-v-infrastructure-planning-and-design.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md b/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md
index 07a7c2aac8..1b03f70a10 100644
--- a/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md
+++ b/mdop/medv-v1/configuring-med-v-server-for-cluster-mode.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring MED-V Server for Cluster Mode
 description: Configuring MED-V Server for Cluster Mode
-author: jamiejdt
+author: dansimp
 ms.assetid: 41f0b2a3-4ce9-48e1-a6fb-4c13c4228515
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -42,16 +45,16 @@ You can configure the MED-V server in cluster mode. In cluster mode, two servers
 **Note**  
 If all servers have the same local settings (such as listening ports, IIS server, management permissions, report database, and so on), the *<InstallDir>/Servers/ServerSettings.xml* can be shared by all servers as well.
 
- 
+ 
 
 ## Related topics
 
 
 [MED-V Infrastructure Planning and Design](med-v-infrastructure-planning-and-design.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/configuring-med-v-workspace-policies.md b/mdop/medv-v1/configuring-med-v-workspace-policies.md
index d307967d15..34784f4a18 100644
--- a/mdop/medv-v1/configuring-med-v-workspace-policies.md
+++ b/mdop/medv-v1/configuring-med-v-workspace-policies.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring MED-V Workspace Policies
 description: Configuring MED-V Workspace Policies
-author: jamiejdt
+author: dansimp
 ms.assetid: 0eaed981-cbf3-4b16-a4b7-4705c5705dc7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -27,7 +30,7 @@ It is important to decide on the type of MED-V workspace you are creating before
 **Note**  
 When configuring a policy, a warning symbol appears next to mandatory fields that are not filled in. If a mandatory field is not filled in, the symbol appears on the tab as well.
 
- 
+ 
 
 ## In This Section
 
@@ -59,9 +62,9 @@ Describes the performance settings of a MED-V workspace, and how to apply them t
 [How to Import and Export a Policy](how-to-import-and-export-a-policy.md)  
 Describes how to import and export a policy.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/creating-a-med-v-image.md b/mdop/medv-v1/creating-a-med-v-image.md
index d8432598da..4b9d3222fb 100644
--- a/mdop/medv-v1/creating-a-med-v-image.md
+++ b/mdop/medv-v1/creating-a-med-v-image.md
@@ -1,12 +1,15 @@
 ---
 title: Creating a MED-V Image
 description: Creating a MED-V Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 7cbbcd22-83f5-4b60-825f-781b4c6a2d36
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -40,11 +43,11 @@ Describes how to delete a MED-V image.
 **Note**  
 After the MED-V image is configured, the computer should not be part of a domain because the join domain procedure should be performed on the client after the deployment, as part of the MED-V workspace setup.
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md b/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md
index e8dd334e01..49db131ccf 100644
--- a/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md
+++ b/mdop/medv-v1/creating-a-med-v-workspacemedv-10-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: Creating a MED-V Workspace
 description: Creating a MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: 9578bb99-8a09-44c1-b88f-538901f16ad3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md b/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md
index e1289a7ed4..c73b1b9457 100644
--- a/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md
+++ b/mdop/medv-v1/creating-a-virtual-pc-image-for-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Creating a Virtual PC Image for MED-V
 description: Creating a Virtual PC Image for MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 5e02ea07-25b9-41a5-a803-d70c55eef586
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -54,98 +57,102 @@ After the Virtual PC image is created, install the MED-V workspace .msi package
 
 2.  Double-click the MED-V workspace .msi package, and follow the installation wizard instructions.
 
-    **Note**  
+    **Note**  
     When a new MED-V version is released, and an existing Virtual PC image is updated, uninstall the existing MED-V workspace .msi package, reboot the computer, and install the new MED-V workspace .msi package.
 
-     
 
-    **Note**  
-    After the MED-V workspace .msi package is installed, other products that replace GINA cannot be installed.
 
-     
+~~~
+**Note**  
+After the MED-V workspace .msi package is installed, other products that replace GINA cannot be installed.
+~~~
+
+
 
 ## How to Run the Virtual Machine Prerequisites Tool
 
 
 The virtual machine (VM) prerequisites tool is a wizard that automates several of the prerequisites.
 
-**Note**  
+**Note**  
 Although many parameters are configurable in the wizard, the properties required for the proper functioning of MED-V are not configurable.
 
- 
+
 
 **To run the virtual machine prerequisites tool**
 
 1.  After the MED-V workspace .msi package is installed, on the Windows **Start** menu, select **All Programs > MED-V > VM Prerequisites Tool**.
 
-    **Note**  
+    **Note**  
     The user running the virtual machine prerequisites tool must have local administrator rights and must be the only user logged in.
 
-     
 
-    The **MED-V VM Prerequisite Wizard Welcome** page appears.
 
-2.  Click **Next**.
+~~~
+The **MED-V VM Prerequisite Wizard Welcome** page appears.
+~~~
 
-3.  On the **Windows Settings** page, from the following configurable properties, select the ones to be configured:
+2. Click **Next**.
 
-    -   **Clear users’ personal history information**
+3. On the **Windows Settings** page, from the following configurable properties, select the ones to be configured:
 
-    -   **Clear local profiles temp directory**
+   -   **Clear users’ personal history information**
 
-    -   **Disable sounds on following Windows events: start, logon, logoff**
+   -   **Clear local profiles temp directory**
 
-    **Note**  
-    Do not enable Windows page saver in a group policy.
+   -   **Disable sounds on following Windows events: start, logon, logoff**
 
-     
+   **Note**  
+   Do not enable Windows page saver in a group policy.
 
-4.  Click **Next**.
 
-5.  On the **Internet Explorer Settings** page, from the following configurable properties, select the ones to be configured:
 
-    -   **Don't use auto complete features**
+4. Click **Next**.
 
-    -   **Disable reuse of windows for launching shortcuts**
+5. On the **Internet Explorer Settings** page, from the following configurable properties, select the ones to be configured:
 
-    -   **Clear browsing history**
+   -   **Don't use auto complete features**
 
-    -   **Enable tabbed browsing in Internet Explorer 7**
+   -   **Disable reuse of windows for launching shortcuts**
 
-6.  Click **Next**.
+   -   **Clear browsing history**
 
-7.  On the **Windows Services** page, from the following configurable properties, select the ones to be configured:
+   -   **Enable tabbed browsing in Internet Explorer 7**
 
-    -   **Security center service**
+6. Click **Next**.
 
-    -   **Task scheduler service**
+7. On the **Windows Services** page, from the following configurable properties, select the ones to be configured:
 
-    -   **Automatic updates service**
+   -   **Security center service**
 
-    -   **System restore service**
+   -   **Task scheduler service**
 
-    -   **Indexing service**
+   -   **Automatic updates service**
 
-    -   **Wireless Zero Configuration**
+   -   **System restore service**
 
-    -   **Fast User Switching Compatibility**
+   -   **Indexing service**
 
-8.  Click **Next**.
+   -   **Wireless Zero Configuration**
 
-9.  On the **Windows Auto Logon** page, do the following:
+   -   **Fast User Switching Compatibility**
 
-    1.  Select the **Enable Windows Auto Logon** check box.
+8. Click **Next**.
 
-    2.  Assign a **User name** and **Password**.
+9. On the **Windows Auto Logon** page, do the following:
+
+   1.  Select the **Enable Windows Auto Logon** check box.
+
+   2.  Assign a **User name** and **Password**.
 
 10. Click **Apply**, and in the confirmation box that appears, click **Yes**.
 
 11. On the **Summary** page, click **Finish** to quit the wizard
 
-**Note**  
+**Note**  
 Verify that group policies do not overwrite the mandatory settings set in the prerequisites tool.
 
- 
+
 
 ## How to Configure MED-V Virtual Machine Manual Installation Prerequisites
 
@@ -193,10 +200,10 @@ Several of the configurations cannot be configured through the virtual machine p
 
 In a MED-V workspace, Sysprep can be configured in order to assign unique security ID (SID), particularly when multiple MED-V workspaces are run on a single computer. It is not recommended to use Sysprep to join a domain; instead, use the MED-V join domain script action as described in [How to Set Up Script Actions](how-to-set-up-script-actions.md).
 
-**Note**  
+**Note**  
 Sysprep is Microsoft's system preparation utility for the Windows operating system.
 
- 
+
 
 **To configure Sysprep in a MED-V workspace**
 
@@ -204,9 +211,9 @@ Sysprep is Microsoft's system preparation utility for the Windows operating syst
 
 2.  From the Windows installation CD, extract *deploy.cab* to the root of the system drive, or download the latest Deployment Tools update from the Microsoft Web site.
 
-    -   For Windows 2000, see [Deployment Tools update for Windows 2000](https://go.microsoft.com/fwlink/?LinkId=143001).
+    -   For Windows 2000, see [Deployment Tools update for Windows 2000](https://go.microsoft.com/fwlink/?LinkId=143001).
 
-    -   For Windows XP, see [Deployment Tools update for Windows XP](https://go.microsoft.com/fwlink/?LinkId=143000).
+    -   For Windows XP, see [Deployment Tools update for Windows XP](https://go.microsoft.com/fwlink/?LinkId=143000).
 
 3.  Run **Setup Manager** (setupmgr.exe).
 
@@ -239,9 +246,9 @@ After all the components are installed and configured, close Microsoft Virtual P
 Creating a MED-V Image
 [How to Set Up Script Actions](how-to-set-up-script-actions.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/define-the-project-scope.md b/mdop/medv-v1/define-the-project-scope.md
index 905bd47687..2d628bd096 100644
--- a/mdop/medv-v1/define-the-project-scope.md
+++ b/mdop/medv-v1/define-the-project-scope.md
@@ -1,12 +1,15 @@
 ---
 title: Define the Project Scope
 description: Define the Project Scope
-author: jamiejdt
+author: dansimp
 ms.assetid: 84637d2a-2e30-417d-b150-dc81f414b3a5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md b/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md
index d08d291846..52e0292edc 100644
--- a/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md
+++ b/mdop/medv-v1/deploying-a-med-v-workspace-using-a-deployment-package.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying a MED-V Workspace Using a Deployment Package
 description: Deploying a MED-V Workspace Using a Deployment Package
-author: jamiejdt
+author: dansimp
 ms.assetid: e07fa70a-1a9f-486f-9a86-b33593b234da
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -37,15 +40,15 @@ If the image will be included in the package, no other configurations are necess
 **Note**  
 If you are using image pre-staging, it is important to configure the image pre-stage folder prior to creating the deployment package. The folder path needs to be included in the deployment package.
 
- 
+ 
 
 Finally, create the deployment package. For more information on creating a deployment package, see [How to Configure a Deployment Package](how-to-configure-a-deployment-package.md). After the package is complete, distribute it for deployment.
 
 After the deployment package is distributed, MED-V client can be installed and the image deployed. For more information on installing MED-V client, see [How to Install MED-V Client](how-to-install-med-v-clientdeployment-package.md). For more information on deploying the image, see [How to Deploy a Workspace Image](how-to-deploy-a-workspace-imagedeployment-package.md).
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md b/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md
index d45d51596d..4167d9099f 100644
--- a/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md
+++ b/mdop/medv-v1/deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying a MED-V Workspace Using an Enterprise Software Distribution System
 description: Deploying a MED-V Workspace Using an Enterprise Software Distribution System
-author: jamiejdt
+author: dansimp
 ms.assetid: 867faed6-74ce-4573-84be-8bf26e66c08c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ MED-V client can be distributed using an enterprise software distribution system
 **Note**  
 If MED-V is installed by using Microsoft System Center Configuration Manager, when creating a package for MED-V, set the run mode to administrative rights.
 
- 
+ 
 
 Before deploying MED-V using an enterprise software distribution system, ensure that you have created a MED-V image ready for deployment. For more information on creating a MED-V image, see [Creating a MED-V Image](creating-a-med-v-image.md).
 
@@ -42,13 +45,13 @@ If you are deploying the image via image pre-staging, configure the pre-stage fo
 **Note**  
 If you are using image pre-staging, it is important to configure the image pre-stage folder prior to pushing the client .msi package. The folder path needs to be included in the client .msi package.
 
- 
+ 
 
 Finally, push the client .msi package using your enterprise software distribution center. MED-V can then be installed and the image deployed. For more information on installing MED-V client, see [How to Install MED-V Client](how-to-install-med-v-clientesds.md). For more information on deploying the image, see [How to Deploy a Workspace Image](how-to-deploy-a-workspace-imageesds.md).
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/design-the-med-v-image-repositories.md b/mdop/medv-v1/design-the-med-v-image-repositories.md
index 462901b073..8302861536 100644
--- a/mdop/medv-v1/design-the-med-v-image-repositories.md
+++ b/mdop/medv-v1/design-the-med-v-image-repositories.md
@@ -1,12 +1,15 @@
 ---
 title: Design the MED-V Image Repositories
 description: Design the MED-V Image Repositories
-author: jamiejdt
+author: dansimp
 ms.assetid: e153154d-2751-4990-b94d-a2d76242c15f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/medv-v1/design-the-med-v-server-infrastructure.md b/mdop/medv-v1/design-the-med-v-server-infrastructure.md
index 8de1eaf944..40536204ff 100644
--- a/mdop/medv-v1/design-the-med-v-server-infrastructure.md
+++ b/mdop/medv-v1/design-the-med-v-server-infrastructure.md
@@ -1,12 +1,15 @@
 ---
 title: Design the MED-V Server Infrastructure
 description: Design the MED-V Server Infrastructure
-author: jamiejdt
+author: dansimp
 ms.assetid: 2781040f-880e-4e16-945d-a38c0adb4151
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md b/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md
index f8c44fb69f..5165183f3c 100644
--- a/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md
+++ b/mdop/medv-v1/examples-of-virtual-machine-configurationsv2.md
@@ -1,12 +1,15 @@
 ---
 title: Examples of Virtual Machine Configurations
 description: Examples of Virtual Machine Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: 5937601e-41ab-4ca2-8fa1-3c9154710cd6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ The following are examples of typical virtual machine configurations: one in a p
 **Note**  
 These examples are not intended for use in all environments. Adjust the configuration according to your environment.
 
- 
+ 
 
 **To configure a typical domain setup in a persistent MED-V workspace**
 
@@ -62,9 +65,9 @@ These examples are not intended for use in all environments. Adjust the configur
 
 [How to Set Up Script Actions](how-to-set-up-script-actions.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/getting-started-with-med-v.md b/mdop/medv-v1/getting-started-with-med-v.md
index 1306d7e5e2..969a8b0a46 100644
--- a/mdop/medv-v1/getting-started-with-med-v.md
+++ b/mdop/medv-v1/getting-started-with-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Getting Started with MED-V
 description: Getting Started with MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 5832cdb3-3892-4048-b29d-7644e75117f0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/high-level-architecturemedv.md b/mdop/medv-v1/high-level-architecturemedv.md
index 15b33becce..7badb94bbd 100644
--- a/mdop/medv-v1/high-level-architecturemedv.md
+++ b/mdop/medv-v1/high-level-architecturemedv.md
@@ -1,12 +1,15 @@
 ---
 title: High-Level Architecture
 description: High-Level Architecture
-author: jamiejdt
+author: dansimp
 ms.assetid: a78e12ad-5aa6-40e0-ae8b-51acaf005712
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md
index 849b6ec167..5d9bdb7412 100644
--- a/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md
+++ b/mdop/medv-v1/how-to-apply-general-settings-to-a-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: How to Apply General Settings to a MED-V Workspace
 description: How to Apply General Settings to a MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: 6152dced-e301-4fa2-bfa0-aecf3c23f23a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -39,7 +42,7 @@ The name of the MED-V workspace.
 **Warning**  
 Do not rename an existing MED-V workspace while it is running on a client computer.
 
- 
+ 
 
 Description
 
@@ -48,7 +51,7 @@ Description of the MED-V workspace, which can include the content or status of t
 **Note**  
 The description is for administrator use and has no impact on the policy.
 
- 
+ 
 
 Support contact info
 
@@ -78,7 +81,7 @@ Do not start the Workspace if the verification fails (exit code is not '0')
 
 Select this check box if you are using a command line and want to start the MED-V workspace only if the script is completed successfully.
 
- 
+ 
 
 A command line can be run on the host prior to starting the MED-V workspace.
 
@@ -95,9 +98,9 @@ A command line can be run on the host prior to starting the MED-V workspace.
 
 [Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md
index 9009a8ddb7..4846278e8e 100644
--- a/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md
+++ b/mdop/medv-v1/how-to-apply-network-settings-to-a-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: How to Apply Network Settings to a MED-V Workspace
 description: How to Apply Network Settings to a MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: 641f46b3-a56f-478a-823b-1d90aa1716b3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md
index cde58fde0f..bb5b64f7e8 100644
--- a/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md
+++ b/mdop/medv-v1/how-to-apply-performance-settings-to-a-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: How to Apply Performance Settings to a MED-V Workspace
 description: How to Apply Performance Settings to a MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: e0fed1e1-6e8f-4d65-ab83-b950a17661c0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md b/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md
index e5ccd13cbb..197b944570 100644
--- a/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md
+++ b/mdop/medv-v1/how-to-apply-virtual-machine-settings-to-a-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: How to Apply Virtual Machine Settings to a MED-V Workspace
 description: How to Apply Virtual Machine Settings to a MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: b50d0dfb-8d61-4543-9607-a29bbb1ed45f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -47,7 +50,7 @@ The actual Microsoft Virtual PC image assigned to the MED-V workspace. The menu
     **Note**  
     Each MED-V workspace image can only be used by one Windows user.
 
-     
+     
 
 Workspace is persistent
 
@@ -58,7 +61,7 @@ For a Domain MED-V workspace, this option must be selected.
 **Note**  
 This setting should not be changed after a MED-V workspace is deployed to users.
 
- 
+ 
 
 Shut down the VM when stopping the Workspace
 
@@ -67,7 +70,7 @@ Select this check box to shut down the virtual machine when stopping the MED-V w
 **Note**  
 This property is enabled only if **Workspace is persistent** is selected.
 
- 
+ 
 
 Logon to Windows in VM using MED-V credentials (SSO)
 
@@ -76,7 +79,7 @@ Select this check box to log in to Windows on the virtual machine by using the M
 **Note**  
 This property is enabled only when **Workspace is persistent** is selected.
 
- 
+ 
 
 Workspace is revertible
 
@@ -85,7 +88,7 @@ Select this check box to configure the MED-V workspace as revertible. In a rever
 **Note**  
 This setting should not be changed after a MED-V workspace is deployed to users.
 
- 
+ 
 
 Synchronize Workspace time zone with host
 
@@ -110,7 +113,7 @@ Select this check box to lock the MED-V workspace when the MED-V workspace is id
 **Note**  
 The idle time refers to the MED-V workspace applications (not the host applications).
 
- 
+ 
 
 *Image Update Settings*
 
@@ -131,9 +134,9 @@ Select this check box to enable Trim Transfer (for more information, see [MED-V
 **Note**  
 Trim Transfer requires indexing the hard drive, which might take a considerable amount of time. It is recommended to use Trim Transfer when indexing the hard drive is more efficient than downloading the new image version, such as when downloading an image version that is similar to the existing version.
 
- 
+ 
 
- 
+ 
 
 ## Related topics
 
@@ -144,9 +147,9 @@ Trim Transfer requires indexing the hard drive, which might take a considerable
 
 [Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md b/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md
index eb50976aa0..3a7c44c436 100644
--- a/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md
+++ b/mdop/medv-v1/how-to-back-up-and-restore-a-med-v-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Back Up and Restore a MED-V Server
 description: How to Back Up and Restore a MED-V Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 8d05e3a4-279b-4ce6-a319-8a09e7a30c60
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -23,7 +26,7 @@ XML files located on the server can be backed up and then restored in case of lo
     **Note**  
     If the configuration has been changed from the default, the files might be stored in a different location.
 
-     
+     
 
     -   ClientPolicy.xml
 
@@ -38,7 +41,7 @@ XML files located on the server can be backed up and then restored in case of lo
     **Note**  
     The ServerSettings.xml file can be backed up as well. However, if a specific configuration has been changed (for example, on the original server, the MED-V VMS directory is located in "*C:\\Vms*" and such a directory does not exist on the new server), it can cause an error.
 
-     
+     
 
 **To restore a MED-V server**
 
@@ -50,9 +53,9 @@ XML files located on the server can be backed up and then restored in case of lo
 
 3.  Restart the MED-V service.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/how-to-configure-a-deployment-package.md b/mdop/medv-v1/how-to-configure-a-deployment-package.md
index 40f29d9160..6d2a5b4f31 100644
--- a/mdop/medv-v1/how-to-configure-a-deployment-package.md
+++ b/mdop/medv-v1/how-to-configure-a-deployment-package.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure a Deployment Package
 description: How to Configure a Deployment Package
-author: jamiejdt
+author: dansimp
 ms.assetid: 748272a1-6af2-476e-a3f1-87435b8e94b1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,49 +19,49 @@ ms.date: 06/16/2016
 
 The Packaging wizard walks you through the creation of a package by creating a folder on your local computer and transferring all the required installation files to the single folder. The contents of the folder can then be moved to multiple removable media drives for distribution.
 
-**Note**  
+**Note**  
 A single package cannot contain installation files for both x86 and x64 systems.
 
- 
+
 
 ## How to Create a Deployment Package
 
 
 **To create a deployment package**
 
-1.  Verify in the **Images** module that you have created at least one local packed image.
+1. Verify in the **Images** module that you have created at least one local packed image.
 
-2.  On the **Tools** menu, select **Packaging wizard**.
+2. On the **Tools** menu, select **Packaging wizard**.
 
-3.  On the **Packaging wizard** welcome page, click **Next**.
+3. On the **Packaging wizard** welcome page, click **Next**.
 
-4.  On the **Workspace Image** page, select the **Include image in the package** check box to include an image in the package.
+4. On the **Workspace Image** page, select the **Include image in the package** check box to include an image in the package.
 
-    The **Image** field is enabled.
+   The **Image** field is enabled.
 
-    **Note**  
-    An image is not required in a MED-V package; the package can be created without an image. In such a case, the image should be uploaded to the server so that it can later be downloaded over the network to the client, or pushed to an image pre-stage folder.
+   **Note**  
+   An image is not required in a MED-V package; the package can be created without an image. In such a case, the image should be uploaded to the server so that it can later be downloaded over the network to the client, or pushed to an image pre-stage folder.
 
-     
 
-5.  Click the **Image** list to view all available images. Select the image to be copied to the package. Click **Refresh** to refresh the list of available images.
 
-6.  Click **Next**.
+5. Click the **Image** list to view all available images. Select the image to be copied to the package. Click **Refresh** to refresh the list of available images.
 
-7.  On the **MED-V Installation Settings** page, select the MED-V installation file by doing one of the following:
+6. Click **Next**.
 
-    -   In the **MED-V installation file** field, type the full path to the directory where the installation file is located.
+7. On the **MED-V Installation Settings** page, select the MED-V installation file by doing one of the following:
 
-    -   Click **...** to browse to the directory where the installation file is located.
+   -   In the **MED-V installation file** field, type the full path to the directory where the installation file is located.
 
-    **Note**  
-    This field is mandatory, and the wizard will not continue without a valid file name.
+   -   Click **...** to browse to the directory where the installation file is located.
 
-     
+   **Note**  
+   This field is mandatory, and the wizard will not continue without a valid file name.
 
-8.  In the **Server address** field, type the server name or IP address.
 
-9.  In the **Server port** field, type the server port.
+
+8. In the **Server address** field, type the server name or IP address.
+
+9. In the **Server port** field, type the server port.
 
 10. Select the **Server is accessed using https** check box to require an https connection to connect to the server.
 
@@ -70,29 +73,31 @@ A single package cannot contain installation files for both x86 and x64 systems.
 
         1.  On the **MED-V Installation Custom Settings** page, in the **Installation folder** field, type the path of the folder where the MED-V files will be installed on the host computer.
 
-            **Note**  
+            **Note**  
             It is recommended to use variables in the path rather than constants, which might vary from computer to computer.
 
             For example, use *%ProgramFiles%\\MED-V* instead of *c:\\MED-V*.
 
-             
 
-        2.  In the **Virtual machines images folder** field, type the path of the folder where the virtual images files will be installed on the host computer.
 
-            **Note**  
-            If you are using image pre-staging, this is the image pre-stage folder where the image is located.
+    ~~~
+    2.  In the **Virtual machines images folder** field, type the path of the folder where the virtual images files will be installed on the host computer.
 
-             
+        **Note**  
+        If you are using image pre-staging, this is the image pre-stage folder where the image is located.
 
-        3.  In the **Minimal required RAM** field, enter the RAM required to install a MED-V package. If the user installing the MED-V package does not have the minimal required RAM, the installation will fail.
 
-        4.  Select the **Install the MED-V management application** check box to include the MED-V management console application in the installation.
 
-        5.  Select the **Create a shortcut to MED-V on the desktop** check box to create a shortcut to MED-V on the host's desktop.
+    3.  In the **Minimal required RAM** field, enter the RAM required to install a MED-V package. If the user installing the MED-V package does not have the minimal required RAM, the installation will fail.
 
-        6.  Select the **Start automatically on computer startup** check box to start MED-V automatically on startup.
+    4.  Select the **Install the MED-V management application** check box to include the MED-V management console application in the installation.
 
-        7.  Click **Next**.
+    5.  Select the **Create a shortcut to MED-V on the desktop** check box to create a shortcut to MED-V on the host's desktop.
+
+    6.  Select the **Start automatically on computer startup** check box to start MED-V automatically on startup.
+
+    7.  Click **Next**.
+    ~~~
 
 12. On the **Additional Installations** page, select the **Include installation of virtualization software** check box to include the Virtual PC installation in the package.
 
@@ -102,9 +107,9 @@ A single package cannot contain installation files for both x86 and x64 systems.
 
     The **Installation file** field is enabled. Type the full path of the Virtual PC update installation file, or click **...** to browse to the directory.
 
-14. Select the **Include installation of Microsoft .NET Framework 2.0** check box to include the Microsoft .NET Framework 2.0 installation in the package.
+14. Select the **Include installation of Microsoft .NET Framework 2.0** check box to include the Microsoft .NET Framework 2.0 installation in the package.
 
-    The **Installation file** field is enabled. Type the full path of the Microsoft .NET Framework 2.0 installation file, or click **...** to browse to the directory.
+    The **Installation file** field is enabled. Type the full path of the Microsoft .NET Framework 2.0 installation file, or click **...** to browse to the directory.
 
 15. Click **Next**.
 
@@ -114,10 +119,10 @@ A single package cannot contain installation files for both x86 and x64 systems.
 
     -   Click **...** to browse to the directory where the installation files should be saved.
 
-    **Note**  
+    **Note**  
     Building the package might consume more space than the actual package size. It is therefore recommended to build the package on the hard drive. After the package is created, it can then be copied to the USB.
 
-     
+
 
 17. In the **Package name** field, enter a name for the package.
 
@@ -127,29 +132,29 @@ A single package cannot contain installation files for both x86 and x64 systems.
 
     After the package is created, a message appears notifying you that it has been completed successfully.
 
-**Note**  
+**Note**  
 If you saved all the files locally, and not directly on the removable media, ensure that you copy only the contents of the folder and not the folder itself to the removable media.
 
- 
 
-**Note**  
+
+**Note**  
 The removable media must be large enough so that the package contents consume a maximum of only three-quarters of the removable media's memory.
 
- 
 
-**Note**  
+
+**Note**  
 When creating the package, up to double the size of the actual package size might be required when the build is complete.
 
- 
+
 
 ## Related topics
 
 
 [Creating a MED-V Image](creating-a-med-v-image.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md b/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md
index f4269c3745..7669269fc7 100644
--- a/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md
+++ b/mdop/medv-v1/how-to-configure-a-domain-user-or-groupmedvv2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure a Domain User or Group
 description: How to Configure a Domain User or Group
-author: jamiejdt
+author: dansimp
 ms.assetid: 055aba81-a9c9-4b98-969d-775e603becf3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -37,15 +40,17 @@ To allow users to utilize the MED-V workspace, you must first add domain users o
 
     The domain users or groups are added.
 
-    **Note**  
+    **Note**  
     Users from trusted domains should be added manually.
 
-     
 
-    **Warning**  
-    Do not run the management application from a computer that is part of a domain that is not trusted by the domain the server is installed on.
 
-     
+~~~
+**Warning**  
+Do not run the management application from a computer that is part of a domain that is not trusted by the domain the server is installed on.
+~~~
+
+
 
 ## How to Remove a Domain User or Group
 
@@ -109,17 +114,17 @@ Select this check box to enable transferring files between the host and MED-V wo
 
 -   **Workspace to Host**—Enable transferring files from the MED-V workspace to the host.
 
-**Note**  
+**Note**  
 If a user without permissions attempts to transfer files, a window will appear prompting him to enter the credentials of a user with permissions to perform the file transfer.
 
- 
 
-**Important**  
-To support file transfer in Windows XP SP3, you must disable offline file synchronization by editing the registry as follows:
+
+**Important**  
+To support file transfer in Windows XP SP3, you must disable offline file synchronization by editing the registry as follows:
 
 `REG ADD HKLM\software\microsoft\windows\currentversion\netcache /V Enabled /T REG_DWORD /F /D 0`
 
- 
+
 
 Advanced
 
@@ -131,16 +136,16 @@ Enable printing to printers connected to the host
 
 Select this check box to enable users to print from the MED-V workspace using the host printer.
 
-**Note**  
+**Note**  
 The printing is performed by the printers defined on the host.
 
- 
+
 
 Enable access to CD / DVD
 
 Select this check box to allow access to a CD or DVD drive from this MED-V workspace.
 
- 
+
 
 **Multiple Memberships**
 
@@ -159,9 +164,9 @@ Select this check box to allow access to a CD or DVD drive from this MED-V works
 
 [How to Set Advanced File Transfer Options](how-to-set-advanced-file-transfer-options.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-configure-image-pre-staging.md b/mdop/medv-v1/how-to-configure-image-pre-staging.md
index 9abff80e8e..5503edfefa 100644
--- a/mdop/medv-v1/how-to-configure-image-pre-staging.md
+++ b/mdop/medv-v1/how-to-configure-image-pre-staging.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Image Pre-staging
 description: How to Configure Image Pre-staging
-author: jamiejdt
+author: dansimp
 ms.assetid: 92781b5a-208f-45a4-a078-ee90cf9efd9d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -17,7 +20,7 @@ ms.date: 06/16/2016
 **Note**  
 Image pre-staging is useful only for the initial image download. It is not supported for image update.
 
- 
+ 
 
 ## How to Configure Image Pre-staging
 
@@ -29,32 +32,32 @@ Image pre-staging is useful only for the initial image download. It is not suppo
     **Note**  
     This folder must be called *MED-V Images*.
 
-     
+     
 
 2.  Inside the MED-V Images folder, create a subfolder and name it *PrestagedImages*.
 
     **Note**  
     This folder must be called *PrestagedImages*.
 
-     
+     
 
 3.  To apply Access Control Lists (ACL) security to the *MED-V Images* folder, set the following ACL:
 
     **NT AUTHORITY\\Authenticated Users:(OI)(CI)(special access:)**
 
-                                             **READ\_CONTROL**
+                                             **READ\_CONTROL**
 
-                                    **SYNCHRONIZE**
+                                    **SYNCHRONIZE**
 
-                                    **FILE\_GENERIC\_READ**
+                                    **FILE\_GENERIC\_READ**
 
-                                    **FILE\_READ\_DATA**
+                                    **FILE\_READ\_DATA**
 
     **                                 FILE\_APPEND\_DATA**
 
-                                    **FILE\_READ\_EA**
+                                    **FILE\_READ\_EA**
 
-                                    **FILE\_READ\_ATTRIBUTES**
+                                    **FILE\_READ\_ATTRIBUTES**
 
     **NT AUTHORITY\\SYSTEM:(OI)(CI)F**
 
@@ -63,23 +66,23 @@ Image pre-staging is useful only for the initial image download. It is not suppo
     **Note**  
     It is recommended to apply ACL security to the *MED-V Images* folder.
 
-     
+     
 
 4.  To apply ACL security to the *PrestagedImages* folder, set the following ACL:
 
     **NT AUTHORITY\\Authenticated Users:(OI)(CI)(special access:)**
 
-    **                                READ\_CONTROL**
+    **READ\_CONTROL**
 
-    **                                                                                SYNCHRONIZE**
+    **SYNCHRONIZE**
 
-    **                                                                                FILE\_GENERIC\_READ**
+    **FILE\_GENERIC\_READ**
 
-    **                                                                                                FILE\_READ\_DATA**
+    **FILE\_READ\_DATA**
 
-    **                                                                                FILE\_READ\_EA**
+    **FILE\_READ\_EA**
 
-    **                                                                                FILE\_READ\_ATTRIBUTES**
+    **FILE\_READ\_ATTRIBUTES**
 
     **NT AUTHORITY\\SYSTEM:(OI)(CI)F**
 
@@ -88,14 +91,14 @@ Image pre-staging is useful only for the initial image download. It is not suppo
     **Note**  
     It is recommended to apply ACL security to the *PrestagedImages* folder.
 
-     
+     
 
 5.  Push the image files (CKM and INDEX files) to the *PrestagedImages* folder.
 
     **Note**  
     After the image files have been pushed to the pre-stage folder, it is recommended to run a data integrity check and to mark the files as read-only.
 
-     
+     
 
 6.  Include the following parameter in the MED-V client installation: *Client.MSI VMSFOLDER=”C:\\MED-V Images”*.
 
@@ -112,9 +115,9 @@ Image pre-staging is useful only for the initial image download. It is not suppo
 
 2.  If the image is in a different location, change the path.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md b/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md
index 9f9f99c37a..5d812e35d6 100644
--- a/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md
+++ b/mdop/medv-v1/how-to-configure-published-applicationsmedvv2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Published Applications
 description: How to Configure Published Applications
-author: jamiejdt
+author: dansimp
 ms.assetid: 43a59ff7-5d4e-49dc-84e5-1082bc4dd8f4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -35,10 +38,10 @@ An application can be published in one of the following ways:
 
 4.  On the **Policy** menu, select **Commit**.
 
-    **Note**  
+    **Note**  
     If you are setting Internet Explorer as a published application to ensure that Web redirection works properly, make certain that any parameters are not in parentheses.
 
-     
+
 
 **Published Application Properties**
 
@@ -60,30 +63,28 @@ An application can be published in one of the following ways:
 
 
 
    Display name
    
-
    The name of the shortcut in the user's Windows Start menu.
    
+
    The name of the shortcut in the user's Windows Start menu.
    
 
    
-Note  
-
    The display name is not case sensitive.
    
+Note
    The display name is not case sensitive.
    
 
    
 
    
- 
+
 
    
 
 
 
    Description
    
-
    A description of the published application, which appears as a tooltip when the user's mouse hovers over the shortcut.
    
+
    A description of the published application, which appears as a tooltip when the user's mouse hovers over the shortcut.
    
 
 
 
    Command line
    
 
    The command used to run the application from within the MED-V workspace. The full path is required, and the parameters can be passed to the application in a similar fashion as in any other Windows command.
    
-
    In a revertible MED-V workspace, you can map a network drive with MapNetworkDrive syntax: "MapNetworkDrive <drive> <path>"—for example, "MapNetworkDrive t: \\tux\date".
    
-
    For example, to publish Windows Explorer, use the following syntax: "c:\" or "c:\windows."
    
+
    In a revertible MED-V workspace, you can map a network drive with MapNetworkDrive syntax: "MapNetworkDrive <drive> <path>"—for example, "MapNetworkDrive t: \tux\date".
    
+
    For example, to publish Windows Explorer, use the following syntax: "c:</em>" or "c:\windows."
    
 
    
-Note  
-
    To have a name resolution, you need to perform one of the following:
    
+Note
    To have a name resolution, you need to perform one of the following:
    
 
    
 
    
- 
+
 
    
 
      
 
    • Configure the DNS in the base MED-V workspace image.
      • 
@@ -91,28 +92,26 @@ An application can be published in one of the following ways:
 
    • Use the IP for defining the network drive.
      • 
 
    
 
    
-Note  
-
    If the path includes spaces, the entire path must be inside quotation marks.
    
+Note
    If the path includes spaces, the entire path must be inside quotation marks.
    
 
    
 
    
- 
+
 
    
 
    
-Note  
-
    The path should not end with a backslash ().
    
+Note
    The path should not end with a backslash ().
    
 
    
 
    
- 
+
 
    
 
 
 
    Start menu
    
-
    Select this check box to create a shortcut for the application in the user's Windows Start menu.
    
+
    Select this check box to create a shortcut for the application in the user's Windows Start menu.
    
 
 
 
 
- 
+
 
 All published applications appear as shortcuts in the Windows **Start** menu (**Start >All Programs> MED-V Applications**).
 
@@ -164,35 +163,34 @@ All published applications appear as shortcuts in the Windows **Start** menu (**
 
 
 
    Display name
    
-
    The name of the shortcut in the user's Windows Start menu.
    
+
    The name of the shortcut in the user's Windows Start menu.
    
 
 
 
    Description
    
-
    The description, which appears as a tooltip when the user's mouse hovers over the shortcut.
    
+
    The description, which appears as a tooltip when the user's mouse hovers over the shortcut.
    
 
 
 
    Folder in workspace
    
 
    Select the folder to publish as a menu containing all the applications within the folder.
    
 
    The text displayed is a relative path from the Programs folder.
    
 
    
-Note  
-
    If left blank, all programs on the host will be published as a menu.
    
+Note
    If left blank, all programs on the host will be published as a menu.
    
 
    
 
    
- 
+
 
    
 
 
 
 
- 
+
 
 All published menus appear as shortcuts in the Windows **Start** menu (**Start >All Programs> MED-V Applications**). You can change the name of the shortcut in the **Start-menu shortcuts folder** field.
 
-**Note**  
+**Note**  
 When configuring two MED-V workspaces, it is recommended to configure a different name for the Start menu shortcuts folder.
 
- 
+
 
 ## How to Remove a Published Menu from a MED-V Workspace
 
@@ -218,10 +216,10 @@ The administrator can run published applications from any location, such as a de
 "\Manager\KidaroCommands.exe" /run "" ""
 ```
 
-**Note**  
+**Note**  
 The MED-V workspace in which the published application is defined must be running.
 
- 
+
 
 ## Related topics
 
@@ -232,9 +230,9 @@ The MED-V workspace in which the published application is defined must be runnin
 
 [Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md b/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md
index 09010c95c9..3db5f49a03 100644
--- a/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md
+++ b/mdop/medv-v1/how-to-configure-the-image-web-distribution-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Image Web Distribution Server
 description: How to Configure the Image Web Distribution Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 2d32ae79-dff5-4c05-a412-dd15452b6007
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md b/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md
index ca1f949944..61a363f290 100644
--- a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md
+++ b/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Virtual Machine Setup for a MED-V Workspace
 description: How to Configure the Virtual Machine Setup for a MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: a4659b4d-18b2-45b1-9605-8b5adc438f53
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md b/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md
index 1fd2518cb4..aded377291 100644
--- a/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md
+++ b/mdop/medv-v1/how-to-configure-the-virtual-machine-setup-for-a-med-v-workspacemedvv2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure the Virtual Machine Setup for a MED-V Workspace
 description: How to Configure the Virtual Machine Setup for a MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: 50bbf58b-842c-4b63-bb93-3783903f6c7d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -25,10 +28,10 @@ All virtual machine setup configuration settings are configured in the **Policy*
 
 2.  In the **Persistent VM Setup** section, configure the properties as described in the following table.
 
-    **Note**  
+    **Note**  
     The persistent VM setup properties are enabled only for a persistent MED-V workspace.
 
-     
+
 
 3.  On the **Policy** menu, select **Commit**.
 
@@ -52,30 +55,28 @@ All virtual machine setup configuration settings are configured in the **Policy*
 
 
 
    Script Editor
    
-
    Click to configure the setup script. For more information, see [How to Set Up Script Actions](how-to-set-up-script-actions.md).
    
+
    Click to configure the setup script. For more information, see How to Set Up Script Actions.
    
 
    
-Note  
-
    This button is enabled only when Run VM Setup script is selected.
    
+Note
    This button is enabled only when Run VM Setup script is selected.
    
 
    
 
    
- 
+
 
    
 
 
 
    Message displayed when script is running
    
 
    A message to be displayed while the script is running. If left blank, the default message is displayed.
    
 
    
-Note  
-
    This field is enabled only when Run VM Setup script is checked.
    
+Note
    This field is enabled only when Run VM Setup script is checked.
    
 
    
 
    
- 
+
 
    
 
 
 
 
- 
+
 
 ## How to Configure the Virtual Machine Setup for a Revertible MED-V Workspace
 
@@ -86,10 +87,10 @@ All virtual machine setup configuration settings are configured in the **Policy*
 
 2.  In the **Revertible VM Setup** section, configure the properties as described in the following table.
 
-    **Note**  
+    **Note**  
     The revertible VM setup properties are enabled only for a revertible MED-V workspace.
 
-     
+
 
 3.  On the **Policy** menu, select **Commit**.
 
@@ -110,12 +111,12 @@ All virtual machine setup configuration settings are configured in the **Policy*
 
 
    Rename the VM based on the computer name pattern
    
 
    Select this check box to assign a unique name to each computer using the MED-V workspace so that you can differentiate between multiple computers using the same MED-V workspace.
    
-
    For more information on configuring computer image names, see [How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md).
    
+
    For more information on configuring computer image names, see How to Configure VM Computer Name Pattern Properties.
    
 
 
 
 
- 
+
 
 ## Related topics
 
@@ -126,9 +127,9 @@ All virtual machine setup configuration settings are configured in the **Policy*
 
 [Examples of Virtual Machine Configurations](examples-of-virtual-machine-configurationsv2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md b/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md
index 13ca88517f..6bea34fef3 100644
--- a/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md
+++ b/mdop/medv-v1/how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure VM Computer Name Pattern Properties
 description: How to Configure VM Computer Name Pattern Properties
-author: jamiejdt
+author: dansimp
 ms.assetid: ddf79ace-8cc3-4ee6-be5a-5940b4df5c36
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -49,22 +52,24 @@ A virtual machine computer name pattern can be assigned both for revertible and
 
     -   **Random characters**—Enter “\#” for each random character to include in the pattern. Each computer using the MED-V workspace will have a suffix of the length specified, which is generated randomly.
 
-    **Note**  
+    **Note**  
     The computer name has a limit of 15 characters. If the pattern exceeds the limit, it will be truncated.
 
-     
+
 
 4.  On the **Policy** menu, select **Commit**.
 
-    **Note**  
+    **Note**  
     A revertible VM computer name pattern can be assigned only when **Rename the VM based on the computer name patterns** (in the **Revertible VM Setup** section) is checked.
 
-     
 
-    **Note**  
-    A unique computer name can be assigned only if it is configured prior to MED-V workspace setup. Changing the name will not affect MED-V workspaces that were already set up.
 
-     
+~~~
+**Note**  
+A unique computer name can be assigned only if it is configured prior to MED-V workspace setup. Changing the name will not affect MED-V workspaces that were already set up.
+~~~
+
+
 
 ## How to Assign a Virtual Machine Computer Name Pattern to a Persistent MED-V Workspace
 
@@ -99,17 +104,17 @@ A virtual machine computer name pattern can be assigned both for revertible and
 
     -   **Random characters**— Enter “\#” for each random character to include in the pattern. The computer will have a suffix of the length specified, which is generated randomly.
 
-    **Note**  
+    **Note**  
     The computer name has a limit of 15 characters. If the pattern exceeds the limit, it will be truncated.
 
-     
+
 
 6.  On the **Policy** menu, select **Commit**.
 
-    **Note**  
+    **Note**  
     The computer will be renamed only if it is set as an action in the **Script Actions** dialog box. For detailed information, see [How to Set Up Script Actions](how-to-set-up-script-actions.md).
 
-     
+
 
 ## Related topics
 
@@ -122,9 +127,9 @@ A virtual machine computer name pattern can be assigned both for revertible and
 
 [Examples of Virtual Machine Configurations](examples-of-virtual-machine-configurationsv2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md b/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md
index d1b9c0415c..463ab388e1 100644
--- a/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md
+++ b/mdop/medv-v1/how-to-configure-web-settings-for-a-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: How to Configure Web Settings for a MED-V Workspace
 description: How to Configure Web Settings for a MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: 9a6cd28f-7e4f-468f-830a-7b1d9abd3af3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -18,10 +21,10 @@ Web sites that can only be displayed in older versions of Internet Explorer and
 
 The following procedures describe how you can set a list of Web browsing rules for a MED-V workspace. All sites included in the rules can be browsed either in the MED-V workspace or on the host, as defined by the administrator. All sites not defined within the rules are browsed from the environment in which they were requested. However, you can configure them as a group as well, to be browsed in the MED-V workspace or the host.
 
-**Note**  
+**Note**  
 Web settings are applied only to Internet Explorer and to no other browsers.
 
- 
+
 
 All Web settings are configured in the **Policy** module, on the **Web** tab.
 
@@ -84,7 +87,7 @@ All Web settings are configured in the **Policy** module, on the **Web** tab.
 
      
 
    • Domain suffix—Access to any host address ending with the suffix specified in the Value property and is set according to the option set in Web Browsing.
      • 
 
    • IP Prefix—Access to any full or partial IP address in the range of the prefix specified in the Value property and is set according to the option set in Web Browsing.
      • 
-
    • All Local Addresses—Access to all addresses without a '.' and is set according to the option set in Web Browsing.
      • 
+
    • All Local Addresses—Access to all addresses without a '.' and is set according to the option set in Web Browsing.
      • 
 
    
 
 
@@ -92,14 +95,13 @@ All Web settings are configured in the **Policy** module, on the **Web** tab.
 
      
 
    • If Domain suffix is selected in the Type property, enter a domain suffix.
      
 
      
-Note  
-
        
+Note
          
 
        • Do not enter "*" before the suffix.
          • 
 
        • Domain suffixes support aliases as well.
          • 
 
        
 
      
 
      
- 
+
 
      • 
 
    • If IP Prefix is selected in the Type property, enter a full or partial IP address.
      • 
 
    
@@ -107,7 +109,7 @@ All Web settings are configured in the **Policy** module, on the **Web** tab.
 
 
 
- 
+
 
 ## How to Delete a Web Rule
 
@@ -127,9 +129,9 @@ All Web settings are configured in the **Policy** module, on the **Web** tab.
 
 [Creating a MED-V Workspace](creating-a-med-v-workspacemedv-10-sp1.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md b/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md
index 0b8d906842..c63893f150 100644
--- a/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md
+++ b/mdop/medv-v1/how-to-create-and-test-a-med-v-image.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create and Test a MED-V Image
 description: How to Create and Test a MED-V Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 40e4aba6-12cb-4794-967d-2c09dc20d808
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -56,7 +59,7 @@ When creating a MED-V image, it goes through the following stages:
     **Note**  
     The following characters cannot be included in the image name: space " < > | \\ / : \* ?
 
-     
+     
 
 5.  Click **OK**.
 
@@ -93,7 +96,7 @@ When creating a MED-V image, it goes through the following stages:
 
 
 
- 
+ 
 
 ## How to Test a MED-V Image from the MED-V Client
 
@@ -125,12 +128,12 @@ After a MED-V test image is created, use the following procedure to test the ima
 **Note**  
 While testing an image, do not open VPC and make changes to the image.
 
- 
+ 
 
 **Note**  
 When testing an image, no changes are saved to the image between sessions; instead, they are saved in a separate, temporary file. This is to ensure that when the image is packed and run on the production environment, it is the original, clean image.
 
- 
+ 
 
 ## Related topics
 
@@ -143,9 +146,9 @@ When testing an image, no changes are saved to the image between sessions; inste
 
 [MED-V Client Operations](med-v-client-operations.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/how-to-delete-a-med-v-image.md b/mdop/medv-v1/how-to-delete-a-med-v-image.md
index 3922b9bf8b..02d9bb6115 100644
--- a/mdop/medv-v1/how-to-delete-a-med-v-image.md
+++ b/mdop/medv-v1/how-to-delete-a-med-v-image.md
@@ -1,12 +1,15 @@
 ---
 title: How to Delete a MED-V Image
 description: How to Delete a MED-V Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 974a493a-7627-4c64-9294-89441f127916
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md b/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md
index fe3263d090..d849956376 100644
--- a/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md
+++ b/mdop/medv-v1/how-to-deploy-a-workspace-imagedeployment-package.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy a Workspace Image
 description: How to Deploy a Workspace Image
-author: jamiejdt
+author: dansimp
 ms.assetid: b2c77e0d-101d-4956-a27c-8beb0e4f262e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md b/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md
index 478a886411..5eb6dd5c1c 100644
--- a/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md
+++ b/mdop/medv-v1/how-to-deploy-a-workspace-imageesds.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy a Workspace Image
 description: How to Deploy a Workspace Image
-author: jamiejdt
+author: dansimp
 ms.assetid: ccc8e89b-1625-4b58-837e-4c6d93d46070
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md b/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md
index 6ca3af5de9..babf8996d1 100644
--- a/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md
+++ b/mdop/medv-v1/how-to-edit-a-published-application-with-advanced-settings.md
@@ -1,12 +1,15 @@
 ---
 title: How to Edit a Published Application with Advanced Settings
 description: How to Edit a Published Application with Advanced Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: 06a79049-9ce9-490f-aad7-fd4fdf185590
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -46,13 +49,12 @@ After a published application has been added and configured, the published appli
 
 
 
    Display name
    
-
    The name of the shortcut in the user's Windows Start menu.
    
+
    The name of the shortcut in the user's Windows Start menu.
    
 
    
-Note  
-
    The display name is not case sensitive.
    
+Note
    The display name is not case sensitive.
    
 
    
 
    
- 
+
 
    
 
 
@@ -63,11 +65,10 @@ After a published application has been added and configured, the published appli
 
    Start in
    
 
    The directory from which to start the application.
    
 
    
-Note  
-
    The path does not need to include quotation marks.
    
+Note
    The path does not need to include quotation marks.
    
 
    
 
    
- 
+
 
    
 
 
@@ -75,14 +76,13 @@ After a published application has been added and configured, the published appli
 
    The command with which to run the application from within the MED-V workspace.
    
 
    The full path is required, and the parameters can be passed to the application in a similar fashion as in any other Windows command.
    
 
    In a domain configuration, a shared drive usually exists on the server where all domain computers map to. The directory should be mapped here, and if it is a folder that requires user authentication, the Use MED-V credentials to run this application check box must be selected.
    
-
    In a revertible MED-V workspace, you can map a network drive with MapNetworkDrive syntax: "MapNetworkDrive <drive> <path>"—for example, "MapNetworkDrive t: \\tux\data".
    
-
    For example, to publish Windows Explorer, use the following syntax: "c:\" or "c:\windows".
    
+
    In a revertible MED-V workspace, you can map a network drive with MapNetworkDrive syntax: "MapNetworkDrive <drive> <path>"—for example, "MapNetworkDrive t: \tux\data".
    
+
    For example, to publish Windows Explorer, use the following syntax: "c:&quot; or "c:\windows".
    
 
    
-Note  
-
    To have a name resolution, you need to perform one of the following:
    
+Note
    To have a name resolution, you need to perform one of the following:
    
 
    
 
    
- 
+
 
    
 
      
 
    • Configure the DNS in the base MED-V workspace image.
      • 
@@ -90,23 +90,21 @@ After a published application has been added and configured, the published appli
 
    • Use the IP for defining the network drive.
      • 
 
    
 
    
-Note  
-
    If the path includes spaces, the entire path must be inside quotation marks.
    
+Note
    If the path includes spaces, the entire path must be inside quotation marks.
    
 
    
 
    
- 
+
 
    
 
    
-Note  
-
    The path should not end with a backslash ().
    
+Note
    The path should not end with a backslash ().
    
 
    
 
    
- 
+
 
    
 
 
 
    Add a shortcut in the host Windows Start menu
    
-
    Select this check box to create a shortcut for the application in the user's Windows Start menu.
    
+
    Select this check box to create a shortcut for the application in the user's Windows Start menu.
    
 
 
 
    Launch this application when the Workspace is started
    
@@ -116,26 +114,25 @@ After a published application has been added and configured, the published appli
 
    Use MED-V credentials to run this application
    
 
    Select this check box to authenticate applications that request a user name and password using the MED-V credentials instead of the credentials set for the application.
    
 
    
-Note  
-
    When using SSO, the command line should be C:\Windows\Explorer.exe "folder path". When not using SSO, the command line should be "folder path".
    
+Note
    When using SSO, the command line should be C:\Windows\Explorer.exe "folder path". When not using SSO, the command line should be "folder path".
    
 
    
 
    
- 
+
 
    
 
 
 
 
- 
+
 
 ## Related topics
 
 
 [How to Configure Published Applications](how-to-configure-published-applicationsmedvv2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-generate-reports-medvv2.md b/mdop/medv-v1/how-to-generate-reports-medvv2.md
index 40f18afa63..e9219aa508 100644
--- a/mdop/medv-v1/how-to-generate-reports-medvv2.md
+++ b/mdop/medv-v1/how-to-generate-reports-medvv2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Generate Reports
 description: How to Generate Reports
-author: jamiejdt
+author: dansimp
 ms.assetid: 9f8ba28e-1993-4c11-a28a-493718051e5d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -59,22 +62,20 @@ The report results can be grouped by dragging a column header to the top of the
 
    Time
    
 
    The date and time the event occurred.
    
 
    
-Note  
-
    By default, the events are displayed in descending date order. However, it can be changed by clicking the Time Received column.
    
+Note
    By default, the events are displayed in descending date order. However, it can be changed by clicking the Time Received column.
    
 
    
 
    
- 
+
 
    
 
 
 
    User Name
    
 
    The user who initiated the event.
    
 
    
-Note  
-
    If the event occurred before a user logged on, the user name is SYSTEM.
    
+Note
    If the event occurred before a user logged on, the user name is SYSTEM.
    
 
    
 
    
- 
+
 
    
 
 
@@ -113,17 +114,16 @@ The report results can be grouped by dragging a column header to the top of the
 
    Image Version
    
 
    The image version that the MED-V workspace is currently using.
    
 
    
-Note  
-
    MED-V workspace version can be Unknown if it has not yet been downloaded onto a computer.
    
+Note
    MED-V workspace version can be Unknown if it has not yet been downloaded onto a computer.
    
 
    
 
    
- 
+
 
    
 
 
 
 
- 
+
 
 ## How to Generate an Activity Log Report
 
@@ -182,18 +182,16 @@ The report results can be grouped by dragging a column header to the top of the
 
    Time Received
    
 
    The date and time the event was received on the server.
    
 
    
-Note  
-
    If the client is working offline, the server receives the reports when the client is online.
    
+Note
    If the client is working offline, the server receives the reports when the client is online.
    
 
    
 
    
- 
+
 
    
 
    
-Note  
-
    By default, the events are displayed in descending date order. However, it can be changed by clicking the Time Received column.
    
+Note
    By default, the events are displayed in descending date order. However, it can be changed by clicking the Time Received column.
    
 
    
 
    
- 
+
 
    
 
 
@@ -219,7 +217,7 @@ The report results can be grouped by dragging a column header to the top of the
 
 
 
- 
+
 
 ## How to Generate an Error Log Report
 
@@ -272,18 +270,16 @@ The report results can be grouped by dragging a column header to the top of the
 
    Time Received
    
 
    The date and time the event was received on the server.
    
 
    
-Note  
-
    If the client is working offline, the server receives the reports when the client is online.
    
+Note
    If the client is working offline, the server receives the reports when the client is online.
    
 
    
 
    
- 
+
 
    
 
    
-Note  
-
    By default, the events are displayed in descending date order. However, it can be changed by clicking the Time Received column.
    
+Note
    By default, the events are displayed in descending date order. However, it can be changed by clicking the Time Received column.
    
 
    
 
    
- 
+
 
    
 
 
@@ -305,11 +301,11 @@ The report results can be grouped by dragging a column header to the top of the
 
 
 
- 
-
- 
-
- 
+
+
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-import-and-export-a-policy.md b/mdop/medv-v1/how-to-import-and-export-a-policy.md
index 7c7c923d36..aaa08137dc 100644
--- a/mdop/medv-v1/how-to-import-and-export-a-policy.md
+++ b/mdop/medv-v1/how-to-import-and-export-a-policy.md
@@ -1,12 +1,15 @@
 ---
 title: How to Import and Export a Policy
 description: How to Import and Export a Policy
-author: jamiejdt
+author: dansimp
 ms.assetid: c86455de-2096-4bb1-b9d3-22efb42f3317
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md b/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md
index 8a48eb313c..16597d58b2 100644
--- a/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md
+++ b/mdop/medv-v1/how-to-install-and-configure-the-med-v-server-component.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install and Configure the MED-V Server Component
 description: How to Install and Configure the MED-V Server Component
-author: jamiejdt
+author: dansimp
 ms.assetid: 2d3c5b15-df2c-4ab6-bf78-f47ef8ae7418
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -45,10 +48,10 @@ This section explains how to [install](#bkmk-howtoinstallthemedvserver) and [con
 
 6.  When the **InstallShield Wizard Completed** screen appears, click **Finish** to complete the wizard.
 
-**Note**  
+**Note**  
 If you are installing the MED-V server via Microsoft Remote Desktop, use the following syntax: **mstsc/admin**. Ensure that your RDP session is directed to the console.
 
- 
+
 
 ## How to Configure the MED-V Server
 
@@ -69,32 +72,34 @@ The following server settings can be configured:
 
 1.  On the Windows Start menu, select **All Programs > MED-V > MED-V Server Configuration Manager**.
 
-    **Note**  
+    **Note**  
     Note: If you selected the **Launch MED-V Server Configuration Manager** check box during the server installation, the MED-V server configuration manager starts automatically after the server installation is complete.
 
-     
 
-    The MED-V Server Configuration Manager appears.
 
-2.  On the **Connections** tab, configure the following client connections settings:
+~~~
+The MED-V Server Configuration Manager appears.
+~~~
 
-    -   **Enable unencrypted connections (http), using port**—Select this check box to enable unencrypted connections using a specified port. In the port box, enter the server port on which to accept unencrypted connections (http).
+2. On the **Connections** tab, configure the following client connections settings:
 
-    -   **Enable encrypted connections (https), using port**—Select this check box to enable encrypted connections using a specified port. In the port box, enter the server port on which to accept encrypted connections (https).
+   -   **Enable unencrypted connections (http), using port**—Select this check box to enable unencrypted connections using a specified port. In the port box, enter the server port on which to accept unencrypted connections (http).
 
-        Https is an optional configuration which can be set to ensure secure transactions between the MED-V server and MED-V clients. To configure https, you must perform the following procedures:
+   -   **Enable encrypted connections (https), using port**—Select this check box to enable encrypted connections using a specified port. In the port box, enter the server port on which to accept encrypted connections (https).
 
-        -   Configure a certificate on the server.
+       Https is an optional configuration which can be set to ensure secure transactions between the MED-V server and MED-V clients. To configure https, you must perform the following procedures:
 
-        -   Associate the server certificate with the port specified using netsh. For information, see the following:
+       -   Configure a certificate on the server.
 
-            -   [Netsh Commands for Hypertext Transfer Protocol (HTTP)](https://go.microsoft.com/fwlink/?LinkId=183314)
+       -   Associate the server certificate with the port specified using netsh. For information, see the following:
 
-            -   [How to: Configure a Port with an SSL Certificate](https://go.microsoft.com/fwlink/?LinkID=183315)
+           -   [Netsh Commands for Hypertext Transfer Protocol (HTTP)](https://go.microsoft.com/fwlink/?LinkId=183314)
 
-            -   [How to: Configure a Port with an SSL Certificate](https://msdn.microsoft.com/library/ms733791.aspx)
+           -   [How to: Configure a Port with an SSL Certificate](https://go.microsoft.com/fwlink/?LinkID=183315)
 
-3.  Click **OK**.
+           -   [How to: Configure a Port with an SSL Certificate](https://msdn.microsoft.com/library/ms733791.aspx)
+
+3. Click **OK**.
 
 ### Configuring Images
 
@@ -148,10 +153,10 @@ The following server settings can be configured:
 
         `Data Source=;Initial Catalog=;uid=sa;pwd=;`
 
-        **Note**  
+        **Note**  
         Note: To connect to SQL Express, use: `Data Source=\sqlexpress.`
 
-         
+
 
 4.  To create the database, click **Create Database**.
 
@@ -182,9 +187,9 @@ The following server settings can be configured:
 
 [Design the MED-V Server Infrastructure](design-the-med-v-server-infrastructure.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md b/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md
index 6d34ea987a..2ab92353b5 100644
--- a/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md
+++ b/mdop/medv-v1/how-to-install-med-v-client-and-med-v-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install MED-V Client and MED-V Management Console
 description: How to Install MED-V Client and MED-V Management Console
-author: jamiejdt
+author: dansimp
 ms.assetid: 8a5f3010-3a50-487e-99d8-e352e5cb51c6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -22,15 +25,15 @@ The following MED-V components are included in the client .msi package:
 
 The MED-V management console and the MED-V client are both installed from the MED-V client .msi package. The MED-V client, however, can be installed independently without the MED-V management console by clearing the **Install the MED-V Management application** check box during installation.
 
-**Note**  
-The MED-V client and MED-V management console can only be installed on Windows 7-, Windows Vista-, and Windows XP-based computers. They cannot be installed on server products.
+**Note**  
+The MED-V client and MED-V management console can only be installed on Windows 7-, Windows Vista-, and Windows XP-based computers. They cannot be installed on server products.
 
- 
 
-**Note**  
+
+**Note**  
 Do not install the MED-V client using the Windows **runas** command.
 
- 
+
 
 **To install the MED-V client**
 
@@ -58,32 +61,34 @@ Do not install the MED-V client using the Windows **runas** command.
 
     -   Select the **Install the MED-V management application** check box to include the management component in the installation.
 
-        **Note**  
+        **Note**  
         Enterprise Desktop Virtualization administrators should install the MED-V management application. This application is required for configuring desktop images and MED-V workspaces.
 
-         
 
-    -   Select the **Load MED-V when Windows starts** check box to start MED-V automatically on startup.
 
-    -   Select the **Add a MED-V shortcut to my desktop** check box to create a MED-V shortcut on your desktop.
+~~~
+-   Select the **Load MED-V when Windows starts** check box to start MED-V automatically on startup.
 
-    -   In the **Server address** field, type the server address.
+-   Select the **Add a MED-V shortcut to my desktop** check box to create a MED-V shortcut on your desktop.
 
-    -   In the **Server port** field, type the server's port.
+-   In the **Server address** field, type the server address.
 
-    -   Select the **Server requires encrypted connections (https)** check box to work with https.
+-   In the **Server port** field, type the server's port.
 
-    -   The default virtual machine images folder is displayed. The default installation folder is *%systemdrive%\\MED-V Images\\*. To change the folder where MED-V should be installed, click **Change**, and browse to an existing folder.
+-   Select the **Server requires encrypted connections (https)** check box to work with https.
 
-7.  Click **Next**.
+-   The default virtual machine images folder is displayed. The default installation folder is *%systemdrive%\\MED-V Images\\*. To change the folder where MED-V should be installed, click **Change**, and browse to an existing folder.
+~~~
 
-8.  On the **Ready to Install the Program** screen, click **Install**.
+7. Click **Next**.
 
-    The MED-V client installation starts. This can take several minutes, and the screen might not display text. During installation, several progress screens appear. If a message appears, follow the instructions provided.
+8. On the **Ready to Install the Program** screen, click **Install**.
 
-    Upon successful installation, the **InstallShield Wizard Completed** screen appears.
+   The MED-V client installation starts. This can take several minutes, and the screen might not display text. During installation, several progress screens appear. If a message appears, follow the instructions provided.
 
-9.  Click **Finish** to close the wizard.
+   Upon successful installation, the **InstallShield Wizard Completed** screen appears.
+
+9. Click **Finish** to close the wizard.
 
 ## Related topics
 
@@ -92,9 +97,9 @@ Do not install the MED-V client using the Windows **runas** command.
 
 [Installation and Upgrade Checklists](installation-and-upgrade-checklists.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md b/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md
index 7452b994da..908b387c82 100644
--- a/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md
+++ b/mdop/medv-v1/how-to-install-med-v-clientdeployment-package.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install MED-V Client
 description: How to Install MED-V Client
-author: jamiejdt
+author: dansimp
 ms.assetid: bfac6de7-d96d-4b3e-bd8b-183e051e53c8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -16,10 +19,10 @@ ms.date: 06/16/2016
 
 In a deployment package-based scenario, the MED-V client installation is included in the deployment package and installed directly from the package.
 
-**Important**  
+**Important**  
 When using a deployment package that does not include an image, ensure that the image is uploaded to the Web or pushed to the pre-stage folder prior to installing the deployment package.
 
- 
+
 
 **To install a deployment package**
 
@@ -33,27 +36,29 @@ When using a deployment package that does not include an image, ensure that the
 
     A dialog box appears listing the components that are already installed and those that are currently being installed.
 
-    **Note**  
+    **Note**  
     If a version of the Microsoft Virtual PC that is not supported exists on the host computer, a message will appear telling you to uninstall the existing version and run the installer again.
 
-     
 
-    **Note**  
-    If an older version of the MED-V client exists, it will prompt you asking whether you want to upgrade.
 
-     
+~~~
+**Note**  
+If an older version of the MED-V client exists, it will prompt you asking whether you want to upgrade.
 
-    Depending on the components that have been installed, you might need to reboot. If rebooting is necessary, a message appears notifying you that you must reboot.
 
-3.  If necessary, reboot the computer.
 
-    When the installation is complete, MED-V starts and a message appears notifying you that the installation is complete.
+Depending on the components that have been installed, you might need to reboot. If rebooting is necessary, a message appears notifying you that you must reboot.
+~~~
 
-4.  Log in to MED-V using the following user name and password:
+3. If necessary, reboot the computer.
 
-    -   Type in the domain name and user name followed by the password of the domain user who is permitted to work with MED-V.
+   When the installation is complete, MED-V starts and a message appears notifying you that the installation is complete.
 
-        Example: "domain\_name\\user\_name", "password"
+4. Log in to MED-V using the following user name and password:
+
+   -   Type in the domain name and user name followed by the password of the domain user who is permitted to work with MED-V.
+
+       Example: "domain\_name\\user\_name", "password"
 
 ## Related topics
 
@@ -64,9 +69,9 @@ When using a deployment package that does not include an image, ensure that the
 
 [Client Installation Command Line Reference](client-installation-command-line-reference.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-install-med-v-clientesds.md b/mdop/medv-v1/how-to-install-med-v-clientesds.md
index 3724660711..46cf4d5fea 100644
--- a/mdop/medv-v1/how-to-install-med-v-clientesds.md
+++ b/mdop/medv-v1/how-to-install-med-v-clientesds.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install MED-V Client
 description: How to Install MED-V Client
-author: jamiejdt
+author: dansimp
 ms.assetid: fb35f618-684c-474f-9053-b70bb29c3cc0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-localize-a-med-v-image.md b/mdop/medv-v1/how-to-localize-a-med-v-image.md
index 5db008c90c..b5f0bdf42a 100644
--- a/mdop/medv-v1/how-to-localize-a-med-v-image.md
+++ b/mdop/medv-v1/how-to-localize-a-med-v-image.md
@@ -1,12 +1,15 @@
 ---
 title: How to Localize a MED-V Image
 description: How to Localize a MED-V Image
-author: jamiejdt
+author: dansimp
 ms.assetid: adc148b3-8cfe-42a0-8847-be6b689a673a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -43,7 +46,7 @@ A packed image can be unpacked to the local repository by extracting it. It then
     **Note**  
     The downloaded image will not appear in the **Local Images** pane until you refresh the page. Click Refresh to see the downloaded image in the **Local Images** pane.
 
-     
+     
 
 ## Related topics
 
@@ -54,9 +57,9 @@ A packed image can be unpacked to the local repository by extracting it. It then
 
 [How to Upload a MED-V Image to the Server](how-to-upload-a-med-v-image-to-the-server.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md b/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md
index fc3a8a4ac6..e620f98a5e 100644
--- a/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md
+++ b/mdop/medv-v1/how-to-lock-and-unlock-a-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: How to Lock and Unlock a Workspace
 description: How to Lock and Unlock a Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: 027166b9-0e06-4a4e-a8ac-a4d5f429656f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-pack-a-med-v-image.md b/mdop/medv-v1/how-to-pack-a-med-v-image.md
index c4a159e291..08ccd86ef5 100644
--- a/mdop/medv-v1/how-to-pack-a-med-v-image.md
+++ b/mdop/medv-v1/how-to-pack-a-med-v-image.md
@@ -1,12 +1,15 @@
 ---
 title: How to Pack a MED-V Image
 description: How to Pack a MED-V Image
-author: jamiejdt
+author: dansimp
 ms.assetid: e1ce2307-0f1b-4bf8-b146-e4012dc138d2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -32,25 +35,27 @@ A MED-V image must be packed before it can be added to a deployment package or u
 
     -   In the **Image name** field, type the desired name.
 
-        **Note**  
+        **Note**  
         The following characters cannot be included in the image name: space " < > | \\ / : \* ?
 
-         
 
-        A new packed image will be created.
 
-    -   From the drop-down list, select an existing name.
+~~~
+    A new packed image will be created.
 
-        A new version of the existing image will be created.
+-   From the drop-down list, select an existing name.
 
-5.  Click **OK**.
+    A new version of the existing image will be created.
+~~~
 
-    A new MED-V packed image is created on your host computer with the properties defined in the following table.
+5. Click **OK**.
 
-**Note**  
+   A new MED-V packed image is created on your host computer with the properties defined in the following table.
+
+**Note**  
 In the **Local Packed Images** and **Packed Images on Server** panes, the most recent version of each image is displayed as the parent node. Click the parent node to view all other existing versions of the image.
 
- 
+
 
 **Local Packed Images Properties**
 
@@ -74,11 +79,10 @@ In the **Local Packed Images** and **Packed Images on Server** panes, the most r
 
    Version
    
 
    The version of the displayed image.
    
 
    
-Note  
-
    All previous versions are kept unless deleted.
    
+Note
    All previous versions are kept unless deleted.
    
 
    
 
    
- 
+
 
    
 
 
@@ -92,7 +96,7 @@ In the **Local Packed Images** and **Packed Images on Server** panes, the most r
 
 
 
- 
+
 
 ## Related topics
 
@@ -103,9 +107,9 @@ In the **Local Packed Images** and **Packed Images on Server** panes, the most r
 
 [Creating a Virtual PC Image for MED-V](creating-a-virtual-pc-image-for-med-v.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md b/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md
index f94242e128..9c9183aebe 100644
--- a/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md
+++ b/mdop/medv-v1/how-to-set-advanced-file-transfer-options.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set Advanced File Transfer Options
 description: How to Set Advanced File Transfer Options
-author: jamiejdt
+author: dansimp
 ms.assetid: 5e9f8749-a5a9-48c6-9bfc-6b8e0cbe6cab
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md b/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md
index 22bd38136e..f06380a126 100644
--- a/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md
+++ b/mdop/medv-v1/how-to-set-med-v-workspace-deletion-options.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set MED-V Workspace Deletion Options
 description: How to Set MED-V Workspace Deletion Options
-author: jamiejdt
+author: dansimp
 ms.assetid: 0f85aa81-c188-4115-9141-ceba2473c00e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-set-up-script-actions.md b/mdop/medv-v1/how-to-set-up-script-actions.md
index d3d6004dfe..cff5da73d1 100644
--- a/mdop/medv-v1/how-to-set-up-script-actions.md
+++ b/mdop/medv-v1/how-to-set-up-script-actions.md
@@ -1,12 +1,15 @@
 ---
 title: How to Set Up Script Actions
 description: How to Set Up Script Actions
-author: jamiejdt
+author: dansimp
 ms.assetid: 367e28f1-d8c2-4845-a01b-2fff9128ccfd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -44,26 +47,28 @@ The following is a list of actions that can be added to the domain setup script:
     **Note**  
     **Rename Computer** is configured in the **VM Settings** tab. For more information, see [How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md).
 
-     
+     
 
-    **Note**  
-    To rename a computer, Windows must be restarted. It is recommended to add a Restart Windows action following a Rename Computer action.
+~~~
+**Note**  
+To rename a computer, Windows must be restarted. It is recommended to add a Restart Windows action following a Rename Computer action.
+~~~
 
-     
 
-4.  Set the order of the actions by selecting an action and clicking **Up** or **Down**.
 
-5.  Click **OK**.
+4. Set the order of the actions by selecting an action and clicking **Up** or **Down**.
 
-**Note**  
+5. Click **OK**.
+
+**Note**  
 When running the Join Domain script, for the script to work, the user logged into the MED-V workspace virtual machine must have local administrator rights.
 
- 
 
-**Note**  
+
+**Note**  
 When running the Disable Auto-Logon script, it is recommended to disable the local guest account used for the auto-logon once the initial setup is complete.
 
- 
+
 
 ### 
 
@@ -89,11 +94,10 @@ When running the Disable Auto-Logon script, it is recommended to disable the loc
 
  • Use the following credentials—The credentials specified; enter a user name and password in the corresponding fields.
    • 
 
 
    
-Note  
-
    The credentials you enter are visible to all MED-V workspace users. It is not recommended to provide domain administrator credentials.
    
+Note
    The credentials you enter are visible to all MED-V workspace users. It is not recommended to provide domain administrator credentials.
    
 
    
 
    
- 
+
 
    
 
 
@@ -109,17 +113,16 @@ When running the Disable Auto-Logon script, it is recommended to disable the loc
 
    Organization Unit
    
 
    An organization unit (OU) may be specified to join the computer to a specific OU. The format must follow an OU distinguished name: OU=<Organization Unit>,<Domain Controller> (for example, OU=QATest, DC=il, DC=MED-V, DC=com).
    
 
    
-Warning  
-
    Only a single level OU is supported as is shown in the example above.
    
+Warning
    Only a single level OU is supported as is shown in the example above.
    
 
    
 
    
- 
+ 
 
    
 
 
 
 
- 
+ 
 
 ### 
 
@@ -152,7 +155,7 @@ When running the Disable Auto-Logon script, it is recommended to disable the loc
 
 
 
- 
+ 
 
 ### 
 
@@ -211,7 +214,7 @@ When running the Disable Auto-Logon script, it is recommended to disable the loc
 
 
 
- 
+ 
 
 When configuring the command-line action, several variables can be used as defined in the following table.
 
@@ -252,7 +255,7 @@ When configuring the command-line action, several variables can be used as defin
 
 
 
- 
+ 
 
 ## Related topics
 
@@ -261,9 +264,9 @@ When configuring the command-line action, several variables can be used as defin
 
 [How to Configure VM Computer Name Pattern Properties](how-to-configure-vm-computer-name-pattern-propertiesmedvv2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md b/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md
index 0589448bfb..d77de77862 100644
--- a/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md
+++ b/mdop/medv-v1/how-to-share-folders-between-the-host-and-the-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: How to Share Folders Between the Host and the MED-V Workspace
 description: How to Share Folders Between the Host and the MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: 3cb295f2-c07e-4ee6-aa3c-ce4c8c45c191
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -39,7 +42,7 @@ The following procedures demonstrate how to share folders between the host and t
         **Note**  
         Ensure that the same drive letter is not in use on both computers.
 
-         
+         
 
     4.  Click **Browse**.
 
@@ -60,11 +63,11 @@ The following procedures demonstrate how to share folders between the host and t
 **Note**  
 Ensure that both the host and MED-V workspace computers are in the same domain or workgroup.
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md b/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md
index 693e8bc4f5..491c545b20 100644
--- a/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md
+++ b/mdop/medv-v1/how-to-start-and-exit-the-med-v-client.md
@@ -1,12 +1,15 @@
 ---
 title: How to Start and Exit the MED-V Client
 description: How to Start and Exit the MED-V Client
-author: jamiejdt
+author: dansimp
 ms.assetid: 3762bad1-6937-40fa-ab5d-61a905865214
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -24,7 +27,7 @@ ms.date: 06/16/2016
 **Note**  
 MED-V cannot be started from an elevated command prompt.
 
- 
+ 
 
 **To exit the MED-V client**
 
@@ -34,9 +37,9 @@ MED-V cannot be started from an elevated command prompt.
 
     The MED-V client exits.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md b/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md
index 869c099df5..b765e2f19c 100644
--- a/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md
+++ b/mdop/medv-v1/how-to-start-stop-and-restart-a-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: How to Start, Stop, and Restart a MED-V Workspace
 description: How to Start, Stop, and Restart a MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: 54ce139c-8f32-499e-944b-72f123ebfd2d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -41,14 +44,14 @@ ms.date: 06/16/2016
     **Note**  
     The first time a MED-V workspace is started, the user name should be in the following format: <domain name>\\<user name>.
 
-     
+     
 
 4.  Select **Save my password** to save your password between sessions.
 
     **Note**  
     To enable the save password feature, the EnableSavePassword attribute must be set to True in the ClientSettings.xml file. The file can be found in the *Servers\\Configuration Server\\* folder.
 
-     
+     
 
 5.  Clear the **Start last used workspace** check box to choose a different MED-V workspace.
 
@@ -83,9 +86,9 @@ ms.date: 06/16/2016
 
 [How to Start and Exit the MED-V Client](how-to-start-and-exit-the-med-v-client.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md b/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md
index 4f8b230308..125a45d5b6 100644
--- a/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md
+++ b/mdop/medv-v1/how-to-uninstall-med-v-componentsmedvv2.md
@@ -1,12 +1,15 @@
 ---
 title: How to Uninstall MED-V Components
 description: How to Uninstall MED-V Components
-author: jamiejdt
+author: dansimp
 ms.assetid: 91bdf488-14e7-43ab-972d-9d92421acb86
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-update-a-med-v-image.md b/mdop/medv-v1/how-to-update-a-med-v-image.md
index 1e6a3668ae..742368d6ac 100644
--- a/mdop/medv-v1/how-to-update-a-med-v-image.md
+++ b/mdop/medv-v1/how-to-update-a-med-v-image.md
@@ -1,12 +1,15 @@
 ---
 title: How to Update a MED-V Image
 description: How to Update a MED-V Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 61eacf50-3a00-4bb8-b2f3-7350a6467fa1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -22,7 +25,7 @@ An existing MED-V image can be updated, thereby creating a new version of the im
 **Note**  
 When a new version is deployed on the client, it overwrites the existing image. When updating an image, ensure that no data on the client needs to be saved.
 
- 
+ 
 
 **To update a MED-V image**
 
@@ -39,7 +42,7 @@ When a new version is deployed on the client, it overwrites the existing image.
     **Note**  
     If you name the image a different name than the existing version, a new image will be created rather than a new version of the existing image.
 
-     
+     
 
 6.  Upload the new version to the server or distribute it via a deployment package.
 
@@ -56,9 +59,9 @@ When a new version is deployed on the client, it overwrites the existing image.
 
 [Updating a MED-V Workspace Image](updating-a-med-v-workspace-image.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md b/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md
index 15b42edc9a..18cf02c554 100644
--- a/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md
+++ b/mdop/medv-v1/how-to-upload-a-med-v-image-to-the-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Upload a MED-V Image to the Server
 description: How to Upload a MED-V Image to the Server
-author: jamiejdt
+author: dansimp
 ms.assetid: 0e70dfdf-3e3a-4860-970c-535806caa907
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -18,10 +21,10 @@ After a MED-V image has been tested, it can be packed and then uploaded to the s
 
 Once a MED-V image is packed and uploaded to the server, it can be distributed to users by using an enterprise software distribution center, or it can be downloaded by users using a deployment package. For information on deployment using an enterprise software distribution center, see [Deploying a MED-V Workspace Using an Enterprise Software Distribution System](deploying-a-med-v-workspace-using-an-enterprise-software-distribution-system.md). For information on deployment using a package, see [Deploying a MED-V Workspace Using a Deployment Package](deploying-a-med-v-workspace-using-a-deployment-package.md).
 
-**Note**  
+**Note**  
 Before uploading an image, verify that a Web proxy is not defined in your browser settings and that Windows Update is not currently running.
 
- 
+
 
 **To upload a MED-V image to the server**
 
@@ -55,11 +58,10 @@ Before uploading an image, verify that a Web proxy is not defined in your browse
 
    Version
    
 
    The version of the displayed image.
    
 
    
-Note  
-
    All previous versions are kept unless deleted.
    
+Note
    All previous versions are kept unless deleted.
    
 
    
 
    
- 
+
 
    
 
 
@@ -73,7 +75,7 @@ Before uploading an image, verify that a Web proxy is not defined in your browse
 
 
 
- 
+
 
 ## Related topics
 
@@ -86,9 +88,9 @@ Before uploading an image, verify that a Web proxy is not defined in your browse
 
 [How to Pack a MED-V Image](how-to-pack-a-med-v-image.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md b/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md
index 8eec332fd5..cae37d85c9 100644
--- a/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md
+++ b/mdop/medv-v1/how-to-view-med-v-settings-and-general-information.md
@@ -1,12 +1,15 @@
 ---
 title: How to View MED-V Settings and General Information
 description: How to View MED-V Settings and General Information
-author: jamiejdt
+author: dansimp
 ms.assetid: c14e3f30-c4e5-47a3-8ad1-0570fc62d991
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/how-to-work-with-reports.md b/mdop/medv-v1/how-to-work-with-reports.md
index 7d9631f017..d9c80fd178 100644
--- a/mdop/medv-v1/how-to-work-with-reports.md
+++ b/mdop/medv-v1/how-to-work-with-reports.md
@@ -1,12 +1,15 @@
 ---
 title: How to Work with Reports
 description: How to Work with Reports
-author: jamiejdt
+author: dansimp
 ms.assetid: b7a660c6-74c3-4ced-a395-9e76a4362a46
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/identify-the-number-of-med-v-instances.md b/mdop/medv-v1/identify-the-number-of-med-v-instances.md
index 4329cd39d6..1d78567667 100644
--- a/mdop/medv-v1/identify-the-number-of-med-v-instances.md
+++ b/mdop/medv-v1/identify-the-number-of-med-v-instances.md
@@ -1,12 +1,15 @@
 ---
 title: Identify the Number of MED-V Instances
 description: Identify the Number of MED-V Instances
-author: jamiejdt
+author: dansimp
 ms.assetid: edea9bdf-a28c-4d24-9298-7bd6536c3a94
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/index.md b/mdop/medv-v1/index.md
index 807accc058..c056dfeeaf 100644
--- a/mdop/medv-v1/index.md
+++ b/mdop/medv-v1/index.md
@@ -1,12 +1,12 @@
 ---
 title: Microsoft Enterprise Desktop Virtualization Planning, Deployment, and Operations Guide
 description: Microsoft Enterprise Desktop Virtualization Planning, Deployment, and Operations Guide
-author: jamiejdt
+author: dansimp
 ms.assetid: 7bc3e120-df77-4f4c-bc8e-7aaa4c2a6525
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/installation-and-upgrade-checklists.md b/mdop/medv-v1/installation-and-upgrade-checklists.md
index 7e30f1b087..581101261f 100644
--- a/mdop/medv-v1/installation-and-upgrade-checklists.md
+++ b/mdop/medv-v1/installation-and-upgrade-checklists.md
@@ -1,12 +1,15 @@
 ---
 title: Installation and Upgrade Checklists
 description: Installation and Upgrade Checklists
-author: jamiejdt
+author: dansimp
 ms.assetid: ccfdde26-4a28-4c14-888d-71b96fe7626e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/installing-and-configuring-med-v-components.md b/mdop/medv-v1/installing-and-configuring-med-v-components.md
index 4798c21506..8128182f05 100644
--- a/mdop/medv-v1/installing-and-configuring-med-v-components.md
+++ b/mdop/medv-v1/installing-and-configuring-med-v-components.md
@@ -1,12 +1,15 @@
 ---
 title: Installing and Configuring MED-V Components
 description: Installing and Configuring MED-V Components
-author: jamiejdt
+author: dansimp
 ms.assetid: 4af90e9f-3c6b-4f7c-8274-56ad24173662
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/key-scenarios-for-using-med-v.md b/mdop/medv-v1/key-scenarios-for-using-med-v.md
index fb490b9fc4..377facde64 100644
--- a/mdop/medv-v1/key-scenarios-for-using-med-v.md
+++ b/mdop/medv-v1/key-scenarios-for-using-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Key Scenarios for Using MED-V
 description: Key Scenarios for Using MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: e35075e2-3401-49ae-810d-1bd51ebc7924
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/med-v-10-installation-checklist.md b/mdop/medv-v1/med-v-10-installation-checklist.md
index 09d1f51e31..6e306306a6 100644
--- a/mdop/medv-v1/med-v-10-installation-checklist.md
+++ b/mdop/medv-v1/med-v-10-installation-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V 1.0 Installation Checklist
 description: MED-V 1.0 Installation Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: a81fd5b0-29b3-4ddc-8f60-7d44c2be9794
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,36 +33,36 @@ The following checklist is intended to provide a high-level list of items to con
 
 
 
    Ensure your computing environment meets the supported configurations required for installing MED-V 1.0.
    
-
    [MED-V 1.0 Supported Configurations](med-v-10-supported-configurationsmedv-10.md)
    
+
    MED-V 1.0 Supported Configurations
    
 
 
 
    Plan and design the MED-V server infrastructure.
    
-
    [MED-V Infrastructure Planning and Design](med-v-infrastructure-planning-and-design.md)
    
+
    MED-V Infrastructure Planning and Design
    
 
 
 
    Verify the required prerequisites are configured.
    
-
    [MED-V Installation Prerequisites](med-v-installation-prerequisites.md)
    
+
    MED-V Installation Prerequisites
    
 
 
 
    Install and configure the MED-V server.
    
-
    [How to Install and Configure the MED-V Server Component](how-to-install-and-configure-the-med-v-server-component.md)
    
+
    How to Install and Configure the MED-V Server Component
    
 
 
 
    If using an image repository, configure the image Web distribution server.
    
-
    [How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md)
    
+
    How to Configure the Image Web Distribution Server
    
 
 
 
    Install the MED-V client and management console.
    
-
    [How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md)
    
+
    How to Install MED-V Client and MED-V Management Console
    
 
 
 
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/med-v-10-release-notesmedv-10.md b/mdop/medv-v1/med-v-10-release-notesmedv-10.md
index 189aad4a2e..ba7e8f9ef6 100644
--- a/mdop/medv-v1/med-v-10-release-notesmedv-10.md
+++ b/mdop/medv-v1/med-v-10-release-notesmedv-10.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V 1.0 Release Notes
 description: MED-V 1.0 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: 006a3537-5c5b-43b5-8df8-4bf6ddd3cd2f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md b/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md
index 35bc7e17e1..dce6ffe881 100644
--- a/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md
+++ b/mdop/medv-v1/med-v-10-sp1-and-sp2-release-notesmedv-10-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V 1.0 SP1 and SP2 Release Notes
 description: MED-V 1.0 SP1 and SP2 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: 0fde8732-8ad2-483c-b094-7996ed9f2766
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ To search these Release Notes, press CTRL+F.
 **Note**  
 Read these Release Notes thoroughly before you install the Microsoft Enterprise Desktop Virtualization (MED-V) platform. These Release Notes contain information that you must have to successfully install the MED-V platform. This document contains information that is not available in the product documentation. If there is a discrepancy between these Release Notes and other MED-V platform documentation, the latest change should be considered authoritative. These Release Notes supersede the content included with this product.
 
- 
+ 
 
 ## About the Product Documentation
 
@@ -68,9 +71,9 @@ Microsoft, Microsoft Enterprise Desktop Virtualization, MS-DOS, Windows, Windows
 
 The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md b/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md
index 0b2af418f6..6beb4ac562 100644
--- a/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md
+++ b/mdop/medv-v1/med-v-10-sp1-supported-configurationsmedv-10-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V 1.0 SP1 Supported Configurations
 description: MED-V 1.0 SP1 Supported Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: 4dcf37c4-a061-43d2-878c-28efc87c3cdd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -14,19 +17,19 @@ ms.date: 08/30/2016
 # MED-V 1.0 SP1 Supported Configurations
 
 
-This topic specifies the requirements necessary to install and run Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 Service Pack 1 (SP1) in your environment.
+This topic specifies the requirements necessary to install and run Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 Service Pack 1 (SP1) in your environment.
 
-## MED-V 1.0 SP1 Client System Requirements
+## MED-V 1.0 SP1 Client System Requirements
 
 
 ### MED-V Client Operating System Requirements
 
-The following table lists the operating systems that are supported for MED-V 1.0 SP1 client installation.
+The following table lists the operating systems that are supported for MED-V 1.0 SP1 client installation.
 
-**Note**  
+**Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/?LinkId=31975) (https://go.microsoft.com/fwlink/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/?LinkId=31976) (https://go.microsoft.com/fwlink/?LinkId=31976).
 
- 
+
 
 @@ -45,19 +48,19 @@ Microsoft provides support for the current service pack and, in some cases, the
 
-
+
-
+
-
+
@@ -65,14 +68,14 @@ Microsoft provides support for the current service pack and, in some cases, the
 
    
 

 
 
    Windows XP
    Windows XP
    		
 
    Professional Edition
    		
 
    SP2 or SP3
    		
 
    x86
    		
 
    
 
    Windows Vista
    Windows Vista
    		
 
    Business, Enterprise, or Ultimate
    		
 
    SP1 or SP2
    		
 
    x86
    		
 
    
 
    Windows 7
    Windows 7
    		
 
    Professional, Enterprise, or Ultimate
    		
 
    None
    		
 
    x86 or x64
    
 
    
 
- 
 
-**Note**  
+
+**Note**  
 MED-V client does not run in native x64 mode. Instead, MED-V runs in Windows on Windows 64-bit (WOW64) mode on 64-bit computers.
 
- 
 
-The following table lists the minimal RAM required for each operating system supported in MED-V 1.0 SP1.
+
+The following table lists the minimal RAM required for each operating system supported in MED-V 1.0 SP1.
 
 @@ -87,41 +90,41 @@ The following table lists the minimal RAM required for each operating system sup
 
-
+
-
+
-
+
-
+
    
 

 
 
    Windows XP Professional
    Windows XP Professional
    		
 
    1 GB
    		
 
    
 
    Windows Vista
    Windows Vista
    		
 
    2 GB
    		
 
    
 
    Windows 7 x86
    Windows 7 x86
    		
 
    2 GB
    		
 
    
 
    Windows 7 x64
    Windows 7 x64
    		
 
    3 GB
    		
 
    
     
 
    
 
- 
 
-### MED-V 1.0 SP1 Client Configuration
+
+### MED-V 1.0 SP1 Client Configuration
 
 **.NET Framework Version**
 
-The following versions of the Microsoft .NET Framework are supported for MED-V 1.0 SP1 client installation:
+The following versions of the Microsoft .NET Framework are supported for MED-V 1.0 SP1 client installation:
 
--   .NET Framework 2.0 or .NET Framework 2.0 SP1
+-   .NET Framework 2.0 or .NET Framework 2.0 SP1
 
--   .NET Framework 3.0 or .NET Framework 3.0 SP1
+-   .NET Framework 3.0 or .NET Framework 3.0 SP1
 
--   .NET Framework 3.5 or .NET Framework 3.5 SP1
+-   .NET Framework 3.5 or .NET Framework 3.5 SP1
 
 **Virtualization Engine**
 
-Microsoft Virtual PC 2007 SP1 with the hotfix that is described in Microsoft Knowledge Base article 974918 is supported for MED-V 1.0 SP1 client installation in the following configurations:
+Microsoft Virtual PC 2007 SP1 with the hotfix that is described in Microsoft Knowledge Base article 974918 is supported for MED-V 1.0 SP1 client installation in the following configurations:
 
 -   Static Virtual Hard Disk (VHD) file
 
@@ -131,25 +134,25 @@ Microsoft Virtual PC 2007 SP1 with the hotfix that is described in Microsoft Kn
 
 **Internet Browser**
 
-Windows Internet Explorer 7 and Windows Internet Explorer 8 are supported for MED-V 1.0 SP1 client installation.
+Windows Internet Explorer 7 and Windows Internet Explorer 8 are supported for MED-V 1.0 SP1 client installation.
 
 **Microsoft Hyper-V Server**
 
 The MED-V client is not supported in a Microsoft Hyper-V Server environment.
 
-## MED-V 1.0 SP1 Workspace System Requirements
+## MED-V 1.0 SP1 Workspace System Requirements
 
 
-MED-V 1.0 SP1 introduces changes to system requirements from those for MED-V 1.0.
+MED-V 1.0 SP1 introduces changes to system requirements from those for MED-V 1.0.
 
 ### MED-V Workspace Operating System Requirements
 
-The following table lists the operating systems supported for MED-V 1.0 SP1 workspaces.
+The following table lists the operating systems supported for MED-V 1.0 SP1 workspaces.
 
-**Note**  
+**Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/?LinkId=31975) (https://go.microsoft.com/fwlink/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/?LinkId=31976) (https://go.microsoft.com/fwlink/?LinkId=31976).
 
- 
+
 
 @@ -168,67 +171,66 @@ Microsoft provides support for the current service pack and, in some cases, the
 
-
+
-
+
    
 

 
 
    Windows 2000
    Windows 2000
    		
 
    Professional
    		
 
    SP4
    		
 
    X86
    		
 
    
 
    Windows XP
    Windows XP
    		
 
    Professional Edition
    		
 
    SP2 or SP3
    
 
    
-Note  
-
    SP3 is recommended to ensure that the MED-V workspace will be compatible with future versions of MED-V.
    
+Note
    SP3 is recommended to ensure that the MED-V workspace will be compatible with future versions of MED-V.
    
 
    
 
    
- 
+
 
    		
 
    x86
    		
 
    
     
 
    
 
- 
 
-### MED-V 1.0 SP1 Workspace Configuration
+
+### MED-V 1.0 SP1 Workspace Configuration
 
 **.NET Framework Version**
 
-MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 SP1 workspace installation:
+MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 SP1 workspace installation:
 
--   .NET Framework 2.0 SP1
+-   .NET Framework 2.0 SP1
 
--   .NET Framework 3.0 SP1
+-   .NET Framework 3.0 SP1
 
--   .NET Framework 3.5 or .NET Framework 3.5 SP1
+-   .NET Framework 3.5 or .NET Framework 3.5 SP1
+
+**Note**  
+We recommend the .NET Framework 3.5 SP1 to ensure that the MED-V workspace is compatible with future versions of MED-V.
 
-**Note**  
-We recommend the .NET Framework 3.5 SP1 to ensure that the MED-V workspace is compatible with future versions of MED-V.
 
- 
 
 **Internet Browser**
 
-Windows Internet Explorer 6 SP2 and Windows Internet Explorer 7 are supported for the MED-V 1.0 SP1 workspace installation.
+Windows Internet Explorer 6 SP2 and Windows Internet Explorer 7 are supported for the MED-V 1.0 SP1 workspace installation.
 
 ### MED-V Workspace Images
 
-MED-V workspace images must be created by using Virtual PC 2007 SP1.
+MED-V workspace images must be created by using Virtual PC 2007 SP1.
 
-## MED-V 1.0 SP1 Server System Requirements
+## MED-V 1.0 SP1 Server System Requirements
 
 
-MED-V 1.0 SP1 introduces changes to system requirements from those for MED-V 1.0.
+MED-V 1.0 SP1 introduces changes to system requirements from those for MED-V 1.0.
 
-### MED-V 1.0 Server Operating System Requirements
+### MED-V 1.0 Server Operating System Requirements
 
-The following table lists the operating systems supported for MED-V 1.0 SP1 server installations.
+The following table lists the operating systems supported for MED-V 1.0 SP1 server installations.
 
-**Note**  
+**Note**  
 Microsoft provides support for the current service pack and, in some cases, the immediately preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/?LinkId=31975) (https://go.microsoft.com/fwlink/?LinkId=31975). For additional information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/?LinkId=31976) (https://go.microsoft.com/fwlink/?LinkId=31976).
 
- 
+
 
 @@ -247,13 +249,13 @@ Microsoft provides support for the current service pack and, in some cases, the
 
-
+
-
+
@@ -261,23 +263,23 @@ Microsoft provides support for the current service pack and, in some cases, the
 
    
 

 
 
    Windows Server 2008
    Windows Server 2008
    		
 
    Standard or Enterprise
    		
 
    SP1 or SP2
    		
 
    X86 or x64
    		
 
    
 
    Windows Server 2008 R2
    Windows Server 2008 R2
    		
 
    Standard or Enterprise
    		
 
    None
    		
 
    x64
    
 
    
 
- 
 
-### MED-V 1.0 SP1 Server Configuration
+
+### MED-V 1.0 SP1 Server Configuration
 
 **.NET Framework Version**
 
-MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 SP1 workspace installation:
+MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 SP1 workspace installation:
 
--   .NET Framework 2.0 or .NET Framework 2.0 SP1
+-   .NET Framework 2.0 or .NET Framework 2.0 SP1
 
--   .NET Framework 3.0 or .NET Framework 3.0 SP1
+-   .NET Framework 3.0 or .NET Framework 3.0 SP1
 
--   .NET Framework 3.5 or .NET Framework 3.5 SP1
+-   .NET Framework 3.5 or .NET Framework 3.5 SP1
 
 **Microsoft SQL Server Version**
 
-The following versions of Microsoft SQL Server are supported for MED-V 1.0 SP1 when SQL Server is installed locally or remotely from the MED-V 1.0 SP1 Server:
+The following versions of Microsoft SQL Server are supported for MED-V 1.0 SP1 when SQL Server is installed locally or remotely from the MED-V 1.0 SP1 Server:
 
 @@ -296,13 +298,13 @@ The following versions of Microsoft SQL Server are supported for MED-V 1.0 SP1 w
 
-
+
-
+
@@ -310,16 +312,16 @@ The following versions of Microsoft SQL Server are supported for MED-V 1.0 SP1 w
 
    
 

 
 
    SQL Server 2005
    SQL Server 2005
    		
 
    Express, Standard, or Enterprise Edition
    		
 
    SP2
    		
 
    X86 or x64
    		
 
    
 
    SQL Server 2008
    SQL Server 2008
    		
 
    Express, Standard, or Enterprise
    		
 
    None
    		
 
    X86 or x64
    
 
    
 
- 
+
 
 **Microsoft Hyper-V Server**
 
 The MED-V server is supported in a Microsoft Hyper-V server environment.
 
-## MED-V 1.0 SP1 Globalization Information
+## MED-V 1.0 SP1 Globalization Information
 
 
-Although MED-V is not released in languages other than English, the following Windows operating system language versions are supported for the MED-V 1.0 SP1 client, workspace, and server installations:
+Although MED-V is not released in languages other than English, the following Windows operating system language versions are supported for the MED-V 1.0 SP1 client, workspace, and server installations:
 
 -   English
 
@@ -337,9 +339,9 @@ Although MED-V is not released in languages other than English, the following Wi
 
 -   Japanese
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md b/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md
index c8e7a5f31a..2ae432d713 100644
--- a/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md
+++ b/mdop/medv-v1/med-v-10-sp1-upgrade-checklistmedv-10-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V 1.0 SP1 Upgrade Checklist
 description: MED-V 1.0 SP1 Upgrade Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 1a462b37-8c7a-4826-9175-0b1b701d345b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -42,16 +45,16 @@ To upgrade Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 to MED-V 1.
 **Note**  
 If the server configuration has been changed from the default, the files might be stored in a different location.
 
- 
+ 
 
 ## Client Upgrade
 
 
 To upgrade the MED-V 1.0 client to MED-V 1.0 SP1, install the .msp file on a MED-V 1.0 client. The client and MED-V are automatically upgraded.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md b/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md
index 8c52db133b..0ad376e710 100644
--- a/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md
+++ b/mdop/medv-v1/med-v-10-supported-configurationsmedv-10.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V 1.0 Supported Configurations
 description: MED-V 1.0 Supported Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: 74643de6-549e-4177-a559-6407e156ed3a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -14,14 +17,14 @@ ms.date: 06/16/2016
 # MED-V 1.0 Supported Configurations
 
 
-This topic specifies the requirements necessary to install and run Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 in your environment.
+This topic specifies the requirements necessary to install and run Microsoft Enterprise Desktop Virtualization (MED-V) 1.0 in your environment.
 
-## MED-V 1.0 Client System Requirements
+## MED-V 1.0 Client System Requirements
 
 
 ### MED-V Client Operating System Requirements
 
-The following table lists the operating systems that are supported for MED-V 1.0 client installation.
+The following table lists the operating systems that are supported for MED-V 1.0 client installation.
 
 @@ -40,13 +43,13 @@ The following table lists the operating systems that are supported for MED-V 1.
 
-
+
-
+
@@ -54,28 +57,28 @@ The following table lists the operating systems that are supported for MED-V 1.
 
    
 

 
 
    Windows XP
    Windows XP
    		
 
    Professional Edition
    		
 
    SP2 or SP3
    		
 
    x86
    		
 
    
 
    Windows Vista
    Windows Vista
    		
 
    Business, Enterprise, or Ultimate Edition
    		
 
    SP1 or SP2
    		
 
    x86
    
 
    
 
- 
 
-**Note**  
+
+**Note**  
 MED-V client does not run in native x64 mode. Instead, MED-V runs in Windows on Windows 64-bit (WOW64) mode on 64-bit computers.
 
- 
 
-### MED-V 1.0 Client Configuration
+
+### MED-V 1.0 Client Configuration
 
 **.NET Framework Version**
 
-The following versions of the Microsoft .NET Framework are supported for MED-V 1.0 client installation:
+The following versions of the Microsoft .NET Framework are supported for MED-V 1.0 client installation:
 
--   .NET Framework 2.0 or .NET Framework 2.0 SP1
+-   .NET Framework 2.0 or .NET Framework 2.0 SP1
 
--   .NET Framework 3.0 or .NET Framework 3.0 SP1
+-   .NET Framework 3.0 or .NET Framework 3.0 SP1
 
--   .NET Framework 3.5 or .NET Framework 3.5 SP1
+-   .NET Framework 3.5 or .NET Framework 3.5 SP1
 
 **Virtualization Engine**
 
-Microsoft Virtual PC 2007 SP1 with the hotfix that is described in Microsoft Knowledge Base article 974918 is supported for MED-V 1.0 client installation in the following configurations:
+Microsoft Virtual PC 2007 SP1 with the hotfix that is described in Microsoft Knowledge Base article 974918 is supported for MED-V 1.0 client installation in the following configurations:
 
 -   Static Virtual Hard Disk (VHD) file
 
@@ -85,18 +88,18 @@ Microsoft Virtual PC 2007 SP1 with the hotfix that is described in Microsoft Kn
 
 **Internet Browser**
 
-Windows Internet Explorer 7 and Windows Internet Explorer 8 are supported for MED-V 1.0 client installation.
+Windows Internet Explorer 7 and Windows Internet Explorer 8 are supported for MED-V 1.0 client installation.
 
 **Microsoft Hyper-V Server**
 
 The MED-V client is not supported in a Microsoft Hyper-V server environment.
 
-## MED-V 1.0 Workspace System Requirements
+## MED-V 1.0 Workspace System Requirements
 
 
 ### MED-V Workspace Operating System Requirements
 
-The following table lists the operating systems supported for MED-V 1.0 workspaces.
+The following table lists the operating systems supported for MED-V 1.0 workspaces.
 
 @@ -115,60 +118,59 @@ The following table lists the operating systems supported for MED-V 1.0 workspa
 
-
+
-
+
    
 

 
 
    Windows 2000
    Windows 2000
    		
 
    Professional
    		
 
    SP4
    		
 
    X86
    		
 
    
 
    Windows XP
    Windows XP
    		
 
    Professional Edition
    		
 
    SP2 or SP3
    
 
    
-Note  
-
    SP3 is recommended to ensure that the MED-V workspace will be compatible with future versions of MED-V.
    
+Note
    SP3 is recommended to ensure that the MED-V workspace will be compatible with future versions of MED-V.
    
 
    
 
    
- 
+
 
    		
 
    x86
    		
 
    
     
 
    
 
- 
 
-### MED-V 1.0 Workspace Configuration
+
+### MED-V 1.0 Workspace Configuration
 
 **.NET Framework Version**
 
-MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 workspace installation:
+MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 workspace installation:
 
--   .NET Framework 2.0 SP1
+-   .NET Framework 2.0 SP1
 
--   .NET Framework 3.0 SP1
+-   .NET Framework 3.0 SP1
 
--   .NET Framework 3.5 or .NET Framework 3.5 SP1
+-   .NET Framework 3.5 or .NET Framework 3.5 SP1
+
+**Note**  
+.NET Framework 3.5 SP1 is recommended to ensure that the MED-V workspace will be compatible with future versions of MED-V.
 
-**Note**  
-.NET Framework 3.5 SP1 is recommended to ensure that the MED-V workspace will be compatible with future versions of MED-V.
 
- 
 
 **Internet Browser**
 
-Windows Internet Explorer 6 SP2 and Windows Internet Explorer 7 are supported for the MED-V 1.0 workspace installation.
+Windows Internet Explorer 6 SP2 and Windows Internet Explorer 7 are supported for the MED-V 1.0 workspace installation.
 
 ### MED-V Workspace Images
 
-MED-V workspace images must be created by using Virtual PC 2007 SP1.
+MED-V workspace images must be created by using Virtual PC 2007 SP1.
 
-## MED-V 1.0 Server System Requirements
+## MED-V 1.0 Server System Requirements
 
 
-### MED-V 1.0 Server Operating System Requirements
+### MED-V 1.0 Server Operating System Requirements
 
-The following table lists the operating systems supported for MED-V 1.0 server installations.
+The following table lists the operating systems supported for MED-V 1.0 server installations.
 
 @@ -187,7 +189,7 @@ The following table lists the operating systems supported for MED-V 1.0 server
 
-
+
@@ -195,23 +197,23 @@ The following table lists the operating systems supported for MED-V 1.0 server
 
    
 

 
 
    Windows Server 2008
    Windows Server 2008
    		
 
    Standard or Enterprise
    		
 
    None
    		
 
    X86 or x64
    
 
    
 
- 
 
-### MED-V 1.0 Server Configuration
+
+### MED-V 1.0 Server Configuration
 
 **.NET Framework Version**
 
-MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 workspace installation:
+MED-V requires one of the following supported versions of the Microsoft .NET Framework for MED-V 1.0 workspace installation:
 
--   .NET Framework 2.0 or .NET Framework 2.0 SP1
+-   .NET Framework 2.0 or .NET Framework 2.0 SP1
 
--   .NET Framework 3.0 or .NET Framework 3.0 SP1
+-   .NET Framework 3.0 or .NET Framework 3.0 SP1
 
--   .NET Framework 3.5 or .NET Framework 3.5 SP1
+-   .NET Framework 3.5 or .NET Framework 3.5 SP1
 
 **Microsoft SQL Server Version**
 
-The following versions of Microsoft SQL Server are supported for MED-V 1.0 when SQL Server is installed locally or remotely from the MED-V 1.0 Server:
+The following versions of Microsoft SQL Server are supported for MED-V 1.0 when SQL Server is installed locally or remotely from the MED-V 1.0 Server:
 
 @@ -230,13 +232,13 @@ The following versions of Microsoft SQL Server are supported for MED-V 1.0 when
 
-
+
-
+
@@ -244,16 +246,16 @@ The following versions of Microsoft SQL Server are supported for MED-V 1.0 when
 
    
 

 
 
    SQL Server 2005
    SQL Server 2005
    		
 
    Express, Standard, or Enterprise Edition
    		
 
    SP2
    		
 
    X86 or x64
    		
 
    
 
    SQL Server 2008
    SQL Server 2008
    		
 
    Express, Standard, or Enterprise
    		
 
    None
    		
 
    X86 or x64
    
 
    
 
- 
+
 
 **Microsoft Hyper-V Server**
 
 The MED-V server is supported in a Microsoft Hyper-V server environment.
 
-## MED-V 1.0 Globalization Information
+## MED-V 1.0 Globalization Information
 
 
-Although MED-V is not released in languages other than English, the following Windows operating system language versions are supported for the MED-V 1.0 client, workspace, and server installations:
+Although MED-V is not released in languages other than English, the following Windows operating system language versions are supported for the MED-V 1.0 client, workspace, and server installations:
 
 -   English
 
@@ -267,9 +269,9 @@ Although MED-V is not released in languages other than English, the following Wi
 
 -   Portuguese (Brazil)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v1/med-v-client-operations.md b/mdop/medv-v1/med-v-client-operations.md
index a273c3227e..e295ac9750 100644
--- a/mdop/medv-v1/med-v-client-operations.md
+++ b/mdop/medv-v1/med-v-client-operations.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V Client Operations
 description: MED-V Client Operations
-author: jamiejdt
+author: dansimp
 ms.assetid: 4a5fffd2-f3f4-4e86-8529-e1386ba46c9a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/med-v-client-toolsv2.md b/mdop/medv-v1/med-v-client-toolsv2.md
index 08db32cc7b..a49324c8b9 100644
--- a/mdop/medv-v1/med-v-client-toolsv2.md
+++ b/mdop/medv-v1/med-v-client-toolsv2.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V Client Tools
 description: MED-V Client Tools
-author: jamiejdt
+author: dansimp
 ms.assetid: ea18d82e-2433-4754-85ac-6eac84bcbb01
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,7 +33,7 @@ The File Transfer Tool can be used to copy files or folders from the MED-V works
 **Note**  
 The File Transfer Tool is enabled only when the MED-V workspace is running.
 
- 
+ 
 
 **To copy files or folders from a MED-V workspace that is currently running**
 
@@ -98,9 +101,9 @@ The following functions can be performed using the diagnostic tool:
 
 -   Browse image store—View all available MED-V workspace images.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/med-v-deployment-and-configuration.md b/mdop/medv-v1/med-v-deployment-and-configuration.md
index 048966f72d..38648cf7f4 100644
--- a/mdop/medv-v1/med-v-deployment-and-configuration.md
+++ b/mdop/medv-v1/med-v-deployment-and-configuration.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V Deployment and Configuration
 description: MED-V Deployment and Configuration
-author: jamiejdt
+author: dansimp
 ms.assetid: 3a224c78-58b0-454c-ad6d-5ce87fbb2526
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/med-v-infrastructure-planning-and-design.md b/mdop/medv-v1/med-v-infrastructure-planning-and-design.md
index 6bd69ab76e..a0654e7a12 100644
--- a/mdop/medv-v1/med-v-infrastructure-planning-and-design.md
+++ b/mdop/medv-v1/med-v-infrastructure-planning-and-design.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V Infrastructure Planning and Design
 description: MED-V Infrastructure Planning and Design
-author: jamiejdt
+author: dansimp
 ms.assetid: 6129b8f6-4b20-4403-8edd-68b007791139
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/med-v-installation-prerequisites.md b/mdop/medv-v1/med-v-installation-prerequisites.md
index c359eb4f66..08db5ec442 100644
--- a/mdop/medv-v1/med-v-installation-prerequisites.md
+++ b/mdop/medv-v1/med-v-installation-prerequisites.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V Installation Prerequisites
 description: MED-V Installation Prerequisites
-author: jamiejdt
+author: dansimp
 ms.assetid: cf3c0906-23eb-4c4a-8951-a65741720f95
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -91,7 +94,7 @@ To prevent antivirus activity from affecting the performance of the virtual desk
 **Important**  
 If Virtual PC for Windows exists on the host computer, uninstall it before installing Virtual PC 2007 SP1.
 
- 
+ 
 
 **To install Microsoft Virtual PC 2007 SP1**
 
@@ -106,16 +109,16 @@ If Virtual PC for Windows exists on the host computer, uninstall it before insta
     **Note**  
     The Virtual PC 2007 SP1 update is required for running Virtual PC 2007 SP1.
 
-     
+     
 
 ## Related topics
 
 
 [Supported Configurations](supported-configurationsmedv-orientation.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/med-v-operations.md b/mdop/medv-v1/med-v-operations.md
index 91bd79d67f..c76249664e 100644
--- a/mdop/medv-v1/med-v-operations.md
+++ b/mdop/medv-v1/med-v-operations.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V Operations
 description: MED-V Operations
-author: jamiejdt
+author: dansimp
 ms.assetid: ce362dc0-47a4-4e66-af64-66734fa50c08
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/med-v-reporting.md b/mdop/medv-v1/med-v-reporting.md
index 4a4e104c25..17674e3619 100644
--- a/mdop/medv-v1/med-v-reporting.md
+++ b/mdop/medv-v1/med-v-reporting.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V Reporting
 description: MED-V Reporting
-author: jamiejdt
+author: dansimp
 ms.assetid: b379153b-be89-4a76-a284-2bb4591c3490
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md b/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md
index ecd55cf23c..1aaecaa5a4 100644
--- a/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md
+++ b/mdop/medv-v1/med-v-trim-transfer-technology-medvv2.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V Trim Transfer Technology
 description: MED-V Trim Transfer Technology
-author: jamiejdt
+author: dansimp
 ms.assetid: 2744e855-a486-4028-9606-f0084794ec65
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -29,7 +32,7 @@ You can configure which folders are indexed on the host as part of the Trim Tran
 
 When applying new settings, the service must be restarted.
 
-``` syntax
+```xml
  
 - 
 %WINDIR% 
diff --git a/mdop/medv-v1/overview-of-med-v.md b/mdop/medv-v1/overview-of-med-v.md
index e612667e99..0d46bf93a7 100644
--- a/mdop/medv-v1/overview-of-med-v.md
+++ b/mdop/medv-v1/overview-of-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Overview of MED-V
 description: Overview of MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 32a85b79-91b0-4507-a57a-01ff0fa029f5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/supported-configurationsmedv-orientation.md b/mdop/medv-v1/supported-configurationsmedv-orientation.md
index e9be1c8b18..c66ad41ec2 100644
--- a/mdop/medv-v1/supported-configurationsmedv-orientation.md
+++ b/mdop/medv-v1/supported-configurationsmedv-orientation.md
@@ -1,12 +1,15 @@
 ---
 title: Supported Configurations
 description: Supported Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: c1438455-445a-4bc8-ae20-483b26181f6f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/technical-referencemedv-10-sp1.md b/mdop/medv-v1/technical-referencemedv-10-sp1.md
index c7bf73e776..77b1fc1045 100644
--- a/mdop/medv-v1/technical-referencemedv-10-sp1.md
+++ b/mdop/medv-v1/technical-referencemedv-10-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: Technical Reference
 description: Technical Reference
-author: jamiejdt
+author: dansimp
 ms.assetid: 387462c7-bb46-40b8-b4cf-ee9453972582
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/troubleshooting-med-v.md b/mdop/medv-v1/troubleshooting-med-v.md
index bc669d94a4..52b110ec3b 100644
--- a/mdop/medv-v1/troubleshooting-med-v.md
+++ b/mdop/medv-v1/troubleshooting-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting MED-V
 description: Troubleshooting MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: f43dae36-6485-4e06-9c66-0a646e27079d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v1/updating-a-med-v-workspace-image.md b/mdop/medv-v1/updating-a-med-v-workspace-image.md
index 4dba9fdb77..c030f2922c 100644
--- a/mdop/medv-v1/updating-a-med-v-workspace-image.md
+++ b/mdop/medv-v1/updating-a-med-v-workspace-image.md
@@ -1,12 +1,15 @@
 ---
 title: Updating a MED-V Workspace Image
 description: Updating a MED-V Workspace Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 1b9c4a73-3487-43d2-98e3-43dbc79e10e3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -64,7 +67,7 @@ An image can be updated in one of the following ways:
     **Note**  
     If you name the image a different name than the existing version, a new image will be created rather than a new version of the existing image.
 
-     
+     
 
 6.  Upload the new version to the server, push it to the image pre-stage folder, or distribute it via a deployment package.
 
@@ -79,9 +82,9 @@ An image can be updated in one of the following ways:
 
 [How to Configure the Image Web Distribution Server](how-to-configure-the-image-web-distribution-server.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v1/using-the-med-v-management-console-user-interface.md b/mdop/medv-v1/using-the-med-v-management-console-user-interface.md
index acc9a83419..58bf527214 100644
--- a/mdop/medv-v1/using-the-med-v-management-console-user-interface.md
+++ b/mdop/medv-v1/using-the-med-v-management-console-user-interface.md
@@ -1,12 +1,15 @@
 ---
 title: Using the MED-V Management Console User Interface
 description: Using the MED-V Management Console User Interface
-author: jamiejdt
+author: dansimp
 ms.assetid: f42714d7-6f0c-4995-ab31-d4ef0845a22c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -42,7 +45,7 @@ The console user interface is divided into the following sections:
 **Note**  
 For security reasons, the first user to log in to the MED-V management console will become the only user on that computer allowed to access the management console.
 
- 
+ 
 
 **To log in**
 
@@ -53,7 +56,7 @@ For security reasons, the first user to log in to the MED-V management console w
     **Note**  
     When configuring the server, users with full access as well as users with read-only access are defined. All users must be domain users. The domain user name and password is used for MED-V management login.
 
-     
+     
 
 2.  Click **OK**.
 
@@ -64,9 +67,9 @@ For security reasons, the first user to log in to the MED-V management console w
 
 [How to Install MED-V Client and MED-V Management Console](how-to-install-med-v-client-and-med-v-management-console.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/about-med-v-20.md b/mdop/medv-v2/about-med-v-20.md
index 3be9b15400..dd2c32be10 100644
--- a/mdop/medv-v2/about-med-v-20.md
+++ b/mdop/medv-v2/about-med-v-20.md
@@ -1,12 +1,15 @@
 ---
 title: About MED-V 2.0
 description: About MED-V 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 7ec53f2c-db6e-4a6b-a069-99d0c25cd101
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/authentication-of-med-v-end-users.md b/mdop/medv-v2/authentication-of-med-v-end-users.md
index 328c317940..843a257c5b 100644
--- a/mdop/medv-v2/authentication-of-med-v-end-users.md
+++ b/mdop/medv-v2/authentication-of-med-v-end-users.md
@@ -1,12 +1,15 @@
 ---
 title: Authentication of MED-V End Users
 description: Authentication of MED-V End Users
-author: jamiejdt
+author: dansimp
 ms.assetid: aaf96eb6-91d1-4f4d-9854-5fc73c7ae7ab
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -49,10 +52,10 @@ Following is the policy path for the Terminal Services policy named DisablePassw
 
 HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Virtual Machine\\Policies\\DisablePasswordSaving
 
-**Note**  
+**Note**  
 The changes that you make to DisablePasswordSaving only affect the RDP prompt to a virtual machine.
 
- 
+
 
 The following table lists the different ways you can configure your settings for credential storing and the effects of the different configurations:
 
@@ -81,35 +84,33 @@ The following table lists the different ways you can configure your settings for
 
    
 
    If the end user does not select the check box, the Remote Desktop Connection (RDC) Client prompt is presented instead of the MED-V prompt, and the check box to accept is cleared. If the end user selects the check box, the RDC Client credential is stored for later use.
    
 
    
-Important  
-
    RDC does not validate credentials when the end user enters them. If the end user caches the credentials through the RDC prompt, there is a risk that incorrect credentials might be stored. In this case, the incorrect credentials must be deleted in the Windows Credential Manager.
    
+Important
    RDC does not validate credentials when the end user enters them. If the end user caches the credentials through the RDC prompt, there is a risk that incorrect credentials might be stored. In this case, the incorrect credentials must be deleted in the Windows Credential Manager.
    
 
    
 
    
- 
+
 
    
 
 
 
    DisablePasswordSaving
    
 
    Enabled
    
 
    
-Note  
-
    This configuration is more secure because it does not allow end user credentials to be cached.
    
+Note
    This configuration is more secure because it does not allow end user credentials to be cached.
    
 
    
 
    
- 
+
 
    
 
 
 
 
- 
+
 
 By default, the MED-V installation sets a registry key in the guest to suppress the "password about to expire" prompt. The end user is only prompted for a password change on the host. Credentials that are updated on the host are passed to the guest.
 
-**Caution**  
+**Caution**  
 If you use Group Policy in your environment, know that it can override the registry key causing the password prompts from the guest to reappear.
 
- 
+
 
 ### Security Concerns with Authentication
 
@@ -124,9 +125,9 @@ This same concern exists when MED-V authentication is disabled but the Terminal
 
 [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v2/command-line-options-for-med-v-installation-files.md b/mdop/medv-v2/command-line-options-for-med-v-installation-files.md
index 456e6f5efd..f6e9a21158 100644
--- a/mdop/medv-v2/command-line-options-for-med-v-installation-files.md
+++ b/mdop/medv-v2/command-line-options-for-med-v-installation-files.md
@@ -1,12 +1,15 @@
 ---
 title: Command-Line Options for MED-V Installation Files
 description: Command-Line Options for MED-V Installation Files
-author: jamiejdt
+author: dansimp
 ms.assetid: 7b8cd3e4-1d09-44a0-b690-f85b0d0a6b02
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md b/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md
index 69c3252f99..66fc177330 100644
--- a/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md
+++ b/mdop/medv-v2/compacting-the-med-v-virtual-hard-disk.md
@@ -1,12 +1,15 @@
 ---
 title: Compacting the MED-V Virtual Hard Disk
 description: Compacting the MED-V Virtual Hard Disk
-author: jamiejdt
+author: dansimp
 ms.assetid: 5e6122d1-9847-4b33-adab-594919eec3c5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Although it is optional, you can compact the virtual hard disk (VHD) to reclaim
 **Important**  
 Before you proceed, create a backup copy of your Windows XP image.
 
- 
+ 
 
 **Preparing the Virtual Hard Disk**
 
@@ -110,9 +113,9 @@ Create a backup copy of your compacted virtual hard disk.
 
 [Technical Reference for MED-V](technical-reference-for-med-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/configure-environment-prerequisites.md b/mdop/medv-v2/configure-environment-prerequisites.md
index 655bc88c78..061ec06592 100644
--- a/mdop/medv-v2/configure-environment-prerequisites.md
+++ b/mdop/medv-v2/configure-environment-prerequisites.md
@@ -1,12 +1,15 @@
 ---
 title: Configure Environment Prerequisites
 description: Configure Environment Prerequisites
-author: jamiejdt
+author: dansimp
 ms.assetid: 7379e8e5-1cb2-4b8e-8acc-5c04e26f8c91
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -31,12 +34,12 @@ The MED-V Host and Guest agents and the MED-V Workspace Packager require the Mic
 **Important**  
 You must also install the update [KB959209](https://go.microsoft.com/fwlink/?LinkId=204950) (https://go.microsoft.com/fwlink/?LinkId=204950), which addresses several known application compatibility issues.
 
- 
+ 
 
 **Note**  
 You must manually install the .NET Framework 3.5 SP1 and the update KB959209 into the Windows Virtual PC image that you prepare for use with MED-V. However, by default, the Microsoft .NET Framework 3.5 SP1 and the update are included when you install Windows 7 on the host computer.
 
- 
+ 
 
 **An Active Directory Infrastructure**
 
@@ -51,9 +54,9 @@ Group Policy provides the centralized management and configuration of operating
 
 [MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/configure-installation-prerequisites.md b/mdop/medv-v2/configure-installation-prerequisites.md
index f52d72ab06..efb17dc81e 100644
--- a/mdop/medv-v2/configure-installation-prerequisites.md
+++ b/mdop/medv-v2/configure-installation-prerequisites.md
@@ -1,12 +1,15 @@
 ---
 title: Configure Installation Prerequisites
 description: Configure Installation Prerequisites
-author: jamiejdt
+author: dansimp
 ms.assetid: ff9cf28a-3eac-4b6c-8ce9-bfc202f57947
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -28,7 +31,7 @@ The following instructions are prerequisites for installing and using Microsoft
 **Important**  
 If a version of Virtual PC for Windows already exists on the host computer, you must uninstall it before you install Windows Virtual PC.
 
- 
+ 
 
 **To install Windows Virtual PC**
 
@@ -39,7 +42,7 @@ If a version of Virtual PC for Windows already exists on the host computer, you
 **Important**  
 Windows Virtual PC includes the Integration Components package, which provides features that improve the interaction between the virtual environment and the physical computer. For example, it lets your mouse move between the host and the guest computers. MED-V requires the installation of the Integration Components package.
 
- 
+ 
 
 ## How to Install and Configure the Windows Virtual PC Update
 
@@ -49,12 +52,12 @@ The Microsoft update associated with article KB977206 enables Windows XP Mode fo
 **Important**  
 You do not have to install this update when you are installing MED-V on host computers that are running Windows 7 with Service Pack 1.
 
- 
+ 
 
 **Tip**  
 In addition to the update listed here, we recommend that you review all available Windows Virtual PC updates and apply those updates that are appropriate or necessary for your environment.
 
- 
+ 
 
 **To install the Windows Virtual PC Update**
 
@@ -90,9 +93,9 @@ To prevent antivirus activity from affecting the performance of the virtual desk
 
 [MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md b/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md
index 6ad4dde0d7..93373c0249 100644
--- a/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md
+++ b/mdop/medv-v2/configuring-a-windows-virtual-pc-image-for-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring a Windows Virtual PC Image for MED-V
 description: Configuring a Windows Virtual PC Image for MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: d87a0df8-9e08-4d1e-bfb0-9dc3cebf0d28
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 11/01/2016
 ---
 
@@ -20,35 +23,35 @@ First time setup prepares the MED-V workspace for an end user. The process creat
 
 Follow these steps to configure your MED-V image for running first time setup:
 
-1.  As an option, you can compact the virtual hard disk (VHD) to reclaim empty disk space and reduce the size of the VHD before you continue with configuring the Windows Virtual PC image. For more information, see [Compacting the MED-V Virtual Hard Disk](compacting-the-med-v-virtual-hard-disk.md).
+1. As an option, you can compact the virtual hard disk (VHD) to reclaim empty disk space and reduce the size of the VHD before you continue with configuring the Windows Virtual PC image. For more information, see [Compacting the MED-V Virtual Hard Disk](compacting-the-med-v-virtual-hard-disk.md).
 
-2.  Customize the virtual machine setup process.
+2. Customize the virtual machine setup process.
 
-3.  Seal the MED-V image by using Sysprep.
+3. Seal the MED-V image by using Sysprep.
 
- **Customizing the Virtual Machine Setup Process**
+   **Customizing the Virtual Machine Setup Process**
 
-1.  As part of preparing your image for use with MED-V, you can configure various settings on the virtual machine, such as specifying the settings for running Windows Update. Specify all the necessary virtual machine settings before you create the MED-V workspace package.
+4. As part of preparing your image for use with MED-V, you can configure various settings on the virtual machine, such as specifying the settings for running Windows Update. Specify all the necessary virtual machine settings before you create the MED-V workspace package.
 
-2.  Before you create the MED-V workspace package, we recommend that you disable restore points on the virtual machine to prevent the differencing disk from growing unbounded. For more information, see [How to turn off and turn on System Restore in Windows XP](https://go.microsoft.com/fwlink/?LinkId=195927) (https://go.microsoft.com/fwlink/?LinkId=195927).
+5. Before you create the MED-V workspace package, we recommend that you disable restore points on the virtual machine to prevent the differencing disk from growing unbounded. For more information, see [How to turn off and turn on System Restore in Windows XP](https://go.microsoft.com/fwlink/?LinkId=195927) (https://go.microsoft.com/fwlink/?LinkId=195927).
 
-    **Note**  
-    You can set up your Sysprep.inf file to disable restore points when first time setup is run. For an example of setting this GuiRunOnce key, see the sample Sysprep.inf file later in this section.
+   **Note**  
+   You can set up your Sysprep.inf file to disable restore points when first time setup is run. For an example of setting this GuiRunOnce key, see the sample Sysprep.inf file later in this section.
 
-     
 
-3.  Configure the setup process to run Mini-Setup instead of the default Windows Welcome. You must either run the Sysprep tool by using the **-mini** switch, or select the **MiniSetup** check box in the graphical user interface. For more information, see [How to Seal the Image with Sysprep](#bkmk-seal).
 
-    **Calling the First time setup Completion File**
+6. Configure the setup process to run Mini-Setup instead of the default Windows Welcome. You must either run the Sysprep tool by using the **-mini** switch, or select the **MiniSetup** check box in the graphical user interface. For more information, see [How to Seal the Image with Sysprep](#bkmk-seal).
 
-    1.  An executable called FtsCompletion.exe is included as part of the installation of the MED-V Guest Agent. By default, it is located in the system drive of your MED-V image under **Program Files – Microsoft Enterprise Desktop Virtualization**.
+   **Calling the First time setup Completion File**
 
-        **Important**  
-        As the final step in the first time setup process, you must run this executable program. The user for whom the executable program is being called must be a member of the guest’s local administrator group.
+   1.  An executable called FtsCompletion.exe is included as part of the installation of the MED-V Guest Agent. By default, it is located in the system drive of your MED-V image under **Program Files – Microsoft Enterprise Desktop Virtualization**.
 
-         
+       **Important**  
+       As the final step in the first time setup process, you must run this executable program. The user for whom the executable program is being called must be a member of the guest’s local administrator group.
 
-    2.  You can decide how you want to call this executable program, for example, through a script that is deployed with the MED-V workspace. You can call this executable as the last line of your Sysprep.inf file. For an example of how to call this executable program in your Sysprep.inf file, see the sample file later in this section.
+
+
+   2.  You can decide how you want to call this executable program, for example, through a script that is deployed with the MED-V workspace. You can call this executable as the last line of your Sysprep.inf file. For an example of how to call this executable program in your Sysprep.inf file, see the sample file later in this section.
 
 After you have completed customization of your MED-V image, you are ready to seal the image by using Sysprep.
 
@@ -58,88 +61,90 @@ After you have completed customization of your MED-V image, you are ready to sea
 
 2.  In a MED-V environment, you can use Sysprep to assign unique security IDs (SID) and other settings to each MED-V workspace the first time that they are started.
 
-    **Note**  
+    **Note**  
     For more information about how to use Sysprep, see [Sysprep Technical Reference](https://go.microsoft.com/fwlink/?LinkId=195930) (https://go.microsoft.com/fwlink/?LinkId=195930).
 
-     
 
-    **Caution**  
-    When you use non-ASCII characters in the Sysprep.inf file, you must save the file by using the encoding appropriate for the characters entered. Windows XP expects the Sysprep.inf file to be encoded by using the code page for the language that you are targeting.
 
-    You must also make sure that the System Locale of the computers to which the MED-V workspace is deployed is set to handle the language specific characters that might be present in the Sysprep.inf file. To change the settings for the System Locale, follow these steps:
+~~~
+**Caution**  
+When you use non-ASCII characters in the Sysprep.inf file, you must save the file by using the encoding appropriate for the characters entered. Windows XP expects the Sysprep.inf file to be encoded by using the code page for the language that you are targeting.
 
-    1.  To open Region and Language, click **Start**, click **Control Panel**, and then click **Region and Language**.
+You must also make sure that the System Locale of the computers to which the MED-V workspace is deployed is set to handle the language specific characters that might be present in the Sysprep.inf file. To change the settings for the System Locale, follow these steps:
 
-    2.  Click the **Administrative** tab, and then click **Change System Locale** under **Language for non-Unicode programs**.
+1.  To open Region and Language, click **Start**, click **Control Panel**, and then click **Region and Language**.
 
-        If you are prompted for an administrator password or confirmation, type the administrator password or provide confirmation.
+2.  Click the **Administrative** tab, and then click **Change System Locale** under **Language for non-Unicode programs**.
 
-    3.  Select your preferred language and then click **OK**.
+    If you are prompted for an administrator password or confirmation, type the administrator password or provide confirmation.
 
-     
+3.  Select your preferred language and then click **OK**.
 
-    **To configure Sysprep on the MED-V Guest Computer**
 
-    1.  Create a folder named *Sysprep* in the root of the MED-V image system drive.
 
-    2.  Download the deploy.cab file. For more information, see [Windows XP Service Pack 3 Deployment Tools](https://go.microsoft.com/fwlink/?LinkId=195928) From the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=195928).
+**To configure Sysprep on the MED-V Guest Computer**
 
-    3.  From the deploy.cab file, copy or extract the Setupmgr.exe, Sysprep.exe, and Setupcl.exe files to the Sysprep folder.
+1.  Create a folder named *Sysprep* in the root of the MED-V image system drive.
 
-    4.  In the Sysprep folder, run **Setup Manager** (Setupmgr.exe) to create a Sysprep.inf answer file.
+2.  Download the deploy.cab file. For more information, see [Windows XP Service Pack 3 Deployment Tools](https://go.microsoft.com/fwlink/?LinkId=195928) From the Microsoft Download Center (https://go.microsoft.com/fwlink/?LinkId=195928).
 
-        Or, you can create this file manually or use your company’s existing file. For more information, see [How to use the Sysprep tool to automate successful deployment of Windows XP](https://go.microsoft.com/fwlink/?LinkId=195929) (https://go.microsoft.com/fwlink/?LinkId=195929).
+3.  From the deploy.cab file, copy or extract the Setupmgr.exe, Sysprep.exe, and Setupcl.exe files to the Sysprep folder.
 
-    5.  Follow the **Setup Manager** wizard.
+4.  In the Sysprep folder, run **Setup Manager** (Setupmgr.exe) to create a Sysprep.inf answer file.
 
-        **Important**  
-        You must configure the MED-V guest to join a domain that lets users log on by using the credentials that they use to log on to the MED-V host.
+    Or, you can create this file manually or use your company’s existing file. For more information, see [How to use the Sysprep tool to automate successful deployment of Windows XP](https://go.microsoft.com/fwlink/?LinkId=195929) (https://go.microsoft.com/fwlink/?LinkId=195929).
 
-         
+5.  Follow the **Setup Manager** wizard.
 
-        **Caution**  
-        When you configure a proxy account for joining virtual machines to the domain, know that it is possible for an end user to obtain the proxy account credentials. Take all the necessary security precautions to minimize risk, such as limiting account user rights. For more information about security concerns when you configure a Windows Virtual PC image for MED-V, see [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md).
+    **Important**  
+    You must configure the MED-V guest to join a domain that lets users log on by using the credentials that they use to log on to the MED-V host.
 
-         
 
-        If end users must provide information during the first time setup process based on the parameters specified in the Sysprep.inf file, you must also specify that first time setup is run in **Attended** mode when you are creating your MED-V workspace package. If no information will be required from the end user, you can specify that first time setup is run in **Unattended** mode when you are creating your MED-V workspace package. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md).
 
-        Although you can specify any settings that you prefer, a MED-V best practice is that you create the Sysprep.inf file so that first time setup can be run in **Unattended** mode. This requires that you provide all of the required settings information as you continue through the **Setup Manager** wizard.
+    **Caution**  
+    When you configure a proxy account for joining virtual machines to the domain, know that it is possible for an end user to obtain the proxy account credentials. Take all the necessary security precautions to minimize risk, such as limiting account user rights. For more information about security concerns when you configure a Windows Virtual PC image for MED-V, see [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md).
 
-        **Caution**  
-        If you have set a local policy or registry entry to include a service level agreement (SLA) in your image (VHD), you must specify that first time setup is run in **Attended** mode or first time setup will fail. Or, a MED-V best practice is to enforce the SLA through Group Policy later so that the SLA is displayed to the end user after first time setup is finished.
 
-         
 
-        **Note**  
-        You can configure the MED-V workspace to set certain Sysprep.inf settings based on the configuration of the host and the identity of the end user. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md).
+    If end users must provide information during the first time setup process based on the parameters specified in the Sysprep.inf file, you must also specify that first time setup is run in **Attended** mode when you are creating your MED-V workspace package. If no information will be required from the end user, you can specify that first time setup is run in **Unattended** mode when you are creating your MED-V workspace package. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md).
 
-         
+    Although you can specify any settings that you prefer, a MED-V best practice is that you create the Sysprep.inf file so that first time setup can be run in **Unattended** mode. This requires that you provide all of the required settings information as you continue through the **Setup Manager** wizard.
 
-    6.  Seal the MED-V image.
+    **Caution**  
+    If you have set a local policy or registry entry to include a service level agreement (SLA) in your image (VHD), you must specify that first time setup is run in **Attended** mode or first time setup will fail. Or, a MED-V best practice is to enforce the SLA through Group Policy later so that the SLA is displayed to the end user after first time setup is finished.
 
-        **Important**  
-        We recommend that you make a backup copy of the MED-V image before sealing it.
 
-         
 
-        After you have completed all the steps in the **Setup Manager** wizard, you are ready to run Sysprep to seal the MED-V image.
+    **Note**  
+    You can configure the MED-V workspace to set certain Sysprep.inf settings based on the configuration of the host and the identity of the end user. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md).
 
-    **To run Sysprep**
 
-    1.  Run the System Preparation Tool (Sysprep.exe) from the *Sysprep* folder that you created when you configured Sysprep in the MED-V virtual machine.
 
-    2.  In the warning message box that appears, click **OK**.
+6.  Seal the MED-V image.
 
-    3.  In the **Options** dialog box, select the **Don't reset grace period for activation** and **Use Mini-Setup** check boxes. Also, make sure that the **Shutdown mode** box is set to **Shut down**.
+    **Important**  
+    We recommend that you make a backup copy of the MED-V image before sealing it.
 
-    4.  Click **Reseal**. This removes identity information and clears event logs to prepare for first time setup.
 
-    5.  If you are not satisfied with the information listed in the confirmation message box that appears, click **Cancel** and then change the selections.
 
-    6.  Click **OK** to complete the system preparation process.
+    After you have completed all the steps in the **Setup Manager** wizard, you are ready to run Sysprep to seal the MED-V image.
 
-    After you have run Sysprep on your MED-V image, the virtual machine shuts down and is ready for use in creating a MED-V workspace.
+**To run Sysprep**
+
+1.  Run the System Preparation Tool (Sysprep.exe) from the *Sysprep* folder that you created when you configured Sysprep in the MED-V virtual machine.
+
+2.  In the warning message box that appears, click **OK**.
+
+3.  In the **Options** dialog box, select the **Don't reset grace period for activation** and **Use Mini-Setup** check boxes. Also, make sure that the **Shutdown mode** box is set to **Shut down**.
+
+4.  Click **Reseal**. This removes identity information and clears event logs to prepare for first time setup.
+
+5.  If you are not satisfied with the information listed in the confirmation message box that appears, click **Cancel** and then change the selections.
+
+6.  Click **OK** to complete the system preparation process.
+
+After you have run Sysprep on your MED-V image, the virtual machine shuts down and is ready for use in creating a MED-V workspace.
+~~~
 
 ## Example
 
@@ -190,8 +195,8 @@ Here is an example of a Sysprep.inf file.
     Language=00000409
 
 [GuiRunOnce]
-    Command0="wmic /namespace:\\root\default path SystemRestore call Disable %SystemDrive%\"
-    Command1="c:\Program Files\Microsoft Enterprise Desktop Virtualization\FtsCompletion.exe"
+    Command0="wmic /namespace:\\root\default path SystemRestore call Disable %SystemDrive%\"
+    Command1="c:\Program Files\Microsoft Enterprise Desktop Virtualization\FtsCompletion.exe"
 
 [sysprepcleanup]
 ```
@@ -203,9 +208,9 @@ Here is an example of a Sysprep.inf file.
 
 [Prepare a MED-V Image](prepare-a-med-v-image.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md b/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md
index 0de486f473..36f93794e4 100644
--- a/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md
+++ b/mdop/medv-v2/configuring-advanced-settings-by-using-windows-powershell.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring Advanced Settings by Using Windows PowerShell
 description: Configuring Advanced Settings by Using Windows PowerShell
-author: jamiejdt
+author: dansimp
 ms.assetid: 437a31cc-2a11-456f-b448-b0b869fb53f7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -79,7 +82,7 @@ Run Windows PowerShell with administrative credentials, and ensure that the Wind
 
     This command runs the Windows PowerShell script and runs the **New-MedvWorkspace** cmdlet to generate a new MED-V workspace package. The new packager files are saved in the folder that you originally specified for storing your MED-V Workspace Packager files. For additional help about this cmdlet, see the Windows PowerShell Help.
 
- 
+ 
 
 ## Exporting a MED-V Configuration to a Registry File
 
@@ -99,9 +102,9 @@ You can import the resultant registry file from the host computer to a MED-V wor
 
 [Test And Deploy the MED-V Workspace Package](test-and-deploy-the-med-v-workspace-package.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/create-a-med-v-workspace-package.md b/mdop/medv-v2/create-a-med-v-workspace-package.md
index 5957081174..900ad453d6 100644
--- a/mdop/medv-v2/create-a-med-v-workspace-package.md
+++ b/mdop/medv-v2/create-a-med-v-workspace-package.md
@@ -1,12 +1,15 @@
 ---
 title: Create a MED-V Workspace Package
 description: Create a MED-V Workspace Package
-author: jamiejdt
+author: dansimp
 ms.assetid: 3f75fe73-41ac-4389-ae21-5efb2d437f4d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -24,7 +27,7 @@ Use the **MED-V Workspace Packager** to create MED-V workspaces. The **MED-V Wor
 
 -   A **Help Center** on the right-hand side of the window that provides information and guidance to help you create, test, and manage your MED-V workspaces.
 
-**Important**  
+**Important**  
 Before you can use the **MED-V Workspace Packager**, you must first make sure that the Windows PowerShell execution policy is set to Unrestricted.
 
 `Set-ExecutionPolicy Unrestricted`
@@ -45,12 +48,12 @@ If it is necessary, change the SAN policy to "Online All" by typing the followin
 
 `DISKPART> exit`
 
- 
 
-**Important**  
+
+**Important**  
 If automatic disk encryption software is installed on the computer that you use to mount the virtual hard disk and build the MED-V workspace package, you must disable the software before you start. Otherwise, you cannot use the MED-V workspace on any other computer.
 
- 
+
 
 The information we provide here can help you create your MED-V workspace deployment package.
 
@@ -67,32 +70,34 @@ Before you start to build your MED-V workspace deployment package, verify that y
 
     Your URL redirection text file or list contains those URLs that you want redirected from the host computer to Internet Explorer in the MED-V workspace. When you are using the packaging wizard to create your MED-V workspace, you import, type, or copy and paste this redirection information as one of the steps in the package creation process.
 
-    **Note**  
+    **Note**  
     URL redirection in MED-V only supports the protocols HTTP and HTTPS. MED-V does not provide support for FTP or any other protocols.
 
-     
 
-    Enter each web address on a single line, for example:
 
-    http://www.contoso.com/webapps/webapp1
+~~~
+Enter each web address on a single line, for example:
 
-    http://www.contoso.com/webapps/webapp2
+http://www.contoso.com/webapps/webapp1
 
-    http://\*.contoso.com
+http://www.contoso.com/webapps/webapp2
 
-    http://www.contoso.com/webapps/\*
+http://\*.contoso.com
+
+http://www.contoso.com/webapps/\*
+
+**Important**  
+If you import a text file that includes a URL that uses special characters (such as ~ ! @ \# and so on), make sure that you specify UTF-8 encoding when you save the text file. Special characters do not import correctly into the MED-V Workspace Packager if the text file was saved using the default ANSI encoding.
+~~~
 
-    **Important**  
-    If you import a text file that includes a URL that uses special characters (such as ~ ! @ \# and so on), make sure that you specify UTF-8 encoding when you save the text file. Special characters do not import correctly into the MED-V Workspace Packager if the text file was saved using the default ANSI encoding.
 
-     
 
 ## Packaging a MED-V Workspace for a Language Other than the Language of the MED-V Workspace Packager Computer
 
 
 By default, the MED-V workspace supports characters in both the language of the computer and in English. To create a MED-V workspace for a language other than the one installed on the computer, specify **-loc \[locale\]** in the PowerShell script (.ps1) after the MED-V workspace name.
 
-To create a MED-V workspace package in a language other than the default language of the MED-V Workspace Packager computer, generate a script in the default language by running the MED-V Workspace Packager and then modifying the output script as required for your locale. The script is located in the MED-V workspace output directory that was specified during packaging. The names of the locale settings are on the .WXL files in the following directory:
+To create a MED-V workspace package in a language other than the default language of the MED-V Workspace Packager computer, generate a script in the default language by running the MED-V Workspace Packager and then modifying the output script as required for your locale. The script is located in the MED-V workspace output directory that was specified during packaging. The names of the locale settings are on the .WXL files in the following directory:
 
 C:\\Program Files\\Microsoft Enterprise Desktop Virtualization\\WindowsPowerShell\\Modules\\Microsoft.Medv.Administration.Commands.WorkspacePackager\\locale
 
@@ -154,267 +159,283 @@ To create a MED-V workspace package, follow these steps:
     
     
 
-     
+
 
 3.  On the **Package Information** page, enter a name for the MED-V workspace and select a folder where the MED-V workspace package files are saved.
 
-    **Warning**  
+    **Warning**  
     You must name the MED-V workspace and specify a folder to continue.
 
-     
 
-    After you have finished, click **Next**.
 
-4.  On the **Select Windows XP Image** page, specify the location of your prepared MED-V Windows XP Virtual PC image (.vhd file).
+~~~
+After you have finished, click **Next**.
+~~~
 
-    **Warning**  
-    You must specify a Windows XP VHD image to continue.
+4. On the **Select Windows XP Image** page, specify the location of your prepared MED-V Windows XP Virtual PC image (.vhd file).
 
-     
+   **Warning**  
+   You must specify a Windows XP VHD image to continue.
 
-    After you have finished, click **Next**.
 
-5.  On the **First Time Setup** page, select whether you want first time setup to run while attended or unattended and whether you want the MED-V workspace used separately or used by all end users on a shared computer.
 
-    If you select **Unattended setup, without any notification**, the end user is not informed before first time setup is run and the virtual machine is not shown to the end user during first time setup. In addition, the **MED-V Messages** page of the wizard is hidden because no messages are required if first time setup runs in a completely unattended mode.
+~~~
+After you have finished, click **Next**.
+~~~
 
-    If you select **Unattended setup, but notify end users before first time setup begins**, the end user is informed before first time setup is run. However, the virtual machine is not shown to the end user during first time setup.
+5. On the **First Time Setup** page, select whether you want first time setup to run while attended or unattended and whether you want the MED-V workspace used separately or used by all end users on a shared computer.
 
-    Select **Attended setup** if the end user must enter information during first time setup.
+   If you select **Unattended setup, without any notification**, the end user is not informed before first time setup is run and the virtual machine is not shown to the end user during first time setup. In addition, the **MED-V Messages** page of the wizard is hidden because no messages are required if first time setup runs in a completely unattended mode.
 
-    The default behavior is **Unattended setup, but notify end users before first time setup begins**.
+   If you select **Unattended setup, but notify end users before first time setup begins**, the end user is informed before first time setup is run. However, the virtual machine is not shown to the end user during first time setup.
 
-    **Caution**  
-    If you created the Sysprep.inf file so that Mini-Setup requires user input to complete, you must select **Attended setup** or problems might occur during first time setup.
+   Select **Attended setup** if the end user must enter information during first time setup.
 
-     
+   The default behavior is **Unattended setup, but notify end users before first time setup begins**.
 
-    You can also specify how a MED-V workspace is used on computers that are shared by multiple end users. You can decide that you want to create a unique MED-V workspace for each end user or that you want the MED-V workspace made available to all end users who share the computer. The default is that the MED-V workspace is unique for each end user.
+   **Caution**  
+   If you created the Sysprep.inf file so that Mini-Setup requires user input to complete, you must select **Attended setup** or problems might occur during first time setup.
 
-    **Important**  
-    We recommend that you disable the fast user switching feature in Windows if you configure the MED-V workspace to be accessed by all users on a shared computer. Problems can occur if an end user logs on by using the fast user switching feature in Windows when another user is still logged on.
 
-     
 
-    **Tip**  
-    When you create a name mask for the MED-V workspace on the **Naming Computers** page, make sure that each virtual machine on a shared computer has a unique computer name.
+~~~
+You can also specify how a MED-V workspace is used on computers that are shared by multiple end users. You can decide that you want to create a unique MED-V workspace for each end user or that you want the MED-V workspace made available to all end users who share the computer. The default is that the MED-V workspace is unique for each end user.
 
-     
+**Important**  
+We recommend that you disable the fast user switching feature in Windows if you configure the MED-V workspace to be accessed by all users on a shared computer. Problems can occur if an end user logs on by using the fast user switching feature in Windows when another user is still logged on.
 
-    You can also specify whether the MED-V workspace is added to the Administrators group or administrator credentials are managed outside MED-V. By default, the MED-V workspace is not automatically added to the Administrators group.
 
-    After you have finished, click **Next**.
 
-6.  On the **MED-V Messages** page, specify the following messages that the end user sees during first time setup:
+**Tip**  
+When you create a name mask for the MED-V workspace on the **Naming Computers** page, make sure that each virtual machine on a shared computer has a unique computer name.
 
-    -   The message that the end user sees when first time setup starts.
 
-    -   The message that the end user sees if first time setup fails or an error occurs.
 
-    **Note**  
-    The **MED-V Messages** page of the wizard is hidden if you selected **Unattended setup, without any notification** on the **First Time Setup** page.
+You can also specify whether the MED-V workspace is added to the Administrators group or administrator credentials are managed outside MED-V. By default, the MED-V workspace is not automatically added to the Administrators group.
 
-     
+After you have finished, click **Next**.
+~~~
 
-    You can also specify an optional URL location for help information that is provided to the end user when first time setup is running.
+6. On the **MED-V Messages** page, specify the following messages that the end user sees during first time setup:
 
-    For example, the URL can point to an internal IT webpage with answers to questions such as "How long will this take and how will I know when it has completed?" or "What do you do if you get an error message?"
+   -   The message that the end user sees when first time setup starts.
 
-    **Note**  
-    If you specify a URL, a link is shown during first time setup that points the end user to this help information. If you do not specify a URL, no link is provided.
+   -   The message that the end user sees if first time setup fails or an error occurs.
 
-     
+   **Note**  
+   The **MED-V Messages** page of the wizard is hidden if you selected **Unattended setup, without any notification** on the **First Time Setup** page.
 
-    After you have finished, click **Next**.
 
-7.  On the **Naming Computers** page, you can specify whether computer naming is managed by MED-V or by a system management tool, such as Sysprep. The default is that computer naming is managed by a system management tool.
 
-    If you specify that computer naming is managed by MED-V, select a predefined computer naming convention (mask) from the drop-down list. A preview of a sample computer name appears that is based on the computer that you are using to build the MED-V workspace package.
+~~~
+You can also specify an optional URL location for help information that is provided to the end user when first time setup is running.
 
-    If you select one of the custom naming conventions, the fields you can specify are limited to the following characters:
+For example, the URL can point to an internal IT webpage with answers to questions such as "How long will this take and how will I know when it has completed?" or "What do you do if you get an error message?"
 
-    -   The prefix and suffix fields are limited to the characters A-Z, a-z, 0-9, and the special characters ! @ \# $ % ^ & ( ) - \_ ' { } . and ~.
+**Note**  
+If you specify a URL, a link is shown during first time setup that points the end user to this help information. If you do not specify a URL, no link is provided.
 
-    -   The hostname and username fields are limited to the digits 0 through 9.
 
-    **Important**  
-    Computer names must be unique and are limited to a maximum of 15 characters. When you decide on your computer naming method, consider end users who have multiple computers or that share a computer, and avoid using computer name masks that could cause a collision on the network.
 
-     
+After you have finished, click **Next**.
+~~~
 
-    **Caution**  
-    The computer name settings that you specify on this page override those specified in the Sysprep.inf answer file.
+7. On the **Naming Computers** page, you can specify whether computer naming is managed by MED-V or by a system management tool, such as Sysprep. The default is that computer naming is managed by a system management tool.
 
-     
+   If you specify that computer naming is managed by MED-V, select a predefined computer naming convention (mask) from the drop-down list. A preview of a sample computer name appears that is based on the computer that you are using to build the MED-V workspace package.
 
-    After you have finished, click **Next**.
+   If you select one of the custom naming conventions, the fields you can specify are limited to the following characters:
 
-8.  On the **Copy Settings from Host** page, you can select the following settings to specify how the MED-V workspace is configured:
+   -   The prefix and suffix fields are limited to the characters A-Z, a-z, 0-9, and the special characters ! @ \# $ % ^ & ( ) - \_ ' { } . and ~.
 
-    **Caution**  
-    The settings that you specify on this page that are copied from the host computer to the MED-V workspace override those specified in the Sysprep.inf answer file.
+   -   The hostname and username fields are limited to the digits 0 through 9.
 
-     
+   **Important**  
+   Computer names must be unique and are limited to a maximum of 15 characters. When you decide on your computer naming method, consider end users who have multiple computers or that share a computer, and avoid using computer name masks that could cause a collision on the network.
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    Copy regional settings
    Select this check box to copy the regional settings from the host computer to the MED-V workspace.
    If you select this check box, the following settings are set in the Sysprep.inf file:
    
-    
    [RegionalSettings]
-    Language
-    SystemLocale
-    UserLocale
-    UserLocale_DefaultUser
-    InputLocale
-    InputLocale_DefaultUser
-    
    Copy user settings
    Select this check box to copy certain user settings, such as user name and company name, from the host to the MED-V workspace.
    If you select this check box, the following settings are set in the Sysprep.inf file:
    
-    
    [UserData]
-    OrgName
-    FullName
    
-    
    
-    Note  
-    
    Personal settings, such as Internet browsing history, are not copied over to the MED-V workspace.
    
-    
    
-    
    
-     
-    
    Copy domain name
    Select this check box to let the guest join the same domain as the host.
    
-    Important  
-    
    The MED-V guest must be configured to join a domain that lets users log on by using the credentials that they use to log on to the MED-V host.
    
-    
    
-    
    
-     
-    
    Copy domain organizational unit
    Select this check box to copy the domain organizational unit from the host computer to the MED-V workspace. This check box is only enabled if you select to copy the domain name from the host computer.
    
 
-     
 
-    After you have finished, click **Next**.
+~~~
+**Caution**  
+The computer name settings that you specify on this page override those specified in the Sysprep.inf answer file.
 
-9.  On the **Startup and Networking** page, you can change the default behavior for the following settings:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    Start MED-V workspace
    Choose whether to start the MED-V workspace at user logon, at first use, or to let the end user decide when the MED-V workspace starts.
    The MED-V workspace starts in one of two ways: either when the end user logs on or when they first start an action that requires MED-V, such as opening a published application or entering a URL that requires redirection.
    
-    
    You can either define this setting for the end user or let the end user control how MED-V starts.
    
-    
    
-    Note  
-    
    If you specify that the end user decides, the default behavior they experience is that the MED-V workspace starts when they log on. They can change the default by right-clicking the MED-V icon in the notification area and selecting MED-V User Settings. If you define this setting for the end user, they cannot change how MED-V starts.
    
-    
    
-    
    
-     
-    
    Networking
    Select Shared or Bridged for your networking setting. The default is Shared.
    Shared - The MED-V workspace uses Network Address Translation (NAT) to share the host's IP for outgoing traffic.
    
-    
    Bridged - The MED-V workspace has its own network address, typically obtained through DHCP.
    Store credentials
    Choose whether you want to store the end user credentials.
    The default behavior is that credential storing is disabled so that the end user must be authenticated every time that they log on.
    
-    
    
-    Important  
-    
    Even though caching the end user’s credentials provides the best user experience, you should be aware of the risks involved.
    
-    
    The end user’s domain credential is stored in a reversible format in the Windows Credential Manager. As a result, an attacker could write a program that retrieves the password and could gain access to the user’s credentials. You can only lessen this risk by disabling the storing of end-user credentials.
    
-    
    
-    
    
-     
-    
    
 
-     
+After you have finished, click **Next**.
+~~~
 
-    After you have finished, click **Next**.
+8. On the **Copy Settings from Host** page, you can select the following settings to specify how the MED-V workspace is configured:
+
+   **Caution**  
+   The settings that you specify on this page that are copied from the host computer to the MED-V workspace override those specified in the Sysprep.inf answer file.
+
+
+
+~~~
+
++++
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
    



    Copy regional settings
    Select this check box to copy the regional settings from the host computer to the MED-V workspace.
    If you select this check box, the following settings are set in the Sysprep.inf file:
    
+
    [RegionalSettings]
+Language
+SystemLocale
+UserLocale
+UserLocale_DefaultUser
+InputLocale
+InputLocale_DefaultUser
+
    Copy user settings
    Select this check box to copy certain user settings, such as user name and company name, from the host to the MED-V workspace.
    If you select this check box, the following settings are set in the Sysprep.inf file:
    
+
    [UserData]
+OrgName
+FullName
    
+
    
+Note  
+
    Personal settings, such as Internet browsing history, are not copied over to the MED-V workspace.
    
+
    
+
    
+
+
    Copy domain name
    Select this check box to let the guest join the same domain as the host.
    
+Important  
+
    The MED-V guest must be configured to join a domain that lets users log on by using the credentials that they use to log on to the MED-V host.
    
+
    
+
    
+
+
    Copy domain organizational unit
    Select this check box to copy the domain organizational unit from the host computer to the MED-V workspace. This check box is only enabled if you select to copy the domain name from the host computer.
    
+
+
+
+After you have finished, click **Next**.
+~~~
+
+9. On the **Startup and Networking** page, you can change the default behavior for the following settings:
+
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    Start MED-V workspace
    Choose whether to start the MED-V workspace at user logon, at first use, or to let the end user decide when the MED-V workspace starts.
    The MED-V workspace starts in one of two ways: either when the end user logs on or when they first start an action that requires MED-V, such as opening a published application or entering a URL that requires redirection.
    
+   
    You can either define this setting for the end user or let the end user control how MED-V starts.
    
+   
    
+   Note
    If you specify that the end user decides, the default behavior they experience is that the MED-V workspace starts when they log on. They can change the default by right-clicking the MED-V icon in the notification area and selecting MED-V User Settings. If you define this setting for the end user, they cannot change how MED-V starts.
    
+   
    
+   
    
+
+   
    Networking
    Select Shared or Bridged for your networking setting. The default is Shared.
    Shared - The MED-V workspace uses Network Address Translation (NAT) to share the host's IP for outgoing traffic.
    
+   
    Bridged - The MED-V workspace has its own network address, typically obtained through DHCP.
    Store credentials
    Choose whether you want to store the end user credentials.
    The default behavior is that credential storing is disabled so that the end user must be authenticated every time that they log on.
    
+   
    
+   Important
    Even though caching the end user’s credentials provides the best user experience, you should be aware of the risks involved.
    
+   
    The end user’s domain credential is stored in a reversible format in the Windows Credential Manager. As a result, an attacker could write a program that retrieves the password and could gain access to the user’s credentials. You can only lessen this risk by disabling the storing of end-user credentials.
    
+   
    
+   
    
+
+   
    
+
+
+
+~~~
+After you have finished, click **Next**.
+~~~
 
 10. On the **Web Redirection** page, you can enter, paste, or import a list of the URLs that are redirected to Internet Explorer in the MED-V workspace. For more information about how to configure your URL redirection information, see [Prerequisites](#bkmk-prereq).
 
-    You can also specify how Internet Explorer in the MED-V workspace is configured for end users. By default, the Internet zone security level is set to High. Also, certain default browsing capabilities, such as the address bar, are removed. This default configuration of Internet Explorer in the MED-V workspace provides a more secure browsing environment for end users.
+   You can also specify how Internet Explorer in the MED-V workspace is configured for end users. By default, the Internet zone security level is set to High. Also, certain default browsing capabilities, such as the address bar, are removed. This default configuration of Internet Explorer in the MED-V workspace provides a more secure browsing environment for end users.
 
-    **Caution**  
-    By changing the default settings, you can customize Internet Explorer in the MED-V workspace. However, realize that if you change the default settings so as to make them less secure, you can expose your organization to those security risks that are present in older versions of Internet Explorer. For more information, see [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md).
+   **Caution**  
+   By changing the default settings, you can customize Internet Explorer in the MED-V workspace. However, realize that if you change the default settings so as to make them less secure, you can expose your organization to those security risks that are present in older versions of Internet Explorer. For more information, see [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md).
 
-     
 
-    After you have finished, click **Next**.
+
+~~~
+After you have finished, click **Next**.
+~~~
 
 11. On the **Summary** page, you can review the packaging settings for this MED-V workspace. If you want to change any settings, click the **Previous** button to return to the relevant page. After you have finished reviewing the settings, click **Create**.
 
-    The **Completion** page of the **Create MED-V Workspace Package Wizard** opens to show the progress of the package creation.
+   The **Completion** page of the **Create MED-V Workspace Package Wizard** opens to show the progress of the package creation.
 
-    **Note**  
-    The MED-V workspace package creation process might take several minutes to complete, depending on the size of the VHD specified.
+   **Note**  
+   The MED-V workspace package creation process might take several minutes to complete, depending on the size of the VHD specified.
 
-     
 
-    If the MED-V workspace package is created successfully, the **Completion** page displays a list of the files that you created and their respective locations. The following is a list of the files that are created and their descriptions:
 
-    -   **setup.exe**—an installation program that you deploy and run on end-user computers to install the MED-V workspaces.
+~~~
+If the MED-V workspace package is created successfully, the **Completion** page displays a list of the files that you created and their respective locations. The following is a list of the files that are created and their descriptions:
 
-    -   **<*workspace\_name*>.msi**—an installer file that you deploy to the end-user computers. The setup.exe file will run this file to install the MED-V workspaces.
+-   **setup.exe**—an installation program that you deploy and run on end-user computers to install the MED-V workspaces.
 
-    -   **<*vhd\_name*>.medv**—a compressed VHD file that you deploy to the end-user computers. The setup.exe file uses it when it installs the MED-V workspaces.
+-   **<*workspace\_name*>.msi**—an installer file that you deploy to the end-user computers. The setup.exe file will run this file to install the MED-V workspaces.
 
-    -   **<*workspace\_name*>.reg**—the configuration settings that are installed when the setup.exe, <*workspace\_name*>.msi, and <*vhd\_name*>.medv files are deployed and setup.exe is run.
+-   **<*vhd\_name*>.medv**—a compressed VHD file that you deploy to the end-user computers. The setup.exe file uses it when it installs the MED-V workspaces.
 
-    -   **<*workspace\_name*>.ps1**—a Windows PowerShell script that you can use to rebuild the registry file and re-build the MED-V workspace package.
+-   **<*workspace\_name*>.reg**—the configuration settings that are installed when the setup.exe, <*workspace\_name*>.msi, and <*vhd\_name*>.medv files are deployed and setup.exe is run.
 
-        **Important**  
-        Before deployment, you can edit configuration settings by updating the .ps1 file that has your preferred method of script editing, such as Windows PowerShell. After you change the .ps1 file, use that file to rebuild the MED-V workspace package that you deploy to your enterprise. For more information, see [Configuring Advanced Settings by Using Windows PowerShell](configuring-advanced-settings-by-using-windows-powershell.md).
+-   **<*workspace\_name*>.ps1**—a Windows PowerShell script that you can use to rebuild the registry file and re-build the MED-V workspace package.
+
+    **Important**  
+    Before deployment, you can edit configuration settings by updating the .ps1 file that has your preferred method of script editing, such as Windows PowerShell. After you change the .ps1 file, use that file to rebuild the MED-V workspace package that you deploy to your enterprise. For more information, see [Configuring Advanced Settings by Using Windows PowerShell](configuring-advanced-settings-by-using-windows-powershell.md).
+
+    However, after the MED-V workspace is deployed, you must edit configuration settings through the registry. For a list and description of the configuration settings, see [Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md).
+~~~
 
-        However, after the MED-V workspace is deployed, you must edit configuration settings through the registry. For a list and description of the configuration settings, see [Managing MED-V Workspace Configuration Settings](managing-med-v-workspace-configuration-settings.md).
 
-         
 
 12. Click **Close** to close the packaging wizard and return to the **MED-V Workspace Packager**.
 
@@ -429,9 +450,9 @@ Your MED-V workspace package is now ready for testing before deployment.
 
 [Prepare a MED-V Image](prepare-a-med-v-image.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md b/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md
index 8391d56dfa..d501b3826f 100644
--- a/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md
+++ b/mdop/medv-v2/creating-a-windows-virtual-pc-image-for-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Creating a Windows Virtual PC Image for MED-V
 description: Creating a Windows Virtual PC Image for MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: fd7c0b1a-0769-4e7b-ad1a-dad19cca081f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -42,7 +45,7 @@ Alternately, if you already have a Windows Imaging (WIM) file that you want to u
 **Important**  
 MED-V only supports one virtual hard disk per virtual machine and only one partition on each virtual disk.
 
- 
+ 
 
 After you have created your virtual hard disk, install Windows XP on the image.
 
@@ -66,21 +69,21 @@ After you have installed Windows XP on your virtual machine, install any require
 **Important**  
 MED-V requires that Windows XP SP3 be running on the guest operating system.
 
- 
+ 
 
 **Warning**  
 When you install updates to Windows XP, make sure that you remain on the version of Internet Explorer in the guest that you intend to use in the MED-V workspace. For example, if you intend to run Internet Explorer 6 in the MED-V workspace, make sure that any updates that you install now do not include Internet Explorer 7 or Internet Explorer 8. In addition, we recommend that you configure the registry to prevent automatic updates from upgrading Internet Explorer.
 
- 
+ 
 
 ### Installing an Optional Performance Update
 
 Although it is optional, we recommend that you install the following update for [hotfix KB972435](https://go.microsoft.com/fwlink/?LinkId=201077) (https://go.microsoft.com/fwlink/?LinkId=201077). This update increases the performance of shared folders in a Terminal Services session:
 
 **Note**  
-The update is publically available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix.
+The update is publicly available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix.
 
- 
+ 
 
 ### Configuring a Group Policy Performance Update
 
@@ -102,7 +105,7 @@ Windows Virtual PC includes the Integration Components package. This provides fe
 **Important**  
 MED-V requires the installation of the Integration Components package.
 
- 
+ 
 
 When you configure the virtual image to work with MED-V, you must manually install the Integration Components package on the guest operating system to make the integration features that are available.
 
@@ -119,7 +122,7 @@ After you install the Integration Components package, you are prompted to instal
 **Important**  
 If you are not prompted to install the RemoteApp update, you must download and install it manually. For more information and instructions about how to download this update, see [Update for Windows XP SP3 to enable RemoteApp](https://go.microsoft.com/fwlink/?LinkId=195925) (https://go.microsoft.com/fwlink/?LinkId=195925).
 
- 
+ 
 
 ### Enabling Remote Desktop
 
@@ -135,7 +138,7 @@ If you want, you can use the Internet Explorer Administration Kit to customize I
 **Warning**  
 You should consider security concerns associated with customizing Internet Explorer in the MED-V workspace. For more information, see [Security Best Practices for MED-V Operations](security-best-practices-for-med-v-operations.md).
 
- 
+ 
 
 After your virtual hard disk is installed with an up-to-date guest operating system, you can install applications on the image.
 
@@ -146,9 +149,9 @@ After your virtual hard disk is installed with an up-to-date guest operating sys
 
 [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/define-and-plan-your-med-v-deployment.md b/mdop/medv-v2/define-and-plan-your-med-v-deployment.md
index 6272729d12..6c0b8e2772 100644
--- a/mdop/medv-v2/define-and-plan-your-med-v-deployment.md
+++ b/mdop/medv-v2/define-and-plan-your-med-v-deployment.md
@@ -1,12 +1,15 @@
 ---
 title: Define and Plan your MED-V Deployment
 description: Define and Plan your MED-V Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: a90945cc-dc37-4548-963d-e0c6f8ba0467
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/deploy-the-med-v-components.md b/mdop/medv-v2/deploy-the-med-v-components.md
index 2c4332e6bb..103992785c 100644
--- a/mdop/medv-v2/deploy-the-med-v-components.md
+++ b/mdop/medv-v2/deploy-the-med-v-components.md
@@ -1,12 +1,15 @@
 ---
 title: Deploy the MED-V Components
 description: Deploy the MED-V Components
-author: jamiejdt
+author: dansimp
 ms.assetid: fc2c5ef2-9c71-412a-8f6c-93df248f77d6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/deploying-the-med-v-workspace-package.md b/mdop/medv-v2/deploying-the-med-v-workspace-package.md
index 5a34de0d1c..b75d781a80 100644
--- a/mdop/medv-v2/deploying-the-med-v-workspace-package.md
+++ b/mdop/medv-v2/deploying-the-med-v-workspace-package.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the MED-V Workspace Package
 description: Deploying the MED-V Workspace Package
-author: jamiejdt
+author: dansimp
 ms.assetid: f314425a-d60f-4b8d-b71f-d13d1da9297f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,12 +22,12 @@ After you have tested your Microsoft Enterprise Desktop Virtualization (MED-V) 2
 **Note**  
 When you are ready to deploy, we recommend that you install the MED-V workspace by running the setup.exe executable program that is included in your MED-V workspace installer package.
 
- 
+ 
 
 **Warning**  
 Before you can install the MED-V workspace, you must first install the MED-V Host Agent.
 
- 
+ 
 
 ## In This Section
 
@@ -38,9 +41,9 @@ Provides information about how to deploy a MED-V workspace in a Windows 7 image.
 [How to Deploy a MED-V Workspace Manually](how-to-deploy-a-med-v-workspace-manually.md)  
 Provides information about how to manually deploy a MED-V workspace.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/deployment-of-med-v.md b/mdop/medv-v2/deployment-of-med-v.md
index aae2559a01..40216dcce3 100644
--- a/mdop/medv-v2/deployment-of-med-v.md
+++ b/mdop/medv-v2/deployment-of-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Deployment of MED-V
 description: Deployment of MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 52ea8ae4-ec2e-4cb8-ab38-e6400f47d3ba
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/deployment-troubleshooting.md b/mdop/medv-v2/deployment-troubleshooting.md
index d8e85a140e..3fafc1ed70 100644
--- a/mdop/medv-v2/deployment-troubleshooting.md
+++ b/mdop/medv-v2/deployment-troubleshooting.md
@@ -1,12 +1,15 @@
 ---
 title: Deployment Troubleshooting
 description: Deployment Troubleshooting
-author: jamiejdt
+author: dansimp
 ms.assetid: 9ee980f2-4e77-4020-9f0e-8c2ffdc390ad
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md b/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md
index 9fd845f807..41e3e7e9ff 100644
--- a/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md
+++ b/mdop/medv-v2/detecting-network-changes-that-affect-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Detecting Network Changes that Affect MED-V
 description: Detecting Network Changes that Affect MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: fd29b95a-cda2-464d-b86d-50b6bd64b4ca
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ The feature includes a component running in the guest operating system that is n
 **Note**  
 This feature is only available if the virtual machine is configured for network address translation (NAT) mode. If the virtual machine is configured for BRIDGED mode, no change indications are generated.
 
- 
+ 
 
 This section provides information and instruction to assist you in monitoring those network changes that can affect MED-V.
 
@@ -30,37 +33,37 @@ This section provides information and instruction to assist you in monitoring th
 
 After you have deployed your MED-V workspaces, you can monitor changes to certain network configurations by preforming the following tasks:
 
-1.  Create a Managed Object Format (MOF) file that will look for the network configuration changes that you want to monitor. The following code shows an example of the MOF file that you can create.
+1. Create a Managed Object Format (MOF) file that will look for the network configuration changes that you want to monitor. The following code shows an example of the MOF file that you can create.
 
-    ``` syntax
-#pragma namespace ("\\\\.\\root\\ccm\\NetworkConfig")
+   ``` syntax
+   #pragma namespace ("\\\\.\\root\\ccm\\NetworkConfig")
 
-    class CCM_IPConfig
-    {
-        [NotNull: ToInstance ToSubClass] uint32 AddressFamily; // AF_INET, AF_INET6
-        [Key, NotNull: ToInstance ToSubClass] string IPAddress; // IPv4 or IPv6 address
-        [NotNull: ToInstance ToSubClass] string SubnetMask; // IPv4 subnet mask
-    };
+   class CCM_IPConfig
+   {
+       [NotNull: ToInstance ToSubClass] uint32 AddressFamily; // AF_INET, AF_INET6
+       [Key, NotNull: ToInstance ToSubClass] string IPAddress; // IPv4 or IPv6 address
+       [NotNull: ToInstance ToSubClass] string SubnetMask; // IPv4 subnet mask
+   };
 
-    class CCM_NetworkAdapter
-    {
-        [Key, NotNull: ToInstance ToSubClass] string Name;
-        [NotNull: ToInstance ToSubClass] uint32 DHCPEnabled = 0; 
-        [NotNull: ToInstance ToSubClass] uint32 Quarantined = 0; // To check if it is quarantined.
-        CCM_IPConfig IPConfigInfo[];
-    };
+   class CCM_NetworkAdapter
+   {
+       [Key, NotNull: ToInstance ToSubClass] string Name;
+       [NotNull: ToInstance ToSubClass] uint32 DHCPEnabled = 0; 
+       [NotNull: ToInstance ToSubClass] uint32 Quarantined = 0; // To check if it is quarantined.
+       CCM_IPConfig IPConfigInfo[];
+   };
 
-    [singleton]
-    class CCM_NetworkAdapters
-    {
-        [NotNull: ToInstance ToSubClass] String ProviderName; // MED-V or other provider
-        CCM_NetworkAdapter AdaptersInfo[];
-    };
-    ```
+   [singleton]
+   class CCM_NetworkAdapters
+   {
+       [NotNull: ToInstance ToSubClass] String ProviderName; // MED-V or other provider
+       CCM_NetworkAdapter AdaptersInfo[];
+   };
+   ```
 
-2.  Compile the MOF file.
+2. Compile the MOF file.
 
-3.  Install the MOF file in the guest.
+3. Install the MOF file in the guest.
 
 After you have installed the MOF file, you can create an event subscription that subscribes to Windows Management Instrumentation (WMI) creation, modification, or deletion events for the **CCM\_NetworkAdapters** class. This detects the following changes to the host:
 
@@ -83,9 +86,9 @@ The event subscription you created provides notification through the WMI system
 
 [Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/determining-how-med-v-will-be-deployed.md b/mdop/medv-v2/determining-how-med-v-will-be-deployed.md
index 6fa769886c..c618873c30 100644
--- a/mdop/medv-v2/determining-how-med-v-will-be-deployed.md
+++ b/mdop/medv-v2/determining-how-med-v-will-be-deployed.md
@@ -1,12 +1,15 @@
 ---
 title: Determining How MED-V Will Be Deployed
 description: Determining How MED-V Will Be Deployed
-author: jamiejdt
+author: dansimp
 ms.assetid: addbfef6-799e-4fe7-87d2-7e096a5ef5a5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -26,7 +29,7 @@ If you are currently using an electronic software distribution solution, you can
 **Note**  
 Whichever electronic software distribution solution that you use, you must be familiar with the requirements of your particular solution. If you are using System Center Configuration Manager 2007 R2 or a later version, see the [Configuration Manager Documentation Library](https://go.microsoft.com/fwlink/?LinkId=66999) in the Microsoft Technical Library (https://go.microsoft.com/fwlink/?LinkId=66999).
 
- 
+ 
 
 You might prefer to install MED-V in a Windows 7 image. Then, after you deploy the Windows 7 images throughout your enterprise, MED-V is ready to be installed when an end user needs it. For more information, see [How to Deploy a MED-V Workspace in a Windows 7 Image](how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md).
 
@@ -37,9 +40,9 @@ You might prefer to install MED-V in a Windows 7 image. Then, after you deploy t
 
 [Planning for MED-V](planning-for-med-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md b/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md
index 6321ebeed6..7f0d4b42e8 100644
--- a/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md
+++ b/mdop/medv-v2/end-to-end-deployment-scenario-for-med-v-20.md
@@ -1,12 +1,15 @@
 ---
 title: End-to-End Deployment Scenario for MED-V 2.0
 description: End-to-End Deployment Scenario for MED-V 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 91bb5a9a-5fb1-4743-8494-9d4dee2ec222
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md b/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md
index 7cdeebc5d7..526c5d24da 100644
--- a/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md
+++ b/mdop/medv-v2/end-to-end-operations-scenario-for-med-v-20.md
@@ -1,12 +1,15 @@
 ---
 title: End-to-End Operations Scenario for MED-V 2.0
 description: End-to-End Operations Scenario for MED-V 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 1d87f5f3-9fc5-4731-8bd1-c155714f34ee
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md b/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md
index 92d0dbc4e4..f266500d1b 100644
--- a/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md
+++ b/mdop/medv-v2/end-to-end-planning-scenario-for-med-v-20.md
@@ -1,12 +1,15 @@
 ---
 title: End-to-End Planning Scenario for MED-V 2.0
 description: End-to-End Planning Scenario for MED-V 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: e7833883-be93-4b42-9fa3-5c4d9a919058
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/example-med-v-checklists.md b/mdop/medv-v2/example-med-v-checklists.md
index 6645ee8f25..1e439600b8 100644
--- a/mdop/medv-v2/example-med-v-checklists.md
+++ b/mdop/medv-v2/example-med-v-checklists.md
@@ -1,12 +1,15 @@
 ---
 title: Example MED-V Checklists
 description: Example MED-V Checklists
-author: jamiejdt
+author: dansimp
 ms.assetid: cf9c33e8-1b7a-4306-92f6-edbb70ab23b5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/example-med-v-environment-planning-checklist.md b/mdop/medv-v2/example-med-v-environment-planning-checklist.md
index f1bfb8ff0e..088faff234 100644
--- a/mdop/medv-v2/example-med-v-environment-planning-checklist.md
+++ b/mdop/medv-v2/example-med-v-environment-planning-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: Example MED-V Environment Planning Checklist
 description: Example MED-V Environment Planning Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 877d1660-abef-4e81-ab3a-a8a3ec181d26
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,28 +33,28 @@ The following checklist provides a high-level list of items to consider and outl
 
 
 
    Review the components of a MED-V deployment.
    
-
    [High-Level Architecture](high-level-architecturemedv2.md)
    
+
    High-Level Architecture
    
 
 
 
    Ensure that your computing environment meets the supported configurations required for installing MED-V 2.0.
    
-
    [MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md)
    
+
    MED-V 2.0 Supported Configurations
    
 
 
 
    Determine how you want to design your MED-V deployment.
    
-
    [Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md)
    
+
    Define and Plan your MED-V Deployment
    
 
 
 
    Review the list of best practices for ensuring that your MED-V deployment environment is more secure.
    
-
    [Security and Protection for MED-V](security-and-protection-for-med-v.md)
    
+
    Security and Protection for MED-V
    
 
 
 
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/example-med-v-image-preparation-checklist.md b/mdop/medv-v2/example-med-v-image-preparation-checklist.md
index 5961cab9d1..2a7a612cb8 100644
--- a/mdop/medv-v2/example-med-v-image-preparation-checklist.md
+++ b/mdop/medv-v2/example-med-v-image-preparation-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: Example MED-V Image Preparation Checklist
 description: Example MED-V Image Preparation Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: d69f252f-624b-439e-814b-b68cdaf7d582
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,24 +33,24 @@ The following checklist provides a high-level list of items to consider and outl
 
 
 
    Create a virtual machine that is running Windows XP SP3 with updates and additions.
    
-
    [Creating a Windows Virtual PC Image for MED-V](creating-a-windows-virtual-pc-image-for-med-v.md)
    
+
    Creating a Windows Virtual PC Image for MED-V
    
 
 
 
    Install any predeployment software that you want on the MED-V image.
    
-
    [Installing Applications on a Windows Virtual PC Image](installing-applications-on-a-windows-virtual-pc-image.md)
    
+
    Installing Applications on a Windows Virtual PC Image
    
 
 
 
    Package the MED-V image by using Sysprep.
    
-
    [Configuring a Windows Virtual PC Image for MED-V](configuring-a-windows-virtual-pc-image-for-med-v.md)
    
+
    Configuring a Windows Virtual PC Image for MED-V
    
 
 
 
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/example-med-v-project-planning-checklist.md b/mdop/medv-v2/example-med-v-project-planning-checklist.md
index 19d9ef8df5..f89d1d89ea 100644
--- a/mdop/medv-v2/example-med-v-project-planning-checklist.md
+++ b/mdop/medv-v2/example-med-v-project-planning-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: Example MED-V Project Planning Checklist
 description: Example MED-V Project Planning Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 2b599bcb-1808-43ba-a689-1642bda24511
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,28 +33,28 @@ The following checklist provides a high-level list of items to consider and outl
 
 
 
    Determine how you can use MED-V to help solve your application compatibility issues.
    
-
    [Planning for Application Operating System Compatibility](planning-for-application-operating-system-compatibility.md)
    
+
    Planning for Application Operating System Compatibility
    
 
 
 
    Plan an end-to-end deployment scenario for your organization.
    
-
    [End-to-End Planning Scenario for MED-V 2.0](end-to-end-planning-scenario-for-med-v-20.md)
    
+
    End-to-End Planning Scenario for MED-V 2.0
    
 
 
 
    Define the project scope by defining the end users and determining the MED-V images to be managed.
    
-
    [Define and Plan your MED-V Deployment](define-and-plan-your-med-v-deployment.md)
    
+
    Define and Plan your MED-V Deployment
    
 
 
 
    Review the list of best practices for ensuring that your MED-V deployment is more secure.
    
-
    [Security and Protection for MED-V](security-and-protection-for-med-v.md)
    
+
    Security and Protection for MED-V
    
 
 
 
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/example-med-v-system-installation-checklist.md b/mdop/medv-v2/example-med-v-system-installation-checklist.md
index 870408a449..e5a0c45347 100644
--- a/mdop/medv-v2/example-med-v-system-installation-checklist.md
+++ b/mdop/medv-v2/example-med-v-system-installation-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: Example MED-V System Installation Checklist
 description: Example MED-V System Installation Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 9e5673ba-dee4-4680-9c57-a149beab14d3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,28 +33,28 @@ The following checklist provides a high-level list of items to consider and outl
 
 
 
    Ensure that your computing environment meets the supported configurations that are required for installing MED-V 2.0.
    
-
    [MED-V 2.0 Supported Configurations](med-v-20-supported-configurations.md)
    
+
    MED-V 2.0 Supported Configurations
    
 
 
 
    Plan and design the MED-V deployment.
    
-
    [Planning for MED-V](planning-for-med-v.md)
    
+
    Planning for MED-V
    
 
 
 
    Verify that the required installation prerequisites are configured.
    
-
    [Configure Installation Prerequisites](configure-installation-prerequisites.md)
    
+
    Configure Installation Prerequisites
    
 
 
 
    Install the MED-V Host Agent and MED-V Workspace Packager.
    
-
    [Deploy the MED-V Components](deploy-the-med-v-components.md)
    
+
    Deploy the MED-V Components
    
 
 
 
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md b/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md
index b2bf7516d2..67505667a8 100644
--- a/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md
+++ b/mdop/medv-v2/example-med-v-workspace-deployment-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: Example MED-V Workspace Deployment Checklist
 description: Example MED-V Workspace Deployment Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: d8857883-9b2d-40ac-9136-59e4e20e02fe
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,28 +33,28 @@ The following checklist provides a high-level list of items to consider and outl
 
 
 
    Prepare the MED-V image for deployment.
    
-
    [Prepare a MED-V Image](prepare-a-med-v-image.md)
    
+
    Prepare a MED-V Image
    
 
 
 
    Create the MED-V workspace deployment package.
    
-
    [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md)
    
+
    Create a MED-V Workspace Package
    
 
 
 
    Test the MED-V workspace installer package.
    
-
    [Testing the MED-V Workspace Package](testing-the-med-v-workspace-package.md)
    
+
    Testing the MED-V Workspace Package
    
 
 
 
    Deploy the MED-V workspace installer package.
    
-
    [Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md)
    
+
    Deploying the MED-V Workspace Package
    
 
 
 
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/getting-started-with-med-vmedv2.md b/mdop/medv-v2/getting-started-with-med-vmedv2.md
index 9803b0802d..a6a566459a 100644
--- a/mdop/medv-v2/getting-started-with-med-vmedv2.md
+++ b/mdop/medv-v2/getting-started-with-med-vmedv2.md
@@ -1,12 +1,15 @@
 ---
 title: Getting Started with MED-V
 description: Getting Started with MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 283734d7-231c-45b6-92c9-c95a46ec3628
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/high-level-architecturemedv2.md b/mdop/medv-v2/high-level-architecturemedv2.md
index 1e02ee8f46..d4ad41a552 100644
--- a/mdop/medv-v2/high-level-architecturemedv2.md
+++ b/mdop/medv-v2/high-level-architecturemedv2.md
@@ -1,12 +1,15 @@
 ---
 title: High-Level Architecture
 description: High-Level Architecture
-author: jamiejdt
+author: dansimp
 ms.assetid: a00edb9f-207b-4f32-9e8f-522ea2739d2f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,7 +33,7 @@ The MED-V software contained in the MED-V host that provides a channel to commun
 **Note**  
 After MED-V and its required components are installed MED-V must be configured. The configuration of MED-V is referred to as first time setup.
 
- 
+ 
 
 **ESD System**  
 Your existing software distribution method that lets you deploy and install the MED-V workspace package files that MED-V creates.
@@ -56,7 +59,7 @@ The MED-V software contained in the MED-V guest that provides a channel to commu
 **Note**  
 The MED-V Guest Agent is installed automatically during first time setup.
 
- 
+ 
 
 **ESD Client**  
 An optional part of your ESD system that installs software packages and reports status to the ESD system.
@@ -68,9 +71,9 @@ An optional part of your ESD system that installs software packages and reports
 
 [Prepare the Deployment Environment for MED-V](prepare-the-deployment-environment-for-med-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md b/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md
index 850932f07c..231cef0574 100644
--- a/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md
+++ b/mdop/medv-v2/how-to-add-or-remove-url-redirection-information-in-a-deployed-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace
 description: How to Add or Remove URL Redirection Information in a Deployed MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: bf55848d-bf77-452e-aaa5-4dd4868ff5bd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 11/01/2016
 ---
 
@@ -43,7 +46,7 @@ You can add and remove URL redirection information by performing one of the foll
 **Note**  
 This method of editing URL redirection information is a MED-V best practice.
 
- 
+ 
 
 **To rebuild the MED-V workspace by using an updated URL text file**
 
@@ -52,7 +55,7 @@ This method of editing URL redirection information is a MED-V best practice.
     **Important**  
     We do not recommend this method of editing URL redirection information. In addition, any time that you redeploy the MED-V workspace back out to your enterprise, first time setup must run again, and any data saved in the virtual machine is lost.
 
-     
+     
 
 ## Related topics
 
@@ -63,9 +66,9 @@ This method of editing URL redirection information is a MED-V best practice.
 
 [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/how-to-create-a-test-environment.md b/mdop/medv-v2/how-to-create-a-test-environment.md
index 8fd869f624..fd2ddea698 100644
--- a/mdop/medv-v2/how-to-create-a-test-environment.md
+++ b/mdop/medv-v2/how-to-create-a-test-environment.md
@@ -1,12 +1,15 @@
 ---
 title: How to Create a Test Environment
 description: How to Create a Test Environment
-author: jamiejdt
+author: dansimp
 ms.assetid: a0db2299-16f3-4516-8769-7d55ca4a1e98
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -31,7 +34,7 @@ The following are some steps and instructions to help you create a test environm
         **Important**  
         The VHD and Setup executable program must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace installer by running setup.exe.
 
-         
+         
 
 2.  After all of the components are installed on the test computer, run the MED-V Host Agent to start first time setup.
 
@@ -40,7 +43,7 @@ The following are some steps and instructions to help you create a test environm
     **Note**  
     If you cannot physically run the MED-V Host Agent on the test computer, first time setup starts automatically the next time that the computer restarts.
 
-     
+     
 
 First time setup starts and can take ten minutes or more to finish.
 
@@ -55,7 +58,7 @@ For information about testing your configuration settings when first time setup
     **Important**  
     The VHD and Setup executable program must be in the same folder on your test environment as the MED-V workspace installer.
 
-     
+     
 
 3.  Install the MED-V workspace by running setup.exe.
 
@@ -70,7 +73,7 @@ You are now ready to test the different settings for configuration, application
 **Note**  
 By default, MED-V overrides the screen lock policy in the guest. However, this does not pose a security problem because the host computer still honors the screen lock policy.
 
- 
+ 
 
 ## Related topics
 
@@ -81,9 +84,9 @@ By default, MED-V overrides the screen lock policy in the guest. However, this d
 
 [How to Test URL Redirection](how-to-test-url-redirection.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md
index 7d2e636805..c7f27598d2 100644
--- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md
+++ b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy a MED-V Workspace in a Windows 7 Image
 description: How to Deploy a MED-V Workspace in a Windows 7 Image
-author: jamiejdt
+author: dansimp
 ms.assetid: a83aba4e-8681-4906-9872-f431c0bb15f9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -29,14 +32,14 @@ The following section provides information and instructions to help you deploy t
     **Warning**  
     Internet Explorer must be closed before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution.
 
-     
+     
 
 4.  Copy the MED-V workspace package files to the Windows 7 image. The MED-V workspace package files are the MED-V workspace installer, .medv file, and setup.exe file that you created by using the **MED-V Workspace Packager**.
 
     **Important**  
     The .medv and setup.exe file must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace by running setup.exe.
 
-     
+     
 
 5.  Configure a shortcut on the **Start** menu to open the MED-V workspace package installation.
 
@@ -53,9 +56,9 @@ When the end user has to access an application published in the MED-V workspace,
 
 [How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md
index 1b46dd19ba..71bc439a8b 100644
--- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md
+++ b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-manually.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy a MED-V Workspace Manually
 description: How to Deploy a MED-V Workspace Manually
-author: jamiejdt
+author: dansimp
 ms.assetid: 94bfb209-2230-49b6-bb40-9c6ab088dbf4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -28,38 +31,42 @@ This section provides instruction about how to manually deploy a MED-V workspace
 
     -   **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file).
 
-        **Warning**  
+        **Warning**  
         Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution.
 
-         
 
-    -   **MED-V Workspace Installer, VHD, and Setup Executable** – created with the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md).
 
-        **Important**  
-        The compressed VHD file (.medv) and the Setup executable program (setup.exe) must be in the same folder as the MED-V workspace installer.
+~~~
+-   **MED-V Workspace Installer, VHD, and Setup Executable** – created with the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md).
 
-         
+    **Important**  
+    The compressed VHD file (.medv) and the Setup executable program (setup.exe) must be in the same folder as the MED-V workspace installer.
+~~~
 
-2.  Install the following in the order listed. The end user can perform this task manually or you can create a script to install the following:
 
-    -   Windows Virtual PC and the Windows Virtual PC additions and updates. A computer restart is required.
 
-    -   The MED-V Host Agent.
+2. Install the following in the order listed. The end user can perform this task manually or you can create a script to install the following:
 
-        **Note**  
-        If it is running, Internet Explorer must be restarted before the installation of the MED-V Host Agent can finish.
+   -   Windows Virtual PC and the Windows Virtual PC additions and updates. A computer restart is required.
 
-         
+   -   The MED-V Host Agent.
 
-    -   The MED-V workspace package.
+       **Note**  
+       If it is running, Internet Explorer must be restarted before the installation of the MED-V Host Agent can finish.
 
-        Install the MED-V workspace by running the setup.exe program that is included in the MED-V workspace package files.
 
-3.  Complete first time setup.
 
-    After the MED-V workspace is installed, you have the option of starting MED-V. This starts the MED-V Host Agent. You can either start MED-V at that time, or start the MED-V Host Agent later to complete first time setup.
+~~~
+-   The MED-V workspace package.
 
-    To start the MED-V Host Agent, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Host Agent**.
+    Install the MED-V workspace by running the setup.exe program that is included in the MED-V workspace package files.
+~~~
+
+3. Complete first time setup.
+
+   After the MED-V workspace is installed, you have the option of starting MED-V. This starts the MED-V Host Agent. You can either start MED-V at that time, or start the MED-V Host Agent later to complete first time setup.
+
+   To start the MED-V Host Agent, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Host Agent**.
 
 ## Related topics
 
@@ -70,9 +77,9 @@ This section provides instruction about how to manually deploy a MED-V workspace
 
 [Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md
index 5c2ea74bbd..e2ebe0a01f 100644
--- a/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md
+++ b/mdop/medv-v2/how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy a MED-V Workspace Through an Electronic Software Distribution System
 description: How to Deploy a MED-V Workspace Through an Electronic Software Distribution System
-author: jamiejdt
+author: dansimp
 ms.assetid: b5134c35-e1de-470c-93f8-ead6218d9dce
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -16,19 +19,19 @@ ms.date: 08/30/2016
 
 An electronic software distribution system is designed to efficiently move software to many different computers over slow or fast network connections. The following section provides information and instructions to help you deploy your MED-V workspace throughout your enterprise by using a software distribution system.
 
-**Note**  
+**Note**  
 Whichever software distribution solution that you use, you must be familiar with the requirements of your particular solution. If you are using System Center Configuration Manager 2007 R2 or a later version, see the [Configuration Manager Documentation Library](https://go.microsoft.com/fwlink/?LinkId=66999) in the Microsoft Technical Library (https://go.microsoft.com/fwlink/?LinkId=66999).
 
- 
 
-**Important**  
+
+**Important**  
 If you are using System Center Configuration Manager 2007 SP2 and your MED-V workspaces are configured to operate in **NAT** mode, the virtual machines are classified as Internet-based clients and cannot find the closest distribution points from which to download content.
 
 The [hotfix to improve the functionality for VMs that are managed by MED-V](https://go.microsoft.com/fwlink/?LinkId=201088) (https://go.microsoft.com/fwlink/?LinkId=201088) adds new functionality to virtual machines that are managed by MED-V and that are configured to operate in **NAT** mode. The new functionality lets virtual machines access the closest distribution points. Therefore, the administrator can manage the virtual machine and the host computer in the same manner. This hotfix must be installed first on the site server and then on the client.
 
-The update is publically available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix.
+The update is publicly available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix.
+
 
- 
 
 You can also deploy the MED-V components together by using a batch file, but this requires a restart after the installation of Windows Virtual PC. To bypass this requirement, you can specify a single restart after all of the components are installed. The single restart also automatically starts MED-V because the MED-V workspace installation places an entry in the RUNKEY.
 
@@ -44,48 +47,50 @@ You can also deploy the MED-V components together by using a batch file, but thi
 
     3.  **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file). For more information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md).
 
-        **Warning**  
+        **Warning**  
         Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution.
 
-         
+
 
     4.  **MED-V Workspace Installer, VHD, and Setup Executable** – created in the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md).
 
-        **Important**  
+        **Important**  
         The compressed virtual hard disk file (.medv) and the Setup executable program (setup.exe) must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace installer by running setup.exe.
 
-         
 
-        **Tip**  
-        Because problems can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe.
 
-         
+~~~
+    **Tip**  
+    Because problems can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe.
+~~~
 
-3.  Configure the packages to run in silent mode (no user interaction is required).
 
-    Running in silent mode eliminates the prompt to close Internet Explorer if it is running and the prompt to start the MED-V Host Agent. Both actions are performed when the computer is restarted.
 
-    **Note**  
-    Installation of Windows Virtual PC requires you to restart the computer. You can create a single installation process and install all the components at the same time if you suppress the restart and ignore the prerequisites necessary for MED-V to install. You can also do this by using command-line arguments. For an example of these arguments, see [How to Deploy the MED-V Components Through an Electronic Software Distribution System](how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md#bkmk-batch). MED-V automatically starts when the computer is restarted.
+3. Configure the packages to run in silent mode (no user interaction is required).
 
-     
+   Running in silent mode eliminates the prompt to close Internet Explorer if it is running and the prompt to start the MED-V Host Agent. Both actions are performed when the computer is restarted.
 
-4.  Install MED-V and its components before installing Windows Virtual PC. See the example batch file later in this topic.
+   **Note**  
+   Installation of Windows Virtual PC requires you to restart the computer. You can create a single installation process and install all the components at the same time if you suppress the restart and ignore the prerequisites necessary for MED-V to install. You can also do this by using command-line arguments. For an example of these arguments, see [How to Deploy the MED-V Components Through an Electronic Software Distribution System](how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md#bkmk-batch). MED-V automatically starts when the computer is restarted.
 
-    **Important**  
-    Select the **IGNORE\_PREREQUISITES** option as shown in the example batch file so that the MED-V components can be installed prior to the required VPC components. Install the MED-V components in this order to allow for the single restart.
 
-     
 
-5.  Identify any other requirements necessary for the installation and for your software distribution system, such as target platforms and the free disk space.
+4. Install MED-V and its components before installing Windows Virtual PC. See the example batch file later in this topic.
 
-6.  Assign the packages to the target set of computers/users.
+   **Important**  
+   Select the **IGNORE\_PREREQUISITES** option as shown in the example batch file so that the MED-V components can be installed prior to the required VPC components. Install the MED-V components in this order to allow for the single restart.
 
-    As computers are running, the software distribution system client recognizes that new packages are available and begins to install the packages per the definition and requirements. The installations should run sequentially in silent. We recommend that this is performed as a single process that does not require a restart until all the packages are installed.
 
-7.  After the installations are complete, restart the updated computers.
 
-    Depending on the software distribution system, you can schedule a restart of the computer or the end users can restart the computers manually during their regular work. After the computer is restarted, MED-V automatically starts after an end user logs on. When MED-V starts for the first time, it runs first time setup.
+5. Identify any other requirements necessary for the installation and for your software distribution system, such as target platforms and the free disk space.
+
+6. Assign the packages to the target set of computers/users.
+
+   As computers are running, the software distribution system client recognizes that new packages are available and begins to install the packages per the definition and requirements. The installations should run sequentially in silent. We recommend that this is performed as a single process that does not require a restart until all the packages are installed.
+
+7. After the installations are complete, restart the updated computers.
+
+   Depending on the software distribution system, you can schedule a restart of the computer or the end users can restart the computers manually during their regular work. After the computer is restarted, MED-V automatically starts after an end user logs on. When MED-V starts for the first time, it runs first time setup.
 
 First time setup starts and might take several minutes to finish, depending on the size of the virtual hard disk that you specified and the number of policies applied to the MED-V workspace on startup. The end user can track the progress by watching the MED-V icon in the notification area. For more information about first time setup, see [MED-V 2.0 Deployment Overview](med-v-20-deployment-overview.md).
 
@@ -131,11 +136,10 @@ The following example, with the specified arguments, shows how to install 64-bit
 
    IGNORE_PREREQUISITES
    
 
    Installs without checking for Windows Virtual PC.
    
 
    
-Note  
-
    Only specify this argument if you are installing Windows Virtual PC as part of this installation.
    
+Note
    Only specify this argument if you are installing Windows Virtual PC as part of this installation.
    
 
    
 
    
- 
+
 
    
 
 
@@ -145,7 +149,7 @@ The following example, with the specified arguments, shows how to install 64-bit
 
 
 
- 
+
 
 ## Example
 
@@ -175,9 +179,9 @@ wusa.exe Windows6.1-KB977206-x64.msu /norestart /quiet
 
 [How to Deploy a MED-V Workspace in a Windows 7 Image](how-to-deploy-a-med-v-workspace-in-a-windows-7-image.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md b/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md
index 71a5503c00..5dfe7451d7 100644
--- a/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md
+++ b/mdop/medv-v2/how-to-deploy-the-med-v-components-through-an-electronic-software-distribution-system.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy the MED-V Components Through an Electronic Software Distribution System
 description: How to Deploy the MED-V Components Through an Electronic Software Distribution System
-author: jamiejdt
+author: dansimp
 ms.assetid: 8a800bdf-6fa4-47b4-b417-df053289d4e8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 11/01/2016
 ---
 
@@ -16,24 +19,24 @@ ms.date: 11/01/2016
 
 An electronic software distribution system can help you efficiently move software to many computers over slow or fast network connections. The following section provides information and instructions to help you deploy the Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 components throughout your enterprise by using a software distribution system.
 
-**Note**  
+**Note**  
 Whichever software distribution solution that you use, you must be familiar with the requirements of your particular solution. If you are using System Center Configuration Manager 2007 R2 or a later version, see the [Configuration Manager Documentation Library](https://go.microsoft.com/fwlink/?LinkId=66999) in the Microsoft Technical Library (https://go.microsoft.com/fwlink/?LinkId=66999).
 
- 
 
-**Important**  
+
+**Important**  
 If you are using System Center Configuration Manager 2007 SP2 and your MED-V workspaces are configured to operate in **NAT** mode, the virtual machines are classified as Internet-based clients and cannot find the closest distribution points from which to download content.
 
 The [hotfix to improve the functionality for VMs that are managed by MED-V](https://go.microsoft.com/fwlink/?LinkId=201088) (https://go.microsoft.com/fwlink/?LinkId=201088) adds new functionality to virtual machines that are managed by MED-V and that are configured to operate in **NAT** mode. The new functionality lets virtual machines access the closest distribution points. Therefore, the administrator can manage the virtual machine and the host computer in the same manner. This hotfix must be installed first on the site server and then on the client.
 
-The update is publically available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix.
+The update is publicly available. However, you might be prompted to accept an agreement for Microsoft Services. Follow the prompts on the successive webpages to retrieve this hotfix.
 
- 
 
-**Note**  
+
+**Note**  
 You must install the MED-V workspace packager and build your MED-V workspaces before you can deploy the MED-V components through your software distribution system. For more information about how to prepare an image and to build your MED-V workspaces, see [Operations for MED-V](operations-for-med-v.md).
 
- 
+
 
 **To deploy the MED-V components by using a software distribution system**
 
@@ -47,27 +50,27 @@ You must install the MED-V workspace packager and build your MED-V workspaces be
 
     3.  **MED-V Host Agent Installation File** – installs the Host Agent (MED-V\_HostAgent\_Setup installation file). For more information, see [How to Manually Install the MED-V Host Agent](how-to-manually-install-the-med-v-host-agent.md).
 
-        **Warning**  
-        Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution.   
+        **Warning**  
+        Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution.   
 
     4.  **MED-V Workspace Installer, VHD, and Setup Executable** – created in the **MED-V Workspace Packager**. For more information, see [Create a MED-V Workspace Package](create-a-med-v-workspace-package.md).
 
-        **Important**  
+        **Important**  
         The compressed virtual hard disk file (.medv) and the Setup executable program (setup.exe) must be in the same folder as the MED-V workspace installer. Then, install the MED-V workspace installer by running setup.exe.
 
-        **Tip**  
-        Because problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe.       
+        **Tip**  
+        Because problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe.       
 
 3.  Configure the packages to run in silent mode (no user interaction is required).
 
     Running in silent mode eliminates the prompt to close Internet Explorer if it is running and the prompt to start the MED-V Host Agent. Both actions are performed when the computer is restarted.
 
-    **Note**  
+    **Note**  
     Installation of Windows Virtual PC requires you to restart the computer. You can create a single installation process and install all the components at the same time if you suppress the restart and ignore the prerequisites necessary for MED-V to install. You can also do this by using command-line arguments. For an example of these arguments, see [To install the MED-V components by using a batch file](#bkmk-batch). MED-V automatically starts when the computer is restarted.
 
 4.  Install MED-V and its components before installing Windows Virtual PC. See the example batch file later in this topic.
 
-    **Important**  
+    **Important**  
     Select the **IGNORE\_PREREQUISITES** option as shown in the example batch file so that the MED-V components can be installed prior to the required VPC components. Install the MED-V components in this order to allow for the single restart.
 
 5.  Identify any other requirements necessary for the installation and for your software distribution system, such as target platforms and the free disk space.
@@ -124,11 +127,10 @@ The following example, with the specified arguments, shows how to install 64-bit
 
    IGNORE_PREREQUISITES
    
 
    Installs without checking for Windows Virtual PC.
    
 
    
-Note  
-
    Only specify this argument if you are installing Windows Virtual PC as part of this installation.
    
+Note
    Only specify this argument if you are installing Windows Virtual PC as part of this installation.
    
 
    
 
    
- 
+
 
    
 
 
@@ -138,7 +140,7 @@ The following example, with the specified arguments, shows how to install 64-bit
 
 
 
- 
+
 
 ## Example
 
@@ -168,9 +170,9 @@ wusa.exe Windows6.1-KB977206-x64.msu /norestart /quiet
 
 [Deploy the MED-V Components](deploy-the-med-v-components.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md b/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md
index 933a0d5877..3411624601 100644
--- a/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md
+++ b/mdop/medv-v2/how-to-install-the-med-v-workspace-packager.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the MED-V Workspace Packager
 description: How to Install the MED-V Workspace Packager
-author: jamiejdt
+author: dansimp
 ms.assetid: 627478e9-6798-4b32-9a50-7a1b72bea295
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ Microsoft Enterprise Desktop Virtualization (MED-V) 2.0 includes a **MED-V Works
 **Important**  
 Before you start to run the wizards, make sure that you have a prepared VHD ready to install. For more information, see [Prepare a MED-V Image](prepare-a-med-v-image.md).
 
- 
+ 
 
 This section provides step-by-step instructions for installing or repairing the **MED-V Workspace Packager**.
 
@@ -66,9 +69,9 @@ If the packager does not open as expected, you can try to repair the installatio
 
 [How to Uninstall the MED-V Components](how-to-uninstall-the-med-v-components.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md b/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md
index 5d0be4b470..017ed271d8 100644
--- a/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md
+++ b/mdop/medv-v2/how-to-manage-url-redirection-by-using-the-med-v-workspace-packager.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage URL Redirection by Using the MED-V Workspace Packager
 description: How to Manage URL Redirection by Using the MED-V Workspace Packager
-author: jamiejdt
+author: dansimp
 ms.assetid: 1a8d25af-479f-42d3-bf5f-c7fd974bbf8c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -24,29 +27,31 @@ You can use the MED-V Workspace Packager to manage URL redirection in the MED-V
 
 3.  In the **Manage Web Redirection** window, you can type, paste, or import a list of the URLs that are redirected to Internet Explorer in the MED-V workspace.
 
-    **Note**  
+    **Note**  
     URL redirection in MED-V only supports the protocols HTTP and HTTPS. MED-V does not provide support for FTP or any other protocols.
 
-     
 
-    Enter each web address on a single line, for example:
 
-    http://www.contoso.com/webapps/webapp1
+~~~
+Enter each web address on a single line, for example:
 
-    http://www.contoso.com/webapps/webapp2
+http://www.contoso.com/webapps/webapp1
 
-    http://\*.contoso.com
+http://www.contoso.com/webapps/webapp2
 
-    http://www.contoso.com/webapps/\*
+http://\*.contoso.com
 
-    **Important**  
-    If you import a text file that includes a URL that uses special characters (such as ~ ! @ \# and so on), make sure that you specify UTF-8 encoding when you save the text file. Special characters do not import correctly into the MED-V Workspace Packager if the text file was saved using the default ANSI encoding.
+http://www.contoso.com/webapps/\*
 
-     
+**Important**  
+If you import a text file that includes a URL that uses special characters (such as ~ ! @ \# and so on), make sure that you specify UTF-8 encoding when you save the text file. Special characters do not import correctly into the MED-V Workspace Packager if the text file was saved using the default ANSI encoding.
+~~~
 
-4.  Click **Save as…** to save the updated URL redirection files in the specified folder. MED-V creates a registry file that contains the updated URL redirection information. Deploy the updated registry key by using Group Policy. For more information about how to use Group Policy, see [Group Policy Software Installation](https://go.microsoft.com/fwlink/?LinkId=195931) (https://go.microsoft.com/fwlink/?LinkId=195931).
 
-    MED-V also creates a Windows PowerShell script in the specified folder that you can use to re-create the updated MED-V workspace package.
+
+4. Click **Save as…** to save the updated URL redirection files in the specified folder. MED-V creates a registry file that contains the updated URL redirection information. Deploy the updated registry key by using Group Policy. For more information about how to use Group Policy, see [Group Policy Software Installation](https://go.microsoft.com/fwlink/?LinkId=195931) (https://go.microsoft.com/fwlink/?LinkId=195931).
+
+   MED-V also creates a Windows PowerShell script in the specified folder that you can use to re-create the updated MED-V workspace package.
 
 ## Related topics
 
@@ -55,9 +60,9 @@ You can use the MED-V Workspace Packager to manage URL redirection in the MED-V
 
 [Manage MED-V URL Redirection](manage-med-v-url-redirection.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md b/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md
index c5d056790b..7f5beda9c6 100644
--- a/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md
+++ b/mdop/medv-v2/how-to-manually-install-the-med-v-host-agent.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manually Install the MED-V Host Agent
 description: How to Manually Install the MED-V Host Agent
-author: jamiejdt
+author: dansimp
 ms.assetid: 4becc90b-6481-4e1f-a4d3-aec74c8821ec
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,12 +24,12 @@ Typically, you deploy and install the MED-V Host Agent by using your company’s
 **Note**  
 The MED-V Guest Agent is installed automatically during first time setup.
 
- 
+ 
 
 **Important**  
 Close Internet Explorer before you install the MED-V Host Agent, otherwise conflicts can occur later with URL redirection. You can also do this by specifying a computer restart during a distribution.
 
- 
+ 
 
 **To install the MED-V Host Agent**
 
@@ -49,7 +52,7 @@ Close Internet Explorer before you install the MED-V Host Agent, otherwise confl
 **Note**  
 Until a MED-V workspace is installed, the MED-V Host Agent can be started and runs, but provides no functionality.
 
- 
+ 
 
 ## Related topics
 
@@ -60,9 +63,9 @@ Until a MED-V workspace is installed, the MED-V Host Agent can be started and ru
 
 [How to Uninstall the MED-V Components](how-to-uninstall-the-med-v-components.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md b/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md
index 0aa54f39d3..828340b98c 100644
--- a/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md
+++ b/mdop/medv-v2/how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: How to Publish and Unpublish an Application on the MED-V Workspace
 description: How to Publish and Unpublish an Application on the MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: fd5a62e9-0577-44d2-ae17-61c0aef78ce8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ In some cases, you might want to install applications on the MED-V workspace wit
 **Important**  
 If you publish an application that does not support UNC paths, we recommend that you map the application to a drive.
 
- 
+ 
 
 You can publish or unpublish applications to a deployed MED-V workspace by performing one of the following tasks:
 
@@ -42,14 +45,14 @@ You can publish or unpublish applications to a deployed MED-V workspace by perfo
     **Note**  
     Frequently, the shortcut is automatically deleted from the host computer **Start** menu when you uninstall the application. However, in some cases, such as for a MED-V workspace that is configured for all users of a shared computer, you might have to manually delete the shortcut on the **Start** menu after the application is uninstalled. The end-user can do this by right-clicking the shortcut and selecting **Delete**.
 
-     
+     
 
 To test that the application was published or unpublished, verify on the MED-V workspace whether the corresponding shortcut is available or not.
 
 **Note**  
 Applications that are included in Windows XP SP3 and are located in the virtual machine Start Menu folder are not automatically published to the host. They are controlled by registry settings that block automatic publishing. For more information, see [Windows Virtual PC Application Exclude List](windows-virtual-pc-application-exclude-list.md).
 
- 
+ 
 
 **To publish Control Panel items**
 
@@ -64,7 +67,7 @@ Applications that are included in Windows XP SP3 and are located in the virtual
 **Caution**  
 When you create the shortcut, do not specify %SystemRoot%\\control.exe. This application will not be published because it is contained in the registry settings that block automatic publishing.
 
- 
+ 
 
 **How MED-V handles automatic application publishing**
 
@@ -87,7 +90,7 @@ When you create the shortcut, do not specify %SystemRoot%\\control.exe. This app
 **Note**  
 A folder must already exist in the host computer Start Menu folder for MED-V to copy the shortcut there. MED-V does not create the folder if it does not already exist.
 
- 
+ 
 
 ## Related topics
 
@@ -98,9 +101,9 @@ A folder must already exist in the host computer Start Menu folder for MED-V to
 
 [Windows Virtual PC Application Exclude List](windows-virtual-pc-application-exclude-list.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/how-to-test-application-publishing.md b/mdop/medv-v2/how-to-test-application-publishing.md
index 4c217d9a2e..2270008b6e 100644
--- a/mdop/medv-v2/how-to-test-application-publishing.md
+++ b/mdop/medv-v2/how-to-test-application-publishing.md
@@ -1,12 +1,15 @@
 ---
 title: How to Test Application Publishing
 description: How to Test Application Publishing
-author: jamiejdt
+author: dansimp
 ms.assetid: 17ba2e12-50a0-4f41-8300-f61f09db9f6c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 11/01/2016
 ---
 
@@ -62,9 +65,9 @@ After you have completed testing your MED-V workspace package and have verified
 
 [Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/how-to-test-url-redirection.md b/mdop/medv-v2/how-to-test-url-redirection.md
index bc9d391040..3a46ee7100 100644
--- a/mdop/medv-v2/how-to-test-url-redirection.md
+++ b/mdop/medv-v2/how-to-test-url-redirection.md
@@ -1,12 +1,15 @@
 ---
 title: How to Test URL Redirection
 description: How to Test URL Redirection
-author: jamiejdt
+author: dansimp
 ms.assetid: 38d80088-da1d-4098-b27e-76f9e78f81dc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 11/01/2016
 ---
 
@@ -59,9 +62,9 @@ After you have completed testing your MED-V workspace package and have verified
 
 [Deploying the MED-V Workspace Package](deploying-the-med-v-workspace-package.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/how-to-uninstall-the-med-v-components.md b/mdop/medv-v2/how-to-uninstall-the-med-v-components.md
index 97639cb578..f1eeaa5b43 100644
--- a/mdop/medv-v2/how-to-uninstall-the-med-v-components.md
+++ b/mdop/medv-v2/how-to-uninstall-the-med-v-components.md
@@ -1,12 +1,15 @@
 ---
 title: How to Uninstall the MED-V Components
 description: How to Uninstall the MED-V Components
-author: jamiejdt
+author: dansimp
 ms.assetid: c121dd27-6b2f-4d41-a21a-c6e8608c5c41
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -21,7 +24,7 @@ Typically, you can configure your electronic software distribution (ESD) system
 **Important**  
 Before you can uninstall the MED-V Host Agent, you must first uninstall any installed MED-V workspace.
 
- 
+ 
 
 Use the following procedures to uninstall the MED-V components from your enterprise.
 
@@ -48,7 +51,7 @@ The ESD client recognizes when the new packages are available and starts to unin
     **Note**  
     If MED-V is currently running, a dialog box appears and prompts you whether you want to shut it down. Click **Yes** to continue with the uninstallation. Click **No** to cancel the uninstallation.
 
-     
+     
 
 Alternately, you can remove a MED-V workspace by running the `uninstall.exe` file, typically located at C:\\ProgramData\\Microsoft\\Medv\\Workspace.
 
@@ -63,7 +66,7 @@ Alternately, you can remove a MED-V workspace by running the `uninstall.exe` fil
     **Note**  
     If you try to uninstall the MED-V Host Agent before you uninstall the MED-V workspace, a dialog box appears that states that you must first uninstall the MED-V workspace. Click **OK** to continue.
 
-     
+     
 
 **To manually uninstall the MED-V Workspace Packager**
 
@@ -76,16 +79,16 @@ Alternately, you can remove a MED-V workspace by running the `uninstall.exe` fil
     **Note**  
     You can uninstall the MED-V Workspace Packager at any time without affecting any deployed MED-V workspaces.
 
-     
+     
 
 ## Related topics
 
 
 [Deploy the MED-V Components](deploy-the-med-v-components.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/how-to-verify-first-time-setup-settings.md b/mdop/medv-v2/how-to-verify-first-time-setup-settings.md
index 4daef057f8..4be201579a 100644
--- a/mdop/medv-v2/how-to-verify-first-time-setup-settings.md
+++ b/mdop/medv-v2/how-to-verify-first-time-setup-settings.md
@@ -1,12 +1,15 @@
 ---
 title: How to Verify First Time Setup Settings
 description: How to Verify First Time Setup Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: e8a07d4c-5786-4455-ac43-2deac4042efd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -19,7 +22,7 @@ While your test of first time setup is running or after it finishes, you can ver
 **Note**  
 For information about how to monitor the successful completion of first time setup throughout your enterprise after deployment, see [Monitoring MED-V Workspace Deployments](monitoring-med-v-workspace-deployments.md).
 
- 
+ 
 
 **To verify settings during first time setup**
 
@@ -48,7 +51,7 @@ For information about how to monitor the successful completion of first time set
         **Note**  
         You can close the virtual machine window at any time and first time setup continues.
 
-         
+         
 
 **To verify settings after first time setup finishes**
 
@@ -81,7 +84,7 @@ For information about how to monitor the successful completion of first time set
 **Note**  
 If you encounter any problems when verifying your first time setup settings, see [Operations Troubleshooting](operations-troubleshooting-medv2.md).
 
- 
+ 
 
 After you have verified that your first time setup settings are correct, you can test other MED-V workspace configurations to verify that they function as intended, such as application publishing and URL redirection.
 
@@ -98,9 +101,9 @@ After you have completed all testing of your MED-V workspace package and have ve
 
 [Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md b/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md
index 0112f0c6b0..0b5b8bf849 100644
--- a/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md
+++ b/mdop/medv-v2/identifying-the-number-and-types-of-med-v-workspaces.md
@@ -1,12 +1,15 @@
 ---
 title: Identifying the Number and Types of MED-V Workspaces
 description: Identifying the Number and Types of MED-V Workspaces
-author: jamiejdt
+author: dansimp
 ms.assetid: 11642253-6b1f-4c4a-a11e-48d8a360e1ea
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -42,7 +45,7 @@ To calculate the required disk space, determine the following:
     **Important**  
     Do not use the .medv file size for your calculation because the .medv file is compressed.
 
-     
+     
 
 -   **Users per computer** – MED-V creates a MED-V workspace for each user on a computer; the MED-V workspace consumes disk space as each user logs on and the MED-V workspace is created.
 
@@ -57,7 +60,7 @@ The following example shows a calculation based on three users of a MED-V worksp
 **Note**  
 A MED-V best practice is to calculate the required space by using a lab deployment to validate the requirements.
 
- 
+ 
 
 ### Locate the Files to Determine File Size
 
@@ -95,7 +98,7 @@ The following locations contain the files for the computer and user settings:
 
 
 
- 
+ 
 
 ### Calculate the Disk Space Requirements for Shared MED-V Workspaces
 
@@ -110,9 +113,9 @@ You can find the differencing disk and the saved state file for shared MED-V wor
 
 [Planning for MED-V](planning-for-med-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/index.md b/mdop/medv-v2/index.md
index 5c86cb32d1..aa6fcbf448 100644
--- a/mdop/medv-v2/index.md
+++ b/mdop/medv-v2/index.md
@@ -1,12 +1,12 @@
 ---
 title: Microsoft Enterprise Desktop Virtualization 2.0
 description: Microsoft Enterprise Desktop Virtualization 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 84109be0-4613-42e9-85fc-fcda8de6e4c4
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md b/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md
index eae1b6e175..211567c714 100644
--- a/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md
+++ b/mdop/medv-v2/installing-and-removing-an-application-on-the-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: Installing and Removing an Application on the MED-V Workspace
 description: Installing and Removing an Application on the MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: 24f32720-51ab-4385-adfe-4f5a65e45fdf
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -29,12 +32,12 @@ After you have deployed a MED-V workspace, you have several different options av
 **Important**  
 To make sure that an installed application is automatically published to the host, install the application on the virtual machine for **All Users**. For more information about application publishing, see [How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md).
 
- 
+ 
 
 **Tip**  
 MED-V does not support guest-to-host redirection for content handling, such as double-clicking a Microsoft Word document in Internet Explorer in the MED-V workspace. Therefore, the required applications, such as Microsoft Word, must be installed in MED-V workspace to provide the default content handling functionality that an end user might expect.
 
- 
+ 
 
 ##  Adding and Removing Applications by Using Group Policy
 
@@ -64,7 +67,7 @@ App-V applications that you publish to the MED-V workspace have file-type associ
 
 To force redirection of those file-type associations, query App-V for mapped file type associations by typing the following at a command prompt in the guest virtual machine: **sftmime /QUERY OBJ:TYPE**. Then, map those file type associations in the host computer.
 
- 
+ 
 
 ##  Adding and Removing Applications on the Core Image
 
@@ -76,14 +79,14 @@ For more information about how to add or remove applications on the core image,
 **Important**  
 We do not recommend this method of managing applications. If you add or remove applications on the core image and redeploy the MED-V workspace back out to your enterprise, first time setup must run again, and any data saved on the virtual machine is lost.
 
- 
+ 
 
 **Note**  
 Even though an application is installed into a MED-V workspace, you might also have to publish the application before it becomes available to the end user. For example, you might have to publish an installed application if the installation did not automatically create a shortcut on the **Start** menu. Likewise, to unpublish an application, you might have to manually remove a shortcut from the **Start** menu.
 
 By default, most applications are published at the time that they are installed, when shortcuts are automatically created and enabled.
 
- 
+ 
 
 ## Related topics
 
@@ -92,9 +95,9 @@ By default, most applications are published at the time that they are installed,
 
 [How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md b/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md
index 360abf2f95..79b0dac9fd 100644
--- a/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md
+++ b/mdop/medv-v2/installing-applications-on-a-windows-virtual-pc-image.md
@@ -1,12 +1,15 @@
 ---
 title: Installing Applications on a Windows Virtual PC Image
 description: Installing Applications on a Windows Virtual PC Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 32651eff-e3c6-4ef4-947d-2beddc695eac
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -21,7 +24,7 @@ The following section provides information to help you install software on the M
 **Caution**  
 For ease of MED-V workspace management after deployment, we recommend that you limit the number of components that you install on the MED-V image to those components that are required or that are helpful when using MED-V. For example, although they are not required to run MED-V, you can install an ESD system to use later for installing applications to a MED-V workspace and antivirus software for security on the image.
 
- 
+ 
 
 **Installing Software on a MED-V Image**
 
@@ -38,7 +41,7 @@ For ease of MED-V workspace management after deployment, we recommend that you l
     **Note**  
     After installation is complete, you might have to close and then restart the virtual machine.
 
-     
+     
 
 Repeat these steps for any software or application that you want to install on the MED-V image. We recommend that you limit the number of applications that you preinstall on the image. The recommended process for installing applications and other software on the image is to preinstall an ESD system now and to use it later to deploy software to the image. Alternately, you can also use Group Policy or App-V to add or remove applications on a MED-V workspace. For more information, see [Managing Applications Deployed to MED-V Workspaces](managing-applications-deployed-to-med-v-workspaces.md).
 
@@ -57,9 +60,9 @@ After you have installed all of the software that you want on the MED-V image, y
 
 [Prepare a MED-V Image](prepare-a-med-v-image.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/manage-med-v-url-redirection.md b/mdop/medv-v2/manage-med-v-url-redirection.md
index a584cd7963..e96d3304dc 100644
--- a/mdop/medv-v2/manage-med-v-url-redirection.md
+++ b/mdop/medv-v2/manage-med-v-url-redirection.md
@@ -1,12 +1,15 @@
 ---
 title: Manage MED-V URL Redirection
 description: Manage MED-V URL Redirection
-author: jamiejdt
+author: dansimp
 ms.assetid: 274161c0-b54a-4364-bb63-89996afccd04
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/manage-med-v-workspace-applications.md b/mdop/medv-v2/manage-med-v-workspace-applications.md
index c390acf3d9..99114c8379 100644
--- a/mdop/medv-v2/manage-med-v-workspace-applications.md
+++ b/mdop/medv-v2/manage-med-v-workspace-applications.md
@@ -1,12 +1,15 @@
 ---
 title: Manage MED-V Workspace Applications
 description: Manage MED-V Workspace Applications
-author: jamiejdt
+author: dansimp
 ms.assetid: f58c7504-a77a-41a8-ac38-7e618da131fb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/manage-med-v-workspace-settings.md b/mdop/medv-v2/manage-med-v-workspace-settings.md
index b3e38bc73b..4710c68f25 100644
--- a/mdop/medv-v2/manage-med-v-workspace-settings.md
+++ b/mdop/medv-v2/manage-med-v-workspace-settings.md
@@ -1,12 +1,15 @@
 ---
 title: Manage MED-V Workspace Settings
 description: Manage MED-V Workspace Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: 35ebd16e-31c7-4996-81be-af1d56346803
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md b/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md
index 80ff06a915..4b652b29fc 100644
--- a/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md
+++ b/mdop/medv-v2/managing-applications-deployed-to-med-v-workspaces.md
@@ -1,12 +1,15 @@
 ---
 title: Managing Applications Deployed to MED-V Workspaces
 description: Managing Applications Deployed to MED-V Workspaces
-author: jamiejdt
+author: dansimp
 ms.assetid: 9a9bcdf5-0aa7-42a3-b6f0-6065adb01bcb
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md b/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md
index c4c8b8fc8e..9cd51b0d7b 100644
--- a/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md
+++ b/mdop/medv-v2/managing-automatic-updates-for-med-v-workspaces.md
@@ -1,12 +1,15 @@
 ---
 title: Managing Automatic Updates for MED-V Workspaces
 description: Managing Automatic Updates for MED-V Workspaces
-author: jamiejdt
+author: dansimp
 ms.assetid: 306f28a2-d653-480d-b737-4b8b3132de5d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -24,7 +27,7 @@ The MED-V workspace wake-up policy guarantees that the MED-V virtual machine is
 **Important**  
 The MED-V workspace wake-up policy is optimized for the Microsoft Update infrastructure. If you are using Microsoft System Center Configuration Manager to deploy non-Microsoft updates, we recommend that you also use the System Center Updates Publisher, which takes advantage of the same infrastructure as Microsoft Update and therefore benefits from the MED-V workspace wake-up policy. For more information, see [System Center Updates Publisher](https://go.microsoft.com/fwlink/?LinkId=200035) (https://go.microsoft.com/fwlink/?LinkId=200035).
 
- 
+ 
 
 When you created your MED-V workspace package, you configured when and how it starts, either when the end user logs on (**Fast Start**) or when the end user first opens a published application (**Normal Start**). Or you set the option to let the end user control this setting.
 
@@ -35,7 +38,7 @@ However, for those cases in which **Fast Start** is not specified or the virtual
 **Note**  
 If the end user opens a published application during the update period, the required updates are applied, but MED-V is not automatically hibernated or shut down after the update period ends. Instead, MED-V continues running.
 
- 
+ 
 
 The MED-V workspace wake-up policy includes three main components:
 
@@ -64,7 +67,7 @@ For more information about how to define your MED-V configuration values, see [M
 **Note**  
 A MED-V best practice is to set your wake up interval to match the time when MED-V virtual machines are planned to be updated regularly. In addition, we recommend that you configure these settings to resemble the host computer’s behavior.
 
- 
+ 
 
 ### Reboot Notification Using your ESD System
 
@@ -73,7 +76,7 @@ You can configure your ESD system to notify MED-V whenever a restart is required
 **Important**  
 You must open the event with Modify Only rights and then signal it. If you do not open it with the correct permissions, it does not work.
 
- 
+ 
 
 ``` syntax
 /// 
@@ -94,9 +97,9 @@ When you signal this event, MED-V captures it and informs the virtual machine th
 
 [Managing Software Updates for MED-V Workspaces](managing-software-updates-for-med-v-workspaces.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md b/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md
index 5cbb5c1263..fb482d47b6 100644
--- a/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md
+++ b/mdop/medv-v2/managing-med-v-workspace-configuration-settings.md
@@ -1,12 +1,15 @@
 ---
 title: Managing MED-V Workspace Configuration Settings
 description: Managing MED-V Workspace Configuration Settings
-author: jamiejdt
+author: dansimp
 ms.assetid: 517d04de-c31f-4b50-b2b3-5f8c312ed37b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,12 +33,12 @@ If the value is still not found, MED-V uses the default.
 
 A general best practice is to set the value in the HKEY\_LOCAL\_MACHINE\\System hive or in the machine policy. But if you want the end user to be able to configure a particular setting, then you should leave it out.
 
-**Note**  
+**Note**  
 Before you deploy your MED-V workspaces, you can use a script editor to change the Windows PowerShell script (.ps1 file) that the MED-V workspace packager created. For more information, see [Configuring Advanced Settings by Using Windows PowerShell](configuring-advanced-settings-by-using-windows-powershell.md).
 
 After you have deployed your MED-V workspaces, you can change certain MED-V configuration settings by editing the registry entries.
 
- 
+
 
 This section lists all the configurable MED-V registry keys and explains their uses.
 
@@ -53,23 +56,23 @@ The following table provides information about the registry values associated wi
 
 
 
-Name 
-Type 
-Data/Default 
-Description 
+Name 
+Type 
+Data/Default 
+Description 
 
 
 
 
-
    EventLogLevel 
    
-
    DWORD 
    
+
    EventLogLevel 
    
+
    DWORD 
    
 
    Default=3
    
 
    The type of information that is logged in the event log. Levels include the following: 0 (None), 1 (Error), 2 (Warning), 3 (Information), 4 (Debug).
    
 
 
 
 
- 
+
 
 ## Fts Key
 
@@ -93,28 +96,28 @@ The following table provides information about the registry values associated wi
 
 
 
-
    AddUserToAdminGroupEnabled 
    
+
    AddUserToAdminGroupEnabled 
    
 
    DWORD
    
 
    Default=0
    
-
    Configures whether first time setup automatically adds the end user to the administrator's group. 0 = false; 1 = true.
    
+
    Configures whether first time setup automatically adds the end user to the administrator's group. 0 = false; 1 = true.
    
 
 
 
    
 
    
 
    
-
    0 = false: First time setup does not automatically add the end user to the administrator's group.
    
+
    0 = false: First time setup does not automatically add the end user to the administrator's group.
    
 
 
 
    
 
    
 
    
-
    1 = true: First time setup automatically adds the end user to the administrator's group.
    
+
    1 = true: First time setup automatically adds the end user to the administrator's group.
    
 
 
-
    ComputerNameMask 
    
+
    ComputerNameMask 
    
 
    SZ
    
-
    MEDV* 
    
-
    The computer name mask that is used to create the guest virtual machine's computer name.
    
+
    MEDV* 
    
+
    The computer name mask that is used to create the guest virtual machine's computer name.
    
 
 
 
    
@@ -128,67 +131,67 @@ The following table provides information about the registry values associated wi
 
    DeleteVMStateTimeout
    
 
    DWORD
    
 
    Default=90
    
-
    The time-out value, in seconds, when first time setup tries to delete the virtual machine. Range = 0 to 2147483647.
    
+
    The time-out value, in seconds, when first time setup tries to delete the virtual machine. Range = 0 to 2147483647.
    
 
 
 
    DetachVfdTimeout
    
 
    DWORD
    
 
    Default=120
    
-
    The time-out value, in seconds, when first time setup tries to detach the virtual floppy disk from the virtual machine. Range = 0 to 2147483647.
    
+
    The time-out value, in seconds, when first time setup tries to detach the virtual floppy disk from the virtual machine. Range = 0 to 2147483647.
    
 
 
-
    DialogUrl 
    
+
    DialogUrl 
    
 
    SZ
    
 
    
-
    Customizable URL that links to internal webpage and is displayed by first time setup dialog messages. 
    
+
    Customizable URL that links to internal webpage and is displayed by first time setup dialog messages. 
    
 
 
 
    ExplorerTimeout
    
 
    DWORD
    
 
    Default=900
    
-
    The time-out value, in seconds, that first time setup waits for Windows Explorer. Range = 0 to 2147483647.
    
+
    The time-out value, in seconds, that first time setup waits for Windows Explorer. Range = 0 to 2147483647.
    
 
 
-
    FailureDialogMsg 
    
+
    FailureDialogMsg 
    
 
    MULTI_SZ
    
-
    Message is found in resource file 
    
+
    Message is found in resource file 
    
 
    Customizable message that is displayed to the end user when first time setup cannot be completed.
    
 
 
-
    GiveUserGroupRightsMaxRetryCount 
    
-
    DWORD 
    
+
    GiveUserGroupRightsMaxRetryCount 
    
+
    DWORD 
    
 
    Default=3
    
 
    The maximum number of times that MED-V tries to give an end user group rights. Exceeding the specified retry value without being able to successfully give an end user group rights most likely causes a virtual machine preparation failure that is then subject to the MaxRetryCount value. Range = 0 to 2147483647.
    
 
 
-
    GiveUserGroupRightsTimeout 
    
+
    GiveUserGroupRightsTimeout 
    
 
    DWORD
    
 
    Default=300
    
-
    The time-out value, in seconds, when giving a user group rights. Range = 0 to 2147483647.
    
+
    The time-out value, in seconds, when giving a user group rights. Range = 0 to 2147483647.
    
 
 
-
    LogFilePaths 
    
+
    LogFilePaths 
    
 
    MULTI_SZ
    
 
    
-
    A list of the log file paths that MED-V collects during first time setup. 
    
+
    A list of the log file paths that MED-V collects during first time setup. 
    
 
 
-
    MaxPostponeTime 
    
+
    MaxPostponeTime 
    
 
    DWORD
    
 
    Default=120
    
-
    The maximum number of hours that first time setup can be postponed by the end user. Range = 0 to 2147483647.
    
+
    The maximum number of hours that first time setup can be postponed by the end user. Range = 0 to 2147483647.
    
 
 
-
    MaxRetryCount 
    
+
    MaxRetryCount 
    
 
    DWORD
    
 
    Default=3
    
 
    The maximum number of times that MED-V tries to prepare a virtual machine if each attempt ends in a failure other than a software error. When virtual machine preparation fails and the number of first time setup retries is exceeded, then MED-V informs the end user about the failure and does not give the option to retry. The count is re-set every time that MED-V is started. Range = 0 to 2147483647.
    
 
 
-
    Mode 
    
+
    Mode 
    
 
    SZ
    
 
    Default=Unattended
    
-
    Configures how first time setup interacts with the user. Possible values are as follows:
    
+
    Configures how first time setup interacts with the user. Possible values are as follows:
    
 
 
 
    
@@ -196,11 +199,10 @@ The following table provides information about the registry values associated wi
 
    
 
    Attended. The end user must enter information during first time setup.
    
 
    
-Note  
-
    If you created the Sysprep.inf file so that Mini-Setup requires user input to complete, then you must select Attended mode or problems might occur during first time setup.
    
+Note
    If you created the Sysprep.inf file so that Mini-Setup requires user input to complete, then you must select Attended mode or problems might occur during first time setup.
    
 
    
 
    
- 
+
 
    
 
 
@@ -216,34 +218,34 @@ The following table provides information about the registry values associated wi
 
    Silent. The virtual machine is not shown to the end user at all during first time setup.
    
 
 
-
    NonInteractiveRetryTimeoutInc 
    
+
    NonInteractiveRetryTimeoutInc 
    
 
    DWORD
    
 
    Default=15
    
-
    The time-out value, in minutes, that first time setup must be completed in first time setup interactive mode when re-attempting setup. Range = 0 to 2147483647.
    
+
    The time-out value, in minutes, that first time setup must be completed in first time setup interactive mode when re-attempting setup. Range = 0 to 2147483647.
    
 
 
-
    NonInteractiveTimeout 
    
+
    NonInteractiveTimeout 
    
 
    DWORD
    
 
    Default=45
    
-
    The time-out value, in minutes, that first time setup must be completed in first time setup interactive mode. Range = 0 to 2147483647.
    
+
    The time-out value, in minutes, that first time setup must be completed in first time setup interactive mode. Range = 0 to 2147483647.
    
 
 
-
    PostponeUtcDateTimeLimit 
    
+
    PostponeUtcDateTimeLimit 
    
 
    SZ
    
 
    
-
    The date and time, in UTC DateTime format, that first time setup can be postponed. Enter in the format "yyyy-MM-dd hh:mm" with hours specified by using the 24-hour clock standard.
    
+
    The date and time, in UTC DateTime format, that first time setup can be postponed. Enter in the format "yyyy-MM-dd hh:mm" with hours specified by using the 24-hour clock standard.
    
 
 
-
    RetryDialogMsg 
    
+
    RetryDialogMsg 
    
 
    MULTI_SZ
    
-
    Message is found in resource file 
    
+
    Message is found in resource file 
    
 
    Customizable message that is displayed to the end user when first time setup must re-attempt setup.
    
 
 
-
    SetComputerNameEnabled 
    
+
    SetComputerNameEnabled 
    
 
    DWORD
    
 
    Default=0
    
-
    Configures whether the ComputerName entry under the [UserData] section of the Sysprep.inf file in the guest should be updated according to the specified ComputerNameMask.   0 = false; 1 = true.
    
+
    Configures whether the ComputerName entry under the [UserData] section of the Sysprep.inf file in the guest should be updated according to the specified ComputerNameMask.   0 = false; 1 = true.
    
 
 
 
    
@@ -258,10 +260,10 @@ The following table provides information about the registry values associated wi
 
    1 = true: The ComputerName entry in the Sysprep.inf file is updated according to the ComputerNameMask.
    
 
 
-
    SetJoinDomainEnabled 
    
+
    SetJoinDomainEnabled 
    
 
    DWORD
    
 
    Default=0
    
-
    Configures whether the JoinDomain setting under the [Identification] section of the Sysprep.inf file in the guest should be updated to match the settings on the host.  0 = false; 1 = true.
    
+
    Configures whether the JoinDomain setting under the [Identification] section of the Sysprep.inf file in the guest should be updated to match the settings on the host.  0 = false; 1 = true.
    
 
 
 
    
@@ -276,10 +278,10 @@ The following table provides information about the registry values associated wi
 
    1 = true: The JoinDomain setting in the Sysprep.inf file is updated to match the settings on the host.
    
 
 
-
    SetMachineObjectOUEnabled 
    
+
    SetMachineObjectOUEnabled 
    
 
    DWORD
    
 
    Default=0
    
-
    Configures whether the MachineObjectOU setting under the [Identification] section of the Sysprep.inf file in the guest is updated to match the host.  0 = false; 1 = true.
    
+
    Configures whether the MachineObjectOU setting under the [Identification] section of the Sysprep.inf file in the guest is updated to match the host.  0 = false; 1 = true.
    
 
 
 
    
@@ -294,16 +296,15 @@ The following table provides information about the registry values associated wi
 
    1 = true: The MachineObjectOU setting in the Sysprep.inf file is updated to match the settings on the host.
    
 
 
-
    SetRegionalSettingsEnabled 
    
+
    SetRegionalSettingsEnabled 
    
 
    DWORD
    
 
    Default=0
    
-
    Configures whether the settings under the [RegionalSettings] section of the Sysprep.inf file in the guest are updated to match the host.  0 = false; 1 = true.
    
+
    Configures whether the settings under the [RegionalSettings] section of the Sysprep.inf file in the guest are updated to match the host.  0 = false; 1 = true.
    
 
    
-Note  
-
    By default, the setting for TimeZone in the guest is always synchronized with the TimeZone setting in the host.
    
+Note
    By default, the setting for TimeZone in the guest is always synchronized with the TimeZone setting in the host.
    
 
    
 
    
- 
+
 
    
 
 
@@ -319,10 +320,10 @@ The following table provides information about the registry values associated wi
 
    1 = true: The settings under the [RegionalSettings] section of the Sysprep.inf file in the guest are updated to match the host.
    
 
 
-
    SetUserDataEnabled 
    
+
    SetUserDataEnabled 
    
 
    DWORD
    
 
    Default=0
    
-
    Configures whether the FullName and the OrgName settings under the [UserData] section of the Sysprep.inf file in the guest are updated to match the settings on the host.  0 = false; 1 = true.
    
+
    Configures whether the FullName and the OrgName settings under the [UserData] section of the Sysprep.inf file in the guest are updated to match the settings on the host.  0 = false; 1 = true.
    
 
 
 
    
@@ -337,22 +338,22 @@ The following table provides information about the registry values associated wi
 
    1 = true: The FullName and OrgName settings in the Sysprep.inf file are updated to match the settings on the host.
    
 
 
-
    StartDialogMsg 
    
+
    StartDialogMsg 
    
 
    MULTI_SZ
    
-
    Message is found in resource file 
    
-
    Customizable message that is displayed to the end user when first time setup is ready to start. 
    
+
    Message is found in resource file 
    
+
    Customizable message that is displayed to the end user when first time setup is ready to start. 
    
 
 
 
    TaskCancelTimeout
    
 
    DWORD
    
 
    Default=30
    
-
    The time-out value, in seconds, that first time setup waits for a response from the virtual machine for a Cancel operation. Range = 0 to 2147483647.
    
+
    The time-out value, in seconds, that first time setup waits for a response from the virtual machine for a Cancel operation. Range = 0 to 2147483647.
    
 
 
 
    TaskVMTurnOffTimeout
    
 
    DWORD
    
 
    Default=60
    
-
    The time-out value, in seconds, that first time setup waits for the virtual machine to shut down. Range = 0 to 2147483647.
    
+
    The time-out value, in seconds, that first time setup waits for the virtual machine to shut down. Range = 0 to 2147483647.
    
 
 
 
    UpgradeTimeout
    
@@ -363,7 +364,7 @@ The following table provides information about the registry values associated wi
 
 
 
- 
+
 
 ## UserExperience Key
 
@@ -387,10 +388,10 @@ The following table provides information about the registry values associated wi
 
 
 
-
    AppPublishingEnabled 
    
+
    AppPublishingEnabled 
    
 
    DWORD
    
 
    Default=1
    
-
    Configures whether application publication from the guest to the host is enabled.  0 = false; 1 = true.
    
+
    Configures whether application publication from the guest to the host is enabled.  0 = false; 1 = true.
    
 
 
 
    
@@ -405,10 +406,10 @@ The following table provides information about the registry values associated wi
 
    1 = true: Enables application publishing from the guest to the host.
    
 
 
-
    AudioSharingEnabled 
    
+
    AudioSharingEnabled 
    
 
    DWORD
    
 
    Default=1
    
-
    Configures whether the sharing of the audio I/O device between the guest and the host is enabled.  0 = false; 1 = true.
    
+
    Configures whether the sharing of the audio I/O device between the guest and the host is enabled.  0 = false; 1 = true.
    
 
 
 
    
@@ -423,10 +424,10 @@ The following table provides information about the registry values associated wi
 
    1 = true: Enables the sharing of the audio I/O device between the guest and the host.
    
 
 
-
    ClipboardSharingEnabled 
    
+
    ClipboardSharingEnabled 
    
 
    DWORD
    
 
    Default=1
    
-
    Configures whether the sharing of the Clipboard between the guest and the host is enabled.  0 = false; 1 = true.
    
+
    Configures whether the sharing of the Clipboard between the guest and the host is enabled.  0 = false; 1 = true.
    
 
 
 
    
@@ -444,7 +445,7 @@ The following table provides information about the registry values associated wi
 
    DialogTimeout
    
 
    DWORD
    
 
    Default=300
    
-
    The time, in seconds, before the first time setup Start Dialog times out. Range = 0 to 2147483647.
    
+
    The time, in seconds, before the first time setup Start Dialog times out. Range = 0 to 2147483647.
    
 
 
 
    HideVmTimeout
    
@@ -453,10 +454,10 @@ The following table provides information about the registry values associated wi
 
    The time-out value, in minutes, that the full-screen virtual machine window is hidden from the end user during a long logon attempt.
    
 
 
-
    LogonStartEnabled 
    
+
    LogonStartEnabled 
    
 
    DWORD
    
 
    Default=1
    
-
    Configures whether the guest should be started when the end user logs on to the desktop or when the first guest application is started.  0 = false; 1 = true.
    
+
    Configures whether the guest should be started when the end user logs on to the desktop or when the first guest application is started.  0 = false; 1 = true.
    
 
 
 
    
@@ -471,10 +472,10 @@ The following table provides information about the registry values associated wi
 
    1 = true: The guest is started when the end user logs on to the desktop.
    
 
 
-
    PrinterSharingEnabled 
    
+
    PrinterSharingEnabled 
    
 
    DWORD
    
 
    Default=1
    
-
    Configures whether the sharing of printers between the guest and the host is enabled.  0 = false; 1 = true.
    
+
    Configures whether the sharing of printers between the guest and the host is enabled.  0 = false; 1 = true.
    
 
 
 
    
@@ -489,16 +490,16 @@ The following table provides information about the registry values associated wi
 
    1 = true: Enables the sharing of printers between the guest and the host.
    
 
 
-
    RebootAbsoluteDelayTimeout 
    
+
    RebootAbsoluteDelayTimeout 
    
 
    DWORD
    
 
    Default=1440
    
-
    The time-out value, in minutes, that first time setup waits for a restart. Range = 0 to 2147483647.
    
+
    The time-out value, in minutes, that first time setup waits for a restart. Range = 0 to 2147483647.
    
 
 
-
    RedirectUrls 
    
+
    RedirectUrls 
    
 
    MULTI_SZ
    
 
    Specified URL list
    
-
    Specifies a list of URLs to be redirected from the host to the guest. 
    
+
    Specifies a list of URLs to be redirected from the host to the guest. 
    
 
 
 
    SmartCardLogonEnabled
    
@@ -518,18 +519,17 @@ The following table provides information about the registry values associated wi
 
    
 
    1 = true: Lets Smart Cards authenticate end users to MED-V.
    
 
    
-Important  
-
    If SmartCardLogonEnabled and CredentialCacheEnabled are both enabled, SmartCardLogonEnabled overrides CredentialCacheEnabled.
    
+Important
    If SmartCardLogonEnabled and CredentialCacheEnabled are both enabled, SmartCardLogonEnabled overrides CredentialCacheEnabled.
    
 
    
 
    
- 
+
 
    
 
 
-
    SmartCardSharingEnabled 
    
+
    SmartCardSharingEnabled 
    
 
    DWORD
    
 
    Default=1
    
-
    Configures whether the sharing of Smart Cards between the guest and the host is enabled.  0 = false; 1 = true.
    
+
    Configures whether the sharing of Smart Cards between the guest and the host is enabled.  0 = false; 1 = true.
    
 
 
 
    
@@ -544,10 +544,10 @@ The following table provides information about the registry values associated wi
 
    1 = true: Enables the sharing of Smart Cards between the guest and the host.
    
 
 
-
    USBDeviceSharingEnabled 
    
+
    USBDeviceSharingEnabled 
    
 
    DWORD
    
 
    Default=1
    
-
    Configures whether the sharing of USB devices between the guest and the host is enabled.  0 = false; 1 = true.
    
+
    Configures whether the sharing of USB devices between the guest and the host is enabled.  0 = false; 1 = true.
    
 
 
 
    
@@ -564,7 +564,7 @@ The following table provides information about the registry values associated wi
 
 
 
- 
+
 
 ## VM Key
 
@@ -588,10 +588,10 @@ The following table provides information about the registry values associated wi
 
 
 
-
    CloseAction 
    
+
    CloseAction 
    
 
    SZ
    
 
    Default=HIBERNATE
    
-
    The action that the virtual machine performs after the last application that is running is closed. This setting is ignored if the LogonStartEnabled value is enabled. Possible options are as follows:
    
+
    The action that the virtual machine performs after the last application that is running is closed. This setting is ignored if the LogonStartEnabled value is enabled. Possible options are as follows:
    
 
 
 
    
@@ -612,36 +612,36 @@ The following table provides information about the registry values associated wi
 
    TURN-OFF. This option can cause data loss because it is the same as turning off the power button or pulling out the power cord on a physical computer. Use this option only if you cannot use one of the other two options.
    
 
 
-
    GuestMemFromHostMem 
    
+
    GuestMemFromHostMem 
    
 
    MULTI_SZ
    
-
    378, 512, 1024, 1536, 2048 
    
-
    A list of memory (MB) values for the guest. This value is used to determine how much RAM is available to the guest. Combined with HostMemToGuestMem, a lookup table is created to determine how much RAM to allocate on the guest virtual machine. Possible values can be from 128 to 3712.
    
+
    378, 512, 1024, 1536, 2048 
    
+
    A list of memory (MB) values for the guest. This value is used to determine how much RAM is available to the guest. Combined with HostMemToGuestMem, a lookup table is created to determine how much RAM to allocate on the guest virtual machine. Possible values can be from 128 to 3712.
    
 
 
-
    GuestUpdateDuration 
    
+
    GuestUpdateDuration 
    
 
    DWORD
    
 
    Default=240
    
-
    The number of minutes that MED-V should keep the guest awake for automatic updating, starting at the time specified in the GuestUpdateTime value. Range = 0 to 1440. Setting this value to zero (0) disables the guest patching functionality.
    
-
    For more information about guest patching for automatic updating, see [Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md).
    
+
    The number of minutes that MED-V should keep the guest awake for automatic updating, starting at the time specified in the GuestUpdateTime value. Range = 0 to 1440. Setting this value to zero (0) disables the guest patching functionality.
    
+
    For more information about guest patching for automatic updating, see Managing Automatic Updates for MED-V Workspaces.
    
 
 
-
    GuestUpdateTime 
    
+
    GuestUpdateTime 
    
 
    SZ
    
 
    Default=00:00
    
-
    The hour and minute each day when MED-V should wake up the guest for automatic updating, by using the 24-hour clock standard. Specify the time in the format HH:MM  
    
-
    For more information about guest patching for automatic updating, see [Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md).
    
+
    The hour and minute each day when MED-V should wake up the guest for automatic updating, by using the 24-hour clock standard. Specify the time in the format HH:MM  
    
+
    For more information about guest patching for automatic updating, see Managing Automatic Updates for MED-V Workspaces.
    
 
 
-
    HostMemToGuestMem 
    
+
    HostMemToGuestMem 
    
 
    MULTI_SZ
    
-
    1024, 2048, 4096, 8192, 16384 
    
-
    A list of memory (MB) values for the guest, determined by the RAM available on the host. Combined with GuestMemFromHostMem, a lookup table is created to determine how much RAM to allocate on the guest virtual machine. Possible values can be from 1024 to 16384.
    
+
    1024, 2048, 4096, 8192, 16384 
    
+
    A list of memory (MB) values for the guest, determined by the RAM available on the host. Combined with GuestMemFromHostMem, a lookup table is created to determine how much RAM to allocate on the guest virtual machine. Possible values can be from 1024 to 16384.
    
 
 
 
    HostMemToGuestMemCalcEnabled
    
 
    DWORD
    
 
    Default=1
    
-
    Configures whether the memory allocated for the guest is calculated from the memory present on the host.  0 = false; 1 = true.
    
+
    Configures whether the memory allocated for the guest is calculated from the memory present on the host.  0 = false; 1 = true.
    
 
 
 
    
@@ -656,16 +656,16 @@ The following table provides information about the registry values associated wi
 
    1 = true: The memory allocated for the guest is calculated from the memory present on the host.
    
 
 
-
    Memory 
    
+
    Memory 
    
 
    DWORD
    
 
    Default=512
    
-
    The RAM (MB) that should be allocated for the guest virtual machine. This setting is ignored if the HostMemToGuestMemEnabled setting is enabled. Range=128 to 2048.
    
+
    The RAM (MB) that should be allocated for the guest virtual machine. This setting is ignored if the HostMemToGuestMemEnabled setting is enabled. Range=128 to 2048.
    
 
 
-
    MultiUserEnabled 
    
+
    MultiUserEnabled 
    
 
    DWORD
    
 
    Default=0
    
-
    Configures whether multiple users share the same MED-V workspace.  0 = false; 1 = true.
    
+
    Configures whether multiple users share the same MED-V workspace.  0 = false; 1 = true.
    
 
 
 
    
@@ -680,10 +680,10 @@ The following table provides information about the registry values associated wi
 
    1 = true: Multiple users share the same MED-V workspace.
    
 
 
-
    NetworkingMode 
    
+
    NetworkingMode 
    
 
    SZ
    
 
    Default=NAT
    
-
    The kind of network connection used on the guest. Possible values are as follows:
    
+
    The kind of network connection used on the guest. Possible values are as follows:
    
 
 
 
    
@@ -695,18 +695,18 @@ The following table provides information about the registry values associated wi
 
    
 
    
 
    
-
    NAT. MED-V uses Network Address Translation (NAT) to share the host's IP for outgoing traffic.
    
+
    NAT. MED-V uses Network Address Translation (NAT) to share the host's IP for outgoing traffic.
    
 
 
-
    TaskTimeout 
    
+
    TaskTimeout 
    
 
    DWORD
    
 
    Default=600
    
-
    A general time-out value, in seconds, that MED-V waits for a task to be completed, such as restarting and shutting down. Range = 0 to 2147483647.
    
+
    A general time-out value, in seconds, that MED-V waits for a task to be completed, such as restarting and shutting down. Range = 0 to 2147483647.
    
 
 
 
 
- 
+
 
 ## Guest Registry Settings
 
@@ -726,17 +726,17 @@ The following table provides information about the guest registry value associat
 
 
 
-Name 
-Type 
-Data/Default 
+Name 
+Type 
+Data/Default 
 Description
 
 
 
 
 
    EnableGPWorkarounds
    
-
    DWORD 
    
-
    Default=1 
    
+
    DWORD 
    
+
    Default=1 
    
 
    Configures how MED-V handles the keys BufferPolicyReads and GroupPolicyMinTransferRate.
    
 
 
@@ -745,13 +745,12 @@ The following table provides information about the guest registry value associat
 
    
 
    By default, MED-V sets these keys as follows:
    
 
    BufferPolicyReads=1 and GroupPolicyMinTransferRate=0.
    
-
    Create the EnableGPWorkarounds  key, if it is necessary, and set the key to zero if you do not want MED-V to change the default settings of BufferPolicyReads and GroupPolicyMinTransferRate.
    
+
    Create the EnableGPWorkarounds  key, if it is necessary, and set the key to zero if you do not want MED-V to change the default settings of BufferPolicyReads and GroupPolicyMinTransferRate.
    
 
    
-Note  
-
    If your MED-V workspace is running in NAT mode, EnableGPWorkarounds affects the registry keys BufferPolicyReads and GroupPolicyMinTransferRate. If your MED-V workspace is running in BRIDGED mode, EnableGPWorkarounds only affects the registry key BufferPolicyReads.
    
+Note
    If your MED-V workspace is running in NAT mode, EnableGPWorkarounds affects the registry keys BufferPolicyReads and GroupPolicyMinTransferRate. If your MED-V workspace is running in BRIDGED mode, EnableGPWorkarounds only affects the registry key BufferPolicyReads.
    
 
    
 
    
- 
+
 
    
 
    1=true: MED-V sets the keys BufferPolicyReads=1 and GroupPolicyMinTransferRate=0 (if running in NAT mode) or just BufferPolicyReads=1 (if running in BRIDGED mode).
    
 
    0=false: MED-V does not make any changes to the keys BufferPolicyReads and GroupPolicyMinTransferRate.
    
@@ -759,7 +758,7 @@ The following table provides information about the guest registry value associat
 
 
 
- 
+
 
 ## Related topics
 
@@ -770,9 +769,9 @@ The following table provides information about the guest registry value associat
 
 [Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md b/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md
index 99c6025728..b27daa2e6f 100644
--- a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md
+++ b/mdop/medv-v2/managing-med-v-workspace-settings-by-using-a-wmi.md
@@ -1,12 +1,15 @@
 ---
 title: Managing MED-V Workspace Settings by Using a WMI
 description: Managing MED-V Workspace Settings by Using a WMI
-author: jamiejdt
+author: dansimp
 ms.assetid: 05a665a3-2309-46c1-babb-a3e3bbb0b1f9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -26,7 +29,7 @@ The WMI provider is implemented in the **root\\microsoft\\medv** namespace and i
 **Caution**  
 WMI browsing tools can be used to delete or modify classes and instances. Deleting or modifying certain classes and instances can result in the loss of valuable data and cause MED-V to function unpredictably.
 
- 
+ 
 
 You can use your preferred WMI browsing tool to view and edit MED-V configuration settings by following these steps.
 
@@ -53,7 +56,7 @@ After you have finished viewing or editing MED-V configuration settings, close t
 **Important**  
 In some cases, a restart of the MED-V workspace is required for changes to MED-V configuration settings to take effect.
 
- 
+ 
 
 The following code shows the Managed Object Format (MOF) file that defines the **Setting** class.
 
@@ -61,9 +64,9 @@ The following code shows the Managed Object Format (MOF) file that defines the *
 [dynamic: ToInstance, provider("TroubleShooting, Version=2.0.392.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"), singleton: DisableOverride ToInstance ToSubClass]
 class Setting : ConfigValueProvider
 {
-                boolean UxSmartCardLogonEnabled = TRUE;
-                [read] string User;
-                [implemented] void Clear([in] string propertyName);
+                boolean UxSmartCardLogonEnabled = TRUE;
+                [read] string User;
+                [implemented] void Clear([in] string propertyName);
 };
 ```
 
@@ -73,55 +76,55 @@ The **Setting** class inherits from the **ConfigValueProvider** class. The follo
 [abstract]
 class ConfigValueProvider
 {
-                [write] string DiagEventLogLevel;
-                [write] boolean FtsAddUserToAdminGroupEnabled;
-                [write] string FtsComputerNameMask;
-                [write] sint32 FtsDeleteVMStateTimeout;
-                [write] sint32 FtsDetachVfdTimeout;
-                [write] string FtsDialogUrl;
-                [write] sint32 FtsExplorerTimeout;
-                [write] string FtsFailureDialogMsg;
-                [write] string FtsLogFilePaths[];
-                [write] sint32 FtsMaxPostponeTime;
-                [write] sint32 FtsMaxRetryCount;
-                [write] string FtsMode;
-                [write] sint32 FtsNonInteractiveRetryTimeoutInc;
-                [write] sint32 FtsNonInteractiveTimeout;
-                [write] string FtsPostponeUtcDateTimeLimit;
-                [write] string FtsRetryDialogMsg;
-                [write] boolean FtsSetComputerNameEnabled;
-                [write] boolean FtsSetJoinDomainEnabled;
-                [write] boolean FtsSetMachineObjectOUEnabled;
-                [write] boolean FtsSetRegionalSettingsEnabled;
-                [write] boolean FtsSetUserDataEnabled;
-                [write] string FtsStartDialogMsg;
-                [write] sint32 FtsTaskCancelTimeout;
-                [write] sint32 FtsTaskVMTurnOffTimeout;
-                [write] sint32 FtsUpgradeTimeout;
-                [write] boolean UxAppPublishingEnabled;
-                [write] boolean UxAudioSharingEnabled;
-                [write] boolean UxClipboardSharingEnabled;
-                [write] boolean UxCredentialCacheEnabled;
-                [write] sint32 UxDialogTimeout;
-                [write] sint32 UxHideVmTimeout;
-                [write] boolean UxLogonStartEnabled;
-                [write] boolean UxPrinterSharingEnabled;
-                [write] sint32 UxRebootAbsoluteDelayTimeout;
-                [write] string UxRedirectUrls[];
-                [write] boolean UxShowExit;
-                [write] boolean UxSmartCardLogonEnabled;
-                [write] boolean UxSmartCardSharingEnabled;
-                [write] boolean UxUSBDeviceSharingEnabled;
-                [write] string VmCloseAction;
-                [write] sint32 VmGuestMemFromHostMem[];
-                [write] sint32 VmGuestUpdateDuration;
-                [write] string VmGuestUpdateTime;
-                [write] sint32 VmHostMemToGuestMem[];
-                [write] boolean VmHostMemToGuestMemCalcEnabled;
-                [write] sint32 VmMemory;
-                [write] boolean VmMultiUserEnabled;
-                [write] string VmNetworkingMode;
-                [write] sint32 VmTaskTimeout;
+                [write] string DiagEventLogLevel;
+                [write] boolean FtsAddUserToAdminGroupEnabled;
+                [write] string FtsComputerNameMask;
+                [write] sint32 FtsDeleteVMStateTimeout;
+                [write] sint32 FtsDetachVfdTimeout;
+                [write] string FtsDialogUrl;
+                [write] sint32 FtsExplorerTimeout;
+                [write] string FtsFailureDialogMsg;
+                [write] string FtsLogFilePaths[];
+                [write] sint32 FtsMaxPostponeTime;
+                [write] sint32 FtsMaxRetryCount;
+                [write] string FtsMode;
+                [write] sint32 FtsNonInteractiveRetryTimeoutInc;
+                [write] sint32 FtsNonInteractiveTimeout;
+                [write] string FtsPostponeUtcDateTimeLimit;
+                [write] string FtsRetryDialogMsg;
+                [write] boolean FtsSetComputerNameEnabled;
+                [write] boolean FtsSetJoinDomainEnabled;
+                [write] boolean FtsSetMachineObjectOUEnabled;
+                [write] boolean FtsSetRegionalSettingsEnabled;
+                [write] boolean FtsSetUserDataEnabled;
+                [write] string FtsStartDialogMsg;
+                [write] sint32 FtsTaskCancelTimeout;
+                [write] sint32 FtsTaskVMTurnOffTimeout;
+                [write] sint32 FtsUpgradeTimeout;
+                [write] boolean UxAppPublishingEnabled;
+                [write] boolean UxAudioSharingEnabled;
+                [write] boolean UxClipboardSharingEnabled;
+                [write] boolean UxCredentialCacheEnabled;
+                [write] sint32 UxDialogTimeout;
+                [write] sint32 UxHideVmTimeout;
+                [write] boolean UxLogonStartEnabled;
+                [write] boolean UxPrinterSharingEnabled;
+                [write] sint32 UxRebootAbsoluteDelayTimeout;
+                [write] string UxRedirectUrls[];
+                [write] boolean UxShowExit;
+                [write] boolean UxSmartCardLogonEnabled;
+                [write] boolean UxSmartCardSharingEnabled;
+                [write] boolean UxUSBDeviceSharingEnabled;
+                [write] string VmCloseAction;
+                [write] sint32 VmGuestMemFromHostMem[];
+                [write] sint32 VmGuestUpdateDuration;
+                [write] string VmGuestUpdateTime;
+                [write] sint32 VmHostMemToGuestMem[];
+                [write] boolean VmHostMemToGuestMemCalcEnabled;
+                [write] sint32 VmMemory;
+                [write] boolean VmMultiUserEnabled;
+                [write] string VmNetworkingMode;
+                [write] sint32 VmTaskTimeout;
 };
 ```
 
@@ -132,9 +135,9 @@ class ConfigValueProvider
 
 [Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md b/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md
index cbca914be6..335fa404ed 100644
--- a/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md
+++ b/mdop/medv-v2/managing-med-v-workspace-settings-by-using-the-med-v-workspace-packager.md
@@ -1,12 +1,15 @@
 ---
 title: Managing MED-V Workspace Settings by Using the MED-V Workspace Packager
 description: Managing MED-V Workspace Settings by Using the MED-V Workspace Packager
-author: jamiejdt
+author: dansimp
 ms.assetid: e4b2c516-b9f8-44f9-9eae-caac6c2af3e7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -18,67 +21,65 @@ You can use the MED-V Workspace Packager to manage certain settings in the MED-V
 
 **To manage settings in a MED-V workspace**
 
-1.  To open the **MED-V Workspace Packager**, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Workspace Packager**.
+1. To open the **MED-V Workspace Packager**, click **Start**, click **All Programs**, click **Microsoft Enterprise Desktop Virtualization**, and then click **MED-V Workspace Packager**.
 
-2.  On the **MED-V Workspace Packager** main panel, click **Manage Settings**.
+2. On the **MED-V Workspace Packager** main panel, click **Manage Settings**.
 
-3.  In the **Manage Settings** window, you can configure the following MED-V workspace settings:
+3. In the **Manage Settings** window, you can configure the following MED-V workspace settings:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    Start MED-V workspace
    Choose whether to start the MED-V workspace at user logon, at first use, or to let the end user decide when the MED-V workspace starts.
    The MED-V workspace starts in one of two ways: either when the end user logs on or when they first perform an action that requires MED-V, such as opening a published application or entering a URL that requires redirection.
    
-    
    You can either define this setting for the end user or let the end user control how MED-V starts.
    
-    
    
-    Note  
-    
    If you specify that the end user decides, the default behavior they experience is that the MED-V workspace starts when they log on. They can change the default by right-clicking the MED-V icon in the notification area and selecting MED-V User Settings. If you define this setting for the end user, they cannot change the way in which MED-V starts.
    
-    
    
-    
    
-     
-    
    Networking
    Select Shared or Bridged for your networking setting. The default is Shared.
    Shared - The MED-V workspace uses Network Address Translation (NAT) to share the host's IP for outgoing traffic.
    
-    
    Bridged - The MED-V workspace has its own network address, typically obtained through DHCP.
    Store credentials
    Choose whether you want to store the end user credentials.
    The default behavior is that credential storing is disabled so that the end user must be authenticated every time that they log on.
    
-    
    
-    Important  
-    
    Even though caching the end user’s credentials provides the best user experience, you should be aware of the risks involved.
    
-    
    The end user’s domain credential is stored in a reversible format in the Windows Credential Manager. An attacker could write a program that retrieves the password and thus gain access to the user’s credentials. You can only lessen this risk by disabling the storing of end user credentials.
    
-    
    
-    
    
-     
-    
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    Start MED-V workspace
    Choose whether to start the MED-V workspace at user logon, at first use, or to let the end user decide when the MED-V workspace starts.
    The MED-V workspace starts in one of two ways: either when the end user logs on or when they first perform an action that requires MED-V, such as opening a published application or entering a URL that requires redirection.
    
+   
    You can either define this setting for the end user or let the end user control how MED-V starts.
    
+   
    
+   Note
    If you specify that the end user decides, the default behavior they experience is that the MED-V workspace starts when they log on. They can change the default by right-clicking the MED-V icon in the notification area and selecting MED-V User Settings. If you define this setting for the end user, they cannot change the way in which MED-V starts.
    
+   
    
+   
    
 
-     
+   
    Networking
    Select Shared or Bridged for your networking setting. The default is Shared.
    Shared - The MED-V workspace uses Network Address Translation (NAT) to share the host's IP for outgoing traffic.
    
+   
    Bridged - The MED-V workspace has its own network address, typically obtained through DHCP.
    Store credentials
    Choose whether you want to store the end user credentials.
    The default behavior is that credential storing is disabled so that the end user must be authenticated every time that they log on.
    
+   
    
+   Important
    Even though caching the end user’s credentials provides the best user experience, you should be aware of the risks involved.
    
+   
    The end user’s domain credential is stored in a reversible format in the Windows Credential Manager. An attacker could write a program that retrieves the password and thus gain access to the user’s credentials. You can only lessen this risk by disabling the storing of end user credentials.
    
+   
    
+   
    
 
-4.  Click **Save as…** to save the updated configuration settings in the specified folder. MED-V creates a registry file that contains the updated settings. Deploy the updated registry file by using Group Policy. For more information about how to use Group Policy, see [Group Policy Software Installation](https://go.microsoft.com/fwlink/?LinkId=195931) (https://go.microsoft.com/fwlink/?LinkId=195931).
+   
    
 
-    MED-V also creates a Windows PowerShell script in the specified folder that you can use to re-create this updated registry file.
+
+
+4. Click **Save as…** to save the updated configuration settings in the specified folder. MED-V creates a registry file that contains the updated settings. Deploy the updated registry file by using Group Policy. For more information about how to use Group Policy, see [Group Policy Software Installation](https://go.microsoft.com/fwlink/?LinkId=195931) (https://go.microsoft.com/fwlink/?LinkId=195931).
+
+   MED-V also creates a Windows PowerShell script in the specified folder that you can use to re-create this updated registry file.
 
 ## Related topics
 
@@ -87,9 +88,9 @@ You can use the MED-V Workspace Packager to manage certain settings in the MED-V
 
 [Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md b/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md
index 646609d1bf..16d9be517a 100644
--- a/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md
+++ b/mdop/medv-v2/managing-printers-on-a-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: Managing Printers on a MED-V Workspace
 description: Managing Printers on a MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: ba0a65ad-444f-4d18-95eb-8b9fa1a3ffba
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -26,14 +29,14 @@ In most cases, MED-V handles printer redirection automatically. After first time
 **Note**  
 If applications are running on the MED-V workspace, the end user is prompted to let the restart continue or postpone it until later. If no applications are running, the restart is automatic and not shown to the end user.
 
- 
+ 
 
 Every time MED-V is re-started, it checks whether any new printers are installed on the host and, if found, retrieves the corresponding drivers from the network print server and installs them on the guest. MED-V then restarts the MED-V workspace just as when first time setup was completed.
 
 **Important**  
 After the relevant drivers are installed on the guest, the printers only become visible on the guest after the restart occurs.
 
- 
+ 
 
 If at any time a driver cannot be located or installed, it must be manually installed on the guest for the network printer to be available to the end user.
 
@@ -48,16 +51,16 @@ The following list offers some additional guidance:
 **Warning**  
 If a printer is manually installed on the guest, and the same printer is later installed on the host, the result is that the printer is installed two times in the guest. To avoid this situation, a MED-V best practice is to manage printer redirection in one manner only: either disable redirection and install printers manually on the guest, or enable redirection and do not install printers manually on the guest.
 
- 
+ 
 
 ## Related topics
 
 
 [Manage MED-V Workspace Settings](manage-med-v-workspace-settings.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md b/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md
index a63e60b4e6..adef226385 100644
--- a/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md
+++ b/mdop/medv-v2/managing-software-updates-for-med-v-workspaces.md
@@ -1,12 +1,15 @@
 ---
 title: Managing Software Updates for MED-V Workspaces
 description: Managing Software Updates for MED-V Workspaces
-author: jamiejdt
+author: dansimp
 ms.assetid: a28d6dcd-cb9f-46ba-8dac-1d990837a3a3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ You have several different options available to you for providing software updat
 **Note**  
 For information about how to specify the configuration settings that define how MED-V receives automatic updates, see [Managing Automatic Updates for MED-V Workspaces](managing-automatic-updates-for-med-v-workspaces.md).
 
- 
+ 
 
 **Updating Software in a MED-V Workspace**
 
@@ -42,7 +45,7 @@ For information about how to specify the configuration settings that define how
     **Important**  
     We do not recommend this method of managing software updates. In addition, if you update software in the core image and redeploy the MED-V workspace back out to your enterprise, first time setup must run again, and any data saved in the virtual machine is lost.
 
-     
+     
 
 ## Related topics
 
@@ -53,9 +56,9 @@ For information about how to specify the configuration settings that define how
 
 [How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/med-v-20-best-practices.md b/mdop/medv-v2/med-v-20-best-practices.md
index 0fc269b7c1..f9b4db8492 100644
--- a/mdop/medv-v2/med-v-20-best-practices.md
+++ b/mdop/medv-v2/med-v-20-best-practices.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V 2.0 Best Practices
 description: MED-V 2.0 Best Practices
-author: jamiejdt
+author: dansimp
 ms.assetid: 47ba2dd1-6c6e-4d6e-8e18-b42291f8e02a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -47,7 +50,7 @@ If you want end users to see a service level agreement (SLA) before they access
 **Caution**  
 Even though a best practice is to run first time setup in **Unattended** mode, if you decide to set the local policy or registry entry to include an SLA in your image (virtual hard disk), you must also specify that first time setup is run in **Attended** mode, or first time setup can fail.
 
- 
+ 
 
 ### Compact the virtual hard disk
 
@@ -98,9 +101,9 @@ To prevent antivirus activity from affecting the performance of the virtual desk
 
 [Security and Protection for MED-V](security-and-protection-for-med-v.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/med-v-20-deployment-overview.md b/mdop/medv-v2/med-v-20-deployment-overview.md
index 28cfb3c18b..fc6e77f812 100644
--- a/mdop/medv-v2/med-v-20-deployment-overview.md
+++ b/mdop/medv-v2/med-v-20-deployment-overview.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V 2.0 Deployment Overview
 description: MED-V 2.0 Deployment Overview
-author: jamiejdt
+author: dansimp
 ms.assetid: 0b8998ea-c46f-4c81-a304-f380b2ed7cf8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -21,10 +24,10 @@ This section provides general information and instructions about how to install
 
 MED-V 2.0 is based on an application model, where the same methods that you use to deploy applications can be used to deploy and manage MED-V. A deployed MED-V solution includes two components: the MED-V Host Agent and Guest Agent. The MED-V Host Agent is installed on the Windows 7 desktop and the MED-V Guest Agent is installed on Windows XP inside the MED-V workspace. MED-V also includes a MED-V Workspace Packager that provides the information and tools necessary for creating and configuring MED-V workspaces.
 
-**Important**  
+**Important**  
 MED-V only supports the installation of the MED-V Workspace Packager, the MED-V Host Agent, and the MED-V workspace for all users. Installing MED-V for the current user only by selecting **ALLUSERS=””** causes failures in the installation of the components and in the setup of the MED-V workspace.
 
- 
+
 
 ### The MED-V Installation Files
 
@@ -38,10 +41,10 @@ The Host Agent installation file is named MED-V\_HostAgent\_Setup.exe. This file
 
 The MED-V Workspace Packager installation file is named MED-V\_WorkspacePackager\_Setup.exe. Use this file to install the MED-V Workspace Packager on a computer where you have administrator rights and permissions. The desktop administrator uses the MED-V Workspace Packager to create and manage MED-V workspaces.
 
-**Note**  
+**Note**  
 The MED-V Guest Agent is installed automatically during first time setup.
 
- 
+
 
 ### The MED-V Deployment Process
 
@@ -53,10 +56,10 @@ The following is a high-level overview of the MED-V installation and deployment
 
 3.  Deploy the required MED-V components throughout your enterprise. The required components of MED-V are Windows Virtual PC, the MED-V Host Agent, and the MED-V workspace.
 
-**Important**  
+**Important**  
 Installation of the MED-V components requires administrative credentials. If an end user is installing MED-V, they are prompted to enter administrative credentials. Alternately, administrative credentials can be provided in context if you are installing by using an electronic software distribution (ESD) system.
 
- 
+
 
 ### The MED-V Components
 
@@ -86,10 +89,10 @@ To deploy MED-V, copy all the required installation files to the host computer o
 
 You can perform the installation manually. However, we recommend that you use an electronic software distribution method to automate the deployment of the components. For more information, see [How to Deploy a MED-V Workspace Through an Electronic Software Distribution System](how-to-deploy-a-med-v-workspace-through-an-electronic-software-distribution-system.md).
 
-**Note**  
+**Note**  
 For information about available command-line arguments to control install options, see [Command-Line Options for MED-V Installation Files](command-line-options-for-med-v-installation-files.md).
 
- 
+
 
 ## Deployment Steps
 
@@ -102,29 +105,33 @@ When you deploy MED-V throughout your enterprise, there are two main considerati
 
     You can install these as part of the Windows 7 installations before you install MED-V, or you can install them as part of the MED-V distribution. However, MED-V does not include a mechanism for their deployment; they must be deployed by using an electronic software distribution (ESD) system or as part of the Windows 7 image.
 
-    **Important**  
+    **Important**  
     When you install the MED-V components by using a batch file, a best practice is to specify that Windows Virtual PC and the Windows Virtual PC hotfix are installed after the MED-V Host Agent and the MED-V workspace package files. This means that Windows Update will not cause any interference with the installation process by requiring a restart.
 
-     
 
-    **Note**  
-    After you install Windows Virtual PC, the computer must be restarted.
 
-     
+~~~
+**Note**  
+After you install Windows Virtual PC, the computer must be restarted.
+~~~
 
-2.  **MED-V Host Agent** – Install the MED-V Host Agent on the Windows 7 computer where MED-V will be run. This must be installed before installing the MED-V workspace and checks to make sure that Windows Virtual PC is installed.
 
-3.  **MED-V workspace** – You create the files that are required in this installation by using the MED-V Workspace Packager: the setup.exe, .medv, and .msi files. To install the MED-V workspace, run setup.exe; this triggers the other files as required. The installation places an entry in the registry under the local machine run key to start the MED-V Host Agent, which always runs MED-V when Windows is started.
 
-    **Important**  
-    The installation of the MED-V workspace can be run interactively by the end user or silently through an electronic software distribution system. Installation of the MED-V workspace requires administrative credentials, so end users must be administrators of their computers to install the MED-V workspace. Alternately, an electronic software distribution system typically runs in the system context and has sufficient permissions.
+2. **MED-V Host Agent** – Install the MED-V Host Agent on the Windows 7 computer where MED-V will be run. This must be installed before installing the MED-V workspace and checks to make sure that Windows Virtual PC is installed.
 
-     
+3. **MED-V workspace** – You create the files that are required in this installation by using the MED-V Workspace Packager: the setup.exe, .medv, and .msi files. To install the MED-V workspace, run setup.exe; this triggers the other files as required. The installation places an entry in the registry under the local machine run key to start the MED-V Host Agent, which always runs MED-V when Windows is started.
+
+   **Important**  
+   The installation of the MED-V workspace can be run interactively by the end user or silently through an electronic software distribution system. Installation of the MED-V workspace requires administrative credentials, so end users must be administrators of their computers to install the MED-V workspace. Alternately, an electronic software distribution system typically runs in the system context and has sufficient permissions.
+
+
+
+~~~
+**Tip**  
+Because of problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe.
+~~~
 
-    **Tip**  
-    Because of problems that can occur when you install MED-V from a network location, we recommend that you copy the MED-V workspace setup files locally and then run setup.exe.
 
-     
 
 ### First Time Setup
 
@@ -149,9 +156,9 @@ After first time setup is complete, the end user is notified that the published
 
 [Deployment of MED-V](deployment-of-med-v.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/medv-v2/med-v-20-release-notes.md b/mdop/medv-v2/med-v-20-release-notes.md
index 1d0aee8310..e4db87aed9 100644
--- a/mdop/medv-v2/med-v-20-release-notes.md
+++ b/mdop/medv-v2/med-v-20-release-notes.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V 2.0 Release Notes
 description: MED-V 2.0 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: b8f7d938-566e-434c-b4b8-28b67cdfd0b1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -38,7 +41,7 @@ This section provides the most up-to-date information about issues with the Micr
 **Note**  
 There are currently no known issues with MED-V 2.0.
 
- 
+ 
 
 ## Release Notes Copyright Information
 
@@ -55,9 +58,9 @@ Microsoft, Active Directory, ActiveSync, MS-DOS, Windows, Windows Server, and W
 
 All other trademarks are property of their respective owners.
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/med-v-20-supported-configurations.md b/mdop/medv-v2/med-v-20-supported-configurations.md
index be1c37d61f..0f1b6b5b06 100644
--- a/mdop/medv-v2/med-v-20-supported-configurations.md
+++ b/mdop/medv-v2/med-v-20-supported-configurations.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V 2.0 Supported Configurations
 description: MED-V 2.0 Supported Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: 88f1d232-aa01-45ab-8da7-d086269250b5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/med-v-event-log-messages.md b/mdop/medv-v2/med-v-event-log-messages.md
index d438afc669..1dac7a402f 100644
--- a/mdop/medv-v2/med-v-event-log-messages.md
+++ b/mdop/medv-v2/med-v-event-log-messages.md
@@ -1,12 +1,15 @@
 ---
 title: MED-V Event Log Messages
 description: MED-V Event Log Messages
-author: jamiejdt
+author: dansimp
 ms.assetid: 7ba7344d-153b-4cc4-a00a-5d42aee9986b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/monitor-med-v-workspaces.md b/mdop/medv-v2/monitor-med-v-workspaces.md
index 3551fe0f49..9d0f3f1006 100644
--- a/mdop/medv-v2/monitor-med-v-workspaces.md
+++ b/mdop/medv-v2/monitor-med-v-workspaces.md
@@ -1,12 +1,15 @@
 ---
 title: Monitor MED-V Workspaces
 description: Monitor MED-V Workspaces
-author: jamiejdt
+author: dansimp
 ms.assetid: f514afe2-8add-4105-9520-1a491733fa79
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/monitoring-med-v-workspace-deployments.md b/mdop/medv-v2/monitoring-med-v-workspace-deployments.md
index bc097e3974..dcdb458c8a 100644
--- a/mdop/medv-v2/monitoring-med-v-workspace-deployments.md
+++ b/mdop/medv-v2/monitoring-med-v-workspace-deployments.md
@@ -1,12 +1,15 @@
 ---
 title: Monitoring MED-V Workspace Deployments
 description: Monitoring MED-V Workspace Deployments
-author: jamiejdt
+author: dansimp
 ms.assetid: 5de0cb06-b8a9-48a5-b8b3-836954295765
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/operations-for-med-v.md b/mdop/medv-v2/operations-for-med-v.md
index 42741ab850..700f62afaa 100644
--- a/mdop/medv-v2/operations-for-med-v.md
+++ b/mdop/medv-v2/operations-for-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Operations for MED-V
 description: Operations for MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 8f3f367d-fa9d-4468-814a-f0495adfaea4
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/operations-troubleshooting-medv2.md b/mdop/medv-v2/operations-troubleshooting-medv2.md
index b3eda03011..dca90ef2ec 100644
--- a/mdop/medv-v2/operations-troubleshooting-medv2.md
+++ b/mdop/medv-v2/operations-troubleshooting-medv2.md
@@ -1,12 +1,15 @@
 ---
 title: Operations Troubleshooting
 description: Operations Troubleshooting
-author: jamiejdt
+author: dansimp
 ms.assetid: 948d7869-accd-44da-974f-93409234dee7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/medv-v2/overview-of-med-vmedv2.md b/mdop/medv-v2/overview-of-med-vmedv2.md
index 9cd7ae88d6..325b6c6151 100644
--- a/mdop/medv-v2/overview-of-med-vmedv2.md
+++ b/mdop/medv-v2/overview-of-med-vmedv2.md
@@ -1,12 +1,15 @@
 ---
 title: Overview of MED-V
 description: Overview of MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 393daa9b-2d76-43e1-861a-9d8c00f68cf6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/planning-for-application-operating-system-compatibility.md b/mdop/medv-v2/planning-for-application-operating-system-compatibility.md
index 5f98ac01db..459c9b83f8 100644
--- a/mdop/medv-v2/planning-for-application-operating-system-compatibility.md
+++ b/mdop/medv-v2/planning-for-application-operating-system-compatibility.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for Application Operating System Compatibility
 description: Planning for Application Operating System Compatibility
-author: jamiejdt
+author: dansimp
 ms.assetid: cdb0a7f0-9da4-4562-8277-12972eb0fea8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/planning-for-med-v.md b/mdop/medv-v2/planning-for-med-v.md
index 084589de20..98c665b7e8 100644
--- a/mdop/medv-v2/planning-for-med-v.md
+++ b/mdop/medv-v2/planning-for-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for MED-V
 description: Planning for MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 8124b765-6930-4607-8bd9-93068403c7a2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/prepare-a-med-v-image.md b/mdop/medv-v2/prepare-a-med-v-image.md
index 1c67c810a4..2746ab886a 100644
--- a/mdop/medv-v2/prepare-a-med-v-image.md
+++ b/mdop/medv-v2/prepare-a-med-v-image.md
@@ -1,12 +1,15 @@
 ---
 title: Prepare a MED-V Image
 description: Prepare a MED-V Image
-author: jamiejdt
+author: dansimp
 ms.assetid: 1bc757e5-8aef-4163-8542-1bdccc028961
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md b/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md
index 7da8db6a76..73bc76772a 100644
--- a/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md
+++ b/mdop/medv-v2/prepare-the-deployment-environment-for-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Prepare the Deployment Environment for MED-V
 description: Prepare the Deployment Environment for MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: d15ea370-7fdb-4852-a1ba-730ec7568e3e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md b/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md
index 2e7f055be3..a97672a4dc 100644
--- a/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md
+++ b/mdop/medv-v2/restarting-and-resetting-a-med-v-workspace.md
@@ -1,12 +1,15 @@
 ---
 title: Restarting and Resetting a MED-V Workspace
 description: Restarting and Resetting a MED-V Workspace
-author: jamiejdt
+author: dansimp
 ms.assetid: a959cdb3-a727-47c7-967e-e58f224e74de
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -33,7 +36,7 @@ For information about how to open the MED-V Administration Toolkit, see [Trouble
     **Warning**  
     Resetting the MED-V workspace causes first time setup to run again, and thus reloads the original virtual hard disk. All data that is stored in the MED-V workspace since first time setup was originally run will be deleted.
 
-     
+     
 
 2.  Click **Reset**.
 
@@ -46,9 +49,9 @@ For information about how to open the MED-V Administration Toolkit, see [Trouble
 
 [Viewing MED-V Workspace Configurations](viewing-med-v-workspace-configurations.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/security-and-protection-for-med-v.md b/mdop/medv-v2/security-and-protection-for-med-v.md
index c196395199..5424443a54 100644
--- a/mdop/medv-v2/security-and-protection-for-med-v.md
+++ b/mdop/medv-v2/security-and-protection-for-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Security and Protection for MED-V
 description: Security and Protection for MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 5db66d56-eb65-4bff-a9e4-3d52de4256bd
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/security-best-practices-for-med-v-operations.md b/mdop/medv-v2/security-best-practices-for-med-v-operations.md
index 28830b3429..26401fc3ba 100644
--- a/mdop/medv-v2/security-best-practices-for-med-v-operations.md
+++ b/mdop/medv-v2/security-best-practices-for-med-v-operations.md
@@ -1,12 +1,15 @@
 ---
 title: Security Best Practices for MED-V Operations
 description: Security Best Practices for MED-V Operations
-author: jamiejdt
+author: dansimp
 ms.assetid: 231e2b9a-8b49-42fe-93b5-2ef12fe17bac
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/technical-reference-for-med-v.md b/mdop/medv-v2/technical-reference-for-med-v.md
index 4db166484f..3b1d052a9b 100644
--- a/mdop/medv-v2/technical-reference-for-med-v.md
+++ b/mdop/medv-v2/technical-reference-for-med-v.md
@@ -1,12 +1,15 @@
 ---
 title: Technical Reference for MED-V
 description: Technical Reference for MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 52aa15ae-6ca8-4494-8660-313c7b723406
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md b/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md
index e1fbb8b31d..df04230dd8 100644
--- a/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md
+++ b/mdop/medv-v2/test-and-deploy-the-med-v-workspace-package.md
@@ -1,12 +1,15 @@
 ---
 title: Test And Deploy the MED-V Workspace Package
 description: Test And Deploy the MED-V Workspace Package
-author: jamiejdt
+author: dansimp
 ms.assetid: 0238dea7-a08c-4859-b8b1-2b52bc63fda6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/testing-the-med-v-workspace-package.md b/mdop/medv-v2/testing-the-med-v-workspace-package.md
index e808acd7ac..c854d25c0e 100644
--- a/mdop/medv-v2/testing-the-med-v-workspace-package.md
+++ b/mdop/medv-v2/testing-the-med-v-workspace-package.md
@@ -1,12 +1,15 @@
 ---
 title: Testing the MED-V Workspace Package
 description: Testing the MED-V Workspace Package
-author: jamiejdt
+author: dansimp
 ms.assetid: 83edcb6e-9615-4d18-96b8-f085a647294e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md b/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md
index d70e01fbcb..202763a51f 100644
--- a/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md
+++ b/mdop/medv-v2/troubleshooting-med-v-by-using-the-administration-toolkit.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting MED-V by Using the Administration Toolkit
 description: Troubleshooting MED-V by Using the Administration Toolkit
-author: jamiejdt
+author: dansimp
 ms.assetid: 6c096a1c-b9ce-4ec7-8dfd-5286e3b9a617
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/troubleshooting-med-vmedv2.md b/mdop/medv-v2/troubleshooting-med-vmedv2.md
index 08644ea8ad..64042f1f8f 100644
--- a/mdop/medv-v2/troubleshooting-med-vmedv2.md
+++ b/mdop/medv-v2/troubleshooting-med-vmedv2.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting MED-V
 description: Troubleshooting MED-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 4502d62b-a7db-4f83-81e2-23fd8b0820e1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/updating-med-v-20.md b/mdop/medv-v2/updating-med-v-20.md
index 7e68c9b367..0d1f80a70b 100644
--- a/mdop/medv-v2/updating-med-v-20.md
+++ b/mdop/medv-v2/updating-med-v-20.md
@@ -1,12 +1,15 @@
 ---
 title: Updating MED-V 2.0
 description: Updating MED-V 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: beea2f54-42d7-4a17-98e0-d243a8562265
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/viewing-and-configuring-med-v-logs.md b/mdop/medv-v2/viewing-and-configuring-med-v-logs.md
index ea1bd70f69..35d8f398a0 100644
--- a/mdop/medv-v2/viewing-and-configuring-med-v-logs.md
+++ b/mdop/medv-v2/viewing-and-configuring-med-v-logs.md
@@ -1,12 +1,15 @@
 ---
 title: Viewing and Configuring MED-V Logs
 description: Viewing and Configuring MED-V Logs
-author: jamiejdt
+author: dansimp
 ms.assetid: a15537ce-981d-4f55-9c3c-e7fbf94b8fe5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -28,7 +31,7 @@ Event Viewer opens and displays the corresponding event logs that you can use to
 **Note**  
 End users can only save event log files in the guest if they have administrative permissions.
 
- 
+ 
 
 ### To manually open the Event Viewer in the host computer
 
@@ -48,7 +51,7 @@ You can also specify the event logging level by editing the EventLogLevel regist
 **Note**  
 The level you specify on the **MED-V Administration Toolkit** window applies to future MED-V event logging. If you set the level to capture all errors, warnings, and informational messages, then the event logs fill more quickly and older events are removed.
 
- 
+ 
 
 ## Related topics
 
@@ -57,9 +60,9 @@ The level you specify on the **MED-V Administration Toolkit** window applies to
 
 [Viewing MED-V Workspace Configurations](viewing-med-v-workspace-configurations.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/medv-v2/viewing-med-v-workspace-configurations.md b/mdop/medv-v2/viewing-med-v-workspace-configurations.md
index 9982fd19ed..c009bcb559 100644
--- a/mdop/medv-v2/viewing-med-v-workspace-configurations.md
+++ b/mdop/medv-v2/viewing-med-v-workspace-configurations.md
@@ -1,12 +1,15 @@
 ---
 title: Viewing MED-V Workspace Configurations
 description: Viewing MED-V Workspace Configurations
-author: jamiejdt
+author: dansimp
 ms.assetid: 5de6cf04-6beb-4ac9-ad52-26ac8c0c8ce6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/whats-new-in-med-v-20.md b/mdop/medv-v2/whats-new-in-med-v-20.md
index 5fe0b947ab..0024381a3d 100644
--- a/mdop/medv-v2/whats-new-in-med-v-20.md
+++ b/mdop/medv-v2/whats-new-in-med-v-20.md
@@ -1,12 +1,15 @@
 ---
 title: What's New in MED-V 2.0
 description: What's New in MED-V 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 53b10bff-2b6f-463b-bdc2-5edc56526792
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md b/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md
index 73932650ec..34ca784d07 100644
--- a/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md
+++ b/mdop/medv-v2/windows-virtual-pc-application-exclude-list.md
@@ -1,12 +1,15 @@
 ---
 title: Windows Virtual PC Application Exclude List
 description: Windows Virtual PC Application Exclude List
-author: jamiejdt
+author: dansimp
 ms.assetid: 7715f198-f5ed-421e-8740-0cec2ca4ece3
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w7
+ms.prod: w10
 ms.date: 04/28/2017
 ---
 
@@ -48,7 +51,7 @@ Windows Virtual PC includes a feature known as the "Exclude List" that lets you
         **Important**  
         If applicable, remove the quotation marks from the full path when you enter it into the value data field.
 
-         
+         
 
 5.  Close Registry Editor and restart the MED-V workspace virtual machine.
 
@@ -63,9 +66,9 @@ You can also republish an excluded application to the host **Start** menu by del
 
 [How to Publish and Unpublish an Application on the MED-V Workspace](how-to-publish-and-unpublish-an-application-on-the-med-v-workspace.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/softgrid-application-virtualization.md b/mdop/softgrid-application-virtualization.md
index 4251743d68..9951bcd5f1 100644
--- a/mdop/softgrid-application-virtualization.md
+++ b/mdop/softgrid-application-virtualization.md
@@ -1,14 +1,17 @@
 ---
 title: SoftGrid Application Virtualization
 description: SoftGrid Application Virtualization
-author: jamiejdt
+author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: manage
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 # SoftGrid Application Virtualization
 
-Selecting the link for [SoftGrid Application Virtualization documentation](https://technet.microsoft.com/library/bb906040.aspx) will take you to another website. Use your browser's **Back** button to return to this page.   
\ No newline at end of file
+Selecting the link for [SoftGrid Application Virtualization documentation](https://technet.microsoft.com/library/bb906040.aspx) will take you to another website. Use your browser's **Back** button to return to this page.   
diff --git a/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md b/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md
index 8ff49372af..93e2506108 100644
--- a/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md
+++ b/mdop/solutions/application-publishing-and-client-interaction-for-app-v-5-solutions.md
@@ -1,12 +1,15 @@
 ---
 title: Application Publishing and Client Interaction for App-V 5
 description: Application Publishing and Client Interaction for App-V 5
-author: jamiejdt
+author: dansimp
 ms.assetid: 9854afdc-00f9-40ec-8275-d168e5151286
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md b/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md
index 7c6b57cd16..860cc5c118 100644
--- a/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md
+++ b/mdop/solutions/creating-app-v-45-databases-using-sql-scripting.md
@@ -1,12 +1,15 @@
 ---
 title: Creating App-V 4.5 Databases Using SQL Scripting
 description: Creating App-V 4.5 Databases Using SQL Scripting
-author: jamiejdt
+author: dansimp
 ms.assetid: 6cd0b180-163e-463f-a658-939ab9a7cfa1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -141,10 +144,10 @@ If used, the two sample batch files provided run the SQL scripts in the followin
 
     -   dbversion.sql
 
-**Note**  
+**Note**  
 Careful consideration when modifying the scripts must be taken and should only be done by someone with the appropriate knowledge. Also, of the sample files presented only the following should be changed: **create\_schema.bat**, **create\_tables.bat**, **database.sql**, and **roles.sql**. All other files should not be modified in any way as this could cause the database to be created incorrectly, which will lead to the failure of App-V services to be installed.
 
- 
+
 
 The two sample batch files must be placed in the same directory where the rest of the SQL scripts were copied to on the computer.
 
@@ -203,7 +206,7 @@ The following accounts will need to be created on the SQL server with specific p
 
 2.  Administrator in the “App-V Admins” group logs in to Application Virtualization Management Console and deletes the following objects from the Management Console.
 
-    **Warning**  
+    **Warning**  
     This is required as the traditional setup populates certain records in the database that are not populated if you run the install against an already existing database. Delete the following objects:
 
     -   Under “Server Groups,” “Default Server Group,” delete “Application Virtualization Management Server”
@@ -212,7 +215,7 @@ The following accounts will need to be created on the SQL server with specific p
 
     -   Under “Provider Policies,” delete “Default Provider”
 
-     
+
 
 3.  Administrator in the App-V admins group should then create:
 
@@ -220,32 +223,34 @@ The following accounts will need to be created on the SQL server with specific p
 
     -   Create a “Default Server Group”
 
-        **Note**  
-        You must create a “Default Server” group even if you will not be used. The server installer only looks for the "Default Server Group" when trying to add the server.  If there is no "Default Server Group" then the installation will fail. If you plan on using server groups other than the default that is fine, it’s just necessary to retain the "Default Server Group" if you plan on adding subsequent App-V Management Servers to your infrastructure.
+        **Note**  
+        You must create a “Default Server” group even if you will not be used. The server installer only looks for the "Default Server Group" when trying to add the server.  If there is no "Default Server Group" then the installation will fail. If you plan on using server groups other than the default that is fine, it’s just necessary to retain the "Default Server Group" if you plan on adding subsequent App-V Management Servers to your infrastructure.
 
-         
 
-    -   Assign the App-V Users Group to the New Provider Policy created above
 
-    -   Under “Server Groups,” create a New Server Group, specifying the New Provider Policy
+~~~
+-   Assign the App-V Users Group to the New Provider Policy created above
 
-    -   Under the New Server group, create a New Application Virtualization Management Server
+-   Under “Server Groups,” create a New Server Group, specifying the New Provider Policy
 
-        **Important**  
-        Do not restart the service before completing all of the above steps!
+-   Under the New Server group, create a New Application Virtualization Management Server
 
-         
+    **Important**  
+    Do not restart the service before completing all of the above steps!
 
-    -   Administrator restarts the Application Virtualization Management Server service.
+
+
+-   Administrator restarts the Application Virtualization Management Server service.
+~~~
 
 ## Conclusion
 
 
 In conclusion, the information in this document allows an administrator to work with the SQL administrators to develop a deployment path that works for the security and administrative divisions in an organization. After reading this document and testing the tasks documented, an administrator should be ready to implement their App-V infrastructure in this type of environment.
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md b/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md
index bb717d6751..5be26f09e4 100644
--- a/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md
+++ b/mdop/solutions/how-to-download-and-deploy-mdop-group-policy--admx--templates.md
@@ -1,12 +1,15 @@
 ---
 title: How to Download and Deploy MDOP Group Policy (.admx) Templates
 description: How to Download and Deploy MDOP Group Policy (.admx) Templates
-author: jamiejdt
+author: dansimp
 ms.assetid: fdb64505-6c66-4fdf-ad74-a6a161191e3f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/15/2018
 ---
 
@@ -20,69 +23,69 @@ You can manage the feature settings of certain Microsoft Desktop Optimization Pa
 
 **How to download and deploy the MDOP Group Policy templates**
 
-1.  Download the latest [MDOP Group Policy templates](https://www.microsoft.com/en-us/download/details.aspx?id=55531) 
+1. Download the latest [MDOP Group Policy templates](https://www.microsoft.com/download/details.aspx?id=55531) 
 
-2.  Expand the downloaded .cab file by running `expand \MDOP_ADMX_Templates.cab -F:* `
+2. Expand the downloaded .cab file by running `expand \MDOP_ADMX_Templates.cab -F:* `
 
-    **Warning**  
-    Do not extract the templates directly to the Group Policy deployment directory. Multiple technologies and versions are bundled in this file.
+   **Warning**  
+   Do not extract the templates directly to the Group Policy deployment directory. Multiple technologies and versions are bundled in this file.
 
-3.  In the extracted folder, locate the technology-version .admx file. Certain MDOP technologies have multiple sets of Group Policy Objects (GPOs). For example, MBAM includes MBAM Management settings and MBAM User settings.
+3. In the extracted folder, locate the technology-version .admx file. Certain MDOP technologies have multiple sets of Group Policy Objects (GPOs). For example, MBAM includes MBAM Management settings and MBAM User settings.
 
-4.  Locate the appropriate .adml file by language-culture (that is, *en-us* for English-United States).
+4. Locate the appropriate .adml file by language-culture (that is, *en-us* for English-United States).
 
-5.  Copy the .admx and .adml files to a policy definition folder. Depending on where you store the templates, you can configure Group Policy settings from the local device or from any computer on the domain.
+5. Copy the .admx and .adml files to a policy definition folder. Depending on where you store the templates, you can configure Group Policy settings from the local device or from any computer on the domain.
 
    - **Local files:** To configure Group Policy settings from the local device, copy template files to the following locations:
 
    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    File typeFile location
    Group Policy template (.admx)
    %systemroot%\policyDefinitions
    Group Policy language file (.adml)
    %systemroot%\policyDefinitions\[MUIculture]
    
+   
+   
+   
+   
+   
+   
+   File type
+   File location
+   
+   
+   
+   
+   
    Group Policy template (.admx)
    
+   
    %systemroot%<strong>policyDefinitions
    
+   
+   
+   
    Group Policy language file (.adml)
    
+   
    %systemroot%<strong>policyDefinitions[MUIculture]
    
+   
+   
+   
 
    - **Domain central store:** To enable Group Policy settings configuration by a Group Policy administrator from any computer on the domain, copy files to the following locations on the domain controller:
 
    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    File typeFile location
    Group Policy template (.admx)
    %systemroot%\sysvol\domain\policies\PolicyDefinitions
    Group Policy language file (.adml)
    %systemroot%\sysvol\domain\policies\PolicyDefinitions\[MUIculture]\[MUIculture]
    
-    
    For example, the U.S. English ADML language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us.
    
+   
+   
+   
+   
+   
+   
+   File type
+   File location
+   
+   
+   
+   
+   
    Group Policy template (.admx)
    
+   
    %systemroot%<strong>sysvol\domain\policies\PolicyDefinitions
    
+   
+   
+   
    Group Policy language file (.adml)
    
+   
    %systemroot%<strong>sysvol\domain\policies\PolicyDefinitions[MUIculture][MUIculture]
    
+   
    For example, the U.S. English ADML language-specific file will be stored in %systemroot%\sysvol\domain\policies\PolicyDefinitions\en-us.
    
+   
+   
+   
 
 6. Edit the Group Policy settings using Group Policy Management Console (GPMC) or Advanced Group Policy Management (AGPM) to configure Group Policy settings for the MDOP technology.
 
@@ -107,42 +110,42 @@ For more information about supported MDOP Group Policy, see the specific documen
 
 
    Application Virtualization (App-V)
    
 
    App-V 5.0 and App-V 5.0 Service Packs
    
-
    [How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy](../appv-v5/how-to-modify-app-v-50-client-configuration-using-the-admx-template-and-group-policy.md)
    
+
    How to Modify App-V 5.0 Client Configuration Using the ADMX Template and Group Policy
    
 
 
 
    User Experience Virtualization (UE-V)
    
 
    UE-V 2.0 and UE-V 2.1
    
-
    [Configuring UE-V 2.x with Group Policy Objects](../uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md)
    
+
    Configuring UE-V 2.x with Group Policy Objects
    
 
 
 
    
 
    UE-V 1.0 including 1.0 SP1
    
-
    [Configuring UE-V with Group Policy Objects](../uev-v1/configuring-ue-v-with-group-policy-objects.md)
    
+
    Configuring UE-V with Group Policy Objects
    
 
 
 
    Microsoft BitLocker Administration and Monitoring (MBAM)
    
 
    MBAM 2.5
    
-
    [Planning for MBAM 2.5 Group Policy Requirements](../mbam-v25/planning-for-mbam-25-group-policy-requirements.md)
    
+
    Planning for MBAM 2.5 Group Policy Requirements
    
 
 
 
    
 
    MBAM 2.0 including 2.0 SP1
    
-
    [Planning for MBAM 2.0 Group Policy Requirements](../mbam-v2/planning-for-mbam-20-group-policy-requirements-mbam-2.md)
    
-
    [Deploying MBAM 2.0 Group Policy Objects](../mbam-v2/deploying-mbam-20-group-policy-objects-mbam-2.md)
    
+
    Planning for MBAM 2.0 Group Policy Requirements
    
+
    Deploying MBAM 2.0 Group Policy Objects
    
 
 
 
    
 
    MBAM 1.0
    
-
    [How to Edit MBAM 1.0 GPO Settings](../mbam-v1/how-to-edit-mbam-10-gpo-settings.md)
    
+
    How to Edit MBAM 1.0 GPO Settings
    
 
 
 
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/solutions/index.md b/mdop/solutions/index.md
index 6183633995..20c7e2da8e 100644
--- a/mdop/solutions/index.md
+++ b/mdop/solutions/index.md
@@ -1,12 +1,12 @@
 ---
 title: MDOP Solutions and Scenarios
 description: MDOP Solutions and Scenarios
-author: jamiejdt
+author: dansimp
 ms.assetid: 1cb18bef-fbae-4e96-a4f1-90cf111c3b5f
 ms.pagetype: mdop
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md b/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md
index 1c1a42ea74..ac39025c59 100644
--- a/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md
+++ b/mdop/solutions/virtualizing-microsoft-office-2010-for-application-virtualization--app-v--50-solutions.md
@@ -1,12 +1,15 @@
 ---
 title: Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0
 description: Virtualizing Microsoft Office 2010 for Application Virtualization (App-V) 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: bd16c20f-cc47-4172-ae16-47b23c9b7f5c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md b/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md
index 773cb6af33..83c7defae3 100644
--- a/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md
+++ b/mdop/solutions/virtualizing-microsoft-office-2013-for-application-virtualization--app-v--50-solutions.md
@@ -1,12 +1,15 @@
 ---
 title: Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0
 description: Virtualizing Microsoft Office 2013 for Application Virtualization (App-V) 5.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 742e64de-6ace-4eb4-901a-7a282ca7ae85
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md b/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md
index dd07ca6239..dbed7e3471 100644
--- a/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md
+++ b/mdop/uev-v1/about-user-experience-virtualization-10-sp1.md
@@ -1,12 +1,15 @@
 ---
 title: About User Experience Virtualization 1.0 SP1
 description: About User Experience Virtualization 1.0 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 0212d3fb-e882-476c-9496-9eb52301703d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -138,12 +141,12 @@ UE-V 1.0 Service Pack 1 provides updates for both the UE-V Agent and the UE-V Ge
 
 
 
- 
+ 
 
 **Important**  
 While the UE-V Agent installation program (AgentSetup.exe) and UE-V Generator installation program (ToolSetup.exe) are translated into the languages above, the Windows Installer (.msi) files are only available in English.
 
- 
+ 
 
 ## Office 2007 Settings Location Templates
 
@@ -258,11 +261,11 @@ When running the UE-V setup for UE-V Agent (AgentSetup.exe), the following retur
 
 
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/about-user-experience-virtualization-10.md b/mdop/uev-v1/about-user-experience-virtualization-10.md
index f3bf041822..30ca82aab4 100644
--- a/mdop/uev-v1/about-user-experience-virtualization-10.md
+++ b/mdop/uev-v1/about-user-experience-virtualization-10.md
@@ -1,12 +1,15 @@
 ---
 title: About User Experience Virtualization 1.0
 description: About User Experience Virtualization 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 3758b100-35a8-4e10-ac08-f583fb8ddbd9
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/accessibility-for-ue-v.md b/mdop/uev-v1/accessibility-for-ue-v.md
index 825bb0113d..25be013a5c 100644
--- a/mdop/uev-v1/accessibility-for-ue-v.md
+++ b/mdop/uev-v1/accessibility-for-ue-v.md
@@ -1,12 +1,15 @@
 ---
 title: Accessibility for UE-V
 description: Accessibility for UE-V
-author: jamiejdt
+author: dansimp
 ms.assetid: 059a76e5-bcf0-4459-b5d2-8b71ff2ef433
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -30,7 +33,7 @@ You can access most commands by using two keystrokes. To use an access key:
 **Note**  
 To cancel the action that you are taking and hide the keyboard shortcuts, press ALT.
 
- 
+ 
 
 ### Documentation in alternative formats
 
@@ -63,13 +66,13 @@ For information about the availability of Microsoft product documentation and bo
 
    (609) 987-8116
    
 
 
-
    [http://www.learningally.org/](https://go.microsoft.com/fwlink/p/?linkid=239)
    
+
    http://www.learningally.org/
    
 
    Web addresses can change, so you might be unable to connect to the website or sites that are mentioned here.
    
 
 
 
 
- 
+ 
 
 ### Customer service for people with hearing impairments
 
@@ -91,9 +94,9 @@ For more information about how accessible technology for computers can help to i
 
 [Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/administering-ue-v-10.md b/mdop/uev-v1/administering-ue-v-10.md
index c534bb5b7c..d0cfef26e9 100644
--- a/mdop/uev-v1/administering-ue-v-10.md
+++ b/mdop/uev-v1/administering-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Administering UE-V 1.0
 description: Administering UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: c399ae8d-c839-4f84-9bfc-adacd8f89f34
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md b/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md
index e07e1cf0ce..1c64c98eb7 100644
--- a/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md
+++ b/mdop/uev-v1/administering-ue-v-with-powershell-and-wmi.md
@@ -1,12 +1,15 @@
 ---
 title: Administering UE-V with PowerShell and WMI
 description: Administering UE-V with PowerShell and WMI
-author: jamiejdt
+author: dansimp
 ms.assetid: 26cc864f-c628-4c04-a18c-dd60fce8187c
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md b/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md
index 46a962c639..d063140038 100644
--- a/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md
+++ b/mdop/uev-v1/changing-the-frequency-of-ue-v-scheduled-tasks.md
@@ -1,12 +1,15 @@
 ---
 title: Changing the Frequency of UE-V Scheduled Tasks
 description: Changing the Frequency of UE-V Scheduled Tasks
-author: jamiejdt
+author: dansimp
 ms.assetid: 33c2674e-0df4-4717-9c3d-820a90b16e19
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md b/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md
index efa20581dd..350d61d863 100644
--- a/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md
+++ b/mdop/uev-v1/checklist-for-evaluating-line-of-business-applications-for-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Checklist for Evaluating Line-of-Business Applications for UE-V 1.0
 description: Checklist for Evaluating Line-of-Business Applications for UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 3bfaab30-59f7-4099-abb1-d248ce0086b8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md b/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md
index db1b927683..37690af84f 100644
--- a/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md
+++ b/mdop/uev-v1/configuring-ue-v-with-group-policy-objects.md
@@ -1,12 +1,15 @@
 ---
 title: Configuring UE-V with Group Policy Objects
 description: Configuring UE-V with Group Policy Objects
-author: jamiejdt
+author: dansimp
 ms.assetid: 5c9be706-a05f-4397-9a38-e6b73ebff1e5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -42,13 +45,13 @@ The following policy settings can be configured for UE-V:
 
    Settings storage path
    
 
    Computers and Users
    
 
    This policy setting configures where the user settings will be stored.
    
-
    Provide a Universal Naming Convention (UNC) path and variables such as \\Server\SettingsShare\%username%.
    
+
    Provide a Universal Naming Convention (UNC) path and variables such as \Server\SettingsShare%username%.
    
 
 
 
    Settings template catalog path
    
 
    Computers Only
    
 
    This policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog will be used to replace the default Microsoft templates that are installed with the UE-V agent.
    
-
    Provide a Universal Naming Convention (UNC) path such as \\Server\TemplateShare or a folder location on the computer.
    
+
    Provide a Universal Naming Convention (UNC) path such as \Server\TemplateShare or a folder location on the computer.
    
 
    
 
    Select the check box to replace the default Microsoft templates.
    
 
@@ -92,7 +95,7 @@ The following policy settings can be configured for UE-V:
 
 
 
- 
+ 
 
 **To configure computer-targeted policies**
 
@@ -125,9 +128,9 @@ The UE-V agent uses the following order of precedence to determine synchronizati
 
 [Operations for UE-V 1.0](operations-for-ue-v-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md b/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md
index f867238246..7c342a42af 100644
--- a/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md
+++ b/mdop/uev-v1/create-ue-v-settings-location-templates-with-the-ue-v-generator.md
@@ -1,12 +1,15 @@
 ---
 title: Create UE-V Settings Location Templates with the UE-V Generator
 description: Create UE-V Settings Location Templates with the UE-V Generator
-author: jamiejdt
+author: dansimp
 ms.assetid: b8e50e2f-0cc6-4f74-bb48-c471fefdc7d8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -29,7 +32,7 @@ The UE-V Generator monitors an application to discover and capture the locations
 **Note**  
 UE-V templates cannot be created from virtualized applications or terminal services applications. However, settings synchronized using the templates can be applied to those applications. To create templates that support Virtual Desktop Infrastructure (VDI) and terminal services applications, open a Windows Installer File (.msi) version of the application with UE-V Generator.
 
- 
+ 
 
 **Excluded Locations**
 
@@ -65,7 +68,7 @@ Use the UE-V Generator to create settings location templates for line-of-busines
     **Note**  
     Before the application is started, the system displays a prompt for **User Account Control**. Permission is required to monitor the registry and file locations that the application uses to store settings.
 
-     
+     
 
 4.  After the application starts, close the application. The UE-V Generator records the locations where the application stores its settings.
 
@@ -112,9 +115,9 @@ Use the UE-V Generator to create settings location templates for line-of-busines
 
 [Operations for UE-V 1.0](operations-for-ue-v-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md b/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md
index 12e6858bfd..485a0704eb 100644
--- a/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md
+++ b/mdop/uev-v1/deploying-the-settings-storage-location-for-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the Settings Storage Location for UE-V 1.0
 description: Deploying the Settings Storage Location for UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: b187d44d-649b-487e-98d3-a61ee2be8c2f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -56,7 +59,7 @@ When you create the settings storage share, you should limit access only to user
     
     
 
-     
+     
 
 4.  Set the following NTFS permissions for the settings storage location folder:
 
@@ -87,7 +90,7 @@ When you create the settings storage share, you should limit access only to user
     
     
 
-     
+     
 
 5.  Click **OK** to close the dialog boxes.
 
@@ -100,7 +103,7 @@ Additional security can be configured when a Windows server is utilized for the
 
 2.  Set registry key value to 1.
 
- 
+ 
 
 ## Related topics
 
@@ -114,9 +117,9 @@ Deploy the Central Storage for User Experience Virtualization Settings Templates
 
 [Deploying the UE-V Agent](deploying-the-ue-v-agent.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md b/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md
index a76036e5fe..c178943956 100644
--- a/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md
+++ b/mdop/uev-v1/deploying-the-settings-template-catalog-for-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the Settings Template Catalog for UE-V 1.0
 description: Deploying the Settings Template Catalog for UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 0e6ab5ef-8eeb-40b4-be7b-a841bd83be96
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/deploying-the-ue-v-agent.md b/mdop/uev-v1/deploying-the-ue-v-agent.md
index 8656b04ed5..ced4f1d88b 100644
--- a/mdop/uev-v1/deploying-the-ue-v-agent.md
+++ b/mdop/uev-v1/deploying-the-ue-v-agent.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the UE-V Agent
 description: Deploying the UE-V Agent
-author: jamiejdt
+author: dansimp
 ms.assetid: ec1c16c4-4be0-41ff-93bc-3e2b1afb5832
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -88,7 +91,7 @@ The Microsoft User Experience Virtualization (UE-V) agent must run on each compu
 
 
 
- 
+ 
 
 During installation, the SettingsStoragePath command-line parameter specifies the settings storage location for the settings values. A settings storage location can be defined before deploying the UE-V Agent. If no settings storage location is defined, then UE-V uses the Active Directory user Home Directory as the settings storage location. When you specify the SettingsStoragePath configuration during setup and use the %username% as part of the value, this will roam the same user settings experience on all computers or sessions that a user logs into. If you specify the %username%\\%computername% variables as part of the SettingsStoragePath value, this will preserve the settings experience for each computer.
 
@@ -97,7 +100,7 @@ Architecture-specific Windows Installer (.msi) files are provided for the UE-V a
 **Note**  
 During UE-V agent installation or uninstallation you can either use the AgentSetup.exe file or the AgentSetup<arch>.msi file, but not both. The same file must be used to uninstall the UE-V Agent as it was used to install the UE-V Agent.
 
- 
+ 
 
 Be sure to use the correct variable format when you install the UE-V agent. The following table provides examples of deployment options for using the AgentSetup.exe or the Windows Installer (.msi) installation files.
 
@@ -119,42 +122,42 @@ Be sure to use the correct variable format when you install the UE-V agent. The
 
    Command prompt
    
 
    When you install the UE-V agent from a command prompt, use the %^username% variable format. If quotation marks are needed because of spaces in the settings storage path, use a batch script file for deployment.
    
 
    
-
    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%^username%
    
+
    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%^username%
    
 
    
-
    msiexec.exe /i "<path to msi file>" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%^username%
    
+
    msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%^username%
    
 
 
 
    Batch script
    
 
    When you install the UE-V Agent from a batch script file, use the %%username%% variable format. If you use this install method, you must escape the variable with the %% characters. Without this character, the script expands the username variable at install time, rather than at run time, causing UE-V to use a single settings storage location for all users.
    
-
    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\\server\settingsshare\%%username%%"
    
+
    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\server\settingsshare%%username%%"
    
 
    
-
    msiexec.exe /i "<path to msi file>" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\\server\settingsshare\%%username%%"
    
+
    msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\server\settingsshare%%username%%"
    
 
    
 
 
 
    PowerShell
    
 
    When you install the UE-V agent from a PowerShell prompt or PowerShell script, use the %username% variable format.
    
-
    & AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%
    
+
    & AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%username%
    
 
    
-
    & msiexec.exe /i "<path to msi file>" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%
    
+
    & msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%username%
    
 
    
 
 
 
    Electronic software distribution, such as deployment of Configuration Manager Software Deployment)
    
 
    When you install the UE-V Agent with Configuration Manager, use the ^%username^% variable format.
    
-
    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\^%username^%
    
+
    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare^%username^%
    
 
    
-
    msiexec.exe /i "<path to msi file>" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\^%username^%
    
+
    msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare^%username^%
    
 
 
 
 
- 
+ 
 
 **Note**  
 The installation of the U-EV Agent requires Administrator rights and the computer will require a restart before the UE-V agent can run.
 
- 
+ 
 
 ## UE-V Agent deployment methods from a network share
 
@@ -191,9 +194,9 @@ Updates for the UE-V agent software will be provided through Microsoft Update. D
 [Installing the UE-V Generator](installing-the-ue-v-generator.md)
 
 Deploy the User Experience Virtualization Agent
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/deploying-ue-v-10.md b/mdop/uev-v1/deploying-ue-v-10.md
index 73e2982b31..27e673050d 100644
--- a/mdop/uev-v1/deploying-ue-v-10.md
+++ b/mdop/uev-v1/deploying-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying UE-V 1.0
 description: Deploying UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 519598bb-8c81-4af7-bee7-357696bff880
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -53,7 +56,7 @@ If you need to synchronize applications other than the default applications in t
 **Note**  
 Deploying custom templates requires a settings template catalog. The default Microsoft application templates are deployed with the UE-V Agent.
 
- 
+ 
 
 ## Topics for this product
 
@@ -68,9 +71,9 @@ Deploying custom templates requires a settings template catalog. The default Mic
 
 [Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md b/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md
index 4483054a73..b0afb56983 100644
--- a/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md
+++ b/mdop/uev-v1/deploying-ue-v-settings-location-templates-for-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying UE-V Settings Location Templates for UE-V 1.0
 description: Deploying UE-V Settings Location Templates for UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 7e0cc553-14f7-40fa-828a-281c8d2d1934
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md b/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md
index c8ff3c97fd..3b8b828a43 100644
--- a/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md
+++ b/mdop/uev-v1/edit-ue-v-settings-location-templates-with-the-ue-v-generator.md
@@ -1,12 +1,15 @@
 ---
 title: Edit UE-V Settings Location Templates with the UE-V Generator
 description: Edit UE-V Settings Location Templates with the UE-V Generator
-author: jamiejdt
+author: dansimp
 ms.assetid: da78f9c8-1624-4111-8c96-79db7224bd0b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md b/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md
index ba5397f882..f7d00db09e 100644
--- a/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md
+++ b/mdop/uev-v1/getting-started-with-user-experience-virtualization-10.md
@@ -1,12 +1,15 @@
 ---
 title: Getting Started With User Experience Virtualization 1.0
 description: Getting Started With User Experience Virtualization 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 74a068dc-4f87-4cb4-b114-8ca2a37149f7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -39,7 +42,7 @@ If you are new to this product, we recommend that you read the documentation car
 **Note**  
 A downloadable version of this administrator’s guide is not available. However, you can learn about a special mode of the TechNet Library that allows you to select articles, group them in a collection, and print them or export them to a file at  (https://go.microsoft.com/fwlink/?LinkId=272497).
 
- 
+ 
 
 ## Getting started with Microsoft User Experience Virtualization topics
 
@@ -73,9 +76,9 @@ A downloadable version of this administrator’s guide is not available. However
 
 -   [Troubleshooting UE-V 1.0](troubleshooting-ue-v-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/high-level-architecture-for-ue-v-10.md b/mdop/uev-v1/high-level-architecture-for-ue-v-10.md
index 138c42e134..fc68a953dd 100644
--- a/mdop/uev-v1/high-level-architecture-for-ue-v-10.md
+++ b/mdop/uev-v1/high-level-architecture-for-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: High-Level Architecture for UE-V 1.0
 description: High-Level Architecture for UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: d54f9f10-1a4d-4e56-802d-22d51646e1cc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/index.md b/mdop/uev-v1/index.md
index 49e6e8a74c..3fe3f036fa 100644
--- a/mdop/uev-v1/index.md
+++ b/mdop/uev-v1/index.md
@@ -1,12 +1,12 @@
 ---
 title: Microsoft User Experience Virtualization (UE-V) 1.0
 description: Microsoft User Experience Virtualization (UE-V) 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 7c2b59f6-bbe9-4373-8b08-c1738665a37b
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 04/19/2017
 ---
 
diff --git a/mdop/uev-v1/installing-the-ue-v-generator.md b/mdop/uev-v1/installing-the-ue-v-generator.md
index 56272dcca2..90bba89eb5 100644
--- a/mdop/uev-v1/installing-the-ue-v-generator.md
+++ b/mdop/uev-v1/installing-the-ue-v-generator.md
@@ -1,12 +1,15 @@
 ---
 title: Installing the UE-V Generator
 description: Installing the UE-V Generator
-author: jamiejdt
+author: dansimp
 ms.assetid: 198b9a5f-3dfc-46be-9005-d33451914f87
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -33,7 +36,7 @@ The Microsoft User Experience Virtualization (UE-V) generator can be installed o
     **Note**  
     A prompt for User Account Control appears before the application is installed. Permission is required to install the UE-V generator.
 
-     
+     
 
 7.  Click **Finish** to close the wizard after the installation is complete. You will need to restart your computer before you can run the UE-V Generator.
 
@@ -48,9 +51,9 @@ The Microsoft User Experience Virtualization (UE-V) generator can be installed o
 
 [Planning for Custom Template Deployment for UE-V 1.0](planning-for-custom-template-deployment-for-ue-v-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md b/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md
index 59bbf08036..81dc8f85cc 100644
--- a/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md
+++ b/mdop/uev-v1/installing-the-ue-v-group-policy-admx-templates.md
@@ -1,12 +1,15 @@
 ---
 title: Installing the UE-V Group Policy ADMX Templates
 description: Installing the UE-V Group Policy ADMX Templates
-author: jamiejdt
+author: dansimp
 ms.assetid: 7bd1f12e-7ba6-49f9-af9c-22c496b13b39
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 07/12/2017
 ---
 
@@ -28,7 +31,7 @@ ADMX files can be installed and tested locally on any computer that runs the Win
 
 **To download the UE-V ADMX templates**
 
-1.  Download the UE-V ADMX template files: .
+1.  Download the UE-V ADMX template files: .
 
 2.  For more information about how to deploy the Group Policy templates, see .
 
diff --git a/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md b/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md
index 395957c559..317975228c 100644
--- a/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md
+++ b/mdop/uev-v1/managing-the-ue-v-10-agent-and-packages-with-powershell-and-wmi.md
@@ -1,12 +1,15 @@
 ---
 title: Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI
 description: Managing the UE-V 1.0 Agent and Packages with PowerShell and WMI
-author: jamiejdt
+author: dansimp
 ms.assetid: c8989b01-1769-4e69-82b1-4aadb261d2d5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -20,10 +23,10 @@ You can use WMI and PowerShell to manage Microsoft User Experience Virtualizatio
 
 1.  Stage the UE-V installer file in an accessible network share.
 
-    **Note**  
+    **Note**  
     Use AgentSetup.exe to deploy both 32-bit and 64-bit versions of the UE-V Agent. Windows Installer Files versions, AgentSetupx86.msi and AgentSetupx64.msi, are available for each architecture. To uninstall the UE-V Agent at a later time using the installation file, you must use the same file type.
 
-     
+
 
 2.  Use one of the following PowerShell commands to install the agent.
 
@@ -149,7 +152,7 @@ You can use WMI and PowerShell to manage Microsoft User Experience Virtualizatio
     
     
 
-     
+
 
 **How to export UE-V package settings and repair UE-V templates with PowerShell**
 
@@ -182,7 +185,7 @@ You can use WMI and PowerShell to manage Microsoft User Experience Virtualizatio
     
     
 
-     
+
 
 **How to configure the UE-V Agent with WMI**
 
@@ -262,13 +265,15 @@ You can use WMI and PowerShell to manage Microsoft User Experience Virtualizatio
     
     
 
-     
 
-    Upon configuration of the UE-V Agent with WMI and PowerShell, the defined configuration is stored in the registry in the following locations:
 
-    `\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UEV\Agent\Configuration`
+~~~
+Upon configuration of the UE-V Agent with WMI and PowerShell, the defined configuration is stored in the registry in the following locations:
 
-    `\HKEY_CURRENT_USER\SOFTWARE\Microsoft\UEV\Agent\Configuration`
+`\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UEV\Agent\Configuration`
+
+`\HKEY_CURRENT_USER\SOFTWARE\Microsoft\UEV\Agent\Configuration`
+~~~
 
 ## Related topics
 
@@ -277,9 +282,9 @@ You can use WMI and PowerShell to manage Microsoft User Experience Virtualizatio
 
 [Operations for UE-V 1.0](operations-for-ue-v-10.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md b/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md
index fb156f5b91..be26ce0c20 100644
--- a/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md
+++ b/mdop/uev-v1/managing-ue-v-10-settings-location-templates-using-powershell-and-wmi.md
@@ -1,12 +1,15 @@
 ---
 title: Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI
 description: Managing UE-V 1.0 Settings Location Templates Using PowerShell and WMI
-author: jamiejdt
+author: dansimp
 ms.assetid: 4b911c78-a5e9-4199-bfeb-72ab764d47c1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -76,7 +79,7 @@ You must have administrator permissions to update, register, or unregister a set
     
     
 
-     
+     
 
 The UE-V PowerShell features allow you to manage a group of settings templates deployed in your enterprise. To manage a group of templates using PowerShell, do the following.
 
@@ -159,7 +162,7 @@ User Experience Virtualization provides the following set of WMI commands. Admin
     
     
 
-     
+     
 
 **How to deploy the UE-V agent with PowerShell**
 
@@ -168,7 +171,7 @@ User Experience Virtualization provides the following set of WMI commands. Admin
     **Note**  
     Use AgentSetup.exe to deploy both 32-bit and 64-bit versions of the UE-V Agent. Windows Installer Files versions, AgentSetupx86.msi and AgentSetupx64.msi, are available for each architecture. To uninstall the UE-V Agent at a later time using the installation file, you must use the same file type.
 
-     
+     
 
 2.  Use one of the following PowerShell commands to install the agent.
 
@@ -185,9 +188,9 @@ User Experience Virtualization provides the following set of WMI commands. Admin
 
 [Operations for UE-V 1.0](operations-for-ue-v-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md b/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md
index 7b7b0d414c..b16ae11350 100644
--- a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md
+++ b/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-release-notes.md
@@ -1,12 +1,15 @@
 ---
 title: Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes
 description: Microsoft User Experience Virtualization (UE-V) 1.0 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: 920f3fae-e9b5-4b94-beda-32c19d31e94b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -118,9 +121,9 @@ When Internet Explorer bookmarks roam from one computer to another computer, the
 
 WORKAROUND: None
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md b/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md
index 4cc5845217..e95de8309a 100644
--- a/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md
+++ b/mdop/uev-v1/microsoft-user-experience-virtualization--ue-v--10-sp1-release-notes.md
@@ -1,12 +1,15 @@
 ---
 title: Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes
 description: Microsoft User Experience Virtualization (UE-V) 1.0 SP1 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: 447fae0c-fe87-4d1c-b616-6f92fbdaf6d5
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
diff --git a/mdop/uev-v1/migrating-ue-v-settings-packages.md b/mdop/uev-v1/migrating-ue-v-settings-packages.md
index b50413e244..0b4de51c02 100644
--- a/mdop/uev-v1/migrating-ue-v-settings-packages.md
+++ b/mdop/uev-v1/migrating-ue-v-settings-packages.md
@@ -1,12 +1,15 @@
 ---
 title: Migrating UE-V Settings Packages
 description: Migrating UE-V Settings Packages
-author: jamiejdt
+author: dansimp
 ms.assetid: 93d99254-3e17-4e96-92ad-87059d8554a7
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -37,7 +40,7 @@ Simply copying the files and folders will not preserve the security settings and
     **Note**  
     To monitor the copy progress, open MySettings.txt with a log file reader such as Trace32.
 
-     
+     
 
 4.  Grant share-level permissions to the new share. Leave the NTFS permissions as they were set by Robocopy.
 
@@ -50,9 +53,9 @@ Simply copying the files and folders will not preserve the security settings and
 
 [Operations for UE-V 1.0](operations-for-ue-v-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/operations-for-ue-v-10.md b/mdop/uev-v1/operations-for-ue-v-10.md
index d1b08455f4..9026d54de9 100644
--- a/mdop/uev-v1/operations-for-ue-v-10.md
+++ b/mdop/uev-v1/operations-for-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Operations for UE-V 1.0
 description: Operations for UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 5b4a82fd-3145-49e8-ac06-f9cc583abe5f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md b/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md
index 9f6bb700f9..a6a104caaa 100644
--- a/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md
+++ b/mdop/uev-v1/planning-for-custom-template-deployment-for-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for Custom Template Deployment for UE-V 1.0
 description: Planning for Custom Template Deployment for UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: be76fc9a-31ca-4290-af11-7640dcb87d50
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -37,7 +40,7 @@ When you use Group Policy to configure the settings template catalog path, you c
 **Note**  
 If you disable this policy setting after it has been enabled, the UE-V agent will not restore the default Microsoft templates.
 
- 
+ 
 
 If there are customized templates in the settings template catalog that use the same ID as the default Microsoft templates, and the UE-V agent is not configured to replace the default Microsoft templates, the Microsoft templates in the catalog will be ignored.
 
@@ -46,7 +49,7 @@ You can also replace the default templates by using the UE-V PowerShell features
 **Note**  
 Old settings packages remain in the settings storage location even if new settings templates are deployed for an application. These packages are not read by the agent, but neither are they automatically deleted.
 
- 
+ 
 
 ## Related topics
 
@@ -58,9 +61,9 @@ Old settings packages remain in the settings storage location even if new settin
 [Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md)
 
 Planning for Custom Template Deployment
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/planning-for-ue-v-10.md b/mdop/uev-v1/planning-for-ue-v-10.md
index 3992127e0d..5f62386c65 100644
--- a/mdop/uev-v1/planning-for-ue-v-10.md
+++ b/mdop/uev-v1/planning-for-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for UE-V 1.0
 description: Planning for UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: fc44aa5f-1d4f-4c03-b326-37ecd6bd913f
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/planning-for-ue-v-configuration-methods.md b/mdop/uev-v1/planning-for-ue-v-configuration-methods.md
index 16b341bfc4..52a0686c4c 100644
--- a/mdop/uev-v1/planning-for-ue-v-configuration-methods.md
+++ b/mdop/uev-v1/planning-for-ue-v-configuration-methods.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for UE-V Configuration Methods
 description: Planning for UE-V Configuration Methods
-author: jamiejdt
+author: dansimp
 ms.assetid: 57bce7ab-1be5-434b-9ee5-c96026bbe010
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -36,7 +39,7 @@ You can configure UE-V before, during, or after agent installation, depending on
 **Note**  
 Registry modification can result in data loss or the computer becoming unresponsive. We recommend that you use other configuration methods.
 
- 
+ 
 
 ### UE-V configuration settings
 
@@ -63,9 +66,9 @@ The following are examples of UE-V configuration settings:
 
 [Planning for UE-V Configuration](planning-for-ue-v-configuration.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/planning-for-ue-v-configuration.md b/mdop/uev-v1/planning-for-ue-v-configuration.md
index d152537495..f30fd8a640 100644
--- a/mdop/uev-v1/planning-for-ue-v-configuration.md
+++ b/mdop/uev-v1/planning-for-ue-v-configuration.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for UE-V Configuration
 description: Planning for UE-V Configuration
-author: jamiejdt
+author: dansimp
 ms.assetid: db78dad4-78e0-45d6-a235-8b7345cb79f8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md b/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md
index 4656579e00..d666e1873b 100644
--- a/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md
+++ b/mdop/uev-v1/planning-which-applications-to-synchronize-with-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Planning Which Applications to Synchronize with UE-V 1.0
 description: Planning Which Applications to Synchronize with UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: c718274f-87b4-47f3-8ef7-5e1bd5557a9d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -69,7 +72,7 @@ The UE-V agent installation software installs the agent and registers a default
 
 
 
- 
+ 
 
 Application settings are applied to the application when the application is started. They are saved when the application closes.
 
@@ -114,7 +117,7 @@ User Experience Virtualization includes settings location templates that capture
 
 
 
- 
+ 
 
 The Windows desktop background and Ease of Access settings are applied when the user logs on, when the computer is unlocked, or upon remote connection to another computer. The agent saves these settings when the user logs off, when the computer is locked, or when a remote connection is disconnected. By default, Windows desktop background settings are roamed between computers of the same operating system version.
 
@@ -125,7 +128,7 @@ UE-V does not support the roaming of settings between operating systems with dif
 **Note**  
 If you change the settings location templates that are provided by Microsoft, User Experience Virtualization might not work properly for the designated application or Windows settings group.
 
- 
+ 
 
 ## Prevent unintentional user Settings configuration
 
@@ -162,9 +165,9 @@ For guidance on whether a line-of-business application should be synchronized, s
 
 [Deploying UE-V 1.0](deploying-ue-v-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/preparing-your-environment-for-ue-v.md b/mdop/uev-v1/preparing-your-environment-for-ue-v.md
index b63fbb2a26..d6c66d49ac 100644
--- a/mdop/uev-v1/preparing-your-environment-for-ue-v.md
+++ b/mdop/uev-v1/preparing-your-environment-for-ue-v.md
@@ -1,12 +1,15 @@
 ---
 title: Preparing Your Environment for UE-V
 description: Preparing Your Environment for UE-V
-author: jamiejdt
+author: dansimp
 ms.assetid: c93d3b33-e032-451a-9e1b-8534e1625396
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md b/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md
index 0115c53e59..411cb7cc83 100644
--- a/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md
+++ b/mdop/uev-v1/restoring-application-and-windows-settings-synchronized-with-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Restoring Application and Windows Settings Synchronized with UE-V 1.0
 description: Restoring Application and Windows Settings Synchronized with UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 254a16b1-f186-44a4-8e22-49a4ee87c734
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/security-and-privacy-for-ue-v-10.md b/mdop/uev-v1/security-and-privacy-for-ue-v-10.md
index 0be86755c3..aadcb96e82 100644
--- a/mdop/uev-v1/security-and-privacy-for-ue-v-10.md
+++ b/mdop/uev-v1/security-and-privacy-for-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Security and Privacy for UE-V 1.0
 description: Security and Privacy for UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: c23d867d-7991-4c78-a123-a8a92758e5ba
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md b/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md
index 3947db526f..ebf7bc2cac 100644
--- a/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md
+++ b/mdop/uev-v1/sharing-settings-location-templates-with-the-ue-v-template-gallery.md
@@ -1,12 +1,15 @@
 ---
 title: Sharing Settings Location Templates with the UE-V Template Gallery
 description: Sharing Settings Location Templates with the UE-V Template Gallery
-author: jamiejdt
+author: dansimp
 ms.assetid: 3830ae0c-96dd-4a8d-96a2-df87aea81b27
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -14,7 +17,7 @@ ms.date: 08/30/2016
 # Sharing Settings Location Templates with the UE-V Template Gallery
 
 
-##  Share location templates with the template gallery
+## Share location templates with the template gallery
 
 
 The Microsoft User Experience Virtualization (UE-V) template gallery allows administrators to share their UE-V settings location templates. In the gallery, you can upload your settings location templates for other people to use, and you can download templates that other people have created. The UE-V template gallery is located on Microsoft TechNet here: .
diff --git a/mdop/uev-v1/supported-configurations-for-ue-v-10.md b/mdop/uev-v1/supported-configurations-for-ue-v-10.md
index d3a6b6e9e8..b03acac6d8 100644
--- a/mdop/uev-v1/supported-configurations-for-ue-v-10.md
+++ b/mdop/uev-v1/supported-configurations-for-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Supported Configurations for UE-V 1.0
 description: Supported Configurations for UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: d90ab83e-741f-48eb-b1d8-a64cb9259f7a
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -19,7 +22,7 @@ Microsoft User Experience Virtualization (UE-V) supports the following described
 **Note**  
 Microsoft provides support for the current service pack, and in some cases, the preceding service pack. To find the support timelines for your product, see the [Lifecycle Supported Service Packs](https://go.microsoft.com/fwlink/p/?LinkId=31975). For more information about Microsoft Support Lifecycle Policy, see [Microsoft Support Lifecycle Support Policy FAQ](https://go.microsoft.com/fwlink/p/?LinkId=31976).
 
- 
+ 
 
 ## Supported configurations for UE-V Agent and UE-V Generator
 
@@ -79,7 +82,7 @@ The following table lists the operating systems that support the User Experience
 
 
 
- 
+ 
 
 There are no special RAM requirements that are specific to UE-V.
 
@@ -88,7 +91,7 @@ The installation of the UE-V agent requires administrative rights and will requi
 **Important**  
 The Sync Your Settings feature in Windows 8 must be disabled to allow UE-V to function properly. Synchronization of settings with both Windows 8 and UE-V will result in unpredictable synchronization behavior.
 
- 
+ 
 
 ### Requirements for the Offline Files feature
 
@@ -168,9 +171,9 @@ Supported Configurations for User Experience Virtualization
 
 [Deploying the UE-V Agent](deploying-the-ue-v-agent.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/troubleshooting-ue-v-10.md b/mdop/uev-v1/troubleshooting-ue-v-10.md
index c59ee48ed8..2efd5fe123 100644
--- a/mdop/uev-v1/troubleshooting-ue-v-10.md
+++ b/mdop/uev-v1/troubleshooting-ue-v-10.md
@@ -1,12 +1,15 @@
 ---
 title: Troubleshooting UE-V 1.0
 description: Troubleshooting UE-V 1.0
-author: jamiejdt
+author: dansimp
 ms.assetid: e40f46a9-34f6-40ee-801b-9bf91f65c0e1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -16,7 +19,7 @@ ms.date: 08/30/2016
 
 Troubleshooting content is not included in the Administrator's Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905).
 
-##  Find troubleshooting information
+## Find troubleshooting information
 
 
 You can use the following information to find troubleshooting content or additional technical content for this product.
@@ -41,7 +44,7 @@ The first step to find help content in the Administrator’s Guide is to search
 
 3.  Review the search results for assistance.
 
-##  Create a troubleshooting article
+## Create a troubleshooting article
 
 
 If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP Online Help or TechNet Wiki, you can create your own TechNet Wiki article.
diff --git a/mdop/uev-v1/ue-v-10-security-considerations.md b/mdop/uev-v1/ue-v-10-security-considerations.md
index f913daa0bc..ce833afd9f 100644
--- a/mdop/uev-v1/ue-v-10-security-considerations.md
+++ b/mdop/uev-v1/ue-v-10-security-considerations.md
@@ -1,12 +1,15 @@
 ---
 title: UE-V 1.0 Security Considerations
 description: UE-V 1.0 Security Considerations
-author: jamiejdt
+author: dansimp
 ms.assetid: c5cdf9ff-dc96-4491-98e9-0eada898ffe0
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -54,130 +57,132 @@ Because settings packages may contain personal information, you should take care
         
         
 
-         
 
-    2.  Set the following NTFS permissions for the settings storage location folder:
 
-        
-        -        -        -        -        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
    




    User accountRecommended permissionsFolder
    Creator/Owner
    No Permissions
    No Permissions
    Domain Admins
    Full Control
    This Folder, Subfolders and Files
    Security group of UE-V users
    List Folder/Read Data, Create Folders/Append Data
    This Folder Only
    Everyone
    Remove all Permissions
    No Permissions
    
+~~~
+2.  Set the following NTFS permissions for the settings storage location folder:
 
-         
+    
+    +    +    +    +    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
    




    User accountRecommended permissionsFolder
    Creator/Owner
    No Permissions
    No Permissions
    Domain Admins
    Full Control
    This Folder, Subfolders and Files
    Security group of UE-V users
    List Folder/Read Data, Create Folders/Append Data
    This Folder Only
    Everyone
    Remove all Permissions
    No Permissions
    
 
-    3.  Set the following share-level (SMB) permissions for the settings template catalog folder.
 
-        
-        -        -        -        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
    



    User accountRecommend permissions
    Everyone
    No Permissions
    Domain Computers
    Read Permission Levels
    Administrators
    Read/Write Permission Levels
    
 
-         
+3.  Set the following share-level (SMB) permissions for the settings template catalog folder.
 
-    4.  Set the following NTFS permissions for the settings template catalog folder.
+    
+    +    +    +    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
    



    User accountRecommend permissions
    Everyone
    No Permissions
    Domain Computers
    Read Permission Levels
    Administrators
    Read/Write Permission Levels
    
 
-        
-        -        -        -        -        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
-        
    




    User accountRecommended permissionsApply to
    Creator/Owner
    Full Control
    This Folder, Subfolders and Files
    Domain Computers
    List Folder Contents and Read
    This Folder, Subfolders and Files
    Everyone
    No Permissions
    No Permissions
    Administrators
    Full Control
    This Folder, Subfolders and Files
    
 
-         
 
-### Use Windows Server 2003 or later servers to host redirected file shares
+4.  Set the following NTFS permissions for the settings template catalog folder.
+
+    
+    +    +    +    +    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
+    
    




    User accountRecommended permissionsApply to
    Creator/Owner
    Full Control
    This Folder, Subfolders and Files
    Domain Computers
    List Folder Contents and Read
    This Folder, Subfolders and Files
    Everyone
    No Permissions
    No Permissions
    Administrators
    Full Control
    This Folder, Subfolders and Files
    
+~~~
+
+
+
+### Use Windows Server 2003 or later servers to host redirected file shares
 
 User settings package files contain personal information that is transferred between the client computer and the server that stores the settings packages. Because of this, you should ensure that the data is protected while it travels over the network.
 
 User settings data is vulnerable to these potential threats: interception of the data as it passes over the network; tampering with the data as it passes over the network; and spoofing of the server that hosts the data.
 
-Several features of Windows Server 2003 and above can help to secure user data:
+Several features of Windows Server 2003 and above can help to secure user data:
 
--   **Kerberos** - Kerberos is standard on all versions of Windows 2000 and Windows Server 2003 and later. Kerberos ensures the highest level of security to network resources. NTLM authenticates the client only; Kerberos authenticates the server and the client. When NTLM is used, the client does not know whether the server is valid. This is particularly important if the client is exchanging personal files with the server, as is the case with Roaming Profiles. Kerberos provides better security than NTLM. Kerberos is not available on Windows NT version 4.0 or earlier operating systems.
+-   **Kerberos** - Kerberos is standard on all versions of Windows 2000 and Windows Server 2003 and later. Kerberos ensures the highest level of security to network resources. NTLM authenticates the client only; Kerberos authenticates the server and the client. When NTLM is used, the client does not know whether the server is valid. This is particularly important if the client is exchanging personal files with the server, as is the case with Roaming Profiles. Kerberos provides better security than NTLM. Kerberos is not available on Windows NT version 4.0 or earlier operating systems.
 
 -   **IPsec** - The IP Security Protocol (IPsec) provides network-level authentication, data integrity, and encryption. IPsec ensures the following:
 
@@ -217,7 +222,7 @@ To ensure that UE-V works optimally, create only the root share on the server, a
 
 This permission configuration allows users to create folders for settings storage. The UE-V agent creates and secures a settingspackage folder while running in the context of the user. The user receives full control to their settingspackage folder. Other users do not inherit access to this folder. You do not need to create and secure individual user directories. This will be done automatically by the agent that runs in the context of the user.
 
-**Note**  
+**Note**  
 Additional security can be configured when a Windows server is utilized for the settings storage share. UE-V can be configured to verify that either the local administrator's group or the current user is the owner of the folder where settings packages are stored. To enable additional security use the following command:
 
 1.  Add a REG\_DWORD registry key named "RepositoryOwnerCheckEnabled" to `HKEY_LOCAL_MACHINE\Software\Microsoft\UEV\Agent\Configuration`.
@@ -226,7 +231,7 @@ Additional security can be configured when a Windows server is utilized for the
 
 When this configuration setting is in place, the UE-V agent verifies that the local administrator’s group or current user is the owner of the settingspackage folder. If not, then the UE-V agent will not allow access to the folder.
 
- 
+
 
 If you must create folders for the users and ensure that you have the correct permissions set.
 
@@ -241,9 +246,9 @@ If you redirect UE-V settings to a user’s home directory, be sure that the per
 
 [Security and Privacy for UE-V 1.0](security-and-privacy-for-ue-v-10.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/uev-v1/ue-v-checklist.md b/mdop/uev-v1/ue-v-checklist.md
index 9a269b5bed..6cba1a8c57 100644
--- a/mdop/uev-v1/ue-v-checklist.md
+++ b/mdop/uev-v1/ue-v-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: UE-V Checklist
 description: UE-V Checklist
-author: jamiejdt
+author: dansimp
 ms.assetid: 0e4b9bd5-4e60-4673-b698-90612008fc2b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
@@ -30,42 +33,42 @@ Use this checklist to plan for preparing your computing environment for Microsof
 
 
 
    Review the Getting Started information about UE-V to gain a basic understanding of the product before you begin the deployment planning.
    
-
    [Getting Started With User Experience Virtualization 1.0](getting-started-with-user-experience-virtualization-10.md)
    
+
    Getting Started With User Experience Virtualization 1.0
    
 
 
 
    Prepare your environment for UE-V 1.0 deployment.
    
-
    [Preparing Your Environment for UE-V](preparing-your-environment-for-ue-v.md)
    
+
    Preparing Your Environment for UE-V
    
 
 
 
    Plan which applications end users can synchronize with UE-V 1.0.
    
-
    [Planning Which Applications to Synchronize with UE-V 1.0](planning-which-applications-to-synchronize-with-ue-v-10.md)
    
+
    Planning Which Applications to Synchronize with UE-V 1.0
    
 
 
 
    Custom settings templates only - create custom settings location templates and then define a setting template catalog.
    
-
    [Deploying the Settings Template Catalog for UE-V 1.0](deploying-the-settings-template-catalog-for-ue-v-10.md)
    
-
    [Create UE-V Settings Location Templates with the UE-V Generator](create-ue-v-settings-location-templates-with-the-ue-v-generator.md)
    
+
    Deploying the Settings Template Catalog for UE-V 1.0
    
+
    Create UE-V Settings Location Templates with the UE-V Generator
    
 
 
 
    Decide which method of configuration (Group Policy, PowerShell, ESD-command line, or batch file) works best for your environment and plan how to configure UE-V 1.0.
    
-
    [Planning for UE-V Configuration Methods](planning-for-ue-v-configuration-methods.md)
    
+
    Planning for UE-V Configuration Methods
    
 
 
 
    Deploy the network share to store settings packages.
    
-
    [Deploying the Settings Storage Location for UE-V 1.0](deploying-the-settings-storage-location-for-ue-v-10.md)
    
+
    Deploying the Settings Storage Location for UE-V 1.0
    
 
 
 
    Custom settings templates only – deploy the features that are required to create and store applications other than the UE-V default applications.
    
-
    [Deploying the Settings Template Catalog for UE-V 1.0](deploying-the-settings-template-catalog-for-ue-v-10.md)
    
-
    [Installing the UE-V Generator](installing-the-ue-v-generator.md)
    
+
    Deploying the Settings Template Catalog for UE-V 1.0
    
+
    Installing the UE-V Generator
    
 
 
 
    Familiarize yourself with the administration and management tasks for UE-V.
    
-
    [Administering UE-V 1.0](administering-ue-v-10.md)
    
+
    Administering UE-V 1.0
    
 
 
 
 
- 
+ 
 
 ## Related topics
 
@@ -74,9 +77,9 @@ Use this checklist to plan for preparing your computing environment for Microsof
 
 [Deploying UE-V 1.0](deploying-ue-v-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/user-experience-virtualization-privacy-statement.md b/mdop/uev-v1/user-experience-virtualization-privacy-statement.md
index 742844a96e..32718bfa04 100644
--- a/mdop/uev-v1/user-experience-virtualization-privacy-statement.md
+++ b/mdop/uev-v1/user-experience-virtualization-privacy-statement.md
@@ -1,12 +1,15 @@
 ---
 title: User Experience Virtualization Privacy Statement
 description: User Experience Virtualization Privacy Statement
-author: jamiejdt
+author: dansimp
 ms.assetid: c2919034-f2cf-48d6-b18e-4dd318252426
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 08/30/2016
 ---
 
@@ -160,9 +163,9 @@ For details about what information is collected and how it is used, see the Upda
 
 [Security and Privacy for UE-V 1.0](security-and-privacy-for-ue-v-10.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md b/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md
index 490a7b9acb..c94f45ff95 100644
--- a/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md
+++ b/mdop/uev-v1/validate-ue-v-settings-location-templates-with-ue-v-generator.md
@@ -1,12 +1,15 @@
 ---
 title: Validate UE-V Settings Location Templates with UE-V Generator
 description: Validate UE-V Settings Location Templates with UE-V Generator
-author: jamiejdt
+author: dansimp
 ms.assetid: 131c636c-173a-4b41-af5d-9a75b453b9d8
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md b/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md
index dc77034221..4447b5f189 100644
--- a/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md
+++ b/mdop/uev-v1/working-with-custom-ue-v-templates-and-the-ue-v-generator.md
@@ -1,12 +1,15 @@
 ---
 title: Working with Custom UE-V Templates and the UE-V Generator
 description: Working with Custom UE-V Templates and the UE-V Generator
-author: jamiejdt
+author: dansimp
 ms.assetid: 7bb2583a-b032-4800-9bf9-eb33528e1d0d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
-ms.prod: w8
+ms.prod: w10
 ms.date: 06/16/2016
 ---
 
diff --git a/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md
index 7c04b3654e..e27695620c 100644
--- a/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md
+++ b/mdop/uev-v2/accessibility-for-ue-v-2x-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Accessibility for UE-V 2.x
 description: Accessibility for UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: ec05da5f-4558-4d4d-9b58-3b8ed68cf2fe
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -58,13 +61,13 @@ For information about the availability of Microsoft product documentation and bo
 
    (609) 987-8116
    
 
 
-
    [http://www.learningally.org/](https://go.microsoft.com/fwlink/p/?linkid=239)
    
+
    http://www.learningally.org/
    
 
    Web addresses can change, so you might be unable to connect to the website or sites that are mentioned here.
    
 
 
 
 
- 
+ 
 
 ### Customer service for people with hearing impairments
 
@@ -91,9 +94,9 @@ For more information about how accessible technology for computers can help to i
 
 [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md b/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md
index 117459cd87..67f7c914ec 100644
--- a/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md
+++ b/mdop/uev-v2/administering-ue-v-2x-new-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Administering UE-V 2.x
 description: Administering UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: 996e4797-8383-4627-b714-24a84c907798
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md b/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md
index d714ca370b..a34f4ed131 100644
--- a/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md
+++ b/mdop/uev-v2/administering-ue-v-2x-with-windows-powershell-and-wmi-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Administering UE-V 2.x with Windows PowerShell and WMI
 description: Administering UE-V 2.x with Windows PowerShell and WMI
-author: jamiejdt
+author: dansimp
 ms.assetid: e749ac03-0adf-475a-a4f2-5cc023549b12
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Microsoft User Experience Virtualization (UE-V) 2.0, 2.1, and 2.1 SP1 provide Wi
 **Note**  
 Administering UE-V 2 with Windows PowerShell requires Windows PowerShell 3.0 or higher. For a complete list of UE-V PowerShell cmdlets, see [UE-V 2 Cmdlet Reference](https://go.microsoft.com/fwlink/p/?LinkId=393495).
 
- 
+ 
 
 ## Managing the UE-V 2.x Agent and packages by using Windows PowerShell and WMI
 
@@ -45,9 +48,9 @@ After you create and deploy UE-V settings location templates, you can manage tho
 
 [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md
index 951b805b9f..b821b00937 100644
--- a/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md
+++ b/mdop/uev-v2/application-template-schema-reference-for-ue-v-2x-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Application Template Schema Reference for UE-V 2.x
 description: Application Template Schema Reference for UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: be8735a5-6a3e-4b1f-ba14-2a3bc3e5a8b6
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -148,7 +151,7 @@ The Process data type is a container used to describe processes to be monitored
 
 
 
- 
+ 
 
 **Processes**
 The Processes data type represents a container for a collection of one or more Process elements. Two child elements are supported in the Processes sequence type: **Process** and **ShellProcess**. Process is an element of type Process and ShellProcess is of data type Empty. At least one item must be identified in the sequence.
@@ -198,7 +201,7 @@ Settings is a container for all the settings that apply to a particular template
 
 
 
- 
+ 
 
 ### Name Element
 
@@ -213,7 +216,7 @@ UE-V does not reference external DTDs, so it is not possible to use named entiti
 
 See  for a complete list of character entities. UTF-8-encoded documents may include the Unicode characters directly. Saving templates through the UE-V Generator converts character entities to their Unicode representations automatically.
 
- 
+ 
 
 ### ID Element
 
@@ -237,7 +240,7 @@ Version identifies the version of the settings location template for administrat
 
 **Hint:** You can save notes about version changes using XML comment tags ``, for example:
 
-``` syntax
+```xml
   `, for example:
 
-``` syntax
-  
-  4
+    Version 1 Jul 05, 2012 Initial template created by Generator - Denise@Contoso.com
+    Version 2 Jul 31, 2012 Added support for app.exe v2.1.3 - Mark@Contoso.com
+    Version 3 Jan 01, 2013 Added font settings support - Mark@Contoso.com
+    Version 4 Jan 31, 2013 Added support for plugin settings - Tony@Contoso.com
+  -->
+4
 ```
 
 **Important**  
@@ -1195,7 +1197,7 @@ This value is queried to determine if a new version of a template should be appl
 
 -   When the microsoft\\uev:SettingsLocationTemplate Update method is called through WMI
 
- 
+ 
 
 ### Author Element
 
@@ -1213,25 +1215,25 @@ Author identifies the creator of the settings location template. Two optional ch
 
 Processes contains at least one `` element, which in turn contains the following child elements: **Filename**, **Architecture**, **ProductName**, **FileDescription**, **ProductVersion**, and **FileVersion**. The Filename child element is mandatory and the others are optional. A fully populated element contains tags similar to this example:
 
-``` syntax
-    
-      MyApplication.exe
-      Win64
-       MyApplication 
-      MyApplication.exe
-      
-        
-        
-        
-        
-      
-      
-        
-        
-        
-        
-      
-    
+```xml
+
+  MyApplication.exe
+  Win64
+   MyApplication 
+  MyApplication.exe
+  
+    
+    
+    
+    
+  
+  
+    
+    
+    
+    
+  
+
 ```
 
 ### Filename
@@ -1261,7 +1263,7 @@ A value of **True** indicates that the string contains illegal characters. Here
 **Note**  
 The UE-V Generator encodes the greater than and less than characters as > and < respectively.
 
- 
+ 
 
 In rare circumstances, the FileName value will not necessarily include the .exe extension, but it should be specified as part of the value. For example, `MyApplictication.exe` should be specified instead of `MyApplictication`. The second example will not apply the template to the process if the actual name of the executable file is “MyApplication.exe”.
 
@@ -1278,7 +1280,7 @@ If this element is absent, the settings location template ignores the process’
 **Note**  
 UE-V does not support ARM processors in this version.
 
- 
+ 
 
 ### ProductName
 
@@ -1288,14 +1290,14 @@ UE-V does not support ARM processors in this version.
 
 ProductName is an optional element used to identify a product for administrative purposes or reporting. ProductName differs from Filename in that there are no regular expression restrictions on its value. This allows for more easily understood descriptions of a process where the executable name may not be obvious. For example:
 
-``` syntax
-    
-      MyApplication.exe
-      My Application 6.x by Contoso.com
-      
-        
-      
-    
+```xml
+
+  MyApplication.exe
+  My Application 6.x by Contoso.com
+  
+    
+  
+
 ```
 
 ### FileDescription
@@ -1308,23 +1310,22 @@ FileDescription is an optional tag that allows for an administrative description
 
 For example, in a suited application, it might be useful to provide reminders about the function of two executables (MyApplication.exe and MyApplicationHelper.exe), as shown here:
 
-``` syntax
+```xml
 
-
-   
-      MyApplication.exe
-      My Application Main Engine
-      
-        
-      
-    
-    
-      MyApplicationHelper.exe
-      My Application Background Process Executable
-      
-        
-      
-    
+  
+    MyApplication.exe
+    My Application Main Engine
+    
+      
+    
+  
+  
+    MyApplicationHelper.exe
+    My Application Background Process Executable
+    
+      
+    
+  
 
 ```
 
@@ -1342,44 +1343,44 @@ The product and file version elements may be left unspecified. Doing so makes th
 
 Product version: 1.0 specified in the UE-V Generator produces the following XML:
 
-``` syntax
-      
-        
-        
-      
+```xml
+
+  
+  
+
 ```
 
 **Example 2:**
 
 File version: 5.0.2.1000 specified in the UE-V Generator produces the following XML:
 
-``` syntax
-      
-        
-        
-        
-        
-      
+```xml
+
+  
+  
+  
+  
+
 ```
 
 **Incorrect Example 1 – incomplete range:**
 
 Only the Minimum attribute is present. Maximum must be included in a range as well.
 
-``` syntax
-      
-        
-      
+```xml
+
+  
+
 ```
 
 **Incorrect Example 2 – Minor specified without Major element:**
 
 Only the Minor element is present. Major must be included as well.
 
-``` syntax
-      
-        
-      
+```xml
+
+  
+
 ```
 
 ### FileVersion
@@ -1396,19 +1397,19 @@ Including a FileVersion element for an application allows for more granular fine
 
 The child elements and syntax rules for FileVersion are identical to those of ProductVersion.
 
-``` syntax
-      
-        MSACCESS.EXE
-        Win32
-        
-          
-          
-        
-        
-          
-          
-        
-      
+```xml
+
+  MSACCESS.EXE
+  Win32
+  
+    
+    
+  
+  
+    
+    
+  
+
 ```
 
 ### Application Element
@@ -1429,11 +1430,11 @@ Application is a container for settings that apply to a particular application.
 
 
 
    Name
    
-
    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name).
    
+
    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.
    
 
 
 
    ID
    
-
    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see [ID](#id).
    
+
    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.
    
 
 
 
    Description
    
@@ -1449,7 +1450,7 @@ Application is a container for settings that apply to a particular application.
 
 
 
    Version
    
-
    Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version).
    
+
    Identifies the version of the settings location template for administrative tracking of changes. For more information, see Version.
    
 
 
 
    DeferToMSAccount
    
@@ -1461,16 +1462,16 @@ Application is a container for settings that apply to a particular application.
 
 
 
    Processes
    
-
    A container for a collection of one or more Process elements. For more information, see [Processes](#processes).
    
+
    A container for a collection of one or more Process elements. For more information, see Processes.
    
 
 
 
    Settings
    
-
    A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in [Data types](#data).
    
+
    A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in Data types.
    
 
 
 
 
- 
+ 
 
 ### Common Element
 
@@ -1490,11 +1491,11 @@ Common is similar to an Application element, but it is always associated with tw
 
 
 
    Name
    
-
    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name).
    
+
    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.
    
 
 
 
    ID
    
-
    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see [ID](#id).
    
+
    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.
    
 
 
 
    Description
    
@@ -1510,7 +1511,7 @@ Common is similar to an Application element, but it is always associated with tw
 
 
 
    Version
    
-
    Identifies the version of the settings location template for administrative tracking of changes. For more information, see [Version](#version).
    
+
    Identifies the version of the settings location template for administrative tracking of changes. For more information, see Version.
    
 
 
 
    DeferToMSAccount
    
@@ -1522,12 +1523,12 @@ Common is similar to an Application element, but it is always associated with tw
 
 
 
    Settings
    
-
    A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in [Data types](#data).
    
+
    A container for all the settings that apply to a particular template. It contains instances of the Registry, File, SystemParameter, and CustomAction settings. For more information, see Settings in Data types.
    
 
 
 
 
- 
+ 
 
 ### SettingsLocationTemplate Element
 
@@ -1547,11 +1548,11 @@ This element defines the settings for a single application or a suite of applica
 
 
 
    Name
    
-
    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see [Name](#name).
    
+
    Specifies a unique name for the settings location template. This is used for display purposes when referencing the template in WMI, PowerShell, Event Viewer and debug logs. For more information, see Name.
    
 
 
 
    ID
    
-
    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see [ID](#id).
    
+
    Populates a unique identifier for a particular template. This tag becomes the primary identifier that the UE-V Agent uses to reference the template at runtime. For more information, see ID.
    
 
 
 
    Description
    
@@ -1568,13 +1569,13 @@ This element defines the settings for a single application or a suite of applica
 
 
 
- 
+ 
 
 ### Appendix: SettingsLocationTemplate.xsd
 
 Here is the SettingsLocationTemplate.xsd file showing its elements, child elements, attributes, and parameters:
 
-``` syntax
+```xml
 
 
 
 
- 
+ 
 
 ### Monitor Application Settings
 
@@ -92,7 +95,7 @@ The **Monitor Application Settings** task is used to synchronize settings for Wi
 
 
 
- 
+ 
 
 ### Sync Controller Application
 
@@ -117,7 +120,7 @@ The **Sync Controller Application** task is used to start the Sync Controller to
 
 
 
- 
+ 
 
 For example, the following command configures the agent to synchronize settings every 15 minutes instead of the default 30 minutes.
 
@@ -148,7 +151,7 @@ The **Synchronize Settings at Logoff** task is used to start an application at l
 
 
 
- 
+ 
 
 ### Template Auto Update
 
@@ -173,7 +176,7 @@ The **Template Auto Update** task checks the settings template catalog for new,
 
 
 
- 
+ 
 
 **Example:** The following command configures the UE-V Agent to check the settings template catalog store every hour.
 
@@ -204,7 +207,7 @@ The **Upload CEIP Data** task runs during the installation if the user or the ad
 
 
 
- 
+ 
 
 ## UE-V 2 Scheduled Task Details
 
@@ -280,7 +283,7 @@ The following chart provides additional information about scheduled tasks for UE
 
 
 
- 
+ 
 
 **Legend**
 
@@ -324,9 +327,9 @@ The following additional information applies to UE-V scheduled tasks:
 
 [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md#deploycatalogue)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md
index 545c246391..ae34b00c58 100644
--- a/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md
+++ b/mdop/uev-v2/configuring-the-company-settings-center-for-ue-v-2x-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Configuring the Company Settings Center for UE-V 2.x
 description: Configuring the Company Settings Center for UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: 48fadb0a-c0dc-4287-9474-f94ce1417003
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -32,7 +35,7 @@ The Company Settings Center desktop application provides users with information
 
     -   Configuration item in the UE-V Configuration Pack for System Center 2012 Configuration Manager: `Tray icon enabled`
 
-     
+     
 
 -   Control Panel application – In Control Panel, browse to **Appearance and Personalization**, and then click **Company Settings Center**.
 
@@ -80,9 +83,9 @@ The Company Settings Center can include a hyperlink that users can click to get
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md b/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md
index 43c909ff82..b55e44d53b 100644
--- a/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md
+++ b/mdop/uev-v2/configuring-ue-v-2x-with-group-policy-objects-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Configuring UE-V 2.x with Group Policy Objects
 description: Configuring UE-V 2.x with Group Policy Objects
-author: jamiejdt
+author: dansimp
 ms.assetid: 2bb55834-26ee-4f19-9860-dfdf3c797143
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -79,13 +82,13 @@ The following policy settings can be configured for UE-V.
 
    Settings storage path
    
 
    Computers and Users
    
 
    This Group Policy setting configures where the user settings are to be stored.
    
-
    Enter a Universal Naming Convention (UNC) path and variables such as \\Server\SettingsShare\%username%.
    
+
    Enter a Universal Naming Convention (UNC) path and variables such as \Server\SettingsShare%username%.
    
 
 
 
    Settings template catalog path
    
 
    Computers Only
    
 
    This Group Policy setting configures where custom settings location templates are stored. This policy setting also configures whether the catalog is to be used to replace the default Microsoft templates that are installed with the UE-V Agent.
    
-
    Enter a Universal Naming Convention (UNC) path such as \\Server\TemplateShare or a folder location on the computer.
    
+
    Enter a Universal Naming Convention (UNC) path such as \Server\TemplateShare or a folder location on the computer.
    
 
    Select the check box to replace the default Microsoft templates.
    
 
 
@@ -121,12 +124,12 @@ The following policy settings can be configured for UE-V.
 
 
 
- 
+ 
 
 **Note**  
 In addition, Group Policy settings are available for many desktop applications and Windows apps. You can use these settings to enable or disable settings synchronization for specific applications.
 
- 
+ 
 
 **Windows App Group Policy settings**
 
@@ -167,7 +170,7 @@ In addition, Group Policy settings are available for many desktop applications a
 
 
 
- 
+ 
 
 For more information about synchronizing Windows apps, see [Windows App List](https://technet.microsoft.com/library/dn458925.aspx#win8applist).
 
@@ -204,9 +207,9 @@ The UE-V Agent uses the following order of precedence to determine synchronizati
 
 [Manage Configurations for UE-V 2.x](manage-configurations-for-ue-v-2x-new-uevv2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md b/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md
index 951fd1dd2e..713779f789 100644
--- a/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md
+++ b/mdop/uev-v2/configuring-ue-v-2x-with-system-center-configuration-manager-2012-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Configuring UE-V 2.x with System Center Configuration Manager 2012
 description: Configuring UE-V 2.x with System Center Configuration Manager 2012
-author: jamiejdt
+author: dansimp
 ms.assetid: 9a4e2a74-7646-4a77-b58f-2b4456487295
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -76,7 +79,7 @@ The UE-V Configuration Pack includes tools to perform the following tasks:
     
     
 
-     
+     
 
 -   Verify compliance by confirming that UE-V is running.
 
@@ -235,9 +238,9 @@ The UE-V Configuration Pack for Configuration Manager 2012 SP1 or later can be d
 
 [Manage Configurations for UE-V 2.x](manage-configurations-for-ue-v-2x-new-uevv2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md b/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md
index 2917322ed7..ba9af1726e 100644
--- a/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md
+++ b/mdop/uev-v2/deploy-required-features-for-ue-v-2x-new-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Deploy Required Features for UE-V 2.x
 description: Deploy Required Features for UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: 10399bb3-cc7b-4578-bc0c-2f6b597abe4d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -41,10 +44,10 @@ UE-V requires a location in which to store user settings in settings package fil
 
 If you don’t create a settings storage location, the UE-V Agent will use Active Directory (AD) by default.
 
-**Note**  
+**Note**  
 As a matter of [performance and capacity planning](https://technet.microsoft.com/library/dn458932.aspx#capacity) and to reduce problems with network latency, create settings storage locations on the same local networks where the users’ computers reside. We recommend 20 MB of disk space per user for the settings storage location.
 
- 
+
 
 ### Create a UE-V Settings Storage Location
 
@@ -103,7 +106,7 @@ The UE-V Agent dynamically creates a user-specific settings storage path, with a
     
     
 
-     
+
 
 4.  Set the following NTFS file system permissions for the settings storage location folder.
 
@@ -134,18 +137,18 @@ The UE-V Agent dynamically creates a user-specific settings storage path, with a
     
     
 
-     
+
 
 With this configuration, the UE-V Agent creates and secures a Settingspackage folder while it runs in the context of the user, and grants each user permission to create folders for settings storage. Users receive full control to their Settingspackage folder while other users cannot access it.
 
-**Note**  
+**Note**  
 If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this additional security, specify this setting in the Windows Server Registry Editor:
 
 1.  Add a **REG\_DWORD** registry key named **"RepositoryOwnerCheckEnabled"** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\UEV\\Agent\\Configuration**.
 
 2.  Set the registry key value to *1*.
 
- 
+
 
 ### Use Active Directory with UE-V 2.x
 
@@ -164,7 +167,7 @@ You can configure UE-V before, during, or after UE-V Agent installation, dependi
 
     Supported operating systems for the domain controller that deploys the Group Policy Objects include the following:
 
-    Windows Server 2008 R2
+    Windows Server 2008 R2
 
     Windows Server 2012 and Windows Server 2012 R2
 
@@ -172,12 +175,12 @@ You can configure UE-V before, during, or after UE-V Agent installation, dependi
 
 -   [Windows PowerShell and WMI](https://technet.microsoft.com/library/dn458937.aspx)**:** You can use scripted commands for Windows PowerShell and Windows Management Instrumentation (WMI) to modify configurations after you install the UE-V Agent.
 
-    **Note**  
+    **Note**  
     Registry modification can result in data loss, or the computer becomes unresponsive. We recommend that you use other configuration methods.
 
-     
 
--   **Command-line or Batch Script Installation:** Parameters that are used when you [Deploy the UE-V Agent](#agent) configure many UE-V settings. Electronic software distribution systems, such as System Center 2012 Configuration Manager, use these parameters to configure their clients when they deploy and install the UE-V Agent software.
+
+-   **Command-line or Batch Script Installation:** Parameters that are used when you [Deploy the UE-V Agent](#agent) configure many UE-V settings. Electronic software distribution systems, such as System Center 2012 Configuration Manager, use these parameters to configure their clients when they deploy and install the UE-V Agent software.
 
 ## Deploy the UE-V 2.x Agent
 
@@ -186,10 +189,10 @@ The UE-V Agent is the core of a UE-V deployment and must run on each computer th
 
 **UE-V Agent Installation Files:** A single installation file, AgentSetup.exe, installs the UE-V Agent on both 32-bit and 64-bit operating systems. In addition, AgentSetupx86.msi or AgentSetupx64.msi architecture-specific Windows Installer files are provided, and since they are smaller, they might streamline the agent deployments. The [command-line parameters for the AgentSetup.exe installer](#params) are supported for the Windows Installer installation as well.
 
-**Important**  
+**Important**  
 During UE-V Agent installation or uninstallation, you can either use the AgentSetup.exe file or the AgentSetup<arch>.msi file, but not both. The same file must be used to uninstall the UE-V Agent that was used to install the UE-V Agent.
 
- 
+
 
 ### To Deploy the UE-V Agent
 
@@ -229,42 +232,42 @@ Use the following procedure to deploy the UE-V Agent from a network share.
 
    Command prompt
    
 
    When you install the UE-V Agent at a command prompt, use the %^username% variable format. If quotation marks are required because of spaces in the settings storage path, use a batch script file for deployment.
    
 
    
-
    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%^username%
    
+
    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%^username%
    
 
    
-
    msiexec.exe /i "<path to msi file>" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%^username%
    
+
    msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%^username%
    
 
 
 
    Batch script
    
 
    When you install the UE-V Agent from a batch script file, use the %%username%% variable format. If you use this installation method, you must escape the variable with the %% characters. Without this character, the script expands the username variable at installation time, rather than at run time, which causes UE-V to use a single settings storage location for all users.
    
-
    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\\server\settingsshare\%%username%%"
    
+
    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\server\settingsshare%%username%%"
    
 
    
-
    msiexec.exe /i "<path to msi file>" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\\server\settingsshare\%%username%%"
    
+
    msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath="\server\settingsshare%%username%%"
    
 
    
 
 
 
    Windows PowerShell
    
 
    When you install the UE-V Agent from a Windows PowerShell prompt or a Windows PowerShell script, use the %username% variable format.
    
-
    & AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%
    
+
    & AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%username%
    
 
    
-
    & msiexec.exe /i "<path to msi file>" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\%username%
    
+
    & msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare%username%
    
 
    
 
 
 
    Electronic software distribution, such as deployment of Configuration Manager Software Deployment
    
 
    When you install the UE-V Agent by using Configuration Manager, use the ^%username^% variable format.
    
-
    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\^%username^%
    
+
    AgentSetup.exe /quiet /norestart /log "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare^%username^%
    
 
    
-
    msiexec.exe /i "<path to msi file>" /quiet /norestart /l*v "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\\server\settingsshare\^%username^%
    
+
    msiexec.exe /i "<path to msi file>" /quiet /norestart /lv "%temp%\UE-VAgentInstaller.log" SettingsStoragePath=\server\settingsshare^%username^%
    
 
 
 
 
- 
 
-**Note**  
+
+**Note**  
 The installation of the UE-V Agent requires administrator rights, and the computer requires a restart before the UE-V Agent can run.
 
- 
+
 
 ### Command-line parameters for UE-V Agent deployment
 
@@ -293,12 +296,11 @@ The command-line parameters of the UE-V Agent are as follows.
 
    SettingsStoragePath
    
 
    Indicates the Universal Naming Convention (UNC) path that defines where settings are stored.
    
 
    
-Important  
-
    You must specify a SettingsStoragePath in UE-V 2.1 and UE-V 2.1 SP1. You can set the AdHomePath string to specify that the user's Active Directory home path is used. For example, SettingsStoragePath = \\share\path|AdHomePath.
    
+Important
    You must specify a SettingsStoragePath in UE-V 2.1 and UE-V 2.1 SP1. You can set the AdHomePath string to specify that the user's Active Directory home path is used. For example, SettingsStoragePath = \share\path|AdHomePath.
    
 
    In UE-V 2.0, you can leave SettingsStoragePath blank to use the Active Directory home path instead.
    
 
    
 
    
- 
+
 
    
 
    %username% or %computername% environment variables are accepted. Scripting can require escaped variables.
    
 
    Default: <none>
    
@@ -369,11 +371,10 @@ The command-line parameters of the UE-V Agent are as follows.
 
    ACCEPTLICENSETERMS
    
 
    Lets UE-V be installed silently. This must be set to True to install UE-V silently and bypass the requirement that the user accepts the UE-V license terms. If set to False or left empty, the user receives an error message and UE-V is not installed.
    
 
    
-Important  
-
    This parameter is required to install UE-V silently.
    
+Important
    This parameter is required to install UE-V silently.
    
 
    
 
    
- 
+
 
    
 
 
@@ -384,7 +385,7 @@ The command-line parameters of the UE-V Agent are as follows.
 
 
 
- 
+
 
 ### Update the UE-V Agent
 
@@ -396,10 +397,10 @@ During a UE-V Agent upgrade, the default group of settings location templates fo
 
 The UE-V 2.x Agent introduces many new features and modifies how and when the agent uploads content to the settings storage share. The upgrade process automates these changes. To upgrade the UE-V Agent, run the UE-V Agent install package (AgentSetup.exe, AgentSetupx86.msi, or AgentSetupx64.msi) on users’ computers.
 
-**Note**  
+**Note**  
 When you upgrade the UE-V Agent, you must use the same installer type (.exe file or .msi packet) that installed the previous UE-V Agent. For example, use the UE-V 2 AgentSetup.exe to upgrade UE-V 1.0 Agents that were installed by using AgentSetup.exe.
 
- 
+
 
 The following configurations are preserved when the Agent Setup program runs:
 
@@ -409,12 +410,12 @@ The following configurations are preserved when the Agent Setup program runs:
 
 -   Scheduled tasks (Interval settings are reset to their defaults)
 
-**Note**  
+**Note**  
 A computer with UE-V 2.x settings location templates that are registered in the UE-V 1.0 Agent register errors in the Windows Event Log.
 
- 
 
-You can use Microsoft System Center 2012 Configuration Manager or another enterprise software distribution tool to automate and distribute the UE-V Agent upgrade.
+
+You can use Microsoft System Center 2012 Configuration Manager or another enterprise software distribution tool to automate and distribute the UE-V Agent upgrade.
 
 **Recommendations:** We recommend that you upgrade all of the UE-V 1.0 Agents in a computing environment, but it is not required. UE-V 2.x settings location templates can interact with a UE-V 1.0 Agent because they only share the settings from the settings storage path. We recommend, however, that you move the deployments to a single agent version to simplify management and to support UE-V.
 
@@ -424,7 +425,7 @@ You might experience errors after you attempt one of the following operations:
 
 -   Upgrade from UE-V 1.0 to UE-V 2
 
--   Upgrade to a newer version of Windows, for example, from Windows 7 to Windows 8 or from Windows 8 to Windows 8.1.
+-   Upgrade to a newer version of Windows, for example, from Windows 7 to Windows 8 or from Windows 8 to Windows 8.1.
 
 -   Uninstall the agent after upgrading the UE-V Agent
 
@@ -448,9 +449,9 @@ You can then retry the uninstall process or upgrade by installing the newer vers
 
 [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md b/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md
index f1bafcb23e..8362ffa04c 100644
--- a/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md
+++ b/mdop/uev-v2/deploy-ue-v-2x-for-custom-applications-new-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Deploy UE-V 2.x for Custom Applications
 description: Deploy UE-V 2.x for Custom Applications
-author: jamiejdt
+author: dansimp
 ms.assetid: f7cb089f-d764-4a93-82b6-926fe0385a23
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -43,7 +46,7 @@ Once you have read through the planning material in [Prepare a UE-V 2.x Deployme
     **Note**  
     Templates that are deployed by using ESD or Group Policy must be registered with UE-V Windows Management Instrumentation (WMI) or Windows PowerShell.
 
-     
+     
 
 ## Prepare to Deploy UE-V 2.x for Custom Applications
 
@@ -65,7 +68,7 @@ The UE-V Generator monitors an application to discover and capture the locations
 **Note**  
 UE-V settings location templates cannot be created from virtualized applications or Terminal Services applications. However, settings that are synchronized by using the templates can be applied to those applications. To create templates that support Virtual Desktop Infrastructure (VDI) and Terminal Services applications, open a version of the Windows Installer (.msi) package of the application by using the UE-V Generator. For more information about synchronizing settings for virtual applications, see [Using UE-V 2.x with Application Virtualization Applications](using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md).
 
- 
+ 
 
 **Excluded Locations:** The discovery process excludes locations that commonly store application software files that do not synchronize settings well between user computers or computing environments. By default, these are excluded:
 
@@ -95,7 +98,7 @@ When you use Group Policy to configure the settings template catalog path, you c
 **Note**  
 If you disable this policy setting after it has been enabled, the UE-V Agent does not restore the default Microsoft templates.
 
- 
+ 
 
 If there are customized templates in the settings template catalog that use the same ID as the default Microsoft templates, and the UE-V Agent is not configured to replace the default Microsoft templates, the Microsoft templates are ignored.
 
@@ -104,7 +107,7 @@ You can also replace the default templates by using the UE-V Windows PowerShell
 **Note**  
 Old settings packages remain in the settings storage location even if you deploy new settings location templates for an application. These packages are not read by the agent, but neither are they automatically deleted.
 
- 
+ 
 
 ## Install the UEV 2.x Generator
 
@@ -128,7 +131,7 @@ Install the Microsoft User Experience Virtualization (UE-V) 2.0 Generator on a c
     **Note**  
     A prompt for **User Account Control** appears before the application is installed. Permission is required to install the UE-V Generator.
 
-     
+     
 
 7.  Click **Finish** to close the wizard after the installation is finished. You must restart your computer before you can run the UE-V Generator.
 
@@ -137,7 +140,7 @@ Install the Microsoft User Experience Virtualization (UE-V) 2.0 Generator on a c
     **Note**  
     The UE-V 2 Generator can only be used to create templates for UE-V 2 Agents. In a mixed deployment of UE-V 1.0 Agents and UE-V 2 Agents, you should continue to use the UE-V 1.0 Generator until you have upgraded all UE-V Agents.
 
-     
+     
 
 ## Deploy a Settings Template Catalog
 
@@ -181,7 +184,7 @@ You can configure the settings template catalog path by using the installation c
     
     
 
-     
+     
 
 3.  Set the following NTFS file system permissions for the settings template catalog folder.
 
@@ -222,7 +225,7 @@ You can configure the settings template catalog path by using the installation c
     
     
 
-     
+     
 
 4.  Click **OK** to close the dialog boxes.
 
@@ -244,7 +247,7 @@ Use the UE-V Generator to create settings location templates for line-of-busines
     **Note**  
     Before the application is started, the system displays a prompt for **User Account Control**. Permission is required to monitor the registry and file locations that the application uses to store settings.
 
-     
+     
 
 4.  After the application starts, close the application. The UE-V Generator records the locations where the application stores its settings.
 
@@ -310,14 +313,14 @@ Templates that are deployed by using an ESD system or Group Policy Objects must
     **Note**  
     Templates on computers are updated daily. The update is based on changes to the settings template catalog.
 
-     
+     
 
 3.  To manually update templates on a computer that runs the UE-V Agent, open an elevated command prompt, and browse to **%Program Files%\\Microsoft User Experience Virtualization \\ Agent \\ <x86 or x64 >**, and then run **ApplySettingsTemplateCatalog.exe**.
 
     **Note**  
     This program runs automatically during computer startup and daily at 3:30 A. M. to gather any new templates that were recently added to the catalog.
 
-     
+     
 
 
 
@@ -331,9 +334,9 @@ Templates that are deployed by using an ESD system or Group Policy Objects must
 
 [Deploy Required Features for UE-V 2.x](deploy-required-features-for-ue-v-2x-new-uevv2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md b/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md
index 2c31ff321d..70de32e73b 100644
--- a/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md
+++ b/mdop/uev-v2/get-started-with-ue-v-2x-new-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Get Started with UE-V 2.x
 description: Get Started with UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: 526ecbf0-0dee-4f0b-b017-8f8d25357b14
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -19,7 +22,7 @@ Follow the steps in this guide to quickly deploy Microsoft User Experience Virtu
 **Note**  
 The information in this section is repeated in greater detail throughout the rest of the documentation. So if you already know that UE-V 2 is the right solution and you don’t need to evaluate it, you can just go right to [Prepare a UE-V 2.x Deployment](prepare-a-ue-v-2x-deployment-new-uevv2.md).
 
- 
+ 
 
 The standard installation of UE-V synchronizes the default Microsoft Windows and Office settings and many Windows app settings. Make sure your test environment includes two or more user computers that share network access and you’ll be evaluating UE-V in just a short time.
 
@@ -111,7 +114,7 @@ Before you proceed, make sure your environment includes these requirements for r
 
 
 
-**Note:** Starting with Windows 10, version 1607, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack
+**Note:** Starting with Windows 10, version 1607, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack
 
 Also…
 
@@ -157,7 +160,7 @@ You’ll need to deploy a settings storage location, a standard network share wh
         
         
 
-         
+         
 
     2.  Set the following NTFS file system permissions for the settings storage location folder.
 
@@ -188,9 +191,9 @@ You’ll need to deploy a settings storage location, a standard network share wh
         
         
 
-         
+         
 
-**Security Note:  **
+**Security Note:**
 
 If you create the settings storage share on a computer running a Windows Server operating system, configure UE-V to verify that either the local Administrators group or the current user is the owner of the folder where settings packages are stored. To enable this additional security, specify this setting in the Windows Server Registry Editor:
 
@@ -256,9 +259,9 @@ You can change the settings in Computer B back to the original Computer A settin
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/index.md b/mdop/uev-v2/index.md
index cf1d9adb63..b0a92410ba 100644
--- a/mdop/uev-v2/index.md
+++ b/mdop/uev-v2/index.md
@@ -1,7 +1,7 @@
 ---
 title: Microsoft User Experience Virtualization (UE-V) 2.x
 description: Microsoft User Experience Virtualization (UE-V) 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: b860fed0-b846-415d-bdd6-ba60231a64be
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
@@ -67,24 +67,23 @@ This diagram shows how deployed UE-V components work together to synchronize set
 
 
 
    Settings location templates
    
-
    UE-V uses XML files as settings location templates to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V . You can also create, edit, or validate custom settings location templates by [managing settings synchronization for custom applications](#customapps).
    
+
    UE-V uses XML files as settings location templates to monitor and synchronize desktop application settings and Windows desktop settings between user computers. By default, some settings location templates are included in UE-V . You can also create, edit, or validate custom settings location templates by managing settings synchronization for custom applications.
    
 
    
-Note  
-
    Settings location templates are not required for Windows apps.
    
+Note
    Settings location templates are not required for Windows apps.
    
 
    
 
    
- 
+
 
    
 
 
 
    Windows app list
    
 
    Settings for Windows apps are captured and applied dynamically. The app developer specifies the settings that are synchronized for each app. UE-V determines which Windows apps are enabled for settings synchronization using a managed list of apps. By default, this list includes most Windows apps.
    
-
    You can add or remove applications in the Windows app list by following the procedures shown [here](https://technet.microsoft.com/library/dn458925.aspx).
    
+
    You can add or remove applications in the Windows app list by following the procedures shown here.
    
 
 
 
 
- 
+
 
 ### Managing Settings Synchronization for Custom Applications
 
@@ -103,12 +102,12 @@ Use these UE-V components to create and manage custom templates for your third-p
 
 
    Settings template catalog
    
 
    The settings template catalog is a folder path on UE-V computers or a Server Message Block (SMB) network share that stores the custom settings location templates. The UE-V Agent checks this location once a day, retrieves new or updated templates, and updates its synchronization behavior.
    
-
    If you use only the UE-V default settings location templates, then a settings template catalog is unnecessary. For more information about settings deployment catalogs, see [Configure a UE-V settings template catalog](https://technet.microsoft.com/library/dn458942.aspx#deploycatalogue).
    
+
    If you use only the UE-V default settings location templates, then a settings template catalog is unnecessary. For more information about settings deployment catalogs, see Configure a UE-V settings template catalog.
    
 
 
 
 
- 
+
 
 ![ue-v generator process](images/ue-vgeneratorprocess.gif)
 
@@ -133,15 +132,15 @@ Many Windows desktop applications, such as Notepad
 
 Many Windows settings, such as desktop background or wallpaper
 
-**Note**  
+**Note**  
 You can also [customize UE-V to synchronize settings](https://technet.microsoft.com/library/dn458942.aspx) for applications other than those synchronized by default.
 
- 
+
 
 ## Compare UE-V to other Microsoft products
 
 
-Use this table to compare UE-V to Synchronize Profiles in Windows 7, Synchronize Profiles in Windows 8, and the Sync PC Settings feature of Microsoft account.
+Use this table to compare UE-V to Synchronize Profiles in Windows 7, Synchronize Profiles in Windows 8, and the Sync PC Settings feature of Microsoft account.
 
 @@ -156,7 +155,7 @@ Use this table to compare UE-V to Synchronize Profiles in Windows 7, Synchroniz
 
-
+
@@ -276,7 +275,7 @@ Use this table to compare UE-V to Synchronize Profiles in Windows 7, Synchroniz
 
    
 

 
    
 FeatureSynchronize Profiles using Windows 7Synchronize Profiles using Windows 7
 Synchronize Profiles using Windows 8
 Synchronize Profiles using Windows 10
 Microsoft account
 
    
 
- 
+
 
 ## UE-V 2.x Release Notes
 
@@ -315,9 +314,9 @@ Find documentation, videos, and other resources for MDOP technologies. You can a
 
 
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md b/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md
index 2ce8a8a4cf..2bee981420 100644
--- a/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md
+++ b/mdop/uev-v2/manage-administrative-backup-and-restore-in-ue-v-2x-new-topic-for-21.md
@@ -1,8 +1,11 @@
 ---
 title: Manage Administrative Backup and Restore in UE-V 2.x
 description: Manage Administrative Backup and Restore in UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: 2eb5ae75-65e5-4afc-adb6-4e83cf4364ae
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -87,10 +90,10 @@ Restoring a user’s device restores the currently registered Template’s setti
 
     If the user’s UE-V settings storage path, domain, and Computer name match the current user then all of the settings for that user are synchronized, with only the latest settings applied. If a user logs on to a new device for the first time and these criteria are met, the settings data is applied to that device.
 
-    **Note**  
+    **Note**  
     Accessibility and Windows Desktop settings require the user to re-logon to Windows to be applied.
 
-     
+
 
 -   **Manual Restore**
 
@@ -126,7 +129,7 @@ WMI and Windows PowerShell commands let you restore application and Windows sett
     
     
 
-     
+
 
 **To restore application settings and Windows settings with WMI**
 
@@ -153,12 +156,14 @@ WMI and Windows PowerShell commands let you restore application and Windows sett
     
     
 
-     
 
-    **Note**  
-    UE-V does not provide a settings rollback for Windows apps.
 
-     
+~~~
+**Note**  
+UE-V does not provide a settings rollback for Windows apps.
+~~~
+
+
 
 
 
@@ -172,9 +177,9 @@ WMI and Windows PowerShell commands let you restore application and Windows sett
 
 [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md b/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md
index 7158058f74..0a0c3a72bf 100644
--- a/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md
+++ b/mdop/uev-v2/manage-configurations-for-ue-v-2x-new-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Manage Configurations for UE-V 2.x
 description: Manage Configurations for UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: e2332eca-a9cd-4446-8f7c-d17058b03466
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md b/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md
index 0e5ca1170c..1b9749d6ca 100644
--- a/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md
+++ b/mdop/uev-v2/managing-the-ue-v-2x-agent-and-packages-with-windows-powershell-and-wmi-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Managing the UE-V 2.x Agent and Packages with Windows PowerShell and WMI
 description: Managing the UE-V 2.x Agent and Packages with Windows PowerShell and WMI
-author: jamiejdt
+author: dansimp
 ms.assetid: 56e6780b-8b2c-4717-91c8-2af63062ab75
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -20,10 +23,10 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m
 
 1.  Stage the UE-V installer file in an accessible network share.
 
-    **Note**  
+    **Note**  
     Use AgentSetup.exe to deploy both 32-bit and 64-bit versions of the UE-V Agent. Windows Installer packages, AgentSetupx86.msi and AgentSetupx64.msi, are available for each architecture. To uninstall the UE-V Agent at a later time by using the installation file, you must use the same file type.
 
-     
+
 
 2.  Use one of the following Windows PowerShell commands to install the UE-V Agent.
 
@@ -33,164 +36,164 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m
 
 **To configure the UE-V Agent by using Windows PowerShell**
 
-1.  Open a Windows PowerShell window. To manage computer settings that affect all users of the computer by using the *Computer* parameter, open the window with an account that has administrator rights.
+1. Open a Windows PowerShell window. To manage computer settings that affect all users of the computer by using the *Computer* parameter, open the window with an account that has administrator rights.
 
-2.  Use the following Windows PowerShell commands to configure the agent.
+2. Use the following Windows PowerShell commands to configure the agent.
+
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    Windows PowerShell commandDescription
    Get-UevConfiguration
    
+   
    Gets the effective UE-V Agent settings. User-specific settings have precedence over the computer settings.
    Get-UevConfiguration - CurrentComputerUser
    
+   
    Gets the UE-V Agent settings values for the current user only.
    Get-UevConfiguration -Computer
    Gets the UE-V Agent configuration settings values for all users on the computer.
    Get-UevConfiguration -Details
    Gets the details for each configuration setting. Displays where the setting is configured or if it uses the default value. Is displayed if the current setting is valid.
    Set-UevConfiguration -Computer –ContactITDescription <IT description>
    Sets the text that is displayed in the Company Settings Center for the help link.
    Set-UevConfiguration -Computer -ContactITUrl <string>
    Sets the URL of the link in the Company Settings Center for the help link. Any URL protocol can be used.
    Set-UevConfiguration -Computer –EnableDontSyncWindows8AppSettings
    Configures the UE-V Agent to not synchronize any Windows apps for all users on the computer.
    Set-UevConfiguration -CurrentComputerUser – EnableDontSyncWindows8AppSettings
    Configures the UE-V Agent to not synchronize any Windows apps for the current computer user.
    Set-UevConfiguration -Computer –EnableFirstUseNotification
    Configures the UE-V Agent to display notification the first time the agent runs for all users on the computer.
    Set-UevConfiguration -Computer –DisableFirstUseNotification
    Configures the UE-V Agent to not display notification the first time that the agent runs for all users on the computer.
    Set-UevConfiguration -Computer –EnableSettingsImportNotify
    Configures the UE-V Agent to notify all users on the computer when settings synchronization is delayed.
    
+   
    Use the DisableSettingsImportNotify parameter to disable notification.
    Set-UevConfiguration - CurrentComputerUser -EnableSettingsImportNotify
    Configures the UE-V Agent to notify the current user when settings synchronization is delayed.
    
+   
    Use the DisableSettingsImportNotify parameter to disable notification.
    Set-UevConfiguration -Computer –EnableSyncUnlistedWindows8Apps
    Configures the UE-V Agent to synchronize all Windows apps that are not explicitly disabled by the Windows app list for all users of the computer. For more information, see "Get-UevAppxPackage" in Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI.
    
+   
    Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V Agent to synchronize only Windows apps that are explicitly enabled by the Windows App List.
    Set-UevConfiguration - CurrentComputerUser - EnableSyncUnlistedWindows8Apps
    Configures the UE-V Agent to synchronize all Windows apps that are not explicitly disabled by the Windows app list for the current user on the computer. For more information, see "Get-UevAppxPackage" in Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI.
    
+   
    Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V Agent to synchronize only Windows apps that are explicitly enabled by the Windows App List.
    Set-UevConfiguration –Computer –DisableSync
    Disables UE-V for all the users on the computer.
    
+   
    Use the EnableSync parameter to enable or re-enable.
    Set-UevConfiguration –CurrentComputerUser -DisableSync
    Disables UE-V for the current user on the computer.
    
+   
    Use the EnableSync parameter to enable or re-enable.
    Set-UevConfiguration -Computer –EnableTrayIcon
    Enables the UE-V icon in the notification area for all users of the computer.
    
+   
    Use the DisableTrayIcon parameter to disable the icon.
    Set-UevConfiguration -Computer -MaxPackageSizeInBytes <size in bytes>
    Configures the UE-V agent to report when a settings package file size reaches the defined threshold for all users on the computer. Sets the threshold package size in bytes.
    Set-UevConfiguration -CurrentComputerUser -MaxPackageSizeInBytes <size in bytes>
    Configures the UE-V agent to report when a settings package file size reaches the defined threshold. Sets the package size warning threshold for the current user.
    Set-UevConfiguration -Computer -SettingsImportNotifyDelayInSeconds
    Specifies the time in seconds before the user is notified for all users of the computer
    Set-UevConfiguration - CurrentComputerUser -SettingsImportNotifyDelayInSeconds
    Specifies the time in seconds before notification for the current user is sent.
    Set-UevConfiguration -Computer -SettingsStoragePath <path to _settings_storage_location>
    Defines a per-computer settings storage location for all users of the computer.
    Set-UevConfiguration -CurrentComputerUser -SettingsStoragePath <path to _settings_storage_location>
    Defines a per-user settings storage location.
    Set-UevConfiguration –Computer –SettingsTemplateCatalogPath <path to catalog>
    Sets the settings template catalog path for all users of the computer.
    Set-UevConfiguration -Computer -SyncMethod <sync method>
    Sets the synchronization method for all users of the computer: SyncProvider or None.
    Set-UevConfiguration -CurrentComputerUser  -SyncMethod <sync method>
    Sets the synchronization method for the current user: SyncProvider or None.
    Set-UevConfiguration -Computer -SyncTimeoutInMilliseconds <timeout in milliseconds>
    Sets the synchronization time-out in milliseconds for all users of the computer
    Set- UevConfiguration -CurrentComputerUser -SyncTimeoutInMilliseconds <timeout in milliseconds>
    Set the synchronization time-out for the current user.
    Clear-UevConfiguration –Computer -<setting name>
    Clears the specified setting for all users on the computer.
    Clear-UevConfiguration –CurrentComputerUser -<setting name>
    Clears the specified setting for the current user only.
    Export-UevConfiguration <settings migration file>
    Exports the UE-V computer configuration to a settings migration file. The file name extension must be .uev.
    
+   
    The Export cmdlet exports all UE-V Agent settings that are configurable with the Computer parameter.
    Import-UevConfiguration <settings migration file>
    Imports the UE-V computer configuration from a settings migration file. The file name extension must be .uev.
    
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    Windows PowerShell commandDescription
    Get-UevConfiguration
    
-    
    Gets the effective UE-V Agent settings. User-specific settings have precedence over the computer settings.
    Get-UevConfiguration - CurrentComputerUser
    
-    
    Gets the UE-V Agent settings values for the current user only.
    Get-UevConfiguration -Computer
    Gets the UE-V Agent configuration settings values for all users on the computer.
    Get-UevConfiguration -Details
    Gets the details for each configuration setting. Displays where the setting is configured or if it uses the default value. Is displayed if the current setting is valid.
    Set-UevConfiguration -Computer –ContactITDescription <IT description>
    Sets the text that is displayed in the Company Settings Center for the help link.
    Set-UevConfiguration -Computer -ContactITUrl <string>
    Sets the URL of the link in the Company Settings Center for the help link. Any URL protocol can be used.
    Set-UevConfiguration -Computer –EnableDontSyncWindows8AppSettings
    Configures the UE-V Agent to not synchronize any Windows apps for all users on the computer.
    Set-UevConfiguration -CurrentComputerUser – EnableDontSyncWindows8AppSettings
    Configures the UE-V Agent to not synchronize any Windows apps for the current computer user.
    Set-UevConfiguration -Computer –EnableFirstUseNotification
    Configures the UE-V Agent to display notification the first time the agent runs for all users on the computer.
    Set-UevConfiguration -Computer –DisableFirstUseNotification
    Configures the UE-V Agent to not display notification the first time that the agent runs for all users on the computer.
    Set-UevConfiguration -Computer –EnableSettingsImportNotify
    Configures the UE-V Agent to notify all users on the computer when settings synchronization is delayed.
    
-    
    Use the DisableSettingsImportNotify parameter to disable notification.
    Set-UevConfiguration - CurrentComputerUser -EnableSettingsImportNotify
    Configures the UE-V Agent to notify the current user when settings synchronization is delayed.
    
-    
    Use the DisableSettingsImportNotify parameter to disable notification.
    Set-UevConfiguration -Computer –EnableSyncUnlistedWindows8Apps
    Configures the UE-V Agent to synchronize all Windows apps that are not explicitly disabled by the Windows app list for all users of the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md).
    
-    
    Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V Agent to synchronize only Windows apps that are explicitly enabled by the Windows App List.
    Set-UevConfiguration - CurrentComputerUser - EnableSyncUnlistedWindows8Apps
    Configures the UE-V Agent to synchronize all Windows apps that are not explicitly disabled by the Windows app list for the current user on the computer. For more information, see "Get-UevAppxPackage" in [Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI](managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md).
    
-    
    Use the DisableSyncUnlistedWindows8Apps parameter to configure the UE-V Agent to synchronize only Windows apps that are explicitly enabled by the Windows App List.
    Set-UevConfiguration –Computer –DisableSync
    Disables UE-V for all the users on the computer.
    
-    
    Use the EnableSync parameter to enable or re-enable.
    Set-UevConfiguration –CurrentComputerUser -DisableSync
    Disables UE-V for the current user on the computer.
    
-    
    Use the EnableSync parameter to enable or re-enable.
    Set-UevConfiguration -Computer –EnableTrayIcon
    Enables the UE-V icon in the notification area for all users of the computer.
    
-    
    Use the DisableTrayIcon parameter to disable the icon.
    Set-UevConfiguration -Computer -MaxPackageSizeInBytes <size in bytes>
    Configures the UE-V agent to report when a settings package file size reaches the defined threshold for all users on the computer. Sets the threshold package size in bytes.
    Set-UevConfiguration -CurrentComputerUser -MaxPackageSizeInBytes <size in bytes>
    Configures the UE-V agent to report when a settings package file size reaches the defined threshold. Sets the package size warning threshold for the current user.
    Set-UevConfiguration -Computer -SettingsImportNotifyDelayInSeconds
    Specifies the time in seconds before the user is notified for all users of the computer
    Set-UevConfiguration - CurrentComputerUser -SettingsImportNotifyDelayInSeconds
    Specifies the time in seconds before notification for the current user is sent.
    Set-UevConfiguration -Computer -SettingsStoragePath <path to _settings_storage_location>
    Defines a per-computer settings storage location for all users of the computer.
    Set-UevConfiguration -CurrentComputerUser -SettingsStoragePath <path to _settings_storage_location>
    Defines a per-user settings storage location.
    Set-UevConfiguration –Computer –SettingsTemplateCatalogPath <path to catalog>
    Sets the settings template catalog path for all users of the computer.
    Set-UevConfiguration -Computer -SyncMethod <sync method>
    Sets the synchronization method for all users of the computer: SyncProvider or None.
    Set-UevConfiguration -CurrentComputerUser  -SyncMethod <sync method>
    Sets the synchronization method for the current user: SyncProvider or None.
    Set-UevConfiguration -Computer -SyncTimeoutInMilliseconds <timeout in milliseconds>
    Sets the synchronization time-out in milliseconds for all users of the computer
    Set- UevConfiguration -CurrentComputerUser -SyncTimeoutInMilliseconds <timeout in milliseconds>
    Set the synchronization time-out for the current user.
    Clear-UevConfiguration –Computer -<setting name>
    Clears the specified setting for all users on the computer.
    Clear-UevConfiguration –CurrentComputerUser -<setting name>
    Clears the specified setting for the current user only.
    Export-UevConfiguration <settings migration file>
    Exports the UE-V computer configuration to a settings migration file. The file name extension must be .uev.
    
-    
    The Export cmdlet exports all UE-V Agent settings that are configurable with the Computer parameter.
    Import-UevConfiguration <settings migration file>
    Imports the UE-V computer configuration from a settings migration file. The file name extension must be .uev.
    
 
-     
 
 **To export UE-V package settings and repair UE-V templates by using Windows PowerShell**
 
@@ -219,7 +222,7 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m
     
     
 
-     
+
 
 **To configure the UE-V Agent by using WMI**
 
@@ -315,13 +318,15 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m
     
     
 
-     
 
-    Upon configuration of the UE-V Agent with WMI and Windows PowerShell, the defined configuration is stored in the registry in the following locations.
 
-    `\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UEV\Agent\Configuration`
+~~~
+Upon configuration of the UE-V Agent with WMI and Windows PowerShell, the defined configuration is stored in the registry in the following locations.
 
-    `\HKEY_CURRENT_USER\SOFTWARE\Microsoft\UEV\Agent\Configuration`
+`\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UEV\Agent\Configuration`
+
+`\HKEY_CURRENT_USER\SOFTWARE\Microsoft\UEV\Agent\Configuration`
+~~~
 
 **To export UE-V package settings and repair UE-V templates by using WMI**
 
@@ -352,9 +357,11 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m
     
     
 
-     
 
-    **Got a suggestion for UE-V**? Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). **Got a UE-V issue**? Use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopuev).
+
+~~~
+**Got a suggestion for UE-V**? Add or vote on suggestions [here](http://uev.uservoice.com/forums/280428-microsoft-user-experience-virtualization). **Got a UE-V issue**? Use the [UE-V TechNet Forum](https://social.technet.microsoft.com/Forums/home?forum=mdopuev).
+~~~
 
 ## Related topics
 
@@ -363,9 +370,9 @@ You can use Windows Management Instrumentation (WMI) and Windows PowerShell to m
 
 [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md b/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md
index 346ee43bd3..d1c3e2c0aa 100644
--- a/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md
+++ b/mdop/uev-v2/managing-ue-v-2x-settings-location-templates-using-windows-powershell-and-wmi-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI
 description: Managing UE-V 2.x Settings Location Templates Using Windows PowerShell and WMI
-author: jamiejdt
+author: dansimp
 ms.assetid: b5253050-acc3-4274-90d0-1fa4c480331d
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -23,7 +26,7 @@ The WMI and Windows PowerShell features of UE-V include the ability to enable, d
 
 You must have administrator permissions to update, register, or unregister a settings location template. Administrator permissions are not required to enable, disable, or list templates.
 
-****To manage settings location templates by using Windows PowerShell****
+***To manage settings location templates by using Windows PowerShell***
 
 1.  Use an account with administrator rights to open a Windows PowerShell command prompt.
 
@@ -152,7 +155,7 @@ You must have administrator permissions to update, register, or unregister a set
     
     
 
-     
+
 
 The UE-V Windows PowerShell features enable you to manage a group of settings templates that are deployed in your enterprise. Use the following procedure to manage a group of templates by using Windows PowerShell.
 
@@ -331,12 +334,14 @@ User Experience Virtualization provides the following set of WMI commands. Admin
     
     
 
-     
 
-    **Note**  
-    Where a list of Package Family Names is called by the WMI command, the list must be in quotes and separated by a pipe symbol, for example, `""`.
 
-     
+~~~
+**Note**  
+Where a list of Package Family Names is called by the WMI command, the list must be in quotes and separated by a pipe symbol, for example, `""`.
+~~~
+
+
 
 ### Deploying the UE-V Agent using Windows PowerShell
 
@@ -344,10 +349,10 @@ User Experience Virtualization provides the following set of WMI commands. Admin
 
 1.  Stage the UE-V Agent installation package in an accessible network share.
 
-    **Note**  
+    **Note**  
     Use AgentSetup.exe to deploy both 32-bit and 64-bit versions of the UE-V Agent. The Windows Installer packages, AgentSetupx86.msi and AgentSetupx64.msi, are available for each architecture. To uninstall the UE-V Agent at a later time by using the installation file, you must use the same file type.
 
-     
+
 
 2.  Use one of the following Windows PowerShell commands to install the UE-V Agent.
 
@@ -364,9 +369,9 @@ User Experience Virtualization provides the following set of WMI commands. Admin
 
 [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md
index ac6a555603..66a3f0adb8 100644
--- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md
+++ b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes
 description: Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: 5ef66cd1-ba2b-4383-9f45-e7cde41f1ba1
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -132,81 +135,81 @@ This section contains hotfixes and KB articles for UE-V 2.0.
 
 
    2927019
    
 
    Hotfix Package 1 for Microsoft User Experience Virtualization 2.0
    
-
    [support.microsoft.com/kb/2927019](https://support.microsoft.com/kb/2927019)
    
+
    support.microsoft.com/kb/2927019
    
 
 
 
    2903501
    
 
    UE-V: User Experience Virtualization (UE-V) compatibility with user profiles
    
-
    [support.microsoft.com/kb/2903501/EN-US](https://support.microsoft.com/kb/2903501/EN-US)
    
+
    support.microsoft.com/kb/2903501/EN-US
    
 
 
 
    2770042
    
 
    UE-V Registry Settings
    
-
    [support.microsoft.com/kb/2770042/EN-US](https://support.microsoft.com/kb/2770042/EN-US)
    
+
    support.microsoft.com/kb/2770042/EN-US
    
 
 
 
    2847017
    
 
    UE-V settings replicated by Internet Explorer
    
-
    [support.microsoft.com/kb/2847017/EN-US](https://support.microsoft.com/kb/2847017/EN-US)
    
+
    support.microsoft.com/kb/2847017/EN-US
    
 
 
 
    2930271
    
 
    Understanding the limitations of roaming Outlook signatures in Microsoft UE-V
    
-
    [support.microsoft.com/kb/2930271/EN-US](https://support.microsoft.com/kb/2930271/EN-US)
    
+
    support.microsoft.com/kb/2930271/EN-US
    
 
 
 
    2769631
    
 
    How to repair a corrupted UE-V install
    
-
    [support.microsoft.com/kb/2769631/EN-US](https://support.microsoft.com/kb/2769631/EN-US)
    
+
    support.microsoft.com/kb/2769631/EN-US
    
 
 
 
    2850989
    
 
    Migrating MAPI profiles with Microsoft UE-V is not supported
    
-
    [support.microsoft.com/kb/2850989/EN-US](https://support.microsoft.com/kb/2850989/EN-US)
    
+
    support.microsoft.com/kb/2850989/EN-US
    
 
 
 
    2769586
    
 
    UE-V roams empty folders and registry keys
    
-
    [support.microsoft.com/kb/2769586/EN-US](https://support.microsoft.com/kb/2769586/EN-US)
    
+
    support.microsoft.com/kb/2769586/EN-US
    
 
 
 
    2782997
    
 
    How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V)
    
-
    [support.microsoft.com/kb/2782997/EN-US](https://support.microsoft.com/kb/2782997/EN-US)
    
+
    support.microsoft.com/kb/2782997/EN-US
    
 
 
 
    2769570
    
 
    UE-V does not update the theme on RDS or VDI sessions
    
-
    [support.microsoft.com/kb/2769570/EN-US](https://support.microsoft.com/kb/2769570/EN-US)
    
+
    support.microsoft.com/kb/2769570/EN-US
    
 
 
 
    2901856
    
 
    Application settings do not sync after you force a restart on a UE-V-enabled computer
    
-
    [support.microsoft.com/kb/2901856/EN-US](https://support.microsoft.com/kb/2901856/EN-US)
    
+
    support.microsoft.com/kb/2901856/EN-US
    
 
 
 
    2850582
    
 
    How To Use Microsoft User Experience Virtualization With App-V Applications
    
-
    [support.microsoft.com/kb/2850582/EN-US](https://support.microsoft.com/kb/2850582/EN-US)
    
+
    support.microsoft.com/kb/2850582/EN-US
    
 
 
 
    3041879
    
 
    Current file versions for Microsoft User Experience Virtualization
    
-
    [support.microsoft.com/kb/3041879/EN-US](https://support.microsoft.com/kb/3041879/EN-US)
    
+
    support.microsoft.com/kb/3041879/EN-US
    
 
 
 
    2843592
    
 
    Information on User Experience Virtualization and High Availability
    
-
    [support.microsoft.com/kb/2843592/EN-US](https://support.microsoft.com/kb/2843592/EN-US)
    
+
    support.microsoft.com/kb/2843592/EN-US
    
 
 
 
 
- 
+ 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md
index c59140995e..4da60e1c20 100644
--- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md
+++ b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md
@@ -1,8 +1,11 @@
 ---
 title: Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes
 description: Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: 79a36c77-fa0c-4651-8028-4a79763a2fd2
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -65,7 +68,7 @@ WORKAROUND: The UE-V installer (.msi) has two new command-line parameters that s
 
 
 
- 
+ 
 
 ### Registry settings do not synchronize between App-V and native applications on the same computer
 
@@ -153,76 +156,76 @@ This section contains hotfixes and KB articles for UE-V 2.1.
 
 
    3018608
    
 
    UE-V 2.1 - TemplateConsole.exe crashes when UE-V WMI classes are missing
    
-
    [support.microsoft.com/kb/3018608/EN-US](https://support.microsoft.com/kb/3018608/EN-US)
    
+
    support.microsoft.com/kb/3018608/EN-US
    
 
 
 
    2903501
    
 
    UE-V: User Experience Virtualization (UE-V) compatibility with user profiles
    
-
    [support.microsoft.com/kb/2903501/EN-US](https://support.microsoft.com/kb/2903501/EN-US)
    
+
    support.microsoft.com/kb/2903501/EN-US
    
 
 
 
    2770042
    
 
    UE-V Registry Settings
    
-
    [support.microsoft.com/kb/2770042/EN-US](https://support.microsoft.com/kb/2770042/EN-US)
    
+
    support.microsoft.com/kb/2770042/EN-US
    
 
 
 
    2847017
    
 
    UE-V settings replicated by Internet Explorer
    
-
    [support.microsoft.com/kb/2847017/EN-US](https://support.microsoft.com/kb/2847017/EN-US)
    
+
    support.microsoft.com/kb/2847017/EN-US
    
 
 
 
    2769631
    
 
    How to repair a corrupted UE-V install
    
-
    [support.microsoft.com/kb/2769631/EN-US](https://support.microsoft.com/kb/2769631/EN-US)
    
+
    support.microsoft.com/kb/2769631/EN-US
    
 
 
 
    2850989
    
 
    Migrating MAPI profiles with Microsoft UE-V is not supported
    
-
    [support.microsoft.com/kb/2850989/EN-US](https://support.microsoft.com/kb/2850989/EN-US)
    
+
    support.microsoft.com/kb/2850989/EN-US
    
 
 
 
    2769586
    
 
    UE-V roams empty folders and registry keys
    
-
    [support.microsoft.com/kb/2769586/EN-US](https://support.microsoft.com/kb/2769586/EN-US)
    
+
    support.microsoft.com/kb/2769586/EN-US
    
 
 
 
    2782997
    
 
    How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V)
    
-
    [support.microsoft.com/kb/2782997/EN-US](https://support.microsoft.com/kb/2782997/EN-US)
    
+
    support.microsoft.com/kb/2782997/EN-US
    
 
 
 
    2769570
    
 
    UE-V does not update the theme on RDS or VDI sessions
    
-
    [support.microsoft.com/kb/2769570/EN-US](https://support.microsoft.com/kb/2769570/EN-US)
    
+
    support.microsoft.com/kb/2769570/EN-US
    
 
 
 
    2850582
    
 
    How To Use Microsoft User Experience Virtualization With App-V Applications
    
-
    [support.microsoft.com/kb/2850582/EN-US](https://support.microsoft.com/kb/2850582/EN-US)
    
+
    support.microsoft.com/kb/2850582/EN-US
    
 
 
 
    3041879
    
 
    Current file versions for Microsoft User Experience Virtualization
    
-
    [support.microsoft.com/kb/3041879/EN-US](https://support.microsoft.com/kb/3041879/EN-US)
    
+
    support.microsoft.com/kb/3041879/EN-US
    
 
 
 
    2843592
    
 
    Information on User Experience Virtualization and High Availability
    
-
    [support.microsoft.com/kb/2843592/EN-US](https://support.microsoft.com/kb/2843592/EN-US)
    
+
    support.microsoft.com/kb/2843592/EN-US
    
 
 
 
 
- 
+ 
 
 
 
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md
index de4f1b1e7b..0a0b7124ef 100644
--- a/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md
+++ b/mdop/uev-v2/microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md
@@ -1,8 +1,11 @@
 ---
 title: Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes
 description: Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes
-author: jamiejdt
+author: dansimp
 ms.assetid: 561988c4-cc5c-4e15-970b-16e942c8f2ef
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -65,7 +68,7 @@ WORKAROUND: The UE-V installer (.msi) has two new command-line parameters that s
 
 
 
- 
+ 
 
 ### Registry settings do not synchronize between App-V and native applications on the same computer
 
@@ -133,7 +136,7 @@ WORKAROUND: When migrating from UE-V 1 to UE-V 2 and it is likely you’ll have
 
 ### UE-V logoff delay
 
-Occassionally on logoff, UE-V takes a long time to sync settings. Typically, this is due to a high latency network or incorrect use of Distrubuted File System (DFS).
+Occasionally on logoff, UE-V takes a long time to sync settings. Typically, this is due to a high latency network or incorrect use of Distrubuted File System (DFS).
 For DFS support, see [Microsoft’s Support Statement Around Replicated User Profile Data](https://support.microsoft.com/kb/2533009) for further details.
 
 WORKAROUND: Starting with HF03, a new registry key has been introduced
@@ -164,76 +167,76 @@ This section contains hotfixes and KB articles for UE-V 2.1 SP1.
 
 
    3018608
    
 
    UE-V 2.1 - TemplateConsole.exe crashes when UE-V WMI classes are missing
    
-
    [support.microsoft.com/kb/3018608/EN-US](https://support.microsoft.com/kb/3018608/EN-US)
    
+
    support.microsoft.com/kb/3018608/EN-US
    
 
 
 
    2903501
    
 
    UE-V: User Experience Virtualization (UE-V) compatibility with user profiles
    
-
    [support.microsoft.com/kb/2903501/EN-US](https://support.microsoft.com/kb/2903501/EN-US)
    
+
    support.microsoft.com/kb/2903501/EN-US
    
 
 
 
    2770042
    
 
    UE-V Registry Settings
    
-
    [support.microsoft.com/kb/2770042/EN-US](https://support.microsoft.com/kb/2770042/EN-US)
    
+
    support.microsoft.com/kb/2770042/EN-US
    
 
 
 
    2847017
    
 
    UE-V settings replicated by Internet Explorer
    
-
    [support.microsoft.com/kb/2847017/EN-US](https://support.microsoft.com/kb/2847017/EN-US)
    
+
    support.microsoft.com/kb/2847017/EN-US
    
 
 
 
    2769631
    
 
    How to repair a corrupted UE-V install
    
-
    [support.microsoft.com/kb/2769631/EN-US](https://support.microsoft.com/kb/2769631/EN-US)
    
+
    support.microsoft.com/kb/2769631/EN-US
    
 
 
 
    2850989
    
 
    Migrating MAPI profiles with Microsoft UE-V is not supported
    
-
    [support.microsoft.com/kb/2850989/EN-US](https://support.microsoft.com/kb/2850989/EN-US)
    
+
    support.microsoft.com/kb/2850989/EN-US
    
 
 
 
    2769586
    
 
    UE-V roams empty folders and registry keys
    
-
    [support.microsoft.com/kb/2769586/EN-US](https://support.microsoft.com/kb/2769586/EN-US)
    
+
    support.microsoft.com/kb/2769586/EN-US
    
 
 
 
    2782997
    
 
    How To Enable Debug Logging in Microsoft User Experience Virtualization (UE-V)
    
-
    [support.microsoft.com/kb/2782997/EN-US](https://support.microsoft.com/kb/2782997/EN-US)
    
+
    support.microsoft.com/kb/2782997/EN-US
    
 
 
 
    2769570
    
 
    UE-V does not update the theme on RDS or VDI sessions
    
-
    [support.microsoft.com/kb/2769570/EN-US](https://support.microsoft.com/kb/2769570/EN-US)
    
+
    support.microsoft.com/kb/2769570/EN-US
    
 
 
 
    2850582
    
 
    How To Use Microsoft User Experience Virtualization With App-V Applications
    
-
    [support.microsoft.com/kb/2850582/EN-US](https://support.microsoft.com/kb/2850582/EN-US)
    
+
    support.microsoft.com/kb/2850582/EN-US
    
 
 
 
    3041879
    
 
    Current file versions for Microsoft User Experience Virtualization
    
-
    [support.microsoft.com/kb/3041879/EN-US](https://support.microsoft.com/kb/3041879/EN-US)
    
+
    support.microsoft.com/kb/3041879/EN-US
    
 
 
 
    2843592
    
 
    Information on User Experience Virtualization and High Availability
    
-
    [support.microsoft.com/kb/2843592/EN-US](https://support.microsoft.com/kb/2843592/EN-US)
    
+
    support.microsoft.com/kb/2843592/EN-US
    
 
 
 
 
- 
+ 
 
 
 
 
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md b/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md
index 72c6be572e..d87870c3ad 100644
--- a/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md
+++ b/mdop/uev-v2/migrating-ue-v-2x-settings-packages-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Migrating UE-V 2.x Settings Packages
 description: Migrating UE-V 2.x Settings Packages
-author: jamiejdt
+author: dansimp
 ms.assetid: f79381f4-e142-405c-b728-5c048502aa70
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -37,7 +40,7 @@ Simply copying the files and folders does not preserve the security settings and
     **Note**  
     To monitor the copy progress, open MySettings.txt with a log viewer such as Trace32.
 
-     
+     
 
 4.  Grant share-level permissions to the new share. Leave the NTFS file system permissions as they were set by Robocopy.
 
@@ -50,9 +53,9 @@ Simply copying the files and folders does not preserve the security settings and
 
 [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md b/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md
index 8c85680256..80cc0caffa 100644
--- a/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md
+++ b/mdop/uev-v2/prepare-a-ue-v-2x-deployment-new-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Prepare a UE-V 2.x Deployment
 description: Prepare a UE-V 2.x Deployment
-author: jamiejdt
+author: dansimp
 ms.assetid: c429fd06-13ff-48c5-b9c9-fa1ec01ab800
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -83,10 +86,10 @@ See [User Experience Virtualization (UE-V) settings templates for Microsoft Offi
 
 When you install the UE-V 2.1 or 2.1 SP1 Agent, it registers a default group of settings location templates that capture settings values for these common Microsoft applications.
 
-**Tip**  
+**Tip**  
 **Microsoft Office 2007 Settings Synchronization** – In UE-V 2.1 and 2.1 SP1, a settings location template is no longer included by default for Office 2007 applications. However, you can still use Office 2007 templates from UE-V 2.0 or earlier and can get the templates from the [UE-V template gallery](https://go.microsoft.com/fwlink/p/?LinkID=246589).
 
- 
+
 
 @@ -102,7 +105,7 @@ When you install the UE-V 2.1 or 2.1 SP1 Agent, it registers a default group of
 
+
    (Download a list of all settings synced)
    
+
    (Download a list of all settings synced)
    
@@ -161,21 +162,21 @@ When you install the UE-V 2.1 or 2.1 SP1 Agent, it registers a default group of
 
    
 

 
    
 
    Microsoft Office 2010 applications
    
-
    ([Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367))
    		
 
    Microsoft Word 2010
    
 
    Microsoft Excel 2010
    
 
    Microsoft Outlook 2010
    
@@ -119,7 +122,7 @@ When you install the UE-V 2.1 or 2.1 SP1 Agent, it registers a default group of
 
    
 
    
 
    Microsoft Office 2013 applications
    
-
    ([Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367))
    		
 
    Microsoft Word 2013
    
 
    Microsoft Excel 2013
    
 
    Microsoft Outlook 2013
    
@@ -136,22 +139,20 @@ When you install the UE-V 2.1 or 2.1 SP1 Agent, it registers a default group of
 
    Microsoft OneDrive for Business 2013
    
 
    The UE-V 2.1 and 2.1 SP1 Microsoft Office 2013 settings location templates include improved Outlook signature support. We’ve added synchronization of default signature settings for new, reply, and forwarded emails.
    
 
    
-Note  
-
    An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization.
    
+Note
    An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization.
    
 
    
 
    
- 
+
 
    		
 
    
 
    
 
    Browser options: Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11
    		
 
    Favorites, home page, tabs, and toolbars.
    
 
    
-Note  
-
    UE-V does not roam settings for Internet Explorer cookies.
    
+Note
    UE-V does not roam settings for Internet Explorer cookies.
    
 
    
 
    
- 
+
 
    		
 
    
 
    
 
    
 
- 
 
-**Note**  
+
+**Note**  
 UE-V 2.1 SP1 does not synchronize settings between the Microsoft Calculator in Windows 10 and the Microsoft Calculator in previous operating systems.
 
- 
+
 
 ### Desktop applications synchronized by default in UE-V 2.0
 
 When you install the UE-V 2.0 Agent, it registers a default group of settings location templates that capture settings values for these common Microsoft applications.
 
-**Tip**  
+**Tip**  
 **Microsoft Office 2013 Settings Synchronization** – In UE-V 2.0, a settings location template is not included by default for Office 2013 applications, but is available for download from the [UE-V template gallery](https://go.microsoft.com/fwlink/p/?LinkID=246589). [Synchronizing Office 2013 with UE-V 2.0](synchronizing-office-2013-with-ue-v-20-both-uevv2.md) provides details about the supported templates that synchronize Office 2013 settings.
 
- 
+
 
 @@ -191,7 +192,7 @@ When you install the UE-V 2.0 Agent, it registers a default group of settings lo
 
+
    (Download a list of all settings synced)
    
+
    (Download a list of all settings synced)
    
@@ -240,7 +240,7 @@ When you install the UE-V 2.0 Agent, it registers a default group of settings lo
 
    
 

 
    
 
    Microsoft Office 2007 applications
    
-
    ([Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367))
    		
 
    Microsoft Access 2007
    
 
    Microsoft Communicator 2007
    
 
    Microsoft Excel 2007
    
@@ -207,7 +208,7 @@ When you install the UE-V 2.0 Agent, it registers a default group of settings lo
 
    
 
    
 
    Microsoft Office 2010 applications
    
-
    ([Download a list of all settings synced](https://www.microsoft.com/download/details.aspx?id=46367))
    		
 
    Microsoft Word 2010
    
 
    Microsoft Excel 2010
    
 
    Microsoft Outlook 2010
    
@@ -226,11 +227,10 @@ When you install the UE-V 2.0 Agent, it registers a default group of settings lo
 
    Browser options: Internet Explorer 8, Internet Explorer 9, and Internet Explorer 10
    		
 
    Favorites, home page, tabs, and toolbars.
    
 
    
-Note  
-
    UE-V does not roam settings for Internet Explorer cookies.
    
+Note
    UE-V does not roam settings for Internet Explorer cookies.
    
 
    
 
    
- 
+
 
    		
 
    
 
    
 
    
 
- 
+
 
 ### Windows settings synchronized by default
 
@@ -288,17 +288,17 @@ UE-V includes settings location templates that capture settings values for these
 
 
 
- 
 
-**Note**  
+
+**Note**  
 Starting in Windows 8, UE-V does not roam settings related to the Start screen, such as items and locations. In addition, UE-V does not support synchronization of pinned taskbar items or Windows file shortcuts.
 
- 
 
-**Important**  
+
+**Important**  
 UE-V 2.1 SP1 roams taskbar settings between Windows 10 devices. However, UE-V does not synchronize taskbar settings between Windows 10 devices and devices running previous operating systems.
 
- 
+
 
 @@ -359,7 +359,7 @@ UE-V 2.1 SP1 roams taskbar settings between Windows 10 devices. However, UE-V do
 
    
 

 
    
 
- 
+
 
 ### UE-V-support for Windows Apps
 
@@ -367,10 +367,10 @@ For Windows apps, the app developer specifies the settings that are synchronized
 
 To display a list of Windows apps that can synchronize settings on a computer with their package family name, enabled status, and enabled source, at a Windows PowerShell command prompt, enter: `Get-UevAppxPackage`
 
-**Note**  
+**Note**  
 As of Windows 8, UE-V does not synchronize Windows app settings if the domain user links their sign-in credentials to their Microsoft Account. This linking synchronizes settings to Microsoft OneDrive so UE-V, which disables synchronization of Windows app settings.
 
- 
+
 
 ### UE-V-support for Roaming Printers
 
@@ -384,10 +384,10 @@ Printer roaming in UE-V requires one of these scenarios:
 
 -   The printer driver can be obtained from Windows Update.
 
-**Note**  
+**Note**  
 The UE-V printer roaming feature does **not** roam printer settings or preferences, such as printing double-sided.
 
- 
+
 
 ### Determine whether you need settings synchronized for other applications
 
@@ -437,7 +437,7 @@ If you’ve decided that you need settings synchronized for other applications,
 
 
 Checklist box
-
    Does the application store settings in the Program Files directory or in the file directory that is located in the Users\[User name]\AppData\LocalLow directory? Application data that is stored in either of these locations usually should not synchronize with the user, because this data is specific to the computer or because the data is too large to synchronize.
    
+
    Does the application store settings in the Program Files directory or in the file directory that is located in the Users[User name]<strong>AppData<strong>LocalLow directory? Application data that is stored in either of these locations usually should not synchronize with the user, because this data is specific to the computer or because the data is too large to synchronize.
    
 
 
 Checklist box
@@ -450,7 +450,7 @@ If you’ve decided that you need settings synchronized for other applications,
 
 
 
- 
+
 
 ## Other Considerations when Preparing a UE-V Deployment
 
@@ -475,10 +475,10 @@ You should also consider these things when you are preparing to deploy UE-V:
 
 Many enterprise applications, including Microsoft Outlook and Lync, prompt users for their domain credentials at login. Users have the option of saving their credentials to disk to prevent having to enter them every time they open these applications. Enabling roaming credentials synchronization lets users save their credentials on one computer and avoid re-entering them on every computer they use in their environment. Users can synchronize some domain credentials with UE-V 2.1 and 2.1 SP1.
 
-**Important**  
+**Important**  
 Credentials synchronization is disabled by default. You must explicitly enable credentials synchronization during deployment to implement this feature.
 
- 
+
 
 UE-V 2.1 and 2.1 SP1 can synchronize enterprise credentials, but do not roam credentials intended only for use on the local computer.
 
@@ -486,10 +486,10 @@ Credentials are synchronous settings, meaning they are applied to your profile t
 
 Credentials synchronization is managed by its own settings location template, which is disabled by default. You can enable or disable this template through the same methods used for other templates. The template identifier for this feature is RoamingCredentialSettings.
 
-**Important**  
+**Important**  
 If you are using Active Directory Credential Roaming in your environment, we recommend that you don’t enable the UE-V credential roaming template.
 
- 
+
 
 Use one of these methods to enable credentials synchronization:
 
@@ -499,10 +499,10 @@ Use one of these methods to enable credentials synchronization:
 
 -   Group Policy
 
-**Note**  
+**Note**  
 Credentials are encrypted during synchronization.
 
- 
+
 
 [Company Settings Center](https://technet.microsoft.com/library/dn458903.aspx)**:** Check the Roaming Credential Settings check box under Windows Settings to enable credential synchronization. Uncheck the box to disable it. This check box only appears in Company Settings Center if your account is not configured to synchronize settings using a Microsoft Account.
 
@@ -642,7 +642,7 @@ Before you proceed, make sure your environment includes these requirements for r
 
 
 
-
    Windows 7
    
+
    Windows 7
    
 
    Ultimate, Enterprise, or Professional Edition
    
 
    SP1
    
 
    32-bit or 64-bit
    
@@ -651,7 +651,7 @@ Before you proceed, make sure your environment includes these requirements for r
 
    .NET Framework 4 or higher for UE-V 2.0.
    
 
 
-
    Windows Server 2008 R2
    
+
    Windows Server 2008 R2
    
 
    Standard, Enterprise, Datacenter, or Web Server
    
 
    SP1
    
 
    64-bit
    
@@ -670,11 +670,10 @@ Before you proceed, make sure your environment includes these requirements for r
 
 
    Windows 10, pre-1607 version
    
 
    
-Note  
-
    Only UE-V 2.1 SP1 supports Windows 10, pre-1607 version
    
+Note
    Only UE-V 2.1 SP1 supports Windows 10, pre-1607 version
    
 
    
 
    
- 
+
 
    
 
    Enterprise or Pro
    
 
    None
    
@@ -701,7 +700,7 @@ Before you proceed, make sure your environment includes these requirements for r
 
 
 
- 
+
 
 Also…
 
@@ -709,16 +708,16 @@ Also…
 
 -   **Administrative Credentials** for any computer on which you’ll be installing
 
-**Note**  
+**Note**  
 
--   Starting with WIndows 10, version 1607, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack.
+-   Starting with WIndows 10, version 1607, UE-V is included with [Windows 10 for Enterprise](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise) and is no longer part of the Microsoft Desktop Optimization Pack.
 
 -   The UE-V Windows PowerShell feature of the UE-V Agent requires .NET Framework 4 or higher and Windows PowerShell 3.0 or higher to be enabled. Download Windows PowerShell 3.0 [here](https://go.microsoft.com/fwlink/?LinkId=309609).
 
--   Install .NET Framework 4 or .NET Framework 4.5 on computers that run the Windows 7 or the Windows Server 2008 R2 operating system. The Windows 8, Windows 8.1, and Windows Server 2012 operating systems come with .NET Framework 4.5 installed. The Windows 10 operating system comes with .NET Framework 4.6 installed.
+-   Install .NET Framework 4 or .NET Framework 4.5 on computers that run the Windows 7 or the Windows Server 2008 R2 operating system. The Windows 8, Windows 8.1, and Windows Server 2012 operating systems come with .NET Framework 4.5 installed. The Windows 10 operating system comes with .NET Framework 4.6 installed.
 -   The “Delete Roaming Cache” policy for Mandatory profiles is not supported with UE-V and should not be used.
 
- 
+
 
 There are no special random access memory (RAM) requirements specific to UE-V.
 
@@ -744,30 +743,30 @@ Enable this configuration through one of these methods:
 
 -   During UE-V installation, at the command prompt or in a batch file, set the AgentSetup.exe parameter *SyncMethod = None*. [Deploying the UE-V 2.x Agent](https://technet.microsoft.com/library/dn458891.aspx#agent) provides more information.
 
--   After the UE-V installation, use the Settings Management feature in System Center 2012 Configuration Manager or the MDOP ADMX templates to push the *SyncMethod = None* configuration.
+-   After the UE-V installation, use the Settings Management feature in System Center 2012 Configuration Manager or the MDOP ADMX templates to push the *SyncMethod = None* configuration.
 
 -   Use Windows PowerShell or Windows Management Instrumentation (WMI) to set the *SyncMethod = None* configuration.
 
-    **Note**  
+    **Note**  
     These last two methods do not work for pooled virtual desktop infrastructure (VDI) environments.
 
-     
+
 
 You must restart the computer before the settings start to synchronize.
 
-**Note**  
+**Note**  
 If you set *SyncMethod = None*, any settings changes are saved directly to the server. If the network connection to the settings storage path is not found, then the settings changes are cached on the device and are synchronized the next time that the sync provider runs. If the settings storage path is not found and the user profile is removed from a pooled VDI environment on logoff, settings changes are lost and the user must reapply the change when the computer is reconnected to the settings storage path.
 
- 
+
 
 **Synchronization for external sync engines:** The *SyncMethod=External* parameter specifies that if UE-V settings are written to a local folder on the user computer, then any external sync engine (such as OneDrive for Business, Work Folders, Sharepoint, or Dropbox) can be used to apply these settings to the different computers that users access.
 
 **Support for shared VDI sessions:** UE-V 2.1 and 2.1 SP1 provide support for VDI sessions that are shared among end users. You can register and configure a special VDI template, which ensures that UE-V keeps all of its functionality intact for non-persistent VDI sessions.
 
-**Note**  
+**Note**  
 If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as [back-up/restore and last known good (LKG)](https://technet.microsoft.com/library/dn878331.aspx).
 
- 
+
 
 The VDI template is provided with UE-V 2.1 and 2.1 SP1 and is typically available here after installation: C:\\Program Files\\Microsoft User Experience Virtualization\\Templates\\VdiState.xml
 
@@ -775,7 +774,7 @@ The VDI template is provided with UE-V 2.1 and 2.1 SP1 and is typically availabl
 
 Install the UE-V Generator on the computer that is used to create custom settings location templates. This computer should be able to run the applications whose settings are synchronized. You must be a member of the Administrators group on the computer that runs the UE-V Generator software.
 
-The UE-V Generator must be installed on a computer that uses an NTFS file system. The UE-V Generator software requires .NET Framework 4. For more information, see [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md).
+The UE-V Generator must be installed on a computer that uses an NTFS file system. The UE-V Generator software requires .NET Framework 4. For more information, see [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md).
 
 ## Other resources for this product
 
@@ -795,9 +794,9 @@ The UE-V Generator must be installed on a computer that uses an NTFS file system
 
 
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md
index be09b357cf..f9c72070dc 100644
--- a/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md
+++ b/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Security Considerations for UE-V 2.x
 description: Security Considerations for UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: 9d5c3cae-9fcb-4dea-bd67-741b3dea63be
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -22,7 +25,7 @@ This topic contains a brief overview of accounts and groups, log files, and othe
 **Important**  
 When you create the settings storage share, limit the share access to users who require access.
 
- 
+ 
 
 Because settings packages might contain personal information, you should take care to protect them as well as possible. In general, do the following:
 
@@ -55,7 +58,7 @@ Because settings packages might contain personal information, you should take ca
         | Everyone | No permissions |
         | Domain computers | Read permission Levels |
         | Administrators | Read/write permission levels |
-         
+         
     4.  Set the following NTFS permissions for the settings template catalog folder.
 
         | User account | Recommended permissions | Apply to |
@@ -110,7 +113,7 @@ Additional security can be configured when a Windows Server is used for the sett
 
 When this configuration setting is in place, the UE-V Agent verifies that the local Administrators group or current user is the owner of the settings package folder. If not, then the UE-V Agent does not grant access to the folder.
 
- 
+ 
 
 If you must create folders for the users, ensure that you have the correct permissions set.
 
@@ -130,9 +133,9 @@ If you redirect UE-V settings to a user’s home directory or a custom Active Di
 
 [Technical Reference for UE-V 2.x](technical-reference-for-ue-v-2x-both-uevv2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md
index 095f82e79c..b18eef56fe 100644
--- a/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md
+++ b/mdop/uev-v2/sync-methods-for-ue-v-2x-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Sync Methods for UE-V 2.x
 description: Sync Methods for UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: af0ae894-dfdc-41d2-927b-c2ab1b355ffe
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md
index c58d24cbd9..acfdf37a3e 100644
--- a/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md
+++ b/mdop/uev-v2/sync-trigger-events-for-ue-v-2x-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Sync Trigger Events for UE-V 2.x
 description: Sync Trigger Events for UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: 4ed71a13-6a4f-4376-996f-74b126536bbc
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -37,7 +40,7 @@ The following table explains the trigger events for classic applications and Win
 
    Windows Logon
    
 
      
 
    • Application and Windows settings are imported to the local cache from the settings storage location.
      • 
-
    • [Asynchronous Windows settings](https://technet.microsoft.com/library/dn458932.aspx#autosyncsettings2) are applied.
      • 
+
    • Asynchronous Windows settings are applied.
      • 
 
    • Synchronous Windows settings will be applied during the next Windows logon.
      • 
 
    • Application settings will be applied when the application starts.
      • 
 
    
@@ -79,19 +82,18 @@ The following table explains the trigger events for classic applications and Win
 
    
 
    Application and Windows settings are synchronized between the settings storage location and the local cache.
    
 
    
-Note  
-
    Settings changes are not cached locally until an application closes. This trigger will not export changes made to a currently running application.
    
+Note
    Settings changes are not cached locally until an application closes. This trigger will not export changes made to a currently running application.
    
 
    For Windows settings, this means that any changes will not be cached locally and exported until the next Lock (Asynchronous) or Logoff (Asynchronous and Synchronous).
    
 
    
 
    
- 
+
 
    
 
    Settings are applied in these cases:
    
 
      
 
    • Asynchronous Windows settings are applied directly.
      • 
 
    • Application settings are applied when the application starts.
      • 
 
    • Both asynchronous and synchronous Windows settings are applied during the next Windows logon.
      • 
-
    • Windows app (AppX) settings are applied during the next refresh. See [Monitor Application Settings](https://technet.microsoft.com/library/dn458944.aspx) for more information.
      • 
+
    • Windows app (AppX) settings are applied during the next refresh. See Monitor Application Settings for more information.
      • 
 
    
 
    NA
    
 
@@ -103,7 +105,7 @@ The following table explains the trigger events for classic applications and Win
 
 
 
- 
+
 
 
 
@@ -119,9 +121,9 @@ The following table explains the trigger events for classic applications and Win
 
 [Choose the Configuration Method for UE-V 2.x](https://technet.microsoft.com/library/dn458891.aspx#config)
 
- 
-
- 
+
+
+
 
 
 
diff --git a/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md b/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md
index 62fd122e29..880b23d11f 100644
--- a/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md
+++ b/mdop/uev-v2/synchronizing-office-2013-with-ue-v-20-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Synchronizing Office 2013 with UE-V 2.0
 description: Synchronizing Office 2013 with UE-V 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: c46feb6d-28a8-4799-888d-053531dc5842
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md
index 3f0dd6974e..44d264f0d9 100644
--- a/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md
+++ b/mdop/uev-v2/technical-reference-for-ue-v-2x-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Technical Reference for UE-V 2.x
 description: Technical Reference for UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: 303cff9a-a96d-4e83-9e94-19b0d3744e1e
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
diff --git a/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md b/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md
index 2bc7e08ad1..a431995b0b 100644
--- a/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md
+++ b/mdop/uev-v2/troubleshooting-ue-v-2x-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Troubleshooting UE-V 2.x
 description: Troubleshooting UE-V 2.x
-author: jamiejdt
+author: dansimp
 ms.assetid: a02847f8-6986-4612-8307-ba1b72d7919b
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -16,7 +19,7 @@ ms.date: 08/30/2016
 
 Troubleshooting content is not included in the Administrator's Guide for this product. Instead, you can find troubleshooting information for this product on the [TechNet Wiki](https://go.microsoft.com/fwlink/p/?LinkId=224905).
 
-##  Find troubleshooting information
+## Find troubleshooting information
 
 
 You can use the following information to find troubleshooting content or additional technical content for this product.
@@ -41,7 +44,7 @@ The first step to find help content in the Administrator’s Guide is to search
 
 3.  Review the search results for assistance.
 
-##  Create a troubleshooting article
+## Create a troubleshooting article
 
 
 If you have a troubleshooting tip or a best practice to share that is not already included in the MDOP Online Help or TechNet Wiki, you can create your own TechNet Wiki article.
diff --git a/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md b/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md
index 9a038522f3..9e9871e1c9 100644
--- a/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md
+++ b/mdop/uev-v2/using-ue-v-2x-with-application-virtualization-applications-both-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Using UE-V 2.x with Application Virtualization Applications
 description: Using UE-V 2.x with Application Virtualization Applications
-author: jamiejdt
+author: dansimp
 ms.assetid: 4644b810-fc48-4fd0-96e4-2fc6cd64d8ad
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -32,7 +35,7 @@ UE-V monitors when an application opens by the program name and, optionally, by
     **Note**  
     If you publish the newly created template to the settings template catalog, the client does not receive the template until the sync provider updates the settings. To manually start this process, open **Task Scheduler**, expand **Task Scheduler Library**, expand **Microsoft**, and expand **UE-V**. In the results pane, right-click **Template Auto Update**, and then click **Run**.
 
-     
+     
 
 4.  Start the App-V package.
 
@@ -46,9 +49,9 @@ UE-V monitors when an application opens by the program name and, optionally, by
 
 [Administering UE-V 2.x](administering-ue-v-2x-new-uevv2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md b/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md
index 7f84bd8f45..873c05ac3b 100644
--- a/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md
+++ b/mdop/uev-v2/whats-new-in-ue-v-20-new-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: What's New in UE-V 2.0
 description: What's New in UE-V 2.0
-author: jamiejdt
+author: dansimp
 ms.assetid: 5d852beb-f293-4e3a-a33b-c40df59a7515
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -43,7 +46,7 @@ By default, UE-V synchronizes the settings of many of the Windows apps included
 **Note**  
 UE-V does not synchronize Windows app settings if the domain users link their sign-in credentials to their Microsoft account. This linking synchronizes settings to Microsoft OneDrive so UE-V only synchronizes the desktop applications.
 
- 
+ 
 
 ## Microsoft account linking
 
@@ -75,9 +78,9 @@ Company Settings Center displays which settings are synchronized and lets users
 
 [Microsoft User Experience Virtualization (UE-V) 2.0 Release Notes](microsoft-user-experience-virtualization--ue-v--20-release-notesuevv2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md b/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md
index d9d06dbd1b..3951f6c67a 100644
--- a/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md
+++ b/mdop/uev-v2/whats-new-in-ue-v-21-new-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: What's New in UE-V 2.1
 description: What's New in UE-V 2.1
-author: jamiejdt
+author: dansimp
 ms.assetid: 7f385183-7d97-4602-b19a-baa710334ade
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -24,7 +27,7 @@ UE-V 2.1 includes the Microsoft Office 2013 settings location template with impr
 **Note**  
 An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization.
 
- 
+ 
 
 Previously UE-V included Microsoft Office 2010 settings location templates that were automatically distributed and registered with the UE-V Agent. UE-V 2.1 works with Office 365 to determine whether Office 2013 settings are roamed by Office 365. If settings are roamed by Office 365 they are not roamed by UE-V. [Overview of user and roaming settings for Office 2013](https://go.microsoft.com/fwlink/p/?LinkID=391220) provides more information.
 
@@ -55,7 +58,7 @@ UE-V 2.1 gives customers the ability to synchronize credentials and certificates
 **Note**  
 In Windows 8 and later, Credential Manager contains web credentials. These credentials are not synchronized between users’ devices.
 
- 
+ 
 
 ## UE-V and Microsoft Account Synchronization
 
@@ -75,7 +78,7 @@ UE-V 2.1 includes [support for VDI sessions](https://technet.microsoft.com/libra
 **Note**  
 If you do not enable VDI mode for non-persistent VDI sessions, certain features do not work, such as back-up/restore and LKG.
 
- 
+ 
 
 ## Administrative Backup and Restore
 
@@ -101,9 +104,9 @@ UE-V now synchronizes touch keyboard personalization, the spelling dictionary, a
 
 [Microsoft User Experience Virtualization (UE-V) 2.1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-release-notesuevv21.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md b/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md
index b90480b137..c58430ce8b 100644
--- a/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md
+++ b/mdop/uev-v2/whats-new-in-ue-v-21-sp1uevv21-sp1.md
@@ -1,8 +1,11 @@
 ---
 title: What's New in UE-V 2.1 SP1
 description: What's New in UE-V 2.1 SP1
-author: jamiejdt
+author: dansimp
 ms.assetid: 9a40c737-ad9a-4ec1-b42b-31bfabe0f170
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -53,7 +56,7 @@ Printer roaming in UE-V requires one of these scenarios:
 **Note**  
 The UE-V printer roaming feature does **not** roam printer settings or preferences, such as printing double-sided.
 
- 
+ 
 
 ## Office 2013 Settings Location Template
 
@@ -63,7 +66,7 @@ UE-V 2.1 and 2.1 SP1 include the Microsoft Office 2013 settings location templat
 **Note**  
 An Outlook profile must be created for any device on which a user wants to sync their Outlook signature. If the profile is not already created, the user can create one and then restart Outlook on that device to enable signature synchronization.
 
- 
+ 
 
 Previously UE-V included Microsoft Office 2010 settings location templates that were automatically distributed and registered with the UE-V Agent. UE-V 2.1 works with Office 365 to determine whether Office 2013 settings are roamed by Office 365. If settings are roamed by Office 365 they are not roamed by UE-V. [Overview of user and roaming settings for Office 2013](https://go.microsoft.com/fwlink/p/?LinkID=391220) provides more information.
 
@@ -89,9 +92,9 @@ UE-V 2.1 ships [Office 2013 and Office 2010 templates](https://technet.microsoft
 
 [Microsoft User Experience Virtualization (UE-V) 2.1 SP1 Release Notes](microsoft-user-experience-virtualization--ue-v--21-sp1-release-notes.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md b/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md
index b1b19388d5..d39f7e4f80 100644
--- a/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md
+++ b/mdop/uev-v2/working-with-custom-ue-v-2x-templates-and-the-ue-v-2x-generator-new-uevv2.md
@@ -1,8 +1,11 @@
 ---
 title: Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator
 description: Working with Custom UE-V 2.x Templates and the UE-V 2.x Generator
-author: jamiejdt
+author: dansimp
 ms.assetid: f0bb4920-0132-472c-a564-abf06a884275
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.pagetype: mdop, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
@@ -61,7 +64,7 @@ Use the UE-V Generator to edit settings location templates. When the revised set
 **Note**  
 If you edit a UE-V 1.0 template by using the UE-V 2 Generator, the template is automatically converted to a UE-V 2 template. UE-V 1.0 Agents can no longer use the edited template.
 
- 
+ 
 
 **To edit a UE-V settings location template with the UE-V Generator**
 
@@ -104,7 +107,7 @@ If you edit a UE-V 1.0 template by using the UE-V 2 Generator, the template is a
     **Note**  
     A settings location template is unique because of the template **ID**. If you copy the template and rename the .xml file, template registration fails because UE-V reads the template **ID** tag in the .xml file to determine the name, not the file name of the .xml file. UE-V also reads the **Version** number to know if anything has changed. If the version number is higher, UE-V updates the template.
 
-     
+     
 
 2.  Open the settings location template file with an XML editor.
 
@@ -162,9 +165,9 @@ Before you deploy any settings location template that you have downloaded from t
 
 [Deploy UE-V 2.x for Custom Applications](deploy-ue-v-2x-for-custom-applications-new-uevv2.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/smb/cloud-mode-business-setup.md b/smb/cloud-mode-business-setup.md
index 9e0b8c0154..b3f0ec8f06 100644
--- a/smb/cloud-mode-business-setup.md
+++ b/smb/cloud-mode-business-setup.md
@@ -2,15 +2,16 @@
 title: Deploy and manage a full cloud IT solution for your business
 description: Learn how to set up a cloud infrastructure for your business, acquire devices and apps, and configure and deploy policies to your devices.
 keywords: smb, full cloud IT solution, small to medium business, deploy, setup, manage, Windows, Intune, Office 365
-ms.prod: w10
-ms.technology: smb-windows
-ms.topic: hero-article
-ms.author: celested
+ms.prod:
+ms.technology:
+ms.author: eravena
+audience: itpro
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: smb
-author: CelesteDG
-ms.date: 10/30/2017
+author: eavena
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
@@ -38,7 +39,7 @@ Go to the Microsoft Bus
 Here's a few things to keep in mind before you get started:
 - You'll need a registered domain to successfully go through the walkthrough.
   - If you already own a domain, you can add this during the Office 365 setup.
-  - If you don't already own a domain, you'll have the option to purchase a domain from the Office 365 admin center. We'll show how to do this as part of the walkthrough.
+  - If you don't already own a domain, you'll have the option to purchase a domain from the Microsoft 365 admin center. We'll show how to do this as part of the walkthrough.
 - You'll need an email address to create your Office 365 tenant.
 - We recommend that you use Internet Explorer for the entire walkthrough. Right click on Internet Explorer and then choose **Start InPrivate Browsing**.
 
@@ -57,115 +58,115 @@ If this is the first time you're setting this up, and you'd like to see how it's
 
 1. Go to the Office 365 page in the Microsoft Business site. Select **Try now** to use the Office 365 Business Premium Trial or select **Buy now** to sign up for Office 365 Business Premium. In this walkthrough, we'll select **Try now**.
 
-  **Figure 1** - Try or buy Office 365
+   **Figure 1** - Try or buy Office 365
 
-  ![Office 365 for business sign up](images/office365_tryorbuy_now.png)
+   ![Office 365 for business sign up](images/office365_tryorbuy_now.png)
 
 2. Fill out the sign up form and provide information about you and your company.
 3. Create a user ID and password to use to sign into your account.
 
-  This step creates an onmicrosoft.com email address. You can use this email address to sign in to the various admin centers. Save your sign-in info so you can use it to sign into https://portal.office.com (the admin portal).
+   This step creates an onmicrosoft.com email address. You can use this email address to sign in to the various admin centers. Save your sign-in info so you can use it to sign into https://portal.office.com (the admin portal).
 
 4. Select **Create my account** and then enter the phone number you used in step 2 to verify your identity. You'll be asked to enter your verification code.
 5. Select **You're ready to go...** which will take you to the Office 365 portal.
 
-  > [!NOTE]  
-  > In the Office 365 portal, icons that are greyed out are still installing.
+   > [!NOTE]  
+   > In the Office 365 portal, icons that are greyed out are still installing.
 
-  **Figure 2** - Office 365 portal
+   **Figure 2** - Office 365 portal
 
-  ![Office 365 portal](images/office365_portal.png)
+   ![Office 365 portal](images/office365_portal.png)
 
 
-6. Select the **Admin** tile to go to the Office 365 admin center.
+6. Select the **Admin** tile to go to the admin center.
 7. In the admin center, click **Next** to see the highlights and welcome info for the admin center. When you're done, click **Go to setup** to complete the Office 365 setup.
 
-  This may take up to a half hour to complete.
+   This may take up to a half hour to complete.
   
-  **Figure 3** - Office 365 admin center
+   **Figure 3** - Admin center
 
-  ![Office 365 admin center](images/office365_admin_portal.png)
+   ![Microsoft 365 admin center](images/office365_admin_portal.png)
 
 
-8. Go back to the Office 365 admin center to add or buy a domain.
-  1. Select the **Domains** option.
+8. Go back to the admin center to add or buy a domain.
+   1. Select the **Domains** option.
 
-    **Figure 4** - Option to add or buy a domain
+      **Figure 4** - Option to add or buy a domain
 
-    ![Add or buy a domain in Office 365 admin center](images/office365_buy_domain.png)
+      ![Add or buy a domain in admin center](images/office365_buy_domain.png)
     
 
-  2.  In the **Home > Domains** page, you will see the Microsoft-provided domain, such as *fabrikamdesign.onmicrosoft.com*.
+   2. In the **Home > Domains** page, you will see the Microsoft-provided domain, such as *fabrikamdesign.onmicrosoft.com*.
 
-    **Figure 5** - Microsoft-provided domain
+      **Figure 5** - Microsoft-provided domain
 
-    ![Microsoft-provided domain](images/office365_ms_provided_domain.png)
+      ![Microsoft-provided domain](images/office365_ms_provided_domain.png)
 
-    - If you already have a domain, select **+ Add domain** to add your existing domain. If you select this option, you'll be required to verify that you own the domain. Follow the steps in the wizard to verify your domain.
-    - If you don't already own a domain, select **+ Buy domain**. If you're using a trial plan, you'll be required to upgrade your trial plan in order to buy a domain. Choose the subscription plan to use for your business and provide the details to complete your order.
+      - If you already have a domain, select **+ Add domain** to add your existing domain. If you select this option, you'll be required to verify that you own the domain. Follow the steps in the wizard to verify your domain.
+      - If you don't already own a domain, select **+ Buy domain**. If you're using a trial plan, you'll be required to upgrade your trial plan in order to buy a domain. Choose the subscription plan to use for your business and provide the details to complete your order.
 
-    Once you've added your domain, you'll see it listed in addition to the Microsoft-provided onmicrosoft.com domain.
+      Once you've added your domain, you'll see it listed in addition to the Microsoft-provided onmicrosoft.com domain.
 
-    **Figure 6** - Domains
+      **Figure 6** - Domains
 
-    ![Verify your domains in Office 365 admin center](images/office365_additional_domain.png)
+      ![Verify your domains in the admin center](images/office365_additional_domain.png)
 
 ### 1.2 Add users and assign product licenses
-Once you've set up Office and added your domain, it's time to add users so they have access to Office 365. People in your organization need an account before they can sign in and access Office 365. The easiest way to add users is to add them one at a time in the Office 365 admin center.
+Once you've set up Office and added your domain, it's time to add users so they have access to Office 365. People in your organization need an account before they can sign in and access Office 365. The easiest way to add users is to add them one at a time in the Microsoft 365 admin center.
 
 When adding users, you can also assign admin privileges to certain users in your team. You'll also want to assign **Product licenses** to each user so that subscriptions can be assigned to the person.
 
 **To add users and assign product licenses**
 
-1. In the Office 365 admin center, select **Users > Active users**.
+1. In the admin center, select **Users > Active users**.
 
-  **Figure 7** - Add users
+   **Figure 7** - Add users
 
-  ![Add Office 365 users](images/office365_users.png)
+   ![Add Office 365 users](images/office365_users.png)
 
 2. In the **Home > Active users** page, add users individually or in bulk.
-  - To add users one at a time, select **+ Add a user**.
+   - To add users one at a time, select **+ Add a user**.
 
-    If you select this option, you'll see the **New user** screen and you can add details about the new user including their name, user name, role, and so on. You also have the opportunity to assign **Product licenses**. For detailed step-by-step info on adding a user account, see *Add a user account in the Office 365 admin center* in Add users individually or in bulk to Office 365 - Admin Help.
+     If you select this option, you'll see the **New user** screen and you can add details about the new user including their name, user name, role, and so on. You also have the opportunity to assign **Product licenses**. For detailed step-by-step info on adding a user account, see *Add a user account in the admin center* in Add users individually or in bulk to Office 365 - Admin Help.
 
-    **Figure 8** - Add an individual user
+     **Figure 8** - Add an individual user
 
-    ![Add an individual user](images/office365_add_individual_user.png)
+     ![Add an individual user](images/office365_add_individual_user.png)
 
-  - To add multiple users at once, select **More** and then choose **+ Import multiple users**. If you select this option, you'll need to create and upload a CSV file containing the list of users.
+   - To add multiple users at once, select **More** and then choose **+ Import multiple users**. If you select this option, you'll need to create and upload a CSV file containing the list of users.
 
-    The **Import multiple users** screen includes a link where you can learn more about importing multiple users and also links for downloading a sample CSV file (one with headers only and another with headers and sample user information). For detailed step-by-step info on adding multiple users to Office 365, see Add several users at the same time to Office 365 - Admin Help. Once you've added all the users, don't forget to assign **Product licenses** to the new users.
+     The **Import multiple users** screen includes a link where you can learn more about importing multiple users and also links for downloading a sample CSV file (one with headers only and another with headers and sample user information). For detailed step-by-step info on adding multiple users to Office 365, see Add several users at the same time to Office 365 - Admin Help. Once you've added all the users, don't forget to assign **Product licenses** to the new users.
 
-    **Figure 9** - Import multiple users
+     **Figure 9** - Import multiple users
 
-    ![Import multiple users](images/office365_import_multiple_users.png)
+     ![Import multiple users](images/office365_import_multiple_users.png)
 
 3. Verify that all the users you added appear in the list of **Active users**. The **Status** should indicate the product licenses that were assigned to them.
 
-  **Figure 10** - List of active users
+   **Figure 10** - List of active users
 
-  ![Verify users and assigned product licenses](images/o365_active_users.png)
+   ![Verify users and assigned product licenses](images/o365_active_users.png)
 
 ### 1.3 Add Microsoft Intune
 Microsoft Intune provides mobile device management, app management, and PC management capabilities from the cloud. Using Intune, organizations can provide their employees with access to apps, data, and corporate resources from anywhere on almost any device while helping to keep corporate information secure. To learn more, see What is Intune?
 
 **To add Microsoft Intune to your tenant**
 
-1. In the Office 365 admin center, select **Billing > Purchase services**.
+1. In the admin center, select **Billing > Purchase services**.
 2. In the **Home > Purchase services** screen, search for **Microsoft Intune**. Hover over **Microsoft Intune** to see the options to start a free 30-day trial or to buy now.
 3. Confirm your order to enable access to Microsoft Intune.
 4. In the admin center, the Intune licenses will show as available and ready to be assigned to users. Select **Users > Active users** and then edit the product licenses assigned to the users to turn on **Intune A Direct**.
 
-  **Figure 11** - Assign Intune licenses
+   **Figure 11** - Assign Intune licenses
 
-  ![Assign Microsoft Intune licenses to users](images/o365_assign_intune_license.png)
+   ![Assign Microsoft Intune licenses to users](images/o365_assign_intune_license.png)
 
 5. In the admin center, confirm that **Intune** shows up in the list under **Admin centers**. If it doesn't, sign out and then sign back in and then check again.
 6. Select **Intune**. This will take you to the Intune management portal.
 
-  **Figure 12** - Microsoft Intune management portal
+   **Figure 12** - Microsoft Intune management portal
 
-  ![Microsoft Intune management portal](images/intune_portal_home.png)
+   ![Microsoft Intune management portal](images/intune_portal_home.png)
 
 Intune should now be added to your tenant. We'll come back to Intune later when we [Configure Microsoft Store for Business for app distribution](#17-configure-microsoft-store-for-business-for-app-distribution).
 
@@ -174,32 +175,32 @@ Microsoft Azure is an open and flexible cloud platform that enables you to quick
 
 **To add Azure AD to your domain**
 
-1. In the Office 365 admin center, select **Admin centers > Azure AD**.
+1. In the admin center, select **Admin centers > Azure AD**.
 
-  > [!NOTE]
-  > You will need Azure AD Premium to configure automatic MDM enrollment with Intune.
+   > [!NOTE]
+   > You will need Azure AD Premium to configure automatic MDM enrollment with Intune.
 
 2. If you have not signed up for Azure AD before, you will see the following message. To proceed with the rest of the walkthrough, you need to activate an Azure subscription.
 
-  **Figure 13** - Access to Azure AD is not available
+   **Figure 13** - Access to Azure AD is not available
 
-  ![Access to Azure AD not available](images/azure_ad_access_not_available.png)
+   ![Access to Azure AD not available](images/azure_ad_access_not_available.png)
 
 3. From the error message, select the country/region for your business. This should match with the location you specified when you signed up for Office 365.
 4. Click **Azure subscription**. This will take you to a free trial sign up screen.
 
-  **Figure 14** - Sign up for Microsoft Azure
+   **Figure 14** - Sign up for Microsoft Azure
 
-  ![Sign up for Microsoft Azure](images/azure_ad_sign_up_screen.png)
+   ![Sign up for Microsoft Azure](images/azure_ad_sign_up_screen.png)
 
 5. In the **Free trial sign up** screen, fill in the required information and then click **Sign up**.
 6. After you sign up, you should see the message that your subscription is ready. Click **Start managing my service**.
 
-  **Figure 15** - Start managing your Azure subscription
+   **Figure 15** - Start managing your Azure subscription
 
-  ![Start managing your Azure subscription](images/azure_ad_successful_signup.png)
+   ![Start managing your Azure subscription](images/azure_ad_successful_signup.png)
 
-  This will take you to the Microsoft Azure portal.
+   This will take you to the Microsoft Azure portal.
 
 ### 1.5 Add groups in Azure AD
 This section is the walkthrough is optional. However, we recommend that you create groups in Azure AD to manage access to corporate resources, such as apps, policies and settings, and so on. For more information, see Managing access to resources with Azure Active Directory groups.
@@ -210,38 +211,38 @@ To add Azure AD group(s), we will use the classic Azure portal, you will see a screen informing you that your directory is ready for use.
 
-  Afterwards, you should see a list of active directories. In the following example, **Fabrikam Design** is the active directory.
+   Afterwards, you should see a list of active directories. In the following example, **Fabrikam Design** is the active directory.
 
-  **Figure 16** - Azure first sign-in screen
+   **Figure 16** - Azure first sign-in screen
 
-  ![Select Azure AD](images/azure_portal_classic_configure_directory.png)
+   ![Select Azure AD](images/azure_portal_classic_configure_directory.png)
 
 2. Select the directory (such as Fabrikam Design) to go to the directory's home page.
 
-  **Figure 17** - Directory home page
+   **Figure 17** - Directory home page
 
-  ![Directory home page](images/azure_portal_classic_directory_ready.png)
+   ![Directory home page](images/azure_portal_classic_directory_ready.png)
 
 3. From the menu options on top, select **Groups**.
 
-  **Figure 18** - Azure AD groups
+   **Figure 18** - Azure AD groups
 
-  ![Add groups in Azure AD](images/azure_portal_classic_groups.png)
+   ![Add groups in Azure AD](images/azure_portal_classic_groups.png)
 
 4. Select **Add a group** (from the top) or **Add group** at the bottom.
 5. In the **Add Group** window, add a name, group type, and description for the group and click the checkmark to save your changes. The new group will appear on the groups list.
 
-  **Figure 19** - Newly added group in Azure AD
+   **Figure 19** - Newly added group in Azure AD
 
-  ![Verify the new group appears on the list](images/azure_portal_classic_all_users_group.png)
+   ![Verify the new group appears on the list](images/azure_portal_classic_all_users_group.png)
 
 6. In the **Groups** tab, select the arrow next to the group (such as **All users**), add members to the group, and then save your changes.
 
-  The members that were added to the group will appear on the list.
+   The members that were added to the group will appear on the list.
 
-  **Figure 20** - Members in the new group
+   **Figure 20** - Members in the new group
 
-  ![Members added to the new group](images/azure_portal_classic_members_added.png)
+   ![Members added to the new group](images/azure_portal_classic_members_added.png)
 
 7. Repeat steps 2-6 to add other groups. You can add groups based on their roles in your company, based on the apps that each group can use, and so on.
 
@@ -250,44 +251,44 @@ Now that you have Azure AD Premium and have it properly configured, you can conf
 
 You can read this blog post to learn how you can combine login, Azure AD Join, and Intune MDM enrollment into an easy step so that you can bring your devices into a managed state that complies with the policies for your organization. We will use this blog post as our guide for this part of the walkthrough.
 
-> [!IMPORTANT]  
+> [!IMPORTANT]
 > We will use the classic Azure portal instead of the new portal to configure automatic MDM enrollment with Intune.
 
 **To enable automatic MDM enrollment**
 
 1. In to the classic Azure portal, click on your company's Azure Active Directory to go back to the main window. Select **Applications** from the list of directory menu options. 
 
-  The list of applications for your company will appear. **Microsoft Intune** will be one of the applications on the list.
+   The list of applications for your company will appear. **Microsoft Intune** will be one of the applications on the list.
 
-  **Figure 21** - List of applications for your company
+   **Figure 21** - List of applications for your company
 
-  ![List of applications for your company](images/azure_portal_classic_applications.png)
+   ![List of applications for your company](images/azure_portal_classic_applications.png)
 
 2. Select **Microsoft Intune** to configure the application.
 3. In the Microsoft Intune configuration page, click **Configure** to start automatic MDM enrollment configuration with Intune.
 
-  **Figure 22** - Configure Microsoft Intune in Azure
+   **Figure 22** - Configure Microsoft Intune in Azure
 
-  ![Configure Microsoft Intune in Azure](images/azure_portal_classic_configure_intune_app.png)
+   ![Configure Microsoft Intune in Azure](images/azure_portal_classic_configure_intune_app.png)
 
 4. In the Microsoft Intune configuration page:
-  - In the **Properties** section, you should see a list of URLs for MDM discovery, MDM terms of use, and MDM compliance.
+   - In the **Properties** section, you should see a list of URLs for MDM discovery, MDM terms of use, and MDM compliance.
 
-    > [!NOTE]  
-    > The URLs are automatically configured for your Azure AD tenant so you don't need to change them.
+     > [!NOTE]  
+     > The URLs are automatically configured for your Azure AD tenant so you don't need to change them.
 
-  - In the **Manage devices for these users** section, you can specify which users' devices should be managed by Intune.
-    - **All** will enable all users' Windows 10 devices to be managed by Intune.
-    - **Groups** let you select whether only users that belong to a specific group will have their devices managed by Intune.
+   - In the **Manage devices for these users** section, you can specify which users' devices should be managed by Intune.
+     - **All** will enable all users' Windows 10 devices to be managed by Intune.
+     - **Groups** let you select whether only users that belong to a specific group will have their devices managed by Intune.
 
-    > [!NOTE]  
-    > In this step, choose the group that contains all the users in your organization as members. This is the **All** group.
+     > [!NOTE]  
+     > In this step, choose the group that contains all the users in your organization as members. This is the **All** group.
 
 5. After you've chosen how to manage devices for users, select **Save** to enable automatic MDM enrollment with Intune.
 
-  **Figure 23** - Configure Microsoft Intune
+   **Figure 23** - Configure Microsoft Intune
 
-  ![Configure automatic MDM enrollment with Intune](images/azure_portal_classic_configure_intune_mdm_enrollment.png)
+   ![Configure automatic MDM enrollment with Intune](images/azure_portal_classic_configure_intune_mdm_enrollment.png)
 
 ### 1.7 Configure Microsoft Store for Business for app distribution
 Next, you'll need to configure Microsoft Store for Business to distribute apps with a management tool such as Intune.
@@ -299,33 +300,33 @@ In this part of the walkthrough, we'll be working on the Microsoft Intune management portal, select **Admin**.
 2. In the **Administration** workspace, click **Mobile Device Management**. If this is the first item you're using the portal, click **manage mobile devices** in the **Mobile Device Management** window. The page will refresh and you'll have new options under **Mobile Device Management**.
 
-  **Figure 24** - Mobile device management
+   **Figure 24** - Mobile device management
 
-  ![Set up mobile device management in Intune](images/intune_admin_mdm_configure.png)
+   ![Set up mobile device management in Intune](images/intune_admin_mdm_configure.png)
 
 3. Sign into Microsoft Store for Business using the same tenant account that you used to sign into Intune.
 4. Accept the EULA.
 5. In the Store portal, select **Settings > Management tools** to go to the management tools page.
 6. In the **Management tools** page, find **Microsoft Intune** on the list and click **Activate** to get Intune ready to use with Microsoft Store for Business.
 
-  **Figure 25** - Activate Intune as the Store management tool
+   **Figure 25** - Activate Intune as the Store management tool
 
-  ![Activate Intune from the Store portal](images/wsfb_management_tools_activate.png)
+   ![Activate Intune from the Store portal](images/wsfb_management_tools_activate.png)
 
 7. Go back to the Intune management portal, select **Admin > Mobile Device Management**, expand **Windows**, and then choose **Store for Business**.
 8. In the **Microsoft Store for Business** page, select **Configure Sync** to sync your Store for Business volume-purchased apps with Intune.
 
-  **Figure 26** - Configure Store for Business sync in Intune
+   **Figure 26** - Configure Store for Business sync in Intune
 
-  ![Configure Store for Business sync in Intune](images/intune_admin_mdm_store_sync.png)
+   ![Configure Store for Business sync in Intune](images/intune_admin_mdm_store_sync.png)
 
 9. In the **Configure Microsoft Store for Business app sync** dialog box, check **Enable Microsoft Store for Business sync**. In the **Language** dropdown list, choose the language in which you want apps from the Store to be displayed in the Intune console and then click **OK**.
 
-  **Figure 27** - Enable Microsoft Store for Business sync in Intune
+   **Figure 27** - Enable Microsoft Store for Business sync in Intune
 
-  ![Enable Store for Business sync in Intune](images/intune_configure_store_app_sync_dialog.png)
+   ![Enable Store for Business sync in Intune](images/intune_configure_store_app_sync_dialog.png)
 
-  The **Microsoft Store for Business** page will refresh and it will show the details from the sync.
+   The **Microsoft Store for Business** page will refresh and it will show the details from the sync.
 
 **To buy apps from the Store**
 
@@ -344,9 +345,9 @@ In the following example, we'll show you how to buy apps through the Microsoft S
 
 1. In the Microsoft Store for Business portal, click **Shop**, scroll down to the **Made by Microsoft** category, and click **Show all** to see all the Microsoft apps in the list.
 
-  **Figure 28** - Shop for Store apps
+   **Figure 28** - Shop for Store apps
 
-  ![Shop for Store apps](images/wsfb_shop_microsoft_apps.png)
+   ![Shop for Store apps](images/wsfb_shop_microsoft_apps.png)
 
 2. Click to select an app, such as **Reader**. This opens the app page.
 3. In the app's Store page, click **Get the app**. You should see a dialog that confirms your order. Click **Close**. This will refresh the app's Store page.
@@ -354,12 +355,12 @@ In the following example, we'll show you how to buy apps through the Microsoft S
 5. Next, search for another app by name (such as **InstaNote**) or repeat steps 1-4 for the **InstaNote** app.
 6. Go to **Manage > Inventory** and verify that the apps you purchased appear in your inventory.
 
-  **Figure 29** - App inventory shows the purchased apps
+   **Figure 29** - App inventory shows the purchased apps
 
-  ![Confirm that your inventory shows purchased apps](images/wsfb_manage_inventory_newapps.png)
+   ![Confirm that your inventory shows purchased apps](images/wsfb_manage_inventory_newapps.png)
 
-  > [!NOTE]
-  > Sync happens automatically, but it may take up to 24 hours for your organization's private store and 12 hours for Intune to sync all your purchased apps. You can force a sync to make this process happen faster. For more info, see [To sync recently purchased apps](#forceappsync).
+   > [!NOTE]
+   > Sync happens automatically, but it may take up to 24 hours for your organization's private store and 12 hours for Intune to sync all your purchased apps. You can force a sync to make this process happen faster. For more info, see [To sync recently purchased apps](#forceappsync).
 
 **To sync recently purchased apps**
 
@@ -368,9 +369,9 @@ If you need to sync your most recently purchased apps and have it appear in your
 1. In the Intune management portal, select **Admin > Mobile Device Management > Windows > Store for Business**.
 2. In the **Microsoft Store for Business** page, click **Sync now** to force a sync.
 
-  **Figure 30** - Force a sync in Intune
+   **Figure 30** - Force a sync in Intune
 
-  ![Force a sync in Intune](images/intune_admin_mdm_forcesync.png)
+   ![Force a sync in Intune](images/intune_admin_mdm_forcesync.png)
 
 **To view purchased apps**
 - In the Intune management portal, select **Apps > Apps** and then choose **Volume-Purchased Apps** to see the list of available apps. Verify that the apps you purchased were imported correctly.
@@ -385,33 +386,33 @@ To set up new Windows devices, go through the Windows initial device setup or fi
 
 **To set up a device**
 1. Go through the Windows device setup experience. On a new or reset device, this starts with the **Hi there** screen on devices running Windows 10, version 1607 (Anniversary Update). The setup lets you:
-  - Fill in the details in the **Hi there** screen including your home country/region, preferred language, keyboard layout, and timezone
-  - Accept the EULA
-  - Customize the setup or use Express settings
+   - Fill in the details in the **Hi there** screen including your home country/region, preferred language, keyboard layout, and timezone
+   - Accept the EULA
+   - Customize the setup or use Express settings
 
-  **Figure 31** - First screen in Windows device setup
+   **Figure 31** - First screen in Windows device setup
 
-  ![First screen in Windows device setup](images/win10_hithere.png)
+   ![First screen in Windows device setup](images/win10_hithere.png)
 
-  > [!NOTE]  
-  > During setup, if you don't have a Wi-Fi network configured, make sure you connect the device to the Internet through a wired/Ethernet connection.
+   > [!NOTE]  
+   > During setup, if you don't have a Wi-Fi network configured, make sure you connect the device to the Internet through a wired/Ethernet connection.
 
 2. In the **Who owns this PC?** screen, select **My work or school owns it** and click **Next**.
 3. In the **Choose how you'll connect** screen, select **Join Azure Active Directory** and click **Next**.
 
-  **Figure 32** - Choose how you'll connect your Windows device
+   **Figure 32** - Choose how you'll connect your Windows device
 
-  ![Choose how you'll connect the Windows device](images/win10_choosehowtoconnect.png)
+   ![Choose how you'll connect the Windows device](images/win10_choosehowtoconnect.png)
 
 4. In the **Let's get you signed in** screen, sign in using one of the user accounts you added in section [1.2 Add users and assign product licenses](#12-add-users-and-assign-product-licenses). We suggest signing in as one of the global administrators. Later, sign in on another device using one of the non-admin accounts.
 
-  **Figure 33** - Sign in using one of the accounts you added
+   **Figure 33** - Sign in using one of the accounts you added
 
-  ![Sign in using one of the accounts you added](images/win10_signin_admin_account.png)
+   ![Sign in using one of the accounts you added](images/win10_signin_admin_account.png)
 
 5. If this is the first time you're signing in, you will be asked to update your password. Update the password and continue with sign-in and setup.
 
-  Windows will continue with setup and you may be asked to set up a PIN for Windows Hello if your organization has it enabled.
+   Windows will continue with setup and you may be asked to set up a PIN for Windows Hello if your organization has it enabled.
 
 ### 2.2 Verify correct device setup
 Verify that the device is set up correctly and boots without any issues.
@@ -426,20 +427,20 @@ In the Intune management
 **To verify if the device is joined to Azure AD**
 1. Check the device name on your PC. To do this, on your Windows PC, select **Settings > System > About** and then check **PC name**.
 
-  **Figure 34** - Check the PC name on your device
+   **Figure 34** - Check the PC name on your device
 
-  ![Check the PC name on your device](images/win10_settings_pcname.png)
+   ![Check the PC name on your device](images/win10_settings_pcname.png)
   
 2. Log in to the Intune management portal.
 3. Select **Groups** and then go to **Devices**.
 4. In the **All Devices** page, look at the list of devices and select the entry that matches the name of your PC. 
-  - Check that the device name appears in the list. Select the device and it will also show the current logged-in user in the **General Information** section.
-  - Check the **Management Channel** column and confirm that it says **Managed by Microsoft Intune**.
-  - Check the **AAD Registered** column and confirm that it says **Yes**.
+   - Check that the device name appears in the list. Select the device and it will also show the current logged-in user in the **General Information** section.
+   - Check the **Management Channel** column and confirm that it says **Managed by Microsoft Intune**.
+   - Check the **AAD Registered** column and confirm that it says **Yes**.
 
-  **Figure 35** - Check that the device appears in Intune
+   **Figure 35** - Check that the device appears in Intune
 
-  ![Check that the device appears in Intune](images/intune_groups_devices_list.png)
+   ![Check that the device appears in Intune](images/intune_groups_devices_list.png)
 
 ## 3. Manage device settings and features
 You can use Microsoft Intune admin settings and policies to manage features on your organization's mobile devices and computers. For more info, see [Manage settings and features on your devices with Microsoft Intune policies](https://docs.microsoft.com/intune/deploy-use/manage-settings-and-features-on-your-devices-with-microsoft-intune-policies).
@@ -456,19 +457,19 @@ In some cases, if an app is missing from the device, you need to reconfigure the
 4. Click **Next** at the bottom of the app deployment settings window or select **Deployment Action** on the left column to check the deployment settings for the app.
 5. For each group that you selected, set **Approval** to **Required Install**. This automatically sets **Deadline** to **As soon as possible**. If **Deadline** is not automatically set, set it to **As soon as possible**.
 
-  **Figure 36** - Reconfigure an app's deployment setting in Intune
+   **Figure 36** - Reconfigure an app's deployment setting in Intune
 
-  ![Reconfigure app deployment settings in Intune](images/intune_apps_deploymentaction.png)
+   ![Reconfigure app deployment settings in Intune](images/intune_apps_deploymentaction.png)
 
 6. Click **Finish**.
 7. Repeat steps 2-6 for other apps that you want to deploy to the device(s) as soon as possible.
-6. Verify that the app shows up on the device. To do this:
-  - Make sure you're logged in to the Windows device.
-  - Click the **Start** button and check the apps that appear in the **Recently added** section. If you don't see the apps that you deployed in Intune, give it a few minutes. Only apps that aren't already deployed on the device will appear in the **Recently added** section.
+8. Verify that the app shows up on the device. To do this:
+   - Make sure you're logged in to the Windows device.
+   - Click the **Start** button and check the apps that appear in the **Recently added** section. If you don't see the apps that you deployed in Intune, give it a few minutes. Only apps that aren't already deployed on the device will appear in the **Recently added** section.
 
-    **Figure 37** - Confirm that additional apps were deployed to the device
+     **Figure 37** - Confirm that additional apps were deployed to the device
 
-    ![Confirm that additiional apps were deployed to the device](images/win10_deploy_apps_immediately.png)
+     ![Confirm that additional apps were deployed to the device](images/win10_deploy_apps_immediately.png)
 
 ### 3.2 Configure other settings in Intune
 
@@ -478,36 +479,36 @@ In some cases, if an app is missing from the device, you need to reconfigure the
 3. On the **Create a New Policy** page, click **Windows** to expand the group, select **General Configuration (Windows 10 Desktop and Mobile and later)**, choose **Create and Deploy a Custom Policy**, and then click **Create Policy**.
 4. On the **Create Policy** page, select **Device Capabilities**.
 5. In the **General** section, add a name and description for this policy. For example:
-  - **Name**: Test Policy - Disable Camera
-  - **Description**: Disables the camera
+   - **Name**: Test Policy - Disable Camera
+   - **Description**: Disables the camera
 6. Scroll down to the **Hardware** section, find **Allow camera is not configured**, toggle the button so that it changes to **Allow camera** and choose **No** from the dropdown list.
 
-  **Figure 38** - Add a configuration policy
+   **Figure 38** - Add a configuration policy
 
-  ![Add a configuration policy](images/intune_policy_disablecamera.png)
+   ![Add a configuration policy](images/intune_policy_disablecamera.png)
 
 7. Click **Save Policy**. A confirmation window will pop up.
 8. On the **Deploy Policy** confirmation window, select **Yes** to deploy the policy now.
 9. On the **Management Deployment** window, select the user group(s) or device group(s) that you want to apply the policy to (for example, **All Users**), and then click **Add**. 
 10. Click **OK** to close the window. 
 
-  **Figure 39** - The new policy should appear in the **Policies** list.
+    **Figure 39** - The new policy should appear in the **Policies** list.
 
-  ![New policy appears on the list](images/intune_policies_newpolicy_deployed.png)
+    ![New policy appears on the list](images/intune_policies_newpolicy_deployed.png)
 
 **To turn off Windows Hello and PINs during device setup**
 1. In the Intune management portal, select **Admin**.
 2. Go to **Mobile Device Management > Windows > Windows Hello for Business**.
 3. In the **Windows Hello for Business** page, select **Disable Windows Hello for Business on enrolled devices**.
 
-  **Figure 40** - Policy to disable Windows Hello for Business
+   **Figure 40** - Policy to disable Windows Hello for Business
 
-  ![Disable Windows Hello for Business](images/intune_policy_disable_windowshello.png)
+   ![Disable Windows Hello for Business](images/intune_policy_disable_windowshello.png)
 
 4. Click **Save**.
 
-  > [!NOTE]
-  > This policy is a tenant-wide Intune setting. It disables Windows Hello and required PINs during setup for all enrolled devices in a tenant.
+   > [!NOTE]
+   > This policy is a tenant-wide Intune setting. It disables Windows Hello and required PINs during setup for all enrolled devices in a tenant.
 
 To test whether these policies get successfully deployed to your tenant, go through [4. Add more devices and users](#4-add-more-devices-and-users) and setup another Windows device and login as one of the users. 
 
@@ -527,34 +528,34 @@ For other devices, such as those personally-owned by employees who need to conne
 2. Select **Access work or school** and then click **Connect** in the **Connect to work or school** page.
 3. In the **Set up a work or school account** window, click **Join this device to Azure Active Directory** to add an Azure AD account to the device.
 
-  **Figure 41** - Add an Azure AD account to the device
+   **Figure 41** - Add an Azure AD account to the device
 
-  ![Add an Azure AD account to the device](images/win10_add_new_user_join_aad.png)
+   ![Add an Azure AD account to the device](images/win10_add_new_user_join_aad.png)
 
 4. In the **Let's get you signed in** window, enter the work credentials for the account and then click **Sign in** to authenticate the user.
 
-  **Figure 42** - Enter the account details
+   **Figure 42** - Enter the account details
 
-  ![Enter the account details](images/win10_add_new_user_account_aadwork.png)
+   ![Enter the account details](images/win10_add_new_user_account_aadwork.png)
 
 5. You will be asked to update the password so enter a new password.
 6. Verify the details to make sure you're connecting to the right organization and then click **Join**.
 
-  **Figure 43** - Make sure this is your organization
+   **Figure 43** - Make sure this is your organization
 
-  ![Make sure this is your organization](images/win10_confirm_organization_details.png)
+   ![Make sure this is your organization](images/win10_confirm_organization_details.png)
 
 7. You will see a confirmation window that says the device is now connected to your organization. Click **Done**.
 
-  **Figure 44** - Confirmation that the device is now connected
+   **Figure 44** - Confirmation that the device is now connected
 
-  ![Confirmation that the device is now connected](images/win10_confirm_device_connected_to_org.png)
+   ![Confirmation that the device is now connected](images/win10_confirm_device_connected_to_org.png)
 
 8. The **Connect to work or school** window will refresh and will now include an entry that shows you're connected to your organization's Azure AD. This means the device is now registered in Azure AD and enrolled in MDM and the account should have access to the organization's resources.
 
-  **Figure 45** - Device is now enrolled in Azure AD
+   **Figure 45** - Device is now enrolled in Azure AD
 
-  ![Device is enrolled in Azure AD](images/win10_device_enrolled_in_aad.png)
+   ![Device is enrolled in Azure AD](images/win10_device_enrolled_in_aad.png)
 
 9. You can confirm that the new device and user are showing up as Intune-managed by going to the Intune management portal and following the steps in [2.3 Verify the device is Azure AD joined](#23-verify-the-device-is-azure-ad-joined). It may take several minutes before the new device shows up so check again later.
 
diff --git a/smb/docfx.json b/smb/docfx.json
index 56500f0150..a5644a3f2b 100644
--- a/smb/docfx.json
+++ b/smb/docfx.json
@@ -4,7 +4,7 @@
       {
         "files": [
           "**/*.md",
-		  "**/*.yml"
+          "**/*.yml"
         ],
         "exclude": [
           "**/obj/**",
@@ -29,20 +29,30 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
-		"uhfHeaderId": "MSDocsHeader-WindowsIT",
-		"breadcrumb_path": "/windows/smb/breadcrumb/toc.json",
-		"feedback_system": "GitHub",
-		"feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
-		"feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
-		"_op_documentIdPathDepotMapping": {
-			"./": {
-			  "depot_name": "TechNet.smb"
-			}
-		}
-	},
+      "breadcrumb_path": "/windows/smb/breadcrumb/toc.json",
+      "feedback_system": "None",
+      "hideEdit": true,
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "TechNet.smb",
+          "folder_relative_path_in_docset": "./"
+        }
+      },
+      "contributors_to_exclude": [ 
+        "rjagiewich", 
+        "traya1", 
+        "rmca14", 
+        "claydetels19", 
+        "Kellylorenebaker",
+        "jborsecnik",
+        "tiburd",
+        "garycentric"
+      ],
+      "titleSuffix": "Windows for Small to Midsize Business"
+    },
     "fileMetadata": {},
     "template": [],
     "dest": "smb",
-    "markdownEngineName": "dfm"
-  }
-}
\ No newline at end of file
+    "markdownEngineName": "markdig"
+    }
+}
diff --git a/smb/index.md b/smb/index.md
index 3f7bb09bc7..5cc2746261 100644
--- a/smb/index.md
+++ b/smb/index.md
@@ -2,16 +2,16 @@
 title: Windows 10 for small to midsize businesses
 description: Microsoft products and devices to transform and grow your businessLearn how to use Windows 10 for your small to midsize business.
 keywords: Windows 10, SMB, small business, midsize business, business
-ms.prod: w10
-ms.technology: smb-windows
+ms.prod: 
+ms.technology: 
 ms.topic: article
 ms.author: celested
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: smb
 author: CelesteDG
-ms.date: 05/01/2017
 ms.localizationpriority: medium
+manager: dansimp
 ---
 
 # Windows 10 for SMB
@@ -22,12 +22,12 @@ ms.localizationpriority: medium
 
 
    Windows 10 for business
    Learn how Windows 10 and Windows devices can help your business.
    
 
    SMB blog
    Read about the latest stories, technology insights, and business strategies for SMBs.
    
-
    How to buy
    Go here when you're ready to buy or want to learn more about Microsoft products you can use to help transform your business.
    
+
    How to buy
    Go here when you're ready to buy or want to learn more about Microsoft products you can use to help transform your business.
    
 
 
 ## ![Deploy a Microsoft solution for your business](images/deploy.png) Deploy
 
-
    [Get started: Deploy and manage a full cloud IT solution for your business](cloud-mode-business-setup.md)
    Find out how easy it is to deploy and manage a full cloud IT solution for your small to midsize business using Microsoft cloud services and tools.
    
+
    Get started: Deploy and manage a full cloud IT solution for your business
    Find out how easy it is to deploy and manage a full cloud IT solution for your small to midsize business using Microsoft cloud services and tools.
    
 
 
  ## Related topics
diff --git a/store-for-business/TOC.md b/store-for-business/TOC.md
index e42cdb492c..fe8f3b7411 100644
--- a/store-for-business/TOC.md
+++ b/store-for-business/TOC.md
@@ -1,7 +1,7 @@
 # [Microsoft Store for Business](index.md)
 ## [What's new in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md)
 ## [Sign up and get started](sign-up-microsoft-store-for-business-overview.md)
-###[Microsoft Store for Business and Microsoft Store for Education overview](microsoft-store-for-business-overview.md)
+### [Microsoft Store for Business and Microsoft Store for Education overview](microsoft-store-for-business-overview.md)
 ### [Prerequisites for Microsoft Store for Business and Education](prerequisites-microsoft-store-for-business.md)
 ### [Sign up for Microsoft Store for Business or Microsoft Store for Education](sign-up-microsoft-store-for-business.md)
 ### [Roles and permissions in the Microsoft Store for Business and Education](roles-and-permissions-microsoft-store-for-business.md)
@@ -16,7 +16,7 @@
 ### [Distribute apps with a management tool](distribute-apps-with-management-tool.md)
 ### [Distribute offline apps](distribute-offline-apps.md)
 ## [Manage products and services](manage-apps-microsoft-store-for-business-overview.md)
-### [App inventory managemement](app-inventory-management-microsoft-store-for-business.md)
+### [App inventory management](app-inventory-management-microsoft-store-for-business.md)
 ### [Manage orders](manage-orders-microsoft-store-for-business.md)
 ### [Manage access to private store](manage-access-to-private-store.md)
 ### [Manage private store settings](manage-private-store-settings.md)
@@ -31,7 +31,7 @@
 ### [Understand billing profiles](billing-profile.md)
 ## [Manage settings in the Microsoft Store for Business and Education](manage-settings-microsoft-store-for-business.md)
 ### [Update account settings](update-microsoft-store-for-business-account-settings.md)
-### [Manage user accounts ](manage-users-and-groups-microsoft-store-for-business.md)
+### [Manage user accounts](manage-users-and-groups-microsoft-store-for-business.md)
 ## [Device Guard signing portal](device-guard-signing-portal.md)
 ### [Add unsigned app to code integrity policy](add-unsigned-app-to-code-integrity-policy.md)
 ### [Sign code integrity policy with Device Guard signing](sign-code-integrity-policy-with-device-guard-signing.md)
diff --git a/store-for-business/acquire-apps-microsoft-store-for-business.md b/store-for-business/acquire-apps-microsoft-store-for-business.md
index cf51aab7e8..cfbb3dcb99 100644
--- a/store-for-business/acquire-apps-microsoft-store-for-business.md
+++ b/store-for-business/acquire-apps-microsoft-store-for-business.md
@@ -8,6 +8,8 @@ ms.pagetype: store
 author: TrudyHa
 ms.author: TrudyHa
 ms.date: 10/23/2018
+ms.reviewer: 
+manager: dansimp
 ms.topic: conceptual
 ms.localizationpriority: medium
 ---
@@ -36,7 +38,7 @@ There are a couple of things we need to know when you pay for apps. You can add
 ## Allow users to shop
 
 **Allow users to shop** controls the shopping experience in Microsoft Store for Education. When this setting is on, **Purchasers** and **Basic Purchasers** can purchase products and services from Microsoft Store for Education. If your school chooses to closely control how purchases are made, admins can turn off **Allow users to shop**. When the setting is off:
-- The shopping experience is not availalbe 
+- The shopping experience is not available 
 - **Purchasers** and **Basic Purchasers** can't purchase products and services from Microsoft Store for Education
 - Admins can't assign shopping roles to users
 - Products and services previously purchased by **Basic Purchasers** can be managed by admins. 
@@ -59,13 +61,13 @@ People in your org can request license for apps that they need, or that others n
 
 ## Acquire apps
 **To acquire an app**  
-1.	Sign in to http://businessstore.microsoft.com
-2.	Select **Shop for my group**, or use Search to find an app. 
-3.	Select the app you want to purchase. 
-4.	On the product description page, choose your license type - either online or offline. 
+1. Sign in to http://businessstore.microsoft.com
+2. Select **Shop for my group**, or use Search to find an app. 
+3. Select the app you want to purchase. 
+4. On the product description page, choose your license type - either online or offline. 
 5.  Free apps will be added to **Products & services**. For apps with a price, you can set the quantity you want to buy. Type the quantity and select **Next**.
-6.	If you don’t have a payment method saved in **Billing & payments**, we will prompt you for one.
-7.	Add your credit card or debit card info, and select **Next**. Your card info is saved as a payment option on **Billing & payments - Payment methods**.
+6. If you don’t have a payment method saved in **Billing & payments**, we will prompt you for one.
+7. Add your credit card or debit card info, and select **Next**. Your card info is saved as a payment option on **Billing & payments - Payment methods**.
 
 You’ll also need to have your business address saved on **My organization - Profile**. The address is used to generate tax rates. For more information on taxes for apps, see [organization tax information](https://docs.microsoft.com/microsoft-store/update-microsoft-store-for-business-account-settings#organization-tax-information). 
 
@@ -76,4 +78,4 @@ Microsoft Store adds the app to your inventory. From **Products & services**, yo
 
 For info on distributing apps, see [Distribute apps to your employees from the Microsoft Store for Business](distribute-apps-to-your-employees-microsoft-store-for-business.md).
 
-For info on offline-licensed apps, see [Distribute offline apps](distribute-offline-apps.md).
\ No newline at end of file
+For info on offline-licensed apps, see [Distribute offline apps](distribute-offline-apps.md).
diff --git a/store-for-business/add-profile-to-devices.md b/store-for-business/add-profile-to-devices.md
index dbd5c9acfb..1215008fc9 100644
--- a/store-for-business/add-profile-to-devices.md
+++ b/store-for-business/add-profile-to-devices.md
@@ -8,6 +8,8 @@ ms.pagetype: store
 author: TrudyHa
 ms.author: TrudyHa
 ms.date: 2/9/2018
+ms.reviewer: 
+manager: dansimp
 ms.topic: conceptual
 ms.localizationpriority: medium
 ---
@@ -19,9 +21,9 @@ ms.localizationpriority: medium
 
 Windows Autopilot simplifies device set up for IT Admins. For an overview of benefits, scenarios, and prerequisites, see [Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-10-autopilot).
 
-Watch this video to learn more about Windows Autopilot in Micrsoft Store for Business. 
    
+Watch this video to learn more about Windows Autopilot in Microsoft Store for Business. 
    
 
-> [!video https://www.microsoft.com/en-us/videoplayer/embed/3b30f2c2-a3e2-4778-aa92-f65dbc3ecf54?autoplay=false]
+> [!video https://www.microsoft.com/videoplayer/embed/3b30f2c2-a3e2-4778-aa92-f65dbc3ecf54?autoplay=false]
 
 ## What is Windows Autopilot?
 In Microsoft Store for Business, you can manage devices for your organization and apply an *Autopilot deployment profile* to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the Autopilot deployment profile you applied to the device.
diff --git a/store-for-business/add-unsigned-app-to-code-integrity-policy.md b/store-for-business/add-unsigned-app-to-code-integrity-policy.md
index 4ffb3b7e72..8c1e9402e7 100644
--- a/store-for-business/add-unsigned-app-to-code-integrity-policy.md
+++ b/store-for-business/add-unsigned-app-to-code-integrity-policy.md
@@ -2,6 +2,8 @@
 title: Add unsigned app to code integrity policy (Windows 10)
 description: When you want to add an unsigned app to a code integrity policy, you need to start with a code integrity policy created from a reference device.
 ms.assetid: 580E18B1-2FFD-4EE4-8CC5-6F375BE224EA
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -91,11 +93,11 @@ Catalog signing is a vital step to adding your unsigned apps to your code integr
 3. Click **Upload** to upload your unsigned catalog files. These are the catalog files you created earlier in [Create catalog files for your unsigned app](#create-catalog-files).
 4. After the files are uploaded, click **Sign** to sign the catalog files.
 5. Click Download to download each item:
-    - signed catalog file
-    - default policy
-    - root certificate for your organization
+   - signed catalog file
+   - default policy
+   - root certificate for your organization
 
-    When you use the Device Guard signing portal to sign a catalog file, the signing certificate is added to the default policy. When you download the signed catalog file, you should also download the default policy and merge this code integrity policy with your existing code integrity policies to protect machines running the catalog file. You need to do this step to trust and run your catalog files. For more information, see the Merging code integrity policies in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide).
+     When you use the Device Guard signing portal to sign a catalog file, the signing certificate is added to the default policy. When you download the signed catalog file, you should also download the default policy and merge this code integrity policy with your existing code integrity policies to protect machines running the catalog file. You need to do this step to trust and run your catalog files. For more information, see the Merging code integrity policies in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide).
 
 6. Open the root certificate that you downloaded, and follow the steps in **Certificate Import wizard** to install the certificate in your machine's certificate store.
-7. Deploy signed catalogs to your managed devices. For more information, see Deploy catalog files with Group Policy, or Deploy catalog files with System Center Configuration Manager in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide).
\ No newline at end of file
+7. Deploy signed catalogs to your managed devices. For more information, see Deploy catalog files with Group Policy, or Deploy catalog files with System Center Configuration Manager in the [Device Guard deployment guide](https://docs.microsoft.com/windows/device-security/device-guard/device-guard-deployment-guide).
diff --git a/store-for-business/app-inventory-management-microsoft-store-for-business.md b/store-for-business/app-inventory-management-microsoft-store-for-business.md
index e3c4b43dac..17369a8148 100644
--- a/store-for-business/app-inventory-management-microsoft-store-for-business.md
+++ b/store-for-business/app-inventory-management-microsoft-store-for-business.md
@@ -2,6 +2,8 @@
 title: App inventory management for Microsoft Store for Business and Microsoft Store for Education (Windows 10)
 description: You can manage all apps that you've acquired on your Apps & Software page.
 ms.assetid: 44211937-801B-4B85-8810-9CA055CDB1B2
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -73,15 +75,15 @@ For online-licensed apps, you can assign apps directly to people in your organiz
 
 **To assign an app to an employee**
 
-1.	Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com).
-2.	Click **Manage**, and then choose **Inventory**.
-3.	Find an app, click the ellipses, and then choose **Assign to people**.
-4.	Type the email address for the employee that you're assigning the app to, and click **Confirm**.
+1. Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://businessstore.microsoft.com).
+2. Click **Manage**, and then choose **Inventory**.
+3. Find an app, click the ellipses, and then choose **Assign to people**.
+4. Type the email address for the employee that you're assigning the app to, and click **Confirm**.
 
 Employees will receive an email with a link that will install the app on their device. Click the link to start the Microsoft Store app, and then click **Install**. Also, in the Microsoft Store app, they can find the app under **My Library**.
 
 There are other options for distributing apps:
-- **Use a management tool** - If you use a management tool that supports Microsoft Store, you can distribute apps with your management tool. Once it is configured to work with Store for Business, your managment tool will have access to all apps in your inventory. For more information, see [Distribute apps with a management tool](distribute-apps-with-management-tool.md).
+- **Use a management tool** - If you use a management tool that supports Microsoft Store, you can distribute apps with your management tool. Once it is configured to work with Store for Business, your management tool will have access to all apps in your inventory. For more information, see [Distribute apps with a management tool](distribute-apps-with-management-tool.md).
 - **Distribute from private store** - You can also add apps to your private store, and let people get them on their own. For more information, see [Distribute apps from private store](#distribute-apps-from-private-store)
 
 ## Distribute apps from private store
@@ -101,9 +103,9 @@ Employees can claim apps that admins added to the private store by doing the fol
 ### Get and remove private store apps
 **To claim an app from the private store**
 
-1.	Sign in to your computer with your Azure Active Directory (AD) credentials, and start the Microsoft Store app.
-2.	Click the private store tab.
-3.	Click the app you want to install, and then click **Install**.
+1. Sign in to your computer with your Azure Active Directory (AD) credentials, and start the Microsoft Store app.
+2. Click the private store tab.
+3. Click the app you want to install, and then click **Install**.
 
 Another way to distribute apps is by assigning them to people in your organization.
 
@@ -190,12 +192,12 @@ For more information about downloading offline-licensed apps, see [Download offl
 
 ## Manage products programmatically
 
-Microsoft Store for Business and Education provides a set of Admin management APIs. If you orgranization develops scripts or tools, these APIs allow Admins to programmatically manage items in **Apps & software**. For more information, see [REST API reference for Microsoft Store for Business](https://docs.microsoft.com/windows/client-management/mdm/rest-api-reference-windows-store-for-business).
+Microsoft Store for Business and Education provides a set of Admin management APIs. If you organization develops scripts or tools, these APIs allow Admins to programmatically manage items in **Apps & software**. For more information, see [REST API reference for Microsoft Store for Business](https://docs.microsoft.com/windows/client-management/mdm/rest-api-reference-windows-store-for-business).
 
-You can download a preview PoweShell script that uses REST APIs. The script is available from PowerShell Gallery. You can use to the script to:
+You can download a preview PowerShell script that uses REST APIs. The script is available from PowerShell Gallery. You can use to the script to:
 - View items in inventory (**Apps & software**)
 - Manage licenses - assigning and removing
 - Perform bulk options using .csv files - this automates license management for customers with large numbers of licenses
 
 > [!NOTE]
-> The Microsoft Store for Business and Education Admin role is required to manage products and to use the MSStore module. This requires advanced knowledge of PowerShell.
\ No newline at end of file
+> The Microsoft Store for Business and Education Admin role is required to manage products and to use the MSStore module. This requires advanced knowledge of PowerShell.
diff --git a/store-for-business/apps-in-microsoft-store-for-business.md b/store-for-business/apps-in-microsoft-store-for-business.md
index 1abad24d9a..cd057cb2a9 100644
--- a/store-for-business/apps-in-microsoft-store-for-business.md
+++ b/store-for-business/apps-in-microsoft-store-for-business.md
@@ -2,6 +2,8 @@
 title: Apps in Microsoft Store for Business and Education (Windows 10)
 description: Microsoft Store for Business has thousands of apps from many different categories.
 ms.assetid: CC5641DA-3CEA-4950-AD81-1AF1AE876926
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -74,4 +76,4 @@ You have the following distribution options for offline-licensed apps:
 - Include the app in a provisioning package, and then use it as part of imaging a device.
 - Distribute the app through a management tool.
 
-For more information, see [Distribute apps to your employees from Microsoft Store for Business](distribute-apps-to-your-employees-microsoft-store-for-business.md).
\ No newline at end of file
+For more information, see [Distribute apps to your employees from Microsoft Store for Business](distribute-apps-to-your-employees-microsoft-store-for-business.md).
diff --git a/store-for-business/assign-apps-to-employees.md b/store-for-business/assign-apps-to-employees.md
index 9fadbfd8e6..5e7a6fcb96 100644
--- a/store-for-business/assign-apps-to-employees.md
+++ b/store-for-business/assign-apps-to-employees.md
@@ -2,6 +2,8 @@
 title: Assign apps to employees (Windows 10)
 description: Administrators can assign online-licensed apps to employees and students in their organization.
 ms.assetid: A0DF4EC2-BE33-41E1-8832-DBB0EBECA31A
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/store-for-business/billing-payments-overview.md b/store-for-business/billing-payments-overview.md
index e3c23bf86e..9176f1da3d 100644
--- a/store-for-business/billing-payments-overview.md
+++ b/store-for-business/billing-payments-overview.md
@@ -11,6 +11,8 @@ ms.author: TrudyHa
 ms.topic: conceptual
 ms.localizationpriority: medium
 ms.date: 03/01/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Billing and payments
@@ -23,4 +25,4 @@ Access invoices and managed your payment methods.
 | ----- | ----------- |
 | [Understand your invoice](billing-understand-your-invoice-msfb.md) | Information about invoices provided by Microsoft Store for Business.  |
 | [Understand billing profiles](billing-profile.md) | Information about billing profiles and how they relate to invoices.  |
-| [Payment methods](payment-methods.md) | Information about managing payment methods.  |
\ No newline at end of file
+| [Payment methods](payment-methods.md) | Information about managing payment methods.  |
diff --git a/store-for-business/billing-profile.md b/store-for-business/billing-profile.md
index 56a0be9b64..9dc8364aff 100644
--- a/store-for-business/billing-profile.md
+++ b/store-for-business/billing-profile.md
@@ -11,10 +11,12 @@ ms.author: TrudyHa
 ms.topic: conceptual
 ms.localizationpriority: medium
 ms.date: 03/01/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Understand billing profiles
-For commercial customers purchasing software or hardware products from Microsoft using a Microsoft customer agreement, billing profiles let you customeize what products are included on your invoice, and how you pay your invoices. 
+For commercial customers purchasing software or hardware products from Microsoft using a Microsoft customer agreement, billing profiles let you customize what products are included on your invoice, and how you pay your invoices. 
 
 Billing profiles include:
 - **Payment methods** – Credit cards or check/wire transfer
diff --git a/store-for-business/billing-understand-your-invoice-msfb.md b/store-for-business/billing-understand-your-invoice-msfb.md
index d477d66085..b9df263894 100644
--- a/store-for-business/billing-understand-your-invoice-msfb.md
+++ b/store-for-business/billing-understand-your-invoice-msfb.md
@@ -10,6 +10,8 @@ ms.author: TrudyHa
 ms.topic: conceptual
 ms.localizationpriority: medium
 ms.date: 03/01/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Understand your Microsoft Customer Agreement invoice
@@ -24,7 +26,6 @@ Invoices are your bill from Microsoft. A few things to note:
 - **Billing profile** - Billing profiles are created during your purchase. Invoices are created for each billing profile. Billing profiles let you customize what products are purchased, how you pay for them, and who can make purchases. For more information, see [Understand billing profiles](billing-profile.md)
 - **Items included** - Your invoice includes total charges for all first and third-party software and hardware products purchased under a Microsoft Customer Agreement. That includes items purchased from Microsoft Store for Business and Azure Marketplace. 
 - **Charges** - Your invoice provides information about products purchased and their related charges and taxes. Purchases are aggregated to provide a concise view of your bill. 
-- **International customers** - Charges on invoices for international customers are converted to their local currencies. Exchange rate information is listed at the bottom of the invoice.
 
 ## Online invoice
 For Store for Business customers, invoices are also available online. A few things to note:
@@ -105,11 +106,8 @@ At the bottom of the invoice, there are instructions for paying your bill. You c
 ### Publisher information
 If you have third-party services in your bill, the name and address of each publisher is listed at the bottom of your invoice.
 
-### Exchange rate
-If prices were converted to your local currency, the exchange rates are listed in this section at the bottom of the invoice. All Azure charges are priced in USD and third-party services are priced in the seller's currency.
-
 ## Next steps
-If there are Azure charges on your invoice that you would like more details on, see [Understand the Azure charges on your Microsoft Customer Agreement invoice](https://docs.microsoft.com/en-us/azure/billing/billing-understand-your-invoice-mca).
+If there are Azure charges on your invoice that you would like more details on, see [Understand the Azure charges on your Microsoft Customer Agreement invoice](https://docs.microsoft.com/azure/billing/billing-understand-your-invoice-mca).
 
 ## Need help? Contact us.
 
diff --git a/store-for-business/configure-mdm-provider-microsoft-store-for-business.md b/store-for-business/configure-mdm-provider-microsoft-store-for-business.md
index 502bdc4c27..298857630c 100644
--- a/store-for-business/configure-mdm-provider-microsoft-store-for-business.md
+++ b/store-for-business/configure-mdm-provider-microsoft-store-for-business.md
@@ -2,6 +2,8 @@
 title: Configure an MDM provider (Windows 10)
 description: For companies or organizations using mobile device management (MDM) tools, those tools can synchronize with Microsoft Store for Business inventory to manage apps with offline licenses.
 ms.assetid: B3A45C8C-A96C-4254-9659-A9B364784673
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -43,4 +45,4 @@ Your MDM tool is ready to use with Microsoft Store. To learn how to configure sy
 - [Manage apps you purchased from Microsoft Store for Business with Microsoft Intune](https://docs.microsoft.com/intune-classic/deploy-use/manage-apps-you-purchased-from-the-windows-store-for-business-with-microsoft-intune)
 - [Manage apps from Microsoft Store for Business with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business)
 
-For third-party MDM providers or management servers, check your product documentation.
\ No newline at end of file
+For third-party MDM providers or management servers, check your product documentation.
diff --git a/store-for-business/device-guard-signing-portal.md b/store-for-business/device-guard-signing-portal.md
index f63f3ef6f6..6a2720e035 100644
--- a/store-for-business/device-guard-signing-portal.md
+++ b/store-for-business/device-guard-signing-portal.md
@@ -2,6 +2,8 @@
 title: Device Guard signing (Windows 10)
 description: Device Guard signing is a Device Guard feature that is available in the Microsoft Store for Business and Microsoft Store for Education.
 ms.assetid: 8D9CD2B9-5FC6-4C3D-AA96-F135AFEEBB78
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -41,7 +43,7 @@ When you're uploading files for Device Guard signing, there are a few limits for
 | Maximum size for multiple files (uploaded in a group) | 4 MB     |
 | Maximum number of files per upload                    | 15 files |
 
- ## File types
+ ## File types
 Catalog and policy files have required files types.
 
 | File          | Required file type |
@@ -49,8 +51,8 @@ Catalog and policy files have required files types.
 | catalog files | .cat               |
 | policy files  | .bin               |
 
- ##  Store for Business roles and permissions
+ ## Store for Business roles and permissions
 Signing code integrity policies and access to Device Guard portal requires the Device Guard signer role.
 
 ## Device Guard signing certificates
-All certificates generated by the Device Guard signing service are unique per customer and are independent of the Microsoft production code signing certificate authorities. All Certification Authority (CA) keys are stored within the cryptographic boundary of Federal Information Processing Standards (FIPS) publication 140-2 compliant hardware security modules. After initial generation, root certificate keys and top level CA keys are removed from the online signing service, encrypted, and stored offline.
\ No newline at end of file
+All certificates generated by the Device Guard signing service are unique per customer and are independent of the Microsoft production code signing certificate authorities. All Certification Authority (CA) keys are stored within the cryptographic boundary of Federal Information Processing Standards (FIPS) publication 140-2 compliant hardware security modules. After initial generation, root certificate keys and top level CA keys are removed from the online signing service, encrypted, and stored offline.
diff --git a/store-for-business/distribute-apps-from-your-private-store.md b/store-for-business/distribute-apps-from-your-private-store.md
index e83245f0e8..d45e508ac3 100644
--- a/store-for-business/distribute-apps-from-your-private-store.md
+++ b/store-for-business/distribute-apps-from-your-private-store.md
@@ -2,6 +2,8 @@
 title: Distribute apps using your private store (Windows 10)
 description: The private store is a feature in Microsoft Store for Business and Microsoft Store for Education that organizations receive during the signup process.
 ms.assetid: C4644035-845C-4C84-87F0-D87EA8F5BA19
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -41,15 +43,13 @@ Microsoft Store adds the app to **Products and services**. Click **Manage**, **A
 
     
 
-3.  Use **Refine results** to search for online-licensed apps under **License type**.
-4.  From the list of online-licensed apps, click the ellipses for the app you want, and then choose **Add to private store**.
+3.  Click on the application to open the application settings, then select **Private store availability**.
+4.  Select **Everyone** to make application available for all people in your organization.
 
     
 
-The value under **Private store** for the app will change to pending. It will take approximately thirty-six hours before the app is available in the private store.
-
 >[!Note]
- > If you are working with a new Line-of-Business (LOB) app, you have to wait for the app to be avilable in **Products & services** before adding it to your private store. For more information, see [Working with line of business apps](working-with-line-of-business-apps.md). 
+ > If you are working with a new Line-of-Business (LOB) app, you have to wait for the app to be available in **Products & services** before adding it to your private store. For more information, see [Working with line-of-business apps](working-with-line-of-business-apps.md). 
 
 ## Private store availability
 You can use security groups to scope which users can install an app from your private store. For more information, see [Private store availability](app-inventory-management-microsoft-store-for-business.md#private-store-availability).
@@ -66,4 +66,4 @@ Employees can claim apps that admins added to the private store by doing the fol
 ## Related topics
 - [Manage access to private store](manage-access-to-private-store.md)
 - [Manage private store settings](manage-private-store-settings.md)
-- [Configure access to Microsoft Store](/windows/configuration/stop-employees-from-using-microsoft-store)
\ No newline at end of file
+- [Configure access to Microsoft Store](/windows/configuration/stop-employees-from-using-microsoft-store)
diff --git a/store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md b/store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md
index ecc09aa00e..dd349cde72 100644
--- a/store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md
+++ b/store-for-business/distribute-apps-to-your-employees-microsoft-store-for-business.md
@@ -2,6 +2,8 @@
 title: Distribute apps to your employees from the Microsoft Store for Business and Education (Windows 10)
 description: Distribute apps to your employees from Microsoft Store for Business or Microsoft Store for Education. You can assign apps to employees,or let employees install them from your private store.
 ms.assetid: E591497C-6DFA-49C1-8329-4670F2164E9E
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/store-for-business/distribute-apps-with-management-tool.md b/store-for-business/distribute-apps-with-management-tool.md
index cab9bdc670..f350acf242 100644
--- a/store-for-business/distribute-apps-with-management-tool.md
+++ b/store-for-business/distribute-apps-with-management-tool.md
@@ -2,6 +2,8 @@
 title: Distribute apps with a management tool (Windows 10)
 description: You can configure a mobile device management (MDM) tool to synchronize your Microsoft Store for Business or Microsoft Store for Education inventory. Microsoft Store management tool services work with MDM tools to manage content.
 ms.assetid: 006F5FB1-E688-4769-BD9A-CFA6F5829016
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -57,4 +59,4 @@ This diagram shows how you can use a management tool to distribute an online-lic
 ## Related topics
 
 [Configure MDM Provider](configure-mdm-provider-microsoft-store-for-business.md)
-[Manage apps you purchased from the Microsoft Store for Business and Education with Microsoft Intune](https://docs.microsoft.com/intune-classic/deploy-use/manage-apps-you-purchased-from-the-windows-store-for-business-with-microsoft-intune)
\ No newline at end of file
+[Manage apps you purchased from the Microsoft Store for Business and Education with Microsoft Intune](https://docs.microsoft.com/intune-classic/deploy-use/manage-apps-you-purchased-from-the-windows-store-for-business-with-microsoft-intune)
diff --git a/store-for-business/distribute-offline-apps.md b/store-for-business/distribute-offline-apps.md
index eefb7fd379..52c8ea4a6b 100644
--- a/store-for-business/distribute-offline-apps.md
+++ b/store-for-business/distribute-offline-apps.md
@@ -2,6 +2,8 @@
 title: Distribute offline apps (Windows 10)
 description: Offline licensing is a new licensing option for Windows 10.
 ms.assetid: 6B9F6876-AA66-4EE4-A448-1371511AC95E
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -63,9 +65,12 @@ There are several items to download or create for offline-licensed apps. The app
 **To download an offline-licensed app**
 
 1.  Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/) or [Microsoft Store for Education](https://educationstore.microsoft.com).
-2.  Click **Manage**, and then choose **Apps & software**.
-3.  Refine results by **License type** to show apps with offline licenses.
-4.  Find the app you want to download, click the ellipses under **Actions**, and then choose **Download for offline use**.
+2.  Click **Manage**.
+3.  Click **Settings**.
+4.  Click **Shop**. Search for the **Shopping experience** section, change the License type to **Offline**, and click  **Get the app**, which will add the app to your inventory.
+5.  Click **Manage**. You now have access to download the appx bundle package metadata and license file.
+6.  Go to **Products & services**, and select **Apps & software**. (The list may be empty, but it will auto-populate after some time.)
+
     - **To download app metadata**: Choose the language for the app metadata, and then click **Download**. Save the downloaded app metadata. This is optional.
     - **To download app package**: Click to expand the package details information, choose the Platform and Architecture combination that you need for your organization, and then click **Download**. Save the downloaded app package. This is required.
     - **To download an app license**: Choose either **Encoded**, or **Unencoded**, and then click **Generate license**. Save the downloaded license. This is required.
diff --git a/store-for-business/docfx.json b/store-for-business/docfx.json
index e02715ff1f..2a30faf3ef 100644
--- a/store-for-business/docfx.json
+++ b/store-for-business/docfx.json
@@ -4,7 +4,7 @@
       {
         "files": [
           "**/*.md",
-		  "**/**.yml"
+          "**/**.yml"
         ],
         "exclude": [
           "**/obj/**",
@@ -31,25 +31,37 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
-		"breadcrumb_path": "/microsoft-store/breadcrumb/toc.json",
-		"uhfHeaderId": "MSDocsHeader-WindowsIT", 
-		"ms.author": "trudyha",
-		"ms.technology": "windows",
-		"ms.topic": "article",
-		"ms.date": "05/09/2017",
-		"searchScope": ["Store"],
-		"feedback_system": "GitHub",
-		"feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
-		"feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
-		"_op_documentIdPathDepotMapping": {
-			"./": {
-			  "depot_name": "MSDN.store-for-business"
-			}
-		}
-	},
+      "breadcrumb_path": "/microsoft-store/breadcrumb/toc.json",
+      "ms.author": "trudyha",
+      "audience": "ITPro",
+      "ms.technology": "windows",
+      "ms.topic": "article",
+      "ms.date": "05/09/2017",
+      "searchScope": [
+        "Store"
+      ],
+      "feedback_system": "None",
+      "hideEdit": true,
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "MSDN.store-for-business",
+          "folder_relative_path_in_docset": "./"
+        }
+      },
+      "contributors_to_exclude": [ 
+        "rjagiewich", 
+        "traya1", 
+        "rmca14", 
+        "claydetels19", 
+        "Kellylorenebaker",
+        "jborsecnik",
+        "tiburd",
+        "garycentric"
+      ]
+    },
     "fileMetadata": {},
     "template": [],
     "dest": "store-for-business",
-    "markdownEngineName": "dfm"
-  }
-}
\ No newline at end of file
+    "markdownEngineName": "markdig"
+    }
+}
diff --git a/store-for-business/education/TOC.md b/store-for-business/education/TOC.md
index b97c30604a..515b03dd25 100644
--- a/store-for-business/education/TOC.md
+++ b/store-for-business/education/TOC.md
@@ -1,7 +1,7 @@
 # [Microsoft Store for Education](/microsoft-store/index?toc=/microsoft-store/education/toc.json)
 ## [What's new in Microsoft Store for Business and Education](/microsoft-store/whats-new-microsoft-store-business-education?toc=/microsoft-store/education/toc.json)
 ## [Sign up and get started](/microsoft-store/sign-up-microsoft-store-for-business-overview?toc=/microsoft-store/education/toc.json)
-###[Microsoft Store for Business and Education overview](/microsoft-store/windows-store-for-business-overview?toc=/microsoft-store/education/toc.json)
+### [Microsoft Store for Business and Education overview](/microsoft-store/windows-store-for-business-overview?toc=/microsoft-store/education/toc.json)
 ### [Prerequisites for Microsoft Store for Business and Education](/microsoft-store/prerequisites-microsoft-store-for-business?toc=/microsoft-store/education/toc.json)
 ### [Sign up for Microsoft Store for Business or Microsoft Store for Education](/microsoft-store/sign-up-microsoft-store-for-business?toc=/microsoft-store/education/toc.json)
 ### [Roles and permissions in the Microsoft Store for Business and Education](/microsoft-store/roles-and-permissions-microsoft-store-for-business?toc=/microsoft-store/education/toc.json)
@@ -21,7 +21,7 @@
 ### [Distribute apps with a management tool](/microsoft-store/distribute-apps-with-management-tool?toc=/microsoft-store/education/toc.json)
 ### [Distribute offline apps](/microsoft-store/distribute-offline-apps?toc=/microsoft-store/education/toc.json)
 ## [Manage products and services](/microsoft-store/manage-apps-microsoft-store-for-business-overview?toc=/microsoft-store/education/toc.json)
-### [App inventory managemement for Microsoft Store for Business](/microsoft-store/app-inventory-management-microsoft-store-for-business?toc=/microsoft-store/education/toc.json)
+### [App inventory management for Microsoft Store for Business](/microsoft-store/app-inventory-management-microsoft-store-for-business?toc=/microsoft-store/education/toc.json)
 ### [Manage app orders in Microsoft Store for Business and Education](/microsoft-store/manage-orders-microsoft-store-for-business?toc=/microsoft-store/education/toc.json)
 ### [Manage access to private store](/microsoft-store/manage-access-to-private-store?toc=/microsoft-store/education/toc.json)
 ### [Manage private store settings](/microsoft-store/manage-private-store-settings?toc=/microsoft-store/education/toc.json)
diff --git a/store-for-business/find-and-acquire-apps-overview.md b/store-for-business/find-and-acquire-apps-overview.md
index d1c2b7f688..ef2a60a52a 100644
--- a/store-for-business/find-and-acquire-apps-overview.md
+++ b/store-for-business/find-and-acquire-apps-overview.md
@@ -2,6 +2,8 @@
 title: Find and acquire apps (Windows 10)
 description: Use the Microsoft Store for Business and Education to find apps for your organization. You can also work with developers to create line-of-business apps that are only available to your organization.
 ms.assetid: 274A5003-5F15-4635-BB8B-953953FD209A
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/store-for-business/manage-access-to-private-store.md b/store-for-business/manage-access-to-private-store.md
index dcf2a8f992..efb45d459f 100644
--- a/store-for-business/manage-access-to-private-store.md
+++ b/store-for-business/manage-access-to-private-store.md
@@ -2,6 +2,8 @@
 title: Manage access to private store (Windows 10)
 description: You can manage access to your private store in Microsoft Store for Business and Microsoft Store for Education.
 ms.assetid: 4E00109C-2782-474D-98C0-02A05BE613A5
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -67,4 +69,4 @@ You can also prevent employees from using Microsoft Store. For more information,
 ## Related topics
 
 [Distribute apps using your private store](distribute-apps-from-your-private-store.md)
-[Configure access to Microsoft Store](/windows/configuration/stop-employees-from-using-microsoft-store)
\ No newline at end of file
+[Configure access to Microsoft Store](/windows/configuration/stop-employees-from-using-microsoft-store)
diff --git a/store-for-business/manage-apps-microsoft-store-for-business-overview.md b/store-for-business/manage-apps-microsoft-store-for-business-overview.md
index 5c9f41f018..eb8e54c5f3 100644
--- a/store-for-business/manage-apps-microsoft-store-for-business-overview.md
+++ b/store-for-business/manage-apps-microsoft-store-for-business-overview.md
@@ -2,6 +2,8 @@
 title: Manage products and services in Microsoft Store for Business (Windows 10)
 description: Manage apps, software, devices, products and services in Microsoft Store for Business.
 ms.assetid: 2F65D4C3-B02C-41CC-92F0-5D9937228202
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -27,9 +29,9 @@ Manage products and services in Microsoft Store for Business and Microsoft Store
 | Topic | Description |
 | ----- | ----------- |
 | [Manage access to private store](manage-access-to-private-store.md) | You can manage access to your private store in Store for Business. |
-| [App inventory managemement for Microsoft Store for Business and Education](app-inventory-management-microsoft-store-for-business.md) | You can manage all apps that you've acquired on your **Apps & software** page. |
+| [App inventory management for Microsoft Store for Business and Education](app-inventory-management-microsoft-store-for-business.md) | You can manage all apps that you've acquired on your **Apps & software** page. |
 | [Manage private store settings](manage-private-store-settings.md) | The private store is a feature in Microsoft Store for Business and Education that organizations receive during the sign up process. When admins add apps to the private store, all employees in the organization can view and download the apps. Only online-licensed apps can be distributed from your private store. |
 | [Configure MDM provider](configure-mdm-provider-microsoft-store-for-business.md) | For companies or organizations using mobile device management (MDM) tools, those tools can synchronize with Microsoft Store for Business inventory to manage apps with offline licenses. Microsoft Store management tool services work with your third-party management tool to manage content. |
 | [Manage Windows device deployment with Windows Autopilot Deployment](add-profile-to-devices.md) | In Microsoft Store for Business, you can manage devices for your organization and apply an Autopilot deployment profile to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows based on the Autopilot deployment profile you applied to the device. |
 | [Microsoft Store for Business and Education PowerShell module - preview](microsoft-store-for-business-education-powershell-module.md) | Use PowerShell cmdlets to automate basic app license assignment.  |
-| [Manage software purchased with Microsoft Products and Services agreement in Microsoft Store for Business](manage-mpsa-software-microsoft-store-for-business.md) | Software purchased with the Microsoft Products and Services Agreement (MPSA) can be managed in Microsoft Store for Business and Education. This allows customers to manage online software purchases in one location. |
\ No newline at end of file
+| [Manage software purchased with Microsoft Products and Services agreement in Microsoft Store for Business](manage-mpsa-software-microsoft-store-for-business.md) | Software purchased with the Microsoft Products and Services Agreement (MPSA) can be managed in Microsoft Store for Business and Education. This allows customers to manage online software purchases in one location. |
diff --git a/store-for-business/manage-mpsa-software-microsoft-store-for-business.md b/store-for-business/manage-mpsa-software-microsoft-store-for-business.md
index 4967eb20a1..be333e3e06 100644
--- a/store-for-business/manage-mpsa-software-microsoft-store-for-business.md
+++ b/store-for-business/manage-mpsa-software-microsoft-store-for-business.md
@@ -10,6 +10,8 @@ ms.author: TrudyHa
 ms.topic: conceptual
 ms.localizationpriority: medium
 ms.date: 3/20/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Manage software purchased with Microsoft Products and Services agreement in Microsoft Store for Business
@@ -49,7 +51,7 @@ You'll need to get permissions for the admin that manages the domain you want to
 In some cases, we might not have info on who the global admin is for the tenant that you select. It might be that the tenant is unmanaged, and you'll need to identify a global admin. Or, you might only need to share account info for the global admin.
 
 If you need to nominate someone to be the global admin, they need sufficient permissions:
-- someone who can distribute sofware
+- someone who can distribute software
 - in Business Center Portal (BCP), it should be someone with **Agreement Admin** role
 
 **To add a global admin to a tenant**
@@ -58,4 +60,4 @@ We'll ask for a global admin if we need that info when you add a tenant to a pur
 
 -  On **Add a Global Admin**, click **Make me the Global Admin**, and then click **Submit**.
 -or-
--  On **Add a Global Admin**, type a name in **Invite someone else**, and then click **Submit**.
\ No newline at end of file
+-  On **Add a Global Admin**, type a name in **Invite someone else**, and then click **Submit**.
diff --git a/store-for-business/manage-orders-microsoft-store-for-business.md b/store-for-business/manage-orders-microsoft-store-for-business.md
index 66650f1c89..91a18494e2 100644
--- a/store-for-business/manage-orders-microsoft-store-for-business.md
+++ b/store-for-business/manage-orders-microsoft-store-for-business.md
@@ -1,6 +1,6 @@
 ---
 title: Manage app orders in Microsoft Store for Business or Microsoft Store for Education (Windows 10)
-description: You can view your order history with Micrsoft Store for Business or Micrsoft Store for Education.
+description: You can view your order history with Microsoft Store for Business or Microsoft Store for Education.
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -10,6 +10,8 @@ ms.author: TrudyHa
 ms.topic: conceptual
 ms.localizationpriority: medium
 ms.date: 11/10/2017
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Manage app orders in Microsoft Store for Business and Education
@@ -40,23 +42,23 @@ Refunds work a little differently for free apps, and apps that have a price. In
 
 **Refunds for free apps**
 
- For free apps, there isn't really a refund to request -- you're removing the app from your inventory. You must first reclaim any assigned licenses, and then you can remove the app from your organization's inventory.
+For free apps, there isn't really a refund to request -- you're removing the app from your inventory. You must first reclaim any assigned licenses, and then you can remove the app from your organization's inventory.
 
- **Refunds for apps that have a price**
+**Refunds for apps that have a price**
 
- There are a few requirements for apps that have a price:
- - **Timing** - Refunds are available for the first 30 days after you place your order. For example, if your order is placed on June 1, you can self-refund through June 30.
- - **Available licenses** - You need to have enough available licenses to cover the number of licenses in the order you are refunding. For example, if you purchased 10 copies of an app and you want to request a refund, you must have at least 10 licenses of the app available in your inventory -- those 10 licenses can't be assigned to people in your organization.
- - **Whole order refunds only** - You must refund the complete amount of apps in an order. You can't refund a part of an order. For example, if you purchased 10 copies of an app, but later found you only needed 5 copies, you'll need to request a refund for the 10 apps, and then make a separate order for 5 apps. If you have had multiple orders of the same app, you can refund one order but still keep the rest of the inventory.
+There are a few requirements for apps that have a price:
+- **Timing** - Refunds are available for the first 30 days after you place your order. For example, if your order is placed on June 1, you can self-refund through June 30.
+- **Available licenses** - You need to have enough available licenses to cover the number of licenses in the order you are refunding. For example, if you purchased 10 copies of an app and you want to request a refund, you must have at least 10 licenses of the app available in your inventory -- those 10 licenses can't be assigned to people in your organization.
+- **Whole order refunds only** - You must refund the complete amount of apps in an order. You can't refund a part of an order. For example, if you purchased 10 copies of an app, but later found you only needed 5 copies, you'll need to request a refund for the 10 apps, and then make a separate order for 5 apps. If you have had multiple orders of the same app, you can refund one order but still keep the rest of the inventory.
 
 **To refund an order**
 
 Reclaim licenses, and then request a refund. If you haven't assigned licenses, start on step 5.
 1.  Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com).
-2.	Click **Manage**, and then choose **Apps & software**.
-3.	Find the app you want to refund, click the ellipses under **Actions**, and then choose **View license details**.
+2. Click **Manage**, and then choose **Apps & software**.
+3. Find the app you want to refund, click the ellipses under **Actions**, and then choose **View license details**.
 4.  Select the people who you want to reclaim license from, click the ellipses under **Actions**, and then choose **Reclaim licenses**.
-5.	Click **Order history**, click the order you want to refund, and click **Refund order**.
+5. Click **Order history**, click the order you want to refund, and click **Refund order**.
 
 For free apps, the app will be removed from your inventory in **Apps & software**.
 
diff --git a/store-for-business/manage-private-store-settings.md b/store-for-business/manage-private-store-settings.md
index ee4baa3b88..32c45c18ee 100644
--- a/store-for-business/manage-private-store-settings.md
+++ b/store-for-business/manage-private-store-settings.md
@@ -2,6 +2,8 @@
 title: Manage private store settings (Windows 10)
 description: The private store is a feature in the Microsoft Store for Business and Microsoft Store for Education that organizations receive during the sign up process.
 ms.assetid: 2D501538-0C6E-4408-948A-2BF5B05F7A0C
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -100,7 +102,7 @@ We've recently made performance improvements for changes in the private store. T
 | ------------------------------------------------------ | -------------- |
 | Add a product to the private store 
     - Apps recently added to your inventory, including line-of-business (LOB) apps and new purchases, will take up to 36 hours to add to the private store. That time begins when the product is purchased, or added to your inventory. 
     - It will take an additional 36 hours for the product to be searchable in private store, even if you see the app available from the private store tab. | - 15 minutes: available on private store tab 
     - 36 hours: searchable in private store 
     - 36 hours: searchable in private store tab |
 | Remove a product from private store |  - 15 minutes: private store tab 
     - 36 hours: searchable in private store |
-| Accept a new LOB app into your inventory (under **Products & services)**) | - 15 minutes: available on private store tab 
     - 36 hours: searchable in private store |
+| Accept a new LOB app into your inventory (under **Products & services**) | - 15 minutes: available on private store tab 
     - 36 hours: searchable in private store |
 | Create a new collection | 15 minutes|
 | Edit or remove a collection | 15 minutes |
 | Create private store tab | 4-6 hours |
diff --git a/store-for-business/manage-settings-microsoft-store-for-business.md b/store-for-business/manage-settings-microsoft-store-for-business.md
index 77cce4033a..351bc09205 100644
--- a/store-for-business/manage-settings-microsoft-store-for-business.md
+++ b/store-for-business/manage-settings-microsoft-store-for-business.md
@@ -2,6 +2,8 @@
 title: Manage settings for Microsoft Store for Business and Microsoft Store for Education (Windows 10)
 description: You can add users and groups, as well as update some of the settings associated with the Azure Active Directory (AD) tenant.
 ms.assetid: E3283D77-4DB2-40A9-9479-DDBC33D5A895
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/store-for-business/manage-users-and-groups-microsoft-store-for-business.md b/store-for-business/manage-users-and-groups-microsoft-store-for-business.md
index 7d6006d776..79cb86cf24 100644
--- a/store-for-business/manage-users-and-groups-microsoft-store-for-business.md
+++ b/store-for-business/manage-users-and-groups-microsoft-store-for-business.md
@@ -2,6 +2,8 @@
 title: Manage user accounts in Microsoft Store for Business and Microsoft Store for Education (Windows 10)
 description: Microsoft Store for Business and Microsoft Store for Education manages permissions with a set of roles. Currently, you can assign these roles to individuals in your organization, but not to groups.
 ms.assetid: 5E7FA071-CABD-4ACA-8AAE-F549EFCE922F
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
diff --git a/store-for-business/microsoft-store-for-business-education-powershell-module.md b/store-for-business/microsoft-store-for-business-education-powershell-module.md
index 4b53678c9c..b7fea1a9ef 100644
--- a/store-for-business/microsoft-store-for-business-education-powershell-module.md
+++ b/store-for-business/microsoft-store-for-business-education-powershell-module.md
@@ -11,12 +11,14 @@ ms.topic: conceptual
 ms.localizationpriority: medium
 ms.author:
 ms.date: 10/22/2017
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Microsoft Store for Business and Education PowerShell module - preview
 
 **Applies to**
--   Windows 10
+-   Windows 10
 
 Microsoft Store for Business and Education PowerShell module (preview) is now available on [PowerShell Gallery](https://go.microsoft.com/fwlink/?linkid=853459).
 
@@ -50,7 +52,6 @@ To install **Microsoft Store for Business and Education PowerShell** with PowerS
 # Install the Microsoft Store for Business and Education PowerShell module from PowerShell Gallery
 
 Install-Module -Name MSStore
-
 ```
 
 ## Import Microsoft Store for Business and Education PowerShell module into the PowerShell session
@@ -60,7 +61,6 @@ Once you install the module on your Windows 10 device, you will need to then imp
 # Import the MSStore module into this session
 
 Import-Module -Name MSStore
-
 ```
 
 Next, authorize the module to call **Microsoft Store for Business and Education** on your behalf. This step is required once, per user of the PowerShell module.
@@ -71,9 +71,8 @@ To authorize the PowerShell module, run this command. You'll need to sign-in wit
 # Grant MSStore Access to your Microsoft Store for Business and Education
 
 Grant-MSStoreClientAppAccess
-
 ```
-You will be promted to sign in with your work or school account and then to authorize the PowerShell Module to access your **Microsoft Store for Business and Education** account. Once the module has been imported into the current PowerShell session and authorized to call into your **Microsoft Store for Business and Education** account, Azure PowerShell cmdlets are loaded and ready to be used.
+You will be prompted to sign in with your work or school account and then to authorize the PowerShell Module to access your **Microsoft Store for Business and Education** account. Once the module has been imported into the current PowerShell session and authorized to call into your **Microsoft Store for Business and Education** account, Azure PowerShell cmdlets are loaded and ready to be used.
 
 ## View items in Products and Services
 Service management should encounter no breaking changes as a result of the separation of Azure Service Management and **Microsoft Store for Business and Education PowerShell** preview.
@@ -82,7 +81,6 @@ Service management should encounter no breaking changes as a result of the separ
 # View items in inventory (Apps & software)
 
 Get-MSStoreInventory
-
 ```
 
 >[!TIP]
@@ -100,7 +98,6 @@ Most items in **Products and Services** in **Microsoft Store for Business and Ed
 # View products assigned to people
 
 Get-MSStoreSeatAssignments -ProductId 9NBLGGH4R2R6 -SkuId 0016
-
 ```
 
 > [!Important]
@@ -127,7 +124,6 @@ Add-MSStoreSeatAssignment -ProductId 9NBLGGH4R2R6 -SkuId 0016 -Username 'user@my
 # Reclaim a product (Product ID and SKU ID combination) from a User (user@host.com)
 
 Remove-MSStoreSeatAssignment -ProductId 9NBLGGH4R2R6 -SkuId 0016 -Username 'user@myorganization.onmicrosoft.com'
-
 ```
 
 ## Assign or reclaim a product with a .csv file
@@ -143,7 +139,6 @@ Add-MSStoreSeatAssignments  -ProductId 9NBLGGH4R2R6 -SkuId 0016 -PathToCsv C:\Pe
 # Reclaim a product (Product ID and SKU ID combination) from a User (user@host.com)
 
 Remove-MSStoreSeatAssignments  -ProductId 9NBLGGH4R2R6 -SkuId 0016 -PathToCsv C:\People.csv -ColumnName UserPrincipalName
-
 ```
 
 ## Uninstall Microsoft Store for Business and Education PowerShell module
@@ -153,5 +148,4 @@ You can remove **Microsoft Store for Business and Education PowerShell** from yo
 # Uninstall the MSStore Module
 
 Get-InstalledModule -Name "MSStore" -RequiredVersion 1.0 | Uninstall-Module
-
 ```
diff --git a/store-for-business/microsoft-store-for-business-overview.md b/store-for-business/microsoft-store-for-business-overview.md
index 276c980fae..4b9707b563 100644
--- a/store-for-business/microsoft-store-for-business-overview.md
+++ b/store-for-business/microsoft-store-for-business-overview.md
@@ -2,6 +2,8 @@
 title: Microsoft Store for Business and Microsoft Store for Education overview (Windows 10)
 description: With Microsoft Store for Business and Microsoft Store for Education, organizations and schools can make volume purchases of Windows apps.
 ms.assetid: 9DA71F6B-654D-4121-9A40-D473CC654A1C
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.pagetype: store, mobile
 ms.mktglfcycl: manage
@@ -28,8 +30,8 @@ Organizations or schools of any size can benefit from using Microsoft Store for
 - **Scales to fit the size of your business** - For smaller businesses, with Azure AD accounts or Office 365 accounts and Windows 10 devices, you can quickly have an end-to-end process for acquiring and distributing content using the Store for Business. For larger businesses, all the capabilities of the Store for Business are available to you, or you can integrate Microsoft Store for Business with management tools, for greater control over access to apps and app updates. You can use existing work or school accounts.
 - **Bulk app acquisition** - Acquire apps in volume from Microsoft Store for Business.
 - **Centralized management** – Microsoft Store provides centralized management for inventory, billing, permissions, and order history. You can use Microsoft Store to view, manage and distribute items purchased from:
-    - **Microsoft Store for Business** – Apps and subscriptions
-    - **Microsoft Store for Education** – Apps and subscriptions
+    - **Microsoft Store for Business** – Apps acquired from Microsoft Store for Business
+    - **Microsoft Store for Education** – Apps acquired from Microsoft Store for Education
     - **Office 365** – Subscriptions
     - **Volume licensing** - Apps purchased with volume licensing
 - **Private store** - Create a private store for your business that’s easily available from any Windows 10 device. Your private store is available from Microsoft Store on Windows 10, or with a browser on the Web. People in your organization can download apps from your organization's private store on Windows 10 devices. 
@@ -58,7 +60,7 @@ Microsoft Azure Active Directory (AD) accounts for your employees:
 - Employees need Azure AD account when they access Store for Business content from Windows devices.
 - If you use a management tool to distribute and manage online-licensed apps, all employees will need an Azure AD account
 - For offline-licensed apps, Azure AD accounts are not required for employees.
-- Admins can add or remove user accounts in the Office 365 admin center, even if you don’t have an Office 365 subscription. You can access the Office 365 admin portal directly from the Store for Business and Education. 
+- Admins can add or remove user accounts in the Microsoft 365 admin center, even if you don’t have an Office 365 subscription. You can access the Office 365 admin portal directly from the Store for Business and Education. 
 
 For more information on Azure AD, see [About Office 365 and Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=708612), and [Intro to Azure: identity and access](https://go.microsoft.com/fwlink/p/?LinkId=708611).
 
@@ -90,7 +92,7 @@ After your admin signs up for the Store for Business and Education, they can ass
 
 > [!NOTE]
 > Currently, the Basic purchaser role is only available for schools using Microsoft Store for Education. For more information, see [Microsoft Store for Education permissions](https://docs.microsoft.com/education/windows/education-scenarios-store-for-business?toc=/microsoft-store/education/toc.json#manage-domain-settings).
- 
+
 In some cases, admins will need to add Azure Active Directory (AD) accounts for their employees. For more information, see [Manage user accounts and groups](manage-users-and-groups-microsoft-store-for-business.md).
 
 Also, if your organization plans to use a management tool, you’ll need to configure your management tool to sync with Store for Business and Education.
@@ -195,7 +197,7 @@ Store for Business and Education is currently available in these markets.
             
  • Colombia
    • 
             
  • Comoros
    • 
             
  • Costa Rica
    • 
-            
  • Côte D'ivoire
    • 
+            
  • Côte D'ivoire
    • 
             
  • Croatia
    • 
             
  • Curçao
    • 
             
  • Cyprus
    • 
@@ -330,8 +332,7 @@ Store for Business and Education is currently available in these markets.
             
  • Viet Nam
    • 
             
  • Virgin Islands, U.S.
    • 
             
  • Zambia
    • 
-            
  • Zimbabwe
       
    •          
-        
+            
  • Zimbabwe
       

    •         
     
    
 
@@ -360,7 +361,7 @@ Customers in these markets can use Microsoft Store for Business and Education to
 - Ukraine 
 
 ### Support to only manage products
-Customers in these markets can use Microsoft Store for Business and Education only to manage products that they've purchased from other channels. For example, they might have purchased products through Volume Licensing Service Center. However, they can't purhcase apps directly from Microsoft Store for Business and Education. 
+Customers in these markets can use Microsoft Store for Business and Education only to manage products that they've purchased from other channels. For example, they might have purchased products through Volume Licensing Service Center. However, they can't purchase apps directly from Microsoft Store for Business and Education. 
 - Puerto Rico
 
 This table summarize what customers can purchase, depending on which Microsoft Store they are using. 
@@ -372,9 +373,9 @@ This table summarize what customers can purchase, depending on which Microsoft S
 
 > [!NOTE]
 > **Microsoft Store for Education customers with support for free apps and Minecraft: Education Edition**
-- Admins can acquire free apps from **Microsoft Store for Education**.
-- Admins need to use an invoice to purchase **Minecraft: Education Edition**. For more information, see [Invoice payment option](https://docs.microsoft.com/education/windows/school-get-minecraft#invoices). 
-- Teachers, or people with the Basic Purachaser role, can acquire free apps, but not **Minecraft: Education Edition**. 
+> - Admins can acquire free apps from **Microsoft Store for Education**.
+> - Admins need to use an invoice to purchase **Minecraft: Education Edition**. For more information, see [Invoice payment option](https://docs.microsoft.com/education/windows/school-get-minecraft#invoices). 
+> - Teachers, or people with the Basic Purchaser role, can acquire free apps, but not **Minecraft: Education Edition**. 
 
 ## Privacy notice
 
@@ -382,7 +383,7 @@ Store for Business and Education services get names and email addresses of peopl
 - Granting and managing permissions
 - Managing app licenses 
 - Distributing apps to people (names appear in a list that admins can select from)
- 
+
 Store for Business and Education does not save names, or email addresses.
 
 Your use of Store for Business and Education is also governed by the [Microsoft Store for Business and Education Services Agreement](https://businessstore.microsoft.com/servicesagreement). 
diff --git a/store-for-business/notifications-microsoft-store-business.md b/store-for-business/notifications-microsoft-store-business.md
index 478fb68e22..d360104140 100644
--- a/store-for-business/notifications-microsoft-store-business.md
+++ b/store-for-business/notifications-microsoft-store-business.md
@@ -1,8 +1,10 @@
 ---
 title: Notifications in Microsoft Store for Business and Education (Windows 10)
-description: Notifications alert you to issues or outages with Micrososft Store for Business and Education.
+description: Notifications alert you to issues or outages with Microsoft Store for Business and Education.
 keywords: notifications, alerts
 ms.assetid: 
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -32,5 +34,5 @@ Microsoft Store for Business and Microsoft Store for Education use a set of noti
 | Manage | We’re on it. Something happened on our end with management for apps and software. We’re working to fix the problem. | You might be unable to manage inventory, including viewing inventory, distributing apps, assigning licenses, or viewing and managing order history.  |
 | Shop | We’re on it. Something happened on our end with purchasing. We’re working to fix the problem. | Shop might not be available. You might not be able to purchase new, or additional licenses. |
 | Private store | We’re on it. Something happened on our end with your organization’s private store. People in your organization can’t download apps right now. We’re working to fix the problem. | People in your organization might not be able to view the private store, or get apps. |
-| Acquistion and licensing | We’re on it. People in your org might not be able to install or use certain apps. We’re working to fix the problem. | People in your org might not be able to claim a license from your private store. |
-| Partner | We’re on it. Something happened on our end with Find a Partner. We’re working to fix the problem. | You might not be able to search for a partner.  |
\ No newline at end of file
+| Acquisition and licensing | We’re on it. People in your org might not be able to install or use certain apps. We’re working to fix the problem. | People in your org might not be able to claim a license from your private store. |
+| Partner | We’re on it. Something happened on our end with Find a Partner. We’re working to fix the problem. | You might not be able to search for a partner.  |
diff --git a/store-for-business/payment-methods.md b/store-for-business/payment-methods.md
index e67c02d7b6..83f20ebfd1 100644
--- a/store-for-business/payment-methods.md
+++ b/store-for-business/payment-methods.md
@@ -11,6 +11,8 @@ ms.author: TrudyHa
 ms.topic: conceptual
 ms.localizationpriority: medium
 ms.date: 03/01/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Payment methods
@@ -48,4 +50,4 @@ Once you select **Add**, the information you provided will be validated with a t
 Once you click **Update**, the information you provided will be validated with a test authorization transaction and, if validated, the payment option will be added to your list of available payment options. Otherwise, you will be prompted for additional information or notified if there are any problems.
 
 > [!NOTE]
-> Certain actions, like updating or adding a payment option, require temporary “test authorization” transactions to validate the payment option. These may appear on your statement as $0.00 authorizations or as small pending transactions. These transactions are temporary and should not impact your account unless you make several changes in a short period of time, or have a low balance.
\ No newline at end of file
+> Certain actions, like updating or adding a payment option, require temporary “test authorization” transactions to validate the payment option. These may appear on your statement as $0.00 authorizations or as small pending transactions. These transactions are temporary and should not impact your account unless you make several changes in a short period of time, or have a low balance.
diff --git a/store-for-business/prerequisites-microsoft-store-for-business.md b/store-for-business/prerequisites-microsoft-store-for-business.md
index 618205cdd5..0d054ed947 100644
--- a/store-for-business/prerequisites-microsoft-store-for-business.md
+++ b/store-for-business/prerequisites-microsoft-store-for-business.md
@@ -2,6 +2,8 @@
 title: Prerequisites for Microsoft Store for Business and Education (Windows 10)
 description: There are a few prerequisites for using Microsoft Store for Business or Microsoft Store for Education.
 ms.assetid: CEBC6870-FFDD-48AD-8650-8B0DC6B2651D
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -49,20 +51,20 @@ While not required, you can use a management tool to distribute and manage apps.
 
 If your organization restricts computers on your network from connecting to the Internet, there is a set of URLs that need to be available for devices to use Microsoft Store. Some of the Microsoft Store features use Store services. Devices using Microsoft Store – either to acquire, install, or update apps – will need access to these URLs. If you use a proxy server to block traffic, your configuration needs to allow these URLs:
 
--   login.live.com
--   login.windows.net
--   account.live.com
--   clientconfig.passport.net
--   windowsphone.com
--   \*.wns.windows.com
--   \*.microsoft.com
--   \*.s-microsoft.com
--   www.msftncsi.com (prior to Windows 10, version 1607)
--   www.msftconnecttest.com/connecttest.txt (replaces www.msftncsi.com
-starting with Windows 10, version 1607)
- 
+- login.live.com
+- login.windows.net
+- account.live.com
+- clientconfig.passport.net
+- windowsphone.com
+- \*.wns.windows.com
+- \*.microsoft.com
+- \*.s-microsoft.com
+- www.msftncsi.com (prior to Windows 10, version 1607)
+- www.msftconnecttest.com/connecttest.txt (replaces www.msftncsi.com
+  starting with Windows 10, version 1607)
+ 
 
- 
+ 
 
 
 
diff --git a/store-for-business/release-history-microsoft-store-business-education.md b/store-for-business/release-history-microsoft-store-business-education.md
index 2bcdcd39b9..cc3bbbad3c 100644
--- a/store-for-business/release-history-microsoft-store-business-education.md
+++ b/store-for-business/release-history-microsoft-store-business-education.md
@@ -9,6 +9,8 @@ author: TrudyHa
 ms.author: TrudyHa
 ms.topic: conceptual
 ms.date: 10/31/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Microsoft Store for Business and Education release history
diff --git a/store-for-business/roles-and-permissions-microsoft-store-for-business.md b/store-for-business/roles-and-permissions-microsoft-store-for-business.md
index 48a7bcf332..2163e6379a 100644
--- a/store-for-business/roles-and-permissions-microsoft-store-for-business.md
+++ b/store-for-business/roles-and-permissions-microsoft-store-for-business.md
@@ -3,6 +3,8 @@ title: Roles and permissions in Microsoft Store for Business and Education (Wind
 description: The first person to sign in to Microsoft Store for Business or Microsoft Store for Education must be a Global Admin of the Azure Active Directory (AD) tenant. Once the Global Admin has signed in, they can give permissions to others employees.
 keywords: roles, permissions
 ms.assetid: CB6281E1-37B1-4B8B-991D-BC5ED361F1EE
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -30,7 +32,7 @@ This table lists the global user accounts and the permissions they have in Micro
 | Purchase apps                   |  X                    | X                     |
 | Distribute apps                |  X                    | X                     |
 | Purchase subscription-based software  |  X             | X                     |
- 
+ 
 
 **Global Administrator** - IT Pros with this account have full access to Microsoft Store. They can do everything allowed in the Microsoft Store Admin role, plus they can sign up for Microsoft Store.
 
diff --git a/store-for-business/settings-reference-microsoft-store-for-business.md b/store-for-business/settings-reference-microsoft-store-for-business.md
index 0f320b25e1..ccb33fc3e0 100644
--- a/store-for-business/settings-reference-microsoft-store-for-business.md
+++ b/store-for-business/settings-reference-microsoft-store-for-business.md
@@ -2,6 +2,8 @@
 title: Settings reference Microsoft Store for Business and Education (Windows 10)
 description: The Microsoft Store for Business and Education has a group of settings that admins use to manage the store.
 ms.assetid: 34F7FA2B-B848-454B-AC00-ECA49D87B678
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -24,7 +26,7 @@ The Microsoft Store for Business and Education has a group of settings that admi
 | Private store | Update the name for your private store. The new name will be displayed on a tab in the Store. For more information, see [Manage private store settings](manage-private-store-settings.md). | **Settings - Distribute** |
 | Offline licensing  | Configure whether or not to make offline-licensed apps available in the Microsoft Store for Business and Education. For more information, see [Distribute offline apps](distribute-offline-apps.md). | **Settings - Shop** |
 | Allow users to shop  | Configure whether or not people in your organization or school can see and use the shop function in Store for Business or Store for Education. For more information, see [Allow users to shop](acquire-apps-microsoft-store-for-business.md#allow-users-to-shop). | **Settings - Shop** |
-| Make everyone a Basic Purchaser  | Allow everyone in your organization to automatically become a Basic Purchaser. This allows them to purchase apps and manage them. For more information, see [Make everyone a Basic Purchaser](https://docs.microsoft.com/education/windows/education-scenarios-store-for-business#basic-purchaser-role). 
     **Make everyone a Basic Purchaser** is only available in Microsoft Store for Education.  | **Settings - Shop** |
+| Make everyone a Basic Purchaser  | Allow everyone in your organization to automatically become a Basic Purchaser. This allows them to purchase apps and manage them. For more information, see [Make everyone a Basic Purchaser](https://docs.microsoft.com/education/windows/education-scenarios-store-for-business#basic-purchaser-role). | **Settings - Shop** |
 | App request | Configure whether or not people in your organization can request apps for admins to purchase. For more information, see [Distribute offline apps](acquire-apps-microsoft-store-for-business.md). | **Settings - Shop** |
 | Management tools | Management tools that are synced with Azure AD are listed on this page. You can choose one to use for managing app updates and distribution. For more information, see [Configure MDM provider](configure-mdm-provider-microsoft-store-for-business.md). | **Settings - Distribute** |
 | Device Guard signing | Use the Device Guard signing portal to add unsigned apps to a code integrity policy, or to sign code integrity policies. For more information, see [Device Guard signing portal](device-guard-signing-portal.md). | **Settings - Devices**  |
diff --git a/store-for-business/sfb-change-history.md b/store-for-business/sfb-change-history.md
index eb426098c6..5a3a21a49f 100644
--- a/store-for-business/sfb-change-history.md
+++ b/store-for-business/sfb-change-history.md
@@ -9,12 +9,15 @@ author: TrudyHa
 ms.author: TrudyHa
 ms.topic: conceptual
 ms.date: 3/2/2019
+ms.reviewer: 
+manager: dansimp
 ms.localizationpriority: medium
 ---
 
 # Change history for Microsoft Store for Business and Microsoft Store for Education  
 
 ## March 2019
+
 | New or changed topic | Description |
 | --- | --- |
 | [Understand your Microsoft Customer Agreement invoice](billing-understand-your-invoice-msfb.md) | New topic |
@@ -24,12 +27,14 @@ ms.localizationpriority: medium
 | [Roles and permissions in Microsoft Store for Business and Education](roles-and-permissions-microsoft-store-for-business.md) | Add info for purchasing roles and permissions. |
 
 ## April 2018
+
 | New or changed topic | Description |
 | --- | --- |
 | [Configure access to Microsoft Store](https://docs.microsoft.com/windows/configuration/stop-employees-from-using-microsoft-store#a-href-idblock-store-group-policyablock-microsoft-store-using-group-policy) | Update on app updates when Microsoft Store is blocked. |
 | [What's New in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md) | Update |
 
 ## March 2018
+
 | New or changed topic | Description |
 | --- | --- |
 | [Manage software purchased with Microsoft Products and Services agreement in Microsoft Store for Business](manage-mpsa-software-microsoft-store-for-business.md) | New |
@@ -73,6 +78,7 @@ ms.localizationpriority: medium
 | [Microsoft Store for Business and Education overview - supported markets](https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview#supported-markets) | Updates for added market support. |
 
 ## June 2017
+
 | New or changed topic | Description |
 | -------------------- | ----------- |
 | [Notifications in Microsoft Store for Business and Education](notifications-microsoft-store-business.md) | New. Information about notification model in Microsoft Store for Business and Education. |
@@ -80,12 +86,12 @@ ms.localizationpriority: medium
 | [Microsoft Store for Business and Education overview - supported markets](https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview#supported-markets) | Updates for added market support. |
 
 ## July 2017
- 
+
 | New or changed topic | Description |
 | -------------------- | ----------- |
 | [Manage Windows device deployment with Windows Autopilot Deployment](add-profile-to-devices.md) | New. Information about Windows Autopilot Deployment Program and how it is used in Microsoft Store for Business and Education.  |
 | [Microsoft Store for Business and Education overview - supported markets](https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview#supported-markets) | Updates for added market support. |
- 
+
 
 
 
diff --git a/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md b/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md
index f9feb738d7..e0db1ee7c7 100644
--- a/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md
+++ b/store-for-business/sign-code-integrity-policy-with-device-guard-signing.md
@@ -2,6 +2,8 @@
 title: Sign code integrity policy with Device Guard signing (Windows 10)
 description: Signing code integrity policies prevents policies from being tampered with after they're deployed. You can sign code integrity policies with the Device Guard signing portal.
 ms.assetid: 63B56B8B-2A40-44B5-B100-DC50C43D20A9
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -38,4 +40,4 @@ Before you get started, be sure to review these best practices:
 4.  After the files are uploaded, click **Sign** to sign the code integrity policy.
 5.  Click **Download** to download the signed code integrity policy.
 
-    When you sign a code integrity policy with the Device Guard signing portal, the signing certificate is added to the policy. This means you can't modify this policy. If you need to make changes, make them to an unsigned version of the policy, and then resign the policy.
\ No newline at end of file
+    When you sign a code integrity policy with the Device Guard signing portal, the signing certificate is added to the policy. This means you can't modify this policy. If you need to make changes, make them to an unsigned version of the policy, and then resign the policy.
diff --git a/store-for-business/sign-up-microsoft-store-for-business-overview.md b/store-for-business/sign-up-microsoft-store-for-business-overview.md
index 8a9212cf86..68548aeb8b 100644
--- a/store-for-business/sign-up-microsoft-store-for-business-overview.md
+++ b/store-for-business/sign-up-microsoft-store-for-business-overview.md
@@ -2,6 +2,8 @@
 title: Sign up and get started (Windows 10)
 description: IT admins can sign up for the Microsoft Store for Business or Microsoft Store for Education and get started working with apps.
 ms.assetid: 87C6FA60-3AB9-4152-A85C-6A1588A20C7B
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -10,7 +12,7 @@ author: TrudyHa
 ms.author: TrudyHa
 ms.topic: conceptual
 ms.localizationpriority: medium
-ms.date: 10/13/2017
+ms.date: 10/03/2019
 ---
 
 # Sign up and get started
@@ -27,10 +29,10 @@ IT admins can sign up for Microsoft Store for Business and Education, and get st
 | Topic | Description |
 | ----- | ----------- |
 | [Microsoft Store for Business and Education overview](windows-store-for-business-overview.md) | Learn about Microsoft Store for Business. |
-| [Prerequisites for Microsoft Store for Business and Education](prerequisites-windows-store-for-business.md) | There are a few prerequisites for using Microsoft Store for Business and Education. |
-| [Sign up for Microsoft Store for Business or Microsoft Store for Education](sign-up-windows-store-for-business.md) | Before you sign up for Store for Business and Education, at a minimum, you'll need an Azure Active Directory (AD) or Office 365 account for your organization, and you'll need to be the global administrator for your organization. If your organization is already using Azure AD, you can go ahead and sign up for Store for Business. If not, we'll help you create an Azure AD or Office 365 account and directory as part of the sign up process. |
-| [Roles and permissions in Microsoft Store for Business and Education](roles-and-permissions-windows-store-for-business.md) | The first person to sign in to Microsoft Store for Business and Education must be a Global Admin of the Azure Active Directory (AD) tenant. Once the Global Admin has signed in, they can give permissions to others employees. |
-| [Settings reference: Microsoft Store for Business and Education](settings-reference-windows-store-for-business.md) | Microsoft Store for Business and Education has a group of settings that admins use to manage the store. |
+| [Prerequisites for Microsoft Store for Business and Education](https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business) | There are a few prerequisites for using Microsoft Store for Business and Education.](https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business) |
+| [Sign up for Microsoft Store for Business or Microsoft Store for Education](https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business) | Before you sign up for Store for Business and Education, at a minimum, you'll need an Azure Active Directory (AD) or Office 365 account for your organization, and you'll need to be the global administrator for your organization. If your organization is already using Azure AD, you can go ahead and sign up for Store for Business. If not, we'll help you create an Azure AD or Office 365 account and directory as part of the sign up process. |
+| [Roles and permissions in Microsoft Store for Business and Education](https://docs.microsoft.com/microsoft-store/roles-and-permissions-microsoft-store-for-business)| The first person to sign in to Microsoft Store for Business and Education must be a Global Admin of the Azure Active Directory (AD) tenant. Once the Global Admin has signed in, they can give permissions to others employees. |
+| [Settings reference: Microsoft Store for Business and Education](https://docs.microsoft.com/microsoft-store/settings-reference-microsoft-store-for-business) | Microsoft Store for Business and Education has a group of settings that admins use to manage the store. |
 
 
 
diff --git a/store-for-business/sign-up-microsoft-store-for-business.md b/store-for-business/sign-up-microsoft-store-for-business.md
index 7ee9e453ff..42f4df57b1 100644
--- a/store-for-business/sign-up-microsoft-store-for-business.md
+++ b/store-for-business/sign-up-microsoft-store-for-business.md
@@ -2,6 +2,8 @@
 title: Sign up for Microsoft Store for Business or Microsoft Store for Education (Windows 10)
 description: Before you sign up for Microsoft Store for Business or Microsoft Store for Education, at a minimum, you'll need an Azure Active Directory (AD) account for your organization, and you'll need to be the global administrator for your organization.
 ms.assetid: 296AAC02-5C79-4999-B221-4F5F8CEA1F12
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -72,7 +74,7 @@ Before signing up for Microsoft Store, make sure you're the global administrator
 
         Be sure to save the portal sign-in page and your user ID info. Click **You're ready to go**.
 
-        ![Image showing sign-in page and user ID for Microsoft Store for Business. ](images/wsfb-onboard-5.png)
+        ![Image showing sign-in page and user ID for Microsoft Store for Business.](images/wsfb-onboard-5.png)
 
     -   At this point, you'll have an Azure AD directory created with one user account. That user account is the global administrator. You can use that account to sign in to Store for Business.
 
diff --git a/store-for-business/troubleshoot-microsoft-store-for-business.md b/store-for-business/troubleshoot-microsoft-store-for-business.md
index 197eeba1a0..2855e4cd43 100644
--- a/store-for-business/troubleshoot-microsoft-store-for-business.md
+++ b/store-for-business/troubleshoot-microsoft-store-for-business.md
@@ -2,6 +2,8 @@
 title: Troubleshoot Microsoft Store for Business (Windows 10)
 description: Troubleshooting topics for Microsoft Store for Business.
 ms.assetid: 243755A3-9B20-4032-9A77-2207320A242A
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -49,6 +51,10 @@ The private store for your organization is a page in Microsoft Store app that co
 
     ![Private store for Contoso publishing](images/wsfb-privatestoreapps.png)
 
+## Troubleshooting Microsoft Store for Business integration with System Center Configuration Manager
+
+If you encounter any problems when integrating Microsoft Store for Business with Configuration Manager, use the [troubleshooting guide](https://support.microsoft.com/help/4010214/understand-and-troubleshoot-microsoft-store-for-business-integration-w).
+
 ## Still having trouble?
 
 If you are still having trouble using Microsoft Store or installing an app, Admins can sign in and look for topics on our **Support** page.
@@ -56,4 +62,4 @@ If you are still having trouble using Microsoft Store or installing an app, Admi
 **To view Support page** 
 
 1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com)
-2. Click **Manage**, and then click **Support**. 
\ No newline at end of file
+2.Choose **Manage**> **Support**. 
diff --git a/store-for-business/update-microsoft-store-for-business-account-settings.md b/store-for-business/update-microsoft-store-for-business-account-settings.md
index 212b62ecf0..1cb95fa906 100644
--- a/store-for-business/update-microsoft-store-for-business-account-settings.md
+++ b/store-for-business/update-microsoft-store-for-business-account-settings.md
@@ -11,13 +11,15 @@ ms.author: TrudyHa
 ms.topic: conceptual
 ms.localizationpriority: medium
 ms.date: 03/18/2019
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Update Billing account settings
 A billing account contains defining information about your organization. 
 
 >[!NOTE]
->Billing accounts are available in Microsoft Store for Business, and M365 admin center preview. For more infomation, see [aka.ms/aboutM365preview](https://aka.ms/aboutM365preview).
+>Billing accounts are available in Microsoft Store for Business, and M365 admin center preview. For more information, see [aka.ms/aboutM365preview](https://aka.ms/aboutM365preview).
 
 The **Billing account** page allows you to manage organization information, purchasing agreements that you have with Microsoft, and admin approvals. The organization information and payment options are required before you can shop for products that have a price.
 
@@ -92,7 +94,7 @@ If you qualify for tax-exempt status in your market, start a service request to
 
 **To start a service request**
 1.  Sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com).
-2.	Select **Manage**, click **Support**, and then under **Store settings & configuration** select **Create technical support ticket**.
+2. Select **Manage**, click **Support**, and then under **Store settings & configuration** select **Create technical support ticket**.
 
 You’ll need this documentation:
 
@@ -101,7 +103,7 @@ You’ll need this documentation:
 | United States | Sales Tax Exemption Certificate |
 | Canada | Certificate of Exemption (or equivalent letter of authorization) |
 | Ireland | 13B/56A Tax Exemption Certificate|
-| International organizations that hold tax exaemption | Certification / letter confirmation from local tax authorities |
+| International organizations that hold tax exemption | Certification / letter confirmation from local tax authorities |
 
 ### Calculating tax
 
@@ -115,7 +117,7 @@ For example:
    
 ($1.29 X .095) X 100 = $12.25
 
 ## Agreements
-Each billing account inculdes access to the purchasing agreements your organization has signed with Microsoft. This could include:
+Each billing account includes access to the purchasing agreements your organization has signed with Microsoft. This could include:
 - Microsoft Enterprise Agreement
 - Select agreements
 - Open agreements
@@ -137,4 +139,4 @@ Admins can decide whether or not offline licenses are shown for apps in Microsof
 You have the following distribution options for offline-licensed apps:
 - Include the app in a provisioning package, and then use it as part of imaging a device.
 - Distribute the app through a management tool.
-For more information, see [Distribute apps to your employees from Microsoft Store for Business](distribute-apps-with-management-tool.md). -->
\ No newline at end of file
+For more information, see [Distribute apps to your employees from Microsoft Store for Business](distribute-apps-with-management-tool.md). -->
diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md
index 45d4c68486..8d06648a0d 100644
--- a/store-for-business/whats-new-microsoft-store-business-education.md
+++ b/store-for-business/whats-new-microsoft-store-business-education.md
@@ -9,6 +9,8 @@ author: TrudyHa
 ms.author: TrudyHa
 ms.topic: conceptual
 ms.date: 10/31/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # What's new in Microsoft Store for Business and Education
@@ -18,6 +20,7 @@ Microsoft Store for Business and Education regularly releases new and improved f
 ## Latest updates for Store for Business and Education
 
 **October 2018**
+
 |  |  |
 |-----------------------|---------------------------------|
 | ![Security groups](images/security-groups-icon.png) |**Use security groups with Private store apps**

     On the details page for apps in your private store, you can set **Private store availability**. This allows you to choose which security groups can see an app in the private store. 

    [Get more info](https://docs.microsoft.com/microsoft-store/app-inventory-management-microsoft-store-for-business#private-store-availability)

    **Applies to**:
     Microsoft Store for Business 
     Microsoft Store for Education |
@@ -85,4 +88,4 @@ We’ve been working on bug fixes and performance improvements to provide you a
 - Manage prepaid Office 365 subscriptions
 - Manage Office 365 subscriptions acquired by partners
 - Edge extensions in Microsoft Store
-- Search results in Microsoft Store for Business
\ No newline at end of file
+- Search results in Microsoft Store for Business
diff --git a/store-for-business/work-with-partner-microsoft-store-business.md b/store-for-business/work-with-partner-microsoft-store-business.md
index 0f30df6697..e2829a08cb 100644
--- a/store-for-business/work-with-partner-microsoft-store-business.md
+++ b/store-for-business/work-with-partner-microsoft-store-business.md
@@ -10,6 +10,8 @@ author: TrudyHa
 ms.author: TrudyHa
 ms.topic: conceptual
 ms.date: 10/12/2018
+ms.reviewer: 
+manager: dansimp
 ---
 
 # Working with solution providers in Microsoft Store for Business
@@ -36,7 +38,7 @@ There are several ways that a solution provider can work with you. Solution prov
 | OEM PC partner | Solution providers can upload device IDs for PCs that you're [managing with Autopilot](https://docs.microsoft.com/microsoft-store/add-profile-to-devices).   |
 | Line-of-business (LOB) partner | Solution providers can develop, submit, and manage LOB apps specific for your organization or school. |
 
-##  Find a solution provider
+## Find a solution provider
 
 You can find partner in Microsoft Store for Business and Education. 
 
diff --git a/store-for-business/working-with-line-of-business-apps.md b/store-for-business/working-with-line-of-business-apps.md
index 36b1eedf64..3085320530 100644
--- a/store-for-business/working-with-line-of-business-apps.md
+++ b/store-for-business/working-with-line-of-business-apps.md
@@ -2,6 +2,8 @@
 title: Working with line-of-business apps (Windows 10)
 description: Your company or school can make line-of-business (LOB) applications available through Microsoft Store for Business or Microsoft Store for Education. These apps are custom to your organization – they might be internal business apps, or apps specific to your school, business, or industry.
 ms.assetid: 95EB7085-335A-447B-84BA-39C26AEB5AC7
+ms.reviewer: 
+manager: dansimp
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
@@ -48,12 +50,12 @@ Admins need to invite developer or ISVs to become an LOB publisher.
 
 **To invite a developer to become an LOB publisher**
 
-1.  Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com).
-2.  Click **Manage**, click **Permissions**, and then choose **Line-of-business publishers**.
-3.  On the Line-of business publishers page, click **Invite** to send an email invitation to a developer.
+1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com).
+2. Click **Manage**, click **Permissions**, and then choose **Line-of-business publishers**.
+3. On the Line-of business publishers page, click **Invite** to send an email invitation to a developer.
  
- >[!Note]
- > This needs to be the email address listed in contact info for the developer account.
+   >[!Note]
+   > This needs to be the email address listed in contact info for the developer account.
   
 ## Submit apps (LOB publisher)
 
@@ -100,4 +102,4 @@ After you add the app to your inventory, you can choose how to distribute the ap
 -   [Distribute apps to your employees from the Microsoft Store for Business](distribute-apps-to-your-employees-microsoft-store-for-business.md)
 -   [Distribute apps from your private store](distribute-apps-from-your-private-store.md)
 -   [Assign apps to employees](assign-apps-to-employees.md)
--   [Distribute offline apps](distribute-offline-apps.md)
\ No newline at end of file
+-   [Distribute offline apps](distribute-offline-apps.md)
diff --git a/windows/access-protection/docfx.json b/windows/access-protection/docfx.json
index f27666d0fd..9df4554e37 100644
--- a/windows/access-protection/docfx.json
+++ b/windows/access-protection/docfx.json
@@ -20,7 +20,7 @@
         "files": [
           "**/*.png",
           "**/*.jpg",
-		  "**/*.gif"
+          "**/*.gif"
         ],
         "exclude": [
           "**/obj/**",
@@ -31,19 +31,20 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
-		"uhfHeaderId": "MSDocsHeader-WindowsIT", 
-		"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
-		"ms.technology": "windows",
-		"ms.topic": "article",
-		"ms.author": "justinha",
-		"_op_documentIdPathDepotMapping": {
-			"./": {
-			  "depot_name": "MSDN.win-access-protection"
-			}
-		}
-	},
+      "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
+      "ms.technology": "windows",
+      "audience": "ITPro",
+      "ms.topic": "article",
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "MSDN.win-access-protection",
+          "folder_relative_path_in_docset": "./"
+        }
+      }
+    },
     "fileMetadata": {},
     "template": [],
-    "dest": "win-access-protection"
+    "dest": "win-access-protection",
+    "markdownEngineName": "markdig"
   }
-}
\ No newline at end of file
+}
diff --git a/windows/access-protection/index.md b/windows/access-protection/index.md
deleted file mode 100644
index 6f99c4db34..0000000000
--- a/windows/access-protection/index.md
+++ /dev/null
@@ -1,3 +0,0 @@
----
-redirect_url: https://docs.microsoft.com/windows/security/identity-protection/
----
\ No newline at end of file
diff --git a/windows/application-management/TOC.md b/windows/application-management/TOC.md
index 110f01c7b0..0bd3d8166a 100644
--- a/windows/application-management/TOC.md
+++ b/windows/application-management/TOC.md
@@ -37,7 +37,7 @@
 ##### [How to Deploy the App-V Databases by Using SQL Scripts](app-v/appv-deploy-appv-databases-with-sql-scripts.md)
 ##### [How to Install the Publishing Server on a Remote Computer](app-v/appv-install-the-publishing-server-on-a-remote-computer.md)
 ##### [How to Install the Management and Reporting Databases on Separate Computers from the Management and Reporting Services](app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md)
-##### [How to install the Management Server on a Standalone Computer and Connect it to the Database ](app-v/appv-install-the-management-server-on-a-standalone-computer.md)
+##### [How to install the Management Server on a Standalone Computer and Connect it to the Database](app-v/appv-install-the-management-server-on-a-standalone-computer.md)
 ##### [About App-V Reporting](app-v/appv-reporting.md)
 ##### [How to install the Reporting Server on a Standalone Computer and Connect it to the Database](app-v/appv-install-the-reporting-server-on-a-standalone-computer.md)
 #### [App-V Deployment Checklist](app-v/appv-deployment-checklist.md)
@@ -56,17 +56,17 @@
 ##### [How to Create a Virtual Application Package Using an App-V Package Accelerator](app-v/appv-create-a-virtual-application-package-package-accelerator.md)
 #### [Administering App-V Virtual Applications by Using the Management Console](app-v/appv-administering-virtual-applications-with-the-management-console.md)
 ##### [About App-V Dynamic Configuration](app-v/appv-dynamic-configuration.md)
-##### [How to Connect to the Management Console ](app-v/appv-connect-to-the-management-console.md)
+##### [How to Connect to the Management Console](app-v/appv-connect-to-the-management-console.md)
 ##### [How to Add or Upgrade Packages by Using the Management Console](app-v/appv-add-or-upgrade-packages-with-the-management-console.md)
-##### [How to Configure Access to Packages by Using the Management Console ](app-v/appv-configure-access-to-packages-with-the-management-console.md)
-##### [How to Publish a Package by Using the Management Console ](app-v/appv-publish-a-packages-with-the-management-console.md)
-##### [How to Delete a Package in the Management Console ](app-v/appv-delete-a-package-with-the-management-console.md)
+##### [How to Configure Access to Packages by Using the Management Console](app-v/appv-configure-access-to-packages-with-the-management-console.md)
+##### [How to Publish a Package by Using the Management Console](app-v/appv-publish-a-packages-with-the-management-console.md)
+##### [How to Delete a Package in the Management Console](app-v/appv-delete-a-package-with-the-management-console.md)
 ##### [How to Add or Remove an Administrator by Using the Management Console](app-v/appv-add-or-remove-an-administrator-with-the-management-console.md)
 ##### [How to Register and Unregister a Publishing Server by Using the Management Console](app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md)
 ##### [How to Create a Custom Configuration File by Using the App-V Management Console](app-v/appv-create-a-custom-configuration-file-with-the-management-console.md)
 ##### [How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console](app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md)
 ##### [How to Customize Virtual Applications Extensions for a Specific AD Group by Using the Management Console](app-v/appv-customize-virtual-application-extensions-with-the-management-console.md)
-##### [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console ](app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md)
+##### [How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console](app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md)
 #### [Managing Connection Groups](app-v/appv-managing-connection-groups.md)
 ##### [About the Connection Group Virtual Environment](app-v/appv-connection-group-virtual-environment.md)
 ##### [About the Connection Group File](app-v/appv-connection-group-file.md)
@@ -86,14 +86,14 @@
 #### [Maintaining App-V](app-v/appv-maintaining-appv.md)
 ##### [How to Move the App-V Server to Another Computer](app-v/appv-move-the-appv-server-to-another-computer.md)
 #### [Administering App-V by Using Windows PowerShell](app-v/appv-administering-appv-with-powershell.md)
-##### [How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help ](app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md)
+##### [How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help](app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md)
 ##### [How to Manage App-V Packages Running on a Stand-Alone Computer by Using Windows PowerShell](app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md)
 ##### [How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell](app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md)
 ##### [How to Modify Client Configuration by Using Windows PowerShell](app-v/appv-modify-client-configuration-with-powershell.md)
 ##### [How to Configure the Client to Receive Package and Connection Groups Updates From the Publishing Server](app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md)
 ##### [How to Apply the User Configuration File by Using Windows PowerShell](app-v/appv-apply-the-user-configuration-file-with-powershell.md)
 ##### [How to Apply the Deployment Configuration File by Using Windows PowerShell](app-v/appv-apply-the-deployment-configuration-file-with-powershell.md)
-##### [How to Sequence a Package  by Using Windows PowerShell ](app-v/appv-sequence-a-package-with-powershell.md)
+##### [How to Sequence a Package  by Using Windows PowerShell](app-v/appv-sequence-a-package-with-powershell.md)
 ##### [How to Create a Package Accelerator by Using Windows PowerShell](app-v/appv-create-a-package-accelerator-with-powershell.md)
 ##### [How to Enable Reporting on the App-V Client by Using Windows PowerShell](app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md)
 ##### [How to Install the App-V Databases and Convert the Associated Security Identifiers  by Using Windows PowerShell](app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md)
diff --git a/windows/application-management/add-apps-and-features.md b/windows/application-management/add-apps-and-features.md
index 9f0e645ab1..81f0da756e 100644
--- a/windows/application-management/add-apps-and-features.md
+++ b/windows/application-management/add-apps-and-features.md
@@ -5,10 +5,12 @@ ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: article
-ms.author: elizapo
-author: lizap
+ms.author: dansimp
+author: msfttracyp
 ms.localizationpriority: medium
 ms.date: 04/26/2018
+ms.reviewer: 
+manager: dansimp
 ms.topic: article
 ---
 # How to add apps and features to Windows 10
@@ -25,4 +27,4 @@ Here's how you do that:
 
 And that's it. You can see the apps you have installed on the **Apps & features** page and the features on **Manage optional features**.
 
-You can manage and uninstall apps and features from the same Settings page. Just select the app or feature, and then select **Uninstall**.
\ No newline at end of file
+You can manage and uninstall apps and features from the same Settings page. Just select the app or feature, and then select **Uninstall**.
diff --git a/windows/application-management/app-v/appv-about-appv.md b/windows/application-management/app-v/appv-about-appv.md
index ed9e7d1801..910454c958 100644
--- a/windows/application-management/app-v/appv-about-appv.md
+++ b/windows/application-management/app-v/appv-about-appv.md
@@ -1,12 +1,15 @@
 ---
 title: What's new in App-V for Windows 10, version 1703 and earlier (Windows 10)
 description: Information about what's new in App-V for Windows 10, version 1703 and earlier. 
-author: jdeckerms
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/08/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # What's new in App-V for Windows 10, version 1703 and earlier
@@ -39,7 +42,7 @@ Previous versions of App-V have required you to manually remove your unpublished
 
 ### App-V is now a feature in Windows 10
 
-With Windows 10, version 1607 and later releases, App-V is now included with [Windows 10 for Enterprise and Windows 10 for Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack.
+With Windows 10, version 1607 and later releases, App-V is now included with [Windows 10 for Enterprise and Windows 10 for Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home) and is no longer part of the Microsoft Desktop Optimization Pack.
 
 To learn more about earlier versions of App-V, see [MDOP Information Experience](https://docs.microsoft.com/microsoft-desktop-optimization-pack/index).
 
@@ -48,8 +51,8 @@ The changes in App-V for Windows 10, version 1607 impact existing implementation
 * The App-V client is installed on user devices automatically with Windows 10, version 1607, and no longer has to be deployed separately. Performing an in-place upgrade to Windows 10, version 1607, on user devices automatically installs the App-V client.
 * In previous releases of App-V, the application sequencer was included in the Microsoft Desktop Optimization Pack. Although you’ll need to use the new application sequencer to create new virtualized applications, existing virtualized applications will continue to work. The App-V application sequencer is available from the [Windows 10 Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit).
 
- >[!NOTE]
- >If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release.
+ > [!NOTE]
+  >If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release.
 
 For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](../app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md) and [Migrating to App-V for Windows 10 from a previous version](../app-v/appv-migrating-to-appv-from-a-previous-version.md).
 
@@ -67,4 +70,4 @@ App-V supports System Center 2016 and System Center 2012 R2 Configuration Manage
 ## Related topics
 
 * [Release Notes for App-V for Windows 10, version 1607](../app-v/appv-release-notes-for-appv-for-windows.md)
-* [Release Notes for App-V for Windows 10, version 1703](../app-v/appv-release-notes-for-appv-for-windows-1703.md)
\ No newline at end of file
+* [Release Notes for App-V for Windows 10, version 1703](../app-v/appv-release-notes-for-appv-for-windows-1703.md)
diff --git a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md
index dc50a4c884..1ef657304d 100644
--- a/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md
+++ b/windows/application-management/app-v/appv-add-or-remove-an-administrator-with-the-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Add or Remove an Administrator by Using the Management Console (Windows 10)
 description: How to add or remove an administrator by using the Management Console
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/08/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to add or remove an administrator by using the Management Console
diff --git a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md
index 65e751d061..ce050e817b 100644
--- a/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md
+++ b/windows/application-management/app-v/appv-add-or-upgrade-packages-with-the-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Add or Upgrade Packages by Using the Management Console (Windows 10)
 description: How to add or upgrade packages by using the Management Console
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/08/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to add or upgrade packages by using the Management Console
diff --git a/windows/application-management/app-v/appv-administering-appv-with-powershell.md b/windows/application-management/app-v/appv-administering-appv-with-powershell.md
index e56d2e0b3a..ea02c9ad1f 100644
--- a/windows/application-management/app-v/appv-administering-appv-with-powershell.md
+++ b/windows/application-management/app-v/appv-administering-appv-with-powershell.md
@@ -1,12 +1,15 @@
 ---
 title: Administering App-V by using Windows PowerShell (Windows 10)
 description: Administering App-V by Using Windows PowerShell
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/08/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Administering App-V by using Windows PowerShell
@@ -51,4 +54,4 @@ The following table describes Windows PowerShell error handling for App-V.
 
 ## Related topics
 
-* [Operations for App-V](appv-operations.md)
\ No newline at end of file
+* [Operations for App-V](appv-operations.md)
diff --git a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md
index 496cc0b738..82f1d28429 100644
--- a/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md
+++ b/windows/application-management/app-v/appv-administering-virtual-applications-with-the-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: Administering App-V Virtual Applications by using the Management Console (Windows 10)
 description: Administering App-V Virtual Applications by using the Management Console
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/08/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Administering App-V Virtual Applications by using the Management Console
@@ -58,4 +61,4 @@ The main elements of the App-V Management Console are:
 ## Other resources for this App-V deployment
 
 - [Application Virtualization (App-V) overview](appv-for-windows.md)
-- [Operations for App-V](appv-operations.md)
\ No newline at end of file
+- [Operations for App-V](appv-operations.md)
diff --git a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md
index cee9f0a966..55dcc71e05 100644
--- a/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md
+++ b/windows/application-management/app-v/appv-allow-administrators-to-enable-connection-groups.md
@@ -1,12 +1,15 @@
 ---
-title: How to Allow Only Administrators to Enable Connection Groups (Windows 10)
+title: Only Allow Admins to Enable Connection Groups (Windows 10)
 description: How to Allow Only Administrators to Enable Connection Groups
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/08/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to allow only administrators to enable connection groups
diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md
index 54a2eb8da6..a913ce8a38 100644
--- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md
+++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md
@@ -1,12 +1,15 @@
 ---
 title: Application Publishing and Client Interaction (Windows 10)
 description: Application publishing and client interaction.
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/08/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Application publishing and client interaction
@@ -343,7 +346,7 @@ This process will recreate both the local and network locations for AppData and
 
 In an App-V Full Infrastructure, after applications are sequenced they are managed and published to users or computers through the App-V Management and Publishing servers. This section details the operations that occur during the common App-V application lifecycle operations (Add, publishing, launch, upgrade, and removal) and the file and registry locations that are changed and modified from the App-V Client perspective. The App-V Client operations are input as PowerShell commands on the computer running the App-V Client.
 
-This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012, see [Integrating Virtual Application Management with App-V 5 and Configuration Manager 2012 SP1](https://www.microsoft.com/en-us/download/details.aspx?id=38177).
+This document focuses on App-V Full Infrastructure solutions. For specific information on App-V Integration with Configuration Manager 2012, see [Integrating Virtual Application Management with App-V 5 and Configuration Manager 2012 SP1](https://www.microsoft.com/download/details.aspx?id=38177).
 
 The App-V application lifecycle tasks are triggered at user sign in (default), machine startup, or as background timed operations. The settings for the App-V Client operations, including Publishing Servers, refresh intervals, package script enablement, and others, are configured (after the client is enabled) with Windows PowerShell commands. See [App-V Client Configuration Settings: Windows PowerShell](appv-client-configuration-settings.md#app-v-client-configuration-settings-windows-powershell).
 
@@ -376,46 +379,46 @@ The process then configures the client for package or connection group additions
 
 3. Configure the packages by identifying the **Add** or **Update** operations.
 
-    1. The App-V Client utilizes the AppX API from Windows and accesses the appv file from the publishing server.
+   1. The App-V Client utilizes the AppX API from Windows and accesses the appv file from the publishing server.
 
-    2. The package file is opened and the **AppXManifest.xml** and **StreamMap.xml** files are downloaded to the Package Store.
+   2. The package file is opened and the **AppXManifest.xml** and **StreamMap.xml** files are downloaded to the Package Store.
 
-    3. Completely stream publishing block data defined in the **StreamMap.xml** file. Publishing block data is stored in Package Store\\PkgGUID\\VerGUID\\Root.
+   3. Completely stream publishing block data defined in the **StreamMap.xml** file. Publishing block data is stored in Package Store\\PkgGUID\\VerGUID\\Root.
 
-        - Icons: Targets of extension points.
-        - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, accessed directly or through file types.
-        - Scripts: Download scripts directory for use throughout the publishing process.
+       - Icons: Targets of extension points.
+       - Portable Executable Headers (PE Headers): Targets of extension points that contain the base information about the image need on disk, accessed directly or through file types.
+       - Scripts: Download scripts directory for use throughout the publishing process.
 
-    4. Populate the Package store by doing the following:
+   4. Populate the Package store by doing the following:
 
-        1. Create sparse files on disk that represent the extracted package for any directories listed.
+      1. Create sparse files on disk that represent the extracted package for any directories listed.
 
-        2. Stage top-level files and directories under root.
+      2. Stage top-level files and directories under root.
 
-        All other files are created when the directory is listed as sparse on disk and streamed on demand.
+         All other files are created when the directory is listed as sparse on disk and streamed on demand.
 
-    5. Create the machine catalog entries. Create the **Manifest.xml** and **DeploymentConfiguration.xml** files from the package files (if no **DeploymentConfiguration.xml** file in the package a placeholder is created).
+   5. Create the machine catalog entries. Create the **Manifest.xml** and **DeploymentConfiguration.xml** files from the package files (if no **DeploymentConfiguration.xml** file in the package a placeholder is created).
 
-    6. Create location of the package store in the registry **HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog**.
+   6. Create location of the package store in the registry **HKLM\\Software\\Microsoft\\AppV\\Client\\Packages\\PkgGUID\\Versions\\VerGUID\\Catalog**.
 
-    7. Create the **Registry.dat** file from the package store to **%ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat**.
+   7. Create the **Registry.dat** file from the package store to **%ProgramData%\\Microsoft\\AppV\\Client\\VReg\\{VersionGUID}.dat**.
 
-    8. Register the package with the App-V Kernel Mode Driver at **HKLM\\Microsoft\\Software\\AppV\\MAV**.
+   8. Register the package with the App-V Kernel Mode Driver at **HKLM\\Microsoft\\Software\\AppV\\MAV**.
 
-    9. Invoke scripting from the **AppxManifest.xml** or **DeploymentConfig.xml** file for Package Add timing.
+   9. Invoke scripting from the **AppxManifest.xml** or **DeploymentConfig.xml** file for Package Add timing.
 
 4. Configure Connection Groups by adding and enabling or disabling.
 
 5. Remove objects that are not published to the target (user or machine).
 
-    >[!NOTE]
+   > [!NOTE]
     >This will not perform a package deletion but rather remove integration points for the specific target (user or machine) and remove user catalog files (machine catalog files for globally published).
 
 6. Invoke background load mounting based on client configuration.
 
 7. Packages that already have publishing information for the machine or user are immediately restored.
 
-    >[!NOTE]
+   > [!NOTE]
     >This condition occurs as a product of removal without unpublishing with background addition of the package.
 
 This completes an App-V package add for the publishing refresh process. The next step is publishing the package to a specific target (machine or user).
@@ -444,7 +447,7 @@ During the Publishing Refresh operation, the specific publishing operation, **Pu
 
     2. Store backup information in the user’s registry and roaming profile (Shortcut Backups).
 
-        >[!NOTE]
+       > [!NOTE]
         >This enables restore extension points if the package is unpublished.
 
     3. Run scripts targeted for publishing timing.
@@ -796,7 +799,7 @@ App-V packages contain the Manifest file inside of the App-V Package file, which
 
 ### Examples of dynamic configuration files
 
-The following example shows the combination of the Manifest, Deployment Configuration, and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only, not to be a complete description of the specific categories available in each file. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760).
+The following example shows the combination of the Manifest, Deployment Configuration, and User Configuration files after publishing and during normal operation. These examples are abbreviated examples of each of the files. The purpose is show the combination of the files only, not to be a complete description of the specific categories available in each file. For more information, download the [App-V Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760).
 
 #### Manifest
 
@@ -844,12 +847,12 @@ The following example shows the combination of the Manifest, Deployment Configur
      
           [{Desktop}]\7-Zip\7-Zip File Manager.lnk
           [{AppVPackageRoot}]\7zFM.exe
-          [{AppVPackageRoot}]\7zFM.exe.O.ico
+          [{AppVPackageRoot}]\7zFM.exe.O.ico
      
      
           [{Common Programs}]\7-Zip\7-Zip File Manager.Ink
           [{AppVPackageRoot}]\7zFM.exe
-          [{AppVPackageRoot)]\7zFM.exe.O.ico
+          [{AppVPackageRoot)]\7zFM.exe.O.ico
      
 
      
diff --git a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md
index 457b84aa95..5ba6786e15 100644
--- a/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md
+++ b/windows/application-management/app-v/appv-apply-the-deployment-configuration-file-with-powershell.md
@@ -1,12 +1,15 @@
 ---
-title: How to apply the deployment configuration file by using Windows PowerShell (Windows 10)
+title: Apply deployment config file via Windows PowerShell (Windows 10)
 description: How to apply the deployment configuration file by using Windows PowerShell for Windows 10.
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/15/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to apply the deployment configuration file by using Windows PowerShell
@@ -17,13 +20,13 @@ When you add or set a package to a computer running the App-V client before it's
 
 ## Apply the deployment configuration file with Windows PowerShell
 
->[!NOTE]
->The following example cmdlet uses the following two file paths for the package and configuration files:
-    >
-    >* C:\\Packages\\Contoso\\MyApp.appv
-    >* C:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml
-    >
->If your package and configuration files use different file paths than the example, feel free to replace them as needed.
+> [!NOTE]
+> The following example cmdlet uses the following two file paths for the package and configuration files:
+> 
+> * C:\\Packages\\Contoso\\MyApp.appv
+> * C:\\Packages\\Contoso\\DynamicConfigurations\\deploymentconfig.xml
+> 
+> If your package and configuration files use different file paths than the example, feel free to replace them as needed.
 
 To specify a new default set of configurations for all users who will run the package on a specific computer, in a Windows PowerShell console, enter the following cmdlet:
 
diff --git a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md
index 8b1e2d8168..e3abc3524a 100644
--- a/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md
+++ b/windows/application-management/app-v/appv-apply-the-user-configuration-file-with-powershell.md
@@ -1,12 +1,15 @@
 ---
 title: How to apply the user configuration file by using Windows PowerShell (Windows 10)
 description: How to apply the user configuration file by using Windows PowerShell (Windows 10).
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/15/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to apply the user configuration file by using Windows PowerShell
@@ -19,12 +22,12 @@ When you publish a package to a specific user, you'll also need to specify a dyn
 
 Here's how to specify a user-specific configuration file:
 
->[!NOTE]
->The following example cmdlets use this example file path for its package:
-    >
-    >* C:\\Packages\\Contoso\\MyApp.appv.
-    >
->If your package file uses a different file path than the example, feel free to replace it as needed.
+> [!NOTE]
+> The following example cmdlets use this example file path for its package:
+> 
+> * C:\\Packages\\Contoso\\MyApp.appv.
+> 
+> If your package file uses a different file path than the example, feel free to replace it as needed.
 
 1. Enter the following cmdlet in Windows PowerShell to add the package to the computer:
 
diff --git a/windows/application-management/app-v/appv-auto-batch-sequencing.md b/windows/application-management/app-v/appv-auto-batch-sequencing.md
index d40b868aa0..67f5ad1826 100644
--- a/windows/application-management/app-v/appv-auto-batch-sequencing.md
+++ b/windows/application-management/app-v/appv-auto-batch-sequencing.md
@@ -1,12 +1,15 @@
 ---
 title: Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10)
 description: How to automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer).
-author: jdeckerms
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Automatically sequence multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)
diff --git a/windows/application-management/app-v/appv-auto-batch-updating.md b/windows/application-management/app-v/appv-auto-batch-updating.md
index 6a74d97208..4a8dd9f493 100644
--- a/windows/application-management/app-v/appv-auto-batch-updating.md
+++ b/windows/application-management/app-v/appv-auto-batch-updating.md
@@ -1,12 +1,15 @@
 ---
 title: Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10)
 description: How to automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer).
-author: jdeckerms
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Automatically update multiple apps at the same time using Microsoft Application Virtualization Sequencer (App-V Sequencer)
diff --git a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md
index acf707a514..3acd5f85db 100644
--- a/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md
+++ b/windows/application-management/app-v/appv-auto-clean-unpublished-packages.md
@@ -1,12 +1,15 @@
 ---
-title: Automatically clean up unpublished packages on the App-V client (Windows 10)
+title: Auto-remove unpublished packages on App-V client (Windows 10)
 description: How to automatically clean up any unpublished packages on your App-V client devices.
-author: jdeckerms
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/15/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Automatically clean up unpublished packages on the App-V client
@@ -59,5 +62,5 @@ Using Group Policy, you can turn on the **Enable automatic cleanup of unused App
 ## Related topics
 
 - [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit)
-- [Download the Microsoft Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/en-us/download/details.aspx?id=41186)
-- [Using the App-V Client Management Console](appv-using-the-client-management-console.md)
\ No newline at end of file
+- [Download the Microsoft Application Virtualization 5.0 Client UI Application](https://www.microsoft.com/download/details.aspx?id=41186)
+- [Using the App-V Client Management Console](appv-using-the-client-management-console.md)
diff --git a/windows/application-management/app-v/appv-auto-provision-a-vm.md b/windows/application-management/app-v/appv-auto-provision-a-vm.md
index 53a38b3f05..ddb1c30871 100644
--- a/windows/application-management/app-v/appv-auto-provision-a-vm.md
+++ b/windows/application-management/app-v/appv-auto-provision-a-vm.md
@@ -1,12 +1,15 @@
 ---
 title: Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10)
 description: How to automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer) PowerShell cmdlet or the user interface.
-author: jdeckerms
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)
@@ -95,12 +98,12 @@ If your apps require custom prerequisites, such as Microsoft SQL Server, we reco
 2. Open PowerShell as an admin and run the **Connect-AppvSequencerVM** cmdlet, using the following parameters:
 
     ```ps1
-    Connect-AppvSequencerVM -VMName "" -ADKPath ""
+    Connect-AppvSequencerVM -VMName ""
     ```
     
     Where `````` is the name of the VM as shown in the Hyper-V Manager tool.
 
-This command creates a new Hyper-V VM file using the provided VHD file and also creates a "clean" checkpoint, from where all sequencing and updating will start.
+This command connects to an existing Hyper-V VM using the provided VM name for auto-sequencing.
 
 ### Review the provisioning log files
 
diff --git a/windows/application-management/app-v/appv-available-mdm-settings.md b/windows/application-management/app-v/appv-available-mdm-settings.md
index 3429a4b616..6bb52f7eb3 100644
--- a/windows/application-management/app-v/appv-available-mdm-settings.md
+++ b/windows/application-management/app-v/appv-available-mdm-settings.md
@@ -1,12 +1,15 @@
 ---
 title: Available Mobile Device Management (MDM) settings for App-V (Windows 10)
 description: A list of the available MDM settings for App-V on Windows 10.
-author: jdeckerms
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/15/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Available Mobile Device Management (MDM) settings for App-V
@@ -29,4 +32,4 @@ With Windows 10, version 1703, you can configure, deploy, and manage your App-V
 |SyncStatusDescription|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncStatusDescription|String|- **0**: App-V publishing is idle.
    - **1**: App-V connection groups publish in progress.
    - **2**: App-V packages (non-connection group) publish in progress.
    - **3**: App-V packages (connection group) publish in progress.
    - **4**: App-V packages unpublish in progress.|
 |SyncProgress|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/ AppVPublishing/LastSync/SyncProgress|String|- **0**: App-V Sync is idle.
    - **1**: App-V Sync is initializing.
    - **2**: App-V Sync is in progress.
    - **3**: App-V Sync is complete.
    - **4**: App-V Sync requires device reboot.|
 |PublishXML|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/
    AppVPublishing/Sync/PublishXML|String|Custom value, entered by admin.|
-|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/
    AppVDynamicPolicy/configurationid/Policy|String|Custom value, entered by admin.|
\ No newline at end of file
+|Policy|Windows 10, version 1703|./Vendor/MSFT/EnterpriseAppVManagement/
    AppVDynamicPolicy/configurationid/Policy|String|Custom value, entered by admin.|
diff --git a/windows/application-management/app-v/appv-capacity-planning.md b/windows/application-management/app-v/appv-capacity-planning.md
index 250809b68c..099bcdf1c4 100644
--- a/windows/application-management/app-v/appv-capacity-planning.md
+++ b/windows/application-management/app-v/appv-capacity-planning.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Capacity Planning (Windows 10)
 description: App-V Capacity Planning
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # App-V Capacity Planning
@@ -123,11 +126,11 @@ Example: Random delay for 500 clients with 120 requests per second is *4 × 500/
 
 Computers running the App-V client connect to the App-V publishing server to send a publishing refresh request and receive a response. Round trip response time is measured on the computer running the App-V client, while processor time is measured on the publishing server. For more information about App-V Publishing Server supported configurations, see [App-V supported configurations](appv-supported-configurations.md).
 
->[!IMPORTANT]
->The following list displays the main factors to consider when setting up the App-V publishing server:
-  * The number of clients connecting simultaneously to a single publishing server.
-  * The number of packages in each refresh.
-  * The available network bandwidth in your environment between the client and the App-V publishing server.
+> [!IMPORTANT]
+> The following list displays the main factors to consider when setting up the App-V publishing server:
+> * The number of clients connecting simultaneously to a single publishing server.
+> * The number of packages in each refresh.
+> * The available network bandwidth in your environment between the client and the App-V publishing server.
 
 |Scenario|Summary|
 |---|---|
@@ -148,11 +151,11 @@ Computers running the App-V client connect to the App-V publishing server to sen
 
 Computers running the App-V client stream the virtual application package from the streaming server. Round trip response time is measured on the computer running the App-V client, and is the time taken to stream the entire package.
 
->[!IMPORTANT]
->The following list identifies the main factors to consider when setting up the App-V streaming server:
-  * The number of clients streaming application packages simultaneously from a single streaming server.
-  * The size of the package being streamed.
-  * The available network bandwidth in your environment between the client and the streaming server.
+> [!IMPORTANT]
+> The following list identifies the main factors to consider when setting up the App-V streaming server:
+> * The number of clients streaming application packages simultaneously from a single streaming server.
+> * The size of the package being streamed.
+> * The available network bandwidth in your environment between the client and the streaming server.
 
 |Scenario|Summary|
 |---|---|
@@ -193,4 +196,4 @@ Although there are many fault-tolerance strategies and technologies you can use,
 
 * [App-V supported configurations](appv-supported-configurations.md)
 * [Planning for high availability with App-V](appv-planning-for-high-availability-with-appv.md)
-* [Planning to deploy App-V](appv-planning-to-deploy-appv.md)
\ No newline at end of file
+* [Planning to deploy App-V](appv-planning-to-deploy-appv.md)
diff --git a/windows/application-management/app-v/appv-client-configuration-settings.md b/windows/application-management/app-v/appv-client-configuration-settings.md
index 983ad32d49..693a058d7e 100644
--- a/windows/application-management/app-v/appv-client-configuration-settings.md
+++ b/windows/application-management/app-v/appv-client-configuration-settings.md
@@ -1,12 +1,15 @@
----
+---
 title: About Client Configuration Settings (Windows 10)
 description: About Client Configuration Settings
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # About Client Configuration Settings
@@ -21,94 +24,92 @@ You can use Group Policy to configure App-V client settings by navigating to the
 
 The following table provides information about App-V client configuration settings that can be configured through Windows PowerShell cmdlets:
 
-| Windows PowerShell cmdlet or cmdlets,
    **Option**
    Type  | Description  | Disabled policy state keys and values |
-|------------|------------|------------|------------|
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-PackageInstallationRoot**
    String  | Specifies directory where all new applications and updates will be installed.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-PackageSourceRoot**
    String  | Overrides source location for downloading package content.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-AllowHighCostLaunch**
    True (enabled); False (Disabled state)  | This setting controls whether virtualized applications are launched on Windows 10 machines connected by a metered network connection (for example, 4G).  | 0 |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReestablishmentRetries**
    Integer (0–99)  | Specifies the number of times to retry a dropped session.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReestablishmentInterval**
    Integer (0–3600)  | Specifies the number of seconds between attempts to reestablish a dropped session.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-LocationProvider**
    String  | Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-CertFilterForClientSsl**
    String  | Specifies the path to a valid certificate in the certificate store.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-VerifyCertificateRevocationList**
    True (enabled); False (Disabled state)  | Verifies Server certificate revocation status before streaming with HTTPS.  | 0 |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-SharedContentStoreMode**
    True (enabled); False (Disabled state)  | Specifies that streamed package contents will be not be saved to the local hard disk.  | 0 |
-| Set-AppvPublishingServer

    **-Name**
    String  | Displays the name of publishing server.  | Policy value not written (same as Not Configured) |
-| Set-AppvPublishingServer

    **-URL**
    String  | Displays the URL of publishing server.  | Policy value not written (same as Not Configured) |
-| Set-AppvPublishingServer

    **-GlobalRefreshEnabled**
    True (enabled); False (Disabled state)  | Enables global publishing refresh (Boolean)  | False |
-| Set-AppvPublishingServer

    **-GlobalRefreshOnLogon**
    True (enabled); False (Disabled state)  | Triggers a global publishing refresh on sign in. (Boolean)  | False |
-| Set-AppvPublishingServer

    **-GlobalRefreshInterval**
    Integer (0–744)  | Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, specify 0.  | 0 |
-| Set-AppvPublishingServer

    **-GlobalRefreshIntervalUnit** 
    0 for hour, 1 for day  | Specifies the interval unit (Hour 0–23, Day 0–31).  | 1 |
-| Set-AppvPublishingServer

    **-UserRefreshEnabled**
    True (enabled); False (Disabled state)  | Enables user publishing refresh (Boolean)  | False |
-| Set-AppvPublishingServer

    **-UserRefreshOnLogon**
    True (enabled); False (Disabled state)  | Triggers a user publishing refresh on sign in. (Boolean) Word count (with spaces): 60  | False |
-| Set-AppvPublishingServer

    **-UserRefreshInterval**
    Word count (with spaces): 85
    Integer (0–744 Hours)  | Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0.  | 0 |
-| Set-AppvPublishingServer

    **-UserRefreshIntervalUnit**
    0 for hour, 1 for day  | Specifies the interval unit (Hour 0–23, Day 0–31).  | 1 |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-MigrationMode**
    True (enabled state); False (Disabled state)  | Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created by a previous version of App-V.  | |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-EnablePackageScripts**
    True (enabled); False (Disabled state)  | Enables scripts defined in the package manifest of configuration files that should run.  | |
-| Set-AppvClientConfiguration

    **-RoamingFileExclusions**
    String  | Specifies the file paths relative to %userprofile% that do not roam with a user's profile. For example, ```/ROAMINGFILEEXCLUSIONS='desktop;my pictures'```  | |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-RoamingRegistryExclusions**
    String  | Specifies the registry paths that do not roam with a user profile. For example, ```/ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients```  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-IntegrationRootUser**
    String  | Specifies the location to create symbolic links associated with the current version of a per-user published package. All virtual application extensions, such as shortcuts and file type associations, will point to this path. If you don't specify a path, symbolic links will not be used when you publish the package. For example, ```%localappdata%\\Microsoft\\AppV\\Client\\Integration```.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-IntegrationRootGlobal**
    String  | Specifies the location to create symbolic links associated with the current version of a globally published package. All virtual application extensions, such as shortcuts and file type associations, will point to this path. If you don't specify a path, symbolic links will not be used when you publish the package. For example, ```%allusersprofile%\\Microsoft\\AppV\\Client\\Integration```.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-VirtualizableExtensions**
    String  | A comma-delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment. When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application associated with the extension point is locally installed. If the extension is located, the **RunVirtual** command-line parameter will be added, and the application will run virtually. For more information about the **RunVirtual** parameter, see [Running a locally installed application inside a virtual environment with virtualized applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md).  | Policy value not written |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingEnabled**
    True (enabled); False (Disabled state)  | Returns information to a reporting server.  | False |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingServerURL**
    String  | Specifies the location on the reporting server where client information is saved.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingDataCacheLimit**
    Integer \[0–1024\]  | Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingDataBlockSize**
    Integer \[1024 - Unlimited\]  | Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingStartTime**
    Integer (0–23)  | Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0–23 corresponding to the hour of the day. By default the **ReportingStartTime** will start on the current day at 10 P.M.or 22.
    **Note** You should configure this setting to a time when computers running the App-V client are least likely to be offline.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingInterval**
    Integer  | Specifies the retry interval that the client will use to resend data to the reporting server.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingRandomDelay**
    Integer \[0 - ReportingRandomDelay\]  | Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and **ReportingRandomDelay** and will wait the specified duration before sending data. This can help to prevent collisions on the server.  | Policy value not written (same as Not Configured) |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-EnableDynamicVirtualization
    **1 (Enabled), 0 (Disabled)  | Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications.  | |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-EnablePublishingRefreshUI**
    1 (Enabled), 0 (Disabled)  | Enables the publishing refresh progress bar for the computer running the App-V Client.  | |
-| Sync-AppvPublishingServer

    **-HidePublishingRefreshUI**
    1 (Enabled), 0 (Disabled)  | Hides the publishing refresh progress bar.  | |
-| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ProcessesUsingVirtualComponents**
    String  | Specifies a list of process paths (that may contain wildcards) that are candidates for using dynamic virtualization (such as supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization.  | Empty string. |
+
+|                                          Windows PowerShell cmdlet or cmdlets,
    **Option**
    Type                                           |                                                                                                                                                                                                                                                                                                                                                                        Description                                                                                                                                                                                                                                                                                                                                                                        |       Disabled policy state keys and values       |
+|------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------|
+|                     Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-PackageInstallationRoot**
    String                     |                                                                                                                                                                                                                                                                                                                                       Specifies directory where all new applications and updates will be installed.                                                                                                                                                                                                                                                                                                                                       | Policy value not written (same as Not Configured) |
+|                        Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-PackageSourceRoot**
    String                        |                                                                                                                                                                                                                                                                                                                                                Overrides source location for downloading package content.                                                                                                                                                                                                                                                                                                                                                 | Policy value not written (same as Not Configured) |
+|       Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-AllowHighCostLaunch**
    True (enabled); False (Disabled state)       |                                                                                                                                                                                                                                                                                                  This setting controls whether virtualized applications are launched on Windows 10 machines connected by a metered network connection (for example, 4G).                                                                                                                                                                                                                                                                                                  |                         0                         |
+|                 Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReestablishmentRetries**
    Integer (0–99)                  |                                                                                                                                                                                                                                                                                                                                                 Specifies the number of times to retry a dropped session.                                                                                                                                                                                                                                                                                                                                                 | Policy value not written (same as Not Configured) |
+|                Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReestablishmentInterval**
    Integer (0–3600)                |                                                                                                                                                                                                                                                                                                                                    Specifies the number of seconds between attempts to reestablish a dropped session.                                                                                                                                                                                                                                                                                                                                     | Policy value not written (same as Not Configured) |
+|                        Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-LocationProvider**
    String                         |                                                                                                                                                                                                                                                                                                                            Specifies the CLSID for a compatible implementation of the IAppvPackageLocationProvider interface.                                                                                                                                                                                                                                                                                                                             | Policy value not written (same as Not Configured) |
+|                     Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-CertFilterForClientSsl**
    String                      |                                                                                                                                                                                                                                                                                                                                            Specifies the path to a valid certificate in the certificate store.                                                                                                                                                                                                                                                                                                                                            | Policy value not written (same as Not Configured) |
+| Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-VerifyCertificateRevocationList**
    True (enabled); False (Disabled state) |                                                                                                                                                                                                                                                                                                                                        Verifies Server certificate revocation status before streaming with HTTPS.                                                                                                                                                                                                                                                                                                                                         |                         0                         |
+|     Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-SharedContentStoreMode**
    True (enabled); False (Disabled state)      |                                                                                                                                                                                                                                                                                                                                   Specifies that streamed package contents will be not be saved to the local hard disk.                                                                                                                                                                                                                                                                                                                                   |                         0                         |
+|                                              Set-AppvPublishingServer

    **-Name**
    String                                               |                                                                                                                                                                                                                                                                                                                                                          Displays the name of publishing server.                                                                                                                                                                                                                                                                                                                                                          | Policy value not written (same as Not Configured) |
+|                                               Set-AppvPublishingServer

    **-URL**
    String                                               |                                                                                                                                                                                                                                                                                                                                                          Displays the URL of publishing server.                                                                                                                                                                                                                                                                                                                                                           | Policy value not written (same as Not Configured) |
+|                      Set-AppvPublishingServer

    **-GlobalRefreshEnabled**
    True (enabled); False (Disabled state)                       |                                                                                                                                                                                                                                                                                                                                                        Enables global publishing refresh (Boolean)                                                                                                                                                                                                                                                                                                                                                        |                       False                       |
+|                      Set-AppvPublishingServer

    **-GlobalRefreshOnLogon**
    True (enabled); False (Disabled state)                       |                                                                                                                                                                                                                                                                                                                                                Triggers a global publishing refresh on sign in. (Boolean)                                                                                                                                                                                                                                                                                                                                                 |                       False                       |
+|                                 Set-AppvPublishingServer

    **-GlobalRefreshInterval**
    Integer (0–744)                                  |                                                                                                                                                                                                                                                                                                                   Specifies the publishing refresh interval using the GlobalRefreshIntervalUnit. To disable package refresh, specify 0.                                                                                                                                                                                                                                                                                                                   |                         0                         |
+|                            Set-AppvPublishingServer

    **-GlobalRefreshIntervalUnit** 
    0 for hour, 1 for day                            |                                                                                                                                                                                                                                                                                                                                                    Specifies the interval unit (Hour 0–23, Day 0–31).                                                                                                                                                                                                                                                                                                                                                     |                         1                         |
+|                       Set-AppvPublishingServer

    **-UserRefreshEnabled**
    True (enabled); False (Disabled state)                        |                                                                                                                                                                                                                                                                                                                                                         Enables user publishing refresh (Boolean)                                                                                                                                                                                                                                                                                                                                                         |                       False                       |
+|                       Set-AppvPublishingServer

    **-UserRefreshOnLogon**
    True (enabled); False (Disabled state)                        |                                                                                                                                                                                                                                                                                                                                   Triggers a user publishing refresh on sign in. (Boolean) Word count (with spaces): 60                                                                                                                                                                                                                                                                                                                                   |                       False                       |
+|               Set-AppvPublishingServer

    **-UserRefreshInterval**
    Word count (with spaces): 85
    Integer (0–744 Hours)                |                                                                                                                                                                                                                                                                                                                    Specifies the publishing refresh interval using the UserRefreshIntervalUnit. To disable package refresh, select 0.                                                                                                                                                                                                                                                                                                                     |                         0                         |
+|                             Set-AppvPublishingServer

    **-UserRefreshIntervalUnit**
    0 for hour, 1 for day                              |                                                                                                                                                                                                                                                                                                                                                    Specifies the interval unit (Hour 0–23, Day 0–31).                                                                                                                                                                                                                                                                                                                                                     |                         1                         |
+|       Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-MigrationMode**
    True (enabled state); False (Disabled state)       |                                                                                                                                                                                                                                                                                                                 Migration mode allows the App-V client to modify shortcuts and FTA’s for packages created by a previous version of App-V.                                                                                                                                                                                                                                                                                                                 |                                                   |
+|      Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-EnablePackageScripts**
    True (enabled); False (Disabled state)       |                                                                                                                                                                                                                                                                                                                                  Enables scripts defined in the package manifest of configuration files that should run.                                                                                                                                                                                                                                                                                                                                  |                                                   |
+|                                    Set-AppvClientConfiguration

    **-RoamingFileExclusions**
    String                                     |                                                                                                                                                                                                                                                                                                Specifies the file paths relative to %userprofile% that do not roam with a user's profile. For example, ```/ROAMINGFILEEXCLUSIONS='desktop;my pictures'```                                                                                                                                                                                                                                                                                                 |                                                   |
+|                    Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-RoamingRegistryExclusions**
    String                    |                                                                                                                                                                                                                                                                                                   Specifies the registry paths that do not roam with a user profile. For example, ```/ROAMINGREGISTRYEXCLUSIONS=software\\classes;software\\clients```                                                                                                                                                                                                                                                                                                    | Policy value not written (same as Not Configured) |
+|                       Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-IntegrationRootUser**
    String                       |                                                                                                                                                                            Specifies the location to create symbolic links associated with the current version of a per-user published package. All virtual application extensions, such as shortcuts and file type associations, will point to this path. If you don't specify a path, symbolic links will not be used when you publish the package. For example, ```%localappdata%\\Microsoft\\AppV\\Client\\Integration```.                                                                                                                                                                            | Policy value not written (same as Not Configured) |
+|                      Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-IntegrationRootGlobal**
    String                      |                                                                                                                                                                          Specifies the location to create symbolic links associated with the current version of a globally published package. All virtual application extensions, such as shortcuts and file type associations, will point to this path. If you don't specify a path, symbolic links will not be used when you publish the package. For example, ```%allusersprofile%\\Microsoft\\AppV\\Client\\Integration```.                                                                                                                                                                           | Policy value not written (same as Not Configured) |
+|                     Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-VirtualizableExtensions**
    String                     | A comma-delineated list of file name extensions that can be used to determine if a locally installed application can be run in the virtual environment. When shortcuts, FTAs, and other extension points are created during publishing, App-V will compare the file name extension to the list if the application associated with the extension point is locally installed. If the extension is located, the **RunVirtual** command-line parameter will be added, and the application will run virtually. For more information about the **RunVirtual** parameter, see [Running a locally installed application inside a virtual environment with virtualized applications](appv-running-locally-installed-applications-inside-a-virtual-environment.md). |             Policy value not written              |
+|        Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingEnabled**
    True (enabled); False (Disabled state)         |                                                                                                                                                                                                                                                                                                                                                        Returns information to a reporting server.                                                                                                                                                                                                                                                                                                                                                         |                       False                       |
+|                       Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingServerURL**
    String                        |                                                                                                                                                                                                                                                                                                                                     Specifies the location on the reporting server where client information is saved.                                                                                                                                                                                                                                                                                                                                     | Policy value not written (same as Not Configured) |
+|               Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingDataCacheLimit**
    Integer \[0–1024\]               |                                                                                                                                                                                                                                                                 Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over. Set between 0 and 1024.                                                                                                                                                                                                                                                                 | Policy value not written (same as Not Configured) |
+|          Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingDataBlockSize**
    Integer \[1024 - Unlimited\]           |                                                                                                                                                                                                                                                               Specifies the maximum size in bytes to transmit to the server for reporting upload requests. This can help avoid permanent transmission failures when the log has reached a significant size. Set between 1024 and unlimited.                                                                                                                                                                                                                                                               | Policy value not written (same as Not Configured) |
+|                   Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingStartTime**
    Integer (0–23)                    |                                                                                                                                                                                 Specifies the time to initiate the client to send data to the reporting server. You must specify a valid integer between 0–23 corresponding to the hour of the day. By default the **ReportingStartTime** will start on the current day at 10 P.M.or 22.
    **Note** You should configure this setting to a time when computers running the App-V client are least likely to be offline.                                                                                                                                                                                  | Policy value not written (same as Not Configured) |
+|                       Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingInterval**
    Integer                        |                                                                                                                                                                                                                                                                                                                               Specifies the retry interval that the client will use to resend data to the reporting server.                                                                                                                                                                                                                                                                                                                               | Policy value not written (same as Not Configured) |
+|       Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ReportingRandomDelay**
    Integer \[0 - ReportingRandomDelay\]        |                                                                                                                                                                                                                     Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and **ReportingRandomDelay** and will wait the specified duration before sending data. This can help to prevent collisions on the server.                                                                                                                                                                                                                     | Policy value not written (same as Not Configured) |
+|   Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    -EnableDynamicVirtualization
    1 (Enabled), 0 (Disabled)   |                                                                                                                                                                                                                                                                                                          Enables supported Shell Extensions, Browser Helper Objects, and Active X controls to be virtualized and run with virtual applications.                                                                                                                                                                                                                                                                                                           |                                                   |
+|          Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-EnablePublishingRefreshUI**
    1 (Enabled), 0 (Disabled)           |                                                                                                                                                                                                                                                                                                                                  Enables the publishing refresh progress bar for the computer running the App-V Client.                                                                                                                                                                                                                                                                                                                                   |                                                   |
+|                           Sync-AppvPublishingServer

    **-HidePublishingRefreshUI**
    1 (Enabled), 0 (Disabled)                           |                                                                                                                                                                                                                                                                                                                                                        Hides the publishing refresh progress bar.                                                                                                                                                                                                                                                                                                                                                         |                                                   |
+|                 Set-AppvClientConfiguration,
    Set-AppvPublishingServer

    **-ProcessesUsingVirtualComponents**
    String                 |                                                                                                                                                                                                                             Specifies a list of process paths (that may contain wildcards) that are candidates for using dynamic virtualization (such as supported shell extensions, browser helper objects, and ActiveX controls). Only processes whose full path matches one of these items can use dynamic virtualization.                                                                                                                                                                                                                             |                   Empty string.                   |
 
 ## App-V client configuration settings: registry keys
 
 The following table provides information about App-V client configuration settings that can be configured through the registry:
 
-| **Setting name**
    Type  | Registry key value  | Disabled policy state keys and values |
-|---------------------------|---------------------|---------------------------------------|
-| **PackageInstallationRoot**
    String  | Streaming\\PackageInstallationRoot  | Policy value not written (same as Not Configured) |
-| **PackageSourceRoot**
    String  | Streaming\\PackageSourceRoot  | Policy value not written (same as Not Configured) |
-| **AllowHighCostLaunch**
    True (Enabled); False (Disabled state)  | Streaming\\AllowHighCostLaunch  | 0 |
-| **ReestablishmentRetries**
    Integer (0–99)  | Streaming\\ReestablishmentRetries  | Policy value not written (same as Not Configured) |
-| **ReestablishmentInterval**
    Integer (0–3600)  | Streaming\\ReestablishmentInterval  | Policy value not written (same as Not Configured) |
-| **LocationProvider**
    String  | Streaming\\LocationProvider  | Policy value not written (same as Not Configured) |
-| **CertFilterForClientSsl**
    String  | Streaming\\CertFilterForClientSsl  | Policy value not written (same as Not Configured) |
-| **VerifyCertificateRevocationList**
    True (Enabled); False (Disabled state)  | Streaming\\VerifyCertificateRevocationList  | 0 |
-| **SharedContentStoreMode**
    True (Enabled); False (Disabled state)  | Streaming\\SharedContentStoreMode  | 0 |
-| **Name**
    String  | Publishing\\Servers{serverId}\\FriendlyName  | Policy value not written (same as Not Configured) |
-| **URL**
    String  | Publishing\\Servers{serverId}\\URL  | Policy value not written (same as Not Configured) |
-| **GlobalRefreshEnabled**
    True (Enabled); False (Disabled state)  | Publishing\\Servers{serverId}\\GlobalEnabled  | False |
-| **GlobalRefreshOnLogon**
    True (Enabled); False (Disabled state)  | Publishing\\Servers{serverId}\\GlobalLogonRefresh  | False |
-| **GlobalRefreshInterval**
    Integer (0–744)  | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshInterval  | 0 |
-| **GlobalRefreshIntervalUnit** 
    0 for hour, 1 for day  | Publishing\\Servers{serverId}\\GlobalPeriodicRefreshIntervalUnit  | 1 |
-| **UserRefreshEnabled**
    True (Enabled); False (Disabled state)  | Publishing\\Servers{serverId}\\UserEnabled  | False |
-| **UserRefreshOnLogon**
    True (Enabled); False (Disabled state)  | Publishing\\Servers{serverId}\\UserLogonRefresh  | False |
-| **UserRefreshInterval**
    Word count (with spaces): 85; Integer (0–744 Hours)  | Publishing\\Servers{serverId}\\UserPeriodicRefreshInterval  | 0 |
-| **UserRefreshIntervalUnit**
    0 for hour, 1 for day  | Publishing\\Servers{serverId}\\UserPeriodicRefreshIntervalUnit  | 1 |
-| **MigrationMode**
    True(Enabled state); False (Disabled state)  | Coexistence\\MigrationMode  | |
-| **EnablePackageScripts**
    True (Enabled); False (Disabled state)  | \\Scripting\\EnablePackageScripts  | |
-| **RoamingFileExclusions**
    String  | | |
-| **RoamingRegistryExclusions**
    String  | Integration\\RoamingReglstryExclusions  | Policy value not written (same as Not Configured) |
-| **IntegrationRootUser**
    String  | Integration\\IntegrationRootUser  | Policy value not written (same as Not Configured) |
-| **IntegrationRootGlobal**
    String  | Integration\\IntegrationRootGlobal  | Policy value not written (same as Not Configured) |
-| **VirtualizableExtensions**
    String  | Integration\\VirtualizableExtensions  | Policy value not written |
-| **ReportingEnabled**
    True (Enabled); False (Disabled state)  | Reporting\\EnableReporting  | False |
-| **ReportingServerURL**
    String  | Reporting\\ReportingServer  | Policy value not written (same as Not Configured) |
-| **ReportingDataCacheLimit**
    Integer \[0–1024\]  | Reporting\\DataCacheLimit  | Policy value not written (same as Not Configured) |
-| **ReportingDataBlockSize**
    Integer \[1024–Unlimited\]  | Reporting\\DataBlockSize  | Policy value not written (same as Not Configured) |
-| **ReportingStartTime**
    Integer (0–23)  | Reporting\\ StartTime  | Policy value not written (same as Not Configured) |
-| **ReportingInterval**
    Integer  | Reporting\\RetryInterval  | Policy value not written (same as Not Configured) |
-| **ReportingRandomDelay**
    Integer \[0 - ReportingRandomDelay\]  | Reporting\\RandomDelay  | Policy value not written (same as Not Configured) |
-| **EnableDynamicVirtualization
    **1 (Enabled), 0 (Disabled)  | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Virtualization  | |
-| **EnablePublishingRefreshUI**
    1 (Enabled), 0 (Disabled)  | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Publishing  | |
-| **HidePublishingRefreshUI**
    1 (Enabled), 0 (Disabled)  | | |
-| **ProcessesUsingVirtualComponents**
    String  | Virtualization\\ProcessesUsingVirtualComponents  | Empty string. |
-
-
-
 
+|                            **Setting name**
    Type                            |                           Registry key value                            |       Disabled policy state keys and values       |
+|--------------------------------------------------------------------------------|-------------------------------------------------------------------------|---------------------------------------------------|
+|                     **PackageInstallationRoot**
    String                      |                   Streaming\\PackageInstallationRoot                    | Policy value not written (same as Not Configured) |
+|                        **PackageSourceRoot**
    String                         |                      Streaming\\PackageSourceRoot                       | Policy value not written (same as Not Configured) |
+|       **AllowHighCostLaunch**
    True (Enabled); False (Disabled state)        |                     Streaming\\AllowHighCostLaunch                      |                         0                         |
+|                  **ReestablishmentRetries**
    Integer (0–99)                  |                    Streaming\\ReestablishmentRetries                    | Policy value not written (same as Not Configured) |
+|                **ReestablishmentInterval**
    Integer (0–3600)                 |                   Streaming\\ReestablishmentInterval                    | Policy value not written (same as Not Configured) |
+|                         **LocationProvider**
    String                         |                       Streaming\\LocationProvider                       | Policy value not written (same as Not Configured) |
+|                      **CertFilterForClientSsl**
    String                      |                    Streaming\\CertFilterForClientSsl                    | Policy value not written (same as Not Configured) |
+| **VerifyCertificateRevocationList**
    True (Enabled); False (Disabled state)  |               Streaming\\VerifyCertificateRevocationList                |                         0                         |
+|      **SharedContentStoreMode**
    True (Enabled); False (Disabled state)      |                    Streaming\\SharedContentStoreMode                    |                         0                         |
+|                               **Name**
    String                               |               Publishing\\Servers{serverId}\\FriendlyName               | Policy value not written (same as Not Configured) |
+|                               **URL**
    String                                |                   Publishing\\Servers{serverId}\\URL                    | Policy value not written (same as Not Configured) |
+|       **GlobalRefreshEnabled**
    True (Enabled); False (Disabled state)       |              Publishing\\Servers{serverId}\\GlobalEnabled               |                       False                       |
+|       **GlobalRefreshOnLogon**
    True (Enabled); False (Disabled state)       |            Publishing\\Servers{serverId}\\GlobalLogonRefresh            |                       False                       |
+|                  **GlobalRefreshInterval**
    Integer (0–744)                  |      Publishing\\Servers{serverId}\\GlobalPeriodicRefreshInterval       |                         0                         |
+|            **GlobalRefreshIntervalUnit** 
    0 for hour, 1 for day             |    Publishing\\Servers{serverId}\\GlobalPeriodicRefreshIntervalUnit     |                         1                         |
+|        **UserRefreshEnabled**
    True (Enabled); False (Disabled state)        |               Publishing\\Servers{serverId}\\UserEnabled                |                       False                       |
+|        **UserRefreshOnLogon**
    True (Enabled); False (Disabled state)        |             Publishing\\Servers{serverId}\\UserLogonRefresh             |                       False                       |
+| **UserRefreshInterval**
    Word count (with spaces): 85; Integer (0–744 Hours) |       Publishing\\Servers{serverId}\\UserPeriodicRefreshInterval        |                         0                         |
+|              **UserRefreshIntervalUnit**
    0 for hour, 1 for day              |     Publishing\\Servers{serverId}\\UserPeriodicRefreshIntervalUnit      |                         1                         |
+|        **MigrationMode**
    True(Enabled state); False (Disabled state)        |                       Coexistence\\MigrationMode                        |                                                   |
+|       **EnablePackageScripts**
    True (Enabled); False (Disabled state)       |                    \\Scripting\\EnablePackageScripts                    |                                                   |
+|                      **RoamingFileExclusions**
    String                       |                                                                         |                                                   |
+|                    **RoamingRegistryExclusions**
    String                     |                 Integration\\RoamingRegistryExclusions                  | Policy value not written (same as Not Configured) |
+|                       **IntegrationRootUser**
    String                        |                    Integration\\IntegrationRootUser                     | Policy value not written (same as Not Configured) |
+|                      **IntegrationRootGlobal**
    String                       |                   Integration\\IntegrationRootGlobal                    | Policy value not written (same as Not Configured) |
+|                     **VirtualizableExtensions**
    String                      |                  Integration\\VirtualizableExtensions                   |             Policy value not written              |
+|         **ReportingEnabled**
    True (Enabled); False (Disabled state)         |                       Reporting\\EnableReporting                        |                       False                       |
+|                        **ReportingServerURL**
    String                        |                       Reporting\\ReportingServer                        | Policy value not written (same as Not Configured) |
+|               **ReportingDataCacheLimit**
    Integer \[0–1024\]                |                        Reporting\\DataCacheLimit                        | Policy value not written (same as Not Configured) |
+|            **ReportingDataBlockSize**
    Integer \[1024–Unlimited\]            |                        Reporting\\DataBlockSize                         | Policy value not written (same as Not Configured) |
+|                    **ReportingStartTime**
    Integer (0–23)                    |                          Reporting\\ StartTime                          | Policy value not written (same as Not Configured) |
+|                        **ReportingInterval**
    Integer                        |                        Reporting\\RetryInterval                         | Policy value not written (same as Not Configured) |
+|        **ReportingRandomDelay**
    Integer \[0 - ReportingRandomDelay\]        |                         Reporting\\RandomDelay                          | Policy value not written (same as Not Configured) |
+|   EnableDynamicVirtualization
    1 (Enabled), 0 (Disabled)    | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Virtualization |                                                   |
+|           **EnablePublishingRefreshUI**
    1 (Enabled), 0 (Disabled)           |   HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\AppV\\Client\\Publishing   |                                                   |
+|            **HidePublishingRefreshUI**
    1 (Enabled), 0 (Disabled)            |                                                                         |                                                   |
+|                 **ProcessesUsingVirtualComponents**
    String                  |             Virtualization\\ProcessesUsingVirtualComponents             |                   Empty string.                   |
 
 ## Related topics
 
-* [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md)
\ No newline at end of file
+* [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md)
diff --git a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md
index df14d062d7..a4d1d3bb4f 100644
--- a/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md
+++ b/windows/application-management/app-v/appv-configure-access-to-packages-with-the-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to configure access to packages by using the Management Console (Windows 10)
 description: How to configure access to packages by using the App-V Management Console.
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to configure access to packages by using the Management Console
@@ -31,8 +34,8 @@ Use the following procedure to configure access to virtualized packages.
 
     1. Using the format **mydomain** \\ **groupname**, enter the name or part of the name of an Active Directory group object, then select **Check**.
 
-        >[!NOTE]  
-        >Ensure that you provide an associated domain name for the group that you are searching for.
+    > [!NOTE]
+    > Ensure that you provide an associated domain name for the group that you are searching for.
 
 3. Grant access to the package by first selecting the desired group, then selecting **Grant Access**. The newly added group is displayed in the **AD entities with access** pane.
 
diff --git a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md b/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md
index 2c4f458795..ae887fc389 100644
--- a/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md
+++ b/windows/application-management/app-v/appv-configure-connection-groups-to-ignore-the-package-version.md
@@ -1,12 +1,15 @@
 ---
 title: How to make a connection group ignore the package version (Windows 10)
 description: How to make a connection group ignore the package version.
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to make a connection group ignore the package version
@@ -63,4 +66,4 @@ For more information, see [How to manage App-V packages running on a stand-alone
 
 ## Related topics
 
-- [Managing connection groups](appv-managing-connection-groups.md)
\ No newline at end of file
+- [Managing connection groups](appv-managing-connection-groups.md)
diff --git a/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md b/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md
index ac9673baaf..bef16f0060 100644
--- a/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md
+++ b/windows/application-management/app-v/appv-configure-the-client-to-receive-updates-from-the-publishing-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to configure the client to receive package and connection groups updates from the publishing server (Windows 10)
 description: How to configure the client to receive package and connection groups updates from the publishing server.
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/25/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to configure the client to receive package and connection groups updates from the publishing server
diff --git a/windows/application-management/app-v/appv-connect-to-the-management-console.md b/windows/application-management/app-v/appv-connect-to-the-management-console.md
index d19cfb0658..f878e5f7a4 100644
--- a/windows/application-management/app-v/appv-connect-to-the-management-console.md
+++ b/windows/application-management/app-v/appv-connect-to-the-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to connect to the Management Console (Windows 10)
 description: How to Connect to the App-V Management Console.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/25/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: lomayor
 ms.topic: article
 ---
 # How to connect to the Management Console
diff --git a/windows/application-management/app-v/appv-connection-group-file.md b/windows/application-management/app-v/appv-connection-group-file.md
index 284057363a..16d0bd518e 100644
--- a/windows/application-management/app-v/appv-connection-group-file.md
+++ b/windows/application-management/app-v/appv-connection-group-file.md
@@ -1,12 +1,15 @@
 ---
 title: About the connection group file (Windows 10)
 description: A summary of what the connection group file is and how to configure it.
-author: MaggiePucciEvans
+author: dansimp
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/25/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # About the connection group file
@@ -90,7 +93,7 @@ You can use the connection group file to configure each connection group by usin
 
 - Specify runtime priorities for connection groups. To edit priority by using the App-V Management Console, select the connection group and then select **Edit**.
 
-    >[!NOTE]
+   > [!NOTE]
     >A package only requires priority if it's associated with more than one connection group.
 - Specify package precedence within the connection group.
 
diff --git a/windows/application-management/app-v/appv-connection-group-virtual-environment.md b/windows/application-management/app-v/appv-connection-group-virtual-environment.md
index 99932f11be..ed2d425dc4 100644
--- a/windows/application-management/app-v/appv-connection-group-virtual-environment.md
+++ b/windows/application-management/app-v/appv-connection-group-virtual-environment.md
@@ -1,12 +1,15 @@
 ---
 title: About the connection group virtual environment (Windows 10)
 description: Overview of how the connection group virtual environment works.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 06/25/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # About the connection group virtual environment
@@ -27,7 +30,20 @@ The connection group that is used is based on the order in which a package appea
 Consider the following example section:
 
 ```XML
-
+
+  
+  
+  
+
 ```
 
 Assume that same DWORD value ABC (HKEY\_LOCAL\_MACHINE\\software\\contoso\\finapp\\region) is defined in the first and third package.
@@ -67,4 +83,4 @@ When a virtualized application tries to find a specific file, App-V will first f
 
 ## Related topics
 
-- [Managing Connection Groups](appv-managing-connection-groups.md)
\ No newline at end of file
+- [Managing Connection Groups](appv-managing-connection-groups.md)
diff --git a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md
index 36dcf56ffe..794615f010 100644
--- a/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md
+++ b/windows/application-management/app-v/appv-convert-a-package-created-in-a-previous-version-of-appv.md
@@ -1,12 +1,15 @@
 ---
 title: How to convert a package created in a previous version of App-V (Windows 10)
 description: How to convert a package created in a previous version of App-V.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 07/10/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to convert a package created in a previous version of App-V
@@ -15,7 +18,7 @@ ms.topic: article
 
 You can use the package converter utility to upgrade virtual application packages created by previous versions of App-V. This section will tell you how to convert existing virtual application packages for upgrade.
 
->[!NOTE]  
+>[!NOTE]
 >If you are running a computer with a 64-bit architecture, you must use the x86 version of Windows PowerShell.
 
 The package converter can only directly convert packages created by an App-V sequencer version 4.5 or later. Packages created with an App-V version earlier than 4.5 must be upgraded to at least App-V 4.5 before conversion.
@@ -35,24 +38,24 @@ The App-V package converter will save the App-V 4.6 installation root folder and
 
 2. You can enter the following cmdlets to check or convert packages:
 
-    - **Test-AppvLegacyPackage**—This cmdlet checks packages. It will return information about any failures with the package such as missing **.sft** files, an invalid source, **.osd** file errors, or invalid package version. This cmdlet will not parse the **.sft** file or do any in-depth validation. For information about options and basic functionality for this cmdlet, using Windows PowerShell, enter the following cmdlet:
+   - **Test-AppvLegacyPackage**—This cmdlet checks packages. It will return information about any failures with the package such as missing **.sft** files, an invalid source, **.osd** file errors, or invalid package version. This cmdlet will not parse the **.sft** file or do any in-depth validation. For information about options and basic functionality for this cmdlet, using Windows PowerShell, enter the following cmdlet:
 
-         ```PowerShell
-         Test-AppvLegacyPackage -?
-         ```
+        ```PowerShell
+        Test-AppvLegacyPackage -?
+        ```
 
-    - **ConvertFrom-AppvLegacyPackage**—This cmdlet converts packages from legacy versions to updated versions. To convert an existing package, enter the following cmdlet:
+   - **ConvertFrom-AppvLegacyPackage**—This cmdlet converts packages from legacy versions to updated versions. To convert an existing package, enter the following cmdlet:
 
-         ```PowerShell
-         ConvertFrom-AppvLegacyPackage C:\contentStore C:\convertedPackages
-         ```
+        ```PowerShell
+        ConvertFrom-AppvLegacyPackage C:\contentStore C:\convertedPackages
+        ```
 
      In this cmdlet, `C:\contentStore` represents the location of the existing package and `C:\convertedPackages` is the output directory to which the resulting App-V for Windows 10 virtual application package file will be saved. By default, if you do not specify a new name, the old package name will be used.
 
      Additionally, the package converter optimizes performance of packages in App-V for Windows 10 by setting the package to stream fault the App-V package.  This is more performant than the primary feature block and fully downloading the package. The flag **DownloadFullPackageOnFirstLaunch** allows you to convert the package and set the package to be fully downloaded by default.
 
-      >[!NOTE]  
-      >Before you specify the output directory, you must create the output directory.
+> [!NOTE]
+    >Before you specify the output directory, you must create the output directory.
 
 ### Advanced Conversion Tips
 
diff --git a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md
index 2ecf79eaaf..312adeb09b 100644
--- a/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md
+++ b/windows/application-management/app-v/appv-create-a-connection-group-with-user-published-and-globally-published-packages.md
@@ -1,12 +1,15 @@
 ---
 title: How to create a connection croup with user-published and globally published packages (Windows 10)
 description: How to create a connection croup with user-published and globally published packages.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 07/10/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to create a connection croup with user-published and globally published packages
diff --git a/windows/application-management/app-v/appv-create-a-connection-group.md b/windows/application-management/app-v/appv-create-a-connection-group.md
index f5353a4be2..9f08b25b41 100644
--- a/windows/application-management/app-v/appv-create-a-connection-group.md
+++ b/windows/application-management/app-v/appv-create-a-connection-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to create a connection group (Windows 10)
 description: How to create a connection group with the App-V Management Console.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 07/10/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to create a connection group
diff --git a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md
index e27f48c14a..273b520a59 100644
--- a/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md
+++ b/windows/application-management/app-v/appv-create-a-custom-configuration-file-with-the-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to create a custom configuration file by using the App-V Management Console (Windows 10)
 description: How to create a custom configuration file by using the App-V Management Console.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 07/10/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to create a custom configuration file by using the App-V Management Console
@@ -27,13 +30,10 @@ You can create a dynamic user configuration file with the App-V Management Conso
 
 4. Select **Advanced**, and then select **Export Configuration**. Enter a file name and select **Save**. Now you can edit the file to configure a package for a user.
 
-    >[!NOTE]  
-    >If you want to export a configuration while running on Windows Server, make sure to disable the IE Enhanced Security Configuration setting. If this setting is enabled and set to block downloads, you won't be able to download anything from the App-V Server.
-
-
-
+   > [!NOTE]
+   > If you want to export a configuration while running on Windows Server, make sure to disable the IE Enhanced Security Configuration setting. If this setting is enalbed and set to block downloads, you won't be able to download anything from the App-V Server.
 
 
 ## Related topics
 
-- [Operations for App-V](appv-operations.md)
\ No newline at end of file
+- [Operations for App-V](appv-operations.md)
diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md
index c9e6680de7..fb72cbc762 100644
--- a/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md
+++ b/windows/application-management/app-v/appv-create-a-package-accelerator-with-powershell.md
@@ -1,12 +1,15 @@
 ---
 title: How to create a package accelerator by using Windows PowerShell (Windows 10)
 description: How to create a package accelerator with Windows PowerShell.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 07/10/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to create a package accelerator by using Windows PowerShell
@@ -24,20 +27,20 @@ App-V Package Accelerators automatically sequence large, complex applications. A
 
     The following parameters are required to use the package accelerator cmdlet:
 
-    - *InstalledFilesPath* specifies the application installation path.
-    - *Installer* specifies the path to the application installer media.
-    - *InputPackagePath* specifies the path to the .appv package.
-    - *Path* specifies the output directory for the package.
+   - *InstalledFilesPath* specifies the application installation path.
+   - *Installer* specifies the path to the application installer media.
+   - *InputPackagePath* specifies the path to the .appv package.
+   - *Path* specifies the output directory for the package.
 
-    The following example cmdlet shows how you can create a package accelerator with an .appv package and the installation media:
+     The following example cmdlet shows how you can create a package accelerator with an .appv package and the installation media:
 
-    ```PowerShell
-    New-AppvPackageAccelerator -InputPackagePath  -Installer  -Path 
-    ```
+     ```PowerShell
+     New-AppvPackageAccelerator -InputPackagePath  -Installer  -Path 
+     ```
 
-    You can also use the following optional parameter with the **New-AppvPackageAccelerator** cmdlet:
+     You can also use the following optional parameter with the **New-AppvPackageAccelerator** cmdlet:
 
-    - *AcceleratorDescriptionFile* specifies the path to user-created package accelerator instructions. The package accelerator instructions are **.txt** or **.rtf** description files that will be included in the package created by the package accelerator.
+   - *AcceleratorDescriptionFile* specifies the path to user-created package accelerator instructions. The package accelerator instructions are **.txt** or **.rtf** description files that will be included in the package created by the package accelerator.
 
 
 
diff --git a/windows/application-management/app-v/appv-create-a-package-accelerator.md b/windows/application-management/app-v/appv-create-a-package-accelerator.md
index 1aa2fa75c3..7f2ec6c3c5 100644
--- a/windows/application-management/app-v/appv-create-a-package-accelerator.md
+++ b/windows/application-management/app-v/appv-create-a-package-accelerator.md
@@ -1,12 +1,15 @@
 ---
 title: How to create a package accelerator (Windows 10)
 description: How to create a package accelerator.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 07/10/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to create a package accelerator
@@ -50,7 +53,7 @@ Use the following procedure to create a package accelerator.
 
 6. On the **Gathering Information** page, review the files that you couldn't find in the location specified by the **Installation Files** page. If the files displayed are not required, select **Remove these files**, then select **Next**. If the files are required, select **Previous** and copy the required files to the directory specified on the **Installation Files** page.
 
-    >[!NOTE]
+   > [!NOTE]
     >You must either remove the unrequired files or select **Previous** and locate the required files to advance to the next page of this wizard.
 
 7. On the **Select Files** page, carefully review the detected files. Clear any file the package accelerator doesn't need to run successfully and select only the files that the application requires. When you're done, select **Next**.
diff --git a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md
index 48dfcaf890..c6983aab02 100644
--- a/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md
+++ b/windows/application-management/app-v/appv-create-a-virtual-application-package-package-accelerator.md
@@ -1,12 +1,15 @@
 ---
 title: How to create a virtual application package using an App-V Package Accelerator (Windows 10)
 description: How to create a virtual application package using an App-V Package Accelerator.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 07/10/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to create a virtual application package using an App-V Package Accelerator
@@ -37,7 +40,7 @@ Use the following procedure to create a virtual application package with the App
 
     Alternatively, if you have already copied the installation files to a directory on this computer, select **Make New Folder**, browse to the folder that contains the installation files, then select **Next**.
 
-    >[!NOTE]
+   > [!NOTE]
     >You can specify the following types of supported installation files:
     > - Windows Installer files (**.msi**)
     > - Cabinet files (.cab)
diff --git a/windows/application-management/app-v/appv-create-and-use-a-project-template.md b/windows/application-management/app-v/appv-create-and-use-a-project-template.md
index 762a8c3837..54aa412604 100644
--- a/windows/application-management/app-v/appv-create-and-use-a-project-template.md
+++ b/windows/application-management/app-v/appv-create-and-use-a-project-template.md
@@ -1,12 +1,15 @@
 ---
 title: Create and apply an App-V project template to a sequenced App-V package (Windows 10)
 description: Steps for how to create and apply an App-V project template (.appvt) to a sequenced App-V package.
-author: jdeckerms
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 07/10/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Create and apply an App-V project template to a sequenced App-V package
@@ -24,7 +27,7 @@ You must first create and save a project template, including a virtual app packa
 
 1. On the device running the App-V Sequencer, select **Start**, select **All Programs**, select **Microsoft Application Virtualization**, and then select **Microsoft Application Virtualization Sequencer**.
 
-    >[!NOTE]
+   > [!NOTE]
     >If the virtual app package is currently open in the App-V Sequencer console, skip to Step 3 of this procedure.
 
 2. On the **File** menu, select **Open**, select **Edit Package**, browse for the virtual app package that includes the settings you want to save with the App-V Project Template, and then select **Edit** to change any of the settings or info included in the file.
diff --git a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md
index dca1b3b048..197cff66cb 100644
--- a/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md
+++ b/windows/application-management/app-v/appv-creating-and-managing-virtualized-applications.md
@@ -1,12 +1,15 @@
 ---
 title: Creating and managing App-V virtualized applications (Windows 10)
 description: Creating and managing App-V virtualized applications
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Creating and managing App-V virtualized applications
@@ -28,7 +31,7 @@ You can use the App-V Sequencer to perform the following tasks:
 - Upgrade existing packages. You can expand an existing package onto the computer running the sequencer and then upgrade the application to create a newer version.
 - Edit configuration information associated with an existing package. For example, you can add a shortcut or modify a file type association.
 
-    >[!NOTE]
+   > [!NOTE]
     >You must create shortcuts and save them to an available network location to allow roaming. If a shortcut is created and saved in a private location, the package must be published locally to the computer running the App-V client.
 
 - Convert existing virtual packages.
@@ -93,20 +96,11 @@ The following table lists the supported shell extensions:
 
 Copy on write (CoW) file extensions allow App-V to dynamically write to specific locations contained in the virtual package while it is being used.
 
-The following table displays the file types that can exist in a virtual package under the VFS directory, but cannot be updated on the computer running the App-V client. All other files and directories can be modified.
+The following table displays the file types that can exist in a virtual package under the VFS directory, since App-V 5.1, but which cannot be updated on the computer running the App-V client. All other files and directories can be modified.
 
 | File Type||||||
 |---|---|---|---|---|---|
-| .acm | .asa | .asp | .aspx | .ax | .bat |
-| .cer  | .chm  | .clb | .cmd  | .cnt  | .cnv  |
-| .com | .cpl | .cpx  | .crt | .dll | .drv |
-| .esc | .exe  | .fon  | .grp | .hlp | .hta |
-| .ime | .inf  | .ins  | .isp | .its | .js |
-| .jse | .lnk | .msc | .msi | .msp | .mst |
-| .mui | .nls | .ocx  | .pal | .pcd | .pif |
-| .reg  | .scf | .scr | .sct | .shb | .shs  |
-| .sys  | .tlb  | .tsp | .url | .vb | .vbe |
-| .vbs  | .vsmacros | .ws  | .wsf | .wsh  |  |
+| .com | .exe | .dll | .ocx |  |
 
 ## Modifying an existing virtual application package
 
diff --git a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md
index b6239f823f..aae5ad7d4c 100644
--- a/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md
+++ b/windows/application-management/app-v/appv-customize-virtual-application-extensions-with-the-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to customize virtual application extensions for a specific AD group by using the Management Console (Windows 10)
 description: How to customize virtual application extensions for a specific AD group by using the Management Console.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 07/10/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to customize virtual applications extensions for a specific AD group by using the Management Console
diff --git a/windows/application-management/app-v/appv-delete-a-connection-group.md b/windows/application-management/app-v/appv-delete-a-connection-group.md
index 28ece19e12..9747e3066d 100644
--- a/windows/application-management/app-v/appv-delete-a-connection-group.md
+++ b/windows/application-management/app-v/appv-delete-a-connection-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to delete a connection group (Windows 10)
 description: How to delete a connection group.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 09/27/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to delete a connection group
diff --git a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md
index c1da202df9..3b5027c30b 100644
--- a/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md
+++ b/windows/application-management/app-v/appv-delete-a-package-with-the-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to delete a package in the Management Console (Windows 10)
 description: How to delete a package in the Management Console.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 09/27/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to delete a package in the Management Console
diff --git a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md
index c0a29eb10f..fa0a2dca44 100644
--- a/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md
+++ b/windows/application-management/app-v/appv-deploy-appv-databases-with-sql-scripts.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy the App-V Databases by Using SQL Scripts (Windows 10)
 description: How to Deploy the App-V Databases by Using SQL Scripts
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to deploy the App-V databases by using SQL scripts
diff --git a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md
index 8dde4cdf22..0c013faf96 100644
--- a/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md
+++ b/windows/application-management/app-v/appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md
@@ -1,12 +1,15 @@
 ---
 title: How to deploy App-V packages using electronic software distribution (Windows 10)
 description: How to deploy App-V packages using electronic software distribution.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 09/27/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to deploy App-V packages using electronic software distribution
@@ -43,4 +46,4 @@ Use one of the following methods to publish packages to App-V client computers w
 
 ## Related topics
 
-- [Operations for App-V](appv-operations.md)
\ No newline at end of file
+- [Operations for App-V](appv-operations.md)
diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md
index 52f16c2759..9ee527503b 100644
--- a/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md
+++ b/windows/application-management/app-v/appv-deploy-the-appv-server-with-a-script.md
@@ -1,12 +1,15 @@
----
+---
 title: How to Deploy the App-V Server Using a Script (Windows 10)
 description: How to Deploy the App-V  Server Using a Script
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to deploy the App-V server using a script
@@ -520,4 +523,4 @@ To use a custom instance of Microsoft SQL Server, use these parameters:
 
 ## Related topics
 
-* [Deploying the App-V Server](appv-deploying-the-appv-server.md)
\ No newline at end of file
+* [Deploying the App-V Server](appv-deploying-the-appv-server.md)
diff --git a/windows/application-management/app-v/appv-deploy-the-appv-server.md b/windows/application-management/app-v/appv-deploy-the-appv-server.md
index d3ef14b85d..d30cf24d63 100644
--- a/windows/application-management/app-v/appv-deploy-the-appv-server.md
+++ b/windows/application-management/app-v/appv-deploy-the-appv-server.md
@@ -1,12 +1,15 @@
 ---
 title: How to Deploy the App-V Server (Windows 10)
 description: How to Deploy the App-V Server in App-V for Windows 10
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to Deploy the App-V Server (new installation)
@@ -29,7 +32,7 @@ ms.topic: article
 1. Download the App-V server components. All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from either of the following locations:
 
     * The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from this site.
-    * The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).
+    * The [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home).
 2. Copy the App-V server installation files to the computer on which you want to install it.
 3. Start the App-V server installation by right-clicking and running **appv\_server\_setup.exe** as an administrator, and then click **Install**.
 4. Review and accept the license terms, and choose whether to enable Microsoft updates.
@@ -51,7 +54,7 @@ ms.topic: article
     | You are using a custom database name. | Select **Custom configuration** and type the database name.
    The database name must be unique, or the installation will fail.|
 8. On the **Configure** page, accept the default value, **Use this local computer**.
 
-    >[!NOTE]
+   > [!NOTE]
     >If you're installing the Management server and Management database side-by-side, the appropriate options are selected by default and cannot be changed.
 9. On the initial **Create New Reporting Database** page, configure the **Microsoft SQL Server instance** and **Reporting Server database** by selecting the appropriate option below.
 
@@ -61,7 +64,7 @@ ms.topic: article
     | You are using a custom database name. | Select **Custom configuration** and type the database name.
    The database name must be unique, or the installation will fail.|
 10. On the **Configure** page, accept the default value: **Use this local computer**.
 
-    >[!NOTE]
+   > [!NOTE]
     >If you're installing the Management server and Management database side-by-side, the appropriate options are selected by default and cannot be changed.
 11. On the **Configure** (Management Server Configuration) page, specify the following:
 
@@ -95,4 +98,4 @@ ms.topic: article
 * [Deploying App-V](appv-deploying-appv.md)
 * [How to install the management and reporting databases on separate computers from the management and reporting services](appv-install-the-management-and-reporting-databases-on-separate-computers.md)
 * [How to install the publishing server on a remote computer](appv-install-the-publishing-server-on-a-remote-computer.md)
-* [How to deploy the App-V server using a script](appv-deploy-the-appv-server-with-a-script.md)
\ No newline at end of file
+* [How to deploy the App-V server using a script](appv-deploy-the-appv-server-with-a-script.md)
diff --git a/windows/application-management/app-v/appv-deploying-appv.md b/windows/application-management/app-v/appv-deploying-appv.md
index b90d7a848e..d71a0f0476 100644
--- a/windows/application-management/app-v/appv-deploying-appv.md
+++ b/windows/application-management/app-v/appv-deploying-appv.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying App-V (Windows 10)
 description: Deploying App-V
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Deploying App-V for Windows 10
diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md
index 42f86ce251..eb84b6e2b7 100644
--- a/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md
+++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2010-wth-appv.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying Microsoft Office 2010 by Using App-V (Windows 10)
 description: Deploying Microsoft Office 2010 by Using App-V
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Deploying Microsoft Office 2010 by Using App-V
@@ -83,7 +86,7 @@ The following table provides a full list of supported integration points for Off
 
 ### Office 2010 App-V Packages
 
-* [Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/en-us/download/details.aspx?id=38399)
+* [Microsoft Office 2010 Sequencing Kit for Microsoft Application Virtualization 5.0](https://www.microsoft.com/download/details.aspx?id=38399)
 * [Known issues when you create or use an App-V 5.0 Office 2010 package](https://support.microsoft.com/kb/2828619)
 * [How To Sequence Microsoft Office 2010 in Microsoft Application Virtualization 5.0](https://support.microsoft.com/kb/2830069)
 
diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md
index ef4a648b31..6fa996507f 100644
--- a/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md
+++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2013-with-appv.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying Microsoft Office 2013 by Using App-V (Windows 10)
 description: Deploying Microsoft Office 2013 by Using App-V
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Deploying Microsoft Office 2013 by Using App-V
@@ -107,7 +110,7 @@ The XML file included in the Office Deployment Tool specifies the product detail
         
         ```
 
-        >[!NOTE]
+       > [!NOTE]
         >The configuration XML is a sample XML file. This file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file.
 
         The previous example of an XML configuration file specifies that Office 2013 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office 2013, which is the location where Office applications will be saved to. Note that the Product ID of the applications will not affect the final licensing of Office. Office 2013 App-V packages with various licensing can be created from the same applications by specifying licensing in a later stage. For more information, see [Customizable attributes and elements of the XML file](#customizable-attributes-and-elements-of-the-xml-file), later in this topic.
@@ -160,51 +163,51 @@ After you download the Office 2013 applications through the Office Deployment To
 
 1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
 
-    * **SourcePath**: Point to the Office applications downloaded earlier.
-    * **ProductID**: Specify the type of licensing, as shown in the following examples:
-        * Subscription Licensing:
-        ```XML
-        
-           
-            
-              
-            
-            
-              
-            
-          
-        
-        ```
-        In this example, the following changes were made to create a package with Subscription licensing:
+   * **SourcePath**: Point to the Office applications downloaded earlier.
+   * **ProductID**: Specify the type of licensing, as shown in the following examples:
+     * Subscription Licensing:
+       ```XML
+       
+        
+         
+           
+         
+         
+           
+         
+       
+       
+       ```
+       In this example, the following changes were made to create a package with Subscription licensing:
         
-        * **SourcePath** is the path, which was changed to point to the Office applications that were downloaded earlier.
-        * **Product ID** for Office was changed to `O365ProPlusRetail`.
-        * **Product ID** for Visio was changed to `VisioProRetail`.
-        * Volume Licensing
-        ```XML
-        
-           
-            
-              
-            
-            
-              
-            
-          
-        
-        ```
-        In this example, the following changes were made to create a package with Volume licensing:
+     * **SourcePath** is the path, which was changed to point to the Office applications that were downloaded earlier.
+     * **Product ID** for Office was changed to `O365ProPlusRetail`.
+     * **Product ID** for Visio was changed to `VisioProRetail`.
+     * Volume Licensing
+       ```XML
+       
+        
+         
+           
+         
+         
+           
+         
+       
+       
+       ```
+       In this example, the following changes were made to create a package with Volume licensing:
         
-        * **SourcePath** is the source's path, which was changed to point to the Office applications that were downloaded earlier.
-        * **Product ID** for Office was changed to `ProPlusVolume`.
-        * **Product ID** for Visio was changed to `VisioProVolume`.
-    * **ExcludeApp** (optional) lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
-    * **PACKAGEGUID** (optional)—By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
+     * **SourcePath** is the source's path, which was changed to point to the Office applications that were downloaded earlier.
+     * **Product ID** for Office was changed to `ProPlusVolume`.
+     * **Product ID** for Visio was changed to `VisioProVolume`.
+   * **ExcludeApp** (optional) lets you specify Office programs that you don’t want included in the App-V package that the Office Deployment Tool creates. For example, you can exclude Access and InfoPath.
+   * **PACKAGEGUID** (optional)—By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use PACKAGEGUID to specify a different package ID for each package, which allows you to publish multiple App-V packages, created by the Office Deployment Tool, and manage them by using the App-V Server.
         
-        An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users.
+       An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2013 for some users, and create another package with Office 2013 and Visio 2013 for another set of users.
         
-        >[!NOTE]
-        >Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
+      > [!NOTE]
+       >Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
 2. Use the **/packager** command to convert the Office applications to an Office 2013 App-V package.
 
     For example:
@@ -225,11 +228,11 @@ After you download the Office 2013 applications through the Office Deployment To
 
     After you run the **/packager** command, the following folders will appear in the directory where you specified the package should be saved:
 
-    * **App-V Packages**, which contains an Office 2013 App-V package and two deployment configuration files.
    
-    * **WorkingDir**
+   * **App-V Packages**, which contains an Office 2013 App-V package and two deployment configuration files.
    
+   * **WorkingDir**
     
-    >[!NOTE]
-    >To troubleshoot any issues, see the log files in the %temp% directory (default).
+    > [!NOTE]
+     >To troubleshoot any issues, see the log files in the %temp% directory (default).
 3. Verify that the Office 2013 App-V package works correctly:
 
     1. Publish the Office 2013 App-V package that you created globally to a test computer and verify that the Office 2013 shortcuts appear.
@@ -321,7 +324,7 @@ You may want to disable specific applications in your Office App-V package. For
         
       
     
-    
+    
       
         Lync 2013
         
@@ -359,10 +362,10 @@ You may want to disable shortcuts for certain Office applications instead of unp
            
            
            Microsoft.Office.MSACCESS.EXE.15
-           true
+           true
            Build a professional app quickly to manage data.
            l
-           [{AppVPackageRoot}]\officel5\MSACCESS.EXE
+           [{AppVPackageRoot}]\office15\MSACCESS.EXE
         
     ```
 3. Save the Deployment Configuration File.
@@ -378,10 +381,10 @@ To upgrade an Office 2013 package, use the Office Deployment Tool. To upgrade a
 
 1. Create a new Office 2013 package through the Office Deployment Tool that uses the most recent Office 2013 application software. The most recent Office 2013 bits can always be obtained through the download stage of creating an Office 2013 App-V Package. The newly created Office 2013 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage.
 
-    >[!NOTE]
-    >Office App-V packages have two Version IDs:
-      * An Office 2013 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
-      * A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2013 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2013 package.
+   > [!NOTE]
+   > Office App-V packages have two Version IDs:
+   >    * An Office 2013 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
+   >    * A second App-V Package Version ID, x.x.x.x for example, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2013 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect that the Office version itself has changed. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2013 package.
 2. Globally publish the newly created Office 2013 App-V Packages onto computers where you would like to apply the new updates. Since the new package has the same lineage of the older Office 2013 App-V Package, publishing the new package with the updates will only apply the new changes to the old package, and thus will be fast.
 3. Upgrades will be applied in the same manner of any globally published App-V Packages. Because applications will probably be in use, upgrades might be delayed until the computer is rebooted.
 
diff --git a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md
index f2caa3c9f0..ce7303bbf8 100644
--- a/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md
+++ b/windows/application-management/app-v/appv-deploying-microsoft-office-2016-with-appv.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying Microsoft Office 2016 by using App-V (Windows 10)
 description: Deploying Microsoft Office 2016 by using App-V
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Deploying Microsoft Office 2016 by using App-V
@@ -92,8 +95,8 @@ After you download the Office Deployment Tool, you can use it to get the latest
 The XML file included in the Office Deployment Tool specifies the product details, such as the languages and Office applications included.
 
 1. **Customize the sample XML configuration file:** Use the sample XML configuration file that you downloaded with the Office Deployment Tool to customize the Office applications:
-  1. Open the sample XML file in Notepad or your favorite text editor.
-  2. With the sample **configuration.xml** file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the **configuration.xml** file:
+   1. Open the sample XML file in Notepad or your favorite text editor.
+   2. With the sample **configuration.xml** file open and ready for editing, you can specify products, languages, and the path to which you save the Office 2016 applications. The following is a basic example of the **configuration.xml** file:
 
       ```XML
       
@@ -108,7 +111,7 @@ The XML file included in the Office Deployment Tool specifies the product detail
       
       ```
     
-      >[!NOTE]
+     > [!NOTE]
       >The configuration XML is a sample XML file. The file includes lines that are commented out. You can “uncomment” these lines to customize additional settings with the file. To uncomment these lines, remove the `````` from the end of the line.
 
       The previous example of an XML configuration file specifies that Office 2016 ProPlus 32-bit edition, including Visio ProPlus, will be downloaded in English to the \\\\server\\Office2016 location where Office applications will be saved. Note that the Product ID of the applications will not affect Office's final licensing. You can create Office 2016 App-V packages with various licensing from the same applications by specifying licensing in a later stage. The following table summarizes the XML file's customizable attributes and elements:
@@ -121,21 +124,21 @@ The XML file included in the Office Deployment Tool specifies the product detail
       | Language element     | Specifies which language the applications support.    | `Language ID="en-us"`   |
       | Version (attribute of **Add** element) | Optional. Specifies which build the package will use.
    Defaults to latest advertised build (as defined in v32.CAB at the Office source).   | `16.1.2.3`    |
       | SourcePath (attribute of **Add** element)   | Specifies the location the applications will be saved to.    | `Sourcepath = "\\Server\Office2016"`     |
-      | Channel (part of **Add** element)       | Optional. Defines which channel will be used to update Office after installation.
    The default is **Deferred** for Office 365 ProPlus and **Current** for Visio Pro for Office 365 and Project Online Desktop Client. 
    For more information about update channels, see [Overview of update channels for Office 365 ProPlus](https://docs.microsoft.com/DeployOffice/overview-of-update-channels-for-office-365-proplus). | `Channel="Current"`
    `Channel="Deferred"`
    `Channel="FirstReleaseDeferred"`
    `Channel="FirstReleaseCurrent"`  |
+      | Channel (part of **Add** element)       | Optional. Defines which channel will be used to update Office after installation.
    The default is **Deferred** for Office 365 ProPlus and **Current** for Visio Pro for Office 365 and Project Desktop Client. 
    For more information about update channels, see [Overview of update channels for Office 365 ProPlus](https://docs.microsoft.com/DeployOffice/overview-of-update-channels-for-office-365-proplus). | `Channel="Current"`
    `Channel="Deferred"`
    `Channel="FirstReleaseDeferred"`
    `Channel="FirstReleaseCurrent"`  |
 
 After editing the **configuration.xml** file to specify the desired product, languages, and the location where the Office 2016 applications will be saved to, you can save the configuration file under a name of your choice, such as "Customconfig.xml."
 2. **Download the applications into the specified location:** Use an elevated command prompt and a 64-bit operating system to download the Office 2016 applications that will later be converted into an App-V package. The following is an example command:
 
-  `\\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml`
+   `\\server\Office2016\setup.exe /download \\server\Office2016\Customconfig.xml`
 
-  The following table describes the example command's elements:
+   The following table describes the example command's elements:
 
-  | Element | Description |
-  |-------------------------------|--------------------------------------|
-  | ```\\server\Office2016```    | This is the network share location that contains the Office Deployment Tool and the custom **Configuration.xml** file, which in this example is **Customconfig.xml**.    |
-  | ``Setup.exe``   | This is the Office Deployment Tool.     |
-  | ```/download```  | Downloads the Office 2016 applications that you specify in the **Customconfig.xml** file.  |
-  | ```\\server\Office2016\Customconfig.xml```| This passes the XML configuration file required to complete the download process. In this example, the file used is **Customconfig.xml**. After using the download command, Office applications should be found in the location specified in the configuration file, which in this example is ```\\Server\Office2016```. |
+   | Element | Description |
+   |-------------------------------|--------------------------------------|
+   | ```\\server\Office2016```    | This is the network share location that contains the Office Deployment Tool and the custom **Configuration.xml** file, which in this example is **Customconfig.xml**.    |
+   | ``Setup.exe``   | This is the Office Deployment Tool.     |
+   | ```/download```  | Downloads the Office 2016 applications that you specify in the **Customconfig.xml** file.  |
+   | ```\\server\Office2016\Customconfig.xml```| This passes the XML configuration file required to complete the download process. In this example, the file used is **Customconfig.xml**. After using the download command, Office applications should be found in the location specified in the configuration file, which in this example is ```\\Server\Office2016```. |
 
 ### Convert the Office applications into an App-V package
 
@@ -161,34 +164,34 @@ After you download the Office 2016 applications through the Office Deployment To
 
 1. In Notepad, reopen the CustomConfig.xml file, and make the following changes to the file:
 
-    * **SourcePath**: Change to the location where you saved the Office applications you downloaded during setup.
-    * **ProductID**: Specify the type of licensing, as shown in the following example:
+   * **SourcePath**: Change to the location where you saved the Office applications you downloaded during setup.
+   * **ProductID**: Specify the type of licensing, as shown in the following example:
 
-        * Subscription Licensing:
-        ```XML
-        
-           
-            
-              
-            
-            
-              
-            
-          
-        
-        ```
-        This example made the following changes to create this Subscription Licensing package:
+     * Subscription Licensing:
+       ```XML
+       
+        
+         
+           
+         
+         
+           
+         
+       
+       
+       ```
+       This example made the following changes to create this Subscription Licensing package:
         
-        * **SourcePath** was changed to point to the Office applications that were downloaded earlier.
-        * **Product ID** for Office was changed to `O365ProPlusRetail`.
-        * **Product ID** for Visio was changed to `VisioProRetail`.
-    * **ExcludeApp** (optional): Lets you specify Office programs that you don’t want included in the App-V package created by the Office Deployment Tool. For example, you can exclude Access.
-    * **PACKAGEGUID** (optional): By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use **PACKAGEGUID** to specify a different package ID for each package, which allows you to publish multiple App-V packages created by the Office Deployment Tool, and then manage your published packages with the App-V Server.
+     * **SourcePath** was changed to point to the Office applications that were downloaded earlier.
+     * **Product ID** for Office was changed to `O365ProPlusRetail`.
+     * **Product ID** for Visio was changed to `VisioProRetail`.
+   * **ExcludeApp** (optional): Lets you specify Office programs that you don’t want included in the App-V package created by the Office Deployment Tool. For example, you can exclude Access.
+   * **PACKAGEGUID** (optional): By default, all App-V packages created by the Office Deployment Tool share the same App-V Package ID. You can use **PACKAGEGUID** to specify a different package ID for each package, which allows you to publish multiple App-V packages created by the Office Deployment Tool, and then manage your published packages with the App-V Server.
         
-        An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.
+       An example of when to use this parameter is if you create different packages for different users. For example, you can create a package with just Office 2016 for some users, and create another package with Office 2016 and Visio 2016 for another set of users.
         
-        >[!NOTE]
-        >Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
+      > [!NOTE]
+       >Even if you use unique package IDs, you can still deploy only one App-V package to a single device.
 2. Use the /packager command to convert the Office applications to an Office 2016 App-V package.
 
     The following is an example packager command:
@@ -209,11 +212,11 @@ After you download the Office 2016 applications through the Office Deployment To
 
     After you run the **/packager** command, the following folders appear up in the directory where you specified the package should be saved:
     
-    * **App-V Packages**—contains an Office 2016 App-V package and two deployment configuration files.
-    * **WorkingDir**
+   * **App-V Packages**—contains an Office 2016 App-V package and two deployment configuration files.
+   * **WorkingDir**
 
-    >[!NOTE]
-    >To troubleshoot any issues, see the log files in the %temp% directory (default).
+    > [!NOTE]
+     >To troubleshoot any issues, see the log files in the %temp% directory (default).
 3. Verify that the Office 2016 App-V package works correctly:
 
     1. Publish the Office 2016 App-V package that you created globally to a test computer and verify that the Office 2016 shortcuts appear.
@@ -297,7 +300,7 @@ You can also disable specific applications in your Office App-V package. For exa
 5. Add the Office 2016 App-V Package with the new Deployment Configuration File.
 
     ```XML
-    
+    
       
         Lync 2016
         
@@ -337,10 +340,10 @@ You may want to disable shortcuts for certain Office applications instead of unp
            
            
            Microsoft.Office.MSACCESS.EXE.16
-           true
+           true
            Build a professional app quickly to manage data.
            l
-           [{AppVPackageRoot}]\officel6\MSACCESS.EXE
+           [{AppVPackageRoot}]\office16\MSACCESS.EXE
         
     ```
 3. Save the Deployment Configuration File.
@@ -356,7 +359,7 @@ To upgrade an Office 2016 package, use the Office Deployment Tool. To upgrade a
 
 1. Create a new Office 2016 package through the Office Deployment Tool that uses the most recent Office 2016 application software. The most recent Office 2016 bits can always be obtained through the download stage of creating an Office 2016 App-V Package. The newly created Office 2016 package will have the most recent updates and a new Version ID. All packages created using the Office Deployment Tool have the same lineage.
 
-    >[!NOTE]
+   > [!NOTE]
     >Office App-V packages have two Version IDs:
       >* An Office 2016 App-V Package Version ID that is unique across all packages created using the Office Deployment Tool.
       >* A second App-V Package Version ID, formatted as X.X.X.X, in the AppX manifest that will only change if there is a new version of Office itself. For example, if a new Office 2016 release with upgrades is available, and a package is created through the Office Deployment Tool to incorporate these upgrades, the X.X.X.X version ID will change to reflect the new version of Office. The App-V server will use the X.X.X.X version ID to differentiate this package and recognize that it contains new upgrades to the previously published package, and as a result, publish it as an upgrade to the existing Office 2016 package.
diff --git a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md
index 4f205bf71e..37adcaae5e 100644
--- a/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md
+++ b/windows/application-management/app-v/appv-deploying-packages-with-electronic-software-distribution-solutions.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying App-V packages by using electronic software distribution (ESD)
 description: Deploying App-V packages by using electronic software distribution (ESD)
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 09/27/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Deploying App-V packages by using electronic software distribution (ESD)
@@ -27,7 +30,7 @@ To learn how to configure the App-V client to enable only administrators to publ
 
 ## Related topics
 
-- [App-V and Citrix integration](https://www.microsoft.com/en-us/download/details.aspx?id=40885)
+- [App-V and Citrix integration](https://www.microsoft.com/download/details.aspx?id=40885)
 - [Operations for App-V](appv-operations.md)
 
 
diff --git a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md
index c50de9053a..4edf732dd1 100644
--- a/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md
+++ b/windows/application-management/app-v/appv-deploying-the-appv-sequencer-and-client.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the App-V Sequencer and configuring the client (Windows 10)
 description: Deploying the App-V Sequencer and configuring the client
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Deploying the App-V Sequencer and configuring the client
diff --git a/windows/application-management/app-v/appv-deploying-the-appv-server.md b/windows/application-management/app-v/appv-deploying-the-appv-server.md
index a8483ea6cb..576764fb91 100644
--- a/windows/application-management/app-v/appv-deploying-the-appv-server.md
+++ b/windows/application-management/app-v/appv-deploying-the-appv-server.md
@@ -1,12 +1,15 @@
 ---
 title: Deploying the App-V Server (Windows 10)
 description: Deploying the App-V Server in App-V for Windows 10
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Deploying the App-V server
@@ -32,7 +35,7 @@ App-V offers the following five server components, each of which serves a specif
 
 * **Management server.** Use the App-V management server and console to manage your App-V infrastructure. See [Administering App-V with the management console](appv-administering-virtual-applications-with-the-management-console.md) for more information about the management server.
 
- >[!NOTE]
+ > [!NOTE]
     >If you are using App-V with your electronic software distribution solution, you don’t need to use the management server and console. However, you may want to take advantage of the reporting and streaming capabilities in App-V.
 * **Management database.** Use the App-V management database to facilitate database pre-deployments for App-V management. For more information about the management database, see [How to deploy the App-V server](appv-deploy-the-appv-server.md).
 * **Publishing server.** Use the App-V publishing server to host and stream virtual applications. The publishing server supports the HTTP and HTTPS protocols and does not require a database connection. To learn how to configure the publishing server, see [How to install the App-V publishing server](appv-install-the-publishing-server-on-a-remote-computer.md).
@@ -42,7 +45,7 @@ App-V offers the following five server components, each of which serves a specif
 All five App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package, which can be downloaded from either of the following locations:
 
 * The [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215). You must have a MSDN subscription to download the MDOP ISO package from this site.
-* The [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home).
+* The [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx) if you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home).
 
 In large organizations, you might want to install more than one instance of the server components to get the following benefits.
 
diff --git a/windows/application-management/app-v/appv-deployment-checklist.md b/windows/application-management/app-v/appv-deployment-checklist.md
index dbb94bed87..bb97e27472 100644
--- a/windows/application-management/app-v/appv-deployment-checklist.md
+++ b/windows/application-management/app-v/appv-deployment-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Deployment Checklist (Windows 10)
 description: App-V Deployment Checklist
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # App-V Deployment Checklist
diff --git a/windows/application-management/app-v/appv-dynamic-configuration.md b/windows/application-management/app-v/appv-dynamic-configuration.md
index 3e900c1a4b..13a82055b6 100644
--- a/windows/application-management/app-v/appv-dynamic-configuration.md
+++ b/windows/application-management/app-v/appv-dynamic-configuration.md
@@ -1,12 +1,15 @@
 ---
 title: About App-V Dynamic Configuration (Windows 10)
 description: About App-V Dynamic Configuration
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 09/27/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # About App-V dynamic configuration
@@ -425,7 +428,7 @@ The body of the deployment configuration file includes two sections:
 
 ```
 
-User Configuration: see [Dynamic User Configuration](appv-dynamic-configuration.md#dynamic-user-configuration) for more information about this section.
+User Configuration: see [Dynamic User Configuration](#dynamic-user-configuration-file) for more information about this section.
 
 Machine Configuration: The Machine Configuration section of the Deployment Configuration File configures information that can only be set for an entire machine, not a specific user on the computer, like the HKEY\_LOCAL\_MACHINE registry keys in the Virtual Registry. This element can have the following four subsections.
 
diff --git a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md
index ed48d628a2..656f0264ce 100644
--- a/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md
+++ b/windows/application-management/app-v/appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md
@@ -1,12 +1,15 @@
 ---
 title: How to Enable Only Administrators to Publish Packages by Using an ESD (Windows 10)
 description: How to Enable Only Administrators to Publish Packages by Using an ESD
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to enable only administrators to publish packages by using an ESD
diff --git a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md
index 9aa52bfd1c..39a072c558 100644
--- a/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md
+++ b/windows/application-management/app-v/appv-enable-reporting-on-the-appv-client-with-powershell.md
@@ -1,12 +1,15 @@
 ---
 title: How to Enable Reporting on the App-V Client by Using Windows PowerShell (Windows 10)
 description: How to Enable Reporting on the App-V Client by Using Windows PowerShell
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to Enable Reporting on the App-V Client by Using Windows PowerShell
@@ -18,65 +21,64 @@ Use the following procedure to configure the App-V for reporting.
 
 **To configure the computer running the App-V client for reporting**
 
-1.  Enable the App-V client. For more information, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md).
+1. Enable the App-V client. For more information, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md).
 
-2.  After you have enabled the App-V client, use the **Set-AppvClientConfiguration** cmdlet to configure appropriate Reporting Configuration settings:
+2. After you have enabled the App-V client, use the **Set-AppvClientConfiguration** cmdlet to configure appropriate Reporting Configuration settings:
 
-    
-    -    -    -    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
    



    SettingDescription
    ReportingEnabled
    Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.
    ReportingServerURL
    Specifies the location on the reporting server where client information is saved. For example, https://<reportingservername>:<reportingportnumber>.
    
-    
    
-    Note  
-    
    This is the port number that was assigned during the Reporting Server setup
    
-    
    
-    
    
-     
-    
    Reporting Start Time
    This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.
    ReportingRandomDelay
    Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.
    ReportingInterval
    Specifies the retry interval that the client will use to resend data to the reporting server.
    ReportingDataCacheLimit
    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.
    ReportingDataBlockSize
    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.
    
+   
+   +   +   +   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
+   
    



    SettingDescription
    ReportingEnabled
    Enables the client to return information to a reporting server. This setting is required for the client to collect the reporting data on the client.
    ReportingServerURL
    Specifies the location on the reporting server where client information is saved. For example, https://<reportingservername>:<reportingportnumber>.
    
+   
    
+   Note
    This is the port number that was assigned during the Reporting Server setup
    
+   
    
+   
    
 
-     
+   
    Reporting Start Time
    This is set to schedule the client to automatically send the data to the server. This setting will indicate the hour at which the reporting data will start to send. It is in the 24 hour format and will take a number between 0-23.
    ReportingRandomDelay
    Specifies the maximum delay (in minutes) for data to be sent to the reporting server. When the scheduled task is started, the client generates a random delay between 0 and ReportingRandomDelay and will wait the specified duration before sending data.
    ReportingInterval
    Specifies the retry interval that the client will use to resend data to the reporting server.
    ReportingDataCacheLimit
    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.
    ReportingDataBlockSize
    Specifies the maximum size in megabytes (MB) of the XML cache for storing reporting information. The size applies to the cache in memory. When the limit is reached, the log file will roll over.
    
 
-3.  After the appropriate settings have been configured, the computer running the App-V client will automatically collect data and will send the data back to the reporting server.
 
-    Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** cmdlet.
+
+3. After the appropriate settings have been configured, the computer running the App-V client will automatically collect data and will send the data back to the reporting server.
+
+   Additionally, administrators can manually send the data back in an on-demand manner using the **Send-AppvClientReport** cmdlet.
 
 
 
diff --git a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md
index 29f36ee761..d9644226fb 100644
--- a/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md
+++ b/windows/application-management/app-v/appv-enable-the-app-v-desktop-client.md
@@ -1,12 +1,15 @@
 ---
 title: Enable the App-V in-box client (Windows 10)
 description: How to enable the App-V in-box client installed with Windows 10.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Enable the App-V in-box client
diff --git a/windows/application-management/app-v/appv-evaluating-appv.md b/windows/application-management/app-v/appv-evaluating-appv.md
index c17263348d..df7f76ca07 100644
--- a/windows/application-management/app-v/appv-evaluating-appv.md
+++ b/windows/application-management/app-v/appv-evaluating-appv.md
@@ -1,12 +1,15 @@
 ---
 title: Evaluating App-V (Windows 10)
 description: Evaluating App-V for Windows 10
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 
diff --git a/windows/application-management/app-v/appv-for-windows.md b/windows/application-management/app-v/appv-for-windows.md
index efac1526d5..459032925c 100644
--- a/windows/application-management/app-v/appv-for-windows.md
+++ b/windows/application-management/app-v/appv-for-windows.md
@@ -1,12 +1,15 @@
 ---
 title: Application Virtualization (App-V) (Windows 10)
 description: Application Virtualization (App-V)
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 09/27/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Application Virtualization (App-V) for Windows 10 overview
diff --git a/windows/application-management/app-v/appv-getting-started.md b/windows/application-management/app-v/appv-getting-started.md
index d18e707951..1b1f6592d5 100644
--- a/windows/application-management/app-v/appv-getting-started.md
+++ b/windows/application-management/app-v/appv-getting-started.md
@@ -1,12 +1,15 @@
 ---
 title: Getting Started with App-V (Windows 10)
 description: Getting Started with App-V for Windows 10
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Getting started with App-V for Windows 10
@@ -15,7 +18,7 @@ ms.topic: article
 
 Microsoft Application Virtualization (App-V) for Windows 10 delivers Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service in real time and on an as-needed basis. Users launch virtual applications from familiar access points and interact with them as if they were installed locally.
 
-With the release of Windows 10, version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/en-us/WindowsForBusiness/windows-for-enterprise). If you're new to Windows 10 and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. To learn what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md).
+With the release of Windows 10, version 1607, App-V is included with the [Windows 10 for Enterprise edition](https://www.microsoft.com/WindowsForBusiness/windows-for-enterprise). If you're new to Windows 10 and App-V, you’ll need to download, activate, and install server- and client-side components to start delivering virtual applications to users. To learn what you need to know before getting started with App-V, see the [Application Virtualization (App-V) overview](appv-for-windows.md).
 
 If you’re already using App-V, performing an in-place upgrade to Windows 10 on user devices automatically installs the App-V client and migrates users’ App-V applications and settings. For more information about how to configure an existing App-V installation after upgrading user devices to Windows 10, see [Upgrading to App-V for Windows 10 from an existing installation](appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md).
 
@@ -32,13 +35,13 @@ To start using App-V to deliver virtual applications to users, you’ll need to
 
 | Component  | What it does     | Where to find it     |
 |------------|--|------|
-| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For more details, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

    If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package that can be downloaded from the following locations:

     If you have a Microsoft Developer Network (MSDN) subscription, use the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215) to download the MDOP ISO package.

     If you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/en-us/WindowsForBusiness/windows-product-home), download it from the [Volume Licensing Service Center](https://www.microsoft.com/en-us/licensing/default.aspx).

    See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components.|
+| App-V server components | App-V offers five server components that work together to allow you to host and publish virtual applications, generate usage reports, and manage your App-V environment. For more details, see [Deploying the App-V Server](appv-deploying-the-appv-server.md).

    If you're already using App-V 5.x, you don't need to redeploy the App-V server components, as they haven't changed since App-V 5.0's release. | The App-V server components are included in the Microsoft Desktop Optimization Pack (MDOP) 2015 ISO package that can be downloaded from the following locations:

     If you have a Microsoft Developer Network (MSDN) subscription, use the [MSDN (Microsoft Developer Network) subscriptions site](https://msdn.microsoft.com/subscriptions/downloads/default.aspx#FileId=65215) to download the MDOP ISO package.

     If you're using [Windows 10 for Enterprise or Education](https://www.microsoft.com/WindowsForBusiness/windows-product-home), download it from the [Volume Licensing Service Center](https://www.microsoft.com/licensing/default.aspx).

    See [Deploying the App-V Server](appv-deploying-the-appv-server.md) for more information about installing and using the server components.|
 | App-V client and App-V Remote Desktop Services (RDS) client | The App-V client is the component that runs virtualized applications on user devices, allowing users to interact with icons and file names to start virtualized applications. | The App-V client is automatically installed with Windows 10, version 1607. 

    To learn how to enable the client, see [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md).           |
 | App-V sequencer      | Use the App-V sequencer to convert Win32 applications into virtual packages for deployment to user devices. Devices must run the App-V client to allow users to interact with virtual applications.    | Installed with the [Windows Assessment and Deployment kit (ADK) for Windows 10, version 1607](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit).  |
 
 For more information about these components, see [High Level Architecture for App-V](appv-high-level-architecture.md).
 
-If you're new to App-V, it's a good idea to read the documentation thoroughly. Before deploying App-V in a production environment, you can ensure installation goes smoothly by validating your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. To get started, see the [Microsoft Training Overview](https://www.microsoft.com/en-us/learning/default.aspx).
+If you're new to App-V, it's a good idea to read the documentation thoroughly. Before deploying App-V in a production environment, you can ensure installation goes smoothly by validating your deployment plan in a test network environment. You might also consider taking a class about relevant technologies. To get started, see the [Microsoft Training Overview](https://www.microsoft.com/learning/default.aspx).
 
 ## Getting started with App-V
 
@@ -55,4 +58,4 @@ If you're new to App-V, it's a good idea to read the documentation thoroughly. B
 * [Deploying App-V](appv-deploying-appv.md)
 * [Operations for App-V](appv-operations.md)
 * [Troubleshooting App-V](appv-troubleshooting.md)
-* [Technical reference for App-V](appv-technical-reference.md)
\ No newline at end of file
+* [Technical reference for App-V](appv-technical-reference.md)
diff --git a/windows/application-management/app-v/appv-high-level-architecture.md b/windows/application-management/app-v/appv-high-level-architecture.md
index 6cd81600e8..ab25607096 100644
--- a/windows/application-management/app-v/appv-high-level-architecture.md
+++ b/windows/application-management/app-v/appv-high-level-architecture.md
@@ -1,12 +1,15 @@
 ---
 title: High-level architecture for App-V (Windows 10)
 description: High-level Architecture for App-V.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # High-level architecture for App-V
@@ -31,4 +34,4 @@ A typical App-V implementation consists of the following elements.
 
 ## Related topics
 
-- [Getting Started with App-V](appv-getting-started.md)
\ No newline at end of file
+- [Getting Started with App-V](appv-getting-started.md)
diff --git a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md
index 24405d012e..82b6545be6 100644
--- a/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md
+++ b/windows/application-management/app-v/appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell (Windows 10)
 description: How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 
@@ -39,7 +42,7 @@ Before attempting this procedure, you should read and understand the information
 
 2.  To open a Windows PowerShell console, click **Start** and type **PowerShell**. Right-click **Windows PowerShell** and select **Run as Administrator**.
 
-    ``` syntax
+    ```powershell
     <#
     .SYNOPSIS
     This Windows PowerShell script will take an array of account names and try to convert each of them to the corresponding SID in standard and hexadecimal formats.
@@ -56,9 +59,6 @@ Before attempting this procedure, you should read and understand the information
     .\ConvertToSID.ps1 $accountsArray | Write-Output -FilePath .\SIDs.txt -Width 200
     #>
 
-    []()  
-
-    []()  
     function ConvertSIDToHexFormat
     {
        param([System.Security.Principal.SecurityIdentifier]$sidToConvert)
diff --git a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md
index a67f0ea3de..ffffedff20 100644
--- a/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md
+++ b/windows/application-management/app-v/appv-install-the-management-and-reporting-databases-on-separate-computers.md
@@ -1,12 +1,15 @@
 ---
 title: How to Install the Management and Reporting Databases on separate computers from the Management and Reporting Services (Windows 10)
 description: How to install the Management and Reporting Databases on separate computers from the Management and Reporting Services.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to Install the Management and Reporting Databases on separate computers from the Management and Reporting Services
@@ -26,11 +29,11 @@ Use the following procedure to install the database server and management server
 4. On the **Feature selection** page, select the components you want to install by first selecting the **Management Server Database** checkbox, then selecting **Next**.
 5. On the **Installation location** page, accept the default location and select **Next**.
 6. On the initial **Create new management server database** page, accept the default selections if appropriate, then select **Next**.
-  * If you are using a custom SQL Server instance, select **Use a custom instance** and enter the name of the instance.
-  * If you are using a custom database name, select **Custom configuration** and enter the database name.
+   * If you are using a custom SQL Server instance, select **Use a custom instance** and enter the name of the instance.
+   * If you are using a custom database name, select **Custom configuration** and enter the database name.
 7. On the next **Create new management server database** page, select **Use a remote computer**, then enter the remote machine account using the following format: ```Domain\MachineAccount```.
 
-    >[!NOTE]
+   > [!NOTE]
     >If you plan to deploy the management server on the same computer you must select **Use this local computer**. Specify the user name for the management server **Install Administrator** using the following format: ```Domain\AdministratorLoginName```. After that, select **Next**.
 8. To start the installation, select **Install**.
 
@@ -42,11 +45,11 @@ Use the following procedure to install the database server and management server
 4. On the **Feature selection** page, select the components you want to install by first selecting the **Reporting Server Database** checkbox, then selecting **Next**.
 5. On the **Installation Location** page, accept the default location and select **Next**.
 6. On the initial **Create new management server database** page, accept the default selections if appropriate, then select **Next**.
- * If you're using a custom SQL Server instance, select **Use a custom instance** and enter the instance name.
- * If you're using a custom database name, select **Custom configuration** and enter the database name.
+   * If you're using a custom SQL Server instance, select **Use a custom instance** and enter the instance name.
+   * If you're using a custom database name, select **Custom configuration** and enter the database name.
 7. On the next **Create new management server database** page, select **Use a remote computer**, and enter the remote machine account using the following format: ```Domain\MachineAccount```.
 
-    >[!NOTE]
+   > [!NOTE]
     >If you plan to deploy the reporting server on the same computer you must select **Use this local computer**. Specify the user name for the reporting server **Install Administrator** using the following format: Domain\\AdministratorLoginName. After that, select **Next**.
 8. To start the installation, select **Install**.
 
@@ -55,18 +58,18 @@ Use the following procedure to install the database server and management server
 1. Copy the App-V server installation files to the computer on which you want to install it on.
 2. To extract the App-V database scripts, open a command prompt and specify the location where the installation files are saved and run the following command:
 
-  ```SQL
+   ```SQL
     appv\_server\_setup.exe /LAYOUT /LAYOUTDIR=”InstallationExtractionLocation”
-  ```
+   ```
   
 3. After the extraction has been completed, to access the App-V database scripts and instructions readme file:
 
- * The App-V Management Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Management Database**.
- * The App-V Reporting Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Reporting Database**.
+   * The App-V Management Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Management Database**.
+   * The App-V Reporting Database scripts and instructions readme are located in the following folder: **InstallationExtractionLocation** \\ **Database Scripts** \\ **Reporting Database**.
 4. For each database, copy the scripts to a share and modify them following the instructions in the readme file.
 
- >[!NOTE]
- >For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md).
+  > [!NOTE]
+   >For more information about modifying the required SIDs contained in the scripts see, [How to Install the App-V Databases and Convert the Associated Security Identifiers by Using Windows PowerShell](appv-install-the-appv-databases-and-convert-the-associated-security-identifiers-with-powershell.md).
 5. Run the scripts on the computer running Microsoft SQL Server.
 
 
@@ -75,4 +78,4 @@ Use the following procedure to install the database server and management server
 
 ## Related topics
 
-* [Deploying App-V](appv-deploying-appv.md)
\ No newline at end of file
+* [Deploying App-V](appv-deploying-appv.md)
diff --git a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md
index 7e82f64b5b..44e1be2801 100644
--- a/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md
+++ b/windows/application-management/app-v/appv-install-the-management-server-on-a-standalone-computer.md
@@ -1,12 +1,15 @@
 ---
 title: How to install the Management Server on a Standalone Computer and Connect it to the Database (Windows 10)
 description: How to install the Management Server on a Standalone Computer and Connect it to the Database
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to install the Management Server on a Standalone Computer and Connect it to the Database
@@ -22,12 +25,12 @@ To install the management server on a standalone computer and connect it to the
 5. On the **Installation Location** page, accept the default location, then select **Next**.
 6. On the **Configure Existing Management Database** page, select **Use a remote SQL Server**, then enter the computer running Microsoft SQL's machine name, such as ```SqlServerMachine```.
 
- >[!NOTE]
- >If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance**, then enter the instance's name. Specify the **SQL Server Database name** that this management server will use, such as ```AppvManagement```.
+  > [!NOTE]
+   >If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server Instance, select **Use the default instance**. If you are using a custom Microsoft SQL Server instance, you must select **Use a custom instance**, then enter the instance's name. Specify the **SQL Server Database name** that this management server will use, such as ```AppvManagement```.
 7. On the **Configure management server configuration** page, specify the following items:
-  * The AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation
-  * The **Website Name** you want to use for the management service. Accept the default if you do not have a custom name.
-  * For the **Port Binding**, specify a unique port number, such as **12345**.
+   * The AD group or account that will connect to the management console for administrative purposes for example **MyDomain\\MyUser** or **MyDomain\\AdminGroup**. The account or AD group you specify will be enabled to manage the server through the management console. You can add additional users or groups using the management console after installation
+   * The **Website Name** you want to use for the management service. Accept the default if you do not have a custom name.
+   * For the **Port Binding**, specify a unique port number, such as **12345**.
 8. Select **Install**.
 9. To confirm that the setup has completed successfully, open a web browser and enter the following URL: https://managementserver:portnumber/Console. If the installation was successful, you should see the **Management Console** appear without any error messages or warnings displayed.
 
@@ -37,4 +40,4 @@ To install the management server on a standalone computer and connect it to the
 
 ## Related topics
 
-* [Deploying App-V](appv-deploying-appv.md)
\ No newline at end of file
+* [Deploying App-V](appv-deploying-appv.md)
diff --git a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md
index a4d4a8ed1a..7209027bb8 100644
--- a/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md
+++ b/windows/application-management/app-v/appv-install-the-publishing-server-on-a-remote-computer.md
@@ -1,12 +1,15 @@
 ---
-title: How to Install the Publishing Server on a Remote Computer (Windows 10)
+title: Install the Publishing Server on a Remote Computer (Windows 10)
 description: How to Install the App-V Publishing Server on a Remote Computer
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to install the publishing server on a remote computer
@@ -24,16 +27,16 @@ Use the following procedure to install the publishing server on a separate compu
 5. On the **Installation location** page, accept the default location, then select **Next**.
 6. On the **Configure publishing server configuration** page, specify the following items:
 
- * The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**.
- * Specify the website name that you want to use for the publishing service. If you don't have a custom name, then use the default name.
- * For the **Port binding**, specify a unique port number that will be used by App-V. For example, **54321**.
+   * The URL for the management service that the publishing server will connect to. For example, **http://ManagementServerName:12345**.
+   * Specify the website name that you want to use for the publishing service. If you don't have a custom name, then use the default name.
+   * For the **Port binding**, specify a unique port number that will be used by App-V. For example, **54321**.
 7. On the **Ready to install** page, select **Install**.
 8. After the installation is complete, the publishing server must be registered with the management server. In the App-V management console, use the following steps to register the server:
 
     1. Open the App-V management server console.
     2. In the left pane, select **Servers**, then select **Register New Server**.
     3. Enter the server name and a description (if required), then select **Add**.
-9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle that package to an AD group, then publish it. Using an internet browser, open the following URL: **https://publishingserver:pubport**. If the server is running correctly, information like the following example should appear.
+9. To verify that the publishing server is running correctly, you should import a package to the management server, entitle that package to an AD group, then publish it. Using an internet browser, open the following URL: https://publishingserver:pubport. If the server is running correctly, information like the following example should appear.
 
     ```SQL
     
@@ -59,4 +62,4 @@ Use the following procedure to install the publishing server on a separate compu
 
 ## Related topics
 
-* [Deploying App-V](appv-deploying-appv.md)
\ No newline at end of file
+* [Deploying App-V](appv-deploying-appv.md)
diff --git a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md
index 9c1a1b5066..d476fda616 100644
--- a/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md
+++ b/windows/application-management/app-v/appv-install-the-reporting-server-on-a-standalone-computer.md
@@ -1,12 +1,15 @@
 ---
 title: How to install the Reporting Server on a standalone computer and connect it to the database (Windows 10)
 description: How to install the App-V Reporting Server on a Standalone Computer and Connect it to the Database
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to install the reporting server on a standalone computer and connect it to the database
@@ -27,7 +30,7 @@ Use the following procedure to install the reporting server on a standalone comp
 5. On the **Installation location** page, accept the default location and select **Next**.
 6. On the **Configure existing reporting database** page, select **Use a remote SQL Server**, then enter the machine name of the computer running Microsoft SQL Server. For example, you can name your computer **SqlServerMachine**.
 
-    >[!NOTE]
+   > [!NOTE]
     >If the Microsoft SQL Server is deployed on the same server, select **Use local SQL Server**. For the SQL Server instance, select **Use the default instance**. If you're using a custom Microsoft SQL Server instance, select **Use a custom instance**, then enter the name of your custom instance. Specify the **SQL Server Database name** that this reporting server will use; for example, you can name the server **AppvReporting**.
 7. On the **Configure reporting server configuration** page.
 
@@ -43,4 +46,4 @@ Use the following procedure to install the reporting server on a standalone comp
 
 * [About App-V reporting](appv-reporting.md)
 * [Deploying App-V](appv-deploying-appv.md)
-* [How to enable reporting on the App-V client by using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md)
\ No newline at end of file
+* [How to enable reporting on the App-V client by using Windows PowerShell](appv-enable-reporting-on-the-appv-client-with-powershell.md)
diff --git a/windows/application-management/app-v/appv-install-the-sequencer.md b/windows/application-management/app-v/appv-install-the-sequencer.md
index 59f1199d00..93180520e7 100644
--- a/windows/application-management/app-v/appv-install-the-sequencer.md
+++ b/windows/application-management/app-v/appv-install-the-sequencer.md
@@ -1,12 +1,15 @@
 ---
 title: Install the App-V Sequencer (Windows 10)
 description: Install the App-V Sequencer
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Install the App-V Sequencer
diff --git a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md
index ae78cb69e8..bc8cd9361e 100644
--- a/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md
+++ b/windows/application-management/app-v/appv-load-the-powershell-cmdlets-and-get-cmdlet-help.md
@@ -1,12 +1,15 @@
 ---
 title: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help (Windows 10)
 description: How to Load the Windows PowerShell Cmdlets for App-V and Get Cmdlet Help
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 09/27/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to load the Windows PowerShell cmdlets for App-V and get cmdlet help
diff --git a/windows/application-management/app-v/appv-maintaining-appv.md b/windows/application-management/app-v/appv-maintaining-appv.md
index eab387ff9a..3b54154537 100644
--- a/windows/application-management/app-v/appv-maintaining-appv.md
+++ b/windows/application-management/app-v/appv-maintaining-appv.md
@@ -1,12 +1,15 @@
 ---
 title: Maintaining App-V (Windows 10)
 description: Maintaining App-V
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 09/27/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Maintaining App-V
@@ -33,4 +36,4 @@ Additionally, ISVs who want to explicitly virtualize or not virtualize calls on
 
 ## Other resources for maintaining App-V
 
-* [Operations for App-V](appv-operations.md)
\ No newline at end of file
+* [Operations for App-V](appv-operations.md)
diff --git a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md
index 4482877876..c7f1214405 100644
--- a/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md
+++ b/windows/application-management/app-v/appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md
@@ -1,12 +1,15 @@
 ---
 title: How to manage App-V packages running on a stand-alone computer by using Windows PowerShell (Windows 10)
 description: How to manage App-V packages running on a stand-alone computer by using Windows PowerShell.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 09/24/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to manage App-V packages running on a stand-alone computer by using Windows PowerShell
@@ -29,8 +32,8 @@ Get-AppvClientPackage –Name "ContosoApplication" -Version 2
 
 Use the **Add-AppvClientPackage** cmdlet to add a package to a computer.
 
->[!IMPORTANT]
->This example only adds a package. It does not publish the package to the user or the computer.
+> [!IMPORTANT]
+> This example only adds a package. It does not publish the package to the user or the computer.
 
 For example:
 
@@ -56,8 +59,8 @@ Publish-AppvClientPackage "ContosoApplication" -Global
 
 ## Publish a package to a specific user
 
->[!NOTE]  
->You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter.
+> [!NOTE]
+> You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter.
 
 An administrator can publish a package to a specific user by specifying the optional *–UserSID* parameter with the **Publish-AppvClientPackage** cmdlet, where *-UserSID* represents the end user’s security identifier (SID).
 
@@ -96,8 +99,8 @@ Unpublish-AppvClientPackage "ContosoApplication"
 
 ## Unpublish a package for a specific user
 
->[!NOTE]
->You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter.
+> [!NOTE]
+> You must use App-V 5.0 SP2 Hotfix Package 5 or later to use this parameter.
 
 An administrator can unpublish a package for a specific user by using the optional *-UserSID* parameter with the **Unpublish-AppvClientPackage** cmdlet, where *-UserSID* represents the end user’s security identifier (SID).
 
@@ -124,8 +127,8 @@ For example:
 Remove-AppvClientPackage "ContosoApplication"
 ```
 
->[!NOTE]
->App-V cmdlets have been assigned to variables for the previous examples for clarity only; assignment is not a requirement. Most cmdlets can be combined as displayed in [Add and publish a package](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#add-and-publish-a-package). For a detailed tutorial, see [App-V 5.0 Client PowerShell Deep Dive](https://blogs.technet.microsoft.com/appv/2012/12/03/app-v-5-0-client-powershell-deep-dive/).
+> [!NOTE]
+> App-V cmdlets have been assigned to variables for the previous examples for clarity only; assignment is not a requirement. Most cmdlets can be combined as displayed in [Add and publish a package](appv-manage-appv-packages-running-on-a-stand-alone-computer-with-powershell.md#add-and-publish-a-package). For a detailed tutorial, see [App-V 5.0 Client PowerShell Deep Dive](https://blogs.technet.microsoft.com/appv/2012/12/03/app-v-5-0-client-powershell-deep-dive/).
 
 ## Enable only administrators to publish or unpublish packages
 
@@ -169,4 +172,4 @@ For more information about pending tasks, see [Upgrading an in-use App-V package
 ## Related topics
 
 - [Operations for App-V](appv-operations.md)
-- [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md)
\ No newline at end of file
+- [Administering App-V by using Windows PowerShell](appv-administering-appv-with-powershell.md)
diff --git a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md
index 9e50ad3f0c..d4e01266f8 100644
--- a/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md
+++ b/windows/application-management/app-v/appv-manage-connection-groups-on-a-stand-alone-computer-with-powershell.md
@@ -1,12 +1,15 @@
 ---
 title: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell (Windows 10)
 description: How to Manage Connection Groups on a Stand-alone Computer by Using Windows PowerShell
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 
diff --git a/windows/application-management/app-v/appv-managing-connection-groups.md b/windows/application-management/app-v/appv-managing-connection-groups.md
index db17fbe2a0..5a94cbc421 100644
--- a/windows/application-management/app-v/appv-managing-connection-groups.md
+++ b/windows/application-management/app-v/appv-managing-connection-groups.md
@@ -1,12 +1,15 @@
 ---
 title: Managing Connection Groups (Windows 10)
 description: Managing Connection Groups
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 
@@ -29,40 +32,40 @@ In some previous versions of App-V, connection groups were referred to as Dynami
 
 
 
-
    [About the Connection Group Virtual Environment](appv-connection-group-virtual-environment.md)
    
+
    About the Connection Group Virtual Environment
    
 
    Describes the connection group virtual environment.
    
 
 
-
    [About the Connection Group File](appv-connection-group-file.md)
    
+
    About the Connection Group File
    
 
    Describes the connection group file.
    
 
 
-
    [How to Create a Connection Group](appv-create-a-connection-group.md)
    
+
    How to Create a Connection Group
    
 
    Explains how to create a new connection group.
    
 
 
-
    [How to Create a Connection Group with User-Published and Globally Published Packages](appv-create-a-connection-group-with-user-published-and-globally-published-packages.md)
    
+
    How to Create a Connection Group with User-Published and Globally Published Packages
    
 
    Explains how to create a new connection group that contains a mix of packages that are published to the user and published globally.
    
 
 
-
    [How to Delete a Connection Group](appv-delete-a-connection-group.md)
    
+
    How to Delete a Connection Group
    
 
    Explains how to delete a connection group.
    
 
 
-
    [How to Publish a Connection Group](appv-publish-a-connection-group.md)
    
+
    How to Publish a Connection Group
    
 
    Explains how to publish a connection group.
    
 
 
-
    [How to Make a Connection Group Ignore the Package Version](appv-configure-connection-groups-to-ignore-the-package-version.md)
    
+
    How to Make a Connection Group Ignore the Package Version
    
 
    Explains how to configure a connection group to accept any version of a package, which simplifies package upgrades and reduces the number of connection groups you need to create.
    
 
 
-
    [How to Allow Only Administrators to Enable Connection Groups](appv-allow-administrators-to-enable-connection-groups.md)
    
+
    How to Allow Only Administrators to Enable Connection Groups
    
 
    Explains how to configure the App-V client so that only administrators (not end users) can enable or disable connection groups.
    
 
 
 
- 
+ 
 
 
 
@@ -74,9 +77,9 @@ In some previous versions of App-V, connection groups were referred to as Dynami
 
 -   [Operations for App-V](appv-operations.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md
index 3776b26829..dff030f470 100644
--- a/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md
+++ b/windows/application-management/app-v/appv-migrating-to-appv-from-a-previous-version.md
@@ -1,12 +1,15 @@
 ---
 title: Migrating to App-V from a Previous Version (Windows 10)
 description: Migrating to App-V for Windows 10 from a previous version
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 
@@ -52,7 +55,7 @@ You can also use the `–OSDsToIncludeInPackage` parameter with the `ConvertFrom
 
 
 
- 
+ 
 
 ### Example conversion statement
 
@@ -158,7 +161,7 @@ ConvertFrom-AppvLegacyPackage –SourcePath \\OldPkgStore\ContosoApp\
 
 
 
- 
+ 
 
 ## Converting packages created using a prior version of App-V
 
@@ -169,7 +172,7 @@ Use the package converter utility to upgrade virtual application packages create
 **Important**  
 After you convert an existing package you should test the package prior to deploying the package to ensure the conversion process was successful.
 
- 
+ 
 
 **What to know before you convert existing packages**
 
@@ -187,7 +190,7 @@ After you convert an existing package you should test the package prior to deplo
 
 
 
    Virtual packages using DSC are not linked after conversion.
    
-
    Link the packages using connection groups. See [Managing Connection Groups](appv-managing-connection-groups.md).
    
+
    Link the packages using connection groups. See Managing Connection Groups.
    
 
 
 
    Environment variable conflicts are detected during conversion.
    
@@ -200,7 +203,7 @@ After you convert an existing package you should test the package prior to deplo
 
 
 
- 
+ 
 
 When converting a package check for failing files or shortcuts, locate the item in App-V 4.6 package. It could possibly be a hard-coded path. Convert the path.
 
@@ -230,19 +233,19 @@ There is no direct method to upgrade to a full App-V infrastructure. Use the inf
 
 
 
    Review prerequisites.
    
-
    [App-V Server prerequisite software](appv-prerequisites.md#app-v-server-prerequisite-software).
    
+
    App-V Server prerequisite software.
    
 
 
 
    Enable the App-V client.
    
-
    [Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md).
    
+
    Enable the App-V desktop client.
    
 
 
 
    Install App-V Server.
    
-
    [How to Deploy the App-V Server](appv-deploy-the-appv-server.md).
    
+
    How to Deploy the App-V Server.
    
 
 
 
    Migrate existing packages.
    
-
    See [Converting packages created using a prior version of App-V](#converting-packages-created-using-a-prior-version-of-app-v) earlier in this topic.
    
+
    See Converting packages created using a prior version of App-V earlier in this topic.
    
 
 
 
diff --git a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md
index e5e1aae356..e2cb4eca48 100644
--- a/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md
+++ b/windows/application-management/app-v/appv-modify-an-existing-virtual-application-package.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify an Existing Virtual Application Package (Windows 10)
 description: How to Modify an Existing Virtual Application Package
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 
diff --git a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md
index 9f0295e52a..7fe2f3896f 100644
--- a/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md
+++ b/windows/application-management/app-v/appv-modify-client-configuration-with-powershell.md
@@ -1,12 +1,15 @@
 ---
 title: How to Modify Client Configuration by Using Windows PowerShell (Windows 10)
 description: How to Modify Client Configuration by Using Windows PowerShell
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 
diff --git a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md
index 9cee0ac02c..5305207fe6 100644
--- a/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md
+++ b/windows/application-management/app-v/appv-move-the-appv-server-to-another-computer.md
@@ -1,12 +1,15 @@
 ---
 title: How to Move the App-V Server to Another Computer (Windows 10)
 description: How to Move the App-V Server to Another Computer
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 
diff --git a/windows/application-management/app-v/appv-operations.md b/windows/application-management/app-v/appv-operations.md
index 13775f5a7a..c45c9ab9cf 100644
--- a/windows/application-management/app-v/appv-operations.md
+++ b/windows/application-management/app-v/appv-operations.md
@@ -1,12 +1,15 @@
 ---
 title: Operations for App-V (Windows 10)
 description: Operations for App-V
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Operations for App-V
diff --git a/windows/application-management/app-v/appv-performance-guidance.md b/windows/application-management/app-v/appv-performance-guidance.md
index 7c9215a248..65ccf02292 100644
--- a/windows/application-management/app-v/appv-performance-guidance.md
+++ b/windows/application-management/app-v/appv-performance-guidance.md
@@ -1,12 +1,15 @@
 ---
 title: Performance Guidance for Application Virtualization (Windows 10)
 description: Performance Guidance for Application Virtualization
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 
@@ -28,7 +31,7 @@ You should read and understand the following information before reading this doc
 
 -   [Application Publishing and Client Interaction](appv-application-publishing-and-client-interaction.md)
 
--   [App-V Sequencing Guide](https://www.microsoft.com/en-us/download/details.aspx?id=27760)
+-   [App-V Sequencing Guide](https://www.microsoft.com/download/details.aspx?id=27760)
 
 **Note**  
 Some terms used in this document may have different meanings depending on external source and context. For more information about terms used in this document followed by an asterisk * review the [Application Virtualization Performance Guidance Terminology](#bkmk-terms1) section of this document.
@@ -86,7 +89,7 @@ Deployment Environment
 
 
 
- 
+ 
 
 Expected Configuration
 
@@ -107,7 +110,7 @@ Expected Configuration
 
 
 
- 
+ 
 
 IT Administration
 
@@ -124,7 +127,7 @@ IT Administration
 
 
 
- 
+ 
 
 ### Usage Scenarios
 
@@ -144,14 +147,14 @@ As you review the two scenarios, keep in mind that these approach the extremes.
 
 
 
    To provide the most optimal user experience, this approach leverages the capabilities of a UPM solution and requires additional image preparation and can incur some additional image management overhead.
    
-
    The following describes many performance improvements in stateful non-persistent deployments. For more information, see [Sequencing Steps to Optimize Packages for Publishing Performance](#sequencing-steps-to-optimize-packages-for-publishing-performance) later in this topic.
    
+
    The following describes many performance improvements in stateful non-persistent deployments. For more information, see Sequencing Steps to Optimize Packages for Publishing Performance later in this topic.
    
 
    The general expectations of the previous scenario still apply here. However, keep in mind that VM images are typically stored in very costly arrays; a slight alteration has been made to the approach. Do not pre-configure user-targeted virtual application packages in the base image.
    
-
    The impact of this alteration is detailed in the [User Experience Walk-through](#bkmk-uewt) section of this document.
    
+
    The impact of this alteration is detailed in the User Experience Walk-through section of this document.
    
 
 
 
 
- 
+ 
 
 ### Preparing your Environment
 
@@ -174,9 +177,9 @@ The following table displays the required steps to prepare the base image and th
 
 
    
 
      
-
    • Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md).
      • 
+
    • Enable the App-V client as described in Enable the App-V in-box client.
      • 
 
    • Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.
      • 
-
    • Configure for Shared Content Store (SCS) mode. For more information see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).
      • 
+
    • Configure for Shared Content Store (SCS) mode. For more information see Deploying the App-V Sequencer and Configuring the Client.
      • 
 
    • Configure Preserve User Integrations on Login Registry DWORD.
      • 
 
    • Pre-configure all user- and global-targeted packages for example, Add-AppvClientPackage.
      • 
 
    • Pre-configure all user- and global-targeted connection groups for example, Add-AppvClientConnectionGroup.
      • 
@@ -194,9 +197,9 @@ The following table displays the required steps to prepare the base image and th
 
    
 
    
 
      
-
    • Enable the App-V client as described in [Enable the App-V in-box client](appv-enable-the-app-v-desktop-client.md).
      • 
+
    • Enable the App-V client as described in Enable the App-V in-box client.
      • 
 
    • Enable UE-V and download the App-V Settings Template from the UE-V template Gallery, see the following steps.
      • 
-
    • Configure for Shared Content Store (SCS) mode. For more information see [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).
      • 
+
    • Configure for Shared Content Store (SCS) mode. For more information see Deploying the App-V Sequencer and Configuring the Client.
      • 
 
    • Configure Preserve User Integrations on Login Registry DWORD.
      • 
 
    • Pre-configure all global-targeted packages for example, Add-AppvClientPackage.
      • 
 
    • Pre-configure all global-targeted connection groups for example, Add-AppvClientConnectionGroup.
      • 
@@ -207,7 +210,7 @@ The following table displays the required steps to prepare the base image and th
 
 
 
- 
+ 
 
 **Configurations** - For critical App-V Client configurations and for a little more context and how-to, review the following information:
 
@@ -228,7 +231,7 @@ The following table displays the required steps to prepare the base image and th
 
 
      Shared Content Store (SCS) Mode
      
 
        
-
      • Configurable in Windows PowerShell with `Set-AppvClientConfiguration -SharedContentStoreMode 1`
        or configurable with Group Policy, as described in [Deploying the App-V Sequencer and Configuring the Client](appv-deploying-the-appv-sequencer-and-client.md).
        • 
+
      • Configurable in Windows PowerShell with Set-AppvClientConfiguration -SharedContentStoreMode 1
        or configurable with Group Policy, as described in Deploying the App-V Sequencer and Configuring the Client.
        • 
 
      
 
      When running the shared content store only publishing data is maintained on hard disk; other virtual application assets are maintained in memory (RAM).
      
 
      This helps to conserve local storage and minimize disk I/O per second (IOPS).
      
@@ -259,7 +262,7 @@ The following table displays the required steps to prepare the base image and th
 
 
 
- 
+ 
 
 ### Configure UE-V solution for App-V Approach
 
@@ -285,7 +288,7 @@ UE-V will only support removing the .lnk file type from the exclusion list in th
 **Important**  
 This topic describes how to change the Windows registry by using Registry Editor. If you change the Windows registry incorrectly, you can cause serious problems that might require you to reinstall Windows. You should make a backup copy of the registry files (System.dat and User.dat) before you change the registry. Microsoft cannot guarantee that the problems that might occur when you change the registry can be resolved. Change the registry at your own risk.
 
- 
+ 
 
 Using the Microsoft Registry Editor (regedit.exe), navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **UEV** \\ **Agent** \\ **Configuration** \\ **ExcludedFileTypes** and remove **.lnk** from the excluded file types.
 
@@ -308,7 +311,7 @@ To enable an optimized login experience, for example the App-V approach for the
 
     App-V packages are not supported when using UPD with selected folders stored in the user profile disk. The Copy on Write driver does not handle UPD selected folders.
 
-     
+     
 
 -   Capturing changes to the locations, which constitute the user integrations, prior to session logoff.
 
@@ -401,7 +404,7 @@ This following is a step-by-step walk-through of the App-V and UPM operations an
 
 
 
- 
+ 
 
 @@ -426,7 +429,7 @@ This following is a step-by-step walk-through of the App-V and UPM operations an
 
      
 

 
      
 
- 
+ 
 
 ### Impact to Package Life Cycle
 
@@ -513,7 +516,7 @@ Several App-V features facilitate new scenarios or enable new customer deploymen
 
 
 
- 
+ 
 
 ### Removing FB1
 
@@ -552,7 +555,7 @@ Removing FB1 does not require the original application installer. After completi
     **Note**  
     This cmdlet requires an executable (.exe) or batch file (.bat). You must provide an empty (does nothing) executable or batch file.
 
-     
+     
 
 @@ -579,7 +582,7 @@ Removing FB1 does not require the original application installer. After completi
 
      
 

 
      
 
- 
+ 
 
 ### Creating a new virtual application package on the sequencer
 
@@ -616,7 +619,7 @@ When publishing a virtual application package, the App-V Client will detect if a
 
 
 
- 
+ 
 
 ### Disabling a Dynamic Configuration by using Windows PowerShell
 
@@ -666,7 +669,7 @@ For documentation on How to Apply a Dynamic Configuration, see:
 
 
 
- 
+ 
 
 ### Determining what virtual fonts exist in the package
 
diff --git a/windows/application-management/app-v/appv-planning-checklist.md b/windows/application-management/app-v/appv-planning-checklist.md
index fd5a908035..edaf668a89 100644
--- a/windows/application-management/app-v/appv-planning-checklist.md
+++ b/windows/application-management/app-v/appv-planning-checklist.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Planning Checklist (Windows 10)
 description: App-V Planning Checklist
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # App-V Planning Checklist
diff --git a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md
index eb7f2408b6..c9c570009a 100644
--- a/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md
+++ b/windows/application-management/app-v/appv-planning-folder-redirection-with-appv.md
@@ -1,12 +1,15 @@
 ---
 title: Planning to Use Folder Redirection with App-V (Windows 10)
 description: Planning to Use Folder Redirection with App-V
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Planning to Use Folder Redirection with App-V
diff --git a/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md b/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md
index ba19107fe3..eaf7729f22 100644
--- a/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md
+++ b/windows/application-management/app-v/appv-planning-for-appv-server-deployment.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for the App-V Server Deployment (Windows 10)
 description: Planning for the App-V 5.1 Server Deployment
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Planning for the App-V server deployment
diff --git a/windows/application-management/app-v/appv-planning-for-appv.md b/windows/application-management/app-v/appv-planning-for-appv.md
index 826d77a491..d54d848a2c 100644
--- a/windows/application-management/app-v/appv-planning-for-appv.md
+++ b/windows/application-management/app-v/appv-planning-for-appv.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for App-V (Windows 10)
 description: Planning for App-V
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Planning for App-V
diff --git a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md
index 7f372f723d..af66e545e4 100644
--- a/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md
+++ b/windows/application-management/app-v/appv-planning-for-high-availability-with-appv.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for High Availability with App-V Server
 description: Planning for High Availability with App-V Server
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Planning for high availability with App-V Server
@@ -84,8 +87,8 @@ Use the following steps to modify the connection string to include ```failover p
 2. Navigate to **HKEY\_LOCAL\_MACHINE** \\ **Software** \\ **Microsoft** \\ **AppV** \\ **Server** \\ **ManagementService**.
 3. Modify the **MANAGEMENT\_SQL\_CONNECTION\_STRING** value with the ```failover partner = ``` value.
 4. Restart management service using the IIS console.
- >[!NOTE]
- >Database Mirroring is on the list of [deprecated database engine features in SQL Server 2012]() due to the **AlwaysOn** feature available starting with Microsoft SQL Server 2012.
+  > [!NOTE]
+   >Database Mirroring is on the list of [deprecated database engine features in SQL Server 2012]() due to the **AlwaysOn** feature available starting with Microsoft SQL Server 2012.
 
 Click any of the following links for more information:
 
diff --git a/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md b/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md
index edeffdebaf..4fa3630f7f 100644
--- a/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md
+++ b/windows/application-management/app-v/appv-planning-for-sequencer-and-client-deployment.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for the App-V Sequencer and Client Deployment (Windows 10)
 description: Planning for the App-V Sequencer and Client Deployment
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Planning for the App-V Sequencer and Client Deployment
diff --git a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md
index 3a1420dd69..dac8271c33 100644
--- a/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md
+++ b/windows/application-management/app-v/appv-planning-for-using-appv-with-office.md
@@ -1,12 +1,15 @@
 ---
 title: Planning for Deploying App-V with Office (Windows 10)
 description: Planning for Using App-V with Office
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Planning for deploying App-V with Office
@@ -87,11 +90,11 @@ To bypass the auto-registration operation for native Word 2010, follow these ste
 1. Exit Word 2010.
 2. Start the Registry Editor by doing the following:
 
-    * In Windows 7k, select **Start**, type **regedit** in the Start Search box, then select the Enter key.
+   * In Windows 7k, select **Start**, type **regedit** in the Start Search box, then select the Enter key.
 
-    * In Windows 8.1 or Windows 10, enter **regedit**, select **Enter** on the Start page, then select the Enter key.
+   * In Windows 8.1 or Windows 10, enter **regedit**, select **Enter** on the Start page, then select the Enter key.
 
-    If you're prompted for an administrator password, enter the password. If you're prompted for a confirmation, select **Continue**.
+     If you're prompted for an administrator password, enter the password. If you're prompted for a confirmation, select **Continue**.
 3. Locate and then select the following registry subkey:
 
     ``` syntax
@@ -136,4 +139,4 @@ The Office 2013 or Office 2016 App-V package supports the following integration
 
 * [Deploying Microsoft Office 2016 by Using App-V](appv-deploying-microsoft-office-2016-with-appv.md)
 * [Deploying Microsoft Office 2013 by Using App-V](appv-deploying-microsoft-office-2013-with-appv.md)
-* [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md)
\ No newline at end of file
+* [Deploying Microsoft Office 2010 by Using App-V](appv-deploying-microsoft-office-2010-wth-appv.md)
diff --git a/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md b/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md
index d8b89dd307..7c682239c3 100644
--- a/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md
+++ b/windows/application-management/app-v/appv-planning-to-deploy-appv-with-electronic-software-distribution-solutions.md
@@ -1,12 +1,15 @@
 ---
 title: Planning to Deploy App-V with an Electronic Software Distribution System (Windows 10)
 description: Planning to Deploy App-V with an Electronic Software Distribution System
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Planning to Deploy App-V with an electronic software distribution system
@@ -30,4 +33,4 @@ Review the following component and architecture requirements options that apply
 
 * [Planning to deploy App-V](appv-planning-to-deploy-appv.md)
 * [How to deploy App-V packages Using Electronic Software Distribution](appv-deploy-appv-packages-with-electronic-software-distribution-solutions.md)
-* [How to enable only administrators to publish packages by using an ESD](appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md)
\ No newline at end of file
+* [How to enable only administrators to publish packages by using an ESD](appv-enable-administrators-to-publish-packages-with-electronic-software-distribution-solutions.md)
diff --git a/windows/application-management/app-v/appv-planning-to-deploy-appv.md b/windows/application-management/app-v/appv-planning-to-deploy-appv.md
index 24becb67a5..ee9e0b73a9 100644
--- a/windows/application-management/app-v/appv-planning-to-deploy-appv.md
+++ b/windows/application-management/app-v/appv-planning-to-deploy-appv.md
@@ -1,12 +1,15 @@
 ---
 title: Planning to Deploy App-V (Windows 10)
 description: Planning to Deploy App-V
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Planning to Deploy App-V for Windows 10
diff --git a/windows/application-management/app-v/appv-preparing-your-environment.md b/windows/application-management/app-v/appv-preparing-your-environment.md
index 60612d1e5c..57989881e0 100644
--- a/windows/application-management/app-v/appv-preparing-your-environment.md
+++ b/windows/application-management/app-v/appv-preparing-your-environment.md
@@ -1,12 +1,15 @@
 ---
 title: Preparing Your Environment for App-V (Windows 10)
 description: Preparing Your Environment for App-V
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # Preparing your environment for App-V
diff --git a/windows/application-management/app-v/appv-prerequisites.md b/windows/application-management/app-v/appv-prerequisites.md
index 35032ce623..bc458a3f94 100644
--- a/windows/application-management/app-v/appv-prerequisites.md
+++ b/windows/application-management/app-v/appv-prerequisites.md
@@ -1,12 +1,15 @@
 ---
 title: App-V Prerequisites (Windows 10)
 description: App-V Prerequisites
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/18/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # App-V for Windows 10 prerequisites
@@ -160,4 +163,4 @@ What to know before installing the prerequisites:
 ## Related topics
 
 * [Planning for App-V](appv-planning-for-appv.md)
-* [App-V Supported Configurations](appv-supported-configurations.md)
\ No newline at end of file
+* [App-V Supported Configurations](appv-supported-configurations.md)
diff --git a/windows/application-management/app-v/appv-publish-a-connection-group.md b/windows/application-management/app-v/appv-publish-a-connection-group.md
index 2e3e097e03..41d35e29a0 100644
--- a/windows/application-management/app-v/appv-publish-a-connection-group.md
+++ b/windows/application-management/app-v/appv-publish-a-connection-group.md
@@ -1,12 +1,15 @@
 ---
 title: How to Publish a Connection Group (Windows 10)
 description: How to Publish a Connection Group
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 09/27/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to Publish a Connection Group
diff --git a/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md b/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md
index 465bd880a0..cd4469abe5 100644
--- a/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md
+++ b/windows/application-management/app-v/appv-publish-a-packages-with-the-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to publish a package by using the Management console (Windows 10)
 description: How to publish a package by using the Management console.
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 09/27/2018
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ms.topic: article
 ---
 # How to publish a package by using the Management console
@@ -15,8 +18,8 @@ ms.topic: article
 
 Use the following procedure to publish an App-V package. Once you publish a package, computers running the App-V client can access and run the applications in that package.
 
->[!NOTE]  
->The ability to enable only administrators to publish or unpublish packages (described below) is supported starting in App-V 5.0 SP3.
+> [!NOTE]
+> The ability to enable only administrators to publish or unpublish packages (described below) is supported starting in App-V 5.0 SP3.
 
 ## Publish an App-V package
 
@@ -43,4 +46,4 @@ Use the following procedure to publish an App-V package. Once you publish a pack
 ## Related topics
 
 * [Operations for App-V](appv-operations.md)
-* [How to configure access to packages by using the Management console](appv-configure-access-to-packages-with-the-management-console.md)
\ No newline at end of file
+* [How to configure access to packages by using the Management console](appv-configure-access-to-packages-with-the-management-console.md)
diff --git a/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md b/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md
index 14f6f70cad..2134edc7bb 100644
--- a/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md
+++ b/windows/application-management/app-v/appv-register-and-unregister-a-publishing-server-with-the-management-console.md
@@ -1,12 +1,15 @@
 ---
 title: How to Register and Unregister a Publishing Server by Using the Management Console (Windows 10)
 description: How to Register and Unregister a Publishing Server by Using the Management Console
-author: MaggiePucciEvans
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 
diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md
index 46c2626270..dc744d16c2 100644
--- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md
+++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows-1703.md
@@ -1,12 +1,15 @@
 ---
 title: Release Notes for App-V for Windows 10, version 1703 (Windows 10)
 description: A list of known issues and workarounds for App-V running on Windows 10, version 1703.
-author: jdeckerms
+author: lomayor
 ms.pagetype: mdop, appcompat, virtualization
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.prod: w10
 ms.date: 04/19/2017
+ms.reviewer: 
+manager: dansimp
+ms.author: dansimp
 ---
 
 
@@ -25,7 +28,7 @@ The following are known issues and workarounds for Application Virtualization (A
     
         
             Unable to manually create a system-owned folder needed for the set-AppVClientConfiguration PowerShell cmdlet when using the PackageInstallationRoot, IntegrationRootUser, or IntegrationRootGlobal parameters.
-            Don't create this file manually, instead let the Add-AppVClientPackage cmdlet auto-generate it.
+            Don't create this file manually, instead let the Add-AppVClientPackage cmdlet auto-generate it.
         
         
             Failure to update an App-V package from App-V 5.x to the latest in-box version, by using the PowerShell sequencing commands.
@@ -33,71 +36,70 @@ The following are known issues and workarounds for Application Virtualization (A
         
         
             Unable to modify the locale for auto-sequencing.
-            Open the C:\Program Files (x86)\Windows Kits\10\Microsoft Application Virtualization\AutoSequencer\Unattend_Sequencer_User_Setup_Template.xml file and include the language code for your locale. For example, if you wanted Spanish (Spain), you'd use: es-ES.
+            Open the C:\Program Files (x86)\Windows Kits\10\Microsoft Application Virtualization\AutoSequencer\Unattend_Sequencer_User_Setup_Template.xml file and include the language code for your locale. For example, if you wanted Spanish (Spain), you'd use: es-ES.
         
         
-            Filetype and protocol handlers aren't registering properly with the Google Chrome browser, causing you to not see App-V packages as an option for default apps from the Settings > Apps> Default Apps area.
+            Filetype and protocol handlers aren't registering properly with the Google Chrome browser, causing you to not see App-V packages as an option for default apps from the Settings > Apps> Default Apps area.
             The recommended workaround is to add the following code to the AppXManifest.xml file, underneath the <appv:Extensions> tag:
 
      
 <appv:Extension Category="AppV.URLProtocol">
-	<appv:URLProtocol>
-		<appv:Name>ftp</appv:Name>
-		<appv:ApplicationURLProtocol>
-			<appv:DefaultIcon>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe,0</appv:DefaultIcon>
-			<appv:ShellCommands>
-				<appv:DefaultCommand>open</appv:DefaultCommand>
-				<appv:ShellCommand>
-					<appv:ApplicationId>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe</appv:ApplicationId>
-					<appv:Name>open</appv:Name>
-					<appv:CommandLine>"[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe" -- "%1"</appv:CommandLine>
-					<appv:DdeExec>
-						<appv:DdeCommand />
-					</appv:DdeExec>
-				</appv:ShellCommand>
-			</appv:ShellCommands>
-		</appv:ApplicationURLProtocol>
-	</appv:URLProtocol>
+    <appv:URLProtocol>
+        <appv:Name>ftp</appv:Name>
+        <appv:ApplicationURLProtocol>
+            <appv:DefaultIcon>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe,0</appv:DefaultIcon>
+            <appv:ShellCommands>
+                <appv:DefaultCommand>open</appv:DefaultCommand>
+                <appv:ShellCommand>
+                    <appv:ApplicationId>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe</appv:ApplicationId>
+                    <appv:Name>open</appv:Name>
+                    <appv:CommandLine>"[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe" -- "%1"</appv:CommandLine>
+                    <appv:DdeExec>
+                        <appv:DdeCommand />
+                    </appv:DdeExec>
+                </appv:ShellCommand>
+            </appv:ShellCommands>
+        </appv:ApplicationURLProtocol>
+    </appv:URLProtocol>
 </appv:Extension>
 <appv:Extension Category="AppV.URLProtocol">
-	<appv:URLProtocol>
-		<appv:Name>http</appv:Name>
-		<appv:ApplicationURLProtocol>
-			<appv:DefaultIcon>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe,0</appv:DefaultIcon>
-			<appv:ShellCommands>
-				<appv:DefaultCommand>open</appv:DefaultCommand>
-				<appv:ShellCommand>
-					<appv:ApplicationId>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe</appv:ApplicationId>
-					<appv:Name>open</appv:Name>
-					<appv:CommandLine>"[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe" -- "%1"</appv:CommandLine>
-					<appv:DdeExec>
-						<appv:DdeCommand />
-					</appv:DdeExec>
-				</appv:ShellCommand>
-			</appv:ShellCommands>
-		</appv:ApplicationURLProtocol>
-	</appv:URLProtocol>
+    <appv:URLProtocol>
+        <appv:Name>http</appv:Name>
+        <appv:ApplicationURLProtocol>
+            <appv:DefaultIcon>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe,0</appv:DefaultIcon>
+            <appv:ShellCommands>
+                <appv:DefaultCommand>open</appv:DefaultCommand>
+                <appv:ShellCommand>
+                    <appv:ApplicationId>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe</appv:ApplicationId>
+                    <appv:Name>open</appv:Name>
+                    <appv:CommandLine>"[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe" -- "%1"</appv:CommandLine>
+                    <appv:DdeExec>
+                        <appv:DdeCommand />
+                    </appv:DdeExec>
+                </appv:ShellCommand>
+            </appv:ShellCommands>
+        </appv:ApplicationURLProtocol>
+    </appv:URLProtocol>
 </appv:Extension>
 <appv:Extension Category="AppV.URLProtocol">
-	<appv:URLProtocol>
-		<appv:Name>https</appv:Name>
-		<appv:ApplicationURLProtocol>
-			<appv:DefaultIcon>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe,0</appv:DefaultIcon>
-			<appv:ShellCommands>
-				<appv:DefaultCommand>open</appv:DefaultCommand>
-				<appv:ShellCommand>
-					<appv:ApplicationId>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe</appv:ApplicationId>
-					<appv:Name>open</appv:Name>
-					<appv:CommandLine>"[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe" -- "%1"</appv:CommandLine>
-					<appv:DdeExec>
-						<appv:DdeCommand />
-					</appv:DdeExec>
-				</appv:ShellCommand>
-			</appv:ShellCommands>
-		</appv:ApplicationURLProtocol>
-	</appv:URLProtocol>
+    <appv:URLProtocol>
+        <appv:Name>https</appv:Name>
+        <appv:ApplicationURLProtocol>
+            <appv:DefaultIcon>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe,0</appv:DefaultIcon>
+            <appv:ShellCommands>
+                <appv:DefaultCommand>open</appv:DefaultCommand>
+                <appv:ShellCommand>
+                    <appv:ApplicationId>[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe</appv:ApplicationId>
+                    <appv:Name>open</appv:Name>
+                    <appv:CommandLine>"[{ProgramFilesX86}]\Google\Chrome\Application\chrome.exe" -- "%1"</appv:CommandLine>
+                    <appv:DdeExec>
+                        <appv:DdeCommand />
+                    </appv:DdeExec>
+                </appv:ShellCommand>
+            </appv:ShellCommands>
+        </appv:ApplicationURLProtocol>
+    </appv:URLProtocol>
 </appv:Extension>
-
                  
-            
+

    diff --git a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md index 0e199f9a53..704d0954f7 100644 --- a/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md +++ b/windows/application-management/app-v/appv-release-notes-for-appv-for-windows.md @@ -1,12 +1,15 @@ --- title: Release Notes for App-V for Windows 10, version 1607 (Windows 10) description: A list of known issues and workarounds for App-V running on Windows 10, version 1607. -author: jdeckerms +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Release Notes for App-V for Windows 10, version 1607 @@ -33,7 +36,7 @@ MSI packages that were generated using an App-V sequencer from previous versions 4. From an elevated Windows PowerShell prompt, navigate to the following folder: - <Windows Kits 10 installation folder>**\Microsoft Application Virtualization\Sequencer\** + <Windows Kits 10 installation folder>**\Microsoft Application Virtualization\Sequencer\\** By default, this path will be:
    **C:\Program Files (x86)\Windows Kits\10\Microsoft Application Virtualization\Sequencer** @@ -134,14 +137,16 @@ The InsertVersionInfo.sql script is not required for versions of the App-V manag The Permissions.sql script should be updated according to **Step 2** in [KB article 3031340](https://support.microsoft.com/kb/3031340). ->[!IMPORTANT]  ->**Step 1** of the KB article listed above isn't required for versions of App-V later than App-V 5.0 SP3. +> [!IMPORTANT] +> **Step 1** of the KB article listed above isn't required for versions of App-V later than App-V 5.0 SP3. ## Microsoft Visual Studio 2012 not supported App-V doesn't support Visual Studio 2012. **Workaround**: Use a newer version of Microsoft Visual Studio. +Currently, Visual Studio 2012 doesn't support app virtualization, whether using Microsoft App-V or third party solutions such as VMWare ThinApp. While it is possible you might find that Visual Studio works well enough for your purposes when running within one of these environments, we are unable to address any bugs or issues found when running in a virtualized environment at this time. + ## Application filename restrictions for App-V Sequencer The App-V Sequencer cannot sequence applications with filenames matching "CO_<x>" where x is any numeral. Error 0x8007139F will be generated. diff --git a/windows/application-management/app-v/appv-reporting.md b/windows/application-management/app-v/appv-reporting.md index e7c4fe6c64..57a4526ecf 100644 --- a/windows/application-management/app-v/appv-reporting.md +++ b/windows/application-management/app-v/appv-reporting.md @@ -1,12 +1,15 @@ --- title: About App-V Reporting (Windows 10) description: About App-V Reporting -author: MaggiePucciEvans +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/16/2018 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article --- # About App-V reporting @@ -21,15 +24,15 @@ The following list displays the end–to-end high-level workflow for reporting i 1. The App-V Reporting server requires the following things: - * Internet Information Service (IIS) web server role - * Windows Authentication role (under **IIS / Security**) - * SQL Server installed and running with SQL Server Reporting Services (SSRS) + * Internet Information Service (IIS) web server role + * Windows Authentication role (under **IIS / Security**) + * SQL Server installed and running with SQL Server Reporting Services (SSRS) - To confirm SQL Server Reporting Services is running, enter in a web browser as administrator on the server that will host App-V Reporting. The SQL Server Reporting Services Home page should appear. + To confirm SQL Server Reporting Services is running, enter in a web browser as administrator on the server that will host App-V Reporting. The SQL Server Reporting Services Home page should appear. 2. Install the App-V reporting server and associated database. For more information about installing the reporting server see [How to install the Reporting Server on a standalone computer and connect it to the database](appv-install-the-reporting-server-on-a-standalone-computer.md). Configure the time when the computer running the App-V client should send data to the reporting server. -3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at [Application Virtualization SSRS Reports](https://www.microsoft.com/en-us/download/details.aspx?id=42630). +3. If you are not using an electronic software distribution system such as Configuration Manager to view reports then you can define reports in SQL Server Reporting Service. Download predefined appvshort Reports from the Download Center at [Application Virtualization SSRS Reports](https://www.microsoft.com/download/details.aspx?id=42630). - >[!NOTE] + > [!NOTE] >If you are using the Configuration Manager integration with App-V, most reports are generated from Configuration Manager rather than from App-V. 4. After importing the App-V Windows PowerShell module using **Import-Module AppvClient** as administrator, enable App-V client reporting. This sample Windows PowerShell command enables App-V reporting: @@ -43,7 +46,7 @@ The following list displays the end–to-end high-level workflow for reporting i 5. After the reporting server receives the data from the App-V client it sends the data to the reporting database. When the database receives and processes the client data, a successful reply is sent to the reporting server, which then notifies the App-V client. 6. When the App-V client receives the success notification, it empties the data cache to conserve space. - >[!NOTE] + > [!NOTE] >By default, the cache is cleared after the server confirms receipt of data. You can manually configure the client to save the data cache. If the App-V client device does not receive a success notification from the server, it retains data in the cache and tries to resend data at the next configured interval. Clients continue to collect data and add it to the cache. @@ -88,7 +91,7 @@ Yes. Besides manually sending reporting using Windows PowerShell cmdlets (**Send For a complete list of client configuration settings, go to [About client configuration settings](appv-client-configuration-settings.md) and look for the following entries: **ReportingEnabled**, **ReportingServerURL**, **ReportingDataCacheLimit**, **ReportingDataBlockSize**, **ReportingStartTime**, **ReportingRandomDelay**, **ReportingInterval**. * Using Group Policy. If distributed using the domain controller, the settings are the same as previously listed. - >[!NOTE] + > [!NOTE] >Group Policy settings override local settings configured using Windows PowerShell. ## App-V Client reporting @@ -212,4 +215,4 @@ You should also ensure that the reporting server web service’s **Maximum Concu ## Related topics * [Deploying the App-V server](appv-deploying-the-appv-server.md) -* [How to install the reporting server on a standalone computer and connect it to the database](appv-install-the-reporting-server-on-a-standalone-computer.md) \ No newline at end of file +* [How to install the reporting server on a standalone computer and connect it to the database](appv-install-the-reporting-server-on-a-standalone-computer.md) diff --git a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md index 491c148ac7..3befc157bd 100644 --- a/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md +++ b/windows/application-management/app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md @@ -1,12 +1,15 @@ --- title: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications (Windows 10) description: Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications -author: MaggiePucciEvans +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 03/08/2018 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-security-considerations.md b/windows/application-management/app-v/appv-security-considerations.md index 53cf04a9a4..ab6c1c4c32 100644 --- a/windows/application-management/app-v/appv-security-considerations.md +++ b/windows/application-management/app-v/appv-security-considerations.md @@ -1,12 +1,15 @@ --- title: App-V Security Considerations (Windows 10) description: App-V Security Considerations -author: MaggiePucciEvans +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/16/2018 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article --- # App-V security considerations @@ -53,7 +56,7 @@ No groups are created automatically during App-V setup. You should create the fo Consider the following additional information: * Access to the package shares: If a share exists on the same computer as the management Server, the **Network** service requires read access to the share. In addition, each App-V client computer must have read access to the package share. - >[!NOTE] + > [!NOTE] >In previous versions of App-V, package share was referred to as content share. * Registering publishing servers with Management Server: A publishing server must be registered with the Management server. For example, it must be added to the database, so that the Publishing server machine accounts are able to call into the Management service API. @@ -69,4 +72,4 @@ During App-V setup, setup log files are created in the **%temp%** folder of the ## Related topics -[Preparing Your Environment for App-V](appv-preparing-your-environment.md) \ No newline at end of file +[Preparing Your Environment for App-V](appv-preparing-your-environment.md) diff --git a/windows/application-management/app-v/appv-sequence-a-new-application.md b/windows/application-management/app-v/appv-sequence-a-new-application.md index 7a7d54cfee..c3e16261db 100644 --- a/windows/application-management/app-v/appv-sequence-a-new-application.md +++ b/windows/application-management/app-v/appv-sequence-a-new-application.md @@ -1,12 +1,15 @@ --- title: Manually sequence a new app using the Microsoft Application Virtualization Sequencer (App-V Sequencer) (Windows 10) description: How to manually sequence a new app using the App-V Sequencer -author: jdeckerms +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/16/2018 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article --- # Manually sequence a new app using the Microsoft Application Virtualization Sequencer (App-V Sequencer) @@ -52,7 +55,7 @@ In Windows 10, version 1607, the App-V Sequencer is included with the Windows AD 5. On the **Select Installer** page, select **Browse** and specify the installation file for the application. - >[!NOTE] + > [!NOTE] >If the specified application installer modifies security access to a file or directory, existing or new, the associated changes will not be captured into the package. If the application does not have an associated installer file and you plan to run all installation steps manually, select the **Perform a Custom Installation** check box, and then select **Next**. @@ -70,7 +73,7 @@ In Windows 10, version 1607, the App-V Sequencer is included with the Windows AD 9. On the **Configure Software** page, optionally run the programs contained in the package. This step allows you to complete any necessary license or configuration tasks before you deploy and run the package on target computers. To run all the programs at one time, select at least one program, and then select **Run All**. To run specific programs, select the program or programs, and then select **Run Selected**. Complete the required configuration tasks and then close the applications. You may need to wait several minutes for all programs to run. - >[!NOTE] + > [!NOTE] >To run first-use tasks for any application that is not available in the list, open the application. The associated information will be captured during this step. Select **Next**. @@ -86,7 +89,7 @@ In Windows 10, version 1607, the App-V Sequencer is included with the Windows AD 12. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. It can take several minutes for all the applications to run. After all applications have run, close each of the applications, and then select **Next**. - >[!NOTE] + > [!NOTE] >If you do not open any applications during this step, the default streaming method is on-demand streaming delivery. This means applications will be downloaded bit by bit until it can be opened. After that, depending on how the background loading is configured, it will load the rest of the application. 13. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select **Allow this package to run on any operating system**. To configure this package to run only on specific operating systems, select **Allow this package to run only on the following operating systems** and select the operating systems that can run this package. After that, select **Next**. @@ -150,7 +153,7 @@ In Windows 10, version 1607, the App-V Sequencer is included with the Windows AD 13. On the **Streaming** page, run each program so that it can be optimized and run more efficiently on target computers. Streaming improves the experience when the virtual application package is run on target computers on high-latency networks. It can take several minutes for all applications to run. After all applications have run, close each application. You can also configure the package to be required to be fully downloaded before opening by selecting the **Force applications to be downloaded** check-box. Select **Next**. - >[!NOTE] + > [!NOTE] >If necessary, you can stop an application from loading during this step. In the **Application Launch** dialog box, select **Stop** and select one of the check boxes: **Stop all applications** or **Stop this application only**. 14. On the **Target OS** page, specify the operating systems that can run this package. To allow all supported operating systems in your environment to run this package, select the **Allow this package to run on any operating system** check box. To configure this package to run only on specific operating systems, select the **Allow this package to run only on the following operating systems** check box, and then select the operating systems that can run this package. Select **Next**. diff --git a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md index 0a7aece481..349ead11a5 100644 --- a/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md +++ b/windows/application-management/app-v/appv-sequence-a-package-with-powershell.md @@ -1,12 +1,15 @@ --- title: How to sequence a package by using Windows PowerShell (Windows 10) description: How to sequence a package by using Windows PowerShell -author: MaggiePucciEvans +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- @@ -17,10 +20,10 @@ ms.date: 04/19/2017 Use the following procedure to create a new App-V package using Windows PowerShell. -> [!NOTE]   +> [!NOTE] > Before you use this procedure you must copy the associated installer files to the computer running the sequencer and you have read and understand the sequencer section of [Planning for the App-V Sequencer and Client Deployment](appv-planning-for-sequencer-and-client-deployment.md). -  + **To create a new virtual application by using Windows PowerShell** 1. Install the App-V sequencer. For more information about installing the sequencer see [How to Install the Sequencer](appv-install-the-sequencer.md). @@ -62,8 +65,8 @@ The following list displays additional optional parameters that can be used with In Windows 10, version 1703, running the new-appvsequencerpackage or the update-appvsequencepackage cmdlets automatically captures and stores all of your customizations as an App-V project template. If you want to make changes to this package later, your customizations are automatically loaded from this template file. ->[!IMPORTANT] ->If you have an auto-saved template and you attempt to load another template through the _TemplateFilePath_ parameter, the customization value from the parameter will override the auto-saved template. +> [!IMPORTANT] +> If you have an auto-saved template and you attempt to load another template through the _TemplateFilePath_ parameter, the customization value from the parameter will override the auto-saved template. ## Related topics @@ -71,4 +74,4 @@ In Windows 10, version 1703, running the new-appvsequencerpackage or the update- -
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file +
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/application-management/app-v/appv-supported-configurations.md b/windows/application-management/app-v/appv-supported-configurations.md index a28d2875c7..2dce846fd9 100644 --- a/windows/application-management/app-v/appv-supported-configurations.md +++ b/windows/application-management/app-v/appv-supported-configurations.md @@ -1,12 +1,15 @@ --- title: App-V Supported Configurations (Windows 10) description: App-V Supported Configurations -author: MaggiePucciEvans +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/16/2018 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article --- # App-V Supported Configurations @@ -48,11 +51,12 @@ The following table lists the SQL Server versions that the App-V Management data |SQL Server version|Service pack|System architecture| |---|---|---| +|Microsoft SQL Server 2017||32-bit or 64-bit| +|Microsoft SQL Server 2016|SP2|32-bit or 64-bit| |Microsoft SQL Server 2014||32-bit or 64-bit| |Microsoft SQL Server 2012|SP2|32-bit or 64-bit| |Microsoft SQL Server 2008 R2|SP3|32-bit or 64-bit| - ### Publishing server operating system requirements The App-V Publishing server can be installed on a server that runs Windows Server 2008 R2 with SP1 or later. @@ -83,6 +87,8 @@ The following table lists the SQL Server versions that are supported for the App |SQL Server version|Service pack|System architecture| |---|---|---| +|Microsoft SQL Server 2017||32-bit or 64-bit| +|Microsoft SQL Server 2016|SP2|32-bit or 64-bit| |Microsoft SQL Server 2014||32-bit or 64-bit| |Microsoft SQL Server 2012|SP2|32-bit or 64-bit| |Microsoft SQL Server 2008 R2|SP3|32-bit or 64-bit| @@ -118,4 +124,4 @@ The App-V client works with System Center Configuration Manager versions startin ## Related topics * [Planning to deploy App-V](appv-planning-to-deploy-appv.md) -* [App-V prerequisites](appv-prerequisites.md) \ No newline at end of file +* [App-V prerequisites](appv-prerequisites.md) diff --git a/windows/application-management/app-v/appv-technical-reference.md b/windows/application-management/app-v/appv-technical-reference.md index 74aec92cad..e0f6e0f48d 100644 --- a/windows/application-management/app-v/appv-technical-reference.md +++ b/windows/application-management/app-v/appv-technical-reference.md @@ -1,12 +1,15 @@ --- title: Technical Reference for App-V (Windows 10) description: Technical Reference for App-V -author: MaggiePucciEvans +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md b/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md index 89e0d58328..a085b22759 100644 --- a/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md +++ b/windows/application-management/app-v/appv-transfer-access-and-configurations-to-another-version-of-a-package-with-the-management-console.md @@ -1,12 +1,15 @@ --- title: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console (Windows 10) description: How to Transfer Access and Configurations to Another Version of a Package by Using the Management Console -author: MaggiePucciEvans +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-troubleshooting.md b/windows/application-management/app-v/appv-troubleshooting.md index 62e8e04338..fd794d1044 100644 --- a/windows/application-management/app-v/appv-troubleshooting.md +++ b/windows/application-management/app-v/appv-troubleshooting.md @@ -1,12 +1,15 @@ --- title: Troubleshooting App-V (Windows 10) description: Troubleshooting App-V -author: MaggiePucciEvans +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md index 7c30f8d1f3..4aedf60d24 100644 --- a/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md +++ b/windows/application-management/app-v/appv-upgrading-to-app-v-for-windows-10-from-an-existing-installation.md @@ -1,12 +1,15 @@ --- title: Upgrading to App-V for Windows 10 from an existing installation (Windows 10) description: Upgrading to App-V for Windows 10 from an existing installation -author: MaggiePucciEvans +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Upgrading to App-V for Windows 10 from an existing installation @@ -96,4 +99,4 @@ Type the following cmdlet in a Windows PowerShell window: -
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). \ No newline at end of file +
    For App-V issues, use the [App-V TechNet Forum](https://social.technet.microsoft.com/Forums/en-US/home?forum=mdopappv). diff --git a/windows/application-management/app-v/appv-using-the-client-management-console.md b/windows/application-management/app-v/appv-using-the-client-management-console.md index 321ed70eaf..b6691c2fc5 100644 --- a/windows/application-management/app-v/appv-using-the-client-management-console.md +++ b/windows/application-management/app-v/appv-using-the-client-management-console.md @@ -1,12 +1,15 @@ --- title: Using the App-V Client Management Console (Windows 10) description: Using the App-V Client Management Console -author: MaggiePucciEvans +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- @@ -19,10 +22,10 @@ This topic provides information about using the Application Virtualization (App- ## Obtain the client management console -The client management console is separate from the App-V client itself. You can download the client management console from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=41186). +The client management console is separate from the App-V client itself. You can download the client management console from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=41186). -> [!NOTE] -To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V client. +> [!NOTE] +> To perform all of the actions available using the client management console, you must have administrative access on the computer running the App-V client. ## Options for managing the App-V client diff --git a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md b/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md index 64e4b04a27..e949a9406e 100644 --- a/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md +++ b/windows/application-management/app-v/appv-view-and-configure-applications-and-default-virtual-application-extensions-with-the-management-console.md @@ -1,12 +1,15 @@ --- title: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console (Windows 10) description: How to View and Configure Applications and Default Virtual Application Extensions by Using the Management Console -author: MaggiePucciEvans +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- diff --git a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md index 3af98c9c73..eac57684c6 100644 --- a/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md +++ b/windows/application-management/app-v/appv-viewing-appv-server-publishing-metadata.md @@ -1,12 +1,15 @@ --- title: Viewing App-V Server Publishing Metadata (Windows 10) description: Viewing App-V Server Publishing Metadata -author: MaggiePucciEvans +author: lomayor ms.pagetype: mdop, appcompat, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 8eed696dd9..7b5828d9c2 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -1,12 +1,14 @@ --- title: Windows 10 - Apps +ms.reviewer: +manager: dansimp description: What are Windows, UWP, and Win32 apps ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: elizapo -author: lizap +ms.author: dansimp +author: msfttracyp ms.localizationpriority: medium ms.topic: article --- @@ -61,7 +63,7 @@ Here are the provisioned Windows apps in Windows 10 versions 1703, 1709, 1803 an | Microsoft.OneConnect | [Paid Wi-Fi & Cellular](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.People | [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.Print3D | [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | | x | x | x | No | -| Microsoft.SkreenSketch | [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | | | | x | No | +| Microsoft.ScreenSketch | [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | | | | x | No | | Microsoft.SkypeApp | [Skype](ms-windows-store://pdp/?PFN=Microsoft.SkypeApp_kzf8qxf38zg5c) | x | x | x | x | No | | Microsoft.StorePurchaseApp | [Store Purchase App](ms-windows-store://pdp/?PFN=Microsoft.StorePurchaseApp_8wekyb3d8bbwe) | x | x | x | x | No | | Microsoft.VP9VideoExtensions | | | | | x | No | @@ -153,32 +155,34 @@ System apps are integral to the operating system. Here are the typical system ap Here are the typical installed Windows apps in Windows 10 versions 1709, 1803, and 1809. -| Name | Full name | 1709 | 1803 | 1809 | Uninstall through UI? | -|--------------------|------------------------------------------|:----:|:----:|:----:|:---------------------:| -| Remote Desktop | Microsoft.RemoteDesktop | x | | x | Yes | -| Code Writer | ActiproSoftwareLLC.562882FEEB491 | x | x | | Yes | -| Eclipse Manager | 46928bounde.EclipseManager | x | x | | Yes | -| Pandora | PandoraMediaInc.29680B314EFC2 | x | x | | Yes | -| Photoshop Express | AdobeSystemIncorporated. AdobePhotoshop | x | x | | Yes | -| Duolingo | D5EA27B7.Duolingo- LearnLanguagesforFree | x | x | | Yes | -| Network Speed Test | Microsoft.NetworkSpeedTest | x | x | x | Yes | -| News | Microsoft.BingNews | x | x | x | Yes | -| Sway | Microsoft.Office.Sway | x | x | x | Yes | -| Microsoft.Advertising | Microsoft.Advertising.Xaml | x | x | x | Yes | -| | Microsoft.NET.Native.Framework.1.2 | x | x | | Yes | -| | Microsoft.NET.Native.Framework.1.3 | x | x | | Yes | -| | Microsoft.NET.Native.Framework.1.6 | x | x | x | Yes | -| | Microsoft.NET.Native.Framework.1.7 | | x | x | Yes | -| | Microsoft.NET.Native.Framework.2.0 | x | x | | Yes | -| | Microsoft.NET.Native.Runtime.1.1 | x | x | | Yes | -| | Microsoft.NET.Native.Runtime.1.3 | x | | | Yes | -| | Microsoft.NET.Native.Runtime.1.4 | x | x | | Yes | -| | Microsoft.NET.Native.Runtime.1.6 | x | x | x | Yes | -| | Microsoft.NET.Native.Runtime.1.7 | x | x | x | Yes | -| | Microsoft.NET.Native.Runtime.2.0 | x | x | | Yes | -| | Microsoft.Services.Store.Engagement | x | x | | Yes | -| | Microsoft.VCLibs.120.00 | x | x | | Yes | -| | Microsoft.VCLibs.140.00 | x | x | x | Yes | -| | Microsoft.VCLibs.120.00.Universal | x | | | Yes | -| | Microsoft.VCLibs.140.00.UWPDesktop | | x | | Yes | ---- \ No newline at end of file + +| Name | Full name | 1709 | 1803 | 1809 | Uninstall through UI? | +|-----------------------|------------------------------------------|:----:|:----:|:----:|:---------------------:| +| Remote Desktop | Microsoft.RemoteDesktop | x | | x | Yes | +| Code Writer | ActiproSoftwareLLC.562882FEEB491 | x | x | | Yes | +| Eclipse Manager | 46928bounde.EclipseManager | x | x | | Yes | +| Pandora | PandoraMediaInc.29680B314EFC2 | x | x | | Yes | +| Photoshop Express | AdobeSystemIncorporated. AdobePhotoshop | x | x | | Yes | +| Duolingo | D5EA27B7.Duolingo- LearnLanguagesforFree | x | x | | Yes | +| Network Speed Test | Microsoft.NetworkSpeedTest | x | x | x | Yes | +| News | Microsoft.BingNews | x | x | x | Yes | +| Sway | Microsoft.Office.Sway | x | x | x | Yes | +| Microsoft.Advertising | Microsoft.Advertising.Xaml | x | x | x | Yes | +| | Microsoft.NET.Native.Framework.1.2 | x | x | | Yes | +| | Microsoft.NET.Native.Framework.1.3 | x | x | | Yes | +| | Microsoft.NET.Native.Framework.1.6 | x | x | x | Yes | +| | Microsoft.NET.Native.Framework.1.7 | | x | x | Yes | +| | Microsoft.NET.Native.Framework.2.0 | x | x | | Yes | +| | Microsoft.NET.Native.Runtime.1.1 | x | x | | Yes | +| | Microsoft.NET.Native.Runtime.1.3 | x | | | Yes | +| | Microsoft.NET.Native.Runtime.1.4 | x | x | | Yes | +| | Microsoft.NET.Native.Runtime.1.6 | x | x | x | Yes | +| | Microsoft.NET.Native.Runtime.1.7 | x | x | x | Yes | +| | Microsoft.NET.Native.Runtime.2.0 | x | x | | Yes | +| | Microsoft.Services.Store.Engagement | x | x | | Yes | +| | Microsoft.VCLibs.120.00 | x | x | | Yes | +| | Microsoft.VCLibs.140.00 | x | x | x | Yes | +| | Microsoft.VCLibs.120.00.Universal | x | | | Yes | +| | Microsoft.VCLibs.140.00.UWPDesktop | | x | | Yes | + +--- diff --git a/windows/application-management/change-history-for-application-management.md b/windows/application-management/change-history-for-application-management.md index 580efc16c4..fdb6834a7a 100644 --- a/windows/application-management/change-history-for-application-management.md +++ b/windows/application-management/change-history-for-application-management.md @@ -1,16 +1,18 @@ --- title: Change history for Application management in Windows 10 (Windows 10) -description: This topic lists changes to documentation for configuring Windows 10. +description: View changes to documentation for application management in Windows 10. keywords: ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 10/24/2017 +ms.reviewer: +manager: dansimp --- # Change history for Application management in Windows 10 diff --git a/windows/application-management/deploy-app-upgrades-windows-10-mobile.md b/windows/application-management/deploy-app-upgrades-windows-10-mobile.md index 3dffa46062..d176e86059 100644 --- a/windows/application-management/deploy-app-upgrades-windows-10-mobile.md +++ b/windows/application-management/deploy-app-upgrades-windows-10-mobile.md @@ -5,9 +5,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: kaushika-ainapure -author: kaushika-msft +ms.author: dansimp +author: msfttracyp ms.date: 07/21/2017 +ms.reviewer: +manager: dansimp ms.topic: article --- # Deploy application upgrades on Windows 10 Mobile @@ -39,7 +41,7 @@ Before you can deploy the upgrade, make sure you import the new version of the a 4. Click **Add**, browse to the existing (older) version of the app that you're upgrading, and then click **OK**. 5. Under **New Deployment Type** select the new version of the app. (When you imported the new version, it comes in as a new deployment type. If you're upgrading a Universal application, you'll see only one type here.) ![Create a supersedence rule for the new version of the app](media/app-upgrade-supersede-deploy-type.png) - > [!IMPORTANT] + > [!IMPORTANT] > Do **NOT** select **Uninstall**. This tells Configuration Manager to uninstall the old version, but it does **NOT** then install the new version. 6. Click **OK**. @@ -56,4 +58,4 @@ You don't need to delete the deployment associated with the older version of the ![Monitoring view in Configuration Manager for the old version of the app](media/app-upgrade-old-version.png) -If you haven't deployed an app through Configuration Manager before, check out [Deploy applications with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/deploy-applications). You can also see how to delete deployments (although you don't have to) and notify users about the upgraded app. \ No newline at end of file +If you haven't deployed an app through Configuration Manager before, check out [Deploy applications with System Center Configuration Manager](https://docs.microsoft.com/sccm/apps/deploy-use/deploy-applications). You can also see how to delete deployments (although you don't have to) and notify users about the upgraded app. diff --git a/windows/application-management/docfx.json b/windows/application-management/docfx.json index 8cb7d083a0..09bd474c3e 100644 --- a/windows/application-management/docfx.json +++ b/windows/application-management/docfx.json @@ -20,7 +20,7 @@ "files": [ "**/*.png", "**/*.jpg", - "**/*.gif" + "**/*.gif" ], "exclude": [ "**/obj/**", @@ -31,23 +31,23 @@ "overwrite": [], "externalReference": [], "globalMetadata": { - "uhfHeaderId": "MSDocsHeader-WindowsIT", - "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", - "ms.technology": "windows", - "ms.topic": "article", - "ms.author": "elizapo", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", - "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "MSDN.win-app-management" - } - } - }, + "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "ms.technology": "windows", + "audience": "ITPro", + "ms.topic": "article", + "ms.author": "elizapo", + "feedback_system": "None", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "MSDN.win-app-management", + "folder_relative_path_in_docset": "./" + } + }, + "titleSuffix": "Windows Application Management" + }, "fileMetadata": {}, "template": [], "dest": "win-app-management", - "markdownEngineName": "dfm" + "markdownEngineName": "markdig" } -} \ No newline at end of file +} diff --git a/windows/application-management/enterprise-background-activity-controls.md b/windows/application-management/enterprise-background-activity-controls.md index 74e71f0072..dc56d686c7 100644 --- a/windows/application-management/enterprise-background-activity-controls.md +++ b/windows/application-management/enterprise-background-activity-controls.md @@ -1,12 +1,13 @@ --- -author: TylerMSFT +author: dansimp title: Remove background task resource restrictions description: Allow enterprise background tasks unrestricted access to computer resources. -ms.author: twhitney +ms.author: dansimp ms.date: 10/03/2017 +ms.reviewer: +manager: dansimp ms.topic: article ms.prod: w10 -ms.technology: uwp keywords: windows 10, uwp, enterprise, background task, resources --- diff --git a/windows/application-management/index.md b/windows/application-management/index.md index 31196fe532..fef303c216 100644 --- a/windows/application-management/index.md +++ b/windows/application-management/index.md @@ -4,9 +4,9 @@ description: Windows 10 application management ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +manager: dansimp +author: dansimp ms.localizationpriority: high -ms.date: 09/26/2017 --- # Windows 10 application management diff --git a/windows/application-management/manage-windows-mixed-reality.md b/windows/application-management/manage-windows-mixed-reality.md index 20b71d39e8..205e2c3711 100644 --- a/windows/application-management/manage-windows-mixed-reality.md +++ b/windows/application-management/manage-windows-mixed-reality.md @@ -1,58 +1,55 @@ --- title: Enable or block Windows Mixed Reality apps in the enterprise (Windows 10) +ms.reviewer: +manager: dansimp description: Learn how to enable or block Windows Mixed Reality apps. keyboards: ["mr", "mr portal", "mixed reality portal", "mixed reality"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article -ms.date: 10/02/2018 --- # Enable or block Windows Mixed Reality apps in the enterprise **Applies to** -- Windows 10 +- Windows 10 [Windows Mixed Reality](https://blogs.windows.com/windowsexperience/2017/10/03/the-era-of-windows-mixed-reality-begins-october-17/) was introduced in Windows 10, version 1709 (also known as the Fall Creators Update), as a [Windows 10 Feature on Demand (FOD)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). Features on Demand are Windows feature packages that can be added at any time. When a Windows 10 PC needs a new feature, it can request the feature package from Windows Update. -Organizations that use Windows Server Update Services (WSUS) must take action to [enable Windows Mixed Reality](#enable). Any organization that wants to prohibit use of Windows Mixed Reality can [block the installation of the Mixed Reality Portal](#block). +Organizations that use Windows Server Update Services (WSUS) must take action to [enable Windows Mixed Reality](#enable-windows-mixed-reality-in-wsus). Any organization that wants to prohibit use of Windows Mixed Reality can [block the installation of the Mixed Reality Portal](#block-the-mixed-reality-portal). - - ## Enable Windows Mixed Reality in WSUS 1. [Check your version of Windows 10.](https://support.microsoft.com/help/13443/windows-which-operating-system) - >[!NOTE] - >You must be on at least Windows 10, version 1709, to run Windows Mixed Reality. + >[!NOTE] + >You must be on at least Windows 10, version 1709, to run Windows Mixed Reality. 2. Windows Mixed Reality Feature on Demand (FOD) is downloaded from Windows Update. If access to Windows Update is blocked, you must manually install the Windows Mixed Reality FOD. - a. Download the FOD .cab file for [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab), [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), or [Windows 10, version 1709](http://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab). + a. Download the FOD .cab file for [Windows 10, version 1903](https://software-download.microsoft.com/download/pr/Microsoft-Windows-Holographic-Desktop-FOD-Package-31bf3856ad364e35-amd64.cab), [Windows 10, version 1809](https://software-download.microsoft.com/download/pr/microsoft-windows-holographic-desktop-fod-package31bf3856ad364e35amd64_1.cab), [Windows 10, version 1803](https://download.microsoft.com/download/9/9/3/9934B163-FA01-4108-A38A-851B4ACD1244/Microsoft-Windows-Holographic-Desktop-FOD-Package~31bf3856ad364e35~amd64~~.cab), or [Windows 10, version 1709](https://download.microsoft.com/download/6/F/8/6F816172-AC7D-4F45-B967-D573FB450CB7/Microsoft-Windows-Holographic-Desktop-FOD-Package.cab). - >[!NOTE] - >You must download the FOD .cab file that matches your operating system version. + >[!NOTE] + >You must download the FOD .cab file that matches your operating system version. - b. Use `Add-Package` to add Windows Mixed Reality FOD to the image. + b. Use `Add-Package` to add Windows Mixed Reality FOD to the image. ``` Add-Package Dism /Online /add-package /packagepath:(path) ``` - c. In **Settings** > **Update & Security** > **Windows Update**, select **Check for updates**. + c. In **Settings** > **Update & Security** > **Windows Update**, select **Check for updates**. IT admins can also create [Side by side feature store (shared folder)](https://technet.microsoft.com/library/jj127275.aspx) to allow access to the Windows Mixed Reality FOD. - - ## Block the Mixed Reality Portal You can use the [AppLocker configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp) to block the Mixed Reality software. @@ -73,32 +70,31 @@ In the following example, the **Id** can be any generated GUID and the **Name** text/plain - <RuleCollection Type="Appx" EnforcementMode="Enabled"> - <FilePublisherRule Id="a9e18c21-ff8f-43cf-b9fc-db40eed693ba" Name="(Default Rule) All signed packaged apps" Description="Allows members of the Everyone group to run packaged apps that are signed." UserOrGroupSid="S-1-1-0" Action="Allow"> - <Conditions> - <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> - <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> - </FilePublisherCondition> - </Conditions> - </FilePublisherRule> - <FilePublisherRule Id="d26da4e7-0b01-484d-a8d3-d5b5341b2d55" Name="Block Mixed Reality Portal" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> - <Conditions> - <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.HolographicFirstRun" BinaryName="*"> - <BinaryVersionRange LowSection="*" HighSection="*" /> - </FilePublisherCondition> - </Conditions> - </FilePublisherRule> - </RuleCollection>> + + + + + + + + + + + + + + + + > - ``` ## Related topics -- [Mixed reality](https://developer.microsoft.com/windows/mixed-reality/mixed_reality) \ No newline at end of file +- [Mixed reality](https://developer.microsoft.com/windows/mixed-reality/mixed_reality) diff --git a/windows/application-management/msix-app-packaging-tool.md b/windows/application-management/msix-app-packaging-tool.md index 0197cc67d9..adcf842841 100644 --- a/windows/application-management/msix-app-packaging-tool.md +++ b/windows/application-management/msix-app-packaging-tool.md @@ -6,9 +6,12 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: medium -ms.author: mikeblodge +ms.author: dansimp ms.topic: article ms.date: 12/03/2018 +ms.reviewer: +manager: dansimp +author: msfttracyp --- # Repackage existing win32 applications to the MSIX format @@ -34,4 +37,4 @@ You can either run your installer interactively (through the UI) or create a pac 1. Use the MSA login associated with your Windows Insider Program credentials in the [Microsoft Store](https://www.microsoft.com/store/r/9N5LW3JBCXKF). 2. Open the product description page. -3. Click the install icon to begin installation. \ No newline at end of file +3. Click the install icon to begin installation. diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 1391890a98..1100a66787 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -1,13 +1,15 @@ --- -title: Per-user services in Windows 10 and Windows Server +title: Per-user services in Windows 10 and Windows Server description: Learn about per-user services introduced in Windows 10. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: elizapo -author: lizap +ms.author: dansimp +author: msfttracyp ms.date: 09/14/2017 +ms.reviewer: +manager: dansimp --- # Per-user services in Windows 10 and Windows Server @@ -90,7 +92,7 @@ Revision=1 If a per-user service can't be disabled using a the security template, you can disable it by using Group Policy preferences. -1. On a Windows Server domain controller or Windows 10 PC that has the [Remote Server Administration Tools (RSAT)](https://www.microsoft.com/en-us/download/details.aspx?id=45520) installed, click **Start**, type GPMC.MSC, and then press **Enter** to open the **Group Policy Management Console**. +1. On a Windows Server domain controller or Windows 10 PC that has the [Remote Server Administration Tools (RSAT)](https://www.microsoft.com/download/details.aspx?id=45520) installed, click **Start**, type GPMC.MSC, and then press **Enter** to open the **Group Policy Management Console**. 2. Create a new Group Policy Object (GPO) or use an existing GPO. @@ -170,7 +172,7 @@ Set-Service -StartupType Disabled ## View per-user services in the Services console (services.msc) -As mentioned you can't view the template services in the Services console, but you can see the user-specific per-user services - they are displayed using the _LUID format (where LUID is the locally unique identifier). +As mentioned you can't view the template services in the Services console, but you can see the user-specific per-user services - they are displayed using the \_LUID format (where LUID is the locally unique identifier). For example, you might see the following per-user services listed in the Services console: diff --git a/windows/application-management/remove-provisioned-apps-during-update.md b/windows/application-management/remove-provisioned-apps-during-update.md index 489c97927a..27c49f97ae 100644 --- a/windows/application-management/remove-provisioned-apps-during-update.md +++ b/windows/application-management/remove-provisioned-apps-during-update.md @@ -4,9 +4,11 @@ description: How to keep provisioned apps that were removed from your machine fr ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.author: helohr -author: HeidiLohr +ms.author: dansimp +author: msfttracyp ms.date: 05/25/2018 +ms.reviewer: +manager: dansimp --- # How to keep apps removed from Windows 10 from returning during an update @@ -17,17 +19,20 @@ When you update a computer running Windows 10, version 1703 or 1709, you might s >[!NOTE] >* This issue only occurs after a feature update (from one version to the next), not monthly updates or security-related updates. >* This only applies to first-party apps that shipped with Windows 10. This doesn't apply to third-party apps, Microsoft Store apps, or LOB apps. +>* This issue can occur whether you removed the app using `Remove-appxprovisionedpackage` or `Get-AppxPackage -allusers | Remove-AppxPackage -Allusers`. -To remove a provisioned app, you need to remove the provisioning package. The apps might reappear if you removed the packages in one of the following ways: +To remove a provisioned app, you need to remove the provisioning package. The apps might reappear if you [removed the packages](https://docs.microsoft.com/powershell/module/dism/remove-appxprovisionedpackage) in one of the following ways: * If you removed the packages while the wim file was mounted when the device was offline. * If you removed the packages by running a PowerShell cmdlet on the device while Windows was online. Although the apps won't appear for new users, you'll still see the apps for the user account you signed in as. -When you remove a provisioned app, we create a registry key that tells Windows not to reinstall or update that app the next time Windows is updated. If the computer isn't online when you deprovision the app, then we don't create that registry key. (This behavior is fixed in Windows 10, version 1803. If you're running Windows 10, version 1709, apply the latest security update to fix it.) +When you [remove a provisioned app](https://docs.microsoft.com/powershell/module/dism/remove-appxprovisionedpackage), we create a registry key that tells Windows not to reinstall or update that app the next time Windows is updated. If the computer isn't online when you deprovision the app, then we don't create that registry key. (This behavior is fixed in Windows 10, version 1803. If you're running Windows 10, version 1709, apply the latest security update to fix it.) + >[!NOTE] >If you remove a provisioned app while Windows is online, it's only removed for *new users*—the user that you signed in as will still have that provisioned app. That's because the registry key created when you deprovision the app only applies to new users created *after* the key is created. This doesn't happen if you remove the provisioned app while Windows is offline. + To prevent these apps from reappearing at the next update, manually create a registry key for each app, then update the computer. ## Create registry keys for deprovisioned apps @@ -36,12 +41,12 @@ Use the following steps to create a registry key: 1. Identify any provisioned apps you want removed. Record the package name for each app. 2. Create a .reg file to generate a registry key for each app. Use [this list of Windows 10, version 1709 registry keys](#registry-keys-for-provisioned-apps) as your starting point. - 1. Paste the list of registry keys into Notepad (or a text editor). - 2. Remove the registry keys belonging to the apps you want to keep. For example, if you want to keep the Bing Weather app, delete this registry key: - ``` - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\A ppxAllUserStore\Deprovisioned\Microsoft.BingWeather_8wekyb3d8bbwe] - ``` - 3. Save the file with a .txt extension, then right-click the file and change the extension to .reg. + 1. Paste the list of registry keys into Notepad (or a text editor). + 2. Remove the registry keys belonging to the apps you want to keep. For example, if you want to keep the Bing Weather app, delete this registry key: + ```yaml + HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\A ppxAllUserStore\Deprovisioned\Microsoft.BingWeather_8wekyb3d8bbwe] + ``` + 3. Save the file with a .txt extension, then right-click the file and change the extension to .reg. 3. Double-click the .reg file to create the registry keys. You can see the new keys in HKLM\\path-to-reg-keys. You're now ready to update your computer. After the update, check the list of apps in the computer to confirm the removed apps are still gone. @@ -157,4 +162,14 @@ Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneMusic_8wekyb3d8bbwe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.ZuneVideo_8wekyb3d8bbwe] -``` + +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.3DBuilder_8wekyb3d8bbwe] + +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.HEVCVideoExtension_8wekyb3d8bbwe] + +[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deprovisioned\Microsoft.Messaging_8wekyb3d8bbwe] +``` + +[Get-AppxPackage](https://docs.microsoft.com/powershell/module/appx/get-appxpackage) +[Get-AppxPackage -allusers](https://docs.microsoft.com/powershell/module/appx/get-appxpackage) +[Remove-AppxPackage](https://docs.microsoft.com/powershell/module/appx/remove-appxpackage) diff --git a/windows/application-management/sideload-apps-in-windows-10.md b/windows/application-management/sideload-apps-in-windows-10.md index cd7c59e6d2..2dc4591d51 100644 --- a/windows/application-management/sideload-apps-in-windows-10.md +++ b/windows/application-management/sideload-apps-in-windows-10.md @@ -2,12 +2,15 @@ title: Sideload LOB apps in Windows 10 (Windows 10) description: Sideload line-of-business apps in Windows 10. ms.assetid: C46B27D0-375B-4F7A-800E-21595CF1D53D +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -author: greg-lindsay -ms.date: 04/19/2017 +author: msfttracyp +ms.date: 05/20/2019 --- # Sideload LOB apps in Windows 10 @@ -16,6 +19,9 @@ ms.date: 04/19/2017 - Windows 10 - Windows 10 Mobile +> [!NOTE] +> As of Windows Insider Build 18956, sideloading is enabled by default. Now, you can deploy a signed package onto a device without a special configuration. + "Line-of-Business" (LOB) apps are present in a wide range of businesses and organizations. Organizations value these apps because they solve problems unique to each business. When you sideload an app, you deploy a signed app package to a device. You maintain the signing, hosting, and deployment of these apps. Sideloading was also available with Windows 8 and Windows 8.1 @@ -48,10 +54,16 @@ And here's what you'll need to do: ## How do I sideload an app on desktop You can sideload apps on managed or unmanaged devices. +>[!IMPORTANT] +> To install an app on Windows 10, in addition to following [these procedures](https://docs.microsoft.com/windows/msix/app-installer/installing-windows10-apps-web), users can also double-click any APPX/MSIX package. + + **To turn on sideloading for managed devices** - Deploy an enterprise policy. + + **To turn on sideloading for unmanaged devices** 1. Open **Settings**. diff --git a/windows/application-management/svchost-service-refactoring.md b/windows/application-management/svchost-service-refactoring.md index e2c31b7f81..3bd1bf1897 100644 --- a/windows/application-management/svchost-service-refactoring.md +++ b/windows/application-management/svchost-service-refactoring.md @@ -5,9 +5,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: kaushika-ainapure -author: kaushika-msft +ms.author: dansimp +author: msfttracyp ms.date: 07/20/2017 +ms.reviewer: +manager: dansimp --- # Changes to Service Host grouping in Windows 10 @@ -38,8 +40,8 @@ Benefits of this design change include: >**Try This** > > To see the refactoring behavior, create a Windows 10 version 1703 VM and configure the memory settings as follows: -> 1. To see grouped processes, set the RAM to 3484 MB or less. Restart the VM and then open Task Manager. -> 2. To see separated processes, set the RAM to 3486 MB or greater. Restart the VM and then open Task Manager. +> 1. To see grouped processes, set the RAM to 3484 MB or less. Restart the VM and then open Task Manager. +> 2. To see separated processes, set the RAM to 3486 MB or greater. Restart the VM and then open Task Manager. Refactoring also makes it easier to view running processes in Task Manager. You can look at Task Manager and know exactly which service is using what resources, without having to expand many separate host groups. diff --git a/windows/client-management/TOC.md b/windows/client-management/TOC.md index d3c28bfc73..cb93e0fb3b 100644 --- a/windows/client-management/TOC.md +++ b/windows/client-management/TOC.md @@ -4,6 +4,7 @@ ## [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md) ## [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md) ## [New policies for Windows 10](new-policies-for-windows-10.md) +## [Windows 10 default media removal policy](change-default-removal-policy-external-storage-media.md) ## [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) ## [Manage the Settings app with Group Policy](manage-settings-app-with-group-policy.md) ## [What version of Windows am I running](windows-version-search.md) @@ -22,9 +23,14 @@ ##### [Troubleshoot port exhaustion](troubleshoot-tcpip-port-exhaust.md) ##### [Troubleshoot Remote Procedure Call (RPC) errors](troubleshoot-tcpip-rpc-errors.md) ### [Advanced troubleshooting for Windows startup](troubleshoot-windows-startup.md) +#### [How to determine the appropriate page file size for 64-bit versions of Windows](determine-appropriate-page-file-size.md) +#### [Generate a kernel or complete crash dump](generate-kernel-or-complete-crash-dump.md) +#### [Introduction to the page file](introduction-page-file.md) +#### [Configure system failure and recovery options in Windows](system-failure-recovery-options.md) #### [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md) #### [Advanced troubleshooting for Windows-based computer freeze](troubleshoot-windows-freeze.md) #### [Advanced troubleshooting for stop error or blue screen error](troubleshoot-stop-errors.md) #### [Advanced troubleshooting for stop error 7B or Inaccessible_Boot_Device](troubleshoot-inaccessible-boot-device.md) +#### [Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md) ## [Mobile device management for solution providers](mdm/index.md) ## [Change history for Client management](change-history-for-client-management.md) diff --git a/windows/client-management/administrative-tools-in-windows-10.md b/windows/client-management/administrative-tools-in-windows-10.md index bab488fec7..35c0f225b0 100644 --- a/windows/client-management/administrative-tools-in-windows-10.md +++ b/windows/client-management/administrative-tools-in-windows-10.md @@ -2,10 +2,13 @@ title: Administrative Tools in Windows 10 (Windows 10) description: Administrative Tools is a folder in Control Panel that contains tools for system administrators and advanced users. ms.assetid: FDC63933-C94C-43CB-8373-629795926DC8 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 07/27/2017 ms.topic: article @@ -28,7 +31,7 @@ The tools in the folder might vary depending on which edition of Windows you are These tools were included in previous versions of Windows and the associated documentation for each tool should help you use these tools in Windows 10. The following list links to documentation for each tool. -  + - [Component Services]( https://go.microsoft.com/fwlink/p/?LinkId=708489) - [Computer Management](https://support.microsoft.com/kb/308423) @@ -48,14 +51,14 @@ These tools were included in previous versions of Windows and the associated doc - [Windows Firewall with Advanced Security](https://go.microsoft.com/fwlink/p/?LinkId=708503) - [Windows Memory Diagnostic]( https://go.microsoft.com/fwlink/p/?LinkId=708507) ->[!TIP]   ->If the content that is linked to a tool in the following list doesn't provide the information you need to use that tool, send us a comment by using the **Was this page helpful?** feature on this **Administrative Tools in Windows 10** page. Details about the information you want for a tool will help us plan future content.  +> [!TIP] +> If the content that is linked to a tool in the following list doesn't provide the information you need to use that tool, send us a comment by using the **Was this page helpful?** feature on this **Administrative Tools in Windows 10** page. Details about the information you want for a tool will help us plan future content.  ## Related topics [Diagnostic Data Viewer](https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overview) -  + diff --git a/windows/client-management/advanced-troubleshooting-802-authentication.md b/windows/client-management/advanced-troubleshooting-802-authentication.md index 2a6671c21f..267386adc6 100644 --- a/windows/client-management/advanced-troubleshooting-802-authentication.md +++ b/windows/client-management/advanced-troubleshooting-802-authentication.md @@ -1,13 +1,15 @@ --- title: Advanced Troubleshooting 802.1X Authentication +ms.reviewer: +manager: dansimp description: Learn how 802.1X Authentication works keywords: advanced troubleshooting, 802.1X authentication, troubleshooting, authentication, Wi-Fi ms.prod: w10 -ms.mktglfcycl: +ms.mktglfcycl: ms.sitesec: library -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: greg-lindsay +ms.author: tracyp ms.topic: troubleshooting --- @@ -15,7 +17,7 @@ ms.topic: troubleshooting ## Overview -This is a general troubleshooting of 802.1X wireless and wired clients. With 802.1X and wireless troubleshooting, it's important to know how the flow of authentication works, and then figuring out where it's breaking. It involves a lot of third party devices and software. Most of the time, we have to identify where the problem is, and another vendor has to fix it. Since we don't make access points or wwitches, it won't be an end-to-end Microsoft solution. +This is a general troubleshooting of 802.1X wireless and wired clients. With 802.1X and wireless troubleshooting, it's important to know how the flow of authentication works, and then figuring out where it's breaking. It involves a lot of third party devices and software. Most of the time, we have to identify where the problem is, and another vendor has to fix it. Since we don't make access points or switches, it won't be an end-to-end Microsoft solution. ## Scenarios @@ -67,7 +69,7 @@ This log is not enabled by default. You can enable this log by expanding **Event ![screenshot of event viewer](images/capi.png) The following article explains how to analyze CAPI2 event logs: -[Troubleshooting PKI Problems on Windows Vista](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc749296%28v=ws.10%29). +[Troubleshooting PKI Problems on Windows Vista](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-vista/cc749296%28v=ws.10%29). When troubleshooting complex 802.1X authentication issues, it is important to understand the 802.1X authentication process. The following figure is an example of wireless connection process with 802.1X authentication: diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index 101ca103bc..5986263a1e 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -1,31 +1,33 @@ --- title: Advanced troubleshooting for Windows boot problems -description: Learn how to troubleshoot when Windows is unable to boot +description: Learn how to troubleshoot when Windows is unable to boot ms.prod: w10 ms.sitesec: library -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: elizapo +ms.author: dansimp ms.date: 11/16/2018 +ms.reviewer: +manager: dansimp ms.topic: troubleshooting --- # Advanced troubleshooting for Windows boot problems ->[!NOTE] ->This article is intended for use by support agents and IT professionals. If you're looking for more general information about recovery options, see [Recovery options in Windows 10](https://support.microsoft.com/help/12415). +> [!NOTE] +> This article is intended for use by support agents and IT professionals. If you're looking for more general information about recovery options, see [Recovery options in Windows 10](https://support.microsoft.com/help/12415). ## Summary There are several reasons why a Windows-based computer may have problems during startup. To troubleshoot boot problems, first determine in which of the following phases the computer gets stuck: -| **Phase** | **Boot Process** | **BIOS** | **UEFI** | -|--------|----------------------|------------------------------| | -| 1 | PreBoot | MBR/PBR (Bootstrap Code) | UEFI Firmware | -| 2 | Windows Boot Manager | %SystemDrive%\bootmgr | \EFI\Microsoft\Boot\bootmgfw.efi | -| 3 | Windows OS Loader | %SystemRoot%\system32\winload.exe | %SystemRoot%\system32\winload.efi | -| 4 | Windows NT OS Kernel | %SystemRoot%\system32\ntoskrnl.exe | | +| **Phase** | **Boot Process** | **BIOS** | **UEFI** | +|-----------|----------------------|------------------------------------|-----------------------------------| +| 1 | PreBoot | MBR/PBR (Bootstrap Code) | UEFI Firmware | +| 2 | Windows Boot Manager | %SystemDrive%\bootmgr | \EFI\Microsoft\Boot\bootmgfw.efi | +| 3 | Windows OS Loader | %SystemRoot%\system32\winload.exe | %SystemRoot%\system32\winload.efi | +| 4 | Windows NT OS Kernel | %SystemRoot%\system32\ntoskrnl.exe | | **1. PreBoot** @@ -56,14 +58,14 @@ Here is a summary of the boot sequence, what will be seen on the display, and ty Each phase has a different approach to troubleshooting. This article provides troubleshooting techniques for problems that occur during the first three phases. ->[!NOTE] ->If the computer repeatedly boots to the recovery options, run the following command at a command prompt to break the cycle: +> [!NOTE] +> If the computer repeatedly boots to the recovery options, run the following command at a command prompt to break the cycle: > ->`Bcdedit /set {default} recoveryenabled no` +> `Bcdedit /set {default} recoveryenabled no` > ->If the F8 options don't work, run the following command: +> If the F8 options don't work, run the following command: > ->`Bcdedit /set {default} bootmenupolicy legacy` +> `Bcdedit /set {default} bootmenupolicy legacy` ## BIOS phase @@ -96,11 +98,10 @@ The Startup Repair tool automatically fixes many common problems. The tool also To do this, follow these steps. ->[!NOTE] ->For additional methods to start WinRE, see [Entry points into WinRE](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference#span-identrypointsintowinrespanspan-identrypointsintowinrespanspan-identrypointsintowinrespanentry-points-into-winre). +> [!NOTE] +> For additional methods to start WinRE, see [Windows Recovery Environment (Windows RE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference#span-identrypointsintowinrespanspan-identrypointsintowinrespanspan-identrypointsintowinrespanentry-points-into-winre). -1. Start the system to the installation media for the installed version of Windows. - **Note** For more information, see [Create installation media for Windows](https://support.microsoft.com/help/15088). +1. Start the system to the installation media for the installed version of Windows. For more information, see [Create installation media for Windows](https://support.microsoft.com/help/15088). 2. On the **Install Windows** screen, select **Next** > **Repair your computer**. @@ -130,8 +131,8 @@ To repair the boot sector, run the following command: BOOTREC /FIXBOOT ``` ->[!NOTE] ->Running **BOOTREC** together with **Fixmbr** overwrites only the master boot code. If the corruption in the MBR affects the partition table, running **Fixmbr** may not fix the problem. +> [!NOTE] +> Running **BOOTREC** together with **Fixmbr** overwrites only the master boot code. If the corruption in the MBR affects the partition table, running **Fixmbr** may not fix the problem. ### Method 3: Fix BCD errors @@ -150,20 +151,25 @@ If you receive BCD-related errors, follow these steps: ``` 4. You might receive one of the following outputs: - - - Scanning all disks for Windows installations. Please wait, since this may take a while...Successfully scanned Windows installations. Total identified Windows installations: 0 + ```dos + Scanning all disks for Windows installations. Please wait, since this may take a while ... + Successfully scanned Windows installations. Total identified Windows installations: 0 The operation completed successfully. + ``` - - Scanning all disks for Windows installations. Please wait, since this may take a while... Successfully scanned Windows installations. Total identified Windows installations: 1 + ```dos + Scanning all disks for Windows installations. Please wait, since this may take a while ... + Successfully scanned Windows installations. Total identified Windows installations: 1 D:\Windows Add installation to boot list? Yes/No/All: + ``` If the output shows **windows installation: 0**, run the following commands: ```dos bcdedit /export c:\bcdbackup -attrib c:\\boot\\bcd -h -r –s +attrib c:\\boot\\bcd -r –s -h ren c:\\boot\\bcd bcd.old @@ -172,39 +178,41 @@ bootrec /rebuildbcd After you run the command, you receive the following output: - Scanning all disks for Windows installations. Please wait, since this may take a while...Successfully scanned Windows installations. Total identified Windows installations: 1{D}:\Windows +```dos +Scanning all disks for Windows installations. Please wait, since this may take a while ... +Successfully scanned Windows installations. Total identified Windows installations: 1 +{D}:\Windows Add installation to boot list? Yes/No/All: Y +``` -5. Try again to start the system. +5. Try restarting the system. ### Method 4: Replace Bootmgr -If methods 1 and 2 do not fix the problem, replace the Bootmgr file from drive C to the System Reserved partition. To do this, follow these steps: +If methods 1, 2 and 3 do not fix the problem, replace the Bootmgr file from drive C to the System Reserved partition. To do this, follow these steps: 1. At a command prompt, change the directory to the System Reserved partition. 2. Run the **attrib** command to unhide the file: ```dos - attrib-s -h -r + attrib -r -s -h ``` 3. Run the same **attrib** command on the Windows (system drive): ```dos - attrib-s -h –r + attrib -r -s -h ``` 4. Rename the Bootmgr file as Bootmgr.old: ```dos - ren c:\\bootmgr bootmgr.old + ren c:\bootmgr bootmgr.old ``` -5. Start a text editor, such as Notepad. +5. Navigate to the system drive. -6. Navigate to the system drive. +6. Copy the Bootmgr file, and then paste it to the System Reserved partition. -7. Copy the Bootmgr file, and then paste it to the System Reserved partition. - -8. Restart the computer. +7. Restart the computer. ### Method 5: Restore System Hive @@ -212,7 +220,6 @@ If Windows cannot load the system registry hive into memory, you must restore th If the problem persists, you may want to restore the system state backup to an alternative location, and then retrieve the registry hives to be replaced. - ## Kernel Phase If the system gets stuck during the kernel phase, you experience multiple symptoms or receive multiple error messages. These include, but are not limited to, the following: @@ -220,8 +227,9 @@ If the system gets stuck during the kernel phase, you experience multiple sympto - A Stop error appears after the splash screen (Windows Logo screen). - Specific error code is displayed. - For example, "0x00000C2" , "0x0000007B" , "inaccessible boot device" and so on. - (To troubleshoot the 0x0000007B error, see [Error code INACCESSIBLE_BOOT_DEVICE (STOP 0x7B)](https://internal.support.services.microsoft.com/help/4343769/troubleshooting-guide-for-windows-boot-problems#0x7bstoperror)) + For example, "0x00000C2" , "0x0000007B" , "inaccessible boot device" and so on. + - [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](https://docs.microsoft.com/windows/client-management/troubleshoot-inaccessible-boot-device) + - [Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md) - The screen is stuck at the "spinning wheel" (rolling dots) "system busy" icon. @@ -265,16 +273,16 @@ For detailed instructions, see [How to perform a clean boot in Windows](https:// If the computer starts in Disable Driver Signature mode, start the computer in Disable Driver Signature Enforcement mode, and then follow the steps that are documented in the following article to determine which drivers or files require driver signature enforcement: [Troubleshooting boot problem caused by missing driver signature (x64)](https://blogs.technet.microsoft.com/askcore/2012/04/15/troubleshooting-boot-issues-due-to-missing-driver-signature-x64/) ->[!NOTE] ->If the computer is a domain controller, try Directory Services Restore mode (DSRM). +> [!NOTE] +> If the computer is a domain controller, try Directory Services Restore mode (DSRM). > ->This method is an important step if you encounter Stop error "0xC00002E1" or "0xC00002E2" +> This method is an important step if you encounter Stop error "0xC00002E1" or "0xC00002E2" **Examples** ->[!WARNING] ->Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these +> [!WARNING] +> Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk. *Error code INACCESSIBLE_BOOT_DEVICE (STOP 0x7B)* @@ -299,17 +307,15 @@ To troubleshoot this Stop error, follow these steps to filter the drivers: For additional troubleshooting steps, see the following articles: -- [Troubleshooting a Stop 0x7B in Windows](https://blogs.technet.microsoft.com/askcore/2013/08/05/troubleshooting-a-stop-0x7b-in-windows/) - -- [Advanced troubleshooting for "Stop error code 0x0000007B (INACCESSIBLE_BOOT_DEVICE)" errors in Windows XP](https://internal.support.services.microsoft.com/help/324103). +- [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](https://docs.microsoft.com/windows/client-management/troubleshoot-inaccessible-boot-device) To fix problems that occur after you install Windows updates, check for pending updates by using these steps: -1. Open a Command Prompt winodw in WinRE. +1. Open a Command Prompt window in WinRE. 2. Run the command: ```dos - dism /image:C:\ /get-packages + DISM /image:C:\ /get-packages ``` 3. If there are any pending updates, uninstall them by running the following commands: @@ -317,7 +323,7 @@ To fix problems that occur after you install Windows updates, check for pending DISM /image:C:\ /remove-package /packagename: name of the package ``` ```dos - Dism /Image:C:\ /Cleanup-Image /RevertPendingActions + DISM /Image:C:\ /Cleanup-Image /RevertPendingActions ``` Try to start the computer. @@ -350,17 +356,15 @@ If the computer does not start, follow these steps: 12. Try to start the computer. -If the Stop error occurs late in the startup process, or if the Stop error is still being generated, you can capture a memory dump. A good memory dump can help determine the root cause of the Stop error. For details, see the following Knowledge Base article: +If the Stop error occurs late in the startup process, or if the Stop error is still being generated, you can capture a memory dump. A good memory dump can help determine the root cause of the Stop error. For details, see the following articles: -- [969028](https://support.microsoft.com/help/969028) How to generate a kernel or a complete memory dump file in Windows Server 2008 and Windows Server 2008 R2 +- [Generate a kernel or complete crash dump](https://docs.microsoft.com/windows/client-management/generate-kernel-or-complete-crash-dump) -For more information about page file problems in Windows 10 or Windows Server 2016, see the following Knowledge Base article: - -- [4133658](https://support.microsoft.com/help/4133658) Introduction of page file in Long-Term Servicing Channel and Semi-Annual Channel of Windows +For more information about page file problems in Windows 10 or Windows Server 2016, see the following: +- [Introduction to page files](https://docs.microsoft.com/windows/client-management/introduction-page-file) For more information about Stop errors, see the following Knowledge Base article: - -- [3106831](https://support.microsoft.com/help/3106831) Troubleshooting Stop error problems for IT Pros +- [Advanced troubleshooting for Stop error or blue screen error issue](https://docs.microsoft.com/windows/client-management/troubleshoot-stop-errors) If the dump file shows an error that is related to a driver (for example, windows\system32\drivers\stcvsm.sys is missing or corrupted), follow these guidelines: @@ -385,6 +389,6 @@ If the dump file shows an error that is related to a driver (for example, window 1. Start WinRE, and open a Command Prompt window. 2. Start a text editor, such as Notepad. - 3. Navigate to C\Windows\System32\Config\. + 3. Navigate to C:\Windows\System32\Config\. 4. Rename the all five hives by appending ".old" to the name. 5. Copy all the hives from the Regback folder, paste them in the Config folder, and then try to start the computer in Normal mode. diff --git a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md index 2581981101..c04dae805a 100644 --- a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md +++ b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md @@ -1,13 +1,15 @@ --- title: Advanced Troubleshooting Wireless Network Connectivity +ms.reviewer: +manager: dansimp description: Learn how troubleshooting of establishing Wi-Fi connections keywords: troubleshooting, wireless network connectivity, wireless, Wi-Fi ms.prod: w10 -ms.mktglfcycl: +ms.mktglfcycl: ms.sitesec: library -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: greg-lindsay +ms.author: dansimp ms.topic: troubleshooting --- @@ -36,6 +38,7 @@ The intention of this troubleshooter is to show how to find a starting point in ### Known Issues and fixes ** ** + | **OS version** | **Fixed in** | | --- | --- | | **Windows 10, version 1803** | [KB4284848](https://support.microsoft.com/help/4284848) | @@ -52,7 +55,7 @@ Make sure that you install the latest Windows updates, cumulative updates, and r - [Windows 8.1 and Windows Server 2012 R2](https://support.microsoft.com/help/4009470) - [Windows Server 2012](https://support.microsoft.com/help/4009471) - [Windows 7 SP1 and Windows Server 2008 R2 SP1](https://support.microsoft.com/help/40009469) - + ## Data Collection 1. Network Capture with ETW. Enter the following at an elevated command prompt: @@ -89,7 +92,7 @@ The following is a high-level view of the main wifi components in Windows. - Scanning for wireless networks in range - Managing connectivity of wireless networks The Media Specific Module (MSM) handles security aspects of connection being established. -The Native Wifi stack consists of drivers and wireless APIs to interact with wireless miniports and the supporting user-mode Wlansvc. +The Native WiFi stack consists of drivers and wireless APIs to interact with wireless miniports and the supporting user-mode Wlansvc. Third-party wireless miniport drivers interface with the upper wireless stack to provide notifications to and receive commands from Windows. @@ -234,8 +237,8 @@ This is followed by **PHY_STATE_CHANGE** and **PORT_DOWN** events due to a disas ### Resources -[802.11 Wireless Tools and Settings](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc755892(v%3dws.10))
    -[Understanding 802.1X authentication for wireless networks](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc759077%28v%3dws.10%29)
    +[802.11 Wireless Tools and Settings](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc755892(v%3dws.10))
    +[Understanding 802.1X authentication for wireless networks](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc759077%28v%3dws.10%29)
    ## Example ETW capture @@ -324,4 +327,4 @@ Copy and paste all the lines below and save them into a text file named "wifi.ta In the following example, the **View** settings are configured to **Show Only Filtered Lines**. -![TAT filter example](images/tat.png) \ No newline at end of file +![TAT filter example](images/tat.png) diff --git a/windows/client-management/change-default-removal-policy-external-storage-media.md b/windows/client-management/change-default-removal-policy-external-storage-media.md new file mode 100644 index 0000000000..5de58be176 --- /dev/null +++ b/windows/client-management/change-default-removal-policy-external-storage-media.md @@ -0,0 +1,50 @@ +--- +title: Windows 10 default media removal policy +description: In Windows 10, version 1809, the default removal policy for external storage media changed from "Better performance" to "Quick removal." +ms.prod: w10 +author: Teresa-Motiv +ms.author: v-tea +ms.date: 12/13/2019 +ms.prod: w10 +ms.topic: article +ms.custom: +- CI 111493 +- CSSTroubleshooting +audience: ITPro +ms.localizationpriority: medium +manager: kaushika +--- + +# Change in default removal policy for external storage media in Windows 10, version 1809 + +Windows defines two main policies, **Quick removal** and **Better performance**, that control how the system interacts with external storage devices such as USB thumb drives or Thunderbolt-enabled external drives. Beginning in Windows 10 version 1809, the default policy is **Quick removal**. + +In earlier versions of Windows, the default policy was **Better performance**. + +You can change the policy setting for each external device, and the policy that you set remains in effect if you disconnect the device and then connect it again to the same computer port. + +## More information + +You can use the storage device policy setting to change the manner in which Windows manages storage devices to better meet your needs. The policy settings have the following effects: + +* **Quick removal**: This policy manages storage operations in a manner that keeps the device ready to remove at any time. You can remove the device without using the Safely Remove Hardware process. However, to do this, Windows cannot cache disk write operations. This may degrade system performance. +* **Better performance**: This policy manages storage operations in a manner that improves system performance. When this policy is in effect, Windows can cache write operations to the external device. However, you must use the Safely Remove Hardware process to remove the external drive. The Safely Remove Hardware process protects the integrity of data on the device by making sure that all cached operations finish. + > [!IMPORTANT] + > If you use the **Better performance** policy, you must use the Safely Remove Hardware process to remove the device. If you remove or disconnect the device without following the safe removal instructions, you risk losing data. + + > [!NOTE] + > If you select **Better performance**, we recommend that you also select **Enable write caching on the device**. + +To change the policy for an external storage device: + +1. Connect the device to the computer. +2. Right-click **Start**, then select **File Explorer**. +3. In File Explorer, identify the letter or label that is associated with the device (for example, **USB Drive (D:)**). +4. Right-click **Start**, then select **Disk Management**. +5. In the lower section of the Disk Management window, right-click the label of the device, and then select **Properties**. + + ![In Disk Management, right-click the device and click Properties.](./images/change-def-rem-policy-1.png) + +6. Select **Policies**, and then select the policy you want to use. + + ![Policy options for disk management](./images/change-def-rem-policy-2.png) diff --git a/windows/client-management/change-history-for-client-management.md b/windows/client-management/change-history-for-client-management.md index 12912a98f5..8265dd9abc 100644 --- a/windows/client-management/change-history-for-client-management.md +++ b/windows/client-management/change-history-for-client-management.md @@ -1,15 +1,17 @@ --- title: Change history for Client management (Windows 10) -description: This topic lists changes to documentation for configuring Windows 10. +description: View changes to documentation for client management in Windows 10. keywords: ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: jdeckerMS -ms.author: jdecker -ms.date: 12/06/2018 +author: dansimp +ms.author: dansimp +ms.date: 12/27/2019 +ms.reviewer: +manager: dansimp ms.topic: article --- @@ -17,6 +19,13 @@ ms.topic: article This topic lists new and updated topics in the [Client management](index.md) documentation for Windows 10 and Windows 10 Mobile. +## December 2019 + +New or changed topic | Description +--- | --- +[Change in default removal policy for external storage media in Windows 10, version 1809](change-default-removal-policy-external-storage-media.md) | New +[Advanced troubleshooting for Event ID 41 "The system has rebooted without cleanly shutting down first"](troubleshoot-event-id-41-restart.md) | New + ## December 2018 New or changed topic | Description diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 7812898ee3..a7c0f2f152 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -6,10 +6,12 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: devices -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp ms.date: 08/02/2018 +ms.reviewer: +manager: dansimp ms.topic: article --- @@ -30,28 +32,36 @@ From its release, Windows 10 has supported remote connections to PCs that are jo ## Set up - Both PCs (local and remote) must be running Windows 10, version 1607 (or later). Remote connection to an Azure AD-joined PC that is running earlier versions of Windows 10 is not supported. -- Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC that you are using to connect to the remote PC. +- Your local PC (where you are connecting from) must be either Azure AD joined or Hybrid Azure AD joined. Remote connection to an Azure AD joined PC from an unjoined device or a non-Windows 10 device is not supported. +Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-guard), a new feature in Windows 10, version 1607, is turned off on the client PC that you are using to connect to the remote PC. - On the PC that you want to connect to: 1. Open system properties for the remote PC. 2. Enable **Allow remote connections to this computer** and select **Allow connections only from computers running Remote Desktop with Network Level Authentication**. - ![Allow remote connections to this computer](images/allow-rdp.png) + ![Allow remote connections to this computer](images/allow-rdp.png) 3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users to connect to the PC, you must allow remote connections for the local **Authenticated Users** group. Click **Select Users**. - >[!NOTE] - >You can specify individual Azure AD accounts for remote connections by having the user sign in to the remote device at least once and then running the following PowerShell cmdlet: - > - >`net localgroup "Remote Desktop Users" /add "AzureAD\the-UPN-attribute-of-your-user"`, where *FirstnameLastname* is the name of the user profile in C:\Users\, which is created based on DisplayName attribute in Azure AD. - > - >In Windows 10, version 1709, the user does not have to sign in to the remote device first. - > - >In Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices. + >[!NOTE] + >You can specify individual Azure AD accounts for remote connections by having the user sign in to the remote device at least once and then running the following PowerShell cmdlet: + > + >`net localgroup "Remote Desktop Users" /add "AzureAD\the-UPN-attribute-of-your-user"`, where *FirstnameLastname* is the name of the user profile in C:\Users\, which is created based on DisplayName attribute in Azure AD. + > + > This command only works for AADJ device users already added to any of the local groups (administrators). + > Otherwise this command throws the below error. For example:
    + > for cloud only user: "There is no such global user or group : *name*"
    + > for synced user: "There is no such global user or group : *name*"
    + > + >In Windows 10, version 1709, the user does not have to sign in to the remote device first. + > + >In Windows 10, version 1709, you can add other Azure AD users to the **Administrators** group on a device in **Settings** and restrict remote credentials to **Administrators**. If there is a problem connecting remotely, make sure that both devices are joined to Azure AD and that TPM is functioning properly on both devices. 4. Enter **Authenticated Users**, then click **Check Names**. If the **Name Not Found** window opens, click **Locations** and select this PC. - >[!TIP] - >When you connect to the remote PC, enter your account name in this format: `AzureAD UPN`. The local PC must either be domain-joined or Azure AD-joined. The local PC and remote PC must be in the same Azure AD tenant. + > [!TIP] + > When you connect to the remote PC, enter your account name in this format: `AzureAD UPN`. The local PC must either be domain-joined or Azure AD-joined. The local PC and remote PC must be in the same Azure AD tenant. +> [!Note] +> If you cannot connect using Remote Desktop Connection 6.0, then you must turn off new features of RDP 6.0 and revert back to RDP 5.0 by changing a few changes in the RDP file. See the details in the [support article](https://support.microsoft.com/help/941641/remote-desktop-connection-6-0-prompts-you-for-credentials-before-you-e). ## Supported configurations @@ -79,7 +89,8 @@ In organizations using only Azure AD, you can connect from an Azure AD-joined PC - Password - Windows Hello for Business, with or without an MDM subscription. - +> [!NOTE] +> If the RDP client is running Windows Server 2016 or Windows Server 2019, to be able to connect to Azure Active Directory-joined PCs, it must [allow Public Key Cryptography Based User-to-User (PKU2U) authentication requests to use online identities](https://docs.microsoft.com/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities). ## Related topics @@ -88,9 +99,9 @@ In organizations using only Azure AD, you can connect from an Azure AD-joined PC -  + -  + diff --git a/windows/client-management/data-collection-for-802-authentication.md b/windows/client-management/data-collection-for-802-authentication.md index cc14ac0242..e866b0d7c4 100644 --- a/windows/client-management/data-collection-for-802-authentication.md +++ b/windows/client-management/data-collection-for-802-authentication.md @@ -1,13 +1,15 @@ --- title: Data collection for troubleshooting 802.1X authentication +ms.reviewer: +manager: dansimp description: Data needed for reviewing 802.1X Authentication issues keywords: troubleshooting, data collection, data, 802.1X authentication, authentication, data ms.prod: w10 ms.mktglfcycl: ms.sitesec: library -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: mikeblodge +ms.author: dansimp ms.topic: troubleshooting --- @@ -72,7 +74,7 @@ Use the following steps to collect wireless and wired logs on Windows and Window ``` wevtutil.exe sl Microsoft-Windows-CAPI2/Operational /e:true wevtutil sl Microsoft-Windows-CAPI2/Operational /ms:104857600 - ``` + ``` 7. Run the following command from the command prompt on the client machine and start PSR to capture screen images: > [!NOTE] @@ -90,13 +92,13 @@ Use the following steps to collect wireless and wired logs on Windows and Window 10. Run the following commands from the command prompt on the NPS server. - - To stop RAS trace log and wireless scenario log: + - To stop RAS trace log and wireless scenario log: ``` netsh trace stop netsh ras set tracing * disabled ``` - - To disable and copy CAPI2 log: + - To disable and copy CAPI2 log: ``` wevtutil.exe sl Microsoft-Windows-CAPI2/Operational /e:false @@ -104,13 +106,13 @@ Use the following steps to collect wireless and wired logs on Windows and Window ``` 11. Run the following commands on the client PC. - - To stop RAS trace log and wireless scenario log: + - To stop RAS trace log and wireless scenario log: ``` netsh trace stop netsh ras set tracing * disabled ``` - - To disable and copy the CAPI2 log: + - To disable and copy the CAPI2 log: ``` wevtutil.exe sl Microsoft-Windows-CAPI2/Operational /e:false wevtutil.exe epl Microsoft-Windows-CAPI2/Operational C:\MSLOG\%COMPUTERNAME%_CAPI2.evtx @@ -118,14 +120,14 @@ Use the following steps to collect wireless and wired logs on Windows and Window 12. Save the following logs on the client and the NPS: - **Client** + **Client** - C:\MSLOG\%computername%_psr.zip - C:\MSLOG\%COMPUTERNAME%_CAPI2.evtx - C:\MSLOG\%COMPUTERNAME%_wireless_cli.etl - C:\MSLOG\%COMPUTERNAME%_wireless_cli.cab - All log files and folders in %Systemroot%\Tracing - **NPS** + **NPS** - C:\MSLOG\%COMPUTERNAME%_CAPI2.evtx - C:\MSLOG\%COMPUTERNAME%_wireless_nps.etl (%COMPUTERNAME%_wired_nps.etl for wired scenario) - C:\MSLOG\%COMPUTERNAME%_wireless_nps.cab (%COMPUTERNAME%_wired_nps.cab for wired scenario) diff --git a/windows/client-management/determine-appropriate-page-file-size.md b/windows/client-management/determine-appropriate-page-file-size.md new file mode 100644 index 0000000000..b6abb3661e --- /dev/null +++ b/windows/client-management/determine-appropriate-page-file-size.md @@ -0,0 +1,129 @@ +--- +title: How to determine the appropriate page file size for 64-bit versions of Windows +description: Learn how to determine the appropriate page file size for 64-bit versions of Windows. +ms.prod: w10 +ms.sitesec: library +ms.topic: troubleshooting +author: Deland-Han +ms.localizationpriority: medium +ms.author: delhan +ms.date: 8/28/2019 +ms.reviewer: +manager: dcscontentpm +--- + +# How to determine the appropriate page file size for 64-bit versions of Windows + +Page file sizing depends on the system crash dump setting requirements and the peak usage or expected peak usage of the system commit charge. Both considerations are unique to each system, even for systems that are identical. This means that page file sizing is also unique to each system and cannot be generalized. + +## Determine the appropriate page file size + +Use the following considerations for page file sizing for all versions of Windows and Windows Server. + +### Crash dump setting + +If you want a crash dump file to be created during a system crash, a page file or a dedicated dump file must exist and be large enough to back up the system crash dump setting. Otherwise, a system memory dump file is not created. + +For more information, see [Support for system crash dumps](introduction-page-file.md#support-for-system-crash-dumps) section. + +### Peak system commit charge + +The system commit charge cannot exceed the system commit limit. This limit is the sum of physical memory (RAM) and all page files combined. If no page files exist, the system commit limit is slightly less than the physical memory that is installed. Peak system-committed memory usage can vary greatly between systems. Therefore, physical memory and page file sizing also vary. + +### Quantity of infrequently accessed pages + +The purpose of a page file is to *back* (support) infrequently accessed modified pages so that they can be removed from physical memory. This provides more available space for more frequently accessed pages. The "\Memory\Modified Page List Bytes" performance counter measures, in part, the number of infrequently accessed modified pages that are destined for the hard disk. However, be aware that not all the memory on the modified page list is written out to disk. Typically, several hundred megabytes of memory remains resident on the modified list. Therefore, consider extending or adding a page file if all the following conditions are true: + +- More available physical memory (\Memory\Available MBytes) is required. + +- The modified page list contains a significant amount of memory. + +- The existing page files are fairly full (\Paging Files(*)\% Usage). + +## Support for system crash dumps + +A system crash (also known as a “bug check” or a "Stop error") occurs when the system cannot run correctly. The dump file that is produced from this event is called a system crash dump. A page file or dedicated dump file is used to write a crash dump file (Memory.dmp) to disk. Therefore, a page file or a dedicated dump file must be large enough to support the kind of crash dump selected. Otherwise, the system cannot create the crash dump file. + +>[!Note] +>During startup, system-managed page files are sized respective to the system crash dump settings. This assumes that enough free disk space exists. + +|System crash dump setting |Minimum page file size requirement| +|-----------|-------------------| +|Small memory dump (256 KB) |1 MB| +|Kernel memory dump |Depends on kernel virtual memory usage| +|Complete memory dump |1 x RAM plus 257 MB*| +|Automatic memory dump |Depends on kernel virtual memory usage. For details, see Automatic memory dump.| + +\* 1 MB of header data and device drivers can total 256 MB of secondary crash dump data. + +The **Automatic memory dump** setting is enabled by default. This is a setting instead of a kind of crash dump. This setting automatically selects the best page file size, depending on the frequency of system crashes. + +The Automatic memory dump feature initially selects a small paging file size. It would accommodate the kernel memory most of the time. If the system crashes again within four weeks, the Automatic memory dump feature sets the page file size as either the RAM size or 32 GB, whichever is smaller. + +Kernel memory crash dumps require enough page file space or dedicated dump file space to accommodate the kernel mode side of virtual memory usage. If the system crashes again within four weeks of the previous crash, a Complete memory dump is selected at restart. This requires a page file or dedicated dump file of at least the size of physical memory (RAM) plus 1 MB for header information plus 256 MB for potential driver data to support all the potential data that is dumped from memory. Again, the system-managed page file will be increased to back this kind of crash dump. If the system is configured to have a page file or a dedicated dump file of a specific size, make sure that the size is sufficient to back the crash dump setting that is listed in the table earlier in this section together with and the peak system commit charge. + +### Dedicated dump files + +Computers that are running Microsoft Windows or Microsoft Windows Server usually must have a page file to support a system crash dump. System administrators now have the option to create a dedicated dump file instead. + +A dedicated dump file is a page file that is not used for paging. Instead, it is “dedicated” to back a system crash dump file (Memory.dmp) when a system crash occurs. Dedicated dump files can be put on any disk volume that can support a page file. We recommend that you use a dedicated dump file if you want a system crash dump but you do not want a page file. + +## System-managed page files + +By default, page files are system-managed. This means that the page files increase and decrease based on many factors, such as the amount of physical memory installed, the process of accommodating the system commit charge, and the process of accommodating a system crash dump. + +For example, when the system commit charge is more than 90 percent of the system commit limit, the page file is increased to back it. This continues to occur until the page file reaches three times the size of physical memory or 4 GB, whichever is larger. This all assumes that the logical disk that is hosting the page file is large enough to accommodate the growth. + +The following table lists the minimum and maximum page file sizes of system-managed page files in Windows 10. + +|Minimum page file size |Maximum page file size| +|---------------|------------------| +|Varies based on page file usage history, amount of RAM (RAM ÷ 8, max 32 GB) and crash dump settings. |3 × RAM or 4 GB, whichever is larger. This is then limited to the volume size ÷ 8. However, it can grow to within 1 GB of free space on the volume if required for crash dump settings.| + +## Performance counters + +Several performance counters are related to page files. This section describes the counters and what they measure. + +### \Memory\Page/sec and other hard page fault counters + +The following performance counters measure hard page faults (which include, but are not limited to, page file reads): + +- \Memory\Page/sec + +- \Memory\Page Reads/sec + +- \Memory\Page Inputs/sec + +The following performance counters measure page file writes: + +- \Memory\Page Writes/sec + +- \Memory\Page Output/sec + +Hard page faults are faults that must be resolved by retrieving the data from disk. Such data can include portions of DLLs, .exe files, memory-mapped files, and page files. These faults might or might not be related to a page file or to a low-memory condition. Hard page faults are a standard function of the operating system. They occur when the following items are read: + +- Parts of image files (.dll and .exe files) as they are used + +- Memory-mapped files + +- A page file + +High values for these counters (excessive paging) indicate disk access of generally 4 KB per page fault on x86 and x64 versions of Windows and Windows Server. This disk access might or might not be related to page file activity but may contribute to poor disk performance that can cause system-wide delays if the related disks are overwhelmed. + +Therefore, we recommend that you monitor the disk performance of the logical disks that host a page file in correlation with these counters. Be aware that a system that has a sustained 100 hard page faults per second experiences 400 KB per second disk transfers. Most 7,200 RPM disk drives can handle about 5 MB per second at an IO size of 16 KB or 800 KB per second at an IO size of 4 KB. No performance counter directly measures which logical disk the hard page faults are resolved for. + +### \Paging File(*)\% Usage + +The \Paging File(*)\% Usage performance counter measures the percentage of usage of each page file. 100 percent usage of a page file does not indicate a performance problem as long as the system commit limit is not reached by the system commit charge, and if a significant amount of memory is not waiting to be written to a page file. + +>[!Note] +>The size of the Modified Page List (\Memory\Modified Page List Bytes) is the total of modified data that is waiting to be written to disk. + +If the Modified Page List (a list of physical memory pages that are the least frequently accessed) contains lots of memory, and if the **% Usage** value of all page files is greater than 90, you can make more physical memory available for more frequently access pages by increasing or adding a page file. + +>[!Note] +>Not all the memory on the modified page list is written out to disk. Typically, several hundred megabytes of memory remains resident on the modified list. + +## Multiple page files and disk considerations + +If a system is configured to have more than one page files, the page file that responds first is the one that is used. This means that page files that are on faster disks are used more frequently. Also, whether you put a page file on a “fast” or “slow” disk is important only if the page file is frequently accessed and if the disk that is hosting the respective page file is overwhelmed. Be aware that actual page file usage depends greatly on the amount of modified memory that the system is managing. This means that files that already exist on disk (such as .txt, .doc, .dll, and .exe) are not written to a page file. Only modified data that does not already exist on disk (for example, unsaved text in Notepad) is memory that could potentially be backed by a page file. After the unsaved data is saved to disk as a file, it is backed by the disk and not by a page file. diff --git a/windows/client-management/docfx.json b/windows/client-management/docfx.json index f68b218456..ffd1c9d266 100644 --- a/windows/client-management/docfx.json +++ b/windows/client-management/docfx.json @@ -20,7 +20,7 @@ "files": [ "**/*.png", "**/*.jpg", - "**/*.gif" + "**/*.gif" ], "exclude": [ "**/obj/**", @@ -31,22 +31,25 @@ "overwrite": [], "externalReference": [], "globalMetadata": { - "uhfHeaderId": "MSDocsHeader-WindowsIT", - "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", - "ms.technology": "windows", - "ms.topic": "article", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", - "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "MSDN.win-client-management" - } - } - }, + "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "ms.technology": "windows", + "audience": "ITPro", + "ms.topic": "article", + "manager": "dansimp", + "feedback_system": "GitHub", + "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", + "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "MSDN.win-client-management", + "folder_relative_path_in_docset": "./" + } + }, + "titleSuffix": "Windows Client Management" + }, "fileMetadata": {}, "template": [], "dest": "win-client-management", - "markdownEngineName": "dfm" + "markdownEngineName": "markdig" } -} \ No newline at end of file +} diff --git a/windows/client-management/generate-kernel-or-complete-crash-dump.md b/windows/client-management/generate-kernel-or-complete-crash-dump.md new file mode 100644 index 0000000000..6601e238eb --- /dev/null +++ b/windows/client-management/generate-kernel-or-complete-crash-dump.md @@ -0,0 +1,111 @@ +--- +title: Generate a kernel or complete crash dump +description: Learn how to generate a kernel or complete crash dump. +ms.prod: w10 +ms.sitesec: library +ms.topic: troubleshooting +author: Deland-Han +ms.localizationpriority: medium +ms.author: delhan +ms.date: 8/28/2019 +ms.reviewer: +manager: dcscontentpm +--- + +# Generate a kernel or complete crash dump + +A system crash (also known as a “bug check” or a "Stop error") occurs when Windows can't run correctly. The dump file that is produced from this event is called a system crash dump. + +A manual kernel or complete memory dump file is useful when you troubleshoot several issues because the process captures a record of system memory at the time of a crash. + +## Set up page files + +See [Support for system crash dumps](determine-appropriate-page-file-size.md#support-for-system-crash-dumps) for the page file size requirement for system crash dump. + +## Enable memory dump setting + +You must be logged on as an administrator or a member of the Administrators group to complete this procedure. If your computer is connected to a network, network policy settings may prevent you from completing this procedure. + +To enable memory dump setting, follow these steps: + +1. In **Control Panel**, select **System and Security** > **System**. + +2. Select **Advanced system settings**, and then select the **Advanced** tab. + +3. In the **Startup and Recovery** area, select **Settings**. + +4. Make sure that **Kernel memory dump** or **Complete memory dump** is selected under **Writing Debugging Information**. + +5. Restart the computer. + +>[!Note] +>You can change the dump file path by edit the **Dump file** field. In other words, you can change the path from %SystemRoot%\Memory.dmp to point to a local drive that has enough disk space, such as E:\Memory.dmp. + +### Tips to generate memory dumps + +When the computer crashes and restarts, the contents of physical RAM are written to the paging file that is located on the partition on which the operating system is installed. + +Depending on the speed of the hard disk on which Windows is installed, dumping more than 2 gigabytes (GB) of memory may take a long time. Even in a best case scenario, if the dump file is configured to reside on another local hard drive, a significant amount of data will be read and written to the hard disks. This can cause a prolonged server outage. + +>[!Note] +>Use this method to generate complete memory dump files with caution. Ideally, you should do this only when you are explicitly requested to by the Microsoft Support engineer. Any kernel or complete memory dump file debugging should be the last resort after all standard troubleshooting methods have been completely exhausted. + +## Manually generate a memory dump file + +### Use the NotMyFault tool + +If you can log on while the problem is occurring, you can use the Microsoft Sysinternals NotMyFault tool. To do this, follow these steps: + +1. Download the [NotMyFault](https://download.sysinternals.com/files/NotMyFault.zip) tool. + +2. Select **Start**, and then select **Command Prompt**. +3. At the command line, run the following command: + + ```cmd + notMyfault.exe /crash + ``` + +>[!Note] +>This operation generates a memory dump file and a D1 Stop error. + +### Use NMI + +On some computers, you cannot use keyboard to generate a crash dump file. For example, Hewlett-Packard (HP) BladeSystem servers from the Hewlett-Packard Development Company are managed through a browser-based graphical user interface (GUI). A keyboard is not attached to the HP BladeSystem server. + +In these cases, you must generate a complete crash dump file or a kernel crash dump file by using the Non-Maskable Interrupt (NMI) switch that causes an NMI on the system processor. + +To do this, follow these steps: + +> [!IMPORTANT] +> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur. + +1. In Registry Editor, locate the following registry subkey: + **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl** + +2. Right-click **CrashControl**, point to **New**, and then click **DWORD Value**. + +3. Type NMICrashDump, and then press Enter. + +4. Right-click **NMICrashDump**, and then select **Modify**. + +5. In the **Value data** box, type **1**, and then select **OK**. + +6. Restart the computer. + +7. Hardware vendors, such as HP, IBM, and Dell, may provide an Automatic System Recovery (ASR) feature. You should disable this feature during troubleshooting. For example, if the HP and Compaq ASR feature is enabled in the BIOS, disable this feature while you troubleshoot to generate a complete Memory.dmp file. For the exact steps, contact your hardware vendor. + +8. Enable the NMI switch in the BIOS or by using the Integrated Lights Out (iLO) Web interface. + + >[!Note] + >For the exact steps, see the BIOS reference manual or contact your hardware vendor. + +9. Test this method on the server by using the NMI switch to generate a dump file. You will see a STOP 0x00000080 hardware malfunction. + +### Use the keyboard + +[Forcing a System Crash from the Keyboard](https://docs.microsoft.com/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-keyboard) + +### Use Debugger + +[Forcing a System Crash from the Debugger](https://docs.microsoft.com/windows-hardware/drivers/debugger/forcing-a-system-crash-from-the-debugger) + diff --git a/windows/client-management/group-policies-for-enterprise-and-education-editions.md b/windows/client-management/group-policies-for-enterprise-and-education-editions.md index 38beb2bfcd..8b2eb55f2f 100644 --- a/windows/client-management/group-policies-for-enterprise-and-education-editions.md +++ b/windows/client-management/group-policies-for-enterprise-and-education-editions.md @@ -4,9 +4,12 @@ description: Use this topic to learn about Group Policy settings that apply only ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: brianlic-msft +author: dansimp ms.localizationpriority: medium ms.date: 10/13/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: troubleshooting --- @@ -34,4 +37,4 @@ In Windows 10, version 1607, the following Group Policy settings apply only to W - \ No newline at end of file + diff --git a/windows/client-management/images/change-def-rem-policy-1.png b/windows/client-management/images/change-def-rem-policy-1.png new file mode 100644 index 0000000000..4d99854104 Binary files /dev/null and b/windows/client-management/images/change-def-rem-policy-1.png differ diff --git a/windows/client-management/images/change-def-rem-policy-2.png b/windows/client-management/images/change-def-rem-policy-2.png new file mode 100644 index 0000000000..d05d5dd16f Binary files /dev/null and b/windows/client-management/images/change-def-rem-policy-2.png differ diff --git a/windows/client-management/images/out-of-memory.png b/windows/client-management/images/out-of-memory.png new file mode 100644 index 0000000000..c377389128 Binary files /dev/null and b/windows/client-management/images/out-of-memory.png differ diff --git a/windows/client-management/images/task-manager-commit.png b/windows/client-management/images/task-manager-commit.png new file mode 100644 index 0000000000..86d289eebe Binary files /dev/null and b/windows/client-management/images/task-manager-commit.png differ diff --git a/windows/client-management/images/task-manager.png b/windows/client-management/images/task-manager.png new file mode 100644 index 0000000000..c52163f46e Binary files /dev/null and b/windows/client-management/images/task-manager.png differ diff --git a/windows/client-management/images/tcp-ts-14.png b/windows/client-management/images/tcp-ts-14.png index f3a3cc4a35..b1db37cd1a 100644 Binary files a/windows/client-management/images/tcp-ts-14.png and b/windows/client-management/images/tcp-ts-14.png differ diff --git a/windows/client-management/img-boot-sequence.md b/windows/client-management/img-boot-sequence.md index 19455fe9cd..dbcd186131 100644 --- a/windows/client-management/img-boot-sequence.md +++ b/windows/client-management/img-boot-sequence.md @@ -1,13 +1,17 @@ --- -description: A full-sized view of the boot sequence flowchart. title: Boot sequence flowchart +description: A full-sized view of the boot sequence flowchart. ms.date: 11/16/2018 +ms.reviewer: +manager: dansimp +ms.author: dansimp +author: dansimp ms.topic: article ms.prod: w10 --- +# Boot sequence flowchart + Return to: [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
    - ![Full-sized boot sequence flowchart](images/boot-sequence.png) - diff --git a/windows/client-management/index.md b/windows/client-management/index.md index f47496e3b0..3838366e1a 100644 --- a/windows/client-management/index.md +++ b/windows/client-management/index.md @@ -4,9 +4,9 @@ description: Windows 10 client management ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.date: 08/16/2017 +ms.author: dansimp --- # Client management @@ -23,6 +23,7 @@ Learn about the administrative tools, tasks and best practices for managing Wind |[Connect to remote Azure Active Directory-joined PCs](connect-to-remote-aadj-pc.md)| Instructions for connecting to a remote PC joined to Azure Active Directory (Azure AD)| |[Join Windows 10 Mobile to Azure AD](join-windows-10-mobile-to-azure-active-directory.md)| Describes the considerations and options for using Windows 10 Mobile with Azure AD in your organization.| |[New policies for Windows 10](new-policies-for-windows-10.md)| Listing of new group policy settings available in Windows 10| +|[Windows 10 default media removal policy](change-default-removal-policy-external-storage-media.md) |In Windows 10, version 1809, the default removal policy for external storage media changed from "Better performance" to "Quick removal." | |[Group policies for enterprise and education editions](group-policies-for-enterprise-and-education-editions.md)| Listing of all group policy settings that apply specifically to Windows 10 Enterprise and Education editions| | [Manage the Settings app with Group Policy](manage-settings-app-with-group-policy.md) | Starting in Windows 10, version 1703, you can now manage the pages that are shown in the Settings app by using Group Policy. | |[Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md)| Instructions for resetting a Windows 10 Mobile device using either *factory* or *'wipe and persist'* reset options| diff --git a/windows/client-management/introduction-page-file.md b/windows/client-management/introduction-page-file.md new file mode 100644 index 0000000000..cee81bcd72 --- /dev/null +++ b/windows/client-management/introduction-page-file.md @@ -0,0 +1,70 @@ +--- +title: Introduction to the page file +description: Learn about the page files in Windows. +ms.prod: w10 +ms.sitesec: library +ms.topic: troubleshooting +author: Deland-Han +ms.localizationpriority: medium +ms.author: delhan +ms.reviewer: greglin +manager: dcscontentpm +--- + +# Introduction to page files + +A page file (also known as a "paging file") is an optional, hidden system file on a hard disk. + +## Functionality + +Page files have the following functionalities. + +### Physical extension of RAM + +Page files enable the system to remove infrequently accessed modified pages from physical memory to let the system use physical memory more efficiently for more frequently accessed pages. + +### Application requirements + +Some products or services require a page file for various reasons. For specific information, check the product documentation. + +For example, the following Windows servers requires page files: + +- Windows Server domain controllers (DCs) +- DFS Replication (DFS-R) servers +- Certificate servers +- ADAM/LDS servers + +This is because the algorithm of the database cache for Extensible Storage Engine (ESENT, or ESE in Microsoft Exchange Server) depends on the "\Memory\Transition Pages RePurposed/sec" performance monitor counter. A page file is required to make sure that the database cache can release memory if other services or applications request memory. + +For Windows Server 2012 Hyper-V and Windows Server 2012 R2 Hyper-V, the page file of the management OS (commonly called the host OS) should be left at the default of setting of "System Managed" . + +### Support for system crash dumps + +Page files can be used to "back" (or support) system crash dumps and extend how much system-committed memory (also known as “virtual memory”) a system can support. + +For more information about system crash dumps, see [system crash dump options](system-failure-recovery-options.md#under-write-debugging-information). + +## Page files in Windows with large physical memory + +When large physical memory is installed, a page file might not be required to support the system commit charge during peak usage. For example, 64-bit versions of Windows and Windows Server support more physical memory (RAM) than 32-bit versions support. The available physical memory alone might be large enough. + +However, the reason to configure the page file size has not changed. It has always been about supporting a system crash dump, if it is necessary, or extending the system commit limit, if it is necessary. For example, when a lot of physical memory is installed, a page file might not be required to back the system commit charge during peak usage. The available physical memory alone might be large enough to do this. However, a page file or a dedicated dump file might still be required to back a system crash dump. + +## System committed memory + +Page files extend how much "committed memory" (also known as "virtual memory") is used to store modified data. + +The system commit memory limit is the sum of physical memory and all page files combined. It represents the maximum system-committed memory (also known as the "system commit charge") that the system can support. + +![Task manager](images/task-manager.png) + +The system commit charge is the total committed or "promised" memory of all committed virtual memory in the system. If the system commit charge reaches the system commit limit, the system and processes might not get committed memory. This condition can cause freezing, crashing, and other malfunctions. Therefore, make sure that you set the system commit limit high enough to support the system commit charge during peak usage. + +![Out of memory](images/out-of-memory.png) + +![Task Manager](images/task-manager-commit.png) + +The system committed charge and system committed limit can be measured on the **Performance** tab in Task Manager or by using the "\Memory\Committed Bytes" and "\Memory\Commit Limit" performance counters. The \Memory\% Committed Bytes In Use counter is a ratio of \Memory\Committed Bytes to \Memory\Commit Limit values. + +>[!Note] +>System-managed page files automatically grow up to three times the physical memory or 4 GB (whichever is larger) when the system commit charge reaches 90 percent of the system commit limit. This assumes that enough free disk space is available to accommodate the growth. diff --git a/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md b/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md index 18a5683f62..688b2e776c 100644 --- a/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md +++ b/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md @@ -2,11 +2,14 @@ title: Join Windows 10 Mobile to Azure Active Directory (Windows 10) description: Devices running Windows 10 Mobile can join Azure Active Directory (Azure AD) when the device is configured during the out-of-box experience (OOBE). ms.assetid: 955DD9EC-3519-4752-827E-79CEB1EC8D6B +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 09/21/2017 ms.topic: article diff --git a/windows/client-management/manage-corporate-devices.md b/windows/client-management/manage-corporate-devices.md index 4d37e28f84..fad72959e6 100644 --- a/windows/client-management/manage-corporate-devices.md +++ b/windows/client-management/manage-corporate-devices.md @@ -2,12 +2,15 @@ title: Manage corporate devices (Windows 10) description: You can use the same management tools to manage all device types running Windows 10 desktops, laptops, tablets, and phones. ms.assetid: 62D6710C-E59C-4077-9C7E-CE0A92DFC05D +ms.reviewer: +manager: dansimp +ms.author: dansimp keywords: ["MDM", "device management"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: devices -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 09/21/2017 ms.topic: article diff --git a/windows/client-management/manage-settings-app-with-group-policy.md b/windows/client-management/manage-settings-app-with-group-policy.md index 2f41baa313..97ea145013 100644 --- a/windows/client-management/manage-settings-app-with-group-policy.md +++ b/windows/client-management/manage-settings-app-with-group-policy.md @@ -4,18 +4,21 @@ description: Find out how to manage the Settings app with Group Policy. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: brianlic-msft +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article --- +# Manage the Settings app with Group Policy + + **Applies to** - Windows 10, Windows Server 2016 - -# Manage the Settings app with Group Policy - You can now manage the pages that are shown in the Settings app by using Group Policy. This lets you hide specific pages from users. Before Windows 10, version 1703, you could either show everything in the Settings app or hide it completely. To make use of the Settings App group polices on Windows server 2016, install fix [4457127](https://support.microsoft.com/help/4457127/windows-10-update-kb4457127) or a later cumulative update. @@ -38,7 +41,7 @@ Policy paths: The Group Policy can be configured in one of two ways: specify a list of pages that are shown or specify a list of pages to hide. To do this, add either **ShowOnly:** or **Hide:** followed by a semicolon delimited list of URIs in **Settings Page Visiblity**. For a full list of URIs, see the URI scheme reference section in [Launch the Windows Settings app](https://docs.microsoft.com/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference). ->[!NOTE] +>[!NOTE] > When you specify the URI in the Settings Page Visibility textbox, don't include **ms-settings:** in the string. Here are some examples: diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 759f45080d..c6fe7134c8 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -6,9 +6,12 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: devices -author: MariciaAlforque +author: dansimp ms.localizationpriority: medium ms.date: 04/26/2018 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article --- @@ -95,7 +98,7 @@ As you review the roles in your organization, you can use the following generali Your configuration requirements are defined by multiple factors, including the level of management needed, the devices and data managed, and your industry requirements. Meanwhile, employees are frequently concerned about IT applying strict policies to their personal devices, but they still want access to corporate email and documents. With Windows 10, you can create a consistent set of configurations across PCs, tablets, and phones through the common MDM layer.  -**MDM**: [MDM](https://www.microsoft.com/en-us/cloud-platform/mobile-device-management) gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, Group Policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. MDM also allows you to target Internet-connected devices to manage policies without using GP that requires on-premises domain-joined devices. This makes MDM the best choice for devices that are constantly on the go. +**MDM**: [MDM](https://www.microsoft.com/cloud-platform/mobile-device-management) gives you a way to configure settings that achieve your administrative intent without exposing every possible setting. (In contrast, Group Policy exposes fine-grained settings that you control individually.) One benefit of MDM is that it enables you to apply broader privacy, security, and application management settings through lighter and more efficient tools. MDM also allows you to target Internet-connected devices to manage policies without using GP that requires on-premises domain-joined devices. This makes MDM the best choice for devices that are constantly on the go. **Group Policy** and **System Center Configuration Manager**: Your organization might still need to manage domain joined computers at a granular level such as Internet Explorer’s 1,500 configurable Group Policy settings. If so, Group Policy and System Center Configuration Manager continue to be excellent management choices: diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index 2db6848263..9d7b5546ff 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -5,9 +5,11 @@ keywords: [".man","ntuser"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.date: 10/02/2018 +ms.reviewer: +manager: dansimp ms.topic: article --- @@ -16,7 +18,7 @@ ms.topic: article **Applies to** -- Windows 10 +- Windows 10 @@ -29,6 +31,7 @@ When the server that stores the mandatory profile is unavailable, such as when t User profiles become mandatory profiles when the administrator renames the NTuser.dat file (the registry hive) of each user's profile in the file system of the profile server from `NTuser.dat` to `NTuser.man`. The `.man` extension causes the user profile to be a read-only profile. + ## Profile extension for each Windows version The name of the folder in which you store the mandatory profile must use the correct extension for the operating system it will be applied to. The following table lists the correct extension for each operating system version. @@ -36,11 +39,11 @@ The name of the folder in which you store the mandatory profile must use the cor | Client operating system version | Server operating system version | Profile extension | | --- | --- | --- | | Windows XP | Windows Server 2003
    Windows Server 2003 R2 | none | -| Windows Vista
    Windows 7 | Windows Server 2008
    Windows Server 2008 R2 | v2 | +| Windows Vista
    Windows 7 | Windows Server 2008
    Windows Server 2008 R2 | v2 | | Windows 8 | Windows Server 2012 | v3 | | Windows 8.1 | Windows Server 2012 R2 | v4 | | Windows 10, versions 1507 and 1511 | N/A | v5 | -| Windows 10, versions 1607, 1703, 1709, 1803, and 1809 | Windows Server 2016 | v6 | +| Windows 10, versions 1607, 1703, 1709, 1803, 1809 and 1903 | Windows Server 2016 and Windows Server 2019 | v6 | For more information, see [Deploy Roaming User Profiles, Appendix B](https://technet.microsoft.com/library/jj649079.aspx) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198). @@ -52,68 +55,68 @@ First, you create a default user profile with the customizations that you want, 1. Sign in to a computer running Windows 10 as a member of the local Administrator group. Do not use a domain account. - > [!NOTE] + > [!NOTE] > Use a lab or extra computer running a clean installation of Windows 10 to create a default user profile. Do not use a computer that is required for business (that is, a production computer). This process removes all domain accounts from the computer, including user profile folders. - + 2. Configure the computer settings that you want to include in the user profile. For example, you can configure settings for the desktop background, uninstall default apps, install line-of-business apps, and so on. >[!NOTE] >Unlike previous versions of Windows, you cannot apply a Start and taskbar layout using a mandatory profile. For alternative methods for customizing the Start menu and taskbar, see [Related topics](#related-topics). 3. [Create an answer file (Unattend.xml)](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx) that sets the [CopyProfile](https://msdn.microsoft.com/library/windows/hardware/dn922656.aspx) parameter to **True**. The CopyProfile parameter causes Sysprep to copy the currently signed-on user’s profile folder to the default user profile. You can use [Windows System Image Manager](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx), which is part of the Windows Assessment and Deployment Kit (ADK) to create the Unattend.xml file. - + 3. Uninstall any application you do not need or want from the PC. For examples on how to uninstall Windows 10 Application see [Remove-AppxProvisionedPackage](https://docs.microsoft.com/powershell/module/dism/remove-appxprovisionedpackage?view=winserver2012-ps). For a list of uninstallable applications, see [Understand the different apps included in Windows 10](https://docs.microsoft.com/windows/application-management/apps-in-windows-10). - - >[!NOTE] - >It is highly recommended to uninstall unwanted or unneeded apps as it will speed up user sign-in times. + + >[!NOTE] + >It is highly recommended to uninstall unwanted or unneeded apps as it will speed up user sign-in times. 3. At a command prompt, type the following command and press **ENTER**. `sysprep /oobe /reboot /generalize /unattend:unattend.xml` (Sysprep.exe is located at: C:\Windows\System32\sysprep. By default, Sysprep looks for unattend.xml in this same folder.) - - >[!TIP] - >If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\System32\Sysprep\Panther\setupact.log and look for an entry like the following: - - >![Microsoft Bing Translator package](images/sysprep-error.png) - - >Use the [Remove-AppxProvisionedPackage](https://technet.microsoft.com/library/dn376476%28v=wps.620%29.aspx) and [Remove-AppxPackage -AllUsers](https://docs.microsoft.com/powershell/module/appx/remove-appxpackage?view=win10-ps) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. - -5. The sysprep process reboots the PC and starts at the first-run experience screen. Complete the set up, and then sign in to the computer using an account that has local administrator privileges. -6. Right-click Start, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section. - -7. In **User Profiles**, click **Default Profile**, and then click **Copy To**. + > [!TIP] + > If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\System32\Sysprep\Panther\setupact.log and look for an entry like the following: + > + > ![Microsoft Bing Translator package](images/sysprep-error.png) + > + > Use the [Remove-AppxProvisionedPackage](https://technet.microsoft.com/library/dn376476%28v=wps.620%29.aspx) and [Remove-AppxPackage -AllUsers](https://docs.microsoft.com/powershell/module/appx/remove-appxpackage?view=win10-ps) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. + +4. The sysprep process reboots the PC and starts at the first-run experience screen. Complete the set up, and then sign in to the computer using an account that has local administrator privileges. + +5. Right-click Start, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section. + +6. In **User Profiles**, click **Default Profile**, and then click **Copy To**. ![Example of UI](images/copy-to.png) -8. In **Copy To**, under **Permitted to use**, click **Change**. +7. In **Copy To**, under **Permitted to use**, click **Change**. ![Example of UI](images/copy-to-change.png) - -9. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. -10. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#extension) for the operating system version. For example, the folder name must end with “.v6” to identify it as a user profile folder for Windows 10, version 1607. +8. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. + +9. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#extension) for the operating system version. For example, the folder name must end with “.v6” to identify it as a user profile folder for Windows 10, version 1607. - If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path. - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. - + ![Example of UI](images/copy-to-path.png) -9. Click **OK** to copy the default user profile. +10. Click **OK** to copy the default user profile. **To make the user profile mandatory** - + 3. In File Explorer, open the folder where you stored the copy of the profile. >[!NOTE] >If the folder is not displayed, click **View** > **Options** > **Change folder and search options**. On the **View** tab, select **Show hidden files and folders**, clear **Hide protected operating system files**, click **Yes** to confirm that you want to show operating system files, and then click **OK** to save your changes. -1. Rename `Ntuser.dat` to `Ntuser.man`. +4. Rename `Ntuser.dat` to `Ntuser.man`. ## How to apply a mandatory user profile to users @@ -146,6 +149,8 @@ When a user is configured with a mandatory profile, Windows 10 starts as though | Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | | Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | +> [!Note] +> The Group Policy settings above can be applied in Windows 10 Professional edition. diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 07e2cb8f96..9241a7fdf7 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -45,28 +45,6 @@ ## [DMProcessConfigXMLFiltered](dmprocessconfigxmlfiltered.md) ## [Using PowerShell scripting with the WMI Bridge Provider](using-powershell-scripting-with-the-wmi-bridge-provider.md) ## [WMI providers supported in Windows 10](wmi-providers-supported-in-windows.md) -## [Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) -### [Design a custom configuration service provider](design-a-custom-windows-csp.md) -### [IConfigServiceProvider2](iconfigserviceprovider2.md) -#### [IConfigServiceProvider2::ConfigManagerNotification](iconfigserviceprovider2configmanagernotification.md) -#### [IConfigServiceProvider2::GetNode](iconfigserviceprovider2getnode.md) -### [ICSPNode](icspnode.md) -#### [ICSPNode::Add](icspnodeadd.md) -#### [ICSPNode::Clear](icspnodeclear.md) -#### [ICSPNode::Copy](icspnodecopy.md) -#### [ICSPNode::DeleteChild](icspnodedeletechild.md) -#### [ICSPNode::DeleteProperty](icspnodedeleteproperty.md) -#### [ICSPNode::Execute](icspnodeexecute.md) -#### [ICSPNode::GetChildNodeNames](icspnodegetchildnodenames.md) -#### [ICSPNode::GetProperty](icspnodegetproperty.md) -#### [ICSPNode::GetPropertyIdentifiers](icspnodegetpropertyidentifiers.md) -#### [ICSPNode::GetValue](icspnodegetvalue.md) -#### [ICSPNode::Move](icspnodemove.md) -#### [ICSPNode::SetProperty](icspnodesetproperty.md) -#### [ICSPNode::SetValue](icspnodesetvalue.md) -### [ICSPNodeTransactioning](icspnodetransactioning.md) -### [ICSPValidate](icspvalidate.md) -### [Samples for writing a custom configuration service provider](samples-for-writing-a-custom-configuration-service-provider.md) ## [Configuration service provider reference](configuration-service-provider-reference.md) ### [AccountManagement CSP](accountmanagement-csp.md) #### [AccountManagement DDF file](accountmanagement-ddf.md) @@ -77,6 +55,8 @@ ### [AllJoynManagement CSP](alljoynmanagement-csp.md) #### [AllJoynManagement DDF](alljoynmanagement-ddf.md) ### [APPLICATION CSP](application-csp.md) +### [ApplicationControl CSP](applicationcontrol-csp.md) +#### [ApplicationControl DDF file](applicationcontrol-csp-ddf.md) ### [AppLocker CSP](applocker-csp.md) #### [AppLocker DDF file](applocker-ddf-file.md) #### [AppLocker XSD](applocker-xsd.md) @@ -127,6 +107,8 @@ #### [DynamicManagement DDF file](dynamicmanagement-ddf.md) ### [EMAIL2 CSP](email2-csp.md) #### [EMAIL2 DDF file](email2-ddf-file.md) +### [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) +#### [EnrollmentStatusTracking DDF file](enrollmentstatustracking-csp-ddf.md) ### [EnterpriseAPN CSP](enterpriseapn-csp.md) #### [EnterpriseAPN DDF](enterpriseapn-ddf.md) ### [EnterpriseAppManagement CSP](enterpriseappmanagement-csp.md) @@ -177,7 +159,15 @@ #### [Personalization DDF file](personalization-ddf.md) ### [Policy CSP](policy-configuration-service-provider.md) #### [Policy DDF file](policy-ddf-file.md) -#### [ApplicationRestrictions XSD](applicationrestrictions-xsd.md) +#### [Policies supported by Group Policy](policies-supported-by-group-policy.md) +#### [ADMX-backed policies](policies-admx-backed.md) +#### [Policies supported by HoloLens 2](policies-supported-by-hololens2.md) +#### [Policies supported by HoloLens (1st gen) Commercial Suite](policies-supported-by-hololens-1st-gen-commercial-suite.md) +#### [Policies supported by HoloLens (1st gen) Development Edition](policies-supported-by-hololens-1st-gen-development-edition.md) +#### [Policies supported by Windows 10 IoT Enterprise](policies-supported-by-iot-enterprise.md) +#### [Policies supported by Windows 10 IoT Core](policies-supported-by-iot-core.md) +#### [Policies supported by Microsoft Surface Hub](policies-supported-by-surface-hub.md) +#### [Policies that can be set using Exchange Active Sync (EAS)](policies-that-can-be-set-using-eas.md) #### [AboveLock](policy-csp-abovelock.md) #### [Accounts](policy-csp-accounts.md) #### [ActiveXControls](policy-csp-activexcontrols.md) @@ -186,6 +176,7 @@ #### [AppRuntime](policy-csp-appruntime.md) #### [AppVirtualization](policy-csp-appvirtualization.md) #### [AttachmentManager](policy-csp-attachmentmanager.md) +#### [Audit](policy-csp-audit.md) #### [Authentication](policy-csp-authentication.md) #### [Autoplay](policy-csp-autoplay.md) #### [Bitlocker](policy-csp-bitlocker.md) @@ -206,6 +197,7 @@ #### [DeliveryOptimization](policy-csp-deliveryoptimization.md) #### [Desktop](policy-csp-desktop.md) #### [DeviceGuard](policy-csp-deviceguard.md) +#### [DeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md) #### [DeviceInstallation](policy-csp-deviceinstallation.md) #### [DeviceLock](policy-csp-devicelock.md) #### [Display](policy-csp-display.md) @@ -243,8 +235,8 @@ #### [RestrictedGroups](policy-csp-restrictedgroups.md) #### [Search](policy-csp-search.md) #### [Security](policy-csp-security.md) +#### [ServiceControlManager](policy-csp-servicecontrolmanager.md) #### [Settings](policy-csp-settings.md) -#### [SmartScreen](policy-csp-smartscreen.md) #### [Speech](policy-csp-speech.md) #### [Start](policy-csp-start.md) #### [Storage](policy-csp-storage.md) @@ -254,11 +246,13 @@ #### [TaskScheduler](policy-csp-taskscheduler.md) #### [TextInput](policy-csp-textinput.md) #### [TimeLanguageSettings](policy-csp-timelanguagesettings.md) +#### [Troubleshooting](policy-csp-troubleshooting.md) #### [Update](policy-csp-update.md) #### [UserRights](policy-csp-userrights.md) #### [Wifi](policy-csp-wifi.md) #### [WindowsConnectionManager](policy-csp-windowsconnectionmanager.md) #### [WindowsDefenderSecurityCenter](policy-csp-windowsdefendersecuritycenter.md) +#### [WindowsDefenderSmartScreen](policy-csp-smartscreen.md) #### [WindowsInkWorkspace](policy-csp-windowsinkworkspace.md) #### [WindowsLogon](policy-csp-windowslogon.md) #### [WindowsPowerShell](policy-csp-windowspowershell.md) diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md index 866c9e3470..04edf1f24d 100644 --- a/windows/client-management/mdm/accountmanagement-csp.md +++ b/windows/client-management/mdm/accountmanagement-csp.md @@ -1,12 +1,14 @@ --- title: AccountManagement CSP -description: Used to configure settings in the Account Manager service -ms.author: maricia +description: Learn about the AccountManagement CSP, which is used to configure settings in the Account Manager service. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: lomayor ms.date: 03/23/2018 +ms.reviewer: +manager: dansimp --- # AccountManagement CSP @@ -14,7 +16,7 @@ ms.date: 03/23/2018 AccountManagement CSP is used to configure setting in the Account Manager service in Windows Holographic for Business edition. Added in Windows 10, version 1803. -> [!Note] +> [!NOTE] > The AccountManagement CSP is only supported in Windows Holographic for Business edition. @@ -29,7 +31,7 @@ Root node for the AccountManagement configuration service provider. Interior node. **UserProfileManagement/EnableProfileManager** -Enable profile lifetime mangement for shared or communal device scenarios. Default value is false. +Enable profile lifetime management for shared or communal device scenarios. Default value is false. Supported operations are Add, Get,Replace, and Delete. Value type is bool. @@ -57,4 +59,4 @@ Supported operations are Add, Get,Replace, and Delete. Value type is integer. **UserProfileManagement/ProfileInactivityThreshold** Start deleting profiles when they have not been logged on during the specified period, given as number of days. Default value is 30. -Supported operations are Add, Get,Replace, and Delete. Value type is integer. \ No newline at end of file +Supported operations are Add, Get,Replace, and Delete. Value type is integer. diff --git a/windows/client-management/mdm/accountmanagement-ddf.md b/windows/client-management/mdm/accountmanagement-ddf.md index 4e6eb780a7..35fd257acb 100644 --- a/windows/client-management/mdm/accountmanagement-ddf.md +++ b/windows/client-management/mdm/accountmanagement-ddf.md @@ -1,12 +1,14 @@ --- title: AccountManagement DDF file -description: Used to configure settings in the Account Manager service -ms.author: maricia +description: View the OMA DM device description framework (DDF) for the AccountManagement configuration service provider. This file is used to configure settings. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: lomayor ms.date: 03/23/2018 +ms.reviewer: +manager: dansimp --- # AccountManagement DDF file @@ -16,7 +18,7 @@ This topic shows the OMA DM device description framework (DDF) for the **Account The XML below is for Windows 10, version 1803. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/accounts-csp.md b/windows/client-management/mdm/accounts-csp.md index 19820b0309..d6d6a9fc16 100644 --- a/windows/client-management/mdm/accounts-csp.md +++ b/windows/client-management/mdm/accounts-csp.md @@ -1,12 +1,14 @@ --- title: Accounts CSP -description: The Accounts configuration service provider (CSP) is used by the enterprise (1) to rename a device, (2) to create a new local Windows account and joint it to a local user group. -ms.author: maricia +description: The Accounts configuration service provider (CSP) is used by the enterprise to rename devices, as well as create local Windows accounts & joint them to a group. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: lomayor ms.date: 04/17/2018 +ms.reviewer: +manager: dansimp --- # Accounts CSP @@ -26,9 +28,14 @@ Root node. Interior node for the account domain information. **Domain/ComputerName** -This node specifies the name for a device. This setting can be managed remotely. A couple of macros can be embedded within the value for dynamic substitution: %RAND:<# of digits>% and %SERIAL%. +This node specifies the DNS hostname for a device. This setting can be managed remotely, but note that this not supported for devices hybrid joined to Azure Active Directory and an on-premises Active directory. The server must explicitly reboot the device for this value to take effect. A couple of macros can be embedded within the value for dynamic substitution. Using any of these macros will limit the new name to 15 characters. -Examples: (a) "Test%RAND:6%" will generate a name "Test" followed by 6 random digits (e.g., "Test123456"). (b) "Foo%SERIAL%", will generate a name "Foo" followed by the serial number derived from device's ID. The server must explicitly reboot the device for this value to take effect. +Available naming macros: + +|Macro|Description|Example|Generated Name| +|:---|:---|:---|:---| +|%RAND:<# of digits>|Generates the specified number of random digits.|Test%RAND:6%|Test123456| +|%SERIAL%|Generates the serial number derived from the device. If the serial number causes the new name to exceed the 15 character limit, the serial number will be truncated from the beginning of the sequence.|Test-Device-%SERIAL%|Test-Device-456| Supported operation is Add. @@ -46,4 +53,4 @@ Supported operation is Add. **Users/_UserName_/LocalUserGroup** This optional node specifies the local user group that a local user account should be joined to. If the node is not set, the new local user account is joined just to the Standard Users group. Set the value to 2 for Administrators group. This setting can be managed remotely. -Supported operation is Add. \ No newline at end of file +Supported operation is Add. diff --git a/windows/client-management/mdm/accounts-ddf-file.md b/windows/client-management/mdm/accounts-ddf-file.md index c0bc44f76f..c4a1538d53 100644 --- a/windows/client-management/mdm/accounts-ddf-file.md +++ b/windows/client-management/mdm/accounts-ddf-file.md @@ -1,12 +1,14 @@ --- title: Accounts DDF file -description: XML file containing the device description framework -ms.author: maricia +description: XML file containing the device description framework for the Accounts configuration service provider. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: lomayor ms.date: 04/17/2018 +ms.reviewer: +manager: dansimp --- # Accounts CSP @@ -16,7 +18,7 @@ This topic shows the OMA DM device description framework (DDF) for the **Account The XML below is for Windows 10, version 1803. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/activesync-csp.md b/windows/client-management/mdm/activesync-csp.md index d77371ecc7..e2f9441b9c 100644 --- a/windows/client-management/mdm/activesync-csp.md +++ b/windows/client-management/mdm/activesync-csp.md @@ -2,11 +2,13 @@ title: ActiveSync CSP description: ActiveSync CSP ms.assetid: c65093ef-bd36-4f32-9dab-edb7bcfb3188 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: lomayor ms.date: 06/26/2017 --- @@ -24,7 +26,7 @@ On the desktop, only per user configuration (./User/Vendor/MSFT/ActiveSync) is s The ./Vendor/MSFT/ActiveSync path is deprecated, but will continue to work in the short term. -  + The following diagram shows the ActiveSync configuration service provider management objects in tree format as used by Open Mobile Alliance Device Management (OMA DM), OMA Client Provisioning, and Enterprise DM. @@ -40,7 +42,7 @@ On the desktop, only per user configuration (./User/Vendor/MSFT/ActiveSync) is s The ./Vendor/MSFT/ActiveSync path is deprecated, but will continue to work in the short term. -  + The supported operation is Get. @@ -58,13 +60,13 @@ When managing over OMA DM, make sure to always use a unique GUID. Provisioning w Braces { } are required around the GUID. In OMA Client Provisioning, you can type the braces. For example: -``` syntax +```xml ``` For OMA DM, you must use the ASCII values of %7B and %7D for the opening and closing braces, respectively. For example, if the GUID is "C556E16F-56C4-4EDB-9C64-D9469EE1FBE0", type: -``` syntax +```xml ./Vendor/MSFT/ActiveSync/Accounts/%7BC556E16F-56C4-4EDB-9C64-D9469EE1FBE0%7D @@ -203,7 +205,7 @@ Valid values are one of the following: - 5 – Email up to a month old is synced to the device. -**Options/ContentTypes/****_Content Type GUID_** +**Options/ContentTypes/***Content Type GUID* Defines the type of content to be individually enabled/disabled for sync. The *GUID* values allowed are one of the following: @@ -231,7 +233,7 @@ Required. A character string that specifies the name of the content type. > **Note**  In Windows 10, this node is currently not working. -  + Supported operations are Get, Replace, and Add (cannot Add after the account is created). @@ -255,9 +257,9 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete. [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/activesync-ddf-file.md b/windows/client-management/mdm/activesync-ddf-file.md index a1c9d4cb8d..6e4c1c5000 100644 --- a/windows/client-management/mdm/activesync-ddf-file.md +++ b/windows/client-management/mdm/activesync-ddf-file.md @@ -2,11 +2,13 @@ title: ActiveSync DDF file description: ActiveSync DDF file ms.assetid: c4cd4816-ad8f-45b2-9b81-8abb18254096 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: lomayor ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml **Note**  If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services, you have a free subscription to Azure AD. For step-by-step guide to register this free subscription, see [Register your free Azure Active Directory subscription.](#register-your-free-azure-active-directory-subscription) -1. Sign-up for Azure AD tenant from [this website](https://account.windowsazure.com/organization) by creating an administrator account for your organization. +1. Sign-up for Azure AD tenant from [this website](https://account.windowsazure.com/organization) by creating an administrator account for your organization. - ![sign up for azure ad tenant](images/azure-ad-add-tenant1.png) + ![sign up for azure ad tenant](images/azure-ad-add-tenant1.png) -2. Enter the information for your organization. Click **check availability** to verify that domain name that you selected is available. +2. Enter the information for your organization. Click **check availability** to verify that domain name that you selected is available. - ![sign up for azure ad](images/azure-ad-add-tenant2.png) + ![sign up for azure ad](images/azure-ad-add-tenant2.png) -3. Complete the login and country information. You must provide a valid phone number, then click **Send text message** or **Call me**. +3. Complete the login and country information. You must provide a valid phone number, then click **Send text message** or **Call me**. - ![create azure account](images/azure-ad-add-tenant3.png) + ![create azure account](images/azure-ad-add-tenant3.png) -4. Enter the code that you receive and then click **Verify code**. After the code is verified and the continue button turns green, click **continue**. +4. Enter the code that you receive and then click **Verify code**. After the code is verified and the continue button turns green, click **continue**. - ![add aad tenant](images/azure-ad-add-tenant3-b.png) + ![add aad tenant](images/azure-ad-add-tenant3-b.png) -5. After you finish creating your Azure account, you are ready to add an Azure AD subscription. +5. After you finish creating your Azure account, you are ready to add an Azure AD subscription. - If you don't have a paid subscription to any Microsoft service, you can purchase an Azure AD premium subscription. Go to Office 356 portal, and then sign in using the admin account that you just created in Step 4 (for example, user1@contosoltd.onmicrosoftcom). + If you don't have a paid subscription to any Microsoft service, you can purchase an Azure AD premium subscription. Go to Office 356 portal, and then sign in using the admin account that you just created in Step 4 (for example, user1@contosoltd.onmicrosoftcom). - ![login to office 365](images/azure-ad-add-tenant4.png) + ![login to office 365](images/azure-ad-add-tenant4.png) -6. Click **Install software**. +6. Click **Install software**. - ![login to office 365](images/azure-ad-add-tenant5.png) + ![login to office 365](images/azure-ad-add-tenant5.png) -7. In the Office 365 portal, select **Purchase Services** from the left nagivation. +7. In the Office 365 portal, select **Purchase Services** from the left nagivation. - ![purchase service option in admin center menu](images/azure-ad-add-tenant6.png) + ![purchase service option in admin center menu](images/azure-ad-add-tenant6.png) -8. On the **Purchase services** page, scroll down until you see **Azure Active Directory Premium**, then click to purchase. +8. On the **Purchase services** page, scroll down until you see **Azure Active Directory Premium**, then click to purchase. - ![azure active directory option in purchase services page](images/azure-ad-add-tenant7.png) + ![azure active directory option in purchase services page](images/azure-ad-add-tenant7.png) -9. Continue with your purchase. +9. Continue with your purchase. - ![azure active directory premium payment page](images/azure-ad-add-tenant8.png) + ![azure active directory premium payment page](images/azure-ad-add-tenant8.png) 10. After the purchase is completed, you can login to your Office 365 Admin Portal and you will see the **Azure AD** option from the Admin drop-down menu along with other services (SharePoint, Exchange, etc...). @@ -89,7 +91,7 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent ![register azuread](images/azure-ad-add-tenant15.png) -  + diff --git a/windows/client-management/mdm/alljoynmanagement-csp.md b/windows/client-management/mdm/alljoynmanagement-csp.md index 2362bb66f0..e4d45bd4fd 100644 --- a/windows/client-management/mdm/alljoynmanagement-csp.md +++ b/windows/client-management/mdm/alljoynmanagement-csp.md @@ -2,11 +2,13 @@ title: AllJoynManagement CSP description: The AllJoynManagement configuration service provider (CSP) allows an IT administrator to enumerate the AllJoyn devices that are connected to the AllJoyn bus. ms.assetid: 468E0EE5-EED3-48FF-91C0-89F9D159AA8C -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: lomayor ms.date: 06/26/2017 --- @@ -20,7 +22,7 @@ The AllJoynManagement configuration service provider (CSP) is only supported in This CSP was added in Windows 10, version 1511. -  + For the firewall settings, note that PublicProfile and PrivateProfile are mutually exclusive. The Private Profile must be set on the directly on the device itself, and the only supported operation is Get. For PublicProfile, both Add and Get are supported. This CSP is intended to be used in conjunction with the AllJoyn Device System Bridge, and an understanding of the bridge will help when determining when and how to use this CSP. For more information, see [Device System Bridge (DSB) Project](https://go.microsoft.com/fwlink/p/?LinkId=615876) and [AllJoyn Device System Bridge](https://go.microsoft.com/fwlink/p/?LinkId=615877). @@ -36,19 +38,19 @@ The root node for the AllJoynManagement configuration service provider. **Services** List of all AllJoyn objects that are discovered on the AllJoyn bus. All AllJoyn objects that expose the "com.microsoft.alljoynmanagement.config" are included. -**Services/****_Node name_** +**Services/***Node name* The unique AllJoyn device ID (a GUID) that hosts one or more configurable objects. **Services/*Node name*/Port** The set of ports that the AllJoyn object uses to communicate configuration settings. Typically only one port is used for communication, but it is possible to specify additional ports. -**Services/*Node name*/Port/****_Node name_** +**Services/*Node name*/Port/***Node name* Port number used for communication. This is specified by the configurable AllJoyn object and reflected here. **Services/*Node name*/Port/*Node name*/CfgObject** The set of configurable interfaces that are available on the port of the AllJoyn object. -**Services/*Node name*/Port/*Node name*/CfgObject/****_Node name_** +**Services/*Node name*/Port/*Node name*/CfgObject/***Node name* The remainder of this URI is an escaped path to the configurable AllJoyn object hosted by the parent ServiceID and accessible by the parent PortNum. For example an AllJoyn Bridge with the Microsoft specific AllJoyn configuration interface "\\FabrikamService\\BridgeConfig" would be specified in the URI as: %2FFabrikamService%2FBridgeConfig. @@ -58,7 +60,7 @@ This is the credential store. An administrator can set credentials for each AllJ When a SyncML request arrives in the CSP to replace or query a configuration item on an AllJoyn object that requires authentication, then the CSP uses the credentials stored here during the authentication phase. -**Credentials/****_Node name_** +**Credentials/***Node name* This is the same service ID specified in \\AllJoynManagement\\Services\\ServiceID URI. It is typically implemented as a GUID. **Credentials/*Node name*/Key** @@ -78,7 +80,7 @@ Boolean value indicating whether AllJoyn router service (AJRouter.dll) is enable Set adapter configuration -``` syntax +```xml SyncML xmlns="SYNCML:SYNCML1.2"> @@ -102,7 +104,7 @@ You should replace \_ALLJOYN\_DEVICE\_ID\_ with an actual device ID. Note that t Get PIN data -``` syntax +```xml @@ -121,7 +123,7 @@ Get PIN data Get the firewall PrivateProfile -``` syntax +```xml @@ -137,9 +139,9 @@ Get the firewall PrivateProfile ``` -  + -  + diff --git a/windows/client-management/mdm/alljoynmanagement-ddf.md b/windows/client-management/mdm/alljoynmanagement-ddf.md index c9da82f50a..1a79f57833 100644 --- a/windows/client-management/mdm/alljoynmanagement-ddf.md +++ b/windows/client-management/mdm/alljoynmanagement-ddf.md @@ -2,11 +2,13 @@ title: AllJoynManagement DDF description: AllJoynManagement DDF ms.assetid: 540C2E60-A041-4749-A027-BBAF0BB046E4 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: lomayor ms.date: 12/05/2017 --- @@ -17,7 +19,7 @@ This topic shows the OMA DM device description framework (DDF) for the **AllJoyn Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -``` syntax +```xml +]> + + 1.2 + + ApplicationControl + ./Vendor/MSFT + + + + + Root Node of the ApplicationControl CSP + + + + + + + + + + + + + + + Policies + + + + + Beginning of a Subtree that contains all policies. + + + + + + + + + + Policies + + + + + + + + + + + The GUID of the Policy + + + + + + + + + + Policy GUID + + + + + + Policy + + + + + + + + The policy binary encoded as base64 + + + + + + + + + + Policy + + + + + + + PolicyInfo + + + + + Information Describing the Policy indicated by the GUID + + + + + + + + + + PolicyInfo + + + + + + Version + + + + + Version of the Policy indicated by the GUID, as a string. When parsing use a uint64 as the containing data type + + + + + + + + + + Version + + text/plain + + + + + IsEffective + + + + + Whether the Policy indicated by the GUID is Effective on the system (loaded by the enforcement engine and in effect) + + + + + + + + + + IsEffective + + text/plain + + + + + IsDeployed + + + + + Whether the Policy indicated by the GUID is deployed on the system (on the physical machine) + + + + + + + + + + IsDeployed + + text/plain + + + + + IsAuthorized + + + + + Whether the Policy indicated by the GUID is authorized to be loaded by the enforcement engine on the system + + + + + + + + + + IsAuthorized + + text/plain + + + + + Status + + + + + The Current Status of the Policy Indicated by the Policy GUID + + + + + + + + + + Status + + text/plain + + + + + FriendlyName + + + + + The FriendlyName of the Policy Indicated by the Policy GUID + + + + + + + + + + FriendlyName + + text/plain + + + + + + + + +``` \ No newline at end of file diff --git a/windows/client-management/mdm/applicationcontrol-csp.md b/windows/client-management/mdm/applicationcontrol-csp.md new file mode 100644 index 0000000000..121f28dad6 --- /dev/null +++ b/windows/client-management/mdm/applicationcontrol-csp.md @@ -0,0 +1,267 @@ +--- +title: ApplicationControl CSP +description: The ApplicationControl CSP allows you to manage multiple Windows Defender Application Control (WDAC) policies from a MDM server. +keywords: whitelisting, security, malware +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: ManikaDhiman +ms.reviewer: jsuther1974 +ms.date: 05/21/2019 +--- + +# ApplicationControl CSP + +Windows Defender Application Control (WDAC) policies can be managed from an MDM server through ApplicationControl configuration service provider (CSP). This CSP provides expanded diagnostic capabilities and support for [multiple policies](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies) (introduced in Windows 10, version 1903). It also provides support for rebootless policy deployment (introduced in Windows 10, version 1709). Unlike [AppLocker CSP](applocker-csp.md), ApplicationControl CSP correctly detects the presence of no-reboot option and consequently does not schedule a reboot. +Existing WDAC policies deployed using AppLocker CSP’s CodeIntegrity node can now be deployed using ApplicationControl CSP URI. Although WDAC policy deployment via AppLocker CSP will continue to be supported, all new feature work will be done in ApplicationControl CSP only. + +ApplicationControl CSP was added in Windows 10, version 1903. + +The following diagram shows ApplicationControl CSP in tree format. + +![tree diagram for applicationcontrol csp](images/provisioning-csp-applicationcontrol.png) + +**./Vendor/MSFT/ApplicationControl** +Defines the root node for ApplicationControl CSP. + +Scope is permanent. Supported operation is Get. + +**ApplicationControl/Policies** +An interior node that contains all the policies, each identified by their globally unique identifier (GUID). + +Scope is permanent. Supported operation is Get. + +**ApplicationControl/Policies/_Policy GUID_** +ApplicationControl CSP enforces that the “ID” segment of a given policy URI is the same GUID as the policy ID in the policy blob. Each *Policy GUID* node contains a Policy node and a corresponding PolicyInfo node. + +Scope is dynamic. Supported operation is Get. + +**ApplicationControl/Policies/_Policy GUID_/Policy** +This node is the policy binary itself, which is encoded as base64. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +Value type is b64. Supported value is a binary file, converted from the policy XML file by the ConvertFrom-CIPolicy cmdlet. + +Default value is empty. + +**ApplicationControl/Policies/_Policy GUID_/PolicyInfo** +An interior node that contains the nodes that describe the policy indicated by the GUID. + +Scope is dynamic. Supported operation is Get. + +**ApplicationControl/Policies/_Policy GUID_/PolicyInfo/Version** +This node provides the version of the policy indicated by the GUID. Stored as a string, but when parsing use a uint64 as the containing data type. + +Scope is dynamic. Supported operation is Get. + +Value type is char. + +**ApplicationControl/Policies/_Policy GUID_/PolicyInfo/IsEffective** +This node specifies whether a policy is actually loaded by the enforcement engine and is in effect on a system. + +Scope is dynamic. Supported operation is Get. + +Value type is bool. Supported values are as follows: + +- True — Indicates that the policy is actually loaded by the enforcement engine and is in effect on a system. +- False — Indicates that the policy is not loaded by the enforcement engine and is not in effect on a system. This is the default. + +**ApplicationControl/Policies/_Policy GUID_/PolicyInfo/IsDeployed** +This node specifies whether a policy is deployed on the system and is present on the physical machine. + +Scope is dynamic. Supported operation is Get. + +Value type is bool. Supported values are as follows: + +- True — Indicates that the policy is deployed on the system and is present on the physical machine. +- False — Indicates that the policy is not deployed on the system and is not present on the physical machine. This is the default. + +**ApplicationControl/Policies/_Policy GUID_/PolicyInfo/IsAuthorized** +This node specifies whether the policy is authorized to be loaded by the enforcement engine on the system. If not authorized, a policy cannot take effect on the system. + +Scope is dynamic. Supported operation is Get. + +Value type is bool. Supported values are as follows: + +- True — Indicates that the policy is authorized to be loaded by the enforcement engine on the system. +- False — Indicates that the policy is not authorized to be loaded by the enforcement engine on the system. This is the default. + +The following table provides the result of this policy based on different values of IsAuthorized, IsDeployed, and IsEffective nodes: + +|IsAuthorized | IsDeployed | IsEffective | Resultant | +|------------ | ---------- | ----------- | --------- | +|True|True|True|Policy is currently running and in effect.| +|True|True|False|Policy requires a reboot to take effect.| +|True|False|True|Policy requires a reboot to unload from CI.| +|False|True|True|Not Reachable.| +|True|False|False|*Not Reachable.| +|False|True|False|*Not Reachable.| +|False|False|True|Not Reachable.| +|False|False|False|*Not Reachable.| + +`*` denotes a valid intermediary state; however, if an MDM transaction results in this state configuration, the END_COMMAND_PROCESSING will result in a fail. + +**ApplicationControl/Policies/_Policy GUID_/PolicyInfo/Status** +This node specifies whether the deployment of the policy indicated by the GUID was successful. + +Scope is dynamic. Supported operation is Get. + +Value type is integer. Default value is 0 == OK. + +**ApplicationControl/Policies/_Policy GUID_/PolicyInfo/FriendlyName** +This node provides the friendly name of the policy indicated by the policy GUID. + +Scope is dynamic. Supported operation is Get. + +Value type is char. + +## Microsoft Endpoint Manager (MEM) Intune Usage Guidance + +For customers using Intune standalone or hybrid management with Configuration Manager (MEMCM) to deploy custom policies via the ApplicationControl CSP, refer to [Deploy Windows Defender Application Control policies by using Microsoft Intune](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune) + +## Non-Intune Usage Guidance + +In order to leverage the ApplicationControl CSP without using Intune, you must: + +1. Know a generated policy’s GUID, which can be found in the policy xml as or for pre-1903 systems. +2. Convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet in order to be deployed. The binary policy may be signed or unsigned. +3. Create a policy node (a Base64-encoded blob of the binary policy representation) using the certutil -encode command line tool. + +Below is a sample certutil invocation: + +```cmd +certutil -encode WinSiPolicy.p7b WinSiPolicy.cer +``` + +An alternative to using certutil would be to use the following PowerShell invocation: + +```powershell +[Convert]::toBase64String($(Get-Content -Encoding Byte -ReadCount 0 -Path )) +``` + +### Deploy Policies + +To deploy a new base policy using the CSP, perform an ADD on **./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy** using the Base64-encoded policy node as {Data}. Refer to the the Format section in the Example 1 below. + +To deploy base policy and supplemental policies: + +1. Perform an ADD on **./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy** using the Base64-encoded policy node as {Data} with the GUID and policy data for the base policy. +2. Repeat for each base or supplemental policy (with its own GUID and data). + +The following example shows the deployment of two base policies and a supplemental policy (which already specifies the base policy it supplements and does not need that reflected in the ADD). + +#### Example 1: Add first base policy + +```xml + + 1 + + + ./Vendor/MSFT/ApplicationControl/Policies/{Base1GUID}/Policy + + + b64 + + {Base1Data} + + +``` + +#### Example 2: Add second base policy + +```xml + + 1 + + + ./Vendor/MSFT/ApplicationControl/Policies/{Base2GUID}/Policy + + + b64 + + {Base2Data} + + +``` + +#### Example 3: Add supplemental policy + +```xml + + 1 + + + ./Vendor/MSFT/ApplicationControl/Policies/{Supplemental1GUID}/Policy + + + b64 + + {Supplemental1Data} + + +``` + +### Get policies + +Perform a GET using a deployed policy’s GUID to interrogate/inspect the policy itself or information about it. + +The following table displays the result of Get operation on different nodes: + +|Nodes | Get Results| +|------------- | ------| +|./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy|raw p7b| +|./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/PolicyInfo/Version|Policy version| +|./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/PolicyInfo/IsEffective|Is the policy in effect| +|./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/PolicyInfo/IsDeployed|Is the policy on the system| +|./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/PolicyInfo/IsAuthorized|Is the policy authorized on the system| +|./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/PolicyInfo/Status|Was the deployment successful| +|./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/PolicyInfo/FriendlyName|Friendly name per the policy| + +The following is an example of Get command: + +```xml + + 1 + + + ./Vendor/MSFT/ApplicationControl/Policies/{PolicyGUID}/Policy + + + +``` + +### Delete policies + +#### Rebootless Deletion + +Upon deletion, policies deployed via the ApplicationControl CSP are removed from the system but stay in effect until the next reboot. In order to functionally do a rebootless delete, first replace the existing policy with an Allow All policy (found at C:\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll.xml) and then delete the updated policy. This will immediately prevent anything from being blocked and fully deactive the policy on the next reboot. + +#### Unsigned Policies + +To delete an unsigned policy, perform a DELETE on **./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy**. + +#### Signed Policies + +> [!NOTE] +> A signed policy by default can only be replaced by another signed policy. Hence, performing a DELETE on **./Vendor/MSFT/ApplicationControl/Policies/_Policy GUID_/Policy** is not sufficient to delete a signed policy. + +To delete a signed policy: + +1. Replace it with a signed update allowing unsigned policy. +2. Deploy another update with unsigned Allow All policy. +3. Perform delete. + +The following is an example of Delete command: + +```xml + + 1 + + + ./Vendor/MSFT/ApplicationControl/Policies/{PolicyGUID}/Policy + + + +``` diff --git a/windows/client-management/mdm/applicationrestrictions-xsd.md b/windows/client-management/mdm/applicationrestrictions-xsd.md deleted file mode 100644 index 1a54b6702f..0000000000 --- a/windows/client-management/mdm/applicationrestrictions-xsd.md +++ /dev/null @@ -1,127 +0,0 @@ ---- -title: ApplicationRestrictions XSD -description: Here's the XSD for the ApplicationManagement/ApplicationRestrictions policy. -ms.assetid: A5AA2B59-3736-473E-8F70-A90FD61EE426 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ApplicationRestrictions XSD - - -Here's the XSD for the ApplicationManagement/ApplicationRestrictions policy. - -``` syntax - - - - - - - - - - - - - - - - - - - - - GUID must use lowercase letters - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -``` - -  - -  - - - - - - diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index c9d931e3e6..5f163fa7a7 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -2,12 +2,14 @@ title: AppLocker CSP description: AppLocker CSP ms.assetid: 32FEA2C9-3CAD-40C9-8E4F-E3C69637580F -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 04/30/2018 +author: lomayor +ms.date: 11/19/2019 --- # AppLocker CSP @@ -15,35 +17,156 @@ ms.date: 04/30/2018 The AppLocker configuration service provider is used to specify which applications are allowed or disallowed. There is no user interface shown for apps that are blocked. -> **Note**   -> When you create a list of allowed apps, all [inbox apps](#inboxappsandcomponents) are also blocked, and you must include them in your list of allowed apps. Don't forget to add the inbox apps for Phone, Messaging, Settings, Start, Email and accounts, Work and school, and other apps that you need. -> -> In Windows 10 Mobile, when you create a list of allowed apps, the [settings app that rely on splash apps](#settingssplashapps) are blocked. To unblock these apps, you must include them in your list of allowed apps. -> -> Delete/unenrollment is not properly supported unless Grouping values are unique across enrollments. If multiple enrollments use the same Grouping value, then unenrollment will not work as expected since there are duplicate URIs that get deleted by the resource manager. To prevent this problem, the Grouping value should include some randomness. The best practice is to use a randomly generated GUID. However, there is no requirement on the exact value of the node. - - The following diagram shows the AppLocker configuration service provider in tree format. ![applocker csp](images/provisioning-csp-applocker.png) -**./Vendor/MSFT/AppLocker** +**./Vendor/MSFT/AppLocker** Defines the root node for the AppLocker configuration service provider. -**ApplicationLaunchRestrictions** +**AppLocker/ApplicationLaunchRestrictions** Defines restrictions for applications. -> [!NOTE]   +> [!NOTE] > When you create a list of allowed apps, all [inbox apps](#inboxappsandcomponents) are also blocked, and you must include them in your list of allowed apps. Don't forget to add the inbox apps for Phone, Messaging, Settings, Start, Email and accounts, Work and school, and other apps that you need. > -> In Windows 10 Mobile, when you create a list of allowed apps, the [settings app that rely on splash apps](#settingssplashapps) are blocked. To unblock these apps, you must include them in your list of allowed apps. +> In Windows 10 Mobile, when you create a list of allowed apps, the [settings app that rely on splash apps](#settingssplashapps) are blocked. To unblock these apps, you must include them in your list of allowed apps. +> +> Delete/unenrollment is not properly supported unless Grouping values are unique across enrollments. If multiple enrollments use the same Grouping value, then unenrollment will not work as expected since there are duplicate URIs that get deleted by the resource manager. To prevent this problem, the Grouping value should include some randomness. The best practice is to use a randomly generated GUID. However, there is no requirement on the exact value of the node. + Additional information: - [Find publisher and product name of apps](#productname) - step-by-step guide for getting the publisher and product names for various Windows apps. -- [Whitelist example](#whitelist-example) - example for Windows 10 Mobile that denies all apps except the ones listed. +- [Whitelist example](#whitelist-examples) - example for Windows 10 Mobile that denies all apps except the ones listed. -**EnterpriseDataProtection** +**AppLocker/ApplicationLaunchRestrictions/_Grouping_** +Grouping nodes are dynamic nodes, and there may be any number of them for a given enrollment (or a given context). The actual identifiers are selected by the management endpoint, whose job it is to determine what their purpose is, and to not conflict with other identifiers that they define. +Different enrollments and contexts may use the same Authority identifier, even if many such identifiers are active at the same time. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/EXE** +Defines restrictions for launching executable applications. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/EXE/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. + +Data type is string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/EXE/EnforcementMode** +The EnforcementMode node for Windows Information Protection (formerly known as Enterprise Data Protection) does not affect the behavior of EnterpriseDataProtection. The EDPEnforcementLevel from Policy CSP should be used to enable and disable Windows Information Protection (formerly known as Enterprise Data Protection). + +The data type is a string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/EXE/NonInteractiveProcessEnforcement** +The data type is a string. + +Supported operations are Add, Delete, Get, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/MSI** +Defines restrictions for executing Windows Installer files. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/MSI/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. + +Data type is string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/MSI/EnforcementMode** +The EnforcementMode node for Windows Information Protection (formerly known as Enterprise Data Protection) does not affect the behavior of EnterpriseDataProtection. The EDPEnforcementLevel from Policy CSP should be used to enable and disable Windows Information Protection (formerly known as Enterprise Data Protection). + +The data type is a string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/Script** +Defines restrictions for running scripts. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/Script/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. + +Data type is string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/Script/EnforcementMode** +The EnforcementMode node for Windows Information Protection (formerly known as Enterprise Data Protection) does not affect the behavior of EnterpriseDataProtection. The EDPEnforcementLevel from Policy CSP should be used to enable and disable Windows Information Protection (formerly known as Enterprise Data Protection). + +The data type is a string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/StoreApps** +Defines restrictions for running apps from the Microsoft Store. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/StoreApps/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. + +Data type is string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/StoreApps/EnforcementMode** +The EnforcementMode node for Windows Information Protection (formerly known as Enterprise Data Protection) does not affect the behavior of EnterpriseDataProtection. The EDPEnforcementLevel from Policy CSP should be used to enable and disable Windows Information Protection (formerly known as Enterprise Data Protection). + +The data type is a string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/DLL** +Defines restrictions for processing DLL files. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/DLL/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. + +Data type is string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/DLL/EnforcementMode** +The EnforcementMode node for Windows Information Protection (formerly known as Enterprise Data Protection) does not affect the behavior of EnterpriseDataProtection. The EDPEnforcementLevel from Policy CSP should be used to enable and disable Windows Information Protection (formerly known as Enterprise Data Protection). + +The data type is a string. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/DLL/NonInteractiveProcessEnforcement** +The data type is a string. + +Supported operations are Add, Delete, Get, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/CodeIntegrity** +This node is only supported on the desktop. + +Supported operations are Get, Add, Delete, and Replace. + +**AppLocker/ApplicationLaunchRestrictions/_Grouping_/CodeIntegrity/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. + +Data type is Base64. + +Supported operations are Get, Add, Delete, and Replace. + +> [!NOTE] +> To use Code Integrity Policy, you first need to convert the policies to binary format using the ConvertFrom-CIPolicy cmdlet. Then a Base64-encoded blob of the binary policy representation should be created (for example, using the [certutil -encode](https://go.microsoft.com/fwlink/p/?LinkId=724364) command line tool) and added to the Applocker-CSP. + +**AppLocker/EnterpriseDataProtection** Captures the list of apps that are allowed to handle enterprise data. Should be used in conjunction with the settings in **./Device/Vendor/MSFT/EnterpriseDataProtection** in [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md). In Windows 10, version 1607 the Windows Information Protection has a concept for allowed and exempt applications. Allowed applications can access enterprise data and the data handled by those applications are protected with encryption. Exempt applications can also access enterprise data, but the data handled by those applications are not protected. This is because some critical enterprise applications may have compatibility problems with encrypted data. @@ -62,138 +185,46 @@ Exempt examples: Additional information: -- [Recommended deny list for Windows Information Protection](#recommended-deny-list-for-windows-information-protection) - example for Windows 10, version 1607 that denies known unenlightened Microsoft apps from accessing enterprise data as an allowed app. This ensures an administrator does not accidentally make these apps Windows Information Protection allowed, and avoid known compatibility issues related to automatic file encryption with these applications. +- [Recommended deny list for Windows Information Protection](#recommended-deny-list-for-windows-information-protection) - example for Windows 10, version 1607 that denies known unenlightened Microsoft apps from accessing enterprise data as an allowed app. This ensures an administrator does not accidentally make these apps Windows Information Protection allowed, and avoid known compatibility issues related to automatic file encryption with these applications. -Each of the previously listed nodes contains a **Grouping** node. +**AppLocker/EnterpriseDataProtection/_Grouping_** +Grouping nodes are dynamic nodes, and there may be any number of them for a given enrollment (or a given context). The actual identifiers are selected by the management endpoint, whose job it is to determine what their purpose is, and to not conflict with other identifiers that they define. +Different enrollments and contexts may use the same Authority identifier, even if many such identifiers are active at the same time. - ---- - - - - - - - - - - - - -
    TermDescription

    Grouping

    Grouping nodes are dynamic nodes, and there may be any number of them for a given enrollment (or a given context). The actual identifiers are selected by the management endpoint, whose job it is to determine what their purpose is, and to not conflict with other identifiers that they define.

    -

    Different enrollments and contexts may use the same Authority identifier, even if many such identifiers are active at the same time.

    -

    Supported operations are Get, Add, Delete, and Replace.

    +Supported operations are Get, Add, Delete, and Replace. -  +**AppLocker/EnterpriseDataProtection/_Grouping_/EXE** +Defines restrictions for launching executable applications. -In addition, each **Grouping** node contains one or more of the following nodes: +Supported operations are Get, Add, Delete, and Replace. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    TermDescription

    EXE

    Defines restrictions for launching executable applications.

    -

    Supported operations are Get, Add, Delete, and Replace.

    MSI

    Defines restrictions for executing Windows Installer files.

    -

    Supported operations are Get, Add, Delete, and Replace.

    Script

    Defines restrictions for running scripts.

    -

    Supported operations are Get, Add, Delete, and Replace.

    StoreApps

    Defines restrictions for running apps from the Microsoft Store.

    -

    Supported operations are Get, Add, Delete, and Replace.

    DLL

    Defines restrictions for processing DLL files.

    -

    Supported operations are Get, Add, Delete, and Replace.

    CodeIntegrity

    This node is only supported on the desktop. Supported operations are Get, Add, Delete, and Replace.

    +**AppLocker/EnterpriseDataProtection/_Grouping_/EXE/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. -  +Data type is string. -Each of the previous nodes contains one or more of the following leaf nodes: +Supported operations are Get, Add, Delete, and Replace. - ---- - - - - - - - - - - - - - - - - - - - - -
    TermDescription

    Policy

    Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy.

    -

    Policy nodes are a Base64-encoded blob of the binary policy representation. The binary policy may be signed or unsigned.

    -

    For CodeIntegrity/Policy, you can use the [certutil -encode](https://go.microsoft.com/fwlink/p/?LinkId=724364) command line tool to encode the data to base-64.

    -

    Here is a sample certutil invocation:

    +**AppLocker/EnterpriseDataProtection/_Grouping_/StoreApps** +Defines restrictions for running apps from the Microsoft Store. -``` -certutil -encode WinSiPolicy.p7b WinSiPolicy.cer -``` +Supported operations are Get, Add, Delete, and Replace. -

    An alternative to using certutil would be to use the following PowerShell invocation:

    +**AppLocker/EnterpriseDataProtection/_Grouping_/StoreApps/Policy** +Policy nodes define the policy for launching executables, Windows Installer files, scripts, store apps, and DLL files. The contents of a given Policy node is precisely the XML format for a RuleCollection node in the corresponding AppLocker XML policy. -``` -[Convert]::ToBase64String($(Get-Content -Encoding Byte -ReadCount 0 -Path )) -``` +Data type is string. -

    If you are using hybrid MDM management with System Center Configuration Manager or using Intune, ensure that you are using Base64 as the Data type when using Custom OMA-URI functionality to apply the Code Integrity policy.

    -

    Data type is string. Supported operations are Get, Add, Delete, and Replace.

    EnforcementMode

    The EnforcementMode node for Windows Information Protection (formerly known as Enterprise Data Protection) does not affect the behavior of EnterpriseDataProtection. The EDPEnforcementLevel from Policy CSP should be used to enable and disable Windows Information Protection (formerly known as Enterprise Data Protection).

    -

    The data type is a string. Supported operations are Get, Add, Delete, and Replace.

    NonInteractiveProcessEnforcement

    The data type is a string.

    -

    Supported operations are Add, Delete, Get, and Replace.

    - -  +Supported operations are Get, Add, Delete, and Replace. ## Find publisher and product name of apps -You can pair a Windows Phone (Windows 10 Mobile, version 1511) to your desktop using the Device Portal on the phone to get the various types of information, including publisher name and product name of apps installed on the phone. This procedure describes pairing your phone to your desktop using WiFi. +You can pair a Windows Phone (Windows 10 Mobile, version 1511) to your desktop using the Device Portal on the phone to get the various types of information, including publisher name and product name of apps installed on the phone. This procedure describes pairing your phone to your desktop using WiFi. If this procedure does not work for you, try the other methods for pairing described in [Device Portal for Mobile](https://msdn.microsoft.com/windows/uwp/debug-test-perf/device-portal-mobile). -**To find Publisher and PackageFullName for apps installed on Windows 10 Mobile** +**To find Publisher and PackageFullName for apps installed on Windows 10 Mobile** 1. On your Windows Phone, go to **Settings**. Choose **Update & security**. Then choose **For developers**. 2. Choose **Developer mode**. @@ -253,7 +284,6 @@ The following table show the mapping of information to the AppLocker publisher r -  Here is an example AppLocker publisher rule: @@ -287,26 +317,28 @@ You can get the publisher name and product name of apps using a web API. -   - Here is the example for Microsoft OneNote: - Request +~~~ +Here is the example for Microsoft OneNote: - ``` syntax - https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata - ``` +Request - Result +``` syntax +https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata +``` - ``` syntax - { - "packageFamilyName": "Microsoft.Office.OneNote_8wekyb3d8bbwe", - "packageIdentityName": "Microsoft.Office.OneNote", - "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", - "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" - } - ``` +Result + +``` syntax +{ + "packageFamilyName": "Microsoft.Office.OneNote_8wekyb3d8bbwe", + "packageIdentityName": "Microsoft.Office.OneNote", + "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", + "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" +} +``` +~~~ @@ -332,17 +364,17 @@ You can get the publisher name and product name of apps using a web API. +

    If this value is populated then the simple thing to do to cover both the AppX and XAP package would be to create two rules for the app. One rule for AppX using the packageIdentityName and publisherCertificateName value and another one using the windowsPhoneLegacyId value.

    windowsPhoneLegacyId

    Same value maps to the ProductName and Publisher name

    This value will only be present if there is a XAP package associated with the app in the Store.

    -

    If this value is populated then the simple thing to do to cover both the AppX and XAP package would be to create two rules for the app. One rule for AppX using the packageIdentityName and publisherCertificateName value and anothe one using the windowsPhoneLegacyId value.
    -  + ## Settings apps that rely on splash apps -When you create a list of allowed apps in Windows 10 Mobile, you must also include the subset of Settings apps that rely on splash apps in your list of allowed apps. These apps are blocked unless they are explicitly added to the list of allowed apps. The following table shows the subset of Settings apps that rely on splash apps . +When you create a list of allowed apps in Windows 10 Mobile, you must also include the subset of Settings apps that rely on splash apps in your list of allowed apps. These apps are blocked unless they are explicitly added to the list of allowed apps. The following table shows the subset of Settings apps that rely on splash apps . The product name is first part of the PackageFullName followed by the version number. @@ -364,16 +396,17 @@ The product name is first part of the PackageFullName followed by the version nu | SettingsPageAppsCorner | 5b04b775-356b-4aa0-aaf8-6491ffea580a\_1.0.0.0\_neutral\_\_4vefaa8deck74 | 5b04b775-356b-4aa0-aaf8-6491ffea580a | | SettingsPagePhoneNfc | b0894dfd-4671-4bb9-bc17-a8b39947ffb6\_1.0.0.0\_neutral\_\_1prqnbg33c1tj | b0894dfd-4671-4bb9-bc17-a8b39947ffb6 | -  + ## Inbox apps and components The following list shows the apps that may be included in the inbox. -> **Note**  This list identifies system apps that ship as part of Windows that you can add to your AppLocker policy to ensure proper functioning of the operating system. If you decide to block some of these apps, we recommend a thorough testing before deploying to your production environment. Failure to do so may result in unexpected failures and can significantly degrade the user experience. +> [!NOTE] +> This list identifies system apps that ship as part of Windows that you can add to your AppLocker policy to ensure proper functioning of the operating system. If you decide to block some of these apps, we recommend a thorough testing before deploying to your production environment. Failure to do so may result in unexpected failures and can significantly degrade the user experience. + -  @@ -587,7 +620,7 @@ The following list shows the apps that may be included in the inbox. +

    PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"

    @@ -680,12 +713,12 @@ The following list shows the apps that may be included in the inbox. - + - + @@ -832,13 +865,13 @@ The following list shows the apps that may be included in the inbox.
    Microsoft Frameworks ProductID = 00000000-0000-0000-0000-000000000000 -

    PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
    Microsoft.MSPodcast
    Posdcast downloadsPodcast downloads 063773e7-f26f-4a92-81f0-aa71a1161e30
    PowerpointPowerPoint b50483c4-8046-4e1b-81ba-590b24935798 Microsoft.Office.PowerPoint
    -  + ## Whitelist examples The following example disables the calendar application. -``` syntax +```xml @@ -862,7 +895,7 @@ The following example disables the calendar application. The following example blocks the usage of the map application. -``` syntax +```xml @@ -939,14 +972,14 @@ The following example disables the Mixed Reality Portal. In the example, the **I ``` -The following example for Windows 10 Mobile denies all apps and allows the following apps: +The following example for Windows 10 Mobile denies all apps and allows the following apps: - [settings app that rely on splash apps](#settingssplashapps) - most of the [inbox apps](#inboxappsandcomponents), but not all. In this example, **MobileGroup0** is the node name. We recommend using a GUID for this node. -``` syntax +```xml @@ -1402,7 +1435,7 @@ In this example, **MobileGroup0** is the node name. We recommend using a GUID fo ## Example for Windows 10 Holographic for Business The following example for Windows 10 Holographic for Business denies all apps and allows the minimum set of [inbox apps](#inboxappsandcomponents) to enable to enable a working device, as well as Settings. -``` syntax +```xml @@ -1689,119 +1722,145 @@ In this example, Contoso is the node name. We recommend using a GUID for this no chr - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + - - + + - - - - - - + + - - - - + + - - - - - - + + - - - - + + - - - - - - + + - - - - + + - - + + - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1815,9 +1874,9 @@ In this example, Contoso is the node name. We recommend using a GUID for this no [Configuration service provider reference](configuration-service-provider-reference.md) -  - -  + + + diff --git a/windows/client-management/mdm/applocker-ddf-file.md b/windows/client-management/mdm/applocker-ddf-file.md index b61780ae9e..fde531cbc9 100644 --- a/windows/client-management/mdm/applocker-ddf-file.md +++ b/windows/client-management/mdm/applocker-ddf-file.md @@ -2,11 +2,13 @@ title: AppLocker DDF file description: AppLocker DDF file ms.assetid: 79E199E0-5454-413A-A57A-B536BDA22496 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: lomayor ms.date: 12/05/2017 --- @@ -17,7 +19,7 @@ This topic shows the OMA DM device description framework (DDF) for the **AppLock Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -``` syntax +```xml This example shows how to enable App-V on the device.

    -``` syntax +```xml $CmdID$ @@ -115,7 +117,7 @@ ms.date: 06/26/2017

    This example shows how to allow package scripts to run during package operations (publish, run, and unpublish). Allowing package scripts assists in package deployments (add and publish of App-V apps).

    -``` syntax +```xml $CmdID$ @@ -139,7 +141,7 @@ ms.date: 06/26/2017

    This SyncML example shows how to publish a package globally on an MDM enrolled device for all device users.

    -``` syntax +```xml $CmdID$ @@ -181,7 +183,7 @@ ms.date: 06/26/2017

    This SyncML example shows how to publish a package globally, with a policy that adds two shortcuts for the package, on an MDM enrolled device.

    -``` syntax +```xml $CmdID$ @@ -275,7 +277,7 @@ ms.date: 06/26/2017

    This SyncML example shows how to publish a package for a specific MDM user.

    -``` syntax +```xml $CmdID$ @@ -318,7 +320,7 @@ ms.date: 06/26/2017 > [!NOTE] > The user connection group has the user-only package as optional in this example, which implies users without the optional package can continue to launch the global package within the same connection group. -``` syntax +```xml $CmdID$ @@ -395,7 +397,7 @@ ms.date: 06/26/2017

    This SyncML example shows how to unpublish all global packages on the device by sending an empty package and connection group list in the SyncML.

    -``` syntax +```xml $CmdID$ @@ -431,7 +433,7 @@ ms.date: 06/26/2017

    These SyncML examples return all global, and user-published packages on the device.

    -``` syntax +```xml $CmdID$ @@ -442,7 +444,7 @@ ms.date: 06/26/2017 ``` -``` syntax +```xml $CmdID$ @@ -451,4 +453,4 @@ ms.date: 06/26/2017     -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/assign-seats.md b/windows/client-management/mdm/assign-seats.md index 1033a9f800..7fe33916b6 100644 --- a/windows/client-management/mdm/assign-seats.md +++ b/windows/client-management/mdm/assign-seats.md @@ -2,11 +2,13 @@ title: Assign seat description: The Assign seat operation assigns seat for a specified user in the Microsoft Store for Business. ms.assetid: B42BF490-35C9-405C-B5D6-0D9F0E377552 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: lomayor ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index e6004a22a5..b8eb37197c 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -2,16 +2,19 @@ title: AssignedAccess CSP description: The AssignedAccess configuration service provider (CSP) is used set the device to run in kiosk mode. ms.assetid: 421CC07D-6000-48D9-B6A3-C638AAF83984 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: lomayor ms.date: 09/18/2018 --- # AssignedAccess CSP +**Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.** The AssignedAccess configuration service provider (CSP) is used to set the device to run in kiosk mode. Once the CSP has been executed, then the next user login that is associated with the kiosk mode puts the device into the kiosk mode running the application specified in the CSP configuration. @@ -22,6 +25,9 @@ For a step-by-step guide for setting up devices to run in kiosk mode, see [Set u > [!Warning] > You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups. +> [!Note] +> If the application calls KeyCredentialManager.IsSupportedAsync when it is running in assigned access mode and it returns false on the first run, invoke the settings screen and select a convenience PIN to use with Windows Hello. This is the settings screen that is hidden by the application running in assigned access mode. You can only use Windows Hello if you first leave assigned access mode, select your convenience pin, and then go back into assigned access mode again. + > [!Note] > The AssignedAccess CSP is supported in Windows 10 Enterprise and Windows 10 Education. Starting from Windows 10, version 1709 it is also supported in Windows 10 Pro and Windows 10 S. Starting in Windows 10, version 1803, it is also supported in Windows Holographic for Business edition. @@ -55,7 +61,7 @@ Here's an example: > [!Tip] > In this example the double \\\ is required because it's in JSON and JSON escapes \ into \\\\. If an MDM server uses JSON parser\composer, they should ask customers to type only one \\, which will be \\\ in the JSON. If user types \\\\, it'll become \\\\\\\ in JSON, which will cause erroneous results. For the same reason, domain\account used in Configuration xml does not need \\\ but only one \\, because xml does not (need to) escape \\. -> +> > This applies to both domain\account, AzureAD\someone@contoso.onmicrosoft.com, i.e. as long as a \ used in JSON string.  When configuring the kiosk mode app, the account name will be used to find the target user. The account name includes domain name and user name. @@ -129,7 +135,7 @@ Additionally, the Status payload includes the following fields: Supported operation is Get. **./Device/Vendor/MSFT/AssignedAccess/ShellLauncher** -Added in Windows 10,version 1803. This node accepts a ShellLauncherConfiguration xml as input. Click [link](#shelllauncherconfiguration-xsd) to see the schema. For more information, see [Shell Launcher](https://docs.microsoft.com/windows-hardware/customize/enterprise/shell-launcher). +Added in Windows 10,version 1803. This node accepts a ShellLauncherConfiguration xml as input. Click [link](#shelllauncherconfiguration-xsd) to see the schema. Shell Launcher V2 is introduced in Windows 10, version 1903 to support both UWP and Win32 apps as the custom shell. For more information, see [Shell Launcher](https://docs.microsoft.com/windows/configuration/kiosk-shelllauncher). > [!Note] > You cannot set both ShellLauncher and KioskModeApp at the same time on the device. @@ -161,7 +167,7 @@ This MDM alert header is defined as follows: KioskModeApp Add -``` syntax +```xml @@ -183,7 +189,7 @@ KioskModeApp Add KioskModeApp Delete -``` syntax +```xml @@ -201,7 +207,7 @@ KioskModeApp Delete KioskModeApp Get -``` syntax +```xml @@ -219,7 +225,7 @@ KioskModeApp Get KioskModeApp Replace -``` syntax +```xml @@ -241,16 +247,23 @@ KioskModeApp Replace ## AssignedAccessConfiguration XSD -``` syntax +Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. + +```xml + + + @@ -265,6 +278,7 @@ KioskModeApp Replace + @@ -281,6 +295,10 @@ KioskModeApp Replace + + + + @@ -299,7 +317,13 @@ KioskModeApp Replace + + + + + + @@ -317,7 +341,8 @@ KioskModeApp Replace - + + @@ -335,6 +360,7 @@ KioskModeApp Replace + @@ -360,6 +386,22 @@ KioskModeApp Replace + + + + + + + + + + + + + + + + @@ -380,59 +422,146 @@ KioskModeApp Replace +``` +Here is the schema for new features introduced in Windows 10 1809 release +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +``` + +Schema for Windows 10 prerelease +```xml + + + + + + + + + + + + + + + + + + +``` + +To authorize a compatible configuration XML that includes 1809 or prerelease elements and attributes, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. e.g. to configure auto-launch feature which is added in 1809 release, use below sample, notice an alias r1809 is given to the 201810 namespace for 1809 release, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. +```xml + + + + + + ``` ## Example AssignedAccessConfiguration XML -``` syntax +```xml -  -    -      -        -          -          -          -          -          -          -          -        -      -      -        -                      -                      -                        -                          -                            -                              -                              -                              -                              -                              -                            -                            -                              -                              -                            -                          -                        -                      -                    -                ]]> -      -      -    -  -  -    -      MultiAppKioskUser -      -    -  + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + MultiAppKioskUser + + + ``` @@ -693,7 +822,7 @@ Example of the Delete command. ## StatusConfiguration XSD -``` syntax +```xml @@ -755,7 +884,7 @@ StatusConfiguration Add OnWithAlerts StatusConfiguration Delete -``` syntax +```xml @@ -773,7 +902,7 @@ StatusConfiguration Delete StatusConfiguration Get -``` syntax +```xml @@ -791,7 +920,7 @@ StatusConfiguration Get StatusConfiguration Replace On -```syntax +```xml @@ -821,7 +950,7 @@ StatusConfiguration Replace On ## Status example Status Get -``` syntax +```xml @@ -839,16 +968,21 @@ Status Get ## ShellLauncherConfiguration XSD -``` syntax +Shell Launcher V2 uses a separate XSD and namespace for backward compatibility. The original V1 XSD has a reference to the V2 XSD. + +```xml + + @@ -870,6 +1004,8 @@ Status Get + + @@ -880,10 +1016,11 @@ Status Get - - + + + @@ -895,6 +1032,7 @@ Status Get + @@ -925,7 +1063,7 @@ Status Get - + @@ -986,6 +1124,31 @@ Status Get ``` +### Shell Launcher V2 XSD + +```xml + + + + + + + + + + + + + + + +``` ## ShellLauncherConfiguration examples @@ -1106,6 +1269,61 @@ ShellLauncherConfiguration Add AutoLogon ``` +ShellLauncher V2 Add +``` + + + + 2 + + + ./Device/Vendor/MSFT/AssignedAccess/ShellLauncher + + + chr + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + +``` + ShellLauncherConfiguration Get ``` @@ -1125,7 +1343,7 @@ ShellLauncherConfiguration Get ## AssignedAccessAlert XSD -```syntax +```xml
    @@ -176,6 +172,34 @@ Footnotes: + +[ApplicationControl CSP](applicationcontrol-csp.md) + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark6check mark6check mark6check mark6check mark6check mark6check mark6
    + + + + [AppLocker CSP](applocker-csp.md) @@ -932,6 +956,34 @@ Footnotes: + +[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark6check mark6check mark6check mark6check mark6cross markcross mark
    + + + + [EnterpriseAPN CSP](enterpriseapn-csp.md) @@ -2500,8 +2552,6 @@ Footnotes: - - [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) @@ -2646,63 +2696,53 @@ Footnotes:
    - - Footnotes: -- 1 - Added in Windows 10, version 1607 -- 2 - Added in Windows 10, version 1703 -- 3 - Added in Windows 10, version 1709 -- 4 - Added in Windows 10, version 1803 -- 5 - Added in Windows 10, version 1809 - ## CSP DDF files download You can download the DDF files for various CSPs from the links below: - +- [Download all the DDF files for Windows 10, version 1903](https://download.microsoft.com/download/6/F/0/6F019079-6EB0-41B5-88E8-D1CE77DBA27B/Windows10_1903_DDF_download.zip) +- [Download all the DDF files for Windows 10, version 1809](https://download.microsoft.com/download/6/A/7/6A735141-5CFA-4C1B-94F4-B292407AF662/Windows10_1809_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1803](https://download.microsoft.com/download/6/2/7/6276FE19-E3FD-4254-9C16-3C31CAA2DE50/Windows10_1803_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1709](https://download.microsoft.com/download/9/7/C/97C6CF99-F75C-475E-AF18-845F8CECCFA4/Windows10_1709_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1607](https://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip) -## CSPs supported in Windows Holographic +## CSPs supported in HoloLens devices -The following list shows the configuration service providers supported in Windows Holographic editions. +The following list shows the CSPs supported in HoloLens devices: -| Configuration service provider | Windows Holographic edition | Windows Holographic for Business edition | -|--------|--------|------------| -| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | -| [Accounts CSP](accounts-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) -| [AppLocker CSP](applocker-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | -| [CertificateStore CSP](certificatestore-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png)| -| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [DevDetail CSP](devdetail-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)2 (runtime provisioning via provisioning packages only; no MDM support)| -| [DeviceStatus CSP](devicestatus-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [DevInfo CSP](devinfo-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DiagnosticLog CSP](diagnosticlog-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [DMAcc CSP](dmacc-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DMClient CSP](dmclient-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [NodeCache CSP](nodecache-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -[PassportForWork CSP](passportforwork-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [Policy CSP](policy-configuration-service-provider.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [RemoteFind CSP](remotefind-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | -| [RemoteWipe CSP](remotewipe-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | -| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [Update CSP](update-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [VPN2 CSP](vpnv2-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [WiFi CSP](wifi-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [WindowsLicensing CSP](windowslicensing-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | - - Footnotes: -- 1 - Added in Windows 10, version 1607 -- 2 - Added in Windows 10, version 1703 -- 3 - Added in Windows 10, version 1709 -- 4 - Added in Windows 10, version 1803 -- 5 - Added in Windows 10, version 1809 +| Configuration service provider | HoloLens (1st gen) Development Edition | HoloLens (1st gen) Commercial Suite | HoloLens 2 | +|------|--------|--------|--------| +| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) +| [Accounts CSP](accounts-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [ApplicationControl CSP](applicationcontrol-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [AppLocker CSP](applocker-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | +| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) | +| [CertificateStore CSP](certificatestore-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png)| ![check mark](images/checkmark.png) | +| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DevDetail CSP](devdetail-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)2 (runtime provisioning via provisioning packages only; no MDM support)| ![check mark](images/checkmark.png) | +| [DeviceManageability CSP](devicemanageability-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [DeviceStatus CSP](devicestatus-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DevInfo CSP](devinfo-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DiagnosticLog CSP](diagnosticlog-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DMAcc CSP](dmacc-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DMClient CSP](dmclient-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [NetworkProxy CSP](networkproxy-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [NodeCache CSP](nodecache-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +[PassportForWork CSP](passportforwork-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [Policy CSP](policy-configuration-service-provider.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [RemoteFind CSP](remotefind-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) | +| [RemoteWipe CSP](remotewipe-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png)4 | ![check mark](images/checkmark.png) | +| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [Update CSP](update-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [VPNv2 CSP](vpnv2-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [WiFi CSP](wifi-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [WindowsLicensing CSP](windowslicensing-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | + ## CSPs supported in Microsoft Surface Hub - [AccountManagement CSP](accountmanagement-csp.md) @@ -2750,12 +2790,19 @@ The following list shows the configuration service providers supported in Window - [Policy CSP](policy-configuration-service-provider.md) - [Provisioning CSP (Provisioning only)](provisioning-csp.md) - [Reboot CSP](reboot-csp.md) -- [RemoteWipe CSP](remotewipe-csp.md) 1 +- [RemoteWipe CSP](remotewipe-csp.md)5 - [RootCATrustedCertificates CSP](rootcacertificates-csp.md) - [UnifiedWriteFilter CSP](unifiedwritefilter-csp.md) - [Update CSP](update-csp.md) - [VPNv2 CSP](vpnv2-csp.md) - [WiFi CSP](wifi-csp.md) - Footnotes: -- 1 - Added in Windows 10, version 1809 +
    + + Footnotes: +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/create-a-custom-configuration-service-provider.md b/windows/client-management/mdm/create-a-custom-configuration-service-provider.md deleted file mode 100644 index 8604379b77..0000000000 --- a/windows/client-management/mdm/create-a-custom-configuration-service-provider.md +++ /dev/null @@ -1,95 +0,0 @@ ---- -title: Create a custom configuration service provider -description: Create a custom configuration service provider -ms.assetid: 0cb37f03-5bf2-4451-8276-23f4a1dee33f -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# Create a custom configuration service provider - -Mobile device OEMs can create custom configuration service providers to manage their devices. A configuration service provider includes an interface for creating, editing, and deleting nodes, and the nodes themselves. Each node contains data for one registry value and can optionally support get, set, and delete operations. - -To design a custom configuration service provider, the OEM must perform the following steps: - -1. Establish node semantics -2. Shape the configuration service provider's subtree -3. Choose a transactioning scheme for each node -4. Determine node operations - -For more information, see [Designing a custom configuration service provider](design-a-custom-windows-csp.md). - -To write a custom configuration service provider, the OEM must implement the following interfaces: - -- [IConfigServiceProvider2](iconfigserviceprovider2.md) (one per configuration service provider) - -- [ICSPNode](icspnode.md) (one per node) - -- [ICSPNodeTransactioning](icspnodetransactioning.md) (optional, for internally transactioned nodes only) - -- [ICSPValidate](icspvalidate.md) (optional, for UI only) - -This code must be compiled into a single .dll file and added to a package by using the instructions found in "Adding content to a package" in [Creating packages](https://msdn.microsoft.com/library/windows/hardware/dn756642). While writing this code, OEMs can store registry settings and files in the following locations. - - ---- - - - - - - - - - - -

    File location

    %DataDrive%\SharedData\OEM\CSP\

    Registry location

    $(HKLM.SOFTWARE)\OEM\CSP\

    - - -For examples of how to perform common tasks such as adding a node, replacing a node's value, querying a node's value, or enumerating a node's children, see [Samples for writing a custom configuration service provider](samples-for-writing-a-custom-configuration-service-provider.md). - -To register the configuration service provider as a COM object, you must add the following registry setting to your package. This step is required. In the following sample, replace *uniqueCSPguid* with a new, unique CLSID generated for this purpose. Replace *dllName* with the name of the .dll file that contains the code for your configuration service provider. - -``` syntax - - - - - -``` - -To register the configuration service provider with ConfigManager2, you must add the following registry setting to your package. This step is required. In the following sample, replace *dllName* with the name of the configuration service provider (the name of the root node). Replace *uniqueCSPguid* with the same *uniqueCSPguid* value as in the preceding example. - -``` syntax - - - - - -``` - -To make the configuration service provider accessible from WAP XML, you must register it with the WAP data processing unit by setting the following registry key in your package. Replace *Name* with the name of the configuration service provider. Leave the GUID value exactly as written here. - -``` syntax - - - - - -``` - -  - - - - - - diff --git a/windows/client-management/mdm/customdeviceui-csp.md b/windows/client-management/mdm/customdeviceui-csp.md index 06c4308457..05add93e6a 100644 --- a/windows/client-management/mdm/customdeviceui-csp.md +++ b/windows/client-management/mdm/customdeviceui-csp.md @@ -2,11 +2,13 @@ title: CustomDeviceUI CSP description: CustomDeviceUI CSP ms.assetid: 20ED1867-7B9E-4455-B397-53B8B15C95A3 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -28,7 +30,7 @@ AppID string value is the default appid/AUMID to launch during startup. The supp **BackgroundTasksToLaunch** List of package names of background tasks that need to be launched on device startup. The supported operation is Get. -**BackgroundTasksToLaunch/****_BackgroundTaskPackageName_** +**BackgroundTasksToLaunch/***BackgroundTaskPackageName* Package Full Name of the App that needs be launched in the background. This can contain no entry points, a single entry point, or multiple entry points. The supported operations are Add, Delete, Get, and Replace. ## SyncML examples @@ -36,7 +38,7 @@ Package Full Name of the App that needs be launched in the background. This can **Set StartupAppID** -``` syntax +```xml @@ -58,7 +60,7 @@ Package Full Name of the App that needs be launched in the background. This can **Get all background tasks** -``` syntax +```xml @@ -76,7 +78,7 @@ Package Full Name of the App that needs be launched in the background. This can **Add background task** -``` syntax +```xml @@ -96,9 +98,9 @@ Package Full Name of the App that needs be launched in the background. This can ``` -  + -  + diff --git a/windows/client-management/mdm/customdeviceui-ddf.md b/windows/client-management/mdm/customdeviceui-ddf.md index d862212b6c..12b590ef8c 100644 --- a/windows/client-management/mdm/customdeviceui-ddf.md +++ b/windows/client-management/mdm/customdeviceui-ddf.md @@ -2,11 +2,13 @@ title: CustomDeviceUI DDF description: CustomDeviceUI DDF ms.assetid: E6D6B902-C57C-48A6-9654-CCBA3898455E -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml -  + ## BulkSeatOperationResultSet @@ -98,16 +100,16 @@ Specifies the properties of the alternate identifier.

    seatDetails

    -

    collection of [SeatDetails](#seatdetails)

    +

    collection of SeatDetails

    failedSeatOperations

    -

    collection of [FailedSeatRequest](#failedseatrequest)

    +

    collection of FailedSeatRequest

    -  + ## FailedSeatRequest @@ -130,7 +132,7 @@ Specifies the properties of the alternate identifier.

    productKey

    -

    [ProductKey](#productkey)

    +

    ProductKey

    userName

    @@ -139,7 +141,7 @@ Specifies the properties of the alternate identifier. -  + ## FrameworkPackageDetails @@ -170,7 +172,7 @@ Specifies the properties of the alternate identifier.

    location

    -

    [PackageLocation](#packagelocation)

    +

    PackageLocation

    @@ -185,17 +187,17 @@ Specifies the properties of the alternate identifier.

    architectures

    -

    collection of [ProductArchitectures](#productarchitectures)

    +

    collection of ProductArchitectures

    packageFormat

    -

    [ProductPackageFormat](#productpackageformat)

    +

    ProductPackageFormat

    platforms

    -

    collection of [ProductPlatform](#productplatform)

    +

    collection of ProductPlatform

    @@ -211,7 +213,7 @@ Specifies the properties of the alternate identifier. -  + ## InventoryDistributionPolicy @@ -239,7 +241,7 @@ Specifies the properties of the alternate identifier. -  + ## InventoryEntryDetails @@ -260,7 +262,7 @@ Specifies the properties of the alternate identifier.

    productKey

    -

    [ProductKey](#productkey)

    +

    ProductKey

    Identifier used on subsequent requests to get additional content including product descriptions, offline license, and download URLs.

    @@ -280,23 +282,23 @@ Specifies the properties of the alternate identifier.

    licenseType

    -

    [LicenseType](#licensetype)

    +

    LicenseType

    Indicates whether the set of seats for a given application supports online or offline licensing.

    distributionPolicy

    -

    [InventoryDistributionPolicy](#inventorydistributionpolicy)

    +

    InventoryDistributionPolicy

    status

    -

    [InventoryStatus](#inventorystatus)

    +

    InventoryStatus

    -  + ## InventoryResultSet @@ -322,13 +324,13 @@ Specifies the properties of the alternate identifier.

    inventoryEntries

    -

    collection of [InventoryEntryDetails](#inventoryentrydetails)

    +

    collection of InventoryEntryDetails

    -  + ## InventoryStatus @@ -356,7 +358,7 @@ Specifies the properties of the alternate identifier. -  + ## LicenseType @@ -384,7 +386,7 @@ Specifies the properties of the alternate identifier. -  + ## LocalizedProductDetail @@ -422,18 +424,18 @@ Specifies the properties of the localized product.

    images

    -

    collection of [ProductImage](#productimage)

    +

    collection of ProductImage

    Artwork and icon associated with the application.

    publisher

    -

    [PublisherDetails](#publisherdetails)

    +

    PublisherDetails

    Publisher of the application.

    -  + ## OfflineLicense @@ -454,7 +456,7 @@ Specifies the properties of the localized product.

    productKey

    -

    [ProductKey](#productkey)

    +

    ProductKey

    Identifies a set of seats associated with an application.

    @@ -480,7 +482,7 @@ Specifies the properties of the localized product. -  + ## PackageContentInfo @@ -499,7 +501,7 @@ Specifies the properties of the localized product.

    productPlatforms

    -

    collection of [ProductPlatform](#productplatform)

    +

    collection of ProductPlatform

    packageFormat

    @@ -508,7 +510,7 @@ Specifies the properties of the localized product. -  + ## PackageLocation @@ -535,7 +537,7 @@ Specifies the properties of the localized product. -  + ## ProductArchitectures @@ -565,7 +567,7 @@ Specifies the properties of the localized product. -  + ## ProductDetails @@ -586,7 +588,7 @@ Specifies the properties of the localized product.

    productKey

    -

    [ProductKey](#productkey)

    +

    ProductKey

    Identifier used on subsequent requests to get additional content including product descriptions, offline license, and download URLs.

    @@ -611,7 +613,7 @@ Specifies the properties of the localized product.

    alternateIds

    -

    collection of [AlternateIdentifier](#alternateidentifier)

    +

    collection of AlternateIdentifier

    The identifiers that can be used to instantiate the installation of on online application.

    @@ -621,13 +623,13 @@ Specifies the properties of the localized product.

    supportedPlatforms

    -

    collection of [ProductPlatform](#productplatform)

    +

    collection of ProductPlatform

    -  + ## ProductImage @@ -656,7 +658,7 @@ Specifies the properties of the product image.

    purpose

    string

    -

    Tag for the purpose of the image, e.g. "screenshot" or "logo".

    +

    Tag for the purpose of the image, e.g. "screenshot" or "logo".

    height

    @@ -676,12 +678,12 @@ Specifies the properties of the product image.

    backgroundColor

    string

    -

    Format "#RRGGBB"

    +

    Format "#RRGGBB"

    foregroundColor

    string

    -

    Format "#RRGGBB"

    +

    Format "#RRGGBB"

    fileSize

    @@ -691,7 +693,7 @@ Specifies the properties of the product image. -  + ## ProductKey @@ -725,7 +727,7 @@ Specifies the properties of the product key. -  + ## ProductPackageDetails @@ -746,7 +748,7 @@ Specifies the properties of the product key.

    frameworkDependencyPackages

    -

    collection of [FrameworkPackageDetails](#frameworkpackagedetails)

    +

    collection of FrameworkPackageDetails

    @@ -761,7 +763,7 @@ Specifies the properties of the product key.

    location

    -

    [PackageLocation](#packagelocation)

    +

    PackageLocation

    @@ -776,17 +778,17 @@ Specifies the properties of the product key.

    architectures

    -

    collection of [ProductArchitectures](#productarchitectures)

    +

    collection of ProductArchitectures

    Values {x86, x64, arm, neutral}

    packageFormat

    -

    [ProductPackageFormat](#productpackageformat)

    +

    ProductPackageFormat

    Extension of the package file.

    platforms

    -

    collection of [ProductPlatform](#productplatform)

    +

    collection of ProductPlatform

    @@ -802,7 +804,7 @@ Specifies the properties of the product key. -  + ## ProductPackageFormat @@ -829,7 +831,7 @@ Specifies the properties of the product key. -  + ## ProductPackageSet @@ -855,13 +857,13 @@ Specifies the properties of the product key.

    productPackages

    -

    collection of [ProductPackageDetails](#productpackagedetails)

    +

    collection of ProductPackageDetails

    A collection of application packages.

    -  + ## ProductPlatform @@ -884,16 +886,16 @@ Specifies the properties of the product key.

    minVersion

    -

    [VersionInfo](#versioninfo)

    +

    VersionInfo

    maxTestedVersion

    -

    [VersionInfo](#versioninfo)

    +

    VersionInfo

    -  + ## PublisherDetails @@ -927,7 +929,7 @@ Specifies the properties of the publisher details. -  + ## SeatAction @@ -951,7 +953,7 @@ Specifies the properties of the publisher details. -  + ## SeatDetails @@ -982,18 +984,18 @@ Specifies the properties of the publisher details.

    state

    -

    [SeatState](#seatstate)

    +

    SeatState

    productKey

    -

    [ProductKey](#productkey)

    +

    ProductKey

    -  + ## SeatDetailsResultSet @@ -1012,7 +1014,7 @@ Specifies the properties of the publisher details.

    seats

    -

    collection of [SeatDetails](#seatdetails)

    +

    collection of SeatDetails

    continuationToken

    @@ -1021,7 +1023,7 @@ Specifies the properties of the publisher details. -  + ## SeatState @@ -1045,7 +1047,7 @@ Specifies the properties of the publisher details. -  + ## SupportedProductPlatform @@ -1068,20 +1070,20 @@ Specifies the properties of the publisher details.

    minVersion

    -

    [VersionInfo](#versioninfo)

    +

    VersionInfo

    maxTestedVersion

    -

    [VersionInfo](#versioninfo)

    +

    VersionInfo

    architectures

    -

    collection of [ProductArchitecture](#productarchitecture)

    +

    collection of ProductArchitectures

    -  + ## VersionInfo diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index 9782ed9ad1..746d5b282e 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -2,12 +2,15 @@ title: Defender CSP description: Defender CSP ms.assetid: 481AA74F-08B2-4A32-B95D-5A3FD05B335C -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/19/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/21/2019 --- # Defender CSP @@ -26,7 +29,7 @@ An interior node to group all threats detected by Windows Defender. Supported operation is Get. -**Detections/****_ThreatId_** +**Detections/***ThreatId* The ID of a threat that has been detected by Windows Defender. Supported operation is Get. @@ -120,7 +123,7 @@ The following table describes the supported values: | 50 | Ransomware | | 51 | ASR Rule | -  + Supported operation is Get. @@ -136,7 +139,7 @@ The following list shows the supported values: - 2 = Manual steps required - 3 = Full scan required - 4 = Reboot required -- 5 = Remediated with non critical failures +- 5 = Remediated with noncritical failures - 6 = Quarantined - 7 = Removed - 8 = Cleaned @@ -213,7 +216,7 @@ Supported product status values: Example: -``` syntax +```xml @@ -222,7 +225,7 @@ Example: ./Vendor/MSFT/Defender/Health/ProductStatus - + @@ -241,7 +244,7 @@ The following list shows the supported values: - 2 = Pending reboot - 4 = Pending manual steps (Windows Defender is waiting for the user to take some action, such as restarting the computer or running a full scan) - 8 = Pending offline scan -- 16 = Pending critical failure (Windows Defender has failed critically and an Adminsitrator needs to investigate and take some action, such as restarting the computer or reinstalling Windows Defender) +- 16 = Pending critical failure (Windows Defender has failed critically and an Administrator needs to investigate and take some action, such as restarting the computer or reinstalling Windows Defender) Supported operation is Get. @@ -350,6 +353,53 @@ The data type is a string. Supported operation is Get. +**Health/TamperProtectionEnabled** +Indicates whether the Windows Defender tamper protection feature is enabled.​ + +The data type is a boolean. + +Supported operation is Get. + +**Health/IsVirtualMachine** +Indicates whether the device is a virtual machine. + +The data type is a string. + +Supported operation is Get. + +**Configuration** +An interior node to group Windows Defender configuration information. + +Supported operation is Get. + +**Configuration/TamperProtection** +Tamper protection helps protect important security features from unwanted changes and interference. This includes real-time protection, behavior monitoring, and more. Accepts signed string to turn the feature on or off. Settings are configured with an MDM solution, such as Intune and is available in Windows 10 Enterprise E5 or equivalent subscriptions. + +Send off blob to device to reset tamper protection state before setting this configuration to "not configured" or "unassigned" in Intune. + +The data type is a Signed blob. + +Supported operations are Add, Delete, Get, Replace. + +Intune tamper protection setting UX supports three states: +- Not configured (default): Does not have any impact on the default state of the device. +- Enabled: Enables the tamper protection feature. +- Disabled: Turns off the tamper protection feature. + +When enabled or disabled exists on the client and admin moves the setting to not configured, it will not have any impact on the device state. To change the state to either enabled or disabled would require to be set explicitly. + +**Configuration/EnableFileHashComputation** +Enables or disables file hash computation feature. +When this feature is enabled Windows defender will compute hashes for files it scans. + +The data type is a integer. + +Supported operations are Add, Delete, Get, Replace. + +Valid values are: +- 1 – Enable. +- 0 (default) – Disable. + **Scan** Node that can be used to start a Windows Defender scan on a device. @@ -372,5 +422,4 @@ Supported operations are Get and Execute. ## Related topics -[Configuration service provider reference](configuration-service-provider-reference.md) - +[Configuration service provider reference](configuration-service-provider-reference.md) \ No newline at end of file diff --git a/windows/client-management/mdm/defender-ddf.md b/windows/client-management/mdm/defender-ddf.md index 7d4f147be9..e5c1dcd59e 100644 --- a/windows/client-management/mdm/defender-ddf.md +++ b/windows/client-management/mdm/defender-ddf.md @@ -2,12 +2,15 @@ title: Defender DDF file description: Defender DDF file ms.assetid: 39B9E6CF-4857-4199-B3C3-EC740A439F65 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/21/2019 --- # Defender DDF file @@ -17,9 +20,9 @@ This topic shows the OMA DM device description framework (DDF) for the **Defende Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1809. +The XML below is the current version for this CSP. -``` syntax +```xml + + TamperProtectionEnabled + + + + + + + + + + + + + + + text/plain + + + + + IsVirtualMachine + + + + + + + + + + + + + + + text/plain + + + + + + Configuration + + + + + + + + + + + + + + + + + + + TamperProtection + + + + + + + + + + + + + + + + + + text/plain + + + + + EnableFileHashComputation + + + + + + + + + + + + + + + + + + text/plain + + + Scan @@ -697,4 +806,4 @@ The XML below is for Windows 10, version 1809. ## Related topics -[Defender configuration service provider](defender-csp.md) \ No newline at end of file +[Defender configuration service provider](defender-csp.md) diff --git a/windows/client-management/mdm/design-a-custom-windows-csp.md b/windows/client-management/mdm/design-a-custom-windows-csp.md deleted file mode 100644 index 66df907c0c..0000000000 --- a/windows/client-management/mdm/design-a-custom-windows-csp.md +++ /dev/null @@ -1,167 +0,0 @@ ---- -title: Design a custom configuration service provider -description: Design a custom configuration service provider -MS-HAID: -- 'p\_phDeviceMgmt.designing\_a\_custom\_configuration\_service\_provider' -- 'p\_phDeviceMgmt.design\_a\_custom\_windows\_csp' -ms.assetid: 0fff9516-a71a-4036-a57b-503ef1a81a37 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# Design a custom configuration service provider - -To design a custom configuration service provider, the OEM must perform the following steps: - -1. Establish node semantics -2. Shape the configuration service provider's subtree -3. Choose a transactioning scheme for each node -4. Determine node operations - -For more information about the larger process of writing a new configuration service provider, see [Create a custom configuration service provider](create-a-custom-configuration-service-provider.md). - -## Establish node semantics - -First, determine the nodes you need based on the kind of data to be stored in the registry. - -Nodes can represent anything from abstract concepts or collections (such as email accounts or connection settings) to more concrete objects (such as registry keys and values, directories, and files). - -### Example - -For example, a hypothetical Email configuration service provider might have these nodes: - -- Account: The name of the email account (such as "Hotmail") - -- Username: The user name or email address ("exampleAccount@hotmail.com") - -- Password: The user's password - -- Server: The DNS address of the server ("mail-serv1-example.mail.hotmail.com") - -The `Account`, `Username`, and `Server` nodes would hold text-based information about the email account, the user's email address, and the server address associated with that account. The `Password` node, however, might hold a binary hash of the user's password. - -## Shape the configuration service provider's subtree - -After determining what the nodes represent, decide where each node fits in the settings hierarchy. - -The root node of a configuration service provider's subtree must be the name of the configuration service provider. In this example, the root node is `Email`. - -All of the nodes defined in the previous step must reside under the configuration service provider's root node. Leaf nodes should be used to store data, and interior nodes should be used to group the data into logical collections. Node URIs must be unique. In other words, no two nodes can have both the same parent and the same name. - -There are three typical scenarios for grouping and structuring the nodes: - -- If all of the data belongs to the same component and no further categorizing or grouping is required, you can build a flat tree in which all values are stored directly under the root node. For examples of this design, see [DevInfo configuration service provider](devinfo-csp.md), [HotSpot configuration service provider](hotspot-csp.md), and [w4 APPLICATION configuration service provider](w4-application-csp.md). - -- If the configuration service provider's nodes represent a preexisting set of entities whose structure is well-defined (such as directories and files), the configuration service provider's nodes can simply mirror the existing structure. - -- If the data must be grouped by type or component, a more complex structure is required. This is especially true when there can be multiple instances of the dataset on the device, and each set is indexed by an ID, account name, or account type. In this case, you must build a more complex tree structure. For examples, see [ActiveSync configuration service provider](activesync-csp.md), [CertificateStore configuration service provider](certificatestore-csp.md), and [CMPolicy configuration service provider](cmpolicy-csp.md). - -### Example - -The following image shows an incorrect way to structure the hypothetical `Email` configuration service provider. The interior `Account` nodes group the account data (server name, user name, and user password). - -![provisioning\-customcsp\-example1](images/provisioning-customcsp-example1.png) - -However, the account nodes in this design are not unique. Even though the nodes are grouped sensibly, the path for each of the leaf nodes is ambiguous. There is no way to disambiguate the two `Username` nodes, for example, or to reliably access the same node by using the same path. This structure will not work. The easiest solution to this problem is usually to replace an interior node (the grouping node) by: - -1. Promoting a child node. - -2. Using the node value as the name of the new interior node. - -The following design conveys the same amount of information as the first design, but all nodes have a unique path, and therefore it will work. - -![provisioning\-customcsp\-example2](images/provisioning-customcsp-example2.png) - -In this case, the `Server` nodes have been promoted up one level to replace the `Account` nodes, and their values are now used as the node names. For example, you could have two different email accounts on the phone, with server names "www.hotmail.com" and "exchange.microsoft.com", each of which stores a user name and a password. - -Note that the process of shaping the configuration service provider’s subtree influences the choice of transactioning schemes for each node. If possible, peer nodes should not have dependencies on each other. Internode dependencies other than parent/child relationships create mandatory groups of settings, which makes configuration service provider development more difficult. - -## Choose a transactioning scheme for each node - -For each node, decide whether to use *external transactioning* or *internal transactioning* to manage the transaction phases (rollback persistence, rollback, and commitment) for the node. - -External transactioning is the simplest option because it allows ConfigManager2 to automatically handle the node's transactioning. - -However, you must use internal transactioning for the following types of nodes: - -- A node that supports the **Execute** method. - -- A node that contains sensitive information (such as a password) that must not be saved in plain text in the ConfigManager2 rollback document. - -- A node that has a dependency on another node that is not a parent. For example, if a parent node has two children that are both required, the configuration service provider could use internal transactioning to defer provisioning the account until both values are set. - -You can choose to mix transactioning modes in your configuration service provider, using internal transactioning for some operations but external transactioning for others. For more information about writing an internally transactioned node, see the [ICSPNodeTransactioning](icspnodetransactioning.md) interface. - -## Determine node operations - -The operations available for each node can vary depending on the purpose of the configuration service provider. The configuration service provider will be easier to use if the operations are consistent. For more information about the supported operations, see the [ICSPNode](icspnode.md) interface. - -For externally transactioned nodes, an operation implementation must include the contrary operations shown in the following table to allow rollback of the operation. - -For internally transactioned nodes, the practice of implementing the contrary commands for each command is recommended, but not required. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Node operationContrary node operation

    Add

    Clear and DeleteChild

    Copy

    To copy to a new node: Clear and DeleteChild

    -

    To copy to an existing node: Add and SetValue

    Clear

    To restore the state of the deleted node: SetValue and SetProperty

    DeleteChild

    To restore the old node: Add

    DeleteProperty

    To restore the deleted property: SetProperty

    Execute

    Externally transactioned nodes do not support the Execute command.

    GetValue

    None

    Move

    To restore a source node: Move

    -

    To restore an overwritten target node: Add and SetValue

    SetValue

    To restore the previous value: SetValue

    - -  - -  - - - - - diff --git a/windows/client-management/mdm/devdetail-csp.md b/windows/client-management/mdm/devdetail-csp.md index 5f9609bccf..9292eb002c 100644 --- a/windows/client-management/mdm/devdetail-csp.md +++ b/windows/client-management/mdm/devdetail-csp.md @@ -2,11 +2,13 @@ title: DevDetail CSP description: DevDetail CSP ms.assetid: 719bbd2d-508d-439b-b175-0874c7e6c360 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 07/11/2018 --- @@ -37,9 +39,9 @@ The following diagram shows the DevDetail configuration service provider managem

    Supported operation is Get. **FwV** -

    Required. Returns the firmware version, as defined in the registry key HKEY\_LOCAL\_MACHINE\\System\\Platform\\DeviceTargetingInfo\\PhoneFirmwareRevision. +

    Required. Returns the firmware version, as defined in the registry key HKEY_LOCAL_MACHINE\System\Platform\DeviceTargetingInfo\PhoneFirmwareRevision. -

    For Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), it returns the BIOS version as defined in the registry key HKEY\_LOCAL\_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\BIOSVersion. +

    For Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), it returns the BIOS version as defined in the registry key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion.

    Supported operation is Get. @@ -49,9 +51,9 @@ The following diagram shows the DevDetail configuration service provider managem

    Supported operation is Get. **HwV** -

    Required. Returns the hardware version, as defined in the registry key HKEY\_LOCAL\_MACHINE\\System\\Platform\\DeviceTargetingInfo\\PhoneRadioHardwareRevision. +

    Required. Returns the hardware version, as defined in the registry key HKEY_LOCAL_MACHINE\System\Platform\DeviceTargetingInfo\PhoneRadioHardwareRevision. -

    For Windows 10 for desktop editions, it returns the BIOS version as defined in the registry key HKEY\_LOCAL\_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\BIOSVersion. +

    For Windows 10 for desktop editions, it returns the BIOS version as defined in the registry key HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion.

    Supported operation is Get. @@ -94,12 +96,12 @@ The following diagram shows the DevDetail configuration service provider managem

    Supported operation is Get. **Ext/Microsoft/OSPlatform** -

    Required. Returns the OS platform of the device. For Windows 10 for desktop editions, it returns the ProductName as defined in HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProductName. +

    Required. Returns the OS platform of the device. For Windows 10 for desktop editions, it returns the ProductName as defined in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName.

    Supported operation is Get. **Ext/Microsoft/ProcessorType** -

    Required. Returns the processor type of the device as documented in SYSTEM\_INFO. +

    Required. Returns the processor type of the device as documented in SYSTEM_INFO.

    Supported operation is Get. @@ -109,7 +111,7 @@ The following diagram shows the DevDetail configuration service provider managem

    Supported operation is Get. **Ext/Microsoft/Resolution** -

    Required. Returns the UI screen resolution of the device (example: "480x800"). +

    Required. Returns the UI screen resolution of the device (example: "480x800").

    Supported operation is Get. @@ -119,7 +121,7 @@ The following diagram shows the DevDetail configuration service provider managem

    Supported operation is Get. **Ext/Microsoft/ProcessorArchitecture** -

    Required. Returns the processor architecture of the device as "arm" or "x86". +

    Required. Returns the processor architecture of the device as "arm" or "x86".

    Supported operation is Get. @@ -186,7 +188,7 @@ Value type is string. Supported operation is Get. **Ext/DeviceHardwareData**

    Added in Windows 10 version 1703. Returns a base64-encoded string of the hardware parameters of a device. -> [!Note] +> [!NOTE] > This node contains a raw blob used to identify a device in the cloud. It's not meant to be human readable by design and you cannot parse the content to get any meaningful hardware information.

    Supported operation is Get. @@ -195,9 +197,9 @@ Value type is string. Supported operation is Get. [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/devdetail-ddf-file.md b/windows/client-management/mdm/devdetail-ddf-file.md index e84b804e6c..b313ad3605 100644 --- a/windows/client-management/mdm/devdetail-ddf-file.md +++ b/windows/client-management/mdm/devdetail-ddf-file.md @@ -2,11 +2,13 @@ title: DevDetail DDF file description: DevDetail DDF file ms.assetid: 645fc2b5-2d2c-43b1-9058-26bedbe9f00d -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 07/11/2018 --- @@ -21,7 +23,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is for Windows 10, version 1809. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/developersetup-csp.md b/windows/client-management/mdm/developersetup-csp.md index 0d91af34b6..40e1d4d82e 100644 --- a/windows/client-management/mdm/developersetup-csp.md +++ b/windows/client-management/mdm/developersetup-csp.md @@ -2,11 +2,13 @@ title: DeveloperSetup CSP description: The DeveloperSetup configuration service provider (CSP) is used to configure developer mode on the device. This CSP was added in the Windows 10, version 1703. ms.assetid: -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2018 --- @@ -15,7 +17,7 @@ ms.date: 06/26/2018 The DeveloperSetup configuration service provider (CSP) is used to configure Developer Mode on the device and connect to the Windows Device Portal. For more information about the Windows Device Portal, see [Windows Device Portal overview](https://msdn.microsoft.com/windows/uwp/debug-test-perf/device-portal). This CSP was added in Windows 10, version 1703. > [!NOTE] -The DeveloperSetup configuration service provider (CSP) is only supported in Windows 10 Holographic Enterprise edition and with runtime provisioning via provisioning packages. It is not supported in MDM. +> The DeveloperSetup configuration service provider (CSP) is only supported in Windows 10 Holographic Enterprise edition and with runtime provisioning via provisioning packages. It is not supported in MDM. The following diagram shows the DeveloperSetup configuration service provider in tree format. @@ -59,11 +61,11 @@ The user name must contain only ASCII characters and cannot contain a colon (:). **DevicePortal/Connection/HttpPort**

    An integer value that is used to configure the HTTP port for incoming connections to the Windows Device Portal service. -If authentication is enabled, **HttpPort** will redirect the user to the (required) **HttpsPort**. +If authentication is enabled, HttpPort will redirect the user to the (required) HttpsPort.

    The only supported operation is Replace. **DevicePortal/Connection/HttpsPort**

    An integer value that is used to configure the HTTPS port for incoming connections to the Windows Device Portal service. -

    The only supported operation is Replace. \ No newline at end of file +

    The only supported operation is Replace. diff --git a/windows/client-management/mdm/developersetup-ddf.md b/windows/client-management/mdm/developersetup-ddf.md index 6ca207820f..21afb0f2a6 100644 --- a/windows/client-management/mdm/developersetup-ddf.md +++ b/windows/client-management/mdm/developersetup-ddf.md @@ -2,11 +2,13 @@ title: DeveloperSetup DDF file description: This topic shows the OMA DM device description framework (DDF) for the DeveloperSetup configuration service provider. This CSP was added in Windows 10, version 1703. ms.assetid: -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -18,7 +20,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml . +- **KBArticleID** – The KB article number for this update that has details regarding the particular update. For example, . ## Recommended Flow for Using the Server-Server Sync Protocol @@ -144,7 +146,7 @@ The following diagram shows the Update policies in a tree format. > This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise -

    Added in Windows 10, version 1607. Allows the IT admin (when used with **Update/ActiveHoursStart**) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time. +

    Added in Windows 10, version 1607. Allows the IT admin (when used with Update/ActiveHoursStart) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time. > [!NOTE] > The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See **Update/ActiveHoursMaxRange** below for more information. @@ -169,7 +171,7 @@ The following diagram shows the Update policies in a tree format. > This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise -

    Added in Windows 10, version 1607. Allows the IT admin (when used with **Update/ActiveHoursEnd**) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time. +

    Added in Windows 10, version 1607. Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time. > [!NOTE] > The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See **Update/ActiveHoursMaxRange** above for more information. @@ -198,7 +200,7 @@ The following diagram shows the Update policies in a tree format. > [!IMPORTANT] > This option should be used only for systems under regulatory compliance, as you will not get security updates as well. -  +

    If the policy is not configured, end-users get the default behavior (Auto install and restart). @@ -288,7 +290,7 @@ The following diagram shows the Update policies in a tree format. **Update/DeferFeatureUpdatesPeriodInDays** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. -

    Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. +>

    Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.

    Added in Windows 10, version 1607. Defers Feature Updates for the specified number of days. @@ -320,9 +322,9 @@ The following diagram shows the Update policies in a tree format. - Update/RequireDeferUpgrade must be set to 1 - System/AllowTelemetry must be set to 1 or higher -

    If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. +

    If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. -

    If the Allow Telemetry policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. +

    If the Allow Telemetry policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. @@ -389,9 +391,9 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego

    Supported values are 0-8, which refers to the number of months to defer upgrades. -

    If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. +

    If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. -

    If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. +

    If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. **Update/EngagedRestartDeadline** > [!NOTE] @@ -494,14 +496,14 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego - 0 (default) – Deferrals are not paused. - 1 – Deferrals are paused. -

    If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. +

    If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. -

    If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. +

    If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. **Update/PauseFeatureUpdates** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. -

    Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. +>

    Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect.

    Added in Windows 10, version 1607. Allows IT Admins to pause Feature Updates for up to 60 days. @@ -633,7 +635,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego > This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile Enterprise > [!Important] -> Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enteprise and IoT Enterprise. +> Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enterprise and IoT Enterprise.

    Allows the device to check for updates from a WSUS server instead of Microsoft Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet. @@ -646,7 +648,7 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego Example -``` syntax +```xml $CmdID$ @@ -672,7 +674,7 @@ Example

    To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server. -

    Value type is string and the default value is an empty string, "". If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. +

    Value type is string and the default value is an empty string, "". If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. > [!Note] > If the "Configure Automatic Updates" Group Policy is disabled, then this policy has no effect. @@ -701,11 +703,11 @@ The update approval list enables IT to approve individual updates and update cla > **Note**  For the Windows 10 build, the client may need to reboot after additional updates are added. -  + Supported operations are Get and Add. -**ApprovedUpdates/****_Approved Update Guid_** +**ApprovedUpdates/***Approved Update Guid* Specifies the update GUID. To auto-approve a class of updates, you can specify the [Update Classifications](https://go.microsoft.com/fwlink/p/?LinkId=526723) GUIDs. We strongly recommend to always specify the DefinitionsUpdates classification (E0789628-CE08-4437-BE74-2495B842F43B), which are used for anti-malware signatures. There are released periodically (several times a day). Some businesses may also want to auto-approve security updates to get them deployed quickly. @@ -728,7 +730,7 @@ Specifies the approved updates that failed to install on a device. Supported operation is Get. -**FailedUpdates/****_Failed Update Guid_** +**FailedUpdates/***Failed Update Guid* Update identifier field of the UpdateIdentity GUID that represent an update that failed to download or install. Supported operation is Get. @@ -748,7 +750,7 @@ The updates that are installed on the device. Supported operation is Get. -**InstalledUpdates/****_Installed Update Guid_** +**InstalledUpdates/***Installed Update Guid* UpdateIDs that represent the updates installed on a device. Supported operation is Get. @@ -758,7 +760,7 @@ The updates that are applicable and not yet installed on the device. This includ Supported operation is Get. -**InstallableUpdates/****_Installable Update Guid_** +**InstallableUpdates/***Installable Update Guid* Update identifiers that represent the updates applicable and not installed on a device. Supported operation is Get. @@ -782,7 +784,7 @@ The updates that require a reboot to complete the update session. Supported operation is Get. -**PendingRebootUpdates/****_Pending Reboot Update Guid_** +**PendingRebootUpdates/***Pending Reboot Update Guid* Update identifiers for the pending reboot state. Supported operation is Get. @@ -883,7 +885,7 @@ Here's the list of corresponding Group Policy settings in HKLM\\Software\\Polici

    -  + Here is the list of older policies that are still supported for backward compatibility. You can use these for Windows 10, version 1511 devices. @@ -902,7 +904,7 @@ For policies supported for Windows Update for Business, when you set policies fo For policies supported for Windows Update for Business, when you set 1511 policies on a device running 1607, the you will get the expected behavior for 1511 policies. -  + ## Update management user experience screenshot @@ -910,14 +912,14 @@ The following screenshots of the administrator console shows the list of update ![mdm update management screenshot](images/deviceupdatescreenshot1.png) -![mdm update managment metadata screenshot](images/deviceupdatescreenshot2.png) +![mdm update management metadata screenshot](images/deviceupdatescreenshot2.png) ## SyncML example Set auto update to notify and defer. -``` syntax +```xml @@ -966,7 +968,7 @@ The following diagram and screenshots show the process flow of the device update ![mdm device update management screenshot](images/deviceupdatescreenshot3.png)![mdm device update management screenshot](images/deviceupdatescreenshot4.png)![mdm device update management screenshot](images/deviceupdatescreenshot5.png)![mdm device update management screenshot](images/deviceupdatescreenshot6.png)![mdm device update management screenshot](images/deviceupdatescreenshot7.png)![mdm device update management screenshot](images/deviceupdatescreenshot8.png)![mdm device update management screenshot](images/deviceupdatescreenshot9.png) -  + diff --git a/windows/client-management/mdm/deviceinstanceservice-csp.md b/windows/client-management/mdm/deviceinstanceservice-csp.md index 9c8435dbaa..09d6af05e4 100644 --- a/windows/client-management/mdm/deviceinstanceservice-csp.md +++ b/windows/client-management/mdm/deviceinstanceservice-csp.md @@ -2,11 +2,13 @@ title: DeviceInstanceService CSP description: DeviceInstanceService CSP ms.assetid: f113b6bb-6ce1-45ad-b725-1b6610721e2d -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -20,7 +22,7 @@ Stop using DeviceInstanceService CSP and use the updated [DeviceStatus CSP](devi The DeviceInstance CSP is only supported in Windows 10 Mobile. -  + The following diagram shows the DeviceInstanceService configuration service provider in tree format. @@ -68,7 +70,7 @@ The parent node to group SIM2 specific information in case of dual SIM mode. The following sample shows how to query roaming status and phone number on the device. -``` syntax +```xml 2 @@ -86,7 +88,7 @@ The following sample shows how to query roaming status and phone number on the d Response from the phone. -``` syntax +```xml 3 1 @@ -108,9 +110,9 @@ Response from the phone. [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index 8d44aca043..246408076e 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -2,11 +2,13 @@ title: DeviceLock CSP description: DeviceLock CSP ms.assetid: 9a547efb-738e-4677-95d3-5506d350d8ab -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -124,7 +126,7 @@ Required. This node has the same set of policy nodes as the **ProviderID** node. Set device lock policies: -``` syntax +```xml 13 diff --git a/windows/client-management/mdm/devicelock-ddf-file.md b/windows/client-management/mdm/devicelock-ddf-file.md index 11ec6e0bf0..545ebcdb9b 100644 --- a/windows/client-management/mdm/devicelock-ddf-file.md +++ b/windows/client-management/mdm/devicelock-ddf-file.md @@ -2,11 +2,13 @@ title: DeviceLock DDF file description: DeviceLock DDF file ms.assetid: 46a691b9-6350-4987-bfc7-f8b1eece3ad9 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -15,7 +17,7 @@ ms.date: 06/26/2017 This topic shows the OMA DM device description framework (DDF) for the **DeviceLock** configuration service provider. DDF files are used only with OMA DM provisioning XML. -``` syntax +```xml **Note**  Multiple SIMs are supported. -  + -**DeviceStatus/CellularIdentities/****_IMEI_** +**DeviceStatus/CellularIdentities/***IMEI* The unique International Mobile Station Equipment Identity (IMEI) number of the mobile device. An IMEI is present for each SIM card on the device. **DeviceStatus/CellularIdentities/*IMEI*/IMSI** @@ -74,7 +76,7 @@ Supported operation is Get. **DeviceStatus/NetworkIdentifiers** Node for queries on network and device properties. -**DeviceStatus/NetworkIdentifiers/****_MacAddress_** +**DeviceStatus/NetworkIdentifiers/***MacAddress* MAC address of the wireless network card. A MAC address is present for each network card on the device. **DeviceStatus/NetworkIdentifiers/*MacAddress*/IPAddressV4** @@ -157,6 +159,12 @@ Valid values: Supported operation is Get. +If more than one antivirus provider is active, this node returns: +- 1 – If every active antivirus provider has a valid signature status. +- 0 – If any of the active antivirus providers has an invalid signature status. + +This node also returns 0 when no antivirus provider is active. + **DeviceStatus/Antivirus/Status** Added in Windows, version 1607. Integer that specifies the status of the antivirus. @@ -186,6 +194,12 @@ Valid values: Supported operation is Get. +If more than one antispyware provider is active, this node returns: +- 1 – If every active antispyware provider has a valid signature status. +- 0 – If any of the active antispyware providers has an invalid signature status. + +This node also returns 0 when no antispyware provider is active. + **DeviceStatus/Antispyware/Status** Added in Windows, version 1607. Integer that specifies the status of the antispyware. @@ -263,23 +277,23 @@ Supported operation is Get. **DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq** Added in Windows, version 1709. Virtualization-based security hardware requirement status. The value is a 256 value bitmask. -- 0x0: System meets hardware configuration requirements -- 0x1: SecureBoot required -- 0x2: DMA Protection required -- 0x4: HyperV not supported for Guest VM -- 0x8: HyperV feature is not available +- 0x0: System meets hardware configuration requirements +- 0x1: SecureBoot required +- 0x2: DMA Protection required +- 0x4: HyperV not supported for Guest VM +- 0x8: HyperV feature is not available Supported operation is Get. **DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus** Added in Windows, version 1709. Virtualization-based security status. Value is one of the following: -- 0 - Running -- 1 - Reboot required -- 2 - 64 bit architecture required -- 3 - not licensed -- 4 - not configured -- 5 - System doesn't meet hardware requirements -- 42 – Other. Event logs in Microsoft-Windows-DeviceGuard have more details +- 0 - Running +- 1 - Reboot required +- 2 - 64 bit architecture required +- 3 - not licensed +- 4 - not configured +- 5 - System doesn't meet hardware requirements +- 42 – Other. Event logs in Microsoft-Windows-DeviceGuard have more details Supported operation is Get. @@ -287,11 +301,11 @@ Supported operation is Get. **DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus** Added in Windows, version 1709. Local System Authority (LSA) credential guard status. -- 0 - Running -- 1 - Reboot required -- 2 - Not licensed for Credential Guard -- 3 - Not configured -- 4 - VBS not running +- 0 - Running +- 1 - Reboot required +- 2 - Not licensed for Credential Guard +- 3 - Not configured +- 4 - VBS not running Supported operation is Get. diff --git a/windows/client-management/mdm/devicestatus-ddf.md b/windows/client-management/mdm/devicestatus-ddf.md index 8f0e5a3364..fbdf08a6d0 100644 --- a/windows/client-management/mdm/devicestatus-ddf.md +++ b/windows/client-management/mdm/devicestatus-ddf.md @@ -2,11 +2,13 @@ title: DeviceStatus DDF description: This topic shows the OMA DM device description framework (DDF) for the DeviceStatus configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.assetid: 780DC6B4-48A5-4F74-9F2E-6E0D88902A45 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 03/12/2018 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is for Windows 10, version 1803. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/devinfo-csp.md b/windows/client-management/mdm/devinfo-csp.md index bbff58b76c..7252e076c2 100644 --- a/windows/client-management/mdm/devinfo-csp.md +++ b/windows/client-management/mdm/devinfo-csp.md @@ -2,11 +2,13 @@ title: DevInfo CSP description: DevInfo CSP ms.assetid: d3eb70db-1ce9-4c72-a13d-651137c1713c -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/devinfo-ddf-file.md b/windows/client-management/mdm/devinfo-ddf-file.md index 8b88fb1918..b81a21b82e 100644 --- a/windows/client-management/mdm/devinfo-ddf-file.md +++ b/windows/client-management/mdm/devinfo-ddf-file.md @@ -2,11 +2,13 @@ title: DevInfo DDF file description: DevInfo DDF file ms.assetid: beb07cc6-4133-4c0f-aa05-64db2b4a004f -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml @@ -93,7 +95,7 @@ Example: Enable the Debug channel logging Example: Export the Debug logs -``` syntax +```xml @@ -112,11 +114,11 @@ Example: Export the Debug logs ## Collect logs from Windows 10 Mobile devices -Since there is no Event Viewer in Windows 10 Mobile, you can use the [Field Medic](https://www.microsoft.com/en-us/p/field-medic/9wzdncrfjb82?activetab=pivot%3aoverviewtab) app to collect logs. +Since there is no Event Viewer in Windows 10 Mobile, you can use the [Field Medic](https://www.microsoft.com/p/field-medic/9wzdncrfjb82?activetab=pivot%3aoverviewtab) app to collect logs. **To collect logs manually** -1. Download and install the [Field Medic]( http://go.microsoft.com/fwlink/p/?LinkId=718232) app from the store. +1. Download and install the [Field Medic]( https://go.microsoft.com/fwlink/p/?LinkId=718232) app from the store. 2. Open the Field Medic app and then click on **Advanced**. ![field medic screenshot](images/diagnose-mdm-failures2.png) @@ -190,7 +192,7 @@ You can use the DiagnosticLog CSP to enable the ETW provider. The provider ID is Add a collector node -``` syntax +```xml @@ -212,7 +214,7 @@ Add a collector node Add the ETW provider to the trace -``` syntax +```xml @@ -234,7 +236,7 @@ Add the ETW provider to the trace Start collector trace logging -``` syntax +```xml @@ -257,7 +259,7 @@ Start collector trace logging Stop collector trace logging -``` syntax +```xml @@ -312,7 +314,7 @@ For best results, ensure that the PC or VM on which you are viewing logs matches Here's an example of how to collect current MDM device state data using the [DiagnosticLog CSP](diagnosticlog-csp.md), version 1.3, which was added in Windows 10, version 1607. You can collect the file from the device using the same FileDownload node in the CSP as you do for the etl files. -``` syntax +```xml diff --git a/windows/client-management/mdm/diagnosticlog-csp.md b/windows/client-management/mdm/diagnosticlog-csp.md index 4b9157ad49..2e5300fe0d 100644 --- a/windows/client-management/mdm/diagnosticlog-csp.md +++ b/windows/client-management/mdm/diagnosticlog-csp.md @@ -2,27 +2,697 @@ title: DiagnosticLog CSP description: DiagnosticLog CSP ms.assetid: F76E0056-3ACD-48B2-BEA1-1048C96571C3 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 +author: manikadhiman +ms.date: 11/19/2019 --- # DiagnosticLog CSP +The DiagnosticLog configuration service provider (CSP) provides the following feature areas: +- [DiagnosticArchive area](#diagnosticarchive-area). Capture and upload event logs, log files, and registry values for troubleshooting. +- [Policy area](#policy-area). Configure Windows event log policies, such as maximum log size. +- [EtwLog area](#etwlog-area). Control ETW trace sessions. +- [DeviceStateData area](#devicestatedata-area). Provide additional device information. +- [FileDownload area](#filedownload-area). Pull trace and state data directly from the device. + +The following are the links to different versions of the DiagnosticLog CSP DDF files: +- [DiagnosticLog CSP version 1.4](diagnosticlog-ddf.md#version-1-4) +- [DiagnosticLog CSP version 1.3](diagnosticlog-ddf.md#version-1-3) +- [DiagnosticLog CSP version 1.2](diagnosticlog-ddf.md#version-1-2) -The DiagnosticLog configuration service provider (CSP) is used for generating and collecting diagnostic information from the device: Event Tracing for Windows (ETW) log files and current MDM configured state of the device. +The following diagram shows the DiagnosticLog CSP in tree format. +![diagnosticlog csp diagram](images/provisioning-csp-diagnosticlog.png) -DiagnosticLog CSP supports the following type of event tracing: +**./Vendor/MSFT/DiagnosticLog** +The root node for the DiagnosticLog CSP. -- Collector-based tracing -- Channel-based tracing +Rest of the nodes in the DiagnosticLog CSP are described within their respective feature area sections. + +## DiagnosticArchive area + +The DiagnosticArchive functionality within the DiagnosticLog CSP is used to trigger devices to gather troubleshooting data into a zip archive file and upload that archive to cloud storage. DiagnosticArchive is designed for ad-hoc troubleshooting scenarios, such as an IT admin investigating an app installation failure using a collection of event log events, registry values, and app or OS log files. + +> [!Note] +> DiagnosticArchive is a "break glass" backstop option for device troubleshooting. Diagnostic data such as log files can grow to many gigabytes. Gathering, transferring, and storing large amounts of data may burden the user's device, the network and cloud storage. Management servers invoking DiagnosticArchive must take care to minimize data gathering frequency and scope. + +The following section describes the nodes for the DiagnosticArchive functionality. + +**DiagnosticArchive** +Added in version 1.4 of the CSP in Windows 10, version 1903. Root node for the DiagnosticArchive functionality. + +The supported operation is Get. + +**DiagnosticArchive/ArchiveDefinition** +Added in version 1.4 of the CSP in Windows 10, version 1903. + +The supported operations are Add and Execute. + +The data type is string. + +Expected value: +Set and Execute are functionality equivalent, and each accepts an XML snippet (as a string) describing what data to gather and where to upload it. + +The following is an example of the XML. This example instructs the CSP to gather: +- All the keys and values under a registry path +- All the *.etl files in a folder +- The output of two commands +- Additional files created by one of the commands +- All the Application event log events. + +The results are zipped and uploaded to the specified SasUrl. The filename format is "DiagLogs-{ComputerName}-YYYYMMDDTHHMMSSZ.zip". + +``` xml + + server generated guid value such as f1e20cb4-9789-4f6b-8f6a-766989764c6d + server generated url where the HTTP PUT will be accepted + HKLM\Software\Policies + %ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\*.etl + %windir%\system32\ipconfig.exe /all + %windir%\system32\mdmdiagnosticstool.exe -out %ProgramData%\temp\ + %ProgramData%\temp\*.* + Application + + +``` +The XML should include the following elements within the `Collection` element: + +**ID** +The ID value is a server-generated GUID string that identifies this data-gathering request. To avoid accidental repetition of data gathering, the CSP ignores subsequent Set or Execute invocations with the same ID value. + +**SasUrl** +The SasUrl value is the target URI to which the CSP uploads the results zip file. It is the responsibility of the management server to provision storage in such a way that the server accepts the HTTP PUT to this URL. For example, the device management service could: +- Provision cloud storage, such as an Azure blob storage container or other storage managed by the device management server +- Generate a dynamic https SAS token URL representing the storage location (and which is understood by the server to allow a one-time upload or time-limited uploads) +- Pass this value to the CSP as the SasUrl value. + +Assuming a case where the management server's customer (such as an IT admin) is meant to access the data, the management server would also expose the stored data through its user interface or APIs. + +**One or more data gathering directives, which may include any of the following:** + +- **RegistryKey** + - Exports all of the key names and values under a given path (recursive). + - Expected input value: Registry path such as "HKLM\Software\Policies". + - Output format: Creates a .reg file, similar to the output of reg.exe EXPORT command. + - Privacy guardrails: To enable diagnostic log capture while reducing the risk of an IT admin inadvertently capturing user-generated documents, registry paths are restricted to those under HKLM and HKCR. + +- **Events** + - Exports all events from the named Windows event log. + - Expected input value: A named event log channel such as "Application" or "Microsoft-Windows-DeviceGuard/Operational". + - Output format: Creates a .evtx file. + +- **Commands** + - This directive type allows the execution of specific commands such as ipconfig.exe. Note that DiagnosticArchive and the Commands directives are not a general-purpose scripting platform. These commands are allowed in the DiagnosticArchive context to handle cases where critical device information may not be available through existing log files. + - Expected input value: The full command line including path and any arguments, such as `%windir%\\system32\\ipconfig.exe /all`. + - Output format: Console text output from the command is captured in a text file and included in the overall output archive. For commands which may generate file output rather than console output, a subsequent FolderFiles directive would be used to capture that output. The example XML above demonstrates this pattern with mdmdiagnosticstool.exe's -out parameter. + - Privacy guardrails: To enable diagnostic data capture while reducing the risk of an IT admin inadvertently capturing user-generated documents, only the following commands are allowed: + - %windir%\\system32\\certutil.exe + - %windir%\\system32\\dxdiag.exe + - %windir%\\system32\\gpresult.exe + - %windir%\\system32\\msinfo32.exe + - %windir%\\system32\\netsh.exe + - %windir%\\system32\\nltest.exe + - %windir%\\system32\\ping.exe + - %windir%\\system32\\powercfg.exe + - %windir%\\system32\\w32tm.exe + - %windir%\\system32\\wpr.exe + - %windir%\\system32\\dsregcmd.exe + - %windir%\\system32\\dispdiag.exe + - %windir%\\system32\\ipconfig.exe + - %windir%\\system32\\logman.exe + - %windir%\\system32\\tracelog.exe + - %programfiles%\\windows defender\\mpcmdrun.exe + - %windir%\\system32\\MdmDiagnosticsTool.exe + - %windir%\\system32\\pnputil.exe + +- **FoldersFiles** + - Captures log files from a given path (without recursion). + - Expected input value: File path with or without wildcards, such as "%windir%\\System32", or "%programfiles%\\*.log". + - Privacy guardrails: To enable diagnostic log capture while reducing the risk of an IT admin inadvertently capturing user-generated documents, only paths under the following roots are allowed: + - %PROGRAMFILES% + - %PROGRAMDATA% + - %PUBLIC% + - %WINDIR% + - %TEMP% + - %TMP% + - Additionally, only files with the following extensions are captured: + - .log + - .txt + - .dmp + - .cab + - .zip + - .xml + - .html + - .evtx + - .etl + +**DiagnosticArchive/ArchiveResults** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting displays the results of the last archive run. + +The supported operation is Get. + +The data type is string. + +A Get to the above URI will return the results of the data gathering for the last diagnostics request. For the example above it returns: + +``` xml + + + + + 1 + 1 + 0 + SyncHdr + 200 + + + 2 + 1 + 1 + Get + 200 + + + 3 + 1 + 1 + + + ./Vendor/MSFT/DiagnosticLog/DiagnosticArchive/ArchiveResults + + + + f1e20cb4-9789-4f6b-8f6a-766989764c6d + HKLM\Software\Policies + C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors\*.etl + %windir%\system32\ipconfig.exe /all + %windir%\system32\mdmdiagnosticstool.exe -out c:\ProgramData\temp\ + c:\ProgramData\temp\*.* + Application + + + + + + + +``` + +Each data gathering node is annotated with the HRESULT of the action and the collection is also annotated with an overall HRESULT. In this example, note that the mdmdiagnosticstool.exe command failed. + +The zip file which is created also contains a results.xml file whose contents align to the Data section in the SyncML for ArchiveResults. Accordingly, an IT admin using the zip file for troubleshooting can determine the order and success of each directive without needing a permanent record of the SyncML value for DiagnosticArchive/ArchiveResults. + + +## Policy area + +The Policy functionality within the DiagnosticLog CSP configures Windows event log policies, such as maximum log size. + +The following section describes the nodes for the Policy functionality. + +**Policy** +Added in version 1.4 of the CSP in Windows 10, version 1903. Root node to control settings for channels in Event Log. + +The supported operation is Get. + +**Policy/Channels** +Added in version 1.4 of the CSP in Windows 10, version 1903. Node that contains Event Log channel settings. + +The supported operation is Get. + +**Policy/Channels/_ChannelName_** +Added in version 1.4 of the CSP in Windows 10, version 1903. Dynamic node to represent a registered channel. The node name must be a valid Windows event log channel name, such as ``Microsoft-Client-Licensing-Platform%2FAdmin``. When specifying the name in the LocURI, it must be URL encoded, otherwise it may unexpectedly translate into a different URI. + +Supported operations are Add, Delete, and Get. + +Add **Channel** +``` xml + + ​ + ​ + 2​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName​ + ​ + ​ + ​ + node​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +Delete **Channel** +``` xml + + ​ + ​ + 3​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +Get **Channel** +``` xml + + ​ + ​ + 4​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +**Policy/Channels/_ChannelName_/MaximumFileSize** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting specifies the maximum size of the log file in megabytes. + +If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte and 2 terabytes in megabyte increments. + +If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is integer. + +Add **MaximumFileSize** +``` xml + + ​ + ​ + 6​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + int​ + text/plain​ + ​ + 3​ + ​ + ​ + ​ + ​ + +``` + +Delete **MaximumFileSize** +``` xml + + ​ + ​ + 7​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` +Get **MaximumFileSize** +``` xml + + ​ + ​ + 5​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **MaximumFileSize** +``` xml + + ​ + ​ + 8​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/MaximumFileSize​ + ​ + ​ + ​ + int​ + text/plain​ + ​ + 5​ + ​ + ​ + ​ + ​ + +``` + +**Policy/Channels/_ChannelName_/SDDL** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting represents SDDL string controlling access to the channel. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is string. + +Default string is as follows: + +https://docs.microsoft.com/windows/desktop/WES/eventmanifestschema-channeltype-complextype. + +Add **SDDL** +``` xml + + ​ + ​ + 10​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + YourSDDL​ + ​ + ​ + ​ + ​ + +``` + +Delete **SDDL** +``` xml + + + ​ + ​ + 11​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Get **SDDL** +``` xml + + ​ + ​ + 9​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **SDDL** +``` xml + + ​ + ​ + 12​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/SDDL​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + YourNewSDDL​ + ​ + ​ + ​ + ​ + +``` + +**Policy/Channels/_ChannelName_/ActionWhenFull** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is string. + +The following are the possible values: +- Truncate — When the log file reaches its maximum file size, new events are not written to the log and are lost. +- Overwrite — When the log file reaches its maximum file size, new events overwrite old events. +- Archive — When the log file reaches its maximum size, the log file is saved to the location specified by the "Archive Location" policy setting. If archive location value is not set, the new file is saved in the same directory as current log file. + +If you disable or do not configure this policy setting, the locally configured value will be used as default. Every channel that is installed, whether inbox or by ISVs, is responsible for defining its own local configuration, and that configuration can be changed by any administrator. Values set via this policy override but do not replace local configuration. + + +Add **ActionWhenFull** +``` xml + + ​ + ​ + 14​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + Archive​ + ​ + ​ + ​ + ​ + +``` + +Delete **ActionWhenFull** +``` xml + + ​ + ​ + 15​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Get **ActionWhenFull** +``` xml + + ​ + ​ + 13​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **ActionWhenFull** +``` xml + + ​ + ​ + 16​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/ActionWhenFull​ + ​ + ​ + ​ + chr​ + text/plain​ + ​ + Truncate​ + ​ + ​ + ​ + ​ + +``` + +**Policy/Channels/_ChannelName_/Enabled** +Added in version 1.4 of the CSP in Windows 10, version 1903. This policy setting specifies whether the channel should be enabled or disabled. + +Supported operations are Add, Delete, Get, and Replace. + +The data type is boolean. + +The following are the possible values: +- TRUE — Enables the channel. +- FALSE — Disables the channel. + +If you disable or do not configure this policy setting, the locally configured value is used as default. + +Get **Enabled** +``` xml + + ​ + ​ + 17​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Add **Enabled** +``` xml + + ​ + ​ + 18​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + bool​ + text/plain​ + ​ + TRUE​ + ​ + ​ + ​ + ​ + +``` + +Delete **Enabled** +``` xml + + ​ + ​ + 19​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + ​ + ​ + ​ + +``` + +Replace **Enabled** +``` xml + + ​ + ​ + 20​ + ​ + ​ + ​ + ./Vendor/MSFT/DiagnosticLog/Policy/Channels/ChannelName/Enabled​ + ​ + ​ + ​ + bool​ + text/plain​ + ​ + FALSE​ + ​ + ​ + ​ + ​ + +``` + +## EtwLog area + +The Event Tracing for Windows (ETW) log feature of the DiagnosticLog CSP is used to control the following types of event tracing: +- [Collector-based tracing](#collector-based-tracing) +- [Channel-based tracing](#channel-based-tracing) + +The ETW log feature is designed for advanced usage, and assumes developers' familiarity with ETW. For more information, see [About Event Tracing](https://docs.microsoft.com/windows/win32/etw/about-event-tracing). ### Collector-based tracing -This type of event tracing simultaneously collects event data from a collection of registered ETW providers. +This type of event tracing collects event data from a collection of registered ETW providers. An event collector is a container of registered ETW providers. Users can add or delete a collector node and register or unregister multiple providers in this collector. @@ -45,13 +715,12 @@ For each registered provider in this collector, the user can: - Change trace level to filter events from this provider - Enable or disable the provider in the trace session -The changes on **State**, **Keywords** and **TraceLevel** takes effect immediately while trace session is in progress. +The changes on **State**, **Keywords**, and **TraceLevel** takes effect immediately while trace session is in progress. -> **Note**  Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. +> [!Note] +> Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. -  - -### Channel-based tracing + ### Channel-based tracing The type of event tracing exports event data from a specific channel. This is only supported on the desktop. @@ -67,40 +736,24 @@ For each channel node, the user can: For more information about using DiagnosticLog to collect logs remotely from a PC or mobile device, see [Diagnose MDM failures in Windows 10](diagnose-mdm-failures-in-windows-10.md). -Here are the links to the DDFs: - -- [DiagnosticLog CSP version 1.2](diagnosticlog-ddf.md#version-1-2) -- [DiagnosticLog CSP version 1.3](diagnosticlog-ddf.md#version-1-3) - -The following diagram shows the DiagnosticLog configuration service provider in tree format. - -![diagnosticlog csp diagram](images/provisioning-csp-diagnosticlog.png) - -**./Vendor/MSFT/DiagnosticLog** -The root node for the DiagnosticLog configuration service provider. - -The following steps describe the process for gathering diagnostics using this CSP. +To gather diagnostics using this CSP: 1. Specify a *CollectorName* for the container of the target ETW providers. 2. (Optional) Set logging and log file parameters using the following options: - - **TraceLogFileMode** - - **LogFileSizeLimitMB** - - Each of these are described later in this topic. + - TraceLogFileMode + - LogFileSizeLimitMB 3. Indicate one or more target ETW providers by supplying its *ProviderGUID* to the Add operation of EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*. 4. (Optional) Set logging and log file parameters using the following options: - - - **TraceLevel** - - **Keywords** - - Each of these are described later in this topic. - -5. Start logging using **TraceControl** EXECUTE command “START” + - TraceLevel + - Keywords +5. Start logging using **TraceControl** EXECUTE command “START”. 6. Perform actions on the target device that will generate activity in the log files. -7. Stop logging using **TraceControl** EXECUTE command “STOP” -8. Collect the log file located in the `%temp%` folder using the method described in [Reading a log file](#reading-a-log-file) +7. Stop logging using **TraceControl** EXECUTE command “STOP”. +8. Collect the log file located in the `%temp%` folder using the method described in [Reading a log file](#reading-a-log-file). + +The following section describes the nodes for EtwLog functionality. **EtwLog** Node to contain the Error Tracing for Windows log. @@ -112,14 +765,14 @@ Interior node to contain dynamic child interior nodes for active providers. The supported operation is Get. -**EtwLog/Collectors/****_CollectorName_** +**EtwLog/Collectors/***CollectorName* Dynamic nodes to represent active collector configuration. Supported operations are Add, Delete, and Get. Add a collector -``` syntax +```xml @@ -141,7 +794,7 @@ Add a collector Delete a collector -``` syntax +```xml @@ -172,8 +825,6 @@ The following table represents the possible values: | 0 | Stopped | | 1 | Started | -  - **EtwLog/Collectors/*CollectorName*/TraceLogFileMode** Specifies the log file logging mode. @@ -183,30 +834,10 @@ Supported operations are Get and Replace. The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - -
    ValueDescription

    EVENT_TRACE_FILE_MODE_SEQUENTIAL (0x00000001)

    Writes events to a log file sequentially; stops when the file reaches its maximum size.

    EVENT_TRACE_FILE_MODE_CIRCULAR (0x00000002)

    Writes events to a log file. After the file reaches the maximum size, the oldest events are replaced with incoming events.

    - -  +| Value | Description | +|-------|--------------------| +| EVENT_TRACE_FILE_MODE_SEQUENTIAL (0x00000001) | Writes events to a log file sequentially; stops when the file reaches its maximum size. | +| EVENT_TRACE_FILE_MODE_CIRCULAR (0x00000002) | Writes events to a log file. After the file reaches the maximum size, the oldest events are replaced with incoming events. | **EtwLog/Collectors/*CollectorName*/TraceControl** Specifies the logging and report action state. @@ -220,8 +851,6 @@ The following table lists the possible values: | START | Start log tracing. | | STOP | Stop log tracing | -  - The supported operation is Execute. After you have added a logging task, you can start a trace by running an Execute command on this node with the value START. @@ -230,7 +859,7 @@ To stop the trace, running an execute command on this node with the value STOP. Start collector trace logging -``` syntax +```xml @@ -253,7 +882,7 @@ Start collector trace logging Stop collector trace logging -``` syntax +```xml @@ -288,18 +917,17 @@ Interior node to contain dynamic child interior nodes for active providers. The supported operation is Get. -**EtwLog/Collectors/*CollectorName*/Providers/****_ProviderGUID_** +**EtwLog/Collectors/*CollectorName*/Providers/***ProviderGUID* Dynamic nodes to represent active provider configuration per provider GUID. -> **Note**  Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. - -  +> [!Note] +> Microsoft-WindowsPhone-Enterprise-Diagnostics-Provider (GUID - 3da494e4-0fe2-415C-b895-fb5265c5c83b) has the required debug resource files built into Windows OS, which will allow the logs files to be decoded on the remote machine. Any other logs may not have the debug resources required to decode. Supported operations are Add, Delete, and Get. Add a provider -``` syntax +```xml @@ -321,7 +949,7 @@ Add a provider Delete a provider -``` syntax +```xml @@ -338,55 +966,26 @@ Delete a provider ``` -**EtwLog/Collectors/*CollectorName*/Providers/*ProvderGUID*/TraceLevel** +**EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*/TraceLevel** Specifies the level of detail included in the trace log. The data type is an integer. Supported operations are Get and Replace. -The following table lists the possible values. +The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ValueDescription

    1 – TRACE_LEVEL_CRITICAL

    Abnormal exit or termination events

    2 – TRACE_LEVEL_ERROR

    Severe error events

    3 – TRACE_LEVEL_WARNING

    Warning events such as allocation failures

    4 – TRACE_LEVEL_INFORMATION

    Non-error events, such as entry or exit events

    5 – TRACE_LEVEL_VERBOSE

    Detailed information

    - -  +| Value | Description | +|-------|--------------------| +| 1 – TRACE_LEVEL_CRITICAL | Abnormal exit or termination events | +| 2 – TRACE_LEVEL_ERROR | Severe error events | +| 3 – TRACE_LEVEL_WARNING | Warning events such as allocation failures | +| 4 – TRACE_LEVEL_INFORMATION | Non-error events, such as entry or exit events | +| 5 – TRACE_LEVEL_VERBOSE | Detailed information | Set provider **TraceLevel** -``` syntax +```xml @@ -407,10 +1006,10 @@ Set provider **TraceLevel** ``` -**EtwLog/Collectors/*CollectorName*/Providers/*ProvderGUID*/Keywords** +**EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*/Keywords** Specifies the provider keywords to be used as MatchAnyKeyword for this provider. -the data type is a string. +The data type is a string. Supported operations are Get and Replace. @@ -418,7 +1017,7 @@ Default value is 0 meaning no keyword. Get provider **Keywords** -``` syntax +```xml @@ -438,7 +1037,7 @@ Get provider **Keywords** Set provider **Keywords** -``` syntax +```xml @@ -461,43 +1060,23 @@ Set provider **Keywords** ``` -**EtwLog/Collectors/*CollectorName*/Providers/*ProvderGUID*/State** +**EtwLog/Collectors/*CollectorName*/Providers/*ProviderGUID*/State** Specifies if this provider is enabled in the trace session. The data type is a boolean. Supported operations are Get and Replace. This change will be effective during active trace session. -The following table lists the possible values. Default value is TRUE. +The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - -
    ValueDescription

    TRUE

    Provider is enabled in the trace session.

    FALSE

    Provider is disables in the trace session.

    - -  +| Value | Description | +|-------|--------------------| +| TRUE | Provider is enabled in the trace session. This is the default. | +| FALSE | Provider is disabled in the trace session. | Set provider **State** -``` syntax +```xml @@ -523,14 +1102,14 @@ Interior node to contain dynamic child interior nodes for registered channels. The supported operation is Get. -**EtwLog/Channels/****_ChannelName_** +**EtwLog/Channels/***ChannelName* Dynamic nodes to represent a registered channel. The node name must be a valid Windows event log channel name, such as "Microsoft-Client-Licensing-Platform%2FAdmin" Supported operations are Add, Delete, and Get. Add a channel -``` syntax +```xml @@ -552,7 +1131,7 @@ Add a channel Delete a channel -``` syntax +```xml @@ -576,7 +1155,7 @@ The supported operation is Execute. Export channel event data -``` syntax +```xml @@ -604,7 +1183,7 @@ Default value is empty string. Get channel **Filter** -``` syntax +```xml @@ -628,36 +1207,16 @@ The data type is a boolean. Supported operations are Get and Replace. -The following table lists the possible values. +The following table lists the possible values: - ---- - - - - - - - - - - - - - - - - -
    ValueDescription

    TRUE

    Channel is enabled.

    FALSE

    Channel is disabled.

    - -  +| Value | Description | +|-------|--------------------| +| TRUE | Channel is enabled. | +| FALSE | Channel is disabled. | Get channel **State** -``` syntax +```xml @@ -676,7 +1235,7 @@ Get channel **State** Set channel **State** -``` syntax +```xml @@ -697,6 +1256,12 @@ Set channel **State** ``` +## DeviceStateData area + +The DeviceStateData functionality within the DiagnosticLog CSP provides additional device information. + +The following section describes the nodes for the DeviceStateData functionality. + **DeviceStateData** Added in version 1.3 of the CSP in Windows 10, version 1607. Node for all types of device state data that are exposed. @@ -705,7 +1270,7 @@ Added in version 1.3 of the CSP in Windows 10, version 1607. Triggers the snapp The supported value is Execute. -``` syntax +```xml @@ -726,13 +1291,24 @@ The supported value is Execute. ``` +## FileDownload area +The FileDownload feature of the DiagnosticLog CSP enables a management server to pull data directly from the device. In the FileDownload context the client and server roles are conceptually reversed, with the management server acting as a client to download the data from the managed device. + +### Comparing FileDownload and DiagnosticArchive +Both the FileDownload and DiagnosticArchive features can be used to get data from the device to the management server, but they are optimized for different workflows. + +- FileDownload enables the management server to directly pull byte-level trace data from the managed device. The data transfer takes place through the existing OMA-DM/SyncML context. It is typically used together with the EtwLogs feature as part of an advanced monitoring or diagnostic flow. FileDownlod requires granular orchestration by the management server, but avoids the need for dedicated cloud storage. +- DiagnosticArchive allows the management server to give the CSP a full set of instructions as single command. Based on those instructions the CSP orchestrates the work client-side to package the requested diagnostic files into a zip archive and upload that archive to cloud storage. The data transfer happens outside of the OMA-DM session, via an HTTP PUT. + +The following section describes the nodes for the FileDownload functionality. + **FileDownload** Node to contain child nodes for log file transportation protocols and corresponding actions. **FileDownload/DMChannel** Node to contain child nodes using DM channel for transport protocol. -**FileDownload/DMChannel/****_FileContext_** +**FileDownload/DMChannel/***FileContext* Dynamic interior nodes that represents per log file context. **FileDownload/DMChannel/*FileContext*/BlockSizeKB** @@ -746,7 +1322,7 @@ Supported operations are Get and Replace. Set **BlockSizeKB** -``` syntax +```xml @@ -769,7 +1345,7 @@ Set **BlockSizeKB** Get **BlockSizeKB** -``` syntax +```xml @@ -795,7 +1371,7 @@ The only supported operation is Get. Get **BlockCount** -``` syntax +```xml @@ -821,7 +1397,7 @@ Supported operations are Get and Replace. Set **BlockIndexToRead** at 0 -``` syntax +```xml @@ -844,7 +1420,7 @@ Set **BlockIndexToRead** at 0 Set **BlockIndexToRead** at 1 -``` syntax +```xml @@ -872,7 +1448,7 @@ The only supported operation is Get. Get **BlockData** -``` syntax +```xml @@ -892,29 +1468,18 @@ Get **BlockData** **FileDownload/DMChannel/*FileContext*/DataBlocks** Node to transfer the selected log file block to the DM server. -**FileDownload/DMChannel/*FileContext*/DataBlocks/****_BlockNumber_** +**FileDownload/DMChannel/*FileContext*/DataBlocks/***BlockNumber* The data type is Base64. -The only supported operation is Get. - -## Reading a log file - - -1. Enumerate log file under **./Vendor/MSFT/DiagnosticLog/FileDownload/DMChannel** -2. Select a log file in the Enumeration result -3. Set **BlockSizeKB** per DM server payload limitation -4. Get **BlockCount** to determine total read request -5. Set **BlockIndexToRead** to initialize read start point -6. Get **BlockData** for upload log block -7. Increase **BlockIndexToRead** -8. Repeat step 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)** - -  - -  - - - - - +The supported operation is Get. +### Reading a log file +To read a log file: +1. Enumerate log file under **./Vendor/MSFT/DiagnosticLog/FileDownload/DMChannel**. +2. Select a log file in the Enumeration result. +3. Set **BlockSizeKB** per DM server payload limitation. +4. Get **BlockCount** to determine total read request. +5. Set **BlockIndexToRead** to initialize read start point. +6. Get **BlockData** for upload log block. +7. Increase **BlockIndexToRead**. +8. Repeat step 5 to 7 until **BlockIndexToRead == (BlockIndexToRead – 1)**. \ No newline at end of file diff --git a/windows/client-management/mdm/diagnosticlog-ddf.md b/windows/client-management/mdm/diagnosticlog-ddf.md index 97ae506323..8bedac1205 100644 --- a/windows/client-management/mdm/diagnosticlog-ddf.md +++ b/windows/client-management/mdm/diagnosticlog-ddf.md @@ -2,11 +2,13 @@ title: DiagnosticLog DDF description: DiagnosticLog DDF ms.assetid: 9DD75EDA-5913-45B4-9BED-20E30CDEBE16 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -21,6 +23,7 @@ The content below are the latest versions of the DDF files: - [DiagnosticLog CSP version 1.2](#version-1-2) - [DiagnosticLog CSP version 1.3](#version-1-3) +- [DiagnosticLog CSP version 1.4](#version-1-4) ## DiagnosticLog CSP version 1.2 @@ -1282,6 +1285,893 @@ The content below are the latest versions of the DDF files: ``` +## DiagnosticLog CSP version 1.4 +```xml + + +]> + + 1.2 + + DiagnosticLog + ./Vendor/MSFT + + + + + + + + + + + + + + + com.microsoft/1.4/MDM/DiagnosticLog + + + + EtwLog + + + + + Root node of all types of event logging nodes that CSP manages. + + + + + + + + + + + + + + + Collectors + + + + + Root node of registered "Collector" nodes. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a registered 'Collector' node. CSP will maintain an ETW trace session for this collector with its name used as a unique identifier. In a collector, a valid ETW provider can be registered and unregistered. The collector's associated trace session will enable the registered providers in it if the provider's state is 'Enabled'. Each provider's state, trace level and keywords can be controlled separately. The name of this node must not be a valid Windows event channel name. It can be a etw provider guid as long as it is not equal to an already registered 'Provider' node name. + + + + + + + + + + CollectorName + + + + + + TraceStatus + + + + + This node is used for getting the status of this collector node's associated trace session. 1 means "in progress"; 0 means "not started or stopped". + + + + + + + + + + + text/plain + + + + + TraceLogFileMode + + + + + + 1 + This node is used for setting or getting the trace log file mode of this collector node's associated trace session. The only two allowed values are 1 and 2, which are EVENT_TRACE_FILE_MODE_SEQUENTIAL and EVENT_TRACE_FILE_MODE_CIRCULAR. Default value is 1. + + + + + + + + + + + text/plain + + + + + TraceControl + + + + + + This node is to trigger "start" and "stop" of this collector node's associated trace session. "Get" returns the name of this node. + + + + + + + + + + + text/plain + + + + + LogFileSizeLimitMB + + + + + + 4 + This node is used for setting or getting the trace log file size limit(in Megabytes) of this collector node's associated trace session. The value range is 1~2048. Default value is 4. + + + + + + + + + + + text/plain + + + + + Providers + + + + + Root node of all providers registered in this collector node. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents an ETW provider registered in this collector node. The node name must be a valid provider GUID. + + + + + + + + + + ProviderGuid + + + + + + Keywords + + + + + + "0" + This node is used for setting or getting the keywords of the event provider in this collector node's associated trace session. The string is in the form of hexadecimal digits and 16 chars wide. It'll be internally converted into ULONGLONG data type in the CSP. Default value is "0", which means all events from this provider are included. If the associated trace session is in progress, new keywords setting is applied immediately; if not, it'll be applied next time that session is started. + + + + + + + + + + + text/plain + + + + + TraceLevel + + + + + + 5 + This node is used for setting or getting the trace level of this event provider in this collector node's associated trace session. Default value is 5, which is TRACE_LEVEL_VERBOSE. If the associated trace session is in progress, new trace level setting is applied immediately;if not, it'll be applied next time that session is started. + + + + + + + + + + + text/plain + + + + + State + + + + + + true + This node is used for setting or getting the state of the event provider in this collector node's associated trace session. If the trace session isn't started, changing the value controls whether to enable the provider or not when session is started; if trace session is already started, changing its value causes enabling or disabling the provider in the live trace session. Default value is true. + + + + + + + + + + + text/plain + + + + + + + + + Channels + + + + + Root node of registered "Channel" nodes. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a registered 'Channel' node. The node name must be a valid Windows event log channel name, e.g. "Microsoft-Client-Licensing-Platform%2FAdmin". When specifying the name in the LocURI, it must be url encoded or it'll be translated into a different URI unexpectedly. + + + + + + + + + + ChannelName + + + + + + Export + + + + + + This node is to trigger exporting events into a log file from this node's associated Windows event channel. The log file's extension is .evtx, which is the standard extension of windows event channel log. The "Get" command returns the name of this node. + + + + + + + + + + + text/plain + + + + + State + + + + + + This node is used for setting or getting the 'Enabled' state of this node's associated windows event channel in the system. Setting it to "TRUE" enables the channel; setting it to "FALSE" disables the channel. + + + + + + + + + + + text/plain + + + + + Filter + + + + + + "" + This node is used for setting or getting the xpath query string to filter the events when exporting the log file from the channel. Default value is empty string. + + + + + + + + + + + text/plain + + + + + + + + DeviceStateData + + + + + Root node of all types of device state data that CSP exposes. + + + + + + + + + + + + + + + MdmConfiguration + + + + + This node is to trigger snapping of the Device Management state data with "SNAP". + + + + + + + + + + + text/plain + + + + + + FileDownload + + + + + Root node of all csp nodes that are related to log file download in csp. + + + + + + + + + + + + + + + DMChannel + + + + + Root node of all csp nodes that are used for controlling file download for their associated log file generated by logging csp nodes. + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a 'FileContext' node corresponding to a log file generated by one of the logging CSP nodes(underneath 'EtwLog' node). The node name must be the name of a registered 'Provider', 'Collector' or 'Channel' node. The log file and its location will be determined by CSP based on the node name. File download is done by dividing the log file into multiple blocks of configured block size and then sending the blocks as requested by MDM server. + + + + + + + + + + FileContext + + + + + + BlockSizeKB + + + + + + 4 + This node is used for setting or getting the block size (in Kilobytes) for the download of associated log file. The value range is 1~16. Default value is 4. + + + + + + + + + + + text/plain + + + + + BlockCount + + + + + This node is used for getting the total number of blocks for the associated log file. If the log file isn't generated yet, the value returned is -1; if the trace session is in progress, the value returned is -2. + + + + + + + + + + + text/plain + + + + + BlockIndexToRead + + + + + + This node is used for setting and getting the block index that points to the data block for 'BlockData' node. The value range is 0~(BlockCount-1). + + + + + + + + + + + text/plain + + + + + BlockData + + + + + This node is used to get the binary data of the block that 'BlockIndexToRead' node is pointing to. + + + + + + + + + + + + + + + + DataBlocks + + + + + Root node of all 'BlockNumber' nodes for the associated log file. The number of its children should be the total block count of the log file. No children nodes exist if 'BlockCount' node's value is less than 0. + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a 'BlockNumber' node. The node name is an integer equal to the index of the block which this node stands for. Therefore the node name should be ranging from 0 to (BlockCount -1). It returns the binary data of the block which this node is referring to. + + + + + + + + + + BlockNumber + + + + + + + + + + + Policy + + + + + Contains policy for diagnostic settings. + + + + + + + + + + + + + + + + + + Channels + + + + + Contains policy for Event Log channel settings. + + + + + + + + + + + + + + + + + + + + + + Each dynamic node represents a registered 'Channel' node. The node name must be a valid Windows event log channel name, e.g. "Microsoft-Client-Licensing-Platform%2FAdmin". When specifying the name in the LocURI, it must be url encoded or it'll be translated into a different URI unexpectedly. + + + + + + + + + + ChannelName + + + + + + MaximumFileSize + + + + + + + + Maximum size of the channel log file in MB. + + + + + + + + + + + text/plain + + + + + SDDL + + + + + + + + SDDL String controlling access to the channel. Default: https://docs.microsoft.com/windows/desktop/WES/eventmanifestschema-channeltype-complextype + + + + + + + + + + + + + + text/plain + + + + + ActionWhenFull + + + + + + + + Action to take when the log file reaches maximum size. "Truncate", "Overwrite", "Archive". + + + + + + + + + + + + + + text/plain + + + + + Enabled + + + + + + + + This policy setting specifies whether the channel should be enabled or disabled. Set value to TRUE to enable and FALSE to disable. + + + + + + + + + + + text/plain + + + + + + + + DiagnosticArchive + + + + + Root note for archive definition and collection. + + + + + + + + + + + + + + + ArchiveDefinition + + + + + + + + + + + + + + + + text/plain + + + + + ArchiveResults + + + + + Pull up the results of the last archive run. + + + + + + + + + + + + + + text/plain + + + + + + +``` + ## Related topics diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md index d794478a6f..3cb1682333 100644 --- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md @@ -5,11 +5,13 @@ MS-HAID: - 'p\_phdevicemgmt.disconnecting\_from\_the\_management\_infrastructure\_\_unenrollment\_' - 'p\_phDeviceMgmt.disconnecting\_from\_mdm\_unenrollment' ms.assetid: 33B2B248-631B-451F-B534-5DA095C4C8E8 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -103,7 +105,7 @@ After the previous package is sent, the unenrollment process begins. When the server initiates disconnection, all undergoing sessions for the enrollment ID are aborted immediately to avoid deadlocks. The server will not get a response for the unenrollment, instead a generic alert notification is sent with messageid=1. -``` syntax +```xml 4 1226 diff --git a/windows/client-management/mdm/dmacc-csp.md b/windows/client-management/mdm/dmacc-csp.md index 8db057501d..aa61f9d50b 100644 --- a/windows/client-management/mdm/dmacc-csp.md +++ b/windows/client-management/mdm/dmacc-csp.md @@ -2,11 +2,13 @@ title: DMAcc CSP description: DMAcc CSP ms.assetid: 43e73d8a-6617-44e7-8459-5c96f4422e63 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -17,7 +19,7 @@ The DMAcc configuration service provider allows an OMA Device Management (DM) ve > **Note**  This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_DEVICE\_MANAGEMENT\_ADMIN capabilities to be accessed from a network configuration application. -  + For the DMAcc CSP, you cannot use the Replace command unless the node already exists. @@ -62,7 +64,7 @@ Interior node for DM server address. Required. -**AppAddr/****_ObjectName_** +**AppAddr/***ObjectName* Required. Defines the OMA DM server address. Only one server address can be configured. When mapping the [w7 APPLICATION configuration service provider](w7-application-csp.md) to the DMAcc Configuration Service Provider, the name of this element is "1". This is the first DM address encountered in the w7 APPLICATION configuration service provider, other DM accounts are ignored. @@ -84,7 +86,7 @@ Interior node for port information. Optional. -**Port/****_ObjectName_** +**Port/***ObjectName* Required. Only one port number can be configured. When mapping the [w7 APPLICATION configuration service provider](w7-application-csp.md) to the DMAcc Configuration Service Provider, the name of this element is "1". @@ -106,7 +108,7 @@ Value type is string. Supported operations are Add, Get, and Replace. ***AccountUID*/AppAuth** Optional. Defines authentication settings. -**AppAuth/****_ObjectName_** +**AppAuth/***ObjectName* Required. Defines one set of authentication settings. When mapping the [w7 APPLICATION configuration service provider](w7-application-csp.md) to the DMAcc Configuration Service Provider, the name of this element is same name as the AAuthLevel value ("CLRED" or "SRVCRED"). @@ -256,11 +258,11 @@ Stores specifies which certificate stores the DM client will search to find the > **Note**   %EF%80%80 is the UTF8-encoded character U+F000. -  + Subject specifies the certificate to search for. For example, to specify that you want a certificate with a particular Subject attribute (“CN=Tester,O=Microsoft”), use the following: -``` syntax +```xml ``` @@ -277,9 +279,9 @@ Supported operations are Add, and Replace. [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/dmacc-ddf-file.md b/windows/client-management/mdm/dmacc-ddf-file.md index 93a041f3d1..232f5672cd 100644 --- a/windows/client-management/mdm/dmacc-ddf-file.md +++ b/windows/client-management/mdm/dmacc-ddf-file.md @@ -2,11 +2,13 @@ title: DMAcc DDF file description: DMAcc DDF file ms.assetid: 44dc99aa-2a85-498b-8f52-a81863765606 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml **Provider/****_ProviderID_** +**Provider/***ProviderID* Required. This node contains the URI-encoded value of the bootstrapped device management account’s Provider ID. Scope is dynamic. This value is set and controlled by the MDM server. As a best practice, use text that doesn’t require XML/URI escaping. For Intune, use **MS DM Server** for Windows desktop or **SCConfigMgr** for Windows mobile for the _ProviderID_. @@ -55,20 +57,20 @@ Supported operations are Get and Add. > **Note**   Although hardware device IDs are guaranteed to be unique, there is a concern that this is not ultimately enforceable during a DM session. The device ID could be changed through the w7 APPLICATION configuration service provider’s **USEHWDEVID** parm by another management server. So during enterprise bootstrap and enrollment, a new device ID is specified by the enterprise server. This node is required and must be set by the server before the client certificate renewal is triggered. -  + **Provider/*ProviderID*/ExchangeID** Optional. Character string that contains the unique Exchange device ID used by the Outlook account of the user the session is running against. This is useful for the enterprise management server to correlate and merge records for a device that is managed by exchange and natively managed by a dedicated management server. > **Note**  In some cases for the desktop, this node will return "not found" until the user sets up their email. -  + Supported operation is Get. The following is a Get command example. -``` syntax +```xml 12 @@ -99,7 +101,7 @@ Required. The character string that contains the device management server addres > **Note**  When the ManagementServerAddressList value is set, the device ignores the value in ManagementServiceAddress. -  + The DMClient configuration service provider will save the address to the same location as the w7 and DMS configuration service providers to ensure the management client has a single place to retrieve the current server address. The initial value for this node is the same server address value as bootstrapped via the [w7 APPLICATION configuration service provider](w7-application-csp.md). @@ -146,7 +148,7 @@ This node is only supported in Windows 10 and later. Once you set the value to 2.0, it will not go back to 1.0. -  + Supported operations are Get, Replace, and Delete. @@ -171,7 +173,7 @@ To work around the timeout, you can use this setting to keep the session alive b Here is an example of DM message sent by the device when it is in pending state: -``` syntax +```xml 1.2 @@ -225,9 +227,9 @@ Added in Windows 10, version 1607. The list of management server URLs in the fo > **Note**  The < and > should be escaped. -  + -``` syntax +```xml 101 @@ -320,7 +322,7 @@ If there is no infinite schedule set, then a 24-hour schedule is created and sch -  + **Valid poll schedule: initial enrollment only \[no infinite schedule\]** @@ -371,13 +373,13 @@ If there is no infinite schedule set, then a 24-hour schedule is created and sch -  + **Invalid poll schedule: disable all poll schedules** > **Note**   Disabling poll schedules results in UNDEFINED behavior and enrollment may fail if poll schedules are all set to zero. -  + @@ -426,7 +428,7 @@ If there is no infinite schedule set, then a 24-hour schedule is created and sch
    -  + **Invalid poll schedule: two infinite schedules** @@ -485,7 +487,7 @@ If there is no infinite schedule set, then a 24-hour schedule is created and sch -  + If the device was previously enrolled in MDM with polling schedule configured via registry key values directly, the MDM server that supports using DMClient CSP to update polling schedule must first send an Add command to add a **./Vendor/MSFT/DMClient/Enrollment/<ProviderID>/Poll** node before it sends a Get/Replace command to query or update polling parameters via DMClient CSP @@ -622,7 +624,7 @@ The status error mapping is listed below. -  + **Provider/*ProviderID*/CustomEnrollmentCompletePage** Optional. Added in Windows 10, version 1703. @@ -768,7 +770,7 @@ Note that <LocURI>./Vendor/MSFT/DMClient/Unenroll</LocURI> is suppor The following SyncML shows how to remotely unenroll the device. Note that this command should be inserted in the general DM packages sent from the server to the device. -``` syntax +```xml 2 @@ -789,9 +791,9 @@ The following SyncML shows how to remotely unenroll the device. Note that this c [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/dmclient-ddf-file.md b/windows/client-management/mdm/dmclient-ddf-file.md index 1c171bbb0f..15b21d0197 100644 --- a/windows/client-management/mdm/dmclient-ddf-file.md +++ b/windows/client-management/mdm/dmclient-ddf-file.md @@ -2,11 +2,13 @@ title: DMClient DDF file description: DMClient DDF file ms.assetid: A21B33AF-DB76-4059-8170-FADF2CB898A0 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is for Windows 10, version 1803. -``` syntax +```xml - Number of days after last sucessful sync to unenroll + Number of days after last successful sync to unenroll @@ -1966,4 +1968,4 @@ The XML below is for Windows 10, version 1803. -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md index 09918702d2..25b59bccc1 100644 --- a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md +++ b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md @@ -3,6 +3,8 @@ title: DMProcessConfigXMLFiltered function description: Configures phone settings by using OMA Client Provisioning XML. Search.Refinement.TopicID: 184 ms.assetid: 31D79901-6206-454C-AE78-9B85A3B3487F +ms.reviewer: +manager: dansimp keywords: ["DMProcessConfigXMLFiltered function"] topic_type: - apiref @@ -12,11 +14,11 @@ api_location: - dmprocessxmlfiltered.dll api_type: - DllExport -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -44,16 +46,16 @@ Microsoft recommends that this function is not used to configure the following t > **Note**  The **DMProcessConfigXMLFiltered** function has full functionality in Windows 10 Mobile and Windows Phone 8.1, but it has a read-only functionality in Windows 10 desktop. -  + ## Syntax ```C++ HRESULT STDAPICALLTYPE DMProcessConfigXMLFiltered( -        LPCWSTR pszXmlIn, -  const WCHAR   **rgszAllowedCspNode, -  const DWORD   dwNumAllowedCspNodes, -        BSTR    *pbstrXmlOut + LPCWSTR pszXmlIn, + const WCHAR   **rgszAllowedCspNode, + const DWORD   dwNumAllowedCspNodes, + BSTR    *pbstrXmlOut ); ``` @@ -61,25 +63,25 @@ HRESULT STDAPICALLTYPE DMProcessConfigXMLFiltered( *pszXmlIn*

      -
    • \[in\] The null–terminated input XML buffer containing the configuration data. The parameter holds the XML that will be used to configure the phone. **DMProcessConfigXMLFiltered** accepts only OMA Client Provisioning XML (also known as WAP provisioning). It does not accept OMA DM SyncML XML (also known as SyncML).
      • +
    • [in] The null–terminated input XML buffer containing the configuration data. The parameter holds the XML that will be used to configure the phone. DMProcessConfigXMLFiltered accepts only OMA Client Provisioning XML (also known as WAP provisioning). It does not accept OMA DM SyncML XML (also known as SyncML).

    *rgszAllowedCspNode*
      -
    • \[in\] Array of **WCHAR\*** that specify which configuration service provider nodes are allowed to be invoked.
      • +
    • [in] Array of WCHAR\* that specify which configuration service provider nodes are allowed to be invoked.

    *dwNumAllowedCspNodes*
      -
    • \[in\] Number of elements passed in *rgszAllowedCspNode*.
      • +
    • [in] Number of elements passed in rgszAllowedCspNode.

    *pbstrXmlOut*
      -
    • \[out\] The resulting null–terminated XML from configuration. The caller of **DMProcessConfigXMLFiltered** is responsible for cleanup of the output buffer that the *pbstrXmlOut* parameter references. Use [**SysFreeString**](https://msdn.microsoft.com/library/windows/hardware/ms221481) to free the memory.
      • +
    • [out] The resulting null–terminated XML from configuration. The caller of DMProcessConfigXMLFiltered is responsible for cleanup of the output buffer that the pbstrXmlOut parameter references. Use SysFreeString to free the memory.

    @@ -124,7 +126,7 @@ Returns the standard **HRESULT** value **S\_OK** to indicate success. The follow -  + ## Remarks @@ -134,20 +136,20 @@ The usage of **DMProcessConfigXMLFiltered** depends on the configuration service ``` XML -    -        -            -            -            -            -            -        -    -    -        -            -        -    + + + + + + + + + + + + + + ``` @@ -156,8 +158,8 @@ Then, the second parameter in the call to **DMProcessConfigXMLFiltered** would h ``` C++ LPCWSTR rgszAllowedCspNodes[] = { -    L"NAPDEF", -    L"BrowserFavorite" + L"NAPDEF", + L"BrowserFavorite" }; ``` @@ -170,18 +172,18 @@ WCHAR szProvxmlContent[] = L"..."; BSTR bstr = NULL; HRESULT hr = DMProcessConfigXMLFiltered( -                szProvxmlContent, -                rgszAllowedCspNodes, -                _countof(rgszAllowedCspNodes), -                &bstr -                ); + szProvxmlContent, + rgszAllowedCspNodes, + _countof(rgszAllowedCspNodes), + &bstr + ); /* check error */ if ( bstr != NULL ) { -    SysFreeString( bstr ); -    bstr = NULL; + SysFreeString( bstr ); + bstr = NULL; } ``` @@ -224,7 +226,7 @@ if ( bstr != NULL ) [**SysFreeString**](https://msdn.microsoft.com/library/windows/hardware/ms221481) -  + diff --git a/windows/client-management/mdm/dmsessionactions-csp.md b/windows/client-management/mdm/dmsessionactions-csp.md index 6e8aa70785..b395c7c3ba 100644 --- a/windows/client-management/mdm/dmsessionactions-csp.md +++ b/windows/client-management/mdm/dmsessionactions-csp.md @@ -1,12 +1,14 @@ --- title: DMSessionActions CSP description: DMSessionActions CSP -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 +ms.reviewer: +manager: dansimp --- # DMSessionActions CSP @@ -26,25 +28,25 @@ The following diagram shows the DMSessionActions configuration service provider **./Device/Vendor/MSFT/DMSessionActions or ./User/Vendor/MSFT/DMSessionActions**

    Defines the root node for the DMSessionActions configuration service provider.

    -**_ProviderID_** +***ProviderID***

    Group settings per device management (DM) server. Each group of settings is distinguished by the Provider ID of the server. It must be the same DM server Provider ID value that was supplied through the w7 APPLICATION configuration service provider XML during the enrollment process. Only one enterprise management server is supported, which means that there should be only one ProviderID node under NodeCache.

    Scope is dynamic. Supported operations are Get, Add, and Delete.

    -**_ProviderID_/CheckinAlertConfiguration** +***ProviderID*/CheckinAlertConfiguration**

    Node for the custom configuration of alerts to be sent during MDM sync session.

    -**_ProviderID_/CheckinAlertConfiguration/Nodes** +***ProviderID*/CheckinAlertConfiguration/Nodes**

    Required. Root node for URIs to be queried. Scope is dynamic.

    Supported operation is Get.

    -**_ProviderID_/CheckinAlertConfiguration/Nodes/_NodeID_** +***ProviderID*/CheckinAlertConfiguration/Nodes/*NodeID***

    Required. Information about each node is stored under NodeID as specified by the server. This value must not contain a comma. Scope is dynamic.

    Supported operations are Get, Add, and Delete.

    -**_ProviderID_/CheckinAlertConfiguration/Nodes/_NodeID_/NodeURI** +***ProviderID*/CheckinAlertConfiguration/Nodes/*NodeID*/NodeURI**

    Required. The value is a complete OMA DM node URI. It can specify either an interior node or a leaf node in the device management tree. Scope is dynamic.

    Value type is string. Supported operations are Add, Get, Replace, and Delete.

    @@ -61,4 +63,4 @@ The following diagram shows the DMSessionActions configuration service provider **PowerSettings/MaxTimeSessionsSkippedInLowPowerState**

    Maximum time in minutes when the device can skip the check-in with the server if the device is in low power state.

    -

    Value type is integer. Supported operations are Add, Get, Replace, and Delete.

    \ No newline at end of file +

    Value type is integer. Supported operations are Add, Get, Replace, and Delete.

    diff --git a/windows/client-management/mdm/dmsessionactions-ddf.md b/windows/client-management/mdm/dmsessionactions-ddf.md index e587b4c69f..aef1210842 100644 --- a/windows/client-management/mdm/dmsessionactions-ddf.md +++ b/windows/client-management/mdm/dmsessionactions-ddf.md @@ -1,12 +1,14 @@ --- title: DMSessionActions DDF file description: DMSessionActions DDF file -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 +ms.reviewer: +manager: dansimp --- # DMSessionActions DDF file @@ -18,7 +20,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml     -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index 710e19855a..e7d55aedc0 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -1,12 +1,14 @@ --- title: DynamicManagement CSP description: DynamicManagement CSP -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 +ms.reviewer: +manager: dansimp --- # DynamicManagement CSP @@ -27,7 +29,7 @@ The following diagram shows the DynamicManagement configuration service provider

    Default value is False. Supported operations are Get and Replace.

    Example to turn on NotificationsEnabled:

    -``` syntax +```xml 100 @@ -82,7 +84,7 @@ The following diagram shows the DynamicManagement configuration service provider Disable Cortana based on Geo location and time, From 9am-5pm, when in the 100 meters radius of the specified latitude/longitude -``` syntax +```xml 200 @@ -136,7 +138,7 @@ Disable Cortana based on Geo location and time, From 9am-5pm, when in the 100 me Disable camera using network trigger with time trigger, from 9-5, when ip4 gateway is 192.168.0.1 -``` syntax +```xml 300 @@ -191,7 +193,7 @@ Disable camera using network trigger with time trigger, from 9-5, when ip4 gatew Delete a context -``` syntax +```xml 400 @@ -204,7 +206,7 @@ Delete a context Get ContextStatus and SignalDefinition from a specific context -``` syntax +```xml 400 @@ -221,4 +223,4 @@ Get ContextStatus and SignalDefinition from a specific context -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/dynamicmanagement-ddf.md b/windows/client-management/mdm/dynamicmanagement-ddf.md index 0ca27a4ec0..3439bf646a 100644 --- a/windows/client-management/mdm/dynamicmanagement-ddf.md +++ b/windows/client-management/mdm/dynamicmanagement-ddf.md @@ -2,11 +2,13 @@ title: DynamicManagement DDF file description: DynamicManagement DDF file ms.assetid: 7e266db0-2fd9-4412-b428-4550f41a1738 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -18,7 +20,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 38dc886b20..f687502610 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -1,12 +1,14 @@ --- title: EAP configuration -description: The topic provides a step-by-step guide for creating an Extensible Authentication Protocol (EAP) configuration XML for the VPN profile and information about EAP certificate filtering in Windows 10. +description: Learn how to create an Extensible Authentication Protocol (EAP) configuration XML for a VPN profile, plus info about EAP certificate filtering in Windows 10. ms.assetid: DD3F2292-4B4C-4430-A57F-922FED2A8FAE -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -54,7 +56,7 @@ Here is an easy way to get the EAP configuration from your desktop using the ras 9. Switch over to PowerShell and use the following cmdlets to retrieve the EAP configuration XML. - ``` syntax + ```powershell Get-VpnConnection -Name Test ``` @@ -78,17 +80,17 @@ Here is an easy way to get the EAP configuration from your desktop using the ras IdleDisconnectSeconds : 0 ``` - ``` syntax + ```powershell $a = Get-VpnConnection -Name Test ``` - ``` syntax + ```powershell $a.EapConfigXmlStream.InnerXml ``` Here is an example output - ``` syntax + ```xml 1300 13 diff --git a/windows/client-management/mdm/email2-csp.md b/windows/client-management/mdm/email2-csp.md index e54767ae8b..ddb14a8d3f 100644 --- a/windows/client-management/mdm/email2-csp.md +++ b/windows/client-management/mdm/email2-csp.md @@ -2,11 +2,13 @@ title: EMAIL2 CSP description: EMAIL2 CSP ms.assetid: bcfc9d98-bc2e-42c6-9b81-0b5bf65ce2b8 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/email2-ddf-file.md b/windows/client-management/mdm/email2-ddf-file.md index cad330322f..f24a64e3e3 100644 --- a/windows/client-management/mdm/email2-ddf-file.md +++ b/windows/client-management/mdm/email2-ddf-file.md @@ -2,11 +2,13 @@ title: EMAIL2 DDF file description: EMAIL2 DDF file ms.assetid: 7e266db0-2fd9-4412-b428-4550f41a1738 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml [!TIP] >Intune has added a number of ADMX-backed administrative templates in public preview. Check if the policy settings you need are available in a template before using the SyncML method described below. [Learn more about Intune's administrative templates.](https://docs.microsoft.com/intune/administrative-templates-windows) ## Enable a policy -1. Find the policy from the list [ADMX-backed policies](policy-configuration-service-provider.md#admx-backed-policies). You need the following information listed in the policy description. - - GP English name +> [!NOTE] +> See [Understanding ADMX-backed policies](https://docs.microsoft.com/windows/client-management/mdm/understanding-admx-backed-policies). + +1. Find the policy from the list [ADMX-backed policies](policies-admx-backed.md). You need the following information listed in the policy description. + - GP English name - GP name - GP ADMX file name - GP path @@ -59,10 +65,10 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( In this example you configure **Enable App-V Client** to **Enabled**. -> [!Note] +> [!NOTE] > The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. -``` syntax +```xml @@ -91,140 +97,140 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( In this example, the policy is in **Administrative Templates > System > App-V > Publishing**. - 1. Double-click **Publishing Server 2 Settings** to see the parameters you need to configure when you enable this policy. + 1. Double-click **Publishing Server 2 Settings** to see the parameters you need to configure when you enable this policy. - ![Enable publishing server 2 policy](images/admx-appv-publishingserver2.png) + ![Enable publishing server 2 policy](images/admx-appv-publishingserver2.png) - ![Enable publishing server 2 settings](images/admx-app-v-enablepublishingserver2settings.png) + ![Enable publishing server 2 settings](images/admx-app-v-enablepublishingserver2settings.png) - 2. Find the variable names of the parameters in the ADMX file. + 2. Find the variable names of the parameters in the ADMX file. - You can find the ADMX file name in the policy description in Policy CSP. In this example, the filename appv.admx is listed in [AppVirtualization/PublishingAllowServer2](policy-configuration-service-provider.md#appvirtualization-publishingallowserver2). + You can find the ADMX file name in the policy description in Policy CSP. In this example, the filename appv.admx is listed in [AppVirtualization/PublishingAllowServer2](policy-configuration-service-provider.md#appvirtualization-publishingallowserver2). - ![Publishing server 2 policy description](images/admx-appv-policy-description.png) + ![Publishing server 2 policy description](images/admx-appv-policy-description.png) - 3. Navigate to **C:\Windows\PolicyDefinitions** (default location of the admx files) and open appv.admx. + 3. Navigate to **C:\Windows\PolicyDefinitions** (default location of the admx files) and open appv.admx. - 4. Search for GP name **Publishing_Server2_policy**. + 4. Search for GP name **Publishing_Server2_policy**. - 5. Under **policy name="Publishing_Server2_Policy"** you can see the \ listed. The text id and enum id represents the data id you need to include in the SyncML data payload. They correspond to the fields you see in GP Editor. + 5. Under **policy name="Publishing_Server2_Policy"** you can see the \ listed. The text id and enum id represents the data id you need to include in the SyncML data payload. They correspond to the fields you see in GP Editor. - Here is the snippet from appv.admx: + Here is the snippet from appv.admx: - ``` syntax - - + ```xml + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - ``` + + ``` - 6. From the \ tag, copy all the text id and enum id and create an XML with data id and value fields. The value field contains the configuration settings you would enter in the GP Editor. + 6. From the \ tag, copy all the text id and enum id and create an XML with data id and value fields. The value field contains the configuration settings you would enter in the GP Editor. - Here is the example XML for Publishing_Server2_Policy : + Here is the example XML for Publishing_Server2_Policy : - ``` syntax - - - - - - - - - - - ``` + ```xml + + + + + + + + + + + ``` - 7. Create the SyncML to enable the policy. Payload contains \ and name/value pairs. + 7. Create the SyncML to enable the policy. Payload contains \ and name/value pairs. - Here is the example for **AppVirtualization/PublishingAllowServer2**: + Here is the example for **AppVirtualization/PublishingAllowServer2**: -> [!Note] +> [!NOTE] > The \ payload must be XML encoded. To avoid encoding, you can use CData if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). If you are using Intune, select String as the data type. - ``` syntax + ```xml @@ -262,7 +268,7 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( The \ payload is \. Here is an example to disable AppVirtualization/PublishingAllowServer2. -``` syntax +```xml @@ -287,7 +293,7 @@ The \ payload is \. Here is an example to disable AppVirtualiza The \ payload is empty. Here an example to set AppVirtualization/PublishingAllowServer2 to "Not Configured." -``` syntax +```xml diff --git a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md index 4c21520591..32ac15d67d 100644 --- a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md +++ b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md @@ -2,18 +2,20 @@ title: Enable offline upgrades to Windows 10 for Windows Embedded 8.1 Handheld devices description: Like any Windows devices, Windows 10 Mobile devices use Microsoft Update by default to download updates over the Internet. ms.assetid: ED3DAF80-847C-462B-BDB1-486577906772 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- # Enable offline upgrades to Windows 10 for Windows Embedded 8.1 Handheld devices -Like any Windows devices, Windows 10 Mobile devices use Microsoft Update by default to download updates over the Internet. However, in some enterprise environments, devices may not be able to access the Internet to retrieve their updates. Because of network restrictions or other enterprise policies, devices must download their updates from an internal location. This document describes how to enable offline updates using System Center Configuration Manager. +Like any Windows devices, Windows 10 Mobile devices use Microsoft Update by default to download updates over the Internet. However, in some enterprise environments, devices may not be able to access the Internet to retrieve their updates. Because of network restrictions or other enterprise policies, devices must download their updates from an internal location. This document describes how to enable offline updates using Microsoft Endpoint Configuration Manager. Here is a table of update path to Windows 10 Mobile. @@ -77,7 +79,7 @@ Down the road, after the upgrade to Windows 10 is complete, if you decide to pus **Requirements:** - The test device must be same as the other production devices that are receiving the updates. -- Your test device must be enrolled with System Center Configuration Manager. +- Your test device must be enrolled with Microsoft Endpoint Configuration Manager. - Your device can connect to the Internet. - Your device must have an SD card with at least 0.5 GB of free space. - Ensure that the settings app and PhoneUpdate applet are available via Assigned Access. @@ -91,7 +93,7 @@ The following diagram is a high-level overview of the process. Define the baseline update set that will be applied to other devices. Use a device that is running the most recent image as the test device. -Trigger the device to check for updates either manually or using System Center Configuration Manager. +Trigger the device to check for updates either manually or using Microsoft Endpoint Configuration Manager. **Manually** @@ -102,19 +104,19 @@ Trigger the device to check for updates either manually or using System Center C > **Note**  There is a bug in all OS versions up to GDR2 where the CSP will not set the assigned value. There is no way to change or set this until GDR2 is deployed onto the device. -**Using System Center Configuration Manager** +**Using Microsoft Endpoint Configuration Manager** 1. Remotely trigger a scan of the test device by deploying a Trigger Scan Configuration Baseline. - ![device scan using sccm](images/windowsembedded-update2.png) + ![device scan using Configuration Manager](images/windowsembedded-update2.png) 2. Set the value of this OMA-URI by browsing to the settings of this Configuration Item and selecting the newly created Trigger Scan settings from the previous step. - ![device scan using sccm](images/windowsembedded-update3.png) + ![device scan using Configuration Manager](images/windowsembedded-update3.png) 3. Ensure that the value that is specified for this URI is greater than the value on the device(s) and that the Remediate noncompliant rules when supported option is checked. For the first time, any value that is greater than 0 will work, but for subsequent configurations, ensure that you specify an incremented value. - ![device scan using sccm](images/windowsembedded-update4.png) + ![device scan using Configuration Manager](images/windowsembedded-update4.png) 4. Create a Configuration Baseline for TriggerScan and Deploy. It is recommended that this Configuration Baseline be deployed after the Controlled Updates Baseline has been applied to the device (the corresponding files are deployed on the device through a device sync session). 5. Follow the prompts for downloading the updates, but do not install the updates on the device. @@ -130,16 +132,16 @@ There are two ways to retrieve this file from the device; one pre-GDR1 and one p 1. Create a Configuration Item using ConfigMgr to look at the registry entry ./Vendor/MSFT/EnterpriseExt/DeviceUpdate/ApprovedUpdatesXml. - > **Note**  In System Center Configuration Manager, you may see an error about exceeding the file limit when using ApprovedUpdatesXml. However, the process still completes even if the file is large. + > **Note**  In Microsoft Endpoint Configuration Manager, you may see an error about exceeding the file limit when using ApprovedUpdatesXml. However, the process still completes even if the file is large. If the XML file is greater than 32K you can also use ./Vendor/MSFT/FileSystem/<*filename*>. 2. Set a baseline for this Configuration Item with a “dummy” value (such as zzz), and ensure that you do not remediate it. The dummy value is not be set; it is only used for comparison. -3. After the report XML is sent to the device, System Center Configuration Manager displays a compliance log that contains the report information. The log can contain significant amount of data. +3. After the report XML is sent to the device, Microsoft Endpoint Configuration Manager displays a compliance log that contains the report information. The log can contain significant amount of data. 4. Parse this log for the report XML content. -For a step-by-step walkthrough, see [How to retrieve a device update report using System Center Configuration Manager logs](#how-to-retrieve-a-device-update-report-using-system-center-configuration-manager-logs). +For a step-by-step walkthrough, see [How to retrieve a device update report using Microsoft Endpoint Configuration Manager logs](#how-to-retrieve-a-device-update-report-using-microsoft-endpoint-configuration-manager-logs). **Post-GDR1: Retrieve the report xml file using an SD card** @@ -226,7 +228,7 @@ This process has three parts: 1. Create a configuration item and specify that file path and name on the device as `NonPersistent\DUCustomContentURIs.xml` 2. Check the box **Remediate noncompliant settings**. - ![embedded device upate](images/windowsembedded-update21.png) + ![embedded device update](images/windowsembedded-update21.png) 3. Click **OK**. @@ -236,11 +238,11 @@ This process has three parts: 1. Create a configuration baseline item and give it a name (such as ControlledUpdates). 2. Add the DUControlledUpdates and DUCustomContentURIs configuration items, and then click **OK**. - ![embedded device upate](images/windowsembedded-update22.png) + ![embedded device update](images/windowsembedded-update22.png) 3. Deploy the configuration baseline to the appropriate device or device collection. - ![embedded device upate](images/windowsembedded-update23.png) + ![embedded device update](images/windowsembedded-update23.png) 4. Click **OK**. @@ -250,7 +252,7 @@ Now that the other "production" or "in-store" devices have the necessary informa ### Use this process for unmanaged devices -If the update policy of the device is not managed or restricted by System Center Configuration Manager, an update process can be initiated on the device in one of the following ways: +If the update policy of the device is not managed or restricted by Microsoft Endpoint Configuration Manager, an update process can be initiated on the device in one of the following ways: - Initiated by a periodic scan that the device automatically performs. - Initiated manually through **Settings** -> **Phone Update** -> **Check for Updates**. @@ -259,21 +261,21 @@ If the update policy of the device is not managed or restricted by System Center If the update policy of the device is managed or restricted by MDM, an update process can be initiated on the device in one of the following ways: -- Trigger the device to scan for updates through System Center Configuration Manager. +- Trigger the device to scan for updates through Microsoft Endpoint Configuration Manager. Ensure that the trigger scan has successfully executed, and then remove the trigger scan configuration baseline. > **Note**  Ensure that the PhoneUpdateRestriction Policy is set to a value of 0, to ensure that the device will not perform an automatic scan. -- Trigger the device to scan as part of a Maintenance Window defined by the IT Admin in System Center Configuration Manager. +- Trigger the device to scan as part of a Maintenance Window defined by the IT Admin in Microsoft Endpoint Configuration Manager. After the installation of updates is completed, the IT Admin can use the DUReport generated in the production devices to determine if the device successfully installed the list of updates. If the device did not, error codes are provided in the DUReport.xml. To retrieve the device update report from a device, perform the same steps defined in [Step 2](#step2). ## Example PowerShell script -``` syntax +```powershell param ( # [Parameter (Mandatory=$true, HelpMessage="Input File")] [String]$inputFile, @@ -454,7 +456,7 @@ DownloadFiles $inputFile $downloadCache $localCacheURL ``` -## How to retrieve a device update report using System Center Configuration Manager logs +## How to retrieve a device update report using Microsoft Endpoint Configuration Manager logs Use this procedure for pre-GDR1 devices. @@ -463,17 +465,17 @@ Use this procedure for pre-GDR1 devices. 1. Trigger a device scan. Go to **Settings** -> **Phone Update** -> **Check for Updates**. Since the DUReport settings have not been remedied, you should see a non-compliance. -2. In System Center Configuration Manager under **Assets and Compliance** > **Compliance Settings**, right-click on **Configuration Items**. +2. In Microsoft Endpoint Configuration Manager under **Assets and Compliance** > **Compliance Settings**, right-click on **Configuration Items**. 3. Select **Create Configuration Item**. - ![device update using sccm](images/windowsembedded-update5.png) + ![device update using Configuration Manager](images/windowsembedded-update5.png) 4. Enter a filename (such as GetDUReport) and then choose **Mobile Device**. 5. In the **Mobile Device Settings** page, check the box **Configure Additional Settings that are not in the default settings group**, and the click **Next**. - ![device update using sccm](images/windowsembedded-update6.png) + ![device update using Configuration Manager](images/windowsembedded-update6.png) 6. In the **Additional Settings** page, click **Add**. - ![device update using sccm](images/windowsembedded-update7.png) + ![device update using Configuration Manager](images/windowsembedded-update7.png) 7. In the **Browse Settings** page, click **Create Setting**. ![device update](images/windowsembedded-update8.png) diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 24e4a9039a..ac08247a1f 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -1,44 +1,90 @@ --- title: Enroll a Windows 10 device automatically using Group Policy description: Enroll a Windows 10 device automatically using Group Policy -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 10/04/2017 +author: manikadhiman +ms.date: 07/29/2019 +ms.reviewer: +manager: dansimp --- # Enroll a Windows 10 device automatically using Group Policy Starting in Windows 10, version 1709, you can use a Group Policy to trigger auto-enrollment to MDM for Active Directory (AD) domain-joined devices. +The enrollment into Intune is triggered by a group policy created on your local AD and happens without any user interaction. This means you can automatically mass-enroll a large number of domain-joined corporate devices into Microsoft Intune. The enrollment process starts in the background once you sign in to the device with your Azure AD account. + Requirements: - AD-joined PC running Windows 10, version 1709 or later - The enterprise has configured a mobile device management (MDM) service - The enterprise AD must be [registered with Azure Active Directory (Azure AD)](azure-active-directory-integration-with-mdm.md) - The device should not already be enrolled in Intune using the classic agents (devices managed using agents will fail enrollment with `error 0x80180026`) +- The minimum Windows Server version requirement is based on the Hybrid AAD join requirement. See [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) for more information. -> [!Tip] -> [How to configure automatic registration of Windows domain-joined devices with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-automatic-device-registration-setup) +> [!TIP] +> For additional information, see the following topics: +> - [How to configure automatic registration of Windows domain-joined devices with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-automatic-device-registration-setup) +> - [How to plan your hybrid Azure Active Directory join implementation](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan) +> - [Azure Active Directory integration with MDM](https://docs.microsoft.com/windows/client-management/mdm/azure-active-directory-integration-with-mdm) -To verify if the device is Azure AD registered, run `dsregcmd /status` from the command line. +The auto-enrollment relies on the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically AAD registered. -Here is a partial screenshot of the result: - -![device status result](images/autoenrollment-device-status.png) - -The auto-enrollment relies of the presence of an MDM service and the Azure Active Directory registration for the PC. Starting in Windows 10, version 1607, once the enterprise has registered its AD with Azure AD, a Windows PC that is domain joined is automatically AAD registered. - -> [!Note] +> [!NOTE] > In Windows 10, version 1709, the enrollment protocol was updated to check whether the device is domain-joined. For details, see [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/library/mt221945.aspx). For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation. -When the auto-enrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task will use the existing MDM service configuration from the Azure Active Directory information of the user. If multi-factor authentication is required, the user will get a prompt to complete the authentication. Once the enrollment is configured, the user can check the status in the Settings page. +When the auto-enrollment Group Policy is enabled, a task is created in the background that initiates the MDM enrollment. The task will use the existing MDM service configuration from the Azure Active Directory information of the user. If multi-factor authentication is required, the user will get a prompt to complete the authentication. Once the enrollment is configured, the user can check the status in the Settings page. -In Windows 10, version 1709, when the same policy is configured in GP and MDM, the GP policy wins (GP policy is take precedence over MDM). In the future release of Windows 10, we are considering a feature that allows the admin to control which policy takes precedence. +In Windows 10, version 1709, when the same policy is configured in GP and MDM, the GP policy wins (GP policy takes precedence over MDM). Since Windows 10, version 1803, a new setting allows you to change the policy conflict winner to MDM. For additional information, see [Windows 10 Group Policy vs. Intune MDM Policy who wins?](https://blogs.technet.microsoft.com/cbernier/2018/04/02/windows-10-group-policy-vs-intune-mdm-policy-who-wins/). For this policy to work, you must verify that the MDM service provider allows the GP triggered MDM enrollment for domain joined devices. +## Verify auto-enrollment requirements and settings +To ensure that the auto-enrollment feature is working as expected, you must verify that various requirements and settings are configured correctly. +The following steps demonstrate required settings using the Intune service: +1. Verify that the user who is going to enroll the device has a valid Intune license. + + ![Intune license verification](images/auto-enrollment-intune-license-verification.png) + +2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](https://docs.microsoft.com/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal). +Also verify that the **MAM user scope** is set to **None**. Otherwise, it will have precedence over the MDM scope that will lead to issues. + + ![Auto-enrollment activation verification](images/auto-enrollment-activation-verification.png) + +3. Verify that the device OS version is Windows 10, version 1709 or later. +4. Auto-enrollment into Intune via Group Policy is valid only for devices which are hybrid Azure AD joined. This means that the device must be joined into both local Active Directory and Azure Active Directory. To verify that the device is hybrid Azure AD joined, run `dsregcmd /status` from the command line. + + You can confirm that the device is properly hybrid-joined if both **AzureAdJoined** and **DomainJoined** are set to **YES**. + + ![Auto-enrollment device status result](images/auto-enrollment-device-status-result.png) + + Additionally, verify that the SSO State section displays **AzureAdPrt** as **YES**. + + ![Auto-enrollment azure AD prt verification](images/auto-enrollment-azureadprt-verification.png) + + This information can also be found on the Azure AD device list. + + ![Azure AD device list](images/azure-ad-device-list.png) + +5. Verify that the MDM discovery URL during auto-enrollment is https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc + + ![MDM discovery URL](images/auto-enrollment-mdm-discovery-url.png) + +6. Some tenants might have both **Microsoft Intune** and **Microsoft Intune Enrollment** under **Mobility**. Make sure that your auto-enrollment settings are configured under **Microsoft Intune** instead of **Microsoft Intune Enrollment**. + + ![Mobility setting MDM intune](images/auto-enrollment-microsoft-intune-setting.png) + +7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM) is properly deployed to all devices which should be enrolled into Intune. +You may contact your domain administrators to verify if the group policy has been deployed successfully. + +8. Verify that the device is not enrolled with the old Intune client used on the Intune Silverlight Portal (this is the Intune portal used before the Azure portal). +9. Verify that Azure AD allows the logon user to enroll devices. + ![Azure AD device settings](images/auto-enrollment-azure-ad-device-settings.png) +10. Verify that Microsoft Intune should allow enrollment of Windows devices. + ![Enrollment of Windows devices](images/auto-enrollment-enrollment-of-windows-devices.png) + ## Configure the auto-enrollment Group Policy for a single PC This procedure is only for illustration purposes to show how the new auto-enrollment policy works. It is not recommended for the production environment in the enterprise. For bulk deployment, you should use the [Group Policy Management Console process](#configure-the-auto-enrollment-for-a-group-of-devices). @@ -48,7 +94,7 @@ Requirements: - Enterprise has MDM service already configured - Enterprise AD must be registered with Azure AD -1. Run GPEdit.msc +1. Run GPEdit.msc Click Start, then in the text box type gpedit. @@ -60,23 +106,34 @@ Requirements: ![MDM policies](images/autoenrollment-mdm-policies.png) -4. Double-click **Auto MDM Enrollment with AAD Token**. +4. Double-click **Enable Automatic MDM enrollment using default Azure AD credentials**. ![MDM autoenrollment policy](images/autoenrollment-policy.png) -5. Click **Enable**, then click **OK**. +5. Click **Enable**, then click **OK**. - A task is created and scheduled to run every 5 minutes for the duration of 1 day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD." +> [!NOTE] +> In Windows 10, version 1903, the MDM.admx file was updated to include an option to select which credential is used to enroll the device. **Device Credential** is a new option that will only have an effect on clients that have the Windows 10, version 1903 feature update installed. +The default behavior for older releases is to revert to **User Credential**. - To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app). +> [!NOTE] +> Device credential group policy setting is not supported for enrolling into Microsoft Intune. - If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot. +When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. The task is called " Schedule created by enrollment client for automatically enrolling in MDM from AAD." - ![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) +To see the scheduled task, launch the [Task Scheduler app](#task-scheduler-app). -6. To verify successful enrollment to MDM , click **Start > Settings > Accounts > Access work or school**, then select your domain account. +If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot. -7. Click **Info** to see the MDM enrollment information. +![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) + +> [!Tip] +> You can avoid this behavior by using Conditional Access Policies in Azure AD. +Learn more by reading [What is Conditional Access?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview). + +6. To verify successful enrollment to MDM , click **Start > Settings > Accounts > Access work or school**, then select your domain account. + +7. Click **Info** to see the MDM enrollment information. ![Work School Settings](images/autoenrollment-settings-work-school.png) @@ -89,9 +146,9 @@ Requirements: ![Task Scheduler search result](images/autoenrollment-task-schedulerapp.png) -2. Under **Best match**, click **Task Scheduler** to launch it. +2. Under **Best match**, click **Task Scheduler** to launch it. -3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. +3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. ![Auto-enrollment scheduled task](images/autoenrollment-scheduled-task.png) @@ -107,11 +164,76 @@ Requirements: - Enterprise AD must be integrated with Azure AD. - Ensure that PCs belong to same computer group. -1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. -2. Create a Security Group for the PCs. -3. Link the GPO. -4. Filter using Security Groups. -5. Enforce a GPO link +> [!IMPORTANT] +> If you do not see the policy, it may be because you don’t have the ADMX installed for Windows 10, version 1803, version 1809, or version 1903. To fix the issue, follow these steps (Note: the latest MDM.admx is backwards compatible): +> 1. Download: +> 1803 -->[Administrative Templates (.admx) for Windows 10 April 2018 Update (1803)](https://www.microsoft.com/download/details.aspx?id=56880) or +> 1809 --> [Administrative Templates for Windows 10 October 2018 Update (1809)](https://www.microsoft.com/download/details.aspx?id=57576) or +> 1903 --> [Administrative Templates (.admx) for Windows 10 May 2019 Update (1903)](https://www.microsoft.com/download/details.aspx?id=58495&WT.mc_id=rss_alldownloads_all) +> 2. Install the package on the Primary Domain Controller (PDC). +> 3. Navigate, depending on the version to the folder: +> 1803 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803) v2**, or +> 1809 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2018 Update (1809) v2**, or +> 1903 --> **C:\Program Files (x86)\Microsoft Group Policy\Windows 10 May 2019 Update (1903) v3** +> 4. Rename the extracted Policy Definitions folder to **PolicyDefinitions**. +> 5. Copy PolicyDefinitions folder to **C:\Windows\SYSVOL\domain\Policies**. +> (If this folder does not exist, then be aware that you will be switching to a [central policy store](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) for your entire domain). +> 6. Restart the Primary Domain Controller for the policy to be available. +> This procedure will work for any future version as well. + +1. Create a Group Policy Object (GPO) and enable the Group Policy **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **MDM** > **Enable automatic MDM enrollment using default Azure AD credentials**. +2. Create a Security Group for the PCs. +3. Link the GPO. +4. Filter using Security Groups. +5. Enforce a GPO link. + +## Troubleshoot auto-enrollment of devices + +Investigate the log file if you have issues even after performing all the mandatory verification steps. The first log file to investigate is the event log on the target Windows 10 device. + +To collect Event Viewer logs: + +1. Open Event Viewer. +2. Navigate to Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin. + + > [!Tip] + > For guidance on how to collect event logs for Intune, see [Collect MDM Event Viewer Log YouTube video](https://www.youtube.com/watch?v=U_oCe2RmQEc). + +3. Search for event ID 75, which represents a successful auto-enrollment. Here is an example screenshot that shows the auto-enrollment completed successfully: + ![Event ID 75](images/auto-enrollment-troubleshooting-event-id-75.png) + + If you cannot find event ID 75 in the logs, it indicates that the auto-enrollment failed. This can happen because of the following reasons: + - The enrollment failed with error. In this case, search for event ID 76, which represents failed auto-enrollment. Here is an example screenshot that shows that the auto-enrollment failed: + ![Event ID 76](images/auto-enrollment-troubleshooting-event-id-76.png) + To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](https://support.microsoft.com/en-ph/help/4469913/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for more information. + - The auto-enrollment did not trigger at all. In this case, you will not find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described in the following section. + + The auto-enrollment process is triggered by a task (Microsoft > Windows > EnterpriseMgmt) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (Computer Configuration > Policies > Administrative Templates > Windows Components > MDM) is successfully deployed to the target machine as shown in the following screenshot: + ![Task scheduler](images/auto-enrollment-task-scheduler.png) + + > [!Note] + > This task isn't visible to standard users - run Scheduled Tasks with administrative credentials to find the task. + + This task runs every 5 minutes for the duration of 1 day. To confirm if the task succeeded, check the task scheduler event logs: + Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational. + Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from AAD is triggered by event ID 107. + + ![Event ID 107](images/auto-enrollment-event-id-107.png) + + When the task is completed, a new event ID 102 is logged. + ![Event ID 102](images/auto-enrollment-event-id-102.png) + + Note that the task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It does not indicate the success or failure of auto-enrollment. + + If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there is possibly issue with the group policy. Immediately run the command `gpupdate /force` in command prompt to get the GPO applied. If this still does not help, further troubleshooting on the Active Directory is required. + One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (HKLM > Software > Microsoft > Enrollments). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: + + ![Outdated enrollment entries](images/auto-enrollment-outdated-enrollment-entries.png) + + By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational event log file under event ID 7016. + A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display less entries as shown in the following screenshot: + + ![Manually deleted entries](images/auto-enrollment-activation-verification-less-entries.png) ### Related topics @@ -120,3 +242,9 @@ Requirements: - [Link a Group Policy Object](https://technet.microsoft.com/library/cc732979(v=ws.11).aspx) - [Filter Using Security Groups](https://technet.microsoft.com/library/cc752992(v=ws.11).aspx) - [Enforce a Group Policy Object Link](https://technet.microsoft.com/library/cc753909(v=ws.11).aspx) + +### Useful Links + +- [Windows 10 Administrative Templates for Windows 10 May 2019 Update 1903](https://www.microsoft.com/download/details.aspx?id=58495) +- [Windows 10 Administrative Templates for Windows 10 October 2018 Update 1809](https://www.microsoft.com/download/details.aspx?id=57576) +- [Windows 10 Administrative Templates for Windows 10 April 2018 Update 1803](https://www.microsoft.com/download/details.aspx?id=56880) diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md new file mode 100644 index 0000000000..e70eed0ce5 --- /dev/null +++ b/windows/client-management/mdm/enrollmentstatustracking-csp-ddf.md @@ -0,0 +1,906 @@ +--- +title: EnrollmentStatusTracking DDF +description: View the OMA DM device description framework (DDF) for the EnrollmentStatusTracking configuration service provider. DDF files are used only with OMA DM provisioning XML. +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: ManikaDhiman +ms.date: 05/17/2019 +--- + +# EnrollmentStatusTracking DDF + + +This topic shows the OMA DM device description framework (DDF) for the **EnrollmentStatusTracking** configuration service provider. DDF files are used only with OMA DM provisioning XML. + +Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). + +### EnrollmentStatusTracking CSP + +```xml + +]> + + 1.2 + + EnrollmentStatusTracking + ./User/Vendor/MSFT + + + + + These settings are used to communicate what policies the Enrollment Status Page (ESP) should block on. Using these settings, policy providers register themselves and the set of policies that need to be tracked. The ESP will include the counts of these policy sets in the status message to the user, and blocks progress on that page until all policies are provisioned. The policy provider is expected to drive the status updates by updating the appropriate node values, which will then be reflected in the ESP status message. + + + + + + + + + + + com.microsoft/1.0/MDM/EnrollmentStatusTracking + + + + Setup + + + + + These settings are read by the Enrollment Status Page (ESP) during the Account Setup phase. Policy providers use these nodes to communicate progress state back to the ESP, which is then displayed to the user through progress message updates. + + + + + + + + + + + + + + + + + + Apps + + + + + Policy providers use these settings to communicate to the ESP which app installations it should block on and provide progress in the status message to the user. + + + + + + + + + + + + + + + + + + PolicyProviders + + + + + These settings are read by the Enrollment Status Page (ESP) during the Device Setup phase. Policy providers use these nodes to communicate progress state back to the ESP, which is then displayed to the user through progress message updates. + + + + + + + + + + + + + + + + + + + + + + + + + + This node represents an app policy provider for the Enrollment Status Page (ESP). Existence of this node indicates to the ESP that it should not show the tracking status message until the TrackingPoliciesCreated node has been set to true. + + + + + + + + + + + + + ProviderName + + + + + + TrackingPoliciesCreated + + + + + + + + Indicates when the provider has created the required policies for the ESP to use for tracking app installation progress. The policy provider itself is expected to set the value of this node, not the MDM server. + + + + + + + + + + + + + + text/plain + + + + + + + Tracking + + + + + This node represents an app policy provider for the Enrollment Status Page (ESP). Existence of this node indicates to the ESP that it should not show the tracking status message until the TrackingPoliciesCreated node has been set to true. + + + + + + + + + + + + + + + + + + + + + + + + + + The name of the provider responsible for installing these apps and providing status back to the Enrollment Status Page. + + + + + + + + + + + + + ProviderName + + + + + + + + + + + + + + A unique name for the app whose progress should be tracked in the ESP. The app name can be arbitrary as it is not used directly by the ESP, so the value can be defined however the policy provider chooses. + + + + + + + + + + + + + AppName + + + + + + TrackingUri + + + + + + + + An optional URI to another CSP for tracking the apps installation. If this value is not set, installation status is derived from the InstallationState node. + + + + + + + + + + + + + + text/plain + + + + + InstallationState + + + + + + + + The installation state for the app. This node should be updated by the policy providers (not the MDM server) so the ESP can track the installation progress and update the status message. Expected values: 1 = NotInstalled, 2 = InProgress, 3 = Completed, 4 = Error + + + + + + + + + + + + + + text/plain + + + + + RebootRequired + + + + + + + + An optional node indicating if the app installation requires the ESP to issue a reboot. This node should be set by the policy provider installing the app (not the MDM server). Expected values: 1 = NotRequired, 2 = SoftReboot, 3 = HardReboot. If this node is not set, the ESP will not reboot the device for this app install. + + + + + + + + + + + + + + text/plain + + + + + + + + + HasProvisioningCompleted + + + + + false + This node is set by the Enrollment Status Page (ESP) when it completes. Providers are able to query this node to determine if the ESP is showing, allowing them to bifurcate their logic accordingly. For instance, when an app install requires a reboot, the policy provider should let the ESP issue the reboot by setting RebootRequired value for that app if and only if the ESP is running, otherwise, the policy provider is responsible for issuing a reboot themselves. + + + + + + + + + + + + + + text/plain + + + + + + + EnrollmentStatusTracking + ./Device/Vendor/MSFT + + + + + These settings are used to communicate what policies the Enrollment Status Page (ESP) should block on. Using these settings, policy providers register themselves and the set of policies that need to be tracked. The ESP will include the counts of these policy sets in the status message to the user, and blocks progress on that page until all policies are provisioned. The policy provider is expected to drive the status updates by updating the appropriate node values, which will then be reflected in the ESP status message. + + + + + + + + + + + com.microsoft/1.0/MDM/EnrollmentStatusTracking + + + + DevicePreparation + + + + + These settings are read by the Enrollment Status Page (ESP) during the Device Preparation phase. These setting are used to orchestrate any setup activities prior to provisioning the device in the Device Setup phase of the ESP. + + + + + + + + + + + + + + + + + + PolicyProviders + + + + + These nodes indicate to the Enrollment Status Page (ESP) that it should wait in the Device Preparation phase until all PolicyProviders are installed or marked as not required. + + + + + + + + + + + + + + + + + + + + + + + + + + This node represents a policy provider for the Enrollment Status Page (ESP). The node should be given a unique name for the policy provider. Registration of a policy provider indicates to the Enrollment Status Page that it should block in the Device Preparation phase until the provider sets its InstallationState node to 1 (not required) or 2 (complete). Once all registered policy providers have been marked as completed (or not required), the Enrollment Status Page will progress to the Device Setup phase. + + + + + + + + + + ProviderName + + + + + + InstallationState + + + + + + + + This node communicates the policy provider installation state back to the Enrollment Status Page. Expected values: 1 = NotInstalled, 2 = NotRequired, 3= Completed, 4 = Error. + + + + + + + + + + + + + + text/plain + + + + + LastError + + + + + + + + If a policy provider fails to install, it can optionally set an HRESULT error code that the Enrollment Status Page can display in an error message to the user. This node will only be read by the Enrollment Status Page when the provider's InstallationState node is set to 3 (Error). This node is only intended to be set by the policy provider itself, not the MDM server. + + + + + + + + + + + text/plain + + + + + Timeout + + + + + + + + An optional timeout (in minutes) for provider installation to complete before the Enrollment Status Page shows an error. Provider installation is considered complete when the InstallationState node is set to 2 (NotRequired) or 3 (Complete). If no timeout value is supplied the ESP will choose a default timeout value of 15 minutes. + + + + + + + + + + + + + + text/plain + + + + + TrackedResourceTypes + + + + + + + + This node's children registers which resource types the policy provider supports for provisioning. Only registered providers for a particular resource type will have their policies incorporated with Enrollment Status Page tracking message. + + + + + + + + + + + + + + + + + + Apps + + + + + + + + false + This node registers the policy provider for App provisioning. + + + + + + + + + + + + + + text/plain + + + + + + + + + Setup + + + + + These settings are read by the Enrollment Status Page (ESP) during the Device Setup phase. Policy providers use these nodes to communicate progress state back to the ESP, which is then displayed to the user through progress message updates. + + + + + + + + + + + + + + + + + + Apps + + + + + These settings are used to communicate what policies the Enrollment Status Page (ESP) should block on. Using these settings, policy providers register themselves and the set of policies that need to be tracked. The ESP will include the counts of these policy sets in the status message to the user, and blocks progress on that page until all policies are provisioned. The policy provider is expected to drive the status updates by updating the appropriate node values, which will then be reflected in the ESP status message. + + + + + + + + + + + + + + + + + + PolicyProviders + + + + + App policy providers for this CSP. These are the policy providers the ESP should wait on before showing the tracking message with status to the user. + + + + + + + + + + + + + + + + + + + + + + + + + + This node represents an app policy provider for the Enrollment Status Page (ESP). Existence of this node indicates to the ESP that it should not show the tracking status message until the TrackingPoliciesCreated node has been set to true. + + + + + + + + + + + + + ProviderName + + + + + + TrackingPoliciesCreated + + + + + + + + Indicates when the provider has created the required policies for the ESP to use for tracking app installation progress. The policy provider itself is expected to set the value of this node, not the MDM server. + + + + + + + + + + + + + + text/plain + + + + + + + Tracking + + + + + These are the set of apps that are being tracked by the Enrollment Status Page. + + + + + + + + + + + + + + + + + + + + + + + + + + The name of the provider responsible for installing these apps and providing status back to the Enrollment Status Page. + + + + + + + + + + + + + ProviderName + + + + + + + + + + + + + + A unique name for the app whose progress should be tracked in the ESP. The app name can be arbitrary as it is not used directly by the ESP, so the value can be defined however the policy provider chooses. + + + + + + + + + + + + + AppName + + + + + + TrackingUri + + + + + + + + An optional URI to another CSP for tracking the apps installation. If this value is not set, installation status is derived from the InstallationState node. + + + + + + + + + + + + + + text/plain + + + + + InstallationState + + + + + + + + The installation state for the app. This node should be updated by the policy providers (not the MDM server) so the ESP can track the installation progress and update the status message. Expected values: 1 = NotInstalled, 2 = InProgress, 3 = Completed, 4 = Error + + + + + + + + + + + + + + text/plain + + + + + RebootRequired + + + + + + + + An optional node indicating if the app installation requires the ESP to issue a reboot. This node should be set by the policy provider installing the app (not the MDM server). Expected values: 1 = NotRequired, 2 = SoftReboot, 3 = HardReboot. If this node is not set, the ESP will not reboot the device for this app install. + + + + + + + + + + + + + + text/plain + + + + + + + + + HasProvisioningCompleted + + + + + false + This node is set by the Enrollment Status Page (ESP) when it completes. Providers are able to query this node to determine if the ESP is showing, allowing them to bifurcate their logic accordingly. For instance, when an app install requires a reboot, the policy provider should let the ESP issue the reboot by setting RebootRequired value for that app if and only if the ESP is running, otherwise, the policy provider is responsible for issuing a reboot themselves. + + + + + + + + + + + + + + text/plain + + + + + + + +``` \ No newline at end of file diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp.md b/windows/client-management/mdm/enrollmentstatustracking-csp.md new file mode 100644 index 0000000000..6faa0a9b38 --- /dev/null +++ b/windows/client-management/mdm/enrollmentstatustracking-csp.md @@ -0,0 +1,179 @@ +--- +title: EnrollmentStatusTracking CSP +description: Learn how to perform a hybrid certificate trust deployment of Windows Hello for Business, for systems with no previous installations. +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: ManikaDhiman +ms.date: 05/21/2019 +--- + +# EnrollmentStatusTracking CSP + +During Autopilot deployment, you can configure the Enrollment Status Page (ESP) to block the device use until the required apps are installed. You can select the apps that must be installed before using the device. The EnrollmentStatusTracking configuration service provider (CSP) is used by Intune's agents, such as SideCar to configure ESP for blocking the device use until the required Win32 apps are installed. It tracks the installation status of the required policy providers and the apps they install and sends it to ESP, which displays the installation progress message to the user. For more information on ESP, see [Windows Autopilot Enrollment Status page](https://docs.microsoft.com/windows/deployment/windows-autopilot/enrollment-status). + +ESP uses the EnrollmentStatusTracking CSP along with the DMClient CSP to track the installation of different apps. The EnrollmentStatusTracking CSP tracks Win32 apps installations and DMClient CSP tracks MSI and Universal Windows Platform apps installations. In DMClient CSP, the **FirstSyncStatus/ExpectedMSIAppPackages** and **FirstSyncStatus/ExpectedModernAppPackages** nodes list the apps to track their installation. See [DMClient CSP](dmclient-csp.md) for more information. + +The EnrollmentStatusTracking CSP was added in Windows 10, version 1903. + + +The following diagram shows the EnrollmentStatusTracking CSP in tree format. + +![tree diagram for enrollmentstatustracking csp](images/provisioning-csp-enrollmentstatustracking.png) + +**./Vendor/MSFT** +For device context, use **./Device/Vendor/MSFT** path and for user context, use **./User/Vendor/MSFT** path. + +**EnrollmentStatusTracking** +Required. Root node for the CSP. This node is supported in both user context and device context. +Provides the settings to communicate what policies the ESP must block on. Using these settings, policy providers register themselves and the set of policies that must be tracked. The ESP includes the counts of these policy settings in the status message that is displayed to the user. It also blocks ESP until all the policies are provisioned. The policy provider is expected to drive the status updates by updating the appropriate node values, which are then reflected in the ESP status message. + +Scope is permanent. Supported operation is Get. + +**EnrollmentStatusTracking/DevicePreparation** +Required. This node is supported only in device context. +Specifies the settings that ESP reads during the device preparation phase. These settings are used to orchestrate any setup activities prior to provisioning the device in the device setup phase of the ESP. + +Scope is permanent. Supported operation is Get. + +**EnrollmentStatusTracking/DevicePreparation/PolicyProviders** +Required. This node is supported only in device context. +Indicates to the ESP that it should wait in the device preparation phase until all the policy providers have their InstallationState node set as 2 (NotRequired) or 3 (Completed). + +Scope is permanent. Supported operation is Get. + +**EnrollmentStatusTracking/DevicePreparation/PolicyProviders/_ProviderName_** +Optional. This node is supported only in device context. +Represents a policy provider for the ESP. The node should be given a unique name for the policy provider. Registration of a policy provider indicates to ESP that it should block in the device preparation phase until the provider sets its InstallationState node to 2 (NotRequired) or 3 (Completed). Once all the registered policy providers are marked as Completed or NotRequired, the ESP progresses to the device setup phase. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +**EnrollmentStatusTracking/DevicePreparation/PolicyProviders/*ProviderName*/InstallationState** +Required. This node is supported only in device context. +Communicates the policy provider installation state back to ESP. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +Value type is integer. Expected values are as follows: +- 1 — NotInstalled +- 2 — NotRequired +- 3 — Completed +- 4 — Error + +**EnrollmentStatusTracking/DevicePreparation/PolicyProviders/*ProviderName*/LastError** +Required. This node is supported only in device context. +Represents the last error code during the application installation process. If a policy provider fails to install, it can optionally set an HRESULT error code that the ESP can display in an error message to the user. ESP reads this node only when the provider's InstallationState node is set to 4 (Error). This node must be set only by the policy provider, and not by the MDM server. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +Value type is integer. + +**EnrollmentStatusTracking/DevicePreparation/PolicyProviders/*ProviderName*/Timeout** +Optional. This node is supported only in device context. +Represents the amount of time, in minutes, that the provider installation process can run before the ESP shows an error. Provider installation is complete when the InstallationState node is set to 2 (NotRequired) or 3 (Completed). If no timeout value is specified, ESP selects the default timeout value of 15 minutes. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +Value type is integer. The default is 15 minutes. + +**EnrollmentStatusTracking/DevicePreparation/PolicyProviders/*ProviderName*/TrackedResourceTypes** +Required. This node is supported only in device context. +This node's children register which resource types the policy provider supports for provisioning. Only registered providers for a particular resource type will have their policies incorporated with ESP tracking message. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +**EnrollmentStatusTracking/DevicePreparation/PolicyProviders/*ProviderName*/TrackedResourceTypes/Apps** +Required. This node is supported only in device context. +This node specifies if the policy provider is registered for app provisioning. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +Value type is boolean. Expected values are as follows: +- false — Indicates that the policy provider is not registered for app provisioning. This is the default. +- true — Indicates that the policy provider is registered for app provisioning. + +**EnrollmentStatusTracking/Setup** +Required. This node is supported in both user context and device context. +Provides the settings that ESP reads during the account setup phase in the user context and device setup phase in the device context. Policy providers use this node to communicate progress status back to the ESP, which is then displayed to the user through progress messages. + +Scope is permanent. Supported operation is Get. + +**EnrollmentStatusTracking/Setup/Apps** +Required. This node is supported in both user context and device context. +Provides the settings to communicate to the ESP which app installations it should block on and provide progress in the status message to the user. + +Scope is permanent. Supported operation is Get. + +**EnrollmentStatusTracking/Setup/Apps/PolicyProviders** +Required. This node is supported in both user context and device context. +Specifies the app policy providers for this CSP. These are the policy providers the ESP should wait on before showing the tracking message with the status to the user. + +Scope is permanent. Supported operation is Get. + +**EnrollmentStatusTracking/Setup/Apps/PolicyProviders**/***ProviderName*** +Optional. This node is supported in both user context and device context. +Represents an app policy provider for the ESP. Existence of this node indicates to the ESP that it should not show the tracking status message until the TrackingPoliciesCreated node has been set to true. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +**EnrollmentStatusTracking/Setup/Apps/PolicyProviders/*ProviderName*/TrackingPoliciesCreated** +Required. This node is supported in both user context and device context. +Indicates if the provider has created the required policies for the ESP to use for tracking app installation progress. The policy provider itself is expected to set the value of this node, not the MDM server. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +Value type is boolean. The expected values are as follows: +- true — Indicates that the provider has created the required policies. +- false — Indicates that the provider has not created the required policies. This is the default. + +**EnrollmentStatusTracking/Setup/Apps/Tracking** +Required. This node is supported in both user context and device context. +Root node for the app installations being tracked by the ESP. + +Scope is permanent. Supported operation is Get. + +**EnrollmentStatusTracking/Setup/Apps/Tracking/_ProviderName_** +Optional. This node is supported in both user context and device context. +Indicates the provider name responsible for installing the apps and providing status back to ESP. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +**EnrollmentStatusTracking/Setup/Apps/Tracking/*ProviderName*/_AppName_** +Optional. This node is supported in both user context and device context. +Represents a unique name for the app whose progress should be tracked by the ESP. The policy provider can define any arbitrary app name as ESP does not use the app name directly. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +**EnrollmentStatusTracking/Setup/Apps/Tracking/*ProviderName*/*AppName*/InstallationState** +Optional. This node is supported in both user context and device context. +Represents the installation state for the app. The policy providers (not the MDM server) must update this node for the ESP to track the installation progress and update the status message. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +Value type is integer. Expected values are as follows: +- 1 — NotInstalled +- 2 — InProgress +- 3 — Completed +- 4 — Error + +**EnrollmentStatusTracking/Setup/Apps/Tracking/*ProviderName*/*AppName*/RebootRequired** +Optional. This node is supported in both user context and device context. +Indicates if the app installation requires ESP to issue a reboot. The policy providers installing the app (not the MDM server) must set this node. If the policy providers do not set this node, the ESP will not reboot the device for the app installation. + +Scope is dynamic. Supported operations are Get, Add, Delete, and Replace. + +Value type is integer. Expected values are as follows: +- 1 — NotRequired +- 2 — SoftReboot +- 3 — HardReboot + +**EnrollmentStatusTracking/Setup/HasProvisioningCompleted** +Required. This node is supported in both user context and device context. +ESP sets this node when it completes. Providers can query this node to determine if the ESP is showing, which allows them to determine if they still need to provide status updates for the ESP through this CSP. + +Scope is permanent. Supported operation is Get. + +Value type is boolean. Expected values are as follows: +- true — Indicates that ESP has completed. This is the default. +- false — Indicates that ESP is displayed, and provisioning is still going. \ No newline at end of file diff --git a/windows/client-management/mdm/enterprise-app-management.md b/windows/client-management/mdm/enterprise-app-management.md index 755b31d58e..b809041a65 100644 --- a/windows/client-management/mdm/enterprise-app-management.md +++ b/windows/client-management/mdm/enterprise-app-management.md @@ -2,11 +2,13 @@ title: Enterprise app management description: This topic covers one of the key mobile device management (MDM) features in Windows 10 for managing the lifecycle of apps across all of Windows. ms.assetid: 225DEE61-C3E3-4F75-BC79-5068759DFE99 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/22/2017 --- @@ -49,7 +51,7 @@ Inventory is specific to the package full name and lists bundled packs and resou > **Note**  On Windows 10 Mobile, XAP packages have the product ID in place of both the package family name and package full name. -  + Here are the nodes for each package full name: - Name @@ -76,7 +78,7 @@ Note that performing a full inventory of a device can be resource intensive on t Here is an example of a query for all apps on the device. -``` syntax +```xml 1 @@ -90,7 +92,7 @@ Here is an example of a query for all apps on the device. Here is an example of a query for a specific app for a user. -``` syntax +```xml 1 @@ -119,7 +121,7 @@ For detailed descriptions of each node, see [EnterpriseModernAppManagement CSP]( Here is an example of a query for all app licenses on a device. -``` syntax +```xml 1 @@ -133,7 +135,7 @@ Here is an example of a query for all app licenses on a device. Here is an example of a query for all app licenses for a user. -``` syntax +```xml 1 @@ -159,7 +161,7 @@ For more information about the AllowAllTrustedApps policy, see [Policy CSP](poli Here are some examples. -``` syntax +```xml 1 @@ -197,7 +199,7 @@ For more information about the AllowDeveloperUnlock policy, see [Policy CSP](pol Here is an example. -``` syntax +```xml 1 @@ -242,7 +244,7 @@ Here are the requirements for this scenario: Here are some examples. -``` syntax +```xml 1 @@ -279,7 +281,7 @@ In the SyncML, you need to specify the following information in the Exec command Here is an example of an offline license installation. -``` syntax +```xml 1 @@ -301,19 +303,19 @@ If you purchased an app from the Store for Business and the app is specified for Here are the requirements for this scenario: -- The location of the app can be a local files system (C:\\StagedApps\\app1.appx), a UNC path (\\\\server\\share\\app1.apx), or an HTTPS location (https://contoso.com/app1.appx\_ -- The user must have permission to access the content location. For HTTPs, you can use server authentication or certificate authentication using a certificate associated with the enrollment. HTTP locations are supported, but not recommended because of lack of authentication requirements. -- The device does not need to have connectivity to the Microsoft Store, store services, or the have the Microsoft Store UI be enabled. -- The user must be logged in, but association with AAD identity is not required. +- The location of the app can be a local files system (C:\\StagedApps\\app1.appx), a UNC path (\\\\server\\share\\app1.apx), or an HTTPS location (https://contoso.com/app1.appx\_ +- The user must have permission to access the content location. For HTTPs, you can use server authentication or certificate authentication using a certificate associated with the enrollment. HTTP locations are supported, but not recommended because of lack of authentication requirements. +- The device does not need to have connectivity to the Microsoft Store, store services, or the have the Microsoft Store UI be enabled. +- The user must be logged in, but association with AAD identity is not required. > **Note**  You must unlock the device to deploy nonStore apps or you must deploy the app license before deploying the offline apps. For details, see [Deploy an offline license to a user](#deploy-an-offline-license-to-a-user). -  + The Add command for the package family name is required to ensure proper removal of the app at unenrollment. Here is an example of a line-of-business app installation. -``` syntax +```xml 0 @@ -340,7 +342,7 @@ Here is an example of a line-of-business app installation. Here is an example of an app installation with dependencies. -``` syntax +```xml 0 @@ -374,7 +376,7 @@ Here is an example of an app installation with dependencies. Here is an example of an app installation with dependencies and optional packages. -``` syntax +```xml 0 @@ -418,25 +420,25 @@ Provisioning allows you to stage the app to the device and all users of the devi Here are the requirements for this scenario: -- The location of the app can be the local files system (C:\\StagedApps\\app1.appx), a UNC path (\\\\server\\share\\app1.apx), or an HTTPS location (https://contoso.com/app1.appx\_ -- The user must have permission to access the content location. For HTTPs, you can use server authentication or certificate authentication using a certificate associated with the enrollment. HTTP locations are supported, but not recommended because of lack of authentication requirements. -- The device does not need to have connectivity to the Microsoft Store, or store services enabled. -- The device does not need any AAD identity or domain membership. -- For nonStore app, your device must be unlocked. -- For Store offline apps, the required licenses must be deployed prior to deploying the apps. +- The location of the app can be the local files system (C:\\StagedApps\\app1.appx), a UNC path (\\\\server\\share\\app1.apx), or an HTTPS location (https://contoso.com/app1.appx\_ +- The user must have permission to access the content location. For HTTPs, you can use server authentication or certificate authentication using a certificate associated with the enrollment. HTTP locations are supported, but not recommended because of lack of authentication requirements. +- The device does not need to have connectivity to the Microsoft Store, or store services enabled. +- The device does not need any AAD identity or domain membership. +- For nonStore app, your device must be unlocked. +- For Store offline apps, the required licenses must be deployed prior to deploying the apps. To provision app for all users of a device from a hosted location, the management server performs an Add and Exec command on the AppInstallation node in the device context. The Add command for the package family name is required to ensure proper removal of the app at unenrollment. > **Note**  When you remove the provisioned app, it will not remove it from the users that already installed the app. -  + Here is an example of app installation. > **Note**  This is only supported in Windows 10 for desktop editions. -``` syntax +```xml 0 @@ -473,7 +475,7 @@ Here is an example of app installation with dependencies. > **Note**  This is only supported in Windows 10 for desktop editions. -``` syntax +```xml 0 @@ -524,7 +526,7 @@ When an app is installed successfully, the node is cleaned up and no longer pres Here is an example of a query for a specific app installation. -``` syntax +```xml 2 @@ -538,7 +540,7 @@ Here is an example of a query for a specific app installation. Here is an example of a query for all app installations. -``` syntax +```xml 2 @@ -556,7 +558,7 @@ Application installations can take some time to complete, hence they are done as Here is an example of an alert. -``` syntax +```xml 4 1226 @@ -592,7 +594,7 @@ To uninstall an app, you delete it under the origin node, package family name, a Here is an example for uninstalling all versions of an app for a user. -``` syntax +```xml 1 @@ -606,7 +608,7 @@ Here is an example for uninstalling all versions of an app for a user. Here is an example for uninstalling a specific version of the app for a user. -``` syntax +```xml 1 @@ -624,12 +626,12 @@ You can remove provisioned apps from a device for a specific version or for all > **Note**  You can only remove an app that has an inventory value IsProvisioned = 1. -  + Removing provisioned app occurs in the device context. Here is an example for removing a provisioned app from a device. -``` syntax +```xml 1 @@ -643,7 +645,7 @@ Here is an example for removing a provisioned app from a device. Here is an example for removing a specific version of a provisioned app from a device: -``` syntax +```xml 1 @@ -661,7 +663,7 @@ You can remove app licenses from a device per app based on the content ID. Here is an example for removing an app license for a user. -``` syntax +```xml 1 @@ -675,7 +677,7 @@ Here is an example for removing an app license for a user. Here is an example for removing an app license for a provisioned package (device context). -``` syntax +```xml 1 @@ -695,7 +697,7 @@ For user-based uninstallation, use ./User in the LocURI, and for provisioning, u Here is an example. There is only one uninstall for hosted and store apps. -``` syntax +```xml 1226 @@ -721,7 +723,7 @@ To update an app from Microsoft Store, the device requires contact with the stor Here is an example of an update scan. -``` syntax +```xml 1 @@ -735,7 +737,7 @@ Here is an example of an update scan. Here is an example of a status check. -``` syntax +```xml 1 @@ -764,7 +766,7 @@ Turning off updates only applies to updates from the Microsoft Store at the devi Here is an example. -``` syntax +```xml 1 @@ -793,7 +795,7 @@ You can install app on non-system volumes, such as a secondary partition or remo Here is an example. -``` syntax +```xml 1 @@ -825,12 +827,12 @@ In Windows 10 Mobile IT administrators can set a policy to restrict user applic > **Note**  The feature is only for Windows 10 Mobile. -  + The RestrictAppDataToSystemVolume policy in [Policy CSP](policy-configuration-service-provider.md) enables you to restrict all user application data to stay on the system volume. When the policy is not configured or if it is disabled, and you move a package or when it is installed to a difference volume, then the user application data will moved to the same volume. You can set this policy to 0 (off, default) or 1. Here is an example. -``` syntax +```xml 1 @@ -871,7 +873,7 @@ The valid values are 0 (off, default value) and 1 (on). Here is an example. -``` syntax +```xml 1 @@ -897,7 +899,7 @@ Here is an example. ``` -  + diff --git a/windows/client-management/mdm/enterpriseapn-csp.md b/windows/client-management/mdm/enterpriseapn-csp.md index ecf0ae28ec..d2b3bddc1d 100644 --- a/windows/client-management/mdm/enterpriseapn-csp.md +++ b/windows/client-management/mdm/enterpriseapn-csp.md @@ -2,11 +2,13 @@ title: EnterpriseAPN CSP description: The EnterpriseAPN configuration service provider is used by the enterprise to provision an APN for the Internet. ms.assetid: E125F6A5-EE44-41B1-A8CC-DF295082E6B2 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/22/2017 --- @@ -15,7 +17,7 @@ ms.date: 09/22/2017 The EnterpriseAPN configuration service provider (CSP) is used by the enterprise to provision an APN for the Internet. > [!Note] -Starting in Windows 10, version 1703 the EnterpriseAPN CSP is supported in Windows 10 Home, Pro, Enterprise, and Education editions. +> Starting in Windows 10, version 1703 the EnterpriseAPN CSP is supported in Windows 10 Home, Pro, Enterprise, and Education editions. The following image shows the EnterpriseAPN configuration service provider in tree format. @@ -24,7 +26,7 @@ The following image shows the EnterpriseAPN configuration service provider in tr **EnterpriseAPN**

    The root node for the EnterpriseAPN configuration service provider.

    -**EnterpriseAPN/****_ConnectionName_** +**EnterpriseAPN/***ConnectionName*

    Name of the connection as seen by Windows Connection Manager.

    Supported operations are Add, Get, Delete, and Replace.

    @@ -50,7 +52,7 @@ The following image shows the EnterpriseAPN configuration service provider in tr

    Supported operations are Add, Get, Delete, and Replace.

    **EnterpriseAPN/*ConnectionName*/ClassId** -

    GUID that defines the APN class to the modem. This is the same as the OEMConnectionId in CM\_CellularEntries CSP. Normally this setting is not present. It is only required when IsAttachAPN is true and the attach APN is not only used as the Internet APN.

    +

    GUID that defines the APN class to the modem. This is the same as the OEMConnectionId in CM_CellularEntries CSP. Normally this setting is not present. It is only required when IsAttachAPN is true and the attach APN is not only used as the Internet APN.

    Supported operations are Add, Get, Delete, and Replace.

    @@ -130,7 +132,7 @@ The following image shows the EnterpriseAPN configuration service provider in tr ## Examples -``` syntax +```xml @@ -276,9 +278,9 @@ atomicZ [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/enterpriseapn-ddf.md b/windows/client-management/mdm/enterpriseapn-ddf.md index ebd171a390..319356f336 100644 --- a/windows/client-management/mdm/enterpriseapn-ddf.md +++ b/windows/client-management/mdm/enterpriseapn-ddf.md @@ -2,11 +2,13 @@ title: EnterpriseAPN DDF description: EnterpriseAPN DDF ms.assetid: A953ADEF-4523-425F-926C-48DA62EB9E21 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -20,13 +22,13 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The content below are the different versions of the DDF for this CSP. -- [EnterpriseAPN CSP version 1.0 DDF](#enterpriseapn-csp-version-1-0-ddf) -- [EnterpriseAPN CSP version 1.1 DDF](#enterpriseapn-csp-version-1-1-ddf) -- [EnterpriseAPN CSP version 1.2 DDF](#enterpriseapn-csp-version-1-2-ddf) +- [EnterpriseAPN CSP version 1.0 DDF](#enterpriseapn-csp-version-10-ddf) +- [EnterpriseAPN CSP version 1.1 DDF](#enterpriseapn-csp-version-11-ddf) +- [EnterpriseAPN CSP version 1.2 DDF](#enterpriseapn-csp-version-12-ddf) -### EnterpriseAPN CSP version 1.0 DDF +### EnterpriseAPN CSP version 1.0 DDF -``` syntax +```xml ``` -### EnterpriseAPN CSP version 1.1 DDF +### EnterpriseAPN CSP version 1.1 DDF -``` syntax +```xml ``` -### EnterpriseAPN CSP version 1.2 DDF +### EnterpriseAPN CSP version 1.2 DDF -``` syntax +```xml **Note**   The EnterpriseAppManagement CSP is only supported in Windows 10 Mobile. -  + The following diagram shows the EnterpriseAppManagement configuration service provider in tree format. @@ -55,7 +57,7 @@ Supported operations are Get and Add. > **Note**   Do NOT use Subject=CN%3DB1C43CD0-1624-5FBB-8E54-34CF17DFD3A1\\x00. The server must replace this value in the supplied client certificate. If your server returns a client certificate containing the same Subject value, this can cause unexpected behavior. The server should always override the subject value and not use the default device-provided Device ID Subject= Subject=CN%3DB1C43CD0-1624-5FBB-8E54-34CF17DFD3A1\\x00 -  + ***EnterpriseID*/Status** Required. The integer value that indicates the current status of the application enrollment. Valid values are 0 (ENABLED), 1 (INSTALL\_DISABLED), 2 (REVOKED), and 3 (INVALID). Scope is dynamic. @@ -77,7 +79,7 @@ Required. The root node for individual enterprise application inventory settings Supported operation is Get. -**/Inventory/****_ProductID_** +**/Inventory/***ProductID* Optional. A node that contains s single enterprise application product ID in GUID format. Scope is dynamic. Supported operation is Get. @@ -107,7 +109,7 @@ Required. This node groups application download-related parameters. The enterpri Supported operation is Get. -**/Download/****_ProductID_** +**/Download/***ProductID* Optional. This node contains the GUID for the installed enterprise application. Each installed application has a unique ID. Scope is dynamic. Supported operations are Get, Add, and Replace. @@ -166,12 +168,12 @@ Required. The integer value that indicates the status of the current download pr

    7:DOWNLOAD_FAILED

    -

    Unable to connect to server, file doesn't exist, etc.

    +

    Unable to connect to server, file doesn't exist, etc.

    -  + Scope is dynamic. Supported operations are Get, Add, and Replace. @@ -207,7 +209,7 @@ The Microsoft Store application has a GUID of d5dc1ebb-a7f1-df11-9264-00237de2db Use the following SyncML format to query to see if the application is installed on a managed device: -``` syntax +```xml 1 @@ -220,7 +222,7 @@ Use the following SyncML format to query to see if the application is installed Response from the device (it contains list of subnodes if this app is installed in the device). -``` syntax +```xml 3 1 @@ -264,7 +266,7 @@ The value actually applied to the device can be queried via the nodes under the Enroll enterprise ID “4000000001” for the first time: -``` syntax +```xml 2 @@ -291,7 +293,7 @@ Enroll enterprise ID “4000000001” for the first time: Update the enrollment token (for example, to update an expired application enrollment token): -``` syntax +```xml 2 @@ -308,7 +310,7 @@ Update the enrollment token (for example, to update an expired application enrol Query all installed applications that belong to enterprise id “4000000001”: -``` syntax +```xml 2 @@ -323,7 +325,7 @@ Query all installed applications that belong to enterprise id “4000000001”: Response from the device (that contains two installed applications): -``` syntax +```xml 3 1 @@ -436,13 +438,13 @@ Install or update the installed app with the product ID “{B316008A-141D-4A79-8 To perform an XAP update, create the Name, URL, Version, and DownloadInstall nodes first, then perform an “execute” on the “DownloadInstall” node (all within an “Atomic” operation). If the application does not exist, the application will be silently installed without any user interaction. If the application cannot be installed, the user will be notified with an Alert dialog. > **Note**   -1. If a previous app-update node existed for this product ID (the node can persist for up to 1 week or 7 days after an installation has completed), then a 418 (already exist) error would be returned on the “Add”. To get around the 418 error, the server should issue a Replace command for the Name, URL, and Version nodes, and then execute on the “DownloadInstall” (within an “Atomic” operation). +> 1. If a previous app-update node existed for this product ID (the node can persist for up to 1 week or 7 days after an installation has completed), then a 418 (already exist) error would be returned on the “Add”. To get around the 418 error, the server should issue a Replace command for the Name, URL, and Version nodes, and then execute on the “DownloadInstall” (within an “Atomic” operation). -2. The application product ID curly braces need to be escaped where { is %7B and } is %7D. +2. The application product ID curly braces need to be escaped where { is %7B and } is %7D. -  + -``` syntax +```xml 2 Large @@ -121,7 +123,7 @@ Folder example: ``` An application that belongs in the folder would add an optional attribute **ParentFolderId**, which maps to **folderId** of the folder. In this case, the location of this application will be located inside the folder. -``` syntax +```xml Medium @@ -250,7 +252,7 @@ For example, in place of SettingPageDisplay, you would use ms-settings:display. Here is an example for Windows 10, version 1703. -``` syntax +```xml @@ -266,7 +268,7 @@ Here is an example for Windows 10, version 1703. Starting in Windows 10, version 1511, you can specify the following quick action settings in the lockdown XML file. The following list shows the quick action settings and settings page dependencies (group and page). -> [!Note] +> [!NOTE] > Only Windows 10, versions 1511 and 1607, the dependent settings group and pages are automatically added when the quick action item is specified in the lockdown XML. In Windows 10, version 1703, Quick action settings no longer require any dependencies from related group or page.
      @@ -325,14 +327,14 @@ Starting in Windows 10, version 1703, Quick action settings no longer require an In this example, all settings pages and quick action settings are allowed. An empty \ node indicates that none of the settings are blocked. -``` syntax +```xml ``` In this example for Windows 10, version 1511, all System setting pages are enabled. Note that the System page group is added as well as all of the System subpage names. -``` syntax +```xml @@ -348,7 +350,7 @@ In this example for Windows 10, version 1511, all System setting pages are ena ``` Here is an example for Windows 10, version 1703. -``` syntax +```xml @@ -374,13 +376,13 @@ Buttons | The following list identifies the hardware buttons on the device that

    • Custom3

    -> [!Note] +> [!NOTE] > Lock down of the Start button only prevents the press and hold event. > > Custom buttons are hardware buttons that can be added to devices by OEMs. Buttons example: -``` syntax +```xml @@ -398,14 +400,14 @@ Buttons example: ``` The Search and custom buttons can be remapped or configured to open a specific application. Button remapping takes effect for the device and applies to all users. -> [!Note] +> [!NOTE] > The lockdown settings for a button, per user role, will apply regardless of the button mapping. > > Button remapping can enable a user to open an application that is not in the Allow list. Use button lock down to prevent application access for a user role. To remap a button in lockdown XML, you supply the button name, the button event (typically "press"), and the product ID for the application the button will open. -``` syntax +```xml "/> -        -  + + + "/> + + ``` @@ -1209,13 +1211,13 @@ The following example shows how to add a new policy. The following example shows how to specify the language to display on the device. -``` syntax +```xml -    -  -      + + -    + ``` @@ -1228,7 +1230,7 @@ These XML examples show how to perform various tasks using OMA DM. The following example shows how to lock down a device. -``` syntax +```xml @@ -1249,67 +1251,67 @@ The following example shows how to lock down a device. The following example shows how to change the accent color to one of the standard colors. -``` syntax +```xml -    -       -         1 -          -             -             ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeAccentColorID -             -             -               int -             -             -            7 -          -       -       -    + + + 1 + + + ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeAccentColorID + + + int + + + 7 + + + + ``` The following example shows how to change the theme. -``` syntax +```xml -    -       -           1 -           -               -                   ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeBackground -               -               -                   int -               -               -               1 -           -       -       -    + + + 1 + + + ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeBackground + + + int + + + 1 + + + + ``` The following example shows how to set a custom theme accent color for the enterprise environment. -``` syntax +```xml -    -      1 -       -          -             ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeAccentColorID -          -          -            int -          -          -         151 -       -    + + 1 + + + ./Vendor/MSFT/EnterpriseAssignedAccess/Theme/ThemeAccentColorID + + + int + + + 151 + + 2 @@ -1331,55 +1333,55 @@ The following example shows how to set a custom theme accent color for the enter Use the examples in this section to set a new lock screen and manage the lock screen features. If using a UNC path, format the LocURI as \\\\host\\share\\image.jpg. -``` syntax +```xml -  2 -  -    -      ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName -    -      chr -      text/plain -    -    c:\windows\system32\lockscreen\480x800\Wallpaper_015.jpg -    -  + 2 + + + ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName + + chr + text/plain + + c:\windows\system32\lockscreen\480x800\Wallpaper_015.jpg + + ``` The following example shows how to query the device for the file being used as the lock screen. -``` syntax +```xml -  2 -  -    -      ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName -    -  + 2 + + + ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName + + ``` The following example shows how to change the existing lock screen image to one of your choosing. -``` syntax +```xml -    -       -         2 -          -             -               ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName -             -             -               chr -               text/plain -             -            c:\windows\system32\lockscreen\480x800\Wallpaper_015.jpg -          -       -       -    + + + 2 + + + ./Vendor/MSFT/EnterpriseAssignedAccess/LockScreenWallpaper/BGFileName + + + chr + text/plain + + c:\windows\system32\lockscreen\480x800\Wallpaper_015.jpg + + + + ``` @@ -1387,45 +1389,45 @@ The following example shows how to change the existing lock screen image to one The following example shows how to set the time zone to UTC-07 Mountain Time (US & Canada). -``` syntax +```xml -    -       -         2 -          -             -               ./Vendor/MSFT/EnterpriseAssignedAccess/Clock/TimeZone -             -             -               int -             -            500 -          -       -       -    + + + 2 + + + ./Vendor/MSFT/EnterpriseAssignedAccess/Clock/TimeZone + + + int + + 500 + + + + ``` The following example shows how to set the time zone to Pacific Standard Time (UTC-08:00) without observing daylight savings time (UTC+01:00). -``` syntax +```xml -    -       -         2 -          -             -               ./Vendor/MSFT/EnterpriseAssignedAccess/Clock/TimeZone -             -             -               int -             -            400  -          -       -       -    + + + 2 + + + ./Vendor/MSFT/EnterpriseAssignedAccess/Clock/TimeZone + + + int + + 400  + + + + ``` @@ -1433,23 +1435,23 @@ The following example shows how to set the time zone to Pacific Standard Time (U The following example shows how to set the language. -``` syntax +```xml -    -       -         1 -          -             -               ./Vendor/MSFT/EnterpriseAssignedAccess/Locale/Language -             -             -               int -             -            1033 -          -       -       -    + + + 1 + + + ./Vendor/MSFT/EnterpriseAssignedAccess/Locale/Language + + + int + + 1033 + + + + ``` @@ -1663,16 +1665,4 @@ The following table lists the product ID and AUMID for each app that is included Microsoft.XboxApp_8wekyb3d8bbwe!Microsoft.XboxApp - - -  - -  - -  - - - - - - + \ No newline at end of file diff --git a/windows/client-management/mdm/enterpriseassignedaccess-ddf.md b/windows/client-management/mdm/enterpriseassignedaccess-ddf.md index 890112e13c..e5392fcc55 100644 --- a/windows/client-management/mdm/enterpriseassignedaccess-ddf.md +++ b/windows/client-management/mdm/enterpriseassignedaccess-ddf.md @@ -2,11 +2,13 @@ title: EnterpriseAssignedAccess DDF description: EnterpriseAssignedAccess DDF ms.assetid: 8BD6FB05-E643-4695-99A2-633995884B37 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -17,7 +19,7 @@ This topic shows the OMA DM device description framework (DDF) for the **Enterpr Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -``` syntax +```xml block of the AssignedAccessXML node. -``` syntax +```xml @@ -224,7 +225,7 @@ Here's an example for uninstalling an app: ``` -**.../*PackageFamilyName*/****_PackageFullName_** +**.../*PackageFamilyName*/***PackageFullName* Optional. Full name of the package installed. Supported operations are Get and Delete. @@ -232,7 +233,7 @@ Supported operations are Get and Delete. > [!Note] > XAP files use a product ID in place of PackageFullName. Here's an example of XAP product ID (including the braces), {12345678-9012-3456-7890-123456789012}. -  + **.../*PackageFamilyName*/*PackageFullName*/Name** Required. Name of the app. Value type is string. @@ -261,7 +262,7 @@ Required. Install location of the app on the device. Value type is string. > [!Note] > Not applicable to XAP files. -  + Supported operation is Get. **.../*PackageFamilyName*/*PackageFullName*/IsFramework** @@ -270,7 +271,7 @@ Required. Whether or not the app is a framework package. Value type is int. The > [!Note] > Not applicable to XAP files. - Supported operation is Get. + Supported operation is Get. **.../*PackageFamilyName*/*PackageFullName*/IsBundle** Required. The value is 1 if the package is an app bundle and 0 (zero) for all other cases. Value type is int. @@ -287,7 +288,7 @@ Required. Resource ID of the app. This is null for the main app, ~ for a bundle, > [!Note] > Not applicable to XAP files. -  + Supported operation is Get. **.../*PackageFamilyName*/*PackageFullName*/PackageStatus** @@ -309,7 +310,7 @@ Required. Specifies whether the package state has changed and requires a reinsta > [!Note] > Not applicable to XAP files. -  + Supported operation is Get. **.../*PackageFamilyName*/*PackageFullName*/Users** @@ -327,16 +328,23 @@ Required. The value is 0 or 1 that indicates if the app is provisioned on the de Supported operation is Get. +**.../*PackageFamilyName*/*PackageFullName*/IsStub** +Required. This node is used to identify whether the package is a stub package. A stub package is a version of the package with minimal functionality that will reduce the size of the app. + +The value is 1 if the package is a stub package and 0 (zero) for all other cases. Value type is int. + +Supported operation is Get. + **.../*PackageFamilyName*/DoNotUpdate** Required. Specifies whether you want to block a specific app from being updated via auto-updates. Supported operations are Add, Get, Delete, and Replace. **.../*PackageFamilyName*/AppSettingPolicy** (only for ./User/Vendor/MSFT) -Added in Windows 10, version 1511. Interior node for all managed app setting values. This node is only supported in the user context. +Added in Windows 10, version 1511. Interior node for all managed app setting values. This node is only supported in the user context. -**.../*PackageFamilyName*/AppSettingPolicy/****_SettingValue_** (only for ./User/Vendor/MSFT) -Added in Windows 10, version 1511. The *SettingValue* and data represent a key value pair to be configured for the app. The node represents the name of the key and the data represents the value. You can find this value in LocalSettings in the Managed.App.Settings container. +**.../*PackageFamilyName*/AppSettingPolicy/***SettingValue* (only for ./User/Vendor/MSFT) +Added in Windows 10, version 1511. The *SettingValue* and data represent a key value pair to be configured for the app. The node represents the name of the key and the data represents the value. You can find this value in LocalSettings in the Managed.App.Settings container. This setting only works for apps that support the feature and it is only supported in the user context. @@ -344,7 +352,7 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete. The following example sets the value for the 'Server' -``` syntax +```xml 0 @@ -362,7 +370,7 @@ The following example sets the value for the 'Server' The following example gets all managed app settings for a specific app. -``` syntax +```xml 0 @@ -398,8 +406,8 @@ NonRemovable requires admin permission. This can only be set per device, not per Value type is integer. Supported operations are Add, Get, and Replace. Valid values: -- 0 – app is not in the nonremovable app policy list -- 1 – app is included in the nonremovable app policy list +- 0 – app is not in the nonremovable app policy list +- 1 – app is included in the nonremovable app policy list **Examples:** @@ -467,7 +475,7 @@ Data 1 = app is in the app policy list **AppInstallation** Required node. Used to perform app installation. -**AppInstallation/****_PackageFamilyName_** +**AppInstallation/***PackageFamilyName* Optional node. Package family name (PFN) of the app. There is one for each PFN on the device when reporting inventory. These items are rooted under their signing origin. Supported operations are Get and Add. @@ -475,7 +483,7 @@ Supported operations are Get and Add. > [!Note] > XAP files use a product ID in place of PackageFamilyName. Here's an example of XAP product ID (including the braces), {12345678-9012-3456-7890-123456789012}. -  + **AppInstallation/*PackageFamilyName*/StoreInstall** Required. Command to perform an install of an app and a license from the Microsoft Store. @@ -484,6 +492,18 @@ Supported operation is Execute, Add, Delete, and Get. **AppInstallation/*PackageFamilyName*/HostedInstall** Required. Command to perform an install of an app package from a hosted location (this can be a local drive, a UNC, or https data source). +The following list shows the supported deployment options: +- ForceApplicationShutdown +- DevelopmentMode  +- InstallAllResources +- ForceTargetApplicationShutdown  +- ForceUpdateToAnyVersion +- DeferRegistration="1". If the app is in use at the time of installation. This stages the files for an app update and completes the registration of the app update after the app closes. Available in the latest insider flight of 20H1. +- StageOnly="1". Stages the files for an app installation or update without installing the app. Available in 1803. +- LicenseUri="\\server\license.lic". Deploys an offline license from the Microsoft Store for Business. Available in 1607. +- ValidateDependencies="1". This is used at provisioning/staging time. If it is set to 1, deployment will perform the same dependency validation during staging that we would normally do at registration time, failing and rejecting the provision request if the dependencies are not present. Available in the latest insider flight of 20H1. +- ExcludeAppFromLayoutModification="1". Sets that the app will be provisioned on all devices and will be able to retain the apps provisioned without pinning them to start layout. Available in 1809. + Supported operation is Execute, Add, Delete, and Get. **AppInstallation/*PackageFamilyName*/LastError** @@ -494,9 +514,9 @@ Supported operation is Get. > [!Note] > This element is not present after the app is installed. -  -**AppInstallation/*PackageFamilyName*/LastErrorDescription** + +**AppInstallation/*PackageFamilyName*/LastErrorDesc** Required. Description of last error relating to the app installation. Supported operation is Get. @@ -504,7 +524,7 @@ Supported operation is Get. > [!Note] > This element is not present after the app is installed. -  + **AppInstallation/*PackageFamilyName*/Status** Required. Status of app installation. The following values are returned: @@ -518,7 +538,7 @@ Supported operation is Get. > [!Note] > This element is not present after the app is installed. -  + **AppInstallation/*PackageFamilyName*/ProgessStatus** Required. An integer the indicates the progress of the app installation. For https locations, this indicates the download progress. ProgressStatus is not available for provisioning and it is only for user-based installations. In provisioning, the value is always 0 (zero). @@ -527,31 +547,31 @@ Supported operation is Get. > [!Note] > This element is not present after the app is installed. -  + **AppLicenses** Required node. Used to manage licenses for app scenarios. **AppLicenses/StoreLicenses** Required node. Used to manage licenses for store apps. -**AppLicenses/StoreLicenses/****_LicenseID_** +**AppLicenses/StoreLicenses/***LicenseID* Optional node. License ID for a store installed app. The license ID is generally the PFN of the app. Supported operations are Add, Get, and Delete. **AppLicenses/StoreLicenses/*LicenseID*/LicenseCategory** -Added in Windows 10, version 1511. Required. Category of license that is used to classify various license sources. Valid value: +Added in Windows 10, version 1511. Required. Category of license that is used to classify various license sources. Valid value: - Unknown - unknown license category - Retail - license sold through retail channels, typically from the Microsoft Store - Enterprise - license sold through the enterprise sales channel, typically from the Store for Business - OEM - license issued to an OEM -- Developer - developer license, typically installed during the app development or side-loading scernarios. +- Developer - developer license, typically installed during the app development or side-loading scenarios. Supported operation is Get. **AppLicenses/StoreLicenses/*LicenseID*/LicenseUsage** -Added in Windows 10, version 1511. Required. Indicates the allowed usage for the license. Valid values: +Added in Windows 10, version 1511. Required. Indicates the allowed usage for the license. Valid values: - Unknown - usage is unknown - Online - the license is only valid for online usage. This is for applications with concurrence requirements, such as an app used on several computers, but can only be used on one at any given time. @@ -561,7 +581,7 @@ Added in Windows 10, version 1511. Required. Indicates the allowed usage for t Supported operation is Get. **AppLicenses/StoreLicenses/*LicenseID*/RequesterID** -Added in Windows 10, version 1511. Required. Identifier for the entity that requested the license, such as the client who acquired the license. For example, all licenses issued by the Store for Business for a particular enterprise client has the same RequesterID. +Added in Windows 10, version 1511. Required. Identifier for the entity that requested the license, such as the client who acquired the license. For example, all licenses issued by the Store for Business for a particular enterprise client has the same RequesterID. Supported operation is Get. @@ -571,7 +591,7 @@ Required. Command to add license. Supported operation is Execute. **AppLicenses/StoreLicenses/*LicenseID*/GetLicenseFromStore** -Added in Windows 10, version 1511. Required. Command to get license from the store. +Added in Windows 10, version 1511. Required. Command to get license from the store. Supported operation is Execute. @@ -582,7 +602,7 @@ For examples of how to use this CSP to for reporting apps inventory, installatio Query the device for a specific app subcategory, such as nonStore apps. -``` syntax +```xml 1 @@ -597,8 +617,7 @@ The result contains a list of apps, such as \App1/App2/App\. Subsequent query for a specific app for its properties. -``` syntax - +```xml 1 @@ -621,9 +640,9 @@ Subsequent query for a specific app for its properties. [Configuration service provider reference](configuration-service-provider-reference.md) -  - -  + + + diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index 10a37ce63c..c9d550f250 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -2,26 +2,28 @@ title: EnterpriseModernAppManagement DDF description: EnterpriseModernAppManagement DDF ms.assetid: -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/27/2018 +author: manikadhiman +ms.date: 10/01/2019 --- # EnterpriseModernAppManagement DDF > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. This topic shows the OMA DM device description framework (DDF) for the **EnterpriseModernAppManagement** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1809. +The XML below is the current version for this CSP. -``` syntax +```xml + + IsStub + + + + + + + + + + + + + + + text/plain + + + DoNotUpdate @@ -520,6 +542,7 @@ The XML below is for Windows 10, version 1809. + @@ -541,6 +564,7 @@ The XML below is for Windows 10, version 1809. + @@ -1103,4 +1127,4 @@ The XML below is for Windows 10, version 1809. -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md b/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md index 3c81c009ea..99150bef80 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-xsd.md @@ -2,11 +2,13 @@ title: EnterpriseModernAppManagement XSD description: Here is the XSD for the application parameters. ms.assetid: D393D094-25E5-4E66-A60F-B59CC312BF57 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -15,7 +17,7 @@ ms.date: 06/26/2017 Here is the XSD for the application parameters. -``` syntax +```xml diff --git a/windows/client-management/mdm/esim-enterprise-management.md b/windows/client-management/mdm/esim-enterprise-management.md new file mode 100644 index 0000000000..386f5a8c48 --- /dev/null +++ b/windows/client-management/mdm/esim-enterprise-management.md @@ -0,0 +1,26 @@ +--- +title: eSIM Enterprise Management +description: Managing eSIM devices in an enterprise +keywords: eSIM enterprise management +ms.prod: w10 +ms.mktglfcycl: +ms.sitesec: library +author: dansimp +ms.localizationpriority: medium +ms.author: dansimp +ms.topic: +--- + +# How Mobile Device Management Providers support eSIM Management on Windows +The eSIM Profile Management Solution puts the Mobile Device Management (MDM) Provider in the front and center. The whole idea is to leverage an already existing solution that customers are familiar with and that they use to manage devices. The expectations from an MDM are that it will leverage the same sync mechanism that it uses for device policies to push any policy to the eSIM profile, and be able to use Groups and Users the same way. This way, the eSIM profile download and installation happens on the background and not impacting the end user. Similarly, the IT admin would use the same method of managing the eSIM profiles (Assignment/de-assignment, etc.) the same way as they currently do device management. + If you are a Mobile Device Management (MDM) Provider and would like to support eSIM Management on Windows, you should do the following: +- Onboard to Azure Active Directory +- Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, please contact them and learn more about their onboarding. If you would like to support multiple mobile operators, [orchestrator providers]( https://www.idemia.com/esim-management-facilitation) are there to act as a proxy that will handle MDM onboarding as well as mobile operator onboarding. Their main [role]( https://www.idemia.com/smart-connect-hub) is to enable the process to be as painless but scalable to all parties. +- Assess solution type that you would like to provide your customers +- Batch/offline solution +- IT Admin can manually import a flat file containing list of eSIM activation codes, and provision eSIM on LTE enabled devices. +- Operator does not have visibility over status of the eSIM profiles and device eSIM has been downloaded and installed to +- Real-time solution +- MDM automatically syncs with the Operator backend system for subscription pool and eSIM management, via sim vendor solution component. IT Admin can view subscription pool and provision eSIM in real time. +- Operator is notified of the status of each eSIM profile and has visibility on which devices are being used +**Note:** The solution type is not noticeable to the end-user. The choice between the two is made between the MDM and the Mobile Operator. diff --git a/windows/client-management/mdm/euiccs-csp.md b/windows/client-management/mdm/euiccs-csp.md index 8e493b7fa5..43626310a0 100644 --- a/windows/client-management/mdm/euiccs-csp.md +++ b/windows/client-management/mdm/euiccs-csp.md @@ -1,12 +1,14 @@ --- title: eUICCs CSP description: eUICCs CSP -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 03/02/2018 +ms.reviewer: +manager: dansimp --- # eUICCs CSP @@ -89,4 +91,4 @@ Supported operation is Execute. Value type is string. **_eUICC_/Actions/Status** Required. Status of most recent operation, as an HRESULT. S_OK indicates success, S_FALSE indicates operation is in progress, other values represent specific errors. -Supported value is Get. Value type is integer. Default is 0. \ No newline at end of file +Supported value is Get. Value type is integer. Default is 0. diff --git a/windows/client-management/mdm/euiccs-ddf-file.md b/windows/client-management/mdm/euiccs-ddf-file.md index 6649a7a42d..3f3e71df8d 100644 --- a/windows/client-management/mdm/euiccs-ddf-file.md +++ b/windows/client-management/mdm/euiccs-ddf-file.md @@ -2,11 +2,13 @@ title: eUICCs DDF file description: eUICCs DDF file ms.assetid: c4cd4816-ad8f-45b2-9b81-8abb18254096 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 03/02/2018 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below if for Windows 10, version 1803. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/federated-authentication-device-enrollment.md b/windows/client-management/mdm/federated-authentication-device-enrollment.md index 22ee108fb4..12af80dacf 100644 --- a/windows/client-management/mdm/federated-authentication-device-enrollment.md +++ b/windows/client-management/mdm/federated-authentication-device-enrollment.md @@ -2,11 +2,13 @@ title: Federated authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using federated authentication policy. ms.assetid: 049ECA6E-1AF5-4CB2-8F1C-A5F22D722DAA -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 07/28/2017 --- @@ -35,7 +37,7 @@ The discovery web service provides the configuration information necessary for a > **Note**  The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. -  + The automatic discovery flow of the device uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc @@ -90,7 +92,7 @@ https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc The following example shows the discovery service request. -``` syntax +```xml @@ -131,7 +133,7 @@ The discovery response is in the XML format and includes the following fields: > **Note**  The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. -  + When authentication policy is set to be Federated, Web Authentication Broker (WAB) will be leveraged by the enrollment client to get a security token. The WAB start page URL is provided by the discovery service in the response message. The enrollment client will call the WAB API within the response message to start the WAB process. WAB pages are server hosted web pages. The server should build those pages to fit the device screen nicely and be as consistent as possible to other builds in the MDM enrollment UI. The opaque security token that is returned from WAB as an endpage will be used by the enrollment client as the device security secret during the client certificate enrollment request call. @@ -140,13 +142,13 @@ When authentication policy is set to be Federated, Web Authentication Broker (WA > - Append the OS version as a parameter in the AuthenticationServiceURL. > - Parse out the OS version from the AuthenticiationServiceURL when the OS sends the response for authentication. -  + A new XML tag, AuthenticationServiceUrl, is introduced in the DiscoveryResponse XML to allow the server to specify the WAB page start URL. For Federated authentication, this XML tag must exist. > **Note**  The enrollment client is agnostic with regards to the protocol flows for authenticating and returning the security token. While the server might prompt for user credentials directly or enter into a federation protocol with another server and directory service, the enrollment client is agnostic to all of this. To remain agnostic, all protocol flows pertaining to authentication that involve the enrollment client are passive, that is, browser-implemented. -  + The following are the explicit requirements for the server. @@ -160,11 +162,14 @@ The enrollment client issues an HTTPS request as follows: AuthenticationServiceUrl?appru=&login_hint= ``` -- <appid> is of the form ms-app://string -- <User Principal Name> is the name of the enrolling user, for example, user@constoso.com as input by the user in an enrollment sign in page. The value of this attribute serves as a hint that can be used by the authentication server as part of the authentication. +- <appid> is of the form ms-app://string +- <User Principal Name> is the name of the enrolling user, for example, user@constoso.com as input by the user in an enrollment sign in page. The value of this attribute serves as a hint that can be used by the authentication server as part of the authentication. After authentication is complete, the auth server should return an HTML form document with a POST method action of appid identified in the query string parameter. +> [!NOTE] +> To make an application compatible with strict Content Security Policy, it is usually necessary to make some changes to HTML templates and client-side code, add the policy header, and test that everything works properly once the policy is deployed. + ``` HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 @@ -196,7 +201,7 @@ The server has to send a POST to a redirect URL of the form ms-app://string (the The following example shows a response received from the discovery web service which requires authentication via WAB. -``` syntax +```xml @@ -250,7 +255,7 @@ wsse:BinarySecurityToken/attributes/EncodingType: The <wsse:BinarySecurityTok The following is an enrollment policy request example with a received security token as client credential. -``` syntax +```xml **Note**  The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. -  + The following snippet shows the policy web service response. -``` syntax +```xml **Note**  The policy service and the enrollment service must be on the same server; that is, they must have the same host name. -  + The following example shows the enrollment web service request for federated authentication. -``` syntax +```xml **Note**  The HTTP server response must not set Transfer-Encoding to Chunked; it must be sent as one message. -  + Similar to the TokenType in the RST, the RSTR will use a custom ValueType in the BinarySecurityToken (http://schemas.microsoft.com/ConfigurationManager/Enrollment/DeviceEnrollmentProvisionDoc), because the token is more than an X.509 v3 certificate. @@ -503,7 +508,7 @@ Here is a sample RSTR message and a sample of OMA client provisioning XML within The following example shows the enrollment web service response. -``` syntax +```xml @@ -553,7 +558,7 @@ The following code shows sample provisioning XML (presented in the preceding pac - + @@ -562,7 +567,7 @@ The following code shows sample provisioning XML (presented in the preceding pac - + @@ -636,7 +641,7 @@ The following code shows sample provisioning XML (presented in the preceding pac - Also important is SSLCLIENTCERTSEARCHCRITERIA, which is used for selecting the certificate to be used for client authentication. The search is based on the subject attribute of the signed user certificate. - CertificateStore/WSTEP enables certificate renewal. If the server does not support it, do not set it. -  + diff --git a/windows/client-management/mdm/filesystem-csp.md b/windows/client-management/mdm/filesystem-csp.md index 5e2ce038a2..653b03b527 100644 --- a/windows/client-management/mdm/filesystem-csp.md +++ b/windows/client-management/mdm/filesystem-csp.md @@ -2,11 +2,13 @@ title: FileSystem CSP description: FileSystem CSP ms.assetid: 9117ee16-ca7a-4efa-9270-c9ac8547e541 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -16,12 +18,12 @@ ms.date: 06/26/2017 The FileSystem configuration service provider is used to query, add, modify, and delete files, file directories, and file attributes on the mobile device. It can retrieve information about or manage files in ROM, files in persistent store and files on any removable storage card that is present in the device. It works for files that are hidden from the user as well as those that are visible to the user. > **Note**  FileSystem CSP is only supported in Windows 10 Mobile. - -  - +> +> +> > **Note**   This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_CSP\_OEM capabilities to be accessed from a network configuration application. -  + The following diagram shows the FileSystem configuration service provider management object in tree format as used by OMA DM. The OMA Client Provisioning protocol is not supported by this configuration service provider. @@ -101,9 +103,9 @@ The following properties are supported for files: [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md index f64d0cdc9d..b8f27a73dc 100644 --- a/windows/client-management/mdm/firewall-csp.md +++ b/windows/client-management/mdm/firewall-csp.md @@ -1,12 +1,14 @@ --- title: Firewall CSP description: Firewall CSP -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 01/26/2018 +ms.reviewer: +manager: dansimp --- # Firewall CSP @@ -38,11 +40,11 @@ The following diagram shows the Firewall configuration service provider in tree

    Value type in integer. Supported operation is Get.

    **MdmStore/Global/CurrentProfiles** -

    Integer value that contains a bitmask of the current enforced profiles that are maintained by the server firewall host. See [FW_PROFILE_TYPE](https://msdn.microsoft.com/library/cc231559.aspx) for the bitmasks that are used to identify profile types. This value is available only in the dynamic store; therefore, it is not merged and has no merge law.

    +

    Integer value that contains a bitmask of the current enforced profiles that are maintained by the server firewall host. See FW_PROFILE_TYPE for the bitmasks that are used to identify profile types. This value is available only in the dynamic store; therefore, it is not merged and has no merge law.

    Value type in integer. Supported operation is Get.

    **MdmStore/Global/DisableStatefulFtp** -

    Boolean value. If false, the firewall performs stateful File Transfer Protocol (FTP) filtering to allow secondary connections. True means stateful FTP is disabled. The merge law for this option is to let "true" values win.

    +

    Boolean value. If false, the firewall performs stateful File Transfer Protocol (FTP) filtering to allow secondary connections. True means stateful FTP is disabled. The merge law for this option is to let "true" values win.

    Default value is false.

    Data type is bool. Supported operations are Add, Get, Replace, and Delete.

    @@ -52,12 +54,12 @@ The following diagram shows the Firewall configuration service provider in tree

    Value type is integer. Supported operations are Add, Get, Replace, and Delete.

    **MdmStore/Global/PresharedKeyEncoding** -

    Specifies the preshared key encoding that is used. The value is integer and MUST be a valid value from the [PRESHARED_KEY_ENCODING_VALUES enumeration](https://msdn.microsoft.com/library/cc231525.aspx). The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.

    +

    Specifies the preshared key encoding that is used. The value is integer and MUST be a valid value from the PRESHARED_KEY_ENCODING_VALUES enumeration. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.

    Default value is 1.

    Value type is integer. Supported operations are Add, Get, Replace, and Delete.

    **MdmStore/Global/IPsecExempt** -

    This value configures IPsec exceptions. The value is integer and MUST be a combination of the valid flags that are defined in [IPSEC_EXEMPT_VALUES](https://msdn.microsoft.com/library/cc231523.aspx); therefore, the maximum value MUST always be IPSEC_EXEMPT_MAX-1 for servers supporting a schema version of 0x0201 and IPSEC_EXEMPT_MAX_V2_0-1 for servers supporting a schema version of 0x0200. If the maximum value is exceeded when the method RRPC_FWSetGlobalConfig (Opnum 4) is called, the method returns ERROR_INVALID_PARAMETER. This error code is returned if no other preceding error is discovered. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.

    +

    This value configures IPsec exceptions. The value is integer and MUST be a combination of the valid flags that are defined in IPSEC_EXEMPT_VALUES; therefore, the maximum value MUST always be IPSEC_EXEMPT_MAX-1 for servers supporting a schema version of 0x0201 and IPSEC_EXEMPT_MAX_V2_0-1 for servers supporting a schema version of 0x0200. If the maximum value is exceeded when the method RRPC_FWSetGlobalConfig (Opnum 4) is called, the method returns ERROR_INVALID_PARAMETER. This error code is returned if no other preceding error is discovered. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.

    Default value is 0.

    Value type is integer. Supported operations are Add, Get, Replace, and Delete.

    @@ -76,7 +78,7 @@ The following diagram shows the Firewall configuration service provider in tree

    Value type is string. Supported operation is Get.

    **MdmStore/Global/BinaryVersionSupported** -

    This value contains the binary version of the structures and data types that are supported by the server. This value is not merged. In addition, this value is always a fixed value for a specific firewall and advanced security component's software build. This value identifies a policy configuration option that is supported only on servers that have a schema version of 0x0201.

    +

    This value contains the binary version of the structures and data types that are supported by the server. This value is not merged. In addition, this value is always a fixed value for a specific firewall and advanced security component's software build. This value identifies a policy configuration option that is supported only on servers that have a schema version of 0x0201.

    Value type is string. Supported operation is Get.

    **MdmStore/Global/OpportunisticallyMatchAuthSetPerKM** @@ -115,7 +117,7 @@ The following diagram shows the Firewall configuration service provider in tree

    Value type is bool. Supported operations are Add, Get and Replace.

    **/Shielded** -

    Boolean value. If this value is true and EnableFirewall is on, the server MUST block all incoming traffic regardless of other policy settings. The merge law for this option is to let "true" values win.

    +

    Boolean value. If this value is true and EnableFirewall is on, the server MUST block all incoming traffic regardless of other policy settings. The merge law for this option is to let "true" values win.

    Default value is false.

    Value type is bool. Supported operations are Get and Replace.

    @@ -160,7 +162,7 @@ The following diagram shows the Firewall configuration service provider in tree Sample syncxml to provision the firewall settings to evaluate -``` syntax +```xml @@ -192,12 +194,12 @@ Sample syncxml to provision the firewall settings to evaluate

    Value type is integer. Supported operations are Add, Get and Replace.

    **/DisableStealthModeIpsecSecuredPacketExemption** -

    Boolean value. This option is ignored if DisableStealthMode is true. Otherwise, when this option is true, the firewall's stealth mode rules MUST NOT prevent the host computer from responding to unsolicited network traffic if that traffic is secured by IPsec. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used. For schema versions 0x0200, 0x0201, and 0x020A, this value is invalid and MUST NOT be used.

    +

    Boolean value. This option is ignored if DisableStealthMode is true. Otherwise, when this option is true, the firewall's stealth mode rules MUST NOT prevent the host computer from responding to unsolicited network traffic if that traffic is secured by IPsec. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used. For schema versions 0x0200, 0x0201, and 0x020A, this value is invalid and MUST NOT be used.

    Default value is true.

    Value type is bool. Supported operations are Add, Get and Replace.

    **FirewallRules** -

    A list of rules controlling traffic through the Windows Firewall. Each Rule ID is OR'ed. Within each rule ID each Filter type is AND'ed.

    +

    A list of rules controlling traffic through the Windows Firewall. Each Rule ID is OR'ed. Within each rule ID each Filter type is AND'ed.

    **FirewallRules/_FirewallRuleName_**

    Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/).

    @@ -245,39 +247,39 @@ Sample syncxml to provision the firewall settings to evaluate

    If not specified, the default is All.

    Value type is string. Supported operations are Add, Get, Replace, and Delete.

    -**FirewallRules/_FirewallRuleName_/LocalAddressRanges** -

    Comma separated list of local addresses covered by the rule. The default value is "\*". Valid tokens include:

    +**FirewallRules/*FirewallRuleName*/LocalAddressRanges** +

    Comma separated list of local addresses covered by the rule. The default value is "". Valid tokens include:

      -
    • "\*" indicates any local address. If present, this must be the only token included.
      • +
    • "" indicates any local address. If present, this must be the only token included.
    • A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.
    • A valid IPv6 address.
      • -
    • An IPv4 address range in the format of "start address - end address" with no spaces included.
      • -
    • An IPv6 address range in the format of "start address - end address" with no spaces included.
      • +
    • An IPv4 address range in the format of "start address - end address" with no spaces included.
      • +
    • An IPv6 address range in the format of "start address - end address" with no spaces included.

    If not specified, the default is All.

    Value type is string. Supported operations are Add, Get, Replace, and Delete.

    -**FirewallRules/_FirewallRuleName_/RemoteAddressRanges** -

    List of comma separated tokens specifying the remote addresses covered by the rule. The default value is "\*". Valid tokens include:

    +**FirewallRules/*FirewallRuleName*/RemoteAddressRanges** +

    List of comma separated tokens specifying the remote addresses covered by the rule. The default value is "". Valid tokens include:

      -
    • "\*" indicates any remote address. If present, this must be the only token included.
      • -
    • "Defaultgateway"
      • -
    • "DHCP"
      • -
    • "DNS"
      • -
    • "WINS"
      • -
    • "Intranet"
      • -
    • "RmtIntranet"
      • -
    • "Internet"
      • -
    • "Ply2Renders"
      • -
    • "LocalSubnet" indicates any local address on the local subnet. This token is not case-sensitive.
      • +
    • "" indicates any remote address. If present, this must be the only token included.
      • +
    • "Defaultgateway"
      • +
    • "DHCP"
      • +
    • "DNS"
      • +
    • "WINS"
      • +
    • "Intranet"
      • +
    • "RmtIntranet"
      • +
    • "Internet"
      • +
    • "Ply2Renders"
      • +
    • "LocalSubnet" indicates any local address on the local subnet. This token is not case-sensitive.
    • A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255.
    • A valid IPv6 address.
      • -
    • An IPv4 address range in the format of "start address - end address" with no spaces included.
      • -
    • An IPv6 address range in the format of "start address - end address" with no spaces included.
      • +
    • An IPv4 address range in the format of "start address - end address" with no spaces included.
      • +
    • An IPv6 address range in the format of "start address - end address" with no spaces included.

    If not specified, the default is All.

    Value type is string. Supported operations are Add, Get, Replace, and Delete.

    -

    The tokens "Intranet", "RmtIntranet", "Internet" and "Ply2Renders" are supported on Windows 10, version 1809, and later.

    +

    The tokens "Intranet", "RmtIntranet", "Internet" and "Ply2Renders" are supported on Windows 10, version 1809, and later.

    **FirewallRules/_FirewallRuleName_/Description**

    Specifies the description of the rule.

    @@ -289,7 +291,7 @@ Sample syncxml to provision the firewall settings to evaluate

    Boolean value. Supported operations are Get and Replace.

    **FirewallRules/_FirewallRuleName_/Profiles** -

    Specifies the profiles to which the rule belongs: Domain, Private, Public. . See [FW_PROFILE_TYPE](https://msdn.microsoft.com/library/cc231559.aspx) for the bitmasks that are used to identify profile types.

    +

    Specifies the profiles to which the rule belongs: Domain, Private, Public. . See FW_PROFILE_TYPE for the bitmasks that are used to identify profile types.

    If not specified, the default is All.

    Value type is integer. Supported operations are Get and Replace.

    diff --git a/windows/client-management/mdm/firewall-ddf-file.md b/windows/client-management/mdm/firewall-ddf-file.md index f9a9e98d71..20172a8f10 100644 --- a/windows/client-management/mdm/firewall-ddf-file.md +++ b/windows/client-management/mdm/firewall-ddf-file.md @@ -1,12 +1,14 @@ --- title: Firewall DDF file description: Firewall DDF file -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 +ms.reviewer: +manager: dansimp --- # Firewall CSP @@ -16,7 +18,7 @@ This topic shows the OMA DM device description framework (DDF) for the **Firewal Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/get-inventory.md b/windows/client-management/mdm/get-inventory.md index b40c8c4274..94c9465267 100644 --- a/windows/client-management/mdm/get-inventory.md +++ b/windows/client-management/mdm/get-inventory.md @@ -5,11 +5,13 @@ MS-HAID: - 'p\_phdevicemgmt.get\_seatblock' - 'p\_phDeviceMgmt.get\_inventory' ms.assetid: C5485722-FC49-4358-A097-74169B204E74 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/18/2017 --- @@ -39,7 +41,7 @@ The **Get Inventory** operation retrieves information from the Microsoft Store f -  + ### URI parameters @@ -75,7 +77,7 @@ The following parameters may be specified in the request URI.

    licenseTypes

    -

    collection of [LicenseType](data-structures-windows-store-for-business.md#licensetype)

    +

    collection of LicenseType

    {online,offline}

    Optional. A collection of license types

    @@ -163,7 +165,7 @@ Here are some examples. The response contains [InventoryResultSet](data-structures-windows-store-for-business.md#inventoryresultset). -  + diff --git a/windows/client-management/mdm/get-localized-product-details.md b/windows/client-management/mdm/get-localized-product-details.md index 990c816be4..c2e89912d8 100644 --- a/windows/client-management/mdm/get-localized-product-details.md +++ b/windows/client-management/mdm/get-localized-product-details.md @@ -2,11 +2,13 @@ title: Get localized product details description: The Get localized product details operation retrieves the localization information of a product from the Micosoft Store for Business. ms.assetid: EF6AFCA9-8699-46C9-A3BB-CD2750C07901 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-offline-license.md b/windows/client-management/mdm/get-offline-license.md index 65ae6a7b6a..772d402b87 100644 --- a/windows/client-management/mdm/get-offline-license.md +++ b/windows/client-management/mdm/get-offline-license.md @@ -2,11 +2,13 @@ title: Get offline license description: The Get offline license operation retrieves the offline license information of a product from the Micosoft Store for Business. ms.assetid: 08DAD813-CF4D-42D6-A783-994A03AEE051 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-product-details.md b/windows/client-management/mdm/get-product-details.md index 30ec8b7d37..18a0174509 100644 --- a/windows/client-management/mdm/get-product-details.md +++ b/windows/client-management/mdm/get-product-details.md @@ -1,18 +1,20 @@ --- title: Get product details -description: The Get product details operation retrieves the product information from the Micosoft Store for Business for a specific application. +description: The Get product details operation retrieves the product information from the Microsoft Store for Business for a specific application. ms.assetid: BC432EBA-CE5E-43BD-BD54-942774767286 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/18/2017 --- # Get product details -The **Get product details** operation retrieves the product information from the Micosoft Store for Business for a specific application. +The **Get product details** operation retrieves the product information from the Microsoft Store for Business for a specific application. ## Request diff --git a/windows/client-management/mdm/get-product-package.md b/windows/client-management/mdm/get-product-package.md index 15dd879715..7f75857534 100644 --- a/windows/client-management/mdm/get-product-package.md +++ b/windows/client-management/mdm/get-product-package.md @@ -2,11 +2,13 @@ title: Get product package description: The Get product package operation retrieves the information about a specific application in the Micosoft Store for Business. ms.assetid: 4314C65E-6DDC-405C-A591-D66F799A341F -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-product-packages.md b/windows/client-management/mdm/get-product-packages.md index cda326c9e5..394b64e58c 100644 --- a/windows/client-management/mdm/get-product-packages.md +++ b/windows/client-management/mdm/get-product-packages.md @@ -2,11 +2,13 @@ title: Get product packages description: The Get product packages operation retrieves the information about applications in the Micosoft Store for Business. ms.assetid: 039468BF-B9EE-4E1C-810C-9ACDD55C0835 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-seat.md b/windows/client-management/mdm/get-seat.md index ae6f05d26d..2169488622 100644 --- a/windows/client-management/mdm/get-seat.md +++ b/windows/client-management/mdm/get-seat.md @@ -2,11 +2,13 @@ title: Get seat description: The Get seat operation retrieves the information about an active seat for a specified user in the Micosoft Store for Business. ms.assetid: 715BAEB2-79FD-4945-A57F-482F9E7D07C6 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-seats-assigned-to-a-user.md b/windows/client-management/mdm/get-seats-assigned-to-a-user.md index 1209d5aa2a..016e2a8711 100644 --- a/windows/client-management/mdm/get-seats-assigned-to-a-user.md +++ b/windows/client-management/mdm/get-seats-assigned-to-a-user.md @@ -2,11 +2,13 @@ title: Get seats assigned to a user description: The Get seats assigned to a user operation retrieves information about assigned seats in the Micosoft Store for Business. ms.assetid: CB963E44-8C7C-46F9-A979-89BBB376172B -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/get-seats.md b/windows/client-management/mdm/get-seats.md index f65e6988e2..21d8f631c1 100644 --- a/windows/client-management/mdm/get-seats.md +++ b/windows/client-management/mdm/get-seats.md @@ -2,11 +2,13 @@ title: Get seats description: The Get seats operation retrieves the information about active seats in the Micosoft Store for Business. ms.assetid: 32945788-47AC-4259-B616-F359D48F4F2F -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/18/2017 --- diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 8fb792fea4..3870f7d385 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -2,11 +2,13 @@ title: Device HealthAttestation CSP description: Device HealthAttestation CSP ms.assetid: 6F2D783C-F6B4-4A81-B9A2-522C4661D1AC -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -53,9 +55,8 @@ The following is a list of functions performed by the Device HealthAttestation C -![healthattestation session diagram](images/healthattestation_1.png) - -**DHA session data (Device HealthAttestation session data)** +healthattestation session diagram
    +DHA session data (Device HealthAttestation session data)

    The following list of data is produced or consumed in one DHA-Transaction:

    • DHA-BootData: the device boot data (TCG logs, PCR values, device/TPM certificate, boot and TPM counters) that are required for validating device boot health.
      • @@ -71,7 +72,7 @@ The following is a list of functions performed by the Device HealthAttestation C
    • Nonce: a crypto protected number that is generated by MDM-Server, which protects the DHA-Session from man-in-the-middle type attacks
    -**DHA-Enabled MDM (Device HealthAttestation enabled device management solution)** +DHA-Enabled MDM (Device HealthAttestation enabled device management solution)

    Device HealthAttestation enabled (DHA-Enabled) device management solution is a device management tool that is integrated with the DHA feature.

    DHA-Enabled device management solutions enable enterprise IT managers to raise the security protection bar for their managed devices based on hardware (TPM) protected data that can be trusted even if a device is compromized by advanced security threats or running a malicious (jailbroken) operating system.

    The following list of operations are performed by DHA-Enabled-MDM:

    @@ -82,7 +83,7 @@ The following is a list of functions performed by the Device HealthAttestation C
  • Gets the device health report (DHA-Report) from DHA-Service, which triggers compliance action
    • -**DHA-CSP (Device HealthAttestation Configuration Service Provider)** +DHA-CSP (Device HealthAttestation Configuration Service Provider)

    The Device HealthAttestation Configuration Service Provider (DHA-CSP) uses a device’s TPM and firmware to measure critical security properties of the device’s BIOS and Windows boot, such that even on a system infected with kernel level malware or a rootkit, these properties cannot be spoofed.

    The following list of operations are performed by DHA-CSP:

      @@ -92,7 +93,7 @@ The following is a list of functions performed by the Device HealthAttestation C
    • Receives attestation requests (DHA-Requests) from a DHA-Enabled MDM, and replies with Device Health Attestation data (DHA-Data)
    -**DHA-Service (Device HealthAttestation Service)** +DHA-Service (Device HealthAttestation Service)

    Device HealthAttestation Service (DHA-Service) validates the data it receives from DHA-CSP and issues a highly trusted hardware (TPM) protected report (DHA-Report) to DHA-Enabled device management solutions through a tamper resistant and tamper evident communication channel.

    DHA-Service is available in 2 flavors: “DHA-Cloud” and “DHA-Server2016”. DHA-Service supports a variety of implementation scenarios including cloud, on premises, air-gapped, and hybrid scenarios.

    @@ -192,7 +193,7 @@ The following diagram shows the Device HealthAttestation configuration service p

    The supported operation is Get.

    -

    The following list shows some examples of supported values. For the complete list of status see [Device HealthAttestation CSP status and error codes](#device-healthattestation-csp-status-and-error-codes).

    +

    The following list shows some examples of supported values. For the complete list of status see Device HealthAttestation CSP status and error codes.

    - 0 - (HEALTHATTESTATION\_CERT\_RETRI_UNINITIALIZED): DHA-CSP is preparing a request to get a new DHA-EncBlob from DHA-Service - 1 - (HEALTHATTESTATION\_CERT\_RETRI_REQUESTED): DHA-CSP is waiting for the DHA-Service to respond back, and issue a DHA-EncBlob to the device @@ -313,16 +314,16 @@ For DHA-OnPrem & DHA-EMC scenarios, send a SyncML command to the HASEndpoint nod The following example shows a sample call that instructs a managed device to communicate with an enterprise managed DHA-Service. -``` syntax - - 1 - - - ./Vendor/MSFT/HealthAttestation/HASEndpoint - - www.ContosoDHA-Service - - +```xml + + 1 + + + ./Vendor/MSFT/HealthAttestation/HASEndpoint + + www.ContosoDHA-Service + + ``` @@ -333,24 +334,24 @@ Send a SyncML call to start collection of the DHA-Data. The following example shows a sample call that triggers collection and verification of health attestation data from a managed device. -``` syntax - - 1 - - - ./Vendor/MSFT/HealthAttestation/VerifyHealth - - - +```xml + + 1 + + + ./Vendor/MSFT/HealthAttestation/VerifyHealth + + + - - 2 - - - ./Vendor/MSFT/HealthAttestation/Status - - - + + 2 + + + ./Vendor/MSFT/HealthAttestation/Status + + + ``` ## **Step 4: Take action based on the clients response** @@ -363,21 +364,21 @@ After the client receives the health attestation request, it sends a response. T Here is a sample alert that is issued by DHA_CSP: -``` syntax - - 1 - 1226 - - - ./Vendor/MSFT/HealthAttestation/VerifyHealth - - - com.microsoft.mdm:HealthAttestation.Result - int - - 3 - - +```xml + + 1 + 1226 + + + ./Vendor/MSFT/HealthAttestation/VerifyHealth + + + com.microsoft.mdm:HealthAttestation.Result + int + + 3 + + ``` - If the response to the status node is not 0, 1 or 3, then troubleshoot the issue. For the complete list of status codes see [Device HealthAttestation CSP status and error codes](#device-healthattestation-csp-status-and-error-codes). @@ -388,35 +389,34 @@ Create a call to the **Nonce**, **Certificate** and **CorrelationId** nodes, and Here is an example: -``` syntax +```xml - 1 - - - ./Vendor/MSFT/HealthAttestation/Nonce - - AAAAAAAAAFFFFFFF - + 1 + + + ./Vendor/MSFT/HealthAttestation/Nonce + + AAAAAAAAAFFFFFFF + - - - 2 - - - ./Vendor/MSFT/HealthAttestation/Certificate - - - - - 3 - - - ./Vendor/MSFT/HealthAttestation/CorrelationId - - - + + 2 + + + ./Vendor/MSFT/HealthAttestation/Certificate + + + + + 3 + + + ./Vendor/MSFT/HealthAttestation/CorrelationId + + + ``` ## **Step 6: Forward device health attestation data to DHA-service** @@ -429,7 +429,7 @@ When the MDM-Server receives the above data, it must: - Decode the XML formatted data blob it receives from the device - Append the nonce that was generated by MDM service (add the nonce that was forwarded to the device in Step 5) to the XML structure that was forwarded by the device in following format: -``` syntax +```xml [INT] @@ -475,7 +475,7 @@ The following list of data points are verified by the DHA-Service in DHA-Report - [CodeIntegrityEnabled](#codeintegrityenabled) - [TestSigningEnabled](#testsigningenabled) - [SafeMode](#safemode) -- [WinPE ](#winpe) +- [WinPE](#winpe) - [ELAMDriverLoaded](#elamdriverloaded) *** - [VSMEnabled](#vsmenabled) - [PCRHashAlgorithmID](#pcrhashalgorithmid) @@ -536,7 +536,7 @@ Each of these are described in further detail in the following sections, along w - Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks. **BitlockerStatus** (at boot time) -

    When Bitlocker is reported "on" at boot time, the device is able to protect data that is stored on the drive from unauthorized access, when the system is turned off or goes to hibernation.

    +

    When Bitlocker is reported "on" at boot time, the device is able to protect data that is stored on the drive from unauthorized access, when the system is turned off or goes to hibernation.

    Windows BitLocker Drive Encryption, encrypts all data stored on the Windows operating system volume. BitLocker uses the TPM to help protect the Windows operating system and user data and helps to ensure that a computer is not tampered with, even if it is left unattended, lost, or stolen.

    @@ -554,9 +554,9 @@ Each of these are described in further detail in the following sections, along w **BootManagerRevListVersion**

    This attribute indicates the version of the Boot Manager that is running on the device, to allow you to track and manage the security of the boot sequence/environment.

    -

    If BootManagerRevListVersion = \[CurrentVersion\], then allow access.

    +

    If BootManagerRevListVersion = [CurrentVersion], then allow access.

    -

    If BootManagerRevListVersion != \[CurrentVersion\], then take one of the following actions that align with your enterprise policies:

    +

    If BootManagerRevListVersion != [CurrentVersion], then take one of the following actions that align with your enterprise policies:

    - Disallow all access - Disallow access to HBI and MBI assets @@ -566,9 +566,9 @@ Each of these are described in further detail in the following sections, along w **CodeIntegrityRevListVersion**

    This attribute indicates the version of the code that is performing integrity checks during the boot sequence. Using this attribute can help you detect if the device is running the latest version of the code that performs integrity checks, or if it is exposed to security risks (revoked) and enforce an appropriate policy action.

    -

    If CodeIntegrityRevListVersion = \[CurrentVersion\], then allow access.

    +

    If CodeIntegrityRevListVersion = [CurrentVersion], then allow access.

    -

    If CodeIntegrityRevListVersion != \[CurrentVersion\], then take one of the following actions that align with your enterprise policies:

    +

    If CodeIntegrityRevListVersion != [CurrentVersion], then take one of the following actions that align with your enterprise policies:

    - Disallow all access - Disallow access to HBI and MBI assets @@ -668,7 +668,7 @@ Each of these are described in further detail in the following sections, along w

    If WinPE = 1 (True), then limit access to remote resources that are required for Windows OS installation.

    **ELAMDriverLoaded** (Windows Defender) -

    To use this reporting feature you must disable "Hybrid Resume" on the device. Early launch anti-malware (ELAM) provides protection for the computers in your network when they start up and before third-party drivers initialize.

    +

    To use this reporting feature you must disable "Hybrid Resume" on the device. Early launch anti-malware (ELAM) provides protection for the computers in your network when they start up and before third-party drivers initialize.

    In the current release, this attribute only monitors/reports if a Microsoft 1st party ELAM (Windows Defender) was loaded during initial boot.

    @@ -732,7 +732,7 @@ Each of these are described in further detail in the following sections, along w **TPMVersion**

    This attribute identifies the version of the TPM that is running on the attested device.

    -

    TPMVersion node provides to replies "1" and "2":

    +

    TPMVersion node provides to replies "1" and "2":

    • 1 means TPM specification version 1.2
    • 2 means TPM specification version 2.0
      • @@ -746,15 +746,15 @@ Each of these are described in further detail in the following sections, along w - Direct the device to an enterprise honeypot, to further monitor the device's activities. **PCR0** -

      The measurement that is captured in PCR\[0\] typically represents a consistent view of the Host Platform between boot cycles. It contains a measurement of components that are provided by the host platform manufacturer.

      +

      The measurement that is captured in PCR[0] typically represents a consistent view of the Host Platform between boot cycles. It contains a measurement of components that are provided by the host platform manufacturer.

      -

      Enterprise managers can create a whitelist of trusted PCR\[0\] values, compare the PCR\[0\] value of the managed devices (the value that is verified and reported by HAS) with the whitelist, and then make a trust decision based on the result of the comparison.

      +

      Enterprise managers can create a whitelist of trusted PCR[0] values, compare the PCR[0] value of the managed devices (the value that is verified and reported by HAS) with the whitelist, and then make a trust decision based on the result of the comparison.

      -

      If your enterprise does not have a whitelist of accepted PCR\[0\] values, then take no action.

      +

      If your enterprise does not have a whitelist of accepted PCR[0] values, then take no action.

      -

      If PCR\[0\] equals an accepted whitelisted value, then allow access.

      +

      If PCR[0] equals an accepted whitelisted value, then allow access.

      -

      If PCR\[0\] does not equal any accepted whitelisted value, then take one of the following actions that align with your enterprise policies:

      +

      If PCR[0] does not equal any accepted whitelisted value, then take one of the following actions that align with your enterprise policies:

      - Disallow all access - Direct the device to an enterprise honeypot, to further monitor the device's activities. @@ -807,219 +807,219 @@ Each of these are described in further detail in the following sections, along w ## **Device HealthAttestation CSP status and error codes** - - - - - - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - - - - + + + + - + + + + + +
      Error codeError nameDescription
      0HEALTHATTESTATION_CERT_RETRIEVAL_UNINITIALIZEDThis is the initial state for devices that have never participated in a DHA-Session.
      Error codeError nameDescription
      1HEALTHATTESTATION_CERT_RETRIEVAL_REQUESTEDThis state signifies that MDM client’s Exec call on the node VerifyHealth has been triggered and now the OS is trying to retrieve DHA-EncBlob from DHA-Server.
      0HEALTHATTESTATION_CERT_RETRIEVAL_UNINITIALIZEDThis is the initial state for devices that have never participated in a DHA-Session.
      2HEALTHATTESTATION_CERT_RETRIEVAL_FAILEDThis state signifies that the device failed to retrieve DHA-EncBlob from DHA-Server.
      1HEALTHATTESTATION_CERT_RETRIEVAL_REQUESTEDThis state signifies that MDM client’s Exec call on the node VerifyHealth has been triggered and now the OS is trying to retrieve DHA-EncBlob from DHA-Server.
      3HEALTHATTESTATION_CERT_RETRIEVAL_COMPLETEThis state signifies that the device failed to retrieve DHA-EncBlob from DHA-Server.
      2HEALTHATTESTATION_CERT_RETRIEVAL_FAILEDThis state signifies that the device failed to retrieve DHA-EncBlob from DHA-Server.
      4HEALTHATTESTATION_CERT_RETRIEVAL_PCR_FAILDeprecated in Windows 10, version 1607.
      3HEALTHATTESTATION_CERT_RETRIEVAL_COMPLETEThis state signifies that the device failed to retrieve DHA-EncBlob from DHA-Server.
      5HEALTHATTESTATION_CERT_RETRIEVAL_GETQUOTE_FAILDHA-CSP failed to get a claim quote.
      4HEALTHATTESTATION_CERT_RETRIEVAL_PCR_FAILDeprecated in Windows 10, version 1607.
      6HEALTHATTESTATION_CERT_RETRIEVAL_DEVICE_NOT_READYDHA-CSP failed in opening a handle to Microsoft Platform Crypto Provider.
      5HEALTHATTESTATION_CERT_RETRIEVAL_GETQUOTE_FAILDHA-CSP failed to get a claim quote.
      7HEALTHATTESTATION_CERT_RETRIEVAL_WINDOWS_AIK_FAILDHA-CSP failed in retrieving Windows AIK
      6HEALTHATTESTATION_CERT_RETRIEVAL_DEVICE_NOT_READYDHA-CSP failed in opening a handle to Microsoft Platform Crypto Provider.
      8HEALTHATTESTATION_CERT_RETRIEVAL_FROM_WEB_FAILDeprecated in Windows 10, version 1607.
      7HEALTHATTESTATION_CERT_RETRIEVAL_WINDOWS_AIK_FAILDHA-CSP failed in retrieving Windows AIK
      9HEALTHATTESTATION_CERT_RETRIEVAL_INVALID_TPM_VERSIONInvalid TPM version (TPM version is not 1.2 or 2.0)
      8HEALTHATTESTATION_CERT_RETRIEVAL_FROM_WEB_FAILDeprecated in Windows 10, version 1607.
      10HEALTHATTESTATION_CERT_RETRIEVAL_GETNONCE_FAILNonce was not found in the registry.
      9HEALTHATTESTATION_CERT_RETRIEVAL_INVALID_TPM_VERSIONInvalid TPM version (TPM version is not 1.2 or 2.0)
      11HEALTHATTESTATION_CERT_RETRIEVAL_GETCORRELATIONID_FAILCorrelation ID was not found in the registry.
      10HEALTHATTESTATION_CERT_RETRIEVAL_GETNONCE_FAILNonce was not found in the registry.
      12HEALTHATTESTATION_CERT_RETRIEVAL_GETCERT_FAILDeprecated in Windows 10, version 1607.
      11HEALTHATTESTATION_CERT_RETRIEVAL_GETCORRELATIONID_FAILCorrelation ID was not found in the registry.
      13HEALTHATTESTATION_CERT_RETRIEVAL_GETCLAIM_FAILDeprecated in Windows 10, version 1607.
      12HEALTHATTESTATION_CERT_RETRIEVAL_GETCERT_FAILDeprecated in Windows 10, version 1607.
      14HEALTHATTESTATION_CERT_RETRIEVAL_ENCODING_FAILFailure in Encoding functions. (Extremely unlikely scenario)
      13HEALTHATTESTATION_CERT_RETRIEVAL_GETCLAIM_FAILDeprecated in Windows 10, version 1607.
      15HEALTHATTESTATION_CERT_RETRIEVAL_ENDPOINTOVERRIDE_FAILDeprecated in Windows 10, version 1607.
      14HEALTHATTESTATION_CERT_RETRIEVAL_ENCODING_FAILFailure in Encoding functions. (Extremely unlikely scenario)
      16HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_LOAD_XMLDHA-CSP failed to load the payload it received from DHA-Service
      15HEALTHATTESTATION_CERT_RETRIEVAL_ENDPOINTOVERRIDE_FAILDeprecated in Windows 10, version 1607.
      17HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CORRUPT_XMLDHA-CSP received a corrupted response from DHA-Service.
      16HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_LOAD_XMLDHA-CSP failed to load the payload it received from DHA-Service
      18HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EMPTY_XMLDHA-CSP received an empty response from DHA-Service.
      17HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CORRUPT_XMLDHA-CSP received a corrupted response from DHA-Service.
      19HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_DECRYPT_AES_EKDHA-CSP failed in decrypting the AES key from the EK challenge.
      18HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EMPTY_XMLDHA-CSP received an empty response from DHA-Service.
      20HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_DECRYPT_CERT_AES_EKDHA-CSP failed in decrypting the health cert with the AES key.
      19HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_DECRYPT_AES_EKDHA-CSP failed in decrypting the AES key from the EK challenge.
      21HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EXPORT_AIKPUBDHA-CSP failed in exporting the AIK Public Key.
      20HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_DECRYPT_CERT_AES_EKDHA-CSP failed in decrypting the health cert with the AES key.
      22HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_CLAIMAUTHORITYONLYDHA-CSP failed in trying to create a claim with AIK attestation data.
      21HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EXPORT_AIKPUBDHA-CSP failed in exporting the AIK Public Key.
      23HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_APPEND_AIKPUBDHA-CSP failed in appending the AIK Pub to the request blob.
      22HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_CLAIMAUTHORITYONLYDHA-CSP failed in trying to create a claim with AIK attestation data.
      24HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_APPEND_AIKCERTDHA-CSP failed in appending the AIK Cert to the request blob.
      23HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_APPEND_AIKPUBDHA-CSP failed in appending the AIK Pub to the request blob.
      25HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_INIT_HTTPHANDLEDHA-CSP failed to obtain a Session handle.
      24HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_APPEND_AIKCERTDHA-CSP failed in appending the AIK Cert to the request blob.
      26HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_GETTARGET_HTTPHANDLEDHA-CSP failed to connect to the DHA-Service.
      25HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_INIT_HTTPHANDLEDHA-CSP failed to obtain a Session handle.
      27HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_HTTPHANDLEDHA-CSP failed to create a HTTP request handle.
      26HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_GETTARGET_HTTPHANDLEDHA-CSP failed to connect to the DHA-Service.
      28HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_SET_INTERNETOPTIONDHA-CSP failed to set options.
      27HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_HTTPHANDLEDHA-CSP failed to create a HTTP request handle.
      29HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_ADD_REQUESTHEADERSDHA-CSP failed to add request headers.
      28HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_SET_INTERNETOPTIONDHA-CSP failed to set options.
      30HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_SEND_REQUESTDHA-CSP failed to send the HTTP request.
      29HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_ADD_REQUESTHEADERSDHA-CSP failed to add request headers.
      31HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_RECEIVE_RESPONSEDHA-CSP failed to receive a response from the DHA-Service.
      30HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_SEND_REQUESTDHA-CSP failed to send the HTTP request.
      32HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_QUERY_HEADERSDHA-CSP failed to query headers when trying to get HTTP status code.
      31HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_RECEIVE_RESPONSEDHA-CSP failed to receive a response from the DHA-Service.
      33HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EMPTY_RESPONSEDHA-CSP received an empty response from DHA-Service even though HTTP status was OK.
      32HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_QUERY_HEADERSDHA-CSP failed to query headers when trying to get HTTP status code.
      34HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_MISSING_RESPONSEDHA-CSP received an empty response along with a HTTP error code from DHA-Service.
      33HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EMPTY_RESPONSEDHA-CSP received an empty response from DHA-Service even though HTTP status was OK.
      35HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_IMPERSONATE_USERDHA-CSP failed to impersonate user.
      34HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_MISSING_RESPONSEDHA-CSP received an empty response along with a HTTP error code from DHA-Service.
      36HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_ACQUIRE_PDCNETWORKACTIVATORDHA-CSP failed to acquire the PDC activators that are needed for network communication when the device is in Connected standby mode.
      35HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_IMPERSONATE_USERDHA-CSP failed to impersonate user.
      0xFFFFHEALTHATTESTATION_CERT_RETRIEVAL_FAILED_UNKNOWNDHA-CSP failed due to an unknown reason, this error is highly unlikely to occur.
      36HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_ACQUIRE_PDCNETWORKACTIVATORDHA-CSP failed to acquire the PDC activators that are needed for network communication when the device is in Connected standby mode.
      400Bad_Request_From_ClientDHA-CSP has received a bad (malformed) attestation request.
      0xFFFFHEALTHATTESTATION_CERT_RETRIEVAL_FAILED_UNKNOWNDHA-CSP failed due to an unknown reason, this error is highly unlikely to occur.
      404Endpoint_Not_ReachableDHA-Service is not reachable by DHA-CSP
      400Bad_Request_From_ClientDHA-CSP has received a bad (malformed) attestation request.
      404Endpoint_Not_ReachableDHA-Service is not reachable by DHA-CSP
      ## DHA-Report V3 schema -``` syntax - +```xml + - + @@ -1122,7 +1122,7 @@ Each of these are described in further detail in the following sections, along w ## DHA-Report example -``` syntax +```xml **Note**  HotSpot CSP is only supported in Windows 10 Mobile. - -  - +> +> +> > **Note**   This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION capability to be accessed from a network configuration application. -  + The following diagram shows the HotSpot configuration service provider management object in tree format as used by OMA Client Provisioning. The OMA DM protocol is not supported by this configuration service provider. @@ -45,7 +47,7 @@ Specified connections will be mapped, by policy, to the Internet sharing service > **Note**   The mapping policy will also include the connection specified in the **TetheringNAIConnection** value as well. -  + If the specified connections do not exist, Internet sharing will not start because it will not have any cellular connections available to share @@ -60,7 +62,7 @@ Specified connections will be mapped, by policy, to the Internet sharing service > **Note**   The mapping policy will also include the connections specified in the **DedicatedConnections** as well. -  + If the specified connections do not exist, Internet sharing will not start because it will not have any cellular connections available to share @@ -92,7 +94,7 @@ Where `` is the path to the resource dll that contains the stri > **Note**  MOAppLink is required to use the MOHelpMessage setting. -  + **EntitlementRequired** Optional. Specifies whether the device requires an entitlement check to determine if Internet sharing should be enabled. This node is set to a Boolean value. The default value is **True**. @@ -120,19 +122,19 @@ Changes to this node require a reboot. **MinWifiKeyLength** > **Important**   This parm is no longer supported for Windows Phone 8.1. The enforced minimum allowed length of the Wi-Fi key is 8. -  + **MinWifiSSIDLength** > **Important**   This parm is no longer supported for Windows Phone 8.1. The enforced minimum allowed length of the Wi-Fi SSID is 1. -  + ## Additional requirements for CDMA networks For CDMA networks that use a separate Network Access Identity (NAI) for Internet sharing, a new parm, TetheringNAI, has been added in the [CM\_CellularEntries configuration service provider](cm-cellularentries-csp.md) configuration service provider. The following sample demonstrates how to specify the connection. -``` syntax +```xml @@ -152,7 +154,7 @@ For CDMA networks that use a separate Network Access Identity (NAI) for Internet > **Note**  CDMA devices are limited to one active data connection at a time. This means any application or service (such as email or MMS) that is bound to another connection may not work while Internet sharing is turned on. -  + ## Creating an Entitlement DLL @@ -194,7 +196,7 @@ During an entitlement check the Internet Sharing service loads the specified DLL -  + The definition for the **ICS\_ENTITLEMENT\_RESULT** is in the header file `IcsEntitlementh`, which ships with the Windows Adaptation Kit. @@ -203,9 +205,9 @@ The definition for the **ICS\_ENTITLEMENT\_RESULT** is in the header file `IcsEn [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/iconfigserviceprovider2.md b/windows/client-management/mdm/iconfigserviceprovider2.md deleted file mode 100644 index fbdb51d309..0000000000 --- a/windows/client-management/mdm/iconfigserviceprovider2.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: IConfigServiceProvider2 -description: IConfigServiceProvider2 -ms.assetid: 8deec0fb-59a6-4d08-8ddb-6d0d3d868a10 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# IConfigServiceProvider2 - - -OEMs are required to implement this interface once per configuration service provider. ConfigManager2 clients use this interface to instantiate the configuration service provider, to communicate general state information to the configuration service provider, and often to access or create nodes. - -The following table shows the methods defined by this interface that OEMs must implement. - - ---- - - - - - - - - - - - - - - - - -
      MethodDescription

      [IConfigServiceProvider2::ConfigManagerNotification](iconfigserviceprovider2configmanagernotification.md)

      Enables ConfigManager2 to send notifications to a configuration service provider of events such as when the configuration service provider is loaded or unloaded, when rollbacks are performed, and when actions are called on nodes.

      [IConfigServiceProvider2::GetNode](iconfigserviceprovider2getnode.md)

      Returns a node from the configuration service provider based on the path relative to the root node.

      - -  - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - - diff --git a/windows/client-management/mdm/iconfigserviceprovider2configmanagernotification.md b/windows/client-management/mdm/iconfigserviceprovider2configmanagernotification.md deleted file mode 100644 index 1ae5155478..0000000000 --- a/windows/client-management/mdm/iconfigserviceprovider2configmanagernotification.md +++ /dev/null @@ -1,144 +0,0 @@ ---- -title: IConfigServiceProvider2 ConfigManagerNotification -description: IConfigServiceProvider2 ConfigManagerNotification -ms.assetid: b1f0fe0f-afbe-4b36-a75d-34239a86a75c -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# IConfigServiceProvider2::ConfigManagerNotification - - -This method enables ConfigManager2 to send notifications of events to a configuration service provider, such as when the configuration service provider is loaded or unloaded, when rollbacks are performed, and when actions are called on nodes. - -## Syntax - - -``` syntax -HRESULT ConfigManagerNotification([in] CFGMGR_NOTIFICATION cmnfyState, - [in] LPARAM lpParam); -``` - -## Parameters - - -*cmnfyState* -
        -
      • -The following events are supported by all configuration service providers. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        EventDescription

        CFGMGR_NOTIFICATION_LOAD

        First time the configuration service provider is loaded/instantiated.

        CFGMGR_NOTIFICATION_BEGINCOMMANDPROCESSING

        About to run the first command of a transaction.

        CFGMGR_NOTIFICATION_ENDCOMMANDPROCESSING

        Last command of transaction has executed. This event is always raised if BEGINCOMMANDPROCESSING was raised, even if the handling of BEGINCOMMANDPROCESSING failed.

        CFGMGR_NOTIFICATION_BEGINCOMMIT

        About to commit the first command of a transaction.

        CFGMGR_NOTIFICATION_ENDCOMMIT

        Last command of a transaction has been committed. This event is always raised if BEGINCOMMIT was raised, even if the handling of BEGINCOMMIT failed.

        CFGMGR_NOTIFICATION_BEGINROLLBACK

        About to roll back the first command of the transaction.

        CFGMGR_NOTIFICATION_ENDROLLBACK

        Last command of the transaction has been rolled back. This event is always raised if BEGINROLLBACK was raised, even if the handling of BEGINROLLBACK failed.

        CFGMGR_NOTIFICATION_UNLOAD

        The configuration service provider is about to be unloaded/deleted.

        CFGMGR_NOTIFICATION_SETSESSIONOBJ

        Session object is available for use; lpParam can be cast to an IConfigSession2 pointer.

        CFGMGR_NOTIFICATION_BEGINTRANSACTIONING

        Primarily used for compatibility with v1 configuration service providers. Signals the beginning of a transactioning sequence.

        CFGMGR_NOTIFICATION_ENDTRANSACTIONING

        Primarily used for compatibility with v1 configuration service providers. Signals the end of a transactioning sequence.

        -
        • -
      -
      - - -*lpParam* -
        -
      • -Normally NULL, but contains a pointer to an IConfigSession2 instance if *cmnfState* is CFGMGR\_NOTIFICATION\_SETSESSIONOBJ. -
        • -
      -
      - -## Return Value - -A value of S\_OK indicates success. - -## Remarks - -ConfigManager2 guarantees that if it raised one of the BEGIN events - -- CFGMGR\_NOTIFICATION\_BEGINCOMMANDPROCESSING -- CFGMGR\_NOTIFICATION\_BEGINCOMMIT -- CFGMGR\_NOTIFICATION\_BEGINROLLBACK - -then the corresponding END event will be raised, even if the handling of the BEGIN notification failed. -For each transaction, the sequence of notifications is: - -1. BEGINCOMMANDPROCESSING - -2. BEGINTRANSACTIONING - -3. ENDTRANSACTIONING - -4. ENDCOMMANDPROCESSING - -5. Either BEGINCOMMIT or BEGINROLLBACK, depending on whether the transaction succeeded or failed. - -6. Either ENDCOMMIT or ENDROLLBACK, depending on whether the transaction succeeded or failed. - -Each configuration service provider will receive the relevant BEGIN/END notifications exactly once per each transaction that ConfigManager2 executes. - -## Requirements - -**Header:** None - -  - - - - - - diff --git a/windows/client-management/mdm/iconfigserviceprovider2getnode.md b/windows/client-management/mdm/iconfigserviceprovider2getnode.md deleted file mode 100644 index df315b2ba4..0000000000 --- a/windows/client-management/mdm/iconfigserviceprovider2getnode.md +++ /dev/null @@ -1,104 +0,0 @@ ---- -title: IConfigServiceProvider2 GetNode -description: IConfigServiceProvider2 GetNode -ms.assetid: 4dc10a59-f6a2-45c0-927c-d594afc9bb91 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# IConfigServiceProvider2::GetNode - - -This method returns a node from the configuration service provider based on the path that was passed in. The returned node is a descendent of the root node. - -## Syntax - - -``` syntax -HRESULT GetNode([in] IConfigManager2URI* pURI, - [out] ICSPNode** ppNode, - [in, out] DWORD* pgrfNodeOptions); -``` - -## Parameters - -*pUri* -
        -
      • -URI of the child node, relative to the root node. For example, to access the "./Vendor/Contoso/SampleCSP/ContainerA/UserName" node, ConfigManager2 calls the configuration service provider's `GetNode` method and passes in an IConfigManager2URI instance representing the URI “SampleCSP/ContainerA/UserName”. -
        • -
      -
      -*ppNode* -
        -
      • -If the query is successful, this returns the ICSPNode instance at the *pUri* location in the configuration service provider's tree. -
        • -
      -
      -*pgrfNodeOptions* -
        -
      • -Nodes support the following features. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Feature nameBit value (in hex)Notes

        CSPNODE_OPTION_NATIVESECURITY

        0x01

        The native security option signifies that the node handles its own security checking, and that ConfigManager2 does not have to manage security for this node.

        CSPNODE_OPTION_INTERNALTRANSACTION

        0x02

        The internal transactioning option tells ConfigManager2 that the configuration service provider handles the transactioning (rollback and commitment) for the node. To handle internal transactioning, the node must implement the [ICSPNodeTransactioning](icspnodetransactioning.md).

        CSPNODE_OPTION_HANDLEALLPROPERTIES

        0x04

        Unused.

        CSPNODE_OPTION_SECRETDATA

        0x08

        Unused.

        -
        • -
      -
      - -## Return Value - -This method returns an ICSPNode. If the function returns null, call GetLastError to get the error value. - -A value of S\_OK indicates that a node was successfully found. CFGMGR\_E\_NODENOTFOUND indicates that the node does not exist. Note that this may be normal, as in the case of optional nodes. - -## Requirements - -**Header:** None - -  - - - - - - diff --git a/windows/client-management/mdm/icspnode.md b/windows/client-management/mdm/icspnode.md deleted file mode 100644 index dedf93e0b1..0000000000 --- a/windows/client-management/mdm/icspnode.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: ICSPNode -description: ICSPNode -ms.assetid: 023466e6-a8ab-48ad-8548-291409686ac2 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode - -This interface does most of the work in a configuration service provider. Each individual node in a configuration service provider tree is represented by a separate implementation of this interface. The actions of a ConfigManager2 client are typically translated into calls to an instance of an ICSPNode. - -These methods must be implemented so that, if they fail, the node's state at the end of the method matches the state before the method was called. - -Some nodes will not be able to perform certain actions, and can return CFGMGR\_E\_COMMANDNOTALLOWED for those methods. For each method that is implemented for externally–transactioned nodes, the contrary method must also be implemented, as defined by "Determine node operations" in [Designing a custom configuration service provider](design-a-custom-windows-csp.md). - -The following table shows the methods defined by this interface that OEMs must implement. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      MethodDescription

      [ICSPNode::Add](icspnodeadd.md)

      Adds an immediate child to a configuration service provider node and returns a pointer to the new child node.

      [ICSPNode::Clear](icspnodeclear.md)

      Deletes the contents and children of the current configuration service provider node. Called before [ICSPNode::DeleteChild](icspnodedeletechild.md).

      [ICSPNode::Copy](icspnodecopy.md)

      Makes a copy of the current node at the specified path within the configuration service provider. If the target node exists, it should be overwritten.

      [ICSPNode::DeleteChild](icspnodedeletechild.md)

      Deletes the specified child node from the configuration service provider node.

      [ICSPNode::DeleteProperty](icspnodedeleteproperty.md)

      Deletes a property from a configuration service provider node.

      [ICSPNode::Execute](icspnodeexecute.md)

      Runs a task on an internally-transactioned configuration service provider node by passing in the specified user data and returning a result.

      [ICSPNode::GetChildNodeNames](icspnodegetchildnodenames.md)

      Returns the list of children for a configuration service provider node.

      [ICSPNode::GetProperty](icspnodegetproperty.md)

      Returns a property value from a configuration service provider node.

      [ICSPNode::GetPropertyIdentifiers](icspnodegetpropertyidentifiers.md)

      Returns a list of non-standard properties supported by the node. The returned array must be allocated with CoTaskMemAlloc.

      [ICSPNode::GetValue](icspnodegetvalue.md)

      Gets the value and data type for the node. Interior (non-leaf) nodes may not have a value.

      [ICSPNode::Move](icspnodemove.md)

      Moves this node to a new location within the configuration service provider. If the target node already exists, it should be overwritten.

      [ICSPNode::SetProperty](icspnodesetproperty.md)

      Sets a property value for a configuration service provider node.

      [ICSPNode::SetValue](icspnodesetvalue.md)

      Sets the value for the configuration service provider node. It is an error to attempt to set the value of an interior node.

      - -  - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - - diff --git a/windows/client-management/mdm/icspnodeadd.md b/windows/client-management/mdm/icspnodeadd.md deleted file mode 100644 index 504d0751e1..0000000000 --- a/windows/client-management/mdm/icspnodeadd.md +++ /dev/null @@ -1,116 +0,0 @@ ---- -title: ICSPNode Add -description: ICSPNode Add -ms.assetid: 5f03d350-c82b-4747-975f-385fd8b5b3a8 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode::Add - -This method adds an immediate child node to a configuration service provider node and returns a pointer to the new node. - -## Syntax - -``` syntax -HRESULT Add([in] IConfigManager2URI* pChildName, - [in] CFG_DATATYPE DataType, - [in] VARIANT varValue, - [in, out] ICSPNode** ppNewNode, - [in, out] DWORD* pgrfNodeOptions); -``` - -## Parameters - -*pChildName* -      Name of child node to add. - -*DataType* -      Data type of the child node to add. Supported types include: -- CFG\_DATATYPE\_NODE - -- CFG\_DATATYPE\_NULL - -- CFG\_DATATYPE\_BINARY - -- CFG\_DATATYPE\_INTEGER - -- CFG\_DATATYPE\_STRING - -- CFG\_DATATYPE\_MULTIPLE\_STRING - -*varValue* -      Value of the child node to add. - -*ppNewNode* -      New child node to return. - -*pgrfNodeOptions* -      Features supported on the new child node. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Feature nameBit value (in hex)Notes

      CSPNODE_OPTION_NATIVESECURITY

      0x01

      The native security option signifies that the node handles its own security checking, and that ConfigManager2 does not have to manage security for this node.

      CSPNODE_OPTION_INTERNALTRANSACTION

      0x02

      The internal transactioning option tells ConfigManager2 that the configuration service provider handles the transactioning (rollback and commitment) for the node. To handle internal transactioning, the node must implement the [ICSPNodeTransactioning](icspnodetransactioning.md).

      CSPNODE_OPTION_HANDLEALLPROPERTIES

      0x04

      Unused.

      CSPNODE_OPTION_SECRETDATA

      0x08

      Unused.

      - -  -## Return Value - -This method returns an ICSPNode and the feature options supported on that child node. If the method returns null, call GetLastError to get the error value. - -A value of S\_OK indicates that a node was successfully found. CMN\_E\_ALREADY\_EXISTS indicates that a child node with the same name already exists. CFGMGR\_E\_COMMANDNOTALLOWED indicates that this node does not support the **Add** method. - -## Remarks - -For externally–transactioned nodes, if this method is implemented, then [ICSPNode::Clear](icspnodeclear.md) and [ICSPNode::DeleteChild](icspnodedeletechild.md) must also be implemented or rollback will fail. - -## Requirements - -**Header:** None - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - - diff --git a/windows/client-management/mdm/icspnodeclear.md b/windows/client-management/mdm/icspnodeclear.md deleted file mode 100644 index 2c0e45ea99..0000000000 --- a/windows/client-management/mdm/icspnodeclear.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: ICSPNode Clear -description: ICSPNode Clear -ms.assetid: b414498b-110a-472d-95c0-2d5b38cd78a6 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - - -# ICSPNode::Clear - -This method deletes the contents and child nodes of the current configuration service provider node. This method is always called on the child node before [ICSPNode::DeleteChild](icspnodedeletechild.md) is called on the parent node. - - -## Syntax - -``` syntax -HRESULT Clear(); -``` - - -## Return Value - -A value of S\_OK indicates that the node was successfully cleared. CFGMGR\_E\_COMMANDNOTALLOWED indicates that this node does not support the **Clear** method. - - -## Remarks - -For externally–transactioned nodes, if this method is implemented, then [ICSPNode::SetValue](icspnodesetvalue.md) and [ICSPNode::SetProperty](icspnodesetproperty.md) must also be implemented or rollback will fail. - -Before calling **Clear** on the target node, ConfigManager2 attempts to gather the current state of the node; the parent node does not have to preserve the state of its child nodes if they are externally-transactioned. - -## Requirements - -**Header:** None - - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - diff --git a/windows/client-management/mdm/icspnodecopy.md b/windows/client-management/mdm/icspnodecopy.md deleted file mode 100644 index 1061d2b6b9..0000000000 --- a/windows/client-management/mdm/icspnodecopy.md +++ /dev/null @@ -1,94 +0,0 @@ ---- -title: ICSPNode Copy -description: ICSPNode Copy -ms.assetid: cd5ce0bc-a08b-4f82-802d-c7ff8701b41f -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode::Copy - -This method makes a copy of the current node at the specified path within the configuration service provider. If the target node exists, it should be overwritten. - -## Syntax - -``` syntax -HRESULT Copy([in] IConfigManager2URI* puriDestination, - [in, out] ICSPNode** ppNewNode, - [in, out] DWORD* pgrfNodeOptions); -``` - -## Parameters - -*puriDestination* -      Path and name of new node's location, relative to the configuration service provider's root node. - -*ppNewNode* -      New node created by the copy operation. - -*pgrfNodeOptions* -      Features supported on the new node. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      Feature nameBit value (in hex)Notes

      CSPNODE_OPTION_NATIVESECURITY

      0x01

      The native security option signifies that the node handles its own security checking, and that ConfigManager2 does not have to manage security for this node.

      CSPNODE_OPTION_INTERNALTRANSACTION

      0x02

      The internal transactioning option tells ConfigManager2 that the configuration service provider handles the transactioning (rollback and commitment) for the node. To handle internal transactioning, the node must implement the [ICSPNodeTransactioning](icspnodetransactioning.md).

      CSPNODE_OPTION_HANDLEALLPROPERTIES

      0x04

      Unused.

      CSPNODE_OPTION_SECRETDATA

      0x08

      Unused.

      - -  -## Return Value - -A value of S\_OK indicates that the node was successfully copied to the new location. CFGMGR\_E\_COMMANDNOTALLOWED indicates that this node does not support the **Copy** method. - -## Remarks - -For externally–transactioned nodes, if this method is implemented, then [ICSPNode::Add](icspnodeadd.md), [ICSPNode::SetValue](icspnodesetvalue.md), [ICSPNode::Clear](icspnodeclear.md), and [ICSPNode::DeleteChild](icspnodedeletechild.md) must also be implemented or rollback will fail. - -## Requirements - -**Header:** None - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - - - - - - diff --git a/windows/client-management/mdm/icspnodedeletechild.md b/windows/client-management/mdm/icspnodedeletechild.md deleted file mode 100644 index 147c0f4af3..0000000000 --- a/windows/client-management/mdm/icspnodedeletechild.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: ICSPNode DeleteChild -description: ICSPNode DeleteChild -ms.assetid: 8cf3663d-a4cf-4d11-b03a-f1d096ad7f9c -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode::DeleteChild - -Deletes the specified child node from the configuration service provider node. [ICSPNode::Clear](icspnodeclear.md) must always be called first on the child node that is to be deleted. - -## Syntax - -``` syntax -HRESULT DeleteChild([in] IConfigManager2URI* puriChildToDelete); -``` - -## Parameters - -*puriChildToDelete* -      The name of the child node to delete. - -## Return Values - -| Return Value | Description | -|------------------------------|--------------------------------------------------| -| CFGMGR\_E\_NODENOTFOUND | The child node does not exist | -| CFGMGR\_E\_COMMANDNOTALLOWED | The child node to be deleted is a read-only node | -| S\_OK | Success. | - -  -A value of S\_OK indicates that a node was successfully deleted. CFGMGR\_E\_NODENOTFOUND indicates that the child node does not exist. CFGMGR\_E\_COMMANDNOTALLOWED indicates that this node does not support the **ICSP::DeleteChild** method, or that the child node to be deleted is a read-only node. - -## Remarks - -For externally–transactioned nodes, if this method is implemented, then [ICSPNode::Add](icspnodeadd.md) must also be implemented or rollback will fail. - -## Requirements - -**Header:** None - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - - diff --git a/windows/client-management/mdm/icspnodedeleteproperty.md b/windows/client-management/mdm/icspnodedeleteproperty.md deleted file mode 100644 index b771500d38..0000000000 --- a/windows/client-management/mdm/icspnodedeleteproperty.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: ICSPNode DeleteProperty -description: ICSPNode DeleteProperty -ms.assetid: 7e21851f-d663-4558-b3e8-590d24b4f6c4 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode::DeleteProperty - -This method deletes a property from a configuration service provider node. - -## Syntax - -``` syntax -HRESULT DeleteProperty([in] REFGUID guidProperty); -``` - -## Parameters - -*guidProperty* -      The GUID of the property to delete. - -## Return Value - -A value of S\_OK indicates that a node was successfully found. CFGMGR\_E\_PROPERTYNOTSUPPORTED indicates that this node does not manage or implement the property itself, but delegates it to ConfigManager2. E\_NOTIMPL indicates this method is not supported by this node. - -## Remarks - -For externally–transactioned nodes, if this method is implemented, then [ICSPNode::SetProperty](icspnodesetproperty.md) must also be implemented or rollback will fail. - -## Requirements - -**Header:** None - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - - diff --git a/windows/client-management/mdm/icspnodeexecute.md b/windows/client-management/mdm/icspnodeexecute.md deleted file mode 100644 index 12c428de69..0000000000 --- a/windows/client-management/mdm/icspnodeexecute.md +++ /dev/null @@ -1,48 +0,0 @@ ---- -title: ICSPNode Execute -description: ICSPNode Execute -ms.assetid: 5916e7b7-256d-49fd-82b6-db0547a215ec -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode::Execute - -This method runs a task on an internally-transactioned configuration service provider node by passing in the specified user data and returning a result. The exact meaning of **Execute** and whether it is even supported depends on the purpose of the node. For example, **Execute** called on a node that represents a file should probably **ShellExecute** the file, whereas calling **Execute** on a registry node generally does not make sense. - -## Syntax - -``` syntax -HRESULT Execute([in] VARIANT varUserData); -``` - -## Parameters - -*varUserData* -    Data to pass into the execution. - -## Return Value - -A value of S\_OK indicates that the operation was performed successfully on the node. E\_NOTIMPL should be returned if this method is not implemented. - -## Remarks - -Externally–transactioned nodes do not support this method. - -## Requirements - -**Header:** None - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - diff --git a/windows/client-management/mdm/icspnodegetchildnodenames.md b/windows/client-management/mdm/icspnodegetchildnodenames.md deleted file mode 100644 index 72d72c56ac..0000000000 --- a/windows/client-management/mdm/icspnodegetchildnodenames.md +++ /dev/null @@ -1,54 +0,0 @@ ---- -title: ICSPNode GetChildNodeNames -description: ICSPNode GetChildNodeNames -ms.assetid: dc057f2b-282b-49ac-91c4-bb83bd3ca4dc -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode::GetChildNodeNames - -This method returns the list of child nodes for a configuration service provider node. - -## Syntax - -``` syntax -HRESULT GetChildNodeNames([out] ULONG* pulCount, - [out,size_is(,*pulCount)] BSTR** pbstrNodeNames); -``` - -## Parameters - -*pulCount* -

      The number of child nodes to return.

      - -*pbstrNodeNames* -

      The array of child node names. The returned array must be allocated with `CoTaskMemAlloc`. Each element of the array must be a valid, non-NULL `BSTR`, allocated by `SysAllocString` or `SysAllocStringLen`. The names returned must not be encoded in any way, including URI-encoding, for canonicalization reasons.

      - -## Return Value - -A value of S\_OK indicates that a node was successfully found. CFGMGR\_E\_COMMANDNOTALLOWED indicates that this was called on a leaf node (no children will be returned). - -## Remarks - -For externally–transactioned nodes, no additional methods are required for successful rollback. - -## Requirements - -**Header:** None - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - - diff --git a/windows/client-management/mdm/icspnodegetproperty.md b/windows/client-management/mdm/icspnodegetproperty.md deleted file mode 100644 index 0778b71554..0000000000 --- a/windows/client-management/mdm/icspnodegetproperty.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: ICSPNode GetProperty -description: ICSPNode GetProperty -ms.assetid: a2bdc158-72e0-4cdb-97ce-f5cf1a44b7db -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode::GetProperty - -This method returns a property value from a configuration service provider node. - -## Syntax - -``` syntax -HRESULT GetProperty([in] REFGUID guidProperty, - [in,out] VARIANT* pvarValue); -``` - -## Parameters - -*guidProperty* -

      GUID that specifies the property to return.

      - -*pvarValue* -

      Value to return.

      - -## Return Value - -A value of S\_OK indicates that the value was successfully returned. CFGMGR\_E\_COMMANDNOTSUPPORTED indicates that the node does not implement the property itself, but delegates the management of the property to ConfigManager2. - -## Remarks - -Every node must handle the CFGMGR\_PROPERTY\_DATATYPE property. - -For externally–transactioned nodes, no additional methods are required for successful rollback. - -## Requirements - -**Header:** None - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - - diff --git a/windows/client-management/mdm/icspnodegetpropertyidentifiers.md b/windows/client-management/mdm/icspnodegetpropertyidentifiers.md deleted file mode 100644 index d0c557b04f..0000000000 --- a/windows/client-management/mdm/icspnodegetpropertyidentifiers.md +++ /dev/null @@ -1,53 +0,0 @@ ---- -title: ICSPNode GetPropertyIdentifiers -description: ICSPNode GetPropertyIdentifiers -ms.assetid: 8a052cd3-d74c-40c4-845f-f804b920deb4 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode::GetPropertyIdentifiers - -This method returns a list of non-standard properties supported by the node. The returned array must be allocated with `CoTaskMemAlloc`. - -## Syntax - -``` syntax -HRESULT GetPropertyIdentifiers([out] ULONG* pulCount, - [out,size_is(,*pulCount)] GUID** pguidProperties); -``` - -## Parameters - -*pulCount* -

      The number of non-standard properties to return.

      - -*pguidProperties* -

      The array of property GUIDs to return. This array must be allocated with `CoTaskMemAlloc`.

      - -## Return Value - -A value of S\_OK indicates that the properties were successfully returned. E\_NOTIMPL indicates that this method is not supported by the node. - -## Remarks - -For externally–transactioned nodes, no additional methods are required for successful rollback. - -## Requirements - -**Header:** None - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - diff --git a/windows/client-management/mdm/icspnodegetvalue.md b/windows/client-management/mdm/icspnodegetvalue.md deleted file mode 100644 index 6207cb507c..0000000000 --- a/windows/client-management/mdm/icspnodegetvalue.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: ICSPNode GetValue -description: ICSPNode GetValue -ms.assetid: c684036d-98be-4659-8ce8-f72436a39b90 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode::GetValue - -This method gets the value and data type for the node. Interior (non-leaf) nodes may not have a value. - -## Syntax - -``` syntax -HRESULT GetValue([in,out] VARIANT* pvarValue); -``` - -## Parameters - -*pvarValue* -

      Data value to return. A node containing a password value returns 16 asterisks (‘\*’) for this method. A leaf node whose value has not been set returns a variant whose type is `VT_NULL`. -

      - -## Return Value - -A value of S\_OK indicates that a node was successfully found. CFGMGR\_E\_COMMANDNOTALLOWED indicates that this node does not support the **ICSP::GetValue** methods, or that this is an interior node. - -## Remarks - -For externally–transactioned nodes, this node is not required to implement any other methods for a successful rollback. - -## Requirements - -**Header:** None - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - - diff --git a/windows/client-management/mdm/icspnodemove.md b/windows/client-management/mdm/icspnodemove.md deleted file mode 100644 index 5540b3727d..0000000000 --- a/windows/client-management/mdm/icspnodemove.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: ICSPNode Move -description: ICSPNode Move -ms.assetid: efb359c3-5c86-4975-bf6f-a1c33922442a -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode::Move - -This method moves the node to a new location within the configuration service provider. If the target node already exists, it should be overwritten. - -## Syntax - -``` syntax -HRESULT Move([in] IConfigManager2URI* puriDestination); -``` - -## Parameters - -*puriDestination* -

      Path and name of the node's new location, relative to the configuration service provider's root node.

      - -## Return Value - -A value of S\_OK indicates that the node was successfully moved. CFGMGR\_E\_COMMANDNOTALLOWED indicates that this node does not support the **ICSP::Move** method. - -## Remarks - -For externally–transactioned nodes, if this method is implemented, then [ICSPNode::Add](icspnodeadd.md) and [ICSPNode::SetValue](icspnodesetvalue.md) must also be implemented or rollback will fail. - -## Requirements - -**Header:** None - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - - diff --git a/windows/client-management/mdm/icspnodesetproperty.md b/windows/client-management/mdm/icspnodesetproperty.md deleted file mode 100644 index 6f455d56f5..0000000000 --- a/windows/client-management/mdm/icspnodesetproperty.md +++ /dev/null @@ -1,56 +0,0 @@ ---- -title: ICSPNode SetProperty -description: ICSPNode SetProperty -ms.assetid: e235c38f-ea04-4cd8-adec-3c6c0ce7172d -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode::SetProperty - -This method sets a property value for a configuration service provider node. - -## Syntax - -``` syntax -HRESULT SetProperty([in] REFGUID guidProperty, - [in] VARIANT varValue); -``` - -## Parameters - -*guidProperty* -

      The GUID of the property.

      - -*varValue* -

      The value to return.

      - -## Return Value - -A value of S\_OK indicates that a node was successfully found. CFGMGR\_E\_COMMANDNOTSUPPORTED indicates that this node delegates the management of the property to ConfigManager2. - -## Remarks - -Every node must properly handle the CFGMGR\_PROPERTY\_DATATYPE property. - -For externally–transactioned nodes, no additional methods are required for successful rollback. - -## Requirements - -**Header:** None - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - - diff --git a/windows/client-management/mdm/icspnodesetvalue.md b/windows/client-management/mdm/icspnodesetvalue.md deleted file mode 100644 index eff2b58e9e..0000000000 --- a/windows/client-management/mdm/icspnodesetvalue.md +++ /dev/null @@ -1,50 +0,0 @@ ---- -title: ICSPNode SetValue -description: ICSPNode SetValue -ms.assetid: b218636d-fe8b-4a0f-b4e8-a621f65619d3 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNode::SetValue - -This method sets the value for the configuration service provider node. It is an error to attempt to set the value of an interior node. - -## Syntax - -``` syntax -HRESULT SetValue([in] VARIANT varValue); -``` - -## Parameters - -*varValue* -

      Value to set. To clear a leaf node’s value, set *varValue*’s type to `VT_NULL`.

      - -## Return Value - -A value of S\_OK indicates that the value was set successfully. CFGMGR\_E\_COMMANDNOTALLOWED indicates that this node does not support the **ICSP::SetValue** method, or that it's an internal node. - -## Remarks - -For externally–transactioned nodes, no additional methods must be implemented to support rollback. - -## Requirements - -**Header:** None - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - - diff --git a/windows/client-management/mdm/icspnodetransactioning.md b/windows/client-management/mdm/icspnodetransactioning.md deleted file mode 100644 index 4bb80100aa..0000000000 --- a/windows/client-management/mdm/icspnodetransactioning.md +++ /dev/null @@ -1,81 +0,0 @@ ---- -title: ICSPNodeTransactioning -description: ICSPNodeTransactioning -ms.assetid: 24dc518a-4a8d-41fe-9bc6-217bbbdf6a3f -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPNodeTransactioning - -This is an optional interface that enables a configuration service provider to define its own transactioning scheme (internal transactioning) for an individual node. Transactioning supports the ability to roll back previous actions on a node. The majority of nodes use external transactioning, which is handled automatically, and do not need to implement this interface. For more information about internal and external transactioning, including how to handle the `RollbackAction` functions, see "Determine node operations" in [Designing a custom configuration service provider](design-a-custom-windows-csp.md). - -``` syntax -interface ICSPNodeTransactioning : IUnknown -{ - HRESULT PersistRollbackAddState([in] IConfigManager2URI* puriChild, - [in] CFG_DATATYPE DataType, - [in] VARIANT varValue, - [in] ISequentialStream* pRollbackStream, - [in] ISequentialStream* pUninstallStream); - HRESULT PersistRollbackCopyState([in] IConfigManager2URI* puriDestination, - [in] ISequentialStream* pRollbackStream, - [in] ISequentialStream* pUninstallStream); - HRESULT PersistRollbackDeleteChildState([in] IConfigManager2URI* puriChild, - [in] ISequentialStream* pRollbackStream, - [in] ISequentialStream* pUninstallStream); - HRESULT PersistRollbackClearState([in] ISequentialStream* pRollbackStream, - [in] ISequentialStream* pUninstallStream); - HRESULT PersistRollbackExecuteState([in] VARIANT varUserData, - [in] ISequentialStream* pRollbackStream, - [in] ISequentialStream* pUninstallStream); - HRESULT PersistRollbackMoveState([in] IConfigManager2URI* puriDestination, - [in] ISequentialStream* pRollbackStream, - [in] ISequentialStream* pUninstallStream); - HRESULT PersistRollbackSetValueState([in] VARIANT varValue, - [in] ISequentialStream* pRollbackStream, - [in] ISequentialStream* pUninstallStream); - HRESULT PersistRollbackSetPropertyState([in] REFGUID guidProperty, - [in] VARIANT varValue, - [in] ISequentialStream* pRollbackStream, - [in] ISequentialStream* pUninstallStream); - HRESULT PersistRollbackDeletePropertyState([in] REFGUID guidProperty, - [in] ISequentialStream* pRollbackStream, - [in] ISequentialStream* pUninstallStream); - HRESULT RollbackAdd([in] ISequentialStream* pUndoStream, - [in] BOOL fRecoveryRollback); - HRESULT RollbackCopy([in] ISequentialStream* pUndoStream, - [in] BOOL fRecoveryRollback); - HRESULT RollbackDeleteChild([in] ISequentialStream* pUndoStream, - [in] BOOL fRecoveryRollback); - HRESULT RollbackClear([in] ISequentialStream* pUndoStream, - [in] BOOL fRecoveryRollback); - HRESULT RollbackExecute([in] ISequentialStream* pUndoStream, - [in] BOOL fRecoveryRollback); - HRESULT RollbackMove([in] ISequentialStream* pUndoStream, - [in] BOOL fRecoveryRollback); - HRESULT RollbackSetValue([in] ISequentialStream* pUndoStream, - [in] BOOL fRecoveryRollback); - HRESULT RollbackSetProperty([in] ISequentialStream* pUndoStream, - [in] BOOL fRecoveryRollback); - HRESULT RollbackDeleteProperty([in] ISequentialStream* pUndoStream, - [in] BOOL fRecoveryRollback); - - HRESULT Commit(); -}; -``` - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - diff --git a/windows/client-management/mdm/icspvalidate.md b/windows/client-management/mdm/icspvalidate.md deleted file mode 100644 index f1c05d21fd..0000000000 --- a/windows/client-management/mdm/icspvalidate.md +++ /dev/null @@ -1,52 +0,0 @@ ---- -title: ICSPValidate -description: ICSPValidate -ms.assetid: b0993f2d-6269-412f-a329-af25fff34ca2 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# ICSPValidate - -This interface is optional. It is called by ConfigManager2 as it batches commands before transactioning begins. This allows the configuration service provider to validate the node before performing specific actions. It is generally only used for configuration service providers that need to expose UI. - -``` syntax -interface ICSPValidate : IUnknown -{ - HRESULT ValidateAdd([in] IConfigNodeState* pNodeState, - [in] IConfigManager2URI* puriChild, - [in] CFG_DATATYPE DataType, - [in] VARIANT varValue); - HRESULT ValidateCopy([in] IConfigNodeState* pNodeState, - [in] IConfigManager2URI* puriDestination); - HRESULT ValidateDeleteChild([in] IConfigNodeState* pNodeState, - [in] IConfigManager2URI* puriChild); - HRESULT ValidateClear([in] IConfigNodeState* pNodeState); - HRESULT ValidateExecute([in] IConfigNodeState* pNodeState, - [in] VARIANT varUserData); - HRESULT ValidateMove([in] IConfigNodeState* pNodeState, - [in] IConfigManager2URI* puriDestination); - HRESULT ValidateSetValue([in] IConfigNodeState* pNodeState, - [in] VARIANT varValue); - HRESULT ValidateSetProperty([in] IConfigNodeState* pNodeState, - [in] REFGUID guidProperty, - [in] VARIANT varValue); - HRESULT ValidateDeleteProperty([in] IConfigNodeState* pNodeState, - [in] REFGUID guidProperty); -``` - -## Related topics - -[Create a custom configuration service provider](create-a-custom-configuration-service-provider.md) - -  - - - - - - diff --git a/windows/client-management/mdm/images/auto-enrollment-activation-verification-less-entries.png b/windows/client-management/mdm/images/auto-enrollment-activation-verification-less-entries.png new file mode 100644 index 0000000000..ef727d0fcd Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-activation-verification-less-entries.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-activation-verification.png b/windows/client-management/mdm/images/auto-enrollment-activation-verification.png new file mode 100644 index 0000000000..9b1667a307 Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-activation-verification.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-azure-ad-device-settings.png b/windows/client-management/mdm/images/auto-enrollment-azure-ad-device-settings.png new file mode 100644 index 0000000000..802d843215 Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-azure-ad-device-settings.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-azureadprt-verification.png b/windows/client-management/mdm/images/auto-enrollment-azureadprt-verification.png new file mode 100644 index 0000000000..8b0d779216 Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-azureadprt-verification.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-device-status-result.png b/windows/client-management/mdm/images/auto-enrollment-device-status-result.png new file mode 100644 index 0000000000..7f51dc49b8 Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-device-status-result.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-enrollment-of-windows-devices.png b/windows/client-management/mdm/images/auto-enrollment-enrollment-of-windows-devices.png new file mode 100644 index 0000000000..5f7fb2c44b Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-enrollment-of-windows-devices.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-event-id-102.png b/windows/client-management/mdm/images/auto-enrollment-event-id-102.png new file mode 100644 index 0000000000..39383a6d1c Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-event-id-102.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-event-id-107.png b/windows/client-management/mdm/images/auto-enrollment-event-id-107.png new file mode 100644 index 0000000000..ae6a64c677 Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-event-id-107.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-intune-license-verification.png b/windows/client-management/mdm/images/auto-enrollment-intune-license-verification.png new file mode 100644 index 0000000000..aecb539266 Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-intune-license-verification.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-mdm-discovery-url.png b/windows/client-management/mdm/images/auto-enrollment-mdm-discovery-url.png new file mode 100644 index 0000000000..6a6aee040f Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-mdm-discovery-url.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-microsoft-intune-setting.png b/windows/client-management/mdm/images/auto-enrollment-microsoft-intune-setting.png new file mode 100644 index 0000000000..8067b2c611 Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-microsoft-intune-setting.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-outdated-enrollment-entries.png b/windows/client-management/mdm/images/auto-enrollment-outdated-enrollment-entries.png new file mode 100644 index 0000000000..20285204d4 Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-outdated-enrollment-entries.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-task-scheduler.png b/windows/client-management/mdm/images/auto-enrollment-task-scheduler.png new file mode 100644 index 0000000000..91f85e0a3d Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-task-scheduler.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-troubleshooting-event-id-75.png b/windows/client-management/mdm/images/auto-enrollment-troubleshooting-event-id-75.png new file mode 100644 index 0000000000..8dbc3e57b0 Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-troubleshooting-event-id-75.png differ diff --git a/windows/client-management/mdm/images/auto-enrollment-troubleshooting-event-id-76.png b/windows/client-management/mdm/images/auto-enrollment-troubleshooting-event-id-76.png new file mode 100644 index 0000000000..7f222a32c7 Binary files /dev/null and b/windows/client-management/mdm/images/auto-enrollment-troubleshooting-event-id-76.png differ diff --git a/windows/client-management/mdm/images/autoenrollment-mdm-policies.png b/windows/client-management/mdm/images/autoenrollment-mdm-policies.png index 29cb6d14da..6833b4ac8b 100644 Binary files a/windows/client-management/mdm/images/autoenrollment-mdm-policies.png and b/windows/client-management/mdm/images/autoenrollment-mdm-policies.png differ diff --git a/windows/client-management/mdm/images/autoenrollment-policy.png b/windows/client-management/mdm/images/autoenrollment-policy.png index f9bb009514..61421babee 100644 Binary files a/windows/client-management/mdm/images/autoenrollment-policy.png and b/windows/client-management/mdm/images/autoenrollment-policy.png differ diff --git a/windows/client-management/mdm/images/azure-ad-device-list.png b/windows/client-management/mdm/images/azure-ad-device-list.png new file mode 100644 index 0000000000..607c36c307 Binary files /dev/null and b/windows/client-management/mdm/images/azure-ad-device-list.png differ diff --git a/windows/client-management/mdm/images/custom-profile-prevent-device-instance-ids.png b/windows/client-management/mdm/images/custom-profile-prevent-device-instance-ids.png new file mode 100644 index 0000000000..226f4850aa Binary files /dev/null and b/windows/client-management/mdm/images/custom-profile-prevent-device-instance-ids.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-applicationcontrol.png b/windows/client-management/mdm/images/provisioning-csp-applicationcontrol.png new file mode 100644 index 0000000000..012b0b392b Binary files /dev/null and b/windows/client-management/mdm/images/provisioning-csp-applicationcontrol.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-bitlocker.png b/windows/client-management/mdm/images/provisioning-csp-bitlocker.png index d3d33ff9f6..63ccb6fc89 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-bitlocker.png and b/windows/client-management/mdm/images/provisioning-csp-bitlocker.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-defender.png b/windows/client-management/mdm/images/provisioning-csp-defender.png index c4a743deeb..793b1568ff 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-defender.png and b/windows/client-management/mdm/images/provisioning-csp-defender.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-diagnosticlog.png b/windows/client-management/mdm/images/provisioning-csp-diagnosticlog.png index 44449d7e6f..a12415ae84 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-diagnosticlog.png and b/windows/client-management/mdm/images/provisioning-csp-diagnosticlog.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-enrollmentstatustracking.png b/windows/client-management/mdm/images/provisioning-csp-enrollmentstatustracking.png new file mode 100644 index 0000000000..3025185664 Binary files /dev/null and b/windows/client-management/mdm/images/provisioning-csp-enrollmentstatustracking.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png b/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png index 018354545f..5c90ec5a2b 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png and b/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-passportforwork2.png b/windows/client-management/mdm/images/provisioning-csp-passportforwork2.png index 8f804b9185..92585d5426 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-passportforwork2.png and b/windows/client-management/mdm/images/provisioning-csp-passportforwork2.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-supl-dmandcp.png b/windows/client-management/mdm/images/provisioning-csp-supl-dmandcp.png index 6c4c961a58..498ce66f47 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-supl-dmandcp.png and b/windows/client-management/mdm/images/provisioning-csp-supl-dmandcp.png differ diff --git a/windows/client-management/mdm/implement-server-side-mobile-application-management.md b/windows/client-management/mdm/implement-server-side-mobile-application-management.md index a96e092f35..481d57ea45 100644 --- a/windows/client-management/mdm/implement-server-side-mobile-application-management.md +++ b/windows/client-management/mdm/implement-server-side-mobile-application-management.md @@ -1,12 +1,14 @@ --- -title: Implement server-side support for mobile application management on Windows -description: The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP). -ms.author: maricia +title: Provide server-side support for mobile app management on Windows +description: The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: dansimp ms.date: 06/26/2017 +ms.reviewer: +manager: dansimp --- @@ -32,10 +34,10 @@ To make applications WIP-aware, app developers need to include the following dat ``` syntax // Mark this binary as Allowed for WIP (EDP) purpose  -    MICROSOFTEDPAUTOPROTECTIONALLOWEDAPPINFO EDPAUTOPROTECTIONALLOWEDAPPINFOID -     BEGIN -         0x0001 -     END  + MICROSOFTEDPAUTOPROTECTIONALLOWEDAPPINFO EDPAUTOPROTECTIONALLOWEDAPPINFOID + BEGIN + 0x0001 + END  ``` ## Configuring an Azure AD tenant for MAM enrollment @@ -57,15 +59,15 @@ Below are protocol changes for MAM enrollment:  Here is an example provisioning XML for MAM enrollment. -``` syntax +```xml -  -    -    -    -    -    -  + + + + + + + ``` @@ -149,20 +151,20 @@ We have updated Skype for Business to work with MAM. The following table explain -[Current channel](https://technet.microsoft.com/library/mt455210.aspx#BKMK_CB) +Current channel Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel. March 9 2017

      Visio Pro for Office 365

      -

      Project Online Desktop Client

      +

      Project Desktop Client

      Office 365 Business (the version of Office that comes with some Office 365 plans, such as Business Premium.)

      -[Deferred channel](https://technet.microsoft.com/library/mt455210.aspx#BKMK_CBB) +Deferred channel Provide users with new features of Office only a few times a year. October 10 2017 Office 365 ProPlus -[First release for deferred channel](https://technet.microsoft.com/library/mt455210.aspx#BKMK_FRCBB) +First release for deferred channel Provide pilot users and application compatibility testers the opportunity to test the next Deferred Channel. June 13 2017 diff --git a/windows/client-management/mdm/index.md b/windows/client-management/mdm/index.md index 2fbd4d1bce..44d416b67a 100644 --- a/windows/client-management/mdm/index.md +++ b/windows/client-management/mdm/index.md @@ -1,16 +1,15 @@ --- title: Mobile device management -description: Windows 10 provides an enterprise management solution to help IT pros manage company security policies and business applications, while avoiding compromise of the users’ privacy on their personal devices. +description: Windows 10 provides an enterprise-level solution to mobile management, to help IT pros comply with security policies while avoiding compromise of user's privacy MS-HAID: - 'p\_phDeviceMgmt.provisioning\_and\_device\_management' - 'p\_phDeviceMgmt.mobile\_device\_management\_windows\_mdm' ms.assetid: 50ac90a7-713e-4487-9cb9-b6d6fdaa4e5b -ms.author: jdecker +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: jdeckerms -ms.date: 01/25/2019 +author: dansimp --- # Mobile device management @@ -29,23 +28,29 @@ Third-party MDM servers can manage Windows 10 by using the MDM protocol. The bu With Windows 10, version 1809, Microsoft is also releasing a Microsoft MDM security baseline that functions like the Microsoft GP-based security baseline. You can easily integrate this baseline into any MDM to support IT pros’ operational needs, addressing security concerns for modern cloud-managed devices. ->[!NOTE] +> [!NOTE] >Intune support for the MDM security baseline is coming soon. The MDM security baseline includes policies that cover the following areas: -- Microsoft inbox security technology (not deprecated) such as Bitlocker, Smartscreen, and DeviceGuard (virtual-based security), ExploitGuard, Defender, and Firewall +- Microsoft inbox security technology (not deprecated) such as Bitlocker, Windows Defender Smartscreen, and DeviceGuard (virtual-based security), ExploitGuard, Defender, and Firewall - Restricting remote access to devices - Setting credential requirements for passwords and PINs - Restricting use of legacy technology - Legacy technology policies that offer alternative solutions with modern technology - And much more -For more details about the MDM policies defined in the MDM security baseline and what Microsoft’s recommended baseline policy values are, see [MDM Security baseline (Preview) for Windows 10, version 1809](http://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1809-MDM-SecurityBaseLine-Document-[Preview].zip). -For information about the MDM policies defined in the Intune security baseline public preview, see [Windows security baseline settings for Intune](https://docs.microsoft.com/en-us/intune/security-baseline-settings-windows) +For more details about the MDM policies defined in the MDM security baseline and what Microsoft’s recommended baseline policy values are, see: +- [MDM Security baseline for Windows 10, version 1909](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1909-MDM-SecurityBaseLine-Document.zip) +- [MDM Security baseline for Windows 10, version 1903](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1903-MDM-SecurityBaseLine-Document.zip) + +- [MDM Security baseline for Windows 10, version 1809](https://download.microsoft.com/download/2/C/4/2C418EC7-31E0-4A74-8928-6DCD512F9A46/1809-MDM-SecurityBaseLine-Document-[Preview].zip) + +For information about the MDM policies defined in the Intune security baseline public preview, see [Windows security baseline settings for Intune](https://docs.microsoft.com/intune/security-baseline-settings-windows) + ## Learn about migrating to MDM When an organization wants to move to MDM to manage devices, they should prepare by analyzing their current Group Policy settings to see what they need to transition to MDM management. Microsoft created the [MDM Migration Analysis Tool](https://aka.ms/mmat/) (MMAT) to help. MMAT determines which Group Policies have been set for a target user or computer and then generates a report that lists the level of support for each policy settings in MDM equivalents. For more information, see [MMAT Instructions](https://github.com/WindowsDeviceManagement/MMAT/blob/master/MDM%20Migration%20Analysis%20Tool%20Instructions.pdf). @@ -79,9 +84,9 @@ When an organization wants to move to MDM to manage devices, they should prepare - [Using PowerShell scripting with the WMI Bridge Provider](using-powershell-scripting-with-the-wmi-bridge-provider.md) - [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/hardware/dn905224) -  + -  + diff --git a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md index 1c0fd67bf1..f1f4f5b05f 100644 --- a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md +++ b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md @@ -5,11 +5,13 @@ MS-HAID: - 'p\_phdevicemgmt.business\_store\_portal\_management\_tool' - 'p\_phDeviceMgmt.management\_tool\_for\_windows\_store\_for\_business' ms.assetid: 0E39AE85-1703-4B24-9A7F-831C6455068F -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 10/27/2017 --- @@ -51,7 +53,7 @@ The Store for Business provides services that enable a management tool to synchr -  + ### Offline-licensed application distribution @@ -79,43 +81,7 @@ For code samples, see [Microsoft Azure Active Directory Samples and Documentatio ## Configure your Azure AD application -Here are the steps to configure your Azure AD app. For additional information, see [Integrating Applications with Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=623021): - -1. Log into Microsoft Azure Management Portal (https:manage.windowsazure.com) -2. Go to the Active Directory module. -3. Select your directory. -4. Click the **Applications** tab. - - ![business store management tool](images/businessstoreportalservices8.png) - -5. Click **Add**. - - ![business store management tool](images/businessstoreportalservices9.png) - -6. Select **Add an application that my organization is developing**. - - ![business store management tool](images/businessstoreportalservices10.png) - -7. Specify a name and then select **WEB APPLICATION AND/OR WEB API**. - - ![business store management tool](images/businessstoreportalservices11.png) - -8. Specify the **SIGN-ON URL** to your application. - - ![business store management tool](images/businessstoreportalservices12.png) - -9. Specify whether your app is multi-tenant or single tenant. For more information, see [Integrating Applications with Azure Active Directory](https://go.microsoft.com/fwlink/p/?LinkId=623021). - - ![business store management tool](images/businessstoreportalservices13.png) - -10. Create a client key. - - ![business store management tool](images/businessstoreportalservices14.png) - - > **Note**  In the prior version of the tool, an update to the app manifest was required to authorize the application. This is no longer necessary. -   -11. Login to Store for Business and enable your application. For step-by-step guide, see [Configure an MDM provider](https://technet.microsoft.com/library/mt606939.aspx). - +See [Quickstart: Register an application with the Microsoft identity platform](https://docs.microsoft.com/azure/active-directory/develop/quickstart-register-app) for the steps to configure your Azure AD app. ## Azure AD Authentication for MTS @@ -156,7 +122,7 @@ The diagram below shows the call patterns for acquiring a new or updated applica - [Bulk assign and reclaim seats for users](bulk-assign-and-reclaim-seats-from-user.md) - [Get seats assigned to a user](get-seats-assigned-to-a-user.md) -  + diff --git a/windows/client-management/mdm/maps-csp.md b/windows/client-management/mdm/maps-csp.md index 85296234bf..dd51d6cb8b 100644 --- a/windows/client-management/mdm/maps-csp.md +++ b/windows/client-management/mdm/maps-csp.md @@ -2,11 +2,13 @@ title: Maps CSP description: The Maps configuration service provider (CSP) is used to configure the maps to download to the device. This CSP was added in Windows 10, version 1511. ms.assetid: E5157296-7C31-4B08-8877-15304C9F6F26 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -17,7 +19,7 @@ The Maps configuration service provider (CSP) is used to configure the maps to d > **Note**  The Maps CSP is only supported in Windows 10 Mobile. -  + The following diagram shows the Maps configuration service provider in tree format. @@ -29,7 +31,7 @@ Root node. **Packages** Represents the map packages installed on the device. -**Packages/****_Package_** +**Packages/***Package* A GUID that represents a map package. When you add a *Package* node, Windows adds it to the queue for download to the device. See the table below for the list of various maps and corresponding GUIDS. **Packages/*Package*/Status** @@ -120,11 +122,11 @@ Here is a list of GUIDs of the most downloaded reqions. | Wisconsin | 0b5a98f7-489d-4a07-859b-4e01fe9e1b32 | | Wyoming | 360e0c25-a3bb-4e29-939a-3631eae46e9a | -  + Here is an example queuing a map package of New York for download. -``` syntax +```xml @@ -142,7 +144,7 @@ Here is an example queuing a map package of New York for download. Here is an example that gets the status of the New York map package on the device. -``` syntax +```xml @@ -158,9 +160,9 @@ Here is an example that gets the status of the New York map package on the devic ``` -  + -  + diff --git a/windows/client-management/mdm/maps-ddf-file.md b/windows/client-management/mdm/maps-ddf-file.md index b0788414da..517d02109c 100644 --- a/windows/client-management/mdm/maps-ddf-file.md +++ b/windows/client-management/mdm/maps-ddf-file.md @@ -2,11 +2,13 @@ title: Maps DDF file description: This topic shows the OMA DM device description framework (DDF) for the Maps configuration service provider. This CSP was added in Windows 10, version 1511. ms.assetid: EF22DBB6-0578-4FD0-B8A6-19DC03288FAF -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml **Note**  When you connect your device using mobile device management (MDM) enrollment, your organization may enforce certain policies on your device. -  + ## Connecting corporate-owned Windows 10-based devices @@ -37,7 +39,7 @@ Devices running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Educatio > **Note**  Mobile devices cannot be connected to an Active Directory domain. -  + ### Out-of-box-experience (OOBE) @@ -92,7 +94,7 @@ There are a few instances where your device cannot be connected to an Active Dir | You are logged in as a standard user. | Your device can only be connected to an Azure AD domain if you are logged in as an administrative user. You’ll need to switch to an administrator account to continue. | | Your device is running Windows 10 Home. | This feature is not available on Windows 10 Home, so you will be unable to connect to an Active Directory domain. You will need to upgrade to Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education to continue. | -  + ### Connecting your device to an Azure AD domain (Join Azure AD) @@ -165,7 +167,7 @@ There are a few instances where your device cannot be connected to an Azure AD d | Your device is already managed by MDM. | The connect to Azure AD flow will attempt to enroll your device into MDM if your Azure AD tenant has a preconfigured MDM endpoint. Your device must be unenrolled from MDM to be able to connect to Azure AD in this case. | | Your device is running Windows 10 Home. | This feature is not available on Windows 10 Home, so you will be unable to connect to an Azure AD domain. You will need to upgrade to Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education to continue. | -  + ## Connecting personally-owned devices (Bring your own device) @@ -214,33 +216,33 @@ All Windows 10-based devices can be connected to an MDM. You can connect to an ### Using the Settings app -1. Launch the Settings app. +1. Launch the Settings app. - ![windows settings page](images/unifiedenrollment-rs1-28.png) + ![windows settings page](images/unifiedenrollment-rs1-28.png) -2. Next, navigate to **Accounts**. +2. Next, navigate to **Accounts**. - ![windows settings accounts page](images/unifiedenrollment-rs1-29.png) + ![windows settings accounts page](images/unifiedenrollment-rs1-29.png) -3. Navigate to **Access work or school**. +3. Navigate to **Access work or school**. - ![access work or school](images/unifiedenrollment-rs1-30.png) + ![access work or school](images/unifiedenrollment-rs1-30.png) -4. Click the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934) . For older builds, use [Connecting your Windows 10-based device to work using a deep link](#connecting-your-windows-10-based-device-to-work-using-a-deep-link). +4. Click the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, use [Connecting your Windows 10-based device to work using a deep link](#connecting-your-windows-10-based-device-to-work-using-a-deep-link). - ![connect to work or school](images/unifiedenrollment-rs1-31.png) + ![connect to work or school](images/unifiedenrollment-rs1-31.png) -5. Type in your work email address. +5. Type in your work email address. - ![set up work or school account](images/unifiedenrollment-rs1-32.png) + ![set up work or school account](images/unifiedenrollment-rs1-32.png) -6. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. +6. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. - Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. Starting in Windows 10, version 1709, you will see the enrollment progress on screen. + Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. Starting in Windows 10, version 1709, you will see the enrollment progress on screen. - ![corporate sign in](images/unifiedenrollment-rs1-33-b.png) + ![corporate sign in](images/unifiedenrollment-rs1-33-b.png) - After you complete the flow, your device will be connected to your organization’s MDM. + After you complete the flow, your device will be connected to your organization’s MDM. ### Connecting to MDM on a phone (Enrolling in device management) @@ -277,13 +279,12 @@ There are a few instances where your device may not be able to connect to work, |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------| | Your device is already connected to your organization’s cloud. | Your device is already connected to either Azure AD, a work or school account, or an AD domain. | | We could not find your identity in your organization’s cloud. | The username you entered was not found on your Azure AD tenant. | -| Your device is already being managed by an organization. | Your device is either already managed by MDM or System Center Configuration Manager. | +| Your device is already being managed by an organization. | Your device is either already managed by MDM or Microsoft Endpoint Configuration Manager. | | You don’t have the right privileges to perform this operation. Please talk to your admin. | You cannot enroll your device into MDM as a standard user. You must be on an administrator account. | | We couldn’t auto-discover a management endpoint matching the username entered. Please check your username and try again. If you know the URL to your management endpoint, please enter it. | You need to provide the server URL for your MDM or check the spelling of the username you entered. | -  - -## Connecting your Windows 10-based device to work using a deep link + +## Connecting your Windows 10-based device to work using a deep link Windows 10-based devices may be connected to work using a deep link. Users will be able to click or open a link in a particular format from anywhere in Windows 10 and be directed to the new enrollment experience. @@ -296,7 +297,7 @@ The deep link used for connecting your device to work will always use the follow | Parameter | Description | Supported Value for Windows 10| |-----------|--------------------------------------------------------------|----------------------------------------------| -| mode | Describes which mode will be executed in the enrollment app. Added in Windows 10, version 1607| “mdm”, "awa", "aadj" | +| mode | Describes which mode will be executed in the enrollment app. Added in Windows 10, version 1607| MDM (Mobile Device Management), AWA (Adding Work Account), and AADJ (Azure Active Directory Joined). | |username | Specifies the email address or UPN of the user who should be enrolled into MDM. Added in Windows 10, version 1703. | string | | servername | Specifies the MDM server URL that will be used to enroll the device. Added in Windows 10, version 1703. | string| | accesstoken | Custom parameter for MDM servers to use as they see fit. Typically, this can be used as a token to validate the enrollment request. Added in Windows 10, version 1703. | string | @@ -313,7 +314,7 @@ The deep link used for connecting your device to work will always use the follow When connecting to MDM using a deep link, the URI you should use is **ms-device-enrollment:?mode=mdm** -**ms-device-enrollment:?mode=mdm&username=someone@example.com&servername=https://example.server.com** +**ms-device-enrollment:?mode=mdm&username=someone@example.com&servername=** The following procedure describes how users can connect their devices to MDM using deep links. @@ -358,11 +359,12 @@ The **Info** button can be found on work or school connections involving MDM. Th Clicking the **Info** button will open a new page in the Settings app that provides details about your MDM connection. You’ll be able to view your organization’s support information (if configured) on this page. You’ll also be able to start a sync session which will force your device to communicate to the MDM server and fetch any updates to policies if needed. -Starting in Windows 10, version 1709, clicking the **Info** button will show a list of policies and line-of-business apps installed by your organization. Here is an example screehshot. +Starting in Windows 10, version 1709, clicking the **Info** button will show a list of policies and line-of-business apps installed by your organization. Here is an example screenshot. ![work or school info](images/unifiedenrollment-rs1-35-b.png) -> [Note] Starting in Windows 10, version 1709, the **Manage** button is no longer available. +> [NOTE] +> Starting in Windows 10, version 1709, the **Manage** button is no longer available. ### Disconnect @@ -382,7 +384,7 @@ Starting in Windows 10, version 1709, you can get the advanced diagnostic report ![collecting enrollment management log files](images/unifiedenrollment-rs1-37-c.png) -  + diff --git a/windows/client-management/mdm/messaging-csp.md b/windows/client-management/mdm/messaging-csp.md index a8b9de322a..e7fcc04cf0 100644 --- a/windows/client-management/mdm/messaging-csp.md +++ b/windows/client-management/mdm/messaging-csp.md @@ -1,12 +1,14 @@ --- title: Messaging CSP description: Messaging CSP -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 +ms.reviewer: +manager: dansimp --- # Messaging CSP @@ -22,7 +24,7 @@ The following diagram shows the Messaging configuration service provider in tree

      Root node for the Messaging configuration service provider.

      **AuditingLevel** -

      Turns on the "Text" auditing feature.

      +

      Turns on the "Text" auditing feature.

      The following list shows the supported values:

      • 0 (Default) - Off
        • @@ -53,7 +55,7 @@ The following diagram shows the Messaging configuration service provider in tree **SyncML example** -``` syntax +```xml diff --git a/windows/client-management/mdm/messaging-ddf.md b/windows/client-management/mdm/messaging-ddf.md index 67dc397e58..3dd896d26b 100644 --- a/windows/client-management/mdm/messaging-ddf.md +++ b/windows/client-management/mdm/messaging-ddf.md @@ -1,12 +1,14 @@ --- title: Messaging DDF file description: Messaging DDF file -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 +ms.reviewer: +manager: dansimp --- # Messaging DDF file @@ -17,7 +19,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml http://schemas.microsoft.com/windows/pki/2009/01/enrollment/rstrc/wstep @@ -198,7 +200,7 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. Here is an example: -``` syntax +```xml http://schemas.microsoft.com/windows/pki/2009/01/enrollment/rstrc/wstep diff --git a/windows/client-management/mdm/multisim-csp.md b/windows/client-management/mdm/multisim-csp.md index 1b3e56a680..7d719b40aa 100644 --- a/windows/client-management/mdm/multisim-csp.md +++ b/windows/client-management/mdm/multisim-csp.md @@ -1,12 +1,14 @@ --- title: MultiSIM CSP description: MultiSIM CSP allows the enterprise to manage devices with dual SIM single active configuration. -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 03/22/2018 +ms.reviewer: +manager: dansimp --- # MultiSIM CSP @@ -72,7 +74,7 @@ Supported operation is Get and Replace. Value type is bool. ## Examples Get modem -``` syntax +```xml @@ -91,7 +93,7 @@ Get modem ``` Get slots -``` syntax +```xml @@ -110,7 +112,7 @@ Get slots ``` Get slot state -``` syntax +```xml @@ -129,7 +131,7 @@ Get slot state ``` Select slot -``` syntax +```xml @@ -150,4 +152,4 @@ Select slot -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/multisim-ddf.md b/windows/client-management/mdm/multisim-ddf.md index 54c76ae742..2e34159750 100644 --- a/windows/client-management/mdm/multisim-ddf.md +++ b/windows/client-management/mdm/multisim-ddf.md @@ -1,12 +1,14 @@ --- title: MultiSIM DDF file -description: XML file containing the device description framework -ms.author: maricia +description: XML file containing the device description framework for the MultiSIM configuration service provider. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 02/27/2018 +ms.reviewer: +manager: dansimp --- # MultiSIM CSP @@ -16,7 +18,7 @@ This topic shows the OMA DM device description framework (DDF) for the **MultiSI The XML below is for Windows 10, version 1803. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/nap-csp.md b/windows/client-management/mdm/nap-csp.md index ba2ef8f0b2..c4dbd6410a 100644 --- a/windows/client-management/mdm/nap-csp.md +++ b/windows/client-management/mdm/nap-csp.md @@ -2,11 +2,13 @@ title: NAP CSP description: NAP CSP ms.assetid: 82f04492-88a6-4afd-af10-a62b8d444d21 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md index f94af70c0f..80a87e53d1 100644 --- a/windows/client-management/mdm/napdef-csp.md +++ b/windows/client-management/mdm/napdef-csp.md @@ -2,11 +2,13 @@ title: NAPDEF CSP description: NAPDEF CSP ms.assetid: 9bcc65dd-a72b-4f90-aba7-4066daa06988 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -16,12 +18,12 @@ ms.date: 06/26/2017 The NAPDEF configuration service provider is used to add, modify, or delete WAP network access points (NAPs). For complete information about these settings, see the standard WAP specification WAP-183-ProvCont-20010724-a. > **Note**  You cannot use NAPDEF CSP on the desktop to update the Push Proxy Gateway (PPG) list. - -  - +> +> +> > **Note**   This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_NETWORKING\_ADMIN capabilities to be accessed from a network configuration application. -  + The following diagram shows the NAPDEF configuration service provider management object in tree format as used by OMA Client Provisioning for **initial bootstrapping of the phone**. The OMA DM protocol is not supported by this configuration service provider. @@ -49,7 +51,7 @@ The only permitted values for this element are "POP" (Password Authentication Pr > **Note**  **AuthName** and **AuthSecret** are not created if **AuthType** is not included in the initial device configuration. **AuthName** and **AuthSecret** cannot be changed if **AuthType** is not included in the provisioning XML used to make the change. -  + **BEARER** Specifies the type of bearer. @@ -129,16 +131,16 @@ The following table shows the Microsoft custom elements that this configuration -  + ## Related topics [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md index 563f13334a..c82e246263 100644 --- a/windows/client-management/mdm/networkproxy-csp.md +++ b/windows/client-management/mdm/networkproxy-csp.md @@ -1,19 +1,21 @@ --- title: NetworkProxy CSP description: NetworkProxy CSP -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 08/29/2018 +ms.reviewer: +manager: dansimp --- # NetworkProxy CSP The NetworkProxy configuration service provider (CSP) is used to configure a proxy server for ethernet and Wi-Fi connections. These settings do not apply to VPN connections. This CSP was added in Windows 10, version 1703. -> [!Note] +> [!NOTE] > In Windows 10 Mobile, the NetworkProxy CSP only works in ethernet connections. Use the WiFi CSP to configure per-network proxy for Wi-Fi connections in mobile devices. How the settings work: @@ -38,10 +40,10 @@ Added in Windows 10, version 1803. When set to 0, it enables proxy configuration Supported operations are Add, Get, Replace, and Delete. -> [!Note] -> Per user proxy configuration setting is not supported. +> [!Note] +> Per user proxy configuration setting is not supported using a configuration file, only modifying registry settings on a local machine. -**AutoDetect** +**AutoDetect** Automatically detect settings. If enabled, the system tries to find the path to a PAC script. Valid values: @@ -50,12 +52,12 @@ Valid values:
      • 1 (default) - Enabled
      -The data type is int. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported. +The data type is integer. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. -**SetupScriptUrl** +**SetupScriptUrl** Address to the PAC script you want to use. -The data type is string. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported. +The data type is string. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. **ProxyServer** Node for configuring a static proxy for Ethernet and Wi-Fi connections. The same proxy server is used for all protocols - including HTTP, HTTPS, FTP, and SOCKS. These settings do not apply to VPN connections. @@ -65,19 +67,70 @@ Supported operation is Get. **ProxyAddress** Address to the proxy server. Specify an address in the format <server>[“:”<port>].  -The data type is string. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported. +The data type is string. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. **Exceptions** Addresses that should not use the proxy server. The system will not use the proxy server for addresses beginning with what is specified in this node. Use semicolons (;) to separate entries.  -The data type is string. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported. +The data type is string. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. **UseProxyForLocalAddresses** Specifies whether the proxy server should be used for local (intranet) addresses.  Valid values:
        -
      • 0 (default) - Do not use proxy server for local addresses
        • -
      • 1 - Use proxy server for local addresses
        • +
      • 0 (default) - Use proxy server for local addresses
        • +
      • 1 - Do not use proxy server for local addresses
      -The data type is int. Supported operations are Get and Replace. Starting in Window 10, version 1803, the Delete operation is also supported. +The data type is integer. Supported operations are Get and Replace. Starting in Windows 10, version 1803, the Delete operation is also supported. + +## Configuration Example + +These generic code portions for the options **ProxySettingsPerUser**, **Autodetect**, and **SetupScriptURL** can be used for a specific operation, for example Replace. Only enter the portion of code needed in the **Replace** section. +```xml + + 1 + + + ./Vendor/MSFT/NetworkProxy/ProxySettingsPerUser + + + int + text/plain + + 0 + + +``` + +```xml + + 2 + + + ./Vendor/MSFT/NetworkProxy/AutoDetect + + + int + text/plain + + 1 + + +``` + +```xml + + 3 + + + ./Vendor/MSFT/NetworkProxy/SetupScriptUrl + + + chr + text/plain + + Insert the proxy PAC URL location here: + + +``` diff --git a/windows/client-management/mdm/networkproxy-ddf.md b/windows/client-management/mdm/networkproxy-ddf.md index b8fbd90dbc..226b6ca0ba 100644 --- a/windows/client-management/mdm/networkproxy-ddf.md +++ b/windows/client-management/mdm/networkproxy-ddf.md @@ -1,12 +1,14 @@ --- title: NetworkProxy DDF file description: AppNetworkProxyLocker DDF file -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 +ms.reviewer: +manager: dansimp --- # NetworkProxy DDF file @@ -17,7 +19,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/networkqospolicy-csp.md b/windows/client-management/mdm/networkqospolicy-csp.md index 4ccc4536e2..ee81816701 100644 --- a/windows/client-management/mdm/networkqospolicy-csp.md +++ b/windows/client-management/mdm/networkqospolicy-csp.md @@ -1,12 +1,14 @@ --- title: NetworkQoSPolicy CSP description: he NetworkQoSPolicy CSP applies the Quality of Service (QoS) policy for Microsoft Surface Hub. This CSP was added in Windows 10, version 1703. -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 +ms.reviewer: +manager: dansimp --- # NetworkQoSPolicy CSP @@ -14,13 +16,13 @@ ms.date: 06/26/2017 The NetworkQoSPolicy configuration service provider creates network Quality of Service (QoS) policies. A QoS policy performs a set of actions on network traffic based on a set of matching conditions. This CSP was added in Windows 10, version 1703. The following conditions are supported: -- Network traffic from a specific application name -- Network traffic from specific source or destination ports -- Network traffic from a specific IP protocol (TCP, UDP, or both) +- Network traffic from a specific application name +- Network traffic from specific source or destination ports +- Network traffic from a specific IP protocol (TCP, UDP, or both) The following actions are supported: -- Layer 2 tagging using a IEEE 802.1p priority value -- Layer 3 tagging using a differentiated services code point (DSCP) value +- Layer 2 tagging using a IEEE 802.1p priority value +- Layer 3 tagging using a differentiated services code point (DSCP) value > [!NOTE] > The NetworkQoSPolicy configuration service provider is supported only in Microsoft Surface Hub. @@ -39,30 +41,30 @@ The following diagram shows the NetworkQoSPolicy configuration service provider

      The only supported operation is Get. -**_Name_** +***Name***

      Node for the QoS policy name. -**_Name_/IPProtocolMatchCondition** +***Name*/IPProtocolMatchCondition**

      Specifies the IP protocol used to match the network traffic.

      Valid values are: - - 0 (default) - Both TCP and UDP - - 1 - TCP - - 2 - UDP +- 0 (default) - Both TCP and UDP +- 1 - TCP +- 2 - UDP

      The data type is int.

      The supported operations are Add, Get, Delete, and Replace. -**_Name_/AppPathNameMatchCondition** +***Name*/AppPathNameMatchCondition**

      Specifies the name of an application to be used to match the network traffic, such as application.exe or %ProgramFiles%\application.exe.

      The data type is char.

      The supported operations are Add, Get, Delete, and Replace. -**_Name_/SourcePortMatchCondition** +***Name*/SourcePortMatchCondition**

      Specifies a single port or a range of ports to be used to match the network traffic source.

      Valid values are: @@ -74,7 +76,7 @@ The following diagram shows the NetworkQoSPolicy configuration service provider

      The supported operations are Add, Get, Delete, and Replace. -**_Name_/DestinationPortMatchCondition** +***Name*/DestinationPortMatchCondition**

      Specifies a single source port or a range of ports to be used to match the network traffic destination.

      Valid values are: @@ -86,7 +88,7 @@ The following diagram shows the NetworkQoSPolicy configuration service provider

      The supported operations are Add, Get, Delete, and Replace. -**_Name_/PriorityValue8021Action** +***Name*/PriorityValue8021Action**

      Specifies the IEEE 802.1p priority value to apply to matching network traffic.

      Valid values are 0-7. @@ -95,7 +97,7 @@ The following diagram shows the NetworkQoSPolicy configuration service provider

      The supported operations are Add, Get, Delete, and Replace. -**_Name_/DSCPAction** +***Name*/DSCPAction**

      The differentiated services code point (DSCP) value to apply to matching network traffic.

      Valid values are 0-63. @@ -104,3 +106,10 @@ The following diagram shows the NetworkQoSPolicy configuration service provider

      The supported operations are Add, Get, Delete, and Replace. + +## Related topics + +Read more about the XML DDF structure to create this policy by following the links below: + +- [More Information about DDF and structure](networkqospolicy-ddf.md) +- [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download) diff --git a/windows/client-management/mdm/networkqospolicy-ddf.md b/windows/client-management/mdm/networkqospolicy-ddf.md index 12c6572869..7535a3ce20 100644 --- a/windows/client-management/mdm/networkqospolicy-ddf.md +++ b/windows/client-management/mdm/networkqospolicy-ddf.md @@ -1,12 +1,14 @@ --- title: NetworkQoSPolicy DDF -description: This topic shows the OMA DM device description framework (DDF) for the NetworkQoSPolicy configuration service provider. DDF files are used only with OMA DM provisioning XML. +description: View the OMA DM device description framework (DDF) for the NetworkQoSPolicy configuration service provider. DDF files are used only with OMA DM provisioning XML ms.assetid: -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -18,7 +20,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml What's new in Windows 10, version 1511](#a-href%22%22-id%22whatsnew%22awhats-new-in-windows-10-version-1511) - - [What's new in Windows 10, version 1607](#a-href%22%22-id%22whatsnew1607%22awhats-new-in-windows-10-version-1607) - - [What's new in Windows 10, version 1703](#a-href%22%22-id%22whatsnew10%22awhats-new-in-windows-10-version-1703) - - [What's new in Windows 10, version 1709](#a-href%22%22-id%22whatsnew1709%22awhats-new-in-windows-10-version-1709) - - [What's new in Windows 10, version 1803](#a-href%22%22-id%22whatsnew1803%22awhats-new-in-windows-10-version-1803) - - [What's new in Windows 10, version 1809](#a-href%22%22-id%22whatsnew1809%22awhats-new-in-windows-10-version-1809) - - [Breaking changes and known issues](#breaking-changes-and-known-issues) - - [Get command inside an atomic command is not supported](#a-href%22%22-id%22getcommand%22aget-command-inside-an-atomic-command-is-not-supported) - - [Notification channel URI not preserved during upgrade from Windows 8.1 to Windows 10](#a-href%22%22-id%22notification%22anotification-channel-uri-not-preserved-during-upgrade-from-windows-81-to-windows-10) - - [Apps installed using WMI classes are not removed](#a-href%22%22-id%22appsnotremoved%22aapps-installed-using-wmi-classes-are-not-removed) - - [Passing CDATA in SyncML does not work](#a-href%22%22-id%22cdata%22apassing-cdata-in-syncml-does-not-work) - - [SSL settings in IIS server for SCEP must be set to "Ignore"](#a-href%22%22-id%22sslsettings%22assl-settings-in-iis-server-for-scep-must-be-set-to-%22ignore%22) - - [MDM enrollment fails on the mobile device when traffic is going through proxy](#a-href%22%22-id%22enrollmentviaproxy%22amdm-enrollment-fails-on-the-mobile-device-when-traffic-is-going-through-proxy) - - [Server-initiated unenrollment failure](#a-href%22%22-id%22unenrollment%22aserver-initiated-unenrollment-failure) - - [Certificates causing issues with Wi-Fi and VPN](#a-href%22%22-id%22certissues%22acertificates-causing-issues-with-wi-fi-and-vpn) - - [Version information for mobile devices](#a-href%22%22-id%22versioninformation%22aversion-information-for-mobile-devices) - - [Upgrading Windows Phone 8.1 devices with app whitelisting using ApplicationRestriction policy has issues](#a-href%22%22-id%22whitelist%22aupgrading-windows-phone-81-devices-with-app-whitelisting-using-applicationrestriction-policy-has-issues) - - [Apps dependent on Microsoft Frameworks may get blocked in phones prior to build 10586.218](#a-href%22%22-id%22frameworks%22aapps-dependent-on-microsoft-frameworks-may-get-blocked-in-phones-prior-to-build-10586218) - - [Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile](#a-href%22%22-id%22wificertissue%22amultiple-certificates-might-cause-wi-fi-connection-instabilities-in-windows-10-mobile) - - [Remote PIN reset not supported in Azure Active Directory joined mobile devices](#a-href%22%22-id%22remote%22aremote-pin-reset-not-supported-in-azure-active-directory-joined-mobile-devices) - - [MDM client will immediately check-in with the MDM server after client renews WNS channel URI](#a-href%22%22-id%22renewwns%22amdm-client-will-immediately-check-in-with-the-mdm-server-after-client-renews-wns-channel-uri) - - [User provisioning failure in Azure Active Directory joined Windows 10 PC](#a-href%22%22-id%22userprovisioning%22auser-provisioning-failure-in-azure-active-directory-joined-windows-10-pc) - - [Requirements to note for VPN certificates also used for Kerberos Authentication](#a-href%22%22-id%22kerberos%22arequirements-to-note-for-vpn-certificates-also-used-for-kerberos-authentication) - - [Device management agent for the push-button reset is not working](#a-href%22%22-id%22pushbuttonreset%22adevice-management-agent-for-the-push-button-reset-is-not-working) - - [Change history in MDM documentation](#change-history-in-mdm-documentation) +- **Breaking changes and known issues** + - [Get command inside an atomic command is not supported](#get-command-inside-an-atomic-command-is-not-supported) + - [Notification channel URI not preserved during upgrade from Windows 8.1 to Windows 10](#notification-channel-uri-not-preserved-during-upgrade-from-windows-81-to-windows-10) + - [Apps installed using WMI classes are not removed](#apps-installed-using-wmi-classes-are-not-removed) + - [Passing CDATA in SyncML does not work](#passing-cdata-in-syncml-does-not-work) + - [SSL settings in IIS server for SCEP must be set to "Ignore"](#ssl-settings-in-iis-server-for-scep-must-be-set-to-ignore) + - [MDM enrollment fails on the mobile device when traffic is going through proxy](#mdm-enrollment-fails-on-the-mobile-device-when-traffic-is-going-through-proxy) + - [Server-initiated unenrollment failure](#server-initiated-unenrollment-failure) + - [Certificates causing issues with Wi-Fi and VPN](#certificates-causing-issues-with-wi-fi-and-vpn) + - [Version information for mobile devices](#version-information-for-mobile-devices) + - [Upgrading Windows Phone 8.1 devices with app whitelisting using ApplicationRestriction policy has issues](#upgrading-windows-phone-81-devices-with-app-whitelisting-using-applicationrestriction-policy-has-issues) + - [Apps dependent on Microsoft Frameworks may get blocked in phones prior to build 10586.218](#apps-dependent-on-microsoft-frameworks-may-get-blocked-in-phones-prior-to-build-10586218) + - [Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile](#multiple-certificates-might-cause-wi-fi-connection-instabilities-in-windows-10-mobile) + - [Remote PIN reset not supported in Azure Active Directory joined mobile devices](#remote-pin-reset-not-supported-in-azure-active-directory-joined-mobile-devices) + - [MDM client will immediately check-in with the MDM server after client renews WNS channel URI](#mdm-client-will-immediately-check-in-with-the-mdm-server-after-client-renews-wns-channel-uri) + - [User provisioning failure in Azure Active Directory joined Windows 10 PC](#user-provisioning-failure-in-azure-active-directory-joined-windows-10-pc) + - [Requirements to note for VPN certificates also used for Kerberos Authentication](#requirements-to-note-for-vpn-certificates-also-used-for-kerberos-authentication) + - [Device management agent for the push-button reset is not working](#device-management-agent-for-the-push-button-reset-is-not-working) + +- **Frequently Asked Questions** + - [Can there be more than 1 MDM server to enroll and manage devices in Windows 10?](#can-there-be-more-than-1-mdm-server-to-enroll-and-manage-devices-in-windows-10) + - [How do I set the maximum number of Azure Active Directory joined devices per user?](#how-do-i-set-the-maximum-number-of-azure-active-directory-joined-devices-per-user) + - [What is dmwappushsvc?](#what-is-dmwappushsvc) + +- **Change history in MDM documentation** + - [January 2020](#january-2020) + - [November 2019](#november-2019) + - [October 2019](#october-2019) + - [September 2019](#september-2019) + - [August 2019](#august-2019) + - [July 2019](#july-2019) + - [June 2019](#june-2019) + - [May 2019](#may-2019) + - [April 2019](#april-2019) + - [March 2019](#march-2019) - [February 2019](#february-2019) - [January 2019](#january-2019) - [December 2018](#december-2018) @@ -66,9 +85,696 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [October 2017](#october-2017) - [September 2017](#september-2017) - [August 2017](#august-2017) - - [FAQ](#faq) -## What's new in Windows 10, version 1511 +## What’s new in MDM for Windows 10, version 1909 + ++++ + + + + + + + + + + + +
      New or updated topicDescription
      BitLocker CSP
      Added the following new nodes in Windows 10, version 1909:

      +ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID. +
      + +## What’s new in MDM for Windows 10, version 1903 + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      New or updated topicDescription
      Policy CSP

      Added the following new policies in Windows 10, version 1903:

      +
      Policy CSP - Audit

      Added new Audit policies in Windows 10, version 1903.

      +
      ApplicationControl CSP

      Added new CSP in Windows 10, version 1903.

      +
      Defender CSP

      Added the following new nodes:
      Health/TamperProtectionEnabled, Health/IsVirtualMachine, Configuration, Configuration/TamperProtection, Configuration/EnableFileHashComputation.

      +
      DiagnosticLog CSP
      +DiagnosticLog DDF

      Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
      +Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults. +

      +
      EnrollmentStatusTracking CSP

      Added new CSP in Windows 10, version 1903.

      +
      PassportForWork CSP

      Added the following new nodes in Windows 10, version 1903:
      SecurityKey, SecurityKey/UseSecurityKeyForSignin

      +
      + +## What’s new in MDM for Windows 10, version 1809 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      New or updated topicDescription
      Policy CSP

      Added the following new policies in Windows 10, version 1809:

      +
        +
      • ApplicationManagement/LaunchAppAfterLogOn
        • +
      • ApplicationManagement/ScheduleForceRestartForUpdateFailures
        • +
      • Authentication/EnableFastFirstSignIn (Preview mode only)
        • +
      • Authentication/EnableWebSignIn (Preview mode only)
        • +
      • Authentication/PreferredAadTenantDomainName
        • +
      • Browser/AllowFullScreenMode
        • +
      • Browser/AllowPrelaunch
        • +
      • Browser/AllowPrinting
        • +
      • Browser/AllowSavingHistory
        • +
      • Browser/AllowSideloadingOfExtensions
        • +
      • Browser/AllowTabPreloading
        • +
      • Browser/AllowWebContentOnNewTabPage
        • +
      • Browser/ConfigureFavoritesBar
        • +
      • Browser/ConfigureHomeButton
        • +
      • Browser/ConfigureKioskMode
        • +
      • Browser/ConfigureKioskResetAfterIdleTimeout
        • +
      • Browser/ConfigureOpenMicrosoftEdgeWith
        • +
      • Browser/ConfigureTelemetryForMicrosoft365Analytics
        • +
      • Browser/PreventCertErrorOverrides
        • +
      • Browser/SetHomeButtonURL
        • +
      • Browser/SetNewTabPageURL
        • +
      • Browser/UnlockHomeButton
        • +
      • Defender/CheckForSignaturesBeforeRunningScan
        • +
      • Defender/DisableCatchupFullScan
        • +
      • Defender/DisableCatchupQuickScan
        • +
      • Defender/EnableLowCPUPriority
        • +
      • Defender/SignatureUpdateFallbackOrder
        • +
      • Defender/SignatureUpdateFileSharesSources
        • +
      • DeviceGuard/ConfigureSystemGuardLaunch
        • +
      • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
        • +
      • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
        • +
      • DeviceInstallation/PreventDeviceMetadataFromNetwork
        • +
      • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
        • +
      • DmaGuard/DeviceEnumerationPolicy
        • +
      • Experience/AllowClipboardHistory
        • +
      • Experience/DoNotSyncBrowserSettings
        • +
      • Experience/PreventUsersFromTurningOnBrowserSyncing
        • +
      • Kerberos/UPNNameHints
        • +
      • Privacy/AllowCrossDeviceClipboard
        • +
      • Privacy/DisablePrivacyExperience
        • +
      • Privacy/UploadUserActivities
        • +
      • Security/RecoveryEnvironmentAuthentication
        • +
      • System/AllowDeviceNameInDiagnosticData
        • +
      • System/ConfigureMicrosoft365UploadEndpoint
        • +
      • System/DisableDeviceDelete
        • +
      • System/DisableDiagnosticDataViewer
        • +
      • Storage/RemovableDiskDenyWriteAccess
        • +
      • TaskManager/AllowEndTask
        • +
      • Update/EngagedRestartDeadlineForFeatureUpdates
        • +
      • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
        • +
      • Update/EngagedRestartTransitionScheduleForFeatureUpdates
        • +
      • Update/SetDisablePauseUXAccess
        • +
      • Update/SetDisableUXWUAccess
        • +
      • WindowsDefenderSecurityCenter/DisableClearTpmButton
        • +
      • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
        • +
      • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
        • +
      • WindowsLogon/DontDisplayNetworkSelectionUI
        • +
      +
      PassportForWork CSP

      Added new settings in Windows 10, version 1809.

      +
      EnterpriseModernAppManagement CSP

      Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

      +
      Win32CompatibilityAppraiser CSP

      Added new configuration service provider in Windows 10, version 1809.

      +
      WindowsLicensing CSP

      Added S mode settings and SyncML examples in Windows 10, version 1809.

      +
      SUPL CSP

      Added 3 new certificate nodes in Windows 10, version 1809.

      +
      Defender CSP

      Added a new node Health/ProductStatus in Windows 10, version 1809.

      +
      BitLocker CSP

      Added a new node AllowStandardUserEncryption in Windows 10, version 1809. Added support for Windows 10 Pro.

      +
      DevDetail CSP

      Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

      +
      Wifi CSP

      Added a new node WifiCost in Windows 10, version 1809.

      +
      WindowsDefenderApplicationGuard CSP

      Added new settings in Windows 10, version 1809.

      +
      RemoteWipe CSP

      Added new settings in Windows 10, version 1809.

      +
      TenantLockdown CSP

      Added new CSP in Windows 10, version 1809.

      +
      Office CSP

      Added FinalStatus setting in Windows 10, version 1809.

      +
      + +## What’s new in MDM for Windows 10, version 1803 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      New or updated topicDescription
      Policy CSP

      Added the following new policies for Windows 10, version 1803:

      +
        +
      • ApplicationDefaults/EnableAppUriHandlers
        • +
      • ApplicationManagement/MSIAllowUserControlOverInstall
        • +
      • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
        • +
      • Bluetooth/AllowPromptedProximalConnections
        • +
      • Browser/AllowConfigurationUpdateForBooksLibrary
        • +
      • Browser/AlwaysEnableBooksLibrary
        • +
      • Browser/EnableExtendedBooksTelemetry
        • +
      • Browser/UseSharedFolderForBooks
        • +
      • Connectivity/AllowPhonePCLinking
        • +
      • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
        • +
      • DeliveryOptimization/DODelayForegroundDownloadFromHttp
        • +
      • DeliveryOptimization/DOGroupIdSource
        • +
      • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
        • +
      • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
        • +
      • DeliveryOptimization/DORestrictPeerSelectionBy
        • +
      • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
        • +
      • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
        • +
      • Display/DisablePerProcessDpiForApps
        • +
      • Display/EnablePerProcessDpi
        • +
      • Display/EnablePerProcessDpiForApps
        • +
      • Experience/AllowWindowsSpotlightOnSettings
        • +
      • KioskBrowser/BlockedUrlExceptions
        • +
      • KioskBrowser/BlockedUrls
        • +
      • KioskBrowser/DefaultURL
        • +
      • KioskBrowser/EnableEndSessionButton
        • +
      • KioskBrowser/EnableHomeButton
        • +
      • KioskBrowser/EnableNavigationButtons
        • +
      • KioskBrowser/RestartOnIdleTime
        • +
      • LanmanWorkstation/EnableInsecureGuestLogons
        • +
      • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
        • +
      • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
        • +
      • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
        • +
      • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
        • +
      • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
        • +
      • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
        • +
      • LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges
        • +
      • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
        • +
      • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
        • +
      • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
        • +
      • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
        • +
      • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
        • +
      • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
        • +
      • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
        • +
      • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
        • +
      • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
        • +
      • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
        • +
      • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
        • +
      • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
        • +
      • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
        • +
      • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
        • +
      • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
        • +
      • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
        • +
      • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
        • +
      • LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
        • +
      • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
        • +
      • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
        • +
      • Notifications/DisallowCloudNotification
        • +
      • RestrictedGroups/ConfigureGroupMembership
        • +
      • Search/AllowCortanaInAAD
        • +
      • Search/DoNotUseWebResults
        • +
      • Security/ConfigureWindowsPasswords
        • +
      • Start/DisableContextMenus
        • +
      • System/FeedbackHubAlwaysSaveDiagnosticsLocally
        • +
      • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
        • +
      • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
        • +
      • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
        • +
      • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
        • +
      • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
        • +
      • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
        • +
      • TaskScheduler/EnableXboxGameSaveTask
        • +
      • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
        • +
      • TextInput/ForceTouchKeyboardDockedState
        • +
      • TextInput/TouchKeyboardDictationButtonAvailability
        • +
      • TextInput/TouchKeyboardEmojiButtonAvailability
        • +
      • TextInput/TouchKeyboardFullModeAvailability
        • +
      • TextInput/TouchKeyboardHandwritingModeAvailability
        • +
      • TextInput/TouchKeyboardNarrowModeAvailability
        • +
      • TextInput/TouchKeyboardSplitModeAvailability
        • +
      • TextInput/TouchKeyboardWideModeAvailability
        • +
      • Update/ConfigureFeatureUpdateUninstallPeriod
        • +
      • UserRights/AccessCredentialManagerAsTrustedCaller
        • +
      • UserRights/AccessFromNetwork
        • +
      • UserRights/ActAsPartOfTheOperatingSystem
        • +
      • UserRights/AllowLocalLogOn
        • +
      • UserRights/BackupFilesAndDirectories
        • +
      • UserRights/ChangeSystemTime
        • +
      • UserRights/CreateGlobalObjects
        • +
      • UserRights/CreatePageFile
        • +
      • UserRights/CreatePermanentSharedObjects
        • +
      • UserRights/CreateSymbolicLinks
        • +
      • UserRights/CreateToken
        • +
      • UserRights/DebugPrograms
        • +
      • UserRights/DenyAccessFromNetwork
        • +
      • UserRights/DenyLocalLogOn
        • +
      • UserRights/DenyRemoteDesktopServicesLogOn
        • +
      • UserRights/EnableDelegation
        • +
      • UserRights/GenerateSecurityAudits
        • +
      • UserRights/ImpersonateClient
        • +
      • UserRights/IncreaseSchedulingPriority
        • +
      • UserRights/LoadUnloadDeviceDrivers
        • +
      • UserRights/LockMemory
        • +
      • UserRights/ManageAuditingAndSecurityLog
        • +
      • UserRights/ManageVolume
        • +
      • UserRights/ModifyFirmwareEnvironment
        • +
      • UserRights/ModifyObjectLabel
        • +
      • UserRights/ProfileSingleProcess
        • +
      • UserRights/RemoteShutdown
        • +
      • UserRights/RestoreFilesAndDirectories
        • +
      • UserRights/TakeOwnership
        • +
      • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
        • +
      • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
        • +
      • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
        • +
      • WindowsDefenderSecurityCenter/HideSecureBoot
        • +
      • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
        • +
      +

      Security/RequireDeviceEncryption - updated to show it is supported in desktop.

      +
      BitLocker CSP

      Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

      +
      DMClient CSP

      Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

      +
        +
      • AADSendDeviceToken
        • +
      • BlockInStatusPage
        • +
      • AllowCollectLogsButton
        • +
      • CustomErrorText
        • +
      • SkipDeviceStatusPage
        • +
      • SkipUserStatusPage
        • +
      +
      Defender CSP

      Added new node (OfflineScan) in Windows 10, version 1803.

      +
      UEFI CSP

      Added a new CSP in Windows 10, version 1803.

      +
      Update CSP

      Added the following nodes in Windows 10, version 1803:

      +
        +
      • Rollback
        • +
      • Rollback/FeatureUpdate
        • +
      • Rollback/QualityUpdateStatus
        • +
      • Rollback/FeatureUpdateStatus
        • +
      +
      AssignedAccess CSP

      Added the following nodes in Windows 10, version 1803:

      +
        +
      • Status
        • +
      • ShellLauncher
        • +
      • StatusConfiguration
        • +
      +

      Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

      +
      MultiSIM CSP

      Added a new CSP in Windows 10, version 1803.

      +
      EnterpriseModernAppManagement CSP

      Added the following node in Windows 10, version 1803:

      +
        +
      • MaintainProcessorArchitectureOnUpdate
        • +
      +
      eUICCs CSP

      Added the following node in Windows 10, version 1803:

      +
        +
      • IsEnabled
        • +
      +
      DeviceStatus CSP

      Added the following node in Windows 10, version 1803:

      +
        +
      • OS/Mode
        • +
      +
      AccountManagement CSP

      Added a new CSP in Windows 10, version 1803.

      +
      RootCATrustedCertificates CSP

      Added the following node in Windows 10, version 1803:

      +
        +
      • UntrustedCertificates
        • +
      +
      NetworkProxy CSP

      Added the following node in Windows 10, version 1803:

      +
        +
      • ProxySettingsPerUser
        • +
      +
      Accounts CSP

      Added a new CSP in Windows 10, version 1803.

      +
      MDM Migration Analysis Too (MMAT)

      Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

      +
      CSP DDF files download

      Added the DDF download of Windows 10, version 1803 configuration service providers.

      +
      + +## What’s new in MDM for Windows 10, version 1709 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
      ItemDescription
      The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

      The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

      +
        +
      • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
        • +
      • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
        • +
      • DomainName - fully qualified domain name if the device is domain-joined.
        • +
      +

      For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

      +
      Firewall CSP

      Added new CSP in Windows 10, version 1709.

      +
      eUICCs CSP

      Added new CSP in Windows 10, version 1709.

      +
      WindowsDefenderApplicationGuard CSPNew CSP added in Windows 10, version 1709. Also added the DDF topic WindowsDefenderApplicationGuard DDF file.
      CM_ProxyEntries CSP and CMPolicy CSPIn Windows 10, version 1709, support for desktop SKUs were added to these CSPs. The table of SKU information in the Configuration service provider reference was updated.
      WindowsDefenderApplicationGuard CSPNew CSP added in Windows 10, version 1709. Also added the DDF topic WindowsDefenderApplicationGuard DDF file.
      VPNv2 CSP

      Added DeviceTunnel and RegisterDNS settings in Windows 10, version 1709.

      +
      DeviceStatus CSP

      Added the following settings in Windows 10, version 1709:

      +
        +
      • DeviceStatus/DomainName
        • +
      • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq
        • +
      • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus
        • +
      • DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus
        • +
      +
      AssignedAccess CSP

      Added the following setting in Windows 10, version 1709.

      +
        +
      • Configuration
        • +
      +

      Starting in Windows 10, version 1709, AssignedAccess CSP is supported in Windows 10 Pro.

      +
      DeviceManageability CSP

      Added the following settings in Windows 10, version 1709:

      +
        +
      • Provider/ProviderID/ConfigInfo
        • +
      • Provider/ProviderID/EnrollmentInfo
        • +
      +
      Office CSP

      Added the following setting in Windows 10, version 1709:

      +
        +
      • Installation/CurrentStatus
        • +
      +
      DMClient CSP

      Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

      +
      Bitlocker CSP

      Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.

      +
      ADMX-backed policies in Policy CSP

      Added new policies.

      +
      Microsoft Store for Business and Microsoft Store

      Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

      +
      MDM enrollment of Windows-based devices

      New features in the Settings app:

      +
        +
      • User sees installation progress of critical policies during MDM enrollment.
        • +
      • User knows what policies, profiles, apps MDM has configured
        • +
      • IT helpdesk can get detailed MDM diagnostic information using client tools
        • +
      +

      For details, see Managing connection and Collecting diagnostic logs

      +
      Enroll a Windows 10 device automatically using Group Policy

      Added new topic to introduce a new Group Policy for automatic MDM enrollment.

      +
      Policy CSP

      Added the following new policies for Windows 10, version 1709:

      +
        +
      • Authentication/AllowAadPasswordReset
        • +
      • Authentication/AllowFidoDeviceSignon
        • +
      • Browser/LockdownFavorites
        • +
      • Browser/ProvisionFavorites
        • +
      • Cellular/LetAppsAccessCellularData
        • +
      • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
        • +
      • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
        • +
      • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
        • +
      • CredentialProviders/DisableAutomaticReDeploymentCredentials
        • +
      • DeviceGuard/EnableVirtualizationBasedSecurity
        • +
      • DeviceGuard/RequirePlatformSecurityFeatures
        • +
      • DeviceGuard/LsaCfgFlags
        • +
      • DeviceLock/MinimumPasswordAge
        • +
      • ExploitGuard/ExploitProtectionSettings
        • +
      • Games/AllowAdvancedGamingServices
        • +
      • Handwriting/PanelDefaultModeDocked
        • +
      • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
        • +
      • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
        • +
      • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
        • +
      • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
        • +
      • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
        • +
      • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
        • +
      • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
        • +
      • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
        • +
      • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
        • +
      • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
        • +
      • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
        • +
      • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
        • +
      • LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon
        • +
      • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
        • +
      • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
        • +
      • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
        • +
      • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
        • +
      • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
        • +
      • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
        • +
      • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
        • +
      • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
        • +
      • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
        • +
      • Power/DisplayOffTimeoutOnBattery
        • +
      • Power/DisplayOffTimeoutPluggedIn
        • +
      • Power/HibernateTimeoutOnBattery
        • +
      • Power/HibernateTimeoutPluggedIn
        • +
      • Power/StandbyTimeoutOnBattery
        • +
      • Power/StandbyTimeoutPluggedIn
        • +
      • Privacy/EnableActivityFeed
        • +
      • Privacy/PublishUserActivities
        • +
      • Defender/AttackSurfaceReductionOnlyExclusions
        • +
      • Defender/AttackSurfaceReductionRules
        • +
      • Defender/CloudBlockLevel
        • +
      • Defender/CloudExtendedTimeout
        • +
      • Defender/ControlledFolderAccessAllowedApplications
        • +
      • Defender/ControlledFolderAccessProtectedFolders
        • +
      • Defender/EnableControlledFolderAccess
        • +
      • Defender/EnableNetworkProtection
        • +
      • Education/DefaultPrinterName
        • +
      • Education/PreventAddingNewPrinters
        • +
      • Education/PrinterNames
        • +
      • Search/AllowCloudSearch
        • +
      • Security/ClearTPMIfNotReady
        • +
      • Settings/AllowOnlineTips
        • +
      • Start/HidePeopleBar
        • +
      • Storage/AllowDiskHealthModelUpdates
        • +
      • System/DisableEnterpriseAuthProxy
        • +
      • System/LimitEnhancedDiagnosticDataWindowsAnalytics
        • +
      • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
        • +
      • Update/DisableDualScan
        • +
      • Update/ManagePreviewBuilds
        • +
      • Update/ScheduledInstallEveryWeek
        • +
      • Update/ScheduledInstallFirstWeek
        • +
      • Update/ScheduledInstallFourthWeek
        • +
      • Update/ScheduledInstallSecondWeek
        • +
      • Update/ScheduledInstallThirdWeek
        • +
      • WindowsDefenderSecurityCenter/CompanyName
        • +
      • WindowsDefenderSecurityCenter/DisableAppBrowserUI
        • +
      • WindowsDefenderSecurityCenter/DisableEnhancedNotifications
        • +
      • WindowsDefenderSecurityCenter/DisableFamilyUI
        • +
      • WindowsDefenderSecurityCenter/DisableHealthUI
        • +
      • WindowsDefenderSecurityCenter/DisableNetworkUI
        • +
      • WindowsDefenderSecurityCenter/DisableNotifications
        • +
      • WindowsDefenderSecurityCenter/DisableVirusUI
        • +
      • WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride
        • +
      • WindowsDefenderSecurityCenter/Email
        • +
      • WindowsDefenderSecurityCenter/EnableCustomizedToasts
        • +
      • WindowsDefenderSecurityCenter/EnableInAppCustomization
        • +
      • WindowsDefenderSecurityCenter/Phone
        • +
      • WindowsDefenderSecurityCenter/URL
        • +
      • WirelessDisplay/AllowMdnsAdvertisement
        • +
      • WirelessDisplay/AllowMdnsDiscovery
        • +
      +
      + +## What’s new in MDM for Windows 10, version 1703 @@ -83,124 +789,414 @@ For details about Microsoft mobile device management protocols for Windows 10 s - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - - + + - - - - - - - - - - + - - + + - - + + - - + + - - + - - + +
    • InBoxApps/SkypeForBusiness
      • +
    • InBoxApps/SkypeForBusiness/DomainName
      • +
    • InBoxApps/Connect
      • +
    • InBoxApps/Connect/AutoLaunch
      • +
    • Properties/DefaultVolume
      • +
    • Properties/ScreenTimeout
      • +
    • Properties/SessionTimeout
      • +
    • Properties/SleepTimeout
      • +
    • Properties/AllowSessionResume
      • +
    • Properties/AllowAutoProxyAuth
      • +
    • Properties/DisableSigninSuggestions
      • +
    • Properties/DoNotShowMyMeetingsAndFiles
      • + + - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + -

      New configuration service providers added in Windows 10, version 1511

        -
      • [AllJoynManagement CSP](alljoynmanagement-csp.md)
        • -
      • [Maps CSP](maps-csp.md)
        • -
      • [Reporting CSP](reporting-csp.md)
        • -
      • [SurfaceHub CSP](surfacehub-csp.md)
        • -
      • [WindowsSecurityAuditing CSP](windowssecurityauditing-csp.md)
        • -

      New and updated policies in Policy CSP

      The following policies have been added to the [Policy CSP](policy-configuration-service-provider.md):

      +

      Update CSP

      Added the following nodes:

        -
      • Accounts/DomainNamesForEmailSync
        • -
      • ApplicationManagement/AllowWindowsBridgeForAndroidAppsExecution
        • -
      • Bluetooth/ServicesAllowedList
        • -
      • DataProtection/AllowAzureRMSForEDP
        • -
      • DataProtection/RevokeOnUnenroll
        • -
      • DeviceLock/DevicePasswordExpiration
        • -
      • DeviceLock/DevicePasswordHistory
        • -
      • TextInput/AllowInputPanel
        • -
      • Update/PauseDeferrals
        • -
      • Update/RequireDeferUpdate
        • -
      • Update/RequireUpdateApproval
        • +
      • FailedUpdates/Failed Update Guid/RevisionNumber
        • +
      • InstalledUpdates/Installed Update Guid/RevisionNumber
        • +
      • PendingRebootUpdates/Pending Reboot Update Guid/RevisionNumber
      -

      The following policies have been updated in the Policy CSP:

      +
      CM_CellularEntries CSP

      To PurposeGroups setting, added the following values:

        -
      • System/AllowLocation
        • -
      • Update/RequireDeferUpgrade
        • +
      • Purchase - 95522B2B-A6D1-4E40-960B-05E6D3F962AB
        • +
      • Administrative - 2FFD9261-C23C-4D27-8DCF-CDE4E14A3364
      -

      The following policies have been deprecated in the Policy CSP:

      +

      CertificateStore CSP

      Added the following setting:

        -
      • TextInput/AllowKoreanExtendedHanja
        • -
      • WiFi/AllowWiFiHotSpotReporting
        • +
      • My/WSTEP/Renew/RetryAfterExpiryInterval
        • +
      +

      ClientCertificateInstall CSP

      Added the following setting:

      +
        +
      • SCEP/UniqueID/Install/AADKeyIdentifierList
        • +
      +

      DMAcc CSP

      Added the following setting:

      +
        +
      • AccountUID/EXT/Microsoft/InitiateSession
        • +
      +

      DMClient CSP

      Added the following nodes and settings:

      +
        +
      • HWDevID
        • +
      • Provider/ProviderID/ManagementServerToUpgradeTo
        • +
      • Provider/ProviderID/CustomEnrollmentCompletePage
        • +
      • Provider/ProviderID/CustomEnrollmentCompletePage/Title
        • +
      • Provider/ProviderID/CustomEnrollmentCompletePage/BodyText
        • +
      • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkHref
        • +
      • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkText
        • +
      +

      CellularSettings CSP

      CM_CellularEntries CSP

      EnterpriseAPN CSP

      For these CSPs, support was added for Windows 10 Home, Pro, Enterprise, and Education editions.

      +
      SecureAssessment CSP

      Added the following settings:

      +
        +
      • AllowTextSuggestions
        • +
      • RequirePrinting
        • +
      +
      EnterpriseAPN CSP

      Added the following setting:

      +
        +
      • Roaming
        • +
      +
      Messaging CSP

      Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enterprise editions.

      +
      Policy CSP

      Added the following new policies:

      +
        +
      • Accounts/AllowMicrosoftAccountSignInAssistant
        • +
      • ApplicationDefaults/DefaultAssociationsConfiguration
        • +
      • Browser/AllowAddressBarDropdown
        • +
      • Browser/AllowFlashClickToRun
        • +
      • Browser/AllowMicrosoftCompatibilityList
        • +
      • Browser/AllowSearchEngineCustomization
        • +
      • Browser/ClearBrowsingDataOnExit
        • +
      • Browser/ConfigureAdditionalSearchEngines
        • +
      • Browser/DisableLockdownOfStartPages
        • +
      • Browser/PreventFirstRunPage
        • +
      • Browser/PreventLiveTileDataCollection
        • +
      • Browser/SetDefaultSearchEngine
        • +
      • Browser/SyncFavoritesBetweenIEAndMicrosoftEdge
        • +
      • Connectivity/AllowConnectedDevices
        • +
      • DeliveryOptimization/DOAllowVPNPeerCaching
        • +
      • DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload
        • +
      • DeliveryOptimization/DOMinDiskSizeAllowedToPeer
        • +
      • DeliveryOptimization/DOMinFileSizeToCache
        • +
      • DeliveryOptimization/DOMinRAMAllowedToPeer
        • +
      • DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
        • +
      • Display/TurnOffGdiDPIScalingForApps
        • +
      • Display/TurnOnGdiDPIScalingForApps
        • +
      • EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint
        • +
      • EnterpriseCloudPrint/CloudPrintOAuthAuthority
        • +
      • EnterpriseCloudPrint/CloudPrintOAuthClientId
        • +
      • EnterpriseCloudPrint/CloudPrintResourceId
        • +
      • EnterpriseCloudPrint/DiscoveryMaxPrinterLimit
        • +
      • EnterpriseCloudPrint/MopriaDiscoveryResourceId
        • +
      • Experience/AllowFindMyDevice
        • +
      • Experience/AllowTailoredExperiencesWithDiagnosticData
        • +
      • Experience/AllowWindowsSpotlightOnActionCenter
        • +
      • Experience/AllowWindowsSpotlightWindowsWelcomeExperience
        • +
      • Location/EnableLocation
        • +
      • Messaging/AllowMMS
        • +
      • Messaging/AllowRCS
        • +
      • Privacy/LetAppsAccessTasks
        • +
      • Privacy/LetAppsAccessTasks_ForceAllowTheseApps
        • +
      • Privacy/LetAppsAccessTasks_ForceDenyTheseApps
        • +
      • Privacy/LetAppsAccessTasks_UserInControlOfTheseApps
        • +
      • Privacy/LetAppsGetDiagnosticInfo
        • +
      • Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps
        • +
      • Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps
        • +
      • Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
        • +
      • Privacy/LetAppsRunInBackground
        • +
      • Privacy/LetAppsRunInBackground_ForceAllowTheseApps
        • +
      • Privacy/LetAppsRunInBackground_ForceDenyTheseApps
        • +
      • Privacy/LetAppsRunInBackground_UserInControlOfTheseApps
        • +
      • Settings/ConfigureTaskbarCalendar
        • +
      • Settings/PageVisibilityList
        • +
      • SmartScreen/EnableAppInstallControl
        • +
      • SmartScreen/EnableSmartScreenInShell
        • +
      • SmartScreen/PreventOverrideForFilesInShell
        • +
      • Start/AllowPinnedFolderDocuments
        • +
      • Start/AllowPinnedFolderDownloads
        • +
      • Start/AllowPinnedFolderFileExplorer
        • +
      • Start/AllowPinnedFolderHomeGroup
        • +
      • Start/AllowPinnedFolderMusic
        • +
      • Start/AllowPinnedFolderNetwork
        • +
      • Start/AllowPinnedFolderPersonalFolder
        • +
      • Start/AllowPinnedFolderPictures
        • +
      • Start/AllowPinnedFolderSettings
        • +
      • Start/AllowPinnedFolderVideos
        • +
      • Start/HideAppList
        • +
      • Start/HideChangeAccountSettings
        • +
      • Start/HideFrequentlyUsedApps
        • +
      • Start/HideHibernate
        • +
      • Start/HideLock
        • +
      • Start/HidePowerButton
        • +
      • Start/HideRecentJumplists
        • +
      • Start/HideRecentlyAddedApps
        • +
      • Start/HideRestart
        • +
      • Start/HideShutDown
        • +
      • Start/HideSignOut
        • +
      • Start/HideSleep
        • +
      • Start/HideSwitchAccount
        • +
      • Start/HideUserTile
        • +
      • Start/ImportEdgeAssets
        • +
      • Start/NoPinningToTaskbar
        • +
      • System/AllowFontProviders
        • +
      • System/DisableOneDriveFileSync
        • +
      • TextInput/AllowKeyboardTextSuggestions
        • +
      • TimeLanguageSettings/AllowSet24HourClock
        • +
      • Update/ActiveHoursMaxRange
        • +
      • Update/AutoRestartDeadlinePeriodInDays
        • +
      • Update/AutoRestartNotificationSchedule
        • +
      • Update/AutoRestartRequiredNotificationDismissal
        • +
      • Update/DetectionFrequency
        • +
      • Update/EngagedRestartDeadline
        • +
      • Update/EngagedRestartSnoozeSchedule
        • +
      • Update/EngagedRestartTransitionSchedule
        • +
      • Update/IgnoreMOAppDownloadLimit
        • +
      • Update/IgnoreMOUpdateDownloadLimit
        • +
      • Update/PauseFeatureUpdatesStartTime
        • +
      • Update/PauseQualityUpdatesStartTime
        • +
      • Update/SetAutoRestartNotificationDisable
        • +
      • Update/SetEDURestart
        • +
      • WiFi/AllowWiFiDirect
        • +
      • WindowsLogon/HideFastUserSwitching
        • +
      • WirelessDisplay/AllowProjectionFromPC
        • +
      • WirelessDisplay/AllowProjectionFromPCOverInfrastructure
        • +
      • WirelessDisplay/AllowProjectionToPCOverInfrastructure
        • +
      • WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver
        • +

      Removed TextInput/AllowLinguisticDataCollection

      +

      Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enterprise and IoT Enterprise

      +

      Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.

      +

      Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.

      +

      Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.

      +

      Added the ConfigOperations/ADMXInstall node and setting, which is used to ingest ADMX files.

      +
      DevDetail CSP

      Added the following setting:

      +
        +
      • DeviceHardwareData
        • +
      +
      CleanPC CSP

      Added new CSP.

      DeveloperSetup CSP

      Added new CSP.

      NetworkProxy CSP

      Added new CSP.

      BitLocker CSP

      Added new CSP.

      +

      Added the following setting:

      +
        +
      • AllowWarningForOtherDiskEncryption
        • +
      +
      EnterpriseDataProtection CSP

      Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported.

      Added the following settings:

      +
        +
      • RevokeOnMDMHandoff
        • +
      • SMBAutoEncryptedFileExtensions

      Management tool for the Micosoft Store for Business

      New topics. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates.

      		DynamicManagement CSP

      Added new CSP.

      Custom header for generic alert

      The MDM-GenericAlert is a new custom header that hosts one or more alert information provided in the http messages sent by the device to the server during an OMA DM session. The generic alert is sent if the session is triggered by the device due to one or more critical or fatal alerts. Here is alert format:

      -MDM-GenericAlert: <AlertType1><AlertType2> -

      If present, the MDM-GenericAlert is presented in every the outgoing MDM message in the same OMA DM session. For more information about generic alerts, see section 8.7 in the OMA Device Management Protocol, Approved Version 1.2.1 in this [OMA website](https://go.microsoft.com/fwlink/p/?LinkId=267526).

      		Implement server-side support for mobile application management on Windows

      New mobile application management (MAM) support added in Windows 10, version 1703.

      Alert message for slow client response

      When the MDM server sends a configuration request, sometimes it takes the client longer than the HTTP timeout to get all information together and then the session ends unexpectedly due to timeout. By default, the MDM client does not send an alert that a DM request is pending.

      -

      To work around the timeout, you can use EnableOmaDmKeepAliveMessage setting to keep the session alive by sending a heartbeat message back to the server. This is achieved by sending a SyncML message with a specific device alert element in the body until the client is able to respond back to the server with the requested information. For details, see EnableOmaDmKeepAliveMessage node in the [DMClient CSP](dmclient-csp.md).

      New node in DMClient CSP

      Added a new node EnableOmaDmKeepAliveMessage to the [DMClient CSP](dmclient-csp.md) and updated the ManagementServerAddress to indicate that it can contain a list of URLs.

      New nodes in EnterpriseModernAppManagement CSP

      Added the following nodes to the [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md):

      +

      PassportForWork CSP

      Added the following new node and settings:

        -
      • AppManagement/GetInventoryQuery
        • -
      • AppManagement/GetInventoryResults
        • -
      • .../PackageFamilyName/AppSettingPolicy/SettingValue
        • -
      • AppLicenses/StoreLicenses/LicenseID/LicenseCategory
        • -
      • AppLicenses/StoreLicenses/LicenseID/LicenseUsage
        • -
      • AppLicenses/StoreLicenses/LicenseID/RequesterID
        • -
      • AppLicenses/StoreLicenses/LicenseID/GetLicenseFromStore
        • +
      • TenantId/Policies/ExcludeSecurityDevices (only for ./Device/Vendor/MSFT)
        • +
      • TenantId/Policies/ExcludeSecurityDevices/TPM12 (only for ./Device/Vendor/MSFT)
        • +
      • TenantId/Policies/EnablePinRecovery

      New nodes in EnterpriseExt CSP

      Added the following nodes to the [EnterpriseExt CSP](enterpriseext-csp.md):

      -
        -
      • DeviceCustomData (CustomID, CustomeString)
        • -
      • Brightness (Default, MaxAuto)
        • -
      • LedAlertNotification (State, Intensity, Period, DutyCycle, Cyclecount)
        • -
      		Office CSP

      Added new CSP.

      New node in EnterpriseExtFileSystem CSP

      Added OemProfile node to [EnterpriseExtFileSystem CSP](enterpriseextfilessystem-csp.md).

      		Personalization CSP

      Added new CSP.

      New nodes in PassportForWork CSP

      Added the following nodes to [PassportForWork CSP](passportforwork-csp.md):

      -
        -
      • TenantId/Policies/PINComplexity/History
        • -
      • TenantId/Policies/PINComplexity/Expiration
        • -
      • TenantId/Policies/Remote/UseRemotePassport (only for ./Device/Vendor/MSFT)
        • -
      • Biometrics/UseBiometrics (only for ./Device/Vendor/MSFT)
        • -
      • Biometrics/FacialFeaturesUseEnhancedAntiSpoofing (only for ./Device/Vendor/MSFT)
        • -
      		EnterpriseAppVManagement CSP

      Added new CSP.

      Updated EnterpriseAssignedAccess CSP

      Here are the changes to the [EnterpriseAssignedAccess CSP](enterpriseassignedaccess-csp.md):

      +      		HealthAttestation CSP

      Added the following settings:

        -
      • In AssignedAccessXML node, added new page settings and quick action settings.
        • -
      • In AssignedAccessXML node, added an example about how to pin applications in multiple app packages using the AUMID.
        • -
      • Updated the [EnterpriseAssignedAccess XSD](enterpriseassignedaccess-xsd.md) topic.
        • +
      • HASEndpoint - added in Windows 10, version 1607, but not documented
        • +
      • TpmReadyStatus - added in the March service release of Windows 10, version 1607

      New nodes in the DevDetail CSP

      Here are the changes to the [DevDetail CSP](devdetail-csp.md):

      +

      SurfaceHub CSP

      Added the following nodes and settings:

        -
      • Added TotalStore and TotalRAM settings.
        • -
      • Added support for Replace command for the DeviceName setting.
        • -

      Handling large objects

      Added support for the client to handle uploading of large objects to the server.

      		NetworkQoSPolicy CSP

      Added new CSP.

      WindowsLicensing CSP

      Added the following setting:

      +
        +
      • ChangeProductKey
        • +
      +
      WindowsAdvancedThreatProtection CSP

      Added the following setting:

      +
        +
      • Configuration/TelemetryReportingFrequency
        • +
      +
      DMSessionActions CSP

      Added new CSP.

      +
      SharedPC CSP

      Added new settings in Windows 10, version 1703.

      +
        +
      • RestrictLocalStorage
        • +
      • KioskModeAUMID
        • +
      • KioskModeUserTileDisplayText
        • +
      • InactiveThreshold
        • +
      • MaxPageFileSizeMB
        • +
      +

      The default value for SetEduPolicies changed to false. The default value for SleepTimeout changed to 300.

      +
      RemoteLock CSP

      Added following setting:

      +
        +
      • LockAndRecoverPIN
        • +
      +
      NodeCache CSP

      Added following settings:

      +
        +
      • ChangedNodesData
        • +
      • AutoSetExpectedValue
        • +
      +
      Download all the DDF files for Windows 10, version 1703

      Added a zip file containing the DDF XML files of the CSPs. The link to the download is available in the DDF topics of various CSPs.

      +
      RemoteWipe CSP

      Added new setting in Windows 10, version 1703.

      +
        +
      • doWipeProtected
        • +
      +
      MDM Bridge WMI Provider

      Added new classes and properties.

      +
      Understanding ADMX-backed policies

      Added a section describing SyncML examples of various ADMX elements.

      +
      Win32 and Desktop Bridge app policy configurationNew topic.
      Deploy and configure App-V apps using MDM

      Added a new topic describing how to deploy and configure App-V apps using MDM.

      +
      EnterpriseDesktopAppManagement CSP

      Added new setting in the March service release of Windows 10, version 1607.

      +
        +
      • MSI/UpgradeCode/[Guid]
        • +
      +
      Reporting CSP

      Added new settings in Windows 10, version 1703.

      +
        +
      • EnterpriseDataProtection/RetrieveByTimeRange/Type
        • +
      • EnterpriseDataProtection/RetrieveByCount/Type
        • +
      +
      Connecting your Windows 10-based device to work using a deep link

      Added following deep link parameters to the table:

      +
        +
      • Username
        • +
      • Servername
        • +
      • Accesstoken
        • +
      • Deviceidentifier
        • +
      • Tenantidentifier
        • +
      • Ownership
        • +
      +
      MDM support for Windows 10 S

      Updated the following topics to indicate MDM support in Windows 10 S.

      + +
      TPMPolicy CSPNew CSP added in Windows 10, version 1703.
      +  -## What's new in Windows 10, version 1607 +## What’s new in MDM for Windows 10, version 1607 @@ -216,25 +1212,25 @@ For details about Microsoft mobile device management protocols for Windows 10 s - + - - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + + + + +

      Sideloading of apps

      Starting in Windows 10, version 1607, sideloading of apps is only allowed through [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md). Product keys (5x5) will no longer be supported to enable sideloading on Windows 10, version 1607 devices.

      Starting in Windows 10, version 1607, sideloading of apps is only allowed through EnterpriseModernAppManagement CSP. Product keys (5x5) will no longer be supported to enable sideloading on Windows 10, version 1607 devices.

      New value for [NodeCache CSP](nodecache-csp.md)

      In [NodeCache CSP](nodecache-csp.md), the value of NodeCache root node starting in Windows 10, version 1607 is com.microsoft/1.0/MDM/NodeCache.

      New value for NodeCache CSP

      In NodeCache CSP, the value of NodeCache root node starting in Windows 10, version 1607 is com.microsoft/1.0/MDM/NodeCache.
      [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)EnterpriseDataProtection CSP

      New CSP.
      [Policy CSP](policy-configuration-service-provider.md)Policy CSP

      Removed the following policies:

        -
      • DataProtection/AllowAzureRMSForEDP - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
        • -
      • DataProtection/AllowUserDecryption - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
        • -
      • DataProtection/EDPEnforcementLevel - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
        • -
      • DataProtection/RequireProtectionUnderLockConfig - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
        • -
      • DataProtection/RevokeOnUnenroll - moved this policy to [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)
        • +
      • DataProtection/AllowAzureRMSForEDP - moved this policy to EnterpriseDataProtection CSP
        • +
      • DataProtection/AllowUserDecryption - moved this policy to EnterpriseDataProtection CSP
        • +
      • DataProtection/EDPEnforcementLevel - moved this policy to EnterpriseDataProtection CSP
        • +
      • DataProtection/RequireProtectionUnderLockConfig - moved this policy to EnterpriseDataProtection CSP
        • +
      • DataProtection/RevokeOnUnenroll - moved this policy to EnterpriseDataProtection CSP
      • DataProtection/EnterpriseCloudResources - moved this policy to NetworkIsolation policy
      • DataProtection/EnterpriseInternalProxyServers - moved this policy to NetworkIsolation policy
      • DataProtection/EnterpriseIPRange - moved this policy to NetworkIsolation policy
        • @@ -371,7 +1367,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s

        Updated Security/AntiTheftMode description to clarify what each supported value does.
      [DMClient CSP](dmclient-csp.md)DMClient CSP

      Added the following settings:

      • ManagementServerAddressList
        • @@ -383,11 +1379,11 @@ For details about Microsoft mobile device management protocols for Windows 10 s

        Removed the EnrollmentID setting.
      [DeviceManageability CSP](devicemanageability-csp.md)DeviceManageability CSP

      New CSP.
      [DeviceStatus CSP](devicestatus-csp.md)DeviceStatus CSP

      Added the following new settings:

      • DeviceStatus/TPM/SpecificationVersion
        • @@ -404,23 +1400,23 @@ For details about Microsoft mobile device management protocols for Windows 10 s
      [AssignedAccess CSP](assignedaccess-csp.md)AssignedAccess CSP

      Added SyncML examples.
      [EnterpriseAssignedAccess CSP](enterpriseassignedaccess-csp.md)EnterpriseAssignedAccess CSP
      • Added a new Folder table entry in the AssignedAccess/AssignedAccessXml description.
      • Updated the DDF and XSD file sections.
      [SecureAssessment CSP](secureassessment-csp.md)SecureAssessment CSP

      New CSP for Windows 10, version 1607
      [DiagnosticLog CSP](diagnosticlog-csp.md) -

      [DiagnosticLog DDF](diagnosticlog-ddf.md)

      		DiagnosticLog CSP +

      DiagnosticLog DDF

      Added version 1.3 of the CSP with two new settings. Added the new 1.3 version of the DDF. Added the following new settings in Windows 10, version 1607.

      • DeviceStateData
        • @@ -428,15 +1424,15 @@ For details about Microsoft mobile device management protocols for Windows 10 s
      [Reboot CSP](reboot-csp.md)Reboot CSP

      New CSP for Windows 10, version 1607
      [CMPolicyEnterprise CSP](cmpolicyenterprise-csp.md)CMPolicyEnterprise CSP

      New CSP for Windows 10, version 1607
      [VPNv2 CSP](vpnv2-csp.md)VPNv2 CSP

      Added the following settings for Windows 10, version 1607

      • ProfileName/RouteList/routeRowId/ExclusionRoute
        • @@ -459,38 +1455,38 @@ For details about Microsoft mobile device management protocols for Windows 10 s
      [Win32AppInventory CSP](win32appinventory-csp.md) -

      [Win32AppInventory DDF](win32appinventory-ddf-file.md)

      		Win32AppInventory CSP +

      Win32AppInventory DDF

      New CSP for Windows 10, version 1607.
      [SharedPC CSP](sharedpc-csp.md)SharedPC CSP

      New CSP for Windows 10, version 1607.
      [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md)WindowsAdvancedThreatProtection CSP

      New CSP for Windows 10, version 1607.
      [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/hardware/dn905224)MDM Bridge WMI Provider

      Added new classes for Windows 10, version 1607.
      [MDM enrollment of Windows devices](mdm-enrollment-of-windows-devices.md)MDM enrollment of Windows devices

      Topic renamed from "Enrollment UI".

      Completely updated enrollment procedures and screenshots.
      [UnifiedWriteFilter CSP](unifiedwritefilter-csp.md) -

      [UnifiedWriteFilter DDF File](unifiedwritefilter-ddf.md)

      		UnifiedWriteFilter CSP +

      UnifiedWriteFilter DDF File

      Added the following new setting for Windows 10, version 1607:

      • NextSession/HORMEnabled
      [CertificateStore CSP](certificatestore-csp.md) -

      [CertificateStore DDF file](certificatestore-ddf-file.md)

      		CertificateStore CSP +

      CertificateStore DDF file

      Added the following new settings in Windows 10, version 1607:

      • My/WSTEP/Renew/LastRenewalAttemptTime
        • @@ -498,7 +1494,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s

      [WindowsLicensing CSP](windowslicensing-csp.md)

      WindowsLicensing CSP

      Added the following new node and settings in Windows 10, version 1607, but not documented:

      • Subscriptions
        • @@ -508,10 +1504,18 @@ For details about Microsoft mobile device management protocols for Windows 10 s

      WiFi CSP

      Deprecated the following node in Windows 10, version 1607:

      +
        +
      • DisableInternetConnectivityChecks
        • +
      +
      -## What's new in Windows 10, version 1703 +## What’s new in MDM for Windows 10, version 1511 @@ -526,1036 +1530,166 @@ For details about Microsoft mobile device management protocols for Windows 10 s - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - - + + - - + + - - + + - - + + + + + + + + + - - + +
    • DeviceCustomData (CustomID, CustomeString)
      • +
    • Brightness (Default, MaxAuto)
      • +
    • LedAlertNotification (State, Intensity, Period, DutyCycle, Cyclecount)
      • + - - + + - - + +
    • TenantId/Policies/PINComplexity/History
      • +
    • TenantId/Policies/PINComplexity/Expiration
      • +
    • TenantId/Policies/Remote/UseRemotePassport (only for ./Device/Vendor/MSFT)
      • +
    • Biometrics/UseBiometrics (only for ./Device/Vendor/MSFT)
      • +
    • Biometrics/FacialFeaturesUseEnhancedAntiSpoofing (only for ./Device/Vendor/MSFT)
      • + - - + +
    • In AssignedAccessXML node, added new page settings and quick action settings.
      • +
    • In AssignedAccessXML node, added an example about how to pin applications in multiple app packages using the AUMID.
      • +
    • Updated the EnterpriseAssignedAccess XSD topic.
      • + - - - - - + - - - - - - - - - - - - - - - - - - - - +
    • Added TotalStore and TotalRAM settings.
      • +
    • Added support for Replace command for the DeviceName setting.
      • + - - - - - - - - - - - - - - - - - + + -

      [Update CSP](update-csp.md)

      Added the following nodes:

      -
        -
      • FailedUpdates/Failed Update Guid/RevisionNumber
        • -
      • InstalledUpdates/Installed Update Guid/RevisionNumber
        • -
      • PendingRebootUpdates/Pending Reboot Update Guid/RevisionNumber
        • -
      -
      [CM_CellularEntries CSP](cm-cellularentries-csp.md)

      To PurposeGroups setting, added the following values:

      -
        -
      • Purchase - 95522B2B-A6D1-4E40-960B-05E6D3F962AB
        • -
      • Administrative - 2FFD9261-C23C-4D27-8DCF-CDE4E14A3364
        • -
      -

      [CertificateStore CSP](certificatestore-csp.md)

      Added the following setting:

      -
        -
      • My/WSTEP/Renew/RetryAfterExpiryInterval
        • -
      -

      [ClientCertificateInstall CSP](clientcertificateinstall-csp.md)

      Added the following setting:

      -
        -
      • SCEP/UniqueID/Install/AADKeyIdentifierList
        • -
      -

      [DMAcc CSP](dmacc-csp.md)

      Added the following setting:

      -
        -
      • AccountUID/EXT/Microsoft/InitiateSession
        • -
      -

      [DMClient CSP](dmclient-csp.md)

      Added the following nodes and settings:

      -
        -
      • HWDevID
        • -
      • Provider/ProviderID/ManagementServerToUpgradeTo
        • -
      • Provider/ProviderID/CustomEnrollmentCompletePage
        • -
      • Provider/ProviderID/CustomEnrollmentCompletePage/Title
        • -
      • Provider/ProviderID/CustomEnrollmentCompletePage/BodyText
        • -
      • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkHref
        • -
      • Provider/ProviderID/CustomEnrollmentCompletePage/HyperlinkText
        • -
      -

      [CellularSettings CSP](cellularsettings-csp.md)

      [CM_CellularEntries CSP](cm-cellularentries-csp.md)

      [EnterpriseAPN CSP](enterpriseapn-csp.md)

      For these CSPs, support was added for Windows 10 Home, Pro, Enterprise, and Education editions.

      -
      [SecureAssessment CSP](secureassessment-csp.md)

      Added the following settings:

      -
        -
      • AllowTextSuggestions
        • -
      • RequirePrinting
        • -
      -
      [EnterpriseAPN CSP](enterpriseapn-csp.md)

      Added the following setting:

      -
        -
      • Roaming
        • -
      -
      [Messaging CSP](messaging-csp.md)

      Added new CSP. This CSP is only supported in Windows 10 Mobile and Mobile Enteprise editions.

      -
      [Policy CSP](policy-configuration-service-provider.md)

      Added the following new policies:

      -
        -
      • Accounts/AllowMicrosoftAccountSignInAssistant
        • -
      • ApplicationDefaults/DefaultAssociationsConfiguration
        • -
      • Browser/AllowAddressBarDropdown
        • -
      • Browser/AllowFlashClickToRun
        • -
      • Browser/AllowMicrosoftCompatibilityList
        • -
      • Browser/AllowSearchEngineCustomization
        • -
      • Browser/ClearBrowsingDataOnExit
        • -
      • Browser/ConfigureAdditionalSearchEngines
        • -
      • Browser/DisableLockdownOfStartPages
        • -
      • Browser/PreventFirstRunPage
        • -
      • Browser/PreventLiveTileDataCollection
        • -
      • Browser/SetDefaultSearchEngine
        • -
      • Browser/SyncFavoritesBetweenIEAndMicrosoftEdge
        • -
      • Connectivity/AllowConnectedDevices
        • -
      • DeliveryOptimization/DOAllowVPNPeerCaching
        • -
      • DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload
        • -
      • DeliveryOptimization/DOMinDiskSizeAllowedToPeer
        • -
      • DeliveryOptimization/DOMinFileSizeToCache
        • -
      • DeliveryOptimization/DOMinRAMAllowedToPeer
        • -
      • DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay
        • -
      • Display/TurnOffGdiDPIScalingForApps
        • -
      • Display/TurnOnGdiDPIScalingForApps
        • -
      • EnterpriseCloudPrint/CloudPrinterDiscoveryEndPoint
        • -
      • EnterpriseCloudPrint/CloudPrintOAuthAuthority
        • -
      • EnterpriseCloudPrint/CloudPrintOAuthClientId
        • -
      • EnterpriseCloudPrint/CloudPrintResourceId
        • -
      • EnterpriseCloudPrint/DiscoveryMaxPrinterLimit
        • -
      • EnterpriseCloudPrint/MopriaDiscoveryResourceId
        • -
      • Experience/AllowFindMyDevice
        • -
      • Experience/AllowTailoredExperiencesWithDiagnosticData
        • -
      • Experience/AllowWindowsSpotlightOnActionCenter
        • -
      • Experience/AllowWindowsSpotlightWindowsWelcomeExperience
        • -
      • Location/EnableLocation
        • -
      • Messaging/AllowMMS
        • -
      • Messaging/AllowRCS
        • -
      • Privacy/LetAppsAccessTasks
        • -
      • Privacy/LetAppsAccessTasks_ForceAllowTheseApps
        • -
      • Privacy/LetAppsAccessTasks_ForceDenyTheseApps
        • -
      • Privacy/LetAppsAccessTasks_UserInControlOfTheseApps
        • -
      • Privacy/LetAppsGetDiagnosticInfo
        • -
      • Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps
        • -
      • Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps
        • -
      • Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps
        • -
      • Privacy/LetAppsRunInBackground
        • -
      • Privacy/LetAppsRunInBackground_ForceAllowTheseApps
        • -
      • Privacy/LetAppsRunInBackground_ForceDenyTheseApps
        • -
      • Privacy/LetAppsRunInBackground_UserInControlOfTheseApps
        • -
      • Settings/ConfigureTaskbarCalendar
        • -
      • Settings/PageVisibilityList
        • -
      • SmartScreen/EnableAppInstallControl
        • -
      • SmartScreen/EnableSmartScreenInShell
        • -
      • SmartScreen/PreventOverrideForFilesInShell
        • -
      • Start/AllowPinnedFolderDocuments
        • -
      • Start/AllowPinnedFolderDownloads
        • -
      • Start/AllowPinnedFolderFileExplorer
        • -
      • Start/AllowPinnedFolderHomeGroup
        • -
      • Start/AllowPinnedFolderMusic
        • -
      • Start/AllowPinnedFolderNetwork
        • -
      • Start/AllowPinnedFolderPersonalFolder
        • -
      • Start/AllowPinnedFolderPictures
        • -
      • Start/AllowPinnedFolderSettings
        • -
      • Start/AllowPinnedFolderVideos
        • -
      • Start/HideAppList
        • -
      • Start/HideChangeAccountSettings
        • -
      • Start/HideFrequentlyUsedApps
        • -
      • Start/HideHibernate
        • -
      • Start/HideLock
        • -
      • Start/HidePowerButton
        • -
      • Start/HideRecentJumplists
        • -
      • Start/HideRecentlyAddedApps
        • -
      • Start/HideRestart
        • -
      • Start/HideShutDown
        • -
      • Start/HideSignOut
        • -
      • Start/HideSleep
        • -
      • Start/HideSwitchAccount
        • -
      • Start/HideUserTile
        • -
      • Start/ImportEdgeAssets
        • -
      • Start/NoPinningToTaskbar
        • -
      • System/AllowFontProviders
        • -
      • System/DisableOneDriveFileSync
        • -
      • TextInput/AllowKeyboardTextSuggestions
        • -
      • TimeLanguageSettings/AllowSet24HourClock
        • -
      • Update/ActiveHoursMaxRange
        • -
      • Update/AutoRestartDeadlinePeriodInDays
        • -
      • Update/AutoRestartNotificationSchedule
        • -
      • Update/AutoRestartRequiredNotificationDismissal
        • -
      • Update/DetectionFrequency
        • -
      • Update/EngagedRestartDeadline
        • -
      • Update/EngagedRestartSnoozeSchedule
        • -
      • Update/EngagedRestartTransitionSchedule
        • -
      • Update/IgnoreMOAppDownloadLimit
        • -
      • Update/IgnoreMOUpdateDownloadLimit
        • -
      • Update/PauseFeatureUpdatesStartTime
        • -
      • Update/PauseQualityUpdatesStartTime
        • -
      • Update/SetAutoRestartNotificationDisable
        • -
      • Update/SetEDURestart
        • -
      • WiFi/AllowWiFiDirect
        • -
      • WindowsLogon/HideFastUserSwitching
        • -
      • WirelessDisplay/AllowProjectionFromPC
        • -
      • WirelessDisplay/AllowProjectionFromPCOverInfrastructure
        • -
      • WirelessDisplay/AllowProjectionToPCOverInfrastructure
        • -
      • WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver
        • -

      Removed TextInput/AllowLinguisticDataCollection

      -

      Starting in Windows 10, version 1703, Update/UpdateServiceUrl is not supported in Windows 10 Mobile Enteprise and IoT Enterprise

      -

      Starting in Windows 10, version 1703, the maximum value of Update/DeferFeatureUpdatesPeriodInDays has been increased from 180 days, to 365 days.

      -

      Starting in Windows 10, version 1703, in Browser/HomePages you can use the "<about:blank>" value if you don’t want to send traffic to Microsoft.

      -

      Starting in Windows 10, version 1703, Start/StartLayout can now be set on a per-device basis in addition to the pre-existing per-user basis.

      -

      Added the ConfigOperations/ADMXInstall node and setting, which is used to ingest ADMX files.

      -
      [DevDetail CSP](devdetail-csp.md)

      Added the following setting:

      -
        -
      • DeviceHardwareData
        • -
      -
      [CleanPC CSP](cleanpc-csp.md)

      Added new CSP.

      [DeveloperSetup CSP](developersetup-csp.md)

      Added new CSP.

      [NetworkProxy CSP](networkproxy-csp.md)

      Added new CSP.

      [BitLocker CSP](bitlocker-csp.md)

      Added new CSP.

      -

      Added the following setting:

      -
        -
      • AllowWarningForOtherDiskEncryption
        • -
      -
      [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md)

      Starting in Windows 10, version 1703, AllowUserDecryption is no longer supported.

      Added the following settings:

      -
        -
      • RevokeOnMDMHandoff
        • -
      • SMBAutoEncryptedFileExtensions
        • -
      [DynamicManagement CSP](dynamicmanagement-csp.md)

      Added new CSP.

      [Implement server-side support for mobile application management on Windows](implement-server-side-mobile-application-management.md)

      New mobile application management (MAM) support added in Windows 10, version 1703.

      [PassportForWork CSP](passportforwork-csp.md)

      Added the following new node and settings:

      -
        -
      • TenantId/Policies/ExcludeSecurityDevices (only for ./Device/Vendor/MSFT)
        • -
      • TenantId/Policies/ExcludeSecurityDevices/TPM12 (only for ./Device/Vendor/MSFT)
        • -
      • TenantId/Policies/EnablePinRecovery
        • +

      New configuration service providers added in Windows 10, version 1511
      [Office CSP](office-csp.md)

      Added new CSP.

      New and updated policies in Policy CSP

      The following policies have been added to the Policy CSP:

      +
        +
      • ApplicationManagement/AllowWindowsBridgeForAndroidAppsExecution
        • +
      • Bluetooth/ServicesAllowedList
        • +
      • DataProtection/AllowAzureRMSForEDP
        • +
      • DataProtection/RevokeOnUnenroll
        • +
      • DeviceLock/DevicePasswordExpiration
        • +
      • DeviceLock/DevicePasswordHistory
        • +
      • TextInput/AllowInputPanel
        • +
      • Update/PauseDeferrals
        • +
      • Update/RequireDeferUpdate
        • +
      • Update/RequireUpdateApproval
        • +
      +

      The following policies have been updated in the Policy CSP:

      +
        +
      • System/AllowLocation
        • +
      • Update/RequireDeferUpgrade
        • +
      +

      The following policies have been deprecated in the Policy CSP:

      +
        +
      • TextInput/AllowKoreanExtendedHanja
        • +
      • WiFi/AllowWiFiHotSpotReporting
        • +
      [Personalization CSP](personalization-csp.md)

      Added new CSP.

      Management tool for the Microsoft Store for Business

      New topics. The Store for Business has a new web service designed for the enterprise to acquire, manage, and distribute applications in bulk. It enables several capabilities that are required for the enterprise to manage the lifecycle of applications from acquisition to updates.
      [EnterpriseAppVManagement CSP](enterpriseappvmanagement-csp.md)

      Added new CSP.

      Custom header for generic alert

      The MDM-GenericAlert is a new custom header that hosts one or more alert information provided in the http messages sent by the device to the server during an OMA DM session. The generic alert is sent if the session is triggered by the device due to one or more critical or fatal alerts. Here is alert format:

      +MDM-GenericAlert: <AlertType1><AlertType2> +

      If present, the MDM-GenericAlert is presented in every the outgoing MDM message in the same OMA DM session. For more information about generic alerts, see section 8.7 in the OMA Device Management Protocol, Approved Version 1.2.1 in this OMA website.
      [HealthAttestation CSP](healthattestation-csp.md)

      Added the following settings:

      +

      Alert message for slow client response

      When the MDM server sends a configuration request, sometimes it takes the client longer than the HTTP timeout to get all information together and then the session ends unexpectedly due to timeout. By default, the MDM client does not send an alert that a DM request is pending.

      +

      To work around the timeout, you can use EnableOmaDmKeepAliveMessage setting to keep the session alive by sending a heartbeat message back to the server. This is achieved by sending a SyncML message with a specific device alert element in the body until the client is able to respond back to the server with the requested information. For details, see EnableOmaDmKeepAliveMessage node in the DMClient CSP.

      New node in DMClient CSP

      Added a new node EnableOmaDmKeepAliveMessage to the DMClient CSP and updated the ManagementServerAddress to indicate that it can contain a list of URLs.

      New nodes in EnterpriseModernAppManagement CSP

      Added the following nodes to the EnterpriseModernAppManagement CSP:

        -
      • HASEndpoint - added in Windows 10, version 1607, but not documented
        • -
      • TpmReadyStatus - added in the March service release of Windows 10, version 1607
        • +
      • AppManagement/GetInventoryQuery
        • +
      • AppManagement/GetInventoryResults
        • +
      • .../PackageFamilyName/AppSettingPolicy/SettingValue
        • +
      • AppLicenses/StoreLicenses/LicenseID/LicenseCategory
        • +
      • AppLicenses/StoreLicenses/LicenseID/LicenseUsage
        • +
      • AppLicenses/StoreLicenses/LicenseID/RequesterID
        • +
      • AppLicenses/StoreLicenses/LicenseID/GetLicenseFromStore

      [SurfaceHub CSP](surfacehub-csp.md)

      Added the following nodes and settings:

      +

      New nodes in EnterpriseExt CSP

      Added the following nodes to the EnterpriseExt CSP:

        -
      • InBoxApps/SkypeForBusiness
        • -
      • InBoxApps/SkypeForBusiness/DomainName
        • -
      • InBoxApps/Connect
        • -
      • InBoxApps/Connect/AutoLaunch
        • -
      • Properties/DefaultVolume
        • -
      • Properties/ScreenTimeout
        • -
      • Properties/SessionTimeout
        • -
      • Properties/SleepTimeout
        • -
      • Properties/AllowSessionResume
        • -
      • Properties/AllowAutoProxyAuth
        • -
      • Properties/DisableSigninSuggestions
        • -
      • Properties/DoNotShowMyMeetingsAndFiles
        • -
      -
      [NetworkQoSPolicy CSP](networkqospolicy-csp.md)

      Added new CSP.

      New node in EnterpriseExtFileSystem CSP

      Added OemProfile node to EnterpriseExtFileSystem CSP.

      [WindowsLicensing CSP](windowslicensing-csp.md)

      Added the following setting:

      +

      New nodes in PassportForWork CSP

      Added the following nodes to PassportForWork CSP:

        -
      • ChangeProductKey
        • -
      -
      [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md)

      Added the following setting:

      +

      Updated EnterpriseAssignedAccess CSP

      Here are the changes to the EnterpriseAssignedAccess CSP:

        -
      • Configuration/TelemetryReportingFrequency
        • -
      -
      [DMSessionActions CSP](dmsessionactions-csp.md)

      Added new CSP.

      -
      [SharedPC CSP](dmsessionactions-csp.md)

      Added new settings in Windows 10, version 1703.

      +

      New nodes in the DevDetail CSP

      Here are the changes to the DevDetail CSP:

        -
      • RestrictLocalStorage
        • -
      • KioskModeAUMID
        • -
      • KioskModeUserTileDisplayText
        • -
      • InactiveThreshold
        • -
      • MaxPageFileSizeMB
        • -
      -

      The default value for SetEduPolicies changed to false. The default value for SleepTimeout changed to 300.

      -
      [RemoteLock CSP](remotelock-csp.md)

      Added following setting:

      -
        -
      • LockAndRecoverPIN
        • -
      -
      [NodeCache CSP](nodecache-csp.md)

      Added following settings:

      -
        -
      • ChangedNodesData
        • -
      • AutoSetExpectedValue
        • -
      -
      [Download all the DDF files for Windows 10, version 1703](https://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip)

      Added a zip file containing the DDF XML files of the CSPs. The link to the download is available in the DDF topics of various CSPs.

      -
      [RemoteWipe CSP](remotewipe-csp.md)

      Added new setting in Windows 10, version 1703.

      -
        -
      • doWipeProtected
        • -
      -
      [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/hardware/dn905224)

      Added new classes and properties.

      -
      [Understanding ADMX-backed policies](understanding-admx-backed-policies.md)

      Added a section describing SyncML examples of various ADMX elements.

      -
      [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md)New topic.
      [Deploy and configure App-V apps using MDM](appv-deploy-and-config.md)

      Added a new topic describing how to deploy and configure App-V apps using MDM.

      -
      [EnterpriseDesktopAppManagement CSP](enterprisedesktopappmanagement-csp.md)

      Added new setting in the March service release of Windows 10, version 1607.

      -
        -
      • MSI/UpgradeCode/[Guid]
        • -
      -
      [Reporting CSP](reporting-csp.md)

      Added new settings in Windows 10, version 1703.

      -
        -
      • EnterpriseDataProtection/RetrieveByTimeRange/Type
        • -
      • EnterpriseDataProtection/RetrieveByCount/Type
        • -
      -
      [Connecting your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connecting-your-windows-10-based-device-to-work-using-a-deep-link)

      Added following deep link parameters to the table:

      -
        -
      • Username
        • -
      • Servername
        • -
      • Accesstoken
        • -
      • Deviceidentifier
        • -
      • Tenantidentifier
        • -
      • Ownership
        • -
      -
      MDM support for Windows 10 S

      Updated the following topics to indicate MDM support in Windows 10 S.

      -
        -
      • [Configuration service provider reference](configuration-service-provider-reference.md)
        • -
      • [Policy CSP](policy-configuration-service-provider.md)
        • -
      -
      [TPMPolicy CSP](tpmpolicy-csp.md)New CSP added in Windows 10, version 1703.

      Handling large objects

      Added support for the client to handle uploading of large objects to the server.
        - -## What's new in Windows 10, version 1709 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      ItemDescription
      The [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/library/mt221945.aspx)

      The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

      -
        -
      • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
        • -
      • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
        • -
      • DomainName - fully qualified domain name if the device is domain-joined.
        • -
      -

      For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

      -
      [Firewall CSP](firewall-csp.md)

      Added new CSP in Windows 10, version 1709.

      -
      [eUICCs CSP](euiccs-csp.md)

      Added new CSP in Windows 10, version 1709.

      -
      [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)New CSP added in Windows 10, version 1709. Also added the DDF topic [WindowsDefenderApplicationGuard DDF file](windowsdefenderapplicationguard-ddf-file.md).
      [CM_ProxyEntries CSP](cm-proxyentries-csp.md) and [CMPolicy CSP](cmpolicy-csp.md)In Windows 10, version 1709, support for desktop SKUs were added to these CSPs. The table of SKU information in the [Configuration service provider reference](configuration-service-provider-reference.md) was updated.
      [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)New CSP added in Windows 10, version 1709. Also added the DDF topic [WindowsDefenderApplicationGuard DDF file](windowsdefenderapplicationguard-ddf-file.md).
      [VPNv2 CSP](vpnv2-csp.md)

      Added DeviceTunnel and RegisterDNS settings in Windows 10, version 1709.

      -
      [DeviceStatus CSP](devicestatus-csp.md)

      Added the following settings in Windows 10, version 1709:

      -
        -
      • DeviceStatus/DomainName
        • -
      • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq
        • -
      • DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus
        • -
      • DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus
        • -
      -
      [AssignedAccess CSP](assignedaccess-csp.md)

      Added the following setting in Windows 10, version 1709.

      -
        -
      • Configuration
        • -
      -

      Starting in Windows 10, version 1709, AssignedAccess CSP is supported in Windows 10 Pro.

      -
      [DeviceManageability CSP](devicemanageability-csp.md)

      Added the following settings in Windows 10, version 1709:

      -
        -
      • Provider/_ProviderID_/ConfigInfo
        • -
      • Provider/_ProviderID_/EnrollmentInfo
        • -
      -
      [Office CSP](office-csp.md)

      Added the following setting in Windows 10, version 1709:

      -
        -
      • Installation/CurrentStatus
        • -
      -
      [DMClient CSP](dmclient-csp.md)

      Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

      -
      [Bitlocker CSP](bitlocker-csp.md)

      Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709.

      -
      [ADMX-backed policies in Policy CSP](policy-configuration-service-provider.md#admx-backed-policies)

      Added new policies.

      -
      Microsoft Store for Business and Microsoft Store

      Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

      -
      [MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md)

      New features in the Settings app:

      -
        -
      • User sees installation progress of critical policies during MDM enrollment.
        • -
      • User knows what policies, profiles, apps MDM has configured
        • -
      • IT helpdesk can get detailed MDM diagnostic information using client tools
        • -
      -

      For details, see [Managing connection](mdm-enrollment-of-windows-devices.md#managing-connections) and [Collecting diagnostic logs](mdm-enrollment-of-windows-devices.md#collecting-diagnostic-logs)

      -
      [Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)

      Added new topic to introduce a new Group Policy for automatic MDM enrollment.

      -
      [Policy CSP](policy-configuration-service-provider.md)

      Added the following new policies for Windows 10, version 1709:

      -
        -
      • Authentication/AllowAadPasswordReset
        • -
      • Authentication/AllowFidoDeviceSignon
        • -
      • Browser/LockdownFavorites
        • -
      • Browser/ProvisionFavorites
        • -
      • Cellular/LetAppsAccessCellularData
        • -
      • Cellular/LetAppsAccessCellularData_ForceAllowTheseApps
        • -
      • Cellular/LetAppsAccessCellularData_ForceDenyTheseApps
        • -
      • Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps
        • -
      • CredentialProviders/DisableAutomaticReDeploymentCredentials
        • -
      • DeviceGuard/EnableVirtualizationBasedSecurity
        • -
      • DeviceGuard/RequirePlatformSecurityFeatures
        • -
      • DeviceGuard/LsaCfgFlags
        • -
      • DeviceLock/MinimumPasswordAge
        • -
      • ExploitGuard/ExploitProtectionSettings
        • -
      • Games/AllowAdvancedGamingServices
        • -
      • Handwriting/PanelDefaultModeDocked
        • -
      • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
        • -
      • LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus
        • -
      • LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus
        • -
      • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
        • -
      • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
        • -
      • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
        • -
      • LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
        • -
      • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayLastSignedIn
        • -
      • LocalPoliciesSecurityOptions/Interactivelogon_DoNotDisplayUsernameAtSignIn
        • -
      • LocalPoliciesSecurityOptions/Interactivelogon_DoNotRequireCTRLALTDEL
        • -
      • LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit
        • -
      • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn
        • -
      • LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn
        • -
      • LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
        • -
      • LocalPoliciesSecurityOptions/RecoveryConsole_AllowAutomaticAdministrativeLogon
        • -
      • LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn
        • -
      • LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation
        • -
      • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators
        • -
      • LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers
        • -
      • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated
        • -
      • LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations
        • -
      • LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode
        • -
      • LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation
        • -
      • LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations
        • -
      • Power/DisplayOffTimeoutOnBattery
        • -
      • Power/DisplayOffTimeoutPluggedIn
        • -
      • Power/HibernateTimeoutOnBattery
        • -
      • Power/HibernateTimeoutPluggedIn
        • -
      • Power/StandbyTimeoutOnBattery
        • -
      • Power/StandbyTimeoutPluggedIn
        • -
      • Privacy/EnableActivityFeed
        • -
      • Privacy/PublishUserActivities
        • -
      • Defender/AttackSurfaceReductionOnlyExclusions
        • -
      • Defender/AttackSurfaceReductionRules
        • -
      • Defender/CloudBlockLevel
        • -
      • Defender/CloudExtendedTimeout
        • -
      • Defender/ControlledFolderAccessAllowedApplications
        • -
      • Defender/ControlledFolderAccessProtectedFolders
        • -
      • Defender/EnableControlledFolderAccess
        • -
      • Defender/EnableNetworkProtection
        • -
      • Education/DefaultPrinterName
        • -
      • Education/PreventAddingNewPrinters
        • -
      • Education/PrinterNames
        • -
      • Search/AllowCloudSearch
        • -
      • Security/ClearTPMIfNotReady
        • -
      • Settings/AllowOnlineTips
        • -
      • Start/HidePeopleBar
        • -
      • Storage/AllowDiskHealthModelUpdates
        • -
      • System/DisableEnterpriseAuthProxy
        • -
      • System/LimitEnhancedDiagnosticDataWindowsAnalytics
        • -
      • Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork
        • -
      • Update/DisableDualScan
        • -
      • Update/ManagePreviewBuilds
        • -
      • Update/ScheduledInstallEveryWeek
        • -
      • Update/ScheduledInstallFirstWeek
        • -
      • Update/ScheduledInstallFourthWeek
        • -
      • Update/ScheduledInstallSecondWeek
        • -
      • Update/ScheduledInstallThirdWeek
        • -
      • WindowsDefenderSecurityCenter/CompanyName
        • -
      • WindowsDefenderSecurityCenter/DisableAppBrowserUI
        • -
      • WindowsDefenderSecurityCenter/DisableEnhancedNotifications
        • -
      • WindowsDefenderSecurityCenter/DisableFamilyUI
        • -
      • WindowsDefenderSecurityCenter/DisableHealthUI
        • -
      • WindowsDefenderSecurityCenter/DisableNetworkUI
        • -
      • WindowsDefenderSecurityCenter/DisableNotifications
        • -
      • WindowsDefenderSecurityCenter/DisableVirusUI
        • -
      • WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride
        • -
      • WindowsDefenderSecurityCenter/Email
        • -
      • WindowsDefenderSecurityCenter/EnableCustomizedToasts
        • -
      • WindowsDefenderSecurityCenter/EnableInAppCustomization
        • -
      • WindowsDefenderSecurityCenter/Phone
        • -
      • WindowsDefenderSecurityCenter/URL
        • -
      • WirelessDisplay/AllowMdnsAdvertisement
        • -
      • WirelessDisplay/AllowMdnsDiscovery
        • -
      -
      -## What's new in Windows 10, version 1803 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      New or updated topicDescription
      [Policy CSP](policy-configuration-service-provider.md)

      Added the following new policies for Windows 10, version 1803:

      -
        -
      • ApplicationDefaults/EnableAppUriHandlers
        • -
      • ApplicationManagement/MSIAllowUserControlOverInstall
        • -
      • ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges
        • -
      • Bluetooth/AllowPromptedProximalConnections
        • -
      • Browser/AllowConfigurationUpdateForBooksLibrary
        • -
      • Browser/AlwaysEnableBooksLibrary
        • -
      • Browser/EnableExtendedBooksTelemetry
        • -
      • Browser/UseSharedFolderForBooks
        • -
      • Connectivity/AllowPhonePCLinking
        • -
      • DeliveryOptimization/DODelayBackgroundDownloadFromHttp
        • -
      • DeliveryOptimization/DODelayForegroundDownloadFromHttp
        • -
      • DeliveryOptimization/DOGroupIdSource
        • -
      • DeliveryOptimization/DOPercentageMaxBackDownloadBandwidth
        • -
      • DeliveryOptimization/DOPercentageMaxForeDownloadBandwidth
        • -
      • DeliveryOptimization/DORestrictPeerSelectionBy
        • -
      • DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth
        • -
      • DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth
        • -
      • Display/DisablePerProcessDpiForApps
        • -
      • Display/EnablePerProcessDpi
        • -
      • Display/EnablePerProcessDpiForApps
        • -
      • Experience/AllowWindowsSpotlightOnSettings
        • -
      • KioskBrowser/BlockedUrlExceptions
        • -
      • KioskBrowser/BlockedUrls
        • -
      • KioskBrowser/DefaultURL
        • -
      • KioskBrowser/EnableEndSessionButton
        • -
      • KioskBrowser/EnableHomeButton
        • -
      • KioskBrowser/EnableNavigationButtons
        • -
      • KioskBrowser/RestartOnIdleTime
        • -
      • LanmanWorkstation/EnableInsecureGuestLogons
        • -
      • LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon
        • -
      • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
        • -
      • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
        • -
      • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
        • -
      • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
        • -
      • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
        • -
      • LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges
        • -
      • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
        • -
      • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
        • -
      • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
        • -
      • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
        • -
      • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees
        • -
      • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts
        • -
      • LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares
        • -
      • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
        • -
      • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
        • -
      • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
        • -
      • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
        • -
      • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
        • -
      • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication
        • -
      • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic
        • -
      • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic
        • -
      • LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers
        • -
      • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
        • -
      • LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
        • -
      • LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation
        • -
      • LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode
        • -
      • Notifications/DisallowCloudNotification
        • -
      • RestrictedGroups/ConfigureGroupMembership
        • -
      • Search/AllowCortanaInAAD
        • -
      • Search/DoNotUseWebResults
        • -
      • Security/ConfigureWindowsPasswords
        • -
      • Start/DisableContextMenus
        • -
      • System/FeedbackHubAlwaysSaveDiagnosticsLocally
        • -
      • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
        • -
      • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
        • -
      • SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode
        • -
      • SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode
        • -
      • SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode
        • -
      • SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode
        • -
      • TaskScheduler/EnableXboxGameSaveTask
        • -
      • TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
        • -
      • TextInput/ForceTouchKeyboardDockedState
        • -
      • TextInput/TouchKeyboardDictationButtonAvailability
        • -
      • TextInput/TouchKeyboardEmojiButtonAvailability
        • -
      • TextInput/TouchKeyboardFullModeAvailability
        • -
      • TextInput/TouchKeyboardHandwritingModeAvailability
        • -
      • TextInput/TouchKeyboardNarrowModeAvailability
        • -
      • TextInput/TouchKeyboardSplitModeAvailability
        • -
      • TextInput/TouchKeyboardWideModeAvailability
        • -
      • Update/ConfigureFeatureUpdateUninstallPeriod
        • -
      • UserRights/AccessCredentialManagerAsTrustedCaller
        • -
      • UserRights/AccessFromNetwork
        • -
      • UserRights/ActAsPartOfTheOperatingSystem
        • -
      • UserRights/AllowLocalLogOn
        • -
      • UserRights/BackupFilesAndDirectories
        • -
      • UserRights/ChangeSystemTime
        • -
      • UserRights/CreateGlobalObjects
        • -
      • UserRights/CreatePageFile
        • -
      • UserRights/CreatePermanentSharedObjects
        • -
      • UserRights/CreateSymbolicLinks
        • -
      • UserRights/CreateToken
        • -
      • UserRights/DebugPrograms
        • -
      • UserRights/DenyAccessFromNetwork
        • -
      • UserRights/DenyLocalLogOn
        • -
      • UserRights/DenyRemoteDesktopServicesLogOn
        • -
      • UserRights/EnableDelegation
        • -
      • UserRights/GenerateSecurityAudits
        • -
      • UserRights/ImpersonateClient
        • -
      • UserRights/IncreaseSchedulingPriority
        • -
      • UserRights/LoadUnloadDeviceDrivers
        • -
      • UserRights/LockMemory
        • -
      • UserRights/ManageAuditingAndSecurityLog
        • -
      • UserRights/ManageVolume
        • -
      • UserRights/ModifyFirmwareEnvironment
        • -
      • UserRights/ModifyObjectLabel
        • -
      • UserRights/ProfileSingleProcess
        • -
      • UserRights/RemoteShutdown
        • -
      • UserRights/RestoreFilesAndDirectories
        • -
      • UserRights/TakeOwnership
        • -
      • WindowsDefenderSecurityCenter/DisableAccountProtectionUI
        • -
      • WindowsDefenderSecurityCenter/DisableDeviceSecurityUI
        • -
      • WindowsDefenderSecurityCenter/HideRansomwareDataRecovery
        • -
      • WindowsDefenderSecurityCenter/HideSecureBoot
        • -
      • WindowsDefenderSecurityCenter/HideTPMTroubleshooting
        • -
      -

      Security/RequireDeviceEncryption - updated to show it is supported in desktop.

      -
      [BitLocker CSP](bitlocker-csp.md)

      Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

      -
      [DMClient CSP](dmclient-csp.md)

      Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

      -
        -
      • AADSendDeviceToken
        • -
      • BlockInStatusPage
        • -
      • AllowCollectLogsButton
        • -
      • CustomErrorText
        • -
      • SkipDeviceStatusPage
        • -
      • SkipUserStatusPage
        • -
      -
      [Defender CSP](defender-csp.md)

      Added new node (OfflineScan) in Windows 10, version 1803.

      -
      [UEFI CSP](uefi-csp.md)

      Added a new CSP in Windows 10, version 1803.

      -
      [Update CSP](update-csp.md)

      Added the following nodes in Windows 10, version 1803:

      -
        -
      • Rollback
        • -
      • Rollback/FeatureUpdate
        • -
      • Rollback/QualityUpdateStatus
        • -
      • Rollback/FeatureUpdateStatus
        • -
      -
      [AssignedAccess CSP](assignedaccess-csp.md)

      Added the following nodes in Windows 10, version 1803:

      -
        -
      • Status
        • -
      • ShellLauncher
        • -
      • StatusConfiguration
        • -
      -

      Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.

      -
      [MultiSIM CSP](multisim-csp.md)

      Added a new CSP in Windows 10, version 1803.

      -
      [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)

      Added the following node in Windows 10, version 1803:

      -
        -
      • MaintainProcessorArchitectureOnUpdate
        • -
      -
      [eUICCs CSP](euiccs-csp.md)

      Added the following node in Windows 10, version 1803:

      -
        -
      • IsEnabled
        • -
      -
      [DeviceStatus CSP](devicestatus-csp.md)

      Added the following node in Windows 10, version 1803:

      -
        -
      • OS/Mode
        • -
      -
      [AccountManagement CSP](accountmanagement-csp.md)

      Added a new CSP in Windows 10, version 1803.

      -
      [RootCATrustedCertificates CSP](rootcacertificates-csp.md)

      Added the following node in Windows 10, version 1803:

      -
        -
      • UntrustedCertificates
        • -
      -
      [NetworkProxy CSP](\networkproxy--csp.md)

      Added the following node in Windows 10, version 1803:

      -
        -
      • ProxySettingsPerUser
        • -
      -
      [Accounts CSP](accounts-csp.md)

      Added a new CSP in Windows 10, version 1803.

      -
      [MDM Migration Analysis Too (MMAT)](https://aka.ms/mmat)

      Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

      -
      [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download)

      Added the DDF download of Windows 10, version 1803 configuration service providers.

      -
      - -## What's new in Windows 10, version 1809 - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
      New or updated topicDescription
      [Policy CSP](policy-configuration-service-provider.md)

      Added the following new policies in Windows 10, version 1809:

      -
        -
      • ApplicationManagement/LaunchAppAfterLogOn
        • -
      • ApplicationManagement/ScheduleForceRestartForUpdateFailures
        • -
      • Authentication/EnableFastFirstSignIn
        • -
      • Authentication/EnableWebSignIn
        • -
      • Authentication/PreferredAadTenantDomainName
        • -
      • Browser/AllowFullScreenMode
        • -
      • Browser/AllowPrelaunch
        • -
      • Browser/AllowPrinting
        • -
      • Browser/AllowSavingHistory
        • -
      • Browser/AllowSideloadingOfExtensions
        • -
      • Browser/AllowTabPreloading
        • -
      • Browser/AllowWebContentOnNewTabPage
        • -
      • Browser/ConfigureFavoritesBar
        • -
      • Browser/ConfigureHomeButton
        • -
      • Browser/ConfigureKioskMode
        • -
      • Browser/ConfigureKioskResetAfterIdleTimeout
        • -
      • Browser/ConfigureOpenMicrosoftEdgeWith
        • -
      • Browser/ConfigureTelemetryForMicrosoft365Analytics
        • -
      • Browser/PreventCertErrorOverrides
        • -
      • Browser/SetHomeButtonURL
        • -
      • Browser/SetNewTabPageURL
        • -
      • Browser/UnlockHomeButton
        • -
      • Defender/CheckForSignaturesBeforeRunningScan
        • -
      • Defender/DisableCatchupFullScan
        • -
      • Defender/DisableCatchupQuickScan
        • -
      • Defender/EnableLowCPUPriority
        • -
      • Defender/SignatureUpdateFallbackOrder
        • -
      • Defender/SignatureUpdateFileSharesSources
        • -
      • DeviceGuard/ConfigureSystemGuardLaunch
        • -
      • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
        • -
      • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
        • -
      • DeviceInstallation/PreventDeviceMetadataFromNetwork
        • -
      • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
        • -
      • DmaGuard/DeviceEnumerationPolicy
        • -
      • Experience/AllowClipboardHistory
        • -
      • Experience/DoNotSyncBrowserSettings
        • -
      • Experience/PreventUsersFromTurningOnBrowserSyncing
        • -
      • Kerberos/UPNNameHints
        • -
      • Privacy/AllowCrossDeviceClipboard
        • -
      • Privacy/DisablePrivacyExperience
        • -
      • Privacy/UploadUserActivities
        • -
      • Security/RecoveryEnvironmentAuthentication
        • -
      • System/AllowDeviceNameInDiagnosticData
        • -
      • System/ConfigureMicrosoft365UploadEndpoint
        • -
      • System/DisableDeviceDelete
        • -
      • System/DisableDiagnosticDataViewer
        • -
      • Storage/RemovableDiskDenyWriteAccess
        • -
      • TaskManager/AllowEndTask
        • -
      • Update/EngagedRestartDeadlineForFeatureUpdates
        • -
      • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
        • -
      • Update/EngagedRestartTransitionScheduleForFeatureUpdates
        • -
      • Update/SetDisablePauseUXAccess
        • -
      • Update/SetDisableUXWUAccess
        • -
      • WindowsDefenderSecurityCenter/DisableClearTpmButton
        • -
      • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
        • -
      • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
        • -
      • WindowsLogon/DontDisplayNetworkSelectionUI
        • -
      -
      [PassportForWork CSP](passportforwork-csp.md)

      Added new settings in Windows 10, version 1809.

      -
      [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)

      Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

      -
      [Win32CompatibilityAppraiser CSP](win32compatibilityappraiser-csp.md)

      Added new configuration service provider in Windows 10, version 1809.

      -
      [WindowsLicensing CSP](windowslicensing-csp.md)

      Added S mode settings and SyncML examples in Windows 10, version 1809.

      -
      [SUPL CSP](supl-csp.md)

      Added 3 new certificate nodes in Windows 10, version 1809.

      -
      [Defender CSP](defender-csp.md)

      Added a new node Health/ProductStatus in Windows 10, version 1809.

      -
      [BitLocker CSP](bitlocker-csp.md)

      Added a new node AllowStandardUserEncryption in Windows 10, version 1809. Added support for Windows 10 Pro.

      -
      [DevDetail CSP](devdetail-csp.md)

      Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

      -
      [Wifi CSP](wifi-csp.md)

      Added a new node WifiCost in Windows 10, version 1809.

      -
      [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)

      Added new settings in Windows 10, version 1809.

      -
      [RemoteWipe CSP](remotewipe-csp.md)

      Added new settings in Windows 10, version 1809.

      -
      [TenantLockdown CSP](tenantlockdown-csp.md)

      Added new CSP in Windows 10, version 1809.

      -
      [Office CSP](office-csp.md)

      Added FinalStatus setting in Windows 10, version 1809.

      -
      - - ## Breaking changes and known issues -### Get command inside an atomic command is not supported +### Get command inside an atomic command is not supported In Windows 10, a Get command inside an atomic command is not supported. This was allowed in Windows Phone 8 and Windows Phone 8.1. -### Notification channel URI not preserved during upgrade from Windows 8.1 to Windows 10 +### Notification channel URI not preserved during upgrade from Windows 8.1 to Windows 10 During an upgrade from Windows 8.1 to Windows 10, the notification channel URI information is not preserved. In addition, the MDM client loses the PFN, AppID, and client secret. After upgrading to Windows 10, you should call MDM\_WNSConfiguration class to recreate the notification channel URI. -### Apps installed using WMI classes are not removed +### Apps installed using WMI classes are not removed Applications installed using WMI classes are not removed when the MDM account is removed from device. -### Passing CDATA in SyncML does not work +### Passing CDATA in SyncML does not work Passing CDATA in data in SyncML to ConfigManager and CSPs does not work in Windows 10. It worked in Windows Phone 8. -### SSL settings in IIS server for SCEP must be set to "Ignore" +### SSL settings in IIS server for SCEP must be set to "Ignore" The certificate setting under "SSL Settings" in the IIS server for SCEP must be set to "Ignore" in Windows 10. In Windows Phone 8.1, when you set the client certificate to "Accept," it works fine. ![ssl settings](images/ssl-settings.png) -### MDM enrollment fails on the mobile device when traffic is going through proxy +### MDM enrollment fails on the mobile device when traffic is going through proxy When the mobile device is configured to use a proxy that requires authentication, the enrollment will fail. To work around this issue, the user can use a proxy that does not require authentication or remove the proxy setting from the connected network. -### Server-initiated unenrollment failure +### Server-initiated unenrollment failure Server-initiated unenrollment for a device enrolled by adding a work account silently fails leaving the MDM account active. MDM policies and resources are still in place and the client can continue to sync with the server. Remote server unenrollment is disabled for mobile devices enrolled via Azure Active Directory Join. It returns an error message to the server. The only way to remove enrollment for a mobile device that is Azure AD joined is by remotely wiping the device. -### Certificates causing issues with Wi-Fi and VPN +### Certificates causing issues with Wi-Fi and VPN Currently in Windows 10, version 1511, when using the ClientCertificateInstall to install certificates to the device store and the user store and both certificates are sent to the device in the same MDM payload, the certificate intended for the device store will also get installed in the user store. This may cause issues with Wi-Fi or VPN when choosing the correct certificate to establish a connection. We are working to fix this issue. -### Version information for mobile devices +### Version information for mobile devices The software version information from **DevDetail/SwV** does not match the version in **Settings** under **System/About**. -### Upgrading Windows Phone 8.1 devices with app whitelisting using ApplicationRestriction policy has issues +### Upgrading Windows Phone 8.1 devices with app whitelisting using ApplicationRestriction policy has issues - When you upgrade Windows Phone 8.1 devices to Windows 10 Mobile using ApplicationRestrictions with a list of allowed apps, some Windows inbox apps get blocked causing unexpected behavior. To work around this issue, you must include the [inbox apps](applocker-csp.md#inboxappsandcomponents) that you need to your list of allowed apps. @@ -1575,15 +1709,15 @@ The software version information from **DevDetail/SwV** does not match the versi No workaround is available at this time. An OS update to fix this issue is coming soon. -### Apps dependent on Microsoft Frameworks may get blocked in phones prior to build 10586.218 +### Apps dependent on Microsoft Frameworks may get blocked in phones prior to build 10586.218 Applies only to phone prior to build 10586.218: When ApplicationManagement/ApplicationRestrictions policy is deployed to Windows 10 Mobile, installation and update of apps dependent on Microsoft Frameworks may get blocked with error 0x80073CF9. To work around this issue, you must include the Microsoft Framework Id to your list of allowed apps. -``` syntax +```xml ``` -### Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile +### Multiple certificates might cause Wi-Fi connection instabilities in Windows 10 Mobile In your deployment, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned does not have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. The solution is to ensure that the Wi-Fi profile provisioned has strict filtering criteria such that it matches only one certificate. @@ -1624,11 +1758,11 @@ The following list describes the prerequisites for a certificate to be used with The following XML sample explains the properties for the EAP TLS XML including certificate filtering. ->[!NOTE] +> [!NOTE] >For PEAP or TTLS Profiles the EAP TLS XML is embedded within some PEAP or TTLS specific elements. -  -``` syntax + +```xml 13 @@ -1727,10 +1861,10 @@ The following XML sample explains the properties for the EAP TLS XML including c ``` ->[!NOTE] +> [!NOTE] >The EAP TLS XSD is located at **%systemdrive%\\Windows\\schemas\\EAPMethods\\eaptlsconnectionpropertiesv3.xsd** -  + Alternatively you can use the following procedure to create an EAP Configuration XML. @@ -1752,33 +1886,141 @@ Alternatively you can use the following procedure to create an EAP Configuration 7. Close the rasphone dialog box. 8. Continue following the procedure in the [EAP configuration](eap-configuration.md) topic from Step 9 to get an EAP TLS profile with appropriate filtering. ->[!NOTE] +> [!NOTE] >You can also set all the other applicable EAP Properties through this UI as well. A guide for what these properties mean can be found in the [Extensible Authentication Protocol (EAP) Settings for Network Access](https://technet.microsoft.com/library/hh945104.aspx) topic. -### Remote PIN reset not supported in Azure Active Directory joined mobile devices +### Remote PIN reset not supported in Azure Active Directory joined mobile devices In Windows 10 Mobile, remote PIN reset in Azure AD joined devices are not supported. Devices are wiped when you issue a remote PIN reset command using the RemoteLock CSP. -### MDM client will immediately check-in with the MDM server after client renews WNS channel URI +### MDM client will immediately check-in with the MDM server after client renews WNS channel URI Starting in Windows 10, after the MDM client automatically renews the WNS channel URI, the MDM client will immediately check-in with the MDM server. Henceforth, for every MDM client check-in, the MDM server should send a GET request for "ProviderID/Push/ChannelURI" to retrieve the latest channel URI and compare it with the existing channel URI; then update the channel URI if necessary. -### User provisioning failure in Azure Active Directory joined Windows 10 PC +### User provisioning failure in Azure Active Directory joined Windows 10 PC In Azure AD joined Windows 10 PC, provisioning /.User resources fails when the user is not logged in as an Azure AD user. If you attempt to join Azure AD from **Settings** > **System** > **About** user interface, make sure to log off and log on with Azure AD credentials to get your organizational configuration from your MDM server. This behavior is by design. -### Requirements to note for VPN certificates also used for Kerberos Authentication +### Requirements to note for VPN certificates also used for Kerberos Authentication If you want to use the certificate used for VPN authentication also for Kerberos authentication (required if you need access to on-premises resources using NTLM or Kerberos), the user's certificate must meet the requirements for smart card certificate, the Subject field should contain the DNS domain name in the DN or the SAN should contain a fully qualified UPN so that the DC can be located from the DNS registrations. If certificates that do not meet these requirements are used for VPN, users may fail to access resources that require Kerberos authentication. This issue primarily impacts Windows Phone. -### Device management agent for the push-button reset is not working +### Device management agent for the push-button reset is not working The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/push-button-reset-overview) keeps the registry settings for OMA DM sessions, but deletes the task schedules. The client enrollment is retained, but it never syncs with the MDM service. +## Frequently Asked Questions + + +### **Can there be more than 1 MDM server to enroll and manage devices in Windows 10?** +No. Only one MDM is allowed. + +### **How do I set the maximum number of Azure Active Directory joined devices per user?** +1. Login to the portal as tenant admin: https://manage.windowsazure.com. +2. Click Active Directory on the left pane. +3. Choose your tenant. +4. Click **Configure**. +5. Set quota to unlimited. + + ![aad maximum joined devices](images/faq-max-devices.png) + + +### **What is dmwappushsvc?** + +Entry | Description +--------------- | -------------------- +What is dmwappushsvc? | It is a Windows service that ships in Windows 10 operating system as a part of the windows management platform. It is used internally by the operating system as a queue for categorizing and processing all WAP messages, which include Windows management messages, MMS, NabSync, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | +What data is handled by dmwappushsvc? | It is a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further: MMS, NabSync, SI/SL. | +How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. | ## Change history in MDM documentation +### January 2020 +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - Defender](policy-csp-defender.md)|Added descriptions for supported actions for Defender/ThreatSeverityDefaultAction.| + + +### November 2019 + +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added option 5 in the supported values list for DeliveryOptimization/DOGroupIdSource.| +|[DiagnosticLog CSP](diagnosticlog-csp.md)|Added substantial updates to this CSP doc.| + +### October 2019 + +|New or updated topic | Description| +|--- | ---| +|[BitLocker CSP](bitlocker-csp.md)|Added the following new nodes:
      ConfigureRecoveryPasswordRotation, RotateRecoveryPasswords, RotateRecoveryPasswordsStatus, RotateRecoveryPasswordsRequestID.| +|[Defender CSP](defender-csp.md)|Added the following new nodes:
      Health/TamperProtectionEnabled, Health/IsVirtualMachine, Configuration, Configuration/TamperProtection, Configuration/EnableFileHashComputation.| + +### September 2019 + +|New or updated topic | Description| +|--- | ---| +|[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)|Added the following new node:
      IsStub.| +|[Policy CSP - Defender](policy-csp-defender.md)|Updated the supported value list for Defender/ScheduleScanDay policy.| +|[Policy CSP - DeviceInstallation](policy-csp-deviceinstallation.md)|Added the following new policies:
      DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs, DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs.| + +### August 2019 + +|New or updated topic | Description| +|--- | ---| +|[DiagnosticLog CSP](diagnosticlog-csp.md)
      [DiagnosticLog DDF](diagnosticlog-ddf.md)|Added version 1.4 of the CSP in Windows 10, version 1903. Added the new 1.4 version of the DDF. Added the following new nodes:
      Policy, Policy/Channels, Policy/Channels/ChannelName, Policy/Channels/ChannelName/MaximumFileSize, Policy/Channels/ChannelName/SDDL, Policy/Channels/ChannelName/ActionWhenFull, Policy/Channels/ChannelName/Enabled, DiagnosticArchive, DiagnosticArchive/ArchiveDefinition, DiagnosticArchive/ArchiveResults.| +|[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md)|Enhanced the article to include additional reference links and the following two topics:
      Verify auto-enrollment requirements and settings, Troubleshoot auto-enrollment of devices.| + +### July 2019 + +|New or updated topic | Description| +|--- | ---| +|[Policy CSP](policy-configuration-service-provider.md)|Added the following list:
      Policies supported by HoloLens 2| +|[ApplicationControl CSP](applicationcontrol-csp.md)|Added new CSP in Windows 10, version 1903.| +|[PassportForWork CSP](passportforwork-csp.md)|Added the following new nodes in Windows 10, version 1903:
      SecurityKey, SecurityKey/UseSecurityKeyForSignin| +|[Policy CSP - Privacy](policy-csp-privacy.md)|Added the following new policies:
      LetAppsActivateWithVoice, LetAppsActivateWithVoiceAboveLock| +|Create a custom configuration service provider|Deleted the following documents from the CSP reference because extensibility via CSPs is not currently supported:
      Create a custom configuration service provider
      Design a custom configuration service provider
      IConfigServiceProvider2
      IConfigServiceProvider2::ConfigManagerNotification
      IConfigServiceProvider2::GetNode
      ICSPNode
      ICSPNode::Add
      ICSPNode::Clear
      ICSPNode::Copy
      ICSPNode::DeleteChild
      ICSPNode::DeleteProperty
      ICSPNode::Execute
      ICSPNode::GetChildNodeNames
      ICSPNode::GetProperty
      ICSPNode::GetPropertyIdentifiers
      ICSPNode::GetValue
      ICSPNode::Move
      ICSPNode::SetProperty
      ICSPNode::SetValue
      ICSPNodeTransactioning
      ICSPValidate
      Samples for writing a custom configuration service provider.| + + +### June 2019 + +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - DeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md)|Added the following new policies:
      AllowDeviceHealthMonitoring, ConfigDeviceHealthMonitoringScope, ConfigDeviceHealthMonitoringUploadDestination.| +|[Policy CSP - TimeLanguageSettings](policy-csp-timelanguagesettings.md)|Added the following new policy:
      ConfigureTimeZone.| + + +### May 2019 + +|New or updated topic | Description| +|--- | ---| +|[DeviceStatus CSP](devicestatus-csp.md)|Updated description of the following nodes:
      DeviceStatus/Antivirus/SignatureStatus, DeviceStatus/Antispyware/SignatureStatus.| +|[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)|Added new CSP in Windows 10, version 1903.| +|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added the following new policies:
      DODelayCacheServerFallbackBackground, DODelayCacheServerFallbackForeground.

      Updated description of the following policies:
      DOMinRAMAllowedToPeer, DOMinFileSizeToCache, DOMinDiskSizeAllowedToPeer.| +|[Policy CSP - Experience](policy-csp-experience.md)|Added the following new policy:
      ShowLockOnUserTile.| +|[Policy CSP - InternetExplorer](policy-csp-internetexplorer.md)|Added the following new policies:
      AllowEnhancedSuggestionsInAddressBar, DisableActiveXVersionListAutoDownload, DisableCompatView, DisableFeedsBackgroundSync, DisableGeolocation, DisableWebAddressAutoComplete, NewTabDefaultPage.| +|[Policy CSP - Power](policy-csp-power.md)|Added the following new policies:
      EnergySaverBatteryThresholdOnBattery, EnergySaverBatteryThresholdPluggedIn, SelectLidCloseActionOnBattery, SelectLidCloseActionPluggedIn, SelectPowerButtonActionOnBattery, SelectPowerButtonActionPluggedIn, SelectSleepButtonActionOnBattery, SelectSleepButtonActionPluggedIn, TurnOffHybridSleepOnBattery, TurnOffHybridSleepPluggedIn, UnattendedSleepTimeoutOnBattery, UnattendedSleepTimeoutPluggedIn.| +|[Policy CSP - Search](policy-csp-search.md)|Added the following new policy:
      AllowFindMyFiles.| +|[Policy CSP - ServiceControlManager](policy-csp-servicecontrolmanager.md)|Added the following new policy:
      SvchostProcessMitigation.| +|[Policy CSP - System](policy-csp-system.md)|Added the following new policies:
      AllowCommercialDataPipeline, TurnOffFileHistory.| +|[Policy CSP - Troubleshooting](policy-csp-troubleshooting.md)|Added the following new policy:
      AllowRecommendations.| +|[Policy CSP - Update](policy-csp-update.md)|Added the following new policies:
      AutomaticMaintenanceWakeUp, ConfigureDeadlineForFeatureUpdates, ConfigureDeadlineForQualityUpdates, ConfigureDeadlineGracePeriod, ConfigureDeadlineNoAutoReboot.| +|[Policy CSP - WindowsLogon](policy-csp-windowslogon.md)|Added the following new policies:
      AllowAutomaticRestartSignOn, ConfigAutomaticRestartSignOn, EnableFirstLogonAnimation.

      Removed the following policy:
      SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart. This policy is replaced by AllowAutomaticRestartSignOn.| + +### April 2019 + +| New or updated topic | Description | +|-------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md) | Added the following warning at the end of the Overview section:
      Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined. | +| [Policy CSP - UserRights](policy-csp-userrights.md) | Added a note stating if you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag () to wrap the data fields. | + +### March 2019 + +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - Storage](policy-csp-storage.md)|Updated ADMX Info of the following policies:
      AllowStorageSenseGlobal, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseCloudContentDehydrationThreshold, ConfigStorageSenseDownloadsCleanupThreshold, ConfigStorageSenseGlobalCadence, ConfigStorageSenseRecycleBinCleanupThreshold.

      Updated description of ConfigStorageSenseDownloadsCleanupThreshold.| + + ### February 2019 |New or updated topic | Description| @@ -1821,31 +2063,31 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[BitLocker CSP](bitlocker-csp.md) +BitLocker CSP

      Added support for Windows 10 Pro starting in the version 1809.

      -[Office CSP](office-csp.md) +Office CSP

      Added FinalStatus setting in Windows 10, version 1809.

      -[RemoteWipe CSP](remotewipe-csp.md) +RemoteWipe CSP

      Added new settings in Windows 10, version 1809.

      -[TenantLockdown CSP](\tenantlockdown--csp.md) +TenantLockdown CSP

      Added new CSP in Windows 10, version 1809.

      -[WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) +WindowsDefenderApplicationGuard CSP

      Added new settings in Windows 10, version 1809.

      -[Policy DDF file](policy-ddf-file.md) +Policy DDF file

      Posted an updated version of the Policy DDF for Windows 10, version 1809.

      -[Policy CSP](policy-configuration-service-provider.md) +Policy CSP

      Added the following new policies in Windows 10, version 1809:

      • Browser/AllowFullScreenMode
        • @@ -1899,52 +2141,52 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[AssignedAccess CSP](assignedaccess-csp.md) +AssignedAccess CSP

        Added the following note:

        • You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
        -[PassportForWork CSP](passportforwork-csp.md) +PassportForWork CSP

        Added new settings in Windows 10, version 1809.

        -[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) +EnterpriseModernAppManagement CSP

        Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

        -[Win32CompatibilityAppraiser CSP](win32compatibilityappraiser-csp.md) +Win32CompatibilityAppraiser CSP

        Added new configuration service provider in Windows 10, version 1809.

        -[WindowsLicensing CSP](windowslicensing-csp.md) +WindowsLicensing CSP

        Added S mode settings and SyncML examples in Windows 10, version 1809.

        -[SUPL CSP](supl-csp.md) +SUPL CSP

        Added 3 new certificate nodes in Windows 10, version 1809.

        -[Defender CSP](defender-csp.md) +Defender CSP

        Added a new node Health/ProductStatus in Windows 10, version 1809.

        -[BitLocker CSP](bitlocker-csp.md) +BitLocker CSP

        Added a new node AllowStandardUserEncryption in Windows 10, version 1809.

        -[DevDetail CSP](devdetail-csp.md) +DevDetail CSP

        Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

        -[Policy CSP](policy-configuration-service-provider.md) +Policy CSP

        Added the following new policies in Windows 10, version 1809:

        • ApplicationManagement/LaunchAppAfterLogOn
        • ApplicationManagement/ScheduleForceRestartForUpdateFailures
          • -
        • Authentication/EnableFastFirstSignIn
          • -
        • Authentication/EnableWebSignIn
          • +
        • Authentication/EnableFastFirstSignIn (Preview mode only)
          • +
        • Authentication/EnableWebSignIn (Preview mode only)
        • Authentication/PreferredAadTenantDomainName
        • Defender/CheckForSignaturesBeforeRunningScan
        • Defender/DisableCatchupFullScan
          • @@ -1989,11 +2231,11 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[Wifi CSP](wifi-csp.md) +Wifi CSP

          Added a new node WifiCost in Windows 10, version 1809.

          -[Diagnose MDM failures in Windows 10](diagnose-mdm-failures-in-windows-10.md) +Diagnose MDM failures in Windows 10

          Recent changes:

          • Added procedure for collecting logs remotely from Windows 10 Holographic.
            • @@ -2001,19 +2243,19 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
          -[Bitlocker CSP](bitlocker-csp.md) +Bitlocker CSP

          Added new node AllowStandardUserEncryption in Windows 10, version 1809.

          -[Policy CSP](policy-configuration-service-provider.md) +Policy CSP

          Recent changes:

          • AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration - removed from docs. Not supported.
          • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
          • AccountPoliciesAccountLockoutPolicy/ResetAccountLockoutCounterAfter - removed from docs. Not supported.
          • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers - removed from docs. Not supported.
            • -
          • System/AllowFontProviders is not supported in Windows Holographic for Business.
            • -
          • Security/RequireDeviceEncryption is suported in the Home SKU.
            • +
          • System/AllowFontProviders is not supported in HoloLens (1st gen) Commercial Suite.
            • +
          • Security/RequireDeviceEncryption is supported in the Home SKU.
          • Start/StartLayout - added a table of SKU support information.
          • Start/ImportEdgeAssets - added a table of SKU support information.
          @@ -2027,7 +2269,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
        -[WiredNetwork CSP](wirednetwork-csp.md) +WiredNetwork CSP New CSP added in Windows 10, version 1809. @@ -2049,11 +2291,11 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[Policy DDF file](policy-ddf-file.md) +Policy DDF file

        Updated the DDF files in the Windows 10 version 1703 and 1709.

        @@ -2074,7 +2316,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) +WindowsDefenderApplicationGuard CSP

        Added the following node in Windows 10, version 1803:

        • Settings/AllowVirtualGPU
          • @@ -2082,26 +2324,26 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
        -[NetworkProxy CSP](\networkproxy--csp.md) +NetworkProxy CSP

        Added the following node in Windows 10, version 1803:

        • ProxySettingsPerUser
        -[Accounts CSP](accounts-csp.md) +Accounts CSP

        Added a new CSP in Windows 10, version 1803.

        -[MDM Migration Analysis Too (MMAT)](https://aka.ms/mmat) +MDM Migration Analysis Too (MMAT)

        Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

        -[CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download) +CSP DDF files download

        Added the DDF download of Windows 10, version 1803 configuration service providers.

        -[Policy CSP](policy-configuration-service-provider.md) +Policy CSP

        Added the following new policies for Windows 10, version 1803:

        • Bluetooth/AllowPromptedProximalConnections
          • @@ -2133,40 +2375,40 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[eUICCs CSP](euiccs-csp.md) +eUICCs CSP

          Added the following node in Windows 10, version 1803:

          • IsEnabled
          -[DeviceStatus CSP](devicestatus-csp.md) +DeviceStatus CSP

          Added the following node in Windows 10, version 1803:

          • OS/Mode
          -[Understanding ADMX-backed policies](understanding-admx-backed-policies.md) +Understanding ADMX-backed policies

          Added the following videos:

          -[AccountManagement CSP](accountmanagement-csp.md) +AccountManagement CSP

          Added a new CSP in Windows 10, version 1803.

          -[RootCATrustedCertificates CSP](rootcacertificates-csp.md) +RootCATrustedCertificates CSP

          Added the following node in Windows 10, version 1803:

          • UntrustedCertificates
          -[Policy CSP](policy-configuration-service-provider.md) +Policy CSP

          Added the following new policies for Windows 10, version 1803:

          • ApplicationDefaults/EnableAppUriHandlers
            • @@ -2185,19 +2427,19 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware

          Added a new section:

            -
          • [Policies supported by GP](policy-configuration-service-provider.md#policies-supported-by-gp) - list of policies in Policy CSP that has corresponding Group Policy. The policy description contains the GP information, such as GP policy name and variable name.
            • +
          • Policies supported by Group Policy - list of policies in Policy CSP that has corresponding Group Policy. The policy description contains the GP information, such as GP policy name and variable name.
          -[Policy CSP - Bluetooth](policy-csp-bluetooth.md) -

          Added new section [ServicesAllowedList usage guide](policy-csp-bluetooth.md#servicesallowedlist-usage-guide).

          +Policy CSP - Bluetooth +

          Added new section ServicesAllowedList usage guide.

          -[MultiSIM CSP](multisim-csp.md) +MultiSIM CSP

          Added SyncML examples and updated the settings descriptions.

          -[RemoteWipe CSP](remotewipe-csp.md) +RemoteWipe CSP

          Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.

          @@ -2218,7 +2460,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[Policy CSP](policy-configuration-service-provider.md) +Policy CSP

          Added the following new policies for Windows 10, version 1803:

          • Display/DisablePerProcessDpiForApps
            • @@ -2236,25 +2478,25 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
              -[VPNv2 ProfileXML XSD](vpnv2-profile-xsd.md) +VPNv2 ProfileXML XSD

              Updated the XSD and Plug-in profile example for VPNv2 CSP.

              -[AssignedAccess CSP](assignedaccess-csp.md) +AssignedAccess CSP

              Added the following nodes in Windows 10, version 1803:

              • Status
              • ShellLauncher
              • StatusConfiguration
              -

              Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in Windows Holographic for Business edition. Added example for Windows Holographic for Business edition.

              +

              Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

              -[MultiSIM CSP](multisim-csp.md) +MultiSIM CSP

              Added a new CSP in Windows 10, version 1803.

              -[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) +EnterpriseModernAppManagement CSP

              Added the following node in Windows 10, version 1803:

              • MaintainProcessorArchitectureOnUpdate
                • @@ -2278,7 +2520,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[Policy CSP](policy-configuration-service-provider.md) +Policy CSP

                Added the following new policies for Windows 10, version 1803:

                • Browser/AllowConfigurationUpdateForBooksLibrary
                  • @@ -2377,15 +2619,15 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware

                  Security/RequireDeviceEncryption - updated to show it is supported in desktop.

                  -[BitLocker CSP](bitlocker-csp.md) +BitLocker CSP

                  Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

                  -[EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) +EnterpriseModernAppManagement CSP

                  Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.

                  -[DMClient CSP](dmclient-csp.md) +DMClient CSP

                  Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

                  • AADSendDeviceToken
                    • @@ -2397,15 +2639,15 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
                  -[Defender CSP](defender-csp.md) +Defender CSP

                  Added new node (OfflineScan) in Windows 10, version 1803.

                  -[UEFI CSP](uefi-csp.md) +UEFI CSP

                  Added a new CSP in Windows 10, version 1803.

                  -[Update CSP](update-csp.md) +Update CSP

                  Added the following nodes in Windows 10, version 1803:

                  • Rollback
                    • @@ -2432,8 +2674,8 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[Configuration service provider reference](configuration-service-provider-reference.md) -

                    Added new section [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download)

                    +Configuration service provider reference +

                    Added new section CSP DDF files download

                    @@ -2453,7 +2695,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[Policy CSP](policy-configuration-service-provider.md) +Policy CSP

                    Added the following policies for Windows 10, version 1709:

                    • Authentication/AllowFidoDeviceSignon
                      • @@ -2491,11 +2733,11 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[Policy DDF file](policy-ddf-file.md) +Policy DDF file

                      Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709.

                      -[Policy CSP](policy-configuration-service-provider.md) +Policy CSP

                      Updated the following policies:

                      • Defender/ControlledFolderAccessAllowedApplications - string separator is |.
                        • @@ -2503,15 +2745,15 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
                      -[eUICCs CSP](euiccs-csp.md) +eUICCs CSP

                      Added new CSP in Windows 10, version 1709.

                      -[AssignedAccess CSP](assignedaccess-csp.md) +AssignedAccess CSP

                      Added SyncML examples for the new Configuration node.

                      -[DMClient CSP](dmclient-csp.md) +DMClient CSP

                      Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

                      @@ -2533,7 +2775,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[Policy CSP](policy-configuration-service-provider.md) +Policy CSP

                      Added the following new policies for Windows 10, version 1709:

                      • Authentication/AllowAadPasswordReset
                        • @@ -2544,7 +2786,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware

                        Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709.

                        -[AssignedAccess CSP](assignedaccess-csp.md) +AssignedAccess CSP

                        Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.

                        @@ -2552,7 +2794,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware

                        Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

                        -The [\[MS-MDE2\]: Mobile Device Enrollment Protocol Version 2](https://msdn.microsoft.com/library/mt221945.aspx) +The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2

                        The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

                        • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
                          • @@ -2562,26 +2804,26 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware

                          For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

                          -[EntepriseAPN CSP](enterpriseapn-csp.md) +EnterpriseAPN CSP

                          Added a SyncML example.

                          -[VPNv2 CSP](vpnv2-csp.md) +VPNv2 CSP

                          Added RegisterDNS setting in Windows 10, version 1709.

                          -[Enroll a Windows 10 device automatically using Group Policy](enroll-a-windows-10-device-automatically-using-group-policy.md) +Enroll a Windows 10 device automatically using Group Policy

                          Added new topic to introduce a new Group Policy for automatic MDM enrollment.

                          -[MDM enrollment of Windows-based devices](mdm-enrollment-of-windows-devices.md) +MDM enrollment of Windows-based devices

                          New features in the Settings app:

                          • User sees installation progress of critical policies during MDM enrollment.
                          • User knows what policies, profiles, apps MDM has configured
                          • IT helpdesk can get detailed MDM diagnostic information using client tools
                          -

                          For details, see [Managing connections](mdm-enrollment-of-windows-devices.md#managing-connections) and [Collecting diagnostic logs](mdm-enrollment-of-windows-devices.md#collecting-diagnostic-logs)

                          +

                          For details, see Managing connections and Collecting diagnostic logs

                          @@ -2601,22 +2843,22 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware -[Enable ADMX-backed policies in MDM](enable-admx-backed-policies-in-mdm.md) +Enable ADMX-backed policies in MDM

                          Added new step-by-step guide to enable ADMX-backed policies.

                          -[Mobile device enrollment](mobile-device-enrollment.md) +Mobile device enrollment

                          Added the following statement:

                          • Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.
                          -[CM\_CellularEntries CSP](cm-cellularentries-csp.md) +CM_CellularEntries CSP

                          Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.

                          -[EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) +EnterpriseDataProtection CSP

                          Updated the Settings/EDPEnforcementLevel values to the following:

                          • 0 (default) – Off / No protection (decrypts previously protected data).
                            • @@ -2626,30 +2868,30 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
                          -[AppLocker CSP](applocker-csp.md) -

                          Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in [Whitelist examples](applocker-csp.md#whitelist-examples).

                          +AppLocker CSP +

                          Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in Whitelist examples.

                          -[DeviceManageability CSP](devicemanageability-csp.md) +DeviceManageability CSP

                          Added the following settings in Windows 10, version 1709:

                            -
                          • Provider/_ProviderID_/ConfigInfo
                            • -
                          • Provider/_ProviderID_/EnrollmentInfo
                            • +
                          • Provider/ProviderID/ConfigInfo
                            • +
                          • Provider/ProviderID/EnrollmentInfo
                          -[Office CSP](office-csp.md) +Office CSP

                          Added the following setting in Windows 10, version 1709:

                          • Installation/CurrentStatus
                          -[BitLocker CSP](bitlocker-csp.md) +BitLocker CSP Added information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. -[Firewall CSP](firewall-csp.md) +Firewall CSP Updated the CSP and DDF topics. Here are the changes:
                          • Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
                            • @@ -2659,8 +2901,8 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
                          -[Policy DDF file](policy-ddf-file.md) -Added another Policy DDF file [download](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) for the 8C release of Windows 10, version 1607, which added the following policies: +Policy DDF file +Added another Policy DDF file download for the 8C release of Windows 10, version 1607, which added the following policies:
                          • Browser/AllowMicrosoftCompatibilityList
                          • Update/DisableDualScan
                            • @@ -2668,7 +2910,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
                          -[Policy CSP](policy-configuration-service-provider.md) +Policy CSP

                          Added the following new policies for Windows 10, version 1709:

                          • Browser/ProvisionFavorites
                            • @@ -2676,8 +2918,6 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
                          • ExploitGuard/ExploitProtectionSettings
                          • Games/AllowAdvancedGamingServices
                          • LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
                            • -
                          • LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus
                            • -
                          • LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus
                          • LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
                          • LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount
                          • LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount
                            • @@ -2711,7 +2951,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
                          • Defender/GuardedFoldersList to Defender/ControlledFolderAccessProtectedFolders
                          • Defender/EnableGuardMyFolders to Defender/EnableControlledFolderAccess
                          -

                          Added links to the additional [ADMX-backed BitLocker policies](policy-csp-bitlocker.md).

                          +

                          Added links to the additional ADMX-backed BitLocker policies.

                          There were issues reported with the previous release of the following policies. These issues were fixed in Window 10, version 1709:

                          • Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts
                            • @@ -2720,35 +2960,3 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware - -  - -## FAQ - - -**Can there be more than 1 MDM server to enroll and manage devices in Windows 10?** -No. Only one MDM is allowed. - -**How do I set the maximum number of Azure Active Directory joined devices per user?** -1. Login to the portal as tenant admin: https://manage.windowsazure.com. -2. Click Active Directory on the left pane. -3. Choose your tenant. -4. Click **Configure**. -5. Set quota to unlimited. - - ![aad maximum joined devices](images/faq-max-devices.png) -  - -**What is dmwappushsvc?** - -Entry | Description ---------------- | -------------------- -What is dmwappushsvc? | It is a Windows service that ships in Windows 10 operating system as a part of the windows management platform. It is used internally by the operating system as a queue for categorizing and processing all WAP messages, which include Windows management messages, MMS, NabSync, and Service Indication/Service Loading (SI/SL). The service also initiates and orchestrates management sync sessions with the MDM server. | -What data is handled by dmwappushsvc? | It is a component handling the internal workings of the management platform and involved in processing messages that have been received by the device remotely for management. The messages in the queue are serviced by another component that is also part of the Windows management stack to process messages. The service also routes and authenticates WAP messages received by the device to internal OS components that process them further: MMS, NabSync, SI/SL. | -How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. | - - - - - - diff --git a/windows/client-management/mdm/nodecache-csp.md b/windows/client-management/mdm/nodecache-csp.md index 28bcf637f6..9072c3eb82 100644 --- a/windows/client-management/mdm/nodecache-csp.md +++ b/windows/client-management/mdm/nodecache-csp.md @@ -2,11 +2,13 @@ title: NodeCache CSP description: NodeCache CSP ms.assetid: b4dd2b0d-79ef-42ac-ab5b-ee07b3097876 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -17,7 +19,7 @@ The NodeCache configuration service provider is used to manage the client cache. NodeCache supports the comparison of hash values instead of actual node values: -``` syntax +```xml application/x-nodemon-sha256 @@ -30,7 +32,7 @@ The following diagram shows the NodeCache configuration service provider in tree ![nodecache csp](images/provisioning-csp-nodecache.png) **./Device/Vendor/MSFT and ./User/Vendor/MSFT** -Required. The root node for the NodeCache object. Supported operation is Get. This configuration service provider is used for enterprise device management only. This is a predefined MIME type to identify this managed object in OMA DM syntax. Starting in Windows 10, version 1607 the value is com.microsoft/\/MDM/NodeCache. +Required. The root node for the NodeCache object. Supported operation is Get. This configuration service provider is used for enterprise device management only. This is a predefined MIME type to identify this managed object in OMA DM syntax. ***ProviderID*** Optional. Group settings per DM server. Each group of settings is distinguished by the server’s Provider ID. It should be the same DM server **PROVIDER-ID** value that was supplied through the [w7 APPLICATION configuration service provider](w7-application-csp.md) XML during the enrollment process. Only one enterprise management server is supported. That is, there should be only one *ProviderID* node under **NodeCache**. Scope is dynamic. @@ -57,7 +59,7 @@ Required. Root node for cached nodes. Scope is dynamic. Supported operation is Get. -**/Nodes/****_NodeID_** +**/Nodes/***NodeID* Optional. Information about each cached node is stored under *NodeID* as specified by the server. This value must not contain a comma. Scope is dynamic. Supported operations are Get, Add, and Delete. @@ -74,7 +76,7 @@ Supported operations are Get, Add, and Delete. Here's an example for setting the ExpectedValue to nonexistent. -``` syntax +```xml 10 @@ -144,7 +146,7 @@ Supported operations are Add, Get, and Delete. Creating settings for node caching: -``` syntax +```xml 2 @@ -220,7 +222,7 @@ Creating settings for node caching: Getting nodes under Provider ID MDMSRV1, cache version, changed nodes, node, expected value: -``` syntax +```xml 18 @@ -265,7 +267,7 @@ Getting nodes under Provider ID MDMSRV1, cache version, changed nodes, node, exp Replacing the cache version, node URI, and expected value: -``` syntax +```xml 2 @@ -297,7 +299,7 @@ Replacing the cache version, node URI, and expected value: For AutoSetExpectedValue, a Replace operation with empty data will query the ./DevDetail/Ext/Microsoft/DeviceName. -```syntax +```xml 2001 @@ -333,12 +335,12 @@ A Get operation on ./Vendor/MSFT/NodeCache/MDM%20SyncML%20Server/Nodes/20/Expect A Get operation on the ChangedNodesData returns an encoded XML. Here is example: -```syntax +```xml U09NRU5FV1ZBTFVF ``` It represents this: -```syntax +```xml U09NRU5FV1ZBTFVF @@ -355,9 +357,9 @@ The value inside of the node tag is the actual value returned by the Uri, which [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/nodecache-ddf-file.md b/windows/client-management/mdm/nodecache-ddf-file.md index 3fd58485ce..7d58ebbea3 100644 --- a/windows/client-management/mdm/nodecache-ddf-file.md +++ b/windows/client-management/mdm/nodecache-ddf-file.md @@ -2,11 +2,13 @@ title: NodeCache DDF file description: NodeCache DDF file ms.assetid: d7605098-12aa-4423-89ae-59624fa31236 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. The Office configuration service provider (CSP) enables a Microsoft Office client to be installed on a device via the Office Deployment Tool (ODT). For more information, see [Configuration options for the Office Deployment Tool](https://technet.microsoft.com/library/jj219426.aspx) and [How to assign Office 365 apps to Windows 10 devices with Microsoft Intune](https://docs.microsoft.com/intune/apps-add-office365). @@ -30,12 +30,12 @@ The root node for the Office configuration service provider.

                            **Installation** Specifies the options for the Microsoft Office installation. -The supported operations are Add, Delete, Get, and Replace. +The supported operations are Add, Delete, and Get. **Installation/_id_** Specifies a unique identifier that represents the ID of the Microsoft Office product to install. -The supported operations are Add, Delete, Get, and Replace. +The supported operations are Add, Delete, and Get. **Installation/_id_/Install** Installs Office by using the XML data specified in the configuration.xml file. @@ -67,7 +67,7 @@ The only supported operation is Get. Sample SyncML to install Office 365 Business Retail from current channel. -```syntax +```xml @@ -89,7 +89,7 @@ Sample SyncML to install Office 365 Business Retail from current channel. To uninstall the Office 365 from the system: -```syntax +```xml @@ -111,7 +111,7 @@ To uninstall the Office 365 from the system: To get the current status of Office 365 on the device. -``` syntax +```xml       @@ -265,4 +265,4 @@ To get the current status of Office 365 on the device. Failure - \ No newline at end of file + diff --git a/windows/client-management/mdm/office-ddf.md b/windows/client-management/mdm/office-ddf.md index 1fb6d40a20..7f8b60345e 100644 --- a/windows/client-management/mdm/office-ddf.md +++ b/windows/client-management/mdm/office-ddf.md @@ -2,11 +2,13 @@ title: Office DDF description: This topic shows the OMA DM device description framework (DDF) for the Office configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.assetid: -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 08/15/2018 --- @@ -21,7 +23,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is for Windows 10, version 1809. -``` syntax +```xml

                            DM protocol commands

                            -

                            The following list shows the commands that are used by the device. For further information about the OMA DM command elements, see "SyncML Representation Protocol Device Management Usage (OMA-SyncML-DMRepPro-V1_1_2-20030613-A)" available from the [OMA website](https://www.openmobilealliance.org/release/DM/V1_1_2-20031209-A/).

                            +

                            The following list shows the commands that are used by the device. For further information about the OMA DM command elements, see "SyncML Representation Protocol Device Management Usage (OMA-SyncML-DMRepPro-V1_1_2-20030613-A)" available from the OMA website.

                            • Add (Implicit Add supported)

                            • Alert (DM alert): Generic alert (1226) is used by enterprise management client when the user triggers an MDM unenrollment action from the device or when a CSP finishes some asynchronous actions. Device alert (1224) is used to notify the server some device triggered event.

                              • @@ -121,23 +123,22 @@ The following table shows the OMA DM standards that Windows uses.

                              Provisioning Files

                              -

                              Provisioning XML must be well formed and follow the definition in [SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905) specification.

                              +

                              Provisioning XML must be well formed and follow the definition in SyncML Representation Protocol specification.

                              If an XML element that is not a valid OMA DM command is under SyncBody, the status code 400 is returned for that element.

                              -Note   -

                              To represent a Unicode string as a URI, first encode the string as UTF-8. Then encode each of the UTF-8 bytes using URI encoding.

                              +Note

                              To represent a Unicode string as a URI, first encode the string as UTF-8. Then encode each of the UTF-8 bytes using URI encoding.

                              -  +

                              WBXML support

                              -

                              Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the [SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905) specification.

                              +

                              Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the SyncML Representation Protocol specification.

                              Handling of large objects

                              -

                              In Windows 10, version 1511, client support for uploading large objects to the server was added.

                              +

                              In Windows 10, version 1511, client support for uploading large objects to the server was added.

                              @@ -208,10 +209,10 @@ Common elements are used by other OMA DM element types. The following table list

                              SessionID

                              Specifies the identifier of the OMA DM session associated with the containing message.

                              -Note  If the server does not notify the device that it supports a new version (through SyncApplicationVersion node in the DMClient CSP), the desktop client returns the SessionID in integer in decimal format and the mobile device client returns 2 bytes as a string. If the server supports DM session sync version 2.0, which is used in Windows 10, the desktop and mobile device client returns 2 bytes. +Note If the server does not notify the device that it supports a new version (through SyncApplicationVersion node in the DMClient CSP), the desktop client returns the SessionID in integer in decimal format and the mobile device client returns 2 bytes as a string. If the server supports DM session sync version 2.0, which is used in Windows 10, the desktop and mobile device client returns 2 bytes.
                              -  +
                              @@ -348,7 +349,7 @@ The following LocURL shows a per device CSP node configuration: **./device/vendo ## SyncML response status codes -When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you are likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://go.microsoft.com/fwlink/p/?LinkId=526905) specification. +When using SyncML in OMA DM, there are standard response status codes that are returned. The following table lists the common SyncML response status codes you are likely to see. For more information about SyncML response status codes, see section 10 of the [SyncML Representation Protocol](https://openmobilealliance.org/release/Common/V1_2_2-20090724-A/OMA-TS-SyncML-RepPro-V1_2_2-20090724-A.pdf) specification. | Status code | Description | |-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| @@ -371,13 +372,13 @@ When using SyncML in OMA DM, there are standard response status codes that are r | 507 | `Atomic` failed. One of the operations in an `Atomic` block failed. | | 516 | `Atomic` roll back failed. An `Atomic` operation failed and the command was not rolled back successfully. | -  + ## Related topics [Configuration service provider reference](configuration-service-provider-reference.md) -  + diff --git a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md index 6431b3c083..fc1667fcc2 100644 --- a/windows/client-management/mdm/on-premise-authentication-device-enrollment.md +++ b/windows/client-management/mdm/on-premise-authentication-device-enrollment.md @@ -2,11 +2,13 @@ title: On-premises authentication device enrollment description: This section provides an example of the mobile device enrollment protocol using on-premises authentication policy. ms.assetid: 626AC8B4-7575-4C41-8D59-185D607E3A47 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -28,7 +30,7 @@ For the list of enrollment scenarios not supported in Windows 10, see [Enrollme The discovery web service provides the configuration information necessary for a user to enroll a device with a management service. The service is a restful web service over HTTPS (server authentication only). ->[!NOTE] +> [!NOTE] >The administrator of the discovery service must create a host with the address enterpriseenrollment.*domain\_name*.com. The device’s automatic discovery flow uses the domain name of the email address that was submitted to the Workplace settings screen during sign in. The automatic discovery system constructs a URI that uses this hostname by appending the subdomain “enterpriseenrollment” to the domain of the email address, and by appending the path “/EnrollmentServer/Discovery.svc”. For example, if the email address is “sample@contoso.com”, the resulting URI for first Get request would be: http://enterpriseenrollment.contoso.com/EnrollmentServer/Discovery.svc @@ -84,7 +86,7 @@ https://EnterpriseEnrollment.Contoso.com/EnrollmentServer/Discovery.svc The following example shows the discovery service request. -``` syntax +```xml @@ -127,12 +129,12 @@ The discovery response is in the XML format and includes the following fields: - Authentication policy (AuthPolicy) – Indicates what type of authentication is required. For the MDM server, OnPremise is the supported value, which means that the user will be authenticated when calling the management service URL. This field is mandatory. - Federated is added as another supported value. This allows the server to leverage the Web Authentication Broker to perform customized user authentication, and term of usage acceptance. ->[!NOTE] +> [!NOTE] >The HTTP server response must not be chunked; it must be sent as one message. The following example shows a response received from the discovery web service for OnPremise authentication: -``` syntax +```xml @@ -169,7 +171,7 @@ For the OnPremise authentication policy, the UsernameToken in GetPolicies contai The following example shows the policy web service request. -``` syntax +```xml [!NOTE] +> [!NOTE] >The HTTP server response must not be chunked; it must be sent as one message. The following snippet shows the policy web service response. -``` syntax +```xml //schema The RST may also specify a number of AdditionalContext items, such as DeviceType and Version. Based on these values, for example, the web service can return device-specific and version-specific DM configuration. ->[!NOTE] +> [!NOTE] >The policy service and the enrollment service must be on the same server; that is, they must have the same host name. The following example shows the enrollment web service request for OnPremise authentication. -``` syntax +```xml @@ -515,4 +517,4 @@ The following example shows the encoded provisioning XML. -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index 7bc515edc2..fbb49aae1f 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -2,19 +2,18 @@ title: PassportForWork CSP description: The PassportForWork configuration service provider is used to provision Windows Hello for Business (formerly Microsoft Passport for Work). ms.assetid: 3BAE4827-5497-41EE-B47F-5C071ADB2C51 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 10/31/2018 +author: manikadhiman +ms.date: 07/19/2019 --- # PassportForWork CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - The PassportForWork configuration service provider is used to provision Windows Hello for Business (formerly Microsoft Passport for Work). It allows you to login to Windows using your Active Directory or Azure Active Directory account and replace passwords, smartcards, and virtual smart cards. > [!IMPORTANT] @@ -36,7 +35,7 @@ The following diagram shows the PassportForWork configuration service provider i Root node for PassportForWork configuration service provider. ***TenantId*** -A globally unique identifier (GUID), without curly braces ( { , } ), that is used as part of Windows Hello for Business provisioning and management. +A globally unique identifier (GUID), without curly braces ( { , } ), that is used as part of Windows Hello for Business provisioning and management. To get a GUID, use the PowerShell cmdlet [Get-AzureAccount](https://docs.microsoft.com/powershell/module/servicemanagement/azure/get-azureaccount). For more information see [Get Windows Azure Active Directory Tenant ID in Windows PowerShell](https://devblogs.microsoft.com/scripting/get-windows-azure-active-directory-tenant-id-in-windows-powershell). ***TenantId*/Policies** Node for defining the Windows Hello for Business policy settings. @@ -191,7 +190,7 @@ Default value is false. If you set this policy to true, Remote Windows Hello for Supported operations are Add, Get, Delete, and Replace. -*Not supported on Windows Holographic and Windows Holographic for Business.* +*Not supported on Windows Holographic and Windows Holographic for Business prior to Windows 10 version 1903 (May 2019 Update).* ***TenantId*/Policies/UseHelloCertificatesAsSmartCardCertificates** (only for ./Device/Vendor/MSFT) Added in Windows 10, version 1809. If you enable this policy setting, applications use Windows Hello for Business certificates as smart card certificates. Biometric factors are unavailable when a user is asked to authorize the use of the certificate's private key. This policy setting is designed to allow compatibility with applications that rely exclusively on smart card certificates. @@ -218,7 +217,7 @@ Default value is true, enabling the biometric gestures for use with Windows Hell Supported operations are Add, Get, Delete, and Replace. -*Not supported on Windows Holographic and Windows Holographic for Business.* +*Not supported on Windows Holographic and Windows Holographic for Business prior to Windows 10 version 1903 (May 2019 Update).* **Biometrics/FacialFeaturesUseEnhancedAntiSpoofing** (only for ./Device/Vendor/MSFT) Boolean value used to enable or disable enhanced anti-spoofing for facial feature recognition on Windows Hello face authentication. This node was added in Windows 10, version 1511. @@ -229,11 +228,9 @@ If you set this policy to true, Windows requires all users on managed devices to Note that enhanced anti-spoofing for Windows Hello face authentication is not required on unmanaged devices. - - Supported operations are Add, Get, Delete, and Replace. -*Not supported on Windows Holographic and Windows Holographic for Business.* +*Not supported on Windows Holographic and Windows Holographic for Business prior to Windows 10 version 1903 (May 2019 Update).* **DeviceUnlock** (only for ./Device/Vendor/MSFT) Added in Windows 10, version 1803. Interior node. @@ -267,11 +264,28 @@ Added in Windows 10, version 1803. List of plugins (comma separated) that the pa Value type is string. Supported operations are Add, Get, Replace, and Delete. +**SecurityKey** (only for ./Device/Vendor/MSFT) +Added in Windows 10, version 1903. Interior node. + +Scope is permanent. Supported operation is Get. + + +**SecurityKey/UseSecurityKeyForSignin** (only for ./Device/Vendor/MSFT) +Added in Windows 10, version 1903. Enables users to sign-in to their device with a [FIDO2 security key](https://docs.microsoft.com/azure/active-directory/authentication/concept-authentication-passwordless#fido2-security-keys) that is compatible with Microsoft’s implementation. + +Scope is dynamic. Supported operations are Add, Get, Replace, and Delete. + +Value type is integer. + +Valid values: +- 0 (default) - disabled. +- 1 - enabled. + ## Examples Here's an example for setting Windows Hello for Business and setting the PIN policies. It also turns on the use of biometrics and TPM. -``` syntax +```xml diff --git a/windows/client-management/mdm/passportforwork-ddf.md b/windows/client-management/mdm/passportforwork-ddf.md index 79bf2a8409..f5b345d7d6 100644 --- a/windows/client-management/mdm/passportforwork-ddf.md +++ b/windows/client-management/mdm/passportforwork-ddf.md @@ -1,25 +1,24 @@ --- title: PassportForWork DDF -description: This topic shows the OMA DM device description framework (DDF) for the PassportForWork configuration service provider. DDF files are used only with OMA DM provisioning XML. +description: View the OMA DM device description framework (DDF) for the PassportForWork configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.assetid: A2182898-1577-4675-BAE5-2A3A9C2AAC9B -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/26/2017 +author: manikadhiman +ms.date: 07/29/2019 --- # PassportForWork DDF -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - This topic shows the OMA DM device description framework (DDF) for the **PassportForWork** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1809. +The XML below is for Windows 10, version 1903. ```xml @@ -45,7 +44,7 @@ The XML below is for Windows 10, version 1809. - com.microsoft/1.5/MDM/PassportForWork + com.microsoft/1.6/MDM/PassportForWork @@ -1262,7 +1261,7 @@ Note that enhanced anti-spoofing for Windows Hello face authentication is not re False - Enables/Disables Dynamic Lock + Enables/Disables Dyanamic Lock @@ -1302,6 +1301,52 @@ Note that enhanced anti-spoofing for Windows Hello face authentication is not re + + SecurityKey + + + + + Security Key + + + + + + + + + + + + + + + UseSecurityKeyForSignin + + + + + + + + 0 + Use security key for signin. 0 is disabled. 1 is enable. If you do not configure this policy setting, the default is disabled. + + + + + + + + + + + text/plain + + + + ``` diff --git a/windows/client-management/mdm/personalization-csp.md b/windows/client-management/mdm/personalization-csp.md index 0d0848e6fe..e3914d786d 100644 --- a/windows/client-management/mdm/personalization-csp.md +++ b/windows/client-management/mdm/personalization-csp.md @@ -1,12 +1,14 @@ --- title: Personalization CSP description: Personalization CSP -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 +ms.reviewer: +manager: dansimp --- # Personalization CSP @@ -69,7 +71,7 @@ The following diagram shows the Personalization configuration service provider i ## Example SyncML -``` syntax +```xml diff --git a/windows/client-management/mdm/personalization-ddf.md b/windows/client-management/mdm/personalization-ddf.md index ccdfdff645..2492302fed 100644 --- a/windows/client-management/mdm/personalization-ddf.md +++ b/windows/client-management/mdm/personalization-ddf.md @@ -1,12 +1,14 @@ --- title: Personalization DDF file description: Personalization DDF file -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 +ms.reviewer: +manager: dansimp --- # Personalization DDF file @@ -17,7 +19,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml [!div class="op_single_selector"] +> +> - [Policies supported by Group Policy](policies-supported-by-group-policy.md) +> - [ADMX-backed policies](policies-admx-backed.md) +> + +- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) +- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) +- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) +- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) +- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) +- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) +- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) +- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) +- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) +- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) +- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) +- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) +- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) +- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) +- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) +- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) +- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) +- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) +- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) +- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) +- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) +- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) +- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) +- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) +- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) +- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) +- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) +- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) +- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) +- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) +- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) +- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) +- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) +- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) +- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) +- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) +- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) +- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) +- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) +- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) +- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) +- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) +- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) +- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) +- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) +- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) +- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) +- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) +- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) +- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) +- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) +- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) +- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) +- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) +- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) +- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) +- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) +- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) +- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) +- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) +- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) +- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) +- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) +- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) +- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) +- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) +- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) +- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) +- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) +- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) +- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) +- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) +- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) +- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) +- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) +- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) +- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) +- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) +- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) +- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) +- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) +- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) +- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) +- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) +- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) +- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) +- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) +- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) +- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) +- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) +- [InternetExplorer/DisableActiveXVersionListAutoDownload](./policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) +- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) +- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) +- [InternetExplorer/DisableCompatView](./policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) +- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) +- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) +- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) +- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) +- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) +- [InternetExplorer/DisableFeedsBackgroundSync](./policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) +- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) +- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) +- [InternetExplorer/DisableGeolocation](./policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) +- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) +- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) +- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) +- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) +- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) +- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) +- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) +- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) +- [InternetExplorer/DisableWebAddressAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) +- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) +- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) +- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) +- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) +- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) +- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) +- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) +- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) +- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) +- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) +- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) +- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) +- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) +- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) +- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) +- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) +- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) +- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) +- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) +- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) +- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) +- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) +- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) +- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) +- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) +- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) +- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) +- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) +- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) +- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) +- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) +- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) +- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) +- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) +- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) +- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) +- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) +- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) +- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) +- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) +- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) +- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) +- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) +- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) +- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) +- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) +- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) +- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) +- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) +- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) +- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) +- [InternetExplorer/NewTabDefaultPage](./policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) +- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) +- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) +- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) +- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) +- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) +- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) +- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) +- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) +- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) +- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) +- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) +- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) +- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) +- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) +- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) +- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) +- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) +- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) +- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) +- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) +- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) +- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) +- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) +- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) +- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) +- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) +- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) +- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) +- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) +- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) +- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) +- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) +- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) +- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) +- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) +- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) +- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) +- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) +- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) +- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) +- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) +- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) +- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) +- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) +- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) +- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) +- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) +- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) +- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) +- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) +- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) +- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) +- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) +- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) +- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) +- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) +- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) +- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) +- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) +- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) +- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) +- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) +- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) +- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) +- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) +- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) +- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) +- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) +- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) +- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) +- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) +- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) +- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) +- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) +- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) +- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) +- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) +- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) +- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) +- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) +- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) +- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) +- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) +- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) +- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) +- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) +- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) +- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) +- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) +- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) +- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) +- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) +- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) +- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) +- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) +- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) +- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) +- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) +- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) +- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) +- [WindowsLogon/AllowAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) +- [WindowsLogon/ConfigAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) +- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) +- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) +- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) +- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) + +## Related topics +[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-group-policy.md b/windows/client-management/mdm/policies-supported-by-group-policy.md new file mode 100644 index 0000000000..97ea0d7de0 --- /dev/null +++ b/windows/client-management/mdm/policies-supported-by-group-policy.md @@ -0,0 +1,911 @@ +--- +title: Policies supported by Group Policy +description: Policies supported by Group Policy +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies supported by Group Policy + +> [!div class="op_single_selector"] +> +> - [Policies supported by Group Policy](policies-supported-by-group-policy.md) +> - [ADMX-backed policies](policies-admx-backed.md) +> + +- [AboveLock/AllowCortanaAboveLock](./policy-csp-abovelock.md#abovelock-allowcortanaabovelock) +- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) +- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) +- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) +- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) +- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) +- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) +- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) +- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) +- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) +- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) +- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) +- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) +- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) +- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) +- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) +- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) +- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) +- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) +- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) +- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) +- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) +- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) +- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) +- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) +- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) +- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) +- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) +- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) +- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) +- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) +- [ApplicationDefaults/DefaultAssociationsConfiguration](./policy-csp-applicationdefaults.md#applicationdefaults-defaultassociationsconfiguration) +- [ApplicationDefaults/EnableAppUriHandlers](./policy-csp-applicationdefaults.md#applicationdefaults-enableappurihandlers) +- [ApplicationManagement/AllowAllTrustedApps](./policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [ApplicationManagement/AllowAppStoreAutoUpdate](./policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](./policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [ApplicationManagement/AllowGameDVR](./policy-csp-applicationmanagement.md#applicationmanagement-allowgamedvr) +- [ApplicationManagement/AllowSharedUserAppData](./policy-csp-applicationmanagement.md#applicationmanagement-allowshareduserappdata) +- [ApplicationManagement/DisableStoreOriginatedApps](./policy-csp-applicationmanagement.md#applicationmanagement-disablestoreoriginatedapps) +- [ApplicationManagement/MSIAllowUserControlOverInstall](./policy-csp-applicationmanagement.md#applicationmanagement-msiallowusercontroloverinstall) +- [ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges](./policy-csp-applicationmanagement.md#applicationmanagement-msialwaysinstallwithelevatedprivileges) +- [ApplicationManagement/RequirePrivateStoreOnly](./policy-csp-applicationmanagement.md#applicationmanagement-requireprivatestoreonly) +- [ApplicationManagement/RestrictAppDataToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictappdatatosystemvolume) +- [ApplicationManagement/RestrictAppToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictapptosystemvolume) +- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) +- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) +- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) +- [Authentication/AllowSecondaryAuthenticationDevice](./policy-csp-authentication.md#authentication-allowsecondaryauthenticationdevice) +- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) +- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) +- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) +- [BITS/BandwidthThrottlingEndTime](./policy-csp-bits.md#bits-bandwidththrottlingendtime) +- [BITS/BandwidthThrottlingStartTime](./policy-csp-bits.md#bits-bandwidththrottlingstarttime) +- [BITS/BandwidthThrottlingTransferRate](./policy-csp-bits.md#bits-bandwidththrottlingtransferrate) +- [BITS/CostedNetworkBehaviorBackgroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorbackgroundpriority) +- [BITS/CostedNetworkBehaviorForegroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorforegroundpriority) +- [BITS/JobInactivityTimeout](./policy-csp-bits.md#bits-jobinactivitytimeout) +- [Browser/AllowAddressBarDropdown](./policy-csp-browser.md#browser-allowaddressbardropdown) +- [Browser/AllowAutofill](./policy-csp-browser.md#browser-allowautofill) +- [Browser/AllowCookies](./policy-csp-browser.md#browser-allowcookies) +- [Browser/AllowDeveloperTools](./policy-csp-browser.md#browser-allowdevelopertools) +- [Browser/AllowDoNotTrack](./policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowExtensions](./policy-csp-browser.md#browser-allowextensions) +- [Browser/AllowFlash](./policy-csp-browser.md#browser-allowflash) +- [Browser/AllowFlashClickToRun](./policy-csp-browser.md#browser-allowflashclicktorun) +- [Browser/AllowFullScreenMode](./policy-csp-browser.md#browser-allowfullscreenmode) +- [Browser/AllowInPrivate](./policy-csp-browser.md#browser-allowinprivate) +- [Browser/AllowMicrosoftCompatibilityList](./policy-csp-browser.md#browser-allowmicrosoftcompatibilitylist) +- [Browser/AllowPasswordManager](./policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](./policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowPrelaunch](./policy-csp-browser.md#browser-allowprelaunch) +- [Browser/AllowPrinting](./policy-csp-browser.md#browser-allowprinting) +- [Browser/AllowSavingHistory](./policy-csp-browser.md#browser-allowsavinghistory) +- [Browser/AllowSearchEngineCustomization](./policy-csp-browser.md#browser-allowsearchenginecustomization) +- [Browser/AllowSearchSuggestionsinAddressBar](./policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSideloadingOfExtensions](./policy-csp-browser.md#browser-allowsideloadingofextensions) +- [Browser/AllowSmartScreen](./policy-csp-browser.md#browser-allowsmartscreen) +- [Browser/AllowTabPreloading](./policy-csp-browser.md#browser-allowtabpreloading) +- [Browser/AllowWebContentOnNewTabPage](./policy-csp-browser.md#browser-allowwebcontentonnewtabpage) +- [Browser/AlwaysEnableBooksLibrary](./policy-csp-browser.md#browser-alwaysenablebookslibrary) +- [Browser/ClearBrowsingDataOnExit](./policy-csp-browser.md#browser-clearbrowsingdataonexit) +- [Browser/ConfigureAdditionalSearchEngines](./policy-csp-browser.md#browser-configureadditionalsearchengines) +- [Browser/ConfigureFavoritesBar](./policy-csp-browser.md#browser-configurefavoritesbar) +- [Browser/ConfigureHomeButton](./policy-csp-browser.md#browser-configurehomebutton) +- [Browser/ConfigureKioskMode](./policy-csp-browser.md#browser-configurekioskmode) +- [Browser/ConfigureKioskResetAfterIdleTimeout](./policy-csp-browser.md#browser-configurekioskresetafteridletimeout) +- [Browser/ConfigureOpenMicrosoftEdgeWith](./policy-csp-browser.md#browser-configureopenmicrosoftedgewith) +- [Browser/ConfigureTelemetryForMicrosoft365Analytics](./policy-csp-browser.md#browser-configuretelemetryformicrosoft365analytics) +- [Browser/DisableLockdownOfStartPages](./policy-csp-browser.md#browser-disablelockdownofstartpages) +- [Browser/EnableExtendedBooksTelemetry](./policy-csp-browser.md#browser-enableextendedbookstelemetry) +- [Browser/EnterpriseModeSiteList](./policy-csp-browser.md#browser-enterprisemodesitelist) +- [Browser/HomePages](./policy-csp-browser.md#browser-homepages) +- [Browser/LockdownFavorites](./policy-csp-browser.md#browser-lockdownfavorites) +- [Browser/PreventAccessToAboutFlagsInMicrosoftEdge](./policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) +- [Browser/PreventCertErrorOverrides](./policy-csp-browser.md#browser-preventcerterroroverrides) +- [Browser/PreventFirstRunPage](./policy-csp-browser.md#browser-preventfirstrunpage) +- [Browser/PreventLiveTileDataCollection](./policy-csp-browser.md#browser-preventlivetiledatacollection) +- [Browser/PreventSmartScreenPromptOverride](./policy-csp-browser.md#browser-preventsmartscreenpromptoverride) +- [Browser/PreventSmartScreenPromptOverrideForFiles](./policy-csp-browser.md#browser-preventsmartscreenpromptoverrideforfiles) +- [Browser/PreventUsingLocalHostIPAddressForWebRTC](./policy-csp-browser.md#browser-preventusinglocalhostipaddressforwebrtc) +- [Browser/ProvisionFavorites](./policy-csp-browser.md#browser-provisionfavorites) +- [Browser/SendIntranetTraffictoInternetExplorer](./policy-csp-browser.md#browser-sendintranettraffictointernetexplorer) +- [Browser/SetDefaultSearchEngine](./policy-csp-browser.md#browser-setdefaultsearchengine) +- [Browser/SetHomeButtonURL](./policy-csp-browser.md#browser-sethomebuttonurl) +- [Browser/SetNewTabPageURL](./policy-csp-browser.md#browser-setnewtabpageurl) +- [Browser/ShowMessageWhenOpeningSitesInInternetExplorer](./policy-csp-browser.md#browser-showmessagewhenopeningsitesininternetexplorer) +- [Browser/SyncFavoritesBetweenIEAndMicrosoftEdge](./policy-csp-browser.md#browser-syncfavoritesbetweenieandmicrosoftedge) +- [Browser/UnlockHomeButton](./policy-csp-browser.md#browser-unlockhomebutton) +- [Browser/UseSharedFolderForBooks](./policy-csp-browser.md#browser-usesharedfolderforbooks) +- [Camera/AllowCamera](./policy-csp-camera.md#camera-allowcamera) +- [Cellular/LetAppsAccessCellularData](./policy-csp-cellular.md#cellular-letappsaccesscellulardata) +- [Cellular/LetAppsAccessCellularData_ForceAllowTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forceallowtheseapps) +- [Cellular/LetAppsAccessCellularData_ForceDenyTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forcedenytheseapps) +- [Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-userincontroloftheseapps) +- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Connectivity/AllowCellularDataRoaming](./policy-csp-connectivity.md#connectivity-allowcellulardataroaming) +- [Connectivity/AllowPhonePCLinking](./policy-csp-connectivity.md#connectivity-allowphonepclinking) +- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) +- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) +- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) +- [Connectivity/DisallowNetworkConnectivityActiveTests](./policy-csp-connectivity.md#connectivity-disallownetworkconnectivityactivetests) +- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) +- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) +- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) +- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) +- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) +- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) +- [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) +- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) +- [Defender/AllowArchiveScanning](./policy-csp-defender.md#defender-allowarchivescanning) +- [Defender/AllowBehaviorMonitoring](./policy-csp-defender.md#defender-allowbehaviormonitoring) +- [Defender/AllowCloudProtection](./policy-csp-defender.md#defender-allowcloudprotection) +- [Defender/AllowEmailScanning](./policy-csp-defender.md#defender-allowemailscanning) +- [Defender/AllowFullScanOnMappedNetworkDrives](./policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) +- [Defender/AllowFullScanRemovableDriveScanning](./policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) +- [Defender/AllowIOAVProtection](./policy-csp-defender.md#defender-allowioavprotection) +- [Defender/AllowOnAccessProtection](./policy-csp-defender.md#defender-allowonaccessprotection) +- [Defender/AllowRealtimeMonitoring](./policy-csp-defender.md#defender-allowrealtimemonitoring) +- [Defender/AllowScanningNetworkFiles](./policy-csp-defender.md#defender-allowscanningnetworkfiles) +- [Defender/AllowUserUIAccess](./policy-csp-defender.md#defender-allowuseruiaccess) +- [Defender/AttackSurfaceReductionOnlyExclusions](./policy-csp-defender.md#defender-attacksurfacereductiononlyexclusions) +- [Defender/AttackSurfaceReductionRules](./policy-csp-defender.md#defender-attacksurfacereductionrules) +- [Defender/AvgCPULoadFactor](./policy-csp-defender.md#defender-avgcpuloadfactor) +- [Defender/CheckForSignaturesBeforeRunningScan](./policy-csp-defender.md#defender-checkforsignaturesbeforerunningscan) +- [Defender/CloudBlockLevel](./policy-csp-defender.md#defender-cloudblocklevel) +- [Defender/CloudExtendedTimeout](./policy-csp-defender.md#defender-cloudextendedtimeout) +- [Defender/ControlledFolderAccessAllowedApplications](./policy-csp-defender.md#defender-controlledfolderaccessallowedapplications) +- [Defender/ControlledFolderAccessProtectedFolders](./policy-csp-defender.md#defender-controlledfolderaccessprotectedfolders) +- [Defender/DaysToRetainCleanedMalware](./policy-csp-defender.md#defender-daystoretaincleanedmalware) +- [Defender/DisableCatchupFullScan](./policy-csp-defender.md#defender-disablecatchupfullscan) +- [Defender/DisableCatchupQuickScan](./policy-csp-defender.md#defender-disablecatchupquickscan) +- [Defender/EnableControlledFolderAccess](./policy-csp-defender.md#defender-enablecontrolledfolderaccess) +- [Defender/EnableLowCPUPriority](./policy-csp-defender.md#defender-enablelowcpupriority) +- [Defender/EnableNetworkProtection](./policy-csp-defender.md#defender-enablenetworkprotection) +- [Defender/ExcludedExtensions](./policy-csp-defender.md#defender-excludedextensions) +- [Defender/ExcludedPaths](./policy-csp-defender.md#defender-excludedpaths) +- [Defender/ExcludedProcesses](./policy-csp-defender.md#defender-excludedprocesses) +- [Defender/RealTimeScanDirection](./policy-csp-defender.md#defender-realtimescandirection) +- [Defender/ScanParameter](./policy-csp-defender.md#defender-scanparameter) +- [Defender/ScheduleQuickScanTime](./policy-csp-defender.md#defender-schedulequickscantime) +- [Defender/ScheduleScanDay](./policy-csp-defender.md#defender-schedulescanday) +- [Defender/ScheduleScanTime](./policy-csp-defender.md#defender-schedulescantime) +- [Defender/SignatureUpdateFallbackOrder](./policy-csp-defender.md#defender-signatureupdatefallbackorder) +- [Defender/SignatureUpdateFileSharesSources](./policy-csp-defender.md#defender-signatureupdatefilesharessources) +- [Defender/SignatureUpdateInterval](./policy-csp-defender.md#defender-signatureupdateinterval) +- [Defender/SubmitSamplesConsent](./policy-csp-defender.md#defender-submitsamplesconsent) +- [Defender/ThreatSeverityDefaultAction](./policy-csp-defender.md#defender-threatseveritydefaultaction) + [DeliveryOptimization/DOAbsoluteMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](./policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](./policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxCacheAge](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](./policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](./policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](./policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [DeviceGuard/ConfigureSystemGuardLaunch](./policy-csp-deviceguard.md#deviceguard-configuresystemguardlaunch) +- [DeviceGuard/EnableVirtualizationBasedSecurity](./policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity) +- [DeviceGuard/LsaCfgFlags](./policy-csp-deviceguard.md#deviceguard-lsacfgflags) +- [DeviceGuard/RequirePlatformSecurityFeatures](./policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures) +- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) +- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) +- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) +- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) +- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) +- [DeviceLock/MinimumPasswordAge](./policy-csp-devicelock.md#devicelock-minimumpasswordage) +- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) +- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) +- [Display/DisablePerProcessDpiForApps](./policy-csp-display.md#display-disableperprocessdpiforapps) +- [Display/EnablePerProcessDpi](./policy-csp-display.md#display-enableperprocessdpi) +- [Display/EnablePerProcessDpiForApps](./policy-csp-display.md#display-enableperprocessdpiforapps) +- [Display/TurnOffGdiDPIScalingForApps](./policy-csp-display.md#display-turnoffgdidpiscalingforapps) +- [Display/TurnOnGdiDPIScalingForApps](./policy-csp-display.md#display-turnongdidpiscalingforapps) +- [DmaGuard/DeviceEnumerationPolicy](./policy-csp-dmaguard.md#dmaguard-deviceenumerationpolicy) +- [Education/PreventAddingNewPrinters](./policy-csp-education.md#education-preventaddingnewprinters) +- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) +- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) +- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) +- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) +- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) +- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) +- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) +- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) +- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) +- [Experience/AllowClipboardHistory](./policy-csp-experience.md#experience-allowclipboardhistory) +- [Experience/AllowCortana](./policy-csp-experience.md#experience-allowcortana) +- [Experience/AllowFindMyDevice](./policy-csp-experience.md#experience-allowfindmydevice) +- [Experience/AllowTailoredExperiencesWithDiagnosticData](./policy-csp-experience.md#experience-allowtailoredexperienceswithdiagnosticdata) +- [Experience/AllowThirdPartySuggestionsInWindowsSpotlight](./policy-csp-experience.md#experience-allowthirdpartysuggestionsinwindowsspotlight) +- [Experience/AllowWindowsConsumerFeatures](./policy-csp-experience.md#experience-allowwindowsconsumerfeatures) +- [Experience/AllowWindowsSpotlight](./policy-csp-experience.md#experience-allowwindowsspotlight) +- [Experience/AllowWindowsSpotlightOnActionCenter](./policy-csp-experience.md#experience-allowwindowsspotlightonactioncenter) +- [Experience/AllowWindowsSpotlightOnSettings](./policy-csp-experience.md#experience-allowwindowsspotlightonsettings) +- [Experience/AllowWindowsSpotlightWindowsWelcomeExperience](./policy-csp-experience.md#experience-allowwindowsspotlightwindowswelcomeexperience) +- [Experience/AllowWindowsTips](./policy-csp-experience.md#experience-allowwindowstips) +- [Experience/ConfigureWindowsSpotlightOnLockScreen](./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen) +- [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications) +- [Experience/DoNotSyncBrowserSettings](./policy-csp-experience.md#experience-donotsyncbrowsersetting) +- [Experience/PreventUsersFromTurningOnBrowserSyncing](./policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing) +- [Experience/ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile) +- [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings) +- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) +- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) +- [Handwriting/PanelDefaultModeDocked](./policy-csp-handwriting.md#handwriting-paneldefaultmodedocked) +- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) +- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) +- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) +- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) +- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) +- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) +- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) +- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) +- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) +- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) +- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) +- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) +- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) +- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) +- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) +- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) +- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) +- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) +- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) +- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) +- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) +- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) +- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) +- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) +- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) +- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) +- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) +- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) +- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) +- [InternetExplorer/DisableActiveXVersionListAutoDownload](./policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) +- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) +- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) +- [InternetExplorer/DisableCompatView](./policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) +- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) +- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) +- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) +- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) +- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) +- [InternetExplorer/DisableFeedsBackgroundSync](./policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) +- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) +- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) +- [InternetExplorer/DisableGeolocation](./policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) +- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) +- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) +- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) +- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) +- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) +- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) +- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) +- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) +- [InternetExplorer/DisableWebAddressAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) +- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) +- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) +- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) +- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) +- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) +- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) +- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) +- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) +- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) +- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) +- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) +- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) +- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) +- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) +- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) +- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) +- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) +- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) +- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) +- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) +- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) +- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) +- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) +- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) +- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) +- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) +- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) +- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) +- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) +- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) +- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) +- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) +- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) +- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) +- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) +- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) +- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) +- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) +- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) +- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) +- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) +- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) +- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) +- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) +- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) +- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) +- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) +- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) +- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) +- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) +- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) +- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) +- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) +- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) +- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) +- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) +- [InternetExplorer/NewTabDefaultPage](./policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) +- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) +- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) +- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) +- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) +- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) +- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) +- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) +- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) +- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) +- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) +- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) +- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) +- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) +- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) +- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) +- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) +- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) +- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) +- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) +- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) +- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) +- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) +- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) +- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) +- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) +- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) +- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) +- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) +- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) +- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) +- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) +- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) +- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) +- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) +- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) +- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) +- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) +- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) +- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) +- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) +- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) +- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) +- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) +- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) +- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) +- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) +- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) +- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) +- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) +- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) +- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) +- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) +- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) +- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) +- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) +- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) +- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) +- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) +- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) +- [LanmanWorkstation/EnableInsecureGuestLogons](./policy-csp-lanmanworkstation.md#lanmanworkstation-enableinsecureguestlogons) +- [Licensing/AllowWindowsEntitlementReactivation](./policy-csp-licensing.md#licensing-allowwindowsentitlementreactivation) +- [Licensing/DisallowKMSClientOnlineAVSValidation](./policy-csp-licensing.md#licensing-disallowkmsclientonlineavsvalidation) +- [LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-blockmicrosoftaccounts) +- [LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-limitlocalaccountuseofblankpasswordstoconsolelogononly) +- [LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameadministratoraccount) +- [LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameguestaccount) +- [LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowundockwithouthavingtologon) +- [LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowedtoformatandejectremovablemedia) +- [LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-preventusersfrominstallingprinterdriverswhenconnectingtosharedprinters) +- [LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) +- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptorsignsecurechanneldataalways) +- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptsecurechanneldatawhenpossible) +- [LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-disablemachineaccountpasswordchanges) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) +- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotRequireCTRLALTDEL](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotrequirectrlaltdel) +- [LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-machineinactivitylimit) +- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) +- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) +- [LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsalways) +- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsifclientagrees) +- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccounts) +- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccountsandshares) +- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictanonymousaccesstonamedpipesandshares) +- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictclientsallowedtomakeremotecallstosam) +- [LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) +- [LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) +- [LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) +- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) +- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication) +- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic) +- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-incomingntlmtraffic) +- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-outgoingntlmtraffictoremoteservers) +- [LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) +- [LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-clearvirtualmemorypagefile) +- [LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-allowuiaccessapplicationstopromptforelevation) +- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforadministrators) +- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) +- [LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-detectapplicationinstallationsandpromptforelevation) +- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateexecutablefilesthataresignedandvalidated) +- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) +- [LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-runalladministratorsinadminapprovalmode) +- [LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-switchtothesecuredesktopwhenpromptingforelevation) +- [LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-useadminapprovalmode) +- [LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-virtualizefileandregistrywritefailurestoperuserlocations) +- [LockDown/AllowEdgeSwipe](./policy-csp-lockdown.md#lockdown-allowedgeswipe) +- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) +- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) +- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) +- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) +- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) +- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) +- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) +- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) +- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) +- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) +- [Maps/EnableOfflineMapsAutoUpdate](./policy-csp-maps.md#maps-enableofflinemapsautoupdate) +- [Messaging/AllowMessageSync](./policy-csp-messaging.md#messaging-allowmessagesync) +- [NetworkIsolation/EnterpriseCloudResources](./policy-csp-networkisolation.md#networkisolation-enterprisecloudresources) +- [NetworkIsolation/EnterpriseIPRange](./policy-csp-networkisolation.md#networkisolation-enterpriseiprange) +- [NetworkIsolation/EnterpriseIPRangesAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseiprangesareauthoritative) +- [NetworkIsolation/EnterpriseInternalProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseinternalproxyservers) +- [NetworkIsolation/EnterpriseProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyservers) +- [NetworkIsolation/EnterpriseProxyServersAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyserversareauthoritative) +- [NetworkIsolation/NeutralResources](./policy-csp-networkisolation.md#networkisolation-neutralresources) +- [Notifications/DisallowCloudNotification](./policy-csp-notifications.md#notifications-disallowcloudnotification) +- [Notifications/DisallowNotificationMirroring](./policy-csp-notifications.md#notifications-disallownotificationmirroring) +- [Notifications/DisallowTileNotification](./policy-csp-notifications.md#notifications-disallowtilenotification) +- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) +- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) +- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) +- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) +- [Power/EnergySaverBatteryThresholdOnBattery](./policy-csp-power.md#power-energysaverbatterythresholdonbattery) +- [Power/EnergySaverBatteryThresholdPluggedIn](./policy-csp-power.md#power-energysaverbatterythresholdpluggedin) +- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) +- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) +- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) +- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) +- [Power/SelectLidCloseActionOnBattery](./policy-csp-power.md#power-selectlidcloseactiononbattery) +- [Power/SelectLidCloseActionPluggedIn](./policy-csp-power.md#power-selectlidcloseactionpluggedin) +- [Power/SelectPowerButtonActionOnBattery](./policy-csp-power.md#power-selectpowerbuttonactiononbattery) +- [Power/SelectPowerButtonActionPluggedIn](./policy-csp-power.md#power-selectpowerbuttonactionpluggedin) +- [Power/SelectSleepButtonActionOnBattery](./policy-csp-power.md#power-selectsleepbuttonactiononbattery) +- [Power/SelectSleepButtonActionPluggedIn](./policy-csp-power.md#power-selectsleepbuttonactionpluggedin) +- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) +- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) +- [Power/TurnOffHybridSleepOnBattery](./policy-csp-power.md#power-turnoffhybridsleeponbattery) +- [Power/TurnOffHybridSleepPluggedIn](./policy-csp-power.md#power-turnoffhybridsleeppluggedin) +- [Power/UnattendedSleepTimeoutOnBattery](./policy-csp-power.md#power-unattendedsleeptimeoutonbattery) +- [Power/UnattendedSleepTimeoutPluggedIn](./policy-csp-power.md#power-unattendedsleeptimeoutpluggedin) +- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) +- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) +- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) +- [Privacy/AllowCrossDeviceClipboard](./policy-csp-privacy.md#privacy-allowcrossdeviceclipboard) +- [Privacy/AllowInputPersonalization](./policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Privacy/DisableAdvertisingId](./policy-csp-privacy.md#privacy-disableadvertisingid) +- [Privacy/DisablePrivacyExperience](./policy-csp-privacy.md#privacy-disableprivacyexperience) +- [Privacy/EnableActivityFeed](./policy-csp-privacy.md#privacy-enableactivityfeed) +- [Privacy/LetAppsAccessAccountInfo](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo) +- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) +- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) +- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) +- [Privacy/LetAppsAccessCalendar](./policy-csp-privacy.md#privacy-letappsaccesscalendar) +- [Privacy/LetAppsAccessCalendar_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forceallowtheseapps) +- [Privacy/LetAppsAccessCalendar_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forcedenytheseapps) +- [Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-userincontroloftheseapps) +- [Privacy/LetAppsAccessCallHistory](./policy-csp-privacy.md#privacy-letappsaccesscallhistory) +- [Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forceallowtheseapps) +- [Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forcedenytheseapps) +- [Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-userincontroloftheseapps) +- [Privacy/LetAppsAccessCamera](./policy-csp-privacy.md#privacy-letappsaccesscamera) +- [Privacy/LetAppsAccessCamera_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forceallowtheseapps) +- [Privacy/LetAppsAccessCamera_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forcedenytheseapps) +- [Privacy/LetAppsAccessCamera_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-userincontroloftheseapps) +- [Privacy/LetAppsAccessContacts](./policy-csp-privacy.md#privacy-letappsaccesscontacts) +- [Privacy/LetAppsAccessContacts_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forceallowtheseapps) +- [Privacy/LetAppsAccessContacts_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forcedenytheseapps) +- [Privacy/LetAppsAccessContacts_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-userincontroloftheseapps) +- [Privacy/LetAppsAccessEmail](./policy-csp-privacy.md#privacy-letappsaccessemail) +- [Privacy/LetAppsAccessEmail_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forceallowtheseapps) +- [Privacy/LetAppsAccessEmail_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forcedenytheseapps) +- [Privacy/LetAppsAccessEmail_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-userincontroloftheseapps) +- [Privacy/LetAppsAccessLocation](./policy-csp-privacy.md#privacy-letappsaccesslocation) +- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forceallowtheseapps) +- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forcedenytheseapps) +- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-userincontroloftheseapps) +- [Privacy/LetAppsAccessMessaging](./policy-csp-privacy.md#privacy-letappsaccessmessaging) +- [Privacy/LetAppsAccessMessaging_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forceallowtheseapps) +- [Privacy/LetAppsAccessMessaging_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forcedenytheseapps) +- [Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-userincontroloftheseapps) +- [Privacy/LetAppsAccessMicrophone](./policy-csp-privacy.md#privacy-letappsaccessmicrophone) +- [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forceallowtheseapps) +- [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forcedenytheseapps) +- [Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-userincontroloftheseapps) +- [Privacy/LetAppsAccessMotion](./policy-csp-privacy.md#privacy-letappsaccessmotion) +- [Privacy/LetAppsAccessMotion_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forceallowtheseapps) +- [Privacy/LetAppsAccessMotion_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forcedenytheseapps) +- [Privacy/LetAppsAccessMotion_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-userincontroloftheseapps) +- [Privacy/LetAppsAccessNotifications](./policy-csp-privacy.md#privacy-letappsaccessnotifications) +- [Privacy/LetAppsAccessNotifications_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forceallowtheseapps) +- [Privacy/LetAppsAccessNotifications_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forcedenytheseapps) +- [Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-userincontroloftheseapps) +- [Privacy/LetAppsAccessPhone](./policy-csp-privacy.md#privacy-letappsaccessphone) +- [Privacy/LetAppsAccessPhone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forceallowtheseapps) +- [Privacy/LetAppsAccessPhone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forcedenytheseapps) +- [Privacy/LetAppsAccessPhone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-userincontroloftheseapps) +- [Privacy/LetAppsAccessRadios](./policy-csp-privacy.md#privacy-letappsaccessradios) +- [Privacy/LetAppsAccessRadios_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forceallowtheseapps) +- [Privacy/LetAppsAccessRadios_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forcedenytheseapps) +- [Privacy/LetAppsAccessRadios_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-userincontroloftheseapps) +- [Privacy/LetAppsAccessTasks](./policy-csp-privacy.md#privacy-letappsaccesstasks) +- [Privacy/LetAppsAccessTasks_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forceallowtheseapps) +- [Privacy/LetAppsAccessTasks_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forcedenytheseapps) +- [Privacy/LetAppsAccessTasks_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-userincontroloftheseapps) +- [Privacy/LetAppsAccessTrustedDevices](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices) +- [Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forceallowtheseapps) +- [Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forcedenytheseapps) +- [Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-userincontroloftheseapps) +- [Privacy/LetAppsGetDiagnosticInfo](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo) +- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) +- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) +- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) +- [Privacy/LetAppsRunInBackground](./policy-csp-privacy.md#privacy-letappsruninbackground) +- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forceallowtheseapps) +- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forcedenytheseapps) +- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-userincontroloftheseapps) +- [Privacy/LetAppsSyncWithDevices](./policy-csp-privacy.md#privacy-letappssyncwithdevices) +- [Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forceallowtheseapps) +- [Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forcedenytheseapps) +- [Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-userincontroloftheseapps) +- [Privacy/PublishUserActivities](./policy-csp-privacy.md#privacy-publishuseractivities) +- [Privacy/UploadUserActivities](./policy-csp-privacy.md#privacy-uploaduseractivities) +- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) +- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) +- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) +- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) +- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) +- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) +- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) +- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) +- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) +- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) +- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) +- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) +- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) +- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) +- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) +- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) +- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) +- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) +- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) +- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) +- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) +- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) +- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) +- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) +- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) +- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) +- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) +- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) +- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) +- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) +- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) +- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) +- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) +- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) +- [Search/AllowCloudSearch](./policy-csp-search.md#search-allowcloudsearch) +- [Search/AllowCortanaInAAD](./policy-csp-search.md#search-allowcortanainaad) +- [Search/AllowFindMyFiles](./policy-csp-search.md#search-allowfindmyfiles) +- [Search/AllowIndexingEncryptedStoresOrItems](./policy-csp-search.md#search-allowindexingencryptedstoresoritems) +- [Search/AllowSearchToUseLocation](./policy-csp-search.md#search-allowsearchtouselocation) +- [Search/AllowUsingDiacritics](./policy-csp-search.md#search-allowusingdiacritics) +- [Search/AlwaysUseAutoLangDetection](./policy-csp-search.md#search-alwaysuseautolangdetection) +- [Search/DisableBackoff](./policy-csp-search.md#search-disablebackoff) +- [Search/DisableRemovableDriveIndexing](./policy-csp-search.md#search-disableremovabledriveindexing) +- [Search/DoNotUseWebResults](./policy-csp-search.md#search-donotusewebresults) +- [Search/PreventIndexingLowDiskSpaceMB](./policy-csp-search.md#search-preventindexinglowdiskspacemb) +- [Search/PreventRemoteQueries](./policy-csp-search.md#search-preventremotequeries) +- [Security/ClearTPMIfNotReady](./policy-csp-security.md#security-cleartpmifnotready) +- [ServiceControlManager/SvchostProcessMitigation](./policy-csp-servicecontrolmanager.md#servicecontrolmanager-svchostprocessmitigation) +- [Settings/AllowOnlineTips](./policy-csp-settings.md#settings-allowonlinetips) +- [Settings/ConfigureTaskbarCalendar](./policy-csp-settings.md#settings-configuretaskbarcalendar) +- [Settings/PageVisibilityList](./policy-csp-settings.md#settings-pagevisibilitylist) +- [SmartScreen/EnableAppInstallControl](./policy-csp-smartscreen.md#smartscreen-enableappinstallcontrol) +- [SmartScreen/EnableSmartScreenInShell](./policy-csp-smartscreen.md#smartscreen-enablesmartscreeninshell) +- [SmartScreen/PreventOverrideForFilesInShell](./policy-csp-smartscreen.md#smartscreen-preventoverrideforfilesinshell) +- [Speech/AllowSpeechModelUpdate](./policy-csp-speech.md#speech-allowspeechmodelupdate) +- [Start/DisableContextMenus](./policy-csp-start.md#start-disablecontextmenus) +- [Start/HidePeopleBar](./policy-csp-start.md#start-hidepeoplebar) +- [Start/HideRecentlyAddedApps](./policy-csp-start.md#start-hiderecentlyaddedapps) +- [Start/StartLayout](./policy-csp-start.md#start-startlayout) +- [Storage/AllowDiskHealthModelUpdates](./policy-csp-storage.md#storage-allowdiskhealthmodelupdates) +- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) +- [System/AllowBuildPreview](./policy-csp-system.md#system-allowbuildpreview) +- [System/AllowCommercialDataPipeline](./policy-csp-system.md#system-allowcommercialdatapipeline) +- [System/AllowDeviceNameInDiagnosticData](./policy-csp-system.md#system-allowdevicenameindiagnosticdata) +- [System/AllowFontProviders](./policy-csp-system.md#system-allowfontproviders) +- [System/AllowLocation](./policy-csp-system.md#system-allowlocation) +- [System/AllowTelemetry](./policy-csp-system.md#system-allowtelemetry) +- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) +- [System/ConfigureMicrosoft365UploadEndpoint](./policy-csp-system.md#system-configuremicrosoft365uploadendpoint) +- [System/ConfigureTelemetryOptInChangeNotification](./policy-csp-system.md#system-configuretelemetryoptinchangenotification) +- [System/ConfigureTelemetryOptInSettingsUx](./policy-csp-system.md#system-configuretelemetryoptinsettingsux) +- [System/DisableDeviceDelete](./policy-csp-system.md#system-disabledevicedelete) +- [System/DisableDiagnosticDataViewer](./policy-csp-system.md#system-disablediagnosticdataviewer) +- [System/DisableEnterpriseAuthProxy](./policy-csp-system.md#system-disableenterpriseauthproxy) +- [System/DisableOneDriveFileSync](./policy-csp-system.md#system-disableonedrivefilesync) +- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) +- [System/LimitEnhancedDiagnosticDataWindowsAnalytics](./policy-csp-system.md#system-limitenhanceddiagnosticdatawindowsanalytics) +- [System/TelemetryProxy](./policy-csp-system.md#system-telemetryproxy) +- [System/TurnOffFileHistory](./policy-csp-system.md#system-turnofffilehistory) +- [SystemServices/ConfigureHomeGroupListenerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegrouplistenerservicestartupmode) +- [SystemServices/ConfigureHomeGroupProviderServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegroupproviderservicestartupmode) +- [SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxaccessorymanagementservicestartupmode) +- [SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxliveauthmanagerservicestartupmode) +- [SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivegamesaveservicestartupmode) +- [SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivenetworkingservicestartupmode) +- [TextInput/AllowLanguageFeaturesUninstall](./policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) +- [TextInput/AllowLinguisticDataCollection](./policy-csp-textinput.md#textinput-allowlinguisticdatacollection) +- [Troubleshooting/AllowRecommendations](./policy-csp-troubleshooting.md#troubleshooting-allowrecommendations) +- [Update/ActiveHoursEnd](./policy-csp-update.md#update-activehoursend) +- [Update/ActiveHoursMaxRange](./policy-csp-update.md#update-activehoursmaxrange) +- [Update/ActiveHoursStart](./policy-csp-update.md#update-activehoursstart) +- [Update/AllowAutoUpdate](./policy-csp-update.md#update-allowautoupdate) +- [Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork](./policy-csp-update.md#update-allowautowindowsupdatedownloadovermeterednetwork) +- [Update/AllowMUUpdateService](./policy-csp-update.md#update-allowmuupdateservice) +- [Update/AllowUpdateService](./policy-csp-update.md#update-allowupdateservice) +- [Update/AutoRestartDeadlinePeriodInDays](./policy-csp-update.md#update-autorestartdeadlineperiodindays) +- [Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates](./policy-csp-update.md#update-autorestartdeadlineperiodindaysforfeatureupdates) +- [Update/AutoRestartNotificationSchedule](./policy-csp-update.md#update-autorestartnotificationschedule) +- [Update/AutoRestartRequiredNotificationDismissal](./policy-csp-update.md#update-autorestartrequirednotificationdismissal) +- [Update/AutomaticMaintenanceWakeUp](./policy-csp-update.md#update-automaticmaintenancewakeup) +- [Update/BranchReadinessLevel](./policy-csp-update.md#update-branchreadinesslevel) +- [Update/ConfigureDeadlineForFeatureUpdates](./policy-csp-update.md#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](./policy-csp-update.md#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](./policy-csp-update.md#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](./policy-csp-update.md#update-configuredeadlinenoautoreboot) +- [Update/DeferFeatureUpdatesPeriodInDays](./policy-csp-update.md#update-deferfeatureupdatesperiodindays) +- [Update/DeferQualityUpdatesPeriodInDays](./policy-csp-update.md#update-deferqualityupdatesperiodindays) +- [Update/DeferUpdatePeriod](./policy-csp-update.md#update-deferupdateperiod) +- [Update/DeferUpgradePeriod](./policy-csp-update.md#update-deferupgradeperiod) +- [Update/DetectionFrequency](./policy-csp-update.md#update-detectionfrequency) +- [Update/DisableDualScan](./policy-csp-update.md#update-disabledualscan) +- [Update/EngagedRestartDeadline](./policy-csp-update.md#update-engagedrestartdeadline) +- [Update/EngagedRestartDeadlineForFeatureUpdates](./policy-csp-update.md#update-engagedrestartdeadlineforfeatureupdates) +- [Update/EngagedRestartSnoozeSchedule](./policy-csp-update.md#update-engagedrestartsnoozeschedule) +- [Update/EngagedRestartSnoozeScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestartsnoozescheduleforfeatureupdates) +- [Update/EngagedRestartTransitionSchedule](./policy-csp-update.md#update-engagedrestarttransitionschedule) +- [Update/EngagedRestartTransitionScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestarttransitionscheduleforfeatureupdates) +- [Update/ExcludeWUDriversInQualityUpdate](./policy-csp-update.md#update-excludewudriversinqualityupdate) +- [Update/FillEmptyContentUrls](./policy-csp-update.md#update-fillemptycontenturls) +- [Update/ManagePreviewBuilds](./policy-csp-update.md#update-managepreviewbuilds) +- [Update/PauseDeferrals](./policy-csp-update.md#update-pausedeferrals) +- [Update/PauseFeatureUpdates](./policy-csp-update.md#update-pausefeatureupdates) +- [Update/PauseFeatureUpdatesStartTime](./policy-csp-update.md#update-pausefeatureupdatesstarttime) +- [Update/PauseQualityUpdates](./policy-csp-update.md#update-pausequalityupdates) +- [Update/PauseQualityUpdatesStartTime](./policy-csp-update.md#update-pausequalityupdatesstarttime) +- [Update/RequireDeferUpgrade](./policy-csp-update.md#update-requiredeferupgrade) +- [Update/ScheduleImminentRestartWarning](./policy-csp-update.md#update-scheduleimminentrestartwarning) +- [Update/ScheduleRestartWarning](./policy-csp-update.md#update-schedulerestartwarning) +- [Update/ScheduledInstallDay](./policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallEveryWeek](./policy-csp-update.md#update-scheduledinstalleveryweek) +- [Update/ScheduledInstallFirstWeek](./policy-csp-update.md#update-scheduledinstallfirstweek) +- [Update/ScheduledInstallFourthWeek](./policy-csp-update.md#update-scheduledinstallfourthweek) +- [Update/ScheduledInstallSecondWeek](./policy-csp-update.md#update-scheduledinstallsecondweek) +- [Update/ScheduledInstallThirdWeek](./policy-csp-update.md#update-scheduledinstallthirdweek) +- [Update/ScheduledInstallTime](./policy-csp-update.md#update-scheduledinstalltime) +- [Update/SetAutoRestartNotificationDisable](./policy-csp-update.md#update-setautorestartnotificationdisable) +- [Update/SetDisablePauseUXAccess](./policy-csp-update.md#update-setdisablepauseuxaccess) +- [Update/SetDisableUXWUAccess](./policy-csp-update.md#update-setdisableuxwuaccess) +- [Update/SetEDURestart](./policy-csp-update.md#update-setedurestart) +- [Update/UpdateNotificationLevel](./policy-csp-update.md#update-updatenotificationlevel) +- [Update/UpdateServiceUrl](./policy-csp-update.md#update-updateserviceurl) +- [Update/UpdateServiceUrlAlternate](./policy-csp-update.md#update-updateserviceurlalternate) +- [UserRights/AccessCredentialManagerAsTrustedCaller](./policy-csp-userrights.md#userrights-accesscredentialmanagerastrustedcaller) +- [UserRights/AccessFromNetwork](./policy-csp-userrights.md#userrights-accessfromnetwork) +- [UserRights/ActAsPartOfTheOperatingSystem](./policy-csp-userrights.md#userrights-actaspartoftheoperatingsystem) +- [UserRights/AllowLocalLogOn](./policy-csp-userrights.md#userrights-allowlocallogon) +- [UserRights/BackupFilesAndDirectories](./policy-csp-userrights.md#userrights-backupfilesanddirectories) +- [UserRights/ChangeSystemTime](./policy-csp-userrights.md#userrights-changesystemtime) +- [UserRights/CreateGlobalObjects](./policy-csp-userrights.md#userrights-createglobalobjects) +- [UserRights/CreatePageFile](./policy-csp-userrights.md#userrights-createpagefile) +- [UserRights/CreatePermanentSharedObjects](./policy-csp-userrights.md#userrights-createpermanentsharedobjects) +- [UserRights/CreateSymbolicLinks](./policy-csp-userrights.md#userrights-createsymboliclinks) +- [UserRights/CreateToken](./policy-csp-userrights.md#userrights-createtoken) +- [UserRights/DebugPrograms](./policy-csp-userrights.md#userrights-debugprograms) +- [UserRights/DenyAccessFromNetwork](./policy-csp-userrights.md#userrights-denyaccessfromnetwork) +- [UserRights/DenyLocalLogOn](./policy-csp-userrights.md#userrights-denylocallogon) +- [UserRights/DenyRemoteDesktopServicesLogOn](./policy-csp-userrights.md#userrights-denyremotedesktopserviceslogon) +- [UserRights/EnableDelegation](./policy-csp-userrights.md#userrights-enabledelegation) +- [UserRights/GenerateSecurityAudits](./policy-csp-userrights.md#userrights-generatesecurityaudits) +- [UserRights/ImpersonateClient](./policy-csp-userrights.md#userrights-impersonateclient) +- [UserRights/IncreaseSchedulingPriority](./policy-csp-userrights.md#userrights-increaseschedulingpriority) +- [UserRights/LoadUnloadDeviceDrivers](./policy-csp-userrights.md#userrights-loadunloaddevicedrivers) +- [UserRights/LockMemory](./policy-csp-userrights.md#userrights-lockmemory) +- [UserRights/ManageAuditingAndSecurityLog](./policy-csp-userrights.md#userrights-manageauditingandsecuritylog) +- [UserRights/ManageVolume](./policy-csp-userrights.md#userrights-managevolume) +- [UserRights/ModifyFirmwareEnvironment](./policy-csp-userrights.md#userrights-modifyfirmwareenvironment) +- [UserRights/ModifyObjectLabel](./policy-csp-userrights.md#userrights-modifyobjectlabel) +- [UserRights/ProfileSingleProcess](./policy-csp-userrights.md#userrights-profilesingleprocess) +- [UserRights/RemoteShutdown](./policy-csp-userrights.md#userrights-remoteshutdown) +- [UserRights/RestoreFilesAndDirectories](./policy-csp-userrights.md#userrights-restorefilesanddirectories) +- [UserRights/TakeOwnership](./policy-csp-userrights.md#userrights-takeownership) +- [Wifi/AllowAutoConnectToWiFiSenseHotspots](./policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) +- [Wifi/AllowInternetSharing](./policy-csp-wifi.md#wifi-allowinternetsharing) +- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) +- [WindowsDefenderSecurityCenter/CompanyName](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-companyname) +- [WindowsDefenderSecurityCenter/DisableAccountProtectionUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableaccountprotectionui) +- [WindowsDefenderSecurityCenter/DisableAppBrowserUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableappbrowserui) +- [WindowsDefenderSecurityCenter/DisableClearTpmButton](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablecleartpmbutton) +- [WindowsDefenderSecurityCenter/DisableDeviceSecurityUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabledevicesecurityui) +- [WindowsDefenderSecurityCenter/DisableEnhancedNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableenhancednotifications) +- [WindowsDefenderSecurityCenter/DisableFamilyUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablefamilyui) +- [WindowsDefenderSecurityCenter/DisableHealthUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablehealthui) +- [WindowsDefenderSecurityCenter/DisableNetworkUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenetworkui) +- [WindowsDefenderSecurityCenter/DisableNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenotifications) +- [WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabletpmfirmwareupdatewarning) +- [WindowsDefenderSecurityCenter/DisableVirusUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablevirusui) +- [WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disallowexploitprotectionoverride) +- [WindowsDefenderSecurityCenter/Email](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-email) +- [WindowsDefenderSecurityCenter/EnableCustomizedToasts](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enablecustomizedtoasts) +- [WindowsDefenderSecurityCenter/EnableInAppCustomization](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enableinappcustomization) +- [WindowsDefenderSecurityCenter/HideRansomwareDataRecovery](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hideransomwaredatarecovery) +- [WindowsDefenderSecurityCenter/HideSecureBoot](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidesecureboot) +- [WindowsDefenderSecurityCenter/HideTPMTroubleshooting](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidetpmtroubleshooting) +- [WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidewindowssecuritynotificationareacontrol) +- [WindowsDefenderSecurityCenter/Phone](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-phone) +- [WindowsDefenderSecurityCenter/URL](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-url) +- [WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) +- [WindowsInkWorkspace/AllowWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowwindowsinkworkspace) +- [WindowsLogon/AllowAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-allowautomaticrestartsignon) +- [WindowsLogon/ConfigAutomaticRestartSignOn](./policy-csp-windowslogon.md#windowslogon-configautomaticrestartsignon) +- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) +- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) +- [WindowsLogon/EnableFirstLogonAnimation](./policy-csp-windowslogon.md#windowslogon-enablefirstlogonanimation) +- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) +- [WindowsLogon/HideFastUserSwitching](./policy-csp-windowslogon.md#windowslogon-hidefastuserswitching) +- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) +- [WirelessDisplay/AllowProjectionToPC](./policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) +- [WirelessDisplay/RequirePinForPairing](./policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) +## Related topics +[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-hololens-1st-gen-commercial-suite.md b/windows/client-management/mdm/policies-supported-by-hololens-1st-gen-commercial-suite.md new file mode 100644 index 0000000000..7e2622844c --- /dev/null +++ b/windows/client-management/mdm/policies-supported-by-hololens-1st-gen-commercial-suite.md @@ -0,0 +1,69 @@ +--- +title: Policies supported by HoloLens (1st gen) Commercial Suite +description: Policies supported by HoloLens (1st gen) Commercial Suite +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/17/2019 +--- + +# Policies supported by HoloLens (1st gen) Commercial Suite + +> [!div class="op_single_selector"] +> +> - [HoloLens 2](policies-supported-by-hololens2.md) +> - [HoloLens (1st gen) Commercial Suite](policies-supported-by-hololens-1st-gen-commercial-suite.md) +> - [HoloLens (1st gen) Development Edition](policies-supported-by-hololens-1st-gen-development-edition.md) +> +- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts.md#accounts-allowmicrosoftaccountconnection) +- [ApplicationManagement/AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [Authentication/AllowFastReconnect](policy-csp-authentication.md#authentication-allowfastreconnect) +- [Authentication/PreferredAadTenantDomainName](policy-csp-authentication.md#authentication-preferredaadtenantdomainname) +- [Bluetooth/AllowAdvertising](policy-csp-bluetooth.md#bluetooth-allowadvertising) +- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#bluetooth-allowdiscoverablemode) +- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#bluetooth-localdevicename) +- [Browser/AllowAutofill](policy-csp-browser.md#browser-allowautofill) +- [Browser/AllowCookies](policy-csp-browser.md#browser-allowcookies) +- [Browser/AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) +- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) +- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection) +- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#devicelock-allowidlereturnwithoutpassword) +- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) +- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) +- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) +- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) +- [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) +- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) +- [Settings/AllowDateTime](policy-csp-settings.md#settings-allowdatetime) +- [Settings/AllowVPN](policy-csp-settings.md#settings-allowvpn) +- [Speech/AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) +- [System/AllowLocation](policy-csp-system.md#system-allowlocation) +- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry) +- [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) +- [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) +- [Update/RequireDeferUpgrade](policy-csp-update.md#update-requiredeferupgrade) +- [Update/RequireUpdateApproval](policy-csp-update.md#update-requireupdateapproval) +- [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) +- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) +- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) + +## Related topics +[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-hololens-1st-gen-development-edition.md b/windows/client-management/mdm/policies-supported-by-hololens-1st-gen-development-edition.md new file mode 100644 index 0000000000..4aefceaece --- /dev/null +++ b/windows/client-management/mdm/policies-supported-by-hololens-1st-gen-development-edition.md @@ -0,0 +1,68 @@ +--- +title: Policies supported by HoloLens (1st gen) Development Edition +description: Policies supported by HoloLens (1st gen) Development Edition +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies supported by HoloLens (1st gen) Development Edition + +> [!div class="op_single_selector"] +> +> - [HoloLens 2](policies-supported-by-hololens2.md) +> - [HoloLens (1st gen) Commercial Suite](policies-supported-by-hololens-1st-gen-commercial-suite.md) +> - [HoloLens (1st gen) Development Edition](policies-supported-by-hololens-1st-gen-development-edition.md) +> + +- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts.md#accounts-allowmicrosoftaccountconnection) +- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [ApplicationManagement/AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [Authentication/AllowFastReconnect](policy-csp-authentication.md#authentication-allowfastreconnect) +- [Bluetooth/AllowAdvertising](policy-csp-bluetooth.md#bluetooth-allowadvertising) +- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#bluetooth-allowdiscoverablemode) +- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#bluetooth-localdevicename) +- [Browser/AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) +- [Browser/AllowCookies](policy-csp-browser.md#browser-allowcookies) +- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) +- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection) +- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) +- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) +- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) +- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#devicelock-allowidlereturnwithoutpassword) +- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) +- [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) +- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) +- [Settings/AllowDateTime](policy-csp-settings.md#settings-allowdatetime) +- [Settings/AllowVPN](policy-csp-settings.md#settings-allowvpn) +- [Speech/AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) +- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry) +- [System/AllowLocation](policy-csp-system.md#system-allowlocation) +- [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) +- [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) +- [Update/RequireUpdateApproval](policy-csp-update.md#update-requireupdateapproval) +- [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) +- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) +- [Update/RequireDeferUpgrade](policy-csp-update.md#update-requiredeferupgrade) +- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) + +## Related topics +[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-hololens2.md b/windows/client-management/mdm/policies-supported-by-hololens2.md new file mode 100644 index 0000000000..4fa3a7f423 --- /dev/null +++ b/windows/client-management/mdm/policies-supported-by-hololens2.md @@ -0,0 +1,87 @@ +--- +title: Policies supported by HoloLens 2 +description: Policies supported by HoloLens 2 +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies supported by HoloLens 2 + +> [!div class="op_single_selector"] +> +> - [HoloLens 2](policies-supported-by-hololens2.md) +> - [HoloLens (1st gen) Commercial Suite](policies-supported-by-hololens-1st-gen-commercial-suite.md) +> - [HoloLens (1st gen) Development Edition](policies-supported-by-hololens-1st-gen-development-edition.md) +> +- [Accounts/AllowMicrosoftAccountConnection](policy-csp-accounts.md#accounts-allowmicrosoftaccountconnection) +- [ApplicationManagement/AllowAllTrustedApps](policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) +- [ApplicationManagement/AllowAppStoreAutoUpdate](policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) +- [ApplicationManagement/AllowDeveloperUnlock](policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) +- [Authentication/AllowFastReconnect](policy-csp-authentication.md#authentication-allowfastreconnect) +- [Authentication/PreferredAadTenantDomainName](policy-csp-authentication.md#authentication-preferredaadtenantdomainname) +- [Bluetooth/AllowDiscoverableMode](policy-csp-bluetooth.md#bluetooth-allowdiscoverablemode) +- [Bluetooth/LocalDeviceName](policy-csp-bluetooth.md#bluetooth-localdevicename) +- [Browser/AllowAutofill](policy-csp-browser.md#browser-allowautofill) +- [Browser/AllowCookies](policy-csp-browser.md#browser-allowcookies) +- [Browser/AllowDoNotTrack](policy-csp-browser.md#browser-allowdonottrack) +- [Browser/AllowPasswordManager](policy-csp-browser.md#browser-allowpasswordmanager) +- [Browser/AllowPopups](policy-csp-browser.md#browser-allowpopups) +- [Browser/AllowSearchSuggestionsinAddressBar](policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) +- [Browser/AllowSmartScreen](policy-csp-browser.md#browser-allowsmartscreen) +- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) +- [Connectivity/AllowUSBConnection](policy-csp-connectivity.md#connectivity-allowusbconnection) +- [DeviceLock/AllowIdleReturnWithoutPassword](policy-csp-devicelock.md#devicelock-allowidlereturnwithoutpassword) +- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) +- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) +- [DeviceLock/DevicePasswordExpiration](policy-csp-devicelock.md#devicelock-devicepasswordexpiration) +- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) +- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) +- [Experience/AllowCortana](policy-csp-experience.md#experience-allowcortana) +- [Experience/AllowManualMDMUnenrollment](policy-csp-experience.md#experience-allowmanualmdmunenrollment) +- [Privacy/AllowInputPersonalization](policy-csp-privacy.md#privacy-allowinputpersonalization) +- [Privacy/LetAppsAccessAccountInfo](policy-csp-privacy.md#privacy-letappsaccessaccountinfo) +- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) +- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) +- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) +- [Privacy/LetAppsAccessBackgroundSpatialPerception](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception) +- [Privacy/LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception-forceallowtheseapps) +- [Privacy/LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception-forcedenytheseapps) +- [Privacy/LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps](policy-csp-privacy.md#privacy-letappsaccessbackgroundspatialperception-userincontroloftheseapps) +- [Privacy/LetAppsAccessCamera](policy-csp-privacy.md#privacy-letappsaccesscamera) +- [Privacy/LetAppsAccessLocation](policy-csp-privacy.md#privacy-letappsaccesslocation) +- [Privacy/LetAppsAccessMicrophone](policy-csp-privacy.md#privacy-letappsaccessmicrophone) +- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) +- [Settings/AllowDateTime](policy-csp-settings.md#settings-allowdatetime) +- [Settings/AllowVPN](policy-csp-settings.md#settings-allowvpn) +- [Speech/AllowSpeechModelUpdate](policy-csp-speech.md#speech-allowspeechmodelupdate) +- [System/AllowCommercialDataPipeline](policy-csp-system.md#system-allowcommercialdatapipeline) +- [System/AllowLocation](policy-csp-system.md#system-allowlocation) +- [System/AllowStorageCard](policy-csp-system.md#system-allowstoragecard) +- [System/AllowTelemetry](policy-csp-system.md#system-allowtelemetry) +- [Update/AllowAutoUpdate](policy-csp-update.md#update-allowautoupdate) +- [Update/AllowUpdateService](policy-csp-update.md#update-allowupdateservice) +- [Update/BranchReadinessLevel](policy-csp-update.md#update-branchreadinesslevel) +- [Update/DeferFeatureUpdatesPeriodInDays](policy-csp-update.md#update-deferfeatureupdatesperiodindays) +- [Update/DeferQualityUpdatesPeriodInDays](policy-csp-update.md#update-deferqualityupdatesperiodindays) +- [Update/ManagePreviewBuilds](policy-csp-update.md#update-managepreviewbuilds) +- [Update/PauseFeatureUpdates](policy-csp-update.md#update-pausefeatureupdates) +- [Update/PauseQualityUpdates](policy-csp-update.md#update-pausequalityupdates) +- [Update/ScheduledInstallDay](policy-csp-update.md#update-scheduledinstallday) +- [Update/ScheduledInstallTime](policy-csp-update.md#update-scheduledinstalltime) +- [Update/UpdateServiceUrl](policy-csp-update.md#update-updateserviceurl) +- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) + +## Related topics +[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-iot-core.md b/windows/client-management/mdm/policies-supported-by-iot-core.md new file mode 100644 index 0000000000..8e2efa62c5 --- /dev/null +++ b/windows/client-management/mdm/policies-supported-by-iot-core.md @@ -0,0 +1,73 @@ +--- +title: Policies supported by Windows 10 IoT Core +description: Policies supported by Windows 10 IoT Core +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/16/2019 +--- + +# Policies supported by Windows 10 IoT Core + +> [!div class="op_single_selector"] +> +> - [IoT Enterprise](policies-supported-by-iot-enterprise.md) +> - [IoT Core](policies-supported-by-iot-core.md) +> + +- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) +- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) +- [CredentialProviders/AllowPINLogon](policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) +- [CredentialProviders/BlockPicturePassword](policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) +- [DataProtection/AllowDirectMemoryAccess](policy-csp-dataprotection.md#dataprotection-allowdirectmemoryaccess) +- [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [InternetExplorer/DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-allowdevicehealthmonitoring) +- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringscope) +- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) +- [Privacy/LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice) +- [Privacy/LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock) +- [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) +- [Wifi/AllowAutoConnectToWiFiSenseHotspots](policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) +- [Wifi/AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing) +- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) +- [Wifi/WLANScanMode](policy-csp-wifi.md#wifi-wlanscanmode) + +## Related topics +[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-iot-enterprise.md b/windows/client-management/mdm/policies-supported-by-iot-enterprise.md new file mode 100644 index 0000000000..4602e64513 --- /dev/null +++ b/windows/client-management/mdm/policies-supported-by-iot-enterprise.md @@ -0,0 +1,68 @@ +--- +title: Policies supported by Windows 10 IoT Enterprise +description: Policies supported by Windows 10 IoT Enterprise +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies supported by Windows 10 IoT Enterprise + +> [!div class="op_single_selector"] +> +> - [IoT Enterprise](policies-supported-by-iot-enterprise.md) +> - [IoT Core](policies-supported-by-iot-core.md) +> + +- [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar) +- [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload) +- [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview) +- [InternetExplorer/DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync) +- [InternetExplorer/DisableGeolocation](policy-csp-internetexplorer.md#internetexplorer-disablegeolocation) +- [InternetExplorer/DisableWebAddressAutoComplete](policy-csp-internetexplorer.md#internetexplorer-disablewebaddressautocomplete) +- [InternetExplorer/NewTabDefaultPage](policy-csp-internetexplorer.md#internetexplorer-newtabdefaultpage) +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) +- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) +- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) +- [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground) +- [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground) +- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOGroupIdSource](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) +- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) +- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) +- [DeliveryOptimization/DORestrictPeerSelectionBy](policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) +- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) +- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) +- [DeviceHealthMonitoring/AllowDeviceHealthMonitoring](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-allowdevicehealthmonitoring) +- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringscope) +- [DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination](policy-csp-devicehealthmonitoring.md#devicehealthmonitoring-configdevicehealthmonitoringuploaddestination) +- [Privacy/LetAppsActivateWithVoice](policy-csp-privacy.md#privacy-letappsactivatewithvoice) +- [Privacy/LetAppsActivateWithVoiceAboveLock](policy-csp-privacy.md#privacy-letappsactivatewithvoiceabovelock) +- [Update/ConfigureDeadlineForFeatureUpdates](policy-csp-update.md#update-configuredeadlineforfeatureupdates) +- [Update/ConfigureDeadlineForQualityUpdates](policy-csp-update.md#update-configuredeadlineforqualityupdates) +- [Update/ConfigureDeadlineGracePeriod](policy-csp-update.md#update-configuredeadlinegraceperiod) +- [Update/ConfigureDeadlineNoAutoReboot](policy-csp-update.md#update-configuredeadlinenoautoreboot) + +## Related topics +[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-supported-by-surface-hub.md b/windows/client-management/mdm/policies-supported-by-surface-hub.md new file mode 100644 index 0000000000..778ff39d58 --- /dev/null +++ b/windows/client-management/mdm/policies-supported-by-surface-hub.md @@ -0,0 +1,78 @@ +--- +title: Policies supported by Microsoft Surface Hub +description: Policies supported by Microsoft Surface Hub +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies supported by Microsoft Surface Hub + +- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) +- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Cryptography/AllowFipsAlgorithmPolicy](policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) +- [Cryptography/TLSCipherSuites](policy-csp-cryptography.md#cryptography-tlsciphersuites) +- [Defender/AllowArchiveScanning](policy-csp-defender.md#defender-allowarchivescanning) +- [Defender/AllowBehaviorMonitoring](policy-csp-defender.md#defender-allowbehaviormonitoring) +- [Defender/AllowCloudProtection](policy-csp-defender.md#defender-allowcloudprotection) +- [Defender/AllowEmailScanning](policy-csp-defender.md#defender-allowemailscanning) +- [Defender/AllowFullScanOnMappedNetworkDrives](policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) +- [Defender/AllowFullScanRemovableDriveScanning](policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) +- [Defender/AllowIOAVProtection](policy-csp-defender.md#defender-allowioavprotection) +- [Defender/AllowIntrusionPreventionSystem](policy-csp-defender.md#defender-allowintrusionpreventionsystem) +- [Defender/AllowOnAccessProtection](policy-csp-defender.md#defender-allowonaccessprotection) +- [Defender/AllowRealtimeMonitoring](policy-csp-defender.md#defender-allowrealtimemonitoring) +- [Defender/AllowScanningNetworkFiles](policy-csp-defender.md#defender-allowscanningnetworkfiles) +- [Defender/AllowScriptScanning](policy-csp-defender.md#defender-allowscriptscanning) +- [Defender/AllowUserUIAccess](policy-csp-defender.md#defender-allowuseruiaccess) +- [Defender/AvgCPULoadFactor](policy-csp-defender.md#defender-avgcpuloadfactor) +- [Defender/DaysToRetainCleanedMalware](policy-csp-defender.md#defender-daystoretaincleanedmalware) +- [Defender/ExcludedExtensions](policy-csp-defender.md#defender-excludedextensions) +- [Defender/ExcludedPaths](policy-csp-defender.md#defender-excludedpaths) +- [Defender/ExcludedProcesses](policy-csp-defender.md#defender-excludedprocesses) +- [Defender/PUAProtection](policy-csp-defender.md#defender-puaprotection) +- [Defender/RealTimeScanDirection](policy-csp-defender.md#defender-realtimescandirection) +- [Defender/ScanParameter](policy-csp-defender.md#defender-scanparameter) +- [Defender/ScheduleQuickScanTime](policy-csp-defender.md#defender-schedulequickscantime) +- [Defender/ScheduleScanDay](policy-csp-defender.md#defender-schedulescanday) +- [Defender/ScheduleScanTime](policy-csp-defender.md#defender-schedulescantime) +- [Defender/SignatureUpdateInterval](policy-csp-defender.md#defender-signatureupdateinterval) +- [Defender/SubmitSamplesConsent](policy-csp-defender.md#defender-submitsamplesconsent) +- [Defender/ThreatSeverityDefaultAction](policy-csp-defender.md#defender-threatseveritydefaultaction) +- [DeliveryOptimization/DOAbsoluteMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) +- [DeliveryOptimization/DOAllowVPNPeerCaching](policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DODownloadMode](policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) +- [DeliveryOptimization/DOGroupId](policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) +- [DeliveryOptimization/DOMaxCacheAge](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) +- [DeliveryOptimization/DOMaxCacheSize](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) +- [DeliveryOptimization/DOMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) +- [DeliveryOptimization/DOMaxUploadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) +- [DeliveryOptimization/DOMinBackgroundQos](policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) +- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) +- [DeliveryOptimization/DOMinFileSizeToCache](policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) +- [DeliveryOptimization/DOMinRAMAllowedToPeer](policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) +- [DeliveryOptimization/DOModifyCacheDrive](policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) +- [DeliveryOptimization/DOMonthlyUploadDataCap](policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) +- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxdownloadbandwidth) +- [Desktop/PreventUserRedirectionOfProfileFolders](policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [TextInput/AllowIMELogging](policy-csp-textinput.md#textinput-allowimelogging) +- [TextInput/AllowIMENetworkAccess](policy-csp-textinput.md#textinput-allowimenetworkaccess) +- [TextInput/AllowInputPanel](policy-csp-textinput.md#textinput-allowinputpanel) +- [TextInput/AllowJapaneseIMESurrogatePairCharacters](policy-csp-textinput.md#textinput-allowjapaneseimesurrogatepaircharacters) +- [TextInput/AllowJapaneseIVSCharacters](policy-csp-textinput.md#textinput-allowjapaneseivscharacters) +- [TextInput/AllowJapaneseNonPublishingStandardGlyph](policy-csp-textinput.md#textinput-allowjapanesenonpublishingstandardglyph) +- [TextInput/AllowJapaneseUserDictionary](policy-csp-textinput.md#textinput-allowjapaneseuserdictionary) +- [TextInput/AllowLanguageFeaturesUninstall](policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) +- [TextInput/ExcludeJapaneseIMEExceptJIS0208](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208) +- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](policy-csp-textinput.md#textinput-excludejapaneseimeexceptjis0208andeudc) +- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](policy-csp-textinput.md#textinput-excludejapaneseimeexceptshiftjis) +- [WiFi/AllowWiFiHotSpotReporting](policy-csp-wifi.md#wifi-allowwifihotspotreporting) + +## Related topics +[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policies-that-can-be-set-using-eas.md b/windows/client-management/mdm/policies-that-can-be-set-using-eas.md new file mode 100644 index 0000000000..3c0303c2c0 --- /dev/null +++ b/windows/client-management/mdm/policies-that-can-be-set-using-eas.md @@ -0,0 +1,39 @@ +--- +title: Policies that can be set using Exchange Active Sync (EAS) +description: Policies that can be set using Exchange Active Sync (EAS) +ms.reviewer: +manager: dansimp +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 +--- + +# Policies that can be set using Exchange Active Sync (EAS) + +- [Camera/AllowCamera](policy-csp-camera.md#camera-allowcamera) +- [Cellular/ShowAppCellularAccessUI](policy-csp-cellular.md#cellular-showappcellularaccessui) +- [Connectivity/AllowBluetooth](policy-csp-connectivity.md#connectivity-allowbluetooth) +- [Connectivity/AllowCellularDataRoaming](policy-csp-connectivity.md#connectivity-allowcellulardataroaming) +- [DeviceLock/AllowSimpleDevicePassword](policy-csp-devicelock.md#devicelock-allowsimpledevicepassword) +- [DeviceLock/AlphanumericDevicePasswordRequired](policy-csp-devicelock.md#devicelock-alphanumericdevicepasswordrequired) +- [DeviceLock/DevicePasswordEnabled](policy-csp-devicelock.md#devicelock-devicepasswordenabled) +- [DeviceLock/DevicePasswordExpiration](policy-csp-devicelock.md#devicelock-devicepasswordexpiration) +- [DeviceLock/DevicePasswordHistory](policy-csp-devicelock.md#devicelock-devicepasswordhistory) +- [DeviceLock/MaxDevicePasswordFailedAttempts](policy-csp-devicelock.md#devicelock-maxdevicepasswordfailedattempts) +- [DeviceLock/MaxInactivityTimeDeviceLock](policy-csp-devicelock.md#devicelock-maxinactivitytimedevicelock) +- [DeviceLock/MinDevicePasswordComplexCharacters](policy-csp-devicelock.md#devicelock-mindevicepasswordcomplexcharacters) +- [DeviceLock/MinDevicePasswordLength](policy-csp-devicelock.md#devicelock-mindevicepasswordlength) +- [DeviceLock/PreventLockScreenSlideShow](policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) +- [Search/AllowSearchToUseLocation](policy-csp-search.md#search-allowsearchtouselocation) +- [Security/RequireDeviceEncryption](policy-csp-security.md#security-requiredeviceencryption) +- [System/AllowStorageCard](policy-csp-system.md#system-allowstoragecard) +- [System/TelemetryProxy](policy-csp-system.md#system-telemetryproxy) +- [Wifi/AllowInternetSharing](policy-csp-wifi.md#wifi-allowinternetsharing) +- [Wifi/AllowWiFi](policy-csp-wifi.md#wifi-allowwifi) + +## Related topics +[Policy CSP](policy-configuration-service-provider.md) \ No newline at end of file diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 00d74b6472..9d72af8a49 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2,20 +2,21 @@ title: Policy CSP description: Policy CSP ms.assetid: 4F3A1134-D401-44FC-A583-6EDD3070BA4F -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/01/2019 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 07/18/2019 --- # Policy CSP -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -The Policy configuration service provider enables the enterprise to configure policies on Windows 10. Use this configuration service provider to configure any company policies. +The Policy configuration service provider enables the enterprise to configure policies on Windows 10. Use this configuration service provider to configure any company policies. The Policy configuration service provider has the following sub-categories: @@ -57,12 +58,12 @@ The following diagram shows the Policy configuration service provider in tree fo

                              Supported operation is Get. -**Policy/Config/****_AreaName_** +**Policy/Config/***AreaName*

                              The area group that can be configured by a single technology for a single provider. Once added, you cannot change the value.

                              Supported operations are Add, Get, and Delete. -**Policy/Config/****_AreaName/PolicyName_** +**Policy/Config/***AreaName/PolicyName*

                              Specifies the name/value pair used in the policy.

                              The following list shows some tips to help you when configuring policies: @@ -70,7 +71,7 @@ The following diagram shows the Policy configuration service provider in tree fo - Separate substring values by the Unicode &\#xF000; in the XML file. > [!NOTE] -> A query from a different caller could provide a different value as each caller could have different values for a named policy. +> A query from a different caller could provide a different value as each caller could have different values for a named policy. - In SyncML, wrap this policy with the Atomic command so that the policy settings are treated as a single transaction. - Supported operations are Add, Get, Delete, and Replace. @@ -81,12 +82,12 @@ The following diagram shows the Policy configuration service provider in tree fo

                              Supported operation is Get. -**Policy/Result/****_AreaName_** +**Policy/Result/***AreaName*

                              The area group that can be configured by a single technology independent of the providers.

                              Supported operation is Get. -**Policy/Result/****_AreaName/PolicyName_** +**Policy/Result/***AreaName/PolicyName*

                              Specifies the name/value pair used in the policy.

                              Supported operation is Get. @@ -97,36 +98,36 @@ The following diagram shows the Policy configuration service provider in tree fo

                              Supported operations are Add, Get, and Delete. **Policy/ConfigOperations/ADMXInstall** -

                              Added in Windows 10, version 1703. Allows settings for ADMX files for Win32 and Desktop Bridge apps to be imported (ingested) by your device and processed into new ADMX-backed policies or preferences. By using ADMXInstall, you can add ADMX-backed policies for those Win32 or Desktop Bridge apps that have been added between OS releases. ADMX-backed policies are ingested to your device by using the Policy CSP URI: `./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. Each ADMX-backed policy or preference that is added is assigned a unique ID. For more information about using Policy CSP to configure Win32 and Desktop Bridge app policies, see [Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md). +

                              Added in Windows 10, version 1703. Allows settings for ADMX files for Win32 and Desktop Bridge apps to be imported (ingested) by your device and processed into new ADMX-backed policies or preferences. By using ADMXInstall, you can add ADMX-backed policies for those Win32 or Desktop Bridge apps that have been added between OS releases. ADMX-backed policies are ingested to your device by using the Policy CSP URI: ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall. Each ADMX-backed policy or preference that is added is assigned a unique ID. For more information about using Policy CSP to configure Win32 and Desktop Bridge app policies, see Win32 and Desktop Bridge app policy configuration. > [!NOTE] > The OPAX settings that are managed by the Microsoft Office Customization Tool are not supported by MDM. For more information about this tool, see [Office Customization Tool](https://technet.microsoft.com/library/cc179097.aspx). -

                              ADMX files that have been installed by using **ConfigOperations/ADMXInstall** can later be deleted by using the URI delete operation. Deleting an ADMX file will delete the ADMX file from disk, remove the metadata from the ADMXdefault registry hive, and delete all the policies that were set from the file. The MDM server can also delete all ADMX policies that are tied to a particular app by calling delete on the URI, `./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}`. +

                              ADMX files that have been installed by using ConfigOperations/ADMXInstall can later be deleted by using the URI delete operation. Deleting an ADMX file will delete the ADMX file from disk, remove the metadata from the ADMXdefault registry hive, and delete all the policies that were set from the file. The MDM server can also delete all ADMX policies that are tied to a particular app by calling delete on the URI, ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}.

                              Supported operations are Add, Get, and Delete. -**Policy/ConfigOperations/ADMXInstall/****_AppName_** +**Policy/ConfigOperations/ADMXInstall/***AppName*

                              Added in Windows 10, version 1703. Specifies the name of the Win32 or Desktop Bridge app associated with the ADMX file.

                              Supported operations are Add, Get, and Delete. -**Policy/ConfigOperations/ADMXInstall/****_AppName_/Policy** +**Policy/ConfigOperations/ADMXInstall/***AppName*/Policy

                              Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app policy is to be imported.

                              Supported operations are Add, Get, and Delete. -**Policy/ConfigOperations/ADMXInstall/****_AppName_/Policy/_UniqueID_** +**Policy/ConfigOperations/ADMXInstall/***AppName*/Policy/*UniqueID*

                              Added in Windows 10, version 1703. Specifies the unique ID of the app ADMX file that contains the policy to import.

                              Supported operations are Add and Get. Does not support Delete. -**Policy/ConfigOperations/ADMXInstall/****_AppName_/Preference** +**Policy/ConfigOperations/ADMXInstall/***AppName*/Preference

                              Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app preference is to be imported.

                              Supported operations are Add, Get, and Delete. -**Policy/ConfigOperations/ADMXInstall/****_AppName_/Preference/_UniqueID_** +**Policy/ConfigOperations/ADMXInstall/***AppName*/Preference/*UniqueID*

                              Added in Windows 10, version 1703. Specifies the unique ID of the app ADMX file that contains the preference to import.

                              Supported operations are Add and Get. Does not support Delete. @@ -137,9 +138,6 @@ The following diagram shows the Policy configuration service provider in tree fo ### AboveLock policies

                              -
                              - AboveLock/AllowActionCenterNotifications -
                              AboveLock/AllowCortanaAboveLock
                              @@ -160,9 +158,7 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Accounts/AllowMicrosoftAccountSignInAssistant
                              -
                              - Accounts/DomainNamesForEmailSync -
                              +
                              ### ActiveXControls policies @@ -202,12 +198,6 @@ The following diagram shows the Policy configuration service provider in tree fo
                              ApplicationManagement/AllowSharedUserAppData
                              -
                              - ApplicationManagement/AllowStore -
                              -
                              - ApplicationManagement/ApplicationRestrictions -
                              ApplicationManagement/DisableStoreOriginatedApps
                              @@ -345,6 +335,188 @@ The following diagram shows the Policy configuration service provider in tree fo +### Audit policies + +
                              +
                              + Audit/AccountLogonLogoff_AuditAccountLockout +
                              +
                              + Audit/AccountLogonLogoff_AuditGroupMembership +
                              +
                              + Audit/AccountLogonLogoff_AuditIPsecExtendedMode +
                              +
                              + Audit/AccountLogonLogoff_AuditIPsecMainMode +
                              +
                              + Audit/AccountLogonLogoff_AuditIPsecQuickMode +
                              +
                              + Audit/AccountLogonLogoff_AuditLogoff +
                              +
                              + Audit/AccountLogonLogoff_AuditLogon +
                              +
                              + Audit/AccountLogonLogoff_AuditNetworkPolicyServer +
                              +
                              + Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents +
                              +
                              + Audit/AccountLogonLogoff_AuditSpecialLogon +
                              +
                              + Audit/AccountLogonLogoff_AuditUserDeviceClaims +
                              +
                              + Audit/AccountLogon_AuditCredentialValidation +
                              +
                              + Audit/AccountLogon_AuditKerberosAuthenticationService +
                              +
                              + Audit/AccountLogon_AuditKerberosServiceTicketOperations +
                              +
                              + Audit/AccountLogon_AuditOtherAccountLogonEvents +
                              +
                              + Audit/AccountManagement_AuditApplicationGroupManagement +
                              +
                              + Audit/AccountManagement_AuditComputerAccountManagement +
                              +
                              + Audit/AccountManagement_AuditDistributionGroupManagement +
                              +
                              + Audit/AccountManagement_AuditOtherAccountManagementEvents +
                              +
                              + Audit/AccountManagement_AuditSecurityGroupManagement +
                              +
                              + Audit/AccountManagement_AuditUserAccountManagement +
                              +
                              + Audit/DSAccess_AuditDetailedDirectoryServiceReplication +
                              +
                              + Audit/DSAccess_AuditDirectoryServiceAccess +
                              +
                              + Audit/DSAccess_AuditDirectoryServiceChanges +
                              +
                              + Audit/DSAccess_AuditDirectoryServiceReplication +
                              +
                              + Audit/DetailedTracking_AuditDPAPIActivity +
                              +
                              + Audit/DetailedTracking_AuditPNPActivity +
                              +
                              + Audit/DetailedTracking_AuditProcessCreation +
                              +
                              + Audit/DetailedTracking_AuditProcessTermination +
                              +
                              + Audit/DetailedTracking_AuditRPCEvents +
                              +
                              + Audit/DetailedTracking_AuditTokenRightAdjusted +
                              +
                              + Audit/ObjectAccess_AuditApplicationGenerated +
                              +
                              + Audit/ObjectAccess_AuditCentralAccessPolicyStaging +
                              +
                              + Audit/ObjectAccess_AuditCertificationServices +
                              +
                              + Audit/ObjectAccess_AuditDetailedFileShare +
                              +
                              + Audit/ObjectAccess_AuditFileShare +
                              +
                              + Audit/ObjectAccess_AuditFileSystem +
                              +
                              + Audit/ObjectAccess_AuditFilteringPlatformConnection +
                              +
                              + Audit/ObjectAccess_AuditFilteringPlatformPacketDrop +
                              +
                              + Audit/ObjectAccess_AuditHandleManipulation +
                              +
                              + Audit/ObjectAccess_AuditKernelObject +
                              +
                              + Audit/ObjectAccess_AuditOtherObjectAccessEvents +
                              +
                              + Audit/ObjectAccess_AuditRegistry +
                              +
                              + Audit/ObjectAccess_AuditRemovableStorage +
                              +
                              + Audit/ObjectAccess_AuditSAM +
                              +
                              + Audit/PolicyChange_AuditAuthenticationPolicyChange +
                              +
                              + Audit/PolicyChange_AuditAuthorizationPolicyChange +
                              +
                              + Audit/PolicyChange_AuditFilteringPlatformPolicyChange +
                              +
                              + Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange +
                              +
                              + Audit/PolicyChange_AuditOtherPolicyChangeEvents +
                              +
                              + Audit/PolicyChange_AuditPolicyChange +
                              +
                              + Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse +
                              +
                              + Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents +
                              +
                              + Audit/PrivilegeUse_AuditSensitivePrivilegeUse +
                              +
                              + Audit/System_AuditIPsecDriver +
                              +
                              + Audit/System_AuditOtherSystemEvents +
                              +
                              + Audit/System_AuditSecurityStateChange +
                              +
                              + Audit/System_AuditSecuritySystemExtension +
                              +
                              + Audit/System_AuditSystemIntegrity +
                              +
                              + ### Authentication policies
                              @@ -364,10 +536,10 @@ The following diagram shows the Policy configuration service provider in tree fo Authentication/AllowSecondaryAuthenticationDevice
                              - Authentication/EnableFastFirstSignIn + Authentication/EnableFastFirstSignIn (Preview mode only)
                              - Authentication/EnableWebSignIn + Authentication/EnableWebSignIn (Preview mode only)
                              Authentication/PreferredAadTenantDomainName @@ -451,9 +623,6 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Browser/AllowAutofill
                              -
                              - Browser/AllowBrowser -
                              Browser/AllowConfigurationUpdateForBooksLibrary
                              @@ -556,9 +725,6 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Browser/EnterpriseSiteListServiceUrl
                              -
                              - Browser/FirstRunURL -
                              Browser/HomePages
                              @@ -658,9 +824,6 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Connectivity/AllowConnectedDevices
                              -
                              - Connectivity/AllowNFC -
                              Connectivity/AllowPhonePCLinking
                              @@ -913,6 +1076,12 @@ The following diagram shows the Policy configuration service provider in tree fo
                              DeliveryOptimization/DODelayForegroundDownloadFromHttp
                              +
                              + DeliveryOptimization/DODelayCacheServerFallbackBackground +
                              +
                              + DeliveryOptimization/DODelayCacheServerFallbackForeground +
                              DeliveryOptimization/DODownloadMode
                              @@ -1000,6 +1169,20 @@ The following diagram shows the Policy configuration service provider in tree fo
                              +### DeviceHealthMonitoring policies + +
                              +
                              + DeviceHealthMonitoring/AllowDeviceHealthMonitoring +
                              +
                              + DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope +
                              +
                              + DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination +
                              +
                              + ### DeviceInstallation policies
                              @@ -1009,6 +1192,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
                              +
                              + DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs +
                              DeviceInstallation/PreventDeviceMetadataFromNetwork
                              @@ -1018,6 +1204,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              DeviceInstallation/PreventInstallationOfMatchingDeviceIDs
                              +
                              + DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs +
                              DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses
                              @@ -1029,9 +1218,6 @@ The following diagram shows the Policy configuration service provider in tree fo
                              DeviceLock/AllowIdleReturnWithoutPassword
                              -
                              - DeviceLock/AllowScreenTimeoutWhileLockedUserConfig -
                              DeviceLock/AllowSimpleDevicePassword
                              @@ -1050,18 +1236,12 @@ The following diagram shows the Policy configuration service provider in tree fo
                              DeviceLock/EnforceLockScreenAndLogonImage
                              -
                              - DeviceLock/EnforceLockScreenProvider -
                              DeviceLock/MaxDevicePasswordFailedAttempts
                              DeviceLock/MaxInactivityTimeDeviceLock
                              -
                              - DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay -
                              DeviceLock/MinDevicePasswordComplexCharacters
                              @@ -1077,9 +1257,6 @@ The following diagram shows the Policy configuration service provider in tree fo
                              DeviceLock/PreventLockScreenSlideShow
                              -
                              - DeviceLock/ScreenTimeoutWhileLocked -
                              ### Display policies @@ -1113,6 +1290,9 @@ The following diagram shows the Policy configuration service provider in tree fo ### Education policies
                              +
                              + Education/AllowGraphingCalculator +
                              Education/DefaultPrinterName
                              @@ -1190,9 +1370,6 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Experience/AllowClipboardHistory
                              -
                              - Experience/AllowCopyPaste -
                              Experience/AllowCortana
                              @@ -1205,15 +1382,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Experience/AllowManualMDMUnenrollment
                              -
                              - Experience/AllowSIMErrorDialogPromptWhenNoSIM -
                              Experience/AllowSaveAsOfOfficeFiles
                              -
                              - Experience/AllowScreenCapture -
                              Experience/AllowSharingOfOfficeFiles
                              @@ -1223,15 +1394,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Experience/AllowTailoredExperiencesWithDiagnosticData
                              -
                              - Experience/AllowTaskSwitcher -
                              Experience/AllowThirdPartySuggestionsInWindowsSpotlight
                              -
                              - Experience/AllowVoiceRecording -
                              Experience/AllowWindowsConsumerFeatures
                              @@ -1262,6 +1427,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Experience/PreventUsersFromTurningOnBrowserSyncing
                              +
                              + Experience/ShowLockOnUserTile +
                              ### ExploitGuard policies @@ -1323,6 +1491,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              InternetExplorer/AllowEnhancedProtectedMode
                              +
                              + InternetExplorer/AllowEnhancedSuggestionsInAddressBar +
                              InternetExplorer/AllowEnterpriseModeFromToolsMenu
                              @@ -1390,6 +1561,8 @@ The following diagram shows the Policy configuration service provider in tree fo InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses
                              + InternetExplorer/DisableActiveXVersionListAutoDownload +

                              InternetExplorer/DisableAdobeFlash
                              @@ -1398,6 +1571,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles
                              +
                              + InternetExplorer/DisableCompatView +
                              InternetExplorer/DisableConfiguringHistory
                              @@ -1416,12 +1592,18 @@ The following diagram shows the Policy configuration service provider in tree fo
                              InternetExplorer/DisableEncryptionSupport
                              +
                              + InternetExplorer/DisableFeedsBackgroundSync +
                              InternetExplorer/DisableFirstRunWizard
                              InternetExplorer/DisableFlipAheadFeature
                              +
                              + InternetExplorer/DisableGeolocation +
                              InternetExplorer/DisableHomePageChange
                              @@ -1449,6 +1631,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              InternetExplorer/DisableUpdateCheck
                              +
                              + InternetExplorer/DisableWebAddressAutoComplete +
                              InternetExplorer/DoNotAllowActiveXControlsInProtectedMode
                              @@ -1842,6 +2027,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses
                              +
                              + InternetExplorer/NewTabDefaultPage +
                              InternetExplorer/NotificationBarInternetExplorerProcesses
                              @@ -2116,12 +2304,6 @@ The following diagram shows the Policy configuration service provider in tree fo
                              LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
                              -
                              - LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus -
                              -
                              - LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus -
                              LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
                              @@ -2176,18 +2358,12 @@ The following diagram shows the Policy configuration service provider in tree fo
                              LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
                              -
                              - LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways -
                              LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
                              LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
                              -
                              - LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession -
                              LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
                              @@ -2206,9 +2382,6 @@ The following diagram shows the Policy configuration service provider in tree fo
                              LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
                              -
                              - LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM -
                              LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
                              @@ -2218,9 +2391,6 @@ The following diagram shows the Policy configuration service provider in tree fo
                              LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
                              -
                              - LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients -
                              LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
                              @@ -2304,15 +2474,9 @@ The following diagram shows the Policy configuration service provider in tree fo ### Messaging policies
                              -
                              - Messaging/AllowMMS -
                              Messaging/AllowMessageSync
                              -
                              - Messaging/AllowRCS -
                              ### MSSecurityGuide policies @@ -2413,6 +2577,14 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Power/DisplayOffTimeoutPluggedIn
                              +
                              + Power/EnergySaverBatteryThresholdOnBattery +
                              +
                              + Power/EnergySaverBatteryThresholdPluggedIn +
                              Power/HibernateTimeoutOnBattery
                              @@ -2425,12 +2597,52 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Power/RequirePasswordWhenComputerWakesPluggedIn
                              +
                              + Power/SelectLidCloseActionOnBattery +
                              +
                              + Power/SelectLidCloseActionPluggedIn +
                              +
                              + Power/SelectPowerButtonActionOnBattery +
                              +
                              + Power/SelectPowerButtonActionPluggedIn +
                              +
                              + Power/SelectSleepButtonActionOnBattery +
                              +
                              + Power/SelectSleepButtonActionPluggedIn +
                              Power/StandbyTimeoutOnBattery
                              Power/StandbyTimeoutPluggedIn
                              +
                              + Power/TurnOffHybridSleepOnBattery +
                              +
                              + Power/TurnOffHybridSleepPluggedIn +
                              +
                              + Power/UnattendedSleepTimeoutOnBattery +
                              +
                              + Power/UnattendedSleepTimeoutPluggedIn +
                              ### Printers policies @@ -2480,6 +2692,18 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps
                              +
                              + Privacy/LetAppsAccessBackgroundSpatialPerception +
                              +
                              + Privacy/LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps +
                              +
                              + Privacy/LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps +
                              +
                              + Privacy/LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps +
                              Privacy/LetAppsAccessCalendar
                              @@ -2660,6 +2884,12 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps
                              +
                              + Privacy/LetAppsActivateWithVoice +
                              +
                              + Privacy/LetAppsActivateWithVoiceAboveLock +
                              Privacy/LetAppsGetDiagnosticInfo
                              @@ -2848,6 +3078,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Search/AllowCortanaInAAD
                              +
                              + Search/AllowFindMyFiles +
                              Search/AllowIndexingEncryptedStoresOrItems
                              @@ -2881,9 +3114,6 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Search/PreventRemoteQueries
                              -
                              - Search/SafeSearchPermissions -
                              ### Security policies @@ -2895,15 +3125,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices
                              -
                              - Security/AllowManualRootCertificateInstallation -
                              Security/AllowRemoveProvisioningPackage
                              -
                              - Security/AntiTheftMode -
                              Security/ClearTPMIfNotReady
                              @@ -2927,6 +3151,13 @@ The following diagram shows the Policy configuration service provider in tree fo +### ServiceControlManager policies +
                              +
                              + ServiceControlManager/SvchostProcessMitigation +
                              +
                              + ### Settings policies
                              @@ -2939,9 +3170,6 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Settings/AllowDateTime
                              -
                              - Settings/AllowEditDeviceName -
                              Settings/AllowLanguage
                              @@ -2974,7 +3202,7 @@ The following diagram shows the Policy configuration service provider in tree fo
                              -### SmartScreen policies +### Windows Defender SmartScreen policies
                              @@ -3101,7 +3329,7 @@ The following diagram shows the Policy configuration service provider in tree fo Storage/EnhancedStorageDevices
                              - Storage/RemovableDiskDenyWriteAccess + Storage/RemovableDiskDenyWriteAccess
                              @@ -3111,6 +3339,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              System/AllowBuildPreview
                              +
                              + System/AllowCommercialDataPipeline +
                              System/AllowDeviceNameInDiagnosticData
                              @@ -3171,6 +3402,9 @@ The following diagram shows the Policy configuration service provider in tree fo
                              System/TelemetryProxy
                              +
                              + System/TurnOffFileHistory +
                              ### SystemServices policies @@ -3251,6 +3485,15 @@ The following diagram shows the Policy configuration service provider in tree fo
                              TextInput/AllowLinguisticDataCollection
                              +
                              + TextInput/ConfigureJapaneseIMEVersion +
                              +
                              + TextInput/ConfigureSimplifiedChineseIMEVersion +
                              +
                              + TextInput/ConfigureTraditionalChineseIMEVersion +
                              TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
                              @@ -3293,7 +3536,15 @@ The following diagram shows the Policy configuration service provider in tree fo
                              - TimeLanguageSettings/AllowSet24HourClock + TimeLanguageSettings/ConfigureTimeZone +
                              +
                              + +### Troubleshooting policies + +
                              +
                              + Troubleshooting/AllowRecommendations
                              @@ -3336,9 +3587,24 @@ The following diagram shows the Policy configuration service provider in tree fo
                              Update/AutoRestartRequiredNotificationDismissal
                              +
                              + Update/AutomaticMaintenanceWakeUp +
                              Update/BranchReadinessLevel
                              +
                              + Update/ConfigureDeadlineForFeatureUpdates +
                              +
                              + Update/ConfigureDeadlineForQualityUpdates +
                              +
                              + Update/ConfigureDeadlineGracePeriod +
                              +
                              + Update/ConfigureDeadlineNoAutoReboot +
                              Update/ConfigureFeatureUpdateUninstallPeriod
                              @@ -3678,22 +3944,28 @@ The following diagram shows the Policy configuration service provider in tree fo ### WindowsLogon policies
                              +
                              + WindowsLogon/AllowAutomaticRestartSignOn +
                              +
                              + WindowsLogon/ConfigAutomaticRestartSignOn +
                              WindowsLogon/DisableLockScreenAppNotifications
                              WindowsLogon/DontDisplayNetworkSelectionUI
                              +
                              + WindowsLogon/EnableFirstLogonAnimation +
                              WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers
                              WindowsLogon/HideFastUserSwitching
                              -
                              - WindowsLogon/SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart -
                              -
                              + ### WindowsPowerShell policies @@ -3732,1427 +4004,25 @@ The following diagram shows the Policy configuration service provider in tree fo +## Policies supported by Group Policy and ADMX-backed policies +- [Policies supported by Group Policy](policies-supported-by-group-policy.md) +- [ADMX-backed policies](policies-admx-backed.md) -## ADMX-backed policies +## Policies supported by HoloLens devices +- [Policies supported by HoloLens 2](policies-supported-by-hololens2.md) +- [Policies supported by HoloLens (1st gen) Commercial Suite](policies-supported-by-hololens-1st-gen-commercial-suite.md) +- [Policies supported by HoloLens (1st gen) Development Edition](policies-supported-by-hololens-1st-gen-development-edition.md) -- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) -- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) -- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) -- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) -- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) -- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) -- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) -- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) -- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) -- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) -- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) -- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) -- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) -- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) -- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) -- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) -- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) -- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) -- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) -- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) -- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) -- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) -- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) -- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) -- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) -- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) -- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) -- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) -- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) -- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) -- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) -- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) -- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) -- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) -- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) -- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) -- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) -- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) -- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) -- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) -- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) -- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) -- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) -- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) -- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) -- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) -- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) -- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) -- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) -- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) -- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) -- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) -- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) -- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) -- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) -- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) -- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) -- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) -- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) -- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) -- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) -- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) -- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) -- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) -- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) -- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) -- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) -- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) -- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) -- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) -- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) -- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) -- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) -- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) -- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) -- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) -- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) -- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) -- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) -- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) -- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) -- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) -- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) -- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) -- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) -- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) -- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) -- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) -- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) -- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) -- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) -- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) -- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) -- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) -- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) -- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) -- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) -- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) -- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) -- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) -- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) -- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) -- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) -- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) -- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) -- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) -- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) -- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) -- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) -- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) -- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) -- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) -- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) -- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) -- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) -- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) -- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) -- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) -- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) -- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) -- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) -- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) -- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) -- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) -- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) -- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) -- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) -- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) -- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) -- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) -- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) -- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) -- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) -- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) -- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) -- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) -- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) -- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) -- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) -- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) -- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) -- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) -- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) -- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) -- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) -- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) -- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) -- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) -- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) -- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) -- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) -- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) -- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) -- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) -- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) -- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) -- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) -- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) -- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) -- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) -- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) -- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) -- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) -- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) -- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) -- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) -- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) -- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) -- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) -- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) -- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) -- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) -- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) -- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) -- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) -- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) -- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) -- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) -- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) -- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) -- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) -- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) -- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) -- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) -- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) -- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) -- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) -- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) -- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) -- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) -- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) -- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) -- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) -- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) -- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) -- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) -- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) -- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) -- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) -- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) -- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) -- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) -- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) -- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) -- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) -- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) -- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) -- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) -- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) -- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) -- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) -- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) -- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) -- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) -- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) -- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) -- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) -- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) -- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) -- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) -- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) -- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) -- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) -- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) -- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) -- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) -- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) -- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) -- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) -- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) -- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) -- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) -- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) -- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) -- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) -- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) -- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) -- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) -- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) -- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) -- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) -- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) -- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) -- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) -- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) -- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) -- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) -- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) -- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) -- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) -- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) -- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) -- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) -- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) -- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) -- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) -- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) -- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) -- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) -- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) -- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) -- [WindowsLogon/SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart](./policy-csp-windowslogon.md#windowslogon-signinlastinteractiveuserautomaticallyafterasysteminitiatedrestart) -- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) +## Policies supported by Windows 10 IoT +- [Policies supported by Windows 10 IoT Enterprise](policies-supported-by-iot-enterprise.md) +- [Policies supported by Windows 10 IoT Core](policies-supported-by-iot-core.md) +## Policies supported by Microsoft Surface Hub +- [Policies supported by Microsoft Surface Hub](policies-supported-by-surface-hub.md) -## Policies supported by GP - -- [AboveLock/AllowCortanaAboveLock](./policy-csp-abovelock.md#abovelock-allowcortanaabovelock) -- [ActiveXControls/ApprovedInstallationSites](./policy-csp-activexcontrols.md#activexcontrols-approvedinstallationsites) -- [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) -- [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) -- [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) -- [AppVirtualization/AllowPackageCleanup](./policy-csp-appvirtualization.md#appvirtualization-allowpackagecleanup) -- [AppVirtualization/AllowPackageScripts](./policy-csp-appvirtualization.md#appvirtualization-allowpackagescripts) -- [AppVirtualization/AllowPublishingRefreshUX](./policy-csp-appvirtualization.md#appvirtualization-allowpublishingrefreshux) -- [AppVirtualization/AllowReportingServer](./policy-csp-appvirtualization.md#appvirtualization-allowreportingserver) -- [AppVirtualization/AllowRoamingFileExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingfileexclusions) -- [AppVirtualization/AllowRoamingRegistryExclusions](./policy-csp-appvirtualization.md#appvirtualization-allowroamingregistryexclusions) -- [AppVirtualization/AllowStreamingAutoload](./policy-csp-appvirtualization.md#appvirtualization-allowstreamingautoload) -- [AppVirtualization/ClientCoexistenceAllowMigrationmode](./policy-csp-appvirtualization.md#appvirtualization-clientcoexistenceallowmigrationmode) -- [AppVirtualization/IntegrationAllowRootGlobal](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootglobal) -- [AppVirtualization/IntegrationAllowRootUser](./policy-csp-appvirtualization.md#appvirtualization-integrationallowrootuser) -- [AppVirtualization/PublishingAllowServer1](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver1) -- [AppVirtualization/PublishingAllowServer2](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver2) -- [AppVirtualization/PublishingAllowServer3](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver3) -- [AppVirtualization/PublishingAllowServer4](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver4) -- [AppVirtualization/PublishingAllowServer5](./policy-csp-appvirtualization.md#appvirtualization-publishingallowserver5) -- [AppVirtualization/StreamingAllowCertificateFilterForClient_SSL](./policy-csp-appvirtualization.md#appvirtualization-streamingallowcertificatefilterforclient-ssl) -- [AppVirtualization/StreamingAllowHighCostLaunch](./policy-csp-appvirtualization.md#appvirtualization-streamingallowhighcostlaunch) -- [AppVirtualization/StreamingAllowLocationProvider](./policy-csp-appvirtualization.md#appvirtualization-streamingallowlocationprovider) -- [AppVirtualization/StreamingAllowPackageInstallationRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackageinstallationroot) -- [AppVirtualization/StreamingAllowPackageSourceRoot](./policy-csp-appvirtualization.md#appvirtualization-streamingallowpackagesourceroot) -- [AppVirtualization/StreamingAllowReestablishmentInterval](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentinterval) -- [AppVirtualization/StreamingAllowReestablishmentRetries](./policy-csp-appvirtualization.md#appvirtualization-streamingallowreestablishmentretries) -- [AppVirtualization/StreamingSharedContentStoreMode](./policy-csp-appvirtualization.md#appvirtualization-streamingsharedcontentstoremode) -- [AppVirtualization/StreamingSupportBranchCache](./policy-csp-appvirtualization.md#appvirtualization-streamingsupportbranchcache) -- [AppVirtualization/StreamingVerifyCertificateRevocationList](./policy-csp-appvirtualization.md#appvirtualization-streamingverifycertificaterevocationlist) -- [AppVirtualization/VirtualComponentsAllowList](./policy-csp-appvirtualization.md#appvirtualization-virtualcomponentsallowlist) -- [ApplicationDefaults/DefaultAssociationsConfiguration](./policy-csp-applicationdefaults.md#applicationdefaults-defaultassociationsconfiguration) -- [ApplicationDefaults/EnableAppUriHandlers](./policy-csp-applicationdefaults.md#applicationdefaults-enableappurihandlers) -- [ApplicationManagement/AllowAllTrustedApps](./policy-csp-applicationmanagement.md#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](./policy-csp-applicationmanagement.md#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](./policy-csp-applicationmanagement.md#applicationmanagement-allowdeveloperunlock) -- [ApplicationManagement/AllowGameDVR](./policy-csp-applicationmanagement.md#applicationmanagement-allowgamedvr) -- [ApplicationManagement/AllowSharedUserAppData](./policy-csp-applicationmanagement.md#applicationmanagement-allowshareduserappdata) -- [ApplicationManagement/DisableStoreOriginatedApps](./policy-csp-applicationmanagement.md#applicationmanagement-disablestoreoriginatedapps) -- [ApplicationManagement/MSIAllowUserControlOverInstall](./policy-csp-applicationmanagement.md#applicationmanagement-msiallowusercontroloverinstall) -- [ApplicationManagement/MSIAlwaysInstallWithElevatedPrivileges](./policy-csp-applicationmanagement.md#applicationmanagement-msialwaysinstallwithelevatedprivileges) -- [ApplicationManagement/RequirePrivateStoreOnly](./policy-csp-applicationmanagement.md#applicationmanagement-requireprivatestoreonly) -- [ApplicationManagement/RestrictAppDataToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictappdatatosystemvolume) -- [ApplicationManagement/RestrictAppToSystemVolume](./policy-csp-applicationmanagement.md#applicationmanagement-restrictapptosystemvolume) -- [AttachmentManager/DoNotPreserveZoneInformation](./policy-csp-attachmentmanager.md#attachmentmanager-donotpreservezoneinformation) -- [AttachmentManager/HideZoneInfoMechanism](./policy-csp-attachmentmanager.md#attachmentmanager-hidezoneinfomechanism) -- [AttachmentManager/NotifyAntivirusPrograms](./policy-csp-attachmentmanager.md#attachmentmanager-notifyantivirusprograms) -- [Authentication/AllowSecondaryAuthenticationDevice](./policy-csp-authentication.md#authentication-allowsecondaryauthenticationdevice) -- [Autoplay/DisallowAutoplayForNonVolumeDevices](./policy-csp-autoplay.md#autoplay-disallowautoplayfornonvolumedevices) -- [Autoplay/SetDefaultAutoRunBehavior](./policy-csp-autoplay.md#autoplay-setdefaultautorunbehavior) -- [Autoplay/TurnOffAutoPlay](./policy-csp-autoplay.md#autoplay-turnoffautoplay) -- [BITS/BandwidthThrottlingEndTime](./policy-csp-bits.md#bits-bandwidththrottlingendtime) -- [BITS/BandwidthThrottlingStartTime](./policy-csp-bits.md#bits-bandwidththrottlingstarttime) -- [BITS/BandwidthThrottlingTransferRate](./policy-csp-bits.md#bits-bandwidththrottlingtransferrate) -- [BITS/CostedNetworkBehaviorBackgroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorbackgroundpriority) -- [BITS/CostedNetworkBehaviorForegroundPriority](./policy-csp-bits.md#bits-costednetworkbehaviorforegroundpriority) -- [BITS/JobInactivityTimeout](./policy-csp-bits.md#bits-jobinactivitytimeout) -- [Browser/AllowAddressBarDropdown](./policy-csp-browser.md#browser-allowaddressbardropdown) -- [Browser/AllowAutofill](./policy-csp-browser.md#browser-allowautofill) -- [Browser/AllowCookies](./policy-csp-browser.md#browser-allowcookies) -- [Browser/AllowDeveloperTools](./policy-csp-browser.md#browser-allowdevelopertools) -- [Browser/AllowDoNotTrack](./policy-csp-browser.md#browser-allowdonottrack) -- [Browser/AllowExtensions](./policy-csp-browser.md#browser-allowextensions) -- [Browser/AllowFlash](./policy-csp-browser.md#browser-allowflash) -- [Browser/AllowFlashClickToRun](./policy-csp-browser.md#browser-allowflashclicktorun) -- [Browser/AllowFullScreenMode](./policy-csp-browser.md#browser-allowfullscreenmode) -- [Browser/AllowInPrivate](./policy-csp-browser.md#browser-allowinprivate) -- [Browser/AllowMicrosoftCompatibilityList](./policy-csp-browser.md#browser-allowmicrosoftcompatibilitylist) -- [Browser/AllowPasswordManager](./policy-csp-browser.md#browser-allowpasswordmanager) -- [Browser/AllowPopups](./policy-csp-browser.md#browser-allowpopups) -- [Browser/AllowPrelaunch](./policy-csp-browser.md#browser-allowprelaunch) -- [Browser/AllowPrinting](./policy-csp-browser.md#browser-allowprinting) -- [Browser/AllowSavingHistory](./policy-csp-browser.md#browser-allowsavinghistory) -- [Browser/AllowSearchEngineCustomization](./policy-csp-browser.md#browser-allowsearchenginecustomization) -- [Browser/AllowSearchSuggestionsinAddressBar](./policy-csp-browser.md#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSideloadingOfExtensions](./policy-csp-browser.md#browser-allowsideloadingofextensions) -- [Browser/AllowSmartScreen](./policy-csp-browser.md#browser-allowsmartscreen) -- [Browser/AllowTabPreloading](./policy-csp-browser.md#browser-allowtabpreloading) -- [Browser/AllowWebContentOnNewTabPage](./policy-csp-browser.md#browser-allowwebcontentonnewtabpage) -- [Browser/AlwaysEnableBooksLibrary](./policy-csp-browser.md#browser-alwaysenablebookslibrary) -- [Browser/ClearBrowsingDataOnExit](./policy-csp-browser.md#browser-clearbrowsingdataonexit) -- [Browser/ConfigureAdditionalSearchEngines](./policy-csp-browser.md#browser-configureadditionalsearchengines) -- [Browser/ConfigureFavoritesBar](./policy-csp-browser.md#browser-configurefavoritesbar) -- [Browser/ConfigureHomeButton](./policy-csp-browser.md#browser-configurehomebutton) -- [Browser/ConfigureKioskMode](./policy-csp-browser.md#browser-configurekioskmode) -- [Browser/ConfigureKioskResetAfterIdleTimeout](./policy-csp-browser.md#browser-configurekioskresetafteridletimeout) -- [Browser/ConfigureOpenMicrosoftEdgeWith](./policy-csp-browser.md#browser-configureopenmicrosoftedgewith) -- [Browser/ConfigureTelemetryForMicrosoft365Analytics](./policy-csp-browser.md#browser-configuretelemetryformicrosoft365analytics) -- [Browser/DisableLockdownOfStartPages](./policy-csp-browser.md#browser-disablelockdownofstartpages) -- [Browser/EnableExtendedBooksTelemetry](./policy-csp-browser.md#browser-enableextendedbookstelemetry) -- [Browser/EnterpriseModeSiteList](./policy-csp-browser.md#browser-enterprisemodesitelist) -- [Browser/HomePages](./policy-csp-browser.md#browser-homepages) -- [Browser/LockdownFavorites](./policy-csp-browser.md#browser-lockdownfavorites) -- [Browser/PreventAccessToAboutFlagsInMicrosoftEdge](./policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) -- [Browser/PreventCertErrorOverrides](./policy-csp-browser.md#browser-preventcerterroroverrides) -- [Browser/PreventFirstRunPage](./policy-csp-browser.md#browser-preventfirstrunpage) -- [Browser/PreventLiveTileDataCollection](./policy-csp-browser.md#browser-preventlivetiledatacollection) -- [Browser/PreventSmartScreenPromptOverride](./policy-csp-browser.md#browser-preventsmartscreenpromptoverride) -- [Browser/PreventSmartScreenPromptOverrideForFiles](./policy-csp-browser.md#browser-preventsmartscreenpromptoverrideforfiles) -- [Browser/PreventUsingLocalHostIPAddressForWebRTC](./policy-csp-browser.md#browser-preventusinglocalhostipaddressforwebrtc) -- [Browser/ProvisionFavorites](./policy-csp-browser.md#browser-provisionfavorites) -- [Browser/SendIntranetTraffictoInternetExplorer](./policy-csp-browser.md#browser-sendintranettraffictointernetexplorer) -- [Browser/SetDefaultSearchEngine](./policy-csp-browser.md#browser-setdefaultsearchengine) -- [Browser/SetHomeButtonURL](./policy-csp-browser.md#browser-sethomebuttonurl) -- [Browser/SetNewTabPageURL](./policy-csp-browser.md#browser-setnewtabpageurl) -- [Browser/ShowMessageWhenOpeningSitesInInternetExplorer](./policy-csp-browser.md#browser-showmessagewhenopeningsitesininternetexplorer) -- [Browser/SyncFavoritesBetweenIEAndMicrosoftEdge](./policy-csp-browser.md#browser-syncfavoritesbetweenieandmicrosoftedge) -- [Browser/UnlockHomeButton](./policy-csp-browser.md#browser-unlockhomebutton) -- [Browser/UseSharedFolderForBooks](./policy-csp-browser.md#browser-usesharedfolderforbooks) -- [Camera/AllowCamera](./policy-csp-camera.md#camera-allowcamera) -- [Cellular/LetAppsAccessCellularData](./policy-csp-cellular.md#cellular-letappsaccesscellulardata) -- [Cellular/LetAppsAccessCellularData_ForceAllowTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forceallowtheseapps) -- [Cellular/LetAppsAccessCellularData_ForceDenyTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-forcedenytheseapps) -- [Cellular/LetAppsAccessCellularData_UserInControlOfTheseApps](./policy-csp-cellular.md#cellular-letappsaccesscellulardata-userincontroloftheseapps) -- [Cellular/ShowAppCellularAccessUI](./policy-csp-cellular.md#cellular-showappcellularaccessui) -- [Connectivity/AllowCellularDataRoaming](./policy-csp-connectivity.md#connectivity-allowcellulardataroaming) -- [Connectivity/AllowPhonePCLinking](./policy-csp-connectivity.md#connectivity-allowphonepclinking) -- [Connectivity/DiablePrintingOverHTTP](./policy-csp-connectivity.md#connectivity-diableprintingoverhttp) -- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](./policy-csp-connectivity.md#connectivity-disabledownloadingofprintdriversoverhttp) -- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](./policy-csp-connectivity.md#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) -- [Connectivity/DisallowNetworkConnectivityActiveTests](./policy-csp-connectivity.md#connectivity-disallownetworkconnectivityactivetests) -- [Connectivity/HardenedUNCPaths](./policy-csp-connectivity.md#connectivity-hardeneduncpaths) -- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](./policy-csp-connectivity.md#connectivity-prohibitinstallationandconfigurationofnetworkbridge) -- [CredentialProviders/AllowPINLogon](./policy-csp-credentialproviders.md#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](./policy-csp-credentialproviders.md#credentialproviders-blockpicturepassword) -- [CredentialsDelegation/RemoteHostAllowsDelegationOfNonExportableCredentials](./policy-csp-credentialsdelegation.md#credentialsdelegation-remotehostallowsdelegationofnonexportablecredentials) -- [CredentialsUI/DisablePasswordReveal](./policy-csp-credentialsui.md#credentialsui-disablepasswordreveal) -- [CredentialsUI/EnumerateAdministrators](./policy-csp-credentialsui.md#credentialsui-enumerateadministrators) -- [Cryptography/AllowFipsAlgorithmPolicy](./policy-csp-cryptography.md#cryptography-allowfipsalgorithmpolicy) -- [DataUsage/SetCost4G](./policy-csp-datausage.md#datausage-setcost4g) -- [Defender/AllowArchiveScanning](./policy-csp-defender.md#defender-allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](./policy-csp-defender.md#defender-allowbehaviormonitoring) -- [Defender/AllowCloudProtection](./policy-csp-defender.md#defender-allowcloudprotection) -- [Defender/AllowEmailScanning](./policy-csp-defender.md#defender-allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](./policy-csp-defender.md#defender-allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](./policy-csp-defender.md#defender-allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](./policy-csp-defender.md#defender-allowioavprotection) -- [Defender/AllowOnAccessProtection](./policy-csp-defender.md#defender-allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](./policy-csp-defender.md#defender-allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](./policy-csp-defender.md#defender-allowscanningnetworkfiles) -- [Defender/AllowUserUIAccess](./policy-csp-defender.md#defender-allowuseruiaccess) -- [Defender/AttackSurfaceReductionOnlyExclusions](./policy-csp-defender.md#defender-attacksurfacereductiononlyexclusions) -- [Defender/AttackSurfaceReductionRules](./policy-csp-defender.md#defender-attacksurfacereductionrules) -- [Defender/AvgCPULoadFactor](./policy-csp-defender.md#defender-avgcpuloadfactor) -- [Defender/CheckForSignaturesBeforeRunningScan](./policy-csp-defender.md#defender-checkforsignaturesbeforerunningscan) -- [Defender/CloudBlockLevel](./policy-csp-defender.md#defender-cloudblocklevel) -- [Defender/CloudExtendedTimeout](./policy-csp-defender.md#defender-cloudextendedtimeout) -- [Defender/ControlledFolderAccessAllowedApplications](./policy-csp-defender.md#defender-controlledfolderaccessallowedapplications) -- [Defender/ControlledFolderAccessProtectedFolders](./policy-csp-defender.md#defender-controlledfolderaccessprotectedfolders) -- [Defender/DaysToRetainCleanedMalware](./policy-csp-defender.md#defender-daystoretaincleanedmalware) -- [Defender/DisableCatchupFullScan](./policy-csp-defender.md#defender-disablecatchupfullscan) -- [Defender/DisableCatchupQuickScan](./policy-csp-defender.md#defender-disablecatchupquickscan) -- [Defender/EnableControlledFolderAccess](./policy-csp-defender.md#defender-enablecontrolledfolderaccess) -- [Defender/EnableLowCPUPriority](./policy-csp-defender.md#defender-enablelowcpupriority) -- [Defender/EnableNetworkProtection](./policy-csp-defender.md#defender-enablenetworkprotection) -- [Defender/ExcludedExtensions](./policy-csp-defender.md#defender-excludedextensions) -- [Defender/ExcludedPaths](./policy-csp-defender.md#defender-excludedpaths) -- [Defender/ExcludedProcesses](./policy-csp-defender.md#defender-excludedprocesses) -- [Defender/RealTimeScanDirection](./policy-csp-defender.md#defender-realtimescandirection) -- [Defender/ScanParameter](./policy-csp-defender.md#defender-scanparameter) -- [Defender/ScheduleQuickScanTime](./policy-csp-defender.md#defender-schedulequickscantime) -- [Defender/ScheduleScanDay](./policy-csp-defender.md#defender-schedulescanday) -- [Defender/ScheduleScanTime](./policy-csp-defender.md#defender-schedulescantime) -- [Defender/SignatureUpdateFallbackOrder](./policy-csp-defender.md#defender-signatureupdatefallbackorder) -- [Defender/SignatureUpdateFileSharesSources](./policy-csp-defender.md#defender-signatureupdatefilesharessources) -- [Defender/SignatureUpdateInterval](./policy-csp-defender.md#defender-signatureupdateinterval) -- [Defender/SubmitSamplesConsent](./policy-csp-defender.md#defender-submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](./policy-csp-defender.md#defender-threatseveritydefaultaction) -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](./policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DOCacheHost](./policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) -- [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) -- [DeliveryOptimization/DODelayForegroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) -- [DeliveryOptimization/DODownloadMode](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOGroupIdSource](./policy-csp-deliveryoptimization.md#deliveryoptimization-dogroupidsource) -- [DeliveryOptimization/DOMaxCacheAge](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinBatteryPercentageAllowedToUpload](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominbatterypercentageallowedtoupload) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](./policy-csp-deliveryoptimization.md#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](./policy-csp-deliveryoptimization.md#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](./policy-csp-deliveryoptimization.md#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxBackgroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxbackgroundbandwidth) -- [DeliveryOptimization/DOPercentageMaxForegroundBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dopercentagemaxforegroundbandwidth) -- [DeliveryOptimization/DORestrictPeerSelectionBy](./policy-csp-deliveryoptimization.md#deliveryoptimization-dorestrictpeerselectionby) -- [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) -- [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) -- [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) -- [DeviceGuard/ConfigureSystemGuardLaunch](./policy-csp-deviceguard.md#deviceguard-configuresystemguardlaunch) -- [DeviceGuard/EnableVirtualizationBasedSecurity](./policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity) -- [DeviceGuard/LsaCfgFlags](./policy-csp-deviceguard.md#deviceguard-lsacfgflags) -- [DeviceGuard/RequirePlatformSecurityFeatures](./policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdeviceids) -- [DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-allowinstallationofmatchingdevicesetupclasses) -- [DeviceInstallation/PreventDeviceMetadataFromNetwork](./policy-csp-deviceinstallation.md#deviceinstallation-preventdevicemetadatafromnetwork) -- [DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofdevicesnotdescribedbyotherpolicysettings) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceIDs](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdeviceids) -- [DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses](./policy-csp-deviceinstallation.md#deviceinstallation-preventinstallationofmatchingdevicesetupclasses) -- [DeviceLock/MinimumPasswordAge](./policy-csp-devicelock.md#devicelock-minimumpasswordage) -- [DeviceLock/PreventEnablingLockScreenCamera](./policy-csp-devicelock.md#devicelock-preventenablinglockscreencamera) -- [DeviceLock/PreventLockScreenSlideShow](./policy-csp-devicelock.md#devicelock-preventlockscreenslideshow) -- [Display/DisablePerProcessDpiForApps](./policy-csp-display.md#display-disableperprocessdpiforapps) -- [Display/EnablePerProcessDpi](./policy-csp-display.md#display-enableperprocessdpi) -- [Display/EnablePerProcessDpiForApps](./policy-csp-display.md#display-enableperprocessdpiforapps) -- [Display/TurnOffGdiDPIScalingForApps](./policy-csp-display.md#display-turnoffgdidpiscalingforapps) -- [Display/TurnOnGdiDPIScalingForApps](./policy-csp-display.md#display-turnongdidpiscalingforapps) -- [DmaGuard/DeviceEnumerationPolicy](./policy-csp-dmaguard.md#dmaguard-deviceenumerationpolicy) -- [Education/PreventAddingNewPrinters](./policy-csp-education.md#education-preventaddingnewprinters) -- [ErrorReporting/CustomizeConsentSettings](./policy-csp-errorreporting.md#errorreporting-customizeconsentsettings) -- [ErrorReporting/DisableWindowsErrorReporting](./policy-csp-errorreporting.md#errorreporting-disablewindowserrorreporting) -- [ErrorReporting/DisplayErrorNotification](./policy-csp-errorreporting.md#errorreporting-displayerrornotification) -- [ErrorReporting/DoNotSendAdditionalData](./policy-csp-errorreporting.md#errorreporting-donotsendadditionaldata) -- [ErrorReporting/PreventCriticalErrorDisplay](./policy-csp-errorreporting.md#errorreporting-preventcriticalerrordisplay) -- [EventLogService/ControlEventLogBehavior](./policy-csp-eventlogservice.md#eventlogservice-controleventlogbehavior) -- [EventLogService/SpecifyMaximumFileSizeApplicationLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizeapplicationlog) -- [EventLogService/SpecifyMaximumFileSizeSecurityLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesecuritylog) -- [EventLogService/SpecifyMaximumFileSizeSystemLog](./policy-csp-eventlogservice.md#eventlogservice-specifymaximumfilesizesystemlog) -- [Experience/AllowClipboardHistory](./policy-csp-experience.md#experience-allowclipboardhistory) -- [Experience/AllowCortana](./policy-csp-experience.md#experience-allowcortana) -- [Experience/AllowFindMyDevice](./policy-csp-experience.md#experience-allowfindmydevice) -- [Experience/AllowTailoredExperiencesWithDiagnosticData](./policy-csp-experience.md#experience-allowtailoredexperienceswithdiagnosticdata) -- [Experience/AllowThirdPartySuggestionsInWindowsSpotlight](./policy-csp-experience.md#experience-allowthirdpartysuggestionsinwindowsspotlight) -- [Experience/AllowWindowsConsumerFeatures](./policy-csp-experience.md#experience-allowwindowsconsumerfeatures) -- [Experience/AllowWindowsSpotlight](./policy-csp-experience.md#experience-allowwindowsspotlight) -- [Experience/AllowWindowsSpotlightOnActionCenter](./policy-csp-experience.md#experience-allowwindowsspotlightonactioncenter) -- [Experience/AllowWindowsSpotlightOnSettings](./policy-csp-experience.md#experience-allowwindowsspotlightonsettings) -- [Experience/AllowWindowsSpotlightWindowsWelcomeExperience](./policy-csp-experience.md#experience-allowwindowsspotlightwindowswelcomeexperience) -- [Experience/AllowWindowsTips](./policy-csp-experience.md#experience-allowwindowstips) -- [Experience/ConfigureWindowsSpotlightOnLockScreen](./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen) -- [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications) -- [Experience/DoNotSyncBrowserSettings](./policy-csp-experience.md#experience-donotsyncbrowsersetting) -- [Experience/PreventUsersFromTurningOnBrowserSyncing](./policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing) -- [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings) -- [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) -- [FileExplorer/TurnOffHeapTerminationOnCorruption](./policy-csp-fileexplorer.md#fileexplorer-turnoffheapterminationoncorruption) -- [Handwriting/PanelDefaultModeDocked](./policy-csp-handwriting.md#handwriting-paneldefaultmodedocked) -- [InternetExplorer/AddSearchProvider](./policy-csp-internetexplorer.md#internetexplorer-addsearchprovider) -- [InternetExplorer/AllowActiveXFiltering](./policy-csp-internetexplorer.md#internetexplorer-allowactivexfiltering) -- [InternetExplorer/AllowAddOnList](./policy-csp-internetexplorer.md#internetexplorer-allowaddonlist) -- [InternetExplorer/AllowAutoComplete](./policy-csp-internetexplorer.md#internetexplorer-allowautocomplete) -- [InternetExplorer/AllowCertificateAddressMismatchWarning](./policy-csp-internetexplorer.md#internetexplorer-allowcertificateaddressmismatchwarning) -- [InternetExplorer/AllowDeletingBrowsingHistoryOnExit](./policy-csp-internetexplorer.md#internetexplorer-allowdeletingbrowsinghistoryonexit) -- [InternetExplorer/AllowEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-allowenhancedprotectedmode) -- [InternetExplorer/AllowEnterpriseModeFromToolsMenu](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodefromtoolsmenu) -- [InternetExplorer/AllowEnterpriseModeSiteList](./policy-csp-internetexplorer.md#internetexplorer-allowenterprisemodesitelist) -- [InternetExplorer/AllowFallbackToSSL3](./policy-csp-internetexplorer.md#internetexplorer-allowfallbacktossl3) -- [InternetExplorer/AllowInternetExplorer7PolicyList](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorer7policylist) -- [InternetExplorer/AllowInternetExplorerStandardsMode](./policy-csp-internetexplorer.md#internetexplorer-allowinternetexplorerstandardsmode) -- [InternetExplorer/AllowInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowinternetzonetemplate) -- [InternetExplorer/AllowIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowintranetzonetemplate) -- [InternetExplorer/AllowLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownInternetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddowninternetzonetemplate) -- [InternetExplorer/AllowLockedDownIntranetZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownintranetzonetemplate) -- [InternetExplorer/AllowLockedDownLocalMachineZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownlocalmachinezonetemplate) -- [InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowlockeddownrestrictedsiteszonetemplate) -- [InternetExplorer/AllowOneWordEntry](./policy-csp-internetexplorer.md#internetexplorer-allowonewordentry) -- [InternetExplorer/AllowSiteToZoneAssignmentList](./policy-csp-internetexplorer.md#internetexplorer-allowsitetozoneassignmentlist) -- [InternetExplorer/AllowSoftwareWhenSignatureIsInvalid](./policy-csp-internetexplorer.md#internetexplorer-allowsoftwarewhensignatureisinvalid) -- [InternetExplorer/AllowSuggestedSites](./policy-csp-internetexplorer.md#internetexplorer-allowsuggestedsites) -- [InternetExplorer/AllowTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowtrustedsiteszonetemplate) -- [InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowslockeddowntrustedsiteszonetemplate) -- [InternetExplorer/AllowsRestrictedSitesZoneTemplate](./policy-csp-internetexplorer.md#internetexplorer-allowsrestrictedsiteszonetemplate) -- [InternetExplorer/CheckServerCertificateRevocation](./policy-csp-internetexplorer.md#internetexplorer-checkservercertificaterevocation) -- [InternetExplorer/CheckSignaturesOnDownloadedPrograms](./policy-csp-internetexplorer.md#internetexplorer-checksignaturesondownloadedprograms) -- [InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-consistentmimehandlinginternetexplorerprocesses) -- [InternetExplorer/DisableAdobeFlash](./policy-csp-internetexplorer.md#internetexplorer-disableadobeflash) -- [InternetExplorer/DisableBypassOfSmartScreenWarnings](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarnings) -- [InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles](./policy-csp-internetexplorer.md#internetexplorer-disablebypassofsmartscreenwarningsaboutuncommonfiles) -- [InternetExplorer/DisableConfiguringHistory](./policy-csp-internetexplorer.md#internetexplorer-disableconfiguringhistory) -- [InternetExplorer/DisableCrashDetection](./policy-csp-internetexplorer.md#internetexplorer-disablecrashdetection) -- [InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation](./policy-csp-internetexplorer.md#internetexplorer-disablecustomerexperienceimprovementprogramparticipation) -- [InternetExplorer/DisableDeletingUserVisitedWebsites](./policy-csp-internetexplorer.md#internetexplorer-disabledeletinguservisitedwebsites) -- [InternetExplorer/DisableEnclosureDownloading](./policy-csp-internetexplorer.md#internetexplorer-disableenclosuredownloading) -- [InternetExplorer/DisableEncryptionSupport](./policy-csp-internetexplorer.md#internetexplorer-disableencryptionsupport) -- [InternetExplorer/DisableFirstRunWizard](./policy-csp-internetexplorer.md#internetexplorer-disablefirstrunwizard) -- [InternetExplorer/DisableFlipAheadFeature](./policy-csp-internetexplorer.md#internetexplorer-disableflipaheadfeature) -- [InternetExplorer/DisableHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablehomepagechange) -- [InternetExplorer/DisableIgnoringCertificateErrors](./policy-csp-internetexplorer.md#internetexplorer-disableignoringcertificateerrors) -- [InternetExplorer/DisableInPrivateBrowsing](./policy-csp-internetexplorer.md#internetexplorer-disableinprivatebrowsing) -- [InternetExplorer/DisableProcessesInEnhancedProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-disableprocessesinenhancedprotectedmode) -- [InternetExplorer/DisableProxyChange](./policy-csp-internetexplorer.md#internetexplorer-disableproxychange) -- [InternetExplorer/DisableSearchProviderChange](./policy-csp-internetexplorer.md#internetexplorer-disablesearchproviderchange) -- [InternetExplorer/DisableSecondaryHomePageChange](./policy-csp-internetexplorer.md#internetexplorer-disablesecondaryhomepagechange) -- [InternetExplorer/DisableSecuritySettingsCheck](./policy-csp-internetexplorer.md#internetexplorer-disablesecuritysettingscheck) -- [InternetExplorer/DisableUpdateCheck](./policy-csp-internetexplorer.md#internetexplorer-disableupdatecheck) -- [InternetExplorer/DoNotAllowActiveXControlsInProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-donotallowactivexcontrolsinprotectedmode) -- [InternetExplorer/DoNotAllowUsersToAddSites](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstoaddsites) -- [InternetExplorer/DoNotAllowUsersToChangePolicies](./policy-csp-internetexplorer.md#internetexplorer-donotallowuserstochangepolicies) -- [InternetExplorer/DoNotBlockOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrols) -- [InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains](./policy-csp-internetexplorer.md#internetexplorer-donotblockoutdatedactivexcontrolsonspecificdomains) -- [InternetExplorer/IncludeAllLocalSites](./policy-csp-internetexplorer.md#internetexplorer-includealllocalsites) -- [InternetExplorer/IncludeAllNetworkPaths](./policy-csp-internetexplorer.md#internetexplorer-includeallnetworkpaths) -- [InternetExplorer/InternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowaccesstodatasources) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/InternetZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowcopypasteviascript) -- [InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/InternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowfontdownloads) -- [InternetExplorer/InternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowlessprivilegedsites) -- [InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowloadingofxamlfiles) -- [InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/InternetZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptinitiatedwindows) -- [InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/InternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowscriptlets) -- [InternetExplorer/InternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowsmartscreenie) -- [InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowupdatestostatusbarviascript) -- [InternetExplorer/InternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowuserdatapersistence) -- [InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/InternetZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadsignedactivexcontrols) -- [InternetExplorer/InternetZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzonedownloadunsignedactivexcontrols) -- [InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablecrosssitescriptingfilter) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/InternetZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenablemimesniffing) -- [InternetExplorer/InternetZoneEnableProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-internetzoneenableprotectedmode) -- [InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-internetzoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/InternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-internetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/InternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-internetzonejavapermissions) -- [InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-internetzonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/InternetZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-internetzonelogonoptions) -- [InternetExplorer/InternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-internetzonenavigatewindowsandframes) -- [InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-internetzonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-internetzoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/InternetZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-internetzoneusepopupblocker) -- [InternetExplorer/IntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowaccesstodatasources) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/IntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowfontdownloads) -- [InternetExplorer/IntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowlessprivilegedsites) -- [InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/IntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowscriptlets) -- [InternetExplorer/IntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowsmartscreenie) -- [InternetExplorer/IntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneallowuserdatapersistence) -- [InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-intranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/IntranetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-intranetzonejavapermissions) -- [InternetExplorer/IntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-intranetzonenavigatewindowsandframes) -- [InternetExplorer/LocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowaccesstodatasources) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowfontdownloads) -- [InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowscriptlets) -- [InternetExplorer/LocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowsmartscreenie) -- [InternetExplorer/LocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneallowuserdatapersistence) -- [InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-localmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonejavapermissions) -- [InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-localmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownInternetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowfontdownloads) -- [InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownInternetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowscriptlets) -- [InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownInternetZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonejavapermissions) -- [InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowninternetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownIntranetJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetjavapermissions) -- [InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowaccesstodatasources) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowfontdownloads) -- [InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownIntranetZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowscriptlets) -- [InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowsmartscreenie) -- [InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneallowuserdatapersistence) -- [InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownintranetzonenavigatewindowsandframes) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowaccesstodatasources) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowfontdownloads) -- [InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowscriptlets) -- [InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowsmartscreenie) -- [InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneallowuserdatapersistence) -- [InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownLocalMachineZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonejavapermissions) -- [InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownlocalmachinezonenavigatewindowsandframes) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonejavapermissions) -- [InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddownrestrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowfontdownloads) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowscriptlets) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowsmartscreenie) -- [InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonejavapermissions) -- [InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-lockeddowntrustedsiteszonenavigatewindowsandframes) -- [InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mkprotocolsecurityrestrictioninternetexplorerprocesses) -- [InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-mimesniffingsafetyfeatureinternetexplorerprocesses) -- [InternetExplorer/NotificationBarInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-notificationbarinternetexplorerprocesses) -- [InternetExplorer/PreventManagingSmartScreenFilter](./policy-csp-internetexplorer.md#internetexplorer-preventmanagingsmartscreenfilter) -- [InternetExplorer/PreventPerUserInstallationOfActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-preventperuserinstallationofactivexcontrols) -- [InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-protectionfromzoneelevationinternetexplorerprocesses) -- [InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-removerunthistimebuttonforoutdatedactivexcontrols) -- [InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictactivexinstallinternetexplorerprocesses) -- [InternetExplorer/RestrictFileDownloadInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-restrictfiledownloadinternetexplorerprocesses) -- [InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowaccesstodatasources) -- [InternetExplorer/RestrictedSitesZoneAllowActiveScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowactivescripting) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowbinaryandscriptbehaviors) -- [InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowcopypasteviascript) -- [InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowdraganddropcopyandpastefiles) -- [InternetExplorer/RestrictedSitesZoneAllowFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfiledownloads) -- [InternetExplorer/RestrictedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowfontdownloads) -- [InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowloadingofxamlfiles) -- [InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowmetarefresh) -- [InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstouseactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowonlyapproveddomainstousetdcactivexcontrol) -- [InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptinitiatedwindows) -- [InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptingofinternetexplorerwebbrowsercontrols) -- [InternetExplorer/RestrictedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowscriptlets) -- [InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowsmartscreenie) -- [InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowupdatestostatusbarviascript) -- [InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowuserdatapersistence) -- [InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneallowvbscripttorunininternetexplorer) -- [InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonedownloadunsignedactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablecrosssitescriptingfilter) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainsacrosswindows) -- [InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenabledraggingofcontentfromdifferentdomainswithinwindows) -- [InternetExplorer/RestrictedSitesZoneEnableMIMESniffing](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneenablemimesniffing) -- [InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneincludelocalpathwhenuploadingfilestoserver) -- [InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/RestrictedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonejavapermissions) -- [InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelaunchingapplicationsandfilesiniframe) -- [InternetExplorer/RestrictedSitesZoneLogonOptions](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonelogonoptions) -- [InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonenavigatewindowsandframes) -- [InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunactivexcontrolsandplugins) -- [InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonerunnetframeworkreliantcomponentssignedwithauthenticode) -- [InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptactivexcontrolsmarkedsafeforscripting) -- [InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszonescriptingofjavaapplets) -- [InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneshowsecuritywarningforpotentiallyunsafefiles) -- [InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneturnonprotectedmode) -- [InternetExplorer/RestrictedSitesZoneUsePopupBlocker](./policy-csp-internetexplorer.md#internetexplorer-restrictedsiteszoneusepopupblocker) -- [InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses](./policy-csp-internetexplorer.md#internetexplorer-scriptedwindowsecurityrestrictionsinternetexplorerprocesses) -- [InternetExplorer/SearchProviderList](./policy-csp-internetexplorer.md#internetexplorer-searchproviderlist) -- [InternetExplorer/SecurityZonesUseOnlyMachineSettings](./policy-csp-internetexplorer.md#internetexplorer-securityzonesuseonlymachinesettings) -- [InternetExplorer/SpecifyUseOfActiveXInstallerService](./policy-csp-internetexplorer.md#internetexplorer-specifyuseofactivexinstallerservice) -- [InternetExplorer/TrustedSitesZoneAllowAccessToDataSources](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowaccesstodatasources) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforactivexcontrols) -- [InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowautomaticpromptingforfiledownloads) -- [InternetExplorer/TrustedSitesZoneAllowFontDownloads](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowfontdownloads) -- [InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowlessprivilegedsites) -- [InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallownetframeworkreliantcomponents) -- [InternetExplorer/TrustedSitesZoneAllowScriptlets](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowscriptlets) -- [InternetExplorer/TrustedSitesZoneAllowSmartScreenIE](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowsmartscreenie) -- [InternetExplorer/TrustedSitesZoneAllowUserDataPersistence](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneallowuserdatapersistence) -- [InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonedonotrunantimalwareagainstactivexcontrols) -- [InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszoneinitializeandscriptactivexcontrols) -- [InternetExplorer/TrustedSitesZoneJavaPermissions](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonejavapermissions) -- [InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames](./policy-csp-internetexplorer.md#internetexplorer-trustedsiteszonenavigatewindowsandframes) -- [Kerberos/AllowForestSearchOrder](./policy-csp-kerberos.md#kerberos-allowforestsearchorder) -- [Kerberos/KerberosClientSupportsClaimsCompoundArmor](./policy-csp-kerberos.md#kerberos-kerberosclientsupportsclaimscompoundarmor) -- [Kerberos/RequireKerberosArmoring](./policy-csp-kerberos.md#kerberos-requirekerberosarmoring) -- [Kerberos/RequireStrictKDCValidation](./policy-csp-kerberos.md#kerberos-requirestrictkdcvalidation) -- [Kerberos/SetMaximumContextTokenSize](./policy-csp-kerberos.md#kerberos-setmaximumcontexttokensize) -- [LanmanWorkstation/EnableInsecureGuestLogons](./policy-csp-lanmanworkstation.md#lanmanworkstation-enableinsecureguestlogons) -- [Licensing/AllowWindowsEntitlementReactivation](./policy-csp-licensing.md#licensing-allowwindowsentitlementreactivation) -- [Licensing/DisallowKMSClientOnlineAVSValidation](./policy-csp-licensing.md#licensing-disallowkmsclientonlineavsvalidation) -- [LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-blockmicrosoftaccounts) -- [LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-enableadministratoraccountstatus) -- [LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-enableguestaccountstatus) -- [LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-limitlocalaccountuseofblankpasswordstoconsolelogononly) -- [LocalPoliciesSecurityOptions/Accounts_RenameAdministratorAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameadministratoraccount) -- [LocalPoliciesSecurityOptions/Accounts_RenameGuestAccount](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-accounts-renameguestaccount) -- [LocalPoliciesSecurityOptions/Devices_AllowUndockWithoutHavingToLogon](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowundockwithouthavingtologon) -- [LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowedtoformatandejectremovablemedia) -- [LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-preventusersfrominstallingprinterdriverswhenconnectingtosharedprinters) -- [LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) -- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptorsignsecurechanneldataalways) -- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptsecurechanneldatawhenpossible) -- [LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-disablemachineaccountpasswordchanges) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) -- [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotRequireCTRLALTDEL](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotrequirectrlaltdel) -- [LocalPoliciesSecurityOptions/InteractiveLogon_MachineInactivityLimit](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-machineinactivitylimit) -- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetextforusersattemptingtologon) -- [LocalPoliciesSecurityOptions/InteractiveLogon_MessageTitleForUsersAttemptingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-messagetitleforusersattemptingtologon) -- [LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-smartcardremovalbehavior) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsalways) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-digitallysigncommunicationsifserveragrees) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkclient-sendunencryptedpasswordtothirdpartysmbservers) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-amountofidletimerequiredbeforesuspendingsession) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsalways) -- [LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsIfClientAgrees](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-microsoftnetworkserver-digitallysigncommunicationsifclientagrees) -- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSAMAccounts](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccounts) -- [LocalPoliciesSecurityOptions/NetworkAccess_DoNotAllowAnonymousEnumerationOfSamAccountsAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-donotallowanonymousenumerationofsamaccountsandshares) -- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictanonymousaccesstonamedpipesandshares) -- [LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networkaccess-restrictclientsallowedtomakeremotecallstosam) -- [LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowlocalsystemtousecomputeridentityforntlm) -- [LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-allowpku2uauthenticationrequests) -- [LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-donotstorelanmanagerhashvalueonnextpasswordchange) -- [LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-lanmanagerauthenticationlevel) -- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedclients) -- [LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-minimumsessionsecurityforntlmsspbasedservers) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AddRemoteServerExceptionsForNTLMAuthentication](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-addremoteserverexceptionsforntlmauthentication) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_AuditIncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-auditincomingntlmtraffic) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_IncomingNTLMTraffic](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-incomingntlmtraffic) -- [LocalPoliciesSecurityOptions/NetworkSecurity_RestrictNTLM_OutgoingNTLMTrafficToRemoteServers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-networksecurity-restrictntlm-outgoingntlmtraffictoremoteservers) -- [LocalPoliciesSecurityOptions/Shutdown_AllowSystemToBeShutDownWithoutHavingToLogOn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-allowsystemtobeshutdownwithouthavingtologon) -- [LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-shutdown-clearvirtualmemorypagefile) -- [LocalPoliciesSecurityOptions/UserAccountControl_AllowUIAccessApplicationsToPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-allowuiaccessapplicationstopromptforelevation) -- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForAdministrators](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforadministrators) -- [LocalPoliciesSecurityOptions/UserAccountControl_BehaviorOfTheElevationPromptForStandardUsers](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-behavioroftheelevationpromptforstandardusers) -- [LocalPoliciesSecurityOptions/UserAccountControl_DetectApplicationInstallationsAndPromptForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-detectapplicationinstallationsandpromptforelevation) -- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateExecutableFilesThatAreSignedAndValidated](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateexecutablefilesthataresignedandvalidated) -- [LocalPoliciesSecurityOptions/UserAccountControl_OnlyElevateUIAccessApplicationsThatAreInstalledInSecureLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-onlyelevateuiaccessapplicationsthatareinstalledinsecurelocations) -- [LocalPoliciesSecurityOptions/UserAccountControl_RunAllAdministratorsInAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-runalladministratorsinadminapprovalmode) -- [LocalPoliciesSecurityOptions/UserAccountControl_SwitchToTheSecureDesktopWhenPromptingForElevation](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-switchtothesecuredesktopwhenpromptingforelevation) -- [LocalPoliciesSecurityOptions/UserAccountControl_UseAdminApprovalMode](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-useadminapprovalmode) -- [LocalPoliciesSecurityOptions/UserAccountControl_VirtualizeFileAndRegistryWriteFailuresToPerUserLocations](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-useraccountcontrol-virtualizefileandregistrywritefailurestoperuserlocations) -- [LockDown/AllowEdgeSwipe](./policy-csp-lockdown.md#lockdown-allowedgeswipe) -- [MSSLegacy/AllowICMPRedirectsToOverrideOSPFGeneratedRoutes](./policy-csp-msslegacy.md#msslegacy-allowicmpredirectstooverrideospfgeneratedroutes) -- [MSSLegacy/AllowTheComputerToIgnoreNetBIOSNameReleaseRequestsExceptFromWINSServers](./policy-csp-msslegacy.md#msslegacy-allowthecomputertoignorenetbiosnamereleaserequestsexceptfromwinsservers) -- [MSSLegacy/IPSourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipsourceroutingprotectionlevel) -- [MSSLegacy/IPv6SourceRoutingProtectionLevel](./policy-csp-msslegacy.md#msslegacy-ipv6sourceroutingprotectionlevel) -- [MSSecurityGuide/ApplyUACRestrictionsToLocalAccountsOnNetworkLogon](./policy-csp-mssecurityguide.md#mssecurityguide-applyuacrestrictionstolocalaccountsonnetworklogon) -- [MSSecurityGuide/ConfigureSMBV1ClientDriver](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1clientdriver) -- [MSSecurityGuide/ConfigureSMBV1Server](./policy-csp-mssecurityguide.md#mssecurityguide-configuresmbv1server) -- [MSSecurityGuide/EnableStructuredExceptionHandlingOverwriteProtection](./policy-csp-mssecurityguide.md#mssecurityguide-enablestructuredexceptionhandlingoverwriteprotection) -- [MSSecurityGuide/TurnOnWindowsDefenderProtectionAgainstPotentiallyUnwantedApplications](./policy-csp-mssecurityguide.md#mssecurityguide-turnonwindowsdefenderprotectionagainstpotentiallyunwantedapplications) -- [MSSecurityGuide/WDigestAuthentication](./policy-csp-mssecurityguide.md#mssecurityguide-wdigestauthentication) -- [Maps/EnableOfflineMapsAutoUpdate](./policy-csp-maps.md#maps-enableofflinemapsautoupdate) -- [Messaging/AllowMessageSync](./policy-csp-messaging.md#messaging-allowmessagesync) -- [NetworkIsolation/EnterpriseCloudResources](./policy-csp-networkisolation.md#networkisolation-enterprisecloudresources) -- [NetworkIsolation/EnterpriseIPRange](./policy-csp-networkisolation.md#networkisolation-enterpriseiprange) -- [NetworkIsolation/EnterpriseIPRangesAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseiprangesareauthoritative) -- [NetworkIsolation/EnterpriseInternalProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseinternalproxyservers) -- [NetworkIsolation/EnterpriseProxyServers](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyservers) -- [NetworkIsolation/EnterpriseProxyServersAreAuthoritative](./policy-csp-networkisolation.md#networkisolation-enterpriseproxyserversareauthoritative) -- [NetworkIsolation/NeutralResources](./policy-csp-networkisolation.md#networkisolation-neutralresources) -- [Notifications/DisallowCloudNotification](./policy-csp-notifications.md#notifications-disallowcloudnotification) -- [Notifications/DisallowNotificationMirroring](./policy-csp-notifications.md#notifications-disallownotificationmirroring) -- [Notifications/DisallowTileNotification](./policy-csp-notifications.md#notifications-disallowtilenotification) -- [Power/AllowStandbyStatesWhenSleepingOnBattery](./policy-csp-power.md#power-allowstandbystateswhensleepingonbattery) -- [Power/AllowStandbyWhenSleepingPluggedIn](./policy-csp-power.md#power-allowstandbywhensleepingpluggedin) -- [Power/DisplayOffTimeoutOnBattery](./policy-csp-power.md#power-displayofftimeoutonbattery) -- [Power/DisplayOffTimeoutPluggedIn](./policy-csp-power.md#power-displayofftimeoutpluggedin) -- [Power/HibernateTimeoutOnBattery](./policy-csp-power.md#power-hibernatetimeoutonbattery) -- [Power/HibernateTimeoutPluggedIn](./policy-csp-power.md#power-hibernatetimeoutpluggedin) -- [Power/RequirePasswordWhenComputerWakesOnBattery](./policy-csp-power.md#power-requirepasswordwhencomputerwakesonbattery) -- [Power/RequirePasswordWhenComputerWakesPluggedIn](./policy-csp-power.md#power-requirepasswordwhencomputerwakespluggedin) -- [Power/StandbyTimeoutOnBattery](./policy-csp-power.md#power-standbytimeoutonbattery) -- [Power/StandbyTimeoutPluggedIn](./policy-csp-power.md#power-standbytimeoutpluggedin) -- [Printers/PointAndPrintRestrictions](./policy-csp-printers.md#printers-pointandprintrestrictions) -- [Printers/PointAndPrintRestrictions_User](./policy-csp-printers.md#printers-pointandprintrestrictions-user) -- [Printers/PublishPrinters](./policy-csp-printers.md#printers-publishprinters) -- [Privacy/AllowCrossDeviceClipboard](./policy-csp-privacy.md#privacy-allowcrossdeviceclipboard) -- [Privacy/AllowInputPersonalization](./policy-csp-privacy.md#privacy-allowinputpersonalization) -- [Privacy/DisableAdvertisingId](./policy-csp-privacy.md#privacy-disableadvertisingid) -- [Privacy/DisablePrivacyExperience](./policy-csp-privacy.md#privacy-disableprivacyexperience) -- [Privacy/EnableActivityFeed](./policy-csp-privacy.md#privacy-enableactivityfeed) -- [Privacy/LetAppsAccessAccountInfo](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo) -- [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) -- [Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forcedenytheseapps) -- [Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-userincontroloftheseapps) -- [Privacy/LetAppsAccessCalendar](./policy-csp-privacy.md#privacy-letappsaccesscalendar) -- [Privacy/LetAppsAccessCalendar_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forceallowtheseapps) -- [Privacy/LetAppsAccessCalendar_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-forcedenytheseapps) -- [Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscalendar-userincontroloftheseapps) -- [Privacy/LetAppsAccessCallHistory](./policy-csp-privacy.md#privacy-letappsaccesscallhistory) -- [Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forceallowtheseapps) -- [Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-forcedenytheseapps) -- [Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscallhistory-userincontroloftheseapps) -- [Privacy/LetAppsAccessCamera](./policy-csp-privacy.md#privacy-letappsaccesscamera) -- [Privacy/LetAppsAccessCamera_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forceallowtheseapps) -- [Privacy/LetAppsAccessCamera_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-forcedenytheseapps) -- [Privacy/LetAppsAccessCamera_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscamera-userincontroloftheseapps) -- [Privacy/LetAppsAccessContacts](./policy-csp-privacy.md#privacy-letappsaccesscontacts) -- [Privacy/LetAppsAccessContacts_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forceallowtheseapps) -- [Privacy/LetAppsAccessContacts_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-forcedenytheseapps) -- [Privacy/LetAppsAccessContacts_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesscontacts-userincontroloftheseapps) -- [Privacy/LetAppsAccessEmail](./policy-csp-privacy.md#privacy-letappsaccessemail) -- [Privacy/LetAppsAccessEmail_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forceallowtheseapps) -- [Privacy/LetAppsAccessEmail_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-forcedenytheseapps) -- [Privacy/LetAppsAccessEmail_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessemail-userincontroloftheseapps) -- [Privacy/LetAppsAccessLocation](./policy-csp-privacy.md#privacy-letappsaccesslocation) -- [Privacy/LetAppsAccessLocation_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forceallowtheseapps) -- [Privacy/LetAppsAccessLocation_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-forcedenytheseapps) -- [Privacy/LetAppsAccessLocation_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesslocation-userincontroloftheseapps) -- [Privacy/LetAppsAccessMessaging](./policy-csp-privacy.md#privacy-letappsaccessmessaging) -- [Privacy/LetAppsAccessMessaging_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forceallowtheseapps) -- [Privacy/LetAppsAccessMessaging_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-forcedenytheseapps) -- [Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmessaging-userincontroloftheseapps) -- [Privacy/LetAppsAccessMicrophone](./policy-csp-privacy.md#privacy-letappsaccessmicrophone) -- [Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forceallowtheseapps) -- [Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-forcedenytheseapps) -- [Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmicrophone-userincontroloftheseapps) -- [Privacy/LetAppsAccessMotion](./policy-csp-privacy.md#privacy-letappsaccessmotion) -- [Privacy/LetAppsAccessMotion_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forceallowtheseapps) -- [Privacy/LetAppsAccessMotion_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-forcedenytheseapps) -- [Privacy/LetAppsAccessMotion_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessmotion-userincontroloftheseapps) -- [Privacy/LetAppsAccessNotifications](./policy-csp-privacy.md#privacy-letappsaccessnotifications) -- [Privacy/LetAppsAccessNotifications_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forceallowtheseapps) -- [Privacy/LetAppsAccessNotifications_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-forcedenytheseapps) -- [Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessnotifications-userincontroloftheseapps) -- [Privacy/LetAppsAccessPhone](./policy-csp-privacy.md#privacy-letappsaccessphone) -- [Privacy/LetAppsAccessPhone_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forceallowtheseapps) -- [Privacy/LetAppsAccessPhone_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-forcedenytheseapps) -- [Privacy/LetAppsAccessPhone_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessphone-userincontroloftheseapps) -- [Privacy/LetAppsAccessRadios](./policy-csp-privacy.md#privacy-letappsaccessradios) -- [Privacy/LetAppsAccessRadios_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forceallowtheseapps) -- [Privacy/LetAppsAccessRadios_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-forcedenytheseapps) -- [Privacy/LetAppsAccessRadios_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccessradios-userincontroloftheseapps) -- [Privacy/LetAppsAccessTasks](./policy-csp-privacy.md#privacy-letappsaccesstasks) -- [Privacy/LetAppsAccessTasks_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forceallowtheseapps) -- [Privacy/LetAppsAccessTasks_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-forcedenytheseapps) -- [Privacy/LetAppsAccessTasks_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstasks-userincontroloftheseapps) -- [Privacy/LetAppsAccessTrustedDevices](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices) -- [Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forceallowtheseapps) -- [Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-forcedenytheseapps) -- [Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsaccesstrusteddevices-userincontroloftheseapps) -- [Privacy/LetAppsGetDiagnosticInfo](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo) -- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) -- [Privacy/LetAppsRunInBackground](./policy-csp-privacy.md#privacy-letappsruninbackground) -- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forceallowtheseapps) -- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-forcedenytheseapps) -- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappsruninbackground-userincontroloftheseapps) -- [Privacy/LetAppsSyncWithDevices](./policy-csp-privacy.md#privacy-letappssyncwithdevices) -- [Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forceallowtheseapps) -- [Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-forcedenytheseapps) -- [Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps](./policy-csp-privacy.md#privacy-letappssyncwithdevices-userincontroloftheseapps) -- [Privacy/PublishUserActivities](./policy-csp-privacy.md#privacy-publishuseractivities) -- [Privacy/UploadUserActivities](./policy-csp-privacy.md#privacy-uploaduseractivities) -- [RemoteAssistance/CustomizeWarningMessages](./policy-csp-remoteassistance.md#remoteassistance-customizewarningmessages) -- [RemoteAssistance/SessionLogging](./policy-csp-remoteassistance.md#remoteassistance-sessionlogging) -- [RemoteAssistance/SolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-solicitedremoteassistance) -- [RemoteAssistance/UnsolicitedRemoteAssistance](./policy-csp-remoteassistance.md#remoteassistance-unsolicitedremoteassistance) -- [RemoteDesktopServices/AllowUsersToConnectRemotely](./policy-csp-remotedesktopservices.md#remotedesktopservices-allowuserstoconnectremotely) -- [RemoteDesktopServices/ClientConnectionEncryptionLevel](./policy-csp-remotedesktopservices.md#remotedesktopservices-clientconnectionencryptionlevel) -- [RemoteDesktopServices/DoNotAllowDriveRedirection](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowdriveredirection) -- [RemoteDesktopServices/DoNotAllowPasswordSaving](./policy-csp-remotedesktopservices.md#remotedesktopservices-donotallowpasswordsaving) -- [RemoteDesktopServices/PromptForPasswordUponConnection](./policy-csp-remotedesktopservices.md#remotedesktopservices-promptforpassworduponconnection) -- [RemoteDesktopServices/RequireSecureRPCCommunication](./policy-csp-remotedesktopservices.md#remotedesktopservices-requiresecurerpccommunication) -- [RemoteManagement/AllowBasicAuthentication_Client](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-client) -- [RemoteManagement/AllowBasicAuthentication_Service](./policy-csp-remotemanagement.md#remotemanagement-allowbasicauthentication-service) -- [RemoteManagement/AllowCredSSPAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationclient) -- [RemoteManagement/AllowCredSSPAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-allowcredsspauthenticationservice) -- [RemoteManagement/AllowRemoteServerManagement](./policy-csp-remotemanagement.md#remotemanagement-allowremoteservermanagement) -- [RemoteManagement/AllowUnencryptedTraffic_Client](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-client) -- [RemoteManagement/AllowUnencryptedTraffic_Service](./policy-csp-remotemanagement.md#remotemanagement-allowunencryptedtraffic-service) -- [RemoteManagement/DisallowDigestAuthentication](./policy-csp-remotemanagement.md#remotemanagement-disallowdigestauthentication) -- [RemoteManagement/DisallowNegotiateAuthenticationClient](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationclient) -- [RemoteManagement/DisallowNegotiateAuthenticationService](./policy-csp-remotemanagement.md#remotemanagement-disallownegotiateauthenticationservice) -- [RemoteManagement/DisallowStoringOfRunAsCredentials](./policy-csp-remotemanagement.md#remotemanagement-disallowstoringofrunascredentials) -- [RemoteManagement/SpecifyChannelBindingTokenHardeningLevel](./policy-csp-remotemanagement.md#remotemanagement-specifychannelbindingtokenhardeninglevel) -- [RemoteManagement/TrustedHosts](./policy-csp-remotemanagement.md#remotemanagement-trustedhosts) -- [RemoteManagement/TurnOnCompatibilityHTTPListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttplistener) -- [RemoteManagement/TurnOnCompatibilityHTTPSListener](./policy-csp-remotemanagement.md#remotemanagement-turnoncompatibilityhttpslistener) -- [RemoteProcedureCall/RPCEndpointMapperClientAuthentication](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-rpcendpointmapperclientauthentication) -- [RemoteProcedureCall/RestrictUnauthenticatedRPCClients](./policy-csp-remoteprocedurecall.md#remoteprocedurecall-restrictunauthenticatedrpcclients) -- [RemoteShell/AllowRemoteShellAccess](./policy-csp-remoteshell.md#remoteshell-allowremoteshellaccess) -- [RemoteShell/MaxConcurrentUsers](./policy-csp-remoteshell.md#remoteshell-maxconcurrentusers) -- [RemoteShell/SpecifyIdleTimeout](./policy-csp-remoteshell.md#remoteshell-specifyidletimeout) -- [RemoteShell/SpecifyMaxMemory](./policy-csp-remoteshell.md#remoteshell-specifymaxmemory) -- [RemoteShell/SpecifyMaxProcesses](./policy-csp-remoteshell.md#remoteshell-specifymaxprocesses) -- [RemoteShell/SpecifyMaxRemoteShells](./policy-csp-remoteshell.md#remoteshell-specifymaxremoteshells) -- [RemoteShell/SpecifyShellTimeout](./policy-csp-remoteshell.md#remoteshell-specifyshelltimeout) -- [Search/AllowCloudSearch](./policy-csp-search.md#search-allowcloudsearch) -- [Search/AllowCortanaInAAD](./policy-csp-search.md#search-allowcortanainaad) -- [Search/AllowIndexingEncryptedStoresOrItems](./policy-csp-search.md#search-allowindexingencryptedstoresoritems) -- [Search/AllowSearchToUseLocation](./policy-csp-search.md#search-allowsearchtouselocation) -- [Search/AllowUsingDiacritics](./policy-csp-search.md#search-allowusingdiacritics) -- [Search/AlwaysUseAutoLangDetection](./policy-csp-search.md#search-alwaysuseautolangdetection) -- [Search/DisableBackoff](./policy-csp-search.md#search-disablebackoff) -- [Search/DisableRemovableDriveIndexing](./policy-csp-search.md#search-disableremovabledriveindexing) -- [Search/DoNotUseWebResults](./policy-csp-search.md#search-donotusewebresults) -- [Search/PreventIndexingLowDiskSpaceMB](./policy-csp-search.md#search-preventindexinglowdiskspacemb) -- [Search/PreventRemoteQueries](./policy-csp-search.md#search-preventremotequeries) -- [Security/ClearTPMIfNotReady](./policy-csp-security.md#security-cleartpmifnotready) -- [Settings/AllowOnlineTips](./policy-csp-settings.md#settings-allowonlinetips) -- [Settings/ConfigureTaskbarCalendar](./policy-csp-settings.md#settings-configuretaskbarcalendar) -- [Settings/PageVisibilityList](./policy-csp-settings.md#settings-pagevisibilitylist) -- [SmartScreen/EnableAppInstallControl](./policy-csp-smartscreen.md#smartscreen-enableappinstallcontrol) -- [SmartScreen/EnableSmartScreenInShell](./policy-csp-smartscreen.md#smartscreen-enablesmartscreeninshell) -- [SmartScreen/PreventOverrideForFilesInShell](./policy-csp-smartscreen.md#smartscreen-preventoverrideforfilesinshell) -- [Speech/AllowSpeechModelUpdate](./policy-csp-speech.md#speech-allowspeechmodelupdate) -- [Start/DisableContextMenus](./policy-csp-start.md#start-disablecontextmenus) -- [Start/HidePeopleBar](./policy-csp-start.md#start-hidepeoplebar) -- [Start/HideRecentlyAddedApps](./policy-csp-start.md#start-hiderecentlyaddedapps) -- [Start/StartLayout](./policy-csp-start.md#start-startlayout) -- [Storage/AllowDiskHealthModelUpdates](./policy-csp-storage.md#storage-allowdiskhealthmodelupdates) -- [Storage/EnhancedStorageDevices](./policy-csp-storage.md#storage-enhancedstoragedevices) -- [System/AllowBuildPreview](./policy-csp-system.md#system-allowbuildpreview) -- [System/AllowDeviceNameInDiagnosticData](./policy-csp-system.md#system-allowdevicenameindiagnosticdata) -- [System/AllowFontProviders](./policy-csp-system.md#system-allowfontproviders) -- [System/AllowLocation](./policy-csp-system.md#system-allowlocation) -- [System/AllowTelemetry](./policy-csp-system.md#system-allowtelemetry) -- [System/BootStartDriverInitialization](./policy-csp-system.md#system-bootstartdriverinitialization) -- [System/ConfigureMicrosoft365UploadEndpoint](./policy-csp-system.md#system-configuremicrosoft365uploadendpoint) -- [System/ConfigureTelemetryOptInChangeNotification](./policy-csp-system.md#system-configuretelemetryoptinchangenotification) -- [System/ConfigureTelemetryOptInSettingsUx](./policy-csp-system.md#system-configuretelemetryoptinsettingsux) -- [System/DisableDeviceDelete](./policy-csp-system.md#system-disabledevicedelete) -- [System/DisableDiagnosticDataViewer](./policy-csp-system.md#system-disablediagnosticdataviewer) -- [System/DisableEnterpriseAuthProxy](./policy-csp-system.md#system-disableenterpriseauthproxy) -- [System/DisableOneDriveFileSync](./policy-csp-system.md#system-disableonedrivefilesync) -- [System/DisableSystemRestore](./policy-csp-system.md#system-disablesystemrestore) -- [System/LimitEnhancedDiagnosticDataWindowsAnalytics](./policy-csp-system.md#system-limitenhanceddiagnosticdatawindowsanalytics) -- [System/TelemetryProxy](./policy-csp-system.md#system-telemetryproxy) -- [SystemServices/ConfigureHomeGroupListenerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegrouplistenerservicestartupmode) -- [SystemServices/ConfigureHomeGroupProviderServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurehomegroupproviderservicestartupmode) -- [SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxaccessorymanagementservicestartupmode) -- [SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxliveauthmanagerservicestartupmode) -- [SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivegamesaveservicestartupmode) -- [SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode](./policy-csp-systemservices.md#systemservices-configurexboxlivenetworkingservicestartupmode) -- [TextInput/AllowLanguageFeaturesUninstall](./policy-csp-textinput.md#textinput-allowlanguagefeaturesuninstall) -- [TextInput/AllowLinguisticDataCollection](./policy-csp-textinput.md#textinput-allowlinguisticdatacollection) -- [Update/ActiveHoursEnd](./policy-csp-update.md#update-activehoursend) -- [Update/ActiveHoursMaxRange](./policy-csp-update.md#update-activehoursmaxrange) -- [Update/ActiveHoursStart](./policy-csp-update.md#update-activehoursstart) -- [Update/AllowAutoUpdate](./policy-csp-update.md#update-allowautoupdate) -- [Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork](./policy-csp-update.md#update-allowautowindowsupdatedownloadovermeterednetwork) -- [Update/AllowMUUpdateService](./policy-csp-update.md#update-allowmuupdateservice) -- [Update/AllowUpdateService](./policy-csp-update.md#update-allowupdateservice) -- [Update/AutoRestartDeadlinePeriodInDays](./policy-csp-update.md#update-autorestartdeadlineperiodindays) -- [Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates](./policy-csp-update.md#update-autorestartdeadlineperiodindaysforfeatureupdates) -- [Update/AutoRestartNotificationSchedule](./policy-csp-update.md#update-autorestartnotificationschedule) -- [Update/AutoRestartRequiredNotificationDismissal](./policy-csp-update.md#update-autorestartrequirednotificationdismissal) -- [Update/BranchReadinessLevel](./policy-csp-update.md#update-branchreadinesslevel) -- [Update/DeferFeatureUpdatesPeriodInDays](./policy-csp-update.md#update-deferfeatureupdatesperiodindays) -- [Update/DeferQualityUpdatesPeriodInDays](./policy-csp-update.md#update-deferqualityupdatesperiodindays) -- [Update/DeferUpdatePeriod](./policy-csp-update.md#update-deferupdateperiod) -- [Update/DeferUpgradePeriod](./policy-csp-update.md#update-deferupgradeperiod) -- [Update/DetectionFrequency](./policy-csp-update.md#update-detectionfrequency) -- [Update/DisableDualScan](./policy-csp-update.md#update-disabledualscan) -- [Update/EngagedRestartDeadline](./policy-csp-update.md#update-engagedrestartdeadline) -- [Update/EngagedRestartDeadlineForFeatureUpdates](./policy-csp-update.md#update-engagedrestartdeadlineforfeatureupdates) -- [Update/EngagedRestartSnoozeSchedule](./policy-csp-update.md#update-engagedrestartsnoozeschedule) -- [Update/EngagedRestartSnoozeScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestartsnoozescheduleforfeatureupdates) -- [Update/EngagedRestartTransitionSchedule](./policy-csp-update.md#update-engagedrestarttransitionschedule) -- [Update/EngagedRestartTransitionScheduleForFeatureUpdates](./policy-csp-update.md#update-engagedrestarttransitionscheduleforfeatureupdates) -- [Update/ExcludeWUDriversInQualityUpdate](./policy-csp-update.md#update-excludewudriversinqualityupdate) -- [Update/FillEmptyContentUrls](./policy-csp-update.md#update-fillemptycontenturls) -- [Update/ManagePreviewBuilds](./policy-csp-update.md#update-managepreviewbuilds) -- [Update/PauseDeferrals](./policy-csp-update.md#update-pausedeferrals) -- [Update/PauseFeatureUpdates](./policy-csp-update.md#update-pausefeatureupdates) -- [Update/PauseFeatureUpdatesStartTime](./policy-csp-update.md#update-pausefeatureupdatesstarttime) -- [Update/PauseQualityUpdates](./policy-csp-update.md#update-pausequalityupdates) -- [Update/PauseQualityUpdatesStartTime](./policy-csp-update.md#update-pausequalityupdatesstarttime) -- [Update/RequireDeferUpgrade](./policy-csp-update.md#update-requiredeferupgrade) -- [Update/ScheduleImminentRestartWarning](./policy-csp-update.md#update-scheduleimminentrestartwarning) -- [Update/ScheduleRestartWarning](./policy-csp-update.md#update-schedulerestartwarning) -- [Update/ScheduledInstallDay](./policy-csp-update.md#update-scheduledinstallday) -- [Update/ScheduledInstallEveryWeek](./policy-csp-update.md#update-scheduledinstalleveryweek) -- [Update/ScheduledInstallFirstWeek](./policy-csp-update.md#update-scheduledinstallfirstweek) -- [Update/ScheduledInstallFourthWeek](./policy-csp-update.md#update-scheduledinstallfourthweek) -- [Update/ScheduledInstallSecondWeek](./policy-csp-update.md#update-scheduledinstallsecondweek) -- [Update/ScheduledInstallThirdWeek](./policy-csp-update.md#update-scheduledinstallthirdweek) -- [Update/ScheduledInstallTime](./policy-csp-update.md#update-scheduledinstalltime) -- [Update/SetAutoRestartNotificationDisable](./policy-csp-update.md#update-setautorestartnotificationdisable) -- [Update/SetDisablePauseUXAccess](./policy-csp-update.md#update-setdisablepauseuxaccess) -- [Update/SetDisableUXWUAccess](./policy-csp-update.md#update-setdisableuxwuaccess) -- [Update/SetEDURestart](./policy-csp-update.md#update-setedurestart) -- [Update/UpdateNotificationLevel](./policy-csp-update.md#update-updatenotificationlevel) -- [Update/UpdateServiceUrl](./policy-csp-update.md#update-updateserviceurl) -- [Update/UpdateServiceUrlAlternate](./policy-csp-update.md#update-updateserviceurlalternate) -- [UserRights/AccessCredentialManagerAsTrustedCaller](./policy-csp-userrights.md#userrights-accesscredentialmanagerastrustedcaller) -- [UserRights/AccessFromNetwork](./policy-csp-userrights.md#userrights-accessfromnetwork) -- [UserRights/ActAsPartOfTheOperatingSystem](./policy-csp-userrights.md#userrights-actaspartoftheoperatingsystem) -- [UserRights/AllowLocalLogOn](./policy-csp-userrights.md#userrights-allowlocallogon) -- [UserRights/BackupFilesAndDirectories](./policy-csp-userrights.md#userrights-backupfilesanddirectories) -- [UserRights/ChangeSystemTime](./policy-csp-userrights.md#userrights-changesystemtime) -- [UserRights/CreateGlobalObjects](./policy-csp-userrights.md#userrights-createglobalobjects) -- [UserRights/CreatePageFile](./policy-csp-userrights.md#userrights-createpagefile) -- [UserRights/CreatePermanentSharedObjects](./policy-csp-userrights.md#userrights-createpermanentsharedobjects) -- [UserRights/CreateSymbolicLinks](./policy-csp-userrights.md#userrights-createsymboliclinks) -- [UserRights/CreateToken](./policy-csp-userrights.md#userrights-createtoken) -- [UserRights/DebugPrograms](./policy-csp-userrights.md#userrights-debugprograms) -- [UserRights/DenyAccessFromNetwork](./policy-csp-userrights.md#userrights-denyaccessfromnetwork) -- [UserRights/DenyLocalLogOn](./policy-csp-userrights.md#userrights-denylocallogon) -- [UserRights/DenyRemoteDesktopServicesLogOn](./policy-csp-userrights.md#userrights-denyremotedesktopserviceslogon) -- [UserRights/EnableDelegation](./policy-csp-userrights.md#userrights-enabledelegation) -- [UserRights/GenerateSecurityAudits](./policy-csp-userrights.md#userrights-generatesecurityaudits) -- [UserRights/ImpersonateClient](./policy-csp-userrights.md#userrights-impersonateclient) -- [UserRights/IncreaseSchedulingPriority](./policy-csp-userrights.md#userrights-increaseschedulingpriority) -- [UserRights/LoadUnloadDeviceDrivers](./policy-csp-userrights.md#userrights-loadunloaddevicedrivers) -- [UserRights/LockMemory](./policy-csp-userrights.md#userrights-lockmemory) -- [UserRights/ManageAuditingAndSecurityLog](./policy-csp-userrights.md#userrights-manageauditingandsecuritylog) -- [UserRights/ManageVolume](./policy-csp-userrights.md#userrights-managevolume) -- [UserRights/ModifyFirmwareEnvironment](./policy-csp-userrights.md#userrights-modifyfirmwareenvironment) -- [UserRights/ModifyObjectLabel](./policy-csp-userrights.md#userrights-modifyobjectlabel) -- [UserRights/ProfileSingleProcess](./policy-csp-userrights.md#userrights-profilesingleprocess) -- [UserRights/RemoteShutdown](./policy-csp-userrights.md#userrights-remoteshutdown) -- [UserRights/RestoreFilesAndDirectories](./policy-csp-userrights.md#userrights-restorefilesanddirectories) -- [UserRights/TakeOwnership](./policy-csp-userrights.md#userrights-takeownership) -- [Wifi/AllowAutoConnectToWiFiSenseHotspots](./policy-csp-wifi.md#wifi-allowautoconnecttowifisensehotspots) -- [Wifi/AllowInternetSharing](./policy-csp-wifi.md#wifi-allowinternetsharing) -- [WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork](./policy-csp-windowsconnectionmanager.md#windowsconnectionmanager-prohitconnectiontonondomainnetworkswhenconnectedtodomainauthenticatednetwork) -- [WindowsDefenderSecurityCenter/CompanyName](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-companyname) -- [WindowsDefenderSecurityCenter/DisableAccountProtectionUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableaccountprotectionui) -- [WindowsDefenderSecurityCenter/DisableAppBrowserUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableappbrowserui) -- [WindowsDefenderSecurityCenter/DisableClearTpmButton](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablecleartpmbutton) -- [WindowsDefenderSecurityCenter/DisableDeviceSecurityUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabledevicesecurityui) -- [WindowsDefenderSecurityCenter/DisableEnhancedNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disableenhancednotifications) -- [WindowsDefenderSecurityCenter/DisableFamilyUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablefamilyui) -- [WindowsDefenderSecurityCenter/DisableHealthUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablehealthui) -- [WindowsDefenderSecurityCenter/DisableNetworkUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenetworkui) -- [WindowsDefenderSecurityCenter/DisableNotifications](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablenotifications) -- [WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disabletpmfirmwareupdatewarning) -- [WindowsDefenderSecurityCenter/DisableVirusUI](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disablevirusui) -- [WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-disallowexploitprotectionoverride) -- [WindowsDefenderSecurityCenter/Email](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-email) -- [WindowsDefenderSecurityCenter/EnableCustomizedToasts](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enablecustomizedtoasts) -- [WindowsDefenderSecurityCenter/EnableInAppCustomization](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-enableinappcustomization) -- [WindowsDefenderSecurityCenter/HideRansomwareDataRecovery](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hideransomwaredatarecovery) -- [WindowsDefenderSecurityCenter/HideSecureBoot](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidesecureboot) -- [WindowsDefenderSecurityCenter/HideTPMTroubleshooting](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidetpmtroubleshooting) -- [WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-hidewindowssecuritynotificationareacontrol) -- [WindowsDefenderSecurityCenter/Phone](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-phone) -- [WindowsDefenderSecurityCenter/URL](./policy-csp-windowsdefendersecuritycenter.md#windowsdefendersecuritycenter-url) -- [WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowsuggestedappsinwindowsinkworkspace) -- [WindowsInkWorkspace/AllowWindowsInkWorkspace](./policy-csp-windowsinkworkspace.md#windowsinkworkspace-allowwindowsinkworkspace) -- [WindowsLogon/DisableLockScreenAppNotifications](./policy-csp-windowslogon.md#windowslogon-disablelockscreenappnotifications) -- [WindowsLogon/DontDisplayNetworkSelectionUI](./policy-csp-windowslogon.md#windowslogon-dontdisplaynetworkselectionui) -- [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers](./policy-csp-windowslogon.md#windowslogon-enumeratelocalusersondomainjoinedcomputers) -- [WindowsLogon/HideFastUserSwitching](./policy-csp-windowslogon.md#windowslogon-hidefastuserswitching) -- [WindowsLogon/SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart](./policy-csp-windowslogon.md#windowslogon-signinlastinteractiveuserautomaticallyafterasysteminitiatedrestart) -- [WindowsPowerShell/TurnOnPowerShellScriptBlockLogging](./policy-csp-windowspowershell.md#windowspowershell-turnonpowershellscriptblocklogging) -- [WirelessDisplay/AllowProjectionToPC](./policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) -- [WirelessDisplay/RequirePinForPairing](./policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) - - -## Policies supported by Windows Holographic for Business - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) -- [Authentication/PreferredAadTenantDomainName​](#authentication-preferredaadtenantdomainname) -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) -- [Browser/AllowAutofill​](#browser-allowautofill) -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection​](#connectivity-allowusbconnection) -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) -- [Experience/AllowCortana](#experience-allowcortana) -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) -- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) -- [System/AllowLocation](#system-allowlocation) -- [System/AllowTelemetry](#system-allowtelemetry) -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) -- [Update/ScheduledInstallDay​](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](#update-updateserviceurl) -- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) - - -## Policies supported by Windows Holographic - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) -- [Browser/AllowCookies](#browser-allowcookies) -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [Experience/AllowCortana](#experience-allowcortana) -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) -- [Speech/AllowSpeechModelUpdate](#speech-allowspeechmodelupdate) -- [System/AllowTelemetry](#system-allowtelemetry) -- [System/AllowLocation](#system-allowlocation) -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) -- [Update/ScheduledInstallDay](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](#update-updateserviceurl) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Wifi/AllowManualWiFiConfiguration](policy-csp-wifi.md#wifi-allowmanualwificonfiguration) - - - - -## Policies that can be set using Exchange Active Sync (EAS) - -- [Browser/AllowBrowser](#browser-allowbrowser) -- [Camera/AllowCamera](#camera-allowcamera) -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowCellularDataRoaming](#connectivity-allowcellulardataroaming) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordExpiration](#devicelock-devicepasswordexpiration) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) -- [DeviceLock/PreventLockScreenSlideShow](#devicelock-preventlockscreenslideshow) -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) -- [System/AllowStorageCard](#system-allowstoragecard) -- [System/TelemetryProxy](#system-telemetryproxy) -- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](#wifi-allowwifi) - - -## Examples - -Set the minimum password length to 4 characters. - -``` syntax - - - - $CmdID$ - - - ./Vendor/MSFT/Policy/Config/DeviceLock/MinDevicePasswordLength - - - int - - 4 - - - - - -``` - -Do not allow NFC. - -``` syntax - - - - $CmdID$ - - - ./Vendor/MSFT/Policy/Config/Connectivity/AllowNFC - - - int - - 0 - - - - - -``` +## Policies that can be set using Exchange Active Sync (EAS) +- [Policies that can be set using Exchange Active Sync (EAS)](policies-that-can-be-set-using-eas.md) ## Related topics -[Configuration service provider reference](configuration-service-provider-reference.md) \ No newline at end of file +[Configuration service provider reference](configuration-service-provider-reference.md) diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index f91a9e7031..493575d365 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -1,12 +1,15 @@ --- title: Policy CSP - AboveLock description: Policy CSP - AboveLock -ms.author: maricia +ms.author: dansimp +ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - AboveLock @@ -19,9 +22,6 @@ ms.date: 05/14/2018 ## AboveLock policies
                              -
                              - AboveLock/AllowActionCenterNotifications -
                              AboveLock/AllowCortanaAboveLock
                              @@ -33,60 +33,6 @@ ms.date: 05/14/2018
                              - -**AboveLock/AllowActionCenterNotifications** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -Specifies whether to allow Action Center notifications above the device lock screen. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 - Not allowed. -- 1 (default) - Allowed. - - - - -
                              **AboveLock/AllowCortanaAboveLock** @@ -94,26 +40,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -152,26 +106,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -197,12 +159,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index dc3c75da62..e978cc82da 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Accounts description: Policy CSP - Accounts -ms.author: maricia +ms.author: dansimp +ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/30/2018 +author: manikadhiman +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Accounts @@ -28,9 +31,6 @@ ms.date: 07/30/2018
                              Accounts/AllowMicrosoftAccountSignInAssistant
                              -
                              - Accounts/DomainNamesForEmailSync -
                              @@ -42,26 +42,42 @@ ms.date: 07/30/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              Mobilecheck mark
                              Mobile Enterprisecheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -97,26 +113,42 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              Mobilecheck mark
                              Mobile Enterprisecheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -149,26 +181,42 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              Mobilecheck mark2
                              Mobile Enterprisecheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -193,62 +241,16 @@ The following list shows the supported values: -
                              - -**Accounts/DomainNamesForEmailSync** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcheck markcheck markcheck markcheck markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -Specifies a list of the domains that are allowed to sync email on the device. - -The data type is a string. - -The default value is an empty string, which allows all email accounts on the device to sync email. Otherwise, the string should contain a pipe-separated list of domains that are allowed to sync email on the device. For example, "contoso.com|fabrikam.net|woodgrove.gov". - - - -
                              - -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index 64bdd52d8f..98588acfa2 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -1,12 +1,15 @@ --- title: Policy CSP - ActiveXControls description: Policy CSP - ActiveXControls -ms.author: maricia +ms.author: dansimp +ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - ActiveXControls @@ -33,26 +36,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -74,9 +85,9 @@ Note: Wild card characters cannot be used when specifying the host URLs. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -90,12 +101,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index 3961d870d8..76ac87c616 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -1,17 +1,21 @@ --- title: Policy CSP - ApplicationDefaults description: Policy CSP - ApplicationDefaults -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 04/16/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - ApplicationDefaults +
                              @@ -35,26 +39,34 @@ ms.date: 04/16/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -90,7 +102,7 @@ To create the SyncML, follow these steps: Here is an example output from the dism default association export command: -``` syntax +```xml @@ -109,7 +121,7 @@ PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4NCjxEZWZhdWx0QXNzb2NpYXRpb25z Here is the SyncMl example: -``` syntax +```xml @@ -143,26 +155,34 @@ Here is the SyncMl example: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4Homecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -197,12 +217,14 @@ This setting supports a range of values between 0 and 1.
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index c936dbc5db..a7680a8600 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -1,18 +1,21 @@ --- title: Policy CSP - ApplicationManagement description: Policy CSP - ApplicationManagement -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/08/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - ApplicationManagement > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
                              @@ -36,12 +39,6 @@ ms.date: 08/08/2018
                              ApplicationManagement/AllowSharedUserAppData
                              -
                              - ApplicationManagement/AllowStore -
                              -
                              - ApplicationManagement/ApplicationRestrictions -
                              ApplicationManagement/DisableStoreOriginatedApps
                              @@ -77,26 +74,34 @@ ms.date: 08/08/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -138,26 +143,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -199,26 +212,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -260,26 +281,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -323,26 +352,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -377,149 +414,40 @@ Most restricted value: 0
                              - -**ApplicationManagement/AllowStore** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -Specifies whether app store is allowed at the device. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
                              - - -**ApplicationManagement/ApplicationRestrictions** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. For desktop devices, use the [AppLocker CSP](applocker-csp.md) instead. - -  -An XML blob that specifies the application restrictions company want to put to the device. It could be an app allow list, app disallow list, allowed publisher IDs, and so on. For a list of Windows apps and product IDs, see [inbox apps](applocker-csp.md#inboxappsandcomponents). For more information about the XML, see the [ApplicationRestrictions XSD](applicationrestrictions-xsd.md). - -> [!NOTE] -> When you upgrade Windows Phone 8.1 devices to Windows 10 Mobile with a list of allowed apps, some Windows inbox apps get blocked causing unexpected behavior. To work around this issue, you must include the [inbox apps](applocker-csp.md#inboxappsandcomponents) that you need to your list of allowed apps. -> -> Here's additional guidance for the upgrade process: -> -> - Use Windows 10 product IDs for the apps listed in [inbox apps](applocker-csp.md#inboxappsandcomponents). -> - Use the new Microsoft publisher name (PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US") and Publisher="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" if you are using the publisher policy. Do not remove the Windows Phone 8.1 publisher if you are using it. -> - In the SyncML, you must use lowercase product ID. -> - Do not duplicate a product ID. Messaging and Skype Video use the same product ID. Duplicates cause an error. -> - You cannot disable or enable **Contact Support** and **Windows Feedback** apps using ApplicationManagement/ApplicationRestrictions policy, although these are listed in the [inbox apps](applocker-csp.md#inboxappsandcomponents). - - -An application that is running may not be immediately terminated. - -Value type is chr. - -Value evaluation rule - The information for PolicyManager is opaque. There is no most restricted value evaluation. Whenever there is a change to the value, the device parses the node value and enforces specified policies. - - - - -
                              - **ApplicationManagement/DisableStoreOriginatedApps** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark1check mark1cross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -535,7 +463,7 @@ Added in Windows 10, version 1607. Boolean value that disables the launch of al ADMX Info: -- GP English name: *Disable all apps from Microsoft Store * +- GP English name: *Disable all apps from Microsoft Store* - GP name: *DisableStoreApps* - GP path: *Windows Components/Store* - GP ADMX file name: *WindowsStore.admx* @@ -558,26 +486,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -592,13 +528,13 @@ List of semi-colon delimited Package Family Names of Windows apps. Listed Window For this policy to work, the Windows apps need to declare in their manifest that they will use the start up task. Example of the declaration here: -``` syntax +```xml ``` -> [!Note] +> [!NOTE] > This policy only works on modern apps. @@ -621,26 +557,34 @@ For this policy to work, the Windows apps need to declare in their manifest that - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4cross markcheck mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscross mark
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -684,26 +628,34 @@ This setting supports a range of values between 0 and 1. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4cross markcheck mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscross mark
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -748,26 +700,34 @@ This setting supports a range of values between 0 and 1. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcheck markcheck markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -810,26 +770,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -870,26 +838,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -930,26 +906,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark5check mark5Homecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -970,7 +954,7 @@ Value type is string. Sample SyncML: -``` syntax +```xml @@ -997,7 +981,7 @@ Sample SyncML: ``` XSD: -``` syntax +```xml @@ -1040,14 +1024,14 @@ XSD:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md index 5bddec2b4c..7c7efc8c73 100644 --- a/windows/client-management/mdm/policy-csp-appruntime.md +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -1,17 +1,21 @@ --- title: Policy CSP - AppRuntime description: Policy CSP - AppRuntime -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 04/16/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - AppRuntime +
                              @@ -32,26 +36,34 @@ ms.date: 04/16/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -71,9 +83,9 @@ If you disable or do not configure this policy setting, users will need to sign > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -87,12 +99,5 @@ ADMX Info:
                              -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. - diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index d3d1e3c5a4..adce29e627 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -1,12 +1,15 @@ --- title: Policy CSP - AppVirtualization description: Policy CSP - AppVirtualization -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/08/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - AppVirtualization @@ -114,26 +117,34 @@ ms.date: 08/08/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -149,9 +160,9 @@ This policy setting allows you to enable or disable Microsoft Application Virtua > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -172,26 +183,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -207,9 +226,9 @@ Enables Dynamic Virtualization of supported shell extensions, browser helper obj > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -230,26 +249,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -265,9 +292,9 @@ Enables automatic cleanup of appv packages that were added after Windows10 anniv > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -288,26 +315,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -323,9 +358,9 @@ Enables scripts defined in the package manifest of configuration files that shou > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -346,26 +381,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -381,9 +424,9 @@ Enables a UX to display to the user when a publishing refresh is performed on th > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -404,26 +447,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -449,9 +500,9 @@ Data Block Size: This value specifies the maximum size in bytes to transmit to t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -472,26 +523,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -507,9 +566,9 @@ Specifies the file paths relative to %userprofile% that do not roam with a user' > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -530,26 +589,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -565,9 +632,9 @@ Specifies the registry paths that do not roam with a user profile. Example usage > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -588,26 +655,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -623,9 +698,9 @@ Specifies how new packages should be loaded automatically by App-V on a specific > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -646,26 +721,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -681,9 +764,9 @@ Migration mode allows the App-V client to modify shortcuts and FTA's for package > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -704,26 +787,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -739,9 +830,9 @@ Specifies the location where symbolic links are created to the current version o > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -762,26 +853,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -797,9 +896,9 @@ Specifies the location where symbolic links are created to the current version o > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -820,26 +919,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -873,9 +980,9 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -896,26 +1003,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -949,9 +1064,9 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -972,26 +1087,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1025,9 +1148,9 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1048,26 +1171,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1101,9 +1232,9 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1124,26 +1255,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1177,9 +1316,9 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1200,26 +1339,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1235,9 +1382,9 @@ Specifies the path to a valid certificate in the certificate store. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1258,26 +1405,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1293,9 +1448,9 @@ This setting controls whether virtualized applications are launched on Windows 8 > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1316,26 +1471,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1351,9 +1514,9 @@ Specifies the CLSID for a compatible implementation of the IAppvPackageLocationP > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1374,26 +1537,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1409,9 +1580,9 @@ Specifies directory where all new applications and updates will be installed. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1432,26 +1603,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1467,9 +1646,9 @@ Overrides source location for downloading package content. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1490,26 +1669,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1525,9 +1712,9 @@ Specifies the number of seconds between attempts to reestablish a dropped sessio > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1548,26 +1735,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1583,9 +1778,9 @@ Specifies the number of times to retry a dropped session. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1606,26 +1801,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1641,9 +1844,9 @@ Specifies that streamed package contents will be not be saved to the local hard > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1664,26 +1867,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1699,9 +1910,9 @@ If enabled, the App-V client will support BrancheCache compatible HTTP streaming > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1722,26 +1933,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1757,9 +1976,9 @@ Verifies Server certificate revocation status before streaming using HTTPS. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1780,26 +1999,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1810,14 +2037,14 @@ ADMX Info: -Specifies a list of process paths (may contain wildcards) which are candidates for using virtual components (shell extensions, browser helper objects, etc). Only processes whose full path matches one of these items can use virtual components. +Specifies a list of process paths (may contain wildcards) which are candidates for using virtual components (shell extensions, browser helper objects, etc.). Only processes whose full path matches one of these items can use virtual components. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1831,12 +2058,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index 65d3b9a405..b09a07d3b2 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -1,12 +1,15 @@ --- title: Policy CSP - AttachmentManager description: Policy CSP - AttachmentManager -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - AttachmentManager @@ -39,26 +42,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -80,9 +91,9 @@ If you do not configure this policy setting, Windows marks file attachments with > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -103,26 +114,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -144,9 +163,9 @@ If you do not configure this policy setting, Windows hides the check box and Unb > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -167,26 +186,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -208,9 +235,9 @@ If you do not configure this policy setting, Windows does not call the registere > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -224,12 +251,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md new file mode 100644 index 0000000000..96103d4ca7 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -0,0 +1,4809 @@ +--- +title: Policy CSP - Audit +description: Policy CSP - Audit +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +--- + +# Policy CSP - Audit + +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + + +
                              + + +## Audit policies + +
                              +
                              + Audit/AccountLogonLogoff_AuditAccountLockout +
                              +
                              + Audit/AccountLogonLogoff_AuditGroupMembership +
                              +
                              + Audit/AccountLogonLogoff_AuditIPsecExtendedMode +
                              +
                              + Audit/AccountLogonLogoff_AuditIPsecMainMode +
                              +
                              + Audit/AccountLogonLogoff_AuditIPsecQuickMode +
                              +
                              + Audit/AccountLogonLogoff_AuditLogoff +
                              +
                              + Audit/AccountLogonLogoff_AuditLogon +
                              +
                              + Audit/AccountLogonLogoff_AuditNetworkPolicyServer +
                              +
                              + Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents +
                              +
                              + Audit/AccountLogonLogoff_AuditSpecialLogon +
                              +
                              + Audit/AccountLogonLogoff_AuditUserDeviceClaims +
                              +
                              + Audit/AccountLogon_AuditCredentialValidation +
                              +
                              + Audit/AccountLogon_AuditKerberosAuthenticationService +
                              +
                              + Audit/AccountLogon_AuditKerberosServiceTicketOperations +
                              +
                              + Audit/AccountLogon_AuditOtherAccountLogonEvents +
                              +
                              + Audit/AccountManagement_AuditApplicationGroupManagement +
                              +
                              + Audit/AccountManagement_AuditComputerAccountManagement +
                              +
                              + Audit/AccountManagement_AuditDistributionGroupManagement +
                              +
                              + Audit/AccountManagement_AuditOtherAccountManagementEvents +
                              +
                              + Audit/AccountManagement_AuditSecurityGroupManagement +
                              +
                              + Audit/AccountManagement_AuditUserAccountManagement +
                              +
                              + Audit/DSAccess_AuditDetailedDirectoryServiceReplication +
                              +
                              + Audit/DSAccess_AuditDirectoryServiceAccess +
                              +
                              + Audit/DSAccess_AuditDirectoryServiceChanges +
                              +
                              + Audit/DSAccess_AuditDirectoryServiceReplication +
                              +
                              + Audit/DetailedTracking_AuditDPAPIActivity +
                              +
                              + Audit/DetailedTracking_AuditPNPActivity +
                              +
                              + Audit/DetailedTracking_AuditProcessCreation +
                              +
                              + Audit/DetailedTracking_AuditProcessTermination +
                              +
                              + Audit/DetailedTracking_AuditRPCEvents +
                              +
                              + Audit/DetailedTracking_AuditTokenRightAdjusted +
                              +
                              + Audit/ObjectAccess_AuditApplicationGenerated +
                              +
                              + Audit/ObjectAccess_AuditCentralAccessPolicyStaging +
                              +
                              + Audit/ObjectAccess_AuditCertificationServices +
                              +
                              + Audit/ObjectAccess_AuditDetailedFileShare +
                              +
                              + Audit/ObjectAccess_AuditFileShare +
                              +
                              + Audit/ObjectAccess_AuditFileSystem +
                              +
                              + Audit/ObjectAccess_AuditFilteringPlatformConnection +
                              +
                              + Audit/ObjectAccess_AuditFilteringPlatformPacketDrop +
                              +
                              + Audit/ObjectAccess_AuditHandleManipulation +
                              +
                              + Audit/ObjectAccess_AuditKernelObject +
                              +
                              + Audit/ObjectAccess_AuditOtherObjectAccessEvents +
                              +
                              + Audit/ObjectAccess_AuditRegistry +
                              +
                              + Audit/ObjectAccess_AuditRemovableStorage +
                              +
                              + Audit/ObjectAccess_AuditSAM +
                              +
                              + Audit/PolicyChange_AuditAuthenticationPolicyChange +
                              +
                              + Audit/PolicyChange_AuditAuthorizationPolicyChange +
                              +
                              + Audit/PolicyChange_AuditFilteringPlatformPolicyChange +
                              +
                              + Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange +
                              +
                              + Audit/PolicyChange_AuditOtherPolicyChangeEvents +
                              +
                              + Audit/PolicyChange_AuditPolicyChange +
                              +
                              + Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse +
                              +
                              + Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents +
                              +
                              + Audit/PrivilegeUse_AuditSensitivePrivilegeUse +
                              +
                              + Audit/System_AuditIPsecDriver +
                              +
                              + Audit/System_AuditOtherSystemEvents +
                              +
                              + Audit/System_AuditSecurityStateChange +
                              +
                              + Audit/System_AuditSecuritySystemExtension +
                              +
                              + Audit/System_AuditSystemIntegrity +
                              +
                              + + +
                              + + +**Audit/AccountLogonLogoff_AuditAccountLockout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by a failed attempt to log on to an account that is locked out. + +If you configure this policy setting, an audit event is generated when an account cannot log on to a computer because the account is locked out. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +Logon events are essential for understanding user activity and to detect potential attacks. + +Volume: Low. + + + +GP Info: +- GP English name: *Audit Account Lockout* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogonLogoff_AuditGroupMembership** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit the group membership information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the group membership information cannot fit in a single security audit event. + +Volume: Low on a client computer. Medium on a domain controller or a network server. + + +GP Info: +- GP English name: *Audit Group Membership* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogonLogoff_AuditIPsecExtendedMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Extended Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Extended Mode negotiation. + +Volume: High. + + + +GP Info: +- GP English name: *Audit IPsec Extended Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogonLogoff_AuditIPsecMainMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Main Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated during an IPsec Main Mode negotiation. + +Volume: High. + + +GP Info: +- GP English name: *Audit IPsec Main Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogonLogoff_AuditIPsecQuickMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. + +If you configure this policy setting, an audit event is generated during an IPsec Quick Mode negotiation. Success audits record successful attempts and Failure audits record unsuccessful attempts. If you do not configure this policy setting, no audit event is generated during an IPsec Quick Mode negotiation. + +Volume: High. + + +GP Info: +- GP English name: *Audit IPsec Quick Mode* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogonLogoff_AuditLogoff** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to. + +If you configure this policy setting, an audit event is generated when a logon session is closed. Success audits record successful attempts to close sessions and Failure audits record unsuccessful attempts to close sessions. +If you do not configure this policy setting, no audit event is generated when a logon session is closed. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Logoff* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogonLogoff_AuditLogon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by user account logon attempts on the computer. +Events in this subcategory are related to the creation of logon sessions and occur on the computer which was accessed. For an interactive logon, the security audit event is generated on the computer that the user account logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. +The following events are included: +- Successful logon attempts. +- Failed logon attempts. +- Logon attempts using explicit credentials. This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch logon configurations, such as scheduled tasks or when using the RUNAS command. +- Security identifiers (SIDs) were filtered and not allowed to log on. + +Volume: Low on a client computer. Medium on a domain controller or a network server. + + +GP Info: +- GP English name: *Audit Logon* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogonLogoff_AuditNetworkPolicyServer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. +If you configure this policy setting, an audit event is generated for each IAS and NAP user access request. Success audits record successful user access requests and Failure audits record unsuccessful attempts. +If you do not configure this policy settings, IAS and NAP user access requests are not audited. + +Volume: Medium or High on NPS and IAS server. No volume on other computers. + + +GP Info: +- GP English name: *Audit Network Policy Server* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 (default) — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogonLogoff_AuditOtherLogonLogoffEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting, such as the following: +- Terminal Services session disconnections. +- New Terminal Services sessions. +- Locking and unlocking a workstation. +- Invoking a screen saver. +- Dismissal of a screen saver. +- Detection of a Kerberos replay attack, in which a Kerberos request was received twice with identical information. This condition could be caused by network misconfiguration. +- Access to a wireless network granted to a user or computer account. +- Access to a wired 802.1x network granted to a user or computer account. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Logon Logoff Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogonLogoff_AuditSpecialLogon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by special logons, such as the following: +- The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level. +- A logon by a member of a Special Group. Special Groups enable you to audit events generated when a member of a certain group has logged on to your network. You can configure a list of group security identifiers (SIDs) in the registry. If any of those SIDs are added to a token during logon and the subcategory is enabled, an event is logged. For more information about this feature, see [Audit Special Logon](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-special-logon). + +Volume: Low. + + +GP Info: +- GP English name: *Audit Special Logon* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogonLogoff_AuditUserDeviceClaims** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource. + +User claims are added to a logon token when claims are included with a user's account attributes in Active Directory. Device claims are added to the logon token when claims are included with a device's computer account attributes in Active Directory. In addition, compound identity must be enabled for the domain and on the computer where the user logged on. + +When this setting is configured, one or more security audit events are generated for each successful logon. You must also enable the Audit Logon setting under Advanced Audit Policy Configuration\System Audit Policies\Logon/Logoff. Multiple events are generated if the user and device claims information cannot fit in a single security audit event. + +Volume: Low on a client computer. Medium on a domain controller or a network server. + + +GP Info: +- GP English name: *Audit User Device Claims* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogon_AuditCredentialValidation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by validation tests on user account logon credentials. + +Events in this subcategory occur only on the computer that is authoritative for those credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. + +Volume: High on domain controllers. + + +GP Info: +- GP English name: *Audit Credential Validation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogon_AuditKerberosAuthenticationService** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT request. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT request. + +Volume: High on Kerberos Key Distribution Center servers. + + +GP Info: +- GP English name: *Audit Kerberos Authentication Service* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogon_AuditKerberosServiceTicketOperations** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts. + +If you configure this policy setting, an audit event is generated after a Kerberos authentication TGT is requested for a user account. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated after a Kerberos authentication TGT is request for a user account. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Kerberos Service Ticket Operations* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountLogon_AuditOtherAccountLogonEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. + +Currently, there are no events in this subcategory. + + + +GP Info: +- GP English name: *Audit Other Account Logon Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountManagement_AuditApplicationGroupManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to application groups, such as the following: +- Application group is created, changed, or deleted. +- Member is added or removed from an application group. + +If you configure this policy setting, an audit event is generated when an attempt to change an application group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an application group changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Application Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountManagement_AuditComputerAccountManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted. + +If you configure this policy setting, an audit event is generated when an attempt to change a computer account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a computer account changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Computer Account Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountManagement_AuditDistributionGroupManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to distribution groups, such as the following: +- Distribution group is created, changed, or deleted. +- Member is added or removed from a distribution group. +- Distribution group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a distribution group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a distribution group changes. + +> [!Note] +> Events in this subcategory are logged only on domain controllers. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Distribution Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountManagement_AuditOtherAccountManagementEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by other user account changes that are not covered in this category, such as the following: +- The password hash of a user account was accessed. This typically happens during an Active Directory Management Tool password migration. +- The Password Policy Checking API was called. Calls to this function can be part of an attack when a malicious application tests the policy to reduce the number of attempts during a password dictionary attack. +- Changes to the Default Domain Group Policy under the following Group Policy paths: +Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy +Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy. + +> [!Note] +> The security audit event is logged when the policy setting is applied. It does not occur at the time when the settings are modified. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Account Management Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountManagement_AuditSecurityGroupManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to security groups, such as the following: +- Security group is created, changed, or deleted. +- Member is added or removed from a security group. +- Group type is changed. + +If you configure this policy setting, an audit event is generated when an attempt to change a security group is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a security group changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Security Group Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/AccountManagement_AuditUserAccountManagement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit changes to user accounts. +Events include the following: +- A user account is created, changed, deleted; renamed, disabled, enabled, locked out, or unlocked. +- A user account’s password is set or changed. +- A security identifier (SID) is added to the SID History of a user account. +- The Directory Services Restore Mode password is configured. +- Permissions on administrative user accounts are changed. +- Credential Manager credentials are backed up or restored. + +If you configure this policy setting, an audit event is generated when an attempt to change a user account is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a user account changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit User Account Management* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/DSAccess_AuditDetailedDirectoryServiceReplication** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers. + +Volume: High. + + + +GP Info: +- GP English name: *Audit Detailed Directory Service Replication* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/DSAccess_AuditDirectoryServiceAccess** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed. + +Only AD DS objects with a matching system access control list (SACL) are logged. + +Events in this subcategory are similar to the Directory Service Access events available in previous versions of Windows. + +Volume: High on domain controllers. None on client computers. + + +GP Info: +- GP English name: *Audit Directory Service Access* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/DSAccess_AuditDirectoryServiceChanges** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted. + +When possible, events logged in this subcategory indicate the old and new values of the object’s properties. + +Events in this subcategory are logged only on domain controllers, and only objects in AD DS with a matching system access control list (SACL) are logged. + +> [!Note] +> Actions on some objects and properties do not cause audit events to be generated due to settings on the object class in the schema. + +If you configure this policy setting, an audit event is generated when an attempt to change an object in AD DS is made. Success audits record successful attempts, however unsuccessful attempts are NOT recorded. +If you do not configure this policy setting, no audit event is generated when an attempt to change an object in AD DS object is made. + +Volume: High on domain controllers only. + + +GP Info: +- GP English name: *Audit Directory Service Changes* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/DSAccess_AuditDirectoryServiceReplication** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers. + +If you configure this policy setting, an audit event is generated during AD DS replication. Success audits record successful replication and Failure audits record unsuccessful replication. +If you do not configure this policy setting, no audit event is generated during AD DS replication. + +>[!Note] +> Events in this subcategory are logged only on domain controllers. + +Volume: Medium on domain controllers. None on client computers. + + +GP Info: +- GP English name: *Audit Directory Service Replication* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/DetailedTracking_AuditDPAPIActivity** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information. For more information about DPAPI, see https://go.microsoft.com/fwlink/?LinkId=121720. + +If you configure this policy setting, an audit event is generated when an encryption or decryption request is made to DPAPI. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when an encryption or decryption request is made to DPAPI. + +Volume: Low. + + +GP Info: +- GP English name: *Audit DPAPI Activity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/DetailedTracking_AuditPNPActivity** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit when plug and play detects an external device. + +If you configure this policy setting, an audit event is generated whenever plug and play detects an external device. Only Success audits are recorded for this category. +If you do not configure this policy setting, no audit event is generated when an external device is detected by plug and play. + +Volume: Low. + + +GP Info: +- GP English name: *Audit PNP Activity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/DetailedTracking_AuditProcessCreation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited. + +If you configure this policy setting, an audit event is generated when a process is created. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process is created. + +Volume: Depends on how the computer is used. + + +GP Info: +- GP English name: *Audit Process Creation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/DetailedTracking_AuditProcessTermination** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a process ends. + +If you configure this policy setting, an audit event is generated when a process ends. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a process ends. + +Volume: Depends on how the computer is used. + + +GP Info: +- GP English name: *Audit Process Termination* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/DetailedTracking_AuditRPCEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit inbound remote procedure call (RPC) connections. + +If you configure this policy setting, an audit event is generated when a remote RPC connection is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a remote RPC connection is attempted. + +Volume: High on RPC servers. + + +GP Info: +- GP English name: *Audit RPC Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/DetailedTracking_AuditTokenRightAdjusted** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by adjusting the privileges of a token. + +Volume: High. + + +GP Info: +- GP English name: *Audit Token Right Adjusted* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditApplicationGenerated** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function. +Events in this subcategory include: +- Creation of an application client context. +- Deletion of an application client context. +- Initialization of an application client context. +- Other application operations using the Windows Auditing APIs. + +Volume: Depends on the applications that are generating them. + + +GP Info: +- GP English name: *Audit Application Generated* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditCentralAccessPolicyStaging** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit access requests where the permission granted or denied by a proposed policy differs from the current central access policy on an object. + +If you configure this policy setting, an audit event is generated each time a user accesses an object and the permission granted by the current central access policy on the object differs from that granted by the proposed policy. The resulting audit event will be generated as follows: +1. Success audits, when configured, records access attempts when the current central access policy grants access but the proposed policy denies access. +2. Failure audits when configured records access attempts when: + - The current central access policy does not grant access but the proposed policy grants access. + - A principal requests the maximum access rights they are allowed and the access rights granted by the current central access policy are different than the access rights granted by the proposed policy. + +Volume: Potentially high on a file server when the proposed policy differs significantly from the current central access policy. + + + +GP Info: +- GP English name: *Audit Central Access Policy Staging* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditCertificationServices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit Active Directory Certificate Services (AD CS) operations. +AD CS operations include the following: + +- AD CS startup/shutdown/backup/restore. +- Changes to the certificate revocation list (CRL). +- New certificate requests. +- Issuing of a certificate. +- Revocation of a certificate. +- Changes to the Certificate Manager settings for AD CS. +- Changes in the configuration of AD CS. +- Changes to a Certificate Services template. +- Importing of a certificate. +- Publishing of a certification authority certificate is to Active Directory Domain Services. +- Changes to the security permissions for AD CS. +- Archival of a key. +- Importing of a key. +- Retrieval of a key. +- Starting of Online Certificate Status Protocol (OCSP) Responder Service. +- Stopping of Online Certificate Status Protocol (OCSP) Responder Service. + +Volume: Medium or Low on computers running Active Directory Certificate Services. + + +GP Info: +- GP English name: *Audit Certification Services* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditDetailedFileShare** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the permissions or other criteria used to grant or deny access. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a file or folder on a share. The administrator can specify whether to audit only successes, only failures, or both successes and failures. + +> [!Note] +> There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared files and folders on the system is audited. + +Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy. + + +GP Info: +- GP English name: *Audit Detailed File Share* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditFileShare** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access a shared folder. + +If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures. + +> [!Note] +> There are no system access control lists (SACLs) for shared folders. If this policy setting is enabled, access to all shared folders on the system is audited. + +Volume: High on a file server or domain controller because of SYSVOL network access required by Group Policy. + + +GP Info: +- GP English name: *Audit File Share* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditFileSystem** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL. For more information about enabling object access auditing, see [Apply a basic audit policy on a file or folder](https://docs.microsoft.com/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder). + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object with a matching SACL. + +> [!Note] +> You can set a SACL on a file system object using the Security tab in that object's Properties dialog box. + +Volume: Depends on how the file system SACLs are configured. + + +GP Info: +- GP English name: *Audit File System* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditFilteringPlatformConnection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP). +The following events are included: +- The Windows Firewall Service blocks an application from accepting incoming connections on the network. +- The WFP allows a connection. +- The WFP blocks a connection. +- The WFP permits a bind to a local port. +- The WFP blocks a bind to a local port. +- The WFP allows a connection. +- The WFP blocks a connection. +- The WFP permits an application or service to listen on a port for incoming connections. +- The WFP blocks an application or service to listen on a port for incoming connections. + +If you configure this policy setting, an audit event is generated when connections are allowed or blocked by the WFP. Success audits record events generated when connections are allowed and Failure audits record events generated when connections are blocked. + +If you do not configure this policy setting, no audit event is generated when connected are allowed or blocked by the WFP. + +Volume: High. + + +GP Info: +- GP English name: *Audit Filtering Platform Connection* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditFilteringPlatformPacketDrop** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit packets that are dropped by Windows Filtering Platform (WFP). + +Volume: High. + + + +GP Info: +- GP English name: *Audit Filtering Platform Packet Drop* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditHandleManipulation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events. + +If you configure this policy setting, an audit event is generated when a handle is manipulated. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a handle is manipulated. + +> [!Note] +> Events in this subcategory generate events only for object types where the corresponding Object Access subcategory is enabled. For example, if File system object access is enabled, handle manipulation security audit events are generated. If Registry object access is not enabled, handle manipulation security audit events will not be generated. + +Volume: Depends on how SACLs are configured. + + +GP Info: +- GP English name: *Audit Handle Manipulation* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditKernelObject** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access the kernel, which includes mutexes and semaphores. +Only kernel objects with a matching system access control list (SACL) generate security audit events. + +> [!Note] +> The Audit: Audit the access of global system objects policy setting controls the default SACL of kernel objects. + +Volume: High if auditing access of global system objects is enabled. + + +GP Info: +- GP English name: *Audit Kernel Object* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditOtherObjectAccessEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the management of task scheduler jobs or COM+ objects. +For scheduler jobs, the following are audited: +- Job created. +- Job deleted. +- Job enabled. +- Job disabled. +- Job updated. + +For COM+ objects, the following are audited: +- Catalog object added. +- Catalog object updated. +- Catalog object deleted. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Object Access Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditRegistry** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL. + +If you configure this policy setting, an audit event is generated each time an account accesses a registry object with a matching SACL. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an account accesses a registry object with a matching SACL. + +> [!Note] +> You can set a SACL on a registry object using the Permissions dialog box. + +Volume: Depends on how registry SACLs are configured. + + +GP Info: +- GP English name: *Audit Registry* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditRemovableStorage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested. + +If you configure this policy setting, an audit event is generated each time an account accesses a file system object on a removable storage. Success audits record successful attempts and Failure audits record unsuccessful attempts. + +If you do not configure this policy setting, no audit event is generated when an account accesses a file system object on a removable storage. + + + +GP Info: +- GP English name: *Audit Removable Storage* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/ObjectAccess_AuditSAM** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects. +SAM objects include the following: +- SAM_ALIAS -- A local group. +- SAM_GROUP -- A group that is not a local group. +- SAM_USER – A user account. +- SAM_DOMAIN – A domain. +- SAM_SERVER – A computer account. + +If you configure this policy setting, an audit event is generated when an attempt to access a kernel object is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt to access a kernel object is made. + +> [!Note] +> Only the System Access Control List (SACL) for SAM_SERVER can be modified. + +Volume: High on domain controllers. For information about reducing the amount of events generated in this subcategory, see [article 841001 in the Microsoft Knowledge Base](https://go.microsoft.com/fwlink/?LinkId=121698). + + + +GP Info: +- GP English name: *Audit SAM* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/PolicyChange_AuditAuthenticationPolicyChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the authentication policy, such as the following: +- Creation of forest and domain trusts. +- Modification of forest and domain trusts. +- Removal of forest and domain trusts. +- Changes to Kerberos policy under Computer Configuration\Windows Settings\Security Settings\Account Policies\Kerberos Policy. +- Granting of any of the following user rights to a user or group: + - Access This Computer From the Network. + - Allow Logon Locally. + - Allow Logon Through Terminal Services. + - Logon as a Batch Job. + - Logon a Service. +- Namespace collision. For example, when a new trust has the same name as an existing namespace name. + +If you configure this policy setting, an audit event is generated when an attempt to change the authentication policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authentication policy is changed. + +> [!Note] +> The security audit event is logged when the group policy is applied. It does not occur at the time when the settings are modified. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Authentication Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/PolicyChange_AuditAuthorizationPolicyChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the authorization policy, such as the following: +- Assignment of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. +- Removal of user rights (privileges), such as SeCreateTokenPrivilege, that are not audited through the “Authentication Policy Change” subcategory. +- Changes in the Encrypted File System (EFS) policy. +- Changes to the Resource attributes of an object. +- Changes to the Central Access Policy (CAP) applied to an object. + +If you configure this policy setting, an audit event is generated when an attempt to change the authorization policy is made. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when the authorization policy changes. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Authorization Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/PolicyChange_AuditFilteringPlatformPolicyChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes to the Windows Filtering Platform (WFP), such as the following: +- IPsec services status. +- Changes to IPsec policy settings. +- Changes to Windows Firewall policy settings. +- Changes to WFP providers and engine. + +If you configure this policy setting, an audit event is generated when a change to the WFP is attempted. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when a change occurs to the WFP. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Filtering Platform Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/PolicyChange_AuditMPSSVCRuleLevelPolicyChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall. +Events include the following: +- Reporting of active policies when Windows Firewall service starts. +- Changes to Windows Firewall rules. +- Changes to Windows Firewall exception list. +- Changes to Windows Firewall settings. +- Rules ignored or not applied by Windows Firewall Service. +- Changes to Windows Firewall Group Policy settings. + +If you configure this policy setting, an audit event is generated by attempts to change policy rules used by the MPSSVC. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated by changes in policy rules used by the MPSSVC. + +Volume: Low. + + +GP Info: +- GP English name: *Audit MPSSVC Rule Level Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/PolicyChange_AuditOtherPolicyChangeEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by other security policy changes that are not audited in the policy change category, such as the following: +- Trusted Platform Module (TPM) configuration changes. +- Kernel-mode cryptographic self tests. +- Cryptographic provider operations. +- Cryptographic context operations or modifications. +- Applied Central Access Policies (CAPs) changes. +- Boot Configuration Data (BCD) modifications. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other Policy Change Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/PolicyChange_AuditPolicyChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit changes in the security audit policy settings, such as the following: +- Settings permissions and audit settings on the Audit Policy object. +- Changes to the system audit policy. +- Registration of security event sources. +- De-registration of security event sources. +- Changes to the per-user audit settings. +- Changes to the value of CrashOnAuditFail. +- Changes to the system access control list on a file system or registry object. +- Changes to the Special Groups list. + +> [!Note] +> System access control list (SACL) change auditing is done when a SACL for an object changes and the policy change category is enabled. Discretionary access control list (DACL) and ownership changes are audited when object access auditing is enabled and the object's SACL is configured for auditing of DACL/Owner change. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Policy Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/PrivilegeUse_AuditNonSensitivePrivilegeUse** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the use of non-sensitive privileges (user rights). +The following privileges are non-sensitive: +- Access Credential Manager as a trusted caller. +- Access this computer from the network. +- Add workstations to domain. +- Adjust memory quotas for a process. +- Allow log on locally. +- Allow log on through Terminal Services. +- Bypass traverse checking. +- Change the system time. +- Create a pagefile. +- Create global objects. +- Create permanent shared objects. +- Create symbolic links. +- Deny access this computer from the network. +- Deny log on as a batch job. +- Deny log on as a service. +- Deny log on locally. +- Deny log on through Terminal Services. +- Force shutdown from a remote system. +- Increase a process working set. +- Increase scheduling priority. +- Lock pages in memory. +- Log on as a batch job. +- Log on as a service. +- Modify an object label. +- Perform volume maintenance tasks. +- Profile single process. +- Profile system performance. +- Remove computer from docking station. +- Shut down the system. +- Synchronize directory service data. + +If you configure this policy setting, an audit event is generated when a non-sensitive privilege is called. Success audits record successful calls and Failure audits record unsuccessful calls. +If you do not configure this policy setting, no audit event is generated when a non-sensitive privilege is called. + +Volume: Very High. + + +GP Info: +- GP English name: *Audit Non Sensitive Privilege Use* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/PrivilegeUse_AuditOtherPrivilegeUseEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Not used. + + + +GP Info: +- GP English name: *Audit Other Privilege Use Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/PrivilegeUse_AuditSensitivePrivilegeUse** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated when sensitive privileges (user rights) are used, such as the following: +- A privileged service is called. +- One of the following privileges are called: + - Act as part of the operating system. + - Back up files and directories. + - Create a token object. + - Debug programs. + - Enable computer and user accounts to be trusted for delegation. + - Generate security audits. + - Impersonate a client after authentication. + - Load and unload device drivers. + - Manage auditing and security log. + - Modify firmware environment values. + - Replace a process-level token. + - Restore files and directories. + - Take ownership of files or other objects. + +If you configure this policy setting, an audit event is generated when sensitive privilege requests are made. Success audits record successful requests and Failure audits record unsuccessful requests. +If you do not configure this policy setting, no audit event is generated when sensitive privilege requests are made. + +Volume: High. + + +GP Info: +- GP English name: *Audit Sensitive Privilege Use* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + +
                              + + +**Audit/System_AuditIPsecDriver** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by the IPsec filter driver, such as the following: +- Startup and shutdown of the IPsec services. +- Network packets dropped due to integrity check failure. +- Network packets dropped due to replay check failure. +- Network packets dropped due to being in plaintext. +- Network packets received with incorrect Security Parameter Index (SPI). This may indicate that either the network card is not working correctly or the driver needs to be updated. +- Inability to process IPsec filters. + +If you configure this policy setting, an audit event is generated on an IPsec filter driver operation. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated on an IPSec filter driver operation. + +Volume: Low. + + +GP Info: +- GP English name: *Audit IPsec Driver* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/System_AuditOtherSystemEvents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit any of the following events: +- Startup and shutdown of the Windows Firewall service and driver. +- Security policy processing by the Windows Firewall Service. +- Cryptography key file and migration operations. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Other System Events* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 (default) — Success+Failure + + + + + + + + + + +
                              + + +**Audit/System_AuditSecurityStateChange** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events generated by changes in the security state of the computer, such as the following events: +- Startup and shutdown of the computer. +- Change of system time. +- Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured. + +Volume: Low. + + +GP Info: +- GP English name: *Audit Security State Change* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 — Off/None +- 1 (default) — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/System_AuditSecuritySystemExtension** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events related to security system extensions or services, such as the following: +- A security system extension, such as an authentication, notification, or security package is loaded and is registered with the Local Security Authority (LSA). It is used to authenticate logon attempts, submit logon requests, and any account or password changes. Examples of security system extensions are Kerberos and NTLM. +- A service is installed and registered with the Service Control Manager. The audit log contains information about the service name, binary, type, start type, and service account. + +If you configure this policy setting, an audit event is generated when an attempt is made to load a security system extension. Success audits record successful attempts and Failure audits record unsuccessful attempts. +If you do not configure this policy setting, no audit event is generated when an attempt is made to load a security system extension. + +Volume: Low. Security system extension events are generated more often on a domain controller than on client computers or member servers. + + +GP Info: +- GP English name: *Audit Security System Extension* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 (default) — Off/None +- 1 — Success +- 2 — Failure +- 3 — Success+Failure + + + + + + + + + + +
                              + + +**Audit/System_AuditSystemIntegrity** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, versions 1809 and 1803 through servicing. This policy setting allows you to audit events that violate the integrity of the security subsystem, such as the following: +- Events that could not be written to the event log because of a problem with the auditing system. +- A process that uses a local procedure call (LPC) port that is not valid in an attempt to impersonate a client by replying, reading, or writing to or from a client address space. +- The detection of a Remote Procedure Call (RPC) that compromises system integrity. +- The detection of a hash value of an executable file that is not valid as determined by Code Integrity. +- Cryptographic operations that compromise system integrity. + +Volume: Low. + + +GP Info: +- GP English name: *Audit System Integrity* +- GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* + + + +The following are the supported values: +- 0 — Off/None +- 1 — Success +- 2 — Failure +- 3 (default) — Success+Failure + + + + + + + + + +
                              + +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. + + + diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index b40a98a737..26a3e3120b 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -1,18 +1,19 @@ --- title: Policy CSP - Authentication description: Policy CSP - Authentication -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/30/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Authentication -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
                              @@ -56,26 +57,34 @@ ms.date: 07/30/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -106,26 +115,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -156,26 +173,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -208,26 +233,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -242,7 +275,7 @@ Preview release in Windows 10, version 1709. Supported in the next release. Spe Value type is integer. -Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password everytime they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs. +Here is an example scenario: At Contoso, there are a lot of shared devices and kiosks that employees throughout the day using as many as 20 different devices. To minimize the loss in productivity when employees have to login with username and password every time they pick up a device, the IT admin deploys SharePC CSP and Authentication/AllowFidoDeviceSignon policy to shared devices. The IT admin provisions and distributes FIDO 2.0 devices to employees, which allows them to authenticate to various shared devices and PCs. @@ -262,26 +295,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -324,26 +365,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -354,12 +403,18 @@ The following list shows the supported values: +> [!Warning] +> This policy is in preview mode only and therefore not meant or recommended for production purposes. + This policy is intended for use on Shared PCs to enable a quick first sign-in experience for a user. It works by automatically connecting new non-admin Azure Active Directory (Azure AD) accounts to the pre-configured candidate local accounts. +> [!Important] +> Pre-configured candidate local accounts are any local accounts (pre-configured or added) in your device. + Value type is integer. Supported values: - 0 - (default) The feature defaults to the existing SKU and device capabilities. -- 1 - Enabled. Auto connect new non-admin AZure AD accounts to pre-configured candidate local accounts +- 1 - Enabled. Auto connect new non-admin Azure AD accounts to pre-configured candidate local accounts - 2 - Disabled. Do not auto connect new non-admin Azure AD accounts to pre-configured local accounts @@ -382,26 +437,34 @@ Value type is integer. Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -412,9 +475,12 @@ Value type is integer. Supported values: +> [!Warning] +> This policy is in preview mode only and therefore not meant or recommended for production purposes. + "Web Sign-in" is a new way of signing into a Windows PC. It enables Windows logon support for non-ADFS federated providers (e.g. SAML). -> [!Note] +> [!Note] > Web Sign-in is only supported on Azure AD Joined PCs. Value type is integer. Supported values: @@ -443,26 +509,34 @@ Value type is integer. Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -493,13 +567,14 @@ Value type is string.
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. + diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index efefb6de1e..38a9ace228 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Autoplay description: Policy CSP - Autoplay -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Autoplay @@ -39,26 +42,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -79,9 +90,9 @@ If you disable or do not configure this policy setting, AutoPlay is enabled for > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -102,26 +113,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -151,9 +170,9 @@ If you disable or not configure this policy setting, Windows Vista or later will > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -174,26 +193,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -224,9 +251,9 @@ Note: This policy setting appears in both the Computer Configuration and User Co > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -240,12 +267,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-bitlocker.md b/windows/client-management/mdm/policy-csp-bitlocker.md index 55976c06ee..3ab3d8246b 100644 --- a/windows/client-management/mdm/policy-csp-bitlocker.md +++ b/windows/client-management/mdm/policy-csp-bitlocker.md @@ -1,18 +1,24 @@ --- title: Policy CSP - Bitlocker description: Policy CSP - Bitlocker -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 06/22/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Bitlocker +> [!NOTE] +> To manage encryption of PCs and devices, use [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). +
                              @@ -33,26 +39,34 @@ ms.date: 06/22/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -66,7 +80,7 @@ ms.date: 06/22/2018 Specifies the BitLocker Drive Encryption method and cipher strength. > [!NOTE] -> XTS-AES 128-bit and XTS-AES 256-bit values are only supported on Windows 10 for desktop. +> XTS-AES 128-bit and XTS-AES 256-bit values are supported only on Windows 10 for desktop. @@ -81,12 +95,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md index dfad46a493..07a7f51c0f 100644 --- a/windows/client-management/mdm/policy-csp-bits.md +++ b/windows/client-management/mdm/policy-csp-bits.md @@ -1,18 +1,22 @@ --- title: Policy CSP - BITS description: Policy CSP - BITS -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 06/29/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - BITS > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + The following bandwidth policies are used together to define the bandwidth-throttling schedule and transfer rate. @@ -20,7 +24,7 @@ The following bandwidth policies are used together to define the bandwidth-throt - BITS/BandwidthThrottlingStartTime - BITS/BandwidthThrottlingTransferRate -If BITS/BandwidthThrottlingStartTime or BITS/BandwidthThrottlingEndTime are NOT defined, but BITS/BandwidthThrottlingTransferRate IS defined, then default values will be used for StartTime and EndTime (8am and 5pm respectively). The time policies are based on the 24-hour clock. +If BITS/BandwidthThrottlingStartTime or BITS/BandwidthThrottlingEndTime are NOT defined, but BITS/BandwidthThrottlingTransferRate IS defined, then default values will be used for StartTime and EndTime (8 AM and 5 PM respectively). The time policies are based on the 24-hour clock.
                              @@ -57,26 +61,34 @@ If BITS/BandwidthThrottlingStartTime or BITS/BandwidthThrottlingEndTime are NOT - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5cross markcheck mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscross mark
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -89,7 +101,7 @@ If BITS/BandwidthThrottlingStartTime or BITS/BandwidthThrottlingEndTime are NOT This policy specifies the bandwidth throttling **end time** that Background Intelligent Transfer Service (BITS) uses for background transfers. This policy setting does not affect foreground transfers. This policy is based on the 24-hour clock. -Value type is integer. Default value is 17 (5 pm). +Value type is integer. Default value is 17 (5 PM). Supported value range: 0 - 23 @@ -99,7 +111,7 @@ Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrott If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. -Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. +Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -132,26 +144,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5cross markcheck mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscross mark
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -174,7 +194,7 @@ Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrott If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. -Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. +Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -207,26 +227,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5cross markcheck mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscross mark
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -249,7 +277,7 @@ Using the three policies together (BandwidthThrottlingStartTime, BandwidthThrott If you disable or do not configure this policy setting, BITS uses all available unused bandwidth. -Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect Peercaching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. +Note: You should base the limit on the speed of the network link, not the computer's network interface card (NIC). This policy setting does not affect peer caching transfers between peer computers (it does affect transfers from the origin server); the "Limit the maximum network bandwidth used for Peercaching" policy setting should be used for that purpose. Consider using this setting to prevent BITS transfers from competing for network bandwidth when the client computer has a fast network card (10Mbs), but is connected to the network via a slow link (56Kbs). @@ -282,26 +310,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5cross markcheck mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscross mark
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -352,26 +388,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5cross markcheck mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscross mark
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -422,26 +466,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5cross markcheck mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscross mark
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -454,7 +506,7 @@ ADMX Info: This policy setting specifies the number of days a pending BITS job can remain inactive before the job is considered abandoned. By default BITS will wait 90 days before considering an inactive job abandoned. After a job is determined to be abandoned, the job is deleted from BITS and any downloaded files for the job are deleted from the disk. -> [!Note] +> [!NOTE] > Any property changes to the job or any successful download action will reset this timeout. Value type is integer. Default is 90 days. @@ -492,14 +544,14 @@ Supported values range: 0 - 999
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 82eb7ed2c3..225de9c9ca 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Bluetooth description: Policy CSP - Bluetooth -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 11/15/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Bluetooth @@ -48,26 +51,34 @@ ms.date: 11/15/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -102,26 +113,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -156,26 +175,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -206,26 +233,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -256,26 +291,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -303,26 +346,34 @@ If this policy is not set or it is deleted, the default local radio name is used - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -333,7 +384,7 @@ If this policy is not set or it is deleted, the default local radio name is used -Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7CAA-436C-8BF0-78CD0FFBD4AF}. +Added in Windows 10, version 1511. Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7CAA-436C-8BF0-78CD0FFBD4AF}. The default value is an empty string. For more information, see [ServicesAllowedList usage guide](#servicesallowedlist-usage-guide) @@ -341,15 +392,19 @@ The default value is an empty string. For more information, see [ServicesAllowed
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. +
                              + ## ServicesAllowedList usage guide When the Bluetooth/ServicesAllowedList policy is provisioned, it will only allow pairing and connections of Windows PCs and phones to explicitly defined Bluetooth profiles and services. It is an allowed list, enabling admins to still allow custom Bluetooth profiles that are not defined by the Bluetooth Special Interests Group (SIG). @@ -462,3 +517,4 @@ Disabling file transfer shall have the following effects - Fsquirt shall not allow receiving of files - Fsquirt shall display error message informing user of policy preventing file transfer - 3rd-party apps shall not be permitted to send or receive files using MSFT Bluetooth API + diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index 9b9cc1b64f..64a83cf92a 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -4,19 +4,24 @@ description: Policy CSP - Browser ms.topic: article ms.prod: w10 ms.technology: windows -author: shortpatti -ms.author: pashort -ms.date: 10/02/2018 +author: dansimp +ms.author: dansimp +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp +ms.localizationpriority: medium --- # Policy CSP - Browser -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/).
                              +> [!NOTE] +> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + ## Browser policies @@ -27,9 +32,6 @@ ms.date: 10/02/2018
                              Browser/AllowAutofill
                              -
                              - Browser/AllowBrowser -
                              Browser/AllowConfigurationUpdateForBooksLibrary
                              @@ -132,9 +134,6 @@ ms.date: 10/02/2018
                              Browser/EnterpriseSiteListServiceUrl
                              -
                              - Browser/FirstRunURL -
                              Browser/HomePages
                              @@ -159,7 +158,10 @@ ms.date: 10/02/2018
                              Browser/PreventSmartScreenPromptOverrideForFiles
                              -
                              +
                              + Browser/PreventTurningOffRequiredExtensions +
                              +
                              Browser/PreventUsingLocalHostIPAddressForWebRTC
                              @@ -200,26 +202,34 @@ ms.date: 10/02/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -263,26 +273,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -321,96 +339,47 @@ To verify AllowAutofill is set to 0 (not allowed): 1. Open Microsoft Edge. 2. In the upper-right corner of the browser, click **…**. 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. -4. Verify the setting **Save form entries** is greyed out. +4. Verify the setting **Save form entries** is grayed out.
                              - -**Browser/AllowBrowser** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. For desktop devices, use the [AppLocker CSP](applocker-csp.md) instead. - -The device allows Microsoft Edge on Windows 10 Mobile by default. With this policy, you can disable the Microsoft Edge tile, and when clicking the tile, a message opens indicating that the administrator disabled Internet browsing. - - - - - -Supported values: - -- 0 – Prevented/not allowed. -- 1 (default) – Allowed. - -Most restricted value: 0 - - - -
                              - **Browser/AllowConfigurationUpdateForBooksLibrary** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -429,10 +398,10 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Allow configuration updates for the Books Library* -- GP name: *AllowConfigurationUpdateForBooksLibrary* -- GP path: *Windows Components/Microsoft Edge* -- GP ADMX file name: *MicrosoftEdge.admx* +- GP English name: *Allow configuration updates for the Books Library* +- GP name: *AllowConfigurationUpdateForBooksLibrary* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* @@ -452,26 +421,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -523,26 +500,34 @@ To verify AllowCookies is set to 0 (not allowed): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -586,26 +571,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -631,9 +624,9 @@ ADMX Info: Supported values: -- Blank (default) - Do not send tracking information but let users choose to send tracking information to sites they visit. -- 0 - Never send tracking information. -- 1 - Send tracking information. +- Blank (default) - Do not send tracking information but let users choose to send tracking information to sites they visit. +- 0 - Never send tracking information. +- 1 - Send tracking information. Most restricted value: 1 @@ -643,7 +636,7 @@ To verify AllowDoNotTrack is set to 0 (not allowed): 1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile. 2. In the upper-right corner of the browser, click **…**. 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. -4. Verify the setting **Send Do Not Track requests** is greyed out. +4. Verify the setting **Send Do Not Track requests** is grayed out. @@ -656,26 +649,34 @@ To verify AllowDoNotTrack is set to 0 (not allowed): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -717,26 +718,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -778,26 +787,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -842,26 +859,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -911,26 +936,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -972,26 +1005,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1037,26 +1078,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1107,26 +1156,34 @@ To verify AllowPasswordManager is set to 0 (not allowed): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1177,26 +1234,34 @@ To verify AllowPopups is set to 0 (not allowed): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1247,26 +1312,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1316,26 +1389,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1385,26 +1466,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1452,26 +1541,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1514,26 +1611,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1583,26 +1688,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1639,7 +1752,7 @@ Most restricted value: 1 To verify AllowSmartScreen is set to 0 (not allowed): 1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. -2. Verify the setting **Help protect me from malicious sites and download with SmartScreen Filter** is disabled. +2. Verify that the setting **Help protect me from malicious sites and download with Windows Defender SmartScreen** is disabled. @@ -1652,26 +1765,34 @@ To verify AllowSmartScreen is set to 0 (not allowed): - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1720,26 +1841,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1788,26 +1917,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1852,26 +1989,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1924,26 +2069,34 @@ To verify that browsing data is cleared on exit (ClearBrowsingDataOnExit is set - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1977,7 +2130,7 @@ ADMX Info: Supported values: - 0 (default) – Prevented/not allowed. Microsoft Edge uses the search engine specified in App settings.

                              If you enabled this policy and now want to disable it, disabling removes all previously configured search engines. -- 1 – Allowed. Add up to five additional search engines and set any one of them as the default.

                              For each search engine added you must specify a link to the OpenSearch XML file that contains, at a minimum, the short name and URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://developer.microsoft.com/en-us/microsoft-edge/platform/documentation/dev-guide/browser/search-provider-discovery/). +- 1 – Allowed. Add up to five additional search engines and set any one of them as the default.

                              For each search engine added you must specify a link to the OpenSearch XML file that contains, at a minimum, the short name and URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://docs.microsoft.com/microsoft-edge/dev-guide/browser/search-provider-discovery). Most restricted value: 0 @@ -1991,26 +2144,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +

                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2060,26 +2221,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2133,26 +2302,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2209,26 +2386,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2280,26 +2465,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2361,26 +2554,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2431,26 +2632,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2468,12 +2677,10 @@ Most restricted value: 0    > [!NOTE] > This policy has no effect when the Browser/HomePages policy is not configured.  -  + > [!IMPORTANT] > This setting can be used only with domain-joined or MDM-enrolled devices. For more information, see the [Microsoft browser extension policy](https://docs.microsoft.com/legal/windows/agreements/microsoft-browser-extension-policy). -Most restricted value: 0 - ADMX Info: @@ -2486,8 +2693,8 @@ ADMX Info: Supported values: -- 0 – Lock down Start pages configured in either the ConfigureOpenEdgeWith policy and HomePages policy. -- 1 (default) – Unlocked. Users can make changes to all configured start pages.

                              When you enable this policy and define a set of URLs in the HomePages policy, Microsoft Edge uses the URLs defined in the ConfigureOpenEdgeWith policy. +- 0 (default) – Lock down Start pages configured in either the ConfigureOpenEdgeWith policy and HomePages policy. +- 1 – Unlocked. Users can make changes to all configured start pages.

                              When you enable this policy and define a set of URLs in the HomePages policy, Microsoft Edge uses the URLs defined in the ConfigureOpenEdgeWith policy. Most restricted value: 0 @@ -2501,26 +2708,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +

                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2562,26 +2777,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2599,7 +2822,7 @@ Most restricted value: 0 > [!NOTE] > This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile. -  + @@ -2629,26 +2852,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2668,79 +2899,40 @@ Supported values:
                              - -**Browser/FirstRunURL** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -Enter a URL in string format for the site you want to load when Microsoft Edge for Windows 10 Mobile opens for the first time, for example, contoso.com. - - - - -
                              - **Browser/HomePages** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2798,26 +2990,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3check mark3check mark3Homecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2861,26 +3061,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2922,26 +3130,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2989,26 +3205,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3051,26 +3275,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3113,26 +3345,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3173,26 +3413,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3234,26 +3482,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3282,7 +3538,7 @@ Supported values: - Blank (default) - Allowed. Users can uninstall extensions. If you previously enabled this policy and you decide to disable it, the list of extension PFNs defined in this policy get ignored. -- String - Provide a semi-colon delimited list of extension PFNs. For example, adding the following OneNote Web Clipper and Office Online extension prevents users from turning it off:

                                    _Microsoft.OneNoteWebClipper8wekyb3d8bbwe;Microsoft.OfficeOnline8wekyb3d8bbwe_

                              After defining the list of extensions, you deploy them through any available enterprise deployment channel, such as Microsoft Intune.

                              Removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. +- String - Provide a semi-colon delimited list of extension PFNs. For example, adding the following OneNote Web Clipper extension prevents users from turning it off:

                                    _Microsoft.OneNoteWebClipper8wekyb3d8bbwe_

                              After defining the list of extensions, you deploy them through any available enterprise deployment channel, such as Microsoft Intune.

                              Removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. @@ -3301,26 +3557,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +

                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3364,26 +3628,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3check mark3check mark3Homecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3398,14 +3670,14 @@ Most restricted value: 1 >*Supported versions: Microsoft Edge on Windows 10, version 1709 or later* [!INCLUDE [provision-favorites-shortdesc](../../../browsers/edge/shortdesc/provision-favorites-shortdesc.md)] -  + Define a default list of favorites in Microsoft Edge. In this case, the Save a Favorite, Import settings, and context menu options (such as Create a new folder) are turned off. To define a default list of favorites: 1. In the upper-right corner of Microsoft Edge, click the ellipses (**...**) and select **Settings**. 2. Click **Import from another browser**, click **Export to file** and save the file. -3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision.

                              Specify the URL as:

                              • HTTP location: "SiteList"=http://localhost:8080/URLs.html
                              • Local network: "SiteList"="\network\shares\URLs.html"
                              • Local file: "SiteList"=file:///c:/Users/Documents/URLs.html
                              +3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision.

                              Specify the URL as:

                              • HTTP location: "SiteList"=
                              • Local network: "SiteList"="\network\shares\URLs.html"
                              • Local file: "SiteList"=file:///c:/Users/Documents/URLs.html
                              >[!IMPORTANT] @@ -3424,7 +3696,6 @@ ADMX Info: - GP ADMX file name: *MicrosoftEdge.admx* -
                              @@ -3435,26 +3706,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3501,26 +3780,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3555,7 +3842,7 @@ ADMX Info: Supported values: -- Blank (default) - Microsoft Edge uses the default search engine specified in App settings. If you don't configure this policy and disable the [AllowSearchEngineCustomization](https://review.docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser?branch=microsoft-edge-preview#browser-allowsearchenginecustomization) policy, users cannot make changes. +- Blank (default) - Microsoft Edge uses the default search engine specified in App settings. If you don't configure this policy and disable the [AllowSearchEngineCustomization](#browser-allowsearchenginecustomization) policy, users cannot make changes. - 0 - Microsoft Edge removes the policy-set search engine and uses the Microsoft Edge specified engine for the market. - 1 - Microsoft Edge uses the policy-set search engine specified in the OpenSearch XML file. Users cannot change the default search engine.

                              Specify a link to the OpenSearch XML file that contains, at a minimum, the short name and the URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://docs.microsoft.com/microsoft-edge/dev-guide/browser/search-provider-discovery). Use this format to specify the link you want to add.

                              If you want users to use the default Microsoft Edge settings for each market, set the string to **EDGEDEFAULT**.

                              If you want users to use Microsoft Bing as the default search engine, then set the string to **EDGEBING**. @@ -3571,26 +3858,34 @@ Most restricted value: 1 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +

                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3638,26 +3933,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3704,26 +4007,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3769,26 +4080,34 @@ Most restricted value: 0 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3805,7 +4124,7 @@ Most restricted value: 0 [!INCLUDE [keep-favorites-in-sync-between-ie-and-edge-shortdesc](../../../browsers/edge/shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md)] -> [!NOTE] +> [!NOTE] > This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile. @@ -3829,7 +4148,7 @@ To verify that favorites are in synchronized between Internet Explorer and Micro
                              1. Open Internet Explorer and add some favorites. -
                              2. Open Microsoft Edge, then select **Hub > Favorites**. +
                              3. Open Microsoft Edge, then select Hub > Favorites.
                              4. Verify that the favorites added to Internet Explorer show up in the favorites list in Microsoft Edge.
                              @@ -3844,26 +4163,34 @@ To verify that favorites are in synchronized between Internet Explorer and Micro - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3911,26 +4238,34 @@ Supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3965,13 +4300,14 @@ Most restricted value: 0
                              -Footnote: +Footnotes: -- 1 - Supported versions, version 1607. -- 2 - Supported versions, version 1703. -- 3 - Supported versions, version 1709. -- 4 - Supported versions, version 1803. -- 5 - Supported versions, version 1809. +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index bb7caec67c..c3b2407f95 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Camera description: Policy CSP - Camera -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Camera @@ -33,26 +36,34 @@ ms.date: 05/14/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -86,30 +97,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - -## Camera policies that can be set using Exchange Active Sync (EAS) - -- [Camera/AllowCamera](#camera-allowcamera) - - - -## Camera policies supported by IoT Core - -- [Camera/AllowCamera](#camera-allowcamera) - - - -## Camera policies supported by Microsoft Surface Hub - -- [Camera/AllowCamera](#camera-allowcamera) - - diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index 0712d689ac..8eea1718e2 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Cellular description: Policy CSP - Cellular -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/08/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Cellular @@ -45,26 +48,34 @@ ms.date: 08/08/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -117,26 +128,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -169,26 +188,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -221,26 +248,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -273,26 +308,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -311,9 +354,9 @@ If this policy setting is disabled or is not configured, the link to the per-app > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -327,30 +370,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - -## Cellular policies that can be set using Exchange Active Sync (EAS) - -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) - - - -## Cellular policies supported by IoT Core - -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) - - - -## Cellular policies supported by Microsoft Surface Hub - -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) - - diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 0806fb596a..9f039348ee 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Connectivity description: Policy CSP - Connectivity -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/30/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Connectivity @@ -31,9 +34,6 @@ ms.date: 07/30/2018
                              Connectivity/AllowConnectedDevices
                              -
                              - Connectivity/AllowNFC -
                              Connectivity/AllowPhonePCLinking
                              @@ -75,26 +75,34 @@ ms.date: 07/30/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -118,7 +126,7 @@ Most restricted value is 0. The following list shows the supported values: -- 0 – Disallow Bluetooth. If this is set to 0, the radio in the Bluetooth control panel will be greyed out and the user will not be able to turn Bluetooth on. +- 0 – Disallow Bluetooth. If this is set to 0, the radio in the Bluetooth control panel will be grayed out and the user will not be able to turn Bluetooth on. - 1 – Reserved. If this is set to 1, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on. - 2 (default) – Allow Bluetooth. If this is set to 2, the radio in the Bluetooth control panel will be functional and the user will be able to turn Bluetooth on. @@ -133,26 +141,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -184,26 +200,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -255,26 +279,34 @@ To validate on mobile devices, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -302,88 +334,40 @@ The following list shows the supported values:
                              - -**Connectivity/AllowNFC** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Allows or disallows near field communication (NFC) on the device. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Do not allow NFC capabilities. -- 1 (default) – Allow NFC capabilities. - - - - -
                              - **Connectivity/AllowPhonePCLinking** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4Homecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -416,7 +400,7 @@ This setting supports a range of values between 0 and 1. Validation: -If the Connectivity/AllowPhonePCLinking policy is configured to value 0, the add a phone button in the Phones section in settings will be greyed out and clicking it will not launch the window for a user to enter their phone number. +If the Connectivity/AllowPhonePCLinking policy is configured to value 0, the add a phone button in the Phones section in settings will be grayed out and clicking it will not launch the window for a user to enter their phone number. Device that has previously opt-in to MMX will also stop showing on the device list. @@ -431,26 +415,34 @@ Device that has previously opt-in to MMX will also stop showing on the device li - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcross markcross markcheck markcheck markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecross mark
                              Educationcross mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -462,8 +454,7 @@ Device that has previously opt-in to MMX will also stop showing on the device li > [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - +> Currently, this policy is supported only in HoloLens 2, Hololens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition. Enables USB connection between the device and a computer to sync files with the device or to use developer tools to deploy or debug applications. Changing this policy does not affect USB charging. @@ -489,26 +480,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -541,26 +540,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -593,26 +600,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -638,9 +653,9 @@ Also, see the "Web-based printing" policy setting in Computer Configuration/Admi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -661,26 +676,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -704,9 +727,9 @@ If you disable or do not configure this policy setting, users can download print > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -727,26 +750,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -770,9 +801,9 @@ See the documentation for the web publishing and online ordering wizards for mor > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -793,26 +824,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -823,7 +862,7 @@ ADMX Info: -Added in Windows 10, version 1703. Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. This policy disables the NCSI active probe, preventing network connectivity to www.msftconnecttest.com. +Added in Windows 10, version 1703. Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to to determine if the device can communicate with the Internet. This policy disables the NCSI active probe, preventing network connectivity to www.msftconnecttest.com. Value type is integer. @@ -846,26 +885,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -883,9 +930,9 @@ If you enable this policy, Windows only allows access to the specified UNC paths > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -906,26 +953,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -940,16 +995,16 @@ Determines whether a user can install and configure the Network Bridge. Important: This settings is location aware. It only applies when a computer is connected to the same DNS domain network it was connected to when the setting was refreshed on that computer. If a computer is connected to a DNS domain network other than the one it was connected to when the setting was refreshed, this setting does not apply. -The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segements together. This connection appears in the Network Connections folder. +The Network Bridge allows users to create a layer 2 MAC bridge, enabling them to connect two or more network segments together. This connection appears in the Network Connections folder. If you disable this setting or do not configure it, the user will be able to create and modify the configuration of a Network Bridge. Enabling this setting does not remove an existing Network Bridge from the user's computer. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -963,14 +1018,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - - diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index f6626284ef..1cb56dfe89 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -1,17 +1,21 @@ --- title: Policy CSP - ControlPolicyConflict description: Policy CSP - ControlPolicyConflict -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - ControlPolicyConflict +
                              @@ -32,26 +36,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -64,10 +76,10 @@ ms.date: 03/12/2018 Added in Windows 10, version 1803. This policy allows the IT admin to control which policy will be used whenever both the MDM policy and its equivalent Group Policy (GP) are set on the device. -> [!Note] +> [!NOTE] > MDMWinsOverGP only applies to policies in Policy CSP. It does not apply to other MDM settings with equivalent GP settings that are defined on other configuration service providers. -This policy is used to ensure that MDM policy wins over GP when same setting is set by both GP and MDM channel. The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. +This policy is used to ensure that MDM policy wins over GP when policy is configured on MDM channel. The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. Note: This policy doesn’t support the Delete command and doesn’t support setting the value to 0 again after it was previously set to 1. Windows 10 version 1809 will support using the Delete command to set the value to 0 again, if it was previously set to 1. The following list shows the supported values: @@ -88,8 +100,8 @@ The [Policy DDF](policy-ddf-file.md) contains the following tags to identify the - \ - \ -For the list MDM-GP mapping list, see [Policies supported by GP -](policy-configuration-service-provider.md#policies-supported-by-gp). +For the list MDM-GP mapping list, see [Policies supported by Group Policy +](policies-supported-by-group-policy.md). The MDM Diagnostic report shows the applied configurations states of a device including policies, certificates, configuration sources, and resource information. The report includes a list of blocked GP settings because MDM equivalent is configured, if any. To get the diagnostic report, go to **Settings** > **Accounts** > **Access work or school** > and then click the desired work or school account. Scroll to the bottom of the page to **Advanced Diagnostic Report** and then click **Create Report**. @@ -104,12 +116,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index f471a91b35..a246711f54 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -1,12 +1,15 @@ --- title: Policy CSP - CredentialProviders description: Policy CSP - CredentialProviders -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - CredentialProviders @@ -39,26 +42,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -82,9 +93,9 @@ To configure Windows Hello for Business, use the Administrative Template policie > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -105,26 +116,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -146,9 +165,9 @@ Note that the user's domain password will be cached in the system vault when usi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -169,26 +188,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -214,19 +241,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - -## CredentialProviders policies supported by IoT Core - -- [CredentialProviders/AllowPINLogon](#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](#credentialproviders-blockpicturepassword) - - diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md index 309848708a..8ff0e68902 100644 --- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -1,17 +1,21 @@ --- title: Policy CSP - CredentialsDelegation description: Policy CSP - CredentialsDelegation -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 04/16/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - CredentialsDelegation +
                              @@ -32,26 +36,34 @@ ms.date: 04/16/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -73,9 +85,9 @@ If you disable or do not configure this policy setting, Restricted Administratio > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -89,12 +101,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index 12f8698b09..ddbe0fbb42 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -1,12 +1,15 @@ --- title: Policy CSP - CredentialsUI description: Policy CSP - CredentialsUI -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - CredentialsUI @@ -36,26 +39,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -80,9 +91,9 @@ The policy applies to all Windows components and applications that use the Windo > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -103,26 +114,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -142,9 +161,9 @@ If you disable this policy setting, users will always be required to type a user > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -158,12 +177,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index 69f8321a8b..e65d65744a 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Cryptography description: Policy CSP - Cryptography -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Cryptography @@ -36,26 +39,34 @@ ms.date: 05/14/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -69,19 +80,24 @@ ms.date: 05/14/2018 Allows or disallows the Federal Information Processing Standard (FIPS) policy. - -GP Info: + +ADMX Info: - GP English name: *System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - + The following list shows the supported values: - 0 (default) – Not allowed. - 1– Allowed. - + + + + + +
                              @@ -92,26 +108,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -125,22 +149,29 @@ The following list shows the supported values: Lists the Cryptographic Cipher Algorithms allowed for SSL connections. Format is a semicolon delimited list. Last write win. + + + + + + + + + + + +
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - -## Cryptography policies supported by Microsoft Surface Hub - -- [Cryptography/AllowFipsAlgorithmPolicy](#cryptography-allowfipsalgorithmpolicy) -- [Cryptography/TLSCipherSuites](#cryptography-tlsciphersuites) - - diff --git a/windows/client-management/mdm/policy-csp-dataprotection.md b/windows/client-management/mdm/policy-csp-dataprotection.md index aabd7f1845..a59ff61127 100644 --- a/windows/client-management/mdm/policy-csp-dataprotection.md +++ b/windows/client-management/mdm/policy-csp-dataprotection.md @@ -1,12 +1,15 @@ --- title: Policy CSP - DataProtection description: Policy CSP - DataProtection -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 01/26/2019 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - DataProtection @@ -36,26 +39,34 @@ ms.date: 01/26/2019 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -88,26 +99,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -121,7 +140,7 @@ The following list shows the supported values: > [!IMPORTANT] > This policy may change in a future release. It may be used for testing purposes, but should not be used in a production environment at this time. -  + Setting used by Windows 8.1 Selective Wipe. > [!NOTE] @@ -131,18 +150,14 @@ Setting used by Windows 8.1 Selective Wipe.
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - -## DataProtection policies supported by IoT Core - -- [DataProtection/AllowDirectMemoryAccess](#dataprotection-allowdirectmemoryaccess) - - diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index b1a2f2dfa1..13ed5363fb 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -1,12 +1,15 @@ --- title: Policy CSP - DataUsage description: Policy CSP - DataUsage -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/13/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - DataUsage @@ -33,11 +36,12 @@ ms.date: 07/13/2018 **DataUsage/SetCost3G** +
                              + This policy is deprecated in Windows 10, version 1809. -
                              @@ -48,26 +52,34 @@ This policy is deprecated in Windows 10, version 1809. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -93,9 +105,9 @@ If this policy setting is disabled or is not configured, the cost of 4G connecti > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -109,12 +121,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index 0605b3bb03..1539c913c4 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -1,18 +1,19 @@ --- title: Policy CSP - Defender description: Policy CSP - Defender -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 01/26/2019 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 01/08/2020 +ms.reviewer: +manager: dansimp --- # Policy CSP - Defender -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
                              @@ -155,26 +156,34 @@ ms.date: 01/26/2019 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -203,8 +212,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off scanning on archived files. +- 1 (default) – Allowed. Scans the archive files. @@ -217,26 +226,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -250,7 +267,7 @@ The following list shows the supported values: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -  + Allows or disallows Windows Defender Behavior Monitoring functionality. @@ -265,8 +282,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off behavior monitoring. +- 1 (default) – Allowed. Turns on real-time behavior monitoring. @@ -279,26 +296,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -328,8 +353,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off the Microsoft Active Protection Service. +- 1 (default) – Allowed. Turns on the Microsoft Active Protection Service. @@ -342,26 +367,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -390,8 +423,8 @@ ADMX Info: The following list shows the supported values: -- 0 (default) – Not allowed. -- 1 – Allowed. +- 0 (default) – Not allowed. Turns off email scanning. +- 1 – Allowed. Turns on email scanning. @@ -404,26 +437,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -452,8 +493,8 @@ ADMX Info: The following list shows the supported values: -- 0 (default) – Not allowed. -- 1 – Allowed. +- 0 (default) – Not allowed. Disables scanning on mapped network drives. +- 1 – Allowed. Scans mapped network drives. @@ -466,26 +507,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -500,7 +549,7 @@ The following list shows the supported values: > This policy is only enforced in Windows 10 for desktop. -Allows or disallows a full scan of removable drives. +Allows or disallows a full scan of removable drives. During a quick scan, removable drives may still be scanned. @@ -514,8 +563,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off scanning on removable drives. +- 1 (default) – Allowed. Scans removable drives. @@ -528,26 +577,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -561,7 +618,7 @@ The following list shows the supported values: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -  + Allows or disallows Windows Defender IOAVP Protection functionality. @@ -590,26 +647,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -644,26 +709,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -706,26 +779,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -754,8 +835,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off the real-time monitoring service. +- 1 (default) – Allowed. Turns on and runs the real-time monitoring service. @@ -768,26 +849,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -801,7 +890,7 @@ The following list shows the supported values: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -  + Allows or disallows a scanning of network files. @@ -816,8 +905,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Turns off scanning of network files. +- 1 (default) – Allowed. Scans network files. @@ -830,26 +919,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -884,26 +981,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -932,8 +1037,8 @@ ADMX Info: The following list shows the supported values: -- 0 – Not allowed. -- 1 (default) – Allowed. +- 0 – Not allowed. Prevents users from accessing UI. +- 1 (default) – Allowed. Lets users access UI. @@ -946,26 +1051,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1004,26 +1117,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1064,26 +1185,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1097,7 +1226,7 @@ ADMX Info: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -  + Represents the average CPU load factor for the Windows Defender scan (in percent). @@ -1127,26 +1256,34 @@ Valid values: 0–100 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1156,7 +1293,6 @@ Valid values: 0–100
                              - This policy setting allows you to manage whether a check for new virus and spyware definitions will occur before running a scan. @@ -1202,26 +1338,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1241,8 +1385,8 @@ Added in Windows 10, version 1709. This policy setting determines how aggressive If this setting is on, Windows Defender Antivirus will be more aggressive when identifying suspicious files to block and scan; otherwise, it will be less aggressive and therefore block and scan with less frequency. For more information about specific values that are supported, see the Windows Defender Antivirus documentation site. -      -> [!Note] + +> [!NOTE] > This feature requires the "Join Microsoft MAPS" setting enabled in order to function. @@ -1274,26 +1418,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1313,7 +1465,7 @@ The typical cloud check timeout is 10 seconds. To enable the extended cloud chec For example, if the desired timeout is 60 seconds, specify 50 seconds in this setting, which will enable the extended cloud check feature, and will raise the total time to 60 seconds. -> [!Note] +> [!NOTE] > This feature depends on three other MAPS settings the must all be enabled- "Configure the 'Block at First Sight' feature; "Join Microsoft MAPS"; "Send file samples when further analysis is required". @@ -1336,26 +1488,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1391,26 +1551,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1446,26 +1614,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1479,7 +1655,7 @@ ADMX Info: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -  + Time period (in days) that quarantine items will be stored on the system. @@ -1509,26 +1685,34 @@ Valid values: 0–90 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1581,26 +1765,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1653,26 +1845,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1716,26 +1916,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1786,26 +1994,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1819,7 +2035,7 @@ ADMX Info: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -Added in Windows 10, version 1709. This policy allows you to turn network protection on (block/audit) or off in Windows Defender Exploit Guard. Network protection is a feature of Windows Defender Exploit Guard that protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer. +Added in Windows 10, version 1709. This policy allows you to turn network protection on (block/audit) or off. Network protection protects employees using any app from accessing phishing scams, exploit-hosting sites, and malicious content on the Internet. This includes preventing third-party browsers from connecting to dangerous sites. Value type is integer. If you enable this setting, network protection is turned on and employees can't turn it off. Its behavior can be controlled by the following options: Block and Audit. If you enable this policy with the ""Block"" option, users/apps will be blocked from connecting to dangerous domains. You will be able to see this activity in Windows Defender Security Center. @@ -1855,26 +2071,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1888,7 +2112,7 @@ The following list shows the supported values: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -  + Allows an administrator to specify a list of file type extensions to ignore during a scan. Each file type in the list must be separated by a **|**. For example, "lib|obj". @@ -1911,26 +2135,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1967,26 +2199,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2006,7 +2246,7 @@ Allows an administrator to specify a list of files opened by processes to ignore > [!IMPORTANT] > The process itself is not excluded from the scan, but can be by using the **Defender/ExcludedPaths** policy to exclude its path. -  + Each file type must be separated by a **|**. For example, "C:\\Example.exe|C:\\Example1.exe". @@ -2029,26 +2269,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2084,26 +2332,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2151,26 +2407,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2214,26 +2478,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2247,13 +2519,13 @@ The following list shows the supported values: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -  + Selects the time of day that the Windows Defender quick scan should run. > [!NOTE] > The scan type will depends on what scan type is selected in the **Defender/ScanParameter** setting. -  + For example, a value of 0=12:00AM, a value of 60=1:00AM, a value of 120=2:00, and so on, up to a value of 1380=11:00PM. @@ -2283,26 +2555,34 @@ Valid values: 0–1380 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2333,17 +2613,17 @@ ADMX Info: -The following list shows the supported values: +The following list shows the supported values: -- 0 (default) – Every day -- 1 – Monday -- 2 – Tuesday -- 3 – Wednesday -- 4 – Thursday -- 5 – Friday -- 6 – Saturday -- 7 – Sunday -- 8 – No scheduled scan +- 0 (default) – Every day +- 1 – Sunday +- 2 – Monday +- 3 – Tuesday +- 4 – Wednesday +- 5 – Thursday +- 6 – Friday +- 7 – Saturday +- 8 – No scheduled scan @@ -2356,26 +2636,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2425,26 +2713,34 @@ Valid values: 0–1380. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2501,26 +2797,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2572,26 +2876,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2605,7 +2917,7 @@ ADMX Info: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -  + Specifies the interval (in hours) that will be used to check for signatures, so instead of using the ScheduleDay and ScheduleTime the check for new signatures will be set according to the interval. @@ -2639,26 +2951,34 @@ Valid values: 0–24. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2672,7 +2992,7 @@ Valid values: 0–24. > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -  + Checks for the user consent level in Windows Defender to send data. If the required consent has already been granted, Windows Defender submits them. If not, (and if the user has specified never to ask), the UI is launched to ask for user consent (when **Defender/AllowCloudProtection** is allowed) before sending data. @@ -2704,26 +3024,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2736,11 +3064,11 @@ The following list shows the supported values: > [!NOTE] > This policy is only enforced in Windows 10 for desktop. -  + Allows an administrator to specify any valid threat severity levels and the corresponding default action ID to take. -This value is a list of threat severity level IDs and corresponding actions, separated by a**|** using the format "*threat level*=*action*|*threat level*=*action*". For example "1=6|2=2|4=10|5=3 +This value is a list of threat severity level IDs and corresponding actions, separated by a | using the format "*threat level*=*action*|*threat level*=*action*". For example, "1=6|2=2|4=10|5=3". The following list shows the supported values for threat severity levels: @@ -2751,12 +3079,12 @@ The following list shows the supported values for threat severity levels: The following list shows the supported values for possible actions: -- 1 – Clean -- 2 – Quarantine -- 3 – Remove -- 6 – Allow -- 8 – User defined -- 10 – Block +- 1 – Clean. Service tries to recover files and try to disinfect. +- 2 – Quarantine. Moves files to quarantine. +- 3 – Remove. Removes files from system. +- 6 – Allow. Allows file/does none of the above actions. +- 8 – User defined. Requires user to make a decision on which action to take. +- 10 – Block. Blocks file execution. @@ -2771,46 +3099,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. - -## Defender policies supported by Microsoft Surface Hub - -- [Defender/AllowArchiveScanning](#defender-allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](#defender-allowbehaviormonitoring) -- [Defender/AllowCloudProtection](#defender-allowcloudprotection) -- [Defender/AllowEmailScanning](#defender-allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](#defender-allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](#defender-allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](#defender-allowioavprotection) -- [Defender/AllowIntrusionPreventionSystem](#defender-allowintrusionpreventionsystem) -- [Defender/AllowOnAccessProtection](#defender-allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](#defender-allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](#defender-allowscanningnetworkfiles) -- [Defender/AllowScriptScanning](#defender-allowscriptscanning) -- [Defender/AllowUserUIAccess](#defender-allowuseruiaccess) -- [Defender/AvgCPULoadFactor](#defender-avgcpuloadfactor) -- [Defender/DaysToRetainCleanedMalware](#defender-daystoretaincleanedmalware) -- [Defender/ExcludedExtensions](#defender-excludedextensions) -- [Defender/ExcludedPaths](#defender-excludedpaths) -- [Defender/ExcludedProcesses](#defender-excludedprocesses) -- [Defender/PUAProtection](#defender-puaprotection) -- [Defender/RealTimeScanDirection](#defender-realtimescandirection) -- [Defender/ScanParameter](#defender-scanparameter) -- [Defender/ScheduleQuickScanTime](#defender-schedulequickscantime) -- [Defender/ScheduleScanDay](#defender-schedulescanday) -- [Defender/ScheduleScanTime](#defender-schedulescantime) -- [Defender/SignatureUpdateInterval](#defender-signatureupdateinterval) -- [Defender/SubmitSamplesConsent](#defender-submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](#defender-threatseveritydefaultaction) - - diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 95e6d74539..8a8184ba9a 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -1,18 +1,19 @@ --- title: Policy CSP - DeliveryOptimization description: Policy CSP - DeliveryOptimization -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/06/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - DeliveryOptimization -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
                              @@ -33,6 +34,12 @@ ms.date: 07/06/2018
                              DeliveryOptimization/DODelayBackgroundDownloadFromHttp
                              +
                              + DeliveryOptimization/DODelayCacheServerFallbackBackground +
                              +
                              + DeliveryOptimization/DODelayCacheServerFallbackForeground +
                              DeliveryOptimization/DODelayForegroundDownloadFromHttp
                              @@ -107,26 +114,34 @@ ms.date: 07/06/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -165,26 +180,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -228,26 +251,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -289,26 +320,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -337,32 +376,184 @@ ADMX Info:
                              + +**DeliveryOptimization/DODelayCacheServerFallbackBackground** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Specifies the time in seconds to delay the fallback from Cache Server to the HTTP source for a background content download. + +> [!NOTE] +> The [DODelayBackgroundDownloadFromHttp](#deliveryoptimization-dodelaybackgrounddownloadfromhttp) policy takes precedence over this policy to allow downloads from peers first. + + + +ADMX Info: +- GP English name: *Delay Background download Cache Server fallback (in seconds)* +- GP name: *DelayCacheServerFallbackBackground* +- GP element: *DelayCacheServerFallbackBackground* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + + +This policy is specified in seconds. +Supported values: 0 - one month (in seconds) + + + + + + + + + +
                              + + +**DeliveryOptimization/DODelayCacheServerFallbackForeground** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Specifies the time in seconds to delay the fallback from Cache Server to the HTTP source for foreground content download. + +> [!NOTE] +> The [DODelayForegroundDownloadFromHttp](#deliveryoptimization-dodelayforegrounddownloadfromhttp) policy takes precedence over this policy to allow downloads from peers first. + + + +ADMX Info: +- GP English name: *Delay Foreground download Cache Server fallback (in seconds)* +- GP name: *DelayCacheServerFallbackForeground* +- GP element: *DelayCacheServerFallbackForeground* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + + +This policy is specified in seconds. +Supported values: 0 - one month (in seconds) + + + + + + + +
                              + **DeliveryOptimization/DODelayForegroundDownloadFromHttp** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -409,26 +600,34 @@ The following list shows the supported values as number of seconds: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -476,26 +675,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -535,26 +742,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -565,7 +780,7 @@ ADMX Info: -Added in Windows 10, version 1803. Set this policy to restrict peer selection to a specific source. Options available are: 1 = AD Site, 2 = Authenticated domain SID, 3 = DHCP Option ID, 4 = DNS Suffix +Added in Windows 10, version 1803. Set this policy to restrict peer selection to a specific source. Available options are: 1 = AD Site, 2 = Authenticated domain SID, 3 = DHCP Option ID, 4 = DNS Suffix, 5 = AAD. When set, the Group ID will be assigned automatically from the selected source. @@ -575,6 +790,8 @@ The options set in this policy only apply to Group (2) download mode. If Group ( For option 3 - DHCP Option ID, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID. +Starting with Windows 10, version 1903, you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this, set the value of DOGroupIdSource to 5. + ADMX Info: @@ -592,6 +809,7 @@ The following list shows the supported values: - 2 - Authenticated domain SID - 3 - DHCP user option - 4 - DNS suffix +- 5 - AAD @@ -604,26 +822,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -662,26 +888,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -695,7 +929,7 @@ ADMX Info: > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. -  + Specifies the maximum cache size that Delivery Optimization can utilize, as a percentage of disk size (1-100). The default value is 20. @@ -720,26 +954,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -752,7 +994,7 @@ ADMX Info: > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. -  + Added in Windows 10, version 1607. Specifies the maximum download bandwidth in KiloBytes/second that the device can use across all concurrent download activities using Delivery Optimization. @@ -778,26 +1020,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -811,7 +1061,7 @@ ADMX Info: > [!NOTE] > This policy is only enforced in Windows 10 Pro, Enterprise, and Education editions and not supported in Windows 10 Mobile. -  + Specifies the maximum upload bandwidth in KiloBytes/second that a device will use across all concurrent upload activity using Delivery Optimization. The default value is 0, which permits unlimited possible bandwidth (optimized for minimal usage of upload bandwidth). @@ -836,26 +1086,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -894,26 +1152,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -951,26 +1217,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -985,7 +1259,7 @@ ADMX Info: > This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile. -Added in Windows 10, version 1703. Specifies the required minimum disk size (capacity in GB) for the device to use Peer Caching. The value 0 means "not-limited" which means the cloud service set default value will be used. Recommended values: 64 GB to 256 GB. +Added in Windows 10, version 1703. Specifies the required minimum disk size (capacity in GB) for the device to use Peer Caching. Recommended values: 64 GB to 256 GB. > [!NOTE] > If the DOMofidyCacheDrive policy is set, the disk size check will apply to the new working directory specified by this policy. @@ -1012,26 +1286,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1046,7 +1328,7 @@ ADMX Info: > This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile. -Added in Windows 10, version 1703. Specifies the minimum content file size in MB enabled to use Peer Caching. The value 0 means "unlimited" which means the cloud service set default value will be used. Recommended values: 1 MB to 100,000 MB. +Added in Windows 10, version 1703. Specifies the minimum content file size in MB enabled to use Peer Caching. Recommended values: 1 MB to 100,000 MB. The default value is 100 MB. @@ -1070,26 +1352,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1104,7 +1394,7 @@ ADMX Info: > This policy is only enforced in Windows 10 Pro, Business, Enterprise, and Education editions and not supported in Windows 10 Mobile. -Added in Windows 10, version 1703. Specifies the minimum RAM size in GB required to use Peer Caching. The value 0 means "not-limited" which means the cloud service set default value will be used. For example if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. Recommended values: 1 GB to 4 GB. +Added in Windows 10, version 1703. Specifies the minimum RAM size in GB required to use Peer Caching. For example, if the minimum set is 1 GB, then devices with 1 GB or higher available RAM will be allowed to use Peer caching. Recommended values: 1 GB to 4 GB. The default value is 4 GB. @@ -1128,26 +1418,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1186,26 +1484,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1246,26 +1552,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1297,15 +1611,8 @@ ADMX Info: **DeliveryOptimization/DOPercentageMaxDownloadBandwidth** - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device -
                              - This policy is deprecated. Use [DOPercentageMaxForegroundBandwidth](#deliveryoptimization-dopercentagemaxforegroundbandwidth) and [DOPercentageMaxBackgroundBandwidth](#deliveryoptimization-dopercentagemaxbackgroundbandwidth) policies instead. @@ -1320,26 +1627,34 @@ This policy is deprecated. Use [DOPercentageMaxForegroundBandwidth](#deliveryopt - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1374,26 +1689,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1435,26 +1758,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1470,9 +1801,9 @@ Added in Windows 10, version 1803. Specifies the maximum background downloa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1501,26 +1832,34 @@ This policy allows an IT Admin to define the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1536,9 +1875,9 @@ Added in Windows 10, version 1803. Specifies the maximum foreground downloa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1560,34 +1899,14 @@ This policy allows an IT Admin to define the following:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. - -## DeliveryOptimization policies supported by Microsoft Surface Hub - -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) - - diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index ac8fca65ac..d1562413d5 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Desktop description: Policy CSP - Desktop -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/08/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Desktop @@ -33,26 +36,34 @@ ms.date: 08/08/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcross markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -72,9 +83,9 @@ If you enable this setting, users are unable to type a new location in the Targe > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -88,18 +99,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - -## Desktop policies supported by Microsoft Surface Hub - -- [Desktop/PreventUserRedirectionOfProfileFolders](#desktop-preventuserredirectionofprofilefolders) - - diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index 248f11d3fd..f34ee27dd5 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -1,18 +1,21 @@ --- title: Policy CSP - DeviceGuard description: Policy CSP - DeviceGuard -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 09/20/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - DeviceGuard > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
                              @@ -44,26 +47,34 @@ ms.date: 09/20/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark5check mark5Homecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -113,26 +124,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark3check mark3cross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -171,26 +190,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark3check mark3cross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -231,26 +258,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark3check mark3cross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -283,14 +318,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md new file mode 100644 index 0000000000..0968a81bc8 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-devicehealthmonitoring.md @@ -0,0 +1,238 @@ +--- +title: Policy CSP - DeviceHealthMonitoring +description: Learn which DeviceHealthMonitoring policies are supported for your edition of Windows. +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - DeviceHealthMonitoring + + + +
                              + + +## DeviceHealthMonitoring policies + +
                              +
                              + DeviceHealthMonitoring/AllowDeviceHealthMonitoring +
                              +
                              + DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope +
                              +
                              + DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination +
                              +
                              + + +
                              + + +**DeviceHealthMonitoring/AllowDeviceHealthMonitoring** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procross mark
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +DeviceHealthMonitoring is an opt-in health monitoring connection between the device and Microsoft. You should enable this policy only if your organization is using a Microsoft device monitoring service which requires it. + + + +The following list shows the supported values: + +- 1 — The DeviceHealthMonitoring connection is enabled. +- 0 (default) — The DeviceHealthMonitoring connection is disabled. + + + + + + + + + + +
                              + + +**DeviceHealthMonitoring/ConfigDeviceHealthMonitoringScope** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procross mark
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +This policy is applicable only if the [AllowDeviceHealthMonitoring](#devicehealthmonitoring-allowdevicehealthmonitoring) policy has been set to 1 (Enabled) on the device. +This policy modifies which health events are sent to Microsoft on the DeviceHealthMonitoring connection. +IT Pros do not need to set this policy. Instead, Microsoft Intune is expected to dynamically manage this value in coordination with the Microsoft device health monitoring service. + + + + + + + + + + + + + + +
                              + + +**DeviceHealthMonitoring/ConfigDeviceHealthMonitoringUploadDestination** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procross mark
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +This policy is applicable only if the [AllowDeviceHealthMonitoring](#devicehealthmonitoring-allowdevicehealthmonitoring) policy has been set to 1 (Enabled) on the device. +The value of this policy constrains the DeviceHealthMonitoring connection to certain destinations in order to support regional and sovereign cloud scenarios. +In most cases, an IT Pro does not need to define this policy. Instead, it is expected that this value is dynamically managed by Microsoft Intune to align with the region or cloud to which the device's tenant is already linked. Only configure this policy manually if explicitly instructed to do so by a Microsoft device monitoring service. + + + + + + + + + + + + + +
                              + +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. + + + diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index a976e68696..4ced8ce8ab 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -1,15 +1,22 @@ --- title: Policy CSP - DeviceInstallation +ms.reviewer: +manager: dansimp description: Policy CSP - DeviceInstallation -ms.author: maricia +ms.author: dansimp +ms.date: 09/27/2019 ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman +ms.localizationpriority: medium --- # Policy CSP - DeviceInstallation +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. +
                              @@ -20,6 +27,9 @@ author: MariciaAlforque
                              DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
                              +
                              + DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs +
                              DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
                              @@ -32,6 +42,9 @@ author: MariciaAlforque
                              DeviceInstallation/PreventInstallationOfMatchingDeviceIDs
                              +
                              + DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs +
                              DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses
                              @@ -46,26 +59,34 @@ author: MariciaAlforque - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -85,17 +106,16 @@ If you enable this policy setting, Windows is allowed to install or update any d If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed. -Peripherals can be specified by their [hardware identity](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. +Peripherals can be specified by their [hardware identity](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](https://docs.microsoft.com/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). ADMX Info: @@ -109,17 +129,10 @@ ADMX Info: - - - - - - - To enable this policy, use the following SyncML. This example allows Windows to install compatible devices with a device ID of USB\Composite or USB\Class_FF. To configure multiple classes, use `` as a delimiter. -``` syntax +```xml @@ -138,7 +151,7 @@ To enable this policy, use the following SyncML. This example allows Windows to ``` -To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: +To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: ```txt >>> [Device Installation Restrictions Policy Check] @@ -146,6 +159,118 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i <<< Section end 2018/11/15 12:26:41.751 <<< [Exit status: SUCCESS] ``` + + + + + + +
                              + + +**DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, version 1809. This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is allowed to install. Use this policy setting only when the "Prevent installation of devices not described by other policy settings" policy setting is enabled. Other policy settings that prevent device installation take precedence over this one. + +If you enable this policy setting, Windows is allowed to install or update any device whose Plug and Play device instance ID appears in the list you create, unless another policy setting specifically prevents that installation (for example, the "Prevent installation of devices that match any of these device IDs" policy setting, the "Prevent installation of devices for these device classes" policy setting, the "Prevent installation of devices that match any of these device instance IDs" policy setting, or the "Prevent installation of removable devices" policy setting). If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. + +If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed. + +Peripherals can be specified by their [device instance ID](https://docs.microsoft.com/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow installation of devices that match any of these device instance IDs* +- GP name: *DeviceInstall_Instance_IDs_Allow* +- GP path: *System/Device Installation/Device Installation Restrictions* +- GP ADMX file name: *deviceinstallation.admx* + + + + + + +To enable this policy, use the following SyncML. + +``` xml + + + + $CmdID$ + + + ./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/AllowInstallationOfMatchingDeviceInstanceIDs + + + string + + + + + + +``` +To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: +``` txt +>>> [Device Installation Restrictions Policy Check] +>>> Section start 2018/11/15 12:26:41.659 +<<< Section end 2018/11/15 12:26:41.751 +<<< [Exit status: SUCCESS] +``` + + + + +
                              @@ -155,26 +280,34 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -196,17 +329,16 @@ This setting allows device installation based on the serial number of a removabl If you disable or do not configure this policy setting, and no other policy setting describes the device, the "Prevent installation of devices not described by other policy settings" policy setting determines whether the device can be installed. -Peripherals can be specified by their [hardware identity](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. +Peripherals can be specified by their [hardware identity](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](https://docs.microsoft.com/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. > [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). ADMX Info: @@ -220,13 +352,6 @@ ADMX Info: - - - - - - - To enable this policy, use the following SyncML. This example allows Windows to install: - Floppy Disks, ClassGUID = {4d36e980-e325-11ce-bfc1-08002be10318} @@ -236,7 +361,7 @@ To enable this policy, use the following SyncML. This example allows Windows to Enclose the class GUID within curly brackets {}. To configure multiple classes, use `` as a delimiter. -``` syntax +```xml @@ -255,7 +380,7 @@ Enclose the class GUID within curly brackets {}. To configure multiple classes, ``` -To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: +To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: ```txt @@ -264,6 +389,11 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i <<< Section end 2018/11/15 12:26:41.751 <<< [Exit status: SUCCESS] ``` + + + + +
                              @@ -273,26 +403,34 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -309,14 +447,12 @@ If you enable this policy setting, Windows does not retrieve device metadata for If you disable or do not configure this policy setting, the setting in the Device Installation Settings dialog box controls whether Windows retrieves device metadata from the Internet. - - > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -338,8 +474,6 @@ ADMX Info: - -
                              @@ -348,26 +482,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -384,13 +526,12 @@ If you enable this policy setting, Windows is prevented from installing or updat If you disable or do not configure this policy setting, Windows is allowed to install or update the device driver for any device that is not described by the "Prevent installation of devices that match any of these device IDs," "Prevent installation of devices for these device classes," or "Prevent installation of removable devices" policy setting. - > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -405,17 +546,10 @@ ADMX Info: - - - - - - - To enable this policy, use the following SyncML. This example prevents Windows from installing devices that are not specifically described by any other policy setting. -``` syntax +```xml @@ -446,7 +580,11 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i You can also block installation by using a custom profile in Intune. ![Custom profile](images/custom-profile-prevent-other-devices.png) + + + +
                              @@ -456,26 +594,34 @@ You can also block installation by using a custom profile in Intune. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -492,14 +638,14 @@ If you enable this policy setting, Windows is prevented from installing a device If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings. -Peripherals can be specified by their [hardware identity](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it blocks the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. +Peripherals can be specified by their [hardware identity](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](https://docs.microsoft.com/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it blocks the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -510,14 +656,15 @@ ADMX Info: - GP ADMX file name: *deviceinstallation.admx* - - + + +
                              -To enable this policy, use the following SyncML. This example prevents Windows from installing compatible devices with a device ID of USB\Composite or USB\Class_FF. To configure multiple classes, use `` as a delimiter. To apply the policy to matching device classes that are already installed, set DeviceInstall_IDs_Deny_Retroactive to true. +To enable this policy, use the following SyncML. This example prevents Windows from installing compatible devices with a device ID of USB\Composite or USB\Class_FF. To configure multiple classes, use &#xF000; as a delimiter. To apply the policy to matching device classes that are already installed, set DeviceInstall_IDs_Deny_Retroactive to true. -``` syntax +```xml @@ -550,7 +697,140 @@ You can also block installation and usage of prohibited peripherals by using a c For example, this custom profile blocks installation and usage of USB devices with hardware IDs "USB\Composite" and "USB\Class_FF", and applies to USB devices with matching hardware IDs that are already installed. ![Custom profile](images/custom-profile-prevent-device-ids.png) + + + + + +
                              + + +**DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. Also available in Windows 10, version 1809. This policy setting allows you to specify a list of Plug and Play device instance IDs for devices that Windows is prevented from installing. This policy setting takes precedence over any other policy setting that allows Windows to install a device. + +If you enable this policy setting, Windows is prevented from installing a device whose device instance ID appears in the list you create. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. + +If you disable or do not configure this policy setting, devices can be installed and updated as allowed or prevented by other policy settings. + +Peripherals can be specified by their [device instance ID](https://docs.microsoft.com/windows-hardware/drivers/install/device-instance-ids). Test the configuration prior to rolling it out to ensure it allows the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent installation of devices that match any of these device instance IDs* +- GP name: *DeviceInstall_Instance_IDs_Deny* +- GP path: *System/Device Installation/Device Installation Restrictions* +- GP ADMX file name: *deviceinstallation.admx* + + + + + + +To enable this policy, use the following SyncML. This example prevents Windows from installing compatible devices with device instance IDs of USB\VID_1F75 and USB\VID_0781. To configure multiple classes, use `` as a delimiter. + +``` xml + + + + $CmdID$ + + + ./Device/Vendor/MSFT/Policy/Config/DeviceInstallation/PreventInstallationOfMatchingDeviceInstanceIDs + + + string + + + + + + +``` +To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see if the following is listed near the end of the log: + +``` txt +>>> [Device Installation Restrictions Policy Check] +>>> Section start 2018/11/15 12:26:41.659 +<<< Section end 2018/11/15 12:26:41.751 +<<< [Exit status: SUCCESS] +``` + +You can also block installation and usage of prohibited peripherals by using a custom profile in Intune. + +For example, this custom profile prevents installation of devices with matching device instance IDs. + +![Custom profile](images/custom-profile-prevent-device-instance-ids.png) + +To prevent installation of devices with matching device instance IDs by using custom profile in Intune: +1. Locate the device instance ID. +2. Replace `&` in the device instance IDs with `&`. +For example: +Replace +```USBSTOR\DISK&VEN_SAMSUNG&PROD_FLASH_DRIVE&REV_1100\0376319020002347&0``` +with +```USBSTOR\DISK&VEN_SAMSUNG&PROD_FLASH_DRIVE&REV_1100\0376319020002347&0``` + > [!Note] + > Do not use spaces in the value. +3. Replace the device instance IDs with `&` into the sample SyncML. Add the SyncML into the Intune custom device configuration profile. + + + + + + + +
                              **DeviceInstallation/PreventInstallationOfMatchingDeviceSetupClasses** @@ -558,26 +838,34 @@ For example, this custom profile blocks installation and usage of USB devices wi - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -594,14 +882,14 @@ If you enable this policy setting, Windows is prevented from installing or updat If you disable or do not configure this policy setting, Windows can install and update devices as allowed or prevented by other policy settings. -Peripherals can be specified by their [hardware identity](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it blocks the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. +Peripherals can be specified by their [hardware identity](https://docs.microsoft.com/windows-hardware/drivers/install/device-identification-strings). For a list of common identifier structures, see [Device Identifier Formats](https://docs.microsoft.com/windows-hardware/drivers/install/device-identifier-formats). Test the configuration prior to rolling it out to ensure it blocks the devices expected. Ideally test various instances of the hardware. For example, test multiple USB keys rather than only one. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -612,9 +900,10 @@ ADMX Info: - GP ADMX file name: *deviceinstallation.admx* - -
                              + + + To enable this policy, use the following SyncML. This example prevents Windows from installing: - Floppy Disks, ClassGUID = {4d36e980-e325-11ce-bfc1-08002be10318} @@ -624,7 +913,7 @@ To enable this policy, use the following SyncML. This example prevents Windows f Enclose the class GUID within curly brackets {}. To configure multiple classes, use `` as a delimiter. To apply the policy to matching device classes that are already installed, set DeviceInstall_Classes_Deny_Retroactive to true. -``` syntax +```xml @@ -651,15 +940,21 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i <<< Section end 2018/11/15 12:26:41.751 <<< [Exit status: SUCCESS] ``` + + -Footnote: + + +
                              + +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 4d766ec5f7..8d3fe92592 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -1,12 +1,15 @@ --- title: Policy CSP - DeviceLock description: Policy CSP - DeviceLock -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/08/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - DeviceLock @@ -22,9 +25,6 @@ ms.date: 08/08/2018
                              DeviceLock/AllowIdleReturnWithoutPassword
                              -
                              - DeviceLock/AllowScreenTimeoutWhileLockedUserConfig -
                              DeviceLock/AllowSimpleDevicePassword
                              @@ -43,18 +43,12 @@ ms.date: 08/08/2018
                              DeviceLock/EnforceLockScreenAndLogonImage
                              -
                              - DeviceLock/EnforceLockScreenProvider -
                              DeviceLock/MaxDevicePasswordFailedAttempts
                              DeviceLock/MaxInactivityTimeDeviceLock
                              -
                              - DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay -
                              DeviceLock/MinDevicePasswordComplexCharacters
                              @@ -70,10 +64,7 @@ ms.date: 08/08/2018
                              DeviceLock/PreventLockScreenSlideShow
                              -
                              - DeviceLock/ScreenTimeoutWhileLocked -
                              - +
                              @@ -84,26 +75,34 @@ ms.date: 08/08/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcross markcross markcheck markcheck markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecross mark
                              Educationcross mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -115,13 +114,12 @@ ms.date: 08/08/2018 > [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. +> Currently, this policy is supported only in HoloLens 2, Hololens (1st gen) Commercial Suite, and HoloLens (1st gen) Development Edition. -  Specifies whether the user must input a PIN or password when the device resumes from an idle state. > [!NOTE] -> This policy must be wrapped in an Atomic command. +> This policy must be wrapped in an Atomic command. @@ -135,92 +133,40 @@ The following list shows the supported values:
                              - -**DeviceLock/AllowScreenTimeoutWhileLockedUserConfig** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              check markcheck markcheck markcheck markcheck markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -  -Specifies whether to show a user-configurable setting to control the screen timeout while on the lock screen of Windows 10 Mobile devices. - -> [!NOTE] -> This policy must be wrapped in an Atomic command. - -> [!IMPORTANT] -> If this policy is set to 1 (Allowed), the value set by **DeviceLock/ScreenTimeOutWhileLocked** is ignored. To ensure enterprise control over the screen timeout, set this policy to 0 (Not allowed) and use **DeviceLock/ScreenTimeOutWhileLocked** to set the screen timeout period. - - - -The following list shows the supported values: - -- 0 (default) – Not allowed. -- 1 – Allowed. - - - - -
                              - **DeviceLock/AllowSimpleDevicePassword** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -258,26 +204,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -321,26 +275,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -357,7 +319,7 @@ Specifies whether device lock is enabled. > This policy must be wrapped in an Atomic command. > > Always use the Replace command instead of Add for this policy in Windows 10 for desktop editions. -  + > [!IMPORTANT] @@ -385,12 +347,12 @@ Specifies whether device lock is enabled. > [!Important] > **DevicePasswordEnabled** should not be set to Enabled (0) when WMI is used to set the EAS DeviceLock policies given that it is Enabled by default in Policy CSP for back compat with Windows 8.x. If **DevicePasswordEnabled** is set to Enabled(0) then Policy CSP will return an error stating that **DevicePasswordEnabled** already exists. Windows 8.x did not support DevicePassword policy. When disabling **DevicePasswordEnabled** (1) then this should be the only policy set from the DeviceLock group of policies listed below: > - **DevicePasswordEnabled** is the parent policy of the following: -> - AllowSimpleDevicePassword -> - MinDevicePasswordLength -> - AlphanumericDevicePasswordRequired -> - MinDevicePasswordComplexCharacters  -> - DevicePasswordExpiration -> - DevicePasswordHistory +> - AllowSimpleDevicePassword +> - MinDevicePasswordLength +> - AlphanumericDevicePasswordRequired +> - MinDevicePasswordComplexCharacters  +> - DevicePasswordExpiration +> - DevicePasswordHistory > - MaxDevicePasswordFailedAttempts > - MaxInactivityTimeDeviceLock @@ -412,26 +374,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -471,26 +441,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -530,26 +508,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1cross markcross markHomecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -573,81 +559,40 @@ Value type is a string, which is the full image filepath and filename.
                              - -**DeviceLock/EnforceLockScreenProvider** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck mark1check mark1
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -Added in Windows 10, version 1607. Restricts lock screen image to a specific lock screen provider. Users will not be able change this provider. - -> [!NOTE] -> This policy is only enforced in Windows 10 for mobile devices. - - -Value type is a string, which is the AppID. - - - - -
                              - **DeviceLock/MaxDevicePasswordFailedAttempts** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -694,26 +639,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -748,85 +701,40 @@ The following list shows the supported values:
                              - -**DeviceLock/MaxInactivityTimeDeviceLockWithExternalDisplay** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck mark2check mark2
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -Specifies the maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked while connected to an external display. - -> [!NOTE] -> This policy must be wrapped in an Atomic command. - - - -The following list shows the supported values: - -- An integer X where 0 <= X <= 999. -- 0 (default) - No timeout is defined. The default of "0" is Windows Phone 7.5 parity and is interpreted by as "No timeout is defined." - - - - -
                              - **DeviceLock/MinDevicePasswordComplexCharacters** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -881,7 +789,7 @@ The default value is 1. The following list shows the supported values and actual

                              Desktop Microsoft Accounts

                              1,2

                              - +<p2

                              Desktop Domain Accounts

                              @@ -921,26 +829,34 @@ For additional information about this policy, see [Exchange ActiveSync Policy En - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -973,6 +889,29 @@ The following list shows the supported values: - The default value is 4 for mobile devices and desktop devices. + +The following example shows how to set the minimum password length to 4 characters. + +```xml + + + + $CmdID$ + + + ./Vendor/MSFT/Policy/Config/DeviceLock/MinDevicePasswordLength + + + int + + 4 + + + + + +``` +
                              @@ -983,26 +922,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1036,26 +983,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1075,9 +1030,9 @@ If you enable this setting, users will no longer be able to enable or disable lo > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1098,26 +1053,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcross markcross markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1137,9 +1100,9 @@ If you enable this setting, users will no longer be able to modify slide show se > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1154,65 +1117,14 @@ ADMX Info:
                              - -**DeviceLock/ScreenTimeoutWhileLocked** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. -  -Allows an enterprise to set the duration in seconds for the screen timeout while on the lock screen of Windows 10 Mobile devices. - -Minimum supported value is 10. - -Maximum supported value is 1800. - -The default value is 10. - -Most restricted value is 0. - - - -
                              - -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index 7e1be2a448..5379d5fbac 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -1,17 +1,21 @@ --- title: Policy CSP - Display description: Policy CSP - Display -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/08/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Display +
                              @@ -44,26 +48,34 @@ ms.date: 08/08/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -96,26 +108,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -168,26 +188,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -220,26 +248,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -287,26 +323,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -347,12 +391,14 @@ To validate on Desktop, do the following:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-dmaguard.md b/windows/client-management/mdm/policy-csp-dmaguard.md index 9c1747dae9..08eaddf872 100644 --- a/windows/client-management/mdm/policy-csp-dmaguard.md +++ b/windows/client-management/mdm/policy-csp-dmaguard.md @@ -1,18 +1,21 @@ --- title: Policy CSP - DmaGuard description: Policy CSP - DmaGuard -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 12/17/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - DmaGuard > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
                              @@ -35,26 +38,34 @@ ms.date: 12/17/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -71,7 +82,7 @@ Device memory sandboxing allows the OS to leverage the I/O Memory Management Uni This policy only takes effect when Kernel DMA Protection is supported and enabled by the system firmware. Kernel DMA Protection is a platform feature that cannot be controlled via policy or by end user. It has to be supported by the system at the time of manufacturing. To check if the system supports Kernel DMA Protection, please check the Kernel DMA Protection field in the Summary page of MSINFO32.exe. -> [!Note] +> [!NOTE] > This policy does not apply to 1394/Firewire, PCMCIA, CardBus, or ExpressCard devices. Supported values: @@ -103,14 +114,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index aba6597add..825ac41a15 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -1,16 +1,21 @@ --- title: Policy CSP - Education description: Policy CSP - Education -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Education +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
                              @@ -19,6 +24,9 @@ ms.date: 03/12/2018 ## Education policies
                              +
                              + Education/AllowGraphingCalculator +
                              Education/DefaultPrinterName
                              @@ -31,6 +39,69 @@ ms.date: 03/12/2018
                              +
                              + + +**Education/AllowGraphingCalculator** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
                              + + + +Added in next major release of Windows 10. This policy setting allows you to control whether graphing functionality is available in the Windows Calculator app. If you disable this policy setting, graphing functionality will not be accessible in the Windows Calculator app. If you enable or don't configure this policy setting, you will be able to access graphing functionality. + + +ADMX Info: +- GP English name: *Allow Graphing Calculator* +- GP name: *AllowGraphingCalculator* +- GP path: *Windows Components/Calculator* +- GP ADMX file name: *Programs.admx* + + + +The following list shows the supported values: +- 0 - Disabled +- 1 (default) - Enabled + + +
                              @@ -39,26 +110,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -84,26 +163,34 @@ The policy value is expected to be the name (network host name) of an installed - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -142,26 +229,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -174,18 +269,20 @@ The following list shows the supported values: Added in Windows 10, version 1709. Allows IT Admins to automatically provision printers based on their names (network host names). -The policy value is expected to be a `````` seperated list of printer names. The OS will attempt to search and install the matching printer driver for each listed printer. +The policy value is expected to be a `````` separated list of printer names. The OS will attempt to search and install the matching printer driver for each listed printer.
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index 472aa8161b..4cecf73ce0 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -1,12 +1,15 @@ --- title: Policy CSP - EnterpriseCloudPrint description: Policy CSP - EnterpriseCloudPrint -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - EnterpriseCloudPrint @@ -48,26 +51,34 @@ ms.date: 05/14/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -95,26 +106,34 @@ The default value is an empty string. Otherwise, the value should contain the UR - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -142,26 +161,34 @@ The default value is an empty string. Otherwise, the value should contain a GUID - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -189,26 +216,34 @@ The default value is an empty string. Otherwise, the value should contain a URL. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -236,26 +271,34 @@ The default value is an empty string. Otherwise, the value should contain the UR - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -283,26 +326,34 @@ For Windows Mobile, the default value is 20. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -323,12 +374,14 @@ The default value is an empty string. Otherwise, the value should contain a URL.
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md index 04063822ba..9cdc8a23f1 100644 --- a/windows/client-management/mdm/policy-csp-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-errorreporting.md @@ -1,12 +1,15 @@ --- title: Policy CSP - ErrorReporting description: Policy CSP - ErrorReporting -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - ErrorReporting @@ -45,26 +48,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -94,9 +105,9 @@ If you disable or do not configure this policy setting, then the default consent > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -117,26 +128,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -156,9 +175,9 @@ If you disable or do not configure this policy setting, the Turn off Windows Err > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -179,26 +198,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -222,9 +249,9 @@ See also the Configure Error Reporting policy setting. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -245,26 +272,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -284,9 +319,9 @@ If you disable or do not configure this policy setting, then consent policy sett > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -307,26 +342,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -346,9 +389,9 @@ If you disable or do not configure this policy setting, Windows Error Reporting > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -362,12 +405,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index 991eab8855..85d7cfd540 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -1,12 +1,15 @@ --- title: Policy CSP - EventLogService description: Policy CSP - EventLogService -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 04/16/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - EventLogService @@ -42,26 +45,34 @@ ms.date: 04/16/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -83,9 +94,9 @@ Note: Old events may or may not be retained according to the "Backup log automat > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -106,26 +117,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -145,9 +164,9 @@ If you disable or do not configure this policy setting, the maximum size of the > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -168,26 +187,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -207,9 +234,9 @@ If you disable or do not configure this policy setting, the maximum size of the > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -230,26 +257,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -269,9 +304,9 @@ If you disable or do not configure this policy setting, the maximum size of the > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -285,12 +320,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index c267e4587c..644621a01e 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -1,32 +1,30 @@ --- title: Policy CSP - Experience description: Policy CSP - Experience -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/30/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Experience -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
                              -## Experience policies +## Experience policies
                              Experience/AllowClipboardHistory
                              -
                              - Experience/AllowCopyPaste -
                              Experience/AllowCortana
                              @@ -39,15 +37,9 @@ ms.date: 07/30/2018
                              Experience/AllowManualMDMUnenrollment
                              -
                              - Experience/AllowSIMErrorDialogPromptWhenNoSIM -
                              Experience/AllowSaveAsOfOfficeFiles
                              -
                              - Experience/AllowScreenCapture -
                              Experience/AllowSharingOfOfficeFiles
                              @@ -57,15 +49,9 @@ ms.date: 07/30/2018
                              Experience/AllowTailoredExperiencesWithDiagnosticData
                              -
                              - Experience/AllowTaskSwitcher -
                              Experience/AllowThirdPartySuggestionsInWindowsSpotlight
                              -
                              - Experience/AllowVoiceRecording -
                              Experience/AllowWindowsConsumerFeatures
                              @@ -96,37 +82,48 @@ ms.date: 07/30/2018
                              Experience/PreventUsersFromTurningOnBrowserSyncing
                              +
                              + Experience/ShowLockOnUserTile +
                              -**Experience/AllowClipboardHistory** +**Experience/AllowClipboardHistory** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -145,7 +142,7 @@ Value type is integer. Supported values: -ADMX Info: +ADMX Info: - GP English name: *Allow Clipboard History* - GP name: *AllowClipboardHistory* - GP path: *System/OS Policies* @@ -173,86 +170,39 @@ ADMX Info:
                              -**Experience/AllowCopyPaste** +**Experience/AllowCortana** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcross markcross markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device -
                              - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -Specifies whether copy and paste is allowed. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
                              - - -**Experience/AllowCortana** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcheck markcheck markcheck markcheck markcheck markcheck mark
                              - - [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -269,7 +219,7 @@ Most restricted value is 0. -ADMX Info: +ADMX Info: - GP English name: *Allow Cortana* - GP name: *AllowCortana* - GP path: *Windows Components/Search* @@ -288,31 +238,39 @@ The following list shows the supported values:
                              -**Experience/AllowDeviceDiscovery** +**Experience/AllowDeviceDiscovery** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -342,31 +300,39 @@ The following list shows the supported values:
                              -**Experience/AllowFindMyDevice** +**Experience/AllowFindMyDevice** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2cross markcheck mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscross mark
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -385,7 +351,7 @@ When Find My Device is off, the device and its location are not registered and t -ADMX Info: +ADMX Info: - GP English name: *Turn On/Off Find My Device* - GP name: *FindMy_AllowFindMyDeviceConfig* - GP path: *Windows Components/Find My Device* @@ -404,31 +370,39 @@ The following list shows the supported values:
                              -**Experience/AllowManualMDMUnenrollment** +**Experience/AllowManualMDMUnenrollment** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -460,71 +434,10 @@ The following list shows the supported values:
                              -**Experience/AllowSIMErrorDialogPromptWhenNoSIM** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device +**Experience/AllowSaveAsOfOfficeFiles**
                              - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Specifies whether to display dialog prompt when no SIM card is detected. - - - -The following list shows the supported values: - -- 0 – SIM card dialog prompt is not displayed. -- 1 (default) – SIM card dialog prompt is displayed. - - - - -
                              - - -**Experience/AllowSaveAsOfOfficeFiles** - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - This policy is deprecated. @@ -534,73 +447,8 @@ This policy is deprecated.
                              -**Experience/AllowScreenCapture** +**Experience/AllowSharingOfOfficeFiles** - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Specifies whether screen capture is allowed. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
                              - - -**Experience/AllowSharingOfOfficeFiles** - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - This policy is deprecated. @@ -610,31 +458,39 @@ This policy is deprecated.
                              -**Experience/AllowSyncMySettings** +**Experience/AllowSyncMySettings** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -660,31 +516,39 @@ The following list shows the supported values:
                              -**Experience/AllowTailoredExperiencesWithDiagnosticData** +**Experience/AllowTailoredExperiencesWithDiagnosticData** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2cross markcheck mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscross mark
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -708,7 +572,7 @@ Most restricted value is 0. -ADMX Info: +ADMX Info: - GP English name: *Do not use diagnostic data for tailored experiences* - GP name: *DisableTailoredExperiencesWithDiagnosticData* - GP path: *Windows Components/Cloud Content* @@ -727,85 +591,39 @@ The following list shows the supported values:
                              -**Experience/AllowTaskSwitcher** +**Experience/AllowThirdPartySuggestionsInWindowsSpotlight** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcross markcross markcheck markcheck markHomecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device -
                              - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Allows or disallows task switching on the device. - - - -The following list shows the supported values: - -- 0 – Task switching not allowed. -- 1 (default) – Task switching allowed. - - - - -
                              - - -**Experience/AllowThirdPartySuggestionsInWindowsSpotlight** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcheck mark1check mark1check mark1check mark1cross markcross mark
                              - - [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -824,7 +642,7 @@ Specifies whether to allow app and content suggestions from third-party software -ADMX Info: +ADMX Info: - GP English name: *Do not suggest third-party content in Windows spotlight* - GP name: *DisableThirdPartySuggestions* - GP path: *Windows Components/Cloud Content* @@ -843,87 +661,39 @@ The following list shows the supported values:
                              -**Experience/AllowVoiceRecording** +**Experience/AllowWindowsConsumerFeatures** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcross markcross markcheck markcheck markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device -
                              - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Specifies whether voice recording is allowed for apps. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
                              - - -**Experience/AllowWindowsConsumerFeatures** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcheck markcheck markcross markcross mark
                              - - [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -936,6 +706,7 @@ The following list shows the supported values: > [!NOTE] > This policy is only enforced in Windows 10 for desktop and not supported in Windows 10 Mobile. +> Prior to Windows 10, version 1803, this policy had User scope. This policy allows IT admins to turn on experiences that are typically for consumers only, such as Start suggestions, Membership notifications, Post-OOBE app install and redirect tiles. @@ -944,7 +715,7 @@ Most restricted value is 0. -ADMX Info: +ADMX Info: - GP English name: *Turn off Microsoft consumer experiences* - GP name: *DisableWindowsConsumerFeatures* - GP path: *Windows Components/Cloud Content* @@ -963,31 +734,39 @@ The following list shows the supported values:
                              -**Experience/AllowWindowsSpotlight** +**Experience/AllowWindowsSpotlight** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark1check mark1cross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1008,7 +787,7 @@ Most restricted value is 0. -ADMX Info: +ADMX Info: - GP English name: *Turn off all Windows spotlight features* - GP name: *DisableWindowsSpotlightFeatures* - GP path: *Windows Components/Cloud Content* @@ -1027,31 +806,39 @@ The following list shows the supported values:
                              -**Experience/AllowWindowsSpotlightOnActionCenter** +**Experience/AllowWindowsSpotlightOnActionCenter** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark2check mark2cross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1071,7 +858,7 @@ Most restricted value is 0. -ADMX Info: +ADMX Info: - GP English name: *Turn off Windows Spotlight on Action Center* - GP name: *DisableWindowsSpotlightOnActionCenter* - GP path: *Windows Components/Cloud Content* @@ -1090,31 +877,39 @@ The following list shows the supported values:
                              -**Experience/AllowWindowsSpotlightOnSettings** +**Experience/AllowWindowsSpotlightOnSettings** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark4check mark4Homecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1125,7 +920,7 @@ The following list shows the supported values: -Added in Windows 10, version 1803. This policy allows IT admins to turn off Suggestions in Settings app. These suggestions from Microsoft may show after each OS clean install, upgrade or an on-going basis to help users discover apps/features on Windows or across devices, to make thier experience productive. +Added in Windows 10, version 1803. This policy allows IT admins to turn off Suggestions in Settings app. These suggestions from Microsoft may show after each OS clean install, upgrade or an on-going basis to help users discover apps/features on Windows or across devices, to make their experience productive. - User setting is under Settings -> Privacy -> General -> Show me suggested content in Settings app. - User Setting is changeable on a per user basis. @@ -1133,7 +928,7 @@ Added in Windows 10, version 1803. This policy allows IT admins to turn off Sugg -ADMX Info: +ADMX Info: - GP English name: *Turn off Windows Spotlight on Settings* - GP name: *DisableWindowsSpotlightOnSettings* - GP path: *Windows Components/Cloud Content* @@ -1152,31 +947,39 @@ The following list shows the supported values:
                              -**Experience/AllowWindowsSpotlightWindowsWelcomeExperience** +**Experience/AllowWindowsSpotlightWindowsWelcomeExperience** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark2check mark2cross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1197,7 +1000,7 @@ Most restricted value is 0. -ADMX Info: +ADMX Info: - GP English name: *Turn off the Windows Welcome Experience* - GP name: *DisableWindowsSpotlightWindowsWelcomeExperience* - GP path: *Windows Components/Cloud Content* @@ -1216,31 +1019,39 @@ The following list shows the supported values:
                              -**Experience/AllowWindowsTips** +**Experience/AllowWindowsTips** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck markcheck markcross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1255,7 +1066,7 @@ Enables or disables Windows Tips / soft landing. -ADMX Info: +ADMX Info: - GP English name: *Do not show Windows tips* - GP name: *DisableSoftLanding* - GP path: *Windows Components/Cloud Content* @@ -1274,31 +1085,39 @@ The following list shows the supported values:
                              -**Experience/ConfigureWindowsSpotlightOnLockScreen** +**Experience/ConfigureWindowsSpotlightOnLockScreen** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark1check mark1cross markcross markHomecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1317,7 +1136,7 @@ Allows IT admins to specify whether spotlight should be used on the user's lock -ADMX Info: +ADMX Info: - GP English name: *Configure Windows spotlight on lock screen* - GP name: *ConfigureWindowsSpotlight* - GP path: *Windows Components/Cloud Content* @@ -1337,31 +1156,39 @@ The following list shows the supported values:
                              -**Experience/DoNotShowFeedbackNotifications** +**Experience/DoNotShowFeedbackNotifications** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1380,7 +1207,7 @@ If you disable or do not configure this policy setting, users can control how of -ADMX Info: +ADMX Info: - GP English name: *Do not show feedback notifications* - GP name: *DoNotShowFeedbackNotifications* - GP path: *Data Collection and Preview Builds* @@ -1399,31 +1226,39 @@ The following list shows the supported values:
                              -**Experience/DoNotSyncBrowserSettings** +**Experience/DoNotSyncBrowserSettings** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark5check mark5Homecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1441,7 +1276,7 @@ Related policy: -ADMX Info: +ADMX Info: - GP English name: *Do not sync browser settings* - GP name: *DisableWebBrowserSettingSync* - GP path: *Windows Components/Sync your settings* @@ -1461,13 +1296,13 @@ _**Sync the browser settings automatically**_ _**Prevent syncing of browser settings and prevent users from turning it on**_ -1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off). -2. Set **PreventUsersFromTurningOnBrowserSyncing** to 1 (Prevented/turned off). +1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off). +2. Set **PreventUsersFromTurningOnBrowserSyncing** to 1 (Prevented/turned off). _**Prevent syncing of browser settings and let users turn on syncing**_ -1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off). -2. Set **PreventUsersFromTurningOnBrowserSyncing** to 0 (Allowed/turned on). +1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off). +2. Set **PreventUsersFromTurningOnBrowserSyncing** to 0 (Allowed/turned on). _**Turn syncing off by default but don’t disable**_ @@ -1485,31 +1320,39 @@ _**Turn syncing off by default but don’t disable**_
                              -**Experience/PreventUsersFromTurningOnBrowserSyncing** +**Experience/PreventUsersFromTurningOnBrowserSyncing** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcross markcross markcheck mark5check mark5Homecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1528,7 +1371,7 @@ Related policy: -ADMX Info: +ADMX Info: - GP English name: *Prevent users from turning on browser syncing* - GP name: *PreventUsersFromTurningOnBrowserSyncing* - GP path: *Windows Components/Sync your settings* @@ -1548,13 +1391,13 @@ _**Sync the browser settings automatically**_ _**Prevent syncing of browser settings and prevent users from turning it on**_ -1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off). -2. Set **PreventUsersFromTurningOnBrowserSyncing** to 1 (Prevented/turned off). +1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off). +2. Set **PreventUsersFromTurningOnBrowserSyncing** to 1 (Prevented/turned off). _**Prevent syncing of browser settings and let users turn on syncing**_ -1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off). -2. Set **PreventUsersFromTurningOnBrowserSyncing** to 0 (Allowed/turned on). +1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off). +2. Set **PreventUsersFromTurningOnBrowserSyncing** to 0 (Allowed/turned on). @@ -1571,15 +1414,90 @@ Validation procedure:
                              -Footnote: + +**Experience/ShowLockOnUserTile** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procross mark
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Shows or hides lock from the user tile menu. + +If you enable this policy setting, the lock option is shown in the User Tile menu. + +If you disable this policy setting, the lock option is never shown in the User Tile menu. + +If you do not configure this policy setting, the lock option is shown in the User Tile menu. Users can choose if they want to show the lock in the user tile menu from the Power Options control panel. + + + +ADMX Info: +- GP English name: *Show lock in the user tile menu* +- GP name: *ShowLockOption* +- GP path: *File Explorer* +- GP ADMX file name: *WindowsExplorer.admx* + + + +Supported values: +- false - The lock option is not displayed in the User Tile menu. +- true (default) - The lock option is displayed in the User Tile menu. + + + + + + + + + +
                              + +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. - diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index 5dda241c5f..f32917cdbc 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -1,12 +1,15 @@ --- title: Policy CSP - ExploitGuard description: Policy CSP - ExploitGuard -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - ExploitGuard @@ -33,26 +36,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -63,7 +74,7 @@ ms.date: 03/12/2018 -Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see [Protect devices from exploits with Windows Defender Exploit Guard](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard) and [Import, export, and deploy Exploit Protection configurations](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml). +Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see [Protect devices from exploits](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/exploit-protection) and [Import, export, and deploy Exploit Protection configurations](https://docs.microsoft.com/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml). The system settings require a reboot; the application settings do not require a reboot. @@ -80,7 +91,7 @@ ADMX Info: Here is an example: -``` syntax +```xml @@ -107,12 +118,14 @@ Here is an example:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md index d427a7ed5c..ddc419671c 100644 --- a/windows/client-management/mdm/policy-csp-fileexplorer.md +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -1,17 +1,21 @@ --- title: Policy CSP - FileExplorer description: Policy CSP - FileExplorer -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 04/16/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - FileExplorer +
                              @@ -35,26 +39,34 @@ ms.date: 04/16/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -70,9 +82,9 @@ Disabling data execution prevention can allow certain legacy plug-in application > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -93,26 +105,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -128,9 +148,9 @@ Disabling heap termination on corruption can allow certain legacy plug-in applic > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -144,12 +164,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-games.md b/windows/client-management/mdm/policy-csp-games.md index 4b7c9efb2d..b114cb8f6a 100644 --- a/windows/client-management/mdm/policy-csp-games.md +++ b/windows/client-management/mdm/policy-csp-games.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Games description: Policy CSP - Games -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Games @@ -33,26 +36,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -76,12 +87,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index a74fbeccf3..16d5bde9bd 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Handwriting description: Policy CSP - Handwriting -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/09/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Handwriting @@ -33,26 +36,34 @@ ms.date: 08/09/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3cross markcheck mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscross mark
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -90,12 +101,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index 823af29f0b..6e0db74b13 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -1,12 +1,15 @@ --- title: Policy CSP - InternetExplorer description: Policy CSP - InternetExplorer -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - InternetExplorer @@ -40,6 +43,9 @@ ms.date: 05/14/2018
                              InternetExplorer/AllowEnhancedProtectedMode
                              +
                              + InternetExplorer/AllowEnhancedSuggestionsInAddressBar +
                              InternetExplorer/AllowEnterpriseModeFromToolsMenu
                              @@ -106,6 +112,9 @@ ms.date: 05/14/2018
                              InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses
                              +
                              + InternetExplorer/DisableActiveXVersionListAutoDownload +
                              InternetExplorer/DisableAdobeFlash
                              @@ -115,6 +124,9 @@ ms.date: 05/14/2018
                              InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles
                              +
                              + InternetExplorer/DisableCompatView +
                              InternetExplorer/DisableConfiguringHistory
                              @@ -133,12 +145,18 @@ ms.date: 05/14/2018
                              InternetExplorer/DisableEncryptionSupport
                              +
                              + InternetExplorer/DisableFeedsBackgroundSync +
                              InternetExplorer/DisableFirstRunWizard
                              InternetExplorer/DisableFlipAheadFeature
                              +
                              + InternetExplorer/DisableGeolocation +
                              InternetExplorer/DisableHomePageChange
                              @@ -166,6 +184,9 @@ ms.date: 05/14/2018
                              InternetExplorer/DisableUpdateCheck
                              +
                              + InternetExplorer/DisableWebAddressAutoComplete +
                              InternetExplorer/DoNotAllowActiveXControlsInProtectedMode
                              @@ -559,6 +580,9 @@ ms.date: 05/14/2018
                              InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses
                              +
                              + InternetExplorer/NewTabDefaultPage +
                              InternetExplorer/NotificationBarInternetExplorerProcesses
                              @@ -768,26 +792,34 @@ ms.date: 05/14/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -808,9 +840,9 @@ If you disable or do not configure this policy setting, the user can configure t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -831,26 +863,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -871,9 +911,9 @@ If you disable or do not configure this policy setting, ActiveX Filtering is not > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -894,26 +934,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -940,9 +988,9 @@ If you disable this policy setting, the list is deleted. The 'Deny all add-ons u > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -963,26 +1011,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1004,9 +1060,9 @@ If you do not configure this setting, the user has the freedom of turning on Aut > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1027,26 +1083,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1067,9 +1131,9 @@ If you disable or do not configure this policy setting, the user can choose whet > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1090,26 +1154,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1134,9 +1206,9 @@ If the "Prevent access to Delete Browsing History" policy setting is enabled, th > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1157,26 +1229,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1199,9 +1279,9 @@ If you do not configure this policy, users will be able to turn on or turn off E > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1216,32 +1296,124 @@ ADMX Info:
                              + +**InternetExplorer/AllowEnhancedSuggestionsInAddressBar** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
                              + + + +This policy setting allows Internet Explorer to provide enhanced suggestions as the user types in the Address bar. To provide enhanced suggestions, the user's keystrokes are sent to Microsoft through Microsoft services. + +If you enable this policy setting, users receive enhanced suggestions while typing in the Address bar. In addition, users cannot change the Suggestions setting on the Settings charm. + +If you disable this policy setting, users do not receive enhanced suggestions while typing in the Address bar. In addition, users cannot change the Suggestions setting on the Settings charm. + +If you do not configure this policy setting, users can change the Suggestions setting on the Settings charm. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar* +- GP name: *AllowServicePoweredQSA* +- GP path: *Windows Components/Internet Explorer* +- GP ADMX file name: *inetres.admx* + + + +Supported values: +- 0 - Disabled +- 1 - Enabled (Default) + + + + + + + + + +
                              + **InternetExplorer/AllowEnterpriseModeFromToolsMenu** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1262,9 +1434,9 @@ If you disable or don't configure this policy setting, the menu option won't app > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1285,26 +1457,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1325,9 +1505,9 @@ If you disable or don't configure this policy setting, Internet Explorer opens a > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1348,26 +1528,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1389,9 +1577,9 @@ If you disable this policy, system defaults will be used. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1412,26 +1600,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1452,9 +1648,9 @@ If you disable or do not configure this policy setting, the user can add and rem > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1475,26 +1671,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1517,9 +1721,9 @@ If you do not configure this policy setting, Internet Explorer uses an Internet > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1540,26 +1744,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1586,9 +1798,9 @@ Note. It is recommended to configure template policy settings in one Group Polic > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1609,26 +1821,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1655,9 +1875,9 @@ Note. It is recommended to configure template policy settings in one Group Polic > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1678,26 +1898,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1724,9 +1952,9 @@ Note. It is recommended to configure template policy settings in one Group Polic > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1747,26 +1975,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1793,9 +2029,9 @@ Note. It is recommended to configure template policy settings in one Group Polic > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1816,26 +2052,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1862,9 +2106,9 @@ Note. It is recommended to configure template policy settings in one Group Polic > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1885,26 +2129,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1931,9 +2183,9 @@ Note. It is recommended to configure template policy settings in one Group Polic > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1954,26 +2206,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2000,9 +2260,9 @@ Note. It is recommended to configure template policy settings in one Group Polic > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2023,26 +2283,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2063,9 +2331,9 @@ If you disable or do not configure this policy setting, Internet Explorer does n > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2086,26 +2354,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2123,23 +2399,23 @@ Internet Explorer has 4 security zones, numbered 1-4, and these are used by this If you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site.  For each entry that you add to the list, enter the following information: -Valuename – A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include a specific protocol. For example, if you enter http://www.contoso.com as the valuename, other protocols are not affected. If you enter just www.contoso.com, then all protocols are affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict. +Valuename – A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include a specific protocol. For example, if you enter as the valuename, other protocols are not affected. If you enter just www.contoso.com, then all protocols are affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict. Value - A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4. If you disable or do not configure this policy, users may choose their own site-to-zone assignments. -> [!Note] +> [!NOTE] > This policy is a list that contains the site and index value. -The list is a set of pairs of strings. Each string is seperated by F000. Each pair of strings is stored as a registry name and value. The registry name is the site and the value is an index. The index has to be sequential. See an example below. +The list is a set of pairs of strings. Each string is separated by F000. Each pair of strings is stored as a registry name and value. The registry name is the site and the value is an index. The index has to be sequential. See an example below. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2151,7 +2427,7 @@ ADMX Info: -```syntax +```xml 2 @@ -2172,7 +2448,7 @@ ADMX Info: Value and index pairs in the SyncML example: - http://adfs.contoso.org 1 -- http://microsoft.com 2 +- https://microsoft.com 2 @@ -2185,26 +2461,34 @@ Value and index pairs in the SyncML example: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2227,9 +2511,9 @@ If you do not configure this policy, users can choose to run or install files wi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2250,26 +2534,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2292,9 +2584,9 @@ If you do not configure this policy setting, the user can turn on and turn off t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2315,26 +2607,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2361,9 +2661,9 @@ Note. It is recommended to configure template policy settings in one Group Polic > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2384,26 +2684,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2430,9 +2738,9 @@ Note. It is recommended to configure template policy settings in one Group Polic > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2453,26 +2761,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2499,9 +2815,9 @@ Note. It is recommended to configure template policy settings in one Group Polic > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2522,26 +2838,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2564,9 +2888,9 @@ If you do not configure this policy setting, Internet Explorer will not check se > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2587,26 +2911,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2629,9 +2961,9 @@ If you do not configure this policy, Internet Explorer will not check the digita > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2652,26 +2984,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2696,9 +3036,9 @@ If you do not configure this policy setting, Internet Explorer requires consiste > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2713,32 +3053,122 @@ ADMX Info:
                              + +**InternetExplorer/DisableActiveXVersionListAutoDownload** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
                              + + + +This setting determines whether IE automatically downloads updated versions of Microsoft’s VersionList.XML. IE uses this file to determine whether an ActiveX control should be stopped from loading. + +> [!Caution] +> If you enable this setting, IE stops downloading updated versions of VersionList.XML. Turning off this automatic download breaks the [out-of-date ActiveX control blocking feature](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking) by not letting the version list update with newly outdated controls, potentially compromising the security of your computer. + +If you disable or do not configure this setting, IE continues to download updated versions of VersionList.XML. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off automatic download of the ActiveX VersionList* +- GP name: *VersionListAutomaticDownloadDisable* +- GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* +- GP ADMX file name: *inetres.admx* + + + +Supported values: +- 0 - Enabled +- 1 - Disabled (Default) + + + + + + + + + +
                              + **InternetExplorer/DisableAdobeFlash** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2761,9 +3191,9 @@ Note that Adobe Flash can still be disabled through the "Add-on List" and "Deny > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2784,26 +3214,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2815,18 +3253,18 @@ ADMX Info: -This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter prevents the user from browsing to or downloading from sites that are known to host malicious content. SmartScreen Filter also prevents the execution of files that are known to be malicious. +This policy setting determines whether the user can bypass warnings from Windows Defender SmartScreen. Windows Defender SmartScreen prevents the user from browsing to or downloading from sites that are known to host malicious content. Windows Defender SmartScreen also prevents the execution of files that are known to be malicious. -If you enable this policy setting, SmartScreen Filter warnings block the user. +If you enable this policy setting, Windows Defender SmartScreen warnings block the user. -If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings. +If you disable or do not configure this policy setting, the user can bypass Windows Defender SmartScreen warnings. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2847,26 +3285,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2878,18 +3324,18 @@ ADMX Info: -This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter warns the user about executable files that Internet Explorer users do not commonly download from the Internet. +This policy setting determines whether the user can bypass warnings from Windows Defender SmartScreen. Windows Defender SmartScreen warns the user about executable files that Internet Explorer users do not commonly download from the Internet. -If you enable this policy setting, SmartScreen Filter warnings block the user. +If you enable this policy setting, Windows Defender SmartScreen warnings block the user. -If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings. +If you disable or do not configure this policy setting, the user can bypass Windows Defender SmartScreen warnings. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2904,32 +3350,122 @@ ADMX Info:
                              + +**InternetExplorer/DisableCompatView** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
                              + + + +This policy setting controls the Compatibility View feature, which allows users to fix website display problems that they may encounter while browsing. + +If you enable this policy setting, the user cannot use the Compatibility View button or manage the Compatibility View sites list. + +If you disable or do not configure this policy setting, the user can use the Compatibility View button and manage the Compatibility View sites list. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Compatibility View* +- GP name: *CompatView_DisableList* +- GP path: *Windows Components/Internet Explorer/Compatibility View* +- GP ADMX file name: *inetres.admx* + + + +Supported values: +- 0 - Disabled (Default) +- 1 - Enabled + + + + + + + + + +
                              + **InternetExplorer/DisableConfiguringHistory** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2950,9 +3486,9 @@ If you disable or do not configure this policy setting, a user can set the numbe > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -2973,26 +3509,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3013,9 +3557,9 @@ If you disable or do not configure this policy setting, the crash detection feat > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3036,26 +3580,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3078,9 +3630,9 @@ If you do not configure this policy setting, the user can choose to participate > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3101,26 +3653,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3145,9 +3705,9 @@ If the "Prevent access to Delete Browsing History" policy setting is enabled, th > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3168,26 +3728,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3208,9 +3776,9 @@ If you disable or do not configure this policy setting, the user can set the Fee > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3231,26 +3799,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3273,9 +3849,9 @@ Note: SSL 2.0 is off by default and is no longer supported starting with Windows > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3290,32 +3866,122 @@ ADMX Info:
                              + +**InternetExplorer/DisableFeedsBackgroundSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
                              + + + +This policy setting allows you to choose whether or not to have background synchronization for feeds and Web Slices. + +If you enable this policy setting, the ability to synchronize feeds and Web Slices in the background is turned off. + +If you disable or do not configure this policy setting, the user can synchronize feeds and Web Slices in the background. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off background synchronization for feeds and Web Slices* +- GP name: *Disable_Background_Syncing* +- GP path: *Windows Components/RSS Feeds* +- GP ADMX file name: *inetres.admx* + + + +Supported values: +- 0 - Enabled (Default) +- 1 - Disabled + + + + + + + + + +
                              + **InternetExplorer/DisableFirstRunWizard** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3340,9 +4006,9 @@ If you disable or do not configure this policy setting, Internet Explorer may ru > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3363,26 +4029,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3407,9 +4081,9 @@ If you don't configure this setting, users can turn this behavior on or off, usi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3424,32 +4098,124 @@ ADMX Info:
                              + +**InternetExplorer/DisableGeolocation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
                              + + + +This policy setting allows you to disable browser geolocation support. This prevents websites from requesting location data about the user. + +If you enable this policy setting, browser geolocation support is turned off. + +If you disable this policy setting, browser geolocation support is turned on. + +If you do not configure this policy setting, browser geolocation support can be turned on or off in Internet Options on the Privacy tab. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off browser geolocation* +- GP name: *GeolocationDisable* +- GP path: *Windows Components/Internet Explorer* +- GP ADMX file name: *inetres.admx* + + + +Supported values: +- 0 - Disabled (Default) +- 1 - Enabled + + + + + + + + + +
                              + **InternetExplorer/DisableHomePageChange** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3469,9 +4235,9 @@ If you disable or do not configure this policy setting, the Home page box is ena > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3492,26 +4258,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3532,9 +4306,9 @@ If you disable or do not configure this policy setting, the user can choose to i > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3555,26 +4329,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3599,9 +4381,9 @@ If you do not configure this policy setting, InPrivate Browsing can be turned on > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3622,26 +4404,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3666,9 +4456,9 @@ If you don't configure this policy setting, users can turn this feature on or of > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3689,26 +4479,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3729,9 +4527,9 @@ If you disable or do not configure this policy setting, the user can configure p > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3752,26 +4550,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3792,9 +4598,9 @@ If you disable or do not configure this policy setting, the user can change the > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3815,26 +4621,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3857,9 +4671,9 @@ Note: If the “Disable Changing Home Page Settings” policy is enabled, the us > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3880,26 +4694,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3920,9 +4742,9 @@ If you disable or do not configure this policy setting, the feature is turned on > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -3943,26 +4765,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3984,9 +4814,9 @@ This policy is intended to help the administrator maintain version control for I > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4001,32 +4831,124 @@ ADMX Info:
                              + +**InternetExplorer/DisableWebAddressAutoComplete** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
                              + + + +This AutoComplete feature suggests possible matches when users are entering Web addresses in the browser address bar. + +If you enable this policy setting, users are not suggested matches when entering Web addresses. The user cannot change the auto-complete for web-address setting. + +If you disable this policy setting, users are suggested matches when entering Web addresses. The user cannot change the auto-complete for web-address setting. + +If you do not configure this policy setting, users can choose to turn the auto-complete setting for web-addresses on or off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the auto-complete feature for web addresses* +- GP name: *RestrictWebAddressSuggest* +- GP path: *Windows Components/Internet Explorer* +- GP ADMX file name: *inetres.admx* + + + +Supported values: +- yes - Disabled (Default) +- no - Enabled + + + + + + + + + +
                              + **InternetExplorer/DoNotAllowActiveXControlsInProtectedMode** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4051,9 +4973,9 @@ If you disable or do not configure this policy setting, Internet Explorer notifi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4074,26 +4996,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4119,9 +5049,9 @@ Also, see the "Security zones: Use only machine settings" policy. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4142,26 +5072,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4187,9 +5125,9 @@ Also, see the "Security zones: Use only machine settings" policy. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4210,26 +5148,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4252,9 +5198,9 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4275,26 +5221,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4321,9 +5275,9 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4344,26 +5298,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4386,9 +5348,9 @@ If you do not configure this policy setting, users choose whether to force local > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4409,26 +5371,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4451,9 +5421,9 @@ If you do not configure this policy setting, users choose whether network paths > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4474,26 +5444,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4516,9 +5494,9 @@ If you do not configure this policy setting, users cannot load a page in the zon > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4539,26 +5517,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4581,9 +5567,9 @@ If you do not configure this policy setting, ActiveX control installations will > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4604,26 +5590,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4644,9 +5638,9 @@ If you disable or do not configure this setting, file downloads that are not use > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4667,26 +5661,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4711,9 +5713,9 @@ If you do not configure this policy setting, a script can perform a clipboard op > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4734,26 +5736,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4776,9 +5786,9 @@ If you do not configure this policy setting, users can drag files or copy and pa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4799,26 +5809,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4841,9 +5859,9 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4864,26 +5882,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4906,9 +5932,9 @@ If you do not configure this policy setting, Web sites from less privileged zone > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4929,26 +5955,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4971,9 +6005,9 @@ If you do not configure this policy setting, the user can decide whether to load > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -4994,26 +6028,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5036,9 +6078,9 @@ If you do not configure this policy setting, Internet Explorer will execute unsi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5059,26 +6101,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5099,9 +6149,9 @@ If you disable this policy setting, the user does not see the per-site ActiveX p > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5122,26 +6172,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5162,9 +6220,9 @@ If you disable this policy setting, the TDC Active X control will run from all s > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5185,26 +6243,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5227,9 +6293,9 @@ If you do not configure this policy setting, the possible harmful actions contai > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5250,26 +6316,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5292,9 +6366,9 @@ If you do not configure this policy setting, the user can enable or disable scri > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5315,26 +6389,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5357,9 +6439,9 @@ If you do not configure this policy setting, the user can enable or disable scri > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5380,26 +6462,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5411,22 +6501,22 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5447,26 +6537,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5487,9 +6585,9 @@ If you disable or do not configure this policy setting, script is not allowed to > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5510,26 +6608,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5552,9 +6658,9 @@ If you do not configure this policy setting, users can preserve information in t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5575,26 +6681,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5619,9 +6733,9 @@ If you do not configure or disable this policy setting, VBScript is prevented fr > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5642,26 +6756,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5684,9 +6806,9 @@ If you don't configure this policy setting, Internet Explorer always checks with > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5707,26 +6829,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5749,9 +6879,9 @@ If you do not configure this policy setting, users are queried whether to downlo > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5772,26 +6902,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5814,9 +6952,9 @@ If you do not configure this policy setting, users cannot run unsigned controls. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5837,26 +6975,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5877,9 +7023,9 @@ If you disable this policy setting, the XSS Filter is turned off for sites in th > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5900,26 +7046,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -5944,9 +7098,9 @@ In Internet Explorer 9 and earlier versions, if you disable this policy or do no > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -5967,26 +7121,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6011,9 +7173,9 @@ In Internet Explorer 9 and earlier versions, if you disable this policy setting > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6034,26 +7196,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6076,9 +7246,9 @@ If you do not configure this policy setting, the MIME Sniffing Safety Feature wi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6099,26 +7269,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6141,9 +7319,9 @@ If you do not configure this policy setting, the user can turn on or turn off Pr > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6164,26 +7342,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6206,9 +7392,9 @@ If you do not configure this policy setting, the user can choose whether path in > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6229,26 +7415,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6273,9 +7467,9 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6296,26 +7490,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Business
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + @@ -6329,26 +7531,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6377,9 +7587,9 @@ If you do not configure this policy setting, the permission is set to High Safet > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6400,26 +7610,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6442,9 +7660,9 @@ If you do not configure this policy setting, users are queried to choose whether > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6465,26 +7683,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6515,9 +7741,9 @@ If you do not configure this policy setting, logon is set to Automatic logon onl > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6538,26 +7764,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6571,18 +7805,18 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6603,26 +7837,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6645,9 +7887,9 @@ If you do not configure this policy setting, Internet Explorer will execute sign > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6668,26 +7910,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6710,9 +7960,9 @@ If you do not configure this policy setting, the user can configure how the comp > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6733,26 +7983,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6775,9 +8033,9 @@ If you do not configure this policy setting, most unwanted pop-up windows are pr > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6798,26 +8056,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6840,9 +8106,9 @@ If you do not configure this policy setting, users are queried to choose whether > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6863,26 +8129,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6905,9 +8179,9 @@ If you do not configure this policy setting, users will receive a prompt when a > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6928,26 +8202,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -6968,9 +8250,9 @@ If you disable or do not configure this setting, users will receive a file downl > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -6991,26 +8273,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7033,9 +8323,9 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7056,26 +8346,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7098,9 +8396,9 @@ If you do not configure this policy setting, Web sites from less privileged zone > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7121,26 +8419,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7163,9 +8469,9 @@ If you do not configure this policy setting, Internet Explorer will execute unsi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7186,26 +8492,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7228,9 +8542,9 @@ If you do not configure this policy setting, the user can enable or disable scri > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7251,26 +8565,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7282,22 +8604,22 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7318,26 +8640,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7360,9 +8690,9 @@ If you do not configure this policy setting, users can preserve information in t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7383,26 +8713,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7425,9 +8763,9 @@ If you don't configure this policy setting, Internet Explorer won't check with y > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7448,26 +8786,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7492,9 +8838,9 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7515,26 +8861,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7563,9 +8917,9 @@ If you do not configure this policy setting, the permission is set to Medium Saf > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7586,26 +8940,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7619,18 +8981,18 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7651,26 +9013,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7693,9 +9063,9 @@ If you do not configure this policy setting, users can load a page in the zone t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7716,26 +9086,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7758,9 +9136,9 @@ If you do not configure this policy setting, users will receive a prompt when a > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7781,26 +9159,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7821,9 +9207,9 @@ If you disable or do not configure this setting, users will receive a file downl > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7844,26 +9230,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7886,9 +9280,9 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7909,26 +9303,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -7951,9 +9353,9 @@ If you do not configure this policy setting, the possibly harmful navigations ar > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -7974,26 +9376,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8016,9 +9426,9 @@ If you do not configure this policy setting, Internet Explorer will not execute > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8039,26 +9449,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8081,9 +9499,9 @@ If you do not configure this policy setting, the user can enable or disable scri > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8104,26 +9522,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8135,22 +9561,22 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8171,26 +9597,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8213,9 +9647,9 @@ If you do not configure this policy setting, users can preserve information in t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8236,26 +9670,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8278,9 +9720,9 @@ If you don't configure this policy setting, Internet Explorer won't check with y > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8301,26 +9743,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8345,9 +9795,9 @@ If you do not configure this policy setting, users are queried whether to allow > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8368,26 +9818,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8416,9 +9874,9 @@ If you do not configure this policy setting, the permission is set to Medium Saf > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8439,26 +9897,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8472,18 +9938,18 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8504,26 +9970,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8546,9 +10020,9 @@ If you do not configure this policy setting, users cannot load a page in the zon > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8569,26 +10043,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8611,9 +10093,9 @@ If you do not configure this policy setting, ActiveX control installations will > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8634,26 +10116,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8674,9 +10164,9 @@ If you disable or do not configure this setting, file downloads that are not use > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8697,26 +10187,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8739,9 +10237,9 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8762,26 +10260,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8804,9 +10310,9 @@ If you do not configure this policy setting, the possibly harmful navigations ar > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8827,26 +10333,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8869,9 +10383,9 @@ If you do not configure this policy setting, Internet Explorer will not execute > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8892,26 +10406,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8934,9 +10456,9 @@ If you do not configure this policy setting, the user can enable or disable scri > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -8957,26 +10479,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -8988,22 +10518,22 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9024,26 +10554,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9066,9 +10604,9 @@ If you do not configure this policy setting, users can preserve information in t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9089,26 +10627,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9133,9 +10679,9 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9156,26 +10702,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9204,9 +10758,9 @@ If you do not configure this policy setting, Java applets are disabled. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9227,26 +10781,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9260,18 +10822,18 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9292,26 +10854,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9340,9 +10910,9 @@ If you do not configure this policy setting, Java applets are disabled. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9363,26 +10933,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9405,9 +10983,9 @@ If you do not configure this policy setting, users are queried to choose whether > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9428,26 +11006,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9470,9 +11056,9 @@ If you do not configure this policy setting, ActiveX control installations will > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9493,26 +11079,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9533,9 +11127,9 @@ If you disable or do not configure this setting, file downloads that are not use > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9556,26 +11150,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9598,9 +11200,9 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9621,26 +11223,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9663,9 +11273,9 @@ If you do not configure this policy setting, the possibly harmful navigations ar > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9686,26 +11296,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9728,9 +11346,9 @@ If you do not configure this policy setting, Internet Explorer will not execute > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9751,26 +11369,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9793,9 +11419,9 @@ If you do not configure this policy setting, the user can enable or disable scri > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9816,26 +11442,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9847,22 +11481,22 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9883,26 +11517,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9925,9 +11567,9 @@ If you do not configure this policy setting, users can preserve information in t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -9948,26 +11590,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -9992,9 +11642,9 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10015,26 +11665,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10048,18 +11706,18 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10080,26 +11738,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10122,9 +11788,9 @@ If you do not configure this policy setting, users can load a page in the zone t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10145,26 +11811,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10187,9 +11861,9 @@ If you do not configure this policy setting, ActiveX control installations will > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10210,26 +11884,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10250,9 +11932,9 @@ If you disable or do not configure this setting, file downloads that are not use > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10273,26 +11955,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10315,9 +12005,9 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10338,26 +12028,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10380,9 +12078,9 @@ If you do not configure this policy setting, the possibly harmful navigations ar > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10403,26 +12101,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10445,9 +12151,9 @@ If you do not configure this policy setting, Internet Explorer will not execute > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10468,26 +12174,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10510,9 +12224,9 @@ If you do not configure this policy setting, the user can enable or disable scri > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10533,26 +12247,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10564,22 +12286,22 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10600,26 +12322,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10642,9 +12372,9 @@ If you do not configure this policy setting, users can preserve information in t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10665,26 +12395,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10709,9 +12447,9 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10732,26 +12470,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10780,9 +12526,9 @@ If you do not configure this policy setting, Java applets are disabled. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10803,26 +12549,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10836,18 +12590,18 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10868,26 +12622,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10910,9 +12672,9 @@ If you do not configure this policy setting, users cannot load a page in the zon > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10933,26 +12695,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -10975,9 +12745,9 @@ If you do not configure this policy setting, ActiveX control installations will > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -10998,26 +12768,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11038,9 +12816,9 @@ If you disable or do not configure this setting, file downloads that are not use > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11061,26 +12839,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11103,9 +12889,9 @@ If you do not configure this policy setting, users are queried whether to allow > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11126,26 +12912,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11168,9 +12962,9 @@ If you do not configure this policy setting, the possibly harmful navigations ar > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11191,26 +12985,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11233,9 +13035,9 @@ If you do not configure this policy setting, Internet Explorer will not execute > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11256,26 +13058,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11298,9 +13108,9 @@ If you do not configure this policy setting, the user can enable or disable scri > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11321,26 +13131,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11352,22 +13170,22 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11388,26 +13206,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11430,9 +13256,9 @@ If you do not configure this policy setting, users cannot preserve information i > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11453,26 +13279,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11497,9 +13331,9 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11520,26 +13354,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11568,9 +13410,9 @@ If you do not configure this policy setting, Java applets are disabled. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11591,26 +13433,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11633,9 +13483,9 @@ If you do not configure this policy setting, users cannot open other windows and > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11656,26 +13506,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11698,9 +13556,9 @@ If you do not configure this policy setting, users can load a page in the zone t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11721,26 +13579,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11763,9 +13629,9 @@ If you do not configure this policy setting, ActiveX control installations will > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11786,26 +13652,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11826,9 +13700,9 @@ If you disable or do not configure this setting, file downloads that are not use > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11849,26 +13723,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11891,9 +13773,9 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11914,26 +13796,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -11956,9 +13846,9 @@ If you do not configure this policy setting, the possibly harmful navigations ar > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -11979,26 +13869,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12021,9 +13919,9 @@ If you do not configure this policy setting, Internet Explorer will not execute > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12044,26 +13942,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12086,9 +13992,9 @@ If you do not configure this policy setting, the user can enable or disable scri > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12109,26 +14015,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12140,22 +14054,22 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12176,26 +14090,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12218,9 +14140,9 @@ If you do not configure this policy setting, users can preserve information in t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12241,26 +14163,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12285,9 +14215,9 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12308,26 +14238,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12356,9 +14294,9 @@ If you do not configure this policy setting, Java applets are disabled. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12379,26 +14317,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12412,18 +14358,18 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12444,26 +14390,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12486,9 +14440,9 @@ If you do not configure this policy setting, the MK Protocol is prevented for Fi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12509,26 +14463,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12551,9 +14513,9 @@ If you do not configure this policy setting, MIME sniffing will never promote a > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12568,32 +14530,125 @@ ADMX Info:
                              + +**InternetExplorer/NewTabDefaultPage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
                              + + + +This policy setting allows you to specify what is displayed when the user opens a new tab. + +If you enable this policy setting, you can choose which page to display when the user opens a new tab: blank page (about:blank), the first home page, the new tab page or the new tab page with my news feed. + +If you disable or do not configure this policy setting, users can select their preference for this behavior. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify default behavior for a new tab* +- GP name: *NewTabAction* +- GP path: *Windows Components/Internet Explorer* +- GP ADMX file name: *inetres.admx* + + + + +Supported values: +- 0 - NewTab_AboutBlank (about:blank) +- 1 - NewTab_Homepage (Home page) +- 2 - NewTab_AboutTabs (New tab page) +- 3 - NewTab_AboutNewsFeed (New tab page with my news feed) (Default) + + + + + + + + + +
                              + **InternetExplorer/NotificationBarInternetExplorerProcesses** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12616,9 +14671,9 @@ If you do not configure this policy setting, the Notification bar will be displa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12639,26 +14694,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12670,18 +14733,18 @@ ADMX Info: -This policy setting prevents the user from managing SmartScreen Filter, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware. +This policy setting prevents the user from managing Windows Defender SmartScreen, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware. -If you enable this policy setting, the user is not prompted to turn on SmartScreen Filter. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the user. +If you enable this policy setting, the user is not prompted to turn on Windows Defender SmartScreen. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the user. -If you disable or do not configure this policy setting, the user is prompted to decide whether to turn on SmartScreen Filter during the first-run experience. +If you disable or do not configure this policy setting, the user is prompted to decide whether to turn on Windows Defender SmartScreen during the first-run experience. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12702,26 +14765,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12742,9 +14813,9 @@ If you disable or do not configure this policy setting, ActiveX controls can be > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12765,26 +14836,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12807,9 +14886,9 @@ If you do not configure this policy setting, any zone can be protected from zone > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12830,26 +14909,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12872,14 +14959,14 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). ADMX Info: -- GP English name: *Remove "Run this time" button for outdated ActiveX controls in Internet Explorer * +- GP English name: *Remove "Run this time" button for outdated ActiveX controls in Internet Explorer* - GP name: *VerMgmtDisableRunThisTime* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* @@ -12895,26 +14982,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -12937,9 +15032,9 @@ If you do not configure this policy setting, the user's preference will be used > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -12960,26 +15055,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13002,9 +15105,9 @@ If you do not configure this policy setting, the user's preference determines wh > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13025,26 +15128,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13067,9 +15178,9 @@ If you do not configure this policy setting, users cannot load a page in the zon > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13090,26 +15201,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13132,9 +15251,9 @@ If you do not configure this policy setting, script code on pages in the zone is > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13155,26 +15274,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13197,9 +15324,9 @@ If you do not configure this policy setting, ActiveX control installations will > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13220,26 +15347,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13260,9 +15395,9 @@ If you disable or do not configure this setting, file downloads that are not use > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13283,26 +15418,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13325,9 +15468,9 @@ If you do not configure this policy setting, binary and script behaviors are not > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13348,26 +15491,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13392,9 +15543,9 @@ If you do not configure this policy setting, a script cannot perform a clipboard > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13415,26 +15566,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13457,9 +15616,9 @@ If you do not configure this policy setting, users are queried to choose whether > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13480,26 +15639,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13522,9 +15689,9 @@ If you do not configure this policy setting, files are prevented from being down > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13545,26 +15712,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13587,9 +15762,9 @@ If you do not configure this policy setting, users are queried whether to allow > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13610,26 +15785,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13652,9 +15835,9 @@ If you do not configure this policy setting, the possibly harmful navigations ar > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13675,26 +15858,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13717,9 +15908,9 @@ If you do not configure this policy setting, the user can decide whether to load > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13740,26 +15931,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13782,9 +15981,9 @@ If you do not configure this policy setting, a user's browser that loads a page > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13805,26 +16004,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13847,9 +16054,9 @@ If you do not configure this policy setting, Internet Explorer will not execute > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13870,26 +16077,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13910,9 +16125,9 @@ If you disable this policy setting, the user does not see the per-site ActiveX p > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13933,26 +16148,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -13973,9 +16196,9 @@ If you disable this policy setting, the TDC Active X control will run from all s > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -13996,26 +16219,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14038,9 +16269,9 @@ If you do not configure this policy setting, the possible harmful actions contai > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14061,26 +16292,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14103,9 +16342,9 @@ If you do not configure this policy setting, the user can enable or disable scri > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14126,26 +16365,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14168,9 +16415,9 @@ If you do not configure this policy setting, the user can enable or disable scri > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14191,26 +16438,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14222,22 +16477,22 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14258,26 +16513,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14298,9 +16561,9 @@ If you disable or do not configure this policy setting, script is not allowed to > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14321,26 +16584,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14363,9 +16634,9 @@ If you do not configure this policy setting, users cannot preserve information i > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14386,26 +16657,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14430,9 +16709,9 @@ If you do not configure or disable this policy setting, VBScript is prevented fr > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14453,26 +16732,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14495,9 +16782,9 @@ If you don't configure this policy setting, Internet Explorer always checks with > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14518,26 +16805,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14560,9 +16855,9 @@ If you do not configure this policy setting, signed controls cannot be downloade > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14583,26 +16878,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14625,9 +16928,9 @@ If you do not configure this policy setting, users cannot run unsigned controls. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14648,26 +16951,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14688,9 +16999,9 @@ If you disable this policy setting, the XSS Filter is turned off for sites in th > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14711,26 +17022,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14755,9 +17074,9 @@ In Internet Explorer 9 and earlier versions, if you disable this policy or do no > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14778,26 +17097,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14822,9 +17149,9 @@ In Internet Explorer 9 and earlier versions, if you disable this policy setting > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14845,26 +17172,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14887,9 +17222,9 @@ If you do not configure this policy setting, the actions that may be harmful can > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14910,26 +17245,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -14952,9 +17295,9 @@ If you do not configure this policy setting, the user can choose whether path in > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -14975,26 +17318,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15019,9 +17370,9 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15042,26 +17393,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15090,9 +17449,9 @@ If you do not configure this policy setting, Java applets are disabled. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15113,26 +17472,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15155,9 +17522,9 @@ If you do not configure this policy setting, users are prevented from running ap > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15178,26 +17545,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15228,9 +17603,9 @@ If you do not configure this policy setting, logon is set to Prompt for username > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15251,26 +17626,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15293,9 +17676,9 @@ If you do not configure this policy setting, users cannot open other windows and > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15316,26 +17699,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15360,9 +17751,9 @@ If you do not configure this policy setting, controls and plug-ins are prevented > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15383,26 +17774,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15425,9 +17824,9 @@ If you do not configure this policy setting, Internet Explorer will not execute > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15448,26 +17847,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15492,9 +17899,9 @@ If you do not configure this policy setting, script interaction is prevented fro > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15515,26 +17922,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15559,9 +17974,9 @@ If you do not configure this policy setting, scripts are prevented from accessin > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15582,26 +17997,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15624,9 +18047,9 @@ If you do not configure this policy setting, the user can configure how the comp > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15647,26 +18070,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15689,9 +18120,9 @@ If you do not configure this policy setting, the user can turn on or turn off Pr > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15712,26 +18143,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15754,9 +18193,9 @@ If you do not configure this policy setting, most unwanted pop-up windows are pr > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15777,26 +18216,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15819,9 +18266,9 @@ If you do not configure this policy setting, popup windows and other restriction > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15842,26 +18289,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15882,9 +18337,9 @@ If you disable or do not configure this policy setting, the user can configure h > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -15905,26 +18360,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -15948,14 +18411,14 @@ Also, see the "Security zones: Do not allow users to change policies" policy. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). ADMX Info: -- GP English name: *Security Zones: Use only machine settings * +- GP English name: *Security Zones: Use only machine settings* - GP name: *Security_HKLM_only* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -15971,26 +18434,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16011,9 +18482,9 @@ If you disable or do not configure this policy setting, ActiveX controls, includ > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16034,26 +18505,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16076,9 +18555,9 @@ If you do not configure this policy setting, users can load a page in the zone t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16099,26 +18578,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16141,9 +18628,9 @@ If you do not configure this policy setting, users will receive a prompt when a > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16164,26 +18651,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16204,9 +18699,9 @@ If you disable or do not configure this setting, users will receive a file downl > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16227,26 +18722,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16269,9 +18772,9 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16292,26 +18795,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16334,9 +18845,9 @@ If you do not configure this policy setting, a warning is issued to the user tha > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16357,26 +18868,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16399,9 +18918,9 @@ If you do not configure this policy setting, Internet Explorer will execute unsi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16422,26 +18941,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16464,9 +18991,9 @@ If you do not configure this policy setting, the user can enable or disable scri > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16487,26 +19014,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16518,22 +19053,22 @@ ADMX Info: -This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. +This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content. -If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. +If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content. -If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. +If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content. -If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. +If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content. Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16554,26 +19089,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16596,9 +19139,9 @@ If you do not configure this policy setting, users can preserve information in t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16619,26 +19162,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16661,9 +19212,9 @@ If you don't configure this policy setting, Internet Explorer won't check with y > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16684,26 +19235,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16728,9 +19287,9 @@ If you do not configure this policy setting, users are queried whether to allow > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16751,26 +19310,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16799,9 +19366,9 @@ If you do not configure this policy setting, the permission is set to Low Safety > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16822,26 +19389,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -16855,18 +19430,18 @@ ADMX Info: This policy setting allows you to manage the opening of windows and frames and access of applications across different domains. -If you enable this policy setting, users can open windows and frames from othe domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. +If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains. If you disable this policy setting, users cannot open windows and frames to access applications from different domains. -If you do not configure this policy setting, users can open windows and frames from othe domains and access applications from other domains. +If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -16880,12 +19455,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index 276d6b2c9e..200fde9087 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -1,18 +1,21 @@ --- title: Policy CSP - Kerberos description: Policy CSP - Kerberos -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/08/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Kerberos > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
                              @@ -50,26 +53,34 @@ ms.date: 08/08/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -89,9 +100,9 @@ If you disable or do not configure this policy setting, the Kerberos client does > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -112,26 +123,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -150,9 +169,9 @@ If you disable or do not configure this policy setting, the client devices will > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -173,26 +192,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -216,9 +243,9 @@ If you disable or do not configure this policy setting, the client computers in > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -239,26 +266,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -278,9 +313,9 @@ If you disable or do not configure this policy setting, the Kerberos client requ > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -301,26 +336,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -344,9 +387,9 @@ Note: This policy setting configures the existing MaxTokenSize registry value in > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -367,26 +410,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -414,14 +465,14 @@ Devices joined to Azure Active Directory in a hybrid environment need to interac
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-kioskbrowser.md b/windows/client-management/mdm/policy-csp-kioskbrowser.md index 57cbcfb347..83b8e5e9a2 100644 --- a/windows/client-management/mdm/policy-csp-kioskbrowser.md +++ b/windows/client-management/mdm/policy-csp-kioskbrowser.md @@ -1,19 +1,22 @@ --- title: Policy CSP - KioskBrowser description: Policy CSP - KioskBrowser -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - KioskBrowser -These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Microsoft Store app, added in Windows 10 version 1803, that provides IT a way to customize the end user’s browsing experience to fulfill kiosk, signage, and shared device scenarios. Application developers can also create their own kiosk browser and read these policies using [NamedPolicy.GetPolicyFromPath(String, String) Method](https://docs.microsoft.com/uwp/api/windows.management.policies.namedpolicy.getpolicyfrompath#Windows_Management_Policies_NamedPolicy_GetPolicyFromPath_System_String_System_String_). +These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Microsoft Store app, added in Windows 10 version 1803, that provides IT a way to customize the end user's browsing experience to fulfill kiosk, signage, and shared device scenarios. Application developers can also create their own kiosk browser and read these policies using [NamedPolicy.GetPolicyFromPath(String, String) Method](https://docs.microsoft.com/uwp/api/windows.management.policies.namedpolicy.getpolicyfrompath#Windows_Management_Policies_NamedPolicy_GetPolicyFromPath_System_String_System_String_).
                              @@ -54,26 +57,34 @@ These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Mic - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -86,7 +97,7 @@ These policies currently only apply to Kiosk Browser app. Kiosk Browser is a Mic Added in Windows 10, version 1803. List of exceptions to the blocked website URLs (with wildcard support). This is used to configure URLs kiosk browsers are allowed to navigate to, which are a subset of the blocked URLs. -> [!Note] +> [!NOTE] > This policy only applies to the Kiosk Browser app in Microsoft Store. @@ -100,26 +111,34 @@ Added in Windows 10, version 1803. List of exceptions to the blocked website URL - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -132,7 +151,7 @@ Added in Windows 10, version 1803. List of exceptions to the blocked website URL Added in Windows 10, version 1803. List of blocked website URLs (with wildcard support). This is used to configure blocked URLs kiosk browsers cannot navigate to. -> [!Note] +> [!NOTE] > This policy only applies to the Kiosk Browser app in Microsoft Store. @@ -146,26 +165,34 @@ Added in Windows 10, version 1803. List of blocked website URLs (with wildcard s - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -178,7 +205,7 @@ Added in Windows 10, version 1803. List of blocked website URLs (with wildcard s Added in Windows 10, version 1803. Configures the default URL kiosk browsers to navigate on launch and restart. -> [!Note] +> [!NOTE] > This policy only applies to the Kiosk Browser app in Microsoft Store. @@ -192,26 +219,34 @@ Added in Windows 10, version 1803. Configures the default URL kiosk browsers to - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -222,7 +257,7 @@ Added in Windows 10, version 1803. Configures the default URL kiosk browsers to -Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk broswser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. +Shows the Kiosk Browser's end session button. When the policy is enabled, the Kiosk Browser app shows a button to reset the browser. When the user clicks on the button, the app will prompt the user for confirmation to end the session. When the user confirms, the Kiosk browser will clear all browsing data (cache, cookies, etc.) and navigate back to the default URL. @@ -235,26 +270,34 @@ Shows the Kiosk Browser's end session button. When the policy is enabled, the Ki - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -267,7 +310,7 @@ Shows the Kiosk Browser's end session button. When the policy is enabled, the Ki Added in Windows 10, version 1803. Enable/disable kiosk browser's home button. -> [!Note] +> [!NOTE] > This policy only applies to the Kiosk Browser app in Microsoft Store. @@ -281,26 +324,34 @@ Added in Windows 10, version 1803. Enable/disable kiosk browser's home button. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -313,7 +364,7 @@ Added in Windows 10, version 1803. Enable/disable kiosk browser's home button. Added in Windows 10, version 1803. Enable/disable kiosk browser's navigation buttons (forward/back). -> [!Note] +> [!NOTE] > This policy only applies to the Kiosk Browser app in Microsoft Store. @@ -327,26 +378,34 @@ Added in Windows 10, version 1803. Enable/disable kiosk browser's navigation but - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -361,19 +420,21 @@ Added in Windows 10, version 1803. Amount of time in minutes the session is idle The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser. -> [!Note] +> [!NOTE] > This policy only applies to the Kiosk Browser app in Microsoft Store.
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-lanmanworkstation.md index 18bcc8cfed..86575f2093 100644 --- a/windows/client-management/mdm/policy-csp-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-lanmanworkstation.md @@ -1,17 +1,21 @@ --- title: Policy CSP - LanmanWorkstation description: Policy CSP - LanmanWorkstation -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 04/16/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - LanmanWorkstation +
                              @@ -32,26 +36,34 @@ ms.date: 04/16/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -86,12 +98,14 @@ This setting supports a range of values between 0 and 1.
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index 79d19dcdbb..e6cfff8888 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Licensing description: Policy CSP - Licensing -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Licensing @@ -36,26 +39,34 @@ ms.date: 05/14/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -94,26 +105,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -145,12 +164,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index b1594d5d38..9263511ddf 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -1,19 +1,19 @@ --- title: Policy CSP - LocalPoliciesSecurityOptions description: Policy CSP - LocalPoliciesSecurityOptions -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - LocalPoliciesSecurityOptions -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -
                              @@ -24,12 +24,6 @@ ms.date: 06/26/2018
                              LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts
                              -
                              - LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus -
                              -
                              - LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus -
                              LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly
                              @@ -84,18 +78,12 @@ ms.date: 06/26/2018
                              LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
                              -
                              - LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways -
                              LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
                              LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
                              -
                              - LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession -
                              LocalPoliciesSecurityOptions/MicrosoftNetworkServer_DigitallySignCommunicationsAlways
                              @@ -114,9 +102,6 @@ ms.date: 06/26/2018
                              LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
                              -
                              - LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM -
                              LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
                              @@ -126,9 +111,6 @@ ms.date: 06/26/2018
                              LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
                              -
                              - LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients -
                              LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
                              @@ -191,32 +173,43 @@ ms.date: 06/26/2018
                              +> [!NOTE] +> To find data formats (and other policy-related details), see [Policy DDF file](https://docs.microsoft.com/windows/client-management/mdm/policy-ddf-file). + **LocalPoliciesSecurityOptions/Accounts_BlockMicrosoftAccounts** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -255,157 +248,40 @@ The following list shows the supported values:
                              - -**LocalPoliciesSecurityOptions/Accounts_EnableAdministratorAccountStatus** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcheck mark3check mark3check mark3check mark3cross markcross mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -This security setting determines whether the local Administrator account is enabled or disabled. - -If you try to reenable the Administrator account after it has been disabled, and if the current Administrator password does not meet the password requirements, you cannot reenable the account. In this case, an alternative member of the Administrators group must reset the password on the Administrator account. For information about how to reset a password, see To reset a password. -Disabling the Administrator account can become a maintenance issue under certain circumstances. - -Under Safe Mode boot, the disabled Administrator account will only be enabled if the machine is non-domain joined and there are no other local active administrator accounts. If the computer is domain joined the disabled administrator will not be enabled. - -Default: Disabled. - -Value type is integer. Supported operations are Add, Get, Replace, and Delete. - - - -GP Info: -- GP English name: *Accounts: Administrator account status* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - -Valid values: -- 0 - local Administrator account is disabled -- 1 - local Administrator account is enabled - - - - -
                              - - -**LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcheck mark3check mark3check mark3check mark3cross markcross mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -This security setting determines if the Guest account is enabled or disabled. - -Default: Disabled. - -Note: If the Guest account is disabled and the security option Network Access: Sharing and Security Model for local accounts is set to Guest Only, network logons, such as those performed by the Microsoft Network Server (SMB Service), will fail. - -Value type is integer. Supported operations are Add, Get, Replace, and Delete. - - - -GP Info: -- GP English name: *Accounts: Guest account status* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - -Valid values: -- 0 - local Guest account is disabled -- 1 - local Guest account is enabled - - - - -
                              - **LocalPoliciesSecurityOptions/Accounts_LimitLocalAccountUseOfBlankPasswordsToConsoleLogonOnly** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -455,26 +331,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -510,26 +394,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -565,26 +457,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -621,26 +521,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -677,26 +585,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -735,26 +651,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -790,26 +714,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -821,7 +753,7 @@ GP Info: -> [!Warning] +> [!WARNING] > Starting in the version 1809 of Windows, this policy is deprecated. Domain member: Digitally encrypt or sign secure channel data (always) @@ -850,6 +782,15 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + +
                              @@ -860,26 +801,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -891,7 +840,7 @@ GP Info: -> [!Warning] +> [!WARNING] > Starting in the version 1809 of Windows, this policy is deprecated. Domain member: Digitally encrypt secure channel data (when possible) @@ -917,6 +866,15 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + +
                              @@ -927,26 +885,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -958,7 +924,7 @@ GP Info: -> [!Warning] +> [!WARNING] > Starting in the version 1809 of Windows, this policy is deprecated. Domain member: Disable machine account password changes @@ -979,6 +945,15 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + +
                              @@ -989,26 +964,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1048,26 +1031,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1112,26 +1103,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1177,26 +1176,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1243,26 +1250,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1304,26 +1319,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1361,26 +1384,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1416,26 +1447,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1480,109 +1519,40 @@ GP Info:
                              - -**LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcheck mark5check mark5check mark5check mark5
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -Microsoft network client: Digitally sign communications (always) - -This security setting determines whether packet signing is required by the SMB client component. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. - -If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. - -Default: Disabled. - - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - -GP Info: -- GP English name: *Microsoft network client: Digitally sign communications (always)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - - - - - - -
                              - **LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1631,26 +1601,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1686,26 +1664,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1716,6 +1702,10 @@ GP Info: + +> [!WARNING] +> Starting in Windows 10, version 1803, this policy is deprecated. + Microsoft network server: Amount of idle time required before suspending a session This security setting determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is suspended due to inactivity. @@ -1752,26 +1742,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1832,26 +1830,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1904,26 +1910,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1969,26 +1983,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2024,26 +2046,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2079,26 +2109,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2128,104 +2166,40 @@ GP Info:
                              - -**LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcheck mark5check mark5check mark5check mark5
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -Network security: Allow Local System to use computer identity for NTLM - -This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. - -If you enable this policy setting, services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error. - -If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. - -By default, this policy is enabled on Windows 7 and above. - -By default, this policy is disabled on Windows Vista. - -This policy is supported on at least Windows Vista or Windows Server 2008. - -Note: Windows Vista or Windows Server 2008 do not expose this setting in Group Policy. - - - -GP Info: -- GP English name: *Network security: Allow Local System to use computer identity for NTLM* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - - - - - - -
                              - **LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2266,26 +2240,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2326,26 +2308,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2395,101 +2385,40 @@ GP Info:
                              - -**LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcheck mark5check mark5check mark5check mark5
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - -This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: - -Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. -Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. - -Default: - -Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. - -Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - - - -GP Info: -- GP English name: *Network security: Minimum session security for NTLM SSP based (including secure RPC) clients* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - - - - - - - - - - -
                              - **LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2530,26 +2459,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2577,6 +2514,15 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + +
                              @@ -2587,26 +2533,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2638,6 +2592,15 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + +
                              @@ -2648,26 +2611,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2699,6 +2670,15 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + +
                              @@ -2709,26 +2689,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2760,6 +2748,15 @@ GP Info: - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* + + + + + + + + +
                              @@ -2770,26 +2767,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + Recovery console: Allow automatic administrative logon @@ -2816,26 +2821,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2882,26 +2895,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2939,26 +2960,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2988,26 +3017,34 @@ Default: Enabled. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3053,26 +3090,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3120,26 +3165,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3180,26 +3233,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3237,26 +3298,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3294,26 +3363,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3357,26 +3434,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3415,26 +3500,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3472,26 +3565,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3529,26 +3630,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3582,14 +3691,13 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. - diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index afa30b7b07..18d00b257a 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -1,12 +1,15 @@ --- title: Policy CSP - LockDown description: Policy CSP - LockDown -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - LockDown @@ -33,26 +36,34 @@ ms.date: 05/14/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -63,7 +74,7 @@ ms.date: 05/14/2018 -Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. +Added in Windows 10, version 1607. Allows the user to invoke any system user interface by swiping in from any screen edge using touch. The easiest way to verify the policy is to restart the explorer process or to reboot after the policy is applied. And then try to swipe from the right edge of the screen. The desired result is for Action Center to not be invoked by the swipe. You can also enter tablet mode and attempt to swipe from the top of the screen to rearrange. That will also be disabled. @@ -86,12 +97,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md index 37f9f79bdb..8635166d18 100644 --- a/windows/client-management/mdm/policy-csp-maps.md +++ b/windows/client-management/mdm/policy-csp-maps.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Maps description: Policy CSP - Maps -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Maps @@ -36,26 +39,34 @@ ms.date: 05/14/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -89,26 +100,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -143,12 +162,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index 9e96723b2f..aefb521407 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Messaging description: Policy CSP - Messaging -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/09/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Messaging @@ -19,71 +22,12 @@ ms.date: 08/09/2018 ## Messaging policies
                              -
                              - Messaging/AllowMMS -
                              Messaging/AllowMessageSync
                              -
                              - Messaging/AllowRCS -
                              -
                              - - -**Messaging/AllowMMS** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck mark2check mark2
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -Added in Windows 10, version 1703. Enables or disables the MMS send/receive functionality on the device. For enterprises, this policy can be used to disable MMS on devices as part of the auditing or management requirement. - - - -The following list shows the supported values: - -- 0 - Disabled. -- 1 (default) - Enabled. - - - -
                              @@ -92,26 +36,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1cross markcheck mark1check mark1check mark1check mark1Homecross mark
                              Procheck mark1
                              Businesscross mark
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -144,64 +96,14 @@ The following list shows the supported values:
                              - -**Messaging/AllowRCS** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck mark2check mark2
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -Added in Windows 10, version 1703. Enables or disables the RCS send/receive functionality on the device. For enterprises, this policy can be used to disable RCS on devices as part of the auditing or management requirement. - - - -The following list shows the supported values: - -- 0 - Disabled. -- 1 (default) - Enabled. - - - -
                              - -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-mssecurityguide.md b/windows/client-management/mdm/policy-csp-mssecurityguide.md index 5b9f201e0a..598cad17d2 100644 --- a/windows/client-management/mdm/policy-csp-mssecurityguide.md +++ b/windows/client-management/mdm/policy-csp-mssecurityguide.md @@ -1,17 +1,21 @@ --- title: Policy CSP - MSSecurityGuide description: Policy CSP - MSSecurityGuide -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 04/16/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - MSSecurityGuide +
                              @@ -47,26 +51,34 @@ ms.date: 04/16/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -81,9 +93,9 @@ ms.date: 04/16/2018 > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -102,26 +114,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -136,9 +156,9 @@ ADMX Info: > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -157,26 +177,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -191,9 +219,9 @@ ADMX Info: > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -212,26 +240,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -246,9 +282,9 @@ ADMX Info: > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -267,26 +303,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -301,9 +345,9 @@ ADMX Info: > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -322,26 +366,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -356,9 +408,9 @@ ADMX Info: > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -370,12 +422,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-msslegacy.md b/windows/client-management/mdm/policy-csp-msslegacy.md index dd2518efdf..80b3024ffa 100644 --- a/windows/client-management/mdm/policy-csp-msslegacy.md +++ b/windows/client-management/mdm/policy-csp-msslegacy.md @@ -1,17 +1,21 @@ --- title: Policy CSP - MSSLegacy description: Policy CSP - MSSLegacy -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 04/16/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - MSSLegacy +
                              @@ -41,26 +45,34 @@ ms.date: 04/16/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -75,9 +87,9 @@ ms.date: 04/16/2018 > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -96,26 +108,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -130,9 +150,9 @@ ADMX Info: > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -151,26 +171,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -185,9 +213,9 @@ ADMX Info: > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -206,26 +234,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -240,9 +276,9 @@ ADMX Info: > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -254,12 +290,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index 2e5574d79b..3d7afccb49 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -1,12 +1,15 @@ --- title: Policy CSP - NetworkIsolation description: Policy CSP - NetworkIsolation -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - NetworkIsolation @@ -54,26 +57,34 @@ ms.date: 05/14/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -106,26 +117,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -171,26 +190,34 @@ fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -222,26 +249,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -274,26 +309,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -327,26 +370,34 @@ Here are the steps to create canonical domain names: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -379,26 +430,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -430,26 +489,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -475,12 +542,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 2d3a5e15e8..8433af94b3 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Notifications description: Policy CSP - Notifications -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Notifications @@ -39,26 +42,34 @@ ms.date: 05/14/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4Homecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -79,7 +90,7 @@ If you disable or do not configure this policy setting, the client computer will No reboots or service restarts are required for this policy setting to take effect. -> [!Warning] +> [!WARNING] > This policy is designed for zero exhaust. This policy may cause some MDM processes to break because WNS notification is used by the MDM server to send real time tasks to the device, such as remote wipe, unenroll, remote find, and mandatory app installation. When this policy is set to disallow WNS, those real time processes will no longer work and some time-sensitive actions such as remote wipe when the device is stolen or unenrollment when the device is compromised will not work. @@ -112,26 +123,34 @@ Validation: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -174,26 +193,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4Homecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -235,12 +262,14 @@ Validation:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 51f9efc4a5..e5adaec521 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Power description: Policy CSP - Power -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 04/16/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Power @@ -31,6 +34,12 @@ ms.date: 04/16/2018
                              Power/DisplayOffTimeoutPluggedIn
                              +
                              + Power/EnergySaverBatteryThresholdOnBattery +
                              +
                              + Power/EnergySaverBatteryThresholdPluggedIn +
                              Power/HibernateTimeoutOnBattery
                              @@ -43,12 +52,42 @@ ms.date: 04/16/2018
                              Power/RequirePasswordWhenComputerWakesPluggedIn
                              +
                              + Power/SelectLidCloseActionOnBattery +
                              +
                              + Power/SelectLidCloseActionPluggedIn +
                              +
                              + Power/SelectPowerButtonActionOnBattery +
                              +
                              + Power/SelectPowerButtonActionPluggedIn +
                              +
                              + Power/SelectSleepButtonActionOnBattery +
                              +
                              + Power/SelectSleepButtonActionPluggedIn +
                              Power/StandbyTimeoutOnBattery
                              Power/StandbyTimeoutPluggedIn
                              +
                              + Power/TurnOffHybridSleepOnBattery +
                              +
                              + Power/TurnOffHybridSleepPluggedIn +
                              +
                              + Power/UnattendedSleepTimeoutOnBattery +
                              +
                              + Power/UnattendedSleepTimeoutPluggedIn +
                              @@ -60,26 +99,34 @@ ms.date: 04/16/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -99,9 +146,9 @@ If you disable this policy setting, standby states (S1-S3) are not allowed. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -122,26 +169,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -161,9 +216,9 @@ If you disable this policy setting, standby states (S1-S3) are not allowed. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -184,26 +239,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -225,9 +288,9 @@ If the user has configured a slide show to run on the lock screen when the machi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -248,26 +311,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -289,9 +360,9 @@ If the user has configured a slide show to run on the lock screen when the machi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -306,32 +377,187 @@ ADMX Info:
                              + +**Power/EnergySaverBatteryThresholdOnBattery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + + +Added in Windows 10, version 1903. This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + +If you enable this policy setting, you must specify a percentage value that indicates the battery charge level. Energy Saver is automatically turned on at (and below) the specified battery charge level. + +If you disable or do not configure this policy setting, users control this setting. + + + +ADMX Info: +- GP English name: *Energy Saver Battery Threshold (on battery)* +- GP name: *EsBattThresholdDC* +- GP element: *EnterEsBattThreshold* +- GP path: *System/Power Management/Energy Saver Settings* +- GP ADMX file name: *power.admx* + + + +Supported values: 0-100. The default is 70. + + + + + + + + + +
                              + + +**Power/EnergySaverBatteryThresholdPluggedIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + +If you enable this policy setting, you must provide a percentage value that indicates the battery charge level. Energy Saver is automatically turned on at (and below) the specified battery charge level. + +If you disable or do not configure this policy setting, users control this setting. + + + +ADMX Info: +- GP English name: *Energy Saver Battery Threshold (plugged in)* +- GP name: *EsBattThresholdAC* +- GP element: *EnterEsBattThreshold* +- GP path: *System/Power Management/Energy Saver Settings* +- GP ADMX file name: *power.admx* + + + +Supported values: 0-100. The default is 70. + + + + + + + + + +
                              + **Power/HibernateTimeoutOnBattery** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -353,9 +579,9 @@ If the user has configured a slide show to run on the lock screen when the machi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -376,26 +602,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -417,9 +651,9 @@ If the user has configured a slide show to run on the lock screen when the machi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -440,26 +674,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -479,9 +721,9 @@ If you disable this policy setting, the user is not prompted for a password when > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -502,26 +744,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -541,9 +791,9 @@ If you disable this policy setting, the user is not prompted for a password when > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -558,32 +808,514 @@ ADMX Info:
                              + +**Power/SelectLidCloseActionOnBattery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + +ADMX Info: +- GP English name: *Select the lid switch action (on battery)* +- GP name: *DCSystemLidAction_2* +- GP element: *SelectDCSystemLidAction* +- GP path: *System/Power Management/Button Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported lid close switch actions (on battery): +- 0 - Take no action +- 1 - Sleep +- 2 - System hibernate sleep state +- 3 - System shutdown + + + + + + + + + + +
                              + + +**Power/SelectLidCloseActionPluggedIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + +ADMX Info: +- GP English name: *Select the lid switch action (plugged in)* +- GP name: *ACSystemLidAction_2* +- GP element: *SelectACSystemLidAction* +- GP path: *System/Power Management/Button Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported lid close switch actions (plugged in): +- 0 - Take no action +- 1 - Sleep +- 2 - System hibernate sleep state +- 3 - System shutdown + + + + + + + + + + +
                              + + +**Power/SelectPowerButtonActionOnBattery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. This policy setting specifies the action that Windows takes when a user presses the Power button. + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + +ADMX Info: +- GP English name: *Select the Power button action (on battery)* +- GP name: *DCPowerButtonAction_2* +- GP element: *SelectDCPowerButtonAction* +- GP path: *System/Power Management/Button Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported Power button actions (on battery): +- 0 - Take no action +- 1 - Sleep +- 2 - System hibernate sleep state +- 3 - System shutdown + + + + + + + + + + +
                              + + +**Power/SelectPowerButtonActionPluggedIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. This policy setting specifies the action that Windows takes when a user presses the Power button. + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + +ADMX Info: +- GP English name: *Select the Power button action (plugged in)* +- GP name: *ACPowerButtonAction_2* +- GP element: *SelectACPowerButtonAction* +- GP path: *System/Power Management/Button Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported Power button actions (plugged in): +- 0 - Take no action +- 1 - Sleep +- 2 - System hibernate sleep state +- 3 - System shutdown + + + + + + + + + + +
                              + + +**Power/SelectSleepButtonActionOnBattery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. This policy setting specifies the action that Windows takes when a user presses the Sleep button. + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + +ADMX Info: +- GP English name: *Select the Sleep button action (on battery)* +- GP name: *DCSleepButtonAction_2* +- GP element: *SelectDCSleepButtonAction* +- GP path: *System/Power Management/Button Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported Sleep button actions (on battery): +- 0 - Take no action +- 1 - Sleep +- 2 - System hibernate sleep state +- 3 - System shutdown + + + + + + + + + + +
                              + + +**Power/SelectSleepButtonActionPluggedIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. This policy setting specifies the action that Windows takes when a user presses the Sleep button. + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + +ADMX Info: +- GP English name: *Select the Sleep button action (plugged in)* +- GP name: *ACSleepButtonAction_2* +- GP element: *SelectACSleepButtonAction* +- GP path: *System/Power Management/Button Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported Sleep button actions (plugged in): +- 0 - Take no action +- 1 - Sleep +- 2 - System hibernate sleep state +- 3 - System shutdown + + + + + + + + + + +
                              + **Power/StandbyTimeoutOnBattery** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -605,9 +1337,9 @@ If the user has configured a slide show to run on the lock screen when the machi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -628,26 +1360,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -669,9 +1409,9 @@ If the user has configured a slide show to run on the lock screen when the machi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -683,14 +1423,320 @@ ADMX Info: +
                              -Footnote: + +**Power/TurnOffHybridSleepOnBattery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. This policy setting allows you to turn off hybrid sleep. + +If you set this policy setting to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). + +If you set this policy setting to 1 or do not configure this policy setting, users control this setting. + + + +ADMX Info: +- GP English name: *Turn off hybrid sleep (on battery)* +- GP name: *DCStandbyWithHiberfileEnable_2* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported values for Hybrid sleep (on battery): +- 0 - no hibernation file for sleep (default) +- 1 - hybrid sleep + + + + + + + + + + +
                              + + +**Power/TurnOffHybridSleepPluggedIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. This policy setting allows you to turn off hybrid sleep. + +If you set this policy setting to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). + +If you set this policy setting to 1 or do not configure this policy setting, users control this setting. + + + +ADMX Info: +- GP English name: *Turn off hybrid sleep (plugged in)* +- GP name: *ACStandbyWithHiberfileEnable_2* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + + +The following are the supported values for Hybrid sleep (plugged in): +- 0 - no hibernation file for sleep (default) +- 1 - hybrid sleep + + + + + + + + + + +
                              + + +**Power/UnattendedSleepTimeoutOnBattery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. + +If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occurring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + + + +ADMX Info: +- GP English name: *Specify the unattended sleep timeout (on battery)* +- GP name: *UnattendedSleepTimeOutDC* +- GP element: *EnterUnattendedSleepTimeOut* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + +Default value for unattended sleep timeout (on battery): +300 + + + + + + + + + +
                              + + +**Power/UnattendedSleepTimeoutPluggedIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. + +If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occurring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + + + +ADMX Info: +- GP English name: *Specify the unattended sleep timeout (plugged in)* +- GP name: *UnattendedSleepTimeOutAC* +- GP element: *EnterUnattendedSleepTimeOut* +- GP path: *System/Power Management/Sleep Settings* +- GP ADMX file name: *power.admx* + + + +Default value for unattended sleep timeout (plugged in): +300 + + + + + + + + +
                              + +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index ae57e495a7..16ec44e238 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Printers description: Policy CSP - Printers -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Printers @@ -39,26 +42,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -91,9 +102,9 @@ If you disable this policy setting: > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -104,6 +115,18 @@ ADMX Info: - GP ADMX file name: *Printing.admx* + +Example +``` +Name: Point and Print Enable Oma-URI: ./Device/Vendor/MSFT/Policy/Config/Printers/PointAndPrintRestrictions +Data type: String Value: + + + + + +``` +
                              @@ -114,26 +137,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -166,9 +197,9 @@ If you disable this policy setting: > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -189,26 +220,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -230,9 +269,9 @@ Note: This settings takes priority over the setting "Automatically publish new p > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -246,12 +285,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index bccb2e581b..0079133981 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -1,18 +1,19 @@ --- title: Policy CSP - Privacy description: Policy CSP - Privacy -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Privacy -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
                              @@ -51,6 +52,18 @@ ms.date: 08/14/2018
                              Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps
                              +
                              + Privacy/LetAppsAccessBackgroundSpatialPerception +
                              +
                              + Privacy/LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps +
                              +
                              + Privacy/LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps +
                              +
                              + Privacy/LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps +
                              Privacy/LetAppsAccessCalendar
                              @@ -231,6 +244,12 @@ ms.date: 08/14/2018
                              Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps
                              +
                              + Privacy/LetAppsActivateWithVoice +
                              +
                              + Privacy/LetAppsActivateWithVoiceAboveLock +
                              Privacy/LetAppsGetDiagnosticInfo
                              @@ -284,26 +303,34 @@ ms.date: 08/14/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3check mark3check mark3Homecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -316,7 +343,7 @@ ms.date: 08/14/2018 Allows or disallows the automatic acceptance of the pairing and privacy user consent dialog when launching apps. -> [!Note] +> [!NOTE] > There were issues reported with the previous release of this policy and a fix was added in Windows 10, version 1709. @@ -340,26 +367,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -400,26 +435,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -460,26 +503,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -521,26 +572,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -588,26 +647,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3check mark3check mark3Homecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -646,26 +713,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -709,26 +784,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -761,26 +844,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -813,26 +904,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -859,32 +958,322 @@ ADMX Info:
                              + +**Privacy/LetAppsAccessBackgroundSpatialPerception** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecross mark
                              Educationcross mark
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. +> [!NOTE] +> Currently, this policy is supported only in HoloLens 2. + +Specifies whether Windows apps can access the movement of the user's head, hands, motion controllers, and other tracked objects, while the apps are running in the background. + +Value type is integer. + + + +ADMX Info: +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 (default) – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
                              + + +**Privacy/LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecross mark
                              Educationcross mark
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. +> [!NOTE] +> Currently, this policy is supported only in HoloLens 2. + +List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + +Value type is chr. + + + +ADMX Info: +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + + + + +
                              + + +**Privacy/LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecross mark
                              Educationcross mark
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. +> [!NOTE] +> Currently, this policy is supported only in HoloLens 2. + +List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the user's movements while the apps are running in the background. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + +Value type is chr. + + + +ADMX Info: +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + + + + +
                              + + +**Privacy/LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procross mark
                              Businesscross mark
                              Enterprisecross mark
                              Educationcross mark
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Added in Windows 10, version 1903. +> [!NOTE] +> Currently, this policy is supported only in HoloLens 2. + +List of semi-colon delimited Package Family Names of Windows Store Apps. +The user is able to control the user movements privacy setting for the listed apps. This setting overrides the default LetAppsAccessBackgroundSpatialPerception policy setting for the specified apps. + +Value type is chr. + + + +ADMX Info: +- GP English name: *Let Windows apps access background spatial perception* +- GP name: *LetAppsAccessBackgroundSpatialPerception* +- GP element: *LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + + + + +
                              + **Privacy/LetAppsAccessCalendar** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -928,26 +1317,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -980,26 +1377,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1032,26 +1437,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1084,26 +1497,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1147,26 +1568,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1199,26 +1628,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1251,26 +1688,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1303,26 +1748,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1366,26 +1819,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1418,26 +1879,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1470,26 +1939,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1522,26 +1999,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1585,26 +2070,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1637,26 +2130,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1689,26 +2190,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1741,26 +2250,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1804,26 +2321,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1856,26 +2381,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1908,26 +2441,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1960,26 +2501,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2003,26 +2552,34 @@ This policy setting specifies whether Windows apps can access the eye tracker. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2046,26 +2603,34 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. Listed - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2089,26 +2654,34 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. Listed - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2132,26 +2705,34 @@ List of semi-colon delimited Package Family Names of Windows Store Apps. The use - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2195,26 +2776,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2247,26 +2836,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2299,26 +2896,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2351,26 +2956,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2414,26 +3027,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2466,26 +3087,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2518,26 +3147,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2570,26 +3207,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2633,26 +3278,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2685,26 +3338,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2737,26 +3398,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2789,26 +3458,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2852,26 +3529,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2904,26 +3589,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2956,26 +3649,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3008,26 +3709,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3071,26 +3780,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3123,26 +3840,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3175,26 +3900,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3227,26 +3960,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3290,26 +4031,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3342,26 +4091,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3394,26 +4151,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3446,26 +4211,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3509,26 +4282,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3561,26 +4342,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3613,26 +4402,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3665,26 +4462,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3717,26 +4522,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3769,26 +4582,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3821,26 +4642,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3873,26 +4702,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3936,26 +4773,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3988,26 +4833,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4040,26 +4893,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4086,32 +4947,176 @@ ADMX Info:
                              + +**Privacy/LetAppsActivateWithVoice** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecheck mark6
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Specifies if Windows apps can be activated by voice. + + + +ADMX Info: +- GP English name: *Allow voice activation* +- GP name: *LetAppsActivateWithVoice* +- GP element: *LetAppsActivateWithVoice_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 (default) – User in control. Users can decide if Windows apps can be activated by voice using Settings > Privacy options on the device. +- 1 – Force allow. Windows apps can be activated by voice and users cannot change it. +- 2 - Force deny. Windows apps cannot be activated by voice and users cannot change it. + + + + +
                              + + +**Privacy/LetAppsActivateWithVoiceAboveLock** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecheck mark6
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Specifies if Windows apps can be activated by voice while the screen is locked. + + + +ADMX Info: +- GP English name: *Allow voice activation above locked screen* +- GP name: *LetAppsActivateWithVoiceAboveLock* +- GP element: *LetAppsActivateWithVoiceAboveLock_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 (default) – User in control. Users can decide if Windows apps can be activated by voice while the screen is locked using Settings > Privacy options on the device. +- 1 – Force allow. Windows apps can be activated by voice while the screen is locked, and users cannot change it. +- 2 - Force deny. Windows apps cannot be activated by voice while the screen is locked, and users cannot change it. + + + + +
                              + **Privacy/LetAppsGetDiagnosticInfo** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4155,26 +5160,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4207,26 +5220,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4259,26 +5280,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4311,26 +5340,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4376,26 +5413,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4428,26 +5473,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4480,26 +5533,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark2check mark2check mark2check mark2check mark2check mark2check mark2Homecheck mark2
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4532,26 +5593,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4595,26 +5664,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4647,26 +5724,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4699,26 +5784,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark1check mark1check mark1check mark1check mark1check mark1check mark1Homecheck mark1
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4751,26 +5844,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3check mark3check mark3check mark3Homecheck mark3
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4809,26 +5910,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -4853,14 +5962,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index d66ad8a1f8..599dc2d1f3 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -1,12 +1,15 @@ --- title: Policy CSP - RemoteAssistance description: Policy CSP - RemoteAssistance -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - RemoteAssistance @@ -42,26 +45,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -87,9 +98,9 @@ If you do not configure this policy setting, the user sees the default warning m > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -110,26 +121,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -151,9 +170,9 @@ If you do not configure this setting, application-based settings are used. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -174,26 +193,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -223,9 +250,9 @@ If you enable this policy setting you should also enable appropriate firewall ex > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -246,26 +273,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -288,9 +323,9 @@ If you enable this policy setting, you have two ways to allow helpers to provide To configure the list of helpers, click "Show." In the window that opens, you can enter the names of the helpers. Add each user or group one by one. When you enter the name of the helper user or user groups, use the following format: -\ or +`\` or -\ +`\` If you enable this policy setting, you should also enable firewall exceptions to allow Remote Assistance communications. The firewall exceptions required for Offer (Unsolicited) Remote Assistance depend on the version of Windows you are running. @@ -318,9 +353,9 @@ Allow Remote Desktop Exception > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -334,12 +369,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-remotedesktopservices.md b/windows/client-management/mdm/policy-csp-remotedesktopservices.md index 6621ddedd2..e5588c0da4 100644 --- a/windows/client-management/mdm/policy-csp-remotedesktopservices.md +++ b/windows/client-management/mdm/policy-csp-remotedesktopservices.md @@ -1,12 +1,15 @@ --- title: Policy CSP - RemoteDesktopServices description: Policy CSP - RemoteDesktopServices -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - RemoteDesktopServices @@ -48,26 +51,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -93,9 +104,9 @@ You can limit the number of users who can connect simultaneously by configuring > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -116,26 +127,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -165,9 +184,9 @@ FIPS compliance can be configured through the System cryptography. Use FIPS comp > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -188,26 +207,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -220,9 +247,9 @@ ADMX Info: This policy setting specifies whether to prevent the mapping of client drives in a Remote Desktop Services session (drive redirection). -By default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in File Explorer or Computer in the format on . You can use this policy setting to override this behavior. +By default, an RD Session Host server maps client drives automatically upon connection. Mapped drives appear in the session folder tree in File Explorer or Computer in the format `` on ``. You can use this policy setting to override this behavior. -If you enable this policy setting, client drive redirection is not allowed in Remote Desktop Services sessions, and Clipboard file copy redirection is not allowed on computers running Windows Server 2003, Windows 8, and Windows XP. +If you enable this policy setting, client drive redirection is not allowed in Remote Desktop Services sessions, and Clipboard file copy redirection is not allowed on computers running Windows Server 2019 and Windows 10. If you disable this policy setting, client drive redirection is always allowed. In addition, Clipboard file copy redirection is always allowed if Clipboard redirection is allowed. @@ -231,9 +258,9 @@ If you do not configure this policy setting, client drive redirection and Clipbo > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -254,26 +281,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -293,9 +328,9 @@ If you disable this setting or leave it not configured, the user will be able to > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -316,26 +351,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -361,9 +404,9 @@ If you do not configure this policy setting, automatic logon is not specified at > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -384,26 +427,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -429,9 +480,9 @@ Note: The RPC interface is used for administering and configuring Remote Desktop > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -445,12 +496,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-remotemanagement.md b/windows/client-management/mdm/policy-csp-remotemanagement.md index 39752ff60e..0eecb5bda9 100644 --- a/windows/client-management/mdm/policy-csp-remotemanagement.md +++ b/windows/client-management/mdm/policy-csp-remotemanagement.md @@ -1,12 +1,15 @@ --- title: Policy CSP - RemoteManagement description: Policy CSP - RemoteManagement -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - RemoteManagement @@ -75,26 +78,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -114,9 +125,9 @@ If you disable or do not configure this policy setting, the WinRM client does no > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -137,26 +148,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -176,9 +195,9 @@ If you disable or do not configure this policy setting, the WinRM service does n > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -199,26 +218,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -238,9 +265,9 @@ If you disable or do not configure this policy setting, the WinRM client does no > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -261,26 +288,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -300,9 +335,9 @@ If you disable or do not configure this policy setting, the WinRM service does n > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -323,26 +358,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -363,7 +406,7 @@ If you disable or do not configure this policy setting, the WinRM service will n The service listens on the addresses specified by the IPv4 and IPv6 filters. The IPv4 filter specifies one or more ranges of IPv4 addresses, and the IPv6 filter specifies one or more ranges of IPv6addresses. If specified, the service enumerates the available IP addresses on the computer and uses only addresses that fall within one of the filter ranges. -You should use an asterisk (*) to indicate that the service listens on all available IP addresses on the computer. When * is used, other ranges in the filter are ignored. If the filter is left blank, the service does not listen on any addresses. +You should use an asterisk (\*) to indicate that the service listens on all available IP addresses on the computer. When \* is used, other ranges in the filter are ignored. If the filter is left blank, the service does not listen on any addresses. For example, if you want the service to listen only on IPv4 addresses, leave the IPv6 filter empty. @@ -375,9 +418,9 @@ Example IPv6 filters:\n3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3FFE:FFFF:7654:FE > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -398,26 +441,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -437,9 +488,9 @@ If you disable or do not configure this policy setting, the WinRM client sends o > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -460,26 +511,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -499,9 +558,9 @@ If you disable or do not configure this policy setting, the WinRM client sends o > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -522,26 +581,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -561,9 +628,9 @@ If you disable or do not configure this policy setting, the WinRM client uses Di > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -584,26 +651,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -623,9 +698,9 @@ If you disable or do not configure this policy setting, the WinRM client uses Ne > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -646,26 +721,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -685,9 +768,9 @@ If you disable or do not configure this policy setting, the WinRM service accept > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -708,26 +791,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -749,9 +840,9 @@ If you enable and then disable this policy setting,any values that were previous > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -772,26 +863,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -817,9 +916,9 @@ If HardeningLevel is set to None, all requests are accepted (though they are not > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -840,26 +939,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -879,9 +986,9 @@ If you disable or do not configure this policy setting and the WinRM client need > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -902,26 +1009,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -945,9 +1060,9 @@ A listener might be automatically created on port 80 to ensure backward compatib > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -968,26 +1083,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1011,9 +1134,9 @@ A listener might be automatically created on port 443 to ensure backward compati > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1027,12 +1150,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md index 3422d53682..1870b26735 100644 --- a/windows/client-management/mdm/policy-csp-remoteprocedurecall.md +++ b/windows/client-management/mdm/policy-csp-remoteprocedurecall.md @@ -1,12 +1,15 @@ --- title: Policy CSP - RemoteProcedureCall description: Policy CSP - RemoteProcedureCall -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - RemoteProcedureCall @@ -36,26 +39,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -79,9 +90,9 @@ Note: This policy will not be applied until the system is rebooted. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -102,26 +113,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -153,9 +172,9 @@ Note: This policy setting will not be applied until the system is rebooted. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -169,12 +188,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-remoteshell.md b/windows/client-management/mdm/policy-csp-remoteshell.md index 300e4c4f1f..8062074499 100644 --- a/windows/client-management/mdm/policy-csp-remoteshell.md +++ b/windows/client-management/mdm/policy-csp-remoteshell.md @@ -1,12 +1,15 @@ --- title: Policy CSP - RemoteShell description: Policy CSP - RemoteShell -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - RemoteShell @@ -51,26 +54,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -90,9 +101,9 @@ If you set this policy to ‘disabled’, new remote shell connections are rejec > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -113,26 +124,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -154,9 +173,9 @@ If you disable or do not configure this policy setting, the default number is fi > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -177,26 +196,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -218,9 +245,9 @@ If you do not configure or disable this policy setting, the default value of 900 > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -241,26 +268,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -282,9 +317,9 @@ If you disable or do not configure this policy setting, the value 150 is used by > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -305,26 +340,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -344,9 +387,9 @@ If you disable or do not configure this policy setting, the limit is five proce > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -367,26 +410,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -399,7 +450,7 @@ ADMX Info: This policy setting configures the maximum number of concurrent shells any user can remotely open on the same system. -Any number from 0 to 0x7FFFFFFF cand be set, where 0 means unlimited number of shells. +Any number from 0 to 0x7FFFFFFF can be set, where 0 means unlimited number of shells. If you enable this policy setting, the user cannot open new remote shells if the count exceeds the specified limit. @@ -408,9 +459,9 @@ If you disable or do not configure this policy setting, by default the limit is > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -431,26 +482,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -466,9 +525,9 @@ This policy setting is deprecated and has no effect when set to any state: Enabl > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -482,12 +541,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 9b75fbd479..adff5f8a8b 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -1,17 +1,21 @@ --- title: Policy CSP - RestrictedGroups description: Policy CSP - RestrictedGroups -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/15/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - RestrictedGroups +
                              @@ -32,32 +36,34 @@ ms.date: 03/15/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4Homecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -74,7 +80,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the Starting in Windows 10, version 1809, you can use this schema for retrieval and application of the RestrictedGroups/ConfigureGroupMembership policy. A minimum occurrence of 0 members when applying the policy implies clearing the access group and should be used with caution. -``` syntax +```xml @@ -119,9 +125,9 @@ Here is an example: ``` - - - + + + @@ -130,6 +136,10 @@ Here is an example: ``` + +> [!Note] +> * You should include the local administrator while modifying the administrators group to prevent accidental loss of access +> * Include the entire UPN after AzureAD @@ -137,8 +147,14 @@ Here is an example:
                              -Take note: -* You should include the local administrator while modifying the administrators group to prevent accidental loss of access -* Include the entire UPN after AzureAD +Footnotes: +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. + + diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index f51a32f819..273291c10b 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Search description: Policy CSP - Search -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/30/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Search @@ -25,6 +28,9 @@ ms.date: 07/30/2018
                              Search/AllowCortanaInAAD
                              +
                              + Search/AllowFindMyFiles +
                              Search/AllowIndexingEncryptedStoresOrItems
                              @@ -58,9 +64,6 @@ ms.date: 07/30/2018
                              Search/PreventRemoteQueries
                              -
                              - Search/SafeSearchPermissions -
                              @@ -72,26 +75,34 @@ ms.date: 07/30/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3check mark3check mark3Homecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -131,26 +142,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -183,32 +202,112 @@ The following list shows the supported values:
                              + +**Search/AllowFindMyFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +Controls if the user can configure search to Find My Files mode, which searches files in secondary hard drives and also outside of the user profile. Find My Files does not allow users to search files or locations to which they do not have access. + + + +ADMX Info: +- GP English name: *Allow Find My Files* +- GP name: *AllowFindMyFiles* +- GP path: *Computer Configuration/Administrative Templates/Windows Components/Search* +- GP ADMX file name: *Search.admx* + + + +The following list shows the supported values: + +- 1 (Default) - Find My Files feature can be toggled (still off by default), and the settings UI is present. +- 0 - Find My Files feature is turned off completely, and the settings UI is disabled. + + + + + + + + + + +
                              + **Search/AllowIndexingEncryptedStoresOrItems** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -253,26 +352,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -310,15 +417,6 @@ The following list shows the supported values: **Search/AllowStoringImagesFromVisionSearch** - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - This policy has been deprecated. @@ -333,26 +431,34 @@ This policy has been deprecated. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -394,26 +500,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -437,26 +551,34 @@ Allow Windows indexer. Value type is integer. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -498,26 +620,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -556,26 +686,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -618,26 +756,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -681,26 +827,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -743,26 +897,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -795,70 +957,14 @@ The following list shows the supported values:
                              - -**Search/SafeSearchPermissions** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. Desktop users should use Search/DoNotUseWebResults. - - -Specifies what level of safe search (filtering adult content) is required. - - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Strict, highest filtering against adult content. -- 1 (default) – Moderate filtering against adult content (valid search results will not be filtered). - - - -
                              - -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - - diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index ec1d131e0d..0a4dcd146d 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -1,18 +1,21 @@ --- title: Policy CSP - Security description: Policy CSP - Security -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/09/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Security > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
                              @@ -27,15 +30,9 @@ ms.date: 08/09/2018
                              Security/AllowAutomaticDeviceEncryptionForAzureADJoinedDevices
                              -
                              - Security/AllowManualRootCertificateInstallation -
                              Security/AllowRemoveProvisioningPackage
                              -
                              - Security/AntiTheftMode -
                              Security/ClearTPMIfNotReady
                              @@ -68,26 +65,34 @@ ms.date: 08/09/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -118,26 +123,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Business
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + > [!NOTE] > This policy has been deprecated in Windows 10, version 1607 @@ -162,88 +175,40 @@ The following list shows the supported values:
                              - -**Security/AllowManualRootCertificateInstallation** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - - -Specifies whether the user is allowed to manually install root and intermediate CA certificates. - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
                              - **Security/AllowRemoveProvisioningPackage** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -268,86 +233,40 @@ The following list shows the supported values:
                              - -**Security/AntiTheftMode** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck markcheck mark
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -> [!NOTE] -> This policy is only enforced in Windows 10 Mobile and not supported in Windows 10 for desktop. - -  -Allows or disallow Anti Theft Mode on the device. - - - -The following list shows the supported values: - -- 0 – Don't allow Anti Theft Mode. -- 1 (default) – Anti Theft Mode will follow the default device configuration (region-dependent). - - - - -
                              - **Security/ClearTPMIfNotReady** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark3check mark3check mark3check mark3cross markcross markHome
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -389,26 +308,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4Homecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -443,26 +370,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -499,26 +434,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -580,26 +523,34 @@ If the MDM policy is set to "NoRequireAuthentication" (2) - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -636,26 +587,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -686,26 +645,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check markcheck markcheck markcheck markcheck markcheck markcheck markHomecheck mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -741,16 +708,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. - - diff --git a/windows/client-management/mdm/policy-csp-servicecontrolmanager.md b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md new file mode 100644 index 0000000000..fff74ab134 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-servicecontrolmanager.md @@ -0,0 +1,123 @@ +--- +title: Policy CSP - ServiceControlManager +description: Policy CSP - ServiceControlManager +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: Heidilohr +ms.localizationpriority: medium +ms.date: 09/27/2019 +--- + +# Policy CSP - ServiceControlManager + + + +
                              + + +## ServiceControlManager policies + +
                              +
                              + ServiceControlManager/SvchostProcessMitigation +
                              +
                              + + +
                              + + +**ServiceControlManager/SvchostProcessMitigation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procross mark
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +This policy setting enables process mitigation options on svchost.exe processes. + +If you enable this policy setting, built-in system services hosted in svchost.exe processes will have stricter security policies enabled on them. + +This includes a policy requiring all binaries loaded in these processes to be signed by Microsoft, as well as a policy disallowing dynamically-generated code. + +If you disable or do not configure this policy setting, the stricter security settings will not be applied. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable svchost.exe mitigation options* +- GP name: *SvchostProcessMitigationEnable* +- GP path: *System/Service Control Manager Settings/Security Settings* +- GP ADMX file name: *ServiceControlManager.admx* + + + +Supported values: +- disabled - Do not add ACG/CIG enforcement and other process mitigation/code integrity policies to SVCHOST processes. +- enabled - Add ACG/CIG enforcement and other process mitigation/code integrity policies to SVCHOST processes. + + + + + + + + +
                              + +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. + + + diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index fa1b94e71a..5b737586b2 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Settings description: Policy CSP - Settings -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/09/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Settings @@ -28,9 +31,6 @@ ms.date: 08/09/2018
                              Settings/AllowDateTime
                              -
                              - Settings/AllowEditDeviceName -
                              Settings/AllowLanguage
                              @@ -72,26 +72,34 @@ ms.date: 08/09/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -129,26 +137,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -179,26 +195,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -223,82 +247,40 @@ The following list shows the supported values:
                              - -**Settings/AllowEditDeviceName** - - - - - - - - - - - - - - - - - - - - - -
                              HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                              cross markcross markcross markcross markcross markcheck mark1check mark1
                              - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                              - - - -Allows editing of the device name. - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
                              - **Settings/AllowLanguage** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -333,26 +315,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check markcheck mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -387,26 +377,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -441,26 +439,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -495,26 +501,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -549,26 +563,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -599,26 +621,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -653,26 +683,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -703,26 +741,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -763,32 +809,40 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] -> * Device > * User +> * Device
                              @@ -804,11 +858,11 @@ If the policy is not specified, the behavior will be that no pages are affected. The format of the PageVisibilityList value is as follows: -- The value is a unicode string up to 10,000 characters long, which will be used without case sensitivity. -- There are two variants: one that shows only the given pages and one which hides the given pages. -- The first variant starts with the string "showonly:" and the second with the string "hide:". -- Following the variant identifier is a semicolon-delimited list of page identifiers, which must not have any extra whitespace. -- Each page identifier is the ms-settings:xyz URI for the page, minus the ms-settings: prefix, so the identifier for the page with URI "ms-settings:network-wifi" would be just "network-wifi". +- The value is a unicode string up to 10,000 characters long, which will be used without case sensitivity. +- There are two variants: one that shows only the given pages and one which hides the given pages. +- The first variant starts with the string "showonly:" and the second with the string "hide:". +- Following the variant identifier is a semicolon-delimited list of page identifiers, which must not have any extra whitespace. +- Each page identifier is the ms-settings:xyz URI for the page, minus the ms-settings: prefix, so the identifier for the page with URI "ms-settings:network-wifi" would be just "network-wifi". The default value for this setting is an empty string, which is interpreted as show everything. @@ -833,7 +887,7 @@ ADMX Info: To validate on Desktop, do the following: -1. Open System Settings and verfiy that the About page is visible and accessible. +1. Open System Settings and verify that the About page is visible and accessible. 2. Configure the policy with the following string: "hide:about". 3. Open System Settings again and verify that the About page is no longer accessible. @@ -841,14 +895,14 @@ To validate on Desktop, do the following:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - - diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index e7bdc48ee7..205d51bff6 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -1,12 +1,15 @@ --- title: Policy CSP - SmartScreen description: Policy CSP - SmartScreen -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - SmartScreen @@ -39,26 +42,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -71,6 +82,9 @@ ms.date: 03/12/2018 Added in Windows 10, version 1703. Allows IT Admins to control whether users are allowed to install apps from places other than the Store. +> [!Note] +> This policy will block installation only while the device is online. To block offline installation too, **SmartScreen/PreventOverrideForFilesInShell** and **SmartScreen/EnableSmartScreenInShell** policies should also be enabled. + ADMX Info: @@ -97,26 +111,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -155,26 +177,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -207,12 +237,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index 43023aecdc..8ecc09d034 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Speech description: Policy CSP - Speech -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/09/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Speech @@ -33,26 +36,34 @@ ms.date: 08/09/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark1check mark1check mark1check mark1check mark1check mark1Homecross mark
                              Procheck mark1
                              Businesscheck mark1
                              Enterprisecheck mark1
                              Educationcheck mark1
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -84,12 +95,14 @@ The following list shows the supported values:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index bbbecfc8b2..a55e6716ff 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -1,18 +1,21 @@ --- title: Policy CSP - Start description: Policy CSP - Start -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Start > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
                              @@ -122,26 +125,34 @@ ms.date: 08/14/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -173,26 +184,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -224,26 +243,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -275,26 +302,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -326,26 +361,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -377,26 +420,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -428,26 +479,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -479,26 +538,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -530,26 +597,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -581,26 +656,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -632,26 +715,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4Homecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -675,6 +766,10 @@ ADMX Info: +The following list shows the supported values: + +- 0 (default) – False (Do not disable). +- 1 - True (disable). @@ -693,26 +788,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -751,26 +854,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -817,26 +928,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -874,26 +993,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -938,26 +1065,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -999,26 +1134,34 @@ To validate on Laptop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1056,26 +1199,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1099,6 +1250,13 @@ ADMX Info: - GP ADMX file name: *StartMenu.admx* + +The following list shows the supported values: + +- 0 (default) – False (do not hide). +- 1 - True (hide). + +
                              @@ -1109,26 +1267,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1169,26 +1335,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1236,26 +1410,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1308,26 +1490,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1365,26 +1555,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1422,26 +1620,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1479,26 +1685,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1536,26 +1750,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1593,26 +1815,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1654,26 +1884,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1722,26 +1960,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1782,26 +2028,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1840,14 +2094,14 @@ ADMX Info:
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index 2760176424..bc6f3d7253 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -1,18 +1,19 @@ --- title: Policy CSP - Storage description: Policy CSP - Storage -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 01/14/2019 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Storage -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
                              @@ -59,26 +60,34 @@ ms.date: 01/14/2019 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -119,28 +128,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark6check mark6check mark6check mark6Home
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              - - +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -186,26 +201,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark6check mark6check mark6check mark6Home
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -254,26 +277,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark6check mark6check mark6check mark6Home
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -288,7 +319,7 @@ When Storage Sense runs, it can dehydrate cloud-backed content that hasn’t bee If the Storage/AllowStorageSenseGlobal policy is disabled, then this policy does not have any effect. -If you enable this policy setting, you must provide the number of days since a cloud-backed file has been opened before Storage Sense will dehydrate it. Supported values are: 0–365. +If you enable this policy setting, you must provide the minimum number of days a cloud-backed file can remain unopened before Storage Sense dehydrates it. Supported values are: 0–365. If you set this value to zero, Storage Sense will not dehydrate any cloud-backed content. The default value is 0, which never dehydrates cloud-backed content. @@ -316,33 +347,40 @@ ADMX Info:
                              - **Storage/ConfigStorageSenseDownloadsCleanupThreshold** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark6check mark6check mark6check mark6Home
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -357,7 +395,7 @@ When Storage Sense runs, it can delete files in the user’s Downloads folder if If the Storage/AllowStorageSenseGlobal policy is disabled, then this policy does not have any effect. -If you enable this policy setting, you must provide the number of days since a file in the Downloads folder has been opened before Storage Sense will delete it. Supported values are: 0–365. +If you enable this policy setting, you must provide the minimum number of days a file can remain unopened before Storage Sense deletes it from the Downloads folder. Supported values are: 0-365. If you set this value to zero, Storage Sense will not delete files in the user’s Downloads folder. The default is 0, or never deleting files in the Downloads folder. @@ -391,26 +429,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark6check mark6check mark6check mark6Home
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -465,26 +511,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark6check mark6check mark6check mark6Home
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -533,26 +587,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -572,9 +634,9 @@ If you disable or do not configure this policy setting, Windows will activate un > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -595,26 +657,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -625,7 +695,10 @@ ADMX Info: -If you enable this policy setting, write access is denied to this removable storage class. If you disable or do not configure this policy setting, write access is allowed to this removable storage class. Note: To require that users write data to BitLocker-protected storage, enable the policy setting "Deny write access to drives not protected by BitLocker," which is located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives." +If you enable this policy setting, write access is denied to this removable storage class. If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + +> [!Note] +> To require that users write data to BitLocker-protected storage, enable the policy setting "Deny write access to drives not protected by BitLocker," which is located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives." Supported values: - 0 - Disable @@ -645,25 +718,25 @@ ADMX Info: +Example for setting the device custom OMA-URI setting to enable this policy: +To deny write access to removable storage within Intune’s custom profile, set OMA-URI to ```.\[device|user]\vendor\msft\policy\[config|result]\Storage/RemovableDiskDenyWriteAccess```, Data type to Integer, and Value to 1. +See [Use custom settings for Windows 10 devices in Intune](https://docs.microsoft.com/intune/custom-settings-windows-10) for information on how to create custom profiles. - - -
                              -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 16bfa23ec7..ff54e474bf 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -1,18 +1,19 @@ --- title: Policy CSP - System description: Policy CSP - System -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/24/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - System -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
                              @@ -24,6 +25,9 @@ ms.date: 08/24/2018
                              System/AllowBuildPreview
                              +
                              + System/AllowCommercialDataPipeline +
                              System/AllowDeviceNameInDiagnosticData
                              @@ -84,6 +88,9 @@ ms.date: 08/24/2018
                              System/TelemetryProxy
                              +
                              + System/TurnOffFileHistory +
                              @@ -95,26 +102,34 @@ ms.date: 08/24/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -128,7 +143,6 @@ ms.date: 08/24/2018 > [!NOTE] > This policy setting applies only to devices running Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, Windows 10 Mobile, and Windows 10 Mobile Enterprise. - This policy setting determines whether users can access the Insider build controls in the Advanced Options for Windows Update. These controls are located under "Get Insider builds," and enable users to make their devices available for downloading and installing Windows preview software. If you enable or do not configure this policy setting, users can download and install Windows preview software on their devices. If you disable this policy setting, the item "Get Insider builds" will be unavailable. @@ -154,32 +168,122 @@ The following list shows the supported values:
                              + +**System/AllowCommercialDataPipeline** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                              Windows EditionSupported?
                              Homecross mark
                              Procheck mark6
                              Businesscheck mark6
                              Enterprisecheck mark6
                              Educationcheck mark6
                              + + +
                              + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                              + + + +> [!NOTE] +> This policy setting applies only to the Windows operating system and apps included with Windows, it does not apply to third-party apps or services running on Windows 10. + +This policy setting opts the device into the Windows enterprise data pipeline. + +If you enable this setting, data collected from the device is opted into the Windows enterprise data pipeline. + +If you disable or do not configure this setting, all data from the device is collected and processed in accordance with the policies for the Windows standard data pipeline. + +Configuring this setting does not change the telemetry collection level or the ability of the user to change the level. + + + +ADMX Info: +- GP English name: *Allow commercial data pipeline* +- GP name: *AllowCommercialDataPipeline* +- GP element: *AllowCommercialDataPipeline* +- GP path: *Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + + + +The following list shows the supported values: + +- 0 (default) - Do not use the Windows Commercial Data Pipeline +- 1 - Use the Windows Commercial Data Pipeline + + + + + + + + + + +
                              + **System/AllowDeviceNameInDiagnosticData** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -221,26 +325,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -273,26 +385,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -317,7 +437,7 @@ The following list shows the supported values: - 0 – Disabled. - 1 (default) – Permits Microsoft to configure device settings only. -- 2 – Allows Microsoft to conduct full experimentations. +- 2 – Allows Microsoft to conduct full experimentation. @@ -330,26 +450,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -366,7 +494,7 @@ This MDM setting corresponds to the EnableFontProviders Group Policy setting. If This setting is used by lower-level components for text display and fond handling and has not direct effect on web browsers, which may download web fonts used in web content. -> [!Note] +> [!NOTE] > Reboot is required after setting the policy; alternatively you can stop and restart the FontCache service. @@ -401,26 +529,34 @@ To verify if System/AllowFontProviders is set to true: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -454,9 +590,9 @@ ADMX Info: The following list shows the supported values: -- 0 – Force Location Off. All Location Privacy settings are toggled off and greyed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search. +- 0 – Force Location Off. All Location Privacy settings are toggled off and grayed out. Users cannot change the settings, and no apps are allowed access to the Location service, including Cortana and Search. - 1 (default) – Location service is allowed. The user has control and can change Location Privacy settings on or off. -- 2 – Force Location On. All Location Privacy settings are toggled on and greyed out. Users cannot change the settings and all consent permissions will be automatically suppressed. +- 2 – Force Location On. All Location Privacy settings are toggled on and grayed out. Users cannot change the settings and all consent permissions will be automatically suppressed. @@ -469,26 +605,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -521,26 +665,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -554,7 +706,7 @@ The following list shows the supported values: Allow the device to send diagnostic and usage telemetry data, such as Watson. -For more information about diagnostic data, including what is and what is not collected by Windows, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization). +For more information about diagnostic data, including what is and what is not collected by Windows, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization). The following tables describe the supported values: @@ -651,26 +803,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -685,16 +845,13 @@ Specifies whether to allow the user to factory reset the device by using control Most restricted value is 0. - > [!TIP] > This policy is also applicable to Windows 10 and not exclusive to phone. + -The following list shows the supported values: -orted values: - +The following list shows the supported values: - 0 – Not allowed. - 1 (default) – Allowed to reset to factory default settings. - @@ -706,26 +863,34 @@ orted values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -751,9 +916,9 @@ If your malware detection application does not include an Early Launch Antimalwa > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -774,26 +939,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -840,26 +1013,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4Homecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -894,26 +1075,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark4check mark4check mark4check mark4Homecross mark
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -928,10 +1117,10 @@ This policy setting determines whether people can change their own telemetry lev If you set this policy setting to "Disable Telemetry opt-in Settings", telemetry levels are disabled in Settings, preventing people from changing them. -If you set this policy setting to "Enable Telemetry opt-in Setings" or don't configure this policy setting, people can change their own telemetry levels in Settings. +If you set this policy setting to "Enable Telemetry opt-in Settings" or don't configure this policy setting, people can change their own telemetry levels in Settings. -Note: -Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. +> [!Note] +> Set the Allow Telemetry policy setting to prevent people from sending diagnostic data to Microsoft beyond your organization's limit. @@ -953,26 +1142,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -990,7 +1187,7 @@ If you disable or don't configure this policy setting, the Delete diagnostic dat ADMX Info: -- GP English name: *Disable deleting diagnostic data * +- GP English name: *Disable deleting diagnostic data* - GP name: *DisableDeviceDelete* - GP element: *DisableDeviceDelete* - GP path: *Data Collection and Preview Builds* @@ -1016,26 +1213,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark5check mark5check mark5check mark5Homecross mark
                              Procheck mark5
                              Businesscheck mark5
                              Enterprisecheck mark5
                              Educationcheck mark5
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1053,7 +1258,7 @@ If you disable or don't configure this policy setting, the Diagnostic Data Viewe ADMX Info: -- GP English name: *Disable diagnostic data viewer. * +- GP English name: *Disable diagnostic data viewer.* - GP name: *DisableDiagnosticDataViewer* - GP element: *DisableDiagnosticDataViewer* - GP path: *Data Collection and Preview Builds* @@ -1079,26 +1284,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1131,26 +1344,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                              Procheck mark2
                              Businesscheck mark2
                              Enterprisecheck mark2
                              Educationcheck mark2
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1205,26 +1426,34 @@ To validate on Desktop, do the following: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                              Procheck mark
                              Businesscheck mark
                              Enterprisecheck mark
                              Educationcheck mark
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1250,9 +1479,9 @@ Also, see the "Turn off System Restore configuration" policy setting. If the "Tu > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -1273,26 +1502,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              check mark4check mark4check mark4check mark4check mark4Homecheck mark4
                              Procheck mark4
                              Businesscheck mark4
                              Enterprisecheck mark4
                              Educationcheck mark4
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1323,26 +1560,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                              HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                              cross markcheck mark3check mark3check mark3check mark3check mark3check mark3Homecross mark
                              Procheck mark3
                              Businesscheck mark3
                              Enterprisecheck mark3
                              Educationcheck mark3
                              +
                              + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1362,7 +1607,7 @@ To enable this behavior you must complete two steps:
                            • Set Allow Telemetry to level 2 (Enhanced)
                            -When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: [Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics](https://go.microsoft.com/fwlink/?linkid=847594). +When you configure these policy settings, a basic level of diagnostic data plus additional events that are required for Windows Analytics are sent to Microsoft. These events are documented here: Windows 10, version 1709 enhanced telemetry events and fields used by Windows Analytics. Enabling enhanced diagnostic data in the System/AllowTelemetry policy in combination with not configuring this policy will also send the required events for Windows Analytics, plus additional enhanced level telemetry data. This setting has no effect on computers configured to send full, basic or security level diagnostic data to Microsoft. @@ -1388,26 +1633,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1433,16 +1686,91 @@ ADMX Info: +
                            -Footnote: + +**System/TurnOffFileHistory** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecross mark
                            Procheck mark6
                            Businesscheck mark6
                            Enterprisecheck mark6
                            Educationcheck mark6
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +This policy setting allows you to turn off File History. + +If you enable this policy setting, File History cannot be activated to create regular, automatic backups. + +If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups. + + + +ADMX Info: +- GP English name: *Turn off File History* +- GP name: *DisableFileHistory* +- GP path: *Windows Components/File History* +- GP ADMX file name: *FileHistory.admx* + + + +The following list shows the supported values: + +- false (default) - allow File History +- true - turn off File History + + + + + + + + +
                            + +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index 89a649fe5c..85d08130a7 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -1,17 +1,21 @@ --- title: Policy CSP - SystemServices description: Policy CSP - SystemServices -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - SystemServices +
                            @@ -47,26 +51,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -96,26 +108,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -145,26 +165,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -194,26 +222,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -243,26 +279,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -292,26 +336,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -334,12 +386,14 @@ GP Info:
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index e806cf4108..8a69418c47 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -1,18 +1,21 @@ --- title: Policy CSP - TaskManager description: Policy CSP - TaskManager -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/05/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - TaskManager > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
                            @@ -35,26 +38,34 @@ ms.date: 07/05/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark5cross markcheck mark5check mark5Homecross mark
                            Procheck mark5
                            Businesscross mark
                            Enterprisecheck mark5
                            Educationcheck mark5
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -68,8 +79,8 @@ ms.date: 07/05/2018 This setting determines whether non-administrators can use Task Manager to end tasks. Value type is integer. Supported values: - - 0 - Disabled. EndTask functionality is blocked in TaskManager. - - 1 - Enabled (default). Users can perform EndTask in TaskManager. +- 0 - Disabled. EndTask functionality is blocked in TaskManager. +- 1 - Enabled (default). Users can perform EndTask in TaskManager. @@ -87,14 +98,14 @@ When the policy is set to 0 - users CANNOT execute 'End task' on processes in Ta
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index 94c33279b8..4bc5ef3a22 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -1,17 +1,21 @@ --- title: Policy CSP - TaskScheduler description: Policy CSP - TaskScheduler -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - TaskScheduler +
                            @@ -32,26 +36,34 @@ ms.date: 03/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -68,12 +80,14 @@ Added in Windows 10, version 1803. This setting determines whether the specific
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index a6403f3b61..7786a5eb5c 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -1,18 +1,23 @@ --- title: Policy CSP - TextInput description: Policy CSP - TextInput -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/09/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - TextInput + + > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before they are commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
                            @@ -57,6 +62,15 @@ ms.date: 08/09/2018
                            TextInput/AllowLinguisticDataCollection
                            +
                            + TextInput/ConfigureJapaneseIMEVersion +
                            +
                            + TextInput/ConfigureSimplifiedChineseIMEVersion +
                            +
                            + TextInput/ConfigureTraditionalChineseIMEVersion +
                            TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode
                            @@ -101,6 +115,8 @@ ms.date: 08/09/2018 **TextInput/AllowHardwareKeyboardTextSuggestions** +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -124,26 +140,34 @@ Added in Windows 10, version 1803. Placeholder only. Do not use in production e - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -180,26 +204,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -234,26 +266,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -290,26 +330,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -347,26 +395,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -403,26 +459,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -459,26 +523,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -515,26 +587,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -575,6 +655,8 @@ To validate that text prediction is disabled on Windows 10 for desktop, do the f **TextInput/AllowKoreanExtendedHanja** +
                            + This policy has been deprecated. @@ -589,26 +671,34 @@ This policy has been deprecated. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -653,26 +743,33 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -703,32 +800,229 @@ This setting supports a range of values between 0 and 1.
                            + +**TextInput/ConfigureJapaneseIMEVersion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +> [!NOTE] +> - The policy is only enforced in Windows 10 for desktop. +> - This policy requires reboot to take effect. + +Added in next major release of Windows 10. Allows IT admins to configure Microsoft Japanese IME version in the desktop. + + + +The following list shows the supported values: + +- 0 (default) - Allows you to configure which Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Japanese IME version to use. The previous version of Microsoft Japanese IME is always selected. +- 2 - Does not allow you to configure which Microsoft Japanese IME version to use. The new Microsoft Japanese IME version is always selected. + + + + +
                            + + +**TextInput/ConfigureSimplifiedChineseIMEVersion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +> [!NOTE] +> - This policy is enforced only in Windows 10 for desktop. +> - This policy requires reboot to take effect. + +Added in next major release of Windows 10. Allows IT admins to configure Microsoft Simplified Chinese IME version in the desktop. + + + +The following list shows the supported values: + +- 0 (default) - Allows you to configure which Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Simplified Chinese IME version to use. The previous version of Microsoft Simplified Chinese IME is always selected. +- 2 - Does not allow you to configure which Microsoft Simplified Chinese IME version to use. The new Microsoft Simplified Chinese IME version is always selected. + + + + +
                            + + +**TextInput/ConfigureTraditionalChineseIMEVersion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +> [!NOTE] +> - This policy is enforced only in Windows 10 for desktop. +> - This policy requires reboot to take effect. + +Added in next major release of Windows 10. Allows IT admins to configure Microsoft Traditional Chinese IME version in the desktop. + + + +The following list shows the supported values: + +- 0 (default) - Allows you to configure which Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is configured by default. +- 1 - Does not allow you to configure which Microsoft Traditional Chinese IME version to use. The previous version of Microsoft Traditional Chinese IME is always selected. +- 2 - Does not allow you to configure which Microsoft Traditional Chinese IME version to use. The new Microsoft Traditional Chinese IME version is always selected. + + + + +
                            + **TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -765,26 +1059,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -819,26 +1121,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -873,26 +1183,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -927,26 +1245,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -978,26 +1304,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1029,26 +1363,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1080,26 +1422,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1131,26 +1481,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1182,26 +1540,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1233,26 +1599,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1284,26 +1658,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1328,30 +1710,14 @@ The following list shows the supported values:
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. - -## TextInput policies supported by Microsoft Surface Hub - -- [TextInput/AllowIMELogging](#textinput-allowimelogging) -- [TextInput/AllowIMENetworkAccess](#textinput-allowimenetworkaccess) -- [TextInput/AllowInputPanel](#textinput-allowinputpanel) -- [TextInput/AllowJapaneseIMESurrogatePairCharacters](#textinput-allowjapaneseimesurrogatepaircharacters) -- [TextInput/AllowJapaneseIVSCharacters](#textinput-allowjapaneseivscharacters) -- [TextInput/AllowJapaneseNonPublishingStandardGlyph](#textinput-allowjapanesenonpublishingstandardglyph) -- [TextInput/AllowJapaneseUserDictionary](#textinput-allowjapaneseuserdictionary) -- [TextInput/AllowLanguageFeaturesUninstall](#textinput-allowlanguagefeaturesuninstall) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208](#textinput-excludejapaneseimeexceptjis0208) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](#textinput-excludejapaneseimeexceptjis0208andeudc) -- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](#textinput-excludejapaneseimeexceptshiftjis) - - diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index cac8f316bb..ffc5c62bec 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -1,12 +1,15 @@ --- title: Policy CSP - TimeLanguageSettings -description: Policy CSP - TimeLanguageSettings -ms.author: maricia +description: Learn which TimeLanguageSettings policies are supported for your edition of Windows. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - TimeLanguageSettings @@ -20,7 +23,7 @@ ms.date: 03/12/2018
                            - TimeLanguageSettings/AllowSet24HourClock + TimeLanguageSettings/ConfigureTimeZone
                            @@ -28,31 +31,39 @@ ms.date: 03/12/2018
                            -**TimeLanguageSettings/AllowSet24HourClock** +**TimeLanguageSettings/ConfigureTimeZone** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcross markcross markcross markcross markcheck mark2check mark2Homecross mark
                            Procheck mark6
                            Businesscheck mark6
                            Enterprisecheck mark6
                            Educationcheck mark6
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -63,25 +74,29 @@ ms.date: 03/12/2018 -Allows for the configuration of the default clock setting to be the 24 hour format. If set to 0 (zero), the device uses the default clock as prescribed by the current locale setting. +Specifies the time zone to be applied to the device. This is the standard Windows name for the target time zone. -The following list shows the supported values: - -- 0 (default) – Current locale setting. -- 1 – Set 24 hour clock. + + + + + +
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md new file mode 100644 index 0000000000..191bcd30d7 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -0,0 +1,151 @@ +--- +title: Policy CSP - Troubleshooting +description: Policy CSP - Troubleshooting +ms.author: dansimp +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: MariciaAlforque +ms.localizationpriority: medium +ms.date: 09/27/2019 +--- + +# Policy CSP - Troubleshooting + + + +
                            + + +## Troubleshooting policies + +
                            +
                            + Troubleshooting/AllowRecommendations +
                            +
                            + + +
                            + + +**Troubleshooting/AllowRecommendations** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecross mark
                            Procheck mark6
                            Businesscheck mark6
                            Enterprisecheck mark6
                            Educationcheck mark6
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +This policy setting allows IT admins to configure how to apply recommended troubleshooting for known problems on the devices in their domains or IT environments. + + + +ADMX Info: +- GP English name: *Troubleshooting: Allow users to access recommended troubleshooting for known problems* +- GP name: *TroubleshootingAllowRecommendations* +- GP path: *Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool* +- GP ADMX file name: *MSDT.admx* + + + +This is a numeric policy setting with merge algorithm (lowest value is the most secure) that uses the most restrictive settings for complex manageability scenarios. + +Supported values: +- 0 (default) - Turn this feature off. +- 1 - Turn this feature off but still apply critical troubleshooting. +- 2 - Notify users when recommended troubleshooting is available, then allow the user to run or ignore it. +- 3 - Run recommended troubleshooting automatically and notify the user after it ran successfully. +- 4 - Run recommended troubleshooting automatically without notifying the user. +- 5 - Allow the user to choose their own recommended troubleshooting settings. + +By default, this policy is not configured and the SKU based defaults are used for managed devices. Current policy values for SKU's are as follows: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            SKUUnmanaged DefaultManaged Default
                            HomePrompt (OOBE)Off
                            ProPrompt (OOBE)Off
                            EducationOn (auto)Off
                            EnterpriseOffOff
                            GovernmentOffOff
                            + + + + + + + + + +
                            + +Footnotes: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. + + + diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 2e24ad1c47..9d98a92f10 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -1,19 +1,21 @@ --- title: Policy CSP - Update description: Policy CSP - Update -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/29/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 10/04/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Update -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - +> [!NOTE] +> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
                            @@ -57,9 +59,24 @@ ms.date: 08/29/2018
                            Update/AutoRestartRequiredNotificationDismissal
                            +
                            + Update/AutomaticMaintenanceWakeUp +
                            Update/BranchReadinessLevel
                            +
                            + Update/ConfigureDeadlineForFeatureUpdates +
                            +
                            + Update/ConfigureDeadlineForQualityUpdates +
                            +
                            + Update/ConfigureDeadlineGracePeriod +
                            +
                            + Update/ConfigureDeadlineNoAutoReboot +
                            Update/ConfigureFeatureUpdateUninstallPeriod
                            @@ -188,9 +205,6 @@ ms.date: 08/29/2018 -
                            -> [!NOTE] -> If the MSA service is disabled, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
                            @@ -200,26 +214,34 @@ ms.date: 08/29/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcheck mark1Homecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -259,26 +281,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -315,26 +345,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcheck mark1Homecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -374,26 +412,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -411,7 +457,7 @@ Supported operations are Get and Replace. > [!IMPORTANT] > This option should be used only for systems under regulatory compliance, as you will not get security updates as well. -  + If the policy is not configured, end-users get the default behavior (Auto install and restart). @@ -446,26 +492,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -508,26 +562,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -567,26 +629,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -621,26 +691,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -686,26 +764,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -754,26 +840,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark5check mark5check mark5check mark5Homecross mark
                            Procheck mark5
                            Businesscheck mark5
                            Enterprisecheck mark5
                            Educationcheck mark5
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -822,26 +916,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -880,26 +982,34 @@ Supported values are 15, 30, 60, 120, and 240 (minutes). - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -934,31 +1044,39 @@ The following list shows the supported values:
                            -**Update/BranchReadinessLevel** +**Update/AutomaticMaintenanceWakeUp** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcheck mark1Homecross mark
                            Procheck mark6
                            Businesscheck mark6
                            Enterprisecheck mark6
                            Educationcheck mark6
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -969,7 +1087,83 @@ The following list shows the supported values: -Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from. +This policy setting allows you to configure if Automatic Maintenance should make a wake request to the OS for the daily scheduled maintenance. + +> [!Note] +> If the OS power wake policy is explicitly disabled, then this setting has no effect. + +If you enable this policy setting, Automatic Maintenance attempts to set OS wake policy and make a wake request for the daily scheduled time, if required. + +If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel applies. + + +ADMX Info: +- GP English name: *Automatic Maintenance WakeUp Policy* +- GP name: *WakeUpPolicy* +- GP path: *Windows Components/Maintenance Scheduler* +- GP ADMX file name: *msched.admx* + + + +Supported values: +- true - Enable +- false - Disable (Default) + + + + + + + + + +
                            + + +**Update/BranchReadinessLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from. As of 1903, the branch readiness levels of Semi-Annual Channel (Targeted) and Semi-Annual Channel have been combined into one Semi-Annual Channel set with a value of 16. For devices on 1903 and later releases, the value of 32 is not a supported value. @@ -987,8 +1181,8 @@ The following list shows the supported values: - 2 {0x2} - Windows Insider build - Fast (added in Windows 10, version 1709) - 4 {0x4} - Windows Insider build - Slow (added in Windows 10, version 1709) - 8 {0x8} - Release Windows Insider build (added in Windows 10, version 1709) -- 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted). -- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. +- 16 {0x10} - (default) Semi-annual Channel (Targeted). Device gets all applicable feature updates from Semi-annual Channel (Targeted). +- 32 {0x20} - Semi-annual Channel. Device gets feature updates from Semi-annual Channel. (*Only applicable to releases prior to 1903, for all releases 1903 and after the Semi-annual Channel and Semi-annual Channel (Targeted) into a single Semi-annual Channel with a value of 16) @@ -996,31 +1190,39 @@ The following list shows the supported values:
                            -**Update/ConfigureFeatureUpdateUninstallPeriod** +**Update/ConfigureDeadlineForFeatureUpdates** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark6
                            Businesscheck mark6
                            Enterprisecheck mark6
                            Educationcheck mark6
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1031,7 +1233,290 @@ The following list shows the supported values: -Added in Windows 10, version 1803. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days. +Added in Windows 10, version 1903. Allows IT admins to specify the number of days a user has before feature updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. + + + +ADMX Info: +- GP English name: *Specify deadlines for automatic updates and restarts* +- GP name: *ConfigureDeadlineForFeatureUpdates* +- GP element: *ConfigureDeadlineForFeatureUpdates* +- GP path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP ADMX file name: *WindowsUpdate.admx* + + + +Supports a numeric value from 2 - 30, which indicates the number of days a device will wait until performing an aggressive installation of a required feature update. + +Default value is 7. + + + + + + + + + +
                            + + +**Update/ConfigureDeadlineForQualityUpdates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecross mark
                            Procheck mark6
                            Businesscheck mark6
                            Enterprisecheck mark6
                            Educationcheck mark6
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +Added in Windows 10, version 1903. Allows IT admins to specify the number of days a user has before quality updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule. + + +ADMX Info: +- GP English name: *Specify deadlines for automatic updates and restarts* +- GP name: *ConfigureDeadlineForQualityUpdates* +- GP element: *ConfigureDeadlineForQualityUpdates* +- GP path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP ADMX file name: *WindowsUpdate.admx* + + + +Supports a numeric value from 2 - 30, which indicates the number of days a device will wait until performing an aggressive installation of a required quality update. + +Default value is 7. + + + + + + + + + +
                            + + +**Update/ConfigureDeadlineGracePeriod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecross mark
                            Procheck mark6
                            Businesscheck mark6
                            Enterprisecheck mark6
                            Educationcheck mark6
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +Added in Windows 10, version 1903. Allows the IT admin (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)) to specify a minimum number of days until restarts occur automatically. Setting the grace period may extend the effective deadline set by the deadline policies. + + +ADMX Info: +- GP English name: *Specify deadlines for automatic updates and restarts* +- GP name: *ConfigureDeadlineGracePeriod* +- GP element: *ConfigureDeadlineGracePeriod* +- GP path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP ADMX file name: *WindowsUpdate.admx* + + + +Supports a numeric value from 0 - 7, which indicates the minimum number of days a device will wait until performing an aggressive installation of a required update once deadline has been reached. + +Default value is 2. + + + + + + + + + +
                            + + +**Update/ConfigureDeadlineNoAutoReboot** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecross mark
                            Procheck mark6
                            Businesscheck mark6
                            Enterprisecheck mark6
                            Educationcheck mark6
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +Added in Windows 10, version 1903. If enabled (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)), devices will not automatically restart outside of active hours until the deadline is reached, even if applicable updates are already installed and pending a restart. + +When disabled, if the device has installed the required updates and is outside of active hours, it may attempt an automatic restart before the deadline. + + +ADMX Info: +- GP English name: *Specify deadlines for automatic updates and restarts* +- GP name: *ConfigureDeadlineNoAutoReboot* +- GP element: *ConfigureDeadlineNoAutoReboot* +- GP path: *Administrative Templates\Windows Components\WindowsUpdate* +- GP ADMX file name: *WindowsUpdate.admx* + + + +Supported values: +- 1 - Enabled +- 0 (default) - Disabled + + + + + + + + + +
                            + + +**Update/ConfigureFeatureUpdateUninstallPeriod** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +Added in Windows 10, version 1803. Enable IT admin to configure feature update uninstall period. Values range 2 - 60 days. Default is 10 days. @@ -1044,26 +1529,34 @@ Added in Windows 10, version 1803. Enable IT admin to configure feature update - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1103,26 +1596,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcheck mark1Homecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1157,26 +1658,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1205,31 +1714,31 @@ If the "Specify intranet Microsoft update service location" policy is enabled, t If the Allow Telemetry policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. OS upgrade: -- Maximum deferral: 8 months -- Deferral increment: 1 month -- Update type/notes: - - Upgrade - 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5 +- Maximum deferral: 8 months +- Deferral increment: 1 month +- Update type/notes: + - Upgrade - 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5 Update: -- Maximum deferral: 1 month -- Deferral increment: 1 week -- Update type/notes: - If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic. - - Security Update - 0FA1201D-4330-4FA8-8AE9-B877473B6441 - - Critical Update - E6CF1350-C01B-414D-A61F-263D14D133B4 - - Update Rollup - 28BC880E-0592-4CBF-8F95-C79B17911D5F - - Service Pack - 68C5B0A3-D1A6-4553-AE49-01D3A7827828 - - Tools - B4832BD8-E735-4761-8DAF-37F882276DAB - - Feature Pack - B54E7D24-7ADD-428F-8B75-90A396FA584F - - Update - CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83 - - Driver - EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0 +- Maximum deferral: 1 month +- Deferral increment: 1 week +- Update type/notes: + If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic. + - Security Update - 0FA1201D-4330-4FA8-8AE9-B877473B6441 + - Critical Update - E6CF1350-C01B-414D-A61F-263D14D133B4 + - Update Rollup - 28BC880E-0592-4CBF-8F95-C79B17911D5F + - Service Pack - 68C5B0A3-D1A6-4553-AE49-01D3A7827828 + - Tools - B4832BD8-E735-4761-8DAF-37F882276DAB + - Feature Pack - B54E7D24-7ADD-428F-8B75-90A396FA584F + - Update - CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83 + - Driver - EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0 Other/cannot defer: -- Maximum deferral: No deferral -- Deferral increment: No deferral -- Update type/notes: - Any update category not specifically enumerated above falls into this category. - - Definition Update - E0789628-CE08-4437-BE74-2495B842F43B +- Maximum deferral: No deferral +- Deferral increment: No deferral +- Update type/notes: + Any update category not specifically enumerated above falls into this category. + - Definition Update - E0789628-CE08-4437-BE74-2495B842F43B - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1362,26 +1879,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1414,26 +1939,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark3check mark3check mark3check mark3cross markcross markHomecross mark
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1478,26 +2011,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1512,7 +2053,7 @@ For Quality Updates, this policy specifies the deadline in days before automatic The system will reboot on or after the specified deadline. The reboot is prioritized over any configured Active Hours and any existing system and user busy checks. -> [!Note] +> [!NOTE] > If Update/EngagedDeadline is the only policy set (Update/EngagedRestartTransitionSchedule and Update/EngagedRestartSnoozeSchedule are not set), the behavior goes from reboot required -> engaged behavior -> forced reboot after deadline is reached with a 3-day snooze period. Value type is integer. Default is 14. @@ -1548,26 +2089,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark5check mark5check mark5check mark5Homecross mark
                            Procheck mark5
                            Businesscheck mark5
                            Enterprisecheck mark5
                            Educationcheck mark5
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1613,26 +2162,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1676,26 +2233,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark5check mark5check mark5check mark5Homecross mark
                            Procheck mark5
                            Businesscheck mark5
                            Enterprisecheck mark5
                            Educationcheck mark5
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1739,26 +2304,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1802,26 +2375,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark5check mark5check mark5check mark5Homecross mark
                            Procheck mark5
                            Businesscheck mark5
                            Enterprisecheck mark5
                            Educationcheck mark5
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1865,26 +2446,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1926,26 +2515,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1988,26 +2585,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2034,13 +2639,11 @@ The following list shows the supported values: To validate this policy: -1. Enable the policy ensure the device is on a cellular network. +1. Enable the policy and ensure the device is on a cellular network. 2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: - - `regd delete HKEY_USERS\S-1-5-21-2702878673-795188819-444038987-2781\software\microsoft\windows\currentversion\windowsupdate /v LastAutoAppUpdateSearchSuccessTime /f` - - - `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\Automatic App Update"""" /I""` - -3. Verify that any downloads that are above the download size limit will complete without being paused. + ```TShell + exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' + ``` @@ -2053,26 +2656,34 @@ To validate this policy: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2088,11 +2699,6 @@ Added in Windows 10, version 1703. Specifies whether to ignore the MO download > [!WARNING] > Setting this policy might cause devices to incur costs from MO operators. - - - `exec-device schtasks.exe -arguments ""/run /tn """"\Microsoft\Windows\WindowsUpdate\AUScheduledInstall"""" /I""` - -3. Verify that any downloads that are above the download size limit will complete without being paused. - The following list shows the supported values: @@ -2105,7 +2711,10 @@ The following list shows the supported values: To validate this policy: 1. Enable the policy and ensure the device is on a cellular network. -2. Run the scheduled task on phone to check for OS updates in the background. For example, on a mobile device, run the following commands in TShell: +2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: + ```TShell + exec-device schtasks.exe -arguments '/run /tn "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /I' + ``` @@ -2118,26 +2727,34 @@ To validate this policy: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark3check mark3check mark3check mark3cross markcheck mark2Homecross mark
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2178,26 +2795,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2244,26 +2869,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2306,26 +2939,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2338,7 +2979,7 @@ The following list shows the supported values: Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Feature Updates. -Value type is string. Supported operations are Add, Get, Delete, and Replace. +Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace. @@ -2360,26 +3001,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcheck mark1Homecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2419,26 +3068,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2451,7 +3108,7 @@ The following list shows the supported values: Added in Windows 10, version 1703. Specifies the date and time when the IT admin wants to start pausing the Quality Updates. -Value type is string. Supported operations are Add, Get, Delete, and Replace. +Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, Get, Delete, and Replace. @@ -2470,15 +3127,6 @@ ADMX Info: **Update/PhoneUpdateRestrictions** - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                            - - This policy is deprecated. Use [Update/RequireUpdateApproval](#update-requireupdateapproval) instead. @@ -2493,26 +3141,34 @@ This policy is deprecated. Use [Update/RequireUpdateApproval](#update-requireupd - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2554,26 +3210,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2610,26 +3274,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2668,26 +3340,34 @@ Supported values are 15, 30, or 60 (minutes). - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2730,26 +3410,34 @@ Supported values are 2, 4, 8, 12, or 24 (hours). - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2799,26 +3487,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark3check mark3check mark3check mark3check mark3cross markHomecross mark
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2855,26 +3551,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark3check mark3check mark3check mark3check mark3cross markHomecross mark
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2911,26 +3615,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark3check mark3check mark3check mark3check mark3cross markHomecross mark
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -2967,26 +3679,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark3check mark3check mark3check mark3check mark3cross markHomecross mark
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3023,26 +3743,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark3check mark3check mark3check mark3check mark3cross markHomecross mark
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3079,26 +3807,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3143,26 +3879,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3202,26 +3946,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark5check mark5check mark5check mark5Homecross mark
                            Procheck mark5
                            Businesscheck mark5
                            Enterprisecheck mark5
                            Educationcheck mark5
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3253,26 +4005,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark5check mark5check mark5check mark5Homecross mark
                            Procheck mark5
                            Businesscheck mark5
                            Enterprisecheck mark5
                            Educationcheck mark5
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3304,26 +4064,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcheck mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3364,26 +4132,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark5check mark5check mark5check mark5Homecross mark
                            Procheck mark5
                            Businesscheck mark5
                            Enterprisecheck mark5
                            Educationcheck mark5
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3402,7 +4178,7 @@ Options: - 1 – Turn off all notifications, excluding restart warnings - 2 – Turn off all notifications, including restart warnings -> [!Important] +> [!IMPORTANT] > If you choose not to get update notifications and also define other Group policies so that devices aren’t automatically getting updates, neither you nor device users will be aware of critical security, quality, or feature updates, and your devices may be at risk. @@ -3433,26 +4209,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3463,8 +4247,8 @@ ADMX Info: -> [!Important] -> Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enteprise and IoT Mobile. +> [!IMPORTANT] +> Starting in Windows 10, version 1703 this policy is not supported in Windows 10 Mobile Enterprise and IoT Mobile. Allows the device to check for updates from a WSUS server instead of Microsoft Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet. @@ -3490,20 +4274,20 @@ The following list shows the supported values: Example -``` syntax - - $CmdID$ - - - chr - text/plain - - - ./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl - - http://abcd-srv:8530 - - +```xml + + $CmdID$ + + + chr + text/plain + + + ./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl + + http://abcd-srv:8530 + + ``` @@ -3517,26 +4301,34 @@ Example - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -3555,7 +4347,7 @@ To use this setting, you must set two server name values: the server from which Value type is string and the default value is an empty string, "". If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. -> [!Note] +> [!NOTE] > If the "Configure Automatic Updates" Group Policy is disabled, then this policy has no effect. > If the "Alternate Download Server" Group Policy is not set, it will use the WSUS server by default to download updates. > This policy is not supported on Windows RT. Setting this policy will not have any effect on Windows RT PCs. @@ -3573,13 +4365,13 @@ ADMX Info:
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. - +- 6 - Added in Windows 10, version 1903. + diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 09b30b65c0..c485382b9e 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -1,24 +1,28 @@ --- title: Policy CSP - UserRights description: Policy CSP - UserRights -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 10/31/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - UserRights +
                            User rights are assigned for user accounts or groups. The name of the policy defines the user right in question, and the values are always users or groups. Values can be represented as SIDs or strings. Here is a list for reference, [Well-Known SID Structures](https://msdn.microsoft.com/library/cc980032.aspx). Even though strings are supported for well-known accounts and groups, it is better to use SIDs because strings are localized for different languages. Some user rights allow things like AccessFromNetwork, while others disallow things, like DenyAccessFromNetwork. Here is an example syncml for setting the user right BackupFilesAndDirectories for Administrators and Authenticated Users groups. -```syntax +```xml @@ -42,30 +46,39 @@ Here is an example syncml for setting the user right BackupFilesAndDirectories f Here are examples of data fields. The encoded 0xF000 is the standard delimiter/separator. -- Grant an user right to Administrators group via SID: - ``` - *S-1-5-32-544 - ``` +- Grant an user right to Administrators group via SID: + ``` + *S-1-5-32-544 + ``` -- Grant an user right to multiple groups (Administrators, Authenticated Users) via SID - ``` - *S-1-5-32-544*S-1-5-11 - ``` +- Grant an user right to multiple groups (Administrators, Authenticated Users) via SID + ``` + *S-1-5-32-544*S-1-5-11 + ``` -- Grant an user right to multiple groups (Administrators, Authenticated Users) via a mix of SID and Strings - ``` - *S-1-5-32-544Authenticated Users - ``` +- Grant an user right to multiple groups (Administrators, Authenticated Users) via a mix of SID and Strings + ``` + *S-1-5-32-544Authenticated Users + ``` -- Grant an user right to multiple groups (Authenticated Users, Administrators) via strings - ``` - Authenticated UsersAdministrators - ``` +- Grant an user right to multiple groups (Authenticated Users, Administrators) via strings + ``` + Authenticated UsersAdministrators + ``` -- Empty input indicates that there are no users configured to have that user right - ``` - - ``` +- Empty input indicates that there are no users configured to have that user right + ``` + + ``` + If you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag (``) to wrap the data fields. You can specify one or more user groups within the CDATA tag by using 0xF000 as the delimiter/separator. + +> [!Note] +> `` is the entity encoding of 0xF000. + +For example, the following syntax grants user rights to Authenticated Users and Replicator user groups: +``` + +```
                            @@ -171,26 +184,34 @@ Here are examples of data fields. The encoded 0xF000 is the standard delimiter/s - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -206,7 +227,7 @@ This user right is used by Credential Manager during Backup/Restore. No accounts GP Info: -- GP English name: *Access Credential Manager ase a trusted caller* +- GP English name: *Access Credential Manager as a trusted caller* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -220,26 +241,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -269,26 +298,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -318,26 +355,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -367,26 +412,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -416,26 +469,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -465,26 +526,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -514,26 +583,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -563,26 +640,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -612,26 +697,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -661,26 +754,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -710,26 +811,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -759,26 +868,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -808,26 +925,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -857,26 +982,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -906,26 +1039,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -955,26 +1096,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1004,26 +1153,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1057,26 +1214,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1106,26 +1271,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1155,26 +1328,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1204,26 +1385,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1253,26 +1442,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1302,26 +1499,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1351,26 +1556,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1400,26 +1613,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1449,26 +1670,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1498,26 +1727,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1547,26 +1784,34 @@ GP Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark4check mark4check mark4check mark4cross markcross markHomecross mark
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1589,12 +1834,14 @@ GP Info:
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 8d16e2c852..dbae4b5780 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -1,12 +1,15 @@ --- title: Policy CSP - Wifi description: Policy CSP - Wifi -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - Wifi @@ -48,6 +51,8 @@ ms.date: 05/14/2018 **WiFi/AllowWiFiHotSpotReporting** +
                            + This policy has been deprecated. @@ -62,26 +67,34 @@ This policy has been deprecated. - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -122,26 +135,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -182,26 +203,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1check markcheck markHomecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -237,26 +266,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1check markcheck markHomecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -289,26 +326,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -339,26 +384,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcheck markcheck markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -381,34 +434,14 @@ Supported operations are Add, Delete, Get, and Replace.
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. - -## Wifi policies that can be set using Exchange Active Sync (EAS) - -- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](#wifi-allowwifi) - - - -## Wifi policies supported by IoT Core - -- [Wifi/AllowAutoConnectToWiFiSenseHotspots](#wifi-allowautoconnecttowifisensehotspots) -- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](#wifi-allowwifi) -- [Wifi/WLANScanMode](#wifi-wlanscanmode) - - - -## Wifi policies supported by Microsoft Surface Hub - -- [WiFi/AllowWiFiHotSpotReporting](#wifi-allowwifihotspotreporting) - - diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index 8f02a364ba..12c192e3e0 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -1,17 +1,21 @@ --- title: Policy CSP - WindowsConnectionManager description: Policy CSP - WindowsConnectionManager -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 04/16/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - WindowsConnectionManager +
                            @@ -32,26 +36,34 @@ ms.date: 04/16/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -79,9 +91,9 @@ If this policy setting is not configured or is disabled, computers are allowed t > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -95,12 +107,14 @@ ADMX Info:
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index d8a9e0a74b..4db39b31f2 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -1,18 +1,21 @@ --- title: Policy CSP - WindowsDefenderSecurityCenter description: Policy CSP - WindowsDefenderSecurityCenter -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/09/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - WindowsDefenderSecurityCenter > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
                            @@ -98,26 +101,34 @@ ms.date: 08/09/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -152,26 +163,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark4check mark4check mark4check mark4check mark4cross markcross markHomecheck mark4
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -210,26 +229,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -270,26 +297,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                            Procheck mark5
                            Businesscheck mark5
                            Enterprisecheck mark5
                            Educationcheck mark5
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -344,26 +379,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark4check mark4check mark4check mark4check mark4cross markcross markHomecheck mark4
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -389,7 +432,7 @@ ADMX Info: Valid values: - 0 - (Disable) The users can see the display of the Device security area in Windows Defender Security Center. -- 1 - (Enable) The users cannot see the display of the Device secuirty area in Windows Defender Security Center. +- 1 - (Enable) The users cannot see the display of the Device security area in Windows Defender Security Center. @@ -402,26 +445,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -434,7 +485,7 @@ Valid values: Added in Windows 10, version 1709. Use this policy if you want Windows Defender Security Center to only display notifications which are considered critical. If you disable or do not configure this setting, Windows Defender Security Center will display critical and non-critical notifications to users. -> [!Note] +> [!NOTE] > If Suppress notification is enabled then users will not see critical or non-critical messages. Value type is integer. Supported operations are Add, Get, Replace and Delete. @@ -465,26 +516,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -525,26 +584,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -585,26 +652,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -645,26 +720,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -705,26 +788,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                            Procheck mark5
                            Businesscheck mark5
                            Enterprisecheck mark5
                            Educationcheck mark5
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -779,26 +870,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -839,26 +938,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -899,26 +1006,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -953,26 +1068,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1013,26 +1136,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1073,26 +1204,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark4check mark4check mark4check mark4check mark4cross markcross markHomecheck mark4
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1131,26 +1270,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark4check mark4check mark4check mark4check mark4cross markcross markHomecheck mark4
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1189,26 +1336,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark4check mark4check mark4check mark4check mark4cross markcross markHomecheck mark4
                            Procheck mark4
                            Businesscheck mark4
                            Enterprisecheck mark4
                            Educationcheck mark4
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1247,26 +1402,34 @@ Valid values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark5check mark5check mark5check mark5check mark5Homecheck mark5
                            Procheck mark5
                            Businesscheck mark5
                            Enterprisecheck mark5
                            Educationcheck mark5
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1323,26 +1486,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1377,26 +1548,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            check mark3check mark3check mark3check mark3check mark3cross markcross markHomecheck mark3
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1424,14 +1603,14 @@ ADMX Info:
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. - 5 - Added in Windows 10, version 1809. -- 6 - Added in the next major release of Windows 10. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index 200331150b..5b88961f3e 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -1,12 +1,15 @@ --- title: Policy CSP - WindowsInkWorkspace description: Policy CSP - WindowsInkWorkspace -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 05/14/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - WindowsInkWorkspace @@ -36,26 +39,34 @@ ms.date: 05/14/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -94,26 +105,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -147,12 +166,14 @@ Value type is int. The following list shows the supported values:
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index e75a0cf6de..f5558370d6 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -1,12 +1,15 @@ --- title: Policy CSP - WindowsLogon description: Policy CSP - WindowsLogon -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/12/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - WindowsLogon @@ -19,24 +22,200 @@ ms.date: 07/12/2018 ## WindowsLogon policies
                            +
                            + WindowsLogon/AllowAutomaticRestartSignOn +
                            +
                            + WindowsLogon/ConfigAutomaticRestartSignOn +
                            WindowsLogon/DisableLockScreenAppNotifications
                            WindowsLogon/DontDisplayNetworkSelectionUI
                            +
                            + WindowsLogon/EnableFirstLogonAnimation +
                            WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers
                            WindowsLogon/HideFastUserSwitching
                            -
                            - WindowsLogon/SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart -
                            +
                            + + +**WindowsLogon/AllowAutomaticRestartSignOn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecheck mark6
                            Procheck mark6
                            Businesscheck mark6
                            Enterprisecheck mark6
                            Educationcheck mark6
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +This policy setting controls whether a device automatically signs in and locks the last interactive user after the system restarts or after a shutdown and cold boot. + +This occurs only if the last interactive user did not sign out before the restart or shutdown.​ + +If the device is joined to Active Directory or Azure Active Directory, this policy applies only to Windows Update restarts. Otherwise, this policy applies to both Windows Update restarts and user-initiated restarts and shutdowns.​ + +If you do not configure this policy setting, it is enabled by default. When the policy is enabled, the user is automatically signed in and the session is automatically locked with all lock screen apps configured for that user after the device boots.​ + +After enabling this policy, you can configure its settings through the [ConfigAutomaticRestartSignOn](#windowslogon-configautomaticrestartsignon) policy, which configures the mode of automatically signing in and locking the last interactive user after a restart or cold boot​. + +If you disable this policy setting, the device does not configure automatic sign in. The user’s lock screen apps are not restarted after the system restarts. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Sign-in and lock last interactive user automatically after a restart* +- GP name: *AutomaticRestartSignOn* +- GP path: *Windows Components/Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + + + + + + + + + + + +
                            + + +**WindowsLogon/ConfigAutomaticRestartSignOn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecheck mark6
                            Procheck mark6
                            Businesscheck mark6
                            Enterprisecheck mark6
                            Educationcheck mark6
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +This policy setting controls the configuration under which an automatic restart, sign on, and lock occurs after a restart or cold boot. If you chose “Disabled” in the [AllowAutomaticRestartSignOn](#windowslogon-allowautomaticrestartsignon) policy, then automatic sign on does not occur and this policy need not be configured. + +If you enable this policy setting, you can choose one of the following two options: + +- Enabled if BitLocker is on and not suspended: Specifies that automatic sign on and lock occurs only if BitLocker is active and not suspended during the reboot or shutdown. Personal data can be accessed on the device’s hard drive at this time if BitLocker is not on or suspended during an update. BitLocker suspension temporarily removes protection for system components and data but may be needed in certain circumstances to successfully update boot-critical components. +BitLocker is suspended during updates if: + - The device does not have TPM 2.0 and PCR7 + - The device does not use a TPM-only protector +- Always Enabled: Specifies that automatic sign on happens even if BitLocker is off or suspended during reboot or shutdown. When BitLocker is not enabled, personal data is accessible on the hard drive. Automatic restart and sign on should only be run under this condition if you are confident that the configured device is in a secure physical location. + +If you disable or do not configure this setting, automatic sign on defaults to the “Enabled if BitLocker is on and not suspended” behavior. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot* +- GP name: *ConfigAutomaticRestartSignOn* +- GP path: *Windows Components/Windows Logon Options* +- GP ADMX file name: *WinLogon.admx* + + + + + + + + + + + + +
                            @@ -45,26 +224,34 @@ ms.date: 07/12/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -84,9 +271,9 @@ If you disable or do not configure this policy setting, users can choose which a > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -107,26 +294,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -145,7 +340,7 @@ If you disable or don't configure this policy setting, any user can disconnect t Here is an example to enable this policy: -``` syntax +```xml @@ -171,9 +366,9 @@ Here is an example to enable this policy: > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -188,32 +383,119 @@ ADMX Info:
                            + +**WindowsLogon/EnableFirstLogonAnimation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                            Windows EditionSupported?
                            Homecross mark
                            Procheck mark6
                            Businesscheck mark6
                            Enterprisecheck mark6
                            Educationcheck mark6
                            + + +
                            + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
                            + + + +This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users are offered the opt-in prompt for services during their first sign-in. + +If you enable this policy setting, Microsoft account users see the opt-in prompt for services, and users with other accounts see the sign-in animation. + +If you disable this policy setting, users do not see the animation and Microsoft account users do not see the opt-in prompt for services. + +If you do not configure this policy setting, the user who completes the initial Windows setup see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting is not configured, users new to this computer do not see the animation. + +> [!NOTE] +> The first sign-in animation is not displayed on Server, so this policy has no effect. + + + +ADMX Info: +- GP English name: *Show first sign-in animation* +- GP name: *EnableFirstLogonAnimation* +- GP path: *System/Logon* +- GP ADMX file name: *Logon.admx* + + + +Supported values: +- 0 - disabled +- 1 - enabled + + + + + + + + + +
                            + **WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers** - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -233,9 +515,9 @@ If you disable or do not configure this policy setting, the Logon UI will not en > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -256,26 +538,34 @@ ADMX Info: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -312,76 +602,16 @@ To validate on Desktop, do the following: -
                            - -**WindowsLogon/SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart** - - - - - - - - - - - - - - - - - - - - - -
                            HomeProBusinessEnterpriseEducationMobileMobile Enterprise
                            cross markcheck markcheck markcheck markcheck markcross markcross mark
                            - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
                            - - - -This policy setting controls whether a device will automatically sign-in the last interactive user after Windows Update restarts the system. - -If you enable or do not configure this policy setting, the device securely saves the user's credentials (including the user name, domain and encrypted password) to configure automatic sign-in after a Windows Update restart. After the Windows Update restart, the user is automatically signed-in and the session is automatically locked with all the lock screen apps configured for that user. - -If you disable this policy setting, the device does not store the user's credentials for automatic sign-in after a Windows Update restart. The users' lock screen apps are not restarted after the system restarts. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Sign-in last interactive user automatically after a system-initiated restart* -- GP name: *AutomaticRestartSignOn* -- GP path: *Windows Components/Windows Logon Options* -- GP ADMX file name: *WinLogon.admx* - - - -
                            - -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index 9fc4dd7314..6ea895cd9a 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -1,17 +1,21 @@ --- title: Policy CSP - WindowsPowerShell description: Policy CSP - WindowsPowerShell -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 04/16/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - WindowsPowerShell +
                            @@ -32,26 +36,34 @@ ms.date: 04/16/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck markcheck markcheck markcheck markcross markcross markHomecross mark
                            Procheck mark
                            Businesscheck mark
                            Enterprisecheck mark
                            Educationcheck mark
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -76,9 +88,9 @@ Note: This policy setting exists under both Computer Configuration and User Conf > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - +> > You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - +> > The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). @@ -92,12 +104,14 @@ ADMX Info:
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 96beff9c33..056759ea10 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -1,12 +1,15 @@ --- title: Policy CSP - WirelessDisplay description: Policy CSP - WirelessDisplay -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/09/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 09/27/2019 +ms.reviewer: +manager: dansimp --- # Policy CSP - WirelessDisplay @@ -54,26 +57,34 @@ ms.date: 08/09/2018 - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark3check mark3check mark3check mark3check mark3check mark3Homecross mark
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -104,26 +115,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark3check mark3check mark3check mark3check mark3check mark3Homecross mark
                            Procheck mark3
                            Businesscheck mark3
                            Enterprisecheck mark3
                            Educationcheck mark3
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -154,26 +173,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -204,26 +231,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -254,26 +289,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -316,26 +359,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2check mark2check mark2Homecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -366,26 +417,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark2check mark2check mark2check mark2cross markcross markHomecross mark
                            Procheck mark2
                            Businesscheck mark2
                            Enterprisecheck mark2
                            Educationcheck mark2
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -416,26 +475,34 @@ The following list shows the supported values: - - - - - - - + + - - - - - - - + + + + + + + + + + + + + + + + + +
                            HomeProBusinessEnterpriseEducationMobileMobile EnterpriseWindows EditionSupported?
                            cross markcheck mark1check mark1check mark1check mark1cross markcross markHomecross mark
                            Procheck mark1
                            Businesscheck mark1
                            Enterprisecheck mark1
                            Educationcheck mark1
                            +
                            + [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -471,12 +538,14 @@ The following list shows the supported values:
                            -Footnote: +Footnotes: - 1 - Added in Windows 10, version 1607. - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in Windows 10, version 1809. +- 6 - Added in Windows 10, version 1903. diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index e9e1339f46..8a9c1a34dc 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -2,34 +2,38 @@ title: Policy DDF file description: Policy DDF file ms.assetid: D90791B5-A772-4AF8-B058-5D566865AF8D -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 08/29/2018 +author: manikadhiman +ms.localizationpriority: medium +ms.date: 05/21/2019 --- # Policy DDF file -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. This topic shows the OMA DM device description framework (DDF) for the **Policy** configuration service provider. DDF files are used only with OMA DM provisioning XML. -You can download the DDF files from the links below: +You can view various Policy DDF files by clicking the following links: -- [Download the Policy DDF file for Windows 10, version 1803](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml) -- [Download the Policy DDF file for Windows 10, version 1803 release C](http://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all_1809C_release.xml) -- [Download the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml) -- [Download the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml) -- [Download the Policy DDF file for Windows 10, version 1607](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607.xml) -- [Download the Policy DDF file for Windows 10, version 1607 release 8C](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) -- [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download) +- [View the Policy DDF file for Windows 10, version 1903](https://download.microsoft.com/download/0/C/D/0CD61812-8B9C-4846-AC4A-1545BFD201EE/PolicyDDF_all_1903.xml) +- [View the Policy DDF file for Windows 10, version 1809](https://download.microsoft.com/download/7/3/5/735B8537-82F4-4CD1-B059-93984F9FAAC5/Policy_DDF_all_1809.xml) +- [View the Policy DDF file for Windows 10, version 1803](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml) +- [View the Policy DDF file for Windows 10, version 1803 release C](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all_1809C_release.xml) +- [View the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml) +- [View the Policy DDF file for Windows 10, version 1703](https://download.microsoft.com/download/7/2/C/72C36C37-20F9-41BF-8E23-721F6FFC253E/PolicyDDF_all.xml) +- [View the Policy DDF file for Windows 10, version 1607](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607.xml) +- [View the Policy DDF file for Windows 10, version 1607 release 8C](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) -The XML below is the DDF for Windows 10, version 1809. +You can download DDF files for various CSPs from [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -``` syntax +The XML below is the DDF for Windows 10, version 1903. + +```xml - com.microsoft/8.0/MDM/Policy + com.microsoft/9.0/MDM/Policy @@ -1420,12 +1424,12 @@ Related policy: If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: - + <support.contoso.com><support.microsoft.com> If disabled or not configured, the webpages specified in App settings loads as the default Start pages. Version 1703 or later: -If you do not want to send traffic to Microsoft, enable this policy and use the value, which honors domain- and non-domain-joined devices, when it is the only configured URL. +If you do not want to send traffic to Microsoft, enable this policy and use the <about:blank> value, which honors domain- and non-domain-joined devices, when it is the only configured URL. Version 1809: If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. @@ -1642,7 +1646,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -1653,10 +1657,10 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) - How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) - How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager (https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) - How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) @@ -2733,6 +2737,30 @@ Related policy: + + AllowEnhancedSuggestionsInAddressBar + + + + + + + + + + + + + + + + + + + text/plain + + + AllowEnterpriseModeFromToolsMenu @@ -3237,6 +3265,30 @@ Related policy: + + DisableActiveXVersionListAutoDownload + + + + + + + + + + + + + + + + + + + text/plain + + + DisableAdobeFlash @@ -3309,6 +3361,30 @@ Related policy: + + DisableCompatView + + + + + + + + + + + + + + + + + + + text/plain + + + DisableConfiguringHistory @@ -3453,6 +3529,30 @@ Related policy: + + DisableFeedsBackgroundSync + + + + + + + + + + + + + + + + + + + text/plain + + + DisableFirstRunWizard @@ -3501,6 +3601,30 @@ Related policy: + + DisableGeolocation + + + + + + + + + + + + + + + + + + + text/plain + + + DisableHomePageChange @@ -3693,6 +3817,30 @@ Related policy: + + DisableWebAddressAutoComplete + + + + + + + + + + + + + + + + + + + text/plain + + + DoNotAllowActiveXControlsInProtectedMode @@ -6765,6 +6913,30 @@ Related policy: + + NewTabDefaultPage + + + + + + + + + + + + + + + + + + + text/plain + + + NotificationBarInternetExplorerProcesses @@ -10235,7 +10407,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + 0 The favorites bar shows your user's links to sites they have added to it. With this policy, you can specify whether to set the favorites bar to always be visible or hidden on any page. If enabled, favorites bar is always visible on any page, and the favorites bar toggle in Settings sets to On, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. The show bar/hide bar option is hidden from the context menu. @@ -10603,12 +10775,12 @@ Related policy: If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: - + <support.contoso.com><support.microsoft.com> If disabled or not configured, the webpages specified in App settings loads as the default Start pages. Version 1703 or later: -If you do not want to send traffic to Microsoft, enable this policy and use the value, which honors domain- and non-domain-joined devices, when it is the only configured URL. +If you do not want to send traffic to Microsoft, enable this policy and use the <about:blank> value, which honors domain- and non-domain-joined devices, when it is the only configured URL. Version 1809: If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. @@ -10851,7 +11023,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -10862,10 +11034,10 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) - How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) - How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager (https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) - How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) @@ -12022,6 +12194,33 @@ Related policy: LastWrite + + AllowEnhancedSuggestionsInAddressBar + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + AllowServicePoweredQSA + LastWrite + + AllowEnterpriseModeFromToolsMenu @@ -12589,6 +12788,33 @@ Related policy: LastWrite + + DisableActiveXVersionListAutoDownload + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement + VersionListAutomaticDownloadDisable + LastWrite + + DisableAdobeFlash @@ -12670,6 +12896,33 @@ Related policy: LastWrite + + DisableCompatView + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView + CompatView_DisableList + LastWrite + + DisableConfiguringHistory @@ -12832,6 +13085,33 @@ Related policy: LastWrite + + DisableFeedsBackgroundSync + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~RSS_Feeds + Disable_Background_Syncing + LastWrite + + DisableFirstRunWizard @@ -12886,6 +13166,33 @@ Related policy: LastWrite + + DisableGeolocation + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + GeolocationDisable + LastWrite + + DisableHomePageChange @@ -13102,6 +13409,33 @@ Related policy: LastWrite + + DisableWebAddressAutoComplete + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + RestrictWebAddressSuggest + LastWrite + + DoNotAllowActiveXControlsInProtectedMode @@ -16558,6 +16892,33 @@ Related policy: LastWrite + + NewTabDefaultPage + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + NewTabAction + LastWrite + + NotificationBarInternetExplorerProcesses @@ -19148,7 +19509,7 @@ Related policy: - com.microsoft/8.0/MDM/Policy + com.microsoft/9.0/MDM/Policy @@ -20830,6 +21191,30 @@ Related policy: + + ConfigureWebcamAccessDomainNames + + + + + + + + Specifies a list of domains that are allowed to access the webcam in CXH-based authentication scenarios. + + + + + + + + + + + text/plain + + + EnableFastFirstSignIn @@ -22414,12 +22799,12 @@ Related policy: If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: - + <support.contoso.com><support.microsoft.com> If disabled or not configured, the webpages specified in App settings loads as the default Start pages. Version 1703 or later: -If you do not want to send traffic to Microsoft, enable this policy and use the value, which honors domain- and non-domain-joined devices, when it is the only configured URL. +If you do not want to send traffic to Microsoft, enable this policy and use the <about:blank> value, which honors domain- and non-domain-joined devices, when it is the only configured URL. Version 1809: If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. @@ -22636,7 +23021,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -22647,10 +23032,10 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) - How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) - How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager (https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) - How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) @@ -23525,6 +23910,7 @@ Related policy: + @@ -24870,6 +25256,30 @@ Related policy: + + SecurityIntelligenceLocation + + + + + + + + + + + + + + + + + + + text/plain + + + SignatureUpdateFallbackOrder @@ -25108,6 +25518,54 @@ Related policy: + + DODelayCacheServerFallbackBackground + + + + + + + + + + + + + + + + + + + text/plain + + + + + DODelayCacheServerFallbackForeground + + + + + + + + + + + + + + + + + + + text/plain + + + DODelayForegroundDownloadFromHttp @@ -25731,6 +26189,100 @@ Related policy: + + DeviceHealthMonitoring + + + + + + + + + + + + + + + + + + + + + AllowDeviceHealthMonitoring + + + + + + + + Enable/disable 4Nines device health monitoring on devices. + + + + + + + + + + + text/plain + + + + + ConfigDeviceHealthMonitoringScope + + + + + + + + If the device is not opted-in to the DeviceHealthMonitoring service via the AllowDeviceHealthMonitoring then this policy has no meaning. For devices which are opted in, the value of this policy modifies which types of events are monitored. + + + + + + + + + + + text/plain + + + + + ConfigDeviceHealthMonitoringUploadDestination + + + + + + + + If the device is not opted-in to the DeviceHealthMonitoring service via the AllowDeviceHealthMonitoring then this policy has no meaning. For devices which are opted in, the value of this policy modifies which destinations are in-scope for monitored events to be uploaded. + + + + + + + + + + + text/plain + + + + DeviceInstallation @@ -27260,6 +27812,35 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + ShowLockOnUserTile + + + + + + + + Shows or hides lock from the user tile menu. +If you enable this policy setting, the lock option will be shown in the User Tile menu. + +If you disable this policy setting, the lock option will never be shown in the User Tile menu. + +If you do not configure this policy setting, users will be able to choose whether they want lock to show through the Power Options Control Panel. + + + + + + + + + + + text/plain + + + ExploitGuard @@ -27634,6 +28215,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + AllowEnhancedSuggestionsInAddressBar + + + + + + + + + + + + + + + + + + + text/plain + + + AllowEnterpriseModeFromToolsMenu @@ -28162,6 +28767,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisableActiveXVersionListAutoDownload + + + + + + + + + + + + + + + + + + + text/plain + + + DisableAdobeFlash @@ -28234,6 +28863,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisableCompatView + + + + + + + + + + + + + + + + + + + text/plain + + + DisableConfiguringHistory @@ -28378,6 +29031,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisableFeedsBackgroundSync + + + + + + + + + + + + + + + + + + + text/plain + + + DisableFirstRunWizard @@ -28426,6 +29103,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisableGeolocation + + + + + + + + + + + + + + + + + + + text/plain + + + DisableIgnoringCertificateErrors @@ -28618,6 +29319,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisableWebAddressAutoComplete + + + + + + + + + + + + + + + + + + + text/plain + + + DoNotAllowActiveXControlsInProtectedMode @@ -31738,6 +32463,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + NewTabDefaultPage + + + + + + + + + + + + + + + + + + + text/plain + + + NotificationBarInternetExplorerProcesses @@ -34140,7 +34889,8 @@ Default: This policy is not defined and CD-ROM access is not restricted to the l Interactive Logon:Display user information when the session is locked User display name, domain and user names (1) User display name only (2) -Do not display user information (3) +Do not display user information (3) +Domain and user names only (4) @@ -35488,52 +36238,6 @@ The options are: - - Location - - - - - - - - - - - - - - - - - - - - - EnableLocation - - - - - - - - - - - - - - - - - - - text/plain - - - - LockDown @@ -36405,6 +37109,62 @@ The options are: + + EnergySaverBatteryThresholdOnBattery + + + + + + + + This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + +If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. + +If you disable or do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + + + EnergySaverBatteryThresholdPluggedIn + + + + + + + + This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + +If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. + +If you disable or do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + HibernateTimeoutOnBattery @@ -36501,6 +37261,210 @@ The options are: + + SelectLidCloseActionOnBattery + + + + + + + + This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + + + SelectLidCloseActionPluggedIn + + + + + + + + This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + + + SelectPowerButtonActionOnBattery + + + + + + + + This policy setting specifies the action that Windows takes when a user presses the power button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + + + SelectPowerButtonActionPluggedIn + + + + + + + + This policy setting specifies the action that Windows takes when a user presses the power button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + + + SelectSleepButtonActionOnBattery + + + + + + + + This policy setting specifies the action that Windows takes when a user presses the sleep button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + + + SelectSleepButtonActionPluggedIn + + + + + + + + This policy setting specifies the action that Windows takes when a user presses the sleep button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + StandbyTimeoutOnBattery @@ -36549,6 +37513,122 @@ The options are: + + TurnOffHybridSleepOnBattery + + + + + + + + This policy setting allows you to turn off hybrid sleep. + +If you set this to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). + +If you do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + + + TurnOffHybridSleepPluggedIn + + + + + + + + This policy setting allows you to turn off hybrid sleep. + +If you set this to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). + +If you do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + + + UnattendedSleepTimeoutOnBattery + + + + + + + + This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. + +If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + + + + + + + + + + + text/plain + + + + + UnattendedSleepTimeoutPluggedIn + + + + + + + + This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. + +If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + + + + + + + + + + + text/plain + + + Printers @@ -38321,6 +39401,54 @@ The options are: + + LetAppsActivateWithVoice + + + + + + + + This policy setting specifies whether Windows apps can be activated by voice. + + + + + + + + + + + text/plain + + + + + LetAppsActivateWithVoiceAboveLock + + + + + + + + This policy setting specifies whether Windows apps can be activated by voice while the system is locked. + + + + + + + + + + + text/plain + + + LetAppsGetDiagnosticInfo @@ -39700,6 +40828,30 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + AllowFindMyFiles + + + + + + + + This feature allows you to disable find my files completely on the machine + + + + + + + + + + + text/plain + + + AllowIndexingEncryptedStoresOrItems @@ -40275,6 +41427,52 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + ServiceControlManager + + + + + + + + + + + + + + + + + + + + + SvchostProcessMitigation + + + + + + + + + + + + + + + + + + + text/plain + + + + Settings @@ -41512,6 +42710,150 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + AllowStorageSenseGlobal + + + + + + + + + + + + + + + + + + + text/plain + + + + + AllowStorageSenseTemporaryFilesCleanup + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigStorageSenseCloudContentDehydrationThreshold + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigStorageSenseDownloadsCleanupThreshold + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigStorageSenseGlobalCadence + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigStorageSenseRecycleBinCleanupThreshold + + + + + + + + + + + + + + + + + + + text/plain + + + EnhancedStorageDevices @@ -41606,6 +42948,30 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + AllowCommercialDataPipeline + + + + + + + + + + + + + + + + + + + text/plain + + + AllowDeviceNameInDiagnosticData @@ -41942,6 +43308,30 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + DisableDirectXDatabaseUpdate + + + + + + + + This group policy allows control over whether the DirectX Database Updater task will be run on the system. + + + + + + + + + + + text/plain + + + DisableEnterpriseAuthProxy @@ -42086,6 +43476,34 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + TurnOffFileHistory + + + + + + + + This policy setting allows you to turn off File History. + +If you enable this policy setting, File History cannot be activated to create regular, automatic backups. + +If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups. + + + + + + + + + + + text/plain + + + SystemServices @@ -42964,6 +44382,85 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + ConfigureTimeZone + + + + + + + + Specifies the time zone to be applied to the device. This is the standard Windows name for the target time zone. + + + + + + + + + + + text/plain + + + + + + Troubleshooting + + + + + + + + + + + + + + + + + + + + + AllowRecommendations + + + + + + + + This policy setting applies recommended troubleshooting for known problems on the device and lets administrators configure how it's applied to their domains/IT environments. +Not configuring this policy setting will allow the user to configure if and how recommended troubleshooting is applied. + +Enabling this policy allows you to configure how recommended troubleshooting is applied on the user's device. You can select from one of the following values: +0 = Turn this feature off. +1 = Turn this feature off but still apply critical troubleshooting. +2 = Notify users when recommended troubleshooting is available, then allow the user to run or ignore it. +3 = Run recommended troubleshooting automatically and notify the user after it's been successfully run. +4 = Run recommended troubleshooting automatically without notifying the user. +5 = Allow the user to choose their own recommended troubleshooting settings. + + + + + + + + + + + text/plain + + + Update @@ -43178,6 +44675,36 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + AutomaticMaintenanceWakeUp + + + + + + + + This policy setting allows you to configure Automatic Maintenance wake up policy. + +The maintenance wakeup policy specifies if Automatic Maintenance should make a wake request to the OS for the daily scheduled maintenance. Note, that if the OS power wake policy is explicitly disabled, then this setting has no effect. + +If you enable this policy setting, Automatic Maintenance will attempt to set OS wake policy and make a wake request for the daily scheduled time, if required. + +If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel will apply. + + + + + + + + + + + text/plain + + + AutoRestartDeadlinePeriodInDays @@ -43298,6 +44825,102 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + ConfigureDeadlineForFeatureUpdates + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigureDeadlineForQualityUpdates + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigureDeadlineGracePeriod + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigureDeadlineNoAutoReboot + + + + + + + + + + + + + + + + + + + text/plain + + + ConfigureFeatureUpdateUninstallPeriod @@ -45882,6 +47505,54 @@ Because of these factors, users do not usually need this user right. Warning: If + + AllowAutomaticRestartSignOn + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigAutomaticRestartSignOn + + + + + + + + + + + + + + + + + + + text/plain + + + DisableLockScreenAppNotifications @@ -45930,6 +47601,38 @@ Because of these factors, users do not usually need this user right. Warning: If + + EnableFirstLogonAnimation + + + + + + + + This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users will be offered the opt-in prompt for services during their first sign-in. + +If you enable this policy setting, Microsoft account users will see the opt-in prompt for services, and users with other accounts will see the sign-in animation. + +If you disable this policy setting, users will not see the animation and Microsoft account users will not see the opt-in prompt for services. + +If you do not configure this policy setting, the user who completes the initial Windows setup will see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting is not configured, users new to this computer will not see the animation. + +Note: The first sign-in animation will not be shown on Server, so this policy will have no effect. + + + + + + + + + + + text/plain + + + EnumerateLocalUsersOnDomainJoinedComputers @@ -45978,30 +47681,6 @@ Because of these factors, users do not usually need this user right. Warning: If - - SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart - - - - - - - - - - - - - - - - - - - text/plain - - - WindowsPowerShell @@ -47993,6 +49672,30 @@ Because of these factors, users do not usually need this user right. Warning: If LowestValueMostSecure + + ConfigureWebcamAccessDomainNames + + + + + + Specifies a list of domains that are allowed to access the webcam in CXH-based authentication scenarios. + + + + + + + + + + + text/plain + + LastWrite + ; + + EnableFastFirstSignIn @@ -49356,7 +51059,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + 0 The favorites bar shows your user's links to sites they have added to it. With this policy, you can specify whether to set the favorites bar to always be visible or hidden on any page. If enabled, favorites bar is always visible on any page, and the favorites bar toggle in Settings sets to On, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. The show bar/hide bar option is hidden from the context menu. @@ -49724,12 +51427,12 @@ Related policy: If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: - + <support.contoso.com><support.microsoft.com> If disabled or not configured, the webpages specified in App settings loads as the default Start pages. Version 1703 or later: -If you do not want to send traffic to Microsoft, enable this policy and use the value, which honors domain- and non-domain-joined devices, when it is the only configured URL. +If you do not want to send traffic to Microsoft, enable this policy and use the <about:blank> value, which honors domain- and non-domain-joined devices, when it is the only configured URL. Version 1809: If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. @@ -49972,7 +51675,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. -When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and extension. When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. @@ -49983,10 +51686,10 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/configmgr/protect/deploy-use/find-a-pfn-for-per-app-vpn) - How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) - How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- Manage apps from the Microsoft Store for Business with Microsoft Endpoint Configuration Manager (https://docs.microsoft.com/configmgr/apps/deploy-use/manage-apps-from-the-windows-store-for-business) - How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) @@ -52448,6 +54151,34 @@ Related policy: LastWrite + + SecurityIntelligenceLocation + + + + + + + + + + + + + + + + + text/plain + + phone + WindowsDefender.admx + SignatureUpdate_SharedSignaturesLocation + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~SignatureUpdate + SignatureUpdate_SharedSignaturesLocation + LastWrite + + SignatureUpdateFallbackOrder @@ -52721,6 +54452,62 @@ Related policy: LastWrite + + DODelayCacheServerFallbackBackground + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + DelayCacheServerFallbackBackground + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + DelayCacheServerFallbackBackground + LastWrite + + + + DODelayCacheServerFallbackForeground + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + DelayCacheServerFallbackForeground + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + DelayCacheServerFallbackForeground + LastWrite + + DODelayForegroundDownloadFromHttp @@ -52824,7 +54611,7 @@ Related policy: text/plain - + DeliveryOptimization.admx GroupIdSource DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat @@ -53272,9 +55059,6 @@ Related policy: text/plain - DeliveryOptimization.admx - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - SetHoursToLimitBackgroundDownloadBandwidth LastWrite @@ -53307,7 +55091,7 @@ Related policy: + /> @@ -53334,9 +55118,6 @@ Related policy: text/plain - DeliveryOptimization.admx - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - SetHoursToLimitForegroundDownloadBandwidth LastWrite @@ -53369,7 +55150,7 @@ Related policy: + /> @@ -53512,6 +55293,96 @@ Related policy: + + DeviceHealthMonitoring + + + + + + + + + + + + + + + + + + + AllowDeviceHealthMonitoring + + + + + 0 + Enable/disable 4Nines device health monitoring on devices. + + + + + + + + + + + text/plain + + + LastWrite + + + + ConfigDeviceHealthMonitoringScope + + + + + + If the device is not opted-in to the DeviceHealthMonitoring service via the AllowDeviceHealthMonitoring then this policy has no meaning. For devices which are opted in, the value of this policy modifies which types of events are monitored. + + + + + + + + + + + text/plain + + LastWrite + + + + ConfigDeviceHealthMonitoringUploadDestination + + + + + + If the device is not opted-in to the DeviceHealthMonitoring service via the AllowDeviceHealthMonitoring then this policy has no meaning. For devices which are opted in, the value of this policy modifies which destinations are in-scope for monitored events to be uploaded. + + + + + + + + + + + text/plain + + LastWrite + + + DeviceInstallation @@ -55136,6 +57007,38 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor HighestValueMostSecure + + ShowLockOnUserTile + + + + + 1 + Shows or hides lock from the user tile menu. +If you enable this policy setting, the lock option will be shown in the User Tile menu. + +If you disable this policy setting, the lock option will never be shown in the User Tile menu. + +If you do not configure this policy setting, users will be able to choose whether they want lock to show through the Power Options Control Panel. + + + + + + + + + + + text/plain + + + WindowsExplorer.admx + WindowsExplorer~AT~WindowsExplorer + ShowLockOption + HighestValueMostSecure + + ExploitGuard @@ -55531,6 +57434,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + AllowEnhancedSuggestionsInAddressBar + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + AllowServicePoweredQSA + LastWrite + + AllowEnterpriseModeFromToolsMenu @@ -56125,6 +58055,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + DisableActiveXVersionListAutoDownload + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement + VersionListAutomaticDownloadDisable + LastWrite + + DisableAdobeFlash @@ -56206,6 +58163,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + DisableCompatView + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView + CompatView_DisableList + LastWrite + + DisableConfiguringHistory @@ -56368,6 +58352,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + DisableFeedsBackgroundSync + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~RSS_Feeds + Disable_Background_Syncing + LastWrite + + DisableFirstRunWizard @@ -56422,6 +58433,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + DisableGeolocation + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + GeolocationDisable + LastWrite + + DisableIgnoringCertificateErrors @@ -56638,6 +58676,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + DisableWebAddressAutoComplete + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + RestrictWebAddressSuggest + LastWrite + + DoNotAllowActiveXControlsInProtectedMode @@ -60148,6 +62213,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + NewTabDefaultPage + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + NewTabAction + LastWrite + + NotificationBarInternetExplorerProcesses @@ -62109,6 +64201,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone LastWrite + 0xF000 @@ -62792,7 +64885,8 @@ Default: This policy is not defined and CD-ROM access is not restricted to the l Interactive Logon:Display user information when the session is locked User display name, domain and user names (1) User display name only (2) -Do not display user information (3) +Do not display user information (3) +Domain and user names only (4) @@ -62805,7 +64899,7 @@ Do not display user information (3) text/plain - + phone Windows Settings~Security Settings~Local Policies~Security Options Interactive logon: Display user information when the session is locked @@ -64255,53 +66349,6 @@ The options are: - - Location - - - - - - - - - - - - - - - - - - - EnableLocation - - - - - 0 - - - - - - - - - - - - text/plain - - - LocationProviderAdm.admx - LocationProviderAdm~AT~LocationAndSensors~WindowsLocationProvider - DisableWindowsLocationProvider_1 - LastWrite - - - LockDown @@ -65234,6 +67281,70 @@ The options are: LastWrite + + EnergySaverBatteryThresholdOnBattery + + + + + 0 + This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + +If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. + +If you disable or do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + Power.admx + EnterEsBattThreshold + Power~AT~System~PowerManagementCat~EnergySaverSettingsCat + EsBattThresholdDC + LastWrite + + + + EnergySaverBatteryThresholdPluggedIn + + + + + 0 + This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + +If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. + +If you disable or do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + Power.admx + EnterEsBattThreshold + Power~AT~System~PowerManagementCat~EnergySaverSettingsCat + EsBattThresholdAC + LastWrite + + HibernateTimeoutOnBattery @@ -65342,6 +67453,234 @@ The options are: LastWrite + + SelectLidCloseActionOnBattery + + + + + 1 + This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + Power.admx + SelectDCSystemLidAction + Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat + DCSystemLidAction_2 + LastWrite + + + + SelectLidCloseActionPluggedIn + + + + + 1 + This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + Power.admx + SelectACSystemLidAction + Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat + ACSystemLidAction_2 + LastWrite + + + + SelectPowerButtonActionOnBattery + + + + + 1 + This policy setting specifies the action that Windows takes when a user presses the power button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + Power.admx + SelectDCPowerButtonAction + Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat + DCPowerButtonAction_2 + LastWrite + + + + SelectPowerButtonActionPluggedIn + + + + + 1 + This policy setting specifies the action that Windows takes when a user presses the power button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + Power.admx + SelectACPowerButtonAction + Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat + ACPowerButtonAction_2 + LastWrite + + + + SelectSleepButtonActionOnBattery + + + + + 1 + This policy setting specifies the action that Windows takes when a user presses the sleep button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + Power.admx + SelectDCSleepButtonAction + Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat + DCSleepButtonAction_2 + LastWrite + + + + SelectSleepButtonActionPluggedIn + + + + + 1 + This policy setting specifies the action that Windows takes when a user presses the sleep button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + Power.admx + SelectACSleepButtonAction + Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat + ACSleepButtonAction_2 + LastWrite + + StandbyTimeoutOnBattery @@ -65396,6 +67735,136 @@ The options are: LastWrite + + TurnOffHybridSleepOnBattery + + + + + 0 + This policy setting allows you to turn off hybrid sleep. + +If you set this to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). + +If you do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + Power.admx + Power~AT~System~PowerManagementCat~PowerSleepSettingsCat + DCStandbyWithHiberfileEnable_2 + LastWrite + + + + TurnOffHybridSleepPluggedIn + + + + + 0 + This policy setting allows you to turn off hybrid sleep. + +If you set this to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). + +If you do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + Power.admx + Power~AT~System~PowerManagementCat~PowerSleepSettingsCat + ACStandbyWithHiberfileEnable_2 + LastWrite + + + + UnattendedSleepTimeoutOnBattery + + + + + 0 + This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. + +If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + + + + + + + + + + + text/plain + + + Power.admx + EnterUnattendedSleepTimeOut + Power~AT~System~PowerManagementCat~PowerSleepSettingsCat + UnattendedSleepTimeOutDC + LastWrite + + + + UnattendedSleepTimeoutPluggedIn + + + + + 0 + This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. + +If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + + + + + + + + + + + text/plain + + + Power.admx + EnterUnattendedSleepTimeOut + Power~AT~System~PowerManagementCat~PowerSleepSettingsCat + UnattendedSleepTimeOutAC + LastWrite + + Printers @@ -67427,6 +69896,62 @@ The options are: ; + + LetAppsActivateWithVoice + + + + + 0 + This policy setting specifies whether Windows apps can be activated by voice. + + + + + + + + + + + text/plain + + + AppPrivacy.admx + LetAppsActivateWithVoice_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsActivateWithVoice + HighestValueMostSecure + + + + LetAppsActivateWithVoiceAboveLock + + + + + 0 + This policy setting specifies whether Windows apps can be activated by voice while the system is locked. + + + + + + + + + + + text/plain + + + AppPrivacy.admx + LetAppsActivateWithVoiceAboveLock_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsActivateWithVoiceAboveLock + HighestValueMostSecure + + LetAppsGetDiagnosticInfo @@ -68989,6 +71514,34 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LowestValueMostSecure + + AllowFindMyFiles + + + + + 1 + This feature allows you to disable find my files completely on the machine + + + + + + + + + + + text/plain + + + phone + Search.admx + Search~AT~WindowsComponents~Search + AllowFindMyFiles + LowestValueMostSecure + + AllowIndexingEncryptedStoresOrItems @@ -69598,6 +72151,53 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + ServiceControlManager + + + + + + + + + + + + + + + + + + + SvchostProcessMitigation + + + + + + + + + + + + + + + + + text/plain + + phone + ServiceControlManager.admx + ServiceControlManager~AT~System~ServiceControlManagerCat~ServiceControlManagerSecurityCat + SvchostProcessMitigationEnable + LastWrite + + + Settings @@ -70893,6 +73493,174 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LastWrite + + AllowStorageSenseGlobal + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + StorageSense.admx + StorageSense~AT~System~StorageSense + SS_AllowStorageSenseGlobal + LastWrite + + + + AllowStorageSenseTemporaryFilesCleanup + + + + + 1 + + + + + + + + + + + + text/plain + + + phone + StorageSense.admx + StorageSense~AT~System~StorageSense + SS_AllowStorageSenseTemporaryFilesCleanup + LastWrite + + + + ConfigStorageSenseCloudContentDehydrationThreshold + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + StorageSense.admx + StorageSense~AT~System~StorageSense + SS_ConfigStorageSenseCloudContentDehydrationThreshold + LastWrite + + + + ConfigStorageSenseDownloadsCleanupThreshold + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + StorageSense.admx + StorageSense~AT~System~StorageSense + SS_ConfigStorageSenseDownloadsCleanupThreshold + LastWrite + + + + ConfigStorageSenseGlobalCadence + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + StorageSense.admx + StorageSense~AT~System~StorageSense + SS_ConfigStorageSenseGlobalCadence + LastWrite + + + + ConfigStorageSenseRecycleBinCleanupThreshold + + + + + 30 + + + + + + + + + + + + text/plain + + + phone + StorageSense.admx + StorageSense~AT~System~StorageSense + SS_ConfigStorageSenseRecycleBinCleanupThreshold + LastWrite + + EnhancedStorageDevices @@ -70995,6 +73763,34 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LowestValueMostSecure + + AllowCommercialDataPipeline + + + + + 0 + + + + + + + + + + + + text/plain + + + DataCollection.admx + AllowCommercialDataPipeline + DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds + AllowCommercialDataPipeline + HighestValueMostSecure + + AllowDeviceNameInDiagnosticData @@ -71367,6 +74163,33 @@ Caution: If a Restricted Groups policy is applied, any current member not on the HighestValueMostSecure + + DisableDirectXDatabaseUpdate + + + + + 0 + This group policy allows control over whether the DirectX Database Updater task will be run on the system. + + + + + + + + + + + text/plain + + + GroupPolicy.admx + GroupPolicy~AT~Network~DirectXDatabase + DisableDirectXDatabaseUpdate + HighestValueMostSecure + + DisableEnterpriseAuthProxy @@ -71528,6 +74351,37 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LastWrite + + TurnOffFileHistory + + + + + 0 + This policy setting allows you to turn off File History. + +If you enable this policy setting, File History cannot be activated to create regular, automatic backups. + +If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups. + + + + + + + + + + + text/plain + + + FileHistory.admx + FileHistory~AT~WindowsComponents~FileHistory + DisableFileHistory + LowestValueMostSecure + + SystemServices @@ -72432,6 +75286,87 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LowestValueMostSecure + + ConfigureTimeZone + + + + + + Specifies the time zone to be applied to the device. This is the standard Windows name for the target time zone. + + + + + + + + + + + text/plain + + phone + LastWrite + + + + + Troubleshooting + + + + + + + + + + + + + + + + + + + AllowRecommendations + + + + + 1 + This policy setting applies recommended troubleshooting for known problems on the device and lets administrators configure how it's applied to their domains/IT environments. +Not configuring this policy setting will allow the user to configure if and how recommended troubleshooting is applied. + +Enabling this policy allows you to configure how recommended troubleshooting is applied on the user's device. You can select from one of the following values: +0 = Turn this feature off. +1 = Turn this feature off but still apply critical troubleshooting. +2 = Notify users when recommended troubleshooting is available, then allow the user to run or ignore it. +3 = Run recommended troubleshooting automatically and notify the user after it's been successfully run. +4 = Run recommended troubleshooting automatically without notifying the user. +5 = Allow the user to choose their own recommended troubleshooting settings. + + + + + + + + + + + text/plain + + + phone + MSDT.admx + MSDT~AT~System~Troubleshooting~WdiScenarioCategory + TroubleshootingAllowRecommendations + LowestValueMostSecure + + Update @@ -72671,6 +75606,39 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LowestValueMostSecure + + AutomaticMaintenanceWakeUp + + + + + 1 + This policy setting allows you to configure Automatic Maintenance wake up policy. + +The maintenance wakeup policy specifies if Automatic Maintenance should make a wake request to the OS for the daily scheduled maintenance. Note, that if the OS power wake policy is explicitly disabled, then this setting has no effect. + +If you enable this policy setting, Automatic Maintenance will attempt to set OS wake policy and make a wake request for the daily scheduled time, if required. + +If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel will apply. + + + + + + + + + + + text/plain + + + msched.admx + msched~AT~WindowsComponents~MaintenanceScheduler + WakeUpPolicy + HighestValueMostSecure + + AutoRestartDeadlinePeriodInDays @@ -72803,7 +75771,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the text/plain - + WindowsUpdate.admx BranchReadinessLevelId WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat @@ -72811,6 +75779,118 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LastWrite + + ConfigureDeadlineForFeatureUpdates + + + + + 7 + + + + + + + + + + + + text/plain + + + WindowsUpdate.admx + ConfigureDeadlineForFeatureUpdates + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + ConfigureDeadlineForFeatureUpdates + LastWrite + + + + ConfigureDeadlineForQualityUpdates + + + + + 7 + + + + + + + + + + + + text/plain + + + WindowsUpdate.admx + ConfigureDeadlineForQualityUpdates + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + ConfigureDeadlineForQualityUpdates + LastWrite + + + + ConfigureDeadlineGracePeriod + + + + + 2 + + + + + + + + + + + + text/plain + + + WindowsUpdate.admx + ConfigureDeadlineGracePeriod + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + ConfigureDeadlineGracePeriod + LastWrite + + + + ConfigureDeadlineNoAutoReboot + + + + + 0 + + + + + + + + + + + + text/plain + + + WindowsUpdate.admx + ConfigureDeadlineNoAutoReboot + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + ConfigureDeadlineNoAutoReboot + HighestValueMostSecure + + ConfigureFeatureUpdateUninstallPeriod @@ -75715,6 +78795,60 @@ Because of these factors, users do not usually need this user right. Warning: If + + AllowAutomaticRestartSignOn + + + + + + + + + + + + + + + + + text/plain + + phone + WinLogon.admx + WinLogon~AT~WindowsComponents~Logon + AutomaticRestartSignOn + LastWrite + + + + ConfigAutomaticRestartSignOn + + + + + + + + + + + + + + + + + text/plain + + phone + WinLogon.admx + WinLogon~AT~WindowsComponents~Logon + ConfigAutomaticRestartSignOn + LastWrite + + DisableLockScreenAppNotifications @@ -75769,6 +78903,41 @@ Because of these factors, users do not usually need this user right. Warning: If LastWrite + + EnableFirstLogonAnimation + + + + + 1 + This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users will be offered the opt-in prompt for services during their first sign-in. + +If you enable this policy setting, Microsoft account users will see the opt-in prompt for services, and users with other accounts will see the sign-in animation. + +If you disable this policy setting, users will not see the animation and Microsoft account users will not see the opt-in prompt for services. + +If you do not configure this policy setting, the user who completes the initial Windows setup will see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting is not configured, users new to this computer will not see the animation. + +Note: The first sign-in animation will not be shown on Server, so this policy will have no effect. + + + + + + + + + + + text/plain + + + Logon.admx + Logon~AT~System~Logon + EnableFirstLogonAnimation + HighestValueMostSecure + + EnumerateLocalUsersOnDomainJoinedComputers @@ -75823,33 +78992,6 @@ Because of these factors, users do not usually need this user right. Warning: If HighestValueMostSecure - - SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart - - - - - - - - - - - - - - - - - text/plain - - phone - WinLogon.admx - WinLogon~AT~WindowsComponents~Logon - AutomaticRestartSignOn - LastWrite - - WindowsPowerShell @@ -76131,4 +79273,5 @@ Because of these factors, users do not usually need this user right. Warning: If -``` \ No newline at end of file + +``` diff --git a/windows/client-management/mdm/policymanager-csp.md b/windows/client-management/mdm/policymanager-csp.md index 366179d7ac..ad4bb24be7 100644 --- a/windows/client-management/mdm/policymanager-csp.md +++ b/windows/client-management/mdm/policymanager-csp.md @@ -2,11 +2,13 @@ title: PolicyManager CSP description: PolicyManager CSP ms.assetid: 048427b1-6024-4660-8660-bd91c583f7f9 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/28/2017 --- diff --git a/windows/client-management/mdm/provisioning-csp.md b/windows/client-management/mdm/provisioning-csp.md index 88ff7aac70..9dfabcfba3 100644 --- a/windows/client-management/mdm/provisioning-csp.md +++ b/windows/client-management/mdm/provisioning-csp.md @@ -2,11 +2,13 @@ title: Provisioning CSP description: The Provisioning configuration service provider is used for bulk user enrollment to an MDM service. ms.assetid: 5D6C17BE-727A-4AFA-9F30-B34C1EA1D2AE -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -17,7 +19,7 @@ The Provisioning configuration service provider is used for bulk user enrollment > **Note**  Bulk enrollment does not work when two factor authentication is enabled. -  + For bulk enrollment step-by-step guide, see [Bulk enrollment](bulk-enrollment-using-windows-provisioning-tool.md). @@ -31,7 +33,7 @@ Root node for Provisioning CSP. **Provisioning/Enrollments** Node for defining bulk enrollment of users into an MDM service. -**Provisioning/Enrollments/****_UPN_** +**Provisioning/Enrollments/***UPN* Unique identifier for the enrollment. For bulk enrollment, this must a service account that is allowed to enroll multiple users. Example, "generic-device@contoso.com" **Provisioning/Enrollments/*UPN*/DiscoveryServiceFullURL** @@ -56,9 +58,9 @@ Specifies the policy service URL. **Provisioning/Enrollments/*UPN*/EnrollmentServiceFullURL** Specifies the enrollment service URL. -  + -  + diff --git a/windows/client-management/mdm/proxy-csp.md b/windows/client-management/mdm/proxy-csp.md index 31a3e8994f..cced09bc2b 100644 --- a/windows/client-management/mdm/proxy-csp.md +++ b/windows/client-management/mdm/proxy-csp.md @@ -2,11 +2,13 @@ title: PROXY CSP description: PROXY CSP ms.assetid: 9904d44c-4a1e-4ae7-a6c7-5dba06cb16ce -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -19,7 +21,7 @@ The PROXY configuration service provider is used to configure proxy connections. This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_NETWORKING\_ADMIN capabilities to be accessed from a network configuration application. -  + For the PROXY CSP, you cannot use the Replace command unless the node already exists. @@ -61,7 +63,7 @@ Depending on the ProxyID, the valid values are ISA, WAP, SOCKS, or NULL. ***ProxyName*/Ports** Node for port information. -***ProxyName*/Ports/****_PortName_** +***ProxyName*/Ports/***PortName* Defines the name of a port. It is recommended that this element name is specified as a numbered node beginning at zero. For example, to provision two ports, use "PORT0" and "PORT1" as the element names. @@ -72,7 +74,7 @@ Specifies the port number to be associated with the parent port. ***ProxyName*/Ports/*PortName*/Services** Node for services information. -***ProxyName*/Ports/Services/****_ServiceName_** +***ProxyName*/Ports/Services/***ServiceName* Defines the name of a service. It is recommended that this element name is specified as a numbered node beginning at zero. For example, to provision two services, use "SERVICE0" and "SERVICE1" as the element names. @@ -85,7 +87,7 @@ One commonly used value is "HTTP". ***ProxyName*/ConRefs** Node for connection reference information -***ProxyName*/ConRefs/****_ConRefName_** +***ProxyName*/ConRefs/***ConRefName* Defines the name of a connection reference. It is recommended that this element name is specified as a numbered node beginning at zero. For example, to provision two connection references, use "CONREF0" and "CONREF1" as the element names. @@ -98,9 +100,9 @@ Specifies one single connectivity object associated with the proxy connection. [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/push-notification-windows-mdm.md b/windows/client-management/mdm/push-notification-windows-mdm.md index e8db3d3e21..bcae3dceaf 100644 --- a/windows/client-management/mdm/push-notification-windows-mdm.md +++ b/windows/client-management/mdm/push-notification-windows-mdm.md @@ -5,11 +5,13 @@ MS-HAID: - 'p\_phdevicemgmt.push\_notification\_support\_for\_device\_management' - 'p\_phDeviceMgmt.push\_notification\_windows\_mdm' ms.assetid: 9031C4FE-212A-4481-A1B0-4C3190B388AE -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/22/2017 --- diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md index 8a137d239f..5e0bc0b2d9 100644 --- a/windows/client-management/mdm/pxlogical-csp.md +++ b/windows/client-management/mdm/pxlogical-csp.md @@ -2,11 +2,13 @@ title: PXLOGICAL configuration service provider description: PXLOGICAL configuration service provider ms.assetid: b5fc84d4-aa32-4edd-95f1-a6a9c0feb459 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index 77dea602cf..70668fa9de 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -2,11 +2,13 @@ title: Reboot CSP description: Reboot CSP ms.assetid: 4E3F1225-BBAD-40F5-A1AB-FF221B6BAF48 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -27,18 +29,20 @@ The following diagram shows the Reboot configuration service provider management **RebootNow**

                            This node executes a reboot of the device. RebootNow triggers a reboot within 5 minutes to allow the user to wrap up any active work.

                            -> [!Note]   +> [!NOTE] > If this node is set to execute during a sync session, the device will reboot at the end of the sync session. -

                            The supported operations are Execute and Get. +

                            The supported operations are Execute and Get.

                            **Schedule**

                            The supported operation is Get.

                            **Schedule/Single** -

                            This node will execute a reboot at a scheduled date and time. Setting a null (empty) date will delete the existing schedule. The date and time value is ISO8601, and both the date and time are required.
                            +

                            This node will execute a reboot at a scheduled date and time. The date and time value is **ISO 8601**, and both the date and time are required.
                            Example to configure: 2018-10-25T18:00:00

                            +Setting a null (empty) date will delete the existing schedule. In accordance with the ISO 8601 format, the date and time representation needs to be 0000-00-00T00:00:00. +

                            The supported operations are Get, Add, Replace, and Delete.

                            **Schedule/DailyRecurrent** @@ -51,13 +55,3 @@ Example to configure: 2018-10-25T18:00:00

                            [Configuration service provider reference](configuration-service-provider-reference.md) - -  - -  - - - - - - diff --git a/windows/client-management/mdm/reboot-ddf-file.md b/windows/client-management/mdm/reboot-ddf-file.md index 36baf398e0..1cf001cffb 100644 --- a/windows/client-management/mdm/reboot-ddf-file.md +++ b/windows/client-management/mdm/reboot-ddf-file.md @@ -2,11 +2,13 @@ title: Reboot DDF file description: This topic shows the OMA DM device description framework (DDF) for the Reboot configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.assetid: ABBD850C-E744-462C-88E7-CA3F43D80DB1 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml -

                            POST

                            +

                            DELETE

                            https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats/{username}

                            diff --git a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md index dd6f9467a1..cfa669f4e5 100644 --- a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md +++ b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md @@ -1,12 +1,14 @@ --- title: Register your free Azure Active Directory subscription -description: If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services, you have a free subscription to Azure AD. +description: Paid subscribers to Office 365, Microsoft Dynamics CRM Online, Enterprise Mobility Suite, or other Microsoft services, have a free subscription to Azure AD. ms.assetid: 97DCD303-BB11-4AFF-84FE-B7F14CDF64F7 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -27,21 +29,11 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent ![register azuread](images/azure-ad-add-tenant11.png) -3. On the **Admin center** page, hover your mouse over the Admin tools icon on the left and then click **Azure AD**. This will take you to the Azure Active Directory sign-up page and brings up your existing Office 365 organization account information. +3. On the **Admin center** page, under Admin Centers on the left, click **Azure Active Directory**. This will take you to the Azure Active Directory portal. - ![register azuread](images/azure-ad-add-tenant12.png) + ![Azure-AD-updated](https://user-images.githubusercontent.com/41186174/71594506-e4845300-2b40-11ea-9a08-c21c824e12a4.png) -4. On the **Sign up** page, make sure to enter a valid phone number and then click **Sign up**. - ![register azuread](images/azure-ad-add-tenant13.png) - -5. It may take a few minutes to process the request. - - ![register azuread](images/azure-ad-add-tenant14.png) - -6. You will see a welcome page when the process completes. - - ![register azuread](images/azure-ad-add-tenant15.png)   diff --git a/windows/client-management/mdm/registry-csp.md b/windows/client-management/mdm/registry-csp.md index fecf3f5a44..61d34774a7 100644 --- a/windows/client-management/mdm/registry-csp.md +++ b/windows/client-management/mdm/registry-csp.md @@ -2,11 +2,13 @@ title: Registry CSP description: Registry CSP ms.assetid: 2307e3fd-7b61-4f00-94e1-a639571f2c9d -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/registry-ddf-file.md b/windows/client-management/mdm/registry-ddf-file.md index 7477a7c981..164f8d4a66 100644 --- a/windows/client-management/mdm/registry-ddf-file.md +++ b/windows/client-management/mdm/registry-ddf-file.md @@ -2,11 +2,13 @@ title: Registry DDF file description: Registry DDF file ms.assetid: 29b5cc07-f349-4567-8a77-387d816a9d15 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -15,7 +17,7 @@ ms.date: 06/26/2017 This topic shows the OMA DM device description framework (DDF) for the **Registry** configuration service provider. DDF files are used only with OMA DM provisioning XML. -``` syntax +```xml 1.2 diff --git a/windows/client-management/mdm/remotefind-csp.md b/windows/client-management/mdm/remotefind-csp.md index d84582b492..554e07f2d4 100644 --- a/windows/client-management/mdm/remotefind-csp.md +++ b/windows/client-management/mdm/remotefind-csp.md @@ -2,11 +2,13 @@ title: RemoteFind CSP description: The RemoteFind configuration service provider retrieves the location information for a particular device. ms.assetid: 2EB02824-65BF-4B40-A338-672D219AF5A0 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -100,7 +102,7 @@ Supported operation is Get. ## Examples -``` syntax +```xml diff --git a/windows/client-management/mdm/remotefind-ddf-file.md b/windows/client-management/mdm/remotefind-ddf-file.md index 814fadbb25..211fd88e78 100644 --- a/windows/client-management/mdm/remotefind-ddf-file.md +++ b/windows/client-management/mdm/remotefind-ddf-file.md @@ -2,11 +2,13 @@ title: RemoteFind DDF file description: This topic shows the OMA DM device description framework (DDF) for the RemoteFind configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.assetid: 5864CBB8-2030-459E-BCF6-9ACB69206FEA -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml 1 @@ -128,7 +130,7 @@ Initiate a remote lock of the device. Initiate a remote lock and PIN reset of the device. To successfully retrieve the new device-generated PIN, the commands must be executed together and in the proper sequence as shown below. -``` syntax +```xml 1 diff --git a/windows/client-management/mdm/remotelock-ddf-file.md b/windows/client-management/mdm/remotelock-ddf-file.md index 99fa47713c..2408353c86 100644 --- a/windows/client-management/mdm/remotelock-ddf-file.md +++ b/windows/client-management/mdm/remotelock-ddf-file.md @@ -2,11 +2,13 @@ title: RemoteLock DDF file description: RemoteLock DDF file ms.assetid: A301AE26-1BF1-4328-99AB-1ABBA4960797 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml - 5 - - - ./Vendor/MSFT/RemoteRing/Ring - - + 5 + + + ./Vendor/MSFT/RemoteRing/Ring + + ``` diff --git a/windows/client-management/mdm/remotering-ddf-file.md b/windows/client-management/mdm/remotering-ddf-file.md index 01fe0aa96f..6ce26f1758 100644 --- a/windows/client-management/mdm/remotering-ddf-file.md +++ b/windows/client-management/mdm/remotering-ddf-file.md @@ -2,11 +2,13 @@ title: RemoteRing DDF file description: This topic shows the OMA DM device description framework (DDF) for the RemoteRing configuration service provider. DDF files are used only with OMA DM provisioning XML. ms.assetid: 6815267F-212B-4370-8B72-A457E8000F7B -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/reporting-csp.md b/windows/client-management/mdm/reporting-csp.md index 924654540b..1f1391ff33 100644 --- a/windows/client-management/mdm/reporting-csp.md +++ b/windows/client-management/mdm/reporting-csp.md @@ -2,11 +2,13 @@ title: Reporting CSP description: The Reporting configuration service provider is used to retrieve Windows Information Protection (formerly known as Enterprise Data Protection) and security auditing logs. ms.assetid: 148441A6-D9E1-43D8-ADEE-FB62E85A39F7 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -79,7 +81,7 @@ Supported operations are Get and Replace. Retrieve all available Windows Information Protection (formerly known as Enterprise Data Protection) logs starting from the specified StartTime. -``` syntax +```xml @@ -102,7 +104,7 @@ Retrieve all available Windows Information Protection (formerly known as Enterpr Retrieve a specified number of security auditing logs starting from the specified StartTime. -``` syntax +```xml diff --git a/windows/client-management/mdm/reporting-ddf-file.md b/windows/client-management/mdm/reporting-ddf-file.md index 6387fc0b59..5b16192077 100644 --- a/windows/client-management/mdm/reporting-ddf-file.md +++ b/windows/client-management/mdm/reporting-ddf-file.md @@ -1,12 +1,14 @@ --- title: Reporting DDF file -description: This topic shows the OMA DM device description framework (DDF) for the Reporting configuration service provider. This CSP was added in Windows 10, version 1511. Support for desktop security auditing was added for the desktop in Windows 10, version 1607. +description: View the OMA DM device description framework (DDF) for the Reporting configuration service provider. ms.assetid: 7A5B79DB-9571-4F7C-ABED-D79CD08C1E35 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for the desktop CSP. -``` syntax +```xml **Device or User** For device certificates, use **./Device/Vendor/MSFT** path and for user certificates use **./User/Vendor/MSFT** path. @@ -35,7 +39,6 @@ Defines the certificate store that contains root, or self-signed certificates, i > [!Note] > The **./User/** configuration is not supported for **RootCATrustedCertificates/Root/**. -  **RootCATrustedCertificates/CA** Node for CA certificates. @@ -46,42 +49,30 @@ Node for trusted publisher certificates. Node for trusted people certificates. **RootCATrustedCertificates/UntrustedCertificates** -Addeded in Windows 10, version 1803. Node for certificates that are not trusted. IT admin can use this node to immediately flag certificates that have been compromised and no longer usable. +Added in Windows 10, version 1803. Node for certificates that are not trusted. IT admin can use this node to immediately flag certificates that have been compromised and no longer usable. **_CertHash_** -Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value. +Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value. This node is common for all the principal root nodes. The supported operations are Get and Delete. -The supported operations are Get and Delete. +The following nodes are all common to the **_CertHash_** node: **/EncodedCertificate** -Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. - -The supported operations are Add, Get, and Replace. +Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. The supported operations are Add, Get, and Replace. **/IssuedBy** -Returns the name of the certificate issuer. This is equivalent to the **Issuer** member in the CERT\_INFO data structure. - -The only supported operation is Get. +Returns the name of the certificate issuer. This is equivalent to the **Issuer** member in the CERT\_INFO data structure. The only supported operation is Get. **/IssuedTo** -Returns the name of the certificate subject. This is equivalent to the **Subject** member in the CERT\_INFO data structure. - -The only supported operation is Get. +Returns the name of the certificate subject. This is equivalent to the **Subject** member in the CERT\_INFO data structure. The only supported operation is Get. **/ValidFrom** -Returns the starting date of the certificate's validity. This is equivalent to the **NotBefore** member in the CERT\_INFO data structure. - -The only supported operation is Get. +Returns the starting date of the certificate's validity. This is equivalent to the **NotBefore** member in the CERT\_INFO data structure. The only supported operation is Get. **/ValidTo** -Returns the expiration date of the certificate. This is equivalent to the **NotAfter** member in the CERT\_INFO data structure. - -The only supported operation is Get. +Returns the expiration date of the certificate. This is equivalent to the **NotAfter** member in the CERT\_INFO data structure. The only supported operation is Get. **/TemplateName** -Returns the certificate template name. - -The only supported operation is Get. +Returns the certificate template name. The only supported operation is Get. ## Related topics diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index 587008f3f5..a80fb75af6 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -2,11 +2,13 @@ title: RootCATrustedCertificates DDF file description: RootCATrustedCertificates DDF file ms.assetid: 06D8787B-D3E1-4D4B-8A21-8045A8F85C1C -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 03/07/2018 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is for Windows 10, version 1803. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md b/windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md deleted file mode 100644 index 63260885d9..0000000000 --- a/windows/client-management/mdm/samples-for-writing-a-custom-configuration-service-provider.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Samples for writing a custom configuration service provider -description: Samples for writing a custom configuration service provider -ms.assetid: ccda4d62-7ce1-483b-912f-25d50c974270 -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/26/2017 ---- - -# Samples for writing a custom configuration service provider - -The following example shows how to retrieve Integrated Circuit Card Identifier (ICCID) and International Mobile Subscriber Identity (IMSI) for a dual SIM phone. - -## Retrieving ICCID and IMSI for a dual SIM phone - -The following sample is used in the [IConfigServiceProvider2::ConfigManagerNotification](iconfigserviceprovider2configmanagernotification.md) method implementation. It first retrieves the IConfigSession2 object, and then queries the ICCID with the IConfigSession2::GetSessionVariable method. To retrieve the IMSI, replace L”ICCID” with L”IMSI”. - -``` syntax -case CFGMGR_NOTIFICATION_SETSESSIONOBJ: - if (NULL != lpParam) - { - m_pSession = reinterpret_cast(lpParam); -        m_pSession->AddRef(); -    } - -    bstrContext = SysAllocString(L"ICCID"); -    if (NULL == bstrContext) -    { -    hr = E_OUTOFMEMORY; -    goto Error; -    } - -    hr = m_pSession->GetSessionVariable(bstrContext, &varValue); -    if (FAILED(hr)) -    { -     goto Error; -    } -    break; -``` - -  - - - - - diff --git a/windows/client-management/mdm/secureassessment-csp.md b/windows/client-management/mdm/secureassessment-csp.md index 4d4507311e..7d972a5a96 100644 --- a/windows/client-management/mdm/secureassessment-csp.md +++ b/windows/client-management/mdm/secureassessment-csp.md @@ -2,11 +2,13 @@ title: SecureAssessment CSP description: SecureAssessment CSP ms.assetid: 6808BE4B-961E-4638-BF15-FD7841D1C00A -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -31,9 +33,9 @@ The supported operations are Add, Delete, Get, and Replace. **TesterAccount** The user name of the test taking account. -- To specify a domain account, use domain\\user. -- To specify an AAD account, use username@tenant.com. -- To specify a local account, use the username. +- To specify a domain account, use domain\\user. +- To specify an AAD account, use username@tenant.com. +- To specify a local account, use the username. The supported operations are Add, Delete, Get, and Replace. @@ -58,9 +60,9 @@ Supported operations are Get and Replace. [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/secureassessment-ddf-file.md b/windows/client-management/mdm/secureassessment-ddf-file.md index a17b7547dd..383470060b 100644 --- a/windows/client-management/mdm/secureassessment-ddf-file.md +++ b/windows/client-management/mdm/secureassessment-ddf-file.md @@ -1,12 +1,14 @@ --- title: SecureAssessment DDF file -description: This topic shows the OMA DM device description framework (DDF) for the SecureAssessment configuration service provider. DDF files are used only with OMA DM provisioning XML. +description: View the OMA DM device description framework (DDF) for the SecureAssessment configuration service provider. DDF files are used only with OMA DM provisioning XML ms.assetid: 68D17F2A-FAEA-4608-8727-DBEC1D7BE48A -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -18,7 +20,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml @@ -207,7 +209,7 @@ Setting a security policy: Querying a security policy: -``` syntax +```xml @@ -220,7 +222,7 @@ Querying a security policy: Setting a security policy: -``` syntax +```xml … @@ -243,7 +245,7 @@ Setting a security policy: Querying a security policy: -``` syntax +```xml … diff --git a/windows/client-management/mdm/server-requirements-windows-mdm.md b/windows/client-management/mdm/server-requirements-windows-mdm.md index 862a062eba..50b8b73b30 100644 --- a/windows/client-management/mdm/server-requirements-windows-mdm.md +++ b/windows/client-management/mdm/server-requirements-windows-mdm.md @@ -5,11 +5,13 @@ MS-HAID: - 'p\_phDeviceMgmt.server\_requirements\_for\_oma\_dm' - 'p\_phDeviceMgmt.server\_requirements\_windows\_mdm' ms.assetid: 5b90b631-62a6-4949-b53a-01275fd304b2 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/sharedpc-csp.md b/windows/client-management/mdm/sharedpc-csp.md index 6e97992194..eaae458518 100644 --- a/windows/client-management/mdm/sharedpc-csp.md +++ b/windows/client-management/mdm/sharedpc-csp.md @@ -2,11 +2,13 @@ title: SharedPC CSP description: SharedPC CSP ms.assetid: 31273166-1A1E-4F96-B176-CB42ECB80957 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 01/16/2019 --- @@ -43,7 +45,7 @@ The default value changed to false in Windows 10, version 1703. The default valu **SetPowerPolicies** Optional. A boolean value that specifies that the power policies should be set when configuring SharedPC mode. -> [!Note] +> [!NOTE] > If used, this value must be set before the action on the **EnableSharedPCMode** node is taken. The supported operations are Add, Get, Replace, and Delete. @@ -53,7 +55,7 @@ The default value is Not Configured and the effective power settings are determi **MaintenanceStartTime** Optional. An integer value that specifies the daily start time of maintenance hour. Given in minutes from midnight. The range is 0-1440. -> [!Note] +> [!NOTE] >  If used, this value must be set before the action on the **EnableSharedPCMode** node is taken. The supported operations are Add, Get, Replace, and Delete. @@ -63,7 +65,7 @@ The default value is Not Configured and its value in the SharedPC provisioning p **SignInOnResume** Optional. A boolean value that, when set to True, requires sign in whenever the device wakes up from sleep mode. -> [!Note] +> [!NOTE] > If used, this value must be set before the action on the **EnableSharedPCMode** node is taken. The supported operations are Add, Get, Replace, and Delete. @@ -73,7 +75,7 @@ The default value is Not Configured and its value in the SharedPC provisioning p **SleepTimeout** The amount of time in seconds before the PC sleeps. 0 means the PC never sleeps. Default is 5 minutes. This node is optional. -> [!Note] +> [!NOTE] > If used, this value must be set before the action on the **EnableSharedPCMode** node is taken. The supported operations are Add, Get, Replace, and Delete. @@ -83,7 +85,7 @@ The default value is Not Configured, and effective behavior is determined by the **EnableAccountManager** A boolean that enables the account manager for shared PC mode. -> [!Note] +> [!NOTE] > If used, this value must be set before the action on the **EnableSharedPCMode** node is taken. The supported operations are Add, Get, Replace, and Delete. @@ -93,7 +95,7 @@ The default value is Not Configured and its value in the SharedPC provisioning p **AccountModel** Configures which type of accounts are allowed to use the PC. -> [!Note] +> [!NOTE] > If used, this value must be set before the action on the **EnableSharedPCMode** node is taken. The supported operations are Add, Get, Replace, and Delete. @@ -109,7 +111,7 @@ Its value in the SharedPC provisioning package is 1 or 2. **DeletionPolicy** Configures when accounts are deleted. -> [!Note] +> [!NOTE] > If used, this value must be set before the action on the **EnableSharedPCMode** node is taken. The supported operations are Add, Get, Replace, and Delete. @@ -130,7 +132,7 @@ The default value is Not Configured. Its value in the SharedPC provisioning pack **DiskLevelDeletion** Sets the percentage of disk space remaining on a PC before cached accounts will be deleted to free disk space. Accounts that have been inactive the longest will be deleted first. -> [!Note] +> [!NOTE] > If used, this value must be set before the action on the **EnableSharedPCMode** node is taken. The default value is Not Configured. Its default value in the SharedPC provisioning package is 25. @@ -142,7 +144,7 @@ The supported operations are Add, Get, Replace, and Delete. **DiskLevelCaching** Sets the percentage of available disk space a PC should have before it stops deleting cached accounts. -> [!Note] +> [!NOTE] > If used, this value must set before the action on the **EnableSharedPCMode** node is taken. The default value is Not Configured. The default value in the SharedPC provisioning package is 25. @@ -156,7 +158,7 @@ Added in Windows 10, version 1703. Restricts the user from using local storage. The default value is Not Configured and behavior is no such restriction applied. Value type is bool. Supported operations are Add, Get, Replace, and Delete. Default in SharedPC provisioning package is False. -> [!Note] +> [!NOTE] > If used, this value must set before the action on the **EnableSharedPCMode** node is taken. **KioskModeAUMID** @@ -164,7 +166,7 @@ Added in Windows 10, version 1703. Specifies the AUMID of the app to use with as Value type is string. Supported operations are Add, Get, Replace, and Delete. -> [!Note] +> [!NOTE] > If used, this value must set before the action on the **EnableSharedPCMode** node is taken. **KioskModeUserTileDisplayText** @@ -172,7 +174,7 @@ Added in Windows 10, version 1703. Specifies the display text for the account sh Value type is string. Supported operations are Add, Get, Replace, and Delete. -> [!Note] +> [!NOTE] > If used, this value must set before the action on the **EnableSharedPCMode** node is taken. **InactiveThreshold** @@ -185,7 +187,7 @@ The default in the SharedPC provisioning package is 30. **MaxPageFileSizeMB** Added in Windows 10, version 1703. Maximum size of the paging file in MB. Applies only to systems with less than 32 GB storage and at least 3 GB of RAM. This node is optional. -> [!Note] +> [!NOTE] > If used, this value must set before the action on the **EnableSharedPCMode** node is taken. Default value is Not Configured. Value type is integer. Supported operations are Add, Get, Replace, and Delete. diff --git a/windows/client-management/mdm/sharedpc-ddf-file.md b/windows/client-management/mdm/sharedpc-ddf-file.md index b17d1adabd..b9ea9c1767 100644 --- a/windows/client-management/mdm/sharedpc-ddf-file.md +++ b/windows/client-management/mdm/sharedpc-ddf-file.md @@ -2,11 +2,13 @@ title: SharedPC DDF file description: SharedPC DDF file ms.assetid: 70234197-07D4-478E-97BB-F6C651C0B970 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the DDF for Windows 10, version 1703. -``` syntax +```xml 1.2 @@ -105,7 +107,7 @@ The following example shows the header component of a DM message. In this case,   -``` syntax +```xml 1.2 DM/1.2 @@ -128,7 +130,7 @@ SyncBody contains one or more DM commands. The SyncBody can contain multiple DM The following example shows the body component of a DM message. In this example, SyncBody contains only one command, Get. This is indicated by the <Final /> tag that occurs immediately after the terminating tag for the Get command. -``` syntax +```xml @@ -155,7 +157,7 @@ The Replace command is used to update a device setting. The following example illustrates how to use the Replace command to update a device setting. -``` syntax +```xml 1.2 DM/1.2 diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md index 5ff2a27abd..64077761f8 100644 --- a/windows/client-management/mdm/supl-csp.md +++ b/windows/client-management/mdm/supl-csp.md @@ -2,20 +2,22 @@ title: SUPL CSP description: SUPL CSP ms.assetid: afad0120-1126-4fc5-8e7a-64b9f2a5eae1 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 07/20/2018 +author: manikadhiman +ms.date: 09/12/2019 --- # SUPL CSP > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -The SUPL configuration service provider is used to configure the location client, as shown in the following table. +The SUPL configuration service provider is used to configure the location client, as shown in the following table: @@ -49,7 +51,7 @@ The SUPL configuration service provider is used to configure the location client

                          • MCC/MNC value pairs which are used to specify which networks' UUIC the SUPL account matches.

                            • @@ -66,7 +68,7 @@ The following diagram shows the SUPL configuration service provider management o   -![supl csp (dm,cp)](images/provisioning-csp-supl-dmandcp.png) +![SUPL csp (dm,cp)](images/provisioning-csp-supl-dmandcp.png) @@ -84,7 +86,10 @@ If this value is not specified, the device infers the H-SLP address from the IMS For OMA DM, if the format for this node is incorrect the entry will be ignored and an error will be returned, but the configuration service provider will continue processing the rest of the parameters. **Version** -Optional. Determines the version of the SUPL protocol to use. For SUPL 1.0, set this value to `1`. For SUPL 2.0, set this value to `2`. The default is 1. +Optional. Determines the major version of the SUPL protocol to use. For SUPL 1.0.0, set this value to 1. For SUPL 2.0.0, set this value to 2. The default is 1. Refer to FullVersion to define the minor version and the service indicator. + +**FullVersion** +Added in the next major release of Windows 10. Optional. Determines the full version (X.Y.Z where X, Y, and Z are the major version, the minor version, and the service indicator, respectively) of the SUPL protocol to use. The default is 1.0.0. If FullVersion is defined, Version field is ignored. **MCCMNCPairs** Required. List all of the MCC and MNC pairs owned by the mobile operator. This list is used to verify that the UICC matches the network and SUPL can be used. When the UICC and network do not match, the device uses the default location service and does not use SUPL. @@ -293,7 +298,7 @@ Optional. Specifies the positioning method that the SUPL client will use for mob - + @@ -423,7 +428,7 @@ If a mobile operator requires the communication with the H-SLP to take place ove Adding new configuration information for a H-SLP server for SUPL. Values in italic must be replaced with correct settings for the mobile operator network. A valid binary blob must be included for the root certificate data value. -``` syntax +```xml @@ -447,7 +452,7 @@ Adding new configuration information for a H-SLP server for SUPL. Values in ital Adding a SUPL and a V2 UPL account to the same device. Values in italic must be replaced with correct settings for the mobile operator network. A valid binary blob must be included for the root certificate data value. -``` syntax +```xml @@ -479,7 +484,7 @@ Adding a SUPL and a V2 UPL account to the same device. Values in italic must be Adding a SUPL account to a device. Values in italic must be replaced with correct settings for the mobile operator network. A valid binary blob must be included for the root certificate data value. -``` syntax +```xml @@ -580,18 +585,6 @@ The following table shows the Microsoft custom elements that this configuration
                              -

                            • Address of the server—a mobile positioning center for non-trusted mode.

                              • +

                            • Address of the server — a mobile positioning center for non-trusted mode.

                            • The positioning method used by the MPC for non-trusted mode.

                            0

                            None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection and ephemeris data) from the Microsoft Positioning Service.

                            None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection, and ephemeris data) from the Microsoft Positioning Service.

                            1
                              - ## Related topics - -[Configuration service provider reference](configuration-service-provider-reference.md) - -  - -  - - - - - - +[Configuration service provider reference](configuration-service-provider-reference.md) \ No newline at end of file diff --git a/windows/client-management/mdm/supl-ddf-file.md b/windows/client-management/mdm/supl-ddf-file.md index 2d75e82287..e2b10b625a 100644 --- a/windows/client-management/mdm/supl-ddf-file.md +++ b/windows/client-management/mdm/supl-ddf-file.md @@ -2,26 +2,28 @@ title: SUPL DDF file description: This topic shows the OMA DM device description framework (DDF) for the SUPL configuration service provider. ms.assetid: 514B7854-80DC-4ED9-9805-F5276BF38034 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 07/20/2018 --- # SUPL DDF file > [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -This topic shows the OMA DM device description framework (DDF) for the **SUPL** configuration service provider. +This topic shows the OMA DM device description framework (DDF) for the **SUPL** configuration service provider (CSP). Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1809. +The XML below is the DDF for the current version for this CSP. -``` syntax +```xml - com.microsoft/1.1/MDM/SUPL + com.microsoft/1.2/MDM/SUPL @@ -157,7 +159,7 @@ The XML below is for Windows 10, version 1809. 1 - Optional. Determines the version of the SUPL protocol to use. For SUPL 1.0, set this value to 1. For SUPL 2.0, set this value to 2. The default is 1. + Optional. Determines the major version of the SUPL protocol to use. For SUPL 1.0.0, set this value to 1. For SUPL 2.0.0, set this value to 2. The default is 1. Refer to FullVersion to define the minor version and the service indicator. @@ -172,6 +174,29 @@ The XML below is for Windows 10, version 1809. + + FullVersion + + + + + + 1.0.0 + Optional. Determines the full version (X.Y.Z where X, Y, and Z are the major version, the minor version, and the service indicator, respectively) of the SUPL protocol to use. The default is 1.0.0. If FullVersion is defined, Version field is ignored. + + + + + + + + + + + text/plain + + + MCCMNCPairs diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index f6ec67db21..fcb23c170c 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -2,11 +2,13 @@ title: SurfaceHub CSP description: The SurfaceHub configuration service provider (CSP) is used to configure Microsoft Surface Hub settings. This CSP was added in Windows 10, version 1511. ms.assetid: 36FBBC32-AD6A-41F1-86BF-B384891AA693 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 07/28/2017 --- @@ -34,55 +36,55 @@ The following diagram shows the SurfaceHub CSP management objects in tree format > [!NOTE] > If the device cannot auto-discover the Exchange server and Session Initiation Protocol (SIP) address from this information, you should specify the ExchangeServer and SipAddress. -  -

                            Here's a SyncML example. + +

                            Here's a SyncML example. -``` syntax - - - - 1 - - - ./Vendor/MSFT/SurfaceHub/DeviceAccount/UserPrincipalName - - - chr - - user@contoso.com - - - - 2 - - - ./Vendor/MSFT/SurfaceHub/DeviceAccount/Password - - - chr - - password - - - - 3 - - - ./Vendor/MSFT/SurfaceHub/DeviceAccount/ValidateAndCommit - - - - - 4 - - - ./Vendor/MSFT/SurfaceHub/DeviceAccount/ErrorContext - - - - - - +```xml + + + + 1 + + + ./Vendor/MSFT/SurfaceHub/DeviceAccount/UserPrincipalName + + + chr + + user@contoso.com + + + + 2 + + + ./Vendor/MSFT/SurfaceHub/DeviceAccount/Password + + + chr + + password + + + + 3 + + + ./Vendor/MSFT/SurfaceHub/DeviceAccount/ValidateAndCommit + + + + + 4 + + + ./Vendor/MSFT/SurfaceHub/DeviceAccount/ErrorContext + + + + + + ```

                            To use a device account from Active Directory @@ -95,37 +97,37 @@ The following diagram shows the SurfaceHub CSP management objects in tree format **DeviceAccount/DomainName**

                            Domain of the device account when you are using Active Directory. To use a device account from Active Directory, you should specify both DomainName and UserName for the device account. -

                            The data type is char. Supported operation is Get and Replace. +

                            The data type is string. Supported operation is Get and Replace. **DeviceAccount/UserName**

                            Username of the device account when you are using Active Directory. To use a device account from Active Directory, you should specify both DomainName and UserName for the device account. -

                            The data type is char. Supported operation is Get and Replace. +

                            The data type is string. Supported operation is Get and Replace. **DeviceAccount/UserPrincipalName**

                            User principal name (UPN) of the device account. To use a device account from Azure Active Directory or a hybrid deployment, you should specify the UPN of the device account. -

                            The data type is char. Supported operation is Get and Replace. +

                            The data type is string. Supported operation is Get and Replace. **DeviceAccount/SipAddress**

                            Session Initiation Protocol (SIP) address of the device account. Normally, the device will try to auto-discover the SIP. This field is only required if auto-discovery fails. -

                            The data type is char. Supported operation is Get and Replace. +

                            The data type is string. Supported operation is Get and Replace. **DeviceAccount/Password**

                            Password for the device account. -

                            The data type is char. Supported operation is Get and Replace. The operation Get is allowed, but it will always return a blank. +

                            The data type is string. Supported operation is Get and Replace. The operation Get is allowed, but it will always return a blank. **DeviceAccount/ValidateAndCommit**

                            This method validates the data provided and then commits the changes. -

                            The data type is char. Supported operation is Execute. +

                            The data type is string. Supported operation is Execute. **DeviceAccount/Email**

                            Email address of the device account. -

                            The data type is char. +

                            The data type is string. **DeviceAccount/PasswordRotationEnabled**

                            Specifies whether automatic password rotation is enabled. If you enforce a password expiration policy on the device account, use this setting to allow the device to manage its own password by changing it frequently, without requiring you to manually update the account information when the password expires. You can reset the password at any time using Active Directory (or Azure AD). @@ -135,17 +137,17 @@ The following diagram shows the SurfaceHub CSP management objects in tree format - 0 - password rotation enabled - 1 - disabled -

                            The data type is int. Supported operation is Get and Replace. +

                            The data type is integer. Supported operation is Get and Replace. **DeviceAccount/ExchangeServer**

                            Exchange server of the device account. Normally, the device will try to auto-discover the Exchange server. This field is only required if auto-discovery fails. -

                            The data type is char. Supported operation is Get and Replace. +

                            The data type is string. Supported operation is Get and Replace. **DeviceAccount/CalendarSyncEnabled**

                            Specifies whether calendar sync and other Exchange server services is enabled. -

                            The data type is bool. Supported operation is Get and Replace. +

                            The data type is boolean. Supported operation is Get and Replace. **DeviceAccount/ErrorContext**

                            If there is an error calling ValidateAndCommit, there is additional context for that error in this node. Here are the possible error values: @@ -202,7 +204,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format   -

                            The data type is int. Supported operation is Get. +

                            The data type is integer. Supported operation is Get. **MaintenanceHoursSimple/Hours**

                            Node for maintenance schedule. @@ -210,12 +212,12 @@ The following diagram shows the SurfaceHub CSP management objects in tree format **MaintenanceHoursSimple/Hours/StartTime**

                            Specifies the start time for maintenance hours in minutes from midnight. For example, to set a 2:00 am start time, set this value to 120. -

                            The data type is int. Supported operation is Get and Replace. +

                            The data type is integer. Supported operation is Get and Replace. **MaintenanceHoursSimple/Hours/Duration**

                            Specifies the duration of maintenance window in minutes. For example, to set a 3-hour duration, set this value to 180. -

                            The data type is int. Supported operation is Get and Replace. +

                            The data type is integer. Supported operation is Get and Replace. **InBoxApps**

                            Node for the in-box app settings. @@ -224,9 +226,9 @@ The following diagram shows the SurfaceHub CSP management objects in tree format

                            Added in Windows 10, version 1703. Node for the Skype for Business settings. **InBoxApps/SkypeForBusiness/DomainName** -

                            Added in Windows 10, version 1703. Specifies the domain of the Skype for Business account when you are using Active Directory. For more information, see [Set up Skype for Business Online](https://support.office.com/en-us/article/Set-up-Skype-for-Business-Online-40296968-e779-4259-980b-c2de1c044c6e?ui=en-US&rs=en-US&ad=US#bkmk_users). +

                            Added in Windows 10, version 1703. Specifies the domain of the Skype for Business account when you are using Active Directory. For more information, see Set up Skype for Business Online. -

                            The data type is char. Supported operation is Get and Replace. +

                            The data type is string. Supported operation is Get and Replace. **InBoxApps/Welcome**

                            Node for the welcome screen. @@ -234,7 +236,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format **InBoxApps/Welcome/AutoWakeScreen**

                            Automatically turn on the screen using motion sensors. -

                            The data type is bool. Supported operation is Get and Replace. +

                            The data type is boolean. Supported operation is Get and Replace. **InBoxApps/Welcome/CurrentBackgroundPath**

                            Background image for the welcome screen. To set this, specify a https URL to a PNG file (only PNGs are supported for security reasons). @@ -249,7 +251,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format - 0 - Organizer and time only - 1 - Organizer, time, and subject. Subject is hidden in private meetings. -

                            The data type is int. Supported operation is Get and Replace. +

                            The data type is integer. Supported operation is Get and Replace. **InBoxApps/WirelessProjection**

                            Node for the wireless projector app settings. @@ -257,12 +259,12 @@ The following diagram shows the SurfaceHub CSP management objects in tree format **InBoxApps/WirelessProjection/PINRequired**

                            Users must enter a PIN to wirelessly project to the device. -

                            The data type is bool. Supported operation is Get and Replace. +

                            The data type is boolean. Supported operation is Get and Replace. **InBoxApps/WirelessProjection/Enabled**

                            Enables wireless projection to the device. -

                            The data type is bool. Supported operation is Get and Replace. +

                            The data type is boolean. Supported operation is Get and Replace. **InBoxApps/WirelessProjection/Channel**

                            Wireless channel to use for Miracast operation. The supported channels are defined by the Wi-Fi Alliance Wi-Fi Direct specification. @@ -288,10 +290,10 @@ The following diagram shows the SurfaceHub CSP management objects in tree format -  -

                            The default value is 255. Outside of regulatory concerns, if the channel is configured incorrectly the driver will either not boot, or will broadcast on the wrong channel (which senders won't be looking for). + +

                            The default value is 255. Outside of regulatory concerns, if the channel is configured incorrectly the driver will either not boot, or will broadcast on the wrong channel (which senders won't be looking for). -

                            The data type is int. Supported operation is Get and Replace. +

                            The data type is integer. Supported operation is Get and Replace. **InBoxApps/Connect**

                            Added in Windows 10, version 1703. Node for the Connect app. @@ -301,7 +303,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format

                            If this setting is true, the Connect app will be automatically launched. If false, the user will need to launch the Connect app manually from the Hub’s settings. -

                            The data type is bool. Supported operation is Get and Replace. +

                            The data type is boolean. Supported operation is Get and Replace. **Properties**

                            Node for the device properties. @@ -314,7 +316,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format **Properties/DefaultVolume**

                            Added in Windows 10, version 1703. Specifies the default volume value for a new session. Permitted values are 0-100. The default is 45. -

                            The data type is int. Supported operation is Get and Replace. +

                            The data type is integer. Supported operation is Get and Replace. **Properties/ScreenTimeout**

                            Added in Windows 10, version 1703. Specifies the number of minutes until the Hub screen turns off. @@ -366,7 +368,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format -

                            The data type is int. Supported operation is Get and Replace. +

                            The data type is integer. Supported operation is Get and Replace. **Properties/SessionTimeout**

                            Added in Windows 10, version 1703. Specifies the number of minutes until the session times out. @@ -418,7 +420,7 @@ The following diagram shows the SurfaceHub CSP management objects in tree format -

                            The data type is int. Supported operation is Get and Replace. +

                            The data type is integer. Supported operation is Get and Replace. **Properties/SleepTimeout**

                            Added in Windows 10, version 1703. Specifies the number of minutes until the Hub enters sleep mode. @@ -470,35 +472,35 @@ The following diagram shows the SurfaceHub CSP management objects in tree format -

                            The data type is int. Supported operation is Get and Replace. +

                            The data type is integer. Supported operation is Get and Replace. **Properties/AllowSessionResume**

                            Added in Windows 10, version 1703. Specifies whether to allow the ability to resume a session when the session times out. -

                            If this setting is true, the "Resume Session" feature will be available on the welcome screen when the screen is idle. If false, once the screen idles, the session will be automatically cleaned up as if the “End Session" feature was initiated. +

                            If this setting is true, the "Resume Session" feature will be available on the welcome screen when the screen is idle. If false, once the screen idles, the session will be automatically cleaned up as if the “End Session" feature was initiated. -

                            The data type is bool. Supported operation is Get and Replace. +

                            The data type is boolean. Supported operation is Get and Replace. **Properties/AllowAutoProxyAuth**

                            Added in Windows 10, version 1703. Specifies whether to use the device account for proxy authentication.

                            If this setting is true, the device account will be used for proxy authentication. If false, a separate account will be used. -

                            The data type is bool. Supported operation is Get and Replace. +

                            The data type is boolean. Supported operation is Get and Replace. **Properties/DisableSigninSuggestions**

                            Added in Windows 10, version 1703. Specifies whether to disable auto-populating of the sign-in dialog with invitees from scheduled meetings.

                            If this setting is true, the sign-in dialog will not be populated. If false, the dialog will auto-populate. -

                            The data type is bool. Supported operation is Get and Replace. +

                            The data type is boolean. Supported operation is Get and Replace. **Properties/DoNotShowMyMeetingsAndFiles** -

                            Added in Windows 10, version 1703. Specifies whether to disable the "My meetings and files" feature in the Start menu, which shows the signed-in user's meetings and files from Office 365. +

                            Added in Windows 10, version 1703. Specifies whether to disable the "My meetings and files" feature in the Start menu, which shows the signed-in user's meetings and files from Office 365.

                            If this setting is true, the “My meetings and files” feature will not be shown. When false, the “My meetings and files” feature will be shown. -

                            The data type is bool. Supported operation is Get and Replace. +

                            The data type is boolean. Supported operation is Get and Replace. **MOMAgent**

                            Node for the Microsoft Operations Management Suite. @@ -513,9 +515,9 @@ The following diagram shows the SurfaceHub CSP management objects in tree format

                            The data type is string. Supported operation is Get and Replace. The Get operation is allowed, but it will always return an empty string. -  + -  + diff --git a/windows/client-management/mdm/surfacehub-ddf-file.md b/windows/client-management/mdm/surfacehub-ddf-file.md index c3b580b0e5..d270254f30 100644 --- a/windows/client-management/mdm/surfacehub-ddf-file.md +++ b/windows/client-management/mdm/surfacehub-ddf-file.md @@ -2,11 +2,13 @@ title: SurfaceHub DDF file description: This topic shows the OMA DM device description framework (DDF) for the SurfaceHub configuration service provider. This CSP was added in Windows 10, version 1511. ms.assetid: D34DA1C2-09A2-4BA3-BE99-AC483C278436 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -18,7 +20,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml [!Note] +> [!NOTE] > The forced network connection is only applicable to devices after reset (not new). The following diagram shows the TenantLockdown configuration service provider in tree format. @@ -36,4 +38,4 @@ Value type is bool. Supported operations are Get and Replace. - true - Require network in OOBE - false - No network connection requirement in OOBE -Example scenario: Henry is the IT admin at Contoso. He deploys 1000 devices successfully with RequireNetworkInOOBE set to true. When users accidentally or intentionally reset their device, they are required to connect to a network before they can proceed. Upon successful connection, users see the Contoso branded sign-in experience where they must use their Azure AD credentials. There is no option to skip the network connection and create a local account. \ No newline at end of file +Example scenario: Henry is the IT admin at Contoso. He deploys 1000 devices successfully with RequireNetworkInOOBE set to true. When users accidentally or intentionally reset their device, they are required to connect to a network before they can proceed. Upon successful connection, users see the Contoso branded sign-in experience where they must use their Azure AD credentials. There is no option to skip the network connection and create a local account. diff --git a/windows/client-management/mdm/tenantlockdown-ddf.md b/windows/client-management/mdm/tenantlockdown-ddf.md index 041e4c97ff..ad901702a5 100644 --- a/windows/client-management/mdm/tenantlockdown-ddf.md +++ b/windows/client-management/mdm/tenantlockdown-ddf.md @@ -1,12 +1,14 @@ --- title: TenantLockdown DDF file -description: XML file containing the device description framework -ms.author: maricia +description: XML file containing the device description framework for the TenantLockdown configuration service provider. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 08/13/2018 +ms.reviewer: +manager: dansimp --- # TenantLockdown DDF file @@ -20,7 +22,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is for Windows 10, version 1809. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/tpmpolicy-csp.md b/windows/client-management/mdm/tpmpolicy-csp.md index 2a39e0fa82..36f46f9df1 100644 --- a/windows/client-management/mdm/tpmpolicy-csp.md +++ b/windows/client-management/mdm/tpmpolicy-csp.md @@ -1,12 +1,14 @@ --- title: TPMPolicy CSP description: TPMPolicy CSP -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 11/01/2017 +ms.reviewer: +manager: dansimp --- # TPMPolicy CSP @@ -35,20 +37,20 @@ The following diagram shows the TPMPolicy configuration service provider in tree Here is an example: -``` syntax -                -                    101 -                    -                        -                            -                                ./Vendor/MSFT/TpmPolicy/IsActiveZeroExhaust -                            -                        -                         - bool -               text/plain -        -        true -                     -                 -``` \ No newline at end of file +```xml + + 101 + + + + ./Vendor/MSFT/TpmPolicy/IsActiveZeroExhaust + + + + bool + text/plain + + true + + +``` diff --git a/windows/client-management/mdm/tpmpolicy-ddf-file.md b/windows/client-management/mdm/tpmpolicy-ddf-file.md index e4f359684a..fcdb101ad2 100644 --- a/windows/client-management/mdm/tpmpolicy-ddf-file.md +++ b/windows/client-management/mdm/tpmpolicy-ddf-file.md @@ -1,12 +1,14 @@ --- title: TPMPolicy DDF file description: TPMPolicy DDF file -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 +ms.reviewer: +manager: dansimp --- # TPMPolicy DDF file @@ -18,7 +20,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/uefi-csp.md b/windows/client-management/mdm/uefi-csp.md index 85542e6932..c26f13353d 100644 --- a/windows/client-management/mdm/uefi-csp.md +++ b/windows/client-management/mdm/uefi-csp.md @@ -1,12 +1,14 @@ --- title: UEFI CSP description: The Uefi CSP interfaces to UEFI's Device Firmware Configuration Interface (DFCI) to make BIOS configuration changes. -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 10/02/2018 +ms.reviewer: +manager: dansimp --- # UEFI CSP @@ -14,11 +16,11 @@ ms.date: 10/02/2018 The UEFI configuration service provider (CSP) interfaces to UEFI's Device Firmware Configuration Interface (DFCI) to make BIOS configuration changes. This CSP was added in Windows 10, version 1809. -> [!Note] +> [!NOTE] > The UEFI CSP version published in Windows 10, version 1803 is replaced with this one (version 1809). -> [!Note] -> The production UEFI CSP is present in 1809, but it depends upon the Device Firmware Configuration Interface (DFCI) and UEFI firmware to comply with this interface. The specification for this interface and compatible firmware is not yet available. +> [!NOTE] +> The production UEFI CSP is present in 1809, but it depends upon the [Device Firmware Configuration Interface (DFCI) and UEFI firmware](https://microsoft.github.io/mu/dyn/mu_plus/DfciPkg/Docs/Dfci_Feature/) to comply with this interface. The following diagram shows the UEFI CSP in tree format. @@ -68,7 +70,7 @@ Apply a permissions information package to UEFI. Input is the signed package in Value type is Base64. Supported operation is Replace. **Permissions/Result** -Retrieves the binary result package of the previous Permissions/Apply operation. This binary package contains XML describing the action taken for each individual permission. +Retrieves the binary result package of the previous Permissions/Apply operation. This binary package contains XML describing the action taken for each individual permission. Supported operation is Get. @@ -107,17 +109,17 @@ Supported operation is Get. Node for settings permission operations. Alternate endpoint for sending a second permission package without an OS restart. **Permissions2/Apply** -Apply a permissions information package to UEFI. Input is the signed package in base64 encoded format. Alternate location for sending two permissions information packages in the same session. +Apply a permissions information package to UEFI. Input is the signed package in base64 encoded format. Alternate location for sending two permissions information packages in the same session. Value type is Base64. Supported operation is Replace. **Permissions2/Result** -Retrieves the binary result package from the previous Permissions2/Apply operation. This binary package contains XML describing the action taken for each individual permission. +Retrieves the binary result package from the previous Permissions2/Apply operation. This binary package contains XML describing the action taken for each individual permission. Supported operation is Get. **Settings2** -Nodefor device settings operations. Alternate endpoint for sending a second settings package without an OS restart. +Node for device settings operations. Alternate endpoint for sending a second settings package without an OS restart. **Settings2/Apply** Apply a settings information package to UEFI. Input is the signed package in base64 encoded format. Alternate location for sending two settings information packages in the same session. @@ -128,3 +130,8 @@ Value type is Base64. Supported operation is Replace. Retrieves the binary result package of previous Settings2/Apply operation. This binary package contains XML describing the action taken for each individual setting. Supported operation is Get. + + +## Related topics + +[UEFI DDF file](./uefi-ddf.md) diff --git a/windows/client-management/mdm/uefi-ddf.md b/windows/client-management/mdm/uefi-ddf.md index ddfe446519..808685d36d 100644 --- a/windows/client-management/mdm/uefi-ddf.md +++ b/windows/client-management/mdm/uefi-ddf.md @@ -1,12 +1,14 @@ --- title: UEFI DDF file description: UEFI DDF file -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 10/02/2018 +ms.reviewer: +manager: dansimp --- # UEFI DDF file @@ -18,7 +20,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is for Windows 10, version 1809. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index 84a4a9551f..33001ff094 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -1,12 +1,14 @@ --- title: Understanding ADMX-backed policies description: Starting in Windows 10, version 1703, you can use ADMX-backed policies for Windows 10 mobile device management (MDM) across Windows 10 devices. -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 03/02/2018 +ms.reviewer: +manager: dansimp --- # Understanding ADMX-backed policies @@ -21,8 +23,8 @@ In addition to standard policies, the Policy CSP can now also handle ADMX-backed ADMX files can either describe operating system (OS) Group Policies that are shipped with Windows or they can describe settings of applications, which are separate from the OS and can usually be downloaded and installed on a PC. Depending on the specific category of the settings that they control (OS or application), the administrative template settings are found in the following two locations in the Local Group Policy Editor: -- OS settings: Computer Configuration/Administrative Templates -- Application settings: User Configuration/Administrative Templates +- OS settings: Computer Configuration/Administrative Templates +- Application settings: User Configuration/Administrative Templates In a domain controller/Group Policy ecosystem, Group Policies are automatically added to the registry of the client computer or user profile by the Administrative Templates Client Side Extension (CSE) whenever the client computer processes a Group Policy. Conversely, in an MDM-managed client, ADMX files are leveraged to define policies independent of Group Policies. Therefore, in an MDM-managed client, a Group Policy infrastructure, including the Group Policy Service (gpsvc.exe), is not required. @@ -40,17 +42,17 @@ To capture the end-to-end MDM handling of ADMX Group Policies, an IT administrat The ADMX file that the MDM ISV uses to determine what UI to display to the IT administrator is the same ADMX file that the client uses for the policy definition. The ADMX file is processed either by the OS at build time or set by the client at OS runtime. In either case, the client and the MDM ISV must be synchronized with the ADMX policy definitions. Each ADMX file corresponds to a Group Policy category and typically contains several policy definitions, each of which represents a single Group Policy. For example, the policy definition for the “Publishing Server 2 Settings” is contained in the appv.admx file, which holds the policy definitions for the Microsoft Application Virtualization (App-V) Group Policy category. Group Policy option button setting: -- If **Enabled** is selected, the necessary data entry controls are displayed for the user in the UI. When IT administrator enters the data and clicks **Apply**, the following events occur: - - The MDM ISV server sets up a Replace SyncML command with a payload that contains the user-entered data. - - The MDM client stack receives this data, which causes the Policy CSP to update the device’s registry per the ADMX-backed policy definition. +- If **Enabled** is selected, the necessary data entry controls are displayed for the user in the UI. When IT administrator enters the data and clicks **Apply**, the following events occur: + - The MDM ISV server sets up a Replace SyncML command with a payload that contains the user-entered data. + - The MDM client stack receives this data, which causes the Policy CSP to update the device’s registry per the ADMX-backed policy definition. -- If **Disabled** is selected and you click **Apply**, the following events occur: - - The MDM ISV server sets up a Replace SyncML command with a payload set to ``. - - The MDM client stack receives this command, which causes the Policy CSP to either delete the device’s registry settings, set the registry keys, or both, per the state change directed by the ADMX-backed policy definition. +- If **Disabled** is selected and you click **Apply**, the following events occur: + - The MDM ISV server sets up a Replace SyncML command with a payload set to ``. + - The MDM client stack receives this command, which causes the Policy CSP to either delete the device’s registry settings, set the registry keys, or both, per the state change directed by the ADMX-backed policy definition. -- If **Not Configured** is selected and you click **Apply**, the following events occur: - - MDM ISV server sets up a Delete SyncML command. - - The MDM client stack receives this command, which causes the Policy CSP to delete the device’s registry settings per the ADMX-backed policy definition. +- If **Not Configured** is selected and you click **Apply**, the following events occur: + - MDM ISV server sets up a Delete SyncML command. + - The MDM client stack receives this command, which causes the Policy CSP to delete the device’s registry settings per the ADMX-backed policy definition. The following diagram shows the main display for the Group Policy Editor. diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md index ae18f01c72..ae0b5e11c1 100644 --- a/windows/client-management/mdm/unifiedwritefilter-csp.md +++ b/windows/client-management/mdm/unifiedwritefilter-csp.md @@ -1,12 +1,14 @@ --- title: UnifiedWriteFilter CSP -description: The UnifiedWriteFilter (UWF) configuration service provider enables the IT administrator to remotely manage the UWF to help protect physical storage media including any writable storage type. +description: The UnifiedWriteFilter (UWF) configuration service provider allows you to remotely manage the UWF. Understand how it helps protect physical storage media. ms.assetid: F4716AC6-0AA5-4A67-AECE-E0F200BA95EB -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -17,7 +19,7 @@ The UnifiedWriteFilter (UWF) configuration service provider enables the IT admin > **Note**  The UnifiedWriteFilter CSP is only supported in Windows 10 Enterprise and Windows 10 Education. -  + The following diagram shows the UWF configuration service provider in tree format. @@ -74,7 +76,7 @@ The only supported operation is Get. **CurrentSession/RegistryExclusions** Required. The root node that contains all registry exclusions. -**CurrentSession/RegistryExclusions/****_ExcludedRegistry_** +**CurrentSession/RegistryExclusions/***ExcludedRegistry* Optional. A registry key in the registry exclusion list for UWF in the current session. The only supported operation is Get. @@ -87,7 +89,7 @@ The only supported operation is Get. **CurrentSession/Volume** Required. The root node to contain all volumes protected by UWF in the current session. -**CurrentSession/Volume/****_Volume_** +**CurrentSession/Volume/***Volume* Optional. Represents a specific volume in the current session. **CurrentSession/Volume/*Volume*/Protected** @@ -108,7 +110,7 @@ The only supported operation is Get. **CurrentSession/Volume/*Volume*/Exclusions** Required. The root node that contains all file exclusions for the volume. -**CurrentSession/Volume/*Volume*/Exclusions/****_ExclusionPath_** +**CurrentSession/Volume/*Volume*/Exclusions/***ExclusionPath* Optional. A string that contains the full path of the file or folder relative to the volume. The only supported operation is Get. @@ -178,7 +180,7 @@ Required. The root node that contains all registry exclusions for the next sessi Supported operations are Add, Delete, and Replace. -**NextSession/RegistryExclusions/****_ExcludedRegistry_** +**NextSession/RegistryExclusions/***ExcludedRegistry* Optional. A registry key in the registry exclusion list for UWF. Supported operations are Add, Delete, Get, and Replace. @@ -191,7 +193,7 @@ Supported operations are Get and Replace. **NextSession/Volume** Required. The root node that contains all volumes protected by UWF for the next session. -**NextSession/Volume/****_Volume_** +**NextSession/Volume/***Volume* Optional. Represents a specific volume in the next session. Supported operations are Add, Delete, and Replace. @@ -214,7 +216,7 @@ The only supported operation is Get. **NextSession/Volume/*Volume*/Exclusions** Required. The root node that contains all file exclusions for this volume in the next session. -**NextSession/Volume/*Volume*/Exclusions/****_ExclusionPath_** +**NextSession/Volume/*Volume*/Exclusions/***ExclusionPath* Optional. A string that contains the full path of the file or folder relative to the volume. Supported operations are Add, Delete, Get, and Replace. @@ -239,9 +241,9 @@ Supported operations are Get and Execute. [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/unifiedwritefilter-ddf.md b/windows/client-management/mdm/unifiedwritefilter-ddf.md index b2757575a6..2eb8bf1445 100644 --- a/windows/client-management/mdm/unifiedwritefilter-ddf.md +++ b/windows/client-management/mdm/unifiedwritefilter-ddf.md @@ -2,11 +2,13 @@ title: UnifiedWriteFilter DDF File description: UnifiedWriteFilter DDF File ms.assetid: 23A7316E-A298-43F7-9407-A65155C8CEA6 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -17,7 +19,7 @@ This topic shows the OMA DM device description framework (DDF) for the **Unified Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -``` syntax +```xml [!NOTE] > When the RequireUpdateApproval policy is set, the MDM uses the ApprovedUpdates list to pass the approved GUIDs. These GUIDs should be a subset of the InstallableUpdates list. -

                            The MDM must first present the EULA to IT and have them accept it before the update is approved. Failure to do this is a breach of legal or contractual obligations. The EULAs can be obtained from the update metadata and have their own EULA ID. It's possible for multiple updates to share the same EULA. It is only necessary to approve the EULA once per EULA ID, not one per update. +

                            The MDM must first present the EULA to IT and have them accept it before the update is approved. Failure to do this is a breach of legal or contractual obligations. The EULAs can be obtained from the update metadata and have their own EULA ID. It's possible for multiple updates to share the same EULA. It is only necessary to approve the EULA once per EULA ID, not one per update.

                            The update approval list enables IT to approve individual updates and update classifications. Auto-approval by update classifications allows IT to automatically approve Definition Updates (i.e., updates to the virus and spyware definitions on devices) and Security Updates (i.e., product-specific updates for security-related vulnerability). The update approval list does not support the uninstallation of updates by revoking approval of already installed updates. Updates are approved based on UpdateID, and an UpdateID only needs to be approved once. An update UpdateID and RevisionNumber are part of the UpdateIdentity type. An UpdateID can be associated to several UpdateIdentity GUIDs due to changes to the RevisionNumber setting. MDM services must synchronize the UpdateIdentity of an UpdateID based on the latest RevisionNumber to get the latest metadata for an update. However, update approval is based on UpdateID. @@ -38,17 +40,18 @@ The following diagram shows the Update configuration service provider in tree fo

                            Supported operations are Get and Add. -**ApprovedUpdates/****_Approved Update Guid_** +**ApprovedUpdates/***Approved Update Guid*

                            Specifies the update GUID. -

                            To auto-approve a class of updates, you can specify the [Update Classifications](https://go.microsoft.com/fwlink/p/?LinkId=526723) GUIDs. We strongly recommend to always specify the DefinitionsUpdates classification (E0789628-CE08-4437-BE74-2495B842F43B), which are used for anti-malware signatures. There are released periodically (several times a day). Some businesses may also want to auto-approve security updates to get them deployed quickly. +

                            To auto-approve a class of updates, you can specify the Update Classifications GUIDs. We strongly recommend to always specify the DefinitionsUpdates classification (E0789628-CE08-4437-BE74-2495B842F43B), which are used for anti-malware signatures. There are released periodically (several times a day). Some businesses may also want to auto-approve security updates to get them deployed quickly.

                            Supported operations are Get and Add.

                            Sample syncml: -

                            + +``` ./Vendor/MSFT/Update/ApprovedUpdates/%7ba317dafe-baf4-453f-b232-a7075efae36e%7d - +``` **ApprovedUpdates/*Approved Update Guid*/ApprovedTime**

                            Specifies the time the update gets approved. @@ -60,7 +63,7 @@ The following diagram shows the Update configuration service provider in tree fo

                            Supported operation is Get. -**FailedUpdates/****_Failed Update Guid_** +**FailedUpdates/***Failed Update Guid*

                            Update identifier field of the UpdateIdentity GUID that represent an update that failed to download or install.

                            Supported operation is Get. @@ -85,7 +88,7 @@ The following diagram shows the Update configuration service provider in tree fo

                            Supported operation is Get. -**InstalledUpdates/****_Installed Update Guid_** +**InstalledUpdates/***Installed Update Guid*

                            UpdateIDs that represent the updates installed on a device.

                            Supported operation is Get. @@ -100,7 +103,7 @@ The following diagram shows the Update configuration service provider in tree fo

                            Supported operation is Get. -**InstallableUpdates/****_Installable Update Guid_** +**InstallableUpdates/***Installable Update Guid*

                            Update identifiers that represent the updates applicable and not installed on a device.

                            Supported operation is Get. @@ -124,7 +127,7 @@ The following diagram shows the Update configuration service provider in tree fo

                            Supported operation is Get. -**PendingRebootUpdates/****_Pending Reboot Update Guid_** +**PendingRebootUpdates/***Pending Reboot Update Guid*

                            Update identifiers for the pending reboot state.

                            Supported operation is Get. @@ -164,7 +167,7 @@ If the conditions are not true, the device will not Roll Back the Latest Quality **Rollback/FeatureUpdate** Added in Windows 10, version 1803. Roll Back Latest Feature Update, if the machine meets the following conditions: -- Condition 1: Device must be Windows Update for Business Connnected +- Condition 1: Device must be Windows Update for Business Connected - Condition 2: Device must be in Paused State - Condition 3: Device must have the Latest Feature Update Installed on the device (Current State) - Condition 4: Machine should be within the uninstall period @@ -185,9 +188,9 @@ Added in Windows 10, version 1803. Returns the result of last RollBack FeatureUp [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/update-ddf-file.md b/windows/client-management/mdm/update-ddf-file.md index c4858fe6d8..731adeeb60 100644 --- a/windows/client-management/mdm/update-ddf-file.md +++ b/windows/client-management/mdm/update-ddf-file.md @@ -2,11 +2,13 @@ title: Update DDF file description: Update DDF file ms.assetid: E236E468-88F3-402A-BA7A-834ED38DD388 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 02/23/2018 --- @@ -18,7 +20,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is for Windows 10, version 1803. -``` syntax +```xml Roll Back Latest Feature Update, if the machine meets the following conditions: - Condition 1: Device must be WUfB Connnected + Condition 1: Device must be WUfB Connected Condition 2: Device must be in Paused State Condition 3: Device must have the Latest Feature Update Installed on the device (Current State) Condition 4: Machine should be within the uninstall period @@ -613,7 +615,7 @@ The XML below is for Windows 10, version 1803. - Returns the result of last RollBack QualityUpdate opearation. + Returns the result of last RollBack QualityUpdate operation. @@ -635,7 +637,7 @@ The XML below is for Windows 10, version 1803. - Returns the result of last RollBack FeatureUpdate opearation. + Returns the result of last RollBack FeatureUpdate operation. diff --git a/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md b/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md index 1db424cd03..5bdd2eaf0f 100644 --- a/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md +++ b/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider.md @@ -2,11 +2,13 @@ title: Using PowerShell scripting with the WMI Bridge Provider description: This topic covers using PowerShell Cmdlet scripts to configure per-user and per-device policy settings, as well as how to invoke methods through the WMI Bridge Provider. ms.assetid: 238D45AD-3FD8-46F9-B7FB-6AEE42BE4C08 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -48,17 +50,17 @@ New-CimInstance -Namespace $namespaceName -ClassName $className -Property @{Pare Get-CimInstance -Namespace $namespaceName -ClassName $className # Query instances with matching properties -Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" +Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" # Modify existing instance -$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" $obj.WLANScanMode=500 Set-CimInstance -CimInstance $obj # Delete existing instance try { - $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" + $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT/Policy/Config' and InstanceID='WiFi'" Remove-CimInstance -CimInstance $obj } catch [Exception] @@ -111,9 +113,9 @@ $session = New-CimSession # Create a new instance for MDM_Policy_User_Config01_Authentication02 ########################################################################## $newInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") $newInstance.CimInstanceProperties.Add($property) -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") $newInstance.CimInstanceProperties.Add($property) $property = [Microsoft.Management.Infrastructure.CimProperty]::Create("AllowEAPCertSSO", 1, "Sint32", "Property") $newInstance.CimInstanceProperties.Add($property) @@ -136,9 +138,9 @@ $session.EnumerateInstances($namespaceName, $className, $options) # with matching properties ########################################################################## $getInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") $getInstance.CimInstanceProperties.Add($property) -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") $getInstance.CimInstanceProperties.Add($property) try { @@ -153,9 +155,9 @@ catch [Exception] # Modify existing instance for MDM_Policy_User_Config01_Authentication02 ########################################################################## $getInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") $getInstance.CimInstanceProperties.Add($property) -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") $getInstance.CimInstanceProperties.Add($property) try { @@ -172,9 +174,9 @@ catch [Exception] # Delete existing instance for MDM_Policy_User_Config01_Authentication02 ########################################################################## $getInstance = New-Object Microsoft.Management.Infrastructure.CimInstance $className, $namespaceName -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("ParentID", './Vendor/MSFT/Policy/Config', "string", "Key") $getInstance.CimInstanceProperties.Add($property) -$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") +$property = [Microsoft.Management.Infrastructure.CimProperty]::Create("InstanceID", 'Authentication', "String", "Key") $getInstance.CimInstanceProperties.Add($property) try { @@ -207,7 +209,7 @@ $params.Add($param) try { - $instance = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT' and InstanceID='WindowsLicensing'" + $instance = Get-CimInstance -Namespace $namespaceName -ClassName $className -Filter "ParentID='./Vendor/MSFT' and InstanceID='WindowsLicensing'" $session.InvokeMethod($namespaceName, $instance, $methodName, $params) } catch [Exception] diff --git a/windows/client-management/mdm/vpn-csp.md b/windows/client-management/mdm/vpn-csp.md index ef49ec3a51..7b8f154145 100644 --- a/windows/client-management/mdm/vpn-csp.md +++ b/windows/client-management/mdm/vpn-csp.md @@ -2,11 +2,13 @@ title: VPN CSP description: VPN CSP ms.assetid: 05ca946a-1c0b-4e11-8d7e-854e14740707 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 04/02/2017 --- diff --git a/windows/client-management/mdm/vpn-ddf-file.md b/windows/client-management/mdm/vpn-ddf-file.md index 79be87ff7f..b3e8aef28c 100644 --- a/windows/client-management/mdm/vpn-ddf-file.md +++ b/windows/client-management/mdm/vpn-ddf-file.md @@ -2,11 +2,13 @@ title: VPN DDF file description: VPN DDF file ms.assetid: 728FCD9C-0B8E-413B-B54A-CD72C9F2B9EE -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -15,7 +17,7 @@ ms.date: 06/26/2017 This topic shows the OMA DM device description framework (DDF) for the **VPN** configuration service provider. DDF files are used only with OMA DM provisioning XML. -``` syntax +```xml **Device or User profile** For user profile, use **./User/Vendor/MSFT** path and for device profile, use **./Device/Vendor/MSFT** path. -**VPNv2/***ProfileName* +**VPNv2/**ProfileName Unique alpha numeric identifier for the profile. The profile name must not include a forward slash (/). Supported operations include Get, Add, and Delete. > **Note**  If the profile name has a space or other non-alphanumeric character, it must be properly escaped according to the URL encoding standard. -**VPNv2/***ProfileName***/AppTriggerList** +**VPNv2/**ProfileName**/AppTriggerList** Optional node. List of applications set to trigger the VPN. If any of these apps are launched and the VPN profile is currently the active profile, this VPN profile will be triggered to connect. -**VPNv2/***ProfileName***/AppTriggerList/***appTriggerRowId* +**VPNv2/**ProfileName**/AppTriggerList/**appTriggerRowId A sequential integer identifier which allows the ability to specify multiple apps for App Trigger. Sequencing must start at 0 and you should not skip numbers. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/AppTriggerList/***appTriggerRowId***/App** +**VPNv2/**ProfileName**/AppTriggerList/**appTriggerRowId**/App** App Node under the Row Id. -**VPNv2/***ProfileName***/AppTriggerList/***appTriggerRowId***/App/Id** +**VPNv2/**ProfileName**/AppTriggerList/**appTriggerRowId**/App/Id** App identity, which is either an app’s package family name or file path. The type is inferred by the Id, and therefore cannot be specified in the get only App/Type field -**VPNv2/***ProfileName***/AppTriggerList/***appTriggerRowId***/App/Type** +**VPNv2/**ProfileName**/AppTriggerList/**appTriggerRowId**/App/Type** Returns the type of **App/Id**. This value can be either of the following: - PackageFamilyName - When this is returned, the App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of the Microsoft Store application. @@ -67,34 +69,34 @@ Returns the type of **App/Id**. This value can be either of the following: Value type is chr. Supported operation is Get. -**VPNv2/***ProfileName***/RouteList/** +**VPNv2/**ProfileName**/RouteList/** Optional node. List of routes to be added to the routing table for the VPN interface. This is required for split tunneling case where the VPN server site has more subnets that the default subnet based on the IP assigned to the interface. Every computer that runs TCP/IP makes routing decisions. These decisions are controlled by the IP routing table. Adding values under this node updates the routing table with routes for the VPN interface post connection. The values under this node represent the destination prefix of IP routes. A destination prefix consists of an IP address prefix and a prefix length. Adding a route here allows the networking stack to identify the traffic that needs to go over the VPN interface for split tunnel VPN. Some VPN servers can configure this during connect negotiation and do not need this information in the VPN Profile. Please check with your VPN server administrator to determine whether you need this information in the VPN profile. -**VPNv2/***ProfileName***/RouteList/***routeRowId* +**VPNv2/**ProfileName**/RouteList/**routeRowId A sequential integer identifier for the RouteList. This is required if you are adding routes. Sequencing must start at 0. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/RouteList/***routeRowId***/Address** +**VPNv2/**ProfileName**/RouteList/**routeRowId**/Address** Subnet address in IPv4/v6 address format which, along with the prefix will be used to determine the destination prefix to send via the VPN Interface. This is the IP address part of the destination prefix. Supported operations include Get, Add, Replace, and Delete. Value type is chr. Example, `192.168.0.0` -**VPNv2/***ProfileName***/RouteList/***routeRowId***/PrefixSize** +**VPNv2/**ProfileName**/RouteList/**routeRowId**/PrefixSize** The subnet prefix size part of the destination prefix for the route entry. This, along with the address will be used to determine the destination prefix to route through the VPN Interface. Value type is int. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/RouteList/***routeRowId***/Metric** +**VPNv2/**ProfileName**/RouteList/**routeRowId**/Metric** Added in Windows 10, version 1607. The route's metric. Value type is int. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/RouteList/***routeRowId***/ExclusionRoute** +**VPNv2/**ProfileName**/RouteList/**routeRowId**/ExclusionRoute** Added in Windows 10, version 1607. A boolean value that specifies if the route being added should point to the VPN Interface or the Physical Interface as the Gateway. Valid values: - False (default) - This route will direct traffic over the VPN @@ -102,17 +104,17 @@ Added in Windows 10, version 1607. A boolean value that specifies if the route Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/DomainNameInformationList** +**VPNv2/**ProfileName**/DomainNameInformationList** Optional node. Name Resolution Policy Table (NRPT) rules for the VPN profile. The Name Resolution Policy Table (NRPT) is a table of namespaces and corresponding settings stored in the Windows registry that determines the DNS client behavior when issuing queries and processing responses. Each row in the NRPT represents a rule for a portion of the namespace for which the DNS client issues queries. Before issuing name resolution queries, the DNS client consults the NRPT to determine if any additional flags must be set in the query. After receiving the response, the client again consults the NRPT to check for any special processing or policy requirements. In the absence of the NRPT, the client operates based on the DNS servers and suffixes set on the interface. -**VPNv2/***ProfileName***/DomainNameInformationList/***dniRowId* +**VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId A sequential integer identifier for the Domain Name information. Sequencing must start at 0. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/DomainNameInformationList/***dniRowId***/DomainName** +**VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/DomainName** Used to indicate the namespace to which the policy applies. When a Name query is issued, the DNS client compares the name in the query to all of the namespaces under DomainNameInformationList to find a match. This parameter can be one of the following types: - FQDN - Fully qualified domain name @@ -120,7 +122,7 @@ Used to indicate the namespace to which the policy applies. When a Name query is Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/DomainNameInformationList/***dniRowId***/DomainNameType** +**VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/DomainNameType** Returns the namespace type. This value can be one of the following: - FQDN - If the DomainName was not prepended with a **.** and applies only to the fully qualified domain name (FQDN) of a specified host. @@ -128,21 +130,21 @@ Returns the namespace type. This value can be one of the following: Value type is chr. Supported operation is Get. -**VPNv2/***ProfileName***/DomainNameInformationList/***dniRowId***/DnsServers** +**VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/DnsServers** List of comma separated DNS Server IP addresses to use for the namespace. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/DomainNameInformationList/***dniRowId***/WebProxyServers** +**VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/WebProxyServers** Optional. Web Proxy Server IP address if you are redirecting traffic through your intranet. > **Note**  Currently only one web proxy server is supported. -  + Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/DomainNameInformationList/***dniRowId***/AutoTrigger** +**VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/AutoTrigger** Added in Windows 10, version 1607. Optional. Boolean to determine whether this domain name rule will trigger the VPN. If set to False, this DomainName rule will not trigger the VPN. @@ -151,9 +153,9 @@ If set to True, this DomainName rule will trigger the VPN By default, this value is false. -Value type is bool. Persistent +Value type is bool. -**VPNv2/***ProfileName***/DomainNameInformationList/***dniRowId***/Persistent** +**VPNv2/**ProfileName**/DomainNameInformationList/**dniRowId**/Persistent** Added in Windows 10, version 1607. A boolean value that specifies if the rule being added should persist even when the VPN is not connected. Value values: - False (default) - This DomainName rule will only be applied when VPN is connected. @@ -161,22 +163,22 @@ Added in Windows 10, version 1607. A boolean value that specifies if the rule b Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/TrafficFilterList** +**VPNv2/**ProfileName**/TrafficFilterList** An optional node that specifies a list of rules. Only traffic that matches these rules can be sent via the VPN Interface. > **Note**  Once a TrafficFilterList is added, all traffic are blocked other than the ones matching the rules. -  + When adding multiple rules, each rule operates based on an OR with the other rules. Within each rule, each property operates based on an AND with each other. -**VPNv2/***ProfileName***/TrafficFilterList/***trafficFilterId* +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId A sequential integer identifier for the Traffic Filter rules. Sequencing must start at 0. -**VPNv2/***ProfileName***/TrafficFilterList/***trafficFilterId***/App** +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/App** Per app VPN rule. This will allow only the apps specified to be allowed over the VPN interface. Value type is chr. -**VPNv2/***ProfileName***/TrafficFilterList/***trafficFilterId***/App/Id** +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/App/Id** App identity for the app-based traffic filter. The value for this node can be one of the following: @@ -187,48 +189,48 @@ The value for this node can be one of the following: Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/TrafficFilterList/***trafficFilterId***/App/Type** +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/App/Type** Returns the type of ID of the **App/Id**. Value type is chr. Supported operation is Get. -**VPNv2/***ProfileName***/TrafficFilterList/***trafficFilterId***/Claims** +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/Claims** Reserved for future use. -**VPNv2/***ProfileName***/TrafficFilterList/***trafficFilterId***/Protocol** +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/Protocol** Numeric value from 0-255 representing the IP protocol to allow. For example, TCP = 6 and UDP = 17. Value type is int. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/TrafficFilterList/***trafficFilterId***/LocalPortRanges** +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/LocalPortRanges** A list of comma separated values specifying local port ranges to allow. For example, `100-120, 200, 300-320`. > **Note**  Ports are only valid when the protocol is set to TCP=6 or UDP=17. -  + Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/TrafficFilterList/***trafficFilterId***/RemotePortRanges** +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/RemotePortRanges** A list of comma separated values specifying remote port ranges to allow. For example, `100-120, 200, 300-320`. > **Note**  Ports are only valid when the protocol is set to TCP=6 or UDP=17. -  + Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/TrafficFilterList/***trafficFilterId***/LocalAddressRanges** +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/LocalAddressRanges** A list of comma separated values specifying local IP address ranges to allow. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/TrafficFilterList/***trafficFilterId***/RemoteAddressRanges** +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/RemoteAddressRanges** A list of comma separated values specifying remote IP address ranges to allow. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/TrafficFilterList/***trafficFilterId***/RoutingPolicyType** +**VPNv2/**ProfileName**/TrafficFilterList/**trafficFilterId**/RoutingPolicyType** Specifies the routing policy if an App or Claims type is used in the traffic filter. The scope of this property is for this traffic filter rule alone. The value can be one of the following: - SplitTunnel - For this traffic filter rule, only the traffic meant for the VPN interface (as determined by the networking stack) goes over the interface. Internet traffic can continue to go over the other interfaces. @@ -238,19 +240,19 @@ This is only applicable for App ID based Traffic Filter rules. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/EdpModeId** +**VPNv2/**ProfileName**/EdpModeId** Enterprise ID, which is required for connecting this VPN profile with an WIP policy. When this is set, the networking stack looks for this Enterprise ID in the app token to determine if the traffic is allowed to go over the VPN. If the profile is active, it also automatically triggers the VPN to connect. We recommend having only one such profile per device. Additionally when connecting with Windows Information Protection (WIP)(formerly known as Enterprise Data Protection), the admin does not have to specify AppTriggerList and TrafficFilterList rules separately in this profile (unless more advanced config is needed) because the WIP policies and App lists automatically takes effect. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/RememberCredentials** +**VPNv2/**ProfileName**/RememberCredentials** Boolean value (true or false) for caching credentials. Default is false, which means do not cache credentials. If set to true, credentials are cached whenever possible. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/AlwaysOn** +**VPNv2/**ProfileName**/AlwaysOn** An optional flag to enable Always On mode. This will automatically connect the VPN at sign-in and will stay connected until the user manually disconnects. > **Note**  Always On only works for the active profile. The first profile provisioned that can be auto triggered will automatically be set as active. @@ -271,7 +273,7 @@ Valid values: Value type is bool. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/LockDown** (./Device only profile) +**VPNv2/**ProfileName**/LockDown** (./Device only profile) Lockdown profile. Valid values: @@ -290,7 +292,7 @@ A Lockdown profile must be deleted before you can add, remove, or connect other Value type is bool. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/DeviceTunnel** (./Device only profile) +**VPNv2/**ProfileName**/DeviceTunnel** (./Device only profile) Device tunnel profile. Valid values: @@ -308,7 +310,7 @@ A device tunnel profile must be deleted before another device tunnel profile can Value type is bool. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/RegisterDNS** +**VPNv2/**ProfileName**/RegisterDNS** Allows registration of the connection's address in DNS. Valid values: @@ -316,112 +318,112 @@ Valid values: - False = Do not register the connection's address in DNS (default). - True = Register the connection's addresses in DNS. -**VPNv2/***ProfileName***/DnsSuffix** +**VPNv2/**ProfileName**/DnsSuffix** Optional. Specifies one or more comma separated DNS suffixes. The first in the list is also used as the primary connection specific DNS suffix for the VPN Interface. The entire list will also be added into the SuffixSearchList. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/ByPassForLocal** +**VPNv2/**ProfileName**/ByPassForLocal** Reserved for future use. -**VPNv2/***ProfileName***/TrustedNetworkDetection** +**VPNv2/**ProfileName**/TrustedNetworkDetection** Optional. Comma separated string to identify the trusted network. VPN will not connect automatically when the user is on their corporate wireless network where protected resources are directly accessible to the device. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/ProfileXML** +**VPNv2/**ProfileName**/ProfileXML** Added in Windows 10, version 1607. The XML schema for provisioning all the fields of a VPN. For the XSD, see [ProfileXML XSD](vpnv2-profile-xsd.md). Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/Proxy** +**VPNv2/**ProfileName**/Proxy** A collection of configuration objects to enable a post-connect proxy support for VPN. The proxy defined for this profile is applied when this profile is active and connected. -**VPNv2/***ProfileName***/Proxy/Manual** +**VPNv2/**ProfileName**/Proxy/Manual** Optional node containing the manual server settings. -**VPNv2/***ProfileName***/Proxy/Manual/Server** +**VPNv2/**ProfileName**/Proxy/Manual/Server** Optional. Proxy server address as a fully qualified hostname or an IP address. You should set this element together with Port. Example, proxy.contoso.com. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/Proxy/AutoConfigUrl** +**VPNv2/**ProfileName**/Proxy/AutoConfigUrl** Optional. URL to automatically retrieve the proxy settings. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/APNBinding** +**VPNv2/**ProfileName**/APNBinding** Reserved for future use. -**VPNv2/***ProfileName***/APNBinding/ProviderId** +**VPNv2/**ProfileName**/APNBinding/ProviderId** Reserved for future use. Optional node. -**VPNv2/***ProfileName***/APNBinding/AccessPointName** +**VPNv2/**ProfileName**/APNBinding/AccessPointName** Reserved for future use. -**VPNv2/***ProfileName***/APNBinding/UserName** +**VPNv2/**ProfileName**/APNBinding/UserName** Reserved for future use. -**VPNv2/***ProfileName***/APNBinding/Password** +**VPNv2/**ProfileName**/APNBinding/Password** Reserved for future use. -**VPNv2/***ProfileName***/APNBinding/IsCompressionEnabled** +**VPNv2/**ProfileName**/APNBinding/IsCompressionEnabled** Reserved for future use. -**VPNv2/***ProfileName***/APNBinding/AuthenticationType** +**VPNv2/**ProfileName**/APNBinding/AuthenticationType** Reserved for future use. -**VPNv2/***ProfileName***/DeviceCompliance** +**VPNv2/**ProfileName**/DeviceCompliance** Added in Windows 10, version 1607. Nodes under DeviceCompliance can be used to enable AAD-based Conditional Access for VPN. -**VPNv2/***ProfileName***/DeviceCompliance/Enabled** +**VPNv2/**ProfileName**/DeviceCompliance/Enabled** Added in Windows 10, version 1607. Enables the Device Compliance flow from the client. If marked as True, the VPN Client will attempt to communicate with AAD to get a certificate to use for authentication. The VPN should be set up to use Certificate Auth and the VPN Server must trust the Server returned by Azure Active Directory. Value type is bool. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/DeviceCompliance/Sso** +**VPNv2/**ProfileName**/DeviceCompliance/Sso** Added in Windows 10, version 1607. Nodes under SSO can be used to choose a certificate different from the VPN Authentication cert for the Kerberos Authentication in the case of Device Compliance. -**VPNv2/***ProfileName***/DeviceCompliance/Sso/Enabled** +**VPNv2/**ProfileName**/DeviceCompliance/Sso/Enabled** Added in Windows 10, version 1607. If this field is set to True, the VPN Client will look for a separate certificate for Kerberos Authentication. Value type is bool. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/DeviceCompliance/Sso/IssuerHash** +**VPNv2/**ProfileName**/DeviceCompliance/Sso/IssuerHash** Added in Windows 10, version 1607. Hashes for the VPN Client to look for the correct certificate for Kerberos Authentication. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/DeviceCompliance/Sso/Eku** +**VPNv2/**ProfileName**/DeviceCompliance/Sso/Eku** Added in Windows 10, version 1607. Comma Separated list of EKUs for the VPN Client to look for the correct certificate for Kerberos Authentication. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/PluginProfile** +**VPNv2/**ProfileName**/PluginProfile** Nodes under the PluginProfile are required when using a Microsoft Store based VPN plugin. -**VPNv2/***ProfileName***/PluginProfile/ServerUrlList** -Required for plug-in profiles. Comma separated list of servers in URL, hostname, or IP format. +**VPNv2/**ProfileName**/PluginProfile/ServerUrlList** +Required for plug-in profiles. Semicolon-separated list of servers in URL, hostname, or IP format. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/PluginProfile/CustomConfiguration** +**VPNv2/**ProfileName**/PluginProfile/CustomConfiguration** Optional. This is an HTML encoded XML blob for SSL-VPN plug-in specific configuration including authentication information that is deployed to the device to make it available for SSL-VPN plug-ins. Contact the plugin provider for format and other details. Most plugins can also configure values based on the server negotiations as well as defaults. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/PluginProfile/PluginPackageFamilyName** +**VPNv2/**ProfileName**/PluginProfile/PluginPackageFamilyName** Required for plug-in profiles. Package family name for the SSL-VPN plug-in. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/PluginProfile/CustomStoreUrl** +**VPNv2/**ProfileName**/PluginProfile/CustomStoreUrl** Reserved for future use. -**VPNv2/***ProfileName***/NativeProfile** +**VPNv2/**ProfileName**/NativeProfile** Nodes under NativeProfile are required when using a Windows Inbox VPN Protocol (IKEv2, PPTP, L2TP). -**VPNv2/***ProfileName***/NativeProfile/Servers** +**VPNv2/**ProfileName**/NativeProfile/Servers** Required for native profiles. Public or routable IP address or DNS name for the VPN gateway. It can point to the external IP of a gateway or a virtual IP for a server farm. Examples, 208.147.66.130 or vpn.contoso.com. The name can be a server name plus a friendly name separated with a semi-colon. For example, server2.example.com;server2FriendlyName. When you get the value, the return will include both the server name and the friendly name; if no friendly name had been supplied it will default to the server name. @@ -430,7 +432,7 @@ You can make a list of server by making a list of server names (with optional fr Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/RoutingPolicyType** +**VPNv2/**ProfileName**/NativeProfile/RoutingPolicyType** Optional for native profiles. Type of routing policy. This value can be one of the following: - SplitTunnel - Traffic can go over any interface as determined by the networking stack. @@ -438,7 +440,7 @@ Optional for native profiles. Type of routing policy. This value can be one of t Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/NativeProtocolType** +**VPNv2/**ProfileName**/NativeProfile/NativeProtocolType** Required for native profiles. Type of tunneling protocol used. This value can be one of the following: - PPTP @@ -448,12 +450,12 @@ Required for native profiles. Type of tunneling protocol used. This value can be Value type is chr. Supported operations include Get, Add, Replace, and Delete. -> **Note** The **Automatic** option means that the device will try each of the built-in tunneling protocols until one succeeds. It will attempt protocols in following order: IKEv2, PPTP and then L2TP. This order is not customizable. +> **Note** The **Automatic** option means that the device will try each of the built-in tunneling protocols until one succeeds. It will attempt protocols in following order: SSTP, IKEv2, PPTP and then L2TP. This order is not customizable. -**VPNv2/***ProfileName***/NativeProfile/Authentication** +**VPNv2/**ProfileName**/NativeProfile/Authentication** Required node for native profile. It contains authentication information for the native VPN profile. -**VPNv2/***ProfileName***/NativeProfile/Authentication/UserMethod** +**VPNv2/**ProfileName**/NativeProfile/Authentication/UserMethod** This value can be one of the following: - EAP @@ -461,7 +463,7 @@ This value can be one of the following: Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/Authentication/MachineMethod** +**VPNv2/**ProfileName**/NativeProfile/Authentication/MachineMethod** This is only supported in IKEv2. This value can be one of the following: @@ -470,32 +472,32 @@ This value can be one of the following: Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/Authentication/Eap** +**VPNv2/**ProfileName**/NativeProfile/Authentication/Eap** Required when the native profile specifies EAP authentication. EAP configuration XML. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/Authentication/Eap/Configuration** +**VPNv2/**ProfileName**/NativeProfile/Authentication/Eap/Configuration** HTML encoded XML of the EAP configuration. For more information about EAP configuration XML, see [EAP configuration](eap-configuration.md). Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/Authentication/Eap/Type** +**VPNv2/**ProfileName**/NativeProfile/Authentication/Eap/Type** Reserved for future use. -**VPNv2/***ProfileName***/NativeProfile/Authentication/Certificate** +**VPNv2/**ProfileName**/NativeProfile/Authentication/Certificate** Reserved for future use. -**VPNv2/***ProfileName***/NativeProfile/Authentication/Certificate/Issuer** +**VPNv2/**ProfileName**/NativeProfile/Authentication/Certificate/Issuer** Reserved for future use. -**VPNv2/***ProfileName***/NativeProfile/Authentication/Certificate/Eku** +**VPNv2/**ProfileName**/NativeProfile/Authentication/Certificate/Eku** Reserved for future use. -**VPNv2/***ProfileName***/NativeProfile/CryptographySuite** +**VPNv2/**ProfileName**/NativeProfile/CryptographySuite** Added in Windows 10, version 1607. Properties of IPSec tunnels. -**VPNv2/***ProfileName***/NativeProfile/CryptographySuite/AuthenticationTransformConstants** +**VPNv2/**ProfileName**/NativeProfile/CryptographySuite/AuthenticationTransformConstants** Added in Windows 10, version 1607. The following list contains the valid values: @@ -509,7 +511,7 @@ The following list contains the valid values: Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/CryptographySuite/CipherTransformConstants** +**VPNv2/**ProfileName**/NativeProfile/CryptographySuite/CipherTransformConstants** Added in Windows 10, version 1607. The following list contains the valid values: @@ -525,7 +527,7 @@ The following list contains the valid values: Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/CryptographySuite/EncryptionMethod** +**VPNv2/**ProfileName**/NativeProfile/CryptographySuite/EncryptionMethod** Added in Windows 10, version 1607. The following list contains the valid values: @@ -540,7 +542,7 @@ The following list contains the valid values: Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/CryptographySuite/IntegrityCheckMethod** +**VPNv2/**ProfileName**/NativeProfile/CryptographySuite/IntegrityCheckMethod** Added in Windows 10, version 1607. The following list contains the valid values: @@ -552,7 +554,7 @@ The following list contains the valid values: Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/CryptographySuite/DHGroup** +**VPNv2/**ProfileName**/NativeProfile/CryptographySuite/DHGroup** Added in Windows 10, version 1607. The following list contains the valid values: @@ -566,7 +568,7 @@ The following list contains the valid values: Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/CryptographySuite/PfsGroup** +**VPNv2/**ProfileName**/NativeProfile/CryptographySuite/PfsGroup** Added in Windows 10, version 1607. The following list contains the valid values: @@ -581,12 +583,12 @@ The following list contains the valid values: Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/L2tpPsk** +**VPNv2/**ProfileName**/NativeProfile/L2tpPsk** Added in Windows 10, version 1607. The preshared key used for an L2TP connection. Value type is chr. Supported operations include Get, Add, Replace, and Delete. -**VPNv2/***ProfileName***/NativeProfile/DisableClassBasedDefaultRoute** +**VPNv2/**ProfileName**/NativeProfile/DisableClassBasedDefaultRoute** Added in Windows 10, version 1607. Specifies the class based default routes. For example, if the interface IP begins with 10, it assumes a class a IP and pushes the route to 10.0.0.0/8 Value type is bool. Supported operations include Get, Add, Replace, and Delete. @@ -596,7 +598,7 @@ Value type is bool. Supported operations include Get, Add, Replace, and Delete. Profile example -``` syntax +```xml @@ -624,10 +626,10 @@ Profile example SplitTunnel - + .contoso.com 10.5.5.5 - + %ProgramFiles%\Internet Explorer\iexplore.exe @@ -655,244 +657,241 @@ Profile example AppTriggerList -``` syntax +```xml - - 10013 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/0/App/Id - - %PROGRAMFILES%\Internet Explorer\iexplore.exe - - - - 10014 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/1/App/Id - - %PROGRAMFILES% (x86)\Internet Explorer\iexplore.exe - - - - - 10015 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/2/App/Id - - Microsoft.MicrosoftEdge_8wekyb3d8bbwe - - + + 10013 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/0/App/Id + + %PROGRAMFILES%\Internet Explorer\iexplore.exe + + + + 10014 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/1/App/Id + + %PROGRAMFILES% (x86)\Internet Explorer\iexplore.exe + + + + + 10015 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/AppTriggerList/2/App/Id + + Microsoft.MicrosoftEdge_8wekyb3d8bbwe + + ``` RouteList and ExclusionRoute -``` syntax - - - 10008 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/Address - - 192.168.0.0 - - - - 10009 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/PrefixSize - - - int - - 24 - - - - 10010 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/ExclusionRoute - - - bool - - true - - - +```xml + + 10008 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/Address + + 192.168.0.0 + + + + 10009 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/PrefixSize + + + int + + 24 + + + + 10010 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/RouteList/0/ExclusionRoute + + + bool + + true + + ``` DomainNameInformationList -``` syntax - - - - 10013 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DomainName - - .contoso.com - - - - 10014 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DnsServers - - 192.168.0.11,192.168.0.12 - - - +```xml + + + 10013 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DomainName + + .contoso.com + + + + 10014 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/DnsServers + + 192.168.0.11,192.168.0.12 + + + - - 10013 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/DomainName - - .contoso.com - - - - - 10015 - - -./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/WebProxyServers - - 192.168.0.100:8888 - - - + + 10013 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/DomainName + + .contoso.com + + + + + 10015 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/WebProxyServers + + 192.168.0.100:8888 + + + - - - 10016 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DomainName - - finance.contoso.com - - - - 10017 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DnsServers - - 192.168.0.11,192.168.0.12 - - - + + + 10016 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DomainName + + finance.contoso.com + + + + 10017 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/2/DnsServers + + 192.168.0.11,192.168.0.12 + + + - - - 10016 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/DomainName - - finance.contoso.com - - - - 10017 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/WebProxyServers - - 192.168.0.11:8080 - - - + + + 10016 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/DomainName + + finance.contoso.com + + + + 10017 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/3/WebProxyServers + + 192.168.0.11:8080 + + + - - 10016 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DomainName - - . - - - - 10017 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DnsServers - - 192.168.0.11,192.168.0.12 - - - + + 10016 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DomainName + + . + + + + 10017 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/4/DnsServers + + 192.168.0.11,192.168.0.12 + + + - - - 10016 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/DomainName - - . - - - - 10017 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/WebProxyServers - - 192.168.0.11 - - + + + 10016 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/DomainName + + . + + + + 10017 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/5/WebProxyServers + + 192.168.0.11 + + ``` AutoTrigger -``` syntax +```xml - 10010 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/AutoTrigger - - - bool - - true - - + 10010 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/0/AutoTrigger + + + bool + + true + + ``` Persistent -``` syntax +```xml - 10010 - - - ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/Persistent - - - bool - - true - - + 10010 + + + ./Vendor/MSFT/VPNv2/VPNProfileName/DomainNameInformationList/1/Persistent + + + bool + + true + + ``` TrafficFilterLIst App -``` syntax +```xml Desktop App 10013 @@ -927,7 +926,7 @@ TrafficFilterLIst App Protocol, LocalPortRanges, RemotePortRanges, LocalAddressRanges, RemoteAddressRanges, RoutingPolicyType, EDPModeId, RememberCredentials, AlwaysOn, Lockdown, DnsSuffix, TrustedNetworkDetection -``` syntax +```xml Protocol $CmdID$ @@ -1075,7 +1074,7 @@ Protocol Proxy - Manual or AutoConfigUrl -``` syntax +```xml Manual $CmdID$ @@ -1101,7 +1100,7 @@ Manual Device Compliance - Sso -``` syntax +```xml Enabled 10011 @@ -1141,7 +1140,7 @@ Device Compliance - Sso PluginProfile -``` syntax +```xml PluginPackageFamilyName @@ -1179,7 +1178,7 @@ PluginPackageFamilyName NativeProfile -``` syntax +```xml Servers 10001 @@ -1314,9 +1313,9 @@ Servers [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/vpnv2-ddf-file.md b/windows/client-management/mdm/vpnv2-ddf-file.md index ffaae7d39e..aa531d9602 100644 --- a/windows/client-management/mdm/vpnv2-ddf-file.md +++ b/windows/client-management/mdm/vpnv2-ddf-file.md @@ -2,11 +2,13 @@ title: VPNv2 DDF file description: This topic shows the OMA DM device description framework (DDF) for the VPNv2 configuration service provider. ms.assetid: 4E2F36B7-D2EE-4F48-AD1A-6BDE7E72CC94 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is for Windows 10, version 1709. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/vpnv2-profile-xsd.md b/windows/client-management/mdm/vpnv2-profile-xsd.md index 87b64762f7..dd82298d1b 100644 --- a/windows/client-management/mdm/vpnv2-profile-xsd.md +++ b/windows/client-management/mdm/vpnv2-profile-xsd.md @@ -2,11 +2,13 @@ title: ProfileXML XSD description: Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some profile examples. ms.assetid: 2F32E14B-F9B9-4760-AE94-E57F1D4DFDB3 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 02/05/2018 --- @@ -18,10 +20,10 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro ## XSD for the VPN profile -``` syntax +```xml - + @@ -132,7 +134,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro - + @@ -342,7 +344,7 @@ Here's the XSD for the ProfileXML node in VPNv2 CSP for Windows 10 and some pro ## Plug-in profile example -``` syntax +```xml testserver1.contoso.com;testserver2.contoso..com diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md index 7ed090af21..e4c93ad525 100644 --- a/windows/client-management/mdm/w4-application-csp.md +++ b/windows/client-management/mdm/w4-application-csp.md @@ -2,11 +2,13 @@ title: w4 APPLICATION CSP description: w4 APPLICATION CSP ms.assetid: ef42b82a-1f04-49e4-8a48-bd4e439fc43a -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/w7-application-csp.md b/windows/client-management/mdm/w7-application-csp.md index 129f56db57..eff35b4fd4 100644 --- a/windows/client-management/mdm/w7-application-csp.md +++ b/windows/client-management/mdm/w7-application-csp.md @@ -2,11 +2,13 @@ title: w7 APPLICATION CSP description: w7 APPLICATION CSP ms.assetid: 10f8aa16-5c89-455d-adcd-d7fb45d4e768 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -158,7 +160,7 @@ Stores specifies which certificate stores the DM client will search to find the Subject specifies the certificate to search for. For example, to specify that you want a certificate with a particular Subject attribute (“CN=Tester,O=Microsoft”), use the following: -``` syntax +```xml ``` diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index d19d79eaec..79992abc08 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -2,12 +2,14 @@ title: WiFi CSP description: WiFi CSP ms.assetid: f927cb5f-9555-4029-838b-03fb68937f06 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque -ms.date: 10/24/2018 +author: manikadhiman +ms.date: 06/18/2019 --- # WiFi CSP @@ -23,7 +25,7 @@ Programming considerations: - Because the Windows 10 Mobile emulator does not support Wi-Fi, you cannot test the Wi-Fi configuration with an emulator. You can still provision a Wi-Fi network using the WiFi CSP, then check it in the Wi-Fi settings page, but you cannot test the network connectivity in the emulator. - For WEP, WPA, and WPA2-based networks, include the passkey in the network configuration in plaintext. The passkey is encrypted automatically when it is stored on the device. - The SSID of the Wi-Fi network part of the LocURI node must be a valid URI based on RFC 2396. This requires that all non-ASCII characters must be escaped using a %-character. Unicode characters without the necessary escaping are not supported. -- The *name\_goes\_here* must match *name\_goes\_here*. +- The \*name\_goes\_here*\\ must match \\ *name\_goes\_here*\\. - For the WiFi CSP, you cannot use the Replace command unless the node already exists. - Using Proxyis only supported in Windows 10 Mobile. Using this configuration in Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) will result in failure. @@ -41,10 +43,10 @@ Identifies the Wi-Fi network configuration. Each Wi-Fi network configuration is Supported operation is Get. -****** +**\** Specifies the name of the Wi-Fi network (32 bytes maximum) to create, configure, query, or delete. The name is case sensitive and can be represented in ASCII. The SSID is added when the WlanXML node is added. When the SSID node is deleted, then all the subnodes are also deleted. -SSID is the name of network you are connecting to, while Profile name is the name of the Profile which contains the WiFi settings information. If the Profile name is not set right in the MDM SyncML, as per the information in the WiFi settings XML, it could lead to some unexpected errors. For example, ./Vendor/MSFT/WiFi/Profile/<*MUST BE NAME OF PROFILE AS PER WIFI XML*>/WlanXml. +SSID is the name of network you are connecting to, while Profile name is the name of the Profile which contains the WiFi settings information. If the Profile name is not set right in the MDM SyncML, as per the information in the WiFi settings XML, it could lead to some unexpected errors. For example, \./Vendor/MSFT/WiFi/Profile/<*MUST BE NAME OF PROFILE AS PER WIFI XML*>/WlanXml\. The supported operations are Add, Get, Delete, and Replace. @@ -77,7 +79,10 @@ If it is an IPvFuture address, then it must be specified as an IP literal as "\[ Supported operations are Get, Add, Delete, and Replace. **DisableInternetConnectivityChecks** -Added in Windows 10, version 1511.Optional. Disable the internet connectivity check for the profile. +> [!Note] +> This node has been deprecated since Windows 10, version 1607. + +Added in Windows 10, version 1511. Optional. Disable the internet connectivity check for the profile. Value type is chr. @@ -116,7 +121,7 @@ These XML examples show how to perform various tasks using OMA DM. The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwork,' a proxy URL 'testproxy,' and port 80. -``` syntax +```xml @@ -155,7 +160,7 @@ The following example shows how to add PEAP-MSCHAPv2 network with SSID 'MyNetwor The following example shows how to query Wi-Fi profiles installed on an MDM server. -``` syntax +```xml 301 @@ -168,7 +173,7 @@ The following example shows how to query Wi-Fi profiles installed on an MDM serv The following example shows the response. -``` syntax +```xml 3 1 @@ -185,17 +190,17 @@ The following example shows the response. The following example shows how to remove a network with SSID ‘MyNetwork’ and no proxy. Removing all network authentication types is done in this same manner. -``` syntax +```xml - 300 - - 301 - - - ./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml - - - + 300 + + 301 + + + ./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml + + + ``` @@ -203,21 +208,21 @@ The following example shows how to remove a network with SSID ‘MyNetwork’ an The following example shows how to add PEAP-MSCHAPv2 network with SSID ‘MyNetwork’ and root CA validation for server certificate. -``` syntax +```xml - 300 - - 301 - - - ./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml - - - chr - - MyNetworkMyNetworkfalseESSmanualWPA2AEStrueuser2500025true InsertCertThumbPrintHere truefalse26falsefalsefalsetruefalse - - + 300 + + 301 + + + ./Vendor/MSFT/WiFi/Profile/MyNetwork/WlanXml + + + chr + + MyNetworkMyNetworkfalseESSmanualWPA2AEStrueuser2500025true InsertCertThumbPrintHere truefalse26falsefalsefalsetruefalse + + ``` @@ -226,9 +231,9 @@ The following example shows how to add PEAP-MSCHAPv2 network with SSID ‘MyNetw [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/wifi-ddf-file.md b/windows/client-management/mdm/wifi-ddf-file.md index 71a6c46d45..2c51e50a62 100644 --- a/windows/client-management/mdm/wifi-ddf-file.md +++ b/windows/client-management/mdm/wifi-ddf-file.md @@ -2,11 +2,13 @@ title: WiFi DDF file description: WiFi DDF file ms.assetid: 00DE1DA7-23DE-4871-B3F0-28EB29A62D61 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/28/2018 --- @@ -19,7 +21,7 @@ This topic shows the OMA DM device description framework (DDF) for the **WiFi** The XML below is for Windows 10, version 1809. -``` syntax +```xml XML describing the network configuration and follows Windows WLAN_profile schema. - Link to schema: http://msdn.microsoft.com/library/windows/desktop/ms707341(v=vs.85).aspx + Link to schema: https://msdn.microsoft.com/library/windows/desktop/ms707341(v=vs.85).aspx diff --git a/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md b/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md index 543252e8f2..7b4f4424be 100644 --- a/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md +++ b/windows/client-management/mdm/win32-and-centennial-app-policy-configuration.md @@ -1,12 +1,14 @@ --- title: Win32 and Desktop Bridge app policy configuration description: Starting in Windows 10, version 1703, you can import ADMX files and set those ADMX-backed policies for Win32 and Desktop Bridge apps. -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 +ms.reviewer: +manager: dansimp --- # Win32 and Desktop Bridge app policy configuration @@ -23,7 +25,13 @@ ms.date: 06/26/2017 ## Overview -Starting in Windows 10, version 1703, you can import ADMX files (also called ADMX ingestion) and set those ADMX-backed policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies. +Starting in Windows 10, version 1703, you can import ADMX files (also called ADMX ingestion) and set those ADMX-backed policies for Win32 and Desktop Bridge apps by using Windows 10 Mobile Device Management (MDM) on desktop SKUs. The ADMX files that define policy information can be ingested to your device by using the Policy CSP URI, `./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall`. The ingested ADMX file is then processed into MDM policies. + +NOTE: Starting from the following Windows 10 version Replace command is supported +- Windows 10, version 1903 with KB4512941 and KB4517211 installed +- Windows 10, version 1809 with KB4512534 and KB installed +- Windows 10, version 1803 with KB4512509 and KB installed +- Windows 10, version 1709 with KB4516071 and KB installed When the ADMX policies are imported, the registry keys to which each policy is written are checked so that known system registry keys, or registry keys that are used by existing inbox policies or system components, are not overwritten. This precaution helps to avoid security concerns over opening the entire registry. Currently, the ingested policies are not allowed to write to locations within the **System**, **Software\Microsoft**, and **Software\Policies\Microsoft** keys, except for the following locations: @@ -46,10 +54,15 @@ When the ADMX policies are imported, the registry keys to which each policy is w - software\microsoft\exchange\ - software\policies\microsoft\vba\security\ - software\microsoft\onedrive +- software\Microsoft\Edge +- Software\Microsoft\EdgeUpdate\ > [!Warning] > Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined. +> [!NOTE] +> Settings that cannot be configured using custom policy ingestion have to be set by pushing the appropriate registry keys directly (for example, by using PowerShell script). + ## Ingesting an app ADMX file The following ADMX file example shows how to ingest a Win32 or Desktop Bridge app ADMX file and set policies from the file. The ADMX file defines eight policies. @@ -394,10 +407,10 @@ The policy {AreaName} format is {AppName}~{SettingType}~{CategoryPathFromAdmx}. {CategoryPathFromAdmx} is derived by traversing the parentCategory parameter. In this example, {CategoryPathFromAdmx} is ParentCategoryArea~Category2~Category3. Therefore, {AreaName} is ContosoCompanyApp~ Policy~ ParentCategoryArea~Category2~Category3. Therefore, from the example: - - Class: User - - Policy name: L_PolicyPreventRun_1 - - Policy area name: ContosoCompanyApp~Policy~ParentCategoryArea~Category2~Category3 - - URI: `./user/Vendor/MSFT/Policy/Config/ContosoCompanyApp~Policy~ParentCategoryArea~Category2~Category3/L_PolicyPreventRun_1` +- Class: User +- Policy name: L_PolicyPreventRun_1 +- Policy area name: ContosoCompanyApp~Policy~ParentCategoryArea~Category2~Category3 +- URI: `./user/Vendor/MSFT/Policy/Config/ContosoCompanyApp~Policy~ParentCategoryArea~Category2~Category3/L_PolicyPreventRun_1` ## ADMX-backed app policy examples diff --git a/windows/client-management/mdm/win32appinventory-csp.md b/windows/client-management/mdm/win32appinventory-csp.md index b7431d69f0..abcbb92914 100644 --- a/windows/client-management/mdm/win32appinventory-csp.md +++ b/windows/client-management/mdm/win32appinventory-csp.md @@ -2,11 +2,13 @@ title: Win32AppInventory CSP description: Win32AppInventory CSP ms.assetid: C0DEDD51-4EAD-4F8E-AEE2-CBE9658BCA22 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -29,30 +31,30 @@ This represents an inventory of installed Win32 applications on the device. The supported operation is Get. -**Win32InstalledProgram/***InstalledProgram* +**Win32InstalledProgram/**InstalledProgram A node that contains information for a specific application. -**Win32InstalledProgram/***InstalledProgram***/Name** +**Win32InstalledProgram/**InstalledProgram**/Name** A string that specifies the name of the application. The supported operation is Get. -**Win32InstalledProgram/***InstalledProgram***/Publisher** +**Win32InstalledProgram/**InstalledProgram**/Publisher** A string that specifies the publisher of the application. The supported operation is Get. -**Win32InstalledProgram/***InstalledProgram***/Version** +**Win32InstalledProgram/**InstalledProgram**/Version** A string that specifies the version of the application. The supported operation is Get. -**Win32InstalledProgram/***InstalledProgram***/Language** +**Win32InstalledProgram/**InstalledProgram**/Language** A string that specifies the language of the application. The supported operation is Get. -**Win32InstalledProgram/***InstalledProgram***/RegKey** +**Win32InstalledProgram/**InstalledProgram**/RegKey** A string that specifies product code or registry subkey. For MSI-based applications this is the product code. @@ -61,17 +63,17 @@ For applications found in Add/Remove Programs, this is the registry subkey. The supported operation is Get. -**Win32InstalledProgram/***InstalledProgram***/Source** +**Win32InstalledProgram/**InstalledProgram**/Source** A string that specifies where the application was discovered, such as MSI or Add/Remove Programs. The supported operation is Get. -**Win32InstalledProgram/***InstalledProgram***/MsiProductCode** +**Win32InstalledProgram/**InstalledProgram**/MsiProductCode** A GUID that uniquely identifies a particular MSI product. The supported operation is Get. -**Win32InstalledProgram/***InstalledProgram***/MsiPackageCode** +**Win32InstalledProgram/**InstalledProgram**/MsiPackageCode** A GUID that identifies an MSI package. Multiple products can make up a single package. The supported operation is Get. @@ -81,9 +83,9 @@ The supported operation is Get. [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/win32appinventory-ddf-file.md b/windows/client-management/mdm/win32appinventory-ddf-file.md index 9521871934..8757e65d3b 100644 --- a/windows/client-management/mdm/win32appinventory-ddf-file.md +++ b/windows/client-management/mdm/win32appinventory-ddf-file.md @@ -2,11 +2,13 @@ title: Win32AppInventory DDF file description: Win32AppInventory DDF file ms.assetid: F6BCC10B-BFE4-40AB-AEEE-34679A4E15B0 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml [!WARNING] > Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. @@ -612,4 +614,4 @@ For the report XML schema, see [Windows Error Reporting connection report](#wind -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/win32compatibilityappraiser-ddf.md b/windows/client-management/mdm/win32compatibilityappraiser-ddf.md index 1b6e03919f..ce4b0b3bf3 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-ddf.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-ddf.md @@ -1,12 +1,14 @@ --- title: Win32CompatibilityAppraiser DDF file -description: XML file containing the device description framework -ms.author: maricia +description: XML file containing the device description framework for the Win32CompatibilityAppraiser configuration service provider. +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 07/19/2018 +ms.reviewer: +manager: dansimp --- # Win32CompatibilityAppraiser DDF file @@ -20,7 +22,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is for Windows 10, version 1809. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/windows-mdm-enterprise-settings.md b/windows/client-management/mdm/windows-mdm-enterprise-settings.md index c33b128242..a8be6bba9c 100644 --- a/windows/client-management/mdm/windows-mdm-enterprise-settings.md +++ b/windows/client-management/mdm/windows-mdm-enterprise-settings.md @@ -1,15 +1,17 @@ --- title: Enterprise settings, policies, and app management -description: The actual management interaction between the device and server is done via the DM client. The DM client communicates with the enterprise management server via DM v1.2 SyncML syntax. +description: The DM client manages the interaction between a device and a server. Learn more about the client-server management workflow. MS-HAID: - 'p\_phdevicemgmt.enterprise\_settings\_\_policies\_\_and\_app\_management' - 'p\_phDeviceMgmt.windows\_mdm\_enterprise\_settings' ms.assetid: 92711D65-3022-4789-924B-602BE3187E23 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index 642dc9ac95..2508fa2863 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -2,11 +2,13 @@ title: WindowsAdvancedThreatProtection CSP description: WindowsAdvancedThreatProtection CSP ms.assetid: 6C3054CA-9890-4C08-9DB6-FBEEB74699A8 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 11/01/2017 --- @@ -118,7 +120,7 @@ The following list describes the characteristics and parameters. ## Examples -``` syntax +```xml @@ -231,9 +233,9 @@ The following list describes the characteristics and parameters. [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md index eee40a5341..583ea67e75 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-ddf.md @@ -2,11 +2,13 @@ title: WindowsAdvancedThreatProtection DDF file description: WindowsAdvancedThreatProtection DDF file ms.assetid: 0C62A790-4351-48AF-89FD-7D46C42D13E0 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml **Settings/AllowWindowsDefenderApplicationGuard** Turn on Windows Defender Application Guard in Enterprise Mode. Value type is integer. Supported operations are Add, Get, Replace, and Delete. - - - 0 - Stops Application Guard in Enterprise Mode. Trying to access non-enterprise domains on the host will not automatically get transferred into the insolated environment. - - 1 - Enables Application Guard in Enterprise Mode. Trying to access non-enterprise websites on the host will automatically get transferred into the container. + +- 0 - Stops Application Guard in Enterprise Mode. Trying to access non-enterprise domains on the host will not automatically get transferred into the insolated environment. +- 1 - Enables Application Guard in Enterprise Mode. Trying to access non-enterprise websites on the host will automatically get transferred into the container. **Settings/ClipboardFileType** Determines the type of content that can be copied from the host to Application Guard environment and vice versa. Value type is integer. Supported operations are Add, Get, Replace, and Delete. @@ -48,7 +50,7 @@ This policy setting allows you to decide how the clipboard behaves while in Appl - 2 - Turns On clipboard operation from the host to an isolated session - 3 - Turns On clipboard operation in both the directions -> [!Important] +> [!IMPORTANT] > Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended. **Settings/PrintingSettings** @@ -126,7 +128,7 @@ If you enable this policy, applications inside Windows Defender Application Guar If you disable or don't configure this policy, applications inside Windows Defender Application Guard will be unable to access the camera and microphone on the user’s device. -> [!Important] +> [!IMPORTANT] > If you turn on this policy, a compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge. To prevent unauthorized access, we recommend that camera and microphone privacy settings be turned off on the user's device when they are not needed. **Status** diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md index eff9174d89..6b319f1404 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md @@ -1,12 +1,14 @@ --- title: WindowsDefenderApplicationGuard DDF file description: WindowsDefenderApplicationGuard DDF file -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 09/10/2018 +ms.reviewer: +manager: dansimp --- # WindowsDefenderApplicationGuard DDF file @@ -478,4 +480,4 @@ This XML is for Windows 10, version 1809. -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/windowslicensing-csp.md b/windows/client-management/mdm/windowslicensing-csp.md index e9ec81150e..58a5040b72 100644 --- a/windows/client-management/mdm/windowslicensing-csp.md +++ b/windows/client-management/mdm/windowslicensing-csp.md @@ -2,11 +2,13 @@ title: WindowsLicensing CSP description: WindowsLicensing CSP ms.assetid: E6BC6B0D-1F16-48A5-9AC4-76D69A7EDDA6 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 08/15/2018 --- @@ -29,10 +31,10 @@ The supported operation is Get. **UpgradeEditionWithProductKey** Enters a product key for an edition upgrade of Windows 10 desktop devices. -> [!NOTE]   +> [!NOTE] > This upgrade process requires a system restart. -  + The date type is a chr. @@ -42,10 +44,10 @@ When a product key is pushed from an MDM server to a user's device, **changepk.e After the device restarts, the edition upgrade process completes. The user will receive a notification of the successful upgrade. -> [!IMPORTANT]   +> [!IMPORTANT] > If another policy requires a system reboot that occurs when **changepk.exe** is running, the edition upgrade will fail. -  + If a product key is entered in a provisioning package and the user begins installation of the package, a notification is shown to the user that their system will restart to complete the package installation. Upon explicit consent from the user to proceed, the package continues installation and **changepk.exe** runs using the product key. The user will receive a reminder notification 30 seconds before the automatic restart. @@ -53,10 +55,10 @@ After the device restarts, the edition upgrade process completes. The user will This node can also be used to activate or change a product key on a particular edition of Windows 10 desktop device by entering a product key. Activation or changing a product key does not require a reboot and is a silent process for the user. -> [!IMPORTANT]   +> [!IMPORTANT] > The product key entered must be 29 characters (that is, it should include dashes), otherwise the activation, edition upgrade, or product key change on Windows 10 desktop devices will fail. The product key is acquired from Microsoft Volume Licensing Service Center. Your organization must have a Volume Licensing contract with Microsoft to access the portal. -  + The following are valid edition upgrade paths when using this node through an MDM: @@ -95,19 +97,19 @@ The supported operation is Get. **UpgradeEditionWithLicense** Provides a license for an edition upgrade of Windows 10 mobile devices. -> [!NOTE]   +> [!NOTE] > This upgrade process does not require a system restart. -  + The date type is XML. The supported operation is Execute. -> [!IMPORTANT]   +> [!IMPORTANT] > The XML license file contents must be properly escaped (that is, it should not simply be a copied XML), otherwise the edition upgrade on Windows 10 mobile devices will fail. For more information on proper escaping of the XML license file, see Section 2.4 of the [W3C XML spec](http://www.w3.org/TR/xml/) . The XML license file is acquired from the Microsoft Volume Licensing Service Center. Your organization must have a Volume Licensing contract with Microsoft to access the portal. -  + The following are valid edition upgrade paths when using this node through an MDM or provisioning package: @@ -194,7 +196,7 @@ Values: **CheckApplicability** -``` syntax +```xml @@ -214,14 +216,14 @@ Values: ``` -> [!NOTE]   +> [!NOTE] > `XXXXX-XXXXX-XXXXX-XXXXX-XXXXX` in the **Data** tag should be replaced with your product key. -  + **Edition** -``` syntax +```xml @@ -239,7 +241,7 @@ Values: **LicenseKeyType** -``` syntax +```xml @@ -257,7 +259,7 @@ Values: **Status** -``` syntax +```xml @@ -275,7 +277,7 @@ Values: **UpgradeEditionWithProductKey** -``` syntax +```xml @@ -295,14 +297,14 @@ Values: ``` -> [!NOTE]   +> [!NOTE] > `XXXXX-XXXXX-XXXXX-XXXXX-XXXXX` in the **Data** tag should be replaced with your product key. -  + **UpgradeEditionWithLicense** -``` syntax +```xml @@ -461,9 +463,9 @@ Values: [Configuration service provider reference](configuration-service-provider-reference.md) -  + -  + diff --git a/windows/client-management/mdm/windowslicensing-ddf-file.md b/windows/client-management/mdm/windowslicensing-ddf-file.md index c96286763c..c5037971d9 100644 --- a/windows/client-management/mdm/windowslicensing-ddf-file.md +++ b/windows/client-management/mdm/windowslicensing-ddf-file.md @@ -2,11 +2,13 @@ title: WindowsLicensing DDF file description: WindowsLicensing DDF file ms.assetid: 2A24C922-A167-4CEE-8F74-08E7453800D2 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 07/16/2017 --- @@ -21,7 +23,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is for Windows 10, version 1809. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/windowssecurityauditing-csp.md b/windows/client-management/mdm/windowssecurityauditing-csp.md index c7ebdf2171..ffd68aa965 100644 --- a/windows/client-management/mdm/windowssecurityauditing-csp.md +++ b/windows/client-management/mdm/windowssecurityauditing-csp.md @@ -2,18 +2,20 @@ title: WindowsSecurityAuditing CSP description: The WindowsSecurityAuditing configuration service provider (CSP) is used to enable logging of security audit events. This CSP was added in Windows 10, version 1511. ms.assetid: 611DF7FF-21CE-476C-AAB5-3D09C1CDF08A -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- # WindowsSecurityAuditing CSP -The WindowsSecurityAuditing configuration service provider (CSP) is used to enable logging of security audit events. This CSP was added in Windows 10, version 1511. +The WindowsSecurityAuditing configuration service provider (CSP) is used to enable logging of security audit events. This CSP was added in Windows 10, version 1511 for Mobile and Mobile Enterprise. Make sure to consult the [Configuration service provider reference](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference) to see if this CSP and others are supported on your Windows installation. The following diagram shows the WindowsSecurityAuditing configuration service provider in tree format. @@ -37,7 +39,7 @@ Supported operations are Get and Replace. Enable logging of audit events. -``` syntax +```xml diff --git a/windows/client-management/mdm/windowssecurityauditing-ddf-file.md b/windows/client-management/mdm/windowssecurityauditing-ddf-file.md index 666177f587..c4710fae63 100644 --- a/windows/client-management/mdm/windowssecurityauditing-ddf-file.md +++ b/windows/client-management/mdm/windowssecurityauditing-ddf-file.md @@ -1,12 +1,14 @@ --- title: WindowsSecurityAuditing DDF file -description: This topic shows the OMA DM device description framework (DDF) for the WindowsSecurityAuditing configuration service provider. This CSP was added in Windows 10, version 1511. +description: View the OMA DM device description framework (DDF) for the WindowsSecurityAuditing configuration service provider. ms.assetid: B1F9A5FA-185B-48C6-A7F4-0F0F23B971F0 -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 12/05/2017 --- @@ -19,7 +21,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml **EnableBlockPeriod** Optional. Enable block period (minutes), used to specify the duration for which automatic authentication attempts will be blocked from occurring after a failed authentication attempt. -Supported operations are Add, Get, Replace, and Delete. Value type is integer. \ No newline at end of file +Supported operations are Add, Get, Replace, and Delete. Value type is integer. diff --git a/windows/client-management/mdm/wirednetwork-ddf-file.md b/windows/client-management/mdm/wirednetwork-ddf-file.md index 1fbdc8f4c3..6ca631d6fe 100644 --- a/windows/client-management/mdm/wirednetwork-ddf-file.md +++ b/windows/client-management/mdm/wirednetwork-ddf-file.md @@ -1,12 +1,14 @@ --- title: WiredNetwork DDF file description: This topic shows the OMA DM device description framework (DDF) for the WiredNetwork configuration service provider. -ms.author: maricia +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/28/2018 +ms.reviewer: +manager: dansimp --- # WiredNetwork DDF file @@ -18,7 +20,7 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. -``` syntax +```xml -``` \ No newline at end of file +``` diff --git a/windows/client-management/mdm/wmi-providers-supported-in-windows.md b/windows/client-management/mdm/wmi-providers-supported-in-windows.md index 55704baa15..914c39c364 100644 --- a/windows/client-management/mdm/wmi-providers-supported-in-windows.md +++ b/windows/client-management/mdm/wmi-providers-supported-in-windows.md @@ -5,11 +5,13 @@ MS-HAID: - 'p\_phdevicemgmt.wmi\_providers\_supported\_in\_windows\_10\_technical\_preview' - 'p\_phDeviceMgmt.wmi\_providers\_supported\_in\_windows' ms.assetid: 7D533044-AAD7-4B8F-B71B-9D52C15A168A -ms.author: maricia +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: MariciaAlforque +author: manikadhiman ms.date: 06/26/2017 --- @@ -19,13 +21,13 @@ Windows Management Infrastructure (WMI) providers (and the classes they support) > **Note**  Applications installed using WMI classes are not removed when the MDM account is removed from device. -  + The child node names of the result from a WMI query are separated by a forward slash (/) and not URI escaped. Here is an example query. Get the list of network adapters from the device. -``` syntax +```xml ./cimV2/Win32_NetworkAdapter @@ -35,7 +37,7 @@ Get the list of network adapters from the device. Result -``` syntax +```xml ./cimV2/Win32_NetworkAdapter @@ -67,55 +69,55 @@ For links to these classes, see [**MDM Bridge WMI Provider**](https://msdn.micro -[MDM_AppInstallJob](https://msdn.microsoft.com/library/windows/hardware/dn610368) +MDM_AppInstallJob

                            Currently testing.

                            -[MDM_Application](https://msdn.microsoft.com/library/windows/hardware/dn610369) +MDM_Application

                            Currently testing.

                            -[MDM_ApplicationFramework](https://msdn.microsoft.com/library/windows/hardware/dn610370) +MDM_ApplicationFramework

                            Currently testing.

                            -[MDM_ApplicationSetting](https://msdn.microsoft.com/library/windows/hardware/dn610382) +MDM_ApplicationSetting

                            Currently testing.

                            -[MDM_BrowserSecurityZones](https://msdn.microsoft.com/library/windows/hardware/dn610383) +MDM_BrowserSecurityZones cross mark -[MDM_BrowserSettings](https://msdn.microsoft.com/library/windows/hardware/dn610384) +MDM_BrowserSettings cross mark -[MDM_Certificate](https://msdn.microsoft.com/library/windows/hardware/dn610385) +MDM_Certificate cross mark -[MDM_CertificateEnrollment](https://msdn.microsoft.com/library/windows/hardware/dn610386) +MDM_CertificateEnrollment cross mark -[MDM_Client](https://msdn.microsoft.com/library/windows/hardware/dn610387) +MDM_Client

                            Currently testing.

                            -[MDM_ConfigSetting](https://msdn.microsoft.com/library/windows/hardware/dn610388) +MDM_ConfigSetting cross mark -[MDM_DeviceRegistrationInfo](https://msdn.microsoft.com/library/windows/hardware/dn610389) +MDM_DeviceRegistrationInfo -[MDM_EASPolicy](https://msdn.microsoft.com/library/windows/hardware/dn610390) +MDM_EASPolicy cross mark -[MDM_MgMtAuthority](https://msdn.microsoft.com/library/windows/hardware/dn610391) +MDM_MgMtAuthority cross mark @@ -127,39 +129,39 @@ For links to these classes, see [**MDM Bridge WMI Provider**](https://msdn.micro -[MDM_RemoteApplication](https://msdn.microsoft.com/library/windows/hardware/dn610371) +MDM_RemoteApplication

                            Test not started.

                            -[MDM_RemoteAppUseCookie](https://msdn.microsoft.com/library/windows/hardware/dn610372) +MDM_RemoteAppUseCookie

                            Test not started.

                            -[MDM_Restrictions](https://msdn.microsoft.com/library/windows/hardware/dn610392) +MDM_Restrictions cross mark -[MDM_RestrictionsUser](https://msdn.microsoft.com/library/windows/hardware/dn610393) +MDM_RestrictionsUser

                            Test not started.

                            -[MDM_SecurityStatus](https://msdn.microsoft.com/library/windows/hardware/dn610394) +MDM_SecurityStatus cross mark -[MDM_SideLoader](https://msdn.microsoft.com/library/windows/hardware/dn610395) +MDM_SideLoader -[MDM_SecurityStatusUser](https://msdn.microsoft.com/library/windows/hardware/dn920104) +MDM_SecurityStatusUser

                            Currently testing.

                            -[MDM_Updates](https://msdn.microsoft.com/library/windows/hardware/dn920105) +MDM_Updates cross mark -[MDM_VpnApplicationTrigger](https://msdn.microsoft.com/library/windows/hardware/dn610396) +MDM_VpnApplicationTrigger cross mark @@ -167,45 +169,45 @@ For links to these classes, see [**MDM Bridge WMI Provider**](https://msdn.micro -[MDM_WebApplication](https://msdn.microsoft.com/library/windows/hardware/dn610373) +MDM_WebApplication

                            Currently testing.

                            -[MDM_WirelessProfile](https://msdn.microsoft.com/library/windows/hardware/dn610397) +MDM_WirelessProfile cross mark -[MDM_WirelesssProfileXML](https://msdn.microsoft.com/library/windows/hardware/dn610398) +MDM_WirelesssProfileXML cross mark -[MDM_WNSChannel](https://msdn.microsoft.com/library/windows/hardware/dn610399) +MDM_WNSChannel cross mark -[MDM_WNSConfiguration](https://msdn.microsoft.com/library/windows/hardware/dn610400) +MDM_WNSConfiguration cross mark -[MSFT_NetFirewallProfile](https://msdn.microsoft.com/library/windows/hardware/jj676842) +MSFT_NetFirewallProfile cross mark -[MSFT_VpnConnection](https://msdn.microsoft.com/library/windows/hardware/jj206647) +MSFT_VpnConnection cross mark -[SoftwareLicensingProduct](https://msdn.microsoft.com/library/windows/hardware/cc534596) +SoftwareLicensingProduct -[SoftwareLicensingService](https://msdn.microsoft.com/library/windows/hardware/cc534597) +SoftwareLicensingService -  + ### Parental control WMI classes @@ -222,7 +224,7 @@ For links to these classes, see [**MDM Bridge WMI Provider**](https://msdn.micro | [**wpcusersettings**](https://msdn.microsoft.com/library/windows/hardware/ms711334) | ![cross mark](images/checkmark.png) | | [**wpcwebsettings**](https://msdn.microsoft.com/library/windows/hardware/ms711334) | ![cross mark](images/checkmark.png) | -  + ### Win32 WMI classes @@ -294,21 +296,13 @@ For links to these classes, see [**MDM Bridge WMI Provider**](https://msdn.micro [**Win32\_UninterruptiblePowerSupply**](https://msdn.microsoft.com/library/windows/hardware/aa394503) | [**Win32\_USBController**](https://msdn.microsoft.com/library/windows/hardware/aa394504) | [**Win32\_UTCTime**](https://msdn.microsoft.com/library/windows/hardware/aa394510) | ![cross mark](images/checkmark.png) -[**Win32\_VideoController**](https://msdn.microsoft.com/library/windows/hardware/aa394505) | +[**Win32\_VideoController**](https://docs.microsoft.com/windows/win32/cimwin32prov/win32-videocontroller) | **Win32\_WindowsUpdateAgentVersion** | -  + ## Related topics - [Configuration service provider reference](configuration-service-provider-reference.md) -  - -  - -10/10/2016 - - - - +## Related Links +[CIM Video Controller](https://docs.microsoft.com/windows/win32/cimwin32prov/cim-videocontroller) diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/new-policies-for-windows-10.md index 7d77e94d7d..da5cc3e5c8 100644 --- a/windows/client-management/new-policies-for-windows-10.md +++ b/windows/client-management/new-policies-for-windows-10.md @@ -2,11 +2,14 @@ title: New policies for Windows 10 (Windows 10) description: Windows 10 includes the following new policies for management. ms.assetid: 1F24ABD8-A57A-45EA-BA54-2DA2238C573D +ms.reviewer: +manager: dansimp +ms.author: dansimp keywords: ["MDM", "Group Policy"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 10/24/2017 ms.topic: reference @@ -20,7 +23,233 @@ ms.topic: reference - Windows 10 - Windows 10 Mobile -Windows 10 includes the following new policies for management. [Download the complete set of Administrative Template (.admx) files for Windows 10](https://www.microsoft.com/download/details.aspx?id=56121). +Windows 10 includes the following new policies for management. [Download the complete set of Administrative Template (.admx) files for Windows 10](https://www.microsoft.com/download/100591). + + +## New Group Policy settings in Windows 10, version 1809 + +The following Group Policy settings were added in Windows 10, version 1809: + +**Start Menu and Taskbar** + +- Start Menu and Taskbar\Force Start to be either full screen size or menu size +- Start Menu and Taskbar\Remove "Recently added" list from Start Menu +- Start Menu and Taskbar\Remove All Programs list from the Start menu +- Start Menu and Taskbar\Remove frequent programs list from the Start Menu + +**System** + +- System\Group Policy\Allow asynchronous user Group Policy processing when logging on through Remote Desktop Services +- System\Group Policy\Configure Applications preference extension policy processing +- System\Group Policy\Configure Data Sources preference extension policy processing +- System\Group Policy\Configure Devices preference extension policy processing +- System\Group Policy\Configure Drive Maps preference extension policy processing +- System\Group Policy\Configure Environment preference extension policy processing +- System\Group Policy\Configure Files preference extension policy processing +- System\Group Policy\Configure Folder Options preference extension policy processing +- System\Group Policy\Configure Folders preference extension policy processing +- System\Group Policy\Configure Ini Files preference extension policy processing +- System\Group Policy\Configure Internet Settings preference extension policy processing +- System\Group Policy\Configure Local Users and Groups preference extension policy processing +- System\Group Policy\Configure Network Options preference extension policy processing +- System\Group Policy\Configure Network Shares preference extension policy processing +- System\Group Policy\Configure Power Options preference extension policy processing +- System\Group Policy\Configure Printers preference extension policy processing +- System\Group Policy\Configure Regional Options preference extension policy processing +- System\Group Policy\Configure Registry preference extension policy processing +- System\Group Policy\Configure Scheduled Tasks preference extension policy processing +- System\Group Policy\Configure Services preference extension policy processing +- System\Group Policy\Configure Shortcuts preference extension policy processing +- System\Group Policy\Configure Start Menu preference extension policy processing +- System\Group Policy\Logging and tracing\Configure Applications preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Data Sources preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Devices preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Drive Maps preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Environment preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Files preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Folder Options preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Folders preference logging and tracing +- System\Group Policy\Logging and tracing\Configure INI Files preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Internet Settings preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Local Users and Groups preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Network Options preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Network Shares preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Power Options preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Printers preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Regional Options preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Registry preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Scheduled Tasks preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Services preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Shortcuts preference logging and tracing +- System\Group Policy\Logging and tracing\Configure Start Menu preference logging and tracing +- System\Kernel DMA Protection\Enumeration policy for external devices incompatible with Kernel DMA Protection +- System\OS Policies\Allow Clipboard History +- System\OS Policies\Allow Clipboard synchronization across devices + +**Windows Components** + +- Windows Components\Data Collection and Preview Builds\Configure Microsoft 365 Update Readiness upload endpoint +- Windows Components\Data Collection and Preview Builds\Disable deleting diagnostic data +- Windows Components\Data Collection and Preview Builds\Disable diagnostic data viewer +- Windows Components\Delivery Optimization\[Reserved for future use] Cache Server Hostname +- Windows Components\Location and Sensors\Windows Location Provider\Turn off Windows Location Provider +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\DFS Management +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\File Server Resource Manager +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Share and Storage Management +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Storage Manager for SANs +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\DFS Management Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\Disk Management Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\File Server Resource Manager Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\Share and Storage Management Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins\Storage Manager for SANS Extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy Management Editor +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy Starter GPO Editor +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Application snap-ins +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Applications preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Control Panel Settings (Computers) +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Control Panel Settings (Users) +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Data Sources preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Devices preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Drive Maps preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Environment preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Files preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Folder Options preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Folders preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Ini Files preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Internet Settings preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Local Users and Groups preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Network Options preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Network Shares preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Power Options preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Preferences tab +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Printers preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Regional Options preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Registry preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Scheduled Tasks preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Services preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Shortcuts preference extension +- Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Preference snap-in extensions\Permit use of Start Menu preference extension +- Windows Components\OOBE\Don't launch privacy settings experience on user logon +- Windows Components\OOBE\Don't launch privacy settings experience on user logon +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Do not use Remote Desktop Session Host server IP address when virtual IP address is not available +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Select the network adapter to be used for Remote Desktop IP Virtualization +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Turn off Windows Installer RDS Compatibility +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Application Compatibility\Turn on Remote Desktop IP Virtualization +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Allow remote start of unlisted programs +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Connections\Turn off Fair Share CPU Scheduling +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Allow time zone redirection +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Do not allow Clipboard redirection +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection\Redirect only the default client printer +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Printer Redirection\Redirect only the default client printer +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\RD Connection Broker\Use RD Connection Broker load balancing +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Allow desktop composition for remote desktop sessions +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Always show desktop on connection +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Do not allow font smoothing +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Remove remote desktop wallpaper +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for logoff of RemoteApp sessions +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for logoff of RemoteApp sessions +- Windows Components\Windows Defender Antivirus\Configure detection for potentially unwanted applications +- Windows Components\Windows Defender Antivirus\Scan\Configure low CPU priority for scheduled scans +- Windows Components\Windows Defender Application Guard\Allow camera and microphone access in Windows Defender Application Guard +- Windows Components\Windows Defender Application Guard\Allow users to trust files that open in Windows Defender Application Guard +- Windows Components\Windows Defender Application Guard\Allow Windows Defender Application Guard to use Root Certificate Authorities from the user’s device +- Windows Components\Windows Defender Application Guard\Configure additional sources for untrusted files in Windows Defender Application Guard +- Windows Components\Windows Hello for Business\Use Windows Hello for Business certificates as smart card certificates +- Windows Components\Windows Media Player\Do Not Show First Use Dialog Boxes +- Windows Components\Windows Media Player\Prevent Automatic Updates +- Windows Components\Windows Media Player\Prevent CD and DVD Media Information Retrieval +- Windows Components\Windows Media Player\Prevent Desktop Shortcut Creation +- Windows Components\Windows Media Player\Prevent Media Sharing +- Windows Components\Windows Media Player\Prevent Music File Media Information Retrieval +- Windows Components\Windows Media Player\Prevent Quick Launch Toolbar Shortcut Creation +- Windows Components\Windows Media Player\Prevent Radio Station Preset Retrieval +- Windows Components\Windows Media Player\Prevent Video Smoothing +- Windows Components\Windows Media Player\Networking\Configure HTTP Proxy +- Windows Components\Windows Media Player\Networking\Configure MMS Proxy +- Windows Components\Windows Media Player\Networking\Configure Network Buffering +- Windows Components\Windows Media Player\Networking\Configure RTSP Proxy +- Windows Components\Windows Media Player\Networking\Hide Network Tab +- Windows Components\Windows Media Player\Networking\Streaming Media Protocols +- Windows Components\Windows Media Player\Playback\Allow Screen Saver +- Windows Components\Windows Media Player\Playback\Prevent Codec Download +- Windows Components\Windows Media Player\User Interface\Do Not Show Anchor +- Windows Components\Windows Media Player\User Interface\Hide Privacy Tab +- Windows Components\Windows Media Player\User Interface\Hide Security Tab +- Windows Components\Windows Media Player\User Interface\Set and Lock Skin +- Windows Components\Windows Security\Account protection\Hide the Account protection area +- Windows Components\Windows Security\App and browser protection\Hide the App and browser protection area +- Windows Components\Windows Security\App and browser protection\Prevent users from modifying settings +- Windows Components\Windows Security\Device performance and health\Hide the Device performance and health area +- Windows Components\Windows Security\Device security\Disable the Clear TPM button +- Windows Components\Windows Security\Device security\Hide the Device security area +- Windows Components\Windows Security\Device security\Hide the Secure boot area +- Windows Components\Windows Security\Device security\Hide the Security processor (TPM) troubleshooter page +- Windows Components\Windows Security\Device security\Hide the TPM Firmware Update recommendation +- Windows Components\Windows Security\Enterprise Customization\Configure customized contact information +- Windows Components\Windows Security\Enterprise Customization\Configure customized notifications +- Windows Components\Windows Security\Enterprise Customization\Specify contact company name +- Windows Components\Windows Security\Enterprise Customization\Specify contact email address or Email ID +- Windows Components\Windows Security\Enterprise Customization\Specify contact phone number or Skype ID +- Windows Components\Windows Security\Enterprise Customization\Specify contact website +- Windows Components\Windows Security\Family options\Hide the Family options area +- Windows Components\Windows Security\Firewall and network protection\Hide the Firewall and network protection area +- Windows Components\Windows Security\Notifications\Hide all notifications +- Windows Components\Windows Security\Notifications\Hide non-critical notifications +- Windows Components\Windows Security\Systray\Hide Windows Security Systray +- Windows Components\Windows Security\Virus and threat protection\Hide the Ransomware data recovery area +- Windows Components\Windows Security\Virus and threat protection\Hide the Virus and threat protection area +- Windows Components\Windows Update\Display options for update notifications +- Windows Components\Windows Update\Remove access to "Pause updates" feature + +**Control Panel** + +- Control Panel\Settings Page Visibility +- Control Panel\Regional and Language Options\Allow users to enable online speech recognition services + +**Network** + +- Network\Windows Connection Manager\Enable Windows to soft-disconnect a computer from a network + + +## New Group Policy settings in Windows 10, version 1803 + +The following Group Policy settings were added in Windows 10, version 1803: + +**System** + +- System\Credentials Delegation\Encryption Oracle Remediation +- System\Group Policy\Phone-PC linking on this device +- System\OS Policies\Allow upload of User Activities + +**Windows Components** + +- Windows Components\App Privacy\Let Windows apps access an eye tracker device +- Windows Components\Cloud Content\Turn off Windows Spotlight on Settings +- Windows Components\Data Collection and Preview Builds\Allow device name to be sent in Windows diagnostic data +- Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in setting user interface +- Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in change notifications +- Windows Components\Delivery Optimization\Maximum Background Download Bandwidth (percentage) +- Windows Components\Delivery Optimization\Maximum Foreground Download Bandwidth (percentage) +- Windows Components\Delivery Optimization\Select the source of Group IDs +- Windows Components\Delivery Optimization\Delay background download from http (in secs) +- Windows Components\Delivery Optimization\Delay Foreground download from http (in secs) +- Windows Components\Delivery Optimization\Select a method to restrict Peer Selection +- Windows Components\Delivery Optimization\Set Business Hours to Limit Background Download Bandwidth +- Windows Components\Delivery Optimization\Set Business Hours to Limit Foreground Download Bandwidth +- Windows Components\IME\Turn on Live Sticker +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Device and Resource Redirection\Do not allow video capture redirection +- Windows Components\Remote Desktop Services\Remote Desktop Session Host\Remote Session Environment\Use hardware graphics adapters for all Remote Desktop Services sessions +- Windows Components\Search\Allow Cortana Page in OOBE on an AAD account +- Windows Components\Store\Disable all apps from Microsoft Store +- Windows Components\Text Input\Allow Uninstallation of Language Features +- Windows Components\Text Input\Improve inking and typing recognition +- Windows Components\Windows Defender Application Guard\Allow hardware-accelerated rendering for Windows Defender Application Guard +- Windows Components\Windows Defender Security Center\Account protection\Hide the Account protection area +- Windows Components\Windows Defender Security Center\Device security\Hide the Device security area +- Windows Components\Windows Defender Security Center\Device security\Hide the Security processor (TPM) troubleshooter page +- Windows Components\Windows Defender Security Center\Device security\Hide the Secure boot area +- Windows Components\Windows Defender Security Center\Virus and threat protection\Hide the Ransomware data recovery area + ## New Group Policy settings in Windows 10, version 1709 @@ -254,6 +483,7 @@ No new [Exchange ActiveSync policies](https://go.microsoft.com/fwlink/p/?LinkId= ## Related topics +[Group Policy Settings Reference Spreadsheet Windows 1803](https://www.microsoft.com/download/details.aspx?id=56946) [Manage corporate devices](manage-corporate-devices.md) @@ -267,4 +497,3 @@ No new [Exchange ActiveSync policies](https://go.microsoft.com/fwlink/p/?LinkId= - diff --git a/windows/client-management/reset-a-windows-10-mobile-device.md b/windows/client-management/reset-a-windows-10-mobile-device.md index dbd44ec56d..e90c985fdb 100644 --- a/windows/client-management/reset-a-windows-10-mobile-device.md +++ b/windows/client-management/reset-a-windows-10-mobile-device.md @@ -2,11 +2,14 @@ title: Reset a Windows 10 Mobile device (Windows 10) description: There are two methods for resetting a Windows 10 Mobile device factory reset and \ 0034;wipe and persist \ 0034; reset. ms.assetid: B42A71F4-DFEE-4D6E-A904-7942D1AAB73F +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 07/27/2017 ms.topic: article @@ -63,7 +66,7 @@ To perform a "wipe and persist" reset, preserving the provisioning applied to th                             ``` -## Reset using the UI +## Reset using the UI 1. On your mobile device, go to **Settings** > **System** > **About** > **Reset your Phone** diff --git a/windows/client-management/system-failure-recovery-options.md b/windows/client-management/system-failure-recovery-options.md new file mode 100644 index 0000000000..28f7edaab0 --- /dev/null +++ b/windows/client-management/system-failure-recovery-options.md @@ -0,0 +1,205 @@ +--- +title: Configure system failure and recovery options in Windows +description: Learn about the system failure and recovery options in Windows. +ms.prod: w10 +ms.sitesec: library +ms.topic: troubleshooting +author: Deland-Han +ms.localizationpriority: medium +ms.author: delhan +ms.date: 8/22/2019 +ms.reviewer: +manager: dcscontentpm +--- + +# Configure system failure and recovery options in Windows + +This article describes how to configure the actions that Windows takes when a system error (also referred to as a bug check, system crash, fatal system error, or Stop error) occurs. You can configure the following actions: + +- Write an event to the System log. + +- Alert administrators (if you have set up administrative alerts). + +- Put system memory into a file that advanced users can use for debugging. + +- Automatically restart the computer. + +>[!Note] +> You must be logged on as an administrator or a member of the Administrators group to complete this procedure. If your computer is connected to a network, network policy settings may prevent you from completing this procedure. + +## Configuring system failure and recovery options + +> [!IMPORTANT] +> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur. + +The options are available in the **Startup and Recovery** dialog box. You can also use the following methods: + +- Modify the values under the following registry subkey: + + **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl** + +- To modify the option on your local computer, use the command line utility (Wmic.exe) to access Windows Management Instrumentation (WMI). + +Follow these steps to view the options in **Startup and Recovery**. (The registry value and Wmic commands are also listed for each option.) + +1. In Control Panel, select **System and Security > System**. + +2. Select **Advanced system settings**, select the **Advanced** tab, and select **Settings** in the **Startup and Recovery** area. + +### Under "System failure" + +Select the check boxes for the actions that you want Windows to perform when a system error occurs. + +#### Write an event to the System log + +This option specifies that event information is recorded in the System log. By default, this option is turned on. + +To turn off this option, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set WriteToSystemLog = False + ``` + +- Set the **LogEvent** DWORD value to **0**. + +#### Send an administrative alert + +The option specifies that administrators are notified of the system error if you configured administrative alerts. By default, this option is turned on. + +To turn off this option, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set SendAdminAlert = False + ``` + +- Set the **SendAlert** DWORD value to **0**. + +#### Automatically restart + +The option specifies that Windows automatically restarts your computer. By default, this option is turned on. + +To turn off this option, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set AutoReboot = False + ``` + +- Set the **AutoReboot** DWORD value to **0**. + +### Under "Write debugging information" + +Select one of the following type of information that you want Windows to record in a memory dump file if the computer stops unexpectedly: + +#### (none) + +The option does not record any information in a memory dump file. + +To specify that you do not want Windows to record information in a memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugInfoType = 0 + ``` +- Set the **CrashDumpEnabled** DWORD value to **0**. + +#### Small Memory Dump + +The option records the smallest amount of information to help identify the problem. This option requires a paging file of at least 2 megabytes (MB) on the boot volume of your computer, and specifies that Windows will create a new file each time the system stops unexpectedly. A history of these files is stored in the folder that is listed under Small Dump Directory (%SystemRoot%\Minidump). In Windows XP and Windows Server 2003, the small memory dump file is used together with the Windows Error Reporting feature. + +To specify that you want to use a small memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugInfoType = 3 + ``` + +- Set the **CrashDumpEnabled** DWORD value to **3**. + +To specify that you want to use a folder as your Small Dump Directory, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set MiniDumpDirectory = + ``` + +- Set the **MinidumpDir** Expandable String Value to \. + +#### Kernel Memory Dump + +The option records only kernel memory. This option stores more information than a small memory dump file, but it takes less time to complete than a complete memory dump file. The file is stored in %SystemRoot%\Memory.dmp by default, and any previous kernel or complete memory dump files are overwritten if the **Overwrite any existing file** check box is selected. If you set this option, you must have a sufficiently large paging file on the boot volume. The required size depends on the amount of RAM in your computer However, the maximum amount of space that must be available for a kernel memory dump on a 32-bit system is 2 GB plus 16 MB. On a 64-bit system, the maximum amount of space that must be available for a kernel memory dump is the size of the RAM plus 128 MB. The following table provides guidelines for the size of the paging file: + +|RAM size |Paging file should be no smaller than| +|-------|-----------------| +|256 MB–1,373 MB |1.5 times the RAM size| +|1,374 MB or greater |32-bit system: 2 GB plus 16 MB
                            64-bit system: size of the RAM plus 128 MB| + +To specify that you want to use a kernel memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugInfoType = 2 + ``` + +- Set the **CrashDumpEnabled** DWORD value to **2**. + +To specify that you want to use a file as your memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugFilePath = + ``` + +- Set the **DumpFile** Expandable String Value to \. + +To specify that you do not want to overwrite any previous kernel or complete memory dump files, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set OverwriteExistingDebugFile = 0 + ``` + +- Set the **Overwrite** DWORD value to **0**. + +#### Complete Memory Dump + +The option records the contents of system memory when the computer stops unexpectedly. This option is not available on computers that have 2 or more GB of RAM. If you select this option, you must have a paging file on the boot volume that is sufficient to hold all the physical RAM plus 1 MB. The file is stored as specified in %SystemRoot%\Memory.dmp by default. + +The extra megabyte is required for a complete memory dump file because Windows writes a header in addition to dumping the memory contents. The header contains a crash dump signature and specifies the values of some kernel variables. The header information does not require a full megabyte of space, but Windows sizes your paging file in increments of megabytes. + +To specify that you want to use a complete memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugInfoType = 1 + ``` + +- Set the **CrashDumpEnabled** DWORD value to **1**. + +To specify that you want to use a file as your memory dump file, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set DebugFilePath = + ``` + +- Set the DumpFile Expandable String Value to \. + +To specify that you do not want to overwrite any previous kernel or complete memory dump files, run the following command or modify the registry value: + +- ```cmd + wmic recoveros set OverwriteExistingDebugFile = 0 + ``` + +- Set the **Overwrite** DWORD value to **0**. + +>[!Note] +>If you contact Microsoft Support about a Stop error, you might be asked for the memory dump file that is generated by the Write Debugging Information option. + +To view system failure and recovery settings for your local computer, type **wmic recoveros** at a command prompt, and then press Enter. To view system failure and recovery settings for a remote computer on your local area network, type **wmic /node: recoveros** at a command prompt, and then press Enter. + +>[!Note] +>To successfully use these Wmic.exe command line examples, you must be logged on by using a user account that has administrative rights on the computer. If you are not logged on by using a user account that has administrative rights on the computer, use the **/user:user_name** and **/password:password** switches. + +### Tips + +- To take advantage of the dump file feature, your paging file must be on the boot volume. If you have moved the paging file to another volume, you must move it back to the boot volume before you use this feature. + +- If you set the Kernel Memory Dump or the Complete Memory Dump option, and you select the **Overwrite any existing file** check box, Windows always writes to the same file name. To save individual dump files, click to clear the **Overwrite any existing file** check box, and then change the file name after each Stop error. + +- You can save some memory if you click to clear the **Write an event to the system log** and **Send an administrative alert** check boxes. The memory that you save depends on the computer, but these features typically require about 60 to 70 KB. + +## References + +[Varieties of Kernel-Mode Dump Files](https://docs.microsoft.com/windows-hardware/drivers/debugger/varieties-of-kernel-mode-dump-files) diff --git a/windows/client-management/troubleshoot-event-id-41-restart.md b/windows/client-management/troubleshoot-event-id-41-restart.md new file mode 100644 index 0000000000..b774919abf --- /dev/null +++ b/windows/client-management/troubleshoot-event-id-41-restart.md @@ -0,0 +1,121 @@ +--- +title: Advanced troubleshooting for Event ID 41 - "The system has rebooted without cleanly shutting down first" +description: Describes the circumstances that cause a computer to generate Event ID 41, and provides guidance for troubleshooting the issue +author: Teresa-Motiv +ms.author: v-tea +ms.date: 12/27/2019 +ms.prod: w10 +ms.topic: article +ms.custom: +- CI 111437 +- CSSTroubleshooting +audience: ITPro +ms.localizationpriority: medium +keywords: event id 41, reboot, restart, stop error, bug check code +manager: kaushika + +--- + +# Advanced troubleshooting for Event ID 41: "The system has rebooted without cleanly shutting down first" + +> **Home users** +> This article is intended for use by support agents and IT professionals. If you're looking for more information about blue screen error messages, please visit [Troubleshoot blue screen errors](https://support.microsoft.com/help/14238/windows-10-troubleshoot-blue-screen-errors). + +The preferred way to shut down Windows is to select **Start**, and then select an option to turn off or shut down the computer. When you use this standard method, the operating system closes all files and notifies the running services and applications so that they can write any unsaved data to disk and flush any active caches. + +If your computer shuts down unexpectedly, Windows logs Event ID 41 the next time that the computer starts. The event text resembles the following: + +> Event ID: 41 +> Description: The system has rebooted without cleanly shutting down first. + +This event indicates that some unexpected activity prevented Windows from shutting down correctly. Such a shutdown might be caused by an interruption in the power supply or by a Stop error. If feasible, Windows records any error codes as it shuts down. During the [kernel phase](advanced-troubleshooting-boot-problems.md#kernel-phase) of the next Windows startup, Windows checks for these codes and includes any existing codes in the event data of Event ID 41. + +> EventData +> BugcheckCode 159 +> BugcheckParameter1 0x3 +> BugcheckParameter2 0xfffffa80029c5060 +> BugcheckParameter3 0xfffff8000403d518 +> BugcheckParameter4 0xfffffa800208c010 +> SleepInProgress false +> PowerButtonTimestamp 0Converts to 0x9f (0x3, 0xfffffa80029c5060, 0xfffff8000403d518, 0xfffffa800208c010) + +## How to use Event ID 41 when you troubleshoot an unexpected shutdown or restart + +By itself, Event ID 41 might not contain sufficient information to explicitly define what occurred. Typically, you have to also consider what was occurring at the time of the unexpected shutdown (for example, the power supply failed). Use the information in this article to identify a troubleshooting approach that is appropriate for your circumstances: + +- [Scenario 1](#scen1): The computer restarts because of a Stop error, and Event ID 41 contains a Stop error (bug check) code +- [Scenario 2](#scen2): The computer restarts because you pressed and held the power button +- [Scenario 3](#scen3): The computer is unresponsive or randomly restarts, and Event ID 41 is not logged or the Event ID 41 entry lists error code values of zero + +### Scenario 1: The computer restarts because of a Stop error, and Event ID 41 contains a Stop error (bug check) code + +When a computer shuts down or restarts because of a Stop error, Windows includes the Stop error data in Event ID 41 as part of the additional event data. This information includes the Stop error code (also called a bug check code), as shown in the following example: + +> EventData +> BugcheckCode 159 +> BugcheckParameter1 0x3 +> BugcheckParameter2 0xfffffa80029c5060 +> BugcheckParameter3 0xfffff8000403d518 +> BugcheckParameter4 0xfffffa800208c010 + +> [!NOTE] +> Event ID 41 includes the bug check code in decimal format. Most documentation that describes bug check codes refers to the codes as hexadecimal values instead of decimal values. To convert decimal to hexadecimal, follow these steps: +> +> 1. Select **Start**, type **calc** in the **Search** box, and then select **Calculator**. +> 1. In the **Calculator** window, select **View** > **Programmer**. +> 1. On the left side of calculator, verify that **Dec** is highlighted. +> 1. Use the keyboard to enter the decimal value of the bug check code. +> 1. On the left side of the calculator, select **Hex**. +> The value that the calculator displays is now the hexadecimal code. +> +> When you convert a bug check code to hexadecimal format, verify that the “0x” designation is followed by eight digits (that is, the part of the code after the “x” includes enough zeros to fill out eight digits). For example, 0x9F is typically documented as 0x0000009f, and 0xA is documented as 0x0000000A. In the case of the example event data in this article, "159" converts to 0x0000009f. + +After you identify the hexadecimal value, use the following references to continue troubleshooting: + +- [Advanced troubleshooting for Stop error or blue screen error issue](troubleshoot-stop-errors.md). +- [Bug Check Code Reference](https://docs.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2). This page lists links to documentation for different bug check codes. +- [How to Debug Kernel Mode Blue Screen Crashes (for beginners)](https://blogs.technet.microsoft.com/askcore/2008/10/31/how-to-debug-kernel-mode-blue-screen-crashes-for-beginners/). + +### Scenario 2: The computer restarts because you pressed and held the power button + +Because this method of restarting the computer interferes with the Windows shutdown operation, we recommend that you use this method only if you have no alternative. For example, you might have to use this approach if your computer is not responding. When you restart the computer by pressing and holding the power button, the computer logs an Event ID 41 that includes a non-zero value for the **PowerButtonTimestamp** entry. + +For help when troubleshooting an unresponsive computer, see [Windows Help](https://support.microsoft.com/hub/4338813/windows-help?os=windows-10). Consider searching for assistance by using keywords such as "hang," "responding," or "blank screen." + +### Scenario 3: The computer is unresponsive or randomly restarts, and Event ID 41 is not recorded or the Event ID 41 entry or lists error code values of zero + +This scenario includes the following circumstances: + +- You shut off power to an unresponsive computer, and then you restart the computer. + To verify that a computer is unresponsive, press the CAPS LOCK key on the keyboard. If the CAPS LOCK light on the keyboard does not change when you press the CAPS LOCK key, the computer might be completely unresponsive (also known as a *hard hang*). +- The computer restarts, but it does not generate Event ID 41. +- The computer restarts and generates Event ID 41, but the **BugcheckCode** and **PowerButtonTimestamp** values are zero. + +In such cases, something prevents Windows from generating error codes or from writing error codes to disk. Something might block write access to the disk (as in the case of an unresponsive computer) or the computer might shut down too quickly to write the error codes or even detect an error. + +The information in Event ID 41 provides some indication of where to start checking for problems: + +- **Event ID 41 is not recorded or the bug check code is zero**. This behavior might indicate a power supply problem. If the power to a computer is interrupted, the computer might shut down without generating a Stop error. If it does generate a Stop error, it might not finish writing the error codes to disk. The next time the computer starts, it might not log Event ID 41. Or, if it does, the bug check code is zero. Conditions such as the following might be the cause: + - In the case of a portable computer, the battery was removed or completely drained. + - In the case of a desktop computer, the computer was unplugged or experienced a power outage. + - The power supply is underpowered or faulty. + +- **The PowerButtonTimestamp value is zero**. This behavior might occur if you disconnected the power to a computer that was not responding to input. Conditions such as the following might be the cause: + - A Windows process blocked write access to the disk, and you shut down the computer by pressing and holding the power button for at least four seconds. + - You disconnected the power to an unresponsive computer. + +Typically, the symptoms described in this scenario indicate a hardware problem. To help isolate the problem, do the following: + +- **Disable overclocking**. If the computer has overclocking enabled, disable it. Verify that the issue occurs when the system runs at the correct speed. +- **Check the memory**. Use a memory checker to determine the memory health and configuration. Verify that all memory chips run at the same speed and that every chip is configured correctly in the system. +- **Check the power supply**. Verify that the power supply has enough wattage to appropriately handle the installed devices. If you added memory, installed a newer processor, installed additional drives, or added external devices, such devices can require more energy than the current power supply can provide consistently. If the computer logged Event ID 41 because the power to the computer was interrupted, consider obtaining an uninterruptible power supply (UPS) such as a battery backup power supply. +- **Check for overheating**. Examine the internal temperature of the hardware and check for any overheating components. + +If you perform these checks and still cannot isolate the problem, set the system to its default configuration and verify whether the issue still occurs. + +> [!NOTE] +> If you see a Stop error message that includes a bug check code, but Event ID 41 does not include that code, change the restart behavior for the computer. To do this, follow these steps: +> +> 1. Right-click **My Computer**, then select **Properties** > **Advanced system settings** > **Advanced**. +> 1. In the **Startup and Recovery** section, select **Settings**. +> 1. Clear the **Automatically restart** check box. diff --git a/windows/client-management/troubleshoot-inaccessible-boot-device.md b/windows/client-management/troubleshoot-inaccessible-boot-device.md index 349f5fce9f..3acffc551f 100644 --- a/windows/client-management/troubleshoot-inaccessible-boot-device.md +++ b/windows/client-management/troubleshoot-inaccessible-boot-device.md @@ -1,21 +1,23 @@ --- -title: Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device +title: Advanced advice for Stop error 7B, Inaccessible_Boot_Device description: Learn how to troubleshoot Stop error 7B or Inaccessible_Boot_Device ms.prod: w10 ms.mktglfcycl: ms.sitesec: library ms.topic: troubleshooting -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: kaushika +ms.author: dansimp ms.date: 12/11/2018 +ms.reviewer: +manager: dansimp --- # Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device This article provides steps to troubleshoot **Stop error 7B: Inaccessible_Boot_Device**. This error may occur after some changes are made to the computer, or immediately after you deploy Windows on the computer. -## Causes of the Inaccessible_Boot_Device Stop error +## Causes of the Inaccessible_Boot_Device Stop error Any one of the following factors may cause the stop error: @@ -35,7 +37,7 @@ Any one of the following factors may cause the stop error: * Corrupted files in the **Boot** partition (for example, corruption in the volume that is labeled **SYSTEM** when you run the `diskpart` > `list vol` command) -## Troubleshoot this error +## Troubleshoot this error Start the computer in [Windows Recovery Mode (WinRE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference#span-identrypointsintowinrespanspan-identrypointsintowinrespanspan-identrypointsintowinrespanentry-points-into-winre). To do this, follow these steps. @@ -45,9 +47,9 @@ Start the computer in [Windows Recovery Mode (WinRE)](https://docs.microsoft.com 3. On the **System Recovery Options** screen, select **Next** > **Command Prompt** . -### Verify that the boot disk is connected and accessible +### Verify that the boot disk is connected and accessible -#### Step 1 +#### Step 1 At the WinRE Command prompt, run `diskpart`, and then run `list disk`. @@ -61,11 +63,11 @@ A list of the physical disks that are attached to the computer should be display Disk 0 Online **size* GB 0 B * ``` -If the computer uses a Unified Extensible Firmware Interface (UEFI) startup interface, there will be an asterisk (*) in the **GPT** column. +If the computer uses a Unified Extensible Firmware Interface (UEFI) startup interface, there will be an asterisk () in the **GPT* column. If the computer uses a basic input/output system (BIOS) interface, there will not be an asterisk in the **Dyn** column. -#### Step 2 +#### Step 2 If the `list disk` command lists the OS disks correctly, run the `list vol` command in `diskpart`. @@ -86,34 +88,34 @@ If the `list disk` command lists the OS disks correctly, run the `list vol` comm >[!NOTE] >If the disk that contains the OS is not listed in the output, you will have to engage the OEM or virtualization manufacturer. -### Verify the integrity of Boot Configuration Database +### Verify the integrity of Boot Configuration Database Check whether the Boot Configuration Database (BCD) has all the correct entries. To do this, run `bcdedit` at the WinRE command prompt. To verify the BCD entries: -1. Examine the **Windows Boot Manager** section that has the **{bootmgr}** identifier. Make sure that the **device** and **path** entries point to the correct device and boot loader file. +1. Examine the **Windows Boot Manager** section that has the **{bootmgr}** identifier. Make sure that the **device** and **path** entries point to the correct device and boot loader file. - An example output if the computer is UEFI-based: + An example output if the computer is UEFI-based: - ``` - device partition=\Device\HarddiskVolume2 - path \EFI\Microsoft\Boot\bootmgfw.efi - ``` + ``` + device partition=\Device\HarddiskVolume2 + path \EFI\Microsoft\Boot\bootmgfw.efi + ``` - An example output if the machine is BIOS based: - ``` - Device partition=C: - ``` - >[!NOTE] - >This output may not contain a path. + An example output if the machine is BIOS based: + ``` + Device partition=C: + ``` + >[!NOTE] + >This output may not contain a path. -2. In the **Windows Boot Loader** that has the **{default}** identifier, make sure that **device** , **path** , **osdevice,** and **systemroot** point to the correct device or partition, winload file, OS partition or device, and OS folder. +2. In the **Windows Boot Loader** that has the **{default}** identifier, make sure that **device** , **path** , **osdevice,** and **systemroot** point to the correct device or partition, winload file, OS partition or device, and OS folder. - >[!NOTE] - >If the computer is UEFI-based, the **bootmgr** and **winload** entires under **{default}** will contain an **.efi** extension. + >[!NOTE] + >If the computer is UEFI-based, the **bootmgr** and **winload** entires under **{default}** will contain an **.efi** extension. - ![bcdedit](images/screenshot1.png) + ![bcdedit](images/screenshot1.png) If any of the information is wrong or missing, we recommend that you create a backup of the BCD store. To do this, run `bcdedit /export C:\temp\bcdbackup`. This command creates a backup in **C:\\temp\\** that is named **bcdbackup** . To restore the backup, run `bcdedit /import C:\temp\bcdbackup`. This command overwrites all BCD settings by using the settings in **bcdbackup** . @@ -129,39 +131,39 @@ If the BCD has the correct entries, check whether the **winload** and **bootmgr* If the files are missing, and you want to rebuild the boot files, follow these steps: -1. Copy all the contents under the **SYSTEM** partition to another location. Alternatively, you can use the command prompt to navigate to the OS drive, create a new folder, and then copy all the files and folders from the **SYSTEM** volume, as follows: +1. Copy all the contents under the **SYSTEM** partition to another location. Alternatively, you can use the command prompt to navigate to the OS drive, create a new folder, and then copy all the files and folders from the **SYSTEM** volume, as follows: ``` D:\> Mkdir BootBackup R:\> Copy *.* D:\BootBackup ``` -2. If you are using Windows 10, or if you are troubleshooting by using a Windows 10 ISO at the Windows Pre-Installation Environment command prompt, you can use the **bcdboot** command to re-create the boot files, as follows: +2. If you are using Windows 10, or if you are troubleshooting by using a Windows 10 ISO at the Windows Pre-Installation Environment command prompt, you can use the **bcdboot** command to re-create the boot files, as follows: - ```cmd - Bcdboot <**OSDrive* >:\windows /s <**SYSTEMdrive* >: /f ALL - ``` + ```cmd + Bcdboot <**OSDrive* >:\windows /s <**SYSTEMdrive* >: /f ALL + ``` - For example: if we assign the ,System Drive> (WinRE drive) the letter R and the is the letter D, this command would be the following: + For example: if we assign the `` (WinRE drive) the letter R and the `` is the letter D, this command would be the following: - ```cmd - Bcdboot D:\windows /s R: /f ALL - ``` + ```cmd + Bcdboot D:\windows /s R: /f ALL + ``` - >[!NOTE] - >The **ALL** part of the **bcdboot** command writes all the boot files (both UEFI and BIOS) to their respective locations. + >[!NOTE] + >The **ALL** part of the **bcdboot** command writes all the boot files (both UEFI and BIOS) to their respective locations. If you do not have a Windows 10 ISO, you must format the partition and copy **bootmgr** from another working computer that has a similar Windows build. To do this, follow these steps: -1. Start **Notepad** . +1. Start **Notepad** . -2. Press Ctrl+O. +2. Press Ctrl+O. -3. Navigate to the system partition (in this example, it is R). +3. Navigate to the system partition (in this example, it is R). -4. Right-click the partition, and then format it. +4. Right-click the partition, and then format it. -### Troubleshooting if this issue occurs after a Windows Update installation +### Troubleshooting if this issue occurs after a Windows Update installation Run the following command to verify the Windows update installation and dates: @@ -169,47 +171,47 @@ Run the following command to verify the Windows update installation and dates: Dism /Image:: /Get-packages ``` -After you run this command, you will see the **Install pending** and **Uninstall Pending ** packages: +After you run this command, you will see the **Install pending** and **Uninstall Pending** packages: ![Dism output](images/pendingupdate.png) -1. Run the `dism /Image:C:\ /Cleanup-Image /RevertPendingActions` command. Replace **C:** with the system partition for your computer. +1. Run the `dism /Image:C:\ /Cleanup-Image /RevertPendingActions` command. Replace **C:** with the system partition for your computer. ![Dism output](images/revertpending.png) -2. Navigate to ***OSdriveLetter* :\Windows\WinSxS** , and then check whether the **pending.xml** file exists. If it does, rename it to **pending.xml.old**. +2. Navigate to ***OSdriveLetter* :\Windows\WinSxS** , and then check whether the **pending.xml** file exists. If it does, rename it to **pending.xml.old**. -3. To revert the registry changes, type **regedit** at the command prompt to open **Registry Editor**. +3. To revert the registry changes, type **regedit** at the command prompt to open **Registry Editor**. -4. Select **HKEY_LOCAL_MACHINE**, and then go to **File** > **Load Hive**. +4. Select **HKEY_LOCAL_MACHINE**, and then go to **File** > **Load Hive**. -5. Navigate to **OSdriveLetter:\Windows\System32\config**, select the file that is named **COMPONENT** (with no extension), and then select **Open**. When you are prompted, enter the name **OfflineComponentHive** for the new hive +5. Navigate to **OSdriveLetter:\Windows\System32\config**, select the file that is named **COMPONENT** (with no extension), and then select **Open**. When you are prompted, enter the name **OfflineComponentHive** for the new hive ![Load Hive](images/loadhive.png) -6. Expand **HKEY_LOCAL_MACHINE\OfflineComponentHive**, and check whether the **PendingXmlIdentifier** key exists. Create a backup of the **OfflineComponentHive** key, and then delete the **PendingXmlIdentifier** key. +6. Expand **HKEY_LOCAL_MACHINE\OfflineComponentHive**, and check whether the **PendingXmlIdentifier** key exists. Create a backup of the **OfflineComponentHive** key, and then delete the **PendingXmlIdentifier** key. -7. Unload the hive. To do this, highlight **OfflineComponentHive**, and then select **File** > **Unload hive**. +7. Unload the hive. To do this, highlight **OfflineComponentHive**, and then select **File** > **Unload hive**. ![Unload Hive](images/unloadhive.png)![Unload Hive](images/unloadhive1.png) -8. Select **HKEY_LOCAL_MACHINE**, go to **File** > **Load Hive**, navigate to ***OSdriveLetter* :\Windows\System32\config**, select the file that is named **SYSTEM** (with no extension), and then select **Open** . When you are prompted, enter the name **OfflineSystemHive** for the new hive. +8. Select **HKEY_LOCAL_MACHINE**, go to **File** > **Load Hive**, navigate to ***OSdriveLetter* :\Windows\System32\config**, select the file that is named **SYSTEM** (with no extension), and then select **Open** . When you are prompted, enter the name **OfflineSystemHive** for the new hive. -9. Expand **HKEY_LOCAL_MACHINE\OfflineSystemHive**, and then select the **Select** key. Check the data for the **Default** value. +9. Expand **HKEY_LOCAL_MACHINE\OfflineSystemHive**, and then select the **Select** key. Check the data for the **Default** value. -10. If the data in **HKEY_LOCAL_MACHINE\OfflineSystemHive\Select\Default** is **1** , expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet001**. If it is **2**, expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet002**, and so on. +10. If the data in **HKEY_LOCAL_MACHINE\OfflineSystemHive\Select\Default** is **1** , expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet001**. If it is **2**, expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet002**, and so on. 11. Expand **Control\Session Manager**. Check whether the **PendingFileRenameOperations** key exists. If it does, back up the **SessionManager** key, and then delete the **PendingFileRenameOperations** key. -### Verifying boot critical drivers and services +### Verifying boot critical drivers and services -#### Check services +#### Check services 1. Follow steps 1-10 in the "Troubleshooting if this issue occurs after an Windows Update installation" section. (Step 11 does not apply to this procedure.) -2. Expand **Services**. +2. Expand **Services**. -3. Make sure that the following registry keys exist under **Services**: +3. Make sure that the following registry keys exist under **Services**: * ACPI @@ -233,18 +235,18 @@ ren SYSTEM SYSTEM.old copy OSdrive:\Windows\System32\config\RegBack\SYSTEM OSdrive:\Windows\System32\config\ ``` -#### Check upper and lower filter drivers +#### Check upper and lower filter drivers Check whether there are any non-Microsoft upper and lower filter drivers on the computer and that they do not exist on another, similar working computer. if they do exist, remove the upper and lower filter drivers: -1. Expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet001\Control**. +1. Expand **HKEY_LOCAL_MACHINE\OfflineHive\ControlSet001\Control**. -2. Look for any **UpperFilters** or **LowerFilters** entries. +2. Look for any **UpperFilters** or **LowerFilters** entries. - >[!NOTE] - >These filters are mainly related to storage. After you expand the **Control** key in the registry, you can search for **UpperFilters** and **LowerFilters**. + >[!NOTE] + >These filters are mainly related to storage. After you expand the **Control** key in the registry, you can search for **UpperFilters** and **LowerFilters**. - The following are some of the different registry entries in which you may find these filter drivers. These entries are located under **ControlSet** and are designated as **Default** : + The following are some of the different registry entries in which you may find these filter drivers. These entries are located under **ControlSet** and are designated as **Default** : \Control\Class\\{4D36E96A-E325-11CE-BFC1-08002BE10318} @@ -266,7 +268,7 @@ The reason that these entries may affect us is because there may be an entry in >[!NOTE] >If there actually is a service that is set to **0** or **1** that corresponds to an **UpperFilters** or **LowerFilters** entry, setting the service to disabled in the **Services** registry (as discussed in steps 2 and 3 of the Check services section) without removing the **Filter Driver** entry causes the computer to crash and generate a 0x7b Stop error. -### Running SFC and Chkdsk +### Running SFC and Chkdsk If the computer still does not start, you can try to run a **chkdisk** process on the system drive, and also run System File Checker. To do this, run the following commands at a WinRE command prompt: diff --git a/windows/client-management/troubleshoot-networking.md b/windows/client-management/troubleshoot-networking.md index 184a70c8f0..57398a2764 100644 --- a/windows/client-management/troubleshoot-networking.md +++ b/windows/client-management/troubleshoot-networking.md @@ -1,12 +1,14 @@ --- title: Advanced troubleshooting for Windows networking +ms.reviewer: +manager: dansimp description: Learn how to troubleshoot networking ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: kaushika +ms.author: dansimp --- # Advanced troubleshooting for Windows networking @@ -27,8 +29,8 @@ The following topics are available to help you troubleshoot common problems rela [802.1X authenticated wired access overview](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831831(v=ws.11))
                            [802.1X authenticated wireless access overview](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh994700(v%3dws.11))
                            [Wireless cccess deployment overview](https://docs.microsoft.com/windows-server/networking/core-network-guide/cncg/wireless/b-wireless-access-deploy-overview)
                            -[TCP/IP technical reference](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd379473(v=ws.10))
                            +[TCP/IP technical reference](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd379473(v=ws.10))
                            [Network Monitor](https://docs.microsoft.com/windows/desktop/netmon2/network-monitor)
                            [RPC and the network](https://docs.microsoft.com/windows/desktop/rpc/rpc-and-the-network)
                            [How RPC works](https://docs.microsoft.com/windows/desktop/rpc/how-rpc-works)
                            -[NPS reason codes](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197570(v=ws.10))
                            \ No newline at end of file +[NPS reason codes](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197570(v=ws.10))
                            diff --git a/windows/client-management/troubleshoot-stop-errors.md b/windows/client-management/troubleshoot-stop-errors.md index 75df2a087d..719976a254 100644 --- a/windows/client-management/troubleshoot-stop-errors.md +++ b/windows/client-management/troubleshoot-stop-errors.md @@ -1,13 +1,15 @@ --- title: Advanced troubleshooting for Stop error or blue screen error issue +ms.reviewer: +manager: dansimp description: Learn how to troubleshoot Stop error or blue screen issues. ms.prod: w10 ms.mktglfcycl: ms.sitesec: library ms.topic: troubleshooting -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: kaushika +ms.author: dansimp --- # Advanced troubleshooting for Stop error or blue screen error issue @@ -20,9 +22,9 @@ ms.author: kaushika A Stop error is displayed as a blue screen that contains the name of the faulty driver, such as any of the following example drivers: -- atikmpag.sys -- igdkmd64.sys -- nvlddmkm.sys +- `atikmpag.sys` +- `igdkmd64.sys` +- `nvlddmkm.sys` There is no simple explanation for the cause of Stop errors (also known as blue screen errors or bug check errors). Many different factors can be involved. However, various studies indicate that Stop errors usually are not caused by Microsoft Windows components. Instead, these errors are generally related to malfunctioning hardware drivers or drivers that are installed by third-party software. This includes video cards, wireless network cards, security programs, and so on. @@ -42,39 +44,39 @@ To troubleshoot Stop error messages, follow these general steps: a. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system: - - [Windows 10, version 1809](https://support.microsoft.com/help/4464619) - - [Windows 10, version 1803](https://support.microsoft.com/help/4099479) - - [Windows 10, version 1709](https://support.microsoft.com/help/4043454) - - [Windows 10, version 1703](https://support.microsoft.com/help/4018124) - - [Windows Server 2016 and Windows 10, version 1607](https://support.microsoft.com/help/4000825) - - [Windows 10, version 1511](https://support.microsoft.com/help/4000824) - - [Windows Server 2012 R2 and Windows 8.1](https://support.microsoft.com/help/4009470) - - [Windows Server 2008 R2 and Windows 7 SP1](https://support.microsoft.com/help/4009469) + - [Windows 10, version 1809](https://support.microsoft.com/help/4464619) + - [Windows 10, version 1803](https://support.microsoft.com/help/4099479) + - [Windows 10, version 1709](https://support.microsoft.com/help/4043454) + - [Windows 10, version 1703](https://support.microsoft.com/help/4018124) + - [Windows Server 2016 and Windows 10, version 1607](https://support.microsoft.com/help/4000825) + - [Windows 10, version 1511](https://support.microsoft.com/help/4000824) + - [Windows Server 2012 R2 and Windows 8.1](https://support.microsoft.com/help/4009470) + - [Windows Server 2008 R2 and Windows 7 SP1](https://support.microsoft.com/help/4009469) - b. Make sure that the BIOS and firmware are up-to-date. + b. Make sure that the BIOS and firmware are up-to-date. - c. Run any relevant hardware and memory tests. + c. Run any relevant hardware and memory tests. 3. Run the [Machine Memory Dump Collector](https://home.diagnostics.support.microsoft.com/selfhelp?knowledgebasearticlefilter=2027760&wa=wsignin1.0) Windows diagnostic package. This diagnostic tool is used to collect machine memory dump files and check for known solutions. 4. Run [Microsoft Safety Scanner](http://www.microsoft.com/security/scanner/en-us/default.aspx) or any other virus detection program that includes checks of the Master Boot Record for infections. -5. Make sure that there is sufficient free space on the hard disk. The exact requirement varies, but we recommend 10 to 15 percent free disk space. +5. Make sure that there is sufficient free space on the hard disk. The exact requirement varies, but we recommend 10–15 percent free disk space. 6. Contact the respective hardware or software vendor to update the drivers and applications in the following scenarios: - - The error message indicates that a specific driver is causing the problem. - - You are seeing an indication of a service that is starting or stopping before the crash occurred. In this situation, determine whether the service behavior is consistent across all instances of the crash. - - You have made any software or hardware changes. + - The error message indicates that a specific driver is causing the problem. + - You are seeing an indication of a service that is starting or stopping before the crash occurred. In this situation, determine whether the service behavior is consistent across all instances of the crash. + - You have made any software or hardware changes. - >[!NOTE] - >If there are no updates available from a specific manufacturer, it is recommended that you disable the related service. - > - >To do this, see [How to perform a clean boot in Windows](https://support.microsoft.com/help/929135) - > - >You can disable a driver by following the steps in [How to temporarily deactivate the kernel mode filter driver in Windows](https://support.microsoft.com/help/816071). - > - >You may also want to consider the option of rolling back changes or reverting to the last-known working state. For more information, see [Roll Back a Device Driver to a Previous Version](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732648(v=ws.11)). + >[!NOTE] + >If there are no updates available from a specific manufacturer, it is recommended that you disable the related service. + > + >To do this, see [How to perform a clean boot in Windows](https://support.microsoft.com/help/929135) + > + >You can disable a driver by following the steps in [How to temporarily deactivate the kernel mode filter driver in Windows](https://support.microsoft.com/help/816071). + > + >You may also want to consider the option of rolling back changes or reverting to the last-known working state. For more information, see [Roll Back a Device Driver to a Previous Version](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732648(v=ws.11)). ### Memory dump collection @@ -88,12 +90,12 @@ To configure the system for memory dump files, follow these steps: 5. Stop and disable Automatic System Restart Services (ASR) to prevent dump files from being written. 6. If the server is virtualized, disable auto reboot after the memory dump file is created. This lets you take a snapshot of the server in-state and also if the problem recurs. -The memory dump file is saved at the following locations. +The memory dump file is saved at the following locations: | Dump file type | Location | |----------------|----------| -|(none) | %SystemRoot%\MEMORY.DMP (inactive, or greyed out) | -|Small memory dump file (256kb) | %SystemRoot%\Minidump | +|(none) | %SystemRoot%\MEMORY.DMP (inactive, or grayed out) | +|Small memory dump file (256 kb) | %SystemRoot%\Minidump | |Kernel memory dump file | %SystemRoot%\MEMORY.DMP | | Complete memory dump file | %SystemRoot%\MEMORY.DMP | | Automatic memory dump file | %SystemRoot%\MEMORY.DMP | @@ -105,8 +107,8 @@ You can use the Microsoft DumpChk (Crash Dump File Checker) tool to verify that More information on how to use Dumpchk.exe to check your dump files: -- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk) -- [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk) +- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk) +- [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk) ### Pagefile Settings @@ -116,7 +118,7 @@ More information on how to use Dumpchk.exe to check your dump files: ### Memory dump analysis -Finding the root cause of the crash may not be easy. Hardware problems are especially difficult to diagnose because they may cause erratic and unpredictable behavior that can manifest itself in a variety of symptoms. +Finding the root cause of the crash may not be easy. Hardware problems are especially difficult to diagnose because they may cause erratic and unpredictable behavior that can manifest itself in various symptoms. When a Stop error occurs, you should first isolate the problematic components, and then try to cause them to trigger the Stop error again. If you can replicate the problem, you can usually determine the cause. @@ -136,18 +138,18 @@ You can use the tools such as Windows Software Development KIT (SDK) and Symbols 1. Verify that the computer is set up to generate a complete memory dump file when a crash occurs. See the steps [here](troubleshoot-windows-freeze.md#method-1-memory-dump) for more information. 2. Locate the memory.dmp file in your Windows directory on the computer that is crashing, and copy that file to another computer. -3. On the other computer, download the [Windows 10 SDK](https://developer.microsoft.com/en-US/windows/downloads/windows-10-sdk). -4. Start the install and choose **Debugging Tools for Windows**. This will install the WinDbg tool. +3. On the other computer, download the [Windows 10 SDK](https://developer.microsoft.com/windows/downloads/windows-10-sdk). +4. Start the install and choose **Debugging Tools for Windows**. This installs the WinDbg tool. 5. Open the WinDbg tool and set the symbol path by clicking **File** and then clicking **Symbol File Path**.
                            a. If the computer is connected to the Internet, enter the [Microsoft public symbol server](https://docs.microsoft.com/windows-hardware/drivers/debugger/microsoft-public-symbols) (https://msdl.microsoft.com/download/symbols) and click **OK**. This is the recommended method.
                            - b. If the computer is not connected to the Internet, you must specify a local [symbol path](https://docs.microsoft.com/en-in/windows-hardware/drivers/debugger/symbol-path). + b. If the computer is not connected to the Internet, you must specify a local [symbol path](https://docs.microsoft.com/windows-hardware/drivers/debugger/symbol-path). 6. Click on **Open Crash Dump**, and then open the memory.dmp file that you copied. See the example below. ![WinDbg](images/windbg.png) 7. There should be a link that says **!analyze -v** under **Bugcheck Analysis**. Click that link. This will enter the command !analyze -v in the prompt at the bottom of the page. 8. A detailed bugcheck analysis will appear. See the example below. ![Bugcheck analysis](images/bugcheck-analysis.png) 9. Scroll down to the section where it says **STACK_TEXT**. There will be rows of numbers with each row followed by a colon and some text. That text should tell you what DLL is causing the crash and if applicable what service is crashing the DLL. -10. See [Using the !analyze Exension](https://docs.microsoft.com/windows-hardware/drivers/debugger/using-the--analyze-extension) for details about how to interpret the STACK_TEXT output. +10. See [Using the !analyze Extension](https://docs.microsoft.com/windows-hardware/drivers/debugger/using-the--analyze-extension) for details about how to interpret the STACK_TEXT output. There are many possible causes of a bugcheck and each case is unique. In the example provided above, the important lines that can be identified from the STACK_TEXT are 20, 21, and 22: @@ -211,7 +213,7 @@ Use the following guidelines when you use Driver Verifier: - Test any “suspicious” drivers (drivers that were recently updated or that are known to be problematic). - If you continue to experience non-analyzable crashes, try enabling verification on all third-party and unsigned drivers. -- Enable concurrent verification on groups of 10 to 20 drivers. +- Enable concurrent verification on groups of 10–20 drivers. - Additionally, if the computer cannot boot into the desktop because of Driver Verifier, you can disable the tool by starting in Safe mode. This is because the tool cannot run in Safe mode. For more information, see [Driver Verifier](https://docs.microsoft.com/windows-hardware/drivers/devtest/driver-verifier). @@ -231,13 +233,13 @@ SYSTEM_SERVICE_EXCEPTION
                            Stop error code c000021a {Fatal System Error} The W NTFS_FILE_SYSTEM
                            Stop error code 0x000000024 | This Stop error is commonly caused by corruption in the NTFS file system or bad blocks (sectors) on the hard disk. Corrupted drivers for hard disks (SATA or IDE) can also adversely affect the system's ability to read and write to disk. Run any hardware diagnostics that are provided by the manufacturer of the storage subsystem. Use the scan disk tool to verify that there are no file system errors. To do this, right-click the drive that you want to scan, select Properties, select Tools, and then select the Check now button.We also suggest that you update the NTFS file system driver (Ntfs.sys), and apply the latest cumulative updates for the current operating system that is experiencing the problem. KMODE_EXCEPTION_NOT_HANDLED
                            Stop error code 0x0000001E | If a driver is identified in the Stop error message, disable or remove that driver. Disable or remove any drivers or services that were recently added.

                            If the error occurs during the startup sequence, and the system partition is formatted by using the NTFS file system, you might be able to use Safe mode to disable the driver in Device Manager. To do this, follow these steps:

                            Go to **Settings > Update & security > Recovery**. Under **Advanced startup**, select **Restart now**. After your PC restarts to the **Choose an option** screen, select **Troubleshoot > Advanced options > Startup Settings > Restart**. After the computer restarts, you'll see a list of options. Press **4** or **F4** to start the computer in Safe mode. Or, if you intend to use the Internet while in Safe mode, press **5** or **F5** for the Safe Mode with Networking option. DPC_WATCHDOG_VIOLATION
                            Stop error code 0x00000133 | This Stop error code is caused by a faulty driver that does not complete its work within the allotted time frame in certain conditions. To enable us to help mitigate this error, collect the memory dump file from the system, and then use the Windows Debugger to find the faulty driver. If a driver is identified in the Stop error message, disable the driver to isolate the problem. Check with the manufacturer for driver updates. Check the system log in Event Viewer for additional error messages that might help identify the device or driver that is causing Stop error 0x133. Verify that any new hardware that is installed is compatible with the installed version of Windows. For example, you can get information about required hardware at Windows 10 Specifications. If Windows Debugger is installed, and you have access to public symbols, you can load the c:\windows\memory.dmp file into the Debugger, and then refer to [Determining the source of Bug Check 0x133 (DPC_WATCHDOG_VIOLATION) errors on Windows Server 2012](https://blogs.msdn.microsoft.com/ntdebugging/2012/12/07/determining-the-source-of-bug-check-0x133-dpc_watchdog_violation-errors-on-windows-server-2012/) to find the problematic driver from the memory dump. -USER_MODE_HEALTH_MONITOR
                            Stop error code 0x0000009E | This Stop error indicates that a user-mode health check failed in a way that prevents graceful shutdown. Therefore, Windows restores critical services by restarting or enabling application failover to other servers. The Clustering Service incorporates a detection mechanism that may detect unresponsiveness in user-mode components.
                            This Stop error usually occurs in a clustered environment, and the indicated faulty driver is RHS.exe.Check the event logs for any storage failures to identify the failing process.Try to update the component or process that is indicated in the event logs. You should see the following event recorded:
                            Event ID: 4870
                            Source: Microsoft-Windows-FailoverClustering
                            Description: User mode health monitoring has detected that the system is not being responsive. The Failover cluster virtual adapter has lost contact with the Cluster Server process with a process ID ‘%1’, for ‘%2’ seconds. Recovery action will be taken. Review the Cluster logs to identify the process and investigate which items might cause the process to hang.
                            For more information, see ["Why is my Failover Clustering node blue screening with a Stop 0x0000009E?"](https://blogs.technet.microsoft.com/askcore/2009/06/12/why-is-my-failover-clustering-node-blue-screening-with-a-stop-0x0000009e) Also, see the following Microsoft video [What to do if a 9E occurs](https://www.youtube.com/watch?v=vOJQEdmdSgw). +USER_MODE_HEALTH_MONITOR
                            Stop error code 0x0000009E | This Stop error indicates that a user-mode health check failed in a way that prevents graceful shutdown. Therefore, Windows restores critical services by restarting or enabling application failover to other servers. The Clustering Service incorporates a detection mechanism that may detect unresponsiveness in user-mode components.
                            This Stop error usually occurs in a clustered environment, and the indicated faulty driver is RHS.exe.Check the event logs for any storage failures to identify the failing process. Try to update the component or process that is indicated in the event logs. You should see the following event recorded:
                            Event ID: 4870
                            Source: Microsoft-Windows-FailoverClustering
                            Description: User mode health monitoring has detected that the system is not being responsive. The Failover cluster virtual adapter has lost contact with the Cluster Server process with a process ID ‘%1’, for ‘%2’ seconds. Recovery action is taken. Review the Cluster logs to identify the process and investigate which items might cause the process to hang.
                            For more information, see ["Why is my Failover Clustering node blue screening with a Stop 0x0000009E?"](https://blogs.technet.microsoft.com/askcore/2009/06/12/why-is-my-failover-clustering-node-blue-screening-with-a-stop-0x0000009e) Also, see the following Microsoft video [What to do if a 9E occurs](https://www.youtube.com/watch?v=vOJQEdmdSgw). ## Debugging examples ### Example 1 -This bugcheck is caused by a driver hang during upgrade, resulting in a bugcheck D1 in NDIS.sys (a Microsoft driver). The **IMAGE_NAME** will tell you the faulting driver, but since this is Microsoft driver it cannot be replaced or removed. The resolution method is to disable the network device in device manager and try the upgrade again. +This bugcheck is caused by a driver hang during upgrade, resulting in a bugcheck D1 in NDIS.sys (a Microsoft driver). The **IMAGE_NAME** tells you the faulting driver, but since this is Microsoft driver it cannot be replaced or removed. The resolution method is to disable the network device in device manager and try the upgrade again. ``` 2: kd> !analyze -v @@ -389,7 +391,7 @@ ANALYSIS_SESSION_ELAPSED_TIME: 8377 ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:av_ndis!ndisqueueioworkitem FAILURE_ID_HASH: {10686423-afa1-4852-ad1b-9324ac44ac96} -FAILURE_ID_REPORT_LINK: http://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=10686423-afa1-4852-ad1b-9324ac44ac96 +FAILURE_ID_REPORT_LINK: https://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=10686423-afa1-4852-ad1b-9324ac44ac96 Followup: ndiscore --------- ``` @@ -562,7 +564,7 @@ ANALYSIS_SESSION_ELAPSED_TIME: 162bd ANALYSIS_SOURCE: KM FAILURE_ID_HASH_STRING: km:av_r_invalid_wwanusbmp!unknown_function FAILURE_ID_HASH: {31e4d053-0758-e43a-06a7-55f69b072cb3} -FAILURE_ID_REPORT_LINK: http://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=31e4d053-0758-e43a-06a7-55f69b072cb3 +FAILURE_ID_REPORT_LINK: https://go.microsoft.com/fwlink/?LinkID=397724&FailureHash=31e4d053-0758-e43a-06a7-55f69b072cb3 Followup: MachineOwner --------- diff --git a/windows/client-management/troubleshoot-tcpip-connectivity.md b/windows/client-management/troubleshoot-tcpip-connectivity.md index ba947f741a..fe6e32ce59 100644 --- a/windows/client-management/troubleshoot-tcpip-connectivity.md +++ b/windows/client-management/troubleshoot-tcpip-connectivity.md @@ -4,10 +4,12 @@ description: Learn how to troubleshoot TCP/IP connectivity. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: kaushika +ms.author: dansimp ms.date: 12/06/2018 +ms.reviewer: +manager: dansimp --- # Troubleshoot TCP/IP connectivity @@ -87,7 +89,7 @@ The application which is causing the reset (identified by port numbers) should b >The above information is about resets from a TCP standpoint and not UDP. UDP is a connectionless protocol and the packets are sent unreliably. You would not see retransmission or resets when using UDP as a transport protocol. However, UDP makes use of ICMP as a error reporting protocol. When you have the UDP packet sent out on a port and the destination does not have port listed, you will see the destination sending out **ICMP Destination host unreachable: Port unreachable** message immediately after the UDP packet -```typescript +``` 10.10.10.1 10.10.10.2 UDP UDP:SrcPort=49875,DstPort=3343 10.10.10.2 10.10.10.1 ICMP ICMP:Destination Unreachable Message, Port Unreachable,10.10.10.2:3343 @@ -96,7 +98,7 @@ The application which is causing the reset (identified by port numbers) should b During the course of troubleshooting connectivity issue, you might also see in the network trace that a machine receives packets but does not respond to. In such cases, there could be a drop at the server level. You should enable firewall auditing on the machine to understand if the local firewall is dropping the packet. -```typescript +``` auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /failure:enable ``` @@ -106,4 +108,4 @@ You can then review the Security event logs to see for a packet drop on a partic Now, run the command `netsh wfp show state`, this will generate a wfpstate.xml file. Once you open this file and filter for the ID you find in the above event (2944008), you will be able to see a firewall rule name associated with this ID which is blocking the connection. -![Screenshot of wfpstate.xml file](images/tcp-ts-13.png) \ No newline at end of file +![Screenshot of wfpstate.xml file](images/tcp-ts-13.png) diff --git a/windows/client-management/troubleshoot-tcpip-netmon.md b/windows/client-management/troubleshoot-tcpip-netmon.md index 5863c1b847..739c11d55d 100644 --- a/windows/client-management/troubleshoot-tcpip-netmon.md +++ b/windows/client-management/troubleshoot-tcpip-netmon.md @@ -4,10 +4,12 @@ description: Learn how to run Network Monitor to collect data for troubleshootin ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: kaushika +ms.author: dansimp ms.date: 12/06/2018 +ms.reviewer: +manager: dansimp --- # Collect data using Network Monitor diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index 8fb6da7063..a33d808d2f 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -4,10 +4,12 @@ description: Learn how to troubleshoot port exhaustion issues. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: kaushika +ms.author: dansimp ms.date: 12/06/2018 +ms.reviewer: +manager: dansimp --- # Troubleshoot port exhaustion issues @@ -76,9 +78,9 @@ Reboot of the server will resolve the issue temporarily, but you would see all t If you suspect that the machine is in a state of port exhaustion: -1. Try making an outbound connection. From the server/machine, access a remote share or try an RDP to another server or telnet to a server on a port. If the outbound connection fails for all of these, go to the next step. +1. Try making an outbound connection. From the server/machine, access a remote share or try an RDP to another server or telnet to a server on a port. If the outbound connection fails for all of these, go to the next step. -2. Open event viewer and under the system logs, look for the events which clearly indicate the current state: +2. Open event viewer and under the system logs, look for the events which clearly indicate the current state: a. **Event ID 4227** @@ -99,15 +101,17 @@ You may also see CLOSE_WAIT state connections in the same output, however CLOSE_ >[!Note] >Having huge connections in TIME_WAIT state does not always indicate that the server is currently out of ports unless the first two points are verified. Having lot of TIME_WAIT connections does indicate that the process is creating lot of TCP connections and may eventually lead to port exhaustion. > ->Netstat has been updated in Windows 10 with the addition of the **-Q** switch to show ports that have transitioned out of time wait as in the BOUND state. An update for Windows 8.1 and Windows Server 2012R2 has been released that contains this functionality. The PowerShell cmdlet `Get-NetTCPConnection` in Windows 10 also shows these BOUND ports. +>Netstat has been updated in Windows 10 with the addition of the **-Q** switch to show ports that have transitioned out of time wait as in the BOUND state. An update for Windows 8.1 and Windows Server 2012 R2 has been released that contains this functionality. The PowerShell cmdlet `Get-NetTCPConnection` in Windows 10 also shows these BOUND ports. +> +>Until 10/2016, netstat was inaccurate. Fixes for netstat, back-ported to 2012 R2, allowed Netstat.exe and Get-NetTcpConnection to correctly report TCP or UDP port usage in Windows Server 2012 R2. See [Windows Server 2012 R2: Ephemeral ports hotfixes](https://support.microsoft.com/help/3123245/update-improves-port-exhaustion-identification-in-windows-server-2012) to learn more. -4. Open a command prompt in admin mode and run the below command +4. Open a command prompt in admin mode and run the below command - ```cmd - Netsh trace start scenario=netconnection capture=yes tracefile=c:\Server.etl - ``` + ```cmd + Netsh trace start scenario=netconnection capture=yes tracefile=c:\Server.etl + ``` -5. Open the server.etl file with [Network Monitor](troubleshoot-tcpip-netmon.md) and in the filter section, apply the filter **Wscore_MicrosoftWindowsWinsockAFD.AFD_EVENT_BIND.Status.LENTStatus.Code == 0x209**. You should see entries which say **STATUS_TOO_MANY_ADDRESSES**. If you do not find any entries, then the server is still not out of ports. If you find them, then you can confirm that the server is under port exhaustion. +5. Open the server.etl file with [Network Monitor](troubleshoot-tcpip-netmon.md) and in the filter section, apply the filter **Wscore_MicrosoftWindowsWinsockAFD.AFD_EVENT_BIND.Status.LENTStatus.Code == 0x209**. You should see entries which say **STATUS_TOO_MANY_ADDRESSES**. If you do not find any entries, then the server is still not out of ports. If you find them, then you can confirm that the server is under port exhaustion. ## Troubleshoot Port exhaustion @@ -129,12 +133,12 @@ For Windows 7 and Windows Server 2008 R2, you can update your Powershell version If method 1 does not help you identify the process (prior to Windows 10 and Windows Server 2012 R2), then have a look at Task Manager: -1. Add a column called “handles” under details/processes. -2. Sort the column handles to identify the process with the highest number of handles. Usually the process with handles greater than 3000 could be the culprit except for processes like System, lsass.exe, store.exe, sqlsvr.exe. +1. Add a column called “handles” under details/processes. +2. Sort the column handles to identify the process with the highest number of handles. Usually the process with handles greater than 3000 could be the culprit except for processes like System, lsass.exe, store.exe, sqlsvr.exe. ![Screenshot of handles column in Windows Task Maner](images/tcp-ts-21.png) -3. If any other process than these has a higher number, stop that process and then try to login using domain credentials and see if it succeeds. +3. If any other process than these has a higher number, stop that process and then try to login using domain credentials and see if it succeeds. ### Method 3 @@ -143,13 +147,13 @@ If Task Manager did not help you identify the process, then use Process Explorer Steps to use Process explorer: 1. [Download Process Explorer](https://docs.microsoft.com/sysinternals/downloads/process-explorer) and run it **Elevated**. -2. Alt + click the column header, select **Choose Columns**, and on the **Process Performance** tab, add **Handle Count**. -3. Select **View \ Show Lower Pane**. -4. Select **View \ Lower Pane View \ Handles**. -5. Click the **Handles** column to sort by that value. -6. Examine the processes with higher handle counts than the rest (will likely be over 10,000 if you can't make outbound connections). -7. Click to highlight one of the processes with a high handle count. -8. In the lower pane, the handles listed as below are sockets. (Sockets are technically file handles). +2. Alt + click the column header, select **Choose Columns**, and on the **Process Performance** tab, add **Handle Count**. +3. Select **View \ Show Lower Pane**. +4. Select **View \ Lower Pane View \ Handles**. +5. Click the **Handles** column to sort by that value. +6. Examine the processes with higher handle counts than the rest (will likely be over 10,000 if you can't make outbound connections). +7. Click to highlight one of the processes with a high handle count. +8. In the lower pane, the handles listed as below are sockets. (Sockets are technically file handles). File \Device\AFD @@ -192,5 +196,5 @@ goto loop - [Port Exhaustion and You!](https://blogs.technet.microsoft.com/askds/2008/10/29/port-exhaustion-and-you-or-why-the-netstat-tool-is-your-friend/) - this article gives a detail on netstat states and how you can use netstat output to determine the port status -- [Detecting ephemeral port exhaustion](https://blogs.technet.microsoft.com/clinth/2013/08/09/detecting-ephemeral-port-exhaustion/): this article has a script which will run in a loop to report the port status. (Applicable for Windows 2012 R2, Windows 8, Windows 10) +- [Detecting ephemeral port exhaustion](https://blogs.technet.microsoft.com/yongrhee/2018/01/09/windows-server-2012-r2-ephemeral-ports-a-k-a-dynamic-ports-hotfixes/): this article has a script which will run in a loop to report the port status. (Applicable for Windows 2012 R2, Windows 8, Windows 10) diff --git a/windows/client-management/troubleshoot-tcpip-rpc-errors.md b/windows/client-management/troubleshoot-tcpip-rpc-errors.md index c747c000a8..7fd5ff086f 100644 --- a/windows/client-management/troubleshoot-tcpip-rpc-errors.md +++ b/windows/client-management/troubleshoot-tcpip-rpc-errors.md @@ -4,10 +4,12 @@ description: Learn how to troubleshoot Remote Procedure Call (RPC) errors ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: kaushika +ms.author: dansimp ms.date: 12/06/2018 +ms.reviewer: +manager: dansimp --- # Troubleshoot Remote Procedure Call (RPC) errors @@ -18,7 +20,7 @@ You might encounter an **RPC server unavailable** error when connecting to Windo This is a commonly encountered error message in the networking world and one can lose hope very fast without trying to understand much, as to what is happening ‘under the hood’. -Before getting in to troubleshooting the **RPC server unavailable*- error, let’s first understand basics about the error. There are a few important terms to understand: +Before getting in to troubleshooting the *RPC server unavailable- error, let’s first understand basics about the error. There are a few important terms to understand: - Endpoint mapper – a service listening on the server, which guides client apps to server apps by port and UUID. - Tower – describes the RPC protocol, to allow the client and server to negotiate a connection. @@ -71,16 +73,16 @@ With Registry Editor, you can modify the following parameters for RPC. The RPC P In this example ports 5000 through 6000 inclusive have been arbitrarily selected to help illustrate how the new registry key can be configured. This is not a recommendation of a minimum number of ports needed for any particular system. -1. Add the Internet key under: HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc +1. Add the Internet key under: HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc -2. Under the Internet key, add the values "Ports" (MULTI_SZ), "PortsInternetAvailable" (REG_SZ), and "UseInternetPorts" (REG_SZ). +2. Under the Internet key, add the values "Ports" (MULTI_SZ), "PortsInternetAvailable" (REG_SZ), and "UseInternetPorts" (REG_SZ). For example, the new registry key appears as follows: Ports: REG_MULTI_SZ: 5000-6000 PortsInternetAvailable: REG_SZ: Y UseInternetPorts: REG_SZ: Y -3. Restart the server. All applications that use RPC dynamic port allocation use ports 5000 through 6000, inclusive. +3. Restart the server. All applications that use RPC dynamic port allocation use ports 5000 through 6000, inclusive. You should open up a range of ports above port 5000. Port numbers below 5000 may already be in use by other applications and could cause conflicts with your DCOM application(s). Furthermore, previous experience shows that a minimum of 100 ports should be opened, because several system services rely on these RPC ports to communicate with each other. @@ -111,24 +113,24 @@ The best thing to always troubleshoot RPC issues before even getting in to trace Portqry.exe -n -e 135 ``` -This would give you a lot of output to look for, but you should be looking for **ip_tcp*- and the port number in the brackets, which tells whether you were successfully able to get a dynamic port from EPM and also make a connection to it. If the above fails, you can typically start collecting simultaneous network traces. Something like this from the output of “PortQry”: +This would give you a lot of output to look for, but you should be looking for *ip_tcp- and the port number in the brackets, which tells whether you were successfully able to get a dynamic port from EPM and also make a connection to it. If the above fails, you can typically start collecting simultaneous network traces. Something like this from the output of “PortQry”: ```cmd Portqry.exe -n 169.254.0.2 -e 135 ``` Partial output below: ->Querying target system called: ->169.254.0.2 ->Attempting to resolve IP address to a name... ->IP address resolved to RPCServer.contoso.com ->querying... ->TCP port 135 (epmap service): LISTENING ->Using ephemeral source port ->Querying Endpoint Mapper Database... ->Server's response: ->UUID: d95afe70-a6d5-4259-822e-2c84da1ddb0d ->ncacn_ip_tcp:169.254.0.10**[49664]** +> Querying target system called: +> 169.254.0.2 +> Attempting to resolve IP address to a name... +> IP address resolved to RPCServer.contoso.com +> querying... +> TCP port 135 (epmap service): LISTENING +> Using ephemeral source port +> Querying Endpoint Mapper Database... +> Server's response: +> UUID: d95afe70-a6d5-4259-822e-2c84da1ddb0d +> ncacn_ip_tcp:169.254.0.10[49664] The one in bold is the ephemeral port number that you made a connection to successfully. @@ -138,14 +140,14 @@ The one in bold is the ephemeral port number that you made a connection to succe You can run the commands below to leverage Windows inbuilt netsh captures, to collect a simultaneous trace. Remember to execute the below on an “Admin CMD”, it requires elevation. - On the client -```cmd -Netsh trace start scenario=netconnection capture=yes tracefile=c:\client_nettrace.etl maxsize=512 overwrite=yes report=yes -``` + ```cmd + Netsh trace start scenario=netconnection capture=yes tracefile=c:\client_nettrace.etl maxsize=512 overwrite=yes report=yes + ``` - On the Server -```cmd -Netsh trace start scenario=netconnection capture=yes tracefile=c:\server_nettrace.etl maxsize=512 overwrite=yes report=yes -``` + ```cmd + Netsh trace start scenario=netconnection capture=yes tracefile=c:\server_nettrace.etl maxsize=512 overwrite=yes report=yes + ``` Now try to reproduce your issue from the client machine and as soon as you feel the issue has been reproduced, go ahead and stop the traces using the command ```cmd @@ -154,7 +156,7 @@ Netsh trace stop Open the traces in [Microsoft Network Monitor 3.4](troubleshoot-tcpip-netmon.md) or Message Analyzer and filter the trace for -- Ipv4.address== and ipv4.address== and tcp.port==135 or just tcp.port==135 should help. +- `Ipv4.address==` and `ipv4.address==` and `tcp.port==135` or just `tcp.port==135` should help. - Look for the “EPM” Protocol Under the “Protocol” column. @@ -164,7 +166,7 @@ Open the traces in [Microsoft Network Monitor 3.4](troubleshoot-tcpip-netmon.md) - Check if we are connecting successfully to this Dynamic port successfully. -- The filter should be something like this: tcp.port== and ipv4.address== +- The filter should be something like this: `tcp.port==` and `ipv4.address==` ![Screenshot of Network Monitor with filter applied](images/tcp-ts-24.png) diff --git a/windows/client-management/troubleshoot-tcpip.md b/windows/client-management/troubleshoot-tcpip.md index f758b36a67..b6a0283109 100644 --- a/windows/client-management/troubleshoot-tcpip.md +++ b/windows/client-management/troubleshoot-tcpip.md @@ -4,10 +4,12 @@ description: Learn how to troubleshoot TCP/IP issues. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: kaushika +ms.author: dansimp ms.date: 12/06/2018 +ms.reviewer: +manager: dansimp --- # Advanced troubleshooting for TCP/IP issues @@ -17,4 +19,4 @@ In these topics, you will learn how to troubleshoot common problems in a TCP/IP - [Collect data using Network Monitor](troubleshoot-tcpip-netmon.md) - [Troubleshoot TCP/IP connectivity](troubleshoot-tcpip-connectivity.md) - [Troubleshoot port exhaustion issues](troubleshoot-tcpip-port-exhaust.md) -- [Troubleshoot Remote Procedure Call (RPC) errors](troubleshoot-tcpip-rpc-errors.md) \ No newline at end of file +- [Troubleshoot Remote Procedure Call (RPC) errors](troubleshoot-tcpip-rpc-errors.md) diff --git a/windows/client-management/troubleshoot-windows-freeze.md b/windows/client-management/troubleshoot-windows-freeze.md index 81c672993c..664dc7700e 100644 --- a/windows/client-management/troubleshoot-windows-freeze.md +++ b/windows/client-management/troubleshoot-windows-freeze.md @@ -1,20 +1,22 @@ --- title: Advanced troubleshooting for Windows-based computer freeze issues +ms.reviewer: +manager: dansimp description: Learn how to troubleshoot computer freeze issues. ms.prod: w10 ms.mktglfcycl: ms.sitesec: library ms.topic: troubleshooting -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: kaushika +ms.author: dansimp --- # Advanced troubleshooting for Windows-based computer freeze issues This article describes how to troubleshoot freeze issues on Windows-based computers and servers. It also provides methods for collecting data that will help administrators or software developers diagnose, identify, and fix these issues. -> [!Note] +> [!NOTE] > The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products. ## Identify the problem @@ -74,77 +76,77 @@ To collect data for a server freeze, check the following table, and use one or m ### Method 1: Memory dump -> [!Note] +> [!NOTE] > Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur. A complete memory dump file records all the contents of system memory when the computer stops unexpectedly. A complete memory dump file may contain data from processes that were running when the memory dump file was collected. If the computer is no longer frozen and now is running in a good state, use the following steps to enable memory dump so that you can collect memory dump when the freeze issue occurs again. If the virtual machine is still running in a frozen state, use the following steps to enable and collect memory dump. -> [!Note] +> [!NOTE] > If you have a restart feature that is enabled on the computer, such as the Automatic System Restart (ASR) feature in Compaq computers, disable it. This setting is usually found in the BIOS. With this feature enabled, if the BIOS doesn't detect a heartbeat from the operating system, it will restart the computer. The restart can interrupt the dump process. -1. Make sure that the computer is set up to get a complete memory dump file. To do this, follow these steps: +1. Make sure that the computer is set up to get a complete memory dump file. To do this, follow these steps: - 1. Go to **Run** and enter `Sysdm.cpl`, and then press enter. + 1. Go to **Run** and enter `Sysdm.cpl`, and then press enter. - 2. In **System Properties**, on the **Advanced** tab, select **Performance** \> **Settings** \> **Advanced**, and then check or change the virtual memory by clicking **Change**. + 2. In **System Properties**, on the **Advanced** tab, select **Performance** \> **Settings** \> **Advanced**, and then check or change the virtual memory by clicking **Change**. - 2. Go back to **System Properties** \> **Advanced** \> **Settings** in **Startup and Recovery**. + 2. Go back to **System Properties** \> **Advanced** \> **Settings** in **Startup and Recovery**. - 3. In the **Write Debugging Information** section, select **Complete Memory Dump**. + 3. In the **Write Debugging Information** section, select **Complete Memory Dump**. - > [!Note] - > For Windows versions that are earlier than Windows 8 or Windows Server 2012, the Complete Memory Dump type isn't available in the GUI. You have to change it in Registry Editor. To do this, change the value of the following **CrashDumpEnabled** registry entry to **1** (REG_DWORD): - >**HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\CrashDumpEnabled** + > [!NOTE] + > For Windows versions that are earlier than Windows 8 or Windows Server 2012, the Complete Memory Dump type isn't available in the GUI. You have to change it in Registry Editor. To do this, change the value of the following **CrashDumpEnabled** registry entry to **1** (REG_DWORD): + >**HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\CrashDumpEnabled** - 4. Select **Overwrite any existing file**. + 4. Select **Overwrite any existing file**. - 5. Make sure that there's a paging file (pagefile.sys) on the system drive and that it’s at least 100 megabytes (MB) over the installed RAM (Initial and Maximum Size). + 5. Make sure that there's a paging file (pagefile.sys) on the system drive and that it’s at least 100 megabytes (MB) over the installed RAM (Initial and Maximum Size). - Additionally, you can use the workaround for [space limitations on the system drive in Windows Server 2008](#space-limitations-on-the-system-drive-in-windows-server-2008). + Additionally, you can use the workaround for [space limitations on the system drive in Windows Server 2008](#space-limitations-on-the-system-drive-in-windows-server-2008). - 6. Make sure that there's more available space on the system drive than there is physical RAM. + 6. Make sure that there's more available space on the system drive than there is physical RAM. -2. Enable the CrashOnCtrlScroll registry value to allow the system to generate a dump file by using the keyboard. To do this, follow these steps: +2. Enable the CrashOnCtrlScroll registry value to allow the system to generate a dump file by using the keyboard. To do this, follow these steps: - 1. Go to Registry Editor, and then locate the following registry keys: + 1. Go to Registry Editor, and then locate the following registry keys: * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters` * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters` - 2. Create the following CrashOnCtrlScroll registry entry in the two registry keys: + 2. Create the following CrashOnCtrlScroll registry entry in the two registry keys: - - **Value Name**: `CrashOnCtrlScroll` - - **Data Type**: `REG_DWORD` - - **Value**: `1` + - **Value Name**: `CrashOnCtrlScroll` + - **Data Type**: `REG_DWORD` + - **Value**: `1` - 3. Exit Registry Editor. + 3. Exit Registry Editor. - 4. Restart the computer. + 4. Restart the computer. -3. On some physical computers, you may generate a nonmakeable interruption (NMI) from the Web Interface feature (such as DRAC, iLo, and RSA). However, by default, this setting will stop the system without creating a memory dump. +3. On some physical computers, you may generate a nonmakeable interruption (NMI) from the Web Interface feature (such as DRAC, iLo, and RSA). However, by default, this setting will stop the system without creating a memory dump. - To allow the operating system to generate a memory dump file at an NMI interruption, set the value of the [NMICrashDump](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc783271(v=ws.10)) registry entry to `1` (REG_DWORD). Then, restart the computer to apply this change. + To allow the operating system to generate a memory dump file at an NMI interruption, set the value of the [NMICrashDump](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc783271(v=ws.10)) registry entry to `1` (REG_DWORD). Then, restart the computer to apply this change. - > [!Note] - > This is applicable only for Windows 7, Windows Server 2008 R2, and earlier versions of Windows. For Windows 8 Windows Server 2012, and later versions of Windows, the NMICrashDump registry key is no longer required, and an NMI interruption will result in [a Stop error that follows a memory dump data collection](https://support.microsoft.com/help/2750146). + > [!NOTE] + > This is applicable only for Windows 7, Windows Server 2008 R2, and earlier versions of Windows. For Windows 8 Windows Server 2012, and later versions of Windows, the NMICrashDump registry key is no longer required, and an NMI interruption will result in [a Stop error that follows a memory dump data collection](https://support.microsoft.com/help/2750146). -4. When the computer exhibits the problem, hold down the right **Ctrl** key, and press the **Scroll Lock** key two times to generate a memory dump file. +4. When the computer exhibits the problem, hold down the right **Ctrl** key, and press the **Scroll Lock** key two times to generate a memory dump file. - > [!Note] - > By default, the dump file is located in the following path:
                            - > %SystemRoot%\MEMORY.DMP + > [!NOTE] + > By default, the dump file is located in the following path:
                            + > %SystemRoot%\MEMORY.DMP ### Method 2: Data sanity check Use the Dump Check Utility (Dumpchk.exe) to read a memory dump file or verify that the file was created correctly. You can use the Microsoft DumpChk (Crash Dump File Checker) tool to verify that the memory dump files are not corrupted or invalid. -- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk) -- [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk) +- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk) +- [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk) Learn how to use Dumpchk.exe to check your dump files: @@ -185,65 +187,65 @@ The Performance Monitor log is located in the path: C:\PERFLOGS #### Use memory dump to collect data for the physical computer that's running in a frozen state -> [!Warning] +> [!WARNING] > Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur. If the physical computer is still running in a frozen state, follow these steps to enable and collect memory dump: -1. Make sure that the computer is set up to get a complete memory dump file and that you can access it through the network. To do this, follow these steps: - > [!Note] - > If it isn't possible to access the affected computer through the network, try to generate a memory dump file through NMI interruption. The result of the action may not collect a memory dump file if some of the following settings aren't qualified. +1. Make sure that the computer is set up to get a complete memory dump file and that you can access it through the network. To do this, follow these steps: + > [!NOTE] + > If it isn't possible to access the affected computer through the network, try to generate a memory dump file through NMI interruption. The result of the action may not collect a memory dump file if some of the following settings aren't qualified. - 1. Try to access the desktop of the computer by any means. + 1. Try to access the desktop of the computer by any means. - > [!Note] - > In case accessing the operating system isn't possible, try to access Registry Editor on the computer remotely in order to check the type of memory dump file and page file with which the computer is currently configured. + > [!NOTE] + > In case accessing the operating system isn't possible, try to access Registry Editor on the computer remotely in order to check the type of memory dump file and page file with which the computer is currently configured. - 2. From a remote computer that is preferably in the same network and subnet, go to **Registry Editor** \> **Connect Network Registry**. Then, connect to the concerned computer, and verify the following settings: + 2. From a remote computer that is preferably in the same network and subnet, go to **Registry Editor** \> **Connect Network Registry**. Then, connect to the concerned computer, and verify the following settings: - * ` `*HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\CrashDumpEnabled` + * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\CrashDumpEnabled` - Make sure that the [CrashDumpEnabled](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-2000-server/cc976050(v=technet.10)) registry entry is `1`. + Make sure that the [CrashDumpEnabled](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-2000-server/cc976050(v=technet.10)) registry entry is `1`. - * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\NMICrashDump` + * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl\NMICrashDump` - On some physical servers, if the NMICrashDump registry entry exists and its value is `1`, you may take advantage of the NMI from the remote management capabilities (such as DRAC, iLo, and RSA). + On some physical servers, if the NMICrashDump registry entry exists and its value is `1`, you may take advantage of the NMI from the remote management capabilities (such as DRAC, iLo, and RSA). - * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PagingFiles and ExistingPageFiles` + * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PagingFiles and ExistingPageFiles` - If the value of the **Pagefile** registry entry is system managed, the size won't be reflected in the registry (Example value: ?:\pagefile.sys). + If the value of the **Pagefile** registry entry is system managed, the size won't be reflected in the registry (Example value: ?:\pagefile.sys). - If the page file is customized, the size will be reflected in the registry, such as ‘?:\pagefile.sys 1024 1124’ where 1024 is the initial size and 1124 is the max size. + If the page file is customized, the size will be reflected in the registry, such as ‘?:\pagefile.sys 1024 1124’ where 1024 is the initial size and 1124 is the max size. - > [!Note] - > If the size isn't reflected in the Registry, try to access an Administrative share where the page file is located (such as \\\\**ServerName**\C$). + > [!NOTE] + > If the size isn't reflected in the Registry, try to access an Administrative share where the page file is located (such as \\\\**ServerName**\C$). - 3. Make sure that there's a paging file (pagefile.sys) on the system drive of the computer, and it's at least 100 MB over the installed RAM. + 3. Make sure that there's a paging file (pagefile.sys) on the system drive of the computer, and it's at least 100 MB over the installed RAM. - 4. Make sure that there's more free space on the hard disk drives of the computer than there is physical RAM. + 4. Make sure that there's more free space on the hard disk drives of the computer than there is physical RAM. -2. Enable the **CrashOnCtrlScroll** registry value on the computer to allow the system to generate a dump file by using the keyboard. To do this, follow these steps: +2. Enable the **CrashOnCtrlScroll** registry value on the computer to allow the system to generate a dump file by using the keyboard. To do this, follow these steps: - 1. From a remote computer preferably in the same network and subnet, go to Registry Editor \> Connect Network Registry. Connect to the concerned computer and locate the following registry keys: + 1. From a remote computer preferably in the same network and subnet, go to Registry Editor \> Connect Network Registry. Connect to the concerned computer and locate the following registry keys: - * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters` + * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters` - * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters` + * `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters` - 2. Create the following CrashOnCtrlScroll registry entry in the two registry keys: + 2. Create the following CrashOnCtrlScroll registry entry in the two registry keys: - **Value Name**: `CrashOnCtrlScroll` - **Data Type**: `REG_DWORD` - **Value**: `1` + **Value Name**: `CrashOnCtrlScroll` + **Data Type**: `REG_DWORD` + **Value**: `1` - 3. Exit Registry Editor. + 3. Exit Registry Editor. - 4. Restart the computer. + 4. Restart the computer. -3. When the computer exhibits the problem, hold down the right **CTRL** key, and press the **Scroll Lock** key two times to generate a memory dump. - > [!Note] - > By default, the dump file is located in the path: %SystemRoot%\MEMORY.DMP +3. When the computer exhibits the problem, hold down the right **CTRL** key, and press the **Scroll Lock** key two times to generate a memory dump. + > [!NOTE] + > By default, the dump file is located in the path: %SystemRoot%\MEMORY.DMP ### Use Pool Monitor to collect data for the physical computer that is no longer frozen @@ -265,7 +267,7 @@ To debug the virtual machines on Hyper-V, run the following cmdlet in Windows Po Debug-VM -Name "VM Name" -InjectNonMaskableInterrupt -ComputerName Hostname ``` -> [!Note] +> [!NOTE] > This method is applicable only to Windows 8, Windows Server 2012, and later versions of Windows virtual machines. For the earlier versions of Windows, see methods 1 through 4 that are described earlier in this section. #### VMware @@ -282,4 +284,4 @@ On Windows Server 2008, you may not have enough free disk space to generate a co Additionally, on Windows Server 2008 Service Pack (SP2), there's a second option if the system drive doesn't have sufficient space. Namely, you can use the DedicatedDumpFile registry entry. To learn how to use the registry entry, see [New behavior in Windows Vista and Windows Server 2008](https://support.microsoft.com/help/969028). -For more information, see [How to use the DedicatedDumpFile registry value to overcome space limitations on the system drive](http://blogs.msdn.com/b/ntdebugging/archive/2010/04/02/how-to-use-the-dedicateddumpfile-registry-value-to-overcome-space-limitations-on-the-system-drive-when-capturing-a-system-memory-dump.aspx). \ No newline at end of file +For more information, see [How to use the DedicatedDumpFile registry value to overcome space limitations on the system drive](http://blogs.msdn.com/b/ntdebugging/archive/2010/04/02/how-to-use-the-dedicateddumpfile-registry-value-to-overcome-space-limitations-on-the-system-drive-when-capturing-a-system-memory-dump.aspx). diff --git a/windows/client-management/troubleshoot-windows-startup.md b/windows/client-management/troubleshoot-windows-startup.md index 47d03fef10..308677bcef 100644 --- a/windows/client-management/troubleshoot-windows-startup.md +++ b/windows/client-management/troubleshoot-windows-startup.md @@ -4,16 +4,50 @@ description: Learn how to troubleshoot Windows start-up issues. ms.prod: w10 ms.sitesec: library ms.topic: troubleshooting -author: kaushika-msft +author: dansimp ms.localizationpriority: medium -ms.author: kaushika +ms.author: dansimp ms.date: +ms.reviewer: +manager: dansimp --- # Advanced troubleshooting for Windows start-up issues -In these topics, you will learn how to troubleshoot common problems related to Windows start-up. +In these topics, you will learn how to troubleshoot common problems that are related to Windows startup. -- [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md) -- [Advanced troubleshooting for Stop error or blue screen error](troubleshoot-stop-errors.md) -- [Advanced troubleshooting for Windows-based computer freeze issues](troubleshoot-windows-freeze.md) +## How it works + +When Microsoft Windows experiences a condition that compromises safe system operation, the system halts. These Windows startup problems are categorized in the following groups: + +- Bug check: Also commonly known as a system crash, a kernel error, or a Stop error. + +- No boot: The system may not produce a bug check but is unable to start up into Windows. + +- Freeze: Also known as "system hang". + +## Best practices + +To understand the underlying cause of Windows startup problems, it's important that the system be configured correctly. Here are some best practices for configuration: + +### Page file settings + +- [Introduction of page file](introduction-page-file.md) + +- [How to determine the appropriate page file size for 64-bit versions of Windows](determine-appropriate-page-file-size.md) + +### Memory dump settings + +- [Configure system failure and recovery options in Windows](system-failure-recovery-options.md) + +- [Generate a kernel or complete crash dump](generate-kernel-or-complete-crash-dump.md) + +## Troubleshooting + +These articles will walk you through the resources you need to troubleshoot Windows startup issues: + +- [Advanced troubleshooting for Windows boot problems](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-boot-problems) + +- [Advanced troubleshooting for Stop error or blue screen error](https://docs.microsoft.com/windows/client-management/troubleshoot-stop-errors) + +- [Advanced troubleshooting for Windows-based computer freeze issues](https://docs.microsoft.com/windows/client-management/troubleshoot-windows-freeze) diff --git a/windows/client-management/windows-10-mobile-and-mdm.md b/windows/client-management/windows-10-mobile-and-mdm.md index b206069663..afb9c4241f 100644 --- a/windows/client-management/windows-10-mobile-and-mdm.md +++ b/windows/client-management/windows-10-mobile-and-mdm.md @@ -2,13 +2,16 @@ title: Windows 10 Mobile deployment and management guide (Windows 10) description: This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. ms.assetid: 6CAA1004-CB65-4FEC-9B84-61AAD2125E5E +ms.reviewer: +manager: dansimp +ms.author: dansimp keywords: Mobile, diagnostic data, BYOD, MDM ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile, devices, security ms.localizationpriority: medium -author: AMeeus +author: dansimp ms.date: 01/26/2019 ms.topic: article --- @@ -24,17 +27,17 @@ Employees increasingly depend on smartphones to complete daily work tasks, but t Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement using a comprehensive mobile device management solution. **In this article** -- [Deploy](#deploy) -- [Configure](#configure) -- [Apps](#apps) -- [Manage](#manage) -- [Retire](#retire) +- [Deploy](#deploy) +- [Configure](#configure) +- [Apps](#apps) +- [Manage](#manage) +- [Retire](#retire) ## Deploy Windows 10 Mobile has a built-in device management client to deploy, configure, maintain, and support smartphones. Common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT), this client provides a single interface through which Mobile Device Management (MDM) solutions can manage any device that runs Windows 10. Because the MDM client integrates with identity management, the effort required to manage devices throughout the lifecycle is greatly reduced. -Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or System Center Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select whichever system best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050). +Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or Microsoft Endpoint Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select whichever system best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](https://go.microsoft.com/fwlink/p/?LinkId=734050). ### Deployment scenarios @@ -105,7 +108,7 @@ MDM enrollment can also be initiated with a provisioning package. This option en Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen will determine who controls the device and influence your management capabilities. ->**Note:** Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, etc. Both an [MSA](https://www.microsoft.com/en-us/account/) and an [Azure AD account](https://www.microsoft.com/en-us/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) give access to these services. +>**Note:** Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, etc. Both an [MSA](https://www.microsoft.com/account/) and an [Azure AD account](https://www.microsoft.com/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) give access to these services. The following table describes the impact of identity choice on device management characteristics of the personal and corporate device scenarios. @@ -183,8 +186,7 @@ For both personal and corporate deployment scenarios, an MDM system is the essen Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](https://azure.microsoft.com/documentation/articles/active-directory-editions/)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. **Mobile Device Management** -Microsoft [Intune](https://www.microsoft.com/en-us/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. -You can also integrate Intune with Configuration Manager to gain a single console for managing all devices in the cloud and on premises, mobile or PC. For more information, see [Manage Mobile Devices with Configuration Manager and Microsoft Intune](https://technet.microsoft.com/library/jj884158.aspx). For guidance on choosing between a stand-alone Intune installation and Intune integrated with System Center Configuration Manager, see Choose between Intune by itself or integrating Intune with System Center Configuration Manager. +Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Like Office 365, Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Office 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. MDM providers that support Windows 10 Mobile currently include: AirWatch, Citrix, MobileIron, SOTI, Blackberry and others. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. >**Note:** Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Office 365. @@ -277,7 +279,7 @@ Employees are usually allowed to change certain personal device settings that yo *Applies to: Corporate devices* -Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi Fi. You can use hardware restrictions to control the availability of these features. +Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi-Fi. You can use hardware restrictions to control the availability of these features. The following lists the MDM settings that Windows 10 Mobile supports to configure hardware restrictions. @@ -300,30 +302,30 @@ The following lists the MDM settings that Windows 10 Mobile supports to configur *Applies to: Personal and corporate devices* -Certificates help improve security by providing account authentication, Wi Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation. +Certificates help improve security by providing account authentication, Wi-Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation. To install certificates manually, you can post them on Microsoft Edge website or send them directly via email, which is ideal for testing purposes. Using SCEP and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device (as long as the MDM system supports the Simple Certificate Enrollment Protocol (SCEP) or Personal Information Exchange (PFX)). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. The table below lists the Windows 10 Mobile PFX certificate deployment settings. Get more detailed information about MDM certificate management in the [Client Certificate Install CSP](https://msdn.microsoft.com/library/windows/hardware/dn920023(v=vs.85).aspx) and [Install digital certificates on Windows 10 Mobile](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile). -Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidently. +Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidentally. ->**Note:** To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Microsoft Store. This Windows 10 Mobile app can help you: -- View a summary of all personal certificates -- View the details of individual certificates -- View the certificates used for VPN, Wi-Fi, and email authentication -- Identify which certificates may have expired -- Verify the certificate path and confirm that you have the correct intermediate and root CA certificates -- View the certificate keys stored in the device TPM +> **Note:** To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Microsoft Store. This Windows 10 Mobile app can help you: +> - View a summary of all personal certificates +> - View the details of individual certificates +> - View the certificates used for VPN, Wi-Fi, and email authentication +> - Identify which certificates may have expired +> - Verify the certificate path and confirm that you have the correct intermediate and root CA certificates +> - View the certificate keys stored in the device TPM ### Wi-Fi profiles *Applies to: Corporate and personal devices* -Wi-Fi is used on mobile devices as much as, or more than, cellular data connections. Most corporate Wi Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi Fi information is difficult for typical users to configure, but MDM systems can fully configure these Wi-Fi profiles without user intervention. +Wi-Fi is used on mobile devices as much as, or more than, cellular data connections. Most corporate Wi-Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi-Fi information is difficult for typical users to configure, but MDM systems can fully configure these Wi-Fi profiles without user intervention. You can create multiple Wi-Fi profiles in your MDM system. The below table lists the Windows 10 Mobile Wi Fi connection profile settings that can be configured by administrators. -- **SSID** The case-sensitive name of the Wi Fi network Service Set Identifier -- **Security type** The type of security the Wi Fi network uses; can be one of the following authentication types: +- **SSID** The case-sensitive name of the Wi-Fi network Service Set Identifier +- **Security type** The type of security the Wi-Fi network uses; can be one of the following authentication types: - Open 802.11 - Shared 802.11 - WPA-Enterprise 802.11 @@ -338,13 +340,13 @@ You can create multiple Wi-Fi profiles in your MDM system. The below table lists - **Extensible Authentication Protocol Transport Layer Security (EAP-TLS)** WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use EAP-TLS with certificates for authentication - **Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MSCHAPv2)** WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use PEAP-MSCHAPv2 with a user name and password for authentication - **Shared key** WPA-Personal 802.11 and WPA2-Personal 802.11 security types can use a shared key for authentication. -- **Proxy** The configuration of any network proxy that the Wi Fi connection requires (to specify the proxy server, use its fully qualified domain name [FQDN], Internet Protocol version 4 [IPv4] address, IP version 6 [IPv6] address, or IPvFuture address) -- **Disable Internet connectivity checks** Whether the Wi Fi connection should check for Internet connectivity +- **Proxy** The configuration of any network proxy that the Wi-Fi connection requires (to specify the proxy server, use its fully qualified domain name [FQDN], Internet Protocol version 4 [IPv4] address, IP version 6 [IPv6] address, or IPvFuture address) +- **Disable Internet connectivity checks** Whether the Wi-Fi connection should check for Internet connectivity - **Proxy auto-configuration URL** A URL that specifies the proxy auto-configuration file - **Enable Web Proxy Auto-Discovery Protocol (WPAD)** Specifies whether WPAD is enabled In addition, you can set a few device wide Wi-Fi settings. -- **Allow Auto Connect to Wi Fi Sense Hotspots** Whether the device will automatically detect and connect to Wi-Fi networks +- **Allow Auto Connect to Wi-Fi Sense Hotspots** Whether the device will automatically detect and connect to Wi-Fi networks - **Allow Manual Wi-Fi Configuration** Whether the user can manually configure Wi-Fi settings - **Allow Wi-Fi** Whether the Wi-Fi hardware is enabled - **Allow Internet Sharing** Allow or disallow Internet sharing @@ -362,18 +364,18 @@ You can define and deploy APN profiles in MDM systems that configure cellular da - **APN name** The APN name - *IP connection type* The IP connection type; set to one of the following values: - - IPv4 only - - IPv6 only - - IPv4 and IPv6 concurrently - - IPv6 with IPv4 provided by 46xlat + - IPv4 only + - IPv6 only + - IPv4 and IPv6 concurrently + - IPv6 with IPv4 provided by 46xlat - **LTE attached** Whether the APN should be attached as part of an LTE Attach - **APN class ID** The globally unique identifier that defines the APN class to the modem - **APN authentication type** The APN authentication type; set to one of the following values: - - None - - Auto - - PAP - - CHAP - - MSCHAPv2 + - None + - Auto + - PAP + - CHAP + - MSCHAPv2 - **User name** The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type - **Password** The password for the user account specified in User name - **Integrated circuit card ID** The integrated circuit card ID associated with the cellular connection profile @@ -631,12 +633,12 @@ The following settings for Microsoft Edge on Windows 10 Mobile can be managed. - **Allow InPrivate** Whether users can use InPrivate browsing - **Allow Password Manager** Whether users can use Password Manager to save and manage passwords locally - **Allow Search Suggestions in Address Bar** Whether search suggestions are shown in the address bar -- **Allow SmartScreen** Whether SmartScreen Filter is enabled +- **Allow Windows Defender SmartScreen** Whether Windows Defender SmartScreen is enabled - **Cookies** Whether cookies are allowed - **Favorites** Configure Favorite URLs - **First Run URL** The URL to open when a user launches Microsoft Edge for the first time -- **Prevent SmartScreen Prompt Override** Whether users can override the SmartScreen warnings for URLs -- **Prevent Smart Screen Prompt Override for Files** Whether users can override the SmartScreen warnings for files +- **Prevent Windows Defender SmartScreen Prompt Override** Whether users can override the Windows Defender SmartScreen warnings for URLs +- **Prevent Smart Screen Prompt Override for Files** Whether users can override the Windows Defender SmartScreen warnings for files ## Manage @@ -708,7 +710,7 @@ Microsoft aspires to update Windows 10 Mobile devices with the latest updates au Wi-Fi Device is connected to a personal or corporate Wi-Fi network (no data charges) Yes -Yes/td> +Yes/td> Yes Yes – outside of Active Hours (forced restart after 7 days if user postpones restart) @@ -768,7 +770,7 @@ Update availability depends on what servicing option you choose for the device. Windows Insider Builds As appropriate during development cycle, released to Windows Insiders only Variable, until the next Insider build is released to Windows Insiders -Allows Insiders to test new feature and application compatibility before a Feature Update is released/td> +Allows Insiders to test new feature and application compatibility before a Feature Update is released/td> Mobile @@ -776,7 +778,7 @@ Update availability depends on what servicing option you choose for the device. Immediately after the Feature Update is published to Windows Update by Microsoft Microsoft typically releases two Feature Updates per 12-month period (approximately every four months, though it can potentially be longer) Makes new features available to users as soon as possible -Mobile & Mobile Enterprise +Mobile & Mobile Enterprise Current Branch for Business (CBB) @@ -955,7 +957,7 @@ DHA-enabled device management solutions help IT managers create a unified securi For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](/windows/device-security/windows-10-mobile-security-guide). -Thisis a lists of attributes that are supported by DHA and can trigger the corrective actions mentioned above. +This is a list of attributes that are supported by DHA and can trigger the corrective actions mentioned above. - **Attestation Identity Key (AIK) present** Indicates that an AIK is present (i.e., the device can be trusted more than a device without an AIK). - **Data Execution Prevention (DEP) enabled** Whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy. - **BitLocker status** BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker. @@ -975,12 +977,12 @@ Thisis a lists of attributes that are supported by DHA and can trigger the corre Windows 10 mobile has protective measures that work together and integrate with Microsoft Intune or third-party Mobile Device Management (MDM) solutions. IT administrators can monitor and verify compliance to ensure corporate resources are protected end-to–end with the security and trust rooted in the physical hardware of the device. Here is what occurs when a smartphone is turned on: -1. Windows 10 Secure Boot protects the boot sequence, enables the device to boot into a defined and trusted configuration, and loads a factory trusted boot loader. -2. Windows 10 Trusted Boot takes control, verifies the digital signature of the Windows kernel, and the components are loaded and executed during the Windows startup process. -3. In parallel to Steps 1 and 2, Windows 10 Mobile TPM (Trusted Platform Modules – measured boot) runs independently in a hardware-protected security zone (isolated from boot execution path monitors boot activities) to create an integrity protected and tamper evident audit trail - signed with a secret that is only accessible by TPM. -4. Devices managed by a DHA-enabled MDM solution send a copy of this audit trail to Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. -5. Microsoft HAS reviews the audit trails, issues an encrypted/signed report, and forwards it to the device. -6. IT managers can use a DHA-enabled MDM solution to review the report in a protected, tamper-resistant and tamper-evident communication channel. They can assess if a device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with security needs and enterprise policies. +1. Windows 10 Secure Boot protects the boot sequence, enables the device to boot into a defined and trusted configuration, and loads a factory trusted boot loader. +2. Windows 10 Trusted Boot takes control, verifies the digital signature of the Windows kernel, and the components are loaded and executed during the Windows startup process. +3. In parallel to Steps 1 and 2, Windows 10 Mobile TPM (Trusted Platform Modules – measured boot) runs independently in a hardware-protected security zone (isolated from boot execution path monitors boot activities) to create an integrity protected and tamper evident audit trail - signed with a secret that is only accessible by TPM. +4. Devices managed by a DHA-enabled MDM solution send a copy of this audit trail to Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. +5. Microsoft HAS reviews the audit trails, issues an encrypted/signed report, and forwards it to the device. +6. IT managers can use a DHA-enabled MDM solution to review the report in a protected, tamper-resistant and tamper-evident communication channel. They can assess if a device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with security needs and enterprise policies. ### Asset reporting diff --git a/windows/client-management/windows-10-support-solutions.md b/windows/client-management/windows-10-support-solutions.md index 797e4ea336..8c30018235 100644 --- a/windows/client-management/windows-10-support-solutions.md +++ b/windows/client-management/windows-10-support-solutions.md @@ -1,97 +1,134 @@ --- -title: Top support solutions for Windows 10 -description: Get links to solutions for Windows 10 issues +title: Troubleshooting Windows 10 +description: Get links to troubleshooting articles for Windows 10 issues +ms.reviewer: kaushika +manager: dansimp ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -ms.author: elizapo +ms.author: kaushika author: kaushika-msft ms.localizationpriority: medium ms.topic: troubleshooting --- -# Troubleshoot Windows 10 clients +# Troubleshoot Windows 10 client -This section contains advanced troubleshooting topics and links to help you resolve issues with Windows 10 clients. Additional topics will be added as they become available. +Microsoft regularly releases both updates for Windows Server. To ensure your servers can receive future updates, including security updates, it's important to keep your servers updated. Check out - [Windows 10 and Windows Server 2016 update history](https://support.microsoft.com/en-us/help/4000825/windows-10-windows-server-2016-update-history) for a complete list of released updates. -## Troubleshooting support topics +This section contains advanced troubleshooting topics and links to help you resolve issues with Windows 10 in an enterprise or IT pro environment. Additional topics will be added as they become available. -- [Advanced troubleshooting for Windows networking](troubleshoot-networking.md)
                            - - [Advanced troubleshooting wireless network connectivity](advanced-troubleshooting-wireless-network-connectivity.md)
                            - - [Advanced troubleshooting 802.1X authentication](advanced-troubleshooting-802-authentication.md)
                            - - [Data collection for troubleshooting 802.1X authentication](data-collection-for-802-authentication.md)
                            - - [Advanced troubleshooting for TCP/IP](troubleshoot-tcpip.md)
                            - - [Collect data using Network Monitor](troubleshoot-tcpip-netmon.md)
                            - - [Troubleshoot TCP/IP connectivity](troubleshoot-tcpip-connectivity.md)
                            - - [Troubleshoot port exhaustion](troubleshoot-tcpip-port-exhaust.md)
                            - - [Troubleshoot Remote Procedure Call (RPC) errors](troubleshoot-tcpip-rpc-errors.md)
                            -- [Advanced troubleshooting for Windows startup](troubleshoot-windows-startup.md)
                            - - [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
                            - - [Advanced troubleshooting for Windows-based computer issues](troubleshoot-windows-freeze.md)
                            - - [Advanced troubleshooting for stop errors or blue screen errors](troubleshoot-stop-errors.md)
                            - - [Advanced troubleshooting for stop error 7B or Inaccessible_Boot_Device](troubleshoot-inaccessible-boot-device.md)
                            +## Troubleshoot 802.1x Authentication +- [Advanced Troubleshooting 802.1X Authentication](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-802-authentication) +- [Data collection for troubleshooting 802.1X authentication](https://docs.microsoft.com/windows/client-management/data-collection-for-802-authentication) -## Windows 10 update history +## Troubleshoot BitLocker +- [Guidelines for troubleshooting BitLocker](https://docs.microsoft.com/windows/security/information-protection/bitlocker/troubleshoot-bitlocker) +- [BitLocker cannot encrypt a drive: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues) +- [Enforcing BitLocker policies by using Intune: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues) +- [BitLocker Network Unlock: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues) +- [BitLocker recovery: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues) +- [BitLocker configuration: known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues) +- [BitLocker cannot encrypt a drive: known TPM issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues) +- [BitLocker and TPM: other known issues](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues) +- [Decode Measured Boot logs to track PCR changes](https://docs.microsoft.com/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs) +- [BitLocker frequently asked questions (FAQ)](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions) -Microsoft regularly releases both updates and solutions for Windows 10. To ensure your computers can receive future updates, including security updates, it's important to keep them updated. Check out the following links for a complete list of released updates: +## Troubleshoot Bugcheck and Stop errors +- [Introduction to the page file](https://docs.microsoft.com/windows/client-management/introduction-page-file) +- [How to determine the appropriate page file size for 64-bit versions of Windows](https://docs.microsoft.com/windows/client-management/determine-appropriate-page-file-size) +- [Configure system failure and recovery options in Windows](https://docs.microsoft.com/windows/client-management/system-failure-recovery-options) +- [Generate a kernel or complete crash dump](https://docs.microsoft.com/windows/client-management/generate-kernel-or-complete-crash-dump) +- [Advanced troubleshooting for Stop error or blue screen error issue](https://docs.microsoft.com/windows/client-management/troubleshoot-stop-errors) +- [Advanced troubleshooting for Stop error 7B or Inaccessible_Boot_Device](https://docs.microsoft.com/windows/client-management/troubleshoot-inaccessible-boot-device) +- [Blue Screen Data - Windows drivers](https://docs.microsoft.com/windows-hardware/drivers/debugger/blue-screen-data) +- [Bug Check Code Reference - Windows drivers](https://docs.microsoft.com/windows-hardware/drivers/debugger/bug-check-code-reference2) -- [Windows 10 version 1809 update history](https://support.microsoft.com/help/4464619) -- [Windows 10 version 1803 update history](https://support.microsoft.com/help/4099479) -- [Windows 10 version 1709 update history](https://support.microsoft.com/help/4043454) -- [Windows 10 Version 1703 update history](https://support.microsoft.com/help/4018124) -- [Windows 10 Version 1607 update history](https://support.microsoft.com/help/4000825) -- [Windows 10 Version 1511 update history](https://support.microsoft.com/help/4000824) +## Troubleshoot Credential Guard +- [Windows Defender Credential Guard - Known issues (Windows 10)](https://docs.microsoft.com/windows/security/identity-protection/credential-guard/credential-guard-known-issues) + +## Troubleshoot Disks +- [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) +- [Windows and GPT FAQ](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-and-gpt-faq) + +## Troubleshoot Kiosk mode +- [Troubleshoot kiosk mode issues](https://docs.microsoft.com/windows/configuration/kiosk-troubleshoot) + +## Troubleshoot No Boot +- [Advanced troubleshooting for Windows boot problems](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-boot-problems) + +## Troubleshoot Push Button Reset +- [Push-button reset frequently-asked questions (FAQ)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/pbr-faq) +- [Push-button reset frequently-asked questions (FAQ)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/pbr-validation) +- [Recovery components](https://docs.microsoft.com/windows-hardware/manufacture/desktop/recovery-strategy-for-common-customizations) + +### Troubleshoot Power Management +- [Modern Standby FAQs](https://docs.microsoft.com/windows-hardware/design/device-experiences/modern-standby-faqs) -These are the top Microsoft Support solutions for the most common issues experienced when using Windows 10 in an enterprise or IT pro environment. The links below include links to KB articles, updates, and library articles. - -## Solutions related to installing Windows Updates - -- [How does Windows Update work](https://docs.microsoft.com/en-us/windows/deployment/update/how-windows-update-works) -- [Windows Update log files](https://docs.microsoft.com/en-us/windows/deployment/update/windows-update-logs) -- [Windows Update troubleshooting](https://docs.microsoft.com/en-us/windows/deployment/update/windows-update-troubleshooting) -- [Windows Update common errors and mitigation](https://docs.microsoft.com/en-us/windows/deployment/update/windows-update-errors) -- [Windows Update - additional resources](https://docs.microsoft.com/en-us/windows/deployment/update/windows-update-resources) - -## Solutions related to installing or upgrading Windows - -- [Quick Fixes](https://docs.microsoft.com/en-us/windows/deployment/upgrade/quick-fixes) -- [Troubleshooting upgrade errors](https://docs.microsoft.com/en-us/windows/deployment/upgrade/troubleshoot-upgrade-errors) -- [Resolution procedures](https://docs.microsoft.com/en-us/windows/deployment/upgrade/resolution-procedures) -- [0xc1800118 error when you push Windows 10 Version 1607 by using WSUS](https://support.microsoft.com/en-in/help/3194588/0xc1800118-error-when-you-push-windows-10-version-1607-by-using-wsus) -- [0xC1900101 error when Windows 10 upgrade fails after the second system restart](https://support.microsoft.com/en-in/help/3208485/0xc1900101-error-when-windows-10-upgrade-fails-after-the-second-system) - -## Solutions related to BitLocker - -- [BitLocker recovery guide](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan) -- [BitLocker: How to enable Network Unlock](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock) -- [BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker) -- [BitLocker Group Policy settings](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings) - -## Solutions related to Bugchecks or Stop Errors -- [Troubleshooting Stop error problems for IT Pros](https://support.microsoft.com/help/3106831/troubleshooting-stop-error-problems-for-it-pros) -- [How to use Windows Recovery Environment (WinRE) to troubleshoot common startup issues](https://support.microsoft.com/help/4026030/how-to-use-windows-recovery-environment-winre-to-troubleshoot-common-s) -- [How to troubleshoot Windows-based computer freeze issues](https://support.microsoft.com/help/3118553/how-to-troubleshoot-windows-based-computer-freeze-issues) -- [Introduction of page file in Long-Term Servicing Channel and Semi-Annual Channel of Windows](https://support.microsoft.com/help/4133658) +## Troubleshoot Secure Boot +- [Secure Boot isn't configured correctly: troubleshooting](https://docs.microsoft.com/windows-hardware/manufacture/desktop/secure-boot-isnt-configured-correctly-troubleshooting) -## Solutions related to Windows Boot issues -- [Troubleshooting Windows boot problems for IT Pros](https://support.microsoft.com/help/4343769) -- [How to use Windows Recovery Environment (WinRE) to troubleshoot common startup issues](https://support.microsoft.com/help/4026030/how-to-use-windows-recovery-environment-winre-to-troubleshoot-common-s) +## Troubleshoot Setup and Install +- [Deployment Troubleshooting and Log Files](https://docs.microsoft.com/windows-hardware/manufacture/desktop/deployment-troubleshooting-and-log-files) -## Solutions related to configuring or managing the Start menu -- [Manage Windows 10 Start and taskbar layout](/windows/configuration/windows-10-start-layout-options-and-policies) -- [Customize and export Start layout](/windows/configuration/customize-and-export-start-layout) -- [Changes to Group Policy settings for Windows 10 Start](/windows/configuration/changes-to-start-policies-in-windows-10) -- [Preinstalled system applications and Start menu may not work when you upgrade to Windows 10, Version 1511](https://support.microsoft.com/help/3152599) -- [Start menu shortcuts aren't immediately accessible in Windows Server 2016](https://support.microsoft.com/help/3198613) -- [Troubleshoot problems opening the Start menu or Cortana](https://support.microsoft.com/help/12385/windows-10-troubleshoot-problems-opening-start-menu-cortana) -- [Modern apps are blocked by security software when you start the applications on Windows 10 Version 1607](https://support.microsoft.com/help/4016973/modern-apps-are-blocked-by-security-software-when-you-start-the-applic) +## Troubleshoot Start Menu +- [Troubleshoot Start menu errors](https://docs.microsoft.com/windows/configuration/start-layout-troubleshoot) -## Solutions related to wireless networking and 802.1X authentication -- [Advanced Troubleshooting Wireless Network](Connectivity]https://docs.microsoft.com/en-us/windows/client-management/advanced-troubleshooting-wireless-network-connectivity) -- [Advanced Troubleshooting 802.1x Authentication](https://docs.microsoft.com/en-us/windows/client-management/advanced-troubleshooting-802-authentication) -- [Troubleshooting Windows 802.11 Wireless Connections](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc766215(v=ws.10)) -- [Troubleshooting Windows Secure 802.3 Wired Connections](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-vista/cc749352(v%3dws.10)) -- [Windows 10 devices can't connect to an 802.1X environment](https://support.microsoft.com/kb/3121002) + +## Troubleshoot Subscription Activation +- [Deploy Windows 10 Enterprise licenses](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses) + +## Troubleshoot System Hang +- [Advanced troubleshooting for Windows-based computer freeze issues](https://docs.microsoft.com/windows/client-management/troubleshoot-windows-freeze) + +## Troubleshoot TCP/IP Communication +- [Collect data using Network Monitor](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-netmon) +- [Troubleshoot TCP/IP connectivity](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-connectivity) +- [Troubleshoot port exhaustion issues](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-port-exhaust) +- [Troubleshoot Remote Procedure Call (RPC) errors](https://docs.microsoft.com/windows/client-management/troubleshoot-tcpip-rpc-errors) + +## Troubleshoot User State Migration Toolkit (USMT) +- [Common Issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues) +- [Frequently Asked Questions](https://docs.microsoft.com/windows/deployment/usmt/usmt-faq) +- [Log Files](https://docs.microsoft.com/windows/deployment/usmt/usmt-log-files) +- [Return Codes](https://docs.microsoft.com/windows/deployment/usmt/usmt-return-codes) + +## Troubleshoot Windows Hello for Business (WHFB) +- [Windows Hello for Business Frequently Asked Questions](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-faq) +- [Windows Hello errors during PIN creation (Windows 10)](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation) +- [Event ID 300 - Windows Hello successfully created (Windows 10)](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-event-300) + + +## Troubleshoot Windows Analytics +- [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-faq-troubleshooting) + +## Troubleshoot Windows Update +- [How Windows Update works](https://docs.microsoft.com/windows/deployment/update/how-windows-update-works) +- [Windows Update log files](https://docs.microsoft.com/windows/deployment/update/windows-update-logs) +- [Windows Update troubleshooting](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting) +- [Windows Update common errors and mitigation](https://docs.microsoft.com/windows/deployment/update/windows-update-errors) +- [Windows Update - Additional resources](https://docs.microsoft.com/windows/deployment/update/windows-update-resources) +- [Get started with Windows Update](https://docs.microsoft.com/windows/deployment/update/windows-update-overview) +- [Servicing stack updates](https://docs.microsoft.com/windows/deployment/update/servicing-stack-updates) + +## Troubleshoot Windows Upgrade +- [Quick fixes - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/quick-fixes) +- [SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag) +- [Troubleshoot Windows 10 upgrade errors - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/troubleshoot-upgrade-errors) +- [Windows error reporting - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/windows-error-reporting) +- [Upgrade error codes - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-error-codes) +- [Log files - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/log-files) +- [Resolution procedures - Windows IT Pro](https://docs.microsoft.com/windows/deployment/upgrade/resolution-procedures) + +## Troubleshoot Windows Recovery (WinRE) +- [Windows RE troubleshooting features](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-re-troubleshooting-features) + +## Troubleshoot Wireless Connection +- [Advanced Troubleshooting Wireless Network Connectivity](https://docs.microsoft.com/windows/client-management/advanced-troubleshooting-wireless-network-connectivity) + +## Other Resources + +### [Troubleshooting Windows Server components](https://docs.microsoft.com/windows-server/troubleshoot/windows-server-support-solutions) diff --git a/windows/client-management/windows-libraries.md b/windows/client-management/windows-libraries.md index 10f9efd44b..b5977c0973 100644 --- a/windows/client-management/windows-libraries.md +++ b/windows/client-management/windows-libraries.md @@ -1,12 +1,14 @@ --- ms.assetid: e68cd672-9dea-4ff8-b725-a915f33d8fd2 +ms.reviewer: +manager: dansimp title: Windows Libraries ms.prod: windows-server-threshold -ms.author: jgerend +ms.author: dansimp ms.manager: dongill ms.technology: storage ms.topic: article -author: jasongerend +author: dansimp description: All about Windows Libraries, which are containers for users' content, such as Documents and Pictures. ms.date: 04/19/2017 --- @@ -115,7 +117,7 @@ See the [Library Description Schema](https://go.microsoft.com/fwlink/?LinkId=159 ### Concepts -- [Windows Search Features ](https://technet.microsoft.com/library/dd744686.aspx) +- [Windows Search Features](https://technet.microsoft.com/library/dd744686.aspx) - [Windows Indexing Features](https://technet.microsoft.com/library/dd744700.aspx) - [Federated Search Features](https://technet.microsoft.com/library/dd744682.aspx) - [Administrative How-to Guides](https://technet.microsoft.com/library/ee461108.aspx) diff --git a/windows/client-management/windows-version-search.md b/windows/client-management/windows-version-search.md index ca022c045d..63dd4a3abe 100644 --- a/windows/client-management/windows-version-search.md +++ b/windows/client-management/windows-version-search.md @@ -5,9 +5,11 @@ keywords: Long-Term Servicing Channel, LTSC, LTSB, Semi-Annual Channel, SAC, Win ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: kaushika-msft -ms.author: MikeBlodge +author: dansimp +ms.author: dansimp ms.date: 04/30/2018 +ms.reviewer: +manager: dansimp ms.topic: troubleshooting --- diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md index 6be8931eeb..7428624219 100644 --- a/windows/configuration/TOC.md +++ b/windows/configuration/TOC.md @@ -79,6 +79,7 @@ #### [DeviceFormFactor](wcd/wcd-deviceformfactor.md) #### [DeviceInfo](wcd/wcd-deviceinfo.md) #### [DeviceManagement](wcd/wcd-devicemanagement.md) +#### [DeviceUpdateCenter](wcd/wcd-deviceupdatecenter.md) #### [DMClient](wcd/wcd-dmclient.md) #### [EditionUpgrade](wcd/wcd-editionupgrade.md) #### [EmbeddedLockdownProfiles](wcd/wcd-embeddedlockdownprofiles.md) @@ -102,6 +103,7 @@ #### [OtherAssets](wcd/wcd-otherassets.md) #### [Personalization](wcd/wcd-personalization.md) #### [Policies](wcd/wcd-policies.md) +#### [Privacy](wcd/wcd-privacy.md) #### [ProvisioningCommands](wcd/wcd-provisioningcommands.md) #### [RcsPresence](wcd/wcd-rcspresence.md) #### [SharedPC](wcd/wcd-sharedpc.md) @@ -110,11 +112,13 @@ #### [Start](wcd/wcd-start.md) #### [StartupApp](wcd/wcd-startupapp.md) #### [StartupBackgroundTasks](wcd/wcd-startupbackgroundtasks.md) +#### [StorageD3InModernStandby](wcd/wcd-storaged3inmodernstandby.md) #### [SurfaceHubManagement](wcd/wcd-surfacehubmanagement.md) #### [TabletMode](wcd/wcd-tabletmode.md) #### [TakeATest](wcd/wcd-takeatest.md) #### [TextInput](wcd/wcd-textinput.md) -#### [Theme](wcd/wcd-theme.md) +#### [Theme](wcd/wcd-theme.md) +#### [Time](wcd/wcd-time.md) #### [UnifiedWriteFilter](wcd/wcd-unifiedwritefilter.md) #### [UniversalAppInstall](wcd/wcd-universalappinstall.md) #### [UniversalAppUninstall](wcd/wcd-universalappuninstall.md) @@ -137,7 +141,7 @@ ### [Administering UE-V](ue-v/uev-administering-uev.md) #### [Manage Configurations for UE-V](ue-v/uev-manage-configurations.md) ##### [Configuring UE-V with Group Policy Objects](ue-v/uev-configuring-uev-with-group-policy-objects.md) -##### [Configuring UE-V with System Center Configuration Manager](ue-v/uev-configuring-uev-with-system-center-configuration-manager.md) +##### [Configuring UE-V with Microsoft Endpoint Configuration Manager](ue-v/uev-configuring-uev-with-system-center-configuration-manager.md) ##### [Administering UE-V with Windows PowerShell and WMI](ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md) ###### [Managing the UE-V Service and Packages with Windows PowerShell and WMI](ue-v/uev-managing-uev-agent-and-packages-with-windows-powershell-and-wmi.md) ###### [Managing UE-V Settings Location Templates Using Windows PowerShell and WMI](ue-v/uev-managing-settings-location-templates-using-windows-powershell-and-wmi.md) diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index 52fa2a92d0..700b2a16cc 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -1,22 +1,31 @@ --- title: Change history for Configure Windows 10 (Windows 10) -description: This topic lists changes to documentation for configuring Windows 10. +ms.reviewer: +manager: dansimp +description: View changes to documentation for configuring Windows 10. keywords: ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article -ms.date: 11/07/2018 +ms.date: 10/03/2019 --- # Change history for Configure Windows 10 This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile. +## April 2019 + +New or changed topic | Description +--- | --- +[Use Shell Launcher to create a Windows 10 kiosk](kiosk-shelllauncher.md) | Added information for Shell Launcher v2, coming in the next feature update to Windows 10. +[Prepare a device for kiosk configuration](kiosk-prepare.md) | Added new recommendations for policies to manage updates. + ## February 2019 New or changed topic | Description @@ -110,14 +119,14 @@ The following topics were moved into the [Privacy](/windows/privacy/index) libra New or changed topic | Description --- | --- -[Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | Updated endpoints. +[Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization) | Updated endpoints. [Configure cellular settings for tablets and PCs](provisioning-apn.md) | Added instructions for confirming that the settings were applied. ## March 2018 New or changed topic | Description --- | --- -[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Added events and fields that were added in the March update. +[Windows 10, version 1709 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703) | Added events and fields that were added in the March update. Set up a kiosk on Windows 10 Pro, Enterprise, or Education | Renamed it **Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education** and reorganized the information to make the choices clearer. @@ -125,7 +134,7 @@ Set up a kiosk on Windows 10 Pro, Enterprise, or Education | Renamed it **Set up New or changed topic | Description --- | --- -[Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Added events and fields that were added in the February update. +[Windows 10, version 1709 basic diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703) | Added events and fields that were added in the February update. [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Added steps for configuring a kiosk in Microsoft Intune. [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) | Updated the instructions for applying a customized Start layout using Microsoft Intune. @@ -136,9 +145,9 @@ New or changed topic | Description [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Added videos demonstrating how to use Microsoft Intune and how to use provisioning packages to configure multi-app kiosks. [ConnectivityProfiles](wcd/wcd-connectivityprofiles.md) | Added settings for VPN **Native** and **Third Party** profile types. [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) | Clarified that the TopMFUApps elements in layoutmodification.xml are not supported in Windows 10, version 1709. -| [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md) | New topic | +| [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/privacy/diagnostic-data-viewer-overviewd) | New topic | [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) | Added section for removing default apps from the taskbar. -[Manage Windows 10 connection endpoints](manage-windows-endpoints-version-1709.md) | New topic for Windows 10, version 1709 that explains the purpose for connections to Microsoft services and how to manage them. +[Manage Windows 10 connection endpoints](https://docs.microsoft.com/windows/privacy/manage-windows-1709-endpoints) | New topic for Windows 10, version 1709 that explains the purpose for connections to Microsoft services and how to manage them. [Configure Windows Spotlight on the lock screen](windows-spotlight.md) | Added section for resolution of custom lock screen images. [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Added section for automatic sign-in after restart on unmanaged devices. @@ -147,15 +156,14 @@ New or changed topic | Description New or changed topic | Description --- | --- -|[Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)| Added events that were added in November. | +|[Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703)| Added events that were added in November. | [Create a provisioning package with multivariant settings](provisioning-packages/provisioning-multivariant.md) | Add support for desktop to [Conditions](provisioning-packages/provisioning-multivariant.md#conditions) table. ## October 2017 -New or changed topic | Description ---- | --- -[Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md) | Added that Microsoft Edge is not supported for assigned access | Removed **Guidelines for using Remote Desktop app**; the behavior for Remote Desktop has changed so that it's no longer necessary to turn off **Start connections in full screen** for assigned access. - +| New or changed topic | Description | +|---------------------------------------------------------------------------------------------|----------------------------------------------------------------| +| [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md) | Added that Microsoft Edge is not supported for assigned access | ## RELEASE: Windows 10, version 1709 @@ -163,15 +171,16 @@ The topics in this library have been updated for Windows 10, version 1709 (also - [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) - [Multi-app kiosk XML reference](multi-app-kiosk-xml.md) -- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) -- [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) - +- [Windows 10, version 1709 basic diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) +- [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields) + ## September 2017 + |New or changed topic | Description| |--- | ---| -|[Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md)|New conceptual info about Windows 10 and the upcoming GDPR-compliance requirements.| -|[Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added that Windows Spotlight can be managed by the Experience/AllowWindowsSpotlight MDM policy. | +|[Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](https://docs.microsoft.com/windows/privacy/gdpr-win10-whitepaper)|New conceptual info about Windows 10 and the upcoming GDPR-compliance requirements.| +|[Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) | Added that Windows Spotlight can be managed by the Experience/AllowWindowsSpotlight MDM policy. | @@ -183,14 +192,15 @@ The topics in this library have been updated for Windows 10, version 1709 (also ## July 2017 + | New or changed topic | Description | | --- | --- | -|[Windows 10, version 1703 Diagnostic Data](windows-diagnostic-data-1703.md)|Updated categories and included diagnostic data.| +|[Windows 10, version 1703 Diagnostic Data](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703)|Updated categories and included diagnostic data.| |[Add image for secondary tiles](start-secondary-tiles.md) | Added XML example for Edge secondary tiles and **ImportEdgeAssets** | |[Customize and export Start layout](customize-and-export-start-layout.md) | Added explanation for tile behavior when the app is not installed | |[Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md) | Added that Microsoft Edge is not supported for assigned access | -|[Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)|Updated several Appraiser events and added Census.Speech. | -|[Manage connections from Windows operating system components to Microsoft-services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Updated Date & Time and Windows spotlight sections. | +|[Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703)|Updated several Appraiser events and added Census.Speech. | +|[Manage connections from Windows operating system components to Microsoft-services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) | Updated Date & Time and Windows spotlight sections. | ## June 2017 @@ -205,7 +215,7 @@ The topics in this library have been updated for Windows 10, version 1709 (also | New or changed topic | Description | | --- | --- | | [Configure cellular settings for tablets and PCs](provisioning-apn.md) | New | -| [ Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) | Added MDM policies for privacy settings | +| [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services) | Added MDM policies for privacy settings | ## April 2017 @@ -223,5 +233,4 @@ The topics in this library have been updated for Windows 10, version 1703 (also - [Use the Lockdown Designer app to create a Lockdown XML file](mobile-devices/mobile-lockdown-designer.md) - [Add image for secondary tiles](start-secondary-tiles.md) - [Provision PCs with apps](provisioning-packages/provision-pcs-with-apps.md) -- [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) -- [Windows 10, version 1703 Diagnostic Data](windows-diagnostic-data-1703.md) \ No newline at end of file +- [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703) diff --git a/windows/configuration/changes-to-start-policies-in-windows-10.md b/windows/configuration/changes-to-start-policies-in-windows-10.md index 603ee4e60e..0a333370c9 100644 --- a/windows/configuration/changes-to-start-policies-in-windows-10.md +++ b/windows/configuration/changes-to-start-policies-in-windows-10.md @@ -2,12 +2,14 @@ title: Changes to Group Policy settings for Windows 10 Start menu (Windows 10) description: Windows 10 has a brand new Start experience. ms.assetid: 612FB68A-3832-451F-AA97-E73791FEAA9F +ms.reviewer: +manager: dansimp keywords: ["group policy", "start menu", "start screen"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: coreyp-at-msft -ms.author: coreyp +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 11/28/2017 @@ -58,7 +60,7 @@ These policy settings are available in **Administrative Templates\\Start Menu an Prevent users from customizing their Start Screen -

                            Use this policy in conjunction with a [customized Start layout](windows-10-start-layout-options-and-policies.md) to prevent users from changing it

                            +

                            Use this policy in conjunction with a customized Start layout to prevent users from changing it

                            Prevent users from uninstalling applications from Start @@ -96,7 +98,7 @@ These policy settings are available in **Administrative Templates\\Start Menu an Start Layout

                            This applies a specific Start layout, and it also prevents users from changing the layout. This policy can be configured in User Configuration or Computer Configuration.

                            -  +
                            @@ -106,7 +108,7 @@ These policy settings are available in **Administrative Templates\\Start Menu an -  + ## Deprecated Group Policy settings for Start @@ -142,7 +144,7 @@ The Start policy settings listed below do not work on Windows 10. Most of them | Remove user folder link from Start Menu | Windows 8 | | Remove Videos link from Start Menu | Windows 8 | -  + ## Related topics diff --git a/windows/configuration/configure-windows-10-taskbar.md b/windows/configuration/configure-windows-10-taskbar.md index 6d89596e32..037e389943 100644 --- a/windows/configuration/configure-windows-10-taskbar.md +++ b/windows/configuration/configure-windows-10-taskbar.md @@ -2,14 +2,16 @@ title: Configure Windows 10 taskbar (Windows 10) description: Admins can pin apps to users' taskbars. keywords: ["taskbar layout","pin apps"] -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 01/18/2018 +ms.reviewer: +manager: dansimp --- # Configure Windows 10 taskbar @@ -25,7 +27,7 @@ If you specify an app to be pinned that is not provisioned for the user on the c The order of apps in the XML file dictates the order of pinned apps on the taskbar from left to right, to the right of any existing apps pinned by the user. > [!NOTE] -> In operating systems configured to use a right-to-left language, the taskbar order will be reversed. +> In operating systems configured to use a right-to-left language, the taskbar order will be reversed. The following example shows how apps will be pinned: Windows default apps to the left (blue circle), apps pinned by the user in the center (orange triangle), and apps that you pin using the XML file to the right (green square). @@ -55,11 +57,11 @@ The following example shows how apps will be pinned: Windows default apps to the In the layout modification XML file, you will need to add entries for applications in the XML markup. In order to pin an application, you need either its AUMID or Desktop Application Link Path. The easiest way to find this data for an application is to: -1. Pin the application to the Start menu on a reference or testing PC. -2. Open Windows PowerShell and run the `Export-StartLayout` cmdlet. -3. Open the generated XML file. -4. Look for an entry corresponding to the app you pinned. -5. Look for a property labeled `AppUserModelID` or `DesktopApplicationLinkPath`. +1. Pin the application to the Start menu on a reference or testing PC. +2. Open Windows PowerShell and run the `Export-StartLayout` cmdlet. +3. Open the generated XML file. +4. Look for an entry corresponding to the app you pinned. +5. Look for a property labeled `AppUserModelID` or `DesktopApplicationLinkPath`. ### Sample taskbar configuration XML file @@ -115,7 +117,7 @@ The easiest way to find this data for an application is to: ``` -##Keep default apps and add your own +## Keep default apps and add your own The `` section will append listed apps to the taskbar by default. The following sample keeps the default apps pinned and adds pins for Paint, Microsoft Reader, and a command prompt. @@ -143,7 +145,7 @@ The `` section will append listed apps to the tas ![default apps pinned to taskbar](images/taskbar-default.png) **After:** - + ![additional apps pinned to taskbar](images/taskbar-default-plus.png) ## Remove default apps and add your own @@ -170,7 +172,6 @@ If you only want to remove some of the default pinned apps, you would use this m - ``` **Before:** @@ -201,7 +202,6 @@ By adding `PinListPlacement="Replace"` to ``, you - ``` ## Configure taskbar by country or region @@ -246,7 +246,6 @@ The following example shows you how to configure taskbars by country or region. - ``` When the preceding example XML file is applied, the resulting taskbar for computers in the US or UK: diff --git a/windows/configuration/cortana-at-work/cortana-at-work-crm.md b/windows/configuration/cortana-at-work/cortana-at-work-crm.md index 87b669a2b7..250b7d99b0 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-crm.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-crm.md @@ -1,13 +1,15 @@ --- title: Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization (Windows 10) -description: How to set up Cortana to help your salespeople get proactive insights on important CRM activities, including sales leads, accounts, and opportunities; presenting the most relevant info at any given time. +description: How to set up Cortana to give salespeople insights on important CRM activities, including sales leads, accounts, and opportunities. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization @@ -28,22 +30,22 @@ You must be a CRM administrator to turn on and use Preview features. For more in **To turn on Cortana with Dynamics CRM** -1. Go to **Settings**, and then click **Administration**. +1. Go to **Settings**, and then click **Administration**. -2. Choose **System Settings**, and then click the **Previews** tab. +2. Choose **System Settings**, and then click the **Previews** tab. -3. Read the license terms, and if you agree, select the **I’ve read and agree to the license terms** check box. +3. Read the license terms, and if you agree, select the **I’ve read and agree to the license terms** check box. -4. For each preview feature you want to enable, click **Yes**. +4. For each preview feature you want to enable, click **Yes**. ## Turn on Cortana with Dynamics CRM on your employees’ devices You must tell your employees to turn on Cortana, before they’ll be able to use it with Dynamics CRM. **To turn on local Cortana with Dynamics CRM** -1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. +1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. -2. Click on **Connected Services**, click **Dynamics CRM**, and then click **Connect**. +2. Click on **Connected Services**, click **Dynamics CRM**, and then click **Connect**. ![Cotana at work, showing how to turn on the connected services for Dynamics CRM](../images/cortana-connect-crm.png) @@ -53,10 +55,10 @@ You must tell your employees to turn on Cortana, before they’ll be able to use Cortana can only access data in Dynamics CRM when it’s turned on. If you don’t want Cortana to access your corporate data, you can turn it off. **To turn off Cortana with Dynamics CRM** -1. Go to **Settings**, and then click **Administration**. +1. Go to **Settings**, and then click **Administration**. -2. Choose **System Settings**, and then click the **Previews** tab. +2. Choose **System Settings**, and then click the **Previews** tab. -3. Click **No** for **Cortana**. +3. Click **No** for **Cortana**. - All Dynamics CRM functionality related to Cortana is turned off in your organization. \ No newline at end of file + All Dynamics CRM functionality related to Cortana is turned off in your organization. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md index 69ffb98a5a..8def5a04c7 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-feedback.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-feedback.md @@ -4,10 +4,12 @@ description: How to send feedback to Microsoft about Cortana at work. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Send feedback about Cortana at work back to Microsoft diff --git a/windows/configuration/cortana-at-work/cortana-at-work-o365.md b/windows/configuration/cortana-at-work/cortana-at-work-o365.md index 87687737c8..3ec17f6e6c 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-o365.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-o365.md @@ -1,13 +1,15 @@ --- title: Set up and test Cortana with Office 365 in your organization (Windows 10) -description: How to connect Cortana to Office 365 so your employees are notified about regular meetings, unusual events, such as meetings over lunch or during a typical commute time, and about early meetings, even setting an alarm so the employee isn’t late. +description: Learn how to connect Cortana to Office 365 so employees are notified about regular meetings and unusual events. You can even set an alarm for early meetings. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Set up and test Cortana with Office 365 in your organization @@ -43,25 +45,25 @@ You must tell your employees to turn on Cortana before they’ll be able to use **To turn on local Cortana with Office 365** -1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. +1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. -2. Click on **Connected Services**, click **Office 365**, and then click **Connect**. +2. Click on **Connected Services**, click **Office 365**, and then click **Connect**. ![Cotana at work, showing how to turn on the connected services for Office 365](../images/cortana-connect-o365.png) The employee can also disconnect by clicking **Disconnect** from the **Office 365** screen. ## Turn off Cortana with Office 365 -Cortana can only access data in your Office 365 org when it’s turned on. If you don’t want Cortana to access your corporate data, you can turn it off in the Office 365 admin center. +Cortana can only access data in your Office 365 org when it’s turned on. If you don’t want Cortana to access your corporate data, you can turn it off in the Microsoft 365 admin center. **To turn off Cortana with Office 365** -1. [Sign in to Office 365](https://www.office.com/signin) using your Azure AD account. +1. [Sign in to Office 365](https://www.office.com/signin) using your Azure AD account. -2. Go to the [Office 365 admin center](https://support.office.com/article/Office-365-admin-center-58537702-d421-4d02-8141-e128e3703547). +2. Go to the [admin center](https://support.office.com/article/Office-365-admin-center-58537702-d421-4d02-8141-e128e3703547). -3. Expand **Service Settings**, and select **Cortana**. +3. Expand **Service Settings**, and select **Cortana**. -4. Click **Cortana** to toggle Cortana off. +4. Click **Cortana** to toggle Cortana off. All Office 365 functionality related to Cortana is turned off in your organization and your employees are unable to use her at work. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-overview.md b/windows/configuration/cortana-at-work/cortana-at-work-overview.md index 48db68727b..cad5f5470d 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-overview.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-overview.md @@ -1,12 +1,14 @@ --- title: Cortana integration in your business or enterprise (Windows 10) -description: The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. +ms.reviewer: +manager: dansimp +description: Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: lizap +author: dansimp ms.localizationpriority: medium -ms.author: elizapo +ms.author: dansimp --- # Cortana integration in your business or enterprise @@ -43,7 +45,7 @@ Cortana requires the following hardware and software to successfully run the inc |Client operating system |
                            • **Desktop:** Windows 10, version 1703
                            • **Mobile:** Windows 10 Mobile, version 1703 (with limited functionality)
                              • | |Azure Active Directory (Azure AD) |While all employees signing into Cortana need an Azure AD account; an Azure AD premium tenant isn’t required. | |Additional policies (Group Policy and Mobile Device Management (MDM)) |There is a rich set of policies that can be used to manage various aspects of Cortana. Most of these policies will limit the abilities of Cortana, but won't turn Cortana off.

                              For example:

                              If you turn **Location** off, Cortana won't be able to provide location-based reminders, such as reminding you to visit the mail room when you get to work.

                              If you turn **Speech** off, your employees won't be able to use “Hello Cortana” for hands free usage or voice commands to easily ask for help. | -|Windows Information Protection (WIP) (optional) |If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip)

                              If you decide to use WIP, you must also have a management solution. This can be Microsoft Intune, Microsoft System Center Configuration Manager (version 1606 or later), or your current company-wide 3rd party mobile device management (MDM) solution.| +|Windows Information Protection (WIP) (optional) |If you want to secure the calendar, email, and contact info provided to Cortana on a device, you can use WIP. For more info about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip)

                              If you decide to use WIP, you must also have a management solution. This can be Microsoft Intune, Microsoft Endpoint Configuration Manager (version 1606 or later), or your current company-wide 3rd party mobile device management (MDM) solution.| ## Signing in using Azure AD Your organization must have an Azure AD tenant and your employees’ devices must all be Azure AD-joined for Cortana to work properly. For info about what an Azure AD tenant is, how to get your devices joined, and other Azure AD maintenance info, see [What is an Azure AD directory?](https://msdn.microsoft.com/library/azure/jj573650.aspx) @@ -51,7 +53,7 @@ Your organization must have an Azure AD tenant and your employees’ devices mus ## Cortana and privacy We understand that there are some questions about Cortana and your organization’s privacy, including concerns about what info is collected by Cortana, where the info is saved, how to manage what data is collected, how to turn Cortana off, how to opt completely out of data collection, and what info is shared with other Microsoft apps and services. For more details about these concerns, see the [Cortana, Search, and privacy: FAQ](https://windows.microsoft.com/windows-10/cortana-privacy-faq) topic. -Cortana is covered under the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement). +Cortana is covered under the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement). ## See also - [What is Cortana?](https://go.microsoft.com/fwlink/p/?LinkId=746818) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md index d23b889cf3..0122fb2eb7 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md @@ -1,13 +1,15 @@ --- -title: Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization (Windows 10) +title: Configure Cortana with Group Policy and MDM settings (Windows 10) description: The list of Group Policy and mobile device management (MDM) policy settings that apply to Cortana at work. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Use Group Policy and mobile device management (MDM) settings to configure Cortana in your organization diff --git a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md index 708c34ef54..8ca269aefe 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md @@ -4,10 +4,12 @@ description: How to integrate Cortana with Power BI to help your employees get a ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Set up and test Cortana for Power BI in your organization @@ -33,9 +35,9 @@ To use this walkthrough, you’ll need: - **Azure Active Directory (Azure AD)/Work or School account**. You can use the account that you created for Office 365, or you can create a new one while you’re establishing your Power BI account. If you choose to use Azure AD, you must connect your Azure AD account to your Windows account. **To connect your account to Windows** - a. Open **Windows Settings**, click **Accounts**, click **Access work or school**, and then in the **Connect to work or school** section, click **Connect**. + a. Open **Windows Settings**, click **Accounts**, click **Access work or school**, and then in the **Connect to work or school** section, click **Connect**. - b. Follow the instructions to add your Azure Active Directory (Azure AD) account to Windows. + b. Follow the instructions to add your Azure Active Directory (Azure AD) account to Windows. ## Set up your test environment for Cortana for Power BI Before you can start this testing scenario, you must first set up your test environment and data, and then you must turn on and set up Cortana to connect and work with Power BI. @@ -48,31 +50,31 @@ Before you can start this testing scenario, you must first set up your test envi ![Cortana at work, showing the navigation expand icon in Power BI](../images/cortana-powerbi-expand-nav.png) -3. Click **Get Data** from the left-hand navigation in Power BI. +3. Click **Get Data** from the left-hand navigation in Power BI. ![Cortana at work, showing the Get Data link](../images/cortana-powerbi-getdata.png) -4. Click **Samples** from the **Content Pack Library** area of the **Get Data** screen. +4. Click **Samples** from the **Content Pack Library** area of the **Get Data** screen. ![Cortana at work, showing the Samples link](../images/cortana-powerbi-getdata-samples.png) -5. Click **Retail Analysis Sample**, and then click **Connect**. +5. Click **Retail Analysis Sample**, and then click **Connect**. ![Cortana at work, showing the Samples link](../images/cortana-powerbi-retail-analysis-sample.png) The sample data is imported and you’re returned to the **Power BI** screen. -6. Click **Dashboards** from the left pane of the **Power BI** screen, and then click **Retail Analysis Sample**. +6. Click **Dashboards** from the left pane of the **Power BI** screen, and then click **Retail Analysis Sample**. ![Cortana at work, showing a dashboard view of the sample data](../images/cortana-powerbi-retail-analysis-dashboard.png) -7. In the upper right-hand menu, click the **Settings** icon, and then click **Settings**. +7. In the upper right-hand menu, click the **Settings** icon, and then click **Settings**. ![Cortana at work, showing where to find the Settings option](../images/cortana-powerbi-settings.png) -8. Click the **Datasets** tab, and then pick the **Retail Analysis Sample** dataset from the list. +8. Click the **Datasets** tab, and then pick the **Retail Analysis Sample** dataset from the list. -9. Click **Q&A and Cortana**, check the **Allow Cortana to access this dataset** box, and then click **Apply**. +9. Click **Q&A and Cortana**, check the **Allow Cortana to access this dataset** box, and then click **Apply**. ![Cortana at work, showing where to find the dataset options](../images/cortana-powerbi-retail-analysis-dataset.png) @@ -88,31 +90,31 @@ After you’ve finished creating your Answer Page, you can continue to the inclu >It can take up to 30 minutes for a custom Answer Page to appear for Power BI and Cortana. Logging in and out of Windows 10, or otherwise restarting Cortana, causes the new content to appear immediately. **To create a custom sales data Answer Page for Cortana** -1. In Power BI, click **My Workspace**, click **Create**, and then click **Report**. +1. In Power BI, click **My Workspace**, click **Create**, and then click **Report**. ![Cortana at work, showing where to create the new report](../images/cortana-powerbi-create-report.png) -2. In the **Create Report** screen, click the **Retail Analysis Sample**, and then click **Create**. +2. In the **Create Report** screen, click the **Retail Analysis Sample**, and then click **Create**. A blank report page appears. -3. In the **Visualizations** pane, click the paint roller icon, expand **Page Size**, and then pick **Cortana** from the **Type** drop-down list. +3. In the **Visualizations** pane, click the paint roller icon, expand **Page Size**, and then pick **Cortana** from the **Type** drop-down list. ![Cortana at work, showing the Visualizations options](../images/cortana-powerbi-pagesize.png) -4. In the **Fields** pane, click to expand **Sales**, expand **This year sales**, and then add both **Value** and **Goal**. +4. In the **Fields** pane, click to expand **Sales**, expand **This year sales**, and then add both **Value** and **Goal**. ![Cortana at work, showing the Field options](../images/cortana-powerbi-field-selection.png) The automatically generated graph is added to your blank report. You have the option to change colors, add borders, add additional visualizations, and modify this page so that it answers the question about sales data as precisely, and in as custom a way, as you want. You just need to make sure that it all stays within the page borders. -5. In the **Visualizations** pane, click the paint roller icon again, expand **Page Information**, type _Sales data 2016_ into the **Name** box, turn on **Q&A**, and then add alternate report names (separated by commas) into the text box. +5. In the **Visualizations** pane, click the paint roller icon again, expand **Page Information**, type _Sales data 2016_ into the **Name** box, turn on **Q&A**, and then add alternate report names (separated by commas) into the text box. The alternate names help Cortana to know what questions to look for and when to show this report. To also improve your results, you should avoid using the names of your report columns. ![Cortana at work, showing the page info for your specific report](../images/cortana-powerbi-report-qna.png) -6. Click **File**, click **Save as**, and save the report as _Sales data 2016_. +6. Click **File**, click **Save as**, and save the report as _Sales data 2016_. Because this is part of the Retail Analysis Sample, it will automatically be included as part of the dataset you included for Cortana. However, you will still need to log in and out of Windows 10, or otherwise restart Cortana, before the new content appears. @@ -120,15 +122,15 @@ After you’ve finished creating your Answer Page, you can continue to the inclu Now that you’ve set up your device, you can use Cortana to show your info from within Power BI. **To use Cortana with Power BI** -1. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. +1. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. -2. Type _This year in sales_. +2. Type _This year in sales_. Cortana shows you the available results. ![Cortana at work, showing the best matches based on the Power BI data](../images/cortana-powerbi-search.png) -3. In the **Power BI** area, click **This year in sales – in Retail Analysis Sample**. +3. In the **Power BI** area, click **This year in sales – in Retail Analysis Sample**. Cortana returns your custom report. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md index 39c1c8f716..a7b6e72c12 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-1.md @@ -1,13 +1,15 @@ --- -title: Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook (Windows 10) +title: Sign-in to Azure AD and manage notebook with Cortana (Windows 10) description: A test scenario walking you through signing in and managing the notebook. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Test scenario 1 - Sign-in to Azure AD and use Cortana to manage the notebook @@ -23,36 +25,36 @@ This scenario turns on Azure AD and let's your employee use Cortana to manage an ## Turn on Azure AD This process helps you to sign out of a Microsoft Account and to sign into an Azure AD account. -1. Click on the **Cortana** icon in the taskbar, click the **Notebook**, and then click **About Me**. +1. Click on the **Cortana** icon in the taskbar, click the **Notebook**, and then click **About Me**. -2. Click your email address. +2. Click your email address. - A dialog box appears, showing the associated account info. + A dialog box appears, showing the associated account info. -3. Click your email address again, and then click **Sign out**. +3. Click your email address again, and then click **Sign out**. - This signs out the Microsoft account, letting you continue to add and use the Azure AD account. + This signs out the Microsoft account, letting you continue to add and use the Azure AD account. -4. Click the **Search** box and then the **Notebook** icon in the left rail. This will start the sign-in request. +4. Click the **Search** box and then the **Notebook** icon in the left rail. This will start the sign-in request. -5. Click **Sign-In** and follow the instructions. +5. Click **Sign-In** and follow the instructions. -6. When you’re asked to sign in, you’ll need to choose an Azure AD account, which will look like kelliecarlson@contoso.com. +6. When you’re asked to sign in, you’ll need to choose an Azure AD account, which will look like kelliecarlson@contoso.com. - >[!IMPORTANT] - >If there’s no Azure AD account listed, you’ll need to go to **Windows Settings > Accounts > Email & app accounts**, and then click **Add a work or school account** to add it. + >[!IMPORTANT] + >If there’s no Azure AD account listed, you’ll need to go to **Windows Settings > Accounts > Email & app accounts**, and then click **Add a work or school account** to add it. ## Use Cortana to manage the notebook content This process helps you to manage the content Cortana shows in your Notebook. -1. Click on the **Cortana** icon in the taskbar, click the **Notebook**, scroll down and click **Weather**. +1. Click on the **Cortana** icon in the taskbar, click the **Notebook**, scroll down and click **Weather**. -2. In the **Weather** settings, scroll down to the **Cities your tracking** area, and then click **Add a city**. +2. In the **Weather** settings, scroll down to the **Cities your tracking** area, and then click **Add a city**. -3. Add *Redmond, Washington*, double-click the search result, click **Add**, and then click **Save**. +3. Add *Redmond, Washington*, double-click the search result, click **Add**, and then click **Save**. ![Cortana at work, showing the multiple Weather screens](../images/cortana-weather-multipanel.png) -4. Click on the **Home** icon and scroll to the weather forecast for Redmond, Washington. +4. Click on the **Home** icon and scroll to the weather forecast for Redmond, Washington. - ![Cortana at work, showing Redmond, WA weather](../images/cortana-redmond-weather.png) \ No newline at end of file + ![Cortana at work, showing Redmond, WA weather](../images/cortana-redmond-weather.png) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md index 74d00b3cd5..c58d165771 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md @@ -1,13 +1,15 @@ --- -title: Test scenario 2 - Perform a quick search with Cortana at work (Windows 10) +title: Perform a quick search with Cortana at work (Windows 10) description: A test scenario about how to perform a quick search with Cortana at work. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Test scenario 2 - Perform a quick search with Cortana at work @@ -36,6 +38,6 @@ This process helps you to use Cortana at work and voice commands to perform a qu 1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). -2. Say *What's the weather in Chicago?* Cortana tells you and shows you the current weather in Chicago. +2. Say *What's the weather in Chicago?* Cortana tells you and shows you the current weather in Chicago. - ![Cortana at work, showing the current weather in Chicago, IL](../images/cortana-chicago-weather.png) \ No newline at end of file + ![Cortana at work, showing the current weather in Chicago, IL](../images/cortana-chicago-weather.png) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md index 88f31d07d2..d072cdb5fa 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md @@ -1,13 +1,15 @@ --- -title: Test scenario 3 - Set a reminder for a specific location using Cortana at work (Windows 10) +title: Set a reminder for a location with Cortana at work (Windows 10) description: A test scenario about how to set a location-based reminder using Cortana at work. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Test scenario 3 - Set a reminder for a specific location using Cortana at work @@ -83,4 +85,4 @@ This process helps you to edit or archive and existing or completed reminder. ![Cortana at work, showing the reminder editing screen](../images/cortana-reminder-edit.png) -3. Change any text that you want to change, click **Add photo** if you want to add or replace an image, click **Delete** if you want to delete the entire reminder, click **Save** to save your changes, and click **Complete and move to History** if you want to save a completed reminder in your **Reminder History**. \ No newline at end of file +3. Change any text that you want to change, click **Add photo** if you want to add or replace an image, click **Delete** if you want to delete the entire reminder, click **Save** to save your changes, and click **Complete and move to History** if you want to save a completed reminder in your **Reminder History**. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md index 184c16fa77..4ea208fcfd 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md @@ -1,13 +1,15 @@ --- -title: Test scenario 4 - Use Cortana at work to find your upcoming meetings (Windows 10) +title: Use Cortana at work to find your upcoming meetings (Windows 10) description: A test scenario about how to use Cortana at work to find your upcoming meetings. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Test scenario 4 - Use Cortana at work to find your upcoming meetings @@ -39,9 +41,9 @@ This process helps you find your upcoming meetings. ## Find out about upcoming meetings by using voice commands This process helps you to use Cortana at work and voice commands to find your upcoming meetings. -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box. +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box. -2. Say _Show me what meeting I have at 3pm tomorrow_. +2. Say _Show me what meeting I have at 3pm tomorrow_. >[!IMPORTANT] >Make sure that you have a meeting scheduled for the time you specify here. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md index 69e38ea1d0..f5efc05577 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md @@ -1,13 +1,15 @@ --- -title: Test scenario 5 - Use Cortana to send email to a co-worker (Windows 10) +title: Use Cortana to send email to a co-worker (Windows 10) description: A test scenario about how to use Cortana at work to send email to a co-worker. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Test scenario 5 - Use Cortana to send email to a co-worker @@ -23,35 +25,35 @@ This scenario helps you to send an email to a co-worker listed in your work addr ## Send an email to a co-worker This process helps you to send a quick message to a co-worker from the work address book. -1. Check to make sure your Microsoft Outlook or mail app is connected and synchronized with your Azure AD account. +1. Check to make sure your Microsoft Outlook or mail app is connected and synchronized with your Azure AD account. -2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. +2. Click on the **Cortana** icon in the taskbar, and then click in the **Search** bar. -3. Type _Send an email to <contact_name>_. +3. Type _Send an email to <contact_name>_. Where _<contact_name>_ is the name of someone in your work address book. -4. Type your email message subject into the **Quick message** (255 characters or less) box and your message into the **Message** (unlimited characters) box, and then click **Send**. +4. Type your email message subject into the **Quick message** (255 characters or less) box and your message into the **Message** (unlimited characters) box, and then click **Send**. ![Cortana at work, showing the email text](../images/cortana-send-email-coworker.png) ## Send an email to a co-worker by using voice commands This process helps you to use Cortana at work and voice commands to send a quick message to a co-worker from the work address book. -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box. +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box. -2. Say _Send an email to <contact_name>_. +2. Say _Send an email to <contact_name>_. Where _<contact_name>_ is the name of someone in your work address book. -3. Add your email message by saying, _Hello this is a test email using Cortana at work._ +3. Add your email message by saying, _Hello this is a test email using Cortana at work._ The message is added and you’re asked if you want to **Send it**, **Add more**, or **Make changes**. ![Cortana at work, showing the email text created from verbal commands](../images/cortana-send-email-coworker-mic.png) -4. Say _Send it_. +4. Say _Send it_. The email is sent. - ![Cortana at work, showing the sent email text](../images/cortana-complete-send-email-coworker-mic.png) \ No newline at end of file + ![Cortana at work, showing the sent email text](../images/cortana-complete-send-email-coworker-mic.png) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md index 3d69e943de..f5ffb003b7 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md @@ -1,13 +1,15 @@ --- -title: Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email (Windows 10) +title: Review a reminder suggested by Cortana (Windows 10) description: A test scenario about how to use Cortana with the Suggested reminders feature. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Test scenario 6 - Review a reminder suggested by Cortana based on what you’ve promised in email @@ -16,7 +18,7 @@ ms.date: 10/05/2017 - Windows 10 Mobile, version 1703 >[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/en-us/servicesagreement). +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. For more info, see the [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) and the [Microsoft Services Agreement](https://www.microsoft.com/servicesagreement). Cortana automatically finds patterns in your email, suggesting reminders based things that you said you would do so you don’t forget about them. For example, Cortana recognizes that if you include the text, _I’ll get this to you by the end of the week_ in an email, you're making a commitment to provide something by a specific date. Cortana can now suggest that you be reminded about this event, letting you decide whether to keep it or to cancel it. @@ -39,7 +41,7 @@ Cortana automatically finds patterns in your email, suggesting reminders based t 5. Create and send an email to yourself (so you can see the Suggested reminder), including the text, _I’ll finish this project by end of day today_. -6. After you get the email, click on the Cortana **Home** icon, and scroll to today’s events. +6. After you get the email, click on the Cortana **Home** icon, and scroll to today’s events. If the reminder has a specific date or time associated with it, like end of day, Cortana notifies you at the appropriate time and puts the reminder into the Action Center. Also from the Home screen, you can view the email where you made the promise, set aside time on your calendar, officially set the reminder, or mark the reminder as completed. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md index 9806b45881..a00867e25b 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md @@ -1,13 +1,15 @@ --- -title: Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device (Windows 10) +title: Help protect data with Cortana and WIP (Windows 10) description: An optional test scenario about how to use Cortana at work with Windows Information Protection (WIP). ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Test scenario 7 - Use Cortana and Windows Information Protection (WIP) to help protect your organization’s data on a device @@ -22,16 +24,16 @@ This optional scenario helps you to protect your organization’s data on a devi ## Use Cortana and WIP to protect your organization’s data -1. Create and deploy an WIP policy to your organization. For info about how to do this, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). +1. Create and deploy an WIP policy to your organization. For info about how to do this, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). -2. Create a new email from a non-protected or personal mailbox, including the text _I’ll send you that presentation tomorrow_. +2. Create a new email from a non-protected or personal mailbox, including the text _I’ll send you that presentation tomorrow_. -3. Wait up to 2 hours to make sure everything has updated, click the **Cortana** icon in the taskbar, and then click in the **Search** bar. +3. Wait up to 2 hours to make sure everything has updated, click the **Cortana** icon in the taskbar, and then click in the **Search** bar. Cortana automatically pulls your commitment to sending the presentation out of your email, showing it to you. -4. Create a new email from a protected mailbox, including the same text as above, _I’ll send you that presentation tomorrow_. +4. Create a new email from a protected mailbox, including the same text as above, _I’ll send you that presentation tomorrow_. -5. Wait until everything has updated again, click the **Cortana** icon in the taskbar, and then click in the **Search** bar. +5. Wait until everything has updated again, click the **Cortana** icon in the taskbar, and then click in the **Search** bar. Because it was in an WIP-protected email, the presentation info isn’t pulled out and it isn’t shown to you. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md index ad3c006e0f..936f8b5788 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-testing-scenarios.md @@ -4,10 +4,12 @@ description: A list of suggested testing scenarios that you can use to test Cort ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Testing scenarios using Cortana in your business or organization @@ -33,4 +35,4 @@ We've come up with a list of suggested testing scenarios that you can use to tes - [Use Windows Information Protection (WIP) to secure content on a device and then try to manage your organization’s entries in the notebook](cortana-at-work-scenario-7.md) >[!IMPORTANT] ->The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. \ No newline at end of file +>The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md index 45b4cb5e6f..9ae00ff891 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md @@ -4,10 +4,12 @@ description: How to create voice commands that use Cortana to perform voice-enab ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: dougkim +ms.author: dansimp ms.date: 10/05/2017 +ms.reviewer: +manager: dansimp --- # Set up and test custom voice commands in Cortana for your organization @@ -34,29 +36,29 @@ To enable voice commands in Cortana - **Start Cortana removing focus from your app, using specific voice-enabled statements.** [Activate a background app in Cortana using voice commands](https://docs.microsoft.com/cortana/voice-commands/launch-a-background-app-with-voice-commands-in-cortana). -2. **Install the VCD file on employees' devices**. You can use System Center Configuration Manager or Microsoft Intune to deploy and install the VCD file on your employees' devices, the same way you deploy and install any other package in your organization. +2. **Install the VCD file on employees' devices**. You can use Microsoft Endpoint Configuration Manager or Microsoft Intune to deploy and install the VCD file on your employees' devices, the same way you deploy and install any other package in your organization. ## Test scenario: Use voice commands in a Microsoft Store app While these aren't line-of-business apps, we've worked to make sure to implement a VCD file, allowing you to test how the functionality works with Cortana in your organization. **To get a Microsoft Store app** -1. Go to the Microsoft Store, scroll down to the **Collections** area, click **Show All**, and then click **Better with Cortana**. +1. Go to the Microsoft Store, scroll down to the **Collections** area, click **Show All**, and then click **Better with Cortana**. -2. Click **Uber**, and then click **Install**. +2. Click **Uber**, and then click **Install**. -3. Open Uber, create an account or sign in, and then close the app. +3. Open Uber, create an account or sign in, and then close the app. **To set up the app with Cortana** -1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. +1. Click on the **Cortana** search box in the taskbar, and then click the **Notebook** icon. -2. Click on **Connected Services**, click **Uber**, and then click **Connect**. +2. Click on **Connected Services**, click **Uber**, and then click **Connect**. ![Cortana at work, showing where to connect the Uber service to Cortana](../images/cortana-connect-uber.png) **To use the voice-enabled commands with Cortana** -1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). +1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). -2. Say _Uber get me a taxi_. +2. Say _Uber get me a taxi_. Cortana changes, letting you provide your trip details for Uber. diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md index 1232a8f3f0..f13d6f81c8 100644 --- a/windows/configuration/customize-and-export-start-layout.md +++ b/windows/configuration/customize-and-export-start-layout.md @@ -2,12 +2,14 @@ title: Customize and export Start layout (Windows 10) description: The easiest method for creating a customized Start layout is to set up the Start screen and export the layout. ms.assetid: CA8DF327-5DD4-452F-9FE5-F17C514B6236 +ms.reviewer: +manager: dansimp keywords: ["start screen"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 09/18/2018 @@ -33,7 +35,7 @@ When [a partial Start layout](#configure-a-partial-start-layout) is applied, the >[!NOTE] >Partial Start layout is only supported on Windows 10, version 1511 and later. -  + You can deploy the resulting .xml file to devices using one of the following methods: @@ -43,10 +45,8 @@ You can deploy the resulting .xml file to devices using one of the following met - [Mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - ## Customize the Start screen on your test computer - To prepare a Start layout for export, you simply customize the Start layout on a test computer. **To prepare a test computer** @@ -55,7 +55,6 @@ To prepare a Start layout for export, you simply customize the Start layout on a 2. Create a new user account that you will use to customize the Start layout. - **To customize Start** 1. Sign in to your test computer with the user account that you created. @@ -79,11 +78,9 @@ To prepare a Start layout for export, you simply customize the Start layout on a > >In earlier versions of Windows 10, no tile would be pinned. - ## Export the Start layout - -When you have the Start layout that you want your users to see, use the [Export-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/export-startlayout?view=win10-ps) cmdlet in Windows PowerShell to export the Start layout to an .xml file. +When you have the Start layout that you want your users to see, use the [Export-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/export-startlayout?view=win10-ps) cmdlet in Windows PowerShell to export the Start layout to an .xml file. Start layout is located by default at C:\Users\username\AppData\Local\Microsoft\Windows\Shell\ >[!IMPORTANT] >If you include secondary Microsoft Edge tiles (tiles that link to specific websites in Microsoft Edge), see [Add custom images to Microsoft Edge secondary tiles](start-secondary-tiles.md) for instructions. @@ -94,9 +91,9 @@ When you have the Start layout that you want your users to see, use the [Export- 2. On a device running Windows 10, version 1607, 1703, or 1803, at the Windows PowerShell command prompt, enter the following command: - `Export-StartLayout –path .xml ` + `Export-StartLayout –path .xml` - On a device running Windows 10, version 1809, run the **Export-StartLayout** with the switch **-UseDesktopApplicationID**. For example: + On a device running Windows 10, version 1809 or higher, run the **Export-StartLayout** with the switch **-UseDesktopApplicationID**. For example: ```PowerShell Export-StartLayout -UseDesktopApplicationID -Path layout.xml @@ -155,6 +152,8 @@ When you have the Start layout that you want your users to see, use the [Export- >* If you place executable files or scripts in the \ProgramData\Microsoft\Windows\Start Menu\Programs folder, they will not pin to Start. > >* Start on Windows 10 does not support subfolders. We only support one folder. For example, \ProgramData\Microsoft\Windows\Start Menu\Programs\Folder. If you go any deeper than one folder, Start will compress the contents of all the subfolder to the top level. +> +>* Three additional shortcuts are pinned to the start menu after the export. These are shortcuts to %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs, %APPDATA%\Microsoft\Windows\Start Menu\Programs, and %APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\. ## Configure a partial Start layout @@ -172,12 +171,12 @@ If the Start layout is applied by Group Policy or MDM, and the policy is removed **To configure a partial Start screen layout** -1. [Customize the Start layout](#bmk-customize-start). +1. [Customize the Start layout](#customize-the-start-screen-on-your-test-computer). -2. [Export the Start layout](#bmk-exportstartscreenlayout). +2. [Export the Start layout](#export-the-start-layout). 3. Open the layout .xml file. There is a `` element. Add `LayoutCustomizationRestrictionType="OnlySpecifiedGroups"` to the **DefaultLayoutOverride** element as follows: - ``` syntax + ```xml ``` @@ -192,7 +191,7 @@ If the Start layout is applied by Group Policy or MDM, and the policy is removed - [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) - [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 23079316c5..3cd4ad2b71 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -2,15 +2,16 @@ title: Customize Windows 10 Start and tasbkar with Group Policy (Windows 10) description: In Windows 10, you can use a Group Policy Object (GPO) to deploy a customized Start layout to users in a domain. ms.assetid: F4A47B36-F1EF-41CD-9CBA-04C83E960545 +ms.reviewer: +manager: dansimp keywords: ["Start layout", "start menu", "layout", "group policy"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp ms.topic: article -ms.date: 11/15/2017 --- # Customize Windows 10 Start and taskbar with Group Policy @@ -26,10 +27,10 @@ In Windows 10 Pro, Enterprise, and Education, you can use a Group Policy Object This topic describes how to update Group Policy settings to display a customized Start and taskbar layout when the users sign in. By creating a domain-based GPO with these settings, you can deploy a customized Start and taskbar layout to users in a domain. ->[!WARNING]   +>[!WARNING] >When a full Start layout is applied with this method, the users cannot pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to Start. When a partial Start layout is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups. When you apply a taskbar layout, users will still be able to pin and unpin apps, and change the order of pinned apps. -  + **Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) @@ -47,17 +48,17 @@ Three features enable Start and taskbar layout control: - The [Export-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/export-startlayout?view=win10-ps) cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. - >[!NOTE]   + >[!NOTE] >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/import-startlayout) cmdlet. - [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration. - In Group Policy, you use the **Start Layout** settings for the **Start Menu and Taskbar** administrative template to set a Start and taskbar layout from an .xml file when the policy is applied. The Group Policy object doesn't support an empty tile layout, so the default tile layout for Windows is loaded in that case. ->[!NOTE]   +>[!NOTE] >To learn how customize Start to include your line-of-business apps when you deploy Windows 10, see [Customize the Windows 10 Start layout]( https://go.microsoft.com/fwlink/p/?LinkId=620863). -  + ## Use Group Policy to apply a customized Start layout in a domain @@ -77,7 +78,7 @@ For information about deploying GPOs in a domain, see [Working with Group Policy You can use the Local Group Policy Editor to provide a customized Start and taskbar layout for any user who signs in on the local computer. To display the customized Start and taskbar layout for any user who signs in, configure **Start Layout** policy settings for the **Start Menu and Taskbar** administrative template. You can use the **Start Menu and Taskbar** administrative template in **User Configuration** or **Computer Configuration**. ->[!NOTE]   +>[!NOTE] >This procedure applies the policy settings on the local computer only. For information about deploying the Start and taskbar layout to users in a domain, see [Use Group Policy to deploy a customized Start layout in a domain](#bkmk-domaingpodeployment). > >This procedure creates a Local Group Policy that applies to all users on the computer. To configure Local Group Policy that applies to a specific user or group on the computer, see [Step-by-Step Guide to Managing Multiple Local Group Policy Objects](https://go.microsoft.com/fwlink/p/?LinkId=620881). The guide was written for Windows Vista and the procedures still apply to Windows 10. @@ -87,32 +88,32 @@ This procedure adds the customized Start and taskbar layout to the user configur **To configure Start Layout policy settings in Local Group Policy Editor** -1. On the test computer, press the Windows key, type **gpedit**, and then select **Edit group policy (Control panel)**. +1. On the test computer, press the Windows key, type **gpedit**, and then select **Edit group policy (Control panel)**. -2. Go to **User Configuration** or **Computer Configuration** > **Administrative Templates** >**Start Menu and Taskbar**. +2. Go to **User Configuration** or **Computer Configuration** > **Administrative Templates** >**Start Menu and Taskbar**. - ![start screen layout policy settings](images/starttemplate.jpg) + ![start screen layout policy settings](images/starttemplate.jpg) -3. Right-click **Start Layout** in the right pane, and click **Edit**. +3. Right-click **Start Layout** in the right pane, and click **Edit**. - This opens the **Start Layout** policy settings. + This opens the **Start Layout** policy settings. - ![policy settings for start screen layout](images/startlayoutpolicy.jpg) + ![policy settings for start screen layout](images/startlayoutpolicy.jpg) -4. Enter the following settings, and then click **OK**: +4. Enter the following settings, and then click **OK**: - 1. Select **Enabled**. + 1. Select **Enabled**. - 2. Under **Options**, specify the path to the .xml file that contains the Start and taskbar layout. For example, type **C:\\Users\\Test01\\StartScreenMarketing.xml**. + 2. Under **Options**, specify the path to the .xml file that contains the Start and taskbar layout. For example, type **C:\\Users\\Test01\\StartScreenMarketing.xml**. - 3. Optionally, enter a comment to identify the Start and taskbar layout. + 3. Optionally, enter a comment to identify the Start and taskbar layout. - >[!IMPORTANT]   - >If you disable Start Layout policy settings that have been in effect and then re-enable the policy, users will not be able to make changes to Start, however the layout in the .xml file will not be reapplied unless the file has been updated. In Windows PowerShell, you can update the timestamp on a file by running the following command: + > [!IMPORTANT] + > If you disable Start Layout policy settings that have been in effect and then re-enable the policy, users will not be able to make changes to Start, however the layout in the .xml file will not be reapplied unless the file has been updated. In Windows PowerShell, you can update the timestamp on a file by running the following command: + > + > `(ls ).LastWriteTime = Get-Date` - >`(ls ).LastWriteTime = Get-Date` - -   + ## Update a customized Start layout @@ -128,10 +129,10 @@ After you use Group Policy to apply a customized Start and taskbar layout on a c - [Add image for secondary tiles](start-secondary-tiles.md) - [Start layout XML for desktop editions of Windows 10 (reference)](start-layout-xml-desktop.md) - [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) -- [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +- [Customize Windows 10 Start and taskbar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) -  -  + + diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md b/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md index 2edbb87a07..047006fce2 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management.md @@ -1,14 +1,16 @@ --- -title: Customize Windows 10 Start and taskbar with mobile device management (MDM) (Windows 10) +title: Alter Windows 10 Start and taskbar via mobile device management description: In Windows 10, you can use a mobile device management (MDM) policy to deploy a customized Start and tasbkar layout to users. ms.assetid: F487850D-8950-41FB-9B06-64240127C1E4 +ms.reviewer: +manager: dansimp keywords: ["start screen", "start menu"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.topic: article -ms.author: jdecker +ms.author: dansimp ms.localizationpriority: medium ms.date: 02/08/2018 --- @@ -28,12 +30,12 @@ In Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, you can us >[!NOTE] >Support for applying a customized taskbar using MDM is added in Windows 10, version 1703. -**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions. +**Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions (also works for taskbar customization). ->[!WARNING]  +>[!WARNING] >When a full Start layout is applied with this method, the users cannot pin, unpin, or uninstall apps from Start. Users can view and open all apps in the **All Apps** view, but they cannot pin any apps to Start. When a partial Start layout is applied, the contents of the specified tile groups cannot be changed, but users can move those groups, and can also create and customize their own groups. -  + ## How Start layout control works @@ -42,10 +44,10 @@ Two features enable Start layout control: - The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. - >[!NOTE]   + >[!NOTE] >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/import-startlayout) cmdlet. -   + - In Microsoft Intune, you select the Start layout XML file and add it to a device configuration profile. @@ -90,9 +92,9 @@ For other MDM solutions, you may need to use an OMA-URI setting for Start layout - [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - [Customize Windows 10 Start and taskbar with provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) - [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) -  + -  + diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index 9fcf13b975..369f3eb6fb 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -2,15 +2,16 @@ title: Customize Windows 10 Start and tasbkar with provisioning packages (Windows 10) description: In Windows 10, you can use a provisioning package to deploy a customized Start layout to users. ms.assetid: AC952899-86A0-42FC-9E3C-C25F45B1ACAC +ms.reviewer: +manager: dansimp keywords: ["Start layout", "start menu"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium -ms.date: 11/15/2017 --- # Customize Windows 10 Start and taskbar with provisioning packages @@ -21,12 +22,12 @@ ms.date: 11/15/2017 - Windows 10 ->**Looking for consumer information?** [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) +> **Looking for consumer information?** [Customize the Start menu](https://go.microsoft.com/fwlink/p/?LinkId=623630) In Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education, version 1703, you can use a provisioning package that you create with Windows Configuration Designer to deploy a customized Start and taskbar layout to users. No reimaging is required, and the Start and taskbar layout can be updated simply by overwriting the .xml file that contains the layout. The provisioning package can be applied to a running device. This enables you to customize Start and taskbar layouts for different departments or organizations, with minimal management overhead. ->[!IMPORTANT] ->If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. +> [!IMPORTANT] +> If you use a provisioning package to configure the taskbar, your configuration will be reapplied each time the explorer.exe process restarts. If your configuration pins an app and the user unpins that app, the user's change will be overwritten the next time the configuration is applied. To apply a taskbar configuration and allow users to make changes that will persist, apply your configuration by using Group Policy. **Before you begin**: [Customize and export Start layout](customize-and-export-start-layout.md) for desktop editions. @@ -37,15 +38,16 @@ Three features enable Start and taskbar layout control: - The **Export-StartLayout** cmdlet in Windows PowerShell exports a description of the current Start layout in .xml file format. - >[!NOTE]   - >To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/import-startlayout) cmdlet. + > [!NOTE] + > To import the layout of Start to a mounted Windows image, use the [Import-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/import-startlayout) cmdlet. - [You can modify the Start .xml file](configure-windows-10-taskbar.md) to include `` or create an .xml file just for the taskbar configuration. - In Windows Configuration Designer, you use the **Policies/Start/StartLayout** setting to provide the contents of the .xml file that defines the Start and taskbar layout. - -## Prepare the Start layout XML file + + +## Prepare the Start layout XML file The **Export-StartLayout** cmdlet produces an XML file. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout section to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout section to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. @@ -59,8 +61,8 @@ The **Export-StartLayout** cmdlet produces an XML file. Because Windows Configur Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md) ->[!IMPORTANT] ->When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. +> [!IMPORTANT] +> When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. 1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). @@ -74,8 +76,8 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 6. Expand **Runtime settings** > **Policies** > **Start**, and click **StartLayout**. - >[!TIP] - >If **Start** is not listed, check the type of settings you selected in step 4. You must create the project using settings for **All Windows desktop editions**. + > [!TIP] + > If **Start** is not listed, check the type of settings you selected in step 4. You must create the project using settings for **All Windows desktop editions**. 7. Enter **layout.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the layout.xml file in a later step. @@ -128,7 +130,6 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L ## Related topics - - [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) - [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) - [Customize and export Start layout](customize-and-export-start-layout.md) @@ -137,12 +138,3 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) - [Customize Windows 10 Start and tasbkar with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) - [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) - -  - -  - - - - - diff --git a/windows/configuration/docfx.json b/windows/configuration/docfx.json index 67eda5ee5a..ea2a557e39 100644 --- a/windows/configuration/docfx.json +++ b/windows/configuration/docfx.json @@ -20,7 +20,7 @@ "files": [ "**/*.png", "**/*.jpg", - "**/*.gif" + "**/*.gif" ], "exclude": [ "**/obj/**", @@ -31,23 +31,23 @@ "overwrite": [], "externalReference": [], "globalMetadata": { - "uhfHeaderId": "MSDocsHeader-WindowsIT", - "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", - "ms.technology": "windows", - "ms.topic": "article", - "ms.author": "jdecker", - "feedback_system": "GitHub", - "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs", - "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app", - "_op_documentIdPathDepotMapping": { - "./": { - "depot_name": "MSDN.win-configuration" - } - } - }, + "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json", + "ms.technology": "windows", + "audience": "ITPro", + "ms.topic": "article", + "feedback_system": "None", + "hideEdit": true, + "_op_documentIdPathDepotMapping": { + "./": { + "depot_name": "MSDN.win-configuration", + "folder_relative_path_in_docset": "./" + } + }, + "titleSuffix": "Configure Windows" + }, "fileMetadata": {}, "template": [], "dest": "win-configuration", - "markdownEngineName": "dfm" + "markdownEngineName": "markdig" } -} \ No newline at end of file +} diff --git a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md index d765f93e06..2e441e90d2 100644 --- a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md +++ b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md @@ -1,8 +1,10 @@ --- title: Find the Application User Model ID of an installed app +ms.reviewer: +manager: dansimp description: To configure assigned access (kiosk mode), you need the Application User Model ID (AUMID) of apps installed on a device. -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.prod: w10 diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md index fdbc8f522a..bbe21777b6 100644 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ b/windows/configuration/guidelines-for-assigned-access-app.md @@ -5,11 +5,13 @@ keywords: ["kiosk", "lockdown", "assigned access"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp ms.topic: article ms.date: 10/02/2018 +ms.reviewer: +manager: dansimp --- # Guidelines for choosing an app for assigned access (kiosk mode) @@ -17,7 +19,7 @@ ms.date: 10/02/2018 **Applies to** -- Windows 10 +- Windows 10 You can use assigned access to restrict customers at your business to using only one Windows app so your device acts like a kiosk. Administrators can use assigned access to restrict a selected user account to access a single Windows app. You can choose almost any Windows app for assigned access; however, some apps may not provide a good user experience. @@ -66,7 +68,7 @@ In Windows 10, version 1803 and later, you can install the **Kiosk Browser** app Kiosk Browser settings | Use this setting to --- | --- -Blocked URL Exceptions | Specify URLs that people can navigate to, even though the URL is in your blocked URL list. You can use wildcards.

                              For example, if you want people to be limited to `contoso.com` only, you would add `contoso.com` to blocked URL exception list and then block all other URLs. +Blocked URL Exceptions | Specify URLs that people can navigate to, even though the URL is in your blocked URL list. You can use wildcards.

                              For example, if you want people to be limited to `http://contoso.com` only, you would add `.contoso.com` to blocked URL exception list and then block all other URLs. Blocked URLs | Specify URLs that people can't navigate to. You can use wildcards.

                              If you want to limit people to a specific site, add `https://*` to the blocked URL list, and then specify the site to be allowed in the blocked URL exceptions list. Default URL | Specify the URL that Kiosk Browser will open with. **Tip!** Make sure your blocked URLs don't include your default URL. Enable End Session Button | Show a button in Kiosk Browser that people can use to reset the browser. End Session will clear all browsing data and navigate back to the default URL. @@ -74,22 +76,22 @@ Enable Home Button | Show a Home button in Kiosk Browser. Home will return the b Enable Navigation Buttons | Show forward and back buttons in Kiosk Browser. Restart on Idle Time | Specify when Kiosk Browser should restart in a fresh state after an amount of idle time since the last user interaction. ->[!IMPORTANT] ->To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in Windows Configuration Designer: -> +> [!IMPORTANT] +> To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in Windows Configuration Designer: +> > 1. Create the provisioning package. When ready to export, close the project in Windows Configuration Designer. ->2. Open the customizations.xml file in the project folder (e.g C:\Users\name\Documents\Windows Imaging and Configuration Designer (WICD)\Project_18). ->3. Insert the null character string in between each URL (e.g www.bing.com``www.contoso.com). ->4. Save the XML file. ->5. Open the project again in Windows Configuration Designer. ->6. Export the package. Ensure you do not revisit the created policies under Kiosk Browser or else the null character will be removed. - - ->[!TIP] ->To enable the **End Session** button for Kiosk Browser in Intune, you must [create a custom OMA-URI policy](https://docs.microsoft.com/intune/custom-settings-windows-10) with the following information: ->- OMA-URI: ./Vendor/MSFT/Policy/Config/KioskBrowser/EnableEndSessionButton ->- Data type: Integer ->- Value: 1 +> 2. Open the customizations.xml file in the project folder (e.g C:\Users\name\Documents\Windows Imaging and Configuration Designer (WICD)\Project_18). +> 3. Insert the null character string in between each URL (e.g www.bing.com``www.contoso.com). +> 4. Save the XML file. +> 5. Open the project again in Windows Configuration Designer. +> 6. Export the package. Ensure you do not revisit the created policies under Kiosk Browser or else the null character will be removed. +> +> +> [!TIP] +> To enable the **End Session** button for Kiosk Browser in Intune, you must [create a custom OMA-URI policy](https://docs.microsoft.com/intune/custom-settings-windows-10) with the following information: +> - OMA-URI: ./Vendor/MSFT/Policy/Config/KioskBrowser/EnableEndSessionButton +> - Data type: Integer +> - Value: 1 #### Rules for URLs in Kiosk Browser settings @@ -115,7 +117,7 @@ Additional guidelines for URLs: The following table describes the results for different combinations of blocked URLs and blocked URL exceptions. -Blocked URL rule | Block URL exception rule | Result +Blocked URL rule | Block URL exception rule | Result --- | --- | --- `*` | `contoso.com`
                              `fabrikam.com` | All requests are blocked unless it is to contoso.com, fabrikam.com, or any of their subdomains. `contoso.com` | `mail.contoso.com`
                              `.contoso.com`
                              `.www.contoso.com` | Block all requests to contoso.com, except for the main page and its mail subdomain. @@ -123,18 +125,19 @@ Blocked URL rule | Block URL exception rule | Result The following table gives examples for blocked URLs. -Entry | Result ---- | --- -`contoso.com` | Blocks all requests to contoso.com, www.contoso.com, and sub.www.contoso.com -`https://*` | Blocks all HTTPS requests to any domain. -`mail.contoso.com` | Blocks requests to mail.contoso.com but not to www.contoso.com or contoso.com -`.contoso.com` | Blocks contoso.com but not its subdomains, like subdomain.contoso.com. -`.www.contoso.com` | Blocks www.contoso.com but not its subdomains. -`*` | Blocks all requests except for URLs in the Blocked URL Exceptions list. -`*:8080` | Blocks all requests to port 8080. -`contoso.com/stuff` | Blocks all requests to contoso.com/stuff and its subdomains. -`192.168.1.2` | Blocks requests to 192.168.1.2. -`youtube.com/watch?v=V1` | Blocks youtube video with id V1. + +| Entry | Result | +|--------------------------|-------------------------------------------------------------------------------| +| `contoso.com` | Blocks all requests to contoso.com, www.contoso.com, and sub.www.contoso.com | +| `https://*` | Blocks all HTTPS requests to any domain. | +| `mail.contoso.com` | Blocks requests to mail.contoso.com but not to www.contoso.com or contoso.com | +| `.contoso.com` | Blocks contoso.com but not its subdomains, like subdomain.contoso.com. | +| `.www.contoso.com` | Blocks www.contoso.com but not its subdomains. | +| `*` | Blocks all requests except for URLs in the Blocked URL Exceptions list. | +| `*:8080` | Blocks all requests to port 8080. | +| `contoso.com/stuff` | Blocks all requests to contoso.com/stuff and its subdomains. | +| `192.168.1.2` | Blocks requests to 192.168.1.2. | +| `youtube.com/watch?v=V1` | Blocks youtube video with id V1. | ### Other browsers @@ -144,7 +147,7 @@ You can create your own web browser Windows app by using the WebView class. Lear - [Creating your own browser with HTML and JavaScript](https://blogs.windows.com/msedgedev/2015/08/27/creating-your-own-browser-with-html-and-javascript/) - [WebView class](https://msdn.microsoft.com/library/windows/apps/windows.ui.xaml.controls.webview.aspx) - [A web browser built with JavaScript as a Windows app](https://github.com/MicrosoftEdge/JSBrowser/tree/v1.0) - + ## Secure your information @@ -170,7 +173,7 @@ The above guidelines may help you select or develop an appropriate Windows app f -  + diff --git a/windows/configuration/images/slv2-oma-uri.png b/windows/configuration/images/slv2-oma-uri.png new file mode 100644 index 0000000000..98ee252b63 Binary files /dev/null and b/windows/configuration/images/slv2-oma-uri.png differ diff --git a/windows/configuration/index.md b/windows/configuration/index.md index 6517e9e14f..ca42852107 100644 --- a/windows/configuration/index.md +++ b/windows/configuration/index.md @@ -7,10 +7,10 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: high -author: jdeckerms -ms.author: jdecker +manager: dansimp +author: dansimp +ms.author: dansimp ms.topic: article -ms.date: 05/11/2018 --- # Configure Windows 10 diff --git a/windows/configuration/kiosk-additional-reference.md b/windows/configuration/kiosk-additional-reference.md index 72377d11f6..aa203bd090 100644 --- a/windows/configuration/kiosk-additional-reference.md +++ b/windows/configuration/kiosk-additional-reference.md @@ -2,13 +2,15 @@ title: More kiosk methods and reference information (Windows 10) description: Find more information for configuring, validating, and troubleshooting kiosk configuration. ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +ms.reviewer: +manager: dansimp +ms.author: dansimp keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.date: 09/13/2018 ms.topic: reference --- @@ -30,7 +32,7 @@ Topic | Description [Policies enforced on kiosk devices](kiosk-policies.md) | Learn about the policies enforced on a device when you configure it as a kiosk. [Assigned access XML reference](kiosk-xml.md) | The XML and XSD for kiosk device configuration. [Use AppLocker to create a Windows 10 kiosk](lock-down-windows-10-applocker.md) | Learn how to use AppLocker to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education, version 1703 and earlier, so that users can only run a few specific apps. -[Use Shell Launcher to create a Windows 10 kiosk](kiosk-shelllauncher.md) | Using Shell Launcher, you can configure a kiosk device that runs a Windows desktop application as the user interface. +[Use Shell Launcher to create a Windows 10 kiosk](kiosk-shelllauncher.md) | Using Shell Launcher, you can configure a kiosk device that runs a Windows application as the user interface. [Use MDM Bridge WMI Provider to create a Windows 10 kiosk](kiosk-mdm-bridge.md) | Environments that use Windows Management Instrumentation (WMI) can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class. [Troubleshoot kiosk mode issues](kiosk-troubleshoot.md) | Tips for troubleshooting multi-app kiosk configuration. diff --git a/windows/configuration/kiosk-mdm-bridge.md b/windows/configuration/kiosk-mdm-bridge.md index f769ca9fe4..51eeccc08b 100644 --- a/windows/configuration/kiosk-mdm-bridge.md +++ b/windows/configuration/kiosk-mdm-bridge.md @@ -2,11 +2,14 @@ title: Use MDM Bridge WMI Provider to create a Windows 10 kiosk (Windows 10) description: Environments that use Windows Management Instrumentation (WMI)can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class. ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +ms.reviewer: +manager: dansimp +ms.author: dansimp keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 11/07/2018 ms.topic: article @@ -28,60 +31,61 @@ Here’s an example to set AssignedAccess configuration: 3. In the command prompt launched by psexec.exe, enter `powershell.exe` to open PowerShell. 4. Execute the following script: -```ps +```xml $nameSpaceName="root\cimv2\mdm\dmmap" $className="MDM_AssignedAccess" $obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -$obj.Configuration = @" -<?xml version="1.0" encoding="utf-8" ?> -<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"> - <Profiles> - <Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"> - <AllAppsList> - <AllowedApps> - <App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> - <App AppUserModelId="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> - <App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> - <App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> - <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> - <App DesktopAppPath="%windir%\system32\mspaint.exe" /> - <App DesktopAppPath="C:\Windows\System32\notepad.exe" /> - </AllowedApps> - </AllAppsList> - <StartLayout> - <![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"> - <LayoutOptions StartTileGroupCellWidth="6" /> - <DefaultLayoutOverride> - <StartLayoutCollection> - <defaultlayout:StartLayout GroupCellWidth="6"> - <start:Group Name="Group1"> - <start:Tile Size="4x4" Column="0" Row="0" AppUserModelID="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> - <start:Tile Size="2x2" Column="4" Row="2" AppUserModelID="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> - <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> - <start:Tile Size="2x2" Column="4" Row="4" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> - <start:Tile Size="4x2" Column="0" Row="4" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> - </start:Group> - <start:Group Name="Group2"> - <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk" /> - <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk" /> - </start:Group> - </defaultlayout:StartLayout> - </StartLayoutCollection> - </DefaultLayoutOverride> - </LayoutModificationTemplate> - ]]> - </StartLayout> - <Taskbar ShowTaskbar="true"/> - </Profile> - </Profiles> - <Configs> - <Config> - <Account>MultiAppKioskUser</Account> - <DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/> - </Config> - </Configs> -</AssignedAccessConfiguration> -"@ +Add-Type -AssemblyName System.Web +$obj.Configuration = [System.Web.HttpUtility]::HtmlEncode(@" + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + MultiAppKioskUser + + + + +"@) Set-CimInstance -CimInstance $obj ``` diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md index 888cbc3049..c319385e70 100644 --- a/windows/configuration/kiosk-methods.md +++ b/windows/configuration/kiosk-methods.md @@ -1,17 +1,23 @@ --- title: Configure kiosks and digital signs on Windows desktop editions (Windows 10) +ms.reviewer: +manager: dansimp +ms.author: dansimp description: Learn about the methods for configuring kiosks. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: jdeckerms +author: dansimp ms.topic: article --- # Configure kiosks and digital signs on Windows desktop editions +>[!WARNING] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + Some desktop devices in an enterprise serve a special purpose, such as a PC in the lobby that customers can use to view your product catalog or a PC displaying visual content as a digital sign. Windows 10 offers two different locked-down experiences for public or specialized use: | | | @@ -43,6 +49,7 @@ You can use this method | For this edition | For this kiosk account type [Assigned access cmdlets](kiosk-single-app.md#powershell) | Pro, Ent, Edu | Local standard user [The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | Pro (version 1709), Ent, Edu | Local standard user, Active Directory, Azure AD [Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md#mdm) | Pro (version 1709), Ent, Edu | Local standard user, Azure AD +[Shell Launcher](kiosk-shelllauncher.md) v2 | Ent, Edu | Local standard user, Active Directory, Azure AD ## Methods for a single-app kiosk running a Windows desktop application @@ -50,8 +57,8 @@ You can use this method | For this edition | For this kiosk account type You can use this method | For this edition | For this kiosk account type --- | --- | --- [The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | Ent, Edu | Local standard user, Active Directory, Azure AD -[Shell Launcher](kiosk-shelllauncher.md) | Ent, Edu | Local standard user, Active Directory, Azure AD [Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md#mdm) | Pro (version 1709), Ent, Edu | Local standard user, Azure AD +[Shell Launcher](kiosk-shelllauncher.md) v1 and v2 | Ent, Edu | Local standard user, Active Directory, Azure AD ## Methods for a multi-app kiosk diff --git a/windows/configuration/kiosk-policies.md b/windows/configuration/kiosk-policies.md index ace4d35ec9..a523b64e83 100644 --- a/windows/configuration/kiosk-policies.md +++ b/windows/configuration/kiosk-policies.md @@ -2,15 +2,17 @@ title: Policies enforced on kiosk devices (Windows 10) description: Learn about the policies enforced on a device when you configure it as a kiosk. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 +ms.reviewer: +manager: dansimp keywords: ["lockdown", "app restrictions", "applocker"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: edu, security -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 07/30/2018 -ms.author: jdecker +ms.author: dansimp ms.topic: article --- diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md index f484267983..aaa526a014 100644 --- a/windows/configuration/kiosk-prepare.md +++ b/windows/configuration/kiosk-prepare.md @@ -2,13 +2,15 @@ title: Prepare a device for kiosk configuration (Windows 10) description: Some tips for device settings on kiosks. ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +ms.reviewer: +manager: dansimp +ms.author: dansimp keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.date: 01/09/2019 ms.topic: article --- @@ -19,24 +21,26 @@ ms.topic: article - Windows 10 Pro, Enterprise, and Education ->[!WARNING] ->For kiosks in public-facing environments with auto sign-in enabled, you should use a user account with least privilege, such as a local standard user account. +> [!WARNING] +> For kiosks in public-facing environments with auto sign-in enabled, you should use a user account with the least privileges, such as a local standard user account. > ->Assigned access can be configured via Windows Management Instrumentation (WMI) or configuration service provider (CSP) to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. +> Assigned access can be configured via Windows Management Instrumentation (WMI) or configuration service provider (CSP) to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that might allow an attacker subverting the assigned access application to gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. ->[!IMPORTANT] ->[User account control (UAC)](https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode. +> [!IMPORTANT] +> [User account control (UAC)](https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode. > ->Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk. +> Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk. ## Configuration recommendations -For a more secure kiosk experience, we recommend that you make the following configuration changes to the device before you configure it as a kiosk: +For a more secure kiosk experience, we recommend that you make the following configuration changes to the device before you configure it as a kiosk: Recommendation | How to --- | --- -Hide update notifications
                              (New in Windows 10, version 1809) | Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\Windows Components\\Windows Update\\Display options for update notifications**
                              -or-
                              Use the MDM setting **Update/UpdateNotificationLevel** from the [**Policy/Update** configuration service provider](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel)
                              -or-
                              Add the following registry keys as DWORD (32-bit) type:
                              `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\SetUpdateNotificationLevel` with a value of `1`, and `HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\UpdateNotificationLevel` with a value of `1` to hide all notifications except restart warnings, or value of `2` to hide all notifications, including restart warnings. -Replace "blue screen" with blank screen for OS errors | Add the following registry key as DWORD (32-bit) type with a value of `1`:

                              `HKLM\SYSTEM\CurrentControlSet\Control\CrashControl\DisplayDisabled` +Hide update notifications
                              (New in Windows 10, version 1809) | Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\Windows Components\\Windows Update\\Display options for update notifications**
                              -or-
                              Use the MDM setting **Update/UpdateNotificationLevel** from the [**Policy/Update** configuration service provider](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updatenotificationlevel)
                              -or-
                              Add the following registry keys as type DWORD (32-bit) in the path of **HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate**:
                              **\SetUpdateNotificationLevel** with a value of `1`, and **\UpdateNotificationLevel** with a value of `1` to hide all notifications except restart warnings, or value of `2` to hide all notifications, including restart warnings. +Enable and schedule automatic updates | Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\Windows Components\\Windows Update\\Configure Automatic Updates**, and select `option 4 (Auto download and schedule the install)`
                              -or-
                              Use the MDM setting **Update/AllowAutoUpdate** from the [**Policy/Update** configuration service provider](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate), and select `option 3 (Auto install and restart at a specified time)`

                              **Note:** Installations can take from between 30 minutes and 2 hours, depending on the device, so you should schedule updates to occur when a block of 3-4 hours is available.

                              To schedule the automatic update, configure **Schedule Install Day**, **Schedule Install Time**, and **Schedule Install Week**. +Enable automatic restart at the scheduled time | Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\Windows Components\\Windows Update\\Always automatically restart at the scheduled time** +Replace "blue screen" with blank screen for OS errors | Add the following registry key as DWORD (32-bit) type with a value of `1`:

                              **HKLM\SYSTEM\CurrentControlSet\Control\CrashControl\DisplayDisabled** Put device in **Tablet mode**. | If you want users to be able to use the touch (on screen) keyboard, go to **Settings** > **System** > **Tablet mode** and choose **On.** Do not turn on this setting if users will not interact with the kiosk, such as for a digital sign. Hide **Ease of access** feature on the sign-in screen. | See [how to disable the Ease of Access button in the registry.](https://docs.microsoft.com/windows-hardware/customize/enterprise/complementary-features-to-custom-logon#welcome-screen) Disable the hardware power button. | Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**. @@ -56,40 +60,45 @@ Logs can help you [troubleshoot issues](multi-app-kiosk-troubleshoot.md) kiosk i In addition to the settings in the table, you may want to set up **automatic logon** for your kiosk device. When your kiosk device restarts, whether from an update or power outage, you can sign in the assigned access account manually or you can configure the device to sign in to the assigned access account automatically. Make sure that Group Policy settings applied to the device do not prevent automatic sign in. ->[!TIP] ->If you use the [kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) or [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) to configure your kiosk, you can set an account to sign in automatically in the wizard or XML. +> [!NOTE] +> If you are using a Windows 10 and later device restriction CSP to set "Preferred Azure AD tenant domain", this will break the "User logon type" auto-login feature of the Kiosk profile. + +> [!TIP] +> If you use the [kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) or [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) to configure your kiosk, you can set an account to sign in automatically in the wizard or XML. **How to edit the registry to have an account sign in automatically** -1. Open Registry Editor (regedit.exe). +1. Open Registry Editor (regedit.exe). - >[!NOTE]   - >If you are not familiar with Registry Editor, [learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002). -   + > [!NOTE] + > If you are not familiar with Registry Editor, [learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002). + + +2. Go to -2. Go to + **HKEY\_LOCAL\_MACHINE\SOFTWARE\\Microsoft\Windows NT\CurrentVersion\Winlogon** - **HKEY\_LOCAL\_MACHINE\SOFTWARE\\Microsoft\WindowsNT\CurrentVersion\Winlogon** +3. Set the values for the following keys. -3. Set the values for the following keys. + - *AutoAdminLogon*: set value as **1**. - - *AutoAdminLogon*: set value as **1**. + - *DefaultUserName*: set value as the account that you want signed in. - - *DefaultUserName*: set value as the account that you want signed in. + - *DefaultPassword*: set value as the password for the account. - - *DefaultPassword*: set value as the password for the account. + > [!NOTE] + > If *DefaultUserName* and *DefaultPassword* aren't there, add them as **New** > **String Value**. - > [!NOTE] - > If *DefaultUserName* and *DefaultPassword* aren't there, add them as **New** > **String Value**. + - *DefaultDomainName*: set value for domain, only for domain accounts. For local accounts, do not add this key. - - *DefaultDomainName*: set value for domain, only for domain accounts. For local accounts, do not add this key. +4. Close Registry Editor. The next time the computer restarts, the account will sign in automatically. -4. Close Registry Editor. The next time the computer restarts, the account will sign in automatically. - ->[!TIP] ->You can also configure automatic sign-in [using the Autologon tool from Sysinternals](https://docs.microsoft.com/sysinternals/downloads/autologon). +> [!TIP] +> You can also configure automatic sign-in [using the Autologon tool from Sysinternals](https://docs.microsoft.com/sysinternals/downloads/autologon). +> [!NOTE] +> If you are also using [Custom Logon](https://docs.microsoft.com/windows-hardware/customize/enterprise/custom-logon) with **HideAutoLogonUI** enabled, you might experience a black screen after a password expires. We recommend that you consider [setting the password to never expire](https://docs.microsoft.com/windows-hardware/customize/enterprise/troubleshooting-custom-logon#the-device-displays-a-black-screen-when-a-password-expiration-screen-is-displayed). ## Interactions and interoperability @@ -113,7 +122,7 @@ The following table describes some features that have interoperability issues we

                              Accessibility

                              Assigned access does not change Ease of Access settings.

                              -

                              We recommend that you use [Keyboard Filter](https://docs.microsoft.com/windows-hardware/customize/enterprise/keyboardfilter) to block the following key combinations that bring up accessibility features:

                              +

                              We recommend that you use Keyboard Filter to block the following key combinations that bring up accessibility features:

                              @@ -144,13 +153,13 @@ The following table describes some features that have interoperability issues we - + - - + + - - + + - - + + - - + + +

                              Learn how to use Shell Launcher to create a kiosk device that runs a Windows desktop application.

                              - - + + - - + + - + +

                              MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Allow action center notifications and a custom OMA-URI setting for AboveLock/AllowActionCenterNotifications.

                              - - + + - + - - + + +

                              Learn how to use Assigned Access to create a kiosk device that runs a Universal Windows app.

                              - + - + - - + + - - + +

                              Assigned access Windows PowerShell cmdlets

                              In addition to using the Windows UI, you can use the Windows PowerShell cmdlets to set or clear assigned access. For more information, see [Assigned access Windows PowerShell reference](https://docs.microsoft.com/powershell/module/assignedaccess/?view=win10-ps).

                              In addition to using the Windows UI, you can use the Windows PowerShell cmdlets to set or clear assigned access. For more information, see Assigned access Windows PowerShell reference.

                              Key sequences blocked by assigned access

                              When in assigned access, some key combinations are blocked for assigned access users.

                              -

                              Alt+F4, Alt+Shift+TaB, Alt+Tab are not blocked by Assigned Access, it is recommended you use [Keyboard Filter](https://docs.microsoft.com/windows-hardware/customize/enterprise/keyboardfilter) to block these key combinations.

                              -

                              Ctrl+Alt+Delete is the key to break out of Assigned Access. If needed, you can use Keyboard Filter to configure a different key combination to break out of assigned access by setting BreakoutKeyScanCode as described in [WEKF_Settings](https://docs.microsoft.com/windows-hardware/customize/enterprise/wekf-settings).

                              +

                              Alt+F4, Alt+Shift+TaB, Alt+Tab are not blocked by Assigned Access, it is recommended you use Keyboard Filter to block these key combinations.

                              +

                              Ctrl+Alt+Delete is the key to break out of Assigned Access. If needed, you can use Keyboard Filter to configure a different key combination to break out of assigned access by setting BreakoutKeyScanCode as described in WEKF_Settings.

                              @@ -209,42 +218,42 @@ The following table describes some features that have interoperability issues we

                              Keyboard Filter settings apply to other standard accounts.

                              - - + +

                              For more information on removing the power button or disabling the physical power button, see Custom Logon.

                              +

                              For more information, see Unified Write Filter.

                              +

                              If you need to use assigned access API, see WEDL_AssignedAccess.

                              +

                              For more information, see Custom Logon.

                              Key sequences blocked by [Keyboard Filter](https://docs.microsoft.com/windows-hardware/customize/enterprise/keyboardfilter)

                              If Keyboard Filter is turned ON then some key combinations are blocked automatically without you having to explicitly block them. For more information, see the [Keyboard Filter](https://docs.microsoft.com/windows-hardware/customize/enterprise/keyboardfilter) reference topic.

                              -

                              [Keyboard Filter](https://docs.microsoft.com/windows-hardware/customize/enterprise/keyboardfilter) is only available on Windows 10 Enterprise or Windows 10 Education.

                              +

                              Key sequences blocked by Keyboard Filter

                              If Keyboard Filter is turned ON then some key combinations are blocked automatically without you having to explicitly block them. For more information, see the Keyboard Filter reference topic.

                              +

                              Keyboard Filter is only available on Windows 10 Enterprise or Windows 10 Education.

                              Power button

                              Customizations for the Power button complement assigned access, letting you implement features such as removing the power button from the Welcome screen. Removing the power button ensures the user cannot turn off the device when it is in assigned access.

                              -

                              For more information on removing the power button or disabling the physical power button, see [Custom Logon](https://docs.microsoft.com/windows-hardware/customize/enterprise/custom-logon).

                              Unified Write Filter (UWF)

                              UWFsettings apply to all users, including those with assigned access.

                              -

                              For more information, see [Unified Write Filter](https://docs.microsoft.com/windows-hardware/customize/enterprise/unified-write-filter).

                              WEDL_AssignedAccess class

                              Although you can use this class to configure and manage basic lockdown features for assigned access, we recommend that you use the Windows PowerShell cmdlets instead.

                              -

                              If you need to use assigned access API, see [WEDL_AssignedAccess](whttps://docs.microsoft.com/windows-hardware/customize/enterprise/wedl-assignedaccess).

                              Welcome Screen

                              Customizations for the Welcome screen let you personalize not only how the Welcome screen looks, but for how it functions. You can disable the power or language button, or remove all user interface elements. There are many options to make the Welcome screen your own.

                              -

                              For more information, see [Custom Logon](https://docs.microsoft.com/windows-hardware/customize/enterprise/custom-logon).
                              + - ## Testing your kiosk in a virtual machine (VM) Customers sometimes use virtual machines (VMs) to test configurations before deploying those configurations to physical devices. If you use a VM to test your single-app kiosk configuration, you need to know how to connect to the VM properly. -A single-app kiosk kiosk configuration runs an app above the lockscreen. It doesn't work when it's accessed remotely, which includes *enhanced* sessions in Hyper-V. +A single-app kiosk configuration runs an app above the lock screen. It doesn't work when it's accessed remotely, which includes *enhanced* sessions in Hyper-V. When you connect to a VM configured as a single-app kiosk, you need a *basic* session rather than an enhanced session. In the following image, notice that **Enhanced session** is not selected in the **View** menu; that means it's a basic session. @@ -252,4 +261,4 @@ When you connect to a VM configured as a single-app kiosk, you need a *basic* se To connect to a VM in a basic session, do not select **Connect** in the connection dialog, as shown in the following image, but instead, select the **X** button in the upper-right corner to cancel the dialog. -![Do not select connect button, use close X in corner](images/vm-kiosk-connect.png) +![Do not select the connect button, use "close X" in the top corner](images/vm-kiosk-connect.png) diff --git a/windows/configuration/kiosk-shelllauncher.md b/windows/configuration/kiosk-shelllauncher.md index cb4de9b225..327042ee5c 100644 --- a/windows/configuration/kiosk-shelllauncher.md +++ b/windows/configuration/kiosk-shelllauncher.md @@ -1,14 +1,16 @@ --- title: Use Shell Launcher to create a Windows 10 kiosk (Windows 10) -description: A single-use device such as a digital sign is easy to set up in Windows 10 for desktop editions (Pro, Enterprise, and Education). +description: Shell Launcher lets you change the default shell that launches when a user signs in to a device. ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +ms.reviewer: +manager: dansimp +ms.author: dansimp keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.date: 10/01/2018 ms.topic: article --- @@ -16,26 +18,36 @@ ms.topic: article **Applies to** ->App type: Windows desktop application -> ->OS edition: Windows 10 Ent, Edu -> ->Account type: Local standard user or administrator, Active Directory, Azure AD +- Windows 10 Ent, Edu +>[!WARNING] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -Using Shell Launcher, you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on. +Using Shell Launcher, you can configure a device that runs an application as the user interface, replacing the default shell (explorer.exe). In **Shell Launcher v1**, available in Windows 10, version 1809 and earlier, you can only specify a Windows desktop application as the replacement shell. In **Shell Launcher v2**, available in the next feature update to Windows 10, you can also specify a UWP app as the replacement shell. >[!NOTE] ->Using the Shell Launcher controls which application the user sees as the shell after sign-in. It does not prevent the user from accessing other desktop applications and system components. +>Shell Launcher controls which application the user sees as the shell after sign-in. It does not prevent the user from accessing other desktop applications and system components. > >Methods of controlling access to other desktop applications and system components can be used in addition to using the Shell Launcher. These methods include, but are not limited to: >- [Group Policy](https://www.microsoft.com/download/details.aspx?id=25250) - example: Prevent access to registry editing tools >- [AppLocker](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview) - Application control policies >- [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm) - Enterprise management of device security policies -> ->You can also configure a kiosk device that runs a Windows desktop application by using the [Provision kiosk devices wizard](kiosk-single-app.md#wizard). - +You can apply a custom shell through Shell Launcher [by using PowerShell](#configure-a-custom-shell-using-powershell). In Windows 10, version 1803 and later, you can also [use mobile device management (MDM)](#configure-a-custom-shell-in-mdm) to apply a custom shell through Shell Launcher. + + +## Differences between Shell Launcher v1 and Shell Launcher v2 + +Shell Launcher v1 replaces `explorer.exe`, the default shell, with `eshell.exe` which can launch a Windows desktop application. + +Shell Launcher v2 replaces `explorer.exe` with `customshellhost.exe`. This new executable file can launch a Windows desktop application or a UWP app. + +In addition to allowing you to use a UWP app for your replacement shell, Shell Launcher v2 offers additional enhancements: +- You can use a custom Windows desktop application that can then launch UWP apps, such as **Settings** and **Touch Keyboard**. +- From a custom UWP shell, you can launch secondary views and run on multiple monitors. +- The custom shell app runs in full screen, and can run other apps in full screen on user’s demand. + +For sample XML configurations for the different app combinations, see [Samples for Shell Launcher v2](https://github.com/Microsoft/Windows-iotcore-samples/tree/develop/Samples/ShellLauncherV2). ## Requirements @@ -44,16 +56,15 @@ Using Shell Launcher, you can configure a kiosk device that runs a Windows deskt > >- Shell Launcher doesn't support a custom shell with an application that launches a different process and exits. For example, you cannot specify **write.exe** in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. **Write.exe** creates a 32-bit wordpad.exe process and exits. Because Shell Launcher is not aware of the newly created wordpad.exe process, Shell Launcher will take action based on the exit code of **Write.exe**, such as restarting the custom shell. -- A domain or local user account. +- A domain, Azure Active Directory, or local user account. -- A Windows desktop application that is installed for that account. The app can be your own company application or a common app like Internet Explorer. +- A Windows application that is installed for that account. The app can be your own company application or a common app like Internet Explorer. -[See the technical reference for the shell launcher component.](https://go.microsoft.com/fwlink/p/?LinkId=618603) +[See the technical reference for the shell launcher component.](https://docs.microsoft.com/windows-hardware/customize/enterprise/shell-launcher) +## Enable Shell Launcher feature -## Configure Shell Launcher - -To set a Windows desktop application as the shell, you first turn on the Shell Launcher feature, and then you can set your custom shell as the default using PowerShell. +To set a custom shell, you first turn on the Shell Launcher feature, and then you can set your custom shell as the default using PowerShell or MDM. **To turn on Shell Launcher in Windows features** @@ -63,7 +74,7 @@ To set a Windows desktop application as the shell, you first turn on the Shell L 2. Select **Shell Launcher** and **OK**. -Alternatively, you can turn on Shell Launcher using Windows Configuration Designer in a provisioning package, using `SMISettings > ShellLauncher`, or the Deployment Image Servicing and Management (DISM.exe) tool. +Alternatively, you can turn on Shell Launcher using Windows Configuration Designer in a provisioning package, using `SMISettings > ShellLauncher`, or you can use the Deployment Image Servicing and Management (DISM.exe) tool. **To turn on Shell Launcher using DISM** @@ -74,11 +85,72 @@ Alternatively, you can turn on Shell Launcher using Windows Configuration Design Dism /online /Enable-Feature /all /FeatureName:Client-EmbeddedShellLauncher ``` -**To set your custom shell** -Modify the following PowerShell script as appropriate. The comments in the sample script explain the purpose of each section and tell you where you will want to change the script for your purposes. Save your script with the extension .ps1, open Windows PowerShell as administrator, and run the script on the kiosk device. +## Configure a custom shell in MDM -``` +You can use XML and a [custom OMA-URI setting](#custom-oma-uri-setting) to configure Shell Launcher in MDM. + +### XML for Shell Launcher configuration + +The following XML sample works for **Shell Launcher v1**: + +```xml + + + + + + + + + + + + + +``` + +For **Shell Launcher v2**, you can use UWP app type for `Shell` by specifying the v2 namespace, and use `v2:AppType` to specify the type, as shown in the following example. If `v2:AppType` is not specified, it implies the shell is Win32 app. + +```xml + + + + + + + + + + + +``` + +>[!TIP] +>In the XML for Shell Launcher v2, note the **AllAppsFullScreen** attribute. When set to **True**, Shell Launcher will run every app in full screen, or maximized for desktop apps. When this attribute is set to **False** or not set, only the custom shell app runs in full screen; other apps launched by the user will run in windowed mode. + +[Get XML examples for different Shell Launcher v2 configurations.](https://github.com/Microsoft/Windows-iotcore-samples/tree/develop/Samples/ShellLauncherV2) + +### Custom OMA-URI setting + +In your MDM service, you can create a [custom OMA-URI setting](https://docs.microsoft.com/intune/custom-settings-windows-10) to configure Shell Launcher v1 or v2. (The [XML](#xml-for-shell-launcher-configuration) that you use for your setting will determine whether you apply Shell Launcher v1 or v2.) + +The OMA-URI path is `./Device/Vendor/MSFT/AssignedAccess/ShellLauncher`. + +For the value, you can select data type `String` and paste the desired configuration file content into the value box. If you wish to upload the xml instead of pasting the content, choose data type `String (XML file)`. + +![Screenshot of custom OMA-URI settings](images/slv2-oma-uri.png) + +After you configure the profile containing the custom Shell Launcher setting, select **All Devices** or selected groups of devices to apply the profile to. Don't assign the profile to users or user groups. + +## Configure a custom shell using PowerShell + +For scripts for Shell Launcher v2, see [Shell Launcher v2 Bridge WMI sample scripts](https://github.com/Microsoft/Windows-iotcore-samples/blob/develop/Samples/ShellLauncherV2/SampleBridgeWmiScripts/README.md). + +For Shell Launcher v1, modify the following PowerShell script as appropriate. The comments in the sample script explain the purpose of each section and tell you where you will want to change the script for your purposes. Save your script with the extension .ps1, open Windows PowerShell as administrator, and run the script on the kiosk device. + +```powershell # Check if shell launcher license is enabled function Check-ShellLauncherLicenseEnabled { @@ -210,3 +282,27 @@ $IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled() "`nEnabled is set to " + $IsShellLauncherEnabled.Enabled ``` + +## default action, custom action, exit code +Shell launcher defines 4 actions to handle app exits, you can customize shell launcher and use these actions based on different exit code. + +Value|Description +--- | --- +0|Restart the shell +1|Restart the device +2|Shut down the device +3|Do nothing + +These action can be used as default action, or can be mapped to a specific exit code. Refer to [Shell Launcher](https://docs.microsoft.com/windows-hardware/customize/enterprise/wesl-usersettingsetcustomshell) to see how these codes with Shell Launcher WMI. + +To configure these action with Shell Launcher CSP, use below syntax in the shell launcher configuration xml. You can specify at most 4 custom actions mapping to 4 exit codes, and one default action for all other exit codes. When app exits and if the exit code is not found in the custom action mapping, or there is no default action defined, it will be no-op, i.e. nothing happens. So it's recommeded to at least define DefaultAction. [Get XML examples for different Shell Launcher v2 configurations.](https://github.com/Microsoft/Windows-iotcore-samples/tree/develop/Samples/ShellLauncherV2) +``` xml + + + + + + + + +``` diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index 439acaa52b..92c0f753d1 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -2,11 +2,14 @@ title: Set up a single-app kiosk (Windows 10) description: A single-use device is easy to set up in Windows 10 for desktop editions (Pro, Enterprise, and Education). ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +ms.reviewer: +manager: dansimp +ms.author: dansimp keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 01/09/2019 ms.topic: article @@ -28,7 +31,7 @@ A single-app kiosk uses the Assigned Access feature to run a single app above th >[!IMPORTANT] >[User account control (UAC)](https://docs.microsoft.com/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode. > ->Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk. +>Kiosk mode is not supported over a remote desktop connection. Your kiosk users must sign in on the physical device that is set up as a kiosk. Apps that run in kiosk mode cannot use copy and paste. You have several options for configuring your single-app kiosk. @@ -42,10 +45,13 @@ Method | Description >[!TIP] >You can also configure a kiosk account and app for single-app kiosk within [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) by using a [kiosk profile](lock-down-windows-10-to-specific-apps.md#profile). +> +>Be sure to check the [configuration recommendations](kiosk-prepare.md) before you set up your kiosk. + ## Set up a kiosk in local Settings >App type: UWP @@ -117,6 +123,7 @@ To remove assigned access, choose **Turn off assigned access and sign out of the + ## Set up a kiosk using Windows PowerShell @@ -169,8 +176,6 @@ Set-AssignedAccess -AppName -UserSID [Learn how to get the AppName](https://msdn.microsoft.com/library/windows/hardware/mt620046%28v=vs.85%29.aspx) (see **Parameters**). -[Learn how to get the SID](https://go.microsoft.com/fwlink/p/?LinkId=615517). - To remove assigned access, using PowerShell, run the following cmdlet. ``` @@ -179,6 +184,7 @@ Clear-AssignedAccess + ## Set up a kiosk using the kiosk wizard in Windows Configuration Designer >App type: UWP or Windows desktop application @@ -201,14 +207,14 @@ When you use the **Provision kiosk devices** wizard in Windows Configuration Des - - - - - - - - + + + + + + + +
                              ![step one](images/one.png)![set up device](images/set-up-device.png)

                              Enable device setup if you want to configure settings on this page.

                              **If enabled:**

                              Enter a name for the device.

                              (Optional) Select a license file to upgrade Windows 10 to a different edition. [See the permitted upgrades.](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades)

                              Toggle **Configure devices for shared use** off. This setting optimizes Windows 10 for shared use scenarios and isn't necessary for a kiosk scenario.

                              You can also select to remove pre-installed software from the device.                               		![device name, upgrade to enterprise, shared use, remove pre-installed software](images/set-up-device-details.png)
                              ![step two](images/two.png) ![set up network](images/set-up-network.png)

                              Enable network setup if you want to configure settings on this page.

                              **If enabled:**

                              Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, the network type (**Open** or **WPA2-Personal**), and (if **WPA2-Personal**) the password for the wireless network.                              		![Enter network SSID and type](images/set-up-network-details.png)
                              ![step three](images/three.png) ![account management](images/account-management.png)

                              Enable account management if you want to configure settings on this page.

                              **If enabled:**

                              You can enroll the device in Active Directory, enroll in Azure Active Directory, or create a local administrator account on the device

                              To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain.

                              Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup). The **maximum number of devices per user** setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click **Get bulk token**. In the **Let's get you signed in** window, enter an account that has permissions to join a device to Azure AD, and then the password. Click **Accept** to give Windows Configuration Designer the necessary permissions.

                              **Warning:** You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards.

                              To create a local administrator account, select that option and enter a user name and password.

                              **Important:** If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.                               		![join Active Directory, Azure AD, or create a local admin account](images/account-management-details.png)
                              ![step four](images/four.png) ![add applications](images/add-applications.png)

                              You can provision the kiosk app in the **Add applications** step. You can install multiple applications, both Windows desktop applications (Win32) and Universal Windows Platform (UWP) apps, in a provisioning package. The settings in this step vary according to the application that you select. For help with the settings, see [Provision PCs with apps](provisioning-packages/provision-pcs-with-apps.md)

                              **Warning:** If you click the plus button to add an application, you must specify an application for the provisioning package to validate. If you click the plus button in error, select any executable file in **Installer Path**, and then a **Cancel** button becomes available, allowing you to complete the provisioning package without an application.                               		![add an application](images/add-applications-details.png)
                              ![step five](images/five.png) ![add certificates](images/add-certificates.png)

                              To provision the device with a certificate for the kiosk app, click **Add a certificate**. Enter a name for the certificate, and then browse to and select the certificate to be used.                              		![add a certificate](images/add-certificates-details.png)
                              ![step six](images/six.png) ![Configure kiosk account and app](images/kiosk-account.png)

                              You can create a local standard user account that will be used to run the kiosk app. If you toggle **No**, make sure that you have an existing user account to run the kiosk app.

                              If you want to create an account, enter the user name and password, and then toggle **Yes** or **No** to automatically sign in the account when the device starts. (If you encounter issues with auto sign-in after you apply the provisioning package, check the Event Viewer logs for auto logon issues under **Applications and Services Logs\Microsoft\Windows\Authentication User Interface\Operational**.)

                              In **Configure the kiosk mode app**, enter the name of the user account that will run the kiosk mode app. Select the type of app to run in kiosk mode, and then enter the path or filename (for a Windows desktop application) or the AUMID (for a Universal Windows app). For a Windows desktop application, you can use the filename if the path to the file is in the PATH environment variable, otherwise the full path is required.                              		![Configure kiosk account and app](images/kiosk-account-details.png)
                              ![step seven](images/seven.png) ![configure kiosk common settings](images/kiosk-common.png)

                              On this step, select your options for tablet mode, the user experience on the Welcome and shutdown screens, and the timeout settings.                              		![set tablet mode and configure welcome and shutdown and turn off timeout settings](images/kiosk-common-details.png)
                              ![finish](images/finish.png)

                              You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.                              		![Protect your package](images/finish-details.png)
                              step oneset up device

                              Enable device setup if you want to configure settings on this page.

                              If enabled:

                              Enter a name for the device.

                              (Optional) Select a license file to upgrade Windows 10 to a different edition. See the permitted upgrades.

                              Toggle Configure devices for shared use off. This setting optimizes Windows 10 for shared use scenarios and isn't necessary for a kiosk scenario.

                              You can also select to remove pre-installed software from the device.                               		device name, upgrade to enterprise, shared use, remove pre-installed software
                              step two set up network

                              Enable network setup if you want to configure settings on this page.

                              If enabled:

                              Toggle On or Off for wireless network connectivity. If you select On, enter the SSID, the network type (Open or WPA2-Personal), and (if WPA2-Personal) the password for the wireless network.                              		Enter network SSID and type
                              step three account management

                              Enable account management if you want to configure settings on this page.

                              If enabled:

                              You can enroll the device in Active Directory, enroll in Azure Active Directory, or create a local administrator account on the device

                              To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain.

                              Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, set up Azure AD join in your organization. The maximum number of devices per user setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 180 days from the date you get the token). Click Get bulk token. In the Let's get you signed in window, enter an account that has permissions to join a device to Azure AD, and then the password. Click Accept to give Windows Configuration Designer the necessary permissions.

                              Warning: You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards.

                              To create a local administrator account, select that option and enter a user name and password.

                              Important: If you create a local account in the provisioning package, you must change the password using the Settings app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.                               		join Active Directory, Azure AD, or create a local admin account
                              step four add applications

                              You can provision the kiosk app in the Add applications step. You can install multiple applications, both Windows desktop applications (Win32) and Universal Windows Platform (UWP) apps, in a provisioning package. The settings in this step vary according to the application that you select. For help with the settings, see Provision PCs with apps

                              Warning: If you click the plus button to add an application, you must specify an application for the provisioning package to validate. If you click the plus button in error, select any executable file in Installer Path, and then a Cancel button becomes available, allowing you to complete the provisioning package without an application.                               		add an application
                              step five add certificates

                              To provision the device with a certificate for the kiosk app, click Add a certificate. Enter a name for the certificate, and then browse to and select the certificate to be used.                              		add a certificate
                              step six Configure kiosk account and app

                              You can create a local standard user account that will be used to run the kiosk app. If you toggle No, make sure that you have an existing user account to run the kiosk app.

                              If you want to create an account, enter the user name and password, and then toggle Yes or No to automatically sign in the account when the device starts. (If you encounter issues with auto sign-in after you apply the provisioning package, check the Event Viewer logs for auto logon issues under Applications and Services Logs\Microsoft\Windows\Authentication User Interface\Operational.)

                              In Configure the kiosk mode app, enter the name of the user account that will run the kiosk mode app. Select the type of app to run in kiosk mode, and then enter the path or filename (for a Windows desktop application) or the AUMID (for a Universal Windows app). For a Windows desktop application, you can use the filename if the path to the file is in the PATH environment variable, otherwise the full path is required.                              		Configure kiosk account and app
                              step seven configure kiosk common settings

                              On this step, select your options for tablet mode, the user experience on the Welcome and shutdown screens, and the timeout settings.                              		set tablet mode and configure welcome and shutdown and turn off timeout settings
                              finish

                              You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.                              		Protect your package
                              @@ -227,10 +233,11 @@ When you use the **Provision kiosk devices** wizard in Windows Configuration Des -  + + ## Set up a kiosk or digital sign using Microsoft Intune or other MDM service >App type: UWP @@ -260,7 +267,7 @@ If you press **Ctrl + Alt + Del** and do not sign in to another account, after a To change the default time for assigned access to resume, add *IdleTimeOut* (DWORD) and enter the value data as milliseconds in hexadecimal. -  + diff --git a/windows/configuration/kiosk-troubleshoot.md b/windows/configuration/kiosk-troubleshoot.md index 321d899394..6a42e81700 100644 --- a/windows/configuration/kiosk-troubleshoot.md +++ b/windows/configuration/kiosk-troubleshoot.md @@ -2,14 +2,16 @@ title: Troubleshoot kiosk mode issues (Windows 10) description: Tips for troubleshooting multi-app kiosk configuration. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 +ms.reviewer: +manager: dansimp keywords: ["lockdown", "app restrictions"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: edu, security -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp ms.topic: article --- diff --git a/windows/configuration/kiosk-validate.md b/windows/configuration/kiosk-validate.md index 4e2e579d33..ea34adf834 100644 --- a/windows/configuration/kiosk-validate.md +++ b/windows/configuration/kiosk-validate.md @@ -2,11 +2,14 @@ title: Validate kiosk configuration (Windows 10) description: This topic explains what to expect on a multi-app kiosk. ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +ms.reviewer: +manager: dansimp +ms.author: dansimp keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 07/30/2018 ms.topic: article @@ -25,7 +28,7 @@ Optionally, run Event Viewer (eventvwr.exe) and look through logs under **Applic To test the kiosk, sign in with the assigned access user account you specified in the configuration to check out the multi-app experience. ->[!NOTE] +>[!NOTE] >The kiosk configuration setting will take effect the next time the assigned access user signs in. If that user account is signed in when you apply the configuration, make sure the user signs out and signs back in to validate the experience. The following sections explain what to expect on a multi-app kiosk. diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md index 93ac3c9bf4..c9d6d3b2c0 100644 --- a/windows/configuration/kiosk-xml.md +++ b/windows/configuration/kiosk-xml.md @@ -2,19 +2,21 @@ title: Assigned Access configuration kiosk XML reference (Windows 10) description: XML and XSD for kiosk device configuration. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 +ms.reviewer: +manager: dansimp keywords: ["lockdown", "app restrictions", "applocker"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: edu, security -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 10/02/2018 -ms.author: jdecker +ms.author: dansimp ms.topic: article --- -# Assigned Access configuration (kiosk) XML reference +# Assigned Access configuration (kiosk) XML reference **Applies to** @@ -24,7 +26,7 @@ ms.topic: article ## Full XML sample >[!NOTE] ->Updated for Windows 10, version 1809. +>Updated for Windows 10, version 1903, and Windows 10 Insider Preview (19H2, 20H1 builds). ```xml @@ -163,11 +165,479 @@ ms.topic: article ``` +## Auto Launch Sample XML + +This sample demonstrates that both UWP and Win32 apps can be configured to automatically launch, when assigned access account logs in. One profile can have at most one app configured for auto launch. AutoLaunchArguments are passed to the apps as is and the app needs to handle the arguments explicitly. + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + aauser1 + + + + aauser2 + + + + + +``` + +## [Preview] Global Profile Sample XML +Global Profile is currently supported in Windows 10 Insider Preview (20H1 builds). Global Profile is designed for scenarios where a user does not have a designated profile, yet IT Admin still wants the user to run in lock down mode, or used as mitigation when a profile cannot be determined for an user. + +This sample demonstrates that only a global profile is used, no active user configured. Global profile will be applied when every non-admin account logs in +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + +``` + +Below sample shows dedicated profile and global profile mixed usage, aauser would use one profile, everyone else that's non-admin will use another profile. +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + aauser + + + + + +``` + +## [Preview] Folder Access sample xml +In Windows 10, version 1809, folder access is locked down so that when common file dialog is opened, IT Admin can specify if the user has access to the Downloads folder, or no access to any folder at all. This restriction has been redesigned for finer granulatity and easier use, and is available in Windows 10 Insider Preview (19H2, 20H1 builds). + +IT Admin now can specify user access to Downloads folder, Removable drives, or no restrictions at all. Note that Downloads and Removable Drives can be allowed at the same time. + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + multi1 + + + + multi2 + + + + multi3 + + + + multi4 + + + + multi5 + + + + multi6 + + + + + + +``` ## XSD for AssignedAccess configuration XML >[!NOTE] ->Updated for Windows 10, version 1809. +>Updated for Windows 10, version 1903 and Windows 10 Insider Preview (19H2, 20H1 builds). +Below schema is for AssignedAccess Configuration up to Windows 10 1803 release. ```xml @@ -177,172 +647,174 @@ ms.topic: article xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config" xmlns:default="http://schemas.microsoft.com/AssignedAccess/2017/config" xmlns:rs5="http://schemas.microsoft.com/AssignedAccess/201810/config" + xmlns:v3="http://schemas.microsoft.com/AssignedAccess/2020/config" targetNamespace="http://schemas.microsoft.com/AssignedAccess/2017/config" > - + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ``` -## XSD schema for new elements in Windows 10, version 1809 - +Here is the schema for new features introduced in Windows 10 1809 release ```xml - - - - - + - - - + + + + + + + + + - - - - - + + + - + + + + + - + - + - + + + -``` \ No newline at end of file +``` + +Schema for Windows 10 Insider Preview (19H2, 20H1 builds) +```xml + + + + + + + + + + + + + + + + + + +``` + +To authorize a compatible configuration XML that includes elements and attributes from Windows 10, version 1809 or newer, always include the namespace of these add-on schemas, and decorate the attributes and elements accordingly with the namespace alias. For example, to configure the auto-launch feature which is added in Windows 10, version 1809, use the following sample. Notice an alias r1809 is given to the 201810 namespace for Windows 10, version 1809, and the alias is tagged on AutoLaunch and AutoLaunchArguments inline. +```xml + + + + + + +``` diff --git a/windows/configuration/lock-down-windows-10-applocker.md b/windows/configuration/lock-down-windows-10-applocker.md index 876d2a663d..ba2f56b8f5 100644 --- a/windows/configuration/lock-down-windows-10-applocker.md +++ b/windows/configuration/lock-down-windows-10-applocker.md @@ -2,15 +2,17 @@ title: Use AppLocker to create a Windows 10 kiosk that runs multiple apps (Windows 10) description: Learn how to use AppLocker to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 +ms.reviewer: +manager: dansimp keywords: ["lockdown", "app restrictions", "applocker"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: edu, security -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 07/30/2018 -ms.author: jdecker +ms.author: dansimp ms.topic: article --- @@ -112,11 +114,11 @@ In addition to specifying the apps that users can run, you should also restrict **Note**   To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**. -   + To learn more about locking down features, see [Customizations for Windows 10 Enterprise](https://go.microsoft.com/fwlink/p/?LinkId=691442). ## Customize Start screen layout for the device (recommended) -Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md). \ No newline at end of file +Configure the Start menu on the device to only show tiles for the permitted apps. You will make the changes manually, export the layout to an .xml file, and then apply that file to devices to prevent users from making changes. For instructions, see [Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md). diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index c38433c752..57629adbe8 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -1,58 +1,56 @@ --- title: Set up a multi-app kiosk (Windows 10) -description: Learn how to configure a kiosk device running Windows 10 so that users can only run a few specific apps. +description: Learn how to configure a kiosk device running Windows 10 so that users can only run a few specific apps. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 +ms.reviewer: +manager: dansimp keywords: ["lockdown", "app restrictions", "applocker"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: edu, security -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 01/09/2019 -ms.author: jdecker +ms.author: dansimp ms.topic: article --- # Set up a multi-app kiosk - **Applies to** -- Windows 10 Pro, Enterprise, and Education - - -A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. The benefit of a kiosk that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. - -The following table lists changes to multi-app kiosk in recent updates. - -New features and improvements | In update ---- | --- -- Configure [a single-app kiosk profile](#profile) in your XML file

                              - Assign [group accounts to a config profile](#config-for-group-accounts)

                              - Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 -- Explicitly allow [some known folders when user opens file dialog box](#fileexplorernamespacerestrictions)

                              - [Automatically launch an app](#allowedapps) when the user signs in

                              - Configure a [display name for the autologon account](#config-for-autologon-account) | Windows 10, version 1809

                              **Important:** To use features released in Windows 10, version 1809, make sure that [your XML file](#create-xml-file) references `http://schemas.microsoft.com/AssignedAccess/201810/config`. +- Windows 10 Pro, Enterprise, and Education +A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. The benefit of a kiosk that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. +The following table lists changes to multi-app kiosk in recent updates. +| New features and improvements | In update | +|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| - Configure [a single-app kiosk profile](#profile) in your XML file

                              - Assign [group accounts to a config profile](#config-for-group-accounts)

                              - Configure [an account to sign in automatically](#config-for-autologon-account) | Windows 10, version 1803 | +| - Explicitly allow [some known folders when user opens file dialog box](#fileexplorernamespacerestrictions)

                              - [Automatically launch an app](#allowedapps) when the user signs in

                              - Configure a [display name for the autologon account](#config-for-autologon-account) | Windows 10, version 1809

                              **Important:** To use features released in Windows 10, version 1809, make sure that [your XML file](#create-xml-file) references `https://schemas.microsoft.com/AssignedAccess/201810/config`. | >[!WARNING] >The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, and will impact other users on the device. Deleting the kiosk configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provisioning package](#provision). - - +>[!TIP] +>Be sure to check the [configuration recommendations](kiosk-prepare.md) before you set up your kiosk. -## Configure a kiosk in Microsoft Intune +## Configure a kiosk in Microsoft Intune To configure a kiosk in Microsoft Intune, see [Windows 10 and Windows Holographic for Business device settings to run as a dedicated kiosk using Intune](https://docs.microsoft.com/intune/kiosk-settings). For explanations of the specific settings, see [Windows 10 and later device settings to run as a kiosk in Intune](https://docs.microsoft.com/intune/kiosk-settings-windows). - + ## Configure a kiosk using a provisioning package Process: + 1. [Create XML file](#create-xml-file) 2. [Add XML file to provisioning package](#add-xml) 3. [Apply provisioning package to device](#apply-ppkg) @@ -69,35 +67,35 @@ If you don't want to use a provisioning package, you can deploy the configuratio - The kiosk device must be running Windows 10 (S, Pro, Enterprise, or Education), version 1709 or later >[!NOTE] ->For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. +>For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. ### Create XML file -Let's start by looking at the basic structure of the XML file. +Let's start by looking at the basic structure of the XML file. -- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout. +- A configuration xml can define multiple *profiles*. Each profile has a unique **Id** and defines a set of applications that are allowed to run, whether the taskbar is visible, and can include a custom Start layout. -- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**. +- A configuration xml can have multiple *config* sections. Each config section associates a non-admin user account to a default profile **Id**. - Multiple config sections can be associated to the same profile. -- A profile has no effect if it’s not associated to a config section. +- A profile has no effect if it’s not associated to a config section. ![profile = app and config = account](images/profile-config.png) - + You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this topic. You can see a full sample version in the [Assigned access XML reference.](kiosk-xml.md) ```xml - - +                               @@ -118,11 +116,11 @@ There are two types of profiles that you can specify in the XML: - **Lockdown profile**: Users assigned a lockdown profile will see the desktop in tablet mode with the specific apps on the Start screen. - **Kiosk profile**: New in Windows 10, version 1803, this profile replaces the KioskModeApp node of the [AssignedAccess CSP](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Users assigned a kiosk profile will not see the desktop, but only the kiosk app running in full-screen mode. -A lockdown profile section in the XML has the following entries: +A lockdown profile section in the XML has the following entries: -- [**Id**](#id) +- [**Id**](#id) -- [**AllowedApps**](#allowedapps) +- [**AllowedApps**](#allowedapps) - [**FileExplorerNamespaceRestrictions**](#fileexplorernamespacerestrictions) @@ -132,15 +130,13 @@ A lockdown profile section in the XML has the following entries: A kiosk profile in the XML has the following entries: -- [**Id**](#id) +- [**Id**](#id) - [**KioskModeApp**](#kioskmodeapp) - - ##### Id -The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. +The profile **Id** is a GUID attribute to uniquely identify the profile. You can create a GUID using a GUID generator. The GUID just needs to be unique within this XML file. ```xml @@ -150,34 +146,33 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can ##### AllowedApps -**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. In Windows 10, version 1809, you can configure a single app in the **AllowedApps** list to run automatically when the assigned access user account signs in. +**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. In Windows 10, version 1809, you can configure a single app in the **AllowedApps** list to run automatically when the assigned access user account signs in. - - -- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). +- For UWP apps, you need to provide the App User Model ID (AUMID). [Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867), or [get the AUMID from the Start Layout XML](#startlayout). - For desktop apps, you need to specify the full path of the executable, which can contain one or more system environment variables in the form of %variableName% (i.e. %systemroot%, %windir%). -- If an app has a dependency on another app, both must be included in the allowed apps list. For example, Internet Explorer 64-bit has a dependency on Internet Explorer 32-bit, so you must allow both "C:\Program Files\internet explorer\iexplore.exe" and “C:\Program Files (x86)\Internet Explorer\iexplore.exe”. +- If an app has a dependency on another app, both must be included in the allowed apps list. For example, Internet Explorer 64-bit has a dependency on Internet Explorer 32-bit, so you must allow both "C:\Program Files\internet explorer\iexplore.exe" and “C:\Program Files (x86)\Internet Explorer\iexplore.exe”. - To configure a single app to launch automatically when the user signs in, include `rs5:AutoLaunch="true"` after the AUMID or path. You can also include arguments to be passed to the app. For an example, see [the AllowedApps sample XML](#apps-sample). -When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. Here are the predefined assigned access AppLocker rules for **UWP apps**: +When the multi-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. Here are the predefined assigned access AppLocker rules for **UWP apps**: -1. Default rule is to allow all users to launch the signed package apps. -2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list. +1. Default rule is to allow all users to launch the signed package apps. +2. The package app deny list is generated at runtime when the assigned access user signs in. Based on the installed/provisioned package apps available for the user account, assigned access generates the deny list. This list will exclude the default allowed inbox package apps which are critical for the system to function, and then exclude the allowed packages that enterprises defined in the assigned access configuration. If there are multiple apps within the same package, all these apps will be excluded. This deny list will be used to prevent the user from accessing the apps which are currently available for the user but not in the allowed list. >[!NOTE] >You cannot manage AppLocker rules that are generated by the multi-app kiosk configuration in [MMC snap-ins](https://technet.microsoft.com/library/hh994629.aspx#BKMK_Using_Snapins). Avoid creating AppLocker rules that conflict with AppLocker rules that are generated by the multi-app kiosk configuration. > - >Multi-app kiosk mode doesn’t block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. + >Multi-app kiosk mode doesn’t block the enterprise or the users from installing UWP apps. When a new UWP app is installed during the current assigned access user session, this app will not be in the deny list. When the user signs out and signs in again, the app will be included in the deny list. If this is an enterprise-deployed line-of-business app and you want to allow it to run, update the assigned access configuration to include it in the allowed app list. Here are the predefined assigned access AppLocker rules for **desktop apps**: -1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. -2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration. -3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list. +1. Default rule is to allow all users to launch the desktop programs signed with Microsoft Certificate in order for the system to boot and function. The rule also allows the admin user group to launch all desktop programs. +2. There is a predefined inbox desktop app deny list for the assigned access user account, and this deny list is adjusted based on the desktop app allow list that you defined in the multi-app configuration. +3. Enterprise-defined allowed desktop apps are added in the AppLocker allow list. The following example allows Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps to run on the device, with Notepad configured to automatically launch and create a file called `123.text` when the user signs in. + ```xml @@ -187,22 +182,25 @@ The following example allows Groove Music, Movies & TV, Photos, Weather, Calcula - + ``` ##### FileExplorerNamespaceRestrictions -Starting in Windows 10, version 1809, you can explicitly allow some known folders to be accessed when the user tries to open the file dialog box in multi-app assigned access by including **FileExplorerNamespaceRestrictions** in your XML file. Currently, **Downloads** is the only folder supported. +Starting in Windows 10, version 1809, you can explicitly allow some known folders to be accessed when the user tries to open the file dialog box in multi-app assigned access by including **FileExplorerNamespaceRestrictions** in your XML file. Currently, **Downloads** is the only folder supported. This can also be set using Microsoft Intune. The following example shows how to allow user access to the Downloads folder in the common file dialog box. +>[!TIP] +> To grant access to the Downloads folder through File Explorer, add "Explorer.exe" to the list of allowed apps, and pin a file explorer shortcut to the kiosk start menu. + ```xml @@ -217,29 +215,36 @@ The following example shows how to allow user access to the Downloads folder in ... - + ``` +FileExplorerNamespaceRestriction has been extended in current Windows 10 Prerelease for finer granularity and easier use, see in the [Assigned access XML reference.](kiosk-xml.md) for full samples. The changes will allow IT Admin to configure if user can access Downloads folder, Removable drives, or no restriction at all by using certain new elements. Note that FileExplorerNamesapceRestrictions and AllowedNamespace:Downloads are available in namespace https://schemas.microsoft.com/AssignedAccess/201810/config, AllowRemovableDrives and NoRestriction are defined in a new namespace https://schemas.microsoft.com/AssignedAccess/2020/config. + +* When FileExplorerNamespaceRestrictions node is not used, or used but left empty, user will not be able to access any folder in common dialog (e.g. Save As in Microsoft Edge browser). +* When Downloads is mentioned in allowed namespace, user will be able to access Downloads folder. +* When AllowRemovableDrives is used, user will be to access removable drives. +* When NoRestriction is used, no restriction will be applied to the dialog. +* AllowRemovableDrives and AllowedNamespace:Downloads can be used at the same time. ##### StartLayout -After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. +After you define the list of allowed applications, you can customize the Start layout for your kiosk experience. You can choose to pin all the allowed apps on the Start screen or just a subset, depending on whether you want the end user to directly access them on the Start screen. The easiest way to create a customized Start layout to apply to other Windows 10 devices is to set up the Start screen on a test device and then export the layout. For detailed steps, see [Customize and export Start layout](customize-and-export-start-layout.md). A few things to note here: -- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration. -- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout. +- The test device on which you customize the Start layout should have the same OS version that is installed on the device where you plan to deploy the multi-app assigned access configuration. +- Since the multi-app assigned access experience is intended for fixed-purpose devices, to ensure the device experiences are consistent and predictable, use the *full* Start layout option instead of the *partial* Start layout. - There are no apps pinned on the taskbar in the multi-app mode, and it is not supported to configure Taskbar layout using the `` tag in a layout modification XML as part of the assigned access configuration. -- The following example uses DesktopApplicationLinkPath to pin the desktop app to start. When the desktop app doesn’t have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files). +- The following example uses DesktopApplicationLinkPath to pin the desktop app to start. When the desktop app doesn’t have a shortcut link on the target device, [learn how to provision .lnk files using Windows Configuration Designer](#lnk-files). This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, and Notepad apps on Start. ```xml - + @@ -264,31 +269,30 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, ``` >[!NOTE] ->If an app is not installed for the user but is included in the Start layout XML, the app will not be shown on the Start screen. - +>If an app is not installed for the user but is included in the Start layout XML, the app will not be shown on the Start screen. ![What the Start screen looks like when the XML sample is applied](images/sample-start.png) ##### Taskbar -Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want. +Define whether you want to have the taskbar present in the kiosk device. For tablet-based or touch-enabled all-in-one kiosks, when you don’t attach a keyboard and mouse, you can hide the taskbar as part of the multi-app experience if you want. The following example exposes the taskbar to the end user: ```xml ``` - + The following example hides the taskbar: ```xml ``` - ->[!NOTE] ->This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. -##### KioskModeApp +>[!NOTE] +>This is different from the **Automatically hide the taskbar** option in tablet mode, which shows the taskbar when swiping up from or moving the mouse pointer down to the bottom of the screen. Setting **ShowTaskbar** as **false** will always keep the taskbar hidden. + +##### KioskModeApp **KioskModeApp** is used for a [kiosk profile](#profile) only. Enter the AUMID for a single app. You can only specify one kiosk profile in the XML. @@ -299,27 +303,25 @@ The following example hides the taskbar: >[!IMPORTANT] >The kiosk profile is designed for public-facing kiosk devices. We recommend that you use a local, non-administrator account. If the device is connected to your company network, using a domain or Azure Active Directory account could potentially compromise confidential information. - #### Configs -Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or mobile device management (MDM) policies set as part of the multi-app experience. +Under **Configs**, define which user account will be associated with the profile. When this user account signs in on the device, the associated assigned access profile will be enforced, including the allowed apps, Start layout, and taskbar configuration, as well as other local group policies or mobile device management (MDM) policies set as part of the multi-app experience. -The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in. +The full multi-app assigned access experience can only work for non-admin users. It’s not supported to associate an admin user with the assigned access profile; doing this in the XML file will result in unexpected/unsupported experiences when this admin user signs in. You can assign: - [A local standard user account that signs in automatically](#config-for-autologon-account) (Applies to Windows 10, version 1803 only) - [An individual account, which can be local, domain, or Azure Active Directory (Azure AD)](#config-for-individual-accounts) -- [A group account, which can be local, Active Directory (domain), or Azure AD](#config-for-group-accounts) (Applies to Windows 10, version 1803 only) +- [A group account, which can be local, Active Directory (domain), or Azure AD](#config-for-group-accounts) (Applies to Windows 10, version 1803 only). >[!NOTE] ->Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request. +>Configs that specify group accounts cannot use a kiosk profile, only a lockdown profile. If a group is configured to a kiosk profile, the CSP will reject the request. ##### Config for AutoLogon Account When you use `` and the configuration is applied to a device, the specified account (managed by Assigned Access) is created on the device as a local standard user account. The specified account is signed in automatically after restart. - The following example shows how to specify an account to sign in automatically. ```xml @@ -328,7 +330,7 @@ The following example shows how to specify an account to sign in automatically. - + ``` In Windows 10, version 1809, you can configure the display name that will be shown when the user signs in. The following example shows how to create an AutoLogon Account that shows the name "Hello World". @@ -344,73 +346,131 @@ In Windows 10, version 1809, you can configure the display name that will be sho On domain-joined devices, local user accounts aren't shown on the sign-in screen by default. To show the **AutoLogonAccount** on the sign-in screen, enable the following Group Policy setting: **Computer Configuration > Administrative Templates > System > Logon > Enumerate local users on domain-joined computers**. (The corresponding MDM policy setting is [WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers in the Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-enumeratelocalusersondomainjoinedcomputers).) - >[!IMPORTANT] >When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows). ##### Config for individual accounts -Individual accounts are specified using ``. +Individual accounts are specified using ``. - Local account can be entered as `machinename\account` or `.\account` or just `account`. - Domain account should be entered as `domain\account`. -- Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. **AzureAD\someone@contoso.onmicrosoft.com**. +- Azure AD account must be specified in this format: `AzureAD\{email address}`. **AzureAD** must be provided AS IS (consider it’s a fixed domain name), then follow with the Azure AD email address, e.g. AzureAD\someone@contoso.onmicrosoft.com. >[!WARNING] >Assigned access can be configured via WMI or CSP to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. - Before applying the multi-app configuration, make sure the specified user account is available on the device, otherwise it will fail. - + >[!NOTE] >For both domain and Azure AD accounts, it’s not required that target account is explicitly added to the device. As long as the device is AD-joined or Azure AD-joined, the account can be discovered in the domain forest or tenant that the device is joined to. For local accounts, it is required that the account exist before you configure the account for assigned access. - ```xml MultiAppKioskUser - + ``` - - ##### Config for group accounts -Group accounts are specified using ``. Nested groups are not supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in ``, user A will not have the kiosk experience. +Group accounts are specified using ``. Nested groups are not supported. For example, if user A is member of Group 1, Group 1 is member of Group 2, and Group 2 is used in ``, user A will not have the kiosk experience. - Local group: Specify the group type as **LocalGroup** and put the group name in Name attribute. Any Azure AD accounts that are added to the local group will not have the kiosk settings applied. ```xml - - - - + + + + ``` -- Domain group: Both security and distribution groups are supported. Specify the group type as **ActiveDirectoryGroup**. Use the domain name as the prefix in the name attribute. + +- Domain group: Both security and distribution groups are supported. Specify the group type as ActiveDirectoryGroup. Use the domain name as the prefix in the name attribute. ```xml - - - - + + + + ``` - Azure AD group: Use the group object ID from the Azure portal to uniquely identify the group in the Name attribute. You can find the object ID on the overview page for the group in **Users and groups** > **All groups**. Specify the group type as **AzureActiveDirectoryGroup**. The kiosk device must have internet connectivity when users that belong to the group sign in. ```xml - - - - + + + + ``` >[!NOTE] - >If an Azure AD group is configured with a lockdown profile on a device, a user in the Azure AD group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out. + >If an Azure AD group is configured with a lockdown profile on a device, a user in the Azure AD group must change their password (after the account has been created with default password on the portal) before they can sign in to this device. If the user uses the default password to sign in to the device, the user will be immediately signed out. + +#### [Preview] Global Profile +Global profile is added in current Windows 10 Prerelease. There are times when IT Admin wants to everyone who logging into a specific devices are assigned access users, even there is no dedicated profile for that user, or there are times that Assigned Access could not identify a profile for the user and a fallback profile is wished to use. Global Profile is designed for these scenarios. + +Usage is demonstrated below, by using the new xml namespace and specify GlobalProfile from that namespace. When GlobalProfile is configured, a non-admin account logs in, if this user does not have designated profile in Assigned Access, or Assigned Access fails to determine a profile for current user, global profile will be applied for the user. + +Note: +1. GlobalProfile can only be multi-app profile +2. Only one GlobalProfile can be used in one AssignedAccess Configuration Xml +3. GlobalProfile can be used as the only config, or it can be used among with regular user or group Config. + +```xml + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ]]> + + + + + + + + +``` + ### Add XML file to provisioning package Before you add the XML file to a provisioning package, you can [validate your configuration XML against the XSD](kiosk-xml.md#xsd-for-assignedaccess-configuration-xml). @@ -420,7 +480,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L >[!IMPORTANT] >When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. -1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). +1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). 2. Choose **Advanced provisioning**. @@ -434,44 +494,45 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 7. In the center pane, click **Browse** to locate and select the assigned access configuration XML file that you created. - ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) + ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) -8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. +8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. -8. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. +9. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. -8. On the **File** menu, select **Save.** +10. On the **File** menu, select **Save.** -9. On the **Export** menu, select **Provisioning package**. +11. On the **Export** menu, select **Provisioning package**. -10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** +12. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** -11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. +13. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. + - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse** and choosing the certificate you want to use to sign the package. -12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. +14. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location. -13. Click **Next**. +15. Click **Next**. -14. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. +16. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. -15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. +17. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. - -15. Copy the provisioning package to the root directory of a USB drive. + - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. + - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. + +18. Copy the provisioning package to the root directory of a USB drive. + ### Apply provisioning package to device Provisioning packages can be applied to a device during the first-run experience (out-of-box experience or "OOBE") and after ("runtime"). @@ -492,7 +553,7 @@ Provisioning packages can be applied to a device during the first-run experience 3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. ![Provision this device](images/prov.jpg) - + 4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. ![Choose a package](images/choose-package.png) @@ -500,49 +561,29 @@ Provisioning packages can be applied to a device during the first-run experience 5. Select **Yes, add it**. ![Do you trust this package?](images/trust-package.png) - - #### After setup, from a USB drive, network folder, or SharePoint site 1. Sign in with an admin account. 2. Insert the USB drive to a desktop computer, navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. For a provisioning package stored on a network folder or on a SharePoint site, navigate to the provisioning package and double-click it to begin installation. >[!NOTE] ->if your provisioning package doesn’t include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device. +>if your provisioning package doesn’t include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device. ![add a package option](images/package.png) - - - - - -### Use MDM to deploy the multi-app configuration +### Use MDM to deploy the multi-app configuration +Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML. -Multi-app kiosk mode is enabled by the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Your MDM policy can contain the assigned access configuration XML. - -If your device is enrolled with a MDM server which supports applying the assigned access configuration, you can use it to apply the setting remotely. +If your device is enrolled with a MDM server which supports applying the assigned access configuration, you can use it to apply the setting remotely. The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configuration`. - - - - - - - - - - - ## Considerations for Windows Mixed Reality immersive headsets - -With the advent of [mixed reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed reality apps. +With the advent of [mixed reality devices (video link)](https://www.youtube.com/watch?v=u0jqNioU2Lo), you might want to create a kiosk that can run mixed reality apps. To create a multi-app kiosk that can run mixed reality apps, you must include the following apps in the [AllowedApps list](#allowedapps): @@ -550,6 +591,7 @@ To create a multi-app kiosk that can run mixed reality apps, you must include th + ``` These are in addition to any mixed reality apps that you allow. @@ -560,85 +602,81 @@ After the admin has completed setup, the kiosk account can sign in and repeat th There is a difference between the mixed reality experiences for a kiosk user and other users. Typically, when a user connects a mixed reality device, they begin in the [Mixed Reality home](https://developer.microsoft.com/windows/mixed-reality/navigating_the_windows_mixed_reality_home). The Mixed Reality home is a shell that runs in "silent" mode when the PC is configured as a kiosk. When a kiosk user connects a mixed reality device, they will see only a blank display in the device, and will not have access to the features and functionality available in the home. To run a mixed reality app, the kiosk user must launch the app from the PC Start screen. - ## Policies set by multi-app kiosk configuration It is not recommended to set policies enforced in assigned access multi-app mode to different values using other channels, as the multi-app mode has been optimized to provide a locked-down experience. When the multi-app assigned access configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. - ### Group Policy The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. This includes local users, domain users, and Azure Active Directory users. -| Setting | Value | +| Setting | Value | | --- | --- | -Remove access to the context menus for the task bar | Enabled -Clear history of recently opened documents on exit | Enabled -Prevent users from customizing their Start Screen | Enabled -Prevent users from uninstalling applications from Start | Enabled -Remove All Programs list from the Start menu | Enabled -Remove Run menu from Start Menu | Enabled -Disable showing balloon notifications as toast | Enabled -Do not allow pinning items in Jump Lists | Enabled -Do not allow pinning programs to the Taskbar | Enabled -Do not display or track items in Jump Lists from remote locations | Enabled -Remove Notifications and Action Center | Enabled -Lock all taskbar settings | Enabled -Lock the Taskbar | Enabled -Prevent users from adding or removing toolbars | Enabled -Prevent users from resizing the taskbar | Enabled -Remove frequent programs list from the Start Menu | Enabled +Remove access to the context menus for the task bar | Enabled +Clear history of recently opened documents on exit | Enabled +Prevent users from customizing their Start Screen | Enabled +Prevent users from uninstalling applications from Start | Enabled +Remove All Programs list from the Start menu | Enabled +Remove Run menu from Start Menu | Enabled +Disable showing balloon notifications as toast | Enabled +Do not allow pinning items in Jump Lists | Enabled +Do not allow pinning programs to the Taskbar | Enabled +Do not display or track items in Jump Lists from remote locations | Enabled +Remove Notifications and Action Center | Enabled +Lock all taskbar settings | Enabled +Lock the Taskbar | Enabled +Prevent users from adding or removing toolbars | Enabled +Prevent users from resizing the taskbar | Enabled +Remove frequent programs list from the Start Menu | Enabled Remove ‘Map Network Drive’ and ‘Disconnect Network Drive’ | Enabled -Remove the Security and Maintenance icon | Enabled -Turn off all balloon notifications | Enabled -Turn off feature advertisement balloon notifications | Enabled -Turn off toast notifications | Enabled -Remove Task Manager | Enabled -Remove Change Password option in Security Options UI | Enabled -Remove Sign Out option in Security Options UI | Enabled -Remove All Programs list from the Start Menu | Enabled – Remove and disable setting -Prevent access to drives from My Computer | Enabled - Restrict all drivers +Remove the Security and Maintenance icon | Enabled +Turn off all balloon notifications | Enabled +Turn off feature advertisement balloon notifications | Enabled +Turn off toast notifications | Enabled +Remove Task Manager | Enabled +Remove Change Password option in Security Options UI | Enabled +Remove Sign Out option in Security Options UI | Enabled +Remove All Programs list from the Start Menu | Enabled – Remove and disable setting +Prevent access to drives from My Computer | Enabled - Restrict all drivers >[!NOTE] >When **Prevent access to drives from My Computer** is enabled, users can browse the directory structure in File Explorer, but they cannot open folders and access the contents. Also, they cannot use the **Run** dialog box or the **Map Network Drive** dialog box to view the directories on these drives. The icons representing the specified drives still appear in File Explorer, but if users double-click the icons, a message appears explaining that a setting prevents the action. This setting does not prevent users from using programs to access local and network drives. It does not prevent users from using the Disk Management snap-in to view and change drive characteristics. - - ### MDM policy - Some of the MDM policies based on the [Policy configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) affect all users on the system (i.e. system-wide). -Setting | Value | System-wide +Setting | Value | System-wide --- | --- | --- -[Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | 0 - Not allowed | Yes -[Start/AllowPinnedFolderDocuments](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderDownloads](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdownloads) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderFileExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderHomeGroup](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderMusic](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderNetwork](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderPersonalFolder](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderPictures](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes -[Start/AllowPinnedFolderVideos](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +[Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | 0 - Not allowed | Yes +[Start/AllowPinnedFolderDocuments](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdocuments) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +[Start/AllowPinnedFolderDownloads](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderdownloads) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +[Start/AllowPinnedFolderFileExplorer](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderfileexplorer) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +[Start/AllowPinnedFolderHomeGroup](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderhomegroup) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +[Start/AllowPinnedFolderMusic](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldermusic) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +[Start/AllowPinnedFolderNetwork](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldernetwork) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +[Start/AllowPinnedFolderPersonalFolder](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpersonalfolder) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +[Start/AllowPinnedFolderPictures](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfolderpictures) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +[Start/AllowPinnedFolderSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +[Start/AllowPinnedFolderVideos](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldervideos) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes Start/DisableContextMenus | 1 - Context menus are hidden for Start apps | No -[Start/HidePeopleBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-hidepeoplebar) | 1 - True (hide) | No -[Start/HideChangeAccountSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) | 1 - True (hide) | Yes -[WindowsInkWorkspace/AllowWindowsInkWorkspace](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowsinkworkspace#windowsinkworkspace-allowwindowsinkworkspace) | 0 - Access to ink workspace is disabled and the feature is turned off | Yes -[Start/StartLayout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-startlayout) | Configuration dependent | No -[WindowsLogon/DontDisplayNetworkSelectionUI](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes +[Start/HidePeopleBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-hidepeoplebar) | 1 - True (hide) | No +[Start/HideChangeAccountSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) | 1 - True (hide) | Yes +[WindowsInkWorkspace/AllowWindowsInkWorkspace](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowsinkworkspace#windowsinkworkspace-allowwindowsinkworkspace) | 0 - Access to ink workspace is disabled and the feature is turned off | Yes +[Start/StartLayout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-startlayout) | Configuration dependent | No +[WindowsLogon/DontDisplayNetworkSelectionUI](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes + ## Provision .lnk files using Windows Configuration Designer First, create your desktop app's shortcut file by installing the app on a test device, using the default installation location. Right-click the installed application, and choose **Send to** > **Desktop (create shortcut)**. Rename the shortcut to `.lnk` -Next, create a batch file with two commands. If the desktop app is already installed on the target device, skip the first command for MSI install. +Next, create a batch file with two commands. If the desktop app is already installed on the target device, skip the first command for MSI install. -``` +```PowerShell msiexec /I ".msi" /qn /norestart copy .lnk "%AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\.lnk" ``` diff --git a/windows/configuration/lockdown-features-windows-10.md b/windows/configuration/lockdown-features-windows-10.md index 93605b8aea..d6ece913c6 100644 --- a/windows/configuration/lockdown-features-windows-10.md +++ b/windows/configuration/lockdown-features-windows-10.md @@ -2,13 +2,15 @@ title: Lockdown features from Windows Embedded 8.1 Industry (Windows 10) description: Many of the lockdown features available in Windows Embedded 8.1 Industry have been modified in some form for Windows 10. ms.assetid: 3C006B00-535C-4BA4-9421-B8F952D47A14 +ms.reviewer: +manager: dansimp keywords: lockdown, embedded ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 @@ -37,34 +39,34 @@ Many of the lockdown features available in Windows Embedded 8.1 Industry have be

                              [Hibernate Once/Resume Many (HORM)](https://go.microsoft.com/fwlink/p/?LinkId=626758): Quick boot to device

                              		[HORM](https://docs.microsoft.com/windows-hardware/customize/enterprise/hibernate-once-resume-many-horm-)

                              Hibernate Once/Resume Many (HORM): Quick boot to device

                              		HORM

                              HORM is supported in Windows 10, version 1607 and later.

                              [Unified Write Filter](https://go.microsoft.com/fwlink/p/?LinkId=626757): protect a device's physical storage media

                              		[Unified Write Filter](https://msdn.microsoft.com/library/windows/hardware/mt572001.aspx)

                              Unified Write Filter: protect a device's physical storage media

                              		Unified Write Filter

                              The Unified Write Filter is continued in Windows 10.

                              [Keyboard Filter]( https://go.microsoft.com/fwlink/p/?LinkId=626761): block hotkeys and other key combinations

                              		[Keyboard Filter](https://go.microsoft.com/fwlink/p/?LinkId=708391)

                              Keyboard Filter: block hotkeys and other key combinations

                              		Keyboard Filter

                              Keyboard filter is added in Windows 10, version 1511. As in Windows Embedded Industry 8.1, Keyboard Filter is an optional component that can be turned on via Turn Windows Features On/Off. Keyboard Filter (in addition to the WMI configuration previously available) will be configurable through Windows Imaging and Configuration Designer (ICD) in the SMISettings path.

                              [Shell Launcher](https://go.microsoft.com/fwlink/p/?LinkId=626676): launch a Windows desktop application on sign-on

                              		[Shell Launcher](https://go.microsoft.com/fwlink/p/?LinkId=618603)

                              Shell Launcher: launch a Windows desktop application on sign-on

                              		Shell Launcher

                              Shell Launcher continues in Windows 10. It is now configurable in Windows ICD under the SMISettings category.

                              -

                              Learn [how to use Shell Launcher to create a kiosk device](https://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Windows desktop application.

                              [Application Launcher]( https://go.microsoft.com/fwlink/p/?LinkId=626675): launch a Universal Windows Platform (UWP) app on sign-on

                              		[Assigned Access](https://go.microsoft.com/fwlink/p/?LinkId=626608)

                              Application Launcher: launch a Universal Windows Platform (UWP) app on sign-on

                              		Assigned Access

                              The Windows 8 Application Launcher has been consolidated into Assigned Access. Application Launcher enabled launching a Windows 8 app and holding focus on that app. Assigned Access offers a more robust solution for ensuring that apps retain focus.

                              [Dialog Filter](https://go.microsoft.com/fwlink/p/?LinkId=626762): suppress system dialogs and control which processes can run

                              		[AppLocker](/windows/device-security/applocker/applocker-overview)

                              Dialog Filter: suppress system dialogs and control which processes can run

                              		AppLocker

                              Dialog Filter has been deprecated for Windows 10. Dialog Filter provided two capabilities; the ability to control which processes were able to run, and the ability to prevent dialogs (in practice, system dialogs) from appearing.

                              • Control over which processes are able to run will now be provided by AppLocker.

                                • @@ -72,48 +74,48 @@ Many of the lockdown features available in Windows Embedded 8.1 Industry have be

                              [Toast Notification Filter]( https://go.microsoft.com/fwlink/p/?LinkId=626673): suppress toast notifications

                              Toast Notification Filter: suppress toast notifications

                              		 Mobile device management (MDM) and Group Policy

                              Toast Notification Filter has been replaced by MDM and Group Policy settings for blocking the individual components of non-critical system toasts that may appear. For example, to prevent a toast from appearing when a USB drive is connected, ensure that USB connections have been blocked using the USB-related policies, and turn off notifications from apps.

                              Group Policy: User Configuration > Administrative Templates > Start Menu and Taskbar > Notifications

                              -

                              MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Allow action center notifications and a [custom OMA-URI setting](https://go.microsoft.com/fwlink/p/?LinkID=616317) for AboveLock/AllowActionCenterNotifications.

                              [Embedded Lockdown Manager](https://go.microsoft.com/fwlink/p/?LinkId=626763): configure lockdown features

                              		[Windows Imaging and Configuration Designer (ICD)](https://go.microsoft.com/fwlink/p/?LinkID=525483)

                              Embedded Lockdown Manager: configure lockdown features

                              		Windows Imaging and Configuration Designer (ICD)

                              The Embedded Lockdown Manager has been deprecated for Windows 10 and replaced by the Windows ICD. Windows ICD is the consolidated tool for Windows imaging and provisioning scenarios and enables configuration of all Windows settings, including the lockdown features previously configurable through Embedded Lockdown Manager.

                              [USB Filter](https://go.microsoft.com/fwlink/p/?LinkId=626674): restrict USB devices and peripherals on system

                              USB Filter: restrict USB devices and peripherals on system

                              		 MDM and Group Policy

                              The USB Filter driver has been replaced by MDM and Group Policy settings for blocking the connection of USB devices.

                              Group Policy: Computer Configuration > Administrative Templates > System > Device Installation > Device Installation Restrictions

                              MDM policy name may vary depending on your MDM service. In Microsoft Intune, use Allow removable storage or Allow USB connection (Windows 10 Mobile only).

                              [Assigned Access](https://go.microsoft.com/fwlink/p/?LinkID=613653): launch a UWP app on sign-in and lock access to system

                              		[Assigned Access](https://go.microsoft.com/fwlink/p/?LinkId=626608)

                              Assigned Access: launch a UWP app on sign-in and lock access to system

                              		Assigned Access

                              Assigned Access has undergone significant improvement for Windows 10. In Windows 8.1, Assigned Access blocked system hotkeys and edge gestures, and non-critical system notifications, but it also applied some of these limitations to other accounts on the device.

                              In Windows 10, Assigned Access no longer affects accounts other than the one being locked down. Assigned Access now restricts access to other apps or system components by locking the device when the selected user account logs in and launching the designated app above the lock screen, ensuring that no unintended functionality can be accessed.

                              -

                              Learn [how to use Assigned Access to create a kiosk device](https://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Universal Windows app.

                              [Gesture Filter](https://go.microsoft.com/fwlink/p/?LinkId=626672): block swipes from top, left, and right edges of screen

                              Gesture Filter: block swipes from top, left, and right edges of screen

                              		 MDM and Group Policy

                              In Windows 8.1, gestures provided the ability to close an app, to switch apps, and to reach the Charms. In Windows 10, Charms have been removed. In Windows 10, version 1607, you can block swipes using the [Allow edge swipe](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#LockDown_AllowEdgeSwipe) policy.

                              In Windows 8.1, gestures provided the ability to close an app, to switch apps, and to reach the Charms. In Windows 10, Charms have been removed. In Windows 10, version 1607, you can block swipes using the Allow edge swipe policy.

                              [Custom Logon]( https://go.microsoft.com/fwlink/p/?LinkId=626759): suppress Windows UI elements during Windows sign-on, sign-off, and shutdown

                              		[Embedded Logon](https://go.microsoft.com/fwlink/p/?LinkId=626760)

                              Custom Logon: suppress Windows UI elements during Windows sign-on, sign-off, and shutdown

                              		Embedded Logon

                              No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.

                              [Unbranded Boot](https://go.microsoft.com/fwlink/p/?LinkId=626872): custom brand a device by removing or replacing Windows boot UI elements

                              		[Unbranded Boot](https://go.microsoft.com/fwlink/p/?LinkId=626873)

                              Unbranded Boot: custom brand a device by removing or replacing Windows boot UI elements

                              		Unbranded Boot

                              No changes. Applies only to Windows 10 Enterprise and Windows 10 Education.
                              -  -  -  + + + diff --git a/windows/configuration/manage-tips-and-suggestions.md b/windows/configuration/manage-tips-and-suggestions.md index 77c814e0b7..911ad4decc 100644 --- a/windows/configuration/manage-tips-and-suggestions.md +++ b/windows/configuration/manage-tips-and-suggestions.md @@ -6,11 +6,13 @@ ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: devices -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 09/20/2017 +ms.reviewer: +manager: dansimp --- # Manage Windows 10 and Microsoft Store tips, "fun facts", and suggestions diff --git a/windows/configuration/manage-wifi-sense-in-enterprise.md b/windows/configuration/manage-wifi-sense-in-enterprise.md index 155c8385f0..a6c43780bc 100644 --- a/windows/configuration/manage-wifi-sense-in-enterprise.md +++ b/windows/configuration/manage-wifi-sense-in-enterprise.md @@ -2,12 +2,15 @@ title: Manage Wi-Fi Sense in your company (Windows 10) description: Wi-Fi Sense automatically connects you to Wi-Fi, so you can get online quickly in more places. ms.assetid: 1845e00d-c4ee-4a8f-a5e5-d00f2735a271 +ms.reviewer: +manager: dansimp +ms.author: dansimp keywords: ["WiFi Sense", "automatically connect to wi-fi", "wi-fi hotspot connection"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 05/02/2018 ms.topic: article @@ -19,7 +22,7 @@ ms.topic: article - Windows 10 - Windows 10 Mobile ->[!IMPORTANT] +>[!IMPORTANT] >Beginning with Windows 10, version 1803, Wifi-Sense is no longer available. The following information only applies to Windows 10, version 1709 and prior. Please see [Connecting to open Wi-Fi hotspots in Windows 10](https://privacy.microsoft.com/windows-10-open-wi-fi-hotspots) for more details. Wi-Fi Sense learns about open Wi-Fi hotspots your Windows PC or Windows phone connects to by collecting information about the network, like whether the open Wi-Fi network has a high-quality connection to the Internet. By using that information from your device and from other Wi-Fi Sense customers' devices too, Wi-Fi Sense builds a database of these high-quality networks. When you’re in range of one of these Wi-Fi hotspots, you automatically get connected to it. @@ -52,28 +55,28 @@ You can manage your Wi-Fi Sense settings by using registry keys and the Registry **To set up Wi-Fi Sense using the Registry Editor** -1. Open your Registry Editor and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config\` +1. Open your Registry Editor and go to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config\` -2. Create and set a new **DWORD (32-bit) Value** named, **AutoConnectAllowedOEM**, with a **Value data** of **0 (zero)**. -

                              Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see [How to configure Wi-Fi Sense on Windows 10 in an enterprise](https://go.microsoft.com/fwlink/p/?LinkId=620959). +2. Create and set a new **DWORD (32-bit) Value** named, **AutoConnectAllowedOEM**, with a **Value data** of **0 (zero)**. +

                              Setting this value to 0 turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see How to configure Wi-Fi Sense on Windows 10 in an enterprise. - ![Registry Editor, showing the creation of a new DWORD value](images/wifisense-registry.png) + ![Registry Editor, showing the creation of a new DWORD value](images/wifisense-registry.png) ### Using the Windows Provisioning settings You can manage your Wi-Fi Sense settings by changing the Windows provisioning setting, **WiFISenseAllowed**. **To set up Wi-Fi Sense using WiFISenseAllowed** -- Change the Windows Provisioning setting, **WiFISenseAllowed**, to **0**. -

                              Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Windows Provisioning settings reference topic, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620909). +- Change the Windows Provisioning setting, **WiFISenseAllowed**, to **0**. +

                              Setting this value to 0 turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Windows Provisioning settings reference topic, WiFiSenseAllowed. ### Using Unattended Windows Setup settings If your company still uses Unattend, you can manage your Wi-Fi Sense settings by changing the Unattended Windows Setup setting, **WiFiSenseAllowed**. **To set up Wi-Fi Sense using WiFISenseAllowed** -- Change the Unattended Windows Setup setting, **WiFISenseAllowed**, to **0**. -

                              Setting this value to **0** turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the **Wi-Fi Settings** screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Unattended Windows Setup Reference topic, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620910). +- Change the Unattended Windows Setup setting, **WiFISenseAllowed**, to **0**. +

                              Setting this value to 0 turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see the Unattended Windows Setup Reference topic, WiFiSenseAllowed. ### How employees can change their own Wi-Fi Sense settings If you don’t turn off the ability for your employees to use Wi-Fi Sense, they can turn it on locally by selecting **Settings > Network & Internet > Wi-Fi > Manage Wi-Fi settings**, and then turning on **Connect to suggested open hotspots**. @@ -92,9 +95,9 @@ If you select the **Share network with my contacts** check box the first time yo - [Wi-Fi Sense and Privacy](https://go.microsoft.com/fwlink/p/?LinkId=620911) - [How to configure Wi-Fi Sense on Windows 10 in an enterprise](https://go.microsoft.com/fwlink/p/?LinkId=620959) -  + -  + diff --git a/windows/configuration/mobile-devices/configure-mobile.md b/windows/configuration/mobile-devices/configure-mobile.md index 50f896bffe..fc6e9e8001 100644 --- a/windows/configuration/mobile-devices/configure-mobile.md +++ b/windows/configuration/mobile-devices/configure-mobile.md @@ -7,10 +7,12 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # Configure Windows 10 Mobile devices diff --git a/windows/configuration/mobile-devices/lockdown-xml.md b/windows/configuration/mobile-devices/lockdown-xml.md index d5e9143721..28bf0b87e3 100644 --- a/windows/configuration/mobile-devices/lockdown-xml.md +++ b/windows/configuration/mobile-devices/lockdown-xml.md @@ -1,13 +1,15 @@ --- title: Configure Windows 10 Mobile using Lockdown XML (Windows 10) -description: Windows 10 Mobile allows enterprises to lock down a device, define multiple user roles, and configure custom layouts on a device. +description: Windows 10 Mobile allows enterprises to lock down a device, define multiple user roles, and configure custom layouts on a device. ms.assetid: 22C8F654-2EC3-4E6D-8666-1EA9FCF90F5F +ms.reviewer: +manager: dansimp ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, mobile -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 @@ -18,9 +20,9 @@ ms.date: 07/27/2017 **Applies to** -- Windows 10 Mobile +- Windows 10 Mobile -Windows 10 Mobile allows enterprises to lock down a device, define multiple user roles, and configure custom layouts on a device. For example, the enterprise can lock down a device so that only applications and settings in an allow list are available. +Windows 10 Mobile allows enterprises to lock down a device, define multiple user roles, and configure custom layouts on a device. For example, the enterprise can lock down a device so that only applications and settings in an allow list are available. This is accomplished using Lockdown XML, an XML file that contains settings for Windows 10 Mobile. When you deploy the lockdown XML file to a device, it is saved on the device as **wehlockdown.xml**. When the device boots, it looks for wehlockdown.xml and applies any settings configured in the file. @@ -38,16 +40,16 @@ Let's start by looking at the basic structure of the lockdown XML file. You can ```xml - - - - - - - - - - + + + + + + + + + + ``` @@ -82,7 +84,7 @@ The following example is a complete lockdown XML file that disables Action Cente - + @@ -143,8 +145,8 @@ In the following example, Outlook Calendar and Outlook Mail are pinned to the St - - + + ``` @@ -158,7 +160,7 @@ You can create and pin folders to Start by using the Apps setting. Each folder r - + Medium 4 @@ -181,7 +183,7 @@ To add apps to the folder, include **ParentFolderId** in the application XML, as 0 0 - 1 + 1 @@ -192,7 +194,7 @@ To add apps to the folder, include **ParentFolderId** in the application XML, as 4 0 - 1 + 1 @@ -224,11 +226,11 @@ In the following example, press-and-hold is disabled for the Back button. ```xml - - - + + + ``` @@ -236,10 +238,10 @@ If you don't specify a button event, all actions for the button are disabled. In ```xml - - - + + + ``` @@ -249,20 +251,20 @@ ButtonRemapList lets you change the app that a button will run. You can remap th > [!WARNING] > Button remapping can enable a user to open an application that is not in the allow list for that user role. Use button lock down to prevent application access for a user role. - + To remap a button, you specify the button, the event, and the product ID for the app that you want the event to open. In the following example, when a user presses the Search button, the phone dialer will open instead of the Search app. ```xml - - - + + + ``` @@ -271,7 +273,7 @@ In the following example, when a user presses the Search button, the phone diale ![XML for CSP Runner](../images/CSPRunnerXML.jpg) You can use CSPRunner to include settings that are not defined in AssignedAccessXML. For example, you can include settings from other sections of EnterpriseAssignedAccess CSP, such as lockscreen, theme, and time zone. You can also include settings from other CSPs, such as [Wi-Fi CSP](https://go.microsoft.com/fwlink/p/?LinkID=717460) or [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962%28v=vs.85%29.aspx). - + CSPRunner is helpful when you are configuring a device to support multiple roles. It lets you apply different policies according to the role that is signed on. For example, Wi-Fi could be enabled for a supervisor role and disabled for a stocking clerk role. In CSPRunner, you specify the CSP and settings using SyncML, a standardized markup language for device management. A SyncML section can include multiple settings, or you can use multiple SyncML sections -- it's up to you how you want to organize settings in this section. @@ -283,21 +285,21 @@ Let's start with the structure of SyncML in the following example: ```xml SyncML> - - | - # - - - CSP Path - - - Data Type - - Value - - | - - + + | + # + + + CSP Path + + + Data Type + + Value + + | + + ``` @@ -358,85 +360,85 @@ If you list a setting or quick action in **Settings**, all settings and quick ac For a list of the settings and quick actions that you can allow or block, see [Settings and quick actions that can be locked down in Windows 10 Mobile](settings-that-can-be-locked-down.md). - + ## Tiles - + ![XML for tiles](../images/TilesXML.png) - + By default, under Assigned Access, tile manipulation is turned off (blocked) and only available if enabled in the user’s profile. If tile manipulation is enabled in the user’s profile, they can pin/unpin, move, and resize tiles based on their preferences. When multiple people use one device and you want to enable tile manipulation for multiple users, you must enable it for each user in their user profile. - + > [!IMPORTANT] > If a device is turned off then back on, the tiles reset to their predefined layout. If a device has only one profile, the only way to reset the tiles is to turn off then turn on the device. If a device has multiple profiles, the device resets the tiles to the predefined layout based on the logged-in user’s profile. - + ```xml ``` - + ## Start screen size - + Specify the size of the Start screen. In addition to 4/6 columns, you can also use 4/6/8 depending on screen resolutions. Valid values: - - - Small sets the width to 4 columns on devices with short axis (less than 400epx) or 6 columns on devices with short axis (greater than or equal to 400epx). - - Large sets the width to 6 columns on devices with short axis (less than 400epx) or 8 columns on devices with short axis (greater than or equal to 400epx). - - If you have existing lockdown xml, you must update start screen size if your device has >=400epx on its short axis so that tiles on Start can fill all 8 columns if you want to use all 8 columns instead of 6, or use 6 columns instead of 4. - - [Learn about effective pixel width (epx) for different device size classes.](https://go.microsoft.com/fwlink/p/?LinkId=733340) - - + +- Small sets the width to 4 columns on devices with short axis (less than 400epx) or 6 columns on devices with short axis (greater than or equal to 400epx). +- Large sets the width to 6 columns on devices with short axis (less than 400epx) or 8 columns on devices with short axis (greater than or equal to 400epx). + + If you have existing lockdown xml, you must update start screen size if your device has >=400epx on its short axis so that tiles on Start can fill all 8 columns if you want to use all 8 columns instead of 6, or use 6 columns instead of 4. + + [Learn about effective pixel width (epx) for different device size classes.](https://go.microsoft.com/fwlink/p/?LinkId=733340) + + ## Configure additional roles - + You can add custom configurations by role. In addition to the role configuration, you must also install a login application on the device. The app displays a list of available roles on the device; the user taps a role, such as "Manager"; the configuration defined for the "Manager" role is applied. - + [Learn how to create a login application that will work with your Lockdown XML file.](https://github.com/Microsoft/Windows-universal-samples/tree/master/Samples/DeviceLockdownAzureLogin) For reference, see the [Windows.Embedded.DeviceLockdown API](https://msdn.microsoft.com/library/windows/apps/windows.embedded.devicelockdown). - + In the XML file, you define each role with a GUID and name, as shown in the following example: - + ```xml ``` You can create a GUID using a GUID generator -- free tools are available online. The GUID needs to be unique within this XML file. - + You can configure the same settings for each role as you did for the default role, except Start screen size which can only be configured for the default role. If you use CSPRunner with roles, be aware that the last CSP setting applied will be retained across roles unless explicitly changed in each role configuration. CSP settings applied by CSPRunner may conflict with settings applied by MDM. - + ```xml - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + ``` ## Validate your XML You can validate your lockdown XML file against the [EnterpriseAssignedAccess XSD](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterpriseassignedaccess-xsd). - + ## Add lockdown XML to a provisioning package -Use the Windows ICD tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package. [Install the ADK.](https://go.microsoft.com/fwlink/p/?LinkId=526740) +Use the Windows ICD tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package. [Install the ADK.](https://go.microsoft.com/fwlink/p/?LinkId=526740) 1. Follow the instructions at [Build and apply a provisioning package](https://go.microsoft.com/fwlink/p/?LinkID=629651) to create a project, selecting **Common to all Windows mobile editions** for your project. @@ -852,7 +854,6 @@ To push lockdown settings to enrolled devices, use the AssignedAccessXML setting - ``` ## Learn more @@ -864,4 +865,4 @@ To push lockdown settings to enrolled devices, use the AssignedAccessXML setting [Settings and quick actions that can be locked down in Windows 10 Mobile](settings-that-can-be-locked-down.md) -[Product IDs in Windows 10 Mobile](product-ids-in-windows-10-mobile.md) \ No newline at end of file +[Product IDs in Windows 10 Mobile](product-ids-in-windows-10-mobile.md) diff --git a/windows/configuration/mobile-devices/mobile-lockdown-designer.md b/windows/configuration/mobile-devices/mobile-lockdown-designer.md index 229a7ea1c4..bb398d4a09 100644 --- a/windows/configuration/mobile-devices/mobile-lockdown-designer.md +++ b/windows/configuration/mobile-devices/mobile-lockdown-designer.md @@ -6,10 +6,12 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # Use the Lockdown Designer app to create a Lockdown XML file diff --git a/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile.md b/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile.md index 5ad6371d4f..1aa6d6f3b8 100644 --- a/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile.md +++ b/windows/configuration/mobile-devices/product-ids-in-windows-10-mobile.md @@ -2,13 +2,15 @@ title: Product IDs in Windows 10 Mobile (Windows 10) description: You can use the product ID and Application User Model (AUMID) in Lockdown.xml to specify apps that will be available to the user. ms.assetid: 31116BED-C16A-495A-BD44-93218A087A1C +ms.reviewer: +manager: dansimp keywords: ["lockdown"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 diff --git a/windows/configuration/mobile-devices/provisioning-configure-mobile.md b/windows/configuration/mobile-devices/provisioning-configure-mobile.md index 141db07726..afb1fa0310 100644 --- a/windows/configuration/mobile-devices/provisioning-configure-mobile.md +++ b/windows/configuration/mobile-devices/provisioning-configure-mobile.md @@ -1,16 +1,18 @@ --- -title: Use Windows Configuration Designer to configure Windows 10 Mobile devices (Windows 10) -description: +title: Configure Windows 10 Mobile devices with Configuration Designer +description: Use Windows Configuration Designer to configure Windows 10 Mobile devices keywords: phone, handheld, lockdown, customize ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # Use Windows Configuration Designer to configure Windows 10 Mobile devices @@ -28,11 +30,11 @@ The **Provision Windows mobile devices** wizard lets you configure common settin ### Start a new project 1. Open Windows Configuration Designer: - - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click the Windows Configuration Designer shortcut, + - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click the Windows Configuration Designer shortcut, - or + or - - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. + - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. 2. On the **Start** page, choose **Provision Windows mobile devices**. @@ -42,10 +44,10 @@ The **Provision Windows mobile devices** wizard lets you configure common settin ### Configure settings in the wizard - - - - + + + +
                              ![step one](../images/one.png)![set up device](../images/set-up-device-mobile.png)

                              Enter a device name.

                              Optionally, you can enter a product key to upgrade the device from Windows 10 Mobile to Windows 10 Mobile Enterprise.                               		![device name, upgrade license](../images/set-up-device-details-mobile.png)
                              ![step two](../images/two.png) ![set up network](../images/set-up-network-mobile.png)

                              Toggle **On** or **Off** for wireless network connectivity.

                              If you select **On**, enter the SSID, network type (**Open** or **WPA2-Personal**), and (if **WPA2-Personal**) the password for the wireless network.                              		![Enter network SSID and type](../images/set-up-network-details-mobile.png)
                              ![step three](../images/three.png) ![bulk enrollment in Azure Active Directory](../images/bulk-enroll-mobile.png)

                              Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup). The **maximum number of devices per user** setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used.

                              Set an expiration date for the token (maximum is 30 days from the date you get the token). Click **Get bulk token**. In the **Let's get you signed in** window, enter an account that has permissions to join a device to Azure AD, and then the password. Click **Accept** to give Windows Configuration Designer the necessary permissions.

                              **Warning:** You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards.                               		![Enter expiration and get bulk token](../images/bulk-enroll-mobile-details.png)
                              ![step four](../images/four.png) ![finish](../images/finish-mobile.png)

                              You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.                              		![Protect your package](../images/finish-details-mobile.png)
                              step oneset up device

                              Enter a device name.

                              Optionally, you can enter a product key to upgrade the device from Windows 10 Mobile to Windows 10 Mobile Enterprise.                               		device name, upgrade license
                              step two set up network

                              Toggle On or Off for wireless network connectivity.

                              If you select On, enter the SSID, network type (Open or WPA2-Personal), and (if WPA2-Personal) the password for the wireless network.                              		Enter network SSID and type
                              step three bulk enrollment in Azure Active Directory

                              Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, set up Azure AD join in your organization. The maximum number of devices per user setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used.

                              Set an expiration date for the token (maximum is 180 days from the date you get the token). Click Get bulk token. In the Let's get you signed in window, enter an account that has permissions to join a device to Azure AD, and then the password. Click Accept to give Windows Configuration Designer the necessary permissions.

                              Warning: You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards.                               		Enter expiration and get bulk token
                              step four finish

                              You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.                              		Protect your package
                              After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page. @@ -86,4 +88,4 @@ You can apply a provisioning package to a device running Windows 10 Mobile by us ## Related topics - [NFC-based device provisioning](provisioning-nfc.md) -- [Use the package splitter tool](provisioning-package-splitter.md) \ No newline at end of file +- [Use the package splitter tool](provisioning-package-splitter.md) diff --git a/windows/configuration/mobile-devices/provisioning-nfc.md b/windows/configuration/mobile-devices/provisioning-nfc.md index 0c9dc82c2d..68b962d26f 100644 --- a/windows/configuration/mobile-devices/provisioning-nfc.md +++ b/windows/configuration/mobile-devices/provisioning-nfc.md @@ -4,11 +4,13 @@ description: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # NFC-based device provisioning @@ -70,14 +72,14 @@ The following table describes the information that is required when writing to a The NFC provisioning helper device must split the provisioning package raw content into multiple parts and publish these in order. Each part should follow the following format: -
                              **Version**
                              (1 byte)                              		**Leading**
                              (1 byte)                              		**Order**
                              (1 byte)                              		**Total**
                              (1 byte)                              		**Chunk payload**
                              (N bytes)
                              +
                              Version
                              (1 byte)                              		Leading
                              (1 byte)                              		Order
                              (1 byte)                              		Total
                              (1 byte)                              		Chunk payload
                              (N bytes)
                              For each part: -- **Version** should always be 0x00. -- **Leading byte** should always be 0xFF. -- **Order** represents which message chunk (out of the whole message) the part belongs to. The Order begins with zero (0). -- **Total** represents the total number of chunks to be transferred for the whole message. -- **Chunk payload** represents each of the split parts. +- Version should always be 0x00. +- Leading byte should always be 0xFF. +- Order represents which message chunk (out of the whole message) the part belongs to. The Order begins with zero (0). +- Total represents the total number of chunks to be transferred for the whole message. +- Chunk payload represents each of the split parts. The NFC provisioning helper device must publish the record in a type of Windows.ProvPlugins.Chunk. @@ -138,9 +140,9 @@ For detailed information and code samples on how to implement an NFC-enabled dev - [Use Windows Configuration Designer to configure Windows 10 Mobile devices](provisioning-configure-mobile.md) - [Barcode provisioning and the package splitter tool](provisioning-package-splitter.md) -  + -  + diff --git a/windows/configuration/mobile-devices/provisioning-package-splitter.md b/windows/configuration/mobile-devices/provisioning-package-splitter.md index 1ba20bd10c..736a35c4ed 100644 --- a/windows/configuration/mobile-devices/provisioning-package-splitter.md +++ b/windows/configuration/mobile-devices/provisioning-package-splitter.md @@ -4,11 +4,13 @@ description: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # Barcode provisioning and the package splitter tool @@ -47,13 +49,13 @@ Before you can use the tool, you must have a built provisioning package. The pac cd C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86 ``` - - or - + - or - - On an x86 computer, type: + On an x86 computer, type: - ``` - cd C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86 - ``` + ``` + cd C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86 + ``` 3. Run `ppkgtobase64.exe`. The [syntax](#syntax) and [switches and arguments](#switches-and-arguments) sections provide details for the command. @@ -81,9 +83,9 @@ ppkgtobase64.exe -i -o -s [-c] [/?] ## Related topics -  + -  + diff --git a/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md b/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md index cf13bbf926..15522142ec 100644 --- a/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md +++ b/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md @@ -2,13 +2,15 @@ title: Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise (Windows 10) description: A device in kiosk mode runs a specified app with no access to other device functions, menus, or settings. ms.assetid: 35EC82D8-D9E8-45C3-84E9-B0C8C167BFF7 +ms.reviewer: +manager: dansimp keywords: kiosk, lockdown, assigned access ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 @@ -34,7 +36,7 @@ Enterprise Assigned Access allows you to put your Windows 10 Mobile or Windows >[!NOTE] >The app can be a Universal Windows app, Universal Windows Phone 8 app, or a legacy Silverlight app. -  + ### Set up Enterprise Assigned Access in MDM @@ -44,7 +46,7 @@ In AssignedAccessXml, for Application, you enter the product ID for the app to r ### Set up assigned access using Windows Configuration Designer ->[!IMPORTANT] +>[!IMPORTANT] >When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. #### Create the *AssignedAccess*.xml file @@ -182,9 +184,9 @@ Apps Corner lets you set up a custom Start screen on your Windows 10 Mobile or 1. On Start ![start](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner** > launch ![launch](../images/launchicon.png). - >[!TIP]   + >[!TIP] >Want to get to Apps Corner with one tap? In **Settings**, tap **Apps Corner** > **pin** to pin the Apps Corner tile to your Start screen. -   + 2. Give the device to someone else, so they can use the device and only the one app you chose. 3. When they're done and you get the device back, press and hold Power ![power](../images/powericon.png), and then swipe right to exit Apps Corner. @@ -198,7 +200,7 @@ Apps Corner lets you set up a custom Start screen on your Windows 10 Mobile or [Product IDs in Windows 10 Mobile](product-ids-in-windows-10-mobile.md) -  + diff --git a/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md b/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md index ca84677bf1..f1d9a178fc 100644 --- a/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md +++ b/windows/configuration/mobile-devices/settings-that-can-be-locked-down.md @@ -1,14 +1,16 @@ --- -title: Settings and quick actions that can be locked down in Windows 10 Mobile (Windows 10) +title: Lock down settings and quick actions in Windows 10 Mobile description: This topic lists the settings and quick actions that can be locked down in Windows 10 Mobile. ms.assetid: 69E2F202-D32B-4FAC-A83D-C3051DF02185 +ms.reviewer: +manager: dansimp keywords: ["lockdown"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: mobile -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 @@ -460,7 +462,7 @@ Quick action buttons are locked down in exactly the same way as Settings pages/g You can specify the quick actions as follows: -``` syntax +```xml diff --git a/windows/configuration/mobile-devices/start-layout-xml-mobile.md b/windows/configuration/mobile-devices/start-layout-xml-mobile.md index c8d736b63d..0682606ac4 100644 --- a/windows/configuration/mobile-devices/start-layout-xml-mobile.md +++ b/windows/configuration/mobile-devices/start-layout-xml-mobile.md @@ -5,11 +5,13 @@ keywords: ["start screen"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # Start layout XML for mobile editions of Windows 10 (reference) @@ -34,7 +36,7 @@ On Windows 10 Mobile, the customized Start works by: The following diagrams show the default Windows 10, version 1607 Start layouts for single SIM and dual SIM devices with Cortana support, and single SIM and dual SIM devices with no Cortana support. -![Start layout for Windows 10 Mobile](..\images\mobile-start-layout.png) +![Start layout for Windows 10 Mobile](../images/mobile-start-layout.png) The diagrams show: @@ -48,7 +50,7 @@ The diagrams show: IT admins can provision the Start layout by creating a LayoutModification.xml file. This file supports several mechanisms to modify or replace the default Start layout and its tiles. ->[!NOTE] +>[!NOTE] >To make sure the Start layout XML parser processes your file correctly, follow these guidelines when writing your LayoutModification.xml file: >- Do not leave spaces or white lines in between each element. >- Do not add comments inside the StartLayout node or any of its children elements. diff --git a/windows/configuration/provisioning-apn.md b/windows/configuration/provisioning-apn.md index b58d853122..3da0ec1215 100644 --- a/windows/configuration/provisioning-apn.md +++ b/windows/configuration/provisioning-apn.md @@ -2,11 +2,13 @@ title: Configure cellular settings for tablets and PCs (Windows 10) description: Enterprises can provision cellular settings for tablets and PC with built-in cellular modems or plug-in USB modem dongles. ms.assetid: 287706E5-063F-4AB5-902C-A0DF6D0730BC +ms.reviewer: +manager: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerMS -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 04/13/2018 diff --git a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md index b70f4fd66c..641af623c3 100644 --- a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md +++ b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md @@ -1,12 +1,14 @@ --- -title: Introduction to configuration service providers (CSPs) for IT pros (Windows 10) -description: Configuration service providers (CSPs) expose device configuration settings in Windows 10. +title: Intro to configuration service providers for IT pros (Windows 10) +description: Configuration service providers (CSPs) expose device configuration settings in Windows 10. ms.assetid: 25C1FDCA-0E10-42A1-A368-984FFDB2B7B6 +ms.reviewer: +manager: dansimp ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 @@ -14,35 +16,33 @@ ms.date: 07/27/2017 # Introduction to configuration service providers (CSPs) for IT pros - **Applies to** -- Windows 10 -- Windows 10 Mobile +- Windows 10 +- Windows 10 Mobile -Configuration service providers (CSPs) expose device configuration settings in Windows 10. This topic is written for people who have no experience with CSPs. +Configuration service providers (CSPs) expose device configuration settings in Windows 10. This topic is written for people who have no experience with CSPs. -The CSPs are documented on the [Hardware Dev Center](https://go.microsoft.com/fwlink/p/?LinkId=717390) because CSPs are used by mobile device management (MDM) service providers. This topic explains how IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 and Windows 10 Mobile in their organizations. +The CSPs are documented on the [Hardware Dev Center](https://go.microsoft.com/fwlink/p/?LinkId=717390) because CSPs are used by mobile device management (MDM) service providers. This topic explains how IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 and Windows 10 Mobile in their organizations. ->[!NOTE]   ->The explanation of CSPs and CSP documentation also apply to Windows Mobile 5, Windows Mobile 6, Windows Phone 7, and Windows Phone 8, but links to current CSPs are for Windows 10 and Windows 10 Mobile. +>[!NOTE] +>This explanation of CSPs and CSP documentation also applies to Windows Mobile 5, Windows Mobile 6, Windows Phone 7, and Windows Phone 8, but links to current CSPs are for Windows 10 and Windows 10 Mobile. - [See what's new for CSPs in Windows 10, version 1809.](https://docs.microsoft.com/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew1809) + [See what's new for CSPs in Windows 10, version 1809.](https://docs.microsoft.com/windows/client-management/mdm/new-in-windows-mdm-enrollment-management#whatsnew1809) ## What is a CSP? +A CSP is an interface in the client operating system, between configuration settings specified in a provisioning document, and configuration settings on the device. CSPs are similar to Group Policy client-side extensions, in that they provide an interface to read, set, modify, or delete configuration settings for a given feature. Typically, these settings map to registry keys, files or permissions. Some of these settings are configurable, and some are read-only. -A CSP is an interface in the client operating system between configuration settings specified in a provisioning document and configuration settings on the device. Their function is similar to that of Group Policy client-side extensions in that they provide an interface to read, set, modify, or delete configuration settings for a given feature. Typically, these settings map to registry keys, files or permissions. Some of these settings are configurable and some are read-only. - -Starting in Windows Mobile 5.0, CSPs were used to manage Windows mobile devices. In the Windows 10 platform, the management approach for both desktop and mobile devices converges, taking advantage of the same CSPs to configure and manage all devices running Windows 10. +Starting with Windows Mobile 5.0, CSPs were used to manage Windows mobile devices. On the Windows 10 platform, the management approach for both desktop and mobile devices converges, taking advantage of the same CSPs to configure and manage all devices running Windows 10. Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](https://go.microsoft.com/fwlink/p/?LinkId=717438) contains the settings to create a Wi-Fi profile. -CSPs are behind many of the management tasks and policies for Windows 10 in Microsoft Intune and non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). +CSPs are behind many of the management tasks and policies for Windows 10, both in Microsoft Intune and in non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). ![how intune maps to csp](../images/policytocsp.png) -CSPs receive configuration policies in the XML-based SyncML format pushed to it from an MDM-compliant management server such as Microsoft Intune. Traditional enterprise management systems, such as System Center Configuration Manager, can also target CSPs by using a client-side WMI-to-CSP bridge. +CSPs receive configuration policies in the XML-based SyncML format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Endpoint Configuration Manager, can also target CSPs, by using a client-side WMI-to-CSP bridge. ### Synchronization Markup Language (SyncML) @@ -50,22 +50,21 @@ The Open Mobile Alliance Device Management (OMA-DM) protocol uses the XML-based ### The WMI-to-CSP Bridge -The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs via scripts and traditional enterprise management software such as Configuration Manager using Windows Management Instrumentation (WMI). The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. +The WMI-to-CSP Bridge is a component allowing configuration of Windows 10 CSPs via scripts and traditional enterprise management software, such as Configuration Manager using Windows Management Instrumentation (WMI). The bridge is responsible for reading WMI commands and through a component called the common device configurator pass them to a CSP for application on the device. [Learn how to use the WMI Bridge Provider with PowerShell.](https://go.microsoft.com/fwlink/p/?LinkId=761090) ## Why should you learn about CSPs? - Generally, enterprises rely on Group Policy or MDM to configure and manage devices. For devices running Windows, MDM services use CSPs to configure your devices. -In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management, or you want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried. +In addition, you may have unmanaged devices, or a large number of devices that you want to configure before enrolling them in management. You may also want to apply custom settings that aren't available through your MDM service. The [CSP documentation](#bkmk-csp-doc) can help you understand the settings that can be configured or queried. -In addition, some of the topics in the [Windows 10 and Windows 10 Mobile](/windows/windows-10) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](../cortana-at-work/cortana-at-work-overview.md) which links to the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings. +Some of the topics in the [Windows 10 and Windows 10 Mobile](/windows/windows-10) library on Technet include links to applicable CSP reference topics, such as [Cortana integration in your business or enterprise](../cortana-at-work/cortana-at-work-overview.md), which links to the [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244). In the CSP topics, you can learn about all of the available configuration settings. -### CSPs in Windows Configuration Designer +### CSPs in Windows Configuration Designer -You can use Windows Configuration Designer to create [provisioning packages](https://go.microsoft.com/fwlink/p/?LinkId=717466) to apply settings to devices during the out-of-box-experience (OOBE) and after devices are set up. You can use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows Configuration Designer are based on CSPs. +You can use Windows Configuration Designer to create [provisioning packages](https://go.microsoft.com/fwlink/p/?LinkId=717466) to apply settings to devices during the out-of-box-experience (OOBE), and after the devices are set up. You can also use provisioning packages to configure a device's connectivity and enroll the device in MDM. Many of the runtime settings in Windows Configuration Designer are based on CSPs. Many settings in Windows Configuration Designer will display documentation for that setting in the center pane, and will include a reference to the CSP if the setting uses one, as shown in the following image. @@ -81,12 +80,11 @@ When a CSP is available but is not explicitly included in your MDM solution, you ### CSPs in Lockdown XML -Lockdown XML can be used to configure devices running Windows 10 Mobile. You can manually author a [Lockdown XML file](../mobile-devices/lockdown-xml.md) to make use of the configuration settings available through the [EnterpriseAssignedAccess configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=618601). In Windows 10, version 1703, you can also use the new [Lockdown Designer app](../mobile-devices/mobile-lockdown-designer.md) to configure your Lockdown XML. +Lockdown XML can be used to configure devices running Windows 10 Mobile. You can manually author a [Lockdown XML file](../mobile-devices/lockdown-xml.md) to make use of the configuration settings available through the [EnterpriseAssignedAccess configuration service provider (CSP)](https://go.microsoft.com/fwlink/p/?LinkID=618601). In Windows 10, version 1703, you can also use the new [Lockdown Designer app](../mobile-devices/mobile-lockdown-designer.md) to configure your Lockdown XML. ## How do you use the CSP documentation? - -All CSPs in Windows 10 are documented in the [Configuration service provider reference](https://go.microsoft.com/fwlink/p/?LinkId=717390). +All CSPs in Windows 10 are documented in the [Configuration service provider reference](https://go.microsoft.com/fwlink/p/?LinkId=717390). The [main CSP topic](https://go.microsoft.com/fwlink/p/?LinkId=717390) tells you which CSPs are supported on each edition of Windows 10, and links to the documentation for each individual CSP. @@ -96,17 +94,17 @@ The documentation for each CSP follows the same structure. After an introduction The full path to a specific configuration setting is represented by its Open Mobile Alliance - Uniform Resource Identifier (OMA-URI). The URI is relative to the devices’ root node (MSFT, for example). Features supported by a particular CSP can be set by addressing the complete OMA-URI path. -The following example shows the diagram for the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes and rectangular elements are settings or policies for which a value must be supplied. +The following example shows the diagram for the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes, and rectangular elements are settings or policies for which a value must be supplied. ![assigned access csp tree](../images/provisioning-csp-assignedaccess.png) -The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see it uses the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608). +The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see that it uses the [AssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=626608). ```XML ./Vendor/MSFT/AssignedAccess/KioskModeApp ``` -When an element in the diagram uses italic font, it indicates a placeholder for specific information, such as the tenant ID in the following example. +When an element in the diagram uses _italic_ font, it indicates a placeholder for specific information, such as the tenant ID in the following example. ![placeholder in csp tree](../images/csp-placeholder.png) @@ -118,12 +116,11 @@ The documentation for most CSPs will also include an XML example. ## CSP examples - CSPs provide access to a number of settings useful to enterprises. This section introduces two CSPs that an enterprise might find particularly useful. - [EnterpriseAssignedAccess CSP](https://go.microsoft.com/fwlink/p/?LinkID=618601) - The EnterpriseAssignedAccess configuration service provider allows IT administrators to configure settings on a Windows 10 Mobile device. An enterprise can make use of this CSP to create single-use or limited-use mobile devices, such as a handheld device that only runs a price-checking app. + The EnterpriseAssignedAccess configuration service provider allows IT administrators to configure settings on a Windows 10 Mobile device. An enterprise can make use of this CSP to create single-use or limited-use mobile devices, such as a handheld device that only runs a price-checking app. In addition to lockscreen wallpaper, theme, time zone, and language, the EnterpriseAssignedAccess CSP includes AssignedAccessXml which can be used to lock down the device through the following settings: @@ -137,7 +134,7 @@ CSPs provide access to a number of settings useful to enterprises. This section - Creating role-specific configurations. - [Policy CSP](https://go.microsoft.com/fwlink/p/?LinkID=623244) - The Policy configuration service provider enables the enterprise to configure policies on Windows 10 and Windows 10 Mobile. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings. + The Policy configuration service provider enables the enterprise to configure policies on Windows 10 and Windows 10 Mobile. Some of these policy settings can also be applied using Group Policy, and the CSP documentation lists the equivalent Group Policy settings. Some of the settings available in the Policy CSP include the following: @@ -157,7 +154,7 @@ CSPs provide access to a number of settings useful to enterprises. This section - **Update**, such as specifying whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store - **WiFi**, such as whether to enable Internet sharing -Here is a list of CSPs supported on Windows 10 Enterprise, Windows 10 Mobile Enterprise, or both: +Here is a list of CSPs supported on Windows 10 Enterprise, Windows 10 Mobile Enterprise, or both: - [ActiveSync CSP](https://go.microsoft.com/fwlink/p/?LinkId=723219) - [Application CSP](https://go.microsoft.com/fwlink/p/?LinkId=723220) @@ -216,13 +213,3 @@ Here is a list of CSPs supported on Windows 10 Enterprise, Windows 10 Mobile E - [Wi-Fi CSP](https://go.microsoft.com/fwlink/p/?LinkID=71743) - [WindowsLicensing CSP](https://go.microsoft.com/fwlink/p/?LinkId=723274) - [WindowsSecurityAuditing CSP](https://go.microsoft.com/fwlink/p/?LinkId=723415) - - -  - -  - - - - - diff --git a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md index 9979020ba7..b825b767ae 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md +++ b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md @@ -2,12 +2,14 @@ title: Provision PCs with common settings (Windows 10) description: Create a provisioning package to apply common settings to a PC running Windows 10. ms.assetid: 66D14E97-E116-4218-8924-E2A326C9367E +ms.reviewer: +manager: dansimp keywords: ["runtime provisioning", "provisioning package"] -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 @@ -66,11 +68,11 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 2. Click **Provision desktop devices**. - ![ICD start options](../images/icd-create-options-1703.png) + ![ICD start options](../images/icd-create-options-1703.png) 3. Name your project and click **Finish**. The pages for desktop provisioning will walk you through the following steps. - ![ICD desktop provisioning](../images/icd-desktop-1703.png) + ![ICD desktop provisioning](../images/icd-desktop-1703.png) > [!IMPORTANT] > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. @@ -79,12 +81,12 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L - - - - - - + + + + + +
                              ![step one](../images/one.png)![set up device](../images/set-up-device.png)

                              Enter a name for the device.

                              (Optional) Select a license file to upgrade Windows 10 to a different edition. [See the permitted upgrades.](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades)

                              Toggle **Yes** or **No** to **Configure devices for shared use**. This setting optimizes Windows 10 for shared use scenarios. [Learn more about shared PC configuration.](../set-up-shared-or-guest-pc.md)

                              You can also select to remove pre-installed software from the device.                               		![device name, upgrade to enterprise, shared use, remove pre-installed software](../images/set-up-device-details-desktop.png)
                              ![step two](../images/two.png) ![set up network](../images/set-up-network.png)

                              Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, the network type (**Open** or **WPA2-Personal**), and (if **WPA2-Personal**) the password for the wireless network.                              		![Enter network SSID and type](../images/set-up-network-details-desktop.png)
                              ![step three](../images/three.png) ![account management](../images/account-management.png)

                              Enable account management if you want to configure settings on this page.

                              You can enroll the device in Active Directory, enroll in Azure Active Directory, or create a local administrator account on the device

                              To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain.

                              Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup). The **maximum number of devices per user** setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click **Get bulk token**. In the **Let's get you signed in** window, enter an account that has permissions to join a device to Azure AD, and then the password. Click **Accept** to give Windows Configuration Designer the necessary permissions.

                              To create a local administrator account, select that option and enter a user name and password.

                              **Important:** If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.                               		![join Active Directory, Azure AD, or create a local admin account](../images/account-management-details.png)
                              ![step four](../images/four.png) ![add applications](../images/add-applications.png)

                              You can install multiple applications, both Windows desktop applications (Win32) and Universal Windows Platform (UWP) apps, in a provisioning package. The settings in this step vary according to the application that you select. For help with the settings, see [Provision PCs with apps](provision-pcs-with-apps.md).                               		![add an application](../images/add-applications-details.png)
                              ![step five](../images/five.png) ![add certificates](../images/add-certificates.png)

                              To provision the device with a certificate, click **Add a certificate**. Enter a name for the certificate, and then browse to and select the certificate to be used.                              		![add a certificate](../images/add-certificates-details.png)
                              ![finish](../images/finish.png)

                              You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.                              		![Protect your package](../images/finish-details.png)
                              step oneset up device

                              Enter a name for the device.

                              (Optional) Select a license file to upgrade Windows 10 to a different edition. See the permitted upgrades.

                              Toggle Yes or No to Configure devices for shared use. This setting optimizes Windows 10 for shared use scenarios. Learn more about shared PC configuration.

                              You can also select to remove pre-installed software from the device.                               		device name, upgrade to enterprise, shared use, remove pre-installed software
                              step two set up network

                              Toggle On or Off for wireless network connectivity. If you select On, enter the SSID, the network type (Open or WPA2-Personal), and (if WPA2-Personal) the password for the wireless network.                              		Enter network SSID and type
                              step three account management

                              Enable account management if you want to configure settings on this page.

                              You can enroll the device in Active Directory, enroll in Azure Active Directory, or create a local administrator account on the device

                              To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain.

                              Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, set up Azure AD join in your organization. The maximum number of devices per user setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 180 days from the date you get the token). Click Get bulk token. In the Let's get you signed in window, enter an account that has permissions to join a device to Azure AD, and then the password. Click Accept to give Windows Configuration Designer the necessary permissions.

                              To create a local administrator account, select that option and enter a user name and password.

                              Important: If you create a local account in the provisioning package, you must change the password using the Settings app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.                               		join Active Directory, Azure AD, or create a local admin account
                              step four add applications

                              You can install multiple applications, both Windows desktop applications (Win32) and Universal Windows Platform (UWP) apps, in a provisioning package. The settings in this step vary according to the application that you select. For help with the settings, see Provision PCs with apps.                               		add an application
                              step five add certificates

                              To provision the device with a certificate, click Add a certificate. Enter a name for the certificate, and then browse to and select the certificate to be used.                              		add a certificate
                              finish

                              You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.                              		Protect your package
                              After you're done, click **Create**. It only takes a few seconds. When the package is built, the location where the package is stored is displayed as a hyperlink at the bottom of the page. @@ -98,7 +100,7 @@ After you're done, click **Create**. It only takes a few seconds. When the packa - Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922) -  + ## Related topics - [Provisioning packages for Windows 10](provisioning-packages.md) diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md index 321a76c0cd..cc40946bcb 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md @@ -2,14 +2,16 @@ title: Provision PCs with apps and certificates (Windows 10) description: Create a provisioning package to apply settings to a PC running Windows 10. keywords: ["runtime provisioning", "provisioning package"] -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # Provision PCs with apps and certificates for initial deployment (advanced provisioning) @@ -44,11 +46,11 @@ Use the Windows Imaging and Configuration Designer (ICD) tool included in the Wi 2. Click **Advanced provisioning**. - ![ICD start options](../images/icdstart-option.png) + ![ICD start options](../images/icdstart-option.png) 3. Name your project and click **Next**. -3. Select **All Windows desktop editions**, click **Next**, and then click **Finish**. +4. Select **All Windows desktop editions**, click **Next**, and then click **Finish**. ### Add a desktop app to your package @@ -89,7 +91,7 @@ Universal apps that you can distribute in the provisioning package can be line-o 6. In the **Available customizations** pane, click the **LicenseProductId** that you just added. -7. For **LicenseInstall**, click **Browse**, navigate to the license file that you renamed **.**ms-windows-store-license**, and select the license file. +7. For **LicenseInstall**, click **Browse**, navigate to the license file that you renamed *\*.**ms-windows-store-license**, and select the license file. [Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps) @@ -122,42 +124,42 @@ For details about the settings you can customize in provisioning packages, see [ 1. When you are done configuring the provisioning package, on the **File** menu, click **Save**. 2. Read the warning that project files may contain sensitive information, and click **OK**. -> **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. + > **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. 3. On the **Export** menu, click **Provisioning package**. -1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** +4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** -10. Set a value for **Package Version**. +5. Set a value for **Package Version**. - > [!TIP]   - > You can make changes to existing packages and change the version number to update previously applied packages. + > [!TIP] + > You can make changes to existing packages and change the version number to update previously applied packages. -11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. +6. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. + - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. - **Important**   - We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.  + **Important** + We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently. -12. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.

                              -Optionally, you can click **Browse** to change the default output location. +7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.

                              + Optionally, you can click **Browse** to change the default output location. -13. Click **Next**. +8. Click **Next**. -14. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

                              -If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. +9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

                              + If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. -15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.

                              -If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. +10. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.

                              + If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. -16. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods: +11. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods: - Shared network folder @@ -180,7 +182,7 @@ If your build is successful, the name of the provisioning package, output direct - Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921) - Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922) -  + ## Related topics diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index 9f7712c5d3..b69a8c78e1 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -2,14 +2,16 @@ title: Provision PCs with apps (Windows 10) description: Add apps to a Windows 10 provisioning package. keywords: ["runtime provisioning", "provisioning package"] -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium -ms.author: jdecker +ms.author: dansimp ms.topic: article ms.date: 09/06/2017 +ms.reviewer: +manager: dansimp --- # Provision PCs with apps @@ -25,7 +27,7 @@ In Windows 10, version 1703, you can install multiple Universal Windows Platform When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#adv). >[!IMPORTANT] ->If you plan to use Intune to manage your devices, we recommend using Intune to install Office 365 ProPlus 2016 apps (Access, Excel, OneDrive for Business, OneNote, Outlook, PowerPoint, Publisher, Skype for Business, Word, Project Online Desktop Cilent, and Visio Pro for Office 365 ProPlus). Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to assign Office 365 ProPlus 2016 apps using Microsoft Intune.](https://docs.microsoft.com/intune/apps-add-office365) +>If you plan to use Intune to manage your devices, we recommend using Intune to install Office 365 ProPlus 2016 apps (Access, Excel, OneDrive for Business, OneNote, Outlook, PowerPoint, Publisher, Skype for Business, Word, Project Desktop Client, and Visio Pro for Office 365 ProPlus). Apps that are installed using a provisioning package cannot be managed or modified using Intune. [Learn how to assign Office 365 ProPlus 2016 apps using Microsoft Intune.](https://docs.microsoft.com/intune/apps-add-office365) ## Settings for UWP apps @@ -39,6 +41,9 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate ### MSI installer +> [!NOTE] +> You can find more information about command-line options for Msiexec.exe [here](https://docs.microsoft.com/windows/win32/msi/command-line-options). + - **Command line arguments**: Optionally, append additional command arguments. The silent flag is appended for you. Example: PROPERTY=VALUE - **Continue installations after failure**: Optionally, specify if you want to continue installing additional apps if this app fails to install @@ -61,6 +66,7 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate + ## Add a Windows desktop application using advanced editor in Windows Configuration Designer @@ -70,7 +76,7 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate ![enter name for first app](../images/wcd-app-name.png) -3. [Configure the settings for the appropriate installer type.](#settings-for-classic-windows-apps) +3. Configure the settings for the appropriate installer type. ![enter settings for first app](../images/wcd-app-commands.png) @@ -100,7 +106,7 @@ Universal apps that you can distribute in the provisioning package can be line-o 6. In the **Available customizations** pane, click the **LicenseProductId** that you just added. -7. For **LicenseInstall**, click **Browse**, navigate to the license file that you renamed **.**ms-windows-store-license**, and select the license file. +7. For **LicenseInstall**, click **Browse**, navigate to the license file that you renamed *\*.**ms-windows-store-license**, and select the license file. [Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps) @@ -133,42 +139,42 @@ For details about the settings you can customize in provisioning packages, see [ 1. When you are done configuring the provisioning package, on the **File** menu, click **Save**. 2. Read the warning that project files may contain sensitive information, and click **OK**. -> **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. + > **Important** When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. 3. On the **Export** menu, click **Provisioning package**. -1. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** +4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** -10. Set a value for **Package Version**. +5. Set a value for **Package Version**. - > [!TIP]   - > You can make changes to existing packages and change the version number to update previously applied packages. + > [!TIP] + > You can make changes to existing packages and change the version number to update previously applied packages. -11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. +6. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. + - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. - **Important**   - We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.  + **Important** + We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently. -12. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.

                              -Optionally, you can click **Browse** to change the default output location. +7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.

                              + Optionally, you can click **Browse** to change the default output location. -13. Click **Next**. +8. Click **Next**. -14. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

                              -If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. +9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

                              + If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. -15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.

                              -If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. +10. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.

                              + If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. -16. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods: +11. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods: - Shared network folder @@ -191,7 +197,7 @@ If your build is successful, the name of the provisioning package, output direct - Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921) - Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922) -  + ## Related topics diff --git a/windows/configuration/provisioning-packages/provisioning-apply-package.md b/windows/configuration/provisioning-packages/provisioning-apply-package.md index 7b9f542042..2760481053 100644 --- a/windows/configuration/provisioning-packages/provisioning-apply-package.md +++ b/windows/configuration/provisioning-packages/provisioning-apply-package.md @@ -4,11 +4,13 @@ description: Provisioning packages can be applied to a device during the first-r ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 08/22/2017 +ms.reviewer: +manager: dansimp --- # Apply a provisioning package @@ -101,4 +103,4 @@ Insert the USB drive to a desktop computer, navigate to **Settings** > **Account - [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) - [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md) - [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) \ No newline at end of file +- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) diff --git a/windows/configuration/provisioning-packages/provisioning-command-line.md b/windows/configuration/provisioning-packages/provisioning-command-line.md index f815fe5059..62e14f6e7a 100644 --- a/windows/configuration/provisioning-packages/provisioning-command-line.md +++ b/windows/configuration/provisioning-packages/provisioning-command-line.md @@ -4,11 +4,13 @@ description: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # Windows Configuration Designer command-line interface (reference) @@ -42,7 +44,7 @@ icd.exe /Build-ProvisioningPackage /CustomizationXML: /PackagePath: | /CustomizationXML | No | Specifies the path to a Windows provisioning XML file that contains the customization assets and settings. For more information, see Windows provisioning answer file. | | /PackagePath | Yes | Specifies the path and the package name where the built provisioning package will be saved. | | /StoreFile | No


                              See Important note. | For partners using a settings store other than the default store(s) used by Windows Configuration Designer, use this parameter to specify the path to one or more comma-separated Windows settings store file. By default, if you don't specify a settings store file, the settings store that's common to all Windows editions will be loaded by Windows Configuration Designer.


                              **Important** If you use this parameter, you must not use /MSPackageRoot or /OEMInputXML. | -| /Variables | No | Specifies a semicolon separated and macro pair. The format for the argument must be =. | +| /Variables | No | Specifies a semicolon separated `` and `` macro pair. The format for the argument must be `=`. | | Encrypted | No | Denotes whether the provisioning package should be built with encryption. Windows Configuration Designer auto-generates the decryption password and includes this information in the output.


                              Precede with + for encryption or - for no encryption. The default is no encryption. | | Overwrite | No | Denotes whether to overwrite an existing provisioning package.


                              Precede with + to overwrite an existing package or - if you don't want to overwrite an existing package. The default is false (don't overwrite). | | /? | No | Lists the switches and their descriptions for the command-line tool or for certain commands. | diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index c0cbd3ed3f..035bdf4010 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -1,14 +1,16 @@ --- title: Create a provisioning package (Windows 10) -description: With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. +description: Learn how to create a provisioning package for Windows 10. Provisioning packages let you quickly configure a device without having to install a new image. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # Create a provisioning package for Windows 10 @@ -16,8 +18,8 @@ ms.date: 07/27/2017 **Applies to** -- Windows 10 -- Windows 10 Mobile +- Windows 10 +- Windows 10 Mobile You use Windows Configuration Designer to create a provisioning package (.ppkg) that contains customization settings. You can apply the provisioning package to a device running Windows 10 or Windows 10 Mobile. @@ -29,45 +31,47 @@ You use Windows Configuration Designer to create a provisioning package (.ppkg) ## Start a new project 1. Open Windows Configuration Designer: - - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, - - or - - - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. + - From either the Start screen or Start menu search, type 'Windows Configuration Designer' and click on the Windows Configuration Designer shortcut, + + or + + - If you installed Windows Configuration Designer from the ADK, navigate to `C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86` (on an x64 computer) or `C:\Program Files\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe` (on an x86 computer), and then double-click **ICD.exe**. 2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image: ![Configuration Designer wizards](../images/icd-create-options-1703.png) - + - The wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices. Wizards are also available for creating provisioning packages for Microsoft Surface Hub and Microsoft HoloLens devices. For a summary of the settings available in the desktop, mobile, and kiosk devices, see [What you can configure using Configuration Designer wizardS](provisioning-packages.md#configuration-designer-wizards). - + - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) - [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md) - [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) - [Instructions for HoloLens wizard](https://technet.microsoft.com/itpro/hololens/hololens-provisioning) - [Instructions for Surface Hub wizard](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub) - + - The **Advanced provisioning** option opens a new project with all **Runtime settings** available. *The rest of this procedure uses advanced provisioning.* - + >[!TIP] > You can start a project in the simple wizard editor and then switch the project to the advanced editor. > > ![Switch to advanced editor](../images/icd-switch.png) - + 3. Enter a name for your project, and then click **Next**. 4. Select the settings you want to configure, based on the type of device, and then click **Next**. The following table describes the options. - | Windows edition | Settings available for customization | Provisioning package can apply to | - | --- | --- | --- | - | All Windows editions | Common settings | All Windows 10 devices | - | All Windows desktop editions | Common settings and settings specific to desktop devices | All Windows 10 desktop editions (Home, Pro, Enterprise, Pro Education, Enterprise Education) | - | All Windows mobile editions | Common settings and settings specific to mobile devices | All Windows 10 Mobile devices | - | Windows 10 IoT Core | Common settings and settings specific to Windows 10 IoT Core | All Windows 10 IoT Core devices | - | Windows 10 Holographic | Common settings and settings specific to Windows 10 Holographic | [Microsoft HoloLens](https://technet.microsoft.com/itpro/hololens/hololens-provisioning) | - | Common to Windows 10 Team edition | Common settings and settings specific to Windows 10 Team | [Microsoft Surface Hub](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub) | - -5. On the **Import a provisioning package (optional)** page, you can click **Finish** to create your project, or browse to and select an existing provisioning packge to import to your project, and then click **Finish**. + + | Windows edition | Settings available for customization | Provisioning package can apply to | + |-----------------------------------|-----------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------| + | All Windows editions | Common settings | All Windows 10 devices | + | All Windows desktop editions | Common settings and settings specific to desktop devices | All Windows 10 desktop editions (Home, Pro, Enterprise, Pro Education, Enterprise Education) | + | All Windows mobile editions | Common settings and settings specific to mobile devices | All Windows 10 Mobile devices | + | Windows 10 IoT Core | Common settings and settings specific to Windows 10 IoT Core | All Windows 10 IoT Core devices | + | Windows 10 Holographic | Common settings and settings specific to Windows 10 Holographic | [Microsoft HoloLens](https://technet.microsoft.com/itpro/hololens/hololens-provisioning) | + | Common to Windows 10 Team edition | Common settings and settings specific to Windows 10 Team | [Microsoft Surface Hub](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub) | + + +5. On the **Import a provisioning package (optional)** page, you can click **Finish** to create your project, or browse to and select an existing provisioning package to import to your project, and then click **Finish**. >[!TIP] >**Import a provisioning package** can make it easier to create different provisioning packages that all have certain settings in common. For example, you could create a provisioning package that contains the settings for your organization's network, and then import it into other packages you create so you don't have to reconfigure those common settings repeatedly. @@ -88,11 +92,11 @@ The settings in Windows Configuration Designer are based on Windows 10 configura The process for configuring settings is similar for all settings. The following table shows an example. - - - - - + + + + +
                              ![step one](../images/one.png)
                              Expand a category.                              		![Expand Certificates category](../images/icd-step1.png)
                              ![step two](../images/two.png)
                              Select a setting.                              		![Select ClientCertificates](../images/icd-step2.png)
                              ![step three](../images/three.png)
                              Enter a value for the setting. Click **Add** if the button is displayed.                              		![Enter a name for the certificate](../images/icd-step3.png)
                              ![step four](../images/four.png)
                              Some settings, such as this example, require additional information. In **Available customizations**, select the value you just created, and additional settings are displayed.                              		![Additional settings for client certificate](../images/icd-step4.png)
                              ![step five](../images/five.png)
                              When the setting is configured, it is displayed in the **Selected customizations** pane.                              		![Selected customizations pane](../images/icd-step5.png)
                              step one
                              Expand a category.                              		Expand Certificates category
                              step two
                              Select a setting.                              		Select ClientCertificates
                              step three
                              Enter a value for the setting. Click Add if the button is displayed.                              		Enter a name for the certificate
                              step four
                              Some settings, such as this example, require additional information. In Available customizations, select the value you just created, and additional settings are displayed.                              		Additional settings for client certificate
                              step five
                              When the setting is configured, it is displayed in the Selected customizations pane.                              		Selected customizations pane
                              For details on each specific setting, see [Windows Provisioning settings reference](https://msdn.microsoft.com/library/windows/hardware/dn965990.aspx). The reference topic for a setting is also displayed in Windows Configuration Designer when you select the setting, as shown in the following image. @@ -105,22 +109,22 @@ For details on each specific setting, see [Windows Provisioning settings referen 1. After you're done configuring your customizations, click **Export** and select **Provisioning Package**. ![Export on top bar](../images/icd-export-menu.png) - + 2. In the **Describe the provisioning package** window, enter the following information, and then click **Next**: - **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field. - **Version (in Major.Minor format** - - Optional. You can change the default package version by specifying a new value in the **Version** field. - **Owner** - Select **IT Admin**. For more information, see [Precedence for provisioning packages](provisioning-how-it-works.md#precedence-for-provisioning-packages). - **Rank (between 0-99)** - Optional. You can select a value between 0 and 99, inclusive. The default package rank is 0. - + 3. In the **Select security details for the provisioning package** window, you can select to encrypt and/or sign a provisioning package with a selected certificate. Both selections are optional. Click **Next** after you make your selections. - - **Encrypt package** - If you select this option, an auto-generated password will be shown on the screen. - - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select** and choosing the certificate you want to use to sign the package. + - **Encrypt package** - If you select this option, an auto-generated password will be shown on the screen. + - **Sign package** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select** and choosing the certificate you want to use to sign the package. - >[!NOTE] - >You should only configure provisioning package security when the package is used for device provisioning and the package has contents with sensitive security data such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. - > - >If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner. + >[!NOTE] + >You should only configure provisioning package security when the package is used for device provisioning and the package has contents with sensitive security data such as certificates or credentials that should be prevented from being compromised. When applying an encrypted and/or signed provisioning package, either during OOBE or through the setting UI, the package can be decrypted, and if signed, be trusted without explicit user consent. An IT administrator can set policy on a user device to restrict the removal of required packages from the device, or the provisioning of potentially harmful packages on the device. + > + >If a provisioning package is signed by a trusted provisioner, it can be installed on a device without a prompt for user consent. In order to enable trusted provider certificates, you must set the **TrustedProvisioners** setting prior to installing the trusted provisioning package. This is the only way to install a package without user consent. To provide additional security, you can also set **RequireProvisioningPackageSignature**, which prevents users from installing provisioning packages that are not signed by a trusted provisioner. 4. In the **Select where to save the provisioning package** window, specify the output location where you want the provisioning package to go once it's built, and then click **Next**. By default, Windows Configuration Designer uses the project folder as the output location. @@ -144,7 +148,7 @@ For details on each specific setting, see [Windows Provisioning settings referen - Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922) -- [How to bulk-enroll devices with On-premises Mobile Device Management in System Center Configuration Manager](https://docs.microsoft.com/sccm/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm) +- [How to bulk-enroll devices with On-premises Mobile Device Management in Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/mdm/deploy-use/bulk-enroll-devices-on-premises-mdm) ## Related topics @@ -157,4 +161,4 @@ For details on each specific setting, see [Windows Provisioning settings referen - [Use a script to install a desktop app in provisioning packages](provisioning-script-to-install-app.md) - [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md) - [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) \ No newline at end of file +- [Create a provisioning package with multivariant settings](provisioning-multivariant.md) diff --git a/windows/configuration/provisioning-packages/provisioning-how-it-works.md b/windows/configuration/provisioning-packages/provisioning-how-it-works.md index a94b851110..8153ebaf57 100644 --- a/windows/configuration/provisioning-packages/provisioning-how-it-works.md +++ b/windows/configuration/provisioning-packages/provisioning-how-it-works.md @@ -4,11 +4,13 @@ description: A provisioning package (.ppkg) is a container for a collection of c ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # How provisioning works in Windows 10 diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index 7729761c95..f1bf1aa323 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -4,11 +4,13 @@ description: Learn how to install and run Windows Configuration Designer. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 10/16/2017 +ms.reviewer: +manager: dansimp --- # Install Windows Configuration Designer diff --git a/windows/configuration/provisioning-packages/provisioning-multivariant.md b/windows/configuration/provisioning-packages/provisioning-multivariant.md index 216d35803f..bf0de14b73 100644 --- a/windows/configuration/provisioning-packages/provisioning-multivariant.md +++ b/windows/configuration/provisioning-packages/provisioning-multivariant.md @@ -4,11 +4,13 @@ description: Create a provisioning package with multivariant settings to customi ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms +author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 11/08/2017 -ms.author: jdecker +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Create a provisioning package with multivariant settings @@ -37,8 +39,8 @@ A **Target** can have more than one **TargetState**, and a **TargetState** can h The following table describes the logic for the target definition. - -
                              When all **Condition** elements are TRUE, **TargetState** is TRUE.![Target state is true when all conditions are true](../images/icd-multi-targetstate-true.png)
                              If any of the **TargetState** elements is TRUE, **Target** is TRUE, and the **Id** can be used for setting customizations.![Target is true if any target state is true](../images/icd-multi-target-true.png)
                              + +
                              When all Condition elements are TRUE, TargetState is TRUE.Target state is true when all conditions are true
                              If any of the TargetState elements is TRUE, Target is TRUE, and the Id can be used for setting customizations.Target is true if any target state is true
                              ### Conditions @@ -115,16 +117,16 @@ Follow these steps to create a provisioning package with multivariant capabiliti The following example shows the contents of a sample customizations.xml file. ```XML - - - + <?xml version="1.0" encoding="utf-8"?> + + {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} My Provisioning Package 1.0 OEM 50 - - + + @@ -137,25 +139,25 @@ Follow these steps to create a provisioning package with multivariant capabiliti - - + + ``` -4. Edit the customizations.xml file to create a **Targets** section to describe the conditions that will handle your multivariant settings. +5. Edit the customizations.xml file to create a **Targets** section to describe the conditions that will handle your multivariant settings. The following example shows the customizations.xml, which has been modified to include several conditions including **ProcessorName**, **ProcessorType**, **MCC**, and **MNC**. ```XML - - + + {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} My Provisioning Package 1.0 OEM 50 - - + + @@ -186,11 +188,11 @@ Follow these steps to create a provisioning package with multivariant capabiliti - - + + ``` -5. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this: +6. In the customizations.xml file, create a **Variant** section for the settings you need to customize. To do this: a. Define a child **TargetRefs** element. @@ -206,16 +208,16 @@ Follow these steps to create a provisioning package with multivariant capabiliti The following example shows the customizations.xml updated to include a **Variant** section and the moved settings that will be applied if the conditions for the variant are met. ```XML - - - + <?xml version="1.0" encoding="utf-8"?> + + {6aaa4dfa-00d7-4aaa-8adf-73c6a7e2501e} My Provisioning Package 1.0 OEM 50 - - + + @@ -254,14 +256,14 @@ Follow these steps to create a provisioning package with multivariant capabiliti - - + + ``` -6. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step. +7. Save the updated customizations.xml file and note the path to this updated file. You will need the path as one of the values for the next step. -7. Use the [Windows Configuration Designer command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml. +8. Use the [Windows Configuration Designer command-line interface](provisioning-command-line.md) to create a provisioning package using the updated customizations.xml. For example: @@ -314,7 +316,7 @@ The following events trigger provisioning on Windows 10 devices: - [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md) - [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) -  + diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index 2a331f5839..af989096a8 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -1,12 +1,14 @@ --- title: Provisioning packages (Windows 10) -description: With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. +description: With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. ms.assetid: 287706E5-063F-4AB5-902C-A0DF6D0730BC +ms.reviewer: +manager: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 @@ -17,16 +19,16 @@ ms.date: 07/27/2017 **Applies to** -- Windows 10 -- Windows 10 Mobile +- Windows 10 +- Windows 10 Mobile Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using Windows provisioning, an IT administrator can easily specify desired configuration and settings required to enroll the devices into management and then apply that configuration to target devices in a matter of minutes. It is best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers. -A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. +A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Provisioning packages are simple enough that with a short set of written instructions, a student or non-technical employee can use them to configure their device. This can result in a significant reduction in the time required to configure multiple devices in your organization. -The [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) includes the Windows Configuration Designer, a tool for configuring provisioning packages. Windows Configuration Designer is also available as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). +The [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) includes the Windows Configuration Designer, a tool for configuring provisioning packages. Windows Configuration Designer is also available as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). @@ -73,16 +75,16 @@ Provisioning packages can be: The following table describes settings that you can configure using the wizards in Windows Configuration Designer to create provisioning packages. - - - - - - - - - -
                              **Step****Description****Desktop wizard****Mobile wizard****Kiosk wizard****HoloLens wizard**
                              Set up deviceAssign device name,
                              enter product key to upgrade Windows,
                              configure shared used,
                              remove pre-installed software                              		![yes](../images/checkmark.png)![yes](../images/checkmark.png)
                              (Only device name and upgrade key)                              		![yes](../images/checkmark.png)![yes](../images/checkmark.png)
                              Set up networkConnect to a Wi-Fi network![yes](../images/checkmark.png)![yes](../images/checkmark.png)![yes](../images/checkmark.png)![yes](../images/checkmark.png)
                              Account managementEnroll device in Active Directory,
                              enroll device in Azure Active Directory,
                              or create a local administrator account                              		![yes](../images/checkmark.png)![no](../images/crossmark.png)![yes](../images/checkmark.png)![yes](../images/checkmark.png)
                              Bulk Enrollment in Azure ADEnroll device in Azure Active Directory

                              Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup).                              		![no](../images/crossmark.png)![yes](../images/checkmark.png)![no](../images/crossmark.png)![no](../images/crossmark.png)
                              Add applicationsInstall applications using the provisioning package.![yes](../images/checkmark.png)![no](../images/crossmark.png)![yes](../images/checkmark.png)![no](../images/crossmark.png)
                              Add certificatesInclude a certificate file in the provisioning package.![yes](../images/checkmark.png)![no](../images/crossmark.png)![yes](../images/checkmark.png)![yes](../images/checkmark.png)
                              Configure kiosk account and appCreate local account to run the kiosk mode app,
                              specify the app to run in kiosk mode                              		![no](../images/crossmark.png)![no](../images/crossmark.png)![yes](../images/checkmark.png)![no](../images/crossmark.png)
                              Configure kiosk common settingsSet tablet mode,
                              configure welcome and shutdown screens,
                              turn off timeout settings                              		![no](../images/crossmark.png)![no](../images/crossmark.png)![yes](../images/checkmark.png)![no](../images/crossmark.png)
                              Developer SetupEnable Developer Mode.![no](../images/crossmark.png)![no](../images/crossmark.png)![no](../images/crossmark.png)![yes](../images/checkmark.png)
                              + + + + + + + + + +
                              StepDescriptionDesktop wizardMobile wizardKiosk wizardHoloLens wizard
                              Set up deviceAssign device name,
                              enter product key to upgrade Windows,
                              configure shared used,
                              remove pre-installed software                              		yesyes
                              (Only device name and upgrade key)                              		yesyes
                              Set up networkConnect to a Wi-Fi networkyesyesyesyes
                              Account managementEnroll device in Active Directory,
                              enroll device in Azure Active Directory,
                              or create a local administrator account                              		yesnoyesyes
                              Bulk Enrollment in Azure ADEnroll device in Azure Active Directory

                              Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, set up Azure AD join in your organization.                              		noyesnono
                              Add applicationsInstall applications using the provisioning package.yesnoyesno
                              Add certificatesInclude a certificate file in the provisioning package.yesnoyesyes
                              Configure kiosk account and appCreate local account to run the kiosk mode app,
                              specify the app to run in kiosk mode                              		nonoyesno
                              Configure kiosk common settingsSet tablet mode,
                              configure welcome and shutdown screens,
                              turn off timeout settings                              		nonoyesno
                              Developer SetupEnable Developer Mode.nononoyes
                              - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) - [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md) @@ -97,19 +99,21 @@ The following table describes settings that you can configure using the wizards The following table provides some examples of settings that you can configure using the Windows Configuration Designer advanced editor to create provisioning packages. -| Customization options | Examples | -|--------------------------|-----------------------------------------------------------------------------------------------| + +| Customization options | Examples | +|--------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------| | Bulk Active Directory join and device name | Join devices to Active Directory domain and assign device names using hardware-specific serial numbers or random characters | -| Applications | Windows apps, line-of-business applications | -| Bulk enrollment into MDM | Automatic enrollment into a third-party MDM service\* | -| Certificates | Root certification authority (CA), client certificates | -| Connectivity profiles | Wi-Fi, proxy settings, Email | -| Enterprise policies | Security restrictions (password, device lock, camera, and so on), encryption, update settings | -| Data assets | Documents, music, videos, pictures | -| Start menu customization | Start menu layout, application pinning | -| Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on | -\* Using a provisioning package for auto-enrollment to System Center Configuration Manager or Configuration Manager/Intune hybrid is not supported. Use the Configuration Manager console to enroll devices. -  +| Applications | Windows apps, line-of-business applications | +| Bulk enrollment into MDM | Automatic enrollment into a third-party MDM service\* | +| Certificates | Root certification authority (CA), client certificates | +| Connectivity profiles | Wi-Fi, proxy settings, Email | +| Enterprise policies | Security restrictions (password, device lock, camera, and so on), encryption, update settings | +| Data assets | Documents, music, videos, pictures | +| Start menu customization | Start menu layout, application pinning | +| Other | Home and lock screen wallpaper, computer name, domain join, DNS settings, and so on | + +\* Using a provisioning package for auto-enrollment to Microsoft Endpoint Configuration Manager is not supported. Use the Configuration Manager console to enroll devices. + For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012). @@ -129,10 +133,10 @@ Windows ICD in Windows 10, version 1607, supported the following scenarios for I > [Learn how to use simple provisioning to configure Windows 10 computers.](provision-pcs-for-initial-deployment.md) * **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use Windows ICD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices. - + * **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows 10 Mobile devices and enroll them into mobile device management (MDM) before handing them to end-users in the organization. IT administrators can use Windows ICD to specify the management end-point and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include: - * System Center Configuration Manager and Microsoft Intune hybrid (certificate-based enrollment) + * Microsoft Intune (certificate-based enrollment) * AirWatch (password-string based enrollment) * Mobile Iron (password-string based enrollment) * Other MDMs (cert-based enrollment) @@ -164,9 +168,9 @@ Windows ICD in Windows 10, version 1607, supported the following scenarios for I -  - -  + + + diff --git a/windows/configuration/provisioning-packages/provisioning-powershell.md b/windows/configuration/provisioning-packages/provisioning-powershell.md index 0398edbb15..02c28c2b6d 100644 --- a/windows/configuration/provisioning-packages/provisioning-powershell.md +++ b/windows/configuration/provisioning-packages/provisioning-powershell.md @@ -4,11 +4,13 @@ description: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # PowerShell cmdlets for provisioning Windows 10 (reference) @@ -24,13 +26,13 @@ Windows 10, version 1703, ships with Windows Provisioning PowerShell cmdlets. Th - - - - - - - + + + + + + +
                              CmdletUse this cmdlet toSyntax
                              Add-ProvisioningPackage Apply a provisioning package```Add-ProvisioningPackage [-Path] [-ForceInstall] [-LogsFolder ] [-WprpFile ] []```
                              Remove-ProvisioningPackageRemove a provisioning package ```Remove-ProvisioningPackage -PackageId [-LogsFolder ] [-WprpFile ] []```
                              ```Remove-ProvisioningPackage -Path [-LogsFolder ] [-WprpFile ] []```
                              ```Remove-ProvisioningPackage -AllInstalledPackages [-LogsFolder ] [-WprpFile ] []```
                              Get-ProvisioningPackage Get information about an installed provisioning package ```Get-ProvisioningPackage -PackageId [-LogsFolder ] [-WprpFile ] []```
                              ```Get-ProvisioningPackage -Path [-LogsFolder ] [-WprpFile ] []```
                              ```Get-ProvisioningPackage -AllInstalledPackages [-LogsFolder ] [-WprpFile ] []```
                              Export-ProvisioningPackage Extract the contents of a provisioning package ```Export-ProvisioningPackage -PackageId -OutputFolder [-Overwrite] [-AnswerFileOnly] [-LogsFolder ] [-WprpFile ] []```
                              ```Export-ProvisioningPackage -Path -OutputFolder [-Overwrite] [-AnswerFileOnly] [-LogsFolder ] [-WprpFile ] []```
                              Install-TrustedProvisioningCertificate Adds a certificate to the Trusted Certificate store ```Install-TrustedProvisioningCertificate ```
                              Get-TrustedProvisioningCertificate List all installed trusted provisioning certificates; use this cmdlet to get the certificate thumbprint to use with the **Uninstall-TrustedProvisioningCertificate** cmdlet```Get-TrustedProvisioningCertificate```
                              Uninstall-TrustedProvisioningCertificate Remove a previously installed provisioning certificate```Uninstall-TrustedProvisioningCertificate ```
                              Add-ProvisioningPackage Apply a provisioning packageAdd-ProvisioningPackage [-Path] <string> [-ForceInstall] [-LogsFolder <string>] [-QuietInstall] [-WprpFile <string>] [<CommonParameters>]
                              Remove-ProvisioningPackageRemove a provisioning package Remove-ProvisioningPackage -PackageId <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                              Remove-ProvisioningPackage -Path <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                              Remove-ProvisioningPackage -AllInstalledPackages [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                              Get-ProvisioningPackage Get information about an installed provisioning package Get-ProvisioningPackage -PackageId <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                              Get-ProvisioningPackage -Path <string> [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                              Get-ProvisioningPackage -AllInstalledPackages [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                              Export-ProvisioningPackage Extract the contents of a provisioning package Export-ProvisioningPackage -PackageId <string> -OutputFolder <string> [-Overwrite] [-AnswerFileOnly] [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                              Export-ProvisioningPackage -Path <string> -OutputFolder <string> [-Overwrite] [-AnswerFileOnly] [-LogsFolder <string>] [-WprpFile <string>] [<CommonParameters>]
                              Install-TrustedProvisioningCertificate Adds a certificate to the Trusted Certificate store Install-TrustedProvisioningCertificate <path to local certificate file on disk>
                              Get-TrustedProvisioningCertificate List all installed trusted provisioning certificates; use this cmdlet to get the certificate thumbprint to use with the Uninstall-TrustedProvisioningCertificate cmdletGet-TrustedProvisioningCertificate
                              Uninstall-TrustedProvisioningCertificate Remove a previously installed provisioning certificateUninstall-TrustedProvisioningCertificate <thumbprint>
                              >[!NOTE] @@ -65,9 +67,9 @@ Trace logs are captured when using cmdlets. The following logs are available in -  + -  + diff --git a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md index 6b2041b522..6a96d2a9a1 100644 --- a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md +++ b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md @@ -4,11 +4,13 @@ description: With Windows 10, you can create provisioning packages that let you ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # Use a script to install a desktop app in provisioning packages diff --git a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md index aa1bf1b80d..8e974645d5 100644 --- a/windows/configuration/provisioning-packages/provisioning-uninstall-package.md +++ b/windows/configuration/provisioning-packages/provisioning-uninstall-package.md @@ -1,14 +1,16 @@ --- -title: Settings changed when you uninstall a provisioning package (Windows 10) +title: Uninstall a provisioning package - reverted settings (Windows 10) description: This topic lists the settings that are reverted when you uninstall a provisioning package. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp --- # Settings changed when you uninstall a provisioning package diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index 2124075aad..95cf9806b1 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -2,14 +2,16 @@ title: Set up a shared or guest PC with Windows 10 (Windows 10) description: Windows 10, version 1607, introduces *shared PC mode*, which optimizes Windows 10 for shared use scenarios. keywords: ["shared pc mode"] -ms.prod: W10 +ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.localizationpriority: medium ms.date: 10/02/2018 +ms.reviewer: +manager: dansimp --- # Set up a shared or guest PC with Windows 10 @@ -24,17 +26,17 @@ Windows 10, version 1607, introduced *shared PC mode*, which optimizes Windows 1 > [!NOTE] > If you're interested in using Windows 10 for shared PCs in a school, see [Use Set up School PCs app](https://technet.microsoft.com/edu/windows/use-set-up-school-pcs-app) which provides a simple way to configure PCs with shared PC mode plus additional settings specific for education. -##Shared PC mode concepts +## Shared PC mode concepts A Windows 10 PC in shared PC mode is designed to be management- and maintenance-free with high reliability. In shared PC mode, only one user can be signed in at a time. When the PC is locked, the currently signed in user can always be signed out at the lock screen. -###Account models +### Account models It is intended that shared PCs are joined to an Active Directory or Azure Active Directory domain by a user with the necessary rights to perform a domain join as part of a setup process. This enables any user that is part of the directory to sign-in to the PC. If using Azure Active Directory Premium, any domain user can also be configured to sign in with administrative rights. Additionally, shared PC mode can be configured to enable a **Guest** option on the sign-in screen, which doesn't require any user credentials or authentication, and creates a new local account each time it is used. Windows 10, version 1703, introduces a **kiosk mode** account. Shared PC mode can be configured to enable a **Kiosk** option on the sign-in screen, which doesn't require any user credentials or authentication, and creates a new local account each time it is used to run a specified app in assigned access (kiosk) mode. -###Account management +### Account management When the account management service is turned on in shared PC mode, accounts are automatically deleted. Account deletion applies to Active Directory, Azure Active Directory, and local accounts that are created by the **Guest** and **Kiosk** options. Account management is performed both at sign-off time (to make sure there is enough disk space for the next user) as well as during system maintenance time periods. Shared PC mode can be configured to delete accounts immediately at sign-out or when disk space is low. In Windows 10, version 1703, an inactive option is added which deletes accounts if they haven't signed in after a specified number of days. -###Maintenance and sleep -Shared PC mode is configured to take advantage of maintenance time periods which run while the PC is not in use. Therefore, sleep is strongly recommended so that the PC can wake up when it is not is use to perform maintenance, clean up accounts, and run Windows Update. The recommended settings can be set by choosing **SetPowerPolicies** in the list of shared PC options. Additionally, on devices without Advanced Configuration and Power Interface (ACPI) wake alarms, shared PC mode will always override real-time clock (RTC) wake alarms to be allowed to wake the PC from sleep (by default, RTC wake alarms are off). This ensures that the widest variety of hardware will take advantage of maintenance periods. +### Maintenance and sleep +Shared PC mode is configured to take advantage of maintenance time periods which run while the PC is not in use. Therefore, sleep is strongly recommended so that the PC can wake up when it is not in use to perform maintenance, clean up accounts, and run Windows Update. The recommended settings can be set by choosing **SetPowerPolicies** in the list of shared PC options. Additionally, on devices without Advanced Configuration and Power Interface (ACPI) wake alarms, shared PC mode will always override real-time clock (RTC) wake alarms to be allowed to wake the PC from sleep (by default, RTC wake alarms are off). This ensures that the widest variety of hardware will take advantage of maintenance periods. While shared PC mode does not configure Windows Update itself, it is strongly recommended to configure Windows Update to automatically install updates and reboot (if necessary) during maintenance hours. This will help ensure the PC is always up to date and not interrupting users with updates. @@ -46,7 +48,7 @@ Use one of the following methods to configure Windows Update: [Learn more about the AllowAutoUpdate settings](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx#Update_AllowAutoUpdate) -###App behavior +### App behavior Apps can take advantage of shared PC mode with the following three APIs: @@ -55,7 +57,7 @@ Apps can take advantage of shared PC mode with the following three APIs: - [IsEducationEnvironment](https://docs.microsoft.com/uwp/api/windows.system.profile.educationsettings) - This informs apps when the PC is used in an education environment. Apps may want to handle diagnostic data differently or hide advertising functionality. -###Customization +### Customization Shared PC mode exposes a set of customizations to tailor the behavior to your requirements. These customizations are the options that you'll set either using MDM or a provisioning package as explained in [Configuring shared PC mode on Windows](#configuring-shared-pc-mode-on-windows). The options are listed in the following table. | Setting | Value | @@ -79,7 +81,7 @@ Shared PC mode exposes a set of customizations to tailor the behavior to your re [Policies: Authentication](wcd/wcd-policies.md#authentication) (optional related setting) | Enables a quick first sign-in experience for a user by automatically connecting new non-admin Azure AD accounts to the pre-configured candidate local accounts. -##Configuring shared PC mode on Windows +## Configuring shared PC mode on Windows You can configure Windows to be in shared PC mode in a couple different ways: - Mobile device management (MDM): Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/mt723294.aspx). Your MDM policy can contain any of the options listed in the [Customization](#customization) section. The following image shows a Microsoft Intune policy with the shared PC options added as OMA-URI settings. [Learn more about Windows 10 policy settings in Microsoft Intune.](https://docs.microsoft.com/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune) @@ -109,43 +111,43 @@ $sharedPC.KioskModeAUMID = "" $sharedPC.KioskModeUserTileDisplayText = "" $sharedPC.InactiveThreshold = 0 Set-CimInstance -CimInstance $sharedPC -Get-CimInstance -Namespace $namespaceName -ClassName MDM_SharedPC +Get-CimInstance -Namespace "root\cimv2\mdm\dmmap" -ClassName MDM_SharedPC ``` ### Create a provisioning package for shared use 1. [Install Windows Configuration Designer](provisioning-packages/provisioning-install-icd.md) -1. Open Windows Configuration Designer. -2. On the **Start page**, select **Advanced provisioning**. -3. Enter a name and (optionally) a description for the project, and click **Next**. -4. Select **All Windows desktop editions**, and click **Next**. -5. Click **Finish**. Your project opens in Windows Configuration Designer. -6. Go to **Runtime settings** > **SharedPC**. [Select the desired settings for shared PC mode.](#customization) -7. On the **File** menu, select **Save.** -8. On the **Export** menu, select **Provisioning package**. -9. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** -10. Set a value for **Package Version**. +2. Open Windows Configuration Designer. +3. On the **Start page**, select **Advanced provisioning**. +4. Enter a name and (optionally) a description for the project, and click **Next**. +5. Select **All Windows desktop editions**, and click **Next**. +6. Click **Finish**. Your project opens in Windows Configuration Designer. +7. Go to **Runtime settings** > **SharedPC**. [Select the desired settings for shared PC mode.](#customization) +8. On the **File** menu, select **Save.** +9. On the **Export** menu, select **Provisioning package**. +10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** +11. Set a value for **Package Version**. > [!TIP] > You can make changes to existing packages and change the version number to update previously applied packages. -   -11. (*Optional*) In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. + +12. (*Optional*) In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. + - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. - > [!IMPORTANT]   - > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently. -   -12. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows Configuration Designer uses the project folder as the output location. + > [!IMPORTANT] + > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently. + +13. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows Configuration Designer uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location. -13. Click **Next**. -14. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status. +14. Click **Next**. +15. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status. If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. -15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. +16. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. -16. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods: +17. Select the **output location** link to go to the location of the package. You can provide that .ppkg to others through any of the following methods: - Shared network folder @@ -166,11 +168,11 @@ You can apply the provisioning package to a PC during initial setup or to a PC t 2. Insert the USB drive. If nothing happens when you insert the USB drive, press the Windows key five times. - - If there is only one provisioning package on the USB drive, the provisioning package is applied. + - If there is only one provisioning package on the USB drive, the provisioning package is applied. - - If there is more than one provisioning package on the USB drive, the **Set up device?** message displays. Click **Set up**, and select the provisioning package that you want to install. + - If there is more than one provisioning package on the USB drive, the **Set up device?** message displays. Click **Set up**, and select the provisioning package that you want to install. - ![Set up device?](images/setupmsg.jpg) + ![Set up device?](images/setupmsg.jpg) 3. Complete the setup process. @@ -187,7 +189,7 @@ On a desktop computer, navigate to **Settings** > **Accounts** > **Work ac ## Guidance for accounts on shared PCs * We recommend no local admin accounts on the PC to improve the reliability and security of the PC. -* When a PC is set up in shared PC mode with the default deletion policy, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account managment happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Guest** and **Kiosk** will be deleted automatically at sign out. +* When a PC is set up in shared PC mode with the default deletion policy, accounts will be cached automatically until disk space is low. Then, accounts will be deleted to reclaim disk space. This account management happens automatically. Both Azure AD and Active Directory domain accounts are managed in this way. Any accounts created through **Guest** and **Kiosk** will be deleted automatically at sign out. * On a Windows PC joined to Azure Active Directory: * By default, the account that joined the PC to Azure AD will have an admin account on that PC. Global administrators for the Azure AD domain will also have admin accounts on the PC. * With Azure AD Premium, you can specify which accounts have admin accounts on a PC using the **Additional administrators on Azure AD Joined devices** setting on the Azure portal. @@ -222,34 +224,34 @@ Shared PC mode sets local group policies to configure the device. Some of these

                              Policy name

                              Value

                              When set?

                              -

                              Admin Templates > Control Panel > Personalization

                              +

                              Admin Templates > Control Panel > Personalization

                              Prevent enabling lock screen slide show

                              Enabled

                              Always

                              Prevent changing lock screen and logon image

                              Enabled

                              Always

                              -

                              Admin Templates > System > Power Management > Button Settings

                              +

                              Admin Templates > System > Power Management > Button Settings

                              Select the Power button action (plugged in)

                              Sleep

                              SetPowerPolicies=True

                              Select the Power button action (on battery)

                              Sleep

                              SetPowerPolicies=True

                              Select the Sleep button action (plugged in)

                              Sleep

                              SetPowerPolicies=True

                              Select the lid switch action (plugged in)

                              Sleep

                              SetPowerPolicies=True

                              Select the lid switch action (on battery)

                              Sleep

                              SetPowerPolicies=True

                              -

                              Admin Templates > System > Power Management > Sleep Settings

                              +

                              Admin Templates > System > Power Management > Sleep Settings

                              Require a password when a computer wakes (plugged in)

                              Enabled

                              SignInOnResume=True

                              Require a password when a computer wakes (on battery)

                              Enabled

                              SignInOnResume=True

                              -

                              Specify the system sleep timeout (plugged in)

                              *SleepTimeout*

                              SetPowerPolicies=True

                              -

                              Specify the system sleep timeout (on battery)

                              *SleepTimeout*

                              SetPowerPolicies=True

                              +

                              Specify the system sleep timeout (plugged in)

                              SleepTimeout

                              SetPowerPolicies=True

                              +

                              Specify the system sleep timeout (on battery)

                              SleepTimeout

                              SetPowerPolicies=True

                              Turn off hybrid sleep (plugged in)

                              Enabled

                              SetPowerPolicies=True

                              Turn off hybrid sleep (on battery)

                              Enabled

                              SetPowerPolicies=True

                              -

                              Specify the unattended sleep timeout (plugged in)

                              *SleepTimeout*

                              SetPowerPolicies=True

                              -

                              Specify the unattended sleep timeout (on battery)

                              *SleepTimeout*

                              SetPowerPolicies=True

                              +

                              Specify the unattended sleep timeout (plugged in)

                              SleepTimeout

                              SetPowerPolicies=True

                              +

                              Specify the unattended sleep timeout (on battery)

                              SleepTimeout

                              SetPowerPolicies=True

                              Allow standby states (S1-S3) when sleeping (plugged in)

                              Enabled

                              SetPowerPolicies=True

                              Allow standby states (S1-S3) when sleeping (on battery)

                              Enabled

                              SetPowerPolicies=True

                              Specify the system hibernate timeout (plugged in)

                              Enabled, 0

                              SetPowerPolicies=True

                              Specify the system hibernate timeout (on battery)

                              Enabled, 0

                              SetPowerPolicies=True

                              -

                              Admin Templates>System>Power Management>Video and Display Settings

                              -

                              Turn off the display (plugged in)

                              *SleepTimeout*

                              SetPowerPolicies=True

                              -

                              Turn off the display (on battery

                              *SleepTimeout*

                              SetPowerPolicies=True

                              -

                              Admin Templates>System>Power Management>Energy Saver Settings

                              +

                              Admin Templates>System>Power Management>Video and Display Settings

                              +

                              Turn off the display (plugged in)

                              SleepTimeout

                              SetPowerPolicies=True

                              +

                              Turn off the display (on battery

                              SleepTimeout

                              SetPowerPolicies=True

                              +

                              Admin Templates>System>Power Management>Energy Saver Settings

                              Energy Saver Battery Threshold (on battery)70SetPowerPolicies=True -

                              Admin Templates>System>Logon

                              +

                              Admin Templates>System>Logon

                              Show first sign-in animation

                              Disabled

                              Always

                              Hide entry points for Fast User Switching

                              Enabled

                              Always

                              Turn on convenience PIN sign-in

                              Disabled

                              Always

                              @@ -258,35 +260,35 @@ Shared PC mode sets local group policies to configure the device. Some of these

                              Allow users to select when a password is required when resuming from connected standby

                              Disabled

                              SignInOnResume=True

                              Block user from showing account details on sign-in

                              Enabled

                              Always

                              -

                              Admin Templates>System>User Profiles

                              +

                              Admin Templates>System>User Profiles

                              Turn off the advertising ID

                              Enabled

                              SetEduPolicies=True

                              -

                              Admin Templates>Windows Components

                              +

                              Admin Templates>Windows Components

                              Do not show Windows Tips

                              Enabled

                              SetEduPolicies=True

                              Turn off Microsoft consumer experiences

                              Enabled

                              SetEduPolicies=True

                              Microsoft Passport for Work

                              Disabled

                              Always

                              Prevent the usage of OneDrive for file storage

                              Enabled

                              Always

                              -

                              Admin Templates>Windows Components>Biometrics

                              +

                              Admin Templates>Windows Components>Biometrics

                              Allow the use of biometrics

                              Disabled

                              Always

                              Allow users to log on using biometrics

                              Disabled

                              Always

                              Allow domain users to log on using biometrics

                              Disabled

                              Always

                              -

                              Admin Templates>Windows Components>Data Collection and Preview Builds

                              +

                              Admin Templates>Windows Components>Data Collection and Preview Builds

                              Toggle user control over Insider builds

                              Disabled

                              Always

                              Disable pre-release features or settings

                              Disabled

                              Always

                              Do not show feedback notifications

                              Enabled

                              Always

                              Allow TelemetryBasic, 0SetEduPolicies=True -

                              Admin Templates>Windows Components>File Explorer

                              +

                              Admin Templates>Windows Components>File Explorer

                              Show lock in the user tile menu

                              Disabled

                              Always

                              -

                              Admin Templates>Windows Components>Maintenance Scheduler

                              -

                              Automatic Maintenance Activation Boundary

                              *MaintenanceStartTime*

                              Always

                              +

                              Admin Templates>Windows Components>Maintenance Scheduler

                              +

                              Automatic Maintenance Activation Boundary

                              MaintenanceStartTime

                              Always

                              Automatic Maintenance Random Delay

                              Enabled, 2 hours

                              Always

                              Automatic Maintenance WakeUp Policy

                              Enabled

                              Always

                              -

                              Admin Templates>Windows Components>Windows Hello for Business

                              +

                              Admin Templates>Windows Components>Windows Hello for Business

                              Use phone sign-in

                              Disabled

                              Always

                              Use Windows Hello for Business

                              Disabled

                              Always

                              Use biometrics

                              Disabled

                              Always

                              -

                              Admin Templates>Windows Components>OneDrive

                              +

                              Admin Templates>Windows Components>OneDrive

                              Prevent the usage of OneDrive for file storage

                              Enabled

                              Always

                              -

                              Windows Settings>Security Settings>Local Policies>Security Options

                              +

                              Windows Settings>Security Settings>Local Policies>Security Options

                              Interactive logon: Do not display last user name

                              Enabled, Disabled when account model is only guest

                              Always

                              Interactive logon: Sign-in last interactive user automatically after a system-initiated restart

                              Disabled

                              Always

                              @@ -300,7 +302,7 @@ Shared PC mode sets local group policies to configure the device. Some of these -  + diff --git a/windows/configuration/setup-digital-signage.md b/windows/configuration/setup-digital-signage.md index 3e25afe52b..7741d3ba98 100644 --- a/windows/configuration/setup-digital-signage.md +++ b/windows/configuration/setup-digital-signage.md @@ -2,11 +2,14 @@ title: Set up digital signs on Windows 10 (Windows 10) description: A single-use device such as a digital sign is easy to set up in Windows 10 (Pro, Enterprise, and Education). ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +ms.reviewer: +manager: dansimp +ms.author: dansimp keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage", "kiosk browser", "browser"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms +author: dansimp ms.localizationpriority: medium ms.date: 10/02/2018 ms.topic: article @@ -55,7 +58,7 @@ This procedure explains how to configure digital signage using Kiosk Browser on - Enter a user name and password, and toggle **Auto sign-in** to **Yes**. - Under **Configure the kiosk mode app**, enter the user name for the account that you're creating. - For **App type**, select **Universal Windows App**. - - In **Enter the AUMID for the app**, enter `Microsoft.KioskBrowser_8wekyb3d8bbwe`. + - In **Enter the AUMID for the app**, enter `Microsoft.KioskBrowser_8wekyb3d8bbwe!App`. 11. In the bottom left corner of Windows Configuration Designer, select **Switch to advanced editor**. 12. Go to **Runtime settings** > **Policies** > **KioskBrowser**. Let's assume that the URL for your digital signage content is contoso.com/menu. - In **BlockedUrlExceptions**, enter `https://www.contoso.com/menu`. @@ -89,4 +92,4 @@ This procedure explains how to configure digital signage using Kiosk Browser on - \ No newline at end of file + diff --git a/windows/configuration/start-layout-troubleshoot.md b/windows/configuration/start-layout-troubleshoot.md index c29f399bba..2e002f5962 100644 --- a/windows/configuration/start-layout-troubleshoot.md +++ b/windows/configuration/start-layout-troubleshoot.md @@ -4,10 +4,12 @@ description: Troubleshoot common errors related to Start menu in Windows 10. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -ms.author: kaushika -author: kaushika-msft +ms.author: dansimp +author: dansimp ms.localizationpriority: medium ms.date: 12/03/18 +ms.reviewer: +manager: dansimp ms.topic: troubleshooting --- @@ -183,7 +185,7 @@ Events for both PDC and Background Tasks Infrastructure Service will be recorded **Resolution**: This issue was resolved in the June 2017 updates. Please update Windows 10, version 1607 to the latest cumulative or feature updates. ->[!Note] +>[!NOTE] >When the Group Policy is enabled, the desired behavior also needs to be selected. By default, it is set to **None**. @@ -212,7 +214,7 @@ XML files can and should be tested locally on a Hyper-V or other virtual machine ### Symptom: Start menu no longer works after a PC is refreshed using F12 during start up -**Description**: If a user is having problems with a PC, is can be refreshed, reset, or restored. Refreshing the PC is a beneficial option because it maintains personal files and settings. When users have trouble starting the PC, "Change PC settings" in Settings is not accessible. So, to access the System Refresh, users may use the F12 key at start up. Refreshing the PC finishes, but Start Menu is not accessible. +**Description**: If a user is having problems with a PC, is can be refreshed, reset, or restored. Refreshing the PC is a beneficial option because it maintains personal files and settings. When users have trouble starting the PC, "Change PC settings" in Settings is not accessible. So, to access the System Refresh, users may use the F12 key at start up. Refreshing the PC finishes, but Start Menu is not accessible. **Cause**: This is a known issue and has been resolved in a cumulative update released August 30th 2018. @@ -231,10 +233,10 @@ XML files can and should be tested locally on a Hyper-V or other virtual machine - User-initiated changes to the start layout are not roamed. Specifically, behaviors include - - Applications (apps or icons) pinned to the start menu are missing. - - Entire tile window disappears. - - The start button fails to respond. - - If a new roaming user is created, the first logon appears normal, but on subsequent logons, tiles are missing. +- Applications (apps or icons) pinned to the start menu are missing. +- Entire tile window disappears. +- The start button fails to respond. +- If a new roaming user is created, the first logon appears normal, but on subsequent logons, tiles are missing. ![Example of a working layout](images/start-ts-3.png) @@ -280,14 +282,14 @@ Additionally, users may see blank tiles if logon was attempted without network c ### Symptom: Start Menu issues with Tile Data Layer corruption -**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database. +**Cause**: Windows 10, version 1507 through the release of version 1607 uses a database for the Tile image information. This is called the Tile Data Layer database (The feature was deprecated in [Windows 10 1703](https://support.microsoft.com/help/4014193/features-that-are-removed-or-deprecated-in-windows-10-creators-update)). **Resolution** There are steps you can take to fix the icons, first is to confirm that is the issue that needs to be addressed. 1. The App or Apps work fine when you click on the tiles. 2. The tiles are blank, have a generic placeholder icon, have the wrong or strange title information. 3. The app is missing, but listed as installed via Powershell and works if you launch via URI. - - Example: `windows-feedback://` + - Example: `windows-feedback://` 4. In some cases, Start can be blank, and Action Center and Cortana do not launch. >[!Note] diff --git a/windows/configuration/start-layout-xml-desktop.md b/windows/configuration/start-layout-xml-desktop.md index cac14132af..520de10950 100644 --- a/windows/configuration/start-layout-xml-desktop.md +++ b/windows/configuration/start-layout-xml-desktop.md @@ -5,10 +5,12 @@ keywords: ["start screen"] ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article ms.date: 10/02/2018 +ms.reviewer: +manager: dansimp ms.localizationpriority: medium --- @@ -51,19 +53,22 @@ The XML schema for `LayoutModification.xml` requires the following order for tag 1. TopMFUApps 1. CustomTaskbarLayoutCollection 1. InkWorkspaceTopApps +1. StartLayoutCollection Comments are not supported in the `LayoutModification.xml` file. ### Supported elements and attributes ->[!NOTE] +>[!NOTE] >To make sure the Start layout XML parser processes your file correctly, follow these guidelines when working with your LayoutModification.xml file: >- Do not leave spaces or white lines in between each element. >- Do not add comments inside the StartLayout node or any of its children elements. >- Do not add multiple rows of comments. The following table lists the supported elements and attributes for the LayoutModification.xml file. +> [!NOTE] +> RequiredStartGroupsCollection and AppendGroup syntax only apply when the Import-StartLayout method is used for building and deploying Windows images. | Element | Attributes | Description | | --- | --- | --- | @@ -541,9 +546,9 @@ Once you have created the LayoutModification.xml file and it is present in the d - [Changes to Start policies in Windows 10](changes-to-start-policies-in-windows-10.md) - [Start layout XML for mobile editions of Windows 10 (reference)](mobile-devices/start-layout-xml-mobile.md) -  + -  + diff --git a/windows/configuration/start-secondary-tiles.md b/windows/configuration/start-secondary-tiles.md index 0dddb20773..2064129dc1 100644 --- a/windows/configuration/start-secondary-tiles.md +++ b/windows/configuration/start-secondary-tiles.md @@ -6,10 +6,11 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: jdeckerms -ms.author: jdecker +author: dansimp +ms.author: dansimp ms.topic: article -ms.date: 06/27/2018 +ms.reviewer: +manager: dansimp --- # Add image for secondary Microsoft Edge tiles @@ -62,7 +63,7 @@ In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutE ## Export Start layout and assets -1. Follow the instructions in [Customize and export Start layout](customize-and-export-start-layout.md#bkmkcustomizestartscreen) to customize the Start screen on your test computer. +1. Follow the instructions in [Customize and export Start layout](customize-and-export-start-layout.md#customize-the-start-screen-on-your-test-computer) to customize the Start screen on your test computer. 2. Open Windows PowerShell as an administrator and enter the following command: ``` @@ -73,11 +74,8 @@ In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutE Use a file name of your choice—for example, StartLayoutMarketing.xml. Include the .xml file name extension. The [Export-StartLayout](https://docs.microsoft.com/powershell/module/startlayout/export-startlayout?view=win10-ps) cmdlet does not append the file name extension, and the policy settings require the extension. 3. If you’d like to change the image for a secondary tile to your own custom image, open the layout.xml file, and look for the images that the tile references. - - For example, your layout.xml contains `Square150x150LogoUri="ms-appdata:///local/PinnedTiles/21581260870/hires.png" Wide310x150LogoUri="ms-appx:///"` - - Open `C:\Users\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\21581260870\` and replace those images with your customized images. - - >[!TIP] - >A quick method for getting appropriately sized images for each tile size is to upload your image at [BuildMyPinnedSite](http://www.buildmypinnedsite.com/) and then download the resized tile images. + - For example, your layout.xml contains `Square150x150LogoUri="ms-appdata:///local/PinnedTiles/21581260870/hires.png" Wide310x150LogoUri="ms-appx:///"` + - Open `C:\Users\\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\21581260870\` and replace those images with your customized images. 4. In Windows PowerShell, enter the following command: @@ -110,12 +108,9 @@ In Microsoft Intune, you create a device restrictions policy to apply to device >[!NOTE] >The device restrictions in Microsoft Intune include [other Start settings](https://docs.microsoft.com/intune/device-restrictions-windows-10#start) that you can also configure in your profile. - - ### Using a provisioning package - -#### Prepare the Start layout and Edge assets XML files +#### Prepare the Start layout and Edge assets XML files The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce XML files. Because Windows Configuration Designer produces a customizations.xml file that contains the configuration settings, adding the Start layout and Edge assets sections to the customizations.xml file directly would result in an XML file embedded in an XML file. Before you add the Start layout and Edge assets sections to the customizations.xml file, you must replace the markup characters in your layout.xml with escape characters. @@ -126,7 +121,7 @@ The **export-StartLayout** and **export-StartLayoutEdgeAssets** cmdlets produce 3. During the procedure to create a provisioning package, you will copy the text with the escape characters and paste it in the customizations.xml file for your project. -#### Create a provisioning package that contains a customized Start layout +#### Create a provisioning package that contains a customized Start layout Use the Windows Configuration Designer tool to create a provisioning package. [Learn how to install Windows Configuration Designer.](provisioning-packages/provisioning-install-icd.md) @@ -134,7 +129,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L >[!IMPORTANT] >When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. -1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). +1. Open Windows Configuration Designer (by default, %systemdrive%\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Imaging and Configuration Designer\\x86\\ICD.exe). 2. Choose **Advanced provisioning**. @@ -155,56 +150,56 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 9. Enter **assets.xml**. This value creates a placeholder in the customizations.xml file that you will replace with the contents of the assets.xml file in a later step. -7. Save your project and close Windows Configuration Designer. +10. Save your project and close Windows Configuration Designer. -7. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) +11. In File Explorer, open the project's directory. (The default location is C:\Users\\*user name*\Documents\Windows Imaging and Configuration Designer (WICD)\\*project name*) -7. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: +12. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: - ![Customizations file with the placeholder text to replace highlighted](images/customization-start-edge.png) + ![Customizations file with the placeholder text to replace highlighted](images/customization-start-edge.png) -7. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). +13. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). -8. Replace **assets.xml** with the text from the assets.xml file, [with markup characters replaced with escape characters](#escape). +14. Replace **assets.xml** with the text from the assets.xml file, [with markup characters replaced with escape characters](#escape). -8. Save and close the customizations.xml file. +15. Save and close the customizations.xml file. -8. Open Windows Configuration Designer and open your project. +16. Open Windows Configuration Designer and open your project. -8. On the **File** menu, select **Save.** +17. On the **File** menu, select **Save.** -9. On the **Export** menu, select **Provisioning package**. +18. On the **Export** menu, select **Provisioning package**. -10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** +19. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** -11. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. +20. Optional. In the **Provisioning package security** window, you can choose to encrypt the package and enable package signing. - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Select...** and choosing the certificate you want to use to sign the package. -12. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. +21. Click **Next** to specify the output location where you want the provisioning package to go when it's built. By default, Windows Imaging and Configuration Designer (ICD) uses the project folder as the output location. Optionally, you can click **Browse** to change the default output location. -13. Click **Next**. +22. Click **Next**. -14. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. +23. Click **Build** to start building the package. The provisioning package doesn't take long to build. The project information is displayed in the build page and the progress bar indicates the build status. If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. -15. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. +24. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again. If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. -16. Copy the provisioning package to the target device. +25. Copy the provisioning package to the target device. -17. Double-click the ppkg file and allow it to install. +26. Double-click the ppkg file and allow it to install. - ## Related topics + ## Related topics - [Manage Windows 10 Start and taskbar layout](windows-10-start-layout-options-and-policies.md) - [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) diff --git a/windows/configuration/stop-employees-from-using-microsoft-store.md b/windows/configuration/stop-employees-from-using-microsoft-store.md index eb3d236c32..0f0d1cd783 100644 --- a/windows/configuration/stop-employees-from-using-microsoft-store.md +++ b/windows/configuration/stop-employees-from-using-microsoft-store.md @@ -1,13 +1,15 @@ --- title: Configure access to Microsoft Store (Windows 10) -description: IT Pros can configure access to Microsoft Store for client computers in their organization. For some organizations, business policies require blocking access to Microsoft Store. +description: Learn how to configure access to Microsoft Store for client computers and mobile devices in your organization. ms.assetid: 7AA60D3D-2A69-45E7-AAB0-B8AFC29C2E97 +ms.reviewer: +manager: dansimp ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: store, mobile -author: TrudyHa -ms.author: Trudyha +author: dansimp +ms.author: dansimp ms.topic: conceptual ms.localizationpriority: medium ms.date: 4/16/2018 @@ -21,7 +23,7 @@ ms.date: 4/16/2018 - Windows 10 - Windows 10 Mobile ->For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). +>For more info about the features and functionality that are supported in each edition of Windows, see [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare). IT pros can configure access to Microsoft Store for client computers in their organization. For some organizations, business policies require blocking access to Microsoft Store. diff --git a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md index dc54b8c470..e6a50b2114 100644 --- a/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md +++ b/windows/configuration/ue-v/uev-administering-uev-with-windows-powershell-and-wmi.md @@ -1,12 +1,15 @@ --- title: Administering UE-V with Windows PowerShell and WMI description: Administering UE-V with Windows PowerShell and WMI -author: MaggiePucciEvans +author: trudyha ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article --- @@ -41,4 +44,4 @@ After you create and deploy UE-V settings location templates, you can manage tho - [Administering UE-V](uev-administering-uev.md) -- [User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx) \ No newline at end of file +- [User Experience Virtualization in Windows PowerShell](https://technet.microsoft.com/library/mt772286.aspx) diff --git a/windows/configuration/ue-v/uev-administering-uev.md b/windows/configuration/ue-v/uev-administering-uev.md index 231e26adb5..16154765ea 100644 --- a/windows/configuration/ue-v/uev-administering-uev.md +++ b/windows/configuration/ue-v/uev-administering-uev.md @@ -1,12 +1,15 @@ --- title: Administering UE-V description: Administering UE-V -author: MaggiePucciEvans +author: trudyha ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article --- diff --git a/windows/configuration/ue-v/uev-application-template-schema-reference.md b/windows/configuration/ue-v/uev-application-template-schema-reference.md index d68b5836f0..2a219ab6bc 100644 --- a/windows/configuration/ue-v/uev-application-template-schema-reference.md +++ b/windows/configuration/ue-v/uev-application-template-schema-reference.md @@ -1,12 +1,15 @@ --- title: Application Template Schema Reference for UE-V description: Application Template Schema Reference for UE-V -author: MaggiePucciEvans +author: trudyha ms.pagetype: mdop, virtualization ms.mktglfcycl: deploy ms.sitesec: library ms.prod: w10 ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.topic: article --- @@ -150,7 +153,7 @@ The Process data type is a container used to describe processes to be monitored -  + **Processes** The Processes data type represents a container for a collection of one or more Process elements. Two child elements are supported in the Processes sequence type: **Process** and **ShellProcess**. Process is an element of type Process and ShellProcess is of data type Empty. At least one item must be identified in the sequence. @@ -199,7 +202,7 @@ Settings is a container for all the settings that apply to a particular template -  + ### Name Element @@ -214,7 +217,7 @@ UE-V does not reference external DTDs, so it is not possible to use named entiti See for a complete list of character entities. UTF-8-encoded documents may include the Unicode characters directly. Saving templates through the UE-V template generator converts character entities to their Unicode representations automatically. -  + ### ID Element @@ -238,7 +241,7 @@ Version identifies the version of the settings location template for administrat **Hint:** You can save notes about version changes using XML comment tags ``, for example: -``` syntax +```xml RTM) of the file back to quality update RTM/base - version and forward differential (VRTM--->R) from feature update RTM/base - version to the target version. Also, use null differential hydration to - hydrate null compressed files. - -- Stage the hydrated files (full file), forward differentials (under ‘f’ - folder) and reverse differentials (under ‘r’ folder) or null compressed - files (under ‘n’ folder) in the component store (%windir%\\WinSxS folder). - -- Resolve any dependencies and install components. - -- Clean up older state (VN-1); the previous state VN is retained for - uninstallation and restoration or repair. +- Identify all files that are required to install the update. +- Hydrate each of necessary files using current version (VN) of the file, reverse differential (VN--->RTM) of the file back to quality update RTM/base version and forward differential (VRTM--->R) from feature update RTM/base version to the target version. Also, use null differential hydration to hydrate null compressed files. +- Stage the hydrated files (full file), forward differentials (under ‘f’ folder) and reverse differentials (under ‘r’ folder) or null compressed files (under ‘n’ folder) in the component store (%windir%\\WinSxS folder). +- Resolve any dependencies and install components. +- Clean up older state (VN-1); the previous state VN is retained for uninstallation and restoration or repair. ### **Resilient Hydration** -To ensure resiliency against component store corruption or missing files that -could occur due to susceptibility of certain types of hardware to file system -corruption, a corruption repair service has been traditionally used to recover -the component store automatically (“automatic corruption repair”) or on demand -(“manual corruption repair”) using an online or local repair source. This -service will continue to offer the ability to repair and recover content for +To ensure resiliency against component store corruption or missing files that could occur due to susceptibility of certain types of hardware to file system corruption, a corruption repair service has been traditionally used to recover the component store automatically (“automatic corruption repair”) or on demand (“manual corruption repair”) using an online or local repair source. This service will continue to offer the ability to repair and recover content for hydration and successfully install an update, if needed. -When corruption is detected during update operations, automatic corruption -repair will start as usual and use the Baseless Patch Storage File published to -Windows Update for each update to fix corrupted manifests, binary differentials, -or hydrated or full files. Baseless patch storage files will contain reverse and -forward differentials and full files for each updated component. Integrity of -the repair files will be hash verified. +When corruption is detected during update operations, automatic corruption repair will start as usual and use the Baseless Patch Storage File published to Windows Update for each update to fix corrupted manifests, binary differentials, or hydrated or full files. Baseless patch storage files will contain reverse and forward differentials and full files for each updated component. Integrity of the repair files will be hash verified. -Corruption repair will use the component manifest to detect missing files and -get hashes for corruption detection. During update installation, new registry -flags for each differential staged on the machine will be set. When automatic -corruption repair runs, it will scan hydrated files using the manifest and -differential files using the flags. If the differential cannot be found or -verified, it will be added to the list of corruptions to repair. +Corruption repair will use the component manifest to detect missing files and get hashes for corruption detection. During update installation, new registry flags for each differential staged on the machine will be set. When automatic corruption repair runs, it will scan hydrated files using the manifest and differential files using the flags. If the differential cannot be found or verified, it will be added to the list of corruptions to repair. ### Lazy automatic corruption repair -“Lazy automatic corruption repair” runs during update operations to detect -corrupted binaries and differentials. While applying an update, if hydration of -any file fails, "lazy" automatic corruption repair automatically starts, -identifies the corrupted binary or differential file, and then adds it to the -corruption list. Later, the update operation continues as far as it can go, so -that "lazy" automatic corruption repair can collect as many corrupted files to fix -as possible. At the end of the hydration section, the update fails, and -automatic corruption repair starts. Automatic corruption repair runs as usual -and at the end of its operation, adds the corruption list generated by "lazy" -automatic corruption repair on top of the new list to repair. Automatic -corruption repair then repairs the files on the corruption list and installation -of the update will succeed on the next attempt. +“Lazy automatic corruption repair” runs during update operations to detect corrupted binaries and differentials. While applying an update, if hydration of any file fails, "lazy" automatic corruption repair automatically starts, identifies the corrupted binary or differential file, and then adds it to the corruption list. Later, the update operation continues as far as it can go, so that "lazy" automatic corruption repair can collect as many corrupted files to fix as possible. At the end of the hydration section, the update fails, and automatic corruption repair starts. Automatic corruption repair runs as usual and at the end of its operation, adds the corruption list generated by "lazy" automatic corruption repair on top of the new list to repair. Automatic corruption repair then repairs the files on the corruption list and installation of the update will succeed on the next attempt. diff --git a/windows/deployment/update/WIP4Biz-intro.md b/windows/deployment/update/WIP4Biz-intro.md index 7a21b2cf52..3534c08c5c 100644 --- a/windows/deployment/update/WIP4Biz-intro.md +++ b/windows/deployment/update/WIP4Biz-intro.md @@ -1,20 +1,22 @@ --- title: Introduction to the Windows Insider Program for Business -description: Introduction to the Windows Insider Program for Business and why IT Pros should join it +description: Introduction to the Windows Insider Program for Business and why IT Pros should join keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, WiP4Biz, enterprise, rings, flight ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library +audience: itpro +itproauthor: jaimeo author: jaimeo -ms.localizationpriority: medium -ms.author: jaimeo -ms.date: 03/01/2018 +ms.localizationprioauthor: jaimeo +ms.audience: itpro +author: jaimeo +ms.reviewer: +manager: laurawi ms.topic: article --- # Introduction to the Windows Insider Program for Business - **Applies to** - Windows 10 @@ -36,11 +38,9 @@ Microsoft recommends that all organizations have at least a few devices enrolled The Windows Insider Program doesn't replace Semi-Annual Channel deployments in an organization. Rather, it provides IT Pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. - [![Illustration showing the Windows Insider PreviewFast Ring for exploration, the Slow Ring for validation, the Semi-Annual Channel Targeted ring for Pilot deployment, and the Semi-Annual Channel for broad deployment](images/WIP4Biz_deployment.png)](images/WIP4Biz_deployment.png)
                              Windows 10 Insider Preview builds enable organizations to prepare sooner for Windows Semi-Annual releases and reduce the overall validation effort required with traditional deployments. - ## Explore new Windows 10 features in Insider Previews Windows 10 Insider Preview builds offer organizations a valuable and exciting opportunity to evaluate new Windows features well before general release. What’s more, by providing feedback to Microsoft on these features, you and other Insiders in your organization can help shape Windows for your specific business needs. Here’s how to get the most out of your feature exploration: @@ -49,7 +49,7 @@ Windows 10 Insider Preview builds offer organizations a valuable and exciting op |Release channel |**Fast Ring:** Insider Preview builds in the Fast Ring are released approximately once a week and contain the very latest features. This makes them ideal for feature exploration.| |Users | Because Fast Ring builds are released so early in the development cycle, we recommend limiting feature exploration in your organization to IT administrators and developers running Insider Preview builds on secondary devices. | |Tasks | - Install and manage Insider Preview builds on devices (per device or centrally across multiple devices)
                              - Explore new features in Windows designed for organizations, including new features related to current and planned line of business applications
                              - Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) for a summary of current features. | -|Feedback | - Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible.
                              - Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.)
                              - [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/en-us/how-to-feedback/) | +|Feedback | - Provide feedback via [Feedback Hub app](insiderhub://home/). This helps us make adjustments to features as quickly as possible.
                              - Encourage users to sign into the Feedback Hub using their AAD work accounts. This enables both you and Microsoft to track feedback submitted by users within your specific organization. (Note: This tracking is only visible to Microsoft and registered Insiders within your organization’s domain.)
                              - [Learn how to provide effective feedback in the Feedback Hub](https://insider.windows.com/how-to-feedback/) | ## Validate Insider Preview builds Along with exploring new features, you also have the option to validate your apps and infrastructure on Insider Preview builds. This activity can play an important role in your [Windows 10 deployment strategy](https://docs.microsoft.com/windows/deployment/update/waas-windows-insider-for-business). Early validation has several benefits: @@ -60,13 +60,10 @@ Along with exploring new features, you also have the option to validate your app - Deploy Windows 10 Semi-Annual releases faster and more confidently - Maximize the 18-month support Window that comes with each Semi-Annual release. - - |Objective |Feature exploration| |---------|---------| |Release channel |**Slow Ring:** Insider Preview builds in the Slow Ring are released approximately once a month. They are more stable than Fast Ring releases, making them better suited for validation purposes. Slow Ring releases can be run on either secondary or primary production devices by skilled users.| |Users | Application and infrastructure validation: In addition to Insiders who might have participated in feature exploration, we also recommend including a small group of application users from each business department to ensure a representative sample.| |Tasks | Application and infrastructure validation: Before running an Insider Preview build, check our [Windows Insider blog](https://blogs.windows.com/windowsexperience/tag/windows-insider-program/#k3WWwxKCTWHCO82H.97) and [Windows Insider Tech Community](https://techcommunity.microsoft.com/t5/Windows-Insider-Program/bd-p/WindowsInsiderProgram) pages for updates on current issues and fixes. | |Feedback | Application and infrastructure validation:Provide feedback in the Feedback Hub app and also inform app vendors of any significant issues. | -|Guidance | Application and infrastructure validation:
                              - [Use Upgrade Readiness to create an app inventory and identify mission-critical apps](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-identify-apps)
                              - [Use Device Health to identify problem devices and device drivers](https://docs.microsoft.com/windows/deployment/update/device-health-monitor)
                              - [Windows 10 application compatibility](https://technet.microsoft.com/windows/mt703793)| - +|Guidance | Application and infrastructure validation:
                              - [Use Upgrade Readiness to create an app inventory and identify mission-critical apps](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-identify-apps)
                              - [Use Device Health to identify problem devices and device drivers](https://docs.microsoft.com/windows/deployment/update/device-health-monitor)
                              - [Windows 10 application compatibility](https://technet.microsoft.com/windows/mt703793)| \ No newline at end of file diff --git a/windows/deployment/update/change-history-for-update-windows-10.md b/windows/deployment/update/change-history-for-update-windows-10.md index 85a1a19aaf..99bb88d5a4 100644 --- a/windows/deployment/update/change-history-for-update-windows-10.md +++ b/windows/deployment/update/change-history-for-update-windows-10.md @@ -3,10 +3,12 @@ title: Change history for Update Windows 10 (Windows 10) description: This topic lists new and updated topics in the Update Windows 10 documentation for Windows 10 and Windows 10 Mobile. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: DaniHalfin -ms.author: daniha -ms.date: 09/18/2018 +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.author: jaimeo +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -20,7 +22,7 @@ This topic lists new and updated topics in the [Update Windows 10](index.md) doc | New or changed topic | Description | | --- | --- | -| [Get started with Windows Update](windows-update-overview.md) | New | +| [Get started with Windows Update](windows-update-overview.md) | New | ## RELEASE: Windows 10, version 1709 @@ -31,7 +33,7 @@ The topics in this library have been updated for Windows 10, version 1709 (also | New or changed topic | Description | | --- | --- | -| [Olympia Corp](olympia/olympia-enrollment-guidelines.md) | New | +| [Olympia Corp](olympia/olympia-enrollment-guidelines.md) | New | ## July 2017 @@ -41,7 +43,7 @@ All topics were updated to reflect the new [naming changes](waas-overview.md#nam | New or changed topic | Description | | --- | --- | -| [Manage additional Windows Update settings](waas-wu-settings.md) | New | +| [Manage additional Windows Update settings](waas-wu-settings.md) | New | ## RELEASE: Windows 10, version 1703 diff --git a/windows/deployment/update/device-health-get-started.md b/windows/deployment/update/device-health-get-started.md deleted file mode 100644 index 5cab04e4ba..0000000000 --- a/windows/deployment/update/device-health-get-started.md +++ /dev/null @@ -1,76 +0,0 @@ ---- -title: Get started with Device Health -description: Configure Device Health in Azure Monitor to monitor health (such as crashes and sign-in failures) for your Windows 10 devices. -keywords: Device Health, oms, operations management suite, prerequisites, requirements, monitoring, crash, drivers, azure -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.date: 10/29/2018 -ms.pagetype: deploy -author: jaimeo -ms.author: jaimeo -ms.localizationpriority: medium -ms.collection: M365-analytics -ms.topic: article ---- - -# Get started with Device Health - -This topic explains the steps necessary to configure your environment for Windows Analytics Device Health. - -- [Get started with Device Health](#get-started-with-device-health) - - [Add the Device Health solution to your Azure subscription](#add-the-device-health-solution-to-your-azure-subscription) - - [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics) - - [Use Device Health to monitor device crashes, app crashes, sign-in failures, and more](#use-device-health-to-monitor-device-crashes-app-crashes-sign-in-failures-and-more) - - [Related topics](#related-topics) - - - -## Add the Device Health solution to your Azure subscription - -Device Health is offered as a *solution* which you link to a new or existing [Azure Monitor](https://azure.microsoft.com/services/monitor/) *workspace* within your Azure *subscription*. To configure this, follows these steps: - -1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal. - - >[!NOTE] - > Device Health is included at no additional cost with Windows 10 [education and enterprise licensing](https://docs.microsoft.com/windows/deployment/update/device-health-monitor#device-health-licensing). An Azure subscription is required for managing and using Device Health, but no Azure charges are expected to accrue to the subscription as a result of using Device Health. - -2. In the Azure portal select **Create a resource**, search for "Device Health", and then select **Create** on the **Device Health** solution. - ![Azure portal page highlighting + Create a resource and with Device Health selected](images/CreateSolution-Part1-Marketplace.png) - - ![Azure portal showing Device Health fly-in and Create button highlighted(images/CreateSolution-Part2-Create.png)](images/CreateSolution-Part2-Create.png) -3. Choose an existing workspace or create a new workspace to host the Device Health solution. - ![Azure portal showing Azure Monitor workspace fly-in](images/CreateSolution-Part3-Workspace.png) - - If you are using other Windows Analytics solutions (Upgrade Readiness or Update Compliance) you should add Device Health to the same workspace. - - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started: - - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*. - - For the resource group setting select **Create new** and use the same name you chose for your new workspace. - - For the location setting, choose the Azure region where you would prefer the data to be stored. - - For the pricing tier select **Free**. -4. Now that you have selected a workspace, you can go back to the Device Health blade and select **Create**. - ![Azure portal showing workspace selected and with Create button highlighted](images/CreateSolution-Part4-WorkspaceSelected.png) -5. Watch for a Notification (in the Azure portal) that "Deployment 'Microsoft.DeviceHealth' to resource group 'YourResourceGroupName' was successful." and then select **Go to resource** This might take several minutes to appear. - ![Azure portal all services page with Azure Monitor found and selected as favorite](images/CreateSolution-Part5-GoToResource.png) - - Suggestion: Choose the **Pin to Dashboard** option to make it easy to navigate to your newly added Device Health solution. - - Suggestion: If a "resource unavailable" error occurs when navigating to the solution, try again after one hour. - -## Enroll devices in Windows Analytics - -Once you've added Device Health to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For Device Health there are two key steps for enrollment: -1. Deploy your CommercialID (from Device Health Settings page) to your Windows 10 devices (typically using Group Policy or similar) -2. Ensure the Windows Diagnostic Data setting on devices is set to Enhanced or Full (typically using Group Policy or similar). Note that the [Limit Enhanced](https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields) policy can substantially reduce the amount of diagnostic data shared with Microsoft while still allowing Device Health to function. -For full enrollment instructions and troubleshooting, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). - -After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it may take 48-72 hours for the first data to appear in the solution. Until then, the Device Health tile will show "Performing Assessment." - -## Use Device Health to monitor device crashes, app crashes, sign-in failures, and more - -Once your devices are enrolled and data is flowing, you can move on to [Using Device Health](device-health-using.md). - ->[!NOTE] ->You can remove the Device Health solution from your workspace if you no longer want to monitor your organization’s devices. Windows diagnostic data will continue to be shared with Microsoft as normal as per the diagnostic data sharing settings on the devices. - -## Related topics - -[Use Device Health to monitor frequency and causes of device crashes](device-health-using.md)
                              -For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics) diff --git a/windows/deployment/update/device-health-monitor.md b/windows/deployment/update/device-health-monitor.md deleted file mode 100644 index 87450cc71f..0000000000 --- a/windows/deployment/update/device-health-monitor.md +++ /dev/null @@ -1,82 +0,0 @@ ---- -title: Monitor the health of devices with Device Health -description: You can use Device Health in Azure Portal to monitor the frequency and causes of crashes and misbehaving apps on devices in your network. -keywords: oms, operations management suite, wdav, health, log analytics -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.localizationpriority: medium -ms.pagetype: deploy -author: jaimeo -ms.author: jaimeo -ms.collection: M365-analytics -ms.topic: article ---- - -# Monitor the health of devices with Device Health - -## Introduction - -Device Health is the newest Windows Analytics solution that complements the existing Upgrade Readiness and Update Compliance solutions by providing IT with reports on some common problems the end users might experience so they can be proactively remediated, thus saving support calls and improving end-user productivity. - -Like Upgrade Readiness and Update Compliance, Device Health is a solution built in Azure Portal, a cloud-based monitoring and automation service that has a flexible servicing subscription based on data usage and retention. This release is free for customers to try and will not incur charges on your Azure Portal workspace for its use. For more information about Azure Portal, see [Windows Analytics in the Azure Portal](windows-analytics-azure-portal.md) . - -Device Health uses Windows diagnostic data that is part of all Windows 10 devices. If you have already employed Upgrade Readiness or Update Compliance solutions, all you need to do is select Device Health from the Azure Portal solution gallery and add it to your Azure Portal workspace. Device Health requires enhanced diagnostic data, so you might need to implement this policy if you've not already done so. - - -Device Health provides the following: - -- Identification of devices that crash frequently, and therefore might need to be rebuilt or replaced -- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes -- Notification of Windows Information Protection misconfigurations that send prompts to end users -- No need for new complex customized infrastructure, thanks to cloud-connected access using Windows 10 diagnostic data - -See the following topics in this guide for detailed information about configuring and using the Device Health solution: - -- [Get started with Device Health](device-health-get-started.md): How to add Device Health to your environment. -- [Using Device Health](device-health-using.md): How to begin using Device Health. - -An overview of the processes used by the Device Health solution is provided below. - -## Device Health licensing - -Use of Windows Analytics Device Health requires one of the following licenses: - -- Windows 10 Enterprise or Windows 10 Education per-device with active Software Assurance -- Windows 10 Enterprise E3 or E5 per-device or per-user subscription (including Microsoft 365 F1, E3, or E5) -- Windows 10 Education A3 or A5 (including Microsoft 365 Education A3 or A5) -- Windows VDA E3 or E5 per-device or per-user subscription - - -You don't have to install Windows 10 Enterprise on a per-device basis--you just need enough of the above licenses for the number of devices using Device Health. - - -## Device Health architecture - -The Device Health architecture and data flow is summarized by the following five-step process: - - - -**(1)** User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
                              -**(2)** Diagnostic data is analyzed by the Microsoft Telemetry Service.
                              -**(3)** Diagnostic data is pushed from the Microsoft Telemetry Service to your Azure Portal workspace.
                              -**(4)** Diagnostic data is available in the Device Health solution.
                              -**(5)** You are now able to proactively monitor Device Health issues in your environment.
                              - -These steps are illustrated in following diagram: - - [![](images/analytics-architecture.png)](images/analytics-architecture.png) - ->[!NOTE] ->This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). - - - -  -## Related topics - -[Get started with Device Health](device-health-get-started.md) - -[Use Device Health to monitor frequency and causes of device crashes](device-health-using.md) - -For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics) diff --git a/windows/deployment/update/device-health-using.md b/windows/deployment/update/device-health-using.md deleted file mode 100644 index e43a16c46f..0000000000 --- a/windows/deployment/update/device-health-using.md +++ /dev/null @@ -1,313 +0,0 @@ ---- -title: Using Device Health -description: Explains how to begin usihg Device Health. -ms.prod: w10 -ms.mktglfcycl: deploy -keywords: oms, operations management suite, wdav, health, log analytics -ms.sitesec: library -ms.pagetype: deploy -author: jaimeo -ms.author: jaimeo -ms.localizationpriority: medium -ms.collection: M365-analytics -ms.topic: article ---- - -# Using Device Health - -This section describes how to use Device Health to monitor devices deployed on your network and troubleshoot the causes if they crash. - - -Device Health provides IT Pros with reports on some common problems that users might experience so that they can be proactively remediated. This decreases support calls and improves productivity. - -Device Health provides the following benefits: - -- Identification of devices that crash frequently and therefore might need to be rebuilt or replaced -- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes -- Notification of Windows Information Protection misconfigurations that send prompts to end users - - ->[!NOTE] ->Information is refreshed daily so that health status can be monitored. Changes will be displayed about 24-48 hours after their occurrence, so you always have a recent snapshot of your devices. - -In Azure Portal, the aspects of a solution's dashboard are usually divided into blades. Blades are a slice of information, typically with a summarization tile and an enumeration of the items that makes up that data. All data is presented through queries. Perspectives are also possible, wherein a given query has a unique view designed to display custom data. The terminology of blades, tiles, and perspectives will be used in the sections that follow. - - -## Device Reliability - -- [Frequently Crashing Devices](#frequently-crashing-devices) -- [Driver-Induced OS Crashes](#driver--induced-OS-crashes) - - - -### Frequently Crashing Devices - -This middle blade in Device Reliability displays the devices that have crashed the most often in the last week. This can help you identify unhealthy devices that might need to be rebuilt or replaced. - -See the following example: - - -![The blade in the middle summarizes devices that crash most often](images/dev-health-main-tile-sterile.png) - -Clicking the header of the Frequently Crashing Devices blade opens a reliability perspective view, where you can filter data (by using filters in the left pane), see trends, and compare to commercial averages: - -![Reliability perspective](images/device-reliability2-sterile.png) - -"Commercial averages" here refers to data collected from deployments with a mix of operating system versions and device models that is similar to yours. If your crash rate is higher, there are opportunities for improvement, for example by moving to newer driver versions. - -Notice the filters in the left pane; they allow you to filter the crash rate shown to a particular operating system version, device model, or other parameter. - ->[!NOTE] ->Use caution when interpreting results filtered by model or operating system version. This is very useful for troubleshooting, but might not be accurate for *comparisons* because the crashes displayed could be of different types. The overall goal for working with crash data is to ensure that most devices have the same driver versions and that the version has a low crash rate. - ->[!TIP] ->Once you've applied a filter (for example setting OSVERSION=1607) you will see the query in the text box change to append the filter (for example, with “(OSVERSION=1607)”). To undo the filter, remove that part of the query in the text box and click the search button to the right of the text box to run the adjusted query.” - - -If you click through a particular device from the view blade or from the Device Reliability perspective, it will take you to the Crash History perspective for that device. - -![Device detail and history](images/device-crash-history2-sterile.png) - -This displays device records sorted by date and crash details by failure ID, also sorted by date. In this view are a number of useful items: - -- Crash history records by date, aggregated by Failure ID. The Failure ID is an internal number that is used to group crashes that are related to each other. Eventually over time, you can use the Failure ID to provide additional info. If a crash was caused by driver, some driver fields will also be populated. - -- StopCode: this is hex value that would be displayed on a bluescreen if you were looking directly at the affected device. - -- Count: the number times that particular Failure ID has occurred on that specific device *on that date*. - - - - -### Driver-Induced OS Crashes - -This blade (on the right) displays drivers that have caused the most devices to crash in the last two weeks. If your crash rate is high, you can reduce the overall operating system crashes in your deployment by upgrading those drivers with a high crash rate. - - -![The blade on the right summarizes devices that crash most often](images/dev-health-main-tile-sterile.png) - -Clicking a listed driver on the Driver-Induced OS Crashes blade opens a driver perspective view, which shows the details for the responsible driver, trends and commercial averages for that driver, and alternative versions of the driver. - -![Driver detail and history](images/driver-detail-1-sterile.png) -![Driver detail and history scrolldown](images/driver-detail-2-sterile.png) - -The driver version table can help you determine whether deploying a newer version of the driver might help you reduce the crash rate. In the example shown above, the most commonly installed driver version (19.15.1.5) has a crash rate of about one-half of one percent--this is low, so this driver is probably fine. However, driver version 19.40.0.3 has a crash rate of almost 20%. If that driver had been widely deployed, updating it would substantially reduce the overal number of crashes in your organization. - - -## App Reliability - -The App Reliability report shows you useful data on app usage and behavior so that you can identify apps that are misbehaving and then take steps to resolve the problem. - -### App reliability events - -The default view includes the **Devices with events** count, which shows the number of devices in your organization that have logged a reliability event for a given app over the last 14 days. A "reliability event" occurs when an app either exits unexpectedly or stops responding. The table also includes a **Devices with Usage** count. This enables you to see how widely used the app was over the same period to put the Devices with Events count into perspective. - -![Main App Reliability view](images/app-reliability-main.png) - -When you click a particular app, the detailed **App reliability** view opens. The first element in the view is the App Information summary: - -![App reliability view with columns for app name, publisher, devices with usage, devices with events, percentage of devices with events logged for that app, and percentage of devices with events as a "commercial average"](images/app-reliability-app-detail.png) - -This table contains: - -- App name -- Publisher -- Devices with usage: the number of unique devices that logged any usage of the app -- Devices with events: the number of unique devices that logged any reliability event for the app -- % with events: the ratio of "devices with events" to "devices with usage" -- % with events (commercial average): the ratio of "devices with events" to "devices with usage" in data collected from deployments with a mix of operating system versions and device models that is similar to yours. This can help you decide if a given app is having problems specifically in your environment or more generally in many environments. - -#### Trend section -Following the App Information summary is the trend section: - -![Trend view](images/app-reliability-trend-view.png) - -With these trend graphs you can more easily detect if an issue is growing, shrinking, or steady. The trend graph on the left shows the number of devices that logged any reliability event for the app. The trend graph on the right shows the ratio of "devices with events" to "devices with usage." - -Each graph displays two lines: - -- Trailing window: in this line, each day’s value reflects reliability events that occurred in the 14 days leading up to that day. This is useful for gauging the long-term trend with reduced volatility due to weekends and small populations. -- Single day: Each day’s value reflects reliability events that occurred in a single day. This is useful if an issue is quickly emerging (or being resolved). - -#### App and OS versions table -The next element in the view is the App and OS versions table: - - -![App/OS version view](images/app-reliability-app-OS-version.png) - -This table breaks out the metrics by combinations of App and OS version. This enables you to identify patterns in that might indicate devices needing an update or configuration change. - -For example, if the table shows that a later version of an app is more reliable than an earlier version in your environment, then prioritizing deployment of the later version is likely the best path forward. If you are already running the latest version of the app, but reliability events are increasing, then you might need to do some troubleshooting, or seek support from Microsoft or the app vendor. - -By default the table is limited to the most-used version combinations in your environment. To see all version combinations click anywhere in the table. - - -#### Reliability event history table - -The next element in the view is the reliability event history table: - -![event history view](images/app-reliability-event-history.png) - -This table shows the most detailed information. Although Device Health is not a debugging tool, the details available in this table can help with troubleshooting by providing the specific devices, versions, and dates of the reliability events. - -This view also includes the **Diagnostic Signature** column. This value can be helpful when you are working with product support or troubleshooting on your own. The value (also known as Failure ID or Failure Name) is the same identifier used to summarize crash statistics for Microsoft and partner developers. - -The Diagnostic Signature value contains the type of reliability event, error code, DLL name, and function name involved. You can use this information to narrow the scope of troubleshooting. For example, a value like *APPLICATION_HANG_ThreadHang_Contoso-Add-In.dll!GetRegistryValue()* implies that the app stopped responding when Contoso-Add-In was trying to read a registry value. In this case you might prioritize updating or disabling the add-in, or using Process Monitor to identify the registry value it was trying to read, which could lead to a resolution through antivirus exclusions, fixing missing keys, or similar remedies. - - -By default the table is limited to a few recent rows. To see all rows click anywhere in the table. - - -### FAQs and limitations - -#### Why does a particular app not appear in the views? -When we allow reliability events from all processes, the list of apps fills with noisy processes which don't feel like meaningful end-user apps (for example, taskhost.exe or odd-test-thing.exe). In order to draw focus to the apps which matter most to users, App Reliability uses a series of filters to limit what appears in the list. The filter criteria include the following: - -- Filter out background processes which have no detected user interaction. -- Filter out operating system processes which, despite having user interaction, do not feel like apps (for example, Logonui.exe, Winlogon.exe). **Known limitation:** Some processes which may feel like apps are not currently detected as such (and are therefore filtered out as OS processes). These include Explorer.exe, Iexplore.exe, Microsoftedge.exe, and several others. -- Remove apps which are not widely used in your environment. **Known limitation:** This might result in an app that you consider important being filtered out when that app is not among the 30 most widely used in your environment. - - -We welcome your suggestions and feedback on this filtering process at the [Device Health Tech Community](https://aka.ms/community/DeviceHealth). - -#### Why are there multiple names and entries for the same app? -For example, you might see *Skype for Business*, *‘skype for business’*, and *Lync* listed separately, but you only use *Skype for Business*. Or you might see *MyApp Pro* and *MyApp Professional* listed separately, even though they feel like the same thing. - -Apps have many elements of metadata which describe them. These include an Add/Remove programs title (“Contoso Suite 12”), executable file names (“ContosoCRM.exe”), executable display name (“Contoso CRM”), and others. App publishers (and in some cases app re-packagers) set these values. For the most part we leave the data as set by the publisher which can lead to some report splitting. In certain cases we apply transformations to reduce splitting, for example we (by design) convert many values to lower case so that incoming data such as "Contoso CRM" and "CONTOSO CRM" become the same app name for reporting. - - - -#### Clicking an app in the App Reliability Events blade sometimes results a List view of records instead of the App Reliability view -To work around this, click the **App Reliability** tab above the results to see the expected view. - -![Click app reliability tab](images/app-reliability-tab.png) - - -#### Clicking "See all…" from the App Reliability Events blade followed by clicking an app from the expanded list results in raw records instead of the App Reliability view -To work around this, replace all of the text in the Log Search query box with the following: - -*DHAppReliability | where AppFileDisplayName == ""* - -For example: - -*DHAppReliability | where AppFileDisplayName == "Microsoft Outlook"* - - - -## Login Health - -Login Health provides reports on Windows login attempts in your environment, including metrics on the login methods being used (such as Windows Hello, face recognition, fingerprint recognition, PIN, or password), the rates and patterns of login success and failure, and the specific reasons logins have failed. - -The Login Health blades appear in the Device Health dashboard: - - -![Main Login health view](images/login-health.png) - -### Login Errors -The **Login errors** blade displays data on the frequency and type of errors, with statistics on specific errors. They are generally categorized into user-generated (caused by bad input) or non-user-generated (might need IT intervention) errors. Click any individual error to see all instances of the error's occurence for the specified time period. - -### Login Metrics by Type -The **Login metrics by type** blade shows the success rate for your devices, as well as the success rate for other environments with a mix of operating system versions and device models similar to yours (the **Commercial average success rate**). - -In the table (by type) you can gauge how broadly each login type is attempted, the number of devices that prefer the type (most used), and the success rate. If migration from passwords to an alternative such as Hello: PIN is going well, you would see high usage and high success rates for the new type. - -Click any of the login types to see detailed login health data for that type: - -![Login type detail](images/login-health-detail.png) - -This view shows trends over time of usage, preferred credentials, and success rate along with the most frequent errors and frequently failing devices for that login type. - -Click a specific login error in this view to see a list of all instances for that error and login type within the specified time range: - -![Login error detail](images/login-health-detail-failure.png) - -Included in this view are device attributes and error attributes such as the following: - -- LogonStatus/LogonSubStatus: Status code for the login attempt -- SignInFailureReason: Known failure reasons evaluated from status or sub-status -- SuggestedSignInRemediation: Suggested remediation that was presented to the user at the time of error - -The filters in the left pane allow you to filter errors to a particular operating system, device model, or other parameters. Alternatively, clicking the most frequently failing models from the Login Health perspective will take you to a list of error instances filtered to the login type and specified device model within the specified time range. - ->[!NOTE] -> Windows Hello: Face authentication errors are not currently included in the login health reports. - - - - -## Windows Information Protection - - -Windows Information Protection (WIP) helps protect work data from accidental sharing. Users might be disrupted if WIP rules are not aligned with real work behavior. WIP App Learning shows which apps on which computers are attempting to cross policy boundaries. - -For details about deploying WIP policies, see [Protect your enterprise data using Windows Information Protection (WIP)](https://docs.microsoft.com/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). - -Once you have WIP policies in place, by using the WIP section of Device Health, you can: - -- Reduce disruptive prompts by adding rules to allow data sharing from approved apps. -- Tune WIP rules, for example by confirming that certain apps are allowed or disallowed by current policy. - - -![Main Windows Information Protection view](images/WIPNEWMAIN-sterile.png) - - -Clicking through the **APP LEARNING** tile shows details of app statistics that you can use to explore each incident and update app policies by using AppLocker or WIP AppIDs. - -![WIP details view](images/WIPNEW1-chart-selected-sterile.png) - -In this chart view, you can click a particular app listing, which will open additional details on the app in question, including details you need to adjust your Windows Information Protection Policy: - -![WIP details view for a specific app](images/WIPappID-sterile.png) - -Here you can copy the WipAppid and use that for adjusting the WIP policy. - -## Data model and built-in extensibility - -All of the views and blades display slices of the most useful data by using pre-formed queries. You have access to the full set of data collected by Device Health, which means you can construct your own queries to expose any data that is of interest to you. For documentation on working with log searches, see [Find data using log searches](https://docs.microsoft.com/azure/log-analytics/log-analytics-log-searches). This topic section provides information about the data types being populated specifically by Device Health. - -### Example queries - -You can run these queries from the Azure Portal **Log Search** interface (available at several points in the Device Health interface) by just typing them in. There are few details to be aware of: - -- After running a query, make sure to set the date range (which appears upper left after running initial query) to "7 days" to ensure you get data back. -- If you see the search tutorial dialog appearing frequently, it's likely because you are have read-only access to the Azure Portal workspace. Ask a workspace administrator to grant you "contributor" permissions (which is required for the "completed tutorial" state to persist). -- If you use the search filters in the left pane, you might notice there is no control to undo a filter selection. To undo a selection, delete the (FilterName="FilterValue") element that is appended to the search query and then click the search button again. For example, after you run a base query of *Type = DHOSReliability KernelModeCrashCount > 0*, a number of filter options appear on the left. If you then filter on **Manufacturer** (for example, by setting *Manufacturer="Microsoft Corporation"* and then clicking **Apply**), the query will change to *Type = DHOSReliability KernelModeCrashCount > 0 (Manufacturer="Microsoft Corporation")*. Delete *(Manufacturer="Microsoft Corporation")* and then click the **search** button again to re-run the query without that filter. - -### Device reliability query examples - -|Data|Query| -|-------------------|------------------------| -|Total devices| Type = DHOSReliability \| measure countdistinct(ComputerID) by Type| -|Number of devices that have crashed in the last three weeks| Type = DHOSReliability KernelModeCrashCount > 0 \| measure countdistinct(ComputerID) by Type| -|Compare the percentage of your devices that have not crashed with the percentage of similar devices outside your organization ("similar" here means other commercial devices with the same mix of device models, operating system versions and update levels).| Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices by Type \| Display Table| -|As above, but sorted by device manufacturer| Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices, countdistinct(ComputerID) as NumberDevices by Manufacturer \| sort NumberDevices desc \| Display Table| -|As above, but sorted by model| Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices, countdistinct(ComputerID) as NumberDevices by ModelFamily\| sort NumberDevices desc \| Display Table| -|As above, but sorted by operating system version| Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices, countdistinct(ComputerID) as NumberDevices by OSVersion \| sort NumberDevices desc \| Display Table| -|Crash rate trending in my organization compared to the commercial average. Each interval shows percentage of devices that crashed at least once in the trailing two weeks| Type=DHOSReliability \| measure avg(map(KernelModeCrashCount, 1, 10000, 0, 1)) as MyOrgPercentCrashFreeDevices, avg(KernelModeCrashFreePercentForIndustry) as CommercialAvgPercentCrashFreeDevices by TimeGenerated \| Display LineChart| -|Table of devices that have crashed the most in the last two weeks| Type = DHOSReliability KernelModeCrashCount > 0 \| Dedup ComputerID \| select Computer, KernelModeCrashCount \| sort TimeGenerated desc, KernelModeCrashCount desc \| Display Table| -|Detailed crash records, most recent first| Type = DHOSCrashData \| sort TimeGenerated desc, Computer asc \| display Table| -|Number of devices that crashed due to drivers| Type = DHDriverReliability DriverKernelModeCrashCount > 0 \| measure countdistinct(ComputerID) by Type| -|Table of drivers that have caused the most devices to crash| Type = DHDriverReliability DriverKernelModeCrashCount > 0 \| measure countdistinct(ComputerID) by DriverName \| Display Table| -|Trend of devices crashed by driver by day| * Type=DHOSCrashData DriverName!="ntkrnlmp.exe" DriverName IN {Type=DHOSCrashData \| measure count() by DriverName | top 5} \| measure countdistinct(ComputerID) as NumberDevices by DriverName interval 1day| -|Crashes for different versions of a given driver (replace netwtw04.sys with the driver you want from the previous list). This lets you get an idea of which *versions* of a given driver work best with your devices| Type = DHDriverReliability DriverName="netwtw04.sys" \| Dedup ComputerID \| sort TimeGenerated desc \| measure countdistinct(ComputerID) as InstallCount, sum(map(DriverKernelModeCrashCount,1,10000, 1)) as DevicesCrashed by DriverVersion \| Display Table| -|Top crashes by FailureID| Type =DHOSCrashData \| measure count() by KernelModeCrashFailureId \| Display Table| - -### Windows Information Protection (WIP) App Learning query examples - -|Data|Query| -|-------------------|------------------------| -|Apps encountering policy boundaries on the most computers (click on an app in the results to see details including computer names)| Type=DHWipAppLearning \| measure countdistinct(ComputerID) as ComputerCount by AppName| -|Trend of App Learning activity for a given app. Useful for tracking activity before and after a rule change| Type=DHWipAppLearning AppName="MICROSOFT.SKYPEAPP" | measure countdistinct(ComputerID) as ComputerCount interval 1day| - -### Exporting data and configuring alerts - -Azure Portal enables you to export data to other tools. To do this, in any view that shows **Log Search** just click the **Export** button. Similarly, clicking the **Alert** button will enable you to run a query automaticlaly on a schedule and receive email alerts for particular query results that you set. If you have a PowerBI account, then you will also see a **PowerBI** button that enables you to run a query on a schedule and have the results automatically saved as a PowerBI data set. - - - - -## Related topics - -[Get started with Device Health](device-health-get-started.md)
                              - -For the latest information on Windows Analytics, including new features and usage tips, see the [Windows Analytics blog](https://blogs.technet.microsoft.com/upgradeanalytics) \ No newline at end of file diff --git a/windows/deployment/update/feature-update-conclusion.md b/windows/deployment/update/feature-update-conclusion.md index 925faca129..5c72afc8c0 100644 --- a/windows/deployment/update/feature-update-conclusion.md +++ b/windows/deployment/update/feature-update-conclusion.md @@ -3,11 +3,13 @@ title: Best practices for feature updates - conclusion description: Final thoughts about how to deploy feature updates ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: lizap +audience: itpro +itproauthor: jaimeo +author: jaimeo ms.localizationpriority: medium -ms.author: elizapo -ms.date: 07/09/2018 +ms.author: jaimeo +ms.reviewer: +manager: laurawi ms.collection: M365-modern-desktop ms.topic: article --- diff --git a/windows/deployment/update/feature-update-maintenance-window.md b/windows/deployment/update/feature-update-maintenance-window.md index 1dd6d6e674..da74aafced 100644 --- a/windows/deployment/update/feature-update-maintenance-window.md +++ b/windows/deployment/update/feature-update-maintenance-window.md @@ -3,11 +3,13 @@ title: Best practices - deploy feature updates during maintenance windows description: Learn how to deploy feature updates during a maintenance window ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: mcureton +audience: itpro +itproauthor: jaimeo +author: jaimeo ms.localizationpriority: medium -ms.author: mikecure -ms.date: 07/09/2018 +ms.author: jaimeo +ms.reviewer: +manager: laurawi ms.collection: M365-modern-desktop ms.topic: article --- @@ -22,13 +24,13 @@ Use the following information to deploy feature updates during a maintenance win ### Step 1: Configure maintenance windows -1. In the Configuration Manager console, choose **Assets and Compliance> Device Collections**. -2. In the **Device Collections** list, select the collection for which you intended to deploy the feature update(s). -3. On the **Home** tab, in the **Properties** group, choose **Properties**. -4. In the **Maintenance Windows** tab of the Properties dialog box, choose the New icon. -5. Complete the Schedule dialog. -6. Select from the Apply this schedule to drop-down list. -7. Choose **OK** and then close the **\ Properties** dialog box. +1. In the Configuration Manager console, choose **Assets and Compliance> Device Collections**. +2. In the **Device Collections** list, select the collection for which you intended to deploy the feature update(s). +3. On the **Home** tab, in the **Properties** group, choose **Properties**. +4. In the **Maintenance Windows** tab of the `` Properties dialog box, choose the New icon. +5. Complete the `` Schedule dialog. +6. Select from the Apply this schedule to drop-down list. +7. Choose **OK** and then close the **\ Properties** dialog box. ### Step 2: Review computer restart device settings @@ -100,7 +102,7 @@ loss of business information, or other pecuniary loss) arising out of the use of or documentation, even if Microsoft has been advised of the possibility of such damages. ``` ->[!NOTE] +>[!NOTE] >If you elect not to override the default setup priority, you will need to increase the [maximum run time](https://docs.microsoft.com/sccm/sum/get-started/manage-settings-for-software-updates#BKMK_SetMaxRunTime) value for Feature Update to Windows 10, version 1709 or higher from the default of 60 minutes. A value of 240 minutes may be required. Remember to ensure that your maintenance window duration is larger than your defined maximum run time value. ## Manually deploy feature updates @@ -110,150 +112,150 @@ The following sections provide the steps to manually deploy a feature update. ### Step 1: Specify search criteria for feature updates There are potentially a thousand or more feature updates displayed in the Configuration Manager console. The first step in the workflow for manually deploying feature updates is to identify the feature updates that you want to deploy. -1. In the Configuration Manager console, click **Software Library**. -2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. The synchronized feature updates are displayed. -3. In the search pane, filter to identify the feature updates that you need by using one or both of the following steps: +1. In the Configuration Manager console, click **Software Library**. +2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. The synchronized feature updates are displayed. +3. In the search pane, filter to identify the feature updates that you need by using one or both of the following steps: - In the search text box, type a search string that will filter the feature updates. For example, type the version number for a specific feature update, or enter a string that would appear in the title of the feature update. - Click **Add Criteria**, select the criteria that you want to use to filter software updates, click **Add**, and then provide the values for the criteria. For example, Title contains 1803, Required is greater than or equal to 1, and Language equals English. -4. Save the search for future use. +4. Save the search for future use. ### Step 2: Download the content for the feature update(s) Before you deploy the feature updates, you can download the content as a separate step. Do this so you can verify that the content is available on the distribution points before you deploy the feature updates. This will help you to avoid any unexpected issues with the content delivery. Use the following procedure to download the content for feature updates before creating the deployment. -1. In the Configuration Manager console, navigate to **Software Library > Windows 10 Servicing**. -2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right click, and select Download. +1. In the Configuration Manager console, navigate to **Software Library > Windows 10 Servicing**. +2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right click, and select Download. The **Download Software Updates Wizard** opens. -3. On the **Deployment Package** page, configure the following settings: +3. On the **Deployment Package** page, configure the following settings: **Create a new deployment package**: Select this setting to create a new deployment package for the software updates that are in the deployment. Configure the following settings: - - **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It is limited to 50 characters. - - **Description**: Specifies the description of the deployment package. The package description provides information about the package contents and is limited to 127 characters. - - **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\server\sharename\path, or click **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page. + - **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It is limited to 50 characters. + - **Description**: Specifies the description of the deployment package. The package description provides information about the package contents and is limited to 127 characters. + - **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\server\sharename\path, or click **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page. - >[!NOTE] + >[!NOTE] >The deployment package source location that you specify cannot be used by another software deployment package. - >[!IMPORTANT] + >[!IMPORTANT] >The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files. - >[!IMPORTANT] + >[!IMPORTANT] >You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location. Click **Next**. -4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then click **Next**. For more information about distribution points, see [Distribution point configurations](https://docs.microsoft.com/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs). +4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then click **Next**. For more information about distribution points, see [Distribution point configurations](https://docs.microsoft.com/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs). >[!NOTE] >The Distribution Points page is available only when you create a new software update deployment package. -5. On the **Distribution Settings** page, specify the following settings: +5. On the **Distribution Settings** page, specify the following settings: - **Distribution priority**: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: High, Medium, or Low. Packages with identical priorities are sent in the order in which they were created. If there is no backlog, the package will process immediately regardless of its priority. By default, packages are sent using Medium priority. - **Enable for on-demand distribution**: Use this setting to enable on-demand content distribution to preferred distribution points. When this setting is enabled, the management point creates a trigger for the distribution manager to distribute the content to all preferred distribution points when a client requests the content for the package and the content is not available on any preferred distribution points. For more information about preferred distribution points and on-demand content, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios). - **Prestaged distribution point settings**: Use this setting to specify how you want to distribute content to prestaged distribution points. Choose one of the following options: - - **Automatically download content when packages are assigned to distribution points**: Use this setting to ignore the prestage settings and distribute content to the distribution point. - - **Download only content changes to the distribution point**: Use this setting to prestage the initial content to the distribution point, and then distribute content changes to the distribution point. - - **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This is the default setting. + - **Automatically download content when packages are assigned to distribution points**: Use this setting to ignore the prestage settings and distribute content to the distribution point. + - **Download only content changes to the distribution point**: Use this setting to prestage the initial content to the distribution point, and then distribute content changes to the distribution point. + - **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This is the default setting. - For more information about prestaging content to distribution points, see [Use Prestaged content](https://docs.microsoft.com/sccm/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage). + For more information about prestaging content to distribution points, see [Use Prestaged content](https://docs.microsoft.com/sccm/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage). Click **Next**. -6. On the **Download Location** page, specify location that Configuration Manager will use to download the software update source files. As needed, use the following options: +6. On the **Download Location** page, specify location that Configuration Manager will use to download the software update source files. As needed, use the following options: - **Download software updates from the Internet**: Select this setting to download the software updates from the location on the Internet. This is the default setting. - **Download software updates from a location on the local network**: Select this setting to download software updates from a local folder or shared network folder. Use this setting when the computer running the wizard does not have Internet access. - >[!NOTE] - >When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard. + >[!NOTE] + >When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard. Click **Next**. -7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then click **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page. -8. On the **Summary** page, verify the settings that you selected in the wizard, and then click Next to download the software updates. -9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click Close. +7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then click **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page. +8. On the **Summary** page, verify the settings that you selected in the wizard, and then click Next to download the software updates. +9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click Close. #### To monitor content status -1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. -2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. -3. Select the feature update package that you previously identified to download the feature updates. -4. On the **Home** tab, in the Content group, click **View Status**. +1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. +2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. +3. Select the feature update package that you previously identified to download the feature updates. +4. On the **Home** tab, in the Content group, click **View Status**. ### Step 3: Deploy the feature update(s) After you determine which feature updates you intend to deploy, you can manually deploy the feature update(s). Use the following procedure to manually deploy the feature update(s). -1. In the Configuration Manager console, click **Software Library**. -2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. -3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Deploy**. +1. In the Configuration Manager console, click **Software Library**. +2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. +3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Deploy**. The **Deploy Software Updates Wizard** opens. -4. On the General page, configure the following settings: +4. On the General page, configure the following settings: - **Name**: Specify the name for the deployment. The deployment must have a unique name that describes the purpose of the deployment and differentiates it from other deployments in the Configuration Manager site. By default, Configuration Manager automatically provides a name for the deployment in the following format: **Microsoft Software Updates - \\** - **Description**: Specify a description for the deployment. The description provides an overview of the deployment and any other relevant information that helps to identify and differentiate the deployment among others in Configuration Manager site. The description field is optional, has a limit of 256 characters, and has a blank value by default. - **Software Update/Software Update Group**: Verify that the displayed software update group, or software update, is correct. - **Select Deployment Template**: Specify whether to apply a previously saved deployment template. You can configure a deployment template to contain multiple common software update deployment properties and then apply the template when you deploy subsequent software updates to ensure consistency across similar deployments and to save time. - **Collection**: Specify the collection for the deployment, as applicable. Members of the collection receive the feature updates that are defined in the deployment. -5. On the Deployment Settings page, configure the following settings: +5. On the Deployment Settings page, configure the following settings: - **Type of deployment**: Specify the deployment type for the software update deployment. Select **Required** to create a mandatory software update deployment in which the feature updates are automatically installed on clients before a configured installation deadline. - >[!IMPORTANT] - > After you create the software update deployment, you cannot later change the type of deployment. + >[!IMPORTANT] + > After you create the software update deployment, you cannot later change the type of deployment. - >[!NOTE] - >A software update group deployed as Required will be downloaded in background and honor BITS settings, if configured. + >[!NOTE] + >A software update group deployed as Required will be downloaded in background and honor BITS settings, if configured. - **Use Wake-on-LAN to wake up clients for required deployments**: Specify whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more software updates in the deployment. Any computers that are in sleep mode at the installation deadline time will be awakened so the software update installation can initiate. Clients that are in sleep mode that do not require any software updates in the deployment are not started. By default, this setting is not enabled and is available only when Type of deployment is set to Required. - >[!WARNING] - >Before you can use this option, computers and networks must be configured for Wake On LAN. + >[!WARNING] + >Before you can use this option, computers and networks must be configured for Wake On LAN. - **Detail level**: Specify the level of detail for the state messages that are reported by client computers. -6. On the Scheduling page, configure the following settings: +6. On the Scheduling page, configure the following settings: - **Schedule evaluation**: Specify whether the available time and installation deadline times are evaluated according to UTC or the local time of the computer running the Configuration Manager console. - >[!NOTE] - >When you select local time, and then select **As soon as possible** for the **Software available time** or **Installation deadline**, the current time on the computer running the Configuration Manager console is used to evaluate when updates are available or when they are installed on a client. If the client is in a different time zone, these actions will occur when the client's time reaches the evaluation time. + >[!NOTE] + >When you select local time, and then select **As soon as possible** for the **Software available time** or **Installation deadline**, the current time on the computer running the Configuration Manager console is used to evaluate when updates are available or when they are installed on a client. If the client is in a different time zone, these actions will occur when the client's time reaches the evaluation time. - **Software available time**: Select **As soon as possible** to specify when the software updates will be available to clients: - - **As soon as possible**: Select this setting to make the software updates in the deployment available to clients as soon as possible. When the deployment is created, the client policy is updated, the clients are made aware of the deployment at their next client policy polling cycle, and then the software updates are available for installation. + - **As soon as possible**: Select this setting to make the software updates in the deployment available to clients as soon as possible. When the deployment is created, the client policy is updated, the clients are made aware of the deployment at their next client policy polling cycle, and then the software updates are available for installation. - **Installation deadline**: Select **Specific time** to specify the installation deadline for the software updates in the deployment. - >[!NOTE] - >You can configure the installation deadline setting only when **Type of deployment** is set to **Required** on the Deployment Settings page. + >[!NOTE] + >You can configure the installation deadline setting only when **Type of deployment** is set to **Required** on the Deployment Settings page. - **Specific time**: Select this setting to automatically install the software updates in the deployment at a specific date and time. Set the date and time value to correspond with your defined maintenance window for the target collection. Allow sufficient time for clients to download the content in advance of the deadline. Adjust accordingly if clients in your environment will need additional download time. E.g., slow or unreliable network links. - >[!NOTE] + >[!NOTE] >The actual installation deadline time is the specific time that you configure plus a random amount of time up to 2 hours. This reduces the potential impact of all client computers in the destination collection installing the software updates in the deployment at the same time. Configure the Computer Agent client setting, Disable deadline randomization to disable the installation randomization delay for the required software updates to allow a greater chance for the installation to start and complete within your defined maintenance window. For more information, see [Computer Agent](https://docs.microsoft.com/sccm/core/clients/deploy/about-client-settings#computer-agent). -7. On the User Experience page, configure the following settings: +7. On the User Experience page, configure the following settings: - **User notifications**: Specify whether to display notification of the software updates in Software Center on the client computer at the configured **Software available time** and whether to display user notifications on the client computers. When **Type of deployment** is set to **Available** on the Deployment Settings page, you cannot select **Hide in Software Center and all notifications**. - **Deadline behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify the behavior that is to occur when the deadline is reached for the software update deployment. Specify whether to install the software updates in the deployment. Also specify whether to perform a system restart after software update installation regardless of a configured maintenance window. For more information about maintenance windows, see [How to use maintenance windows](https://docs.microsoft.com/sccm/core/clients/manage/collections/use-maintenance-windows). - **Device restart behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify whether to suppress a system restart on servers and workstations after software updates are installed and a system restart is required to complete the installation. - >[!IMPORTANT] - >Suppressing system restarts can be useful in server environments or for cases in which you do not want the computers that are installing the software updates to restart by default. However, doing so can leave computers in an insecure state, whereas allowing a forced restart helps to ensure immediate completion of the software update installation. + >[!IMPORTANT] + >Suppressing system restarts can be useful in server environments or for cases in which you do not want the computers that are installing the software updates to restart by default. However, doing so can leave computers in an insecure state, whereas allowing a forced restart helps to ensure immediate completion of the software update installation. - **Write filter handling for Windows Embedded devices**: When you deploy software updates to Windows Embedded devices that are write filter enabled, you can specify to install the software update on the temporary overlay and either commit changes later or commit the changes at the installation deadline or during a maintenance window. When you commit changes at the installation deadline or during a maintenance window, a restart is required and the changes persist on the device. - >[!NOTE] - >When you deploy a software update to a Windows Embedded device, make sure that the device is a member of a collection that has a configured maintenance window. + >[!NOTE] + >When you deploy a software update to a Windows Embedded device, make sure that the device is a member of a collection that has a configured maintenance window. - **Software updates deployment re-evaluation behavior upon restart**: Starting in Configuration Manager version 1606, select this setting to configure software updates deployments to have clients run a software updates compliance scan immediately after a client installs software updates and restarts. This enables the client to check for additional software updates that become applicable after the client restarts, and to then install them (and become compliant) during the same maintenance window. -8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager will generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page. +8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager will generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page. >[!NOTE] >You can review recent software updates alerts from the Software Updates node in the Software Library workspace. -9. On the Download Settings page, configure the following settings: +9. On the Download Settings page, configure the following settings: - Specify whether the client will download and install the software updates when a client is connected to a slow network or is using a fallback content location. - Specify whether to have the client download and install the software updates from a fallback distribution point when the content for the software updates is not available on a preferred distribution point. - **Allow clients to share content with other clients on the same subnet**: Specify whether to enable the use of BranchCache for content downloads. For more information about BranchCache, see [Fundamental concepts for content management](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/fundamental-concepts-for-content-management#branchcache). - **If software updates are not available on distribution point in current, neighbor or site groups, download content from Microsoft Updates**: Select this setting to have clients that are connected to the intranet download software updates from Microsoft Update if software updates are not available on distribution points. Internet-based clients can always go to Microsoft Update for software updates content. - Specify whether to allow clients to download after an installation deadline when they use metered Internet connections. Internet providers sometimes charge by the amount of data that you send and receive when you are on a metered Internet connection. - >[!NOTE] - >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios). -10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. -11. Click **Next** to deploy the feature update(s). + >[!NOTE] + >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios). +10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. +11. Click **Next** to deploy the feature update(s). ### Step 4: Monitor the deployment status After you deploy the feature update(s), you can monitor the deployment status. Use the following procedure to monitor the deployment status: -1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. -2. Click the software update group or software update for which you want to monitor the deployment status. -3. On the **Home** tab, in the **Deployment** group, click **View Status**. +1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. +2. Click the software update group or software update for which you want to monitor the deployment status. +3. On the **Home** tab, in the **Deployment** group, click **View Status**. diff --git a/windows/deployment/update/feature-update-mission-critical.md b/windows/deployment/update/feature-update-mission-critical.md index eb6c6695aa..7e35245a09 100644 --- a/windows/deployment/update/feature-update-mission-critical.md +++ b/windows/deployment/update/feature-update-mission-critical.md @@ -3,11 +3,14 @@ title: Best practices and recommendations for deploying Windows 10 Feature updat description: Learn how to deploy feature updates to your mission critical devices ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: mcureton +audience: itpro +itproauthor: jaimeo +author: jaimeo ms.localizationpriority: medium -ms.author: mikecure +ms.author: jaimeo ms.date: 07/10/2018 +ms.reviewer: +manager: laurawi ms.collection: M365-modern-desktop ms.topic: article --- @@ -16,7 +19,7 @@ ms.topic: article **Applies to**: Windows 10 -Managing an environment with devices that provide mission critical services 24 hours a day, 7 days a week, can present challenges in keeping these devices current with Windows 10 feature updates. The processes that you use to keep regular devices current with Windows 10 feature updates, often aren’t the most effective to service mission critical devices. This whitepaper will focus on the recommended approach of using the System Center Configuration Manager (current branch) software updates feature to deploy Windows 10 semi-annual feature updates. +Managing an environment with devices that provide mission critical services 24 hours a day, 7 days a week, can present challenges in keeping these devices current with Windows 10 feature updates. The processes that you use to keep regular devices current with Windows 10 feature updates, often aren’t the most effective to service mission critical devices. This whitepaper will focus on the recommended approach of using the Microsoft Endpoint Configuration Manager (current branch) software updates feature to deploy Windows 10 semi-annual feature updates. For simplicity, we will outline the steps to deploy a feature update manually. If you prefer an automated approach, please see [Using Windows 10 servicing plans to deploy Windows 10 feature updates](waas-manage-updates-configuration-manager.md#use-windows-10-servicing-plans-to-deploy-windows-10-feature-updates). @@ -27,7 +30,7 @@ Devices and shared workstations that are online and available 24 hours a day, 7 You can use Configuration Manager to deploy feature updates to Windows 10 devices in two ways. The first option is to use the software updates feature. The second option is to use a task sequence to deploy feature updates. There are times when deploying a Windows 10 feature update requires the use of a task sequence—for example: -- **LTSC feature updates.** With the LTSC servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade. +- **Upgrade to the next LTSC release.** With the LTSC servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade. - **Additional required tasks.** When deploying a feature update requires additional steps (e.g., suspending disk encryption, updating applications), you can use task sequences to orchestrate the additional steps. Software updates do not have the ability to add steps to their deployments. - **Language pack installs.** When deploying a feature update requires the installation of additional language packs, you can use task sequences to orchestrate the installation. Software updates do not have the ability to natively install language packs. @@ -38,4 +41,4 @@ Use the following information: - [Deploy feature updates during maintenance windows](feature-update-maintenance-window.md) - [Deploy feature updates for user-initiated installations](feature-update-user-install.md) -- [Conclusion](feature-update-conclusion.md) \ No newline at end of file +- [Conclusion](feature-update-conclusion.md) diff --git a/windows/deployment/update/feature-update-user-install.md b/windows/deployment/update/feature-update-user-install.md index 88f1e895d2..e22be01edd 100644 --- a/windows/deployment/update/feature-update-user-install.md +++ b/windows/deployment/update/feature-update-user-install.md @@ -3,11 +3,13 @@ title: Best practices - deploy feature updates for user-initiated installations description: Learn how to manually deploy feature updates ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: mcureton +audience: itpro +author: jaimeo ms.localizationpriority: medium -ms.author: mikecure +ms.author: jaimeo ms.date: 07/10/2018 +ms.reviewer: +manager: laurawi ms.collection: M365-modern-desktop ms.topic: article --- @@ -67,6 +69,7 @@ foreach ($k in $iniSetupConfigKeyValuePair.Keys) #Write content to file New-Item $iniFilePath -ItemType File -Value $iniSetupConfigContent -Force +<# Disclaimer Sample scripts are not supported under any Microsoft standard support program or service. The sample scripts is provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without @@ -76,9 +79,10 @@ Microsoft, its authors, or anyone else involved in the creation, production, or for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample script or documentation, even if Microsoft has been advised of the possibility of such damages. +#> ``` ->[!NOTE] +>[!NOTE] >If you elect not to override the default setup priority, you will need to increase the [maximum run time](https://docs.microsoft.com/sccm/sum/get-started/manage-settings-for-software-updates#BKMK_SetMaxRunTime) value for Feature Update to Windows 10, version 1709 or higher from the default of 60 minutes. A value of 240 minutes may be required. Remember to ensure that your maintenance window duration is larger than your defined maximum run time value. ## Manually deploy feature updates in a user-initiated installation @@ -88,150 +92,150 @@ The following sections provide the steps to manually deploy a feature update. ### Step 1: Specify search criteria for feature updates There are potentially a thousand or more feature updates displayed in the Configuration Manager console. The first step in the workflow for manually deploying a feature update is to identify the feature updates that you want to deploy. -1. In the Configuration Manager console, click **Software Library**. -2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. The synchronized feature updates are displayed. -3. In the search pane, filter to identify the feature updates that you need by using one or both of the following steps: +1. In the Configuration Manager console, click **Software Library**. +2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. The synchronized feature updates are displayed. +3. In the search pane, filter to identify the feature updates that you need by using one or both of the following steps: - In the **search** text box, type a search string that will filter the feature updates. For example, type the version number for a specific feature update, or enter a string that would appear in the title of the feature update. - Click **Add Criteria**, select the criteria that you want to use to filter software updates, click **Add**, and then provide the values for the criteria. For example, Title contains 1803, **Required** is greater than or equal to 1, and **Language** equals English. -4. Save the search for future use. +4. Save the search for future use. ### Step 2: Download the content for the feature update(s) Before you deploy the feature updates, you can download the content as a separate step. Do this so you can verify that the content is available on the distribution points before you deploy the feature updates. This will help you to avoid any unexpected issues with the content delivery. Use the following procedure to download the content for feature updates before creating the deployment. -1. In the Configuration Manager console, navigate to **Software Library > Windows 10 Servicing**. -2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Download**. +1. In the Configuration Manager console, navigate to **Software Library > Windows 10 Servicing**. +2. Choose the feature update(s) to download by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Download**. The **Download Software Updates Wizard** opens. -3. On the **Deployment Package** page, configure the following settings: +3. On the **Deployment Package** page, configure the following settings: **Create a new deployment package**: Select this setting to create a new deployment package for the software updates that are in the deployment. Configure the following settings: - - **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It is limited to 50 characters. - - **Description**: Specifies the description of the deployment package. The package description provides information about the package contents and is limited to 127 characters. - - **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\\server\sharename\path, or click **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page. + - **Name**: Specifies the name of the deployment package. The package must have a unique name that briefly describes the package content. It is limited to 50 characters. + - **Description**: Specifies the description of the deployment package. The package description provides information about the package contents and is limited to 127 characters. + - **Package source**: Specifies the location of the feature update source files. Type a network path for the source location, for example, \\\server\sharename\path, or click **Browse** to find the network location. You must create the shared folder for the deployment package source files before you proceed to the next page. - >[!NOTE] - >The deployment package source location that you specify cannot be used by another software deployment package. + >[!NOTE] + >The deployment package source location that you specify cannot be used by another software deployment package. - >[!IMPORTANT] - >The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files. + >[!IMPORTANT] + >The SMS Provider computer account and the user that is running the wizard to download the feature updates must both have Write NTFS permissions on the download location. You should carefully restrict access to the download location to reduce the risk of attackers tampering with the feature update source files. - >[!IMPORTANT] - >You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location. + >[!IMPORTANT] + >You can change the package source location in the deployment package properties after Configuration Manager creates the deployment package. But if you do so, you must first copy the content from the original package source to the new package source location. Click **Next**. -4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then click **Next**. For more information about distribution points, see [Distribution point configurations](https://docs.microsoft.com/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs). +4. On the **Distribution Points** page, specify the distribution points or distribution point groups that will host the feature update files, and then click **Next**. For more information about distribution points, see [Distribution point configurations](https://docs.microsoft.com/sccm/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_configs). >[!NOTE] >The Distribution Points page is available only when you create a new software update deployment package. -5. On the **Distribution Settings** page, specify the following settings: +5. On the **Distribution Settings** page, specify the following settings: - **Distribution priority**: Use this setting to specify the distribution priority for the deployment package. The distribution priority applies when the deployment package is sent to distribution points at child sites. Deployment packages are sent in priority order: **High**, **Medium**, or **Low**. Packages with identical priorities are sent in the order in which they were created. If there is no backlog, the package will process immediately regardless of its priority. By default, packages are sent using Medium priority. - **Enable for on-demand distribution**: Use this setting to enable on-demand content distribution to preferred distribution points. When this setting is enabled, the management point creates a trigger for the distribution manager to distribute the content to all preferred distribution points when a client requests the content for the package and the content is not available on any preferred distribution points. For more information about preferred distribution points and on-demand content, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios). - **Prestaged distribution point settings**: Use this setting to specify how you want to distribute content to prestaged distribution points. Choose one of the following options: - - **Automatically download content when packages are assigned to distribution points**: Use this setting to ignore the prestage settings and distribute content to the distribution point. - - **Download only content changes to the distribution point**: Use this setting to prestage the initial content to the distribution point, and then distribute content changes to the distribution point. - - **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This is the default setting. + - **Automatically download content when packages are assigned to distribution points**: Use this setting to ignore the prestage settings and distribute content to the distribution point. + - **Download only content changes to the distribution point**: Use this setting to prestage the initial content to the distribution point, and then distribute content changes to the distribution point. + - **Manually copy the content in this package to the distribution point**: Use this setting to always prestage content on the distribution point. This is the default setting. - For more information about prestaging content to distribution points, see [Use Prestaged content](https://docs.microsoft.com/sccm/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage). + For more information about prestaging content to distribution points, see [Use Prestaged content](https://docs.microsoft.com/sccm/core/servers/deploy/configure/deploy-and-manage-content#bkmk_prestage). Click **Next**. -6. On the **Download Location** page, specify location that Configuration Manager will use to download the software update source files. As needed, use the following options: +6. On the **Download Location** page, specify location that Configuration Manager will use to download the software update source files. As needed, use the following options: - **Download software updates from the Internet**: Select this setting to download the software updates from the location on the Internet. This is the default setting. - **Download software updates from a location on the local network**: Select this setting to download software updates from a local folder or shared network folder. Use this setting when the computer running the wizard does not have Internet access. - >[!NOTE] - >When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard. + >[!NOTE] + >When you use this setting, download the software updates from any computer with Internet access, and then copy the software updates to a location on the local network that is accessible from the computer running the wizard. Click **Next**. -7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then click **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page. -8. On the **Summary** page, verify the settings that you selected in the wizard, and then click Next to download the software updates. -9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click **Close**. +7. On the **Language Selection** page, specify the languages for which the selected feature updates are to be downloaded, and then click **Next**. Ensure that your language selection matches the language(s) of the feature updates selected for download. For example, if you selected English and German based feature updates for download, select those same languages on the language selection page. +8. On the **Summary** page, verify the settings that you selected in the wizard, and then click Next to download the software updates. +9. On the **Completion** page, verify that the software updates were successfully downloaded, and then click **Close**. #### To monitor content status -1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. -2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. -3. Select the feature update package that you previously identified to download the feature updates. -4. On the **Home** tab, in the Content group, click **View Status**. +1. To monitor the content status for the feature updates, click **Monitoring** in the Configuration Manager console. +2. In the Monitoring workspace, expand **Distribution Status**, and then click **Content Status**. +3. Select the feature update package that you previously identified to download the feature updates. +4. On the **Home** tab, in the Content group, click **View Status**. ### Step 3: Deploy the feature update(s) After you determine which feature updates you intend to deploy, you can manually deploy the feature update(s). Use the following procedure to manually deploy the feature update(s). -1. In the Configuration Manager console, click **Software Library**. -2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. -3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Deploy**. +1. In the Configuration Manager console, click **Software Library**. +2. In the Software Library workspace, expand **Windows 10 Servicing**, and click **All Windows 10 Updates**. +3. Choose the feature update(s) to deploy by using your saved search criteria. Select one or more of the feature updates returned, right click, and select **Deploy**. The **Deploy Software Updates Wizard** opens. -4. On the General page, configure the following settings: +4. On the General page, configure the following settings: - **Name**: Specify the name for the deployment. The deployment must have a unique name that describes the purpose of the deployment and differentiates it from other deployments in the Configuration Manager site. By default, Configuration Manager automatically provides a name for the deployment in the following format: **Microsoft Software Updates - \\** - **Description**: Specify a description for the deployment. The description provides an overview of the deployment and any other relevant information that helps to identify and differentiate the deployment among others in Configuration Manager site. The description field is optional, has a limit of 256 characters, and has a blank value by default. - **Software Update/Software Update Group**: Verify that the displayed software update group, or software update, is correct. - **Select Deployment Template**: Specify whether to apply a previously saved deployment template. You can configure a deployment template to contain multiple common software update deployment properties and then apply the template when you deploy subsequent software updates to ensure consistency across similar deployments and to save time. - **Collection**: Specify the collection for the deployment, as applicable. Members of the collection receive the feature updates that are defined in the deployment. -5. On the Deployment Settings page, configure the following settings: +5. On the Deployment Settings page, configure the following settings: - **Type of deployment**: Specify the deployment type for the software update deployment. Select **Required** to create a mandatory software update deployment in which the feature updates are automatically installed on clients before a configured installation deadline. - >[!IMPORTANT] - > After you create the software update deployment, you cannot later change the type of deployment. + >[!IMPORTANT] + > After you create the software update deployment, you cannot later change the type of deployment. - >[!NOTE] - >A software update group deployed as **Required** will be downloaded in background and honor BITS settings, if configured. + >[!NOTE] + >A software update group deployed as **Required** will be downloaded in background and honor BITS settings, if configured. - **Use Wake-on-LAN to wake up clients for required deployments**: Specify whether to enable Wake On LAN at the deadline to send wake-up packets to computers that require one or more software updates in the deployment. Any computers that are in sleep mode at the installation deadline time will be awakened so the software update installation can initiate. Clients that are in sleep mode that do not require any software updates in the deployment are not started. By default, this setting is not enabled and is available only when **Type of deployment** is set to **Required**. - >[!WARNING] - >Before you can use this option, computers and networks must be configured for Wake On LAN. + >[!WARNING] + >Before you can use this option, computers and networks must be configured for Wake On LAN. - **Detail level**: Specify the level of detail for the state messages that are reported by client computers. -6. On the Scheduling page, configure the following settings: +6. On the Scheduling page, configure the following settings: - **Schedule evaluation**: Specify whether the available time and installation deadline times are evaluated according to UTC or the local time of the computer running the Configuration Manager console. - **Software available time**: Select **Specific time** to specify when the software updates will be available to clients: - - **Specific time**: Select this setting to make the feature update in the deployment available to clients at a specific date and time. Specify a date and time that corresponds with the start of your fixed servicing window. When the deployment is created, the client policy is updated and clients are made aware of the deployment at their next client policy polling cycle. However, the feature update in the deployment is not available for installation until after the specified date and time are reached and the required content has been downloaded. + - **Specific time**: Select this setting to make the feature update in the deployment available to clients at a specific date and time. Specify a date and time that corresponds with the start of your fixed servicing window. When the deployment is created, the client policy is updated and clients are made aware of the deployment at their next client policy polling cycle. However, the feature update in the deployment is not available for installation until after the specified date and time are reached and the required content has been downloaded. - **Installation deadline**: Select **Specific time** to specify the installation deadline for the software updates in the deployment. - >[!NOTE] - >You can configure the installation deadline setting only when **Type of deployment** is set to **Required** on the Deployment Settings page. + >[!NOTE] + >You can configure the installation deadline setting only when **Type of deployment** is set to **Required** on the Deployment Settings page. - - **Specific time**: Select this setting to automatically install the software updates in the deployment at a specific date and time. However, for the purposes of the fixed servicing window, set the installation deadline date and time to a future value, well beyond the fixed servicing window. + - **Specific time**: Select this setting to automatically install the software updates in the deployment at a specific date and time. However, for the purposes of the fixed servicing window, set the installation deadline date and time to a future value, well beyond the fixed servicing window. - Required deployments for software updates can benefit from functionality called advanced download. When the software available time is reached, clients will start downloading the content based on a randomized time. The feature update will not be displayed in Software Center for installation until the content is fully downloaded. This ensures that the feature update installation will start immediately when initiated. + Required deployments for software updates can benefit from functionality called advanced download. When the software available time is reached, clients will start downloading the content based on a randomized time. The feature update will not be displayed in Software Center for installation until the content is fully downloaded. This ensures that the feature update installation will start immediately when initiated. -7. On the User Experience page, configure the following settings: +7. On the User Experience page, configure the following settings: - **User notifications**: Specify **Display in Software Center and show all notifications**. - **Deadline behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify the behavior that is to occur when the deadline is reached for the software update deployment. Specify whether to install the software updates in the deployment. Also specify whether to perform a system restart after software update installation regardless of a configured maintenance window. - >[!NOTE] - >Remember that the installation deadline date and time will be well into the future to allow plenty of time for the user-initiated install during a fixed servicing window. + >[!NOTE] + >Remember that the installation deadline date and time will be well into the future to allow plenty of time for the user-initiated install during a fixed servicing window. - **Device restart behavior**: Available only when **Type of deployment** is set to **Required** on the Deployment Settings page. Specify whether to suppress a system restart on servers and workstations after software updates are installed and a system restart is required to complete the installation. - >[!IMPORTANT] - >Suppressing system restarts can be useful in server environments or for cases in which you do not want the computers that are installing the software updates to restart by default. However, doing so can leave computers in an insecure state, whereas allowing a forced restart helps to ensure immediate completion of the software update installation. + >[!IMPORTANT] + >Suppressing system restarts can be useful in server environments or for cases in which you do not want the computers that are installing the software updates to restart by default. However, doing so can leave computers in an insecure state, whereas allowing a forced restart helps to ensure immediate completion of the software update installation. - **Write filter handling for Windows Embedded devices**: When you deploy software updates to Windows Embedded devices that are write filter enabled, you can specify to install the software update on the temporary overlay and either commit changes later or commit the changes at the installation deadline or during a maintenance window. When you commit changes at the installation deadline or during a maintenance window, a restart is required and the changes persist on the device. - >[!NOTE] - >When you deploy a software update to a Windows Embedded device, make sure that the device is a member of a collection that has a configured maintenance window. + >[!NOTE] + >When you deploy a software update to a Windows Embedded device, make sure that the device is a member of a collection that has a configured maintenance window. - **Software updates deployment re-evaluation behavior upon restart**: Starting in Configuration Manager version 1606, select this setting to configure software updates deployments to have clients run a software updates compliance scan immediately after a client installs software updates and restarts. This enables the client to check for additional software updates that become applicable after the client restarts, and to then install them (and become compliant) during the same maintenance window. -8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager will generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page. +8. On the Alerts page, configure how Configuration Manager and System Center Operations Manager will generate alerts for this deployment. You can configure alerts only when **Type of deployment** is set to **Required** on the Deployment Settings page. >[!NOTE] >You can review recent software updates alerts from the **Software Updates** node in the **Software Library** workspace. -9. On the Download Settings page, configure the following settings: +9. On the Download Settings page, configure the following settings: - Specify whether the client will download and install the software updates when a client is connected to a slow network or is using a fallback content location. - Specify whether to have the client download and install the software updates from a fallback distribution point when the content for the software updates is not available on a preferred distribution point. - **Allow clients to share content with other clients on the same subnet**: Specify whether to enable the use of BranchCache for content downloads. For more information about BranchCache, see [Fundamental concepts for content management](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/fundamental-concepts-for-content-management#branchcache). - **If software updates are not available on distribution point in current, neighbor or site groups, download content from Microsoft Updates**: Select this setting to have clients that are connected to the intranet download software updates from Microsoft Update if software updates are not available on distribution points. Internet-based clients can always go to Microsoft Update for software updates content. - Specify whether to allow clients to download after an installation deadline when they use metered Internet connections. Internet providers sometimes charge by the amount of data that you send and receive when you are on a metered Internet connection. - >[!NOTE] - >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios). -10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. -11. Click **Next** to deploy the feature update(s). + >[!NOTE] + >Clients request the content location from a management point for the software updates in a deployment. The download behavior depends upon how you have configured the distribution point, the deployment package, and the settings on this page. For more information, see [Content source location scenarios](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/content-source-location-scenarios). +10. On the Summary page, review the settings. To save the settings to a deployment template, click **Save As Template**, enter a name and select the settings that you want to include in the template, and then click **Save**. To change a configured setting, click the associated wizard page and change the setting. +11. Click **Next** to deploy the feature update(s). ### Step 4: Monitor the deployment status After you deploy the feature update(s), you can monitor the deployment status. Use the following procedure to monitor the deployment status: -1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. -2. Click the software update group or software update for which you want to monitor the deployment status. -3. On the **Home** tab, in the **Deployment** group, click **View Status**. \ No newline at end of file +1. In the Configuration Manager console, navigate to **Monitoring > Overview > Deployments**. +2. Click the software update group or software update for which you want to monitor the deployment status. +3. On the **Home** tab, in the **Deployment** group, click **View Status**. diff --git a/windows/deployment/update/fod-and-lang-packs.md b/windows/deployment/update/fod-and-lang-packs.md index a87578d48a..9dbe7740b3 100644 --- a/windows/deployment/update/fod-and-lang-packs.md +++ b/windows/deployment/update/fod-and-lang-packs.md @@ -1,24 +1,31 @@ ---- -title: Windows 10 - How to make FoD and language packs available when you're using WSUS/SCCM -description: Learn how to make FoD and language packs available when you're using WSUS/SCCM -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: article -ms.author: elizapo -author: lizap -ms.localizationpriority: medium -ms.date: 03/13/2019 -ms.topic: article ---- -# How to make Features on Demand and language packs available when you're using WSUS/SCCM - -> Applies to: Windows 10 - -As of Windows 10 version 1709, you cannot use Windows Server Update Services (WSUS) to host [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FOD) and language packs for Windows 10 clients locally. Instead, you can enforce a Group Policy setting that tells the clients to pull them directly from Windows Update. You can also host FOD and language packs on a network share, but starting with Windows 10 version 1809, FOD and language packs can only be installed from Windows Update. - -For Windows domain environments running WSUS or SCCM, change the **Specify settings for optional component installation and component repair** policy to enable downloading FOD and language packs from Windows Update. This setting is located in `Computer Configuration\Administrative Templates\System` in the Group Policy Editor. - -Changing this policy does not affect how other updates are distributed. They continue to come from WSUS or SCCM as you have scheduled them. - -Learn about other client management options, including using Group Policy and administrative templates, in [Manage clients in Windows 10](https://docs.microsoft.com/windows/client-management/). +--- +title: Windows 10 - How to make FoD and language packs available when you're using WSUS/SCCM +description: Learn how to make FoD and language packs available when you're using WSUS/SCCM +ms.prod: w10 +ms.mktglfcycl: manage + +ms.pagetype: article +ms.author: jaimeo +audience: itpro +author: jaimeo +ms.localizationpriority: medium +ms.date: 03/13/2019 +ms.reviewer: +manager: laurawi +ms.topic: article +--- +# How to make Features on Demand and language packs available when you're using WSUS/SCCM + +> Applies to: Windows 10 + +As of Windows 10 version 1709, you can't use Windows Server Update Services (WSUS) to host [Features on Demand](https://docs.microsoft.com/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (FODs) locally. Starting with Windows 10 version 1803, language packs can no longer be hosted on WSUS. + +The **Specify settings for optional component installation and component repair** policy, located under `Computer Configuration\Administrative Templates\System` in the Group Policy Editor, can be used to specify alternate ways to acquire FOD packages, language packages, and content for corruption repair. However, it’s important to note this policy only allows specifying one alternate location and behaves differently across OS versions. + +In Windows 10 version 1709 and 1803, changing the **Specify settings for optional component installation and component repair** policy to download content from Windows Update enables acquisition of FOD packages while also enabling corruption repair. Specifying a network location works for either, depending on the content is found at that location. Changing this policy on these OS versions does not influence how language packs are acquired. + +In Windows 10 version 1809 and beyond, changing the **Specify settings for optional component installation and component repair** policy also influences how language packs are acquired, however language packs can only be acquired directly from Windows Update. It’s currently not possible to acquire them from a network share. Specifying a network location works for FOD packages or corruption repair, depending on the content at that location. + +For all OS versions, changing the **Specify settings for optional component installation and component repair** policy does not affect how OS updates are distributed. They continue to come from WSUS or SCCM or other sources as you have scheduled them, even while optional content is sourced from Windows Update or a network location. + +Learn about other client management options, including using Group Policy and administrative templates, in [Manage clients in Windows 10](https://docs.microsoft.com/windows/client-management/). diff --git a/windows/deployment/update/how-windows-update-works.md b/windows/deployment/update/how-windows-update-works.md index 72ac510693..ac597ae387 100644 --- a/windows/deployment/update/how-windows-update-works.md +++ b/windows/deployment/update/how-windows-update-works.md @@ -1,20 +1,22 @@ --- title: How Windows Update works -description: Learn how Windows Update works, including architecture and troubleshooting +description: Learn how Windows Update works, including architecture and troubleshooting. ms.prod: w10 ms.mktglfcycl: -ms.sitesec: library -author: kaushika-msft +audience: itpro +itproauthor: jaimeo +author: jaimeo ms.localizationpriority: medium -ms.author: elizapo -ms.date: 09/18/2018 +ms.author: jaimeo +ms.reviewer: +manager: laurawi ms.collection: M365-modern-desktop ms.topic: article --- # How does Windows Update work? ->Applies to: Windows 10 +> Applies to: Windows 10 The Windows Update workflow has four core areas of functionality: @@ -33,7 +35,7 @@ The Windows Update workflow has four core areas of functionality: ### Install -1. Orchestrator initates the installation. +1. Orchestrator initiates the installation. 2. The arbiter calls the installer to install the package. @@ -94,8 +96,8 @@ When users start scanning in Windows Update through the Settings panel, the foll ![Windows Update scan log 2](images/update-scan-log-2.png) - Common service IDs - >[!IMPORTANT] - >ServiceId here identifies a client abstraction, not any specific service in the cloud. No assumption should be made of which server a serviceId is pointing to, it's totally controlled by the SLS responses. + > [!IMPORTANT] + > ServiceId here identifies a client abstraction, not any specific service in the cloud. No assumption should be made of which server a serviceId is pointing to, it's totally controlled by the SLS responses. |Service|ServiceId| |-------|---------| @@ -114,8 +116,8 @@ Common update failure is caused due to network issues. To find the root of the i - "SOAP faults" can be either client- or server-side issues; read the message. - The WU client uses SLS (Service Locator Service) to discover the configurations and endpoints of Microsoft network update sources – WU, MU, Flighting. - >[!NOTE] - >Warning messages for SLS can be ignored if the search is against WSUS/SCCM. + > [!NOTE] + > Warning messages for SLS can be ignored if the search is against WSUS/SCCM. - On sites that only use WSUS/SCCM, the SLS may be blocked at the firewall. In this case the SLS request will fail, and can’t scan against Windows Update or Microsoft Update but can still scan against WSUS/SCCM, since it’s locally configured. ![Windows Update scan log 3](images/update-scan-log-3.png) diff --git a/windows/deployment/update/images/UC_commercialID.png b/windows/deployment/update/images/UC_commercialID.png new file mode 100644 index 0000000000..6896be03e6 Binary files /dev/null and b/windows/deployment/update/images/UC_commercialID.png differ diff --git a/windows/deployment/update/images/UC_commercialID_GP.png b/windows/deployment/update/images/UC_commercialID_GP.png new file mode 100644 index 0000000000..95d92cf6df Binary files /dev/null and b/windows/deployment/update/images/UC_commercialID_GP.png differ diff --git a/windows/deployment/update/images/UC_telemetrylevel.png b/windows/deployment/update/images/UC_telemetrylevel.png new file mode 100644 index 0000000000..a11e68a5f8 Binary files /dev/null and b/windows/deployment/update/images/UC_telemetrylevel.png differ diff --git a/windows/deployment/update/images/azure-portal-LA-wkspcsumm_sterile.png b/windows/deployment/update/images/azure-portal-LA-wkspcsumm_sterile.png index 7b1b17ac18..9308673481 100644 Binary files a/windows/deployment/update/images/azure-portal-LA-wkspcsumm_sterile.png and b/windows/deployment/update/images/azure-portal-LA-wkspcsumm_sterile.png differ diff --git a/windows/deployment/update/images/azure-portal-LAfav1.png b/windows/deployment/update/images/azure-portal-LAfav1.png index 64ae8b1d74..1c01cc7509 100644 Binary files a/windows/deployment/update/images/azure-portal-LAfav1.png and b/windows/deployment/update/images/azure-portal-LAfav1.png differ diff --git a/windows/deployment/update/images/azure-portal-LAmain-wkspc-subname-sterile.png b/windows/deployment/update/images/azure-portal-LAmain-wkspc-subname-sterile.png index b9cfa6bbc1..afdfbb2d21 100644 Binary files a/windows/deployment/update/images/azure-portal-LAmain-wkspc-subname-sterile.png and b/windows/deployment/update/images/azure-portal-LAmain-wkspc-subname-sterile.png differ diff --git a/windows/deployment/update/images/azure-portal-UR-settings.png b/windows/deployment/update/images/azure-portal-UR-settings.png index c716134e9a..67ace993e8 100644 Binary files a/windows/deployment/update/images/azure-portal-UR-settings.png and b/windows/deployment/update/images/azure-portal-UR-settings.png differ diff --git a/windows/deployment/update/images/azure-portal-create-resource-boxes.png b/windows/deployment/update/images/azure-portal-create-resource-boxes.png index a90344e02d..b15bec2265 100644 Binary files a/windows/deployment/update/images/azure-portal-create-resource-boxes.png and b/windows/deployment/update/images/azure-portal-create-resource-boxes.png differ diff --git a/windows/deployment/update/images/temp-azure-portal-soltn-setting.png b/windows/deployment/update/images/temp-azure-portal-soltn-setting.png index e757a3d3c0..33175c7590 100644 Binary files a/windows/deployment/update/images/temp-azure-portal-soltn-setting.png and b/windows/deployment/update/images/temp-azure-portal-soltn-setting.png differ diff --git a/windows/deployment/update/images/waas-wufb-3-rings.png b/windows/deployment/update/images/waas-wufb-3-rings.png new file mode 100644 index 0000000000..5c8b7ec1ee Binary files /dev/null and b/windows/deployment/update/images/waas-wufb-3-rings.png differ diff --git a/windows/deployment/update/images/waas-wufb-fast-ring.png b/windows/deployment/update/images/waas-wufb-fast-ring.png new file mode 100644 index 0000000000..48f91a262f Binary files /dev/null and b/windows/deployment/update/images/waas-wufb-fast-ring.png differ diff --git a/windows/deployment/update/images/waas-wufb-pause.png b/windows/deployment/update/images/waas-wufb-pause.png new file mode 100644 index 0000000000..b8ea2c8df9 Binary files /dev/null and b/windows/deployment/update/images/waas-wufb-pause.png differ diff --git a/windows/deployment/update/images/waas-wufb-pilot-problem.png b/windows/deployment/update/images/waas-wufb-pilot-problem.png new file mode 100644 index 0000000000..b3fbf0aaad Binary files /dev/null and b/windows/deployment/update/images/waas-wufb-pilot-problem.png differ diff --git a/windows/deployment/update/images/waas-wufb-policy-pause.png b/windows/deployment/update/images/waas-wufb-policy-pause.png new file mode 100644 index 0000000000..b8ea2c8df9 Binary files /dev/null and b/windows/deployment/update/images/waas-wufb-policy-pause.png differ diff --git a/windows/deployment/update/images/waas-wufb-slow-ring.png b/windows/deployment/update/images/waas-wufb-slow-ring.png new file mode 100644 index 0000000000..b14aba135f Binary files /dev/null and b/windows/deployment/update/images/waas-wufb-slow-ring.png differ diff --git a/windows/deployment/update/images/wufb-pastdeadline-restart-warning.png b/windows/deployment/update/images/wufb-pastdeadline-restart-warning.png new file mode 100644 index 0000000000..984afea6ed Binary files /dev/null and b/windows/deployment/update/images/wufb-pastdeadline-restart-warning.png differ diff --git a/windows/deployment/update/images/wufb-pastdeadline-restartnow.png b/windows/deployment/update/images/wufb-pastdeadline-restartnow.png new file mode 100644 index 0000000000..c1fe8c04a6 Binary files /dev/null and b/windows/deployment/update/images/wufb-pastdeadline-restartnow.png differ diff --git a/windows/deployment/update/images/wufb-restart-imminent-warning.png b/windows/deployment/update/images/wufb-restart-imminent-warning.png new file mode 100644 index 0000000000..5fc96b5cb4 Binary files /dev/null and b/windows/deployment/update/images/wufb-restart-imminent-warning.png differ diff --git a/windows/deployment/update/images/wufb-update-deadline-warning.png b/windows/deployment/update/images/wufb-update-deadline-warning.png new file mode 100644 index 0000000000..9a3158583a Binary files /dev/null and b/windows/deployment/update/images/wufb-update-deadline-warning.png differ diff --git a/windows/deployment/update/index.md b/windows/deployment/update/index.md index ebd4a10408..a81d83a38c 100644 --- a/windows/deployment/update/index.md +++ b/windows/deployment/update/index.md @@ -3,11 +3,10 @@ title: Update Windows 10 in enterprise deployments (Windows 10) description: Windows as a service provides an all-new way to think about building, deploying, and servicing Windows 10. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: Jaimeo +author: jaimeo +manager: laurawi ms.localizationpriority: high ms.author: jaimeo -ms.date: 04/06/2018 ms.topic: article --- @@ -36,18 +35,18 @@ Windows as a service provides a new way to think about building, deploying, and | [Overview of Windows as a service](waas-overview.md) | Explains the differences in building, deploying, and servicing Windows 10; introduces feature updates, quality updates, and the different servicing branches; compares servicing tools. | | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | Explains the decisions you need to make in your servicing strategy. | | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | Explains how to make use of servicing branches and update deferrals to manage Windows 10 updates. | -| [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) | Explains how to assign devices to Current Branch (CB) or Current Branch for Business (CBB) for feature and quality updates, and how to enroll devices in Windows Insider. | +| [Assign devices to servicing branches for Windows 10 updates](https://docs.microsoft.com/windows/deployment/update/waas-servicing-channels-windows-10-updates) | Explains how to assign devices to the Semi-Annual Channel for feature and quality updates, and how to enroll devices in Windows Insider. | | [Monitor Windows Updates with Update Compliance](update-compliance-monitor.md) | Explains how to use Windows Analytics: Update Compliance to monitor and manage Windows Updates on devices in your organization. | | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | Explains the benefits of using Delivery Optimization or BranchCache for update distribution. | | [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) | Explains updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. | | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) | Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune. | | [Deploy Windows 10 updates using Windows Server Update Services (WSUS)](waas-manage-updates-wsus.md) | Explains how to use WSUS to manage Windows 10 updates. | -| [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | Explains how to use Configuration Manager to manage Windows 10 updates. | +| [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) | Explains how to use Configuration Manager to manage Windows 10 updates. | | [Manage device restarts after updates](waas-restart.md) | Explains how to manage update related device restarts. | | [Manage additional Windows Update settings](waas-wu-settings.md) | Provides details about settings available to control and configure Windows Update | | [Windows Insider Program for Business](waas-windows-insider-for-business.md) | Explains how the Windows Insider Program for Business works and how to become an insider. | >[!TIP] ->Windows servicing is changing, but for disaster recovery scenarios and bare-metal deployments of Windows 10, you still can use traditional imaging software such as System Center Configuration Manager or the Microsoft Deployment Toolkit. Using these tools to deploy Windows 10 images is similar to deploying previous versions of Windows. +>Windows servicing is changing, but for disaster recovery scenarios and bare-metal deployments of Windows 10, you still can use traditional imaging software such as Microsoft Endpoint Configuration Manager or the Microsoft Deployment Toolkit. Using these tools to deploy Windows 10 images is similar to deploying previous versions of Windows. >With each release of a new feature update for CB, Microsoft makes available new .iso files for use in updating your custom images. Each Windows 10 build has a finite servicing lifetime, so it’s important that images stay up to date with the latest build. For detailed information about how to deploy Windows 10 to bare-metal machines or to upgrade to Windows 10 from previous builds of Windows, see [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](../deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md). Additionally, Windows 10 clients can move from any supported version of Windows 10 (i.e. Version 1511) to the latest version directly (i.e 1709). diff --git a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md index 65cd936797..adb1e56155 100644 --- a/windows/deployment/update/olympia/olympia-enrollment-guidelines.md +++ b/windows/deployment/update/olympia/olympia-enrollment-guidelines.md @@ -5,8 +5,11 @@ ms.author: jaimeo ms.topic: article ms.prod: w10 ms.technology: windows +audience: itpro +itproauthor: jaimeo author: jaimeo -ms.date: 03/02/2018 +ms.reviewer: +manager: laurawi keywords: insider, trial, enterprise, lab, corporation, test --- @@ -85,6 +88,9 @@ This is the Bring Your Own Device (BYOD) method--your device will receive Olympi - This method will upgrade your Windows 10 Pro license to Enterprise and create a new account. See [Set up Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-azuread-joined-devices-setup) for more information. + > [!NOTE] + > Make sure that you save your Pro license key before upgrading to the Enterprise edition. If the device gets disconnected from Olympia, you can use the Pro key to reactivate the license manually in the unlikely event that the license fails to downgrade back to Pro automatically. To reactivate manually, see [Upgrade by manually entering a product key](https://docs.microsoft.com/windows/deployment/upgrade/windows-10-edition-upgrades#upgrade-by-manually-entering-a-product-key). + 1. Go to **Start > Settings > Accounts > Access work or school**. To see this setting, you need to have administrator rights to your device (see [local administrator](https://support.microsoft.com/instantanswers/5de907f1-f8ba-4fd9-a89d-efd23fee918c/create-a-local-user-or-administrator-account-in-windows-10)). ![Settings -> Accounts](images/1-1.png) diff --git a/windows/deployment/update/servicing-stack-updates.md b/windows/deployment/update/servicing-stack-updates.md index 900593d031..49d29f4d8a 100644 --- a/windows/deployment/update/servicing-stack-updates.md +++ b/windows/deployment/update/servicing-stack-updates.md @@ -3,11 +3,13 @@ title: Servicing stack updates (Windows 10) description: Servicing stack updates improve the code that installs the other updates. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: Jaimeo +audience: itpro +itproauthor: jaimeo +author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 11/29/2018 +ms.reviewer: +manager: laurawi ms.collection: M365-modern-desktop ms.topic: article --- @@ -52,3 +54,4 @@ Typically, the improvements are reliability and performance improvements that do * Installing servicing stack update does not require restarting the device, so installation should not be disruptive. * Servicing stack update releases are specific to the operating system version (build number), much like quality updates. * Search to install latest available [Servicing stack update for Windows 10](https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV990001). +* Once a servicing stack update is installed, it cannot be removed or uninstalled from the machine. diff --git a/windows/deployment/update/update-compliance-delivery-optimization.md b/windows/deployment/update/update-compliance-delivery-optimization.md index 53c10d8b86..612c44e92a 100644 --- a/windows/deployment/update/update-compliance-delivery-optimization.md +++ b/windows/deployment/update/update-compliance-delivery-optimization.md @@ -1,10 +1,12 @@ --- title: Delivery Optimization in Update Compliance (Windows 10) +ms.reviewer: +manager: laurawi description: new Delivery Optimization data displayed in Update Compliance ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library ms.pagetype: deploy +audience: itpro author: jaimeo ms.author: jaimeo keywords: oms, operations management suite, optimization, downloads, updates, log analytics @@ -14,9 +16,8 @@ ms.topic: article --- # Delivery Optimization in Update Compliance -The Update Compliance solution of Windows Analytics provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days. - ![DO status](images/UC_workspace_DO_status.png) +The Update Compliance solution of Windows Analytics provides you with information about your Delivery Optimization configuration, including the observed bandwidth savings across all devices that used peer-to-peer distribution over the past 28 days. ## Delivery Optimization Status @@ -26,11 +27,9 @@ The Delivery Optimization Status section includes three blades: - The **Content Distribution (%)** blade shows the percentage of bandwidth savings for each category - The **Content Distribution (GB)** blade shows the total amount of data seen from each content type broken down by the download source (peers vs non-peers). - - ## Device Configuration blade -Devices can be set to use different download modes; these download modes determine in what situations Delivery Optimization will use peer-to-peer distribution to accomplish the downloads. The top section shows the number of devices configured to use peer-to-peer distribution in *Peering On* compared to *Peering Off* modes. The table shows a breakdown of the various download mode configurations seen in your environment. For more information about the different configuration options, see [Set up Delivery Optimization for Windows 10 updates](waas-delivery-optimization-setup.md) for recommendations for different scenarios or [Delivery Optimization reference](waas-delivery-optimization-reference.md#download-mode) for complete details of this setting. +Devices can be set to use different download modes; these download modes determine in what situations Delivery Optimization will use peer-to-peer distribution to accomplish the downloads. The top section shows the number of devices configured to use peer-to-peer distribution in *Peering On* compared to *Peering Off* modes. The table shows a breakdown of the various download mode configurations seen in your environment. For more information about the different configuration options, see [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization-setup.md). ## Content Distribution (%) blade The first of two blades showing information on content breakdown, this blade shows a ring chart summarizing **Bandwidth Savings %**, which is the percentage of data received from peer sources out of the total data downloaded (for any device that used peer-to-peer distribution). @@ -44,4 +43,3 @@ The download sources that could be included are: - LAN Bytes: Bytes downloaded from LAN Peers which are other devices on the same local network - Group Bytes: Bytes downloaded from Group Peers which are other devices that belong to the same Group (available when the “Group” download mode is used) - HTTP Bytes: Non-peer bytes. The HTTP download source can be Microsoft Servers, Windows Update Servers, a WSUS server or an SCCM Distribution Point for Express Updates. - diff --git a/windows/deployment/update/update-compliance-feature-update-status.md b/windows/deployment/update/update-compliance-feature-update-status.md index 4dbf3ca380..2d3216901c 100644 --- a/windows/deployment/update/update-compliance-feature-update-status.md +++ b/windows/deployment/update/update-compliance-feature-update-status.md @@ -1,11 +1,14 @@ --- title: Update Compliance - Feature Update Status report +ms.reviewer: +manager: laurawi description: an overview of the Feature Update Status report ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library ms.pagetype: deploy -author: Jaimeo +audience: itpro +itproauthor: jaimeo +author: jaimeo ms.author: jaimeo ms.collection: M365-analytics ms.topic: article @@ -32,3 +35,16 @@ Refer to the following list for what each state means: * Devices that have failed the given feature update installation are counted as **Update failed**. * If a device should be, in some way, progressing toward this security update, but its status cannot be inferred, it will count as **Status Unknown**. Devices not using Windows Update are the most likely devices to fall into this category. +## Compatibility holds + +Microsoft uses diagnostic data to determine whether devices that use Windows Update are ready for a feature update in order to ensure a smooth experience. When Microsoft determines a device is not ready to update due to a known issue, a *compatibility hold* is generated to delay the device’s upgrade and safeguard the end-user experience. Holds are released over time as diagnostic data is analyzed and fixes are addressed. Details are provided on some, but not all compatibility holds on the Windows 10 release information page for any given release. + +To learn how compatibility holds are reflected in the experience, see [Update compliance perspectives](update-compliance-perspectives.md#deployment-status). + +### Opting out of compatibility hold + +Microsoft will release a device from a compatibility hold when it has determined it can safely and smoothly install a feature update, but you are ultimately in control of your devices and can opt out if desired. To opt out, set the registry key **HKLM\Software\Microsoft\Windows NT\CurrentVersion\502505fe-762c-4e80-911e-0c3fa4c63fb0** to a name of **DataRequireGatedScanForFeatureUpdates** and a value of **0**. + + +Setting this registry key to **0** will force the device to opt out from *all* compatibility holds. Any other value, or deleting the key, will resume compatibility protection on the device. + diff --git a/windows/deployment/update/update-compliance-get-started.md b/windows/deployment/update/update-compliance-get-started.md index 4de6b50ffd..5e81c8e5a0 100644 --- a/windows/deployment/update/update-compliance-get-started.md +++ b/windows/deployment/update/update-compliance-get-started.md @@ -1,12 +1,14 @@ --- title: Get started with Update Compliance (Windows 10) +ms.reviewer: +manager: laurawi description: Configure Update Compliance in Azure Portal to see the status of updates and antimalware protection on devices in your network. keywords: update compliance, oms, operations management suite, prerequisites, requirements, updates, upgrades, antivirus, antimalware, signature, log analytics, wdav ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library ms.pagetype: deploy -author: Jaimeo +audience: itpro +author: jaimeo ms.author: jaimeo ms.localizationpriority: medium ms.collection: M365-analytics @@ -14,60 +16,113 @@ ms.topic: article --- # Get started with Update Compliance -This topic explains the steps necessary to configure your environment for Windows Analytics: Update Compliance. +This topic explains the steps necessary to configure your environment for Update Compliance. Steps are provided in sections that follow the recommended setup process: 1. Ensure you meet the [Update Compliance prerequisites](#update-compliance-prerequisites). 2. [Add Update Compliance to your Azure subscription](#add-update-compliance-to-your-azure-subscription). -3. [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics). -4. [Use Update Compliance](update-compliance-using.md) to monitor Windows Updates, Windows Defender Antivirus status, and Delivery Optimization. +3. [Enroll devices in Update Compliance](#enroll-devices-in-update-compliance). +4. [Use Update Compliance](update-compliance-using.md) to monitor Windows Updates and get Delivery Optimization insights. ## Update Compliance prerequisites Before you begin the process to add Update Compliance to your Azure subscription, first ensure you can meet the prerequisites: -1. Update Compliance works only with Windows 10 Professional, Education, and Enterprise editions. Update Compliance only provides data for the standard Desktop Windows 10 version and is not currently compatible with Windows Server, Surface Hub, IoT, etc. -2. Update Compliance provides detailed deployment data for devices on the Semi-Annual Channel and the Long-term Servicing Channel. Update Compliance will show Windows Insider Preview devices, but currently will not provide detailed deployment information for them. -3. Update Compliance requires at least the Basic level of diagnostic data and a Commercial ID to be enabled on the device. -4. To show device names for versions of Windows 10 starting with 1803 in Windows Analytics you must opt in. For details about this, see the "AllowDeviceNameinTelemetry (in Windows 10)" entry in the table in the [Distributing policies at scale](windows-analytics-get-started.md#deploying-windows-analytics-at-scale) section of [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). -5. To use the Windows Defender Status, devices must be E3-licensed and have Cloud Protection enabled. E5-licensed devices will not appear here. For E5 devices, you should use [Windows Defender ATP](https://docs.microsoft.com/sccm/protect/deploy-use/windows-defender-advanced-threat-protection) instead. For more information on Windows 10 Enterprise licensing, see [Windows 10 Enterprise: FAQ for IT Professionals](https://docs.microsoft.com/windows/deployment/planning/windows-10-enterprise-faq-itpro). +1. Update Compliance works only with Windows 10 Professional, Education, and Enterprise editions. Update Compliance only provides data for the standard Desktop Windows 10 version and is not currently compatible with Windows Server, Surface Hub, IoT, etc. +2. Update Compliance provides detailed deployment data for devices on the Semi-Annual Channel and the Long-term Servicing Channel. Update Compliance will show Windows Insider Preview devices, but currently will not provide detailed deployment information for them. +3. Update Compliance requires at least the Basic level of diagnostic data and a Commercial ID to be enabled on the device. +4. For Windows 10 1803+, device names will not appear in Update Compliance unless you opt in. The steps to accomplish this is outlined in the [Enroll devices in Update Compliance](#enroll-devices-in-update-compliance) section. ## Add Update Compliance to your Azure subscription Update Compliance is offered as a solution which is linked to a new or existing [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal) workspace within your Azure subscription. To configure this, follow these steps: -1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal. +1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal. > [!NOTE] > Update Compliance is included at no additional cost with Windows 10 Professional, Education, and Enterprise editions. An Azure subscription is required for managing and using Update Compliance, but no Azure charges are expected to accrue to the subscription as a result of using Update Compliance. -2. In the Azure portal select **+ Create a resource**, and search for “Update Compliance". You should see it in the results below. +2. In the Azure portal select **+ Create a resource**, and search for “Update Compliance". You should see it in the results below. ![Update Compliance marketplace search results](images/UC_00_marketplace_search.png) -3. Select **Update Compliance** and a blade will appear summarizing the solution’s offerings. At the bottom, select **Create** to begin adding the solution to Azure. +3. Select **Update Compliance** and a blade will appear summarizing the solution’s offerings. At the bottom, select **Create** to begin adding the solution to Azure. ![Update Compliance solution creation](images/UC_01_marketplace_create.png) -4. Choose an existing workspace or create a new workspace that will be assigned to the Update Compliance solution. - - If you already have another Windows Analytics solution, you should use the same workspace. - - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started: - - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*. - - For the resource group setting select **Create new** and use the same name you chose for your new workspace. - - For the location setting, choose the Azure region where you would prefer the data to be stored. - - For the pricing tier select **Free**. +4. Choose an existing workspace or create a new workspace that will be assigned to the Update Compliance solution. + - [Desktop Analytics](https://docs.microsoft.com/sccm/desktop-analytics/overview) customers are advised to use the same workspace for Update Compliance. + - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started: + - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*. + - For the resource group setting select **Create new** and use the same name you chose for your new workspace. + - For the location setting, choose the Azure region where you would prefer the data to be stored. + - For the pricing tier select **per GB**. ![Update Compliance workspace creation](images/UC_02_workspace_create.png) -5. The resource group and workspace creation process could take a few minutes. After this, you are able to use that workspace for Update Compliance. Select **Create**. +5. The resource group and workspace creation process could take a few minutes. After this, you are able to use that workspace for Update Compliance. Select **Create**. ![Update Compliance workspace selection](images/UC_03_workspace_select.png) -6. Watch for a notification in the Azure portal that your deployment has been successful. This might take a few minutes. Then, select **Go to resource**. +6. Watch for a notification in the Azure portal that your deployment has been successful. This might take a few minutes. Then, select **Go to resource**. ![Update Compliance deployment successful](images/UC_04_resourcegrp_deployment_successful.png) -## Enroll devices in Windows Analytics -Once you've added Update Compliance to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For Update Compliance there are two key steps for enrollment: -1. Deploy your Commercial ID (from the Update Compliance Settings page) to your Windows 10 devices (typically by using Group Policy, [Mobile Device Management](https://docs.microsoft.com/windows/client-management/windows-10-mobile-and-mdm), [System Center Configuration Manager](https://docs.microsoft.com/sccm/core/understand/introduction) or similar). -2. Ensure the Windows Diagnostic Data setting on devices is set to at least Basic (typically using Group Policy or similar). For full enrollment instructions and troubleshooting, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). +## Enroll devices in Update Compliance +Once you've added Update Compliance to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For Update Compliance there are three key steps to ensure successful enrollment: -After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it might take 48-72 hours for the first data to appear in the solution. Until then, Update Compliance will indicate it is still assessing devices. +### Deploy your Commercial ID to devices +A Commercial ID is a globally-unique identifier assigned to a specific Log Analytics workspace. This is used to identify devices as part of your environment. + +To find your Commercial ID within Azure: +1. Navigate to the **Solutions** tab for your workspace, and then select the **WaaSUpdateInsights** solution. +2. From there, select the Update Compliance Settings page on the navbar. +3. Your Commercial ID is available in the settings page. + +![Update Compliance Settings page](images/UC_commercialID.png) + +>**Important** +> +>Regenerate your Commercial ID only if your Original ID key can no longer be used or if you want to completely reset your workspace. Regenerating your Commercial ID cannot be undone and will result in you losing data for all devices that have the current Commercial ID until the new Commercial ID is deployed to devices. + +#### Deploying Commercial ID using Group Policy +Commercial ID can be deployed using Group Policy. The Group Policy for Commercial ID is under **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure the Commercial ID**. + +![Commercial ID Group Policy location](images/UC_commercialID_GP.png) + +#### Deploying Commercial ID using MDM +Commercial ID can be deployed through a [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm/) (MDM) policy beginning with Windows 10, version 1607. Commercial ID is under the [DMClient configuration service provider](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp). + +### Ensure endpoints are whitelisted +To enable data sharing between devices, your network, and Microsoft's Diagnostic Data Service, configure your proxy to whitelist the following endpoints. You may need security group approval to do this. + +| **Endpoint** | **Function** | +|---------------------------------------------------------|-----------| +| `https://v10c.events.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1803 and later. | +| `https://v10.vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1709 or earlier. | +| `https://settings-win.data.microsoft.com` | Enables the compatibility update to send data to Microsoft. | +| `http://adl.windows.com` | Allows the compatibility update to receive the latest compatibility data from Microsoft. | +| `https://watson.telemetry.microsoft.com` | Windows Error Reporting (WER), used to provide more advanced error reporting in the event of certain Feature Update deployment failures. | +| `https://oca.telemetry.microsoft.com` | Online Crash Analysis, used to provide device-specific recommendations and detailed errors in the event of certain crashes. | +| `https://login.live.com` | This endpoint is optional but allows for the Update Compliance service to more reliably identify and process devices. If you want to disable end-user managed service account (MSA) access, you should apply the appropriate [policy](https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts#block-all-consumer-microsoft-account-user-authentication) instead of blocking this endpoint. | + +### Set diagnostic data levels +Update Compliance requires that devices are configured to send Microsoft at least the Basic level of diagnostic data in order to function. For more information on Windows diagnostic data, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization). + +#### Configuring Telemetry level using Group Policy +You can set Allow Telemetry through Group Policy, this setting is in the same place as the Commercial ID policy, under **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Allow Telemetry**. Update Compliance requires at least Basic (level 1) to function. + +![Allow Telemetry in Group Policy](images/UC_telemetrylevel.png) + +#### Configuring Telemetry level using MDM +Telemetry level can additionally be configured through a [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm/) (MDM) policy. Allow Telemetry is under the [Policy Configuration Service Provider](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) as [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry). + +### Enabling Device Name in telemetry +Beginning with Windows 10, version 1803, Device Name is no longer collected as part of normal Windows Diagnostic Data and must explicitly be allowed to be sent to Microsoft. If devices do not have this policy enabled, their device name will appear as '#' instead. + +#### Allow Device Name in Telemetry with Group Policy +Allow Device Name in Telemetry is under the same node as Commercial ID and Allow Telemetry policies in Group Policy, listed as **Allow device name to be sent in Windows diagnostic data**. + +#### Allow Device Name in Telemetry with MDM +Allow Device Name in Telemetry is under the [Policy Configuration Service Provider](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) as [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry). + +>[!NOTE] +>After enrolling your devices (by deploying your CommercialID and Windows Diagnostic Data settings), it might take 48-72 hours for the first data to appear in the solution. Until then, Update Compliance will indicate it is still assessing devices. \ No newline at end of file diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index 5ce705a7fa..731828c027 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -1,12 +1,14 @@ --- title: Monitor Windows Updates and Windows Defender AV with Update Compliance (Windows 10) +ms.reviewer: +manager: laurawi description: You can use Update Compliance in Azure Portal to monitor the progress of updates and key antimalware protection features on devices in your network. keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library ms.pagetype: deploy -author: Jaimeo +audience: itpro +author: jaimeo ms.author: jaimeo ms.localizationpriority: medium ms.collection: M365-analytics @@ -15,16 +17,17 @@ ms.topic: article # Monitor Windows Updates with Update Compliance + + ## Introduction -Update Compliance is a [Windows Analytics solution](windows-analytics-overview.md) that enables organizations to: +Update Compliance enables organizations to: -* Monitor Windows 10 Professional, Education, and Enterprise security, quality, and feature updates. +* Monitor security, quality, and feature updates for Windows 10 Professional, Education, and Enterprise editions. * View a report of device and update issues related to compliance that need attention. -* See the status of Windows Defender Antivirus signatures and threats. * Check bandwidth savings incurred across multiple content types by using [Delivery Optimization](waas-delivery-optimization.md). -Update Compliance is offered through the Azure portal, and is available free for devices that meet the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites). +Update Compliance is offered through the Azure portal, and is included as part of Windows 10 licenses listed in the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites). Update Compliance uses Windows 10 and Windows Defender Antivirus diagnostic data for all of its reporting. It collects system data including update deployment progress, [Windows Update for Business](waas-manage-updates-wufb.md) configuration data, Windows Defender Antivirus data, and Delivery Optimization usage data, and then sends this data to a secure cloud to be stored for analysis and usage in [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/query-language/get-started-analytics-portal). @@ -35,16 +38,16 @@ See the following topics in this guide for detailed information about configurin ## Update Compliance architecture -The Update Compliance architecture and data flow is summarized by the following four-step process: +The Update Compliance architecture and data flow follows this process: -1. User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service.
                              -2. Diagnostic data is analyzed by the Update Compliance Data Service.
                              -3. Diagnostic data is pushed from the Update Compliance Data Service to your Azure Monitor workspace.
                              -4. Diagnostic data is available in the Update Compliance solution.
                              +1. User computers send diagnostic data to a secure Microsoft data center using the Microsoft Data Management Service. +2. Diagnostic data is analyzed by the Update Compliance Data Service. +3. Diagnostic data is pushed from the Update Compliance Data Service to your Azure Monitor workspace. +4. Diagnostic data is available in the Update Compliance solution. >[!NOTE] ->This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). +>This process assumes that Windows diagnostic data is enabled and data sharing is enabled as outlined in the enrollment section of [Get started with Update Compliance](update-compliance-get-started.md). @@ -52,4 +55,4 @@ The Update Compliance architecture and data flow is summarized by the following ## Related topics [Get started with Update Compliance](update-compliance-get-started.md)
                              -[Use Update Compliance to monitor Windows Updates](update-compliance-using.md) +[Use Update Compliance to monitor Windows Updates](update-compliance-using.md) \ No newline at end of file diff --git a/windows/deployment/update/update-compliance-need-attention.md b/windows/deployment/update/update-compliance-need-attention.md index 54f7f8e186..a4b940a236 100644 --- a/windows/deployment/update/update-compliance-need-attention.md +++ b/windows/deployment/update/update-compliance-need-attention.md @@ -1,11 +1,14 @@ --- title: Update Compliance - Need Attention! report +ms.reviewer: +manager: laurawi description: an overview of the Update Compliance Need Attention! report ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library ms.pagetype: deploy -author: Jaimeo +audience: itpro +itproauthor: jaimeo +author: jaimeo ms.author: jaimeo ms.collection: M365-analytics ms.topic: article diff --git a/windows/deployment/update/update-compliance-perspectives.md b/windows/deployment/update/update-compliance-perspectives.md index f0403b00c8..b38df5c5af 100644 --- a/windows/deployment/update/update-compliance-perspectives.md +++ b/windows/deployment/update/update-compliance-perspectives.md @@ -1,10 +1,13 @@ --- title: Update Compliance - Perspectives +ms.reviewer: +manager: laurawi description: an overview of Update Compliance Perspectives ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library ms.pagetype: deploy +audience: itpro +itproauthor: jaimeo author: jaimeo ms.author: jaimeo ms.collection: M365-analytics @@ -23,6 +26,8 @@ The first blade is the **Build Summary** blade. This blade summarizes the most i The second blade is the **Deferral Configurations** blade, breaking down Windows Update for Business deferral settings (if any). +## Deployment status + The third blade is the **Deployment Status** blade. This defines how many days it has been since the queried version has been released, and breaks down the various states in the update funnel each device has reported to be in. The possible states are as follows: | State | Description | @@ -35,6 +40,9 @@ The third blade is the **Deployment Status** blade. This defines how many days i | Blocked | There is a hard block on the update being completed. This could be that another update must be completed before this one, or some other task is blocking the installation of the update. | | Unknown | Devices that do not report detailed information on the status of their updates will report Unknown. This is most likely devices that do not use Windows Update for deployment. | | Update paused | These devices have Windows Update for Business pause enabled, preventing this update from being installed. | +| Failed | A device is unable to install an update. This failure could be linked to a serious error in the update installation process or, in some cases, a [compatibility hold](update-compliance-feature-update-status.md#compatibility-holds). | + +## Detailed deployment status The final blade is the **Detailed Deployment Status** blade. This blade breaks down the detailed stage of deployment a device is in, beyond the generalized terms defined in Deployment Status. The following are the possible stages a device can report: @@ -44,6 +52,7 @@ The final blade is the **Detailed Deployment Status** blade. This blade breaks d | Update paused | The device’s Windows Update for Business policy dictates the update is paused from being offered. | | Update offered | The device has been offered the update, but has not begun downloading it. | | Pre-Download tasks passed | The device has finished all necessary tasks prior to downloading the update. | +| Compatibility hold | The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#compatibility-holds) | | Download Started | The update has begun downloading on the device. | | Download Succeeded | The update has successfully completed downloading. | | Pre-Install Tasks Passed | Tasks that must be completed prior to installing the update have been completed. | diff --git a/windows/deployment/update/update-compliance-security-update-status.md b/windows/deployment/update/update-compliance-security-update-status.md index 8b8961fa18..fa252c9db1 100644 --- a/windows/deployment/update/update-compliance-security-update-status.md +++ b/windows/deployment/update/update-compliance-security-update-status.md @@ -1,11 +1,12 @@ --- title: Update Compliance - Security Update Status report +ms.reviewer: +manager: laurawi description: an overview of the Security Update Status report ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library ms.pagetype: deploy -author: Jaimeo +author: jaimeo ms.author: jaimeo ms.collection: M365-analytics ms.topic: article @@ -22,9 +23,48 @@ The **Overall Security Update Status** blade provides a visualization of devices The **Latest Security Update Status** and **Previous Security Update Status** tiles are stacked to form one blade. The **Latest Security Update Status** provides a visualization of the different deployment states devices are in regarding the latest update for each build (or version) of Windows 10, along with the revision of that update. The **Previous Security Update Status** blade provides the same information without the accompanying visualization. The various deployment states reported by devices are as follows: -* **Installed** devices are devices that have completed installation for the given update. -* When a device is counted as **In Progress or Deferred**, it has either begun the installation process for the given update or has been intentionally deferred or paused using Windows Update for Business Settings. -* Devices that have **Update Issues** have failed to update at some point during the installation process of the given security update or have not seen progress for a period of seven days. -* If a device should be, in some way, progressing toward this security update, but its status cannot be inferred, it will count as **Status Unknown**. This is most often devices that have not scanned for an update in some time, or devices not being managed through Windows Update. + +## Deployment status +Deployment status summarizes detailed status into higher-level states to get a quick sense of the status the given device was last reported to be in relative to this specific update. Note that with the latency of deployment data, devices might have since moved on from the reported deployment status. + +|Deployment status |Description | +|---------|---------| +|Failed | The device encountered a failure during the update process. Note that due to latency, devices reporting this status may have since retried the update. | +|Progress stalled | he device started the update process, but no progress has been reported in the last 7 days. | +|Deferred | The device is currently deferring the update process due to Windows Update for Business policies. | +|In progress | The device has begun the updating process for this update. This status appears if the device is in any stage of the update process including and after download, but before completing the update. If no progress has been reported in the last 7 days, devices will move to **Progress stalled**.** | +|Update completed | The device has completed the update process. | +|Update paused | The device is prevented from being offered the update due to updates being paused on the device. | +|Unknown | No record is available for this device relative to this update. This is a normal status if an update has recently been released or if the device does not use Windows Update. | + + +## Detailed status +Detailed status provides a detailed stage-level representation of where in the update process the device was last reported to be in relative to this specific update. Note that with the latency of deployment data, devices might have since moved on from the reported detailed status. + + +|Detaild status |Description | +|---------|---------| +|Scheduled in next X days | The device is currently deferring the update with Windows Update for Business policies but will be offered the update within the next X days. | +|Compatibility hold | The device has been placed under a *compatibility hold* to ensure a smooth feature update experience and will not resume the update until the hold has been cleared. For more information see [Feature Update Status report](update-compliance-feature-update-status.md#compatibility-holds) | +|Update deferred | The device is currently deferring the update with Windows Update for Business policies. | +|Update paused | The device is prevented from being offered the update due to updates being paused on the device. | +|Update offered | The device has been offered the update by Windows Update but has not yet begun to download it. | +|Download started | The device has begun downloading the update. | +|Download succeeded | The device has finished downloading the update but has not yet begun installing the update. | +|Install started | The device has begun installing the update. | +|PreInstall task passed | The device has passed checks prior to beginning the rest of the installation process after a restart. | +|Reboot required | The device requires a restart to install the update, but one has not yet been scheduled. | +|Reboot pending | The device is pending a restart to install the update. | +|Reboot initiated | The device reports "Reboot initiated" just before actually restarting specifically to apply the update. | +|Commit | The device, after a restart, is committing changes relevant to the update. | +|Finalize succeeded | The device has finished final tasks after a restart to apply the update. | +|Update successful | The device has successfully applied the update. | +|Cancelled | The update was cancelled at some point in the update process. | +|Uninstalled | The update was successfully uninstalled from the device. | +|Rollback | The update failed to apply during the update process, causing the device to roll back changes and revert to the previous update. | + + + + The rows of each tile in this section are interactive; selecting them will navigate you to the query that is representative of that row and section. diff --git a/windows/deployment/update/update-compliance-using.md b/windows/deployment/update/update-compliance-using.md index 356f7c7af8..3f9b6fbcbb 100644 --- a/windows/deployment/update/update-compliance-using.md +++ b/windows/deployment/update/update-compliance-using.md @@ -1,11 +1,13 @@ --- title: Using Update Compliance (Windows 10) -description: Explains how to begin usihg Update Compliance. +ms.reviewer: +manager: laurawi +description: Explains how to begin using Update Compliance. keywords: oms, operations management suite, wdav, updates, upgrades, antivirus, antimalware, signature, log analytics ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library ms.pagetype: deploy +audience: itpro author: jaimeo ms.author: jaimeo ms.localizationpriority: medium @@ -30,7 +32,7 @@ After Update Compliance has successfully been [added to your Azure subscription] ![Update Compliance tile no data](images/UC_tile_assessing.png) -When the solution is added, data is not immediately available. Data will begin to be collected after data is sent up that belongs to the Commercial ID associated with the device. This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). After Microsoft has collected and processed any device data associated with your Commercial ID, the tile will be replaced with the following summary: +When the solution is added, data is not immediately available. Data will begin to be collected after data is sent up that belongs to the Commercial ID associated with the device. This process assumes that Windows diagnostic data is enabled and data sharing is enabled as described in [Enrolling devices in Update Compliance](update-compliance-get-started.md#enroll-devices-in-update-compliance). After Microsoft has collected and processed any device data associated with your Commercial ID, the tile will be replaced with the following summary: ![Update Compliance tile with data](images/UC_tile_filled.png) @@ -51,21 +53,21 @@ Update Compliance’s overview blade summarizes all the data Update Compliance p * Feature updates: A device is up to date on feature updates whenever it has the latest applicable feature update installed. Update Compliance considers [Servicing Channel](waas-overview.md#servicing-channels) when determining update applicability. * AV Signature: A device is up to date on Antivirus Signature when the latest Windows Defender Signatures have been downloaded. This distribution only considers devices that are running Windows Defender Antivirus. -The blade also provides the time at which your Update Compliance workspace was [refreshed](#data-latency). +The blade also provides the time at which your Update Compliance workspace was [refreshed](#update-compliance-data-latency). The following is a breakdown of the different sections available in Update Compliance: * [Need Attention!](update-compliance-need-attention.md) - This section is the default section when arriving to your Update Compliance workspace. It provides a summary of the different issues devices are facing relative to Windows 10 updates. * [Security Update Status](update-compliance-security-update-status.md) - This section lists the percentage of devices that are on the latest security update released for the version of Windows 10 it is running. Selecting this section provides blades that summarize the overall status of security updates across all devices and a summary of their deployment progress towards the latest two security updates. * [Feature Update Status](update-compliance-feature-update-status.md) - This section lists the percentage of devices that are on the latest feature update that is applicable to a given device. Selecting this section provides blades that summarize the overall feature update status across all devices and a summary of deployment status for different versions of Windows 10 in your environment. -* [Windows Defender AV Status](update-compliance-wd-av-status.md) - This section lists the percentage of devices running Windows Defender Antivirus that are not sufficiently protected. Selecting this section provides a summary of signature and threat status across all devices that are running Windows Defender Antivirus. This section is not applicable to devices not running Windows Defender Antivirus or devices that do not meet the [prerequisites](update-compliance-get-started.md#update-compliance-prerequisites) to be assessed. * [Delivery Optimization Status](update-compliance-delivery-optimization.md) - This section summarizes bandwidth savings incurred by utilizing Delivery Optimization in your environment. It provides a breakdown of Delivery Optimization configuration across devices, and summarizes bandwidth savings and utilization across multiple content types. ## Update Compliance data latency Update Compliance uses Windows 10 diagnostic data as its data source. After you add Update Compliance and appropriately configure your devices, it could take 48-72 hours before they first appear. The process that follows is as follows: -Update Compliance is refreshed every 12 hours. This means that every 12 hours all data that has been gathered over the last 12-hour interval is pushed to Log Analytics. However, the rate that each data type is sent and how long it takes to be ready for Update Compliance varies, roughly outlined below. -| Data Type | Refresh Rate | Data Latency | +Update Compliance is refreshed every 12 hours. This means that every 12 hours all data that has been gathered over the last 12-hour interval is pushed to Log Analytics. However, the rate at which each type of data is sent from the device and how long it takes to be ready for Update Compliance varies, roughly outlined below. + +| Data Type | Data upload rate from device | Data Latency | |--|--|--| |WaaSUpdateStatus | Once per day |4 hours | |WaaSInsiderStatus| Once per day |4 hours | @@ -75,7 +77,7 @@ Update Compliance is refreshed every 12 hours. This means that every 12 hours al |WUDOAggregatedStatus|On update event, aggregated over time|24-36 hours | |WUDOStatus|Once per day|12 hours | -This means you should generally expect to see new data every 24-36 hours, except for WaaSDeploymentStatus and WUDOAggregatedStatus, which may take 36-48 hours (if it misses the 36th hour refresh, it would be in the 48th, so the data will be present in the 48th hour refresh). +This means you should generally expect to see new data device data every 24 hours, except for WaaSDeploymentStatus and WUDOAggregatedStatus, which may take 36-48 hours (if it misses the 36th hour refresh, it would be in the 48th, so the data will be present in the 48th hour refresh). ## Using Log Analytics diff --git a/windows/deployment/update/update-compliance-wd-av-status.md b/windows/deployment/update/update-compliance-wd-av-status.md index 7a8e65c4a5..edc9156531 100644 --- a/windows/deployment/update/update-compliance-wd-av-status.md +++ b/windows/deployment/update/update-compliance-wd-av-status.md @@ -1,10 +1,13 @@ --- title: Update Compliance - Windows Defender AV Status report +ms.reviewer: +manager: laurawi description: an overview of the Windows Defender AV Status report ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library ms.pagetype: deploy +audience: itpro +itproauthor: jaimeo author: jaimeo ms.author: jaimeo ms.collection: M365-analytics @@ -18,9 +21,9 @@ ms.topic: article The Windows Defender AV Status section deals with data concerning signature and threat status for devices that use Windows Defender Antivirus. The section tile in the [Overview Blade](update-compliance-using.md#overview-blade) provides the percentage of devices with insufficient protection – this percentage only considers devices using Windows Defender Antivirus. >[!NOTE] ->Update Compliance's Windows Defender Antivirus status is compatible with E3, B, F1, VL Professional and below licenses. Devices with an E5 license are not shown here; devices with an E5 license can be monitored using the [Windows Defender ATP portal](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection). If you'd like to learn more about Windows 10 licensing, see the [Windows 10 product licensing options](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx). +>Update Compliance's Windows Defender Antivirus status is compatible with E3, B, F1, VL Professional and below licenses. Devices with an E5 license are not shown here; devices with an E5 license can be monitored using the [Windows Defender ATP portal](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection). If you'd like to learn more about Windows 10 licensing, see the [Windows 10 product licensing options](https://www.microsoft.com/Licensing/product-licensing/windows10.aspx). -# Windows Defender AV Status sections +## Windows Defender AV Status sections The **Protection Status** blade gives a count for devices that have either out-of-date signatures or real-time protection turned off. Below, it gives a more detailed breakdown of the two issues. Selecting any of these statuses will navigate you to a Log Search view containing the query. The **Threat Status** blade shows, among devices that have encountered threats, how many were and were not remediated successfully. It also provides a detailed count. Selecting either of these will take you to the respective query in Log Search for further investigation. @@ -33,4 +36,8 @@ Here are some important terms to consider when using the Windows Defender AV Sta * **Not assessed** devices are devices where either a non-Microsoft AV solution is used or it has been more than 7 days since the device recently disappeared. ## Windows Defender data latency -Because of the way Windows Defender is associated with the rest of Windows device data, Defender data for new devices might take much longer to appear than other data types. This process could take up to 28 days. \ No newline at end of file +Because of the way Windows Defender is associated with the rest of Windows device data, Defender data for new devices might take much longer to appear than other data types. This process could take up to 28 days. + +## Related topics + +- [Windows Defender Antivirus pre-requisites](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting#confirm-pre-requisites) diff --git a/windows/deployment/update/waas-branchcache.md b/windows/deployment/update/waas-branchcache.md index 5181cd933e..6bb0bf7519 100644 --- a/windows/deployment/update/waas-branchcache.md +++ b/windows/deployment/update/waas-branchcache.md @@ -3,11 +3,11 @@ title: Configure BranchCache for Windows 10 updates (Windows 10) description: Use BranchCache to optimize network bandwidth during update deployment. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 07/27/2017 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -20,7 +20,7 @@ ms.topic: article > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -BranchCache is a bandwidth-optimization feature that has been available since the Windows Server 2008 R2 and Windows 7 operating systems. Each client has a cache and acts as an alternate source for content that devices on its own network request. Windows Server Update Services (WSUS) and System Center Configuration Manager can use BranchCache to optimize network bandwidth during update deployment, and it’s easy to configure for either of them. BranchCache has two operating modes: Distributed Cache mode and Hosted Cache mode. +BranchCache is a bandwidth-optimization feature that has been available since the Windows Server 2008 R2 and Windows 7 operating systems. Each client has a cache and acts as an alternate source for content that devices on its own network request. Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager can use BranchCache to optimize network bandwidth during update deployment, and it’s easy to configure for either of them. BranchCache has two operating modes: Distributed Cache mode and Hosted Cache mode. - Distributed Cache mode operates like the [Delivery Optimization](waas-delivery-optimization.md) feature in Windows 10: each client contains a cached version of the BranchCache-enabled files it requests and acts as a distributed cache for other clients requesting that same file. @@ -39,7 +39,7 @@ In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization ## Configure servers for BranchCache -You can use WSUS and Configuration Manager with BranchCache in Distributed Cache mode. BranchCache in Distributed Cache mode is easy to configure for both WSUS and System Center Configuration Manager. +You can use WSUS and Configuration Manager with BranchCache in Distributed Cache mode. BranchCache in Distributed Cache mode is easy to configure for both WSUS and Microsoft Endpoint Configuration Manager. For a step-by-step guide to configuring BranchCache on Windows Server devices, see the [BranchCache Deployment Guide (Windows Server 2012)](https://technet.microsoft.com/library/jj572990) or [BranchCache Deployment Guide (Windows Server 2016)](https://technet.microsoft.com/windows-server-docs/networking/branchcache/deploy/branchcache-deployment-guide). @@ -63,7 +63,7 @@ In addition to these steps, there is one requirement for WSUS to be able to use - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) - [Deploy Windows 10 updates using Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 83d145df77..0c96d3ba90 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -1,9 +1,12 @@ --- title: Configure Windows Update for Business (Windows 10) +ms.reviewer: +manager: laurawi description: You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices. ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library + +audience: itpro author: jaimeo ms.localizationpriority: medium ms.author: jaimeo @@ -16,7 +19,6 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile - Windows Server 2016 - Windows Server 2019 @@ -25,8 +27,8 @@ ms.topic: article You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices. The sections in this topic provide the Group Policy and MDM policies for Windows 10, version 1511 and above. The MDM policies use the OMA-URI setting from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). ->[!IMPORTANT] ->For Windows Update for Business policies to be honored, the diagnostic data level of the device must be set to **1 (Basic)** or higher. If it is set to **0 (Security)**, Windows Update for Business policies will have no effect. For instructions, see [Configure the operating system diagnostic data level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#diagnostic-data-levels). +> [!IMPORTANT] +> Beginning with Windows 10, version 1903, organizations can use Windows Update for Business policies, regardless of the diagnostic data level chosen. If the diagnostic data level is set to **0 (Security)**, Windows Update for Business policies will still be honored. For instructions, see [Configure the operating system diagnostic data level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#diagnostic-data-levels). Some Windows Update for Business policies are not applicable or behave differently for devices running Windows 10 Mobile Enterprise. Specifically, policies pertaining to Feature Updates will not be applied to Windows 10 Mobile Enterprise. All Windows 10 Mobile updates are recognized as Quality Updates, and can only be deferred or paused using the Quality Update policy settings. Additional information is provided in this topic and in [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md). @@ -123,9 +125,9 @@ Starting with Windows 10, version 1703, using Settings to control the pause beha ## Configure when devices receive Quality Updates -Quality Updates are typically published on the first Tuesday of every month, although they can be released at any time. You can define if, and for how long, you would like to defer receiving Quality Updates following their availability. You can defer receiving these Quality Updates for a period of up to 35 days from their release by setting the **DeferQualityUpdatesPeriodinDays** value. +Quality updates are typically published on the first Tuesday of every month, although they can be released at any time. You can define if, and for how long, you would like to defer receiving Quality updates following their availability. You can defer receiving these quality updates for a period of up to 30 days from their release by setting the **DeferQualityUpdatesPeriodinDays** value. -You can set your system to receive updates for other Microsoft products—known as Microsoft Updates (such as Microsoft Office, Visual Studio)—along with Windows Updates by setting the **AllowMUUpdateService** policy. When you do this, these Microsoft Updates will follow the same deferral and pause rules as all other Quality Updates. +You can set your system to receive updates for other Microsoft products—known as Microsoft updates (such as Microsoft Office, Visual Studio)—along with Windows updates by setting the **AllowMUUpdateService** policy. When you do this, these Microsoft updates will follow the same deferral and pause rules as all other quality updates. >[!IMPORTANT] >This policy defers both Feature and Quality Updates on Windows 10 Mobile Enterprise. @@ -144,7 +146,7 @@ You can set your system to receive updates for other Microsoft products—known ## Pause quality updates -You can also pause a system from receiving Quality Updates for a period of up to 35 days from when the value is set. After 35 days has passed, the pause setting will automatically expire and the device will scan Windows Update for applicable quality Updates. Following this scan, you can then pause quality Updates for the device again. +You can also pause a system from receiving quality updates for a period of up to 35 days from when the value is set. After 35 days have passed, the pause setting will automatically expire and the device will scan Windows Update for applicable quality updates. Following this scan, you can then pause quality updates for the device again. Starting with Windows 10, version 1703, when you configure a pause by using policy, you must set a start date for the pause to begin. The pause period is calculated by adding 35 days to this start date. @@ -188,7 +190,7 @@ Starting with Windows 10, version 1709, you can set policies to manage preview b The **Manage preview builds** setting gives administrators control over enabling or disabling preview build installation on a device. You can also decide to stop preview builds once the release is public. * Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business** - *Manage preview builds* * MDM: **Update/ManagePreviewBuilds** -* System Center Configuration Manager: **Enable dual scan, manage through Windows Update for Business policy** +* Microsoft Endpoint Configuration Manager: **Enable dual scan, manage through Windows Update for Business policy** >[!IMPORTANT] >This policy replaces the "Toggle user control over Insider builds" policy under that is only supported up to Windows 10, version 1703. You can find the older policy here: @@ -199,9 +201,9 @@ The policy settings to **Select when Feature Updates are received** allows you t * Group Policy: **Computer Configuration/Administrative Templates/Windows Components/Windows Update/ Windows Update for Business** - *Select when Preview Builds and Feature Updates are received* * MDM: **Update/BranchReadinessLevel** -## Exclude drivers from Quality Updates +## Exclude drivers from quality updates -Starting with Windows 10, version 1607, you can selectively opt out of receiving driver update packages as part of your normal quality update cycle. This policy will not apply to updates to drivers provided with the operating system (which will be packaged within a security or critical update) or to Feature Updates, where drivers might be dynamically installed to ensure the Feature Update process can complete. +Starting with Windows 10, version 1607, you can selectively opt out of receiving driver update packages as part of your normal quality update cycle. This policy will not apply to updates to drivers provided with the operating system (which will be packaged within a security or critical update) or to feature updates, where drivers might be dynamically installed to ensure the feature update process can complete. **Policy settings to exclude drivers** @@ -218,7 +220,7 @@ The following are quick-reference tables of the supported policy values for Wind | GPO Key | Key type | Value | | --- | --- | --- | -| BranchReadinessLevel | REG_DWORD | 16: systems take Feature Updates for the Current Branch (CB)
                              32: systems take Feature Updates for the Current Branch for Business (CBB)
                              Note: Other value or absent: receive all applicable updates (CB) | +| BranchReadinessLevel | REG_DWORD | 2: systems take Feature Updates for the Windows Insider build - Fast (added in Windows 10, version 1709)
                              4: systems take Feature Updates for the Windows Insider build - Slow (added in Windows 10, version 1709)
                              8: systems take Feature Updates for the Release Windows Insider build (added in Windows 10, version 1709)
                              16: for Windows 10, version 1703: systems take Feature Updates for the Current Branch (CB); for Windows 10, version 1709, 1803 and 1809: systems take Feature Updates from Semi-annual Channel (Targeted) (SAC-T); for Windows 10, version 1903 or later: systems take Feature Updates from Semi-annual Channel
                              32: systems take Feature Updates from Semi-annual Channel
                              Note: Other value or absent: receive all applicable updates | | DeferQualityUpdates | REG_DWORD | 1: defer quality updates
                              Other value or absent: don’t defer quality updates | | DeferQualityUpdatesPeriodinDays | REG_DWORD | 0-35: defer quality updates by given days | | PauseQualityUpdatesStartDate | REG_DWORD | 1: pause quality updates
                              Other value or absent: don’t pause quality updates | @@ -232,7 +234,7 @@ The following are quick-reference tables of the supported policy values for Wind | MDM Key | Key type | Value | | --- | --- | --- | -| BranchReadinessLevel | REG_DWORD | 16: systems take Feature Updates for the Current Branch (CB)
                              32: systems take Feature Updates for the Current Branch for Business (CBB)
                              Note: Other value or absent: receive all applicable updates (CB) | +| BranchReadinessLevel | REG_DWORD |2: systems take Feature Updates for the Windows Insider build - Fast (added in Windows 10, version 1709)
                              4: systems take Feature Updates for the Windows Insider build - Slow (added in Windows 10, version 1709)
                              8: systems take Feature Updates for the Release Windows Insider build (added in Windows 10, version 1709)
                              16: for Windows 10, version 1703: systems take Feature Updates for the Current Branch (CB); for Windows 10, version 1709, 1803 and 1809: systems take Feature Updates from Semi-annual Channel (Targeted) (SAC-T); for Windows 10, version 1903 or later: systems take Feature Updates from Semi-annual Channel
                              32: systems take Feature Updates from Semi-annual Channel
                              Note: Other value or absent: receive all applicable updates | | DeferQualityUpdatesPeriodinDays | REG_DWORD | 0-35: defer quality updates by given days | | PauseQualityUpdatesStartDate | REG_DWORD | 1: pause quality updates
                              Other value or absent: don’t pause quality updates | | DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-365: defer feature updates by given days | @@ -269,7 +271,7 @@ When a device running a newer version sees an update available on Windows Update - [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-delivery-optimization-reference.md b/windows/deployment/update/waas-delivery-optimization-reference.md index 582639b74e..e7d8d21550 100644 --- a/windows/deployment/update/waas-delivery-optimization-reference.md +++ b/windows/deployment/update/waas-delivery-optimization-reference.md @@ -1,11 +1,14 @@ --- title: Delivery Optimization reference +ms.reviewer: +manager: laurawi description: Reference of all Delivery Optimization settings and descriptions of same keywords: oms, operations management suite, wdav, updates, downloads, log analytics ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library -author: JaimeO + +audience: itpro +author: jaimeo ms.localizationpriority: medium ms.author: jaimeo ms.collection: M365-modern-desktop @@ -37,7 +40,7 @@ In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimiz | --- | --- | --- | | [Download mode](#download-mode) | DODownloadMode | 1511 | | [Group ID](#group-id) | DOGroupID | 1511 | -| [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-allowed-to-use-peer-caching) | DOMinRAMAllowedToPeer | 1703 | +| [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-inclusive-allowed-to-use-peer-caching) | DOMinRAMAllowedToPeer | 1703 | | [Minimum disk size allowed to use Peer Caching](#minimum-disk-size-allowed-to-use-peer-caching) | DOMinDiskSizeAllowedToPeer | 1703 | | [Max Cache Age](#max-cache-age) | DOMaxCacheAge | 1511 | | [Max Cache Size](#max-cache-size) | DOMaxCacheSize | 1511 | @@ -59,6 +62,8 @@ In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimiz | [Select the source of Group IDs](#select-the-source-of-group-ids) | DOGroupIDSource | 1803 | | [Delay background download from http (in secs)](#delay-background-download-from-http-in-secs) | DODelayBackgroundDownloadFromHttp | 1803 | | [Delay foreground download from http (in secs)](#delay-foreground-download-from-http-in-secs) | DODelayForegroundDownloadFromHttp | 1803 | +| [Delay foreground download cache server fallback (in secs)](#delay-foreground-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackForeground | 1903 | +| [Delay background download cache server fallback (in secs)](#delay-background-download-cache-server-fallback-in-secs) | DelayCacheServerFallbackBackground | 1903 | ### More detail on Delivery Optimization settings: @@ -70,7 +75,7 @@ Delivery Optimization uses locally cached updates. In cases where devices have a - The system drive is the default location for the Delivery Optimization cache. [Modify Cache Drive](#modify-cache-drive) allows administrators to change that location. >[!NOTE] ->It is possible to configure preferred cache devices. For more information, see [Set “preferred” cache devices for Delivery Optimization](#set-preferred-cache-devices). +>It is possible to configure preferred cache devices. For more information, see [Group ID](#group-id). All cached files have to be above a set minimum size. This size is automatically set by the Delivery Optimization cloud services, but when local storage is sufficient and the network isn't strained or congested, administrators might choose to change it to obtain increased performance. You can set the minimum size of files to cache by adjusting [Minimum Peer Caching Content File Size](#minimum-peer-caching-content-file-size). @@ -79,8 +84,8 @@ Additional options available that control the impact Delivery Optimization has o - [Max Upload Bandwidth](#max-upload-bandwidth) controls the Delivery Optimization upload bandwidth usage. - [Monthly Upload Data Cap](#monthly-upload-data-cap) controls the amount of data a client can upload to peers each month. - [Minimum Background QoS](#minimum-background-qos) lets administrators guarantee a minimum download speed for Windows updates. This is achieved by adjusting the amount of data downloaded directly from Windows Update or WSUS servers, rather than other peers in the network. -- [Maximum Foreground Download Bandwidth](#maximum-foreground-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. -- [Maximum Background Download Bandwidth](#maximum-background-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses across all concurrent download activities as a percentage of available download bandwidth. +- [Maximum Foreground Download Bandwidth](#maximum-foreground-download-bandwidth) specifies the **maximum foreground download bandwidth** that Delivery Optimization uses, across all concurrent download activities, as a percentage of available download bandwidth. +- [Maximum Background Download Bandwidth](#maximum-background-download-bandwidth) specifies the **maximum background download bandwidth** that Delivery Optimization uses, across all concurrent download activities, as a percentage of available download bandwidth. - [Set Business Hours to Limit Background Download Bandwidth](#set-business-hours-to-limit-background-download-bandwidth) specifies the maximum background download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. - [Set Business Hours to Limit Foreground Download Bandwidth](#set-business-hours-to-limit-foreground-download-bandwidth) specifies the maximum foreground download bandwidth that Delivery Optimization uses during and outside business hours across all concurrent download activities as a percentage of available download bandwidth. - [Select a method to restrict Peer Selection](#select-a-method-to-restrict-peer-selection) restricts peer selection by the options you select. @@ -89,7 +94,7 @@ Additional options available that control the impact Delivery Optimization has o - [Delay foreground download from http (in secs)](#delay-foreground-download-from-http-in-secs) allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use P2P. Administrators can further customize scenarios where Delivery Optimization will be used with the following settings: -- [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-allowed-to-use-peer-caching) sets the minimum RAM required for peer caching to be enabled. +- [Minimum RAM (inclusive) allowed to use Peer Caching](#minimum-ram-inclusive-allowed-to-use-peer-caching) sets the minimum RAM required for peer caching to be enabled. - [Minimum disk size allowed to use Peer Caching](#minimum-disk-size-allowed-to-use-peer-caching) sets the minimum disk size required for peer caching to be enabled. - [Enable Peer Caching while the device connects via VPN](#enable-peer-caching-while-the-device-connects-via-vpn) allows clients connected through VPN to use peer caching. - [Allow uploads while the device is on battery while under set Battery level](#allow-uploads-while-the-device-is-on-battery-while-under-set-battery-level) controls the minimum battery level required for uploads to occur. You must enable this policy to allow upload while on battery. @@ -112,7 +117,7 @@ Download mode dictates which download sources clients are allowed to use when do ### Group ID -By default, peer sharing on clients using the group download mode is limited to the same domain in Windows 10, version 1511, and the same domain and AD DS site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or AD DS site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example, you could create a sub-group representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to be peers. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group. +By default, peer sharing on clients using the group download mode is limited to the same domain in Windows 10, version 1511, and the same domain and Active Directory Domain Services site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or Active Directory Domain Services site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example, you could create a sub-group representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to be peers. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group. [//]: # (SCCM Boundary Group option; GroupID Source policy) @@ -127,7 +132,8 @@ Starting in Windows 10, version 1803, set this policy to restrict peer selection - 1 = AD Site - 2 = Authenticated domain SID - 3 = DHCP Option ID (with this option, the client will query DHCP Option ID 234 and use the returned GUID value as the Group ID) -- 4 = DNS Suffix +- 4 = DNS Suffix +- 5 = Starting with Windows 10, version 1903, you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. When set, the Group ID is assigned automatically from the selected source. If you set this policy, the GroupID policy will be ignored. The option set in this policy only applies to Group (2) download mode. If Group (2) isn't set as Download mode, this policy will be ignored. If you set the value to anything other than 0-4, the policy is ignored. @@ -190,14 +196,18 @@ Starting in Windows 10, version 1803, specifies the maximum foreground download Starting in Windows 10, version 1803, set this policy to restrict peer selection via selected option. Currently the only available option is **1 = Subnet mask** This option (Subnet mask) applies to both Download Modes LAN (1) and Group (2). - - ### Delay background download from http (in secs) Starting in Windows 10, version 1803, this allows you to delay the use of an HTTP source in a background download that is allowed to use peer-to-peer. ### Delay foreground download from http (in secs) Starting in Windows 10, version 1803, allows you to delay the use of an HTTP source in a foreground (interactive) download that is allowed to use peer-to-peer. +### Delay Foreground Download Cache Server Fallback (in secs) +Starting in Windows 10, version 1903, allows you to delay the fallback from cache server to the HTTP source for foreground content download by X seconds. If you set the policy to delay foreground download from http, it will apply first (to allow downloads from peers first). + +### Delay Background Download Cache Server Fallback (in secs) +Starting in Windows 10, version 1903, set this policy to delay the fallback from cache server to the HTTP source for a background content download by X seconds. If you set the policy to delay background download from http, it will apply first (to allow downloads from peers first). + ### Minimum Background QoS This value specifies the minimum download speed guarantee that a client attempts to achieve and will fulfill by downloading more kilobytes from Windows Update servers or WSUS. Simply put, the lower this value is, the more content will be sourced using peers on the network rather than Windows Update. The higher this value, the more content is received from Windows Update servers or WSUS, versus peers on the local network. @@ -221,3 +231,5 @@ The device can download from peers while on battery regardless of this policy. >[!IMPORTANT] > By default, devices **will not upload while on battery**. To enable uploads while on battery, you need to enable this policy and set the battery value under which uploads pause. + + diff --git a/windows/deployment/update/waas-delivery-optimization-setup.md b/windows/deployment/update/waas-delivery-optimization-setup.md index f9b506d216..61a6af8b7c 100644 --- a/windows/deployment/update/waas-delivery-optimization-setup.md +++ b/windows/deployment/update/waas-delivery-optimization-setup.md @@ -1,11 +1,14 @@ --- title: Set up Delivery Optimization +ms.reviewer: +manager: laurawi description: Delivery Optimization is a new peer-to-peer distribution method in Windows 10 keywords: oms, operations management suite, wdav, updates, downloads, log analytics ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library -author: JaimeO + +audience: itpro +author: jaimeo ms.localizationpriority: medium ms.author: jaimeo ms.collection: M365-modern-desktop @@ -22,7 +25,7 @@ ms.topic: article ## Recommended Delivery Optimization settings -Delivery Optimization offers a great many settings to fine-tune its behavior (see [Delivery Optimization reference](waas-delivery-optimization-reference.md) for a comprehensive list), but for the most efficient performance, there are just a few key parameters that will have the greates impact if particular situations exist in your deployment: +Delivery Optimization offers a great many settings to fine-tune its behavior (see [Delivery Optimization reference](waas-delivery-optimization-reference.md) for a comprehensive list), but for the most efficient performance, there are just a few key parameters that will have the greatest impact if particular situations exist in your deployment: - Does your topology include multiple breakouts to the internet (i.e., a "hybrid WAN") or are there only a few connections to the internet, so that all requests appear to come from a single external IP address (a "hub and spoke" topology)? - If you use boundary groups in your topology, how many devices are present in a given group? @@ -48,7 +51,7 @@ Quick-reference table: For this scenario, grouping devices by domain allows devices to be included in peer downloads and uploads across VLANs. **Set Download Mode to 2 - Group**. The default group is the authenticated domain or Active Directory site. If your domain-based group is too wide, or your Active Directory sites aren’t aligned with your site network topology, then you should consider additional options for dynamically creating groups, for example by using the GroupIDSrc parameter. -[//]: # is there a topic on GroupIDSrc we can link to? + To do this in Group Policy go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Download mode** to **2**. @@ -77,7 +80,7 @@ To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** Many devices now come with large internal drives. You can set Delivery Optimization to take better advantage of this space (especially if you have large numbers of devices) by changing the minimum file size to cache. If you have more than 30 devices in your local network or group, change it from the default 50 MB to 10 MB. If you have more than 100 devices (and are running Windows 10, version 1803 or later), set this value to 1 MB. -[//]: # default of 50 aimed at consumer +[//]: # (default of 50 aimed at consumer) To do this in Group Policy, go to **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization** and set **Minimum Peer Caching Content File Size** to 100 (if you have more than 30 devices) or 1 (if you have more than 100 devices). @@ -91,14 +94,17 @@ To do this in Group Policy, go to **Configuration\Policies\Administrative Templa To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** and set DOMaxCacheAge to 7 or more (up to 30 days). -[//]: # material about "preferred" devices; remove MinQos/MaxCacheAge; table format? +[//]: # (material about "preferred" devices; remove MinQos/MaxCacheAge; table format?) ## Monitor Delivery Optimization -[//]: # How to tell if it’s working? What values are reasonable; which are not? If not, which way to adjust and how? -- check PercentPeerCaching for files > minimum >= 50% +[//]: # (How to tell if it’s working? What values are reasonable; which are not? If not, which way to adjust and how? -- check PercentPeerCaching for files > minimum >= 50%) -### Windows PowerShell cmdlets for analyzing usage -**Starting in Windows 10, version 1703**, you can use two new PowerShell cmdlets to check the performance of Delivery Optimization: +### Windows PowerShell cmdlets + +**Starting in Windows 10, version 1703**, you can use new PowerShell cmdlets to check the performance of Delivery Optimization. + +#### Analyze usage `Get-DeliveryOptimizationStatus` returns a real-time snapshot of all current Delivery Optimization jobs. @@ -113,9 +119,11 @@ To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** | BytesfromHTTP | Total number of bytes received over HTTP | | DownloadDuration | Total download time in seconds | | Status | Current state of the operation. Possible values are: **Downloading** (download in progress); **Complete** (download completed, but is not uploading yet); **Caching** (download completed successfully and is ready to upload or uploading); **Paused** (download/upload paused by caller) | - - -  +| NumPeers | Indicates the total number of peers returned from the service. | +| PredefinedCallerApplication | Indicates the last caller that initiated a request for the file. | +| ExpireOn | The target expiration date and time for the file. | +| Pinned | A yes/no value indicating whether an item has been "pinned" in the cache (see `setDeliveryOptmizationStatus`). | + `Get-DeliveryOptimizationPerfSnap` returns a list of key performance data: - Number of files downloaded  @@ -129,9 +137,35 @@ To do this with MDM, go to **.Vendor/MSFT/Policy/Config/DeliveryOptimization/** Using the `-Verbose` option returns additional information: - Bytes from peers (per type)  -- Bytes from CDN  (the number of bytes received over HTTP) +- Bytes from CDN (the number of bytes received over HTTP) - Average number of peer connections per download  +Starting in Window 10, version 1903, `get-DeliveryOptimizationPerfSnap` has a new option `-CacheSummary` which provides a summary of the cache status. + +Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth` returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month. + +#### Manage the Delivery Optimization cache + +**Starting in Windows 10, version 1903:** + +`set-DeliveryOptimizationStatus -ExpireOn [date time]` extends the expiration of all files in the cache. You can set the expiration immediately for all files that are in the "caching" state. For files in progress ("downloading"), the expiration is applied once the download is complete. You can set the expiration up to one year from the current date and time. + +`set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]` extends expiration for a single specific file in the cache. + +You can now "pin" files to keep them persistent in the cache. You can only do this with files that are downloaded in modes 1, 2, or 3. + +`set-DeliveryOptimizationStatus -Pin [True] -File ID [FileID]` keeps a specific file in the cache such that it won't be deleted until the expiration date and time (which you set with `set-DeliveryOptimizationStatus -ExpireOn [date time] -FileID [FileID]`). The file is also excluded from the cache quota calculation. + +`set-DeliveryOptimizationStatus -Pin [False] -File ID [FileID]` "unpins" a file, so that it will be deleted when the expiration date and time are reached. The file is included in the cache quota calculation. + +`delete-DeliveryOptimizationCache` lets you clear files from the cache and remove all persisted data related to them. You can use these options with this cmdlet: + +- `-FileID` specifies a particular file to delete. +- `-IncludePinnedFiles` deletes all files that are pinned. +- `-Force` deletes the cache with no prompts. + + +#### Work with Delivery Optimization logs **Starting in Windows 10, version 1803:** @@ -143,9 +177,7 @@ Log entries are written to the PowerShell pipeline as objects. To dump logs to a [//]: # (section on what to look for in logs, list of peers, connection failures) -`Get-DeliveryOptimizationPerfSnapThisMonth` -Returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month. [//]: # (possibly move to Troubleshooting) diff --git a/windows/deployment/update/waas-delivery-optimization.md b/windows/deployment/update/waas-delivery-optimization.md index 1c13688e4e..9de80024c2 100644 --- a/windows/deployment/update/waas-delivery-optimization.md +++ b/windows/deployment/update/waas-delivery-optimization.md @@ -1,11 +1,14 @@ --- title: Configure Delivery Optimization for Windows 10 updates (Windows 10) +ms.reviewer: +manager: laurawi description: Delivery Optimization is a peer-to-peer distribution method in Windows 10 keywords: oms, operations management suite, wdav, updates, downloads, log analytics ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library -author: JaimeO + +audience: itpro +author: jaimeo ms.localizationpriority: medium ms.author: jaimeo ms.collection: M365-modern-desktop @@ -21,7 +24,7 @@ ms.topic: article > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -Windows updates, upgrades, and applications can contain packages with very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those packages from alternate sources (such as other peers on the network) in addition to the traditional Internet-based servers. You can use Delivery Optimization in conjunction with Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or System Center Configuration Manager (when installation of Express Updates is enabled). +Windows updates, upgrades, and applications can contain packages with very large files. Downloading and distributing updates can consume quite a bit of network resources on the devices receiving them. You can use Delivery Optimization to reduce bandwidth consumption by sharing the work of downloading these packages among multiple devices in your deployment. Delivery Optimization can accomplish this because it is a self-organizing distributed cache that allows clients to download those packages from alternate sources (such as other peers on the network) in addition to the traditional Internet-based servers. You can use Delivery Optimization in conjunction with Windows Update, Windows Server Update Services (WSUS), Windows Update for Business, or Microsoft Endpoint Configuration Manager (when installation of Express Updates is enabled). Delivery Optimization is a cloud-managed solution. Access to the Delivery Optimization cloud services is a requirement. This means that in order to use the peer-to-peer functionality of Delivery Optimization, devices must have access to the internet. @@ -53,14 +56,16 @@ The following table lists the minimum Windows 10 version that supports Delivery | Win32 apps for Intune | 1709 | | SCCM Express Updates | 1709 + Configuration Manager version 1711 | -[//]: # (**Network requirements**) + -By default in Windows 10 Enterprise and Education editions, Delivery Optimization allows peer-to-peer sharing on the organization's own network only (specifically, all of the devices must be behind the same NAT), but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. +In Windows 10 Enterprise, Professional, and Education editions, Delivery Optimization is enabled by default for peer-to-peer sharing on the local network (NAT). Specifically, all of the devices must be behind the same NAT, but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. -For more details, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md#download-mode). +For more details, see "Download mode" in [Delivery optimization reference](waas-delivery-optimization-reference.md). ## Set up Delivery Optimization @@ -72,7 +77,9 @@ You can use Group Policy or an MDM solution like Intune to configure Delivery Op You will find the Delivery Optimization settings in Group Policy under **Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization**. In MDM, the same settings are under **.Vendor/MSFT/Policy/Config/DeliveryOptimization/**. -[//]: # (Starting with Windows Intune version 1902, you can set many Delivery Optimization policies as a profile which you can then apply to groups of devices. For more information, see {LINK}.) +Starting with Microsoft Intune version 1902, you can set many Delivery Optimization policies as a profile which you can then apply to groups of devices. For more information, see [Delivery Optimization settings in Microsoft Intune](https://docs.microsoft.com/intune/delivery-optimization-windows)) + +**Starting with Windows 10, version 1903,** you can use the Azure Active Directory (AAD) Tenant ID as a means to define groups. To do this set the value for DOGroupIdSource to its new maximum value of 5. ## Reference @@ -90,7 +97,12 @@ For more details, check out the [Adopting Windows as a Service at Microsoft](htt **Does Delivery Optimization work with WSUS?**: Yes. Devices will obtain the update payloads from the WSUS server, but must also have an internet connection as they communicate with the Delivery Optimization cloud service for coordination. -**Which ports does Delivery Optimization use?**: For peer-to-peer traffic, it uses 7680 for TCP/IP or 3544 for NAT traversal (optionally Teredo). For client-service communication, it uses HTTP or HTTPS over port 80/443. +**Which ports does Delivery Optimization use?**: Delivery Optimization listens on port 7680 for requests from other peers by using TCP/IP. The service will register and open this port on the device, but you might need to set this port to accept inbound traffic through your firewall yourself. If you don't allow inbound traffic over port 7680, you can't use the peer-to-peer functionality of Delivery Optimization. However, devices can still successfully download by using HTTP or HTTPS traffic over port 80 (such as for default Windows Update data). + +If you set up Delivery Optimization to create peer groups that include devices across NATs (or any form of internal subnet that uses gateways or firewalls between subnets), it will use Teredo. For this to work, you must allow inbound TCP/IP traffic over port 3544. Look for a "NAT traversal" setting in your firewall to set this up. + +Delivery Optimization also communicates with its cloud service by using HTTP/HTTPS over port 80. + **What are the requirements if I use a proxy?**: You must allow Byte Range requests. See [Proxy requirements for Windows Update](https://support.microsoft.com/help/3175743/proxy-requirements-for-windows-update) for details. @@ -110,8 +122,49 @@ For the payloads (optional): **Does Delivery Optimization use multicast?**: No. It relies on the cloud service for peer discovery, resulting in a list of peers and their IP addresses. Client devices then connect to their peers to obtain download files over TCP/IP. -[//]: # (**What data does Delivery Optimization send to the service?**) -[//]: # (??????????????? I'm not sure we can avoid sharing this, per GDPR guidelines) +**How does Delivery Optimization deal with congestion on the router from peer-to-peer activity on the LAN?**: Starting in Windows 10, version 1903, Delivery Optimization uses LEDBAT to relieve such congestion. For more details see this post on the [Networking Blog](https://techcommunity.microsoft.com/t5/Networking-Blog/Windows-Transport-converges-on-two-Congestion-Providers-Cubic/ba-p/339819). + + +## Troubleshooting + +This section summarizes common problems and some solutions to try. + +### If you don't see any bytes from peers + +If you don’t see any bytes coming from peers the cause might be one of the following issues: + +- Clients aren’t able to reach the Delivery Optimization cloud services. +- The cloud service doesn’t see other peers on the network. +- Clients aren’t able to connect to peers that are offered back from the cloud service. + + +### Clients aren't able to reach the Delivery Optimization cloud services. + +If you suspect this is the problem, try these steps: + +1. Start a download of an app that is larger than 50 MB from the Store (for example "Candy Crush Saga"). +2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and observe the DownloadMode setting. For peering to work, DownloadMode should be 1, 2, or 3. +3. If **DownloadMode** is 99 it could indicate your device is unable to reach the Delivery Optimization cloud services. Ensure that the Delivery Optimization hostnames are allowed access: most importantly **\*.do.dsp.mp.microsoft.com**. + + + +### The cloud service doesn't see other peers on the network. + +If you suspect this is the problem, try these steps: + +1. Download the same app on two different devices on the same network, waiting 10 – 15 minutes between downloads. +2. Run `Get-DeliveryOptimizationStatus` from an elevated Powershell window and ensure that **DownloadMode** is 1 or 2 on both devices. +3. Run `Get-DeliveryOptimizationPerfSnap` from an elevated Powershell window on the second device. The **NumberOfPeers** field should be non-zero. +4. If the number of peers is zero and you have **DownloadMode** = 1, ensure that both devices are using the same public IP address to reach the internet. To do this, open a browser Windows and search for “what is my IP”. You can **DownloadMode 2** (Group) and a custom GroupID (Guid) to fix this if the devices aren’t reporting the same public IP address. + + +### Clients aren't able to connect to peers offered by the cloud service + +If you suspect this is the problem, try a Telnet test between two devices on the network to ensure they can connect using port 7680. To do this, follow these steps: + +1. Install Telnet by running **dism /online /Enable-Feature /FeatureName:TelnetClient** from an elevated command prompt. +2. Run the test. For example, if you are on device with IP 192.168.8.12 and you are trying to test the connection to 192.168.9.17 run **telnet 192.168.9.17 7680** (the syntax is *telnet [destination IP] [port]*. You will either see a connection error or a blinking cursor like this /_. The blinking cursor means success. + @@ -135,7 +188,7 @@ For the payloads (optional): - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-deployment-rings-windows-10-updates.md b/windows/deployment/update/waas-deployment-rings-windows-10-updates.md index badacbf568..5888c1f3a1 100644 --- a/windows/deployment/update/waas-deployment-rings-windows-10-updates.md +++ b/windows/deployment/update/waas-deployment-rings-windows-10-updates.md @@ -3,11 +3,11 @@ title: Build deployment rings for Windows 10 updates (Windows 10) description: Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 07/11/2018 +ms.reviewer: +manager: laurawi ms.collection: M365-modern-desktop ms.topic: article --- @@ -18,10 +18,12 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) +> [!NOTE] +> We're in the process of updating this topic with more definitive guidance. In the meantime, see [this post](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Tactical-considerations-for-creating-Windows-deployment-rings/ba-p/746979) on the Windows 10 IT Pro blog for some great suggestions for a deployment ring structure. + For Windows as a service, maintenance is ongoing and iterative. Deploying previous versions of Windows required organizations to build sets of users to roll out the changes in phases. Typically, these users ranged (in order) from the most adaptable and least risky to the least adaptable or riskiest. With Windows 10, a similar methodology exists, but construction of the groups is a little different. Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. They are simply a method by which to separate machines into a deployment timeline. With Windows 10, you construct deployment rings a bit differently in each servicing tool, but the concepts remain the same. Each deployment ring should reduce the risk of issues derived from the deployment of the feature updates by gradually deploying the update to entire departments. As previously mentioned, consider including a portion of each department’s employees in several deployment rings. @@ -35,7 +37,6 @@ Table 1 provides an example of the deployment rings you might use. | Deployment ring | Servicing channel | Deferral for feature updates | Deferral for quality updates | Example | | --- | --- | --- | --- | --- | | Preview | Windows Insider Program | None | None | A few machines to evaluate early builds prior to their arrival to the semi-annual channel | -| Targeted | Semi-annual channel (Targeted) | None | None | Select devices across various teams used to evaluate the major release prior to broad deployment | | Broad | Semi-annual channel | 120 days | 7-14 days | Broadly deployed to most of the organization and monitored for feedback
                              Pause updates if there are critical issues | | Critical | Semi-annual channel | 180 days | 30 days | Devices that are critical and will only receive updates once they've been vetted for a period of time by the majority of the organization | @@ -55,7 +56,7 @@ As Table 1 shows, each combination of servicing channel and deployment group is | ![done](images/checklistdone.png) | Build deployment rings for Windows 10 updates (this topic) | | ![to do](images/checklistbox.gif) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | | ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                              or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                              or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | +| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                              or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                              or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) | ## Related topics @@ -67,6 +68,6 @@ As Table 1 shows, each combination of servicing channel and deployment group is - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) - [Manage software updates in Intune](https://docs.microsoft.com/intune/windows-update-for-business-configure) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-integrate-wufb.md b/windows/deployment/update/waas-integrate-wufb.md index 4bbd1a7ddc..9d8afa433e 100644 --- a/windows/deployment/update/waas-integrate-wufb.md +++ b/windows/deployment/update/waas-integrate-wufb.md @@ -1,13 +1,14 @@ --- -title: Integrate Windows Update for Business with management solutions (Windows 10) -description: Use Windows Update for Business deployments with management tools such as Windows Server Update Services (WSUS) and System Center Configuration Manager. +title: Integrate Windows Update for Business (Windows 10) +description: Use Windows Update for Business deployments with management tools such as Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library author: jaimeo ms.localizationpriority: medium ms.author: jaimeo ms.date: 07/27/2017 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -17,11 +18,10 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS) and System Center Configuration Manager. +You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager. ## Integrate Windows Update for Business with Windows Server Update Services @@ -42,7 +42,7 @@ For Windows 10, version 1607, devices can now be configured to receive updates f - Admin has also put 3rd party drivers on WSUS - +
                              ContentMetadata sourcePayload sourceDeferred?
                              Updates to WindowsWindows UpdateWindows UpdateYes![diagram of content flow](images/wufb-config1a.png)
                              Updates to WindowsWindows UpdateWindows UpdateYesdiagram of content flow
                              Updates to Office and other productsWSUSWSUSNo
                              Third-party driversWSUSWSUSNo
                              @@ -57,7 +57,7 @@ For Windows 10, version 1607, devices can now be configured to receive updates f - + @@ -77,7 +77,7 @@ In this example, the deferral behavior for updates to Office and other non-Windo
                              ContentMetadata sourcePayload sourceDeferred?
                              Updates to Windows (excluding drivers)Windows UpdateWindows UpdateYes![diagram of content flow](images/wufb-config2.png)
                              Updates to Windows (excluding drivers)Windows UpdateWindows UpdateYesdiagram of content flow
                              Updates to Office and other productsWSUSWSUSNo
                              DriversWSUSWSUSNo
                              - +
                              ContentMetadata sourcePayload sourceDeferred?
                              Updates to Windows (excluding drivers)Microsoft UpdateMicrosoft UpdateYes![diagram of content flow](images/wufb-config3a.png)
                              Updates to Windows (excluding drivers)Microsoft UpdateMicrosoft UpdateYesdiagram of content flow
                              Updates to Office and other productsMicrosoft UpdateMicrosoft UpdateNo
                              Drivers, third-party applicationsWSUSWSUSNo
                              @@ -85,7 +85,7 @@ In this example, the deferral behavior for updates to Office and other non-Windo >[!NOTE] > Because the admin enabled **Update/AllowMUUpdateService**, placing the content on WSUS was not needed for the particular device, as the device will always receive Microsoft Update content from Microsoft when configured in this manner. -## Integrate Windows Update for Business with System Center Configuration Manager +## Integrate Windows Update for Business with Microsoft Endpoint Configuration Manager For Windows 10, version 1607, organizations already managing their systems with a Configuration Manager solution can also have their devices configured for Windows Update for Business (i.e. setting deferral policies on those devices). Such devices will be visible in the Configuration Manager console, however they will appear with a detection state of **Unknown**. @@ -107,8 +107,8 @@ For more information, see [Integration with Windows Update for Business in Windo - [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) - [Configure Windows Update for Business](waas-configure-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-manage-updates-configuration-manager.md b/windows/deployment/update/waas-manage-updates-configuration-manager.md index dab2336165..da28265e33 100644 --- a/windows/deployment/update/waas-manage-updates-configuration-manager.md +++ b/windows/deployment/update/waas-manage-updates-configuration-manager.md @@ -1,58 +1,57 @@ --- -title: Deploy Windows 10 updates using System Center Configuration Manager (Windows 10) -description: System Center Configuration Manager provides maximum control over quality and feature updates for Windows 10. +title: Deploy Windows 10 updates via Microsoft Endpoint Configuration Manager +description: Microsoft Endpoint Configuration Manager provides maximum control over quality and feature updates for Windows 10. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 10/16/2017 +ms.reviewer: +manager: laurawi ms.topic: article --- -# Deploy Windows 10 updates using System Center Configuration Manager +# Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager **Applies to** - Windows 10 -- Windows 10 Mobile + > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) >[!IMPORTANT] ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products. -> ->In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. +>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. -System Center Configuration Manager provides maximum control over quality and feature updates for Windows 10. Unlike other servicing tools, Configuration Manager has capabilities that extend beyond servicing, such as application deployment, antivirus management, software metering, and reporting, and provides a secondary deployment method for LTSB clients. Configuration Manager can effectively control bandwidth usage and content distribution through a combination of BranchCache and distribution points. Microsoft encourages organizations currently using Configuration Manager for Windows update management to continue doing so for Windows 10 client computers. + +Microsoft Endpoint Configuration Manager provides maximum control over quality and feature updates for Windows 10. Unlike other servicing tools, Configuration Manager has capabilities that extend beyond servicing, such as application deployment, antivirus management, software metering, and reporting, and provides a secondary deployment method for LTSB clients. Configuration Manager can effectively control bandwidth usage and content distribution through a combination of BranchCache and distribution points. Microsoft encourages organizations currently using Configuration Manager for Windows update management to continue doing so for Windows 10 client computers. You can use Configuration Manager to service Windows 10 devices in two ways. The first option is to use Windows 10 Servicing Plans to deploy Windows 10 feature updates automatically based on specific criteria, similar to an Automatic Deployment Rule for software updates. The second option is to use a task sequence to deploy feature updates, along with anything else in the installation. >[!NOTE] ->This topic focuses on updating and upgrading Windows 10 after it has already been deployed. To use Configuration Manager to upgrade your systems from the Windows 8.1, Windows 8, or Windows 7 operating system, see [Upgrade to Windows 10 with System Center Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager). +>This topic focuses on updating and upgrading Windows 10 after it has already been deployed. To use Configuration Manager to upgrade your systems from the Windows 8.1, Windows 8, or Windows 7 operating system, see [Upgrade to Windows 10 with Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager). ## Windows 10 servicing dashboard -The Windows 10 servicing dashboard gives you a quick-reference view of your active servicing plans, compliance for servicing plan deployment, and other key information about Windows 10 servicing. For details about what each tile on the servicing dashboard represents, see [Manage Windows as a service using System Center Configuration Manager](https://technet.microsoft.com/library/mt627931.aspx). +The Windows 10 servicing dashboard gives you a quick-reference view of your active servicing plans, compliance for servicing plan deployment, and other key information about Windows 10 servicing. For details about what each tile on the servicing dashboard represents, see [Manage Windows as a service using Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt627931.aspx). For the Windows 10 servicing dashboard to display information, you must adhere to the following requirements: - **Heartbeat discovery**. Enable heartbeat discovery for the site receiving Windows 10 servicing information. Configuration for heartbeat discovery can be found in Administration\Overview\Hierarchy Configuration\Discovery Methods. -- **Windows Server Update Service (WSUS)**. System Center Configuration Manager must have the Software update point site system role added and configured to receive updates from a WSUS 4.0 server with the hotfix KB3095113 installed. +- **Windows Server Update Service (WSUS)**. Microsoft Endpoint Configuration Manager must have the Software update point site system role added and configured to receive updates from a WSUS 4.0 server with the hotfix KB3095113 installed. - **Service connection point**. Add the Service connection point site system role in Online, persistent connection mode. - **Upgrade classification**. Select **Upgrade** from the list of synchronized software update classifications. **To configure Upgrade classification** - 1. Go to Administration\Overview\Site Configuration\Sites, and then select your site from the list. + 1. Go to Administration\Overview\Site Configuration\Sites, and then select your site from the list. - 2. On the Ribbon, in the **Settings** section, click **Configure Site Components**, and then click **Software Update Point**. + 2. On the Ribbon, in the **Settings** section, click **Configure Site Components**, and then click **Software Update Point**. ![Example of UI](images/waas-sccm-fig1.png) - 3. In the **Software Update Point Component Properties** dialog box, on the **Classifications** tab, click **Upgrades**. + 3. In the **Software Update Point Component Properties** dialog box, on the **Classifications** tab, click **Upgrades**. When you have met all these requirements and deployed a servicing plan to a collection, you’ll receive information on the Windows 10 servicing dashboard. @@ -65,131 +64,131 @@ Regardless of the method by which you deploy Windows 10 feature updates to your **To create collections for deployment rings** -1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. +1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. -2. On the Ribbon, in the **Create** group, click **Create Device Collection**. +2. On the Ribbon, in the **Create** group, click **Create Device Collection**. -3. In the Create Device Collection Wizard, in the **name** box, type **Windows 10 – All Current Branch for Business**. +3. In the Create Device Collection Wizard, in the **name** box, type **Windows 10 – All Current Branch for Business**. -4. Click **Browse** to select the limiting collection, and then click **All Systems**. +4. Click **Browse** to select the limiting collection, and then click **All Systems**. -5. In **Membership rules**, click **Add Rule**, and then click **Query Rule**. +5. In **Membership rules**, click **Add Rule**, and then click **Query Rule**. -6. Name the rule **CBB Detection**, and then click **Edit Query Statement**. +6. Name the rule **CBB Detection**, and then click **Edit Query Statement**. -7. On the **Criteria** tab, click the **New** icon. +7. On the **Criteria** tab, click the **New** icon. ![Example of UI](images/waas-sccm-fig4.png) -8. In the **Criterion Properties** dialog box, leave the type as **Simple Value**, and then click **Select**. +8. In the **Criterion Properties** dialog box, leave the type as **Simple Value**, and then click **Select**. -9. In the **Select Attribute** dialog box, from the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **OSBranch**, and then click **OK**. +9. In the **Select Attribute** dialog box, from the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **OSBranch**, and then click **OK**. ![Example of UI](images/waas-sccm-fig5.png) >[!NOTE] >Configuration Manager discovers clients’ servicing branch and stores that value in the **OSBranch** attribute, which you will use to create collections based on servicing branch. The values in this attribute can be **0 (Current Branch)**, **1 (Current Branch for Business)**, or **2 (Long-Term Servicing Branch)**. -10. Leave **Operator** set to **is equal to**; in the **Value** box, type **1**. Click **OK**. +10. Leave **Operator** set to **is equal to**; in the **Value** box, type **1**. Click **OK**. ![Example of UI](images/waas-sccm-fig6.png) -11. Now that the **OSBranch** attribute is correct, verify the operating system version. +11. Now that the **OSBranch** attribute is correct, verify the operating system version. -12. On the **Criteria** tab, click the **New** icon again to add criteria. +12. On the **Criteria** tab, click the **New** icon again to add criteria. -13. In the **Criterion Properties** dialog box, click **Select**. +13. In the **Criterion Properties** dialog box, click **Select**. -14. From the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **Operating System Name and Version**, and then click **OK**. +14. From the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **Operating System Name and Version**, and then click **OK**. ![Example of UI](images/waas-sccm-fig7.png) -15. In the **Value** box, type **Microsoft Windows NT Workstation 10.0**, and then click **OK**. +15. In the **Value** box, type **Microsoft Windows NT Workstation 10.0**, and then click **OK**. ![Example of UI](images/waas-sccm-fig8.png) -16. In the **Query Statement Properties** dialog box, you see two values. Click **OK**, and then click **OK** again to continue to the Create Device Collection Wizard. +16. In the **Query Statement Properties** dialog box, you see two values. Click **OK**, and then click **OK** again to continue to the Create Device Collection Wizard. -17. Click **Summary**, and then click **Next**. +17. Click **Summary**, and then click **Next**. -18. Close the wizard. +18. Close the wizard. >[!IMPORTANT] >Windows Insider PCs are discovered the same way as CB or CBB devices. If you have Windows Insider PCs that you use Configuration Manager to manage, then you should create a collection of those PCs and exclude them from this collection. You can create the membership for the Windows Insider collection either manually or by using a query where the operating system build doesn’t equal any of the current CB or CBB build numbers. You would have to update each periodically to include new devices or new operating system builds. After you have updated the membership, this new collection will contain all managed clients on the CBB servicing branch. You will use this collection as a limiting collection for future CBB-based collections and the **Ring 4 Broad broad business users** collection. Complete the following steps to create the **Ring 4 Broad business users** device collection, which you’ll use as a CBB deployment ring for servicing plans or task sequences. -1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. +1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. -2. On the Ribbon, in the **Create** group, click **Create Device Collection**. +2. On the Ribbon, in the **Create** group, click **Create Device Collection**. -3. In the Create Device Collection Wizard, in the **name** box, type **Ring 4 Broad business users**. +3. In the Create Device Collection Wizard, in the **name** box, type **Ring 4 Broad business users**. -4. Click **Browse** to select the limiting collection, and then click **Windows 10 – All Current Branch for Business**. +4. Click **Browse** to select the limiting collection, and then click **Windows 10 – All Current Branch for Business**. -5. In **Membership rules**, click **Add Rule**, and then click **Direct Rule**. +5. In **Membership rules**, click **Add Rule**, and then click **Direct Rule**. -6. In the **Create Direct Membership Rule Wizard** dialog box, click **Next**. +6. In the **Create Direct Membership Rule Wizard** dialog box, click **Next**. -7. In the **Value** field, type all or part of the name of a device to add, and then click **Next**. +7. In the **Value** field, type all or part of the name of a device to add, and then click **Next**. -8. Select the computer that will be part of the **Ring 4 Broad business users** deployment ring, and then click **Next**. +8. Select the computer that will be part of the **Ring 4 Broad business users** deployment ring, and then click **Next**. -9. Click **Next**, and then click **Close**. +9. Click **Next**, and then click **Close**. -10. In the **Create Device Collection Wizard** dialog box, click **Summary**. +10. In the **Create Device Collection Wizard** dialog box, click **Summary**. -11. Click **Next**, and then click **Close**. +11. Click **Next**, and then click **Close**. ## Use Windows 10 servicing plans to deploy Windows 10 feature updates -There are two ways to deploy Windows 10 feature updates with System Center Configuration Manager. The first is to use servicing plans, which provide an automated method to update devices consistently in their respective deployment rings, similar to Automatic Deployment Rules for software updates. +There are two ways to deploy Windows 10 feature updates with Microsoft Endpoint Configuration Manager. The first is to use servicing plans, which provide an automated method to update devices consistently in their respective deployment rings, similar to Automatic Deployment Rules for software updates. **To configure Windows feature updates for CBB clients in the Ring 4 Broad business users deployment ring using a servicing plan** -1. In the Configuration Manager console, go to Software Library\Overview\Windows 10 Servicing, and then click **Servicing Plans**. +1. In the Configuration Manager console, go to Software Library\Overview\Windows 10 Servicing, and then click **Servicing Plans**. -2. On the Ribbon, in the **Create** group, click **Create Servicing Plan**. +2. On the Ribbon, in the **Create** group, click **Create Servicing Plan**. -3. Name the plan **Ring 4 Broad business users Servicing Plan**, and then click **Next**. +3. Name the plan **Ring 4 Broad business users Servicing Plan**, and then click **Next**. -4. On the **Servicing Plan page**, click **Browse**. Select the **Ring 4 Broad business users** collection, which you created in the [Create collections for deployment rings](#create-collections-for-deployment-rings) section, click **OK**, and then click **Next**. +4. On the **Servicing Plan page**, click **Browse**. Select the **Ring 4 Broad business users** collection, which you created in the [Create collections for deployment rings](#create-collections-for-deployment-rings) section, click **OK**, and then click **Next**. >[!IMPORTANT] >Microsoft added a new protection feature to Configuration Manager that prevents accidental installation of high-risk deployments such as operating system upgrades on site systems. If you select a collection (All Systems in this example) that has a site system in it, you may receive the following message. > >![This is a high-risk deployment](images/waas-sccm-fig9.png) > - >For details about how to manage the settings for high-risk deployments in Configuration Manager, see [Settings to manage high-risk deployments for System Center Configuration Manager](https://technet.microsoft.com/library/mt621992.aspx). + >For details about how to manage the settings for high-risk deployments in Configuration Manager, see [Settings to manage high-risk deployments for Microsoft Endpoint Configuration Manager](https://technet.microsoft.com/library/mt621992.aspx). -5. On the **Deployment Ring** page, select the **Business Ready (Current Branch for Business)** readiness state, leave the delay at **0 days**, and then click **Next**. +5. On the **Deployment Ring** page, select the **Business Ready (Current Branch for Business)** readiness state, leave the delay at **0 days**, and then click **Next**. Doing so deploys CBB feature updates to the broad business users deployment ring immediately after they are released to CBB. On the Upgrades page, you specify filters for the feature updates to which this servicing plan is applicable. For example, if you wanted this plan to be only for Windows 10 Enterprise, you could select **Title**, and then type **Enterprise**. -6. For this example, on the **Upgrades** page, click **Next** to leave the criterion blank. +6. For this example, on the **Upgrades** page, click **Next** to leave the criterion blank. -7. On the **Deployment Schedule** page, click **Next** to keep the default values of making the content available immediately and requiring installation by the 7-day deadline. +7. On the **Deployment Schedule** page, click **Next** to keep the default values of making the content available immediately and requiring installation by the 7-day deadline. -8. On the **User Experience** page, from the **Deadline behavior** list, select **Software Installation and System restart (if necessary)**. From the **Device restart behavior** list, select **Workstations**, and then click **Next**. +8. On the **User Experience** page, from the **Deadline behavior** list, select **Software Installation and System restart (if necessary)**. From the **Device restart behavior** list, select **Workstations**, and then click **Next**. Doing so allows installation and restarts after the 7-day deadline on workstations only. -9. On the **Deployment Package** page, select **Create a new deployment package**. In **Name**, type **CBB Upgrades**, select a share for your package source location, and then click **Next**. +9. On the **Deployment Package** page, select **Create a new deployment package**. In **Name**, type **CBB Upgrades**, select a share for your package source location, and then click **Next**. In this example, \\contoso-cm01\Sources\Windows 10 Feature Upgrades is a share on the Configuration Manager server that contains all the Windows 10 feature updates. ![Example of UI](images/waas-sccm-fig10.png) -10. On the **Distribution Points** page, from the **Add** list, select **Distribution Point**. +10. On the **Distribution Points** page, from the **Add** list, select **Distribution Point**. ![Example of UI](images/waas-sccm-fig11.png) Select the distribution points that serve the clients to which you’re deploying this servicing plan, and then click **OK**. -11. Click **Summary**, click **Next** to complete the servicing plan, and then click **Close**. +11. Click **Summary**, click **Next** to complete the servicing plan, and then click **Close**. You have now created a servicing plan for the **Ring 4 Broad business users** deployment ring. By default, this rule is evaluated each time the software update point is synchronized, but you can modify this schedule by viewing the service plan’s properties on the **Evaluation Schedule** tab. @@ -206,62 +205,59 @@ There are times when deploying a Windows 10 feature update requires the use of a Each time Microsoft releases a new Windows 10 build, it releases a new .iso file containing the latest build, as well. Regardless of the scenario that requires a task sequence to deploy the Windows 10 upgrade, the base process is the same. Start by creating an Operating System Upgrade Package in the Configuration Manager console: -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages. +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages. -2. On the Ribbon, in the **Create** group, click **Add Operating System Upgrade Package**. +2. On the Ribbon, in the **Create** group, click **Add Operating System Upgrade Package**. -3. On the **Data Source** page, type the path of the extracted .iso file of the new version of Windows 10 you’re deploying, and then click **Next**. +3. On the **Data Source** page, type the path of the extracted .iso file of the new version of Windows 10 you’re deploying, and then click **Next**. In this example, the Windows 10 Enterprise 1607 installation media is deployed to \\contoso-cm01\Sources\Operating Systems\Windows 10 Enterprise\Windows 10 Enterprise - Version 1607. - - >[!NOTE] - >System Center Configuration Manager version 1606 is required to manage machines running Windows 10, version 1607. - -4. On the **General** page, in the **Name** field, type the name of the folder (**Windows 10 Enterprise - Version 1607** in this example). Set the **Version** to **1607**, and then click **Next**. -5. On the **Summary** page, click **Next** to create the package. +4. On the **General** page, in the **Name** field, type the name of the folder (**Windows 10 Enterprise - Version 1607** in this example). Set the **Version** to **1607**, and then click **Next**. -6. On the **Completion** page, click **Close**. +5. On the **Summary** page, click **Next** to create the package. + +6. On the **Completion** page, click **Close**. Now that the operating system upgrade package has been created, the content in that package must be distributed to the correct distribution points so that the clients can access the content. Complete the following steps to distribute the package content to distribution points: -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages, and then select the **Windows 10 Enterprise – Version 1607** software upgrade package. +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages, and then select the **Windows 10 Enterprise – Version 1607** software upgrade package. -2. On the Ribbon, in the **Deployment group**, click **Distribute Content**. +2. On the Ribbon, in the **Deployment group**, click **Distribute Content**. -3. In the Distribute Content Wizard, on the **General** page, click **Next**. +3. In the Distribute Content Wizard, on the **General** page, click **Next**. -4. On the **Content Destination** page, click **Add**, and then click **Distribution Point**. +4. On the **Content Destination** page, click **Add**, and then click **Distribution Point**. -5. In the **Add Distribution Points** dialog box, select the distribution point that will serve the clients receiving this package, and then click **OK**. +5. In the **Add Distribution Points** dialog box, select the distribution point that will serve the clients receiving this package, and then click **OK**. -6. On the **Content Destination** page, click **Next**. +6. On the **Content Destination** page, click **Next**. -7. On the **Summary** page, click **Next** to distribute the content to the selected distribution point. +7. On the **Summary** page, click **Next** to distribute the content to the selected distribution point. -8. On the **Completion** page, click **Close**. +8. On the **Completion** page, click **Close**. Now that the upgrade package has been created and its contents distributed, create the task sequence that will use it. Complete the following steps to create the task sequence, using the previously created deployment package: -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences. +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences. -2. On the Ribbon, in the **Create** group, click **Create Task Sequence**. +2. On the Ribbon, in the **Create** group, click **Create Task Sequence**. -3. In the Create Task Sequence Wizard, on the **Create a new task sequence** page, select **Upgrade an operating system from upgrade package**, and then click **Next**. +3. In the Create Task Sequence Wizard, on the **Create a new task sequence** page, select **Upgrade an operating system from upgrade package**, and then click **Next**. -4. On the **Task Sequence Information** page, in **Task sequence name**, type **Upgrade Windows 10 Enterprise – Version 1607**, and then click **Next**. +4. On the **Task Sequence Information** page, in **Task sequence name**, type **Upgrade Windows 10 Enterprise – Version 1607**, and then click **Next**. -5. On the **Upgrade the Windows Operating system** page, click **Browse**, select the deployment package you created in the previous steps, and then click **OK**. +5. On the **Upgrade the Windows Operating system** page, click **Browse**, select the deployment package you created in the previous steps, and then click **OK**. -6. Click **Next**. +6. Click **Next**. -7. On the **Include Updates** page, select **Available for installation – All software updates**, and then click **Next**. +7. On the **Include Updates** page, select **Available for installation – All software updates**, and then click **Next**. -8. On the **Install Applications** page, click **Next**. +8. On the **Install Applications** page, click **Next**. -9. On the **Summary** page, click **Next** to create the task sequence. +9. On the **Summary** page, click **Next** to create the task sequence. -10. On the **Completion** page, click **Close**. +10. On the **Completion** page, click **Close**. With the task sequence created, you’re ready to deploy it. If you’re using this method to deploy most of your Windows 10 feature updates, you may want to create deployment rings to stage the deployment of this task sequence, with delays appropriate for the respective deployment ring. In this example, you deploy the task sequence to the **Ring 4 Broad business users collection**. @@ -270,29 +266,29 @@ With the task sequence created, you’re ready to deploy it. If you’re using t **To deploy your task sequence** -1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences, and then select the **Upgrade Windows 10 Enterprise – Version 1607** task sequence. +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences, and then select the **Upgrade Windows 10 Enterprise – Version 1607** task sequence. -2. On the Ribbon, in the **Deployment** group, click **Deploy**. +2. On the Ribbon, in the **Deployment** group, click **Deploy**. -3. In the Deploy Software Wizard, on the **General** page, click **Browse**. Select the target collection, click **OK**, and then click **Next**. +3. In the Deploy Software Wizard, on the **General** page, click **Browse**. Select the target collection, click **OK**, and then click **Next**. -4. On the **Deployment Settings** page, for **purpose**, select **Required**, and then click **Next**. +4. On the **Deployment Settings** page, for **purpose**, select **Required**, and then click **Next**. -5. On the **Scheduling** page, select the **Schedule when this deployment will become available** check box (it sets the current time by default). For **Assignment schedule**, click **New**. +5. On the **Scheduling** page, select the **Schedule when this deployment will become available** check box (it sets the current time by default). For **Assignment schedule**, click **New**. -6. In the **Assignment Schedule** dialog box, click **Schedule**. +6. In the **Assignment Schedule** dialog box, click **Schedule**. -7. In the **Custom Schedule** dialog box, select the desired deadline, and then click **OK**. +7. In the **Custom Schedule** dialog box, select the desired deadline, and then click **OK**. -8. In the **Assignment Schedule** dialog box, click **OK**, and then click **Next**. +8. In the **Assignment Schedule** dialog box, click **OK**, and then click **Next**. -9. On the **User Experience** page, in the **When the scheduled assignment time is reached, allow the following activities to be performed outside of the maintenance window** section, select **Software Installation** and **System restart** (if required to complete the installation), and then click **Next**. +9. On the **User Experience** page, in the **When the scheduled assignment time is reached, allow the following activities to be performed outside of the maintenance window** section, select **Software Installation** and **System restart** (if required to complete the installation), and then click **Next**. -10. Use the defaults for the remaining settings. +10. Use the defaults for the remaining settings. -11. Click **Summary**, and then click **Next** to deploy the task sequence. +11. Click **Summary**, and then click **Next** to deploy the task sequence. -12. Click **Close**. +12. Click **Close**. ## Steps to manage updates for Windows 10 @@ -304,11 +300,11 @@ With the task sequence created, you’re ready to deploy it. If you’re using t | ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | | ![done](images/checklistdone.png) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | | ![done](images/checklistdone.png) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                              or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                              or Deploy Windows 10 updates using System Center Configuration Manager (this topic) | +| ![done](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                              or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                              or Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager (this topic) | ## See also -[Manage Windows as a service using System Center Configuration Manager](https://docs.microsoft.com/sccm/osd/deploy-use/manage-windows-as-a-service) +[Manage Windows as a service using Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/osd/deploy-use/manage-windows-as-a-service) ## Related topics @@ -326,7 +322,7 @@ With the task sequence created, you’re ready to deploy it. If you’re using t - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md index 8b2a68dd3b..14223dbdc3 100644 --- a/windows/deployment/update/waas-manage-updates-wsus.md +++ b/windows/deployment/update/waas-manage-updates-wsus.md @@ -3,11 +3,11 @@ title: Deploy Windows 10 updates using Windows Server Update Services (Windows 1 description: WSUS allows companies to defer, selectively approve, choose when delivered, and determine which devices receive updates. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 10/16/2017 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -21,11 +21,10 @@ ms.topic: article > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) >[!IMPORTANT] ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products. -> ->In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. +>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy or the registry. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. -WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they’re delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but does not provide all the scheduling options and deployment flexibility that System Center Configuration Manager provides. + +WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they’re delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but does not provide all the scheduling options and deployment flexibility that Microsoft Endpoint Configuration Manager provides. When you choose WSUS as your source for Windows updates, you use Group Policy to point Windows 10 client devices to the WSUS server for their updates. From there, updates are periodically downloaded to the WSUS server and managed, approved, and deployed through the WSUS administration console or Group Policy, streamlining enterprise update management. If you’re currently using WSUS to manage Windows updates in your environment, you can continue to do so in Windows 10. @@ -33,35 +32,23 @@ When you choose WSUS as your source for Windows updates, you use Group Policy to ## Requirements for Windows 10 servicing with WSUS -To be able to use WSUS to manage and deploy Windows 10 feature updates, you must have WSUS 4.0, which is available in the Windows Server 2012 R2 and Windows Server 2012 operating systems. In addition to WSUS 4.0, you must install the [KB3095113](https://support.microsoft.com/kb/3095113) and [KB3159706](https://support.microsoft.com/kb/3159706) patches on the WSUS server. +To be able to use WSUS to manage and deploy Windows 10 feature updates, you must use a supported WSUS version: +- WSUS 10.0.14393 (role in Windows Server 2016) +- WSUS 10.0.17763 (role in Windows Server 2019) +- WSUS 6.2 and 6.3 (role in Windows Server 2012 and Windows Server 2012 R2) +- KB 3095113 and KB 3159706 (or an equivalent update) must be installed on WSUS 6.2 and 6.3. + +> [!IMPORTANT] +> Both [KB 3095113](https://support.microsoft.com/kb/3095113) and [KB 3159706](https://support.microsoft.com/kb/3159706) are included in the **Security Monthly Quality Rollup** starting in July 2017. This means you might not see KB 3095113 and KB 3159706 as installed updates since they might have been installed with a rollup. However, if you need either of these updates, we recommend installing a **Security Monthly Quality Rollup** released after **October 2017** since they contain an additional WSUS update to decrease memory utilization on WSUS's clientwebservice. +>If you have synced either of these updates prior to the security monthly quality rollup, you can experience problems. To recover from this, see [How to Delete Upgrades in WSUS](https://blogs.technet.microsoft.com/wsus/2016/01/29/how-to-delete-upgrades-in-wsus/). + ## WSUS scalability To use WSUS to manage all Windows updates, some organizations may need access to WSUS from a perimeter network, or they might have some other complex scenario. WSUS is highly scalable and configurable for organizations of any size or site layout. For specific information about scaling WSUS, including upstream and downstream server configuration, branch offices, WSUS load balancing, and other complex scenarios, see [Choose a Type of WSUS Deployment](https://technet.microsoft.com/library/cc720448%28v=ws.10%29.aspx). -## Express Installation Files -With Windows 10, quality updates will be larger than traditional Windows Updates because they’re cumulative. To manage the bandwidth clients downloading large updates like these will need, WSUS has a feature called *Express Installation Files*. - - At a binary level, files associated with updates may not change a lot. In fact, with cumulative quality updates, most of the content will be from previous updates. Rather than downloading the entire update when only a small percentage of the payload is actually different, Express Installation Files analyze the differences between the new files associated with an update and the existing files on the client. This approach significantly reduces the amount of bandwidth used because only a fraction of the update content is actually delivered. - - **To configure WSUS to download Express Update Files** - -1. Open the WSUS Administration Console. - -2. In the navigation pane, go to *Your_Server*\\**Options**. - -3. In the **Options** section, click **Update Files and Languages**. - - ![Example of UI](images/waas-wsus-fig1.png) - -4. In the **Update Files and Languages** dialog box, select **Download express installation files**. - - ![Example of UI](images/waas-wsus-fig2.png) - - >[!NOTE] - >Because Windows 10 updates are cumulative, enabling Express Installation Files when WSUS is configured to download Windows 10 updates will significantly increase the amount of disk space that WSUS requires. Alternatively, when using Express Installation Files for previous versions of Windows, the feature’s positive effects aren’t noticeable because the updates aren’t cumulative. ## Configure automatic updates and update service location @@ -69,41 +56,41 @@ When using WSUS to manage updates on Windows client devices, start by configurin **To configure the Configure Automatic Updates and Intranet Microsoft Update Service Location Group Policy settings for your environment** -1. Open GPMC. +1. Open Group Policy Management Console (gpmc.msc). -2. Expand Forest\Domains\\*Your_Domain*. +2. Expand *Forest\Domains\\*Your_Domain**. -3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. +3. Right-click **Your_Domain**, and then select **Create a GPO in this domain, and Link it here**. - ![Example of UI](images/waas-wsus-fig3.png) + ![Example of UI](images/waas-wsus-fig3.png) - >[!NOTE] - >In this example, the **Configure Automatic Updates** and **Intranet Microsoft Update Service Location** Group Policy settings are specified for the entire domain. This is not a requirement; you can target these settings to any security group by using Security Filtering or a specific OU. + >[!NOTE] + >In this example, the **Configure Automatic Updates** and **Intranet Microsoft Update Service Location** Group Policy settings are specified for the entire domain. This is not a requirement; you can target these settings to any security group by using Security Filtering or a specific OU. -4. In the **New GPO** dialog box, name the new GPO **WSUS – Auto Updates and Intranet Update Service Location**. +4. In the **New GPO** dialog box, name the new GPO **WSUS – Auto Updates and Intranet Update Service Location**. -5. Right-click the **WSUS – Auto Updates and Intranet Update Service Location** GPO, and then click **Edit**. +5. Right-click the **WSUS – Auto Updates and Intranet Update Service Location** GPO, and then click **Edit**. -6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. +6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. -7. Right-click the **Configure Automatic Updates** setting, and then click **Edit**. +7. Right-click the **Configure Automatic Updates** setting, and then click **Edit**. - ![Example of UI](images/waas-wsus-fig4.png) + ![Example of UI](images/waas-wsus-fig4.png) -8. In the **Configure Automatic Updates** dialog box, select **Enable**. +8. In the **Configure Automatic Updates** dialog box, select **Enable**. -9. Under **Options**, from the **Configure automatic updating** list, select **3 - Auto download and notify for install**, and then click **OK**. +9. Under **Options**, from the **Configure automatic updating** list, select **3 - Auto download and notify for install**, and then click **OK**. - ![Example of UI](images/waas-wsus-fig5.png) + ![Example of UI](images/waas-wsus-fig5.png) - >[!NOTE] - ?There are three other settings for automatic update download and installation dates and times. This is simply the option this example uses. For more examples of how to control automatic updates and other related policies, see [Configure Automatic Updates by Using Group Policy](https://technet.microsoft.com/library/cc720539%28v=ws.10%29.aspx). + > [!NOTE] + > There are three other settings for automatic update download and installation dates and times. This is simply the option this example uses. For more examples of how to control automatic updates and other related policies, see [Configure Automatic Updates by Using Group Policy](https://technet.microsoft.com/library/cc720539%28v=ws.10%29.aspx). -9. Right-click the **Specify intranet Microsoft update service location** setting, and then click **Edit**. +10. Right-click the **Specify intranet Microsoft update service location** setting, and then select **Edit**. -9. In the **Specify intranet Microsoft update service location** dialog box, select **Enable**. +11. In the **Specify intranet Microsoft update service location** dialog box, select **Enable**. -12. Under **Options**, in the **Set the intranet update service for detecting updates** and **Set the intranet statistics server** options, type **http://Your_WSUS_Server_FQDN:PortNumber**, and then click **OK**. +12. Under **Options**, in the **Set the intranet update service for detecting updates** and **Set the intranet statistics server** options, type http://Your_WSUS_Server_FQDN:PortNumber, and then select **OK**. >[!NOTE] >The URL `http://CONTOSO-WSUS1.contoso.com:8530` in the following image is just an example. In your environment, be sure to use the server name and port number for your WSUS instance. @@ -111,7 +98,7 @@ When using WSUS to manage updates on Windows client devices, start by configurin ![Example of UI](images/waas-wsus-fig6.png) >[!NOTE] - >The default HTTP port for WSUS is 8530, and the default HTTP over Secure Sockets Layer (HTTPS) port is 8531. If you’re unsure which port WSUS is using for client communication, right-click the WSUS Administration site in IIS Manager, and then click **Edit Bindings**. + >The default HTTP port for WSUS is 8530, and the default HTTP over Secure Sockets Layer (HTTPS) port is 8531. (The other options are 80 and 443; no other ports are supported.) As Windows clients refresh their computer policies (the default Group Policy refresh setting is 90 minutes and when a computer restarts), computers start to appear in WSUS. Now that clients are communicating with the WSUS server, create the computer groups that align with your deployment rings. @@ -124,19 +111,20 @@ You can use computer groups to target a subset of devices that have specific qua **To create computer groups in the WSUS Administration Console** -1. Open the WSUS Administration Console. +1. Open the WSUS Administration Console. -2. Go to *Server_Name*\Computers\All Computers, and then click **Add Computer Group**. +2. Go to *Server_Name*\Computers\All Computers, and then click **Add Computer Group**. ![Example of UI](images/waas-wsus-fig7.png) 3. Type **Ring 2 Pilot Business Users** for the name, and then click **Add**. -4. Repeat these steps for the **Ring 3 Broad IT** and **Ring 4 Broad Business Users** groups. When you’re finished, there should be three deployment ring groups. +4. Repeat these steps for the **Ring 3 Broad IT** and **Ring 4 Broad Business Users** groups. When you’re finished, there should be three deployment ring groups. Now that the groups have been created, add the computers to the computer groups that align with the desired deployment rings. You can do this through [Group Policy](#wsus-gp) or manually by using the [WSUS Administration Console](#wsus-admin). + ## Use the WSUS Administration Console to populate deployment rings Adding computers to computer groups in the WSUS Administration Console is simple, but it could take much longer than managing membership through Group Policy, especially if you have many computers to add. Adding computers to computer groups in the WSUS Administration Console is called *server-side targeting*. @@ -149,15 +137,15 @@ When new computers communicate with WSUS, they appear in the **Unassigned Comput **To assign computers manually** -1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers\Unassigned Computers. +1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers\Unassigned Computers. Here, you see the new computers that have received the GPO you created in the previous section and started communicating with WSUS. This example has only two computers; depending on how broadly you deployed your policy, you will likely have many computers here. -2. Select both computers, right-click the selection, and then click **Change Membership**. +2. Select both computers, right-click the selection, and then click **Change Membership**. ![Example of UI](images/waas-wsus-fig8.png) -3. In the **Set Computer Group Membership** dialog box, select the **Ring 2 Pilot Business Users** deployment ring, and then click **OK**. +3. In the **Set Computer Group Membership** dialog box, select the **Ring 2 Pilot Business Users** deployment ring, and then click **OK**. Because they were assigned to a group, the computers are no longer in the **Unassigned Computers** group. If you select the **Ring 2 Pilot Business Users** computer group, you will see both computers there. @@ -175,7 +163,7 @@ Another way to add multiple computers to a deployment ring in the WSUS Administr ![Example of UI](images/waas-wsus-fig9.png) -4. Select the **Ring 3 Broad IT** deployment ring, and then click **OK**. +4. Select the **Ring 3 Broad IT** deployment ring, and then click **OK**. You can now see these computers in the **Ring 3 Broad IT** computer group. @@ -187,11 +175,11 @@ The WSUS Administration Console provides a friendly interface from which you can **To configure WSUS to allow client-side targeting from Group Policy** -1. Open the WSUS Administration Console, and go to *Server_Name*\Options, and then click **Computers**. +1. Open the WSUS Administration Console, and go to *Server_Name*\Options, and then click **Computers**. ![Example of UI](images/waas-wsus-fig10.png) -2. In the **Computers** dialog box, select **Use Group Policy or registry settings on computers**, and then click **OK**. +2. In the **Computers** dialog box, select **Use Group Policy or registry settings on computers**, and then click **OK**. >[!NOTE] >This option is exclusively either-or. When you enable WSUS to use Group Policy for group assignment, you can no longer manually add computers through the WSUS Administration Console until you change the option back. @@ -203,39 +191,42 @@ Now that WSUS is ready for client-side targeting, complete the following steps t >[!TIP] >When using client-side targeting, consider giving security groups the same names as your deployment rings. Doing so simplifies the policy-creation process and helps ensure that you don’t add computers to the incorrect rings. -1. Open GPMC. +1. Open Group Policy Management Console (gpmc.msc). -2. Expand Forest\Domains\\*Your_Domain*. +2. Expand Forest\Domains\\*Your_Domain*. -3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. +3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. -4. In the **New GPO** dialog box, type **WSUS – Client Targeting – Ring 4 Broad Business Users** for the name of the new GPO. +4. In the **New GPO** dialog box, type **WSUS – Client Targeting – Ring 4 Broad Business Users** for the name of the new GPO. -5. Right-click the **WSUS – Client Targeting – Ring 4 Broad Business Users** GPO, and then click **Edit**. +5. Right-click the **WSUS – Client Targeting – Ring 4 Broad Business Users** GPO, and then click **Edit**. ![Example of UI](images/waas-wsus-fig11.png) -6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. +6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. -7. Right-click **Enable client-side targeting**, and then click **Edit**. +7. Right-click **Enable client-side targeting**, and then click **Edit**. -8. In the **Enable client-side targeting** dialog box, select **Enable**. +8. In the **Enable client-side targeting** dialog box, select **Enable**. -9. In the **Target group name for this computer** box, type **Ring 4 Broad Business Users**. This is the name of the deployment ring in WSUS to which these computers will be added. +9. In the **Target group name for this computer** box, type *Ring 4 Broad Business Users*. This is the name of the deployment ring in WSUS to which these computers will be added. ![Example of UI](images/waas-wsus-fig12.png) -10. Close the Group Policy Management Editor. +> [!WARNING] +> The target group name must match the computer group name. + +10. Close the Group Policy Management Editor. Now you’re ready to deploy this GPO to the correct computer security group for the **Ring 4 Broad Business Users** deployment ring. **To scope the GPO to a group** -1. In GPMC, select the **WSUS – Client Targeting – Ring 4 Broad Business Users** policy. +1. In GPMC, select the **WSUS – Client Targeting – Ring 4 Broad Business Users** policy. -2. Click the **Scope** tab. +2. Click the **Scope** tab. -3. Under **Security Filtering**, remove the default **AUTHENTICATED USERS** security group, and then add the **Ring 4 Broad Business Users** group. +3. Under **Security Filtering**, remove the default **AUTHENTICATED USERS** security group, and then add the **Ring 4 Broad Business Users** group. ![Example of UI](images/waas-wsus-fig13.png) @@ -246,82 +237,88 @@ The next time the clients in the **Ring 4 Broad Business Users** security group For clients that should have their feature updates approved as soon as they’re available, you can configure Automatic Approval rules in WSUS. >[!NOTE] ->WSUS respects the client’s servicing branch. If you approve a feature update while it is still Current Branch (CB), WSUS will install the update only on PCs that are in the CB servicing branch. When Microsoft releases the build for Current Branch for Business (CBB), the PCs in the CBB servicing branch will install it. +>WSUS respects the client device's servicing branch. If you approve a feature update while it is still in one branch, such as Insider Preview, WSUS will install the update only on devices that are in that servicing branch. When Microsoft releases the build for Semi-Annual Channel, the devices in the Semi-Annual Channel will install it. Windows Update for Business branch settings do not apply to feature updates through WSUS. + **To configure an Automatic Approval rule for Windows 10 feature updates and approve them for the Ring 3 Broad IT deployment ring** -1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Options, and then select **Automatic Approvals**. +1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Options, and then select **Automatic Approvals**. -2. On the **Update Rules** tab, click **New Rule**. +2. On the **Update Rules** tab, click **New Rule**. -3. In the **Add Rule** dialog box, select the **When an update is in a specific classification**, **When an update is in a specific product**, and **Set a deadline for the approval** check boxes. +3. In the **Add Rule** dialog box, select the **When an update is in a specific classification**, **When an update is in a specific product**, and **Set a deadline for the approval** check boxes. ![Example of UI](images/waas-wsus-fig14.png) -4. In the **Edit the properties** area, select **any classification**. Clear everything except **Upgrades**, and then click **OK**. +4. In the **Edit the properties** area, select **any classification**. Clear everything except **Upgrades**, and then click **OK**. -5. In the **Edit the properties area**, click the **any product** link. Clear all check boxes except **Windows 10**, and then click **OK**. +5. In the **Edit the properties area**, click the **any product** link. Clear all check boxes except **Windows 10**, and then click **OK**. Windows 10 is under All Products\Microsoft\Windows. -6. In the **Edit the properties** area, click the **all computers** link. Clear all the computer group check boxes except **Ring 3 Broad IT**, and then click **OK**. +6. In the **Edit the properties** area, click the **all computers** link. Clear all the computer group check boxes except **Ring 3 Broad IT**, and then click **OK**. -7. Leave the deadline set for **7 days after the approval at 3:00 AM**. +7. Leave the deadline set for **7 days after the approval at 3:00 AM**. -8. In the **Step 3: Specify a name** box, type **Windows 10 Upgrade Auto-approval for Ring 3 Broad IT**, and then click **OK**. +8. In the **Step 3: Specify a name** box, type **Windows 10 Upgrade Auto-approval for Ring 3 Broad IT**, and then click **OK**. ![Example of UI](images/waas-wsus-fig15.png) -9. In the **Automatic Approvals** dialog box, click **OK**. +9. In the **Automatic Approvals** dialog box, click **OK**. >[!NOTE] - >WSUS does not honor any existing month/week/day deferral settings for CB or CBB. That said, if you’re using Windows Update for Business for a computer for which WSUS is also managing updates, when WSUS approves the update, it will be installed on the computer regardless of whether you configured Group Policy to wait. + >WSUS does not honor any existing month/week/day [deferral settings](waas-configure-wufb.md#configure-when-devices-receive-feature-updates). That said, if you’re using Windows Update for Business for a computer for which WSUS is also managing updates, when WSUS approves the update, it will be installed on the computer regardless of whether you configured Group Policy to wait. Now, whenever Windows 10 feature updates are published to WSUS, they will automatically be approved for the **Ring 3 Broad IT** deployment ring with an installation deadline of 1 week. +> [!WARNING] +> The auto approval rule runs after synchronization occurs. This means that the *next* upgrade for each Windows 10 version will be approved. If you select **Run Rule**, all possible updates that meet the criteria will be approved, potentially including older updates that you don't actually want--which can be a problem when the download sizes are very large. + ## Manually approve and deploy feature updates -You can manually approve updates and set deadlines for installation within the WSUS Administration Console, as well. To simplify the manual approval process, start by creating a software update view that contains only Windows 10 updates. +You can manually approve updates and set deadlines for installation within the WSUS Administration Console, as well. It might be best to approve update rules manually after your pilot deployment has been updated. + +To simplify the manual approval process, start by creating a software update view that contains only Windows 10 updates. **To approve and deploy feature updates manually** 1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates. In the **Action** pane, click **New Update View**. -2. In the **Add Update View** dialog box, select **Updates are in a specific classification** and **Updates are for a specific product**. +2. In the **Add Update View** dialog box, select **Updates are in a specific classification** and **Updates are for a specific product**. -3. Under **Step 2: Edit the properties**, click **any classification**. Clear all check boxes except **Upgrades**, and then click **OK**. +3. Under **Step 2: Edit the properties**, click **any classification**. Clear all check boxes except **Upgrades**, and then click **OK**. -4. Under **Step 2: Edit the properties**, click **any product**. Clear all check boxes except **Windows 10**, and then click **OK**. +4. Under **Step 2: Edit the properties**, click **any product**. Clear all check boxes except **Windows 10**, and then click **OK**. Windows 10 is under All Products\Microsoft\Windows. -5. In the **Step 3: Specify a name** box, type **All Windows 10 Upgrades**, and then click **OK**. +5. In the **Step 3: Specify a name** box, type **All Windows 10 Upgrades**, and then click **OK**. ![Example of UI](images/waas-wsus-fig16.png) -Now that you have the All Windows 10 Upgrades view, complete the following steps to manually approve an update for the **Ring 4 Broad Business Users** deployment ring: +Now that you have the **All Windows 10 Upgrades** view, complete the following steps to manually approve an update for the **Ring 4 Broad Business Users** deployment ring: -1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates\All Windows 10 Upgrades. +1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates\All Windows 10 Upgrades. -2. Right-click the feature update you want to deploy, and then click **Approve**. +2. Right-click the feature update you want to deploy, and then click **Approve**. ![Example of UI](images/waas-wsus-fig17.png) -3. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, select **Approved for Install**. +3. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, select **Approved for Install**. ![Example of UI](images/waas-wsus-fig18.png) -4. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, click **Deadline**, click **One Week**, and then click **OK**. +4. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, click **Deadline**, click **One Week**, and then click **OK**. ![Example of UI](images/waas-wsus-fig19.png) -5. If the **Microsoft Software License Terms** dialog box opens, click **Accept**. +5. If the **Microsoft Software License Terms** dialog box opens, click **Accept**. If the deployment is successful, you should receive a successful progress report. ![Example of UI](images/waas-wsus-fig20.png) -6. In the **Approval Progress** dialog box, click **Close**. +6. In the **Approval Progress** dialog box, click **Close**.
                              @@ -334,7 +331,7 @@ Now that you have the All Windows 10 Upgrades view, complete the following steps | ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | | ![done](images/checklistdone.png) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | | ![done](images/checklistdone.png) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![done](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                              or Deploy Windows 10 updates using Windows Server Update Services (this topic)
                              or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | +| ![done](images/checklistdone.png) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                              or Deploy Windows 10 updates using Windows Server Update Services (this topic)
                              or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) | @@ -353,6 +350,6 @@ Now that you have the All Windows 10 Upgrades view, complete the following steps - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) +- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-manage-updates-wufb.md b/windows/deployment/update/waas-manage-updates-wufb.md index be96b68e59..2486006471 100644 --- a/windows/deployment/update/waas-manage-updates-wufb.md +++ b/windows/deployment/update/waas-manage-updates-wufb.md @@ -1,9 +1,10 @@ --- title: Deploy updates using Windows Update for Business (Windows 10) +ms.reviewer: +manager: laurawi description: Windows Update for Business lets you manage when devices received updates from Windows Update. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library author: jaimeo ms.localizationpriority: medium ms.author: jaimeo @@ -16,111 +17,97 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile - Windows Server 2016 - Windows Server 2019 +Windows Update for Business is a free service that is available for Windows Pro, Enterprise, Pro for Workstation, and Education editions. + > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) -Windows Update for Business enables information technology administrators to keep the Windows 10 devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Windows Update service. You can use Group Policy or MDM solutions such as Intune to configure the Windows Update for Business settings that control how and when Windows 10 devices are updated. In addition, by using Intune, organizations can manage devices that are not joined to a domain at all or are joined to Microsoft Azure Active Directory (Azure AD) alongside your on-premises domain-joined devices. Windows Update for Business leverages diagnostic data to provide reporting and insights into an organization's Windows 10 devices. - -Specifically, Windows Update for Business allows for: - -- The creation of deployment rings, where administrators can specify which devices go first in an update wave, and which ones will come later (to allow for reliability and performance testing on a subset of systems before rolling out updates across the organization). -- Selectively including or excluding drivers as part of Microsoft-provided updates -- Integration with existing management tools such as Windows Server Update Services (WSUS), System Center Configuration Manager, and Microsoft Intune. -- Peer-to-peer delivery for Microsoft updates, which optimizes bandwidth efficiency and reduces the need for an on-site server caching solution. -- Control over diagnostic data level to provide reporting and insights in Windows Analytics. - -Windows Update for Business is a free service that is available for Windows Pro, Enterprise, Pro Education, and Education editions. +Windows Update for Business enables IT administrators to keep the Windows 10 devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Windows Update service. You can use Group Policy or MDM solutions such as Microsoft Intune to configure the Windows Update for Business settings that control how and when Windows 10 devices are updated. + +Specifically, Windows Update for Business allows for control over update offering and experience to allow for reliability and performance testing on a subset of systems before rolling out updates across the organization as well as a positive update experience for those within your organization. >[!NOTE] ->See [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) to learn more about deployment rings in Windows 10. +> To use Windows Update for Business, you must allow devices to access the Windows Update service. -## Update types +## Types of updates managed by Windows Update for Business -Windows Update for Business provides three types of updates to Windows 10 devices: +Windows Update for Business provides management policies for several types of updates to Windows 10 devices: -- **Feature Updates**: previously referred to as *upgrades*, Feature Updates contain not only security and quality revisions, but also significant feature additions and changes; they are released semi-annually. -- **Quality Updates**: these are traditional operating system updates, typically released the second Tuesday of each month (though they can be released at any time). These include security, critical, and driver updates. Windows Update for Business also treats non-Windows updates (such as those for Microsoft Office or Visual Studio) as Quality Updates. These non-Windows Updates are known as *Microsoft Updates* and devices can be optionally configured to receive such updates along with their Windows Updates. -- **Non-deferrable updates**: Currently, antimalware and antispyware Definition Updates from Windows Update cannot be deferred. +- **Feature updates:** previously referred to as upgrades, feature updates contain not only security and quality revisions, but also significant feature additions and changes; they are released semi-annually in the fall and in the spring. +- **Quality updates:** these are traditional operating system updates, typically released the second Tuesday of each month (though they can be released at any time). These include security, critical, and driver updates. Windows Update for Business also treats non-Windows updates (such as those for Microsoft Office or Visual Studio) as quality updates. These non-Windows Updates are known as "Microsoft updates" and can configure devices to receive or not receive such updates along with their Windows updates. +- **Driver updates:** these are non-Microsoft drivers that are applicable to your devices. Driver updates can be turned off by using Windows Update for Business policies. +- **Microsoft product updates**: these are updates for other Microsoft products, such as Office. These updates can be enabled or disabled by using Windows Update for Business policy. + + + +## Offering + +You can control when updates are applied, for example by deferring when an update is installed on a device or by pausing updates for a certain period. + +### Manage which updates are offered + +Windows Update for Business offers you the ability to turn on or off both driver and Microsoft product updates. + +- Drivers (on/off): When "on," this policy will not include drivers with Windows Update. +- Microsoft product updates (on/off): When "on" this policy will install updates for other Microsoft products. + + +### Manage when updates are offered +You can defer or pause the installation of updates for a set period of time. + +#### Defer or pause an update + +A Windows Update for Business administrator can defer the installation of both feature and quality updates from deploying to devices within a bounded range of time from when those updates are first made available on the Windows Update service. You can use this deferral to allow time to validate deployments as they are pushed to devices. Deferrals work by allowing you to specify the number of days after an update is released before it is offered to a device (if you set a feature update deferral period of 365 days, the device will not install a feature update that has been released for less than 365 days). To defer feature updates use the **Select when Preview Builds and Feature Updates are Received** policy. + + +|Category |Maximum deferral | +|---------|---------| +|Feature updates | 365 days | +|Quality updates | 30 days | +|Non-deferrable | none | + +#### Pause an update + +If you discover a problem while deploying a feature or quality update, the IT administrator can pause the update for 35 days to prevent other devices from installing it until the issue is mitigated. + +If you pause a feature update, quality updates are still offered to devices to ensure they stay secure. The pause period for both feature and quality updates is calculated from a start date that you set. + +To pause feature updates use the **Select when Preview Builds and Feature Updates are Received** policy and to pause quality updates use the **Select when Quality Updates are Received** policy. For more information, see [Pause feature updates](waas-configure-wufb.md#pause-feature-updates) and [Pause quality updates](waas-configure-wufb.md#pause-quality-updates). + +#### Select branch readiness level for feature updates + +The branch readiness level enables administrators to specify which channel of feature updates they want to receive. Today there are branch readiness level options for both pre-release and released updates: + +- Windows Insider Program for Business pre-release updates + - Windows Insider Fast + - Windows Insider Slow + - Windows Insider Release Preview +- Semi-annual Channel for released updates -Both Feature and Quality Updates can be deferred from deploying to client devices by a Windows Update for Business administrator within a bounded range of time from when those updates are first made available on the Windows Update Service. This deferral capability allows administrators to validate deployments as they are pushed to all client devices configured for Windows Update for Business. Deferrals work by allowing you to specify the number of days after an update is released before it is offered to a device (if you set a deferral period of 365 days, the update will not be offered until 365 days after that update was released). +Prior to Windows 10, version 1903, there are two channels for released updates: Semi-annual Channel and Semi-annual Channel (Targeted). Deferral days are calculated against the release date of the chosen channel. Starting with Windows 10, version 1903 there is only the one release channel: Semi-annual Channel. All deferral days will be calculated against a release’s Semi-annual Channel release date. To see release dates, visit [Windows Release Information](https://docs.microsoft.com/windows/release-information/). You can set the branch readiness level by using the **Select when Preview Builds and Feature Updates are Received** policy. In order to use this to manage pre-release builds, first enable preview builds by using the **Manage preview Builds** policy. -| Category | Maximum deferral | Deferral increments | Example | WSUS classification GUID | -| --- | --- | --- | --- | --- | -| Feature Updates | 365 days | Days | From Windows 10, version 1511 to version 1607 maximum was 180 days.
                              From Windows 10, version 1703 to version 1809, the maximum is 365 days. | 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5 | -| Quality Updates | 30 days | Days | Security updates
                              Drivers (optional)
                              Non-security updates
                              Microsoft updates (Office,Visual Studio, etc.) | 0FA1201D-4330-4FA8-8AE9-B877473B6441

                              EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0

                              CD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83

                              varies | -| Non-deferrable | No deferral | No deferral | Definition updates | E0789628-CE08-4437-BE74-2495B842F43B | +### Recommendations ->[!NOTE] ->For information about classification GUIDs, see [WSUS Classification GUIDs](https://msdn.microsoft.com/library/ff357803.aspx). - -## Windows Update for Business in various Windows 10 versions - -Windows Update for Business was first available in Windows 10, version 1511. This diagram lists new or changed capabilities and updated behavior in subsequent versions. - - -| Windows 10, version 1511 | 1607 | 1703 | 1709 | 1803 | 1809 | -| --- | --- | --- | --- | --- | --- | -| Defer quality updates
                              Defer feature updates
                              Pause updates | All 1511 features, plus: **WSUS integration** | All 1607 features, plus **Settings controls** | All 1703 features, plus **Ability to set slow vs. fast Insider Preview branch** | All 1709 features, plus **Uninstall updates remotely** | All 1803 features, plus **Option to use default automatic updates**
                              **Ability to set separate deadlines for feature vs. quality updates**
                              **Admins can prevent users from pausing updates** -## Managing Windows Update for Business with Group Policy - -The group policy path for Windows Update for Business has changed to correctly reflect its association to Windows Update for Business and provide the ability to easily manage pre-release Windows Insider Preview builds in Windows 10, version 1709. - -| Action | Windows 10 versions prior to 1709 | Windows 10 versions after 1709 | -| --- | --- | --- | -| Set Windows Update for Business Policies | Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Update | Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business | -| Manage Windows Insider Preview builds | Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds/Toggle user control over Insider builds | Computer Configuration/Administrative Templates/Windows Components/Windows Update/Windows Update for Business - *Manage preview builds* | -| Manage when updates are received | Select when Feature Updates are received | Select when Preview Builds and Feature Updates are received
                              (Computer Configuration/Administrative Templates/Windows Components/Windows Update/ Windows Update for Business - **Select when Preview Builds and Feature Updates are received**) | - -## Managing Windows Update for Business with MDM - -Starting with Windows 10, version 1709, the Windows Update for Business settings in MDM were changed to correctly reflect the associations with Windows Update for Business and provide the ability to easily manage Windows Insider Preview builds in 1709. - -| Action | Windows 10 versions prior to 1709 | Windows 10 versions after 1709 | -| --- | --- | --- | -| Manage Windows Insider Preview builds | System/AllowBuildPreview | Update/ManagePreviewBuilds | -| Manage when updates are received | Select when Feature Updates are received | Select when Preview Builds and Feature Updates are received (Update/BranchReadinessLevel) | - -## Managing Windows Update for Business with Software Center Configuration Manager - -Starting with Windows 10, version 1709, you can assign a collection of devices to have dual scan enabled and manage that collection with Windows Update for Business policies. Starting with Windows 10, version 1809, you can set a collection of devices to receive the Windows Insider Preview Feature Updates from Windows Update from within Software Center Configuration Manager. - -| Action | Windows 10 versions between 1709 and 1809 | Windows 10 versions after 1809 | -| --- | --- | --- | -| Manage Windows Update for Business in Configuration Manager | Manage Feature or Quality Updates with Windows Update for Business via Dual Scan | Manage Insider pre-release builds with Windows Update for Business within Software Center Configuration Manager | - -## Managing Windows Update for Business with Windows Settings options -Windows Settings includes options to control certain Windows Update for Business features: - -- [Configure the readiness level](waas-configure-wufb.md#configure-devices-for-the-appropriate-service-channel) for a branch by using **Settings > Update & security > Windows Update > Advanced options** -- [Pause feature updates](waas-configure-wufb.md#pause-feature-updates) by using Settings > Update & security > Window Update > Advanced options - -## Other changes in Windows Update for Business in Windows 10, version 1703 and later releases - - -### Pause and deferral periods - -The maximum pause time period is 35 days for both quality and feature updates. The maximum deferral period for feature updates is 365 days. - -Also, the pause period is calculated from the set start date. For more details, see [Pause Feature Updates](waas-configure-wufb.md#pause-feature-updates) and [Pause Quality Updates](waas-configure-wufb.md#pause-quality-updates). As a result, certain policy keys have different names; see the "Comparing keys in Windows 10, version 1607 to Windows 10, version 1703" section in [Configure Windows Update for Business](waas-configure-wufb.md) for details. +For the best experience with Windows Update, follow these guidelines: +- Use devices for at least 6 hours per month, including at least 2 hours of continuous use. +- Keep devices regularly charged. Plugging in devices overnight enables them to automatically update outside of active hours. +- Make sure that devices have at least 10 GB of free space. +- Give devices unobstructed access to the Windows Update service. ## Monitor Windows Updates by using Update Compliance -Update Compliance provides a holistic view of OS update compliance, update deployment progress, and failure troubleshooting for Windows 10 devices. This new service uses diagnostic data including installation progress, Windows Update configuration, and other information to provide such insights, at no extra cost and without additional infrastructure requirements. Whether used with Windows Update for Business or other management tools, you can be assured that your devices are properly updated. +Update Compliance provides a holistic view of operating system update compliance, update deployment progress, and failure troubleshooting for Windows 10 devices. This service uses diagnostic data including installation progress, Windows Update configuration, and other information to provide such insights, at no extra cost and without extra infrastructure requirements. Whether used with Windows Update for Business or other management tools, you can be assured that your devices are properly updated. ![Update Compliance Dashboard](images/waas-wufb-update-compliance.png) For more information about Update Compliance, see [Monitor Windows Updates using Update Compliance](update-compliance-monitor.md). -## Manage Windows Update for Business with Intune - -Microsoft Intune provides the ability to configure Windows Update for Business settings on devices. Intune doesn’t store the updates, but only the update policy assignment. For more information, see [Manage software updates](https://docs.microsoft.com/intune/windows-update-for-business-configure). ## Steps to manage updates for Windows 10 @@ -131,7 +118,7 @@ Microsoft Intune provides the ability to configure Windows Update for Business s | ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | | ![done](images/checklistdone.png) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | | ![done](images/checklistdone.png) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![done](images/checklistdone.png) | Deploy updates using Windows Update for Business (this topic)
                              or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                              or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | +| ![done](images/checklistdone.png) | Deploy updates using Windows Update for Business (this topic)
                              or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                              or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) | ## Related topics - [Update Windows 10 in the enterprise](index.md) @@ -146,9 +133,9 @@ Microsoft Intune provides the ability to configure Windows Update for Business s - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-mobile-updates.md b/windows/deployment/update/waas-mobile-updates.md index e9493106b4..abb64e0561 100644 --- a/windows/deployment/update/waas-mobile-updates.md +++ b/windows/deployment/update/waas-mobile-updates.md @@ -1,13 +1,13 @@ --- -title: Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile (Windows 10) -description: tbd +title: Deploy updates to Windows 10 Mobile or Windows 10 IoT Mobile +description: Deploy updates to devices in your organization that are running Windows 10 Mobile Enterprise or Windows 10 IoT Mobile. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 07/27/2017 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -17,43 +17,29 @@ ms.topic: article **Applies to** - Windows 10 Mobile -- [Windows 10 IoT Mobile](https://www.microsoft.com/en-us/WindowsForBusiness/windows-iot) +- [Windows 10 IoT Mobile](https://www.microsoft.com/WindowsForBusiness/windows-iot) > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) >[!TIP] >If you're not familiar with the Windows 10 servicing or release channels, read [Servicing channels](waas-overview.md#servicing-channels) first. -Devices running Windows 10 Mobile and Windows 10 IoT Mobile receive updates from the Semi-annual channel unless you [enroll the device in the Windows Insider Program](waas-servicing-channels-windows-10-updates.md#enroll-devices-in-the-windows-insider-program) or assign the device to Current Branch for Business (CBB). Only devices running Windows 10 Mobile Enterprise or Windows 10 IoT Mobile can be assigned to CBB. +Devices running Windows 10 Mobile and Windows 10 IoT Mobile receive updates from the Semi-annual Channel unless you [enroll the device in the Windows Insider Program](waas-servicing-channels-windows-10-updates.md#enroll-devices-in-the-windows-insider-program). [Learn how to upgrade Windows 10 Mobile to Windows 10 Mobile Enterprise](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades) -
                              ->[!IMPORTANT] ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products. -> ->In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. -| Windows 10 edition | CB | CBB | Insider Program | -| --- | --- | --- | --- | --- | -| Mobile | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Mobile Enterprise | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | -| IoT Mobile | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | +| Windows 10 edition | Semi-annual Channel | Insider Program | +| --- | --- | --- | --- | +| Mobile | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Mobile Enterprise | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | +| IoT Mobile | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | -
                              -Configuration of Windows 10 Mobile and Windows 10 IoT Mobile devices is limited to the feature set pertaining to Quality Updates only. That is, Windows Mobile Feature Updates are categorized the same as Quality Updates, and can only be deferred by setting the Quality Update deferral period, for a maximum period of 30 days. You can use mobile device management (MDM) to manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. Updates cannot be managed for Windows 10 Mobile. -## Windows 10, version 1511 +Configuration of Windows 10 Mobile and Windows 10 IoT Mobile devices is limited to the feature set pertaining to quality updates only. That is, Windows Mobile feature updates are categorized the same as quality updates, and can only be deferred by setting the quality update deferral period, for a maximum period of 30 days. You can use mobile device management (MDM) to manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile. Updates cannot be managed for Windows 10 Mobile. -Only the following Windows Update for Business policies are supported for Windows 10 Mobile and Windows 10 IoT Mobile: - -- ../Vendor/MSFT/Policy/Config/Update/RequireDeferredUpgrade -- ../Vendor/MSFT/Policy/Config/Update/DeferUpdatePeriod -- ../Vendor/MSFT/Policy/Config/Update/PauseDeferrals - -To defer the update period or pause deferrals, the device must be configured for CBB servicing branch by applying the **RequireDeferredUpgrade** policy. ## Windows 10, version 1607 @@ -63,9 +49,8 @@ Only the following Windows Update for Business policies are supported for Window - ../Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatesInDays - ../Vendor/MSFT/Policy/Config/Update/PauseQualityUpdates -In version 1607, you can defer and pause updates for devices on both the CB and CBB servicing branches. -If a device running Windows 10 Mobile Enterprise or Windows 10 IoT Mobile, version 1511, has Windows Update for Business policies applied and is then updated to version 1607, version 1511 policies continue to apply until version 1607 policies are applied. + @@ -83,9 +68,9 @@ If a device running Windows 10 Mobile Enterprise or Windows 10 IoT Mobile, versi - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-morenews.md b/windows/deployment/update/waas-morenews.md index 59ac096f8d..c7be3666ed 100644 --- a/windows/deployment/update/waas-morenews.md +++ b/windows/deployment/update/waas-morenews.md @@ -1,11 +1,14 @@ --- -title: Windows as a service +title: Windows as a service news & resources ms.prod: w10 ms.topic: article ms.manager: elizapo -author: lizap -ms.author: elizapo -ms.date: 12/19/2018 +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.author: jaimeo +ms.reviewer: +manager: laurawi ms.localizationpriority: high ms.topic: article --- @@ -14,6 +17,20 @@ ms.topic: article Here's more news about [Windows as a service](windows-as-a-service.md):
                                +
                              • Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization - June 25, 2019
                                • +
                              • Updating Windows 10, version 1903 using Configuration Manager or WSUS - May 23, 2019
                                • +
                              • What’s new in Windows Update for Business in Windows 10, version 1903 - May 21, 2019
                                • +
                              • What’s new for IT pros in Windows 10, version 1903 - May 21, 2019
                                • +
                              • How to get the Windows 10 May 2019 Update - May 21, 2019
                                • +
                              • The benefits of Windows 10 Dynamic Update - April 17, 2019
                                • +
                              • Improving the Windows 10 update experience with control, quality and transparency - April 4, 2019
                                • +
                              • Call to action: review your Windows Update for Business deferral values - April 3, 2019
                                • +
                              • Windows 10, version 1809 designated for broad deployment - March 28, 2019
                                • +
                              • Data, insights and listening to improve the customer experience - March 6, 2019
                                • +
                              • Getting to know the Windows update history pages - February 21, 2019
                                • +
                              • Windows Update for Business and the retirement of SAC-T - February 14, 2019
                                • +
                              • Application compatibility in the Windows ecosystem - January 15, 2019
                                • +
                              • Windows monthly security and quality updates overview - January 10, 2019
                              • Driver quality in the Windows ecosystem - December 19, 2018
                              • Modern Desktop Podcast - Episode 001 – Windows 10 Monthly Quality Updates - December 18, 2018
                              • Measuring Delivery Optimization and its impact to your network - December 13, 2018
                                • @@ -27,10 +44,10 @@ Here's more news about [Windows as a service](windows-as-a-service.md):
                              • How to get the Windows 10 October 2018 Update - October 2, 2018
                              • Reducing Windows 10 Package Size Downloads for x64 Systems - September 26, 2018
                              • Windows 7 Servicing Stack Updates: Managing Change and Appreciating Cumulative Updates - September 21, 2018
                                • -
                              • Helping customers shift to a modern desktop - September 6, 2018
                                • -
                              • Windows Update for Business & Windows Analytics: a real-world experience - September 5, 2018
                                • -
                              • What's next for Windows 10 and Windows Server quality updates - August 16, 2018
                                • -
                              • Windows 10 monthly updates - August 1, 2018 (**video**)
                                • +
                              • Helping customers shift to a modern desktop - September 6, 2018
                                • +
                              • Windows Update for Business & Windows Analytics: a real-world experience - September 5, 2018
                                • +
                              • What's next for Windows 10 and Windows Server quality updates - August 16, 2018
                                • +
                              • Windows 10 monthly updates - August 1, 2018 (video)
                              • Windows 10 update servicing cadence - August 1, 2018
                              • Windows 10 quality updates explained and the end of delta updates - July 11, 2018
                              • AI Powers Windows 10 April 2018 Update Rollout - June 14, 2018
                                • diff --git a/windows/deployment/update/waas-optimize-windows-10-updates.md b/windows/deployment/update/waas-optimize-windows-10-updates.md index d44fb4db2e..1e0f4be7b7 100644 --- a/windows/deployment/update/waas-optimize-windows-10-updates.md +++ b/windows/deployment/update/waas-optimize-windows-10-updates.md @@ -3,11 +3,11 @@ title: Optimize update delivery for Windows 10 updates (Windows 10) description: Two methods of peer-to-peer content distribution are available in Windows 10, Delivery Optimization and BranchCache. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 09/24/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -33,7 +33,7 @@ Two methods of peer-to-peer content distribution are available in Windows 10. >[!NOTE] >Full BranchCache functionality is supported in Windows 10 Enterprise and Education; Windows 10 Pro supports some BranchCache functionality, including BITS transfers used for servicing operations. - Windows Server Update Services (WSUS) and System Center Configuration Manager can use BranchCache to allow peers to source content from each other versus always having to contact a server. Using BranchCache, files are cached on each individual client, and other clients can retrieve them as needed. This approach distributes the cache rather than having a single point of retrieval, saving a significant amount of bandwidth while drastically reducing the time that it takes for clients to receive the requested content. + Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager can use BranchCache to allow peers to source content from each other versus always having to contact a server. Using BranchCache, files are cached on each individual client, and other clients can retrieve them as needed. This approach distributes the cache rather than having a single point of retrieval, saving a significant amount of bandwidth while drastically reducing the time that it takes for clients to receive the requested content.

                                @@ -42,20 +42,20 @@ Two methods of peer-to-peer content distribution are available in Windows 10. | Delivery Optimization | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | | BranchCache | ![no](images/crossmark.png) | ![no](images/crossmark.png) |![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ->[!NOTE] ->System Center Configuration Manager has an additional feature called Client Peer Cache that allows peer-to-peer content sharing between clients you use System Center Configuration Manager to manage, in the same Configuration Manager boundary Group. For more information, see [Client Peer Cache](https://docs.microsoft.com/sccm/core/plan-design/hierarchy/client-peer-cache). +> [!NOTE] +> Microsoft Endpoint Configuration Manager has an additional feature called Client Peer Cache that allows peer-to-peer content sharing between clients you use Microsoft Endpoint Configuration Manager to manage, in the same Configuration Manager boundary Group. For more information, see [Client Peer Cache](https://docs.microsoft.com/configmgr/core/plan-design/hierarchy/client-peer-cache). > ->In addition to Client Peer Cache, similar functionality is available in the Windows Preinstallation Environment (Windows PE) for imaging-related content. Using this technology, clients imaging with System Center Configuration Manager task sequences can source operating system images, driver packages, boot images, packages, and programs from peers instead of distribution points. For detailed information about how Windows PE Peer Cache works and how to configure it, see [Prepare Windows PE peer cache to reduce WAN traffic in System Center Configuration Manager](https://technet.microsoft.com/library/mt613173.aspx). +> In addition to Client Peer Cache, similar functionality is available in the Windows Preinstallation Environment (Windows PE) for imaging-related content. Using this technology, clients imaging with Microsoft Endpoint Configuration Manager task sequences can source operating system images, driver packages, boot images, packages, and programs from peers instead of distribution points. For detailed information about how Windows PE Peer Cache works and how to configure it, see [Prepare Windows PE peer cache to reduce WAN traffic in Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/osd/get-started/prepare-windows-pe-peer-cache-to-reduce-wan-traffic). ## Express update delivery Windows 10 quality update downloads can be large because every package contains all previously released fixes to ensure consistency and simplicity. Windows has been able to reduce the size of Windows Update downloads with a feature called Express. ->[!NOTE] ->Express update delivery applies to quality update downloads. Starting with Windows 10, version 1709, Express update delivery also applies to feature update downloads for clients connected to Windows Update and Windows Update for Business. +> [!NOTE] +> Express update delivery applies to quality update downloads. Starting with Windows 10, version 1709, Express update delivery also applies to feature update downloads for clients connected to Windows Update and Windows Update for Business. ### How Microsoft supports Express -- **Express on System Center Configuration Manager** starting with version 1702 of Configuration Manager and Windows 10, version 1703 or later, or Windows 10, version 1607 with the April 2017 cumulative update. +- **Express on Microsoft Endpoint Configuration Manager** starting with version 1702 of Configuration Manager and Windows 10, version 1703 or later, or Windows 10, version 1607 with the April 2017 cumulative update. - **Express on WSUS Standalone** Express update delivery is available on [all support versions of WSUS](https://technet.microsoft.com/library/cc708456(v=ws.10).aspx). @@ -81,8 +81,8 @@ The Windows Update client will try to download Express first, and under certain At this point, the download is complete and the update is ready to be installed. ->[!TIP] ->Express will **always** be leveraged if your machines are updated regularly with the latest cumulative updates. +> [!TIP] +> Express will **always** be leveraged if your machines are updated regularly with the latest cumulative updates. ## Steps to manage updates for Windows 10 @@ -93,12 +93,11 @@ At this point, the download is complete and the update is ready to be installed. | ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | | ![done](images/checklistdone.png) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | | ![done](images/checklistdone.png) | Optimize update delivery for Windows 10 updates (this topic) | -| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                                or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                                or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | +| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                                or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                                or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) | ## Related topics - - [Update Windows 10 in the enterprise](index.md) - [Deploy updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) - [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) @@ -106,5 +105,5 @@ At this point, the download is complete and the update is ready to be installed. - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-overview.md b/windows/deployment/update/waas-overview.md index 3d46e34a86..812e47c937 100644 --- a/windows/deployment/update/waas-overview.md +++ b/windows/deployment/update/waas-overview.md @@ -1,14 +1,14 @@ --- title: Overview of Windows as a service (Windows 10) -description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy. +description: Windows as a service introduces a new way to build, deploy, and service Windows. Learn how Windows as a service works. keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: Jaimeo +author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 09/24/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -18,18 +18,12 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile - Windows 10 IoT Mobile > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time. -Click the following Microsoft Mechanics video for an overview of the release model, particularly the Semi-Annual Channel. - - -[![YouTube video of Michael Niehouse explaining how the Semi-Annual Channel works](images/SAC_vid_crop.jpg)](https://youtu.be/qSAsiM01GOU) - ## Building Prior to Windows 10, Microsoft released new versions of Windows every few years. This traditional deployment schedule imposed a training burden on users because the feature revisions were often significant. That schedule also meant waiting long periods without new features — a scenario that doesn’t work in today’s rapidly changing world, a world in which new security, management, and deployment capabilities are necessary to address challenges. Windows as a service will deliver smaller feature updates two times per year, around March and September, to help address these issues. @@ -70,33 +64,32 @@ To align with this new update delivery model, Windows 10 has three servicing cha ### Naming changes -As part of the alignment with Windows 10 and Office 365 ProPlus, we are adopting common terminology to make it as easy as possible to understand the servicing process. Going forward, these are the new terms we will be using: -* Semi-Annual Channel - We will be referring to Current Branch (CB) as "Semi-Annual Channel (Targeted)", while Current Branch for Business (CBB) will simply be referred to as "Semi-Annual Channel". -* Long-Term Servicing Channel -  The Long-Term Servicing Branch (LTSB) will be referred to as Long-Term Servicing Channel (LTSC). +There are currently two release channels for Windows 10: + +- The **Semi-Annual Channel** receives feature updates twice per year. +- The **Long Term Servicing Channel**, which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. >[!IMPORTANT] ->With each Semi-Annual Channel release, we recommend beginning deployment right away to devices selected for early adoption (targeted validation) and ramp up to full deployment at your discretion, regardless of the "Targeted" designation. This will enable you to gain access to new features, experiences, and integrated security as soon as possible. For more information, see the blog post [Windows 10 and the "disappearing" SAC-T](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-and-the-disappearing-SAC-T/ba-p/199747). +>With each Semi-Annual Channel release, we recommend beginning deployment right away to devices selected for early adoption (targeted validation) and ramp up to full deployment at your discretion. This will enable you to gain access to new features, experiences, and integrated security as soon as possible. The "Semi-Annual Channel (Targeted)" designation is no longer used. For more information, see the blog post [Windows 10 and the "disappearing" SAC-T](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-and-the-disappearing-SAC-T/ba-p/199747). ->[!NOTE] +> [!NOTE] >For additional information, see the section about [Servicing Channels](#servicing-channels). > >You can also read the blog post [Waas simplified and aligned](https://blogs.technet.microsoft.com/windowsitpro/2017/07/27/waas-simplified-and-aligned/), with details on this change. >[!IMPORTANT] ->Devices on the Semi-Annual Channel (formerly called Current Branch for Business) must have their diagnostic data set to **1 (Basic)** or higher, in order to ensure that the service is performing at the expected quality. If diagnostic data is set to **0**, the device will be treated as if it were in the Semi-Annual Channel (Targeted)(formerly called Current Branch or CB) branch. For instructions to set the diagnostic data level, see [Configure the operating system diagnostic data level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#diagnostic-data-levels). +>Devices on the Semi-Annual Channel must have their diagnostic data set to **1 (Basic)** or higher, in order to ensure that the service is performing at the expected quality. For instructions to set the diagnostic data level, see [Configure the operating system diagnostic data level](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#diagnostic-data-levels). ### Feature updates With Windows 10, Microsoft will package new features into feature updates that can be deployed using existing management tools. Because feature updates are delivered more frequently than with previous Windows releases — twice per year, around March and September, rather than every 3–5 years — changes will be in bite-sized chunks rather than all at once and end user readiness time much shorter. ->[!TIP] -> The feature update cadence has been aligned with Office 365 ProPlus updates. Starting with this falls' update, both Windows and Office will deliver their major updates semi-annually, around March and September. See [upcoming changes to Office 365 ProPlus update management](https://support.office.com/article/Overview-of-the-upcoming-changes-to-Office-365-ProPlus-update-management-78b33779-9356-4cdf-9d2c-08350ef05cca) for more information about changes to Office update management. ### Quality updates Monthly updates in previous Windows versions were often overwhelming because of the sheer number of updates available each month. Many organizations selectively chose which updates they wanted to install and which they didn’t, and this created countless scenarios in which organizations deployed essential security updates but picked only a subset of non-security fixes. -In Windows 10, rather than receiving several updates each month and trying to figure out which the organization needs, which ultimately causes platform fragmentation, administrators will see one cumulative monthly update that supersedes the previous month’s update, containing both security and non-security fixes. This approach makes patching simpler and ensures that customers’ devices are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from patching. The left side of Figure 1 provides an example of Windows 7 devices in an enterprise and what their current patch level might look like. On the right is what Microsoft’s test environment PCs contain. This drastic difference is the basis for many compatibility issues and system anomalies related to Windows updates. +In Windows 10, rather than receiving several updates each month and trying to figure out which the organization needs, which ultimately causes platform fragmentation, administrators will see one cumulative monthly update that supersedes the previous month’s update, containing both security and non-security fixes. This approach makes patching simpler and ensures that customers’ devices are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from patching. The left side of Figure 1 provides an example of Windows 7 devices in an enterprise and what their current patch level might look like. On the right is what Microsoft’s test environment devices contain. This drastic difference is the basis for many compatibility issues and system anomalies related to Windows updates. **Figure 1** @@ -108,58 +101,58 @@ In Windows 10, rather than receiving several updates each month and trying to fi To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing channels to allow customers to designate how frequently their individual devices are updated. For example, an organization may have test devices that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity. -With that in mind, Windows 10 offers 3 servicing channels. The [Windows Insider Program](#windows-insider) provides organizations with the opportunity to test and provide feedback on features that will be shipped in the next feature update. The [Semi-Annual Channel](#semi-annual-channel) provides new functionality with twice-per-year feature update releases. Organizations can choose when to deploy updates from the Semi-Annual Channel. The [Long Term Servicing Channel](#long-term-servicing-channel), which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. For details about the versions in each servicing channel, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). +With that in mind, Windows 10 offers three servicing channels. The [Windows Insider Program](#windows-insider) provides organizations with the opportunity to test and provide feedback on features that will be shipped in the next feature update. The [Semi-Annual Channel](#semi-annual-channel) provides new functionality with twice-per-year feature update releases. Organizations can choose when to deploy updates from the Semi-Annual Channel. The [Long Term Servicing Channel](#long-term-servicing-channel), which is designed to be used only for specialized devices (which typically don't run Office) such as those that control medical equipment or ATM machines, receives new feature releases every two to three years. For details about the versions in each servicing channel, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). The concept of servicing channels is new, but organizations can use the same management tools they used to manage updates and upgrades in previous versions of Windows. For more information about the servicing tool options for Windows 10 and their capabilities, see [Servicing tools](#servicing-tools). ->[!NOTE] ->Servicing channels are not the only way to separate groups of devices when consuming updates. Each channel can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing channels, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md). +> [!NOTE] +> Servicing channels are not the only way to separate groups of devices when consuming updates. Each channel can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing channels, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md). ### Semi-Annual Channel -In the Semi-Annual servicing channel, feature updates are available as soon as Microsoft releases them. Windows 10, version 1511, had few servicing tool options to delay feature updates, limiting the use of the Semi-Annual servicing channel. Windows 10, version 1607 and onward, includes more servicing tools that can delay feature updates for up to 365 days. This servicing model is ideal for pilot deployments and testing of Windows 10 feature updates and for users such as developers who need to work with the latest features immediately. Once the latest release has gone through pilot deployment and testing, you will be able to choose the timing at which it goes into broad deployment. +In the Semi-Annual servicing channel, feature updates are available as soon as Microsoft releases them. Windows 10, version 1511, had few servicing tool options to delay feature updates, limiting the use of the Semi-Annual servicing channel. Starting with Windows 10, version 1607, more servicing tools that can delay feature updates for up to 365 days are available. This servicing model is ideal for pilot deployments and testing of Windows 10 feature updates and for users such as developers who need to work with the latest features immediately. Once the latest release has gone through pilot deployment and testing, you will be able to choose the timing at which it goes into broad deployment. -When Microsoft officially releases a feature update for Windows 10, it is made available to any PC not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft System Center Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the Semi-Annual Channel will be available but not necessarily immediately mandatory, depending on the policy of the management system. For more details about Windows 10 servicing tools, see [Servicing tools](#servicing-tools). +When Microsoft officially releases a feature update for Windows 10, it is made available to any device not configured to defer feature updates so that those devices can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager, or Windows Update for Business, however, can defer feature updates to selective devices by withholding their approval and deployment. In this scenario, the content available for the Semi-Annual Channel will be available but not necessarily immediately mandatory, depending on the policy of the management system. For more details about Windows 10 servicing tools, see [Servicing tools](#servicing-tools). Organizations are expected to initiate targeted deployment on Semi-Annual Channel releases. All customers, independent software vendors (ISVs), and partners should use this time for testing and piloting within their environments. After 2-4 months, we will transition to broad deployment and encourage customers and partners to expand and accelerate the deployment of the release. For customers using Windows Update for Business, the Semi-Annual Channel provides three months of additional total deployment time before being required to update to the next release. ->[!NOTE] -All releases of Windows 10 have 18 months of servicing for all editions--these updates provide security and feature updates for the release. Customers running Enterprise and Education editions have an additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release. These versions include Enterprise and Education editions for Windows 10, versions 1607, 1703, 1709 and 1803. Starting in October 2018, all Semi-Annual Channel releases in the September/October timeframe will also have the additional 12 months of servicing for a total of 30 months from the initial release. The Semi-Annual Channel versions released in March/April timeframe will continue to have an 18 month lifecycle. - - ->[!NOTE] ->Organizations can electively delay feature updates into as many phases as they wish by using one of the servicing tools mentioned in the section Servicing tools. +> [!NOTE] +> All releases of Windows 10 have 18 months of servicing for all editions--these updates provide security and feature updates for the release. Customers running Enterprise and Education editions have an additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release. These versions include Enterprise and Education editions for Windows 10, versions 1607 and later. Starting in October 2018, all Semi-Annual Channel releases in the September/October timeframe will also have the additional 12 months of servicing for a total of 30 months from the initial release. The Semi-Annual Channel versions released in March/April timeframe will continue to have an 18-month lifecycle. +> +> +> [!NOTE] +> Organizations can electively delay feature updates into as many phases as they wish by using one of the servicing tools mentioned in the section Servicing tools. ### Long-term Servicing Channel -Specialized systems—such as PCs that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. It’s more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSC servicing model prevents Windows 10 Enterprise LTSB devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date. With this in mind, quality updates are still immediately available to Windows 10 Enterprise LTSB clients, but customers can choose to defer them by using one of the servicing tools mentioned in the section Servicing tools. +Specialized systems—such as devices that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don’t need feature updates as frequently as other devices in the organization. It’s more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSC servicing model prevents Windows 10 Enterprise LTSB devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date. With this in mind, quality updates are still immediately available to Windows 10 Enterprise LTSB clients, but customers can choose to defer them by using one of the servicing tools mentioned in the section Servicing tools. ->[!NOTE] ->Windows 10 Enterprise LTSB is a separate Long Term Servicing Channel version. +> [!NOTE] +> Windows 10 Enterprise LTSB is a separate Long Term Servicing Channel version. > ->Long-term Servicing channel is not intended for deployment on most or all the PCs in an organization; it should be used only for special-purpose devices. As a general guideline, a PC with Microsoft Office installed is a general-purpose device, typically used by an information worker, and therefore it is better suited for the Semi-Annual servicing channel. +> Long-term Servicing channel is not intended for deployment on most or all the devices in an organization; it should be used only for special-purpose devices. As a general guideline, a device with Microsoft Office installed is a general-purpose device, typically used by an information worker, and therefore it is better suited for the Semi-Annual servicing channel. Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSB. Instead, it typically offers new LTSC releases every 2–3 years, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. ->[!NOTE] ->Windows 10 LTSB will support the currently released processors and chipsets at the time of release of the LTSB. As future CPU generations are released, support will be created through future Windows 10 LTSB releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](https://support.microsoft.com/help/18581/lifecycle-support-policy-faq-windows-products). +> [!NOTE] +> Windows 10 LTSB will support the currently released processors and chipsets at the time of release of the LTSB. As future CPU generations are released, support will be created through future Windows 10 LTSB releases that customers can deploy for those systems. For more information, see **Supporting the latest processor and chipsets on Windows** in [Lifecycle support policy FAQ - Windows Products](https://support.microsoft.com/help/18581/lifecycle-support-policy-faq-windows-products). The Long-term Servicing Channel is available only in the Windows 10 Enterprise LTSB edition. This edition of Windows doesn’t include a number of applications, such as Microsoft Edge, Microsoft Store, Cortana (though limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. These apps are not supported in Windows 10 Enterprise LTSB edition, even if you install by using sideloading. ->[!NOTE] ->If an organization has devices currently running Windows 10 Enterprise LTSB that it would like to change to the Semi-Annual Channel, it can make the change without losing user data. Because LTSB is its own SKU, however, an upgrade is required from Windows 10 Enterprise LTSB to Windows 10 Enterprise, which supports the Semi-Annual Channel. +> [!NOTE] +> If an organization has devices currently running Windows 10 Enterprise LTSB that it would like to change to the Semi-Annual Channel, it can make the change without losing user data. Because LTSB is its own SKU, however, an upgrade is required from Windows 10 Enterprise LTSB to Windows 10 Enterprise, which supports the Semi-Annual Channel. ### Windows Insider For many IT pros, gaining visibility into feature updates early—before they’re available to the Semi-Annual Channel — can be both intriguing and valuable for future end user communications as well as provide the means to test for any issues on the next Semi-Annual Channel release. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. -Microsoft recommends that all organizations have at least a few PCs enrolled in the Windows Insider Program and provide feedback on any issues they encounter. For information about the Windows Insider Program for Business, go to [Windows Insider Program for Business](waas-windows-insider-for-business.md). +Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program and provide feedback on any issues they encounter. For information about the Windows Insider Program for Business, go to [Windows Insider Program for Business](waas-windows-insider-for-business.md). >[!NOTE] ->Microsoft recommends that all organizations have at least a few PCs enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub app. +>Microsoft recommends that all organizations have at least a few devices enrolled in the Windows Insider Program, to include the Windows Insider Program in their deployment plans and to provide feedback on any issues they encounter to Microsoft via our Feedback Hub app. > ->The Windows Insider Program isn’t intended to replace Semi-Annual Channel deployments in an organization. Rather, it provides IT pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. +> The Windows Insider Program isn’t intended to replace Semi-Annual Channel deployments in an organization. Rather, it provides IT pros and other interested parties with pre-release Windows builds that they can test and ultimately provide feedback on to Microsoft. @@ -167,12 +160,12 @@ Microsoft recommends that all organizations have at least a few PCs enrolled in There are many tools with which IT pros can service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following are examples of the servicing tools available to manage Windows as a service updates: -- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the Semi-Annual Channel. Organizations can target which devices defer updates by selecting the Defer upgrades check box in Start\Settings\Update & Security\Advanced Options on a Windows 10 client. +- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the Semi-Annual Channel. Organizations can target which devices defer updates by selecting the Defer upgrades check box in Start\Settings\Update & Security\Advanced Options on a Windows 10 device. - **Windows Update for Business** is the second option for servicing Windows as a service. This servicing tool includes control over update deferment and provides centralized management using Group Policy. Windows Update for Business can be used to defer updates by up to 365 days, depending on the version. These deployment options are available to clients in the Semi-Annual Channel. In addition to being able to use Group Policy to manage Windows Update for Business, either option can be configured without requiring any on-premises infrastructure by using Intune. - **Windows Server Update Services (WSUS)** provides extensive control over Windows 10 updates and is natively available in the Windows Server operating system. In addition to the ability to defer updates, organizations can add an approval layer for updates and choose to deploy them to specific computers or groups of computers whenever ready. -- **System Center Configuration Manager** provides the greatest control over servicing Windows as a service. IT pros can defer updates, approve them, and have multiple options for targeting deployments and managing bandwidth usage and deployment times. +- **Microsoft Endpoint Configuration Manager** provides the greatest control over servicing Windows as a service. IT pros can defer updates, approve them, and have multiple options for targeting deployments and managing bandwidth usage and deployment times. -With all these options, which an organization chooses depends on the resources, staff, and expertise its IT organization already has. For example, if IT already uses System Center Configuration Manager to manage Windows updates, it can continue to use it. Similarly, if IT is using WSUS, it can continue to use that. For a consolidated look at the benefits of each tool, see Table 1. +With all these options, which an organization chooses depends on the resources, staff, and expertise its IT organization already has. For example, if IT already uses Microsoft Endpoint Configuration Manager to manage Windows updates, it can continue to use it. Similarly, if IT is using WSUS, it can continue to use that. For a consolidated look at the benefits of each tool, see Table 1. **Table 1** @@ -181,10 +174,10 @@ With all these options, which an organization chooses depends on the resources, | Windows Update | Yes (manual) | No | Delivery Optimization | None| | Windows Update for Business | Yes | No | Delivery Optimization | Other Group Policy objects | | WSUS | Yes | Yes | BranchCache or Delivery Optimization | Upstream/downstream server scalability | -| Configuration Manager | Yes | Yes | BranchCache, Client Peer Cache | Distribution points, multiple deployment options | +| Configuration Manager | Yes | Yes | BranchCache, Client Peer Cache, or Delivery Optimization. For the latter, see [peer-to-peer content distribution](https://docs.microsoft.com/configmgr/sum/deploy-use/optimize-windows-10-update-delivery#peer-to-peer-content-distribution) and [Optimize Windows 10 Update Delivery](https://docs.microsoft.com/windows/deployment/update/waas-optimize-windows-10-updates) | Distribution points, multiple deployment options | >[!NOTE] ->Due to [naming changes](#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products. +>Due to [naming changes](#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel.
                                @@ -197,7 +190,7 @@ With all these options, which an organization chooses depends on the resources, | ![to do](images/checklistbox.gif) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | | ![to do](images/checklistbox.gif) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | | ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                                or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                                or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | +| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                                or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                                or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) | @@ -211,6 +204,6 @@ With all these options, which an organization chooses depends on the resources, - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-quick-start.md b/windows/deployment/update/waas-quick-start.md index 9ef541fce2..7e0bf21538 100644 --- a/windows/deployment/update/waas-quick-start.md +++ b/windows/deployment/update/waas-quick-start.md @@ -4,11 +4,11 @@ description: In Windows 10, Microsoft has streamlined servicing to make operatin keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: Jaimeo +author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 10/17/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -18,16 +18,14 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile -- Windows 10 IoT Mobile Windows as a service is a new concept, introduced with the release of Windows 10. While [an extensive set of documentation](index.md) is available explaining all the specifics and nuances, here is a quick guide to the most important concepts. ## Definitions Some new terms have been introduced as part of Windows as a service, so you should know what these terms mean. -- **Feature updates** will be released twice per year, around March and September. As the name suggests, these will add new features to Windows 10, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years. -- **Quality updates** deliver both security and non-security fixes. They are typically released on the second Tuesday of each month ("Patch Tuesday"), though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they are important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md). +- **Feature updates** are released twice per year, around March and September. As the name suggests, these will add new features to Windows 10, delivered in bite-sized chunks compared to the previous practice of Windows releases every 3-5 years. +- **Quality updates** deliver both security and non-security fixes. They are typically released on the second Tuesday of each month, though they can be released at any time. Quality updates include security updates, critical updates, servicing stack updates, and driver updates. Quality updates are cumulative, so installing the latest quality update is sufficient to get all the available fixes for a specific Windows 10 feature update. The "servicing stack" is the code that installs other updates, so they are important to keep current. For more information, see [Servicing stack updates](servicing-stack-updates.md). - **Insider Preview** builds are made available during the development of the features that will be shipped in the next feature update, enabling organizations to validate new features as well as compatibility with existing apps and infrastructure, providing feedback to Microsoft on any issues encountered. - **Servicing channels** allow organizations to choose when to deploy new features. - The **Semi-Annual Channel** receives feature updates twice per year. @@ -40,9 +38,9 @@ For some interesting in-depth information about how cumulative updates work, see ## Key Concepts -Windows 10 gains new functionality with twice-per-year feature update releases. Initially, organizations will use these feature update releases for pilot deployments to ensure compatibility with existing apps and infrastructure. After a period of time, typically about four months after the feature update release, broad deployment throughout the organization can begin. The exact timeframe is determined by feedback from customers, ISVs, OEMs, and others, with an explicit "ready for broad deployment" declaration signaling this to customers. +Windows 10 gains new functionality with twice-per-year feature update releases. Initially, organizations will use these feature update releases for pilot deployments to ensure compatibility with existing apps and infrastructure. With each Semi-Annual Channel release, we recommend beginning deployment right away to devices selected for early adoption (targeted validation) and ramp up to full deployment at your discretion. -Each Windows 10 feature update will be serviced with quality updates for 18 months from the date of the feature update release. +All releases of Windows 10 have 18 months of servicing for all editions--these updates provide security and feature updates for the release. Customers running Enterprise and Education editions have an additional 12 months of servicing for specific Windows 10 releases, for a total of 30 months from initial release. These versions include Enterprise and Education editions for Windows 10, versions 1607 and later. Starting in October 2018, all Semi-Annual Channel releases in the September/October timeframe will also have the additional 12 months of servicing for a total of 30 months from the initial release. The Semi-Annual Channel versions released in March/April timeframe will continue to have an 18-month lifecycle. Windows 10 Enterprise LTSB is a separate **Long Term Servicing Channel** version. Each release is supported for a total of 10 years (five years standard support, five years extended support). New releases are expected about every three years. @@ -50,7 +48,7 @@ See [Assign devices to servicing channels for Windows 10 updates](waas-servicing ## Staying up to date -The process for keeping Windows 10 up to date involves deploying a feature update, at an appropriate time after its release. A variety of tools management and patching tools such as Windows Update, Windows Update for Business, Windows Server Update Services, System Center Configuration Manager, and third-party products) can be used to help with this process. [Windows Analytics Upgrade Readiness](https://www.microsoft.com/en-us/WindowsForBusiness/windows-analytics), a free tool to streamline Windows upgrade projects, is another important tool to help. +The process for keeping Windows 10 up to date involves deploying a feature update, at an appropriate time after its release. A variety of management and update tools such as Windows Update, Windows Update for Business, Windows Server Update Services, Microsoft Endpoint Configuration Manager, and third-party products) can be used to help with this process. [Upgrade Readiness](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-get-started), a free tool to streamline Windows upgrade projects, is another important tool to help. Because app compatibility, both for desktop apps and web apps, is outstanding with Windows 10, extensive advanced testing isn’t required. Instead, only business-critical apps need to be tested, with the remaining apps validated through a series of pilot deployment rings. Once these pilot deployments have validated most apps, broad deployment can begin. @@ -60,17 +58,12 @@ Additional technologies such as BranchCache and Delivery Optimization, both peer See [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) and [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) for more information. -## Video: An overview of Windows as a service -Click the following Microsoft Mechanics video for an overview of the updated release model, particularly the Semi-Annual Channel. - - -[![YouTube video of Michael Niehouse explaining how the Semi-Annual Channel works](images/SAC_vid_crop.jpg)](https://youtu.be/qSAsiM01GOU) ## Learn more -[Adopting Windows as a service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) - +- [Adopting Windows as a service at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/851/Adopting-Windows-as-a-service-at-Microsoft) +- [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) ## Related topics @@ -81,7 +74,7 @@ Click the following Microsoft Mechanics video for an overview of the updated rel - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md index 13c1dce96d..e1866cfcc0 100644 --- a/windows/deployment/update/waas-restart.md +++ b/windows/deployment/update/waas-restart.md @@ -3,11 +3,12 @@ title: Manage device restarts after updates (Windows 10) description: tbd ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library + author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 07/27/2017 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -17,7 +18,7 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile + > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) @@ -42,6 +43,9 @@ When **Configure Automatic Updates** is enabled in Group Policy, you can enable - **Turn off auto-restart for updates during active hours** prevents automatic restart during active hours. - **No auto-restart with logged on users for scheduled automatic updates installations** prevents automatic restart when a user is signed in. If a user schedules the restart in the update notification, the device will restart at the time the user specifies even if a user is signed in at the time. This policy only applies when **Configure Automatic Updates** is set to option **4-Auto download and schedule the install**. +> [!NOTE] +> When using Remote Desktop Protocol connections, only active RDP sessions are considered as logged on users. Devices that do not have locally logged on users, or active RDP sessions, will be restarted. + You can also use Registry, to prevent automatic restarts when a user is signed in. Under **HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU**, set **AuOptions** to **4** and enable **NoAutoRebootWithLoggedOnUsers**. As with Group Policy, if a user schedules the restart in the update notification, it will override this setting. For a detailed description of these registry keys, see [Registry keys used to manage restart](#registry-keys-used-to-manage-restart). @@ -159,8 +163,9 @@ In the Group Policy editor, you will see a number of policy settings that pertai >[!NOTE] >You can only choose one path for restart behavior. -> >If you set conflicting restart policies, the actual restart behavior may not be what you expected. +>When using RDP, only active RDP sessions are considered as logged on users. + ## Registry keys used to manage restart The following tables list registry values that correspond to the Group Policy settings for controlling restarts after updates in Windows 10. @@ -199,4 +204,4 @@ There are 3 different registry combinations for controlling restart behavior: - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) diff --git a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md index 7a7dfcc5d0..2eae42de3a 100644 --- a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md @@ -3,11 +3,12 @@ title: Assign devices to servicing channels for Windows 10 updates (Windows 10) description: tbd ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library + author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 10/13/2017 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -17,72 +18,63 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile + > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) >[!TIP] >If you're not familiar with the Windows 10 servicing or release channels, read [Servicing Channels](waas-overview.md#servicing-channels) first. > ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB, CBB and LTSB may still be displayed in some of our products. +>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. -Semi-Annual Channel (Targeted) is the default servicing channel for all Windows 10 devices except those with the LTSB edition installed. The following table shows the servicing channels available to each edition of Windows 10. +The Semi-Annual Channel is the default servicing channel for all Windows 10 devices except those with the LTSB edition installed. The following table shows the servicing channels available to each Windows 10 edition. -| Windows 10 edition | Semi-Annual Channel (Targeted) | Semi-Annual Channel | Long-Term Servicing Channel | Insider Program | -| --- | --- | --- | --- | --- | -| Home | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Pro | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Enterprise | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Enterprise LTSB | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | -| Pro Education | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Education | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Mobile | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | -| Mobile Enterprise | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Windows 10 edition | Semi-Annual Channel | Long-Term Servicing Channel | Insider Program | +| --- | --- | --- | --- | +| Home | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Pro | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Enterprise | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Enterprise LTSB | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | +| Pro Education | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Education | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Mobile | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Mobile Enterprise | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | >[!NOTE] >The LTSB edition of Windows 10 is only available through the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). + + ## Assign devices to Semi-Annual Channel >[!IMPORTANT] ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB, CBB and LTSB may still be displayed in some of our products. -> ->In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. +>Due to [naming changes](waas-overview.md#naming-changes), older terms like CB and CBB might still be displayed in some of our products, such as in Group Policy. If you encounter these terms, "CB" refers to the Semi-Annual Channel (Targeted)--which is no longer used--while "CBB" refers to the Semi-Annual Channel. -**To assign a single PC locally to CBB** +**To assign a single devices locally to the Semi-Annual Channel** 1. Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options**. 2. Select **Defer feature updates**. -**To assign PCs to CBB using Group Policy** +**To assign devices to the Semi-Annual Channel by using Group Policy** -- In Windows 10, version 1511: - Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** +- In Windows 10, version 1607 and later releases: -- In Windows 10, version 1607: - - Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** - enable policy and set branch readiness level to CBB + Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** - enable policy and set branch readiness level to the Semi-Annual Channel -**To assign PCs to CBB using MDM** +**To assign devices to to the Semi-Annual Channel by using MDM** -- In Windows 10, version 1511: - ../Vendor/MSFT/Policy/Config/Update/**RequireDeferUpgrade** - -- In Windows 10, version 1607: +- In Windows 10, version 1607 and later releases: ../Vendor/MSFT/Policy/Config/Update/**BranchReadinessLevel** -**To assign Windows 10 Mobile Enterprise to CBB using MDM** +**To assign Windows 10 Mobile Enterprise devices to the Semi-Annual Channel by using MDM** -- In Windows 10 Mobile Enterprise, version 1511: - ../Vendor/MSFT/Policy/Config/Update/RequireDeferUpgrade - -- In Windows 10 Mobile Enterprise, version 1607: +- In Windows 10 Mobile Enterprise, version 1607 and later releases: ../Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel @@ -90,8 +82,8 @@ Semi-Annual Channel (Targeted) is the default servicing channel for all Windows To get started with the Windows Insider Program for Business, you will need to follow a few simple steps: -1. On the [Windows Insider](https://insider.windows.com) website, go to **For Business > Getting Started** to [register your organizational Azure AD account](https://insider.windows.com/en-us/insidersigninaad/). -2. **Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/en-us/for-business-organization-admin/) and control settings centrally.
                                **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. +1. On the [Windows Insider](https://insider.windows.com) website, go to **For Business > Getting Started** to [register your organizational Azure AD account](https://insider.windows.com/insidersigninaad/). +2. **Register your domain**. Rather than have each user register individually for Insider Preview builds, administrators can simply [register their domain](https://insider.windows.com/for-business-organization-admin/) and control settings centrally.
                                **Note:** The signed-in user needs to be a **Global Administrator** of the Azure AD domain in order to be able to register the domain. 3. Make sure the **Allow Telemetry** setting is set to **2** or higher. 4. Starting with Windows 10, version 1709, set policies to manage preview builds and their delivery: @@ -120,7 +112,7 @@ To prevent devices in your enterprise from being enrolled in the Insider Program ## Switching channels -During the life of a device, it may be necessary or desirable to switch between the available channels. Depending on the channel you are using, the exact mechanism for doing this can be different; some will be simple, others more involved. +During the life of a device, it might be necessary or desirable to switch between the available channels. Depending on the channel you are using, the exact mechanism for doing this can be different; some will be simple, others more involved. @@ -138,38 +130,21 @@ During the life of a device, it may be necessary or desirable to switch between - - - + - - - - - - - - - - - - - - - @@ -179,11 +154,6 @@ During the life of a device, it may be necessary or desirable to switch between - - - - - @@ -208,7 +178,7 @@ By enabling the Group Policy setting under **Computer Configuration\Administrati | ![done](images/checklistdone.png) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | | ![done](images/checklistdone.png) | Assign devices to servicing channels for Windows 10 updates (this topic) | | ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                                or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                                or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | +| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                                or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                                or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) | ## Related topics @@ -219,5 +189,5 @@ By enabling the Group Policy setting under **Computer Configuration\Administrati - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-servicing-differences.md b/windows/deployment/update/waas-servicing-differences.md index 20a86bd384..d55a28a5c1 100644 --- a/windows/deployment/update/waas-servicing-differences.md +++ b/windows/deployment/update/waas-servicing-differences.md @@ -1,28 +1,31 @@ --- title: Servicing differences between Windows 10 and older operating systems +ms.reviewer: +manager: laurawi description: Learn the differences between servicing Windows 10 and servicing older operating systems. keywords: updates, servicing, current, deployment, semi-annual channel, feature, quality, rings, insider, tools ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: KarenSimWindows +audience: itpro +author: jaimeo ms.localizationpriority: medium -ms.author: karensim +ms.audience: itpro +author: jaimeo ms.topic: article ms.collection: M365-modern-desktop --- # Understanding the differences between servicing Windows 10-era and legacy Windows operating systems ->Applies to: Windows 10 +> Applies to: Windows 10 +> +> **February 15, 2019: This document has been corrected and edited to reflect that security-only updates for legacy OS versions are not cumulative. They were previously identified as cumulative similar to monthly rollups, which is inaccurate.** ->**February 15, 2019: This document has been corrected and edited to reflect that security-only updates for legacy OS versions are not cumulative. They were previously identified as cumulative similar to monthly rollups, which is inaccurate.** - -Today, many enterprise customers have a mix of modern and legacy client and server operating systems. Managing the servicing and updating differences between those legacy operating systems and Windows 10 versions adds a level of complexity that is not well understood. This can be confusing. With the end of support for legacy [Windows 7 SP1](https://support.microsoft.com/help/4057281/windows-7-support-will-end-on-january-14-2020) and Windows Server 2008 R2 variants on January 14, 2020, System Administrators have a critical need critical to understand how best to leverage a modern workplace to support system updates. +Today, many enterprise customers have a mix of modern and legacy client and server operating systems. Managing the servicing and updating differences between those legacy operating systems and Windows 10 versions adds a level of complexity that is not well understood. This can be confusing. With the end of support for legacy [Windows 7 SP1](https://support.microsoft.com/help/4057281/windows-7-support-will-end-on-january-14-2020) and Windows Server 2008 R2 variants on January 14, 2020, System Administrators have a critical need to understand how best to leverage a modern workplace to support system updates. The following provides an initial overview of how updating client and server differs between the Windows 10-era Operating Systems (such as, Windows 10 version 1709, Windows Server 2016) and legacy operating systems (such as Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2). ->[!NOTE] ->A note on naming convention in this article: For brevity, "Windows 10" refers to all operating systems across client, server and IoT released since July 2015, while "legacy" refers to all operating systems prior to that period for client and server, including Windows 7, Window 8.1, Windows Server 2008 R2, Windows Server 2012 R2, etc. +> [!NOTE] +> A note on naming convention in this article: For brevity, "Windows 10" refers to all operating systems across client, server and IoT released since July 2015, while "legacy" refers to all operating systems prior to that period for client and server, including Windows 7, Window 8.1, Windows Server 2008 R2, Windows Server 2012 R2, etc. ## Infinite fragmentation Prior to Windows 10, all updates to operating system (OS) components were published individually. On "Update Tuesday," customers would pick and choose individual updates they wanted to apply. Most chose to update security fixes, while far fewer selected non-security fixes, updated drivers, or installed .NET Framework updates. @@ -36,7 +39,7 @@ Windows 10 provided an opportunity to end the era of infinite fragmentation. Wit This helps simplify servicing. Devices with the original Release to Market (RTM) version of a feature release installed could get up to date by installing the most recent LCU. -Windows publishes the new LCU packages for each Windows 10 version (1607, 1709, etc.) on the second Tuesday of each month. This package is classified as a required security update and contains contents from the previous LCU as well as new security, non-security and Internet Explorer 11 (IE11) fixes. The security classification, by definition, requires a reboot of the device to complete installation of the update. +Windows publishes the new LCU packages for each Windows 10 version (1607, 1709, etc.) on the second Tuesday of each month. This package is classified as a required security update and contains contents from the previous LCU as well as new security, non-security, and Internet Explorer 11 (IE11) fixes. A reboot of the device might be required to complete installation of the update. ![High level cumulative update model](images/servicing-cadence.png) @@ -83,6 +86,12 @@ Moving to the cumulative model for legacy OS versions continues to improve predi ## Public preview releases Lastly, the cumulative update model directly impacts the public Preview releases offered in the 3rd and/or 4th weeks of the month. Update Tuesday, also referred to as the "B" week release occurs on the second Tuesday of the month. It is always a required security update across all operating systems. In addition to this monthly release, Windows also releases non-security update "previews" targeting the 3rd (C) and the 4th (D) weeks of the month. These preview releases include that month’s B-release plus a set of non-security updates for testing and validation as a cumulative package. We recommend IT Administrators uses the C/D previews to test the update in their environments. Any issues identified with the updates in the C/D releases are identified and then fixed or removed, prior to being rolled up in to the next month’s B release package together with new security updates. Security-only Packages are not part of the C/D preview program. +> [!NOTE] +> Only preview updates for the most recent release of Windows 10 are published to Windows Server Update Services (WSUS). For customers using the WSUS channel, and products such as Microsoft Endpoint Configuration Manager that rely on it, will not see preview updates for older versions of Windows 10. + +> [!NOTE] +> Preview updates for Windows 10 are not named differently than their LCU counterparts and do not contain the word 'Preview'. They can be identified by their release date (C or D week) and their classification as non-security updates. + ### Examples Windows 10 version 1709: - (9B) September 11, 2018 Update Tuesday / B release - includes security, non-security and IE update. This update is categorized as "Required, Security" it requires a system reboot. diff --git a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md index ab220901a1..e82f2eebde 100644 --- a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md @@ -3,11 +3,11 @@ title: Prepare servicing strategy for Windows 10 updates (Windows 10) description: A strong Windows 10 deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: Jaimeo +author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 11/02/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -17,7 +17,7 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile + > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) @@ -32,7 +32,7 @@ Windows 10 spreads the traditional deployment effort of a Windows upgrade, which - **Identify excluded devices.** For some organizations, special-purpose devices such as those used to control factory or medical equipment or run ATMs require a stricter, less frequent feature update cycle than the Semi-annual Channel can offer. For those machines, you must install Windows 10 Enterprise LTSB to avoid feature updates for up to 10 years. Identify these devices, and separate them from the phased deployment and servicing cycles to help remove confusion for your administrators and ensure that devices are handled correctly. - **Recruit volunteers.** The purpose of testing a deployment is to receive feedback. One effective way to recruit pilot users is to request volunteers. When doing so, clearly state that you’re looking for feedback rather than people to just “try it out” and that there could be occasional issues involved with accepting feature updates right away. With Windows as a service, the expectation is that there should be few issues, but if an issue does arise, you want testers to let you know as soon as possible. When considering whom to recruit for pilot groups, be sure to include members who provide the broadest set of applications and devices to validate the largest number of apps and devices possible. - **Update Group Policy.** Each feature update includes new group policies to manage new features. If you use Group Policy to manage devices, the Group Policy Admin for the Active Directory domain will need to download a .admx package and copy it to their [Central Store](https://support.microsoft.com/help/929841/how-to-create-the-central-store-for-group-policy-administrative-templa) (or to the [PolicyDefinitions](https://msdn.microsoft.com/library/bb530196.aspx) directory in the SYSVOL of a domain controller if not using a Central Store). Always manage new group polices from the version of Windows 10 they shipped with by using the Remote Server Administration Tools. The ADMX download package is created at the end of each development cycle and then posted for download. To find the ADMX download package for a given Windows build, search for “ADMX download for Windows build xxxx”. For details about Group Policy management, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) -- **Choose a servicing tool.** Decide which product you’ll use to manage the Windows updates in your environment. If you’re currently using Windows Server Update Services (WSUS) or System Center Configuration Manager to manage your Windows updates, you can continue using those products to manage Windows 10 updates. Alternatively, you can use Windows Update for Business. In addition to which product you’ll use, consider how you’ll deliver the updates. With Windows 10, multiple peer-to-peer options are available to make update distribution faster. For a comparison of tools, see [Servicing tools](waas-overview.md#servicing-tools). +- **Choose a servicing tool.** Decide which product you’ll use to manage the Windows updates in your environment. If you’re currently using Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager to manage your Windows updates, you can continue using those products to manage Windows 10 updates. Alternatively, you can use Windows Update for Business. In addition to which product you’ll use, consider how you’ll deliver the updates. With Windows 10, multiple peer-to-peer options are available to make update distribution faster. For a comparison of tools, see [Servicing tools](waas-overview.md#servicing-tools). - **Prioritize applications.** First, create an application portfolio. This list should include everything installed in your organization and any webpages your organization hosts. Next, prioritize this list to identify those that are the most business critical. Because the expectation is that application compatibility with Windows 10 will be high, only the most business critical applications should be tested before the pilot phase; everything else can be tested afterwards. For more information about identifying compatibility issues withe applications, see [Manage Windows upgrades with Upgrade Analytics](../upgrade/manage-windows-upgrades-with-upgrade-readiness.md). >[!NOTE] @@ -56,7 +56,7 @@ Each time Microsoft releases a Windows 10 feature update, the IT department shou | ![to do](images/checklistbox.gif) | [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | | ![to do](images/checklistbox.gif) | [Assign devices to servicing channels for Windows 10 updates](waas-servicing-channels-windows-10-updates.md) | | ![to do](images/checklistbox.gif) | [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | -| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                                or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                                or [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | +| ![to do](images/checklistbox.gif) | [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md)
                                or [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
                                or [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) | ## Related topics @@ -68,5 +68,5 @@ Each time Microsoft releases a Windows 10 feature update, the IT department shou - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index 7749569b04..3967a511a8 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -3,11 +3,14 @@ title: Manage additional Windows Update settings (Windows 10) description: Additional settings to control the behavior of Windows Update (WU) in Windows 10 ms.prod: w10 ms.mktglfcycl: deploy -ms.sitesec: library + +audience: itpro author: jaimeo ms.localizationpriority: medium -ms.author: jaimeo -ms.date: 07/27/2017 +ms.audience: itpro +author: jaimeo +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -17,18 +20,18 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile -> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) + +> **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) You can use Group Policy settings or mobile device management (MDM) to configure the behavior of Windows Update (WU) on your Windows 10 devices. You can configure the update detection frequency, select when updates are received, specify the update service location and more. >[!IMPORTANT] ->In Windows 10, any Group Policy user configuration settings for Windows Update were deprecated and are no longer supported on this platform. +>In Windows 10, any Group Policy user configuration settings for Windows Update are no longer supported on this platform. ## Summary of Windows Update settings -| Group Policy setting | MDM setting | Supported from version | +| Group Policy setting | MDM setting | Supported from version | | --- | --- | --- | | [Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location) | [UpdateServiceUrl](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurl) and [UpdateServiceUrlAlternate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-updateserviceurlalternate) | All | | [Automatic Updates Detection Frequency](#automatic-updates-detection-frequency) | [DetectionFrequency](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-detectionfrequency) | 1703 | @@ -59,9 +62,9 @@ For additional settings that configure when Feature and Quality updates are rece ### Specify Intranet Microsoft update service location Specifies an intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. -This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. +This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. -To use this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify Intranet Microsoft update service location**. You must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service. +To use this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify Intranet Microsoft update service location**. You must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update Agent to download updates from an alternate download server instead of the intranet update service. If the setting is set to **Enabled**, the Automatic Updates client connects to the specified intranet Microsoft update service (or alternate download server), instead of Windows Update, to search for and download updates. Enabling this setting means that end users in your organization don’t have to go through a firewall to get updates, and it gives you the opportunity to test updates after deploying them. If the setting is set to **Disabled** or **Not Configured**, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. @@ -122,7 +125,7 @@ If the intranet Microsoft update service supports multiple target groups, this p ### Allow signed updates from an intranet Microsoft update service location -This policy setting allows you to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. +This policy setting allows you to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. To configure this setting in Group Policy, go to **Computer Configuration\Administrative Templates\Windows Components\Windows update\Allow signed updates from an intranet Microsoft update service location**. @@ -145,7 +148,7 @@ To add more flexibility to the update process, settings are available to control Allows admins to exclude Windows Update (WU) drivers during updates. -To configure this setting in Group Policy, use **Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not include drivers with Windows Updates**. +To configure this setting in Group Policy, use **Computer Configuration\Administrative Templates\Windows Components\Windows update\Do not include drivers with Windows Updates**. Enable this policy to not include drivers with Windows quality updates. If you disable or do not configure this policy, Windows Update will include updates that have a Driver classification. @@ -153,7 +156,9 @@ If you disable or do not configure this policy, Windows Update will include upda Enables the IT admin to manage automatic update behavior to scan, download, and install updates. -When enabling this setting through Group Policy, under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Configure Automatic Updates**, you must select one of the four options: +#### Configuring Automatic Updates by using Group Policy + +Under **Computer Configuration\Administrative Templates\Windows Components\Windows update\Configure Automatic Updates**, you must select one of the four options: **2 - Notify for download and auto install** - When Windows finds updates that apply to this device, users will be notified that updates are ready to be downloaded. After going to **Settings > Update & security > Windows Update**, users can download and install any available updates. @@ -167,14 +172,92 @@ If this setting is set to *Disabled*, any updates that are available on Windows If this setting is set to *Not Configured*, an administrator can still configure Automatic Updates through the settings app, under **Settings > Update & security > Windows Update > Advanced options**. +#### Configuring Automatic Updates by editing the registry +> [!NOTE] +> Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require you to reinstall the operating system. Microsoft cannot guarantee that these problems can be resolved. Modify the registry at your own risk. + +In an environment that does not have Active Directory deployed, you can edit registry settings to configure group policies for Automatic Update. + +To do this, follow these steps: + +1. Select **Start**, search for "regedit", and then open Registry Editor. + +2. Open the following registry key: + + ``` + HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU + ``` + +3. Add one of the following registry values to configure Automatic Update. + + * NoAutoUpdate (REG_DWORD): + + * **0**: Automatic Updates is enabled (default). + + * **1**: Automatic Updates is disabled. + + * AUOptions (REG_DWORD): + + * **1**: Keep my computer up to date is disabled in Automatic Updates. + + * **2**: Notify of download and installation. + + * **3**: Automatically download and notify of installation. + + * **4**: Automatically download and scheduled installation. + + * ScheduledInstallDay (REG_DWORD): + + * **0**: Every day. + + * **1** through **7**: The days of the week from Sunday (1) to Saturday (7). + + * ScheduledInstallTime (REG_DWORD): + + **n**, where **n** equals the time of day in a 24-hour format (0-23). + + * UseWUServer (REG_DWORD) + + Set this value to **1** to configure Automatic Updates to use a server that is running Software Update Services instead of Windows Update. + + * RescheduleWaitTime (REG_DWORD) + + **m**, where **m** equals the time period to wait between the time Automatic Updates starts and the time that it begins installations where the scheduled times have passed. The time is set in minutes from 1 to 60, representing 1 minute to 60 minutes) + + > [!NOTE] + > This setting only affects client behavior after the clients have updated to the SUS SP1 client version or later versions. + + * NoAutoRebootWithLoggedOnUsers (REG_DWORD): + + **0** (false) or **1** (true). If set to **1**, Automatic Updates does not automatically restart a computer while users are logged on. + + > [!NOTE] + > This setting affects client behavior after the clients have updated to the SUS SP1 client version or later versions. + +To use Automatic Updates with a server that is running Software Update Services, see the Deploying Microsoft Windows Server Update Services 2.0 guidance. + +When you configure Automatic Updates directly by using the policy registry keys, the policy overrides the preferences that are set by the local administrative user to configure the client. If an administrator removes the registry keys at a later date, the preferences that were set by the local administrative user are used again. + +To determine the WSUS server that the client computers and servers connect to for updates, add the following registry values to the registry: +``` +HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ +``` + +* WUServer (REG_SZ) + + This value sets the WSUS server by HTTP name (for example, http://IntranetSUS). + +* WUStatusServer (REG_SZ) + + This value sets the SUS statistics server by HTTP name (for example, http://IntranetSUS). ## Related topics - [Update Windows 10 in the enterprise](index.md) - [Overview of Windows as a service](waas-overview.md) -- [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) +- [Manage updates for Windows 10 Mobile Enterprise and Windows 10 IoT Mobile](waas-mobile-updates.md) - [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) - [Configure BranchCache for Windows 10 updates](waas-branchcache.md) - [Configure Windows Update for Business](waas-configure-wufb.md) -- [Manage device restarts after updates](waas-restart.md) \ No newline at end of file +- [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/waas-wufb-group-policy.md b/windows/deployment/update/waas-wufb-group-policy.md index 706d1cc4a6..5119f6f5be 100644 --- a/windows/deployment/update/waas-wufb-group-policy.md +++ b/windows/deployment/update/waas-wufb-group-policy.md @@ -1,17 +1,17 @@ --- -title: Walkthrough use Group Policy to configure Windows Update for Business (Windows 10) -description: Configure Windows Update for Business settings using Group Policy. +title: Configure Windows Update for Business via Group Policy (Windows 10) +description: Walkthrough demonstrating how to configure Windows Update for Business settings, using Group Policy. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library author: jaimeo ms.localizationpriority: medium ms.author: jaimeo -ms.date: 07/27/2017 +ms.reviewer: +manager: laurawi ms.topic: article --- -# Walkthrough: use Group Policy to configure Windows Update for Business +# Walkthrough: Use Group Policy to configure Windows Update for Business **Applies to** @@ -20,336 +20,107 @@ ms.topic: article > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) ->[!IMPORTANT] ->Due to [naming changes](waas-overview.md#naming-changes), older terms like CB,CBB and LTSB may still be displayed in some of our products. -> ->In the following settings CB refers to Semi-Annual Channel (Targeted), while CBB refers to Semi-Annual Channel. - -Using Group Policy to manage Windows Update for Business is simple and familiar: use the same Group Policy Management Console (GPMC) you use to manage other device and user policy settings in your environment. Before configuring the Windows Update for Business Group Policy settings, consider a [deployment strategy](waas-servicing-strategy-windows-10-updates.md) for updates and feature updates in your environment. - -In Windows 10 version 1511, only Current Branch for Business (CBB) upgrades could be delayed, restricting the Current Branch (CB) builds to a single deployment ring. Windows 10 version 1607, however, has a new Group Policy setting that allows you to delay feature updates for both CB and CBB, broadening the use of the CB servicing branch. - ->[!NOTES] ->The terms *feature updates* and *quality updates* in Windows 10, version 1607, correspond to the terms *upgrades* and *updates* in version 1511. - ->To follow the instructions in this article, you will need to download and install the relevant ADMX templates for your Windows 10 version. ->See the following articles for instructions on the ADMX templates in your environment. - -> - [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759) -> - [Step-By-Step: Managing Windows 10 with Administrative templates](https://blogs.technet.microsoft.com/canitpro/2015/10/20/step-by-step-managing-windows-10-with-administrative-templates/) - - -To use Group Policy to manage quality and feature updates in your environment, you must first create Active Directory security groups that align with your constructed deployment rings. Most customers have many deployment rings already in place in their environment, and these rings likely align with existing phased rollouts of current patches and operating system upgrades. - -## Configure Windows Update for Business in Windows 10 version 1511 - -In this example, you use two security groups to manage your updates: **Ring 4 Broad business users** and **Ring 5 Broad business users #2** from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md). - -- The **Ring 4 Broad business users** group contains PCs of IT members who test the updates as soon as they’re released for Windows clients in the Current Branch for Business (CBB) servicing branch. This phase typically occurs after testing on Current Branch (CB) devices. -- The **Ring 5 Broad business users #2** group consists of the first line-of-business (LOB) users, who consume quality updates after 1 week and feature updates 1 month after the CBB release. - ->[!NOTE] ->Although the [sample deployment rings](waas-deployment-rings-windows-10-updates.md) specify a feature update deferral of 2 weeks for Ring 5, deferrals in Windows 10, version 1511 are in increments of months only. -> ->Windows 10 version 1511 does not support deferment of CB builds of Windows 10, so you can establish only one CB deployment ring. In version 1607 and later, CB builds can be delayed, making it possible to have multiple CB deployment rings. - Complete the following steps on a PC running the Remote Server Administration Tools or on a domain controller. - - ### Configure the Ring 4 Broad business users deployment ring for CBB with no deferral +## Overview -1. Open GPMC (gpmc.msc). +You can use Group Policy through the Group Policy Management Console (GPMC) to control how Windows Update for Business works. You should consider and devise a deployment strategy for updates before you make changes to the Windows Update for Business settings. See -2. Expand **Forest** > **Domains** > *your domain*. +An IT administrator can set policies for Windows Update for Business by using Group Policy, or they can be set locally (per device). All of the relevant policies are under the path **Computer configuration > Administrative Templates > Windows Components > Windows Update**. -3. Right-click *your domain* and select **Create a GPO in this domain, and Link it here**. +To manage updates with Windows Update for Business as described in this topic, you should prepare with these steps, if you haven't already: - ![UI for Create GPO menu](images/waas-wufb-gp-create.png) - -4. In the **New GPO** dialog box, type **Windows Update for Business - CBB1** for the name of the new GPO. +- Create Active Directory security groups that align with the deployment rings you use to phase deployment of updates. See [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) to learn more about deployment rings in Windows 10. +- Allow access to the Windows Update service. +- Download and install ADMX templates appropriate to your Windows 10 version. For more information, see [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759) and [Step-By-Step: Managing Windows 10 with Administrative templates](https://blogs.technet.microsoft.com/canitpro/2015/10/20/step-by-step-managing-windows-10-with-administrative-templates/). - >[!NOTE] - >In this example, you’re linking the GPO to the top-level domain. This is not a requirement: you can link the Windows Update for Business GPOs to any organizational unit (OU) that’s appropriate for your Active Directory Domain Services (AD DS) structure. -5. Right-click the **Windows Update for Business - CBB1** GPO, and then click **Edit**. +## Set up Windows Update for Business - ![UI for Edit GPO](images/waas-wufb-gp-edit.png) - -6. In the Group Policy Management Editor, go to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Update**. +In this example, one security group is used to manage updates. Typically we would recommend having at least three rings (early testers for pre-release builds, broad deployment for releases, critical devices for mature releases) to deploy. See [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) for more information. -7. Right-click **Defer Upgrades and Updates**, and then click **Edit**. +Follow these steps on a device running the Remote Server Administration Tools or on a domain controller: - ![UI to edit Defer Upgrades and Updates](images/waas-wufb-gp-edit-defer.png) - - In the **Defer Upgrades and Updates** Group Policy setting configuration, you see several options: - - **Enable/Disable Deferred Updates**. Enabling this policy setting sets the receiving client to the CBB servicing branch. Specifically disabling this policy forces the client into the CB servicing branch, making it impossible for users to change it. - - **Defer upgrades for the following**. This option allows you to delay feature updates up to 8 months, a number added to the default CBB delay (approximately 4 months from CB). By using Windows Update for Business, you can use this option to stagger CBB feature updates, making the total offset up to 12 months from CB. - - **Defer updates for the following**. This option allows you to delay the installation of quality updates on a Windows 10 device for up to 4 weeks, allowing for phased rollouts of updates in your enterprise, but not all quality updates are deferrable with this option. Table 1 shows the deferment capabilities by update type. - - **Pause Upgrades and Updates**. Should an issue arise with a feature update, this option allows a one-time skip of the current month’s quality and feature update. Quality updates will resume after 35 days, and feature updates will resume after 60 days. For example, deploy this setting as a stand-alone policy to the entire organization in an emergency. - - Table 1 summarizes the category of update in Windows 10 and how long Windows Update for Business can defer its installation. - - **Table 1** - -
                                Windows Insider ProgramSemi-Annual Channel (Targeted)Wait for the final Semi-Annual Channel release.
                                Semi-Annual ChannelNot directly possible, because Windows Insider Program devices are automatically upgraded to the Semi-Annual Channel (Targeted) release at the end of the development cycle.Not directly possible
                                Long-Term Servicing Channel Not directly possible (requires wipe-and-load).
                                Semi-Annual Channel (Targeted)InsiderUse the Settings app to enroll the device in the Windows Insider Program.
                                Semi-Annual ChannelSelect the Defer upgrade setting, or move the PC to a target group or flight that will not receive the next upgrade until it is business ready. Note that this change will not have any immediate impact; it only prevents the installation of the next Semi-Annual Channel release.
                                Long-Term Servicing ChannelNot directly possible (requires wipe-and-load).
                                Semi-Annual Channel Insider Use the Settings app to enroll the device in the Windows Insider Program.
                                Semi-Annual Channel (Targeted)Disable the Defer upgrade setting, or move the device to a target group or flight that will receive the latest Current Semi-Annual Channel release.
                                Long-Term Servicing ChannelLong-Term Servicing Channel Insider Use media to upgrade to the latest Windows Insider Program build.
                                Semi-Annual Channel (Targeted)Use media to upgrade. Note that the Semi-Annual Channel build must be a later build.
                                Semi-Annual Channel Use media to upgrade. Note that the Semi-Annual Channel build must be a later build.
                                - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                CategoryMaximum deferralDeferral incrementsClassification typeClassification GUID
                                OS upgrades8 months1 monthUpgrade3689BDC8-B205-4AF4-8D4A-A63924C5E9D5
                                OS updates4 weeks1 weekSecurity updates0FA1201D-4330-4FA8-8AE9-B877473B6441
                                DriversEBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0
                                UpdatesCD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83
                                Other/non-deferrableNo deferralNo deferralDefinition updatesE0789628-CE08-4437-BE74-2495B842F43B
                                +### Set up a ring +1. Start Group Policy Management Console (gpmc.msc). +2. Expand **Forest > Domains > *\*. +3. Right-click *\* and select **Create a GPO in this domain and link it here**. +4. In the **New GPO** dialog box, enter *Windows Update for Business - Group 1* as the name of the new Group Policy Object. +5. Right-click the **Windows Update for Business - Group 1" object, and then select **Edit**. +6. In the Group Policy Management Editor, go to **Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update**. You are now ready to start assigning policies to this ring (group) of devices. - Simply enabling the **Defer Upgrades and Updates** policy sets the receiving client to the CBB servicing branch, which is what you want for your first deployment ring, **Ring 4 Broad business users**. - -8. Enable the **Defer Updates and Upgrades** setting, and then click **OK**. -9. Close the Group Policy Management Editor. +## Offering -Because the **Windows Update for Business - CBB1** GPO contains a computer policy and you only want to apply it to computers in the **Ring 4 Broad business users** group, use **Security Filtering** to scope the policy’s effect. +You can control when updates are applied, for example by deferring when an update is installed on a device or by pausing updates for a certain period of time. -### Scope the policy to the Ring 4 Broad business users group +### Manage which updates are offered -1. In the GPMC, select the **Windows Update for Business - CBB1** policy. +Windows Update for Business offers you the ability to turn on or off both driver and Microsoft product updates. -2. In **Security Filtering** on the **Scope** tab, remove the default **AUTHENTICATED USERS** security group, and add the **Ring 4 Broad business users** group. +- Drivers (on/off): **Computer configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates** +- Microsoft product updates (on/off): **Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Automatic Updates > Install updates for other Microsoft products** - ![Scope policy to group](images/waas-wufb-gp-scope.png) - +We recommend that you allow the driver policy to allow drivers to updated on devices (the default), but you can turn this setting off if you prefer to manage drivers manually. We also recommend that you leave the "Microsoft product updates" setting on. -The **Ring 4 Broad business users** deployment ring has now been configured. Next, configure **Ring 5 Broad business users #2** to accommodate a 1-week delay for quality updates and a 2-week delay for feature updates. +### Manage when updates are offered +You can defer or pause the installation of updates for a set period of time. +#### Defer or pause an update -### Configure the Ring 5 Broad business users \#2 deployment ring for CBB with deferrals +A Windows Update for Business administrator can defer or pause updates and preview builds. You can defer features updates for up to 365 days. You can pause feature or quality updates for up to 35 days from a given start date that you specify. -1. Open GPMC (gpmc.msc). +- Defer or pause a feature update: **Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are Received** +- Defer or pause a quality update: **Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are Received** -2. Expand **Forest** > **Domains** > *your domain*. - -3. Right-click *your domain* and select **Create a GPO in this domain, and Link it here**. - - ![UI for Create GPO menu](images/waas-wufb-gp-create.png) - -4. In the **New GPO** dialog box, type **Windows Update for Business - CBB2** for the name of the new GPO. - -5. Right-click the **Windows Update for Business - CBB2** GPO, and then click **Edit**. - - ![UI for Edit GPO](images/waas-wufb-gp-edit.png) - -6. In the Group Policy Management Editor, go to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Update**. - -7. Right-click **Defer Upgrades and Updates**, and then click **Edit**. - -8. Enable the **Defer Updates and Upgrades** setting, configure the **Defer upgrades for the following** option for 1 month, and then configure the **Defer updates for the following** option for 1 week. - - ![Example of policy settings](images/waas-wufb-gp-broad.png) - -9. Click **OK** and close the Group Policy Management Editor. - - -### Scope the policy to the Ring 5 Broad business users \#2 group - -1. In the GPMC, select the **Windows Update for Business - CBB2** policy. - -2. In **Security Filtering** on the **Scope** tab, remove the default **AUTHENTICATED USERS** security group, and add the **Ring 5 Broad business users \#2** group. +#### Example -## Configure Windows Update for Business in Windows 10 version 1607 +In this example, there are three rings for quality updates. The first ring ("pilot") has a deferral period of 0 days. The second ring ("fast") has a deferral of five days. The third ring ("slow") has a deferral of ten days. -To use Group Policy to manage quality and feature updates in your environment, you must first create Active Directory security groups that align with your constructed deployment rings. Most customers have many deployment rings already in place in their environment, and these rings likely align with existing phased rollouts of current patches and operating system upgrades. +![illustration of devices divided into three rings](images/waas-wufb-3-rings.png) -In this example, you use three security groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) to manage your updates: +When the quality update is released, it is offered to devices in the pilot ring the next time they scan for updates. -- **Ring 2 Pilot Business Users** contains the PCs of business users which are part of the pilot testing process, receiving CB builds 4 weeks after they are released. -- **Ring 4 Broad business users** consists of IT members who receive updates after Microsoft releases a Windows 10 build to the CBB servicing branch. -- **Ring 5 Broad business users #2** consists of LOB users on CBB, who receive quality updates after 7 days and feature updates after 14 days. +##### Five days later +The devices in the fast ring are offered the quality update the next time they scan for updates. -In this example, you configure and scope the update schedules for all three groups. +![illustration of devices with fast ring deployed](images/waas-wufb-fast-ring.png) -### Configure Ring 2 Pilot Business Users policy +##### Ten days later +Ten days after the quality update is released, it is offered to the devices in the slow ring the next time they scan for updates. -1. Open GPMC (gpmc.msc). +![illustration of devices with slow ring deployed](images/waas-wufb-slow-ring.png) -2. Expand **Forest** > **Domains** > *your domain*. +If no problems occur, all of the devices that scan for updates will be offered the quality update within ten days of its release, in three waves. -3. Right-click *your domain* and select **Create a GPO in this domain, and Link it here**. +##### What if a problem occurs with the update? - ![UI for Create GPO menu](images/waas-wufb-gp-create.png) +In this example, some problem is discovered during the deployment of the update to the "pilot" ring. -4. In the **New GPO** dialog box, type **Windows Update for Business - CB2** for the name of the new GPO. +![illustration of devices divided with pilot ring experiencing a problem](images/waas-wufb-pilot-problem.png) - >[!NOTE] - >In this example, you’re linking the GPO to the top-level domain. This is not a requirement: you can link the Windows Update for Business GPOs to any organizational unit (OU) that’s appropriate for your Active Directory Domain Services (AD DS) structure. - -5. Right-click the **Windows Update for Business - CB2** GPO, and then click **Edit**. +At this point, the IT administrator can set a policy to pause the update. In this example, the admin selects the **Pause quality updates** check box. - ![Edit menu for this GPO](images/waas-wufb-gp-cb2.png) - -6. In the Group Policy Management Editor, go to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Defer Windows Updates**. +![illustration of rings with pause quality update check box selected](images/waas-wufb-pause.png) -7. Right-click **Select when Feature Updates are received**, and then click **Edit**. +Now all devices are paused from updating for 35 days. When the pause is removed, they will be offered the *next* quality update, which ideally will not have the same issue. If there is still an issue, the IT admin can pause updates again. -8. In the **Select when Feature Updates are received** policy, enable it, select a branch readiness level of **CB**, set the feature update delay to **28** days, and then click **OK**. - ![Settings for this GPO](images/waas-wufb-gp-cb2-settings.png) - - Table 3 summarizes the category of updates in Windows 10, version 1607, and how long Windows Update for Business can defer its installation. - **Table 3** +#### Set branch readiness level for feature updates - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                CategoryMaximum deferralDeferral incrementsExampleClassification GUID
                                Feature Updates180 daysDaysFrom Windows 10, version 1511 to version 16073689BDC8-B205-4AF4-8D4A-A63924C5E9D5
                                Quality Updates30 daysDaysSecurity updates0FA1201D-4330-4FA8-8AE9-B877473B6441
                                Drivers (optional)EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0
                                Non-security updatesCD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83
                                Microsoft updates (Office, Visual Studio, etc.)varies
                                Non-deferrableNo deferralNo deferralDefinition updatesE0789628-CE08-4437-BE74-2495B842F43B
                                +This policy only applies to feature updates. To enable preview builds for devices in your organization, set the "Enable preview builds" policy and then use the "Select when preview builds and feature updates are received" policy. -9. Close the Group Policy Management Editor. +We recommend that you set up a ring to receive preview builds by joining the Windows Insider Program for Business. By having a ring of devices receiving "pre-release slow" builds and learning about commercial pre-release features, you can ensure that any issues you have with the release are fixed before it is ever released and far before you broadly deploy. -Because the **Windows Update for Business – CB2** GPO contains a computer policy and you only want to apply it to computers in the **Ring 2 Pilot Business Users** group, use **Security Filtering** to scope the policy’s effect. +- Enable preview builds: **Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Manage Preview Builds** -### Scope the policy to the Ring 2 Pilot Business Users group -1. In the GPMC, select the **Windows Update for Business - CB2** policy. -2. In **Security Filtering** on the **Scope** tab, remove the default **AUTHENTICATED USERS** security group, and add the **Ring 2 Pilot Business Users** group. +- Set branch readiness level: **Computer configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are Received** - ![Scope policy to group](images/waas-wufb-gp-scope-cb2.png) -The **Ring 2 Pilot Business Users** deployment ring has now been configured. Next, configure **Ring 4 Broad business users** to set those clients into the CBB servicing branch so that they receive feature updates as soon as they’re made available for the CBB servicing branch. -### Configure Ring 4 Broad business users policy -1. Open GPMC (gpmc.msc). - -2. Expand **Forest** > **Domains** > *your domain*. - -3. Right-click *your domain* and select **Create a GPO in this domain, and Link it here**. - -4. In the **New GPO** dialog box, type **Windows Update for Business - CBB1** for the name of the new GPO. - -5. Right-click the **Windows Update for Business - CBB1** GPO, and then click **Edit**. - -6. In the Group Policy Management Editor, go to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Defer Windows Updates**. - -7. Right-click **Select when Feature Updates are received**, and then click **Edit**. - -8. In the **Select when Feature Updates are received** policy, enable it, select a branch readiness level of **CBB**, and then click **OK**. - - ![Settings for this GPO](images/waas-wufb-gp-cbb1-settings.png) - -9. Close the Group Policy Management Editor. - - - -### Scope the policy to the Ring 4 Broad business users group - -1. In the GPMC, select the **Windows Update for Business - CBB1** policy. - -2. In **Security Filtering** on the **Scope** tab, remove the default **AUTHENTICATED USERS** security group, and add the **Ring 4 Broad business users** group. - - -The **Ring 4 Broad business users** deployment ring has now been configured. Finally, configure **Ring 5 Broad business users #2** to accommodate a 7-day delay for quality updates and a 14-day delay for feature updates - -### Configure Ring 5 Broad business users \#2 policy - -1. Open GPMC (gpmc.msc). - -2. Expand **Forest** > **Domains** > *your domain*. - -3. Right-click *your domain* and select **Create a GPO in this domain, and Link it here**. - -4. In the **New GPO** dialog box, type **Windows Update for Business - CBB2** for the name of the new GPO. - -5. Right-click the **Windows Update for Business - CBB2** GPO, and then click **Edit**. - -6. In the Group Policy Management Editor, go to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Defer Windows Updates**. - -7. Right-click **Select when Feature Updates are received**, and then click **Edit**. - -8. In the **Select when Feature Updates are received** policy, enable it, select a branch readiness level of **CBB**, set the feature update delay to **14** days, and then click **OK**. - - ![Settings for this GPO](images/waas-wufb-gp-cbb2-settings.png) - -9. Right-click **Select when Quality Updates are received**, and then click **Edit**. - -10. In the **Select when Quality Updates are received** policy, enable it, set the quality update delay to **7** days, and then click **OK**. - - ![Settings for this GPO](images/waas-wufb-gp-cbb2q-settings.png) - -11. Close the Group Policy Management Editor. - - - -### Scope the policy to the Ring 5 Broad business users \#2 group - -1. In the GPMC, select the **Windows Update for Business - CBB2** policy. - -2. In **Security Filtering** on the **Scope** tab, remove the default **AUTHENTICATED USERS** security group, and add the **Ring 5 Broad business users #2** group. - -## Known issues -The following article describes the known challenges that can occur when you manage a Windows 10 Group policy client base: -- [Known issues managing a Windows 10 Group Policy client in Windows Server 2012 R2](https://support.microsoft.com/help/4015786/known-issues-managing-a-windows-10-group-policy-client-in-windows-serv) ## Related topics @@ -365,7 +136,12 @@ The following article describes the known challenges that can occur when you man - [Deploy updates using Windows Update for Business](waas-manage-updates-wufb.md) - [Configure Windows Update for Business](waas-configure-wufb.md) - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) -- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Walkthrough: use Intune to configure Windows Update for Business](https://docs.microsoft.com/intune/windows-update-for-business-configure) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) + + + + + diff --git a/windows/deployment/update/waas-wufb-intune.md b/windows/deployment/update/waas-wufb-intune.md index e65e9b8d2d..30af2075e1 100644 --- a/windows/deployment/update/waas-wufb-intune.md +++ b/windows/deployment/update/waas-wufb-intune.md @@ -3,11 +3,14 @@ title: Walkthrough use Intune to configure Windows Update for Business (Windows description: Configure Windows Update for Business settings using Microsoft Intune. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library +audience: itpro author: jaimeo ms.localizationpriority: medium -ms.author: jaimeo +ms.audience: itpro +author: jaimeo ms.date: 07/27/2017 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -17,7 +20,7 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile + > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) @@ -81,38 +84,38 @@ You have now configured the **Ring 4 Broad business users** deployment ring to e ### Configure the Ring 5 Broad business users \#2 deployment ring for CBB with deferrals -1. In the Policy workspace, click **Configuration Policies**, and then click **Add**. +1. In the Policy workspace, click **Configuration Policies**, and then click **Add**. -2. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. +2. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. -3. Name the policy **Windows Update for Business – CBB2**. Then, in the **OMA-URI Settings** section, click **Add**. +3. Name the policy **Windows Update for Business – CBB2**. Then, in the **OMA-URI Settings** section, click **Add**. In this policy, you add two OMA-URI settings, one for each deferment type. -4. In **Setting name**, type **Enable Clients for CBB**, and then in the **Data type** list, select **Integer**. +4. In **Setting name**, type **Enable Clients for CBB**, and then in the **Data type** list, select **Integer**. -6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/RequireDeferUpgrade**. Then, in the **Value** box, type **1**. +6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/RequireDeferUpgrade**. Then, in the **Value** box, type **1**. -7. Click **OK** to save the setting. +7. Click **OK** to save the setting. -8. In the **OMA-URI Settings** section, click **Add**. +8. In the **OMA-URI Settings** section, click **Add**. -9. For this setting, in **Setting name**, type **Defer Updates for 1 Week**, and then in the **Data type** list, select **Integer**. +9. For this setting, in **Setting name**, type **Defer Updates for 1 Week**, and then in the **Data type** list, select **Integer**. -11. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferUpdatePeriod**. +11. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferUpdatePeriod**. -12. In the **Value** box, type **1**. +12. In the **Value** box, type **1**. -13. Click **OK** to save the setting. +13. Click **OK** to save the setting. -14. In the **OMA-URI Settings** section, click **Add**. +14. In the **OMA-URI Settings** section, click **Add**. -15. For this setting, in **Setting name**, type **Defer Upgrades for 1 Month**, and then in the **Data type** list, select **Integer**. +15. For this setting, in **Setting name**, type **Defer Upgrades for 1 Month**, and then in the **Data type** list, select **Integer**. -17. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferUpgradePeriod**. +17. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferUpgradePeriod**. -18. In the **Value** box, type **1**. +18. In the **Value** box, type **1**. -19. Click **OK** to save the setting. +19. Click **OK** to save the setting. Three settings should appear in the **Windows Update for Business – CBB2** policy. @@ -120,7 +123,7 @@ You have now configured the **Ring 4 Broad business users** deployment ring to e 20. Click **Save Policy**, and then click **Yes** at the **Deploy Policy** prompt. -21. In the **Manage Deployment** dialog box, select the **Ring 5 Broad business users #2** computer group, click **Add**, and then click **OK**. +21. In the **Manage Deployment** dialog box, select the **Ring 5 Broad business users #2** computer group, click **Add**, and then click **OK**. ## Configure Windows Update for Business in Windows 10 version 1607 @@ -158,8 +161,8 @@ In this example, you use three security groups from Table 1 in [Build deployment 8. Because the **Ring 2 Pilot Business Users** deployment ring receives the CB feature updates after 28 days, in the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. 8. In **Setting name**, type **Defer feature updates for 28 days**, and then select **Integer** from the **Data type** list. -10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. -11. In the **Value** box, type **28**, and then click **OK**. +10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. +11. In the **Value** box, type **28**, and then click **OK**. ![Settings for this policy](images/waas-wufb-intune-step11a.png) @@ -184,7 +187,7 @@ You have now configured the **Ring 2 Pilot Business Users** deployment ring to e 4. Name the policy **Windows Update for Business - CBB1**. Then, in the **OMA-URI Settings** section, click **Add**. -4. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. +5. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. 6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel**. @@ -196,22 +199,22 @@ You have now configured the **Ring 2 Pilot Business Users** deployment ring to e 8. Because the **Ring 4 Broad business users** deployment ring receives the CBB feature updates immediately, in the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. -8. In **Setting name**, type **Defer feature updates for 0 days**, and then select **Integer** from the **Data type** list. +9. In **Setting name**, type **Defer feature updates for 0 days**, and then select **Integer** from the **Data type** list. -10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. +10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. -11. In the **Value** box, type **0**, and then click **OK**. +11. In the **Value** box, type **0**, and then click **OK**. ![Settings for this policy](images/waas-wufb-intune-cbb1a.png) -9. Click **Save Policy**. +12. Click **Save Policy**. -9. In the **Deploy Policy: Windows Update for Business – CBB1** dialog box, click **Yes**. +13. In the **Deploy Policy: Windows Update for Business – CBB1** dialog box, click **Yes**. - >[!NOTE] - >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. + >[!NOTE] + >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. -10. In the **Manage Deployment: Windows Update for Business – CBB1** dialog box, select the **Ring 4 Broad business users** group, click **Add**, and then click **OK**. +14. In the **Manage Deployment: Windows Update for Business – CBB1** dialog box, select the **Ring 4 Broad business users** group, click **Add**, and then click **OK**. You have now configured the **Ring 4 Broad business users** deployment ring to receive CBB feature updates as soon as they’re available. Finally, configure **Ring 5 Broad business users #2** to accommodate a 7-day delay for quality updates and a 14-day delay for feature updates. @@ -226,7 +229,7 @@ You have now configured the **Ring 4 Broad business users** deployment ring to r 4. Name the policy **Windows Update for Business - CBB2**. Then, in the **OMA-URI Settings** section, click **Add**. -4. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. +5. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. 6. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel**. @@ -238,30 +241,30 @@ You have now configured the **Ring 4 Broad business users** deployment ring to r 8. In the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. -8. In **Setting name**, type **Defer quality updates for 7 days**, and then select **Integer** from the **Data type** list. +9. In **Setting name**, type **Defer quality updates for 7 days**, and then select **Integer** from the **Data type** list. -10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatesPeriodInDays**. +10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatesPeriodInDays**. -11. In the **Value** box, type **7**, and then click **OK**. +11. In the **Value** box, type **7**, and then click **OK**. -8. In the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. +12. In the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. -8. In **Setting name**, type **Defer feature updates for 14 days**, and then select **Integer** from the **Data type** list. +13. In **Setting name**, type **Defer feature updates for 14 days**, and then select **Integer** from the **Data type** list. -10. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. +14. In the **OMA-URI** box, type **./Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatesPeriodInDays**. -11. In the **Value** box, type **14**, and then click **OK**. +15. In the **Value** box, type **14**, and then click **OK**. ![Settings for this policy](images/waas-wufb-intune-cbb2a.png) -9. Click **Save Policy**. +16. Click **Save Policy**. -9. In the **Deploy Policy: Windows Update for Business – CBB2** dialog box, click **Yes**. +17. In the **Deploy Policy: Windows Update for Business – CBB2** dialog box, click **Yes**. - >[!NOTE] - >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. + >[!NOTE] + >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. -10. In the **Manage Deployment: Windows Update for Business – CBB2** dialog box, select the **Ring 5 Broad Business Users #2** group, click **Add**, and then click **OK**. +18. In the **Manage Deployment: Windows Update for Business – CBB2** dialog box, select the **Ring 5 Broad Business Users #2** group, click **Add**, and then click **OK**. ## Related topics @@ -279,7 +282,7 @@ You have now configured the **Ring 4 Broad business users** deployment ring to r - [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) - [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) - [Deploy Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) -- [Deploy Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) +- [Deploy Windows 10 updates using Microsoft Endpoint Configuration Manager](waas-manage-updates-configuration-manager.md) - [Manage device restarts after updates](waas-restart.md) diff --git a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md deleted file mode 100644 index 48fcd8eb4c..0000000000 --- a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md +++ /dev/null @@ -1,283 +0,0 @@ ---- -title: Frequently asked questions and troubleshooting Windows Analytics -description: Frequently asked questions about Windows Analytics and steps to take when things go wrong -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, updates, upgrades, log analytics, health, FAQ, problems, troubleshooting, error -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: jaimeo -ms.author: jaimeo -ms.localizationpriority: medium -ms.collection: M365-analytics -ms.topic: article ---- - -# Frequently asked questions and troubleshooting Windows Analytics - ->[!IMPORTANT] ->**The OMS portal has been deprecated; you should start using the [Azure portal](https://portal.azure.com) instead as soon as possible.** Many experiences are the same in the two portals, but there are some key differences. See [Windows Analytics in the Azure Portal](windows-analytics-azure-portal.md) for steps to use Windows Analytics in the Azure portal. For much more information about the transition from OMS to Azure, see [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition). - -This topic compiles the most common issues encountered with configuring and using Windows Analytics, as well as general questions. This FAQ, along with the [Windows Analytics Technical Community](https://techcommunity.microsoft.com/t5/Windows-Analytics/ct-p/WindowsAnalytics), are recommended resources to consult before contacting Microsoft support. - -## Troubleshooting common problems - -If you've followed the steps in the [Enrolling devices in Windows Analytics](windows-analytics-get-started.md) topic and are still encountering problems, you might find the solution here. - -[Devices not appearing in Upgrade Readiness](#devices-not-appearing-in-upgrade-readiness) - -[Devices not appearing in Device Health Device Reliability](#devices-not-appearing-in-device-health-device-reliability) - -[Device crashes not appearing in Device Health Device Reliability](#device-crashes-not-appearing-in-device-health-device-reliability) - -[Apps not appearing in Device Health App Reliability](#apps-not-appearing-in-device-health-app-reliability) - -[Upgrade Readiness shows many "Computers with outdated KB"](#upgrade-readiness-shows-many-computers-with-outdated-kb) - -[Upgrade Readiness shows many "Computers with incomplete data"](#upgrade-readiness-shows-many-computers-with-incomplete-data) - -[Upgrade Readiness doesn't show app inventory data on some devices](#upgrade-readiness-doesnt-show-app-inventory-data-on-some-devices) - -[Upgrade Readiness doesn't show IE site discovery data from some devices](#upgrade-readiness-doesnt-show-ie-site-discovery-data-from-some-devices) - -[Device names not appearing for Windows 10 devices](#device-names-not-appearing-for-windows-10-devices) - -[Custom log queries using the AbnormalShutdownCount field of Device Health show zero or lower than expected results](#custom-log-queries-using-the-abnormalshutdowncount-field-of-device-health-show-zero-or-lower-than-expected-results) - -[Disable Upgrade Readiness](#disable-upgrade-readiness) - -[Exporting large data sets](#exporting-large-data-sets) - - -### Devices not appearing in Upgrade Readiness - -In Log Analytics, go to **Settings > Connected sources > Windows telemetry** and verify that you are subscribed to the Windows Analytics solutions you intend to use. - -Even though devices can take 2-3 days after enrollment to show up due to latency in the system, you can now verify the status of your devices with a few hours of running the deployment script as described in [You can now check on the status of your computers within hours of running the deployment script](https://blogs.technet.microsoft.com/upgradeanalytics/2017/05/12/wheres-my-data/) on the Windows Analytics blog. - ->[!NOTE] -> If you generate the status report and get an error message saying "Sorry! We’re not recognizing your Commercial Id," go to **Settings > Connected sources > Windows telemetry** remove the Upgrade Readiness solution, and then re-add it. - -If devices are not showing up as expected, find a representative device and follow these steps to run the latest pilot version of the Upgrade Readiness deployment script on it to troubleshoot issues: - -1. Download and extract the [Upgrade Readiness Deployment Script](https://www.microsoft.com/download/details.aspx?id=53327). Ensure that the **Pilot/Diagnostics** folder is included. -2. Edit the script as described in [Upgrade Readiness deployment script](../upgrade/upgrade-readiness-deployment-script.md). -3. Check that `isVerboseLogging` is set to `$true`. -4. Run the script again. Log files will be saved to the directory specified in the script. -5. Check the output of the script in the command window and/or log **UA_dateTime_machineName.txt** to ensure that all steps were completed successfully. -6. If you are still seeing errors you can't diagnose, then consider open a support case with Microsoft Support through your regular channel and provide this information. - -If you want to check a large number of devices, you should run the latest script at scale from your management tool of choice (for example, System Center Configuration Manager) and check the results centrally. - -If you think the issue might be related to a network proxy, check "Enable data sharing" section of the [Enrolling devices in Windows Analytics](windows-analytics-get-started.md) topic. Also see [Understanding connectivity scenarios and the deployment script](https://blogs.technet.microsoft.com/upgradeanalytics/2017/03/10/understanding-connectivity-scenarios-and-the-deployment-script/) on the Windows Analytics blog. - -If you have deployed images that have not been generalized, then many of them might have the same ID and so Windows Analytics will see them as one device. If you suspect this is the issue, then you can reset the IDs on the non-generalized devices by performing these steps: -1. Net stop diagtrack -2. Reg delete hklm\software\microsoft\sqmclient /v MachineId /f -3. Net start diagtrack - -#### Devices not appearing in Device Health Device Reliability - -[![Device Reliability tile showing device count highlighted](images/device-reliability-device-count.png)](images/device-reliability-device-count.png) - -If you have devices that appear in other solutions, but not Device Health (the Device Health overview tile shows "Performing Assessment" or the device count is lower than expected), follow these steps to investigate the issue: -1. Using the Azure portal, remove the Device Health (appears as DeviceHealthProd on some pages) solution from your Log Analytics workspace. After completing this, add the Device Health solution to you workspace again. -2. Confirm that the devices are running Windows 10. -3. Verify that the Commercial ID is present in the device's registry. For details see [https://gpsearch.azurewebsites.net/#13551](https://gpsearch.azurewebsites.net/#13551). -4. Confirm that devices have opted in to provide diagnostic data by checking in the registry that **AllowTelemetry** is set to 2 (Enhanced) or 3 (Full) in **HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection** (or **HKLM\Software\Policies\Microsoft\Windows\DataCollection**, which takes precedence if set). -5. Verify that devices can reach the endpoints specified in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). Also check settings for SSL inspection and proxy authentication; see [Configuring endpoint access with SSL inspection](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#configuring-endpoint-access-with-ssl-inspection) for more information. -6. Remove the Device Health (appears as DeviceHealthProd on some pages) from your Log Analytics workspace -7. Wait 48 hours for activity to appear in the reports. -8. If you need additional troubleshooting, contact Microsoft Support. - - -### Device crashes not appearing in Device Health Device Reliability - -[![Device Reliability tile showing crash count highlighted](images/device-reliability-crash-count.png)](images/device-reliability-crash-count.png) - -If you know that devices are experiencing stop error crashes that do not seem to be reflected in the count of devices with crashes, follow these steps to investigate the issue: - -1. Verify that devices are reporting data properly by following the steps in the [Devices not appearing in Device Health Device Reliability](#devices-not-appearing-in-device-health-device-reliability) section of this topic. -2. Trigger a known crash on a test device by using a tool such as [NotMyFault](https://docs.microsoft.com/sysinternals/downloads/notmyfault) from Windows Sysinternals. -3. Verify that Windows Error Reporting (WER) is not disabled or redirected by confirming the registry settings in **HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting** (or **HKLM\Software\Policies\Microsoft\Windows\DataCollection**, which will take precedence if set): - - - Verify that the value "Disabled" (REG_DWORD), if set, is 0. - - Verify that the value "DontSendAdditionalData" (REG_DWORD), if set, is 0. - - Verify that the value "CorporateWERServer" (REG_SZ) is not configured. - -4. Verify that WER can reach all diagnostic endpoints specified in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md)--if WER can only reach some of the endpoints, it could be included in the device count while not reporting crashes. -5. Check that crash reports successfully complete the round trip with Event 1001 and that BucketID is not blank. A typical such event looks like this: - - [![Event viewer detail showing Event 1001 details](images/event_1001.png)](images/event_1001.png) - - You can use the following Windows PowerShell snippet to summarize recent occurrences of Event 1001. Most events should have a value for BucketID (a few intermittent blank values are OK, however). - - ```powershell - $limitToMostRecentNEvents = 20 - Get-WinEvent -FilterHashTable @{ProviderName="Windows Error Reporting"; ID=1001} | - ?{ $_.Properties[2].Value -match "crash|blue" } | - % { [pscustomobject]@{ - TimeCreated=$_.TimeCreated - WEREvent=$_.Properties[2].Value - BucketId=$_.Properties[0].Value - ContextHint = $( - if($_.Properties[2].Value -eq "bluescreen"){"kernel"} - else{ $_.Properties[5].Value } - ) - }} | Select-Object -First $limitToMostRecentNEvents - ``` - The output should look something like this: - [![Typical output for this snippet](images/device-reliability-event1001-PSoutput.png)](images/device-reliability-event1001-PSoutput.png) - -6. Check that some other installed device, app, or crash monitoring solution is not intercepting crash events. -7. Wait 48 hours for activity to appear in the reports. -8. If you need additional troubleshooting, contact Microsoft Support. - -#### Endpoint connectivity - -Devices must be able to reach the endpoints specified in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). - -If you are using proxy server authentication, it's worth taking extra care to check the configuration. Prior to Windows 10, version 1703, WER only uploads error reports in the machine context, so whitelisting endpoints to allow non-authenticated access was typically used. In Windows 10, version 1703 and later versions, WER will attempt to use the context of the user that is logged on for proxy authentication such that only the user account requires proxy access. - - -For more information, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md#configuring-endpoint-access-with-proxy-server-authentication). - -### Apps not appearing in Device Health App Reliability - -[![App Reliability tile showing relability events trend](images/app-reliability.png)](images/app-reliability.png) - -If apps that you know are crashing do not appear in App Reliability, follow these steps to investigate the issue: - -1. Double-check the steps in the [Devices not appearing in Device Health Device Reliability](#devices-not-appearing-in-device-health-device-reliability) and [Device crashes not appearing in Device Health Device Reliability](#device-crashes-not-appearing-in-device-health-device-reliability) sections of this topic. -2. Confirm that an in-scope application has crashed on an enrolled device. Keep the following points in mind: - - Not all user-mode crashes are included in App Reliability, which tracks only apps that have a GUI, have been used interactively by a user, and are not part of the operating system. - - Enrolling more devices helps to ensure that there are enough naturally occurring app crashes. - - You can also use test apps which are designed to crash on demand. - -3. Verify that *per-user* Windows Error Reporting (WER) is not disabled or redirected by confirming the registry settings in **HKCU\SOFTWARE\Microsoft\Windows\Windows Error Reporting** (or **HKCU\Software\Policies\Microsoft\Windows\DataCollection**, which will take precedence if set): - - - Verify that the value "Disabled" (REG_DWORD), if set, is 0. - - Verify that the value "DontSendAdditionalData" (REG_DWORD), if set, is 0. - - Verify that the value "CorporateWERServer" (REG_SZ) is not configured. -4. Check that some other installed device, app, or crash monitoring solution is not intercepting crash events. -5. Wait 48 hours for activity to appear in the reports. -6. If you need additional troubleshooting, contact Microsoft Support. - - -### Upgrade Readiness shows many "Computers with outdated KB" -If you see a large number of devices reported as shown in this screenshot of the Upgrade Readiness tile: - -[![Upgrade Readiness tile showing Computers with outdated KB datum in red box](images/outdated_outdated.png)](images/outdated_outdated.png) - -On Windows 7 SP1 and Windows 8.1 devices, you must deploy the compatibility update as described in [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). - -Note that the compatibility update retains the same KB number when a new version is released, so even if the update is installed on your devices, *they might not be running the latest version*. The compatibility update is now a critical update, so you can check that the latest version is installed from your management tool. - - -### Upgrade Readiness shows many "Computers with incomplete data" -If you see a large number of devices reported as shown in this screenshot of the Upgrade Readiness tile: - -[![Upgrade Readiness tile showing Computers with incomplete data datum in red box](images/outdated_incomplete.png)](images/outdated_incomplete.png) - -Download the latest deployment script and run it on an affected device to check for issues. See the [Upgrade Readiness deployment script](../upgrade/upgrade-readiness-deployment-script.md) topic for information about obtaining and running the script, and for a description of the error codes that can be displayed. Remember to wait up to 48-72 hours to see the results. -See ["Understanding connectivity scenarios and the deployment script"](https://blogs.technet.microsoft.com/upgradeanalytics/2017/03/10/understanding-connectivity-scenarios-and-the-deployment-script/) on the Windows Analytics blog for a summary of setting the ClientProxy for the script, which will enable the script properly check for diagnostic data endpoint connectivity. - - -If this becomes a recurring issue, schedule a full inventory scan monthly, as per the device enrollment guidelines for deployment at scale. - - - -### Upgrade Readiness doesn't show app inventory data on some devices -Upgrade Readiness only collects app inventory on devices that are not yet upgraded to the target operating system version specified in the Upgrade Readiness Overview blade. This is because Upgrade Readiness targets upgrade planning (for devices not yet upgraded). - - -### Upgrade Readiness doesn't show IE site discovery data from some devices -Double-check that IE site discovery opt-in has been configured in the deployment script. (See the [Upgrade Readiness deployment script](../upgrade/upgrade-readiness-deployment-script.md) topic for information about obtaining and running the script, and for a description of the error codes that can be displayed. See ["Understanding connectivity scenarios and the deployment script"](https://blogs.technet.microsoft.com/upgradeanalytics/2017/03/10/understanding-connectivity-scenarios-and-the-deployment-script/) on the Windows Analytics blog for a summary of setting the ClientProxy for the script, which will enable the script properly check for diagnostic data endpoint connectivity.) - -Also, on Windows 10 devices remember that IE site discovery requires data diagnostics set to the Enhanced level. -Finally, Upgrade Readiness only collects IE site discovery data on devices that are not yet upgraded to the target operating system version specified in the Upgrade Readiness Overview blade. This is because Upgrade Readiness targets upgrade planning (for devices not yet upgraded). - ->[!NOTE] -> IE site discovery is disabled on devices running Windows 7 and Windows 8.1 that are in Switzerland and EU countries. - -### Device names not appearing for Windows 10 devices -Starting with Windows 10, version 1803, the device name is no longer collected by default and requires a separate opt-in. For more information, see [Enrolling devices in Windows Analytics](windows-analytics-get-started.md). Allowing device names to be collected can make it easier for you to identify individual devices that report problems. Without the device name, Windows Analytics can only label devices by a GUID that it generates. - -### Custom log queries using the AbnormalShutdownCount field of Device Health show zero or lower than expected results -This issue affects custom queries of the Device Health data by using the **Logs > Search page** or API. It does not impact any of the built-in tiles or reports of the Device Health solution. The **AbnormalShutdownCount** field of the **DHOSReliability** data table represents abnormal shutdowns other than crashes, such as sudden power loss or holding down the power button. - -We have identified an incompatibility between AbnormalShutdownCount and the Limited Enhanced diagnostic data level on Windows 10, versions 1709, 1803, and 1809. Such devices do not send the abnormal shutdown signal to Microsoft. You should not rely on AbnormalShutdownCount in your custom queries unless you use any one of the following workarounds: - - -- Upgrade devices to Windows 10, version 1903 when available. Participants in the Windows Insider program can preview this change using Windows Insider builds. -- Change the diagnostic data setting from devices running Windows 10, versions 1709, 1803, and 1809 normal Enhanced level instead of Limited Enhanced. -- Use alternative data from devices to track abnormal shutdowns. For example, you can forward abnormal shutdown events from the Windows Event Log to your Log Analytics workspace by using the Log Analytics agent. Suggested events to forward include: - - Log: System, ID: 41, Source: Kernel-Power - - Log System, ID: 6008, Source: EventLog - - - -### Disable Upgrade Readiness - -If you want to stop using Upgrade Readiness and stop sending diagnostic data to Microsoft, follow these steps: - -1. Unsubscribe from the Upgrade Readiness solution in Azure Portal. In Azure Portal, go to **Settings** > **Connected Sources** > **Windows Telemetry** and choose the **Unsubscribe** option. - - ![Upgrade Readiness unsubscribe](images/upgrade-analytics-unsubscribe.png) - -2. Disable the Commercial Data Opt-in Key on computers running Windows 7 SP1 or 8.1. On computers running Windows 10, set the diagnostic data level to **Security**: - - **Windows 7 and Windows 8.1**: Delete CommercialDataOptIn registry property from *HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection* - - **Windows 10**: Follow the instructions in [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization). - -3. If you enabled **Internet Explorer Site Discovery**, you can disable Internet Explorer data collection by setting the *IEDataOptIn* registry key to value "0". The IEDataOptIn key can be found under: *HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection*. -4. **Optional step:** You can also remove the “CommercialId” key from: "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection". - -### Exporting large data sets - -Azure Log Analytics is optimized for advanced analytics of large data sets and can efficiently generate summaries and analytics for them. The query language is not optimized (or intended) for returning large raw data sets and has built-in limits to protect against overuse. There are times when it might be necessary to get more data than this, but that should be done sparingly since this is not the intended way to use Azure Log Analytics. The following code snippet shows how to retrieve data from UAApp one “page” at a time: - -``` -let snapshot = toscalar(UAApp | summarize max(TimeGenerated)); -let pageSize = 100000; -let pageNumber = 0; - -UAApp -| where TimeGenerated == snapshot and IsRollup==true and RollupLevel=="Granular" and Importance == "Low install count" -| order by AppName, AppVendor, AppVersion desc -| serialize -| where row_number(0) >= (pageSize * pageNumber) -| take pageSize -``` - - - -## Other common questions - -### What are the requirements and costs for Windows Analytics solutions? -| Windows Analytics solution| Windows license requirements | Windows version requirements | Minimum diagnostic data requirements | -|----------------------|-----------------------------------|------------------------------|------------------------------| -| Upgrade Readiness | No additional requirements | Windows 7 with Service Pack 1, Windows 8.1, Windows 10 | Basic level in most cases; Enhanced level to support Windows 10 app usage data and IE site discovery | -| Update Compliance | No additional requirements | Windows 10 | Basic level | -| Device Health | **Any** of the following licenses:
                                - Windows 10 Enterprise or Windows 10 Education per-device with active Software Assurance
                                - Windows 10 Enterprise E3 or E5 per-device or per-user subscription (including Microsoft 365 F1, E3, or E5)
                                - Windows 10 Education A3 or A5 (including Microsoft 365 Education A3 or A5)
                                - Windows VDA E3 or E5 per-device or per-user subscription
                                - Windows Server 2016 or later | Windows 10 | - For Windows 10 version 1709 or later: Enhanced (Limited)
                                - For earlier versions: Enhanced - ->[!NOTE] -> Regarding licensing requirements for Device Health, you do not need per-seat licensing, but only enough licenses to cover your total device usage. For example, if you have 100 E3 licenses, you can monitor 100 devices with Device Health. - -Beyond the cost of Windows operating system licenses, there is no additional cost for using Windows Analytics. Within Azure Log Analytics, Windows Analytics is "zero-rated;" this means it is excluded from data limits and costs regardless of the Azure Log Analytics pricing tier you have chosen. To be more specific, Azure Log Analytics is available in different pricing tiers as described in [Pricing - Log Analytics](https://azure.microsoft.com/pricing/details/log-analytics/). -- If you are using the free tier, which has a cap on the amount of data collected per day, the Windows Analytics data will not count towards this cap. You will be able to collect all the Windows Analytics data from your devices and still have the full cap available for collecting additional data from other sources. -- If you are using a paid tier that charges per GB of data collected, the Windows Analytics data will not be charged. You will be able to collect all the Windows Analytics data from your devices and not incur any costs. - -Note that different Azure Log Analytics plans have different data retention periods, and the Windows Analytics solutions inherit the workspace's data retention policy. So, for example, if your workspace is on the free plan then Windows Analytics will retain the last week's worth of "daily snapshots" that are collected in the workspace. - - -### Why do SCCM and Upgrade Readiness show different counts of devices that are ready to upgrade? -System Center Configuration Manager (SCCM) considers a device ready to upgrade if *no installed app* has an upgrade decision of “not ready” (that is, they are all "ready" or "in progress"), while Upgrade Readiness considers a device ready to upgrade only if *all* installed apps are marked “ready”. -  -Currently, you can choose the criteria you wish to use: -- To use the SCCM criteria, create the collection of devices ready to upgrade within the SCCM console (using the analytics connector). -- To use the Upgrade Readiness criteria, export the list of ready-to-upgrade devices from the corresponding Upgrade Readiness report, and then build the SCCM collection from that spreadsheet. - -### How does Upgrade Readiness collect the inventory of devices and applications? -For details about this process and some tips, see [How does Upgrade Readiness in WA collects application inventory for your OMS workspace?](https://techcommunity.microsoft.com/t5/Windows-Analytics-Blog/How-does-Upgrade-Readiness-in-WA-collects-application-inventory/ba-p/213586) on the Windows Analytics blog. diff --git a/windows/deployment/update/windows-analytics-azure-portal.md b/windows/deployment/update/windows-analytics-azure-portal.md deleted file mode 100644 index 7e923f2c27..0000000000 --- a/windows/deployment/update/windows-analytics-azure-portal.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Windows Analytics in the Azure Portal -description: Use the Azure Portal to add and configure Windows Analytics solutions -keywords: Device Health, oms, Azure, portal, operations management suite, add, manage, configure, Upgrade Readiness, Update Compliance -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: jaimeo -ms.author: jaimeo -ms.localizationpriority: medium -ms.collection: M365-analytics -ms.topic: article ---- - -# Windows Analytics in the Azure Portal - -Windows Analytics uses Azure Log Analytics (formerly known as Operations Management Suite or OMS), a collection of cloud-based servicing for monitoring and automating your on-premises and cloud environments. - -**The OMS portal has been deprecated; you should start using the [Azure portal](https://portal.azure.com) instead as soon as possible.** Many experiences are the same in the two portals, but there are some key differences, which this topic will explain. For much more information about the transition from OMS to Azure, see [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition). - -## Navigation and permissions in the Azure portal - -Go to the [Azure portal](https://portal.azure.com), select **All services**, and search for *Log Analytics*. Once it appears, you can select the star to add it to your favorites for easy access in the future. - -[![Azure portal all services page with Log Analytics found and selected as favorite](images/azure-portal-LAfav1.png)](images/azure-portal-LAfav1.png) - -### Permissions - -It's important to understand the difference between Azure Active Directory and an Azure subscription: - -**Azure Active Directory** is the directory that Azure uses. Azure Active Directory (AD) is a separate service which sits by itself and is used by all of Azure and also Office 365. - -An **Azure subscription** is a container for billing, but also acts as a security boundary. Every Azure subscription has a trust relationship with at least one Azure AD instance. This means that a subscription trusts that directory to authenticate users, services, and devices. - - ->[!IMPORTANT] ->Unlike the OMS portal (which only requires permission to access the Azure Log Analytics workspace), the Azure portal also requires access to be configured to either the linked *Azure subscription* or Azure resource group. - -To check the Log Analytics workspaces you can access, select **Log Analytics**. You should see a grid control listing all workspaces, along with the Azure subscription each is linked to: - -[![Log Analytics workspace page showing accessible workspaces and linked Azure subscriptions](images/azure-portal-LAmain-wkspc-subname-sterile.png)](images/azure-portal-LAmain-wkspc-subname-sterile.png) - -If you do not see your workspace in this view, but you are able to access the workspace from the classic portal, that means you do not have access to the workspace's Azure subscription or resource group. To remedy this, you will need to find someone with admin rights to grant you access, which they can do by selecting the subscription name and selecting **Access control (IAM)** (alternatively they can configure your access at the resource group level). They should either grant you "Log Analytics Reader" access (for read-only access) or "Log Analytics Contributor" access (which enables making changes such as creating deployment plans and changing application readiness states). - -When permissions are configured, you can select the workspace and then select **Workspace summary** to see information similar to what was shown in the OMS overview page. - -[![Log Analytics workspace page showing workspace summary](images/azure-portal-LA-wkspcsumm_sterile.png)](images/azure-portal-LA-wkspcsumm_sterile.png) - -## Adding Windows Analytics solutions - -In the Azure portal, the simplest way to add Windows Analytics solutions (Upgrade Readiness, Update Compliance, and Device Health) is to select **+ Create a resource** and then type the solution name in the search box. In this example, the search is for "Device Health": - -[![Add WA solutions with "create a resource"](images/azure-portal-create-resource-boxes.png)](images/azure-portal-create-resource-boxes.png) - -Select the solution from the list that is returned by the search, and then select **Create** to add the solution. - -## Navigating to Windows Analytics solutions settings - -To adjust settings for a Windows Analytics solution, first navigate to the **Solutions** tab for your workspace, and then select the solution to configure. In this example, Upgrade Readiness is being adjusted by selecting **CompatibilityAssessment**: - -[![Select WA solution to adjust settings](images/temp-azure-portal-soltn-setting.png)](images/temp-azure-portal-soltn-setting.png) - -From there, select the settings page to adjust specific settings: - -[![Settings page for Upgrade Readiness in Azure portsl](images/azure-portal-UR-settings.png)](images/azure-portal-UR-settings.png) - ->[!NOTE] ->To access these settings, both the subscription and workspace require "contributor" permissions. You can view your current role and make changes in other roles by using the **Access control (IAM)** tab in Azure. diff --git a/windows/deployment/update/windows-analytics-get-started.md b/windows/deployment/update/windows-analytics-get-started.md deleted file mode 100644 index f0ee52dd38..0000000000 --- a/windows/deployment/update/windows-analytics-get-started.md +++ /dev/null @@ -1,191 +0,0 @@ ---- -title: Enrolling devices in Windows Analytics (Windows 10) -description: Enroll devices to enable use of Update Compliance, Upgrade Readiness, and Device Health in Windows Analytics. -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, updates, upgrades, log analytics, health, azure portal -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: jaimeo -ms.author: jaimeo -ms.localizationpriority: medium -ms.collection: M365-analytics -ms.topic: article ---- - -# Enrolling devices in Windows Analytics - -If you have not already done so, consult the topics for any of the three Windows Analytics solutions (Update Compliance, Upgrade Readiness, and Device Health) you intend to use and follow the steps there to add the solutions to Azure Portal. - -- [Get started with Device Health](device-health-get-started.md) -- [Get started with Update Compliance](update-compliance-get-started.md) -- [Get started with Upgrade Readiness](../upgrade/upgrade-readiness-get-started.md) - -If you've already done that, you're ready to enroll your devices in Windows Analytics by following these steps: - - - -## Copy your Commercial ID key - -Microsoft uses a unique commercial ID to map information from user computers to your Azure workspace. This should be generated for you automatically. Copy your commercial ID key from any of the Windows Analytics solutions you have added to your Windows Portal, and then deploy it to user computers. - -To find your commercial ID, first navigate to the **Solutions** tab for your workspace, and then select the solution. In this example, Upgrade Readiness is being adjusted by selecting **CompatibilityAssessment**: - -[![Select WA solution to adjust settings](images/temp-azure-portal-soltn-setting.png)](images/temp-azure-portal-soltn-setting.png) - -From there, select the settings page, where you can find and copy your commercial ID: - -[![Settings page for Upgrade Readiness in Azure portsl](images/azure-portal-UR-settings.png)](images/azure-portal-UR-settings.png) - - - - ->**Important**
                                Regenerate a Commercial ID key only if your original ID key can no longer be used. Regenerating a commercial ID key resets the data in your workspace for all solutions that use the ID. Additionally, you’ll need to deploy the new commercial ID key to user computers again. - - -## Enable data sharing - -To enable data sharing, configure your proxy server to whitelist the following endpoints. You might need to get approval from your security group to do this. - -| **Endpoint** | **Function** | -|---------------------------------------------------------|-----------| -|`https://ceuswatcab01.blob.core.windows.net` | Windows Error Reporting (WER); required for Device Health reports in Windows 10, version 1809 or later. Not used by Upgrade Readiness or Update Compliance AV reports. | -| `https://ceuswatcab02.blob.core.windows.net` | Windows Error Reporting (WER); required for Device Health reports in Windows 10, version 1809 or later. Not used by Upgrade Readiness or Update Compliance AV reports. | -| `https://eaus2watcab01.blob.core.windows.net` | Windows Error Reporting (WER); required for Device Health reports in Windows 10, version 1809 or later. Not used by Upgrade Readiness or Update Compliance AV reports. | -| `https://eaus2watcab02.blob.core.windows.net` | Windows Error Reporting (WER); required for Device Health reports in Windows 10, version 1809 or later. Not used by Upgrade Readiness or Update Compliance AV reports. | -| `https://weus2watcab01.blob.core.windows.net` | Windows Error Reporting (WER); required for Device Health reports in Windows 10, version 1809 or later. Not used by Upgrade Readiness or Update Compliance AV reports. | -| `https://weus2watcab02.blob.core.windows.net` | Windows Error Reporting (WER); required for Device Health reports in Windows 10, version 1809 or later. Not used by Upgrade Readiness or Update Compliance AV reports. | -| `https://v10c.events.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for use with devices running Windows 10, version 1803 or later **that also have the 2018-09 Cumulative Update (KB4458469, KB4457136, KB4457141) or later installed** | -| `https://v10.events.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for use with Windows 10, version 1803 *without* the 2018-09 Cumulative Update installed | -| `https://v10.vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1709 or earlier | -| `https://vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for operating systems older than Windows 10 | -| `https://settings-win.data.microsoft.com` | Enables the compatibility update to send data to Microsoft. | -| `http://adl.windows.com` | Allows the compatibility update to receive the latest compatibility data from Microsoft. | -| `https://watson.telemetry.microsoft.com` | Windows Error Reporting (WER); required for Device Health reports. Not used by Upgrade Readiness or Update Compliance AV reports. | -| `https://oca.telemetry.microsoft.com` | Online Crash Analysis; required for Device Health reports. Not used by Upgrade Readiness or Update Compliance AV reports. | -| `https://login.live.com` | This endpoint is required by Device Health to ensure data integrity and provides a more reliable device identity for all of the Windows Analytics solutions on Windows 10. If you want to disable end-user managed service account (MSA) access, you should apply the appropriate [policy](https://docs.microsoft.com/windows/security/identity-protection/access-control/microsoft-accounts#block-all-consumer-microsoft-account-user-authentication) instead of blocking this endpoint. | -| `https://www.msftncsi.com` | Windows Error Reporting (WER); required for Device Health to check connectivity | -| `https://www.msftconnecttest.com` | Windows Error Reporting (WER); required for Device Health to check connectivity | - - ->[!NOTE] ->Proxy authentication and SSL inspections are frequent challenges for enterprises. See the following sections for configuration options. - -### Configuring endpoint access with SSL inspection -To ensure privacy and data integrity Windows checks for a Microsoft SSL certificate when communicating with the diagnostic data endpoints. Accordingly SSL interception and inspection is not possible. To use Windows Analytics services you should exclude the above endpoints from SSL inspection. - -### Configuring endpoint access with proxy server authentication -If your organization uses proxy server authentication for outbound traffic, use one or more of the following approaches to ensure that the diagnostic data is not blocked by proxy authentication: - -- **Best option: Bypass** Configure your proxy servers to **not** require proxy authentication for traffic to the diagnostic data endpoints. This is the most comprehensive solution and it works for all versions of Windows 10. -- **User proxy authentication:** Alternatively, you can configure devices to use the logged on user's context for proxy authentication. First, update the devices to Windows 10, version 1703 or later. Then, ensure that users of the devices have proxy permission to reach the diagnostic data endpoints. This requires that the devices have console users with proxy permissions, so you couldn't use this method with headless devices. -- **Device proxy authentication:** Another option--the most complex--is as follows: First, configure a system level proxy server on the devices. Then, configure these devices to use machine-account-based outbound proxy authentication. Finally, configure proxy servers to allow the machine accounts access to the diagnostic data endpoints. - -## Deploy the compatibility update and related updates - -The compatibility update scans your devices and enables application usage tracking. If you don’t already have these updates installed, you can download the applicable version from the Microsoft Update Catalog or deploy it using Windows Server Update Services (WSUS) or your software distribution solution, such as System Center Configuration Manager. - -| **Operating System** | **Updates** | -|----------------------|-----------------------------------------------------------------------------| -| Windows 10 | Windows 10 includes the compatibility update, so you will automatically have the latest compatibility update so long as you continue to keep your Windows 10 devices up to date with cumulative updates. | -| Windows 8.1 | [KB 2976978](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2976978)
                                Performs diagnostics on the Windows 8.1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues might be encountered when the latest Windows operating system is installed.
                                For more information about this update, see | -| Windows 7 SP1 | [KB2952664](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB2952664)
                                Performs diagnostics on the Windows 7 SP1 systems that participate in the Windows Customer Experience Improvement Program. These diagnostics help determine whether compatibility issues might be encountered when the latest Windows operating system is installed.
                                For more information about this update, see | - -We also recommend installing the latest [Windows Monthly Rollup](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=security%20monthly%20quality%20rollup) on Windows 7 and Windows 8.1 devices. - ->[!IMPORTANT] ->Restart devices after you install the compatibility updates for the first time. - ->[!NOTE] ->We recommend you configure your update management tool to automatically install the latest version of these updates. There is a related optional update, [KB 3150513](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=3150513), which can provide updated configuration and definitions for older compatibiltiy updates. For more information about this optional update, see . - - - -If you are planning to enable IE Site Discovery in Upgrade Readiness, you will need to install a few additional updates. - -| **Site discovery** | **Update** | -|----------------------|-----------------------------------------------------------------------------| -| [Review site discovery](../upgrade/upgrade-readiness-additional-insights.md#site-discovery) | [KB3080149](https://www.catalog.update.microsoft.com/Search.aspx?q=3080149)
                                Updates the Diagnostic and Telemetry tracking service to existing devices. This update is only necessary on Windows 7 and Windows 8.1 devices.
                                For more information about this update, see

                                Install the latest [Windows Monthly Rollup](https://catalog.update.microsoft.com/v7/site/Search.aspx?q=security%20monthly%20quality%20rollup). This functionality has been included in Internet Explorer 11 starting with the July 2016 Cumulative Update. | - ->[!NOTE] -> IE site discovery is disabled on devices running Windows 7 and Windows 8.1 that are in Switzerland and EU countries. - -## Set diagnostic data levels - -You can set the diagnostic data level used by monitored devices either with the [Upgrade Readiness deployment script](../upgrade/upgrade-readiness-deployment-script.md) or by policy (by using Group Policy or Mobile Device Management). - -The basic functionality of Upgrade Readiness will work at the Basic diagnostic data level, you won't get usage or health data for your updated devices without enabling the Enhanced level. This means you won't get information about health regressions on updated devices. So it is best to enable the Enhanced diagnostic data level, at least on devices running Windows 10, version 1709 (or later) where the Enhanced diagnostic data setting can be paired with "limited enhanced" data level (see [Windows 10 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields)). For more information, see [Windows Analytics and privacy](https://docs.microsoft.com/windows/deployment/update/windows-analytics-privacy). - -## Enroll a few pilot devices - -You can use the Upgrade Readiness deployment script to automate and verify your deployment. We always recommend manually running this script on a few representative devices to verify things are properly configured and the device can connect to the diagnostic data endpoints. Make sure to run the pilot version of the script, which will provide extra diagnostics. - -See the [Upgrade Readiness deployment script](../upgrade/upgrade-readiness-deployment-script.md) topic for information about obtaining and running the script, and for a description of the error codes that can be displayed. See ["Understanding connectivity scenarios and the deployment script"](https://blogs.technet.microsoft.com/upgradeanalytics/2017/03/10/understanding-connectivity-scenarios-and-the-deployment-script/) on the Windows Analytics blog for a summary of setting the ClientProxy for the script, which will enable the script properly check for diagnostic data endpoint connectivity. - -After data is sent from devices to Microsoft, it generally takes 48-56 hours for the data to populate in Windows Analytics. The compatibility update takes several minutes to run. If the update does not get a chance to finish running or if the computers are inaccessible (turned off or sleeping for example), data will take longer to populate in Windows Analytics. For this reason, you can expect most of your devices to be populated in Windows Analytics in about 1-2 weeks after deploying the update and configuration to user computers. As described in the Windows Analytics blog post ["You can now check on the status of your computers within hours of running the deployment script"](https://blogs.technet.microsoft.com/upgradeanalytics/2017/05/12/wheres-my-data/), you can verify that devices have successfully connected to the service within a few hours. Most of those devices should start to show up in the Windows Analytics console within a few days. - -## Deploy additional optional settings - -Certain Windows Analytics features have additional settings you can use. - -- **Update Compliance** is only compatible with Windows 10 desktop devices (workstations and laptops). To use the Windows Defender Antivirus Assessment, devices must be protected by Windows Defender AV (and not a partner antivirus application), and must have enabled cloud-delivered protection, as described in [Utilize Microsoft cloud-delivered protection in Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus). See the [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/troubleshoot-reporting) topic for help with ensuring that the configuration is correct. - -- For devices running Windows 10, version 1607 or earlier, Windows diagnostic data must also be set to Enhanced (see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization#enhanced-level)) in order to be compatible with Windows Defender Antivirus. See the [Windows Defender Antivirus in Windows 10 and Windows Server 2016](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) for more information about enabling, configuring, and validating Windows Defender AV. - -- **Device Health** is only compatible with Windows 10 desktop devices (workstations and laptops) and Windows Server 2016. The solution requires that at least the Enhanced level of diagnostic data is enabled on all devices that are intended to be displayed in the solution. In Windows 10, version 1709, a new policy was added to "limit enhanced telemetry to the minimum required by Windows Analytics". To learn more about Windows diagnostic data, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization). - -- **IE site discovery** is an optional feature of Upgrade Readiness that provides an inventory of websites that are accessed by client devices using Internet Explorer on Windows 7, Windows 8.1, and Windows 10. To enable IE site discovery, make sure the required updates are installed (per previous section) and enable IE site discovery in the deployment script batch file. - -## Deploying Windows Analytics at scale - -When you have completed a pilot deployment, you are ready to automate data collection and distribute the deployment script to the remaining devices in your organization. - -### Automate data collection - -To ensure that user computers are receiving the most up-to-date data from Microsoft, we recommend that you establish the following data sharing and analysis processes: - -- Enable automatic updates for the compatibility update and related updates. These updates include the latest application and driver issue information as we discover it during testing. -- Schedule the Upgrade Readiness deployment script to automatically run monthly. Scheduling the script ensures that full inventory is sent monthly even if devices were not connected or had low battery power at the time the system normally sends inventory. Make sure to run the production version of the script, which is lighter weight and non-interactive. The script also has a number of built-in error checks, so you can monitor the results. If you can't run the deployment script at scale, another option is to configure things centrally via Group Policy or Mobile Device Management (MDM). Although we recommend using the deployment script, both options are discussed in the sections below. - -When you run the deployment script, it initiates a full scan. The daily scheduled task to capture the changes is created when the update package is installed. For Windows 10 devices, this task is already included in the operating system. A full scan averages about 2 MB, but the scans for changes are very small. The scheduled task is named "Windows Compatibility Appraiser" and can be found in the Task Scheduler Library under Microsoft > Windows > Application Experience. Changes are invoked via the nightly scheduled task. It attempts to run around 3:00AM every day. If the system is powered off at that time, the task will run when the system is turned on. - -### Distribute the deployment script at scale - -Use a software distribution system such as System Center Configuration Manager to distribute the Upgrade Readiness deployment script at scale. For more information, see [Upgrade Readiness deployment script](https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-deployment-script). For information on how to deploy PowerShell scripts by using Windows Intune, see [Manage PowerShell scripts in Intune for Windows 10 devices](https://docs.microsoft.com/intune/intune-management-extension). - -### Distributing policies at scale -There are a number of policies that can be centrally managed to control Windows Analytics device configuration. All of these policies have *preference* registry key equivalents that can be set by using the deployment script. Policy settings override preference settings if both are set. ->[!NOTE] ->You can only set the diagnostic data level to Enhanced by using policy. For example, this is necessary for using Device Health. - -These policies are under Microsoft\Windows\DataCollection: - -| Policy | Value | -|-----------------------|------------------| -| CommercialId | In order for your devices to show up in Windows Analytics, they must be configured with your organization’s Commercial ID. | -| AllowTelemetry (in Windows 10) | 1 (Basic), 2 (Enhanced) or 3 (Full) diagnostic data. Windows Analytics will work with basic diagnostic data, but more features are available when you use the Enhanced level (for example, Device Health requires Enhanced diagnostic data and Upgrade Readiness only collects app usage and site discovery data on Windows 10 devices with Enhanced diagnostic data). For more information, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization). | -| LimitEnhancedDiagnosticDataWindowsAnalytics (in Windows 10) | Only applies when AllowTelemetry=2. Limits the Enhanced diagnostic data events sent to Microsoft to just those needed by Windows Analytics. For more information, see [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields).| -| AllowDeviceNameInTelemetry (in Windows 10) | In Windows 10, version 1803, a separate opt-in is required to enable devices to continue to send the device name. Allowing device names to be collected can make it easier for you to identify individual devices that report problems. Without the device name, Windows Analytics can only label devices by a GUID that it generates. | -| CommercialDataOptIn (in Windows 7 and Windows 8) | 1 is required for Upgrade Readiness, which is the only solution that runs on Windows 7 or Windows 8. | - - -You can set these values by using Group Policy (in Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds) or by using Mobile Device Management (in Provider/*Provider ID*/CommercialID). (If you are using Microsoft Intune, use `MS DM Server` as the provider ID.) For more information about deployment using MDM, see the [DMClient CSP](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp) topic in MDM documentation. - -The corresponding preference registry values are available in **HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection** and can be configured by the deployment script. If a given setting is configured by both preference registry settings and policy, the policy values will override. However, the **IEDataOptIn** setting is different--you can only set this with the preference registry keys: - -- IEOptInLevel = 0 Internet Explorer data collection is disabled -- IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones -- IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones -- IEOptInLevel = 3 Data collection is enabled for all sites - -For more information about Internet Explorer Security Zones, see [About URL Security Zones](https://docs.microsoft.com/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537183(v=vs.85)). - -### Distribution at scale without using the deployment script - -We recommend using the deployment script to configure devices. However if this is not an option, you can still manage settings by policy as described in the previous section. However, if you don't run the deployment script, you won't benefit from its error checking, and you might have to wait a long time (possibly weeks) before devices send the initial full inventory scan. - -Note that it is possible to intiate a full inventory scan on a device by calling these commands: -- CompatTelRunner.exe -m:generaltel.dll -f:DoCensusRun -- CompatTelRunner.exe -m:appraiser.dll -f:DoScheduledTelemetryRun ent - -For details on how to run these and how to check results, see the deployment script. diff --git a/windows/deployment/update/windows-analytics-overview.md b/windows/deployment/update/windows-analytics-overview.md deleted file mode 100644 index 8ebb6a4bff..0000000000 --- a/windows/deployment/update/windows-analytics-overview.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Windows Analytics -description: Introduction and overview of Windows Analytics -keywords: Device Health, Upgrade Readiness, Update Compliance, oms, operations management suite, prerequisites, requirements, monitoring, crash, drivers -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: jaimeo -ms.author: jaimeo -ms.localizationpriority: medium -ms.collection: M365-analytics -ms.topic: article ---- - -# Windows Analytics overview - -Windows Analytics is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. There are currently three solutions which you can use singly or in any combination: - -## Device Health - -[Device Health](device-health-get-started.md) provides the following: - -- Identification of devices that crash frequently, and therefore might need to be rebuilt or replaced -- Identification of device drivers that are causing device crashes, with suggestions of alternative versions of those drivers that might reduce the number of crashes -- Notification of Windows Information Protection misconfigurations that send prompts to end users - - -## Update Compliance - -[Update Compliance](update-compliance-get-started.md) shows you the state of your devices with respect to the Windows updates so that you can ensure that they are on the most current updates as appropriate. In addition, Update Compliance provides the following: - -- Dedicated drill-downs for devices that might need attention -- An inventory of devices, including the version of Windows they are running and their update status -- The ability to track protection and threat status for Windows Defender Antivirus-enabled devices -- An overview of Windows Update for Business deferral configurations (Windows 10, version 1607 and later) -- Powerful built-in log analytics to create useful custom queries -- Cloud-connected access utilizing Windows 10 diagnostic data means no need for new complex, customized infrastructure - -## Upgrade Readiness - -[Upgrade Readiness](../upgrade/upgrade-readiness-get-started.md) offers a set of tools to plan and manage the upgrade process end to end, allowing you to adopt new Windows releases more quickly. With new Windows versions being released multiple times a year, ensuring application and driver compatibility on an ongoing basis is key to adopting new Windows versions as they are released. Upgrade Readiness not only supports upgrade management from Windows 7 and Windows 8.1 to Windows 10, but also Windows 10 upgrades in the Windows as a service model. - -Use Upgrade Readiness to get: - -- A visual workflow that guides you from pilot to production -- Detailed computer and application inventory -- Powerful computer-level search and drill-downs -- Guidance and insights into application and driver compatibility issues, with suggested fixes -- Data-driven application rationalization tools -- Application usage information, allowing targeted validation; workflow to track validation progress and decisions -- Data export to commonly used software deployment tools, including System Center Configuration Manager - -To get started with any of these solutions, visit the links for instructions to add it to Azure Portal. - ->[!NOTE] -> For details about licensing requirements and costs associated with using Windows Analytics solutions, see [What are the requirements and costs for Windows Analytics solutions?](windows-analytics-FAQ-troubleshooting.md#what-are-the-requirements-and-costs-for-windows-analytics-solutions). diff --git a/windows/deployment/update/windows-analytics-privacy.md b/windows/deployment/update/windows-analytics-privacy.md deleted file mode 100644 index 744f34d7a4..0000000000 --- a/windows/deployment/update/windows-analytics-privacy.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Windows Analytics and privacy -description: How Windows Analytics uses data -keywords: windows analytics, oms, privacy, data, diagnostic, operations management suite, prerequisites, requirements, updates, upgrades, log analytics, health, FAQ, problems, troubleshooting, error -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: jaimeo -ms.author: jaimeo -ms.localizationpriority: high -ms.collection: M365-analytics -ms.topic: article ---- - -# Windows Analytics and privacy - -Windows Analytics is fully committed to privacy, centering on these tenets: - -- **Transparency:** We fully document the Windows Analytics diagnostic events (see the links for additional information) so you can review them with your company’s security and compliance teams. The Diagnostic Data Viewer lets you see diagnostic data sent from a given device (see [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/configuration/diagnostic-data-viewer-overview) for details). -- **Control:** You ultimately control the level of diagnostic data you wish to share. In Windows 10, version 1709 we added a new policy to Limit enhanced diagnostic data to the minimum required by Windows Analytics -- **Security:** Your data is protected with strong security and encryption -- **Trust:** Windows Analytics supports the Microsoft Online Service Terms - -The following illustration shows how diagnostic data flows from individual devices through the Diagnostic Data Service, Azure Log Analytics storage, and to your Log Analytics workspace: - -[![Diagram illustrating flow of diagnostic data from devices](images/WA-data-flow-v1.png)](images/WA-data-flow-v1.png) - -The data flow sequence is as follows: - -1. Diagnostic data is sent from devices to the Microsoft Diagnostic Data Management service, which is hosted in the US. -2. An IT administrator creates an Azure Log Analytics workspace. The administrator chooses the location, copies the Commercial ID (which identifies that workspace), and then pushes Commercial ID to devices they want to monitor. This is the mechanism that specifies which devices appear in which workspaces. -3. Each day Microsoft produces a "snapshot" of IT-focused insights for each workspace in the Diagnostic Data Management service. -4. These snapshots are copied to transient storage which is used only by Windows Analytics (also hosted in US data centers) where they are segregated by Commercial ID. -5. The snapshots are then copied to the appropriate Azure Log Analytics workspace. -6. If the IT administrator is using the Upgrade Readiness solution, user input from the IT administrator (specifically, the target operating system release and the importance and upgrade readiness per app) is stored in the Windows Analytics Azure Storage. (Upgrade Readiness is the only Windows Analytics solution that takes such user input.) - - -See these topics for additional background information about related privacy issues: - -- [Windows 10 and the GDPR for IT Decision Makers](https://docs.microsoft.com/windows/privacy/gdpr-it-guidance) -- [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization) -- [Windows 7, Windows 8, and Windows 8.1 Appraiser Telemetry Events, and Fields](https://go.microsoft.com/fwlink/?LinkID=822965) -- [Windows 10, version 1809 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809) -- [Windows 10, version 1803 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803) -- [Windows 10, version 1709 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) -- [Windows 10, version 1703 basic level Windows diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703) -- [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](https://docs.microsoft.com/windows/configuration/enhanced-diagnostic-data-windows-analytics-events-and-fields) -- [Diagnostic Data Viewer Overview](https://docs.microsoft.com/windows/configuration/diagnostic-data-viewer-overview) -- [Licensing Terms and Documentation](https://www.microsoftvolumelicensing.com/DocumentSearch.aspx?Mode=3&DocumentTypeId=31) -- [Learn about security and privacy at Microsoft datacenters](https://www.microsoft.com/datacenters) -- [Confidence in the trusted cloud](https://azure.microsoft.com/support/trust-center/) -- [Trust Center](https://www.microsoft.com/trustcenter) - -### Can Windows Analytics be used without a direct client connection to the Microsoft Data Management Service? -No, the entire service is powered by Windows diagnostic data, which requires that devices have this direct connectivity. - -### Can I choose the data center location? -Yes for Azure Log Analytics, but no for the Microsoft Data Management Service (which is hosted in the US). diff --git a/windows/deployment/update/windows-as-a-service.md b/windows/deployment/update/windows-as-a-service.md index 624b72ef06..89b24aea50 100644 --- a/windows/deployment/update/windows-as-a-service.md +++ b/windows/deployment/update/windows-as-a-service.md @@ -4,12 +4,17 @@ ms.prod: windows-10 layout: LandingPage ms.topic: landing-page ms.manager: elizapo -author: lizap -ms.author: elizapo -ms.date: 01/24/2019 +audience: itpro +itproauthor: jaimeo +author: jaimeo +description: Discover the latest news articles, videos, and podcasts about Windows as a service. Find resources for using Windows as a service within your organization. +ms.audience: itpro +ms.reviewer: +manager: laurawi ms.localizationpriority: high ms.collection: M365-modern-desktop --- + # Windows as a service Find the tools and resources you need to help deploy and support Windows as a service in your organization. @@ -18,19 +23,23 @@ Find the tools and resources you need to help deploy and support Windows as a se Find the latest and greatest news on Windows 10 deployment and servicing. -**Working to make Windows updates clear and transparent** -> [!VIDEO https://www.youtube-nocookie.com/embed/u5P20y39DrA] +**Discovering the Windows 10 Update history pages** +> [!VIDEO https://www.youtube-nocookie.com/embed/mTnAb9XjMPY] -Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. The Windows update history page is for anyone looking to gain an immediate, precise understanding of particular Windows update issues. +Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. Bookmark the Windows release health dashboard for near real-time information on known issues, workarounds, and resolutions--as well as the current status of the latest feature update rollout. The latest news: [See more news](waas-morenews.md). You can also check out the [Windows 10 blog](https://techcommunity.microsoft.com/t5/Windows-10-Blog/bg-p/Windows10Blog). @@ -40,9 +49,15 @@ Written by IT pros for IT pros, sharing real world examples and scenarios for Wi -**NEW** Classifying Windows updates in common deployment tools +**NEW** Tactical considerations for creating Windows deployment rings -NEW Express updates for Windows Server 2016 re-enabled for November 2018 update +**NEW** Windows 10 Enterprise vs. Windows 10 Pro: Modern management considerations for your organization + +Deployment rings: The hidden [strategic] gem of Windows as a service + +Classifying Windows updates in common deployment tools + +Express updates for Windows Server 2016 re-enabled for November 2018 update 2019 SHA-2 Code Signing Support requirement for Windows and WSUS @@ -71,7 +86,7 @@ Prepare to implement Windows as a service effectively using the right tools, pro -Simplified updates +Simplified updates Windows 10 end user readiness diff --git a/windows/deployment/update/windows-update-error-reference.md b/windows/deployment/update/windows-update-error-reference.md index 8552724e85..b8d84e3075 100644 --- a/windows/deployment/update/windows-update-error-reference.md +++ b/windows/deployment/update/windows-update-error-reference.md @@ -3,361 +3,365 @@ title: Windows Update error code list by component description: Reference information for Windows Update error codes ms.prod: w10 ms.mktglfcycl: -ms.sitesec: library -author: kaushika-msft +audience: itpro +itproauthor: jaimeo +author: jaimeo ms.localizationpriority: medium -ms.author: elizapo +ms.audience: itpro +author: jaimeo ms.date: 09/18/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- # Windows Update error codes by component ->Applies to: Windows 10 +> Applies to: Windows 10 This section lists the error codes for Microsoft Windows Update. - -## Automatic Update Errors -|Error code|Message|Description| -|-|-|-| -|0x80243FFF|WU_E_AUCLIENT_UNEXPECTED|There was a user interface error not covered by another WU_E_AUCLIENT_* error code.| -|0x8024A000|WU_E_AU_NOSERVICE|Automatic Updates was unable to service incoming requests. | -|0x8024A002|WU_E_AU_NONLEGACYSERVER|The old version of the Automatic Updates client has stopped because the WSUS server has been upgraded.|  -|0x8024A003 |WU_E_AU_LEGACYCLIENTDISABLED| The old version of the Automatic Updates client was disabled.|  -|0x8024A004|WU_E_AU_PAUSED|Automatic Updates was unable to process incoming requests because it was paused.|  -|0x8024A005|WU_E_AU_NO_REGISTERED_SERVICE| No unmanaged service is registered with AU.|  -|0x8024AFFF|WU_E_AU_UNEXPECTED| An Automatic Updates error not covered by another WU_E_AU * code.|  - -## Windows Update UI errors +## Automatic Update Errors -|Error code|Message|Description| -|-|-|-| -|0x80243001|WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION|The results of download and installation could not be read from the registry due to an unrecognized data format version.|  -|0x80243002|WU_E_INSTALLATION_RESULTS_INVALID_DATA|The results of download and installation could not be read from the registry due to an invalid data format.|  -|0x80243003|WU_E_INSTALLATION_RESULTS_NOT_FOUND |The results of download and installation are not available; the operation may have failed to start.|  -|0x80243004| WU_E_TRAYICON_FAILURE| A failure occurred when trying to create an icon in the taskbar notification area.| -|0x80243FFD| WU_E_NON_UI_MODE| Unable to show UI when in non-UI mode; WU client UI modules may not be installed.  | -|0x80243FFE| WU_E_WUCLTUI_UNSUPPORTED_VERSION| Unsupported version of WU client UI exported functions.  | -|0x80243FFF| WU_E_AUCLIENT_UNEXPECTED| There was a user interface error not covered by another WU_E_AUCLIENT_* error code.  | - -## Inventory errors +| Error code | Message | Description | +|------------|---------------------------------|--------------------------------------------------------------------------------------------------------| +| 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. | +| 0x8024A000 | `WU_E_AU_NOSERVICE` | Automatic Updates was unable to service incoming requests. | +| 0x8024A002 | `WU_E_AU_NONLEGACYSERVER` | The old version of the Automatic Updates client has stopped because the WSUS server has been upgraded. | +| 0x8024A003 | `WU_E_AU_LEGACYCLIENTDISABLED` | The old version of the Automatic Updates client was disabled. | +| 0x8024A004 | `WU_E_AU_PAUSED` | Automatic Updates was unable to process incoming requests because it was paused. | +| 0x8024A005 | `WU_E_AU_NO_REGISTERED_SERVICE` | No unmanaged service is registered with `AU`. | +| 0x8024AFFF | `WU_E_AU_UNEXPECTED` | An Automatic Updates error not covered by another `WU_E_AU*` code. | -|Error code|Message|Description| -|-|-|-| -|0x80249001| WU_E_INVENTORY_PARSEFAILED| Parsing of the rule file failed. | -|0x80249002| WU_E_INVENTORY_GET_INVENTORY_TYPE_FAILED | Failed to get the requested inventory type from the server. | -|0x80249003| WU_E_INVENTORY_RESULT_UPLOAD_FAILED| Failed to upload inventory result to the server. | -|0x80249004| WU_E_INVENTORY_UNEXPECTED| There was an inventory error not covered by another error code.|  -|0x80249005| WU_E_INVENTORY_WMI_ERROR| A WMI error occurred when enumerating the instances for a particular class.  | - -## Expression evaluator errors +## Windows Update UI errors -|Error code|Message|Description| -|-|-|-| -|0x8024E001 | WU_E_EE_UNKNOWN_EXPRESSION | An expression evaluator operation could not be completed because an expression was unrecognized.| -|0x8024E002| WU_E_EE_INVALID_EXPRESSION| An expression evaluator operation could not be completed because an expression was invalid.  | -|0x8024E003| WU_E_EE_MISSING_METADATA| An expression evaluator operation could not be completed because an expression contains an incorrect number of metadata nodes. | -|0x8024E004| WU_E_EE_INVALID_VERSION| An expression evaluator operation could not be completed because the version of the serialized expression data is invalid. | -| 0x8024E005| WU_E_EE_NOT_INITIALIZED| The expression evaluator could not be initialized.|  -| 0x8024E006| WU_E_EE_INVALID_ATTRIBUTEDATA | An expression evaluator operation could not be completed because there was an invalid attribute.| -| 0x8024E007| WU_E_EE_CLUSTER_ERROR | An expression evaluator operation could not be completed because the cluster state of the computer could not be determined. | -| 0x8024EFFF| WU_E_EE_UNEXPECTED| There was an expression evaluator error not covered by another WU_E_EE_* error code.  | - -## Reporter errors +| Error code | Message | Description | +|------------|---------------------------------------------|--------------------------------------------------------------------------------------------------------------------------| +| 0x80243001 | `WU_E_INSTALLATION_RESULTS_UNKNOWN_VERSION` | The results of download and installation could not be read from the registry due to an unrecognized data format version. | +| 0x80243002 | `WU_E_INSTALLATION_RESULTS_INVALID_DATA` | The results of download and installation could not be read from the registry due to an invalid data format. | +| 0x80243003 | `WU_E_INSTALLATION_RESULTS_NOT_FOUND` | The results of download and installation are not available; the operation may have failed to start. | +| 0x80243004 | `WU_E_TRAYICON_FAILURE` | A failure occurred when trying to create an icon in the taskbar notification area. | +| 0x80243FFD | `WU_E_NON_UI_MODE` | Unable to show UI when in non-UI mode; WU client UI modules may not be installed. | +| 0x80243FFE | `WU_E_WUCLTUI_UNSUPPORTED_VERSION` | Unsupported version of WU client UI exported functions. | +| 0x80243FFF | `WU_E_AUCLIENT_UNEXPECTED` | There was a user interface error not covered by another `WU_E_AUCLIENT_*` error code. | -|Error code|Message|Description| -|-|-|-| -| 0x80247001| WU_E_OL_INVALID_SCANFILE | An operation could not be completed because the scan package was invalid.|  -|0x80247002| WU_E_OL_NEWCLIENT_REQUIRED| An operation could not be completed because the scan package requires a greater version of the Windows Update Agent.|  -| 0x80247FFF| WU_E_OL_UNEXPECTED| Search using the scan package failed. | -| 0x8024F001| WU_E_REPORTER_EVENTCACHECORRUPT| The event cache file was defective. | -| 0x8024F002 | WU_E_REPORTER_EVENTNAMESPACEPARSEFAILED | The XML in the event namespace descriptor could not be parsed.|  -| 0x8024F003| WU_E_INVALID_EVENT| The XML in the event namespace descriptor could not be parsed.|  -| 0x8024F004| WU_E_SERVER_BUSY| The server rejected an event because the server was too busy.|  -| 0x8024FFFF| WU_E_REPORTER_UNEXPECTED| There was a reporter error not covered by another error code. | - -## Redirector errors -The components that download the Wuredir.cab file and then parse the Wuredir.cab file generate the following errors. +## Inventory errors -|Error code|Message|Description | -|-|-|-| -| 0x80245001| WU_E_REDIRECTOR_LOAD_XML| The redirector XML document could not be loaded into the DOM class.  | -| 0x80245002| WU_E_REDIRECTOR_S_FALSE| The redirector XML document is missing some required information. | -| 0x80245003| WU_E_REDIRECTOR_ID_SMALLER| The redirectorId in the downloaded redirector cab is less than in the cached cab.  | -| 0x80245FFF| WU_E_REDIRECTOR_UNEXPECTED| The redirector failed for reasons not covered by another WU_E_REDIRECTOR_* error code.  | - -## Protocol Talker errors -The following errors map to SOAPCLIENT_ERRORs through the Atlsoap.h file. These errors are obtained when the CClientWebService object calls the GetClientError() method. +| Error code | Message | Description | +|------------|--------------------------------------------|-------------------------------------------------------------------------------| +| 0x80249001 | `WU_E_INVENTORY_PARSEFAILED` | Parsing of the rule file failed. | +| 0x80249002 | `WU_E_INVENTORY_GET_INVENTORY_TYPE_FAILED` | Failed to get the requested inventory type from the server. | +| 0x80249003 | `WU_E_INVENTORY_RESULT_UPLOAD_FAILED` | Failed to upload inventory result to the server. | +| 0x80249004 | `WU_E_INVENTORY_UNEXPECTED` | There was an inventory error not covered by another error code. | +| 0x80249005 | `WU_E_INVENTORY_WMI_ERROR` | A WMI error occurred when enumerating the instances for a particular class. | -|Error code|Message|Description| -|-|-|-| -| 0x80244000| WU_E_PT_SOAPCLIENT_BASE| WU_E_PT_SOAPCLIENT_* error codes map to the SOAPCLIENT_ERROR enum of the ATL Server Library.| -|0x80244001| WU_E_PT_SOAPCLIENT_INITIALIZE| Same as SOAPCLIENT_INITIALIZE_ERROR - initialization of the SOAP client failed possibly because of an MSXML installation failure. | -| 0x80244002| WU_E_PT_SOAPCLIENT_OUTOFMEMORY| Same as SOAPCLIENT_OUTOFMEMORY - SOAP client failed because it ran out of memory. | -| 0x80244003| WU_E_PT_SOAPCLIENT_GENERATE| Same as SOAPCLIENT_GENERATE_ERROR - SOAP client failed to generate the request.|  -| 0x80244004| WU_E_PT_SOAPCLIENT_CONNECT| Same as SOAPCLIENT_CONNECT_ERROR - SOAP client failed to connect to the server. | -| 0x80244005| WU_E_PT_SOAPCLIENT_SEND| Same as SOAPCLIENT_SEND_ERROR - SOAP client failed to send a message for reasons of WU_E_WINHTTP_* error codes.| -| 0x80244006| WU_E_PT_SOAPCLIENT_SERVER| Same as SOAPCLIENT_SERVER_ERROR - SOAP client failed because there was a server error. | -| 0x80244007| WU_E_PT_SOAPCLIENT_SOAPFAULT| Same as SOAPCLIENT_SOAPFAULT - SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_* error codes.| -| 0x80244008| WU_E_PT_SOAPCLIENT_PARSEFAULT| Same as SOAPCLIENT_PARSEFAULT_ERROR - SOAP client failed to parse a SOAP fault.|  -| 0x80244009| WU_E_PT_SOAPCLIENT_READ| Same as SOAPCLIENT_READ_ERROR - SOAP client failed while reading the response from the server.| -| 0x8024400A| WU_E_PT_SOAPCLIENT_PARSE| Same as SOAPCLIENT_PARSE_ERROR - SOAP client failed to parse the response from the server. | - - - -## Other Protocol Talker errors -The following errors map to SOAP_ERROR_CODEs from the Atlsoap.h file. These errors are obtained from the m_fault.m_soapErrCode member of the CClientWebService object when GetClientError() returns SOAPCLIENT_SOAPFAULT. +## Expression evaluator errors -|Error code|Message|Description| -|-|-|-| -| 0x8024400B| WU_E_PT_SOAP_VERSION| Same as SOAP_E_VERSION_MISMATCH - SOAP client found an unrecognizable namespace for the SOAP envelope.| -| 0x8024400C| WU_E_PT_SOAP_MUST_UNDERSTAND| Same as SOAP_E_MUST_UNDERSTAND - SOAP client was unable to understand a header.  | -| 0x8024400D| WU_E_PT_SOAP_CLIENT| Same as SOAP_E_CLIENT - SOAP client found the message was malformed; fix before resending. | -| 0x8024400E| WU_E_PT_SOAP_SERVER| Same as SOAP_E_SERVER - The SOAP message could not be processed due to a server error; resend later. | -| 0x8024400F| WU_E_PT_WMI_ERROR| There was an unspecified Windows Management Instrumentation (WMI) error.|  -| 0x80244010| WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS| The number of round trips to the server exceeded the maximum limit. | -| 0x80244011| WU_E_PT_SUS_SERVER_NOT_SET| WUServer policy value is missing in the registry. | -| 0x80244012| WU_E_PT_DOUBLE_INITIALIZATION| Initialization failed because the object was already initialized. | -| 0x80244013| WU_E_PT_INVALID_COMPUTER_NAME| The computer name could not be determined. | -| 0x80244015| WU_E_PT_REFRESH_CACHE_REQUIRED| The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry.|  -| 0x80244016| WU_E_PT_HTTP_STATUS_BAD_REQUEST| Same as HTTP status 400 - the server could not process the request due to invalid syntax. | -| 0x80244017| WU_E_PT_HTTP_STATUS_DENIED| Same as HTTP status 401 - the requested resource requires user authentication. | -| 0x80244018| WU_E_PT_HTTP_STATUS_FORBIDDEN| Same as HTTP status 403 - server understood the request but declined to fulfill it.| -| 0x80244019| WU_E_PT_HTTP_STATUS_NOT_FOUND| Same as HTTP status 404 - the server cannot find the requested URI (Uniform Resource Identifier). | -| 0x8024401A| WU_E_PT_HTTP_STATUS_BAD_METHOD| Same as HTTP status 405 - the HTTP method is not allowed.  | -| 0x8024401B| WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ| Same as HTTP status 407 - proxy authentication is required. | -| 0x8024401C| WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT| Same as HTTP status 408 - the server timed out waiting for the request. | -| 0x8024401D| WU_E_PT_HTTP_STATUS_CONFLICT| Same as HTTP status 409 - the request was not completed due to a conflict with the current state of the resource. | -| 0x8024401E| WU_E_PT_HTTP_STATUS_GONE| Same as HTTP status 410 - requested resource is no longer available at the server.| -| 0x8024401F| WU_E_PT_HTTP_STATUS_SERVER_ERROR| Same as HTTP status 500 - an error internal to the server prevented fulfilling the request. | -| 0x80244020| WU_E_PT_HTTP_STATUS_NOT_SUPPORTED| Same as HTTP status 500 - server does not support the functionality required to fulfill the request. | -| 0x80244021| WU_E_PT_HTTP_STATUS_BAD_GATEWAY |Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfil the request.| -| 0x80244022| WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL| Same as HTTP status 503 - the service is temporarily overloaded.  | -| 0x80244023| WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT| Same as HTTP status 503 - the request was timed out waiting for a gateway. | -| 0x80244024| WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP| Same as HTTP status 505 - the server does not support the HTTP protocol version used for the request. | -| 0x80244025| WU_E_PT_FILE_LOCATIONS_CHANGED| Operation failed due to a changed file location; refresh internal state and resend.|  -| 0x80244026| WU_E_PT_REGISTRATION_NOT_SUPPORTED| Operation failed because Windows Update Agent does not support registration with a non-WSUS server. | -| 0x80244027| WU_E_PT_NO_AUTH_PLUGINS_REQUESTED| The server returned an empty authentication information list.  | -| 0x80244028| WU_E_PT_NO_AUTH_COOKIES_CREATED| Windows Update Agent was unable to create any valid authentication cookies. | -| 0x80244029| WU_E_PT_INVALID_CONFIG_PROP| A configuration property value was wrong. | -| 0x8024402A| WU_E_PT_CONFIG_PROP_MISSING| A configuration property value was missing. | -| 0x8024402B| WU_E_PT_HTTP_STATUS_NOT_MAPPED| The HTTP request could not be completed and the reason did not correspond to any of the WU_E_PT_HTTP_* error codes. | -| 0x8024402C| WU_E_PT_WINHTTP_NAME_NOT_RESOLVED| Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved. | -| 0x8024402F| WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS| External cab file processing completed with some errors.| -| 0x80244030| WU_E_PT_ECP_INIT_FAILED| The external cab processor initialization did not complete. | -| 0x80244031| WU_E_PT_ECP_INVALID_FILE_FORMAT| The format of a metadata file was invalid. | -| 0x80244032| WU_E_PT_ECP_INVALID_METADATA| External cab processor found invalid metadata. | -| 0x80244033| WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST| The file digest could not be extracted from an external cab file. | -| 0x80244034| WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE| An external cab file could not be decompressed. | -| 0x80244035| WU_E_PT_ECP_FILE_LOCATION_ERROR| External cab processor was unable to get file locations. | -| 0x80244FFF| WU_E_PT_UNEXPECTED| A communication error not covered by another WU_E_PT_* error code. | -| 0x8024502D| WU_E_PT_SAME_REDIR_ID| Windows Update Agent failed to download a redirector cabinet file with a new redirectorId value from the server during the recovery. | -| 0x8024502E| WU_E_PT_NO_MANAGED_RECOVER| A redirector recovery action did not complete because the server is managed. | +| Error code | Message | Description | +|------------|---------------------------------|--------------------------------------------------------------------------------------------------------------------------------| +| 0x8024E001 | `WU_E_EE_UNKNOWN_EXPRESSION` | An expression evaluator operation could not be completed because an expression was unrecognized. | +| 0x8024E002 | `WU_E_EE_INVALID_EXPRESSION` | An expression evaluator operation could not be completed because an expression was invalid. | +| 0x8024E003 | `WU_E_EE_MISSING_METADATA` | An expression evaluator operation could not be completed because an expression contains an incorrect number of metadata nodes. | +| 0x8024E004 | `WU_E_EE_INVALID_VERSION` | An expression evaluator operation could not be completed because the version of the serialized expression data is invalid. | +| 0x8024E005 | `WU_E_EE_NOT_INITIALIZED` | The expression evaluator could not be initialized. | +| 0x8024E006 | `WU_E_EE_INVALID_ATTRIBUTEDATA` | An expression evaluator operation could not be completed because there was an invalid attribute. | +| 0x8024E007 | `WU_E_EE_CLUSTER_ERROR` | An expression evaluator operation could not be completed because the cluster state of the computer could not be determined. | +| 0x8024EFFF | `WU_E_EE_UNEXPECTED` | There was an expression evaluator error not covered by another `WU_E_EE_*` error code. | -## Download Manager errors +## Reporter errors -|Error code|Message|Description| -|-|-|-| -| 0x80246001| WU_E_DM_URLNOTAVAILABLE| A download manager operation could not be completed because the requested file does not have a URL. | -| 0x80246002| WU_E_DM_INCORRECTFILEHASH| A download manager operation could not be completed because the file digest was not recognized. | -| 0x80246003| WU_E_DM_UNKNOWNALGORITHM| A download manager operation could not be completed because the file metadata requested an unrecognized hash algorithm. | -| 0x80246004| WU_E_DM_NEEDDOWNLOADREQUEST| An operation could not be completed because a download request is required from the download handler. | -| 0x80246005| WU_E_DM_NONETWORK| A download manager operation could not be completed because the network connection was unavailable. | -| 0x80246006| WU_E_DM_WRONGBITSVERSION| A download manager operation could not be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible.|  -| 0x80246007| WU_E_DM_NOTDOWNLOADED| The update has not been downloaded. | -| 0x80246008| WU_E_DM_FAILTOCONNECTTOBITS| A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS).|  -| 0x80246009|WU_E_DM_BITSTRANSFERERROR| A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error.  | -| 0x8024600A| WU_E_DM_DOWNLOADLOCATIONCHANGED| A download must be restarted because the location of the source of the download has changed.|  -| 0x8024600B| WU_E_DM_CONTENTCHANGED| A download must be restarted because the update content changed in a new revision.  | -| 0x80246FFF| WU_E_DM_UNEXPECTED| There was a download manager error not covered by another WU_E_DM_* error code.  | - -## Update Handler errors +| Error code | Message | Description | +|------------|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------| +| 0x80247001 | `WU_E_OL_INVALID_SCANFILE` | An operation could not be completed because the scan package was invalid. | +| 0x80247002 | `WU_E_OL_NEWCLIENT_REQUIRED` | An operation could not be completed because the scan package requires a greater version of the Windows Update Agent. | +| 0x80247FFF | `WU_E_OL_UNEXPECTED` | Search using the scan package failed. | +| 0x8024F001 | `WU_E_REPORTER_EVENTCACHECORRUPT` | The event cache file was defective. | +| 0x8024F002 | `WU_E_REPORTER_EVENTNAMESPACEPARSEFAILED` | The XML in the event namespace descriptor could not be parsed. | +| 0x8024F003 | `WU_E_INVALID_EVENT` | The XML in the event namespace descriptor could not be parsed. | +| 0x8024F004 | `WU_E_SERVER_BUSY` | The server rejected an event because the server was too busy. | +| 0x8024FFFF | `WU_E_REPORTER_UNEXPECTED` | There was a reporter error not covered by another error code. | -|Error code|Message|Description| -|-|-|-| -| 0x80242000| WU_E_UH_REMOTEUNAVAILABLE|9 A request for a remote update handler could not be completed because no remote process is available. | -| 0x80242001| WU_E_UH_LOCALONLY| A request for a remote update handler could not be completed because the handler is local only. | -| 0x80242002| WU_E_UH_UNKNOWNHANDLER| A request for an update handler could not be completed because the handler could not be recognized. | -| 0x80242003| WU_E_UH_REMOTEALREADYACTIVE| A remote update handler could not be created because one already exists.  | -| 0x80242004| WU_E_UH_DOESNOTSUPPORTACTION| A request for the handler to install (uninstall) an update could not be completed because the update does not support install (uninstall).|  -| 0x80242005| WU_E_UH_WRONGHANDLER| An operation did not complete because the wrong handler was specified.  | -| 0x80242006| WU_E_UH_INVALIDMETADATA| A handler operation could not be completed because the update contains invalid metadata. | -| 0x80242007| WU_E_UH_INSTALLERHUNG| An operation could not be completed because the installer exceeded the time limit. | -| 0x80242008| WU_E_UH_OPERATIONCANCELLED| An operation being done by the update handler was cancelled. | -| 0x80242009| WU_E_UH_BADHANDLERXML| An operation could not be completed because the handler-specific metadata is invalid.  | -| 0x8024200A| WU_E_UH_CANREQUIREINPUT| A request to the handler to install an update could not be completed because the update requires user input. | -| 0x8024200B| WU_E_UH_INSTALLERFAILURE| The installer failed to install (uninstall) one or more updates.  | -| 0x8024200C| WU_E_UH_FALLBACKTOSELFCONTAINED| The update handler should download self-contained content rather than delta-compressed content for the update. | -| 0x8024200D| WU_E_UH_NEEDANOTHERDOWNLOAD| The update handler did not install the update because it needs to be downloaded again.  | -| 0x8024200E| WU_E_UH_NOTIFYFAILURE| The update handler failed to send notification of the status of the install (uninstall) operation.  | -| 0x8024200F| WU_E_UH_INCONSISTENT_FILE_NAMES | The file names contained in the update metadata and in the update package are inconsistent.  | -| 0x80242010| WU_E_UH_FALLBACKERROR| The update handler failed to fall back to the self-contained content.  | -| 0x80242011| WU_E_UH_TOOMANYDOWNLOADREQUESTS| The update handler has exceeded the maximum number of download requests.  | -| 0x80242012| WU_E_UH_UNEXPECTEDCBSRESPONSE| The update handler has received an unexpected response from CBS.  | -| 0x80242013| WU_E_UH_BADCBSPACKAGEID| The update metadata contains an invalid CBS package identifier.  | -| 0x80242014| WU_E_UH_POSTREBOOTSTILLPENDING| The post-reboot operation for the update is still in progress.  | -| 0x80242015| WU_E_UH_POSTREBOOTRESULTUNKNOWN| The result of the post-reboot operation for the update could not be determined.  | -| 0x80242016| WU_E_UH_POSTREBOOTUNEXPECTEDSTATE| The state of the update after its post-reboot operation has completed is unexpected.  | -| 0x80242017| WU_E_UH_NEW_SERVICING_STACK_REQUIRED| The OS servicing stack must be updated before this update is downloaded or installed.  | -| 0x80242FFF| WU_E_UH_UNEXPECTED| An update handler error not covered by another WU_E_UH_* code.  | - -## Data Store errors +## Redirector errors +The components that download the `Wuredir.cab` file and then parse the `Wuredir.cab` file generate the following errors. -|Error code|Message|Description | -|-|-|-| -| 0x80248000| WU_E_DS_SHUTDOWN| An operation failed because Windows Update Agent is shutting down.  | -| 0x80248001| WU_E_DS_INUSE| An operation failed because the data store was in use.|  -| 0x80248002| WU_E_DS_INVALID| The current and expected states of the data store do not match.|  -| 0x80248003| WU_E_DS_TABLEMISSING| The data store is missing a table.  | -| 0x80248004| WU_E_DS_TABLEINCORRECT| The data store contains a table with unexpected columns.  | -| 0x80248005| WU_E_DS_INVALIDTABLENAME| A table could not be opened because the table is not in the data store. | -| 0x80248006| WU_E_DS_BADVERSION| The current and expected versions of the data store do not match. | -| 0x80248007| WU_E_DS_NODATA| The information requested is not in the data store.  | -| 0x80248008| WU_E_DS_MISSINGDATA| The data store is missing required information or has a NULL in a table column that requires a non-null value.  | -| 0x80248009| WU_E_DS_MISSINGREF| The data store is missing required information or has a reference to missing license terms file localized property or linked row. | -| 0x8024800A| WU_E_DS_UNKNOWNHANDLER| The update was not processed because its update handler could not be recognized.  | -| 0x8024800B| WU_E_DS_CANTDELETE| The update was not deleted because it is still referenced by one or more services.  | -| 0x8024800C| WU_E_DS_LOCKTIMEOUTEXPIRED| The data store section could not be locked within the allotted time.  | -| 0x8024800D| WU_E_DS_NOCATEGORIES | The category was not added because it contains no parent categories and is not a top-level category itself.  | -| 0x8024800E| WU_E_DS_ROWEXISTS| The row was not added because an existing row has the same primary key.  | -| 0x8024800F| WU_E_DS_STOREFILELOCKED| The data store could not be initialized because it was locked by another process.  | -| 0x80248010| WU_E_DS_CANNOTREGISTER| The data store is not allowed to be registered with COM in the current process.  -| 0x80248011| WU_E_DS_UNABLETOSTART| Could not create a data store object in another process.  -| 0x80248013| WU_E_DS_DUPLICATEUPDATEID |The server sent the same update to the client with two different revision IDs.  -| 0x80248014 |WU_E_DS_UNKNOWNSERVICE| An operation did not complete because the service is not in the data store.  -| 0x80248015 |WU_E_DS_SERVICEEXPIRED |An operation did not complete because the registration of the service has expired.  -| 0x80248016 | WU_E_DS_DECLINENOTALLOWED | A request to hide an update was declined because it is a mandatory update or because it was deployed with a deadline.  -| 0x80248017 | WU_E_DS_TABLESESSIONMISMATCH| A table was not closed because it is not associated with the session.  -| 0x80248018 | WU_E_DS_SESSIONLOCKMISMATCH| A table was not closed because it is not associated with the session.  -| 0x80248019 | WU_E_DS_NEEDWINDOWSSERVICE| A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it is a built-in service and/or Automatic Updates cannot fall back to another service.  -| 0x8024801A | WU_E_DS_INVALIDOPERATION| A request was declined because the operation is not allowed.  -| 0x8024801B | WU_E_DS_SCHEMAMISMATCH| The schema of the current data store and the schema of a table in a backup XML document do not match.  -| 0x8024801C | WU_E_DS_RESETREQUIRED| The data store requires a session reset; release the session and retry with a new session.  -| 0x8024801D | WU_E_DS_IMPERSONATED| A data store operation did not complete because it was requested with an impersonated identity.  -| 0x80248FFF | WU_E_DS_UNEXPECTED| A data store error not covered by another WU_E_DS_* code.  - -## Driver Util errors +| Error code | Message | Description | +|----------- |------------------------------|------------------------------------------------------------------------------------------| +| 0x80245001 | `WU_E_REDIRECTOR_LOAD_XML` | The redirector XML document could not be loaded into the DOM class. | +| 0x80245002 | `WU_E_REDIRECTOR_S_FALSE` | The redirector XML document is missing some required information. | +| 0x80245003 | `WU_E_REDIRECTOR_ID_SMALLER` | The redirectorId in the downloaded redirector cab is less than in the cached cab. | +| 0x80245FFF | `WU_E_REDIRECTOR_UNEXPECTED` | The redirector failed for reasons not covered by another `WU_E_REDIRECTOR_*` error code. | + +## Protocol Talker errors +The following errors map to `SOAPCLIENT_ERROR`s through the `Atlsoap.h` file. These errors are obtained when the `CClientWebService` object calls the `GetClientError()` method. + + +| Error code | Message | Description | +|------------|----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------| +| 0x80244000 | `WU_E_PT_SOAPCLIENT_BASE` | `WU_E_PT_SOAPCLIENT_*` error codes map to the `SOAPCLIENT_ERROR` enum of the ATL Server Library. | +| 0x80244001 | `WU_E_PT_SOAPCLIENT_INITIALIZE` | Same as `SOAPCLIENT_INITIALIZE_ERROR` - initialization of the `SOAP` client failed possibly because of an MSXML installation failure. | +| 0x80244002 | `WU_E_PT_SOAPCLIENT_OUTOFMEMORY` | Same as `SOAPCLIENT_OUTOFMEMORY` - `SOAP` client failed because it ran out of memory. | +| 0x80244003 | `WU_E_PT_SOAPCLIENT_GENERATE` | Same as `SOAPCLIENT_GENERATE_ERROR` - `SOAP` client failed to generate the request. | +| 0x80244004 | `WU_E_PT_SOAPCLIENT_CONNECT` | Same as `SOAPCLIENT_CONNECT_ERROR` - `SOAP` client failed to connect to the server. | +| 0x80244005 | `WU_E_PT_SOAPCLIENT_SEND` | Same as `SOAPCLIENT_SEND_ERROR` - `SOAP` client failed to send a message for reasons of `WU_E_WINHTTP_*` error codes. | +| 0x80244006 | `WU_E_PT_SOAPCLIENT_SERVER` | Same as `SOAPCLIENT_SERVER_ERROR` - `SOAP` client failed because there was a server error. | +| 0x80244007 | `WU_E_PT_SOAPCLIENT_SOAPFAULT` | Same as `SOAPCLIENT_SOAPFAULT` - `SOAP` client failed because there was a SOAP fault for reasons of `WU_E_PT_SOAP_*` error codes. | +| 0x80244008 | `WU_E_PT_SOAPCLIENT_PARSEFAULT` | Same as `SOAPCLIENT_PARSEFAULT_ERROR` - `SOAP` client failed to parse a `SOAP` fault. | +| 0x80244009 | `WU_E_PT_SOAPCLIENT_READ` | Same as `SOAPCLIENT_READ_ERROR` - `SOAP` client failed while reading the response from the server. | +| 0x8024400A | `WU_E_PT_SOAPCLIENT_PARSE` | Same as `SOAPCLIENT_PARSE_ERROR` - `SOAP` client failed to parse the response from the server. | + +## Other Protocol Talker errors +The following errors map to `SOAP_ERROR_CODE`s from the `Atlsoap.h` file. These errors are obtained from the `m_fault.m_soapErrCode` member of the `CClientWebService` object when `GetClientError()` returns `SOAPCLIENT_SOAPFAULT`. + + +| Error code | Message | Description | +|------------|----------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 0x8024400B | `WU_E_PT_SOAP_VERSION` | Same as `SOAP_E_VERSION_MISMATCH` - `SOAP` client found an unrecognizable namespace for the `SOAP` envelope. | +| 0x8024400C | `WU_E_PT_SOAP_MUST_UNDERSTAND` | Same as `SOAP_E_MUST_UNDERSTAND` - `SOAP` client was unable to understand a header. | +| 0x8024400D | `WU_E_PT_SOAP_CLIENT` | Same as `SOAP_E_CLIENT` - `SOAP` client found the message was malformed; fix before resending. | +| 0x8024400E | `WU_E_PT_SOAP_SERVER` | Same as `SOAP_E_SERVER` - The `SOAP` message could not be processed due to a server error; resend later. | +| 0x8024400F | `WU_E_PT_WMI_ERROR` | There was an unspecified Windows Management Instrumentation (WMI) error. | +| 0x80244010 | `WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS` | The number of round trips to the server exceeded the maximum limit. | +| 0x80244011 | `WU_E_PT_SUS_SERVER_NOT_SET` | WUServer policy value is missing in the registry. | +| 0x80244012 | `WU_E_PT_DOUBLE_INITIALIZATION` | Initialization failed because the object was already initialized. | +| 0x80244013 | `WU_E_PT_INVALID_COMPUTER_NAME` | The computer name could not be determined. | +| 0x80244015 | `WU_E_PT_REFRESH_CACHE_REQUIRED` | The reply from the server indicates that the server was changed or the cookie was invalid; refresh the state of the internal cache and retry. | +| 0x80244016 | `WU_E_PT_HTTP_STATUS_BAD_REQUEST` | Same as HTTP status 400 - the server could not process the request due to invalid syntax. | +| 0x80244017 | `WU_E_PT_HTTP_STATUS_DENIED` | Same as HTTP status 401 - the requested resource requires user authentication. | +| 0x80244018 | `WU_E_PT_HTTP_STATUS_FORBIDDEN` | Same as HTTP status 403 - server understood the request but declined to fulfill it. | +| 0x80244019 | `WU_E_PT_HTTP_STATUS_NOT_FOUND` | Same as HTTP status 404 - the server cannot find the requested URI (Uniform Resource Identifier). | +| 0x8024401A | `WU_E_PT_HTTP_STATUS_BAD_METHOD` | Same as HTTP status 405 - the HTTP method is not allowed. | +| 0x8024401B | `WU_E_PT_HTTP_STATUS_PROXY_AUTH_REQ` | Same as HTTP status 407 - proxy authentication is required. | +| 0x8024401C | `WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT` | Same as HTTP status 408 - the server timed out waiting for the request. | +| 0x8024401D | `WU_E_PT_HTTP_STATUS_CONFLICT` | Same as HTTP status 409 - the request was not completed due to a conflict with the current state of the resource. | +| 0x8024401E | `WU_E_PT_HTTP_STATUS_GONE` | Same as HTTP status 410 - requested resource is no longer available at the server. | +| 0x8024401F | `WU_E_PT_HTTP_STATUS_SERVER_ERROR` | Same as HTTP status 500 - an error internal to the server prevented fulfilling the request. | +| 0x80244020 | `WU_E_PT_HTTP_STATUS_NOT_SUPPORTED` | Same as HTTP status 500 - server does not support the functionality required to fulfill the request. | +| 0x80244021 | `WU_E_PT_HTTP_STATUS_BAD_GATEWAY` | Same as HTTP status 502 - the server while acting as a gateway or a proxy received an invalid response from the upstream server it accessed in attempting to fulfill the request. | +| 0x80244022 | `WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL` | Same as HTTP status 503 - the service is temporarily overloaded. | +| 0x80244023 | `WU_E_PT_HTTP_STATUS_GATEWAY_TIMEOUT` | Same as HTTP status 503 - the request was timed out waiting for a gateway. | +| 0x80244024 | `WU_E_PT_HTTP_STATUS_VERSION_NOT_SUP` | Same as HTTP status 505 - the server does not support the HTTP protocol version used for the request. | +| 0x80244025 | `WU_E_PT_FILE_LOCATIONS_CHANGED` | Operation failed due to a changed file location; refresh internal state and resend. | +| 0x80244026 | `WU_E_PT_REGISTRATION_NOT_SUPPORTED` | Operation failed because Windows Update Agent does not support registration with a non-WSUS server. | +| 0x80244027 | `WU_E_PT_NO_AUTH_PLUGINS_REQUESTED` | The server returned an empty authentication information list. | +| 0x80244028 | `WU_E_PT_NO_AUTH_COOKIES_CREATED` | Windows Update Agent was unable to create any valid authentication cookies. | +| 0x80244029 | `WU_E_PT_INVALID_CONFIG_PROP` | A configuration property value was wrong. | +| 0x8024402A | `WU_E_PT_CONFIG_PROP_MISSING` | A configuration property value was missing. | +| 0x8024402B | `WU_E_PT_HTTP_STATUS_NOT_MAPPED` | The HTTP request could not be completed and the reason did not correspond to any of the `WU_E_PT_HTTP_*` error codes. | +| 0x8024402C | `WU_E_PT_WINHTTP_NAME_NOT_RESOLVED` | Same as ERROR_WINHTTP_NAME_NOT_RESOLVED - the proxy server or target server name cannot be resolved. | +| 0x8024402F | `WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS` | External cab file processing completed with some errors. | +| 0x80244030 | `WU_E_PT_ECP_INIT_FAILED` | The external cab processor initialization did not complete. | +| 0x80244031 | `WU_E_PT_ECP_INVALID_FILE_FORMAT` | The format of a metadata file was invalid. | +| 0x80244032 | `WU_E_PT_ECP_INVALID_METADATA` | External cab processor found invalid metadata. | +| 0x80244033 | `WU_E_PT_ECP_FAILURE_TO_EXTRACT_DIGEST` | The file digest could not be extracted from an external cab file. | +| 0x80244034 | `WU_E_PT_ECP_FAILURE_TO_DECOMPRESS_CAB_FILE` | An external cab file could not be decompressed. | +| 0x80244035 | `WU_E_PT_ECP_FILE_LOCATION_ERROR` | External cab processor was unable to get file locations. | +| 0x80244FFF | `WU_E_PT_UNEXPECTED` | A communication error not covered by another `WU_E_PT_*` error code. | +| 0x8024502D | `WU_E_PT_SAME_REDIR_ID` | Windows Update Agent failed to download a redirector cabinet file with a new redirectorId value from the server during the recovery. | +| 0x8024502E | `WU_E_PT_NO_MANAGED_RECOVER` | A redirector recovery action did not complete because the server is managed. | + +## Download Manager errors + +| Error code | Message | Description | +|------------|-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------| +| 0x80246001 | `WU_E_DM_URLNOTAVAILABLE` | A download manager operation could not be completed because the requested file does not have a URL. | +| 0x80246002 | `WU_E_DM_INCORRECTFILEHASH` | A download manager operation could not be completed because the file digest was not recognized. | +| 0x80246003 | `WU_E_DM_UNKNOWNALGORITHM` | A download manager operation could not be completed because the file metadata requested an unrecognized hash algorithm. | +| 0x80246004 | `WU_E_DM_NEEDDOWNLOADREQUEST` | An operation could not be completed because a download request is required from the download handler. | +| 0x80246005 | `WU_E_DM_NONETWORK` | A download manager operation could not be completed because the network connection was unavailable. | +| 0x80246006 | `WU_E_DM_WRONGBITSVERSION` | A download manager operation could not be completed because the version of Background Intelligent Transfer Service (BITS) is incompatible. | +| 0x80246007 | `WU_E_DM_NOTDOWNLOADED` | The update has not been downloaded. | +| 0x80246008 | `WU_E_DM_FAILTOCONNECTTOBITS` | A download manager operation failed because the download manager was unable to connect the Background Intelligent Transfer Service (BITS). | +| 0x80246009 | `WU_E_DM_BITSTRANSFERERROR` | A download manager operation failed because there was an unspecified Background Intelligent Transfer Service (BITS) transfer error. | +| 0x8024600A | `WU_E_DM_DOWNLOADLOCATIONCHANGED` | A download must be restarted because the location of the source of the download has changed. | +| 0x8024600B | `WU_E_DM_CONTENTCHANGED` | A download must be restarted because the update content changed in a new revision. | +| 0x80246FFF | `WU_E_DM_UNEXPECTED` | There was a download manager error not covered by another `WU_E_DM_*` error code. | + +## Update Handler errors + +| Error code | Message | Description | +|------------|----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------| +| 0x80242000 | `WU_E_UH_REMOTEUNAVAILABLE` | A request for a remote update handler could not be completed because no remote process is available. | +| 0x80242001 | `WU_E_UH_LOCALONLY` | A request for a remote update handler could not be completed because the handler is local only. | +| 0x80242002 | `WU_E_UH_UNKNOWNHANDLER` | A request for an update handler could not be completed because the handler could not be recognized. | +| 0x80242003 | `WU_E_UH_REMOTEALREADYACTIVE` | A remote update handler could not be created because one already exists. | +| 0x80242004 | `WU_E_UH_DOESNOTSUPPORTACTION` | A request for the handler to install (uninstall) an update could not be completed because the update does not support install (uninstall). | +| 0x80242005 | `WU_E_UH_WRONGHANDLER` | An operation did not complete because the wrong handler was specified. | +| 0x80242006 | `WU_E_UH_INVALIDMETADATA` | A handler operation could not be completed because the update contains invalid metadata. | +| 0x80242007 | `WU_E_UH_INSTALLERHUNG` | An operation could not be completed because the installer exceeded the time limit. | +| 0x80242008 | `WU_E_UH_OPERATIONCANCELLED` | An operation being done by the update handler was canceled. | +| 0x80242009 | `WU_E_UH_BADHANDLERXML` | An operation could not be completed because the handler-specific metadata is invalid. | +| 0x8024200A | `WU_E_UH_CANREQUIREINPUT` | A request to the handler to install an update could not be completed because the update requires user input. | +| 0x8024200B | `WU_E_UH_INSTALLERFAILURE` | The installer failed to install (uninstall) one or more updates. | +| 0x8024200C | `WU_E_UH_FALLBACKTOSELFCONTAINED` | The update handler should download self-contained content rather than delta-compressed content for the update. | +| 0x8024200D | `WU_E_UH_NEEDANOTHERDOWNLOAD` | The update handler did not install the update because it needs to be downloaded again. | +| 0x8024200E | `WU_E_UH_NOTIFYFAILURE` | The update handler failed to send notification of the status of the install (uninstall) operation. | +| 0x8024200F | `WU_E_UH_INCONSISTENT_FILE_NAMES` | The file names contained in the update metadata and in the update package are inconsistent. | +| 0x80242010 | `WU_E_UH_FALLBACKERROR` | The update handler failed to fall back to the self-contained content. | +| 0x80242011 | `WU_E_UH_TOOMANYDOWNLOADREQUESTS` | The update handler has exceeded the maximum number of download requests. | +| 0x80242012 | `WU_E_UH_UNEXPECTEDCBSRESPONSE` | The update handler has received an unexpected response from CBS. | +| 0x80242013 | `WU_E_UH_BADCBSPACKAGEID` | The update metadata contains an invalid CBS package identifier. | +| 0x80242014 | `WU_E_UH_POSTREBOOTSTILLPENDING` | The post-reboot operation for the update is still in progress. | +| 0x80242015 | `WU_E_UH_POSTREBOOTRESULTUNKNOWN` | The result of the post-reboot operation for the update could not be determined. | +| 0x80242016 | `WU_E_UH_POSTREBOOTUNEXPECTEDSTATE` | The state of the update after its post-reboot operation has completed is unexpected. | +| 0x80242017 | `WU_E_UH_NEW_SERVICING_STACK_REQUIRED` | The OS servicing stack must be updated before this update is downloaded or installed. | +| 0x80242FFF | `WU_E_UH_UNEXPECTED` | An update handler error not covered by another `WU_E_UH_*` code. | + +## Data Store errors + +| Error code | Message | Description | +|------------|--------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 0x80248000 | `WU_E_DS_SHUTDOWN` | An operation failed because Windows Update Agent is shutting down. | +| 0x80248001 | `WU_E_DS_INUSE` | An operation failed because the data store was in use. | +| 0x80248002 | `WU_E_DS_INVALID` | The current and expected states of the data store do not match. | +| 0x80248003 | `WU_E_DS_TABLEMISSING` | The data store is missing a table. | +| 0x80248004 | `WU_E_DS_TABLEINCORRECT` | The data store contains a table with unexpected columns. | +| 0x80248005 | `WU_E_DS_INVALIDTABLENAME` | A table could not be opened because the table is not in the data store. | +| 0x80248006 | `WU_E_DS_BADVERSION` | The current and expected versions of the data store do not match. | +| 0x80248007 | `WU_E_DS_NODATA` | The information requested is not in the data store. | +| 0x80248008 | `WU_E_DS_MISSINGDATA` | The data store is missing required information or has a NULL in a table column that requires a non-null value. | +| 0x80248009 | `WU_E_DS_MISSINGREF` | The data store is missing required information or has a reference to missing license terms file localized property or linked row. | +| 0x8024800A | `WU_E_DS_UNKNOWNHANDLER` | The update was not processed because its update handler could not be recognized. | +| 0x8024800B | `WU_E_DS_CANTDELETE` | The update was not deleted because it is still referenced by one or more services. | +| 0x8024800C | `WU_E_DS_LOCKTIMEOUTEXPIRED` | The data store section could not be locked within the allotted time. | +| 0x8024800D | `WU_E_DS_NOCATEGORIES` | The category was not added because it contains no parent categories and is not a top-level category itself. | +| 0x8024800E | `WU_E_DS_ROWEXISTS` | The row was not added because an existing row has the same primary key. | +| 0x8024800F | `WU_E_DS_STOREFILELOCKED` | The data store could not be initialized because it was locked by another process. | +| 0x80248010 | `WU_E_DS_CANNOTREGISTER` | The data store is not allowed to be registered with COM in the current process. | +| 0x80248011 | `WU_E_DS_UNABLETOSTART` | Could not create a data store object in another process. | +| 0x80248013 | `WU_E_DS_DUPLICATEUPDATEID` | The server sent the same update to the client with two different revision IDs. | +| 0x80248014 | `WU_E_DS_UNKNOWNSERVICE` | An operation did not complete because the service is not in the data store. | +| 0x80248015 | `WU_E_DS_SERVICEEXPIRED` | An operation did not complete because the registration of the service has expired. | +| 0x80248016 | `WU_E_DS_DECLINENOTALLOWED` | A request to hide an update was declined because it is a mandatory update or because it was deployed with a deadline. | +| 0x80248017 | `WU_E_DS_TABLESESSIONMISMATCH` | A table was not closed because it is not associated with the session. | +| 0x80248018 | `WU_E_DS_SESSIONLOCKMISMATCH` | A table was not closed because it is not associated with the session. | +| 0x80248019 | `WU_E_DS_NEEDWINDOWSSERVICE` | A request to remove the Windows Update service or to unregister it with Automatic Updates was declined because it is a built-in service and/or Automatic Updates cannot fall back to another service. | +| 0x8024801A | `WU_E_DS_INVALIDOPERATION` | A request was declined because the operation is not allowed. | +| 0x8024801B | `WU_E_DS_SCHEMAMISMATCH` | The schema of the current data store and the schema of a table in a backup XML document do not match. | +| 0x8024801C | `WU_E_DS_RESETREQUIRED` | The data store requires a session reset; release the session and retry with a new session. | +| 0x8024801D | `WU_E_DS_IMPERSONATED` | A data store operation did not complete because it was requested with an impersonated identity. | +| 0x80248FFF | `WU_E_DS_UNEXPECTED` | A data store error not covered by another `WU_E_DS_*` code. | + +## Driver Util errors The PnP enumerated device is removed from the System Spec because one of the hardware IDs or the compatible IDs matches an installed printer driver. This is not a fatal error, and the device is merely skipped. -|Error code|Message|Description -|-|-|-| -| 0x8024C001 | WU_E_DRV_PRUNED| A driver was skipped.  -| 0x8024C002 |WU_E_DRV_NOPROP_OR_LEGACY| A property for the driver could not be found. It may not conform with required specifications.  -| 0x8024C003 | WU_E_DRV_REG_MISMATCH| The registry type read for the driver does not match the expected type.  -| 0x8024C004 | WU_E_DRV_NO_METADATA| The driver update is missing metadata.  -| 0x8024C005 | WU_E_DRV_MISSING_ATTRIBUTE| The driver update is missing a required attribute.  -| 0x8024C006| WU_E_DRV_SYNC_FAILED| Driver synchronization failed.  -| 0x8024C007 | WU_E_DRV_NO_PRINTER_CONTENT| Information required for the synchronization of applicable printers is missing.  -| 0x8024CFFF | WU_E_DRV_UNEXPECTED| A driver error not covered by another WU_E_DRV_* code.  - -## Windows Update error codes +| Error code | Message | Description | +|------------|-------------------------------|------------------------------------------------------------------------------------------------| +| 0x8024C001 | `WU_E_DRV_PRUNED` | A driver was skipped. | +| 0x8024C002 | `WU_E_DRV_NOPROP_OR_LEGACY` | A property for the driver could not be found. It may not conform with required specifications. | +| 0x8024C003 | `WU_E_DRV_REG_MISMATCH` | The registry type read for the driver does not match the expected type. | +| 0x8024C004 | `WU_E_DRV_NO_METADATA` | The driver update is missing metadata. | +| 0x8024C005 | `WU_E_DRV_MISSING_ATTRIBUTE` | The driver update is missing a required attribute. | +| 0x8024C006 | `WU_E_DRV_SYNC_FAILED` | Driver synchronization failed. | +| 0x8024C007 | `WU_E_DRV_NO_PRINTER_CONTENT` | Information required for the synchronization of applicable printers is missing. | +| 0x8024CFFF | `WU_E_DRV_UNEXPECTED` | A driver error not covered by another `WU_E_DRV_*` code. | -|Error code|Message|Description -|-|-|-| -| 0x80240001 | WU_E_NO_SERVICE| Windows Update Agent was unable to provide the service.  -| 0x80240002 | WU_E_MAX_CAPACITY_REACHED | The maximum capacity of the service was exceeded.  -| 0x80240003 | WU_E_UNKNOWN_ID| An ID cannot be found.  -| 0x80240004 | WU_E_NOT_INITIALIZED| The object could not be initialized.  -| 0x80240005 | WU_E_RANGEOVERLAP |The update handler requested a byte range overlapping a previously requested range.  -| 0x80240006 | WU_E_TOOMANYRANGES| The requested number of byte ranges exceeds the maximum number (2^31 - 1).  -| 0x80240007 | WU_E_INVALIDINDEX| The index to a collection was invalid.  -| 0x80240008 | WU_E_ITEMNOTFOUND| The key for the item queried could not be found.  -| 0x80240009 | WU_E_OPERATIONINPROGRESS| Another conflicting operation was in progress. Some operations such as installation cannot be performed twice simultaneously.  -| 0x8024000A | WU_E_COULDNOTCANCEL| Cancellation of the operation was not allowed.  -| 0x8024000B | WU_E_CALL_CANCELLED| Operation was cancelled.  -| 0x8024000C | WU_E_NOOP| No operation was required.  -| 0x8024000D | WU_E_XML_MISSINGDATA| Windows Update Agent could not find required information in the update's XML data.  -| 0x8024000E | WU_E_XML_INVALID| Windows Update Agent found invalid information in the update's XML data.  -| 0x8024000F | WU_E_CYCLE_DETECTED | Circular update relationships were detected in the metadata.  -| 0x80240010 | WU_E_TOO_DEEP_RELATION| Update relationships too deep to evaluate were evaluated.  -| 0x80240011 | WU_E_INVALID_RELATIONSHIP| An invalid update relationship was detected.  -| 0x80240012 | WU_E_REG_VALUE_INVALID| An invalid registry value was read.  -| 0x80240013 | WU_E_DUPLICATE_ITEM| Operation tried to add a duplicate item to a list.  -| 0x80240016 | WU_E_INSTALL_NOT_ALLOWED| Operation tried to install while another installation was in progress or the system was pending a mandatory restart.  -| 0x80240017 | WU_E_NOT_APPLICABLE| Operation was not performed because there are no applicable updates.  -| 0x80240018 | WU_E_NO_USERTOKEN| Operation failed because a required user token is missing.  -| 0x80240019 | WU_E_EXCLUSIVE_INSTALL_CONFLICT| An exclusive update cannot be installed with other updates at the same time.  -| 0x8024001A | WU_E_POLICY_NOT_SET | A policy value was not set.  -| 0x8024001B | WU_E_SELFUPDATE_IN_PROGRESS| The operation could not be performed because the Windows Update Agent is self-updating.  -| 0x8024001D | WU_E_INVALID_UPDATE| An update contains invalid metadata.  -| 0x8024001E | WU_E_SERVICE_STOP| Operation did not complete because the service or system was being shut down.  -| 0x8024001F | WU_E_NO_CONNECTION| Operation did not complete because the network connection was unavailable.  -| 0x80240020 | WU_E_NO_INTERACTIVE_USER| Operation did not complete because there is no logged-on interactive user.  -| 0x80240021 | WU_E_TIME_OUT| Operation did not complete because it timed out.  -| 0x80240022 | WU_E_ALL_UPDATES_FAILED| Operation failed for all the updates.  -| 0x80240023 | WU_E_EULAS_DECLINED| The license terms for all updates were declined.  -| 0x80240024 | WU_E_NO_UPDATE| There are no updates.  -| 0x80240025 | WU_E_USER_ACCESS_DISABLED| Group Policy settings prevented access to Windows Update.  -| 0x80240026 | WU_E_INVALID_UPDATE_TYPE| The type of update is invalid.  -| 0x80240027 | WU_E_URL_TOO_LONG| The URL exceeded the maximum length.  -| 0x80240028 | WU_E_UNINSTALL_NOT_ALLOWED| The update could not be uninstalled because the request did not originate from a WSUS server.  -| 0x80240029 | WU_E_INVALID_PRODUCT_LICENSE| Search may have missed some updates before there is an unlicensed application on the system.  -| 0x8024002A | WU_E_MISSING_HANDLER| A component required to detect applicable updates was missing.  -| 0x8024002B | WU_E_LEGACYSERVER| An operation did not complete because it requires a newer version of server.  -| 0x8024002C | WU_E_BIN_SOURCE_ABSENT| A delta-compressed update could not be installed because it required the source.  -| 0x8024002D | WU_E_SOURCE_ABSENT| A full-file update could not be installed because it required the source.  -| 0x8024002E | WU_E_WU_DISABLED| Access to an unmanaged server is not allowed.  -| 0x8024002F | WU_E_CALL_CANCELLED_BY_POLICY| Operation did not complete because the DisableWindowsUpdateAccess policy was set.  -| 0x80240030 | WU_E_INVALID_PROXY_SERVER| The format of the proxy list was invalid.  -| 0x80240031 | WU_E_INVALID_FILE| The file is in the wrong format.  -| 0x80240032 | WU_E_INVALID_CRITERIA| The search criteria string was invalid.  -| 0x80240033 | WU_E_EULA_UNAVAILABLE| License terms could not be downloaded.  -| 0x80240034 | WU_E_DOWNLOAD_FAILED| Update failed to download.  -| 0x80240035 | WU_E_UPDATE_NOT_PROCESSED| The update was not processed.  -| 0x80240036 | WU_E_INVALID_OPERATION| The object's current state did not allow the operation.  -| 0x80240037 | WU_E_NOT_SUPPORTED| The functionality for the operation is not supported.  -| 0x80240038 | WU_E_WINHTTP_INVALID_FILE| The downloaded file has an unexpected content type.  -| 0x80240039 | WU_E_TOO_MANY_RESYNC| Agent is asked by server to resync too many times.  -| 0x80240040 | WU_E_NO_SERVER_CORE_SUPPORT| WUA API method does not run on Server Core installation.  -| 0x80240041 | WU_E_SYSPREP_IN_PROGRESS| Service is not available while sysprep is running.  -| 0x80240042 | WU_E_UNKNOWN_SERVICE| The update service is no longer registered with AU.  -| 0x80240043 | WU_E_NO_UI_SUPPORT| There is no support for WUA UI.  -| 0x80240FFF | WU_E_UNEXPECTED| An operation failed due to reasons not covered by another error code.  - -## Windows Update success codes +## Windows Update error codes -|Error code|Message|Description -|-|-|-| -| 0x00240001| WU_S_SERVICE_STOP| Windows Update Agent was stopped successfully.  -| 0x00240002 | WU_S_SELFUPDATE| Windows Update Agent updated itself.  -| 0x00240003 | WU_S_UPDATE_ERROR| Operation completed successfully but there were errors applying the updates.  -| 0x00240004 | WU_S_MARKED_FOR_DISCONNECT| A callback was marked to be disconnected later because the request to disconnect the operation came while a callback was executing.  -| 0x00240005 | WU_S_REBOOT_REQUIRED| The system must be restarted to complete installation of the update.  -| 0x00240006 | WU_S_ALREADY_INSTALLED| The update to be installed is already installed on the system.  -| 0x00240007 | WU_S_ALREADY_UNINSTALLED | The update to be removed is not installed on the system.  -| 0x00240008 | WU_S_ALREADY_DOWNLOADED| The update to be downloaded has already been downloaded.  - -## Windows Installer minor errors +| Error code | Message | Description | +|------------|-----------------------------------|--------------------------------------------------------------| +| 0x80240001 | `WU_E_NO_SERVICE` | Windows Update Agent was unable to provide the service. +| 0x80240002 | `WU_E_MAX_CAPACITY_REACHED` | The maximum capacity of the service was exceeded. +| 0x80240003 | `WU_E_UNKNOWN_ID` | An ID cannot be found. +| 0x80240004 | `WU_E_NOT_INITIALIZED` | The object could not be initialized. +| 0x80240005 | `WU_E_RANGEOVERLAP` | The update handler requested a byte range overlapping a previously requested range. +| 0x80240006 | `WU_E_TOOMANYRANGES` | The requested number of byte ranges exceeds the maximum number (2^31 - 1). +| 0x80240007 | `WU_E_INVALIDINDEX` | The index to a collection was invalid. +| 0x80240008 | `WU_E_ITEMNOTFOUND` | The key for the item queried could not be found. +| 0x80240009 | `WU_E_OPERATIONINPROGRESS` | Another conflicting operation was in progress. Some operations such as installation cannot be performed twice simultaneously. +| 0x8024000A | `WU_E_COULDNOTCANCEL` | Cancellation of the operation was not allowed. +| 0x8024000B | `WU_E_CALL_CANCELLED` | Operation was canceled. +| 0x8024000C | `WU_E_NOOP` | No operation was required. +| 0x8024000D | `WU_E_XML_MISSINGDATA` | Windows Update Agent could not find required information in the update's XML data. +| 0x8024000E | `WU_E_XML_INVALID` | Windows Update Agent found invalid information in the update's XML data. +| 0x8024000F | `WU_E_CYCLE_DETECTED` | Circular update relationships were detected in the metadata. +| 0x80240010 | `WU_E_TOO_DEEP_RELATION` | Update relationships too deep to evaluate were evaluated. +| 0x80240011 | `WU_E_INVALID_RELATIONSHIP` | An invalid update relationship was detected. +| 0x80240012 | `WU_E_REG_VALUE_INVALID` | An invalid registry value was read. +| 0x80240013 | `WU_E_DUPLICATE_ITEM` | Operation tried to add a duplicate item to a list. +| 0x80240016 | `WU_E_INSTALL_NOT_ALLOWED` | Operation tried to install while another installation was in progress or the system was pending a mandatory restart. +| 0x80240017 | `WU_E_NOT_APPLICABLE` | Operation was not performed because there are no applicable updates. +| 0x80240018 | `WU_E_NO_USERTOKEN` | Operation failed because a required user token is missing. +| 0x80240019 | `WU_E_EXCLUSIVE_INSTALL_CONFLICT` | An exclusive update cannot be installed with other updates at the same time. +| 0x8024001A | `WU_E_POLICY_NOT_SET` | A policy value was not set. +| 0x8024001B | `WU_E_SELFUPDATE_IN_PROGRESS` | The operation could not be performed because the Windows Update Agent is self-updating. +| 0x8024001D | `WU_E_INVALID_UPDATE` | An update contains invalid metadata. +| 0x8024001E | `WU_E_SERVICE_STOP` | Operation did not complete because the service or system was being shut down. +| 0x8024001F | `WU_E_NO_CONNECTION` | Operation did not complete because the network connection was unavailable. +| 0x80240020 | `WU_E_NO_INTERACTIVE_USER` | Operation did not complete because there is no logged-on interactive user. +| 0x80240021 | `WU_E_TIME_OUT` | Operation did not complete because it timed out. +| 0x80240022 | `WU_E_ALL_UPDATES_FAILED` | Operation failed for all the updates. +| 0x80240023 | `WU_E_EULAS_DECLINED` | The license terms for all updates were declined. +| 0x80240024 | `WU_E_NO_UPDATE` | There are no updates. +| 0x80240025 | `WU_E_USER_ACCESS_DISABLED` | Group Policy settings prevented access to Windows Update. +| 0x80240026 | `WU_E_INVALID_UPDATE_TYPE` | The type of update is invalid. +| 0x80240027 | `WU_E_URL_TOO_LONG` | The URL exceeded the maximum length. +| 0x80240028 | `WU_E_UNINSTALL_NOT_ALLOWED` | The update could not be uninstalled because the request did not originate from a WSUS server. +| 0x80240029 | `WU_E_INVALID_PRODUCT_LICENSE` | Search may have missed some updates before there is an unlicensed application on the system. +| 0x8024002A | `WU_E_MISSING_HANDLER` | A component required to detect applicable updates was missing. +| 0x8024002B | `WU_E_LEGACYSERVER` | An operation did not complete because it requires a newer version of server. +| 0x8024002C | `WU_E_BIN_SOURCE_ABSENT` | A delta-compressed update could not be installed because it required the source. +| 0x8024002D | `WU_E_SOURCE_ABSENT` | A full-file update could not be installed because it required the source. +| 0x8024002E | `WU_E_WU_DISABLED` | Access to an unmanaged server is not allowed. +| 0x8024002F | `WU_E_CALL_CANCELLED_BY_POLICY` | Operation did not complete because the DisableWindowsUpdateAccess policy was set. +| 0x80240030 | `WU_E_INVALID_PROXY_SERVER` | The format of the proxy list was invalid. +| 0x80240031 | `WU_E_INVALID_FILE` | The file is in the wrong format. +| 0x80240032 | `WU_E_INVALID_CRITERIA` | The search criteria string was invalid. +| 0x80240033 | `WU_E_EULA_UNAVAILABLE` | License terms could not be downloaded. +| 0x80240034 | `WU_E_DOWNLOAD_FAILED` | Update failed to download. +| 0x80240035 | `WU_E_UPDATE_NOT_PROCESSED` | The update was not processed. +| 0x80240036 | `WU_E_INVALID_OPERATION` | The object's current state did not allow the operation. +| 0x80240037 | `WU_E_NOT_SUPPORTED` | The functionality for the operation is not supported. +| 0x80240038 | `WU_E_WINHTTP_INVALID_FILE` | The downloaded file has an unexpected content type. +| 0x80240039 | `WU_E_TOO_MANY_RESYNC` | Agent is asked by server to resync too many times. +| 0x80240040 | `WU_E_NO_SERVER_CORE_SUPPORT` | `WUA API` method does not run on Server Core installation. +| 0x80240041 | `WU_E_SYSPREP_IN_PROGRESS` | Service is not available while sysprep is running. +| 0x80240042 | `WU_E_UNKNOWN_SERVICE` | The update service is no longer registered with `AU`. +| 0x80240043 | `WU_E_NO_UI_SUPPORT` | There is no support for `WUA UI`. +| 0x80240FFF | `WU_E_UNEXPECTED` | An operation failed due to reasons not covered by another error code. + +## Windows Update success codes + +| Error code | Message | Description | +|------------|------------------------------|-------------------------------------------------------------------------------------------------------------------------------------| +| 0x00240001 | `WU_S_SERVICE_STOP` | Windows Update Agent was stopped successfully. | +| 0x00240002 | `WU_S_SELFUPDATE` | Windows Update Agent updated itself. | +| 0x00240003 | `WU_S_UPDATE_ERROR` | Operation completed successfully but there were errors applying the updates. | +| 0x00240004 | `WU_S_MARKED_FOR_DISCONNECT` | A callback was marked to be disconnected later because the request to disconnect the operation came while a callback was executing. | +| 0x00240005 | `WU_S_REBOOT_REQUIRED` | The system must be restarted to complete installation of the update. | +| 0x00240006 | `WU_S_ALREADY_INSTALLED` | The update to be installed is already installed on the system. | +| 0x00240007 | `WU_S_ALREADY_UNINSTALLED` | The update to be removed is not installed on the system. | +| 0x00240008 | `WU_S_ALREADY_DOWNLOADED` | The update to be downloaded has already been downloaded. | + +## Windows Installer minor errors The following errors are used to indicate that part of a search fails because of Windows Installer problems. Another part of the search may successfully return updates. All Windows Installer minor codes must share the same error code range so that the caller can tell that they are related to Windows Installer. -|Error code|Message|Description -|-|-|-| -| 0x80241001 |WU_E_MSI_WRONG_VERSION| Search may have missed some updates because the Windows Installer is less than version 3.1.  -| 0x80241002 | WU_E_MSI_NOT_CONFIGURED| Search may have missed some updates because the Windows Installer is not configured.  -| 0x80241003 | WU_E_MSP_DISABLED| Search may have missed some updates because policy has disabled Windows Installer patching.  -| 0x80241004 | WU_E_MSI_WRONG_APP_CONTEXT| An update could not be applied because the application is installed per-user.  -| 0x80241FFF | WU_E_MSP_UNEXPECTED| Search may have missed some updates because there was a failure of the Windows Installer.  +| Error code | Message | Description | +|------------|------------------------------|---------------------------------------------------------------------------------------------| +| 0x80241001 | `WU_E_MSI_WRONG_VERSION` | Search may have missed some updates because the Windows Installer is less than version 3.1. | +| 0x80241002 | `WU_E_MSI_NOT_CONFIGURED` | Search may have missed some updates because the Windows Installer is not configured. | +| 0x80241003 | `WU_E_MSP_DISABLED` | Search may have missed some updates because policy has disabled Windows Installer patching. | +| 0x80241004 | `WU_E_MSI_WRONG_APP_CONTEXT` | An update could not be applied because the application is installed per-user. | +| 0x80241FFF | `WU_E_MSP_UNEXPECTED` | Search may have missed some updates because there was a failure of the Windows Installer. | -## Windows Update Agent update and setup errors +## Windows Update Agent update and setup errors -|Error code|Message|Description -|-|-|-| -| 0x8024D001 | WU_E_SETUP_INVALID_INFDATA| Windows Update Agent could not be updated because an INF file contains invalid information.  -| 0x8024D002 | WU_E_SETUP_INVALID_IDENTDATA| Windows Update Agent could not be updated because the wuident.cab file contains invalid information.  -| 0x8024D003 | WU_E_SETUP_ALREADY_INITIALIZED| Windows Update Agent could not be updated because of an internal error that caused setup initialization to be performed twice.  -| 0x8024D004 | WU_E_SETUP_NOT_INITIALIZED| Windows Update Agent could not be updated because setup initialization never completed successfully.  -| 0x8024D005 | WU_E_SETUP_SOURCE_VERSION_MISMATCH| Windows Update Agent could not be updated because the versions specified in the INF do not match the actual source file versions.  -| 0x8024D006 | WU_E_SETUP_TARGET_VERSION_GREATER| Windows Update Agent could not be updated because a WUA file on the target system is newer than the corresponding source file.  -| 0x8024D007 | WU_E_SETUP_REGISTRATION_FAILED| Windows Update Agent could not be updated because regsvr32.exe returned an error.  -| 0x8024D009 | WU_E_SETUP_SKIP_UPDATE| An update to the Windows Update Agent was skipped due to a directive in the wuident.cab file.  -| 0x8024D00A | WU_E_SETUP_UNSUPPORTED_CONFIGURATION| Windows Update Agent could not be updated because the current system configuration is not supported.  -| 0x8024D00B | WU_E_SETUP_BLOCKED_CONFIGURATION| Windows Update Agent could not be updated because the system is configured to block the update.  -| 0x8024D00C | WU_E_SETUP_REBOOT_TO_FIX| Windows Update Agent could not be updated because a restart of the system is required.  -| 0x8024D00D | WU_E_SETUP_ALREADYRUNNING| Windows Update Agent setup is already running.  -| 0x8024D00E | WU_E_SETUP_REBOOTREQUIRED| Windows Update Agent setup package requires a reboot to complete installation.  -| 0x8024D00F | WU_E_SETUP_HANDLER_EXEC_FAILURE| Windows Update Agent could not be updated because the setup handler failed during execution.  -| 0x8024D010 | WU_E_SETUP_INVALID_REGISTRY_DATA| Windows Update Agent could not be updated because the registry contains invalid information.  -| 0x8024D013 | WU_E_SETUP_WRONG_SERVER_VERSION| Windows Update Agent could not be updated because the server does not contain update information for this version.  -| 0x8024DFFF | WU_E_SETUP_UNEXPECTED| Windows Update Agent could not be updated because of an error not covered by another WU_E_SETUP_* error code.  \ No newline at end of file +| Error code | Message | Description | +|------------|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------| +| 0x8024D001 | `WU_E_SETUP_INVALID_INFDATA` | Windows Update Agent could not be updated because an INF file contains invalid information. | +| 0x8024D002 | `WU_E_SETUP_INVALID_IDENTDATA` | Windows Update Agent could not be updated because the `wuident.cab` file contains invalid information. | +| 0x8024D003 | `WU_E_SETUP_ALREADY_INITIALIZED` | Windows Update Agent could not be updated because of an internal error that caused setup initialization to be performed twice. | +| 0x8024D004 | `WU_E_SETUP_NOT_INITIALIZED` | Windows Update Agent could not be updated because setup initialization never completed successfully. | +| 0x8024D005 | `WU_E_SETUP_SOURCE_VERSION_MISMATCH` | Windows Update Agent could not be updated because the versions specified in the INF do not match the actual source file versions. | +| 0x8024D006 | `WU_E_SETUP_TARGET_VERSION_GREATER` | Windows Update Agent could not be updated because a WUA file on the target system is newer than the corresponding source file. | +| 0x8024D007 | `WU_E_SETUP_REGISTRATION_FAILED` | Windows Update Agent could not be updated because `regsvr32.exe` returned an error. | +| 0x8024D009 | `WU_E_SETUP_SKIP_UPDATE` | An update to the Windows Update Agent was skipped due to a directive in the `wuident.cab` file. | +| 0x8024D00A | `WU_E_SETUP_UNSUPPORTED_CONFIGURATION` | Windows Update Agent could not be updated because the current system configuration is not supported. | +| 0x8024D00B | `WU_E_SETUP_BLOCKED_CONFIGURATION` | Windows Update Agent could not be updated because the system is configured to block the update. | +| 0x8024D00C | `WU_E_SETUP_REBOOT_TO_FIX` | Windows Update Agent could not be updated because a restart of the system is required. | +| 0x8024D00D | `WU_E_SETUP_ALREADYRUNNING` | Windows Update Agent setup is already running. | +| 0x8024D00E | `WU_E_SETUP_REBOOTREQUIRED` | Windows Update Agent setup package requires a reboot to complete installation. | +| 0x8024D00F | `WU_E_SETUP_HANDLER_EXEC_FAILURE` | Windows Update Agent could not be updated because the setup handler failed during execution. | +| 0x8024D010 | `WU_E_SETUP_INVALID_REGISTRY_DATA` | Windows Update Agent could not be updated because the registry contains invalid information. | +| 0x8024D013 | `WU_E_SETUP_WRONG_SERVER_VERSION` | Windows Update Agent could not be updated because the server does not contain update information for this version. | +| 0x8024DFFF | `WU_E_SETUP_UNEXPECTED` | Windows Update Agent could not be updated because of an error not covered by another `WU_E_SETUP_*` error code. | diff --git a/windows/deployment/update/windows-update-errors.md b/windows/deployment/update/windows-update-errors.md index d63d0500b4..cdb6ea9f85 100644 --- a/windows/deployment/update/windows-update-errors.md +++ b/windows/deployment/update/windows-update-errors.md @@ -3,11 +3,15 @@ title: Windows Update common errors and mitigation description: Learn about some common issues you might experience with Windows Update ms.prod: w10 ms.mktglfcycl: -ms.sitesec: library -author: kaushika-msft -ms.localizationpriority: medium -ms.author: elizapo +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationprioauthor: jaimeo +ms.audience: itpro +author: jaimeo ms.date: 09/18/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -17,20 +21,22 @@ ms.topic: article The following table provides information about common errors you might run into with Windows Update, as well as steps to help you mitigate them. -|Error Code|Message|Description|Mitigation| -|-|-|-|-| -|0x8024402F|WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS|External cab file processing completed with some errors|One of the reasons we see this issue is due to the design of a software called Lightspeed Rocket for Web filtering.
                                The IP addresses of the computers you want to get updates successfully on, should be added to the exceptions list of Lightspeed | -|0x80242006|WU_E_UH_INVALIDMETADATA|A handler operation could not be completed because the update contains invalid metadata.|Rename Software Redistribution Folder and attempt to download the updates again:
                                Rename the following folders to *.BAK:
                                - %systemroot%\system32\catroot2

                                To do this, type the following commands at a command prompt. Press ENTER after you type each command.
                                - Ren %systemroot%\SoftwareDistribution\DataStore *.bak
                                - Ren %systemroot%\SoftwareDistribution\Download *.bak
                                Ren %systemroot%\system32\catroot2 *.bak | -|0x80070BC9|ERROR_FAIL_REBOOT_REQUIRED|The requested operation failed. A system reboot is required to roll back changes made.|Ensure that we do not have any policies that control the start behavior for the Windows Module Installer. This service should not be hardened to any start value and should be managed by the OS.| -|0x80200053|BG_E_VALIDATION_FAILED|NA|Ensure that there is no Firewalls that filter downloads. The Firewall filtering may lead to invalid responses being received by the Windows Update Client.

                                If the issue still persists, run the [WU reset script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc). | -|0x80072EE2|WININET_E_TIMEOUT|The operation timed out|This error message can be caused if the computer isn't connected to Internet. To fix this issue, following these steps: make sure these URLs are not blocked:
                                http://*.update.microsoft.com
                                https://*.update.microsoft.com
                                http://download.windowsupdate.com

                                Additionally , you can take a network trace and see what is timing out. | -|0x80072EFD
                                0x80072EFE 
                                0x80D02002|TIME OUT ERRORS|The operation timed out|Make sure there are no firewall rules or proxy to block Microsoft download URLs.
                                Take a network monitor trace to understand better. | -|0X8007000D|ERROR_INVALID_DATA|Indicates invalid data downloaded or corruption occurred.|Attempt to re-download the update and initiate installation. | -|0x8024A10A|USO_E_SERVICE_SHUTTING_DOWN|Indicates that the WU Service is shutting down.|This may happen due to a very long period of time of inactivity, a system hang leading to the service being idle and leading to the shutdown of the service. Ensure that the system remains active and the connections remain established to complete the upgrade. | -|0x80240020|WU_E_NO_INTERACTIVE_USER|Operation did not complete because there is no logged-on interactive user.|Please login to the system to initiate the installation and allow the system to be rebooted. | -|0x80242014|WU_E_UH_POSTREBOOTSTILLPENDING|The post-reboot operation for the update is still in progress.|Some Windows Updates require the system to be restarted. Reboot the system to complete the installation of the Updates. | -|0x80246017|WU_E_DM_UNAUTHORIZED_LOCAL_USER|The download failed because the local user was denied authorization to download the content.|Ensure that the user attempting to download and install updates has been provided with sufficient privileges to install updates (Local Administrator).| -|0x8024000B|WU_E_CALL_CANCELLED|Operation was cancelled.|This indicates that the operation was cancelled by the user/service. You may also encounter this error when we are unable to filter the results. Run the [Decline Superseded PowerShell script](https://gallery.technet.microsoft.com/scriptcenter/Cleanup-WSUS-server-4424c9d6) to allow the filtering process to complete.| -|0x8024000E|WU_E_XML_INVALID|Windows Update Agent found invalid information in the update's XML data.|Certain drivers contain additional metadata information in the update.xml, which could lead Orchestrator to understand it as invalid data. Ensure that you have the latest Windows Update Agent installed on the machine. | -|0x8024D009|WU_E_SETUP_SKIP_UPDATE|An update to the Windows Update Agent was skipped due to a directive in the wuident.cab file.|You may encounter this error when WSUS is not sending the Self-update to the clients.

                                Review [KB920659](https://support.microsoft.com/help/920659/the-microsoft-windows-server-update-services-wsus-selfupdate-service-d) for instructions to resolve the issue.| -|0x80244007|WU_E_PT_SOAPCLIENT_SOAPFAULT|SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_* error codes.|This issue occurs because Windows cannot renew the cookies for Windows Update.

                                Review [KB2883975](https://support.microsoft.com/help/2883975/0x80244007-error-when-windows-tries-to-scan-for-updates-on-a-wsus-serv) for instructions to resolve the issue.| \ No newline at end of file + +| Error Code | Message | Description | Mitigation | +|------------------------------------------|-----------------------------------|-----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 0x8024402F | WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS | External cab file processing completed with some errors | One of the reasons we see this issue is due to the design of a software called Lightspeed Rocket for Web filtering.
                                The IP addresses of the computers you want to get updates successfully on, should be added to the exceptions list of Lightspeed | +| 0x80242006 | WU_E_UH_INVALIDMETADATA | A handler operation could not be completed because the update contains invalid metadata. | Rename Software Redistribution Folder and attempt to download the updates again:
                                Rename the following folders to \*.BAK:
                                - %systemroot%\system32\catroot2

                                To do this, type the following commands at a command prompt. Press ENTER after you type each command.
                                - Ren %systemroot%\SoftwareDistribution\DataStore \*.bak
                                - Ren %systemroot%\SoftwareDistribution\Download \*.bak
                                Ren %systemroot%\system32\catroot2 \*.bak | +| 0x80070BC9 | ERROR_FAIL_REBOOT_REQUIRED | The requested operation failed. A system reboot is required to roll back changes made. | Ensure that we do not have any policies that control the start behavior for the Windows Module Installer. This service should not be hardened to any start value and should be managed by the OS. | +| 0x80200053 | BG_E_VALIDATION_FAILED | NA | Ensure that there is no Firewalls that filter downloads. The Firewall filtering may lead to invalid responses being received by the Windows Update Client.

                                If the issue still persists, run the [WU reset script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc). | +| 0x80072EE2 | WININET_E_TIMEOUT | The operation timed out | This error message can be caused if the computer isn't connected to Internet. To fix this issue, following these steps: make sure these URLs are not blocked:
                                http://.update.microsoft.com
                                https://                                .update.microsoft.com


                                Additionally , you can take a network trace and see what is timing out. \ | +| 0x80072EFD
                                0x80072EFE 
                                0x80D02002 | TIME_OUT_ERRORS | The operation timed out | Make sure there are no firewall rules or proxy to block Microsoft download URLs.
                                Take a network monitor trace to understand better. \ | +| 0X8007000D | ERROR_INVALID_DATA | Indicates invalid data downloaded or corruption occurred. | Attempt to re-download the update and initiate installation. | +| 0x8024A10A | USO_E_SERVICE_SHUTTING_DOWN | Indicates that the WU Service is shutting down. | This may happen due to a very long period of time of inactivity, a system hang leading to the service being idle and leading to the shutdown of the service. Ensure that the system remains active and the connections remain established to complete the upgrade. | +| 0x80240020 | WU_E_NO_INTERACTIVE_USER | Operation did not complete because there is no logged-on interactive user. | Please login to the system to initiate the installation and allow the system to be rebooted. | +| 0x80242014 | WU_E_UH_POSTREBOOTSTILLPENDING | The post-reboot operation for the update is still in progress. | Some Windows Updates require the system to be restarted. Reboot the system to complete the installation of the Updates. | +| 0x80246017 | WU_E_DM_UNAUTHORIZED_LOCAL_USER | The download failed because the local user was denied authorization to download the content. | Ensure that the user attempting to download and install updates has been provided with sufficient privileges to install updates (Local Administrator). | +| 0x8024000B | WU_E_CALL_CANCELLED | Operation was cancelled. | This indicates that the operation was cancelled by the user/service. You may also encounter this error when we are unable to filter the results. Run the [Decline Superseded PowerShell script](https://gallery.technet.microsoft.com/scriptcenter/Cleanup-WSUS-server-4424c9d6) to allow the filtering process to complete. | +| 0x8024000E | WU_E_XML_INVALID | Windows Update Agent found invalid information in the update's XML data. | Certain drivers contain additional metadata information in the update.xml, which could lead Orchestrator to understand it as invalid data. Ensure that you have the latest Windows Update Agent installed on the machine. | +| 0x8024D009 | WU_E_SETUP_SKIP_UPDATE | An update to the Windows Update Agent was skipped due to a directive in the wuident.cab file. | You may encounter this error when WSUS is not sending the Self-update to the clients.

                                Review [KB920659](https://support.microsoft.com/help/920659/the-microsoft-windows-server-update-services-wsus-selfupdate-service-d) for instructions to resolve the issue. | +| 0x80244007 | WU_E_PT_SOAPCLIENT_SOAPFAULT | SOAP client failed because there was a SOAP fault for reasons of WU_E_PT_SOAP_\* error codes. | This issue occurs because Windows cannot renew the cookies for Windows Update.

                                Review [KB2883975](https://support.microsoft.com/help/2883975/0x80244007-error-when-windows-tries-to-scan-for-updates-on-a-wsus-serv) for instructions to resolve the issue. | + diff --git a/windows/deployment/update/windows-update-logs.md b/windows/deployment/update/windows-update-logs.md index b65bcc0c93..1e9deff347 100644 --- a/windows/deployment/update/windows-update-logs.md +++ b/windows/deployment/update/windows-update-logs.md @@ -3,11 +3,15 @@ title: Windows Update log files description: Learn about the Windows Update log files ms.prod: w10 ms.mktglfcycl: -ms.sitesec: library -author: kaushika-msft -ms.localizationpriority: medium -ms.author: elizapo +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationprioauthor: jaimeo +ms.audience: itpro +author: jaimeo ms.date: 09/18/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -61,7 +65,7 @@ The WU engine has different component names. The following are some of the most - DataStore - Caching update data locally - IdleTimer - Tracking active calls, stopping a service ->[!NOTE] +>[!NOTE] >Many component log messages are invaluable if you are looking for problems in that specific area. However, they can be useless if you don't filter to exclude irrelevant components so that you can focus on what’s important. ### Windows Update log structure @@ -141,3 +145,5 @@ There are different identifiers for the same update in different contexts. It’ - Small integers (especially in Datastore) can be local IDs ![Windows Update inconsisten terminology](images/update-inconsistent.png) +## Windows Setup log files analysis using SetupDiag tool +SetupDiag is a diagnostic tool that can be used for analysis of logs related to installation of Windows Updates. For detailed information, see [SetupDiag](https://docs.microsoft.com/windows/deployment/upgrade/setupdiag). diff --git a/windows/deployment/update/windows-update-overview.md b/windows/deployment/update/windows-update-overview.md index 18664e5161..47cb14f395 100644 --- a/windows/deployment/update/windows-update-overview.md +++ b/windows/deployment/update/windows-update-overview.md @@ -1,13 +1,17 @@ --- title: Get started with Windows Update -description: Learn how Windows Update works, including architecture and troubleshooting +description: An overview of learning resources for Windows Update, including documents on architecture, log files, and common errors. ms.prod: w10 ms.mktglfcycl: -ms.sitesec: library -author: kaushika-msft -ms.localizationpriority: medium -ms.author: elizapo +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationprioauthor: jaimeo +ms.audience: itpro +author: jaimeo ms.date: 09/18/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -17,7 +21,7 @@ ms.topic: article With the release of Windows 10, we moved the update model to the Unified Update Platform. Unified Update Platform (UUP) is a single publishing, hosting, scan and download model for all types of OS updates, desktop and mobile for all Windows-based operating systems, for everything from monthly quality updates to new feature updates. -Ues the following information to get started with Windows Update: +Use the following information to get started with Windows Update: - Understand the UUP architecture - Understand [how Windows Update works](how-windows-update-works.md) @@ -35,15 +39,15 @@ To understand the changes to the Windows Update architecture that UUP introduces - **Update Session Orchestrator (USO)**- A Windows OS component that orchestrates the sequence of downloading and installing various update types from Windows Update. Update types- - - OS Feature updates - - OS Security updates - - Device drivers - - Defender definition updates + - OS Feature updates + - OS Security updates + - Device drivers + - Defender definition updates - >[!NOTE] - > Other types of updates, like Office desktop updates, are installed if the user opts into Microsoft Update. - > - >Store apps aren't installed by USO, today they are separate. + >[!NOTE] + > Other types of updates, like Office desktop updates, are installed if the user opts into Microsoft Update. + > + >Store apps aren't installed by USO, today they are separate. - **WU Client/ UpdateAgent** - The component running on your PC. It's essentially a DLL that is downloaded to the device when an update is applicable. It surfaces the APIs needed to perform an update, including those needed to generate a list of payloads to download, as well as starts stage and commit operations. It provides a unified interface that abstracts away the underlying update technologies from the caller. - **WU Arbiter handle**- Code that is included in the UpdateAgent binary. The arbiter gathers information about the device, and uses the CompDB(s) to output an action list. It is responsible for determining the final "composition state" of your device, and which payloads (like ESDs or packages) are needed to get your device up to date. @@ -52,4 +56,4 @@ To understand the changes to the Windows Update architecture that UUP introduces Additional components include the following- - **CompDB** – A generic term to refer to the XML describing information about target build composition, available diff packages, and conditional rules. -- **Action List** – The payload and additional information needed to perform an update. The action list is consumed by the UpdateAgent, as well as other installers to determine what payload to download. It's also consumed by the "Install Agent" to determine what actions need to be taken, such as installing or removing packages. \ No newline at end of file +- **Action List** – The payload and additional information needed to perform an update. The action list is consumed by the UpdateAgent, as well as other installers to determine what payload to download. It's also consumed by the "Install Agent" to determine what actions need to be taken, such as installing or removing packages. diff --git a/windows/deployment/update/windows-update-resources.md b/windows/deployment/update/windows-update-resources.md index 66befc0f13..16e2488d65 100644 --- a/windows/deployment/update/windows-update-resources.md +++ b/windows/deployment/update/windows-update-resources.md @@ -1,13 +1,17 @@ --- -title: Windows Update - Additional resources +title: Windows Update - Additional resources description: Additional resources for Windows Update ms.prod: w10 -ms.mktglfcycl: -ms.sitesec: library -author: kaushika-msft +ms.mktglfcycl: + +audience: itpro +author: jaimeo ms.localizationpriority: medium -ms.author: elizapo +ms.audience: itpro +author: jaimeo ms.date: 09/18/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -17,108 +21,112 @@ ms.topic: article The following resources provide additional information about using Windows Update. -## WSUS Troubleshooting - -[Troubleshooting issues with WSUS client agents](https://support.microsoft.com/help/10132/) - -[How to troubleshoot WSUS](https://support.microsoft.com/help/4025764/) - -[Error 80244007 when WSUS client scans for updates](https://support.microsoft.com/help/4096317/) - -[Updates may not be installed with Fast Startup in Windows 10](https://support.microsoft.com/help/4011287/) - - -## How do I reset Windows Update components? - -[This script](https://gallery.technet.microsoft.com/scriptcenter/Reset-WindowsUpdateps1-e0c5eb78) will completely reset the Windows Update client settings. It has been tested on Windows 7, 8, 10, and Windows Server 2012 R2. It will configure the services and registry keys related to Windows Update for default settings. It will also clean up files related to Windows Update, in addition to BITS related data. +## WSUS Troubleshooting - -[This script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc) allow reset the Windows Update Agent resolving issues with Windows Update. - - -## Reset Windows Update components manually -1. Open a Windows command prompt. To open a command prompt, click **Start > Run**. Copy and paste (or type) the following command and then press ENTER: +[Troubleshooting issues with WSUS client agents](https://support.microsoft.com/help/10132/) + +[How to troubleshoot WSUS](https://support.microsoft.com/help/4025764/) + +[Error 80244007 when WSUS client scans for updates](https://support.microsoft.com/help/4096317/) + +[Updates may not be installed with Fast Startup in Windows 10](https://support.microsoft.com/help/4011287/) + + +## How do I reset Windows Update components? + +[This script](https://gallery.technet.microsoft.com/scriptcenter/Reset-WindowsUpdateps1-e0c5eb78) will completely reset the Windows Update client settings. It has been tested on Windows 7, 8, 10, and Windows Server 2012 R2. It will configure the services and registry keys related to Windows Update for default settings. It will also clean up files related to Windows Update, in addition to BITS related data. + + +[This script](https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc) allow reset the Windows Update Agent resolving issues with Windows Update. + + +## Reset Windows Update components manually +1. Open a Windows command prompt. To open a command prompt, click **Start > Run**. Copy and paste (or type) the following command and then press ENTER: ``` cmd - ``` -2. Stop the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command. ``` - net stop bits - net stop wuauserv +2. Stop the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command. ``` -3. Delete the qmgr\*.dat files. To do this, type the following command at a command prompt, and then press ENTER: + net stop bits + net stop wuauserv ``` - Del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat" +3. Delete the qmgr\*.dat files. To do this, type the following command at a command prompt, and then press ENTER: ``` -4. If this is your first attempt at resolving your Windows Update issues by using the steps in this article, go to step 5 without carrying out the steps in step 4. The steps in step 4 should only be performed at this point in the troubleshooting if you cannot resolve your Windows Update issues after following all steps but step 4. The steps in step 4 are also performed by the "Aggressive" mode of the Fix it Solution above. - 1. Rename the following folders to *.BAK: - - %systemroot%\SoftwareDistribution\DataStore - - %systemroot%\SoftwareDistribution\Download - - %systemroot%\system32\catroot2 - - To do this, type the following commands at a command prompt. Press ENTER after you type each command. - - Ren %systemroot%\SoftwareDistribution\DataStore *.bak - - Ren %systemroot%\SoftwareDistribution\Download *.bak - - Ren %systemroot%\system32\catroot2 *.bak - 2. Reset the BITS service and the Windows Update service to the default security descriptor. To do this, type the following commands at a command prompt. Press ENTER after you type each command. - - sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) - - sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) -5. Type the following command at a command prompt, and then press ENTER: + Del "%ALLUSERSPROFILE%\Application Data\Microsoft\Network\Downloader\qmgr*.dat" ``` - cd /d %windir%\system32 +4. If this is your first attempt at resolving your Windows Update issues by using the steps in this article, go to step 5 without carrying out the steps in step 4. The steps in step 4 should only be performed at this point in the troubleshooting if you cannot resolve your Windows Update issues after following all steps but step 4. The steps in step 4 are also performed by the "Aggressive" mode of the Fix it Solution above. + 1. Rename the following folders to *.BAK: + - %systemroot%\SoftwareDistribution\DataStore + - %systemroot%\SoftwareDistribution\Download + - %systemroot%\system32\catroot2 + + To do this, type the following commands at a command prompt. Press ENTER after you type each command. + - Ren %systemroot%\SoftwareDistribution\DataStore *.bak + - Ren %systemroot%\SoftwareDistribution\Download *.bak + - Ren %systemroot%\system32\catroot2 *.bak + 2. Reset the BITS service and the Windows Update service to the default security descriptor. To do this, type the following commands at a command prompt. Press ENTER after you type each command. + - sc.exe sdset bits D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) + - sc.exe sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU) +5. Type the following command at a command prompt, and then press ENTER: ``` -6. Reregister the BITS files and the Windows Update files. To do this, type the following commands at a command prompt. Press ENTER after you type each command. - - regsvr32.exe atl.dll - - regsvr32.exe urlmon.dll - - regsvr32.exe mshtml.dll - - regsvr32.exe shdocvw.dll - - regsvr32.exe browseui.dll - - regsvr32.exe jscript.dll - - regsvr32.exe vbscript.dll - - regsvr32.exe scrrun.dll - - regsvr32.exe msxml.dll - - regsvr32.exe msxml3.dll - - regsvr32.exe msxml6.dll - - regsvr32.exe actxprxy.dll - - regsvr32.exe softpub.dll - - regsvr32.exe wintrust.dll - - regsvr32.exe dssenh.dll - - regsvr32.exe rsaenh.dll - - regsvr32.exe gpkcsp.dll - - regsvr32.exe sccbase.dll - - regsvr32.exe slbcsp.dll - - regsvr32.exe cryptdlg.dll - - regsvr32.exe oleaut32.dll - - regsvr32.exe ole32.dll - - regsvr32.exe shell32.dll - - regsvr32.exe initpki.dll - - regsvr32.exe wuapi.dll - - regsvr32.exe wuaueng.dll - - regsvr32.exe wuaueng1.dll - - regsvr32.exe wucltui.dll - - regsvr32.exe wups.dll - - regsvr32.exe wups2.dll - - regsvr32.exe wuweb.dll - - regsvr32.exe qmgr.dll - - regsvr32.exe qmgrprxy.dll - - regsvr32.exe wucltux.dll - - regsvr32.exe muweb.dll - - regsvr32.exe wuwebv.dll -7. Reset Winsock. To do this, type the following command at a command prompt, and then press ENTER: + cd /d %windir%\system32 ``` - netsh reset winsock +6. Reregister the BITS files and the Windows Update files. To do this, type the following commands at a command prompt. Press ENTER after you type each command. + ``` -8. If you are running Windows XP or Windows Server 2003, you have to set the proxy settings. To do this, type the following command at a command prompt, and then press ENTER: + regsvr32.exe atl.dll + regsvr32.exe urlmon.dll + regsvr32.exe mshtml.dll + regsvr32.exe shdocvw.dll + regsvr32.exe browseui.dll + regsvr32.exe jscript.dll + regsvr32.exe vbscript.dll + regsvr32.exe scrrun.dll + regsvr32.exe msxml.dll + regsvr32.exe msxml3.dll + regsvr32.exe msxml6.dll + regsvr32.exe actxprxy.dll + regsvr32.exe softpub.dll + regsvr32.exe wintrust.dll + regsvr32.exe dssenh.dll + regsvr32.exe rsaenh.dll + regsvr32.exe gpkcsp.dll + regsvr32.exe sccbase.dll + regsvr32.exe slbcsp.dll + regsvr32.exe cryptdlg.dll + regsvr32.exe oleaut32.dll + regsvr32.exe ole32.dll + regsvr32.exe shell32.dll + regsvr32.exe initpki.dll + regsvr32.exe wuapi.dll + regsvr32.exe wuaueng.dll + regsvr32.exe wuaueng1.dll + regsvr32.exe wucltui.dll + regsvr32.exe wups.dll + regsvr32.exe wups2.dll + regsvr32.exe wuweb.dll + regsvr32.exe qmgr.dll + regsvr32.exe qmgrprxy.dll + regsvr32.exe wucltux.dll + regsvr32.exe muweb.dll + regsvr32.exe wuwebv.dll ``` - proxycfg.exe -d + +7. Reset Winsock. To do this, type the following command at a command prompt, and then press ENTER: ``` -9. Restart the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command. + netsh winsock reset ``` - net start bits - - net start wuauserv +8. If you are running Windows XP or Windows Server 2003, you have to set the proxy settings. To do this, type the following command at a command prompt, and then press ENTER: + ``` + proxycfg.exe -d + ``` +9. Restart the BITS service and the Windows Update service. To do this, type the following commands at a command prompt. Press ENTER after you type each command. + ``` + net start bits + + net start wuauserv ``` 10. If you are running Windows Vista or Windows Server 2008, clear the BITS queue. To do this, type the following command at a command prompt, and then press ENTER: - ``` - bitsadmin.exe /reset /allusers - ``` \ No newline at end of file + ``` + bitsadmin.exe /reset /allusers + ``` diff --git a/windows/deployment/update/windows-update-troubleshooting.md b/windows/deployment/update/windows-update-troubleshooting.md index 5f09b45f16..39568ae5ae 100644 --- a/windows/deployment/update/windows-update-troubleshooting.md +++ b/windows/deployment/update/windows-update-troubleshooting.md @@ -3,11 +3,14 @@ title: Windows Update troubleshooting description: Learn how to troubleshoot Windows Update ms.prod: w10 ms.mktglfcycl: -ms.sitesec: library -author: kaushika-msft -ms.localizationpriority: medium -ms.author: elizapo -ms.date: 09/18/2018 +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationprioauthor: jaimeo +ms.audience: itpro +author: jaimeo +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -20,7 +23,9 @@ If you run into problems when using Windows Update, start with the following ste 1. Run the built-in Windows Update troubleshooter to fix common issues. Navigate to **Settings > Update & Security > Troubleshoot > Windows Update**. 2. Install the most recent Servicing Stack Update (SSU) that matches your version of Windows from the Microsoft Update Catalog. See [Servicing stack updates](servicing-stack-updates.md) for more details on SSU. 3. Make sure that you install the latest Windows updates, cumulative updates, and rollup updates. To verify the update status, refer to the appropriate update history for your system: -  + + - [Windows 10, version 1903 and Windows Server, version 1903](https://support.microsoft.com/help/4498140) + - [Windows 10, version 1809 and Windows Server 2019](https://support.microsoft.com/help/4464619/windows-10-update-history) - [Windows 10, version 1803](https://support.microsoft.com/help/4099479/windows-10-update-history) - [Windows 10, version 1709](https://support.microsoft.com/help/4043454) - [Windows 10, version 1703](https://support.microsoft.com/help/4018124) @@ -44,7 +49,7 @@ The update that is offered to a device depends on several factors. Some of the m If the update you're offered isn't the most current available, it might be because your device is being managed by a WSUS server, and you're being offered the updates available on that server. It's also possible, if your device is part of a Windows as a Service deployment ring, that your admin is intentionally slowing the rollout of updates. Since the WaaS rollout is slow and measured to begin with, all devices will not receive the update on the same day. -## My machine is frozen at scan. Why? +## My device is frozen at scan. Why? The Settings UI is talking to the Update Orchestrator service which in turn is talking to Windows Update service. If these services stop unexpectedly then you might see this behavior. In such cases, do the following: 1. Close the Settings app and reopen it. 2. Launch Services.msc and check if the following services are running: @@ -135,13 +140,29 @@ Or DownloadManager [0]12F4.1FE8::09/29/2017-13:45:08.530 [agent]DO job {C6E2F6DC-5B78-4608-B6F1-0678C23614BD} hit a transient error, updateId = 5537BD35-BB74-40B2-A8C3-B696D3C97CBA.201 , error = 0x80D0000A ``` -Go to Services.msc and ensure that Windows Firewall Service is enabled. Stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft. For more information , see [I need to disable Windows Firewall](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc766337\(v=ws.10\)) or [Windows Update stuck at 0 percent on Windows 10 or Windows Server 2016](https://support.microsoft.com/help/4039473/windows-update-stuck-at-0-percent-on-windows-10-and-windows-server-201). +Go to Services.msc and ensure that Windows Firewall Service is enabled. Stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft. For more information, see [I need to disable Windows Firewall](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc766337(v=ws.10)). ## Issues arising from configuration of conflicting policies Windows Update provides a wide range configuration policies to control the behavior of WU service in a managed environment. While these policies let you configure the settings at a granular level, misconfiguration or setting conflicting polices may lead to unexpected behaviors. See [How to configure automatic updates by using Group Policy or registry settings](https://support.microsoft.com/help/328010/how-to-configure-automatic-updates-by-using-group-policy-or-registry-s) for more information. + +## Device cannot access update files +Check that your device can access these Windows Update endpoints: + +- http://windowsupdate.microsoft.com +- http://*.windowsupdate.microsoft.com +- https://*.windowsupdate.microsoft.com +- http://*.update.microsoft.com +- https://*.update.microsoft.com +- http://*.windowsupdate.com +- http://download.windowsupdate.com +- https://download.microsoft.com +- http://*.download.windowsupdate.com +- http://wustat.windows.com +- http://ntservicepack.microsoft.com + Whitelist these endpoints for future use. ## Updates aren't downloading from the intranet endpoint (WSUS/SCCM) Windows 10 devices can receive updates from a variety of sources, including Windows Update online, a Windows Server Update Services server, and others. To determine the source of Windows Updates currently being used on a device, follow these steps: diff --git a/windows/deployment/update/wufb-autoupdate.md b/windows/deployment/update/wufb-autoupdate.md index da64371629..ac584017e2 100644 --- a/windows/deployment/update/wufb-autoupdate.md +++ b/windows/deployment/update/wufb-autoupdate.md @@ -1,13 +1,17 @@ --- title: Setting up Automatic Update in Windows Update for Business (Windows 10) -description: Learn how to get started using Windows Update for Business. +description: Learn how to configure Automatic Update group policies in Windows Update for Business. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: lizap -ms.localizationpriority: medium -ms.author: elizapo +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationprioauthor: jaimeo +ms.audience: itpro +author: jaimeo ms.date: 06/20/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -21,9 +25,9 @@ Automatic Update governs the "behind the scenes" download and installation proce |Policy|Description | |-|-| -|Configure Automatic Updates|Governs the installation activity that happens in the background. This allows you to configure the installation to happen during the [maintenance window](https://docs.microsoft.com/sccm/core/clients/manage/collections/use-maintenance-windows). Also, you can specify an installation time where the device will also try to install the latest packages. You can also pick a certain day and or week.| +|Configure Automatic Updates|Governs the installation activity that happens in the background. This allows you to configure the installation to happen during the [maintenance window](https://docs.microsoft.com/configmgr/core/clients/manage/collections/use-maintenance-windows). Also, you can specify an installation time where the device will also try to install the latest packages. You can also pick a certain day and or week.| |Automatic Update Detection Frequency|Lets you set the scan frequency the device will use to connect to Windows Update to see if there is any available content. Default is 22 hours, but you can increase or decrease the frequency. Keep in mind a desktop computer may need to scan less frequently than laptops, which can have intermittent internet connection.| -|Specify Intranet Microsoft Update Service Location|Used for Windows Server Update Services or System Center Configuration Manager users who want to install custom packages that are not offered through Windows Update.| +|Specify Intranet Microsoft Update Service Location|Used for Windows Server Update Services or Microsoft Endpoint Configuration Manager users who want to install custom packages that are not offered through Windows Update.| |Do not connect to any Windows Update Internet locations
                                Required for Dual Scan|Prevents access to Windows Update.| ## Suggested configuration diff --git a/windows/deployment/update/wufb-basics.md b/windows/deployment/update/wufb-basics.md index 6cdd0a1cc6..11483f0c9b 100644 --- a/windows/deployment/update/wufb-basics.md +++ b/windows/deployment/update/wufb-basics.md @@ -3,11 +3,15 @@ title: Configure the Basic group policy for Windows Update for Business description: Learn how to get started using the Basic GPO in Windows Update for Business. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: lizap -ms.localizationpriority: medium -ms.author: elizapo +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationprioauthor: jaimeo +ms.audience: itpro +author: jaimeo ms.date: 06/20/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- # Configure the Basic group policy for Windows Update for Business @@ -24,4 +28,4 @@ For Windows Update for Business configurations to work, devices need to be confi |Policy|Location|Suggested configuration| |-|-|-| |Allow Telemetry |GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Allow Telemetry |State: Enabled
                                **Option**: 1-Basic| -|Configure Commercial ID|GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Commercial ID |State: Enabled
                                **Commercial ID**: The GUID created for you at the time of onboarding to Windows Analytics| \ No newline at end of file +|Configure Commercial ID|GPO: Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Commercial ID |State: Enabled
                                **Commercial ID**: The GUID created for you at the time of onboarding to Windows Analytics| diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md index 5d1f0ea0d5..df08dd3caa 100644 --- a/windows/deployment/update/wufb-compliancedeadlines.md +++ b/windows/deployment/update/wufb-compliancedeadlines.md @@ -3,53 +3,120 @@ title: Enforce compliance deadlines with policies in Windows Update for Business description: Learn how to enforce compliance deadlines using Windows Update for Business. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: lizap +author: jaimeo ms.localizationpriority: medium -ms.author: elizapo -ms.date: 06/20/2018 +ms.author: jaimeo +ms.reviewer: +manager: laurawi ms.topic: article --- # Enforcing compliance deadlines for updates >Applies to: Windows 10 -Deploying feature or quality updates for many organizations is only part of the equation for managing their device ecosystem. The ability to enforce patch compliance is the next important part. Windows Update for Business provides controls to manage deadlines for when devices should migrate to newer revisions. We offer two compliance flows that you can choose from: +Deploying feature or quality updates for many organizations is only part of the equation for managing their device ecosystem. The ability to enforce update compliance is the next important part. Windows Update for Business provides controls to manage deadlines for when devices should migrate to newer versions. + +The compliance options have changed with the release of Windows 10, version 1903: + +- [Starting with Windows 10, version 1903](#starting-with-windows-10-version-1903) +- [Prior to Windows 10, version 1903](#prior-to-windows-10-version-1903) + + +## Starting with Windows 10, version 1903 + +With a current version of Windows 10, it's best to use the new policy introduced in Windows 10, version 1903: **Specify deadlines for automatic updates and restarts**. In MDM, this policy is available as four separate settings: + +- Update/ConfigureDeadlineForFeatureUpdates +- Update/ConfigureDeadlineForQualityUpdates +- Update/ConfigureDeadlineGracePeriod +- Update/ConfigureDeadlineNoAutoReboot + +This policy starts the countdown for the update installation deadline from when the update is published, instead of starting with the "restart pending" state as the older policies did. + +The policy also includes a configurable grace period to allow, for example, users who have been away to have extra time before being forced to restart their devices. + +Further, the policy includes the option to opt out of automatic restarts until the deadline is reached by presenting the "engaged restart experience" until the deadline has actually expired. At this point the device will automatically schedule a restart regardless of active hours. + + + +### Policy setting overview + +|Policy|Description | +|-|-| +| (starting in Windows 10, version 1903) Specify deadlines for automatic updates and restarts | Similar to the older "Specify deadline before auto-restart for update installation," but starts the deadline countdown from when the update was published. Also introduces a configurable grace period and the option to opt out of automatic restarts until the deadline is reached. | + + + +### Suggested configurations + +|Policy|Location|Quality update deadline in days|Feature update deadline in days|Grace period in days| +|-|-|-|-|-| +|(starting in Windows 10, version 1903) Specify deadlines for automatic updates and restarts | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadlines for automatic updates and restarts | 7 | 7 | 2 | + +When **Specify deadlines for automatic updates and restarts** is set (starting in Windows 10, version 1903): + +**While restart is pending, before the deadline occurs:** +- For the first few days, the user receives a toast notification +- After this period, the user receives this dialog: + +![The notification users get for an impending restart prior to deadline](images/wufb-update-deadline-warning.png) +- If the user scheduled a restart, or if an auto restart is scheduled, 15 minutes before the scheduled time the user is receives this notification that the restart is about to occur: + +![The notification users get for an impending restart 15 minutes prior to restart](images/wufb-restart-imminent-warning.png) + +**If the restart is still pending after the deadline passes:** +- Within 12 hours before the deadline passes, the user receives this notification that the deadline is approaching: + +![The notification users get for an approaching restart deadline](images/wufb-pastdeadline-restart-warning.png) +- Once the deadline has passed, the user is forced to restart to keep their devices in compliance and receives this notification: + +![The notification users get for an imminent restart after the deadline](images/wufb-pastdeadline-restartnow.png) + + + + +## Prior to Windows 10, version 1903 + + +Two compliance flows are available: - [Deadline only](#deadline-only) - [Deadline with user engagement](#deadline-with-user-engagement) -## Deadline Only +### Deadline only This flow only enforces the deadline where the device will attempt to silently restart outside of active hours before the deadline is reached. Once the deadline is reached the user is prompted with either a confirmation button or a restart now option. -### End User Experience +#### End-user experience -Once the device is in the pending restart state, it will attempt to restart the device during non-active hours. This is known as the auto-restart period, and by default it does not require user interaction to reboot the device. +Once the device is in the pending restart state, it will attempt to restart the device during non-active hours. This is known as the auto-restart period, and by default it does not require user interaction to restart the device. ->[!NOTE] +>[!NOTE] >Deadlines are enforced from pending restart state (for example, when the device has completed the installation and download from Windows Update). -### Policy overview +#### Policy overview |Policy|Description | |-|-| -|Specify deadline before auto-restart for update installation|Governs the update experience once the device has entered pending reboot state. It specifies a deadline, in days, to enforce compliance (such as imminent install).| -|Configure Auto-restart warning notification schedule for updates|Configures the reminder notification and the warning notification for a scheduled install. The user can dismiss a reminder, but not the warning.| +|Specify deadline before auto-restart for update installation|Governs the update experience once the device has entered pending restart state. It specifies a deadline, in days, to enforce compliance (such as imminent installation).| +|Configure Auto-restart warning notification schedule for updates|Configures the reminder notification and the warning notification for a scheduled installation. The user can dismiss a reminder, but not the warning.| -### Suggested Configuration -|Policy|Location|3 Day Compliance|5 Day Compliance|7 Day Compliance | + + +#### Suggested configuration + +|Policy|Location|3-day compliance|5-day compliance|7-day compliance| |-|-|-|-|-| -|Specify deadline before auto-restart for update installation| GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadline before auto-restart for update installation |State: Enabled
                                **Specify the number of days before pending restart will automatically be executed outside of active hours**: 2|State: Enabled
                                **Specify the number of days before pending restart will automatically be executed outside of active hours**: 3|State: Enabled
                                **Specify the number of days before pending restart will automatically be executed outside of active hours**: 4 +|Specify deadline before auto-restart for update installation| GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify deadline before auto-restart for update installation |State: Enabled
                                **Specify the number of days before pending restart will automatically be executed outside of active hours:** 2| State: Enabled
                                **Specify the number of days before pending restart will automatically be executed outside of active hours:** 3 | State: Enabled
                                **Specify the number of days before pending restart will automatically be executed outside of active hours:** 4| -### Controlling notification experience for deadline +#### Controlling notification experience for deadline |Policy| Location|Suggested Configuration | |-|-|-| |Configure Auto-restart warning notification schedule for updates|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure auto-restart warning notifications schedule for updates |State: Enabled
                                **Reminder** (hours): 2
                                **Warning** (minutes): 60 | -### Notification experience for deadline +#### Notification experience for deadline Notification users get for a quality update deadline: ![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) @@ -57,42 +124,49 @@ Notification users get for a quality update deadline: Notification users get for a feature update deadline: ![The notification users get for an impending feature update deadline](images/wufb-feature-notification.png) -## Deadline with user engagement +### Deadline with user engagement This flow provides the end user with prompts to select a time to restart the device before the deadline is reached. If the device is unable to restart at the time specified by the user or the time selected is outside the deadline, the device will restart the next time it is active. -### End user experience +#### End-user experience Before the deadline the device will be in two states: auto-restart period and engaged-restart period. During the auto-restart period the device will silently try to restart outside of active hours. If the device can't find an idle moment to restart, then the device will go into engaged-restart. The end user, at this point, can select a time that they would like the device to try to restart. Both phases happen before the deadline; once that deadline has passed then the device will restart at the next available time. -### Policy overview +#### Policy overview |Policy| Description | |-|-| -|Specify engaged restart transition and notification schedule for updates|Governs how the user will be impacted by the pending reboot. Transition days, first starts out in Auto-Restart where the device will find an idle moment to reboot the device. After 2 days engaged restart will commence and the user will be able to choose a time| -|Configure Auto-restart required notification for updates|Governs the notifications during the Auto-Restart period. During Active hours, the user will be notified that the device is trying to reboot. They will have the option to confirm or dismiss the notification| +|Specify engaged restart transition and notification schedule for updates|Governs how the user will be impacted by the pending restart. Transition days, first starts out in Auto-Restart where the device will find an idle moment to restart the device. After 2 days engaged restart will commence and the user will be able to choose a time| +|Configure Auto-restart required notification for updates|Governs the notifications during the Auto-Restart period. During Active hours, the user will be notified that the device is trying to restart. They will have the option to confirm or dismiss the notification| -### Suggested configuration +#### Suggested configuration -|Policy| Location| 3 Day Compliance| 5 Day Compliance| 7 Day Compliance | +|Policy| Location| 3-day compliance| 5-day compliance| 7-day compliance | |-|-|-|-|-| |Specify engaged restart transition and notification schedule for updates|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Specify Engaged restart transition and notification schedule for updates|State: Enabled
                                **Transition** (Days): 2
                                **Snooze** (Days): 2
                                **Deadline** (Days): 3|State: Enabled
                                **Transition** (Days): 2
                                **Snooze** (Days): 2
                                **Deadline** (Days): 4|State: Enabled
                                **Transition** (Days): 2
                                **Snooze** (Days): 2
                                **Deadline** (Days): 5| -### Controlling notification experience for engaged deadline +#### Controlling notification experience for engaged deadline |Policy| Location |Suggested Configuration |-|-|-| |Configure Auto-restart required notification for updates |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Configure Auto-restart required notification for updates|State: Enabled
                                **Method**: 2- User| -### Notification experience for engaged deadlines +#### Notification experience for engaged deadlines + Notification users get for quality update engaged deadline: + ![The notification users get for an impending engaged quality update deadline](images/wufb-quality-engaged-notification.png) Notification users get for a quality update deadline: + ![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) Notification users get for a feature update engaged deadline: + ![The notification users get for an impending feature update engaged deadline](images/wufb-feature-update-engaged-notification.png) Notification users get for a feature update deadline: + ![The notification users get for an impending feature update deadline](images/wufb-feature-update-deadline-notification.png) + + diff --git a/windows/deployment/update/wufb-managedrivers.md b/windows/deployment/update/wufb-managedrivers.md index c49ed5ff8a..e451d7751a 100644 --- a/windows/deployment/update/wufb-managedrivers.md +++ b/windows/deployment/update/wufb-managedrivers.md @@ -3,11 +3,15 @@ title: Managing drivers, dual-managed environments, and Delivery Optimization wi description: Learn how to manage drivers, dual managed environments, and bandwidth (Delivery Optimization) with GPOs in Windows Update for Business. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: lizap -ms.localizationpriority: medium -ms.author: elizapo +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationprioauthor: jaimeo +ms.audience: itpro +author: jaimeo ms.date: 06/21/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- # Managing drivers, dual-managed environments, and Delivery Optimization with group policies @@ -37,7 +41,7 @@ You can use an on-premises catalog, like WSUS, to deploy 3rd Party patches and u |Policy| Description | |-|-| -|Specify Intranet Microsoft Update Service Location| Used for WSUS/System Center Configuration Manager customers who want to install custom packages that are not offered through Windows Update.| +|Specify Intranet Microsoft Update Service Location| Used for WSUS/Microsoft Endpoint Configuration Manager customers who want to install custom packages that are not offered through Windows Update.| ### Suggested configuration @@ -63,4 +67,4 @@ You can use an on-premises catalog, like WSUS, to deploy 3rd Party patches and u |Download Mode|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Download Mode|State: Enabled
                                **Download Mode**: Group (2)| |Minimum Peer Caching Content File Size (in MB)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Minimum Peer Caching Content File Size (in MB)|State: Enabled
                                **Minimum Peer caching content file size (in MB)**: 10 MB| |Allow uploads while the device is on battery while under set battery level (percentage)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Allow uploads while the device is on battery while under set battery level (percentage)|State: Enabled
                                **Minimum battery level (Percentage)**: 60| -|Max Cache Age (in seconds)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Max Cache Age (in seconds)|State: Enabled
                                **Max Cache Age (in seconds)**: 604800 ~ 7 days| \ No newline at end of file +|Max Cache Age (in seconds)|GPO: Computer Configuration > Administrative Templates > Windows Components > Delivery Optimization > Max Cache Age (in seconds)|State: Enabled
                                **Max Cache Age (in seconds)**: 604800 ~ 7 days| diff --git a/windows/deployment/update/wufb-manageupdate.md b/windows/deployment/update/wufb-manageupdate.md index 84aa983ea8..10037c56b2 100644 --- a/windows/deployment/update/wufb-manageupdate.md +++ b/windows/deployment/update/wufb-manageupdate.md @@ -1,13 +1,17 @@ --- title: Managing feature and quality updates with policies in Windows Update for Business (Windows 10) -description: Learn how to get started using Windows Update for Business. +description: Learn how to manage feature and quality updates using group policies in Windows Update for Business. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: lizap -ms.localizationpriority: medium -ms.author: elizapo +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationprioauthor: jaimeo +ms.audience: itpro +author: jaimeo ms.date: 06/20/2018 +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -20,6 +24,7 @@ Windows Update for Business allows users to control when devices should receive The following policies let you configure when you want a device to see a feature and or quality update from Windows Update. ## Policy overview + |Policy name| Description | |-|-| |Select when Quality Updates are received|Configures when the device should receive quality update. In this policy you can also select a date to pause receiving Quality Updates until. | @@ -29,9 +34,10 @@ The following policies let you configure when you want a device to see a feature ## Suggested configuration for a non-wave deployment If you don't need a wave deployment and have a small set of devices to manage, we recommend the following configuration: + |Policy| Location|Suggested configuration | |-|-|-| -|Select when Quality Updates are received | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are received|State: Enabled
                                **Defer receiving it for this many days**: 0
                                **Pause Quality Updates**: Blank
                                *Note: use this functionality to prevent the device from receiving a quality update until the time passes| +|Select when Quality Updates are received | GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Quality Updates are received|State: Enabled
                                **Defer receiving it for this many days**: 0
                                **Pause Quality Updates**: Blank
                                *Note: use this functionality to prevent the device from receiving a quality update until the time passes| |Select when Preview Builds & feature Updates are received |GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business > Select when Preview Builds and Feature Updates are received|State: Enabled
                                **Select Windows Readiness Level**: SAC
                                **Defer receiving for this many days**: 0-365
                                **Pause Feature Updates**: Blank
                                *Note: use this functionality to prevent the device from receiving a feature update until the time passes| |Do not allow update deferral policies to cause scans against Windows Update|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not allow update deferral policies to cause scans against Windows Update|State: Disabled| diff --git a/windows/deployment/update/wufb-onboard.md b/windows/deployment/update/wufb-onboard.md index 022e4b177b..058f595090 100644 --- a/windows/deployment/update/wufb-onboard.md +++ b/windows/deployment/update/wufb-onboard.md @@ -3,11 +3,14 @@ title: Onboarding to Windows Update for Business (Windows 10) description: Learn how to get started using Windows Update for Business. ms.prod: w10 ms.mktglfcycl: manage -ms.sitesec: library -author: lizap -ms.localizationpriority: medium -ms.author: elizapo -ms.date: 06/20/2018 +audience: itpro +itproauthor: jaimeo +author: jaimeo +ms.localizationprioauthor: jaimeo +ms.audience: itpro +author: jaimeo +ms.reviewer: +manager: laurawi ms.topic: article --- @@ -15,30 +18,30 @@ ms.topic: article >Applies to: Windows 10 -Windows Update for Business is a tool that enables IT pros and power users to manage content they want to receive from Windows Update Service (WU). Windows Update for Business can control the following: +Windows Update for Business is a tool that enables IT pros and power users to manage content they want to receive from Windows Update Service. Windows Update for Business can control the following: -- Interaction between the client and Windows Update service (AU Options) +- Interaction between the client and Windows Update service - End user notification for pending updates - Compliance deadlines for feature or quality updates -- Configure wave deployment for feature or quality updates bandwidth optimization (DO) +- Configure wave deployment for feature or quality updates bandwidth optimization -We also provide additional functionality to manage your environment when risk or issues arise such as a LOB application being blocked: +We also provide additional functionality to manage your environment when risk or issues arise such as applications being blocked: - Uninstall latest feature or quality update - Pause for a duration of time Use the following information to set up your environment using Windows Update for Business policies: -- [Supported SKUs](#supported_skus) +- [Supported SKUs](#supported-editions) - [Windows Update for Business basics](wufb-basics.md) - [Setting up automatic update](wufb-autoupdate.md) - [Managing feature and quality updates](wufb-manageupdate.md) - [Enforcing compliance deadlines](wufb-compliancedeadlines.md) - [Managing drivers, environments with both Windows Update for Business and WSUS, and Download Optmization](wufb-managedrivers.md) -## Supported SKUs +## Supported editions -Windows Update for Business is supported on the following versions of Windows 10: +Windows Update for Business is supported on the following editions of Windows 10: - Windows 10 Education - Windows 10 Enterprise diff --git a/windows/deployment/upgrade/log-files.md b/windows/deployment/upgrade/log-files.md index 1e62227e0d..a4c6a01688 100644 --- a/windows/deployment/upgrade/log-files.md +++ b/windows/deployment/upgrade/log-files.md @@ -1,169 +1,260 @@ ---- -title: Log files - Windows IT Pro -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. -keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: greg-lindsay -ms.date: 03/30/2018 -ms.localizationpriority: medium -ms.topic: article ---- - -# Log files - -**Applies to** -- Windows 10 - ->[!NOTE] ->This is a 400 level topic (advanced).
                                ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - - -Several log files are created during each phase of the upgrade process. These log files are essential for troubleshooting upgrade problems. By default, the folders that contain these log files are hidden on the upgrade target computer. To view the log files, configure Windows Explorer to view hidden items, or use a tool to automatically gather these logs. The most useful log is **setupact.log**. The log files are located in a different folder depending on the Windows Setup phase. Recall that you can determine the phase from the extend code. - -Note: Also see the [Windows Error Reporting](windows-error-reporting.md) section in this document for help locating error codes and log files. - -The following table describes some log files and how to use them for troubleshooting purposes:
                                - -
                                - - - - - - - - - - - - - - - - -
                                Log filePhase: LocationDescriptionWhen to use
                                setupact.logDown-Level:
                                $Windows.~BT\Sources\Panther                                		Contains information about setup actions during the downlevel phase. All down-level failures and starting point for rollback investigations.
                                This is the most important log for diagnosing setup issues.
                                OOBE:
                                $Windows.~BT\Sources\Panther\UnattendGC                                		Contains information about actions during the OOBE phase.Investigating rollbacks that failed during OOBE phase and operations – 0x4001C, 0x4001D, 0x4001E, 0x4001F.
                                Rollback:
                                $Windows.~BT\Sources\Rollback                                		Contains information about actions during rollback.Investigating generic rollbacks - 0xC1900101.
                                Pre-initialization (prior to downlevel):
                                Windows                                		Contains information about initializing setup.If setup fails to launch.
                                Post-upgrade (after OOBE):
                                Windows\Panther                                		Contains information about setup actions during the installation.Investigate post-upgrade related issues.
                                setuperr.logSame as setupact.logContains information about setup errors during the installation.Review all errors encountered during the installation phase.
                                miglog.xmlPost-upgrade (after OOBE):
                                Windows\Panther                                		Contains information about what was migrated during the installation.Identify post upgrade data migration issues.
                                BlueBox.logDown-Level:
                                Windows\Logs\Mosetup                                		Contains information communication between setup.exe and Windows Update.Use during WSUS and WU down-level failures or for 0xC1900107.
                                Supplemental rollback logs:
                                -Setupmem.dmp
                                -setupapi.dev.log
                                -Event logs (*.evtx)                                		$Windows.~BT\Sources\RollbackAdditional logs collected during rollback. -Setupmem.dmp: If OS bugchecks during upgrade, setup will attempt to extract a mini-dump.
                                -Setupapi: Device install issues - 0x30018
                                -Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.
                                - -## Log entry structure - -A setupact.log or setuperr.log entry includes the following elements: - -
                                  -
                                1. The date and time - 2016-09-08 09:20:05. -
                                2. The log level - Info, Warning, Error, Fatal Error. -
                                3. The logging component - CONX, MOUPG, PANTHR, SP, IBSLIB, MIG, DISM, CSI, CBS. -
                                    -
                                  • The logging components SP (setup platform), MIG (migration engine), and CONX (compatibility information) are particularly useful for troubleshooting Windows Setup errors. -
                                  -
                                4. The message - Operation completed successfully. -
                                - -See the following example: - -| Date/Time | Log level | Component | Message | -|------|------------|------------|------------| -|2016-09-08 09:23:50,| Warning | MIG | Could not replace object C:\Users\name\Cookies. Target Object cannot be removed.| - - -## Analyze log files - ->The following instructions are meant for IT professionals. Also see the [Upgrade error codes](upgrade-error-codes.md) section in this guide to familiarize yourself with [result codes](upgrade-error-codes.md#result-codes) and [extend codes](upgrade-error-codes.md#extend-codes). - -
                                To analyze Windows Setup log files: - -
                                  -
                                1. Determine the Windows Setup error code. This code should be returned by Windows Setup if it is not successful with the upgrade process. -
                                2. Based on the [extend code](upgrade-error-codes.md#extend-codes) portion of the error code, determine the type and location of a [log files](#log-files) to investigate. -
                                3. Open the log file in a text editor, such as notepad. -
                                4. Using the [result code](upgrade-error-codes.md#result-codes) portion of the Windows Setup error code, search for the result code in the file and find the last occurrence of the code. Alternatively search for the "abort" and abandoning" text strings described in step 7 below. -
                                5. To find the last occurrence of the result code: -
                                    -
                                  1. Scroll to the bottom of the file and click after the last character. -
                                  2. Click Edit. -
                                  3. Click Find. -
                                  4. Type the result code. -
                                  5. Under Direction select Up. -
                                  6. Click Find Next. -
                                  -
                                6. When you have located the last occurrence of the result code, scroll up a few lines from this location in the file and review the processes that failed just prior to generating the result code. -
                                7. Search for the following important text strings: -
                                    -
                                  • Shell application requested abort -
                                  • Abandoning apply due to error for object -
                                  -
                                8. Decode Win32 errors that appear in this section. -
                                9. Write down the timestamp for the observed errors in this section. -
                                10. Search other log files for additional information matching these timestamps or errors. -
                                - -For example, assume that the error code for an error is 0x8007042B - 0x2000D. Searching for "8007042B" reveals the following content from the setuperr.log file: - ->Some lines in the text below are shortened to enhance readability. The date and time at the start of each line (ex: 2016-10-05 15:27:08) is shortened to minutes and seconds, and the certificate file name which is a long text string is shortened to just "CN." - -
                                setuperr.log content: - -
                                -27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
-27:08, Error           MIG    Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
-27:08, Error                  Gather failed. Last error: 0x00000000
-27:08, Error           SP     SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
-27:09, Error           SP     CMigrateFramework: Gather framework failed. Status: 44
-27:09, Error           SP     Operation failed: Migrate framework (Full). Error: 0x8007042B[gle=0x000000b7]
-27:09, Error           SP     Operation execution failed: 13. hr = 0x8007042B[gle=0x000000b7]
-27:09, Error           SP     CSetupPlatformPrivate::Execute: Execution of operations queue failed, abandoning. Error: 0x8007042B[gle=0x000000b7]
-
                                - -The first line indicates there was an error **0x00000570** with the file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]** (shown below): - -
                                -27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
-
                                - -The error 0x00000570 is a [Win32 error code](https://msdn.microsoft.com/library/cc231199.aspx) corresponding to: ERROR_FILE_CORRUPT: The file or directory is corrupted and unreadable. - -Therefore, Windows Setup failed because it was not able to migrate the corrupt file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN]**. This file is a local system certificate and can be safely deleted. Searching the setupact.log file for additional details, the phrase "Shell application requested abort" is found in a location with the same timestamp as the lines in setuperr.log. This confirms our suspicion that this file is the cause of the upgrade failure: - -
                                setupact.log content: - -
                                -27:00, Info                   Gather started at 10/5/2016 23:27:00
-27:00, Info [0x080489] MIG    Setting system object filter context (System)
-27:00, Info [0x0803e5] MIG    Not unmapping HKCU\Software\Classes; it is not mapped
-27:00, Info [0x0803e5] MIG    Not unmapping HKCU; it is not mapped
-27:00, Info            SP     ExecuteProgress: Elapsed events:1 of 4, Percent: 12
-27:00, Info [0x0802c6] MIG    Processing GATHER for migration unit: \UpgradeFramework (CMXEAgent)
-27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
-27:08, Error           MIG    Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
-27:08, Info            SP     ExecuteProgress: Elapsed events:2 of 4, Percent: 25
-27:08, Info            SP     ExecuteProgress: Elapsed events:3 of 4, Percent: 37
-27:08, Info [0x080489] MIG    Setting system object filter context (System)
-27:08, Info [0x0803e5] MIG    Not unmapping HKCU\Software\Classes; it is not mapped
-27:08, Info [0x0803e5] MIG    Not unmapping HKCU; it is not mapped
-27:08, Info            MIG    COutOfProcPluginFactory::FreeSurrogateHost: Shutdown in progress.
-27:08, Info            MIG    COutOfProcPluginFactory::LaunchSurrogateHost::CommandLine: -shortened-
-27:08, Info            MIG    COutOfProcPluginFactory::LaunchSurrogateHost: Successfully launched host and got control object.
-27:08, Error                  Gather failed. Last error: 0x00000000
-27:08, Info                   Gather ended at 10/5/2016 23:27:08 with result 44
-27:08, Info                   Leaving MigGather method
-27:08, Error           SP     SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
-
                                - - -
                                This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file. Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f. - -## Related topics - -[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) -
                                [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                                [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) -
                                [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
                                [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +--- +title: Log files - Windows IT Pro +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Learn how to interpret the log files generated during the Windows 10 upgrade process. +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Log files + +**Applies to** +- Windows 10 + +>[!NOTE] +>This is a 400 level topic (advanced).
                                +>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. + + +Several log files are created during each phase of the upgrade process. These log files are essential for troubleshooting upgrade problems. By default, the folders that contain these log files are hidden on the upgrade target computer. To view the log files, configure Windows Explorer to view hidden items, or use a tool to automatically gather these logs. The most useful log is **setupact.log**. The log files are located in a different folder depending on the Windows Setup phase. Recall that you can determine the phase from the extend code. + +>[!NOTE] +>Also see the [Windows Error Reporting](windows-error-reporting.md) section in this document for help locating error codes and log files. + +The following table describes some log files and how to use them for troubleshooting purposes:
                                + +
                                + + + + + + + + + + + + + + + + +
                                Log filePhase: LocationDescriptionWhen to use
                                setupact.logDown-Level:
                                $Windows.~BT\Sources\Panther                                		Contains information about setup actions during the downlevel phase. All down-level failures and starting point for rollback investigations.
                                This is the most important log for diagnosing setup issues.
                                OOBE:
                                $Windows.~BT\Sources\Panther\UnattendGC                                		Contains information about actions during the OOBE phase.Investigating rollbacks that failed during OOBE phase and operations – 0x4001C, 0x4001D, 0x4001E, 0x4001F.
                                Rollback:
                                $Windows.~BT\Sources\Rollback                                		Contains information about actions during rollback.Investigating generic rollbacks - 0xC1900101.
                                Pre-initialization (prior to downlevel):
                                Windows                                		Contains information about initializing setup.If setup fails to launch.
                                Post-upgrade (after OOBE):
                                Windows\Panther                                		Contains information about setup actions during the installation.Investigate post-upgrade related issues.
                                setuperr.logSame as setupact.logContains information about setup errors during the installation.Review all errors encountered during the installation phase.
                                miglog.xmlPost-upgrade (after OOBE):
                                Windows\Panther                                		Contains information about what was migrated during the installation.Identify post upgrade data migration issues.
                                BlueBox.logDown-Level:
                                Windows\Logs\Mosetup                                		Contains information communication between setup.exe and Windows Update.Use during WSUS and WU down-level failures or for 0xC1900107.
                                Supplemental rollback logs:
                                +Setupmem.dmp
                                +setupapi.dev.log
                                +Event logs (*.evtx)                                		$Windows.~BT\Sources\RollbackAdditional logs collected during rollback. +Setupmem.dmp: If OS bug checks during upgrade, setup will attempt to extract a mini-dump.
                                +Setupapi: Device install issues - 0x30018
                                +Event logs: Generic rollbacks (0xC1900101) or unexpected reboots.
                                + +## Log entry structure + +A setupact.log or setuperr.log entry (files are located at C:\Windows) includes the following elements: + +
                                  +
                                1. The date and time - 2016-09-08 09:20:05. +
                                2. The log level - Info, Warning, Error, Fatal Error. +
                                3. The logging component - CONX, MOUPG, PANTHR, SP, IBSLIB, MIG, DISM, CSI, CBS. +
                                    +
                                  • The logging components SP (setup platform), MIG (migration engine), and CONX (compatibility information) are particularly useful for troubleshooting Windows Setup errors. +
                                  +
                                4. The message - Operation completed successfully. +
                                + +See the following example: + +| Date/Time | Log level | Component | Message | +|------|------------|------------|------------| +|2016-09-08 09:23:50,| Warning | MIG | Could not replace object C:\Users\name\Cookies. Target Object cannot be removed.| + + +## Analyze log files + +The following instructions are meant for IT professionals. Also see the [Upgrade error codes](upgrade-error-codes.md) section in this guide to familiarize yourself with [result codes](upgrade-error-codes.md#result-codes) and [extend codes](upgrade-error-codes.md#extend-codes). + +
                                To analyze Windows Setup log files: + +
                                  +
                                1. Determine the Windows Setup error code. This code should be returned by Windows Setup if it is not successful with the upgrade process. +
                                2. Based on the extend code portion of the error code, determine the type and location of a log files to investigate. +
                                3. Open the log file in a text editor, such as notepad. +
                                4. Using the result code portion of the Windows Setup error code, search for the result code in the file and find the last occurrence of the code. Alternatively search for the "abort" and abandoning" text strings described in step 7 below. +
                                5. To find the last occurrence of the result code: +
                                    +
                                  1. Scroll to the bottom of the file and click after the last character. +
                                  2. Click Edit. +
                                  3. Click Find. +
                                  4. Type the result code. +
                                  5. Under Direction select Up. +
                                  6. Click Find Next. +
                                  +
                                6. When you have located the last occurrence of the result code, scroll up a few lines from this location in the file and review the processes that failed just prior to generating the result code. +
                                7. Search for the following important text strings: +
                                    +
                                  • Shell application requested abort +
                                  • Abandoning apply due to error for object +
                                  +
                                8. Decode Win32 errors that appear in this section. +
                                9. Write down the timestamp for the observed errors in this section. +
                                10. Search other log files for additional information matching these timestamps or errors. +
                                + +For example, assume that the error code for an error is 0x8007042B - 0x2000D. Searching for "8007042B" reveals the following content from the setuperr.log file: + +Some lines in the text below are shortened to enhance readability. The date and time at the start of each line (ex: 2016-10-05 15:27:08) is shortened to minutes and seconds, and the certificate file name which is a long text string is shortened to just "CN." + +
                                setuperr.log content: + +
                                +27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
+27:08, Error           MIG    Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
+27:08, Error                  Gather failed. Last error: 0x00000000
+27:08, Error           SP     SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
+27:09, Error           SP     CMigrateFramework: Gather framework failed. Status: 44
+27:09, Error           SP     Operation failed: Migrate framework (Full). Error: 0x8007042B[gle=0x000000b7]
+27:09, Error           SP     Operation execution failed: 13. hr = 0x8007042B[gle=0x000000b7]
+27:09, Error           SP     CSetupPlatformPrivate::Execute: Execution of operations queue failed, abandoning. Error: 0x8007042B[gle=0x000000b7]
+
                                + +The first line indicates there was an error **0x00000570** with the file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]** (shown below): + +
                                +27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
+
                                + +The error 0x00000570 is a [Win32 error code](https://msdn.microsoft.com/library/cc231199.aspx) corresponding to: ERROR_FILE_CORRUPT: The file or directory is corrupted and unreadable. + +Therefore, Windows Setup failed because it was not able to migrate the corrupt file **C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN]**. This file is a local system certificate and can be safely deleted. Searching the setupact.log file for additional details, the phrase "Shell application requested abort" is found in a location with the same timestamp as the lines in setuperr.log. This confirms our suspicion that this file is the cause of the upgrade failure: + +
                                setupact.log content: + +
                                +27:00, Info                   Gather started at 10/5/2016 23:27:00
+27:00, Info [0x080489] MIG    Setting system object filter context (System)
+27:00, Info [0x0803e5] MIG    Not unmapping HKCU\Software\Classes; it is not mapped
+27:00, Info [0x0803e5] MIG    Not unmapping HKCU; it is not mapped
+27:00, Info            SP     ExecuteProgress: Elapsed events:1 of 4, Percent: 12
+27:00, Info [0x0802c6] MIG    Processing GATHER for migration unit: <System>\UpgradeFramework (CMXEAgent)
+27:08, Error           SP     Error READ, 0x00000570 while gathering/applying object: File, C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Will return 0[gle=0x00000570]
+27:08, Error           MIG    Error 1392 while gathering object C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18 [CN]. Shell application requested abort![gle=0x00000570]
+27:08, Info            SP     ExecuteProgress: Elapsed events:2 of 4, Percent: 25
+27:08, Info            SP     ExecuteProgress: Elapsed events:3 of 4, Percent: 37
+27:08, Info [0x080489] MIG    Setting system object filter context (System)
+27:08, Info [0x0803e5] MIG    Not unmapping HKCU\Software\Classes; it is not mapped
+27:08, Info [0x0803e5] MIG    Not unmapping HKCU; it is not mapped
+27:08, Info            MIG    COutOfProcPluginFactory::FreeSurrogateHost: Shutdown in progress.
+27:08, Info            MIG    COutOfProcPluginFactory::LaunchSurrogateHost::CommandLine: -shortened-
+27:08, Info            MIG    COutOfProcPluginFactory::LaunchSurrogateHost: Successfully launched host and got control object.
+27:08, Error                  Gather failed. Last error: 0x00000000
+27:08, Info                   Gather ended at 10/5/2016 23:27:08 with result 44
+27:08, Info                   Leaving MigGather method
+27:08, Error           SP     SPDoFrameworkGather: Gather operation failed. Error: 0x0000002C
+
                                + +
                                setupapi.dev.log content: + +
                                +>>>  [Device Install (UpdateDriverForPlugAndPlayDevices) - PCI\VEN_8086&DEV_8C4F]
+>>>  Section start 2019/09/26 20:13:01.623
+      cmd: rundll32.exe "C:\WINDOWS\Installer\MSI6E4C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_95972906 484 ChipsetWiX.CustomAction!Intel.Deployment.ChipsetWiX.CustomActions.InstallDrivers
+     ndv: INF path: C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf
+     ndv: Install flags: 0x00000000
+     ndv: {Update Device Driver - PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8}
+     ndv:      Search options: 0x00000081
+     ndv:      Searching single INF 'C:\WINDOWS\TEMP\{15B1CD41-69F5-48EA-9F45-0560A40FE2D8}\Drivers\lynxpoint\LynxPointSystem.inf'
+     dvi:      {Build Driver List} 20:13:01.643
+     dvi:           Searching for hardware ID(s):
+     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
+     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028
+     dvi:                pci\ven_8086&dev_8c4f&cc_060100
+     dvi:                pci\ven_8086&dev_8c4f&cc_0601
+     dvi:           Searching for compatible ID(s):
+     dvi:                pci\ven_8086&dev_8c4f&rev_04
+     dvi:                pci\ven_8086&dev_8c4f
+     dvi:                pci\ven_8086&cc_060100
+     dvi:                pci\ven_8086&cc_0601
+     dvi:                pci\ven_8086
+     dvi:                pci\cc_060100
+     dvi:                pci\cc_0601
+     sig:           {_VERIFY_FILE_SIGNATURE} 20:13:01.667
+     sig:                Key      = lynxpointsystem.inf
+     sig:                FilePath = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
+     sig:                Catalog  = c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\LynxPoint.cat
+     sig:                Success: File is signed in catalog.
+     sig:           {_VERIFY_FILE_SIGNATURE exit(0x00000000)} 20:13:01.683
+     dvi:           Created Driver Node:
+     dvi:                HardwareID   - PCI\VEN_8086&DEV_8C4F
+     dvi:                InfName      - c:\windows\temp\{15b1cd41-69f5-48ea-9f45-0560a40fe2d8}\drivers\lynxpoint\lynxpointsystem.inf
+     dvi:                DevDesc      - Intel(R) QM87 LPC Controller - 8C4F
+     dvi:                Section      - Needs_ISAPNP_DRV
+     dvi:                Rank         - 0x00ff2001
+     dvi:                Signer Score - WHQL
+     dvi:                DrvDate      - 04/04/2016
+     dvi:                Version      - 10.1.1.18
+     dvi:      {Build Driver List - exit(0x00000000)} 20:13:01.699
+     ndv:      Searching currently installed INF
+     dvi:      {Build Driver List} 20:13:01.699
+     dvi:           Searching for hardware ID(s):
+     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028&rev_04
+     dvi:                pci\ven_8086&dev_8c4f&subsys_05be1028
+     dvi:                pci\ven_8086&dev_8c4f&cc_060100
+     dvi:                pci\ven_8086&dev_8c4f&cc_0601
+     dvi:           Searching for compatible ID(s):
+     dvi:                pci\ven_8086&dev_8c4f&rev_04
+     dvi:                pci\ven_8086&dev_8c4f
+     dvi:                pci\ven_8086&cc_060100
+     dvi:                pci\ven_8086&cc_0601
+     dvi:                pci\ven_8086
+     dvi:                pci\cc_060100
+     dvi:                pci\cc_0601
+     dvi:           Created Driver Node:
+     dvi:                HardwareID   - PCI\VEN_8086&DEV_8C4F
+     dvi:                InfName      - C:\WINDOWS\System32\DriverStore\FileRepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
+     dvi:                DevDesc      - Intel(R) QM87 LPC Controller - 8C4F
+     dvi:                Section      - Needs_ISAPNP_DRV
+     dvi:                Rank         - 0x00ff2001
+     dvi:                Signer Score - WHQL
+     dvi:                DrvDate      - 10/03/2016
+     dvi:                Version      - 10.1.1.38
+     dvi:      {Build Driver List - exit(0x00000000)} 20:13:01.731
+     dvi:      {DIF_SELECTBESTCOMPATDRV} 20:13:01.731
+     dvi:           Default installer: Enter 20:13:01.735
+     dvi:                {Select Best Driver}
+     dvi:                     Class GUID of device changed to: {4d36e97d-e325-11ce-bfc1-08002be10318}.
+     dvi:                     Selected Driver:
+     dvi:                          Description - Intel(R) QM87 LPC Controller - 8C4F
+     dvi:                          InfFile     - c:\windows\system32\driverstore\filerepository\lynxpointsystem.inf_amd64_cd1e518d883ecdfe\lynxpointsystem.inf
+     dvi:                          Section     - Needs_ISAPNP_DRV
+     dvi:                {Select Best Driver - exit(0x00000000)}
+     dvi:           Default installer: Exit
+     dvi:      {DIF_SELECTBESTCOMPATDRV - exit(0x00000000)} 20:13:01.743
+     ndv:      Currently Installed Driver:
+     ndv:           Inf Name       - oem1.inf
+     ndv:           Driver Date    - 10/03/2016
+     ndv:           Driver Version - 10.1.1.38
+     ndv: {Update Device Driver - exit(00000103)}
+!    ndv: No better matching drivers found for device 'PCI\VEN_8086&DEV_8C4F&SUBSYS_05BE1028&REV_04\3&11583659&0&F8'.
+!    ndv: No devices were updated.
+<<<  Section end 2019/09/26 20:13:01.759
+<<<  [Exit status: FAILURE(0xC1900101)]
+
                                + +
                                This analysis indicates that the Windows upgrade error can be resolved by deleting the C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\[CN] file. Note: In this example, the full, unshortened file name is C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\be8228fb2d3cb6c6b0ccd9ad51b320b4_a43d512c-69f2-42de-aef9-7a88fabdaa3f. + +## Related topics + +[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) +
                                [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +
                                [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) +
                                [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +
                                [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md b/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md deleted file mode 100644 index 05ad622fed..0000000000 --- a/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness.md +++ /dev/null @@ -1,45 +0,0 @@ ---- -title: Manage Windows upgrades with Upgrade Readiness (Windows 10) -description: Provides an overview of the process of managing Windows upgrades with Upgrade Readiness. -ms.prod: w10 -author: greg-lindsay -ms.date: 04/25/2017 -ms.topic: article ---- - -# Manage Windows upgrades with Upgrade Readiness - -Upgrading to new operating systems has traditionally been a challenging, complex, and slow process for many enterprises. Discovering applications and drivers and then testing them for potential compatibility issues have been among the biggest pain points. - -With the release of Upgrade Readiness, enterprises now have the tools to plan and manage the upgrade process end to end, allowing them to adopt new Windows releases more quickly. With new Windows versions being released multiple times a year, ensuring application and driver compatibility on an ongoing basis is key to adopting new Windows versions as they are released. Windows Upgrade Readiness not only supports upgrade management from Windows 7, Windows 8.1 to Windows 10, but also Windows 10 upgrades in the [Windows as a service](https://technet.microsoft.com/itpro/windows/manage/waas-overview) model. - -Microsoft developed Upgrade Readiness in response to demand from enterprise customers looking for additional direction and details about upgrading to Windows 10. Upgrade Readiness was built taking into account multiple channels of customer feedback, testing, and Microsoft’s experience upgrading millions of devices to Windows 10. - -With Windows diagnostic data enabled, Upgrade Readiness collects system, application, and driver data for analysis. We then identify compatibility issues that can block an upgrade and suggest fixes when they are known to Microsoft. - -Use Upgrade Readiness to get: - -- A visual workflow that guides you from pilot to production -- Detailed computer and application inventory -- Powerful computer level search and drill-downs -- Guidance and insights into application and driver compatibility issues, with suggested fixes -- Data driven application rationalization tools -- Application usage information, allowing targeted validation; workflow to track validation progress and decisions -- Data export to commonly used software deployment tools, including System Center Configuration Manager - -The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. - -**Important** For system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see: - -- [Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization) -- [Manage connections from Windows operating system components to Microsoft services](/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services) -- [Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965) - -##**Related topics** - -[Upgrade Readiness architecture](upgrade-readiness-architecture.md)
                                -[Upgrade Readiness requirements](upgrade-readiness-requirements.md)
                                -[Upgrade Readiness release notes](upgrade-readiness-requirements.md#important-information-about-this-release)
                                -[Get started with Upgrade Readiness](upgrade-readiness-get-started.md)
                                -[Use Upgrade Readiness to manage Windows upgrades](use-upgrade-readiness-to-manage-windows-upgrades.md)
                                -[Troubleshoot Upgrade Readiness](troubleshoot-upgrade-readiness.md)
                                diff --git a/windows/deployment/upgrade/quick-fixes.md b/windows/deployment/upgrade/quick-fixes.md index d8b5c9b9e4..fa2817f19b 100644 --- a/windows/deployment/upgrade/quick-fixes.md +++ b/windows/deployment/upgrade/quick-fixes.md @@ -1,13 +1,16 @@ --- title: Quick fixes - Windows IT Pro -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Learn how to quickly resolve many problems which may come up during a Windows 10 upgrade. keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy +audience: itpro author: greg-lindsay -ms.date: 05/03/2018 ms.localizationpriority: medium ms.topic: article --- @@ -25,23 +28,24 @@ The following list of fixes can resolve many Windows upgrade problems. You shoul The Microsoft Virtual Agent provided by [Microsoft Support](https://support.microsoft.com/contactus/) can help you to analyze and correct some Windows upgrade errors. **To talk to a person about your issue**, start the Virtual Agent (click **Get started**) and enter "Talk to a person" two times. ->You might also wish to try a new tool available from Microsoft that helps to diagnose many Windows upgrade errors. For more information and to download this tool, see [SetupDiag](setupdiag.md). The topic is more advanced (300 level) because several advanced options are available for using the tool. However, you can now just download and then double-click the tool to run it. By default when you click Save, the tool is saved in your **Downloads** folder. Double-click the tool in the folder and wait until it finishes running (it might take a few minutes), then double-click the **SetupDiagResults.log** file and open it using Notepad to see the results of the analysis. +> [!TIP] +> You might also wish to try a new tool available from Microsoft that helps to diagnose many Windows upgrade errors. For more information and to download this tool, see [SetupDiag](setupdiag.md). The topic is more advanced (300 level) because several advanced options are available for using the tool. However, you can now just download and then double-click the tool to run it. By default when you click Save, the tool is saved in your **Downloads** folder. Double-click the tool in the folder and wait until it finishes running (it might take a few minutes), then double-click the **SetupDiagResults.log** file and open it using Notepad to see the results of the analysis. ## List of fixes
                                  -
                                1. Remove nonessential external hardware, such as docks and USB devices. [More information](#remove-external-hardware).
                                  2. -
                                2. Check the system drive for errors and attempt repairs. [More information](#repair-the-system-drive).
                                  3. -
                                3. Run the Windows Update troubleshooter. [More information](#windows-update-troubleshooter).
                                  4. -
                                4. Attempt to restore and repair system files. [More information](#repair-system-files).
                                  5. -
                                5. Update Windows so that all available recommended updates are installed, and ensure the computer is rebooted if this is necessary to complete installation of an update. [More information](#update-windows).
                                  6. +
                                6. Remove nonessential external hardware, such as docks and USB devices. More information.
                                  7. +
                                7. Check the system drive for errors and attempt repairs. More information.
                                  8. +
                                8. Run the Windows Update troubleshooter. More information.
                                  9. +
                                9. Attempt to restore and repair system files. More information.
                                  10. +
                                10. Update Windows so that all available recommended updates are installed, and ensure the computer is rebooted if this is necessary to complete installation of an update. More information.
                                11. Temporarily uninstall non-Microsoft antivirus software. - [More information](#uninstall-non-microsoft-antivirus-software).
                                  12. + More information. -
                                12. Uninstall all nonessential software. [More information](#uninstall-non-essential-software).
                                  13. -
                                13. Update firmware and drivers. [More information](#update-firmware-and-drivers)
                                  14. -
                                14. Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. [More information](#ensure-that-download-and-install-updates-is-selected).
                                  15. -
                                15. Verify at least 16 GB of free space is available to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. [More information](#verify-disk-space).
                                  16. +
                                16. Uninstall all nonessential software. More information.
                                  17. +
                                17. Update firmware and drivers. More information
                                  18. +
                                18. Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. More information.
                                  19. +
                                19. Verify at least 16 GB of free space is available to upgrade a 32-bit OS, or 20 GB for a 64-bit OS. More information.
                                ## Step by step instructions @@ -147,7 +151,8 @@ To check and repair system files: The operation completed successfully. ``` - >It may take several minutes for the command operations to be completed. For more information, see [Repair a Windows Image](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/repair-a-windows-image). + > [!NOTE] + > It may take several minutes for the command operations to be completed. For more information, see [Repair a Windows Image](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/repair-a-windows-image). ### Update Windows @@ -218,11 +223,12 @@ When you run Disk Cleanup and enable the option to Clean up system files, you ca ### Open an elevated command prompt ->It is no longer necessary to open an elevated command prompt to run the [SetupDiag](setupdiag.md) tool. However, this is still the optimal way to run the tool. +> [!TIP] +> It is no longer necessary to open an elevated command prompt to run the [SetupDiag](setupdiag.md) tool. However, this is still the optimal way to run the tool. To launch an elevated command prompt, press the Windows key on your keyboard, type **cmd**, press Ctrl+Shift+Enter, and then Alt+C to confirm the elevation prompt. Screenshots and other steps to open an administrator (aka elevated) command prompt are [here](https://answers.microsoft.com/en-us/windows/forum/windows_7-security/command-prompt-admin-windows-7/6a188166-5e23-461f-b468-f325688ec8c7). -Note: When you open an elevated command prompt, you will usually start in the **C:\WINDOWS\system32** directory. To run a program that you recently downloaded, you must change to the directory where the program is located. Alternatively, you can move or copy the program to a location on the computer that is automatically searched. These directories are listed in the [PATH variable](https://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings-winpc/adding-path-variable/97300613-20cb-4d85-8d0e-cc9d3549ba23). +Note: When you open an elevated command prompt, you will usually start in the **C:\WINDOWS\system32** directory. To run a program that you recently downloaded, you must change to the directory where the program is located. Alternatively, you can move or copy the program to a location on the computer that is automatically searched. These directories are listed in the [PATH variable](https://answers.microsoft.com/windows/forum/windows_10-other_settings-winpc/adding-path-variable/97300613-20cb-4d85-8d0e-cc9d3549ba23). If this is too complicated for you, then use File Explorer to create a new folder under C: with a short name such as "new" then copy or move the programs you want to run (like SetupDiag) to this folder using File Explorer. When you open an elevated command prompt, change to this directory by typing "cd c:\new" and now you can run the programs in that folder. @@ -232,6 +238,6 @@ If you downloaded the SetupDiag.exe program to your computer, then copied it to [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
                                [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                                [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +
                                [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications)
                                [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
                                [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) \ No newline at end of file +
                                [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/resolution-procedures.md b/windows/deployment/upgrade/resolution-procedures.md index 3b660307e8..41c49f7eb9 100644 --- a/windows/deployment/upgrade/resolution-procedures.md +++ b/windows/deployment/upgrade/resolution-procedures.md @@ -1,763 +1,788 @@ ---- -title: Resolution procedures - Windows IT Pro -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. -keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: greg-lindsay -ms.date: 03/30/2018 -ms.localizationpriority: medium -ms.topic: article ---- - -# Resolution procedures - -**Applies to** -- Windows 10 - ->[!NOTE] ->This is a 200 level topic (moderate).
                                ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - - -## 0xC1900101 - -A frequently observed result code is 0xC1900101. This result code can be thrown at any stage of the upgrade process, with the exception of the downlevel phase. 0xC1900101 is a generic rollback code, and usually indicates that an incompatible driver is present. The incompatible driver can cause blue screens, system hangs, and unexpected reboots. Analysis of supplemental log files is often helpful, such as:
                                - -- The minidump file: $Windows.~bt\Sources\Rollback\setupmem.dmp, -- Event logs: $Windows.~bt\Sources\Rollback\*.evtx -- The device install log: $Windows.~bt\Sources\Rollback\setupapi\setupapi.dev.log - -The device install log is particularly helpful if rollback occurs during the sysprep operation (extend code 0x30018). To resolve a rollback due to driver conflicts, try running setup using a minimal set of drivers and startup programs by performing a [clean boot](https://support.microsoft.com/kb/929135) before initiating the upgrade process. - -
                                See the following general troubleshooting procedures associated with a result code of 0xC1900101: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                - - -
                                Code -
                                0xC1900101 - 0x20004 -
                                - -
                                -
                                Cause -
                                Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation -
                                This is generally caused by out-of-date drivers. -
                                -                                		 - - -
                                Mitigation -
                                Uninstall antivirus applications. -
                                Remove all unused SATA devices. -
                                Remove all unused devices and drivers. -
                                Update drivers and BIOS. -
                                -
                                - - -
                                Code -
                                0xC1900101 - 0x2000c -
                                - -
                                -
                                Cause -
                                Windows Setup encountered an unspecified error during Wim apply in the WinPE phase. -
                                This is generally caused by out-of-date drivers. -
                                -                                		 - - -
                                Mitigation -
                                Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. -
                                Contact your hardware vendor to obtain updated device drivers. -
                                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. -
                                -
                                - - -
                                Code -
                                0xC1900101 - 0x20017 - -
                                - -
                                -
                                Cause -
                                A driver has caused an illegal operation. -
                                Windows was not able to migrate the driver, resulting in a rollback of the operating system. -
                                This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. -
                                -                                		 - - -
                                Mitigation -
                                -Ensure that all that drivers are updated.
                                -Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers. -
                                For more information, see [Understanding Failures and Log Files](https://technet.microsoft.com/library/ee851579.aspx). -
                                Update or uninstall the problem drivers. -
                                -
                                - - -
                                Code -
                                0xC1900101 - 0x30018 -
                                - -
                                -
                                Cause -
                                A device driver has stopped responding to setup.exe during the upgrade process. -
                                -                                		 - - -
                                Mitigation -
                                -Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. -
                                Contact your hardware vendor to obtain updated device drivers. -
                                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. -
                                -
                                - - -
                                Code -
                                0xC1900101 - 0x3000D -
                                - -
                                -
                                Cause -
                                Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation. -
                                This can occur due to a problem with a display driver. - -
                                -                                		 - - -
                                Mitigation -
                                -Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. -
                                Update or uninstall the display driver. -
                                -
                                - - -
                                Code -
                                0xC1900101 - 0x4000D -
                                - -
                                -
                                Cause -
                                A rollback occurred due to a driver configuration issue. -
                                Installation failed during the second boot phase while attempting the MIGRATE_DATA operation. - -
                                This can occur due to incompatible drivers. - -
                                -                                		 - - -
                                Mitigation -
                                -
                                Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors. -
                                Review the rollback log and determine the stop code. -
                                The rollback log is located in the **C:\$Windows.~BT\Sources\Panther** folder. An example analysis is shown below. This example is not representative of all cases: -
                                Info SP Crash 0x0000007E detected -
                                Info SP Module name : -
                                Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005 -
                                Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A -
                                Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728 -
                                Info SP Bugcheck parameter 4 : 0xFFFFD000E5D22F40 -
                                Info SP Cannot recover the system. -
                                Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows. - - -
                                Typically, there is a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
                                - -1. Make sure you have enough disk space.
                                -2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
                                -3. Try changing video adapters.
                                -4. Check with your hardware vendor for any BIOS updates.
                                -5. Disable BIOS memory options such as caching or shadowing. -

                                -
                                -
                                - - -
                                Code -
                                0xC1900101 - 0x40017 -
                                - -
                                -
                                Cause -
                                Windows 10 upgrade failed after the second reboot. -
                                This is usually caused by a faulty driver. For example: antivirus filter drivers or encryption drivers. -
                                -                                		 - - -
                                Mitigation -
                                Clean boot into Windows, and then attempt the upgrade to Windows 10.
                                - -For more information, see [How to perform a clean boot in Windows](https://support.microsoft.com/kb/929135). - -

                                Ensure you select the option to "Download and install updates (recommended)." -
                                -
                                - -

                                0x800xxxxx

                                - -
                                Result codes starting with the digits 0x800 are also important to understand. These error codes indicate general operating system errors, and are not unique to the Windows upgrade process. Examples include timeouts, devices not functioning, and a process stopping unexpectedly. - -
                                See the following general troubleshooting procedures associated with a result code of 0x800xxxxx:
                                - -
                                - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                - - -
                                Code -
                                - -80040005 - 0x20007 - -
                                - -
                                -
                                Cause -
                                - -An unspecified error occurred with a driver during the SafeOS phase. - -
                                -                                		 - - -
                                Mitigation -
                                - -This error has more than one possible cause. Attempt [quick fixes](quick-fixes.md), and if not successful, [analyze log files](log-files.md#analyze-log-files) in order to determine the problem and solution. - -
                                -
                                - - -
                                Code -
                                - -0x80073BC3 - 0x20009
                                -0x8007002 - 0x20009
                                -0x80073B92 - 0x20009 - -
                                - -
                                -
                                Cause -
                                - -The requested system device cannot be found, there is a sharing violation, or there are multiple devices matching the identification criteria. - -
                                -                                		 - - -
                                Mitigation -
                                - -These errors occur during partition analysis and validation, and can be caused by the presence of multiple system partitions. For example, if you installed a new system drive but left the previous system drive connected, this can cause a conflict. To resolve the errors, disconnect or temporarily disable drives that contain the unused system partition. You can reconnect the drive after the upgrade has completed. Alternatively, you can delete the unused system partition. - -
                                -
                                - - -
                                Code -
                                - -800704B8 - 0x3001A - -
                                - -
                                -
                                Cause -
                                - -An extended error has occurred during the first boot phase. - -
                                -                                		 - - -
                                Mitigation -
                                - -Disable or uninstall non-Microsoft antivirus applications, disconnect all unnecessary devices, and perform a [clean boot](https://support.microsoft.com/kb/929135). - -
                                -
                                - - -
                                Code -
                                - -8007042B - 0x4000D - -
                                - -
                                -
                                Cause -
                                - -The installation failed during the second boot phase while attempting the MIGRATE_DATA operation. -
                                This issue can occur due to file system, application, or driver issues. - -
                                -                                		 - - -
                                Mitigation -
                                - -[Analyze log files](log-files.md#analyze-log-files) in order to determine the file, application, or driver that is not able to be migrated. Disconnect, update, remove, or replace the device or object. - -
                                -
                                - - -
                                Code -
                                - -8007001F - 0x3000D - -
                                - -
                                -
                                Cause -
                                - -The installation failed in the FIRST_BOOT phase with an error during MIGRATE_DATA operation. - -
                                -                                		 - - -
                                Mitigation -
                                - -[Analyze log files](log-files.md#analyze-log-files) in order to determine the files or registry entries that are blocking data migration. - -This error can be due to a problem with user profiles. It can occur due to corrupt registry entries under **HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList** or invalid files in the **\\Users** directory. - -Note: If a previous upgrade did not complete, invalid profiles might exist in the **Windows.old\\Users** directory. - -To repair this error, ensure that deleted accounts are not still present in the Windows registry and that files under the \\Users directory are valid. Delete the invalid files or user profiles that are causing this error. The specific files and profiles that are causing the error will be recorded in the Windows setup log files. - -
                                -
                                - - -
                                Code -
                                - -8007001F - 0x4000D - -
                                - -
                                -
                                Cause -
                                - -General failure, a device attached to the system is not functioning. - -
                                -                                		 - - -
                                Mitigation -
                                - -[Analyze log files](log-files.md#analyze-log-files) in order to determine the device that is not functioning properly. Disconnect, update, or replace the device. - -
                                -
                                - - -
                                Code -
                                - -8007042B - 0x4001E - -
                                - -
                                -
                                Cause -
                                - -The installation failed during the second boot phase while attempting the PRE_OOBE operation. - -
                                -                                		 - - -
                                Mitigation -
                                - -This error has more than one possible cause. Attempt [quick fixes](quick-fixes.md), and if not successful, [analyze log files](log-files.md#analyze-log-files) in order to determine the problem and solution. - -
                                -
                                - - -## Other result codes - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Error code -Cause -Mitigation -
                                0xC1800118WSUS has downloaded content that it cannot use due to a missing decryption key.See [Steps to resolve error 0xC1800118](https://blogs.technet.microsoft.com/wsus/2016/09/21/resolving-error-0xc1800118/) for information.
                                0xC1900200Setup.exe has detected that the machine does not meet the minimum system requirements.Ensure the system you are trying to upgrade meets the minimum system requirements.
                                See [Windows 10 specifications](https://www.microsoft.com/en-us/windows/windows-10-specifications) for information.
                                0x80090011A device driver error occurred during user data migration.Contact your hardware vendor and get all the device drivers updated. It is recommended to have an active internet connection during upgrade process. -
                                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
                                0xC7700112Failure to complete writing data to the system drive, possibly due to write access failure on the hard disk.This issue is resolved in the latest version of Upgrade Assistant. -
                                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
                                0x80190001An unexpected error was encountered while attempting to download files required for upgrade.To resolve this issue, download and run the media creation tool. See [Download windows 10](https://www.microsoft.com/en-us/software-download/windows10). -
                                0x80246007The update was not downloaded successfully.Attempt other methods of upgrading the operating system.
                                -Download and run the media creation tool. See [Download windows 10](https://www.microsoft.com/en-us/software-download/windows10). -
                                Attempt to upgrade using .ISO or USB.
                                -**Note**: Windows 10 Enterprise isn’t available in the media creation tool. For more information, go to the [Volume Licensing Service Center](https://www.microsoft.com/licensing/servicecenter/default.aspx). -
                                0xC1900201The system did not pass the minimum requirements to install the update.Contact the hardware vendor to get the latest updates.
                                0x80240017The upgrade is unavailable for this edition of Windows.Administrative policies enforced by your organization might be preventing the upgrade. Contact your IT administrator.
                                0x80070020The existing process cannot access the file because it is being used by another process.Use the MSCONFIG tool to perform a clean boot on the machine and then try to perform the update again. For more information, see [How to perform a clean boot in Windows](https://support.microsoft.com/kb/929135).
                                0x80070522The user doesn’t have required privilege or credentials to upgrade.Ensure that you have signed in as a local administrator or have local administrator privileges.
                                0xC1900107A cleanup operation from a previous installation attempt is still pending and a system reboot is required in order to continue the upgrade. -Reboot the device and run setup again. If restarting device does not resolve the issue, then use the Disk Cleanup utility and cleanup the temporary as well as the System files. For more information, see [Disk cleanup in Windows 10](https://support.microsoft.com/instantanswers/8fef4121-711b-4be1-996f-99e02c7301c2/disk-cleanup-in-windows-10).
                                0xC1900209The user has chosen to cancel because the system does not pass the compatibility scan to install the update. Setup.exe will report this error when it can upgrade the machine with user data but cannot migrate installed applications.Incompatible software is blocking the upgrade process. Uninstall the application and try the upgrade again. See [Windows 10 Pre-Upgrade Validation using SETUP.EXE](https://blogs.technet.microsoft.com/mniehaus/2015/08/23/windows-10-pre-upgrade-validation-using-setup-exe/) for more information. - -
                                You can also download the [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=526740) and install Application Compatibility Tools. -
                                0x8007002 This error is specific to upgrades using System Center Configuration Manager 2012 R2 SP1 CU3 (5.00.8238.1403)Analyze the SMSTS.log and verify that the upgrade is failing on "Apply Operating system" Phase: Error 80072efe DownloadFileWithRanges() failed. 80072efe. ApplyOperatingSystem (0x0760) - -
                                The error 80072efe means that the connection with the server was terminated abnormally. - -
                                To resolve this issue, try the OS Deployment test on a client in same VLAN as the Configuration Manager server. Check the network configuration for random client-server connection issues happening on the remote VLAN. -
                                0x80240FFF Occurs when update synchronization fails. It can occur when you are using Windows Server Update Services on its own or when it is integrated with System Center Configuration Manager. If you enable update synchronization before you install hotfix 3095113, WSUS doesn't recognize the Upgrades classification and instead treats the upgrade like a regular update. You can prevent this by installing hotfix 3095113 before you enable update synchronization. However, if you have already run into this problem, do the following: - -
                                  -
                                1. Disable the Upgrades classification.
                                  2. -
                                2. Install hotfix 3095113.
                                  3. -
                                3. Delete previously synched updates.
                                  4. -
                                4. Enable the Upgrades classification.
                                  5. -
                                5. Perform a full synch.
                                  6. -
                                -
                                For detailed information on how to run these steps check out How to delete upgrades in WSUS.

                                -
                                0x8007007EOccurs when update synchronization fails because you do not have hotfix 3095113 installed before you enable update synchronization. Specifically, the CopyToCache operation fails on clients that have already downloaded the upgrade because Windows Server Update Services has bad metadata related to the upgrade. It can occur when you are using standalone Windows Server Update Services or when WSUS is integrated with System Center Configuration Manager. Use the following steps to repair Windows Server Update Services. You must run these steps on each WSUS server that synched metadata before you installed the hotfix. - -
                                  -
                                1. Stop the Windows Update service. Sign in as a user with administrative privileges, and then do the following: -
                                    -
                                  1. Open Administrative Tools from the Control Panel.
                                    2. -
                                  2. Double-click Services.
                                    3. -
                                  3. Find the Windows Update service, right-click it, and then click Stop. If prompted, enter your credentials.
                                    4. -
                                  -
                                  2. -
                                2. Delete all files and folders under c:\Windows\SoftwareDistribution\DataStore.
                                  3. -
                                3. Restart the Windows Update service.
                                  4. -
                                -
                                - -## Other error codes - - - - - - - - - - - - - - - -
                                Error CodesCauseMitigation
                                0x80070003- 0x20007 -This is a failure during SafeOS phase driver installation. - -[Verify device drivers](https://msdn.microsoft.com/windows/hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](log-files.md#analyze-log-files) to determine the problem driver. -
                                0x8007025D - 0x2000C -This error occurs if the ISO file's metadata is corrupt."Re-download the ISO/Media and re-attempt the upgrade. - -Alternatively, re-create installation media the [Media Creation Tool](https://www.microsoft.com/en-us/software-download/windows10). - -
                                0x80070490 - 0x20007An incompatible device driver is present. - -[Verify device drivers](https://msdn.microsoft.com/windows/hardware/drivers/install/troubleshooting-device-and-driver-installations) on the computer, and [analyze log files](log-files.md#analyze-log-files) to determine the problem driver. - -
                                0xC1900101 - 0x2000c -An unspecified error occurred in the SafeOS phase during WIM apply. This can be caused by an outdated driver or disk corruption. -Run checkdisk to repair the file system. For more information, see the [quick fixes](quick-fixes.md) section in this guide. -
                                Update drivers on the computer, and select "Download and install updates (recommended)" during the upgrade process. Disconnect devices other than the mouse, keyboard and display.
                                0xC1900200 - 0x20008 - -The computer doesn’t meet the minimum requirements to download or upgrade to Windows 10. - -See [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/windows-10-specifications) and verify the computer meets minimum requirements. - -
                                Review logs for [compatibility information](https://blogs.technet.microsoft.com/askcore/2016/01/21/using-the-windows-10-compatibility-reports-to-understand-upgrade-issues/).
                                0x80070004 - 0x3000D -This is a problem with data migration during the first boot phase. There are multiple possible causes. - -[Analyze log files](log-files.md#analyze-log-files) to determine the issue.
                                0xC1900101 - 0x4001E -Installation failed in the SECOND_BOOT phase with an error during PRE_OOBE operation. -This is a generic error that occurs during the OOBE phase of setup. See the [0xC1900101](#0xc1900101) section of this guide and review general troubleshooting procedures described in that section.
                                0x80070005 - 0x4000D -The installation failed in the SECOND_BOOT phase with an error in during MIGRATE_DATA operation. This error indicates that access was denied while attempting to migrate data. -[Analyze log files](log-files.md#analyze-log-files) to determine the data point that is reporting access denied.
                                0x80070004 - 0x50012 -Windows Setup failed to open a file. -[Analyze log files](log-files.md#analyze-log-files) to determine the data point that is reporting access problems.
                                0xC190020e -
                                0x80070070 - 0x50011 -
                                0x80070070 - 0x50012 -
                                0x80070070 - 0x60000 -                                		These errors indicate the computer does not have enough free space available to install the upgrade. -To upgrade a computer to Windows 10, it requires 16 GB of free hard drive space for a 32-bit OS, and 20 GB for a 64-bit OS. If there is not enough space, attempt to [free up drive space](https://support.microsoft.com/help/17421/windows-free-up-drive-space) before proceeding with the upgrade. - -
                                Note: If your device allows it, you can use an external USB drive for the upgrade process. Windows setup will back up the previous version of Windows to a USB external drive. The external drive must be at least 8GB (16GB is recommended). The external drive should be formatted using NTFS. Drives that are formatted in FAT32 may run into errors due to FAT32 file size limitations. USB drives are preferred over SD cards because drivers for SD cards are not migrated if the device does not support Connected Standby. -
                                - -## Modern setup errors - -Also see the following sequential list of modern setup (mosetup) error codes with a brief description of the cause. - -| Result code | Message | Description | -| --- | --- | --- | -| 0XC1900100 | MOSETUP_E_VERSION_MISMATCH | An unexpected version of Setup Platform binaries was encountered. Please verify the package contents. | -| 0XC1900101 | MOSETUP_E_SETUP_PLATFORM | The Setup Platform has encountered an unspecified error. | -| 0XC1900102 | MOSETUP_E_SHUTDOWN_BLOCK | Unable to create or destroy the shutdown block message. | -| 0XC1900103 | MOSETUP_E_COMPAT_TIMEOUT | The compatibility issues were not resolved within the required time limit. | -| 0XC1900104 | MOSETUP_E_PROCESS_TIMEOUT | The installation process did not complete within the required time limit. | -| 0XC1900105 | MOSETUP_E_TEST_MODE | The installation process is being used in a test environment. | -| 0XC1900106 | MOSETUP_E_TERMINATE_PROCESS | The installation process was terminated. | -| 0XC1900107 | MOSETUP_E_CLEANUP_PENDING | A cleanup operation from a previous installation attempt is still pending. A system reboot is required. | -| 0XC1900108 | MOSETUP_E_REPORTING | An error has occured and the result value must be consolidated for telemetry purposes. | -| 0XC1900109 | MOSETUP_E_COMPAT_TERMINATE | The installation process was terminated during the actionable compatibility phase. | -| 0XC190010a | MOSETUP_E_UNKNOWN_CMD_LINE | The installation process was launched with an unknown command line argument. | -| 0XC190010b | MOSETUP_E_INSTALL_IMAGE_NOT_FOUND | The installation image was not found. | -| 0XC190010c | MOSETUP_E_AUTOMATION_INVALID | The provided automation information was invalid. | -| 0XC190010d | MOSETUP_E_INVALID_CMD_LINE | The installation process was launched with an invalid command line argument. | -| 0XC190010e | MOSETUP_E_EULA_ACCEPT_REQUIRED | The installation process requires that the user accept the license agreement. | -| 0XC1900110 | MOSETUP_E_EULA_CANCEL | The user has chosen to cancel for license agreement. | -| 0XC1900111 | MOSETUP_E_ADVERTISE_CANCEL | The user has chosen to cancel for advertisement. | -| 0XC1900112 | MOSETUP_E_TARGET_DRIVE_NOT_FOUND | Could not find a target drive letter. | -| 0XC1900113 | MOSETUP_E_EULA_DECLINED | The user has declined the license terms. | -| 0XC190011e | MOSETUP_E_FLIGHTING_BVT | The installation process has been halted for testing purposes. | -| 0XC190011f | MOSETUP_E_PROCESS_CRASHED | The installation process crashed. | -| 0XC1900120 | MOSETUP_E_EULA_TIMEOUT | The user has not accepted Eula within the required time limit. | -| 0XC1900121 | MOSETUP_E_ADVERTISE_TIMEOUT | The user has not accepted Advertisement within the required time limit. | -| 0XC1900122 | MOSETUP_E_DOWNLOADDISKSPACE_TIMEOUT | The download diskspace issues were not resolved within the required time limit. | -| 0XC1900123 | MOSETUP_E_INSTALLDISKSPACE_TIMEOUT | The install diskspace issues were not resolved within the required time limit. | -| 0XC1900124 | MOSETUP_E_COMPAT_SYSREQ_TIMEOUT | The minimum requirements compatibility issues were not resolved within the required time limit. | -| 0XC1900125 | MOSETUP_E_COMPAT_DOWNLOADREQ_TIMEOUT | The compatibility issues for download were not resolved within the required time limit. | -| 0XC1900126 | MOSETUP_E_GATHER_OS_STATE_SIGNATURE | The GatherOsState executable has invalid signature. | -| 0XC1900127 | MOSETUP_E_UNINSTALL_ALLOWED_ABORT | The user has chosen to abort Setup to keep Uninstall option active. | -| 0XC1900128 | MOSETUP_E_MISSING_TASK | The install cannot continue because a required task is missing. | -| 0XC1900129 | MOSETUP_E_UPDATEMEDIA_REQUESTED | A more up-to-date version of setup will be launched to continue installation -| 0XC190012f | MOSETUP_E_FINALIZE_ALREADY_REQUESTED | The install cannot continue because a finalize operation was already requested. | -| 0XC1900130 | MOSETUP_E_INSTALL_HASH_MISSING | The install cannot continue because the instance hash was not found. | -| 0XC1900131 | MOSETUP_E_INSTALL_HASH_MISMATCH | The install cannot continue because the instance hash does not match. | -| 0XC19001df | MOSETUP_E_DISK_FULL | The install cannot continue because the system is out of disk space. | -| 0XC19001e0 | MOSETUP_E_GATHER_OS_STATE_FAILED | The GatherOsState executable has failed to execute. | -| 0XC19001e1 | MOSETUP_E_PROCESS_SUSPENDED | The installation process was suspended. | -| 0XC19001e2 | MOSETUP_E_PREINSTALL_SCRIPT_FAILED | A preinstall script failed to execute or returned an error. | -| 0XC19001e3 | MOSETUP_E_PRECOMMIT_SCRIPT_FAILED | A precommit script failed to execute or returned an error. | -| 0XC19001e4 | MOSETUP_E_FAILURE_SCRIPT_FAILED | A failure script failed to execute or returned an error. | -| 0XC19001e5 | MOSETUP_E_SCRIPT_TIMEOUT | A script exceeded the timeout limit. | -| 0XC1900200 | MOSETUP_E_COMPAT_SYSREQ_BLOCK | The system does not pass the minimum requirements to install the update. | -| 0XC1900201 | MOSETUP_E_COMPAT_SYSREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to install the update. | -| 0XC1900202 | MOSETUP_E_COMPAT_DOWNLOADREQ_BLOCK | The system does not pass the minimum requirements to download the update. | -| 0XC1900203 | MOSETUP_E_COMPAT_DOWNLOADREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to download the update. | -| 0XC1900204 | MOSETUP_E_COMPAT_MIGCHOICE_BLOCK | The system does not pass the requirements for desired migration choice. | -| 0XC1900205 | MOSETUP_E_COMPAT_MIGCHOICE_CANCEL | The user has chosen to cancel because the system does not pass the requirements for desired migration choice. | -| 0XC1900206 | MOSETUP_E_COMPAT_DEVICEREQ_BLOCK | The system does not pass the device scan to install the update. | -| 0XC1900207 | MOSETUP_E_COMPAT_DEVICEREQ_CANCEL | The user has chosen to cancel because the system does not pass the device scan to install the update. | -| 0XC1900208 | MOSETUP_E_COMPAT_INSTALLREQ_BLOCK | The system does not pass the compat scan to install the update. | -| 0XC1900209 | MOSETUP_E_COMPAT_INSTALLREQ_CANCEL | The user has chosen to cancel because the system does not pass the compat scan to install the update. | -| 0XC190020a | MOSETUP_E_COMPAT_RECOVERYREQ_BLOCK | The system does not pass the minimum requirements to recover Windows. | -| 0XC190020b | MOSETUP_E_COMPAT_RECOVERYREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to recover Windows. | -| 0XC190020c | MOSETUP_E_DOWNLOADDISKSPACE_BLOCK | The system does not pass the diskspace requirements to download the payload. | -| 0XC190020d | MOSETUP_E_DOWNLOADDISKSPACE_CANCEL | The user has chosen to cancel as the device does not have enough disk space to download. | -| 0XC190020e | MOSETUP_E_INSTALLDISKSPACE_BLOCK | The system does not pass the diskspace requirements to install the payload. | -| 0XC190020f | MOSETUP_E_INSTALLDISKSPACE_CANCEL | The user has chosen to cancel as the device does not have enough disk space to install. | -| 0XC1900210 | MOSETUP_E_COMPAT_SCANONLY | The user has used the setup.exe command line to do scanonly, not to install the OS. | -| 0XC1900211 | MOSETUP_E_DOWNLOAD_UNPACK_DISKSPACE_BLOCK | The system does not pass the disk space requirements to download and unpack media. | -| 0XC1900212 | MOSETUP_E_DOWNLOAD_UNPACK_DISKSPACE_MULTIARCH_BLOCK | The system does not pass the disk space requirements to download and unpack multi-architecture media. | -| 0XC1900213 | MOSETUP_E_NO_OFFER_FOUND | There was no offer found that matches the required criteria. | -| 0XC1900214 | MOSETUP_E_UNSUPPORTED_VERSION | This version of the tool is not supported. | -| 0XC1900215 | MOSETUP_E_NO_MATCHING_INSTALL_IMAGE | Could not find an install image for this system. | -| 0XC1900216 | MOSETUP_E_ROLLBACK_PENDING | Found pending OS rollback operation. | -| 0XC1900220 | MOSETUP_E_COMPAT_REPORT_NOT_DISPLAYED | The compatibility report cannot be displayed due to a missing system component. | -| 0XC1900400 | MOSETUP_E_UA_VERSION_MISMATCH | An unexpected version of Update Agent client was encountered. | -| 0XC1900401 | MOSETUP_E_UA_NO_PACKAGES_TO_DOWNLOAD | No packages to be downloaded. | -| 0XC1900402 | MOSETUP_E_UA_UPDATE_CANNOT_BE_MERGED | No packages to be downloaded. | -| 0XC1900403 | MOSETUP_E_UA_CORRUPT_PAYLOAD_FILES | Payload files were corrupt. | -| 0XC1900404 | MOSETUP_E_UA_BOX_NOT_FOUND | The installation executable was not found. | -| 0XC1900405 | MOSETUP_E_UA_BOX_CRASHED | The installation process terminated unexpectedly. | - -## Related topics - -[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) -
                                [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                                [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) -
                                [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
                                [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +--- +title: Resolution procedures - Windows IT Pro +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Discover general troubleshooting procedures for dealing with 0xC1900101, the generic rollback code thrown when something goes wrong during a Windows 10 upgrade. +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Resolution procedures + +**Applies to** +- Windows 10 + +> [!NOTE] +> This is a 200 level topic (moderate). +> See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. + +## 0xC1900101 + +A frequently observed result code is 0xC1900101. This result code can be thrown at any stage of the upgrade process, with the exception of the downlevel phase. 0xC1900101 is a generic rollback code, and usually indicates that an incompatible driver is present. The incompatible driver can cause blue screens, system hangs, and unexpected reboots. Analysis of supplemental log files is often helpful, such as: + +- The minidump file: $Windows.~bt\Sources\Rollback\setupmem.dmp, +- Event logs: $Windows.~bt\Sources\Rollback\*.evtx +- The device install log: $Windows.~bt\Sources\Rollback\setupapi\setupapi.dev.log + +The device install log is particularly helpful if rollback occurs during the sysprep operation (extend code 0x30018). + +To resolve a rollback that was caused by driver conflicts, try running setup using a minimal set of drivers and startup programs by performing a [clean boot](https://support.microsoft.com/kb/929135) before initiating the upgrade process. + +See the following general troubleshooting procedures associated with a result code of 0xC1900101:

                                + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                + + +
                                Code +
                                0xC1900101 - 0x20004 +
                                + + +
                                Cause +
                                Windows Setup encountered an error during the SAFE_OS with the INSTALL_RECOVERY_ENVIRONMENT operation. +
                                This is generally caused by out-of-date drivers. +
                                +                                		 + + +
                                Mitigation +
                                Uninstall antivirus applications. +
                                Remove all unused SATA devices. +
                                Remove all unused devices and drivers. +
                                Update drivers and BIOS. +
                                +
                                + + +
                                Code +
                                0xC1900101 - 0x2000c +
                                + + +
                                Cause +
                                Windows Setup encountered an unspecified error during Wim apply in the WinPE phase. +
                                This is generally caused by out-of-date drivers. +
                                +                                		 + + +
                                Mitigation +
                                Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. +
                                Contact your hardware vendor to obtain updated device drivers. +
                                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. +
                                +
                                + + +
                                Code +
                                0xC1900101 - 0x20017 + +
                                + + +
                                Cause +
                                A driver has caused an illegal operation. +
                                Windows was not able to migrate the driver, resulting in a rollback of the operating system. +
                                This is a SafeOS boot failure, typically caused by drivers or non-Microsoft disk encryption software. +
                                +                                		 + + +
                                Mitigation +
                                +Ensure that all that drivers are updated. +
                                Open the Setuperr.log and Setupact.log files in the %windir%\Panther directory, and then locate the problem drivers. +
                                For more information, see Windows Vista, Windows 7, Windows Server 2008 R2, Windows 8.1, and Windows 10 setup log file locations. +
                                Update or uninstall the problem drivers. +
                                +
                                + + +
                                Code +
                                0xC1900101 - 0x30018 +
                                + + +
                                Cause +
                                A device driver has stopped responding to setup.exe during the upgrade process. +
                                +                                		 + + +
                                Mitigation +
                                +Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. +
                                Contact your hardware vendor to obtain updated device drivers. +
                                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. +
                                +
                                + + +
                                Code +
                                0xC1900101 - 0x3000D +
                                + + +
                                Cause +
                                Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation. +
                                This can occur due to a problem with a display driver. + +
                                +                                		 + + +
                                Mitigation +
                                +Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display. +
                                Update or uninstall the display driver. +
                                +
                                + + +
                                Code +
                                0xC1900101 - 0x4000D +
                                + + +
                                Cause +
                                A rollback occurred due to a driver configuration issue. +
                                Installation failed during the second boot phase while attempting the MIGRATE_DATA operation. +
                                This can occur because of incompatible drivers. + +
                                +                                		 + + +
                                Mitigation +
                                +Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors. +
                                Review the rollback log and determine the stop code. +
                                The rollback log is located in the $Windows.~BT\Sources\Rollback folder. An example analysis is shown below. This example is not representative of all cases: +
                                +Info SP     Crash 0x0000007E detected
+Info SP       Module name           :
+Info SP       Bugcheck parameter 1  : 0xFFFFFFFFC0000005
+Info SP       Bugcheck parameter 2  : 0xFFFFF8015BC0036A
+Info SP       Bugcheck parameter 3  : 0xFFFFD000E5D23728
+Info SP       Bugcheck parameter 4  : 0xFFFFD000E5D22F40
+Info SP     Cannot recover the system.
+Info SP     Rollback: Showing splash window with restoring text: Restoring your previous version of Windows.
                                + +Typically, there is a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
                                + +1. Make sure you have enough disk space.
                                +2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
                                +3. Try changing video adapters.
                                +4. Check with your hardware vendor for any BIOS updates.
                                +5. Disable BIOS memory options such as caching or shadowing. + +
                                +
                                + + +
                                Code +
                                0xC1900101 - 0x40017 +
                                + + +
                                Cause +
                                Windows 10 upgrade failed after the second reboot. +
                                This is usually caused by a faulty driver. For example: antivirus filter drivers or encryption drivers. +
                                +                                		 + + +
                                +Mitigation +
                                + +Clean boot into Windows, and then attempt the upgrade to Windows 10. For more information, see [How to perform a clean boot in Windows](https://support.microsoft.com/kb/929135). + +Ensure that you select the option to "Download and install updates (recommended)." + +Computers that run Citrix VDA +You may see this message after you upgrade a computer from Windows 10, version 1511 to Windows 10, version 1607. After the second system restart, the system generates this error and then rolls back to the previous version. This problem has also been observed in upgrades to Windows 8.1 and Windows 8. + +This problem occurs because the computer has Citrix Virtual Delivery Agent (VDA) installed. Citrix VDA installs device drivers and a file system filter driver (CtxMcsWbc). This Citrix filter driver prevents the upgrade from writing changes to the disk, so the upgrade cannot complete and the system rolls back. + +**Resolution** + +To resolve this problem, install [Cumulative update for Windows 10 Version 1607 and Windows Server 2016: November 8, 2016](https://support.microsoft.com/help/3200970/cumulative-update-for-windows-10-version-1607-and-windows-server-2016). + +You can work around this problem in two ways + +**Workaround 1** + +1. Use the VDA setup application (VDAWorkstationSetup_7.11) to uninstall Citrix VDA. +1. Run the Windows upgrade again. +1. Reinstall Citrix VDA. + +**Workaround 2** + +If you cannot uninstall Citrix VDA, follow these steps to work around this problem: + +1. In Registry Editor, go to the following subkey: + ``` + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\CtxMcsWbc + ``` +1. Change the value of the **Start** entry from **0** to **4**. This change disables the Citrix MCS cache service. +1. Go to the following subkey: + ``` + HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} + ``` +1. Delete the **CtxMcsWbc** entry. +1. Restart the computer, and then try the upgrade again. + +> **Third-party information disclaimer** +> The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products. + +
                                +
                                + +## 0x800xxxxx + +Result codes that start with the digits 0x800 are also important to understand. These error codes indicate general operating system errors, and are not unique to the Windows upgrade process. Examples include timeouts, devices not functioning, and a process stopping unexpectedly. + +See the following general troubleshooting procedures associated with a result code of 0x800xxxxx: + +
                                + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                + + +
                                Code +
                                +80040005 - 0x20007 + +
                                + + +
                                Cause +
                                +An unspecified error occurred with a driver during the SafeOS phase. + +
                                +                                		 + + +
                                Mitigation +
                                + +This error has more than one possible cause. Attempt [quick fixes](quick-fixes.md), and if not successful, [analyze log files](log-files.md#analyze-log-files) in order to determine the problem and solution. + +
                                +
                                + + +
                                Code +
                                +0x80073BC3 - 0x20009
                                +0x80070002 - 0x20009
                                +0x80073B92 - 0x20009 + +
                                + + +
                                Cause +
                                +The requested system device cannot be found, there is a sharing violation, or there are multiple devices matching the identification criteria. + +
                                +                                		 + + +
                                Mitigation +
                                + +These errors occur during partition analysis and validation, and can be caused by the presence of multiple system partitions. For example, if you installed a new system drive but left the previous system drive connected, this can cause a conflict. To resolve the errors, disconnect or temporarily disable drives that contain the unused system partition. You can reconnect the drive after the upgrade has completed. Alternatively, you can delete the unused system partition. + +
                                +
                                + + +
                                Code +
                                +800704B8 - 0x3001A + +
                                + + +
                                Cause +
                                +An extended error has occurred during the first boot phase. + +
                                +                                		 + + +
                                Mitigation +
                                + +Disable or uninstall non-Microsoft antivirus applications, disconnect all unnecessary devices, and perform a [clean boot](https://support.microsoft.com/kb/929135). + +
                                +
                                + + +
                                Code +
                                +8007042B - 0x4000D + +
                                + + +
                                Cause +
                                +The installation failed during the second boot phase while attempting the MIGRATE_DATA operation. +
                                This issue can occur due to file system, application, or driver issues. + +
                                +                                		 + + +
                                Mitigation +
                                + +[Analyze log files](log-files.md#analyze-log-files) in order to determine the file, application, or driver that is not able to be migrated. Disconnect, update, remove, or replace the device or object. + +
                                +
                                + + +
                                Code +
                                +8007001F - 0x3000D + +
                                + + +
                                Cause +
                                +The installation failed in the FIRST_BOOT phase with an error during MIGRATE_DATA operation. + +
                                +                                		 + + +
                                Mitigation +
                                + +[Analyze log files](log-files.md#analyze-log-files) in order to determine the files or registry entries that are blocking data migration. + +This error can be due to a problem with user profiles. It can occur due to corrupt registry entries under **HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList** or invalid files in the **\\Users** directory. + +> [!NOTE] +> If a previous upgrade did not complete, invalid profiles might exist in the **Windows.old\\Users** directory. + +To repair this error, ensure that deleted accounts are not still present in the Windows registry and that files under the \\Users directory are valid. Delete the invalid files or user profiles that are causing this error. The specific files and profiles that are causing the error will be recorded in the Windows setup log files. + +
                                +
                                + + +
                                Code +
                                +8007001F - 0x4000D + +
                                + + +
                                Cause +
                                +General failure, a device attached to the system is not functioning. + +
                                +                                		 + + +
                                Mitigation +
                                + +[Analyze log files](log-files.md#analyze-log-files) in order to determine the device that is not functioning properly. Disconnect, update, or replace the device. + +
                                +
                                + + +
                                Code +
                                +8007042B - 0x4001E + +
                                + + +
                                Cause +
                                +The installation failed during the second boot phase while attempting the PRE_OOBE operation. + +
                                +                                		 + + +
                                Mitigation +
                                + +This error has more than one possible cause. Attempt [quick fixes](quick-fixes.md), and if not successful, [analyze log files](log-files.md#analyze-log-files) in order to determine the problem and solution. + +
                                +
                                + + +## Other result codes + +
                                + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Error codeCauseMitigation
                                0xC1800118WSUS has downloaded content that it cannot use due to a missing decryption key.See Steps to resolve error 0xC1800118 for information.
                                0xC1900200Setup.exe has detected that the machine does not meet the minimum system requirements.Ensure the system you are trying to upgrade meets the minimum system requirements.
                                See Windows 10 specifications for information.
                                0x80090011A device driver error occurred during user data migration.Contact your hardware vendor and get all the device drivers updated. It is recommended to have an active internet connection during upgrade process. +
                                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
                                0xC7700112Failure to complete writing data to the system drive, possibly due to write access failure on the hard disk.This issue is resolved in the latest version of Upgrade Assistant. +
                                Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process.
                                0x80190001An unexpected error was encountered while attempting to download files required for upgrade.To resolve this issue, download and run the media creation tool. See Download windows 10. +
                                0x80246007The update was not downloaded successfully.Attempt other methods of upgrading the operating system.
                                +Download and run the media creation tool. See Download windows 10. +
                                Attempt to upgrade using .ISO or USB.
                                +Note
                                Windows 10 Enterprise isn’t available in the media creation tool. For more information, go to the Volume Licensing Service Center. +
                                0x80244018Your machine is connected through a proxy server.Make sure Automatically Detect Settings is selected in internet options. (Control Panel > Internet Options > Connections > LAN Settings). +
                                0xC1900201The system did not pass the minimum requirements to install the update.Contact the hardware vendor to get the latest updates.
                                0x80240017The upgrade is unavailable for this edition of Windows.Administrative policies enforced by your organization might be preventing the upgrade. Contact your IT administrator.
                                0x80070020The existing process cannot access the file because it is being used by another process.Use the MSCONFIG tool to perform a clean boot on the machine and then try to perform the update again. For more information, see How to perform a clean boot in Windows.
                                0x80070522The user doesn’t have required privilege or credentials to upgrade.Ensure that you have signed in as a local administrator or have local administrator privileges.
                                0xC1900107A cleanup operation from a previous installation attempt is still pending and a system reboot is required in order to continue the upgrade. +Restart the device and run setup again. If restarting the device does not resolve the issue, then use the Disk Cleanup utility and clean up the temporary files as well as the System files. For more information, see Disk cleanup in Windows 10.
                                0xC1900209The user has chosen to cancel because the system does not pass the compatibility scan to install the update. Setup.exe will report this error when it can upgrade the machine with user data but cannot migrate installed applications.Incompatible software is blocking the upgrade process. Uninstall the application and try the upgrade again. See Windows 10 Pre-Upgrade Validation using SETUP.EXE for more information. +
                                You can also download the Windows Assessment and Deployment Kit (ADK) for Windows 10 and install Application Compatibility Tools. +
                                0x8007002 This error is specific to upgrades using System Center 2012 Configuration Manager R2 SP1 CU3 (5.00.8238.1403)Analyze the SMSTS.log and verify that the upgrade is failing on "Apply Operating system" Phase: Error 80072efe DownloadFileWithRanges() failed. 80072efe. ApplyOperatingSystem (0x0760) +
                                The error 80072efe means that the connection with the server was terminated abnormally. +
                                To resolve this issue, try the OS Deployment test on a client in same VLAN as the Configuration Manager server. Check the network configuration for random client-server connection issues happening on the remote VLAN. +
                                0x80240FFF Occurs when update synchronization fails. It can occur when you are using Windows Server Update Services on its own or when it is integrated with Microsoft Endpoint Configuration Manager. If you enable update synchronization before you install hotfix 3095113, WSUS doesn't recognize the Upgrades classification and instead treats the upgrade like a regular update. You can prevent this by installing hotfix 3095113 before you enable update synchronization. However, if you have already run into this problem, do the following: +
                                  +
                                1. Disable the Upgrades classification.
                                  2. +
                                2. Install hotfix 3095113.
                                  3. +
                                3. Delete previously synched updates.
                                  4. +
                                4. Enable the Upgrades classification.
                                  5. +
                                5. Perform a full synch.
                                  6. +
                                +For detailed information on how to run these steps check out How to delete upgrades in WSUS.

                                +
                                0x8007007EOccurs when update synchronization fails because you do not have hotfix 3095113 installed before you enable update synchronization. Specifically, the CopyToCache operation fails on clients that have already downloaded the upgrade because Windows Server Update Services has bad metadata related to the upgrade. It can occur when you are using standalone Windows Server Update Services or when WSUS is integrated with Microsoft Endpoint Configuration Manager. Use the following steps to repair Windows Server Update Services. You must run these steps on each WSUS server that synched metadata before you installed the hotfix. +
                                  +
                                1. Stop the Windows Update service. Sign in as a user with administrative privileges, and then do the following: +
                                    +
                                  1. Open Administrative Tools from the Control Panel.
                                    2. +
                                  2. Double-click Services.
                                    3. +
                                  3. Find the Windows Update service, right-click it, and then select Stop. If prompted, enter your credentials.
                                    4. +
                                  +
                                  2. +
                                2. Delete all files and folders under c:\Windows\SoftwareDistribution\DataStore.
                                  3. +
                                3. Restart the Windows Update service.
                                  4. +
                                +
                                + +## Other error codes + +
                                + + + + + + + + + + + + + +
                                Error CodesCauseMitigation
                                0x80070003- 0x20007 +This is a failure during SafeOS phase driver installation. + +Verify device drivers on the computer, and analyze log files to determine the problem driver. +
                                0x8007025D - 0x2000C +This error occurs if the ISO file's metadata is corrupt."Re-download the ISO/Media and re-attempt the upgrade. + +Alternatively, re-create installation media the [Media Creation Tool](https://www.microsoft.com/software-download/windows10). + +
                                0x80070490 - 0x20007An incompatible device driver is present. + +Verify device drivers on the computer, and analyze log files to determine the problem driver. + +
                                0xC1900101 - 0x2000c +An unspecified error occurred in the SafeOS phase during WIM apply. This can be caused by an outdated driver or disk corruption. +Run checkdisk to repair the file system. For more information, see the quick fixes section in this guide. +
                                Update drivers on the computer, and select "Download and install updates (recommended)" during the upgrade process. Disconnect devices other than the mouse, keyboard and display.
                                0xC1900200 - 0x20008 + +The computer doesn’t meet the minimum requirements to download or upgrade to Windows 10. + +See Windows 10 Specifications and verify the computer meets minimum requirements. + +Review logs for [compatibility information](https://blogs.technet.microsoft.com/askcore/2016/01/21/using-the-windows-10-compatibility-reports-to-understand-upgrade-issues/).
                                0x80070004 - 0x3000D +This is a problem with data migration during the first boot phase. There are multiple possible causes. + +Analyze log files to determine the issue.
                                0xC1900101 - 0x4001E +Installation failed in the SECOND_BOOT phase with an error during PRE_OOBE operation. +This is a generic error that occurs during the OOBE phase of setup. See the 0xC1900101 section of this guide and review general troubleshooting procedures described in that section.
                                0x80070005 - 0x4000D +The installation failed in the SECOND_BOOT phase with an error in during MIGRATE_DATA operation. This error indicates that access was denied while attempting to migrate data. +Analyze log files to determine the data point that is reporting access denied.
                                0x80070004 - 0x50012 +Windows Setup failed to open a file. +Analyze log files to determine the data point that is reporting access problems.
                                0xC190020e +
                                0x80070070 - 0x50011 +
                                0x80070070 - 0x50012 +
                                0x80070070 - 0x60000 +                                		These errors indicate the computer does not have enough free space available to install the upgrade. +To upgrade a computer to Windows 10, it requires 16 GB of free hard drive space for a 32-bit OS, and 20 GB for a 64-bit OS. If there is not enough space, attempt to free up drive space before proceeding with the upgrade. + +> [!NOTE] +> If your device allows it, you can use an external USB drive for the upgrade process. Windows setup will back up the previous version of Windows to a USB external drive. The external drive must be at least 8GB (16GB is recommended). The external drive should be formatted using NTFS. Drives that are formatted in FAT32 may run into errors due to FAT32 file size limitations. USB drives are preferred over SD cards because drivers for SD cards are not migrated if the device does not support Connected Standby. +
                                + +## Modern setup errors + +Also see the following sequential list of modern setup (mosetup) error codes with a brief description of the cause. + +| Result code | Message | Description | +| --- | --- | --- | +| 0XC1900100 | MOSETUP_E_VERSION_MISMATCH | An unexpected version of Setup Platform binaries was encountered. Please verify the package contents. | +| 0XC1900101 | MOSETUP_E_SETUP_PLATFORM | The Setup Platform has encountered an unspecified error. | +| 0XC1900102 | MOSETUP_E_SHUTDOWN_BLOCK | Unable to create or destroy the shutdown block message. | +| 0XC1900103 | MOSETUP_E_COMPAT_TIMEOUT | The compatibility issues were not resolved within the required time limit. | +| 0XC1900104 | MOSETUP_E_PROCESS_TIMEOUT | The installation process did not complete within the required time limit. | +| 0XC1900105 | MOSETUP_E_TEST_MODE | The installation process is being used in a test environment. | +| 0XC1900106 | MOSETUP_E_TERMINATE_PROCESS | The installation process was terminated. | +| 0XC1900107 | MOSETUP_E_CLEANUP_PENDING | A cleanup operation from a previous installation attempt is still pending. A system reboot is required. | +| 0XC1900108 | MOSETUP_E_REPORTING | An error has occurred and the result value must be consolidated for telemetry purposes. | +| 0XC1900109 | MOSETUP_E_COMPAT_TERMINATE | The installation process was terminated during the actionable compatibility phase. | +| 0XC190010a | MOSETUP_E_UNKNOWN_CMD_LINE | The installation process was launched with an unknown command-line argument. | +| 0XC190010b | MOSETUP_E_INSTALL_IMAGE_NOT_FOUND | The installation image was not found. | +| 0XC190010c | MOSETUP_E_AUTOMATION_INVALID | The provided automation information was invalid. | +| 0XC190010d | MOSETUP_E_INVALID_CMD_LINE | The installation process was launched with an invalid command-line argument. | +| 0XC190010e | MOSETUP_E_EULA_ACCEPT_REQUIRED | The installation process requires that the user accept the license agreement. | +| 0XC1900110 | MOSETUP_E_EULA_CANCEL | The user has chosen to cancel for license agreement. | +| 0XC1900111 | MOSETUP_E_ADVERTISE_CANCEL | The user has chosen to cancel for advertisement. | +| 0XC1900112 | MOSETUP_E_TARGET_DRIVE_NOT_FOUND | Could not find a target drive letter. | +| 0XC1900113 | MOSETUP_E_EULA_DECLINED | The user has declined the license terms. | +| 0XC190011e | MOSETUP_E_FLIGHTING_BVT | The installation process has been halted for testing purposes. | +| 0XC190011f | MOSETUP_E_PROCESS_CRASHED | The installation process crashed. | +| 0XC1900120 | MOSETUP_E_EULA_TIMEOUT | The user has not accepted Eula within the required time limit. | +| 0XC1900121 | MOSETUP_E_ADVERTISE_TIMEOUT | The user has not accepted Advertisement within the required time limit. | +| 0XC1900122 | MOSETUP_E_DOWNLOADDISKSPACE_TIMEOUT | The download disk space issues were not resolved within the required time limit. | +| 0XC1900123 | MOSETUP_E_INSTALLDISKSPACE_TIMEOUT | The install disk space issues were not resolved within the required time limit. | +| 0XC1900124 | MOSETUP_E_COMPAT_SYSREQ_TIMEOUT | The minimum requirements compatibility issues were not resolved within the required time limit. | +| 0XC1900125 | MOSETUP_E_COMPAT_DOWNLOADREQ_TIMEOUT | The compatibility issues for download were not resolved within the required time limit. | +| 0XC1900126 | MOSETUP_E_GATHER_OS_STATE_SIGNATURE | The GatherOsState executable has invalid signature. | +| 0XC1900127 | MOSETUP_E_UNINSTALL_ALLOWED_ABORT | The user has chosen to abort Setup to keep Uninstall option active. | +| 0XC1900128 | MOSETUP_E_MISSING_TASK | The install cannot continue because a required task is missing. | +| 0XC1900129 | MOSETUP_E_UPDATEMEDIA_REQUESTED | A more up-to-date version of setup will be launched to continue installation +| 0XC190012f | MOSETUP_E_FINALIZE_ALREADY_REQUESTED | The install cannot continue because a finalize operation was already requested. | +| 0XC1900130 | MOSETUP_E_INSTALL_HASH_MISSING | The install cannot continue because the instance hash was not found. | +| 0XC1900131 | MOSETUP_E_INSTALL_HASH_MISMATCH | The install cannot continue because the instance hash does not match. | +| 0XC19001df | MOSETUP_E_DISK_FULL | The install cannot continue because the system is out of disk space. | +| 0XC19001e0 | MOSETUP_E_GATHER_OS_STATE_FAILED | The GatherOsState executable has failed to execute. | +| 0XC19001e1 | MOSETUP_E_PROCESS_SUSPENDED | The installation process was suspended. | +| 0XC19001e2 | MOSETUP_E_PREINSTALL_SCRIPT_FAILED | A preinstall script failed to execute or returned an error. | +| 0XC19001e3 | MOSETUP_E_PRECOMMIT_SCRIPT_FAILED | A precommit script failed to execute or returned an error. | +| 0XC19001e4 | MOSETUP_E_FAILURE_SCRIPT_FAILED | A failure script failed to execute or returned an error. | +| 0XC19001e5 | MOSETUP_E_SCRIPT_TIMEOUT | A script exceeded the timeout limit. | +| 0XC1900200 | MOSETUP_E_COMPAT_SYSREQ_BLOCK | The system does not pass the minimum requirements to install the update. | +| 0XC1900201 | MOSETUP_E_COMPAT_SYSREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to install the update. | +| 0XC1900202 | MOSETUP_E_COMPAT_DOWNLOADREQ_BLOCK | The system does not pass the minimum requirements to download the update. | +| 0XC1900203 | MOSETUP_E_COMPAT_DOWNLOADREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to download the update. | +| 0XC1900204 | MOSETUP_E_COMPAT_MIGCHOICE_BLOCK | The system does not pass the requirements for desired migration choice. | +| 0XC1900205 | MOSETUP_E_COMPAT_MIGCHOICE_CANCEL | The user has chosen to cancel because the system does not pass the requirements for desired migration choice. | +| 0XC1900206 | MOSETUP_E_COMPAT_DEVICEREQ_BLOCK | The system does not pass the device scan to install the update. | +| 0XC1900207 | MOSETUP_E_COMPAT_DEVICEREQ_CANCEL | The user has chosen to cancel because the system does not pass the device scan to install the update. | +| 0XC1900208 | MOSETUP_E_COMPAT_INSTALLREQ_BLOCK | The system does not pass the compat scan to install the update. | +| 0XC1900209 | MOSETUP_E_COMPAT_INSTALLREQ_CANCEL | The user has chosen to cancel because the system does not pass the compat scan to install the update. | +| 0XC190020a | MOSETUP_E_COMPAT_RECOVERYREQ_BLOCK | The system does not pass the minimum requirements to recover Windows. | +| 0XC190020b | MOSETUP_E_COMPAT_RECOVERYREQ_CANCEL | The user has chosen to cancel because the system does not pass the minimum requirements to recover Windows. | +| 0XC190020c | MOSETUP_E_DOWNLOADDISKSPACE_BLOCK | The system does not pass the disk space requirements to download the payload. | +| 0XC190020d | MOSETUP_E_DOWNLOADDISKSPACE_CANCEL | The user has chosen to cancel as the device does not have enough disk space to download. | +| 0XC190020e | MOSETUP_E_INSTALLDISKSPACE_BLOCK | The system does not pass the disk space requirements to install the payload. | +| 0XC190020f | MOSETUP_E_INSTALLDISKSPACE_CANCEL | The user has chosen to cancel as the device does not have enough disk space to install. | +| 0XC1900210 | MOSETUP_E_COMPAT_SCANONLY | The user has used the setup.exe command line to do scanonly, not to install the OS. | +| 0XC1900211 | MOSETUP_E_DOWNLOAD_UNPACK_DISKSPACE_BLOCK | The system does not pass the disk space requirements to download and unpack media. | +| 0XC1900212 | MOSETUP_E_DOWNLOAD_UNPACK_DISKSPACE_MULTIARCH_BLOCK | The system does not pass the disk space requirements to download and unpack multi-architecture media. | +| 0XC1900213 | MOSETUP_E_NO_OFFER_FOUND | There was no offer found that matches the required criteria. | +| 0XC1900214 | MOSETUP_E_UNSUPPORTED_VERSION | This version of the tool is not supported. | +| 0XC1900215 | MOSETUP_E_NO_MATCHING_INSTALL_IMAGE | Could not find an install image for this system. | +| 0XC1900216 | MOSETUP_E_ROLLBACK_PENDING | Found pending OS rollback operation. | +| 0XC1900220 | MOSETUP_E_COMPAT_REPORT_NOT_DISPLAYED | The compatibility report cannot be displayed due to a missing system component. | +| 0XC1900400 | MOSETUP_E_UA_VERSION_MISMATCH | An unexpected version of Update Agent client was encountered. | +| 0XC1900401 | MOSETUP_E_UA_NO_PACKAGES_TO_DOWNLOAD | No packages to be downloaded. | +| 0XC1900402 | MOSETUP_E_UA_UPDATE_CANNOT_BE_MERGED | No packages to be downloaded. | +| 0XC1900403 | MOSETUP_E_UA_CORRUPT_PAYLOAD_FILES | Payload files were corrupt. | +| 0XC1900404 | MOSETUP_E_UA_BOX_NOT_FOUND | The installation executable was not found. | +| 0XC1900405 | MOSETUP_E_UA_BOX_CRASHED | The installation process terminated unexpectedly. | + +## Related topics + +- [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) +- [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +- [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) +- [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/home?category=Windows10ITPro) +- [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md index 3193a41095..3a7f854132 100644 --- a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md +++ b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md @@ -1,62 +1,64 @@ ---- -title: Resolve Windows 10 upgrade errors - Windows IT Pro -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. -keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: greg-lindsay -ms.date: 04/18/2018 -ms.localizationpriority: medium -ms.topic: article ---- - -# Resolve Windows 10 upgrade errors : Technical information for IT Pros - -**Applies to** -- Windows 10 - ->[!IMPORTANT] ->This article contains technical instructions for IT administrators. If you are not an IT administrator, try some of the [quick fixes](quick-fixes.md) described in this article then contact [Microsoft Support](https://support.microsoft.com/contactus/) starting with the Virtual Agent. To talk to a person about your issue, click **Get started** to interact with the Virtual Agent, then enter "Talk to a person" two times. The Virtual Agent can also help you to resolve many Windows upgrade issues. Also see: [Get help with Windows 10 upgrade and installation errors](https://support.microsoft.com/help/10587/windows-10-get-help-with-upgrade-installation-errors) and [Submit Windows 10 upgrade errors using Feedback Hub](submit-errors.md). - -This article contains a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. - -The article was originally one page, but has been divided into sub-topics of different technical levels. Basic level provides common procedures that can resolve several types of upgrade errors. Advanced level requires some experience with detailed troubleshooting methods. - -The following four levels are assigned: - -Level 100: Basic
                                -Level 200: Moderate
                                -Level 300: Moderate advanced
                                -Level 400: Advanced
                                - -## In this guide - -See the following topics in this article: - -- [Quick fixes](quick-fixes.md): \Level 100\ Steps you can take to eliminate many Windows upgrade errors.
                                -- [SetupDiag](setupdiag.md): \Level 300\ SetupDiag is a new tool to help you isolate the root cause of an upgrade failure. -- [Troubleshooting upgrade errors](troubleshoot-upgrade-errors.md): \Level 300\ General advice and techniques for troubleshooting Windows 10 upgrade errors, and an explanation of phases used during the upgrade process.
                                -- [Windows Error Reporting](windows-error-reporting.md): \Level 300\ How to use Event Viewer to review details about a Windows 10 upgrade. -- [Upgrade error codes](upgrade-error-codes.md): \Level 400\ The components of an error code are explained. - - [Result codes](upgrade-error-codes.md#result-codes): Information about result codes. - - [Extend codes](upgrade-error-codes.md#extend-codes): Information about extend codes. -- [Log files](log-files.md): \Level 400\ A list and description of log files useful for troubleshooting. - - [Log entry structure](log-files.md#log-entry-structure): The format of a log entry is described. - - [Analyze log files](log-files.md#analyze-log-files): General procedures for log file analysis, and an example. -- [Resolution procedures](resolution-procedures.md): \Level 200\ Causes and mitigation procedures associated with specific error codes. - - [0xC1900101](resolution-procedures.md#0xc1900101): Information about the 0xC1900101 result code. - - [0x800xxxxx](resolution-procedures.md#0x800xxxxx): Information about result codes that start with 0x800. - - [Other result codes](resolution-procedures.md#other-result-codes): Additional causes and mitigation procedures are provided for some result codes. - - [Other error codes](resolution-procedures.md#other-error-codes): Additional causes and mitigation procedures are provided for some error codes. -- [Submit Windows 10 upgrade errors](submit-errors.md): \Level 100\ Submit upgrade errors to Microsoft for analysis. - -## Related topics - -[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) -
                                [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                                [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) -
                                [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
                                [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) -
                                \ No newline at end of file +--- +title: Resolve Windows 10 upgrade errors - Windows IT Pro +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Resolve Windows 10 upgrade errors : Technical information for IT Pros + +**Applies to** +- Windows 10 + +>[!IMPORTANT] +>This article contains technical instructions for IT administrators. If you are not an IT administrator, try some of the [quick fixes](quick-fixes.md) described in this article then contact [Microsoft Support](https://support.microsoft.com/contactus/) starting with the Virtual Agent. To talk to a person about your issue, click **Get started** to interact with the Virtual Agent, then enter "Talk to a person" two times. The Virtual Agent can also help you to resolve many Windows upgrade issues. Also see: [Get help with Windows 10 upgrade and installation errors](https://support.microsoft.com/help/10587/windows-10-get-help-with-upgrade-installation-errors) and [Submit Windows 10 upgrade errors using Feedback Hub](submit-errors.md). + +This article contains a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. + +The article was originally one page, but has been divided into sub-topics of different technical levels. Basic level provides common procedures that can resolve several types of upgrade errors. Advanced level requires some experience with detailed troubleshooting methods. + +The following four levels are assigned: + +Level 100: Basic
                                +Level 200: Moderate
                                +Level 300: Moderate advanced
                                +Level 400: Advanced
                                + +## In this guide + +See the following topics in this article: + +- [Quick fixes](quick-fixes.md): \Level 100\ Steps you can take to eliminate many Windows upgrade errors.
                                +- [SetupDiag](setupdiag.md): \Level 300\ SetupDiag is a new tool to help you isolate the root cause of an upgrade failure. +- [Troubleshooting upgrade errors](troubleshoot-upgrade-errors.md): \Level 300\ General advice and techniques for troubleshooting Windows 10 upgrade errors, and an explanation of phases used during the upgrade process.
                                +- [Windows Error Reporting](windows-error-reporting.md): \Level 300\ How to use Event Viewer to review details about a Windows 10 upgrade. +- [Upgrade error codes](upgrade-error-codes.md): \Level 400\ The components of an error code are explained. + - [Result codes](upgrade-error-codes.md#result-codes): Information about result codes. + - [Extend codes](upgrade-error-codes.md#extend-codes): Information about extend codes. +- [Log files](log-files.md): \Level 400\ A list and description of log files useful for troubleshooting. + - [Log entry structure](log-files.md#log-entry-structure): The format of a log entry is described. + - [Analyze log files](log-files.md#analyze-log-files): General procedures for log file analysis, and an example. +- [Resolution procedures](resolution-procedures.md): \Level 200\ Causes and mitigation procedures associated with specific error codes. + - [0xC1900101](resolution-procedures.md#0xc1900101): Information about the 0xC1900101 result code. + - [0x800xxxxx](resolution-procedures.md#0x800xxxxx): Information about result codes that start with 0x800. + - [Other result codes](resolution-procedures.md#other-result-codes): Additional causes and mitigation procedures are provided for some result codes. + - [Other error codes](resolution-procedures.md#other-error-codes): Additional causes and mitigation procedures are provided for some error codes. +- [Submit Windows 10 upgrade errors](submit-errors.md): \Level 100\ Submit upgrade errors to Microsoft for analysis. + +## Related topics + +[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) +
                                [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +
                                [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) +
                                [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +
                                [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +
                                diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index 9b97b16be8..0a503b2010 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -1,13 +1,16 @@ --- title: SetupDiag +ms.reviewer: +manager: laurawi +ms.author: greglin description: How to use the SetupDiag tool to diagnose Windows Setup errors keywords: deploy, troubleshoot, windows, 10, upgrade, update, setup, diagnose ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy +audience: itpro author: greg-lindsay -ms.date: 12/18/2018 ms.localizationpriority: medium ms.topic: article --- @@ -25,7 +28,8 @@ ms.topic: article ## About SetupDiag -Current version of SetupDiag: 1.4.0.0 +Current version of SetupDiag: 1.6.0.42 +>Always be sure to run the most recent version of SetupDiag, so that can access new functionality and fixes to known issues. SetupDiag is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. @@ -64,9 +68,13 @@ The [Release notes](#release-notes) section at the bottom of this topic has info | /Output:\ |
                                • This optional parameter enables you to specify the output file for results. This is where you will find what SetupDiag was able to determine. Only text format output is supported. UNC paths will work, provided the context under which SetupDiag runs has access to the UNC path. If the path has a space in it, you must enclose the entire path in double quotes (see the example section below).
                                • Default: If not specified, SetupDiag will create the file **SetupDiagResults.log** in the same directory where SetupDiag.exe is run.
                                | | /LogsPath:\ |
                                • This optional parameter tells SetupDiag.exe where to find the log files for an offline analysis. These log files can be in a flat folder format, or containing multiple subdirectories. SetupDiag will recursively search all child directories.
                                | | /ZipLogs:\ |
                                • This optional parameter tells SetupDiag.exe to create a zip file containing the results and all the log files it parsed. The zip file is created in the same directory where SetupDiag.exe is run.
                                • Default: If not specified, a value of 'true' is used.
                                | -| /Verbose |
                                • This optional parameter will output much more data to a log file. By default, SetupDiag will only produce a log file entry for serious errors. Using **/Verbose** will cause SetupDiag to always produce an additional log file with debugging details. These details can be useful when reporting a problem with SetupDiag.
                                | | /Format:\ |
                                • This optional parameter can be used to output log files in xml or JSON format. If this parameter is not specified, text format is used by default.
                                | +| /Scenario:\[Recovery\] |
                                • This optional parameter instructs SetupDiag.exe to look for and process reset and recovery logs and ignore setup/upgrade logs.
                                | +| /Verbose |
                                • This optional parameter will output much more data to a log file. By default, SetupDiag will only produce a log file entry for serious errors. Using **/Verbose** will cause SetupDiag to always produce an additional log file with debugging details. These details can be useful when reporting a problem with SetupDiag.
                                | | /NoTel |
                                • This optional parameter tells SetupDiag.exe not to send diagnostic telemetry to Microsoft.
                                | +| /AddReg |
                                • This optional parameter instructs SetupDiag.exe to add failure information to the registry in offline mode. By default, SetupDiag will add failure information to the registry in online mode only. Registry data is added to the following location on the system where SetupDiag is run: **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag**.
                                | +| /RegPath |
                                • This optional parameter instructs SetupDiag.exe to add failure information to the registry using the specified path. If this parameter is not specified the default path is **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag**. +
                                | Note: The **/Mode** parameter is deprecated in version 1.4.0.0 of SetupDiag. - In previous versions, this command was used with the LogsPath parameter to specify that SetupDiag should run in an offline manner to analyze a set of log files that were captured from a different computer. In version 1.4.0.0 when you specify /LogsPath then SetupDiag will automatically run in offline mode, therefore the /Mode parameter is not needed. @@ -97,6 +105,19 @@ The following example specifies that SetupDiag is to run in offline mode, and to SetupDiag.exe /Output:C:\SetupDiag\Results.log /LogsPath:D:\Temp\Logs\LogSet1 ``` +The following example sets recovery scenario in offline mode. In the example, SetupDiag will search for reset/recovery logs in the specified LogsPath location and output the resuts to the directory specified by the /Output parameter. + +``` +SetupDiag.exe /Output:C:\SetupDiag\RecoveryResults.log /LogsPath:D:\Temp\Cabs\PBR_Log /Scenario:Recovery +``` + +The following example sets recovery scenario in online mode. In the example, SetupDiag will search for reset/recovery logs on the current system and output results in XML format. + +``` +SetupDiag.exe /Scenario:Recovery /Format:xml +``` + + ## Log files [Windows Setup Log Files and Event Logs](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-log-files-and-event-logs) has information about where logs are created during Windows Setup. For offline processing, you should run SetupDiag against the contents of the entire folder. For example, depending on when the upgrade failed, copy one of the following folders to your offline location: @@ -129,155 +150,42 @@ SetupDiag.exe /Output:C:\SetupDiag\Dumpdebug.log /LogsPath:D:\Dump ## Known issues 1. Some rules can take a long time to process if the log files involved are large. -2. If the failing computer is opted into the Insider program and getting regular pre-release updates, or an update is already pending on the computer when SetupDiag is run, it can encounter problems trying to open these log files. This will likely cause a failure to determine a root cause. In this case, try gathering the log files and running SetupDiag in offline mode. ## Sample output -The following is an example where SetupDiag is run in offline mode. In this example, there is an application warning, but since setup is executed in /quiet mode so it becomes a block. Instructions to resolve the problem are provided by SetupDiag in the output. - -The output also provides an error code 0xC1900208 - 0x4000C which corresponds to a compatibility issue as documented in the [Upgrade error codes](upgrade-error-codes.md#result-codes) and [Resolution procedures](resolution-procedures.md#modern-setup-errors) topics in this article. +The following is an example where SetupDiag is run in offline mode. ``` -C:\SetupDiag>SetupDiag.exe /Output:C:\SetupDiag\Results.log /LogsPath:C:\Temp\BobMacNeill +D:\SetupDiag>SetupDiag.exe /output:c:\setupdiag\result.xml /logspath:D:\Tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e /format:xml -SetupDiag v1.4.0.0 +SetupDiag v1.6.0.0 Copyright (c) Microsoft Corporation. All rights reserved. -Searching for setup logs, this can take a minute or more depending on the number and size of the logs...please wait. - Found 4 setupact.logs. - Processing setupact.log at: c:\temp\bobmacneill\$WINDOWS.~BT\Sources\Panther\setupact.log - Processing setupact.log at: c:\temp\bobmacneill\Panther\setupact.log - Processing setupact.log at: c:\temp\bobmacneill\Panther\NewOs\Panther\setupact.log - Processing setupact.log at: c:\temp\bobmacneill\Panther\UnattendGC\setupact.log -Found c:\temp\bobmacneill\$WINDOWS.~BT\Sources\Panther\setupact.log with update date 03/29/2018 23:13:58 and CV: H2X+YsWL/UOkj/8X to be the correct setup log. -Gathering information from setup logs. +Searching for setup logs... +Found d:\tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e\setupact_6.log with update date 6/12/2019 2:44:20 PM to be the correct setup log. +Found d:\tests\Logs\f55be736-beed-4b9b-aedf-c133536c946e\setupact_1.log with update date 6/12/2019 2:45:19 PM to be the correct rollback log. + +Gathering baseline information from setup logs... SetupDiag: processing rule: CompatScanOnly. -..No match. +...No match. -SetupDiag: processing rule: BitLockerHardblock. -..No match. +... -SetupDiag: processing rule: VHDHardblock. -..No match. +SetupDiag: processing rule: DISMImageSessionFailure. +.. +Error: SetupDiag reports DISM provider failure. +Last Phase: Safe OS +Last Operation: Apply Optional Component status +Message = Failed to get the IDismImage instance from the image session +Function: CDISMManager::CloseImageSession +Error: 0x800706ba +Recommend you re-download the update source files, reboot and try the update again. -SetupDiag: processing rule: PortableWorkspaceHardblock. -..No match. +SetupDiag found 1 matching issue. -SetupDiag: processing rule: AuditModeHardblock. -..No match. - -SetupDiag: processing rule: SafeModeHardblock. -..No match. - -SetupDiag: processing rule: InsufficientSystemPartitionDiskSpaceHardblock. -..No match. - -SetupDiag: processing rule: CompatBlockedApplicationAutoUninstall. -....No match. - -SetupDiag: processing rule: CompatBlockedApplicationDismissable. -.... - -Matching Profile found: CompatBlockedApplicationDismissable - EA52620B-E6A0-4BBC-882E-0686605736D9 -Warning: Found Application Block for: "Microsoft Endpoint Protection". -This is a dismissible message when not running setup.exe in "/quiet" mode. -Consider specifying "/compat /ignore warning" to ignore these dismissible warnings. -You must manually uninstall "Microsoft Endpoint Protection" before continuing with the installation/update, or change the command line parameters to ignore warnings. -For more information about Setup command line switches, see here: -https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options - -SetupDiag: processing rule: CompatBlockedApplicationManualUninstall. -....No match. - -SetupDiag: processing rule: HardblockDeviceOrDriver. -....No match. - -SetupDiag: processing rule: HardblockMismatchedLanguage. -..No match. - -SetupDiag: processing rule: HardblockFlightSigning. -..No match. - -SetupDiag: processing rule: DiskSpaceBlockInDownLevel. -..No match. - -SetupDiag: processing rule: DiskSpaceFailure. -..No match. - -SetupDiag: processing rule: DebugSetupMemoryDump. -.No match. - -SetupDiag: processing rule: DebugSetupCrash. -.No match. - -SetupDiag: processing rule: DebugMemoryDump. -.No match. - -SetupDiag: processing rule: DeviceInstallHang. -..No match. - -SetupDiag: processing rule: BootFailureDetected. -.No match. - -SetupDiag: processing rule: FindDebugInfoFromRollbackLog. -.No match. - -SetupDiag: processing rule: AdvancedInstallerFailed. -..No match. - -SetupDiag: processing rule: FindMigApplyUnitFailure. -..No match. - -SetupDiag: processing rule: FindMigGatherUnitFailure. -..No match. - -SetupDiag: processing rule: OptionalComponentInstallFailure. -..No match. - -SetupDiag: processing rule: CriticalSafeOSDUFailure. -..No match. - -SetupDiag: processing rule: UserProfileCreationFailureDuringOnlineApply. -..No match. - -SetupDiag: processing rule: WimMountFailure. -..No match. - -SetupDiag: processing rule: FindSuccessfulUpgrade. -..No match. - -SetupDiag: processing rule: FindSetupHostReportedFailure. -..No match. - -SetupDiag: processing rule: FindDownlevelFailure. -..No match. - -SetupDiag: processing rule: FindAbruptDownlevelFailure. -....Error: SetupDiag reports abrupt down-level failure. Last Operation: Finalize, Error: 0xC1900208 - 0x4000C -Failure Data: Last Operation: Finalize, Error: 0xC1900208 - 0x4000C -Refer to https://docs.microsoft.com/windows/deployment/upgrade/upgrade-error-codes for error information. - -SetupDiag: processing rule: FindSetupPlatformFailedOperationInfo. -..No match. - -SetupDiag: processing rule: FindRollbackFailure. -..No match. - -SetupDiag found 2 matching issues. - -Warning: Found Application Block for: "Microsoft Endpoint Protection". -This is a dismissible message when not running setup.exe in "/quiet" mode. -Consider specifying "/compat /ignore warning" to ignore these dismissible warnings. -You must manually uninstall "Microsoft Endpoint Protection" before continuing with the installation/update, or change the command line parameters to ignore warnings. -For more information about Setup command line switches, see here: -https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options -Error: SetupDiag reports abrupt down-level failure. Last Operation: Finalize, Error: 0xC1900208 - 0x4000C -Failure Data: Last Operation: Finalize, Error: 0xC1900208 - 0x4000C -Refer to https://docs.microsoft.com/windows/deployment/upgrade/upgrade-error-codes for error information. - -SetupDiag results were logged to: c:\setupdiag\results.log +SetupDiag results were logged to: c:\setupdiag\results.xml Logs ZipFile created at: c:\setupdiag\Logs_14.zip ``` @@ -288,71 +196,71 @@ When searching log files, SetupDiag uses a set of rules to match known issues. T Each rule name and its associated unique rule identifier are listed with a description of the known upgrade-blocking issue. In the rule descriptions, the term "down-level" refers to the first phase of the upgrade process, which runs under the starting OS. -1. CompatScanOnly - FFDAFD37-DB75-498A-A893-472D49A1311D +1. CompatScanOnly - FFDAFD37-DB75-498A-A893-472D49A1311D - This rule indicates that setup.exe was called with a specific command line parameter that indicated setup was to do a compat scan only, not an upgrade. -2. BitLockerHardblock - C30152E2-938E-44B8-915B-D1181BA635AE +2. BitLockerHardblock - C30152E2-938E-44B8-915B-D1181BA635AE - This is a block when the target OS does not support BitLocker, yet the host OS has BitLocker enabled. -3. VHDHardblock - D9ED1B82-4ED8-4DFD-8EC0-BE69048978CC +3. VHDHardblock - D9ED1B82-4ED8-4DFD-8EC0-BE69048978CC - This block happens when the host OS is booted to a VHD image. Upgrade is not supported when the host OS is booted from a VHD image. -4. PortableWorkspaceHardblock - 5B0D3AB4-212A-4CE4-BDB9-37CA404BB280 +4. PortableWorkspaceHardblock - 5B0D3AB4-212A-4CE4-BDB9-37CA404BB280 - This indicates that the host OS is booted from a Windows To-Go device (USB key). Upgrade is not supported in the Windows To-Go environment. -5. AuditModeHardblock - A03BD71B-487B-4ACA-83A0-735B0F3F1A90 +5. AuditModeHardblock - A03BD71B-487B-4ACA-83A0-735B0F3F1A90 - This block indicates that the host OS is currently booted into Audit Mode, a special mode for modifying the Windows state. Upgrade is not supported from this state. -6. SafeModeHardblock - 404D9523-B7A8-4203-90AF-5FBB05B6579B +6. SafeModeHardblock - 404D9523-B7A8-4203-90AF-5FBB05B6579B - This block indicates that the host OS is booted to Safe Mode, where upgrade is not supported. -7. InsufficientSystemPartitionDiskSpaceHardblock - 3789FBF8-E177-437D-B1E3-D38B4C4269D1 +7. InsufficientSystemPartitionDiskSpaceHardblock - 3789FBF8-E177-437D-B1E3-D38B4C4269D1 - This block is encountered when setup determines the system partition (where the boot loader files are stored) does not have enough space to be serviced with the newer boot files required during the upgrade process. -8. CompatBlockedApplicationAutoUninstall – BEBA5BC6-6150-413E-8ACE-5E1EC8D34DD5 +8. CompatBlockedApplicationAutoUninstall – BEBA5BC6-6150-413E-8ACE-5E1EC8D34DD5 - This rule indicates there is an application that needs to be uninstalled before setup can continue. -9. CompatBlockedApplicationDismissable - EA52620B-E6A0-4BBC-882E-0686605736D9 - - When running setup in /quiet mode, there are dismissible application messages that turn into blocks unless the command line also specifies “/compat /ignore warning”. This rule indicates setup was executed in /quiet mode but there is an application dismissible block message that have prevented setup from continuing. -10. CompatBlockedApplicationManualUninstall - 9E912E5F-25A5-4FC0-BEC1-CA0EA5432FF4 +9. CompatBlockedApplicationDismissable - EA52620B-E6A0-4BBC-882E-0686605736D9 + - When running setup in /quiet mode, there are dismissible application messages that turn into blocks unless the command line also specifies “/compat ignorewarning”. This rule indicates setup was executed in /quiet mode but there is an application dismissible block message that have prevented setup from continuing. +10. CompatBlockedApplicationManualUninstall - 9E912E5F-25A5-4FC0-BEC1-CA0EA5432FF4 - This rule indicates that an application without an Add/Remove Programs entry, is present on the system and blocking setup from continuing. This typically requires manual removal of the files associated with this application to continue. -11. HardblockDeviceOrDriver - ED3AEFA1-F3E2-4F33-8A21-184ADF215B1B +11. HardblockDeviceOrDriver - ED3AEFA1-F3E2-4F33-8A21-184ADF215B1B - This indicates a device driver that is loaded on the host OS is not compatible with the newer OS version and needs to be removed prior to the upgrade. -12. HardblockMismatchedLanguage - 60BA8449-CF23-4D92-A108-D6FCEFB95B45 +12. HardblockMismatchedLanguage - 60BA8449-CF23-4D92-A108-D6FCEFB95B45 - This rule indicates the host OS and the target OS language editions do not match. -13. HardblockFlightSigning - 598F2802-3E7F-4697-BD18-7A6371C8B2F8 +13. HardblockFlightSigning - 598F2802-3E7F-4697-BD18-7A6371C8B2F8 - This rule indicates the target OS is a pre-release, Windows Insider build, and the target machine has Secure Boot enabled. This will block the pre-release signed build from booting if installed on the machine. -14. DiskSpaceBlockInDownLevel - 6080AFAC-892E-4903-94EA-7A17E69E549E +14. DiskSpaceBlockInDownLevel - 6080AFAC-892E-4903-94EA-7A17E69E549E - This failure indicates the system ran out of disk space during the down-level operations of upgrade. -15. DiskSpaceFailure - 981DCBA5-B8D0-4BA7-A8AB-4030F7A10191 +15. DiskSpaceFailure - 981DCBA5-B8D0-4BA7-A8AB-4030F7A10191 - This failure indicates the system drive ran out of available disk space at some point after the first reboot into the upgrade. -16. DeviceInstallHang - 37BB1C3A-4D79-40E8-A556-FDA126D40BC6 +16. DeviceInstallHang - 37BB1C3A-4D79-40E8-A556-FDA126D40BC6 - This failure rule indicates the system hung or bug checked during the device installation phase of upgrade. -17. DebugSetupMemoryDump - C7C63D8A-C5F6-4255-8031-74597773C3C6 +17. DebugSetupMemoryDump - C7C63D8A-C5F6-4255-8031-74597773C3C6 - This offline only rule indicates a bug check occurred during setup. If the debugger tools are available on the system, SetupDiag will debug the memory dump and provide details. -18. DebugSetupCrash - CEEBA202-6F04-4BC3-84B8-7B99AED924B1 +18. DebugSetupCrash - CEEBA202-6F04-4BC3-84B8-7B99AED924B1 - This offline only rule indicates that setup itself encountered a failure that resulted in a process memory dump. If the debugger tools are installed on the system, SetupDiag will debug the memory dump and give further details. -19. DebugMemoryDump - 505ED489-329A-43F5-B467-FCAAF6A1264C +19. DebugMemoryDump - 505ED489-329A-43F5-B467-FCAAF6A1264C - This offline only rule is for any memory.dmp file that resulted during the setup/upgrade operation. If the debugger tools are installed on the system, SetupDiag will debug the memory dump and give further details. -20. BootFailureDetected - 4FB446C2-D4EC-40B4-97E2-67EB19D1CFB7 +20. BootFailureDetected - 4FB446C2-D4EC-40B4-97E2-67EB19D1CFB7 - This rule indicates a boot failure occurred during a specific phase of the update. The rule will indicate the failure code and phase for diagnostic purposes. -21. FindDebugInfoFromRollbackLog - 9600EB68-1120-4A87-9FE9-3A4A70ACFC37 +21. FindDebugInfoFromRollbackLog - 9600EB68-1120-4A87-9FE9-3A4A70ACFC37 - This rule will determine and give details when a bug check occurs during the setup/upgrade process that resulted in a memory dump, but without the requirement of the debugger package being on the executing machine. -22. AdvancedInstallerFailed - 77D36C96-32BE-42A2-BB9C-AAFFE64FCADC +22. AdvancedInstallerFailed - 77D36C96-32BE-42A2-BB9C-AAFFE64FCADC - Finds fatal advanced installer operations that cause setup failures. -23. FindMigApplyUnitFailure - A4232E11-4043-4A37-9BF4-5901C46FD781 +23. FindMigApplyUnitFailure - A4232E11-4043-4A37-9BF4-5901C46FD781 - Detects a migration unit failure that caused the update to fail. This rule will output the name of the migration plug-in as well as the error code it produced for diagnostic purposes. -24. FindMigGatherUnitFailure - D04C064B-CD77-4E64-96D6-D26F30B4EE29 +24. FindMigGatherUnitFailure - D04C064B-CD77-4E64-96D6-D26F30B4EE29 - Detects a migration gather unit failure that caused the update to fail. This rule will output the name of the gather unit/plug-in as well as the error code it produced for diagnostic purposes. -25. CriticalSafeOSDUFailure - 73566DF2-CA26-4073-B34C-C9BC70DBF043 +25. CriticalSafeOSDUFailure - 73566DF2-CA26-4073-B34C-C9BC70DBF043 - This rule indicates a failure occurred while updating the SafeOS image with a critical dynamic update. It will indicate the phase and error code that occurred while attempting to update the SafeOS image for diagnostic purposes. -26. UserProfileCreationFailureDuringOnlineApply - 678117CE-F6A9-40C5-BC9F-A22575C78B14 +26. UserProfileCreationFailureDuringOnlineApply - 678117CE-F6A9-40C5-BC9F-A22575C78B14 - Indicates there was a critical failure while creating or modifying a User Profile during the online apply phase of the update. It will indicate the operation and error code associated with the failure for diagnostic purposes. -27. WimMountFailure - BE6DF2F1-19A6-48C6-AEF8-D3B0CE3D4549 +27. WimMountFailure - BE6DF2F1-19A6-48C6-AEF8-D3B0CE3D4549 - This rule indicates the update failed to mount a wim file. It will show the name of the wim file as well as the error message and error code associated with the failure for diagnostic purposes. -28. FindSuccessfulUpgrade - 8A0824C8-A56D-4C55-95A0-22751AB62F3E +28. FindSuccessfulUpgrade - 8A0824C8-A56D-4C55-95A0-22751AB62F3E - Determines if the given setup was a success or not based off the logs. -29. FindSetupHostReportedFailure - 6253C04F-2E4E-4F7A-B88E-95A69702F7EC +29. FindSetupHostReportedFailure - 6253C04F-2E4E-4F7A-B88E-95A69702F7EC - Gives information about failures surfaced early in the upgrade process by setuphost.exe -30. FindDownlevelFailure - 716334B7-F46A-4BAA-94F2-3E31BC9EFA55 +30. FindDownlevelFailure - 716334B7-F46A-4BAA-94F2-3E31BC9EFA55 - Gives failure information surfaced by SetupPlatform, later in the down-level phase. -31. FindAbruptDownlevelFailure - 55882B1A-DA3E-408A-9076-23B22A0472BD +31. FindAbruptDownlevelFailure - 55882B1A-DA3E-408A-9076-23B22A0472BD - Gives last operation failure information when the system fails in the down-level, but the log just ends abruptly. -32. FindSetupPlatformFailedOperationInfo - 307A0133-F06B-4B75-AEA8-116C3B53C2D1 +32. FindSetupPlatformFailedOperationInfo - 307A0133-F06B-4B75-AEA8-116C3B53C2D1 - Gives last phase and error information when SetupPlatform indicates a critical failure. This rule will indicate the operation and error associated with the failure for diagnostic purposes. -33. FindRollbackFailure - 3A43C9B5-05B3-4F7C-A955-88F991BB5A48 +33. FindRollbackFailure - 3A43C9B5-05B3-4F7C-A955-88F991BB5A48 - Gives last operation, failure phase and error information when a rollback occurs. 34. AdvancedInstallerGenericFailure – 4019550D-4CAA-45B0-A222-349C48E86F71 - A rule to match AdvancedInstaller read/write failures in a generic sense. Will output the executable being called as well as the error code and exit code reported. @@ -394,39 +302,86 @@ Each rule name and its associated unique rule identifier are listed with a descr - Indicates a sysPrep plug-in has failed in a critical operation. Indicates the plug-in name, operation name and error code. 53. UserProvidedDriverInjectionFailure - 2247C48A-7EE3-4037-AFAB-95B92DE1D980 - A driver provided to setup (via command line input) has failed in some way. Outputs the driver install function and error code. +54. PlugInComplianceBlock - D912150B-1302-4860-91B5-527907D08960 + - These are for server upgrades only, will output the compliance block and remediation required. +55. PreReleaseWimMountDriverFound - 31EC76CC-27EC-4ADC-9869-66AABEDB56F0 + - Captures failures due to having an unrecognized wimmount.sys driver registered on the system. +56. WinSetupBootFilterFailure - C073BFC8-5810-4E19-B53B-4280B79E096C + - Detects failures in the kernel mode file operations. +57. WimMountDriverIssue - 565B60DD-5403-4797-AE3E-BC5CB972FBAE + - Detects failures in WimMount.sys registration on the system. +58. DISMImageSessionFailure - 61B7886B-10CD-4C98-A299-B987CB24A11C + - Captures failure information when DISM fails to start an image session successfully. +59. FindEarlyDownlevelError - A4CE4FC9-5E10-4BB1-8ECE-3B29EB9D7C52 + - Detects failures in down-level phase before setup platform is invoked. +60. FindSPFatalError - A4028172-1B09-48F8-AD3B-86CDD7D55852 + - Captures failure information when setup platform encounters a fatal error. + ## Release notes +08/08/2019 - SetupDiag v1.6.0.42 is released with 60 rules, as a standalone tool available from the Download Center. + - Log detection performance is improved. What used to take up to a minute should take around 10 seconds or less. + - Added Setup Operation and Setup Phase information to both the results log and the registry information. + - This is the last Operation and Phase that Setup was in when the failure occurred. + - Added detailed Setup Operation and Setup Phase information (and timing) to output log when /verbose is specified. + - Note, if the issue found is a compat block, no Setup Operation or Phase info exists yet and therefore won’t be available. + - Added more info to the Registry output. + - Detailed ‘FailureData’ info where available. Example: “AppName = MyBlockedApplication” or “DiskSpace = 6603” (in MB) + - “Key = Value” data specific to the failure found. + - Added ‘UpgradeStartTime’, ‘UpgradeEndTime’ and ‘UpgradeElapsedTime’ + - Added ‘SetupDiagVersion’, ‘DateTime’ (to indicate when SetupDiag was executed on the system), ‘TargetOSVersion’, ‘HostOSVersion’ and more… + + +06/19/2019 - SetupDiag v1.5.0.0 is released with 60 rules, as a standalone tool available from the Download Center. +- All date and time outputs are updated to localized format per user request. +- Added setup Operation and Phase information to /verbose log. +- Added last Setup Operation and last Setup Phase information to most rules where it make sense (see new output below). +- Performance improvement in searching setupact.logs to determine correct log to parse. +- Added SetupDiag version number to text report (xml and json always had it). +- Added "no match" reports for xml and json per user request. +- Formatted Json output for easy readability. +- Performance improvements when searching for setup logs; this should be much faster now. +- Added 7 new rules: PlugInComplianceBlock, PreReleaseWimMountDriverFound, WinSetupBootFilterFailure, WimMountDriverIssue, DISMImageSessionFailure, FindEarlyDownlevelError, and FindSPFatalError. See the [Rules](#rules) section above for more information. +- Diagnostic information is now output to the registry at **HKLM\SYSTEM\Setup\MoSetup\Volatile\SetupDiag** + - The **/AddReg** command was added to toggle registry output. This setting is off by default for offline mode, and on by default for online mode. The command has no effect for online mode and enables registry output for offline mode. + - This registry key is deleted as soon as SetupDiag is run a second time, and replaced with current data, so it’s always up to date. + - This registry key also gets deleted when a new update instance is invoked. + - For an example, see [Sample registry key](#sample-registry-key). + +05/17/2019 - SetupDiag v1.4.1.0 is released with 53 rules, as a standalone tool available from the Download Center. +- This release dds the ability to find and diagnose reset and recovery failures (Push Button Reset). + 12/18/2018 - SetupDiag v1.4.0.0 is released with 53 rules, as a standalone tool available from the Download Center. - - This release includes major improvements in rule processing performance: ~3x faster rule processing performance! - - The FindDownlevelFailure rule is up to 10x faster. - - New rules have been added to analyze failures upgrading to Windows 10 version 1809. - - A new help link is available for resolving servicing stack failures on the down-level OS when the rule match indicates this type of failure. - - Removed the need to specify /Mode parameter. Now if you specify /LogsPath, it automatically assumes offline mode. - - Some functional and output improvements were made for several rules. +- This release includes major improvements in rule processing performance: ~3x faster rule processing performance! + - The FindDownlevelFailure rule is up to 10x faster. +- New rules have been added to analyze failures upgrading to Windows 10 version 1809. +- A new help link is available for resolving servicing stack failures on the down-level OS when the rule match indicates this type of failure. +- Removed the need to specify /Mode parameter. Now if you specify /LogsPath, it automatically assumes offline mode. +- Some functional and output improvements were made for several rules. 07/16/2018 - SetupDiag v1.3.1 is released with 44 rules, as a standalone tool available from the Download Center. - - This release fixes a problem that can occur when running SetupDiag in online mode on a computer that produces a setupmem.dmp file, but does not have debugger binaries installed. +- This release fixes a problem that can occur when running SetupDiag in online mode on a computer that produces a setupmem.dmp file, but does not have debugger binaries installed. 07/10/2018 - SetupDiag v1.30 is released with 44 rules, as a standalone tool available from the Download Center. - - Bug fix for an over-matched plug-in rule. The rule will now correctly match only critical (setup failure) plug-in issues. - - New feature: Ability to output logs in JSON and XML format. - - Use "/Format:xml" or "/Format:json" command line parameters to specify the new output format. See [sample logs](#sample-logs) at the bottom of this topic. - - If the “/Format:xml” or “/Format:json” parameter is omitted, the log output format will default to text. - - New Feature: Where possible, specific instructions are now provided in rule output to repair the identified error. For example, instructions are provided to remediate known blocking issues such as uninstalling an incompatible app or freeing up space on the system drive. - - 3 new rules added: AdvancedInstallerFailed, MigrationAbortedDueToPluginFailure, DISMAddPackageFailed. +- Bug fix for an over-matched plug-in rule. The rule will now correctly match only critical (setup failure) plug-in issues. +- New feature: Ability to output logs in JSON and XML format. + - Use "/Format:xml" or "/Format:json" command line parameters to specify the new output format. See [sample logs](#sample-logs) at the bottom of this topic. + - If the “/Format:xml” or “/Format:json” parameter is omitted, the log output format will default to text. +- New Feature: Where possible, specific instructions are now provided in rule output to repair the identified error. For example, instructions are provided to remediate known blocking issues such as uninstalling an incompatible app or freeing up space on the system drive. +- 3 new rules added: AdvancedInstallerFailed, MigrationAbortedDueToPluginFailure, DISMAddPackageFailed. 05/30/2018 - SetupDiag v1.20 is released with 41 rules, as a standalone tool available from the Download Center. - - Fixed a bug in device install failure detection in online mode. - - Changed SetupDiag to work without an instance of setupact.log. Previously, SetupDiag required at least one setupact.log to operate. This change enables the tool to analyze update failures that occur prior to calling SetupHost. - - Telemetry is refactored to only send the rule name and GUID (or “NoRuleMatched” if no rule is matched) and the Setup360 ReportId. This change assures data privacy during rule processing. +- Fixed a bug in device install failure detection in online mode. +- Changed SetupDiag to work without an instance of setupact.log. Previously, SetupDiag required at least one setupact.log to operate. This change enables the tool to analyze update failures that occur prior to calling SetupHost. +- Telemetry is refactored to only send the rule name and GUID (or “NoRuleMatched” if no rule is matched) and the Setup360 ReportId. This change assures data privacy during rule processing. 05/02/2018 - SetupDiag v1.10 is released with 34 rules, as a standalone tool available from the Download Center. - - A performance enhancment has been added to result in faster rule processing. - - Rules output now includes links to support articles, if applicable. - - SetupDiag now provides the path and name of files that it is processing. - - You can now run SetupDiag by simply clicking on it and then examining the output log file. - - An output log file is now always created, whether or not a rule was matched. +- A performance enhancment has been added to result in faster rule processing. +- Rules output now includes links to support articles, if applicable. +- SetupDiag now provides the path and name of files that it is processing. +- You can now run SetupDiag by simply clicking on it and then examining the output log file. +- An output log file is now always created, whether or not a rule was matched. 03/30/2018 - SetupDiag v1.00 is released with 26 rules, as a standalone tool available from the Download Center. @@ -465,49 +420,121 @@ Refer to https://docs.microsoft.com/windows/deployment/upgrade/upgrade-error-cod ### XML log sample -``` +```xml - - 1.3.0.0 - DiskSpaceBlockInDownLevel - 6080AFAC-892E-4903-94EA-7A17E69E549E + + 1.6.0.0 + FindSPFatalError + A4028172-1B09-48F8-AD3B-86CDD7D55852 Offline - Microsoft Corporation - Virtual Machine - x64 + Gigabyte Technology Co., Ltd. + X470 AORUS ULTRA GAMING + 1033 UEFI - 20171012000000.000000+000 - Hyper-V UEFI Release v2.5 - Hyper-V UEFI Release v2.5 - 10.0.14393 - 14393.1794.amd64fre.rs1_release.171008-1615 - 10.0.16299.15 (rs3_release.170928-1534) - 1033 - Core - + 20180808000000.000000+000 + F3 + + 10.0.18908 + 18908.1000.amd64fre.rs_prerelease.190524-1658 + 10.0.18912.1001 (rs_prerelease.190601-1739) + + Professional + Windows Defender - 2017-12-21T12:56:22 + 2019-06-06T21:19:10 - 2017-12-21T13:22:46 + 2019-06-06T22:21:49 0001-01-01T00:00:00 0001-01-01T00:00:00 + 0001-01-01T00:00:00 + 0001-01-01T00:00:00 + Offline - 06600fcd-acc0-40e4-b7f8-bb984dc8d05a - 06600fcd-acc0-40e4-b7f8-bb984dc8d05a + MgUweCZk90KdwUiZ + F21F8FB6-00FD-4349-84FB-2AC75F389E73 + F21F8FB6-00FD-4349-84FB-2AC75F389E73 - Warning: Found Disk Space Hard Block. - You must free up at least "6603" MB of space on the System Drive, and try again. + 2019-06-06 21:47:11, Error SP Error converting install time 5/2/2019 to structure[gle=0x00000057] + +Error: SetupDiag reports Fatal Error. +Last Setup Phase = Downlevel +Last Setup Operation: Gather data, scope: EVERYTHING +Error: 0x00000057 + LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5/2/2019 to structure[gle=0x00000057] + LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5/2/2019 to structure[gle=0x00000057] + +Refer to "https://docs.microsoft.com/windows/desktop/Debug/system-error-codes" for error information. + Err = 0x00000057, LastOperation = Gather data, scope: EVERYTHING, LastPhase = Downlevel ``` ### JSON log sample ``` -{"Version":"1.3.0.0","ProfileName":"DiskSpaceBlockInDownLevel","ProfileGuid":"6080AFAC-892E-4903-94EA-7A17E69E549E","SystemInfo":{"BiosReleaseDate":"20171012000000.000000+000","BiosVendor":"Hyper-V UEFI Release v2.5","BiosVersion":"Hyper-V UEFI Release v2.5","CV":null,"CommercialId":"Offline","FilterDrivers":"","FirmwareType":"UEFI","HostOSArchitecture":"x64","HostOSBuildString":"14393.1794.amd64fre.rs1_release.171008-1615","HostOSEdition":"Core","HostOSLanguageId":"1033","HostOSVersion":"10.0.14393","MachineName":"Offline","Manufacturer":"Microsoft Corporation","Model":"Virtual Machine","RegisteredAV":"","ReportId":"06600fcd-acc0-40e4-b7f8-bb984dc8d05a","RollbackElapsedTime":"PT0S","RollbackEndTime":"\/Date(-62135568000000-0800)\/","RollbackStartTime":"\/Date(-62135568000000-0800)\/","SDMode":1,"SetupReportId":"06600fcd-acc0-40e4-b7f8-bb984dc8d05a","TargetOSArchitecture":null,"TargetOSBuildString":"10.0.16299.15 (rs3_release.170928-1534)","UpgradeElapsedTime":"PT26M24S","UpgradeEndTime":"\/Date(1513891366000-0800)\/","UpgradeStartTime":"\/Date(1513889782000-0800)\/"},"FailureData":["Warning: Found Disk Space Hard Block."],"DeviceDriverInfo":null,"Remediation":["You must free up at least \"6603\" MB of space on the System Drive, and try again."]} +{ + "Version":"1.6.0.0", + "ProfileName":"FindSPFatalError", + "ProfileGuid":"A4028172-1B09-48F8-AD3B-86CDD7D55852", + "SystemInfo":{ + "BiosReleaseDate":"20180808000000.000000+000", + "BiosVendor":"F3", + "BiosVersion":"F3", + "CV":"MgUweCZk90KdwUiZ", + "CommercialId":"Offline", + "FilterDrivers":"", + "FinalizeStartTime":"\/Date(-62135568000000-0800)\/", + "FirmwareType":"UEFI", + "HostOSArchitecture":"x64", + "HostOSBuildString":"18908.1000.amd64fre.rs_prerelease.190524-1658", + "HostOSEdition":"Professional", + "HostOSLanguageId":"", + "HostOSVersion":"", + "MachineName":"Offline", + "Manufacturer":"Gigabyte Technology Co., Ltd.", + "Model":"X470 AORUS ULTRA GAMING", + "PostOOBESuccessTime":"\/Date(-62135568000000-0800)\/", + "RegisteredAV":"Windows Defender", + "ReportId":"F21F8FB6-00FD-4349-84FB-2AC75F389E73", + "RollbackElapsedTime":"PT0S", + "RollbackEndTime":"\/Date(-62135568000000-0800)\/", + "RollbackStartTime":"\/Date(-62135568000000-0800)\/", + "SetupReportId":"F21F8FB6-00FD-4349-84FB-2AC75F389E73", + "TargetOSArchitecture":null, + "TargetOSBuildString":"10.0.18912.1001 (rs_prerelease.190601-1739)", + "TotalOfflineTime":"PT0S", + "UpgradeElapsedTime":"PT1H2M39S", + "UpgradeEndTime":"\/Date(1559884909000-0700)\/", + "UpgradeStartTime":"\/Date(1559881150000-0700)\/" + }, + "LogErrorLine":"2019-06-06 21:47:11, Error SP Error converting install time 5\/2\/2019 to structure[ + gle=0x00000057 + ]", + "FailureData":[ + "\u000aError: SetupDiag reports Fatal Error.\u000aLast Setup Phase = Downlevel\u000aLast Setup Operation: Gather data, scope: EVERYTHING\u000aError: 0x00000057", + "LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5\/2\/2019 to structure[ + gle=0x00000057 + ]", + "LogEntry: 2019-06-06 21:47:11, Error SP Error converting install time 5\/2\/2019 to structure[ + gle=0x00000057 + ]", + "\u000aRefer to \"https:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/Debug\/system-error-codes\" for error information." + ], + "FailureDetails":"Err = 0x00000057, LastOperation = Gather data, scope: EVERYTHING, LastPhase = Downlevel", + "DeviceDriverInfo":null, + "Remediation":[ + + ], + "SetupPhaseInfo":null, + "SetupOperationInfo":null +} ``` +## Sample registry key + +![Addreg](./../images/addreg.png) + ## Related topics [Resolve Windows 10 upgrade errors: Technical information for IT Pros](https://docs.microsoft.com/windows/deployment/upgrade/resolve-windows-10-upgrade-errors) diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md index a3241982d6..64716a73e7 100644 --- a/windows/deployment/upgrade/submit-errors.md +++ b/windows/deployment/upgrade/submit-errors.md @@ -1,74 +1,76 @@ ---- -title: Submit Windows 10 upgrade errors using Feedback Hub -description: Submit Windows 10 upgrade errors for diagnosis using feedback hub -keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, feedback -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: greg-lindsay -ms.date: 03/16/2018 -ms.localizationpriority: medium -ms.topic: article ---- - -# Submit Windows 10 upgrade errors using Feedback Hub - -**Applies to** -- Windows 10 - ->[!NOTE] ->This is a 100 level topic (basic).
                                ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - -## In this topic - -This topic describes how to submit problems with a Windows 10 upgrade to Microsoft using the Windows 10 Feedback Hub. - -## About the Feedback Hub - -The Feedback Hub app lets you tell Microsoft about any problems you run in to while using Windows 10 and send suggestions to help us improve your Windows experience. Previously, you could only use the Feedback Hub if you were in the Windows Insider Program. Now anyone can use this tool. You can download the Feedback Hub app from the Microsoft Store [here](https://www.microsoft.com/en-us/store/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0). - -The Feedback Hub requires Windows 10 or Windows 10 mobile. If you are having problems upgrading from an older version of Windows to Windows 10, you can use the Feedback Hub to submit this information, but you must collect the log files from the legacy operating system and then attach these files to your feedback using a device that is running Windows 10. If you are upgrading to Windows 10 from a previous verion of Windows 10, the Feedback Hub will collect log files automatically. - -## Submit feedback - -To submit feedback about a failed Windows 10 upgrade, click the following link: [Feedback Hub](feedback-hub://?referrer=resolveUpgradeErrorsPage&tabid=2&contextid=81&newFeedback=true&feedbackType=2&topic=submit-errors.md)  - -The Feedback Hub will open. - -- Under **Tell us about it**, and then under **Summarize your issue**, type **Upgrade failing**. -- Under **Give us more detail**, provide additional information about the failed upgrade, such as: - - When did the failure occur? - - Were there any reboots? - - How many times did the system reboot? - - How did the upgrade fail? - - Were any error codes visible? - - Did the computer fail to a blue screen? - - Did the computer automatically roll back or did it hang, requiring you to power cycle it before it rolled back? -- Additional details - - What type of security software is installed? - - Is the computer up to date with latest drivers and firmware? - - Are there any external devices connected? -- If you used the link above, the category and subcategory will be automatically selected. If it is not selected, choose **Install and Update** and **Windows Installation**. - -You can attach a screenshot or file if desired. This is optional, but can be extremely helpful when diagnosing your upgrade issue. The location of these files is described here: [Windows Setup log files and event logs](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-log-files-and-event-logs). - -Click **Submit** to send your feedback. - -See the following example: - -![feedback example](../images/feedback.png) - -After you click Submit, that's all you need to do. Microsoft will receive your feedback and begin analyzing the issue. You can check on your feedback periodically to see what solutions have been provided. - -## Link to your feedback - -After your feedback is submitted, you can email or post links to it by opening the Feedback Hub, clicking My feedback at the top, clicking the feedback item you submitted, clicking **Share**, then copying the short link that is displayed. - -![share](../images/share.jpg) - -## Related topics - -[Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx) - +--- +title: Submit Windows 10 upgrade errors using Feedback Hub +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Submit Windows 10 upgrade errors for diagnosis using feedback hub +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, feedback +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Submit Windows 10 upgrade errors using Feedback Hub + +**Applies to** +- Windows 10 + +>[!NOTE] +>This is a 100 level topic (basic).
                                +>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. + +## In this topic + +This topic describes how to submit problems with a Windows 10 upgrade to Microsoft using the Windows 10 Feedback Hub. + +## About the Feedback Hub + +The Feedback Hub app lets you tell Microsoft about any problems you run in to while using Windows 10 and send suggestions to help us improve your Windows experience. Previously, you could only use the Feedback Hub if you were in the Windows Insider Program. Now anyone can use this tool. You can download the Feedback Hub app from the Microsoft Store [here](https://www.microsoft.com/store/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0). + +The Feedback Hub requires Windows 10 or Windows 10 mobile. If you are having problems upgrading from an older version of Windows to Windows 10, you can use the Feedback Hub to submit this information, but you must collect the log files from the legacy operating system and then attach these files to your feedback using a device that is running Windows 10. If you are upgrading to Windows 10 from a previous verion of Windows 10, the Feedback Hub will collect log files automatically. + +## Submit feedback + +To submit feedback about a failed Windows 10 upgrade, click the following link: [Feedback Hub](feedback-hub://?referrer=resolveUpgradeErrorsPage&tabid=2&contextid=81&newFeedback=true&feedbackType=2&topic=submit-errors.md)  + +The Feedback Hub will open. + +- Under **Tell us about it**, and then under **Summarize your issue**, type **Upgrade failing**. +- Under **Give us more detail**, provide additional information about the failed upgrade, such as: + - When did the failure occur? + - Were there any reboots? + - How many times did the system reboot? + - How did the upgrade fail? + - Were any error codes visible? + - Did the computer fail to a blue screen? + - Did the computer automatically roll back or did it hang, requiring you to power cycle it before it rolled back? +- Additional details + - What type of security software is installed? + - Is the computer up to date with latest drivers and firmware? + - Are there any external devices connected? +- If you used the link above, the category and subcategory will be automatically selected. If it is not selected, choose **Install and Update** and **Windows Installation**. + +You can attach a screenshot or file if desired. This is optional, but can be extremely helpful when diagnosing your upgrade issue. The location of these files is described here: [Windows Setup log files and event logs](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-log-files-and-event-logs). + +Click **Submit** to send your feedback. + +See the following example: + +![feedback example](../images/feedback.png) + +After you click Submit, that's all you need to do. Microsoft will receive your feedback and begin analyzing the issue. You can check on your feedback periodically to see what solutions have been provided. + +## Link to your feedback + +After your feedback is submitted, you can email or post links to it by opening the Feedback Hub, clicking My feedback at the top, clicking the feedback item you submitted, clicking **Share**, then copying the short link that is displayed. + +![share](../images/share.jpg) + +## Related topics + +[Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx) + diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md index e89aab650c..c429b8496c 100644 --- a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md +++ b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md @@ -1,11 +1,15 @@ --- title: Troubleshoot Windows 10 upgrade errors - Windows IT Pro -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Understanding the Windows 10 upgrade process can help you troubleshoot errors when something goes wrong. Find out more with this guide. keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy +audience: itpro author: greg-lindsay ms.localizationpriority: medium ms.topic: article @@ -89,6 +93,6 @@ WIM = Windows image (Microsoft) [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
                                [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                                [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +
                                [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-/ifications)
                                [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
                                [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-readiness.md b/windows/deployment/upgrade/troubleshoot-upgrade-readiness.md deleted file mode 100644 index e020be4aad..0000000000 --- a/windows/deployment/upgrade/troubleshoot-upgrade-readiness.md +++ /dev/null @@ -1,3 +0,0 @@ ---- -redirect_url: /windows/deployment/update/windows-analytics-FAQ-troubleshooting ---- \ No newline at end of file diff --git a/windows/deployment/upgrade/upgrade-error-codes.md b/windows/deployment/upgrade/upgrade-error-codes.md index 398c6de350..9f3b61be3a 100644 --- a/windows/deployment/upgrade/upgrade-error-codes.md +++ b/windows/deployment/upgrade/upgrade-error-codes.md @@ -1,13 +1,16 @@ --- title: Upgrade error codes - Windows IT Pro -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Understand the error codes that may come up if something goes wrong during the Windows 10 upgrade process. keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy +audience: itpro author: greg-lindsay -ms.date: 08/18/2018 ms.localizationpriority: medium ms.topic: article --- @@ -27,7 +30,7 @@ If the upgrade process is not successful, Windows Setup will return two codes: 1. **A result code**: The result code corresponds to a specific Win32 or NTSTATUS error. 2. **An extend code**: The extend code contains information about both the *phase* in which an error occurred, and the *operation* that was being performed when the error occurred. ->For example, a result code of **0xC1900101** with an extend code of **0x4000D** will be returned as: **0xC1900101 - 0x4000D**. +For example, a result code of **0xC1900101** with an extend code of **0x4000D** will be returned as: **0xC1900101 - 0x4000D**. Note: If only a result code is returned, this can be because a tool is being used that was not able to capture the extend code. For example, if you are using the [Windows 10 Upgrade Assistant](https://support.microsoft.com/kb/3159635) then only a result code might be returned. @@ -36,7 +39,7 @@ Note: If only a result code is returned, this can be because a tool is being use ## Result codes ->A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue.
                                To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](resolution-procedures.md) section later in this article. +A result code of **0xC1900101** is generic and indicates that a rollback occurred. In most cases, the cause is a driver compatibility issue.
                                To troubleshoot a failed upgrade that has returned a result code of 0xC1900101, analyze the extend code to determine the Windows Setup phase, and see the [Resolution procedures](resolution-procedures.md) section later in this article. The following set of result codes are associated with [Windows Setup](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options) compatibility warnings: @@ -74,7 +77,8 @@ Some result codes are self-explanatory, whereas others are more generic and requ ## Extend codes ->**Important**: Extend codes reflect the current Windows 10 upgrade process, and might change in future releases of Windows 10. The codes discussed in this section apply to Windows 10 version 1607, also known as the Anniversary Update. +>[!IMPORTANT] +>Extend codes reflect the current Windows 10 upgrade process, and might change in future releases of Windows 10. The codes discussed in this section apply to Windows 10 version 1607, also known as the Anniversary Update. Extend codes can be matched to the phase and operation when an error occurred. To match an extend code to the phase and operation: @@ -87,7 +91,7 @@ The following tables provide the corresponding phase and operation for values of
                                - +
                                Extend code: phase
                                Extend code: phase
                                HexPhase
                                0SP_EXECUTION_UNKNOWN
                                1SP_EXECUTION_DOWNLEVEL @@ -99,7 +103,7 @@ The following tables provide the corresponding phase and operation for values of - + - @@ -69,7 +74,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -80,7 +84,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -91,7 +94,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -102,7 +104,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -113,7 +114,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -127,7 +127,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -138,7 +137,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -149,7 +147,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -160,7 +157,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -171,7 +167,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -182,7 +177,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -193,7 +187,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -204,7 +197,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -215,18 +207,16 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - - - - - + + + @@ -234,11 +224,10 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - - - - + + + @@ -247,9 +236,8 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - - + @@ -259,7 +247,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -273,7 +260,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - @@ -282,9 +268,8 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - - +
                                Extend code: operation
                                Extend code: operation
                                HexOperation @@ -152,6 +156,6 @@ For example: An extend code of **0x4000D**, represents a problem during phase 4 [Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx)
                                [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                                [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) +
                                [Windows 10 Specifications](https://www.microsoft.com/windows/Windows-/ifications)
                                [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro)
                                [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md b/windows/deployment/upgrade/upgrade-readiness-additional-insights.md deleted file mode 100644 index 7c3bfe6c23..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-additional-insights.md +++ /dev/null @@ -1,93 +0,0 @@ ---- -title: Upgrade Readiness - Additional insights -description: Explains additional features of Upgrade Readiness. -ms.prod: w10 -author: jaimeo -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness - Additional insights - -This topic provides information on additional features that are available in Upgrade Readiness to provide insights into your environment. These include: - -- [Spectre and Meltdown protections](#spectre-meltdown-protection-status): Status of devices with respect to their anti-virus, security update, and firmware updates related to protection from the "Spectre" and "Meltdown" vulnerabilities. -- [Site discovery](#site-discovery): An inventory of web sites that are accessed by client computers running Windows 7, Windows 8.1, or Windows 10 using Internet Explorer. -- [Office add-ins](#office-add-ins): A list of the Microsoft Office add-ins that are installed on client computers. - -## Spectre and Meltdown protection status -Microsoft has published guidance for IT Pros that outlines the steps you can take to improve protection against the hardware vulnerabilities known as "Spectre" and "Meltdown." See [Windows Client Guidance for IT Pros to protect against speculative execution side-channel vulnerabilities](https://go.microsoft.com/fwlink/?linkid=867468) for details about the vulnerabilities and steps you can take. - -Microsoft recommends three steps to help protect against the Spectre and Meltdown vulnerabilities: -- Verify that you are running a supported antivirus application. -- Apply all available Windows operating system updates, including the January 2018 and later Windows security updates. -- Apply any applicable processor firmware (microcode) updates provided by your device manufacturer(s). - -Upgrade Readiness reports on status of your devices in these three areas. - -![Spectre-Meltdown protection blades](../images/spectre-meltdown-prod-closeup.png) - ->[!IMPORTANT] ->To provide these blades with data, ensure that your devices can reach the endpoint **http://adl.windows.com**. (See [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started) for more about necessary endpoints and how to whitelist them.) - -### Anti-virus status blade -This blade helps you determine if your devices' anti-virus solution is compatible with the latest Windows operating system updates. It shows the number of devices that have an anti-virus solution with no known issues, issues reported, or an unknown status for a particular Windows security update. In the following example, an anti-virus solution that has no known issues with the January 3, 2018 Windows update is installed on about 2,800 devices. - -![Spectre-Meltdown antivirus blade](../images/AV-status-by-computer.png) - -### Security update status blade -This blade indicates whether a Windows security update that includes Spectre- or Meltdown-related fixes (January 3, 2018 or later) has been installed, as well as whether specific fixes have been disabled. Though protections are enabled by default on devices running Windows (but not Windows Server) operating systems, some IT administrators might choose to disable specific protections. In the following example, about 4,300 devices have a Windows security update that includes Spectre or Meltdown protections installed, and those protections are enabled. - -![Spectre-Meltdown antivirus blade](../images/win-security-update-status-by-computer.png) - ->[!IMPORTANT] ->If you are seeing computers with statuses of either “Unknown – action may be required” or “Installed, but mitigation status unknown,” it is likely that you need to whitelist the **http://adl.windows.com** endpoint. - -### Firmware update status blade -This blade reports the number of devices that have installed a firmware update that includes Spectre or Meltdown protections. The blade might report a large number of blank, “unknown”, or “to be determined” statuses at first. As CPU information is provided by partners, the blade will automatically update with no further action required on your part. - - - - -## Site discovery - -The IE site discovery feature in Upgrade Readiness provides an inventory of web sites that are accessed by client computers using Internet Explorer on Windows 7, Windows 8.1, and Windows 10. Site discovery does not include sites that are accessed using other Web browsers, such as Microsoft Edge. Site inventory information is provided as optional data related to upgrading to Windows 10 and Internet Explorer 11, and is meant to help prioritize compatibility testing for web applications. You can make more informed decisions about testing based on usage data. - -> [!NOTE] -> Site discovery data is disabled by default; you can find documentation on what is collected in the [Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965). After you turn on this feature, data is collected on all sites visited by Internet Explorer, except during InPrivate sessions. The data collection process is silent, without notification to the employee. You are responsible for ensuring that your use of this feature complies with all applicable local laws and regulatory requirements, including any requirements to provide notice to employees. - ->IE site discovery is disabled on devices running Windows 7 and Windows 8.1 that are in Switzerland and EU countries. - -In order to use site discovery, a separate opt-in is required; see [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started). - -### Review most active sites - -This blade indicates the most visited sites by computers in your environment. Review this list to determine which web applications and sites are used most frequently. The number of visits is based on the total number of views, and not by the number of unique devices accessing a page. - -For each site, the fully qualified domain name will be listed. You can sort the data by domain name or by URL. - -![Most active sites](../images/upgrade-analytics-most-active-sites.png) - -Click the name of any site in the list to drill down into more details about the visits, including the time of each visit and the computer name. - -![Site domain detail](../images/upgrade-analytics-site-domain-detail.png) - -### Review document modes in use - -This blade provides information about which document modes are used in the sites that are visited in your environment. Document modes are used to provide compatibility with older versions of Internet Explorer. Sites that use older technologies may require additional testing and are less likely to be compatible with Microsoft Edge. Counts are based on total page views and not the number of unique devices. For more information about document modes, see [Deprecated document modes](https://technet.microsoft.com/itpro/internet-explorer/ie11-deploy-guide/deprecated-document-modes). - -![Site activity by document mode](../images/upgrade-analytics-site-activity-by-doc-mode.png) - -### Run browser-related queries - -You can run predefined queries to capture more info, such as sites that have Enterprise Mode enabled, or the number of unique computers that have visited a site. For example, this query returns the most used ActiveX controls. You can modify and save the predefined queries. - -![](../images/upgrade-analytics-query-activex-name.png) - -## Office add-ins - -Office add-ins provides a list of the Microsoft Office add-ins in your environment, and enumerates the computers that have these add-ins installed. This information should not affect the upgrade decision workflow, but can be helpful to an administrator. - -## Related topics - -[Upgrade Readiness release notes](upgrade-readiness-release-notes.md) \ No newline at end of file diff --git a/windows/deployment/upgrade/upgrade-readiness-architecture.md b/windows/deployment/upgrade/upgrade-readiness-architecture.md deleted file mode 100644 index bba456b2e9..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-architecture.md +++ /dev/null @@ -1,32 +0,0 @@ ---- -title: Upgrade Readiness architecture (Windows 10) -description: Describes Upgrade Readiness architecture. -ms.prod: w10 -author: jaimeo -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness architecture - -Microsoft analyzes system, application, and driver diagnostic data to help you determine when computers are upgrade-ready, allowing you to simplify and accelerate Windows upgrades in your organization. The diagram below illustrates how Upgrade Readiness components work together in a typical installation. - - - -![Upgrade Readiness architecture](../images/ur-arch-diagram.png) - -After you enable Windows diagnostic data on user computers and install the compatibility update KB (1), user computers send computer, application and driver diagnostic data to a secure Microsoft data center through the Microsoft Data Management Service (2). After you configure Upgrade Readiness, diagnostic data is analyzed by the Upgrade Readiness Service (3) and pushed to your workspace (4). You can then use the Upgrade Readiness solution (5) to plan and manage Windows upgrades. - -For more information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see: - -[Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization)
                                -[Manage connections from Windows operating system components to Microsoft services](/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services)
                                -[Windows 7, Windows 8, and Windows 8.1 appraiser diagnostic data events and fields](https://go.microsoft.com/fwlink/?LinkID=822965)
                                - -##**Related topics** - -[Upgrade Readiness requirements](upgrade-readiness-requirements.md)
                                -[Upgrade Readiness release notes](upgrade-readiness-requirements.md#important-information-about-this-release)
                                -[Get started with Upgrade Readiness](upgrade-readiness-get-started.md)
                                diff --git a/windows/deployment/upgrade/upgrade-readiness-data-sharing.md b/windows/deployment/upgrade/upgrade-readiness-data-sharing.md deleted file mode 100644 index 9753f76d40..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-data-sharing.md +++ /dev/null @@ -1,57 +0,0 @@ ---- -title: Upgrade Readiness data sharing -description: Connectivity scenarios for data sharing with Upgrade Readiness -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: jaimeo -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness data sharing - -To enable data sharing with the Upgrade Readiness solution, the following endpoints must be accessible: - - -| **Endpoint** | **Function** | -|---------------------------------------------------------|-----------| -| `https://v10.vortex-win.data.microsoft.com/collect/v1`
                                `https://Vortex-win.data.microsoft.com/health/keepalive` | Connected User Experiences and Telemetry component endpoint. User computers send data to Microsoft through this endpoint. | -| `https://settings.data.microsoft.com/qos` | Enables the compatibility update KB to send data to Microsoft. | -| `https://go.microsoft.com/fwlink/?LinkID=544713`
                                `https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc` | This service provides driver information about whether there will be a driver available post-upgrade for the hardware on the system. | - -Whitelist these endpoints on your network. This might require working with your organizations's network security group. - -## Connectivity to the Internet - -There are several different methods your organization can use to connect to the Internet, and these methods can affect how authentication is performed by the deployment script. - -### Direct connection to the Internet - -This scenario is very simple since there is no proxy involved. If you are using a network firewall which is blocking outgoing traffic, please keep in mind that even though we provide DNS names for the endpoints needed to communicate to the Microsoft diagnostic data backend, We therefore do not recommend to attempt to whitelist endpoints on your firewall based on IP-addresses. - -In order to use the direct connection scenario, set the parameter **ClientProxy=Direct** in **runconfig.bat**. - -### Connection through the WinHTTP proxy - -This is the first and most simple proxy scenario. The WinHTTP stack was designed for use in services and does not support proxy autodetection, PAC scripts or authentication. - -In order to set the WinHTTP proxy system-wide on your computers, you need to -•Use the command netsh winhttp set proxy \:\ -•Set ClientProxy=System in runconfig.bat - -The WinHTTP scenario is most appropriate for customers who use a single proxy or f. If you have more advanced proxy requirements, refer to Scenario 3. - -If you want to learn more about proxy considerations on Windows, see [Understanding Web Proxy Configuration](https://blogs.msdn.microsoft.com/ieinternals/2013/10/11/understanding-web-proxy-configuration/). - -### Logged-in user’s Internet connection - -In order to accommodate complex proxy scenarios, we also support using the currently logged-in user’s internet connection. This scenario supports PAC scripts, proxy autodetection and authentication. Essentially, if the logged in user can reach the Windows diagnostic data endpoints, the diagnostic data client can send data. If runconfig.bat runs while no user is logged in, diagnostic data events get written into a buffer which gets flushed when a user logs in. - -In order to enable this scenario, you need: -- A current quality update Rollup for Windows 7, 8.1 or Windows 10 Version 1511. Updates shipped after October 2016 have the needed code -- Set the reg key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection\DisableEnterpriseAuthProxy to 0. If the value does not exist, create a new DWORD, name it DisableEnterpriseAuthProxy and set the value to 0. The deployment script will check this is configured correctly. -- Set ClientProxy=User in bat. - - diff --git a/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md b/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md deleted file mode 100644 index 38f7cf60aa..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-deploy-windows.md +++ /dev/null @@ -1,99 +0,0 @@ ---- -title: Upgrade Readiness - Get a list of computers that are upgrade ready (Windows 10) -description: Describes how to get a list of computers that are ready to be upgraded in Upgrade Readiness. -ms.prod: w10 -author: jaimeo -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness - Step 3: Deploy Windows - -All of your work up to now involved reviewing and resolving application and driver issues. Along the way, as you’ve resolved issues and decided which applications and drivers are ready to upgrade, you’ve been building a list of computers that are upgrade ready. -The blades in the **Deploy** section are: - -- [Deploy eligible computers](#deploy-eligible-computers) -- [Deploy computers by group](#computer-groups) - ->Computers that are listed in this step are assigned an **UpgradeDecision** value, and the total count of computers in each upgrade decision category is displayed. Additionally, computers are assigned an **UpgradeAssessment** value. This value is displayed by drilling down into a specific upgrade decision category. For information about upgrade assessment values, see [Upgrade assessment](#upgrade-assessment). - -## Deploy eligible computers - -In this blade, computers grouped by upgrade decision are listed. The upgrade decision on the machines is a calculated value based on the upgrade decision status for the apps and drivers installed on the computer. This value cannot be modified directly. The upgrade decision is calculated in the following ways: -- **Review in progress**: At least one app or driver installed on the computer is marked **Review in progress**. -- **Ready to upgrade**: All apps and drivers installed on the computer are marked as **Ready to Upgrade**. -- **Won’t upgrade**: At least one app or driver installed on the computer is marked as **Won’t upgrade**, or a system requirement is not met. - - - -![Deploy eligible computers](../images/ua-cg-16.png) - -Select **Export computers** for more details, including computer name, manufacturer and model, and Windows edition currently running on the computer. Sort or further query the data and then select **Export** to generate and save a comma-separated value (csv) list of upgrade-ready computers. - ->**Important**
                                When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export fewer items at a time. - -## Computer groups - -Computer groups allow you to segment your environment by creating device groups based on log search results, or by importing groups from Active Directory, WSUS or System Center Configuration Manager. Computer groups are an OMS feature. For more information, see [Computer groups in OMS](https://blogs.technet.microsoft.com/msoms/2016/04/04/computer-groups-in-oms/). - -Query based computer groups are recommended in the initial release of this feature. A feature known as **Configuration Manager Upgrade Readiness Connector** is anticipated in a future release that will enable synchronization of **ConfigMgr Collections** with computer groups in OMS. - -### Getting started with Computer Groups - -When you sign in to OMS, you will see a new blade entitled **Computer Groups**. See the following example: - -![Computer groups](../images/ua-cg-01.png) - -To create a computer group, open **Log Search** and create a query based on **Type=UAComputer**, for example: - -``` -Type=UAComputer Manufacturer=DELL -``` - -![Computer groups](../images/ua-cg-02.png) - -When you are satisfied that the query is returning the intended results, add the following text to your search: - -``` -| measure count() by Computer -``` - -This will ensure every computer only shows up once. Then, save your group by clicking **Save** and **Yes**. See the following example: - -![Computer groups](../images/ua-cg-03.png) - -Your new computer group will now be available in Upgrade Readiness. See the following example: - -![Computer groups](../images/ua-cg-04.png) - -### Using Computer Groups - -When you drill into a computer group, you will see that computers are categorized by **UpgradeDecision**. For computers with the status **Review in progress** or **Won’t upgrade** you can drill down to view issues that cause a computer to be in each category, or you can simply display a list of the computers in the category. For computers that are designated **Ready to upgrade**, you can go directly to the list of computers that are ready. - -![Computer groups](../images/ua-cg-05.png) - -Viewing a list of computers in a certain status is self-explanatory, Let’s look at what happens when you click the details link on **Review in progress**: - -![Computer groups](../images/ua-cg-06.png) - -Next, select if you want to see application issues (**UAApp**) or driver issues (**UADriver**). See the following example of selecting **UAApp**: - -![Computer groups](../images/ua-cg-07.png) - -A list of apps that require review so that Dell Computers are ready for upgrade to Windows 10 is displayed. - -### Upgrade assessment - -Upgrade assessment and guidance details are explained in the following table. - -| Upgrade assessment | Action required before or after upgrade pilot? | Issue | What it means | Guidance | -|-----------------------|------------------------------------------------|----------|-----------------|---------------| -| No known issues | No | None | Computers will upgrade seamlessly.
                                | OK to use as-is in pilot. | -| OK to pilot, fixed during upgrade | No, for awareness only | Application or driver will not migrate to new OS | The currently installed version of an application or driver won’t migrate to the new operating system; however, a compatible version is installed with the new operating system. | OK to use as-is in pilot. | -| OK to pilot with new driver from Windows Update | Yes | Driver will not migrate to new OS | The currently installed version of a driver won’t migrate to the new operating system; however, a newer, compatible version is available from Windows Update. | Although a compatible version of the driver is installed during upgrade, a newer version is available from Windows Update.

                                If the computer automatically receives updates from Windows Update, no action is required. Otherwise, replace the new in-box driver with the Windows Update version after upgrading.

                                | - -Select **Export computers** to view pilot-ready computers organized by operating system. After you select the computers you want to use in a pilot, click Export to generate and save a comma-separated value (csv) file. - ->**Important**> When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export fewer items at a time. \ No newline at end of file diff --git a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md b/windows/deployment/upgrade/upgrade-readiness-deployment-script.md deleted file mode 100644 index e7440a2195..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-deployment-script.md +++ /dev/null @@ -1,180 +0,0 @@ ---- -title: Upgrade Readiness deployment script (Windows 10) -description: Deployment script for Upgrade Readiness. -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: jaimeo -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness deployment script - -To automate the steps provided in [Get started with Upgrade Readiness](upgrade-readiness-get-started.md), and to troubleshoot data sharing issues, you can run the [Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409), developed by Microsoft. - ->[!IMPORTANT] ->Upgrade Readiness was previously called Upgrade Analytics. References to Upgrade Analytics in any scripts or online content pertain to the Upgrade Readiness solution. - -For detailed information about using the Upgrade Readiness (also known as upgrade analytics) deployment script, see the [Upgrade Analytics blog](https://techcommunity.microsoft.com/t5/Windows-Analytics-Blog/New-version-of-the-Upgrade-Analytics-Deployment-Script-available/ba-p/187164?advanced=false&collapse_discussion=true&q=new%20version%20of%20the%20upgrade%20analytics%20deployment%20script%20available&search_type=thread). - -> The following guidance applies to version 11.11.16 or later of the Upgrade Readiness deployment script. If you are using an older version, download the latest from the [Download Center](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409). - -The Upgrade Readiness deployment script does the following: - -1. Sets commercial ID key + CommercialDataOptIn + RequestAllAppraiserVersions keys. -2. Verifies that user computers can send data to Microsoft. -3. Checks whether the computer has a pending restart.   -4. Verifies that the latest version of KB package 10.0.x is installed (version 10.0.14348 or later is required, but version 10.0.14913 or later is recommended). -5. If enabled, turns on verbose mode for troubleshooting. -6. Initiates the collection of the diagnostic data that Microsoft needs to assess your organization’s upgrade readiness. -7. If enabled, displays the script’s progress in a cmd window, providing you immediate visibility into issues (success or fail for each step) and/or writes to log file. - -## Running the script - ->There should be no performance impact caused by the script. The script is a light wrapper of Windows in-box components that undergo performance testing and optimization to avoid any performance impact. However, typically the script is scheduled to be run outside of working hours. -> ->Do not run the script at each sign-on. It is recommended to run the script once every 30 days. -> ->The length of time the script takes to run on each system depends on the number of apps and drivers, and the type of hardware. Anti-virus software scanning simultaneously can increase the script run time, but the script should require no longer than 10 minutes to run, and typically the time is much shorter. If the script is observed running for an extended period of time, please run the Pilot script, and collect logs to share with Microsoft. Log files are created in the drive that is specified in the RunConfig.bat file. By default this is set to: **%SystemDrive%\UADiagnostics**. - -To run the Upgrade Readiness deployment script: - -1. Download the [Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) and extract the .zip file. Inside, there are two folders: **Pilot** and **Deployment**. The **Pilot** folder contains advanced logging that can help troubleshoot issues and is intended to be run from an elevated command prompt. The **Deployment** folder offers a lightweight script intended for broad deployment through ConfigMgr or other software deployment system. We recommend manually running the Pilot version of the script on 5-10 machines to verify that everything is configured correctly. Once you have confirmed that data is flowing successfully, proceed to run the Deployment version throughout your organization. - -2. Edit the following parameters in RunConfig.bat: - - 1. Provide a storage location for log information. You can store log information on a remote file share or a local directory. If the script is blocked from creating the log file for the given path, it creates the log files in the drive with the Windows directory. Example: %SystemDrive%\\UADiagnostics - - 2. Input your commercial ID key. To find your commercial ID, first navigate to the **Solutions** tab for your workspace, and then select the solution. From there, select the **Settings** page, where you can find and copy your commercial ID: - - 3. By default, the script sends log information to both the console and the log file. To change the default behavior, use one of the following options: - - > *logMode = 0 log to console only* - > - > *logMode = 1 log to file and console* - > - > *logMode = 2 log to file only* - -3. To enable Internet Explorer data collection, set AllowIEData to IEDataOptIn. By default, AllowIEData is set to Disable. Then use one of the following options to determine what Internet Explorer data can be collected: - - > *IEOptInLevel = 0 Internet Explorer data collection is disabled* - > - > *IEOptInLevel = 1 Data collection is enabled for sites in the Local intranet + Trusted sites + Machine local zones* - > - > *IEOptInLevel = 2 Data collection is enabled for sites in the Internet + Restricted sites zones* - > - > *IEOptInLevel = 3 Data collection is enabled for all sites* - -4. A recent version (03.02.17) of the deployment script is configured to collect and send diagnostic and debugging data to Microsoft. If you wish to disable sending diagnostic and debugging data to Microsoft, set **AppInsightsOptIn = false**. By default, **AppInsightsOptIn** is set to **true**. - - The data that is sent is the same data that is collected in the text log file that captures the events and error codes while running the script. This file is named in the following format: **UA_yyyy_mm_dd_hh_mm_ss_machineID.txt**. Log files are created in the drive that is specified in the RunConfig.bat file. By default this is set to: **%SystemDrive%\UADiagnostics**. - - This data gives us the ability to determine the status of your machines and to help troubleshoot issues. If you choose to opt-in to and send this data to Microsoft, you must also allow https traffic to be sent to the following wildcard endpoints: - - \*vortex\*.data.microsoft.com
                                - \*settings\*.data.microsoft.com - -5. The latest version (03.28.2018) of the deployment script configures insider builds to continue to send the device name to the diagnostic data management service and the analytics portal. If you do not want to have insider builds send the device name sent to analytics and be available in the analytics portal, set **DeviceNAmeOptIn = false**. By default it is true, which preserves the behavior on previous versions of Windows. This setting only applies to insider builds. Note that the device name is also sent to AppInsights, so to ensure the device name is not sent to either place you would need to also set **AppInsightsOptIn = false**. - -6. After you finish editing the parameters in RunConfig.bat, you are ready to run the script. If you are using the Pilot version, run RunConfig.bat from an elevated command prompt. If you are using the Deployment version, use ConfigMgr or other software deployment service to run RunConfig.bat as system. - -## Exit codes - -The deployment script displays the following exit codes to let you know if it was successful, or if an error was encountered. - -| Exit code | Suggested fix | -|-----------|--------------| -| 0 - Success | N/A | -| 1 - Unexpected error occurred while executing the script. | The files in the deployment script are likely corrupted. Download the [latest script](https://go.microsoft.com/fwlink/?LinkID=822966) from the download center and try again. | -| 2 - Error when logging to console. $logMode = 0. (console only) | Try changing the $logMode value to **1** and try again. $logMode value 1 logs to both console and file. | -| 3 - Error when logging to console and file. $logMode = 1. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. | -| 4 - Error when logging to file. $logMode = 2. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. | -| 5 - Error when logging to console and file. $logMode = unknown. | Verify that you have set the logPath parameter in RunConfig.bat, and that the configuration script has access to connect and write to this location. | -| 6 - The commercialID parameter is set to unknown. | Modify the runConfig.bat file to set the CommercialID value. The value for parameter in the runconfig.bat file should match the Commercial ID key for your workspace. See [Generate your Commercial ID key](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#generate-your-commercial-id-key) for instructions on generating a Commercial ID key for your workspace. | -| 8 - Failure to create registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection**. The Commercial Id property is set at the following registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the context under which the script in running has access to the registry key. | -| 9 - The script failed to write Commercial Id to registry. -Error creating or updating registry key: **CommercialId** at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the context under which the script in running has access to the registry key. | -| 10 - Error when writing **CommercialDataOptIn** to the registry at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the deployment script is running in a context that has access to the registry key. | -| 11 - Function **SetupCommercialId** failed with an unexpected exception. The **SetupCommercialId** function updates the Commercial Id at the registry key path: **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | Verify that the configuration script has access to this location. | -| 12 - Can’t connect to Microsoft - Vortex. Check your network/proxy settings. | **Http Get** on the end points did not return a success exit code. For Windows 10, connectivity is verified by connecting to https://v10.vortex-win.data.microsoft.com/health/keepalive. For previous operating systems, connectivity is verified by connecting to https://vortex-win.data.microsoft.com/health/keepalive. If there is an error verifying connectivity, this will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md) | -| 13 - Can’t connect to Microsoft - setting. | An error occurred connecting to https://settings.data.microsoft.com/qos. This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#enable-data-sharing). Verify that the required endpoints are whitelisted correctly. See Whitelist select endpoints for more details. | -| 14 - Can’t connect to Microsoft - compatexchange. An error occurred connecting to [CompatibilityExchangeService.svc](https://compatexchange1.trafficmanager.net/CompatibilityExchangeService.svc). | This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md). | -| 15 - Function CheckVortexConnectivity failed with an unexpected exception. | This error will prevent the collected data from being sent to Upgrade Readiness. To resolve this issue, verify that the required endpoints are correctly whitelisted. For more information, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md). Check the logs for the exception message and the HResult. | -| 16 - The computer requires a reboot before running the script. | Restart the device to complete the installation of the compatibility update and related updates. Reboot the computer before running the Upgrade Readiness deployment script. | -| 17 - Function **CheckRebootRequired** failed with an unexpected exception. | Restart the device to complete installation of the compatibility update and related updates. Check the logs for the exception message and the HResult. | -|18 - Appraiser KBs not installed or **appraiser.dll** not found. | Either the Appraiser-related updates are not installed, or the **appraiser.dll** file was not found. For more information, see appraiser diagnostic data events and fields information in the [Data collection](https://technet.microsoft.com/itpro/windows/deploy/upgrade-readiness-get-started#data-collection-and-privacy) and privacy topic. | -| 19 - Function **CheckAppraiserKB**, which checks the compatibility update KBs, failed with unexpected exception. | Check the logs for the Exception message and HResult. The script will not run further if this error is not fixed. | -| 20 - An error occurred when creating or updating the registry key **RequestAllAppraiserVersions** at **HKLM:\SOFTWARE\Microsoft\WindowsNT \CurrentVersion\AppCompatFlags\Appraiser** | The registry key is required for data collection to work correctly. Verify that the script is running in a context that has access to the registry key. | -| 21 - Function **SetRequestAllAppraiserVersions** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 22 - **RunAppraiser** failed with unexpected exception. | Check the logs for the exception message and HResult. Check the **%windir%\System32** directory for the file **CompatTelRunner.exe**. If the file does not exist, reinstall the required compatibility updates which include this file, and check your organization's Group Policy to verify it does not remove this file. | -| 23 - Error finding system variable **%WINDIR%**. | Verify that this environment variable is configured on the computer. | -| 24 - The script failed when writing **IEDataOptIn** to the registry. An error occurred when creating registry key **IEOptInLevel** at **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | This is a required registry key for IE data collection to work correctly. Verify that the deployment script in running in a context that has access to the registry key. Check the logs for the exception message and HResult. | -| 25 - The function **SetIEDataOptIn** failed with unexpected exception. | Check the logs for the exception message and HResult. | -| 27 - The script is not running under **System** account. | The Upgrade Readiness configuration script must be run as **System**. | -| 28 - Could not create log file at the specified **logPath**. | Make sure the deployment script has access to the location specified in the **logPath** parameter. | -| 29 - Connectivity check failed for proxy authentication. | Install cumulative updates on the device and enable the **DisableEnterpriseAuthProxy** authentication proxy setting. The **DisableEnterpriseAuthProxy** setting is enabled by default for Windows 7\. For Windows 8.1 computers, set the **DisableEnterpriseAuthProxy** setting to **0** (not disabled). For more information on authentication proxy support, see [Authentication proxy support added in new version (12.28.16) of the Upgrade Readiness deployment script](https://go.microsoft.com/fwlink/?linkid=838688). | -| 30 - Connectivity check failed. Registry key property **DisableEnterpriseAuthProxy** is not enabled. | The **DisableEnterpriseAuthProxy** setting is enabled by default for Windows 7\. For Windows 8.1 computers, set the **DisableEnterpriseAuthProxy** setting to **0** (not disabled). For more information on authentication proxy support, see [this blog post](https://go.microsoft.com/fwlink/?linkid=838688). | -| 31 - There is more than one instance of the Upgrade Readiness data collector running at the same time on this computer. Use Task Manager to check if **CompatTelRunner.exe** is running, and wait until it has completed to rerun the script. The Upgrade Readiness task is scheduled by default to run daily at 0300. | -| 32 - Appraiser version on the machine is outdated. | The configuration script detected a version of the compatibility update module that is older than the minimum required to correctly collect the data required by Upgrade Readiness solution. Use the latest version of the [compatibility update](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started#deploy-the-compatibility-update-and-related-updates) for Windows 7 SP1/Windows 8.1. | -| 33 - **CompatTelRunner.exe** exited with an exit code | **CompatTelRunner.exe** runs the appraise task on the device. If it fails, it will provide a specific exit code. The script will return exit code 33 when **CompatTelRunner.exe** itself exits with an exit code. Check the logs for more details. Also see the **Note** following this table for additional steps to follow. | -| 34 - Function **CheckProxySettings** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 35 - Function **CheckAuthProxy** failed with an unexpected exception. Check the logs for the exception message and HResult. | -| 36 - Function **CheckAppraiserEndPointsConnectivity** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 37 - **Diagnose_internal.cmd** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 38 - Function **Get-SqmID** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 39 - For Windows 10: AllowTelemetry property is not set to 1 or higher at registry key path **HKLM:\SOFTWARE\Policies\Microsoft \Windows\DataCollection** or **HKLM:\SOFTWARE\Microsoft\Windows \CurrentVersion\Policies\DataCollection** | For Windows 10 devices, the **AllowTelemetry** property should be set to 1 or greater to enable data collection. The script will return an error if this is not true. For more information, see [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization). | -| 40 - Function **CheckTelemetryOptIn** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 41 - The script failed to impersonate the currently logged on user. | The script mimics the UTC client to collect upgrade readiness data. When auth proxy is set, the UTC client impersonates the user that is logged on. The script also tries to mimic this, but the process failed. | -| 42 - Function **StartImpersonatingLoggedOnUser** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 43 - Function **EndImpersonatingLoggedOnUser** failed with an unexpected exception. | Check the logs for the exception message and HResult. | -| 44 - Diagtrack.dll version is old, so Auth Proxy will not work. | Update the device using Windows Update or Windows Server Update Services. | -| 45 - Diagtrack.dll was not found. | Update the device using Windows Update or Windows Server Update Services. | -| 48 - **CommercialID** mentioned in RunConfig.bat should be a GUID. | Copy the commercial ID from your workspace. To find your commercial ID, first navigate to the Solutions tab for your workspace in Azure Portal, and then select the solution. From there, select the **Settings** page, where you can find and copy your commercial ID.| -| 50 - Diagtrack Service is not running. | The Diagtrack service is required to send data to Microsoft. Enable and run the "Connected User Experiences and Telemetry" service. | -| 51 - RunCensus failed with an unexpected exception. | RunCensus explitly runs the process used to collect device information. The method failed with an unexpected exception. The most common cause is incorrect setup of diagnostic data. Check the ExceptionHResult and ExceptionMessage for more details. | -| 52 - DeviceCensus.exe not found on a Windows 10 machine. | On computers running Windows 10, the process devicecensus.exe should be present in the \system32 directory. Error code 52 is returned if the process was not found. Ensure that it exists at the specified location. | -| 53 - There is a different CommercialID present at the GPO path: **HKLM:\SOFTWARE\Policies\Microsoft \Windows\DataCollection**. This will take precedence over the CommercialID provided in the script. | Provide the correct CommercialID at the GPO location. | -| 54 - Microsoft Account Sign In Assistant Service is Disabled. | This service is required for devices running Windows 10. The diagnostic data client relies on the Microsoft Account Sign In Assistant (MSA) to get the Global Device ID for the device. Without the MSA service running, the global device ID will not be generated and sent by the client and Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are). | -| 55 - SetDeviceNameOptIn function failed to create registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | The function SetDeviceNameOptIn sets the registry key value which determines whether to send the device name in diagnostic data. The function tries to create the registry key path if it does not already exist. Verify that the account has the correct permissions to change or add registry keys. | -| 56 - SetDeviceNameOptIn function failed to create property AllowDeviceNameInTelemetry at registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | Verify that the account has the correct permissions to change or add registry keys.| -| 57 - SetDeviceNameOptIn function failed to update AllowDeviceNameInTelemetry property to value 1 at registry key path: **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection** | Verify that the account has the correct permissions to change or add registry keys. | -| 58 - SetDeviceNameOptIn function failed with unexpected exception | The function SetDeviceNameOptIn failed with an unexpected exception. | -| 59 - CleanupOneSettings failed to delete LastPersistedEventTimeOrFirstBoot property at registry key path: **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\Diagtrack** |The CleanupOneSettings function clears some of the cached values needed by the Appraiser which is the data collector on the monitored device. This helps in the download of the most recent for accurate running of the data collector. Verify that the account has the correct permissions to change or add registry keys. | -| 60 - CleanupOneSettings failed to delete registry key: **HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\ Diagnostics\Diagtrack\SettingsRequests** | Verify that the account has the correct permissions to change or add registry keys. | -| 61 - CleanupOneSettings failed with an exception | CleanupOneSettings failed with an unexpected exception. | -| 63 - Diagnostic data is disabled for the device | If AllowTelemetry == 0, devices cannot send diagnostic data. To resolve this, set the **AllowTelemetry** value at **HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection**. | - - - - - - - ->[!NOTE] ->**Additional steps to follow if you receive exit code 33** - ->Check the exit code for any of these messages: -> ->- CompatTelRunner.exe exited with last error code: 0x800703F1 ->- CompatTelRunner.exe exited with last error code: 0x80070005 ->- CompatTelRunner.exe exited with last error code: 0x80080005 ->  -> ->If the exit code includes any of those messages, then run these commands from an elevated command prompt: -> ->1. Net stop diagtrack ->2. Net stop pcasvc ->3. Net stop dps ->4. Del %windir%\appcompat\programs\amcache.hve ->5. reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v AmiHivePermissionsCorrect /f ->6. reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" /v LogFlags /t REG_DWORD /d 4 /f ->7. Net start diagtrack ->8. Net start pcasvc ->9. Net start dps -> ->Then run the Enterprise Config script (RunConfig.bat) again.  -> ->If the script still fails, then send mail to **uasupport@microsoft.com** including log files from the RunConfig.bat script. These log files are stored on the drive that is specified in the RunConfig.bat file. By default this is set to **%SystemDrive%\UADiagnostics**. The log file is named with the format **UA_yyyy_mm_dd_hh_mm_ss_machineID.txt**. There will be some additional logs generated under your **\Windows\Temp** directory with the names similar to **AslLog_....txt**. You should send those logs as well. - diff --git a/windows/deployment/upgrade/upgrade-readiness-get-started.md b/windows/deployment/upgrade/upgrade-readiness-get-started.md deleted file mode 100644 index 58c217bda4..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-get-started.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Get started with Upgrade Readiness (Windows 10) -description: Explains how to get started with Upgrade Readiness. -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics, -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: jaimeo -ms.author: jaimeo -ms.localizationpriority: medium -ms.topic: article -ms.collection: M365-analytics ---- - -# Get started with Upgrade Readiness - ->[!IMPORTANT] ->**The OMS portal has been deprecated; you should start using the [Azure portal](https://portal.azure.com) instead as soon as possible.** Many experiences are the same in the two portals, but there are some key differences. See [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md) for steps to use Windows Analytics in the Azure portal. For much more information about the transition from OMS to Azure, see [OMS portal moving to Azure](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-portal-transition). - -This topic explains how to obtain and configure Upgrade Readiness for your organization. - -You can use Upgrade Readiness to plan and manage your upgrade project end-to-end. Upgrade Readiness works by establishing communications between computers in your organization and Microsoft. Upgrade Readiness collects computer, application, and driver data for analysis. This data is used to identify compatibility issues that can block your upgrade and to suggest fixes that are known to Microsoft. - -Before you begin, consider reviewing the following helpful information:
                                - - [Upgrade Readiness requirements](upgrade-readiness-requirements.md): Provides detailed requirements to use Upgrade Readiness.
                                - - [Upgrade Readiness blog](https://aka.ms/blog/WindowsAnalytics): Contains announcements of new features and provides helpful tips for using Upgrade Readiness. - ->If you are using System Center Configuration Manager, also check out information about how to integrate Upgrade Readiness with Configuration Manager: [Integrate Upgrade Readiness with System Center Configuration Manager](https://docs.microsoft.com/sccm/core/clients/manage/upgrade/upgrade-analytics). - -When you are ready to begin using Upgrade Readiness, perform the following steps: - -1. Review [data collection and privacy](#data-collection-and-privacy) information. -2. [Add the Upgrade Readiness solution to your Azure subsctiption](#add-the-upgrade-readiness-solution-to-your-Azure-subscription). -3. [Enroll devices in Windows Analytics](#enroll-devices-in-windows-analytics). -4. [Use Upgrade Readiness to manage Windows Upgrades](#use-upgrade-readiness-to-manage-windows-upgrades) once your devices are enrolled. - -## Data collection and privacy - -To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see the following topics, refer to [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-FAQ-troubleshooting), which discusses the issues and provides links to still more detailed information. - -## Add the Upgrade Readiness solution to your Azure subscription - -Upgrade Readiness is offered as a *solution* which you link to a new or existing [Azure Log Analytics](https://azure.microsoft.com/services/log-analytics/) *workspace* within your Azure *subscription*. To configure this, follows these steps: - -1. Sign in to the [Azure Portal](https://portal.azure.com) with your work or school account or a Microsoft account. If you don't already have an Azure subscription you can create one (including free trial options) through the portal. - - >[!NOTE] - > Upgrade Readiness is included at no additional cost with Windows 10 Professional, Education, and Enterprise editions. An Azure subscription is required for managing and using Upgrade Readiness, but no Azure charges are expected to accrue to the subscription as a result of using Upgrade Readiness. - -2. In the Azure portal select **Create a resource**, search for "Upgrade Readiness", and then select **Create** on the **Upgrade Readiness** solution. - ![Azure portal page highlighting + Create a resource and with Upgrade Readiness selected](../images/UR-Azureportal1.png) - - ![Azure portal showing Upgrade Readiness fly-in and Create button highlighted(images/CreateSolution-Part2-Create.png)](../images/UR-Azureportal2.png) -3. Choose an existing workspace or create a new workspace to host the Upgrade Readiness solution. - ![Azure portal showing Log Analytics workspace fly-in](../images/UR-Azureportal3.png) - - If you are using other Windows Analytics solutions (Device Health or Update Compliance) you should add Upgrade Readiness to the same workspace. - - If you are creating a new workspace, and your organization does not have policies governing naming conventions and structure, consider the following workspace settings to get started: - - Choose a workspace name which reflects the scope of planned usage in your organization, for example *PC-Analytics*. - - For the resource group setting select **Create new** and use the same name you chose for your new workspace. - - For the location setting, choose the Azure region where you would prefer the data to be stored. - - For the pricing tier select **Free**. -4. Now that you have selected a workspace, you can go back to the Upgrade Readiness blade and select **Create**. - ![Azure portal showing workspace selected and with Create button highlighted](../images/UR-Azureportal4.png) -5. Watch for a Notification (in the Azure portal) that "Deployment 'Microsoft.CompatibilityAssessmentOMS' to resource group 'YourResourceGroupName' was successful." and then select **Go to resource** This might take several minutes to appear. - ![Azure portal all services page with Log Analytics found and selected as favorite](../images/CreateSolution-Part5-GoToResource.png) - - Suggestion: Choose the **Pin to Dashboard** option to make it easy to navigate to your newly added Upgrade Readiness solution. - - Suggestion: If a "resource unavailable" error occurs when navigating to the solution, try again after one hour. - -## Enroll devices in Windows Analytics - - -Once you've added Upgrade Readiness to a workspace in your Azure subscription, you can start enrolling the devices in your organization. For full instructions, see [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started). - - - -## Use Upgrade Readiness to manage Windows Upgrades - -Now that your devices are enrolled, you can move on to [Use Upgrade Readiness to manage Windows Upgrades](https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades). diff --git a/windows/deployment/upgrade/upgrade-readiness-identify-apps.md b/windows/deployment/upgrade/upgrade-readiness-identify-apps.md deleted file mode 100644 index 0d0bf625ef..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-identify-apps.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -title: Upgrade Readiness - Identify important apps (Windows 10) -description: Describes how to prepare your environment so that you can use Upgrade Readiness to manage Windows upgrades. -ms.prod: w10 -author: jaimeo -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness - Step 1: Identify important apps - -This is the first step of the Upgrade Readiness workflow. In this step, applications are listed and grouped by importance level. Setting the importance level enables you to prioritize applications for upgrade. - - - -![Prioritize applications](../images/upgrade-analytics-prioritize.png) - -Select **Assign importance** to change an application’s importance level. By default, applications are marked **Not reviewed** or **Low install count** until you assign a different importance level to them. - -To change an application’s importance level: - -1. Select **Not reviewed** or **Low install count** on the **Prioritize applications** blade to view the list of applications with that importance level. -2. Select the applications you want to change to a specific importance level and then select the appropriate option from the **Select importance level** list. -3. Click **Save** when finished. - -Importance levels include: - -| Importance level | When to use it | Recommendation | -|--------------------|------------------|------------------| -| Low install count | We give you a head start by identifying applications that are installed on 2% or less of your total computer inventory. \[Number of computers application is installed on/total number of computers in your inventory.\]

                                Low install count applications are automatically marked as **Ready to upgrade** in the **UpgradeDecision** column unless they have issues that need attention.
                                | Be sure to review low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates. For example, payroll apps or tax accounting apps tend to be installed on a relatively small number of machines but are still considered business critical applications.

                                | -| Not reviewed | Applications that are installed on more than 2% of your total computer inventory are marked not reviewed until you set their importance level.

                                | Once you’ve started to investigate an application to determine its importance level and upgrade readiness, change its status to **Review in progress** in both the **Importance** and **UpgradeDecision** columns. | -| Business critical | By default, no applications are marked as business critical because only you can make that determination. If you know that an application is critical to your organization’s functioning, mark it **Business critical**.

                                | You may also want to change the application’s status to **Review in progress** in the **UpgradeDecision** column to let other team members know that you’re working on getting this business critical application upgrade-ready. Once you’ve fixed any issues and validated that the application will migrate successfully, change the upgrade decision to **Ready to upgrade**.
                                | -| Important | By default, no applications are marked as important because only you can make that determination. If the application is important but not critical to your organization’s functioning, mark it **Important**. | You may also want to change the application’s status to **Review in progress** in the **UpgradeDecision** column to let other team members know that you’re working on getting this important application upgrade-ready. Once you’ve fixed any issues and validated that the application will migrate successfully, change the upgrade decision to **Ready to upgrade**.
                                | -| Ignore | By default, no applications are marked as ignore because only you can make that determination. If the application is not important to your organization’s functioning, such as user-installed applications and games, you may not want to spend time and money validating that these applications will migrate successfully. Mark these applications **Ignore**.
                                | Set the application’s importance level to **Ignore** to let other team members know that it can be left as-is with no further investigation or testing. If you set the importance level to ignore, and this is an app that you are not planning on testing or validating, consider changing the upgrade decision to **Ready to upgrade**. By marking these apps ready to upgrade, you are indicating that you are comfortable upgrading with the app remaining in its current state.

                                | -| Review in progress | Once you’ve started to investigate an application to determine its importance level and upgrade readiness, change its status to **Review in progress** in both the **Importance** and **UpgradeDecision** columns.
                                | As you learn more about the application’s importance to your organization’s functioning, change the importance level to **Business critical**, **Important**, or **Ignore**.

                                Until you’ve determined that priority applications will migrate successfully, leave the upgrade decision status as **Review in progress**.
                                | - diff --git a/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md b/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md deleted file mode 100644 index f84da4c3eb..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-monitor-deployment.md +++ /dev/null @@ -1,49 +0,0 @@ ---- -title: Monitor deployment with Upgrade Readiness -description: Describes how to use Upgrade Readiness to monitor the deployment after Windows upgrades. -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics, -ms.localizationpriority: medium -ms.prod: w10 -author: jaimeo -ms.author: jaimeo -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness - Step 4: Monitor - -Now that you have started deploying an update with Upgrade Readiness, you can use it to monitor important elements. - -![Upgrade Readiness dialog showing "STEP 4: Monitor" and blades for "Update progress," "Driver issues," and "User feedback"](../images/UR-monitor-main.png) - - -## Update progress - -The **Update progress** blade allows you to monitor the progress and status of your deployment. Any device that has attepted to upgrade in the last 30 days displays the **DeploymentStatus** attribute. You'll be able to see the number of computers that have successfully upgraded, failed to upgrade, are stalled, etc. - - -Selecting this blade allows you to view device-level details about the deployment. For example, select **Failed** to view the original operating system version, the target operating system version, and the reason the update failed for each of the devices that failed to upgrade. In the case of the device illustrated in the following image, an attempt was made to upgrade from Windows 10, version 1703 to 1709, but the operation timed out. - -!["Update progress" blade showing detailed information after selecting the "failed" item](../images/UR-update-progress-failed-detail.png) - - -## Driver issues - -The **Driver issues** blade allows you to see Device Manager errors for your upgraded devices. We include data for all compatibility-related device errors, such as "driver not found" and "driver not started." The blade summarizes errors by error type, but you can select a particular error type to see device-level details about which device(s) are failing and where to obtain a driver. - - -For example, by selecting error code **28 - driver not installed**, you would see that the device in the following image is missing the driver for a network controller. Upgrade Readiness also notifies that a suitable driver is available online through Windows Update. If this device is configured to automatically receive updates from Windows Update, this issue would likely resolve itself following the device's next Windows Update scan. If this device does not automatically receive updates from Windows Update, you would need to deliver the driver manually. - -!["Driver issue" blade showing detailed information after selecting a specific driver error](../images/UR-driver-issue-detail.png) - -## User feedback - -The **User Feedback** blade focuses on gathering subjective feedback from your end users. If a user submits feedback through the Feedback Hub app on a device in your workspace, we will make that feedback visible to you in this blade. The Feedback Hub app is built into Windows 10 and can be accessed by typing "Feedback Hub" in the Cortana search bar. - - -We recommend that you encourage your end users to submit any feedback they have through Feedback Hub. Not only will this feedback be sent directly to Microsoft for review, but you'll also be able to see it by using Upgrade Readiness. You should be aware that **feedback submitted through Feedback Hub will be publicly visible**, so it's best to avoid submitting feedback about internal line-of-business applications. - -When viewing user feedback in Upgrade Readiness, you'll be able to see the raw "Title" and "Feedback" text from the user's submission in Feedback Hub, as well as the number of upvotes the submission has received. (Since feedback is publicly visible, the number of upvotes is a global value and not specific to your company.) If a Microsoft engineer has responded to the submission in Feedback Hub, we'll pull in the Microsoft response for you to see as well. - -![Example user feedback item](../images/UR-example-feedback.png) - \ No newline at end of file diff --git a/windows/deployment/upgrade/upgrade-readiness-release-notes.md b/windows/deployment/upgrade/upgrade-readiness-release-notes.md deleted file mode 100644 index 38b0510215..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-release-notes.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -title: Upgrade Readiness release notes (Windows 10) -description: Provides tips and limitations about Upgrade Readiness. -redirect_url: https://docs.microsoft.com/windows/deployment/upgrade/upgrade-readiness-requirements#important-information-about-this-release ---- \ No newline at end of file diff --git a/windows/deployment/upgrade/upgrade-readiness-requirements.md b/windows/deployment/upgrade/upgrade-readiness-requirements.md deleted file mode 100644 index 9d4f85609f..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-requirements.md +++ /dev/null @@ -1,74 +0,0 @@ ---- -title: Upgrade Readiness requirements (Windows 10) -description: Provides requirements for Upgrade Readiness. -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics, -ms.prod: w10 -author: jaimeo -ms.author: jaimeo -ms.localizationpriority: medium -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness requirements - -This article introduces concepts and steps needed to get up and running with Upgrade Readiness. We recommend that you review this list of requirements before getting started as you may need to collect information, such as account credentials, and get approval from internal IT groups, such as your network security group, before you can start using Upgrade Readiness. - -## Supported upgrade paths - -### Windows 7 and Windows 8.1 - -To perform an in-place upgrade, user computers must be running the latest version of either Windows 7 SP1 or Windows 8.1. After you enable Windows diagnostic data, Upgrade Readiness performs a full inventory of computers so that you can see which version of Windows is installed on each computer. - -The compatibility update that sends diagnostic data from user computers to Microsoft data centers works with Windows 7 SP1 and Windows 8.1 only. Upgrade Readiness cannot evaluate Windows XP or Windows Vista for upgrade eligibility. - - - -If you need to update user computers to Windows 7 SP1 or Windows 8.1, use Windows Update or download and deploy the applicable package from the Microsoft Download Center. - -> [!NOTE] -> Upgrade Readiness is designed to best support in-place upgrades. In-place upgrades do not support migrations from BIOS to UEFI or from 32-bit to 64-bit architecture. If you need to migrate computers in these scenarios, use the wipe-and-reload method. Upgrade Readiness insights are still valuable in this scenario, however, you can ignore in-place upgrade specific guidance. - -See [Windows 10 Specifications](https://www.microsoft.com/en-US/windows/windows-10-specifications) for additional information about computer system requirements. - -### Windows 10 - -Keeping Windows 10 up to date involves deploying a feature update, and Upgrade Readiness tools help you prepare and plan for these Windows updates. -The latest cumulative updates must be installed on Windows 10 computers to make sure that the required compatibility updates are installed. You can find the latest cumulative update on the [Microsoft Update Catalog](https://catalog.update.microsoft.com). - -While Upgrade Readiness can be used to assist with updating devices from Windows 10 Long-Term Servicing Channel (LTSC) to Windows 10 Semi-Annual Channel, Upgrade Readiness does not support updates to Windows 10 LTSC. The Long-Term Servicing Channel of Windows 10 is not intended for general deployment, and does not receive feature updates, therefore it is not a supported target with Upgrade Readiness. See [Windows as a service overview](../update/waas-overview.md#long-term-servicing-channel) to understand more about LTSC. - -## Operations Management Suite or Azure Log Analytics - -Upgrade Readiness is offered as a solution in Azure Portal and Azure Log Analytics, a collection of cloud-based services for managing on premises and cloud computing environments. For more information about Azure Portal, see [Windows Analytics in the Azure Portal](../update/windows-analytics-azure-portal.md) or the Azure [Log Analytics overview](https://azure.microsoft.com/services/log-analytics/). - -If you’re already using Azure Portal or Azure Log Analytics, you’ll find Upgrade Readiness in the Solutions Gallery. Click the **Upgrade Readiness** tile in the gallery and then click **Add** on the solution’s details page. Upgrade Readiness is now visible in your workspace. - -If you are not using Azure Portal or Azure Log Analytics, go to [Log Analytics](https://azure.microsoft.com/services/log-analytics/) on Microsoft.com and select **Start free** to start the setup process. During the process, you’ll create a workspace and add the Upgrade Readiness solution to it. - ->[!IMPORTANT] ->You can use either a Microsoft Account or a Work or School account to create a workspace. If your company is already using Azure Active Directory, use a Work or School account when you sign in to Azure Portal. Using a Work or School account allows you to use identities from your Azure AD to manage permissions in Azure Portal. You also need an Azure subscription to link to your Azure Portal workspace. The account you used to create the workspace must have administrator permissions on the Azure subscription in order to link the workspace to the Azure account. Once the link has been established, you can revoke the administrator permissions. - -## System Center Configuration Manager integration - -Upgrade Readiness can be integrated with your installation of Configuration Manager. For more information, see [Integrate Upgrade Readiness with System Center Configuration Manager](https://docs.microsoft.com/sccm/core/clients/manage/upgrade/upgrade-analytics). - - - -## Important information about this release - -Before you get started configuring Upgrade Anatlyics, review the following tips and limitations about this release. - -**Upgrade Readiness does not support on-premises Windows deployments.** Upgrade Readiness is built as a cloud service, which allows Upgrade Readiness to provide you with insights based on the data from user computers and other Microsoft compatibility services. Cloud services are easy to get up and running and are cost-effective because there is no requirement to physically implement and maintain services on-premises. - -**In-region data storage requirements.** Windows diagnostic data from user computers is encrypted, sent to, and processed at Microsoft-managed secure data centers located in the US. Our analysis of the upgrade readiness-related data is then provided to you through the Upgrade Readiness solution in Azure Portal. Upgrade Readiness is supported in all Azure regions; however, selecting an international Azure region does not prevent diagnostic data from being sent to and processed in Microsoft's secure data centers in the US. - -### Tips - -- When viewing inventory items in table view, the maximum number of rows that can be viewed and exported is limited to 5,000. If you need to view or export more than 5,000 items, reduce the scope of the query so you can export a list with fewer items. - -- Sorting data by clicking a column heading may not sort your complete list of items. For information about how to sort data in Azure Portal, see [Sorting DocumentDB data using Order By](https://azure.microsoft.com/documentation/articles/documentdb-orderby). - -## Get started - -See [Get started with Upgrade Readiness](upgrade-readiness-get-started.md) for detailed, step-by-step instructions for configuring Upgrade Readiness and getting started on your Windows upgrade project. diff --git a/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md b/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md deleted file mode 100644 index d6d2f7af15..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-resolve-issues.md +++ /dev/null @@ -1,212 +0,0 @@ ---- -title: Upgrade Readiness - Resolve application and driver issues (Windows 10) -description: Describes how to resolve application and driver issues that can occur during an upgrade with Upgrade Readiness. -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics, -ms.prod: w10 -author: jaimeo -ms.author: jaimeo -ms.localizationpriority: medium -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness - Step 2: Resolve app and driver issues - -This section of the Upgrade Readiness workflow reports application and driver inventory and shows you which applications have known issues, which applications have no known issues, and which drivers have issues. We identify applications and drivers that need attention and suggest fixes when we know about them. - -## In this section - -The blades in the **Step 2: Resolve issues** section are: - -- [Review applications with known issues](#review-applications-with-known-issues) -- [Review known driver issues](#review-known-driver-issues) -- [Review low-risk apps and drivers](#review-low-risk-apps-and-drivers) -- [Prioritize app and driver testing](#prioritize-app-and-driver-testing) - ->You can change an application’s upgrade decision and a driver’s upgrade decision from the blades in this section. To change an application’s or a driver’s importance level, select **User changes**. Select the item you want to change and then select the appropriate option from the **Select upgrade decision** list. - -Upgrade decisions include: - -| Upgrade decision | When to use it | Guidance | -|--------------------|-------------------|-------------| -| Not reviewed | All drivers are marked as Not reviewed by default.

                                Any app that has not been marked **Low install count** will also have an upgrade decision of **Not reviewed** by default.
                                | Apps you have not yet reviewed or are waiting to review later should be marked as **Not reviewed**. When you start to investigate an application or a driver to determine upgrade readiness, change their upgrade decision to **Review in progress**.

                                | -| Review in progress | When you start to investigate an application or a driver to determine upgrade readiness, change its upgrade decision to **Review in progress**.

                                Until you’ve determined that applications and drivers will migrate successfully or you’ve resolved blocking issues, leave the upgrade decision status as **Review in progress**.

                                | Once you’ve fixed any issues and validated that the application or driver will migrate successfully, change the upgrade decision to **Ready to upgrade**.
                                | -| Ready to upgrade | Mark applications and drivers **Ready to upgrade** once you’ve resolved all blocking issues and you’re confident that they will upgrade successfully, or if you’ve decided to upgrade them as-is. | Applications with no known issues and with low installation rates are marked **Ready to upgrade** by default.

                                In Step 1, you might have marked some of your apps as **Ignore**. These should be marked as **Ready to upgrade**. Apps with low installation rates are marked as **Ready to upgrade** by default. Be sure to review any low install count applications for any business critical or important applications that are not yet upgrade-ready, despite their low installation rates.
                                | -| Won’t upgrade | By default, no applications or drivers are marked **Won’t upgrade** because only you can make that determination.

                                Use **Won’t upgrade** for applications and drivers that you do not work on your target operating system, or that you are unable to upgrade.
                                | If, during your investigation into an application or driver, you determine that they should not or cannot be upgraded, mark them **Won’t upgrade**.

                                | -As you review applications with known issues, you can also see ISV support statements or applications using [Ready for Windows](https://www.readyforwindows.com/). - -## Review applications with known issues - -Applications with issues known to Microsoft are listed, grouped by upgrade assessment into **Attention needed** or **Fix available**. - - - -![Review applications with known issues](../images/upgrade-analytics-apps-known-issues.png) - -To change an application's upgrade decision: - -1. Select **Decide upgrade readiness** to view applications with issues. -2. In the table view, select an **UpgradeDecision** value. -3. Select **Decide upgrade readiness** to change the upgrade decision for each application. -4. Select the applications you want to change to a specific upgrade decision and then select the appropriate option from the **Select upgrade decision** list. -5. Click **Save** when finished. - -IMPORTANT: Ensure that you have the most recent versions of the compatibility update and related KBs installed to get the most up-to-date compatibility information. - -For applications assessed as **Attention needed**, review the table below for details about known issues and for guidance about how to resolve them, when possible. - -| Upgrade Assessment | Action required prior to upgrade? | Issue | What it means | Guidance | -|--------------------|-----------------------------------|-----------|-----------------|------------| -| Attention needed | No | Application is removed during upgrade | Compatibility issues were detected and the application will not migrate to the new operating system.
                                | No action is required for the upgrade to proceed. | -| Attention needed | Yes | Blocking upgrade | Blocking issues were detected and Upgrade Readiness is not able to remove the application during upgrade.

                                The application may work on the new operating system.
                                | Remove the application before upgrading, and reinstall and test on new operating system. | -| Attention needed | No | Evaluate application on new OS | The application will migrate, but issues were detected that may impact its performance on the new operating system. | No action is required for the upgrade to proceed, but be sure to test the application on the new operating system.
                                | -| Attention needed | No | Does not work with new OS, but won’t block upgrade | The application is not compatible with the new operating system, but won’t block the upgrade. | No action is required for the upgrade to proceed, however, you’ll have to install a compatible version of the application on the new operating system.
                                | -| Attention needed | Yes | Does not work with new OS, and will block upgrade | The application is not compatible with the new operating system and will block the upgrade. | Remove the application before upgrading.

                                A compatible version of the application may be available.
                                | -| Attention needed | Yes | May block upgrade, test application | Issues were detected that may interfere with the upgrade, but need to be investigated further.
                                | Test the application’s behavior during upgrade. If it blocks the upgrade, remove it before upgrading and reinstall and test it on the new operating system.
                                | -| Attention needed | Maybe | Multiple | Multiple issues are affecting the application. See detailed view for more information.| When you see Multiple in the query detailed view, click **Query** to see details about what issues were detected with the different versions of the application. | - -For applications assessed as **Fix available**, review the table below for details about known issues and ways to fix them that are known to Microsoft. - -| Upgrade Assessment | Action required prior to upgrade? | Issue | What it means | Guidance | -|--------------------|-----------------------------------|----------|-----------------|-------------| -| Fix available | Yes | Blocking upgrade, update application to newest version | The existing version of the application is not compatible with the new operating system and won’t migrate. A compatible version of the application is available. | Update the application before upgrading. | -| Fix available | No | Reinstall application after upgrading | The application is compatible with the new operating system, but must be reinstalled after upgrading. The application is removed during the upgrade process.
                                | No action is required for the upgrade to proceed. Reinstall application on the new operating system. | -| Fix available | Yes | Blocking upgrade, but can be reinstalled after upgrading | The application is compatible with the new operating system, but won’t migrate. | Remove the application before upgrading and reinstall on the new operating system.
                                | -| Fix available | Yes | Disk encryption blocking upgrade | The application’s encryption features are blocking the upgrade. | Disable the encryption feature before upgrading and enable it again after upgrading.
                                | - -### ISV support for applications with Ready for Windows - -[Ready for Windows](https://www.readyforwindows.com/) lists software solutions that are supported and in use for Windows 10. This site leverages data about application adoption from commercial Windows 10 installations and helps IT managers upgrade to Windows 10 with confidence. For more information, see [Ready for Windows Frequently Asked Questions](https://developer.microsoft.com/windows/ready-for-windows/#/faq/). - -Click **Review Applications With Known Issues** to see the status of applications for Ready for Windows and corresponding guidance. For example: - -![Upgrade analytics Ready for Windows status](../images/upgrade-analytics-ready-for-windows-status.png) - -If there are known issues with an application, the specific guidance for that known issue takes precedence over the Ready for Windows guidance. - -![Upgrade analytics Ready for Windows status guidance precedence](../images/upgrade-analytics-ready-for-windows-status-guidance-precedence.png) - -If you query with RollupLevel="NamePublisher", each version of the application can have a different status for Ready for Windows. In this case, different values appear for Ready for Windows. - -![Name publisher rollup](../images/upgrade-analytics-namepub-rollup.png) - ->[!TIP] ->Within the Upgrade Readiness data model, an object of Type **UAApp** refers to a particular application installed on a specific computer. - ->To support dynamic aggregation and summation of data the Upgrade Readiness solution "rolls up" (aggregates) data in preprocessing. Rolling up to the **Granular** level enables display of the **App** level. In Upgrade Readiness terminology, an **App** is a unique combination of: app name, app vendor, app version, and app language. Thus, at the Granular level, you can see attributes such as **total install count**, which is the number of machines with a specific **App** installed. - ->Upgrade Readiness also has a roll up level of **NamePublisher**, This level enables you to ignore different app versions within your organization for a particular app. In other words, **NamePublisher** displays statistics about a given app, aggregated across all versions. - -The following table lists possible values for **ReadyForWindows** and what they mean. For more information, see [What does the Adoption Status mean?](https://developer.microsoft.com/en-us/windows/ready-for-windows#/faq/?scrollTo=faqStatuses) - -| Ready for Windows Status | Query rollup level | What this means | Guidance | -|-------------------|--------------------------|-----------------|----------| -|Supported version available | Granular | The software provider has declared support for one or more versions of this application on Windows 10. | The ISV has declared support for a version of this application on Windows 10. | -| Highly adopted | Granular | This version of this application has been highly adopted within the Windows 10 Enterprise ecosystem. | This application has been installed on at least 100,000 commercial Windows 10 devices. | -| Adopted | Granular | This version of this application has been adopted within the Windows 10 Enterprise ecosystem. | This application has been installed on at least 10,000 commercial Windows 10 devices. | -| Insufficient Data | Granular | Too few commercial Windows 10 devices are sharing information about this version of this application for Microsoft to categorize its adoption. | N/A | -| Contact developer | Granular | There may be compatibility issues with this version of the application, so Microsoft recommends contacting the software provider to learn more. | Check [Ready for Windows](https://www.readyforwindows.com/) for additional information.| -|Supported version available | NamePublisher | The software provider has declared support for this application on Windows 10. | The ISV has declared support for a version of this application on Windows 10.| -|Adoption status available | NamePublisher | A Ready for Windows adoption status is available for one or more versions of this application. Please check Ready for Windows to learn more. |Check [Ready for Windows](https://www.readyforwindows.com/) for adoption information for this application.| -| Unknown | Any | There is no Ready for Windows information available for this version of this application. Information may be available for other versions of the application at [Ready for Windows](https://www.readyforwindows.com/). | N/A | - -## Review drivers with known issues - -Drivers that won’t migrate to the new operating system are listed, grouped by availability. - -![Review drivers with known issues](../images/upgrade-analytics-drivers-known.png) - -Availability categories are explained in the table below. - -| Driver availability | Action required before or after upgrade? | What it means | Guidance | -|-----------------------|------------------------------------------|----------------|--------------| -| Available in-box | No, for awareness only | The currently installed version of an application or driver won’t migrate to the new operating system; however, a compatible version is installed with the new operating system.
                                | No action is required for the upgrade to proceed. | -| Import from Windows Update | Yes | The currently installed version of a driver won’t migrate to the new operating system; however, a compatible version is available from Windows Update.
                                | If the computer automatically receives updates from Windows Update, no action is required. Otherwise, import a new driver from Windows Update after upgrading.
                                | -| Available in-box and from Windows Update | Yes | The currently installed version of a driver won’t migrate to the new operating system.

                                Although a new driver is installed during upgrade, a newer version is available from Windows Update.
                                | If the computer automatically receives updates from Windows Update, no action is required. Otherwise, import a new driver from Windows Update after upgrading.
                                | -| Check with vendor | Yes | The driver won’t migrate to the new operating system and we are unable to locate a compatible version.
                                | Check with the independent hardware vendor (IHV) who manufactures the driver for a solution. | - -To change a driver’s upgrade decision: - -1. Select **Decide upgrade readiness** and then select the group of drivers you want to review. Select **Table** to view the list in a table. - -2. Select **User changes** to enable user input. - -3. Select the drivers you want to change to a specific upgrade decision and then select the appropriate option from the **Select upgrade decision** list. - -4. Click **Save** when finished. - -## Review low-risk apps and drivers - -Applications and drivers that are meet certain criteria to be considered low risk are displayed on this blade. - -![Blade showing low-risk apps](../images/ua-step2-low-risk.png) - -The first row reports the number of your apps that have an official statement of support on Windows 10 from the software vendor, so you can be confident that they will work on your target operating system. - -The second row (**Apps that are "Highly adopted"**) shows apps that have a ReadyForWindows status of "Highly adopted". This means that they have been installed on at least 100,000 commercial Windows 10 devices, and that Microsoft has not detected significant issues with the app in diagnostic data. Since these apps are prevalent in the ecosystem at large, you can be confident that they will work in your environment as well. - -Each row of the blade uses a different criterion to filter your apps or drivers. You can view a list of applications that meet the criterion by clicking into a row of the blade. For example, if you click the row that says "Apps that are 'Highly adopted'", the result is a list of apps that have a ReadyForWindows status of "Highly adopted". From here, you can bulk-select the results, select **Ready to upgrade**, and then click **Save**.  This will mark all apps meeting the "Highly adopted" criterion as "Ready to upgrade"--no further validation is required. Any applications that you have marked as *Mission critical* or *Business critical* are filtered out, as well as any app that has an issue known to Microsoft. This allows you to work with apps in bulk without having to worry about missing a critical app. - -You can customize the criteria further by using the Log Search query language. For example, if a ReadyForWindows status of "Adopted" is not sufficient by itself for you to be confident in an app's compatibility, you can add additional filters. To do this, click the row labeled **Apps that are 'Adopted'**.  Then, modify the resulting query to fit your company's risk tolerance. If, for example, you prefer that an app must be "Adopted" and have fewer than 1,000 installations, then add *TotalInstalls < 1000* to the end of the Log Search query. Similarly, you can append additional criteria by using other attributes such as monthly active users or app importance. - ->[!NOTE] ->Apps that you have designated as *Mission critical* or *Business critical* are automatically **excluded** from the counts on this blade. If an app is critical, you should always validate it manually it prior to upgrading. - - At the bottom of the blade, the **OTHER APPS AND DRIVERS IN NEED OF REVIEW** section allows you to quickly access apps you have designated as **Mission critical** or **Business critical**, your remaining apps that still need to be reviewed, and your remaining drivers that need to be reviewed. - - - -## Prioritize app and driver testing - -Planning and executing an OS upgrade project can be overwhelming. When you are tasked with evaluating thousands of applications and drivers to ensure a successful upgrade, it can be difficult to decide where to start. The Upgrade Readiness solution provides valuable assistance for you, helping to determine the most important apps and drivers to unblock and enabling you yo create a proposed action plan. - -### Proposed action plan - -The Upgrade Readiness proposed action plan is an optimally ordered list of apps and drivers that are in need of review. By testing apps and drivers in the order suggested by the proposed action plan, you are able to increase your number of “Ready to upgrade” computers in an efficient manner. The action plan can be a very powerful tool during upgrade planning – but it’s most helpful when it’s used correctly. This topic explains the proposed action plan, describes how to use it, and calls out a few misconceptions and invalid use cases that you should avoid. - -The proposed action plan represents the order thath Microsoft recommends you rationalize the upgrade-readiness of your apps and drivers. By validating apps and drivers in the order proposed, you can ensure that you are testing efficiently. - -Each item in the proposed action plan represents either an application or a driver that you have not yet marked “Ready to upgrade.” - ->Since “Low install count” apps are automatically marked “Ready to upgrade”, you will not see any of these apps in the proposed action plan. - -Each item in the plan has the following attributes: - -| Attribute | Description | Example value | -|-----------------------|------------------------------------------|----------------| -| ItemRank | The location of this item in the context of the proposed action plan. For example, the item with ItemRank 7 is the 7th item in the Plan. It is crucial that the Plan is viewed in order by increasing ItemRank. Sorting the Plan in any other way invalidates the insights that the Plan provides. | 7 | -| ItemType | Whether this item is an app or driver -- possible values are: "App" and "Driver." | App | -| ItemName | The name of the app or driver that is in need of review. | Microsoft Visual C++ 2005 Redistributable (x64) | -| ItemVendor | The vendor of the app or driver. | Microsoft Corporation | -| ItemVersion | The version of the app or driver. | 12.1.0.1 | -| ItemLanguage | If this item is an application, then this field will be the language of the app. If the item is a driver, then this will say "N/A." | English | -| ItemHardwareId | If this item is a driver, then this field will be the hardware id of the driver. If the item is an app, then this will say "N/A." | N/A | -| Upgrade Decision | The upgrade decision you have provided for this app or driver. If you have not defined an upgrade decision, then you will see the default value of “Not reviewed.” | Review in progress | -| ComputersUnblocked | Assuming you have already marked all previous items in the proposed action plan “Ready to upgrade”, this represents the number of additional computers that will become “Ready to upgrade” by testing this app or driver and giving it an upgrade decision of “Ready to upgrade”. For example, if ComputersUnblocked is 200, then resolving any issues associated with the app/driver in question will make 200 new computers “Ready to upgrade.” | 200 | -| CumulativeUnblocked | The total number of computers that will become “Ready to upgrade” if you validate and mark this and all prior items in the proposed action plan “Ready to upgrade”. For example, if ItemRank is 7, and CumulativeUnblocked is 950, then fixing items 1 thru 7 in the proposed action plan will cause 950 of your computers to become “Ready to upgrade.” | 950 | -| CumulativeUnblockedPct | The percentage of your machines that will become “Ready to upgrade” if you make this and all prior items in the proposed action plan “Ready to upgrade.” | 0.24 | - -See the following example action plan items (click the image for a full-size view): - -![Proposed action plan](../images/UR-lift-report.jpg) - -
                                -In this example, the 3rd item is an application: **Microsoft Bing Sports**, a modern app, version **4.20.951.0**, published by Microsoft. By validating this app and making its UpgradeDecision “Ready to upgrade”, you can potentially make **1014** computers “Ready to upgrade” – but only after you have already validated items 1 and 2 in the list. By marking items 1, 2, and 3 “Ready to upgrade”, 14779 of your computers will become upgrade-ready. This represents 10.96% of the machines in this workspace. - -#### Using the proposed action plan - -There are several valid use cases for the proposed action plan. But it’s always important to remember that the information presented in the Plan is only accurate when sorted by increasing Item Rank! Here are three potential cases in which you could use the proposed action plan: - -1. Quickly determine how many apps and drivers you’ll need to validate in order to make x% of your computers upgrade-ready. To determine this, simply find the first item in the Plan with a CumulativeUnblockedPct greater than or equal to your desired percentage of upgrade-ready computers. The corresponding ItemRank represents the smallest number of apps and drivers that you can validate in order to reach your upgrade readiness goal. The prior items in the proposed action plan itself represent the most efficient route to reaching your goal. - -2. Use the proposed action plan to prepare a small portion of your machines for a pilot of your target Operating System. Let’s say you want to test a new Operating System by upgrading a few hundred computers. You can use the proposed action plan to determine how many apps and drivers you will need to validate before you can be confident that your pilot will be successful. - -3. If your project deadline is approaching and you only have time to validate a few more apps and drivers, you can use the proposed action plan to determine which apps and drivers you should focus on to maximize the number of computers that you can confidently upgrade. - -#### Misconceptions and things to avoid - -The most common misconceptions about the proposed action plan involve the assumption that each item in the plan is independent of those around it. The apps and drivers in the plan must be considered in the correct order to draw valid conclusions. For example, if you choose to validate items 1, 3, 4, and 5 and mark each of them “Ready to upgrade,” the proposed action plan cannot tell you how many computers will become upgrade-ready as a result of your testing. Even the non-cumulative “ComputersUnblocked” count is dependent upon all prior issues having already been resolved. - -If an item with ItemRank = 7 has a ComputersUnblocked value of 50, do not assume that 50 of your computers will become upgrade-ready if you test this item. However, if you validate items 1 through 6 in the plan, you can make an additional 50 computers upgrade-ready by validating the 7th item in the plan. \ No newline at end of file diff --git a/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md b/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md deleted file mode 100644 index 24abb86fb6..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-target-new-OS.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Upgrade Readiness - Targeting a new operating system version -description: Explains how to run Upgrade Readiness again to target a different operating system version or bulk-approve all apps from a given vendor -ms.prod: w10 -author: jaimeo -ms.topic: article -ms.collection: M365-analytics ---- - -# Targeting a new operating system version - -After you've used Upgrade Readiness to help deploy a given version of Windows 10, you might want to use it again to help deploy a newer version of Windows 10. When you change the target operating system version (as described in [Use Upgrade Readiness to manage Windows upgrades](use-upgrade-readiness-to-manage-windows-upgrades.md#target-version)), the app states (Importance, AppOwner, UpgradeDecision, TestPlan, and TestResult) are not reset. Follow this guidance to preserve or reset these states as needed: - -## TestResults - -If you want to preserve the TestResults from the previous operating system version testing, there is nothing you need to do. - -If you want to reset them, click any of the rows in the **Prioritize Application** blade (described in [Upgrade Readiness - Step 1: Identify important apps](upgrade-readiness-identify-apps.md)). This will take you to the **Log Search** user experience. Replace the query in that window with the following query: - -`search in (UAApp) IsRollup == true and RollupLevel == "Granular" and TestResult <> "Not started"` - -After a short period of time, you will see the "user input" perspective render, which will let you bulk-edit the results. Select the check box in the table header, click the **bulk edit** button, and then set the **TestResult** to *Not started*. Leave all other fields as they are. - -## UpgradeDecision - -If you want to preserve the UpgradeDecision from the previous operating system version testing, there is nothing you need to do. - -If you want to reset them, keep these important points in mind: - -- Make sure to *not* reset the **Ready to upgrade** decision for the "long tail" of apps that have importance of **Ignore** or **Low install count**. Doing this will make it extremely difficult to complete the Upgrade Readiness workflow. -- Decide which decisions to reset. For example, one option is just to reset the decisions marked **Ready to upgrade** (in order to retest those), while preserving states of apps marked **Won't upgrade**. Doing this means you won't lose track of this previous marking. Or you can reset everything. - -To do this, type the following query in **Log Search**: - -`search in (UAApp) IsRollup == true and RollupLevel == "Granular" and Importance <> "Ignore" and Importance <> "Low install count" and UpgradeDecision == "Ready to upgrade"` - ->[!NOTE] ->If you just want to reset all **UpgradeDecision** values, you can simply remove `'and UpgradeDecision == "Ready to upgrade"` from the query. - -After a short period of time, you will see the "user input" perspective render, which will let you bulk-edit the results. Select the check box in the table header, click the **bulk edit** button, and then set the **UpgradeDecision** to *Not reviewed*. Leave all other fields as they are. - - -## Bulk-approving apps from a given vendor - -You can bulk-approve all apps from a given vendor (for example, Microsoft) if there are no known compatibility issues. To do this, type the following query in **Log Search**: - -`search in (UAApp) IsRollup == true and RollupLevel == "Granular" and AppVendor has "Microsoft" and UpgradeAssessment=="No known issues" and UpgradeDecision<>"Ready to upgrade"` - -After a short period of time, you will see the "user input" perspective render, which will let you bulk-edit the results. Select the check box in the table header, click the **bulk edit" button**, and then set the **UpgradeDecision** to *Ready to upgrade*. Leave all other fields as they are. - -## Related topics - -[Windows Analytics overview](../update/windows-analytics-overview.md) - -[Manage Windows upgrades with Upgrade Readiness](manage-windows-upgrades-with-upgrade-readiness.md) - -[Get started with Upgrade Readiness](upgrade-readiness-get-started.md) - diff --git a/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md b/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md deleted file mode 100644 index fb74ebaab1..0000000000 --- a/windows/deployment/upgrade/upgrade-readiness-upgrade-overview.md +++ /dev/null @@ -1,70 +0,0 @@ ---- -title: Upgrade Readiness - Upgrade Overview (Windows 10) -description: Displays the total count of computers sharing data and upgraded. -ms.prod: w10 -author: jaimeo -ms.topic: article -ms.collection: M365-analytics ---- - -# Upgrade Readiness - Upgrade overview - -The first blade in the Upgrade Readiness solution is the upgrade overview blade. This blade displays the total count of computers sharing data with Microsoft, and the count of computers upgraded. As you successfully upgrade computers, the count of computers upgraded increases. - -The upgrade overivew blade displays data refresh status, including the date and time of the most recent data update and whether user changes are reflected. The upgrade overview blade also displays the current target OS version. For more information about the target OS version, see [target version](use-upgrade-readiness-to-manage-windows-upgrades.md#target-version). - -The following color-coded status changes are reflected on the upgrade overview blade: - -- The "Last updated" banner: - - No delay in processing device inventory data = "Last updated" banner is displayed in green. - - Delay processing device inventory data = "Last updated" banner is displayed in amber. -- Computers with incomplete data: - - Less than 4% = Count is displayed in green. - - 4% - 10% = Count is displayed in amber. - - Greater than 10% = Count is displayed in red. -- Computers with outdated KB: - - Less than 10% = Count is displayed in green. - - 10% - 30% = Count is displayed in amber. - - Greater than 30% = Count is displayed in red. -- User changes: - - Pending user changes = User changes count displays "Data refresh pending" in amber. - - No pending user changes = User changes count displays "Up to date" in green. -- Target version: - - If the current value matches the recommended value, the version is displayed in green. - - If the current value is an older OS version than the recommended value, but not deprecated, the version is displayed in amber. - - If the current value is a deprecated OS version, the version is displayed in red. - -Click a row to drill down and see details about individual computers. If updates are missing, see [Enrolling devices in Windows Analytics](../update/windows-analytics-get-started.md) for information on required updates. - -In the following example, there is no delay in data processing, more than 10% of computers (6k\8k) have incomplete data, more than 30% of computers (6k/8k) require an update, there are no pending user changes, and the currently selected target OS version is the same as the recommended version: - -![Upgrade overview](../images/ur-overview.png) - - - -If data processing is delayed, the "Last updated" banner will indicate the date on which data was last updated. You can continue using your workspace as normal. However, any changes or additional information that is added might not be displayed until data is refreshed. When your workspace is in this state, there is no action required; data is typically refreshed and the display will return to normal again within 24 hours. - -If there are computers with incomplete data, verify that you have installed the latest compatibilty updates. Install the updates if necessary and then run the most recent [Update Readiness deployment script](https://go.microsoft.com/fwlink/?LinkID=822966&clcid=0x409) from the Microsoft download center. The updated data payload should appear in Upgrade Readiness within 48 hours of a successful run on the deployment script. - -Select **Total computers** for a list of computers and details about them, including: - -- Computer ID and computer name -- Computer manufacturer -- Computer model -- Operating system version and build -- Count of system requirement, application, and driver issues per computer -- Upgrade assessment based on analysis of computer diagnostic data -- Upgrade decision status - -Select **Total applications** for a list of applications discovered on user computers and details about them, including: - -- Application vendor -- Application version -- Count of computers the application is installed on -- Count of computers that opened the application at least once in the past 30 days -- Percentage of computers in your total computer inventory that opened the application in the past 30 days -- Issues detected, if any -- Upgrade assessment based on analysis of application data -- Rollup level diff --git a/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md b/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md index d9763887fe..f559f6feee 100644 --- a/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md +++ b/windows/deployment/upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md @@ -1,13 +1,16 @@ --- -title: Perform an in-place upgrade to Windows 10 using Configuration Manager (Windows 10) -description: The simplest path to upgrade PCs currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. Use a System Center Configuration Manager task sequence to completely automate the process. +title: Perform in-place upgrade to Windows 10 via Configuration Manager +description: In-place upgrades make upgrading Windows 7, Windows 8, and Windows 8.1 to Windows 10 easy -- you can even automate the whole process with a Microsoft Endpoint Configuration Manager task sequence. ms.assetid: F8DF6191-0DB0-4EF5-A9B1-6A11D5DE4878 +ms.reviewer: +manager: laurawi +ms.author: greglin keywords: upgrade, update, task sequence, deploy ms.prod: w10 ms.localizationpriority: medium ms.mktglfcycl: deploy -author: mtniehaus -ms.date: 07/27/2017 +audience: itpro +author: greg-lindsay ms.topic: article --- @@ -18,7 +21,10 @@ ms.topic: article - Windows 10 -The simplest path to upgrade PCs currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a System Center Configuration Manager task sequence to completely automate the process. +The simplest path to upgrade PCs currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a Microsoft Endpoint Configuration Manager task sequence to completely automate the process. + +>[!IMPORTANT] +>Beginning with Windows 10 and Windows Server 2016, Windows Defender is already installed. A management client for Windows Defender is also installed automatically if the Configuration Manager client is installed. However, previous Windows operating systems installed the System Center Endpoint Protection (SCEP) client with the Configuration Manager client. The SCEP client can block in-place upgrade to Windows 10 due to incompatibility, and must removed from a device before performing an in-place upgrade to Windows 10. ## Proof-of-concept environment @@ -108,15 +114,15 @@ Figure 2. Upgrade from Windows 7 to Windows 10 Enterprise x64 with a task sequ After the task sequence finishes, the computer will be fully upgraded to Windows 10. -## Upgrade to Windows 10 with System Center Configuration Manager Current Branch +## Upgrade to Windows 10 with Microsoft Endpoint Configuration Manager Current Branch -With System Center Configuration Manager Current Branch, new built-in functionality makes it easier to upgrade to Windows 10. +With Microsoft Endpoint Configuration Manager Current Branch, new built-in functionality makes it easier to upgrade to Windows 10. **Note**   For more details about Configuration Manager Current Branch, see the [Configuration Manager Team blog](https://go.microsoft.com/fwlink/p/?LinkId=620205). An [evaluation version is currently available](https://go.microsoft.com/fwlink/p/?LinkId=620206) for you to try. The instructions below are specific to the Technical Preview 2 release and may change after the next version of Configuration Manager is released. -  + ### Create the OS upgrade package @@ -144,7 +150,7 @@ Figure 3. The Configuration Manager upgrade task sequence. ### Create a device collection -After you create the upgrade task sequence, you can create a collection to test a deployment. In this section, we assume you have the PC0001 machine running Windows 7 SP1, with the next version of System Center Configuration Manager client installed. +After you create the upgrade task sequence, you can create a collection to test a deployment. In this section, we assume you have the PC0001 machine running Windows 7 SP1, with the next version of Microsoft Endpoint Configuration Manager client installed. 1. On CM01, using the Configuration Manager console, in the Asset and Compliance workspace, right-click **Device Collections**, and then select **Create Device Collection**. Use the following settings: - General @@ -204,9 +210,9 @@ After the task sequence completes, the computer will be fully upgraded to Window [Configuration Manager Team blog](https://go.microsoft.com/fwlink/p/?LinkId=620109) -  + -  + diff --git a/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md b/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md index 7986e2b587..ee85dd816a 100644 --- a/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md +++ b/windows/deployment/upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md @@ -1,107 +1,110 @@ ---- -title: Perform an in-place upgrade to Windows 10 with MDT (Windows 10) -description: The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. -ms.assetid: B8993151-3C1E-4F22-93F4-2C5F2771A460 -keywords: upgrade, update, task sequence, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -author: mtniehaus -ms.date: 07/27/2017 -ms.topic: article ---- - -# Perform an in-place upgrade to Windows 10 with MDT - -**Applies to** -- Windows 10 - -The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a Microsoft Deployment Toolkit (MDT) 2013 Update 2 task sequence to completely automate the process. - -## Proof-of-concept environment - -For the purposes of this topic, we will use four machines: DC01, MDT01, and PC0001. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard machine, fully patched with the latest security updates, and configured as a member server in the fictional contoso.com domain. PC0001 is a machine with Windows 7 SP1, targeted for the Windows 10 upgrade. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). - -![fig 1](../images/upgrademdt-fig1-machines.png) - -Figure 1. The machines used in this topic. - -## Set up the upgrade task sequence - -MDT adds support for Windows 10 deployment, including a new in-place upgrade task sequence template that makes the process really simple. - -## Create the MDT production deployment share - -The steps to create the deployment share for production are the same as when you created the deployment share to create the custom reference image: - -1. On MDT01, log on as Administrator in the CONTOSO domain with a password of **P@ssw0rd**. -2. Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. -3. On the **Path** page, in the **Deployment share path** text box, type **E:\\MDTProduction**, and then click **Next**. -4. On the **Share** page, in the **Share name** text box, type **MDTProduction$**, and then click **Next**. -5. On the **Descriptive Name** page, in the **Deployment share** description text box, type **MDT Production**, and then click **Next**. -6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. -7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. - -## Add Windows 10 Enterprise x64 (full source) - -In these steps we assume that you have copied the content of a Windows 10 Enterprise x64 ISO to the E:\\Downloads\\Windows 10 Enterprise x64 folder. - -1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**. -2. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. -3. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: - - Full set of source files - - Source directory: E:\\Downloads\\Windows 10 Enterprise x64 - - Destination directory name: W10EX64RTM -4. After you add the operating system, in the **Operating Systems / Windows 10** folder, double-click the added operating system name in the **Operating System** node and change the name to the following: **Windows 10 Enterprise x64 RTM Default Image** - -![figure 2](../images/upgrademdt-fig2-importedos.png) - -Figure 2. The imported Windows 10 operating system after you rename it. - -## Create a task sequence to upgrade to Windows 10 Enterprise - -1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 10**. -2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: - - Task sequence ID: W10-X64-UPG - - Task sequence name: Windows 10 Enterprise x64 RTM Upgrade - - Template: Standard Client Upgrade Task Sequence - - Select OS: Windows 10 Enterprise x64 RTM Default Image - - Specify Product Key: Do not specify a product key at this time - - Full Name: Contoso - - Organization: Contoso - - Internet Explorer home page: about:blank - - Admin Password: Do not specify an Administrator Password at this time - -![figure 3](../images/upgrademdt-fig3-tasksequence.png) - -Figure 3. The task sequence to upgrade to Windows 10. - -## Perform the Windows 10 upgrade - -To initiate the in-place upgrade, perform the following steps on PC0003 (currently running Windows 7 SP1). - -1. Start the MDT deployment wizard by running the following command: **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs** -2. Select the **Windows 10 Enterprise x64 RTM Upgrade** task sequence, and then click **Next**. - - ![figure 4](../images/upgrademdt-fig4-selecttask.png) - - Figure 4. Upgrade task sequence. - -3. On the **Credentials** tab, specify the **MDT\_BA** account, **P@ssw0rd** password, and **CONTOSO** for the domain. (Some or all of these values can be specified in Bootstrap.ini so they are automatically populated.) -4. On the **Ready** tab, click **Begin** to start the task sequence. -When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers. - -![figure 5](../images/upgrademdt-fig5-winupgrade.png) - -Figure 5. Upgrade from Windows 7 to Windows 10 Enterprise x64 with a task sequence. - -After the task sequence completes, the computer will be fully upgraded to Windows 10. - -## Related topics - -[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md) - -[Microsoft Deployment Toolkit downloads and resources](https://go.microsoft.com/fwlink/p/?LinkId=618117) -  +--- +title: Perform an in-place upgrade to Windows 10 with MDT (Windows 10) +description: The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. +ms.assetid: B8993151-3C1E-4F22-93F4-2C5F2771A460 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: upgrade, update, task sequence, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Perform an in-place upgrade to Windows 10 with MDT + +**Applies to** +- Windows 10 + +The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. You can use a Microsoft Deployment Toolkit (MDT) 2013 Update 2 task sequence to completely automate the process. + +## Proof-of-concept environment + +For the purposes of this topic, we will use three machines: DC01, MDT01, and PC0001. DC01 is a domain controller and MDT01 is a Windows Server 2012 R2 standard machine, fully patched with the latest security updates, and configured as a member server in the fictional contoso.com domain. PC0001 is a machine with Windows 7 SP1, targeted for the Windows 10 upgrade. For more details on the setup for this topic, please see [Deploy Windows 10 with the Microsoft Deployment Toolkit](../deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md). + +![fig 1](../images/upgrademdt-fig1-machines.png) + +Figure 1. The machines used in this topic. + +## Set up the upgrade task sequence + +MDT adds support for Windows 10 deployment, including a new in-place upgrade task sequence template that makes the process really simple. + +## Create the MDT production deployment share + +The steps to create the deployment share for production are the same as when you created the deployment share to create the custom reference image: + +1. On MDT01, log on as Administrator in the CONTOSO domain with a password of P@ssw0rd. +2. Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. +3. On the **Path** page, in the **Deployment share path** text box, type **E:\\MDTProduction**, and then click **Next**. +4. On the **Share** page, in the **Share name** text box, type **MDTProduction$**, and then click **Next**. +5. On the **Descriptive Name** page, in the **Deployment share** description text box, type **MDT Production**, and then click **Next**. +6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. +7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. + +## Add Windows 10 Enterprise x64 (full source) + +In these steps we assume that you have copied the content of a Windows 10 Enterprise x64 ISO to the E:\\Downloads\\Windows 10 Enterprise x64 folder. + +1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**. +2. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. +3. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: + - Full set of source files + - Source directory: E:\\Downloads\\Windows 10 Enterprise x64 + - Destination directory name: W10EX64RTM +4. After you add the operating system, in the **Operating Systems / Windows 10** folder, double-click the added operating system name in the **Operating System** node and change the name to the following: **Windows 10 Enterprise x64 RTM Default Image** + +![figure 2](../images/upgrademdt-fig2-importedos.png) + +Figure 2. The imported Windows 10 operating system after you rename it. + +## Create a task sequence to upgrade to Windows 10 Enterprise + +1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 10**. +2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + - Task sequence ID: W10-X64-UPG + - Task sequence name: Windows 10 Enterprise x64 RTM Upgrade + - Template: Standard Client Upgrade Task Sequence + - Select OS: Windows 10 Enterprise x64 RTM Default Image + - Specify Product Key: Do not specify a product key at this time + - Full Name: Contoso + - Organization: Contoso + - Internet Explorer home page: about:blank + - Admin Password: Do not specify an Administrator Password at this time + +![figure 3](../images/upgrademdt-fig3-tasksequence.png) + +Figure 3. The task sequence to upgrade to Windows 10. + +## Perform the Windows 10 upgrade + +To initiate the in-place upgrade, perform the following steps on PC0003 (currently running Windows 7 SP1). + +1. Start the MDT deployment wizard by running the following command: **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs** +2. Select the **Windows 10 Enterprise x64 RTM Upgrade** task sequence, and then click **Next**. + + ![figure 4](../images/upgrademdt-fig4-selecttask.png) + + Figure 4. Upgrade task sequence. + +3. On the **Credentials** tab, specify the **MDT\_BA** account, P@ssw0rd password, and **CONTOSO** for the domain. (Some or all of these values can be specified in Bootstrap.ini so they are automatically populated.) +4. On the **Ready** tab, click **Begin** to start the task sequence. + When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers. + +![figure 5](../images/upgrademdt-fig5-winupgrade.png) + +Figure 5. Upgrade from Windows 7 to Windows 10 Enterprise x64 with a task sequence. + +After the task sequence completes, the computer will be fully upgraded to Windows 10. + +## Related topics + +[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md) + +[Microsoft Deployment Toolkit downloads and resources](https://go.microsoft.com/fwlink/p/?LinkId=618117) + diff --git a/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md b/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md index ed314a0bb8..78d70d0d25 100644 --- a/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md +++ b/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md @@ -1,110 +1,113 @@ ---- -title: Upgrade Windows Phone 8.1 to Windows 10 Mobile in an MDM environment (Windows 10) -description: This article describes how to upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile using MDM. -keywords: upgrade, update, windows, phone, windows 10, mdm, mobile -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdm -author: greg-lindsay -ms.topic: article ---- - -# Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management (MDM) - -**Applies to** - -- Windows 10 Mobile - -## Summary - -This article describes how system administrators can upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile using [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm/) (MDM). - ->[!IMPORTANT] ->If you are not a system administrator, see the [Windows 10 Mobile Upgrade & Updates](https://www.microsoft.com/windows/windows-10-mobile-upgrade) page for details about updating your Windows 8.1 Mobile device to Windows 10 Mobile using the [Upgrade Advisor](https://www.microsoft.com/store/p/upgrade-advisor/9nblggh0f5g4). - -## Upgrading with MDM - -The Windows Phone 8.1 to Windows 10 Mobile upgrade uses an "opt-in" or "seeker" model. To determine if the device is eligible for an upgrade with MDM, see the [How to determine whether an upgrade is available for a device](#howto-upgrade-available) topic in this article. An eligible device must opt-in to be offered the upgrade. For consumers, the Windows 10 Mobile Upgrade Advisor app is available from the Windows Store to perform the opt-in. For Enterprises, Microsoft is offering a centralized management solution through MDM that can push a management policy to each eligible device to perform the opt-in. - -If you use a list of allowed applications (app whitelisting) with MDM, verify that system applications are whitelisted before you upgrade to Windows 10 Mobile. Also, be aware that there are [known issues](https://msdn.microsoft.com/library/windows/hardware/mt299056.aspx#whitelist) with app whitelisting that could adversely affect the device after you upgrade. - -Some enterprises might want to control the availability of the Windows 10 Mobile upgrade to their users. With the opt-in model, the enterprise can blacklist the Upgrade Advisor app to prevent their users from upgrading prematurely. For more information about how to blacklist the Upgrade Advisor app, see the [How to blacklist the Upgrade Advisor app](#howto-blacklist) section in this article. Enterprises that have blacklisted the Upgrade Advisor app can use the solution described in this article to select the upgrade timing on a per-device basis. - -## More information - -To provide enterprises with a solution that's independent of the Upgrade Advisor, a new registry key in the registry configuration service provider (CSP) is available. A special GUID key value is defined. When Microsoft Update (MU) detects the presence of the registry key value on a device, any available upgrade will be made available to the device. - -### Prerequisites - -- Windows Phone 8.1 device with an available upgrade to Windows 10 Mobile. -- Device connected to Wi-Fi or cellular network to perform scan for upgrade. -- Device is already enrolled with an MDM session. -- Device is able to receive the management policy. -- MDM is capable of pushing the management policy to devices. Minimum version numbers for some popular MDM providers that support this solution are: InTune: 5.0.5565, AirWatch: 8.2, Mobile Iron: 9.0. - -### Instructions for the MDM server - -The registry CSP is used to push the GUID value to the following registry key for which the Open Mobile Alliance (OMA) Device Management (DM) client has Read/Write access and for which the Device Update service has Read access. - -``` -[HKLM\Software\Microsoft\Provisioning\OMADM] -"EnterpriseUpgrade"="d369c9b6-2379-466d-9162-afc53361e3c2” -``` - - -The complete SyncML command for the solution is as follows. Note: The SyncML may vary, depending on your MDM solution. - -``` -SyncML xmlns="SYNCML:SYNCML1.1"> - - - 250 - - - ./Vendor/MSFT/Registry/HKLM/SOFTWARE/Microsoft/Provisioning/OMADM/EnterpriseUpgrade - - - chr - - d369c9b6-2379-466d-9162-afc53361e3c2 - - - - - -``` - -The OMA DM server policy description is provided in the following table: - -|Item |Setting | -|------|------------| -| OMA-URI |./Vendor/MSFT/Registry/HKLM/SOFTWARE/Microsoft/Provisioning/OMADM/EnterpriseUpgrade | -| Data Type |String | -| Value |d369c9b6-2379-466d-9162-afc53361e3c2 | - - -After the device consumes the policy, it will be able to receive an available upgrade. - -To disable the policy, delete the **OMADM** registry key or set the **EnterpriseUpgrade** string value to anything other than the GUID. - -### How to determine whether an upgrade is available for a device - -The Windows 10 Mobile Upgrade Advisor app is not designed or intended for Enterprise customers who want to automate the upgrade process. However, the Windows 10 Mobile Upgrade Advisor app is the best mechanism to determine when an upgrade is available. The app dynamically queries whether the upgrade is released for this device model and associated mobile operator (MO). - -We recommend that enterprises use a pilot device with the Windows 10 Mobile Upgrade Advisor app installed. The pilot device provides the device model and MO used by the enterprise. When you run the app on the pilot device, it will tell you that either an upgrade is available, that the device is eligible for upgrade, or that an upgrade is not available for this device. - -Note: The availability of Windows 10 Mobile as an update for existing Windows Phone 8.1 devices varies by device manufacturer, device model, country or region, mobile operator or service provider, hardware limitations, and other factors. To check for compatibility and other important installation information, see the [Windows 10 Mobile FAQ](https://support.microsoft.com/help/10599/windows-10-mobile-how-to-get) page. - -### How to blacklist the Upgrade Advisor app - -Some enterprises may want to block their users from installing the Windows 10 Mobile Upgrade Advisor app. With Windows Phone 8.1, you can allow or deny individual apps by adding specific app publishers or the app globally unique identifier (GUID) from the Window Phone Store to an allow or deny XML list. The GUID for a particular application can be found in the URL for the app in the phone store. For example, the GUID to the Windows 10 Mobile Upgrade Adviser (fbe47e4f-7769-4103-910e-dca8c43e0b07) is displayed in the following URL: - -http://windowsphone.com/s?appid=fbe47e4f-7769-4103-910e-dca8c43e0b07 - -For more information about how to do this, see [Try it out: restrict Windows Phone 8.1 apps](https://technet.microsoft.com/windows/dn771706.aspx). - -## Related topics - -[Windows 10 Mobile and mobile device management](/windows/client-management/windows-10-mobile-and-mdm) +--- +title: Upgrade Windows Phone 8.1 to Windows 10 Mobile in an MDM environment (Windows 10) +ms.reviewer: +manager: laurawi +ms.author: greglin +description: This article describes how to upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile using MDM. +keywords: upgrade, update, windows, phone, windows 10, mdm, mobile +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdm +audience: itpro author: greg-lindsay +ms.topic: article +--- + +# Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management (MDM) + +**Applies to** + +- Windows 10 Mobile + +## Summary + +This article describes how system administrators can upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile using [Mobile Device Management](https://docs.microsoft.com/windows/client-management/mdm/) (MDM). + +>[!IMPORTANT] +>If you are not a system administrator, see the [Windows 10 Mobile Upgrade & Updates](https://www.microsoft.com/windows/windows-10-mobile-upgrade) page for details about updating your Windows 8.1 Mobile device to Windows 10 Mobile using the [Upgrade Advisor](https://www.microsoft.com/store/p/upgrade-advisor/9nblggh0f5g4). + +## Upgrading with MDM + +The Windows Phone 8.1 to Windows 10 Mobile upgrade uses an "opt-in" or "seeker" model. To determine if the device is eligible for an upgrade with MDM, see the [How to determine whether an upgrade is available for a device](#howto-upgrade-available) topic in this article. An eligible device must opt-in to be offered the upgrade. For consumers, the Windows 10 Mobile Upgrade Advisor app is available from the Windows Store to perform the opt-in. For Enterprises, Microsoft is offering a centralized management solution through MDM that can push a management policy to each eligible device to perform the opt-in. + +If you use a list of allowed applications (app whitelisting) with MDM, verify that system applications are whitelisted before you upgrade to Windows 10 Mobile. Also, be aware that there are [known issues](https://msdn.microsoft.com/library/windows/hardware/mt299056.aspx#whitelist) with app whitelisting that could adversely affect the device after you upgrade. + +Some enterprises might want to control the availability of the Windows 10 Mobile upgrade to their users. With the opt-in model, the enterprise can blacklist the Upgrade Advisor app to prevent their users from upgrading prematurely. For more information about how to blacklist the Upgrade Advisor app, see the [How to blacklist the Upgrade Advisor app](#howto-blacklist) section in this article. Enterprises that have blacklisted the Upgrade Advisor app can use the solution described in this article to select the upgrade timing on a per-device basis. + +## More information + +To provide enterprises with a solution that's independent of the Upgrade Advisor, a new registry key in the registry configuration service provider (CSP) is available. A special GUID key value is defined. When Microsoft Update (MU) detects the presence of the registry key value on a device, any available upgrade will be made available to the device. + +### Prerequisites + +- Windows Phone 8.1 device with an available upgrade to Windows 10 Mobile. +- Device connected to Wi-Fi or cellular network to perform scan for upgrade. +- Device is already enrolled with an MDM session. +- Device is able to receive the management policy. +- MDM is capable of pushing the management policy to devices. Minimum version numbers for some popular MDM providers that support this solution are: InTune: 5.0.5565, AirWatch: 8.2, Mobile Iron: 9.0. + +### Instructions for the MDM server + +The registry CSP is used to push the GUID value to the following registry key for which the Open Mobile Alliance (OMA) Device Management (DM) client has Read/Write access and for which the Device Update service has Read access. + +``` +[HKLM\Software\Microsoft\Provisioning\OMADM] +"EnterpriseUpgrade"="d369c9b6-2379-466d-9162-afc53361e3c2” +``` + + +The complete SyncML command for the solution is as follows. Note: The SyncML may vary, depending on your MDM solution. + +``` +SyncML xmlns="SYNCML:SYNCML1.1"> + + + 250 + + + ./Vendor/MSFT/Registry/HKLM/SOFTWARE/Microsoft/Provisioning/OMADM/EnterpriseUpgrade + + + chr + + d369c9b6-2379-466d-9162-afc53361e3c2 + + + + + +``` + +The OMA DM server policy description is provided in the following table: + +|Item |Setting | +|------|------------| +| OMA-URI |./Vendor/MSFT/Registry/HKLM/SOFTWARE/Microsoft/Provisioning/OMADM/EnterpriseUpgrade | +| Data Type |String | +| Value |d369c9b6-2379-466d-9162-afc53361e3c2 | + + +After the device consumes the policy, it will be able to receive an available upgrade. + +To disable the policy, delete the **OMADM** registry key or set the **EnterpriseUpgrade** string value to anything other than the GUID. + +### How to determine whether an upgrade is available for a device + +The Windows 10 Mobile Upgrade Advisor app is not designed or intended for Enterprise customers who want to automate the upgrade process. However, the Windows 10 Mobile Upgrade Advisor app is the best mechanism to determine when an upgrade is available. The app dynamically queries whether the upgrade is released for this device model and associated mobile operator (MO). + +We recommend that enterprises use a pilot device with the Windows 10 Mobile Upgrade Advisor app installed. The pilot device provides the device model and MO used by the enterprise. When you run the app on the pilot device, it will tell you that either an upgrade is available, that the device is eligible for upgrade, or that an upgrade is not available for this device. + +Note: The availability of Windows 10 Mobile as an update for existing Windows Phone 8.1 devices varies by device manufacturer, device model, country or region, mobile operator or service provider, hardware limitations, and other factors. To check for compatibility and other important installation information, see the [Windows 10 Mobile FAQ](https://support.microsoft.com/help/10599/windows-10-mobile-how-to-get) page. + +### How to blacklist the Upgrade Advisor app + +Some enterprises may want to block their users from installing the Windows 10 Mobile Upgrade Advisor app. With Windows Phone 8.1, you can allow or deny individual apps by adding specific app publishers or the app globally unique identifier (GUID) from the Window Phone Store to an allow or deny XML list. The GUID for a particular application can be found in the URL for the app in the phone store. For example, the GUID to the Windows 10 Mobile Upgrade Adviser (fbe47e4f-7769-4103-910e-dca8c43e0b07) is displayed in the following URL: + +http://windowsphone.com/s?appid=fbe47e4f-7769-4103-910e-dca8c43e0b07 + +For more information about how to do this, see [Try it out: restrict Windows Phone 8.1 apps](https://technet.microsoft.com/windows/dn771706.aspx). + +## Related topics + +[Windows 10 Mobile and mobile device management](/windows/client-management/windows-10-mobile-and-mdm) diff --git a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md b/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md deleted file mode 100644 index 5b149323f8..0000000000 --- a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Use Upgrade Readiness to manage Windows upgrades (Windows 10) -description: Describes how to use Upgrade Readiness to manage Windows upgrades. -keywords: windows analytics, oms, operations management suite, prerequisites, requirements, upgrades, log analytics, -ms.localizationpriority: medium -ms.prod: w10 -author: jaimeo -ms.author: jaimeo -ms.date: 07/31/2018 -ms.topic: article ---- - -# Use Upgrade Readiness to manage Windows upgrades - -You can use Upgrade Readiness to prioritize and work through application and driver issues, assign and track issue resolution status, and identify computers that are ready to upgrade. Upgrade Readiness enables you to deploy Windows with confidence, knowing that you’ve addressed potential blocking issues. - -- Based on diagnostic data from user computers, Upgrade Readiness identifies application and driver compatibility issues that may block Windows upgrades, allowing you to make data-driven decisions about your organization’s upgrade readiness. -- Information is refreshed daily so you can monitor upgrade progress. Any changes your team makes, such as assigning application importance and marking applications as ready to upgrade, are reflected 24 hours after you make them. - -When you are ready to begin the upgrade process, a workflow is provided to guide you through critical high-level tasks. - -![Series of blades showing Upgrade Overview, Step 1: Identify Important Apps, Prioritize Applications, Step 2: Resolve issues, and Review applications with known issues](../images/ua-cg-15.png) - -Each step in the workflow is enumerated using blue tiles. Helpful data is provided on white tiles to help you get started, to monitor your progress, and to complete each step. - ->**Important**: You can use the [Target version](#target-version) setting to evaluate computers that are running a specified version of Windows before starting the Upgrade Readiness workflow. By default, the Target version is configured to the released version of Windows 10 for the Current Branch for Business (CBB). - -The following information and workflow is provided: - -- [Upgrade overview](upgrade-readiness-upgrade-overview.md): Review compatibility and usage information about computers, applications, and drivers. -- [Step 1: Identify important apps](upgrade-readiness-identify-apps.md): Assign importance levels to prioritize your applications. -- [Step 2: Resolve issues](upgrade-readiness-resolve-issues.md): Identify and resolve problems with applications. -- [Step 3: Deploy](upgrade-readiness-deploy-windows.md): Start the upgrade process. - -Also see the following topic for information about additional items that can be affected by the upgrade process: - -- [Additional insights](upgrade-readiness-additional-insights.md): Find out which MS Office add-ins are installed, and review web site activity. - -## Target version - -The target version setting is used to evaluate the number of computers that are already running the default version of Windows 10, or a later version. The target version of Windows 10 is displayed on the upgrade overview tile. See the following example: - -![Upgrade overview showing target version](../images/ur-target-version.png) - -The default target version in Upgrade Readiness is set to the released version of the Current Branch for Business (CBB). CBB can be determined by reviewing [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). The target version setting is used to evaluate the number of computers that are already running this version of Windows, or a later version. - -The number displayed under **Computers upgraded** in the Upgrade Overview blade is the total number of computers that are already running the same or a later version of Windows compared to the target version. It also is used in the evaluation of apps and drivers: Known issues and guidance for the apps and drivers in Upgrade Readiness is based on the target operating system version. - -You now have the ability to change the Windows 10 version you wish to target. The available options currently are: Windows 10 version 1507, Windows 10 version 1511, Windows 10 version 1607, Windows 10 version 1703, Windows 10 version 1709 and Windows 10 version 1803. - -To change the target version setting, click on **Solutions Settings**, which appears at the top when you open you Upgrade Readiness solution: - -![Upgrade Readiness dialog showing gear labeled Solution Settings](../images/ua-cg-08.png) - ->You must be signed in to Upgrade Readiness as an administrator to view settings. - -On the **Upgrade Readiness Settings** page, choose one of the options in the drop down box and click **Save**. The changes in the target version setting are reflected in evaluations when a new snapshot is uploaded to your workspace. - -![Upgrade Readiness Settings dialog showing gear labeled Save and arrow labeled Cancel](../images/ur-settings.png) diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index 7183dcd91c..e2806e3c0c 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -2,11 +2,15 @@ title: Windows 10 edition upgrade (Windows 10) description: With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. ms.assetid: A7642E90-A3E7-4A25-8044-C4E402DC462A +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library ms.pagetype: mobile +audience: itpro author: greg-lindsay ms.topic: article --- @@ -24,7 +28,7 @@ For a list of operating systems that qualify for the Windows 10 Pro Upgrade or W The following table shows the methods and paths available to change the edition of Windows 10 that is running on your computer. **Note**: The reboot requirement for upgrading from Pro to Enterprise was removed in version 1607. -Note: Although it isn't displayed yet in the table, edition upgrade is also possible using [edition upgrade policy](https://docs.microsoft.com/sccm/compliance/deploy-use/upgrade-windows-version) in System Center Configuration Manager. +Note: Although it isn't displayed yet in the table, edition upgrade is also possible using [edition upgrade policy](https://docs.microsoft.com/configmgr/compliance/deploy-use/upgrade-windows-version) in Microsoft Endpoint Configuration Manager. ![not supported](../images/x_blk.png) (X) = not supported
                                ![supported, reboot required](../images/check_grn.png) (green checkmark) = supported, reboot required
                                @@ -135,7 +139,7 @@ Downgrading from Enterprise - Upgrade edition: **Enterprise** - Valid downgrade paths: **Pro, Pro for Workstations, Pro Education, Education** -You can move directly from Enterprise to any valid destination edition. In this example, downgrading to Pro for Workstations, Pro Education, or Education requires an additional activation key to supersede the firmware-embedded Pro key. In all cases, you must comply with [Microsoft License Terms](https://www.microsoft.com/useterms). If you are a volume license customer, refer to the [Microsoft Volume Licensing Reference Guide](https://www.microsoft.com/en-us/download/details.aspx?id=11091). +You can move directly from Enterprise to any valid destination edition. In this example, downgrading to Pro for Workstations, Pro Education, or Education requires an additional activation key to supersede the firmware-embedded Pro key. In all cases, you must comply with [Microsoft License Terms](https://www.microsoft.com/useterms). If you are a volume license customer, refer to the [Microsoft Volume Licensing Reference Guide](https://www.microsoft.com/download/details.aspx?id=11091). ### Supported Windows 10 downgrade paths @@ -234,9 +238,9 @@ You can move directly from Enterprise to any valid destination edition. In this
                                ->**Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions. - ->**Windows N/KN**: Windows "N" and "KN" SKUs follow the same rules shown above. +> **Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions. +> +> **Windows N/KN**: Windows "N" and "KN" SKUs follow the same rules shown above. Some slightly more complex scenarios are not represented by the table above. For example, you can perform an upgrade from Pro to Pro for Workstation on a computer with an embedded Pro key using a Pro for Workstation license key, and then later downgrade this computer back to Pro with the firmware-embedded key. The downgrade is allowed but only because the pre-installed OS is Pro. diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md index 6c780da774..37da456194 100644 --- a/windows/deployment/upgrade/windows-10-upgrade-paths.md +++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md @@ -1,11 +1,15 @@ --- title: Windows 10 upgrade paths (Windows 10) +ms.reviewer: +manager: laurawi +ms.author: greglin description: You can upgrade to Windows 10 from a previous version of Windows if the upgrade path is supported. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: medium ms.pagetype: mobile +audience: itpro author: greg-lindsay ms.topic: article --- @@ -18,19 +22,21 @@ ms.topic: article ## Upgrade paths -This topic provides a summary of available upgrade paths to Windows 10. You can upgrade to Windows 10 from Windows 7 or a later operating system. This includes upgrading from one release of Windows 10 to later release of Windows 10. Migrating from one edition of Windows 10 to a different edition of the same release is also supported. For more information about migrating to a different edition of Windows 10, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). +This topic provides a summary of available upgrade paths to Windows 10. You can upgrade to Windows 10 from Windows 7 or a later operating system. This includes upgrading from one release of Windows 10 to later release of Windows 10. Migrating from one edition of Windows 10 to a different edition of the same release is also supported. ->**Windows 10 version upgrade**: You can directly upgrade a supported version of Windows 10 to a newer version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information. +If you are also migrating to a different edition of Windows, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). Methods and supported paths are described on this page to change the edition of Windows. These methods require that you input a license or product key for the new Windows edition prior to starting the upgrade process. Edition downgrade is also supported for some paths, but please note that applications and settings are not maintained when the Windows edition is downgraded. ->**Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions. +> **Windows 10 version upgrade**: You can directly upgrade any semi-annual channel version of Windows 10 to a newer, supported semi-annual channel version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information. +> +> **Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions. +> +> In-place upgrade from Windows 7, Windows 8.1, or [Windows 10 semi-annual channel](https://docs.microsoft.com/windows/release-information/) to Windows 10 LTSC is not supported. **Note**: Windows 10 LTSC 2015 did not block this upgrade path. This was corrected in the Windows 10 LTSC 2016 release, which will now only allow data-only and clean install options. You can upgrade from Windows 10 LTSC to Windows 10 semi-annual channel, provided that you upgrade to the same or a newer build version. For example, Windows 10 Enterprise 2016 LTSB can be upgraded to Windows 10 Enterprise version 1607 or later. Upgrade is supported using the in-place upgrade process (using Windows setup). You will need to use the Product Key switch if you want to keep your apps. If you don't use the switch the option 'Keep personal files and apps' will be grayed out. The command line would be **setup.exe /pkey xxxxx-xxxxx-xxxxx-xxxxx-xxxxx**, using your relevant Windows 10 SAC product key. For example, if using a KMS, the command line would be **setup.exe /pkey NPPR9-FWDCX-D2C8J-H872K-2YT43**. +> +> **Windows N/KN**: Windows "N" and "KN" SKUs (editions without media-related functionality) follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process. +> +> **Windows 8.0**: You cannot upgrade directly from Windows 8.0 to Windows 10. To upgrade from Windows 8.0, you must first install the [Windows 8.1 update](https://support.microsoft.com/help/15356/windows-8-install-update-kb-2919355). ->In-place upgrade from Windows 7, Windows 8.1, or Windows 10 semi-annual channel to Windows 10 LTSC is not supported. **Note**: Windows 10 LTSC 2015 did not block this upgrade path. This was corrected in the Windows 10 LTSC 2016 release, which will now only allow data-only and clean install options. You can upgrade from Windows 10 LTSC to Windows 10 semi-annual channel, provided that you upgrade to the same or a newer build version. For example, Windows 10 Enterprise 2016 LTSB can be upgraded to Windows 10 Enterprise version 1607 or later. Upgrade is supported using the in-place upgrade process (using Windows setup). - ->**Windows N/KN**: Windows "N" and "KN" SKUs follow the same upgrade paths shown below. If the pre-upgrade and post-upgrade editions are not the same type (e.g. Windows 8.1 Pro N to Windows 10 Pro), personal data will be kept but applications and settings will be removed during the upgrade process. - ->**Windows 8.0**: You cannot upgrade directly from Windows 8.0 to Windows 10. To upgrade from Windows 8.0, you must first install the [Windows 8.1 update](https://support.microsoft.com/help/15356/windows-8-install-update-kb-2919355). - -✔ = Full upgrade is supported including personal data, settings, and applications.
                                +✔ = Full upgrade is supported including personal data, settings, and applications.
                                D = Edition downgrade; personal data is maintained, applications and settings are removed.
                                @@ -58,7 +64,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar
                                Home Basic
                                Home Premium
                                Professional✔
                                Ultimate✔
                                Enterprise✔
                                Windows 8.1
                                Connected
                                Pro✔
                                Pro Student✔
                                Pro WMC✔
                                Enterprise✔
                                Embedded Industry✔
                                Windows RT
                                Windows Phone 8.1 ✔
                                Windows 10
                                Home✔✔✔✔ ✔✔✔
                                Pro D✔✔✔✔ ✔✔✔
                                ✔D D
                                ✔✔ ✔✔
                                Mobile Enterprise D✔
                                diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md index 1b021674ca..562773ef21 100644 --- a/windows/deployment/upgrade/windows-error-reporting.md +++ b/windows/deployment/upgrade/windows-error-reporting.md @@ -1,67 +1,74 @@ ---- -title: Windows error reporting - Windows IT Pro -description: Resolve Windows 10 upgrade errors for ITPros. Technical information for IT professionals to help diagnose Windows setup errors. -keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -author: greg-lindsay -ms.date: 03/30/2018 -ms.localizationpriority: medium -ms.topic: article ---- - -# Windows error reporting - -**Applies to** -- Windows 10 - ->[!NOTE] ->This is a 300 level topic (moderately advanced).
                                ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. - - -When Windows Setup fails, the result and extend code are recorded as an informational event in the Application log by Windows Error Reporting as event 1001. The event name is **WinSetupDiag02**. You can use Event Viewer to review this event, or you can use Windows PowerShell. - -To use Windows PowerShell, type the following commands from an elevated Windows PowerShell prompt: - -``` -$events = Get-WinEvent -FilterHashtable @{LogName="Application";ID="1001";Data="WinSetupDiag02"} -$event = [xml]$events[0].ToXml() -$event.Event.EventData.Data -``` - -To use Event Viewer: -1. Open Event Viewer and navigate to **Windows Logs\Application**. -2. Click **Find**, and then search for **winsetupdiag02**. -3. Double-click the event that is highlighted. - -Note: For legacy operating systems, the Event Name was WinSetupDiag01. - -Ten parameters are listed in the event: -
                                - - - - - - - - - - - -
                                P1: The Setup Scenario (1=Media,5=WindowsUpdate,7=Media Creation Tool)
                                P2: Setup Mode (x=default,1=Downlevel,5=Rollback)
                                P3: New OS Architecture (x=default,0=X86,9=AMD64)
                                P4: Install Result (x=default,0=Success,1=Failure,2=Cancel,3=Blocked)
                                P5: Result Error Code (Ex: 0xc1900101)
                                P6: Extend Error Code (Ex: 0x20017)
                                P7: Source OS build (Ex: 9600)
                                P8: Source OS branch (not typically available)
                                P9: New OS build (Ex: 16299}
                                P10: New OS branch (Ex: rs3_release}
                                - -The event will also contain links to log files that can be used to perform a detailed diagnosis of the error. An example of this event from a successful upgrade is shown below. - -![Windows Error Reporting](../images/event.png) - -## Related topics - -[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) -
                                [Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) -
                                [Windows 10 Specifications](https://www.microsoft.com/en-us/windows/Windows-10-specifications) -
                                [Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) -
                                [Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) +--- +title: Windows error reporting - Windows IT Pro +ms.reviewer: +manager: laurawi +ms.author: greglin +description: Learn how to review the events generated by Windows Error Reporting when something goes wrong during Windows 10 setup. +keywords: deploy, error, troubleshoot, windows, 10, upgrade, code, rollback, ITPro +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Windows Error Reporting + +**Applies to** +- Windows 10 + +> [!NOTE] +> This is a 300 level topic (moderately advanced). +> See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. + + +When Windows Setup fails, the result and extend code are recorded as an informational event in the Application log by Windows Error Reporting as event 1001. The event name is **WinSetupDiag02**. You can use Event Viewer to review this event, or you can use Windows PowerShell. + +To use Windows PowerShell, type the following commands from an elevated Windows PowerShell prompt: + +> [!IMPORTANT] +> The following source will be available only if you have updated from a previous version of Windows 10 to a new version. If you installed the current version and have not updated, the source named **WinSetupDiag02** will be unavailable. + +```Powershell +$events = Get-WinEvent -FilterHashtable @{LogName="Application";ID="1001";Data="WinSetupDiag02"} +$event = [xml]$events[0].ToXml() +$event.Event.EventData.Data +``` + +To use Event Viewer: +1. Open Event Viewer and navigate to **Windows Logs\Application**. +2. Click **Find**, and then search for **winsetupdiag02**. +3. Double-click the event that is highlighted. + +Note: For legacy operating systems, the Event Name was WinSetupDiag01. + +Ten parameters are listed in the event: + +| Parameters | +| ------------- | +|P1: The Setup Scenario (1=Media,5=WindowsUpdate,7=Media Creation Tool) | +|P2: Setup Mode (x=default,1=Downlevel,5=Rollback) | +|P3: New OS Architecture (x=default,0=X86,9=AMD64) | +|P4: Install Result (x=default,0=Success,1=Failure,2=Cancel,3=Blocked) | +|**P5: Result Error Code** (Ex: 0xc1900101) | +|**P6: Extend Error Code** (Ex: 0x20017) | +|P7: Source OS build (Ex: 9600) | +|P8: Source OS branch (not typically available) | +|P9: New OS build (Ex: 16299} | +|P10: New OS branch (Ex: rs3_release} | + + +The event will also contain links to log files that can be used to perform a detailed diagnosis of the error. An example of this event from a successful upgrade is shown below. + +![Windows Error Reporting](../images/event.png) + +## Related topics + +[Windows 10 FAQ for IT professionals](https://technet.microsoft.com/windows/dn798755.aspx) +[Windows 10 Enterprise system requirements](https://technet.microsoft.com/windows/dn798752.aspx) +[Windows 10 Specifications](https://www.microsoft.com/windows/Windows-10-specifications) +[Windows 10 IT pro forums](https://social.technet.microsoft.com/Forums/en-US/home?category=Windows10ITPro) +[Fix Windows Update errors by using the DISM or System Update Readiness tool](https://support.microsoft.com/kb/947821) diff --git a/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md b/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md index d5eff8daa4..6062bfa905 100644 --- a/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md +++ b/windows/deployment/upgrade/windows-upgrade-and-migration-considerations.md @@ -1,74 +1,79 @@ ---- -title: Windows Upgrade and Migration Considerations (Windows 10) -description: Windows Upgrade and Migration Considerations -ms.assetid: 7f85095c-5922-45e9-b28e-91b1263c7281 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 11/17/2017 -ms.topic: article ---- - -# Windows upgrade and migration considerations -Files and application settings can be migrated to new hardware running the Windows® operating system, or they can be maintained during an operating system upgrade on the same computer. This topic summarizes the Microsoft® tools you can use to move files and settings between installations in addition to special considerations for performing an upgrade or migration. - -## Upgrade from a previous version of Windows -You can upgrade from an earlier version of Windows, which means you can install the new version of Windows and retain your applications, files, and settings as they were in your previous version of Windows. If you decide to perform a custom installation of Windows instead of an upgrade, your applications and settings will not be maintained. Your personal files, and all Windows files and directories, will be moved to a Windows.old folder. You can access your data in the Windows.old folder after Windows Setup is complete. - -## Migrate files and settings -Migration tools are available to transfer settings from one computer that is running Windows to another. These tools transfer only the program settings, not the programs themselves. - -For more information about application compatibility, see the [Application Compatibility Toolkit (ACT)](https://go.microsoft.com/fwlink/p/?LinkId=131349). - -The User State Migration Tool (USMT) 10.0 is an application intended for administrators who are performing large-scale automated deployments. For deployment to a small number of computers or for individually customized deployments, you can use Windows Easy Transfer. - -### Migrate with Windows Easy Transfer -Windows Easy Transfer is a software wizard for transferring files and settings from one computer that is running Windows to another. It helps you select what to move to your new computer, enables you to set which migration method to use, and then performs the transfer. When the transfer has completed, Windows Easy Transfer Reports shows you what was transferred and provides a list of programs you might want to install on your new computer, in addition to links to other programs you might want to download. - -With Windows Easy Transfer, files and settings can be transferred using a network share, a USB flash drive (UFD), or the Easy Transfer cable. However, you cannot use a regular universal serial bus (USB) cable to transfer files and settings with Windows Easy Transfer. An Easy Transfer cable can be purchased on the Web, from your computer manufacturer, or at an electronics store. - -### Migrate with the User State Migration Tool -You can use USMT to automate migration during large deployments of the Windows operating system. USMT uses configurable migration rule (.xml) files to control exactly which user accounts, user files, operating system settings, and application settings are migrated and how they are migrated. You can use USMT for both *side-by-side* migrations, where one piece of hardware is being replaced, or *wipe-and-load* (or *refresh*) migrations, when only the operating system is being upgraded. - -## Upgrade and migration considerations -Whether you are upgrading or migrating to a new version of Windows, you must be aware of the following issues and considerations: - -### Application compatibility -For more information about application compatibility in Windows, see the [Application Compatibility Toolkit (ACT)](https://go.microsoft.com/fwlink/p/?LinkId=131349). - -### Multilingual Windows image upgrades -When performing multilingual Windows upgrades, cross-language upgrades are not supported by USMT. If you are upgrading or migrating an operating system with multiple language packs installed, you can upgrade or migrate only to the system default user interface (UI) language. For example, if English is the default but you have a Spanish language pack installed, you can upgrade or migrate only to English. - -If you are using a single-language Windows image that matches the system default UI language of your multilingual operating system, the migration will work. However, all of the language packs will be removed, and you will have to reinstall them after the upgrade is completed. - -### Errorhandler.cmd -When upgrading from an earlier version of Windows, if you intend to use Errorhandler.cmd, you must copy this file into the %WINDIR%\\Setup\\Scripts directory on the old installation. This makes sure that if there are errors during the down-level phase of Windows Setup, the commands in Errorhandler.cmd will run. - -### Data drive ACL migration -During the configuration pass of Windows Setup, the root access control list (ACL) on drives formatted for NTFS that do not appear to have an operating system will be changed to the default Windows XP ACL format. The ACLs on these drives are changed to enable authenticated users to modify access on folders and files. - -Changing the ACLs may affect the performance of Windows Setup if the default Windows XP ACLs are applied to a partition with a large amount of data. Because of these performance concerns, you can change the following registry value to disable this feature: - -``` syntax -Key: HKLM\System\Setup -Type: REG_DWORD -Value: "DDACLSys_Disabled" = 1 -``` - -This feature is disabled if this registry key value exists and is configured to `1`. - -## Related topics -[User State Migration Tool (USMT) Overview Topics](../usmt/usmt-topics.md)
                                -[Windows 10 upgrade paths](windows-10-upgrade-paths.md)
                                -[Windows 10 edition upgrade](windows-10-edition-upgrades.md) - - -  - -  - - - - - +--- +title: Windows Upgrade and Migration Considerations (Windows 10) +description: Windows Upgrade and Migration Considerations +ms.assetid: 7f85095c-5922-45e9-b28e-91b1263c7281 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.topic: article +--- + +# Windows upgrade and migration considerations +Files and application settings can be migrated to new hardware running the Windows® operating system, or they can be maintained during an operating system upgrade on the same computer. This topic summarizes the Microsoft® tools you can use to move files and settings between installations in addition to special considerations for performing an upgrade or migration. + +## Upgrade from a previous version of Windows +You can upgrade from an earlier version of Windows, which means you can install the new version of Windows and retain your applications, files, and settings as they were in your previous version of Windows. If you decide to perform a custom installation of Windows instead of an upgrade, your applications and settings will not be maintained. Your personal files, and all Windows files and directories, will be moved to a Windows.old folder. You can access your data in the Windows.old folder after Windows Setup is complete. + +## Migrate files and settings +Migration tools are available to transfer settings from one computer that is running Windows to another. These tools transfer only the program settings, not the programs themselves. + +For more information about application compatibility, see the [Application Compatibility Toolkit (ACT)](https://go.microsoft.com/fwlink/p/?LinkId=131349). + +The User State Migration Tool (USMT) 10.0 is an application intended for administrators who are performing large-scale automated deployments. For deployment to a small number of computers or for individually customized deployments, you can use Windows Easy Transfer. + +### Migrate with Windows Easy Transfer +Windows Easy Transfer is a software wizard for transferring files and settings from one computer that is running Windows to another. It helps you select what to move to your new computer, enables you to set which migration method to use, and then performs the transfer. When the transfer has completed, Windows Easy Transfer Reports shows you what was transferred and provides a list of programs you might want to install on your new computer, in addition to links to other programs you might want to download. + +With Windows Easy Transfer, files and settings can be transferred using a network share, a USB flash drive (UFD), or the Easy Transfer cable. However, you cannot use a regular universal serial bus (USB) cable to transfer files and settings with Windows Easy Transfer. An Easy Transfer cable can be purchased on the Web, from your computer manufacturer, or at an electronics store. + +> [!NOTE] +> Windows Easy Transfer [is not available in Windows 10](https://support.microsoft.com/help/4026265/windows-windows-easy-transfer-is-not-available-in-windows-10). + +### Migrate with the User State Migration Tool +You can use USMT to automate migration during large deployments of the Windows operating system. USMT uses configurable migration rule (.xml) files to control exactly which user accounts, user files, operating system settings, and application settings are migrated and how they are migrated. You can use USMT for both *side-by-side* migrations, where one piece of hardware is being replaced, or *wipe-and-load* (or *refresh*) migrations, when only the operating system is being upgraded. + +## Upgrade and migration considerations +Whether you are upgrading or migrating to a new version of Windows, you must be aware of the following issues and considerations: + +### Application compatibility +For more information about application compatibility in Windows, see [Use Upgrade Readiness to manage Windows upgrades](https://docs.microsoft.com/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades). + +### Multilingual Windows image upgrades +When performing multilingual Windows upgrades, cross-language upgrades are not supported by USMT. If you are upgrading or migrating an operating system with multiple language packs installed, you can upgrade or migrate only to the system default user interface (UI) language. For example, if English is the default but you have a Spanish language pack installed, you can upgrade or migrate only to English. + +If you are using a single-language Windows image that matches the system default UI language of your multilingual operating system, the migration will work. However, all of the language packs will be removed, and you will have to reinstall them after the upgrade is completed. + +### Errorhandler.cmd +When upgrading from an earlier version of Windows, if you intend to use Errorhandler.cmd, you must copy this file into the %WINDIR%\\Setup\\Scripts directory on the old installation. This makes sure that if there are errors during the down-level phase of Windows Setup, the commands in Errorhandler.cmd will run. + +### Data drive ACL migration +During the configuration pass of Windows Setup, the root access control list (ACL) on drives formatted for NTFS that do not appear to have an operating system will be changed to the default Windows XP ACL format. The ACLs on these drives are changed to enable authenticated users to modify access on folders and files. + +Changing the ACLs may affect the performance of Windows Setup if the default Windows XP ACLs are applied to a partition with a large amount of data. Because of these performance concerns, you can change the following registry value to disable this feature: + +``` syntax +Key: HKLM\System\Setup +Type: REG_DWORD +Value: "DDACLSys_Disabled" = 1 +``` + +This feature is disabled if this registry key value exists and is configured to `1`. + +## Related topics +[User State Migration Tool (USMT) Overview Topics](../usmt/usmt-topics.md)
                                +[Windows 10 upgrade paths](windows-10-upgrade-paths.md)
                                +[Windows 10 edition upgrade](windows-10-edition-upgrades.md) + + +  + +  + + + + + diff --git a/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md b/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md index 060c4485ec..b0cf117686 100644 --- a/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md +++ b/windows/deployment/usmt/getting-started-with-the-user-state-migration-tool.md @@ -1,12 +1,15 @@ --- -title: Getting Started with the User State Migration Tool (USMT) (Windows 10) +title: User State Migration Tool (USMT) - Getting Started (Windows 10) description: Getting Started with the User State Migration Tool (USMT) ms.assetid: 506ff1d2-94b8-4460-8672-56aad963504b +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay -ms.date: 04/19/2017 ms.topic: article --- @@ -81,4 +84,4 @@ This topic outlines the general process that you should follow to migrate files **Note**   Run the **LoadState** command in administrator mode. To do this, right-click **Command Prompt**, and then click **Run As Administrator**. -5. Log off after you run the **LoadState** command. Some settings (for example, fonts, wallpaper, and screen saver settings) will not take effect until the next time that the user logs on. \ No newline at end of file +5. Log off after you run the **LoadState** command. Some settings (for example, fonts, wallpaper, and screen saver settings) will not take effect until the next time that the user logs on. diff --git a/windows/deployment/usmt/migrate-application-settings.md b/windows/deployment/usmt/migrate-application-settings.md index f80bc67ba2..8ca3e5b215 100644 --- a/windows/deployment/usmt/migrate-application-settings.md +++ b/windows/deployment/usmt/migrate-application-settings.md @@ -1,169 +1,172 @@ ---- -title: Migrate Application Settings (Windows 10) -description: Migrate Application Settings -ms.assetid: 28f70a83-0a3e-4a6b-968a-2b78ccd3cc07 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migrate Application Settings - - -You can create a custom .xml file to migrate specific line-of-business application settings or to change the default migration behavior of the User State Migration Tool (USMT) 10.0. For ScanState and LoadState to use this file, you must specify the custom .xml file on both command lines. - -This topic defines how to author a custom migration .xml file that migrates the settings of an application that is not migrated by default using MigApp.xml. You should migrate the settings after you install the application, but before the user runs the application for the first time. - -This topic does not contain information about how to migrate applications that store settings in an application-specific store, only the applications that store the information in files or in the registry. It also does not contain information about how to migrate the data that users create using the application. For example, if the application creates .doc files using a specific template, this topic does not discuss how to migrate the .doc files and templates themselves. - -## In this Topic - - -- [Before You Begin](#bkmk-beforebegin) - -- [Step 1: Verify that the application is installed on the source computer, and that it is the same version as the version to be installed on the destination computer](#bkmk-step1). - -- [Step 2: Identify settings to collect and determine where each setting is stored on the computer](#bkmk-step2). - -- [Step 3: Identify how to apply the gathered settings](#bkmk-step3). - -- [Step 4: Create the migration XML component for the application](#bkmk-step4). - -- [Step 5: Test the application settings migration](#bkmk-step5). - -## Before You Begin - - -You should identify a test computer that contains the operating system of your source computers, and the application whose settings you want to migrate. For example, if you are planning on migrating from Windows 7 to Windows 10, install Windows 7 on your test computer and then install the application. - -## Step 1: Verify that the application is installed on the source computer, and that it is the same version as the version to be installed on the destination computer. - - -Before USMT migrates the settings, you need it to check whether the application is installed on the source computer, and that it is the correct version. If the application is not installed on the source computer, you probably do not want USMT to spend time searching for the application’s settings. More importantly, if USMT collects settings for an application that is not installed, it may migrate settings that will cause the destination computer to function incorrectly. You should also investigate whether there is more than one version of the application. This is because the new version may not store the settings in the same place, which may lead to unexpected results on the destination computer. - -There are many ways to detect if an application is installed. The best practice is to check for an application uninstall key in the registry, and then search the computer for the executable file that installed the application. It is important that you check for both of these items, because sometimes different versions of the same application share the same uninstall key. So even if the key is there, it may not correspond to the version of the application that you want. - -### Check the registry for an application uninstall key. - -When many applications are installed (especially those installed using the Microsoft® Windows® Installer technology), an application uninstall key is created under **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall**. For example, when Adobe Acrobat Reader 7 is installed, it creates a key named **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall \\{AC76BA86-7AD7-1033-7B44-A70000000000}**. Therefore, if a computer contains this key, then Adobe Acrobat Reader 7 is installed on the computer. You can check for the existence of a registry key using the **DoesObjectExist** helper function. - -Usually, you can find this key by searching under **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall** for the name of the application, the name of the application executable file, or for the name of the company that makes the application. You can use the Registry Editor (**Regedit.exe** located in the %**SystemRoot**%) to search the registry. - -### Check the file system for the application executable file. - -You should also check the application binaries for the executable that installed the application. To do this, you will first need to determine where the application is installed and what the name of the executable is. Most applications store the installation location of the application binaries in the registry. You should search the registry for the name of the application, the name of the application executable, or for the name of the company that makes the application, until you find the registry value that contains the installation path. Once you have determined the path to the application executable, you can use the **DoesFileVersionMatch** helper function to check for the correct version of the application executable. For an example of how to do this, see the Windows Live™ Messenger section of the MigApp.xml file. - -## Step 2: Identify settings to collect and determine where each setting is stored on the computer. - - -Next, you should go through the user interface and make a list of all of the available settings. You can reduce the list if there are settings that you do not want to migrate. To determine where each setting is stored, you will need to change each setting and monitor the activity on the registry and the file system. You do not need to migrate the binary files and registry settings that are made when the application is installed. This is because you will need to reinstall the application onto the destination computer. You only need to migrate those settings that are customizable. - -### - -**How To Determine Where Each Setting is Stored** - -1. Download a file and registry monitoring tool, such as the Regmon and Filemon tools, from the [Windows Sysinternals Web site](https://go.microsoft.com/fwlink/p/?linkid=36109). - -2. Shut down as many applications as possible to limit the registry and file system activity on the computer. - -3. Filter the output of the tools so it only displays changes being made by the application. - - **Note**   - Most applications store their settings under the user profile. That is, the settings stored in the file system are under the %**UserProfile**% directory, and the settings stored in the registry are under the **HKEY\_CURRENT\_USER** hive. For these applications you can filter the output of the file and registry monitoring tools to show activity only under these locations. This will considerably reduce the amount of output that you will need to examine. - -   - -4. Start the monitoring tool(s), change a setting, and look for registry and file system writes that occurred when you changed the setting. Make sure the changes you make actually take effect. For example, if you are changing a setting in Microsoft Word by selecting a check box in the **Options** dialog box, the change typically will not take effect until you close the dialog box by clicking **OK**. - -5. When the setting is changed, note the changes to the file system and registry. There may be more than one file or registry values for each setting. You should identify the minimal set of file and registry changes that are required to change this setting. This set of files and registry keys is what you will need to migrate in order to migrate the setting. - - **Note**   - Changing an application setting invariably leads to writing to registry keys. If possible, filter the output of the file and registry monitor tool to display only writes to files and registry keys/values. - -   - -## Step 3: Identify how to apply the gathered settings. - - -If the version of the application on the source computer is the same as the one on the destination computer, then you do not have to modify the collected files and registry keys. By default, USMT migrates the files and registry keys from the source location to the corresponding location on the destination computer. For example, if a file was collected from the C:\\Documents and Settings\\User1\\My Documents folder and the profile directory on the destination computer is located at D:\\Users\\User1, then USMT will automatically migrate the file to D:\\Users\\User1\\My Documents. However, you may need to modify the location of some settings in the following three cases: - -### Case 1: The version of the application on the destination computer is newer than the one on the source computer. - -In this case, the newer version of the application may be able to read the settings from the source computer without modification. That is, the data collected from an older version of the application is sometimes compatible with the newer version of the application. However, you may need to modify the setting location if either of the following is true: - -- **The newer version of the application has the ability to import settings from an older version.** This mapping usually happens the first time a user runs the newer version after the settings have been migrated. Some applications do this automatically after settings are migrated; however, other applications will only do this if the application was upgraded from the older version. When the application is upgraded, a set of files and/or registry keys is installed that indicates the older version of the application was previously installed. If you perform a clean installation of the newer version (which is the case in most migrations), the computer does not contain this set of files and registry keys so the mapping does not occur. In order to trick the newer version of the application into initiating this import process, your migration script may need to create these files and/or registry keys on the destination computer. - - To identify which files and/or registry keys/values need to be created to cause the import, you should upgrade the older version of the application to the newer one and monitor the changes made to the file system and registry by using the same process described in [How To determine where each setting is stored](#bkmkdetermine). Once you know the set of files that the computer needs, you can use the <`addObjects`> element to add them to the destination computer. - -- [The newer version of the application cannot read settings from the source computer and it is also unable to import the settings into the new format.](#bkmkdetermine) In this case, you will need to create a mapping for each setting from the old locations to the new locations. To do this, determine where the newer version stores each setting using the process described in How to determine where each setting is stored. After you have created the mapping, apply the settings to the new location on the destination computer using the <`locationModify`> element, and the **RelativeMove** and **ExactMove** helper functions. - -### Case 2: The destination computer already contains settings for the application. - -We recommend that you migrate the settings after you install the application, but before the user runs the application for the first time. We recommend this because this ensures that there are no settings on the destination computer when you migrate the settings. If you must install the application before the migration, you should delete any existing settings using the <`destinationCleanup`> element. If for any reason you want to preserve the settings that are on the destination computer, you can use the <`merge`> element and **DestinationPriority** helper function. - -### Case 3: The application overwrites settings when it is installed. - -We recommend that you migrate the settings after you install the application, but before the user runs the application for the first time. We recommend this because this ensures that there are no settings on the destination computer when you migrate the settings. Also, when some applications are installed, they overwrite any existing settings that are on the computer. In this scenario, if you migrated the data before you installed the application, your customized settings would be overwritten. This is common for applications that store settings in locations that are outside of the user profile (typically these are settings that apply to all users). These universal settings are sometimes overwritten when an application is installed, and they are replaced by default values. To avoid this, you must install these applications before migrating the files and settings to the destination computer. By default with USMT, data from the source computer overwrites data that already exists in the same location on the destination computer. - -## Step 4: Create the migration XML component for the application - - -After you have completed steps 1 through 3, you will need to create a custom migration .xml file that migrates the application based on the information that you now have. You can use the MigApp.xml file as a model because it contains examples of many of the concepts discussed in this topic. You can also see [Custom XML Examples](usmt-custom-xml-examples.md) for another sample .xml file. - -**Note**   -We recommend that you create a separate .xml file instead of adding your script to the **MigApp.xml** file. This is because the **MigApp.xml** file is a very large file and it will be difficult to read and edit. In addition, if you reinstall USMT for some reason, the **MigApp.xml** file will be overwritten by the default version of the file and you will lose your customized version. - -  - -**Important**   -Some applications store information in the user profile that should not be migrated (for example, application installation paths, the computer name, and so on). You should make sure to exclude these files and registry keys from the migration. - -  - -Your script should do the following: - -1. Check whether the application and correct version is installed by: - - - Searching for the installation uninstall key under **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall** using the **DoesObjectExist** helper function. - - - Checking for the correct version of the application executable file using the **DoesFileVersionMatch** helper function. - -2. If the correct version of the application is installed, then ensure that each setting is migrated to the appropriate location on the destination computer. - - - If the versions of the applications are the same on both the source and destination computers, migrate each setting using the <`include`> and <`exclude`> elements. - - - If the version of the application on the destination computer is newer than the one on the source computer, and the application cannot import the settings, your script should either 1) add the set of files that trigger the import using the <`addObjects`> element or 2) create a mapping that applies the old settings to the correct location on the destination computer using the <`locationModify`> element, and the **RelativeMove** and **ExactMove** helper functions. - - - If you must install the application before migrating the settings, delete any settings that are already on the destination computer using the <`destinationCleanup`> element. - -For information about the .xml elements and helper functions, see [XML Elements Library](usmt-xml-elements-library.md). - -## Step 5: Test the application settings migration - - -On a test computer, install the operating system that will be installed on the destination computers. For example, if you are planning on migrating from Windows 7 to Windows 10, install Windows 10 and the application. Next, run LoadState on the test computer and verify that all settings migrate. Make corrections if necessary and repeat the process until all the necessary settings are migrated correctly. - -To speed up the time it takes to collect and migrate the data, you can migrate only one user at a time, and you can exclude all other components from the migration except the application that you are testing. To specify only User1 in the migration, type: **/ue:\*\\\* /ui:user1**. For more information, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md) and User options in the [ScanState Syntax](usmt-scanstate-syntax.md) topic. To troubleshoot a problem, check the progress log, and the ScanState and LoadState logs, which contain warnings and errors that may point to problems with the migration. - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - -[Conflicts and Precedence](usmt-conflicts-and-precedence.md) - -[XML Elements Library](usmt-xml-elements-library.md) - -[Log Files](usmt-log-files.md) - -  - -  - - - - - +--- +title: Migrate Application Settings (Windows 10) +description: Migrate Application Settings +ms.assetid: 28f70a83-0a3e-4a6b-968a-2b78ccd3cc07 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migrate Application Settings + + +You can create a custom .xml file to migrate specific line-of-business application settings or to change the default migration behavior of the User State Migration Tool (USMT) 10.0. For ScanState and LoadState to use this file, you must specify the custom .xml file on both command lines. + +This topic defines how to author a custom migration .xml file that migrates the settings of an application that is not migrated by default using MigApp.xml. You should migrate the settings after you install the application, but before the user runs the application for the first time. + +This topic does not contain information about how to migrate applications that store settings in an application-specific store, only the applications that store the information in files or in the registry. It also does not contain information about how to migrate the data that users create using the application. For example, if the application creates .doc files using a specific template, this topic does not discuss how to migrate the .doc files and templates themselves. + +## In this Topic + + +- [Before You Begin](#bkmk-beforebegin) + +- [Step 1: Verify that the application is installed on the source computer, and that it is the same version as the version to be installed on the destination computer](#bkmk-step1). + +- [Step 2: Identify settings to collect and determine where each setting is stored on the computer](#bkmk-step2). + +- [Step 3: Identify how to apply the gathered settings](#bkmk-step3). + +- [Step 4: Create the migration XML component for the application](#bkmk-step4). + +- [Step 5: Test the application settings migration](#bkmk-step5). + +## Before You Begin + + +You should identify a test computer that contains the operating system of your source computers, and the application whose settings you want to migrate. For example, if you are planning on migrating from Windows 7 to Windows 10, install Windows 7 on your test computer and then install the application. + +## Step 1: Verify that the application is installed on the source computer, and that it is the same version as the version to be installed on the destination computer. + + +Before USMT migrates the settings, you need it to check whether the application is installed on the source computer, and that it is the correct version. If the application is not installed on the source computer, you probably do not want USMT to spend time searching for the application’s settings. More importantly, if USMT collects settings for an application that is not installed, it may migrate settings that will cause the destination computer to function incorrectly. You should also investigate whether there is more than one version of the application. This is because the new version may not store the settings in the same place, which may lead to unexpected results on the destination computer. + +There are many ways to detect if an application is installed. The best practice is to check for an application uninstall key in the registry, and then search the computer for the executable file that installed the application. It is important that you check for both of these items, because sometimes different versions of the same application share the same uninstall key. So even if the key is there, it may not correspond to the version of the application that you want. + +### Check the registry for an application uninstall key. + +When many applications are installed (especially those installed using the Microsoft® Windows® Installer technology), an application uninstall key is created under **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall**. For example, when Adobe Acrobat Reader 7 is installed, it creates a key named **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall \\{AC76BA86-7AD7-1033-7B44-A70000000000}**. Therefore, if a computer contains this key, then Adobe Acrobat Reader 7 is installed on the computer. You can check for the existence of a registry key using the **DoesObjectExist** helper function. + +Usually, you can find this key by searching under **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall** for the name of the application, the name of the application executable file, or for the name of the company that makes the application. You can use the Registry Editor (**Regedit.exe** located in the %**SystemRoot**%) to search the registry. + +### Check the file system for the application executable file. + +You should also check the application binaries for the executable that installed the application. To do this, you will first need to determine where the application is installed and what the name of the executable is. Most applications store the installation location of the application binaries in the registry. You should search the registry for the name of the application, the name of the application executable, or for the name of the company that makes the application, until you find the registry value that contains the installation path. Once you have determined the path to the application executable, you can use the **DoesFileVersionMatch** helper function to check for the correct version of the application executable. For an example of how to do this, see the Windows Live™ Messenger section of the MigApp.xml file. + +## Step 2: Identify settings to collect and determine where each setting is stored on the computer. + + +Next, you should go through the user interface and make a list of all of the available settings. You can reduce the list if there are settings that you do not want to migrate. To determine where each setting is stored, you will need to change each setting and monitor the activity on the registry and the file system. You do not need to migrate the binary files and registry settings that are made when the application is installed. This is because you will need to reinstall the application onto the destination computer. You only need to migrate those settings that are customizable. + +### + +**How To Determine Where Each Setting is Stored** + +1. Download a file and registry monitoring tool, such as the Regmon and Filemon tools, from the [Windows Sysinternals Web site](https://go.microsoft.com/fwlink/p/?linkid=36109). + +2. Shut down as many applications as possible to limit the registry and file system activity on the computer. + +3. Filter the output of the tools so it only displays changes being made by the application. + + **Note**   + Most applications store their settings under the user profile. That is, the settings stored in the file system are under the %**UserProfile**% directory, and the settings stored in the registry are under the **HKEY\_CURRENT\_USER** hive. For these applications you can filter the output of the file and registry monitoring tools to show activity only under these locations. This will considerably reduce the amount of output that you will need to examine. + + + +4. Start the monitoring tool(s), change a setting, and look for registry and file system writes that occurred when you changed the setting. Make sure the changes you make actually take effect. For example, if you are changing a setting in Microsoft Word by selecting a check box in the **Options** dialog box, the change typically will not take effect until you close the dialog box by clicking **OK**. + +5. When the setting is changed, note the changes to the file system and registry. There may be more than one file or registry values for each setting. You should identify the minimal set of file and registry changes that are required to change this setting. This set of files and registry keys is what you will need to migrate in order to migrate the setting. + + **Note**   + Changing an application setting invariably leads to writing to registry keys. If possible, filter the output of the file and registry monitor tool to display only writes to files and registry keys/values. + + + +## Step 3: Identify how to apply the gathered settings. + + +If the version of the application on the source computer is the same as the one on the destination computer, then you do not have to modify the collected files and registry keys. By default, USMT migrates the files and registry keys from the source location to the corresponding location on the destination computer. For example, if a file was collected from the C:\\Documents and Settings\\User1\\My Documents folder and the profile directory on the destination computer is located at D:\\Users\\User1, then USMT will automatically migrate the file to D:\\Users\\User1\\My Documents. However, you may need to modify the location of some settings in the following three cases: + +### Case 1: The version of the application on the destination computer is newer than the one on the source computer. + +In this case, the newer version of the application may be able to read the settings from the source computer without modification. That is, the data collected from an older version of the application is sometimes compatible with the newer version of the application. However, you may need to modify the setting location if either of the following is true: + +- **The newer version of the application has the ability to import settings from an older version.** This mapping usually happens the first time a user runs the newer version after the settings have been migrated. Some applications do this automatically after settings are migrated; however, other applications will only do this if the application was upgraded from the older version. When the application is upgraded, a set of files and/or registry keys is installed that indicates the older version of the application was previously installed. If you perform a clean installation of the newer version (which is the case in most migrations), the computer does not contain this set of files and registry keys so the mapping does not occur. In order to trick the newer version of the application into initiating this import process, your migration script may need to create these files and/or registry keys on the destination computer. + + To identify which files and/or registry keys/values need to be created to cause the import, you should upgrade the older version of the application to the newer one and monitor the changes made to the file system and registry by using the same process described in [How To determine where each setting is stored](#bkmkdetermine). Once you know the set of files that the computer needs, you can use the <`addObjects`> element to add them to the destination computer. + +- [The newer version of the application cannot read settings from the source computer and it is also unable to import the settings into the new format.](#bkmkdetermine) In this case, you will need to create a mapping for each setting from the old locations to the new locations. To do this, determine where the newer version stores each setting using the process described in How to determine where each setting is stored. After you have created the mapping, apply the settings to the new location on the destination computer using the <`locationModify`> element, and the **RelativeMove** and **ExactMove** helper functions. + +### Case 2: The destination computer already contains settings for the application. + +We recommend that you migrate the settings after you install the application, but before the user runs the application for the first time. We recommend this because this ensures that there are no settings on the destination computer when you migrate the settings. If you must install the application before the migration, you should delete any existing settings using the <`destinationCleanup`> element. If for any reason you want to preserve the settings that are on the destination computer, you can use the <`merge`> element and **DestinationPriority** helper function. + +### Case 3: The application overwrites settings when it is installed. + +We recommend that you migrate the settings after you install the application, but before the user runs the application for the first time. We recommend this because this ensures that there are no settings on the destination computer when you migrate the settings. Also, when some applications are installed, they overwrite any existing settings that are on the computer. In this scenario, if you migrated the data before you installed the application, your customized settings would be overwritten. This is common for applications that store settings in locations that are outside of the user profile (typically these are settings that apply to all users). These universal settings are sometimes overwritten when an application is installed, and they are replaced by default values. To avoid this, you must install these applications before migrating the files and settings to the destination computer. By default with USMT, data from the source computer overwrites data that already exists in the same location on the destination computer. + +## Step 4: Create the migration XML component for the application + + +After you have completed steps 1 through 3, you will need to create a custom migration .xml file that migrates the application based on the information that you now have. You can use the MigApp.xml file as a model because it contains examples of many of the concepts discussed in this topic. You can also see [Custom XML Examples](usmt-custom-xml-examples.md) for another sample .xml file. + +**Note**   +We recommend that you create a separate .xml file instead of adding your script to the **MigApp.xml** file. This is because the **MigApp.xml** file is a very large file and it will be difficult to read and edit. In addition, if you reinstall USMT for some reason, the **MigApp.xml** file will be overwritten by the default version of the file and you will lose your customized version. + + + +**Important**   +Some applications store information in the user profile that should not be migrated (for example, application installation paths, the computer name, and so on). You should make sure to exclude these files and registry keys from the migration. + + + +Your script should do the following: + +1. Check whether the application and correct version is installed by: + + - Searching for the installation uninstall key under **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall** using the **DoesObjectExist** helper function. + + - Checking for the correct version of the application executable file using the **DoesFileVersionMatch** helper function. + +2. If the correct version of the application is installed, then ensure that each setting is migrated to the appropriate location on the destination computer. + + - If the versions of the applications are the same on both the source and destination computers, migrate each setting using the <`include`> and <`exclude`> elements. + + - If the version of the application on the destination computer is newer than the one on the source computer, and the application cannot import the settings, your script should either 1) add the set of files that trigger the import using the <`addObjects`> element or 2) create a mapping that applies the old settings to the correct location on the destination computer using the <`locationModify`> element, and the **RelativeMove** and **ExactMove** helper functions. + + - If you must install the application before migrating the settings, delete any settings that are already on the destination computer using the <`destinationCleanup`> element. + +For information about the .xml elements and helper functions, see [XML Elements Library](usmt-xml-elements-library.md). + +## Step 5: Test the application settings migration + + +On a test computer, install the operating system that will be installed on the destination computers. For example, if you are planning on migrating from Windows 7 to Windows 10, install Windows 10 and the application. Next, run LoadState on the test computer and verify that all settings migrate. Make corrections if necessary and repeat the process until all the necessary settings are migrated correctly. + +To speed up the time it takes to collect and migrate the data, you can migrate only one user at a time, and you can exclude all other components from the migration except the application that you are testing. To specify only User1 in the migration, type: **/ue:\*\\\* /ui:user1**. For more information, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md) and User options in the [ScanState Syntax](usmt-scanstate-syntax.md) topic. To troubleshoot a problem, check the progress log, and the ScanState and LoadState logs, which contain warnings and errors that may point to problems with the migration. + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + +[Conflicts and Precedence](usmt-conflicts-and-precedence.md) + +[XML Elements Library](usmt-xml-elements-library.md) + +[Log Files](usmt-log-files.md) + + + + + + + + + diff --git a/windows/deployment/usmt/migration-store-types-overview.md b/windows/deployment/usmt/migration-store-types-overview.md index d019dc53f2..2d1d744fa6 100644 --- a/windows/deployment/usmt/migration-store-types-overview.md +++ b/windows/deployment/usmt/migration-store-types-overview.md @@ -1,78 +1,81 @@ ---- -title: Migration Store Types Overview (Windows 10) -description: Migration Store Types Overview -ms.assetid: 3b6ce746-76c6-43ff-8cd5-02ed0ae0cf70 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migration Store Types Overview - - -When planning your migration, you should determine which migration store type best meets your needs. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) 10.0 components on your source and destination computers. You should also determine the space needed to create and host the migration store, whether you are using a local share, network share, or storage device. - -## In This Topic - - -[Migration Store Types](#bkmk-types) - -[Local Store vs. Remote Store](#bkmk-localvremote) - -[The /localonly Command-Line Option](#bkmk-localonly) - -## Migration Store Types - - -This section describes the three migration store types available in USMT. - -### Uncompressed (UNC) - -The uncompressed (UNC) migration store is an uncompressed directory with a mirror image of the folder hierarchy being migrated. Each directory and file retains the same access permissions that it has on the local file system. You can use Windows Explorer to view this migration store type. Settings are stored in a catalog file that also describes how to restore files on the destination computer. - -### Compressed - -The compressed migration store is a single image file that contains all files being migrated and a catalog file. This image file is often encrypted and protected with a password, and cannot be navigated with Windows Explorer. - -### Hard-Link - -A hard-link migration store functions as a map that defines how a collection of bits on the hard disk are “wired” into the file system. You use the new USMT hard-link migration store in the PC Refresh scenario only. This is because the hard-link migration store is maintained on the local computer while the old operating system is removed and the new operating system is installed. Using a hard-link migration store saves network bandwidth and minimizes the server use needed to accomplish the migration. - -You use a command-line option,**/hardlink** , to create a hard-link migration store, which functions the same as an uncompressed migration store. Files are not duplicated on the local computer when user state is captured, nor are they duplicated when user state is restored. For more information, see [Hard-Link Migration Store](usmt-hard-link-migration-store.md). - -The following flowchart illustrates the procedural differences between a local migration store and a remote migration store. In this example, a hard-link migration store is used for the local store. - -![migration store comparison](images/dep-win8-l-usmt-migrationcomparemigstores.gif) - -## Local Store vs. Remote Store - - -If you have enough space and you are migrating the user state back to the same computer, storing data on a local device is normally the best option to reduce server storage costs and network performance issues. You can store the data locally either on a different partition or on a removable device such as a USB flash drive (UFD). Also, depending on the imaging technology that you are using, you might be able to store the data on the partition that is being re-imaged, if the data will be protected from deletion during the process. To increase performance, store the data on high-speed drives that use a high-speed network connection. It is also good practice to ensure that the migration is the only task the server is performing. - -If there is not enough local disk space, or if you are moving the user state to another computer, then you must store the data remotely. For example, you can store it in on a shared folder, on removable media such as a UFD drive, or you can store it directly on the destination computer. For example, create and share C:\\store on the destination computer. Then run the ScanState command on the source computer and save the files and settings to \\\\*DestinationComputerName*\\store. Then, run the **LoadState** command on the destination computer and specify **C:\\Store** as the store location. By doing this, you do not need to save the files to a server. - -**Important**   -If possible, have users store their data within their %UserProfile%\\My Documents and %UserProfile%\\Application Data folders. This will reduce the chance of USMT missing critical user data that is located in a directory that USMT is not configured to check. - -  - -### The /localonly Command-Line Option - -You should use this option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when you specify **/LocalOnly**, see [ScanState Syntax](usmt-scanstate-syntax.md). - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md) - -  - -  - - - - - +--- +title: Migration Store Types Overview (Windows 10) +description: Migration Store Types Overview +ms.assetid: 3b6ce746-76c6-43ff-8cd5-02ed0ae0cf70 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migration Store Types Overview + + +When planning your migration, you should determine which migration store type best meets your needs. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) 10.0 components on your source and destination computers. You should also determine the space needed to create and host the migration store, whether you are using a local share, network share, or storage device. + +## In This Topic + + +[Migration Store Types](#bkmk-types) + +[Local Store vs. Remote Store](#bkmk-localvremote) + +[The /localonly Command-Line Option](#bkmk-localonly) + +## Migration Store Types + + +This section describes the three migration store types available in USMT. + +### Uncompressed (UNC) + +The uncompressed (UNC) migration store is an uncompressed directory with a mirror image of the folder hierarchy being migrated. Each directory and file retains the same access permissions that it has on the local file system. You can use Windows Explorer to view this migration store type. Settings are stored in a catalog file that also describes how to restore files on the destination computer. + +### Compressed + +The compressed migration store is a single image file that contains all files being migrated and a catalog file. This image file is often encrypted and protected with a password, and cannot be navigated with Windows Explorer. + +### Hard-Link + +A hard-link migration store functions as a map that defines how a collection of bits on the hard disk are “wired” into the file system. You use the new USMT hard-link migration store in the PC Refresh scenario only. This is because the hard-link migration store is maintained on the local computer while the old operating system is removed and the new operating system is installed. Using a hard-link migration store saves network bandwidth and minimizes the server use needed to accomplish the migration. + +You use a command-line option,**/hardlink** , to create a hard-link migration store, which functions the same as an uncompressed migration store. Files are not duplicated on the local computer when user state is captured, nor are they duplicated when user state is restored. For more information, see [Hard-Link Migration Store](usmt-hard-link-migration-store.md). + +The following flowchart illustrates the procedural differences between a local migration store and a remote migration store. In this example, a hard-link migration store is used for the local store. + +![migration store comparison](images/dep-win8-l-usmt-migrationcomparemigstores.gif) + +## Local Store vs. Remote Store + + +If you have enough space and you are migrating the user state back to the same computer, storing data on a local device is normally the best option to reduce server storage costs and network performance issues. You can store the data locally either on a different partition or on a removable device such as a USB flash drive (UFD). Also, depending on the imaging technology that you are using, you might be able to store the data on the partition that is being re-imaged, if the data will be protected from deletion during the process. To increase performance, store the data on high-speed drives that use a high-speed network connection. It is also good practice to ensure that the migration is the only task the server is performing. + +If there is not enough local disk space, or if you are moving the user state to another computer, then you must store the data remotely. For example, you can store it in on a shared folder, on removable media such as a UFD drive, or you can store it directly on the destination computer. For example, create and share C:\\store on the destination computer. Then run the ScanState command on the source computer and save the files and settings to \\\\*DestinationComputerName*\\store. Then, run the **LoadState** command on the destination computer and specify **C:\\Store** as the store location. By doing this, you do not need to save the files to a server. + +**Important**   +If possible, have users store their data within their %UserProfile%\\My Documents and %UserProfile%\\Application Data folders. This will reduce the chance of USMT missing critical user data that is located in a directory that USMT is not configured to check. + + + +### The /localonly Command-Line Option + +You should use this option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when you specify **/LocalOnly**, see [ScanState Syntax](usmt-scanstate-syntax.md). + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md) + + + + + + + + + diff --git a/windows/deployment/usmt/offline-migration-reference.md b/windows/deployment/usmt/offline-migration-reference.md index 93bdc1523e..2eab7ea7b8 100644 --- a/windows/deployment/usmt/offline-migration-reference.md +++ b/windows/deployment/usmt/offline-migration-reference.md @@ -2,9 +2,13 @@ title: Offline Migration Reference (Windows 10) description: Offline Migration Reference ms.assetid: f347547c-d601-4c3e-8f2d-0138edeacfda +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -89,19 +93,19 @@ The following table defines the supported combination of online and offline oper
                                -  + **Note**   It is possible to run the ScanState tool while the drive remains encrypted by suspending Windows BitLocker Drive Encryption before booting into WinPE. For more information, see [this Microsoft site](https://go.microsoft.com/fwlink/p/?LinkId=190314). -  + ## User-Group Membership and Profile Control User-group membership is not preserved during offline migrations. You must configure a **<ProfileControl>** section in the Config.xml file to specify the groups that the migrated users should be made members of. The following example places all migrated users into the Users group: -``` syntax +``` xml @@ -156,7 +160,7 @@ An offline migration can either be enabled by using a configuration file on the -  + You can use only one of the **/offline**,**/offlineWinDir** , or **/OfflineWinOld** command-line options at a time; USMT does not support using more than one together. @@ -194,7 +198,7 @@ The following system environment variables are necessary in the scenarios outlin -  + ## Offline.xml Elements @@ -239,7 +243,7 @@ Syntax: <failOnMultipleWinDir>1</failOnMultipleWinDir> or Syntax: &l The following XML example illustrates some of the elements discussed earlier in this topic. -``` syntax +``` xml C:\Windows @@ -255,9 +259,9 @@ The following XML example illustrates some of the elements discussed earlier in [Plan Your Migration](usmt-plan-your-migration.md) -  + -  + diff --git a/windows/deployment/usmt/understanding-migration-xml-files.md b/windows/deployment/usmt/understanding-migration-xml-files.md index 0f29913dee..bc484bd496 100644 --- a/windows/deployment/usmt/understanding-migration-xml-files.md +++ b/windows/deployment/usmt/understanding-migration-xml-files.md @@ -2,9 +2,13 @@ title: Understanding Migration XML Files (Windows 10) description: Understanding Migration XML Files ms.assetid: d3d1fe89-085c-4da8-9657-fd54b8bfc4b7 +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -52,7 +56,7 @@ The Config.xml file is the configuration file created by the `/genconfig` option **Note**   When modifying the XML elements in the Config.xml file, you should edit an element and set the **migrate** property to **no**, rather than deleting the element from the file. If you delete the element instead of setting the property, the component may still be migrated by rules in other XML files. -  + ## Overview of the MigApp.xml file @@ -62,7 +66,7 @@ The MigApp.xml file installed with USMT includes instructions to migrate the set **Important**   The MigApps.xml file will only detect and migrate .pst files that are linked to Microsoft Office Outlook. See the [Sample migration rules for customized versions of XML files](#bkmk-samples) section of this document for more information about migrating .pst files that are not linked to Outlook. -  + ## Overview of the MigDocs.xml file @@ -179,7 +183,7 @@ You can make a copy of the MigUser.xml file and modify it to include or exclude **Note**   Each file name extension you include in the rules within the MigUser.xml file increases the amount of time needed for the ScanState tool to gather the files for the migration. If you are migrating more than three hundred file types, you may experience a slow migration. For more information about other ways to organize the migration of your data, see the [Using multiple XML files](#bkmk-multiple) section of this document. -  + ## Using multiple XML files @@ -201,7 +205,7 @@ You can use multiple XML files with the ScanState and LoadState tools. Each of t

                                Config.xml file

                                Operating-system components such as desktop wallpaper and background theme.

                                -

                                You can also overload config.xml to include some application and document settings by generating the config.xml file with the other default XML files. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [Config.xml File](usmt-configxml-file.md).

                                +

                                You can also overload config.xml to include some application and document settings by generating the config.xml file with the other default XML files. For more information, see Customize USMT XML Files and Config.xml File.

                                MigApps.xml file

                                @@ -218,11 +222,11 @@ You can use multiple XML files with the ScanState and LoadState tools. Each of t -  + For example, you can use all of the XML migration file types for a single migration, as in the following example: -``` syntax +``` Scanstate /config:c:\myFolder\config.xml /i:migapps.xml /i:migdocs.xml /i:customrules.xml ``` @@ -231,7 +235,7 @@ Scanstate /config:c:\myFolder\config.xml /i:migapps.xml /i:migdocs.xml / **Important**   You should not use the MigUser.xml and MigDocs.xml files together in the same command. Using both XML files can result in duplication of some migrated files. This occurs when conflicting target-location instructions are given in each XML file. The target file will be stored once during the migration, but will be applied by each XML file to a different location on the destination computer. -  + If your data set is unknown or if many files are stored outside of the standard user-profile folders, the MigDocs.xml is a better choice than the MigUser.xml file, because the MigDocs.xml file will gather a broader scope of data. The MigDocs.xml file migrates folders of data based on location. The MigUser.xml file migrates only the files with the specified file name extensions. @@ -245,7 +249,7 @@ You can use the **/genmigxml** command-line option to determine which files will **Note**   If you reinstall USMT, the default migration XML files will be overwritten and any customizations you make directly to these files will be lost. Consider creating separate XML files for your custom migration rules and saving them in a secure location. -  + To generate the XML migration rules file for a source computer: @@ -255,14 +259,14 @@ To generate the XML migration rules file for a source computer: 3. At the command prompt, type: - ``` syntax + ``` cd /d scanstate.exe /genmigxml: ``` Where *<USMTpath>* is the location on your source computer where you have saved the USMT files and tools, and *<filepath.xml>* is the full path to a file where you can save the report. For example, type: - ``` syntax + ``` cd /d c:\USMT scanstate.exe /genmigxml:"C:\Documents and Settings\USMT Tester\Desktop\genMig.xml" ``` @@ -289,7 +293,7 @@ The MigDocs.xml file calls the **GenerateDocPatterns** function, which takes thr

                                ScanProgramFiles

                                The ScanProgramFiles argument is valid only when the GenerateDocPatterns function is called in a system context. This argument determines whether or not to scan the Program Files directory to gather registered file name extensions for known applications.

                                For example, when set to TRUE, the function discovers and migrates .doc files under the Microsoft Office directory, because .doc is a file name extension registered to a Microsoft Office application. The GenerateDocPatterns function generates this inclusion pattern for .doc files:

                                -
                                <pattern type="File">C:\Program Files\Microsoft Office\*[*.doc]</pattern>
                                +
                                <pattern type="File">C:\Program Files\Microsoft Office[.doc]</pattern>

                                If a child folder of an included folder contains an installed application, ScanProgramFiles will also create an exclusion rule for the child folder. All folders under the application folder will be scanned recursively for registered file name extensions.

                                False

                                @@ -306,41 +310,41 @@ The MigDocs.xml file calls the **GenerateDocPatterns** function, which takes thr -  + **Usage:** -``` syntax +``` MigXmlHelper.GenerateDocPatterns ("", "", "") ``` To create include data patterns for only the system drive: -``` syntax +``` xml -      -         -      + + + ``` To create an include rule to gather files for registered extensions from the %PROGRAMFILES% directory: -``` syntax +``` xml -      -         -      + + + ``` To create exclude data patterns: -``` syntax +``` xml -      -         -      + + + ``` @@ -399,14 +403,14 @@ The user context includes rules for data in the User Profiles directory. When ca **Note**   Rules contained in a component that is assigned the user context will be run for each user profile on the computer. Files that are scanned multiple times by the MigDocs.xml files will only be copied to the migration store once; however, a large number of rules in the user context can slow down the migration. Use the system context when it is applicable. -  + ### Sample migration rules for customized versions of XML files **Note**   For best practices and requirements for customized XML files in USMT, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [General Conventions](usmt-general-conventions.md). -  + ### Exclude rules usage examples @@ -420,16 +424,16 @@ In the examples below, the source computer has a .txt file called "new text docu

                                Rule 1

                                -
                                <pattern type="File">d:\new folder\[new text document.txt]</pattern>
                                +
                                <pattern type="File">d:\new folder[new text document.txt]</pattern>

                                Rule 2

                                -
                                <pattern type="File">d:\new folder\*[*]</pattern>
                                +
                                <pattern type="File">d:\new folder[]</pattern>
                                -  + To exclude the new text document.txt file as well as any .txt files in “new folder”, you can do the following: @@ -437,12 +441,12 @@ To exclude the new text document.txt file as well as any .txt files in “new fo To exclude Rule 1, there needs to be an exact match of the file name. However, for Rule 2, you can create a pattern to exclude files by using the file name extension. -``` syntax +``` xml -      -        D:\Newfolder\[new text document.txt] -         D:\New folder\*[*.txt] -      + + D:\Newfolder\[new text document.txt] + D:\New folder\*[*.txt] + ``` @@ -450,11 +454,11 @@ To exclude Rule 1, there needs to be an exact match of the file name. However, f If you do not know the file name or location of the file, but you do know the file name extension, you can use the **GenerateDrivePatterns** function. However, the rule will be less specific than the default include rule generated by the MigDocs.xml file, so it will not have precedence. You must use the <UnconditionalExclude> element to give this rule precedence over the default include rule. For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). -``` syntax +``` xml -      -         -      + + + ``` @@ -462,18 +466,18 @@ If you do not know the file name or location of the file, but you do know the fi If you want the <UnconditionalExclude> element to apply to both the system and user context, you can create a third component using the **UserandSystem** context. Rules in this component will be run in both contexts. -``` syntax +``` xml -   MigDocExcludes -    -      -        -          -                 -          -        -      -    + MigDocExcludes + + + + + + + + + ``` @@ -487,11 +491,11 @@ The application data directory is the most common location that you would need t This rule will include .pst files that are located in the default location, but are not linked to Microsoft Outlook. Use the user context to run this rule for each user on the computer. -``` syntax +``` xml -      -        %CSIDL_LOCAL_APPDATA%\Microsoft\Outlook\*[*.pst] -      + + %CSIDL_LOCAL_APPDATA%\Microsoft\Outlook\*[*.pst] + ``` @@ -499,11 +503,11 @@ This rule will include .pst files that are located in the default location, but For locations outside the user profile, such as the Program Files folder, you can add the rule to the system context component. -``` syntax +``` xml -      -        %CSIDL_PROGRAM_FILES%\*[*.pst] -      + + %CSIDL_PROGRAM_FILES%\*[*.pst] + ``` @@ -512,7 +516,7 @@ For more examples of include rules that you can use in custom migration XML file **Note**   For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). -  + ## Next steps @@ -528,9 +532,9 @@ You can use an XML schema (MigXML.xsd) file to validate the syntax of your custo [Include Files and Settings](usmt-include-files-and-settings.md) -  + -  + diff --git a/windows/deployment/usmt/usmt-best-practices.md b/windows/deployment/usmt/usmt-best-practices.md index 5d26845936..48782e0bdc 100644 --- a/windows/deployment/usmt/usmt-best-practices.md +++ b/windows/deployment/usmt/usmt-best-practices.md @@ -2,9 +2,13 @@ title: USMT Best Practices (Windows 10) description: USMT Best Practices ms.assetid: e3cb1e78-4230-4eae-b179-e6e9160542d2 +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -62,7 +66,7 @@ As the authorized administrator, it is your responsibility to protect the privac **Important**   If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration. -   + - **Encrypt the store** @@ -95,7 +99,7 @@ As the authorized administrator, it is your responsibility to protect the privac Although it is not a requirement, it is good practice for <CustomFileName> to match the name of the file. For example, the following is from the MigApp.xml file: - ``` syntax + ``` xml ``` @@ -121,7 +125,7 @@ As the authorized administrator, it is your responsibility to protect the privac **Note**   The number of times a rule is processed does not affect the number of times a file is migrated. The USMT migration engine ensures that each file migrates only once. -   + - **We recommend that you create a separate .xml file instead of adding your .xml code to one of the existing migration .xml files** @@ -136,7 +140,7 @@ As the authorized administrator, it is your responsibility to protect the privac **Note**   The question mark is not valid as a wildcard character in USMT .xml files. -   + ## Related topics @@ -145,9 +149,9 @@ As the authorized administrator, it is your responsibility to protect the privac [Plan Your Migration](usmt-plan-your-migration.md) -  + -  + diff --git a/windows/deployment/usmt/usmt-choose-migration-store-type.md b/windows/deployment/usmt/usmt-choose-migration-store-type.md index fd3170f994..75c4393563 100644 --- a/windows/deployment/usmt/usmt-choose-migration-store-type.md +++ b/windows/deployment/usmt/usmt-choose-migration-store-type.md @@ -1,62 +1,65 @@ ---- -title: Choose a Migration Store Type (Windows 10) -description: Choose a Migration Store Type -ms.assetid: 4e163e90-9c57-490b-b849-2ed52ab6765f -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Choose a Migration Store Type - - -One of the main considerations for planning your migration is to determine which migration store type best meets your needs. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) 10.0 components on your source and destination computers, and how much space is needed to create and host the migration store, whether you are using a local share, network share, or storage device. The final consideration is ensuring that user date integrity is maintained by encrypting the migration store. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - -

                                [Migration Store Types Overview](migration-store-types-overview.md)

                                Choose the migration store type that works best for your needs and migration scenario.

                                [Estimate Migration Store Size](usmt-estimate-migration-store-size.md)

                                Estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure.

                                [Hard-Link Migration Store](usmt-hard-link-migration-store.md)

                                Learn about hard-link migration stores and the scenarios in which they are used.

                                [Migration Store Encryption](usmt-migration-store-encryption.md)

                                Learn about the using migration store encryption to protect user data integrity during a migration.

                                - -  - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md) - -[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) - -  - -  - - - - - +--- +title: Choose a Migration Store Type (Windows 10) +description: Choose a Migration Store Type +ms.assetid: 4e163e90-9c57-490b-b849-2ed52ab6765f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Choose a Migration Store Type + + +One of the main considerations for planning your migration is to determine which migration store type best meets your needs. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) 10.0 components on your source and destination computers, and how much space is needed to create and host the migration store, whether you are using a local share, network share, or storage device. The final consideration is ensuring that user date integrity is maintained by encrypting the migration store. + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + +

                                Migration Store Types Overview

                                Choose the migration store type that works best for your needs and migration scenario.

                                Estimate Migration Store Size

                                Estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure.

                                Hard-Link Migration Store

                                Learn about hard-link migration stores and the scenarios in which they are used.

                                Migration Store Encryption

                                Learn about the using migration store encryption to protect user data integrity during a migration.

                                + + + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md) + +[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-command-line-syntax.md b/windows/deployment/usmt/usmt-command-line-syntax.md index 9d5968c09d..43d9d9c686 100644 --- a/windows/deployment/usmt/usmt-command-line-syntax.md +++ b/windows/deployment/usmt/usmt-command-line-syntax.md @@ -1,51 +1,54 @@ ---- -title: User State Migration Tool (USMT) Command-line Syntax (Windows 10) -description: User State Migration Tool (USMT) Command-line Syntax -ms.assetid: f9d205c9-e824-46c7-8d8b-d7e4b52fd514 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) Command-line Syntax - - -The User State Migration Tool (USMT) 10.0 migrates user files and settings during large deployments of Windows. To improve and simplify the migration process, USMT captures desktop, network, and application settings in addition to a user's files. USMT then migrates these items to a new Windows installation. - -## In This Section - - - ---- - - - - - - - - - - - - - - -

                                [ScanState Syntax](usmt-scanstate-syntax.md)

                                Lists the command-line options for using the ScanState tool.

                                [LoadState Syntax](usmt-loadstate-syntax.md)

                                Lists the command-line options for using the LoadState tool.

                                [UsmtUtils Syntax](usmt-utilities.md)

                                Lists the command-line options for using the UsmtUtils tool.

                                - -  - -  - -  - - - - - +--- +title: User State Migration Tool (USMT) Command-line Syntax (Windows 10) +description: User State Migration Tool (USMT) Command-line Syntax +ms.assetid: f9d205c9-e824-46c7-8d8b-d7e4b52fd514 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) Command-line Syntax + + +The User State Migration Tool (USMT) 10.0 migrates user files and settings during large deployments of Windows. To improve and simplify the migration process, USMT captures desktop, network, and application settings in addition to a user's files. USMT then migrates these items to a new Windows installation. + +## In This Section + + + ++++ + + + + + + + + + + + + + + +

                                ScanState Syntax

                                Lists the command-line options for using the ScanState tool.

                                LoadState Syntax

                                Lists the command-line options for using the LoadState tool.

                                UsmtUtils Syntax

                                Lists the command-line options for using the UsmtUtils tool.

                                + + + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-common-issues.md b/windows/deployment/usmt/usmt-common-issues.md index 753055a44c..49aa08dbfe 100644 --- a/windows/deployment/usmt/usmt-common-issues.md +++ b/windows/deployment/usmt/usmt-common-issues.md @@ -1,337 +1,340 @@ ---- -title: Common Issues (Windows 10) -description: Common Issues -ms.assetid: 5a37e390-8617-4768-9eee-50397fbbb2e1 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.date: 09/19/2017 -author: greg-lindsay -ms.topic: article ---- - -# Common Issues - - -The following sections discuss common issues that you might see when you run the User State Migration Tool (USMT) 10.0 tools. USMT produces log files that describe in further detail any errors that occurred during the migration process. These logs can be used to troubleshoot migration failures. - -## In This Topic - - -[User Account Problems](#user) - -[Command-line Problems](#command) - -[XML File Problems](#xml) - -[Migration Problems](#migration) - -[Offline Migration Problems](#bkmk-offline) - -[Hard Link Migration Problems](#bkmk-hardlink) - -[USMT does not migrate the Start layout](#usmt-does-not-migrate-the-start-layout) - -## General Guidelines for Identifying Migration Problems - - -When you encounter a problem or error message during migration, you can use the following general guidelines to help determine the source of the problem: - -- Examine the ScanState, LoadState, and UsmtUtils logs to obtain the exact USMT error messages and Windows® application programming interface (API) error messages. For more information about USMT return codes and error messages, see [Return Codes](usmt-return-codes.md). For more information about Windows API error messages, type **nethelpmsg** on the command line. - - In most cases, the ScanState and LoadState logs indicate why a USMT migration is failing. We recommend that you use the **/v***:5* option when testing your migration. This verbosity level can be adjusted in a production migration; however, reducing the verbosity level might make it more difficult to diagnose failures that are encountered during production migrations. You can use a verbosity level higher than 5 if you want the log files output to go to a debugger. - - **Note**   - Running the ScanState and LoadState tools with the **/v***:5* option creates a detailed log file. Although this option makes the log file large, the extra detail can help you determine where migration errors occurred. - -   - -- Use the **/Verify** option in the UsmtUtils tool to determine whether any files in a compressed migration store are corrupted. For more information, see [Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md). - -- Use the **/Extract** option in the UsmtUtils tool to extract files from a compressed migration store. For more information, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). - -- Create a progress log using the **/Progress** option to monitor your migration. - -- For the source and destination computers, obtain operating system information, and versions of applications such as Internet Explorer and any other relevant programs. Then verify the exact steps that are needed to reproduce the problem. This information might help you to understand what is wrong and to reproduce the issue in your testing environment. - -- Log off after you run the LoadState tool. Some settings—for example, fonts, desktop backgrounds, and screen-saver settings—will not take effect until the next time the end user logs on. - -- Close all applications before running ScanState or LoadState tools. If some applications are running during the ScanState or LoadState process, USMT might not migrate some data. For example, if Microsoft Outlook® is open, USMT might not migrate PST files. - - **Note**   - USMT will fail if it cannot migrate a file or setting unless you specify the **/c** option. When you specify the **/c** option, USMT ignores errors. However, it logs an error when it encounters a file that is in use that did not migrate. - -   - -## User Account Problems - - -The following sections describe common user account problems. Expand the section to see recommended solutions. - -### I'm having problems creating local accounts on the destination computer. - -**Resolution:** For more information about creating accounts and migrating local accounts, see [Migrate User Accounts](usmt-migrate-user-accounts.md). - -### Not all of the user accounts were migrated to the destination computer. - -**Causes/Resolutions** There are two possible causes for this problem: - -When running the ScanState tool on Windows Vista, or the ScanState and LoadState tools on Windows 7, Windows 8, or Windows 10, you must run them in Administrator mode from an account with administrative credentials to ensure that all specified users are migrated. To run in Administrator mode: - -1. Click **Start**. - -2. Click **All Programs**. - -3. Click **Accessories**. - -4. Right-click **Command Prompt**. - -5. Click **Run as administrator**. - -Then specify your LoadState or ScanState command. If you do not run USMT in Administrator mode, only the user profile that is logged on will be included in the migration. - -Any user accounts on the computer that have not been used will not be migrated. For example, if you add User1 to the computer, but User1 never logs on, then USMT will not migrate the User1 account. - -### User accounts that I excluded were migrated to the destination computer. - -**Cause:** The command that you specified might have had conflicting **/ui** and **/ue** options. If a user is specified with the **/ui** option and is also specified to be excluded with either the **/ue** or **/uel** options, the user will be included in the migration. For example, if you specify `/ui:domain1\* /ue:domain1\user1`, then User1 will be migrated because the **/ui** option takes precedence. - -**Resolution:** For more information about how to use the **/ui** and **/ue** options together, see the examples in the [ScanState Syntax](usmt-scanstate-syntax.md) topic. - -### I am using the /uel option, but many accounts are still being included in the migration. - -**Cause** The **/uel** option depends on the last modified date of the users' NTUser.dat file. There are scenarios in which this last modified date might not match the users' last logon date. - -**Resolution** This is a limitation of the **/uel** option. You might need to exclude these users manually with the **/ue** option. - -### The LoadState tool reports an error as return code 71 and fails to restore a user profile during a migration test. - -**Cause:** During a migration test, if you run the ScanState tool on your test computer and then delete user profiles in order to test the LoadState tool on the same computer, you may have a conflicting key present in the registry. Using the **net use** command to remove a user profile will delete folders and files associated with that profile, but will not remove the registry key. - -**Resolution:** To delete a user profile, use the **User Accounts** item in Control Panel. To correct an incomplete deletion of a user profile: - -1. Open the registry editor by typing `regedit` at an elevated command prompt. - -2. Navigate to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList`. - - Each user profile is stored in a System Identifier key under `ProfileList`. - -3. Delete the key for the user profile you are trying to remove. - -### Files that were not encrypted before the migration are now encrypted with the account used to run the LoadState tool. - -**Cause:** The ScanState tool was run using the **/EFS: copyraw** option to migrate encrypted files and Encrypting File System (EFS) certificates. The encryption attribute was set on a folder that was migrated, but the attribute was removed from file contents of that folder prior to migration. - -**Resolution:** Before using the ScanState tool for a migration that includes encrypted files and EFS certificates, you can run the Cipher tool at the command prompt to review and change encryption settings on files and folders. You must remove the encryption attribute from folders that contain unencrypted files or encrypt the contents of all files within an encrypted folder. - -To remove encryption from files that have already been migrated incorrectly, you must log on to the computer with the account that you used to run the LoadState tool and then remove the encryption from the affected files. - -### The LoadState tool reports an error as return code 71 and a Windows Error 2202 in the log file. - -**Cause:** The computer name was changed during an offline migration of a local user profile. - -**Resolution:** You can use the **/mu** option when you run the LoadState tool to specify a new name for the user. For example, - -``` syntax -loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore -/progress:prog.log /l:load.log /mu:fareast\user1:farwest\user1 -``` - -## Command-line Problems - - -The following sections describe common command-line problems. Expand the section to see recommended solutions. - -### I received the following error message: "Usage Error: You cannot specify a file path with any of the command-line options that exceeds 256 characters." - -**Cause:** You might receive this error message in some cases even if you do not specify a long store or file path, because the path length is calculated based on the absolute path. For example, if you run the **scanstate.exe /o store** command from C:\\Program Files\\USMT40, then each character in "`C:\Program Files\USMT40`" will be added to the length of "store" to get the length of the path. - -**Resolution:** Ensure that the total path length—the store path plus the current directory—does not exceed 256 characters. - -### I received the following error message: "USMT was unable to create the log file(s). Ensure that you have write access to the log directory." - -**Cause:** If you are running the ScanState or LoadState tools from a shared network resource, you will receive this error message if you do not specify **/l**. - -**Resolution:** To fix this issue in this scenario, specify the **/l:scan.log** or **/l:load.log** option. - -## XML File Problems - - -The following sections describe common XML file problems. Expand the section to see recommended solutions. - -### I used the /genconfig option to create a Config.xml file, but I see only a few applications and components that are in MigApp.xml. Why does Config.xml not contain all of the same applications? - -**Cause:** Config.xml will contain only operating system components, applications, and the user document sections that are in both of the .xml files and are installed on the computer when you run the **/genconfig** option. Otherwise, these applications and components will not appear in the Config.xml file. - -**Resolution:** Install all of the desired applications on the computer before running the **/genconfig** option. Then run ScanState with all of the .xml files. For example, run the following: - -`scanstate /genconfig:config.xml /i:migdocs.xml /i:migapp.xml /v:5 /l:scanstate.log` - -### I am having problems with a custom .xml file that I authored, and I cannot verify that the syntax is correct. - -**Resolution:** You can load the XML schema (MigXML.xsd), included with USMT, into your XML authoring tool. For examples, see the [Visual Studio Development Center](https://go.microsoft.com/fwlink/p/?LinkId=74513). Then, load your .xml file in the authoring tool to see if there is a syntax error. In addition, see [USMT XML Reference](usmt-xml-reference.md) for more information about using the XML elements. - -### I am using a MigXML helper function, but the migration isn’t working the way I expected it to.  How do I troubleshoot this issue? - -**Cause:** Typically, this issue is caused by incorrect syntax used in a helper function. You receive a Success return code, but the files you wanted to migrate did not get collected or applied, or weren’t collected or applied in the way you expected. - -**Resolution:** You should search the ScanState or LoadState log for either the component name which contains the MigXML helper function, or the MigXML helper function title, so that you can locate the related warning in the log file. - -## Migration Problems - - -The following sections describe common migration problems. Expand the section to see recommended solutions. - -### Files that I specified to exclude are still being migrated. - -**Cause:** There might be another rule that is including the files. If there is a more specific rule or a conflicting rule, the files will be included in the migration. - -**Resolution:** For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md) and the Diagnostic Log section in [Log Files](usmt-log-files.md). - -### I specified rules to move a folder to a specific location on the destination computer, but it has not migrated correctly. - -**Cause:** There might be an error in the XML syntax. - -**Resolution:** You can use the USMT XML schema (MigXML.xsd) to write and validate migration .xml files. Also see the XML examples in the following topics: - -[Conflicts and Precedence](usmt-conflicts-and-precedence.md) - -[Exclude Files and Settings](usmt-exclude-files-and-settings.md) - -[Reroute Files and Settings](usmt-reroute-files-and-settings.md) - -[Include Files and Settings](usmt-include-files-and-settings.md) - -[Custom XML Examples](usmt-custom-xml-examples.md) - -### After LoadState completes, the new desktop background does not appear on the destination computer. - -There are three typical causes for this issue. - -**Cause \#1:**: Some settings such as fonts, desktop backgrounds, and screen-saver settings are not applied by LoadState until after the destination computer has been restarted. - -**Resolution:** To fix this issue, log off, and then log back on to see the migrated desktop background. - -**Cause \#2:** If the source computer was running Windows® XP and the desktop background was stored in the *Drive*:\\WINDOWS\\Web\\Wallpaper folder—the default folder where desktop backgrounds are stored in Windows XP—the desktop background will not be migrated. Instead, the destination computer will have the default Windows® desktop background. This will occur even if the desktop background was a custom picture that was added to the \\WINDOWS\\Web\\Wallpaper folder. However, if the end user sets a picture as the desktop background that was saved in another location, for example, My Pictures, then the desktop background will migrate. - -**Resolution:** Ensure that the desktop background images that you want to migrate are not in the \\WINDOWS\\Web\\Wallpaper folder on the source computer. - -**Cause \#3:** If ScanState was not run on Windows XP from an account with administrative credentials, some operating system settings will not migrate. For example, desktop background settings, screen-saver selections, modem options, media-player settings, and Remote Access Service (RAS) connection phone book (.pbk) files and settings will not migrate. - -**Resolution:** Run the ScanState and LoadState tools from within an account with administrative credentials. - -### I included MigApp.xml in the migration, but some PST files aren’t migrating. - -**Cause:** The MigApp.xml file migrates only the PST files that are linked to Outlook profiles. - -**Resolution:** To migrate PST files that are not linked to Outlook profiles, you must create a separate migration rule to capture these files. - -### USMT does not migrate the Start layout - -**Description:** You are using USMT to migrate profiles from one installation of Windows 10 to another installation of Windows 10 on different hardware. After migration, the user signs in on the new device and does not have the Start menu layout they had previously configured. - -**Cause:** A code change in the Start Menu with Windows 10 version 1607 and later is incompatible with this USMT function. - -**Resolution:** The following workaround is available: - -1. With the user signed in, back up the Start layout using the following Windows PowerShell command. You can specify a different path if desired: - - ``` - Export-StartLayout -Path "C:\Layout\user1.xml" - ``` -2. Migrate the user's profile with USMT. -3. Before the user signs in on the new device, import the Start layout using the following Windows PowerShell command: - - ``` - Import-StartLayout –LayoutPath "C:\Layout\user1.xml" –MountPath %systemdrive% - ``` - -This workaround changes the Default user's Start layout. The workaround does not scale to a mass migrations or multiuser devices, but it can potentially unblock some scenarios. If other users will sign on to the device you should delete layoutmodification.xml from the Default user profile. Otherwise, all users who sign on to that device will use the imported Start layout. - -## Offline Migration Problems - - -The following sections describe common offline migration problems. Expand the section to see recommended solutions. - -### Some of my system settings do not migrate in an offline migration. - -**Cause:** Some system settings, such as desktop backgrounds and network printers, are not supported in an offline migration. For more information, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) - -**Resolution:** In an offline migration, these system settings must be restored manually. - -### The ScanState tool fails with return code 26. - -**Cause:** A common cause of return code 26 is that a temp profile is active on the source computer. This profile maps to c:\\users\\temp. The ScanState log shows a MigStartupOfflineCaught exception that includes the message "User profile duplicate SID error". - -**Resolution:** You can reboot the computer to get rid of the temp profile or you can set MIG\_FAIL\_ON\_PROFILE\_ERROR=0 to skip the error and exclude the temp profile. - -### Include and Exclude rules for migrating user profiles do not work the same offline as they do online. - -**Cause:** When offline, the DNS server cannot be queried to resolve the user name and SID mapping. - -**Resolution:** Use a Security Identifier (SID) to include a user when running the ScanState tool. For example: - -``` syntax -Scanstate /ui:S1-5-21-124525095-708259637-1543119021* -``` - -The wild card (\*) at the end of the SID will migrate the *SID*\_Classes key as well. - -You can also use patterns for SIDs that identify generic users or groups. For example, you can use the */ue:\*-500* option to exclude the local administrator accounts. For more information about Windows SIDs, see [this Microsoft Web site](https://go.microsoft.com/fwlink/p/?LinkId=190277). - -### My script to wipe the disk fails after running the ScanState tool on a 64-bit system. - -**Cause:** The HKLM registry hive is not unloaded after the ScanState tool has finished running. - -**Resolution:** Reboot the computer or unload the registry hive at the command prompt after the ScanState tool has finished running. For example, at a command prompt, type: - -``` syntax -reg.exe unload hklm\$dest$software -``` - -## Hard-Link Migration Problems - - -The following sections describe common hard-link migration problems. Expand the section to see recommended solutions. - -### EFS files are not restored to the new partition. - -**Cause:** EFS files cannot be moved to a new partition with a hard link. The **/efs:hardlink** command-line option is only applicable to files migrated on the same partition. - -**Resolution:** Use the **/efs:copyraw** command-line option to copy EFS files during the migration instead of creating hard links, or manually copy the EFS files from the hard-link store. - -### The ScanState tool cannot delete a previous hard-link migration store. - -**Cause:** The migration store contains hard links to locked files. - -**Resolution:** Use the UsmtUtils tool to delete the store or change the store name. For example, at a command prompt, type: - -``` syntax -USMTutils /rd -``` - -You should also reboot the machine. - - - - - -## Related topics - - -[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - -[Frequently Asked Questions](usmt-faq.md) - -[Return Codes](usmt-return-codes.md) - -[UsmtUtils Syntax](usmt-utilities.md) - -  - -  - - - - - +--- +title: Common Issues (Windows 10) +description: Common Issues +ms.assetid: 5a37e390-8617-4768-9eee-50397fbbb2e1 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.date: 09/19/2017 +audience: itpro author: greg-lindsay +ms.topic: article +--- + +# Common Issues + + +The following sections discuss common issues that you might see when you run the User State Migration Tool (USMT) 10.0 tools. USMT produces log files that describe in further detail any errors that occurred during the migration process. These logs can be used to troubleshoot migration failures. + +## In This Topic + + +[User Account Problems](#user) + +[Command-line Problems](#command) + +[XML File Problems](#xml) + +[Migration Problems](#migration) + +[Offline Migration Problems](#bkmk-offline) + +[Hard Link Migration Problems](#bkmk-hardlink) + +[USMT does not migrate the Start layout](#usmt-does-not-migrate-the-start-layout) + +## General Guidelines for Identifying Migration Problems + + +When you encounter a problem or error message during migration, you can use the following general guidelines to help determine the source of the problem: + +- Examine the ScanState, LoadState, and UsmtUtils logs to obtain the exact USMT error messages and Windows® application programming interface (API) error messages. For more information about USMT return codes and error messages, see [Return Codes](usmt-return-codes.md). For more information about Windows API error messages, type **nethelpmsg** on the command line. + + In most cases, the ScanState and LoadState logs indicate why a USMT migration is failing. We recommend that you use the **/v**:5 option when testing your migration. This verbosity level can be adjusted in a production migration; however, reducing the verbosity level might make it more difficult to diagnose failures that are encountered during production migrations. You can use a verbosity level higher than 5 if you want the log files output to go to a debugger. + + **Note** + Running the ScanState and LoadState tools with the **/v**:5 option creates a detailed log file. Although this option makes the log file large, the extra detail can help you determine where migration errors occurred. + + + +- Use the **/Verify** option in the UsmtUtils tool to determine whether any files in a compressed migration store are corrupted. For more information, see [Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md). + +- Use the **/Extract** option in the UsmtUtils tool to extract files from a compressed migration store. For more information, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). + +- Create a progress log using the **/Progress** option to monitor your migration. + +- For the source and destination computers, obtain operating system information, and versions of applications such as Internet Explorer and any other relevant programs. Then verify the exact steps that are needed to reproduce the problem. This information might help you to understand what is wrong and to reproduce the issue in your testing environment. + +- Log off after you run the LoadState tool. Some settings—for example, fonts, desktop backgrounds, and screen-saver settings—will not take effect until the next time the end user logs on. + +- Close all applications before running ScanState or LoadState tools. If some applications are running during the ScanState or LoadState process, USMT might not migrate some data. For example, if Microsoft Outlook® is open, USMT might not migrate PST files. + + **Note** + USMT will fail if it cannot migrate a file or setting unless you specify the **/c** option. When you specify the **/c** option, USMT ignores errors. However, it logs an error when it encounters a file that is in use that did not migrate. + + + +## User Account Problems + + +The following sections describe common user account problems. Expand the section to see recommended solutions. + +### I'm having problems creating local accounts on the destination computer. + +**Resolution:** For more information about creating accounts and migrating local accounts, see [Migrate User Accounts](usmt-migrate-user-accounts.md). + +### Not all of the user accounts were migrated to the destination computer. + +**Causes/Resolutions** There are two possible causes for this problem: + +When running the ScanState tool on Windows Vista, or the ScanState and LoadState tools on Windows 7, Windows 8, or Windows 10, you must run them in Administrator mode from an account with administrative credentials to ensure that all specified users are migrated. To run in Administrator mode: + +1. Click **Start**. + +2. Click **All Programs**. + +3. Click **Accessories**. + +4. Right-click **Command Prompt**. + +5. Click **Run as administrator**. + +Then specify your LoadState or ScanState command. If you do not run USMT in Administrator mode, only the user profile that is logged on will be included in the migration. + +Any user accounts on the computer that have not been used will not be migrated. For example, if you add User1 to the computer, but User1 never logs on, then USMT will not migrate the User1 account. + +### User accounts that I excluded were migrated to the destination computer. + +**Cause:** The command that you specified might have had conflicting **/ui** and **/ue** options. If a user is specified with the **/ui** option and is also specified to be excluded with either the **/ue** or **/uel** options, the user will be included in the migration. For example, if you specify `/ui:domain1\* /ue:domain1\user1`, then User1 will be migrated because the **/ui** option takes precedence. + +**Resolution:** For more information about how to use the **/ui** and **/ue** options together, see the examples in the [ScanState Syntax](usmt-scanstate-syntax.md) topic. + +### I am using the /uel option, but many accounts are still being included in the migration. + +**Cause** The **/uel** option depends on the last modified date of the users' NTUser.dat file. There are scenarios in which this last modified date might not match the users' last logon date. + +**Resolution** This is a limitation of the **/uel** option. You might need to exclude these users manually with the **/ue** option. + +### The LoadState tool reports an error as return code 71 and fails to restore a user profile during a migration test. + +**Cause:** During a migration test, if you run the ScanState tool on your test computer and then delete user profiles in order to test the LoadState tool on the same computer, you may have a conflicting key present in the registry. Using the **net use** command to remove a user profile will delete folders and files associated with that profile, but will not remove the registry key. + +**Resolution:** To delete a user profile, use the **User Accounts** item in Control Panel. To correct an incomplete deletion of a user profile: + +1. Open the registry editor by typing `regedit` at an elevated command prompt. + +2. Navigate to `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList`. + + Each user profile is stored in a System Identifier key under `ProfileList`. + +3. Delete the key for the user profile you are trying to remove. + +### Files that were not encrypted before the migration are now encrypted with the account used to run the LoadState tool. + +**Cause:** The ScanState tool was run using the **/EFS: copyraw** option to migrate encrypted files and Encrypting File System (EFS) certificates. The encryption attribute was set on a folder that was migrated, but the attribute was removed from file contents of that folder prior to migration. + +**Resolution:** Before using the ScanState tool for a migration that includes encrypted files and EFS certificates, you can run the Cipher tool at the command prompt to review and change encryption settings on files and folders. You must remove the encryption attribute from folders that contain unencrypted files or encrypt the contents of all files within an encrypted folder. + +To remove encryption from files that have already been migrated incorrectly, you must log on to the computer with the account that you used to run the LoadState tool and then remove the encryption from the affected files. + +### The LoadState tool reports an error as return code 71 and a Windows Error 2202 in the log file. + +**Cause:** The computer name was changed during an offline migration of a local user profile. + +**Resolution:** You can use the **/mu** option when you run the LoadState tool to specify a new name for the user. For example, + +``` syntax +loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore +/progress:prog.log /l:load.log /mu:fareast\user1:farwest\user1 +``` + +## Command-line Problems + + +The following sections describe common command-line problems. Expand the section to see recommended solutions. + +### I received the following error message: "Usage Error: You cannot specify a file path with any of the command-line options that exceeds 256 characters." + +**Cause:** You might receive this error message in some cases even if you do not specify a long store or file path, because the path length is calculated based on the absolute path. For example, if you run the **scanstate.exe /o store** command from C:\\Program Files\\USMT40, then each character in "`C:\Program Files\USMT40`" will be added to the length of "store" to get the length of the path. + +**Resolution:** Ensure that the total path length—the store path plus the current directory—does not exceed 256 characters. + +### I received the following error message: "USMT was unable to create the log file(s). Ensure that you have write access to the log directory." + +**Cause:** If you are running the ScanState or LoadState tools from a shared network resource, you will receive this error message if you do not specify **/l**. + +**Resolution:** To fix this issue in this scenario, specify the **/l:scan.log** or **/l:load.log** option. + +## XML File Problems + + +The following sections describe common XML file problems. Expand the section to see recommended solutions. + +### I used the /genconfig option to create a Config.xml file, but I see only a few applications and components that are in MigApp.xml. Why does Config.xml not contain all of the same applications? + +**Cause:** Config.xml will contain only operating system components, applications, and the user document sections that are in both of the .xml files and are installed on the computer when you run the **/genconfig** option. Otherwise, these applications and components will not appear in the Config.xml file. + +**Resolution:** Install all of the desired applications on the computer before running the **/genconfig** option. Then run ScanState with all of the .xml files. For example, run the following: + +`scanstate /genconfig:config.xml /i:migdocs.xml /i:migapp.xml /v:5 /l:scanstate.log` + +### I am having problems with a custom .xml file that I authored, and I cannot verify that the syntax is correct. + +**Resolution:** You can load the XML schema (MigXML.xsd), included with USMT, into your XML authoring tool. For examples, see the [Visual Studio Development Center](https://go.microsoft.com/fwlink/p/?LinkId=74513). Then, load your .xml file in the authoring tool to see if there is a syntax error. In addition, see [USMT XML Reference](usmt-xml-reference.md) for more information about using the XML elements. + +### I am using a MigXML helper function, but the migration isn’t working the way I expected it to.  How do I troubleshoot this issue? + +**Cause:** Typically, this issue is caused by incorrect syntax used in a helper function. You receive a Success return code, but the files you wanted to migrate did not get collected or applied, or weren’t collected or applied in the way you expected. + +**Resolution:** You should search the ScanState or LoadState log for either the component name which contains the MigXML helper function, or the MigXML helper function title, so that you can locate the related warning in the log file. + +## Migration Problems + + +The following sections describe common migration problems. Expand the section to see recommended solutions. + +### Files that I specified to exclude are still being migrated. + +**Cause:** There might be another rule that is including the files. If there is a more specific rule or a conflicting rule, the files will be included in the migration. + +**Resolution:** For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md) and the Diagnostic Log section in [Log Files](usmt-log-files.md). + +### I specified rules to move a folder to a specific location on the destination computer, but it has not migrated correctly. + +**Cause:** There might be an error in the XML syntax. + +**Resolution:** You can use the USMT XML schema (MigXML.xsd) to write and validate migration .xml files. Also see the XML examples in the following topics: + +[Conflicts and Precedence](usmt-conflicts-and-precedence.md) + +[Exclude Files and Settings](usmt-exclude-files-and-settings.md) + +[Reroute Files and Settings](usmt-reroute-files-and-settings.md) + +[Include Files and Settings](usmt-include-files-and-settings.md) + +[Custom XML Examples](usmt-custom-xml-examples.md) + +### After LoadState completes, the new desktop background does not appear on the destination computer. + +There are three typical causes for this issue. + +**Cause \#1:**: Some settings such as fonts, desktop backgrounds, and screen-saver settings are not applied by LoadState until after the destination computer has been restarted. + +**Resolution:** To fix this issue, log off, and then log back on to see the migrated desktop background. + +**Cause \#2:** If the source computer was running Windows® XP and the desktop background was stored in the *Drive*:\\WINDOWS\\Web\\Wallpaper folder—the default folder where desktop backgrounds are stored in Windows XP—the desktop background will not be migrated. Instead, the destination computer will have the default Windows® desktop background. This will occur even if the desktop background was a custom picture that was added to the \\WINDOWS\\Web\\Wallpaper folder. However, if the end user sets a picture as the desktop background that was saved in another location, for example, My Pictures, then the desktop background will migrate. + +**Resolution:** Ensure that the desktop background images that you want to migrate are not in the \\WINDOWS\\Web\\Wallpaper folder on the source computer. + +**Cause \#3:** If ScanState was not run on Windows XP from an account with administrative credentials, some operating system settings will not migrate. For example, desktop background settings, screen-saver selections, modem options, media-player settings, and Remote Access Service (RAS) connection phone book (.pbk) files and settings will not migrate. + +**Resolution:** Run the ScanState and LoadState tools from within an account with administrative credentials. + +### I included MigApp.xml in the migration, but some PST files aren’t migrating. + +**Cause:** The MigApp.xml file migrates only the PST files that are linked to Outlook profiles. + +**Resolution:** To migrate PST files that are not linked to Outlook profiles, you must create a separate migration rule to capture these files. + +### USMT does not migrate the Start layout + +**Description:** You are using USMT to migrate profiles from one installation of Windows 10 to another installation of Windows 10 on different hardware. After migration, the user signs in on the new device and does not have the Start menu layout they had previously configured. + +**Cause:** A code change in the Start Menu with Windows 10 version 1607 and later is incompatible with this USMT function. + +**Resolution:** The following workaround is available: + +1. With the user signed in, back up the Start layout using the following Windows PowerShell command. You can specify a different path if desired: + + ``` + Export-StartLayout -Path "C:\Layout\user1.xml" + ``` +2. Migrate the user's profile with USMT. +3. Before the user signs in on the new device, import the Start layout using the following Windows PowerShell command: + + ``` + Import-StartLayout –LayoutPath "C:\Layout\user1.xml" –MountPath %systemdrive% + ``` + +This workaround changes the Default user's Start layout. The workaround does not scale to a mass migrations or multiuser devices, but it can potentially unblock some scenarios. If other users will sign on to the device you should delete layoutmodification.xml from the Default user profile. Otherwise, all users who sign on to that device will use the imported Start layout. + +## Offline Migration Problems + + +The following sections describe common offline migration problems. Expand the section to see recommended solutions. + +### Some of my system settings do not migrate in an offline migration. + +**Cause:** Some system settings, such as desktop backgrounds and network printers, are not supported in an offline migration. For more information, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) + +**Resolution:** In an offline migration, these system settings must be restored manually. + +### The ScanState tool fails with return code 26. + +**Cause:** A common cause of return code 26 is that a temp profile is active on the source computer. This profile maps to c:\\users\\temp. The ScanState log shows a MigStartupOfflineCaught exception that includes the message "User profile duplicate SID error". + +**Resolution:** You can reboot the computer to get rid of the temp profile or you can set MIG\_FAIL\_ON\_PROFILE\_ERROR=0 to skip the error and exclude the temp profile. + +### Include and Exclude rules for migrating user profiles do not work the same offline as they do online. + +**Cause:** When offline, the DNS server cannot be queried to resolve the user name and SID mapping. + +**Resolution:** Use a Security Identifier (SID) to include a user when running the ScanState tool. For example: + +``` syntax +Scanstate /ui:S1-5-21-124525095-708259637-1543119021* +``` + +The wild card (\*) at the end of the SID will migrate the *SID*\_Classes key as well. + +You can also use patterns for SIDs that identify generic users or groups. For example, you can use the */ue:\*-500* option to exclude the local administrator accounts. For more information about Windows SIDs, see [this Microsoft Web site](https://go.microsoft.com/fwlink/p/?LinkId=190277). + +### My script to wipe the disk fails after running the ScanState tool on a 64-bit system. + +**Cause:** The HKLM registry hive is not unloaded after the ScanState tool has finished running. + +**Resolution:** Reboot the computer or unload the registry hive at the command prompt after the ScanState tool has finished running. For example, at a command prompt, type: + +``` syntax +reg.exe unload hklm\$dest$software +``` + +## Hard-Link Migration Problems + + +The following sections describe common hard-link migration problems. Expand the section to see recommended solutions. + +### EFS files are not restored to the new partition. + +**Cause:** EFS files cannot be moved to a new partition with a hard link. The **/efs:hardlink** command-line option is only applicable to files migrated on the same partition. + +**Resolution:** Use the **/efs:copyraw** command-line option to copy EFS files during the migration instead of creating hard links, or manually copy the EFS files from the hard-link store. + +### The ScanState tool cannot delete a previous hard-link migration store. + +**Cause:** The migration store contains hard links to locked files. + +**Resolution:** Use the UsmtUtils tool to delete the store or change the store name. For example, at a command prompt, type: + +``` syntax +USMTutils /rd +``` + +You should also reboot the machine. + + + + + +## Related topics + + +[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) + +[Frequently Asked Questions](usmt-faq.md) + +[Return Codes](usmt-return-codes.md) + +[UsmtUtils Syntax](usmt-utilities.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-common-migration-scenarios.md b/windows/deployment/usmt/usmt-common-migration-scenarios.md index 9610ddc0ca..b23758ae60 100644 --- a/windows/deployment/usmt/usmt-common-migration-scenarios.md +++ b/windows/deployment/usmt/usmt-common-migration-scenarios.md @@ -2,9 +2,13 @@ title: Common Migration Scenarios (Windows 10) description: Common Migration Scenarios ms.assetid: 1d8170d5-e775-4963-b7a5-b55e8987c1e4 +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -126,11 +130,11 @@ A company receives 50 new laptops for their managers and needs to reallocate 50 A company is allocating 20 new computers to users in the accounting department. The users each have a source computer that contains their files and settings. An administrator uses a management technology such as a logon script or a batch file to run ScanState on each source computer to collect the user states and save them to a server in a compressed migration store. -1. On each source computer, the administrator runs the ScanState tool using Microsoft System Center Configuration Manager (SCCM), Microsoft Deployment Toolkit (MDT), a logon script, a batch file, or a non-Microsoft management technology. ScanState collects the user state from each source computer and then saves it to a server. +1. On each source computer, the administrator runs the ScanState tool using Microsoft Endpoint Configuration Manager, Microsoft Deployment Toolkit (MDT), a logon script, a batch file, or a non-Microsoft management technology. ScanState collects the user state from each source computer and then saves it to a server. 2. On each new computer, the administrator installs the company's SOE, which includes Windows 10 and other company applications. -3. On each of the new computers, the administrator runs the LoadState tool using System Center Configuration Manager, a logon script, a batch file, or a non-Microsoft management technology. LoadState migrates each user state from the migration store to one of the new computers. +3. On each of the new computers, the administrator runs the LoadState tool using Microsoft Endpoint Configuration Manager, a logon script, a batch file, or a non-Microsoft management technology. LoadState migrates each user state from the migration store to one of the new computers. ## Related topics diff --git a/windows/deployment/usmt/usmt-configxml-file.md b/windows/deployment/usmt/usmt-configxml-file.md index 7a81795919..db0aad8633 100644 --- a/windows/deployment/usmt/usmt-configxml-file.md +++ b/windows/deployment/usmt/usmt-configxml-file.md @@ -2,9 +2,13 @@ title: Config.xml File (Windows 10) description: Config.xml File ms.assetid: 9dc98e76-5155-4641-bcb3-81915db538e8 +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -27,7 +31,7 @@ For more information about using the Config.xml file with other migration files, **Note**   To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. -  + ## In This Topic @@ -92,7 +96,7 @@ The following example specifies that all locked files, regardless of their locat Additionally, the order in the **<ErrorControl>** section implies priority. In this example, the first **<nonFatal>** tag takes precedence over the second **<fatal>** tag. This precedence is applied, regardless of how many tags are listed. -``` syntax +``` xml * [*] @@ -107,7 +111,7 @@ Additionally, the order in the **<ErrorControl>** section implies priority **Important**   The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character. -  + ### <fatal> @@ -143,7 +147,7 @@ Syntax: ``*<pattern>*`` -  + You use the **<fatal>** element to specify that errors matching a specific pattern should cause USMT to halt the migration. @@ -197,14 +201,14 @@ Syntax: ``*<pattern>*`` -  + You use the **<nonFatal>** element to specify that errors matching a specific pattern should not cause USMT to halt the migration. ## <registryError> -The **<registryError>**element is not required. +The <registryError>element is not required. - **Number of occurrences**: Once for each component @@ -236,7 +240,7 @@ Syntax: `` -  + You use the **<registryError>** element to specify that errors matching a specific pattern should not cause USMT to halt the migration. @@ -260,9 +264,9 @@ The **<HardLinkStoreControl>** sample code below specifies that hard links **Important**   The **<ErrorControl>** section can be configured to conditionally ignore file access errors, based on the file’s location. -  + -``` syntax +``` xml @@ -355,7 +359,7 @@ This element describes the source and destination groups for a local group membe -  + The valid and required children of **<changeGroup>** are **<include>** and **<exclude>**. Although both can be children at the same time, only one is required. @@ -380,7 +384,7 @@ Syntax: ``` ` Refer to the following sample Config.xml file for additional details about items you can choose to exclude from a migration. -``` syntax +```xml @@ -576,9 +580,9 @@ Refer to the following sample Config.xml file for additional details about items [USMT XML Reference](usmt-xml-reference.md) -  + -  + diff --git a/windows/deployment/usmt/usmt-conflicts-and-precedence.md b/windows/deployment/usmt/usmt-conflicts-and-precedence.md index 835c365684..5b40bd3e9d 100644 --- a/windows/deployment/usmt/usmt-conflicts-and-precedence.md +++ b/windows/deployment/usmt/usmt-conflicts-and-precedence.md @@ -2,9 +2,13 @@ title: Conflicts and Precedence (Windows 10) description: Conflicts and Precedence ms.assetid: 0e2691a8-ff1e-4424-879b-4d5a2f8a113a +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -65,7 +69,7 @@ If you have an <include> rule in one component and a <locationModify> The following .xml file migrates all files from C:\\Userdocs, including .mp3 files, because the <exclude> rule is specified in a separate component. -``` syntax +``` xml User Documents @@ -99,7 +103,7 @@ The following .xml file migrates all files from C:\\Userdocs, including .mp3 fil Specifying `migrate="no"` in the Config.xml file is the same as deleting the corresponding component from the migration .xml file. However, if you set `migrate="no"` for My Documents, but you have a rule similar to the one shown below in a migration .xml file (which includes all of the .doc files from My Documents), then only the .doc files will be migrated, and all other files will be excluded. -``` syntax +``` xml %CSIDL_PERSONAL%\* [*.doc] @@ -132,7 +136,7 @@ If there are conflicting rules within a component, the most specific rule is app In the following example, mp3 files will not be excluded from the migration. This is because directory names take precedence over the file extensions. -``` syntax +``` xml C:\Data\* [*] @@ -171,40 +175,40 @@ These examples explain how USMT deals with <include> and <exclude> r
                                  -

                                • Include rule: <pattern type="File">C:\Dir1\* [*]</pattern>

                                  • -

                                • Exclude rule: <pattern type="File">C:\* [*.txt]</pattern>

                                  • +

                                • Include rule: <pattern type="File">C:\Dir1* []</pattern>

                                  • +

                                • Exclude rule: <pattern type="File">C:* [.txt]</pattern>

                                Migrates all files and subfolders in Dir1 (including all .txt files in C:).

                                The <exclude> rule does not affect the migration because the <include> rule is more specific.

                                  -

                                • Include rule: <pattern type="File">C:\Dir1\* [*]</pattern>

                                  • -

                                • Exclude rule: <pattern type="File">C:\Dir1\Dir2\* [*.txt]</pattern>

                                  • +

                                • Include rule: <pattern type="File">C:\Dir1* []</pattern>

                                  • +

                                • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                                Migrates all files and subfolders in C:\Dir1, except the .txt files in C:\Dir1\Dir2 and its subfolders.

                                Both rules are processed as intended.

                                  -

                                • Include rule: <pattern type="File">C:\Dir1\* [*]</pattern>

                                  • -

                                • Exclude rule: <pattern type="File">C:\Dir1\ * [*.txt]</pattern>

                                  • +

                                • Include rule: <pattern type="File">C:\Dir1* []</pattern>

                                  • +

                                • Exclude rule: <pattern type="File">C:\Dir1\ * [.txt]</pattern>

                                Migrates all files and subfolders in C:\Dir1, except the .txt files in C:\Dir1 and its subfolders.

                                Both rules are processed as intended.

                                  -

                                • Include rule: <pattern type="File">C:\Dir1\Dir2\* [*.txt]</pattern>

                                  • -

                                • Exclude rule: <pattern type="File">C:\Dir1\Dir2\* [*.txt]</pattern>

                                  • +

                                • Include rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                                  • +

                                • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                                Nothing will be migrated.

                                The rules are equally specific, so the <exclude> rule takes precedence over the <include> rule.

                                  -

                                • Include rule: C:\Dir1\* [*.txt]

                                  • -

                                • Exclude rule: C:\Dir1\Dir2\* [*]

                                  • +

                                • Include rule: C:\Dir1* [.txt]

                                  • +

                                • Exclude rule: C:\Dir1\Dir2* []

                                Migrates the .txt files in Dir1 and the .txt files from subfolders other than Dir2.

                                No files are migrated from Dir2 or its subfolders.

                                @@ -212,8 +216,8 @@ These examples explain how USMT deals with <include> and <exclude> r
                                  -

                                • Include rule: C:\Dir1\Dir2\* [*]

                                  • -

                                • Exclude rule: C:\Dir1\* [*.txt]

                                  • +

                                • Include rule: C:\Dir1\Dir2* []

                                  • +

                                • Exclude rule: C:\Dir1* [.txt]

                                Migrates all files and subfolders of Dir2, except the .txt files from Dir1 and any subfolders of Dir1 (including Dir2).

                                Both rules are processed as intended.

                                @@ -221,7 +225,7 @@ These examples explain how USMT deals with <include> and <exclude> r -  + @@ -240,13 +244,13 @@ These examples explain how USMT deals with <include> and <exclude> r @@ -254,11 +258,11 @@ These examples explain how USMT deals with <include> and <exclude> r @@ -266,11 +270,11 @@ These examples explain how USMT deals with <include> and <exclude> r @@ -278,7 +282,7 @@ These examples explain how USMT deals with <include> and <exclude> r

                                Component 1:

                                  -

                                • Include rule: <pattern type="File">C:\Dir1\* [*]</pattern>

                                  • -

                                • Exclude rule: <pattern type="File">C:\Dir1\Dir2\* [*.txt]</pattern>

                                  • +

                                • Include rule: <pattern type="File">C:\Dir1* []</pattern>

                                  • +

                                • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                                Component 2:

                                  -

                                • Include rule: <pattern type="File">C:\Dir1\Dir2\* [*.txt]</pattern>

                                  • -

                                • Exclude rule: <pattern type="File">C:\Dir1\* [*]</pattern>

                                  • +

                                • Include rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

                                  • +

                                • Exclude rule: <pattern type="File">C:\Dir1* []</pattern>

                                Migrates all files and subfolders of C:\Dir1\ (including C:\Dir1\Dir2).

                                Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, although some .txt files were excluded when Component 1 was processed, they were included when Component 2 was processed.

                                Component 1:

                                  -

                                • Include rule: C:\Dir1\Dir2\* [*]

                                  • +

                                • Include rule: C:\Dir1\Dir2* []

                                Component 2:

                                  -

                                • Exclude rule: C:\Dir1\* [*.txt]

                                  • +

                                • Exclude rule: C:\Dir1* [.txt]

                                Migrates all files and subfolders from Dir2 except the .txt files in C:\Dir1 and its subfolders.

                                Both rules are processed as intended.

                                Component 1:

                                  -

                                • Exclude rule: C:\Dir1\Dir2\* [*]

                                  • +

                                • Exclude rule: C:\Dir1\Dir2* []

                                Component 2:

                                  -

                                • Include rule: C:\Dir1\* [*.txt]

                                  • +

                                • Include rule: C:\Dir1* [.txt]

                                Migrates all .txt files in Dir1 and any subfolders.

                                Component 1 does not contain an <include> rule, so the <exclude> rule is not processed.
                                -  + ### Including and excluding registry objects @@ -298,7 +302,7 @@ These examples explain how USMT deals with <include> and <exclude> r
                                  -

                                • Include rule: HKLM\Software\Microsoft\Command Processor\* [*]

                                  • +

                                • Include rule: HKLM\Software\Microsoft\Command Processor* []

                                • Exclude Rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                                Migrates all keys in HKLM\Software\Microsoft\Command Processor except DefaultColor.

                                @@ -307,7 +311,7 @@ These examples explain how USMT deals with <include> and <exclude> r

                                • Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                                  • -

                                • Exclude Rule: HKLM\Software\Microsoft\Command Processor\* [*]

                                  • +

                                • Exclude Rule: HKLM\Software\Microsoft\Command Processor* []

                                Migrates only DefaultColor in HKLM\Software\Microsoft\Command Processor.

                                DefaultColor is migrated because the <include> rule is more specific than the <exclude> rule.

                                @@ -323,7 +327,7 @@ These examples explain how USMT deals with <include> and <exclude> r -  + @@ -343,11 +347,11 @@ These examples explain how USMT deals with <include> and <exclude> r @@ -356,7 +360,7 @@ These examples explain how USMT deals with <include> and <exclude> r

                                Component 1:

                                • Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                                  • -

                                • Exclude rule: HKLM\Software\Microsoft\Command Processor\* [*]

                                  • +

                                • Exclude rule: HKLM\Software\Microsoft\Command Processor* []

                                Component 2:

                                  -

                                • Include rule: HKLM\Software\Microsoft\Command Processor\* [*]

                                  • +

                                • Include rule: HKLM\Software\Microsoft\Command Processor* []

                                • Exclude rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

                                Migrates all the keys/values under HKLM\Software\Microsoft\Command Processor.
                                -  + ## File collisions @@ -387,7 +391,7 @@ The destination computer contains the following files: You have a custom .xml file that contains the following code: -``` syntax +``` xml c:\data\* [*] @@ -412,7 +416,7 @@ For this example, the following table describes the resulting behavior if you ad 
                                <merge script="MigXmlHelper.DestinationPriority()"> 
    <objectSet> 
-      <pattern type="File">c:\data\* [*]</pattern> 
+      <pattern type="File">c:\data* []</pattern> 
    </objectSet> 
 </merge>

                                During ScanState, all the files will be added to the store.

                                @@ -421,7 +425,7 @@ For this example, the following table describes the resulting behavior if you ad 
                                <merge script="MigXmlHelper.SourcePriority()"> 
    <objectSet> 
-      <pattern type="File">c:\data\* [*]</pattern> 
+      <pattern type="File">c:\data* []</pattern> 
    </objectSet> 
 </merge>

                                During ScanState, all the files will be added to the store.

                                @@ -444,16 +448,16 @@ For this example, the following table describes the resulting behavior if you ad -  + ## Related topics [USMT XML Reference](usmt-xml-reference.md) -  + -  + diff --git a/windows/deployment/usmt/usmt-custom-xml-examples.md b/windows/deployment/usmt/usmt-custom-xml-examples.md index 7aa6d0c5d4..66f4f18511 100644 --- a/windows/deployment/usmt/usmt-custom-xml-examples.md +++ b/windows/deployment/usmt/usmt-custom-xml-examples.md @@ -2,11 +2,14 @@ title: Custom XML Examples (Windows 10) description: Custom XML Examples ms.assetid: 48f441d9-6c66-43ef-91e9-7c78cde6fcc0 +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay -ms.date: 04/19/2017 ms.topic: article --- @@ -16,7 +19,7 @@ ms.topic: article **Note**   Because the tables in this topic are wide, you may need to adjust the width of its window. -  + ## In This Topic: @@ -34,7 +37,7 @@ Because the tables in this topic are wide, you may need to adjust the width of i The following is a template for the sections that you need to migrate your application. The template is not functional on its own, but you can use it to write your own .xml file. -``` syntax +``` xml @@ -124,15 +127,15 @@ The following is a custom .xml file named CustomFile.xml that migrates My Videos

                                Filters out the shortcuts in My Videos that do not resolve on the destination computer. This has no effect on files that are not shortcuts. For example, if there is a shortcut in My Videos on the source computer that points to C:\Folder1, that shortcut will be migrated only if C:\Folder1 exists on the destination computer. However, all other files, such as .mp3 files, migrate without any filtering.

                                -
                                <pattern type="File">%CSIDL_MYVIDEO%\* [*]</pattern>
                                +
                                <pattern type="File">%CSIDL_MYVIDEO%* [*]</pattern>

                                Migrates My Videos for all users.

                                -  + -``` syntax +```xml @@ -173,27 +176,27 @@ This table describes the behavior in the following example .xml file. -
                                <pattern type="File">%ProgramFiles%\USMTTestFolder\* [USMTTestFile.txt]</pattern>
                                +
                                <pattern type="File">%ProgramFiles%\USMTTestFolder* [USMTTestFile.txt]</pattern>

                                Migrates all instances of the file Usmttestfile.txt from all sub-directories under %ProgramFiles%\USMTTestFolder.

                                -
                                <pattern type="File">%ProgramFiles%\USMTDIRTestFolder\* [*]</pattern>
                                +
                                <pattern type="File">%ProgramFiles%\USMTDIRTestFolder* []</pattern>

                                Migrates the whole directory under %ProgramFiles%\USMTDIRTestFolder.

                                -
                                <pattern type="Registry">HKCU\Software\USMTTESTKEY\* [MyKey]</pattern>
                                +
                                <pattern type="Registry">HKCU\Software\USMTTESTKEY* [MyKey]</pattern>

                                Migrates all instances of MyKey under HKCU\Software\USMTTESTKEY.

                                -
                                <pattern type="Registry">HKLM\Software\USMTTESTKEY\* [*]</pattern>
                                +
                                <pattern type="Registry">HKLM\Software\USMTTESTKEY* []</pattern>

                                Migrates the entire registry hive under HKLM\Software\USMTTESTKEY.

                                -  + -``` syntax +``` xml File Migration Test @@ -229,7 +232,7 @@ This table describes the behavior in the following example .xml file. The behavior for this custom .xml file is described within the <`displayName`> tags in the code. -``` syntax +``` xml @@ -305,9 +308,9 @@ The behavior for this custom .xml file is described within the <`displayName` [Customize USMT XML Files](usmt-customize-xml-files.md) -  + -  + diff --git a/windows/deployment/usmt/usmt-customize-xml-files.md b/windows/deployment/usmt/usmt-customize-xml-files.md index a07abab50d..9376707ccd 100644 --- a/windows/deployment/usmt/usmt-customize-xml-files.md +++ b/windows/deployment/usmt/usmt-customize-xml-files.md @@ -1,135 +1,138 @@ ---- -title: Customize USMT XML Files (Windows 10) -description: Customize USMT XML Files -ms.assetid: d58363c1-fd13-4f65-8b91-9986659dc93e -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Customize USMT XML Files - - -## In This Topic - - -[Overview](#bkmk-overview) - -[Migration .xml Files](#bkmk-migxml) - -[Custom .xml Files](#bkmk-customxmlfiles) - -[The Config.xml File](#bkmk-configxml) - -[Examples](#bkmk-examples) - -[Additional Information](#bkmk-addlinfo) - -## Overview - - -If you want the **ScanState** and **LoadState** tools to use any of the migration .xml files, specify these files at the command line using the **/i** option. Because the **ScanState** and **LoadState** tools need the .xml files to control the migration, specify the same set of .xml files for both the **ScanState** and **LoadState** commands. However, you do not have to specify the Config.xml file with the **/config** option, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store but not to the destination computer. To do this, modify the Config.xml file and specify the updated file with the **LoadState** command. Then the **LoadState** command will migrate only the files and settings that you want to migrate. - -If you leave out an .xml file from the **LoadState** command, all of the data in the store that was migrated with the missing .xml files will be migrated. However, the migration rules that were specified with the **ScanState** command will not apply. For example, if you leave out an .xml file, and it contains a rerouting rule such as: `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files, and they will be migrated to C:\\data. - -To modify the migration, do one or more of the following. - -- **Modify the migration .xml files.** If you want to exclude a portion of a component—for example, you want to migrate C:\\ but exclude all of the .mp3 files—or if you want to move data to a new location on the destination computer, modify the .xml files. To modify these files, you must be familiar with the migration rules and syntax. If you want **ScanState** and **LoadState** to use these files, specify them at the command line when each command is entered. - -- **Create a custom .xml file.** You can also create a custom .xml file to migrate settings for another application, or to change the migration behavior to suit your needs. For **ScanState** and **LoadState** to use this file, specify them on both command lines. - -- **Create and modify a Config.xml file.** Do this if you want to exclude an entire component from the migration. For example, you can use a Config.xml file to exclude the entire My Documents folder, or exclude the settings for an application. Excluding components using a Config.xml file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. In addition, using a Config.xml file is the only way to exclude the operating system settings from being migrated. - -For more information about excluding data, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. - -## Migration .xml Files - - -This section describes the migration .xml files that are included with USMT. Each file contains migration rules that control which components are migrated and where they are migrated to on the destination computer. - -**Note**   -You can use the asterisk (\*) wildcard character in each of these files. However, you cannot use a question mark (?) as a wildcard character. - -  - -- **The MigApp.xml file.** Specify this file with both the **ScanState** and **LoadState** commands to migrate application settings. - -- **The MigDocs.xml file.** Specify this file with both the **ScanState** and **LoadState** tools to migrate all user folders and files that are found by the **MigXmlHelper.GenerateDocPatterns** helper function. This helper function finds user data that resides on the root of any drive and in the Users directory. However, it does not find and migrate any application data, program files, or any files in the Windows directory. You can modify the MigDocs.xml file. - -- **The MigUser.xml file.** Specify this file with both the **ScanState** and **LoadState** commands to migrate user folders, files, and file types. You can modify the MigUser.xml file. This file does not contain rules that migrate specific user accounts. The only way to specify which user accounts to migrate is on the command line using the **ScanState** and the **LoadState** user options. - - **Note**   - Do not use the MigUser.xml and MigDocs.xml files together. For more information, see the [Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md) and [USMT Best Practices](usmt-best-practices.md) topics. - -   - -## Custom .xml Files - - -You can create custom .xml files to customize the migration for your unique needs. For example, you may want to create a custom file to migrate a line-of-business application or to modify the default migration behavior. If you want **ScanState** and **LoadState** to use this file, specify it with both commands. For more information, see the How to Create a Custom .xml File topic. - -## The Config.xml File - - -The Config.xml file is an optional file that you create using the **/genconfig** option with the **ScanState** command. You should create and modify this file if you want to exclude certain components from the migration. In addition, you must create and modify this file if you want to exclude any of the operating system settings from being migrated. The Config.xml file format is different from that of the migration .xml files because it does not contain any migration rules. It contains only a list of the operating system components, applications, and the user documents that can be migrated. For an example, see the [Config.xml File](usmt-configxml-file.md) topic. For this reason, excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. However, you cannot use wildcard characters in a Config.xml file. - -If you want to include all of the default components, you do not need to create the Config.xml file. Alternatively, if you are satisfied with the default migration behavior defined in the MigApp.xml, MigDocs.xml, and MigUser.xml files, and you want to exclude only some components, you can create and modify a Config.xml file and leave the other .xml files in their original state. - -When you run the **ScanState** command with the **/genconfig** option, **ScanState** reads the other .xml files that you specify using the **/i** option to create a custom list of components that can be migrated from the computer. This file will contain only operating system components, applications, and the user document sections that are in both of the .xml files and that are installed on the computer when you run the **ScanState** command with the **/genconfig** option. Therefore, you should create this file on a source computer that contains all of the components, applications, and settings that will be present on the destination computers. This will ensure that this file contains every component that can be migrated. The components are organized into sections: <Applications>, <WindowsComponents>, and <Documents>. To choose not to migrate a component, change its entry to `migrate="no"`. - -After you create this file, you need to specify it only with the **ScanState** command using the **/Config** option for it to affect the migration. However, if you want to exclude additional data that you migrated to the store, modify the Config.xml file and specify the updated file with the **LoadState** command. For example, if you collected the My Documents folder in the store, but you decide that you do not want to migrate the My Documents folder to a destination computer, you can modify the Config.xml file to indicate `migrate="no"` before you run the **LoadState** command, and the file will not be migrated. For more information about the precedence that takes place when excluding data, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. - -In addition, note the following functionality with the Config.xml file: - -- If a parent component is removed from the migration in the Config.xml file by specifying `migrate="no"`, all of its child components will automatically be removed from the migration, even if the child component is set to `migrate="yes"`. - -- If you mistakenly have two lines of code for the same component where one line specifies `migrate="no" `and the other line specifies `migrate="yes"`, the component will be migrated. - -- In USMT there are several migration policies that can be configured in the Config.xml file. For example, you can configure additional **<ErrorControl>**, **<ProfileControl>**, and **<HardLinkStoreControl>** options. For more information, see the [Config.xml File](usmt-configxml-file.md) topic. - -**Note**   -To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. - -  - -### Examples - -- The following command creates a Config.xml file in the current directory, but it does not create a store: - - `scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:5` - -- The following command creates an encrypted store using the Config.xml file and the default migration .xml files: - - `scanstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /o /config:config.xml /v:5 /encrypt /key:"mykey"` - -- The following command decrypts the store and migrates the files and settings: - - `loadstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /v:5 /decrypt /key:"mykey"` - -## Additional Information - - -- For more information about how to change the files and settings that are migrated, see the [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). - -- For more information about each .xml element, see the [XML Elements Library](usmt-xml-elements-library.md) topic. - -- For answers to common questions, see ".xml files" in the [Frequently Asked Questions](usmt-faq.md) topic. - -## Related topics - - -[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) - -[USMT Resources](usmt-resources.md) - -  - -  - - - - - +--- +title: Customize USMT XML Files (Windows 10) +description: Customize USMT XML Files +ms.assetid: d58363c1-fd13-4f65-8b91-9986659dc93e +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Customize USMT XML Files + + +## In This Topic + + +[Overview](#bkmk-overview) + +[Migration .xml Files](#bkmk-migxml) + +[Custom .xml Files](#bkmk-customxmlfiles) + +[The Config.xml File](#bkmk-configxml) + +[Examples](#bkmk-examples) + +[Additional Information](#bkmk-addlinfo) + +## Overview + + +If you want the **ScanState** and **LoadState** tools to use any of the migration .xml files, specify these files at the command line using the **/i** option. Because the **ScanState** and **LoadState** tools need the .xml files to control the migration, specify the same set of .xml files for both the **ScanState** and **LoadState** commands. However, you do not have to specify the Config.xml file with the **/config** option, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store but not to the destination computer. To do this, modify the Config.xml file and specify the updated file with the **LoadState** command. Then the **LoadState** command will migrate only the files and settings that you want to migrate. + +If you leave out an .xml file from the **LoadState** command, all of the data in the store that was migrated with the missing .xml files will be migrated. However, the migration rules that were specified with the **ScanState** command will not apply. For example, if you leave out an .xml file, and it contains a rerouting rule such as: `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files, and they will be migrated to C:\\data. + +To modify the migration, do one or more of the following. + +- **Modify the migration .xml files.** If you want to exclude a portion of a component—for example, you want to migrate C:\\ but exclude all of the .mp3 files—or if you want to move data to a new location on the destination computer, modify the .xml files. To modify these files, you must be familiar with the migration rules and syntax. If you want **ScanState** and **LoadState** to use these files, specify them at the command line when each command is entered. + +- **Create a custom .xml file.** You can also create a custom .xml file to migrate settings for another application, or to change the migration behavior to suit your needs. For **ScanState** and **LoadState** to use this file, specify them on both command lines. + +- **Create and modify a Config.xml file.** Do this if you want to exclude an entire component from the migration. For example, you can use a Config.xml file to exclude the entire My Documents folder, or exclude the settings for an application. Excluding components using a Config.xml file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. In addition, using a Config.xml file is the only way to exclude the operating system settings from being migrated. + +For more information about excluding data, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. + +## Migration .xml Files + + +This section describes the migration .xml files that are included with USMT. Each file contains migration rules that control which components are migrated and where they are migrated to on the destination computer. + +**Note**   +You can use the asterisk (\*) wildcard character in each of these files. However, you cannot use a question mark (?) as a wildcard character. + + + +- **The MigApp.xml file.** Specify this file with both the **ScanState** and **LoadState** commands to migrate application settings. + +- **The MigDocs.xml file.** Specify this file with both the **ScanState** and **LoadState** tools to migrate all user folders and files that are found by the **MigXmlHelper.GenerateDocPatterns** helper function. This helper function finds user data that resides on the root of any drive and in the Users directory. However, it does not find and migrate any application data, program files, or any files in the Windows directory. You can modify the MigDocs.xml file. + +- **The MigUser.xml file.** Specify this file with both the **ScanState** and **LoadState** commands to migrate user folders, files, and file types. You can modify the MigUser.xml file. This file does not contain rules that migrate specific user accounts. The only way to specify which user accounts to migrate is on the command line using the **ScanState** and the **LoadState** user options. + + **Note**   + Do not use the MigUser.xml and MigDocs.xml files together. For more information, see the [Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md) and [USMT Best Practices](usmt-best-practices.md) topics. + + + +## Custom .xml Files + + +You can create custom .xml files to customize the migration for your unique needs. For example, you may want to create a custom file to migrate a line-of-business application or to modify the default migration behavior. If you want **ScanState** and **LoadState** to use this file, specify it with both commands. For more information, see the How to Create a Custom .xml File topic. + +## The Config.xml File + + +The Config.xml file is an optional file that you create using the **/genconfig** option with the **ScanState** command. You should create and modify this file if you want to exclude certain components from the migration. In addition, you must create and modify this file if you want to exclude any of the operating system settings from being migrated. The Config.xml file format is different from that of the migration .xml files because it does not contain any migration rules. It contains only a list of the operating system components, applications, and the user documents that can be migrated. For an example, see the [Config.xml File](usmt-configxml-file.md) topic. For this reason, excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. However, you cannot use wildcard characters in a Config.xml file. + +If you want to include all of the default components, you do not need to create the Config.xml file. Alternatively, if you are satisfied with the default migration behavior defined in the MigApp.xml, MigDocs.xml, and MigUser.xml files, and you want to exclude only some components, you can create and modify a Config.xml file and leave the other .xml files in their original state. + +When you run the **ScanState** command with the **/genconfig** option, **ScanState** reads the other .xml files that you specify using the **/i** option to create a custom list of components that can be migrated from the computer. This file will contain only operating system components, applications, and the user document sections that are in both of the .xml files and that are installed on the computer when you run the **ScanState** command with the **/genconfig** option. Therefore, you should create this file on a source computer that contains all of the components, applications, and settings that will be present on the destination computers. This will ensure that this file contains every component that can be migrated. The components are organized into sections: <Applications>, <WindowsComponents>, and <Documents>. To choose not to migrate a component, change its entry to `migrate="no"`. + +After you create this file, you need to specify it only with the **ScanState** command using the **/Config** option for it to affect the migration. However, if you want to exclude additional data that you migrated to the store, modify the Config.xml file and specify the updated file with the **LoadState** command. For example, if you collected the My Documents folder in the store, but you decide that you do not want to migrate the My Documents folder to a destination computer, you can modify the Config.xml file to indicate `migrate="no"` before you run the **LoadState** command, and the file will not be migrated. For more information about the precedence that takes place when excluding data, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. + +In addition, note the following functionality with the Config.xml file: + +- If a parent component is removed from the migration in the Config.xml file by specifying `migrate="no"`, all of its child components will automatically be removed from the migration, even if the child component is set to `migrate="yes"`. + +- If you mistakenly have two lines of code for the same component where one line specifies `migrate="no"` and the other line specifies `migrate="yes"`, the component will be migrated. + +- In USMT there are several migration policies that can be configured in the Config.xml file. For example, you can configure additional **<ErrorControl>**, **<ProfileControl>**, and **<HardLinkStoreControl>** options. For more information, see the [Config.xml File](usmt-configxml-file.md) topic. + +**Note**   +To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. + + + +### Examples + +- The following command creates a Config.xml file in the current directory, but it does not create a store: + + `scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:5` + +- The following command creates an encrypted store using the Config.xml file and the default migration .xml files: + + `scanstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /o /config:config.xml /v:5 /encrypt /key:"mykey"` + +- The following command decrypts the store and migrates the files and settings: + + `loadstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /v:5 /decrypt /key:"mykey"` + +## Additional Information + + +- For more information about how to change the files and settings that are migrated, see the [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). + +- For more information about each .xml element, see the [XML Elements Library](usmt-xml-elements-library.md) topic. + +- For answers to common questions, see ".xml files" in the [Frequently Asked Questions](usmt-faq.md) topic. + +## Related topics + + +[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) + +[USMT Resources](usmt-resources.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-determine-what-to-migrate.md b/windows/deployment/usmt/usmt-determine-what-to-migrate.md index 224a7d5a1b..cb04fac7e3 100644 --- a/windows/deployment/usmt/usmt-determine-what-to-migrate.md +++ b/windows/deployment/usmt/usmt-determine-what-to-migrate.md @@ -1,64 +1,67 @@ ---- -title: Determine What to Migrate (Windows 10) -description: Determine What to Migrate -ms.assetid: 01ae1d13-c3eb-4618-b39d-ee5d18d55761 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Determine What to Migrate - - -By default, User State Migration Tool (USMT) 10.0 migrates the items listed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md), depending on the migration .xml files you specify. These default settings are often enough for a basic migration. - -However, when considering what settings to migrate, you should also consider what settings you would like the user to be able to configure, if any, and what settings you would like to standardize. Many organizations use their migration as an opportunity to create and begin enforcing a better-managed environment. Some of the settings that users can configure on unmanaged computers prior to the migration can be locked on the new, managed computers. For example, standard wallpaper, Internet Explorer security settings, and desktop configuration are some of the items you can choose to standardize. - -To reduce complexity and increase standardization, your organization should consider creating a *standard operating environment (SOE)*. An SOE is a combination of hardware and software that you distribute to all users. This means selecting a baseline for all computers, including standard hardware drivers; core operating system features; core productivity applications, especially if they are under volume licensing; and core utilities. This environment should also include a standard set of security features, as outlined in the organization’s corporate policy. Using a standard operating environment can vastly simplify the migration and reduce overall deployment challenges. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - -

                                [Identify Users](usmt-identify-users.md)

                                Use command-line options to specify which users to migrate and how they should be migrated.

                                [Identify Applications Settings](usmt-identify-application-settings.md)

                                Determine which applications you want to migrate and prepare a list of application settings to be migrated.

                                [Identify Operating System Settings](usmt-identify-operating-system-settings.md)

                                Use migration to create a new standard environment on each of the destination computers.

                                [Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md)

                                Determine and locate the standard, company-specified, and non-standard locations of the file types, files, folders, and settings that you want to migrate.

                                - -  - -## Related topics - - -[What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) - -  - -  - - - - - +--- +title: Determine What to Migrate (Windows 10) +description: Determine What to Migrate +ms.assetid: 01ae1d13-c3eb-4618-b39d-ee5d18d55761 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Determine What to Migrate + + +By default, User State Migration Tool (USMT) 10.0 migrates the items listed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md), depending on the migration .xml files you specify. These default settings are often enough for a basic migration. + +However, when considering what settings to migrate, you should also consider what settings you would like the user to be able to configure, if any, and what settings you would like to standardize. Many organizations use their migration as an opportunity to create and begin enforcing a better-managed environment. Some of the settings that users can configure on unmanaged computers prior to the migration can be locked on the new, managed computers. For example, standard wallpaper, Internet Explorer security settings, and desktop configuration are some of the items you can choose to standardize. + +To reduce complexity and increase standardization, your organization should consider creating a *standard operating environment (SOE)*. An SOE is a combination of hardware and software that you distribute to all users. This means selecting a baseline for all computers, including standard hardware drivers; core operating system features; core productivity applications, especially if they are under volume licensing; and core utilities. This environment should also include a standard set of security features, as outlined in the organization’s corporate policy. Using a standard operating environment can vastly simplify the migration and reduce overall deployment challenges. + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + +

                                Identify Users

                                Use command-line options to specify which users to migrate and how they should be migrated.

                                Identify Applications Settings

                                Determine which applications you want to migrate and prepare a list of application settings to be migrated.

                                Identify Operating System Settings

                                Use migration to create a new standard environment on each of the destination computers.

                                Identify File Types, Files, and Folders

                                Determine and locate the standard, company-specified, and non-standard locations of the file types, files, folders, and settings that you want to migrate.

                                + + + +## Related topics + + +[What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-estimate-migration-store-size.md b/windows/deployment/usmt/usmt-estimate-migration-store-size.md index 670edce731..34eeb23adc 100644 --- a/windows/deployment/usmt/usmt-estimate-migration-store-size.md +++ b/windows/deployment/usmt/usmt-estimate-migration-store-size.md @@ -1,136 +1,139 @@ ---- -title: Estimate Migration Store Size (Windows 10) -description: Estimate Migration Store Size -ms.assetid: cfb9062b-7a2a-467a-a24e-0b31ce830093 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Estimate Migration Store Size - - -The disk space requirements for a migration are dependent on the size of the migration store and the type of migration. You can estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure. You can also calculate the disk space requirements using the ScanState tool. - -## In This Topic - - -- [Hard Disk Space Requirements](#bkmk-spacereqs). Describes the disk space requirements for the migration store and other considerations on the source and destination computers. - -- [Calculate Disk Space Requirements Using the ScanState Tool](#bkmk-calcdiskspace). Describes how to use the ScanState tool to determine how big the migration store will be on a particular computer. - -- [Estimate Migration Store Size](#bkmk-estmigstoresize). Describes how to estimate the average size of migration stores for the computers in your organization, based on your infrastructure. - -## Hard Disk Space Requirements - - -- **Store.** For non-hard-link migrations, you should ensure that there is enough available disk space at the location where you will save your store to contain the data being migrated. You can save your store to another partition, an external storage device such as a USB flash drive or a server. For more information, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md). - -- **Source Computer.** The source computer needs enough available space for the following: - - - [E250 megabytes (MB) minimum of hard disk space.](#bkmk-estmigstoresize) Space is needed to support the User State Migration Tool (USMT) 10.0 operations, for example, growth in the page file. Provided that every volume involved in the migration is formatted as NTFS, 250 MB should be enough space to ensure success for almost every hard-link migration, regardless of the size of the migration. The USMT tools will not create the migration store if 250 MB of disk space is not available. - - - [Temporary space for USMT to run.](#bkmk-estmigstoresize) Additional disk space for the USMT tools to operate is required. This does not include the minimum 250 MB needed to create the migration store. The amount of temporary space required can be calculated using the ScanState tool. - - - [Hard-link migration store.](#bkmk-estmigstoresize) It is not necessary to estimate the size of a hard-link migration store. The only case where the hard-link store can be quite large is when non-NTFS file systems exist on the system and contain data being migrated. - -- [Destination computer.](#bkmk-estmigstoresize) The destination computer needs enough available space for the following: - - - [Operating system.](#bkmk-estmigstoresize) - - - [Applications.](#bkmk-estmigstoresize) - - - [Data being migrated.](#bkmk-estmigstoresize) It is important to consider that in addition to the files being migrated, registry information will also require hard disk space for storage. - - - [Temporary space for USMT to run.](#bkmk-estmigstoresize) Additional disk space for the USMT tools to operate is required. The amount of temporary space required can be calculated using the ScanState tool. - -## Calculate Disk Space Requirements using the ScanState Tool - - -You can use the ScanState tool to calculate the disk space requirements for a particular compressed or uncompressed migration. It is not necessary to estimate the migration store size for a hard-link migration since this method does not create a separate migration store. The ScanState tool provides disk space requirements for the state of the computer at the time the tool is run. The state of the computer may change during day to day use so it is recommended that you use the calculations as an estimate when planning your migration. - -**To run the ScanState tool on the source computer with USMT installed,** - -1. Open a command prompt with administrator privileges. - -2. Navigate to the USMT tools. For example, type - - ``` syntax - cd /d "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\User State Migration Tool\" - ``` - - Where *<architecture>* is x86 or amd64. - -3. Run the **ScanState** tool to generate an XML report of the space requirements. At the command prompt, type - - ``` syntax - ScanState.exe /p: - ``` - - Where *<StorePath>* is a path to a directory where the migration store will be saved and *<path to a file>* is the path and filename where the XML report for space requirements will be saved. For example, - - ``` syntax - ScanState.exe c:\store /p:c:\spaceRequirements.xml - ``` - - The migration store will not be created by running this command, but `StorePath` is a required parameter. - -The ScanState tool also allows you to estimate disk space requirements based on a customized migration. For example, you might not want to migrate the My Documents folder to the destination computer. You can specify this in a configuration file when you run the ScanState tool. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md). - -**Note**   -To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, the **/p** option, without specifying *<path to a file>* is still available in USMT. - -  - -The space requirements report provides two elements, <**storeSize**> and <**temporarySpace**>. The <**temporarySpace**> value shows the disk space, in bytes, that USMT uses to operate during the migration—this does not include the minimum 250 MB needed to support USMT. The <**storeSize**> value shows the disk space, in bytes, required to host the migration store contents on both the source and destination computers. The following example shows a report generated using **/p:***<path to a file>*. - -``` syntax - - - - 11010592768 - - - 58189144 - - -``` - -Additionally, USMT performs a compliance check for a required minimum of 250 MB of available disk space and will not create a store if the compliance check fails. - -## Estimate Migration Store Size - - -Determine how much space you will need to store the migrated data. You should base your calculations on the volume of e-mail, personal documents, and system settings for each user. The best way to estimate these is to survey several computers to arrive at an average for the size of the store that you will need. - -The amount of space that is required in the store will vary, depending on the local storage strategies your organization uses. For example, one key element that determines the size of migration data sets is e-mail storage. If e-mail is stored centrally, data sets will be smaller. If e-mail is stored locally, such as offline-storage files, data sets will be larger. Mobile users will typically have larger data sets than workstation users. You should perform tests and inventory the network to determine the average data set size in your organization. - -**Note**   -You can create a space-estimate file (Usmtsize.txt), by using the legacy **/p** command-line option to estimate the size of the store. - -  - -When trying to determine how much disk space you will need, consider the following issues: - -- **E-mail** : If users deal with a large volume of e-mail or keep e-mail on their local computers instead of on a mail server, the e-mail can take up as much disk space as all other user files combined. Prior to migrating user data, make sure that users who store e-mail locally synchronize their inboxes with their mail server. - -- **User documents**: Frequently, all of a user's documents fit into less than 50 MB of space, depending on the types of files involved. This estimate assumes typical office work, such as word-processing documents and spreadsheets. This estimate can vary substantially based on the types of documents that your organization uses. For example, an architectural firm that predominantly uses computer-aided design (CAD) files needs much more space than a law firm that primarily uses word-processing documents. You do not need to migrate the documents that users store on file servers through mechanisms such as Folder Redirection, as long as users will have access to these locations after the migration. - -- **User system settings** Five megabytes is usually adequate space to save the registry settings. This requirement can fluctuate, however, based on the number of applications that have been installed. It is rare, however, for the user-specific portion of the registry to exceed 5 MB. - -## Related topics - - -[Common Migration Scenarios](usmt-common-migration-scenarios.md) - -  - -  - - - - - +--- +title: Estimate Migration Store Size (Windows 10) +description: Estimate Migration Store Size +ms.assetid: cfb9062b-7a2a-467a-a24e-0b31ce830093 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Estimate Migration Store Size + + +The disk space requirements for a migration are dependent on the size of the migration store and the type of migration. You can estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure. You can also calculate the disk space requirements using the ScanState tool. + +## In This Topic + + +- [Hard Disk Space Requirements](#bkmk-spacereqs). Describes the disk space requirements for the migration store and other considerations on the source and destination computers. + +- [Calculate Disk Space Requirements Using the ScanState Tool](#bkmk-calcdiskspace). Describes how to use the ScanState tool to determine how big the migration store will be on a particular computer. + +- [Estimate Migration Store Size](#bkmk-estmigstoresize). Describes how to estimate the average size of migration stores for the computers in your organization, based on your infrastructure. + +## Hard Disk Space Requirements + + +- **Store.** For non-hard-link migrations, you should ensure that there is enough available disk space at the location where you will save your store to contain the data being migrated. You can save your store to another partition, an external storage device such as a USB flash drive or a server. For more information, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md). + +- **Source Computer.** The source computer needs enough available space for the following: + + - [E250 megabytes (MB) minimum of hard disk space.](#bkmk-estmigstoresize) Space is needed to support the User State Migration Tool (USMT) 10.0 operations, for example, growth in the page file. Provided that every volume involved in the migration is formatted as NTFS, 250 MB should be enough space to ensure success for almost every hard-link migration, regardless of the size of the migration. The USMT tools will not create the migration store if 250 MB of disk space is not available. + + - [Temporary space for USMT to run.](#bkmk-estmigstoresize) Additional disk space for the USMT tools to operate is required. This does not include the minimum 250 MB needed to create the migration store. The amount of temporary space required can be calculated using the ScanState tool. + + - [Hard-link migration store.](#bkmk-estmigstoresize) It is not necessary to estimate the size of a hard-link migration store. The only case where the hard-link store can be quite large is when non-NTFS file systems exist on the system and contain data being migrated. + +- [Destination computer.](#bkmk-estmigstoresize) The destination computer needs enough available space for the following: + + - [Operating system.](#bkmk-estmigstoresize) + + - [Applications.](#bkmk-estmigstoresize) + + - [Data being migrated.](#bkmk-estmigstoresize) It is important to consider that in addition to the files being migrated, registry information will also require hard disk space for storage. + + - [Temporary space for USMT to run.](#bkmk-estmigstoresize) Additional disk space for the USMT tools to operate is required. The amount of temporary space required can be calculated using the ScanState tool. + +## Calculate Disk Space Requirements using the ScanState Tool + + +You can use the ScanState tool to calculate the disk space requirements for a particular compressed or uncompressed migration. It is not necessary to estimate the migration store size for a hard-link migration since this method does not create a separate migration store. The ScanState tool provides disk space requirements for the state of the computer at the time the tool is run. The state of the computer may change during day to day use so it is recommended that you use the calculations as an estimate when planning your migration. + +**To run the ScanState tool on the source computer with USMT installed,** + +1. Open a command prompt with administrator privileges. + +2. Navigate to the USMT tools. For example, type + + ``` syntax + cd /d "C:\Program Files (x86)\Windows Kits\8.0\Assessment and Deployment Kit\User State Migration Tool\" + ``` + + Where *<architecture>* is x86 or amd64. + +3. Run the **ScanState** tool to generate an XML report of the space requirements. At the command prompt, type + + ``` syntax + ScanState.exe /p: + ``` + + Where *<StorePath>* is a path to a directory where the migration store will be saved and *<path to a file>* is the path and filename where the XML report for space requirements will be saved. For example, + + ``` syntax + ScanState.exe c:\store /p:c:\spaceRequirements.xml + ``` + + The migration store will not be created by running this command, but `StorePath` is a required parameter. + +The ScanState tool also allows you to estimate disk space requirements based on a customized migration. For example, you might not want to migrate the My Documents folder to the destination computer. You can specify this in a configuration file when you run the ScanState tool. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md). + +**Note**   +To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, the **/p** option, without specifying *<path to a file>* is still available in USMT. + + + +The space requirements report provides two elements, <**storeSize**> and <**temporarySpace**>. The <**temporarySpace**> value shows the disk space, in bytes, that USMT uses to operate during the migration—this does not include the minimum 250 MB needed to support USMT. The <**storeSize**> value shows the disk space, in bytes, required to host the migration store contents on both the source and destination computers. The following example shows a report generated using **/p:***<path to a file>*. + +```xml + + + + 11010592768 + + + 58189144 + + +``` + +Additionally, USMT performs a compliance check for a required minimum of 250 MB of available disk space and will not create a store if the compliance check fails. + +## Estimate Migration Store Size + + +Determine how much space you will need to store the migrated data. You should base your calculations on the volume of e-mail, personal documents, and system settings for each user. The best way to estimate these is to survey several computers to arrive at an average for the size of the store that you will need. + +The amount of space that is required in the store will vary, depending on the local storage strategies your organization uses. For example, one key element that determines the size of migration data sets is e-mail storage. If e-mail is stored centrally, data sets will be smaller. If e-mail is stored locally, such as offline-storage files, data sets will be larger. Mobile users will typically have larger data sets than workstation users. You should perform tests and inventory the network to determine the average data set size in your organization. + +**Note**   +You can create a space-estimate file (Usmtsize.txt), by using the legacy **/p** command-line option to estimate the size of the store. + + + +When trying to determine how much disk space you will need, consider the following issues: + +- **E-mail** : If users deal with a large volume of e-mail or keep e-mail on their local computers instead of on a mail server, the e-mail can take up as much disk space as all other user files combined. Prior to migrating user data, make sure that users who store e-mail locally synchronize their inboxes with their mail server. + +- **User documents**: Frequently, all of a user's documents fit into less than 50 MB of space, depending on the types of files involved. This estimate assumes typical office work, such as word-processing documents and spreadsheets. This estimate can vary substantially based on the types of documents that your organization uses. For example, an architectural firm that predominantly uses computer-aided design (CAD) files needs much more space than a law firm that primarily uses word-processing documents. You do not need to migrate the documents that users store on file servers through mechanisms such as Folder Redirection, as long as users will have access to these locations after the migration. + +- **User system settings** Five megabytes is usually adequate space to save the registry settings. This requirement can fluctuate, however, based on the number of applications that have been installed. It is rare, however, for the user-specific portion of the registry to exceed 5 MB. + +## Related topics + + +[Common Migration Scenarios](usmt-common-migration-scenarios.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-exclude-files-and-settings.md b/windows/deployment/usmt/usmt-exclude-files-and-settings.md index 3e8388b8b8..21a829f394 100644 --- a/windows/deployment/usmt/usmt-exclude-files-and-settings.md +++ b/windows/deployment/usmt/usmt-exclude-files-and-settings.md @@ -1,276 +1,279 @@ ---- -title: Exclude Files and Settings (Windows 10) -description: Exclude Files and Settings -ms.assetid: df85baf1-6e29-4995-a4bb-ba3f8f7fed0b -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Exclude Files and Settings -When you specify the migration .xml files, MigApp.xml, Migdocs, and MigUser.xml, the User State Migration Tool (USMT) 10.0 migrates the settings and components listed, as discussed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) You can create a custom .xml file to further specify what to include or exclude in the migration. In addition you can create a Config.xml file to exclude an entire component from a migration. You cannot, however, exclude users by using the migration .xml files or the Config.xml file. The only way to specify which users to include and exclude is by using the User options on the command line in the ScanState tool. For more information, see [ScanState Syntax](usmt-scanstate-syntax.md). - -In this topic: - -- [Create a custom .xml file](#create-a-custom-xml-file). You can use the following elements to specify what to exclude: - - - include and exclude: You can use the <include> and <exclude> elements to exclude objects with conditions. For example, you can migrate all files located in the C:\\ drive, except any .mp3 files. It is important to remember that [Conflicts and Precedence](usmt-conflicts-and-precedence.md) apply to these elements. - - - [unconditionalExclude](#example-1-how-to-migrate-all-files-from-c-except-mp3-files): You can use the <unconditionalExclude> element to globally exclude data. This element takes precedence over all other include and exclude rules in the .xml files. Therefore, this element excludes objects regardless of any other <include> rules that are in the .xml files. For example, you can exclude all .mp3 files on the computer, or you can exclude all files from C:\\UserData. - -- [Create a Config.xml File](#create-a-config-xml-file): You can create and modify a Config.xml file to exclude an entire component from the migration. For example, you can use this file to exclude the settings for one of the default applications. In addition, creating and modifying a Config.xml file is the only way to exclude the operating-system settings that are migrated to computers running Windows. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. - -## Create a custom .xml file -We recommend that you create a custom .xml file instead of modifying the default migration .xml files. When you use a custom .xml file, you can keep your changes separate from the default .xml files, which makes it easier to track your modifications. - -### <include> and <exclude> -The migration .xml files, MigApp.xml, MigDocs, and MigUser.xml, contain the <component> element, which typically represents a self-contained component or an application such as Microsoft® Office Outlook® and Word. To exclude the files and registry settings that are associated with these components, use the <include> and <exclude> elements. For example, you can use these elements to migrate all files and settings with pattern X except files and settings with pattern Y, where Y is more specific than X. For the syntax of these elements, see [USMT XML Reference](usmt-xml-reference.md). - -**Note**   -If you specify an <exclude> rule, always specify a corresponding <include> rule. Otherwise, if you do not specify an <include> rule, the specific files or settings will not be included. They will already be excluded from the migration. Thus, an unaccompanied <exclude> rule is unnecessary. - -- [Example 1: How to migrate all files from C:\\ except .mp3 files](#example-1-how-to-migrate-all-files-from-c-except-mp3-files) - -- [Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp](#example-2-how-to-migrate-all-files-located-in-cdata-except-files-in-cdatatmp) - -- [Example 3: How to exclude the files in a folder but include all subfolders](#example-3-how-to-exclude-the-files-in-a-folder-but-include-all-subfolders) - -- [Example 4: How to exclude a file from a specific folder](#example-4-how-to-exclude-a-file-from-a-specific-folder) - -- [Example 5: How to exclude a file from any location](#example-5-how-to-exclude-a-file-from-any-location) - -### Example 1: How to migrate all files from C:\\ except .mp3 files -The following .xml file migrates all files located on the C: drive, except any .mp3 files. - -``` xml - - - - MP3 Files - - - - - C:\* [*] - - - - - C:\* [*.mp3] - - - - - - -``` -### Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp -The following .xml file migrates all files and subfolders in C:\\Data, except the files and subfolders in C:\\Data\\tmp. - -``` xml - - - Test component - - - - - C:\Data\* [*] - - - - - C:\Data\temp\* [*] - - - - - - -``` - -### Example 3: How to exclude the files in a folder but include all subfolders -The following .xml file migrates any subfolders in C:\\EngineeringDrafts, but excludes all files that are in C:\\EngineeringDrafts. - -``` xml - - - Component to migrate all Engineering Drafts Documents without subfolders - - - - - C:\EngineeringDrafts\* [*] - - - - - C:\EngineeringDrafts\ [*] - - - - - - -``` - -### Example 4: How to exclude a file from a specific folder -The following .xml file migrates all files and subfolders in C:\\EngineeringDrafts, except for the Sample.doc file in C:\\EngineeringDrafts. - -``` xml - - - Component to migrate all Engineering Drafts Documents except Sample.doc - - - - - C:\EngineeringDrafts\* [*] - - - - - C:\EngineeringDrafts\ [Sample.doc] - - - - - - -``` - -### Example 5: How to exclude a file from any location -To exclude a Sample.doc file from any location on the C: drive, use the <pattern> element. If multiple files exist with the same name on the C: drive, all of these files will be excluded. - -``` xml - C:\* [Sample.doc] -``` - -To exclude a Sample.doc file from any drive on the computer, use the <script> element. If multiple files exist with the same name, all of these files will be excluded. - -``` xml - -``` -#### Examples of how to use XML to exclude files, folders, and registry keys -Here are some examples of how to use XML to exclude files, folders, and registry keys. For more info, see [USMT XML Reference](usmt-xml-reference.md) - -**Example 1: How to exclude all .mp3 files**
                                -The following .xml file excludes all .mp3 files from the migration: - -``` xml - - - Test - - - - - - - - - - - -``` -**Example 2: How to exclude all of the files on a specific drive**
                                -The following .xml file excludes only the files located on the C: drive. - -``` xml - - - Test - - - - - c:\*[*] - - - - - - -``` -**Example 3: How to exclude registry keys**
                                -The following .xml file unconditionally excludes the HKEY_CURRENT_USER registry key and all of its subkeys. - -``` xml - - - - Test - - - - - HKCU\testReg[*] - - - - - HKCU\*[*] - - - - - - -``` -**Example 4: How to Exclude `C:\Windows` and `C:\Program Files`**
                                -The following .xml file unconditionally excludes the system folders of `C:\Windows` and `C:\Program Files`. Note that all \*.docx, \*.xls and \*.ppt files will not be migrated because the <unconditionalExclude> element takes precedence over the <include> element. - -``` xml - - - - Test - - - - - - - - - - - - C:\Program Files\* [*] -C:\Windows\* [*] - - - - - - -``` -## Create a Config XML File -You can create and modify a Config.xml file if you want to exclude components from the migration. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. Config.xml is an optional file that you can create using the **/genconfig** command-line option with the ScanState tool. For example, you can use the Config.xml file to exclude the settings for one of the default applications. In addition, creating and modifying this file is the only way to exclude the operating-system settings that are migrated to computers running Windows. - -- **To exclude the settings for a default application:** Specify `migrate="no"` for the application under the <Applications> section of the Config.xml file. - -- **To exclude an operating system setting:** Specify `migrate="no"` for the setting under the <WindowsComponents> section. - -- **To exclude My Documents:** Specify `migrate="no"` for My Documents under the <Documents> section. Note that any <include> rules in the .xml files will still apply. For example, if you have a rule that includes all the .docx files in My Documents, then only the .docx files will be migrated, but the rest of the files will not. - -See [Config.xml File](usmt-configxml-file.md) for more information. - -**Note**   -To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. - -## Related topics -- [Customize USMT XML Files](usmt-customize-xml-files.md) -- [USMT XML Reference](usmt-xml-reference.md) - -  - -  - - - - - +--- +title: Exclude Files and Settings (Windows 10) +description: Exclude Files and Settings +ms.assetid: df85baf1-6e29-4995-a4bb-ba3f8f7fed0b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Exclude Files and Settings +When you specify the migration .xml files, MigApp.xml, Migdocs, and MigUser.xml, the User State Migration Tool (USMT) 10.0 migrates the settings and components listed, as discussed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) You can create a custom .xml file to further specify what to include or exclude in the migration. In addition you can create a Config.xml file to exclude an entire component from a migration. You cannot, however, exclude users by using the migration .xml files or the Config.xml file. The only way to specify which users to include and exclude is by using the User options on the command line in the ScanState tool. For more information, see [ScanState Syntax](usmt-scanstate-syntax.md). + +In this topic: + +- [Create a custom .xml file](#create-a-custom-xml-file). You can use the following elements to specify what to exclude: + + - include and exclude: You can use the <include> and <exclude> elements to exclude objects with conditions. For example, you can migrate all files located in the C:\\ drive, except any .mp3 files. It is important to remember that [Conflicts and Precedence](usmt-conflicts-and-precedence.md) apply to these elements. + + - [unconditionalExclude](#example-1-how-to-migrate-all-files-from-c-except-mp3-files): You can use the <unconditionalExclude> element to globally exclude data. This element takes precedence over all other include and exclude rules in the .xml files. Therefore, this element excludes objects regardless of any other <include> rules that are in the .xml files. For example, you can exclude all .mp3 files on the computer, or you can exclude all files from C:\\UserData. + +- [Create a Config.xml File](#create-a-config-xml-file): You can create and modify a Config.xml file to exclude an entire component from the migration. For example, you can use this file to exclude the settings for one of the default applications. In addition, creating and modifying a Config.xml file is the only way to exclude the operating-system settings that are migrated to computers running Windows. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. + +## Create a custom .xml file +We recommend that you create a custom .xml file instead of modifying the default migration .xml files. When you use a custom .xml file, you can keep your changes separate from the default .xml files, which makes it easier to track your modifications. + +### <include> and <exclude> +The migration .xml files, MigApp.xml, MigDocs, and MigUser.xml, contain the <component> element, which typically represents a self-contained component or an application such as Microsoft® Office Outlook® and Word. To exclude the files and registry settings that are associated with these components, use the <include> and <exclude> elements. For example, you can use these elements to migrate all files and settings with pattern X except files and settings with pattern Y, where Y is more specific than X. For the syntax of these elements, see [USMT XML Reference](usmt-xml-reference.md). + +**Note**   +If you specify an <exclude> rule, always specify a corresponding <include> rule. Otherwise, if you do not specify an <include> rule, the specific files or settings will not be included. They will already be excluded from the migration. Thus, an unaccompanied <exclude> rule is unnecessary. + +- [Example 1: How to migrate all files from C:\\ except .mp3 files](#example-1-how-to-migrate-all-files-from-c-except-mp3-files) + +- [Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp](#example-2-how-to-migrate-all-files-located-in-cdata-except-files-in-cdatatmp) + +- [Example 3: How to exclude the files in a folder but include all subfolders](#example-3-how-to-exclude-the-files-in-a-folder-but-include-all-subfolders) + +- [Example 4: How to exclude a file from a specific folder](#example-4-how-to-exclude-a-file-from-a-specific-folder) + +- [Example 5: How to exclude a file from any location](#example-5-how-to-exclude-a-file-from-any-location) + +### Example 1: How to migrate all files from C:\\ except .mp3 files +The following .xml file migrates all files located on the C: drive, except any .mp3 files. + +``` xml + + + + MP3 Files + + + + + C:\* [*] + + + + + C:\* [*.mp3] + + + + + + +``` +### Example 2: How to migrate all files located in C:\\Data except files in C:\\Data\\tmp +The following .xml file migrates all files and subfolders in C:\\Data, except the files and subfolders in C:\\Data\\tmp. + +``` xml + + + Test component + + + + + C:\Data\* [*] + + + + + C:\Data\temp\* [*] + + + + + + +``` + +### Example 3: How to exclude the files in a folder but include all subfolders +The following .xml file migrates any subfolders in C:\\EngineeringDrafts, but excludes all files that are in C:\\EngineeringDrafts. + +``` xml + + + Component to migrate all Engineering Drafts Documents without subfolders + + + + + C:\EngineeringDrafts\* [*] + + + + + C:\EngineeringDrafts\ [*] + + + + + + +``` + +### Example 4: How to exclude a file from a specific folder +The following .xml file migrates all files and subfolders in C:\\EngineeringDrafts, except for the Sample.doc file in C:\\EngineeringDrafts. + +``` xml + + + Component to migrate all Engineering Drafts Documents except Sample.doc + + + + + C:\EngineeringDrafts\* [*] + + + + + C:\EngineeringDrafts\ [Sample.doc] + + + + + + +``` + +### Example 5: How to exclude a file from any location +To exclude a Sample.doc file from any location on the C: drive, use the <pattern> element. If multiple files exist with the same name on the C: drive, all of these files will be excluded. + +``` xml + C:\* [Sample.doc] +``` + +To exclude a Sample.doc file from any drive on the computer, use the <script> element. If multiple files exist with the same name, all of these files will be excluded. + +``` xml + +``` +#### Examples of how to use XML to exclude files, folders, and registry keys +Here are some examples of how to use XML to exclude files, folders, and registry keys. For more info, see [USMT XML Reference](usmt-xml-reference.md) + +**Example 1: How to exclude all .mp3 files**
                                +The following .xml file excludes all .mp3 files from the migration: + +``` xml + + + Test + + + + + + + + + + + +``` +**Example 2: How to exclude all of the files on a specific drive**
                                +The following .xml file excludes only the files located on the C: drive. + +``` xml + + + Test + + + + + c:\*[*] + + + + + + +``` +**Example 3: How to exclude registry keys**
                                +The following .xml file unconditionally excludes the HKEY_CURRENT_USER registry key and all of its subkeys. + +``` xml + + + + Test + + + + + HKCU\testReg[*] + + + + + HKCU\*[*] + + + + + + +``` +**Example 4: How to Exclude `C:\Windows` and `C:\Program Files`**
                                +The following .xml file unconditionally excludes the system folders of `C:\Windows` and `C:\Program Files`. Note that all \*.docx, \*.xls and \*.ppt files will not be migrated because the <unconditionalExclude> element takes precedence over the <include> element. + +``` xml + + + + Test + + + + + + + + + + + + C:\Program Files\* [*] +C:\Windows\* [*] + + + + + + +``` +## Create a Config XML File +You can create and modify a Config.xml file if you want to exclude components from the migration. Excluding components using this file is easier than modifying the migration .xml files because you do not need to be familiar with the migration rules and syntax. Config.xml is an optional file that you can create using the **/genconfig** command-line option with the ScanState tool. For example, you can use the Config.xml file to exclude the settings for one of the default applications. In addition, creating and modifying this file is the only way to exclude the operating-system settings that are migrated to computers running Windows. + +- **To exclude the settings for a default application:** Specify `migrate="no"` for the application under the <Applications> section of the Config.xml file. + +- **To exclude an operating system setting:** Specify `migrate="no"` for the setting under the <WindowsComponents> section. + +- **To exclude My Documents:** Specify `migrate="no"` for My Documents under the <Documents> section. Note that any <include> rules in the .xml files will still apply. For example, if you have a rule that includes all the .docx files in My Documents, then only the .docx files will be migrated, but the rest of the files will not. + +See [Config.xml File](usmt-configxml-file.md) for more information. + +**Note**   +To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. + +## Related topics +- [Customize USMT XML Files](usmt-customize-xml-files.md) +- [USMT XML Reference](usmt-xml-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md index 90f1903e5d..6a97acb78b 100644 --- a/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md +++ b/windows/deployment/usmt/usmt-extract-files-from-a-compressed-migration-store.md @@ -1,119 +1,122 @@ ---- -title: Extract Files from a Compressed USMT Migration Store (Windows 10) -description: Extract Files from a Compressed USMT Migration Store -ms.assetid: ad9fbd6e-f89e-4444-8538-9b11566b1f33 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Extract Files from a Compressed USMT Migration Store - - -When you migrate files and settings during a typical PC-refresh migration, you usually create a compressed migration store file on the intermediate store. This migration store is a single image file that contains all files being migrated as well as a catalog file. To protect the compressed file, you can encrypt it by using different encryption algorithms. When you migrate the file back to the source computer after the operating system is installed, you can run the **Usmtutils** command with the **/extract** option to recover the files from the compressed migration store. You can also use the **Usmtutils** command with the **/extract** option any time you need to recover data from a migration store. - -Options used with the **/extract** option can specify: - -- The cryptographic algorithm that was used to create the migration store. - -- The encryption key or the text file that contains the encryption key. - -- Include and exclude patterns for selective data extraction. - -In addition, you can specify the file patterns that you want to extract by using the **/i** option to include file patterns or the **/e** option to exclude file patterns. When both the **/i** option and the **/e** option are used in the same command, include patterns take precedence over exclude patterns. Note that this is different from the include and exclude rules used in the ScanState and LoadState tools. - -## In this topic - - -- [To run the USMTutils tool with the /extract option](#bkmk-extractsyntax) - -- [To extract all files from a compressed migration store](#bkmk-extractallfiles) - -- [To extract specific file types from an encrypted compressed migration store](#bkmk-extractspecificfiles) - -- [To extract all but one, or more, file types from an encrypted compressed migration store](#bkmk-excludefilepattern) - -- [To extract file types using the include pattern and the exclude pattern](#bkmk-includeexcludefiles) - -### To run the USMTutils tool with the /extract option - -To extract files from the compressed migration store onto the destination computer, use the following USMTutils syntax: - -Cd /d <USMTpath> usmtutils /extract <filePath> <destinationPath> \[/i:<includePattern>\] \[/e:<excludePattern>\] \[/l:<logfile>\] \[/decrypt\[:<AlgID>\] {/key:<keystring> | /keyfile:<filename>}\] \[/o\] - -Where the placeholders have the following values: - -- *<USMTpath>* is the location where you have saved the USMT files and tools. - -- *<filePath>* is the location of the migration store. - -- *<destination path>* is the location of the file where you want the **/extract** option to put the extracted migration store contents. - -- *<includePattern>* specifies the pattern for the files to include in the extraction. - -- *<excludePattern>* specifies the pattern for the files to omit from the extraction. - -- *<AlgID>* is the cryptographic algorithm that was used to create the migration store on the **ScanState** command line. - -- *<logfile>* is the location and name of the log file. - -- *<keystring>* is the encryption key that was used to encrypt the migration store. - -- *<filename>* is the location and name of the text file that contains the encryption key. - -### To extract all files from a compressed migration store - -To extract everything from a compressed migration store to a file on the C:\\ drive, type: - -``` syntax -usmtutils /extract D:\MyMigrationStore\USMT\store.mig C:\ExtractedStore -``` - -### To extract specific file types from an encrypted compressed migration store - -To extract specific files, such as .txt and .pdf files, from an encrypted compressed migration store, type: - -``` syntax -usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:"*.txt,*.pdf" C:\ExtractedStore /decrypt /keyfile:D:\encryptionKey.txt -``` - -In this example, the file is encrypted and the encryption key is located in a text file called encryptionKey. - -### To extract all but one, or more, file types from an encrypted compressed migration store - -To extract all files except for one file type, such as .exe files, from an encrypted compressed migration store, type: - -``` syntax -usmtutils /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedStore /decrypt:AES_128 /key:password /l:C:\usmtutilslog.txt -``` - -### To extract file types using the include pattern and the exclude pattern - -To extract files from a compressed migration store, and to exclude files of one type (such as .exe files) while including only specific files, use both the include pattern and the exclude pattern, as in this example: - -``` syntax -usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o -``` - -In this example, if there is a myProject.exe file, it will also be extracted because the include pattern option takes precedence over the exclude pattern option. - -## Related topics - - -[UsmtUtils Syntax](usmt-utilities.md) - -[Return Codes](usmt-return-codes.md) - -[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md) - -  - -  - - - - - +--- +title: Extract Files from a Compressed USMT Migration Store (Windows 10) +description: Extract Files from a Compressed USMT Migration Store +ms.assetid: ad9fbd6e-f89e-4444-8538-9b11566b1f33 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Extract Files from a Compressed USMT Migration Store + + +When you migrate files and settings during a typical PC-refresh migration, you usually create a compressed migration store file on the intermediate store. This migration store is a single image file that contains all files being migrated as well as a catalog file. To protect the compressed file, you can encrypt it by using different encryption algorithms. When you migrate the file back to the source computer after the operating system is installed, you can run the **Usmtutils** command with the **/extract** option to recover the files from the compressed migration store. You can also use the **Usmtutils** command with the **/extract** option any time you need to recover data from a migration store. + +Options used with the **/extract** option can specify: + +- The cryptographic algorithm that was used to create the migration store. + +- The encryption key or the text file that contains the encryption key. + +- Include and exclude patterns for selective data extraction. + +In addition, you can specify the file patterns that you want to extract by using the **/i** option to include file patterns or the **/e** option to exclude file patterns. When both the **/i** option and the **/e** option are used in the same command, include patterns take precedence over exclude patterns. Note that this is different from the include and exclude rules used in the ScanState and LoadState tools. + +## In this topic + + +- [To run the USMTutils tool with the /extract option](#bkmk-extractsyntax) + +- [To extract all files from a compressed migration store](#bkmk-extractallfiles) + +- [To extract specific file types from an encrypted compressed migration store](#bkmk-extractspecificfiles) + +- [To extract all but one, or more, file types from an encrypted compressed migration store](#bkmk-excludefilepattern) + +- [To extract file types using the include pattern and the exclude pattern](#bkmk-includeexcludefiles) + +### To run the USMTutils tool with the /extract option + +To extract files from the compressed migration store onto the destination computer, use the following USMTutils syntax: + +Cd /d <USMTpath> usmtutils /extract <filePath> <destinationPath> \[/i:<includePattern>\] \[/e:<excludePattern>\] \[/l:<logfile>\] \[/decrypt\[:<AlgID>\] {/key:<keystring> | /keyfile:<filename>}\] \[/o\] + +Where the placeholders have the following values: + +- *<USMTpath>* is the location where you have saved the USMT files and tools. + +- *<filePath>* is the location of the migration store. + +- *<destination path>* is the location of the file where you want the **/extract** option to put the extracted migration store contents. + +- *<includePattern>* specifies the pattern for the files to include in the extraction. + +- *<excludePattern>* specifies the pattern for the files to omit from the extraction. + +- *<AlgID>* is the cryptographic algorithm that was used to create the migration store on the **ScanState** command line. + +- *<logfile>* is the location and name of the log file. + +- *<keystring>* is the encryption key that was used to encrypt the migration store. + +- *<filename>* is the location and name of the text file that contains the encryption key. + +### To extract all files from a compressed migration store + +To extract everything from a compressed migration store to a file on the C:\\ drive, type: + +``` syntax +usmtutils /extract D:\MyMigrationStore\USMT\store.mig C:\ExtractedStore +``` + +### To extract specific file types from an encrypted compressed migration store + +To extract specific files, such as .txt and .pdf files, from an encrypted compressed migration store, type: + +``` syntax +usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:"*.txt,*.pdf" C:\ExtractedStore /decrypt /keyfile:D:\encryptionKey.txt +``` + +In this example, the file is encrypted and the encryption key is located in a text file called encryptionKey. + +### To extract all but one, or more, file types from an encrypted compressed migration store + +To extract all files except for one file type, such as .exe files, from an encrypted compressed migration store, type: + +``` syntax +usmtutils /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedStore /decrypt:AES_128 /key:password /l:C:\usmtutilslog.txt +``` + +### To extract file types using the include pattern and the exclude pattern + +To extract files from a compressed migration store, and to exclude files of one type (such as .exe files) while including only specific files, use both the include pattern and the exclude pattern, as in this example: + +``` syntax +usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o +``` + +In this example, if there is a myProject.exe file, it will also be extracted because the include pattern option takes precedence over the exclude pattern option. + +## Related topics + + +[UsmtUtils Syntax](usmt-utilities.md) + +[Return Codes](usmt-return-codes.md) + +[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-faq.md b/windows/deployment/usmt/usmt-faq.md index 70d6e1b2f5..49092e9f6f 100644 --- a/windows/deployment/usmt/usmt-faq.md +++ b/windows/deployment/usmt/usmt-faq.md @@ -1,134 +1,137 @@ ---- -title: Frequently Asked Questions (Windows 10) -description: Frequently Asked Questions -ms.assetid: 813c13a7-6818-4e6e-9284-7ee49493241b -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Frequently Asked Questions - - -The following sections provide frequently asked questions and recommended solutions for migrations using User State Migration Tool (USMT) 10.0. - -## General - - -### How much space is needed on the destination computer? - -The destination computer needs enough available space for the following: - -- Operating system - -- Applications - -- Uncompressed store - -### Can I store the files and settings directly on the destination computer or do I need a server? - -You do not need to save the files to a server. If you are moving the user state to a new computer, you can create the store on a shared folder, on media that you can remove, such as a USB flash drive (UFD), or you can store it directly on the destination computer, as in the following steps: - -1. Create and share the directory C:\\store on the destination computer. - -2. Run the ScanState tool on the source computer and save the files and settings to \\\\*DestinationComputerName*\\store - -3. Run the LoadState tool on the destination computer and specify C:\\store as the store location. - -### Can I migrate data between operating systems with different languages? - -No. USMT does not support migrating data between operating systems with different languages; the source computer's operating-system language must match the destination computer's operating-system language. - -### Can I change the location of the temporary directory on the destination computer? - -Yes. The environment variable USMT\_WORKING\_DIR can be changed to an alternative temporary directory. There are some offline migration scenarios where this is necessary, for example, when the USMT binaries are located on read-only Windows Preinstallation Environment (WinPE) boot media. - -### How do I install USMT? - -Because USMT is included in Windows Assessment and Deployment Kit (Windows ADK), you need to install the Windows ADK package on at least one computer in your environment. However, the USMT binaries are designed to be deployed using xcopy. This means that they are installed on a computer simply by recursively copying the USMT directory from the computer containing the Windows ADK to each client computer. - -### How do I uninstall USMT? - -If you have installed the Windows ADK on the computer, uninstalling Windows ADK will uninstall USMT. For client computers that do not have the Windows ADK installed, you can simply delete the USMT directory to uninstall USMT. - -## Files and Settings - - -### How can I exclude a folder or a certain type of file from the migration? - -You can use the **<unconditionalExclude>** element to globally exclude data from the migration. For example, you can use this element to exclude all MP3 files on the computer or to exclude all files from C:\\UserData. This element excludes objects regardless of any other <include> rules that are in the .xml files. For an example, see <unconditionalExclude> in the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. For the syntax of this element, see [XML Elements Library](usmt-xml-elements-library.md). - -### What happens to files that were located on a drive that does not exist on the destination computer? - -USMT migrates the files to the %SystemDrive% while maintaining the correct folder hierarchy. For example, if E:\\data\\File.pst is on the source computer, but the destination computer does not have an E:\\ drive, the file will be migrated to C:\\data\\File.pst, if C:\\ is the system drive. This holds true even when <locationModify> rules attempt to move data to a drive that does not exist on the destination computer. - -## USMT .xml Files - - -### Where can I get examples of USMT .xml files? - -The following topics include examples of USMT .xml files: - -- [Exclude Files and Settings](usmt-exclude-files-and-settings.md) - -- [Reroute Files and Settings](usmt-reroute-files-and-settings.md) - -- [Include Files and Settings](usmt-include-files-and-settings.md) - -- [Custom XML Examples](usmt-custom-xml-examples.md) - -### Can I use custom .xml files that were written for USMT 5.0? - -Yes. You can use custom .xml files that were written for USMT 5.0 with USMT for Windows 10. However, in order to use new USMT functionality, you must revisit your custom USMT files and refresh them to include the new command-line options and XML elements. - -### How can I validate the .xml files? - -You can use the USMT XML Schema (MigXML.xsd) to write and validate migration .xml files. - -### Why must I list the .xml files with both the ScanState and LoadState commands? - -The .xml files are not copied to the store as in previous versions of USMT. Because the ScanState and LoadState tools need the .xml files to control the migration, you must specify the same set of .xml files for the **ScanState** and **LoadState** commands. If you used a particular set of mig\*.xml files in the ScanState tool, either called through the "/auto" option, or individually through the "/i" option, then you should use same option to call the exact same mig\*.xml files in the LoadState tool. However, you do not have to specify the Config.xml file, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store, but not to the destination computer. To do this, modify the Config.xml file and specify the updated file with the **LoadState** command. **LoadState** will migrate only the files and settings that you want to migrate. - -If you exclude an .xml file from the **LoadState** command, then all of the data that is in the store that was migrated with the missing .xml files will be migrated. However, the migration rules that were specified for the **ScanState** command will not apply. For example, if you exclude a MigApp.xml file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files. Instead, it will migrate them to C:\\data. - -### Which files can I modify and specify on the command line? - -You can specify the MigUser.xml and MigApp.xml files on the command line. You can modify each of these files. The migration of operating system settings is controlled by the manifests, which you cannot modify. If you want to exclude certain operating-system settings or any other components, create and modify the Config.xml file. - -### What happens if I do not specify the .xml files on the command line? - -- **ScanState** - - If you do not specify any files with the **ScanState** command, all user accounts and default operating system components are migrated. - -- **LoadState** - - If you do not specify any files with the **LoadState** command, all data that is in the store is migrated. However, any target-specific migration rules that were specified in .xml files with the **ScanState** command will not apply. For example, if you exclude a MigApp.xml file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files. Instead, it will migrate them to C:\\data. - -## Conflicts and Precedence - - -### What happens when there are conflicting XML rules or conflicting objects on the destination computer? - -For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - -## Related topics - - -[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - -[Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md) - -[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md) - -  - -  - - - - - +--- +title: Frequently Asked Questions (Windows 10) +description: Frequently Asked Questions +ms.assetid: 813c13a7-6818-4e6e-9284-7ee49493241b +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Frequently Asked Questions + + +The following sections provide frequently asked questions and recommended solutions for migrations using User State Migration Tool (USMT) 10.0. + +## General + + +### How much space is needed on the destination computer? + +The destination computer needs enough available space for the following: + +- Operating system + +- Applications + +- Uncompressed store + +### Can I store the files and settings directly on the destination computer or do I need a server? + +You do not need to save the files to a server. If you are moving the user state to a new computer, you can create the store on a shared folder, on media that you can remove, such as a USB flash drive (UFD), or you can store it directly on the destination computer, as in the following steps: + +1. Create and share the directory C:\\store on the destination computer. + +2. Run the ScanState tool on the source computer and save the files and settings to \\\\*DestinationComputerName*\\store + +3. Run the LoadState tool on the destination computer and specify C:\\store as the store location. + +### Can I migrate data between operating systems with different languages? + +No. USMT does not support migrating data between operating systems with different languages; the source computer's operating-system language must match the destination computer's operating-system language. + +### Can I change the location of the temporary directory on the destination computer? + +Yes. The environment variable USMT\_WORKING\_DIR can be changed to an alternative temporary directory. There are some offline migration scenarios where this is necessary, for example, when the USMT binaries are located on read-only Windows Preinstallation Environment (WinPE) boot media. + +### How do I install USMT? + +Because USMT is included in Windows Assessment and Deployment Kit (Windows ADK), you need to install the Windows ADK package on at least one computer in your environment. However, the USMT binaries are designed to be deployed using xcopy. This means that they are installed on a computer simply by recursively copying the USMT directory from the computer containing the Windows ADK to each client computer. + +### How do I uninstall USMT? + +If you have installed the Windows ADK on the computer, uninstalling Windows ADK will uninstall USMT. For client computers that do not have the Windows ADK installed, you can simply delete the USMT directory to uninstall USMT. + +## Files and Settings + + +### How can I exclude a folder or a certain type of file from the migration? + +You can use the **<unconditionalExclude>** element to globally exclude data from the migration. For example, you can use this element to exclude all MP3 files on the computer or to exclude all files from C:\\UserData. This element excludes objects regardless of any other <include> rules that are in the .xml files. For an example, see <unconditionalExclude> in the [Exclude Files and Settings](usmt-exclude-files-and-settings.md) topic. For the syntax of this element, see [XML Elements Library](usmt-xml-elements-library.md). + +### What happens to files that were located on a drive that does not exist on the destination computer? + +USMT migrates the files to the %SystemDrive% while maintaining the correct folder hierarchy. For example, if E:\\data\\File.pst is on the source computer, but the destination computer does not have an E:\\ drive, the file will be migrated to C:\\data\\File.pst, if C:\\ is the system drive. This holds true even when <locationModify> rules attempt to move data to a drive that does not exist on the destination computer. + +## USMT .xml Files + + +### Where can I get examples of USMT .xml files? + +The following topics include examples of USMT .xml files: + +- [Exclude Files and Settings](usmt-exclude-files-and-settings.md) + +- [Reroute Files and Settings](usmt-reroute-files-and-settings.md) + +- [Include Files and Settings](usmt-include-files-and-settings.md) + +- [Custom XML Examples](usmt-custom-xml-examples.md) + +### Can I use custom .xml files that were written for USMT 5.0? + +Yes. You can use custom .xml files that were written for USMT 5.0 with USMT for Windows 10. However, in order to use new USMT functionality, you must revisit your custom USMT files and refresh them to include the new command-line options and XML elements. + +### How can I validate the .xml files? + +You can use the USMT XML Schema (MigXML.xsd) to write and validate migration .xml files. + +### Why must I list the .xml files with both the ScanState and LoadState commands? + +The .xml files are not copied to the store as in previous versions of USMT. Because the ScanState and LoadState tools need the .xml files to control the migration, you must specify the same set of .xml files for the **ScanState** and **LoadState** commands. If you used a particular set of mig\*.xml files in the ScanState tool, either called through the "/auto" option, or individually through the "/i" option, then you should use same option to call the exact same mig\*.xml files in the LoadState tool. However, you do not have to specify the Config.xml file, unless you want to exclude some of the files and settings that you migrated to the store. For example, you might want to migrate the My Documents folder to the store, but not to the destination computer. To do this, modify the Config.xml file and specify the updated file with the **LoadState** command. **LoadState** will migrate only the files and settings that you want to migrate. + +If you exclude an .xml file from the **LoadState** command, then all of the data that is in the store that was migrated with the missing .xml files will be migrated. However, the migration rules that were specified for the **ScanState** command will not apply. For example, if you exclude a MigApp.xml file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files. Instead, it will migrate them to C:\\data. + +### Which files can I modify and specify on the command line? + +You can specify the MigUser.xml and MigApp.xml files on the command line. You can modify each of these files. The migration of operating system settings is controlled by the manifests, which you cannot modify. If you want to exclude certain operating-system settings or any other components, create and modify the Config.xml file. + +### What happens if I do not specify the .xml files on the command line? + +- **ScanState** + + If you do not specify any files with the **ScanState** command, all user accounts and default operating system components are migrated. + +- **LoadState** + + If you do not specify any files with the **LoadState** command, all data that is in the store is migrated. However, any target-specific migration rules that were specified in .xml files with the **ScanState** command will not apply. For example, if you exclude a MigApp.xml file that has a rerouting rule such as `MigsysHelperFunction.RelativeMove("c:\data", "%CSIDL_PERSONAL%")`, USMT will not reroute the files. Instead, it will migrate them to C:\\data. + +## Conflicts and Precedence + + +### What happens when there are conflicting XML rules or conflicting objects on the destination computer? + +For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + +## Related topics + + +[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) + +[Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md) + +[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-general-conventions.md b/windows/deployment/usmt/usmt-general-conventions.md index ea9b591221..3439d25d7a 100644 --- a/windows/deployment/usmt/usmt-general-conventions.md +++ b/windows/deployment/usmt/usmt-general-conventions.md @@ -1,103 +1,106 @@ ---- -title: General Conventions (Windows 10) -description: General Conventions -ms.assetid: 5761986e-a847-41bd-bf8e-7c1bd01acbc6 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# General Conventions - - -This topic describes the XML helper functions. - -## In This Topic - - -[General XML Guidelines](#bkmk-general) - -[Helper Functions](#bkmk-helperfunctions) - -## General XML Guidelines - - -Before you modify the .xml files, become familiar with the following guidelines: - -- **XML schema** - - You can use the User State Migration Tool (USMT) 10.0 XML schema, MigXML.xsd, to write and validate migration .xml files. - -- **Conflits** - - In general, when there are conflicts within the XML schema, the most specific pattern takes precedence. For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - -- **Required elements** - - The required elements for a migration .xml file are **<migration>**, **<component>**, **<role>**, and **<rules>**. - -- **Required child elements** - - - USMT does not fail with an error if you do not specify the required child elements. However, you must specify the required child elements for the parent element to affect the migration. - - - The required child elements apply only to the first definition of the element. If these elements are defined and then referred to using their name, the required child elements do not apply. For example, if you define `` in **<namedElements>**, and you specify `` in **<component>** to refer to this element, the definition inside **<namedElements>** must have the required child elements, but the **<component>** element does not need to have the required child elements. - -- **File names with brackets** - - If you are migrating a file that has a bracket character (\[ or \]) in the file name, you must insert a carat (^) character directly before the bracket for the bracket character to be valid. For example, if there is a file named File.txt, you must specify `c:\documents\mydocs [file^].txt] `instead of `c:\documents\mydocs [file].txt]`. - -- **Using quotation marks** - - When you surround code in quotation marks, you can use either double ("") or single (') quotation marks. - -## Helper Functions - - -You can use the XML helper functions in the [XML Elements Library](usmt-xml-elements-library.md) to change migration behavior. Before you use these functions in an .xml file, note the following: - -- **All of the parameters are strings** - -- **You can leave NULL parameters blank** - - As with parameters with a default value convention, if you have a NULL parameter at the end of a list, you can leave it out. For example, the following function: - - ``` syntax - SomeFunction("My String argument",NULL,NULL) - ``` - - is equivalent to: - - ``` syntax - SomeFunction("My String argument") - ``` - -- **The encoded location used in all the helper functions is an unambiguous string representation for the name of an object** - - It is composed of the node part, optionally followed by the leaf enclosed in square brackets. This makes a clear distinction between nodes and leaves. - - For example, specify the file C:\\Windows\\Notepad.exe: **c:\\Windows\[Notepad.exe\]**. Similarly, specify the directory C:\\Windows\\System32 like this: **c:\\Windows\\System32**; note the absence of the \[\] characters. - - The registry is represented in a similar way. The default value of a registry key is represented as an empty \[\] construct. For example, the default value for the HKLM\\SOFTWARE\\MyKey registry key is **HKLM\\SOFTWARE\\MyKey\[\]**. - -- **You specify a location pattern in a way that is similar to how you specify an actual location** - - The exception is that both the node and leaf part accept patterns. However, a pattern from the node does not extend to the leaf. - - For example, the pattern **c:\\Windows\\\*** will match the \\Windows directory and all subdirectories, but it will not match any of the files in those directories. To match the files as well, you must specify **c:\\Windows\\\*\[\*\]**. - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - -  - -  - - - - - +--- +title: General Conventions (Windows 10) +description: General Conventions +ms.assetid: 5761986e-a847-41bd-bf8e-7c1bd01acbc6 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# General Conventions + + +This topic describes the XML helper functions. + +## In This Topic + + +[General XML Guidelines](#bkmk-general) + +[Helper Functions](#bkmk-helperfunctions) + +## General XML Guidelines + + +Before you modify the .xml files, become familiar with the following guidelines: + +- **XML schema** + + You can use the User State Migration Tool (USMT) 10.0 XML schema, MigXML.xsd, to write and validate migration .xml files. + +- **Conflits** + + In general, when there are conflicts within the XML schema, the most specific pattern takes precedence. For more information, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + +- **Required elements** + + The required elements for a migration .xml file are **<migration>**, **<component>**, **<role>**, and **<rules>**. + +- **Required child elements** + + - USMT does not fail with an error if you do not specify the required child elements. However, you must specify the required child elements for the parent element to affect the migration. + + - The required child elements apply only to the first definition of the element. If these elements are defined and then referred to using their name, the required child elements do not apply. For example, if you define `` in **<namedElements>**, and you specify `` in **<component>** to refer to this element, the definition inside **<namedElements>** must have the required child elements, but the **<component>** element does not need to have the required child elements. + +- **File names with brackets** + + If you are migrating a file that has a bracket character (\[ or \]) in the file name, you must insert a carat (^) character directly before the bracket for the bracket character to be valid. For example, if there is a file named **file].txt**, you must specify `c:\documents\mydocs [file^].txt]` instead of `c:\documents\mydocs [file].txt]`. + +- **Using quotation marks** + + When you surround code in quotation marks, you can use either double ("") or single (') quotation marks. + +## Helper Functions + + +You can use the XML helper functions in the [XML Elements Library](usmt-xml-elements-library.md) to change migration behavior. Before you use these functions in an .xml file, note the following: + +- **All of the parameters are strings** + +- **You can leave NULL parameters blank** + + As with parameters with a default value convention, if you have a NULL parameter at the end of a list, you can leave it out. For example, the following function: + + ``` syntax + SomeFunction("My String argument",NULL,NULL) + ``` + + is equivalent to: + + ``` syntax + SomeFunction("My String argument") + ``` + +- **The encoded location used in all the helper functions is an unambiguous string representation for the name of an object** + + It is composed of the node part, optionally followed by the leaf enclosed in square brackets. This makes a clear distinction between nodes and leaves. + + For example, specify the file C:\\Windows\\Notepad.exe: **c:\\Windows\[Notepad.exe\]**. Similarly, specify the directory C:\\Windows\\System32 like this: **c:\\Windows\\System32**; note the absence of the \[\] characters. + + The registry is represented in a similar way. The default value of a registry key is represented as an empty \[\] construct. For example, the default value for the HKLM\\SOFTWARE\\MyKey registry key is **HKLM\\SOFTWARE\\MyKey\[\]**. + +- **You specify a location pattern in a way that is similar to how you specify an actual location** + + The exception is that both the node and leaf part accept patterns. However, a pattern from the node does not extend to the leaf. + + For example, the pattern **c:\\Windows\\\\*** will match the \\Windows directory and all subdirectories, but it will not match any of the files in those directories. To match the files as well, you must specify **c:\\Windows\\\*\[\*\]**. + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-hard-link-migration-store.md b/windows/deployment/usmt/usmt-hard-link-migration-store.md index 2de6572380..e9bb2376d5 100644 --- a/windows/deployment/usmt/usmt-hard-link-migration-store.md +++ b/windows/deployment/usmt/usmt-hard-link-migration-store.md @@ -2,9 +2,13 @@ title: Hard-Link Migration Store (Windows 10) description: Hard-Link Migration Store ms.assetid: b0598418-4607-4952-bfa3-b6e4aaa2c574 +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -67,7 +71,7 @@ When you create a hard link, you give an existing file an additional path. For i **Note**   A hard link can only be created for a file on the same volume. If you copy a hard-link migration store to another drive or external device, the files, and not the links, are copied, as in a non-compressed migration-store scenario. -  + For more information about hard links, please see [Hard Links and Junctions](https://go.microsoft.com/fwlink/p/?LinkId=132934) @@ -78,7 +82,7 @@ As a best practice, we recommend that you delete the hard-link migration store a **Important**   Using the **/c** option will force the Loadstate tool to continue applying files when non-fatal errors occur. If you use the **/c** option, you should verify that no errors are reported in the logs before deleting the hard-link migration store in order to avoid data loss. -  + Keeping the hard-link migration store can result in additional disk space being consumed or problems with some applications for the following reasons: @@ -91,7 +95,7 @@ Keeping the hard-link migration store can result in additional disk space being **Important**   The read-only file attribute on migrated files is lost when the hard-link migration store is deleted. This is due to a limitation in NTFS file system hard links. -  + ## Hard-Link Migration Scenario @@ -103,12 +107,15 @@ For example, a company has decided to deploy Windows 10 on all of their compute **Note**   As a best practice, we recommend that you do not create your hard-link migration store until just before you perform the migration in order to migrate the latest versions of your files. You should not use your software applications on the computer after creating the migration store until you have finished migrating your files with Loadstate. -   + 2. On each computer, an administrator installs the company's standard operating environment (SOE), which includes Windows 7 and other applications the company currently uses. 3. An administrator runs the LoadState command-line tool on each computer. The LoadState tool restores user state back on each computer. +> [!NOTE] +> During the update of a domain-joined computer, the profiles of users whose SID cannot be resolved will not be migrated. When using a hard-link migration store, it could cause a data loss. + ## Hard-Link Migration Store Details @@ -159,7 +166,7 @@ Files that are locked by an application are treated the same in hard-link migrat **Important**   There are some scenarios in which modifying the **<HardLinkStoreControl>** section in the Config.xml file makes it more difficult to delete a hard-link migration store. In these scenarios, you must use USMTutils.exe to schedule the migration store for deletion on the next restart. -  + ## XML Elements in the Config.xml File @@ -197,16 +204,16 @@ A new section in the Config.xml file allows optional configuration of some of th -  + **Important**   You must use the **/nocompress** option with the **/HardLink** option. -  + The following XML sample specifies that files locked by an application under the \\Users directory can remain in place during the migration. It also specifies that locked files that are not located in the \\Users directory should result in the **File in Use** error. It is important to exercise caution when specifying the paths using the **File in Use<createhardlink>** tag in order to minimize scenarios that make the hard-link migration store more difficult to delete. -``` syntax +``` xml @@ -222,10 +229,9 @@ The following XML sample specifies that files locked by an application under the [Plan Your Migration](usmt-plan-your-migration.md) -  - -  + + diff --git a/windows/deployment/usmt/usmt-how-it-works.md b/windows/deployment/usmt/usmt-how-it-works.md index 956abe0554..5c8bbb6d9b 100644 --- a/windows/deployment/usmt/usmt-how-it-works.md +++ b/windows/deployment/usmt/usmt-how-it-works.md @@ -1,147 +1,150 @@ ---- -title: How USMT Works (Windows 10) -description: How USMT Works -ms.assetid: 5c8bd669-9e1e-473d-81e6-652f40b24171 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# How USMT Works - - -USMT includes two tools that migrate settings and data: ScanState and LoadState. ScanState collects information from the source computer, and LoadState applies that information to the destination computer. - -- [ScanState Process](#bkmk-ssprocess) - -- [LoadState Process](#bkmk-lsprocess) - - **Note**   - For more information about how USMT processes the rules and the XML files, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - -   - -## The ScanState Process - - -When you run the ScanState tool on the source computer, it goes through the following process: - -1. It parses and validates the command-line parameters, creates the ScanState.log file, and then begins logging. - -2. It collects information about all of the migration components that need to be migrated. A *migration component* is a logical group of files, registry keys, and values. For example, the set of files, registry keys, and values that store the settings of Adobe Acrobat is grouped into a single migration component. - - There are three types of components: - - - Components that migrate the operating system settings - - - Components that migrate application settings - - - Components that migrate users’ files - - The ScanState tool collects information about the application settings and user data components from the .xml files that are specified on the command line. - - In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You cannot modify these files. If you want to exclude certain operating-system settings, you must create and modify a Config.xml file. - -3. ScanState determines which user profiles should be migrated. By default, all user profiles on the source computer are migrated. However, you can include and exclude users using the User Options. The public profile in a source computer running Windows 7, Windows 8, and Windows 10 is always migrated, and you cannot exclude these profiles from the migration. - -4. In the "Scanning" phase, ScanState does the following for each user profile selected for migration: - - 1. For each component, ScanState checks the type of the component. If the current user profile is the system profile and the component type is “System” or “UserAndSystem”, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile is not the system profile and the component type is “User” or “UserAndSystem”, the component is selected for this user. Otherwise, this component is ignored. - - **Note**   - From this point on, ScanState does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users’ files. ScanState processes all components in the same way. - -   - - 2. Each component that is selected in the previous step is processed further. Any profile-specific variables (such as CSIDL\_PERSONAL) are evaluated in the context of the current profile. For example, if the profile that is being processed belongs to “User1”, then CSIDL\_PERSONAL would expand to C:\\Users\\User1\\Documents, assuming that the user profiles are stored in the C:\\Users directory. - - 3. For each selected component, ScanState evaluates the <detects> section. If the condition in the <detects> section evaluates to false, the component is not processed any further. Otherwise, the processing of this component continues. - - 4. For each selected component, ScanState evaluates the <rules> sections. For each <rules> section, if the current user profile is the system profile and the context of the <rules> section is “System” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile is not the system profile and the context of the <rules> section is “User” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. - - 5. ScanState creates a list of migration units that need to be migrated by processing the various subsections under this <rules> section. Each unit is collected if it is mentioned in an <include> subsection, as long as there is not a more specific rule for it in an <exclude> subsection in the same <rules> section. For more information about precedence in the .xml files, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - - In addition, any migration unit (such as a file, registry key, or set of registry values) that is in an <UnconditionalExclude> section is not migrated. - - **Note**   - ScanState ignores some subsections such as <destinationCleanup> and <locationModify>. These sections are evaluated only on the destination computer. - -   - -5. In the "Collecting" phase, ScanState creates a master list of the migration units by combining the lists that were created for each selected user profile. - -6. In the "Saving" phase, ScanState writes the migration units that were collected to the store location. - - **Note**   - ScanState does not modify the source computer in any way. - -   - -## The LoadState Process - - -The LoadState process is very similar to the ScanState process. The ScanState tool collects migration units such as file, registry key, or registry values from the source computer and saves them to the store. Similarly, the LoadState tool collects migration units from the store and applies them to the destination computer. - -1. ScanState parses and validates the command-line parameters, creates the ScanState.log file, and then begins logging. - -2. LoadState collects information about the migration components that need to be migrated. - - LoadState obtains information for the application-settings components and user-data components from the migration .xml files that are specified by the LoadState command. - - In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You cannot modify these files. If you want to exclude certain operating-system settings, you must create and modify a Config.xml file. - -3. LoadState determines which user profiles should be migrated. By default, all user profiles present on the source computer are migrated. However, you can include and exclude users using the User Options. The system profile, the "All users" profile in a source computer running Windows XP, or the Public profile in a source computer running Windows Vista, Windows 7, and Windows 8, is always migrated and you cannot exclude these profiles from the migration. - - - If you are migrating local user accounts and if the accounts do not already exist on the destination computer, you must use the**/lac** command-line option. If you do not specify the **/lac** option, any local user accounts that are not already present on the destination computer, are not migrated. - - - The **/md** and **/mu** options are processed to rename the user profile on the destination computer, if they have been included when the LoadState command was specified. - - - For each user profile selected from the store, LoadState creates a corresponding user profile on the destination computer. The destination computer does not need to be connected to the domain for domain user profiles to be created. If USMT cannot determine a domain, it attempts to apply the settings to a local account. For more information, see [Identify Users](usmt-identify-users.md). - -4. In the "Scanning" phase, LoadState does the following for each user profile: - - 1. For each component, LoadState checks the type of the component. If the current user profile is the system profile and the component type is “System” or “UserAndSystem”, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile is not the system profile and the component type is “User” or “UserAndSystem”, the component is selected for this user. Otherwise, this component is ignored. - - **Note**   - From this point on, LoadState does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users’ files. LoadState evaluates all components in the same way. - -   - - 2. Each component that is selected is processed further. Any profile-specific variables (such as CSIDL\_PERSONAL) are evaluated in the context of the current profile. For example, if the profile being processed belongs to “User1”, then CSIDL\_PERSONAL would expand to C:\\Users\\User1\\Documents (assuming that the user profiles are stored in the C:\\Users directory). - - **Note**   - LoadState ignores the <detects> section specified in a component. At this point, all specified components are considered to be detected and are selected for migration. - -   - - 3. For each selected component, LoadState evaluates the <rules> sections. For each <rules> section, if the current user profile is the system profile and the context of the <rules> section is “System” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile is not the system profile and the context of the <rules> section is “User” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. - - 4. LoadState creates a master list of migration units by processing the various subsections under the <rules> section. Each migration unit that is in an <include> subsection is migrated as long, as there is not a more specific rule for it in an <exclude> subsection in the same <rules> section. For more information about precedence, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - - 5. LoadState evaluates the destination computer-specific subsections; for example, the <destinationCleanup> and <locationModify> subsections. - - 6. If the destination computer is running Windows 7 or Windows 8 then the migunits that were collected by ScanState using downlevel manifest files are processed by LoadState using the corresponding Component Manifest for Windows 7. The downlevel manifest files are not used during LoadState. - - **Important**   - It is important to specify the .xml files with the LoadState command if you want LoadState to use them. Otherwise, any destination-specific rules, such as <locationModify>, in these .xml files are ignored, even if the same .xml files were provided when the ScanState command ran. - -   - -5. In the "Apply" phase, LoadState writes the migration units that were collected to the various locations on the destination computer. If there are conflicts and there is not a <merge> rule for the object, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally, for example, OriginalFileName(1).OriginalExtension. Some settings, such as fonts, wallpaper, and screen-saver settings, do not take effect until the next time the user logs on. For this reason, you should log off when the LoadState command actions have completed. - -## Related topics - - -[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) - -  - -  - - - - - +--- +title: How USMT Works (Windows 10) +description: How USMT Works +ms.assetid: 5c8bd669-9e1e-473d-81e6-652f40b24171 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# How USMT Works + + +USMT includes two tools that migrate settings and data: ScanState and LoadState. ScanState collects information from the source computer, and LoadState applies that information to the destination computer. + +- [ScanState Process](#bkmk-ssprocess) + +- [LoadState Process](#bkmk-lsprocess) + + **Note**   + For more information about how USMT processes the rules and the XML files, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + + + +## The ScanState Process + + +When you run the ScanState tool on the source computer, it goes through the following process: + +1. It parses and validates the command-line parameters, creates the ScanState.log file, and then begins logging. + +2. It collects information about all of the migration components that need to be migrated. A *migration component* is a logical group of files, registry keys, and values. For example, the set of files, registry keys, and values that store the settings of Adobe Acrobat is grouped into a single migration component. + + There are three types of components: + + - Components that migrate the operating system settings + + - Components that migrate application settings + + - Components that migrate users’ files + + The ScanState tool collects information about the application settings and user data components from the .xml files that are specified on the command line. + + In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You cannot modify these files. If you want to exclude certain operating-system settings, you must create and modify a Config.xml file. + +3. ScanState determines which user profiles should be migrated. By default, all user profiles on the source computer are migrated. However, you can include and exclude users using the User Options. The public profile in a source computer running Windows 7, Windows 8, and Windows 10 is always migrated, and you cannot exclude these profiles from the migration. + +4. In the "Scanning" phase, ScanState does the following for each user profile selected for migration: + + 1. For each component, ScanState checks the type of the component. If the current user profile is the system profile and the component type is “System” or “UserAndSystem”, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile is not the system profile and the component type is “User” or “UserAndSystem”, the component is selected for this user. Otherwise, this component is ignored. + + **Note**   + From this point on, ScanState does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users’ files. ScanState processes all components in the same way. + + + + 2. Each component that is selected in the previous step is processed further. Any profile-specific variables (such as CSIDL\_PERSONAL) are evaluated in the context of the current profile. For example, if the profile that is being processed belongs to “User1”, then CSIDL\_PERSONAL would expand to C:\\Users\\User1\\Documents, assuming that the user profiles are stored in the C:\\Users directory. + + 3. For each selected component, ScanState evaluates the <detects> section. If the condition in the <detects> section evaluates to false, the component is not processed any further. Otherwise, the processing of this component continues. + + 4. For each selected component, ScanState evaluates the <rules> sections. For each <rules> section, if the current user profile is the system profile and the context of the <rules> section is “System” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile is not the system profile and the context of the <rules> section is “User” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. + + 5. ScanState creates a list of migration units that need to be migrated by processing the various subsections under this <rules> section. Each unit is collected if it is mentioned in an <include> subsection, as long as there is not a more specific rule for it in an <exclude> subsection in the same <rules> section. For more information about precedence in the .xml files, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + + In addition, any migration unit (such as a file, registry key, or set of registry values) that is in an <UnconditionalExclude> section is not migrated. + + **Note**   + ScanState ignores some subsections such as <destinationCleanup> and <locationModify>. These sections are evaluated only on the destination computer. + + + +5. In the "Collecting" phase, ScanState creates a master list of the migration units by combining the lists that were created for each selected user profile. + +6. In the "Saving" phase, ScanState writes the migration units that were collected to the store location. + + **Note**   + ScanState does not modify the source computer in any way. + + + +## The LoadState Process + + +The LoadState process is very similar to the ScanState process. The ScanState tool collects migration units such as file, registry key, or registry values from the source computer and saves them to the store. Similarly, the LoadState tool collects migration units from the store and applies them to the destination computer. + +1. ScanState parses and validates the command-line parameters, creates the ScanState.log file, and then begins logging. + +2. LoadState collects information about the migration components that need to be migrated. + + LoadState obtains information for the application-settings components and user-data components from the migration .xml files that are specified by the LoadState command. + + In Windows 7, and Windows 8, the manifest files control how the operating-system settings are migrated. You cannot modify these files. If you want to exclude certain operating-system settings, you must create and modify a Config.xml file. + +3. LoadState determines which user profiles should be migrated. By default, all user profiles present on the source computer are migrated. However, you can include and exclude users using the User Options. The system profile, the "All users" profile in a source computer running Windows XP, or the Public profile in a source computer running Windows Vista, Windows 7, and Windows 8, is always migrated and you cannot exclude these profiles from the migration. + + - If you are migrating local user accounts and if the accounts do not already exist on the destination computer, you must use the/lac command-line option. If you do not specify the **/lac** option, any local user accounts that are not already present on the destination computer, are not migrated. + + - The **/md** and **/mu** options are processed to rename the user profile on the destination computer, if they have been included when the LoadState command was specified. + + - For each user profile selected from the store, LoadState creates a corresponding user profile on the destination computer. The destination computer does not need to be connected to the domain for domain user profiles to be created. If USMT cannot determine a domain, it attempts to apply the settings to a local account. For more information, see [Identify Users](usmt-identify-users.md). + +4. In the "Scanning" phase, LoadState does the following for each user profile: + + 1. For each component, LoadState checks the type of the component. If the current user profile is the system profile and the component type is “System” or “UserAndSystem”, the component is selected for this user. Otherwise, the component is ignored. Alternatively, if the current user profile is not the system profile and the component type is “User” or “UserAndSystem”, the component is selected for this user. Otherwise, this component is ignored. + + **Note** + From this point on, LoadState does not distinguish between components that migrate operating-system settings, those that migrate application settings, and those that migrate users’ files. LoadState evaluates all components in the same way. + + + + 2. Each component that is selected is processed further. Any profile-specific variables (such as CSIDL\_PERSONAL) are evaluated in the context of the current profile. For example, if the profile being processed belongs to “User1”, then CSIDL\_PERSONAL would expand to C:\\Users\\User1\\Documents (assuming that the user profiles are stored in the C:\\Users directory). + + **Note** + LoadState ignores the <detects> section specified in a component. At this point, all specified components are considered to be detected and are selected for migration. + + + + 3. For each selected component, LoadState evaluates the <rules> sections. For each <rules> section, if the current user profile is the system profile and the context of the <rules> section is “System” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. Alternatively, if the current user profile is not the system profile and the context of the <rules> section is “User” or “UserAndSystem”, the rule is processed further. Otherwise, this rule is ignored. + + 4. LoadState creates a master list of migration units by processing the various subsections under the <rules> section. Each migration unit that is in an <include> subsection is migrated as long, as there is not a more specific rule for it in an <exclude> subsection in the same <rules> section. For more information about precedence, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). + + 5. LoadState evaluates the destination computer-specific subsections; for example, the <destinationCleanup> and <locationModify> subsections. + + 6. If the destination computer is running Windows 7 or Windows 8 then the migunits that were collected by ScanState using downlevel manifest files are processed by LoadState using the corresponding Component Manifest for Windows 7. The downlevel manifest files are not used during LoadState. + + **Important** + It is important to specify the .xml files with the LoadState command if you want LoadState to use them. Otherwise, any destination-specific rules, such as <locationModify>, in these .xml files are ignored, even if the same .xml files were provided when the ScanState command ran. + + + +5. In the "Apply" phase, LoadState writes the migration units that were collected to the various locations on the destination computer. If there are conflicts and there is not a <merge> rule for the object, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally, for example, OriginalFileName(1).OriginalExtension. Some settings, such as fonts, wallpaper, and screen-saver settings, do not take effect until the next time the user logs on. For this reason, you should log off when the LoadState command actions have completed. + +## Related topics + + +[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-how-to.md b/windows/deployment/usmt/usmt-how-to.md index 57faa88dd9..9fdba24603 100644 --- a/windows/deployment/usmt/usmt-how-to.md +++ b/windows/deployment/usmt/usmt-how-to.md @@ -1,32 +1,35 @@ ---- -title: User State Migration Tool (USMT) How-to topics (Windows 10) -description: User State Migration Tool (USMT) How-to topics -ms.assetid: 7b9a2f2a-a43a-4984-9746-a767f9f1c7e3 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) How-to topics -The following table lists topics that describe how to use User State Migration Tool (USMT) 10.0 to perform specific tasks. - -## In This Section - -|Topic |Description| -|------|-----------| -|[Exclude Files and Settings](usmt-exclude-files-and-settings.md)|Create a custom .xml file to exclude files, file types, folders, or registry settings from your migration.| -|[Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md)|Recover files from a compressed migration store after installing the operating system.| -|[Include Files and Settings](usmt-include-files-and-settings.md)|Create a custom .xml file to include files, file types, folders, or registry settings in your migration.| -|[Migrate Application Settings](migrate-application-settings.md)|Migrate the settings of an application that the MigApp.xml file does not include by default.| -|[Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md)|Migrate Encrypting File System (EFS) certificates by using USMT.| -|[Migrate User Accounts](usmt-migrate-user-accounts.md)|Specify the users to include and exclude in your migration.| -|[Reroute Files and Settings](usmt-reroute-files-and-settings.md)|Create a custom .xml file to reroute files and settings during a migration.| -|[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md)|Determine whether a compressed migration store is intact, or whether it contains corrupt files or a corrupt catalog.| - -## Related topics -- [User State Migration Tool (USMT) Overview Topics](usmt-topics.md) -- [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) -- [User State Migration Toolkit (USMT) Reference](usmt-reference.md) \ No newline at end of file +--- +title: User State Migration Tool (USMT) How-to topics (Windows 10) +description: User State Migration Tool (USMT) How-to topics +ms.assetid: 7b9a2f2a-a43a-4984-9746-a767f9f1c7e3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) How-to topics +The following table lists topics that describe how to use User State Migration Tool (USMT) 10.0 to perform specific tasks. + +## In This Section + +|Topic |Description| +|------|-----------| +|[Exclude Files and Settings](usmt-exclude-files-and-settings.md)|Create a custom .xml file to exclude files, file types, folders, or registry settings from your migration.| +|[Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md)|Recover files from a compressed migration store after installing the operating system.| +|[Include Files and Settings](usmt-include-files-and-settings.md)|Create a custom .xml file to include files, file types, folders, or registry settings in your migration.| +|[Migrate Application Settings](migrate-application-settings.md)|Migrate the settings of an application that the MigApp.xml file does not include by default.| +|[Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md)|Migrate Encrypting File System (EFS) certificates by using USMT.| +|[Migrate User Accounts](usmt-migrate-user-accounts.md)|Specify the users to include and exclude in your migration.| +|[Reroute Files and Settings](usmt-reroute-files-and-settings.md)|Create a custom .xml file to reroute files and settings during a migration.| +|[Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md)|Determine whether a compressed migration store is intact, or whether it contains corrupt files or a corrupt catalog.| + +## Related topics +- [User State Migration Tool (USMT) Overview Topics](usmt-topics.md) +- [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) +- [User State Migration Toolkit (USMT) Reference](usmt-reference.md) diff --git a/windows/deployment/usmt/usmt-identify-application-settings.md b/windows/deployment/usmt/usmt-identify-application-settings.md index 134ae9d3a7..2a8a430f41 100644 --- a/windows/deployment/usmt/usmt-identify-application-settings.md +++ b/windows/deployment/usmt/usmt-identify-application-settings.md @@ -1,59 +1,62 @@ ---- -title: Identify Applications Settings (Windows 10) -description: Identify Applications Settings -ms.assetid: eda68031-9b02-4a5b-a893-3786a6505381 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Identify Applications Settings - - -When planning for your migration, you should identify which applications and settings you want to migrate. For more information about how to create a custom .xml file to migrate the settings of another application, see [Customize USMT XML Files](usmt-customize-xml-files.md). - -## Applications - - -First, create and prioritize a list of applications that to be migrated. It may be helpful to review the application lists and decide which applications will be redeployed and which applications will be retired. Often, the applications are prioritized based on a combination of how widely the application is used and how complex the application is. - -Next, identify an application owner to be in charge of each application. This is necessary because the developers will not be experts on all of the applications in the organization. The application owner should have the most experience with an application. The application owner provides insight into how the organization installs, configures, and uses the application. - -## Application Settings - - -Next, determine and locate the application settings to be migrated. You can acquire much of the information that you need for this step when you are testing the new applications for compatibility with the new operating system. - -After completing the list of applications to be migrated, review the list and work with each application owner on a list of settings to be migrated. For each setting, determine whether it needs to be migrated or if the default settings are adequate. Then, determine where the setting is located; for example, in the registry or in an .ini file. Next, consider the following questions to determine what needs to be done to migrate the setting successfully: - -- Is the destination version of the application newer than the source version? - -- Do these settings work with the new version? - -- Do the settings need to be moved or altered? - -- Can the first-run process force the application to appear as if it had run already? If so, does this work correctly, or does it break the application? - -After answering these questions, create a custom .xml file to migrate settings. Work with the application owner to develop test cases and to determine the file types that need to be migrated for the application. - -## Locating Where Settings Are Stored - - -See [Migrate Application Settings](migrate-application-settings.md) and follow the directions. - -## Related topics - - -[Determine What to Migrate](usmt-determine-what-to-migrate.md) - -  - -  - - - - - +--- +title: Identify Applications Settings (Windows 10) +description: Identify Applications Settings +ms.assetid: eda68031-9b02-4a5b-a893-3786a6505381 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Identify Applications Settings + + +When planning for your migration, you should identify which applications and settings you want to migrate. For more information about how to create a custom .xml file to migrate the settings of another application, see [Customize USMT XML Files](usmt-customize-xml-files.md). + +## Applications + + +First, create and prioritize a list of applications that to be migrated. It may be helpful to review the application lists and decide which applications will be redeployed and which applications will be retired. Often, the applications are prioritized based on a combination of how widely the application is used and how complex the application is. + +Next, identify an application owner to be in charge of each application. This is necessary because the developers will not be experts on all of the applications in the organization. The application owner should have the most experience with an application. The application owner provides insight into how the organization installs, configures, and uses the application. + +## Application Settings + + +Next, determine and locate the application settings to be migrated. You can acquire much of the information that you need for this step when you are testing the new applications for compatibility with the new operating system. + +After completing the list of applications to be migrated, review the list and work with each application owner on a list of settings to be migrated. For each setting, determine whether it needs to be migrated or if the default settings are adequate. Then, determine where the setting is located; for example, in the registry or in an .ini file. Next, consider the following questions to determine what needs to be done to migrate the setting successfully: + +- Is the destination version of the application newer than the source version? + +- Do these settings work with the new version? + +- Do the settings need to be moved or altered? + +- Can the first-run process force the application to appear as if it had run already? If so, does this work correctly, or does it break the application? + +After answering these questions, create a custom .xml file to migrate settings. Work with the application owner to develop test cases and to determine the file types that need to be migrated for the application. + +## Locating Where Settings Are Stored + + +See [Migrate Application Settings](migrate-application-settings.md) and follow the directions. + +## Related topics + + +[Determine What to Migrate](usmt-determine-what-to-migrate.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md index 5070fe03e4..45cd2a17a7 100644 --- a/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md +++ b/windows/deployment/usmt/usmt-identify-file-types-files-and-folders.md @@ -1,48 +1,51 @@ ---- -title: Identify File Types, Files, and Folders (Windows 10) -description: Identify File Types, Files, and Folders -ms.assetid: 93bb2a33-c126-4f7a-a961-6c89686d54e0 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Identify File Types, Files, and Folders - - -When planning for your migration, if not using MigDocs.xml, you should identify the file types, files, folders, and settings that you want to migrate. First, you should determine the standard file locations on each computer, such as **My Documents.** , **C:\\Data** , and company-specified locations, such as **\\EngineeringDrafts**. Next, you should determine and locate the non-standard locations. For non-standard locations, consider the following: - -- **File types**. Consider which file types need to be included and excluded from the migration. You can create this list based on common applications used in your organization. Applications normally use specific file name extensions. For example, Microsoft Office Word primarily uses .doc, .docx and .dotx file name extension. However, it also uses other file types, such as templates (.dot files), on a less frequent basis. - -- **Excluded locations**. Consider the locations on the computer that should be excluded from the migration (for example, %WINDIR% and Program Files). - -- **New locations**. Decide where files should be migrated to on the destination computer for example, \\My Documents, a designated folder, or a folder matching the files' name and location on the source computer. For example, you might have shared data on source machine or you might wish to clean up documents outside the user profiles on the source system. Identify any data that needs to be redirected to a new location in the apply phase. This can be accomplished with location modify rules. - -Once you have verified which files and file types that the end users work with regularly, you will need to locate them. Files may be saved to a single folder or scattered across a drive. A good starting point for finding files types to include is to look at the registered file types on the computer. - -**To find the registered file types on a computer running Windows 7 or Windows 8** - -1. Click **Start**. Open **Control Panel**, click **Control Panel Home**, and click **Programs**. - -2. Click **Default Programs**, and click **Associate a file type or protocol with a program**. - -3. On this screen, the registered file types are displayed. - -For more information about how to change the file types, files, and folders that are migrated when you specify the MigUser.xml file, see [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). - -## Related topics - - -[Determine What to Migrate](usmt-determine-what-to-migrate.md) - -  - -  - - - - - +--- +title: Identify File Types, Files, and Folders (Windows 10) +description: Identify File Types, Files, and Folders +ms.assetid: 93bb2a33-c126-4f7a-a961-6c89686d54e0 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Identify File Types, Files, and Folders + + +When planning for your migration, if not using MigDocs.xml, you should identify the file types, files, folders, and settings that you want to migrate. First, you should determine the standard file locations on each computer, such as **My Documents.** , **C:\\Data** , and company-specified locations, such as **\\EngineeringDrafts**. Next, you should determine and locate the non-standard locations. For non-standard locations, consider the following: + +- **File types**. Consider which file types need to be included and excluded from the migration. You can create this list based on common applications used in your organization. Applications normally use specific file name extensions. For example, Microsoft Office Word primarily uses .doc, .docx and .dotx file name extension. However, it also uses other file types, such as templates (.dot files), on a less frequent basis. + +- **Excluded locations**. Consider the locations on the computer that should be excluded from the migration (for example, %WINDIR% and Program Files). + +- **New locations**. Decide where files should be migrated to on the destination computer for example, \\My Documents, a designated folder, or a folder matching the files' name and location on the source computer. For example, you might have shared data on source machine or you might wish to clean up documents outside the user profiles on the source system. Identify any data that needs to be redirected to a new location in the apply phase. This can be accomplished with location modify rules. + +Once you have verified which files and file types that the end users work with regularly, you will need to locate them. Files may be saved to a single folder or scattered across a drive. A good starting point for finding files types to include is to look at the registered file types on the computer. + +**To find the registered file types on a computer running Windows 7 or Windows 8** + +1. Click **Start**. Open **Control Panel**, click **Control Panel Home**, and click **Programs**. + +2. Click **Default Programs**, and click **Associate a file type or protocol with a program**. + +3. On this screen, the registered file types are displayed. + +For more information about how to change the file types, files, and folders that are migrated when you specify the MigUser.xml file, see [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). + +## Related topics + + +[Determine What to Migrate](usmt-determine-what-to-migrate.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-identify-operating-system-settings.md b/windows/deployment/usmt/usmt-identify-operating-system-settings.md index 28d95e4b3b..1cffd2aed8 100644 --- a/windows/deployment/usmt/usmt-identify-operating-system-settings.md +++ b/windows/deployment/usmt/usmt-identify-operating-system-settings.md @@ -1,57 +1,60 @@ ---- -title: Identify Operating System Settings (Windows 10) -description: Identify Operating System Settings -ms.assetid: 1704ab18-1765-41fb-a27c-3aa3128fa242 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Identify Operating System Settings - - -When planning for your migration, you should identify which operating system settings you want to migrate and to what extent you want to create a new standard environment on each of the computers. User State Migration Tool (USMT) 10.0 enables you to migrate select settings and keep the default values for all others. The operating system settings include the following: - -- **Apperance.** - - This includes items such as wallpaper, colors, sounds, and the location of the taskbar. - -- **Action.** - - This includes items such as the key-repeat rate, whether double-clicking a folder opens it in a new window or the same window, and whether you need to single-click or double-click an item to open it. - -- **Internet.** - - These are the settings that let you connect to the Internet and control how your browser operates. This includes items such as your home page URL, favorites, bookmarks, cookies, security settings, dial-up connections, and proxy settings. - -- **Mail.** - - This includes the information that you need to connect to your mail server, your signature file, views, mail rules, local mail, and contacts. - -To help you decide which settings to migrate, you should consider any previous migration experiences as well as the results of any surveys and tests that you have conducted. You should also consider the number of help-desk calls related to operating-system settings that you have had in the past, and are able to handle in the future. Also decide how much of the new operating-system functionality you want to take advantage of. - -You should migrate any settings that users need to get their jobs done, those that make the work environment comfortable, and those that will reduce help-desk calls after the migration. Although it is easy to dismiss migrating user preferences, you should consider that users can spend a significant amount of time restoring items such as wallpaper, screen savers, and other customizable user-interface features. Most users do not remember how these settings were applied. Although these items are not critical to migration success, migrating these items increases user productivity and overall satisfaction of the migration process. - -**Note**   -For more information about how to change the operating-system settings that are migrated, see [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). - -For information about the operating-system settings that USMT migrates, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) - -  - -## Related topics - - -[Determine What to Migrate](usmt-determine-what-to-migrate.md) - -  - -  - - - - - +--- +title: Identify Operating System Settings (Windows 10) +description: Identify Operating System Settings +ms.assetid: 1704ab18-1765-41fb-a27c-3aa3128fa242 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Identify Operating System Settings + + +When planning for your migration, you should identify which operating system settings you want to migrate and to what extent you want to create a new standard environment on each of the computers. User State Migration Tool (USMT) 10.0 enables you to migrate select settings and keep the default values for all others. The operating system settings include the following: + +- **Apperance.** + + This includes items such as wallpaper, colors, sounds, and the location of the taskbar. + +- **Action.** + + This includes items such as the key-repeat rate, whether double-clicking a folder opens it in a new window or the same window, and whether you need to single-click or double-click an item to open it. + +- **Internet.** + + These are the settings that let you connect to the Internet and control how your browser operates. This includes items such as your home page URL, favorites, bookmarks, cookies, security settings, dial-up connections, and proxy settings. + +- **Mail.** + + This includes the information that you need to connect to your mail server, your signature file, views, mail rules, local mail, and contacts. + +To help you decide which settings to migrate, you should consider any previous migration experiences as well as the results of any surveys and tests that you have conducted. You should also consider the number of help-desk calls related to operating-system settings that you have had in the past, and are able to handle in the future. Also decide how much of the new operating-system functionality you want to take advantage of. + +You should migrate any settings that users need to get their jobs done, those that make the work environment comfortable, and those that will reduce help-desk calls after the migration. Although it is easy to dismiss migrating user preferences, you should consider that users can spend a significant amount of time restoring items such as wallpaper, screen savers, and other customizable user-interface features. Most users do not remember how these settings were applied. Although these items are not critical to migration success, migrating these items increases user productivity and overall satisfaction of the migration process. + +**Note**   +For more information about how to change the operating-system settings that are migrated, see [User State Migration Tool (USMT) How-to topics](usmt-how-to.md). + +For information about the operating-system settings that USMT migrates, see [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) + + + +## Related topics + + +[Determine What to Migrate](usmt-determine-what-to-migrate.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-identify-users.md b/windows/deployment/usmt/usmt-identify-users.md index 5654585491..8168e90730 100644 --- a/windows/deployment/usmt/usmt-identify-users.md +++ b/windows/deployment/usmt/usmt-identify-users.md @@ -1,87 +1,90 @@ ---- -title: Identify Users (Windows 10) -description: Identify Users -ms.assetid: 957a4fe9-79fd-44a2-8c26-33e50f71f9de -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Identify Users - - -It is important to carefully consider how you plan to migrate users. By default, all users are migrated by User State Migration Tool (USMT) 5.0. You must specify which users to include by using the command line. You cannot specify users in the .xml files. For instructions on how to migrate users, see [Migrate User Accounts](usmt-migrate-user-accounts.md). - -## In This Topic - - -- [Migrating Local Accounts](#bkmk-8) - -- [Migrating Domain Accounts](#bkmk-9) - -- [Command-Line Options](#bkmk-7) - -## Migrating Local Accounts - - -Before migrating local accounts, note the following: - -- [You must explicitly specify that local accounts that are not on the destination computer should be migrated.](#bkmk-8) If you are migrating local accounts and the local account does not exist on the destination computer, you must use the**/lac** option when using the LoadState command. If the **/lac** option is not specified, no local user accounts will be migrated. - -- [Consider whether to enable user accounts that are new to the destination computer.](#bkmk-8) The **/lae** option enables the account that was created with the **/lac** option. However, if you create a disabled local account by using only the **/lac** option, a local administrator must enable the account on the destination computer. - -- [Be careful when specifying a password for local accounts.](#bkmk-8) If you create the local account with a blank password, anyone could log on to that account on the destination computer. If you create the local account with a password, the password is available to anyone with access to the USMT command-line tools. - - **Note**   - If there are multiple users on a computer, and you specify a password with the **/lac** option, all migrated users will have the same password. - -   - -## Migrating Domain Accounts - - -The source and destination computers do not need to be connected to the domain for domain user profiles to be migrated. - -## Command-Line Options - - -USMT provides several options to migrate multiple users on a single computer. The following command-line options specify which users to migrate. - -- [Specifying users.](#bkmk-8) You can specify which users to migrate with the **/all**, **/ui**, **/uel**, and **/ue** options with both the ScanState and LoadState command-line tools. - - **Important**   - The **/uel** option excludes users based on the **LastModified** date of the Ntuser.dat file. The **/uel** option is not valid in offline migrations. - -   - -- [Moving users to another domain.](#bkmk-8) You can move user accounts to another domain using the **/md** option with the LoadState command-line tool. - -- [Creating local accounts.](#bkmk-8) You can create and enable local accounts using the **/lac** and **/lae** options with the LoadState command-line tool. - -- [Renaming user accounts.](#bkmk-8) You can rename user accounts using the **/mu** option. - - **Note**   - By default, if a user name is not specified in any of the command-line options, the user will be migrated. - -   - -## Related topics - - -[Determine What to Migrate](usmt-determine-what-to-migrate.md) - -[ScanState Syntax](usmt-scanstate-syntax.md) - -[LoadState Syntax](usmt-loadstate-syntax.md) - -  - -  - - - - - +--- +title: Identify Users (Windows 10) +description: Identify Users +ms.assetid: 957a4fe9-79fd-44a2-8c26-33e50f71f9de +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Identify Users + + +It is important to carefully consider how you plan to migrate users. By default, all users are migrated by User State Migration Tool (USMT) 5.0. You must specify which users to include by using the command line. You cannot specify users in the .xml files. For instructions on how to migrate users, see [Migrate User Accounts](usmt-migrate-user-accounts.md). + +## In This Topic + + +- [Migrating Local Accounts](#bkmk-8) + +- [Migrating Domain Accounts](#bkmk-9) + +- [Command-Line Options](#bkmk-7) + +## Migrating Local Accounts + + +Before migrating local accounts, note the following: + +- [You must explicitly specify that local accounts that are not on the destination computer should be migrated.](#bkmk-8) If you are migrating local accounts and the local account does not exist on the destination computer, you must use the/lac option when using the LoadState command. If the **/lac** option is not specified, no local user accounts will be migrated. + +- [Consider whether to enable user accounts that are new to the destination computer.](#bkmk-8) The **/lae** option enables the account that was created with the **/lac** option. However, if you create a disabled local account by using only the **/lac** option, a local administrator must enable the account on the destination computer. + +- [Be careful when specifying a password for local accounts.](#bkmk-8) If you create the local account with a blank password, anyone could log on to that account on the destination computer. If you create the local account with a password, the password is available to anyone with access to the USMT command-line tools. + + **Note** + If there are multiple users on a computer, and you specify a password with the **/lac** option, all migrated users will have the same password. + + + +## Migrating Domain Accounts + + +The source and destination computers do not need to be connected to the domain for domain user profiles to be migrated. + +## Command-Line Options + + +USMT provides several options to migrate multiple users on a single computer. The following command-line options specify which users to migrate. + +- [Specifying users.](#bkmk-8) You can specify which users to migrate with the **/all**, **/ui**, **/uel**, and **/ue** options with both the ScanState and LoadState command-line tools. + + **Important**   + The **/uel** option excludes users based on the **LastModified** date of the Ntuser.dat file. The **/uel** option is not valid in offline migrations. + + + +- [Moving users to another domain.](#bkmk-8) You can move user accounts to another domain using the **/md** option with the LoadState command-line tool. + +- [Creating local accounts.](#bkmk-8) You can create and enable local accounts using the **/lac** and **/lae** options with the LoadState command-line tool. + +- [Renaming user accounts.](#bkmk-8) You can rename user accounts using the **/mu** option. + + **Note**   + By default, if a user name is not specified in any of the command-line options, the user will be migrated. + + + +## Related topics + + +[Determine What to Migrate](usmt-determine-what-to-migrate.md) + +[ScanState Syntax](usmt-scanstate-syntax.md) + +[LoadState Syntax](usmt-loadstate-syntax.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-include-files-and-settings.md b/windows/deployment/usmt/usmt-include-files-and-settings.md index b3e26e37b3..c594b6ea7d 100644 --- a/windows/deployment/usmt/usmt-include-files-and-settings.md +++ b/windows/deployment/usmt/usmt-include-files-and-settings.md @@ -2,9 +2,13 @@ title: Include Files and Settings (Windows 10) description: Include Files and Settings ms.assetid: 9009c6a5-0612-4478-8742-abe5eb6cbac8 +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -34,7 +38,7 @@ In this topic: The following .xml file migrates a single registry key. -``` syntax +``` xml Component to migrate only registry value string @@ -60,7 +64,7 @@ The following examples show how to migrate a folder from a specific drive, and f - **Including subfolders.** The following .xml file migrates all files and subfolders from C:\\EngineeringDrafts to the destination computer. - ``` syntax + ``` xml Component to migrate all Engineering Drafts Documents including subfolders @@ -79,7 +83,7 @@ The following examples show how to migrate a folder from a specific drive, and f - **Excluding subfolders.** The following .xml file migrates all files from C:\\EngineeringDrafts, but it does not migrate any subfolders within C:\\EngineeringDrafts. - ``` syntax + ``` xml Component to migrate all Engineering Drafts Documents without subfolders @@ -100,7 +104,7 @@ The following examples show how to migrate a folder from a specific drive, and f The following .xml file migrates all files and subfolders of the EngineeringDrafts folder from any drive on the computer. If multiple folders exist with the same name, then all files with this name are migrated. -``` syntax +``` xml Component to migrate all Engineering Drafts Documents folder on any drive on the computer @@ -120,7 +124,7 @@ The following .xml file migrates all files and subfolders of the EngineeringDraf The following .xml file migrates all files and subfolders of the EngineeringDrafts folder from any location on the C:\\ drive. If multiple folders exist with the same name, they are all migrated. -``` syntax +``` xml Component to migrate all Engineering Drafts Documents EngineeringDrafts folder from where ever it exists on the C: drive @@ -143,7 +147,7 @@ The following .xml file migrates all files and subfolders of the EngineeringDraf The following .xml file migrates .mp3 files located in the specified drives on the source computer into the C:\\Music folder on the destination computer. -``` syntax +``` xml All .mp3 files to My Documents @@ -173,7 +177,7 @@ The following examples show how to migrate a file from a specific folder, and ho - **To migrate a file from a folder.** The following .xml file migrates only the Sample.doc file from C:\\EngineeringDrafts on the source computer to the destination computer. - ``` syntax + ``` xml Component to migrate all Engineering Drafts Documents @@ -192,13 +196,13 @@ The following examples show how to migrate a file from a specific folder, and ho - **To migrate a file from any location.** To migrate the Sample.doc file from any location on the C:\\ drive, use the <pattern> element, as the following example shows. If multiple files exist with the same name on the C:\\ drive, all of files with this name are migrated. - ``` syntax + ``` xml C:\* [Sample.doc] ``` To migrate the Sample.doc file from any drive on the computer, use <script> as the following example shows. If multiple files exist with the same name, all files with this name are migrated. - ``` syntax + ``` xml ``` diff --git a/windows/deployment/usmt/usmt-loadstate-syntax.md b/windows/deployment/usmt/usmt-loadstate-syntax.md index 760fbb96ed..3bbf83959b 100644 --- a/windows/deployment/usmt/usmt-loadstate-syntax.md +++ b/windows/deployment/usmt/usmt-loadstate-syntax.md @@ -1,711 +1,710 @@ ---- -title: LoadState Syntax (Windows 10) -description: LoadState Syntax -ms.assetid: 53d2143b-cbe9-4cfc-8506-36e9d429f6d4 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# LoadState Syntax - - -This topic discusses the **LoadState** command syntax and options. - -## In This Topic - - -[Before You Begin](#before) - -[Syntax](#bkmk-s) - -[Storage Options](#bkmk-st) - -[Migration Rule Options](#bkmk-mig) - -[Monitoring Options](#bkmk-mon) - -[User Options](#bkmk-user) - -[Incompatible Command-Line Options](#bkmk-cloi) - -## Before You Begin - - -Before you run the **LoadState** command, note the following: - -- To ensure that all operating system settings migrate, we recommend that you run the **LoadState** commands in administrator mode from an account with administrative credentials. - -- For information about software requirements for running the **LoadState** command, see [USMT Requirements](usmt-requirements.md). - -- You should log off after you run the **LoadState** command. Some settings (for example, fonts, wallpaper, and screensaver settings) will not take effect until the next time the user logs in. - -- Unless otherwise specified, you can use each option only once when running a tool on the command line. - -- **LoadState** does not require domain controller access to apply domain profiles. This functionality is available without any additional configuration. It is not necessary for the source computer to have had domain controller access when the user profile was gathered using **ScanState**. However, domain profiles are inaccessible until the destination computer is joined to the domain. - -- The [Incompatible Command-Line Options](#bkmk-cloi) table lists which options you can use together and which command-line options are incompatible. - -## Syntax - - -This section explains the syntax and usage of the command-line options available when you use the **LoadState** command. The options can be specified in any order. If the option contains a parameter, you can specify either a colon or space separator. - -The **LoadState** command's syntax is: - -loadstate *StorePath* \[/i:\[*Path*\\\]*FileName*\] \[/v:*VerbosityLevel*\] \[/nocompress\] \[/decrypt /key:*KeyString*|/keyfile:\[Path\\\]*FileName*\] \[/l:\[*Path*\\\]*FileName*\] \[/progress:\[*Path*\\\]*FileName*\] \[/r:*TimesToRetry*\] \[/w:*SecondsToWait*\] \[/c\] \[/all\] \[/ui:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/ue:\[\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/uel:*NumberOfDays*|*YYYY/MM/DD*|0\] \[/md:*OldDomain*:*NewDomain*\] \[/mu:*OldDomain*\\*OldUserName*:\[*NewDomain*\\\]*NewUserName*\] \[/lac:\[*Password*\]\] \[/lae\] \[/config:\[*Path*\\\]*FileName*\] \[/?|help\] - -For example, to decrypt the store and migrate the files and settings to a computer running Windows 7 type the following on the command line: - -`loadstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /v:13 /decrypt /key:"mykey"` - -## Storage Options - - -USMT provides the following options that you can use to specify how and where the migrated data is stored. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-Line OptionDescription

                                StorePath

                                Indicates the folder where the files and settings data are stored. You must specify StorePath when using the LoadState command. You cannot specify more than one StorePath.

                                /decrypt /key:KeyString

                                -

                                or

                                -

                                /decrypt /key:"Key String"

                                -

                                or

                                -

                                /decrypt /keyfile:[Path\]FileName

                                Decrypts the store with the specified key. With this option, you will need to specify the encryption key in one of the following ways:

                                -
                                  -

                                • /key:KeyString specifies the encryption key. If there is a space in KeyString, you must surround the argument with quotation marks.

                                  • -

                                • /keyfile:FilePathAndName specifies a text (.txt) file that contains the encryption key

                                  • -
                                -

                                KeyString cannot exceed 256 characters.

                                -

                                The /key and /keyfile options cannot be used on the same command line.

                                -

                                The /decrypt and /nocompress options cannot be used on the same command line.

                                -
                                -Important   -

                                Use caution with this option, because anyone who has access to the LoadState command-line script will also have access to the encryption key.

                                -
                                -
                                -  -
                                -

                                For example:

                                -

                                loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /decrypt /key:mykey

                                /decrypt:"encryption strength"

                                The /decrypt option accepts a command-line parameter to define the encryption strength specified for the migration store encryption. For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md).

                                /hardlink

                                Enables user-state data to be restored from a hard-link migration store. The /nocompress parameter must be specified with /hardlink option.

                                /nocompress

                                Specifies that the store is not compressed. You should only use this option in testing environments. We recommend that you use a compressed store during your actual migration. This option cannot be used with the /decrypt option.

                                -

                                For example:

                                -

                                loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /nocompress

                                - -  - -## Migration Rule Options - - -USMT provides the following options to specify what files you want to migrate. - - ---- - - - - - - - - - - - - - - - - - - - - -
                                Command-Line OptionDescription

                                /i:[Path\]FileName

                                (include)

                                -

                                Specifies an .xml file that contains rules that define what state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigSys.xml, MigDocs.xml and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.

                                -

                                For more information about which files to specify, see the "XML files" section of the [Frequently Asked Questions](usmt-faq.md) topic.

                                /config:[Path\]FileName

                                Specifies the Config.xml file that the LoadState command should use. You cannot specify this option more than once on the command line. Path can be either a relative or full path. If you do not specify the Path variable, then the FileName must be located in the current directory.

                                -

                                This example migrates the files and settings based on the rules in the Config.xml, MigDocs.xml, and MigApp.xml files:

                                -

                                loadstate \\server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:5 /l:loadstate.log

                                /auto:"path to script files"

                                This option enables you to specify the location of the default .xml files and then launch your migration. If no path is specified, USMT will use the directory where the USMT binaries are located. The /auto option has the same effect as using the following options: /i:MigDocs.xml /i:MigApp.xml /v:5.

                                - -  - -## Monitoring Options - - -USMT provides several command-line options that you can use to analyze problems that occur during migration. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-Line OptionDescription

                                /l:[Path\]FileName

                                Specifies the location and name of the LoadState log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then the log will be created in the current directory. You can specify the /v option to adjust the amount of output.

                                -

                                If you run the LoadState command from a shared network resource, you must specify this option or USMT will fail with the error: "USMT was unable to create the log file(s)". To fix this issue, use the /l:load.log option.

                                /v:<VerbosityLevel>

                                (Verbosity)

                                -

                                Enables verbose output in the LoadState log file. The default value is 0.

                                -

                                You can set the VerbosityLevel to one of the following levels:

                                - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                LevelExplanation

                                0

                                Only the default errors and warnings are enabled.

                                1

                                Enables verbose output.

                                4

                                Enables error and status output.

                                5

                                Enables verbose and status output.

                                8

                                Enables error output to a debugger.

                                9

                                Enables verbose output to a debugger.

                                12

                                Enables error and status output to a debugger.

                                13

                                Enables verbose, status, and debugger output.

                                -

                                 

                                -

                                For example:

                                -

                                loadstate \\server\share\migration\mystore /v:5 /i:migdocs.xml /i:migapp.xml

                                /progress:[Path\]FileName

                                Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

                                -

                                For example:

                                -

                                loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /progress:prog.log /l:scanlog.log

                                /c

                                When this option is specified, the LoadState command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit on the computer, the LoadState command will log an error and continue with the migration. Without the /c option, the LoadState command will exit on the first error. You can use the new <ErrorControl> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /c command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /genconfig option now generates a sample <ErrorControl> section that is enabled by specifying error messages and desired behaviors in the Config.xml file.

                                /r:<TimesToRetry>

                                (Retry)

                                -

                                Specifies the number of times to retry when an error occurs while migrating the user state from a server. The default is three times. This option is useful in environments where network connectivity is not reliable.

                                -

                                While restoring the user state, the /r option will not recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem.

                                /w:<SecondsBeforeRetry>

                                (Wait)

                                -

                                Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second.

                                /? or /help

                                Displays Help on the command line.

                                - -  - -## User Options - - -By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You cannot exclude users in the migration .xml files or by using the Config.xml file. For more information, see [Identify Users](usmt-identify-users.md). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-Line OptionDescription

                                /all

                                Migrates all of the users on the computer.

                                -

                                USMT migrates all user accounts on the computer, unless you specifically exclude an account with the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to use the /all option, you cannot also use the /ui, /ue or /uel options.

                                /ui:DomainName\UserName

                                -

                                or

                                -

                                /ui:"DomainName\User Name"

                                -

                                or

                                -

                                /ui:ComputerName\LocalUserName

                                (User include)

                                -

                                Migrates the specified user. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue option. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk (*) wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotations marks.

                                -

                                For example:

                                -
                                  -

                                • To include only User2 from the Corporate domain, type:

                                  -

                                  /ue:*\* /ui:corporate\user2

                                  • -
                                -
                                -Note   -

                                If a user is specified for inclusion with the /ui option, and also is specified to be excluded with either the /ue or /uel options, the user will be included in the migration.

                                -
                                -
                                -  -
                                -

                                For more examples, see the descriptions of the /uel, /ue, and /ui options in this table.

                                /uel:<NumberOfDays>

                                -

                                or

                                -

                                /uel:<YYYY/MM/DD>

                                -

                                or

                                -

                                /uel:0

                                (User exclude based on last logon)

                                -

                                Migrates only the users that logged onto the source computer within the specified time period, based on the Last Modified date of the Ntuser.dat file on the source computer. The /uel option acts as an include rule. For example, the /uel:30 option migrates users who logged on, or whose user account was modified, within the last 30 days from the date when the ScanState command is run. You can specify a number of days or you can specify a date. You cannot use this option with the /all option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged onto another computer, that logon instance is not considered by USMT.

                                -
                                -Note   -

                                The /uel option is not valid in offline migrations.

                                -
                                -
                                -  -
                                -

                                Examples:

                                -
                                  -

                                • /uel:0 migrates accounts that were logged on to the source computer when the ScanState command was run.

                                  • -

                                • /uel:90 migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.

                                  • -

                                • /uel:1 migrates users whose accounts have been modified within the last 24 hours.

                                  • -

                                • /uel:2002/1/15 migrates users who have logged on or whose accounts have been modified since January 15, 2002.

                                  • -
                                -

                                For example:

                                -

                                loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0

                                /ue:DomainName\UserName

                                -

                                or

                                -

                                /ue:"DomainName\User Name"

                                -

                                or

                                -

                                /ue:ComputerName\LocalUserName

                                (User exclude)

                                -

                                Excludes the specified users from the migration. You can specify multiple /ue options but you cannot use the /ue option with the /all option. DomainName and UserName can contain the asterisk (*) wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.

                                -

                                For example:

                                -

                                loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /ue:contoso\user1

                                -

                                For more examples, see the descriptions of the /uel, /ue, and /ui options in this table.

                                /md:OldDomain:NewDomain

                                -

                                or

                                -

                                /md:LocalComputerName:NewDomain

                                (move domain)

                                -

                                Specifies a new domain for the user. Use this option to change the domain for users on a computer or to migrate a local user to a domain account. OldDomain may contain the asterisk (*) wildcard character.

                                -

                                You can specify this option more than once. You may want to specify multiple /md options if you are consolidating users across multiple domains to a single domain. For example, you could specify the following to consolidate the users from the Corporate and FarNorth domains into the Fabrikam domain: /md:corporate:fabrikam and /md:farnorth:fabrikam.

                                -

                                If there are conflicts between two /md commands, the first rule that you specify is applied. For example, if you specify the /md:corporate:fabrikam and /md:corporate:farnorth commands, then Corporate users would be mapped to the Fabrikam domain.

                                -
                                -Note   -

                                If you specify an OldDomain that did not exist on the source computer, the LoadState command will appear to complete successfully, without an error or warning. However, in this case, users will not be moved to NewDomain but will remain in their original domain. For example, if you misspell "contoso" and you specify "/md:contso:fabrikam", the users will remain in contoso on the destination computer.

                                -
                                -
                                -  -
                                -

                                For example:

                                -

                                loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore

                                -

                                /progress:prog.log /l:load.log /md:contoso:fabrikam

                                /mu:OldDomain\OldUserName:[NewDomain\]NewUserName

                                -

                                or

                                -

                                /mu:OldLocalUserName:NewDomain\NewUserName

                                Specifies a new user name for the specified user. If the store contains more than one user, you can specify multiple /mu options. You cannot use wildcard characters with this option.

                                -

                                For example:

                                -

                                loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore

                                -

                                /progress:prog.log /l:load.log /mu:contoso\user1:fabrikam\user1

                                /lac:[Password]

                                (local account create)

                                -

                                Specifies that if a user account is a local (non-domain) account, and it does not exist on the destination computer, USMT will create the account on the destination computer but it will be disabled. To enable the account, you must also use the /lae option.

                                -

                                If the /lac option is not specified, any local user accounts that do not already exist on the destination computer will not be migrated.

                                -

                                Password is the password for the newly created account. An empty password is used by default.

                                -
                                -Caution   -

                                Use the Password variable with caution because it is provided in plain text and can be obtained by anyone with access to the computer that is running the LoadState command.

                                -

                                Also, if the computer has multiple users, all migrated users will have the same password.

                                -
                                -
                                -  -
                                -

                                For example:

                                -

                                loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore

                                -

                                For instructions, see [Migrate User Accounts](usmt-migrate-user-accounts.md).

                                /lae

                                (local account enable)

                                -

                                Enables the account that was created with the /lac option. You must specify the /lac option with this option.

                                -

                                For example:

                                -

                                loadstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore

                                -

                                /progress:prog.log /l:load.log /lac:password /lae

                                -

                                For instructions, see [Migrate User Accounts](usmt-migrate-user-accounts.md).

                                - -  - -### Examples for the /ui and /ue options - -The following examples apply to both the **/ui** and **/ue** options. You can replace the **/ue** option with the **/ui** option to include, rather than exclude, the specified users. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                BehaviorCommand

                                Exclude the user named User One in the Corporate domain.

                                /ue:"corporate\user one"

                                Exclude the user named User1 in the Corporate domain.

                                /ue:corporate\user1

                                Exclude the local user named User1.

                                /ue:%computername%\user1

                                Exclude all domain users.

                                /ue:Domain\*

                                Exclude all local users.

                                /ue:%computername%\*

                                Exclude users in all domains named User1, User2, and so on.

                                /ue:*\user*

                                - -  - -### Using the Options Together - -You can use the **/uel**, **/ue** and **/ui** options together to migrate only the users that you want migrated. - -**The /ui option has precedence over the /ue and /uel options.** If a user is specified to be included using the **/ui** option, and also specified to be excluded using either the **/ue** or **/uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the **/ui** option takes precedence over the **/ue** option. - -**The /uel option takes precedence over the /ue option.** If a user has logged on within the specified time period set by the **/uel** option, that user’s profile will be migrated even if they are excluded by using the **/ue** option. For example, if you specify `/ue:contoso\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                BehaviorCommand

                                Include only User2 from the Fabrikam domain and exclude all other users.

                                /ue:*\* /ui:fabrikam\user2

                                Include only the local user named User1 and exclude all other users.

                                /ue:*\* /ui:user1

                                Include only the domain users from Contoso, except Contoso\User1.

                                This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:

                                -
                                  -

                                • Using the ScanState command-line tool, type: /ue:*\* /ui:contoso\*

                                  • -

                                • Using the LoadState command-line tool, type: /ue:contoso\user1

                                  • -

                                Include only local (non-domain) users.

                                /ue:*\* /ui:%computername%\*

                                - -  - -## Incompatible Command-Line Options - - -The following table indicates which command-line options are not compatible with the **LoadState** command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options are not compatible. For example, you cannot use the **/nocompress** option with the **/encrypt** option. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-Line Option/keyfile/nocompress/genconfig/all

                                /i

                                /v

                                /nocompress

                                N/A

                                X

                                /key

                                X

                                X

                                /decrypt

                                Required*

                                X

                                X

                                /keyfile

                                N/A

                                X

                                /l

                                /progress

                                X

                                /r

                                X

                                /w

                                X

                                /c

                                X

                                /p

                                X

                                N/A

                                /all

                                X

                                /ui

                                X

                                X

                                /ue

                                X

                                X

                                /uel

                                X

                                X

                                /genconfig

                                N/A

                                /config

                                X

                                StorePath

                                /md

                                /mu

                                /lae

                                /lac

                                - -  - -**Note**   -You must specify either the **/key** or **/keyfile** option with the **/encrypt** option. - -  - -## Related topics - - -[XML Elements Library](usmt-xml-elements-library.md) - -  - -  - - - - - +--- +title: LoadState Syntax (Windows 10) +description: LoadState Syntax +ms.assetid: 53d2143b-cbe9-4cfc-8506-36e9d429f6d4 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# LoadState Syntax + + +This topic discusses the **LoadState** command syntax and options. + +## In This Topic + + +[Before You Begin](#before) + +[Syntax](#bkmk-s) + +[Storage Options](#bkmk-st) + +[Migration Rule Options](#bkmk-mig) + +[Monitoring Options](#bkmk-mon) + +[User Options](#bkmk-user) + +[Incompatible Command-Line Options](#bkmk-cloi) + +## Before You Begin + + +Before you run the **LoadState** command, note the following: + +- To ensure that all operating system settings migrate, we recommend that you run the **LoadState** commands in administrator mode from an account with administrative credentials. + +- For information about software requirements for running the **LoadState** command, see [USMT Requirements](usmt-requirements.md). + +- You should log off after you run the **LoadState** command. Some settings (for example, fonts, wallpaper, and screensaver settings) will not take effect until the next time the user logs in. + +- Unless otherwise specified, you can use each option only once when running a tool on the command line. + +- **LoadState** does not require domain controller access to apply domain profiles. This functionality is available without any additional configuration. It is not necessary for the source computer to have had domain controller access when the user profile was gathered using **ScanState**. However, domain profiles are inaccessible until the destination computer is joined to the domain. + +- The [Incompatible Command-Line Options](#bkmk-cloi) table lists which options you can use together and which command-line options are incompatible. + +## Syntax + + +This section explains the syntax and usage of the command-line options available when you use the **LoadState** command. The options can be specified in any order. If the option contains a parameter, you can specify either a colon or space separator. + +The **LoadState** command's syntax is: + +loadstate *StorePath* \[/i:\[*Path*\\\]*FileName*\] \[/v:*VerbosityLevel*\] \[/nocompress\] \[/decrypt /key:*KeyString*|/keyfile:\[Path\\\]*FileName*\] \[/l:\[*Path*\\\]*FileName*\] \[/progress:\[*Path*\\\]*FileName*\] \[/r:*TimesToRetry*\] \[/w:*SecondsToWait*\] \[/c\] \[/all\] \[/ui:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/ue:\[\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/uel:*NumberOfDays*|*YYYY/MM/DD*|0\] \[/md:*OldDomain*:*NewDomain*\] \[/mu:*OldDomain*\\*OldUserName*:\[*NewDomain*\\\]*NewUserName*\] \[/lac:\[*Password*\]\] \[/lae\] \[/config:\[*Path*\\\]*FileName*\] \[/?|help\] + +For example, to decrypt the store and migrate the files and settings to a computer running Windows 7 type the following on the command line: + +`loadstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /v:13 /decrypt /key:"mykey"` + +## Storage Options + + +USMT provides the following options that you can use to specify how and where the migrated data is stored. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-Line OptionDescription

                                StorePath

                                Indicates the folder where the files and settings data are stored. You must specify StorePath when using the LoadState command. You cannot specify more than one StorePath.

                                /decrypt /key:KeyString

                                +

                                or

                                +

                                /decrypt /key:"Key String"

                                +

                                or

                                +

                                /decrypt /keyfile:[Path</em>]FileName

                                Decrypts the store with the specified key. With this option, you will need to specify the encryption key in one of the following ways:

                                +
                                  +

                                • /key:KeyString specifies the encryption key. If there is a space in KeyString, you must surround the argument with quotation marks.

                                  • +

                                • /keyfile:FilePathAndName specifies a text (.txt) file that contains the encryption key

                                  • +
                                +

                                KeyString cannot exceed 256 characters.

                                +

                                The /key and /keyfile options cannot be used on the same command line.

                                +

                                The /decrypt and /nocompress options cannot be used on the same command line.

                                +
                                +Important

                                Use caution with this option, because anyone who has access to the LoadState command-line script will also have access to the encryption key.

                                +
                                +
                                + +
                                +

                                For example:

                                +

                                loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /decrypt /key:mykey

                                /decrypt:"encryption strength"

                                The /decrypt option accepts a command-line parameter to define the encryption strength specified for the migration store encryption. For more information about supported encryption algorithms, see Migration Store Encryption.

                                /hardlink

                                Enables user-state data to be restored from a hard-link migration store. The /nocompress parameter must be specified with /hardlink option.

                                /nocompress

                                Specifies that the store is not compressed. You should only use this option in testing environments. We recommend that you use a compressed store during your actual migration. This option cannot be used with the /decrypt option.

                                +

                                For example:

                                +

                                loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /nocompress

                                + + + +## Migration Rule Options + + +USMT provides the following options to specify what files you want to migrate. + + ++++ + + + + + + + + + + + + + + + + + + + + +
                                Command-Line OptionDescription

                                /i:[Path]FileName

                                (include)

                                +

                                Specifies an .xml file that contains rules that define what state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigSys.xml, MigDocs.xml and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.

                                +

                                For more information about which files to specify, see the "XML files" section of the Frequently Asked Questions topic.

                                /config:[Path]FileName

                                Specifies the Config.xml file that the LoadState command should use. You cannot specify this option more than once on the command line. Path can be either a relative or full path. If you do not specify the Path variable, then the FileName must be located in the current directory.

                                +

                                This example migrates the files and settings based on the rules in the Config.xml, MigDocs.xml, and MigApp.xml files:

                                +

                                loadstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:5 /l:loadstate.log

                                /auto:"path to script files"

                                This option enables you to specify the location of the default .xml files and then launch your migration. If no path is specified, USMT will use the directory where the USMT binaries are located. The /auto option has the same effect as using the following options: /i:MigDocs.xml /i:MigApp.xml /v:5.

                                + + + +## Monitoring Options + + +USMT provides several command-line options that you can use to analyze problems that occur during migration. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-Line OptionDescription

                                /l:[Path]FileName

                                Specifies the location and name of the LoadState log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then the log will be created in the current directory. You can specify the /v option to adjust the amount of output.

                                +

                                If you run the LoadState command from a shared network resource, you must specify this option or USMT will fail with the error: "USMT was unable to create the log file(s)". To fix this issue, use the /l:load.log option.

                                /v:<VerbosityLevel>

                                (Verbosity)

                                +

                                Enables verbose output in the LoadState log file. The default value is 0.

                                +

                                You can set the VerbosityLevel to one of the following levels:

                                + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                LevelExplanation

                                0

                                Only the default errors and warnings are enabled.

                                1

                                Enables verbose output.

                                4

                                Enables error and status output.

                                5

                                Enables verbose and status output.

                                8

                                Enables error output to a debugger.

                                9

                                Enables verbose output to a debugger.

                                12

                                Enables error and status output to a debugger.

                                13

                                Enables verbose, status, and debugger output.

                                +

                                +

                                For example:

                                +

                                loadstate \server\share\migration\mystore /v:5 /i:migdocs.xml /i:migapp.xml

                                /progress:[Path</em>]FileName

                                Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

                                +

                                For example:

                                +

                                loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:loadlog.log

                                /c

                                When this option is specified, the LoadState command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit on the computer, the LoadState command will log an error and continue with the migration. Without the /c option, the LoadState command will exit on the first error. You can use the new <ErrorControl> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /c command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /genconfig option now generates a sample <ErrorControl> section that is enabled by specifying error messages and desired behaviors in the Config.xml file.

                                /r:<TimesToRetry>

                                (Retry)

                                +

                                Specifies the number of times to retry when an error occurs while migrating the user state from a server. The default is three times. This option is useful in environments where network connectivity is not reliable.

                                +

                                While restoring the user state, the /r option will not recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem.

                                /w:<SecondsBeforeRetry>

                                (Wait)

                                +

                                Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second.

                                /? or /help

                                Displays Help on the command line.

                                + + + +## User Options + + +By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You cannot exclude users in the migration .xml files or by using the Config.xml file. For more information, see [Identify Users](usmt-identify-users.md). + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-Line OptionDescription

                                /all

                                Migrates all of the users on the computer.

                                +

                                USMT migrates all user accounts on the computer, unless you specifically exclude an account with the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to use the /all option, you cannot also use the /ui, /ue or /uel options.

                                /ui:DomainName<em>UserName

                                +

                                or

                                +

                                /ui:"DomainName<em>User Name"

                                +

                                or

                                +

                                /ui:ComputerName<em>LocalUserName

                                (User include)

                                +

                                Migrates the specified user. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue option. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotations marks.

                                +

                                For example:

                                +
                                  +

                                • To include only User2 from the Corporate domain, type:

                                  +

                                  /ue:* /ui:corporate\user2

                                  • +
                                +
                                +Note

                                If a user is specified for inclusion with the /ui option, and also is specified to be excluded with either the /ue or /uel options, the user will be included in the migration.

                                +
                                +
                                + +
                                +

                                For more examples, see the descriptions of the /uel, /ue, and /ui options in this table.

                                /uel:<NumberOfDays>

                                +

                                or

                                +

                                /uel:<YYYY/MM/DD>

                                +

                                or

                                +

                                /uel:0

                                (User exclude based on last logon)

                                +

                                Migrates only the users that logged onto the source computer within the specified time period, based on the Last Modified date of the Ntuser.dat file on the source computer. The /uel option acts as an include rule. For example, the /uel:30 option migrates users who logged on, or whose user account was modified, within the last 30 days from the date when the ScanState command is run. You can specify a number of days or you can specify a date. You cannot use this option with the /all option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged onto another computer, that logon instance is not considered by USMT.

                                +
                                +Note

                                The /uel option is not valid in offline migrations.

                                +
                                +
                                + +
                                +

                                Examples:

                                +
                                  +

                                • /uel:0 migrates accounts that were logged on to the source computer when the ScanState command was run.

                                  • +

                                • /uel:90 migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.

                                  • +

                                • /uel:1 migrates users whose accounts have been modified within the last 24 hours.

                                  • +

                                • /uel:2002/1/15 migrates users who have logged on or whose accounts have been modified since January 15, 2002.

                                  • +
                                +

                                For example:

                                +

                                loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /uel:0

                                /ue:DomainName<em>UserName

                                +

                                or

                                +

                                /ue:"DomainName<em>User Name"

                                +

                                or

                                +

                                /ue:ComputerName<em>LocalUserName

                                (User exclude)

                                +

                                Excludes the specified users from the migration. You can specify multiple /ue options but you cannot use the /ue option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.

                                +

                                For example:

                                +

                                loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /ue:contoso\user1

                                +

                                For more examples, see the descriptions of the /uel, /ue, and /ui options in this table.

                                /md:OldDomain:NewDomain

                                +

                                or

                                +

                                /md:LocalComputerName:NewDomain

                                (move domain)

                                +

                                Specifies a new domain for the user. Use this option to change the domain for users on a computer or to migrate a local user to a domain account. OldDomain may contain the asterisk () wildcard character.

                                +

                                You can specify this option more than once. You may want to specify multiple /md options if you are consolidating users across multiple domains to a single domain. For example, you could specify the following to consolidate the users from the Corporate and FarNorth domains into the Fabrikam domain: /md:corporate:fabrikam and /md:farnorth:fabrikam.

                                +

                                If there are conflicts between two /md commands, the first rule that you specify is applied. For example, if you specify the /md:corporate:fabrikam and /md:corporate:farnorth commands, then Corporate users would be mapped to the Fabrikam domain.

                                +
                                +Note

                                If you specify an OldDomain that did not exist on the source computer, the LoadState command will appear to complete successfully, without an error or warning. However, in this case, users will not be moved to NewDomain but will remain in their original domain. For example, if you misspell "contoso" and you specify "/md:contso:fabrikam", the users will remain in contoso on the destination computer.

                                +
                                +
                                + +
                                +

                                For example:

                                +

                                loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore

                                +

                                /progress:prog.log /l:load.log /md:contoso:fabrikam

                                /mu:OldDomain<em>OldUserName:[NewDomain]NewUserName

                                +

                                or

                                +

                                /mu:OldLocalUserName:NewDomain<em>NewUserName

                                Specifies a new user name for the specified user. If the store contains more than one user, you can specify multiple /mu options. You cannot use wildcard characters with this option.

                                +

                                For example:

                                +

                                loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore

                                +

                                /progress:prog.log /l:load.log /mu:contoso\user1:fabrikam\user1

                                /lac:[Password]

                                (local account create)

                                +

                                Specifies that if a user account is a local (non-domain) account, and it does not exist on the destination computer, USMT will create the account on the destination computer but it will be disabled. To enable the account, you must also use the /lae option.

                                +

                                If the /lac option is not specified, any local user accounts that do not already exist on the destination computer will not be migrated.

                                +

                                Password is the password for the newly created account. An empty password is used by default.

                                +
                                +Caution

                                Use the Password variable with caution because it is provided in plain text and can be obtained by anyone with access to the computer that is running the LoadState command.

                                +

                                Also, if the computer has multiple users, all migrated users will have the same password.

                                +
                                +
                                + +
                                +

                                For example:

                                +

                                loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore

                                +

                                For instructions, see Migrate User Accounts.

                                /lae

                                (local account enable)

                                +

                                Enables the account that was created with the /lac option. You must specify the /lac option with this option.

                                +

                                For example:

                                +

                                loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore

                                +

                                /progress:prog.log /l:load.log /lac:password /lae

                                +

                                For instructions, see Migrate User Accounts.

                                + + + +### Examples for the /ui and /ue options + +The following examples apply to both the **/ui** and **/ue** options. You can replace the **/ue** option with the **/ui** option to include, rather than exclude, the specified users. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                BehaviorCommand

                                Exclude the user named User One in the Corporate domain.

                                /ue:"corporate\user one"

                                Exclude the user named User1 in the Corporate domain.

                                /ue:corporate\user1

                                Exclude the local user named User1.

                                /ue:%computername%\user1

                                Exclude all domain users.

                                /ue:Domain

                                Exclude all local users.

                                /ue:%computername%

                                Exclude users in all domains named User1, User2, and so on.

                                /ue:\user

                                + + + +### Using the Options Together + +You can use the **/uel**, **/ue** and **/ui** options together to migrate only the users that you want migrated. + +**The /ui option has precedence over the /ue and /uel options.** If a user is specified to be included using the **/ui** option, and also specified to be excluded using either the **/ue** or **/uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the **/ui** option takes precedence over the **/ue** option. + +**The /uel option takes precedence over the /ue option.** If a user has logged on within the specified time period set by the **/uel** option, that user’s profile will be migrated even if they are excluded by using the **/ue** option. For example, if you specify `/ue:contoso\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                                BehaviorCommand

                                Include only User2 from the Fabrikam domain and exclude all other users.

                                /ue:* /ui:fabrikam\user2

                                Include only the local user named User1 and exclude all other users.

                                /ue:* /ui:user1

                                Include only the domain users from Contoso, except Contoso\User1.

                                This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:

                                +
                                  +

                                • Using the ScanState command-line tool, type: /ue:* /ui:contoso

                                  • +

                                • Using the LoadState command-line tool, type: /ue:contoso\user1

                                  • +

                                Include only local (non-domain) users.

                                /ue: /ui:%computername%*

                                + + + +## Incompatible Command-Line Options + + +The following table indicates which command-line options are not compatible with the **LoadState** command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options are not compatible. For example, you cannot use the **/nocompress** option with the **/encrypt** option. + + +++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-Line Option/keyfile/nocompress/genconfig/all

                                /i

                                /v

                                /nocompress

                                N/A

                                X

                                /key

                                X

                                X

                                /decrypt

                                Required*

                                X

                                X

                                /keyfile

                                N/A

                                X

                                /l

                                /progress

                                X

                                /r

                                X

                                /w

                                X

                                /c

                                X

                                /p

                                X

                                N/A

                                /all

                                X

                                /ui

                                X

                                X

                                /ue

                                X

                                X

                                /uel

                                X

                                X

                                /genconfig

                                N/A

                                /config

                                X

                                StorePath

                                /md

                                /mu

                                /lae

                                /lac

                                + + + +**Note** +You must specify either the **/key** or **/keyfile** option with the **/encrypt** option. + + + +## Related topics + + +[XML Elements Library](usmt-xml-elements-library.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-log-files.md b/windows/deployment/usmt/usmt-log-files.md index 3c71bf52ca..d9917d3495 100644 --- a/windows/deployment/usmt/usmt-log-files.md +++ b/windows/deployment/usmt/usmt-log-files.md @@ -2,9 +2,13 @@ title: Log Files (Windows 10) description: Log Files ms.assetid: 28185ebd-630a-4bbd-94f4-8c48aad05649 +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -45,22 +49,22 @@ The following table describes each command-line option related to logs, and it p -

                                /l[Path\]FileName

                                +

                                /l[Path]FileName

                                Scanstate.log or LoadState.log

                                Specifies the path and file name of the ScanState.log or LoadState log.

                                -

                                /progress[Path\]FileName

                                +

                                /progress[Path]FileName

                                Specifies the path and file name of the Progress log.

                                Provides information about the status of the migration, by percentage complete.

                                /v[VerbosityLevel]

                                Not applicable

                                -

                                See the "Monitoring Options" section in [ScanState Syntax](usmt-scanstate-syntax.md).

                                +

                                See the "Monitoring Options" section in ScanState Syntax.

                                -

                                /listfiles[Path\]FileName

                                +

                                /listfiles[Path]FileName

                                Specifies the path and file name of the Listfiles log.

                                Provides a list of the files that were migrated.

                                @@ -72,12 +76,12 @@ The following table describes each command-line option related to logs, and it p -  + **Note**   You cannot store any of the log files in *StorePath*. If you do, the log will be overwritten when USMT is run. -  + ## ScanState and LoadState Logs @@ -218,7 +222,7 @@ The remaining fields are key/value pairs as indicated in the following table. -  + ## List Files Log @@ -249,7 +253,7 @@ The following examples describe common scenarios in which you can use the diagno Let’s imagine that we have the following directory structure and that we want the “data” directory to be included in the migration along with the “New Text Document.txt” file in the “New Folder.” The directory of **C:\\data** contains: -``` syntax +``` 01/21/2009 10:08 PM . 01/21/2009 10:08 PM .. 01/21/2009 10:08 PM New Folder @@ -260,7 +264,7 @@ Let’s imagine that we have the following directory structure and that we want The directory of **C:\\data\\New Folder** contains: -``` syntax +``` 01/21/2009 10:08 PM . 01/21/2009 10:08 PM .. 01/21/2009 10:08 PM 0 New Text Document.txt @@ -269,7 +273,7 @@ The directory of **C:\\data\\New Folder** contains: To migrate these files you author the following migration XML: -``` syntax +```xml @@ -291,7 +295,7 @@ To migrate these files you author the following migration XML: However, upon testing the migration you notice that the “New Text Document.txt” file isn’t included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable MIG\_ENABLE\_DIAG set such that the diagnostic log is generated. Upon searching the diagnostic log for the component “DATA1”, the following XML section is discovered: -``` syntax +``` xml @@ -312,13 +316,13 @@ Analysis of this XML section reveals the migunit that was created when the migra An analysis of the XML elements reference topic reveals that the <pattern> tag needs to be modified as follows: -``` syntax +``` xml c:\data\* [*] ``` When the migration is preformed again with the modified tag, the diagnostic log reveals the following: -``` syntax +``` xml @@ -343,7 +347,7 @@ This diagnostic log confirms that the modified <pattern> value enables the In this scenario, you have the following directory structure and you want all files in the “data” directory to migrate, except for text files. The **C:\\Data** folder contains: -``` syntax +``` Directory of C:\Data 01/21/2009 10:08 PM . @@ -356,7 +360,7 @@ Directory of C:\Data The **C:\\Data\\New Folder\\** contains: -``` syntax +``` 01/21/2009 10:08 PM . 01/21/2009 10:08 PM .. 01/21/2009 10:08 PM 0 New Text Document.txt @@ -365,7 +369,7 @@ The **C:\\Data\\New Folder\\** contains: You author the following migration XML: -``` syntax +```xml @@ -393,7 +397,7 @@ You author the following migration XML: However, upon testing the migration you notice that all the text files are still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable MIG\_ENABLE\_DIAG set so that the diagnostic log is generated. Upon searching the diagnostic log for the component “DATA1”, the following XML section is discovered: -``` syntax +``` xml @@ -419,7 +423,7 @@ However, upon testing the migration you notice that all the text files are still Upon reviewing the diagnostic log, you confirm that the files are still migrating, and that it is a problem with the authored migration XML rule. You author an update to the migration XML script as follows: -``` syntax +```xml @@ -450,7 +454,7 @@ Upon reviewing the diagnostic log, you confirm that the files are still migratin Your revised migration XML script excludes the files from migrating, as confirmed in the diagnostic log: -``` syntax +``` xml @@ -480,9 +484,9 @@ Your revised migration XML script excludes the files from migrating, as confirme [LoadState Syntax](usmt-loadstate-syntax.md) -  + -  + diff --git a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md index c38ad5f818..706f2c6a6e 100644 --- a/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md +++ b/windows/deployment/usmt/usmt-migrate-efs-files-and-certificates.md @@ -1,52 +1,55 @@ ---- -title: Migrate EFS Files and Certificates (Windows 10) -description: Migrate EFS Files and Certificates -ms.assetid: 7f19a753-ec45-4433-b297-cc30f16fdee1 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migrate EFS Files and Certificates - - -This topic describes how to migrate Encrypting File System (EFS) certificates. For more information about the **/efs** For options, see [ScanState Syntax](usmt-scanstate-syntax.md). - -## To Migrate EFS Files and Certificates - - -Encrypting File System (EFS) certificates will be migrated automatically. However, by default, the User State Migration Tool (USMT) 10.0 fails if an encrypted file is found (unless you specify an **/efs** option). Therefore, you must specify **/efs:abort | skip | decryptcopy | copyraw | hardlink** with the ScanState command to migrate the encrypted files. Then, when you run the LoadState command on the destination computer, the encrypted file and the EFS certificate will be automatically migrated. - -**Note**   -The **/efs** options are not used with the LoadState command. - -  - -Before using the ScanState tool for a migration that includes encrypted files and EFS certificates, you must ensure that all files in an encrypted folder are encrypted as well or remove the encryption attribute from folders that contain unencrypted files. If the encryption attribute has been removed from a file but not from the parent folder, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. - -You can run the Cipher tool at a Windows command prompt to review and change encryption settings on files and folders. For example, to remove encryption from a folder, at a command prompt type: - -``` syntax -Cipher /D /S: -``` - -Where *<Path>* is the full path of the topmost parent directory where the encryption attribute is set. - -## Related topics - - -[What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) - -[Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md) - -  - -  - - - - - +--- +title: Migrate EFS Files and Certificates (Windows 10) +description: Migrate EFS Files and Certificates +ms.assetid: 7f19a753-ec45-4433-b297-cc30f16fdee1 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migrate EFS Files and Certificates + + +This topic describes how to migrate Encrypting File System (EFS) certificates. For more information about the **/efs** For options, see [ScanState Syntax](usmt-scanstate-syntax.md). + +## To Migrate EFS Files and Certificates + + +Encrypting File System (EFS) certificates will be migrated automatically. However, by default, the User State Migration Tool (USMT) 10.0 fails if an encrypted file is found (unless you specify an **/efs** option). Therefore, you must specify **/efs:abort | skip | decryptcopy | copyraw | hardlink** with the ScanState command to migrate the encrypted files. Then, when you run the LoadState command on the destination computer, the encrypted file and the EFS certificate will be automatically migrated. + +**Note**   +The **/efs** options are not used with the LoadState command. + + + +Before using the ScanState tool for a migration that includes encrypted files and EFS certificates, you must ensure that all files in an encrypted folder are encrypted as well or remove the encryption attribute from folders that contain unencrypted files. If the encryption attribute has been removed from a file but not from the parent folder, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. + +You can run the Cipher tool at a Windows command prompt to review and change encryption settings on files and folders. For example, to remove encryption from a folder, at a command prompt type: + +``` syntax +Cipher /D /S: +``` + +Where *<Path>* is the full path of the topmost parent directory where the encryption attribute is set. + +## Related topics + + +[What Does USMT Migrate?](usmt-what-does-usmt-migrate.md) + +[Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-migrate-user-accounts.md b/windows/deployment/usmt/usmt-migrate-user-accounts.md index 9fb4c1f48f..663964c7eb 100644 --- a/windows/deployment/usmt/usmt-migrate-user-accounts.md +++ b/windows/deployment/usmt/usmt-migrate-user-accounts.md @@ -1,93 +1,96 @@ ---- -title: Migrate User Accounts (Windows 10) -description: Migrate User Accounts -ms.assetid: a3668361-43c8-4fd2-b26e-9a2deaeaeb09 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migrate User Accounts - - -By default, all users are migrated. The only way to specify which users to include and exclude is on the command line by using the User options. You cannot specify users in the migration XML files or by using the Config.xml file. - -## In this Topic - - -- [To migrate all user accounts and user settings](#bkmk-migrateall) - -- [To migrate two domain accounts (User1 and User2)](#bkmk-migratetwo) - -- [To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain](#bkmk-migratemoveuserone) - -## To migrate all user accounts and user settings - - -1. Log on to the source computer as an administrator, and specify the following in a **Command-Prompt** window: - - `scanstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml /o` - -2. Log on to the destination computer as an administrator. - -3. Do one of the following: - - - If you are migrating domain accounts, specify: - - `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml` - - - If you are migrating local accounts along with domain accounts, specify: - - `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml /lac /lae` - - **Note**   - You do not have to specify the **/lae** option, which enables the account that was created with the **/lac** option. Instead, you can create a disabled local account by specifying only the **/lac** option, and then a local administrator needs to enable the account on the destination computer. - -   - -## To migrate two domain accounts (User1 and User2) - - -1. Log on to the source computer as an administrator, and specify: - - `scanstate \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:fabrikam\user2 /i:migdocs.xml /i:migapp.xml /o` - -2. Log on to the destination computer as an administrator. - -3. Specify the following: - - `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml` - -## To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain - - -1. Log on to the source computer as an administrator, and type the following at the command-line prompt: - - `scanstate \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:contoso\user2 /i:migdocs.xml /i:migapp.xml /o` - -2. Log on to the destination computer as an administrator. - -3. Specify the following: - - `loadstate \\server\share\migration\mystore /mu:contoso\user1:fabrikam\user2 /i:migdocs.xml /i:migapp.xml` - -## Related topics - - -[Identify Users](usmt-identify-users.md) - -[ScanState Syntax](usmt-scanstate-syntax.md) - -[LoadState Syntax](usmt-loadstate-syntax.md) - -  - -  - - - - - +--- +title: Migrate User Accounts (Windows 10) +description: Migrate User Accounts +ms.assetid: a3668361-43c8-4fd2-b26e-9a2deaeaeb09 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migrate User Accounts + + +By default, all users are migrated. The only way to specify which users to include and exclude is on the command line by using the User options. You cannot specify users in the migration XML files or by using the Config.xml file. + +## In this Topic + + +- [To migrate all user accounts and user settings](#bkmk-migrateall) + +- [To migrate two domain accounts (User1 and User2)](#bkmk-migratetwo) + +- [To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain](#bkmk-migratemoveuserone) + +## To migrate all user accounts and user settings +Links to detailed explanations of commands are available in the Related Topics section. + +1. Log on to the source computer as an administrator, and specify the following in a **Command-Prompt** window: + + `scanstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml /o` + +2. Log on to the destination computer as an administrator. + +3. Do one of the following: + + - If you are migrating domain accounts, specify: + + `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml` + + - If you are migrating local accounts along with domain accounts, specify: + + `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml /lac /lae` + + **Note**   + You do not have to specify the **/lae** option, which enables the account that was created with the **/lac** option. Instead, you can create a disabled local account by specifying only the **/lac** option, and then a local administrator needs to enable the account on the destination computer. + + + +## To migrate two domain accounts (User1 and User2) +Links to detailed explanations of commands are available in the Related Topics section. + +1. Log on to the source computer as an administrator, and specify: + + `scanstate \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:fabrikam\user2 /i:migdocs.xml /i:migapp.xml /o` + +2. Log on to the destination computer as an administrator. + +3. Specify the following: + + `loadstate \\server\share\migration\mystore /i:migdocs.xml /i:migapp.xml` + +## To migrate two domain accounts (User1 and User2) and move User1 from the Contoso domain to the Fabrikam domain +Links to detailed explanations of commands are available in the Related Topics section. + +1. Log on to the source computer as an administrator, and type the following at the command-line prompt: + + `scanstate \\server\share\migration\mystore /ue:*\* /ui:contoso\user1 /ui:contoso\user2 /i:migdocs.xml /i:migapp.xml /o` + +2. Log on to the destination computer as an administrator. + +3. Specify the following: + + `loadstate \\server\share\migration\mystore /mu:contoso\user1:fabrikam\user2 /i:migdocs.xml /i:migapp.xml` + +## Related topics + + +[Identify Users](usmt-identify-users.md) + +[ScanState Syntax](usmt-scanstate-syntax.md) + +[LoadState Syntax](usmt-loadstate-syntax.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-migration-store-encryption.md b/windows/deployment/usmt/usmt-migration-store-encryption.md index a177f4bccb..8ef1ea7592 100644 --- a/windows/deployment/usmt/usmt-migration-store-encryption.md +++ b/windows/deployment/usmt/usmt-migration-store-encryption.md @@ -1,73 +1,76 @@ ---- -title: Migration Store Encryption (Windows 10) -description: Migration Store Encryption -ms.assetid: b28c2657-b986-4487-bd38-cb81500b831d -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Migration Store Encryption - - -This topic discusses User State Migration Tool (USMT) 10.0 options for migration store encryption to protect the integrity of user data during a migration. - -## USMT Encryption Options - - -USMT enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES), in several bit-level options. AES is a National Institute of Standards and Technology (NIST) specification for the encryption of electronic data. - -The encryption algorithm you choose must be specified for both the **ScanState** and the **LoadState** commands, so that these commands can create or read the store during encryption and decryption. The new encryption algorithms can be specified on the **ScanState** and the **LoadState** command lines by using the **/encrypt**:*"encryptionstrength"* and the **/decrypt**:*"encryptionstrength"* command-line options. All of the encryption application programming interfaces (APIs) used by USMT are available in Windows 7, Windows 8, and Windows 10 operating systems. However, export restrictions might limit the set of algorithms that are available to computers in certain locales. You can use the Usmtutils.exe file to determine which encryption algorithms are available to the computers' locales before you begin the migration. - -The following table describes the command-line encryption options in USMT. - - ----- - - - - - - - - - - - - - - - - - - - -
                                ComponentOptionDescription

                                ScanState

                                /encrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

                                This option and argument specify that the migration store is encrypted and which algorithm to use. When the algorithm argument is not provided, the ScanState tool employs the 3DES algorithm.

                                LoadState

                                /decrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

                                This option and argument specify that the store must be decrypted and which algorithm to use. When the algorithm argument is not provided, the LoadState tool employs the 3DES algorithm.

                                - -  - -**Important**   -Some encryption algorithms may not be available on your systems. You can verify which algorithms are available by running the UsmtUtils command with the **/ec** option. For more information see [UsmtUtils Syntax](usmt-utilities.md) - -  - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md) - -  - -  - - - - - +--- +title: Migration Store Encryption (Windows 10) +description: Migration Store Encryption +ms.assetid: b28c2657-b986-4487-bd38-cb81500b831d +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Migration Store Encryption + + +This topic discusses User State Migration Tool (USMT) 10.0 options for migration store encryption to protect the integrity of user data during a migration. + +## USMT Encryption Options + + +USMT enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES), in several bit-level options. AES is a National Institute of Standards and Technology (NIST) specification for the encryption of electronic data. + +The encryption algorithm you choose must be specified for both the **ScanState** and the **LoadState** commands, so that these commands can create or read the store during encryption and decryption. The new encryption algorithms can be specified on the **ScanState** and the **LoadState** command lines by using the **/encrypt**:*"encryptionstrength"* and the **/decrypt**:*"encryptionstrength"* command-line options. All of the encryption application programming interfaces (APIs) used by USMT are available in Windows 7, Windows 8, and Windows 10 operating systems. However, export restrictions might limit the set of algorithms that are available to computers in certain locales. You can use the Usmtutils.exe file to determine which encryption algorithms are available to the computers' locales before you begin the migration. + +The following table describes the command-line encryption options in USMT. + + +++++ + + + + + + + + + + + + + + + + + + + +
                                ComponentOptionDescription

                                ScanState

                                /encrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

                                This option and argument specify that the migration store is encrypted and which algorithm to use. When the algorithm argument is not provided, the ScanState tool employs the 3DES algorithm.

                                LoadState

                                /decrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

                                This option and argument specify that the store must be decrypted and which algorithm to use. When the algorithm argument is not provided, the LoadState tool employs the 3DES algorithm.

                                + + + +**Important**   +Some encryption algorithms may not be available on your systems. You can verify which algorithms are available by running the UsmtUtils command with the **/ec** option. For more information see [UsmtUtils Syntax](usmt-utilities.md) + + + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-overview.md b/windows/deployment/usmt/usmt-overview.md index 6cd2240e96..6d80871901 100644 --- a/windows/deployment/usmt/usmt-overview.md +++ b/windows/deployment/usmt/usmt-overview.md @@ -1,57 +1,60 @@ ---- -title: User State Migration Tool (USMT) Overview (Windows 10) -description: User State Migration Tool (USMT) Overview -ms.assetid: 3b649431-ad09-4b17-895a-3fec7ac0a81f -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 10/16/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) Overview -You can use User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems. USMT captures user accounts, user files, operating system settings, and application settings, and then migrates them to a new Windows installation. You can use USMT for both PC replacement and PC refresh migrations. For more information, see [Common Migration Scenarios](usmt-common-migration-scenarios.md). - -USMT enables you to do the following: - -- Configure your migration according to your business needs by using the migration rule (.xml) files to control exactly which files and settings are migrated and how they are migrated. For more information about how to modify these files, see [USMT XML Reference](usmt-xml-reference.md). - -- Fit your customized migration into your automated deployment process by using the ScanState and LoadState tools, which control collecting and restoring the user files and settings. For more information, see [User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md). - -- Perform offline migrations. You can run migrations offline by using the ScanState command in Windows Preinstallation Environment (WinPE) or you can perform migrations from previous installations of Windows contained in Windows.old directories. For more information about migration types, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md) and [Offline Migration Reference](offline-migration-reference.md). - -## Benefits -USMT provides the following benefits to businesses that are deploying Windows operating systems: - -- Safely migrates user accounts, operating system and application settings. - -- Lowers the cost of deploying Windows by preserving user state. - -- Reduces end-user downtime required to customize desktops and find missing files. - -- Reduces help-desk calls. - -- Reduces the time needed for the user to become familiar with the new operating system. - -- Increases employee satisfaction with the migration experience. - -## Limitations -USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can use [PCmover Express](https://go.microsoft.com/fwlink/?linkid=620915). PCmover Express is a tool created by Microsoft's partner, Laplink. - -There are some scenarios in which the use of USMT is not recommended. These include: - -- Migrations that require end-user interaction. - -- Migrations that require customization on a machine-by-machine basis. - -## Related topics -- [User State Migration Tool (USMT) Technical Reference](usmt-technical-reference.md) - - -  - - - - - +--- +title: User State Migration Tool (USMT) Overview (Windows 10) +description: User State Migration Tool (USMT) Overview +ms.assetid: 3b649431-ad09-4b17-895a-3fec7ac0a81f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 10/16/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) Overview +You can use User State Migration Tool (USMT) 10.0 to streamline and simplify user state migration during large deployments of Windows operating systems. USMT captures user accounts, user files, operating system settings, and application settings, and then migrates them to a new Windows installation. You can use USMT for both PC replacement and PC refresh migrations. For more information, see [Common Migration Scenarios](usmt-common-migration-scenarios.md). + +USMT enables you to do the following: + +- Configure your migration according to your business needs by using the migration rule (.xml) files to control exactly which files and settings are migrated and how they are migrated. For more information about how to modify these files, see [USMT XML Reference](usmt-xml-reference.md). + +- Fit your customized migration into your automated deployment process by using the ScanState and LoadState tools, which control collecting and restoring the user files and settings. For more information, see [User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md). + +- Perform offline migrations. You can run migrations offline by using the ScanState command in Windows Preinstallation Environment (WinPE) or you can perform migrations from previous installations of Windows contained in Windows.old directories. For more information about migration types, see [Choose a Migration Store Type](usmt-choose-migration-store-type.md) and [Offline Migration Reference](offline-migration-reference.md). + +## Benefits +USMT provides the following benefits to businesses that are deploying Windows operating systems: + +- Safely migrates user accounts, operating system and application settings. + +- Lowers the cost of deploying Windows by preserving user state. + +- Reduces end-user downtime required to customize desktops and find missing files. + +- Reduces help-desk calls. + +- Reduces the time needed for the user to become familiar with the new operating system. + +- Increases employee satisfaction with the migration experience. + +## Limitations +USMT is intended for administrators who are performing large-scale automated deployments. If you are only migrating the user states of a few computers, you can use [PCmover Express](https://go.microsoft.com/fwlink/?linkid=620915). PCmover Express is a tool created by Microsoft's partner, Laplink. + +There are some scenarios in which the use of USMT is not recommended. These include: + +- Migrations that require end-user interaction. + +- Migrations that require customization on a machine-by-machine basis. + +## Related topics +- [User State Migration Tool (USMT) Technical Reference](usmt-technical-reference.md) + + +  + + + + + diff --git a/windows/deployment/usmt/usmt-plan-your-migration.md b/windows/deployment/usmt/usmt-plan-your-migration.md index aabd7f7072..1fa60664bd 100644 --- a/windows/deployment/usmt/usmt-plan-your-migration.md +++ b/windows/deployment/usmt/usmt-plan-your-migration.md @@ -1,68 +1,71 @@ ---- -title: Plan Your Migration (Windows 10) -description: Plan Your Migration -ms.assetid: c951f7df-850e-47ad-b31b-87f902955e3e -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Plan Your Migration - - -Before you use the User State Migration Tool (USMT) 10.0 to perform your migration, we recommend that you plan your migration carefully. Planning can help your migration proceed smoothly and can reduce the risk of migration failure. - -In migration planning, both organizations and individuals must first identify what to migrate, including user settings, applications and application settings, and personal data files and folders. Identifying the applications to migrate is especially important so that you can avoid capturing data about applications that may be phased out. - -One of the most important requirements for migrating settings and data is restoring only the information that the destination computer requires. Although the data that you capture on the source computer may be more comprehensive than the restoration data for backup purposes, restoring data or settings for applications that you will not install on the destination system is redundant. This can also introduce instability in a newly deployed computer. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - - - - - -

                                [Common Migration Scenarios](usmt-common-migration-scenarios.md)

                                Determine whether you will perform a refresh migration or a replace migration.

                                [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md)

                                Learn which applications, user data, and operating system components USMT migrates.

                                [Choose a Migration Store Type](usmt-choose-migration-store-type.md)

                                Choose an uncompressed, compressed, or hard-link migration store.

                                [Determine What to Migrate](usmt-determine-what-to-migrate.md)

                                Identify user accounts, application settings, operating system settings, and files that you want to migrate inside your organization.

                                [Test Your Migration](usmt-test-your-migration.md)

                                Test your migration before you deploy Windows to all users.

                                - -  - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - -  - -  - - - - - +--- +title: Plan Your Migration (Windows 10) +description: Plan Your Migration +ms.assetid: c951f7df-850e-47ad-b31b-87f902955e3e +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Plan Your Migration + + +Before you use the User State Migration Tool (USMT) 10.0 to perform your migration, we recommend that you plan your migration carefully. Planning can help your migration proceed smoothly and can reduce the risk of migration failure. + +In migration planning, both organizations and individuals must first identify what to migrate, including user settings, applications and application settings, and personal data files and folders. Identifying the applications to migrate is especially important so that you can avoid capturing data about applications that may be phased out. + +One of the most important requirements for migrating settings and data is restoring only the information that the destination computer requires. Although the data that you capture on the source computer may be more comprehensive than the restoration data for backup purposes, restoring data or settings for applications that you will not install on the destination system is redundant. This can also introduce instability in a newly deployed computer. + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + +

                                Common Migration Scenarios

                                Determine whether you will perform a refresh migration or a replace migration.

                                What Does USMT Migrate?

                                Learn which applications, user data, and operating system components USMT migrates.

                                Choose a Migration Store Type

                                Choose an uncompressed, compressed, or hard-link migration store.

                                Determine What to Migrate

                                Identify user accounts, application settings, operating system settings, and files that you want to migrate inside your organization.

                                Test Your Migration

                                Test your migration before you deploy Windows to all users.

                                + + + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-recognized-environment-variables.md b/windows/deployment/usmt/usmt-recognized-environment-variables.md index 7012dc5ff6..d2862feb9a 100644 --- a/windows/deployment/usmt/usmt-recognized-environment-variables.md +++ b/windows/deployment/usmt/usmt-recognized-environment-variables.md @@ -1,467 +1,470 @@ ---- -title: Recognized Environment Variables (Windows 10) -description: Recognized Environment Variables -ms.assetid: 2b0ac412-e131-456e-8f0c-c26249b5f3df -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Recognized Environment Variables - - -When using the XML files MigDocs.xml, MigApp.xml, and MigUser.xml, you can use environment variables to identify folders that may be different on different computers. Constant special item ID list (CSIDL) values provide a way to identify folders that applications use frequently but may not have the same name or location on any given computer. For example, the documents folder may be C:\\Users\\<Username>\\My Documents on one computer and C:\\Documents and Settings on another. You can use the asterisk (\*) wildcard character in MigUser.xml, MigApp.xml and MigDoc.xml files. However, you cannot use the asterisk (\*) wildcard characters in the Config.xml file. - -## In This Topic - - -- [Variables that are processed for the operating system and in the context of each user](#bkmk-1) - -- [Variables that are recognized only in the user context](#bkmk-2) - -## Variables that are processed for the operating system and in the context of each user - - -You can use these variables within sections in the .xml files with `context=UserAndSystem`, `context=User`, and `context=System`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                VariableExplanation

                                ALLUSERSAPPDATA

                                Same as CSIDL_COMMON_APPDATA.

                                ALLUSERSPROFILE

                                Refers to %PROFILESFOLDER%\Public or %PROFILESFOLDER%\all users.

                                COMMONPROGRAMFILES

                                Same as CSIDL_PROGRAM_FILES_COMMON.

                                COMMONPROGRAMFILES(X86)

                                Refers to the C:\Program Files (x86)\Common Files folder on 64-bit systems.

                                CSIDL_COMMON_ADMINTOOLS

                                Version 10.0. The file-system directory that contains administrative tools for all users of the computer.

                                CSIDL_COMMON_ALTSTARTUP

                                The file-system directory that corresponds to the non-localized Startup program group for all users.

                                CSIDL_COMMON_APPDATA

                                The file-system directory that contains application data for all users. A typical path Windows is C:\ProgramData.

                                CSIDL_COMMON_DESKTOPDIRECTORY

                                The file-system directory that contains files and folders that appear on the desktop for all users. A typical Windows® XP path is C:\Documents and Settings\All Users\Desktop. A typical path is C:\Users\Public\Desktop.

                                CSIDL_COMMON_DOCUMENTS

                                The file-system directory that contains documents that are common to all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Documents. A typical path is C:\Users\Public\Documents.

                                CSIDL_COMMON_FAVORITES

                                The file-system directory that serves as a common repository for favorites common to all users. A typical path is C:\Users\Public\Favorites.

                                CSIDL_COMMON_MUSIC

                                The file-system directory that serves as a repository for music files common to all users. A typical path is C:\Users\Public\Music.

                                CSIDL_COMMON_PICTURES

                                The file-system directory that serves as a repository for image files common to all users. A typical path is C:\Users\Public\Pictures.

                                CSIDL_COMMON_PROGRAMS

                                The file-system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs.

                                CSIDL_COMMON_STARTMENU

                                The file-system directory that contains the programs and folders which appear on the Start menu for all users. A typical path in Windows is C:\ProgramData\Microsoft\Windows\Start Menu.

                                CSIDL_COMMON_STARTUP

                                The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.

                                CSIDL_COMMON_TEMPLATES

                                The file-system directory that contains the templates that are available to all users. A typical path is C:\ProgramData\Microsoft\Windows\Templates.

                                CSIDL_COMMON_VIDEO

                                The file-system directory that serves as a repository for video files common to all users. A typical path is C:\Users\Public\Videos.

                                CSIDL_DEFAULT_APPDATA

                                Refers to the Appdata folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_LOCAL_APPDATA

                                Refers to the local Appdata folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_COOKIES

                                Refers to the Cookies folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_CONTACTS

                                Refers to the Contacts folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_DESKTOP

                                Refers to the Desktop folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_DOWNLOADS

                                Refers to the Downloads folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_FAVORITES

                                Refers to the Favorites folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_HISTORY

                                Refers to the History folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_INTERNET_CACHE

                                Refers to the Internet Cache folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_PERSONAL

                                Refers to the Personal folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_MYDOCUMENTS

                                Refers to the My Documents folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_MYPICTURES

                                Refers to the My Pictures folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_MYMUSIC

                                Refers to the My Music folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_MYVIDEO

                                Refers to the My Videos folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_RECENT

                                Refers to the Recent folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_SENDTO

                                Refers to the Send To folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_STARTMENU

                                Refers to the Start Menu folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_PROGRAMS

                                Refers to the Programs folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_STARTUP

                                Refers to the Startup folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_TEMPLATES

                                Refers to the Templates folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_QUICKLAUNCH

                                Refers to the Quick Launch folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_FONTS

                                A virtual folder containing fonts. A typical path is C:\Windows\Fonts.

                                CSIDL_PROGRAM_FILESX86

                                The Program Files folder on 64-bit systems. A typical path is C:\Program Files(86).

                                CSIDL_PROGRAM_FILES_COMMONX86

                                A folder for components that are shared across applications on 64-bit systems. A typical path is C:\Program Files(86)\Common.

                                CSIDL_PROGRAM_FILES

                                The Program Files folder. A typical path is C:\Program Files.

                                CSIDL_PROGRAM_FILES_COMMON

                                A folder for components that are shared across applications. A typical path is C:\Program Files\Common.

                                CSIDL_RESOURCES

                                The file-system directory that contains resource data. A typical path is C:\Windows\Resources.

                                CSIDL_SYSTEM

                                The Windows System folder. A typical path is C:\Windows\System32.

                                CSIDL_WINDOWS

                                The Windows directory or system root. This corresponds to the %WINDIR% or %SYSTEMROOT% environment variables. A typical path is C:\Windows.

                                DEFAULTUSERPROFILE

                                Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [DefaultUserProfile].

                                PROFILESFOLDER

                                Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [ProfilesDirectory].

                                PROGRAMFILES

                                Same as CSIDL_PROGRAM_FILES.

                                PROGRAMFILES(X86)

                                Refers to the C:\Program Files (x86) folder on 64-bit systems.

                                SYSTEM

                                Refers to %WINDIR%\system32.

                                SYSTEM16

                                Refers to %WINDIR%\system.

                                SYSTEM32

                                Refers to %WINDIR%\system32.

                                SYSTEMPROFILE

                                Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 [ProfileImagePath].

                                SYSTEMROOT

                                Refers to the root of the system drive.

                                WINDIR

                                Refers to the Windows folder located on the system drive.

                                - -  - -## Variables that are recognized only in the user context - - -You can use these variables in the .xml files within sections with `context=User` and `context=UserAndSystem`. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                VariableExplanation

                                APPDATA

                                Same as CSIDL_APPDATA.

                                CSIDL_ADMINTOOLS

                                The file-system directory that is used to store administrative tools for an individual user. The Microsoft® Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.

                                CSIDL_ALTSTARTUP

                                The file-system directory that corresponds to the user's non-localized Startup program group.

                                CSIDL_APPDATA

                                The file-system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\username\Application Data or C:\Users\username\AppData\Roaming.

                                CSIDL_BITBUCKET

                                The virtual folder that contains the objects in the user's Recycle Bin.

                                CSIDL_CDBURN_AREA

                                The file-system directory acting as a staging area for files waiting to be written to CD. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\MasteredBurning\Disc Burning.

                                CSIDL_CONNECTIONS

                                The virtual folder representing Network Connections that contains network and dial-up connections.

                                CSIDL_CONTACTS

                                This refers to the Contacts folder in %CSIDL_PROFILE%.

                                CSIDL_CONTROLS

                                The virtual folder that contains icons for the Control Panel items.

                                CSIDL_COOKIES

                                The file-system directory that serves as a common repository for Internet cookies. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies.

                                CSIDL_DESKTOP

                                The virtual folder representing the Windows desktop.

                                CSIDL_DESKTOPDIRECTORY

                                The file-system directory used to physically store file objects on the desktop, which should not be confused with the desktop folder itself. A typical path is C:\Users\username\Desktop.

                                CSIDL_DRIVES

                                The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.

                                CSIDL_FAVORITES

                                The file-system directory that serves as a common repository for the user's favorites. A typical path is C:\Users\Username\Favorites.

                                CSIDL_HISTORY

                                The file-system directory that serves as a common repository for Internet history items.

                                CSIDL_INTERNET

                                A virtual folder for Internet Explorer.

                                CSIDL_INTERNET_CACHE

                                The file-system directory that serves as a common repository for temporary Internet files. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files

                                CSIDL_LOCAL_APPDATA

                                The file-system directory that serves as a data repository for local, non-roaming applications. A typical path is C:\Users\username\AppData\Local.

                                CSIDL_MYDOCUMENTS

                                The virtual folder representing My Documents.A typical path is C:\Users\Username\Documents.

                                CSIDL_MYMUSIC

                                The file-system directory that serves as a common repository for music files. A typical path is C:\Users\Username\Music.

                                CSIDL_MYPICTURES

                                The file-system directory that serves as a common repository for image files. A typical path is C:\Users\Username\Pictures.

                                CSIDL_MYVIDEO

                                The file-system directory that serves as a common repository for video files. A typical path is C:\Users\Username\Videos.

                                CSIDL_NETHOOD

                                A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.

                                CSIDL_NETWORK

                                A virtual folder representing My Network Places, the root of the network namespace hierarchy.

                                CSIDL_PERSONAL

                                The virtual folder representing the My Documents desktop item. This is equivalent to CSIDL_MYDOCUMENTS.

                                -

                                A typical path is C:\Documents and Settings\username\My Documents.

                                CSIDL_PLAYLISTS

                                The virtual folder used to store play albums, typically C:\Users\username\My Music\Playlists.

                                CSIDL_PRINTERS

                                The virtual folder that contains installed printers.

                                CSIDL_PRINTHOOD

                                The file-system directory that contains the link objects that can exist in the Printers virtual folder. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Printer Shortcuts.

                                CSIDL_PROFILE

                                The user's profile folder. A typical path is C:\Users\Username.

                                CSIDL_PROGRAMS

                                The file-system directory that contains the user's program groups, which are themselves file-system directories. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs.

                                CSIDL_RECENT

                                The file-system directory that contains shortcuts to the user's most recently used documents. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent.

                                CSIDL_SENDTO

                                The file-system directory that contains Send To menu items. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\SendTo.

                                CSIDL_STARTMENU

                                The file-system directory that contains Start menu items. A typical path in Windows XP is C:\Documents and Settings\username\Start Menu. A typical path in Windows Vista, Windows 7, or Windows 8 is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu.

                                CSIDL_STARTUP

                                The file-system directory that corresponds to the user's Startup program group. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

                                CSIDL_TEMPLATES

                                The file-system directory that serves as a common repository for document templates. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Templates.

                                HOMEPATH

                                Same as the standard environment variable.

                                TEMP

                                The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

                                TMP

                                The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

                                USERPROFILE

                                Same as CSIDL_PROFILE.

                                USERSID

                                Represents the current user-account security identifier (SID). For example,

                                -

                                S-1-5-21-1714567821-1326601894-715345443-1026.

                                - -  - -## Related topics - - -[USMT XML Reference](usmt-xml-reference.md) - -  - -  - - - - - +--- +title: Recognized Environment Variables (Windows 10) +description: Recognized Environment Variables +ms.assetid: 2b0ac412-e131-456e-8f0c-c26249b5f3df +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Recognized Environment Variables + + +When using the XML files MigDocs.xml, MigApp.xml, and MigUser.xml, you can use environment variables to identify folders that may be different on different computers. Constant special item ID list (CSIDL) values provide a way to identify folders that applications use frequently but may not have the same name or location on any given computer. For example, the documents folder may be C:\\Users\\<Username>\\My Documents on one computer and C:\\Documents and Settings on another. You can use the asterisk (\*) wildcard character in MigUser.xml, MigApp.xml and MigDoc.xml files. However, you cannot use the asterisk (\*) wildcard characters in the Config.xml file. + +## In This Topic + + +- [Variables that are processed for the operating system and in the context of each user](#bkmk-1) + +- [Variables that are recognized only in the user context](#bkmk-2) + +## Variables that are processed for the operating system and in the context of each user + + +You can use these variables within sections in the .xml files with `context=UserAndSystem`, `context=User`, and `context=System`. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                VariableExplanation

                                ALLUSERSAPPDATA

                                Same as CSIDL_COMMON_APPDATA.

                                ALLUSERSPROFILE

                                Refers to %PROFILESFOLDER%\Public or %PROFILESFOLDER%\all users.

                                COMMONPROGRAMFILES

                                Same as CSIDL_PROGRAM_FILES_COMMON.

                                COMMONPROGRAMFILES(X86)

                                Refers to the C:\Program Files (x86)\Common Files folder on 64-bit systems.

                                CSIDL_COMMON_ADMINTOOLS

                                Version 10.0. The file-system directory that contains administrative tools for all users of the computer.

                                CSIDL_COMMON_ALTSTARTUP

                                The file-system directory that corresponds to the non-localized Startup program group for all users.

                                CSIDL_COMMON_APPDATA

                                The file-system directory that contains application data for all users. A typical path Windows is C:\ProgramData.

                                CSIDL_COMMON_DESKTOPDIRECTORY

                                The file-system directory that contains files and folders that appear on the desktop for all users. A typical Windows® XP path is C:\Documents and Settings\All Users\Desktop. A typical path is C:\Users\Public\Desktop.

                                CSIDL_COMMON_DOCUMENTS

                                The file-system directory that contains documents that are common to all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Documents. A typical path is C:\Users\Public\Documents.

                                CSIDL_COMMON_FAVORITES

                                The file-system directory that serves as a common repository for favorites common to all users. A typical path is C:\Users\Public\Favorites.

                                CSIDL_COMMON_MUSIC

                                The file-system directory that serves as a repository for music files common to all users. A typical path is C:\Users\Public\Music.

                                CSIDL_COMMON_PICTURES

                                The file-system directory that serves as a repository for image files common to all users. A typical path is C:\Users\Public\Pictures.

                                CSIDL_COMMON_PROGRAMS

                                The file-system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs.

                                CSIDL_COMMON_STARTMENU

                                The file-system directory that contains the programs and folders which appear on the Start menu for all users. A typical path in Windows is C:\ProgramData\Microsoft\Windows\Start Menu.

                                CSIDL_COMMON_STARTUP

                                The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.

                                CSIDL_COMMON_TEMPLATES

                                The file-system directory that contains the templates that are available to all users. A typical path is C:\ProgramData\Microsoft\Windows\Templates.

                                CSIDL_COMMON_VIDEO

                                The file-system directory that serves as a repository for video files common to all users. A typical path is C:\Users\Public\Videos.

                                CSIDL_DEFAULT_APPDATA

                                Refers to the Appdata folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_LOCAL_APPDATA

                                Refers to the local Appdata folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_COOKIES

                                Refers to the Cookies folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_CONTACTS

                                Refers to the Contacts folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_DESKTOP

                                Refers to the Desktop folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_DOWNLOADS

                                Refers to the Downloads folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_FAVORITES

                                Refers to the Favorites folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_HISTORY

                                Refers to the History folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_INTERNET_CACHE

                                Refers to the Internet Cache folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_PERSONAL

                                Refers to the Personal folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_MYDOCUMENTS

                                Refers to the My Documents folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_MYPICTURES

                                Refers to the My Pictures folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_MYMUSIC

                                Refers to the My Music folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_MYVIDEO

                                Refers to the My Videos folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_RECENT

                                Refers to the Recent folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_SENDTO

                                Refers to the Send To folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_STARTMENU

                                Refers to the Start Menu folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_PROGRAMS

                                Refers to the Programs folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_STARTUP

                                Refers to the Startup folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_TEMPLATES

                                Refers to the Templates folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_DEFAULT_QUICKLAUNCH

                                Refers to the Quick Launch folder inside %DEFAULTUSERPROFILE%.

                                CSIDL_FONTS

                                A virtual folder containing fonts. A typical path is C:\Windows\Fonts.

                                CSIDL_PROGRAM_FILESX86

                                The Program Files folder on 64-bit systems. A typical path is C:\Program Files(86).

                                CSIDL_PROGRAM_FILES_COMMONX86

                                A folder for components that are shared across applications on 64-bit systems. A typical path is C:\Program Files(86)\Common.

                                CSIDL_PROGRAM_FILES

                                The Program Files folder. A typical path is C:\Program Files.

                                CSIDL_PROGRAM_FILES_COMMON

                                A folder for components that are shared across applications. A typical path is C:\Program Files\Common.

                                CSIDL_RESOURCES

                                The file-system directory that contains resource data. A typical path is C:\Windows\Resources.

                                CSIDL_SYSTEM

                                The Windows System folder. A typical path is C:\Windows\System32.

                                CSIDL_WINDOWS

                                The Windows directory or system root. This corresponds to the %WINDIR% or %SYSTEMROOT% environment variables. A typical path is C:\Windows.

                                DEFAULTUSERPROFILE

                                Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [DefaultUserProfile].

                                PROFILESFOLDER

                                Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [ProfilesDirectory].

                                PROGRAMFILES

                                Same as CSIDL_PROGRAM_FILES.

                                PROGRAMFILES(X86)

                                Refers to the C:\Program Files (x86) folder on 64-bit systems.

                                SYSTEM

                                Refers to %WINDIR%\system32.

                                SYSTEM16

                                Refers to %WINDIR%\system.

                                SYSTEM32

                                Refers to %WINDIR%\system32.

                                SYSTEMPROFILE

                                Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 [ProfileImagePath].

                                SYSTEMROOT

                                Refers to the root of the system drive.

                                WINDIR

                                Refers to the Windows folder located on the system drive.

                                + +  + +## Variables that are recognized only in the user context + + +You can use these variables in the .xml files within sections with `context=User` and `context=UserAndSystem`. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                VariableExplanation

                                APPDATA

                                Same as CSIDL_APPDATA.

                                CSIDL_ADMINTOOLS

                                The file-system directory that is used to store administrative tools for an individual user. The Microsoft® Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.

                                CSIDL_ALTSTARTUP

                                The file-system directory that corresponds to the user's non-localized Startup program group.

                                CSIDL_APPDATA

                                The file-system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\username\Application Data or C:\Users\username\AppData\Roaming.

                                CSIDL_BITBUCKET

                                The virtual folder that contains the objects in the user's Recycle Bin.

                                CSIDL_CDBURN_AREA

                                The file-system directory acting as a staging area for files waiting to be written to CD. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\MasteredBurning\Disc Burning.

                                CSIDL_CONNECTIONS

                                The virtual folder representing Network Connections that contains network and dial-up connections.

                                CSIDL_CONTACTS

                                This refers to the Contacts folder in %CSIDL_PROFILE%.

                                CSIDL_CONTROLS

                                The virtual folder that contains icons for the Control Panel items.

                                CSIDL_COOKIES

                                The file-system directory that serves as a common repository for Internet cookies. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies.

                                CSIDL_DESKTOP

                                The virtual folder representing the Windows desktop.

                                CSIDL_DESKTOPDIRECTORY

                                The file-system directory used to physically store file objects on the desktop, which should not be confused with the desktop folder itself. A typical path is C:\Users\username\Desktop.

                                CSIDL_DRIVES

                                The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.

                                CSIDL_FAVORITES

                                The file-system directory that serves as a common repository for the user's favorites. A typical path is C:\Users\Username\Favorites.

                                CSIDL_HISTORY

                                The file-system directory that serves as a common repository for Internet history items.

                                CSIDL_INTERNET

                                A virtual folder for Internet Explorer.

                                CSIDL_INTERNET_CACHE

                                The file-system directory that serves as a common repository for temporary Internet files. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files

                                CSIDL_LOCAL_APPDATA

                                The file-system directory that serves as a data repository for local, non-roaming applications. A typical path is C:\Users\username\AppData\Local.

                                CSIDL_MYDOCUMENTS

                                The virtual folder representing My Documents.A typical path is C:\Users\Username\Documents.

                                CSIDL_MYMUSIC

                                The file-system directory that serves as a common repository for music files. A typical path is C:\Users\Username\Music.

                                CSIDL_MYPICTURES

                                The file-system directory that serves as a common repository for image files. A typical path is C:\Users\Username\Pictures.

                                CSIDL_MYVIDEO

                                The file-system directory that serves as a common repository for video files. A typical path is C:\Users\Username\Videos.

                                CSIDL_NETHOOD

                                A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.

                                CSIDL_NETWORK

                                A virtual folder representing My Network Places, the root of the network namespace hierarchy.

                                CSIDL_PERSONAL

                                The virtual folder representing the My Documents desktop item. This is equivalent to CSIDL_MYDOCUMENTS.

                                +

                                A typical path is C:\Documents and Settings\username\My Documents.

                                CSIDL_PLAYLISTS

                                The virtual folder used to store play albums, typically C:\Users\username\My Music\Playlists.

                                CSIDL_PRINTERS

                                The virtual folder that contains installed printers.

                                CSIDL_PRINTHOOD

                                The file-system directory that contains the link objects that can exist in the Printers virtual folder. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Printer Shortcuts.

                                CSIDL_PROFILE

                                The user's profile folder. A typical path is C:\Users\Username.

                                CSIDL_PROGRAMS

                                The file-system directory that contains the user's program groups, which are themselves file-system directories. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs.

                                CSIDL_RECENT

                                The file-system directory that contains shortcuts to the user's most recently used documents. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent.

                                CSIDL_SENDTO

                                The file-system directory that contains Send To menu items. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\SendTo.

                                CSIDL_STARTMENU

                                The file-system directory that contains Start menu items. A typical path in Windows XP is C:\Documents and Settings\username\Start Menu. A typical path in Windows Vista, Windows 7, or Windows 8 is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu.

                                CSIDL_STARTUP

                                The file-system directory that corresponds to the user's Startup program group. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

                                CSIDL_TEMPLATES

                                The file-system directory that serves as a common repository for document templates. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Templates.

                                HOMEPATH

                                Same as the standard environment variable.

                                TEMP

                                The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

                                TMP

                                The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

                                USERPROFILE

                                Same as CSIDL_PROFILE.

                                USERSID

                                Represents the current user-account security identifier (SID). For example,

                                +

                                S-1-5-21-1714567821-1326601894-715345443-1026.

                                + +  + +## Related topics + + +[USMT XML Reference](usmt-xml-reference.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-reference.md b/windows/deployment/usmt/usmt-reference.md index 6472bb3b6a..c5bcd4193c 100644 --- a/windows/deployment/usmt/usmt-reference.md +++ b/windows/deployment/usmt/usmt-reference.md @@ -1,74 +1,77 @@ ---- -title: User State Migration Toolkit (USMT) Reference (Windows 10) -description: User State Migration Toolkit (USMT) Reference -ms.assetid: 2135dbcf-de49-4cea-b2fb-97dd016e1a1a -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Toolkit (USMT) Reference - - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                                [USMT Requirements](usmt-requirements.md)

                                Describes operating system, hardware, and software requirements, and user prerequisites.

                                [USMT Best Practices](usmt-best-practices.md)

                                Discusses general and security-related best practices when using USMT.

                                [How USMT Works](usmt-how-it-works.md)

                                Learn about the processes behind the ScanState and LoadState tools.

                                [Plan Your Migration](usmt-plan-your-migration.md)

                                Choose what to migrate and the best migration scenario for your enterprise.

                                [User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md)

                                Explore command-line options for the ScanState, LoadState, and UsmtUtils tools.

                                [USMT XML Reference](usmt-xml-reference.md)

                                Learn about customizing a migration with XML files.

                                [Offline Migration Reference](offline-migration-reference.md)

                                Find requirements, best practices, and other considerations for performing a migration offline.

                                - -  - -## Related topics - - -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) - -[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) - -[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - -  - -  - - - - - +--- +title: User State Migration Toolkit (USMT) Reference (Windows 10) +description: User State Migration Toolkit (USMT) Reference +ms.assetid: 2135dbcf-de49-4cea-b2fb-97dd016e1a1a +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Toolkit (USMT) Reference + + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

                                USMT Requirements

                                Describes operating system, hardware, and software requirements, and user prerequisites.

                                USMT Best Practices

                                Discusses general and security-related best practices when using USMT.

                                How USMT Works

                                Learn about the processes behind the ScanState and LoadState tools.

                                Plan Your Migration

                                Choose what to migrate and the best migration scenario for your enterprise.

                                User State Migration Tool (USMT) Command-line Syntax

                                Explore command-line options for the ScanState, LoadState, and UsmtUtils tools.

                                USMT XML Reference

                                Learn about customizing a migration with XML files.

                                Offline Migration Reference

                                Find requirements, best practices, and other considerations for performing a migration offline.

                                + + + +## Related topics + + +[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) + +[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) + +[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-requirements.md b/windows/deployment/usmt/usmt-requirements.md index c4d78425d6..45af228e40 100644 --- a/windows/deployment/usmt/usmt-requirements.md +++ b/windows/deployment/usmt/usmt-requirements.md @@ -1,158 +1,161 @@ ---- -title: USMT Requirements (Windows 10) -description: USMT Requirements -ms.assetid: 2b0cf3a3-9032-433f-9622-1f9df59d6806 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 05/03/2017 -ms.topic: article ---- - -# USMT Requirements - - -## In This Topic - - -- [Supported Operating Systems](#bkmk-1) -- [Windows PE](#windows-pe) -- [Credentials](#credentials) -- [Config.xml](#configxml) -- [LoadState](#loadstate) -- [Hard Disk Requirements](#bkmk-3) -- [User Prerequisites](#bkmk-userprereqs) - -## Supported Operating Systems - - -The User State Migration Tool (USMT) 10.0 does not have any explicit RAM or CPU speed requirements for either the source or destination computers. If your computer complies with the system requirements of the operating system, it also complies with the requirements for USMT. You need an intermediate store location large enough to hold all of the migrated data and settings, and the same amount of hard disk space on the destination computer for the migrated files and settings. - -The following table lists the operating systems supported in USMT. - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Operating SystemsScanState (source computer)LoadState (destination computer)

                                32-bit versions of Windows 7

                                X

                                X

                                64-bit versions of Windows 7

                                X

                                X

                                32-bit versions of Windows 8

                                X

                                X

                                64-bit versions of Windows 8

                                X

                                X

                                32-bit versions of Windows 10

                                X

                                X

                                64-bit versions of Windows 10

                                X

                                X

                                - -  - -**Note**   -You can migrate a 32-bit operating system to a 64-bit operating system. However, you cannot migrate a 64-bit operating system to a 32-bit operating system. - -USMT does not support any of the Windows Server® operating systems, Windows 2000, Windows XP, or any of the starter editions for Windows Vista or Windows 7. - -USMT for Windows 10 should not be used for migrating from Windows 7 to Windows 8.1. It is meant to migrate to Windows 10. -For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](https://go.microsoft.com/fwlink/p/?LinkId=246564).  - -## Windows PE - -- **Must use latest version of Window PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](https://msdn.microsoft.com/library/windows/hardware/dn938350.aspx). - -## Credentials - -- **Run as administrator** - When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8 or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration. - -To open an elevated command prompt: - -1. Click **Start**. -2. Enter **cmd** in the search function. -3. Depending on the OS you are using, **cmd** or **Command Prompt** is displayed. -3. Right-click **cmd** or **Command Prompt**, and then click **Run as administrator**. -4. If the current user is not already an administrator, you will be prompted to enter administrator credentials. - -**Important**
                                -You must run USMT using an account with full administrative permissions, including the following privileges: - -- SeBackupPrivilege (Back up files and directories) -- SeDebugPrivilege (Debug programs) -- SeRestorePrivilege (Restore files and directories) -- SeSecurityPrivilege (Manage auditing and security log) -- SeTakeOwnership Privilege (Take ownership of files or other objects) - - -## Config.xml - -- **Specify the /c option and <ErrorControl> settings in the Config.xml file.**
                                - USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md). - -## LoadState - -- **Install applications before running the LoadState command.**
                                - Install all applications on the destination computer before restoring the user state. This ensures that migrated settings are preserved. - -## Hard-Disk Requirements - - -Ensure that there is enough available space in the migration-store location and on the source and destination computers. For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md). - -## User Prerequisites - - -This documentation assumes that IT professionals using USMT understand command-line tools. The documentation also assumes that IT professionals using USMT to author MigXML rules understand the following: - -- The navigation and hierarchy of the Windows registry. -- The files and file types that applications use. -- The methods to extract application and setting information manually from applications created by internal software-development groups and non-Microsoft software vendors. -- XML-authoring basics. - -## Related topics - - -[Plan Your Migration](usmt-plan-your-migration.md)
                                -[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)
                                -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
                                - -  - -  - - - - - +--- +title: USMT Requirements (Windows 10) +description: USMT Requirements +ms.assetid: 2b0cf3a3-9032-433f-9622-1f9df59d6806 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 05/03/2017 +ms.topic: article +--- + +# USMT Requirements + + +## In This Topic + + +- [Supported Operating Systems](#bkmk-1) +- [Windows PE](#windows-pe) +- [Credentials](#credentials) +- [Config.xml](#configxml) +- [LoadState](#loadstate) +- [Hard Disk Requirements](#bkmk-3) +- [User Prerequisites](#bkmk-userprereqs) + +## Supported Operating Systems + + +The User State Migration Tool (USMT) 10.0 does not have any explicit RAM or CPU speed requirements for either the source or destination computers. If your computer complies with the system requirements of the operating system, it also complies with the requirements for USMT. You need an intermediate store location large enough to hold all of the migrated data and settings, and the same amount of hard disk space on the destination computer for the migrated files and settings. + +The following table lists the operating systems supported in USMT. + + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Operating SystemsScanState (source computer)LoadState (destination computer)

                                32-bit versions of Windows 7

                                X

                                X

                                64-bit versions of Windows 7

                                X

                                X

                                32-bit versions of Windows 8

                                X

                                X

                                64-bit versions of Windows 8

                                X

                                X

                                32-bit versions of Windows 10

                                X

                                X

                                64-bit versions of Windows 10

                                X

                                X

                                + + + +**Note**   +You can migrate a 32-bit operating system to a 64-bit operating system. However, you cannot migrate a 64-bit operating system to a 32-bit operating system. + +USMT does not support any of the Windows Server® operating systems, Windows 2000, Windows XP, or any of the starter editions for Windows Vista or Windows 7. + +USMT for Windows 10 should not be used for migrating from Windows 7 to Windows 8.1. It is meant to migrate to Windows 10. +For more information about previous releases of the USMT tools, see [User State Migration Tool (USMT) 4.0 User’s Guide](https://go.microsoft.com/fwlink/p/?LinkId=246564).  + +## Windows PE + +- **Must use latest version of Window PE.** For example, to migrate to Windows 10, you'll need Windows PE 5.1. For more info, see [What's New in Windows PE](https://msdn.microsoft.com/library/windows/hardware/dn938350.aspx). + +## Credentials + +- **Run as administrator** + When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8 or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration. + +To open an elevated command prompt: + +1. Click **Start**. +2. Enter **cmd** in the search function. +3. Depending on the OS you are using, **cmd** or **Command Prompt** is displayed. +3. Right-click **cmd** or **Command Prompt**, and then click **Run as administrator**. +4. If the current user is not already an administrator, you will be prompted to enter administrator credentials. + +**Important**
                                +You must run USMT using an account with full administrative permissions, including the following privileges: + +- SeBackupPrivilege (Back up files and directories) +- SeDebugPrivilege (Debug programs) +- SeRestorePrivilege (Restore files and directories) +- SeSecurityPrivilege (Manage auditing and security log) +- SeTakeOwnership Privilege (Take ownership of files or other objects) + + +## Config.xml + +- **Specify the /c option and <ErrorControl> settings in the Config.xml file.**
                                + USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md). + +## LoadState + +- **Install applications before running the LoadState command.**
                                + Install all applications on the destination computer before restoring the user state. This ensures that migrated settings are preserved. + +## Hard-Disk Requirements + + +Ensure that there is enough available space in the migration-store location and on the source and destination computers. For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md). + +## User Prerequisites + + +This documentation assumes that IT professionals using USMT understand command-line tools. The documentation also assumes that IT professionals using USMT to author MigXML rules understand the following: + +- The navigation and hierarchy of the Windows registry. +- The files and file types that applications use. +- The methods to extract application and setting information manually from applications created by internal software-development groups and non-Microsoft software vendors. +- XML-authoring basics. + +## Related topics + + +[Plan Your Migration](usmt-plan-your-migration.md)
                                +[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)
                                +[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
                                + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-reroute-files-and-settings.md b/windows/deployment/usmt/usmt-reroute-files-and-settings.md index 9f146337b3..22f64e513e 100644 --- a/windows/deployment/usmt/usmt-reroute-files-and-settings.md +++ b/windows/deployment/usmt/usmt-reroute-files-and-settings.md @@ -2,9 +2,13 @@ title: Reroute Files and Settings (Windows 10) description: Reroute Files and Settings ms.assetid: 905e6a24-922c-4549-9732-60fa11862a6c +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -28,7 +32,7 @@ In this topic: The following custom .xml file migrates the directories and files from C:\\EngineeringDrafts into the My Documents folder of every user. %CSIDL\_PERSONAL% is the virtual folder representing the My Documents desktop item, which is equivalent to CSIDL\_MYDOCUMENTS. -``` syntax +``` xml Engineering Drafts Documents to Personal Folder @@ -57,7 +61,7 @@ The following custom .xml file migrates the directories and files from C:\\Engin The following custom .xml file reroutes .mp3 files located in the fixed drives on the source computer into the C:\\Music folder on the destination computer. -``` syntax +``` xml All .mp3 files to My Documents @@ -85,7 +89,7 @@ The following custom .xml file reroutes .mp3 files located in the fixed drives o The following custom .xml file migrates the Sample.doc file from C:\\EngineeringDrafts into the My Documents folder of every user. %CSIDL\_PERSONAL% is the virtual folder representing the My Documents desktop item, which is equivalent to CSIDL\_MYDOCUMENTS. -``` syntax +``` xml Sample.doc into My Documents diff --git a/windows/deployment/usmt/usmt-resources.md b/windows/deployment/usmt/usmt-resources.md index c934bdd8eb..eaaa49a5d4 100644 --- a/windows/deployment/usmt/usmt-resources.md +++ b/windows/deployment/usmt/usmt-resources.md @@ -1,47 +1,50 @@ ---- -title: USMT Resources (Windows 10) -description: USMT Resources -ms.assetid: a0b266c7-4bcb-49f1-b63c-48c6ace86b43 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# USMT Resources - - -## USMT Online Resources - - -- [ADK Release Notes](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx) - -- Microsoft Visual Studio - - - You can use the User State Migration Tool (USMT) XML schema (the MigXML.xsd file) to validate the migration .xml files using an XML authoring tool such as Microsoft® Visual Studio®. - - For more information about how to use the schema with your XML authoring environment, see the environment’s documentation. - -- [Ask the Directory Services Team blog](https://go.microsoft.com/fwlink/p/?LinkId=226365) - -- Forums: - - - [Microsoft Deployment Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=226386) - - - [Configuration Manager Operating System Deployment](https://go.microsoft.com/fwlink/p/?LinkId=226388) - -## Related topics - - -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) - -  - -  - - - - - +--- +title: USMT Resources (Windows 10) +description: USMT Resources +ms.assetid: a0b266c7-4bcb-49f1-b63c-48c6ace86b43 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# USMT Resources + + +## USMT Online Resources + + +- [ADK Release Notes](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx) + +- Microsoft Visual Studio + + - You can use the User State Migration Tool (USMT) XML schema (the MigXML.xsd file) to validate the migration .xml files using an XML authoring tool such as Microsoft® Visual Studio®. + + For more information about how to use the schema with your XML authoring environment, see the environment’s documentation. + +- [Ask the Directory Services Team blog](https://go.microsoft.com/fwlink/p/?LinkId=226365) + +- Forums: + + - [Microsoft Deployment Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=226386) + + - [Configuration Manager Operating System Deployment](https://go.microsoft.com/fwlink/p/?LinkId=226388) + +## Related topics + + +[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/usmt-return-codes.md b/windows/deployment/usmt/usmt-return-codes.md index 0ec3d9f0f8..c137197a5c 100644 --- a/windows/deployment/usmt/usmt-return-codes.md +++ b/windows/deployment/usmt/usmt-return-codes.md @@ -1,783 +1,786 @@ ---- -title: Return Codes (Windows 10) -description: Return Codes -ms.assetid: e71bbc6b-d5a6-4e48-ad01-af0012b35f22 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Return Codes - - -This topic describes User State Migration Tool (USMT) 10.0 return codes and error messages. Also included is a table listing the USMT return codes with their associated mitigation steps. In addition, this topic provides tips to help you use the logfiles to determine why you received an error. - -Understanding the requirements for running USMT can help minimize errors in your USMT migrations. For more information, see [USMT Requirements](usmt-requirements.md). - -## In This Topic - - -[USMT Return Codes](#bkmk-returncodes) - -[USMT Error Messages](#bkmk-errormessages) - -[Troubleshooting Return Codes and Error Messages](#bkmk-tscodeserrors) - -## USMT Return Codes - - -If you encounter an error in your USMT migration, you can use return codes and the more specific information provided in the associated USMT error messages to troubleshoot the issue and to identify mitigation steps. - -Return codes are grouped into the following broad categories that describe their area of error reporting: - -Success or User Cancel - -Invalid Command Lines - -Setup and Initialization - -Non-fatal Errors - -Fatal Errors - -As a best practice, we recommend that you set verbosity level to 5, **/v***:5*, on the **ScanState**, **LoadState**, and **USMTUtils** command lines so that the most detailed reporting is available in the respective USMT logs. You can use a higher verbosity level if you want the log files output to go to a debugger. - -## USMT Error Messages - - -Error messages provide more detailed information about the migration problem than the associated return code. For example, the **ScanState**, **LoadState**, or **USMTUtils** tool might return a code of "11” (for “USMT\_INVALID\_PARAMETERS") and a related error message that reads "/key and /keyfile both specified". The error message is displayed at the command prompt and is identified in the **ScanState**, **LoadState**, or **USMTUtils** log files to help you determine why the return code was received. - -You can obtain more information about any listed Windows application programming interface (API) system error codes by typing **net helpmsg** on the command line and, then typing the error code number. For more information about System Error Codes, see [this Microsoft Web site](https://go.microsoft.com/fwlink/p/?LinkId=147060). - -## Troubleshooting Return Codes and Error Messages - - -The following table lists each return code by numeric value, along with the associated error messages and suggested troubleshooting actions. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Return code valueReturn codeError messageTroubleshooting, mitigation, workaroundsCategory

                                0

                                USMT_SUCCESS

                                Successful run

                                Not applicable

                                Success or Cancel

                                1

                                USMT_DISPLAY_HELP

                                Command line help requested

                                Not applicable

                                Success or Cancel

                                2

                                USMT_STATUS_CANCELED

                                Gather was aborted because of an EFS file

                                Not applicable

                                User chose to cancel (such as pressing CTRL+C)

                                Not applicable

                                Success or Cancel

                                3

                                USMT_WOULD_HAVE_FAILED

                                At least one error was skipped as a result of /c

                                Review ScanState, LoadState, or UsmtUtils log for details about command-line errors.

                                11

                                USMT_INVALID_PARAMETERS

                                /all conflicts with /ui, /ue or /uel

                                Review ScanState log or LoadState log for details about command-line errors.

                                /auto expects an optional parameter for the script folder

                                Review ScanState log or LoadState log for details about command-line errors.

                                /encrypt can't be used with /nocompress

                                Review ScanState log or LoadState log for details about command-line errors.

                                /encrypt requires /key or /keyfile

                                Review ScanState log or LoadState log for details about command-line errors.

                                /genconfig can't be used with most other options

                                Review ScanState log or LoadState log for details about command-line errors.

                                /genmigxml can't be used with most other options

                                Review ScanState log or LoadState log for details about command-line errors.

                                /hardlink requires /nocompress

                                Review ScanState log or LoadState log for details about command-line errors.

                                /key and /keyfile both specified

                                Review ScanState log or LoadState log for details about command-line errors.

                                /key or /keyfile used without enabling encryption

                                Review ScanState log or LoadState log for details about command-line errors.

                                /lae is only used with /lac

                                Review ScanState log or LoadState log for details about command-line errors.

                                /listfiles cannot be used with /p

                                Review ScanState log or LoadState log for details about command-line errors.

                                /offline requires a valid path to an XML file describing offline paths

                                Review ScanState log or LoadState log for details about command-line errors.

                                /offlinewindir requires a valid path to offline windows folder

                                Review ScanState log or LoadState log for details about command-line errors.

                                /offlinewinold requires a valid path to offline windows folder

                                Review ScanState log or LoadState log for details about command-line errors.

                                A command was already specified

                                Verify that the command-line syntax is correct and that there are no duplicate commands.

                                An option argument is missing

                                Review ScanState log or LoadState log for details about command-line errors.

                                An option is specified more than once and is ambiguous

                                Review ScanState log or LoadState log for details about command-line errors.

                                By default /auto selects all users and uses the highest log verbosity level. Switches like /all, /ui, /ue, /v are not allowed.

                                Review ScanState log or LoadState log for details about command-line errors.

                                Command line arguments are required. Specify /? for options.

                                Review ScanState log or LoadState log for details about command-line errors.

                                Command line option is not valid

                                Review ScanState log or LoadState log for details about command-line errors.

                                EFS parameter specified is not valid for /efs

                                Review ScanState log or LoadState log for details about command-line errors.

                                File argument is invalid for /genconfig

                                Review ScanState log or LoadState log for details about command-line errors.

                                File argument is invalid for /genmigxml

                                Review ScanState log or LoadState log for details about command-line errors.

                                Invalid space estimate path. Check the parameters and/or file system permissions

                                Review ScanState log or LoadState log for details about command-line errors.

                                List file path argument is invalid for /listfiles

                                Review ScanState log or LoadState log for details about command-line errors.

                                Retry argument must be an integer

                                Review ScanState log or LoadState log for details about command-line errors.

                                Settings store argument specified is invalid

                                Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

                                Specified encryption algorithm is not supported

                                Review ScanState log or LoadState log for details about command-line errors.

                                The /efs:hardlink requires /hardlink

                                Review ScanState log or LoadState log for details about command-line errors.

                                The /targetWindows7 option is only available for Windows XP, Windows Vista, and Windows 7

                                Review ScanState log or LoadState log for details about command-line errors.

                                The store parameter is required but not specified

                                Review ScanState log or LoadState log for details about command-line errors.

                                The source-to-target domain mapping is invalid for /md

                                Review ScanState log or LoadState log for details about command-line errors.

                                The source-to-target user account mapping is invalid for /mu

                                Review ScanState log or LoadState log for details about command-line errors.

                                Undefined or incomplete command line option

                                Review ScanState log or LoadState log for details about command-line errors.

                                Invalid Command Lines

                                Use /nocompress, or provide an XML file path with /p"pathtoafile" to get a compressed store size estimate

                                Review ScanState log or LoadState log for details about command-line errors.

                                User exclusion argument is invalid

                                Review ScanState log or LoadState log for details about command-line errors.

                                Verbosity level must be specified as a sum of the desired log options: Verbose (0x01), Record Objects (0x04), Echo to debug port (0x08)

                                Review ScanState log or LoadState log for details about command-line errors.

                                Volume shadow copy feature is not supported with a hardlink store

                                Review ScanState log or LoadState log for details about command-line errors.

                                Wait delay argument must be an integer

                                Review ScanState log or LoadState log for details about command-line errors.

                                12

                                USMT_ERROR_OPTION_PARAM_TOO_LARGE

                                Command line arguments cannot exceed 256 characters

                                Review ScanState log or LoadState log for details about command-line errors.

                                Invalid Command Lines

                                Specified settings store path exceeds the maximum allowed length of 256 characters

                                Review ScanState log or LoadState log for details about command-line errors.

                                13

                                USMT_INIT_LOGFILE_FAILED

                                Log path argument is invalid for /l

                                When /l is specified in the ScanState command line, USMT validates the path. Verify that the drive and other information, for example file system characters, are correct.

                                Invalid Command Lines

                                14

                                USMT_ERROR_USE_LAC

                                Unable to create a local account because /lac was not specified

                                When creating local accounts, the command-line options /lac and /lae should be used.

                                Invalid Command Lines

                                26

                                USMT_INIT_ERROR

                                Multiple Windows installations found

                                Listfiles.txt could not be created. Verify that the location you specified for the creation of this file is valid.

                                Setup and Initialization

                                Software malfunction or unknown exception

                                Check all loaded .xml files for errors, common error when using /I to load the Config.xml file.

                                Unable to find a valid Windows directory to proceed with requested offline operation; Check if offline input file is present and has valid entries

                                Verify that the offline input file is present and that it has valid entries. USMT could not find valid offline operating system. Verify your offline directory mapping.

                                27

                                USMT_INVALID_STORE_LOCATION

                                A store path can't be used because an existing store exists; specify /o to overwrite

                                Specify /o to overwrite an existing intermediate or migration store.

                                Setup and Initialization

                                A store path is missing or has incomplete data

                                Make sure that the store path is accessible and that the proper permission levels are set.

                                An error occurred during store creation

                                Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

                                An inappropriate device such as a floppy disk was specified for the store

                                Make sure that the store path is accessible and that the proper permission levels are set.

                                Invalid store path; check the store parameter and/or file system permissions

                                Invalid store path; check the store parameter and/or file system permissions

                                The file layout and/or file content is not recognized as a valid store

                                Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

                                The store path holds a store incompatible with the current USMT version

                                Make sure that the store path is accessible and that the proper permission levels are set.

                                The store save location is read-only or does not support a requested storage option

                                Make sure that the store path is accessible and that the proper permission levels are set.

                                28

                                USMT_UNABLE_GET_SCRIPTFILES

                                Script file is invalid for /i

                                Check all specified migration .xml files for errors. This is a common error when using /i to load the Config.xml file.

                                Setup and Initialization

                                Unable to find a script file specified by /i

                                Verify the location of your script files, and ensure that the command-line options are correct.

                                29

                                USMT_FAILED_MIGSTARTUP

                                A minimum of 250 MB of free space is required for temporary files

                                Verify that the system meets the minimum temporary disk space requirement of 250 MB. As a workaround, you can set the environment variable USMT_WORKING_DIR=<path> to redirect the temporary files working directory.

                                Setup and Initialization

                                Another process is preventing migration; only one migration tool can run at a time

                                Check the ScanState log file for migration .xml file errors.

                                Failed to start main processing, look in log for system errors or check the installation

                                Check the ScanState log file for migration .xml file errors.

                                Migration failed because of an XML error; look in the log for specific details

                                Check the ScanState log file for migration .xml file errors.

                                Unable to automatically map the drive letters to match the online drive letter layout; Use /offline to provide a mapping table

                                Check the ScanState log file for migration .xml file errors.

                                31

                                USMT_UNABLE_FINDMIGUNITS

                                An error occurred during the discover phase; the log should have more specific information

                                Check the ScanState log file for migration .xml file errors.

                                Setup and Initialization

                                32

                                USMT_FAILED_SETMIGRATIONTYPE

                                An error occurred processing the migration system

                                Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

                                Setup and Initialization

                                33

                                USMT_UNABLE_READKEY

                                Error accessing the file specified by the /keyfile parameter

                                Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

                                Setup and Initialization

                                The encryption key must have at least one character

                                Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

                                34

                                USMT_ERROR_INSUFFICIENT_RIGHTS

                                Directory removal requires elevated privileges

                                Log on as Administrator, and run with elevated privileges.

                                Setup and Initialization

                                No rights to create user profiles; log in as Administrator; run with elevated privileges

                                Log on as Administrator, and run with elevated privileges.

                                No rights to read or delete user profiles; log in as Administrator, run with elevated privileges

                                Log on as Administrator, and run with elevated privileges.

                                35

                                USMT_UNABLE_DELETE_STORE

                                A reboot is required to remove the store

                                Reboot to delete any files that could not be deleted when the command was executed.

                                Setup and Initialization

                                A store path can't be used because it contains data that could not be overwritten

                                A migration store could not be deleted. If you are using a hardlink migration store you might have a locked file in it. You should manually delete the store, or use USMTUtils /rd command to delete the store.

                                There was an error removing the store

                                Review ScanState log or LoadState log for details about command-line errors.

                                36

                                USMT_ERROR_UNSUPPORTED_PLATFORM

                                Compliance check failure; please check the logs for details

                                Investigate whether there is an active temporary profile on the system.

                                Setup and Initialization

                                Use of /offline is not supported during apply

                                The /offline command was not used while running in the Windows Preinstallation Environment (WinPE).

                                Use /offline to run gather on this platform

                                The /offline command was not used while running in WinPE.

                                37

                                USMT_ERROR_NO_INVALID_KEY

                                The store holds encrypted data but the correct encryption key was not provided

                                Verify that you have included the correct encryption /key or /keyfile.

                                Setup and Initialization

                                38

                                USMT_ERROR_CORRUPTED_NOTENCRYPTED_STORE

                                An error occurred during store access

                                Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

                                Setup and Initialization

                                39

                                USMT_UNABLE_TO_READ_CONFIG_FILE

                                Error reading Config.xml

                                Review ScanState log or LoadState log for details about command-line errors in the Config.xml file.

                                Setup and Initialization

                                File argument is invalid for /config

                                Check the command line you used to load the Config.xml file. You can use online Help by typing /? on the command line.

                                40

                                USMT_ERROR_UNABLE_CREATE_PROGRESS_LOG

                                Error writing to the progress log

                                The Progress log could not be created. Verify that the location is valid and that you have write access.

                                Setup and Initialization

                                Progress log argument is invalid for /progress

                                The Progress log could not be created. Verify that the location is valid and that you have write access.

                                41

                                USMT_PREFLIGHT_FILE_CREATION_FAILED

                                Can't overwrite existing file

                                The Progress log could not be created. Verify that the location is valid and that you have write access.

                                Setup and Initialization

                                Invalid space estimate path. Check the parameters and/or file system permissions

                                Review ScanState log or LoadState log for details about command-line errors.

                                42

                                USMT_ERROR_CORRUPTED_STORE

                                The store contains one or more corrupted files

                                Review UsmtUtils log for details about the corrupted files. For information on how to extract the files that are not corrupted, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md).

                                61

                                USMT_MIGRATION_STOPPED_NONFATAL

                                Processing stopped due to an I/O error

                                USMT exited but can continue with the /c command-line option, with the optional configurable <ErrorControl> section or by using the /vsc command-line option.

                                Non-fatal Errors

                                71

                                USMT_INIT_OPERATING_ENVIRONMENT_FAILED

                                A Windows Win32 API error occurred

                                Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

                                Fatal Errors

                                An error occurred when attempting to initialize the diagnostic mechanisms such as the log

                                Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

                                Failed to record diagnostic information

                                Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

                                Unable to start. Make sure you are running USMT with elevated privileges

                                Exit USMT and log in again with elevated privileges.

                                72

                                USMT_UNABLE_DOMIGRATION

                                An error occurred closing the store

                                Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

                                Fatal Errors

                                An error occurred in the apply process

                                Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

                                An error occurred in the gather process

                                Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

                                Out of disk space while writing the store

                                Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

                                Out of temporary disk space on the local system

                                Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

                                - -  - -## Related topics - - -[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - -[Log Files](usmt-log-files.md) - -  - -  - - - - - +--- +title: Return Codes (Windows 10) +description: Return Codes +ms.assetid: e71bbc6b-d5a6-4e48-ad01-af0012b35f22 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Return Codes + + +This topic describes User State Migration Tool (USMT) 10.0 return codes and error messages. Also included is a table listing the USMT return codes with their associated mitigation steps. In addition, this topic provides tips to help you use the logfiles to determine why you received an error. + +Understanding the requirements for running USMT can help minimize errors in your USMT migrations. For more information, see [USMT Requirements](usmt-requirements.md). + +## In This Topic + + +[USMT Return Codes](#bkmk-returncodes) + +[USMT Error Messages](#bkmk-errormessages) + +[Troubleshooting Return Codes and Error Messages](#bkmk-tscodeserrors) + +## USMT Return Codes + + +If you encounter an error in your USMT migration, you can use return codes and the more specific information provided in the associated USMT error messages to troubleshoot the issue and to identify mitigation steps. + +Return codes are grouped into the following broad categories that describe their area of error reporting: + +Success or User Cancel + +Invalid Command Lines + +Setup and Initialization + +Non-fatal Errors + +Fatal Errors + +As a best practice, we recommend that you set verbosity level to 5, **/v**:5, on the **ScanState**, **LoadState**, and **USMTUtils** command lines so that the most detailed reporting is available in the respective USMT logs. You can use a higher verbosity level if you want the log files output to go to a debugger. + +## USMT Error Messages + + +Error messages provide more detailed information about the migration problem than the associated return code. For example, the **ScanState**, **LoadState**, or **USMTUtils** tool might return a code of "11” (for “USMT\_INVALID\_PARAMETERS") and a related error message that reads "/key and /keyfile both specified". The error message is displayed at the command prompt and is identified in the **ScanState**, **LoadState**, or **USMTUtils** log files to help you determine why the return code was received. + +You can obtain more information about any listed Windows application programming interface (API) system error codes by typing **net helpmsg** on the command line and, then typing the error code number. For more information about System Error Codes, see [this Microsoft Web site](https://go.microsoft.com/fwlink/p/?LinkId=147060). + +## Troubleshooting Return Codes and Error Messages + + +The following table lists each return code by numeric value, along with the associated error messages and suggested troubleshooting actions. + + +++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Return code valueReturn codeError messageTroubleshooting, mitigation, workaroundsCategory

                                0

                                USMT_SUCCESS

                                Successful run

                                Not applicable

                                Success or Cancel

                                1

                                USMT_DISPLAY_HELP

                                Command line help requested

                                Not applicable

                                Success or Cancel

                                2

                                USMT_STATUS_CANCELED

                                Gather was aborted because of an EFS file

                                Not applicable

                                User chose to cancel (such as pressing CTRL+C)

                                Not applicable

                                Success or Cancel

                                3

                                USMT_WOULD_HAVE_FAILED

                                At least one error was skipped as a result of /c

                                Review ScanState, LoadState, or UsmtUtils log for details about command-line errors.

                                11

                                USMT_INVALID_PARAMETERS

                                /all conflicts with /ui, /ue or /uel

                                Review ScanState log or LoadState log for details about command-line errors.

                                /auto expects an optional parameter for the script folder

                                Review ScanState log or LoadState log for details about command-line errors.

                                /encrypt can't be used with /nocompress

                                Review ScanState log or LoadState log for details about command-line errors.

                                /encrypt requires /key or /keyfile

                                Review ScanState log or LoadState log for details about command-line errors.

                                /genconfig can't be used with most other options

                                Review ScanState log or LoadState log for details about command-line errors.

                                /genmigxml can't be used with most other options

                                Review ScanState log or LoadState log for details about command-line errors.

                                /hardlink requires /nocompress

                                Review ScanState log or LoadState log for details about command-line errors.

                                /key and /keyfile both specified

                                Review ScanState log or LoadState log for details about command-line errors.

                                /key or /keyfile used without enabling encryption

                                Review ScanState log or LoadState log for details about command-line errors.

                                /lae is only used with /lac

                                Review ScanState log or LoadState log for details about command-line errors.

                                /listfiles cannot be used with /p

                                Review ScanState log or LoadState log for details about command-line errors.

                                /offline requires a valid path to an XML file describing offline paths

                                Review ScanState log or LoadState log for details about command-line errors.

                                /offlinewindir requires a valid path to offline windows folder

                                Review ScanState log or LoadState log for details about command-line errors.

                                /offlinewinold requires a valid path to offline windows folder

                                Review ScanState log or LoadState log for details about command-line errors.

                                A command was already specified

                                Verify that the command-line syntax is correct and that there are no duplicate commands.

                                An option argument is missing

                                Review ScanState log or LoadState log for details about command-line errors.

                                An option is specified more than once and is ambiguous

                                Review ScanState log or LoadState log for details about command-line errors.

                                By default /auto selects all users and uses the highest log verbosity level. Switches like /all, /ui, /ue, /v are not allowed.

                                Review ScanState log or LoadState log for details about command-line errors.

                                Command line arguments are required. Specify /? for options.

                                Review ScanState log or LoadState log for details about command-line errors.

                                Command line option is not valid

                                Review ScanState log or LoadState log for details about command-line errors.

                                EFS parameter specified is not valid for /efs

                                Review ScanState log or LoadState log for details about command-line errors.

                                File argument is invalid for /genconfig

                                Review ScanState log or LoadState log for details about command-line errors.

                                File argument is invalid for /genmigxml

                                Review ScanState log or LoadState log for details about command-line errors.

                                Invalid space estimate path. Check the parameters and/or file system permissions

                                Review ScanState log or LoadState log for details about command-line errors.

                                List file path argument is invalid for /listfiles

                                Review ScanState log or LoadState log for details about command-line errors.

                                Retry argument must be an integer

                                Review ScanState log or LoadState log for details about command-line errors.

                                Settings store argument specified is invalid

                                Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

                                Specified encryption algorithm is not supported

                                Review ScanState log or LoadState log for details about command-line errors.

                                The /efs:hardlink requires /hardlink

                                Review ScanState log or LoadState log for details about command-line errors.

                                The /targetWindows7 option is only available for Windows XP, Windows Vista, and Windows 7

                                Review ScanState log or LoadState log for details about command-line errors.

                                The store parameter is required but not specified

                                Review ScanState log or LoadState log for details about command-line errors.

                                The source-to-target domain mapping is invalid for /md

                                Review ScanState log or LoadState log for details about command-line errors.

                                The source-to-target user account mapping is invalid for /mu

                                Review ScanState log or LoadState log for details about command-line errors.

                                Undefined or incomplete command line option

                                Review ScanState log or LoadState log for details about command-line errors.

                                Invalid Command Lines

                                Use /nocompress, or provide an XML file path with /p"pathtoafile" to get a compressed store size estimate

                                Review ScanState log or LoadState log for details about command-line errors.

                                User exclusion argument is invalid

                                Review ScanState log or LoadState log for details about command-line errors.

                                Verbosity level must be specified as a sum of the desired log options: Verbose (0x01), Record Objects (0x04), Echo to debug port (0x08)

                                Review ScanState log or LoadState log for details about command-line errors.

                                Volume shadow copy feature is not supported with a hardlink store

                                Review ScanState log or LoadState log for details about command-line errors.

                                Wait delay argument must be an integer

                                Review ScanState log or LoadState log for details about command-line errors.

                                12

                                USMT_ERROR_OPTION_PARAM_TOO_LARGE

                                Command line arguments cannot exceed 256 characters

                                Review ScanState log or LoadState log for details about command-line errors.

                                Invalid Command Lines

                                Specified settings store path exceeds the maximum allowed length of 256 characters

                                Review ScanState log or LoadState log for details about command-line errors.

                                13

                                USMT_INIT_LOGFILE_FAILED

                                Log path argument is invalid for /l

                                When /l is specified in the ScanState command line, USMT validates the path. Verify that the drive and other information, for example file system characters, are correct.

                                Invalid Command Lines

                                14

                                USMT_ERROR_USE_LAC

                                Unable to create a local account because /lac was not specified

                                When creating local accounts, the command-line options /lac and /lae should be used.

                                Invalid Command Lines

                                26

                                USMT_INIT_ERROR

                                Multiple Windows installations found

                                Listfiles.txt could not be created. Verify that the location you specified for the creation of this file is valid.

                                Setup and Initialization

                                Software malfunction or unknown exception

                                Check all loaded .xml files for errors, common error when using /I to load the Config.xml file.

                                Unable to find a valid Windows directory to proceed with requested offline operation; Check if offline input file is present and has valid entries

                                Verify that the offline input file is present and that it has valid entries. USMT could not find valid offline operating system. Verify your offline directory mapping.

                                27

                                USMT_INVALID_STORE_LOCATION

                                A store path can't be used because an existing store exists; specify /o to overwrite

                                Specify /o to overwrite an existing intermediate or migration store.

                                Setup and Initialization

                                A store path is missing or has incomplete data

                                Make sure that the store path is accessible and that the proper permission levels are set.

                                An error occurred during store creation

                                Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

                                An inappropriate device such as a floppy disk was specified for the store

                                Make sure that the store path is accessible and that the proper permission levels are set.

                                Invalid store path; check the store parameter and/or file system permissions

                                Invalid store path; check the store parameter and/or file system permissions

                                The file layout and/or file content is not recognized as a valid store

                                Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

                                The store path holds a store incompatible with the current USMT version

                                Make sure that the store path is accessible and that the proper permission levels are set.

                                The store save location is read-only or does not support a requested storage option

                                Make sure that the store path is accessible and that the proper permission levels are set.

                                28

                                USMT_UNABLE_GET_SCRIPTFILES

                                Script file is invalid for /i

                                Check all specified migration .xml files for errors. This is a common error when using /i to load the Config.xml file.

                                Setup and Initialization

                                Unable to find a script file specified by /i

                                Verify the location of your script files, and ensure that the command-line options are correct.

                                29

                                USMT_FAILED_MIGSTARTUP

                                A minimum of 250 MB of free space is required for temporary files

                                Verify that the system meets the minimum temporary disk space requirement of 250 MB. As a workaround, you can set the environment variable USMT_WORKING_DIR=<path> to redirect the temporary files working directory.

                                Setup and Initialization

                                Another process is preventing migration; only one migration tool can run at a time

                                Check the ScanState log file for migration .xml file errors.

                                Failed to start main processing, look in log for system errors or check the installation

                                Check the ScanState log file for migration .xml file errors.

                                Migration failed because of an XML error; look in the log for specific details

                                Check the ScanState log file for migration .xml file errors.

                                Unable to automatically map the drive letters to match the online drive letter layout; Use /offline to provide a mapping table

                                Check the ScanState log file for migration .xml file errors.

                                31

                                USMT_UNABLE_FINDMIGUNITS

                                An error occurred during the discover phase; the log should have more specific information

                                Check the ScanState log file for migration .xml file errors.

                                Setup and Initialization

                                32

                                USMT_FAILED_SETMIGRATIONTYPE

                                An error occurred processing the migration system

                                Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

                                Setup and Initialization

                                33

                                USMT_UNABLE_READKEY

                                Error accessing the file specified by the /keyfile parameter

                                Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

                                Setup and Initialization

                                The encryption key must have at least one character

                                Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

                                34

                                USMT_ERROR_INSUFFICIENT_RIGHTS

                                Directory removal requires elevated privileges

                                Log on as Administrator, and run with elevated privileges.

                                Setup and Initialization

                                No rights to create user profiles; log in as Administrator; run with elevated privileges

                                Log on as Administrator, and run with elevated privileges.

                                No rights to read or delete user profiles; log in as Administrator, run with elevated privileges

                                Log on as Administrator, and run with elevated privileges.

                                35

                                USMT_UNABLE_DELETE_STORE

                                A reboot is required to remove the store

                                Reboot to delete any files that could not be deleted when the command was executed.

                                Setup and Initialization

                                A store path can't be used because it contains data that could not be overwritten

                                A migration store could not be deleted. If you are using a hardlink migration store you might have a locked file in it. You should manually delete the store, or use USMTUtils /rd command to delete the store.

                                There was an error removing the store

                                Review ScanState log or LoadState log for details about command-line errors.

                                36

                                USMT_ERROR_UNSUPPORTED_PLATFORM

                                Compliance check failure; please check the logs for details

                                Investigate whether there is an active temporary profile on the system.

                                Setup and Initialization

                                Use of /offline is not supported during apply

                                The /offline command was not used while running in the Windows Preinstallation Environment (WinPE).

                                Use /offline to run gather on this platform

                                The /offline command was not used while running in WinPE.

                                37

                                USMT_ERROR_NO_INVALID_KEY

                                The store holds encrypted data but the correct encryption key was not provided

                                Verify that you have included the correct encryption /key or /keyfile.

                                Setup and Initialization

                                38

                                USMT_ERROR_CORRUPTED_NOTENCRYPTED_STORE

                                An error occurred during store access

                                Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

                                Setup and Initialization

                                39

                                USMT_UNABLE_TO_READ_CONFIG_FILE

                                Error reading Config.xml

                                Review ScanState log or LoadState log for details about command-line errors in the Config.xml file.

                                Setup and Initialization

                                File argument is invalid for /config

                                Check the command line you used to load the Config.xml file. You can use online Help by typing /? on the command line.

                                40

                                USMT_ERROR_UNABLE_CREATE_PROGRESS_LOG

                                Error writing to the progress log

                                The Progress log could not be created. Verify that the location is valid and that you have write access.

                                Setup and Initialization

                                Progress log argument is invalid for /progress

                                The Progress log could not be created. Verify that the location is valid and that you have write access.

                                41

                                USMT_PREFLIGHT_FILE_CREATION_FAILED

                                Can't overwrite existing file

                                The Progress log could not be created. Verify that the location is valid and that you have write access.

                                Setup and Initialization

                                Invalid space estimate path. Check the parameters and/or file system permissions

                                Review ScanState log or LoadState log for details about command-line errors.

                                42

                                USMT_ERROR_CORRUPTED_STORE

                                The store contains one or more corrupted files

                                Review UsmtUtils log for details about the corrupted files. For information on how to extract the files that are not corrupted, see Extract Files from a Compressed USMT Migration Store.

                                61

                                USMT_MIGRATION_STOPPED_NONFATAL

                                Processing stopped due to an I/O error

                                USMT exited but can continue with the /c command-line option, with the optional configurable <ErrorControl> section or by using the /vsc command-line option.

                                Non-fatal Errors

                                71

                                USMT_INIT_OPERATING_ENVIRONMENT_FAILED

                                A Windows Win32 API error occurred

                                Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

                                Fatal Errors

                                An error occurred when attempting to initialize the diagnostic mechanisms such as the log

                                Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

                                Failed to record diagnostic information

                                Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

                                Unable to start. Make sure you are running USMT with elevated privileges

                                Exit USMT and log in again with elevated privileges.

                                72

                                USMT_UNABLE_DOMIGRATION

                                An error occurred closing the store

                                Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

                                Fatal Errors

                                An error occurred in the apply process

                                Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

                                An error occurred in the gather process

                                Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

                                Out of disk space while writing the store

                                Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

                                Out of temporary disk space on the local system

                                Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

                                + + + +## Related topics + + +[User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) + +[Log Files](usmt-log-files.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-scanstate-syntax.md b/windows/deployment/usmt/usmt-scanstate-syntax.md index ca8aab7167..83afe8628b 100644 --- a/windows/deployment/usmt/usmt-scanstate-syntax.md +++ b/windows/deployment/usmt/usmt-scanstate-syntax.md @@ -1,874 +1,873 @@ ---- -title: ScanState Syntax (Windows 10) -description: ScanState Syntax -ms.assetid: 004c755f-33db-49e4-8a3b-37beec1480ea -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# ScanState Syntax - - -The ScanState command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store. - -## In This Topic - - -[Before You Begin](#bkmk-beforeyoubegin) - -[Syntax](#bkmk-syntax) - -[Storage Options](#bkmk-storageoptions) - -[Migration Rule Options](#bkmk-migrationruleoptions) - -[Monitoring Options](#bkmk-monitoringoptions) - -[User Options](#bkmk-useroptions) - -[Encrypted File Options](#bkmk-efs) - -[Incompatible Command-Line Options](#bkmk-iclo) - -## Before You Begin - - -Before you run the **ScanState** command, note the following: - -- To ensure that all operating system settings migrate, in most cases you must run the **ScanState** commands in administrator mode from an account with administrative credentials. - -- If you encrypt the migration store, you will be required to enter an encryption key or a path to a file containing the encryption key. Be sure to make note of the key or the key file location, because this information is not kept anywhere in the migration store. You will need this information when you run the LoadState command to decrypt the migration store, or if you need to run the recovery utility. An incorrect or missing key or key file results in an error message. - -- For information about software requirements for running the **ScanState** command, see [USMT Requirements](usmt-requirements.md). - -- Unless otherwise noted, you can use each option only once when running a tool on the command line. - -- You can gather domain accounts without the source computer having domain controller access. This functionality is available without any additional configuration. - -- The [Incompatible Command-Line Options](#bkmk-iclo) table lists which options you can use together and which command-line options are incompatible. - -- The directory location where you save the migration store will be excluded from the scan. For example, if you save the migration store to the root of the D drive, the D drive and all of its subdirectories will be excluded from the scan. - -## Syntax - - -This section explains the syntax and usage of the **ScanState** command-line options. The options can be specified in any order. If the option contains a parameter, you can use either a colon or a space separator. - -The **ScanState** command's syntax is: - -scanstate \[*StorePath*\] \[/apps\] \[/ppkg:*FileName*\] \[/i:\[*Path*\\\]*FileName*\] \[/o\] \[/v:*VerbosityLevel*\] \[/nocompress\] \[/localonly\] \[/encrypt /key:*KeyString*|/keyfile:\[Path\\\]*FileName*\] \[/l:\[*Path*\\\]*FileName*\] \[/progress:\[*Path*\\\]*FileName*\] \[/r:*TimesToRetry*\] \[/w:*SecondsBeforeRetry*\] \[/c\] \[/p\] \[/all\] \[/ui:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/ue:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/uel:*NumberOfDays*|*YYYY/MM/DD*|0\] \[/efs:abort|skip|decryptcopy|copyraw\] \[/genconfig:\[*Path*\\\]*FileName*\[/config:\[*Path*\\\]*FileName*\] \[/?|help\] - -For example: - -To create a Config.xml file in the current directory, use: - -`scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13` - -To create an encrypted store using the Config.xml file and the default migration .xml files, use: - -`scanstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /o /config:config.xml /v:13 /encrypt /key:"mykey"` - -## Storage Options - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-Line OptionDescription

                                StorePath

                                Indicates a folder where files and settings will be saved. Note that StorePath cannot be c:\. You must specify the StorePath option in the ScanState command, except when using the /genconfig option. You cannot specify more than one StorePath location.

                                /apps

                                Scans the image for apps and includes them and their associated registry settings.

                                /ppkg [<FileName>]

                                Exports to a specific file location.

                                /o

                                Required to overwrite any existing data in the migration store or Config.xml file. If not specified, the ScanState command will fail if the migration store already contains data. You cannot use this option more than once on a command line.

                                /vsc

                                This option enables the volume shadow-copy service to migrate files that are locked or in use. This command-line option eliminates most file-locking errors that are typically encountered by the <ErrorControl> section.

                                -

                                This option can be used only with the ScanState executable file and cannot be combined with the /hardlink option.

                                /hardlink

                                Enables the creation of a hard-link migration store at the specified location. The /nocompress option must be specified with the /hardlink option.

                                /encrypt [{/key:<KeyString> | /keyfile:<file>]}

                                Encrypts the store with the specified key. Encryption is disabled by default. With this option, you will need to specify the encryption key in one of the following ways:

                                -
                                  -

                                • /key:KeyString specifies the encryption key. If there is a space in KeyString, you will need to surround KeyString with quotation marks.

                                  • -

                                • /keyfile:FilePathAndName specifies a text (.txt) file that contains the encryption key.

                                  • -
                                -

                                We recommend that KeyString be at least eight characters long, but it cannot exceed 256 characters. The /key and /keyfile options cannot be used on the same command line. The /encrypt and /nocompress options cannot be used on the same command line.

                                -
                                -Important   -

                                You should use caution with this option, because anyone who has access to the ScanState command-line script will also have access to the encryption key.

                                -
                                -
                                -  -
                                -

                                The following example shows the ScanState command and the /key option:

                                -

                                scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /encrypt /key:mykey

                                /encrypt:<EncryptionStrength>

                                The /encrypt option accepts a command-line parameter to define the encryption strength to be used for encryption of the migration store. For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md).

                                /nocompress

                                Disables compression of data and saves the files to a hidden folder named "File" at StorePath\USMT. Compression is enabled by default. Combining the /nocompress option with the /hardlink option generates a hard-link migration store. You can use the uncompressed store to view what USMT stored, troubleshoot a problem, or run an antivirus utility against the files. You should use this option only in testing environments, because we recommend that you use a compressed store during your actual migration, unless you are combining the /nocompress option with the /hardlink option.

                                -

                                The /nocompress and /encrypt options cannot be used together in one statement on the command line. However, if you do choose to migrate an uncompressed store, the LoadState command will migrate each file directly from the store to the correct location on the destination computer without a temporary location.

                                -

                                For example:

                                -

                                scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /nocompress

                                - -  - -## Run the ScanState Command on an Offline Windows System - - -You can run the **ScanState** command in Windows Preinstallation Environment (WinPE). In addition, USMT supports migrations from previous installations of Windows contained in Windows.old directories. The offline directory can be a Windows directory when you run the **ScanState** command in WinPE or a Windows.old directory when you run the **ScanState** command in Windows. - -There are several benefits to running the **ScanState** command on an offline Windows image, including: - -- **Improved Performance.** - - Because WinPE is a thin operating system, there are fewer running services. In this environment, the **ScanState** command has more access to the local hardware resources, enabling **ScanState** to perform migration operations more quickly. - -- **Simplified end to end deployment process.** - - Migrating data from Windows.old simplifies the end-to-end deployment process by enabling the migration process to occur after the new operating system is installed. - -- **Improved success of migration.** - - The migration success rate is increased because files will not be locked for editing while offline, and because WinPE provides administrator access to files in the offline Windows file system, eliminating the need for administrator-level access to the online system. - -- **Ability to recover an unbootable computer.** - - It might be possible to recover and migrate data from an unbootable computer. - -## Offline Migration Options - - - ---- - - - - - - - - - - - - - - - - - - - - -
                                Command-Line OptionDefinition

                                /offline:"path to an offline.xml file"

                                This option is used to define a path to an offline .xml file that might specify other offline migration options, for example, an offline Windows directory or any domain or folder redirection required in your migration.

                                /offlinewindir:"path to a Windows directory"

                                This option specifies the offline Windows directory that the ScanState command gathers user state from. The offline directory can be Windows.old when you run the ScanState command in Windows or a Windows directory when you run the ScanState command in WinPE.

                                /offlinewinold:"Windows.old directory"

                                This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.

                                - -  - -## Migration Rule Options - - -USMT provides the following options to specify what files you want to migrate. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-Line OptionDescription

                                /i:[Path\]FileName

                                (include)

                                -

                                Specifies an .xml file that contains rules that define what user, application or system state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigDocs.xml, and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory. For more information about which files to specify, see the "XML Files" section of the [Frequently Asked Questions](usmt-faq.md) topic.

                                /genconfig:[Path\]FileName

                                (Generate Config.xml)

                                -

                                Generates the optional Config.xml file, but does not create a migration store. To ensure that this file contains every component, application and setting that can be migrated, you should create this file on a source computer that contains all the components, applications and settings that will be present on the destination computers. In addition, you should specify the other migration .xml files, using the /i option, when you specify this option.

                                -

                                After you create this file, you will need to make use of it with the ScanState command using the /config option.

                                -

                                The only options that you can specify with this option are the /i, /v, and /l options. You cannot specify StorePath, because the /genconfig option does not create a store. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

                                -

                                Examples:

                                -
                                  -

                                • The following example creates a Config.xml file in the current directory:

                                  -

                                  scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13

                                  • -

                                /config:[Path\]FileName

                                Specifies the Config.xml file that the ScanState command should use to create the store. You cannot use this option more than once on the command line. Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.

                                -

                                The following example creates a store using the Config.xml file, MigDocs.xml, and MigApp.xml files:

                                -

                                scanstate \\server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scan.log

                                -

                                The following example migrates the files and settings to the destination computer using the Config.xml, MigDocs.xml, and MigApp.xml files:

                                -

                                loadstate \\server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:load.log

                                /auto:path to script files

                                This option enables you to specify the location of the default .xml files and then begin the migration. If no path is specified, USMT will reference the directory where the USMT binaries are located. The /auto option has the same effect as using the following options: /i:MigDocs.xml /i:MigApp.xml /v:5.

                                /genmigxml:path to a file

                                This option specifies that the ScanState command should use the document finder to create and export an .xml file that defines how to migrate all of the files on the computer on which the ScanState command is running.

                                /targetwindows8

                                Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 8 or Windows 8.1 instead of Windows 10. You should use this command line option in the following scenarios:

                                -
                                  -

                                • To create a Config.xml file by using the /genconfig option. Using the /targetwindows8 option optimizes the Config.xml file so that it only contains components that relate to Windows 8 or Windows 8.1.

                                  • -

                                • To create a migration store. Using the /targetwindows8 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows8 command-line option, some settings can be lost during the migration.

                                  • -

                                /targetwindows7

                                Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 7 instead of Windows 10. You should use this command line option in the following scenarios:

                                -
                                  -

                                • To create a Config.xml file by using the /genconfig option. Using the /targetwindows7 option optimizes the Config.xml file so that it only contains components that relate to Windows 7.

                                  • -

                                • To create a migration store. Using the /targetwindows7 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows7 command-line option, some settings can be lost during the migration.

                                  • -

                                /localonly

                                Migrates only files that are stored on the local computer, regardless of the rules in the .xml files that you specify on the command line. You should use this option when you want to exclude the data from removable drives on the source computer, such as USB flash drives (UFDs), some external hard drives, and so on, and when there are network drives mapped on the source computer. If the /localonly option is not specified, then the ScanState command will copy files from these removable or network drives into the store.

                                -

                                Anything that is not considered a fixed drive by the OS will be excluded by /localonly. In some cases large external hard drives are considered fixed drives. These drives can be explicitly excluded from migration by using a custom.xml file. For more information about how to exclude all files on a specific drive, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md).

                                -

                                The /localonly command-line option includes or excludes data in the migration as identified in the following table:

                                - ---- - - - - - - - - - - - - - - - - - - - - -
                                Drive typeBehavior with /localonly

                                Removable drives such as a USB flash drive

                                Excluded

                                Network drives

                                Excluded

                                Fixed drives

                                Included

                                -

                                 

                                - -  - -## Monitoring Options - - -USMT provides several options that you can use to analyze problems that occur during migration. - -**Note**   -The ScanState log is created by default, but you can specify the name and location of the log with the **/l** option. - -  - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-Line OptionDescription

                                /listfiles:<FileName>

                                You can use the /listfiles command-line option with the ScanState command to generate a text file that lists all of the files included in the migration.

                                /l:[Path\]FileName

                                Specifies the location and name of the ScanState log.

                                -

                                You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then the log will be created in the current directory. You can use the /v option to adjust the amount of output.

                                -

                                If you run the ScanState or LoadState commands from a shared network resource, you must specify this option or USMT will fail with the following error: "USMT was unable to create the log file(s)". To fix this issue, use the /l:scan.log command.

                                /v:<VerbosityLevel>

                                (Verbosity)

                                -

                                Enables verbose output in the ScanState log file. The default value is 0.

                                -

                                You can set the VerbosityLevel to one of the following levels:

                                - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                LevelExplanation

                                0

                                Only the default errors and warnings are enabled.

                                1

                                Enables verbose output.

                                4

                                Enables error and status output.

                                5

                                Enables verbose and status output.

                                8

                                Enables error output to a debugger.

                                9

                                Enables verbose output to a debugger.

                                12

                                Enables error and status output to a debugger.

                                13

                                Enables verbose, status, and debugger output.

                                -

                                 

                                -

                                For example:

                                -

                                scanstate \\server\share\migration\mystore /v:13 /i:migdocs.xml /i:migapp.xml

                                -

                                /progress:[Path\]FileName

                                Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

                                -

                                For example:

                                -

                                scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /progress:prog.log /l:scanlog.log

                                /c

                                When this option is specified, the ScanState command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit in the store, the ScanState command will log an error and continue with the migration. In addition, if a file is open or in use by an application, USMT may not be able to migrate the file and will log an error. Without the /c option, the ScanState command will exit on the first error.

                                -

                                You can use the new <ErrorControl> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /c command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /genconfig option now generates a sample <ErrorControl> section that is enabled by specifying error messages and desired behaviors in the Config.xml file.

                                /r:<TimesToRetry>

                                (Retry)

                                -

                                Specifies the number of times to retry when an error occurs while saving the user state to a server. The default is three times. This option is useful in environments where network connectivity is not reliable.

                                -

                                While storing the user state, the /r option will not be able to recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem.

                                /w:<SecondsBeforeRetry>

                                (Wait)

                                -

                                Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second.

                                /p:<pathToFile>

                                When the ScanState command runs, it will create an .xml file in the path specified. This .xml file includes improved space estimations for the migration store. The following example shows how to create this .xml file:

                                -

                                Scanstate.exe C:\MigrationLocation [additional parameters]

                                -

                                /p:"C:\MigrationStoreSize.xml"

                                -

                                For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md).

                                -

                                To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, you can use the /p option, without specifying "pathtoafile", in USMT. If you specify only the /p option, the storage space estimations are created in the same manner as with USMT3.x releases.

                                /? or /help

                                Displays Help at the command line.

                                - -  - -## User Options - - -By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You cannot exclude users in the migration .xml files or using the Config.xml file. For more information, see [Identify Users](usmt-identify-users.md) and [Migrate User Accounts](usmt-migrate-user-accounts.md). - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-Line OptionDescription

                                /all

                                Migrates all of the users on the computer.

                                -

                                USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to specify the /all option, you cannot also use the /ui, /ue or /uel options.

                                /ui:<DomainName>\<UserName>

                                -

                                or

                                -

                                /ui:<ComputerName>\<LocalUserName>

                                (User include)

                                -

                                Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue or /uel options. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk (*) wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.

                                -
                                -Note   -

                                If a user is specified for inclusion with the /ui option, and also is specified to be excluded with either the /ue or /uel options, the user will be included in the migration.

                                -
                                -
                                -  -
                                -

                                For example:

                                -
                                  -

                                • To include only User2 from the Fabrikam domain, type:

                                  -

                                  /ue:*\* /ui:fabrikam\user2

                                  • -

                                • To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, type:

                                  -

                                  /uel:30 /ui:fabrikam\*

                                  -

                                  In this example, a user account from the Contoso domain that was last modified 2 months ago will not be migrated.

                                  • -
                                -

                                For more examples, see the descriptions of the /ue and /ui options in this table.

                                /uel:<NumberOfDays>

                                -

                                or

                                -

                                /uel:<YYYY/MM/DD>

                                -

                                or

                                -

                                /uel:0

                                (User exclude based on last logon)

                                -

                                Migrates the users that logged onto the source computer within the specified time period, based on the Last Modified date of the Ntuser.dat file on the source computer. The /uel option acts as an include rule. For example, the /uel:30 option migrates users who logged on, or whose account was modified, within the last 30 days from the date when the ScanState command is run.

                                -

                                You can specify a number of days or you can specify a date. You cannot use this option with the /all option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged onto another computer, that logon instance is not considered by USMT.

                                -
                                -Note   -

                                The /uel option is not valid in offline migrations.

                                -
                                -
                                -  -
                                -
                                  -

                                • /uel:0 migrates any users who are currently logged on.

                                  • -

                                • /uel:90 migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.

                                  • -

                                • /uel:1 migrates users whose account has been modified within the last 24 hours.

                                  • -

                                • /uel:2002/1/15 migrates users who have logged on or been modified January 15, 2002 or afterwards.

                                  • -
                                -

                                For example:

                                -

                                scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0

                                /ue:<DomainName>\<UserName>

                                -

                                -or-

                                -

                                -

                                /ue:<ComputerName>\<LocalUserName>

                                (User exclude)

                                -

                                Excludes the specified users from the migration. You can specify multiple /ue options. You cannot use this option with the /all option. <DomainName> and <UserName> can contain the asterisk (*) wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks.

                                -

                                For example:

                                -

                                scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1

                                - -  - -## How to Use /ui and /ue - - -The following examples apply to both the /**ui** and /**ue** options. You can replace the /**ue** option with the /**ui** option to include, rather than exclude, the specified users. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                BehaviorCommand

                                Exclude the user named User One in the Fabrikam domain.

                                /ue:"fabrikam\user one"

                                Exclude the user named User1 in the Fabrikam domain.

                                /ue:fabrikam\user1

                                Exclude the local user named User1.

                                /ue:%computername%\user1

                                Exclude all domain users.

                                /ue:Domain\*

                                Exclude all local users.

                                /ue:%computername%\*

                                Exclude users in all domains named User1, User2, and so on.

                                /ue:*\user*

                                - -  - -## Using the Options Together - - -You can use the /**uel**, /**ue** and /**ui** options together to migrate only the users that you want migrated. - -The /**ui** option has precedence over the /**ue** and /**uel** options. If a user is specified to be included using the /**ui** option, and also specified to be excluded using either the /**ue** or /**uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the /**ui** option takes precedence over the /**ue** option. - -The /**uel** option takes precedence over the /**ue** option. If a user has logged on within the specified time period set by the /**uel** option, that user’s profile will be migrated even if they are excluded by using the /**ue** option. For example, if you specify `/ue:fixed\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                BehaviorCommand

                                Include only User2 from the Fabrikam domain and exclude all other users.

                                /ue:*\* /ui:fabrikam\user2

                                Include only the local user named User1 and exclude all other users.

                                /ue:*\* /ui:user1

                                Include only the domain users from Contoso, except Contoso\User1.

                                This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:

                                -
                                  -

                                • On the ScanState command line, type: /ue:*\* /ui:contoso\*

                                  • -

                                • On the LoadState command line, type: /ue:contoso\user1

                                  • -

                                Include only local (non-domain) users.

                                /ue:*\* /ui:%computername%\*

                                - -  - -## Encrypted File Options - - -You can use the following options to migrate encrypted files. In all cases, by default, USMT fails if an encrypted file is found unless you specify an /**efs** option. To migrate encrypted files, you must change the default behavior. - -For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md). - -**Note**   -EFS certificates will be migrated automatically when migrating to Windows 7, Windows 8 or Windows 10. Therefore, you should specify the /**efs:copyraw** option with the **ScanState** command to migrate the encrypted files - -  - -**Caution**   -Take caution when migrating encrypted files. If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration. - -  - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-Line OptionExplanation

                                /efs:hardlink

                                Creates a hard link to the EFS file instead of copying it. Use only with the /hardlink and the /nocompress options.

                                /efs:abort

                                Causes the ScanState command to fail with an error code, if an Encrypting File System (EFS) file is found on the source computer. Enabled by default.

                                /efs:skip

                                Causes the ScanState command to ignore EFS files.

                                /efs:decryptcopy

                                Causes the ScanState command to decrypt the file, if possible, before saving it to the migration store, and to fail if the file cannot be decrypted. If the ScanState command succeeds, the file will be unencrypted in the migration store, and once you run the LoadState command, the file will be copied to the destination computer.

                                /efs:copyraw

                                Causes the ScanState command to copy the files in the encrypted format. The files will be inaccessible on the destination computer until the EFS certificates are migrated. EFS certificates will be automatically migrated; however, by default USMT fails if an encrypted file is found, unless you specify an /efs option. Therefore you should specify the /efs:copyraw option with the ScanState command to migrate the encrypted file. Then, when you run the LoadState command, the encrypted file and the EFS certificate will be automatically migrated.

                                -

                                For example:

                                -

                                ScanState /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /efs:copyraw

                                -
                                -Important   -

                                All files must be encrypted if the parent folder is encrypted. If the encryption attribute on a file inside an encrypted folder has been removed, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md).

                                -
                                -
                                -  -
                                - -  - -## Incompatible Command-Line Options - - -The following table indicates which command-line options are not compatible with the **ScanState** command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options are not compatible. For example, you cannot use the **/nocompress** option with the **/encrypt** option. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-Line Option/keyfile/nocompress/genconfig/all

                                /i

                                /o

                                /v

                                /nocompress

                                X

                                N/A

                                /localonly

                                X

                                /key

                                X

                                X

                                /encrypt

                                Required*

                                X

                                X

                                /keyfile

                                N/A

                                X

                                /l

                                /progress

                                X

                                /r

                                X

                                /w

                                X

                                /c

                                X

                                /p

                                X

                                N/A

                                /all

                                X

                                /ui

                                X

                                X

                                /ue

                                X

                                X

                                /uel

                                X

                                X

                                /efs:<option>

                                X

                                /genconfig

                                N/A

                                /config

                                X

                                <StorePath>

                                X

                                - -  - -**Note**   -You must specify either the /**key** or /**keyfile** option with the /**encrypt** option. - -  - -## Related topics - - -[XML Elements Library](usmt-xml-elements-library.md) - -  - -  - - - - - +--- +title: ScanState Syntax (Windows 10) +description: ScanState Syntax +ms.assetid: 004c755f-33db-49e4-8a3b-37beec1480ea +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# ScanState Syntax + + +The ScanState command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store. + +## In This Topic + + +[Before You Begin](#bkmk-beforeyoubegin) + +[Syntax](#bkmk-syntax) + +[Storage Options](#bkmk-storageoptions) + +[Migration Rule Options](#bkmk-migrationruleoptions) + +[Monitoring Options](#bkmk-monitoringoptions) + +[User Options](#bkmk-useroptions) + +[Encrypted File Options](#bkmk-efs) + +[Incompatible Command-Line Options](#bkmk-iclo) + +## Before You Begin + + +Before you run the **ScanState** command, note the following: + +- To ensure that all operating system settings migrate, in most cases you must run the **ScanState** commands in administrator mode from an account with administrative credentials. + +- If you encrypt the migration store, you will be required to enter an encryption key or a path to a file containing the encryption key. Be sure to make note of the key or the key file location, because this information is not kept anywhere in the migration store. You will need this information when you run the LoadState command to decrypt the migration store, or if you need to run the recovery utility. An incorrect or missing key or key file results in an error message. + +- For information about software requirements for running the **ScanState** command, see [USMT Requirements](usmt-requirements.md). + +- Unless otherwise noted, you can use each option only once when running a tool on the command line. + +- You can gather domain accounts without the source computer having domain controller access. This functionality is available without any additional configuration. + +- The [Incompatible Command-Line Options](#bkmk-iclo) table lists which options you can use together and which command-line options are incompatible. + +- The directory location where you save the migration store will be excluded from the scan. For example, if you save the migration store to the root of the D drive, the D drive and all of its subdirectories will be excluded from the scan. + +## Syntax + + +This section explains the syntax and usage of the **ScanState** command-line options. The options can be specified in any order. If the option contains a parameter, you can use either a colon or a space separator. + +The **ScanState** command's syntax is: + +scanstate \[*StorePath*\] \[/apps\] \[/ppkg:*FileName*\] \[/i:\[*Path*\\\]*FileName*\] \[/o\] \[/v:*VerbosityLevel*\] \[/nocompress\] \[/localonly\] \[/encrypt /key:*KeyString*|/keyfile:\[Path\\\]*FileName*\] \[/l:\[*Path*\\\]*FileName*\] \[/progress:\[*Path*\\\]*FileName*\] \[/r:*TimesToRetry*\] \[/w:*SecondsBeforeRetry*\] \[/c\] \[/p\] \[/all\] \[/ui:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/ue:\[*DomainName*|*ComputerName*\\\]*UserName*\] \[/uel:*NumberOfDays*|*YYYY/MM/DD*|0\] \[/efs:abort|skip|decryptcopy|copyraw\] \[/genconfig:\[*Path*\\\]*FileName*\[/config:\[*Path*\\\]*FileName*\] \[/?|help\] + +For example: + +To create a Config.xml file in the current directory, use: + +`scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13` + +To create an encrypted store using the Config.xml file and the default migration .xml files, use: + +`scanstate \\server\share\migration\mystore /i:migapp.xml /i:migdocs.xml /o /config:config.xml /v:13 /encrypt /key:"mykey"` + +## Storage Options + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-Line OptionDescription

                                StorePath

                                Indicates a folder where files and settings will be saved. Note that StorePath cannot be C:\. You must specify the StorePath option in the ScanState command, except when using the /genconfig option. You cannot specify more than one StorePath location.

                                /apps

                                Scans the image for apps and includes them and their associated registry settings.

                                /ppkg [<FileName>]

                                Exports to a specific file location.

                                /o

                                Required to overwrite any existing data in the migration store or Config.xml file. If not specified, the ScanState command will fail if the migration store already contains data. You cannot use this option more than once on a command line.

                                /vsc

                                This option enables the volume shadow-copy service to migrate files that are locked or in use. This command-line option eliminates most file-locking errors that are typically encountered by the <ErrorControl> section.

                                +

                                This option can be used only with the ScanState executable file and cannot be combined with the /hardlink option.

                                /hardlink

                                Enables the creation of a hard-link migration store at the specified location. The /nocompress option must be specified with the /hardlink option.

                                /encrypt [{/key:<KeyString> | /keyfile:<file>]}

                                Encrypts the store with the specified key. Encryption is disabled by default. With this option, you will need to specify the encryption key in one of the following ways:

                                +
                                  +

                                • /key:KeyString specifies the encryption key. If there is a space in KeyString, you will need to surround KeyString with quotation marks.

                                  • +

                                • /keyfile:FilePathAndName specifies a text (.txt) file that contains the encryption key.

                                  • +
                                +

                                We recommend that KeyString be at least eight characters long, but it cannot exceed 256 characters. The /key and /keyfile options cannot be used on the same command line. The /encrypt and /nocompress options cannot be used on the same command line.

                                +
                                +Important

                                You should use caution with this option, because anyone who has access to the ScanState command-line script will also have access to the encryption key.

                                +
                                +
                                + +
                                +

                                The following example shows the ScanState command and the /key option:

                                +

                                scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /encrypt /key:mykey

                                /encrypt:<EncryptionStrength>

                                The /encrypt option accepts a command-line parameter to define the encryption strength to be used for encryption of the migration store. For more information about supported encryption algorithms, see Migration Store Encryption.

                                /nocompress

                                Disables compression of data and saves the files to a hidden folder named "File" at StorePath\USMT. Compression is enabled by default. Combining the /nocompress option with the /hardlink option generates a hard-link migration store. You can use the uncompressed store to view what USMT stored, troubleshoot a problem, or run an antivirus utility against the files. You should use this option only in testing environments, because we recommend that you use a compressed store during your actual migration, unless you are combining the /nocompress option with the /hardlink option.

                                +

                                The /nocompress and /encrypt options cannot be used together in one statement on the command line. However, if you do choose to migrate an uncompressed store, the LoadState command will migrate each file directly from the store to the correct location on the destination computer without a temporary location.

                                +

                                For example:

                                +

                                scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /nocompress

                                + + + +## Run the ScanState Command on an Offline Windows System + + +You can run the **ScanState** command in Windows Preinstallation Environment (WinPE). In addition, USMT supports migrations from previous installations of Windows contained in Windows.old directories. The offline directory can be a Windows directory when you run the **ScanState** command in WinPE or a Windows.old directory when you run the **ScanState** command in Windows. + +There are several benefits to running the **ScanState** command on an offline Windows image, including: + +- **Improved Performance.** + + Because WinPE is a thin operating system, there are fewer running services. In this environment, the **ScanState** command has more access to the local hardware resources, enabling **ScanState** to perform migration operations more quickly. + +- **Simplified end to end deployment process.** + + Migrating data from Windows.old simplifies the end-to-end deployment process by enabling the migration process to occur after the new operating system is installed. + +- **Improved success of migration.** + + The migration success rate is increased because files will not be locked for editing while offline, and because WinPE provides administrator access to files in the offline Windows file system, eliminating the need for administrator-level access to the online system. + +- **Ability to recover an unbootable computer.** + + It might be possible to recover and migrate data from an unbootable computer. + +## Offline Migration Options + + + ++++ + + + + + + + + + + + + + + + + + + + + +
                                Command-Line OptionDefinition

                                /offline:"path to an offline.xml file"

                                This option is used to define a path to an offline .xml file that might specify other offline migration options, for example, an offline Windows directory or any domain or folder redirection required in your migration.

                                /offlinewindir:"path to a Windows directory"

                                This option specifies the offline Windows directory that the ScanState command gathers user state from. The offline directory can be Windows.old when you run the ScanState command in Windows or a Windows directory when you run the ScanState command in WinPE.

                                /offlinewinold:"Windows.old directory"

                                This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.

                                + + + +## Migration Rule Options + + +USMT provides the following options to specify what files you want to migrate. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-Line OptionDescription

                                /i:[Path]FileName

                                (include)

                                +

                                Specifies an .xml file that contains rules that define what user, application or system state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigDocs.xml, and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory. For more information about which files to specify, see the "XML Files" section of the Frequently Asked Questions topic.

                                /genconfig:[Path]FileName

                                (Generate Config.xml)

                                +

                                Generates the optional Config.xml file, but does not create a migration store. To ensure that this file contains every component, application and setting that can be migrated, you should create this file on a source computer that contains all the components, applications and settings that will be present on the destination computers. In addition, you should specify the other migration .xml files, using the /i option, when you specify this option.

                                +

                                After you create this file, you will need to make use of it with the ScanState command using the /config option.

                                +

                                The only options that you can specify with this option are the /i, /v, and /l options. You cannot specify StorePath, because the /genconfig option does not create a store. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

                                +

                                Examples:

                                +
                                  +

                                • The following example creates a Config.xml file in the current directory:

                                  +

                                  scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13

                                  • +

                                /config:[Path</em>]FileName

                                Specifies the Config.xml file that the ScanState command should use to create the store. You cannot use this option more than once on the command line. Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.

                                +

                                The following example creates a store using the Config.xml file, MigDocs.xml, and MigApp.xml files:

                                +

                                scanstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scan.log

                                +

                                The following example migrates the files and settings to the destination computer using the Config.xml, MigDocs.xml, and MigApp.xml files:

                                +

                                loadstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:load.log

                                /auto:path to script files

                                This option enables you to specify the location of the default .xml files and then begin the migration. If no path is specified, USMT will reference the directory where the USMT binaries are located. The /auto option has the same effect as using the following options: /i:MigDocs.xml /i:MigApp.xml /v:5.

                                /genmigxml:path to a file

                                This option specifies that the ScanState command should use the document finder to create and export an .xml file that defines how to migrate all of the files on the computer on which the ScanState command is running.

                                /targetwindows8

                                Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 8 or Windows 8.1 instead of Windows 10. You should use this command line option in the following scenarios:

                                +
                                  +

                                • To create a Config.xml file by using the /genconfig option. Using the /targetwindows8 option optimizes the Config.xml file so that it only contains components that relate to Windows 8 or Windows 8.1.

                                  • +

                                • To create a migration store. Using the /targetwindows8 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows8 command-line option, some settings can be lost during the migration.

                                  • +

                                /targetwindows7

                                Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 7 instead of Windows 10. You should use this command line option in the following scenarios:

                                +
                                  +

                                • To create a Config.xml file by using the /genconfig option. Using the /targetwindows7 option optimizes the Config.xml file so that it only contains components that relate to Windows 7.

                                  • +

                                • To create a migration store. Using the /targetwindows7 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows7 command-line option, some settings can be lost during the migration.

                                  • +

                                /localonly

                                Migrates only files that are stored on the local computer, regardless of the rules in the .xml files that you specify on the command line. You should use this option when you want to exclude the data from removable drives on the source computer, such as USB flash drives (UFDs), some external hard drives, and so on, and when there are network drives mapped on the source computer. If the /localonly option is not specified, then the ScanState command will copy files from these removable or network drives into the store.

                                +

                                Anything that is not considered a fixed drive by the OS will be excluded by /localonly. In some cases large external hard drives are considered fixed drives. These drives can be explicitly excluded from migration by using a custom.xml file. For more information about how to exclude all files on a specific drive, see Exclude Files and Settings.

                                +

                                The /localonly command-line option includes or excludes data in the migration as identified in the following table:

                                + ++++ + + + + + + + + + + + + + + + + + + + + +
                                Drive typeBehavior with /localonly

                                Removable drives such as a USB flash drive

                                Excluded

                                Network drives

                                Excluded

                                Fixed drives

                                Included

                                +

                                + + + +## Monitoring Options + + +USMT provides several options that you can use to analyze problems that occur during migration. + +**Note** +The ScanState log is created by default, but you can specify the name and location of the log with the **/l** option. + + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-Line OptionDescription

                                /listfiles:<FileName>

                                You can use the /listfiles command-line option with the ScanState command to generate a text file that lists all of the files included in the migration.

                                /l:[Path]FileName

                                Specifies the location and name of the ScanState log.

                                +

                                You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then the log will be created in the current directory. You can use the /v option to adjust the amount of output.

                                +

                                If you run the ScanState or LoadState commands from a shared network resource, you must specify this option or USMT will fail with the following error: "USMT was unable to create the log file(s)". To fix this issue, use the /l:scan.log command.

                                /v:<VerbosityLevel>

                                (Verbosity)

                                +

                                Enables verbose output in the ScanState log file. The default value is 0.

                                +

                                You can set the VerbosityLevel to one of the following levels:

                                + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                LevelExplanation

                                0

                                Only the default errors and warnings are enabled.

                                1

                                Enables verbose output.

                                4

                                Enables error and status output.

                                5

                                Enables verbose and status output.

                                8

                                Enables error output to a debugger.

                                9

                                Enables verbose output to a debugger.

                                12

                                Enables error and status output to a debugger.

                                13

                                Enables verbose, status, and debugger output.

                                +

                                +

                                For example:

                                +

                                scanstate \server\share\migration\mystore /v:13 /i:migdocs.xml /i:migapp.xml

                                +

                                /progress:[Path</em>]FileName

                                Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

                                +

                                For example:

                                +

                                scanstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:scanlog.log

                                /c

                                When this option is specified, the ScanState command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit in the store, the ScanState command will log an error and continue with the migration. In addition, if a file is open or in use by an application, USMT may not be able to migrate the file and will log an error. Without the /c option, the ScanState command will exit on the first error.

                                +

                                You can use the new <ErrorControl> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /c command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /genconfig option now generates a sample <ErrorControl> section that is enabled by specifying error messages and desired behaviors in the Config.xml file.

                                /r:<TimesToRetry>

                                (Retry)

                                +

                                Specifies the number of times to retry when an error occurs while saving the user state to a server. The default is three times. This option is useful in environments where network connectivity is not reliable.

                                +

                                While storing the user state, the /r option will not be able to recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem.

                                /w:<SecondsBeforeRetry>

                                (Wait)

                                +

                                Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second.

                                /p:<pathToFile>

                                When the ScanState command runs, it will create an .xml file in the path specified. This .xml file includes improved space estimations for the migration store. The following example shows how to create this .xml file:

                                +

                                Scanstate.exe C:\MigrationLocation [additional parameters]

                                +

                                /p:"C:\MigrationStoreSize.xml"

                                +

                                For more information, see Estimate Migration Store Size.

                                +

                                To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, you can use the /p option, without specifying "pathtoafile", in USMT. If you specify only the /p option, the storage space estimations are created in the same manner as with USMT3.x releases.

                                /? or /help

                                Displays Help at the command line.

                                + + + +## User Options + + +By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You cannot exclude users in the migration .xml files or using the Config.xml file. For more information, see [Identify Users](usmt-identify-users.md) and [Migrate User Accounts](usmt-migrate-user-accounts.md). + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-Line OptionDescription

                                /all

                                Migrates all of the users on the computer.

                                +

                                USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to specify the /all option, you cannot also use the /ui, /ue or /uel options.

                                /ui:<DomainName>\<UserName>

                                +

                                or

                                +

                                /ui:<ComputerName>\<LocalUserName>

                                (User include)

                                +

                                Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue or /uel options. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.

                                +
                                +Note

                                If a user is specified for inclusion with the /ui option, and also is specified to be excluded with either the /ue or /uel options, the user will be included in the migration.

                                +
                                +
                                + +
                                +

                                For example:

                                +
                                  +

                                  To include only User2 from the Fabrikam domain, type:

                                  +

                                  /ue:*\* /ui:fabrikam\user2

                                  +

                                  To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, type:

                                  +

                                  /uel:30 /ui:fabrikam\*

                                  +

                                  In this example, a user account from the Contoso domain that was last modified 2 months ago will not be migrated.

                                  +
                                +

                                For more examples, see the descriptions of the /ue and /ui options in this table.

                                /uel:<NumberOfDays>

                                +

                                or

                                +

                                /uel:<YYYY/MM/DD>

                                +

                                or

                                +

                                /uel:0

                                (User exclude based on last logon)

                                +

                                Migrates the users that logged onto the source computer within the specified time period, based on the Last Modified date of the Ntuser.dat file on the source computer. The /uel option acts as an include rule. For example, the /uel:30 option migrates users who logged on, or whose account was modified, within the last 30 days from the date when the ScanState command is run.

                                +

                                You can specify a number of days or you can specify a date. You cannot use this option with the /all option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged onto another computer, that logon instance is not considered by USMT.

                                +
                                +Note

                                The /uel option is not valid in offline migrations.

                                +
                                +
                                + +
                                +
                                  +

                                • /uel:0 migrates any users who are currently logged on.

                                  • +

                                • /uel:90 migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.

                                  • +

                                • /uel:1 migrates users whose account has been modified within the last 24 hours.

                                  • +

                                • /uel:2002/1/15 migrates users who have logged on or been modified January 15, 2002 or afterwards.

                                  • +
                                +

                                For example:

                                +

                                scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0

                                /ue:<DomainName>\<UserName>

                                +

                                -or-

                                +

                                +

                                /ue:<ComputerName>\<LocalUserName>

                                (User exclude)

                                +

                                Excludes the specified users from the migration. You can specify multiple /ue options. You cannot use this option with the /all option. <DomainName> and <UserName> can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks.

                                +

                                For example:

                                +

                                scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1

                                + + + +## How to Use /ui and /ue + + +The following examples apply to both the /**ui** and /**ue** options. You can replace the /**ue** option with the /**ui** option to include, rather than exclude, the specified users. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                BehaviorCommand

                                Exclude the user named User One in the Fabrikam domain.

                                /ue:"fabrikam\user one"

                                Exclude the user named User1 in the Fabrikam domain.

                                /ue:fabrikam\user1

                                Exclude the local user named User1.

                                /ue:%computername%\user1

                                Exclude all domain users.

                                /ue:Domain\*

                                Exclude all local users.

                                /ue:%computername%\*

                                Exclude users in all domains named User1, User2, and so on.

                                /ue:*\user*

                                + + + +## Using the Options Together + + +You can use the /**uel**, /**ue** and /**ui** options together to migrate only the users that you want migrated. + +The /**ui** option has precedence over the /**ue** and /**uel** options. If a user is specified to be included using the /**ui** option, and also specified to be excluded using either the /**ue** or /**uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the /**ui** option takes precedence over the /**ue** option. + +The /**uel** option takes precedence over the /**ue** option. If a user has logged on within the specified time period set by the /**uel** option, that user’s profile will be migrated even if they are excluded by using the /**ue** option. For example, if you specify `/ue:fixed\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                                BehaviorCommand

                                Include only User2 from the Fabrikam domain and exclude all other users.

                                /ue:*\* /ui:fabrikam\user2

                                Include only the local user named User1 and exclude all other users.

                                /ue:*\* /ui:user1

                                Include only the domain users from Contoso, except Contoso\User1.

                                This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:

                                +
                                  +

                                • On the ScanState command line, type: /ue:*\* /ui:contoso\*

                                  • +

                                • On the LoadState command line, type: /ue:contoso\user1

                                  • +

                                Include only local (non-domain) users.

                                /ue:*\* /ui:%computername%\*

                                + + + +## Encrypted File Options + + +You can use the following options to migrate encrypted files. In all cases, by default, USMT fails if an encrypted file is found unless you specify an /**efs** option. To migrate encrypted files, you must change the default behavior. + +For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md). + +**Note** +EFS certificates will be migrated automatically when migrating to Windows 7, Windows 8 or Windows 10. Therefore, you should specify the /**efs:copyraw** option with the **ScanState** command to migrate the encrypted files + + + +**Caution** +Take caution when migrating encrypted files. If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration. + + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-Line OptionExplanation

                                /efs:hardlink

                                Creates a hard link to the EFS file instead of copying it. Use only with the /hardlink and the /nocompress options.

                                /efs:abort

                                Causes the ScanState command to fail with an error code, if an Encrypting File System (EFS) file is found on the source computer. Enabled by default.

                                /efs:skip

                                Causes the ScanState command to ignore EFS files.

                                /efs:decryptcopy

                                Causes the ScanState command to decrypt the file, if possible, before saving it to the migration store, and to fail if the file cannot be decrypted. If the ScanState command succeeds, the file will be unencrypted in the migration store, and once you run the LoadState command, the file will be copied to the destination computer.

                                /efs:copyraw

                                Causes the ScanState command to copy the files in the encrypted format. The files will be inaccessible on the destination computer until the EFS certificates are migrated. EFS certificates will be automatically migrated; however, by default USMT fails if an encrypted file is found, unless you specify an /efs option. Therefore you should specify the /efs:copyraw option with the ScanState command to migrate the encrypted file. Then, when you run the LoadState command, the encrypted file and the EFS certificate will be automatically migrated.

                                +

                                For example:

                                +

                                ScanState /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /efs:copyraw

                                +
                                +Important

                                All files must be encrypted if the parent folder is encrypted. If the encryption attribute on a file inside an encrypted folder has been removed, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. For more information, see Migrate EFS Files and Certificates.

                                +
                                +
                                + +
                                + + + +## Incompatible Command-Line Options + + +The following table indicates which command-line options are not compatible with the **ScanState** command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options are not compatible. For example, you cannot use the **/nocompress** option with the **/encrypt** option. + + +++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-Line Option/keyfile/nocompress/genconfig/all

                                /i

                                /o

                                /v

                                /nocompress

                                X

                                N/A

                                /localonly

                                X

                                /key

                                X

                                X

                                /encrypt

                                Required*

                                X

                                X

                                /keyfile

                                N/A

                                X

                                /l

                                /progress

                                X

                                /r

                                X

                                /w

                                X

                                /c

                                X

                                /p

                                X

                                N/A

                                /all

                                X

                                /ui

                                X

                                X

                                /ue

                                X

                                X

                                /uel

                                X

                                X

                                /efs:<option>

                                X

                                /genconfig

                                N/A

                                /config

                                X

                                <StorePath>

                                X

                                + + + +**Note** +You must specify either the /**key** or /**keyfile** option with the /**encrypt** option. + + + +## Related topics + + +[XML Elements Library](usmt-xml-elements-library.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-technical-reference.md b/windows/deployment/usmt/usmt-technical-reference.md index 8386dcb426..74dbc40088 100644 --- a/windows/deployment/usmt/usmt-technical-reference.md +++ b/windows/deployment/usmt/usmt-technical-reference.md @@ -1,10 +1,14 @@ --- title: User State Migration Tool (USMT) Technical Reference (Windows 10) -description: The User State Migration Tool (USMT) is included with the Windows Assessment and Deployment Kit (Windows ADK) for Windows 10. USMT provides a highly customizable user-profile migration experience for IT professionals. +description: The User State Migration Tool (USMT) provides a highly customizable user-profile migration experience for IT professionals. ms.assetid: f90bf58b-5529-4520-a9f8-b6cb4e4d3add +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article diff --git a/windows/deployment/usmt/usmt-test-your-migration.md b/windows/deployment/usmt/usmt-test-your-migration.md index fd06ddddea..183f7bc16e 100644 --- a/windows/deployment/usmt/usmt-test-your-migration.md +++ b/windows/deployment/usmt/usmt-test-your-migration.md @@ -2,9 +2,13 @@ title: Test Your Migration (Windows 10) description: Test Your Migration ms.assetid: 754af276-8386-4eac-8079-3d1e45964a0d +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -19,19 +23,19 @@ After you have thoroughly tested the entire migration process on a single comput If your test migration encounters any errors, examine the ScanState and LoadState logs to obtain the exact User State Migration Tool (USMT) 10.0 return code and associated error messages or Windows application programming interface (API) error message. For more information about USMT return codes and error messages, see [Return Codes](usmt-return-codes.md). You can also obtain more information about a Windows API error message by typing **net helpmsg** and the error message number on the command line. -In most cases, the ScanState and LoadState logs indicate why a USMT migration is failing. We recommend that you use the **/v***:5* option when testing your migration. This verbosity level can be adjusted in a production migration. Reducing the verbosity level might make it more difficult to diagnose failures that are encountered during production migrations. You can use a higher verbosity level if you want the log files output to go to a debugger. +In most cases, the ScanState and LoadState logs indicate why a USMT migration is failing. We recommend that you use the **/v**:5 option when testing your migration. This verbosity level can be adjusted in a production migration. Reducing the verbosity level might make it more difficult to diagnose failures that are encountered during production migrations. You can use a higher verbosity level if you want the log files output to go to a debugger. **Note**   -Running the ScanState and LoadState tools with the **/v***:5* option creates a detailed log file. Although this option makes the log file large, it is helpful in determining where migration errors occurred. +Running the ScanState and LoadState tools with the **/v**:5 option creates a detailed log file. Although this option makes the log file large, it is helpful in determining where migration errors occurred. -  + -After you have determined that the pilot migration successfully migrated the specified files and settings, you are ready to add USMT to the server that is running Microsoft® System Center Configuration Manager (SCCM), or a non-Microsoft management technology. For more information, see [Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=140246). +After you have determined that the pilot migration successfully migrated the specified files and settings, you are ready to add USMT to the server that is running Microsoft Endpoint Configuration Manager, or a non-Microsoft management technology. For more information, see [Manage user state in Configuration Manager](https://docs.microsoft.com/configmgr/osd/get-started/manage-user-state). **Note**   For testing purposes, you can create an uncompressed store using the **/hardlink /nocompress** option. When compression is disabled, the ScanState tool saves the files and settings to a hidden folder named "File" at *StorePath*\\USMT. You can use the uncompressed store to view what USMT has stored or to troubleshoot a problem, or you can run an antivirus utility against the files. Additionally, you can also use the **/listfiles** command-line option and the diagnostic log to list the files that were gathered and to troubleshoot problems with your migration. -  + ## Related topics @@ -40,9 +44,9 @@ For testing purposes, you can create an uncompressed store using the **/hardlink [Log Files](usmt-log-files.md) -  + -  + diff --git a/windows/deployment/usmt/usmt-topics.md b/windows/deployment/usmt/usmt-topics.md index 16bffa6816..69321a476c 100644 --- a/windows/deployment/usmt/usmt-topics.md +++ b/windows/deployment/usmt/usmt-topics.md @@ -1,27 +1,30 @@ ---- -title: User State Migration Tool (USMT) Overview Topics (Windows 10) -description: User State Migration Tool (USMT) Overview Topics -ms.assetid: 23170271-130b-416f-a7a7-c2f6adc32eee -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) Overview Topics -The User State Migration Tool (USMT) 10.0 provides a highly customizable user-profile migration experience for IT professionals. USMT includes three command-line tools: ScanState.exe, LoadState.exe, and UsmtUtils.exe. USMT also includes a set of three modifiable .xml files: MigApp.xml, MigDocs.xml, and MigUser.xml. Additionally, you can create custom .xml files to support your migration needs. You can also create a Config.xml file to specify files or settings to exclude from the migration. - -## In This Section - -|Topic |Description| -|------|-----------| -|[User State Migration Tool (USMT) Overview](usmt-overview.md)|Describes the benefits and limitations of using USMT.| -|[Getting Started with the User State Migration Tool (USMT)](getting-started-with-the-user-state-migration-tool.md)|Describes the general process to follow to migrate files and settings, and provides links to more information.| -|[Windows Upgrade and Migration Considerations](../upgrade/windows-upgrade-and-migration-considerations.md)|Discusses the Microsoft® tools you can use to move files and settings between installations, as well as special considerations for performing an upgrade or migration.| - -## Related topics -- [User State Migration Tool (USMT) How-to topics](usmt-how-to.md) -- [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) -- [User State Migration Toolkit (USMT) Reference](usmt-reference.md) \ No newline at end of file +--- +title: User State Migration Tool (USMT) Overview Topics (Windows 10) +description: User State Migration Tool (USMT) Overview Topics +ms.assetid: 23170271-130b-416f-a7a7-c2f6adc32eee +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) Overview Topics +The User State Migration Tool (USMT) 10.0 provides a highly customizable user-profile migration experience for IT professionals. USMT includes three command-line tools: ScanState.exe, LoadState.exe, and UsmtUtils.exe. USMT also includes a set of three modifiable .xml files: MigApp.xml, MigDocs.xml, and MigUser.xml. Additionally, you can create custom .xml files to support your migration needs. You can also create a Config.xml file to specify files or settings to exclude from the migration. + +## In This Section + +|Topic |Description| +|------|-----------| +|[User State Migration Tool (USMT) Overview](usmt-overview.md)|Describes the benefits and limitations of using USMT.| +|[Getting Started with the User State Migration Tool (USMT)](getting-started-with-the-user-state-migration-tool.md)|Describes the general process to follow to migrate files and settings, and provides links to more information.| +|[Windows Upgrade and Migration Considerations](../upgrade/windows-upgrade-and-migration-considerations.md)|Discusses the Microsoft® tools you can use to move files and settings between installations, as well as special considerations for performing an upgrade or migration.| + +## Related topics +- [User State Migration Tool (USMT) How-to topics](usmt-how-to.md) +- [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) +- [User State Migration Toolkit (USMT) Reference](usmt-reference.md) diff --git a/windows/deployment/usmt/usmt-troubleshooting.md b/windows/deployment/usmt/usmt-troubleshooting.md index a3c18ef846..085f3892d2 100644 --- a/windows/deployment/usmt/usmt-troubleshooting.md +++ b/windows/deployment/usmt/usmt-troubleshooting.md @@ -1,70 +1,73 @@ ---- -title: User State Migration Tool (USMT) Troubleshooting (Windows 10) -description: User State Migration Tool (USMT) Troubleshooting -ms.assetid: 770f45bb-2284-463f-a29c-69c04f437533 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# User State Migration Tool (USMT) Troubleshooting - - -The following table describes topics that address common User State Migration Tool (USMT) 10.0 issues and questions. These topics describe tools that you can use to troubleshoot issues that arise during your migration. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - - - - - -

                                [Common Issues](usmt-common-issues.md)

                                Find troubleshooting solutions for common problems in USMT.

                                [Frequently Asked Questions](usmt-faq.md)

                                Find answers to questions about how to use USMT.

                                [Log Files](usmt-log-files.md)

                                Learn how to enable logging to help you troubleshoot issues in USMT.

                                [Return Codes](usmt-return-codes.md)

                                Learn how to use return codes to identify problems in USMT.

                                [USMT Resources](usmt-resources.md)

                                Find more information and support for using USMT.

                                - -  - -## Related topics - - -[USMT Best Practices](usmt-best-practices.md) - -[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) - -[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) - -[User State Migration Toolkit (USMT) Reference](usmt-reference.md) - -  - -  - - - - - +--- +title: User State Migration Tool (USMT) Troubleshooting (Windows 10) +description: User State Migration Tool (USMT) Troubleshooting +ms.assetid: 770f45bb-2284-463f-a29c-69c04f437533 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# User State Migration Tool (USMT) Troubleshooting + + +The following table describes topics that address common User State Migration Tool (USMT) 10.0 issues and questions. These topics describe tools that you can use to troubleshoot issues that arise during your migration. + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + +

                                Common Issues

                                Find troubleshooting solutions for common problems in USMT.

                                Frequently Asked Questions

                                Find answers to questions about how to use USMT.

                                Log Files

                                Learn how to enable logging to help you troubleshoot issues in USMT.

                                Return Codes

                                Learn how to use return codes to identify problems in USMT.

                                USMT Resources

                                Find more information and support for using USMT.

                                + + + +## Related topics + + +[USMT Best Practices](usmt-best-practices.md) + +[User State Migration Tool (USMT) Overview Topics](usmt-topics.md) + +[User State Migration Tool (USMT) How-to topics](usmt-how-to.md) + +[User State Migration Toolkit (USMT) Reference](usmt-reference.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-utilities.md b/windows/deployment/usmt/usmt-utilities.md index 1f7f57ce3e..4e9269a29d 100644 --- a/windows/deployment/usmt/usmt-utilities.md +++ b/windows/deployment/usmt/usmt-utilities.md @@ -1,348 +1,351 @@ ---- -title: UsmtUtils Syntax (Windows 10) -description: UsmtUtils Syntax -ms.assetid: cdab7f2d-dd68-4016-b9ed-41ffa743b65c -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# UsmtUtils Syntax - - -This topic describes the syntax for the utilities available in User State Migration Tool (USMT) 10.0 through the command-line interface. These utilities: - -- Improve your ability to determine cryptographic options for your migration. - -- Assist in removing hard-link stores that cannot otherwise be deleted due to a sharing lock. - -- Verify whether the catalog file or any of the other files in the compressed migration store have become corrupted. - -- Extract files from the compressed migration store when you migrate files and settings to the destination computer. - -## In This Topic - - -[Usmtutils.exe](#bkmk-usmtutils-exe) - -[Verify Options](#bkmk-verifyoptions) - -[Extract Options](#bkmk-extractoptions) - -## Usmtutils.exe - - -The following table lists command-line options for USMTutils.exe. The sections that follow provide further command-line options for the **/verify** and the **/extract** options. - -The syntax for UsmtUtils.exe is: - -usmtutils \[/ec | /rd *<storeDir>* | /verify *<filepath>* \[options\] | /extract *<filepath>* *<destinationPath>* \[options\]\] - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-line OptionDescription

                                /ec

                                Returns a list of supported cryptographic algorithms (AlgIDs) on the current system. You can use this on a destination computer to determine which algorithm to use with the /encrypt command before you run the ScanState tool on the source computer.

                                /rd<storeDir>

                                Removes the directory path specified by the <storeDir> argument on the computer. You can use this command to delete hard-link migration stores that cannot otherwise be deleted at a command prompt due to a sharing lock. If the migration store spans multiple volumes on a given drive, it will be deleted from all of these volumes.

                                -

                                For example:

                                -

                                usmtutils /rd D:\MyHardLinkStore

                                /y

                                Overrides the accept deletions prompt when used with the /rd option. When you use the /y option with the /rd option, you will not be prompted to accept the deletions before USMT deletes the directories.

                                /verify

                                Returns information on whether the compressed migration store is intact or whether it contains corrupted files or a corrupted catalog.

                                -

                                See [Verify Options](#bkmk-verifyoptions) for syntax and options to use with /verify.

                                /extract

                                Recovers files from a compressed USMT migration store.

                                -

                                See [Extract Options](#bkmk-extractoptions) for syntax and options to use with /extract.

                                - -  - -## Verify Options - - -Use the **/verify** option when you want to determine whether a compressed migration store is intact or whether it contains corrupted files or a corrupted catalog. For more information on how to use the **/verify** option, see [Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md). - -The syntax for **/verify** is: - -usmtutils /verify\[:*<reportType>*\] *<filePath>* \[/l:*<logfile>*\] \[/v:*VerbosityLevel*\] \[/decrypt \[:*<AlgID>*\] {/key:*<keystring>* | /keyfile:*<filename>*}\] - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-line OptionDescription

                                <reportType>

                                Specifies whether to report on all files, corrupted files only, or the status of the catalog.

                                -
                                  -

                                • Summary. Returns both the number of files that are intact and the number of files that are corrupted in the migration store. If no algorithm is specified, the summary report is displayed as a default.

                                  • -

                                • all. Returns a tab-delimited list of all of the files in the compressed migration store and the status for each file. Each line contains the file name followed by a tab spacing, and either “CORRUPTED” or “OK” depending on the status of the file. The last entry reports the corruption status of the "CATALOG" of the store. A catalog file contains metadata for all files in a migration store. The LoadState tool requires a valid catalog file in order to open the migration store. Returns "OK" if the catalog file is intact and LoadState can open the migration store and "CORRUPTED" if the migration store is corrupted.

                                  • -

                                • failureonly. Returns a tab-delimited list of only the files that are corrupted in the compressed migration store.

                                  • -

                                • Catalog. Returns only the status of the catalog file.

                                  • -
                                /l: -

                                <logfilePath>

                                Specifies the location and name of the log file.

                                /v:<VerbosityLevel>

                                (Verbosity)

                                -

                                Enables verbose output in the UsmtUtils log file. The default value is 0.

                                -

                                You can set the VerbosityLevel to one of the following levels:

                                - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                LevelExplanation

                                0

                                Only the default errors and warnings are enabled.

                                1

                                Enables verbose output.

                                4

                                Enables error and status output.

                                5

                                Enables verbose and status output.

                                8

                                Enables error output to a debugger.

                                9

                                Enables verbose output to a debugger.

                                12

                                Enables error and status output to a debugger.

                                13

                                Enables verbose, status, and debugger output.

                                -

                                 

                                /decrypt<AlgID>/:<KeyString>

                                -

                                or

                                -

                                /decrypt<AlgID>/:<“Key String”>

                                -

                                or

                                -

                                /decrypt:<AlgID>/keyfile:<FileName>

                                Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, specify a /key or /keyfile option as follows:

                                -
                                  -

                                • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

                                  -

                                  <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

                                  • -

                                • /key:<KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

                                  • -

                                • /keyfile: <FileName> specifies the location and name of a text (.txt) file that contains the encryption key.

                                  • -
                                -

                                For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md)

                                - -  - -Some examples of **/verify** commands: - -- `usmtutils /verify D:\MyMigrationStore\store.mig` - -- `usmtutils /verify:catalog D:\MyMigrationStore\store.mig` - -- `usmtutils /verify:all D:\MyMigrationStore\store.mig /decrypt /l:D:\UsmtUtilsLog.txt` - -- `usmtutils /verify:failureonly D:\MyMigrationStore\store.mig /decrypt:AES_192 /keyfile:D:\encryptionKey.txt` - -## Extract Options - - -Use the **/extract** option to recover files from a compressed USMT migration store if it will not restore normally with loadstate. For more information on how to use the **/extract** option, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). - -The syntax for **/extract** is: - -/extract *<filePath>* *<destinationPath>* \[/i:*<includePattern>*\] \[/e: *<excludePattern>*\] \[/l: *<logfile>*\] \[/v: *VerbosityLevel>*\] \[/decrypt\[:*<AlgID>*\] {key: *<keystring>* | /keyfile: *<filename>*}\] \[/o\] - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                Command-line OptionDescription

                                <filePath>

                                Path to the USMT migration store.

                                -

                                For example:

                                -

                                D:\MyMigrationStore\USMT\store.mig

                                <destinationPath>

                                Path to the folder where the tool puts the individual files.

                                /i:<includePattern>

                                Specifies a pattern for files to include in the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

                                /e:<excludePattern>

                                Specifies a pattern for files to omit from the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

                                /l:<logfilePath>

                                Specifies the location and name of the log file.

                                /v:<VerbosityLevel>

                                (Verbosity)

                                -

                                Enables verbose output in the UsmtUtils log file. The default value is 0.

                                -

                                You can set the VerbosityLevel to one of the following levels:

                                - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                LevelExplanation

                                0

                                Only the default errors and warnings are enabled.

                                1

                                Enables verbose output.

                                4

                                Enables error and status output.

                                5

                                Enables verbose and status output.

                                8

                                Enables error output to a debugger.

                                9

                                Enables verbose output to a debugger.

                                12

                                Enables error and status output to a debugger.

                                13

                                Enables verbose, status, and debugger output.

                                -

                                 

                                /decrypt<AlgID>/key:<KeyString>

                                -

                                or

                                -

                                /decrypt<AlgID>/:<“Key String”>

                                -

                                or

                                -

                                /decrypt:<AlgID>/keyfile:<FileName>

                                Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, you must also specify a /key or /keyfile option as follows:

                                -
                                  -

                                • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

                                  -

                                  <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

                                  • -

                                • /key: <KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

                                  • -

                                • /keyfile:<FileName> specifies a text (.txt) file that contains the encryption key

                                  • -
                                -

                                For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md).

                                /o

                                Overwrites existing output files.

                                - -  - -Some examples of **/extract** commands: - -- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig C:\ExtractedStore` - -- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:"*.txt, *.pdf" C:\ExtractedStore /decrypt /keyfile:D:\encryptionKey.txt` - -- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedStore /decrypt:AES_128 /key:password /l:C:\usmtlog.txt` - -- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o` - -## Related topics - - -[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) - -[Return Codes](usmt-return-codes.md) - -  - -  - - - - - +--- +title: UsmtUtils Syntax (Windows 10) +description: UsmtUtils Syntax +ms.assetid: cdab7f2d-dd68-4016-b9ed-41ffa743b65c +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# UsmtUtils Syntax + + +This topic describes the syntax for the utilities available in User State Migration Tool (USMT) 10.0 through the command-line interface. These utilities: + +- Improve your ability to determine cryptographic options for your migration. + +- Assist in removing hard-link stores that cannot otherwise be deleted due to a sharing lock. + +- Verify whether the catalog file or any of the other files in the compressed migration store have become corrupted. + +- Extract files from the compressed migration store when you migrate files and settings to the destination computer. + +## In This Topic + + +[Usmtutils.exe](#bkmk-usmtutils-exe) + +[Verify Options](#bkmk-verifyoptions) + +[Extract Options](#bkmk-extractoptions) + +## Usmtutils.exe + + +The following table lists command-line options for USMTutils.exe. The sections that follow provide further command-line options for the **/verify** and the **/extract** options. + +The syntax for UsmtUtils.exe is: + +usmtutils \[/ec | /rd *<storeDir>* | /verify *<filepath>* \[options\] | /extract *<filepath>* *<destinationPath>* \[options\]\] + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-line OptionDescription

                                /ec

                                Returns a list of supported cryptographic algorithms (AlgIDs) on the current system. You can use this on a destination computer to determine which algorithm to use with the /encrypt command before you run the ScanState tool on the source computer.

                                /rd<storeDir>

                                Removes the directory path specified by the <storeDir> argument on the computer. You can use this command to delete hard-link migration stores that cannot otherwise be deleted at a command prompt due to a sharing lock. If the migration store spans multiple volumes on a given drive, it will be deleted from all of these volumes.

                                +

                                For example:

                                +

                                usmtutils /rd D:\MyHardLinkStore

                                /y

                                Overrides the accept deletions prompt when used with the /rd option. When you use the /y option with the /rd option, you will not be prompted to accept the deletions before USMT deletes the directories.

                                /verify

                                Returns information on whether the compressed migration store is intact or whether it contains corrupted files or a corrupted catalog.

                                +

                                See Verify Options for syntax and options to use with /verify.

                                /extract

                                Recovers files from a compressed USMT migration store.

                                +

                                See Extract Options for syntax and options to use with /extract.

                                + + + +## Verify Options + + +Use the **/verify** option when you want to determine whether a compressed migration store is intact or whether it contains corrupted files or a corrupted catalog. For more information on how to use the **/verify** option, see [Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md). + +The syntax for **/verify** is: + +usmtutils /verify\[:*<reportType>*\] *<filePath>* \[/l:*<logfile>*\] \[/v:*VerbosityLevel*\] \[/decrypt \[:*<AlgID>*\] {/key:*<keystring>* | /keyfile:*<filename>*}\] + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-line OptionDescription

                                <reportType>

                                Specifies whether to report on all files, corrupted files only, or the status of the catalog.

                                +
                                  +

                                • Summary. Returns both the number of files that are intact and the number of files that are corrupted in the migration store. If no algorithm is specified, the summary report is displayed as a default.

                                  • +

                                • all. Returns a tab-delimited list of all of the files in the compressed migration store and the status for each file. Each line contains the file name followed by a tab spacing, and either “CORRUPTED” or “OK” depending on the status of the file. The last entry reports the corruption status of the "CATALOG" of the store. A catalog file contains metadata for all files in a migration store. The LoadState tool requires a valid catalog file in order to open the migration store. Returns "OK" if the catalog file is intact and LoadState can open the migration store and "CORRUPTED" if the migration store is corrupted.

                                  • +

                                • failureonly. Returns a tab-delimited list of only the files that are corrupted in the compressed migration store.

                                  • +

                                • Catalog. Returns only the status of the catalog file.

                                  • +
                                /l: +

                                <logfilePath>

                                Specifies the location and name of the log file.

                                /v:<VerbosityLevel>

                                (Verbosity)

                                +

                                Enables verbose output in the UsmtUtils log file. The default value is 0.

                                +

                                You can set the VerbosityLevel to one of the following levels:

                                + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                LevelExplanation

                                0

                                Only the default errors and warnings are enabled.

                                1

                                Enables verbose output.

                                4

                                Enables error and status output.

                                5

                                Enables verbose and status output.

                                8

                                Enables error output to a debugger.

                                9

                                Enables verbose output to a debugger.

                                12

                                Enables error and status output to a debugger.

                                13

                                Enables verbose, status, and debugger output.

                                +

                                 

                                /decrypt<AlgID>/:<KeyString>

                                +

                                or

                                +

                                /decrypt<AlgID>/:<“Key String”>

                                +

                                or

                                +

                                /decrypt:<AlgID>/keyfile:<FileName>

                                Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, specify a /key or /keyfile option as follows:

                                +
                                  +

                                • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

                                  +

                                  <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

                                  • +

                                • /key:<KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

                                  • +

                                • /keyfile: <FileName> specifies the location and name of a text (.txt) file that contains the encryption key.

                                  • +
                                +

                                For more information about supported encryption algorithms, see Migration Store Encryption

                                + + + +Some examples of **/verify** commands: + +- `usmtutils /verify D:\MyMigrationStore\store.mig` + +- `usmtutils /verify:catalog D:\MyMigrationStore\store.mig` + +- `usmtutils /verify:all D:\MyMigrationStore\store.mig /decrypt /l:D:\UsmtUtilsLog.txt` + +- `usmtutils /verify:failureonly D:\MyMigrationStore\store.mig /decrypt:AES_192 /keyfile:D:\encryptionKey.txt` + +## Extract Options + + +Use the **/extract** option to recover files from a compressed USMT migration store if it will not restore normally with loadstate. For more information on how to use the **/extract** option, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). + +The syntax for **/extract** is: + +/extract *<filePath>* *<destinationPath>* \[/i:*<includePattern>*\] \[/e: *<excludePattern>*\] \[/l: *<logfile>*\] \[/v: *VerbosityLevel>*\] \[/decrypt\[:*<AlgID>*\] {key: *<keystring>* | /keyfile: *<filename>*}\] \[/o\] + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                Command-line OptionDescription

                                <filePath>

                                Path to the USMT migration store.

                                +

                                For example:

                                +

                                D:\MyMigrationStore\USMT\store.mig

                                <destinationPath>

                                Path to the folder where the tool puts the individual files.

                                /i:<includePattern>

                                Specifies a pattern for files to include in the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

                                /e:<excludePattern>

                                Specifies a pattern for files to omit from the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

                                /l:<logfilePath>

                                Specifies the location and name of the log file.

                                /v:<VerbosityLevel>

                                (Verbosity)

                                +

                                Enables verbose output in the UsmtUtils log file. The default value is 0.

                                +

                                You can set the VerbosityLevel to one of the following levels:

                                + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                LevelExplanation

                                0

                                Only the default errors and warnings are enabled.

                                1

                                Enables verbose output.

                                4

                                Enables error and status output.

                                5

                                Enables verbose and status output.

                                8

                                Enables error output to a debugger.

                                9

                                Enables verbose output to a debugger.

                                12

                                Enables error and status output to a debugger.

                                13

                                Enables verbose, status, and debugger output.

                                +

                                 

                                /decrypt<AlgID>/key:<KeyString>

                                +

                                or

                                +

                                /decrypt<AlgID>/:<“Key String”>

                                +

                                or

                                +

                                /decrypt:<AlgID>/keyfile:<FileName>

                                Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, you must also specify a /key or /keyfile option as follows:

                                +
                                  +

                                • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

                                  +

                                  <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

                                  • +

                                • /key: <KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

                                  • +

                                • /keyfile:<FileName> specifies a text (.txt) file that contains the encryption key

                                  • +
                                +

                                For more information about supported encryption algorithms, see Migration Store Encryption.

                                /o

                                Overwrites existing output files.

                                + + + +Some examples of **/extract** commands: + +- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig C:\ExtractedStore` + +- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:"*.txt, *.pdf" C:\ExtractedStore /decrypt /keyfile:D:\encryptionKey.txt` + +- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /e:*.exe C:\ExtractedStore /decrypt:AES_128 /key:password /l:C:\usmtlog.txt` + +- `usmtutils /extract D:\MyMigrationStore\USMT\store.mig /i:myProject.* /e:*.exe C:\ExtractedStore /o` + +## Related topics + + +[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) + +[Return Codes](usmt-return-codes.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md index 90ad6b1407..4fc36c33bc 100644 --- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md +++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md @@ -1,426 +1,429 @@ ---- -title: What does USMT migrate (Windows 10) -description: What does USMT migrate -ms.assetid: f613987d-0f17-43fe-9717-6465865ceda7 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 09/12/2017 -ms.topic: article ---- - -# What does USMT migrate? - - -## In this topic - - -- [Default migration scripts](#bkmk-defaultmigscripts) - -- [User Data](#bkmk-3) - -- [Operating-system components](#bkmk-4) - -- [Supported applications](#bkmk-2) - -- [What USMT does not migrate](#no) - -## Default migration scripts - - -The User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. USMT provides the following sample scripts: - -- **MigApp.XML.** Rules to migrate application settings. - -- **MigDocs.XML.** Rules that use the **MigXmlHelper.GenerateDocPatterns** helper function, which can be used to automatically find user documents on a computer without the need to author extensive custom migration .xml files. - -- **MigUser.XML.** Rules to migrate user profiles and user data. - - MigUser.xml gathers everything in a user’s profile and then does a file extension- based search of most of the system for other user data. If data doesn’t match either of these criteria, the data won’t be migrated. For the most part, this file describes a "core" migration. - - The following data does not migrate with MigUser.xml: - - - Files outside the user profile that don’t match one of the file extensions in MigUser.xml. - - - Access control lists (ACLs) for folders outside the user profile. - -## User data - - -This section describes the user data that USMT migrates by default, using the MigUser.xml file. It also defines how to migrate ACLs. - -- **Folders from each user profile.** When you specify the MigUser.xml file, USMT migrates everything in a user’s profiles including the following: - - My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites. - - >[!IMPORTANT] - >Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues#usmt-does-not-migrate-the-start-layout). - -- **Folders from the All Users and Public profiles.** When you specify the MigUser.xml file, USMT also migrates the following from the **All Users** profile in Windows® XP, or the **Public** profile in Windows Vista, Windows 7, or Windows 8: - - - Shared Documents - - - Shared Video - - - Shared Music - - - Shared desktop files - - - Shared Pictures - - - Shared Start menu - - - Shared Favorites - -- **File types.** When you specify the MigUser.xml file, the ScanState tool searches the fixed drives, collects and then migrates files with any of the following file extensions: - - **.accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*.** - - **Note**   - The asterisk (\*) stands for zero or more characters. - -   - -- **Access control lists.** USMT migrates ACLs for specified files and folders from computers running both Windows® XP and Windows Vista. For example, if you migrate a file named File1.txt that is read-only for User1 and read/write for User2, these settings will still apply on the destination computer after the migration. - -**Important**   -To migrate ACLs, you must specify the directory to migrate in the MigUser.xml file. Using file patterns like \*.doc will not migrate a directory. The source ACL information is migrated only when you explicitly specify the directory. For example, `c:\test docs`. - -  - -## Operating-system components - - -USMT migrates operating-system components to a destination computer from computers running Windows 7 and Windows 8 - -The following components are migrated by default using the manifest files: - -- Accessibility settings - -- Address book - -- Command-prompt settings - -- \*Desktop wallpaper - -- EFS files - -- Favorites - -- Folder options - -- Fonts - -- Group membership. USMT migrates users’ group settings. The groups to which a user belongs can be found by right-clicking **My Computer** on the Start menu and then clicking **Manage**. When running an offline migration, the use of a **<ProfileControl>** section in the Config.xml file is required. - -- \*Windows Internet Explorer® settings - -- Microsoft® Open Database Connectivity (ODBC) settings - -- Mouse and keyboard settings - -- Network drive mapping - -- \*Network printer mapping - -- \*Offline files - -- \*Phone and modem options - -- RAS connection and phone book (.pbk) files - -- \*Regional settings - -- Remote Access - -- \*Taskbar settings - -- User personal certificates (all) - -- Windows Mail. - -- \*Windows Media Player - -- Windows Rights Management - -\* These settings are not available for an offline migration. For more information, see [Offline Migration Reference](offline-migration-reference.md). - -**Important**   -This list may not be complete. There may be additional components that are migrated. - -  - -**Note**   -Some settings, such as fonts, are not applied by the LoadState tool until after the destination computer has been restarted. For this reason, restart the destination computer after you run the LoadState tool. - -  - -## Supported applications - - -Although it is not required for all applications, it is good practice to install all applications on the destination computer before restoring the user state. Installing applications before migrating settings helps to ensure that the migrated settings are not overwritten by the application installers. - -**Note**   -The versions of installed applications must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. - -  - -**Note**   -USMT migrates only the settings that have been used or modified by the user. If there is an application setting on the source computer that was not touched by the user, the setting may not migrate. - -  - -When you specify the MigApp.xml file, USMT migrates the settings for the following applications: - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                ProductVersion

                                Adobe Acrobat Reader

                                9

                                AOL Instant Messenger

                                6.8

                                Adobe Creative Suite

                                2

                                Adobe Photoshop CS

                                8, 9

                                Adobe ImageReady CS

                                Apple iTunes

                                6, 7, 8

                                Apple QuickTime Player

                                5, 6, 7

                                Apple Safari

                                3.1.2

                                Google Chrome

                                beta

                                Google Picasa

                                3

                                Google Talk

                                beta

                                IBM Lotus 1-2-3

                                9

                                IBM Lotus Notes

                                6,7, 8

                                IBM Lotus Organizer

                                5

                                IBM Lotus WordPro

                                9.9

                                Intuit Quicken Deluxe

                                2009

                                Money Plus Business

                                2008

                                Money Plus Home

                                2008

                                Mozilla Firefox

                                3

                                Microsoft Office

                                2003, 2007, 2010

                                Microsoft Office Access®

                                2003, 2007, 2010

                                Microsoft Office Excel®

                                2003, 2007, 2010

                                Microsoft Office FrontPage®

                                2003, 2007, 2010

                                Microsoft Office OneNote®

                                2003, 2007, 2010

                                Microsoft Office Outlook®

                                2003, 2007, 2010

                                Microsoft Office PowerPoint®

                                2003, 2007, 2010

                                Microsoft Office Publisher

                                2003, 2007, 2010

                                Microsoft Office Word

                                2003, 2007, 2010

                                Opera Software Opera

                                9.5

                                Microsoft Outlook Express

                                (only mailbox file)

                                Microsoft Project

                                2003, 2007

                                Microsoft Office Visio®

                                2003, 2007

                                RealPlayer Basic

                                11

                                Sage Peachtree

                                2009

                                Skype

                                3.8

                                Windows Live Mail

                                12, 14

                                Windows Live Messenger

                                8.5, 14

                                Windows Live MovieMaker

                                14

                                Windows Live Photo Gallery

                                12, 14

                                Windows Live Writer

                                12, 14

                                Windows Mail

                                (Windows 7 and 8)

                                Microsoft Works

                                9

                                Yahoo Messenger

                                9

                                Microsoft Zune™ Software

                                3

                                - -  - -## What USMT does not migrate - - -The following is a list of the settings that USMT does not migrate. If you are having a problem that is not listed here, see [Common Issues](usmt-common-issues.md). - -### Application settings - -USMT does not migrate the following application settings: - -- Settings from earlier versions of an application. The versions of each application must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. USMT can migrate from an earlier version of Microsoft Office to a later version. - -- Application settings and some operating-system settings when a local account is created. For example, if you run /lac to create a local account on the destination computer, USMT will migrate the user data, but only some of the operating-system settings, such as wallpaper and screensaver settings, and no application settings will migrate. - -- Microsoft Project settings, when migrating from Office 2003 to Office 2007 system. - -- ICQ Pro settings, if ICQ Pro is installed in a different location on the destination computer. To successfully migrate the settings of ICQ Pro, you must install ICQ Pro in the same location on the destination computer as it was on the source computer. Otherwise, after you run the LoadState tool, the application will not start. You may encounter problems when: - - - You change the default installation location on 32-bit destination computers. - - - You attempt to migrate from a 32-bit computer to a 64-bit computer. This is because the ICQ Pro default installation directory is different on the two types of computers. When you install ICQ Pro on a 32-bit computer, the default location is "C:\\Program Files\\...". The ICQ Pro default installation directory on an x64-based computer, however, is “C:\\Program Files (x86)\\...”. - -### Operating-System settings - -USMT does not migrate the following operating-system settings. - -- Local printers, hardware-related settings, drivers, passwords, application binary files, synchronization files, DLL files, or other executable files. - -- Permissions for shared folders. After migration, you must manually re-share any folders that were shared on the source computer. - -- Files and settings migrating between operating systems with different languages. The operating system of the source computer must match the language of the operating system on the destination computer. - -- Customized icons for shortcuts may not migrate. - -- Taskbar settings, when the source computer is running Windows XP. - -You should also note the following: - -- You should run USMT from an account with administrative credentials. Otherwise, some data will not migrate. When running the ScanState and LoadState tools you must run the tools in Administrator mode from an account with administrative credentials. If you do not run USMT in Administrator mode, only the user profile that is logged on will be included in the migration. In addition, you must run the ScanState tool on Windows XP from an account with administrative credentials. Otherwise, some operating-system settings will not migrate. To run in Administrator mode, click **Start**, click **All Programs**, click **Accessories**, right-click **Command Prompt**, and then click **Run as administrator**. - -- You can use the /**localonly** option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when you specify /**localonly**, see [ScanState Syntax](usmt-scanstate-syntax.md). - -### Start menu layout - -Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues#usmt-does-not-migrate-the-start-layout). - -## Related topics - - -[Plan your migration](usmt-plan-your-migration.md) - -  - -  - - - - - +--- +title: What does USMT migrate (Windows 10) +description: What does USMT migrate +ms.assetid: f613987d-0f17-43fe-9717-6465865ceda7 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 09/12/2017 +ms.topic: article +--- + +# What does USMT migrate? + + +## In this topic + + +- [Default migration scripts](#bkmk-defaultmigscripts) + +- [User Data](#bkmk-3) + +- [Operating-system components](#bkmk-4) + +- [Supported applications](#bkmk-2) + +- [What USMT does not migrate](#no) + +## Default migration scripts + + +The User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. USMT provides the following sample scripts: + +- **MigApp.XML.** Rules to migrate application settings. + +- **MigDocs.XML.** Rules that use the **MigXmlHelper.GenerateDocPatterns** helper function, which can be used to automatically find user documents on a computer without the need to author extensive custom migration .xml files. + +- **MigUser.XML.** Rules to migrate user profiles and user data. + + MigUser.xml gathers everything in a user’s profile and then does a file extension- based search of most of the system for other user data. If data doesn’t match either of these criteria, the data won’t be migrated. For the most part, this file describes a "core" migration. + + The following data does not migrate with MigUser.xml: + + - Files outside the user profile that don’t match one of the file extensions in MigUser.xml. + + - Access control lists (ACLs) for folders outside the user profile. + +## User data + + +This section describes the user data that USMT migrates by default, using the MigUser.xml file. It also defines how to migrate ACLs. + +- **Folders from each user profile.** When you specify the MigUser.xml file, USMT migrates everything in a user’s profiles including the following: + + My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites. + + >[!IMPORTANT] + >Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues#usmt-does-not-migrate-the-start-layout). + +- **Folders from the All Users and Public profiles.** When you specify the MigUser.xml file, USMT also migrates the following from the **All Users** profile in Windows® XP, or the **Public** profile in Windows Vista, Windows 7, or Windows 8: + + - Shared Documents + + - Shared Video + + - Shared Music + + - Shared desktop files + + - Shared Pictures + + - Shared Start menu + + - Shared Favorites + +- **File types.** When you specify the MigUser.xml file, the ScanState tool searches the fixed drives, collects and then migrates files with any of the following file extensions: + + **.accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*.** + + **Note**   + The asterisk (\*) stands for zero or more characters. + + + +- **Access control lists.** USMT migrates ACLs for specified files and folders from computers running both Windows® XP and Windows Vista. For example, if you migrate a file named File1.txt that is read-only for User1 and read/write for User2, these settings will still apply on the destination computer after the migration. + +**Important**   +To migrate ACLs, you must specify the directory to migrate in the MigUser.xml file. Using file patterns like \*.doc will not migrate a directory. The source ACL information is migrated only when you explicitly specify the directory. For example, `c:\test docs`. + + + +## Operating-system components + + +USMT migrates operating-system components to a destination computer from computers running Windows 7 and Windows 8 + +The following components are migrated by default using the manifest files: + +- Accessibility settings + +- Address book + +- Command-prompt settings + +- \*Desktop wallpaper + +- EFS files + +- Favorites + +- Folder options + +- Fonts + +- Group membership. USMT migrates users’ group settings. The groups to which a user belongs can be found by right-clicking **My Computer** on the Start menu and then clicking **Manage**. When running an offline migration, the use of a **<ProfileControl>** section in the Config.xml file is required. + +- \*Windows Internet Explorer® settings + +- Microsoft® Open Database Connectivity (ODBC) settings + +- Mouse and keyboard settings + +- Network drive mapping + +- \*Network printer mapping + +- \*Offline files + +- \*Phone and modem options + +- RAS connection and phone book (.pbk) files + +- \*Regional settings + +- Remote Access + +- \*Taskbar settings + +- User personal certificates (all) + +- Windows Mail. + +- \*Windows Media Player + +- Windows Rights Management + +\* These settings are not available for an offline migration. For more information, see [Offline Migration Reference](offline-migration-reference.md). + +**Important**   +This list may not be complete. There may be additional components that are migrated. + + + +**Note**   +Some settings, such as fonts, are not applied by the LoadState tool until after the destination computer has been restarted. For this reason, restart the destination computer after you run the LoadState tool. + + + +## Supported applications + + +Although it is not required for all applications, it is good practice to install all applications on the destination computer before restoring the user state. Installing applications before migrating settings helps to ensure that the migrated settings are not overwritten by the application installers. + +**Note**   +The versions of installed applications must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. + + + +**Note**   +USMT migrates only the settings that have been used or modified by the user. If there is an application setting on the source computer that was not touched by the user, the setting may not migrate. + + + +When you specify the MigApp.xml file, USMT migrates the settings for the following applications: + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                ProductVersion

                                Adobe Acrobat Reader

                                9

                                AOL Instant Messenger

                                6.8

                                Adobe Creative Suite

                                2

                                Adobe Photoshop CS

                                8, 9

                                Adobe ImageReady CS

                                Apple iTunes

                                6, 7, 8

                                Apple QuickTime Player

                                5, 6, 7

                                Apple Safari

                                3.1.2

                                Google Chrome

                                beta

                                Google Picasa

                                3

                                Google Talk

                                beta

                                IBM Lotus 1-2-3

                                9

                                IBM Lotus Notes

                                6,7, 8

                                IBM Lotus Organizer

                                5

                                IBM Lotus WordPro

                                9.9

                                Intuit Quicken Deluxe

                                2009

                                Money Plus Business

                                2008

                                Money Plus Home

                                2008

                                Mozilla Firefox

                                3

                                Microsoft Office

                                2003, 2007, 2010

                                Microsoft Office Access®

                                2003, 2007, 2010

                                Microsoft Office Excel®

                                2003, 2007, 2010

                                Microsoft Office FrontPage®

                                2003, 2007, 2010

                                Microsoft Office OneNote®

                                2003, 2007, 2010

                                Microsoft Office Outlook®

                                2003, 2007, 2010

                                Microsoft Office PowerPoint®

                                2003, 2007, 2010

                                Microsoft Office Publisher

                                2003, 2007, 2010

                                Microsoft Office Word

                                2003, 2007, 2010

                                Opera Software Opera

                                9.5

                                Microsoft Outlook Express

                                (only mailbox file)

                                Microsoft Project

                                2003, 2007

                                Microsoft Office Visio®

                                2003, 2007

                                RealPlayer Basic

                                11

                                Sage Peachtree

                                2009

                                Skype

                                3.8

                                Windows Live Mail

                                12, 14

                                Windows Live Messenger

                                8.5, 14

                                Windows Live MovieMaker

                                14

                                Windows Live Photo Gallery

                                12, 14

                                Windows Live Writer

                                12, 14

                                Windows Mail

                                (Windows 7 and 8)

                                Microsoft Works

                                9

                                Yahoo Messenger

                                9

                                Microsoft Zune™ Software

                                3

                                + + + +## What USMT does not migrate + + +The following is a list of the settings that USMT does not migrate. If you are having a problem that is not listed here, see [Common Issues](usmt-common-issues.md). + +### Application settings + +USMT does not migrate the following application settings: + +- Settings from earlier versions of an application. The versions of each application must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. USMT can migrate from an earlier version of Microsoft Office to a later version. + +- Application settings and some operating-system settings when a local account is created. For example, if you run /lac to create a local account on the destination computer, USMT will migrate the user data, but only some of the operating-system settings, such as wallpaper and screensaver settings, and no application settings will migrate. + +- Microsoft Project settings, when migrating from Office 2003 to Office 2007 system. + +- ICQ Pro settings, if ICQ Pro is installed in a different location on the destination computer. To successfully migrate the settings of ICQ Pro, you must install ICQ Pro in the same location on the destination computer as it was on the source computer. Otherwise, after you run the LoadState tool, the application will not start. You may encounter problems when: + + - You change the default installation location on 32-bit destination computers. + + - You attempt to migrate from a 32-bit computer to a 64-bit computer. This is because the ICQ Pro default installation directory is different on the two types of computers. When you install ICQ Pro on a 32-bit computer, the default location is "C:\\Program Files\\...". The ICQ Pro default installation directory on an x64-based computer, however, is “C:\\Program Files (x86)\\...”. + +### Operating-System settings + +USMT does not migrate the following operating-system settings. + +- Local printers, hardware-related settings, drivers, passwords, application binary files, synchronization files, DLL files, or other executable files. + +- Permissions for shared folders. After migration, you must manually re-share any folders that were shared on the source computer. + +- Files and settings migrating between operating systems with different languages. The operating system of the source computer must match the language of the operating system on the destination computer. + +- Customized icons for shortcuts may not migrate. + +- Taskbar settings, when the source computer is running Windows XP. + +You should also note the following: + +- You should run USMT from an account with administrative credentials. Otherwise, some data will not migrate. When running the ScanState and LoadState tools you must run the tools in Administrator mode from an account with administrative credentials. If you do not run USMT in Administrator mode, only the user profile that is logged on will be included in the migration. In addition, you must run the ScanState tool on Windows XP from an account with administrative credentials. Otherwise, some operating-system settings will not migrate. To run in Administrator mode, click **Start**, click **All Programs**, click **Accessories**, right-click **Command Prompt**, and then click **Run as administrator**. + +- You can use the /**localonly** option to exclude the data from removable drives and network drives mapped on the source computer. For more information about what is excluded when you specify /**localonly**, see [ScanState Syntax](usmt-scanstate-syntax.md). + +### Start menu layout + +Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](https://docs.microsoft.com/windows/deployment/usmt/usmt-common-issues#usmt-does-not-migrate-the-start-layout). + +## Related topics + + +[Plan your migration](usmt-plan-your-migration.md) + + + + + + + + + diff --git a/windows/deployment/usmt/usmt-xml-elements-library.md b/windows/deployment/usmt/usmt-xml-elements-library.md index edea901079..bfbd4e2c61 100644 --- a/windows/deployment/usmt/usmt-xml-elements-library.md +++ b/windows/deployment/usmt/usmt-xml-elements-library.md @@ -2,9 +2,13 @@ title: XML Elements Library (Windows 10) description: XML Elements Library ms.assetid: f5af0f6d-c3bf-4a4c-a0ca-9db7985f954f +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -53,66 +57,66 @@ The following table describes the XML elements and helper functions you can use -

                                [<addObjects>](#addobjects)

                                -

                                [<attributes>](#attribute)

                                -

                                [<bytes>](#bytes)

                                -

                                [<commandLine>](#commandline)

                                -

                                [<component>](#component)

                                -

                                [<condition>](#condition)

                                -

                                [<conditions>](#conditions)

                                -

                                [<content>](#content)

                                -

                                [<contentModify>](#contentmodify)

                                -

                                [<description>](#description)

                                -

                                [<destinationCleanup>](#destinationcleanup)

                                -

                                [<detect>](#detect)

                                -

                                [<detects>](#detects)

                                -

                                [<detection>](#detection)

                                -

                                [<displayName>](#displayname)

                                -

                                [<environment>](#bkmk-environment)

                                -

                                [<exclude>](#exclude)

                                -

                                [<excludeAttributes>](#excludeattributes)

                                -

                                [<extensions>](#extensions)

                                -

                                [<extension>](#extension)

                                -

                                [<externalProcess>](#externalprocess)

                                -

                                [<icon>](#icon)

                                -

                                [<include>](#include)

                                -

                                [<includeAttribute>](#includeattributes)

                                -

                                [<library>](#library)

                                -

                                [<location>](#location)

                                -

                                [<locationModify>](#locationmodify)

                                -

                                [<_locDefinition>](#locdefinition)

                                -

                                [<manufacturer>](#manufacturer)

                                -

                                [<merge>](#merge)

                                -

                                [<migration>](#migration)

                                -

                                [<namedElements>](#namedelements)

                                -

                                [<object>](#object)

                                -

                                [<objectSet>](#objectset)

                                -

                                [<path>](#path)

                                -

                                [<paths>](#paths)

                                -

                                [<pattern>](#pattern)

                                -

                                [<processing>](#processing)

                                -

                                [<plugin>](#plugin)

                                -

                                [<role>](#role)

                                -

                                [<rules>](#rules)

                                -

                                [<script>](#script)

                                -

                                [<text>](#text)

                                -

                                [<unconditionalExclude>](#unconditionalexclude)

                                -

                                [<variable>](#variable)

                                -

                                [<version>](#version)

                                -

                                [<windowsObjects>](#windowsobjects)

                                -

                                [<condition> functions](#conditionfunctions)

                                -

                                [<content> functions](#contentfunctions)

                                -

                                [<contentModify> functions](#contentmodifyfunctions)

                                -

                                [<include> and <exclude> filter functions](#persistfilterfunctions)

                                -

                                [<locationModify> functions](#locationmodifyfunctions)

                                -

                                [<merge> functions](#mergefunctions)

                                -

                                [<script> functions](#scriptfunctions)

                                -

                                [Internal USMT functions](#internalusmtfunctions)

                                +

                                <addObjects>

                                +

                                <attributes>

                                +

                                <bytes>

                                +

                                <commandLine>

                                +

                                <component>

                                +

                                <condition>

                                +

                                <conditions>

                                +

                                <content>

                                +

                                <contentModify>

                                +

                                <description>

                                +

                                <destinationCleanup>

                                +

                                <detect>

                                +

                                <detects>

                                +

                                <detection>

                                +

                                <displayName>

                                +

                                <environment>

                                +

                                <exclude>

                                +

                                <excludeAttributes>

                                +

                                <extensions>

                                +

                                <extension>

                                +

                                <externalProcess>

                                +

                                <icon>

                                +

                                <include>

                                +

                                <includeAttribute>

                                +

                                <library>

                                +

                                <location>

                                +

                                <locationModify>

                                +

                                <_locDefinition>

                                +

                                <manufacturer>

                                +

                                <merge>

                                +

                                <migration>

                                +

                                <namedElements>

                                +

                                <object>

                                +

                                <objectSet>

                                +

                                <path>

                                +

                                <paths>

                                +

                                <pattern>

                                +

                                <processing>

                                +

                                <plugin>

                                +

                                <role>

                                +

                                <rules>

                                +

                                <script>

                                +

                                <text>

                                +

                                <unconditionalExclude>

                                +

                                <variable>

                                +

                                <version>

                                +

                                <windowsObjects>

                                +

                                <condition> functions

                                +

                                <content> functions

                                +

                                <contentModify> functions

                                +

                                <include> and <exclude> filter functions

                                +

                                <locationModify> functions

                                +

                                <merge> functions

                                +

                                <script> functions

                                +

                                Internal USMT functions

                                -  + ## <addObjects> @@ -135,7 +139,7 @@ Syntax: The following example is from the MigApp.xml file: -``` syntax +``` xml %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] @@ -205,11 +209,11 @@ Syntax: -  + The following example is from the MigApp.xml file: -``` syntax +``` xml %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] DWORD @@ -268,11 +272,11 @@ Syntax: -  + The following example is from the MigApp.xml file: -``` syntax +``` xml %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] DWORD @@ -317,12 +321,12 @@ Syntax: -  + ## <component> -The <component> element is required in a custom .xml file. This element defines the most basic construct of a migration .xml file. For example, in the MigApp.xml file, "Microsoft® Office 2003" is a component that contains another component, "Microsoft Office Access® 2003". You can use the child elements to define the component. +The <component> element is required in a custom .xml file. This element defines the most basic construct of a migration .xml file. For example, in the MigApp.xml file, "Microsoft® Office 2003" is a component that contains another component, "Microsoft Office Access® 2003". You can use the child elements to define the component. A component can be nested inside another component; that is, the <component> element can be a child of the <role> element within the <component> element in two cases: 1) when the parent <component> element is a container or 2) if the child <component> element has the same role as the parent <component> element. @@ -362,7 +366,7 @@ hidden="Yes|No">

                                You can use the following to group settings, and define the type of the component.

                                • System: Operating system settings. All Windows® components are defined by this type.

                                  -

                                  When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that is specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name. Otherwise, the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.

                                  • +

                                  When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that is specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name. Otherwise, the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.

                                • Application: Settings for an application.

                                • Device: Settings for a device.

                                • Documents: Specifies files.

                                  • @@ -385,17 +389,17 @@ hidden="Yes|No">

                                  No

                                  (default = TRUE)

                                  Can be any of TRUE, FALSE, YES or NO. If this parameter is FALSE (or NO), the component will not be migrated unless there is an equivalent component on the destination computer.

                                  -

                                  When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that are specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name or the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.

                                  +

                                  When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that are specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name or the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.

                                  hidden

                                  -

                                   

                                  +

                                  This parameter is for internal USMT use only.

                                  -  + For an example, see any of the default migration .xml files. @@ -446,13 +450,13 @@ Syntax: -  + For example, In the code sample below, the <condition> elements, A and B, are joined together by the AND operator because they are in separate <conditions> sections. For example: -``` syntax +``` xml A @@ -465,7 +469,7 @@ In the code sample below, the <condition> elements, A and B, are joined to However, in the code sample below, the <condition> elements, A and B, are joined together by the OR operator because they are in the same <conditions> section. -``` syntax +``` xml A @@ -512,16 +516,18 @@ The <condition> functions return a Boolean value. You can use these elemen

                                  OSVersion

                                  Yes

                                  -

                                  The major version, minor version, build number and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version with a pattern. For example, 5.0.*.

                                  +

                                  The major version, minor version, build number and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version with a pattern. For example, 5.0.*.

                                  -   - For example: - <condition>MigXmlHelper.DoesOSMatch("NT","\*")</condition> +~~~ +For example: + +<condition>MigXmlHelper.DoesOSMatch("NT","\*")</condition> +~~~ - **IsNative64Bit** @@ -550,22 +556,24 @@ The <condition> functions return a Boolean value. You can use these elemen

                                  OSType

                                  Yes

                                  -

                                  Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is “9x”, the result will be FALSE.

                                  +

                                  Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is “9x”, the result will be FALSE.

                                  OSVersion

                                  Yes

                                  -

                                  The major version, minor version, build number, and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version but no pattern is allowed. For example, 5.0.

                                  +

                                  The major version, minor version, build number, and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version but no pattern is allowed. For example, 5.0.

                                  The IsOSLaterThan function returns TRUE if the current operating system is later than or equal to OSVersion.

                                  -   - For example: - <condition negation="Yes">MigXmlHelper.IsOSLaterThan("NT","6.0")</condition> +~~~ +For example: + +<condition negation="Yes">MigXmlHelper.IsOSLaterThan("NT","6.0")</condition> +~~~ - **IsOSEarlierThan** @@ -590,412 +598,420 @@ The <condition> functions return a Boolean value. You can use these elemen

                                  OSType

                                  Yes

                                  -

                                  Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is “9x” the result will be FALSE.

                                  +

                                  Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is “9x” the result will be FALSE.

                                  OSVersion

                                  Yes

                                  -

                                  The major version, minor version, build number, and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version but no pattern is allowed. For example, 5.0.

                                  +

                                  The major version, minor version, build number, and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version but no pattern is allowed. For example, 5.0.

                                  The IsOSEarlierThan function returns TRUE if the current operating system is earlier than OSVersion.

                                  -   + ### Object content functions -- **DoesObjectExist** +- **DoesObjectExist** - The DoesObjectExist function returns TRUE if any object exists that matches the location pattern. Otherwise, it returns FALSE. The location pattern is expanded before attempting the enumeration. + The DoesObjectExist function returns TRUE if any object exists that matches the location pattern. Otherwise, it returns FALSE. The location pattern is expanded before attempting the enumeration. - Syntax: DoesObjectExist("*ObjectType*","*EncodedLocationPattern*") + Syntax: DoesObjectExist("*ObjectType*","*EncodedLocationPattern*") - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  SettingRequired?Value

                                  ObjectType

                                  Yes

                                  Defines the object type. Can be File or Registry.

                                  EncodedLocationPattern

                                  Yes

                                  The [location pattern](#locations). Environment variables are allowed.

                                  + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  SettingRequired?Value

                                  ObjectType

                                  Yes

                                  Defines the object type. Can be File or Registry.

                                  EncodedLocationPattern

                                  Yes

                                  The location pattern. Environment variables are allowed.

                                  -   - For an example of this element, see the MigApp.xml file. -- **DoesFileVersionMatch** +~~~ +For an example of this element, see the MigApp.xml file. +~~~ - The pattern check is case insensitive. +- **DoesFileVersionMatch** - Syntax: DoesFileVersionMatch("*EncodedFileLocation*","*VersionTag*","*VersionValue*") + The pattern check is case insensitive. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  SettingRequired?Value

                                  EncodedFileLocation

                                  Yes

                                  The [location pattern](#locations) for the file that will be checked. Environment variables are allowed.

                                  VersionTag

                                  Yes

                                  The [version tag](#allowed) value that will be checked.

                                  VersionValue

                                  Yes

                                  A string pattern. For example, "Microsoft*".

                                  + Syntax: DoesFileVersionMatch("*EncodedFileLocation*","*VersionTag*","*VersionValue*") -   + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  SettingRequired?Value

                                  EncodedFileLocation

                                  Yes

                                  The location pattern for the file that will be checked. Environment variables are allowed.

                                  VersionTag

                                  Yes

                                  The version tag value that will be checked.

                                  VersionValue

                                  Yes

                                  A string pattern. For example, "Microsoft*".

                                  - For example: - <condition>MigXmlHelper.DoesFileVersionMatch("%MSNMessengerInstPath%\\msnmsgr.exe","ProductVersion","6.\*")</condition> - <condition>MigXmlHelper.DoesFileVersionMatch("%MSNMessengerInstPath%\\msnmsgr.exe","ProductVersion","7.\*")</condition> +~~~ +For example: -- **IsFileVersionAbove** +<condition>MigXmlHelper.DoesFileVersionMatch("%MSNMessengerInstPath%\\msnmsgr.exe","ProductVersion","6.\*")</condition> - The IsFileVersionAbove function returns TRUE if the version of the file is higher than *VersionValue*. +<condition>MigXmlHelper.DoesFileVersionMatch("%MSNMessengerInstPath%\\msnmsgr.exe","ProductVersion","7.\*")</condition> +~~~ - Syntax: IsFileVersionAbove("*EncodedFileLocation*","*VersionTag*","*VersionValue*") +- **IsFileVersionAbove** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  SettingRequired?Value

                                  EncodedFileLocation

                                  Yes

                                  The [location pattern](#locations) for the file that will be checked. Environment variables are allowed.

                                  VersionTag

                                  Yes

                                  The [version tag](#allowed) value that will be checked.

                                  VersionValue

                                  Yes

                                  The value to compare to. You cannot specify a pattern.

                                  + The IsFileVersionAbove function returns TRUE if the version of the file is higher than *VersionValue*. -   + Syntax: IsFileVersionAbove("*EncodedFileLocation*","*VersionTag*","*VersionValue*") -- **IsFileVersionBelow** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  SettingRequired?Value

                                  EncodedFileLocation

                                  Yes

                                  The location pattern for the file that will be checked. Environment variables are allowed.

                                  VersionTag

                                  Yes

                                  The version tag value that will be checked.

                                  VersionValue

                                  Yes

                                  The value to compare to. You cannot specify a pattern.

                                  - Syntax: IsFileVersionBelow("*EncodedFileLocation*","*VersionTag*","*VersionValue*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  SettingRequired?Value

                                  EncodedFileLocation

                                  Yes

                                  The [location pattern](#locations) for the file that will be checked. Environment variables are allowed.

                                  VersionTag

                                  Yes

                                  The [version tag](#allowed) value that will be checked.

                                  VersionValue

                                  Yes

                                  The value to compare to. You cannot specify a pattern.

                                  -   +- **IsFileVersionBelow** -- **IsSystemContext** + Syntax: IsFileVersionBelow("*EncodedFileLocation*","*VersionTag*","*VersionValue*") - The IsSystemContext function returns TRUE if the current context is "System". Otherwise, it returns FALSE. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  SettingRequired?Value

                                  EncodedFileLocation

                                  Yes

                                  The location pattern for the file that will be checked. Environment variables are allowed.

                                  VersionTag

                                  Yes

                                  The version tag value that will be checked.

                                  VersionValue

                                  Yes

                                  The value to compare to. You cannot specify a pattern.

                                  - Syntax: IsSystemContext() -- **DoesStringContentEqual** - The DoesStringContentEqual function returns TRUE if the string representation of the given object is identical to `StringContent`. +- **IsSystemContext** - Syntax: DoesStringContentEqual("*ObjectType*","*EncodedLocation*","*StringContent*") + The IsSystemContext function returns TRUE if the current context is "System". Otherwise, it returns FALSE. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  SettingRequired?Value

                                  ObjectType

                                  Yes

                                  Defines the type of object. Can be File or Registry.

                                  EncodedLocationPattern

                                  Yes

                                  The [encoded location](#locations) for the object that will be examined. You can specify environment variables.

                                  StringContent

                                  Yes

                                  The string that will be checked against.

                                  + Syntax: IsSystemContext() -   +- **DoesStringContentEqual** - For example: + The DoesStringContentEqual function returns TRUE if the string representation of the given object is identical to `StringContent`. - ``` syntax - MigXmlHelper.DoesStringContentEqual("File","%USERNAME%","") - ``` + Syntax: DoesStringContentEqual("*ObjectType*","*EncodedLocation*","*StringContent*") -- **DoesStringContentContain** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  SettingRequired?Value

                                  ObjectType

                                  Yes

                                  Defines the type of object. Can be File or Registry.

                                  EncodedLocationPattern

                                  Yes

                                  The encoded location for the object that will be examined. You can specify environment variables.

                                  StringContent

                                  Yes

                                  The string that will be checked against.

                                  - The DoesStringContentContain function returns TRUE if there is at least one occurrence of *StrToFind* in the string representation of the object. - Syntax: DoesStringContentContain("*ObjectType*","*EncodedLocation*","*StrToFind*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  SettingRequired?Value

                                  ObjectType

                                  Yes

                                  Defines the type of object. Can be File or Registry.

                                  EncodedLocationPattern

                                  Yes

                                  The [encoded location](#locations) for the object that will be examined. You can specify environment variables.

                                  StrToFind

                                  Yes

                                  A string that will be searched inside the content of the given object.

                                  +~~~ +For example: -   +``` xml +MigXmlHelper.DoesStringContentEqual("File","%USERNAME%","") +``` +~~~ -- **IsSameObject** +- **DoesStringContentContain** - The IsSameObject function returns TRUE if the given encoded locations resolve to the same physical object. Otherwise, it returns FALSE. + The DoesStringContentContain function returns TRUE if there is at least one occurrence of *StrToFind* in the string representation of the object. - Syntax: IsSameObject("*ObjectType*","*EncodedLocation1*","*EncodedLocation2*") + Syntax: DoesStringContentContain("*ObjectType*","*EncodedLocation*","*StrToFind*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  SettingRequired?Value

                                  ObjectType

                                  Yes

                                  Defines the type of object. Can be File or Registry.

                                  EncodedLocation1

                                  Yes

                                  The [encoded location](#locations) for the first object. You can specify environment variables.

                                  EncodedLocation2

                                  Yes

                                  The [encoded location](#locations) for the second object. You can specify environment variables.

                                  + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  SettingRequired?Value

                                  ObjectType

                                  Yes

                                  Defines the type of object. Can be File or Registry.

                                  EncodedLocationPattern

                                  Yes

                                  The encoded location for the object that will be examined. You can specify environment variables.

                                  StrToFind

                                  Yes

                                  A string that will be searched inside the content of the given object.

                                  -   - For example: - ``` syntax - - MigXmlHelper.IsSameObject("File","%CSIDL_FAVORITES%","%CSIDL_COMMON_FAVORITES%") - %CSIDL_FAVORITES%\* [*] - - ``` +- **IsSameObject** -- **IsSameContent** + The IsSameObject function returns TRUE if the given encoded locations resolve to the same physical object. Otherwise, it returns FALSE. - The IsSameContent function returns TRUE if the given objects have the same content. Otherwise, it returns FALSE. The content will be compared byte by byte. + Syntax: IsSameObject("*ObjectType*","*EncodedLocation1*","*EncodedLocation2*") - Syntax: IsSameContent("*ObjectType1*","*EncodedLocation1*","*ObjectType2*","*EncodedLocation2*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  SettingRequired?Value

                                  ObjectType

                                  Yes

                                  Defines the type of object. Can be File or Registry.

                                  EncodedLocation1

                                  Yes

                                  The encoded location for the first object. You can specify environment variables.

                                  EncodedLocation2

                                  Yes

                                  The encoded location for the second object. You can specify environment variables.

                                  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  SettingRequired?Value

                                  ObjectType1

                                  Yes

                                  Defines the type of the first object. Can be File or Registry.

                                  EncodedLocation1

                                  Yes

                                  The [encoded location](#locations) for the first object. You can specify environment variables.

                                  ObjectType2

                                  Yes

                                  Defines the type of the second object. Can be File or Registry.

                                  EncodedLocation2

                                  Yes

                                  The [encoded location](#locations) for the second object. You can specify environment variables.

                                  -   -- **IsSameStringContent** +~~~ +For example: - The IsSameStringContent function returns TRUE if the given objects have the same content. Otherwise, it returns FALSE. The content will be interpreted as a string. +``` xml + + MigXmlHelper.IsSameObject("File","%CSIDL_FAVORITES%","%CSIDL_COMMON_FAVORITES%") + %CSIDL_FAVORITES%\* [*] + +``` +~~~ - Syntax: IsSameStringContent("*ObjectType1*","*EncodedLocation1*","*ObjectType2*","*EncodedLocation2*") +- **IsSameContent** + + The IsSameContent function returns TRUE if the given objects have the same content. Otherwise, it returns FALSE. The content will be compared byte by byte. + + Syntax: IsSameContent("*ObjectType1*","*EncodedLocation1*","*ObjectType2*","*EncodedLocation2*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  SettingRequired?Value

                                  ObjectType1

                                  Yes

                                  Defines the type of the first object. Can be File or Registry.

                                  EncodedLocation1

                                  Yes

                                  The encoded location for the first object. You can specify environment variables.

                                  ObjectType2

                                  Yes

                                  Defines the type of the second object. Can be File or Registry.

                                  EncodedLocation2

                                  Yes

                                  The encoded location for the second object. You can specify environment variables.

                                  + + + +- **IsSameStringContent** + + The IsSameStringContent function returns TRUE if the given objects have the same content. Otherwise, it returns FALSE. The content will be interpreted as a string. + + Syntax: IsSameStringContent("*ObjectType1*","*EncodedLocation1*","*ObjectType2*","*EncodedLocation2*") + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  SettingRequired?Value

                                  ObjectType1

                                  Yes

                                  Defines the type of the first object. Can be File or Registry.

                                  EncodedLocation1

                                  Yes

                                  The encoded location for the first object. You can specify environment variables.

                                  ObjectType2

                                  Yes

                                  Defines the type of the second object. Can be File or Registry.

                                  EncodedLocation2

                                  Yes

                                  The encoded location for the second object. You can specify environment variables.

                                  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  SettingRequired?Value

                                  ObjectType1

                                  Yes

                                  Defines the type of the first object. Can be File or Registry.

                                  EncodedLocation1

                                  Yes

                                  The [encoded location](#locations) for the first object. You can specify environment variables.

                                  ObjectType2

                                  Yes

                                  Defines the type of the second object. Can be File or Registry.

                                  EncodedLocation2

                                  Yes

                                  The [encoded location](#locations) for the second object. You can specify environment variables.

                                  -   ## <conditions> @@ -1036,11 +1052,11 @@ Syntax: -  + The following example is from the MigApp.xml file: -``` syntax +``` xml MigXmlHelper.IsNative64Bit() @@ -1093,7 +1109,7 @@ Syntax: -  + ### <content> functions @@ -1132,19 +1148,21 @@ The following functions generate patterns out of the content of an object. These -   - For example: - ``` syntax - - ``` +~~~ +For example: - and +``` xml + +``` - ``` syntax - - ``` +and + +``` xml + +``` +~~~ - **ExtractMultipleFiles** @@ -1181,7 +1199,7 @@ The following functions generate patterns out of the content of an object. These -   + - **ExtractDirectory** @@ -1221,19 +1239,21 @@ The following functions generate patterns out of the content of an object. These -   - For example: - ``` syntax - - - - %HklmWowSoftware%\Classes\Software\RealNetworks\Preferences\DT_Common [] - - - - ``` +~~~ +For example: + +``` xml + + + + %HklmWowSoftware%\Classes\Software\RealNetworks\Preferences\DT_Common [] + + + +``` +~~~ ## <contentModify> @@ -1277,7 +1297,7 @@ Syntax: -  + ### <contentModify> functions @@ -1311,7 +1331,7 @@ The following functions change the content of objects as they are migrated. Thes -   + - **ConvertToString** @@ -1341,17 +1361,19 @@ The following functions change the content of objects as they are migrated. Thes -   - For example: - ``` syntax - - - HKCU\Control Panel\Desktop [ScreenSaveUsePassword] - - - ``` +~~~ +For example: + +``` xml + + + HKCU\Control Panel\Desktop [ScreenSaveUsePassword] + + +``` +~~~ - **ConvertToBinary** @@ -1387,7 +1409,7 @@ The following functions change the content of objects as they are migrated. Thes -   + - **SetValueByTable** @@ -1428,7 +1450,7 @@ The following functions change the content of objects as they are migrated. Thes -   + - **KeepExisting** @@ -1474,11 +1496,11 @@ The following functions change the content of objects as they are migrated. Thes -   + - **MergeMultiSzContent** - The MergeMultiSzContent function merges the MULTI-SZ content of the registry values that are enumerated by the parent <ObjectSet> element with the content of the equivalent registry values that already exist on the destination computer. `Instruction` and` String` either remove or add content to the resulting MULTI-SZ. Duplicate elements will be removed. + The MergeMultiSzContent function merges the MULTI-SZ content of the registry values that are enumerated by the parent <ObjectSet> element with the content of the equivalent registry values that already exist on the destination computer. `Instruction` and `String` either remove or add content to the resulting MULTI-SZ. Duplicate elements will be removed. Syntax: MergeMultiSzContent (*Instruction*,*String*,*Instruction*,*String*,…) @@ -1513,7 +1535,7 @@ The following functions change the content of objects as they are migrated. Thes -   + - **MergeDelimitedContent** @@ -1558,7 +1580,7 @@ The following functions change the content of objects as they are migrated. Thes -   + ## <description> @@ -1597,11 +1619,11 @@ Syntax: -  + The following code sample shows how the <description> element defines the "My custom component" description.: -``` syntax +``` xml My custom component ``` @@ -1610,10 +1632,10 @@ The following code sample shows how the <description> element defines the The <destinationCleanup> element deletes objects, such as files and registry keys, from the destination computer before applying the objects from the source computer. This element is evaluated only when the LoadState tool is run on the destination computer. That is, this element is ignored by the ScanState tool. -**Important**   +**Important** Use this option with extreme caution because it will delete objects from the destination computer. -  + For each <destinationCleanup> element there can be multiple <objectSet> elements. A common use for this element is if there is a missing registry key on the source computer and you want to ensure that a component is migrated. In this case, you can delete all of the component's registry keys before migrating the source registry keys. This will ensure that if there is a missing key on the source computer, it will also be missing on the destination computer. @@ -1652,11 +1674,11 @@ Syntax: -  + For example: -``` syntax +``` xml HKCU\Software\Lotus\123\99.0\DDE Preferences\* [*] @@ -1723,7 +1745,7 @@ Syntax: -  + For examples, see the examples for [<detection>](#detection). @@ -1782,11 +1804,11 @@ Syntax: -  + The following example is from the MigApp.xml file. -``` syntax +``` xml MigXmlHelper.DoesFileVersionMatch("%Lotus123InstPath%\123w.exe","ProductVersion","9.*") @@ -1853,11 +1875,11 @@ Syntax: -  + For example: -``` syntax +``` xml MigXmlHelper.DoesObjectExist("Registry","HKCU\Software\Adobe\Photoshop\8.0") @@ -1868,7 +1890,7 @@ For example: and -``` syntax +``` xml @@ -1920,11 +1942,11 @@ Syntax: -  + For example: -``` syntax +``` xml Command Prompt settings ``` @@ -1982,7 +2004,7 @@ Syntax: -  + ## @@ -1991,7 +2013,7 @@ Syntax: In this scenario, you want to generate the location of objects at run time depending on the configuration of the destination computer. For example, you must do this if an application writes data in the directory where it is installed, and users can install the application anywhere on the computer. If the application writes a registry value hklm\\software\\companyname\\install \[path\] and then updates this value with the location where the application is installed, then the only way for you to migrate the required data correctly is to define an environment variable. For example: -``` syntax +``` xml @@ -2001,7 +2023,7 @@ In this scenario, you want to generate the location of objects at run time depen Then you can use an include rule as follows. You can use any of the [<script> functions](#scriptfunctions) to perform similar tasks. -``` syntax +``` xml %INSTALLPATH%\ [*.xyz] @@ -2011,7 +2033,7 @@ Then you can use an include rule as follows. You can use any of the [<script& Second, you can also filter registry values that contain data that you need. The following example extracts the first string (before the separator ",") in the value of the registry Hklm\\software\\companyname\\application\\ \[Path\]. -``` syntax +``` xml @@ -2029,7 +2051,7 @@ Second, you can also filter registry values that contain data that you need. The In this scenario, you want to migrate five files named File1.txt, File2.txt, and so on, from %SYSTEMDRIVE%\\data\\userdata\\dir1\\dir2\\. To do this you must have the following <include> rule in an .xml file: -``` syntax +``` xml %SYSTEMDRIVE%\data\userdata\dir1\dir2 [File1.txt] @@ -2043,7 +2065,7 @@ In this scenario, you want to migrate five files named File1.txt, File2.txt, and Instead of typing the path five times, you can create a variable for the location as follows: -``` syntax +``` xml %SYSTEMDRIVE%\data\userdata\dir1\dir2 @@ -2053,7 +2075,7 @@ Instead of typing the path five times, you can create a variable for the locatio Then, you can specify the variable in an <include> rule as follows: -``` syntax +``` xml %DATAPATH% [File1.txt] @@ -2108,11 +2130,11 @@ Syntax: -  + For example, from the MigUser.xml file: -``` syntax +``` xml %CSIDL_MYMUSIC%\* [*] @@ -2165,11 +2187,11 @@ Syntax: -  + Example: -``` syntax +``` xml @@ -2272,11 +2294,11 @@ Syntax: -  + For example, if you want to migrate all \*.doc files from the source computer, specifying the following code under the <component> element: -``` syntax +``` xml doc @@ -2284,7 +2306,7 @@ For example, if you want to migrate all \*.doc files from the source computer, s is the same as specifying the following code below the <rules> element: -``` syntax +``` xml @@ -2341,7 +2363,7 @@ Syntax: -  + For an example of how to use the <externalProcess> element, see the example for [<excludeAttributes>](#excludeattributes). @@ -2393,11 +2415,11 @@ Syntax: -  + The following example is from the MigUser.xml file: -``` syntax +``` xml My Video @@ -2470,7 +2492,7 @@ The following functions return a Boolean value. You can use them to migrate cert -   + - **IgnoreIrrelevantLinks** @@ -2480,7 +2502,7 @@ The following functions return a Boolean value. You can use them to migrate cert For example: - ``` syntax + ``` xml %CSIDL_COMMON_VIDEO%\* [*] @@ -2496,7 +2518,7 @@ The following functions return a Boolean value. You can use them to migrate cert In the following example, HKCU\\Control Panel\\International \[Locale\] will be included in the store, but it will not be migrated to the destination computer: - ``` syntax + ``` xml HKCU\Control Panel\International [Locale] @@ -2545,7 +2567,7 @@ Syntax:

                                • Owner. The owner of the object (SID).

                                • Group. The primary group for the object (SID).

                                • DACL (discretionary access control list). An access control list that is controlled by the owner of an object and that specifies the access particular users or groups can have to the object.

                                  • -

                                • SACL (system access control list). An ACL that controls the generation of audit messages for attempts to access a securable object. The ability to get or set an object's SACL is controlled by a privilege typically held only by system administrators.

                                  • +

                                • SACL (system access control list). An ACL that controls the generation of audit messages for attempts to access a securable object. The ability to get or set an object's SACL is controlled by a privilege typically held only by system administrators.

                              • TimeFields can be one of the following:

                                  @@ -2558,7 +2580,7 @@ Syntax: -  + For an example of how to use the <includeAttributes> element, see the example for [<excludeAttributes>](#excludeattributes). @@ -2609,11 +2631,11 @@ Syntax: -  + The following example is from the MigApp.xml file: -``` syntax +``` xml %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] @@ -2670,11 +2692,11 @@ Syntax: -  + The following example is from the MigApp.xml file: -``` syntax +``` xml %CSIDL_APPDATA%\Microsoft\Office\ [Access10.pip] @@ -2686,45 +2708,47 @@ The following example is from the MigApp.xml file: The following functions change the location of objects as they are migrated when using the <locationModify> element. These functions are called for every object that the parent <ObjectSet> element is enumerating. The <locationModify> element will create the appropriate folder on the destination computer if it does not already exist. -- **ExactMove** +- **ExactMove** - The ExactMove function moves all of the objects that are matched by the parent <ObjectSet> element into the given *ObjectEncodedLocation*. You can use this function when you want to move a single file to a different location on the destination computer. If the destination location is a node, all of the matching source objects will be written to the node without any subdirectories. If the destination location is a leaf, the migration engine will migrate all of the matching source objects to the same location. If a collision occurs, the normal collision algorithms will apply. + The ExactMove function moves all of the objects that are matched by the parent <ObjectSet> element into the given *ObjectEncodedLocation*. You can use this function when you want to move a single file to a different location on the destination computer. If the destination location is a node, all of the matching source objects will be written to the node without any subdirectories. If the destination location is a leaf, the migration engine will migrate all of the matching source objects to the same location. If a collision occurs, the normal collision algorithms will apply. - Syntax: ExactMove(*ObjectEncodedLocation*) + Syntax: ExactMove(*ObjectEncodedLocation*) - - - - - - - - - - - - - - - - - - - - -
                                  SettingRequired?Value

                                  ObjectEncodedLocation

                                  Yes

                                  The destination [location](#locations) for all of the source objects.

                                  + + + + + + + + + + + + + + + + + + + + +
                                  SettingRequired?Value

                                  ObjectEncodedLocation

                                  Yes

                                  The destination location for all of the source objects.

                                  -   - For example: - ``` syntax - - - HKCU\Keyboard Layout\Toggle [] - - - ``` +~~~ +For example: + +``` xml + + + HKCU\Keyboard Layout\Toggle [] + + +``` +~~~ - **Move** @@ -2754,7 +2778,7 @@ The following functions change the location of objects as they are migrated when -   + - **RelativeMove** @@ -2789,22 +2813,24 @@ The following functions change the location of objects as they are migrated when -   - For example: - ``` syntax - - +~~~ +For example: + +``` xml + + + %CSIDL_COMMON_FAVORITES%\* [*] + + + + %CSIDL_COMMON_FAVORITES%\* [*] - - - - - %CSIDL_COMMON_FAVORITES%\* [*] - - - ``` +                                   +                                   +``` +~~~ ## <\_locDefinition> @@ -2848,7 +2874,7 @@ Syntax: -  + ## <merge> @@ -2894,11 +2920,11 @@ Syntax: -  + The following example is from the MigUser.xml file: -``` syntax +``` xml @@ -2923,7 +2949,7 @@ These functions control how collisions are resolved. For example: - ``` syntax + ``` xml HKCU\Software\Microsoft\Office\9.0\PhotoDraw\ [MyPictures] @@ -2966,7 +2992,7 @@ These functions control how collisions are resolved. -   + - **NewestVersion** @@ -2996,7 +3022,7 @@ These functions control how collisions are resolved. -   + - **HigherValue()** @@ -3012,7 +3038,7 @@ These functions control how collisions are resolved. For example: - ``` syntax + ``` xml %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Publisher [UpgradeVersion] @@ -3037,7 +3063,7 @@ The <migration> element is the single root element of a migration .xml fil Syntax: -<migration urlid="*UrlID/*Name"> +<migration urlid="UrlID/Name"> </migration> @@ -3058,7 +3084,7 @@ Syntax:

                                  urlid

                                  Yes

                                  -

                                  UrlID is a string identifier that uniquely identifies this .xml file. This parameter must be a no-colon-name as defined by the XML Namespaces specification. Each migration .xml file must have a unique urlid. If two migration .xml files have the same urlid, the second .xml file that is specified on the command line will not be processed. For more information about XML Namespaces, see [Use XML Namespaces](https://go.microsoft.com/fwlink/p/?LinkId=220938).

                                  +

                                  UrlID is a string identifier that uniquely identifies this .xml file. This parameter must be a no-colon-name as defined by the XML Namespaces specification. Each migration .xml file must have a unique urlid. If two migration .xml files have the same urlid, the second .xml file that is specified on the command line will not be processed. For more information about XML Namespaces, see Use XML Namespaces.

                                  Name

                                  @@ -3068,11 +3094,11 @@ Syntax: -  + The following example is from the MigApp.xml file: -``` syntax +``` xml ``` @@ -3111,10 +3137,10 @@ This filter helper function can be used to filter the migration of files based o -  -``` syntax - + +``` xml + File_size @@ -3169,7 +3195,7 @@ Syntax: The following example is from the MigApp.xml file: -``` syntax +``` xml %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] @@ -3205,7 +3231,7 @@ Syntax: The following example is from the MigUser.xml file: -``` syntax +``` xml My Music @@ -3248,7 +3274,7 @@ This is an internal USMT element. Do not use this element. You can use this element to specify multiple objects. You can specify multiple <pattern> elements for each <objectSet> element and they will be combined. If you are specifying files, you may want to use GenerateDrivePatterns with <script> instead. GenerateDrivePatterns is basically the same as a <pattern> rule, without the drive letter specification. For example, the following two lines of code are similar: -``` syntax +``` xml C:\Folder\* [Sample.doc] ``` @@ -3288,37 +3314,36 @@ Syntax:

                                  Yes

                                  A valid registry or file path pattern, followed by at least one space, followed by brackets [] that contain the object to be migrated.

                                    -

                                  • Path can contain the asterisk (*) wildcard character or can be an [Recognized Environment Variables](usmt-recognized-environment-variables.md). You cannot use the question mark as a wildcard character.You can use HKCU and HKLM to refer to HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE respectively.

                                    • -

                                  • Object can contain the asterisk (*) wildcard character. However, you cannot use the question mark as a wildcard character. For example:

                                    -

                                    C:\Folder\ [*] enumerates all files in C:\Path but no subfolders of C:\Folder.

                                    -

                                    C:\Folder\* [*] enumerates all files and subfolders of C:\Folder.

                                    +

                                  • Path can contain the asterisk () wildcard character or can be an Recognized Environment Variables. You cannot use the question mark as a wildcard character.You can use HKCU and HKLM to refer to HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE respectively.

                                    • +

                                  • Object can contain the asterisk () wildcard character. However, you cannot use the question mark as a wildcard character. For example:

                                    +

                                    C:\Folder\ [] enumerates all files in C:<em>Path but no subfolders of C:\Folder.

                                    +

                                    C:\Folder* [] enumerates all files and subfolders of C:\Folder.

                                    C:\Folder\ [*.mp3] enumerates all .mp3 files in C:\Folder.

                                    C:\Folder\ [Sample.doc] enumerates only the Sample.doc file located in C:\Folder.

                                    -Note   -

                                    If you are migrating a file that has a square bracket character ([ or ]) in the file name, you must insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", you must specify <pattern type="File">c:\documents\mydocs [file^].txt]</pattern> instead of <pattern type="File">c:\documents\mydocs [file].txt]</pattern>.

                                    +Note

                                    If you are migrating a file that has a square bracket character ([ or ]) in the file name, you must insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", you must specify <pattern type="File">c:\documents\mydocs [file^].txt]</pattern> instead of <pattern type="File">c:\documents\mydocs [file].txt]</pattern>.

                                    -  +
                                  -  + For example: - To migrate a single registry key: - ``` syntax + ``` xml HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache [Persistent] ``` - To migrate the EngineeringDrafts folder and any subfolders from the C: drive: - ``` syntax + ``` xml C:\EngineeringDrafts\* [*] ``` @@ -3328,13 +3353,13 @@ For example: - To migrate the Sample.doc file from C:\\EngineeringDrafts: - ``` syntax + ``` xml C:\EngineeringDrafts\ [Sample.doc] ``` - To migrate the Sample.doc file from where ever it exists on the C: drive use pattern in the following way. If multiple files exist with the same name on the C: drive, then all of these files will be migrated. - ``` syntax + ``` xml C:\* [Sample.doc] ``` @@ -3387,7 +3412,7 @@ Syntax: -  + ## <plugin> @@ -3443,24 +3468,24 @@ Syntax:

                                • Specify one “Container” <role> element within a <component> element. In this case, you cannot specify any child <rules> elements, only other <component> elements. And each child <component> element must have the same type as that of parent <component> element. For example:

                                  • <component context="UserAndSystem" type="Application">
-  <displayName _locID="migapp.msoffice2003">Microsoft Office 2003</displayName> 
+  <displayName _locID="migapp.msoffice2003">Microsoft Office 2003</displayName> 
   <environment name="GlobalEnv" /> 
   <role role="Container">
     <detection name="AnyOffice2003Version" /> 
     <detection name="FrontPage2003" /> 
     <!-- 
- Office 2003 Common Settings 
-  --> 
+ Office 2003 Common Settings 
+  --> 
     <component context="UserAndSystem" type="Application">
                                  -  + The following example is from the MigUser.xml file. For more examples, see the MigApp.xml file: -``` syntax +``` xml Start Menu @@ -3543,11 +3568,11 @@ Syntax: -  + The following example is from the MigUser.xml file: -``` syntax +``` xml My Music @@ -3594,7 +3619,7 @@ The return value that is required by <script> depends on the parent elemen Syntax: <script>MigXmlHelper.GetStringContent("*ObjectType*","*EncodedLocationPattern*", "*ExpandContent*")</script> - Example:` ` + Example: `` - You can use [GenerateUserPatterns](#scriptfunctions) when <script> is within <objectSet>. @@ -3639,24 +3664,23 @@ The return value that is required by <script> depends on the parent elemen

                                • When used within <objectSet>, the return value must be a two-dimensional array of strings.

                                • When used within <location>, the return value must be a valid location that aligns with the type attribute of <location>. For example, if <location type="File">, the child script element, if specified, must be a valid file location.

                                  -Note   -

                                  If you are migrating a file that has a bracket character ([ or ]) in the file name, insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", specify <pattern type="File">c:\documents\mydocs [file^].txt]</pattern> instead of <pattern type="File">c:\documents\mydocs [file].txt]</pattern>.

                                  +Note

                                  If you are migrating a file that has a bracket character ([ or ]) in the file name, insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", specify <pattern type="File">c:\documents\mydocs [file^].txt]</pattern> instead of <pattern type="File">c:\documents\mydocs [file].txt]</pattern>.

                                  -  +
                                  • -  + Examples: To migrate the Sample.doc file from any drive on the source computer, use <script> as follows. If multiple files exist with the same name, all such files will get migrated. -``` syntax +``` xml ``` @@ -3716,137 +3740,143 @@ These functions return either a string or a pattern. -   - For example: - ``` syntax - - - - ``` +~~~ +For example: -- **GenerateDrivePatterns** +``` xml + + + +``` +~~~ - The GenerateDrivePatterns function will iterate all of the available drives and select the ones that match the requested drive type. It will then concatenate the selected drives with the end part of *PatternSegment* to form a full encoded file pattern. For example, if *PatternSegment* is `Path [file.txt]` and DriveType is `Fixed`, then the function will generate `C:\Path [file.txt]`, and other patterns if there are fixed drives other than C:. You cannot specify environment variables with this function. You can use GenerateDrivePatterns with <script> elements that are within [<objectSet>](#objectset) that are within <include>/<exclude>. +- **GenerateDrivePatterns** - Syntax: GenerateDrivePatterns("*PatternSegment*","*DriveType*") + The GenerateDrivePatterns function will iterate all of the available drives and select the ones that match the requested drive type. It will then concatenate the selected drives with the end part of *PatternSegment* to form a full encoded file pattern. For example, if *PatternSegment* is `Path [file.txt]` and DriveType is `Fixed`, then the function will generate `C:\Path [file.txt]`, and other patterns if there are fixed drives other than C:. You cannot specify environment variables with this function. You can use GenerateDrivePatterns with <script> elements that are within [<objectSet>](#objectset) that are within <include>/<exclude>. - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  SettingRequired?Value

                                  PatternSegment

                                  Yes

                                  The suffix of an encoded pattern. It will be concatenated with a drive specification, such as "c:\", to form a complete [encoded file pattern](#locations). For example, "* [*.doc]". PatternSegment cannot be an environment variable.

                                  DriveType

                                  Yes

                                  The drive type for which the patterns are to be generated. You can specify one of:

                                  -
                                    -

                                  • Fixed

                                    • -

                                  • CDROM

                                    • -

                                  • Removable

                                    • -

                                  • Remote

                                    • -
                                  + Syntax: GenerateDrivePatterns("*PatternSegment*","*DriveType*") -   + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  SettingRequired?Value

                                  PatternSegment

                                  Yes

                                  The suffix of an encoded pattern. It will be concatenated with a drive specification, such as "c:&quot;, to form a complete encoded file pattern. For example, "* [*.doc]". PatternSegment cannot be an environment variable.

                                  DriveType

                                  Yes

                                  The drive type for which the patterns are to be generated. You can specify one of:

                                  +
                                    +

                                  • Fixed

                                    • +

                                  • CDROM

                                    • +

                                  • Removable

                                    • +

                                  • Remote

                                    • +
                                  - See the last component in the MigUser.xml file for an example of this element. -- **GenerateUserPatterns** - The function will iterate through all users that are being migrated, excluding the currently processed user if <ProcessCurrentUser> is FALSE, and will expand the specified pattern in the context of each user. For example, if users A, B and C have profiles in C:\\Documents and Settings), by calling `GenerateUserPattens('File','%userprofile% [*.doc]','TRUE')`, the helper function will generate the following three patterns: +~~~ +See the last component in the MigUser.xml file for an example of this element. +~~~ - - "C:\\Documents and Settings\\A\\\* \[\*.doc\]" +- **GenerateUserPatterns** - - "C:\\Documents and Settings\\B\\\* \[\*.doc\]" + The function will iterate through all users that are being migrated, excluding the currently processed user if <ProcessCurrentUser> is FALSE, and will expand the specified pattern in the context of each user. For example, if users A, B and C have profiles in C:\\Documents and Settings), by calling `GenerateUserPattens('File','%userprofile% [*.doc]','TRUE')`, the helper function will generate the following three patterns: - - "C:\\Documents and Settings\\C\\\* \[\*.doc\]" + - "C:\\Documents and Settings\\A\\\* \[\*.doc\]" - Syntax:GenerateUserPatterns("*ObjectType*","*EncodedLocationPattern*","*ProcessCurrentUser*") + - "C:\\Documents and Settings\\B\\\* \[\*.doc\]" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  SettingRequired?Value

                                  ObjectType

                                  Yes

                                  Defines the object type. Can be File or Registry.

                                  EncodedLocationPattern

                                  Yes

                                  The [location pattern](#locations). Environment variables are allowed.

                                  ProcessCurrentUser

                                  Yes

                                  Can be TRUE or FALSE. Indicates if the patterns should be generated for the current user.

                                  + - "C:\\Documents and Settings\\C\\\* \[\*.doc\]" -   + Syntax:GenerateUserPatterns("*ObjectType*","*EncodedLocationPattern*","*ProcessCurrentUser*") - **Example:** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  SettingRequired?Value

                                  ObjectType

                                  Yes

                                  Defines the object type. Can be File or Registry.

                                  EncodedLocationPattern

                                  Yes

                                  The location pattern. Environment variables are allowed.

                                  ProcessCurrentUser

                                  Yes

                                  Can be TRUE or FALSE. Indicates if the patterns should be generated for the current user.

                                  - If GenerateUserPattens('File','%userprofile% \[\*.doc\]','FALSE') is called while USMT is processing user A, then this function will only generate patterns for users B and C. You can use this helper function to build complex rules. For example, to migrate all .doc files from the source computer — but if user X is not migrated, then do not migrate any of the .doc files from user X’s profile. - The following is example code for this scenario. The first <rules> element migrates all.doc files on the source computer with the exception of those inside C:\\Documents and Settings. The second <rules> elements will migrate all .doc files from C:\\Documents and Settings with the exception of the .doc files in the profiles of the other users. Because the second <rules> element will be processed in each migrated user context, the end result will be the desired behavior. The end result is the one we expected. - ``` syntax - - - - - - - - - %ProfilesFolder%\* [*.doc] - - - - - - - %ProfilesFolder%\* [*.doc] - - - - - - - - - ``` +~~~ +**Example:** + +If GenerateUserPattens('File','%userprofile% \[\*.doc\]','FALSE') is called while USMT is processing user A, then this function will only generate patterns for users B and C. You can use this helper function to build complex rules. For example, to migrate all .doc files from the source computer — but if user X is not migrated, then do not migrate any of the .doc files from user X’s profile. + +The following is example code for this scenario. The first <rules> element migrates all.doc files on the source computer with the exception of those inside C:\\Documents and Settings. The second <rules> elements will migrate all .doc files from C:\\Documents and Settings with the exception of the .doc files in the profiles of the other users. Because the second <rules> element will be processed in each migrated user context, the end result will be the desired behavior. The end result is the one we expected. + +``` xml + + + + + + + + + %ProfilesFolder%\* [*.doc] + + + + + + + %ProfilesFolder%\* [*.doc] + + + + + + + + +``` +~~~ ### MigXmlHelper.GenerateDocPatterns @@ -3884,27 +3914,27 @@ This helper function invokes the document finder to scan the system for all file -  -``` syntax -  -  -    MigDocUser -    -      -        -          -            -          -        -        -          -            -          -        -      -    -  + +``` xml + + + MigDocUser + + + + + + + + + + + + + + + ``` ### Simple executing scripts @@ -3913,7 +3943,7 @@ The following scripts have no return value. You can use the following errors wit - **AskForLogoff()**. Prompts the user to log off at the end of the migration. For example: - ``` syntax + ``` xml @@ -3923,7 +3953,7 @@ The following scripts have no return value. You can use the following errors wit - **KillExplorer()**. Stops Explorer.exe for the current user context. This allows access to certain keys and files that are kept open when Explorer.exe is running. For example: - ``` syntax + ``` xml @@ -3931,7 +3961,7 @@ The following scripts have no return value. You can use the following errors wit - **RegisterFonts(FileEncodedLocation)**. Registers the given font or all of the fonts in the given directory. For example: - ``` syntax + ``` xml @@ -3941,7 +3971,7 @@ The following scripts have no return value. You can use the following errors wit - **RestartExplorer().** Restarts Explorer.exe at the end of the migration. For example: - ``` syntax + ``` xml @@ -3987,11 +4017,11 @@ Syntax: -  + For example: -``` syntax +``` xml %CSIDL_COMMON_APPDATA%\QuickTime @@ -4016,7 +4046,7 @@ Syntax: The following .xml file excludes all .mp3 files from migration. For additional examples of how to use this element, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md). -``` syntax +``` xml Test @@ -4083,11 +4113,11 @@ Syntax: -  + The following example is from the MigApp.xml file: -``` syntax +``` xml HKLM\Software @@ -4135,11 +4165,11 @@ Syntax: -  + For example: -``` syntax +``` xml 4.* ``` @@ -4224,9 +4254,9 @@ The following version tags contain values that can be compared: [USMT XML Reference](usmt-xml-reference.md) -  - -  + + + diff --git a/windows/deployment/usmt/usmt-xml-reference.md b/windows/deployment/usmt/usmt-xml-reference.md index bf89e762e9..e69e94db8f 100644 --- a/windows/deployment/usmt/usmt-xml-reference.md +++ b/windows/deployment/usmt/usmt-xml-reference.md @@ -1,75 +1,78 @@ ---- -title: USMT XML Reference (Windows 10) -description: USMT XML Reference -ms.assetid: fb946975-0fee-4ec0-b3ef-7c34945ee96f -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# USMT XML Reference - - -This section contains topics that you can use to work with and to customize the migration XML files. - -## In This Section - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                                  [Understanding Migration XML Files](understanding-migration-xml-files.md)

                                  Provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file.

                                  [Config.xml File](usmt-configxml-file.md)

                                  Describes the Config.xml file and policies concerning its configuration.

                                  [Customize USMT XML Files](usmt-customize-xml-files.md)

                                  Describes how to customize USMT XML files.

                                  [Custom XML Examples](usmt-custom-xml-examples.md)

                                  Gives examples of XML files for various migration scenarios.

                                  [Conflicts and Precedence](usmt-conflicts-and-precedence.md)

                                  Describes the precedence of migration rules and how conflicts are handled.

                                  [General Conventions](usmt-general-conventions.md)

                                  Describes the XML helper functions.

                                  [XML File Requirements](xml-file-requirements.md)

                                  Describes the requirements for custom XML files.

                                  [Recognized Environment Variables](usmt-recognized-environment-variables.md)

                                  Describes environment variables recognized by USMT.

                                  [XML Elements Library](usmt-xml-elements-library.md)

                                  Describes the XML elements and helper functions for authoring migration XML files to use with USMT.

                                  - -  - -  - -  - - - - - +--- +title: USMT XML Reference (Windows 10) +description: USMT XML Reference +ms.assetid: fb946975-0fee-4ec0-b3ef-7c34945ee96f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# USMT XML Reference + + +This section contains topics that you can use to work with and to customize the migration XML files. + +## In This Section + + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

                                  Understanding Migration XML Files

                                  Provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file.

                                  Config.xml File

                                  Describes the Config.xml file and policies concerning its configuration.

                                  Customize USMT XML Files

                                  Describes how to customize USMT XML files.

                                  Custom XML Examples

                                  Gives examples of XML files for various migration scenarios.

                                  Conflicts and Precedence

                                  Describes the precedence of migration rules and how conflicts are handled.

                                  General Conventions

                                  Describes the XML helper functions.

                                  XML File Requirements

                                  Describes the requirements for custom XML files.

                                  Recognized Environment Variables

                                  Describes environment variables recognized by USMT.

                                  XML Elements Library

                                  Describes the XML elements and helper functions for authoring migration XML files to use with USMT.

                                  + + + + + + + + + + + diff --git a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md index 273d230290..433a6a1605 100644 --- a/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md +++ b/windows/deployment/usmt/verify-the-condition-of-a-compressed-migration-store.md @@ -1,125 +1,128 @@ ---- -title: Verify the Condition of a Compressed Migration Store (Windows 10) -description: Verify the Condition of a Compressed Migration Store -ms.assetid: 4a3fda96-5f7d-494a-955f-6b865ec9fcae -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: greg-lindsay -ms.date: 04/19/2017 -ms.topic: article ---- - -# Verify the Condition of a Compressed Migration Store - - -When you migrate files and settings during a typical PC-refresh migration, the user state is usually stored in a compressed folder on the intermediate store. This compressed folder, also called the compressed migration store, is a single image file that contains: - -- All of the files being migrated. - -- The user’s settings. - -- A catalog file that contains metadata for all files in the migration store. - -When you run the **LoadState** command to load the data from these files to the destination computer, LoadState requires a valid catalog file in order to open the migration store. You can run the **UsmtUtils** command with the **/verify** option to determine whether the compressed migration store is intact, or whether it contains corrupted files or a corrupted catalog. You should run the **/verify** option on the migration store before you overwrite the original user-state files and settings. - -When you use the **/verify** option, you can specify what type of information to report in the UsmtUtils log file. These report types are: - -- **Catalog**: Displays the status of only the catalog file. - -- **All**: Displays the status of all files, including the catalog file. - -- **Failure only**: Displays only the files that are corrupted. - -## In This Topic - - -The following sections demonstrate how to run the **UsmtUtils** command with the **/verify** option, and how to specify the information to display in the UsmtUtils log file. - -- [The UsmtUtils syntax for the /verify option](#bkmk-verifysyntax) - -- [To verify that the migration store is intact](#bkmk-verifyintactstore) - -- [To verify the status of only the catalog file](#bkmk-verifycatalog) - -- [To verify the status of all files](#bkmk-verifyallfiles) - -- [To verify the status of the files and return only the corrupted files](#bkmk-returncorrupted) - -### The UsmtUtils Syntax for the /verify Option - -To verify the condition of a compressed migration store, use the following UsmtUtils syntax: - -cd /d<USMTpath>usmtutils /verify\[:<reportType>\] <filePath> \[/l:<logfile>\] \[/decrypt \[:<AlgID>\] {/key:<keystring> | /keyfile:<filename>}\] - -Where the placeholders have the following values: - -- *<USMTpath>* is the location where you have saved the USMT files and tools. - -- *<reportType>* specifies whether to report on all files, corrupted files only, or the status of the catalog. - -- *<filePath>* is the location of the compressed migration store. - -- *<logfile>* is the location and name of the log file. - -- *<AlgID>* is the cryptographic algorithm that was used to create the migration store on the **ScanState** command line. - -- *<keystring>* is the encryption key that was used to encrypt the migration store. - -- *<filename>* is the location and name of the text file that contains the encryption key. - -### To Verify that the Migration Store is Intact - -To verify whether the migration store is intact or whether it contains corrupted files or a corrupted catalog, type: - -``` syntax -usmtutils /verify D:\MyMigrationStore\store.mig -``` - -Because no report type is specified, UsmtUtils displays the default summary report. - -### To Verify the Status of Only the Catalog File - -To verify whether the catalog file is corrupted or intact, type: - -``` syntax -usmtutils /verify:catalog D:\MyMigrationStore\store.mig -``` - -### To Verify the Status of all Files - -To verify whether there are any corrupted files in the compressed migration store, and to specify the name and location of the log file, type: - -`usmtutils /verify:all D:\MyMigrationStore\store.mig /decrypt /l:D:\UsmtUtilsLog.txt` - -In addition to verifying the status of all files, this example decrypts the files. Because no encryption algorithm is specified, UsmtUtils uses the default 3DES cryptographic algorithm. - -### To Verify the Status of the Files and Return Only the Corrupted Files - -In this example, the log file will only list the files that became corrupted during the ScanState process. This list will include the catalog file if it is also corrupted. - -``` syntax -usmtutils /verify:failureonly D:\MyMigrationStore\USMT\store.mig /decrypt:AES_192 /keyfile:D:\encryptionKey.txt -``` - -This example also decrypts the files by specifying the cryptographic algorithm and the location of the file that contains the encryption key. - -### Next Steps - -If the **/verify** option indicates that there are corrupted files in the migration store, you can use the **/extract** option in the UsmtUtils tool to recover data from some corrupted stores. For more information, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). - -## Related topics - - -[UsmtUtils Syntax](usmt-utilities.md) - -[Return Codes](usmt-return-codes.md) - -  - -  - - - - - +--- +title: Verify the Condition of a Compressed Migration Store (Windows 10) +description: Verify the Condition of a Compressed Migration Store +ms.assetid: 4a3fda96-5f7d-494a-955f-6b865ec9fcae +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 04/19/2017 +ms.topic: article +--- + +# Verify the Condition of a Compressed Migration Store + + +When you migrate files and settings during a typical PC-refresh migration, the user state is usually stored in a compressed folder on the intermediate store. This compressed folder, also called the compressed migration store, is a single image file that contains: + +- All of the files being migrated. + +- The user’s settings. + +- A catalog file that contains metadata for all files in the migration store. + +When you run the **LoadState** command to load the data from these files to the destination computer, LoadState requires a valid catalog file in order to open the migration store. You can run the **UsmtUtils** command with the **/verify** option to determine whether the compressed migration store is intact, or whether it contains corrupted files or a corrupted catalog. You should run the **/verify** option on the migration store before you overwrite the original user-state files and settings. + +When you use the **/verify** option, you can specify what type of information to report in the UsmtUtils log file. These report types are: + +- **Catalog**: Displays the status of only the catalog file. + +- **All**: Displays the status of all files, including the catalog file. + +- **Failure only**: Displays only the files that are corrupted. + +## In This Topic + + +The following sections demonstrate how to run the **UsmtUtils** command with the **/verify** option, and how to specify the information to display in the UsmtUtils log file. + +- [The UsmtUtils syntax for the /verify option](#bkmk-verifysyntax) + +- [To verify that the migration store is intact](#bkmk-verifyintactstore) + +- [To verify the status of only the catalog file](#bkmk-verifycatalog) + +- [To verify the status of all files](#bkmk-verifyallfiles) + +- [To verify the status of the files and return only the corrupted files](#bkmk-returncorrupted) + +### The UsmtUtils Syntax for the /verify Option + +To verify the condition of a compressed migration store, use the following UsmtUtils syntax: + +cd /d<USMTpath>usmtutils /verify\[:<reportType>\] <filePath> \[/l:<logfile>\] \[/decrypt \[:<AlgID>\] {/key:<keystring> | /keyfile:<filename>}\] + +Where the placeholders have the following values: + +- *<USMTpath>* is the location where you have saved the USMT files and tools. + +- *<reportType>* specifies whether to report on all files, corrupted files only, or the status of the catalog. + +- *<filePath>* is the location of the compressed migration store. + +- *<logfile>* is the location and name of the log file. + +- *<AlgID>* is the cryptographic algorithm that was used to create the migration store on the **ScanState** command line. + +- *<keystring>* is the encryption key that was used to encrypt the migration store. + +- *<filename>* is the location and name of the text file that contains the encryption key. + +### To Verify that the Migration Store is Intact + +To verify whether the migration store is intact or whether it contains corrupted files or a corrupted catalog, type: + +``` syntax +usmtutils /verify D:\MyMigrationStore\store.mig +``` + +Because no report type is specified, UsmtUtils displays the default summary report. + +### To Verify the Status of Only the Catalog File + +To verify whether the catalog file is corrupted or intact, type: + +``` syntax +usmtutils /verify:catalog D:\MyMigrationStore\store.mig +``` + +### To Verify the Status of all Files + +To verify whether there are any corrupted files in the compressed migration store, and to specify the name and location of the log file, type: + +`usmtutils /verify:all D:\MyMigrationStore\store.mig /decrypt /l:D:\UsmtUtilsLog.txt` + +In addition to verifying the status of all files, this example decrypts the files. Because no encryption algorithm is specified, UsmtUtils uses the default 3DES cryptographic algorithm. + +### To Verify the Status of the Files and Return Only the Corrupted Files + +In this example, the log file will only list the files that became corrupted during the ScanState process. This list will include the catalog file if it is also corrupted. + +``` syntax +usmtutils /verify:failureonly D:\MyMigrationStore\USMT\store.mig /decrypt:AES_192 /keyfile:D:\encryptionKey.txt +``` + +This example also decrypts the files by specifying the cryptographic algorithm and the location of the file that contains the encryption key. + +### Next Steps + +If the **/verify** option indicates that there are corrupted files in the migration store, you can use the **/extract** option in the UsmtUtils tool to recover data from some corrupted stores. For more information, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). + +## Related topics + + +[UsmtUtils Syntax](usmt-utilities.md) + +[Return Codes](usmt-return-codes.md) + +  + +  + + + + + diff --git a/windows/deployment/usmt/xml-file-requirements.md b/windows/deployment/usmt/xml-file-requirements.md index 968c47e9bb..aeae8b54ae 100644 --- a/windows/deployment/usmt/xml-file-requirements.md +++ b/windows/deployment/usmt/xml-file-requirements.md @@ -2,9 +2,13 @@ title: XML File Requirements (Windows 10) description: XML File Requirements ms.assetid: 4b567b50-c50a-4a4f-8684-151fe3f8275f +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 04/19/2017 ms.topic: article @@ -17,20 +21,20 @@ When creating custom .xml files, note the following requirements: - **The file must be in Unicode Transformation Format-8 (UTF-8).** You must save the file in this format, and you must specify the following syntax at the beginning of each .xml file: - ``` syntax + ``` xml ``` - **The file must have a unique migration urlid**. The urlid of each file that you specify on the command line must be different. If two migration .xml files have the same urlid, the second .xml file that is specified on the command line will not be processed. This is because USMT uses the urlid to define the components within the file. For example, you must specify the following syntax at the beginning of each file: - ``` syntax + ``` xml ``` - **Each component in the file must have a display name in order for it to appear in the Config.xml file.** This is because the Config.xml file defines the components by the display name and the migration urlid. For example, specify the following syntax: - ``` syntax + ``` xml My Application ``` diff --git a/windows/deployment/vda-subscription-activation.md b/windows/deployment/vda-subscription-activation.md index 52d00d7f17..61edc16bf7 100644 --- a/windows/deployment/vda-subscription-activation.md +++ b/windows/deployment/vda-subscription-activation.md @@ -1,147 +1,151 @@ ---- -title: Configure VDA for Windows 10 Subscription Activation -description: How to enable Windows 10 Enterprise E3 and E5 subscriptions for VDA -keywords: upgrade, update, task sequence, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -ms.date: 05/17/2018 -author: greg-lindsay -ms.topic: article -ms.collection: M365-modern-desktop ---- - -# Configure VDA for Windows 10 Subscription Activation - -This document describes how to configure virtual machines (VMs) to enable [Windows 10 Subscription Activation](windows-10-enterprise-subscription-activation.md) in a Windows Virtual Desktop Access (VDA) scenario. Windows VDA is a device or user-based licensing mechanism for managing access to virtual desktops. - -Deployment instructions are provided for the following scenarios: -1. [Active Directory-joined VMs](#active-directory-joined-vms) -2. [Azure Active Directory-joined VMs](#azure-active-directory-joined-vms) -3. [Azure Gallery VMs](#azure-gallery-vms) - -## Requirements - -- VMs must be running Windows 10 Pro, version 1703 (also known as the Creator's Update) or later. -- VMs must be Active Directory-joined or Azure Active Directory (AAD)-joined. -- VMs must be generation 1. -- VMs must hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH). - -## Activation - -### Scenario 1 -- The VM is running Windows 10, version 1803 or later. -- The VM is hosted in Azure or another [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH). - - When a user with VDA rights signs in to the VM using their AAD credentials, the VM is automatically stepped-up to Enterprise and activated. There is no need to perform Windows 10 Pro activation. This eliminates the need to maintain KMS or MAK in the qualifying cloud infrastructure. - -### Scenario 2 -- The Hyper-V host and the VM are both running Windows 10, version 1803 or later. - - [Inherited Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation#inherited-activation) is enabled. All VMs created by a user with a Windows 10 E3 or E5 license are automatically activated independent of whether a user signs in iwth a local account or using an Azure Active Directory account. - -### Scenario 3 -- The VM is running Windows 10, version 1703 or 1709, or the hoster is not an authorized [QMTH](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) partner. - - In this scenario, the underlying Windows 10 Pro license must be activated prior to Subscription Activation of Windows 10 Enterprise. Activation is accomplished using a Windows 10 Pro Generic Volume License Key (GVLK) and a Volume License KMS activation server provided by the hoster. Alternatively, a KMS activation server on your corporate network can be used if you have configured a private connection, such as [ExpressRoute](https://azure.microsoft.com/services/expressroute/) or [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/). - -For examples of activation issues, see [Troubleshoot the user experience](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses#troubleshoot-the-user-experience). - -## Active Directory-joined VMs - -1. Use the following instructions to prepare the VM for Azure: [Prepare a Windows VHD or VHDX to upload to Azure](https://docs.microsoft.com/azure/virtual-machines/windows/prepare-for-upload-vhd-image) -2. (Optional) To disable network level authentication, type the following at an elevated command prompt: - - ``` - REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f - ``` - -3. At an elevated command prompt, type **sysdm.cpl** and press ENTER. -4. On the Remote tab, choose **Allow remote connections to this computer** and then click **Select Users**. -5. Click **Add**, type **Authenticated users**, and then click **OK** three times. -6. Follow the instructions to use sysprep at [Steps to generalize a VHD](https://docs.microsoft.com/azure/virtual-machines/windows/prepare-for-upload-vhd-image#steps-to-generalize-a-vhd) and then start the VM again. -7. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). -8. Open Windows Configuration Designer and click **Provison desktop services**. -9. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 10. - - 1. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name. - - Note: You can use a different project name, but this name is also used with dism.exe in a subsequent step. - 2. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**. -10. On the Set up network page, choose **Off**. -11. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details. - - Note: This step is different for [Azure AD-joined VMs](#azure-active-directory-joined-vms). -12. On the Add applications page, add applications if desired. This step is optional. -13. On the Add certificates page, add certificates if desired. This step is optional. -14. On the Finish page, click **Create**. -15. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 16. - 1. In file explorer, double-click the VHD to mount the disk image. Determine the drive letter of the mounted image. - 2. Type the following at an elevated commnand prompt. Replace the letter **G** with the drive letter of the mounted image, and enter the project name you used if it is different than the one suggested: - - ``` - Dism.exe /Image=G:\ /Add-ProvisioningPackage /PackagePath: "Desktop AD Enrollment Pro GVLK.ppkg" - ``` - 3. Right-click the mounted image in file explorer and click **Eject**. -1. See instructions at [Upload and create VM from generalized VHD](https://docs.microsoft.com/azure/virtual-machines/windows/upload-generalized-managed#log-in-to-azure) to log in to Azure, get your storage account details, upload the VHD, and create a managed image. - -## Azure Active Directory-joined VMs - ->[!IMPORTANT] ->Azure Active Directory (Azure AD) provisioning packages have a 30 day limit on bulk token usage. You will need to update the provisioning package and re-inject it into the image after 30 days. Existing virtual machines that are Azure AD-joined and deployed will not need to be recreated. - -For Azure AD-joined VMs, follow the same instructions (above) as for [Active Directory-joined VMs](#active-directory-joined-vms) with the following exceptions: -- In step 9, during setup with Windows Configuration Designer, under **Name**, type a name for the project that indicates it is not for Active Directory joined VMs, such as **Desktop Bulk Enrollment Token Pro GVLK**. -- In step 11, during setup with Windows Configuration Designer, on the Account Management page, instead of enrolling in Active Directory, choose **Enroll in Azure AD**, click **Get Bulk Token**, sign in and add the bulk token using your organization's credentials. -- In step 15, sub-step 2, when entering the PackagePath, use the project name you entered in step 9 (ex: **Desktop Bulk Enrollment Token Pro GVLK.ppkg**) -- When attempting to access the VM using remote desktop, you will need to create a custom RDP settings file as described below in [Create custom RDP settings for Azure](#create-custom-rpd-settings-for-azure). - -## Azure Gallery VMs - -1. (Optional) To disable network level authentication, type the following at an elevated command prompt: - - ``` - REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f - ``` - -2. At an elevated command prompt, type **sysdm.cpl** and press ENTER. -3. On the Remote tab, choose **Allow remote connections to this computer** and then click **Select Users**. -4. Click **Add**, type **Authenticated users**, and then click **OK** three times. -5. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). -6. Open Windows Configuration Designer and click **Provison desktop services**. -7. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 8. - 1. Under **Name**, type **Desktop Bulk Enrollment Token Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name. - 2. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**. -8. Under **Name**, type **Desktop Bulk Enrollment**, click **Finish**, and then on the **Set up device** page enter a device name. -9. On the Set up network page, choose **Off**. -10. On the Account Management page, choose **Enroll in Azure AD**, click **Get Bulk Token**, sign in, and add the bulk token using your organizations credentials. -11. On the Add applications page, add applications if desired. This step is optional. -12. On the Add certificates page, add certificates if desired. This step is optional. -13. On the Finish page, click **Create**. -14. Copy the .ppkg file to the remote Virtual machine. Double click to initiate the provisioning package install. This will reboot the system. - -- When attempting to access the VM using remote desktop, you will need to create a custom RDP settings file as described [below](#create-custom-rpd-settings-for-azure). - -## Create custom RDP settings for Azure - -To create custom RDP settings for Azure: - -1. Open Remote Desktop Connection and enter the IP address or DNS name for the remote host. -2. Click **Show Options**, and then under Connection settings click **Save As** and save the RDP file to the location where you will use it. -3. Close the Remote Desktop Connection window and open Notepad. -4. Drag the RDP file into the Notepad window to edit it. -5. Enter or replace the line that specifies authentication level with the following two lines of text: - - ```text - enablecredsspsupport:i:0 - authentication level:i:2 - ``` -6. **enablecredsspsupport** and **authentication level** should each appear only once in the file. -7. Save your changes, and then use this custom RDP file with your Azure AD credentials to connect to the Azure VM. - -## Related topics - -[Windows 10 Subscription Activation](windows-10-enterprise-subscription-activation.md) -
                                  [Recommended settings for VDI desktops](https://docs.microsoft.com/windows-server/remote/remote-desktop-services/rds-vdi-recommendations) -
                                  [Licensing the Windows Desktop for VDI Environments](https://download.microsoft.com/download/1/1/4/114A45DD-A1F7-4910-81FD-6CAF401077D0/Microsoft%20VDI%20and%20VDA%20FAQ%20v3%200.pdf) - +--- +title: Configure VDA for Windows 10 Subscription Activation +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +description: How to enable Windows 10 Enterprise E3 and E5 subscriptions for VDA +keywords: upgrade, update, task sequence, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +ms.collection: M365-modern-desktop +--- + +# Configure VDA for Windows 10 Subscription Activation + +This document describes how to configure virtual machines (VMs) to enable [Windows 10 Subscription Activation](windows-10-subscription-activation.md) in a Windows Virtual Desktop Access (VDA) scenario. Windows VDA is a device or user-based licensing mechanism for managing access to virtual desktops. + +Deployment instructions are provided for the following scenarios: +1. [Active Directory-joined VMs](#active-directory-joined-vms) +2. [Azure Active Directory-joined VMs](#azure-active-directory-joined-vms) +3. [Azure Gallery VMs](#azure-gallery-vms) + +## Requirements + +- VMs must be running Windows 10 Pro, version 1703 (also known as the Creator's Update) or later. +- VMs must be Active Directory-joined or Azure Active Directory (AAD)-joined. +- VMs must be generation 1. +- VMs must hosted by a [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH). + +## Activation + +### Scenario 1 +- The VM is running Windows 10, version 1803 or later. +- The VM is hosted in Azure or another [Qualified Multitenant Hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) (QMTH). + + When a user with VDA rights signs in to the VM using their AAD credentials, the VM is automatically stepped-up to Enterprise and activated. There is no need to perform Windows 10 Pro activation. This eliminates the need to maintain KMS or MAK in the qualifying cloud infrastructure. + +### Scenario 2 +- The Hyper-V host and the VM are both running Windows 10, version 1803 or later. + + [Inherited Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation#inherited-activation) is enabled. All VMs created by a user with a Windows 10 E3 or E5 license are automatically activated independent of whether a user signs in with a local account or using an Azure Active Directory account. + +### Scenario 3 +- The VM is running Windows 10, version 1703 or 1709, or the hoster is not an authorized [QMTH](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx) partner. + + In this scenario, the underlying Windows 10 Pro license must be activated prior to Subscription Activation of Windows 10 Enterprise. Activation is accomplished using a Windows 10 Pro Generic Volume License Key (GVLK) and a Volume License KMS activation server provided by the hoster. Alternatively, a KMS activation server on your corporate network can be used if you have configured a private connection, such as [ExpressRoute](https://azure.microsoft.com/services/expressroute/) or [VPN Gateway](https://azure.microsoft.com/services/vpn-gateway/). + +For examples of activation issues, see [Troubleshoot the user experience](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses#troubleshoot-the-user-experience). + +## Active Directory-joined VMs + +1. Use the following instructions to prepare the VM for Azure: [Prepare a Windows VHD or VHDX to upload to Azure](https://docs.microsoft.com/azure/virtual-machines/windows/prepare-for-upload-vhd-image) +2. (Optional) To disable network level authentication, type the following at an elevated command prompt: + + ``` + REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f + ``` + +3. At an elevated command prompt, type **sysdm.cpl** and press ENTER. +4. On the Remote tab, choose **Allow remote connections to this computer** and then click **Select Users**. +5. Click **Add**, type **Authenticated users**, and then click **OK** three times. +6. Follow the instructions to use sysprep at [Steps to generalize a VHD](https://docs.microsoft.com/azure/virtual-machines/windows/prepare-for-upload-vhd-image#steps-to-generalize-a-vhd) and then start the VM again. +7. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). +8. Open Windows Configuration Designer and click **Provison desktop services**. +9. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 10. + + 1. Under **Name**, type **Desktop AD Enrollment Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name. + - Note: You can use a different project name, but this name is also used with dism.exe in a subsequent step. + 2. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**. +10. On the Set up network page, choose **Off**. +11. On the Account Management page, choose **Enroll into Active Directory** and then enter the account details. + - Note: This step is different for [Azure AD-joined VMs](#azure-active-directory-joined-vms). +12. On the Add applications page, add applications if desired. This step is optional. +13. On the Add certificates page, add certificates if desired. This step is optional. +14. On the Finish page, click **Create**. +15. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 16. + 1. In file explorer, double-click the VHD to mount the disk image. Determine the drive letter of the mounted image. + 2. Type the following at an elevated commnand prompt. Replace the letter **G** with the drive letter of the mounted image, and enter the project name you used if it is different than the one suggested: + + ``` + Dism.exe /Image=G:\ /Add-ProvisioningPackage /PackagePath: "Desktop AD Enrollment Pro GVLK.ppkg" + ``` + 3. Right-click the mounted image in file explorer and click **Eject**. +16. See instructions at [Upload and create VM from generalized VHD](https://docs.microsoft.com/azure/virtual-machines/windows/upload-generalized-managed#log-in-to-azure) to log in to Azure, get your storage account details, upload the VHD, and create a managed image. + +## Azure Active Directory-joined VMs + +>[!IMPORTANT] +>Azure Active Directory (Azure AD) provisioning packages have a 180 day limit on bulk token usage. You will need to update the provisioning package and re-inject it into the image after 180 days. Existing virtual machines that are Azure AD-joined and deployed will not need to be recreated. + +For Azure AD-joined VMs, follow the same instructions (above) as for [Active Directory-joined VMs](#active-directory-joined-vms) with the following exceptions: +- In step 9, during setup with Windows Configuration Designer, under **Name**, type a name for the project that indicates it is not for Active Directory joined VMs, such as **Desktop Bulk Enrollment Token Pro GVLK**. +- In step 11, during setup with Windows Configuration Designer, on the Account Management page, instead of enrolling in Active Directory, choose **Enroll in Azure AD**, click **Get Bulk Token**, sign in and add the bulk token using your organization's credentials. +- In step 15, sub-step 2, when entering the PackagePath, use the project name you entered in step 9 (ex: **Desktop Bulk Enrollment Token Pro GVLK.ppkg**) +- When attempting to access the VM using remote desktop, you will need to create a custom RDP settings file as described below in [Create custom RDP settings for Azure](#create-custom-rdp-settings-for-azure). + +## Azure Gallery VMs + +1. (Optional) To disable network level authentication, type the following at an elevated command prompt: + + ``` + REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f + ``` + +2. At an elevated command prompt, type **sysdm.cpl** and press ENTER. +3. On the Remote tab, choose **Allow remote connections to this computer** and then click **Select Users**. +4. Click **Add**, type **Authenticated users**, and then click **OK** three times. +5. [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd). +6. Open Windows Configuration Designer and click **Provison desktop services**. +7. If you must activate Windows 10 Pro as described for [scenario 3](#scenario-3), complete the following steps. Otherwise, skip to step 8. + 1. Under **Name**, type **Desktop Bulk Enrollment Token Pro GVLK**, click **Finish**, and then on the **Set up device** page enter a device name. + 2. Under **Enter product key** type the Pro GVLK key: **W269N-WFGWX-YVC9B-4J6C9-T83GX**. +8. Under **Name**, type **Desktop Bulk Enrollment**, click **Finish**, and then on the **Set up device** page enter a device name. +9. On the Set up network page, choose **Off**. +10. On the Account Management page, choose **Enroll in Azure AD**, click **Get Bulk Token**, sign in, and add the bulk token using your organizations credentials. +11. On the Add applications page, add applications if desired. This step is optional. +12. On the Add certificates page, add certificates if desired. This step is optional. +13. On the Finish page, click **Create**. +14. Copy the .ppkg file to the remote Virtual machine. Double click to initiate the provisioning package install. This will reboot the system. + +- When attempting to access the VM using remote desktop, you will need to create a custom RDP settings file as described [below](#create-custom-rdp-settings-for-azure). + +## Create custom RDP settings for Azure + +To create custom RDP settings for Azure: + +1. Open Remote Desktop Connection and enter the IP address or DNS name for the remote host. +2. Click **Show Options**, and then under Connection settings click **Save As** and save the RDP file to the location where you will use it. +3. Close the Remote Desktop Connection window and open Notepad. +4. Drag the RDP file into the Notepad window to edit it. +5. Enter or replace the line that specifies authentication level with the following two lines of text: + + ```text + enablecredsspsupport:i:0 + authentication level:i:2 + ``` +6. **enablecredsspsupport** and **authentication level** should each appear only once in the file. +7. Save your changes, and then use this custom RDP file with your Azure AD credentials to connect to the Azure VM. + +## Related topics + +[Windows 10 Subscription Activation](windows-10-subscription-activation.md) +
                                  [Recommended settings for VDI desktops](https://docs.microsoft.com/windows-server/remote/remote-desktop-services/rds-vdi-recommendations) +
                                  [Licensing the Windows Desktop for VDI Environments](https://download.microsoft.com/download/1/1/4/114A45DD-A1F7-4910-81FD-6CAF401077D0/Microsoft%20VDI%20and%20VDA%20FAQ%20v3%200.pdf) + diff --git a/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md b/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md index feaadc8e47..cd12f07346 100644 --- a/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md +++ b/windows/deployment/volume-activation/activate-forest-by-proxy-vamt.md @@ -1,53 +1,57 @@ ---- -title: Activate by Proxy an Active Directory Forest (Windows 10) -description: Activate by Proxy an Active Directory Forest -ms.assetid: 6475fc87-a6f7-4fa8-b0aa-de19f2dea7e5 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Activate by Proxy an Active Directory Forest - -You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate by proxy an Active Directory (AD) forest for an isolated workgroup that does not have Internet access. ADBA enables certain volume products to inherit activation from the domain. - -**Important**   -ADBA is only applicable to Generic Volume License Keys (GVLKs) and KMS Host key (CSVLK). To use ADBA, one or more KMS Host keys (CSVLK) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products. - -In a typical proxy-activation scenario, the VAMT host computer distributes a product key to one or more client computers and collects the installation ID (IID) from each computer. The VAMT host computer sends the IIDs to Microsoft on behalf of the client computers and obtains the corresponding Confirmation IDs (CIDs). The VAMT host computer then installs the CIDs on the client computer to complete the activation. If you use this activation method, only the VAMT host computer needs to have Internet access. - -**Note**   -For workgroups that are isolated from any larger network, you can still perform an AD forest activation. This requires installing a second instance of VAMT on a computer in the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. You can also activate by proxy a KMS Host key (CSVLK) in the core network if you do not want the host computer to connect to Microsoft over the Internet. - -## Requirements - -Before performing proxy activation, ensure that the network and the VAMT installation meet the following requirements: -- There is an instance of VAMT that is installed on a computer that has Internet access. If you are performing proxy activation for an isolated workgroup, you must also have VAMT installed on one of the computers in the workgroup. -- VAMT has administrative permissions to the Active Directory domain. - -**To perform an Active Directory forest proxy activation** - -1. Open VAMT. -2. In the left-side pane, click the **Active Directory-Based Activation** node. -3. In the right-side **Actions** pane, click **Proxy activate forest** to open the **Install Product Key** dialog box. -4. In the **Install Product Key** dialog box, select the KMS Host key (CSVLK) that you want to activate. -5. If you want to rename the ADBA object, enter a new Active Directory-Based Activation Object name. If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed. -6. Enter the name of the file where you want to save the offline installation ID, or browse to the file location and then click **Open**. If you are activating an AD forest in an isolated workgroup, save the .cilx file to a removable media device. -7. Click **Install Key**. VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. The activated object and the date that it was created appear in the **Active Directory-Based Activation** node in the center pane. -9. Insert the removable media into the VAMT host that has Internet access. Make sure that you are on the root node, and that the **Volume Activation Management Tool** view is displayed in the center pane. -10. In the right-side **Actions** pane, click **Acquire confirmation IDs for CILX** to open the **Acquire confirmation IDs for file** dialog box. -11. In the **Acquire confirmation IDs for file** dialog box, browse to where the .cilx file you exported from the isolated workgroup host computer is located. Select the file, and then click **Open**. VAMT displays an **Acquiring Confirmation IDs** message while it contacts Microsoft and acquires the CIDs. -12. When the CID collection process is complete, VAMT displays a **Volume Activation Management Tool** message that shows how many confirmation IDs were successfully acquired, and the name of the file to which the IDs were saved. Click **OK** to close the message. -13. Remove the storage device that contains the .cilx file from the Internet-connected VAMT host computer and insert it into the VAMT host computer in the isolated workgroup. -14. Open VAMT and then click the **Active Directory-Based Activation** node in the left-side pane. -15. In the right-side **Actions** pane, click **Apply confirmation ID to Active Directory domain**, browse to the .cilx file and then click **Open**. - -VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. The activated object and the date that it was created appear in the **Active Directory-Based Activation** node in the center pane. - -## Related topics - -- [Add and Remove Computers](add-remove-computers-vamt.md) +--- +title: Activate by Proxy an Active Directory Forest (Windows 10) +description: Activate by Proxy an Active Directory Forest +ms.assetid: 6475fc87-a6f7-4fa8-b0aa-de19f2dea7e5 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Activate by Proxy an Active Directory Forest + +You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate by proxy an Active Directory (AD) forest for an isolated workgroup that does not have Internet access. ADBA enables certain volume products to inherit activation from the domain. + +> [!IMPORTANT] +> ADBA is only applicable to *Generic Volume License Keys (GVLKs)* and *KMS Host key (CSVLK)*. To use ADBA, one or more KMS Host keys (CSVLK) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products. + +In a typical proxy-activation scenario, the VAMT host computer distributes a product key to one or more client computers and collects the installation ID (IID) from each computer. The VAMT host computer sends the IIDs to Microsoft on behalf of the client computers and obtains the corresponding Confirmation IDs (CIDs). The VAMT host computer then installs the CIDs on the client computer to complete the activation. If you use this activation method, only the VAMT host computer needs to have Internet access. + +> [!NOTE] +> For workgroups that are isolated from any larger network, you can still perform an AD forest activation. This requires installing a second instance of VAMT on a computer in the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. You can also activate by proxy a KMS Host key (CSVLK) in the core network if you do not want the host computer to connect to Microsoft over the Internet. + +## Requirements + +Before performing proxy activation, ensure that the network and the VAMT installation meet the following requirements: +- There is an instance of VAMT that is installed on a computer that has Internet access. If you are performing proxy activation for an isolated workgroup, you must also have VAMT installed on one of the computers in the workgroup. +- VAMT has administrative permissions to the Active Directory domain. + +**To perform an Active Directory forest proxy activation** + +1. Open VAMT. +2. In the left-side pane, click the **Active Directory-Based Activation** node. +3. In the right-side **Actions** pane, click **Proxy activate forest** to open the **Install Product Key** dialog box. +4. In the **Install Product Key** dialog box, select the KMS Host key (CSVLK) that you want to activate. +5. If you want to rename the ADBA object, enter a new Active Directory-Based Activation Object name. If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed. +6. Enter the name of the file where you want to save the offline installation ID, or browse to the file location and then click **Open**. If you are activating an AD forest in an isolated workgroup, save the .cilx file to a removable media device. +7. Click **Install Key**. VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. The activated object and the date that it was created appear in the **Active Directory-Based Activation** node in the center pane. +9. Insert the removable media into the VAMT host that has Internet access. Make sure that you are on the root node, and that the **Volume Activation Management Tool** view is displayed in the center pane. +10. In the right-side **Actions** pane, click **Acquire confirmation IDs for CILX** to open the **Acquire confirmation IDs for file** dialog box. +11. In the **Acquire confirmation IDs for file** dialog box, browse to where the .cilx file you exported from the isolated workgroup host computer is located. Select the file, and then click **Open**. VAMT displays an **Acquiring Confirmation IDs** message while it contacts Microsoft and acquires the CIDs. +12. When the CID collection process is complete, VAMT displays a **Volume Activation Management Tool** message that shows how many confirmation IDs were successfully acquired, and the name of the file to which the IDs were saved. Click **OK** to close the message. +13. Remove the storage device that contains the .cilx file from the Internet-connected VAMT host computer and insert it into the VAMT host computer in the isolated workgroup. +14. Open VAMT and then click the **Active Directory-Based Activation** node in the left-side pane. +15. In the right-side **Actions** pane, click **Apply confirmation ID to Active Directory domain**, browse to the .cilx file and then click **Open**. + +VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. The activated object and the date that it was created appear in the **Active Directory-Based Activation** node in the center pane. + +## Related topics + +- [Add and Remove Computers](add-remove-computers-vamt.md) diff --git a/windows/deployment/volume-activation/activate-forest-vamt.md b/windows/deployment/volume-activation/activate-forest-vamt.md index ea37d1ba1a..06362064ff 100644 --- a/windows/deployment/volume-activation/activate-forest-vamt.md +++ b/windows/deployment/volume-activation/activate-forest-vamt.md @@ -1,47 +1,50 @@ ---- -title: Activate an Active Directory Forest Online (Windows 10) -description: Activate an Active Directory Forest Online -ms.assetid: 9b5bc193-799b-4aa5-9d3e-0e495f7195d3 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Activate an Active Directory Forest Online - -You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate an Active Directory (AD) forest over the Internet. ADBA enables certain products to inherit activation from the domain. - -**Important**   -ADBA is only applicable to Generic Volume License Keys (GVLKs) and KMS Host keys (CSVLKs). To use ADBA, one or more KMS Host keys (CSVLKs) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products. - -## Requirements - -Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: -- VAMT is installed on a host computer that has Internet access. -- VAMT has administrative permissions to the Active Directory domain. -- The KMS Host key (CSVLK) you intend to use is added to VAMT in the **Product Keys** node. - -**To perform an online Active Directory forest activation** - -1. Open VAMT. -2. In the left-side pane, click the **Active Directory-Based Activation** node. -3. In the right-side **Actions** pane, click **Online activate forest** to open the **Install Product Key** dialog box. -4. In the **Install Product Key** dialog box, select the KMS Host key (CSVLK) that you want to apply to the AD forest. -5. If required, enter a new Active Directory-Based Activation Object name - - **Important**   - If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed. - -6. Click **Install Key**. -7. VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. - -The activated object and the date that is was created appear in the **Active Directory-Based Activation** node in the center pane. - -## Related topics - -- [Scenario 1: Online Activation](scenario-online-activation-vamt.md) -- [Add and Remove Computers](add-remove-computers-vamt.md) +--- +title: Activate an Active Directory Forest Online (Windows 10) +description: Activate an Active Directory Forest Online +ms.assetid: 9b5bc193-799b-4aa5-9d3e-0e495f7195d3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Activate an Active Directory Forest Online + +You can use the Volume Activation Management Tool (VAMT) Active Directory-Based Activation (ADBA) function to activate an Active Directory (AD) forest over the Internet. ADBA enables certain products to inherit activation from the domain. + +**Important**   +ADBA is only applicable to Generic Volume License Keys (GVLKs) and KMS Host keys (CSVLKs). To use ADBA, one or more KMS Host keys (CSVLKs) must be installed on the AD forest, and client keys (GVLKs) must be installed on the client products. + +## Requirements + +Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: +- VAMT is installed on a host computer that has Internet access. +- VAMT has administrative permissions to the Active Directory domain. +- The KMS Host key (CSVLK) you intend to use is added to VAMT in the **Product Keys** node. + +**To perform an online Active Directory forest activation** + +1. Open VAMT. +2. In the left-side pane, click the **Active Directory-Based Activation** node. +3. In the right-side **Actions** pane, click **Online activate forest** to open the **Install Product Key** dialog box. +4. In the **Install Product Key** dialog box, select the KMS Host key (CSVLK) that you want to apply to the AD forest. +5. If required, enter a new Active Directory-Based Activation Object name + + **Important**   + If you want to rename the ADBA object, you must do it now. After you click **Install Key**, the name cannot be changed. + +6. Click **Install Key**. +7. VAMT displays the **Activating Active Directory** dialog box until it completes the requested action. + +The activated object and the date that is was created appear in the **Active Directory-Based Activation** node in the center pane. + +## Related topics + +- [Scenario 1: Online Activation](scenario-online-activation-vamt.md) +- [Add and Remove Computers](add-remove-computers-vamt.md) diff --git a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md index 03e0029f83..893b4f6f7c 100644 --- a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md +++ b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md @@ -1,97 +1,120 @@ ---- -title: Activate using Active Directory-based activation (Windows 10) -description: Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. -ms.assetid: 08cce6b7-7b5b-42cf-b100-66c363a846af -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Activate using Active Directory-based activation -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows Server 2012 R2 -- Windows Server 2012 - -**Looking for retail activation?** -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. Active Directory-based activation requires that the forest schema be updated by adprep.exe on a computer running Windows Server 2012 or Windows Server 2012 R2, but after the schema is updated, older domain controllers can still activate clients. -Any domain-joined computers running Windows 10, Windows 8.1, Windows 8, Windows Server 2012, or Windows Server 2012 R2 with a GVLK will be activated automatically and transparently. They will stay activated as long as they remain members of the domain and maintain periodic contact with a domain controller. Activation takes place after the Licensing service starts. When this service starts, the computer contacts AD DS automatically, receives the activation object, and is activated without user intervention. -To allow computers with GVLKs to activate themselves, use the Volume Activation Tools console in Windows Server 2012 R2 or the VAMT in earlier versions of Windows Server to create an object in the AD DS forest. You create this activation object by submitting a KMS host key to Microsoft, as shown in Figure 10. -The process proceeds as follows: -1. Perform one of the following tasks: - - Install the Volume Activation Services server role on a domain controller running Windows Server 2012 R2, and add a KMS host key by using the Volume Activation Tools Wizard. - - Extend the domain to the Windows Server 2012 R2 schema level, and add a KMS host key by using the VAMT. -2. Microsoft verifies the KMS host key, and an activation object is created. -3. Client computers are activated by receiving the activation object from a domain controller during startup. - - ![Active Directory-based activation flow](../images/volumeactivationforwindows81-10.jpg) - - **Figure 10**. The Active Directory-based activation flow - -For environments in which all computers are running Windows 10, Windows 8.1, Windows 8, Windows Server 2012, or Windows Server 2012 R2, and they are joined to a domain, Active Directory-based activation is the best option for activating all client computers and servers, and you may be able to remove any KMS hosts from your environment. -If an environment will continue to contain earlier volume licensing operating systems and applications or if you have workgroup computers outside the domain, you need to maintain a KMS host to maintain activation status for earlier volume licensing editions of Windows and Office. -Clients that are activated with Active Directory-based activation will maintain their activated state for up to 180 days since the last contact with the domain, but they will periodically attempt to reactivate before then and at the end of the 180day period. By default, this reactivation event occurs every seven days. -When a reactivation event occurs, the client queries AD DS for the activation object. Client computers examine the activation object and compare it to the local edition as defined by the GVLK. If the object and GVLK match, reactivation occurs. If the AD DS object cannot be retrieved, client computers use KMS activation. If the computer is removed from the domain, when the computer or the Software Protection service is restarted, the operating system will change the status from activated to not activated, and the computer will try to activate with KMS. -## Step-by-step configuration: Active Directory-based activation -**Note**   -You must be a member of the local Administrators group on all computers mentioned in these steps. You also need to be a member of the Enterprise Administrators group, because setting up Active Directory-based activation changes forest-wide settings. -**To configure Active Directory-based activation on Windows Server 2012 R2, complete the following steps:** -1. Use an account with Domain Administrator and Enterprise Administrator credentials to sign in to a domain controller. -2. Launch Server Manager. -3. Add the Volume Activation Services role, as shown in Figure 11. - - ![Adding the Volume Activation Services role](../images/volumeactivationforwindows81-11.jpg) - - **Figure 11**. Adding the Volume Activation Services role - -4. Click the link to launch the Volume Activation Tools (Figure 12). - - ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-12.jpg) - - **Figure 12**. Launching the Volume Activation Tools - -5. Select the **Active Directory-Based Activation** option (Figure 13). - - ![Selecting Active Directory-Based Activation](../images/volumeactivationforwindows81-13.jpg) - - **Figure 13**. Selecting Active Directory-Based Activation - -6. Enter your KMS host key and (optionally) a display name (Figure 14). - - ![Choosing how to activate your product](../images/volumeactivationforwindows81-15.jpg) - - **Figure 14**. Entering your KMS host key - -7. Activate your KMS host key by phone or online (Figure 15). - - ![Entering your KMS host key](../images/volumeactivationforwindows81-14.jpg) - - **Figure 15**. Choosing how to activate your product - -8. After activating the key, click **Commit**, and then click **Close**. - -## Verifying the configuration of Active Directory-based activation - -To verify your Active Directory-based activation configuration, complete the following steps: -1. After you configure Active Directory-based activation, start a computer that is running an edition of Windows that is configured by volume licensing. -2. If the computer has been previously configured with a MAK key, replace the MAK key with the GVLK by running the **slmgr.vbs /ipk** command and specifying the GLVK as the new product key. -3. If the computer is not joined to your domain, join it to the domain. -4. Sign in to the computer. -5. Open Windows Explorer, right-click **Computer**, and then click **Properties**. -6. Scroll down to the **Windows activation** section, and verify that this client has been activated. - - **Note**
                                  - If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmgr.vbs /dlv** command also indicates whether KMS has been used. - -## See also -- [Volume Activation for Windows 10](volume-activation-windows-10.md) +--- +title: Activate using Active Directory-based activation (Windows 10) +description: Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. +ms.assetid: 08cce6b7-7b5b-42cf-b100-66c363a846af +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Activate using Active Directory-based activation + +> Applies to +> +>- Windows 10 +>- Windows 8.1 +>- Windows 8 +>- Windows Server 2012 R2 +>- Windows Server 2012 +>- Windows Server 2016 +>- Windows Server 2019 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows 7 or Windows 8.1](https://support.microsoft.com/help/15083/windows-activate-windows-7-or-8-1) +- [Get Help Activating Microsoft Windows 10](https://support.microsoft.com/help/12440/windows-10-activate) + +Active Directory-based activation is implemented as a role service that relies on AD DS to store activation objects. Active Directory-based activation requires that the forest schema be updated using *adprep.exe* on a supported server OS, but after the schema is updated, older domain controllers can still activate clients. + +Any domain-joined computers running a supported operating system with a Generic Volume License Key (GVLK) will be activated automatically and transparently. They will stay activated as long as they remain members of the domain and maintain periodic contact with a domain controller. Activation takes place after the Licensing service starts. When this service starts, the computer contacts AD DS automatically, receives the activation object, and is activated without user intervention. + +To allow computers with GVLKs to activate themselves, use the Volume Activation Tools console or the [Volume Activation Management Tool (VAMT)](volume-activation-management-tool.md) in earlier versions of Windows Server to create an object in the AD DS forest. You create this activation object by submitting a KMS host key to Microsoft, as shown in Figure 10. + +The process proceeds as follows: + +1. Perform one of the following tasks: + - Install the Volume Activation Services server role on a domain controller and add a KMS host key by using the Volume Activation Tools Wizard. + - Extend the domain to the Windows Server 2012 R2 or higher schema level, and add a KMS host key by using the VAMT. +1. Microsoft verifies the KMS host key, and an activation object is created. +1. Client computers are activated by receiving the activation object from a domain controller during startup. + + ![Active Directory-based activation flow](../images/volumeactivationforwindows81-10.jpg) + + **Figure 10**. The Active Directory-based activation flow + +For environments in which all computers are running an operating system listed under *Applies to*, and they are joined to a domain, Active Directory-based activation is the best option for activating all client computers and servers, and you may be able to remove any KMS hosts from your environment. + +If an environment will continue to contain earlier volume licensing operating systems and applications or if you have workgroup computers outside the domain, you need to maintain a KMS host to maintain activation status for earlier volume licensing editions of Windows and Office. + +Clients that are activated with Active Directory-based activation will maintain their activated state for up to 180 days since the last contact with the domain, but they will periodically attempt to reactivate before then and at the end of the 180 day period. By default, this reactivation event occurs every seven days. + +When a reactivation event occurs, the client queries AD DS for the activation object. Client computers examine the activation object and compare it to the local edition as defined by the GVLK. If the object and GVLK match, reactivation occurs. If the AD DS object cannot be retrieved, client computers use KMS activation. If the computer is removed from the domain, and the computer or the Software Protection service is restarted, the operating system will change the status from activated to not activated, and the computer will try to activate with KMS. + +## Step-by-step configuration: Active Directory-based activation + +> [!NOTE] +> You must be a member of the local Administrators group on all computers mentioned in these steps. You also need to be a member of the Enterprise Administrators group, because setting up Active Directory-based activation changes forest-wide settings. + +**To configure Active Directory-based activation on Windows Server 2012 R2 or higher, complete the following steps:** + +1. Use an account with Domain Administrator and Enterprise Administrator credentials to sign in to a domain controller. +1. Launch Server Manager. +1. Add the Volume Activation Services role, as shown in Figure 11. + + ![Adding the Volume Activation Services role](../images/volumeactivationforwindows81-11.jpg) + + **Figure 11**. Adding the Volume Activation Services role + +1. Click the link to launch the Volume Activation Tools (Figure 12). + + ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-12.jpg) + + **Figure 12**. Launching the Volume Activation Tools + +1. Select the **Active Directory-Based Activation** option (Figure 13). + + ![Selecting Active Directory-Based Activation](../images/volumeactivationforwindows81-13.jpg) + + **Figure 13**. Selecting Active Directory-Based Activation + +1. Enter your KMS host key and (optionally) a display name (Figure 14). + + ![Choosing how to activate your product](../images/volumeactivationforwindows81-15.jpg) + + **Figure 14**. Entering your KMS host key + +1. Activate your KMS host key by phone or online (Figure 15). + + ![Entering your KMS host key](../images/volumeactivationforwindows81-14.jpg) + + **Figure 15**. Choosing how to activate your product + +1. After activating the key, click **Commit**, and then click **Close**. + +## Verifying the configuration of Active Directory-based activation + +To verify your Active Directory-based activation configuration, complete the following steps: + +1. After you configure Active Directory-based activation, start a computer that is running an edition of Windows that is configured by volume licensing. +1. If the computer has been previously configured with a MAK key, replace the MAK key with the GVLK by running the **slmgr.vbs /ipk** command and specifying the GLVK as the new product key. +1. If the computer is not joined to your domain, join it to the domain. +1. Sign in to the computer. +1. Open Windows Explorer, right-click **Computer**, and then click **Properties**. +1. Scroll down to the **Windows activation** section, and verify that this client has been activated. + + > [!NOTE] + > If you are using both KMS and Active Directory-based activation, it may be difficult to see whether a client has been activated by KMS or by Active Directory-based activation. Consider disabling KMS during the test, or make sure that you are using a client computer that has not already been activated by KMS. The **slmgr.vbs /dlv** command also indicates whether KMS has been used. + +## See also + +- [Volume Activation for Windows 10](volume-activation-windows-10.md) diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index dd8545387c..01010689aa 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -1,143 +1,144 @@ ---- -title: Activate using Key Management Service (Windows 10) -ms.assetid: f2417bfe-7d25-4e82-bc07-de316caa8dac -description: -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.localizationpriority: medium -ms.date: 10/16/2017 -ms.topic: article ---- - -# Activate using Key Management Service - -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -There are three possible scenarios for volume activation of Windows 10 or Windows Server 2012 R2 by using a Key Management Service (KMS) host: -- Host KMS on a computer running Windows 10 -- Host KMS on a computer running Windows Server 2012 R2 -- Host KMS on a computer running an earlier version of Windows - -Check out [Windows 10 Volume Activation Tips](https://blogs.technet.microsoft.com/askcore/2015/09/15/windows-10-volume-activation-tips/). - -## Key Management Service in Windows 10 - -Installing a KMS host key on a computer running Windows 10 allows you to activate other computers running Windows 10 against this KMS host and earlier versions of the client operating system, such as Windows 8.1 or Windows 7. -Clients locate the KMS server by using resource records in DNS, so some configuration of DNS may be required. This scenario can be beneficial if your organization uses volume activation for clients and MAK-based activation for a smaller number of servers. -To enable KMS functionality, a KMS key is installed on a KMS host; then, the host is activated over the Internet or by phone using Microsoft’s activation services. - -**Configure KMS in Windows 10** - -1. Open an elevated command prompt. -2. Enter one of the following commands. - - To install a KMS key, type **slmgr.vbs /ipk <KmsKey>**. - - To activate online, type **slmgr.vbs /ato**. - - To activate by using the telephone, type **slui.exe 4**. -3. After activating the KMS key, restart the Software Protection Service. - -For more information, see the information for Windows 7 in [Deploy KMS Activation](https://go.microsoft.com/fwlink/p/?LinkId=717032). - -## Key Management Service in Windows Server 2012 R2 -Installing a KMS host key on a computer running Windows Server allows you to activate computers running Windows Server 2012 R2, Windows Server 2008 R2, Windows Server 2008, Windows 10, Windows 8.1, Windows 7, and Windows Vista. - -**Note**   -You cannot install a client KMS key into the KMS in Windows Server. - -This scenario is commonly used in larger organizations that do not find the overhead of using a server a burden. - -**Note**   - -If you receive error 0xC004F015 when trying to activate Windows 10 Enterprise, see [KB 3086418](https://go.microsoft.com/fwlink/p/?LinkId=620687). - -**Configure KMS in Windows Server 2012 R2** - -1. Sign in to a computer running Windows Server 2012 R2 with an account that has local administrative credentials. -2. Launch Server Manager. -3. Add the Volume Activation Services role, as shown in Figure 4. - - ![Adding the Volume Activation Services role in Server Manager](../images/volumeactivationforwindows81-04.jpg) - - **Figure 4**. Adding the Volume Activation Services role in Server Manager\ - -4. When the role installation is complete, click the link to launch the Volume Activation Tools (Figure 5). - - ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-05.jpg) - - **Figure 5**. Launching the Volume Activation Tools - - 5. Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6). - This can be the same computer on which you installed the role or another computer. For example, it can be a client computer running Windows 10. - - ![Configuring the computer as a KMS host](../images/volumeactivationforwindows81-06.jpg) - - **Figure 6**. Configuring the computer as a KMS host - -6. Install your KMS host key by typing it in the text box, and then click **Commit** (Figure 7). - - ![Installing your KMS host key](../images/volumeactivationforwindows81-07.jpg) - - **Figure 7**. Installing your KMS host key - -7. If asked to confirm replacement of an existing key, click **Yes**. -8. After the product key is installed, you must activate it. Click **Next** (Figure 8). - - ![Activating the software](../images/volumeactivationforwindows81-08.jpg) - - **Figure 8**. Activating the software - - The KMS key can be activated online or by phone. See Figure 9. - - ![Choosing to activate online](../images/volumeactivationforwindows81-09.jpg) - - **Figure 9**. Choosing to activate online - -Now that the KMS host is configured, it will begin to listen for activation requests. However, it will not activate clients successfully until the activation threshold is met. - -## Verifying the configuration of Key Management Service - -You can verify KMS volume activation from the KMS host server or from the client computer. KMS volume activation requires a minimum threshold of 25 computers before activation requests will be processed. The verification process described here will increment the activation count each time a client computer contacts the KMS host, but unless the activation threshold is reached, the verification will take the form of an error message rather than a confirmation message. -**Note**   - -If you configured Active Directory-based activation before configuring KMS activation, you must use a client computer that will not first try to activate itself by using Active Directory-based activation. You could use a workgroup computer that is not joined to a domain or a computer running Windows 7 or Windows Server 2008 R2. - -To verify that KMS volume activation works, complete the following steps: - -1. On the KMS host, open the event log and confirm that DNS publishing is successful. -2. On a client computer, open a Command Prompt window, type **Slmgr.vbs /ato**, and then press ENTER.

                                  -The **/ato** command causes the operating system to attempt activation by using whichever key has been installed in the operating system. The response should show the license state and detailed Windows version information. -3. On a client computer or the KMS host, open an elevated Command Prompt window, type **Slmgr /dlv**, and then press ENTER.

                                  - -The **/dlv** command displays the detailed licensing information. The response should return an error that states that the KMS activation count is too low. This confirms that KMS is functioning correctly, even though the client has not been activated. - -For more information about the use and syntax of slmgr.vbs, see [Slmgr.vbs Options](https://go.microsoft.com/fwlink/p/?LinkId=733639). - -## Key Management Service in earlier versions of Windows - -If you have already established a KMS infrastructure in your organization for an earlier version of Windows, you may want to continue using that infrastructure to activate computers running Windows 10 or Windows Server 2012 R2. Your existing KMS host must be running Windows 7 or later. To upgrade your KMS host, complete the following steps: - -1. Download and install the correct update for your current KMS host operating system. Restart the computer as directed. -2. Request a new KMS host key from the Volume Licensing Service Center. -3. Install the new KMS host key on your KMS host. -4. Activate the new KMS host key by running the slmrg.vbs script. - -For detailed instructions, see [Update that enables Windows 8.1 and Windows 8 KMS hosts to activate a later version of Windows](https://go.microsoft.com/fwlink/p/?LinkId=618265) and [Update that enables Windows 7 and Windows Server 2008 R2 KMS hosts to activate Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=626590). - -## See also -- [Volume Activation for Windows 10](volume-activation-windows-10.md) -  - +--- +title: Activate using Key Management Service (Windows 10) +ms.assetid: f2417bfe-7d25-4e82-bc07-de316caa8dac +ms.reviewer: +manager: laurawi +ms.author: greglin +description: +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.localizationpriority: medium +ms.date: 10/16/2017 +ms.topic: article +--- + +# Activate using Key Management Service + +**Applies to** +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +There are three possible scenarios for volume activation of Windows 10 or Windows Server 2012 R2 by using a Key Management Service (KMS) host: +- Host KMS on a computer running Windows 10 +- Host KMS on a computer running Windows Server 2012 R2 +- Host KMS on a computer running an earlier version of Windows + +Check out [Windows 10 Volume Activation Tips](https://blogs.technet.microsoft.com/askcore/2015/09/15/windows-10-volume-activation-tips/). + +## Key Management Service in Windows 10 + +Installing a KMS host key on a computer running Windows 10 allows you to activate other computers running Windows 10 against this KMS host and earlier versions of the client operating system, such as Windows 8.1 or Windows 7. +Clients locate the KMS server by using resource records in DNS, so some configuration of DNS may be required. This scenario can be beneficial if your organization uses volume activation for clients and MAK-based activation for a smaller number of servers. +To enable KMS functionality, a KMS key is installed on a KMS host; then, the host is activated over the Internet or by phone using Microsoft’s activation services. + +**Configure KMS in Windows 10** + +1. Open an elevated command prompt. +2. Enter one of the following commands. + - To install a KMS key, type **slmgr.vbs /ipk <KmsKey>**. + - To activate online, type **slmgr.vbs /ato**. + - To activate by using the telephone, type **slui.exe 4**. +3. After activating the KMS key, restart the Software Protection Service. + +For more information, see the information for Windows 7 in [Deploy KMS Activation](https://go.microsoft.com/fwlink/p/?LinkId=717032). + +## Key Management Service in Windows Server 2012 R2 +Installing a KMS host key on a computer running Windows Server allows you to activate computers running Windows Server 2012 R2, Windows Server 2008 R2, Windows Server 2008, Windows 10, Windows 8.1, Windows 7, and Windows Vista. + +**Note**   +You cannot install a client KMS key into the KMS in Windows Server. + +This scenario is commonly used in larger organizations that do not find the overhead of using a server a burden. + +**Note**   + +If you receive error 0xC004F015 when trying to activate Windows 10 Enterprise, see [KB 3086418](https://go.microsoft.com/fwlink/p/?LinkId=620687). + +**Configure KMS in Windows Server 2012 R2** + +1. Sign in to a computer running Windows Server 2012 R2 with an account that has local administrative credentials. +2. Launch Server Manager. +3. Add the Volume Activation Services role, as shown in Figure 4. + + ![Adding the Volume Activation Services role in Server Manager](../images/volumeactivationforwindows81-04.jpg) + + **Figure 4**. Adding the Volume Activation Services role in Server Manager\ + +4. When the role installation is complete, click the link to launch the Volume Activation Tools (Figure 5). + + ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-05.jpg) + + **Figure 5**. Launching the Volume Activation Tools + + 5. Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6). + This can be the same computer on which you installed the role or another computer. For example, it can be a client computer running Windows 10. + + ![Configuring the computer as a KMS host](../images/volumeactivationforwindows81-06.jpg) + + **Figure 6**. Configuring the computer as a KMS host + +5. Install your KMS host key by typing it in the text box, and then click **Commit** (Figure 7). + + ![Installing your KMS host key](../images/volumeactivationforwindows81-07.jpg) + + **Figure 7**. Installing your KMS host key + +6. If asked to confirm replacement of an existing key, click **Yes**. +7. After the product key is installed, you must activate it. Click **Next** (Figure 8). + + ![Activating the software](../images/volumeactivationforwindows81-08.jpg) + + **Figure 8**. Activating the software + + The KMS key can be activated online or by phone. See Figure 9. + + ![Choosing to activate online](../images/volumeactivationforwindows81-09.jpg) + + **Figure 9**. Choosing to activate online + +Now that the KMS host is configured, it will begin to listen for activation requests. However, it will not activate clients successfully until the activation threshold is met. + +## Verifying the configuration of Key Management Service + +You can verify KMS volume activation from the KMS host server or from the client computer. KMS volume activation requires a minimum threshold of 25 computers before activation requests will be processed. The verification process described here will increment the activation count each time a client computer contacts the KMS host, but unless the activation threshold is reached, the verification will take the form of an error message rather than a confirmation message. +**Note**   + +If you configured Active Directory-based activation before configuring KMS activation, you must use a client computer that will not first try to activate itself by using Active Directory-based activation. You could use a workgroup computer that is not joined to a domain or a computer running Windows 7 or Windows Server 2008 R2. + +To verify that KMS volume activation works, complete the following steps: + +1. On the KMS host, open the event log and confirm that DNS publishing is successful. +2. On a client computer, open a Command Prompt window, type **Slmgr.vbs /ato**, and then press ENTER.

                                  +The **/ato** command causes the operating system to attempt activation by using whichever key has been installed in the operating system. The response should show the license state and detailed Windows version information. +3. On a client computer or the KMS host, open an elevated Command Prompt window, type **Slmgr /dlv**, and then press ENTER.

                                  + +The **/dlv** command displays the detailed licensing information. The response should return an error that states that the KMS activation count is too low. This confirms that KMS is functioning correctly, even though the client has not been activated. + +For more information about the use and syntax of slmgr.vbs, see [Slmgr.vbs Options](https://go.microsoft.com/fwlink/p/?LinkId=733639). + +## Key Management Service in earlier versions of Windows + +If you have already established a KMS infrastructure in your organization for an earlier version of Windows, you may want to continue using that infrastructure to activate computers running Windows 10 or Windows Server 2012 R2. Your existing KMS host must be running Windows 7 or later. To upgrade your KMS host, complete the following steps: + +1. Download and install the correct update for your current KMS host operating system. Restart the computer as directed. +2. Request a new KMS host key from the Volume Licensing Service Center. +3. Install the new KMS host key on your KMS host. +4. Activate the new KMS host key by running the slmgr.vbs script. + +For detailed instructions, see [Update that enables Windows 8.1 and Windows 8 KMS hosts to activate a later version of Windows](https://go.microsoft.com/fwlink/p/?LinkId=618265) and [Update that enables Windows 7 and Windows Server 2008 R2 KMS hosts to activate Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=626590). + +## See also +- [Volume Activation for Windows 10](volume-activation-windows-10.md) diff --git a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md index 2747cb444b..0664a272c5 100644 --- a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md +++ b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md @@ -1,124 +1,127 @@ ---- -title: Activate clients running Windows 10 (Windows 10) -description: After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. -ms.assetid: 39446e49-ad7c-48dc-9f18-f85a11ded643 -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Activate clients running Windows 10 - -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. If the computer has been configured with a Generic Volume License Key (GVLK), neither IT nor the user need take any action. It just works. -Enterprise edition images and installation media should already be configured with the GVLK. When the client computer starts, the Licensing service examines the current licensing condition of the computer. -If activation or reactivation is required, the following sequence occurs: -1. If the computer is a member of a domain, it asks a domain controller for a volume activation object. If Active Directory-based activation is configured, the domain controller returns the object. If the object matches the edition of the software that is installed and the computer has a matching GVLK, the computer is activated (or reactivated), and it will not need to be activated again for 180 days, although the operating system will attempt reactivation at much shorter, regular intervals. -2. If the computer is not a member of a domain or if the volume activation object is not available, the computer will issue a DNS query to attempt to locate a KMS server. If a KMS server can be contacted, activation occurs if the KMS has a key that matches the computer’s GVLK. -3. The computer tries to activate against Microsoft servers if it is configured with a MAK. - -If the client is not able to activate itself successfully, it will periodically try again. The frequency of the retry attempts depends on the current licensing state and whether the client computer has been successfully activated in the past. For example, if the client computer had been previously activated by Active Directory-based activation, it will periodically try to contact the domain controller at each restart. - -## How Key Management Service works - -KMS uses a client–server topology. KMS client computers can locate KMS host computers by using DNS or a static configuration. KMS clients contact the KMS host by using RPCs carried over TCP/IP. - -### Key Management Service activation thresholds - -You can activate physical computers and virtual machines by contacting a KMS host. To qualify for KMS activation, there must be a minimum number of qualifying computers (called the activation threshold). KMS clients will be activated only after this threshold has been met. Each KMS host counts the number of computers that have requested activation until the threshold is met. - -A KMS host responds to each valid activation request from a KMS client with the count of how many computers have already contacted the KMS host for activation. Client computers that receive a count below the activation threshold are not activated. For example, if the first two computers that contact the KMS host are running Windows 10, the first receives an activation count of 1, and the second receives an activation count of 2. If the next computer is a virtual machine on a computer running Windows 10, it receives an activation count of 3, and so on. None of these computers will be activated, because computers running Windows 10, like other client operating system versions, must receive an activation count of 25 or more. -When KMS clients are waiting for the KMS to reach the activation threshold, they will connect to the KMS host every two hours to get the current activation count. They will be activated when the threshold is met. - -In our example, if the next computer that contacts the KMS host is running Windows Server 2012 R2, it receives an activation count of 4, because activation counts are cumulative. If a computer running Windows Server 2012 R2 receives an activation count that is 5 or more, it is activated. If a computer running Windows 10 receives an activation count of 25 or more, it is activated. - -### Activation count cache - -To track the activation threshold, the KMS host keeps a record of the KMS clients that request activation. The KMS host gives each KMS client a client ID designation, and the KMS host saves each client ID in a table. By default, each activation request remains in the table for up to 30 days. When a client renews its activation, the cached client ID is removed from the table, a new record is created, and the 30day period begins again. If a KMS client computer does not renew its activation within 30 days, the KMS host removes the corresponding client ID from the table and reduces the activation count by one. -However, the KMS host only caches twice the number of client IDs that are required to meet the activation threshold. Therefore, only the 50 most recent client IDs are kept in the table, and a client ID could be removed much sooner than 30 days. -The total size of the cache is set by the type of client computer that is attempting to activate. If a KMS host receives activation requests only from servers, the cache will hold only 10 client IDs (twice the required 5). If a client computer running Windows 10 contacts that KMS host, KMS increases the cache size to 50 to accommodate the higher threshold. KMS never reduces the cache size. - -### Key Management Service connectivity - -KMS activation requires TCP/IP connectivity. By default, KMS hosts and clients use DNS to publish and find the KMS. The default settings can be used, which require little or no administrative action, or KMS hosts and client computers can be manually configured based on network configuration and security requirements. - -### Key Management Service activation renewal - -KMS activations are valid for 180 days (the *activation validity interval*). To remain activated, KMS client computers must renew their activation by connecting to the KMS host at least once every 180 days. By default, KMS client computers attempt to renew their activation every 7 days. If KMS activation fails, the client computer retries every two hours. After a client computer’s activation is renewed, the activation validity interval begins again. - -### Publication of the Key Management Service - -The KMS uses service (SRV) resource records in DNS to store and communicate the locations of KMS hosts. KMS hosts use the DNS dynamic update protocol, if available, to publish the KMS service (SRV) resource records. If dynamic update is not available or the KMS host does not have rights to publish the resource records, the DNS records must be published manually, or you must configure client computers to connect to specific KMS hosts. - -### Client discovery of the Key Management Service - -By default, KMS client computers query DNS for KMS information. The first time a KMS client computer queries DNS for KMS information, it randomly chooses a KMS host from the list of service (SRV) resource records that DNS returns. The address of a DNS server that contains the service (SRV) resource records can be listed as a suffixed entry on KMS client computers, which allows one DNS server to advertise the service (SRV) resource records for KMS, and KMS client computers with other primary DNS servers to find it. -Priority and weight parameters can be added to the DnsDomainPublishList registry value for KMS. Establishing KMS host priority groupings and weighting within each group allows you to specify which KMS host the client computers should try first and balances traffic among multiple KMS hosts. Only Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 provide these priority and weight parameters. -If the KMS host that a client computer selects does not respond, the KMS client computer removes that KMS host from its list of service (SRV) resource records and randomly selects another KMS host from the list. When a KMS host responds, the KMS client computer caches the name of the KMS host and uses it for subsequent activation and renewal attempts. If the cached KMS host does not respond on a subsequent renewal, the KMS client computer discovers a new KMS host by querying DNS for KMS service (SRV) resource records. -By default, client computers connect to the KMS host for activation by using anonymous RPCs through TCP port 1688. (You can change the default port.) After establishing a TCP session with the KMS host, the client computer sends a single request packet. The KMS host responds with the activation count. If the count meets or exceeds the activation threshold for that operating system, the client computer is activated and the session is closed. The KMS client computer uses this same process for renewal requests. 250 bytes are used for communication each way. - -### Domain Name System server configuration - -The default KMS automatic publishing feature requires the service (SRV) resource record and support for DNS dynamic update protocol. KMS client computer default behavior and the KMS service (SRV) resource record publishing are supported on a DNS server that is running Microsoft software or any other DNS server that supports service (SRV) resource records (per Internet Engineering Task Force \[IETF\] Request for Comments \[RFC\] 2782) and dynamic updates (per IETF RFC 2136). For example, Berkeley Internet Domain Name versions 8.x and 9.x support service (SRV) resource records and dynamic update. -The KMS host must be configured so that it has the credentials needed to create and update the following resource records on the DNS servers: service (SRV), IPv4 host (A), and IPv6 host (AAAA), or the records need to be created manually. The recommended solution for giving the KMS host the needed credentials is to create a security group in AD DS, then add all KMS hosts to that group. On a DNS server that is running Microsoft software, ensure that this security group is given full control over the \_VLMCS.\_TCP record in each DNS domain that will contain the KMS service (SRV) resource records. - -### Activating the first Key Management Service host - -KMS hosts on the network need to install a KMS key, and then be activated with Microsoft. Installation of a KMS key enables the KMS on the KMS host. After installing the KMS key, complete the activation of the KMS host by telephone or online. Beyond this initial activation, a KMS host does not communicate any information to Microsoft. KMS keys are only installed on KMS hosts, never on individual KMS client computers. - -### Activating subsequent Key Management Service hosts - -Each KMS key can be installed on up to six KMS hosts. These hosts can be physical computers or virtual machines. After activating a KMS host, the same host can be reactivated up to nine times with the same key. If the organization needs more than six KMS hosts, you can request additional activations for your organization’s KMS key by calling a Microsoft Volume [Licensing Activation Center](https://go.microsoft.com/fwlink/p/?LinkID=618264) to request an exception. - -## How Multiple Activation Key works - -A MAK is used for one-time activation with Microsoft’s hosted activation services. Each MAK has a predetermined number of allowed activations. This number is based on volume licensing agreements, and it might not match the organization’s exact license count. Each activation that uses a MAK with the Microsoft hosted activation service counts toward the activation limit. - -You can activate computers by using a MAK in two ways: -- **MAK independent activation**. Each computer independently connects and is activated with Microsoft over the Internet or by telephone. MAK independent activation is best suited to computers within an organization that do not maintain a connection to the corporate network. MAK independent activation is shown in Figure 16. - - ![MAK independent activation](../images/volumeactivationforwindows81-16.jpg) - - **Figure 16**. MAK independent activation -- **MAK proxy activation**. MAK proxy activation enables a centralized activation request on behalf of multiple computers with one connection to Microsoft. You configure MAK proxy activation by using the VAMT. MAK proxy activation is appropriate for environments in which security concerns restrict direct access to the Internet or the corporate network. It is also suited for development and test labs that lack this connectivity. MAK proxy activation with the VAMT is shown in Figure 17. - - ![MAK proxy activation with the VAMT](../images/volumeactivationforwindows81-17.jpg) - - **Figure 17**. MAK proxy activation with the VAMT - -A MAK is recommended for computers that rarely or never connect to the corporate network and for environments in which the number of computers that require activation does not meet the KMS activation threshold. - -You can use a MAK for individual computers or with an image that can be duplicated or installed by using Microsoft deployment solutions. You can also use a MAK on a computer that was originally configured to use KMS activation. This is useful for moving a computer off the core network to a disconnected environment. - -### Multiple Activation Key architecture and activation - -MAK independent activation installs a MAK product key on a client computer. The key instructs that computer to activate itself with Microsoft servers over the Internet. -In MAK proxy activation, the VAMT installs a MAK product key on a client computer, obtains the installation ID from the target computer, sends the installation ID to Microsoft on behalf of the client, and obtains a confirmation ID. The tool then activates the client computer by installing the confirmation ID. - -## Activating as a standard user - -Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 do not require administrator privileges for activation, but this change does not allow standard user accounts to remove computers running Windows 7 or Windows Server 2008 R2 from the activated state. An administrator account is still required for other activation- or license-related tasks, such as “rearm.” - -## See also - -- [Volume Activation for Windows 10](volume-activation-windows-10.md) -  -  +--- +title: Activate clients running Windows 10 (Windows 10) +description: After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. +ms.assetid: 39446e49-ad7c-48dc-9f18-f85a11ded643 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Activate clients running Windows 10 + +**Applies to** +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +After you have configured Key Management Service (KMS) or Active Directory-based activation on your network, activating a client running Windows 10 is easy. If the computer has been configured with a Generic Volume License Key (GVLK), neither IT nor the user need take any action. It just works. +Enterprise edition images and installation media should already be configured with the GVLK. When the client computer starts, the Licensing service examines the current licensing condition of the computer. +If activation or reactivation is required, the following sequence occurs: +1. If the computer is a member of a domain, it asks a domain controller for a volume activation object. If Active Directory-based activation is configured, the domain controller returns the object. If the object matches the edition of the software that is installed and the computer has a matching GVLK, the computer is activated (or reactivated), and it will not need to be activated again for 180 days, although the operating system will attempt reactivation at much shorter, regular intervals. +2. If the computer is not a member of a domain or if the volume activation object is not available, the computer will issue a DNS query to attempt to locate a KMS server. If a KMS server can be contacted, activation occurs if the KMS has a key that matches the computer’s GVLK. +3. The computer tries to activate against Microsoft servers if it is configured with a MAK. + +If the client is not able to activate itself successfully, it will periodically try again. The frequency of the retry attempts depends on the current licensing state and whether the client computer has been successfully activated in the past. For example, if the client computer had been previously activated by Active Directory-based activation, it will periodically try to contact the domain controller at each restart. + +## How Key Management Service works + +KMS uses a client–server topology. KMS client computers can locate KMS host computers by using DNS or a static configuration. KMS clients contact the KMS host by using RPCs carried over TCP/IP. + +### Key Management Service activation thresholds + +You can activate physical computers and virtual machines by contacting a KMS host. To qualify for KMS activation, there must be a minimum number of qualifying computers (called the activation threshold). KMS clients will be activated only after this threshold has been met. Each KMS host counts the number of computers that have requested activation until the threshold is met. + +A KMS host responds to each valid activation request from a KMS client with the count of how many computers have already contacted the KMS host for activation. Client computers that receive a count below the activation threshold are not activated. For example, if the first two computers that contact the KMS host are running Windows 10, the first receives an activation count of 1, and the second receives an activation count of 2. If the next computer is a virtual machine on a computer running Windows 10, it receives an activation count of 3, and so on. None of these computers will be activated, because computers running Windows 10, like other client operating system versions, must receive an activation count of 25 or more. +When KMS clients are waiting for the KMS to reach the activation threshold, they will connect to the KMS host every two hours to get the current activation count. They will be activated when the threshold is met. + +In our example, if the next computer that contacts the KMS host is running Windows Server 2012 R2, it receives an activation count of 4, because activation counts are cumulative. If a computer running Windows Server 2012 R2 receives an activation count that is 5 or more, it is activated. If a computer running Windows 10 receives an activation count of 25 or more, it is activated. + +### Activation count cache + +To track the activation threshold, the KMS host keeps a record of the KMS clients that request activation. The KMS host gives each KMS client a client ID designation, and the KMS host saves each client ID in a table. By default, each activation request remains in the table for up to 30 days. When a client renews its activation, the cached client ID is removed from the table, a new record is created, and the 30day period begins again. If a KMS client computer does not renew its activation within 30 days, the KMS host removes the corresponding client ID from the table and reduces the activation count by one. +However, the KMS host only caches twice the number of client IDs that are required to meet the activation threshold. Therefore, only the 50 most recent client IDs are kept in the table, and a client ID could be removed much sooner than 30 days. +The total size of the cache is set by the type of client computer that is attempting to activate. If a KMS host receives activation requests only from servers, the cache will hold only 10 client IDs (twice the required 5). If a client computer running Windows 10 contacts that KMS host, KMS increases the cache size to 50 to accommodate the higher threshold. KMS never reduces the cache size. + +### Key Management Service connectivity + +KMS activation requires TCP/IP connectivity. By default, KMS hosts and clients use DNS to publish and find the KMS. The default settings can be used, which require little or no administrative action, or KMS hosts and client computers can be manually configured based on network configuration and security requirements. + +### Key Management Service activation renewal + +KMS activations are valid for 180 days (the *activation validity interval*). To remain activated, KMS client computers must renew their activation by connecting to the KMS host at least once every 180 days. By default, KMS client computers attempt to renew their activation every 7 days. If KMS activation fails, the client computer retries every two hours. After a client computer’s activation is renewed, the activation validity interval begins again. + +### Publication of the Key Management Service + +The KMS uses service (SRV) resource records in DNS to store and communicate the locations of KMS hosts. KMS hosts use the DNS dynamic update protocol, if available, to publish the KMS service (SRV) resource records. If dynamic update is not available or the KMS host does not have rights to publish the resource records, the DNS records must be published manually, or you must configure client computers to connect to specific KMS hosts. + +### Client discovery of the Key Management Service + +By default, KMS client computers query DNS for KMS information. The first time a KMS client computer queries DNS for KMS information, it randomly chooses a KMS host from the list of service (SRV) resource records that DNS returns. The address of a DNS server that contains the service (SRV) resource records can be listed as a suffixed entry on KMS client computers, which allows one DNS server to advertise the service (SRV) resource records for KMS, and KMS client computers with other primary DNS servers to find it. +Priority and weight parameters can be added to the DnsDomainPublishList registry value for KMS. Establishing KMS host priority groupings and weighting within each group allows you to specify which KMS host the client computers should try first and balances traffic among multiple KMS hosts. Only Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 provide these priority and weight parameters. +If the KMS host that a client computer selects does not respond, the KMS client computer removes that KMS host from its list of service (SRV) resource records and randomly selects another KMS host from the list. When a KMS host responds, the KMS client computer caches the name of the KMS host and uses it for subsequent activation and renewal attempts. If the cached KMS host does not respond on a subsequent renewal, the KMS client computer discovers a new KMS host by querying DNS for KMS service (SRV) resource records. +By default, client computers connect to the KMS host for activation by using anonymous RPCs through TCP port 1688. (You can change the default port.) After establishing a TCP session with the KMS host, the client computer sends a single request packet. The KMS host responds with the activation count. If the count meets or exceeds the activation threshold for that operating system, the client computer is activated and the session is closed. The KMS client computer uses this same process for renewal requests. 250 bytes are used for communication each way. + +### Domain Name System server configuration + +The default KMS automatic publishing feature requires the service (SRV) resource record and support for DNS dynamic update protocol. KMS client computer default behavior and the KMS service (SRV) resource record publishing are supported on a DNS server that is running Microsoft software or any other DNS server that supports service (SRV) resource records (per Internet Engineering Task Force \[IETF\] Request for Comments \[RFC\] 2782) and dynamic updates (per IETF RFC 2136). For example, Berkeley Internet Domain Name versions 8.x and 9.x support service (SRV) resource records and dynamic update. +The KMS host must be configured so that it has the credentials needed to create and update the following resource records on the DNS servers: service (SRV), IPv4 host (A), and IPv6 host (AAAA), or the records need to be created manually. The recommended solution for giving the KMS host the needed credentials is to create a security group in AD DS, then add all KMS hosts to that group. On a DNS server that is running Microsoft software, ensure that this security group is given full control over the \_VLMCS.\_TCP record in each DNS domain that will contain the KMS service (SRV) resource records. + +### Activating the first Key Management Service host + +KMS hosts on the network need to install a KMS key, and then be activated with Microsoft. Installation of a KMS key enables the KMS on the KMS host. After installing the KMS key, complete the activation of the KMS host by telephone or online. Beyond this initial activation, a KMS host does not communicate any information to Microsoft. KMS keys are only installed on KMS hosts, never on individual KMS client computers. + +### Activating subsequent Key Management Service hosts + +Each KMS key can be installed on up to six KMS hosts. These hosts can be physical computers or virtual machines. After activating a KMS host, the same host can be reactivated up to nine times with the same key. If the organization needs more than six KMS hosts, you can request additional activations for your organization’s KMS key by calling a Microsoft Volume [Licensing Activation Center](https://go.microsoft.com/fwlink/p/?LinkID=618264) to request an exception. + +## How Multiple Activation Key works + +A MAK is used for one-time activation with Microsoft’s hosted activation services. Each MAK has a predetermined number of allowed activations. This number is based on volume licensing agreements, and it might not match the organization’s exact license count. Each activation that uses a MAK with the Microsoft hosted activation service counts toward the activation limit. + +You can activate computers by using a MAK in two ways: +- **MAK independent activation**. Each computer independently connects and is activated with Microsoft over the Internet or by telephone. MAK independent activation is best suited to computers within an organization that do not maintain a connection to the corporate network. MAK independent activation is shown in Figure 16. + + ![MAK independent activation](../images/volumeactivationforwindows81-16.jpg) + + **Figure 16**. MAK independent activation +- **MAK proxy activation**. MAK proxy activation enables a centralized activation request on behalf of multiple computers with one connection to Microsoft. You configure MAK proxy activation by using the VAMT. MAK proxy activation is appropriate for environments in which security concerns restrict direct access to the Internet or the corporate network. It is also suited for development and test labs that lack this connectivity. MAK proxy activation with the VAMT is shown in Figure 17. + + ![MAK proxy activation with the VAMT](../images/volumeactivationforwindows81-17.jpg) + + **Figure 17**. MAK proxy activation with the VAMT + +A MAK is recommended for computers that rarely or never connect to the corporate network and for environments in which the number of computers that require activation does not meet the KMS activation threshold. + +You can use a MAK for individual computers or with an image that can be duplicated or installed by using Microsoft deployment solutions. You can also use a MAK on a computer that was originally configured to use KMS activation. This is useful for moving a computer off the core network to a disconnected environment. + +### Multiple Activation Key architecture and activation + +MAK independent activation installs a MAK product key on a client computer. The key instructs that computer to activate itself with Microsoft servers over the Internet. +In MAK proxy activation, the VAMT installs a MAK product key on a client computer, obtains the installation ID from the target computer, sends the installation ID to Microsoft on behalf of the client, and obtains a confirmation ID. The tool then activates the client computer by installing the confirmation ID. + +## Activating as a standard user + +Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2 do not require administrator privileges for activation, but this change does not allow standard user accounts to remove computers running Windows 7 or Windows Server 2008 R2 from the activated state. An administrator account is still required for other activation- or license-related tasks, such as “rearm.” + +## See also + +- [Volume Activation for Windows 10](volume-activation-windows-10.md) +  +  diff --git a/windows/deployment/volume-activation/active-directory-based-activation-overview.md b/windows/deployment/volume-activation/active-directory-based-activation-overview.md index f217d8827c..581a2a317e 100644 --- a/windows/deployment/volume-activation/active-directory-based-activation-overview.md +++ b/windows/deployment/volume-activation/active-directory-based-activation-overview.md @@ -1,40 +1,44 @@ ---- -title: Active Directory-Based Activation Overview (Windows 10) -description: Active Directory-Based Activation Overview -ms.assetid: c1dac3bd-6a86-4c45-83dd-421e63a398c0 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: greg-lindsay -ms.date: 12/07/2018 -ms.topic: article ---- - -# Active Directory-Based Activation overview - -Active Directory-Based Activation (ADBA) enables enterprises to activate computers through a connection to their domain. Many companies have computers at offsite locations that use products that are registered to the company. Previously these computers needed to either use a retail key or a Multiple Activation Key (MAK), or physically connect to the network in order to activate their products by using Key Management Services (KMS). ADBA provides a way to activate these products if the computers can join the company’s domain. When the user joins their computer to the domain, the ADBA object automatically activates Windows installed on their computer, as long as the computer has a Generic Volume License Key (GVLK) installed. No single physical computer is required to act as the activation object, because it is distributed throughout the domain. - -## ADBA scenarios - -You might use ADBA if you only want to activate domain joined devices. - -If you have a server hosting the KMS service, it can be necessary to reactivate licenses if the server is replaced with a new host. This is not necessary When ADBA is used. - -ADBA can also make load balancing easier when multiple KMS servers are present since the client can connect to any domain controller. This is simpler than using the DNS service to load balance by configuring priority and weight values. - -Some VDI solutions also require that new clients activate during creation before they are added to the pool. In this scenario, ADBA can eliminate potential VDI issues that might arise due to a KMS outage. - - -## ADBA methods - -VAMT enables IT Professionals to manage and activate the ADBA object. Activation can be performed using the following methods: -- Online activation: To activate an ADBA forest online, the user selects the **Online activate forest** function, selects a KMS Host key (CSVLK) to use, and gives the ADBA Object a name. -- Proxy activation: For a proxy activation, the user first selects the **Proxy activate forest** function, selects a KMS Host key (CSVLK) to use, gives the ADBA Object a name, and provides a file name to save the CILx file that contains the Installation ID. Next, the user takes that file to a computer that is running VAMT with an Internet connection and then selects the **Acquire confirmation IDs for CILX** function on the VAMT landing page, and provides the original CILx file. When VAMT has loaded the Confirmation IDs into the original CILx file, the user takes this file back to the original VAMT instance, where the user completes the proxy activation process by selecting the **Apply confirmation ID to Active Directory domain** function. - -## Related topics - -- [How to Activate an Active Directory Forest Online](https://go.microsoft.com/fwlink/p/?LinkId=246565) -- [How to Proxy Activate an Active Directory Forest](https://go.microsoft.com/fwlink/p/?LinkId=246566) -  -  +--- +title: Active Directory-Based Activation Overview (Windows 10) +description: Active Directory-Based Activation Overview +ms.assetid: c1dac3bd-6a86-4c45-83dd-421e63a398c0 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.date: 12/07/2018 +ms.topic: article +--- + +# Active Directory-Based Activation overview + +Active Directory-Based Activation (ADBA) enables enterprises to activate computers through a connection to their domain. Many companies have computers at offsite locations that use products that are registered to the company. Previously these computers needed to either use a retail key or a Multiple Activation Key (MAK), or physically connect to the network in order to activate their products by using Key Management Services (KMS). ADBA provides a way to activate these products if the computers can join the company’s domain. When the user joins their computer to the domain, the ADBA object automatically activates Windows installed on their computer, as long as the computer has a Generic Volume License Key (GVLK) installed. No single physical computer is required to act as the activation object, because it is distributed throughout the domain. + +## ADBA scenarios + +You might use ADBA if you only want to activate domain joined devices. + +If you have a server hosting the KMS service, it can be necessary to reactivate licenses if the server is replaced with a new host. This is not necessary When ADBA is used. + +ADBA can also make load balancing easier when multiple KMS servers are present since the client can connect to any domain controller. This is simpler than using the DNS service to load balance by configuring priority and weight values. + +Some VDI solutions also require that new clients activate during creation before they are added to the pool. In this scenario, ADBA can eliminate potential VDI issues that might arise due to a KMS outage. + + +## ADBA methods + +VAMT enables IT Professionals to manage and activate the ADBA object. Activation can be performed using the following methods: +- Online activation: To activate an ADBA forest online, the user selects the **Online activate forest** function, selects a KMS Host key (CSVLK) to use, and gives the ADBA Object a name. +- Proxy activation: For a proxy activation, the user first selects the **Proxy activate forest** function, selects a KMS Host key (CSVLK) to use, gives the ADBA Object a name, and provides a file name to save the CILx file that contains the Installation ID. Next, the user takes that file to a computer that is running VAMT with an Internet connection and then selects the **Acquire confirmation IDs for CILX** function on the VAMT landing page, and provides the original CILx file. When VAMT has loaded the Confirmation IDs into the original CILx file, the user takes this file back to the original VAMT instance, where the user completes the proxy activation process by selecting the **Apply confirmation ID to Active Directory domain** function. + +## Related topics + +- [How to Activate an Active Directory Forest Online](https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-vamt) +- [How to Proxy Activate an Active Directory Forest](https://docs.microsoft.com/windows/deployment/volume-activation/activate-forest-by-proxy-vamt) +  +  diff --git a/windows/deployment/volume-activation/add-manage-products-vamt.md b/windows/deployment/volume-activation/add-manage-products-vamt.md index 3f226d854d..255bda4716 100644 --- a/windows/deployment/volume-activation/add-manage-products-vamt.md +++ b/windows/deployment/volume-activation/add-manage-products-vamt.md @@ -1,27 +1,30 @@ ---- -title: Add and Manage Products (Windows 10) -description: Add and Manage Products -ms.assetid: a48fbc23-917d-40f7-985c-e49702c05e51 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Add and Manage Products - -This section describes how to add client computers into the Volume Activation Management Tool (VAMT). After the computers are added, you can manage the products that are installed on your network. - -## In this Section - -|Topic |Description | -|------|------------| -|[Add and Remove Computers](add-remove-computers-vamt.md) |Describes how to add client computers to VAMT. | -|[Update Product Status](update-product-status-vamt.md) |Describes how to update the status of product license. | -|[Remove Products](remove-products-vamt.md) |Describes how to remove a product from the product list. | -  -  -  +--- +title: Add and Manage Products (Windows 10) +description: Add and Manage Products +ms.assetid: a48fbc23-917d-40f7-985c-e49702c05e51 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Add and Manage Products + +This section describes how to add client computers into the Volume Activation Management Tool (VAMT). After the computers are added, you can manage the products that are installed on your network. + +## In this Section + +|Topic |Description | +|------|------------| +|[Add and Remove Computers](add-remove-computers-vamt.md) |Describes how to add client computers to VAMT. | +|[Update Product Status](update-product-status-vamt.md) |Describes how to update the status of product license. | +|[Remove Products](remove-products-vamt.md) |Describes how to remove a product from the product list. | + + + diff --git a/windows/deployment/volume-activation/add-remove-computers-vamt.md b/windows/deployment/volume-activation/add-remove-computers-vamt.md index 612916effe..0784cbb98a 100644 --- a/windows/deployment/volume-activation/add-remove-computers-vamt.md +++ b/windows/deployment/volume-activation/add-remove-computers-vamt.md @@ -1,60 +1,63 @@ ---- -title: Add and Remove Computers (Windows 10) -description: Add and Remove Computers -ms.assetid: cb6f3a78-ece0-4dc7-b086-cb003d82cd52 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: jdeckerms -ms.pagetype: activation -ms.date: 04/25/2017 -ms.topic: article ---- - -# Add and Remove Computers - -You can add computers that have any of the supported Windows or Office products installed to a Volume Activation Management Tool (VAMT) database by using the **Discover products** function. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. You can remove computers from a VAMT database by using the **Delete** function. After you add the computers, you can add the products that are installed on the computers by running the **Update license status** function. - -Before adding computers, ensure that the Windows Management Instrumentation (WMI) firewall exception required by VAMT has been enabled on all target computers. For more information see [Configure Client Computers](configure-client-computers-vamt.md). - -## To add computers to a VAMT database - -1. Open VAMT. -2. Click **Discover products** in the **Actions** menu in the right-side pane to open the **Discover Products** dialog box. -3. In the **Discover products** dialog box, click **Search for computers in the Active Directory** to display the search options, then click the search option you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. - - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**, then under **Domain Filter Criteria**, in the list of domain names click the name of the domain you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". - - To search by individual computer name or IP address, click **Manually enter name or IP address**, then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing. - - To search for computers in a workgroup, click **Search for computers in the workgroup**, then under **Workgroup Filter Criteria**, in the list of workgroup names click the name of the workgroup you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". - - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box provided. VAMT will validate only the LDAP query syntax, but will otherwise run the query without further checks. -4. Click **Search**. -5. VAMT searches for the specified computers and adds them to the VAMT database. During the search, VAMT displays the **Finding computers** message shown below. - To cancel the search, click **Cancel**. When the search is complete the names of the newly-discovered computers appear in the product list view in the center pane. - - ![VAMT, Finding computers dialog box](images/dep-win8-l-vamt-findingcomputerdialog.gif) - - **Important**   - This step adds only the computers to the VAMT database, and not the products that are installed on the computers. To add the products, you need to run the **Update license status** function. - -## To add products to VAMT - -1. In the **Products** list, select the computers that need to have their product information added to the VAMT database. -2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -4. Click **Filter**. VAMT displays the filtered list in the center pane. -5. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. -6. VAMT displays the **Collecting product information** dialog box while it collects the licensing status of all supported products on the selected computers. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. - - **Note**   - If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. - -## To remove computers from a VAMT database - -You can delete a computer by clicking on it in the product list view, and then clicking **Delete** in the **Selected Item** menu in the right-hand pane. In the **Confirm Delete Selected Products** dialog box that appears, click **Yes** to delete the computer. If a computer has multiple products listed, you must delete each product to completely remove the computer from the VAMT database. - -## Related topics - -- [Add and Manage Products](add-manage-products-vamt.md) -  -  +--- +title: Add and Remove Computers (Windows 10) +description: Add and Remove Computers +ms.assetid: cb6f3a78-ece0-4dc7-b086-cb003d82cd52 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.pagetype: activation +ms.date: 04/25/2017 +ms.topic: article +--- + +# Add and Remove Computers + +You can add computers that have any of the supported Windows or Office products installed to a Volume Activation Management Tool (VAMT) database by using the **Discover products** function. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. You can remove computers from a VAMT database by using the **Delete** function. After you add the computers, you can add the products that are installed on the computers by running the **Update license status** function. + +Before adding computers, ensure that the Windows Management Instrumentation (WMI) firewall exception required by VAMT has been enabled on all target computers. For more information see [Configure Client Computers](configure-client-computers-vamt.md). + +## To add computers to a VAMT database + +1. Open VAMT. +2. Click **Discover products** in the **Actions** menu in the right-side pane to open the **Discover Products** dialog box. +3. In the **Discover products** dialog box, click **Search for computers in the Active Directory** to display the search options, then click the search option you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general LDAP query. + - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**, then under **Domain Filter Criteria**, in the list of domain names click the name of the domain you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". + - To search by individual computer name or IP address, click **Manually enter name or IP address**, then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing. + - To search for computers in a workgroup, click **Search for computers in the workgroup**, then under **Workgroup Filter Criteria**, in the list of workgroup names click the name of the workgroup you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer within the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". + - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box provided. VAMT will validate only the LDAP query syntax, but will otherwise run the query without further checks. +4. Click **Search**. +5. VAMT searches for the specified computers and adds them to the VAMT database. During the search, VAMT displays the **Finding computers** message shown below. + To cancel the search, click **Cancel**. When the search is complete the names of the newly-discovered computers appear in the product list view in the center pane. + + ![VAMT, Finding computers dialog box](images/dep-win8-l-vamt-findingcomputerdialog.gif) + + **Important**   + This step adds only the computers to the VAMT database, and not the products that are installed on the computers. To add the products, you need to run the **Update license status** function. + +## To add products to VAMT + +1. In the **Products** list, select the computers that need to have their product information added to the VAMT database. +2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +4. Click **Filter**. VAMT displays the filtered list in the center pane. +5. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. +6. VAMT displays the **Collecting product information** dialog box while it collects the licensing status of all supported products on the selected computers. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. + + **Note**   + If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. + +## To remove computers from a VAMT database + +You can delete a computer by clicking on it in the product list view, and then clicking **Delete** in the **Selected Item** menu in the right-hand pane. In the **Confirm Delete Selected Products** dialog box that appears, click **Yes** to delete the computer. If a computer has multiple products listed, you must delete each product to completely remove the computer from the VAMT database. + +## Related topics + +- [Add and Manage Products](add-manage-products-vamt.md) + + diff --git a/windows/deployment/volume-activation/add-remove-product-key-vamt.md b/windows/deployment/volume-activation/add-remove-product-key-vamt.md index 0168f3de62..fc7b9b051d 100644 --- a/windows/deployment/volume-activation/add-remove-product-key-vamt.md +++ b/windows/deployment/volume-activation/add-remove-product-key-vamt.md @@ -1,36 +1,39 @@ ---- -title: Add and Remove a Product Key (Windows 10) -description: Add and Remove a Product Key -ms.assetid: feac32bb-fb96-4802-81b8-c69220dcfcce -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Add and Remove a Product Key - -Before you can use a Multiple Activation Key (MAK), retail, or KMS Host key (CSVLK) product key, you must first add it to the Volume Activation Management Tool (VAMT) database. - -## To Add a Product Key - -1. Open VAMT. -2. In the left-side pane, right-click the **Product Keys** node to open the **Actions** menu. -3. Click **Add product keys** to open the **Add Product Keys** dialog box. -4. In the **Add Product Keys** dialog box, select from one of the following methods to add product keys: - - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys separated by line breaks, and click **Add Key(s)**. - - To import a Comma Separated Values (CSV) file containing a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. - - **Note**   - If you are activating a large number of products with a MAK, you should refresh the activation count of the MAK, to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. - -## Remove a Product Key - -- To remove a product key from the list, simply select the key in the list and click **Delete** on the **Selected Items** menu in the right-side pane. Click **Yes** to confirm deletion of the product key. Removing a product key from the VAMT database will not affect the activation state of any products or computers on the network. - -## Related topics - -- [Manage Product Keys](manage-product-keys-vamt.md) +--- +title: Add and Remove a Product Key (Windows 10) +description: Add and Remove a Product Key +ms.assetid: feac32bb-fb96-4802-81b8-c69220dcfcce +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Add and Remove a Product Key + +Before you can use a Multiple Activation Key (MAK), retail, or KMS Host key (CSVLK) product key, you must first add it to the Volume Activation Management Tool (VAMT) database. + +## To Add a Product Key + +1. Open VAMT. +2. In the left-side pane, right-click the **Product Keys** node to open the **Actions** menu. +3. Click **Add product keys** to open the **Add Product Keys** dialog box. +4. In the **Add Product Keys** dialog box, select from one of the following methods to add product keys: + - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys separated by line breaks, and click **Add Key(s)**. + - To import a Comma Separated Values (CSV) file containing a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. + + **Note**   + If you are activating a large number of products with a MAK, you should refresh the activation count of the MAK, to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. + +## Remove a Product Key + +- To remove a product key from the list, simply select the key in the list and click **Delete** on the **Selected Items** menu in the right-side pane. Click **Yes** to confirm deletion of the product key. Removing a product key from the VAMT database will not affect the activation state of any products or computers on the network. + +## Related topics + +- [Manage Product Keys](manage-product-keys-vamt.md) diff --git a/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md b/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md index 09daa5dffb..d56ff58a30 100644 --- a/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md +++ b/windows/deployment/volume-activation/appendix-information-sent-to-microsoft-during-activation-client.md @@ -1,68 +1,71 @@ ---- -title: Appendix Information sent to Microsoft during activation (Windows 10) -ms.assetid: 4bfff495-07d0-4385-86e3-7a077cbd64b8 -description: -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Appendix: Information sent to Microsoft during activation -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -When you activate a computer running Windows 10, the following information is sent to Microsoft: - -- The Microsoft product code (a five-digit code that identifies the Windows product you are activating) -- A channel ID or site code that identifies how the Windows product was originally obtained - - For example, a channel ID or site code identifies whether the product was originally purchased from a retail store, obtained as an evaluation copy, obtained through a volume licensing program, or preinstalled by a computer manufacturer. - -- The date of installation and whether the installation was successful -- Information that helps confirm that your Windows product key has not been altered -- Computer make and model -- Version information for the operating system and software -- Region and language settings -- A unique number called a *globally unique identifier*, which is assigned to your computer -- Product key (hashed) and product ID -- BIOS name, revision number, and revision date -- Volume serial number (hashed) of the hard disk drive -- The result of the activation check - - This includes error codes and the following information about any activation exploits and related malicious or unauthorized software that was found or disabled: - - - The activation exploit’s identifier - - The activation exploit’s current state, such as cleaned or quarantined - - Computer manufacturer’s identification - - The activation exploit’s file name and hash in addition to a hash of related software components that may indicate the presence of an activation exploit -- The name and a hash of the contents of your computer’s startup instructions file -- If your Windows license is on a subscription basis, information about how your subscription works - -Standard computer information is also sent, but your computer’s IP address is only retained temporarily. - -## Use of information - -Microsoft uses the information to confirm that you have a licensed copy of the software. Microsoft does not use the information to contact individual consumers. -For additional details, see [Windows 10 Privacy Statement](https://go.microsoft.com/fwlink/p/?LinkId=619879). - -## See also - -- [Volume Activation for Windows 10](volume-activation-windows-10.md) -  -  +--- +title: Appendix Information sent to Microsoft during activation (Windows 10) +ms.assetid: 4bfff495-07d0-4385-86e3-7a077cbd64b8 +ms.reviewer: +manager: laurawi +ms.author: greglin +description: +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Appendix: Information sent to Microsoft during activation +**Applies to** +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +When you activate a computer running Windows 10, the following information is sent to Microsoft: + +- The Microsoft product code (a five-digit code that identifies the Windows product you are activating) +- A channel ID or site code that identifies how the Windows product was originally obtained + + For example, a channel ID or site code identifies whether the product was originally purchased from a retail store, obtained as an evaluation copy, obtained through a volume licensing program, or preinstalled by a computer manufacturer. + +- The date of installation and whether the installation was successful +- Information that helps confirm that your Windows product key has not been altered +- Computer make and model +- Version information for the operating system and software +- Region and language settings +- A unique number called a *globally unique identifier*, which is assigned to your computer +- Product key (hashed) and product ID +- BIOS name, revision number, and revision date +- Volume serial number (hashed) of the hard disk drive +- The result of the activation check + + This includes error codes and the following information about any activation exploits and related malicious or unauthorized software that was found or disabled: + + - The activation exploit’s identifier + - The activation exploit’s current state, such as cleaned or quarantined + - Computer manufacturer’s identification + - The activation exploit’s file name and hash in addition to a hash of related software components that may indicate the presence of an activation exploit +- The name and a hash of the contents of your computer’s startup instructions file +- If your Windows license is on a subscription basis, information about how your subscription works + +Standard computer information is also sent, but your computer’s IP address is only retained temporarily. + +## Use of information + +Microsoft uses the information to confirm that you have a licensed copy of the software. Microsoft does not use the information to contact individual consumers. +For additional details, see [Windows 10 Privacy Statement](https://go.microsoft.com/fwlink/p/?LinkId=619879). + +## See also + +- [Volume Activation for Windows 10](volume-activation-windows-10.md) +  +  diff --git a/windows/deployment/volume-activation/configure-client-computers-vamt.md b/windows/deployment/volume-activation/configure-client-computers-vamt.md index ce4dae56e7..6b80a72d89 100644 --- a/windows/deployment/volume-activation/configure-client-computers-vamt.md +++ b/windows/deployment/volume-activation/configure-client-computers-vamt.md @@ -2,11 +2,15 @@ title: Configure Client Computers (Windows 10) description: Configure Client Computers ms.assetid: a48176c9-b05c-4dd5-a9ef-83073e2370fc +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: jdeckerms +audience: itpro +author: greg-lindsay ms.date: 04/25/2017 ms.topic: article --- @@ -80,12 +84,12 @@ On the client computer, create the following registry key using regedit.exe. There are several options for organizations to configure the WMI firewall exception for computers: - **Image.** Add the configurations to the master Windows image deployed to all clients. - **Group Policy.** If the clients are part of a domain, then all clients can be configured using Group Policy. The Group Policy setting for the WMI firewall exception is found in GPMC.MSC at: **Computer Configuration\\Windows Settings\\Security Settings\\Windows Firewall with Advanced Security\\Windows Firewall with Advanced Security\\Inbound Rules**. -- **Script.** Execute a script using Microsoft System Center Configuration Manager or a third-party remote script execution facility. +- **Script.** Execute a script using Microsoft Endpoint Configuration Manager or a third-party remote script execution facility. - **Manual.** Configure the WMI firewall exception individually on each client. The above configurations will open an additional port through the Windows Firewall on target computers and should be performed on computers that are protected by a network firewall. In order to allow VAMT to query the up-to-date licensing status, the WMI exception must be maintained. We recommend administrators consult their network security policies and make clear decisions when creating the WMI exception. ## Related topics - [Install and Configure VAMT](install-configure-vamt.md) -  -  + + diff --git a/windows/deployment/volume-activation/images/vamt-known-issue-message.png b/windows/deployment/volume-activation/images/vamt-known-issue-message.png new file mode 100644 index 0000000000..5ce1a31e1f Binary files /dev/null and b/windows/deployment/volume-activation/images/vamt-known-issue-message.png differ diff --git a/windows/deployment/volume-activation/import-export-vamt-data.md b/windows/deployment/volume-activation/import-export-vamt-data.md index 6c5122845f..5b77d96564 100644 --- a/windows/deployment/volume-activation/import-export-vamt-data.md +++ b/windows/deployment/volume-activation/import-export-vamt-data.md @@ -1,48 +1,51 @@ ---- -title: Import and Export VAMT Data (Windows 10) -description: Import and Export VAMT Data -ms.assetid: 09a2c595-1a61-4da6-bd46-4ba8763cfd4f -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Import and Export VAMT Data - -You can use the Volume Activation Management Tool (VAMT) to import product-activation data from a Computer Information List (.cilx or .cil) file into SQL Server, and to export product-activation data into a .cilx file. A .cilx file is an XML file that stores computer and product-activation data. -You can import data or export data during the following scenarios: -- Import and merge data from previous versions of VAMT. -- Export data to use to perform proxy activations. - -**Warning**   -Editing a .cilx file using an application other than VAMT can corrupt the .cilx file and is not supported. - -## Import VAMT Data - -**To import data into VAMT** -1. Open VAMT. -2. In the right-side **Actions** pane, click **Import list** to open the **Import List** dialog box. -3. In the **Import List** dialog box, navigate to the .cilx file location, select the file, and click **Open**. -4. In the **Volume Activation Management Tool** dialog box, click **OK** to begin the import. VAMT displays a progress message while the file is being imported. Click **OK** when a message appears and confirms that the import has completed successfully. - -## Export VAMT Data - -Exporting VAMT data from a non-Internet-connected VAMT host computer is the first step of proxy activation using multiple VAMT hosts. To export product-activation data to a .cilx file: -1. In the left-side pane, you can click a product you want to export data for, or click **Products** if the list contains data for all products. -2. If you want to export only part of the data in a product list, in the product list view in the center pane select the products you want to export. -3. In the right-side **Actions** pane on, click **Export list** to open the **Export List** dialog box. -4. In the **Export List** dialog box, click **Browse** to navigate to the .cilx file. -5. Under **Export options**, select one of the following data-type options: - - Export products and product keys - - Export products only - - Export proxy activation data only. Selecting this option ensures that the export contains only the licensing information required for the proxy web service to obtain CIDs from Microsoft. No Personally Identifiable Information (PII) is contained in the exported .cilx file when this selection is checked. -6. If you have selected products to export, select the **Export selected product rows only** check box. -7. Click **Save**. VAMT displays a progress message while the data is being exported. Click **OK** when a message appears and confirms that the export has completed successfully. - -## Related topics - -- [Perform Proxy Activation](proxy-activation-vamt.md) +--- +title: Import and Export VAMT Data (Windows 10) +description: Import and Export VAMT Data +ms.assetid: 09a2c595-1a61-4da6-bd46-4ba8763cfd4f +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Import and Export VAMT Data + +You can use the Volume Activation Management Tool (VAMT) to import product-activation data from a Computer Information List (.cilx or .cil) file into SQL Server, and to export product-activation data into a .cilx file. A .cilx file is an XML file that stores computer and product-activation data. +You can import data or export data during the following scenarios: +- Import and merge data from previous versions of VAMT. +- Export data to use to perform proxy activations. + +**Warning**   +Editing a .cilx file using an application other than VAMT can corrupt the .cilx file and is not supported. + +## Import VAMT Data + +**To import data into VAMT** +1. Open VAMT. +2. In the right-side **Actions** pane, click **Import list** to open the **Import List** dialog box. +3. In the **Import List** dialog box, navigate to the .cilx file location, select the file, and click **Open**. +4. In the **Volume Activation Management Tool** dialog box, click **OK** to begin the import. VAMT displays a progress message while the file is being imported. Click **OK** when a message appears and confirms that the import has completed successfully. + +## Export VAMT Data + +Exporting VAMT data from a non-Internet-connected VAMT host computer is the first step of proxy activation using multiple VAMT hosts. To export product-activation data to a .cilx file: +1. In the left-side pane, you can click a product you want to export data for, or click **Products** if the list contains data for all products. +2. If you want to export only part of the data in a product list, in the product list view in the center pane select the products you want to export. +3. In the right-side **Actions** pane on, click **Export list** to open the **Export List** dialog box. +4. In the **Export List** dialog box, click **Browse** to navigate to the .cilx file. +5. Under **Export options**, select one of the following data-type options: + - Export products and product keys + - Export products only + - Export proxy activation data only. Selecting this option ensures that the export contains only the licensing information required for the proxy web service to obtain CIDs from Microsoft. No Personally Identifiable Information (PII) is contained in the exported .cilx file when this selection is checked. +6. If you have selected products to export, select the **Export selected product rows only** check box. +7. Click **Save**. VAMT displays a progress message while the data is being exported. Click **OK** when a message appears and confirms that the export has completed successfully. + +## Related topics + +- [Perform Proxy Activation](proxy-activation-vamt.md) diff --git a/windows/deployment/volume-activation/install-configure-vamt.md b/windows/deployment/volume-activation/install-configure-vamt.md index cd82ce78a4..dc1c9eaa35 100644 --- a/windows/deployment/volume-activation/install-configure-vamt.md +++ b/windows/deployment/volume-activation/install-configure-vamt.md @@ -1,31 +1,34 @@ ---- -title: Install and Configure VAMT (Windows 10) -description: Install and Configure VAMT -ms.assetid: 5c7ae9b9-0dbc-4277-bc4f-8b3e4ab0bf50 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Install and Configure VAMT - -This section describes how to install and configure the Volume Activation Management Tool (VAMT). - -## In this Section - -|Topic |Description | -|------|------------| -|[VAMT Requirements](vamt-requirements.md) |Provides system requirements for installing VAMT on a host computer. | -|[Install VAMT](install-vamt.md) |Describes how to get and install VAMT. | -|[Configure Client Computers](configure-client-computers-vamt.md) |Describes how to configure client computers on your network to work with VAMT. | - -## Related topics - -- [Introduction to VAMT](introduction-vamt.md) -  -  +--- +title: Install and Configure VAMT (Windows 10) +description: Install and Configure VAMT +ms.assetid: 5c7ae9b9-0dbc-4277-bc4f-8b3e4ab0bf50 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Install and Configure VAMT + +This section describes how to install and configure the Volume Activation Management Tool (VAMT). + +## In this Section + +|Topic |Description | +|------|------------| +|[VAMT Requirements](vamt-requirements.md) |Provides system requirements for installing VAMT on a host computer. | +|[Install VAMT](install-vamt.md) |Describes how to get and install VAMT. | +|[Configure Client Computers](configure-client-computers-vamt.md) |Describes how to configure client computers on your network to work with VAMT. | + +## Related topics + +- [Introduction to VAMT](introduction-vamt.md) +  +  diff --git a/windows/deployment/volume-activation/install-kms-client-key-vamt.md b/windows/deployment/volume-activation/install-kms-client-key-vamt.md index 2894ba4f88..3fe43074c1 100644 --- a/windows/deployment/volume-activation/install-kms-client-key-vamt.md +++ b/windows/deployment/volume-activation/install-kms-client-key-vamt.md @@ -1,40 +1,43 @@ ---- -title: Install a KMS Client Key (Windows 10) -description: Install a KMS Client Key -ms.assetid: d234468e-7917-4cf5-b0a8-4968454f7759 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Install a KMS Client Key - -You can use the Volume Activation Management Tool (VAMT) to install Generic Volume License Key (GVLK), or KMS client, product keys. For example, if you are converting a MAK-activated product to KMS activation. - -**Note**   -By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. - -**To install a KMS Client key** -1. Open VAMT. -2. In the left-side pane click **Products** to open the product list view in the center pane. -3. In the products list view in the center pane, select the products that need to have GVLKs installed. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the center pane. -6. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. -7. The **Install Product Key** dialog box displays the keys that are available to be installed. -8. Select the **Automatically select an AD or KMS client key** option and then click **Install Key**. - - VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status is shown under the **Status of Last Action** column in the product list view in the center pane. - -## Related topics - -- [Perform KMS Activation](kms-activation-vamt.md) +--- +title: Install a KMS Client Key (Windows 10) +description: Install a KMS Client Key +ms.assetid: d234468e-7917-4cf5-b0a8-4968454f7759 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Install a KMS Client Key + +You can use the Volume Activation Management Tool (VAMT) to install Generic Volume License Key (GVLK), or KMS client, product keys. For example, if you are converting a MAK-activated product to KMS activation. + +**Note**   +By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. + +**To install a KMS Client key** +1. Open VAMT. +2. In the left-side pane click **Products** to open the product list view in the center pane. +3. In the products list view in the center pane, select the products that need to have GVLKs installed. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the center pane. +6. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. +7. The **Install Product Key** dialog box displays the keys that are available to be installed. +8. Select the **Automatically select an AD or KMS client key** option and then click **Install Key**. + + VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status is shown under the **Status of Last Action** column in the product list view in the center pane. + +## Related topics + +- [Perform KMS Activation](kms-activation-vamt.md) diff --git a/windows/deployment/volume-activation/install-product-key-vamt.md b/windows/deployment/volume-activation/install-product-key-vamt.md index fb7df4b2e4..96908f97d1 100644 --- a/windows/deployment/volume-activation/install-product-key-vamt.md +++ b/windows/deployment/volume-activation/install-product-key-vamt.md @@ -1,42 +1,45 @@ ---- -title: Install a Product Key (Windows 10) -description: Install a Product Key -ms.assetid: 78812c87-2208-4f8b-9c2c-5a8a18b2d648 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Install a Product Key - -You can use the Volume Activation Management Tool (VAMT) to install retail, Multiple Activation Key (MAK), and KMS Host key (CSVLK). - -**To install a Product key** -1. Open VAMT. -2. In the left-side pane, click the product that you want to install keys onto. -3. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. -6. In the products list view in the center pane, sort the list if needed and then select the products that need to have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. -7. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. -8. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAK based on the selected products. You can select a recommended product key or a product key from the **All Product Keys** list. Use the scroll bar if you need to view the **Description** for each key. When you have selected the product key you want to install, click **Install Key**. Note that only one key can be installed at a time. -9. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status is shown under the **Status of Last Action** column in the product list view in the center pane. - - **Note**   - Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct MAK or KMS Host key (CSVLK), see [How to Choose the Right - Volume License Key for Windows](https://go.microsoft.com/fwlink/p/?linkid=238382). - -## Related topics - -- [Manage Product Keys](manage-product-keys-vamt.md) -  -  +--- +title: Install a Product Key (Windows 10) +description: Install a Product Key +ms.assetid: 78812c87-2208-4f8b-9c2c-5a8a18b2d648 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Install a Product Key + +You can use the Volume Activation Management Tool (VAMT) to install retail, Multiple Activation Key (MAK), and KMS Host key (CSVLK). + +**To install a Product key** +1. Open VAMT. +2. In the left-side pane, click the product that you want to install keys onto. +3. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. +6. In the products list view in the center pane, sort the list if needed and then select the products that need to have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. +7. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. +8. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAK based on the selected products. You can select a recommended product key or a product key from the **All Product Keys** list. Use the scroll bar if you need to view the **Description** for each key. When you have selected the product key you want to install, click **Install Key**. Note that only one key can be installed at a time. +9. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status is shown under the **Status of Last Action** column in the product list view in the center pane. + + **Note**   + Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct MAK or KMS Host key (CSVLK), see [How to Choose the Right + Volume License Key for Windows](https://go.microsoft.com/fwlink/p/?linkid=238382). + +## Related topics + +- [Manage Product Keys](manage-product-keys-vamt.md) + + diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index a4905eb8ae..9a229185cc 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -1,71 +1,74 @@ ---- -title: Install VAMT (Windows 10) -description: Install VAMT -ms.assetid: 2eabd3e2-0a68-43a5-8189-2947e46482fc -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.localizationpriority: medium -ms.date: 03/11/2019 -ms.topic: article ---- - -# Install VAMT - -This topic describes how to install the Volume Activation Management Tool (VAMT). - -## Install VAMT - -You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for Windows 10. - ->[!IMPORTANT]   ->VAMT requires local administrator privileges on all managed computers in order to deposit confirmation IDs (CIDs), get the client products’ license status, and install product keys. If VAMT is being used to manage products and product keys on the local host computer and you do not have administrator privileges, start VAMT with elevated privileges. For Active Directory-Based Activation use, for best results we recommend running VAMT while logged on as a domain administrator.  - ->[!NOTE]   ->The VAMT Microsoft Management Console snap-in ships as an x86 package. - -### Requirements - -- [Windows Server with Desktop Experience](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-with-desktop-experience), with internet access and all updates applied -- [Windows 10, version 1809 ADK](https://go.microsoft.com/fwlink/?linkid=2026036) -- [SQL Server 2017 Express](https://www.microsoft.com/sql-server/sql-server-editions-express) - -### Install SQL Server 2017 Express - -1. Download and open the [SQL Server 2017 Express](https://www.microsoft.com/sql-server/sql-server-editions-express) package. -2. Select **Basic**. -3. Accept the license terms. -4. Enter an install location or use the default path, and then select **Install**. -5. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. - ![In this example, the instance name is SQLEXPRESS01](images/sql-instance.png) - -### Install VAMT using the ADK - -1. Download and open the [Windows 10, version 1809 ADK](https://go.microsoft.com/fwlink/?linkid=2026036) package. -2. Enter an install location or use the default path, and then select **Next**. -3. Select a privacy setting, and then select **Next**. -4. Accept the license terms. -5. On the **Select the features you want to install** page, select **Volume Activation Management Tool (VAMT)**, and then select **Install**. (You can select additional features to install as well.) -6. On the completion page, select **Close**. - -### Configure VAMT to connect to SQL Server 2017 Express - -1. Open **Volume Active Management Tool 3.1** from the Start menu. -2. Enter the server instance name and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example. - - ![Server name is .\SQLEXPRESS and database name is VAMT](images/vamt-db.png) - - - - -## Uninstall VAMT - -To uninstall VAMT using the **Programs and Features** Control Panel: -1. Open **Control Panel** and select **Programs and Features**. -2. Select **Assessment and Deployment Kit** from the list of installed programs and click **Change**. Follow the instructions in the Windows ADK installer to remove VAMT. - - -  -  +--- +title: Install VAMT (Windows 10) +description: Install VAMT +ms.assetid: 2eabd3e2-0a68-43a5-8189-2947e46482fc +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.localizationpriority: medium +ms.date: 03/11/2019 +ms.topic: article +--- + +# Install VAMT + +This topic describes how to install the Volume Activation Management Tool (VAMT). + +## Install VAMT + +You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for Windows 10. + +>[!IMPORTANT] +>VAMT requires local administrator privileges on all managed computers in order to deposit confirmation IDs (CIDs), get the client products’ license status, and install product keys. If VAMT is being used to manage products and product keys on the local host computer and you do not have administrator privileges, start VAMT with elevated privileges. For Active Directory-Based Activation use, for best results we recommend running VAMT while logged on as a domain administrator.  + +>[!NOTE] +>The VAMT Microsoft Management Console snap-in ships as an x86 package. + +### Requirements + +- [Windows Server with Desktop Experience](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-with-desktop-experience), with internet access and all updates applied +- [Windows 10, version 1809 ADK](https://go.microsoft.com/fwlink/?linkid=2026036) +- [SQL Server 2017 Express](https://www.microsoft.com/sql-server/sql-server-editions-express) + +### Install SQL Server 2017 Express + +1. Download and open the [SQL Server 2017 Express](https://www.microsoft.com/sql-server/sql-server-editions-express) package. +2. Select **Basic**. +3. Accept the license terms. +4. Enter an install location or use the default path, and then select **Install**. +5. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. + ![In this example, the instance name is SQLEXPRESS01](images/sql-instance.png) + +### Install VAMT using the ADK + +1. Download and open the [Windows 10, version 1809 ADK](https://go.microsoft.com/fwlink/?linkid=2026036) package. +2. Enter an install location or use the default path, and then select **Next**. +3. Select a privacy setting, and then select **Next**. +4. Accept the license terms. +5. On the **Select the features you want to install** page, select **Volume Activation Management Tool (VAMT)**, and then select **Install**. (You can select additional features to install as well.) +6. On the completion page, select **Close**. + +### Configure VAMT to connect to SQL Server 2017 Express + +1. Open **Volume Active Management Tool 3.1** from the Start menu. +2. Enter the server instance name and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example. + + ![Server name is .\SQLEXPRESS and database name is VAMT](images/vamt-db.png) + + + + +## Uninstall VAMT + +To uninstall VAMT using the **Programs and Features** Control Panel: +1. Open **Control Panel** and select **Programs and Features**. +2. Select **Assessment and Deployment Kit** from the list of installed programs and click **Change**. Follow the instructions in the Windows ADK installer to remove VAMT. + + + + diff --git a/windows/deployment/volume-activation/introduction-vamt.md b/windows/deployment/volume-activation/introduction-vamt.md index da71484e83..791d49e497 100644 --- a/windows/deployment/volume-activation/introduction-vamt.md +++ b/windows/deployment/volume-activation/introduction-vamt.md @@ -1,63 +1,66 @@ ---- -title: Introduction to VAMT (Windows 10) -description: Introduction to VAMT -ms.assetid: 0439685e-0bae-4967-b0d4-dd84ca6d7fa7 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Introduction to VAMT - -The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office®, and select other Microsoft products volume and retail activation process. VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in and can be installed on any computer that has one of the following Windows operating systems: Windows® 7, Windows 8, Windows 8.1, Windows 10,Windows Server 2008 R2, or Windows Server 2012. - -**Note**   -VAMT can be installed on, and can manage, physical or virtual instances. VAMT cannot detect whether or not the remote products are virtual. As long as the products can respond to Windows Management Instrumentation (WMI) calls, they will be discovered and activated. - -## In this Topic -- [Managing Multiple Activation Key (MAK) and Retail Activation](#bkmk-managingmak) -- [Managing Key Management Service (KMS) Activation](#bkmk-managingkms) -- [Enterprise Environment](#bkmk-enterpriseenvironment) -- [VAMT User Interface](#bkmk-userinterface) - -## Managing Multiple Activation Key (MAK) and Retail Activation - -You can use a MAK or a retail product key to activate Windows, Windows Server, or Office on an individual computer or a group of computers. VAMT enables two different activation scenarios: -- **Online activation.** Many enterprises maintain a single Windows system image or Office installation package for deployment across the enterprise. Occasionally there is also a need to use retail product keys in special situations. Online activation enables you to activate over the Internet any products installed with MAK, KMS host, or retail product keys on one or more connected computers within a network. This process requires that each product communicate activation information directly to Microsoft. -- **Proxy activation.** This activation method enables you to perform volume activation for products installed on client computers that do not have Internet access. The VAMT host computer distributes a MAK, KMS Host key (CSVLK), or retail product key to one or more client products and collects the installation ID (IID) from each client product. The VAMT host sends the IIDs to Microsoft on behalf of the client products and obtains the corresponding Confirmation IDs (CIDs). The VAMT host then installs the CIDs on the client products to complete the activation. Using this method, only the VAMT host computer needs Internet access. You can also activate products installed on computers in a workgroup that is completely isolated from any larger network, by installing a second instance of VAMT on a computer within the workgroup. Then, use removable media to transfer activation data between this new instance of VAMT and the Internet-connected VAMT host. - -## Managing Key Management Service (KMS) Activation - -In addition to MAK or retail activation, you can use VAMT to perform volume activation using the Key Management Service (KMS). VAMT can install and activate GVLK (KMS client) keys on client products. GVLKs are the default product keys used by Volume License editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 as well as Microsoft Office 2010. -VAMT treats a KMS Host key (CSVLK) product key identically to a retail-type product key; therefore, the experience for product key entry and activation management are identical for both these product key types. - -## Enterprise Environment - -VAMT is commonly implemented in enterprise environments. The following illustrates three common environments—Core Network, Secure Zone, and Isolated Lab. - -![VAMT in the enterprise](images/dep-win8-l-vamt-image001-enterprise.jpg) - -In the Core Network environment, all computers are within a common network managed by Active Directory® Domain Services (AD DS). The Secure Zone represents higher-security Core Network computers that have additional firewall protection. -The Isolated Lab environment is a workgroup that is physically separate from the Core Network, and its computers do not have Internet access. The network security policy states that no information that could identify a specific computer or user may be transferred out of the Isolated Lab. - -## VAMT User Interface - -The following screenshot shows the VAMT graphical user interface. - -![VAMT user interface](images/vamtuserinterfaceupdated.jpg) - -VAMT provides a single, graphical user interface for managing activations, and for performing other activation-related tasks such as: -- **Adding and removing computers.** You can use VAMT to discover computers in the local environment. VAMT can discover computers by querying AD DS, workgroups, by individual computer name or IP address, or via a general LDAP query. -- **Discovering products.** You can use VAMT to discover Windows, Windows Server, Office, and select other products installed on the client computers. -- **Monitoring activation status.** You can collect activation information about each product, including the last 5 characters of the product key being used, the current license state (such as Licensed, Grace, Unlicensed), and the product edition information. -- **Managing product keys.** You can store multiple product keys and use VAMT to install these keys to remote client products. You can also determine the number of activations remaining for MAKs. -- **Managing activation data.** VAMT stores activation data in a SQL database. VAMT can export this data to other VAMT hosts or to an archive in XML format. - -## Related topics -- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) -  -  +--- +title: Introduction to VAMT (Windows 10) +description: Introduction to VAMT +ms.assetid: 0439685e-0bae-4967-b0d4-dd84ca6d7fa7 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Introduction to VAMT + +The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office®, and select other Microsoft products volume and retail activation process. VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in and can be installed on any computer that has one of the following Windows operating systems: Windows® 7, Windows 8, Windows 8.1, Windows 10,Windows Server 2008 R2, or Windows Server 2012. + +**Note**   +VAMT can be installed on, and can manage, physical or virtual instances. VAMT cannot detect whether or not the remote products are virtual. As long as the products can respond to Windows Management Instrumentation (WMI) calls, they will be discovered and activated. + +## In this Topic +- [Managing Multiple Activation Key (MAK) and Retail Activation](#bkmk-managingmak) +- [Managing Key Management Service (KMS) Activation](#bkmk-managingkms) +- [Enterprise Environment](#bkmk-enterpriseenvironment) +- [VAMT User Interface](#bkmk-userinterface) + +## Managing Multiple Activation Key (MAK) and Retail Activation + +You can use a MAK or a retail product key to activate Windows, Windows Server, or Office on an individual computer or a group of computers. VAMT enables two different activation scenarios: +- **Online activation.** Many enterprises maintain a single Windows system image or Office installation package for deployment across the enterprise. Occasionally there is also a need to use retail product keys in special situations. Online activation enables you to activate over the Internet any products installed with MAK, KMS host, or retail product keys on one or more connected computers within a network. This process requires that each product communicate activation information directly to Microsoft. +- **Proxy activation.** This activation method enables you to perform volume activation for products installed on client computers that do not have Internet access. The VAMT host computer distributes a MAK, KMS Host key (CSVLK), or retail product key to one or more client products and collects the installation ID (IID) from each client product. The VAMT host sends the IIDs to Microsoft on behalf of the client products and obtains the corresponding Confirmation IDs (CIDs). The VAMT host then installs the CIDs on the client products to complete the activation. Using this method, only the VAMT host computer needs Internet access. You can also activate products installed on computers in a workgroup that is completely isolated from any larger network, by installing a second instance of VAMT on a computer within the workgroup. Then, use removable media to transfer activation data between this new instance of VAMT and the Internet-connected VAMT host. + +## Managing Key Management Service (KMS) Activation + +In addition to MAK or retail activation, you can use VAMT to perform volume activation using the Key Management Service (KMS). VAMT can install and activate GVLK (KMS client) keys on client products. GVLKs are the default product keys used by Volume License editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 as well as Microsoft Office 2010. +VAMT treats a KMS Host key (CSVLK) product key identically to a retail-type product key; therefore, the experience for product key entry and activation management are identical for both these product key types. + +## Enterprise Environment + +VAMT is commonly implemented in enterprise environments. The following illustrates three common environments—Core Network, Secure Zone, and Isolated Lab. + +![VAMT in the enterprise](images/dep-win8-l-vamt-image001-enterprise.jpg) + +In the Core Network environment, all computers are within a common network managed by Active Directory® Domain Services (AD DS). The Secure Zone represents higher-security Core Network computers that have additional firewall protection. +The Isolated Lab environment is a workgroup that is physically separate from the Core Network, and its computers do not have Internet access. The network security policy states that no information that could identify a specific computer or user may be transferred out of the Isolated Lab. + +## VAMT User Interface + +The following screenshot shows the VAMT graphical user interface. + +![VAMT user interface](images/vamtuserinterfaceupdated.jpg) + +VAMT provides a single, graphical user interface for managing activations, and for performing other activation-related tasks such as: +- **Adding and removing computers.** You can use VAMT to discover computers in the local environment. VAMT can discover computers by querying AD DS, workgroups, by individual computer name or IP address, or via a general LDAP query. +- **Discovering products.** You can use VAMT to discover Windows, Windows Server, Office, and select other products installed on the client computers. +- **Monitoring activation status.** You can collect activation information about each product, including the last 5 characters of the product key being used, the current license state (such as Licensed, Grace, Unlicensed), and the product edition information. +- **Managing product keys.** You can store multiple product keys and use VAMT to install these keys to remote client products. You can also determine the number of activations remaining for MAKs. +- **Managing activation data.** VAMT stores activation data in a SQL database. VAMT can export this data to other VAMT hosts or to an archive in XML format. + +## Related topics +- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) + + diff --git a/windows/deployment/volume-activation/kms-activation-vamt.md b/windows/deployment/volume-activation/kms-activation-vamt.md index 9752481f0b..d109d49ad1 100644 --- a/windows/deployment/volume-activation/kms-activation-vamt.md +++ b/windows/deployment/volume-activation/kms-activation-vamt.md @@ -1,46 +1,49 @@ ---- -title: Perform KMS Activation (Windows 10) -description: Perform KMS Activation -ms.assetid: 5a3ae8e6-083e-4153-837e-ab0a225c1d10 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Perform KMS Activation - -The Volume Activation Management Tool (VAMT) can be used to perform volume activation using the Key Management Service (KMS). You can use VAMT to activate Generic Volume Licensing Keys, or KMS client keys, on products accessible to VAMT. GVLKs are the default product keys used by the volume-license editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft Office 2010. GVLKs are already installed in volume-license editions of these products. - -## Requirements - -Before configuring KMS activation, ensure that your network and VAMT installation meet the following requirements: -- KMS host is set up and enabled. -- KMS clients can access the KMS host. -- VAMT is installed on a central computer with network access to all client computers. -- The products to be activated have been added to VAMT. For more information on adding product keys, see [Install a KMS Client Key](install-kms-client-key-vamt.md). -- VAMT has administrative permissions on all computers to be activated, and Windows Management Instrumentation (WMI) is accessible through the Windows Firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -## To configure devices for KMS activation - -**To configure devices for KMS activation** -1. Open VAMT. -2. If necessary, set up the KMS activation preferences. If you don’t need to set up the preferences, skip to step 6 in this procedure. Otherwise, continue to step 2. -3. To set up the preferences, on the menu bar click **View**, then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. -4. Under **Key Management Services host selection**, select one of the following options: - - **Find a KMS host automatically using DNS (default)**. If you choose this option, VAMT first clears any previously configured KMS host on the target computer and instructs the computer to query the Domain Name Service (DNS) to locate a KMS host and attempt activation. - - **Find a KMS host using DNS in this domain for supported products**. Enter the domain name. If you choose this option, VAMT first clears any previously configured KMS host on the target computer and instructs the computer to query the DNS in the specified domain to locate a KMS host and attempt activation. - - **Use specific KMS host**. Enter the KMS host name and KMS host port. For environments which do not use DNS for KMS host identification, VAMT sets the specified KMS host name and KMS host port on the target computer, and then instructs the computer to attempt activation with the specific KMS host. -5. Click **Apply**, and then click **OK** to close the **Volume Activation Management Tool Preferences** dialog box. -6. Select the products to be activated by selecting individual products in the product list view in the center pane. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box.In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -7. Click **Filter**. VAMT displays the filtered list in the center pane. -8. In the right-side pane, click **Activate** in the **Selected Items** menu, and then click **Volume activate**. -9. Click a credential option. Choose **Alternate credentials** only if you are activating products that require administrator credentials different from the ones you are currently using. -10. If you are supplying alternate credentials, at the prompt, type the appropriate user name and password and click **OK**. -VAMT displays the **Volume Activation** dialog box until it completes the requested action. When the process is finished, the updated activation status of each product appears in the product list view in the center pane. -  \ No newline at end of file +--- +title: Perform KMS Activation (Windows 10) +description: Perform KMS Activation +ms.assetid: 5a3ae8e6-083e-4153-837e-ab0a225c1d10 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Perform KMS Activation + +The Volume Activation Management Tool (VAMT) can be used to perform volume activation using the Key Management Service (KMS). You can use VAMT to activate Generic Volume Licensing Keys, or KMS client keys, on products accessible to VAMT. GVLKs are the default product keys used by the volume-license editions of Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft Office 2010. GVLKs are already installed in volume-license editions of these products. + +## Requirements + +Before configuring KMS activation, ensure that your network and VAMT installation meet the following requirements: +- KMS host is set up and enabled. +- KMS clients can access the KMS host. +- VAMT is installed on a central computer with network access to all client computers. +- The products to be activated have been added to VAMT. For more information on adding product keys, see [Install a KMS Client Key](install-kms-client-key-vamt.md). +- VAMT has administrative permissions on all computers to be activated, and Windows Management Instrumentation (WMI) is accessible through the Windows Firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +## To configure devices for KMS activation + +**To configure devices for KMS activation** +1. Open VAMT. +2. If necessary, set up the KMS activation preferences. If you don’t need to set up the preferences, skip to step 6 in this procedure. Otherwise, continue to step 2. +3. To set up the preferences, on the menu bar click **View**, then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. +4. Under **Key Management Services host selection**, select one of the following options: + - **Find a KMS host automatically using DNS (default)**. If you choose this option, VAMT first clears any previously configured KMS host on the target computer and instructs the computer to query the Domain Name Service (DNS) to locate a KMS host and attempt activation. + - **Find a KMS host using DNS in this domain for supported products**. Enter the domain name. If you choose this option, VAMT first clears any previously configured KMS host on the target computer and instructs the computer to query the DNS in the specified domain to locate a KMS host and attempt activation. + - **Use specific KMS host**. Enter the KMS host name and KMS host port. For environments which do not use DNS for KMS host identification, VAMT sets the specified KMS host name and KMS host port on the target computer, and then instructs the computer to attempt activation with the specific KMS host. +5. Click **Apply**, and then click **OK** to close the **Volume Activation Management Tool Preferences** dialog box. +6. Select the products to be activated by selecting individual products in the product list view in the center pane. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box.In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +7. Click **Filter**. VAMT displays the filtered list in the center pane. +8. In the right-side pane, click **Activate** in the **Selected Items** menu, and then click **Volume activate**. +9. Click a credential option. Choose **Alternate credentials** only if you are activating products that require administrator credentials different from the ones you are currently using. +10. If you are supplying alternate credentials, at the prompt, type the appropriate user name and password and click **OK**. +VAMT displays the **Volume Activation** dialog box until it completes the requested action. When the process is finished, the updated activation status of each product appears in the product list view in the center pane. +  diff --git a/windows/deployment/volume-activation/local-reactivation-vamt.md b/windows/deployment/volume-activation/local-reactivation-vamt.md index c2c0095d04..309dd5a702 100644 --- a/windows/deployment/volume-activation/local-reactivation-vamt.md +++ b/windows/deployment/volume-activation/local-reactivation-vamt.md @@ -1,44 +1,47 @@ ---- -title: Perform Local Reactivation (Windows 10) -description: Perform Local Reactivation -ms.assetid: aacd5ded-da11-4d27-a866-3f57332f5dec -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Perform Local Reactivation - -If you reinstall Windows® or Microsoft® Office 2010 on a computer that was initially activated using proxy activation (MAK, retail, or CSLVK (KMS host)), and have not made significant changes to the hardware, use this local reactivation procedure to reactivate the program on that computer. -Local reactivation relies upon data that was created during the initial proxy activation and stored in the Volume Activation Management Tool (VAMT) database. The database contains the installation ID (IID) and confirmation ID (Pending CID). Local reactivation uses this data to reapply the CID and reactivate those products. Reapplying the same CID conserves the remaining activations on the key. - -**Note**   -During the initial proxy activation, the CID is bound to a digital “fingerprint”, which is calculated from values assigned to several different hardware components in the computer. If the computer has had significant hardware changes, this fingerprint will no longer match the CID. In this case, you must obtain a new CID for the computer from Microsoft. - -## To Perform a Local Reactivation - -**To perform a local reactivation** -1. Open VAMT. Make sure that you are connected to the desired database. -2. In the left-side pane, click the product you want to reactivate to display the products list. -3. In the product list view in the center pane, select the desired products to be reactivated. You can sort the list by computer name by clicking on the **Computer Name** heading. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the center pane. -6. In the right-side pane, click **Activate**, and then click **Apply Confirmation ID**. -7. Click a credential option. Choose **Alternate credentials** only if you are reactivating products that require administrator credentials different from the ones you are currently using. -8. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. - - VAMT displays the **Apply Confirmation ID** dialog box. - -10. If you are using a different product key than the product key used for initial activation, you must complete a new activation to obtain a new CID. -11. If you are activating a product that requires administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** check box. -12. Click **OK**. - -## Related topics - -- [Manage Activations](manage-activations-vamt.md) +--- +title: Perform Local Reactivation (Windows 10) +description: Perform Local Reactivation +ms.assetid: aacd5ded-da11-4d27-a866-3f57332f5dec +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Perform Local Reactivation + +If you reinstall Windows® or Microsoft® Office 2010 on a computer that was initially activated using proxy activation (MAK, retail, or CSLVK (KMS host)), and have not made significant changes to the hardware, use this local reactivation procedure to reactivate the program on that computer. +Local reactivation relies upon data that was created during the initial proxy activation and stored in the Volume Activation Management Tool (VAMT) database. The database contains the installation ID (IID) and confirmation ID (Pending CID). Local reactivation uses this data to reapply the CID and reactivate those products. Reapplying the same CID conserves the remaining activations on the key. + +**Note**   +During the initial proxy activation, the CID is bound to a digital “fingerprint”, which is calculated from values assigned to several different hardware components in the computer. If the computer has had significant hardware changes, this fingerprint will no longer match the CID. In this case, you must obtain a new CID for the computer from Microsoft. + +## To Perform a Local Reactivation + +**To perform a local reactivation** +1. Open VAMT. Make sure that you are connected to the desired database. +2. In the left-side pane, click the product you want to reactivate to display the products list. +3. In the product list view in the center pane, select the desired products to be reactivated. You can sort the list by computer name by clicking on the **Computer Name** heading. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the center pane. +6. In the right-side pane, click **Activate**, and then click **Apply Confirmation ID**. +7. Click a credential option. Choose **Alternate credentials** only if you are reactivating products that require administrator credentials different from the ones you are currently using. +8. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. + + VAMT displays the **Apply Confirmation ID** dialog box. + +10. If you are using a different product key than the product key used for initial activation, you must complete a new activation to obtain a new CID. +11. If you are activating a product that requires administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** check box. +12. Click **OK**. + +## Related topics + +- [Manage Activations](manage-activations-vamt.md) diff --git a/windows/deployment/volume-activation/manage-activations-vamt.md b/windows/deployment/volume-activation/manage-activations-vamt.md index 480d593d6d..318cd0cb65 100644 --- a/windows/deployment/volume-activation/manage-activations-vamt.md +++ b/windows/deployment/volume-activation/manage-activations-vamt.md @@ -1,30 +1,33 @@ ---- -title: Manage Activations (Windows 10) -description: Manage Activations -ms.assetid: 53bad9ed-9430-4f64-a8de-80613870862c -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Manage Activations - -This section describes how to activate a client computer, by using a variety of activation methods. - -## In this Section - -|Topic |Description | -|------|------------| -|[Perform Online Activation](online-activation-vamt.md) |Describes how to activate a client computer over the Internet. | -|[Perform Proxy Activation](proxy-activation-vamt.md) |Describes how to perform volume activation for client products that do not have Internet access. | -|[Perform KMS Activation](kms-activation-vamt.md) |Describes how perform volume activation using the Key Management Service (KMS). | -|[Perform Local Reactivation](local-reactivation-vamt.md) |Describes how to reactivate an operating system or Office program that was reinstalled. | -|[Activate an Active Directory Forest Online](activate-forest-vamt.md) |Describes how to use Active Directory-Based Activation to online activate an Active Directory forest. | -|[Activate by Proxy an Active Directory Forest](activate-forest-by-proxy-vamt.md) |Describes how to use Active Directory-Based Activation to proxy activate an Active Directory forest that is not connected to the Internet. | -  -  -  +--- +title: Manage Activations (Windows 10) +description: Manage Activations +ms.assetid: 53bad9ed-9430-4f64-a8de-80613870862c +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Manage Activations + +This section describes how to activate a client computer, by using a variety of activation methods. + +## In this Section + +|Topic |Description | +|------|------------| +|[Perform Online Activation](online-activation-vamt.md) |Describes how to activate a client computer over the Internet. | +|[Perform Proxy Activation](proxy-activation-vamt.md) |Describes how to perform volume activation for client products that do not have Internet access. | +|[Perform KMS Activation](kms-activation-vamt.md) |Describes how perform volume activation using the Key Management Service (KMS). | +|[Perform Local Reactivation](local-reactivation-vamt.md) |Describes how to reactivate an operating system or Office program that was reinstalled. | +|[Activate an Active Directory Forest Online](activate-forest-vamt.md) |Describes how to use Active Directory-Based Activation to online activate an Active Directory forest. | +|[Activate by Proxy an Active Directory Forest](activate-forest-by-proxy-vamt.md) |Describes how to use Active Directory-Based Activation to proxy activate an Active Directory forest that is not connected to the Internet. | + + + diff --git a/windows/deployment/volume-activation/manage-product-keys-vamt.md b/windows/deployment/volume-activation/manage-product-keys-vamt.md index 356b2adbca..bedd50af8f 100644 --- a/windows/deployment/volume-activation/manage-product-keys-vamt.md +++ b/windows/deployment/volume-activation/manage-product-keys-vamt.md @@ -1,26 +1,29 @@ ---- -title: Manage Product Keys (Windows 10) -description: Manage Product Keys -ms.assetid: 4c6c4216-b4b7-437c-904e-4cb257f913cd -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Manage Product Keys - -This section describes how to add and remove a product key from the Volume Activation Management Tool (VAMT). After you add a product key to VAMT, you can install that product key on a product or products you select in the VAMT database. -## In this Section - -|Topic |Description | -|------|------------| -|[Add and Remove a Product Key](add-remove-product-key-vamt.md) |Describes how to add a product key to the VAMT database. | -|[Install a Product Key](install-product-key-vamt.md) |Describes how to install a product key for specific product. | -|[Install a KMS Client Key](install-kms-client-key-vamt.md) |Describes how to install a GVLK (KMS client) key. | -  -  -  +--- +title: Manage Product Keys (Windows 10) +description: Manage Product Keys +ms.assetid: 4c6c4216-b4b7-437c-904e-4cb257f913cd +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Manage Product Keys + +This section describes how to add and remove a product key from the Volume Activation Management Tool (VAMT). After you add a product key to VAMT, you can install that product key on a product or products you select in the VAMT database. +## In this Section + +|Topic |Description | +|------|------------| +|[Add and Remove a Product Key](add-remove-product-key-vamt.md) |Describes how to add a product key to the VAMT database. | +|[Install a Product Key](install-product-key-vamt.md) |Describes how to install a product key for specific product. | +|[Install a KMS Client Key](install-kms-client-key-vamt.md) |Describes how to install a GVLK (KMS client) key. | + + + diff --git a/windows/deployment/volume-activation/manage-vamt-data.md b/windows/deployment/volume-activation/manage-vamt-data.md index f2a1b046c1..7d068975cd 100644 --- a/windows/deployment/volume-activation/manage-vamt-data.md +++ b/windows/deployment/volume-activation/manage-vamt-data.md @@ -1,22 +1,25 @@ ---- -title: Manage VAMT Data (Windows 10) -description: Manage VAMT Data -ms.assetid: 233eefa4-3125-4965-a12d-297a67079dc4 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Manage VAMT Data - -This section describes how to save, import, export, and merge a Computer Information List (CILX) file using the Volume Activation Management Tool (VAMT). - -## In this Section -|Topic |Description | -|------|------------| -|[Import and Export VAMT Data](import-export-vamt-data.md) |Describes how to import and export VAMT data. | -|[Use VAMT in Windows PowerShell](use-vamt-in-windows-powershell.md) |Describes how to access Windows PowerShell and how to import the VAMT PowerShell module. | +--- +title: Manage VAMT Data (Windows 10) +description: Manage VAMT Data +ms.assetid: 233eefa4-3125-4965-a12d-297a67079dc4 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Manage VAMT Data + +This section describes how to save, import, export, and merge a Computer Information List (CILX) file using the Volume Activation Management Tool (VAMT). + +## In this Section +|Topic |Description | +|------|------------| +|[Import and Export VAMT Data](import-export-vamt-data.md) |Describes how to import and export VAMT data. | +|[Use VAMT in Windows PowerShell](use-vamt-in-windows-powershell.md) |Describes how to access Windows PowerShell and how to import the VAMT PowerShell module. | diff --git a/windows/deployment/volume-activation/monitor-activation-client.md b/windows/deployment/volume-activation/monitor-activation-client.md index 1b13e0e5ff..ea131b996d 100644 --- a/windows/deployment/volume-activation/monitor-activation-client.md +++ b/windows/deployment/volume-activation/monitor-activation-client.md @@ -1,43 +1,44 @@ ---- -title: Monitor activation (Windows 10) -ms.assetid: 264a3e86-c880-4be4-8828-bf4c839dfa26 -description: -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: greg-lindsay -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Monitor activation - -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for retail activation?** - -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -You can monitor the success of the activation process for a computer running Windows 8.1 in several ways. The most popular methods include: -- Using the Volume Licensing Service Center website to track use of MAK keys. -- Using the **Slmgr /dlv** command on a client computer or on the KMS host. (For a full list of options, see [Slmgr.vbs Options](https://technet.microsoft.com/library/ff793433.aspx).) -- Viewing the licensing status, which is exposed through Windows Management Instrumentation (WMI); therefore, it is available to non-Microsoft or custom tools that can access WMI. (Windows PowerShell can also access WMI information.) -- Most licensing actions and events are recorded in the Event log. -- Microsoft System Center Operations Manager and the KMS Management Pack can provide insight and information to users of System Center Operations Manager. -- The VAMT provides a single site from which to manage and monitor volume activations. This is explained in the next section. - -## See also - -- [Volume Activation for Windows 10](volume-activation-windows-10.md) -  -  +--- +title: Monitor activation (Windows 10) +ms.assetid: 264a3e86-c880-4be4-8828-bf4c839dfa26 +ms.reviewer: +manager: laurawi +ms.author: greglin +description: +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.localizationpriority: medium +ms.topic: article +--- + +# Monitor activation + +**Applies to** +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) + +You can monitor the success of the activation process for a computer running Windows in several ways. The most popular methods include: +- Using the Volume Licensing Service Center website to track use of MAK keys. +- Using the **Slmgr /dlv** command on a client computer or on the KMS host. (For a full list of options, see [Slmgr.vbs Options](https://technet.microsoft.com/library/ff793433.aspx).) +- Viewing the licensing status, which is exposed through Windows Management Instrumentation (WMI); therefore, it is available to non-Microsoft or custom tools that can access WMI. (Windows PowerShell can also access WMI information.) +- Most licensing actions and events are recorded in the Event log (ex: Application Log events 12288-12290). +- Microsoft System Center Operations Manager and the KMS Management Pack can provide insight and information to users of System Center Operations Manager. +- See [Troubleshooting activation error codes](https://docs.microsoft.com/windows-server/get-started/activation-error-codes) for information about troubleshooting procedures for Multiple Activation Key (MAK) or the Key Management Service (KMS). +- The VAMT provides a single site from which to manage and monitor volume activations. This is explained in the next section. + +## See also + +[Volume Activation for Windows 10](volume-activation-windows-10.md) diff --git a/windows/deployment/volume-activation/online-activation-vamt.md b/windows/deployment/volume-activation/online-activation-vamt.md index 1342ffa177..45f237024f 100644 --- a/windows/deployment/volume-activation/online-activation-vamt.md +++ b/windows/deployment/volume-activation/online-activation-vamt.md @@ -1,52 +1,55 @@ ---- -title: Perform Online Activation (Windows 10) -description: Perform Online Activation -ms.assetid: 8381792b-a454-4e66-9b4c-e6e4c9303823 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Perform Online Activation - -You can use the Volume Activation Management Tool (VAMT) to enable client products to be activated over the Internet. You can install the client products with any kind of product key that is eligible for online activation—Multiple Activation Key (MAK), retail, and Windows Key Management Services (KMS) host key. - -## Requirements - -Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: -- VAMT is installed on a central computer that has network access to all client computers. -- Both the VAMT host and client computers have Internet access. -- The products that you want to activate are added to VAMT. -- VAMT has administrative permissions on all computers that you intend to activate, and that Windows Management Instrumentation (WMI) can be accessed through the Windows firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking -**Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. - -## To Perform an Online Activation - -**To perform an online activation** -1. Open VAMT. -2. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -4. Click **Filter**. VAMT displays the filtered list in the center pane. -5. Select the products that you want to activate. You can use the **CTRL** key or the **SHIFT** key to select more than one product. -6. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane and then point to **Activate**. If the **Actions** pane is not displayed, click the Show/Hide Action Pane button, which is located on the toolbar to the right of the Help button. -7. Point to **Online activate**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. -8. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status is shown under the **Status of Last Action** column in the products list view in the center pane. - - **Note**   - Online activation does not enable you to save the Confirmation IDs (CIDs). As a result, you cannot perform local reactivation. - - **Note** - You can use online activation to select products that have different key types and activate the products at the same time. - -## Related topics -- [Manage Activations](manage-activations-vamt.md) +--- +title: Perform Online Activation (Windows 10) +description: Perform Online Activation +ms.assetid: 8381792b-a454-4e66-9b4c-e6e4c9303823 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Perform Online Activation + +You can use the Volume Activation Management Tool (VAMT) to enable client products to be activated over the Internet. You can install the client products with any kind of product key that is eligible for online activation—Multiple Activation Key (MAK), retail, and Windows Key Management Services (KMS) host key. + +## Requirements + +Before performing online activation, ensure that the network and the VAMT installation meet the following requirements: +- VAMT is installed on a central computer that has network access to all client computers. +- Both the VAMT host and client computers have Internet access. +- The products that you want to activate are added to VAMT. +- VAMT has administrative permissions on all computers that you intend to activate, and that Windows Management Instrumentation (WMI) can be accessed through the Windows firewall. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking +**Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. + +## To Perform an Online Activation + +**To perform an online activation** +1. Open VAMT. +2. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +4. Click **Filter**. VAMT displays the filtered list in the center pane. +5. Select the products that you want to activate. You can use the **CTRL** key or the **SHIFT** key to select more than one product. +6. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane and then point to **Activate**. If the **Actions** pane is not displayed, click the Show/Hide Action Pane button, which is located on the toolbar to the right of the Help button. +7. Point to **Online activate**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. +8. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status is shown under the **Status of Last Action** column in the products list view in the center pane. + + **Note**   + Online activation does not enable you to save the Confirmation IDs (CIDs). As a result, you cannot perform local reactivation. + + **Note** + You can use online activation to select products that have different key types and activate the products at the same time. + +## Related topics +- [Manage Activations](manage-activations-vamt.md) diff --git a/windows/deployment/volume-activation/plan-for-volume-activation-client.md b/windows/deployment/volume-activation/plan-for-volume-activation-client.md index 26eb638a78..6ced1398db 100644 --- a/windows/deployment/volume-activation/plan-for-volume-activation-client.md +++ b/windows/deployment/volume-activation/plan-for-volume-activation-client.md @@ -2,37 +2,40 @@ title: Plan for volume activation (Windows 10) description: Product activation is the process of validating software with the manufacturer after it has been installed on a specific computer. ms.assetid: f84b005b-c362-4a70-a84e-4287c0d2e4ca +ms.reviewer: +manager: laurawi +ms.author: greglin keywords: vamt, volume activation, activation, windows activation ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: jdeckerms +audience: itpro +author: greg-lindsay ms.localizationpriority: medium -ms.date: 09/27/2017 ms.topic: article --- # Plan for volume activation **Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 +- Windows 10 +- Windows 8.1 +- Windows 8 +- Windows 7 +- Windows Server 2012 R2 +- Windows Server 2012 +- Windows Server 2008 R2 **Looking for retail activation?** -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) +- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) *Product activation* is the process of validating software with the manufacturer after it has been installed on a specific computer. Activation confirms that the product is genuine—not a fraudulent copy—and that the product key or serial number is valid and has not been compromised or revoked. Activation also establishes a link or relationship between the product key and the particular installation. -During the activation process, information about the specific installation is examined. In the case of online activations, this information is sent to a server at Microsoft. This information may include the software version, the product key, the IP address of the computer, and information about the device. The activation methods that Microsoft uses are designed to help protect user privacy, and they cannot be used to track back to the computer or user. The gathered data confirms that the software is a legally licensed copy, and this data is used for statistical analysis. Microsoft does not use this information to identify or contact the user or the organization. +During the activation process, information about the specific installation is examined. For online activations, this information is sent to a server at Microsoft. This information may include the software version, the product key, the IP address of the computer, and information about the device. The activation methods that Microsoft uses are designed to help protect user privacy, and they cannot be used to track back to the computer or user. The gathered data confirms that the software is a legally licensed copy, and this data is used for statistical analysis. Microsoft does not use this information to identify or contact the user or the organization. ->[!NOTE]  +>[!NOTE] >The IP address is used only to verify the location of the request, because some editions of Windows (such as “Starter” editions) can only be activated within certain geographical target markets. ## Distribution channels and activation @@ -76,7 +79,7 @@ Telephone activation is primarily used in situations where a computer is isolate - Active Directory-based activation **Note**   -A specialized method, Token-based activation, is available for specific situations when approved customers rely on a public key infrastructure in a completely isolated, and usually high-security, environment. For more information, contact your Microsoft Account Team or your service representative. +Token-based activation is available for specific situations when approved customers rely on a public key infrastructure in an isolated and high-security environment. For more information, contact your Microsoft Account Team or your service representative. Token-based Activation option is available for Windows 10 Enterprise LTSB editions (Version 1507 and 1607). ### Multiple activation key @@ -97,7 +100,7 @@ Volume editions of Windows 10 and Windows Server 2012 R2 (in addition to volu The KMS requires a minimum number of computers (physical computers or virtual machines) in a network environment. The organization must have at least five computers to activate Windows Server 2012 R2 and at least 25 computers to activate client computers that are running Windows 10. These minimums are referred to as *activation thresholds*. -Planning to use the KMS includes selecting the best location for the KMS host and how many KMS hosts to have. One KMS host can handle a large number of activations, but organizations will often deploy two KMS hosts to ensure availability. Only rarely would more than two KMS hosts be used. The KMS can be hosted on a client computer or on a server, and it can be run on older versions of the operating system if proper configuration steps are taken. Setting up your KMS is discussed later in this guide. +Planning to use the KMS includes selecting the best location for the KMS host and how many KMS hosts to have. One KMS host can handle a large number of activations, but organizations will often deploy two KMS hosts to ensure availability. Only rarely will more than two KMS hosts be used. The KMS can be hosted on a client computer or on a server, and it can be run on older versions of the operating system if proper configuration steps are taken. Setting up your KMS is discussed later in this guide. ### Active Directory-based activation @@ -113,7 +116,7 @@ A modern business network has many nuances and interconnections. This section ex Your core network is that part of your network that enjoys stable, high-speed, reliable connectivity to infrastructure servers. In many cases, the core network is also connected to the Internet, although that is not a requirement to use the KMS or Active Directory-based activation after the KMS server or AD DS is configured and active. Your core network likely consists of many network segments. In many organizations, the core network makes up the vast majority of the business network. -In the core network, a centralized KMS solution is usually recommended. You can also use Active Directory-based activation, but in many organizations, KMS will still be required to activate older client computers and computers that are not joined to the domain. Some administrators prefer to run both solutions to have the most flexibility, while others prefer to choose only a KMS-based solution for simplicity. Active Directory-based activation as the only solution is workable if all of the clients in your organization are running Windows 10, Windows 8.1, or Windows 8. +In the core network, a centralized KMS solution is recommended. You can also use Active Directory-based activation, but in many organizations, KMS will still be required to activate older client computers and computers that are not joined to the domain. Some administrators prefer to run both solutions to have the most flexibility, while others prefer to choose only a KMS-based solution for simplicity. Active Directory-based activation as the only solution is workable if all of the clients in your organization are running Windows 10, Windows 8.1, or Windows 8. A typical core network that includes a KMS host is shown in Figure 1. @@ -169,7 +172,7 @@ Now it’s time to assemble the pieces into a working solution. By evaluating yo |----------|------------------| |Number of domain-joined computers that support Active Directory-based activation (computers running Windows 10, Windows 8.1, Windows 8, Windows Server 2012 R2, or Windows Server 2012 R2) and will connect to a domain controller at least every 180 days. Computers can be mobile, semi-isolated, or located in a branch office or the core network. |Active Directory-based activation | |Number of computers in the core network that will connect (directly or through a VPN) at least every 180 days

                                  Note
                                  The core network must meet the KMS activation threshold. |KMS (central) | -|Number of computers that do not connect to the network at least once every 180 days (or if no network meets the activation threshold) |MAM | +|Number of computers that do not connect to the network at least once every 180 days (or if no network meets the activation threshold) | MAK | |Number of computers in semi-isolated networks that have connectivity to the KMS in the core network |KMS (central) | |Number of computers in isolated networks where the KMS activation threshold is met |KMS (local) | |Number of computers in isolated networks where the KMS activation threshold is not met |MAK | @@ -194,7 +197,7 @@ A KMS host running Windows Server 2012 R2, Windows Server 2012, or Windows Se When you create installation media or images for client computers that will be activated by KMS or Active Directory-based activation, install a generic volume license key (GVLK) for the edition of Windows you are creating. GVLKs are also referred to as KMS client setup keys. -Installation media from Microsoft for Enterprise editions of the Windows operating system may already contain the GVLK. One GVLK is available for each type of installation. Note that the GLVK will not activate the software against Microsoft activation servers, only against a KMS or Active Directory-based activation object. In other words, the GVLK does not work unless a valid KMS host key can be found. GVLKs are the only product keys that do not need to be kept confidential. +Installation media from Microsoft for Enterprise editions of the Windows operating system may already contain the GVLK. One GVLK is available for each type of installation. The GLVK will not activate the software against Microsoft activation servers, but rather against a KMS or Active Directory-based activation object. In other words, the GVLK does not work unless a valid KMS host key can be found. GVLKs are the only product keys that do not need to be kept confidential. Typically, you will not need to manually enter a GVLK unless a computer has been activated with a MAK or a retail key and it is being converted to a KMS activation or to Active Directory-based activation. If you need to locate the GVLK for a particular client edition, see [Appendix A: KMS Client Setup Keys](https://technet.microsoft.com/library/jj612867.aspx). @@ -225,5 +228,5 @@ The flow of KMS activation is shown in Figure 3, and it follows this sequence: ## See also - [Volume Activation for Windows 10](volume-activation-windows-10.md) -  -  + + diff --git a/windows/deployment/volume-activation/proxy-activation-vamt.md b/windows/deployment/volume-activation/proxy-activation-vamt.md index aab7a8768c..ff4ab4c6f5 100644 --- a/windows/deployment/volume-activation/proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/proxy-activation-vamt.md @@ -1,55 +1,58 @@ ---- -title: Perform Proxy Activation (Windows 10) -description: Perform Proxy Activation -ms.assetid: 35a919ed-f1cc-4d10-9c88-9bd634549dc3 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Perform Proxy Activation - -You can use the Volume Activation Management Tool (VAMT) to perform activation for client computers that do not have Internet access. The client products can be installed with any type of product key that is eligible for proxy activation: Multiple activation Key (MAK), KMS Host key (CSVLK), or retail key. - -In a typical proxy-activation scenario, the VAMT host computer distributes a MAK to one or more client computers and collects the installation ID (IID) from each computer. The VAMT host computer sends the IIDs to Microsoft on behalf of the client computers and obtains the corresponding Confirmation IDs (CIDs). The VAMT host computer then installs the CIDs on the client computer to complete the activation. Using this activation method, only the VAMT host computer needs Internet access. - -**Note**   -For workgroups that are completely isolated from any larger network, you can still perform MAK, KMS Host key (CSVLK), or retail proxy activation. This requires installing a second instance of VAMT on a computer within the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. For more information about this scenario, see [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md). Similarly, you can proxy activate a KMS Host key (CSVLK) located in an isolated network. You can also proxy activate a KMS Host key (CSVLK) in the core network if you do not want the KMS host computer to connect to Microsoft over the Internet.  - -## Requirements - -Before performing proxy activation, ensure that your network and the VAMT installation meet the following requirements: -- There is an instance of VAMT that is installed on a computer that has Internet access. If you are performing proxy activation for an isolated workgroup, you also need to have VAMT installed on one of the computers in the workgroup. -- The products to be activated have been added to VAMT and are installed with a retail product key, a KMS Host key (CSVLK) or a MAK. If the products have not been installed with a proper product key, refer to the steps in the [Add and Remove a Product Key](add-remove-product-key-vamt.md) section for instructions on how to install a product key. -- VAMT has administrative permissions on all products to be activated and Windows Management Instrumentation (WMI) is accessible through the Windows firewall. -- For workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). -The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking **Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. - -## To Perform Proxy Activation - -**To perform proxy activation** - -1. Open VAMT. -2. If necessary, install product keys. For more information see: - - [Install a Product Key](install-product-key-vamt.md) to install retail, MAK, or KMS Host key (CSVLK). - - [Install a KMS Client Key](install-kms-client-key-vamt.md) to install GVLK (KMS client) keys. -3. In the **Products** list in the center pane, select the individual products to be activated. You can use the **Filter** function to narrow your search for products by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the center pane. -6. In the right-side pane, click **Activate** and then click **Proxy activate** to open the **Proxy Activate** dialog box. -7. In the **Proxy Activate** dialog box click **Apply Confirmation ID, apply to selected machine(s) and activate**. -8. If you are activating products that require administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** checkbox. -9. Click **OK**. -10. VAMT displays the **Activating products** dialog box until it completes the requested action. If you selected the **Alternate Credentials** option, you will be prompted to enter the credentials. - - **Note**   - You can use proxy activation to select products that have different key types and activate the products at the same time. -  -  -  +--- +title: Perform Proxy Activation (Windows 10) +description: Perform Proxy Activation +ms.assetid: 35a919ed-f1cc-4d10-9c88-9bd634549dc3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Perform Proxy Activation + +You can use the Volume Activation Management Tool (VAMT) to perform activation for client computers that do not have Internet access. The client products can be installed with any type of product key that is eligible for proxy activation: Multiple activation Key (MAK), KMS Host key (CSVLK), or retail key. + +In a typical proxy-activation scenario, the VAMT host computer distributes a MAK to one or more client computers and collects the installation ID (IID) from each computer. The VAMT host computer sends the IIDs to Microsoft on behalf of the client computers and obtains the corresponding Confirmation IDs (CIDs). The VAMT host computer then installs the CIDs on the client computer to complete the activation. Using this activation method, only the VAMT host computer needs Internet access. + +**Note**   +For workgroups that are completely isolated from any larger network, you can still perform MAK, KMS Host key (CSVLK), or retail proxy activation. This requires installing a second instance of VAMT on a computer within the isolated group and using removable media to transfer activation data between that computer and another VAMT host computer that has Internet access. For more information about this scenario, see [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md). Similarly, you can proxy activate a KMS Host key (CSVLK) located in an isolated network. You can also proxy activate a KMS Host key (CSVLK) in the core network if you do not want the KMS host computer to connect to Microsoft over the Internet.  + +## Requirements + +Before performing proxy activation, ensure that your network and the VAMT installation meet the following requirements: +- There is an instance of VAMT that is installed on a computer that has Internet access. If you are performing proxy activation for an isolated workgroup, you also need to have VAMT installed on one of the computers in the workgroup. +- The products to be activated have been added to VAMT and are installed with a retail product key, a KMS Host key (CSVLK) or a MAK. If the products have not been installed with a proper product key, refer to the steps in the [Add and Remove a Product Key](add-remove-product-key-vamt.md) section for instructions on how to install a product key. +- VAMT has administrative permissions on all products to be activated and Windows Management Instrumentation (WMI) is accessible through the Windows firewall. +- For workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). +The product keys that are installed on the client products must have a sufficient number of remaining activations. If you are activating a MAK key, you can retrieve the remaining number of activations for that key by selecting the MAK in the product key list in the center pane and then clicking **Refresh product key data online** in the right-side pane. This retrieves the number of remaining activations for the MAK from Microsoft. Note that this step requires Internet access and that the remaining activation count can only be retrieved for MAKs. + +## To Perform Proxy Activation + +**To perform proxy activation** + +1. Open VAMT. +2. If necessary, install product keys. For more information see: + - [Install a Product Key](install-product-key-vamt.md) to install retail, MAK, or KMS Host key (CSVLK). + - [Install a KMS Client Key](install-kms-client-key-vamt.md) to install GVLK (KMS client) keys. +3. In the **Products** list in the center pane, select the individual products to be activated. You can use the **Filter** function to narrow your search for products by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the center pane. +6. In the right-side pane, click **Activate** and then click **Proxy activate** to open the **Proxy Activate** dialog box. +7. In the **Proxy Activate** dialog box click **Apply Confirmation ID, apply to selected machine(s) and activate**. +8. If you are activating products that require administrator credentials different from the ones you are currently using, select the **Use Alternate Credentials** checkbox. +9. Click **OK**. +10. VAMT displays the **Activating products** dialog box until it completes the requested action. If you selected the **Alternate Credentials** option, you will be prompted to enter the credentials. + + **Note**   + You can use proxy activation to select products that have different key types and activate the products at the same time. + + + diff --git a/windows/deployment/volume-activation/remove-products-vamt.md b/windows/deployment/volume-activation/remove-products-vamt.md index 719e036af3..65dd923d7e 100644 --- a/windows/deployment/volume-activation/remove-products-vamt.md +++ b/windows/deployment/volume-activation/remove-products-vamt.md @@ -1,32 +1,35 @@ ---- -title: Remove Products (Windows 10) -description: Remove Products -ms.assetid: 4d44379e-dda1-4a8f-8ebf-395b6c0dad8e -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Remove Products - -To remove one or more products from the Volume Activation Management Tool (VAMT), you can delete them from the product list view in the center pane. - -**To delete one or more products** -1. Click a product node in the left-side pane. -2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -4. Click **Filter**. VAMT displays the filtered list in the center pane. -5. Select the products you want to delete. -6. Click **Delete** in the **Selected Items** menu in the right-side pane. -7. On the **Confirm Delete Selected Products** dialog box, click **OK**. - -## Related topics -- [Add and Manage Products](add-manage-products-vamt.md) -  -  +--- +title: Remove Products (Windows 10) +description: Remove Products +ms.assetid: 4d44379e-dda1-4a8f-8ebf-395b6c0dad8e +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Remove Products + +To remove one or more products from the Volume Activation Management Tool (VAMT), you can delete them from the product list view in the center pane. + +**To delete one or more products** +1. Click a product node in the left-side pane. +2. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +3. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +4. Click **Filter**. VAMT displays the filtered list in the center pane. +5. Select the products you want to delete. +6. Click **Delete** in the **Selected Items** menu in the right-side pane. +7. On the **Confirm Delete Selected Products** dialog box, click **OK**. + +## Related topics +- [Add and Manage Products](add-manage-products-vamt.md) +  +  diff --git a/windows/deployment/volume-activation/scenario-kms-activation-vamt.md b/windows/deployment/volume-activation/scenario-kms-activation-vamt.md index 74bb58d089..34263037b3 100644 --- a/windows/deployment/volume-activation/scenario-kms-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-kms-activation-vamt.md @@ -1,45 +1,48 @@ ---- -title: Scenario 3 KMS Client Activation (Windows 10) -description: Scenario 3 KMS Client Activation -ms.assetid: 72b04e8f-cd35-490c-91ab-27ea799b05d0 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Scenario 3: KMS Client Activation - -In this scenario, you use the Volume Activation Management Tool (VAMT) to activate Key Management Service (KMS) client keys or Generic Volume License Keys (GVLKs). This can be performed on either Core Network or Isolated Lab computers. By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. You do not have to enter a key to activate a product as a GVLK, unless you are converting a MAK-activated product to a KMS activation. For more information, see [Install a KMS Client Key](install-kms-client-key-vamt.md). - -The procedure that is described below assumes the following: -- The KMS Service is enabled and available to all KMS clients. -- VAMT has been installed and computers have been added to the VAMT database. See Parts 1 through 4 in either [Scenario 1: Online Activation](scenario-online-activation-vamt.md) or [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) for more information. - -## Activate KMS Clients - -1. Open VAMT. -2. To set the KMS activation options, on the menu bar click **View**. Then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. -3. In the **Volume Activation Management Tool Preferences** dialog box, under **KMS Management Services host selection** select from the following options: - - **Find a KMS host automatically using DNS**. This is the default setting. VAMT will instruct the computer to query the Domain Name Service (DNS) to locate a KMS host and perform activation. If the client contains a registry key with a valid KMS host, that value will be used instead. - - **Find a KMS host using DNS in this domain for supported products**. Select this option if you use a specific domain, and enter the name of the domain. - - **Use specific KMS host**. Select this option for environments which do not use DNS for KMS host identification, and manually enter the KMS host name and select the KMS host port. VAMT will set the specified KMS host name and KMS host port on the target computer, and then instruct the computer to perform activation with the specific KMS host. -4. In the left-side pane, in the **Products** node, click the product that you want to activate. -5. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -6. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -7. Click **Filter**. VAMT displays the filtered list in the center pane. -8. Select the products that you want to activate. -9. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane, click **Activate**, point to **Volume activate**, and then click the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. -10. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - -The same status is shown under the **Status of Last Action** column in the products list view in the center pane. - -## Related topics -- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) -  -  +--- +title: Scenario 3 KMS Client Activation (Windows 10) +description: Scenario 3 KMS Client Activation +ms.assetid: 72b04e8f-cd35-490c-91ab-27ea799b05d0 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Scenario 3: KMS Client Activation + +In this scenario, you use the Volume Activation Management Tool (VAMT) to activate Key Management Service (KMS) client keys or Generic Volume License Keys (GVLKs). This can be performed on either Core Network or Isolated Lab computers. By default, volume license editions of Windows Vista, Windows® 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. GVLKs are already installed in volume license editions of these products. You do not have to enter a key to activate a product as a GVLK, unless you are converting a MAK-activated product to a KMS activation. For more information, see [Install a KMS Client Key](install-kms-client-key-vamt.md). + +The procedure that is described below assumes the following: +- The KMS Service is enabled and available to all KMS clients. +- VAMT has been installed and computers have been added to the VAMT database. See Parts 1 through 4 in either [Scenario 1: Online Activation](scenario-online-activation-vamt.md) or [Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) for more information. + +## Activate KMS Clients + +1. Open VAMT. +2. To set the KMS activation options, on the menu bar click **View**. Then click **Preferences** to open the **Volume Activation Management Tool Preferences** dialog box. +3. In the **Volume Activation Management Tool Preferences** dialog box, under **KMS Management Services host selection** select from the following options: + - **Find a KMS host automatically using DNS**. This is the default setting. VAMT will instruct the computer to query the Domain Name Service (DNS) to locate a KMS host and perform activation. If the client contains a registry key with a valid KMS host, that value will be used instead. + - **Find a KMS host using DNS in this domain for supported products**. Select this option if you use a specific domain, and enter the name of the domain. + - **Use specific KMS host**. Select this option for environments which do not use DNS for KMS host identification, and manually enter the KMS host name and select the KMS host port. VAMT will set the specified KMS host name and KMS host port on the target computer, and then instruct the computer to perform activation with the specific KMS host. +4. In the left-side pane, in the **Products** node, click the product that you want to activate. +5. In the products list view in the center pane, sort the list if necessary. You can use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +6. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by Product Name, Product Key Type, or License Status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +7. Click **Filter**. VAMT displays the filtered list in the center pane. +8. Select the products that you want to activate. +9. Click **Activate** in the **Selected Items** menu in the right-side **Actions** pane, click **Activate**, point to **Volume activate**, and then click the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. +10. VAMT displays the **Activating products** dialog box until it completes the requested action. When activation is complete, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + +The same status is shown under the **Status of Last Action** column in the products list view in the center pane. + +## Related topics +- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) +  +  diff --git a/windows/deployment/volume-activation/scenario-online-activation-vamt.md b/windows/deployment/volume-activation/scenario-online-activation-vamt.md index ba55442b69..865dbdf623 100644 --- a/windows/deployment/volume-activation/scenario-online-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-online-activation-vamt.md @@ -1,133 +1,136 @@ ---- -title: Scenario 1 Online Activation (Windows 10) -description: Scenario 1 Online Activation -ms.assetid: 94dba40e-383a-41e4-b74b-9e884facdfd3 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Scenario 1: Online Activation - -In this scenario, the Volume Activation Management Tool (VAMT) is deployed in the Core Network environment. VAMT is installed on a central computer that has network access to all of the client computers. Both the VAMT host and the client computers have Internet access. The following illustration shows a diagram of an online activation scenario for Multiple Activation Keys (MAKs). You can use this scenario for online activation of the following key types: -- Multiple Activation Key (MAK) -- Windows Key Management Service (KMS) keys: - - KMS Host key (CSVLK) - - Generic Volume License Key (GVLK), or KMS client key -- Retail -The Secure Zone represents higher-security Core Network computers that have additional firewall protection. - -![VAMT firewall configuration for multiple subnets](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) - -## In This Topic -- [Install and start VAMT on a networked host computer](#bkmk-partone) -- [Configure the Windows Management Instrumentation firewall exception on target computers](#bkmk-parttwo) -- [Connect to VAMT database](#bkmk-partthree) -- [Discover products](#bkmk-partfour) -- [Sort and filter the list of computers](#bkmk-partfive) -- [Collect status information from the computers in the list](#bkmk-partsix) -- [Add product keys and determine the remaining activation count](#bkmk-partseven) -- [Install the product keys](#bkmk-parteight) -- [Activate the client products](#bkmk-partnine) - -## Step 1: Install and start VAMT on a networked host computer - -1. Install VAMT on the host computer. -2. Click the VAMT icon in the **Start** menu to open VAMT. - -## Step 2: Configure the Windows Management Instrumentation firewall exception on target computers - -- Ensure that the Windows Management Instrumentation (WMI) firewall exception has been enabled for all target computers. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - - **Note**   - To retrieve product license status, VAMT must have administrative permissions on the remote computers and WMI must be available through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -## Step 3: Connect to a VAMT database - -1. If you are not already connected to a database, the **Database Connection Settings** dialog box appears when you open VAMT. Select the server and database where the keys that must be activated are located. -2. Click **Connect**. -3. If you are already connected to a database, VAMT displays an inventory of the products and product keys in the center pane, and a license overview of the computers in the database. If you need to connect to a different database, click **Successfully connected to Server** to open **the Database Connection Settings** dialog box. For more information about how to create VAMT databases and adding VAMT data, see [Manage VAMT Data](manage-vamt-data.md) - -## Step 4: Discover products - -1. In the left-side pane, in the **Products** node Products, click the product that you want to activate. -2. To open the **Discover Products** dialog box, click **Discover products** in the **Actions** menu in the right-side pane. -3. In the **Discover Products** dialog box, click **Search for computers in the Active Directory** to display the search options, and then click the search options that you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general Lightweight Directory Access Protocol (LDAP) query: - - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**. Then under **Domain Filter Criteria**, in the list of domain names click the name of the domain that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for specific computers in the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only those computer names that start with the letter "a". - - To search by individual computer name or IP address, click **Manually enter name or IP address**. Then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing. - - To search for computers in a workgroup, click **Search for computers in the workgroup**. Then under **Workgroup Filter Criteria**, in the list of workgroup names, click the name of the workgroup that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer in the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". - - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box that appears. VAMT will validate the LDAP query syntax, but will otherwise run the query without additional checks. -4. Click **Search**. - - When the search is complete, the products that VAMT discovers appear in the product list view in the center pane. - -## Step 5: Sort and filter the list of computers - -You can sort the list of products so that it is easier to find the computers that require product keys to be activated: -1. On the menu bar at the top of the center pane, click **Group by**, and then click **Product**, **Product Key Type**, or **License Status**. -2. To sort the list further, you can click one of the column headings to sort by that column. -3. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. -4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. - - To filter the list by computer name, enter a name in the **Computer Name** box. - - To filter the list by product name, product key type, or license status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. -5. Click **Filter**. VAMT displays the filtered list in the product list view in the center pane. - -## Step 6: Collect status information from the computers in the list - -To collect the status from select computers in the database, you can select computers in the product list view by using one of the following methods: -- To select a block of consecutively listed computers, click the first computer that you want to select, and then click the last computer while pressing the **Shift** key. -- To select computers which are not listed consecutively, hold down the **Ctrl** key and select each computer for which you want to collect the status information. -**To collect status information from the selected computers** -1. In the right-side **Actions** pane, click **Update license status** in the **Selected Items** menu and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials that are different from the ones that you used to log on to the computer. Otherwise, click **Current Credentials** and continue to step 2.If you are supplying alternate credentials, in the **Windows Security** dialog box, type the appropriate user name and password and then click **OK**. -2. VAMT displays the **Collecting product information** dialog box while it collects the license status of all supported products on the selected computers. When the process is finished, the updated license status of each product will appear in the product list view in the center pane. - - **Note**   - If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. - -## Step 7: Add product keys and determine the remaining activation count - -1. Click the **Product Keys** node in the left-side pane, and then click **Add Product Keys** in the right-side pane to open the **Add Product Keys** dialog box. -2. In the **Add Product Key** dialog box, you can select from one of the following methods to add product keys: - - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys, and then click **Add Key(s)**. - - To import a Comma Separated Values File (CSV) that contains a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. - - The keys that you have added appear in the **Product Keys** list view in the center pane. - - **Important**   - If you are activating many products with a MAK, refresh the activation count of the MAK to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and then click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. - -## Step 8: Install the product keys - -1. In the left-side pane, click the product that you want to install keys on to. -2. If necessary, sort and filter the list of products so that it is easier to find the computers that must have a product key installed. See [Step 5: Sort and filter the list of computers](#bkmk-partfive). -3. In the **Products** list view pane, select the individual products which must have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. -4. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. -5. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAKs based on the selected products. If you are installing a MAK you can select a recommended product key or any other MAK from the **All Product Keys List**. If you are not installing a MAK, select a product key from the **All Product Keys** list. Use the scroll bar if you want to view the **Description** for each key. When you have selected the product key that you want to install, click **Install Key**. Note that only one key can be installed at a time. -6. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. - - The same status appears under the **Status of Last Action** column in the product list view in the center pane. - **Note**   - - Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct product key, see [How to Choose the Right Volume License Key for Windows.](https://go.microsoft.com/fwlink/p/?linkid=238382) - -## Step 9: Activate the client products - -1. Select the individual products that you want to activate in the list-view pane. -2. On the menu bar, click **Action**, point to **Activate** and point to **Online activate**. You can also right-click the selected computers(s) to display the **Action** menu, point to **Activate** and point to **Online activate**. You can also click **Activate** in the **Selected Items** menu in the right-hand pane to access the **Activate** option. -3. If you are activating product keys using your current credential, click **Current credential** and continue to step 5. If you are activating products that require an administrator credential that is different from the one you are currently using, click the **Alternate credential** option. -4. Enter your alternate user name and password and click **OK**. -5. The **Activate** option contacts the Microsoft product-activation server over the Internet and requests activation for the selected products. VAMT displays the **Activating products** dialog box until the requested actions are completed. - - **Note**   - Installing a MAK and overwriting the GVLK on client products must be done with care. If the RTM version of Windows Vista has been installed on the computer for more than 30 days, then its initial grace period has expired. As a result, it will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are available on the network. - - RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and volume editions of Office 2010 will not enter RFM. - -## Related topics -- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) -  -  +--- +title: Scenario 1 Online Activation (Windows 10) +description: Scenario 1 Online Activation +ms.assetid: 94dba40e-383a-41e4-b74b-9e884facdfd3 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Scenario 1: Online Activation + +In this scenario, the Volume Activation Management Tool (VAMT) is deployed in the Core Network environment. VAMT is installed on a central computer that has network access to all of the client computers. Both the VAMT host and the client computers have Internet access. The following illustration shows a diagram of an online activation scenario for Multiple Activation Keys (MAKs). You can use this scenario for online activation of the following key types: +- Multiple Activation Key (MAK) +- Windows Key Management Service (KMS) keys: + - KMS Host key (CSVLK) + - Generic Volume License Key (GVLK), or KMS client key +- Retail +The Secure Zone represents higher-security Core Network computers that have additional firewall protection. + +![VAMT firewall configuration for multiple subnets](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) + +## In This Topic +- [Install and start VAMT on a networked host computer](#bkmk-partone) +- [Configure the Windows Management Instrumentation firewall exception on target computers](#bkmk-parttwo) +- [Connect to VAMT database](#bkmk-partthree) +- [Discover products](#bkmk-partfour) +- [Sort and filter the list of computers](#bkmk-partfive) +- [Collect status information from the computers in the list](#bkmk-partsix) +- [Add product keys and determine the remaining activation count](#bkmk-partseven) +- [Install the product keys](#bkmk-parteight) +- [Activate the client products](#bkmk-partnine) + +## Step 1: Install and start VAMT on a networked host computer + +1. Install VAMT on the host computer. +2. Click the VAMT icon in the **Start** menu to open VAMT. + +## Step 2: Configure the Windows Management Instrumentation firewall exception on target computers + +- Ensure that the Windows Management Instrumentation (WMI) firewall exception has been enabled for all target computers. For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + + **Note**   + To retrieve product license status, VAMT must have administrative permissions on the remote computers and WMI must be available through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +## Step 3: Connect to a VAMT database + +1. If you are not already connected to a database, the **Database Connection Settings** dialog box appears when you open VAMT. Select the server and database where the keys that must be activated are located. +2. Click **Connect**. +3. If you are already connected to a database, VAMT displays an inventory of the products and product keys in the center pane, and a license overview of the computers in the database. If you need to connect to a different database, click **Successfully connected to Server** to open **the Database Connection Settings** dialog box. For more information about how to create VAMT databases and adding VAMT data, see [Manage VAMT Data](manage-vamt-data.md) + +## Step 4: Discover products + +1. In the left-side pane, in the **Products** node Products, click the product that you want to activate. +2. To open the **Discover Products** dialog box, click **Discover products** in the **Actions** menu in the right-side pane. +3. In the **Discover Products** dialog box, click **Search for computers in the Active Directory** to display the search options, and then click the search options that you want to use. You can search for computers in an Active Directory domain, by individual computer name or IP address, in a workgroup, or by a general Lightweight Directory Access Protocol (LDAP) query: + - To search for computers in an Active Directory domain, click **Search for computers in the Active Directory**. Then under **Domain Filter Criteria**, in the list of domain names click the name of the domain that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for specific computers in the domain. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only those computer names that start with the letter "a". + - To search by individual computer name or IP address, click **Manually enter name or IP address**. Then enter the full name or IP address in the **One or more computer names or IP addresses separated by commas** text box. Separate multiple entries with a comma. Note that VAMT supports both IPv4 and IPV6 addressing. + - To search for computers in a workgroup, click **Search for computers in the workgroup**. Then under **Workgroup Filter Criteria**, in the list of workgroup names, click the name of the workgroup that you want to search. You can narrow the search further by typing a name in the **Filter by computer name** field to search for a specific computer in the workgroup. This filter supports the asterisk (\*) wildcard. For example, typing "a\*" will display only computer names that start with the letter "a". + - To search for computers by using a general LDAP query, click **Search with LDAP query** and enter your query in the text box that appears. VAMT will validate the LDAP query syntax, but will otherwise run the query without additional checks. +4. Click **Search**. + + When the search is complete, the products that VAMT discovers appear in the product list view in the center pane. + +## Step 5: Sort and filter the list of computers + +You can sort the list of products so that it is easier to find the computers that require product keys to be activated: +1. On the menu bar at the top of the center pane, click **Group by**, and then click **Product**, **Product Key Type**, or **License Status**. +2. To sort the list further, you can click one of the column headings to sort by that column. +3. You can also use the **Filter** function to narrow your search for computers by clicking **Filter** in the right-side pane to open the **Filter Products** dialog box. +4. In the **Filter Products** dialog box, you can filter the list by computer name, product name, product key type, license status, or by any combination of these options. + - To filter the list by computer name, enter a name in the **Computer Name** box. + - To filter the list by product name, product key type, or license status, click the list you want to use for the filter and select an option. If necessary, click **clear all filters** to create a new filter. +5. Click **Filter**. VAMT displays the filtered list in the product list view in the center pane. + +## Step 6: Collect status information from the computers in the list + +To collect the status from select computers in the database, you can select computers in the product list view by using one of the following methods: +- To select a block of consecutively listed computers, click the first computer that you want to select, and then click the last computer while pressing the **Shift** key. +- To select computers which are not listed consecutively, hold down the **Ctrl** key and select each computer for which you want to collect the status information. + **To collect status information from the selected computers** +- In the right-side **Actions** pane, click **Update license status** in the **Selected Items** menu and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials that are different from the ones that you used to log on to the computer. Otherwise, click **Current Credentials** and continue to step 2.If you are supplying alternate credentials, in the **Windows Security** dialog box, type the appropriate user name and password and then click **OK**. +- VAMT displays the **Collecting product information** dialog box while it collects the license status of all supported products on the selected computers. When the process is finished, the updated license status of each product will appear in the product list view in the center pane. + + **Note** + If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. + +## Step 7: Add product keys and determine the remaining activation count + +1. Click the **Product Keys** node in the left-side pane, and then click **Add Product Keys** in the right-side pane to open the **Add Product Keys** dialog box. +2. In the **Add Product Key** dialog box, you can select from one of the following methods to add product keys: + - To add product keys manually, click **Enter product key(s) separated by line breaks**, enter one or more product keys, and then click **Add Key(s)**. + - To import a Comma Separated Values File (CSV) that contains a list of product keys, click **Select a product key file to import**, browse to the file location, click **Open** to import the file, and then click **Add Key(s)**. + + The keys that you have added appear in the **Product Keys** list view in the center pane. + + **Important**   + If you are activating many products with a MAK, refresh the activation count of the MAK to ensure that the MAK can support the required number of activations. In the product key list in the center pane, select the MAK and then click **Refresh product key data online** in the right-side pane to contact Microsoft and retrieve the number of remaining activations for the MAK. This step requires Internet access. You can only retrieve the remaining activation count for MAKs. + +## Step 8: Install the product keys + +1. In the left-side pane, click the product that you want to install keys on to. +2. If necessary, sort and filter the list of products so that it is easier to find the computers that must have a product key installed. See [Step 5: Sort and filter the list of computers](#bkmk-partfive). +3. In the **Products** list view pane, select the individual products which must have keys installed. You can use the **CTRL** key or the **SHIFT** key to select more than one product. +4. Click **Install product key** in the **Selected Items** menu in the right-side pane to display the **Install Product Key** dialog box. +5. The **Select Product Key** dialog box displays the keys that are available to be installed. Under **Recommended MAKs**, VAMT might display one or more recommended MAKs based on the selected products. If you are installing a MAK you can select a recommended product key or any other MAK from the **All Product Keys List**. If you are not installing a MAK, select a product key from the **All Product Keys** list. Use the scroll bar if you want to view the **Description** for each key. When you have selected the product key that you want to install, click **Install Key**. Note that only one key can be installed at a time. +6. VAMT displays the **Installing product key** dialog box while it attempts to install the product key for the selected products. When the process is finished, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + + The same status appears under the **Status of Last Action** column in the product list view in the center pane. + **Note**   + + Product key installation will fail if VAMT finds mismatched key types or editions. VAMT will display the failure status and will continue the installation for the next product in the list. For more information on choosing the correct product key, see [How to Choose the Right Volume License Key for Windows.](https://go.microsoft.com/fwlink/p/?linkid=238382) + +## Step 9: Activate the client products + +1. Select the individual products that you want to activate in the list-view pane. +2. On the menu bar, click **Action**, point to **Activate** and point to **Online activate**. You can also right-click the selected computers(s) to display the **Action** menu, point to **Activate** and point to **Online activate**. You can also click **Activate** in the **Selected Items** menu in the right-hand pane to access the **Activate** option. +3. If you are activating product keys using your current credential, click **Current credential** and continue to step 5. If you are activating products that require an administrator credential that is different from the one you are currently using, click the **Alternate credential** option. +4. Enter your alternate user name and password and click **OK**. +5. The **Activate** option contacts the Microsoft product-activation server over the Internet and requests activation for the selected products. VAMT displays the **Activating products** dialog box until the requested actions are completed. + + **Note**   + Installing a MAK and overwriting the GVLK on client products must be done with care. If the RTM version of Windows Vista has been installed on the computer for more than 30 days, then its initial grace period has expired. As a result, it will enter Reduced Functionality Mode (RFM) if online activation is not completed successfully before the next logon attempt. However, you can use online activation to recover properly configured computers from RFM, as long as the computers are available on the network. + + RFM only applies to the RTM version of Windows Vista or the retail editions of Microsoft Office 2010. Windows Vista with SP1 or later, Windows 7, Windows 8, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, and volume editions of Office 2010 will not enter RFM. + +## Related topics +- [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) + + diff --git a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md index e83331d22e..3c52c27790 100644 --- a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md @@ -2,11 +2,15 @@ title: Scenario 2 Proxy Activation (Windows 10) description: Scenario 2 Proxy Activation ms.assetid: ed5a8a56-d9aa-4895-918f-dd1898cb2c1a +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: jdeckerms +audience: itpro +author: greg-lindsay ms.date: 04/25/2017 ms.topic: article --- @@ -65,14 +69,14 @@ You can sort the list of products so that it is easier to find the computers tha ## Step 6: Collect Status Information from the Computers in the Isolated Lab To collect the status from select computers in the database, you can select computers in the product list view by using one of the following methods: -- To select a block of consecutively listed computers, click the first computer that you want to select, and then click the last computer while pressing the **Shift** key. -- To select computers which are not listed consecutively, hold down the **Ctrl** ley and select each computer for which you want to collect the status information. -**To collect status information from the selected computers** -1. In the right-side **Actions** pane, click **Update license status** in the **Selected Items** menu and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials that are different from the ones that you used to log on to the computer. Otherwise, click **Current Credentials** and continue to step 2.If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and then click **OK**. -2. VAMT displays the **Collecting product information** dialog box while it collects the license status of all supported products on the selected computers. When the process is finished, the updated license status of each product will appear in the product list view in the center pane. +- To select a block of consecutively listed computers, click the first computer that you want to select, and then click the last computer while pressing the **Shift** key. +- To select computers which are not listed consecutively, hold down the **Ctrl** ley and select each computer for which you want to collect the status information. + **To collect status information from the selected computers** +- In the right-side **Actions** pane, click **Update license status** in the **Selected Items** menu and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials that are different from the ones that you used to log on to the computer. Otherwise, click **Current Credentials** and continue to step 2.If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and then click **OK**. +- VAMT displays the **Collecting product information** dialog box while it collects the license status of all supported products on the selected computers. When the process is finished, the updated license status of each product will appear in the product list view in the center pane. - **Note**   - If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. + **Note** + If a computer has more than one supported product installed, VAMT adds an entry for each product. The entry appears under the appropriate product heading. ## Step 7: Add Product Keys @@ -140,7 +144,7 @@ In this step, you export VAMT from the workgroup’s host computer and save it i 1. Select the products to which you want to apply CIDs. If needed, sort and filter the list to find the products. 2. In the right-side **Selected Items** menu, click **Activate**, click **Apply Confirmation ID**, and then select the appropriate credential option. If you click the **Alternate Credentials** option, you will be prompted to enter an alternate user name and password. - VAMT displays the **Applying Confirmation Id** dialog box while it installs the CIDs on the selected products. When VAMT finishes installing the CIDs, the status appears in the **Action Sataus** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. + VAMT displays the **Applying Confirmation Id** dialog box while it installs the CIDs on the selected products. When VAMT finishes installing the CIDs, the status appears in the **Action Status** column of the dialog box. Click **Close** to close the dialog box. You can also click the **Automatically close when done** check box when the dialog box appears. The same status appears under the **Status of Last Action** column in the product list view in the center pane. ## Step 13: (Optional) Reactivating Reimaged Computers in the Isolated Lab @@ -163,5 +167,5 @@ If you have captured new images of the computers in the isolated lab, but the un ## Related topics - [VAMT Step-by-Step Scenarios](vamt-step-by-step.md) -  -  + + diff --git a/windows/deployment/volume-activation/update-product-status-vamt.md b/windows/deployment/volume-activation/update-product-status-vamt.md index a114a8e286..038839adb4 100644 --- a/windows/deployment/volume-activation/update-product-status-vamt.md +++ b/windows/deployment/volume-activation/update-product-status-vamt.md @@ -1,35 +1,38 @@ ---- -title: Update Product Status (Windows 10) -description: Update Product Status -ms.assetid: 39d4abd4-801a-4e8f-9b8c-425a24a96764 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# Update Product Status - -After you add computers to the VAMT database, you need to use the **Update license status** function to add the products that are installed on the computers. You can also use the **Update license status** at any time to retrieve the most current license status for any products in the VAMT database. -To retrieve license status, VAMT must have administrative permissions on all selected computers and Windows Management Instrumentation (WMI) must be accessible through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). - -**Note**   -The license-status query requires a valid computer name for each system queried. If the VAMT database contains computers that were added without Personally Identifiable Information, computer names will not be available for those computers, and the status for these computers will not be updated. - -## Update the license status of a product - -1. Open VAMT. -2. In the **Products** list, select one or more products that need to have their status updated. -3. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. -4. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. - - VAMT displays the **Collecting product information** dialog box while it collects the status of all selected products. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. - - **Note**   - If a previously discovered Microsoft Office 2010 product has been uninstalled from the remote computer, updating its licensing status will cause the entry to be deleted from the **Office** product list view, and, consequently, the total number of discovered products will be smaller. However, the Windows installation of the same computer will not be deleted and will always be shown in the **Windows** products list view. -  -## Related topics -- [Add and Manage Products](add-manage-products-vamt.md) +--- +title: Update Product Status (Windows 10) +description: Update Product Status +ms.assetid: 39d4abd4-801a-4e8f-9b8c-425a24a96764 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# Update Product Status + +After you add computers to the VAMT database, you need to use the **Update license status** function to add the products that are installed on the computers. You can also use the **Update license status** at any time to retrieve the most current license status for any products in the VAMT database. +To retrieve license status, VAMT must have administrative permissions on all selected computers and Windows Management Instrumentation (WMI) must be accessible through the Windows Firewall. In addition, for workgroup computers, a registry key must be created to enable remote administrative actions under User Account Control (UAC). For more information, see [Configure Client Computers](configure-client-computers-vamt.md). + +**Note**   +The license-status query requires a valid computer name for each system queried. If the VAMT database contains computers that were added without Personally Identifiable Information, computer names will not be available for those computers, and the status for these computers will not be updated. + +## Update the license status of a product + +1. Open VAMT. +2. In the **Products** list, select one or more products that need to have their status updated. +3. In the right-side **Actions** pane, click **Update license status** and then click a credential option. Choose **Alternate Credentials** only if you are updating products that require administrator credentials different from the ones you used to log into the computer. +4. If you are supplying alternate credentials, in the **Windows Security** dialog box type the appropriate user name and password and click **OK**. + + VAMT displays the **Collecting product information** dialog box while it collects the status of all selected products. When the process is finished, the updated licensing status of each product will appear in the product list view in the center pane. + + **Note**   + If a previously discovered Microsoft Office 2010 product has been uninstalled from the remote computer, updating its licensing status will cause the entry to be deleted from the **Office** product list view, and, consequently, the total number of discovered products will be smaller. However, the Windows installation of the same computer will not be deleted and will always be shown in the **Windows** products list view. + +## Related topics +- [Add and Manage Products](add-manage-products-vamt.md) diff --git a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md index 68c4c3cd66..07047dd903 100644 --- a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md +++ b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md @@ -1,13 +1,17 @@ --- title: Use the Volume Activation Management Tool (Windows 10) -description: The Volume Activation Management Tool (VAMT) provides several useful features, including the ability to perform VAMT proxy activation and to track and monitor several types of product keys. +description: The Volume Activation Management Tool (VAMT) provides several useful features, including the ability to track and monitor several types of product keys. ms.assetid: b11f0aee-7b60-44d1-be40-c960fc6c4c47 +ms.reviewer: +manager: laurawi +ms.author: greglin keywords: vamt, volume activation, activation, windows activation ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: jdeckerms +audience: itpro +author: greg-lindsay ms.localizationpriority: medium ms.date: 07/27/2017 ms.topic: article diff --git a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md index 521f5ee32b..e54f6338f1 100644 --- a/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md +++ b/windows/deployment/volume-activation/use-vamt-in-windows-powershell.md @@ -2,11 +2,15 @@ title: Use VAMT in Windows PowerShell (Windows 10) description: Use VAMT in Windows PowerShell ms.assetid: 13e0ceec-d827-4681-a5c3-8704349e3ba9 +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: jdeckerms +audience: itpro +author: greg-lindsay ms.date: 04/25/2017 ms.topic: article --- @@ -15,37 +19,37 @@ ms.topic: article The Volume Activation Management Tool (VAMT) PowerShell cmdlets can be used to perform the same functions as the Vamt.exe command-line tool. **To install PowerShell 3.0** -- VAMT PowerShell cmdlets require Windows PowerShell, which is included in Windows 10, Windows 8 and Windows Server® 2012. You can download PowerShell for Windows 7 or other operating systems from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=218356). -**To install the Windows Assessment and Deployment Kit** -- In addition to PowerShell, you must import the VAMT PowerShell module. The module is included in the VAMT 3.0 folder after you install the Windows Assessment and Deployment Kit (Windows ADK). -**To prepare the VAMT PowerShell environment** -1. To open PowerShell with administrative credentials, click **Start** and type “PowerShell” to locate the program. Right-click **Windows PowerShell**, and then click **Run as administrator**. To open PowerShell in Windows 7, click **Start**, click **All Programs**, click **Accessories**, click **Windows PowerShell**, right-click **Windows PowerShell**, and then click **Run as administrator**. +- VAMT PowerShell cmdlets require Windows PowerShell, which is included in Windows 10, Windows 8 and Windows Server® 2012. You can download PowerShell for Windows 7 or other operating systems from the [Microsoft Download Center](https://go.microsoft.com/fwlink/p/?LinkId=218356). + **To install the Windows Assessment and Deployment Kit** +- In addition to PowerShell, you must import the VAMT PowerShell module. The module is included in the VAMT 3.0 folder after you install the Windows Assessment and Deployment Kit (Windows ADK). + **To prepare the VAMT PowerShell environment** +- To open PowerShell with administrative credentials, click **Start** and type “PowerShell” to locate the program. Right-click **Windows PowerShell**, and then click **Run as administrator**. To open PowerShell in Windows 7, click **Start**, click **All Programs**, click **Accessories**, click **Windows PowerShell**, right-click **Windows PowerShell**, and then click **Run as administrator**. - **Important**   - If you are using a computer that has an 64-bit processor, select **Windows PowerShell (x86)**. VAMT PowerShell cmdlets are supported for the x86 architecture only. You must use an x86 version of Windows PowerShell to import the VAMT module, which are available in these directories: - - The x86 version of PowerShell is available in C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe - - The x86 version of the PowerShell ISE is available in C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell\_ise.exe -2. For all supported operating systems you can use the VAMT PowerShell module included with the Windows ADK. By default, the module is installed with the Windows ADK in the VAMT folder. Change directories to the directory where VAMT is located. + **Important** + If you are using a computer that has an 64-bit processor, select **Windows PowerShell (x86)**. VAMT PowerShell cmdlets are supported for the x86 architecture only. You must use an x86 version of Windows PowerShell to import the VAMT module, which are available in these directories: + - The x86 version of PowerShell is available in C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe + - The x86 version of the PowerShell ISE is available in C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell\_ise.exe +- For all supported operating systems you can use the VAMT PowerShell module included with the Windows ADK. By default, the module is installed with the Windows ADK in the VAMT folder. Change directories to the directory where VAMT is located. - For example, if the Windows ADK is installed in the default location of `C:\Program Files(x86)\Windows Kits\10`, type: + For example, if the Windows ADK is installed in the default location of `C:\Program Files(x86)\Windows Kits\10`, type: - ``` ps1 - cd “C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\VAMT 3.0” - ``` -3. Import the VAMT PowerShell module. To import the module, type the following at a command prompt: - ``` syntax - Import-Module .\VAMT.psd1 - ``` - Where **Import-Module** imports a module only into the current session. To import the module into all sessions, add an **Import-Module** command to a Windows PowerShell profile. For more information about profiles, type `get-help about_profiles`. + ``` powershell + cd “C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\VAMT 3.0” + ``` +- Import the VAMT PowerShell module. To import the module, type the following at a command prompt: + ``` powershell + Import-Module .\VAMT.psd1 + ``` + Where **Import-Module** imports a module only into the current session. To import the module into all sessions, add an **Import-Module** command to a Windows PowerShell profile. For more information about profiles, type `get-help about_profiles`. ## To Get Help for VAMT PowerShell cmdlets You can view all of the help sections for a VAMT PowerShell cmdlet, or you can view only the section that you are interested in. To view all of the Help content for a VAMT cmdlet, type: -``` ps1 +``` powershell get-help -all ``` For example, type: -``` ps1 +``` powershell get-help get-VamtProduct -all ``` @@ -54,19 +58,19 @@ The update-help cmdlet is not supported for VAMT PowerShell cmdlets. To view onl **To view VAMT PowerShell Help sections** -1. To get the syntax to use with a cmdlet, type the following at a command prompt: - ``` ps1 - get-help - ``` - For example, type: - ``` ps1 - get-help get-VamtProduct - ``` -2. To see examples using a cmdlet, type: - ``` ps1 - get-help -examples - ``` - For example, type: - ``` ps1 - get-help get-VamtProduct -examples - ``` +1. To get the syntax to use with a cmdlet, type the following at a command prompt: + ``` powershell + get-help + ``` + For example, type: + ``` powershell + get-help get-VamtProduct + ``` +2. To see examples using a cmdlet, type: + ``` powershell + get-help -examples + ``` + For example, type: + ``` powershell + get-help get-VamtProduct -examples + ``` diff --git a/windows/deployment/volume-activation/vamt-known-issues.md b/windows/deployment/volume-activation/vamt-known-issues.md index 19ce9dbba1..2259c02d2f 100644 --- a/windows/deployment/volume-activation/vamt-known-issues.md +++ b/windows/deployment/volume-activation/vamt-known-issues.md @@ -1,22 +1,63 @@ --- -title: VAMT Known Issues (Windows 10) -description: VAMT Known Issues +title: VAMT known issues (Windows 10) +description: Volume Activation Management Tool (VAMT) known issues ms.assetid: 8992f1f3-830a-4ce7-a248-f3a6377ab77f +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 +audience: itpro +author: greg-lindsay +ms.date: 12/17/2019 ms.topic: article +ms.custom: +- CI 111496 +- CSSTroubleshooting --- -# VAMT Known Issues +# VAMT known issues -The following list contains the current known issues with the Volume Activation Management Tool (VAMT) 3.0. -- The VAMT Windows Management Infrastructure (WMI) remote operations may take longer to execute if the target computer is in a sleep or standby state. -- Recovery of Non-Genuine computers is a two-step process. VAMT can be used to install a new product key and activate the computer. However, the computer itself must visit the [Windows Genuine Advantage](https://go.microsoft.com/fwlink/p/?linkid=182914) Web site to revalidate the computer's Genuine status. Upon successfully completing this step, the computer will be restored to full functionality. For more information on recovering Non-Genuine Windows computers, go to [Windows Volume Activation](https://go.microsoft.com/fwlink/p/?linkid=184668). -- When opening a Computer Information List (.cil file) saved in a previous version of VAMT, the edition information is not shown for each product in the center pane. Users must update the product status again to obtain the edition information. -- The remaining activation count can only be retrieved for MAKs. -  -  +The current known issues with the Volume Activation Management Tool (VAMT), versions 3.0. and 3.1, include: + +- VAMT Windows Management Infrastructure (WMI) remote operations might take longer to execute if the target computer is in a sleep or standby state. +- When you open a Computer Information List (CIL) file that was saved by using a previous version of VAMT, the edition information is not shown for each product in the center pane. You must update the product status again to obtain the edition information. +- The remaining activation count can only be retrieved for Multiple Activation Key (MAKs). + +## Workarounds for adding CSVLKs for Windows 10 activation to VAMT 3.1 + +Another known issue is that when you try to add a Windows 10 Key Management Service (KMS) Host key (CSVLK) or a Windows Server 2012 R2 for Windows 10 CSVLK into VAMT 3.1 (version 10.0.10240.0), you receive the error message shown here. + +![VAMT error message](./images/vamt-known-issue-message.png) + +This issue occurs because VAMT 3.1 does not contain the correct Pkconfig files to recognize this kind of key. To work around this issue, use one of the following methods. + +### Method 1 + +Do not add the CSVLK to the VAMT 3.1 tool. Instead, use the **slmgr.vbs /ipk \<*CSVLK*>** command to install a CSVLK on a KMS host. In this command, \<*CSVLK*> represents the specific key that you want to install. For more information about how to use the Slmgr.vbs tool, see [Slmgr.vbs options for obtaining volume activation information](https://docs.microsoft.com/windows-server/get-started/activation-slmgr-vbs-options). + +### Method 2 + +On the KMS host computer, perform the following steps: + +1. Download the hotfix from [July 2016 update rollup for Windows 8.1 and Windows Server 2012 R2](https://support.microsoft.com/help/3172614/). + +1. In Windows Explorer, right-click **485392_intl_x64_zip** and extract the hotfix to C:\KB3058168. + +1. To extract the contents of the update, run the following command: + + ```cmd + expand c:\KB3058168\Windows8.1-KB3058168-x64.msu -f:* C:\KB3058168\ + ``` + +1. To extract the contents of Windows8.1-KB3058168-x64.cab, run the following command: + + ```cmd + expand c:\KB3058168\Windows8.1-KB3058168-x64.cab -f:pkeyconfig-csvlk.xrm-ms c:\KB3058168 + ``` + +1. In the C:\KB3058168\x86_microsoft-windows-s..nent-sku-csvlk-pack_31bf3856ad364e35_6.3.9600.17815_none_bd26b4f34d049716 folder, copy the pkeyconfig-csvlk.xrm-ms file. Paste this file into the C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\VAMT3\pkconfig folder. + +1. Restart VAMT. diff --git a/windows/deployment/volume-activation/vamt-requirements.md b/windows/deployment/volume-activation/vamt-requirements.md index 553111ae6f..e9c0da934f 100644 --- a/windows/deployment/volume-activation/vamt-requirements.md +++ b/windows/deployment/volume-activation/vamt-requirements.md @@ -1,44 +1,46 @@ ---- -title: VAMT Requirements (Windows 10) -description: VAMT Requirements -ms.assetid: d14d152b-ab8a-43cb-a8fd-2279364007b9 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# VAMT Requirements - -This topic includes info about the product key and system requirements for VAMT. - -## Product Key Requirements - -The Volume Activation Management Tool (VAMT) can be used to perform activations using any of the following types of product keys. - -|Product key type |Where to obtain | -|-----------------|----------------| -|

                                  • Multiple Activation Key (MAK)
                                  • Key Management Service (KMS) host key (CSVLK)
                                  • KMS client setup keys (GVLK)
                                  |Volume licensing keys can only be obtained with a signed contract from Microsoft. For more info, see the [Microsoft Volume Licensing portal](https://go.microsoft.com/fwlink/p/?LinkId=227282). | -|Retail product keys |Obtained at time of product purchase. | - -## System Requirements - -The following table lists the system requirements for the VAMT host computer. - -|Item |Minimum system requirement | -|-----|---------------------------| -|Computer and Processor |1 GHz x86 or x64 processor | -|Memory |1 GB RAM for x86 or 2 GB RAM for x64 | -|Hard Disk |16 GB available hard disk space for x86 or 20 GB for x64 | -|External Drive|Removable media (Optional) | -|Display |1024x768 or higher resolution monitor | -|Network |Connectivity to remote computers via Windows® Management Instrumentation (TCP/IP) and Microsoft® Activation Web Service on the Internet via HTTPS | -|Operating System |Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, or Windows Server 2012. | -|Additional Requirements |
                                  • Connection to a SQL Server database. For more info, see [Install VAMT](install-vamt.md).
                                  • PowerShell 3.0: For Windows 8, Windows 8.1, Windows 10, and Windows Server® 2012, PowerShell is included in the installation. For previous versions of Windows and -Windows Server, you must download PowerShell 3.0. To download PowerShell, go to [Download Windows PowerShell 3.0](https://go.microsoft.com/fwlink/p/?LinkId=218356).
                                  • If installing on Windows Server 2008 R2, you must also install .NET Framework 3.51.
                                  | - -## Related topics -- [Install and Configure VAMT](install-configure-vamt.md) +--- +title: VAMT Requirements (Windows 10) +description: VAMT Requirements +ms.assetid: d14d152b-ab8a-43cb-a8fd-2279364007b9 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# VAMT Requirements + +This topic includes info about the product key and system requirements for VAMT. + +## Product Key Requirements + +The Volume Activation Management Tool (VAMT) can be used to perform activations using any of the following types of product keys. + +|Product key type |Where to obtain | +|-----------------|----------------| +|
                                  • Multiple Activation Key (MAK)
                                  • Key Management Service (KMS) host key (CSVLK)
                                  • KMS client setup keys (GVLK)
                                  |Volume licensing keys can only be obtained with a signed contract from Microsoft. For more info, see the [Microsoft Volume Licensing portal](https://go.microsoft.com/fwlink/p/?LinkId=227282). | +|Retail product keys |Obtained at time of product purchase. | + +## System Requirements + +The following table lists the system requirements for the VAMT host computer. + +| Item | Minimum system requirement | +| ---- | ---------------------------| +| Computer and Processor | 1 GHz x86 or x64 processor | +| Memory | 1 GB RAM for x86 or 2 GB RAM for x64 | +| Hard Disk | 16 GB available hard disk space for x86 or 20 GB for x64 | +| External Drive | Removable media (Optional) | +| Display | 1024x768 or higher resolution monitor | +| Network | Connectivity to remote computers via Windows Management Instrumentation (TCP/IP) and Microsoft Activation Web Service on the Internet via HTTPS | +| Operating System | Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012, or later. | +| Additional Requirements |
                                  • Connection to a SQL Server database. For more info, see [Install VAMT](install-vamt.md).
                                  • PowerShell 3.0: For Windows 8, Windows 8.1, Windows 10, and Windows Server 2012, PowerShell is included in the installation. For previous versions of Windows and Windows Server, you must download PowerShell 3.0. To download PowerShell, go to [Download Windows PowerShell 3.0](https://go.microsoft.com/fwlink/p/?LinkId=218356).
                                  • If installing on Windows Server 2008 R2, you must also install .NET Framework 3.51.
                                  | + +## Related topics +- [Install and Configure VAMT](install-configure-vamt.md) diff --git a/windows/deployment/volume-activation/vamt-step-by-step.md b/windows/deployment/volume-activation/vamt-step-by-step.md index f057e3302e..ae1576bb5f 100644 --- a/windows/deployment/volume-activation/vamt-step-by-step.md +++ b/windows/deployment/volume-activation/vamt-step-by-step.md @@ -1,29 +1,32 @@ ---- -title: VAMT Step-by-Step Scenarios (Windows 10) -description: VAMT Step-by-Step Scenarios -ms.assetid: 455c542c-4860-4b57-a1f0-7e2d28e11a10 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.date: 04/25/2017 -ms.topic: article ---- - -# VAMT Step-by-Step Scenarios - -This section provides step-by-step instructions on implementing the Volume Activation Management Tool (VAMT) in typical environments. VAMT supports many common scenarios; the scenarios in this section describe some of the most common to get you started. - -## In this Section - -|Topic |Description | -|------|------------| -|[Scenario 1: Online Activation](scenario-online-activation-vamt.md) |Describes how to distribute Multiple Activation Keys (MAKs) to products installed on one or more connected computers within a network, and how to instruct these products to contact Microsoft over the Internet for activation. | -|[Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) |Describes how to use two VAMT host computers — the first one with Internet access and a second computer within an isolated workgroup — as proxies to perform MAK volume activation for workgroup computers that do not have Internet access. | -|[Scenario 3: KMS Client Activation](scenario-kms-activation-vamt.md) |Describes how to use VAMT to configure client products for Key Management Service (KMS) activation. By default, volume license editions of Windows 10, Windows Vista, Windows® 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, or Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. | - -## Related topics -- [Introduction to VAMT](introduction-vamt.md) -  -  +--- +title: VAMT Step-by-Step Scenarios (Windows 10) +description: VAMT Step-by-Step Scenarios +ms.assetid: 455c542c-4860-4b57-a1f0-7e2d28e11a10 +ms.reviewer: +manager: laurawi +ms.author: greglin +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro author: greg-lindsay +ms.date: 04/25/2017 +ms.topic: article +--- + +# VAMT Step-by-Step Scenarios + +This section provides step-by-step instructions on implementing the Volume Activation Management Tool (VAMT) in typical environments. VAMT supports many common scenarios; the scenarios in this section describe some of the most common to get you started. + +## In this Section + +|Topic |Description | +|------|------------| +|[Scenario 1: Online Activation](scenario-online-activation-vamt.md) |Describes how to distribute Multiple Activation Keys (MAKs) to products installed on one or more connected computers within a network, and how to instruct these products to contact Microsoft over the Internet for activation. | +|[Scenario 2: Proxy Activation](scenario-proxy-activation-vamt.md) |Describes how to use two VAMT host computers — the first one with Internet access and a second computer within an isolated workgroup — as proxies to perform MAK volume activation for workgroup computers that do not have Internet access. | +|[Scenario 3: KMS Client Activation](scenario-kms-activation-vamt.md) |Describes how to use VAMT to configure client products for Key Management Service (KMS) activation. By default, volume license editions of Windows 10, Windows Vista, Windows® 7, Windows 8, Windows Server 2008, Windows Server 2008 R2, or Windows Server® 2012, and Microsoft® Office 2010 use KMS for activation. | + +## Related topics +- [Introduction to VAMT](introduction-vamt.md) +  +  diff --git a/windows/deployment/volume-activation/volume-activation-management-tool.md b/windows/deployment/volume-activation/volume-activation-management-tool.md index 172989517e..c73cbc4546 100644 --- a/windows/deployment/volume-activation/volume-activation-management-tool.md +++ b/windows/deployment/volume-activation/volume-activation-management-tool.md @@ -1,12 +1,16 @@ --- title: Volume Activation Management Tool (VAMT) Technical Reference (Windows 10) -description: The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. +description: The Volume Activation Management Tool (VAMT) enables network administrators to automate and centrally manage volume activation and retail activation. ms.assetid: 1df0f795-f41c-473b-850c-e98af1ad2f2a +ms.reviewer: +manager: laurawi +ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: activation -author: jdeckerms +audience: itpro +author: greg-lindsay ms.date: 04/25/2017 ms.topic: article --- @@ -15,17 +19,12 @@ ms.topic: article The Volume Activation Management Tool (VAMT) enables network administrators and other IT professionals to automate and centrally manage the Windows®, Microsoft® Office, and select other Microsoft products volume and retail-activation process. VAMT can manage volume activation using Multiple Activation Keys (MAKs) or the Windows Key Management Service (KMS). VAMT is a standard Microsoft Management Console (MMC) snap-in that requires the Microsoft Management Console (MMC) 3.0. VAMT can be installed on any computer that has one of the following Windows operating systems: -- Windows® 7 -- Windows 8 -- Windows 8.1 -- Windows 10 -- Windows Server 2008 R2 -- Windows Server® 2012 -- Windows Server 2012 R2 +- Windows® 7 or above +- Windows Server 2008 R2 or above + **Important**   -VAMT is designed to manage volume activation for: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Microsoft Office 2010, and Microsoft Office 2013. Computers installed with volume editions of -**Windows XP** or **Windows Server 2003** cannot be managed using VAMT. However, Office 2010 and Office 2013 products installed on these two operating systems can still be managed. +VAMT is designed to manage volume activation for: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows Server 2008 (or later), Microsoft Office 2010 (or above). VAMT is only available in an EN-US (x86) package. @@ -42,4 +41,4 @@ VAMT is only available in an EN-US (x86) package. |[Manage VAMT Data](manage-vamt-data.md) |Describes how to save, import, export, and merge a Computer Information List (CILX) file using VAMT. | |[VAMT Step-by-Step Scenarios](vamt-step-by-step.md) |Provides step-by-step instructions for using VAMT in typical environments. | |[VAMT Known Issues](vamt-known-issues.md) |Lists known issues in VAMT. | -  \ No newline at end of file + diff --git a/windows/deployment/volume-activation/volume-activation-windows-10.md b/windows/deployment/volume-activation/volume-activation-windows-10.md index ebf9a48213..a820b9e25b 100644 --- a/windows/deployment/volume-activation/volume-activation-windows-10.md +++ b/windows/deployment/volume-activation/volume-activation-windows-10.md @@ -1,66 +1,72 @@ ---- -title: Volume Activation for Windows 10 (Windows 10) -description: This guide is designed to help organizations that are planning to use volume activation to deploy and activate Windows 10, including organizations that have used volume activation for earlier versions of Windows. -ms.assetid: 6e8cffae-7322-4fd3-882a-cde68187aef2 -keywords: vamt, volume activation, activation, windows activation -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: activation -author: jdeckerms -ms.localizationpriority: medium -ms.date: 07/27/2017 -ms.topic: article ---- - -# Volume Activation for Windows 10 - -**Applies to** -- Windows 10 -- Windows 8.1 -- Windows 8 -- Windows 7 -- Windows Server 2012 R2 -- Windows Server 2012 -- Windows Server 2008 R2 - -**Looking for volume licensing information?** -- [Download the Volume Licensing Reference Guide for Windows 10 Desktop Operating System](https://go.microsoft.com/fwlink/p/?LinkId=620104) - -**Looking for retail activation?** -- [Get Help Activating Microsoft Windows](https://go.microsoft.com/fwlink/p/?LinkId=618644) - -This guide is designed to help organizations that are planning to use volume activation to deploy and activate Windows 10, including organizations that have used volume activation for earlier versions of Windows. -*Volume activation* is the process that Microsoft volume licensing customers use to automate and manage the activation of Windows operating systems, Microsoft Office, and other Microsoft products across large organizations. Volume licensing is available to customers who purchase software under various volume programs (such as Open and Select) and to participants in programs such as the Microsoft Partner Program and MSDN Subscriptions. - -Volume activation is a configurable solution that helps automate and manage the product activation process on computers running Windows operating systems that have been licensed under a volume licensing program. Volume activation is also used with other software from Microsoft (most notably the Office suites) that are sold under volume licensing agreements and that support volume activation. - -This guide provides information and step-by-step guidance to help you choose a volume activation method that suits your environment, and then to configure that solution successfully. This guide describes the volume activation features that are available in Windows 10 and Windows Server 2012 R2 and the tools that are provided in these versions of Windows and Windows Server to manage volume activation. - -Because most organizations will not immediately switch all computers to Windows 10, practical volume activation strategies must also take in to account how to work with the Windows 8, Windows 7, Windows Server 2012, and Windows Server 2008 R2Windows Server 2008 R2 operating systems. This guide -discusses how the new volume activation tools can support earlier operating systems, but it does not discuss the tools that are provided with earlier operating system versions. - -Volume activation—and the need for activation itself—is not new, and this guide does not review all of its concepts and history. You can find additional background in the appendices of this guide. For more information, see [Volume Activation Overview](https://go.microsoft.com/fwlink/p/?LinkId=618209) in the TechNet Library. - -If you would like additional information about planning a volume activation deployment specifically for Windows 7 and Windows Server 2008 R2, please see the [Volume Activation Planning Guide for Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=618210). - -To successfully plan and implement a volume activation strategy, you must: -- Learn about and understand product activation. -- Review and evaluate the available activation types or models. -- Consider the connectivity of the clients to be activated. -- Choose the method or methods to be used with each type of client. -- Determine the types and number of product keys you will need. -- Determine the monitoring and reporting needs in your organization. -- Install and configure the tools required to support the methods selected. - -Keep in mind that the method of activation does not change an organization’s responsibility to the licensing requirements. You must ensure that all software used in your organization is properly licensed and activated in accordance with the terms of the licensing agreements in place. - -**In this guide:** -- [Plan for volume activation](plan-for-volume-activation-client.md) -- [Activate using Key Management Service](activate-using-key-management-service-vamt.md) -- [Activate using Active Directory-based activation](activate-using-active-directory-based-activation-client.md) -- [Activate clients running Windows 10](activate-windows-10-clients-vamt.md) -- [Monitor activation](monitor-activation-client.md) -- [Use the Volume Activation Management Tool](use-the-volume-activation-management-tool-client.md) -- [Appendix: Information sent to Microsoft during activation](appendix-information-sent-to-microsoft-during-activation-client.md) -  \ No newline at end of file +--- +title: Volume Activation for Windows 10 +description: Learn how to use volume activation to deploy & activate Windows 10. Includes details for orgs that have used volume activation for earlier versions of Windows. +ms.assetid: 6e8cffae-7322-4fd3-882a-cde68187aef2 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: vamt, volume activation, activation, windows activation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: activation +audience: itpro +author: greg-lindsay +ms.localizationpriority: medium +ms.date: 07/27/2017 +ms.topic: article +--- + +# Volume Activation for Windows 10 + +> Applies to +> +>- Windows 10 +>- Windows Server 2012 R2 +>- Windows Server 2012 +>- Windows Server 2016 +>- Windows Server 2019 + +**Looking for volume licensing information?** + +- [Download the Volume Licensing Reference Guide for Windows 10 Desktop Operating System](https://go.microsoft.com/fwlink/p/?LinkId=620104) + +**Looking for retail activation?** + +- [Get Help Activating Microsoft Windows](https://support.microsoft.com/help/12440/windows-10-activate) + +This guide is designed to help organizations that are planning to use volume activation to deploy and activate Windows 10, including organizations that have used volume activation for earlier versions of Windows. + +*Volume activation* is the process that Microsoft volume licensing customers use to automate and manage the activation of Windows operating systems, Microsoft Office, and other Microsoft products across large organizations. Volume licensing is available to customers who purchase software under various volume programs (such as [Open](https://www.microsoft.com/Licensing/licensing-programs/open-license) and [Select](https://www.microsoft.com/Licensing/licensing-programs/select)) and to participants in programs such as the [Microsoft Partner Program](https://partner.microsoft.com/) and [MSDN Subscriptions](https://visualstudio.microsoft.com/msdn-platforms/). + +Volume activation is a configurable solution that helps automate and manage the product activation process on computers running Windows operating systems that have been licensed under a volume licensing program. Volume activation is also used with other software from Microsoft (most notably the Office suites) that are sold under volume licensing agreements and that support volume activation. + +This guide provides information and step-by-step guidance to help you choose a volume activation method that suits your environment, and then to configure that solution successfully. This guide describes the volume activation features and the tools to manage volume activation. + +Because most organizations will not immediately switch all computers to Windows 10, practical volume activation strategies must also take in to account how to work with the Windows 8.1, Windows 7, Windows Server 2012, and Windows Server 2008 R2 operating systems. This guide discusses how the new volume activation tools can support earlier operating systems, but it does not discuss the tools that are provided with earlier operating system versions. + +Volume activation -and the need for activation itself- is not new, and this guide does not review all of its concepts and history. You can find additional background in the appendices of this guide. For more information, see [Volume Activation Overview](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831612(v=ws.11)). + +If you would like additional information about planning a volume activation deployment specifically for Windows 7 and Windows Server 2008 R2, please see the [Volume Activation Planning Guide for Windows 7](https://go.microsoft.com/fwlink/p/?LinkId=618210). + +To successfully plan and implement a volume activation strategy, you must: + +- Learn about and understand product activation. +- Review and evaluate the available activation types or models. +- Consider the connectivity of the clients to be activated. +- Choose the method or methods to be used with each type of client. +- Determine the types and number of product keys you will need. +- Determine the monitoring and reporting needs in your organization. +- Install and configure the tools required to support the methods selected. + +Keep in mind that the method of activation does not change an organization’s responsibility to the licensing requirements. You must ensure that all software used in your organization is properly licensed and activated in accordance with the terms of the licensing agreements in place. + +## Additional information + +- [Plan for volume activation](plan-for-volume-activation-client.md) +- [Activate using Key Management Service](activate-using-key-management-service-vamt.md) +- [Activate using Active Directory-based activation](activate-using-active-directory-based-activation-client.md) +- [Activate clients running Windows 10](activate-windows-10-clients-vamt.md) +- [Monitor activation](monitor-activation-client.md) +- [Use the Volume Activation Management Tool](use-the-volume-activation-management-tool-client.md) +- [Appendix: Information sent to Microsoft during activation](appendix-information-sent-to-microsoft-during-activation-client.md) diff --git a/windows/deployment/windows-10-architecture-posters.md b/windows/deployment/windows-10-architecture-posters.md deleted file mode 100644 index ec1efe188a..0000000000 --- a/windows/deployment/windows-10-architecture-posters.md +++ /dev/null @@ -1,25 +0,0 @@ ---- -title: Deploy Windows 10 - architectural posters -description: Provides architural planning posters for Windows 10 in the enterprise -ms.prod: w10 -ms.author: elizapo -author: lizap -ms.date: 09/28/2017 -ms.tgt_pltfrm: na -ms.topic: article -ms.localizationpriority: medium ---- -# Architectural planning posters for Windows 10 - -You can download the following posters for architectural information about deploying Windows 10 in the enterprise. - -- [Deploy Windows 10 - Clean installation](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/master/windows/media/ModernSecureDeployment/Deploy-CleanInstallation.pdf) - Learn about the options and steps for a new installation of Windows 10. -- [Deploy Windows 10 - In-place upgrade](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/master/windows/media/ModernSecureDeployment/Deploy-InplaceUpgrade.pdf) - Learn about the steps to upgrade from a previous version of Windows. -- [Deploy Windows 10 - Windows Autopilot](https://github.com/MicrosoftDocs/windows-itpro-docs/blob/master/windows/media/ModernSecureDeployment/Deploy-WindowsAutoPilot.pdf) - Learn how you can set up and pre-configure Windows 10 devices. -- [Deploy Windows 10 - Windows servicing](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/master/windows/media/ModernSecureDeployment/WindowsServicing.pdf) - Learn how to keep Windows up to date. -- [Deploy Windows 10 - Protection solutions](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/master/windows/media/ModernSecureDeployment/ProtectionSolutions.pdf) - Learn about the two tiers of protection available for Windows 10 devices. diff --git a/windows/deployment/windows-10-deployment-posters.md b/windows/deployment/windows-10-deployment-posters.md new file mode 100644 index 0000000000..3ae808a4af --- /dev/null +++ b/windows/deployment/windows-10-deployment-posters.md @@ -0,0 +1,41 @@ +--- +title: Windows 10 deployment process posters +description: View and download Windows 10 deployment process flows for Microsoft Endpoint Configuration Manager and Windows Autopilot. +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +ms.author: greglin +keywords: upgrade, in-place, configuration, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows 10 deployment process posters + +**Applies to** +- Windows 10 + +The following posters step through various options for deploying Windows 10 with Windows Autopilot or Microsoft Endpoint Configuration Manager. + +## Deploy Windows 10 with Autopilot + +The Windows Autopilot poster is two pages in portrait mode (11x17). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10AutopilotFlowchart.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10Autopilotflowchart.vsdx) format. + +[![Deploy Windows 10 with Autopilot](./media/windows10-autopilot-flowchart.png)](./media/Windows10AutopilotFlowchart.pdf) + +## Deploy Windows 10 with Microsoft Endpoint Configuration Manager + +The Configuration Manager poster is one page in landscape mode (17x11). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.vsdx) format. + +[![Deploy Windows 10 with Configuration Manager](./media/windows10-deployment-config-manager.png)](./media/Windows10DeploymentConfigManager.pdf) + +## See also + +[Overview of Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot)
                                  +[Scenarios to deploy enterprise operating systems with Configuration Manager](https://docs.microsoft.com/configmgr/osd/deploy-use/scenarios-to-deploy-enterprise-operating-systems) \ No newline at end of file diff --git a/windows/deployment/windows-10-deployment-scenarios.md b/windows/deployment/windows-10-deployment-scenarios.md index e9cd9edd07..cd3a28b0ca 100644 --- a/windows/deployment/windows-10-deployment-scenarios.md +++ b/windows/deployment/windows-10-deployment-scenarios.md @@ -1,13 +1,18 @@ --- title: Windows 10 deployment scenarios (Windows 10) -description: To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. +description: Understand the different ways Windows 10 operating system can be deployed in your organization. Explore several Windows 10 deployment scenarios. ms.assetid: 7A29D546-52CC-482C-8870-8123C7DC04B5 +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay keywords: upgrade, in-place, configuration, deploy ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library ms.date: 11/06/2018 +audience: itpro author: greg-lindsay ms.topic: article --- @@ -20,7 +25,7 @@ ms.topic: article To successfully deploy the Windows 10 operating system in your organization, it is important to understand the different ways that it can be deployed, especially now that there are new scenarios to consider. Choosing among these scenarios, and understanding the capabilities and limitations of each, is a key task. The following table summarizes various Windows 10 deployment scenarios. The scenarios are each assigned to one of three categories. -- Modern deployment methods are recommended unless you have a specific need to use a different procedure. These methods are supported with existing tools such as Microsoft Deployment Toolkit (MDT) and System Center Configuration Manager. These methods are discussed in detail on the [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home). +- Modern deployment methods are recommended unless you have a specific need to use a different procedure. These methods are supported with existing tools such as Microsoft Deployment Toolkit (MDT) and Microsoft Endpoint Configuration Manager. These methods are discussed in detail on the [Modern Desktop Deployment Center](https://docs.microsoft.com/microsoft-365/enterprise/desktop-deployment-center-home). - Dynamic deployment methods enable you to configure applications and settings for specific use cases. - Traditional deployment methods use existing tools to deploy operating system images.
                                    @@ -104,7 +109,7 @@ The following table summarizes various Windows 10 deployment scenarios. The scen Deploy a new device, or wipe an existing device and deploy with a fresh image. - Deploy a Windows 10 image using MDT
                                  Install a new version of Windows on a new computer with System Center Configuration Manager + Deploy a Windows 10 image using MDT
                                  Install a new version of Windows on a new computer with Microsoft Endpoint Configuration Manager @@ -116,7 +121,7 @@ The following table summarizes various Windows 10 deployment scenarios. The scen Also called wipe and load. Redeploy a device by saving the user state, wiping the disk, then restoring the user state. - Refresh a Windows 7 computer with Windows 10
                                  Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager + Refresh a Windows 7 computer with Windows 10
                                  Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager @@ -128,7 +133,7 @@ The following table summarizes various Windows 10 deployment scenarios. The scen Replace an existing device with a new one by saving the user state on the old device and then restoring it to the new device. - Replace a Windows 7 computer with a Windows 10 computer
                                  Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager + Replace a Windows 7 computer with a Windows 10 computer
                                  Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager @@ -154,7 +159,7 @@ For more information about Windows Autopilot, see [Overview of Windows Autopilot For existing computers running Windows 7, Windows 8, or Windows 8.1, the recommended path for organizations deploying Windows 10 leverages the Windows installation program (Setup.exe) to perform an in-place upgrade, which automatically preserves all data, settings, applications, and drivers from the existing operating system version. This requires the least IT effort, because there is no need for any complex deployment infrastructure. -Although consumer PCs will be upgraded using Windows Update, organizations want more control over the process. This is accomplished by leveraging tools like System Center Configuration Manager or the Microsoft Deployment Toolkit to completely automate the upgrade process through simple task sequences. +Although consumer PCs will be upgraded using Windows Update, organizations want more control over the process. This is accomplished by leveraging tools like Microsoft Endpoint Configuration Manager or the Microsoft Deployment Toolkit to completely automate the upgrade process through simple task sequences. The in-place upgrade process is designed to be extremely reliable, with the ability to automatically roll back to the previous operating system if any issues are encountered during the deployment process, without any IT staff involvement. Rolling back manually can also be done by leveraging the automatically-created recovery information (stored in the Windows.old folder), in case any issues are encountered after the upgrade is finished. The upgrade process is also typically faster than traditional deployments, because applications do not need to be reinstalled as part of the process. @@ -201,7 +206,7 @@ While the initial Windows 10 release includes a variety of provisioning setting ## Traditional deployment: -New versions of Windows have typically been deployed by organizations using an image-based process built on top of tools provided in the [Windows Assessment and Deployment Kit](windows-adk-scenarios-for-it-pros.md), Windows Deployment Services, the [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md), and [System Center Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md). +New versions of Windows have typically been deployed by organizations using an image-based process built on top of tools provided in the [Windows Assessment and Deployment Kit](windows-adk-scenarios-for-it-pros.md), Windows Deployment Services, the [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md), and [Microsoft Endpoint Configuration Manager](deploy-windows-sccm/deploy-windows-10-with-system-center-2012-r2-configuration-manager.md). With the release of Windows 10, all of these tools are being updated to fully support Windows 10. Although newer scenarios such as in-place upgrade and dynamic provisioning may reduce the need for traditional deployment capabilities in some organizations, these traditional methods remain important and will continue to be available to organizations that need them. @@ -264,7 +269,7 @@ The deployment process for the replace scenario is as follows: ## Related topics - [Upgrade to Windows 10 with the Microsoft Deployment Toolkit](upgrade/upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md) -- [Upgrade to Windows 10 with System Center Configuration Manager](upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md) +- [Upgrade to Windows 10 with Microsoft Endpoint Configuration Manager](upgrade/upgrade-to-windows-10-with-system-center-configuraton-manager.md) - [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=620230) - [Deploy Windows 10 with the Microsoft Deployment Toolkit](deploy-windows-mdt/deploy-windows-10-with-the-microsoft-deployment-toolkit.md) - [Windows setup technical reference](https://go.microsoft.com/fwlink/p/?LinkId=619357) diff --git a/windows/deployment/windows-10-deployment-tools-reference.md b/windows/deployment/windows-10-deployment-tools-reference.md index 0395575429..31c2c53103 100644 --- a/windows/deployment/windows-10-deployment-tools-reference.md +++ b/windows/deployment/windows-10-deployment-tools-reference.md @@ -1,10 +1,15 @@ --- -title: Windows 10 deployment tools (Windows 10) +title: Windows 10 deployment tools reference description: Learn about the tools available to deploy Windows 10. ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 07/12/2017 ms.topic: article diff --git a/windows/deployment/windows-10-deployment-tools.md b/windows/deployment/windows-10-deployment-tools.md index ec368c30f1..2bf8998e1e 100644 --- a/windows/deployment/windows-10-deployment-tools.md +++ b/windows/deployment/windows-10-deployment-tools.md @@ -1,10 +1,15 @@ --- -title: Windows 10 deployment tools (Windows 10) -description: Learn about the tools available to deploy Windows 10. +title: Windows 10 deployment tools +description: Browse through documentation describing Windows 10 deployment tools. Learn how to use these these tools to successfully deploy Windows 10 to your organization. ms.assetid: 5C4B0AE3-B2D0-4628-9E73-606F3FAA17BB +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library +audience: itpro author: greg-lindsay ms.date: 10/16/2017 ms.topic: article diff --git a/windows/deployment/windows-10-enterprise-e3-overview.md b/windows/deployment/windows-10-enterprise-e3-overview.md index 8419e4ccb1..e4cadbe165 100644 --- a/windows/deployment/windows-10-enterprise-e3-overview.md +++ b/windows/deployment/windows-10-enterprise-e3-overview.md @@ -8,6 +8,11 @@ ms.localizationpriority: medium ms.sitesec: library ms.pagetype: mdt ms.date: 08/24/2017 +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +audience: itpro author: greg-lindsay ms.collection: M365-modern-desktop ms.topic: article @@ -40,9 +45,9 @@ When you purchase Windows 10 Enterprise E3 via a partner, you get the followin How does the Windows 10 Enterprise E3 in CSP program compare with Microsoft Volume Licensing Agreements and Software Assurance? -- [Microsoft Volume Licensing](https://www.microsoft.com/en-us/licensing/default.aspx) programs are broader in scope, providing organizations with access to licensing for all Microsoft products. +- [Microsoft Volume Licensing](https://www.microsoft.com/licensing/default.aspx) programs are broader in scope, providing organizations with access to licensing for all Microsoft products. -- [Software Assurance](https://www.microsoft.com/en-us/Licensing/licensing-programs/software-assurance-default.aspx) provides organizations with the following categories of benefits: +- [Software Assurance](https://www.microsoft.com/Licensing/licensing-programs/software-assurance-default.aspx) provides organizations with the following categories of benefits: - **Deployment and management**. These benefits include planning services, Microsoft Desktop Optimization (MDOP), Windows Virtual Desktop Access Rights, Windows-To-Go Rights, Windows Roaming Use Rights, Windows Thin PC, Windows RT Companion VDA Rights, and other benefits. @@ -75,17 +80,17 @@ Windows 10 Enterprise edition has a number of features that are unavailable in -

                                  Credential Guard\*

                                  +

                                  Credential Guard

                                  This feature uses virtualization-based security to help protect security secrets (for example, NTLM password hashes, Kerberos Ticket Granting Tickets) so that only privileged system software can access them. This helps prevent Pass-the-Hash or Pass-the-Ticket attacks.

                                  Credential Guard has the following features:

                                    -

                                  • **Hardware-level security**.  Credential Guard uses hardware platform security features (such as Secure Boot and virtualization) to help protect derived domain credentials and other secrets.

                                    • -

                                  • **Virtualization-based security**.  Windows services that access derived domain credentials and other secrets run in a virtualized, protected environment that is isolated.

                                    • -

                                  • **Improved protection against persistent threats**.  Credential Guard works with other technologies (e.g., Device Guard) to help provide further protection against attacks, no matter how persistent.

                                    • -

                                  • **Improved manageability**.  Credential Guard can be managed through Group Policy, Windows Management Instrumentation (WMI), or Windows PowerShell.

                                    • +

                                  • Hardware-level security.  Credential Guard uses hardware platform security features (such as Secure Boot and virtualization) to help protect derived domain credentials and other secrets.

                                    • +

                                  • Virtualization-based security.  Windows services that access derived domain credentials and other secrets run in a virtualized, protected environment that is isolated.

                                    • +

                                  • Improved protection against persistent threats.  Credential Guard works with other technologies (e.g., Device Guard) to help provide further protection against attacks, no matter how persistent.

                                    • +

                                  • Improved manageability.  Credential Guard can be managed through Group Policy, Windows Management Instrumentation (WMI), or Windows PowerShell.

                                  -

                                  For more information, see [Protect derived domain credentials with Credential Guard](https://technet.microsoft.com/itpro/windows/keep-secure/credential-guard).

                                  -

                                  \* Credential Guard requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)

                                  +

                                  For more information, see Protect derived domain credentials with Credential Guard.

                                  +

                                  Credential Guard requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)

                                  Device Guard

                                  @@ -96,17 +101,17 @@ Windows 10 Enterprise edition has a number of features that are unavailable in

                                • Helps protect the Windows system core from vulnerability and zero-day exploits

                                • Allows only trusted apps to run

                                  • -

                                  For more information, see [Introduction to Device Guard](https://technet.microsoft.com/itpro/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies).

                                  +

                                  For more information, see Introduction to Device Guard.

                                  AppLocker management

                                  This feature helps IT pros determine which applications and files users can run on a device (also known as “whitelisting”). The applications and files that can be managed include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.

                                  -

                                  For more information, see [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview).

                                  +

                                  For more information, see AppLocker.

                                  Application Virtualization (App-V)

                                  -

                                  This feature makes applications available to end users without installing the applications directly on users’ devices. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. This feature also helps ensure that applications are kept current with the latest security updates.

                                  -

                                  For more information, see [Getting Started with App-V for Windows 10](https://technet.microsoft.com/itpro/windows/manage/appv-getting-started).

                                  +

                                  This feature makes applications available to end users without installing the applications directly on users’ devices. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. This feature also helps ensure that applications are kept current with the latest security updates.

                                  +

                                  For more information, see Getting Started with App-V for Windows 10.

                                  User Experience Virtualization (UE-V)

                                  @@ -118,7 +123,7 @@ Windows 10 Enterprise edition has a number of features that are unavailable in

                                • Create custom templates for your third-party or line-of-business applications

                                • Recover settings after hardware replacement or upgrade, or after re-imaging a virtual machine to its initial state

                                  • -

                                  For more information, see [User Experience Virtualization (UE-V) for Windows 10 overview](https://technet.microsoft.com/itpro/windows/manage/uev-for-windows).

                                  +

                                  For more information, see User Experience Virtualization (UE-V) for Windows 10 overview.

                                  Managed User Experience

                                  @@ -142,7 +147,7 @@ See [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). ## Deploy Windows 10 Enterprise features -Now that you have Windows 10 Enterprise edition running on devices, how do you take advantage of the Enterprise edition features and capabilities? What are the next steps that need to be taken for each of the features discussed in [Table 1](#compare-windows-10-pro-and-enterprise-editions)? +Now that you have Windows 10 Enterprise edition running on devices, how do you take advantage of the Enterprise edition features and capabilities? What are the next steps that need to be taken for each of the features discussed in [Table 1](#compare-windows10-pro-and-enterprise-editions)? The following sections provide you with the high-level tasks that need to be performed in your environment to help users take advantage of the Windows 10 Enterprise edition features. @@ -158,7 +163,7 @@ You can implement Credential Guard on Windows 10 Enterprise devices by turning - Configure Credential Guard registry settings by using the Registry Editor or the [Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). - You can automate these manual steps by using a management tool such as System Center Configuration Manager. + You can automate these manual steps by using a management tool such as Microsoft Endpoint Configuration Manager. For more information about implementing Credential Guard, see the following resources: @@ -249,7 +254,7 @@ The Managed User Experience feature is a set of Windows 10 Enterprise edition f ## Related topics -[Windows 10 Enterprise Subscription Activation](windows-10-enterprise-subscription-activation.md) +[Windows 10 Enterprise Subscription Activation](windows-10-subscription-activation.md)
                                  [Connect domain-joined devices to Azure AD for Windows 10 experiences](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/)
                                  [Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
                                  [Windows for business](https://www.microsoft.com/windowsforbusiness/default.aspx) diff --git a/windows/deployment/windows-10-enterprise-subscription-activation.md b/windows/deployment/windows-10-enterprise-subscription-activation.md deleted file mode 100644 index 767a8c0724..0000000000 --- a/windows/deployment/windows-10-enterprise-subscription-activation.md +++ /dev/null @@ -1,183 +0,0 @@ ---- -title: Windows 10 Subscription Activation -description: How to enable Windows 10 Enterprise E3 and E5 subscriptions -keywords: upgrade, update, task sequence, deploy -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdt -author: greg-lindsay -ms.collection: M365-modern-desktop -search.appverid: -- MET150 -ms.topic: article ---- - -# Windows 10 Subscription Activation - -With Windows 10 version 1703 (also known as the Creator’s Update), both Windows 10 Enterprise E3 and Windows 10 Enterprise E5 are available as online services via subscription. Deploying [Windows 10 Enterprise](planning/windows-10-enterprise-faq-itpro.md) in your organization can now be accomplished with no keys and no reboots. - - If you are running Windows 10 version 1703 or later: - -- Devices with a current Windows 10 Pro license can be seamlessly upgraded to Windows 10 Enterprise. -- Product key-based Windows 10 Enterprise software licenses can be transitioned to Windows 10 Enterprise subscriptions. - -Organizations that have an Enterprise agreement can also benefit from the new service, using traditional Active Directory-joined devices. In this scenario, the Active Directory user that signs in on their device must be synchronized with Azure AD using [Azure AD Connect Sync](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-whatis). - -See the following topics in this article: -- [Inherited Activation](#inherited-activation): Description of a new feature available in Windows 10, version 1803 and later. -- [The evolution of Windows 10 deployment](#the-evolution-of-deployment): A short history of Windows deployment. -- [Requirements](#requirements): Prerequisites to use the Windows 10 Enterprise subscription model. -- [Benefits](#benefits): Advantages of Windows 10 Enterprise + subscription-based licensing. -- [How it works](#how-it-works): A summary of the subscription-based licensing option. -- [Virtual Desktop Access (VDA)](#virtual-desktop-access-vda): Enable Windows 10 Subscription Activation for VMs in the cloud. - -For information on how to deploy Windows 10 Enterprise licenses, see [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). - -## Inherited Activation - -Inherited Activation is a new feature available in Windows 10, version 1803 that allows Windows 10 virtual machines to inherit activation state from their Windows 10 host. - -When a user with Windows 10 E3 or E5 license assigned creates a new Windows 10 virtual machine (VM) using a Windows 10 local host, the VM inherits the activation state from a host machine independent of whether user signs on with a local account or using an Azure Active Directory (AAD) account on a VM. - -To support Inherited Activation, both the host computer and the VM must be running Windows 10, version 1803 or later. - -## The evolution of deployment - ->The original version of this section can be found at [Changing between Windows SKUs](https://blogs.technet.microsoft.com/mniehaus/2017/10/09/changing-between-windows-skus/). - -The following figure illustrates how deploying Windows 10 has evolved with each release. With this release, deployment is automatic. - -![Illustration of how Windows 10 deployment has evolved](images/sa-evolution.png) - -- **Windows 7** required you to redeploy the operating system using a full wipe-and-load process if you wanted to change from Windows 7 Professional to Windows 10 Enterprise.
                                  -- **Windows 8.1** added support for a Windows 8.1 Pro to Windows 8.1 Enterprise in-place upgrade (considered a “repair upgrade” because the OS version was the same before and after).  This was a lot easier than wipe-and-load, but it was still time-consuming.
                                  -- **Windows 10 1507** added the ability to install a new product key using a provisioning package or using MDM to change the SKU.  This required a reboot, which would install the new OS components, and took several minutes to complete. However, it was a lot quicker than in-place upgrade.
                                  -- **Windows 10 1607** made a big leap forward. Now you can just change the product key and the SKU instantly changes from Windows 10 Pro to Windows 10 Enterprise.  In addition to provisioning packages and MDM, you can just inject a key using SLMGR.VBS (which injects the key into WMI), so it became trivial to do this using a command line.
                                  -- **Windows 10 1703** made this “step-up” from Windows 10 Pro to Windows 10 Enterprise automatic for those that subscribed to Windows 10 Enterprise E3 or E5 via the CSP program.
                                  -- **Windows 10 1709** adds support for Windows 10 Subscription Activation, very similar to the CSP support but for large enterprises, enabling the use of Azure AD for assigning licenses to users. When those users sign in on an AD or Azure AD-joined machine, it automatically steps up from Windows 10 Pro to Windows 10 Enterprise. -- **Windows 10 1803** updates Windows 10 Subscription Activation to enable pulling activation keys directly from firmware for devices that support firmware-embedded keys. It is no longer necessary to run a script to perform the activation step on Windows 10 Pro prior to activating Enterprise. For virtual machines and hosts running Windows 10, version 1803 [Inherited Activation](#inherited-activation) is also enabled. - -## Requirements - -For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA), you must have the following: - -- Windows 10 (Pro or Enterprise) version 1703 or later installed and **activated** on the devices to be upgraded. -- Azure Active Directory (Azure AD) available for identity management. -- Devices must be Azure AD-joined or Active Directory joined with Azure AD Connect. Workgroup-joined devices are not supported. - - >[!NOTE] - >An issue has been identified with Hybrid Azure AD joined devices that have enabled [multi-factor authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted) (MFA). If a user signs into a device using their Active Directory account and MFA is enabled, the device will not successfully upgrade to their Windows Enterprise subscription. To resolve this issue, the user must either sign in with an Azure Active Directory account, or you must disable MFA for this user during the 30-day polling period and renewal. - -For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 Enterprise E3 or E5 through a cloud solution provider (CSP). Identity management and device requirements are the same when you use CSP to manage licenses, with the exception that Windows 10 Enterprise E3 is also available through CSP to devices running Windows 10, version 1607. For more information about obtaining Windows 10 Enterprise E3 through your CSP, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md). - -If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade benefits for Windows Cloud Subscriptions in CSP](https://blogs.windows.com/business/2017/01/19/new-windows-10-upgrade-benefits-windows-cloud-subscriptions-csp/) - -## Benefits - -With Windows 10 Enterprise, businesses can benefit from enterprise-level security and control. Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Enterprise E3 or E5 to their users. Now, with Windows 10 Enterprise E3 and E5 being available as a true online service, it is available in every channel thus allowing all organizations to take advantage of enterprise grade Windows 10 features. To compare Windows 10 editions and review pricing, see the following: - -- [Compare Windows 10 editions](https://www.microsoft.com/en-us/windowsforbusiness/compare) -- [Enterprise Mobility + Security Pricing Options](https://www.microsoft.com/en-us/cloud-platform/enterprise-mobility-security-pricing) - -You can benefit by moving to Windows as an online service in the following ways: - -1. Licenses for Windows 10 Enterprise are checked based on Azure Active Directory (Azure AD) credentials, so now businesses have a systematic way to assign licenses to end users and groups in their organization. -2. User logon triggers a silent edition upgrade, with no reboot required -3. Support for mobile worker/BYOD activation; transition away from on-prem KMS and MAK keys. -4. Compliance support via seat assignment. - -## How it works - -When a licensed user signs in to a device that meets requirements using the Azure AD credentials associated with a Windows 10 Enterprise E3 or E5 license, the operating system turns from Windows 10 Pro to Windows 10 Enterprise and all the appropriate Windows 10 Enterprise features are unlocked. When a user’s subscription expires or is transferred to another user, the Windows 10 Enterprise device reverts seamlessly to Windows 10 Pro edition, after a grace period of up to 90 days. - -Devices currently running Windows 10 Pro, version 1703 or later can get Windows 10 Enterprise Semi-Annual Channel on up to five devices for each user covered by the license. This benefit does not include Long Term Servicing Channel. - -### Scenarios - -**Scenario #1**:  You are using Windows 10 1803 or above, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise). - -All of your Windows 10 Pro devices will step-up to Windows 10 Enterprise, and devices that are already running Windows 10 Enterprise will migrate from KMS or MAK activated Enterprise edition to Subscription activated Enterprise edition when a Subscription Activation-enabled user signs in to the device. - -**Scenario #2**:  You are using Windows 10, version 1607, 1703, or 1709 with KMS for activation, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise). - -To change all of your Windows 10 Pro devices to Windows 10 Enterprise, run the following command on each computer: - -
                                  -cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
                                  - -The command causes the OS to change to Windows 10 Enterprise and then seek out the KMS server to reactivate.  This key comes from [Appendix A: KMS Client Setup Keys](https://technet.microsoft.com/library/jj612867.aspx) in the Volume Activation guide.  It is also possible to inject the Windows 10 Pro key from this article if you wish to step back down from Enterprise to Pro. - -**Scenario #3**:  Using Azure AD-joined devices or Active Directory-joined devices running Windows 10 1709 or later, and with Azure AD synchronization configured, just follow the steps in [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md) to acquire a $0 SKU and get a new Windows 10 Enterprise E3 or E5 license in Azure AD. Then, assign that license to all of your Azure AD users. These can be AD-synced accounts.  The device will automatically change from Windows 10 Pro to Windows 10 Enterprise when that user signs in. - -In summary, if you have a Windows 10 Enterprise E3 or E5 subscription, but are still running Windows 10 Pro, it’s really simple (and quick) to move to Windows 10 Enterprise using one of the scenarios above. - -If you’re running Windows 7, it can be more work.  A wipe-and-load approach works, but it is likely to be easier to upgrade from Windows 7 Pro directly to Windows 10 Enterprise. This is a supported path, and completes the move in one step.  This method also works if you are running Windows 8.1 Pro. - -### Licenses - -The following policies apply to acquisition and renewal of licenses on devices: -- Devices that have been upgraded will attempt to acquire licenses every 30 days, and must be connected to the Internet to be successful. -- Licenses are valid for 90 days. If a device is disconnected from the Internet until its current license expires, the operating system will revert to Windows 10 Pro. As soon as the device is connected to the Internet again, the license will automatically renew assuming the device is still present on list of user devices. -- Up to five devices can be upgraded for each user license. -- The list of devices is chronological and cannot be manually modified. -- If a device meets requirements and a licensed user signs in on that device, it will be upgraded. -- If five devices are already on the list and a subscribed user signs in on a sixth device, then this new device is added to the end of the list and the first device is removed. -- Devices that are removed from the list will cease trying to acquire a license and revert to Windows 10 Pro when the grace period expires. - -Licenses can also be reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs. - -When you have the required Azure AD subscription, group-based licensing is the preferred method to assign Enterprise E3 and E5 licenses to users. For more information, see [Group-based licensing basics in Azure AD](https://docs.microsoft.com/azure/active-directory/active-directory-licensing-whatis-azure-portal). - -### Existing Enterprise deployments - -If you are running Windows 10, version 1803 or later, Subscription Activation will automatically pull the firmware-embedded Windows 10 activation key and activate the underlying Pro License. The license will then step-up to Windows 10 Enterprise using Subscription Activation. This automatically migrates your devices from KMS or MAK activated Enterprise to Subscription activated Enterprise. - -If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key. - -If the computer has never been activated with a Pro key, run the following script. Copy the text below into a .cmd file and run the file from an elevated command prompt: - -
                                  -@echo off
-FOR /F "skip=1" %%A IN ('wmic path SoftwareLicensingService get OA3xOriginalProductKey') DO  ( 
-SET "ProductKey=%%A"
-goto InstallKey
-)
-
-:InstallKey
-IF [%ProductKey%]==[] (
-echo No key present
-) ELSE (
-echo Installing %ProductKey%
-changepk.exe /ProductKey %ProductKey%
-)
-
                                  - -### Obtaining an Azure AD licence - -Enterprise Agreement/Software Assurance (EA/SA): -- Organizations with a traditional EA must order a $0 SKU, process e-mails sent to the license administrator for the company, and assign licenses using Azure AD (ideally to groups using the new Azure AD Premium feature for group assignment). For more information, see [Enabling Subscription Activation with an existing EA](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses#enabling-subscription-activation-with-an-existing-ea). -- The license administrator can assign seats to Azure AD users with the same process that is used for O365. -- New EA/SA Windows Enterprise customers can acquire both an SA subscription and an associated $0 cloud subscription. - -Microsoft Products & Services Agreements (MPSA): -- Organizations with MPSA are automatically emailed the details of the new service. They must take steps to process the instructions. -- Existing MPSA customers will receive service activation emails that allow their customer administrator to assign users to the service. -- New MPSA customers who purchase the Software Subscription Windows Enterprise E3 and E5 will be enabled for both the traditional key-based and new subscriptions activation method. - -### Deploying licenses - -See [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). - -## Virtual Desktop Access (VDA) - -Subscriptions to Windows 10 Enterprise are also available for virtualized clients. Windows 10 Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Windows Azure or in another [qualified multitenant hoster](https://www.microsoft.com/en-us/CloudandHosting/licensing_sca.aspx). - -Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Azure Active Directory-joined clients are supported. See [Enable VDA for Subscription Activation](vda-subscription-activation.md). - -## Related topics - -[Connect domain-joined devices to Azure AD for Windows 10 experiences](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/) -
                                  [Compare Windows 10 editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare) -
                                  [Windows for business](https://www.microsoft.com/en-us/windowsforbusiness/default.aspx) diff --git a/windows/deployment/windows-10-media.md b/windows/deployment/windows-10-media.md index ab9ff889c0..24743735e8 100644 --- a/windows/deployment/windows-10-media.md +++ b/windows/deployment/windows-10-media.md @@ -1,12 +1,17 @@ --- title: Windows 10 volume license media -description: There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. +description: Learn about volume license media in Windows 10, and channels such as the Volume License Service Center (VLSC). keywords: deploy, upgrade, update, software, media ms.prod: w10 ms.mktglfcycl: plan ms.localizationpriority: medium ms.date: 10/20/2017 +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay ms.sitesec: library +audience: itpro author: greg-lindsay ms.topic: article --- @@ -26,7 +31,8 @@ To download Windows 10 installation media from the VLSC, use the product search When you select a product, for example “Windows 10 Enterprise” or “Windows 10 Education”, you can then choose the specific release by clicking **Download** and choosing the **Download Method**, **Language**, and **Operating system Type** (bitness). ->If you do not see a Windows 10 release available in the list of downloads, verify the [release date](https://technet.microsoft.com/windows/release-info.aspx). +> [!NOTE] +> If you do not see a Windows 10 release available in the list of downloads, verify the [release date](https://technet.microsoft.com/windows/release-info.aspx). In Windows 10, version 1709 the packaging of volume licensing media and upgrade packages is different than it has been for previous releases. Instead of having separate media and packages for Windows 10 Pro (volume licensing version), Windows 10 Enterprise, and Windows 10 Education, all three are bundled together. The following section explains this change. @@ -36,9 +42,9 @@ Windows 10, version 1709 is available starting on 10/17/2017 in all relevant dis For ISOs that you download from the VLSC or Visual Studio Subscriptions, you can still search for the individual Windows editions. However, each of these editions (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education) will point to the same ISO file, so you only need to download the ISO once. A single Windows image (WIM) file is included in the ISO that contains all the volume licensing images: -![Images](images\table01.png) +![Images](images/table01.png) -When using the contents of these ISOs with tools such as the Microsoft Deployment Toolkit or System Center Configuration Manager, make sure you select the appropriate image index in any task sequences that you create or update. +When using the contents of these ISOs with tools such as the Microsoft Deployment Toolkit or Microsoft Endpoint Configuration Manager, make sure you select the appropriate image index in any task sequences that you create or update. For packages published to Windows Server Update Services (WSUS), you’ll also notice the change because, instead of having separate packages for each Windows edition, there will be just one package: @@ -63,7 +69,7 @@ This Semi-Annual Channel release of Windows 10 continues the Windows as a servic See the following example for Windows 10, version 1709: -![Windows 10, version 1709 lang pack](images\lang-pack-1709.png) +![Windows 10, version 1709 lang pack](images/lang-pack-1709.png) ### Features on demand @@ -74,7 +80,7 @@ Features on demand is a method for adding features to your Windows 10 image that ## Related topics -[Microsoft Volume Licensing Service Center (VLSC) User Guide](https://www.microsoft.com/en-us/download/details.aspx?id=10585) +[Microsoft Volume Licensing Service Center (VLSC) User Guide](https://www.microsoft.com/download/details.aspx?id=10585)
                                  [Volume Activation for Windows 10](https://docs.microsoft.com/windows/deployment/volume-activation/volume-activation-windows-10)
                                  [Plan for volume activation](https://docs.microsoft.com/windows/deployment/volume-activation/plan-for-volume-activation-client)
                                  [VLSC downloads FAQ](https://www.microsoft.com/Licensing/servicecenter/Help/FAQDetails.aspx?id=150) diff --git a/windows/deployment/windows-10-missing-fonts.md b/windows/deployment/windows-10-missing-fonts.md index 708ffc8476..dfa95cf6e1 100644 --- a/windows/deployment/windows-10-missing-fonts.md +++ b/windows/deployment/windows-10-missing-fonts.md @@ -1,101 +1,103 @@ ---- -title: How to install fonts missing after upgrading to Windows 10 -description: Some of the fonts are missing from the system after you upgrade to Windows 10. -keywords: deploy, upgrade, FoD, optional feature -ms.prod: w10 -ms.mktglfcycl: plan -ms.sitesec: library -ms.localizationpriority: medium -author: kaushika-msft -ms.author: kaushika -ms.date: 10/31/2017 -ms.topic: article ---- -# How to install fonts that are missing after upgrading to Windows 10 - -> Applies to: Windows 10 - -When you upgrade from the Windows 7, Windows 8, or Windows 8.1 operating system to Windows 10, certain fonts are no longer available by default post-upgrade. To reduce the operating system footprint, improve performance, and optimize disk space usage, we moved many of the fonts that were previously shipped with prior versions of Windows to the optional features of Windows 10. If you install a fresh instance of Windows 10, or upgrade an older version of Windows to Windows 10, these optional features are not enabled by default. As a result, these fonts appear to be missing from the system. - -If you have documents created using the missing fonts, these documents might display differently on Windows 10. - -For example, if you have an English (or French, German, or Spanish) version of Windows 10 installed, you might notice that fonts such as the following are appear to be missing: - -- Gautami -- Meiryo -- Narkism/Batang -- BatangChe -- Dotum -- DotumChe -- Gulim -- GulimChe -- Gungsuh -- GungsuhChe - -If you want to use these fonts, you can enable the optional feature to add these back to your system. Be aware that this is a permanent change in behavior for Windows 10, and it will remain this way in future releases. - -## Installing language-associated features via language settings: - -If you want to use the fonts from the optional feature and you know that you will want to view Web pages, edit documents, or use apps in the language associated with that feature, add that language into your user profile. You do this the Settings app. - -For example, here are the steps to install the fonts associated with the Hebrew language: - -1. Click **Start > Settings**. -2. In Settings, click **Time & language**, and then click **Region & language**. -3. If Hebrew is not included in the list of languages, click the plus sign (**+**) to add a language. -4. Find Hebrew, and then click it to add it to your language list. - -Once you have added Hebrew to your language list, then the optional Hebrew font feature and other optional features for Hebrew language support are installed. This should only take a few minutes. - -> Note: The optional features are installed by Windows Update. This means you need to be online for the Windows Update service to work. - -## Install optional fonts manually without changing language settings: - -If you want to use fonts in an optional feature but don't need to search web pages, edit documents, or use apps in the associated language, you can install the optional font features manually without changing your language settings. - -For example, here are the steps to install the fonts associated with the Hebrew language without adding the Hebrew language itself to your language preferences: - -1. Click **Start > Settings**. -2. In Settings, click **Apps**, click **Apps & features**, and then click **Manage optional features**. - -3. If you don't see **Hebrew Supplemental Fonts** in the list of installed features, click the plus sign (**+**) to add a feature. -4. Select **Hebrew Supplemental Fonts** in the list, and then click **Install**. - -> Note: The optional features are installed by Windows Update. You need to be online for the Windows Update service to work. - -## Fonts included in optional font features - -Here is a comprehensive list of the font families in each of the optional features. Some font families might include multiple fonts for different weights and styles. - -- Arabic Script Supplemental Fonts: Aldhabi, Andalus, Arabic Typesetting, Microsoft Uighur, Sakkal Majalla, Simplified Arabic, Traditional Arabic, Urdu Typesetting -- Bangla Script Supplemental Fonts: Shonar Bangla, Vrinda -- Canadian Aboriginal Syllabics Supplemental Fonts: Euphemia -- Cherokee Supplemental Fonts: Plantagenet Cherokee -- Chinese (Simplified) Supplemental Fonts: DengXian, FangSong, KaiTi, SimHei -- Chinese (Traditional) Supplemental Fonts: DFKai-SB, MingLiU, MingLiU_HKSCS, PMingLiU -- Devanagari Supplemental Fonts: Aparajita, Kokila, Mangal, Sanskrit Text, Utsaah -- Ethiopic Supplemental Fonts: Nyala -- Gujarati Supplemental Fonts: Shruti -- Gurmukhi Supplemental Fonts: Raavi -- Hebrew Supplemental Fonts: Aharoni Bold, David, FrankRuehl, Gisha, Levanim MT, Miriam, Miriam Fixed, Narkism, Rod -- Japanese Supplemental Fonts: Meiryo, Meiryo UI, MS Gothic, MS PGothic, MS UI Gothic, MS Mincho, MS PMincho, Yu Mincho -- Kannada Supplemental Fonts: Tunga -- Khmer Supplemental Fonts: DaunPenh, Khmer UI, MoolBoran -- Korean Supplemental Fonts: Batang, BatangChe, Dotum, DotumChe, Gulim, GulimChe, Gungsuh, GungsuhChe -- Lao Supplemental Fonts: DokChampa, Lao UI -- Malayalam Supplemental Fonts: Karthika -- Odia Supplemental Fonts: Kalinga -- Pan-European Supplemental Fonts: Arial Nova, Georgia Pro, Gill Sans Nova, Neue Haas Grotesk, Rockwell Nova, Verdana Pro -- Sinhala Supplemental Fonts: Iskoola Pota -- Syriac Supplemental Fonts: Estrangelo Edessa -- Tamil Supplemental Fonts: Latha, Vijaya -- Telugu Supplemental Fonts: Gautami, Vani -- Thai Supplemental Fonts: Angsana New, AngsanaUPC, Browallia New, BrowalliaUPC, Cordia New, CordiaUPC, DilleniaUPC, EucrosiaUPC, FreesiaUPC, IrisUPC, JasmineUPC, KodchiangUPC, Leelawadee, LilyUPC - -## Related Topics - -[Download the list of all available language FODs](https://download.microsoft.com/download/0/A/A/0AA4342D-3933-4216-A90D-3BA8392FB1D1/Windows%2010%201703%20FOD%20to%20LP%20Mapping%20Table.xlsx) - -[Features On Demand V2 (Capabilities)](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities#span-idrelatedtopicsspanrelated-topics) - -[Add Language Packs to Windows](/windows-hardware/manufacture/desktop/add-language-packs-to-windows) +--- +title: How to install fonts missing after upgrading to Windows 10 +description: Some of the fonts are missing from the system after you upgrade to Windows 10. +keywords: deploy, upgrade, FoD, optional feature +ms.prod: w10 +ms.mktglfcycl: plan +ms.sitesec: library +ms.localizationpriority: medium +audience: itpro author: greg-lindsay +ms.audience: itpro author: greg-lindsay +ms.date: 10/31/2017 +ms.reviewer: +manager: laurawi +ms.topic: article +--- +# How to install fonts that are missing after upgrading to Windows 10 + +> Applies to: Windows 10 + +When you upgrade from the Windows 7, Windows 8, or Windows 8.1 operating system to Windows 10, certain fonts are no longer available by default post-upgrade. To reduce the operating system footprint, improve performance, and optimize disk space usage, we moved many of the fonts that were previously shipped with prior versions of Windows to the optional features of Windows 10. If you install a fresh instance of Windows 10, or upgrade an older version of Windows to Windows 10, these optional features are not enabled by default. As a result, these fonts appear to be missing from the system. + +If you have documents created using the missing fonts, these documents might display differently on Windows 10. + +For example, if you have an English (or French, German, or Spanish) version of Windows 10 installed, you might notice that fonts such as the following are appear to be missing: + +- Gautami +- Meiryo +- Narkism/Batang +- BatangChe +- Dotum +- DotumChe +- Gulim +- GulimChe +- Gungsuh +- GungsuhChe + +If you want to use these fonts, you can enable the optional feature to add these back to your system. Be aware that this is a permanent change in behavior for Windows 10, and it will remain this way in future releases. + +## Installing language-associated features via language settings: + +If you want to use the fonts from the optional feature and you know that you will want to view Web pages, edit documents, or use apps in the language associated with that feature, add that language into your user profile. You do this the Settings app. + +For example, here are the steps to install the fonts associated with the Hebrew language: + +1. Click **Start > Settings**. +2. In Settings, click **Time & language**, and then click **Region & language**. +3. If Hebrew is not included in the list of languages, click the plus sign (**+**) to add a language. +4. Find Hebrew, and then click it to add it to your language list. + +Once you have added Hebrew to your language list, then the optional Hebrew font feature and other optional features for Hebrew language support are installed. This should only take a few minutes. + +> Note: The optional features are installed by Windows Update. This means you need to be online for the Windows Update service to work. + +## Install optional fonts manually without changing language settings: + +If you want to use fonts in an optional feature but don't need to search web pages, edit documents, or use apps in the associated language, you can install the optional font features manually without changing your language settings. + +For example, here are the steps to install the fonts associated with the Hebrew language without adding the Hebrew language itself to your language preferences: + +1. Click **Start > Settings**. +2. In Settings, click **Apps**, click **Apps & features**, and then click **Manage optional features**. + +3. If you don't see **Hebrew Supplemental Fonts** in the list of installed features, click the plus sign (**+**) to add a feature. +4. Select **Hebrew Supplemental Fonts** in the list, and then click **Install**. + +> Note: The optional features are installed by Windows Update. You need to be online for the Windows Update service to work. + +## Fonts included in optional font features + +Here is a comprehensive list of the font families in each of the optional features. Some font families might include multiple fonts for different weights and styles. + +- Arabic Script Supplemental Fonts: Aldhabi, Andalus, Arabic Typesetting, Microsoft Uighur, Sakkal Majalla, Simplified Arabic, Traditional Arabic, Urdu Typesetting +- Bangla Script Supplemental Fonts: Shonar Bangla, Vrinda +- Canadian Aboriginal Syllabics Supplemental Fonts: Euphemia +- Cherokee Supplemental Fonts: Plantagenet Cherokee +- Chinese (Simplified) Supplemental Fonts: DengXian, FangSong, KaiTi, SimHei +- Chinese (Traditional) Supplemental Fonts: DFKai-SB, MingLiU, MingLiU_HKSCS, PMingLiU +- Devanagari Supplemental Fonts: Aparajita, Kokila, Mangal, Sanskrit Text, Utsaah +- Ethiopic Supplemental Fonts: Nyala +- Gujarati Supplemental Fonts: Shruti +- Gurmukhi Supplemental Fonts: Raavi +- Hebrew Supplemental Fonts: Aharoni Bold, David, FrankRuehl, Gisha, Levanim MT, Miriam, Miriam Fixed, Narkism, Rod +- Japanese Supplemental Fonts: Meiryo, Meiryo UI, MS Gothic, MS PGothic, MS UI Gothic, MS Mincho, MS PMincho, Yu Mincho +- Kannada Supplemental Fonts: Tunga +- Khmer Supplemental Fonts: DaunPenh, Khmer UI, MoolBoran +- Korean Supplemental Fonts: Batang, BatangChe, Dotum, DotumChe, Gulim, GulimChe, Gungsuh, GungsuhChe +- Lao Supplemental Fonts: DokChampa, Lao UI +- Malayalam Supplemental Fonts: Karthika +- Odia Supplemental Fonts: Kalinga +- Pan-European Supplemental Fonts: Arial Nova, Georgia Pro, Gill Sans Nova, Neue Haas Grotesk, Rockwell Nova, Verdana Pro +- Sinhala Supplemental Fonts: Iskoola Pota +- Syriac Supplemental Fonts: Estrangelo Edessa +- Tamil Supplemental Fonts: Latha, Vijaya +- Telugu Supplemental Fonts: Gautami, Vani +- Thai Supplemental Fonts: Angsana New, AngsanaUPC, Browallia New, BrowalliaUPC, Cordia New, CordiaUPC, DilleniaUPC, EucrosiaUPC, FreesiaUPC, IrisUPC, JasmineUPC, KodchiangUPC, Leelawadee, LilyUPC + +## Related Topics + +[Download the list of all available language FODs](https://download.microsoft.com/download/0/A/A/0AA4342D-3933-4216-A90D-3BA8392FB1D1/Windows%2010%201703%20FOD%20to%20LP%20Mapping%20Table.xlsx) + +[Features On Demand V2 (Capabilities)](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities#span-idrelatedtopicsspanrelated-topics) + +[Add Language Packs to Windows](/windows-hardware/manufacture/desktop/add-language-packs-to-windows) diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index 340920f673..a9ffbb1c73 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -8,6 +8,11 @@ ms.pagetype: deploy keywords: deployment, automate, tools, configure, mdt ms.localizationpriority: medium ms.date: 10/11/2017 +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +audience: itpro author: greg-lindsay ms.topic: article --- @@ -23,7 +28,7 @@ ms.topic: article - [Step by step guide: Configure a test lab to deploy Windows 10](windows-10-poc.md) Please complete all steps in the prerequisite guide before starting this guide. This guide requires about 5 hours to complete, but can require less time or more time depending on the speed of the Hyper-V host. After completing the current guide, also see the companion guide: -- [Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) +- [Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md) The PoC environment is a virtual network running on Hyper-V with three virtual machines (VMs): - **DC1**: A contoso.com domain controller, DNS server, and DHCP server. @@ -45,13 +50,13 @@ Topics and procedures in this guide are summarized in the following table. An es
                                  TopicDescriptionTime -
                                  [About MDT](#about-mdt)A high-level overview of the Microsoft Deployment Toolkit (MDT).Informational -
                                  [Install MDT](#install-mdt)Download and install MDT.40 minutes -
                                  [Create a deployment share and reference image](#create-a-deployment-share-and-reference-image)A reference image is created to serve as the template for deploying new images.90 minutes -
                                  [Deploy a Windows 10 image using MDT](#deploy-a-windows-10-image-using-mdt)The reference image is deployed in the PoC environment.60 minutes -
                                  [Refresh a computer with Windows 10](#refresh-a-computer-with-windows-10)Export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings.60 minutes -
                                  [Replace a computer with Windows 10](#replace-a-computer-with-windows-10)Back up an existing client computer, then restore this backup to a new computer.60 minutes -
                                  [Troubleshooting logs, events, and utilities](#troubleshooting-logs-events-and-utilities)Log locations and troubleshooting hints.Informational +
                                  About MDTA high-level overview of the Microsoft Deployment Toolkit (MDT).Informational +
                                  Install MDTDownload and install MDT.40 minutes +
                                  Create a deployment share and reference imageA reference image is created to serve as the template for deploying new images.90 minutes +
                                  Deploy a Windows 10 image using MDTThe reference image is deployed in the PoC environment.60 minutes +
                                  Refresh a computer with Windows 10Export user data from an existing client computer, wipe the computer, install a new operating system, and then restore user data and settings.60 minutes +
                                  Replace a computer with Windows 10Back up an existing client computer, then restore this backup to a new computer.60 minutes +
                                  Troubleshooting logs, events, and utilitiesLog locations and troubleshooting hints.Informational
                                  @@ -60,8 +65,8 @@ Topics and procedures in this guide are summarized in the following table. An es MDT performs deployments by using the Lite Touch Installation (LTI), Zero Touch Installation (ZTI), and User-Driven Installation (UDI) deployment methods. - LTI is the deployment method used in the current guide, requiring only MDT and performed with a minimum amount of user interaction. -- ZTI is fully automated, requiring no user interaction and is performed using MDT and System Center Configuration Manager. After completing the steps in the current guide, see [Step by step: Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md) to use the ZTI deployment method in the PoC environment. -- UDI requires manual intervention to respond to installation prompts such as machine name, password and language settings. UDI requires MDT and System Center Configuration Manager. +- ZTI is fully automated, requiring no user interaction and is performed using MDT and Microsoft Endpoint Configuration Manager. After completing the steps in the current guide, see [Step by step: Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md) to use the ZTI deployment method in the PoC environment. +- UDI requires manual intervention to respond to installation prompts such as machine name, password and language settings. UDI requires MDT and Microsoft Endpoint Configuration Manager. ## Install MDT @@ -72,7 +77,7 @@ MDT performs deployments by using the Lite Touch Installation (LTI), Zero Touch Set-ItemProperty -Path $AdminKey -Name “IsInstalled” -Value 0 Stop-Process -Name Explorer ``` -2. Download and install the 64-bit version of [Microsoft Deployment Toolkit (MDT)](https://www.microsoft.com/en-us/download/details.aspx?id=54259) on SRV1 using the default options. As of the writing of this guide, the latest version of MDT was 8443. +2. Download and install the 64-bit version of [Microsoft Deployment Toolkit (MDT)](https://www.microsoft.com/download/details.aspx?id=54259) on SRV1 using the default options. As of the writing of this guide, the latest version of MDT was 8443. 3. Download and install the latest [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) on SRV1 using the default installation settings. The current version is the ADK for Windows 10, version 1703. Installation might require several minutes to acquire all components. @@ -485,7 +490,7 @@ This section will demonstrate how to export user data from an existing client co cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs ``` - **Note**: Litetouch.vbs must be able to create the C:\MININT directory on the local computer. + **Note**: For more information on tools for viewing log files and to assist with troubleshooting, see [Configuration Manager Tools](https://docs.microsoft.com/configmgr/core/support/tools). 5. Choose the **Windows 10 Enterprise x64 Custom Image** and then click **Next**. @@ -494,12 +499,12 @@ This section will demonstrate how to export user data from an existing client co **Note**: The USMT will still back up the computer. 7. Lite Touch Installation will perform the following actions: - - Back up user settings and data using USMT. - - Install the Windows 10 Enterprise X64 operating system. - - Update the operating system via Windows Update. - - Restore user settings and data using USMT. + - Back up user settings and data using USMT. + - Install the Windows 10 Enterprise X64 operating system. + - Update the operating system via Windows Update. + - Restore user settings and data using USMT. - You can review the progress of installation on SRV1 by clicking on the **Monitoring** node in the deployment workbench. When OS installation is complete, the computer will restart, set up devices, and configure settings. + You can review the progress of installation on SRV1 by clicking on the **Monitoring** node in the deployment workbench. When OS installation is complete, the computer will restart, set up devices, and configure settings. 8. Sign in with the CONTOSO\Administrator account and verify that all CONTOSO domain user accounts and data have been migrated to the new operating system, or other user accounts as specified [previously](#configure-the-mdt-production-deployment-share). @@ -560,18 +565,18 @@ At a high level, the computer replace process consists of:
                                  Remove-Item c:\_SMSTaskSequence -recurse Restart-Computer ``` -2. Sign in to PC1 using the contoso\administrator account, and then type the following at an elevated command prompt: +3. Sign in to PC1 using the contoso\administrator account, and then type the following at an elevated command prompt: ``` cscript \\SRV1\MDTProd$\Scripts\Litetouch.vbs ``` -3. Complete the deployment wizard using the following: +4. Complete the deployment wizard using the following: - **Task Sequence**: Backup Only Task Sequence - **User Data**: Specify a location: **\\\\SRV1\MigData$\PC1** - **Computer Backup**: Do not back up the existing computer. -4. While the task sequence is running on PC1, open the deployment workbench console on SRV1 and click the **Monitoring* node. Press F5 to refresh the console, and view the status of current tasks. -5. On PC1, verify that **The user state capture was completed successfully** is displayed, and click **Finish** when the capture is complete. -6. On SRV1, verify that the file **USMT.MIG** was created in the **C:\MigData\PC1\USMT** directory. See the following example: +5. While the task sequence is running on PC1, open the deployment workbench console on SRV1 and click the **Monitoring* node. Press F5 to refresh the console, and view the status of current tasks. +6. On PC1, verify that **The user state capture was completed successfully** is displayed, and click **Finish** when the capture is complete. +7. On SRV1, verify that the file **USMT.MIG** was created in the **C:\MigData\PC1\USMT** directory. See the following example: ``` PS C:\> dir C:\MigData\PC1\USMT @@ -582,15 +587,15 @@ At a high level, the computer replace process consists of:
                                  ---- ------------- ------ ---- -a--- 9/6/2016 11:34 AM 14248685 USMT.MIG ``` -### Deploy PC3 + ### Deploy PC3 -1. On the Hyper-V host, type the following commands at an elevated Windows PowerShell prompt: +8. On the Hyper-V host, type the following commands at an elevated Windows PowerShell prompt: ``` New-VM –Name "PC3" –NewVHDPath "c:\vhd\pc3.vhdx" -NewVHDSizeBytes 60GB -SwitchName poc-internal -BootDevice NetworkAdapter -Generation 2 Set-VMMemory -VMName "PC3" -DynamicMemoryEnabled $true -MinimumBytes 512MB -MaximumBytes 2048MB -Buffer 20 ``` -2. Temporarily disable the external network adapter on SRV1 again, so that we can successfully boot PC3 from WDS. To disable the adapter, type the following command at an elevated Windows PowerShell prompt on SRV1: +9. Temporarily disable the external network adapter on SRV1 again, so that we can successfully boot PC3 from WDS. To disable the adapter, type the following command at an elevated Windows PowerShell prompt on SRV1: ``` Disable-NetAdapter "Ethernet 2" -Confirm:$false @@ -599,32 +604,32 @@ At a high level, the computer replace process consists of:
                                  >As mentioned previously, ensure that you disable the **external** network adapter, and wait for the command to complete before proceeding. -3. Start and connect to PC3 by typing the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: +10. Start and connect to PC3 by typing the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: - ``` - Start-VM PC3 - vmconnect localhost PC3 - ``` + ``` + Start-VM PC3 + vmconnect localhost PC3 + ``` -4. When prompted, press ENTER for network boot. +11. When prompted, press ENTER for network boot. -6. On PC3, use the following settings for the Windows Deployment Wizard: - - **Task Sequence**: Windows 10 Enterprise x64 Custom Image - - **Move Data and Settings**: Do not move user data and settings - - **User Data (Restore)**: Specify a location: **\\\\SRV1\MigData$\PC1** +12. On PC3, use the following settings for the Windows Deployment Wizard: + - **Task Sequence**: Windows 10 Enterprise x64 Custom Image + - **Move Data and Settings**: Do not move user data and settings + - **User Data (Restore)**: Specify a location: **\\\\SRV1\MigData$\PC1** -5. When OS installation has started on PC1, re-enable the external network adapter on SRV1 by typing the following command on SRV1: +13. When OS installation has started on PC1, re-enable the external network adapter on SRV1 by typing the following command on SRV1: - ``` - Enable-NetAdapter "Ethernet 2" - ``` -7. Setup will install the Windows 10 Enterprise operating system, update via Windows Update, and restore the user settings and data from PC1. + ``` + Enable-NetAdapter "Ethernet 2" + ``` +14. Setup will install the Windows 10 Enterprise operating system, update via Windows Update, and restore the user settings and data from PC1. -8. When PC3 has completed installing the OS, sign in to PC3 using the contoso\administrator account. When the PC completes updating, click **Finish**. +15. When PC3 has completed installing the OS, sign in to PC3 using the contoso\administrator account. When the PC completes updating, click **Finish**. -9. Verify that settings have been migrated from PC1. This completes demonstration of the replace procedure. +16. Verify that settings have been migrated from PC1. This completes demonstration of the replace procedure. -10. Shut down PC3 in preparation for the [next](windows-10-poc-sc-config-mgr.md) procedure. +17. Shut down PC3 in preparation for the [next](windows-10-poc-sc-config-mgr.md) procedure. ## Troubleshooting logs, events, and utilities @@ -635,7 +640,7 @@ Deployment logs are available on the client computer in the following locations: You can review WDS events in Event Viewer at: **Applications and Services Logs > Microsoft > Windows > Deployment-Services-Diagnostics**. By default, only the **Admin** and **Operational** logs are enabled. To enable other logs, right-click the log and then click **Enable Log**. -Tools for viewing log files, and to assist with troubleshooting are available in the [System Center 2012 R2 Configuration Manager Toolkit](https://www.microsoft.com/en-us/download/details.aspx?id=50012) +Tools for viewing log files, and to assist with troubleshooting are available in the [System Center 2012 R2 Configuration Manager Toolkit](https://www.microsoft.com/download/details.aspx?id=50012) Also see [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) for detailed troubleshooting information. @@ -644,7 +649,7 @@ Also see [Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade- [Microsoft Deployment Toolkit](https://technet.microsoft.com/windows/dn475741)
                                  [Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md) -  + diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index a83edcf57d..fc6a392e8f 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -1,6 +1,6 @@ --- -title: Step by step - Deploy Windows 10 using System Center Configuration Manager -description: Deploy Windows 10 in a test lab using System Center Configuration Manager +title: Step by step - Deploy Windows 10 using Microsoft Endpoint Configuration Manager +description: Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -8,11 +8,16 @@ ms.pagetype: deploy keywords: deployment, automate, tools, configure, sccm ms.localizationpriority: medium ms.date: 10/11/2017 +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +audience: itpro author: greg-lindsay ms.topic: article --- -# Deploy Windows 10 in a test lab using System Center Configuration Manager +# Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager **Applies to** @@ -34,7 +39,7 @@ This guide leverages the Hyper-V server role to perform procedures. If you do no ## In this guide -This guide provides end-to-end instructions to install and configure System Center Configuration Manager, and use it to deploy a Windows 10 image. Depending on the speed of your Hyper-V host, the procedures in this guide will require 6-10 hours to complete. +This guide provides end-to-end instructions to install and configure Microsoft Endpoint Configuration Manager, and use it to deploy a Windows 10 image. Depending on the speed of your Hyper-V host, the procedures in this guide will require 6-10 hours to complete. Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. @@ -44,24 +49,24 @@ Topics and procedures in this guide are summarized in the following table. An es
                                  TopicDescriptionTime -
                                  [Install prerequisites](#install-prerequisites)Install prerequisite Windows Server roles and features, download, install and configure SQL Server, configure firewall rules, and install the Windows ADK.60 minutes -
                                  [Install System Center Configuration Manager](#install-system-center-configuration-manager)Download System Center Configuration Manager, configure prerequisites, and install the package.45 minutes -
                                  [Download MDOP and install DaRT](#download-mdop-and-install-dart)Download the Microsoft Desktop Optimization Pack 2015 and install DaRT 10.15 minutes -
                                  [Prepare for Zero Touch installation](#prepare-for-zero-touch-installation)Prerequisite procedures to support Zero Touch installation.60 minutes -
                                  [Create a boot image for Configuration Manager](#create-a-boot-image-for-configuration-manager)Use the MDT wizard to create the boot image in Configuration Manager.20 minutes -
                                  [Create a Windows 10 reference image](#create-a-windows-10-reference-image)This procedure can be skipped if it was done previously, otherwise instructions are provided to create a reference image.0-60 minutes -
                                  [Add a Windows 10 operating system image](#add-a-windows-10-operating-system-image)Add a Windows 10 operating system image and distribute it.10 minutes
                                  [Create a task sequence](#create-a-task-sequence)Create a Configuration Manager task sequence with MDT integration using the MDT wizard15 minutes -
                                  [Finalize the operating system configuration](#finalize-the-operating-system-configuration)Enable monitoring, configure rules, and distribute content.30 minutes -
                                  [Deploy Windows 10 using PXE and Configuration Manager](#deploy-windows-10-using-pxe-and-configuration-manager)Deploy Windows 10 using Configuration Manager deployment packages and task sequences.60 minutes -
                                  [Replace a client with Windows 10 using Configuration Manager](#replace-a-client-with-windows-10-using-configuration-manager)Replace a client computer with Windows 10 using Configuration Manager.90 minutes -
                                  [Refresh a client with Windows 10 using Configuration Manager](#refresh-a-client-with-windows-10-using-configuration-manager)Use a task sequence to refresh a client with Windows 10 using Configuration Manager and MDT90 minutes +
                                  Install prerequisitesInstall prerequisite Windows Server roles and features, download, install and configure SQL Server, configure firewall rules, and install the Windows ADK.60 minutes +
                                  Install Microsoft Endpoint Configuration ManagerDownload Microsoft Endpoint Configuration Manager, configure prerequisites, and install the package.45 minutes +
                                  Download MDOP and install DaRTDownload the Microsoft Desktop Optimization Pack 2015 and install DaRT 10.15 minutes +
                                  Prepare for Zero Touch installationPrerequisite procedures to support Zero Touch installation.60 minutes +
                                  Create a boot image for Configuration ManagerUse the MDT wizard to create the boot image in Configuration Manager.20 minutes +
                                  Create a Windows 10 reference imageThis procedure can be skipped if it was done previously, otherwise instructions are provided to create a reference image.0-60 minutes +
                                  Add a Windows 10 operating system imageAdd a Windows 10 operating system image and distribute it.10 minutes
                                  Create a task sequenceCreate a Configuration Manager task sequence with MDT integration using the MDT wizard15 minutes +
                                  Finalize the operating system configurationEnable monitoring, configure rules, and distribute content.30 minutes +
                                  Deploy Windows 10 using PXE and Configuration ManagerDeploy Windows 10 using Configuration Manager deployment packages and task sequences.60 minutes +
                                  Replace a client with Windows 10 using Configuration ManagerReplace a client computer with Windows 10 using Configuration Manager.90 minutes +
                                  Refresh a client with Windows 10 using Configuration ManagerUse a task sequence to refresh a client with Windows 10 using Configuration Manager and MDT90 minutes
                                  ## Install prerequisites -1. Before installing System Center Configuration Manager, we must install prerequisite services and features. Type the following command at an elevated Windows PowerShell prompt on SRV1: +1. Before installing Microsoft Endpoint Configuration Manager, we must install prerequisite services and features. Type the following command at an elevated Windows PowerShell prompt on SRV1: ``` Install-WindowsFeature Web-Windows-Auth,Web-ISAPI-Ext,Web-Metabase,Web-WMI,BITS,RDC,NET-Framework-Features,Web-Asp-Net,Web-Asp-Net45,NET-HTTP-Activation,NET-Non-HTTP-Activ @@ -69,7 +74,7 @@ Topics and procedures in this guide are summarized in the following table. An es >If the request to add features fails, retry the installation by typing the command again. -2. Download [SQL Server 2014 SP2](https://www.microsoft.com/en-us/evalcenter/evaluate-sql-server-2014-sp2) from the Microsoft Evaluation Center as an .ISO file on the Hyper-V host computer. Save the file to the **C:\VHD** directory. +2. Download [SQL Server 2014 SP2](https://www.microsoft.com/evalcenter/evaluate-sql-server-2014-sp2) from the Microsoft Evaluation Center as an .ISO file on the Hyper-V host computer. Save the file to the **C:\VHD** directory. 3. When you have downloaded the file **SQLServer2014SP2-FullSlipstream-x64-ENU.iso** and placed it in the C:\VHD directory, type the following command at an elevated Windows PowerShell prompt on the Hyper-V host: ``` @@ -113,7 +118,7 @@ Topics and procedures in this guide are summarized in the following table. An es 7. Download and install the latest [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) on SRV1 using the default installation settings. The current version is the ADK for Windows 10, version 1703. Installation might require several minutes to acquire all components. -## Install System Center Configuration Manager +## Install Microsoft Endpoint Configuration Manager 1. On SRV1, temporarily disable IE Enhanced Security Configuration for Administrators by typing the following commands at an elevated Windows PowerShell prompt: @@ -123,7 +128,7 @@ Topics and procedures in this guide are summarized in the following table. An es Stop-Process -Name Explorer ``` -2. Download [System Center Configuration Manager and Endpoint Protection](https://www.microsoft.com/en-us/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) on SRV1 (download the executable file anywhere on SRV1), double-click the file, enter **C:\configmgr** for **Unzip to folder**, and click **Unzip**. The C:\configmgr directory will be automatically created. Click **OK** and then close the **WinZip Self-Extractor** dialog box when finished. +2. Download [Microsoft Endpoint Configuration Manager and Endpoint Protection](https://www.microsoft.com/evalcenter/evaluate-system-center-configuration-manager-and-endpoint-protection) on SRV1 (download the executable file anywhere on SRV1), double-click the file, enter **C:\configmgr** for **Unzip to folder**, and click **Unzip**. The C:\configmgr directory will be automatically created. Click **OK** and then close the **WinZip Self-Extractor** dialog box when finished. 3. Before starting the installation, verify that WMI is working on SRV1. See the following examples. Verify that **Running** is displayed under **Status** and **True** is displayed next to **TcpTestSucceeded**: @@ -181,7 +186,7 @@ Topics and procedures in this guide are summarized in the following table. An es ``` cmd /c C:\configmgr\SMSSETUP\BIN\X64\Setup.exe ``` -18. Provide the following in the System Center Configuration Manager Setup Wizard: +18. Provide the following in the Microsoft Endpoint Configuration Manager Setup Wizard: - **Before You Begin**: Read the text and click *Next*. - **Getting Started**: Choose **Install a Configuration Manager primary site** and select the **Use typical installation options for a stand-alone primary site** checkbox. - Click **Yes** in response to the popup window. @@ -235,7 +240,7 @@ Topics and procedures in this guide are summarized in the following table. An es ## Prepare for Zero Touch installation -This section contains several procedures to support Zero Touch installation with System Center Configuration Manager. +This section contains several procedures to support Zero Touch installation with Microsoft Endpoint Configuration Manager. ### Create a folder structure @@ -274,7 +279,7 @@ This section contains several procedures to support Zero Touch installation with 3. On the **Network Access Account** tab, choose **Specify the account that accesses network locations**. 4. Click the yellow starburst and then click **New Account**. 5. Click **Browse** and then under **Enter the object name to select**, type **CM_NAA** and click **OK**. -6. Next to **Password** and **Confirm Password**, type **pass@word1**, and then click **OK** twice. +6. Next to **Password** and **Confirm Password**, type pass@word1, and then click **OK** twice. ### Configure a boundary group @@ -303,26 +308,26 @@ This section contains several procedures to support Zero Touch installation with WDSUTIL /Set-Server /AnswerClients:None ``` -1. Deterime the MAC address of the internal network adapter on SRV1. To determine this, type the following command at an elevated Windows PowerShell prompt on SRV1: +1. Determine the MAC address of the internal network adapter on SRV1. To determine this, type the following command at an elevated Windows PowerShell prompt on SRV1: ``` (Get-NetAdapter "Ethernet").MacAddress ``` >If the internal network adapter, assigned an IP address of 192.168.0.2, is not named "Ethernet" then replace the name "Ethernet" in the previous command with the name of this network adapter. You can review the names of network adapters and the IP addresses assigned to them by typing **ipconfig**. -2. In the System Center Configuration Manager console, in the **Administration** workspace, click **Distribution Points**. +2. In the Microsoft Endpoint Configuration Manager console, in the **Administration** workspace, click **Distribution Points**. 3. In the display pane, right-click **SRV1.CONTOSO.COM** and then click **Properties**. 4. On the PXE tab, select the following settings: - - **Enable PXE support for clients**. Click **Yes** in the popup that appears. - - **Allow this distribution point to respond to incoming PXE requests** - - **Enable unknown computer support**. Click **OK** in the popup that appears. - - **Require a password when computers use PXE** - - **Password** and **Confirm password**: pass@word1 - - **Respond to PXE requests on specific network interfaces**: Click the yellow starburst and then enter the MAC address determined in the first step of this procedure. + - **Enable PXE support for clients**. Click **Yes** in the popup that appears. + - **Allow this distribution point to respond to incoming PXE requests** + - **Enable unknown computer support**. Click **OK** in the popup that appears. + - **Require a password when computers use PXE** + - **Password** and **Confirm password**: pass@word1 + - **Respond to PXE requests on specific network interfaces**: Click the yellow starburst and then enter the MAC address determined in the first step of this procedure. - See the following example: + See the following example: - Config Mgr PXE + Config Mgr PXE 5. Click **OK**. 6. Wait for a minute, then type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present: @@ -592,20 +597,20 @@ If you have already completed steps in [Deploy Windows 10 in a test lab using Mi 3. On the General page, type **Windows 10 Enterprise x64** under **Task sequence name:** and then click **Next**. 4. On the Details page, enter the following settings: - - Join a domain: **contoso.com** - - Account: click **Set** - - User name: **contoso\CM_JD** - - Password: **pass@word1** - - Confirm password: **pass@word1** - - Click **OK** - - Windows Settings - - User name: **Contoso** - - Organization name: **Contoso** - - Product key: \ - - Administrator Account: **Enable the account and specify the local administrator password** - - Password: **pass@word1** - - Confirm password: **pass@word1** - - Click **Next** + - Join a domain: **contoso.com** + - Account: click **Set** + - User name: **contoso\CM_JD** + - Password: pass@word1 + - Confirm password: pass@word1 + - Click **OK** + - Windows Settings + - User name: **Contoso** + - Organization name: **Contoso** + - Product key: \ + - Administrator Account: **Enable the account and specify the local administrator password** + - Password: pass@word1 + - Confirm password: pass@word1 + - Click **Next** 5. On the Capture Settings page, accept the default settings and click **Next**. @@ -750,20 +755,20 @@ In this first deployment scenario, we will deploy Windows 10 using PXE. This sce 2. Press ENTER when prompted to start the network boot service. -3. In the Task Sequence Wizard, provide the password: **pass@word1**, and then click **Next**. +3. In the Task Sequence Wizard, provide the password: pass@word1, and then click **Next**. 4. Before you click **Next** in the Task Sequence Wizard, press the **F8** key. A command prompt will open. 5. At the command prompt, type **explorer.exe** and review the Windows PE file structure. 6. The smsts.log file is critical for troubleshooting any installation problems that might be encountered. Depending on the deployment phase, the smsts.log file is created in different locations: - - X:\windows\temp\SMSTSLog\smsts.log before disks are formatted. - - x:\smstslog\smsts.log after disks are formatted. - - c:\_SMSTaskSequence\Logs\Smstslog\smsts.log before the System Center Configuration Manager client is installed. - - c:\windows\ccm\logs\Smstslog\smsts.log after the System Center Configuration Manager client is installed. - - c:\windows\ccm\logs\smsts.log when the task sequence is complete. + - X:\windows\temp\SMSTSLog\smsts.log before disks are formatted. + - x:\smstslog\smsts.log after disks are formatted. + - c:\_SMSTaskSequence\Logs\Smstslog\smsts.log before the Microsoft Endpoint Configuration Manager client is installed. + - c:\windows\ccm\logs\Smstslog\smsts.log after the Microsoft Endpoint Configuration Manager client is installed. + - c:\windows\ccm\logs\smsts.log when the task sequence is complete. - Note: If a reboot is pending on the client, the reboot will be blocked as long as the command window is open. + Note: If a reboot is pending on the client, the reboot will be blocked as long as the command window is open. 7. In the explorer window, click **Tools** and then click **Map Network Drive**. @@ -790,7 +795,7 @@ In this first deployment scenario, we will deploy Windows 10 using PXE. This sce ## Replace a client with Windows 10 using Configuration Manager ->Before starting this section, you can delete computer objects from Active Directory that were created as part of previous deployment procedures. Use the Active Directory Users and Computers console on DC1 to remove stale entries under contoto.com\Computers, but do not delete the computer account (hostname) for PC1. There should be at least two computer accounts present in the contoso.com\Computers container: one for SRV1, and one for the hostname of PC1. It is not required to delete the stale entries, this is only done to remove clutter. +>Before starting this section, you can delete computer objects from Active Directory that were created as part of previous deployment procedures. Use the Active Directory Users and Computers console on DC1 to remove stale entries under contoso.com\Computers, but do not delete the computer account (hostname) for PC1. There should be at least two computer accounts present in the contoso.com\Computers container: one for SRV1, and one for the hostname of PC1. It is not required to delete the stale entries, this is only done to remove clutter. ![contoso.com\Computers](images/poc-computers.png) @@ -837,7 +842,7 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF Checkpoint-VM -Name PC1 -SnapshotName BeginState ``` -3. On SRV1, in the Configuration Manager console, in the Administration workspace, expand **Hierarcy Configuration** and click on **Discovery Methods**. +3. On SRV1, in the Configuration Manager console, in the Administration workspace, expand **Hierarchy Configuration** and click on **Discovery Methods**. 4. Double-click **Active Directory System Discovery** and on the **General** tab select the **Enable Active Directory System Discovery** checkbox. 5. Click the yellow starburst, click **Browse**, select **contoso\Computers**, and then click **OK** three times. 6. When a popup dialog box asks if you want to run full discovery, click **Yes**. @@ -927,7 +932,7 @@ Set-VMNetworkAdapter -VMName PC4 -StaticMacAddress 00-15-5D-83-26-FF 4. In the Software Library workspace, expand **Operating Systems**, click **Task Sequences**, right-click **Windows 10 Enterprise x64** and then click **Deploy**. -5. Use the following settings in the Deploy Sofware wizard: +5. Use the following settings in the Deploy Software wizard: - General > Collection: Click Browse and select **Install Windows 10 Enterprise x64**
                                  - Deployment Settings > Purpose: **Available**
                                  - Deployment Settings > Make available to the following: **Configuration Manager clients, media and PXE**
                                  @@ -1029,7 +1034,7 @@ In the Configuration Manager console, in the Software Library workspace under Op Start-VM PC4 vmconnect localhost PC4 ``` -2. In the **Welcome to the Task Sequence Wizard**, enter **pass@word1** and click **Next**. +2. In the **Welcome to the Task Sequence Wizard**, enter pass@word1 and click **Next**. 3. Choose the **Windows 10 Enterprise X64** image. 4. Setup will install the operating system using the Windows 10 Enterprise x64 reference image, install the configuration manager client, join PC4 to the domain, and restore users and settings from PC1. 5. Save checkpoints for all VMs if you wish to review their status at a later date. This is not required (checkpoints do take up space on the Hyper-V host). Note: the next procedure will install a new OS on PC1 update its status in Configuration Manager and in Active Directory as a Windows 10 device, so you cannot return to a previous checkpoint only on the PC1 VM without a conflict. Therefore, if you do create a checkpoint, you should do this for all VMs. @@ -1049,8 +1054,8 @@ In the Configuration Manager console, in the Software Library workspace under Op 1. On SRV1, in the Assets and Compliance workspace, click **Device Collections** and then double-click **Install Windows 10 Enterprise x64**. 2. Right-click the computer account for PC1, point to **Client Notification**, click **Download Computer Policy**, and click **OK** in the popup dialog box. -3. On PC1, in the notification area, click **New sofware is available** and then click **Open Sofware Center**. -4. In the Sofware Center, click **Operating Systems**, click **Windows 10 Enterprise x64**, click **Install** and then click **INSTALL OPERATING SYSTEM**. See the following example: +3. On PC1, in the notification area, click **New software is available** and then click **Open Software Center**. +4. In the Software Center, click **Operating Systems**, click **Windows 10 Enterprise x64**, click **Install** and then click **INSTALL OPERATING SYSTEM**. See the following example: ![installOS](images/sccm-install-os.png) @@ -1070,7 +1075,7 @@ In the Configuration Manager console, in the Software Library workspace under Op [System Center 2012 Configuration Manager Survival Guide](https://social.technet.microsoft.com/wiki/contents/articles/7075.system-center-2012-configuration-manager-survival-guide.aspx#Step-by-Step_Guides) -  + diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index 08755c35c9..2b72ab624c 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -1,5 +1,9 @@ --- title: Configure a test lab to deploy Windows 10 +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay description: Concepts and procedures for deploying Windows 10 in a proof of concept lab environment. ms.prod: w10 ms.mktglfcycl: deploy @@ -7,7 +11,7 @@ ms.sitesec: library ms.pagetype: deploy keywords: deployment, automate, tools, configure, mdt, sccm ms.localizationpriority: medium -ms.date: 11/16/2017 +audience: itpro author: greg-lindsay ms.topic: article --- @@ -21,7 +25,7 @@ ms.topic: article This guide contains instructions to configure a proof of concept (PoC) environment requiring a minimum amount of resources. The guide makes extensive use of Windows PowerShell and Hyper-V. Subsequent companion guides contain steps to deploy Windows 10 using the PoC environment. After completing this guide, see the following Windows 10 PoC deployment guides: - [Step by step: Deploy Windows 10 in a test lab using MDT](windows-10-poc-mdt.md)
                                  -- [Step by step: Deploy Windows 10 in a test lab using System Center Configuration Manager](windows-10-poc-sc-config-mgr.md)
                                  +- [Step by step: Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md)
                                  The PoC deployment guides are intended to provide a demonstration of Windows 10 deployment tools and processes for IT professionals that are not familiar with these tools, and those that are interested in setting up a proof of concept environment. The instructions in this guide should not be used in a production setting, and are not meant to replace the instructions found in production deployment guidance. @@ -29,9 +33,9 @@ Approximately 3 hours are required to configure the PoC environment. You will ne Windows PowerShell commands are provided to set up the PoC environment quickly. You do not need to be an expert in Windows PowerShell to complete the steps in the guide, however you are required to customize some commands to your environment. ->Instructions to "type" Windows PowerShell commands provided in this guide can be followed literally by typing the commands, but the preferred method is to copy and paste these commands. - ->A Windows PowerShell window can be used to run all commands in this guide. However, when commands are specified for a command prompt, you must either type CMD at the Windows PowerShell prompt to enter the command prompt, or preface the command with "cmd /c", or if desired you can escape special characters in the command using the back-tick character (`). In most cases, the simplest thing is to type cmd and enter a command prompt, type the necessary commands, then type "exit" to return to Windows PowerShell. +> Instructions to "type" Windows PowerShell commands provided in this guide can be followed literally by typing the commands, but the preferred method is to copy and paste these commands. +> +> A Windows PowerShell window can be used to run all commands in this guide. However, when commands are specified for a command prompt, you must either type CMD at the Windows PowerShell prompt to enter the command prompt, or preface the command with "cmd /c", or if desired you can escape special characters in the command using the back-tick character (`). In most cases, the simplest thing is to type cmd and enter a command prompt, type the necessary commands, then type "exit" to return to Windows PowerShell. Hyper-V is installed, configured and used extensively in this guide. If you are not familiar with Hyper-V, review the [terminology](#appendix-b-terminology-used-in-this-guide) used in this guide before starting. @@ -48,19 +52,19 @@ Topics and procedures in this guide are summarized in the following table. An es
                                  - - +
                                  TopicDescriptionTime
                                  [Hardware and software requirements](#hardware-and-software-requirements)Prerequisites to complete this guide.Informational -
                                  [Lab setup](#lab-setup)A description and diagram of the PoC environment.Informational -
                                  [Configure the PoC environment](#configure-the-poc-environment)Parent topic for procedures.Informational -
                                  [Verify support and install Hyper-V](#verify-support-and-install-hyper-v)Verify that installation of Hyper-V is supported, and install the Hyper-V server role.10 minutes -
                                  [Download VHD and ISO files](#download-vhd-and-iso-files)Download evaluation versions of Windows Server 2012 R2 and Windows 10 and prepare these files to be used on the Hyper-V host.30 minutes -
                                  [Convert PC to VM](#convert-pc-to-vm)Convert a physical computer on your network to a VM hosted in Hyper-V.30 minutes -
                                  [Resize VHD](#resize-vhd)Increase the storage capacity for one of the Windows Server VMs.5 minutes -
                                  [Configure Hyper-V](#configure-hyper-v)Create virtual switches, determine available RAM for virtual machines, and add virtual machines.15 minutes -
                                  [Configure service and user accounts](#configure-service-and-user-accounts)Start virtual machines and configure all services and settings.60 minutes -
                                  [Configure VMs](#configure-vms)Start virtual machines and configure all services and settings.60 minutes -
                                  [Appendix A: Verify the configuration](#appendix-a-verify-the-configuration)Verify and troubleshoot network connectivity and services in the PoC environment.30 minutes -
                                  [Appendix B: Terminology in this guide](#appendix-b-terminology-used-in-this-guide)Terms used in this guide.Informational +
                                  TopicDescriptionTime
                                  Hardware and software requirementsPrerequisites to complete this guide.Informational +
                                  Lab setupA description and diagram of the PoC environment.Informational +
                                  Configure the PoC environmentParent topic for procedures.Informational +
                                  Verify support and install Hyper-VVerify that installation of Hyper-V is supported, and install the Hyper-V server role.10 minutes +
                                  Download VHD and ISO filesDownload evaluation versions of Windows Server 2012 R2 and Windows 10 and prepare these files to be used on the Hyper-V host.30 minutes +
                                  Convert PC to VMConvert a physical computer on your network to a VM hosted in Hyper-V.30 minutes +
                                  Resize VHDIncrease the storage capacity for one of the Windows Server VMs.5 minutes +
                                  Configure Hyper-VCreate virtual switches, determine available RAM for virtual machines, and add virtual machines.15 minutes +
                                  Configure service and user accountsStart virtual machines and configure all services and settings.60 minutes +
                                  Configure VMsStart virtual machines and configure all services and settings.60 minutes +
                                  Appendix A: Verify the configurationVerify and troubleshoot network connectivity and services in the PoC environment.30 minutes +
                                  Appendix B: Terminology in this guideTerms used in this guide.Informational
                                  @@ -71,59 +75,59 @@ One computer that meets the hardware and software specifications below is requir - **Computer 1**: the computer you will use to run Hyper-V and host virtual machines. This computer should have 16 GB or more of installed RAM and a multi-core processor. - **Computer 2**: a client computer from your corporate network. It is shadow-copied to create a VM that can be added to the PoC environment, enabling you to test a mirror image of a computer on your network. If you do not have a computer to use for this simulation, you can download an evaluation VHD and use it to represent this computer. Subsequent guides use this computer to simulate Windows 10 replace and refresh scenarios, so the VM is required even if you cannot create this VM using computer 2. -Harware requirements are displayed below: +Hardware requirements are displayed below:
                                  - - + + - + - + - - + + - + - + - + +
                                  16 GB RAM to test Windows 10 deployment with Microsoft Endpoint Configuration Manager. - + - + - + @@ -218,25 +222,25 @@ Starting with Windows 8, the host computer’s microprocessor must support secon ![hyper-v](images/svr_mgr2.png) -

                                  If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under **Role Administration Tools\Hyper-V Management Tools**. +

                                  If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. ### Download VHD and ISO files -When you have completed installation of Hyper-V on the host computer, begin configuration of Hyper-V by downloading VHD and ISO files to the Hyper-V host. These files will be used to create the VMs used in the lab. Before you can download VHD and ISO files, you will need to register and sign in to the [TechNet Evaluation Center](https://www.microsoft.com/en-us/evalcenter/) using your Microsoft account. +When you have completed installation of Hyper-V on the host computer, begin configuration of Hyper-V by downloading VHD and ISO files to the Hyper-V host. These files will be used to create the VMs used in the lab. Before you can download VHD and ISO files, you will need to register and sign in to the [TechNet Evaluation Center](https://www.microsoft.com/evalcenter/) using your Microsoft account. -1. Create a directory on your Hyper-V host named **C:\VHD** and download a single [Windows Server 2012 R2 VHD](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2012-r2) from the TechNet Evaluation Center to the **C:\VHD** directory. +1. Create a directory on your Hyper-V host named **C:\VHD** and download a single [Windows Server 2012 R2 VHD](https://www.microsoft.com/evalcenter/evaluate-windows-server-2012-r2) from the TechNet Evaluation Center to the **C:\VHD** directory. **Important**: This guide assumes that VHDs are stored in the **C:\VHD** directory on the Hyper-V host. If you use a different directory to store VHDs, you must adjust steps in this guide appropriately. After completing registration you will be able to download the 7.47 GB Windows Server 2012 R2 evaluation VHD. An example of the download offering is shown below.

                                  **Computer 1** (required)**Computer 2** (recommended)Computer 1 (required)Computer 2 (recommended)
                                  **Role**Role Hyper-V host Client computer
                                  **Description**Description This computer will run Hyper-V, the Hyper-V management tools, and the Hyper-V Windows PowerShell module. This computer is a Windows 7 or Windows 8/8.1 client on your corporate network that will be converted to a VM to demonstrate the upgrade process.
                                  **OS**Windows 8.1/10 or Windows Server 2012/2012 R2/2016\*OSWindows 8.1/10 or Windows Server 2012/2012 R2/2016* Windows 7 or a later
                                  **Edition**Edition Enterprise, Professional, or Education Any
                                  **Architecture**Architecture 64-bit Any
                                  Note: Retaining applications and settings requires that architecture (32 or 64-bit) is the same before and after the upgrade.
                                  **RAM**RAM 8 GB RAM (16 GB recommended) to test Windows 10 deployment with MDT. -
                                  16 GB RAM to test Windows 10 deployment with System Center Configuration Manager.                                  		 Any
                                  **Disk**Disk 200 GB available hard disk space, any format. Any size, MBR formatted.
                                  **CPU**CPU SLAT-Capable CPU Any
                                  **Network**Network Internet connection Any
                                  - +
                                  ![VHD](images/download_vhd.png)
                                  VHD
                                  2. Download the file to the **C:\VHD** directory. When the download is complete, rename the VHD file that you downloaded to **2012R2-poc-1.vhd**. This is done to make the filename simple to recognize and type. 3. Copy the VHD to a second file also in the **C:\VHD** directory and name this VHD **2012R2-poc-2.vhd**. -4. Download the [Windows 10 Enterprise ISO](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-10-enterprise) from the TechNet Evaluation Center to the **C:\VHD** directory on your Hyper-V host. +4. Download the [Windows 10 Enterprise ISO](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) from the TechNet Evaluation Center to the **C:\VHD** directory on your Hyper-V host. >During registration, you must specify the type, version, and language of installation media to download. In this example, a Windows 10 Enterprise, 64 bit, English ISO is chosen. You can choose a different version if desired. **Note: The evaluation version of Windows 10 does not support in-place upgrade**. @@ -247,13 +251,13 @@ After completing these steps, you will have three files in the **C:\VHD** direct The following displays the procedures described in this section, both before and after downloading files: 
                                  -C:\>mkdir VHD
-C:\>cd VHD
-C:\VHD>ren 9600*.vhd 2012R2-poc-1.vhd
-C:\VHD>copy 2012R2-poc-1.vhd 2012R2-poc-2.vhd
+C:>mkdir VHD
+C:>cd VHD
+C:\VHD>ren 9600*.vhd 2012R2-poc-1.vhd
+C:\VHD>copy 2012R2-poc-1.vhd 2012R2-poc-2.vhd
    1 file(s) copied.
 C:\VHD ren *.iso w10-enterprise.iso
-C:\VHD>dir /B
+C:\VHD>dir /B
 2012R2-poc-1.vhd
 2012R2-poc-2.vhd
 w10-enterprise.iso
@@ -267,14 +271,14 @@ w10-enterprise.iso
 If you do not have a PC available to convert to VM, perform the following steps to download an evaluation VM:
 
                                  
 
                                    
-
                                  1. Open the [Download virtual machines](https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/) page.
-
                                  2. Under **Virtual machine**, choose **IE11 on Win7**.
-
                                  3. Under **Select platform** choose **HyperV (Windows)**.
-
                                  4. Click **Download .zip**. The download is 3.31 GB.
+
                                  5. Open the Download virtual machines page.
+
                                  6. Under Virtual machine, choose IE11 on Win7.
+
                                  7. Under Select platform choose HyperV (Windows).
+
                                  8. Click Download .zip. The download is 3.31 GB.
 
                                  9. Extract the zip file. Three directories are created.
-
                                  10. Open the **Virtual Hard Disks** directory and then copy **IE11 - Win7.vhd** to the **C:\VHD** directory.
-
                                  11. Rename **IE11 - Win7.vhd** to **w7.vhd** (do not rename the file to w7.vhdx).
-
                                  12. In step 5 of the [Configure Hyper-V](#configure-hyper-v) section, replace the VHD file name **w7.vhdx** with **w7.vhd**.
+
                                  13. Open the Virtual Hard Disks directory and then copy IE11 - Win7.vhd to the C:\VHD directory.
+
                                  14. Rename IE11 - Win7.vhd to w7.vhd (do not rename the file to w7.vhdx).
+
                                  15. In step 5 of the Configure Hyper-V section, replace the VHD file name w7.vhdx with w7.vhd.
 
                                  
 
 
@@ -328,7 +332,7 @@ Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Ca
 If the **Type** column does not indicate GPT, then the disk partition format is MBR ("Installable File System" = MBR). In the following example, the disk is GPT:
 
 
                                  -PS C:\> Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
+PS C:> Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
 
 SystemName                           Caption                                 Type
 ----------                           -------                                 ----
@@ -339,7 +343,7 @@ USER-PC1                             Disk #0, Partition #1                   GPT
 On a computer running Windows 8 or later, you can also type **Get-Disk** at a Windows PowerShell prompt to discover the partition style. The default output of this cmdlet displays the partition style for all attached disks. Both commands are displayed below. In this example, the client computer is running Windows 8.1 and uses a GPT style partition format:
 
 
                                  -PS C:\> Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
+PS C:> Get-WmiObject -Class Win32_DiskPartition | Select-Object -Property SystemName,Caption,Type
 
 SystemName                            Caption                               Type
 ----------                            -------                               ----
@@ -349,7 +353,7 @@ PC-X1                                 Disk #0, Partition #2                 GPT:
 PC-X1                                 Disk #0, Partition #3                 GPT: Basic Data
 PC-X1                                 Disk #0, Partition #4                 GPT: Basic Data
 
-PS C:\> Get-Disk
+PS C:> Get-Disk
 
 Number Friendly Name                  OperationalStatus                     Total Size Partition Style
 ------ -------------                  -----------------                     ---------- ---------------
@@ -377,12 +381,12 @@ The following table displays the Hyper-V VM generation to choose based on the OS
         MBR
         32
         1
-        [Prepare a generation 1 VM](#prepare-a-generation-1-vm)
+        Prepare a generation 1 VM
     
     
         64
         1
-        [Prepare a generation 1 VM](#prepare-a-generation-1-vm)
+        Prepare a generation 1 VM
     
     
         GPT
@@ -393,30 +397,30 @@ The following table displays the Hyper-V VM generation to choose based on the OS
     
         64
         1
-        [Prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk)
+        Prepare a generation 1 VM from a GPT disk
     
     
         Windows 8 or later
         MBR
         32
         1
-        [Prepare a generation 1 VM](#prepare-a-generation-1-vm)
+        Prepare a generation 1 VM
     
     
         64
         1, 2
-        [Prepare a generation 1 VM](#prepare-a-generation-1-vm)
+        Prepare a generation 1 VM
     
     
         GPT
         32
         1
-        [Prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk)
+        Prepare a generation 1 VM from a GPT disk
     
     
         64
         2
-        [Prepare a generation 2 VM](#prepare-a-generation-2-vm)
+        Prepare a generation 2 VM
     
 
 
@@ -424,9 +428,9 @@ The following table displays the Hyper-V VM generation to choose based on the OS
 
 Notes:
                                  
 
                                    
-
                                  • If the PC is running Windows 7, it can only be converted and hosted in Hyper-V as a generation 1 VM. This Hyper-V requirement means that if the Windows 7 PC is also using a GPT partition style, the OS disk can be shadow copied, but a new system partition must be created. In this case, see [Prepare a generation 1 VM from a GPT disk](#prepare-a-generation-1-vm-from-a-gpt-disk).
-
                                  • If the PC is running Windows 8 or later and uses the GPT partition style, you can capture the disk image and create a generation 2 VM. To do this, you must temporarily mount the EFI system partition which is accomplished using the **mountvol** command. In this case, see [Prepare a generation 2 VM](#prepare-a-generation-2-vm).
-
                                  • If the PC is using an MBR partition style, you can convert the disk to VHD and use it to create a generation 1 VM. If you use the Disk2VHD tool described in this guide, it is not necessary to mount the MBR system partition, but it is still necessary to capture it. In this case, see [Prepare a generation 1 VM](#prepare-a-generation-1-vm).
+
                                  • If the PC is running Windows 7, it can only be converted and hosted in Hyper-V as a generation 1 VM. This Hyper-V requirement means that if the Windows 7 PC is also using a GPT partition style, the OS disk can be shadow copied, but a new system partition must be created. In this case, see Prepare a generation 1 VM from a GPT disk.
+
                                  • If the PC is running Windows 8 or later and uses the GPT partition style, you can capture the disk image and create a generation 2 VM. To do this, you must temporarily mount the EFI system partition which is accomplished using the mountvol command. In this case, see Prepare a generation 2 VM.
+
                                  • If the PC is using an MBR partition style, you can convert the disk to VHD and use it to create a generation 1 VM. If you use the Disk2VHD tool described in this guide, it is not necessary to mount the MBR system partition, but it is still necessary to capture it. In this case, see Prepare a generation 1 VM.
 
                                  
 
 #### Prepare a generation 1 VM
@@ -436,7 +440,7 @@ Notes:
                                  
     >You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive.
 
 2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface.
-3. Select the checkboxes next to the **C:\** and the **system reserved** (BIOS/MBR) volumes. The system volume is not assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to **\\?\Volume{**. See the following example. **Important**: You must include the system volume in order to create a bootable VHD. If this volume is not displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation).
+3. Select the checkboxes next to the **C:\\** and the **system reserved** (BIOS/MBR) volumes. The system volume is not assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to **\\?\Volume{**. See the following example. **Important**: You must include the system volume in order to create a bootable VHD. If this volume is not displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation).
 4. Specify a location to save the resulting VHD or VHDX file (F:\VHD\w7.vhdx in the following example) and click **Create**. See the following example:
 
     ![disk2vhd](images/disk2vhd.png)
@@ -466,7 +470,7 @@ Notes:
                                  
     This command temporarily assigns a drive letter of S to the system volume and mounts it. If the letter S is already assigned to a different volume on the computer, then choose one that is available (ex: mountvol z: /s).
 
 3. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface.
-4. Select the checkboxes next to the **C:\** and the **S:\** volumes, and clear the **Use Volume Shadow Copy checkbox**. Volume shadow copy will not work if the EFI system partition is selected.
+4. Select the checkboxes next to the **C:\\** and the **S:\\** volumes, and clear the **Use Volume Shadow Copy checkbox**. Volume shadow copy will not work if the EFI system partition is selected.
 
     **Important**: You must include the EFI system partition in order to create a bootable VHD. The Windows RE tools partition (shown below) is not required, but it can also be converted if desired.
 
@@ -493,7 +497,7 @@ Notes:
                                  
     >You might experience timeouts if you attempt to run Disk2vhd from a network share, or specify a network share for the destination. To avoid timeouts, use local, portable media such as a USB drive.
 
 2. On the computer you wish to convert, double-click the disk2vhd utility to start the graphical user interface.
-3. Select the checkbox next to the **C:\** volume and clear the checkbox next to **Use Vhdx**. Note: the system volume is not copied in this scenario, it will be added later.
+3. Select the checkbox next to the **C:\\** volume and clear the checkbox next to **Use Vhdx**. Note: the system volume is not copied in this scenario, it will be added later.
 4. Specify a location to save the resulting VHD file (F:\VHD\w7.vhd in the following example) and click **Create**. See the following example:
 
     ![disk2vhd](images/disk2vhd4.png)
@@ -515,7 +519,7 @@ Notes:
                                  
 ### Resize VHD
 
 
                                  
-**Enhanced session mode**
+Enhanced session mode
 
 **Important**: Before proceeding, verify that you can take advantage of [enhanced session mode](https://technet.microsoft.com/windows-server-docs/compute/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) when completing instructions in this guide. Enhanced session mode enables you to copy and paste the commands from the Hyper-V host to VMs, between VMs, and between RDP sessions. After copying some text, you can paste into a Windows PowerShell window by simply right-clicking. Before right-clicking, do not left click other locations as this can empty the clipboard. You can also copy and paste files directly from one computer to another by right-clicking and selecting copy on one computer, then right-clicking and selecting paste on another computer.
 
@@ -629,7 +633,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
     Dismount-VHD -Path c:\vhd\d.vhd
     
                                  
 
-    Next, create the PC1 VM with two attached VHDs, and boot to DVD ($maxram must be defined previously using the same Windows PowerShell promt):
+    Next, create the PC1 VM with two attached VHDs, and boot to DVD ($maxram must be defined previously using the same Windows PowerShell prompt):
 
     
                                       New-VM -Name "PC1" -VHDPath c:\vhd\w7.vhd -SwitchName poc-internal
@@ -643,48 +647,48 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
 
     The VM will automatically boot into Windows Setup. In the PC1 window:
 
-    1. Click **Next**.
-    2. Click **Repair your computer**.
-    3. Click **Troubleshoot**.
-    4. Click **Command Prompt**.
-    5. Type the following command to save an image of the OS drive:
+   1. Click **Next**.
+   2. Click **Repair your computer**.
+   3. Click **Troubleshoot**.
+   4. Click **Command Prompt**.
+   5. Type the following command to save an image of the OS drive:
 
-    
                                  -    dism /Capture-Image /ImageFile:D:\c.wim /CaptureDir:C:\ /Name:Drive-C
-    
                                  
+      
                                  +      dism /Capture-Image /ImageFile:D:\c.wim /CaptureDir:C:\ /Name:Drive-C
+      
                                  
 
-    6. Wait for the OS image to complete saving, and then type the following commands to convert the C: drive to MBR:
+   6. Wait for the OS image to complete saving, and then type the following commands to convert the C: drive to MBR:
 
-    
                                  -    diskpart
-    select disk 0
-    clean
-    convert MBR
-    create partition primary size=100
-    format fs=ntfs quick
-    active
-    create partition primary
-    format fs=ntfs quick label=OS
-    assign letter=c
-    exit
-    
                                  
+      
                                  +      diskpart
+      select disk 0
+      clean
+      convert MBR
+      create partition primary size=100
+      format fs=ntfs quick
+      active
+      create partition primary
+      format fs=ntfs quick label=OS
+      assign letter=c
+      exit
+      
                                  
 
-    7. Type the following commands to restore the OS image and boot files:
+   7. Type the following commands to restore the OS image and boot files:
 
-    
                                  -    dism /Apply-Image /ImageFile:D:\c.wim /Index:1 /ApplyDir:C:\
-    bcdboot c:\windows
-    exit
-    
                                  
+      
                                  +      dism /Apply-Image /ImageFile:D:\c.wim /Index:1 /ApplyDir:C:\
+      bcdboot c:\windows
+      exit
+      
                                  
 
-    8. Click **Continue** and verify the VM boots successfully (do not boot from DVD).
-    9. Click **Ctrl+Alt+Del**, and then in the bottom right corner, click **Shut down**.
-    10. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host to remove the temporary disks and drives from PC1:
+   8. Click **Continue** and verify the VM boots successfully (do not boot from DVD).
+   9. Click **Ctrl+Alt+Del**, and then in the bottom right corner, click **Shut down**.
+   10. Type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host to remove the temporary disks and drives from PC1:
 
-    
                                  -    Remove-VMHardDiskDrive -VMName PC1 -ControllerType IDE -ControllerNumber 0 -ControllerLocation 1
-    Set-VMDvdDrive -VMName PC1 -Path $null
-    
                                  
+       
                                  +       Remove-VMHardDiskDrive -VMName PC1 -ControllerType IDE -ControllerNumber 0 -ControllerLocation 1
+       Set-VMDvdDrive -VMName PC1 -Path $null
+       
                                  
 
 ### Configure VMs
 
@@ -695,7 +699,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
     vmconnect localhost DC1
     
                                  
 
-2. Click **Next** to accept the default settings, read the license terms and click **I accept**, provide an administrator password of **pass@word1**, and click **Finish**.
+2. Click **Next** to accept the default settings, read the license terms and click **I accept**, provide an administrator password of pass@word1, and click **Finish**.
 3. Click **Ctrl+Alt+Del** in the upper left corner of the virtual machine connection window, and then sign in to DC1 using the Administrator account.
 4. Right-click **Start**, point to **Shut down or sign out**, and click **Sign out**. The VM connection will reset and a new connection dialog box will appear enabling you to choose a custom display configuration. Select a desktop size, click **Connect** and sign in again with the local Administrator account. Note: Signing in this way ensures that [enhanced session mode](https://technet.microsoft.com/windows-server-docs/compute/hyper-v/learn-more/Use-local-resources-on-Hyper-V-virtual-machine-with-VMConnect) is enabled. It is only necessary to do this the first time you sign in to a new VM.
 5. If DC1 is configured as described in this guide, it will currently be assigned an APIPA address, have a randomly generated hostname, and a single network adapter named "Ethernet." Open an elevated Windows PowerShell prompt on DC1 and type or paste the following commands to provide a new hostname and configure a static IP address and gateway:
@@ -706,9 +710,9 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
     Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 192.168.0.1,192.168.0.2
     
                                  
 
-    >The default gateway at 192.168.0.2 will be configured later in this guide.
-
-    >Note: A list of available tasks for an app will be populated the first time you run it on the taskbar. Because these tasks aren't available until the App has been run, you will not see the **Run as Administrator** task until you have left-clicked Windows PowerShell for the first time. In this newly created VM, you will need to left-click Windows PowerShell one time, and then you can right-click and choose Run as Administrator to open an elevated Windows PowerShell prompt.
+   > The default gateway at 192.168.0.2 will be configured later in this guide.
+   > 
+   > Note: A list of available tasks for an app will be populated the first time you run it on the taskbar. Because these tasks aren't available until the App has been run, you will not see the **Run as Administrator** task until you have left-clicked Windows PowerShell for the first time. In this newly created VM, you will need to left-click Windows PowerShell one time, and then you can right-click and choose Run as Administrator to open an elevated Windows PowerShell prompt.
 
 6. Install the Active Directory Domain Services role by typing the following command at an elevated Windows PowerShell prompt:
 
@@ -775,7 +779,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
 
     **Configure service and user accounts**
 
-    Windows 10 deployment with MDT and System Center Configuration Manager requires specific accounts to perform some actions. Service accounts will be created to use for these tasks. A user account is also added in the contoso.com domain that can be used for testing purposes. In the test lab environment, passwords are set to never expire.
+    Windows 10 deployment with MDT and Microsoft Endpoint Configuration Manager requires specific accounts to perform some actions. Service accounts will be created to use for these tasks. A user account is also added in the contoso.com domain that can be used for testing purposes. In the test lab environment, passwords are set to never expire.
 
     >To keep this test lab relatively simple, we will not create a custom OU structure and set permissions. Required permissions are enabled by adding accounts to the Domain Admins group. To configure these settings in a production environment, see [Prepare for Zero Touch Installation of Windows 10 with Configuration Manager](deploy-windows-sccm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md)
 
@@ -819,7 +823,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
 
 17. Open an elevated Windows PowerShell prompt on PC1 and verify that the client VM has received a DHCP lease and can communicate with the consoto.com domain controller.
 
-    To open Windows PowerShell on Windows 7, click **Start**, and search for "**power**." Right-click **Windows PowerShell** and then click **Pin to Taskbar** so that it is simpler to use Windows Powershell during this lab. Click **Windows PowerShell** on the taskbar, and then type **ipconfig** at the prompt to see the client's current IP address. Also type **ping dc1.contoso.com** and **nltest /dsgetdc:contoso.com** to verify that it can reach the domain controller. See the following examples of a successful network connection:
+    To open Windows PowerShell on Windows 7, click **Start**, and search for "**power**." Right-click **Windows PowerShell** and then click **Pin to Taskbar** so that it is simpler to use Windows PowerShell during this lab. Click **Windows PowerShell** on the taskbar, and then type **ipconfig** at the prompt to see the client's current IP address. Also type **ping dc1.contoso.com** and **nltest /dsgetdc:contoso.com** to verify that it can reach the domain controller. See the following examples of a successful network connection:
 
     ```
     ipconfig
@@ -901,7 +905,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
     vmconnect localhost SRV1
                                  -25. Accept the default settings, read license terms and accept them, provide an administrator password of **pass@word1**, and click **Finish**. When you are prompted about finding PCs, devices, and content on the network, click **Yes**. +25. Accept the default settings, read license terms and accept them, provide an administrator password of pass@word1, and click **Finish**. When you are prompted about finding PCs, devices, and content on the network, click **Yes**. 26. Sign in to SRV1 using the local administrator account. In the same way that was done on DC1, sign out of SRV1 and then sign in again to enable enhanced session mode. This will enable you to copy and paste Windows PowerShell commands from the Hyper-V host to the VM. 27. Open an elevated Windows PowerShell prompt on SRV1 and type the following commands: @@ -962,7 +966,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to cmd /c netsh routing ip nat add interface name="Internal" mode=PRIVATE -32. The DNS service on SRV1 also needs to resolve hosts in the contoso.com domain. This can be accomplished with a conditional forwarder. Open an elevated Windows PowerShell prompt on SRV1 and type the following command: +32. The DNS service on SRV1 also needs to resolve hosts in the `contoso.com` domain. This can be accomplished with a conditional forwarder. Open an elevated Windows PowerShell prompt on SRV1 and type the following command: 
                                       Add-DnsServerConditionalForwarderZone -Name contoso.com -MasterServers 192.168.0.1
@@ -974,7 +978,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to
     ping www.microsoft.com
                                  - If you see "Ping request could not find host www.microsoft.com" on PC1 and DC1, but not on SRV1, then you will need to configure a server-level DNS forwarder on SRV1. To do this, open an elevated Windows PowerShell prompt on SRV1 and type the following command. + If you see "Ping request could not find host `www.microsoft.com`" on PC1 and DC1, but not on SRV1, then you will need to configure a server-level DNS forwarder on SRV1. To do this, open an elevated Windows PowerShell prompt on SRV1 and type the following command. **Note**: This command also assumes that "Ethernet 2" is the external-facing network adapter on SRV1. If the external adapter has a different name, replace "Ethernet 2" in the command below with that name: @@ -1030,10 +1034,10 @@ Use the following procedures to verify that the PoC environment is configured pr **DCDiag** displays "passed test" for all tests.
                                  **Get-DnsServerResourceRecord** displays the correct DNS address records for DC1, SRV1, and the computername of PC1. Additional address records for the zone apex (@), DomainDnsZones, and ForestDnsZones will also be registered.
                                  **Get-DnsServerForwarder** displays a single forwarder of 192.168.0.2.
                                  - **Resolve-DnsName** displays public IP address results for www.microsoft.com.
                                  - **Get-DhcpServerInDC** displays 192.168.0.1, dc1.contoso.com.
                                  + **Resolve-DnsName** displays public IP address results for `www.microsoft.com`.
                                  + **Get-DhcpServerInDC** displays 192.168.0.1, `dc1.contoso.com`.
                                  **Get-DhcpServerv4Statistics** displays 1 scope with 2 addresses in use (these belong to PC1 and the Hyper-V host).
                                  - **ipconfig** displays a primary DNS suffix and suffix search list of contoso.com, IP address of 192.168.0.1, subnet mask of 255.255.255.0, default gateway of 192.168.0.2, and DNS server addresses of 192.168.0.1 and 192.168.0.2. + **ipconfig** displays a primary DNS suffix and suffix search list of `contoso.com`, IP address of 192.168.0.1, subnet mask of 255.255.255.0, default gateway of 192.168.0.2, and DNS server addresses of 192.168.0.1 and 192.168.0.2. 2. On SRV1, open an elevated Windows PowerShell prompt and type the following commands: @@ -1047,8 +1051,8 @@ Use the following procedures to verify that the PoC environment is configured pr **Get-Service** displays a status of "Running" for both services.
                                  **Get-DnsServerForwarder** either displays no forwarders, or displays a list of forwarders you are required to use so that SRV1 can resolve Internet names.
                                  - **Resolve-DnsName** displays public IP address results for www.microsoft.com.
                                  - **ipconfig** displays a primary DNS suffix of contoso.com. The suffix search list contains contoso.com and your corporate domain. Two ethernet adapters are shown: Ethernet adapter "Ethernet" has an IP addresses of 192.168.0.2, subnet mask of 255.255.255.0, no default gateway, and DNS server addresses of 192.168.0.1 and 192.168.0.2. Ethernet adapter "Ethernet 2" has an IP address, subnet mask, and default gateway configured by DHCP on your corporate network.
                                  + **Resolve-DnsName** displays public IP address results for `www.microsoft.com`.
                                  + **ipconfig** displays a primary DNS suffix of `contoso.com`. The suffix search list contains `contoso.com` and your corporate domain. Two ethernet adapters are shown: Ethernet adapter "Ethernet" has an IP addresses of 192.168.0.2, subnet mask of 255.255.255.0, no default gateway, and DNS server addresses of 192.168.0.1 and 192.168.0.2. Ethernet adapter "Ethernet 2" has an IP address, subnet mask, and default gateway configured by DHCP on your corporate network.
                                  **netsh** displays three interfaces on the computer: interface "Ethernet 2" with DHCP enabled = Yes and IP address assigned by your corporate network, interface "Ethernet" with DHCP enabled = No and IP address of 192.168.0.2, and interface "Loopback Pseudo-Interface 1" with IP address of 127.0.0.1. 3. On PC1, open an elevated Windows PowerShell prompt and type the following commands: @@ -1063,9 +1067,9 @@ Use the following procedures to verify that the PoC environment is configured pr **whoami** displays the current user context, for example in an elevated Windows PowerShell prompt, contoso\administrator is displayed.
                                  **hostname** displays the name of the local computer, for example W7PC-001.
                                  - **nslookup** displays the DNS server used for the query, and the results of the query. For example, server dc1.contoso.com, address 192.168.0.1, Name e2847.dspb.akamaiedge.net.
                                  - **ping** displays if the source can resolve the target name, and whether or not the target responds to ICMP. If it cannot be resolved, "..could not find host" will be diplayed and if the target is found and also responds to ICMP, you will see "Reply from" and the IP address of the target.
                                  - **tracert** displays the path to reach the destination, for example srv1.contoso.com [192.168.0.2] followed by a list of hosts and IP addresses corresponding to subsequent routing nodes between the source and the destination. + **nslookup** displays the DNS server used for the query, and the results of the query. For example, server `dc1.contoso.com`, address 192.168.0.1, Name `e2847.dspb.akamaiedge.net`.
                                  + **ping** displays if the source can resolve the target name, and whether or not the target responds to ICMP. If it cannot be resolved, "..could not find host" will be displayed and if the target is found and also responds to ICMP, you will see "Reply from" and the IP address of the target.
                                  + **tracert** displays the path to reach the destination, for example `srv1.contoso.com` [192.168.0.2] followed by a list of hosts and IP addresses corresponding to subsequent routing nodes between the source and the destination. ## Appendix B: Terminology used in this guide @@ -1075,14 +1079,15 @@ Use the following procedures to verify that the PoC environment is configured pr
                                  -
                                  TermDefinition +
                                  Term +Definition
                                  GPTGUID partition table (GPT) is an updated hard-disk formatting scheme that enables the use of newer hardware. GPT is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions.
                                  Hyper-VHyper-V is a server role introduced with Windows Server 2008 that lets you create a virtualized computing environment. Hyper-V can also be installed as a Windows feature on Windows client operating systems, starting with Windows 8.
                                  Hyper-V hostThe computer where Hyper-V is installed.
                                  Hyper-V ManagerThe user-interface console used to view and configure Hyper-V.
                                  MBRMaster Boot Record (MBR) is a legacy hard-disk formatting scheme that limits support for newer hardware. MBR is one of the partition formats that can be chosen when first initializing a hard drive, prior to creating and formatting partitions. MBR is in the process of being replaced by the GPT partition format.
                                  Proof of concept (PoC)Confirmation that a process or idea works as intended. A PoC is carried out in a test environment to learn about and verify a process. -
                                  Shadow copyA copy or "snapshot" of a computer at a point in time, created by the Volume Shadow Copy Service (VSS), typically for backup purposes. +
                                  Shadow copyA copy or "snapshot" of a computer at a point in time, created by the Volume Shadow Copy Service (VSS), typically for backup purposes.
                                  Virtual machine (VM)A VM is a virtual computer with its own operating system, running on the Hyper-V host.
                                  Virtual switchA virtual network connection used to connect VMs to each other and to physical network adapters on the Hyper-V host.
                                  VM snapshotA point in time image of a VM that includes its disk, memory and device state. It can be used to return a virtual machine to a former state corresponding to the time the snapshot was taken. @@ -1094,9 +1099,9 @@ Use the following procedures to verify that the PoC environment is configured pr [Windows 10 deployment scenarios](windows-10-deployment-scenarios.md) -  + -  + diff --git a/windows/deployment/windows-10-pro-in-s-mode.md b/windows/deployment/windows-10-pro-in-s-mode.md index 2e66746137..412dceea4f 100644 --- a/windows/deployment/windows-10-pro-in-s-mode.md +++ b/windows/deployment/windows-10-pro-in-s-mode.md @@ -1,87 +1,90 @@ ---- -title: Switch to Windows 10 Pro/Enterprise from S mode -description: Overview of Windows 10 Pro/Enterprise in S mode. S mode switch options are also outlined in this document. Switching out of S mode is optional. -keywords: Windows 10 S switch, S mode Switch, Switch in S mode, s mode switch, Windows 10 S, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Pro in S mode -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.prod: w10 -ms.sitesec: library -ms.pagetype: deploy -author: jaimeo -ms.collection: M365-modern-desktop -ms.topic: article ---- - -# Switch to Windows 10 Pro or Enterprise from S mode - -We recommend staying in S mode. However, in some limited scenarios, you might need to switch to Windows 10 Pro, Home, or Enterprise (not in S mode). You can switch devices running Windows 10, version 1709 or later. - - -A number of other transformations are possible depending on which version and edition of Windows 10 you are starting with. Depending on the details, you might *switch* between S mode and the ordinary version or *convert* between different editions while staying in or out of S mode. The following quick reference table summarizes all of the switches or conversions that are supported by various means: - - - - -| If a device is running this version of Windows 10 | and this edition of Windows 10 | then you can switch or convert it to this edition of Windows 10 by these methods: | | | -|-------------|---------------------|-----------------------------------|-------------------------------|--------------------------------------------| -| | | **Store for Education** (switch/convert all devices in your tenant) | **Microsoft Store** (switch/convert one device at a time) | **Intune** (switch/convert any number of devices selected by admin) | -| **Windows 10, version 1709** | Pro in S mode | Pro EDU | Pro | Not by this method | -| | Pro | Pro EDU | Not by any method | Not by any method | -| | Home | Not by any method | Not by any method | Not by any method | -| | | | | | -| **Windows 10, version 1803** | Pro in S mode | Pro EDU in S mode | Pro | Not by this method | -| | Pro | Pro EDU | Not by any method | Not by any method | -| | Home in S mode | Not by any method | Home | Not by this method | -| | Home | Not by any method | Not by any method | Not by any method | -| | | | | | -| **Windows 10, version 1809** | Pro in S mode | Pro EDU in S mode | Pro | Pro | -| | Pro | Pro EDU | Not by any method | Not by any method | -| | Home in S mode | Not by any method | Home | Home | -| | Home | Not by any method | Not by any method | Not by any method | - - -Use the following information to switch to Windows 10 Pro through the Microsoft Store. -> [!IMPORTANT] -> While it’s free to switch to Windows 10 Pro, it’s not reversible. The only way to rollback this kind of switch is through a [bare-metal recovery (BMR)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/create-media-to-run-push-button-reset-features-s14) reset. This restores a Windows device to the factory state, even if the user needs to replace the hard drive or completely wipe the drive clean. If a device is switched out of S mode via the Microsoft Store, it will remain out of S mode even after the device is reset. - -## Switch one device through the Microsoft Store -Use the following information to switch to Windows 10 Pro through the Microsoft Store or by navigating to **Settings** and then **Activation** on the device. - -Note these differences affecting switching modes in various releases of Windows 10: - -- In Windows 10, version 1709, you can switch devices one at a time from Windows 10 Pro in S mode to Windows 10 Pro by using the Microsoft Store or **Settings**. No other switches are possible. -- In Windows 10, version 1803, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store or **Settings**. -- Windows 10, version 1809, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store, **Settings**, or you can switch multiple devices in bulk by using Intune. You can also block users from switching devices themselves. - - -1. Sign into the Microsoft Store using your Microsoft account. -2. Search for "S mode". -3. In the offer, select **Buy**, **Get**, or **Learn more.** - -You'll be prompted to save your files before the switch starts. Follow the prompts to switch to Windows 10 Pro. - -## Switch one or more devices by using Microsoft Intune - -Starting with Windows 10, version 1809, if you need to switch multiple devices in your environment from Windows 10 Pro in S mode to Windows 10 Pro, you can use Microsoft Intune or any other supported mobile device management software. You can configure devices to switch out of S mode during OOBE or post-OOBE - this gives you flexibility to manage Windows 10 in S mode devices at any point during the device lifecycle. - -1. Start Microsoft Intune. -2. Navigate to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch**. -3. Follow the instructions to complete the switch. - - -## Block users from switching - -You can control which devices or users can use the Microsoft Store to switch out of S mode in Windows 10. -To set this, go to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch in Microsoft Intune**, and then choose **Keep in S mode**. - -## S mode management with CSPs - -In addition to using Microsoft Intune or another modern device management tool to manage S mode, you can also use the [WindowsLicensing](https://docs.microsoft.com/windows/client-management/mdm/windowslicensing-csp) configuration service provider (CSP). In Windows 10, version 1809, we added S mode functionality that lets you switch devices, block devices from switching, and check the status (whether a device is in S mode). - - -## Related topics - -[FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)
                                  -[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
                                  -[Windows 10 Pro Education](https://docs.microsoft.com/education/windows/test-windows10s-for-edu)
                                  -[Introduction to Microsoft Intune in the Azure portal](https://docs.microsoft.com/intune/what-is-intune) +--- +title: Switch to Windows 10 Pro/Enterprise from S mode +ms.reviewer: +manager: laurawi +ms.audience: itpro author: greg-lindsay +description: Overview of Windows 10 Pro/Enterprise in S mode. S mode switch options are also outlined in this document. Switching out of S mode is optional. +keywords: Windows 10 S switch, S mode Switch, Switch in S mode, s mode switch, Windows 10 S, S-mode, system requirements, Overview, Windows 10 Pro in S mode, Windows 10 Pro in S mode +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.prod: w10 +ms.sitesec: library +ms.pagetype: deploy +audience: itpro author: greg-lindsay +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Switch to Windows 10 Pro or Enterprise from S mode + +We recommend staying in S mode. However, in some limited scenarios, you might need to switch to Windows 10 Pro, Home, or Enterprise (not in S mode). You can switch devices running Windows 10, version 1709 or later. + + +A number of other transformations are possible depending on which version and edition of Windows 10 you are starting with. Depending on the details, you might *switch* between S mode and the ordinary version or *convert* between different editions while staying in or out of S mode. The following quick reference table summarizes all of the switches or conversions that are supported by various means: + + + + +| If a device is running this version of Windows 10 | and this edition of Windows 10 | then you can switch or convert it to this edition of Windows 10 by these methods: | | | +|-------------|---------------------|-----------------------------------|-------------------------------|--------------------------------------------| +| | | **Store for Education** (switch/convert all devices in your tenant) | **Microsoft Store** (switch/convert one device at a time) | **Intune** (switch/convert any number of devices selected by admin) | +| **Windows 10, version 1709** | Pro in S mode | Pro EDU | Pro | Not by this method | +| | Pro | Pro EDU | Not by any method | Not by any method | +| | Home | Not by any method | Not by any method | Not by any method | +| | | | | | +| **Windows 10, version 1803** | Pro in S mode | Pro EDU in S mode | Pro | Not by this method | +| | Pro | Pro EDU | Not by any method | Not by any method | +| | Home in S mode | Not by any method | Home | Not by this method | +| | Home | Not by any method | Not by any method | Not by any method | +| | | | | | +| **Windows 10, version 1809** | Pro in S mode | Pro EDU in S mode | Pro | Pro | +| | Pro | Pro EDU | Not by any method | Not by any method | +| | Home in S mode | Not by any method | Home | Home | +| | Home | Not by any method | Not by any method | Not by any method | + + +Use the following information to switch to Windows 10 Pro through the Microsoft Store. +> [!IMPORTANT] +> While it’s free to switch to Windows 10 Pro, it’s not reversible. The only way to rollback this kind of switch is through a [bare-metal recovery (BMR)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/create-media-to-run-push-button-reset-features-s14) reset. This restores a Windows device to the factory state, even if the user needs to replace the hard drive or completely wipe the drive clean. If a device is switched out of S mode via the Microsoft Store, it will remain out of S mode even after the device is reset. + +## Switch one device through the Microsoft Store +Use the following information to switch to Windows 10 Pro through the Microsoft Store or by navigating to **Settings** and then **Activation** on the device. + +Note these differences affecting switching modes in various releases of Windows 10: + +- In Windows 10, version 1709, you can switch devices one at a time from Windows 10 Pro in S mode to Windows 10 Pro by using the Microsoft Store or **Settings**. No other switches are possible. +- In Windows 10, version 1803, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store or **Settings**. +- Windows 10, version 1809, you can switch devices running any S mode edition to the equivalent non-S mode edition one at a time by using the Microsoft Store, **Settings**, or you can switch multiple devices in bulk by using Intune. You can also block users from switching devices themselves. + + +1. Sign into the Microsoft Store using your Microsoft account. +2. Search for "S mode". +3. In the offer, select **Buy**, **Get**, or **Learn more.** + +You'll be prompted to save your files before the switch starts. Follow the prompts to switch to Windows 10 Pro. + +## Switch one or more devices by using Microsoft Intune + +Starting with Windows 10, version 1809, if you need to switch multiple devices in your environment from Windows 10 Pro in S mode to Windows 10 Pro, you can use Microsoft Intune or any other supported mobile device management software. You can configure devices to switch out of S mode during OOBE or post-OOBE - this gives you flexibility to manage Windows 10 in S mode devices at any point during the device lifecycle. + +1. Start Microsoft Intune. +2. Navigate to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch**. +3. Follow the instructions to complete the switch. + + +## Block users from switching + +You can control which devices or users can use the Microsoft Store to switch out of S mode in Windows 10. +To set this, go to **Device configuration > Profiles > Windows 10 and later > Edition upgrade and mode switch in Microsoft Intune**, and then choose **Keep in S mode**. + +## S mode management with CSPs + +In addition to using Microsoft Intune or another modern device management tool to manage S mode, you can also use the [WindowsLicensing](https://docs.microsoft.com/windows/client-management/mdm/windowslicensing-csp) configuration service provider (CSP). In Windows 10, version 1809, we added S mode functionality that lets you switch devices, block devices from switching, and check the status (whether a device is in S mode). + + +## Related topics + +[FAQs](https://support.microsoft.com/help/4020089/windows-10-in-s-mode-faq)
                                  +[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
                                  +[Windows 10 Pro Education](https://docs.microsoft.com/education/windows/test-windows10s-for-edu)
                                  +[Introduction to Microsoft Intune in the Azure portal](https://docs.microsoft.com/intune/what-is-intune) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md new file mode 100644 index 0000000000..bdb8c230c4 --- /dev/null +++ b/windows/deployment/windows-10-subscription-activation.md @@ -0,0 +1,240 @@ +--- +title: Windows 10 Subscription Activation +description: How to dynamically enable Windows 10 Enterprise or Education subscriptions +keywords: upgrade, update, task sequence, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +manager: laurawi +ms.collection: M365-modern-desktop +search.appverid: +- MET150 +ms.topic: article +--- + +# Windows 10 Subscription Activation + +Starting with Windows 10, version 1703 Windows 10 Pro supports the Subscription Activation feature, enabling users to “step-up” from Windows 10 Pro to **Windows 10 Enterprise** automatically if they are subscribed to Windows 10 Enterprise E3 or E5. + +With Windows 10, version 1903 the Subscription Activation feature also supports the ability to step-up from Windows 10 Pro Education to the Enterprise grade edition for educational institutions – **Windows 10 Education**. + +The Subscription Activation feature eliminates the need to manually deploy Windows 10 Enterprise or Education images on each target device, then later standing up on-prem key management services such as KMS or MAK based activation, entering GVLKs, and subsequently rebooting client devices. + +## Subscription Activation for Windows 10 Enterprise + +With Windows 10, version 1703 both Windows 10 Enterprise E3 and Windows 10 Enterprise E5 are available as online services via subscription. Deploying [Windows 10 Enterprise](planning/windows-10-enterprise-faq-itpro.md) in your organization can now be accomplished with no keys and no reboots. + + If you are running Windows 10, version 1703 or later: + +- Devices with a current Windows 10 Pro license can be seamlessly upgraded to Windows 10 Enterprise. +- Product key-based Windows 10 Enterprise software licenses can be transitioned to Windows 10 Enterprise subscriptions. + +Organizations that have an Enterprise agreement can also benefit from the new service, using traditional Active Directory-joined devices. In this scenario, the Active Directory user that signs in on their device must be synchronized with Azure AD using [Azure AD Connect Sync](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-whatis). + +## Subscription Activation for Windows 10 Education + +Subscription Activation for Education works the same as the Enterprise version, but in order to use Subscription Activation for Education, you must have a device running Windows 10 Pro Education, version 1903 or later and an active subscription plan with a Windows 10 Enterprise license. For more information, see the [requirements](#windows-10-education-requirements) section. + +## In this article + +- [Inherited Activation](#inherited-activation): Description of a new feature available in Windows 10, version 1803 and later. +- [The evolution of Windows 10 deployment](#the-evolution-of-deployment): A short history of Windows deployment. +- [Requirements](#requirements): Prerequisites to use the Windows 10 Subscription Activation model. +- [Benefits](#benefits): Advantages of Windows 10 subscription-based licensing. +- [How it works](#how-it-works): A summary of the subscription-based licensing option. +- [Virtual Desktop Access (VDA)](#virtual-desktop-access-vda): Enable Windows 10 Subscription Activation for VMs in the cloud. + +For information on how to deploy Windows 10 Enterprise licenses, see [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). + +## Inherited Activation + +Inherited Activation is a new feature available in Windows 10, version 1803 that allows Windows 10 virtual machines to inherit activation state from their Windows 10 host. + +When a user with Windows 10 E3/E5 or A3/A5 license assigned creates a new Windows 10 virtual machine (VM) using a Windows 10 local host, the VM inherits the activation state from a host machine independent of whether user signs on with a local account or using an Azure Active Directory (AAD) account on a VM. + +To support Inherited Activation, both the host computer and the VM must be running Windows 10, version 1803 or later. + +## The evolution of deployment + +>The original version of this section can be found at [Changing between Windows SKUs](https://blogs.technet.microsoft.com/mniehaus/2017/10/09/changing-between-windows-skus/). + +The following figure illustrates how deploying Windows 10 has evolved with each release. With this release, deployment is automatic. + +![Illustration of how Windows 10 deployment has evolved](images/sa-evolution.png) + +- **Windows 7** required you to redeploy the operating system using a full wipe-and-load process if you wanted to change from Windows 7 Professional to Windows 10 Enterprise.
                                  +- **Windows 8.1** added support for a Windows 8.1 Pro to Windows 8.1 Enterprise in-place upgrade (considered a “repair upgrade” because the OS version was the same before and after).  This was a lot easier than wipe-and-load, but it was still time-consuming.
                                  +- **Windows 10, version 1507** added the ability to install a new product key using a provisioning package or using MDM to change the SKU.  This required a reboot, which would install the new OS components, and took several minutes to complete. However, it was a lot quicker than in-place upgrade.
                                  +- **Windows 10, version 1607** made a big leap forward. Now you can just change the product key and the SKU instantly changes from Windows 10 Pro to Windows 10 Enterprise.  In addition to provisioning packages and MDM, you can just inject a key using SLMGR.VBS (which injects the key into WMI), so it became trivial to do this using a command line.
                                  +- **Windows 10, version 1703** made this “step-up” from Windows 10 Pro to Windows 10 Enterprise automatic for those that subscribed to Windows 10 Enterprise E3 or E5 via the CSP program.
                                  +- **Windows 10, version 1709** adds support for Windows 10 Subscription Activation, very similar to the CSP support but for large enterprises, enabling the use of Azure AD for assigning licenses to users. When those users sign in on an AD or Azure AD-joined machine, it automatically steps up from Windows 10 Pro to Windows 10 Enterprise.
                                  +- **Windows 10, version 1803** updates Windows 10 Subscription Activation to enable pulling activation keys directly from firmware for devices that support firmware-embedded keys. It is no longer necessary to run a script to perform the activation step on Windows 10 Pro prior to activating Enterprise. For virtual machines and hosts running Windows 10, version 1803 [Inherited Activation](#inherited-activation) is also enabled.
                                  +- **Windows 10, version 1903** updates Windows 10 Subscription Activation to enable step up from Windows 10 Pro Education to Windows 10 Education for those with a qualifying Windows 10 or Microsoft 365 subscription. + +## Requirements + +### Windows 10 Enterprise requirements + +For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & Services Agreements (MPSA), you must have the following: + +- Windows 10 (Pro or Enterprise) version 1703 or later installed on the devices to be upgraded. +- Azure Active Directory (Azure AD) available for identity management. +- Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. + +For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 Enterprise E3/E5 or A3/A5 through a cloud solution provider (CSP). Identity management and device requirements are the same when you use CSP to manage licenses, with the exception that Windows 10 Enterprise E3 is also available through CSP to devices running Windows 10, version 1607. For more information about obtaining Windows 10 Enterprise E3 through your CSP, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md). + +If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade benefits for Windows Cloud Subscriptions in CSP](https://blogs.windows.com/business/2017/01/19/new-windows-10-upgrade-benefits-windows-cloud-subscriptions-csp/) + +#### Muti-factor authentication + +An issue has been identified with Hybrid Azure AD joined devices that have enabled [multi-factor authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted) (MFA). If a user signs into a device using their Active Directory account and MFA is enabled, the device will not successfully upgrade to their Windows Enterprise subscription. + +To resolve this issue: + +If the device is running Windows 10, version 1703, 1709, or 1803, the user must either sign in with an Azure AD account, or you must disable MFA for this user during the 30-day polling period and renewal. + +If the device is running Windows 10, version 1809 or later: +1. Windows 10, version 1809 must be updated with [KB4497934](https://support.microsoft.com/help/4497934/windows-10-update-kb4497934). Later versions of Windows 10 automatically include this patch. +2. When the user signs in on a Hybrid Azure AD joined device with MFA enabled, a notification will indicate that there is a problem. Click the notification and then click **Fix now** to step through the subscription activation process. See the example below: + +![Subscription Activation with MFA1](images/sa-mfa1.png)
                                  +![Subscription Activation with MFA2](images/sa-mfa2.png)
                                  +![Subscription Activation with MFA2](images/sa-mfa3.png) + +### Windows 10 Education requirements + +1. Windows 10 Pro Education, version 1903 or later installed on the devices to be upgraded. +2. A device with a Windows 10 Pro Education digital license. You can confirm this information in Settings > Update & Security> Activation. +3. The Education tenant must have an active subscription to Microsoft 365 with a Windows 10 Enterprise license or a Windows 10 Enterprise or Education subscription. +4. Devices must be Azure AD-joined or Hybrid Azure AD joined. Workgroup-joined or Azure AD registered devices are not supported. + +>If Windows 10 Pro is converted to Windows 10 Pro Education [using benefits available in Store for Education](https://docs.microsoft.com/education/windows/change-to-pro-education#change-using-microsoft-store-for-education), then the feature will not work. You will need to re-image the device using a Windows 10 Pro Education edition. + + +## Benefits + +With Windows 10 Enterprise or Windows 10 Education, businesses and institutions can benefit from enterprise-level security and control. Previously, only organizations with a Microsoft Volume Licensing Agreement could deploy Windows 10 Education or Windows 10 Enterprise to their users. Now, with Windows 10 Enterprise E3 or A3 and E5 or A5 being available as a true online service, it is available in select channels thus allowing all organizations to take advantage of enterprise-grade Windows 10 features. To compare Windows 10 editions and review pricing, see the following: + +- [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare) +- [Enterprise Mobility + Security Pricing Options](https://www.microsoft.com/cloud-platform/enterprise-mobility-security-pricing) + +You can benefit by moving to Windows as an online service in the following ways: + +1. Licenses for Windows 10 Enterprise and Education are checked based on Azure Active Directory (Azure AD) credentials, so now businesses have a systematic way to assign licenses to end users and groups in their organization. +2. User logon triggers a silent edition upgrade, with no reboot required +3. Support for mobile worker/BYOD activation; transition away from on-prem KMS and MAK keys. +4. Compliance support via seat assignment. +5. Licenses can be updated to different users dynamically, enabling you to optimize your licensing investment against changing needs. + +## How it works + +The device is AAD joined from Settings > Accounts > Access work or school. + +The IT administrator assigns Windows 10 Enterprise to a user. See the following figure. + +![Windows 10 Enterprise](images/ent.png) + +When a licensed user signs in to a device that meets requirements using their Azure AD credentials, the operating system steps up from Windows 10 Pro to Windows 10 Enterprise (or Windows 10 Pro Education to Windows 10 Education) and all the appropriate Windows 10 Enterprise/Education features are unlocked. When a user’s subscription expires or is transferred to another user, the device reverts seamlessly to Windows 10 Pro / Windows 10 Pro Education edition, once current subscription validity expires. + +Devices running Windows 10 Pro, version 1703 or Windows 10 Pro Education, version 1903 or later can get Windows 10 Enterprise or Education Semi-Annual Channel on up to five devices for each user covered by the license. This benefit does not include Long Term Servicing Channel. + +The following figures summarize how the Subscription Activation model works: + +Before Windows 10, version 1903:
                                  +![1703](images/before.png) + +After Windows 10, version 1903:
                                  +![1903](images/after.png) + +Note: +1. A Windows 10 Pro Education device will only step up to Windows 10 Education edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). +2. A Windows 10 Pro device will only step up to Windows 10 Enterprise edition when “Windows 10 Enterprise” license is assigned from M365 Admin center (as of May 2019). + +### Scenarios + +**Scenario #1**:  You are using Windows 10, version 1803 or above, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise). + +All of your Windows 10 Pro devices will step-up to Windows 10 Enterprise, and devices that are already running Windows 10 Enterprise will migrate from KMS or MAK activated Enterprise edition to Subscription activated Enterprise edition when a Subscription Activation-enabled user signs in to the device. + +**Scenario #2**:  You are using Windows 10, version 1607, 1703, or 1709 with KMS for activation, and just purchased Windows 10 Enterprise E3 or E5 subscriptions (or have had an E3 or E5 subscription for a while but haven’t yet deployed Windows 10 Enterprise). + +To change all of your Windows 10 Pro devices to Windows 10 Enterprise, run the following command on each computer: + +
                                  +cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43
                                  + +The command causes the OS to change to Windows 10 Enterprise and then seek out the KMS server to reactivate.  This key comes from [Appendix A: KMS Client Setup Keys](https://technet.microsoft.com/library/jj612867.aspx) in the Volume Activation guide.  It is also possible to inject the Windows 10 Pro key from this article if you wish to step back down from Enterprise to Pro. + +**Scenario #3**:  Using Azure AD-joined devices or Active Directory-joined devices running Windows 10 1709 or later, and with Azure AD synchronization configured, just follow the steps in [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md) to acquire a $0 SKU and get a new Windows 10 Enterprise E3 or E5 license in Azure AD. Then, assign that license to all of your Azure AD users. These can be AD-synced accounts.  The device will automatically change from Windows 10 Pro to Windows 10 Enterprise when that user signs in. + +In summary, if you have a Windows 10 Enterprise E3 or E5 subscription, but are still running Windows 10 Pro, it’s really simple (and quick) to move to Windows 10 Enterprise using one of the scenarios above. + +If you’re running Windows 7, it can be more work.  A wipe-and-load approach works, but it is likely to be easier to upgrade from Windows 7 Pro directly to Windows 10 Enterprise. This is a supported path, and completes the move in one step.  This method also works if you are running Windows 8.1 Pro. + +### Licenses + +The following policies apply to acquisition and renewal of licenses on devices: +- Devices that have been upgraded will attempt to renew licenses about every 30 days, and must be connected to the Internet to successfully acquire or renew a license. +- If a device is disconnected from the Internet until its current subscription expires, the operating system will revert to Windows 10 Pro or Windows 10 Pro Education. As soon as the device is connected to the Internet again, the license will automatically renew. +- Up to five devices can be upgraded for each user license. +- If a device meets the requirements and a licensed user signs in on that device, it will be upgraded. + +Licenses can be reallocated from one user to another user, allowing you to optimize your licensing investment against changing needs. + +When you have the required Azure AD subscription, group-based licensing is the preferred method to assign Enterprise E3 and E5 licenses to users. For more information, see [Group-based licensing basics in Azure AD](https://docs.microsoft.com/azure/active-directory/active-directory-licensing-whatis-azure-portal). + +### Existing Enterprise deployments + +If you are running Windows 10, version 1803 or later, Subscription Activation will automatically pull the firmware-embedded Windows 10 activation key and activate the underlying Pro License. The license will then step-up to Windows 10 Enterprise using Subscription Activation. This automatically migrates your devices from KMS or MAK activated Enterprise to Subscription activated Enterprise. + +If you are using Windows 10, version 1607, 1703, or 1709 and have already deployed Windows 10 Enterprise, but you want to move away from depending on KMS servers and MAK keys for Windows client machines, you can seamlessly transition as long as the computer has been activated with a firmware-embedded Windows 10 Pro product key. + +If the computer has never been activated with a Pro key, run the following script. Copy the text below into a .cmd file and run the file from an elevated command prompt: + +
                                  +@echo off
+FOR /F "skip=1" %%A IN ('wmic path SoftwareLicensingService get OA3xOriginalProductKey') DO  ( 
+SET "ProductKey=%%A"
+goto InstallKey
+)
+
+:InstallKey
+IF [%ProductKey%]==[] (
+echo No key present
+) ELSE (
+echo Installing %ProductKey%
+changepk.exe /ProductKey %ProductKey%
+)
+
                                  + +### Obtaining an Azure AD license + +Enterprise Agreement/Software Assurance (EA/SA): +- Organizations with a traditional EA must order a $0 SKU, process e-mails sent to the license administrator for the company, and assign licenses using Azure AD (ideally to groups using the new Azure AD Premium feature for group assignment). For more information, see [Enabling Subscription Activation with an existing EA](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses#enabling-subscription-activation-with-an-existing-ea). +- The license administrator can assign seats to Azure AD users with the same process that is used for O365. +- New EA/SA Windows Enterprise customers can acquire both an SA subscription and an associated $0 cloud subscription. + +Microsoft Products & Services Agreements (MPSA): +- Organizations with MPSA are automatically emailed the details of the new service. They must take steps to process the instructions. +- Existing MPSA customers will receive service activation emails that allow their customer administrator to assign users to the service. +- New MPSA customers who purchase the Software Subscription Windows Enterprise E3 and E5 will be enabled for both the traditional key-based and new subscriptions activation method. + +### Deploying licenses + +See [Deploy Windows 10 Enterprise licenses](deploy-enterprise-licenses.md). + +## Virtual Desktop Access (VDA) + +Subscriptions to Windows 10 Enterprise are also available for virtualized clients. Windows 10 Enterprise E3 and E5 are available for Virtual Desktop Access (VDA) in Windows Azure or in another [qualified multitenant hoster](https://www.microsoft.com/CloudandHosting/licensing_sca.aspx). + +Virtual machines (VMs) must be configured to enable Windows 10 Enterprise subscriptions for VDA. Active Directory-joined and Azure Active Directory-joined clients are supported. See [Enable VDA for Subscription Activation](vda-subscription-activation.md). + +## Related topics + +[Connect domain-joined devices to Azure AD for Windows 10 experiences](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-devices-group-policy/)
                                  +[Compare Windows 10 editions](https://www.microsoft.com/WindowsForBusiness/Compare)
                                  +[Windows for business](https://www.microsoft.com/windowsforbusiness/default.aspx)
                                  diff --git a/windows/deployment/windows-adk-scenarios-for-it-pros.md b/windows/deployment/windows-adk-scenarios-for-it-pros.md index 06d9b89385..861ef1b1ad 100644 --- a/windows/deployment/windows-adk-scenarios-for-it-pros.md +++ b/windows/deployment/windows-adk-scenarios-for-it-pros.md @@ -1,94 +1,97 @@ ---- -title: Windows ADK for Windows 10 scenarios for IT Pros (Windows 10) -description: The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. -ms.assetid: FC4EB39B-29BA-4920-87C2-A00D711AE48B -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -author: greg-lindsay -ms.date: 07/27/2017 -ms.topic: article ---- - -# Windows ADK for Windows 10 scenarios for IT Pros - - -The [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. For an overview of what's new in the Windows ADK for Windows 10, see [What's new in kits and tools](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx). - -In previous releases of Windows, the Windows ADK docs were published on both TechNet and the MSDN Hardware Dev Center. Starting with the Windows 10 release, Windows ADK documentation is available on the MSDN Hardware Dev Center. For the Windows 10 ADK reference content, see [Desktop manufacturing](https://msdn.microsoft.com/library/windows/hardware/dn938361.aspx). - -Here are some key scenarios that will help you find the content on the MSDN Hardware Dev Center. - -### Create a Windows image using command-line tools - -[DISM](https://msdn.microsoft.com/library/windows/hardware/dn898558.aspx) is used to mount and service Windows images. - -Here are some things you can do with DISM: - -- [Mount an offline image](https://msdn.microsoft.com/library/windows/hardware/dn938321.aspx) -- [Add drivers to an offline image](https://msdn.microsoft.com/library/windows/hardware/dn898469.aspx) -- [Enable or disable Windows features](https://msdn.microsoft.com/library/windows/hardware/dn898567.aspx) -- [Add or remove packages](https://msdn.microsoft.com/library/windows/hardware/dn898481.aspx) -- [Add language packs](https://msdn.microsoft.com/library/windows/hardware/dn898470.aspx) -- [Add Universal Windows apps](https://msdn.microsoft.com/library/windows/hardware/dn898600.aspx) -- [Upgrade the Windows edition](https://msdn.microsoft.com/library/windows/hardware/dn898500.aspx) - -[Sysprep](https://msdn.microsoft.com/library/windows/hardware/dn938335.aspx) prepares a Windows installation for imaging and allows you to capture a customized installation. - -Here are some things you can do with Sysprep: - -- [Generalize a Windows installation](https://msdn.microsoft.com/library/windows/hardware/dn938334.aspx) -- [Customize the default user profile](https://msdn.microsoft.com/library/windows/hardware/dn898521.aspx) -- [Use answer files](https://msdn.microsoft.com/library/windows/hardware/dn938346.aspx) - -[Windows PE (WinPE)](https://msdn.microsoft.com/library/windows/hardware/dn938389.aspx) is a small operating system used to boot a computer that does not have an operating system. You can boot to Windows PE and then install a new operating system, recover data, or repair an existing operating system. - -Here are ways you can create a WinPE image: - -- [Create a bootable USB drive](https://msdn.microsoft.com/library/windows/hardware/dn938386.aspx) -- [Create a Boot CD, DVD, ISO, or VHD](https://msdn.microsoft.com/library/windows/hardware/dn938385.aspx) - -[Windows Recovery Environment (Windows RE)](https://msdn.microsoft.com/library/windows/hardware/dn938364.aspx) is a recovery environment that can repair common operating system problems. - -Here are some things you can do with Windows RE: - -- [Customize Windows RE](https://msdn.microsoft.com/library/windows/hardware/dn898523.aspx) -- [Push-button reset](https://msdn.microsoft.com/library/windows/hardware/dn938307.aspx) - -[Windows System Image Manager (Windows SIM)](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx) helps you create answer files that change Windows settings and run scripts during installation. - -Here are some things you can do with Windows SIM: - -- [Create answer file](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx) -- [Add a driver path to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915062.aspx) -- [Add a package to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915066.aspx) -- [Add a custom command to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915058.aspx) - -For a list of settings you can change, see [Unattended Windows Setup Reference](https://msdn.microsoft.com/library/windows/hardware/dn923277.aspx) on the MSDN Hardware Dev Center. - -### Create a Windows image using Windows ICD - -Introduced in Windows 10, [Windows Imaging and Configuration Designer (ICD)](https://msdn.microsoft.com/library/windows/hardware/dn916113.aspx) streamlines the customizing and provisioning of a Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), Windows 10 Mobile, or Windows 10 IoT Core (IoT Core) image. - -Here are some things you can do with Windows ICD: - -- [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107.aspx) -- [Export a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916110.aspx) -- [Build and deploy an image for Windows 10 for desktop editions](https://msdn.microsoft.com/library/windows/hardware/dn916105.aspx) - -### IT Pro Windows deployment tools - -There are also a few tools included in the Windows ADK that are specific to IT Pros and this documentation is available on TechNet: - -- [Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) -- [User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) - -  - -  - - - - - +--- +title: Windows ADK for Windows 10 scenarios for IT Pros (Windows 10) +description: The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. +ms.assetid: FC4EB39B-29BA-4920-87C2-A00D711AE48B +ms.reviewer: +manager: laurawi +ms.audience: itpro author: greg-lindsay +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro author: greg-lindsay +ms.date: 07/27/2017 +ms.topic: article +--- + +# Windows ADK for Windows 10 scenarios for IT Pros + + +The [Windows Assessment and Deployment Kit](https://go.microsoft.com/fwlink/p/?LinkId=526803) (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. For an overview of what's new in the Windows ADK for Windows 10, see [What's new in kits and tools](https://msdn.microsoft.com/library/windows/hardware/dn927348.aspx). + +In previous releases of Windows, the Windows ADK docs were published on both TechNet and the MSDN Hardware Dev Center. Starting with the Windows 10 release, Windows ADK documentation is available on the MSDN Hardware Dev Center. For the Windows 10 ADK reference content, see [Desktop manufacturing](https://msdn.microsoft.com/library/windows/hardware/dn938361.aspx). + +Here are some key scenarios that will help you find the content on the MSDN Hardware Dev Center. + +### Create a Windows image using command-line tools + +[DISM](https://msdn.microsoft.com/library/windows/hardware/dn898558.aspx) is used to mount and service Windows images. + +Here are some things you can do with DISM: + +- [Mount an offline image](https://msdn.microsoft.com/library/windows/hardware/dn938321.aspx) +- [Add drivers to an offline image](https://msdn.microsoft.com/library/windows/hardware/dn898469.aspx) +- [Enable or disable Windows features](https://msdn.microsoft.com/library/windows/hardware/dn898567.aspx) +- [Add or remove packages](https://msdn.microsoft.com/library/windows/hardware/dn898481.aspx) +- [Add language packs](https://msdn.microsoft.com/library/windows/hardware/dn898470.aspx) +- [Add Universal Windows apps](https://msdn.microsoft.com/library/windows/hardware/dn898600.aspx) +- [Upgrade the Windows edition](https://msdn.microsoft.com/library/windows/hardware/dn898500.aspx) + +[Sysprep](https://msdn.microsoft.com/library/windows/hardware/dn938335.aspx) prepares a Windows installation for imaging and allows you to capture a customized installation. + +Here are some things you can do with Sysprep: + +- [Generalize a Windows installation](https://msdn.microsoft.com/library/windows/hardware/dn938334.aspx) +- [Customize the default user profile](https://msdn.microsoft.com/library/windows/hardware/dn898521.aspx) +- [Use answer files](https://msdn.microsoft.com/library/windows/hardware/dn938346.aspx) + +[Windows PE (WinPE)](https://msdn.microsoft.com/library/windows/hardware/dn938389.aspx) is a small operating system used to boot a computer that does not have an operating system. You can boot to Windows PE and then install a new operating system, recover data, or repair an existing operating system. + +Here are ways you can create a WinPE image: + +- [Create a bootable USB drive](https://msdn.microsoft.com/library/windows/hardware/dn938386.aspx) +- [Create a Boot CD, DVD, ISO, or VHD](https://msdn.microsoft.com/library/windows/hardware/dn938385.aspx) + +[Windows Recovery Environment (Windows RE)](https://msdn.microsoft.com/library/windows/hardware/dn938364.aspx) is a recovery environment that can repair common operating system problems. + +Here are some things you can do with Windows RE: + +- [Customize Windows RE](https://msdn.microsoft.com/library/windows/hardware/dn898523.aspx) +- [Push-button reset](https://msdn.microsoft.com/library/windows/hardware/dn938307.aspx) + +[Windows System Image Manager (Windows SIM)](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx) helps you create answer files that change Windows settings and run scripts during installation. + +Here are some things you can do with Windows SIM: + +- [Create answer file](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx) +- [Add a driver path to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915062.aspx) +- [Add a package to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915066.aspx) +- [Add a custom command to an answer file](https://msdn.microsoft.com/library/windows/hardware/dn915058.aspx) + +For a list of settings you can change, see [Unattended Windows Setup Reference](https://msdn.microsoft.com/library/windows/hardware/dn923277.aspx) on the MSDN Hardware Dev Center. + +### Create a Windows image using Windows ICD + +Introduced in Windows 10, [Windows Imaging and Configuration Designer (ICD)](https://msdn.microsoft.com/library/windows/hardware/dn916113.aspx) streamlines the customizing and provisioning of a Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), Windows 10 Mobile, or Windows 10 IoT Core (IoT Core) image. + +Here are some things you can do with Windows ICD: + +- [Build and apply a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916107.aspx) +- [Export a provisioning package](https://msdn.microsoft.com/library/windows/hardware/dn916110.aspx) +- [Build and deploy an image for Windows 10 for desktop editions](https://msdn.microsoft.com/library/windows/hardware/dn916105.aspx) + +### IT Pro Windows deployment tools + +There are also a few tools included in the Windows ADK that are specific to IT Pros and this documentation is available on TechNet: + +- [Volume Activation Management Tool (VAMT) Technical Reference](volume-activation/volume-activation-management-tool.md) +- [User State Migration Tool (USMT) Technical Reference](usmt/usmt-technical-reference.md) + +  + +  + + + + + diff --git a/windows/deployment/windows-autopilot/TOC.md b/windows/deployment/windows-autopilot/TOC.md index 35cd9c6cba..d94b04fdcb 100644 --- a/windows/deployment/windows-autopilot/TOC.md +++ b/windows/deployment/windows-autopilot/TOC.md @@ -1,31 +1,32 @@ -# [Windows Autopilot](windows-autopilot.md) +# [Windows Autopilot deployment](index.md) +# [What's new](windows-autopilot-whats-new.md) +# Understanding Windows Autopilot +## [Overview](windows-autopilot.md) ## [Requirements](windows-autopilot-requirements.md) -### [Configuration requirements](windows-autopilot-requirements-configuration.md) -#### [Intune Connector (preview)](intune-connector.md) -### [Network requirements](windows-autopilot-requirements-network.md) -### [Licensing requirements](windows-autopilot-requirements-licensing.md) -## [Scenarios and Capabilities](windows-autopilot-scenarios.md) -### [Support for existing devices](existing-devices.md) -### [User-driven mode](user-driven.md) -#### [Azure Active Directory joined](user-driven-aad.md) -#### [Hybrid Azure Active Directory joined](user-driven-hybrid.md) -### [Self-deploying mode](self-deploying.md) -### [Windows Autopilot Reset](windows-autopilot-reset.md) -#### [Remote reset](windows-autopilot-reset-remote.md) -#### [Local reset](windows-autopilot-reset-local.md) -## [Administering Autopilot](administer.md) -### [Configuring](configure-autopilot.md) -#### [Adding devices](add-devices.md) -#### [Creating profiles](profiles.md) -#### [Enrollment status page](enrollment-status.md) -#### [BitLocker encryption](bitlocker.md) -### [Administering Autopilot via Partner Center](https://docs.microsoft.com/en-us/partner-center/autopilot) -### [Administering Autopilot via Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot) -### [Administering Autopilot via Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles) -### [Administering Autopilot via Microsoft 365 Business & Office 365 Admin portal](https://support.office.com/article/Create-and-edit-Autopilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa) -## Getting started -### [Demonstrate Autopilot deployment on a VM](demonstrate-deployment-on-vm.md) -## [Customer consent](registration-auth.md) +## [Scenarios and capabilities](windows-autopilot-scenarios.md) +## [Get started](demonstrate-deployment-on-vm.md) + +# Deployment scenarios +## [Deployment processes](deployment-process.md) +## [User-driven mode](user-driven.md) +## [Self-deploying mode](self-deploying.md) +## [Windows Autopilot Reset](windows-autopilot-reset.md) +## [White glove](white-glove.md) +## [Support for existing devices](existing-devices.md) + +# Administering Windows Autopilot +## [Registering devices](add-devices.md) +## [Configuring device profiles](profiles.md) +## [Enrollment Status Page](enrollment-status.md) +## [BitLocker encryption](bitlocker.md) +## [DFCI management](dfci-management.md) +## [Windows Autopilot update](autopilot-update.md) ## [Troubleshooting](troubleshooting.md) +## [Known issues](known-issues.md) + +# Support ## [FAQ](autopilot-faq.md) -## [Support](autopilot-support.md) +## [Contacts](autopilot-support.md) +## [Registration authorization](registration-auth.md) +## [Device guidelines](autopilot-device-guidelines.md) +## [Motherboard replacement](autopilot-mbr.md) diff --git a/windows/deployment/windows-autopilot/add-devices.md b/windows/deployment/windows-autopilot/add-devices.md index 853bcdd07b..e674b3196e 100644 --- a/windows/deployment/windows-autopilot/add-devices.md +++ b/windows/deployment/windows-autopilot/add-devices.md @@ -1,5 +1,7 @@ --- title: Adding devices +ms.reviewer: +manager: laurawi description: How to add devices to Windows Autopilot keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune ms.prod: w10 @@ -7,8 +9,9 @@ ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library ms.pagetype: deploy +audience: itpro author: greg-lindsay -ms.author: greg-lindsay +ms.author: greglin ms.collection: M365-modern-desktop ms.topic: article --- @@ -18,35 +21,54 @@ ms.topic: article **Applies to** -- Windows 10 +- Windows 10 Before deploying a device using Windows Autopilot, the device must be registered with the Windows Autopilot deployment service. Ideally, this would be performed by the OEM, reseller, or distributor from which the devices were purchased, but this can also be done by the organization by collecting the hardware identity and uploading it manually. +## OEM registration + +When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers and resellers" section of the [Windows Autopilot information page](https://aka.ms/windowsautopilot). + +Before an OEM can register devices on behalf of an organization, the organization must grant the OEM permission to do so. This process is initiated by the OEM, with approval granted by an Azure AD global administrator from the organization. See the "Customer Consent" section of the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#oem-authorization). + +## Reseller, distributor, or partner registration + +Customers may purchase devices from resellers, distributors, or other partners. As long as these resellers, distributors, and partners are part of the [Cloud Solution Partners (CSP) program](https://partner.microsoft.com/en-us/cloud-solution-provider), they too can register devices on behalf of the customer. + +As with OEMs, CSP partners must be granted permission to register devices on behalf of an organization. This follows the process described on the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#csp-authorization). The CSP partner initiates a request to establish a relationship with the organization, with approval granted by a global administrator from the organization. Once approved, CSP partners add devices using [Partner Center](https://partner.microsoft.com/en-us/pcv/dashboard/overview), either directly through the web site or via available APIs that can automate the same tasks. + +Windows Autopilot does not require delegated administrator permissions when establishing the relationship between the CSP partner and the organization. As part of the approval process performed by the global administrator, the global administrator can choose to uncheck the "Include delegated administration permissions" checkbox. + +## Automatic registration of existing devices + +If an existing device is already running a supported version of Windows 10 semi-annual channel and enrolled in an MDM service such an Intune, that MDM service can ask the device for the hardware ID (also known as a hardware hash). Once it has that, it can automatically register the device with Windows Autopilot. + +For instructions on how to do this with Microsoft Intune, see [Create an Autopilot deployment profile](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-deployment-profile) documentation describing the "Convert all targeted devices to Autopilot" setting. + +Also note that when using the [Windows Autopilot for existing devices](https://docs.microsoft.com/windows/deployment/windows-autopilot/existing-devices) scenario, it is not necessary to pre-register the devices with Windows Autopilot. Instead, a configuration file (AutopilotConfigurationFile.json) containing all the Windows Autopilot profile settings is used; the device can be registered with Windows Autopilot after the fact using the same "Convert all targeted devices to Autopilot" setting. + ## Manual registration -To perform manual registration of a device, you must caputure its hardware ID (also known as a hardware hash) and upload this to the Windows Autopilot deployment service. See the topics below for detailed information on how to collect and upload hardware IDs. - ->[!IMPORTANT] ->Do not connect devices to the Internet prior to capturing the hardware ID and creating an Autopilot device profile. This includes collecting the hardware ID, uploading the .CSV into MSfB or Intune, assigning the profile, and confirming the profile assignment. Connecting the device to the Internet before this process is complete will result in the device downloading a blank profile that is stored on the device until it is explicity removed. In Windows 10 version 1809, you can clear the cached profile by restarting OOBE. In previous versions, the only way to clear the stored profile is to re-install the OS, reimage the PC, or run **sysprep /generalize /oobe**.
                                  ->After Intune reports the profile ready to go, only then should the device be connected to the Internet. - -Also note that if OOBE is restarted too many times it can enter a recovery mode and fail to run the Autopilot configuration. You can identify this scenario if OOBE displays multiple configuration options on the same page, including language, region, and keyboard layout. The normal OOBE displays each of these on a separate page. The following value key tracks the count of OOBE retries: - -**HKCU\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UserOOBE** - -To ensure OOBE has not been restarted too many times, you can change this value to 1. +To perform manual registration of a device, you must first capture its hardware ID (also known as a hardware hash). Once this process has completed, the resulting hardware ID can be uploaded to the Windows Autopilot service. Because this process requires booting the device into Windows 10 in order to obtain the hardware ID, this is intended primarily for testing and evaluation scenarios. ## Device identification -To define a device to the Windows Autopilot deployment service, a unique hardware ID for the device needs to be captured and uploaded to the service. While this step is ideally done by the hardware vendor (OEM, reseller, or distributor), automatically associating the device with an organization, it is also possible to do this through a harvesting process that collects the device from within a running Windows 10 version 1703 or later installation. +To define a device to the Windows Autopilot deployment service, a unique hardware ID for the device needs to be captured and uploaded to the service. While this step is ideally done by the hardware vendor (OEM, reseller, or distributor), automatically associating the device with an organization, it is also possible to do this through a harvesting process that collects the device from within a running Windows 10 installation. The hardware ID, also commonly referred to as a hardware hash, contains several details about the device, including its manufacturer, model, device serial number, hard drive serial number, and many other attributes that can be used to uniquely identify that device. -Note that the hardware hash also contains details about when it was generated, so it will change each time it is generated. When the Windows Autopilot Deployment Service attempts to match a device, it considers changes like that, as well as more substantial changes such as a new hard drive, and is still able to match successfully. But substantial changes to the hardware, such as motherboard replacement, would not match, so the device would need to be re-uploaded. +Note that the hardware hash also contains details about when it was generated, so it will change each time it is generated. When the Windows Autopilot deployment service attempts to match a device, it considers changes like that, as well as more substantial changes such as a new hard drive, and is still able to match successfully. But substantial changes to the hardware, such as a motherboard replacement, would not match, so a new hash would need to be generated and uploaded. -## Collecting the hardware ID from existing devices using PowerShell +### Collecting the hardware ID from existing devices using Microsoft Endpoint Configuration Manager -The hardware ID, or hardware hash, for an existing device is available through Windows Management Instrumentation (WMI), as long as that device is running Windows 10 version 1703 or later. To help gather this information, as well as the serial number of the device (useful to see at a glance the machine to which it belongs), a PowerShell script called [Get-WindowsAutoPilotInfo.ps1 has been published to the PowerShell Gallery website](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo). +Microsoft Endpoint Configuration Manager automatically collects the hardware hashes for existing Windows 10 devices. For more information, see [Gather information from Configuration Manager for Windows Autopilot](https://docs.microsoft.com/configmgr/comanage/how-to-prepare-win10#windows-autopilot). You can extract the hash information from Configuration Manager into a CSV file. + +> [!Note] +> Before uploading the CSV file on Intune, please make sure that the first row contains the device serial number, Windows product ID, hardware hash, group tag, and assigned user. If there is header information on the top of CSV file, please delete that header information. See details at [Enroll Windows devices in Intune](https://docs.microsoft.com/intune/enrollment/enrollment-autopilot). + +### Collecting the hardware ID from existing devices using PowerShell + +The hardware ID, or hardware hash, for an existing device is available through Windows Management Instrumentation (WMI), as long as that device is running a supported version of Windows 10 semi-annual channel. To help gather this information, as well as the serial number of the device (useful to see at a glance the machine to which it belongs), a PowerShell script called [Get-WindowsAutoPilotInfo.ps1 has been published to the PowerShell Gallery website](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo). To use this script, you can download it from the PowerShell Gallery and run it on each computer, or you can install it directly from the PowerShell Gallery. To install it directly and capture the hardware hash from the local computer, use the following commands from an elevated Windows PowerShell prompt: @@ -58,27 +80,95 @@ Install-Script -Name Get-WindowsAutoPilotInfo Get-WindowsAutoPilotInfo.ps1 -OutputFile AutoPilotHWID.csv ``` -The commands can also be run remotely, as long as WMI permissions are in place and WMI is accessible through the Windows Firewall on that remote computer. See the Get-WindowsAutoPilotInfo script’s help (using “Get-Help Get-WindowsAutoPilotInfo.ps1”) for more information about running the script. +The commands can also be run remotely, as long as WMI permissions are in place and WMI is accessible through the Windows Firewall on that remote computer. See the [Get-WindowsAutoPilotInfo](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo) script’s help (using “Get-Help Get-WindowsAutoPilotInfo.ps1”) for more information about running the script. + +>[!IMPORTANT] +>Do not connect devices to the Internet prior to capturing the hardware ID and creating an Autopilot device profile. This includes collecting the hardware ID, uploading the .CSV into MSfB or Intune, assigning the profile, and confirming the profile assignment. Connecting the device to the Internet before this process is complete will result in the device downloading a blank profile that is stored on the device until it is explicity removed. In Windows 10 version 1809, you can clear the cached profile by restarting OOBE. In previous versions, the only way to clear the stored profile is to re-install the OS, reimage the PC, or run **sysprep /generalize /oobe**.
                                  +>After Intune reports the profile ready to go, only then should the device be connected to the Internet. >[!NOTE] ->If you will connect to the device remotely to collect the hardware ID, see the information at the top of this page about device connectivity to the Internet. - -## Collecting the hardware ID from existing devices using System Center Configuration Manager - -Starting with System Center Configuration Manager current branch version 1802, the hardware hashes for existing Windows 10 version 1703 and higher devices are automatically collected by Configuration Manager. See the [What’s new in version 1802](https://docs.microsoft.com/sccm/core/plan-design/changes/whats-new-in-version-1802#report-on-windows-autopilot-device-information) documentation for more details. +>If OOBE is restarted too many times it can enter a recovery mode and fail to run the Autopilot configuration. You can identify this scenario if OOBE displays multiple configuration options on the same page, including language, region, and keyboard layout. The normal OOBE displays each of these on a separate page. The following value key tracks the count of OOBE retries:
                                  +>**HKCU\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UserOOBE**
                                  +>To ensure OOBE has not been restarted too many times, you can change this value to 1. ## Registering devices -Once the hardware IDs have been captured from existing devices, they can be uploaded through a variety of means. See the detailed documentation for each available mechanism: + -For guidance on how to register devices, configure and apply deployment profiles, follow one of the available administration options: -- [Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot) +Once the hardware IDs have been captured from existing devices, they can be uploaded through a variety of means. See the detailed documentation for each available mechanism. -- [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles) +- [Microsoft Intune](https://docs.microsoft.com/intune/enrollment-autopilot). This is the preferred mechanism for all customers. +- [Partner Center](https://msdn.microsoft.com/partner-center/autopilot). This is used by CSP partners to register devices on behalf of customers. +- [Microsoft 365 Business & Office 365 Admin](https://support.office.com/article/Create-and-edit-AutoPilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa). This is typically used by small and medium businesses (SMBs) who manage their devices using Microsoft 365 Business. +- [Microsoft Store for Business](https://docs.microsoft.com/microsoft-store/add-profile-to-devices#manage-autopilot-deployment-profiles). You might already be using MSfB to manage your apps and settings. -- [Microsoft 365 Business & Office 365 Admin](https://support.office.com/article/Create-and-edit-AutoPilot-profiles-5cf7139e-cfa1-4765-8aad-001af1c74faa) +A summary of each platform's capabilities is provided below.
                                  +
                                  + + + + + + + -- [Partner Center](https://msdn.microsoft.com/partner-center/autopilot) + + + + + + -For those using Microsoft Intune, devices should normally be uploaded via Intune; for those using Microsoft 365 Business, its administrative portal would be used. For [Cloud Solution Provider (CSP)](https://partnercenter.microsoft.com/en-us/partner/cloud-solution-provider) partners uploading devices on the behalf of a customer that they are authorized to manage, Partner Center can be used. For any other scenario, the Microsoft Store for Business is available. + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  Platform/PortalRegister devices?Create/Assign profileAcceptable DeviceID
                                  OEM Direct APIYES - 1000 at a time maxNOTuple or PKID
                                  Partner CenterYES - 1000 at a time maxYES34Tuple or PKID or 4K HH
                                  IntuneYES - 500 at a time max1YES124K HH
                                  Microsoft Store for Business4YES - 1000 at a time maxYES44K HH
                                  Microsoft 365 BusinessYES - 1000 at a time maxYES34K HH
                                  + +>1Microsoft recommended platform to use
                                  +>2Intune license required
                                  +>3Feature capabilities are limited
                                  +>4To be retired
                                  + +Also see the following topics for more information about device IDs: +- [Device identification](#device-identification) +- [Windows Autopilot device guidelines](https://docs.microsoft.com/windows/deployment/windows-autopilot/autopilot-device-guidelines) +- [Add devices to a customer account](https://docs.microsoft.com/partner-center/autopilot) + + +## Summary + +When deploying new devices using Windows Autopilot, the following steps are required: + +1. [Register devices](#registering-devices). Ideally, this step is performed by the OEM, reseller, or distributor from which the devices were purchased, but this can also be done by the organization by collecting the hardware identity and uploading it manually. +2. [Configure device profiles](profiles.md), specifying how the device should be deployed and what user experience should be presented. +3. Boot the device. When the device is connected to a network with internet access, it will contact the Windows Autopilot deployment service to see if the device is registered, and if it is, it will download profile settings such as the [Enrollment Status page](enrollment-status.md), which are used to customize the end user experience. + +## Other configuration settings + +- [Bitlocker encryption settings](bitlocker.md): You can configure the BitLocker encryption settings to be applied before automatic encryption is started. \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/administer.md b/windows/deployment/windows-autopilot/administer.md deleted file mode 100644 index 402c3a2f7d..0000000000 --- a/windows/deployment/windows-autopilot/administer.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Administering Autopilot -description: A short description of methods for configuring Autopilot -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: low -ms.sitesec: library -ms.pagetype: deploy -author: greg-lindsay -ms.author: greg-lindsay -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Administering Autopilot - -**Applies to: Windows 10** - -Several platforms are available to register devices with Windows Autopilot. A summary of each platform's capabilities is provided below. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  Platform/Portal -Register devices? -Create/Assign profile -Acceptable DeviceID -
                                  OEM Direct APIYES - 1000 at a time maxNOTuple or PKID
                                  Partner CenterYES - 1000 at a time max\*YESTuple or PKID or 4K HH
                                  IntuneYES - 175 at a time maxYES\*4K HH
                                  Microsoft Store for BusinessYES - 1000 at a time maxYES4K HH
                                  Microsoft Business 365YES - 1000 at a time maxYES4K HH
                                  - ->*Microsoft recommended platform to use \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/autopilot-device-guidelines.md b/windows/deployment/windows-autopilot/autopilot-device-guidelines.md new file mode 100644 index 0000000000..43ac6da548 --- /dev/null +++ b/windows/deployment/windows-autopilot/autopilot-device-guidelines.md @@ -0,0 +1,47 @@ +--- +title: Windows Autopilot device guidelines +ms.reviewer: +manager: laurawi +description: Learn all about hardware, firmware, and software best practices for Windows Autopilot deployment. +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot device guidelines + +**Applies to** + +- Windows 10 + +## Hardware and firmware best practice guidelines for Windows Autopilot + +All devices used with Windows Autopilot should meet the [minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) for Windows 10. + +The following additional best practices ensure that devices can easily be provisioned by organizations as part of the Windows Autopilot deployment process: +- Ensure that the TPM 2.0 is enabled and in a good state (not in Reduced Functionality Mode) by default on devices intended for Windows Autopilot self-deploying mode. +- The OEM provisions unique tuple info (SmbiosSystemManufacturer, SmbiosSystemProductName, SmbiosSystemSerialNumber) or PKID + SmbiosSystemSerialNumber into the [SMBIOS fields](https://docs.microsoft.com/windows-hardware/drivers/bringup/smbios) per Microsoft specification (Manufacturer, Product Name and Serial Number stored in SMBIOS Type 1 04h, Type 1 05h and Type 1 07h). +- The OEM uploads 4K Hardware Hashes obtained using OA3 Tool RS3+ run in Audit mode on full OS to Microsoft via CBR report prior to shipping devices to an Autopilot customer or channel partner. +- As a best practice, Microsoft requires that OEM shipping drivers are published to Windows Update within 30 days of the CBR being submitted, and system firmware and driver updates are published to Windows Update within 14 days +- The OEM ensures that the PKID provisioned in the SMBIOS is passed on to the channel. + +## Software best practice guidelines for Windows Autopilot + +- The Windows Autopilot device should be preinstalled with only a Windows 10 base image plus drivers. +- You can preinstall your licensed version of Office, such as [Office 365 ProPlus](https://docs.microsoft.com/deployoffice/about-office-365-proplus-in-the-enterprise). +- Unless explicitly requested by the customer, no other preinstalled software should be included. + - Per OEM Policy, Windows 10 features, including built-in apps, should not be disabled or removed. + +## Related topics + +[Windows Autopilot customer consent](registration-auth.md)
                                  +[Motherboard replacement scenario guidance](autopilot-mbr.md)
                                  diff --git a/windows/deployment/windows-autopilot/autopilot-faq.md b/windows/deployment/windows-autopilot/autopilot-faq.md index 7399e75801..616f6b21ce 100644 --- a/windows/deployment/windows-autopilot/autopilot-faq.md +++ b/windows/deployment/windows-autopilot/autopilot-faq.md @@ -1,161 +1,164 @@ ---- -title: Windows Autopilot support -description: Support information for Windows Autopilot -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: low -ms.sitesec: library -ms.pagetype: deploy -author: greg-lindsay -ms.author: greg-lindsay -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot FAQ - -**Applies to: Windows 10** - -This topic provides OEMs, partners, administrators, and end-users with answers to some frequently asked questions about deploying Windows 10 with Windows Autopilot. - -A [glossary](#glossary) of abbreviations used in this topic is provided at the end. - - -## Microsoft Partner Center - -| Question | Answer | -| --- | --- | -| In the Partner Center, does the Tenant ID need to be provided with every device file upload? Is this needed to allow the business customer to access their devices in MSfB? | No. Providing the Tenant ID is a one-time entry in the Partner Center that can be re-used with future device uploads. | -| How does the customer or tenant know that their devices are ready to be claimed in MSfB? | After the device file upload is completed in the Partner Center, the tenant can see the devices available for Windows Autopilot setup in MSfB. The OEM would need to advise the tenant to access MSfB. Auto-notification from MSfB to the tenant is being developed. | -| How does a customer authorize an OEM or Channel Partner to register Autopilot devices on the customer’s behalf? | Before an OEM or Channel Partner can register a device for Autopilot on behalf of a customer, the customer must first give them consent. The consent process begins with the OEM or Channel Partner sending a link to the customer, which directs the customer to a consent page in Microsoft Store for Business. The steps explaining this process are [here](registration-auth.md). | -| Are there any restrictions if a business customer has registered devices in MSfB and later wants those devices to be managed by a CSP via the Partner Center? | The devices will need to be deleted in MSfB by the business customer before the CSP can upload and manage them in the Partner Center. | -| Does Windows Autopilot support removing the option to enable a local administrator account? | Windows Autopilot doesn’t support removing the local admin account. However, it does support restricting the user performing AAD domain join in OOBE to a standard account (versus admin account by default).| -| How can I test the Windows Autopilot CSV file in the Partner Center? | Only CSP Partners have access to the Partner Center portal. If you are a CSP, you can create a Sales agent user account which has access to “Devices” for testing the file. This can be done today in the Partner Center.

                                  Go [here](https://msdn.microsoft.com/partner-center/create-user-accounts-and-set-permissions) for more information. | -| Must I become a Cloud Solution Provider (CSP) to participate in Windows Autopilot? | Top volume OEMs do not, as they can use the OEM Direct API. All others who choose to use MPC to register devices must become CSPs in order to access MPC. | -| Do the different CSP levels have all the same capabilities when it comes to Windows Autopilot? | For purposes of Windows Autopilot, there are three different types of CSPs, each with different levels of authority an access:

                                  1. Direct CSP: Gets direct authorization from the customer to register devices.

                                  2. Indirect CSP Provider: Gets implicit permission to register devices through the relationship their CSP Reseller partner has with the customer. Indirect CSP Providers register devices through Microsoft Partner Center.

                                  3. Indirect CSP Reseller: Gets direct authorization from the customer to register devices. At the same time, their indirect CSP Provider partner also gets authorization, which mean that either the Indirect Provider or the Indirect Reseller can register devices for the customer. However, the Indirect CSP Reseller must register devices through the MPC UI (manually uploading CSV file), whereas the Indirect CSP Provider has the option to register devices using the MPC APIs. | - -## Manufacturing - -| Question | Answer | -| --- | --- | -| What changes need to be made in the factory OS image for customer configuration settings? |No changes are required on the factory floor to enable Windows Autopilot deployment. | -| What version of the OA3 tool meets Windows Autopilot deployment requirements? | Windows Autopilot can work with any version of the OA3 tool. We recommend using Windows 10, version 1703 and above to generate the 4K Hardware Hash. | -| At the time of placing an order, do customers need to be state whether they want it with or without Windows Autopilot options? | Yes, if they want Windows Autopilot, they will want Windows 10, version 1703 or later versions. Also, they will want to receive the CSV file or have the file upload (i.e., registration) completed on their behalf. | -| Does the OEM need to manage or collect any custom imaging files from customers and perform any image uploads to Microsoft? | No change, OEMs just send the CBRs as usual to Microsoft. No images are sent to Microsoft to enable Windows Autopilot. Windows Autopilot only customizes OOBE and allows policy configurations (disables admin account, for example). | -| Are there any customer impacts to upgrading from Windows 8 to Windows 10? | The devices must have Windows 10, version 1703 or later to enroll in Windows Autopilot deployment, otherwise no impacts. | -| Will there be any change to the existing CBR with 4k Hardware Hash? | No. | -| What new information needs to be sent from the OEM to Microsoft? | Nothing, unless the OEM opts to register the device on the customer’s behalf, in which case they would upload the device ID via a CSV file into Microsoft Partner Center, or use the OEM Direct API. | -| Is there a contract or amendment for an OEM to participate in Windows Autopilot Deployment? | No. | - -## CSV schema - -| Question | Answer | -| --- | --- | -| Can a comma be used in the CSV file? | No. | -| What error messages can a user expect to see in the Partner Center or MSfB when uploading a file? | See the “In Microsoft Store for Business” section of this guide. | -| Is there a limit to the number of devices that can be listed in the CSV file? | Yes, the CSV file can only contain 1,000 devices to apply to a single profile. If more than 1,000 devices need to be applied to a profile, the devices need to be uploaded through multiple CSV files. | -| Does Microsoft have any recommendations on how an OEM should provide the CSV file to their customers? | Microsoft recommends encrypting the CSV file when sending to the business customer to self-register their Windows Autopilot devices (either through MPC, MSfB, or Intune). | - - -## Hardware hash - -| Question | Answer | -| --- | --- | -| Must every Hardware Hash submitted by the OEM contain the SMBIOS UUID (universally unique identifier), MAC (media access control) address and unique disk serial number (if using Windows 10, version 1703 and above OEM Activation 3.0 tool)? | Yes. Since Windows Autopilot is based on the ability to uniquely identify devices applying for cloud configuration, it is critical to submit Hardware Hashes which meet the outlined requirement. | -| What is the reason for needing the SMBIOS UUID, MAC Address and Disk Serial Number in the Hardware Hash details? | For creating the Hardware Hash, these are the fields that are needed to identify a device, as parts of the device are added/removed. Since we don’t have a unique identifier for Windows devices, this is the best logic to identify a device. | -| What is difference between OA3 Hardware Hash, 4K Hardware Hash, and Windows Autopilot Hardware Hash? | None. They’re different names for the same thing. The Windows 10, 1703 version of the OA3 tool output is called the OA3 Hash, which is 4K in size, which is usable for the Windows Autopilot deployment scenario. Note: When using a non-1703 version OA3Tool, you get a different sized Hash, which may not be used for Windows Autopilot deployment. | -| What is the thought around parts replacement and/or repair for the NIC (network interface controller) and/or Disk? Will the Hardware Hash become invalid? | Yes. If you replace parts, you need to gather the new Hardware Hash, though it depends on what is replaced, and the characteristics of the parts. For example, if you replace the TPM or motherboard, it’s a new device – you MUST have new Hardware Hash. If you replace one network card, it’s probably not a new device, and the device will function with the old Hardware Hash. However, as a best practice, you should assume the old Hardware Hash is invalid and get a new Hardware Hash after any hardware changes – this is Microsoft’s strong recommendation any time you replace parts. | - -## Motherboard replacement - -| Question | Answer | -| --- | --- | -| How does Autopilot handle motherboard replacement scenarios?” | Motherboard replacement is out for scope for Autopilot. Any device that is repaired or serviced in a way that alters the ability to identify the device for Windows Autopilot must go through the normal OOBE process, and manually select the right settings or apply a custom image - as is the case today.

                                  To reuse the same device for Windows Autopilot after a motherboard replacement, the device would need to be de-registered from Autopilot, the motherboard replaced, a new 4K HH harvested, and then re-registered using the new 4K HH (or device ID).

                                  **Note**: An OEM will not be able to use the OEM Direct API to re-register the device, since the OEM Direct API only accepts a tuple or PKID. In this case, the OEM would either have to send the new 4K HH info via a CSV file to customer, and let customer reregister the device via MSfB or Intune.| - -## SMBIOS - -| Question | Answer | -| --- | --- | -| Any specific requirement to SMBIOS UUID? | It must be unique as specified in the Windows 10 hardware requirements. | -| What is the requirement on the SMBIOS table to meet the Windows Autopilot Hardware Hash need? | It must meet all the Windows 10 hardware requirements. Additional details may be found [here](https://msdn.microsoft.com/library/jj128256(v=vs.85).aspx). | -| If the SMBIOS supports UUID and Serial Number, is it enough for the OA3 tool to generate the Hardware Hash? | No. At a minimum, the following SMBIOS fields need to be populated with unique values: ProductKeyID SmbiosSystemManufacturer SmbiosSystemProductName SmbiosSystemSerialNumber SmbiosSkuNumber SmbiosSystemFamily MacAddress SmbiosUuid DiskSerialNumber TPM EkPub | - -## Technical interface - -| Question | Answer | -| --- | --- | -| What is the interface to get the MAC Address and Disk Serial Number? How does the OA tool get MAC and Disk Serial #? | Disk serial number is found from IOCTL_STORAGE_QUERY_PROPERTY with StorageDeviceProperty/PropertyStandardQuery. Network MAC address is IOCTL_NDIS_QUERY_GLOBAL_STATS from OID_802_3_PERMANENT_ADDRESS. However the exact mechanisms/”interface” for doing this operation varies depending on the exact scenario being discussed. | -| Follow up clarification: If we have 2-3 MACs on the system, how does OA Tool choose which MAC Address and Disk Serial Number on the system since there are multiple instances of each? If a platform has LAN And WLAN, which MAC is chosen? | In short, all available values are used. In detail, there may be extra specific usage rules. The System disk serial number is more important than any other disks available. Network interfaces that are removable should not be used if detected as they are removable. LAN vs WLAN should not matter, both will be used. | - -## The end user experience - -| Question | Answer | -| --- | --- | -| How do I know that I received Autopilot? | You can tell that you received Windows Autopilot (as in the device received a configuration but has not yet applied it) when you skip the selection page (as seen below), and are immediately taken to a generic or customized sign-in page. | -| Windows Autopilot didn’t work, what do I do now? | Questions and actions to assist in troubleshooting: Did a screen not get skipped? Did a user end up as an admin when configured not to? Remember that AAD Admins will be local admins regardless of whether Windows Autopilot is configured to disable local admin Collection information – run licensingdiag.exe and send the .cab (Cabinet file) file that is generated to AutopilotHelp@microsoft.com. If possible, collect an ETL from WPR. Often in these cases, users are not signing into the right AAD tenant, or are creating local user accounts. For a complete list of support options, refer to [Windows Autopilot support](autopilot-support.md). | -| If an Administrator makes changes to an existing profile, will the changes take effect on devices that have that profile assigned to them that have already been deployed? | No. Windows Autopilot profiles are not resident on the device. They are downloaded during OOBE, the settings defined at the time are applied. Then, the profile is discarded on the device. If the device is re-imaged or reset, the new profile settings will take effect the next time the device goes through OOBE. | -| What is the experience if a device isn’t registered or if an IT Admin doesn’t configure Windows Autopilot prior to an end user attempting to self-deploy? | If the device isn’t registered, it will not receive the Windows Autopilot experience and the end user will go through normal OOBE. The Windows Autopilot configurations will NOT be applied until the user runs through OOBE again, after registration. If a device is started before an MDM profile is created, the device will go through standard OOBE experience. The IT Admin would then have to manually enrol that device into the MDM, after which—the next time that device is “reset”—it will go through the Windows Autopilot OOBE experience. | -| What may be a reason why I did not receive a customized sign-in screen during Autopilot? | Tenant branding must be configured in portal.azure.com to receive a customized sign-in experience. | -| What happens if a device is registered with Azure AD but does not have an Windows Autopilot profile assigned? | The regular AAD OOBE will occur since no Windows Autopilot profile was assigned to the device. | -| How can I collect logs on Autopilot? | The best way to collect logs on Windows Autopilot performance is to collect a Windows Performance Recorder (WPR) trace during OOBE. The XML file (WPRP extension) for this trace may be provided upon request. | - - -## MDM - -| Question | Answer | -| --- | --- | -| Must we use Intune for our MDM? | No. No, any MDM will work with Autopilot, but others probably won’t have the same full suite of Windows Autopilot features as Intune. You’ll get the best experience from Intune. | -| Can Intune support Win32 app preinstalls? | Yes. Starting with the Windows 10 October Update (version 1809), Intune supports Win32 apps using .msi (and .msix) wrappers. | -| What is co-management? | Co-management is when you use a combination of a cloud MDM tool (Intune) and an on-premise configuration tool like System Center Configuration Manager (SCCM). You only need to use SCCM if Intune can’t support what you want to do with your profile. If you choose to co-manage using Intune + SCCM, you do it by including an SCCM agent in your Intune profile. When that profile is pushed to the device, the device will see the SCCM agent and go out to SCCM to pull down any additional profile settings. | -| Must we use System Center Configuration Manager (SCCM) for Windows Autopilot | No. Co-management (described above) is optional. | - - -## Features - -| Question | Answer | -| --- | --- | -| Self-deploying mode | A new version of Windows Autopilot where the user only turns on the device, and nothing else. It’s useful for scenarios where a standard user account isn’t needed (e.g., shared devices, or KIOSK devices). | -| Hybrid Azure Active Directory join | Allows Windows Autopilot devices to connect to an on-premise Active Directory domain controller (in addition to being Azure AD joined). | -| Windows Autopilot reset | Removes user apps and settings from a device, but maintains AAD domain join and MDM enrollment. Useful for when transferring a device from one user to another. | -| Personalization | Adds the following to the OOBE experience: A personalized welcome message can be created A username hint can be added Sign-in page text can be personalized The company’s logo can be included | -| [Autopilot for existing devices](existing-devices.md) | Offers an upgrade path to Windows Autopilot for all existing Win 7/8 devices. | - - - -## General - -| Question | Answer | -| --- | --- | -| If I wipe the machine and restart, will I still receive Windows Autopilot? | Yes, if the device is still registered for Windows Autopilot and is running Windows 10, version 1703 7B and above releases, it will receive the Windows Autopilot experience. | -| Can I harvest the device fingerprint on existing machines? | Yes, if the device is running Windows 10, version 1703 and above, you can harvest device fingerprints for registration. There are no plans to backport the functionality to previous releases and no way to harvest them on pre-Windows 10 Windows 10, version 1703 devices that have not been updated to Windows 10, version 1703. | -| What is Windows 10, version 1703 7B and why does it matter? | Windows 10, version 1703 7B is a Windows 10, version 1703 image bundled with cumulative updates. To receive Autopilot, clients **must** run Windows 10, version 1703 7B or later. These cumulative updates contain a critical fix for Autopilot. Consider the following:

                                  Windows Autopilot will not apply its profiles to the machine unless AAD credentials match the expected AAD tenant. For the Windows 10, version 1703 release, it was assumed that would be determined by the domain name, so the domain name used to register (for example contoso.com) should match the domain name used to sign in (for example user@contoso.com). But what happens if your tenant has multiple domains (for example us.contoso.com, or fr.contoso.com)? Since these domain names do not match, the device will not be configured for Autopilot. However, both domains are part of the same AAD tenant, and as such it was determined the matching scheme was not useful. This was improved upon by making use of the tenant ID. By using the tenant ID, we can determine that if the user signs into a domain with a tenant matching the one they registered with, we can safely consider this to be a match. The fix for this problem already exists in Windows 10, version 1709 and was backported into the Windows 10, version 1703 7B release.

                                  **Key Take-Aways**: When using pre-Windows 10, version 1703 7B clients the user’s domain **must** match the domain they registered with. This functionality is found in Windows 10 version 1709 clients using build >= 16215, and Windows 10, version 1703 clients >= 7B. | -| What is the impact of not updating to 7B? | See the detailed scenario described directly above. | -| Is Windows Autopilot supported on other SKUs, e.g. Surface Hub, HoloLens, Windows Mobile. | No, Windows Autopilot isn’t supported on other SKUs. | -| Does Windows Autopilot work after MBR or image re-installation? | Yes. | -| Can machines that have reimaged a few times go through Autopilot? What does the error message "This user is not authorized to enroll" mean? Error code 801c0003. | There are limits to the number of devices a particular AAD user can enroll in AAD, as well as the number of devices that are supported per user in Intune. (These are somewhat configurable but not “infinite.”) You’ll run into this frequently if you reuse the devices, or even if you roll back to previous virtual machine snapshots. | -| What happens if a device is registered to a malicious agent? | By design, Windows Autopilot does not apply a profile until the user signs in with the matching tenant for the configured profile via the AAD sign-in process. What occurs is illustrated below. If badguys.com registers a device owned by contoso.com, at worst, the user would be directed to sign into badguys.com. When the user enters their email/password, the sign-in information is redirected through AAD to the proper AAD authentication and the user is prompted to then sign into contoso.com. Since contoso.com does not match badguys.com as the tenant, the Windows Autopilot profile will not be applied and the regular AAD OOBE will occur. | -| Where is the Windows Autopilot data stored? | Windows Autopilot data is stored in the United States (US), not in a sovereign cloud, even when the AAD tenant is registered in a sovereign cloud. This is applicable to all Windows Autopilot data, regardless of the portal leveraged to deploy Autopilot. | -| Why is Windows Autopilot data stored in the US and not in a sovereign cloud? | It is not customer data that we store, but business data which enables Microsoft to provide a service, therefore it is okay for the data to reside in the US. Customers can stop subscribing to the service any time, and, in that event, the business data is removed by Microsoft. | -| How many ways are there to register a device for Windows Autopilot | There are six ways to register a device, depending on who is doing the registering:

                                  1. OEM Direct API (only available to TVOs)
                                  2. MPC via the MPC API (must be a CSP)
                                  3. MPC via manual upload of CSV file in the UI (must be a CSP)
                                  4. MSfB via CSV file upload
                                  5. Intune via CSV file upload
                                  6. Microsoft 365 Business portal via CSV file upload | -| How many ways are there to create an Windows Autopilot profile? | There are four ways to create & assign an Windows Autopilot profile:

                                  1. Through MPC (must be a CSP)
                                  2. Through MSfB
                                  3. Through Intune (or another MDM)
                                  4. Microsoft 365 Business portal

                                  Microsoft recommends creation and assignment of profiles through Intune.| -| What are some common causes of registration failures? |
                                  1. Bad or missing Hardware hash entries can lead to faulty registration attempts
                                  2. Hidden special characters in CSV files.

                                  To avoid this issue, after creating your CSV file, open it in Notepad to look for hidden characters or trailing spaces or other corruptions.| - -## Glossary - -| Term | Meaning | -| --- | --- | -| CSV | Comma Separated Values (File type similar to Excel spreadsheet) | -| MPC | Microsoft Partner Center | -| MDM | Mobile Device Management | -| OEM | Original Equipment Manufacturer | -| CSP | Cloud Solution Provider | -| MSfB | Microsoft Store for Business | -| AAD | Azure Active Directory | -| 4K HH | 4K Hardware Hash | -| CBR | Computer Build Report | -| EC | Enterprise Commerce | -| DDS | Device Directory Service | -| OOBE | Out of the Box Experience | -| UUID | Universally Unique Identifier | +--- +title: Windows Autopilot FAQ +ms.reviewer: This topic provides OEMs, partners, administrators, and end users with answers to some frequently asked questions about deploying Windows 10 with Windows Autopilot. +manager: laurawi +description: Support information for Windows Autopilot +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: low +ms.sitesec: library +ms.pagetype: deploy +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot FAQ + +**Applies to: Windows 10** + +This article provides OEMs, partners, administrators, and end users with answers to some frequently asked questions about deploying Windows 10 with Windows Autopilot. + +A [glossary](#glossary) of abbreviations used in this article is provided at the end. + + +## Microsoft Partner Center + +| Question | Answer | +| --- | --- | +| In the Partner Center, does the Tenant ID need to be provided with every device file upload? Is it needed to allow the business customer to access their devices in Microsoft Store for Business (MSfB)? | No. Providing the Tenant ID is a one-time entry in the Partner Center that can be reused with future device uploads. | +| How does the customer or tenant know that their devices are ready to be claimed in MSfB? | After the device file upload is completed in the Partner Center, the tenant can see the devices available for Windows Autopilot setup in MSfB. The OEM needs to advise the tenant to access MSfB. Autonotification from MSfB to the tenant is being developed. | +| How does a customer authorize an OEM or Channel Partner to register Autopilot devices on the customer’s behalf? | Before an OEM or Channel Partner can register a device for Autopilot on behalf of a customer, the customer must first give them consent. The consent process begins with the OEM or Channel Partner sending a link to the customer that directs the customer to a consent page in MSfB. For more information, see [Registration](registration-auth.md). | +| Are there any restrictions if a business customer has registered devices in MSfB and later wants those devices to be managed by a Cloud Solution Provider (CSP) using the Partner Center? | The devices will need to be deleted in MSfB by the business customer before the CSP can upload and manage them in the Partner Center. | +| Does Windows Autopilot support removing the option to enable a local administrator account? | Windows Autopilot doesn’t support removing the local admin account. However, it does support restricting the user performing Azure Active Directory (Azure AD) domain join in OOBE to a standard account (versus an administrator account by default).| +| How can I test the Windows Autopilot CSV file in the Partner Center? | Only CSP Partners have access to the Partner Center portal. If you are a CSP, you can create a Sales agent user account that has access to devices for testing the file. This can be done today in the Partner Center.

                                  For more information, see [Create user accounts and set permissions](https://msdn.microsoft.com/partner-center/create-user-accounts-and-set-permissions). | +| Must I become a CSP to participate in Windows Autopilot? | Top volume OEMs do not, as they can use the OEM Direct API. All others who choose to use MPC to register devices must become CSPs in order to access MPC. | +| Do the different CSP levels have all the same capabilities when it comes to Windows Autopilot? | For purposes of Windows Autopilot, there are three different types of CSPs, each with different levels of authority and access:

                                  1. Direct CSP: Gets direct authorization from the customer to register devices.

                                  2. Indirect CSP Provider: Gets implicit permission to register devices through the relationship their CSP Reseller partner has with the customer. Indirect CSP Providers register devices through Microsoft Partner Center.

                                  3. Indirect CSP Reseller: Gets direct authorization from the customer to register devices. At the same time, their indirect CSP Provider partner also gets authorization, which means that either the Indirect Provider or the Indirect Reseller can register devices for the customer. However, the Indirect CSP Reseller must register devices through the MPC UI (manually uploading CSV file), whereas the Indirect CSP Provider has the option to register devices using the MPC APIs. | + + +## Manufacturing + +| Question | Answer | +| --- | --- | +| What changes need to be made in the factory OS image for customer configuration settings? |No changes are required on the factory floor to enable Windows Autopilot deployment. | +| What version of the OA3 tool meets Windows Autopilot deployment requirements? | Windows Autopilot can work with any version of the OA3 tool. We recommend using a supported version of Windows 10 semi-annual channel to generate the 4K hardware hash. | +| At the time of placing an order, do customers need to be state whether they want it with or without Windows Autopilot options? | Yes, if they want Windows Autopilot, they will want a supported version of Windows 10 semi-annual channel. Also, they will want to receive the CSV file or have the file upload (that is, registration) completed on their behalf. | +| Does the OEM need to manage or collect any custom imaging files from customers and perform any image uploads to Microsoft? | No change, OEMs just send the CBRs as usual to Microsoft. No images are sent to Microsoft to enable Windows Autopilot. Windows Autopilot only customizes OOBE and allows policy configurations (disables admin account, for example). | +| Are there any customer impacts to upgrading from Windows 8 to Windows 10? | The devices must be running a supported version of Windows 10 semi-annual channel to enroll in Windows Autopilot deployment. Otherwise, there are no impacts. | +| Will there be any change to the existing CBR with 4K hardware hash? | No. | +| What new information needs to be sent from the OEM to Microsoft? | Nothing, unless the OEM opts to register the device on the customer’s behalf, in which case they would upload the device ID using a CSV file into Microsoft Partner Center, or use the OEM Direct API. | +| Is there a contract or amendment for an OEM to participate in Windows Autopilot Deployment? | No. | + +## CSV schema + +| Question | Answer | +| --- | --- | +| Can a comma be used in the CSV file? | No. | +| What error messages can a user expect to see in the Partner Center or MSfB when uploading a file? | See the In Microsoft Store for Business section of this guide. | +| Is there a limit to the number of devices that can be listed in the CSV file? | Yes, the CSV file can only contain 1,000 devices to apply to a single profile. If more than 1,000 devices need to be applied to a profile, the devices need to be uploaded through multiple CSV files. | +| Does Microsoft have any recommendations on how an OEM should provide the CSV file to their customers? | We recommend encrypting the CSV file when sending to the business customer to self-register their Windows Autopilot devices (either through MPC, MSfB, or Intune). | + + +## Hardware hash + +| Question | Answer | +| --- | --- | +| Must every hardware hash submitted by the OEM contain the SMBIOS UUID (universally unique identifier), MAC (media access control) address, and unique disk serial number (if using Windows 10 OEM Activation 3.0 tool)? | Yes. Since Windows Autopilot is based on the ability to uniquely identify devices applying for cloud configuration, it is critical to submit hardware hashes that meet the outlined requirement. | +| What is the reason for needing the SMBIOS UUID, MAC Address, and Disk Serial Number in the hardware hash details? | For creating the hardware hash, these are the fields that are needed to identify a device, as parts of the device are added or removed. Since we don’t have a unique identifier for Windows devices, this is the best logic to identify a device. | +| What is difference between OA3 hardware hash, 4K hardware hash, and Windows Autopilot hardware hash? | None. They’re different names for the same thing. The OA3 tool output is called the OA3 Hash, which is 4K in size, which is usable for the Windows Autopilot deployment scenario. Note: When using an older, unsupported Windows version OA3Tool, you get a different sized Hash, which may not be used for Windows Autopilot deployment. | +| What is the thought around parts replacement and repair for the NIC (network interface controller) and Disk? Will the hardware hash become invalid? | Yes. If you replace parts, you need to gather the new hardware hash, though it depends on what is replaced, and the characteristics of the parts. For example, if you replace the TPM or motherboard, it’s a new device and you must have new hardware hash. If you replace one network card, it’s probably not a new device, and the device will function with the old hardware hash. However, as a best practice, you should assume the old hardware hash is invalid and get a new hardware hash after any hardware changes. This is recommended anytime you replace parts. | + +## Motherboard replacement + +| Question | Answer | +| --- | --- | +| How does Autopilot handle motherboard replacement scenarios? | Motherboard replacement is out for scope for Autopilot. Any device that is repaired or serviced in a way that alters the ability to identify the device for Windows Autopilot must go through the normal OOBE process, and manually select the right settings or apply a custom image, as is the case today.

                                  To reuse the same device for Windows Autopilot after a motherboard replacement, the device would need to be de-registered from Autopilot, the motherboard replaced, a new 4K HH harvested, and then re-registered using the new 4K hardware hash (or device ID).

                                  **Note**: An OEM will not be able to use the OEM Direct API to re-register the device, since the OEM Direct API only accepts a tuple or PKID. In this case, the OEM would either have to send the new 4K hardware hash information using a CSV file to customer, and let customer reregister the device using MSfB or Intune.| + +## SMBIOS + +| Question | Answer | +| --- | --- | +| Any specific requirement to SMBIOS UUID? | It must be unique as specified in the Windows 10 hardware requirements. | +| What is the requirement on the SMBIOS table to meet the Windows Autopilot hardware hash need? | It must meet all the Windows 10 hardware requirements. Additional details may be found [here](https://msdn.microsoft.com/library/jj128256(v=vs.85).aspx). | +| If the SMBIOS supports UUID and Serial Number, is it enough for the OA3 tool to generate the hardware hash? | No. At a minimum, the following SMBIOS fields need to be populated with unique values: ProductKeyID SmbiosSystemManufacturer SmbiosSystemProductName SmbiosSystemSerialNumber SmbiosSkuNumber SmbiosSystemFamily MacAddress SmbiosUuid DiskSerialNumber TPM EkPub | + +## Technical interface + +| Question | Answer | +| --- | --- | +| What is the interface to get the MAC Address and Disk Serial Number? How does the OA tool get MAC and Disk Serial #? | Disk serial number is found from IOCTL_STORAGE_QUERY_PROPERTY with StorageDeviceProperty/PropertyStandardQuery. Network MAC address is IOCTL_NDIS_QUERY_GLOBAL_STATS from OID_802_3_PERMANENT_ADDRESS. However the method for performing this operation varies depending on the scenario. | +| Follow up clarification: If we have 2-3 MACs on the system, how does OA Tool choose which MAC Address and Disk Serial Number are on the system since there are multiple instances of each? If a platform has LAN And WLAN, which MAC is chosen? | In short, all available values are used. In detail, there may be specific usage rules. The system disk serial number is more important than the other disks available. Network interfaces that are removable should not be used if detected as they are removable. LAN vs WLAN should not matter, as both will be used. | + +## The end-user experience + +|Question|Answer| +|----|-----| +|How do I know that I received Autopilot?|You can tell that you received Windows Autopilot (as in the device received a configuration but has not yet applied it) when you skip the selection page (as seen below), and are immediately taken to a generic or customized sign-in page.| +|Windows Autopilot didn’t work, what do I do now?| Questions and actions to assist in troubleshooting: Did a screen not get skipped? Did a user end up as an admin when configured not to? Remember that Azure AD Admins will be local admins regardless of whether Windows Autopilot is configured to disable local admin Collection information: run licensingdiag.exe and send the .cab (Cabinet) file that is generated to AutopilotHelp@microsoft.com. If possible, collect an ETL from Windows Performance Recorder (WPR). Often in these cases, users are not signing into the right Azure AD tenant, or are creating local user accounts. For a complete list of support options, refer to [Windows Autopilot support](autopilot-support.md). | +| If an Administrator makes changes to an existing profile, will the changes take effect on devices that have that profile assigned to them that have already been deployed? |No. Windows Autopilot profiles are not resident on the device. They are downloaded during OOBE, the settings defined at the time are applied. Then, the profile is discarded on the device. If the device is reimaged or reset, the new profile settings will take effect the next time the device goes through OOBE.| +|What is the experience if a device isn’t registered or if an IT Admin doesn’t configure Windows Autopilot prior to an end user attempting to self-deploy? |If the device isn’t registered, it will not receive the Windows Autopilot experience and the end user will go through normal OOBE. The Windows Autopilot configurations will not be applied until the user runs through OOBE again, after registration. If a device is started before an MDM profile is created, the device will go through standard OOBE experience. The IT Admin would then have to manually enroll that device into the MDM, after which the next time that device is reset, it will go through the Windows Autopilot OOBE experience.| +|Why didn't I receive a customized sign-in screen during Autopilot? |Tenant branding must be configured in portal.azure.com to receive a customized sign-in experience.| +|What happens if a device is registered with Azure AD but does not have a Windows Autopilot profile assigned? |The regular Azure AD OOBE will occur since no Windows Autopilot profile was assigned to the device.| +|How can I collect logs on Autopilot?|The best way to collect logs on Windows Autopilot performance is to collect a WPR trace during OOBE. The XML file (WPRP extension) for this trace may be provided upon request.| + +## MDM + +| Question | Answer | +| --- | --- | +| Must we use Intune for our MDM? | No, any MDM will work with Autopilot, but others probably won’t have the same full suite of Windows Autopilot features as Intune. You’ll get the best experience from Intune. | +| Can Intune support Win32 app preinstalls? | Yes. Starting with the Windows 10 October Update (version 1809), Intune supports Win32 apps using .msi (and .msix) wrappers. | +| What is co-management? | Co-management is when you use a combination of a cloud MDM tool (Intune) and an on-premises configuration tool like Microsoft Endpoint Configuration Manager. You only need to use the Configuration Manager if Intune can’t support what you want to do with your profile. If you choose to co-manage using Intune + Configuration Manager, you do it by including a Configuration Manager agent in your Intune profile. When that profile is pushed to the device, the device will see the Configuration Manager agent and go out to the Configuration Manager to pull down any additional profile settings. | +| Must we use Microsoft Endpoint Configuration Manager for Windows Autopilot | No. Co-management (described above) is optional. | + + +## Features + +| Question | Answer | +| --- | --- | +| Self-deploying mode | A new version of Windows Autopilot where the user only turns on the device, and nothing else. It’s useful for scenarios where a standard user account isn’t needed (for example, shared devices, or KIOSK devices). | +| Hybrid Azure Active Directory join | Allows Windows Autopilot devices to connect to an on-premises Active Directory domain controller (in addition to being Azure AD joined). | +| Windows Autopilot reset | Removes user apps and settings from a device, but maintains Azure AD domain join and MDM enrollment. Useful for when transferring a device from one user to another. | +| Personalization | Adds the following to the OOBE experience: A personalized welcome message can be created. A username hint can be added Sign-in page text can be personalized. The company’s logo can be included | +| [Autopilot for existing devices](existing-devices.md) | Offers an upgrade path to Windows Autopilot for all existing Windows 7- and Windows 8-based devices. | + + + +## General + +|Question|Answer +|------------------|-----------------| +|If I wipe the machine and restart, will I still receive Windows Autopilot?|Yes, if the device is still registered for Windows Autopilot and is running a supported version of Windows 10 semi-annual channel, it will receive the Windows Autopilot experience.| +|Can I harvest the device fingerprint on existing machines?|Yes, if the device is running a supported version of Windows 10 semi-annual channel, you can harvest device fingerprints for registration. There are no plans to backport the functionality to legacy releases and no way to harvest them on devices running unsupported versions of Windows.| +|Is Windows Autopilot supported on other SKUs, for example, Surface Hub, HoloLens, Windows Mobile.|No, Windows Autopilot isn’t supported on other SKUs.| +|Does Windows Autopilot work after MBR or image reinstallation?|Yes.| +| Can machines that have reimaged a few times go through Autopilot? What does the error message "This user is not authorized to enroll" mean? Error code 801c0003. |There are limits to the number of devices a particular Azure AD user can enroll in Azure AD, as well as the number of devices that are supported per user in Intune. (These are configurable but not infinite.) You’ll run into this frequently if you reuse the devices, or even if you roll back to previous virtual machine snapshots.| +|What happens if a device is registered to a malicious agent? |By design, Windows Autopilot does not apply a profile until the user signs in with the matching tenant for the configured profile using the Azure AD sign-in process. What occurs is illustrated below. If badguys.com registers a device owned by contoso.com, at worst, the user would be directed to sign into badguys.com. When the user enters their email/password, the sign-in information is redirected through Azure AD to the proper Azure AD authentication and the user is prompted to then sign into contoso.com. Since contoso.com does not match badguys.com as the tenant, the Windows Autopilot profile will not be applied and the regular Azure AD OOBE will occur.| +|Where is the Windows Autopilot data stored? |Windows Autopilot data is stored in the United States (US), not in a sovereign cloud, even when the Azure AD tenant is registered in a sovereign cloud. This is applicable to all Windows Autopilot data, regardless of the portal leveraged to deploy Autopilot.| +|Why is Windows Autopilot data stored in the US and not in a sovereign cloud?|It is not customer data that we store, but business data that enables Microsoft to provide a service, therefore it is okay for the data to reside in the US. Customers can stop subscribing to the service at any time, and, in that event, the business data is removed by Microsoft.| +|How many ways are there to register a device for Windows Autopilot|There are six ways to register a device, depending on who is doing the registering:

                                  1. OEM Direct API (only available to TVOs)
                                  2. MPC using the MPC API (must be a CSP)
                                  3. MPC using manual upload of CSV file in the UI (must be a CSP)
                                  4. MSfB using CSV file upload
                                  5. Intune using CSV file upload
                                  6. Microsoft 365 Business portal using CSV file upload| +|How many ways are there to create a Windows Autopilot profile?|There are four ways to create and assign a Windows Autopilot profile:

                                  1. Through MPC (must be a CSP)
                                  2. Through MSfB
                                  3. Through Intune (or another MDM)
                                  4. Microsoft 365 Business portal

                                  Microsoft recommends creation and assignment of profiles through Intune. | +| What are some common causes of registration failures? |1. Bad or missing hardware hash entries can lead to faulty registration attempts
                                  2. Hidden special characters in CSV files.

                                  To avoid this issue, after creating your CSV file, open it in Notepad to look for hidden characters or trailing spaces or other corruptions.| +| Is Autopilot supported on IoT devices? | Autopilot is not supported on IoT Core devices, and there are currently no plans to add this support. Autopilot is supported on Windows 10 IoT Enterprise SAC devices. Autopilot is supported on Windows 10 Enterprise LTSC 2019 and above; it is not supported on earlier versions of LTSC.| +| Is Autopilot supported in all regions/countries? | Autopilot only supports customers using global Azure. Global Azure does not include the three entities listed below:
                                  - Azure Germany
                                  - Azure China 21Vianet
                                  - Azure Government
                                  So, if a customer is set up in global Azure, there are no region restrictions. For example, if Contoso uses global Azure but has employees working in China, the Contoso employees working in China would be able to use Autopilot to deploy devices. If Contoso uses Azure China 21Vianet, the Contoso employees would not be able to use Autopilot.| + +## Glossary + +| Term | Meaning | +| --- | --- | +| CSV | Comma Separated Values (File type similar to Excel spreadsheet) | +| MPC | Microsoft Partner Center | +| MDM | Mobile Device Management | +| OEM | Original Equipment Manufacturer | +| CSP | Cloud Solution Provider | +| MSfB | Microsoft Store for Business | +| Azure AD | Azure Active Directory | +| 4K HH | 4K hardware hash | +| CBR | Computer Build Report | +| EC | Enterprise Commerce | +| DDS | Device Directory Service | +| OOBE | Out of the Box Experience | +| UUID | Universally Unique Identifier | diff --git a/windows/deployment/windows-autopilot/autopilot-mbr.md b/windows/deployment/windows-autopilot/autopilot-mbr.md new file mode 100644 index 0000000000..f103766d0d --- /dev/null +++ b/windows/deployment/windows-autopilot/autopilot-mbr.md @@ -0,0 +1,420 @@ +--- +title: Windows Autopilot motherboard replacement +ms.reviewer: +manager: laurawi +description: Windows Autopilot deployment MBR scenarios +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: deploy +audience: itpro author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot motherboard replacement scenario guidance + +**Applies to** + +- Windows 10 + +This document offers guidance for Windows Autopilot device repair scenarios that Microsoft partners can use in Motherboard Replacement (MBR) situations, and other servicing scenarios. + +Repairing Autopilot enrolled devices is complex, as it tries to balance OEM requirements with Windows Autopilot requirements. Specifically, OEM’s require strict uniqueness across motherboards, MAC addresses, etc., while Windows Autopilot requires strict uniqueness at the Hardware ID level for each device to enable successful registration. The Hardware ID does not always accommodate all the OEM hardware component requirements, thus these requirements are sometimes at odds, causing issues with some repair scenarios. + +**Motherboard Replacement (MBR)** + +If a motherboard replacement is needed on a Windows Autopilot device, the following process is recommended: + +1. [Deregister the device](#deregister-the-autopilot-device-from-the-autopilot-program) from Windows Autopilot +2. [Replace the motherboard](#replace-the-motherboard) +3. [Capture a new device ID (4K HH)](#capture-a-new-autopilot-device-id-4k-hh-from-the-device) +4. [Reregister the device](#reregister-the-repaired-device-using-the-new-device-id) with Windows Autopilot +5. [Reset the device](#reset-the-device) +6. [Return the device](#return-the-repaired-device-to-the-customer) + +Each of these steps is described below. + +## Deregister the Autopilot device from the Autopilot program + +Before the device arrives at the repair facility, it must be deregistered by the entity that registered it. Only the entity that registered the device can deregister it. This might be the customer IT Admin, the OEM, or the CSP partner. If the IT Admin registered the device, they likely did so via Intune (or possibly the Microsoft Store for Business). In that case, they should deregister the device from Intune (or MSfB). This is necessary because devices registered in Intune will not show up in MPC. However, if the OEM or CSP partner registered the device, they likely did so via the Microsoft Partner Center (MPC). In that case, they should deregister the device from MPC, which will also remove it from the customer IT Admin’s Intune account. Below, we describe the steps an IT Admin would go through to deregister a device from Intune, and the steps an OEM or CSP would go through to deregister a device from MPC. + +**NOTE**: When possible, an OEM or CSP should register Autopilot devices, rather than having the customer do it. This will avoid problems where OEMs or CSPs may not be able to deregister a device if, for example, a customer leasing a device goes out of business before deregistering it themselves. + +**EXCEPTION**: If a customer grants an OEM permission to register devices on their behalf via the automated consent process, then an OEM can use the API to deregister devices they didn’t register themselves (instead, the customer registered the devices). But keep in mind that this would only remove those devices from the Autopilot program, it would not disenroll them from Intune or disjoin them from AAD. The customer must do those steps, if desired, through Intune. + +### Deregister from Intune + +To deregister an Autopilot device from Intune, an IT Admin would: + +1. Sign in to their Intune account +2. Navigate to Intune > Groups > All groups +3. Remove the desired device from its group +4. Navigate to Intune > Devices > All devices +5. Select the checkbox next to the device you want to delete, then click the Delete button on the top menu +6. Navigate to Intune > Devices > Azure AD devices +7. Select the checkbox next to the device you want to delete, then click the Delete button along the top menu +8. Navigate to Intune > Device enrollment > Windows enrollment > Devices +9. Select the checkbox next to the device you want to deregister +10. Click the extended menu icon (“…”) on the far right end of the line containing the device you want to deregister in order to expose an additional menu with the option to “unassign user” +11. Click “Unassign user” if the device was previously assigned to a user; if not, this option will be grayed-out and can be ignored +12. With the unassigned device still selected, click the Delete button along the top menu to remove this device + +**NOTE**: These steps deregister the device from Autopilot, but also unenroll the device from Intune, and disjoin the device from AAD. While it may appear that only deregistering the device from Autopilot is needed, there are certain barriers in place within Intune that necessitate all the steps above be done, which is best practice anyway in case the device gets lost or becomes unrecoverable, to eliminate the possibility of orphaned devices existing in the Autopilot database, or Intune, or AAD. If a device gets into an unrecoverable state, you can contact the appropriate [Microsoft support alias](autopilot-support.md) for assistance. + +The deregistration process will take about 15 minutes. You can accelerate the process by clicking the “Sync” button, then “Refresh” the display until the device is no longer present. + +More details on deregistering devices from Intune can be found [here](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group). + +### Deregister from MPC + +To deregister an Autopilot device from the Microsoft Partner Center (MPC), a CSP would: + +1. Log into MPC +2. Navigate to Customer > Devices +3. Select the device to be deregistered and click the “Delete device” button + +![devices](images/devices.png) + +**NOTE**: Deregistering a device from Autopilot in MPC does only that; it does not also unenroll the device from the MDM (Intune), nor does it disjoin the device from AAD. Therefore, if possible, the OEM/CSP ideally should work with the customer IT Admin to have the device fully removed per the Intune steps in the previous section. + +Alternatively, an OEM partner that has integrated the OEM Direct APIs can deregister a device by calling the AutopilotDeviceRegistration API with the TenantID and TenantDomain fields left blank in the request call. + +Because the repair facility will not have access to the user’s login credentials, the repair facility will have to reimage the device as part of the repair process. This means that the customer should do three things before sending the device off for repair: +1. Copy all important data off the device. +2. Let the repair facility know which version of Windows they should reinstall after the repair. +3. If applicable, let the repair facility know which version of Office they should reinstall after the repair. + +## Replace the motherboard + +Technicians replace the motherboard (or other hardware) on the broken device. A replacement DPK is injected. + +Repair and key replacement processes vary between facilities. Sometimes repair facilities receive motherboard spare parts from OEMs that have replacement DPKs already injected, but sometimes not. Sometimes repair facilities receive fully-functional BIOS tools from OEMs, but sometimes not. This means that the quality of the data in the BIOS after a MBR varies. To ensure the repaired device will still be Autopilot-capable following its repair, the new (post-repair) BIOS should be able to successfully gather and populate the following information at a minimum: + +- DiskSerialNumber +- SmbiosSystemSerialNumber +- SmbiosSystemManufacturer +- SmbiosSystemProductName +- SmbiosUuid +- TPM EKPub +- MacAddress +- ProductKeyID +- OSType + +**NOTE**: For simplicity, and because processes vary between repair facilities, we have excluded many of the additional steps often used in a MBR, such as: +- Verify that the device is still functional +- Disable BitLocker* +- Repair the Boot Configuration Data (BCD) +- Repair and verify the network driver operation + +*BitLocker can be suspended rather than disbled if the technician has the ability to resume it after the repair. + +## Capture a new Autopilot device ID (4K HH) from the device + +Repair technicians must sign in to the repaired device to capture the new device ID. Assuming the repair technician does NOT have access to the customer’s login credentials, they will have to reimage the device in order to gain access, per the following steps: + +1. The repair technician creates a [WinPE bootable USB drive](https://docs.microsoft.com/windows-hardware/manufacture/desktop/oem-deployment-of-windows-10-for-desktop-editions#create-a-bootable-windows-pe-winpe-partition). +2. The repair technician boots the device to WinPE. +3. The repair technician [applies a new Windows image to the device](https://docs.microsoft.com/windows-hardware/manufacture/desktop/work-with-windows-images). + + **NOTE**: Ideally, the same version of Windows should be reimaged onto the device that was originally on the device, so some coordination will be required between the repair facility and customer to capture this information at the time the device arrives for repair. This might include the customer sending the repair facility a customized image (.ppk file) via a USB stick, for example. + +4. The repair technician boots the device into the new Windows image. +5. Once on the desktop, the repair technician captures the new device ID (4K HH) off the device using either the OA3 Tool or the PowerShell script, as described below. + +Those repair facilities with access to the OA3 Tool (which is part of the ADK) can use the tool to capture the 4K Hardware Hash (4K HH). + +Alternatively, the [WindowsAutoPilotInfo Powershell script](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo) can be used to capture the 4K HH by following these steps: + +1. Install the script from the [PowerShell Gallery](https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo) or from the command line (command line installation is shown below). +2. Navigate to the script directory and run it on the device when the device is either in Full OS or Audit Mode. See the following example. + + ```powershell + md c:\HWID + Set-Location c:\HWID + Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force + Install-Script -Name Get-WindowsAutopilotInfo -Force + Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv + ``` + +>If you are prompted to install the NuGet package, choose **Yes**.
                                  +>If, after installing the script you get an error that Get-WindowsAutopilotInfo.ps1 is not found, verify that C:\Program Files\WindowsPowerShell\Scripts is present in your PATH variable.
                                  +>If the Install-Script cmdlet fails, verify that you have the default PowerShell repository registered (**Get-PSRepository**) or register the default repository with **Register-PSRepository -Default -Verbose**. + +The script creates a .csv file that contains the device information, including the complete 4K HH. Save this file so that you can access it later. The service facility will use this 4K HH to reregister device as described below. Be sure to use the -OutputFile parameter when saving the file, which ensures that file formatting is correct. Do not attempt to pipe the command output to a file manually. + +**NOTE**: If the repair facility does not have the ability to run the OA3 tool or PowerShell script to capture the new 4K HH, then the CSP (or OEM) partners must do this for them. Without some entity capturing the new 4K HH, there is no way to reregister this device as an Autopilot device. + + +## Reregister the repaired device using the new device ID + +If an OEM is not able to reregister the device, then the repair facility or CSP should reregister the device using MPC, or the customer IT Admin should be advised to reregister the device via Intune (or MSfB). Both ways of reregistering a device are shown below. + +### Reregister from Intune + +To reregister an Autopilot device from Intune, an IT Admin would: +1. Sign in to Intune. +2. Navigate to Device enrollment > Windows enrollment > Devices > Import. +3. Click the **Import** button to upload a csv file containing the device ID of the device to be reregistered (the device ID was the 4K HH captured by the PowerShell script or OA3 tool described previously in this document). + +The following video provides a good overview of how to (re)register devices via MSfB.
                                  + +> [!VIDEO https://www.youtube.com/embed/IpLIZU_j7Z0] + +### Reregister from MPC + +To reregister an Autopilot device from MPC, an OEM or CSP would: + +1. Sign in to MPC. +2. Navigate to the Customer > Devices page and click the **Add devices** button to upload the csv file. + +![device](images/device2.png)
                                  +![device](images/device3.png) + +In the case of reregistering a repaired device through MPC, the uploaded csv file must contain the 4K HH for the device, and not just the PKID or Tuple (SerialNumber + OEMName + ModelName). If only the PKID or Tuple were used, the Autopilot service would be unable to find a match in the Autopilot database, since no 4K HH info was ever previously submitted for this essentially “new” device, and the upload will fail, likely returning a ZtdDeviceNotFound error. So, again, only upload the 4K HH, not the Tuple or PKID. + +**NOTE**: When including the 4K HH in the csv file, you do NOT also need to include the PKID or Tuple. Those columns may be left blank, as shown below: + +![hash](images/hh.png) + +## Reset the device + +Since the device was required to be in Full OS or Audit Mode to capture the 4K HH, the repair facility must reset the image back to a pre-OOBE state before returning it to the customer. One way this can be accomplished is by using the built-in reset feature in Windows, as follows: + +On the device, go to Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Finally, click on Reset. + +![reset](images/reset.png) + +However, it’s likely the repair facility won’t have access to Windows because they lack the user credentials to login, in which case they need to use other means to reimage the device, such as the [Deployment Image Servicing and Management tool](https://docs.microsoft.com/windows-hardware/manufacture/desktop/oem-deployment-of-windows-10-for-desktop-editions#use-a-deployment-script-to-apply-your-image). + +## Return the repaired device to the customer + +After completing the previous steps, the repaired device can now be returned to the customer, and will be auto-enrolled into the Autopilot program on first boot-up during OOBE. + +**NOTE**: If the repair facility did NOT reimage the device, they could be sending it back in a potentially broken state (e.g., there’s no way to log into the device because it’s been dissociated from the only known user account), in which case they should tell the organization that they need to fix the registration and OS themselves. + +**IMPORTANT**: A device can be “registered” for Autopilot prior to being powered-on, but the device isn’t actually “deployed” to Autopilot (i.e., enabled as an Autopilot device) until it goes through OOBE, which is why resetting the device back to a pre-OOBE state is a required step. + +## Specific repair scenarios + +This section covers the most common repair scenarios, and their impact on Autopilot enablement. + +NOTES ON TEST RESULTS: + +- Scenarios below were tested using Intune only (no other MDMs were tested). +- In most test scenarios below, the repaired and reregistered device needed to go through OOBE again for Autopilot to be enabled. +- Motherboard replacement scenarios often result in lost data, so repair centers or customers should be reminded to backup data (if possible) prior to repair. +- In the cases where a repair facility does not have the ability to write device info into the BIOS of the repaired device, new processes need to be created to successfully enable Autopilot. +- Repaired device should have the Product Key (DPK) preinjected in the BIOS before capturing the new 4K HH (device ID) + +In the following table:
                                  +- Supported = **Yes**: the device can be reenabled for Autopilot +- Supported = **No**: the device cannot be reenabled for Autopilot + + +
                                  ScenarioSupportedMicrosoft Recommendation +
                                  Motherboard Replacement (MBR) in generalYesThe recommended course of action for MBR scenarios is: + +1. Autopilot device is deregistered from the Autopilot program +2. The motherboard is replace +3. The device is reimaged (with BIOS info and DPK reinjected)* +4. A new Autopilot device ID (4K HH) is captured off the device +5. The repaired device is reregistered for the Autopilot program using the new device ID +6. The repaired device is reset to boot to OOBE +7. The repaired device is shipped back to the customer + +*It’s not necessary to reimage the device if the repair technician has access to the customer’s login credentials. It’s technically possible to do a successful MBR and Autopilot re-enablement without keys or certain BIOS info (e.g., serial #, model name, etc.), but doing so is only recommended for testing/educational purposes. + +
                                  MBR when motherboard has a TPM chip (enabled) and only one onboard network card (that also gets replaced)Yes + +1. Deregister damaged device +2. Replace motherboard +3. Reimage device (to gain access), unless have access to customers’ login credentials +4. Write device info into BIOS +5. Capture new 4K HH +6. Reregister repaired device +7. Reset device back to OOBE +8. Go through Autopilot OOBE (customer) +9. Autopilot successfully enabled + +
                                  MBR when motherboard has a TPM chip (enabled) and a second network card (or network interface) that is not replaced along with the motherboardNoThis scenario is not recommended, as it breaks the Autopilot experience, because the resulting Device ID will not be stable until after TPM attestation has completed, and even then registration may give incorrect results because of ambiguity with MAC Address resolution. +
                                  MBR where the NIC card, HDD, and WLAN all remain the same after the repairYes + +1. Deregister damaged device +2. Replace motherboard (with new RDPK preinjected in BIOS) +3. Reimage device (to gain access), unless have access to customers’ login credentials +4. Write old device info into BIOS (same s/n, model, etc.)* +5. Capture new 4K HH +6. Reregister repaired device +7. Reset device back to OOBE +8. Go through Autopilot OOBE (customer) +9. Autopilot successfully enabled + +*Note that for this and subsequent scenarios, rewriting old device info would not include the TPM 2.0 endorsement key, as the associated private key is locked to the TPM device + +
                                  MBR where the NIC card remains the same, but the HDD and WLAN are replacedYes + +1. Deregister damaged device +2. Replace motherboard (with new RDPK preinjected in BIOS) +3. Insert new HDD and WLAN +4. Write old device info into BIOS (same s/n, model, etc.) +5. Capture new 4K HH +6. Reregister repaired device +7. Reset device back to OOBE +8. Go through Autopilot OOBE (customer) +9. Autopilot successfully enabled + +
                                  MBR where the NIC card and WLAN remains the same, but the HDD is replacedYes + +1. Deregister damaged device +2. Replace motherboard (with new RDPK preinjected in BIOS) +3. Insert new HDD +4. Write old device info into BIOS (same s/n, model, etc.) +5. Capture new 4K HH +6. Reregister repaired device +7. Reset device back to OOBE +8. Go through Autopilot OOBE (customer) +9. Autopilot successfully enabled + +
                                  MBR where only the MB is replaced (all other parts remain same) but new MB was taken from a previously used device that had NOT been Autopilot-enabled before.Yes + +1. Deregister damaged device +2. Replace motherboard (with new RDPK preinjected in BIOS) +3. Reimage device (to gain access), unless have access to customers’ login credentials +4. Write old device info into BIOS (same s/n, model, etc.) +5. Capture new 4K HH +6. Reregister repaired device +7. Reset device back to OOBE +8. Go through Autopilot OOBE (customer) +9. Autopilot successfully enabled + +
                                  MBR where only the MB is replaced (all other parts remain same) but new MB was taken from a previously used device that HAD been Autopilot-enabled before.Yes + +1. Deregister old device from which MB will be taken +2. Deregister damaged device (that you want to repair) +3. Replace motherboard in repair device with MB from other Autopilot device (with new RDPK preinjected in BIOS) +4. Reimage device (to gain access), unless have access to customers’ login credentials +5. Write old device info into BIOS (same s/n, model, etc.) +6. Capture new 4K HH +7. Reregister repaired device +8. Reset device back to OOBE +9. Go through Autopilot OOBE (customer) +10. Autopilot successfully enabled + +NOTE: The repaired device can also be used successfully as a normal, non-Autopilot device. + +
                                  BIOS info excluded from MBR deviceNoRepair facility does not have BIOS tool to write device info into BIOS after MBR. + +1. Deregister damaged device +2. Replace motherboard (BIOS does NOT contain device info) +3. Reimage and write DPK into image +4. Capture new 4K HH +5. Reregister repaired device +6. Create Autopilot profile for device +7. Go through Autopilot OOBE (customer) +8. Autopilot FAILS to recognize repaired device + +
                                  MBR when there is no TPM chipYesThough we do not recommend enabling an Autopilot devices without a TPM chip (which is recommended for BitLocker encryption), it is possible to enable an Autopilot devices in “standard user” mode (but NOT Self-deploying mode) that does not have a TPM chip. In this case, you would: + +1. Deregister damaged device +2. Replace motherboard +3. Reimage device (to gain access), unless have access to customers’ login credentials +4. Write old device info into BIOS (same s/n, model, etc.) +5. Capture new 4K HH +6. Reregister repaired device +7. Reset device back to OOBE +8. Go through Autopilot OOBE (customer) +9. Autopilot successfully enabled + +
                                  New DPK written into image on repaired Autopilot device with a new MBYesRepair facility replaces normal MB on damaged device. MB does not contain any DPK in the BIOS. Repair facility writes DPK into image after MBR. + +1. Deregister damaged device +2. Replace motherboard – BIOS does NOT contain DPK info +3. Reimage device (to gain access), unless have access to customers’ login credentials +4. Write device info into BIOS (same s/n, model, etc.) +5. Capture new 4K HH +6. Reset or reimage device to pre-OOBE and write DPK into image +7. Reregister repaired device +8. Go through Autopilot OOBE +9. Autopilot successfully enabled + +
                                  New Repair Product Key (RDPK)YesUsing a MB with a new RDPK preinjected results in a successful Autopilot refurbishment scenario. + +1. Deregister damaged device +2. Replace motherboard (with new RDPK preinjected in BIOS) +3. Reimage or rest image to pre-OOBE +4. Write device info into BIOS +5. Capture new 4K HH +6. Reregister repaired device +7. Reimage or reset image to pre-OOBE +8. Go through Autopilot OOBE +9. Autopilot successfully enabled + +
                                  No Repair Product Key (RDPK) injectedNoThis scenario violates Microsoft policy and breaks the Windows Autopilot experience. +
                                  Reimage damaged Autopilot device that was not deregistered prior to repairYes, but the device will still be associated with previous tenant ID, so should only be returned to same customer + +1. Reimage damaged device +2. Write DPK into image +3. Go through Autopilot OOBE +4. Autopilot successfully enabled (to previous tenant ID) + +
                                  Disk replacement from a non-Autopilot device to an Autopilot deviceYes + +1. Do not deregister damaged device prior to repair +2. Replace HDD on damaged device +3. Reimage or reset image back to OOBE +4. Go through Autopilot OOBE (customer) +5. Autopilot successfully enabled (repaired device recognized as its previous self) + +
                                  Disk replacement from one Autopilot device to another Autopilot deviceMaybeIf the device from which the HDD is taken was itself previously deregistered from Autopilot, then that HDD can be used in a repair device. But if the HDD was never previously deregistered from Autopilot before being used in a repaired device, the newly repaired device will not have the proper Autopilot experience. + +Assuming the used HDD was previously deregistered (before being used in this repair): + +1. Deregister damaged device +2. Replace HDD on damaged device using a HDD from another deregistered Autopilot device +3. Reimage or rest the repaired device back to a pre-OOBE state +4. Go through Autopilot OOBE (customer) +5. Autopilot successfully enabled + +
                                  Third party network card replacement NoWhether from a non-Autopilot device to an Autopilot device, from one Autopilot device to another Autopilot device, or from an Autopilot device to a non-Autopilot device, any scenario where a 3rd party (not onboard) Network card is replaced will break the Autopilot experience, and is not recommended. +
                                  A device repaired more than 3 timesNoAutopilot is not supported when a device is repeatedly repaired, so that whatever parts NOT replaced become associated with too many parts that have been replaced, which would make it difficult to uniquely identify that device in the future. +
                                  Memory replacementYesReplacing the memory on a damaged device does not negatively affect the Autopilot experience on that device. No de/reregistration is needed. The repair technician simply needs to replace the memory. +
                                  GPU replacementYesReplacing the GPU(s) on a damaged device does not negatively affect the Autopilot experience on that device. No de/reregistration is needed. The repair technician simply needs to replace the GPU. +
                                  + +>When scavenging parts from another Autopilot device, we recommend unregistering the scavenged device from Autopilot, scavenging it, and then NEVER REGISTERING THE SCAVENGED DEVICE (AGAIN) FOR AUTOPILOT, because reusing parts this way may cause two active devices to end up with the same ID, with no possibility of distinguishing between the two. + +**NOTE**: The following parts may be replaced without compromising Autopilot enablement or requiring special additional repair steps: +- Memory (RAM or ROM) +- Power Supply +- Video Card +- Card Reader +- Sound card +- Expansion card +- Microphone +- Webcam +- Fan +- Heat sink +- CMOS battery + +Other repair scenarios not yet tested and verified include: +- Daughterboard replacement +- CPU replacement +- Wifi replacement +- Ethernet replacement + +## FAQ + +| Question | Answer | +| --- | --- | +| If we have a tool that programs product information into the BIOS after the MBR, do we still need to submit a CBR report for the device to be Autopilot-capable? | No. Not if the in-house tool writes the minimum necessary information into the BIOS that the Autopilot program looks for to identify the device, as described earlier in this document. | +| What if only some components are replaced rather than the full motherboard? | While it’s true that some limited repairs do not prevent the Autopilot algorithm from successfully matching the post-repair device with the pre-repair device, it is best to ensure 100% success by going through the MBR steps above even for devices that only needed limited repairs. | +| How does a repair technician gain access to a broken device if they don’t have the customer’s login credentials? | The technician will have to reimage the device and use their own credentials during the repair process. | + +## Related topics + +[Device guidelines](autopilot-device-guidelines.md)
                                  diff --git a/windows/deployment/windows-autopilot/autopilot-support.md b/windows/deployment/windows-autopilot/autopilot-support.md index 370197bca0..7fd687321a 100644 --- a/windows/deployment/windows-autopilot/autopilot-support.md +++ b/windows/deployment/windows-autopilot/autopilot-support.md @@ -1,45 +1,43 @@ --- title: Windows Autopilot support -description: Support information for Windows Autopilot +description: Find out who to contact for help with your Windows Autopilot installation. keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: low ms.sitesec: library ms.pagetype: deploy +audience: itpro author: greg-lindsay -ms.author: greg-lindsay +ms.author: greglin ms.date: 10/31/2018 +ms.reviewer: +manager: laurawi ms.collection: M365-modern-desktop ms.topic: article --- # Windows Autopilot support information -**Applies to: Windows 10** +**Applies to: Windows 10** The following table displays support information for the Windows Autopilot program. Before contacting the resources listed below for Windows Autopilot-related issues, check the [Windows Autopilot FAQ](autopilot-faq.md). -| Audience | Support contact | -| --- | --- | -OEM or Channel Partner registering devices as a CSP (via MPC) | Use the help resources available in MPC. Whether you are a named partner or a channel partner (distributor, reseller, SI, etc.), if you’re a CSP registering Autopilot devices through MPC (either manually or through the MPC API), your first-line of support should be the help resources within MPC. | -| OEM registering devices using OEM Direct API | Contact MSOEMOPS@microsoft.com. Response time depends on priority:
                                  Low – 120 hours
                                  Normal – 72 hours
                                  High – 24 hours
                                  Immediate – 4 hours | -| OEM with a PFE | Reach out to your PFE for support. | -| Partners with a Partner Technology Strategist (PTS) | If you have a PTS (whether you’re a CSP or not), you may first try working through your account’s specific Partner Technology Strategist (PTS). | -| Partners with an Ecosystem PM | If you have an Ecosystem PM (whether you’re a CSP or not), you may first try working through your account’s specific Ecosystem PM, especially for technical issues. | -| Enterprise customers | Contact your Technical Account Manager (TAM), or Account Technology Strategist (ATS), or Customer Service Support (CSS) representative. | -| End-user | Contact your IT administrator. | -| Microsoft Partner Center (MPC) users | Use the [help resources](https://partner.microsoft.com/support) available in MPC. | -| Microsoft Store for Business (MSfB) users | Use the help resources available in MSfB. | -| Intune users | From the Microsoft Azure portal, click [Help + support](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/overview). | -| Microsoft 365 Business | Support is accessible directly through the Microsoft 365 Business portal when logged in: https://support.microsoft.com/en-us. | -| Queries relating to MDA testing | Contact MDAHelp@microsoft.com. | -| All other queries, or when unsure who to contact | Contact msoemops@microsoft.com. | - - - - +| Audience | Support contact | +|---------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| OEM or Channel Partner registering devices as a CSP (via MPC) | Use the help resources available in MPC. Whether you are a named partner or a channel partner (distributor, reseller, SI, etc.), if you’re a CSP registering Autopilot devices through MPC (either manually or through the MPC API), your first-line of support should be the help resources within MPC. | +| OEM registering devices using OEM Direct API | Contact MSOEMOPS@microsoft.com. Response time depends on priority:
                                  Low – 120 hours
                                  Normal – 72 hours
                                  High – 24 hours
                                  Immediate – 4 hours | +| Partners with a Partner Technology Strategist (PTS) | If you have a PTS (whether you’re a CSP or not), you may first try working through your account’s specific Partner Technology Strategist (PTS). | +| Partners with an Ecosystem PM | If you have an Ecosystem PM (whether you’re a CSP or not), you may first try working through your account’s specific Ecosystem PM, especially for technical issues. To learn more about Ecosystem PMs and the services they offer, contact epsoinfo@microsoft.com. | +| Enterprise customers | Contact your Technical Account Manager (TAM), or Account Technology Strategist (ATS), or Customer Service Support (CSS) representative. | +| End-user | Contact your IT administrator. | +| Microsoft Partner Center (MPC) users | Use the [help resources](https://partner.microsoft.com/support) available in MPC. | +| Microsoft Store for Business (MSfB) users | Use the help resources available in MSfB. | +| Intune users | From the Microsoft Azure portal, click [Help + support](https://portal.azure.com/#blade/Microsoft_Azure_Support/HelpAndSupportBlade/overview). | +| Microsoft 365 Business | Support is accessible directly through the Microsoft 365 Business portal when logged in: https://support.microsoft.com/en-us. | +| Queries relating to MDA testing | Contact MDAHelp@microsoft.com. | +| All other queries, or when unsure who to contact | Contact msoemops@microsoft.com. | diff --git a/windows/deployment/windows-autopilot/autopilot-update.md b/windows/deployment/windows-autopilot/autopilot-update.md new file mode 100644 index 0000000000..db4094b8a8 --- /dev/null +++ b/windows/deployment/windows-autopilot/autopilot-update.md @@ -0,0 +1,48 @@ +--- +title: Windows Autopilot update +ms.reviewer: +manager: laurawi +description: Windows Autopilot update +keywords: Autopilot, update, Windows 10 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +ms.localizationpriority: medium +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot update + +**Applies to** + +- Windows 10, version 1903 + +Windows Autopilot update enables you to get the latest Autopilot features and critical issue fixes without the need to move to latest Windows OS version. With Autopilot update, organizations can keep their current OS version and still benefit from new Autopilot features and bug fixes. + +During the Autopilot deployment process, Windows Autopilot update has been added as a new node after the critical [Windows Zero Day Patch (ZDP) update](https://docs.microsoft.com/windows-hardware/customize/desktop/windows-updates-during-oobe) check. During the update process, Windows Autopilot devices reach out to Windows Update to check for a new Autopilot update. If there is an Autopilot update available, the device will download and install the update, then restart automatically. See the following example. + + ![Autopilot update 1](images/update1.png)
                                  + ![Autopilot update 2](images/update2.png)
                                  + ![Autopilot update 3](images/update3.png) + +The following diagram illustrates a typical Windows Autopilot deployment orchestration during the Out of Box Experience (OOBE) with the new Windows Autopilot update node. + + ![Autopilot update flow](images/update-flow.png) + +## Release cadence + +- When an Autopilot update is available, it is typically released on the 4th Tuesday of the month. The update could be released on a different week if there is an exception. +- A knowledge base (KB) article will also be published to document the changes that are included in the update. + +For a list of released updates, see [Autopilot update history](windows-autopilot-whats-new.md#windows-autopilot-update-history). + +## See also + +[Windows Update during OOBE](https://docs.microsoft.com/windows-hardware/customize/desktop/windows-updates-during-oobe)
                                  +[What's new in Windows Autopilot](windows-autopilot-whats-new.md)
                                  \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/bitlocker.md b/windows/deployment/windows-autopilot/bitlocker.md index cf06f0bc75..234ae17fcc 100644 --- a/windows/deployment/windows-autopilot/bitlocker.md +++ b/windows/deployment/windows-autopilot/bitlocker.md @@ -1,15 +1,17 @@ --- title: Setting the BitLocker encryption algorithm for Autopilot devices +ms.reviewer: +manager: laurawi description: Microsoft Intune provides a comprehensive set of configuration options to manage BitLocker on Windows 10 devices. keywords: Autopilot, BitLocker, encryption, 256-bit, Windows 10 ms.prod: w10 -ms.technology: Windows ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy ms.localizationpriority: medium +audience: itpro author: greg-lindsay -ms.author: greg-lindsay +ms.author: greglin ms.collection: M365-modern-desktop ms.topic: article --- @@ -17,9 +19,13 @@ ms.topic: article # Setting the BitLocker encryption algorithm for Autopilot devices +**Applies to** + +- Windows 10 + With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. This ensures that the default encrytion algorithm is not applied automatically when this is not the desired setting. Other BitLocker policies that must be applied prior to encryption can also be delivered before automatic BitLocker encryption begins. -The BitLocker encryption algorithm is used when BitLocker is first enabled, and sets the strength to which full volume encryption should occur. Available encryption algorithms are: AES-CBC 128-bit, AES-CBC 256-bit, XTS-AES 128-bit or XTS-AES 256-bit encryption. The default value is XTS-AES 128-bit encryption. See [BitLocker CSP](https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp) for information about the recommended encryption algorithms to use. +The BitLocker encryption algorithm is used when BitLocker is first enabled, and sets the strength to which full volume encryption should occur. Available encryption algorithms are: AES-CBC 128-bit, AES-CBC 256-bit, XTS-AES 128-bit or XTS-AES 256-bit encryption. The default value is XTS-AES 128-bit encryption. See [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) for information about the recommended encryption algorithms to use. To ensure the desired BitLocker encryption algorithm is set before automatic encryption occurs for Autopilot devices: @@ -45,4 +51,4 @@ Windows 10, version 1809 or later. ## See also -[Bitlocker overview](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-overview) \ No newline at end of file +[Bitlocker overview](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview) diff --git a/windows/deployment/windows-autopilot/configure-autopilot.md b/windows/deployment/windows-autopilot/configure-autopilot.md deleted file mode 100644 index 988b5d91f2..0000000000 --- a/windows/deployment/windows-autopilot/configure-autopilot.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: Configure Autopilot deployment -description: How to configure Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: deploy -author: greg-lindsay -ms.author: greg-lindsay -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Configure Autopilot deployment - -**Applies to** - -- Windows 10 - -## Deploying new devices - -When deploying new devices using Windows Autopilot, a common set of steps are required: - -1. [Register devices with the Windows Autopilot deployment service](add-devices.md). Ideally, this step would be performed by the OEM, reseller, or distributor from which the devices were purchased, but this can also be done by the organization by collecting the hardware identity and uploading it manually. - -2. [Assign a profile of settings to each device](profiles.md), specifying how the device should be deployed and what user experience should be presented. - -3. Boot the device. When the device is connected to a network with internet access, it will contact the Windows Autopilot deployment service to see if the device is registered, and if it is, it will download profile settings such as the [Enrollment Status page](enrollment-status.md), which are used to customize the end user experience. - - - -## Related topics - -[Windows Autopilot scenarios](windows-autopilot-scenarios.md) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 59fa406a68..516142c42a 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -1,213 +1,850 @@ --- -title: Demonstrate Autopilot deployment on a VM +title: Demonstrate Autopilot deployment +ms.reviewer: +manager: laurawi description: Step-by-step instructions on how to set-up a Virtual Machine with a Windows Autopilot deployment -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, upgrade ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium ms.sitesec: library ms.pagetype: deploy author: greg-lindsay -ms.author: greg-lindsay +ms.author: greglin ms.collection: M365-modern-desktop ms.topic: article +ms.custom: autopilot --- -# Demonstrate Autopilot deployment on a VM +# Demonstrate Autopilot deployment **Applies to** - Windows 10 -In this topic you'll learn how to set-up a Windows Autopilot deployment for a Virtual Machine using Hyper-V. Watch the following video to see an overview of the process: +To get started with Windows Autopilot, you should try it out with a virtual machine (VM) or you can use a physical device that will be wiped and then have a fresh install of Windows 10. + +In this topic you'll learn how to set-up a Windows Autopilot deployment for a VM using Hyper-V. Note: Although there are [multiple platforms](administer.md) available to enable Autopilot, this lab primarily uses Intune. + +>Hyper-V and a VM are not required for this lab. You can also use a physical device. However, the instructions assume that you are using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual. + +The following video provides an overview of the process:
                                  +>For a list of terms used in this guide, see the [Glossary](#glossary) section. + ## Prerequisites -These are the thing you'll need on your device to get started: -* Installation media for the [latest version of Windows 10 Professional or Enterprise (ISO file)](https://www.microsoft.com/software-download/windows10) -* Internet access (see [Network connectivity requirements](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot#network-connectivity-requirements)) -* Hypervisor needs to be unoccupied, or used by Hyper-V, as we will be using Hyper-V to create the Virtual Machine +These are the things you'll need to complete this lab: + + + +
                                  Windows 10 installation mediaWindows 10 Professional or Enterprise (ISO file) for a supported version of Windows 10, semi-annual channel. If you do not already have an ISO to use, a link is provided to download an evaluation version of Windows 10 Enterprise.
                                  Internet accessIf you are behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.
                                  Hyper-V or a physical device running Windows 10The guide assumes that you will use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.
                                  A Premium Intune accountThis guide will describe how to obtain a free 30-day trial premium account that can be used to complete the lab.
                                  -See additional prerequisites in the [Windows Autopilot overview topic](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot#prerequisites). +## Procedures -## Create your Virtual Machine +A summary of the sections and procedures in the lab is provided below. Follow each section in the order it is presented, skipping the sections that do not apply to you. Optional procedures are provided in the appendix. -### Enable Hyper-V -The first thing to do, is to enable the Hyper-V feature on your device. ->[!IMPORTANT] ->If you already have Hyper-V enabled, skip this step. +[Verify support for Hyper-V](#verify-support-for-hyper-v) +
                                  [Enable Hyper-V](#enable-hyper-v) +
                                  [Create a demo VM](#create-a-demo-vm) +
                                      [Set ISO file location](#set-iso-file-location) +
                                      [Determine network adapter name](#determine-network-adapter-name) +
                                      [Use Windows PowerShell to create the demo VM](#use-windows-powershell-to-create-the-demo-vm) +
                                      [Install Windows 10](#install-windows-10) +
                                  [Capture the hardware ID](#capture-the-hardware-id) +
                                  [Reset the VM back to Out-Of-Box-Experience (OOBE)](#reset-the-vm-back-to-out-of-box-experience-oobe) +
                                  [Verify subscription level](#verify-subscription-level) +
                                  [Configure company branding](#configure-company-branding) +
                                  [Configure Microsoft Intune auto-enrollment](#configure-microsoft-intune-auto-enrollment) +
                                  [Register your VM](#register-your-vm) +
                                      [Autopilot registration using Intune](#autopilot-registration-using-intune) +
                                      [Autopilot registration using MSfB](#autopilot-registration-using-msfb) +
                                  [Create and assign a Windows Autopilot deployment profile](#create-and-assign-a-windows-autopilot-deployment-profile) +
                                      [Create a Windows Autopilot deployment profile using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) +
                                         [Assign the profile](#assign-the-profile) +
                                      [Create a Windows Autopilot deployment profile using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb) +
                                  [See Windows Autopilot in action](#see-windows-autopilot-in-action) +
                                  [Remove devices from Autopilot](#remove-devices-from-autopilot) +
                                      [Delete (deregister) Autopilot device](#delete-deregister-autopilot-device) +
                                  [Appendix A: Verify support for Hyper-V](#appendix-a-verify-support-for-hyper-v) +
                                  [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile) +
                                      [Add a Win32 app](#add-a-win32-app) +
                                         [Prepare the app for Intune](#prepare-the-app-for-intune) +
                                         [Create app in Intune](#create-app-in-intune) +
                                         [Assign the app to your Intune profile](#assign-the-app-to-your-intune-profile) +
                                      [Add Office 365](#add-office-365) +
                                         [Create app in Intune](#create-app-in-intune) +
                                         [Assign the app to your Intune profile](#assign-the-app-to-your-intune-profile) +
                                  [Glossary](#glossary) + +## Verify support for Hyper-V + +If you don't already have Hyper-V, we must first enable this on a computer running Windows 10 or Windows Server (2012 R2 or later). + +>If you already have Hyper-V enabled, skip to the [create a demo VM](#create-a-demo-vm) step. If you are using a physical device instead of a VM, skip to [Install Windows 10](#install-windows-10). + +If you are not sure that your device supports Hyper-V, or you have problems installing Hyper-V, see [appendix A](#appendix-a-verify-support-for-hyper-v) below for details on verifying that Hyper-V can be successfully installed. + +## Enable Hyper-V + +To enable Hyper-V, open an elevated Windows PowerShell prompt and run the following command: -Open a PowerShell prompt **as an administrator** and run the following: ```powershell Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All ``` -You will be prompted to restart your device, so save all your work and restart it before you continue. +This command works on all operating systems that support Hyper-V, but on Windows Server operating systems you must type an additional command (below) to add the Hyper-V Windows PowerShell module and the Hyper-V Manager console. The following command will also install Hyper-V if it isn't already installed, so if you're using Windows Server, you can just type the following command instead of using the Enable-WindowsOptionalFeature command: -### Create and start your demo Virtual Machine - -Now that Hyper-V is enabled, proceed to create your Virtual Machine. - -Open a PowerShell prompt **as an administrator** and run the following: ```powershell -New-VMSwitch -Name AutopilotExternal -NetAdapterName -AllowManagementOS $true +Install-WindowsFeature -Name Hyper-V -IncludeManagementTools +``` + +When you are prompted to restart the computer, choose **Yes**. The computer might restart more than once. + +>Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: + + ![hyper-v feature](../images/hyper-v-feature.png) + + ![hyper-v](../images/svr_mgr2.png) + +

                                  If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. + +After installation is complete, open Hyper-V Manager by typing **virtmgmt.msc** at an elevated command prompt, or by typing **Hyper-V** in the Start menu search box. + +To read more about Hyper-V, see [Introduction to Hyper-V on Windows 10](https://docs.microsoft.com/virtualization/hyper-v-on-windows/about/) and [Hyper-V on Windows Server](https://docs.microsoft.com/windows-server/virtualization/hyper-v/hyper-v-on-windows-server). + +## Create a demo VM + +Now that Hyper-V is enabled, we need to create a VM running Windows 10. We can [create a VM](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/create-virtual-machine) and [virtual network](https://docs.microsoft.com/virtualization/hyper-v-on-windows/quick-start/connect-to-network) using Hyper-V Manager, but it is simpler to use Windows PowerShell. + +To use Windows Powershell we just need to know two things: + +1. The location of the Windows 10 ISO file. + - In the example, we assume the location is **c:\iso\win10-eval.iso**. +2. The name of the network interface that connects to the Internet. + - In the example, we use a Windows PowerShell command to determine this automatically. + +After we have set the ISO file location and determined the name of the appropriate network interface, we can install Windows 10. + +### Set ISO file location + +You can download an ISO file for an evaluation version of the latest release of Windows 10 Enterprise [here](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise). +- When asked to select a platform, choose **64 bit**. + +After you download this file, the name will be extremely long (ex: 17763.107.101029-1455.rs5_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso). + +1. So that it is easier to type and remember, rename the file to **win10-eval.iso**. +2. Create a directory on your computer named **c:\iso** and move the **win10-eval.iso** file there, so the path to the file is **c:\iso\win10-eval.iso**. +3. If you wish to use a different name and location for the file, you must modify the Windows PowerShell commands below to use your custom name and directory. + +### Determine network adapter name + +The Get-NetAdaper cmdlet is used below to automatically find the network adapter that is most likely to be the one you use to connect to the Internet. You should test this command first by running the following at an elevated Windows PowerShell prompt: + +```powershell +(Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name +``` + +The output of this command should be the name of the network interface you use to connect to the Internet. Verify that this is the correct interface name. If it is not the correct interface name, you'll need to edit the first command below to use your network interface name. + +For example, if the command above displays Ethernet but you wish to use Ethernet2, then the first command below would be New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName **Ethernet2**. + +### Use Windows PowerShell to create the demo VM + +All VM data will be created under the current path in your PowerShell prompt. Consider navigating into a new folder before running the following commands. + +>[!IMPORTANT] +>**VM switch**: a VM switch is how Hyper-V connects VMs to a network.

                                  If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."

                                  If you have never created an external VM switch before, then just run the commands below. + +```powershell +New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name New-VM -Name WindowsAutopilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal -Add-VMDvdDrive -Path -VMName WindowsAutopilot +Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot Start-VM -VMName WindowsAutopilot ``` ->[!IMPORTANT] ->Make sure to replace <*Name of Network Adapter with internet access*> and <*Path to Windows 10 ISO*> with the appropriate values. ->Additionally, note that all Virtual Machine related data will be created under the current path in your PowerShell prompt. Consider navigating into a new folder before running the above. +After entering these commands, connect to the VM that you just created and wait for a prompt to press a key and boot from the DVD. You can connect to the VM by double-clicking it in Hyper-V Manager. + +See the sample output below. In this sample, the VM is created under the **c:\autopilot** directory and the vmconnect.exe command is used (which is only available on Windows Server). If you installed Hyper-V on Windows 10, use Hyper-V Manager to connect to your VM. + +

                                  +PS C:\autopilot> dir c:\iso
+
+
+    Directory: C:\iso
+
+
+Mode                LastWriteTime         Length Name
+----                -------------         ------ ----
+-a----        3/12/2019   2:46 PM     4627343360 win10-eval.iso
+
+PS C:\autopilot> (Get-NetAdapter |?{$.Status -eq "Up" -and !$.Virtual}).Name
+Ethernet
+PS C:\autopilot> New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$.Status -eq "Up" -and !$.Virtual}).Name
+
+Name              SwitchType NetAdapterInterfaceDescription
+----              ---------- ------------------------------
+AutopilotExternal External   Intel(R) Ethernet Connection (2) I218-LM
+
+PS C:\autopilot> New-VM -Name WindowsAutopilot -MemoryStartupBytes 2GB -BootDevice VHD -NewVHDPath .\VMs\WindowsAutopilot.vhdx -Path .\VMData -NewVHDSizeBytes 80GB -Generation 2 -Switch AutopilotExternal
+
+Name             State CPUUsage(%) MemoryAssigned(M) Uptime   Status             Version
+----             ----- ----------- ----------------- ------   ------             -------
+WindowsAutopilot Off   0           0                 00:00:00 Operating normally 8.0
+
+PS C:\autopilot> Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot
+PS C:\autopilot> Start-VM -VMName WindowsAutopilot
+PS C:\autopilot> vmconnect.exe localhost WindowsAutopilot
+PS C:\autopilot> dir
+
+    Directory: C:\autopilot
+
+Mode                LastWriteTime         Length Name
+----                -------------         ------ ----
+d-----        3/12/2019   3:15 PM                VMData
+d-----        3/12/2019   3:42 PM                VMs
+
+PS C:\autopilot>
+
                                  ### Install Windows 10 -Now that the Virtual Machine was created and started, open **Hyper-V Manager** and connect to the **WindowsAutopilot** Virtual Machine. -Make sure the Virtual Machine booted from the installation media you've provided and complete the Windows installation process. +Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples: -Once the installation is complete, create a checkpoint. You will create multiple checkpoints throughout this process, which you can later use to go through the process again. + ![Windows setup](images/winsetup1.png) + ![Windows setup](images/winsetup2.png) + ![Windows setup](images/winsetup3.png) + ![Windows setup](images/winsetup4.png) + ![Windows setup](images/winsetup5.png) + ![Windows setup](images/winsetup6.png) + +>After the VM restarts, during OOBE, it’s fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: + + ![Windows setup](images/winsetup7.png) + +Once the installation is complete, sign in and verify that you are at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. You will create multiple checkpoints throughout this lab, which can be used later to go through the process again. + + ![Windows setup](images/winsetup8.png) + +To create your first checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM) and run the following: -To create the checkpoint, open a PowerShell prompt **as an administrator** and run the following: ```powershell Checkpoint-VM -Name WindowsAutopilot -SnapshotName "Finished Windows install" ``` -## Capture your Virtual Machine's hardware ID +Click on the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see **Finished Windows Install** listed in the Checkpoints pane. -On the newly created Virtual Machine, open a PowerShell prompt **as an administrator** and run the following: -```powershell -md c:\HWID -Set-Location c:\HWID -Set-ExecutionPolicy Unrestricted -Install-Script -Name Get-WindowsAutopilotInfo -Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv -``` +## Capture the hardware ID + +>NOTE: Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you’re not going to use the OA3 Tool to capture the full 4K HH for various reasons (you’d have to install the OA3 tool, your device couldn’t have a volume license version of Windows, it’s a more complicated process than using a PS script, etc.). Instead, you’ll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool. + +Follow these steps to run the PS script: + +1. Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device: + + ```powershell + md c:\HWID + Set-Location c:\HWID + Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force + Install-Script -Name Get-WindowsAutopilotInfo -Force + $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts" + Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv + ``` + +When you are prompted to install the NuGet package, choose **Yes**. + +See the sample output below. + +
                                  +PS C:\> md c:\HWID
+
+    Directory: C:\
+
+Mode                LastWriteTime         Length Name
+----                -------------         ------ ----
+d-----        3/14/2019  11:33 AM                HWID
+
+PS C:\> Set-Location c:\HWID
+PS C:\HWID> Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted -Force
+PS C:\HWID> Install-Script -Name Get-WindowsAutopilotInfo -Force
+
+NuGet provider is required to continue
+PowerShellGet requires NuGet provider version '2.8.5.201' or newer to interact with NuGet-based repositories. The NuGet
+ provider must be available in 'C:\Program Files\PackageManagement\ProviderAssemblies' or
+'C:\Users\user1\AppData\Local\PackageManagement\ProviderAssemblies'. You can also install the NuGet provider by running
+ 'Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force'. Do you want PowerShellGet to install and
+import the NuGet provider now?
+[Y] Yes  [N] No  [S] Suspend  [?] Help (default is "Y"): Y
+PS C:\HWID> $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
+PS C:\HWID> Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv
+PS C:\HWID> dir
+
+    Directory: C:\HWID
+
+Mode                LastWriteTime         Length Name
+----                -------------         ------ ----
+-a----        3/14/2019  11:33 AM           8184 AutopilotHWID.csv
+
+PS C:\HWID>
+
                                  + +Verify that there is an **AutopilotHWID.csv** file in the **c:\HWID** directory that is about 8 KB in size. This file contains the complete 4K HH. + +**Note**: Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you are curious. The file format will be validated when it is imported into Autopilot. An example of the data in this file is shown below. + +![Serial number and hardware hash](images/hwid.png) + +You will need to upload this data into Intune to register your device for Autopilot, so it needs to be transferred to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). + +If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this. >[!NOTE] ->Accept all prompts while running the above cmdlets. +>When copying and pasting to or from VMs, avoid clicking other things with your mouse cursor between the copy and paste process as this can empty or overwrite the clipboard and require that you start over. Go directly from copy to paste. -### Mount the Virtual Hard Drive (VHD) +## Reset the VM back to Out-Of-Box-Experience (OOBE) -To gain access to the AutopilotHWID.csv that contains the hardware ID, stop the Virtual Machine to unlock the Virtual Hard Drive. - -To do that, on your device (**not** on the Virtual Machine), open a PowerShell prompt **as an administrator** and run the following: -```powershell -Stop-VM -VMName WindowsAutopilot -``` - -Once the Virtual Machine has stopped, create a checkpoint: -```powershell -Checkpoint-VM -Name WindowsAutopilot -SnapshotName "HWID captured" -``` - -With the checkpoint created, continue to mount the VHD: -```powershell -Mount-VHD -path (Get-VMHardDiskDrive -VMName WindowsAutopilot).Path -``` - -Once mounted, navigate to the new drive and copy **AutopilotHWID.csv** to a location on your device. - -Before you proceed, unmount the VHD to unlock it and start the Virtual Machine: -```powershell -Dismount-VHD -path (Get-VMHardDiskDrive -VMName WindowsAutopilot).Path -Start-VM -VMName WindowsAutopilot -``` - -## Reset Virtual Machine back to Out-Of-Box-Experience (OOBE) - -With the hardware ID captured, prepare your Virtual Machine for Windows Autopilot deployment by resetting it back to OOBE. +With the hardware ID captured in a file, prepare your Virtual Machine for Windows Autopilot deployment by resetting it back to OOBE. On the Virtual Machine, go to **Settings > Update & Security > Recovery** and click on **Get started** under **Reset this PC**. Select **Remove everything** and **Just remove my files**. Finally, click on **Reset**. ![Reset this PC final prompt](images/autopilot-reset-prompt.jpg) -Resetting your Virtual Machine can take a while. Proceed to the next steps while your Virtual Machine is resetting. +Resetting the VM or device can take a while. Proceed to the next step (verify subscription level) during the reset process. ![Reset this PC screen capture](images/autopilot-reset-progress.jpg) +## Verify subscription level + +For this lab, you need an AAD Premium subscription. You can tell if you have a Premium subscription by navigating to the [MDM enrollment configuration](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) blade. See the following example: + +**Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune** + +![MDM and Intune](images/mdm-intune2.png) + +If the configuration blade shown above does not appear, it’s likely that you don’t have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium. + +To convert your Intune trial account to a free Premium trial account, navigate to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. + +![Reset this PC final prompt](images/aad-lic1.png) + ## Configure company branding ->[!IMPORTANT] ->If you already have company branding configured in Azure Active Directory, you can skip this step. - -Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding). +If you already have company branding configured in Azure Active Directory, you can skip this step. >[!IMPORTANT] >Make sure to sign-in with a Global Administrator account. -Click on **Configure** and configure any type of company branding you'd like to see during the OOBE. +Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), click on **Configure** and configure any type of company branding you'd like to see during the OOBE. -![Configure button in Company branding](images/autopilot-aad-configure.jpg) +![Configure company branding](images/branding.png) -Once finished, click **Save**. +When you are finished, click **Save**. >[!NOTE] >Changes to company branding can take up to 30 minutes to apply. - ## Configure Microsoft Intune auto-enrollment ->[!IMPORTANT] ->If you already have MDM auto-enrollment configured in Azure Active Directory, you can skip this step. +If you already have MDM auto-enrollment configured in Azure Active Directory, you can skip this step. -Navigate to [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**. +Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**. If you do not see Microsoft Intune, click **Add application** and choose **Intune**. For the purposes of this demo, select **All** under the **MDM user scope** and click **Save**. -![MDM user scope in the Mobility blade](images/autopilot-aad-mdm.jpg) +![MDM user scope in the Mobility blade](images/autopilot-aad-mdm.png) -## Register your Virtual Machine to your organization +## Register your VM -Navigate to [Microsoft Store for Business device management](https://businessstore.microsoft.com/en-us/manage/devices). Click on **Add devices** and select the **AutopilotHWID.csv** you've saved earlier. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your Virtual Machine added. +Your VM (or device) can be registered either via Intune or Microsoft Store for Business (MSfB). Both processes are shown here, but only pick one for purposes of this lab. We highly recommend using Intune rather than MSfB. -![Add devices through Microsoft Store for Business](images/autopilot-devices-add.jpg) +### Autopilot registration using Intune + +1. In Intune in the Azure portal, choose **Device enrollment** > **Windows enrollment** > **Devices** > **Import**. + + ![Intune device import](images/device-import.png) + + >[!NOTE] + >If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared. + +2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It’s okay if other fields (Windows Product ID) are left blank. + + ![HWID CSV](images/hwid-csv.png) + + You should receive confirmation that the file is formatted correctly before uploading it, as shown above. + +3. Click **Import** and wait until the import process completes. This can take up to 15 minutes. + +4. Click **Sync** to sync the device you just registered. Wait a few moments before refreshing to verify your VM or device has been added. See the following example. + + ![Import HWID](images/import-vm.png) + +### Autopilot registration using MSfB + +>[!IMPORTANT] +>If you've already registered your VM (or device) using Intune, then skip this step. + +Optional: see the following video for an overview of the process. + +  + +> [!video https://www.youtube.com/embed/IpLIZU_j7Z0] + +First, you need a MSfB account. You can use the same one you created above for Intune, or follow [these instructions](https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview) to create a new one. + +Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) using your test account by clicking **Sign in** in the upper-right-corner of the main page. + +Select **Manage** from the top menu, then click the **Windows Autopilot Deployment Program** link under the **Devices** card. See the following example: + +![Microsoft Store for Business](images/msfb.png) + +Click the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added. + +![Devices](images/msfb-device.png) ## Create and assign a Windows Autopilot deployment profile -Navigate to [Windows enrollment in Microsoft Intune](https://portal.azure.com/#blade/Microsoft_Intune_Enrollment/OverviewBlade/windowsEnrollment). +>[!IMPORTANT] +>Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB. Both processes are shown here, but only pick one for purposes of this lab: -Make sure to sync the device you've just registered, by clicking on **Devices** under **Windows Autopilot Deployment Program (Preview)** and selecting **Sync**. Wait a few moments before refreshing to see your Virtual Machine added. +Pick one: +- [Create profiles using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) +- [Create profiles using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb) -![Microsoft Intune sync Windows devices](images/autopilot-intune-sync.jpg) +### Create a Windows Autopilot deployment profile using Intune -### Create a Windows Autopilot deployment profile +>[!NOTE] +>Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list first: -Click on **Deployment profiles** under **Windows Autopilot Deployment Program (Preview)** and select **Create profile**. +![Devices](images/intune-devices.png) -![Microsoft Intune create deployment profile](images/autopilot-intune-profile-add.jpg) +>The example above lists both a physical device and a VM. Your list should only include only one of these. -In the **Create profile** blade, set the name to **Autopilot Intune Demo**, click on **Out-of-box experience (OOBE)** and configure the following: -| Setting name | Value | +To create a Windows Autopilot profile, select **Device enrollment** > **Windows enrollment** > **Deployment profiles** + +![Deployment profiles](images/deployment-profiles.png) + +Click on **Create profile**. + +![Create deployment profile](images/create-profile.png) + +On the **Create profile** blade, use the following values: + +| Setting | Value | |---|---| -|Privacy Settings|Hide| -|End user license agreement (EULA)|Hide| -|User account type|Standard| +| Name | Autopilot Lab profile | +| Description | blank | +| Convert all targeted devices to Autopilot | No | +| Deployment mode | User-driven | +| Join to Azure AD as | Azure AD joined | -Click on **Save** and **Create**. +Click on **Out-of-box experience (OOBE)** and configure the following settings: -![Create a new deployment profile in Microsoft Intune](images/autopilot-intune-profile-configure.jpg) +| Setting | Value | +|---|---| +| EULA | Hide | +| Privacy Settings | Hide | +| Hide change account options | Hide | +| User account type | Standard | +| Apply device name template | No | -### Assign a Windows Autopilot deployment profile +See the following example: -With the deployment profile created, go back to **Devices** under **Windows Autopilot Deployment Program (Preview)** and select your Virtual Machine. Click on **Assign profile** and in the **Assign Profile** blade select **Autopilot Intune Demo** under the **Autopilot profile**. Click on **Assign**. +![Deployment profile](images/profile.png) -![Assign Autopilot Profile in Microsoft Intune](images/autopilot-intune-profile-assign.jpg) +Click on **OK** and then click on **Create**. -Wait a few minutes for all changes to apply. +>If you want to add an app to your profile via Intune, the OPTIONAL steps for doing so can be found in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile). + +#### Assign the profile + +Profiles can only be assigned to Groups, so first you must create a group that contains the devices to which the profile should be applied. This guide will provide simple instructions to assign a profile, for more detailed instructions, see [Create an Autopilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an Autopilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group), as optional reading. + +To create a Group, open the Azure Portal and select **Azure Active Directory** > **Groups** > **All groups**: + +![All groups](images/all-groups.png) + +Select New group from the Groups blade to open the new groups UI. Select the “Security” group type, name the group, and select the “Assigned” membership type: + +Before clicking **Create**, expand the **Members** panel, click your device's serial number (it will then appear under **Selected members**) and then click **Select** to add that device to this group. + +![New group](images/new-group.png) + +Now click **Create** to finish creating the new group. + +Click on **All groups** and click **Refresh** to verify that your new group has been successfully created. + +With a group created containing your device, you can now go back and assign your profile to that group. Navigate back to the Intune page in the Azure portal (one way is to type **Intune** in the top banner search bar and select **Intune** from the results). + +From Intune, select **Device enrollment** > **Windows enrollment** > **Deployment Profiles** to open the profile blade. Click on the name of the profile you previously created (Autopilot Lab profile) to open the details blade for that profile: + +![Lab profile](images/deployment-profiles2.png) + +Under **Manage**, click **Assignments**, and then with the **Include** tab highlighted, expand the **Select groups** blade and click **AP Lab Group 1** (the group will appear under **Selected members**). + +![Include group](images/include-group.png) + +Click **Select** and then click **Save**. + +![Include group](images/include-group2.png) + +It’s also possible to assign specific users to a profile, but we will not cover this scenario in the lab. For more detailed information, see [Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot). + +### Create a Windows Autopilot deployment profile using MSfB + +If you have already created and assigned a profile via Intune by using the steps immediately above, then skip this section. + +A [video](https://www.youtube.com/watch?v=IpLIZU_j7Z0) is available that covers the steps required to create and assign profiles in MSfB. These steps are also summarized below. + +First, sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/manage/dashboard) using the Intune account you initially created for this lab. + +Click **Manage** from the top menu, then click **Devices** from the left navigation tree. + +![MSfB manage](images/msfb-manage.png) + +Click the **Windows Autopilot Deployment Program** link in the **Devices** tile. + +To CREATE the profile: + +Select your device from the **Devices** list: + +![MSfB create](images/msfb-create1.png) + +On the Autopilot deployment dropdown menu, select **Create new profile**: + +![MSfB create](images/msfb-create2.png) + +Name the profile, choose your desired settings, and then click **Create**: + +![MSfB create](images/msfb-create3.png) + +The new profile is added to the Autopilot deployment list. + +To ASSIGN the profile: + +To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab, then select the profile you want to assign from the **Autopilot deployment** dropdown menu as shown: + +![MSfB assign](images/msfb-assign1.png) + +Confirm the profile was successfully assigned to the intended device by checking the contents of the **Profile** column: + +![MSfB assign](images/msfb-assign2.png) + +>[!IMPORTANT] +>The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. ## See Windows Autopilot in action -By now, your Virtual Machine should be back to OOBE. Make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding) -, otherwise those changes might not show up. +If you shut down your VM after the last reset, it’s time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**: + +![Device status](images/device-status.png) + +Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up. + +>[!TIP] +>If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you’re expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset). + +- Ensure your device has an internet connection. +- Turn on the device +- Verify that the appropriate OOBE screens (with appropriate Company Branding) appear. You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen (which you can skip). + +![OOBE sign-in page](images/autopilot-oobe.jpg) + +Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go into the Intune Azure portal, and select **Devices > All devices**, then **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated. + +![Device enabled](images/enabled-device.png) Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure Active Directory credentials and you're all done. -![OOBE sign-in page](images/autopilot-oobe.jpg) +Windows Autopilot will now take over to automatically join your device into Azure Active Directory and enroll it to Microsoft Intune. Use the checkpoints you've created to go through this process again with different settings. -Windows Autopilot will now take over to automatically join your Virtual Machine into Azure Active Directory and enroll it to Microsoft Intune. Use the checkpoints you've created to go through this process again with different settings. +## Remove devices from Autopilot +To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found [here](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [here](https://docs.microsoft.com/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below. + +### Delete (deregister) Autopilot device + +You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into your Intune Azure portal, then navigate to **Intune > Devices > All Devices**. Select the checkbox next to the device you want to delete, then click the Delete button along the top menu. + +![Delete device](images/delete-device1.png) + +Click **X** when challenged to complete the operation: + +![Delete device](images/delete-device2.png) + +This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**. + +![Delete device](images/delete-device3.png) + +The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune. Note: A device will only appear in the All devices list once it has booted. The latter (Windows Autopilot Deployment Program > Devices) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune. + +To remove the device from the Autopilot program, select the device and click Delete. + +![Delete device](images/delete-device4.png) + +A warning message appears reminding you to first remove the device from Intune, which we previously did. + +![Delete device](images/delete-device5.png) + +At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program: + +![Delete device](images/delete-device6.png) + +Once the device no longer appears, you are free to reuse it for other purposes. + +If you also (optionally) want to remove your device from AAD, navigate to **Azure Active Directory > Devices > All Devices**, select your device, and click the delete button: + +![Delete device](images/delete-device7.png) + +## Appendix A: Verify support for Hyper-V + +Starting with Windows 8, the host computer’s microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information. + +To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, scroll down, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example: + +
                                  +C:>systeminfo
+
+...
+Hyper-V Requirements:      VM Monitor Mode Extensions: Yes
+                           Virtualization Enabled In Firmware: Yes
+                           Second Level Address Translation: Yes
+                           Data Execution Prevention Available: Yes
+
                                  + +In this example, the computer supports SLAT and Hyper-V. + +>If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting will depend on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings. + +You can also identify Hyper-V support using [tools](https://blogs.msdn.microsoft.com/taylorb/2008/06/19/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v/) provided by the processor manufacturer, the [msinfo32](https://technet.microsoft.com/library/cc731397.aspx) tool, or you can download the [coreinfo](https://technet.microsoft.com/sysinternals/cc835722) utility and run it, as shown in the following example: + +
                                  +C:>coreinfo -v
+
+Coreinfo v3.31 - Dump information on system CPU and memory topology
+Copyright (C) 2008-2014 Mark Russinovich
+Sysinternals - www.sysinternals.com
+
+Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz
+Intel64 Family 6 Model 42 Stepping 7, GenuineIntel
+Microcode signature: 0000001B
+HYPERVISOR      -       Hypervisor is present
+VMX             *       Supports Intel hardware-assisted virtualization
+EPT             *       Supports Intel extended page tables (SLAT)
+
                                  + +Note: A 64-bit operating system is required to run Hyper-V. + +## Appendix B: Adding apps to your profile + +### Add a Win32 app + +#### Prepare the app for Intune + +Before we can pull an application into Intune to make it part of our AP profile, we need to “package” the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool). After downloading the tool, gather the following three bits of information to use the tool: + +1. The source folder for your application +2. The name of the setup executable file +3. The output folder for the new file + +For the purposes of this lab, we’ll use the Notepad++ tool as our Win32 app. + +Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available) and then copy the file to a known location, such as C:\Notepad++msi. + +Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example: + +![Add app](images/app01.png) + +After the tool finishes running, you should have an .intunewin file in the Output folder, which you can now upload into Intune using the following steps. + +#### Create app in Intune + +Log into the Azure portal and select **Intune**. + +Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. + +![Add app](images/app02.png) + +Under **App Type**, select **Windows app (Win32)**: + +![Add app](images/app03.png) + +On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then click **OK**: + +![Add app](images/app04.png) + +On the **App Information Configure** blade, provide a friendly name, description, and publisher, such as: + +![Add app](images/app05.png) + +On the **Program Configuration** blade, supply the install and uninstall commands: + +Install: msiexec /i "npp.7.6.3.installer.x64.msi" /q +Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q + +NOTE: Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Intune-Win32-App-Packaging-Tool) automatically generated them when it converted the .msi file into a .intunewin file. + +![Add app](images/app06.png) + +Simply using an install command like “notepad++.exe /S” will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn’t actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). + +Click **OK** to save your input and activate the **Requirements** blade. + +On the **Requirements Configuration** blade, specify the **OS architecture** and the **Minimum OS version**: + +![Add app](images/app07.png) + +Next, configure the **Detection rules**. For our purposes, we will select manual format: + +![Add app](images/app08.png) + +Click **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule: + +![Add app](images/app09.png) + +Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. + +**Return codes**: For our purposes, leave the return codes at their default values: + +![Add app](images/app10.png) + +Click **OK** to exit. + +You may skip configuring the final **Scope (Tags)** blade. + +Click the **Add** button to finalize and save your app package. + +Once the indicator message says the addition has completed. + +![Add app](images/app11.png) + +You will be able to find your app in your app list: + +![Add app](images/app12.png) + +#### Assign the app to your Intune profile + +**NOTE**: The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here. + +In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu: + +![Add app](images/app13.png) + +Select **Add Group** to open the **Add group** pane that is related to the app. + +For our purposes, select **Required** from the **Assignment type** dropdown menu: + +>**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. + +Select **Included Groups** and assign the groups you previously created that will use this app: + +![Add app](images/app14.png) + +![Add app](images/app15.png) + +In the **Select groups** pane, click the **Select** button. + +In the **Assign group** pane, select **OK**. + +In the **Add group** pane, select **OK**. + +In the app **Assignments** pane, select **Save**. + +![Add app](images/app16.png) + +At this point, you have completed steps to add a Win32 app to Intune. + +For more information on adding apps to Intune, see [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps-win32-app-management). + +### Add Office 365 + +#### Create app in Intune + +Log into the Azure portal and select **Intune**. + +Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. + +![Add app](images/app17.png) + +Under **App Type**, select **Office 365 Suite > Windows 10**: + +![Add app](images/app18.png) + +Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this labe we have only selected Excel: + +![Add app](images/app19.png) + +Click **OK**. + +In the **App Suite Information** pane, enter a unique suite name, and a suitable description. + +>Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. + +![Add app](images/app20.png) + +Click **OK**. + +In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**: + +![Add app](images/app21.png) + +Click **OK** and then click **Add**. + +#### Assign the app to your Intune profile + +**NOTE**: The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#assign-the-profile). If you have not done that, please return to the main part of the lab and complete those steps before returning here. + +In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu: + +![Add app](images/app22.png) + +Select **Add Group** to open the **Add group** pane that is related to the app. + +For our purposes, select **Required** from the **Assignment type** dropdown menu: + +>**Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. + +Select **Included Groups** and assign the groups you previously created that will use this app: + +![Add app](images/app23.png) + +![Add app](images/app24.png) + +In the **Select groups** pane, click the **Select** button. + +In the **Assign group** pane, select **OK**. + +In the **Add group** pane, select **OK**. + +In the app **Assignments** pane, select **Save**. + +![Add app](images/app25.png) + +At this point, you have completed steps to add Office to Intune. + +For more information on adding Office apps to Intune, see [Assign Office 365 apps to Windows 10 devices with Microsoft Intune](https://docs.microsoft.com/intune/apps-add-office365). + +If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate: + +![Add app](images/app26.png) + +## Glossary + + + + + + + + + + + + + + +
                                  OEMOriginal Equipment Manufacturer
                                  CSVComma Separated Values
                                  MPCMicrosoft Partner Center
                                  CSPCloud Solution Provider
                                  MSfBMicrosoft Store for Business
                                  AADAzure Active Directory
                                  4K HH4K Hardware Hash
                                  CBRComputer Build Report
                                  ECEnterprise Commerce (server)
                                  DDSDevice Directory Service
                                  OOBEOut of the Box Experience
                                  VMVirtual Machine
                                  diff --git a/windows/deployment/windows-autopilot/deployment-process.md b/windows/deployment/windows-autopilot/deployment-process.md new file mode 100644 index 0000000000..6723d50e35 --- /dev/null +++ b/windows/deployment/windows-autopilot/deployment-process.md @@ -0,0 +1,27 @@ +--- +title: Windows 10 deployment process posters +description: View and download Windows 10 deployment process flows for Microsoft Endpoint Configuration Manager and Windows Autopilot. +ms.reviewer: +manager: laurawi +ms.audience: itpro +author: greg-lindsay +keywords: upgrade, in-place, configuration, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Windows Autopilot deployment process + +**Applies to** +- Windows 10 + +Windows Autopilot deployment processes are summarized in the poster below. The poster is two pages in portrait mode (11x17). Click the image below to view a PDF in your browser. + +[![Deploy Windows 10 with Autopilot](../media/windows10-autopilot-flowchart.png)](../media/Windows10AutopilotFlowchart.pdf) + +**Note**: The Windows Autopilot for existing devices process is included in the [Microsoft Endpoint Configuration Manager deployment poster](../windows-10-deployment-posters.md#deploy-windows-10-with-microsoft-endpoint-configuration-manager). \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/dfci-management.md b/windows/deployment/windows-autopilot/dfci-management.md new file mode 100644 index 0000000000..550420a264 --- /dev/null +++ b/windows/deployment/windows-autopilot/dfci-management.md @@ -0,0 +1,70 @@ +--- +title: DFCI Management +ms.reviewer: +manager: laurawi +description: With Windows Autopilot Deployment and Intune, you can manage UEFI (BIOS) settings after they're enrolled by using the Device Firmware Configuration Interface (DFCI) +keywords: Autopilot, DFCI, UEFI, Windows 10 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +ms.localizationpriority: medium +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# DFCI Management + +**Applies to** + +- Windows 10 + +With Windows Autopilot Deployment and Intune, you can manage Unified Extensible Firmware Interface (UEFI) settings after they're enrolled by using the Device Firmware Configuration Interface (DFCI). DFCI [enables Windows to pass management commands](https://docs.microsoft.com/windows/client-management/mdm/uefi-csp) from Intune to UEFI to Autopilot deployed devices. This allows you to limit end user's control over BIOS settings. For example, you can lock down the boot options to prevent users from booting up another OS, such as one that doesn't have the same security features. + +If a user reinstalls a previous Windows version, install a separate OS, or format the hard drive, they can't override DFCI management. This feature can also prevent malware from communicating with OS processes, including elevated OS processes. DFCI’s trust chain uses public key cryptography, and doesn't depend on local UEFI password security. This layer of security blocks local users from accessing managed settings from the device’s UEFI menus. + +For an overview of DFCI benefits, scenarios, and prerequisites, see [Device Firmware Configuration Interface (DFCI) Introduction](https://microsoft.github.io/mu/dyn/mu_plus/DfciPkg/Docs/Dfci_Feature/). + +## DFCI management lifecycle + +The DFCI management lifecycle can be viewed as UEFI integration, device registration, profile creation, enrollment, management, retirement, and recovery. See the following figure. + + ![Lifecycle](images/dfci.png) + +## Requirements + +- Windows 10, version 1809 or later and a supported UEFI is required. +- The device manufacturer must have DFCI added to their UEFI firmware in the manufacturing process, or as a firmware update that you install. Work with your device vendors to determine the [manufacturers that support DFCI](#oems-that-support-dfci), or the firmware version needed to use DFCI. +- The device must be managed with Microsoft Intune. For more information, see [Enroll Windows devices in Intune using Windows Autopilot](https://docs.microsoft.com/intune/enrollment/enrollment-autopilot). +- The device must be registered for Windows Autopilot by a [Microsoft Cloud Solution Provider (CSP) partner](https://partner.microsoft.com/membership/cloud-solution-provider), or registered directly by the OEM. + +>[!IMPORTANT] +>Devices manually registered for Autopilot (such as by [importing from a csv file](https://docs.microsoft.com/intune/enrollment/enrollment-autopilot#add-devices)) are not allowed to use DFCI. By design, DFCI management requires external attestation of the device’s commercial acquisition through an OEM or a Microsoft CSP partner registration to Windows Autopilot. When your device is registered, its serial number is displayed in the list of Windows Autopilot devices. + +## Managing DFCI profile with Windows Autopilot + +There are four basic steps in managing DFCI profile with Windows Autopilot: + +1. Create an Autopilot Profile +2. Create an Enrollment status page profile +3. Create a DFCI profile +4. Assign the profiles + +See [Create the profiles](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows#create-the-profiles) and [Assign the profiles, and reboot](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows#assign-the-profiles-and-reboot) for details. + +You can also [change existing DFCI settings](https://docs.microsoft.com/intune/configuration/device-firmware-configuration-interface-windows#update-existing-dfci-settings) on devices that are in use. In your existing DFCI profile, change the settings and save your changes. Since the profile is already assigned, the new DFCI settings take effect when next time the device syncs or the device reboots. + +## OEMs that support DFCI + +- [Microsoft Surface](https://docs.microsoft.com/surface/surface-manage-dfci-guide) + +Additional OEMs are pending. + +## See also + +[Microsoft DFCI Scenarios](https://microsoft.github.io/mu/dyn/mu_plus/DfciPkg/Docs/Scenarios/DfciScenarios/)
                                  +[Windows Autopilot and Surface devices](https://docs.microsoft.com/surface/windows-autopilot-and-surface-devices)
                                  \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/enrollment-status.md b/windows/deployment/windows-autopilot/enrollment-status.md index d2e6471454..11a393eada 100644 --- a/windows/deployment/windows-autopilot/enrollment-status.md +++ b/windows/deployment/windows-autopilot/enrollment-status.md @@ -1,68 +1,39 @@ ---- -title: Windows Autopilot Enrollment Status page -description: Gives an overview of the enrollment status page capabilities, configuration -keywords: Autopilot Plug and Forget, Windows 10 -ms.prod: w10 -ms.technology: Windows -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: deploy -ms.localizationpriority: medium -author: greg-lindsay -ms.author: greg-lindsay -ms.collection: M365-modern-desktop -ms.topic: article ---- - - -# Windows Autopilot Enrollment Status page - -The Windows Autopilot Enrollment Status page displaying the status of the complete device configuration process. Incorporating feedback from customers, this provides information to the user to show that the device is being set up and can be configured to prevent access to the desktop until the configuration is complete. - - ![Enrollment status page](images/enrollment-status-page.png) - -## Available settings - - The following settings can be configured to customize behavior of the enrollment status page: - - -
                                  SettingYesNo -
                                  Show app and profile installation progressThe enrollment status page is displayed.The enrollment status page is not displayed. -
                                  Block device use until all apps and profiles are installedThe settings in this table are made available to customize behavior of the enrollment status page, so that the user can address potential installation issues. -The enrollment status page is displayed with no additional options to address installation failures. -
                                  Allow users to reset device if installation error occursA Reset device button is displayed if there is an installation failure.The Reset device button is not displayed if there is an installation failure. -
                                  Allow users to use device if installation error occursA Continue anyway button is displayed if there is an installation failure.The Continue anyway button is not displayed if there is an installation failure. -
                                  Show error when installation takes longer than specified number of minutesSpecify the number of minutes to wait for installation to complete. A default value of 60 minutes is entered. -
                                  Show custom message when an error occursA text box is provided where you can specify a custom message to display in case of an installation error.The default message is displayed:
                                  Oh no! Something didn't do what it was supposed to. Please contact your IT department. -
                                  Allow users to collect logs about installation errorsIf there is an installation error, a Collect logs button is displayed.
                                  If the user clicks this button they are asked to choose a location to save the log file MDMDiagReport.cab                                  		The Collect logs button is not displayed if there is an installation error. -
                                  Block device use until these required apps are installed if they are assigned to the user/deviceChoose All or Selected.

                                  If Selected is chosen, a Select apps button is displayed that enables you to choose which apps must be installed prior to enabling device use. -
                                  - -See the following example: - - ![Enrollment status page settings](images/esp-settings.png) - -## Installation progress tracking - -The Enrollment Status page tracks a subset of the available MDM CSP policies that are delivered to the device as part of the complete device configuration process. The specific types of policies that are tracked include: - -- Certain types of app installations. - - Enterprise modern apps (Appx/MSIX) installed by the [Enterprise Modern App Managment CSP](https://docs.microsoft.com/windows/client-management/mdm/enterprisemodernappmanagement-csp). - - Enterprise desktop apps (single-file MSIs) installed by the [Enterprise Desktop App Management CSP](https://docs.microsoft.com/windows/client-management/mdm/enterprisedesktopappmanagement-csp). -- Certain device configuration policies. - -The following types of policies and installations are not tracked: - -- Intune Management Extensions PowerShell scripts -- Office 365 ProPlus installations** -- System Center Configuration Manager apps, packages, and task sequences - -**The ability to track Office 365 ProPlus installations was added with Windows 10, version 1809.
                                  - -## More information - -For more information on configuring the Enrollment Status page, see the [Microsoft Intune documentation](https://docs.microsoft.com/intune/windows-enrollment-status).
                                  -For details about the underlying implementation, see the [FirstSyncStatus details in the DMClient CSP documentation](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp).
                                  -For more information about blocking for app installation: -- [Blocking for app installation using Enrollment Status Page](https://blogs.technet.microsoft.com/mniehaus/2018/12/06/blocking-for-app-installation-using-enrollment-status-page/). -- [Support Tip: Office C2R installation is now tracked during ESP](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Office-C2R-installation-is-now-tracked-during-ESP/ba-p/295514). +--- +title: Windows Autopilot Enrollment Status Page +ms.reviewer: +manager: laurawi +description: Gives an overview of the Enrollment Status Page capabilities, configuration +keywords: Autopilot Plug and Forget, Windows 10 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: deploy +ms.localizationpriority: medium +audience: itpro +author: greg-lindsay +ms.author: greglin +ms.collection: M365-modern-desktop +ms.topic: article +--- + + +# Windows Autopilot Enrollment Status Page + +**Applies to** + +- Windows 10, version 1803 and later + +The Enrollment Status Page (ESP) displays the status of the complete device configuration process when an MDM managed user signs into a device for the very first time. The ESP will help users understand the progress of device provisioning and ensures the device has met the organizations desired state before the user can access the desktop for the first time. + +The ESP will track the installation of applications, security policies, certificates and network connections. Within Intune, an administrator can deploy ESP profiles to a licensed Intune user and configure specific settings within the ESP profile; a few of these settings are: force the installation of specified applications, allow users to collect troubleshooting logs, specify what a user can do if device setup fails. For more information, see how to set up the [Enrollment Status Page in Intune](https://docs.microsoft.com/intune/windows-enrollment-status). + + ![Enrollment Status Page](images/enrollment-status-page.png) + + +## More information + +For more information on configuring the Enrollment Status Page, see the [Microsoft Intune documentation](https://docs.microsoft.com/intune/windows-enrollment-status).
                                  +For details about the underlying implementation, see the [FirstSyncStatus details in the DMClient CSP documentation](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp).
                                  +For more information about blocking for app installation: +- [Blocking for app installation using Enrollment Status Page](https://blogs.technet.microsoft.com/mniehaus/2018/12/06/blocking-for-app-installation-using-enrollment-status-page/). +- [Support Tip: Office C2R installation is now tracked during ESP](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Office-C2R-installation-is-now-tracked-during-ESP/ba-p/295514). diff --git a/windows/deployment/windows-autopilot/existing-devices.md b/windows/deployment/windows-autopilot/existing-devices.md index 643cfeb6bd..81cc5bf9a7 100644 --- a/windows/deployment/windows-autopilot/existing-devices.md +++ b/windows/deployment/windows-autopilot/existing-devices.md @@ -1,35 +1,41 @@ --- title: Windows Autopilot for existing devices -description: Listing of Autopilot scenarios +description: Modern desktop deployment with Windows Autopilot enables you to easily deploy the latest version of Windows 10 to your existing devices. keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.reviewer: mniehaus +manager: laurawi ms.prod: w10 ms.mktglfcycl: deploy -ms.localizationpriority: low +ms.localizationpriority: medium ms.sitesec: library ms.pagetype: deploy +audience: itpro author: greg-lindsay -ms.author: greg-lindsay -ms.date: 11/05/2018 +ms.author: greglin ms.collection: M365-modern-desktop ms.topic: article --- # Windows Autopilot for existing devices -**Applies to: Windows 10** +**Applies to: Windows 10** -Modern desktop management with Windows Autopilot enables you to easily deploy the latest version of Windows 10 to your existing devices. The apps you need for work can be automatically installed. Your work profile is synchronized, so you can resume working right away. +Modern desktop deployment with Windows Autopilot enables you to easily deploy the latest version of Windows 10 to your existing devices. The apps you need for work can be automatically installed. Your work profile is synchronized, so you can resume working right away. -This topic describes how to convert Windows 7 domain-joined computers to Azure Active Directory-joined computers running Windows 10 by using Windows Autopilot. +This topic describes how to convert Windows 7 or Windows 8.1 domain-joined computers to Windows 10 devices joined to either Azure Active Directory or Active Directory (Hybrid Azure AD Join) by using Windows Autopilot. + +>[!NOTE] +>Windows Autopilot for existing devices only supports user-driven Azure Active Directory and Hybrid Azure AD profiles. Self-deploying profiles are not supported. ## Prerequisites -- System Center Configuration Manager Current Branch (1806) OR System Center Configuration Manager Technical Preview (1808) +- A currently supported version of Microsoft Endpoint Configuration Manager current branch or technical preview branch. - The [Windows ADK](https://developer.microsoft.com/en-us/windows/hardware/windows-assessment-deployment-kit) 1803 or later - - Note: Config Mgr 1806 or later is required to [support](https://docs.microsoft.com/sccm/core/plan-design/configs/support-for-windows-10#windows-10-adk) the Windows ADK 1809. + - For more information on Configuration Manager support, see [Support for Windows 10 ADK](https://docs.microsoft.com/configmgr/core/plan-design/configs/support-for-windows-10#windows-10-adk). - Assigned Microsoft Intune Licenses - Azure Active Directory Premium -- Windows 10 version 1809 or later imported into Config Mgr as an Operating System Image +- Windows 10 version 1809 or later imported into Configuration Manager as an Operating System Image + - **Important**: See [Known issues](known-issues.md) if you are using Windows 10 1903 with Configuration Manager’s built-in **Windows Autopilot existing device** task sequence template. Currently, one of the steps in this task sequence must be edited to work properly with Windows 10, version 1903. ## Procedures @@ -41,7 +47,7 @@ To enable and configure the enrollment and status page: 1. Open [Intune in the Azure portal](https://aka.ms/intuneportal). 2. Access **Intune > Device enrollment > Windows enrollment** and [Set up an enrollment status page](https://docs.microsoft.com/intune/windows-enrollment-status). -3. Access **Azure Active Directory > Mobility (MDM and MAM) > Microsoft Intune** and [Configure automatic MDM enrollment](https://docs.microsoft.com/sccm/mdm/deploy-use/enroll-hybrid-windows#enable-windows-10-automatic-enrollment) and configure the MDM user scope for some or all users. +3. Access **Azure Active Directory > Mobility (MDM and MAM) > Microsoft Intune** and [Configure automatic MDM enrollment](https://docs.microsoft.com/configmgr/mdm/deploy-use/enroll-hybrid-windows#enable-windows-10-automatic-enrollment) and configure the MDM user scope for some or all users. See the following examples. @@ -51,43 +57,44 @@ See the following examples. ### Create the JSON file >[!TIP] ->To run the following commands on a computer running Windows Server 2012/2012 R2 or Windows 7/8.1, you must first download and install the [Windows Management Framework](https://www.microsoft.com/en-us/download/details.aspx?id=54616). +>To run the following commands on a computer running Windows Server 2012/2012 R2 or Windows 7/8.1, you must first download and install the [Windows Management Framework](https://www.microsoft.com/download/details.aspx?id=54616). 1. On an Internet connected Windows PC or Server open an elevated Windows PowerShell command window 2. Enter the following lines to install the necessary modules #### Install required modules - ``` + ```powershell Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force Install-Module AzureAD -Force Install-Module WindowsAutopilotIntune -Force + Install-Module Microsoft.Graph.Intune -Force ``` - + 3. Enter the following lines and provide Intune administrative credentials - - In the following command, replace the example user principal name for Azure authentication (admin@M365x373186.onmicrosoft.com) with your user account. Be sure that the user account you specify has sufficient administrative rights. + - Be sure that the user account you specify has sufficient administrative rights. - ``` - Connect-AutopilotIntune -user admin@M365x373186.onmicrosoft.com - ``` - The password for your account will be requested using a standard Azure AD form. Type your password and then click **Sign in**. -
                                  See the following example: + ```powershell + Connect-MSGraph + ``` + The user and password for your account will be requested using a standard Azure AD form. Type your username and password and then click **Sign in**. +
                                  See the following example: - ![Azure AD authentication](images/pwd.png) + ![Azure AD authentication](images/pwd.png) - If this is the first time you’ve used the Intune Graph APIs, you’ll also be prompted to enable read and write permissions for Microsoft Intune PowerShell. To enable these permissions: - - Select **Consent on behalf or your organization** - - Click **Accept** + If this is the first time you’ve used the Intune Graph APIs, you’ll also be prompted to enable read and write permissions for Microsoft Intune PowerShell. To enable these permissions: + - Select **Consent on behalf or your organization** + - Click **Accept** 4. Next, retrieve and display all the Autopilot profiles available in the specified Intune tenant in JSON format: #### Retrieve profiles in Autopilot for existing devices JSON format - ``` + ```powershell Get-AutopilotProfile | ConvertTo-AutopilotConfigurationJSON ``` - See the following sample output: + See the following sample output: (use the horizontal scroll bar at the bottom to view long lines) 
                                       PS C:\> Get-AutopilotProfile | ConvertTo-AutopilotConfigurationJSON
     {
@@ -106,21 +113,23 @@ See the following examples.
 
     See the following table for a description of properties used in the JSON file.
 
-    | Property | Description |
-    | --- | --- |
-    | Version (number, optional) | The version number that identifies the format of the JSON file.  For Windows 10 1809, the version specified must be 2049. |
-    | CloudAssignedTenantId (guid, required) | The Azure Active Directory tenant ID that should be used.  This is the GUID for the tenant, and can be found in properties of the tenant.  The value should not include braces. |
-    | CloudAssignedTenantDomain (string, required) | The Azure Active Directory tenant name that should be used, e.g. tenant.onmicrosoft.com. |
-    | CloudAssignedOobeConfig (number, required) | This is a bitmap that shows which Autopilot settings were configured. Values include: SkipCortanaOptIn = 1, OobeUserNotLocalAdmin = 2, SkipExpressSettings = 4, SkipOemRegistration = 8, SkipEula = 16 |
-    | CloudAssignedDomainJoinMethod (number, required) | This property should be set to 0 and specifies that the device should join Azure AD. |
-    | CloudAssignedForcedEnrollment (number, required) | Specifies that the device should require AAD Join and MDM enrollment.  
                                  0 = not required, 1 = required.   |
-    | ZtdCorrelationId (guid, required) | A unique GUID (without braces) that will be provided to Intune as part of the registration process. ZtdCorrelationId will be included in enrollment message as “OfflineAutoPilotEnrollmentCorrelator”. This attribute will be present only if the enrollment is taking place on a device registered with Zero Touch Provisioning via offline registration.|
-    | CloudAssignedAadServerData (encoded JSON string, required) | An embedded JSON string used for branding. It requires AAD corp branding enabled. 
                                   Example value: "CloudAssignedAadServerData":  "{\"ZeroTouchConfig\":{\"CloudAssignedTenantUpn\":\"\",\"CloudAssignedTenantDomain\":\"tenant.onmicrosoft.com\"}}"|
-    | CloudAssignedDeviceName (string, optional) | The name automatically assigned to the computer.  This follows the naming pattern convention that can be configured in Intune as part of the Autopilot profile, or can specify an explicit name to use. |
 
-5. The Autopilot profile must be saved as a JSON file in ASCII or ANSI format. Windows PowerShell defaults to Unicode format, so if you attempt to redirect output of the commands to a file, you must also specify the file format. For example, to save the file in ASCII format using Windows PowerShell, you can create a directory (ex: c:\Autopilot) and save the profile as shown below:
+   |                          Property                          |                                                                                                                                                                        Description                                                                                                                                                                         |
+   |------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+   |                 Version (number, optional)                 |                                                                                                                 The version number that identifies the format of the JSON file.  For Windows 10 1809, the version specified must be 2049.                                                                                                                  |
+   |           CloudAssignedTenantId (guid, required)           |                                                                                      The Azure Active Directory tenant ID that should be used.  This is the GUID for the tenant, and can be found in properties of the tenant.  The value should not include braces.                                                                                       |
+   |        CloudAssignedTenantDomain (string, required)        |                                                                                                                                  The Azure Active Directory tenant name that should be used, e.g. tenant.onmicrosoft.com.                                                                                                                                  |
+   |         CloudAssignedOobeConfig (number, required)         |                                                                           This is a bitmap that shows which Autopilot settings were configured. Values include: SkipCortanaOptIn = 1, OobeUserNotLocalAdmin = 2, SkipExpressSettings = 4, SkipOemRegistration = 8, SkipEula = 16                                                                           |
+   |      CloudAssignedDomainJoinMethod (number, required)      |                                                                                                                                    This property specifies whether the device should join Azure Active Directory or Active Directory (Hybrid Azure AD Join).  Values include: Active AD Join = 0, Hybrid Azure AD Join = 1                                                        |
+   |      CloudAssignedForcedEnrollment (number, required)      |                                                                                                                         Specifies that the device should require AAD Join and MDM enrollment.  
                                  0 = not required, 1 = required.                                                                                                                         |
+   |             ZtdCorrelationId (guid, required)              | A unique GUID (without braces) that will be provided to Intune as part of the registration process. ZtdCorrelationId will be included in enrollment message as “OfflineAutoPilotEnrollmentCorrelator”. This attribute will be present only if the enrollment is taking place on a device registered with Zero Touch Provisioning via offline registration. |
+   | CloudAssignedAadServerData (encoded JSON string, required) |                                                  An embedded JSON string used for branding. It requires AAD corp branding enabled. 
                                   Example value: "CloudAssignedAadServerData":  "{\"ZeroTouchConfig\":{\"CloudAssignedTenantUpn\":\"\",\"CloudAssignedTenantDomain\":\"tenant.onmicrosoft.com\"}}"                                                   |
+   |         CloudAssignedDeviceName (string, optional)         |                                                                          The name automatically assigned to the computer.  This follows the naming pattern convention that can be configured in Intune as part of the Autopilot profile, or can specify an explicit name to use.                                                                           |
 
-    ```
+
+5. The Autopilot profile must be saved as a JSON file in ASCII or ANSI format. Windows PowerShell defaults to Unicode format, so if you attempt to redirect output of the commands to a file, you must also specify the file format. For example, to save the file in ASCII format using Windows PowerShell, you can create a directory (ex: c:\Autopilot) and save the profile as shown below: (use the horizontal scroll bar at the bottom if needed to view the entire command string)
+
+    ```powershell
     Get-AutopilotProfile | ConvertTo-AutopilotConfigurationJSON | Out-File c:\Autopilot\AutopilotConfigurationFile.json -Encoding ASCII
     ```
     **IMPORTANT**: The file name must be named **AutopilotConfigurationFile.json** in addition to being encoded as ASCII/ANSI. 
@@ -129,7 +138,7 @@ See the following examples.
 
     ![Notepad JSON](images/notepad.png)
 
-    After saving the file, move the file to a location suitable as an SCCM package source.
+    After saving the file, move the file to a location suitable as a Microsoft Endpoint Configuration Manager package source.
 
     >[!IMPORTANT]
     >Multiple JSON profile files can be used, but each must be named **AutopilotConfigurationFile.json** in order for OOBE to follow the Autopilot experience. The file also must be encoded as ANSI. 

                                  **Saving the file with Unicode or UTF-8 encoding or saving it with a different file name will cause Windows 10 OOBE to not follow the Autopilot experience**.
                                  
@@ -147,7 +156,7 @@ See the following examples.
     - Program Type: **Do not create a program**
 4. Click **Next** twice and then click **Close**.
 
-**NOTE**: If you change user-driven Autopilot profile settings in Intune at a later date, you must also update the JSON file and redistribute the associated Config Mgr package.
+**NOTE**: If you change user-driven Autopilot profile settings in Intune at a later date, you must also update the JSON file and redistribute the associated Configuration Manager package.
 
 ### Create a target collection
 
@@ -157,19 +166,19 @@ See the following examples.
 1. Navigate to **\Assets and Compliance\Overview\Device Collections**
 2. On the ribbon, click **Create** and then click **Create Device Collection**
 3. In the **Create Device Collection Wizard** enter the following **General** details:
-    - Name: **Autopilot for existing devices collection**
-    - Comment: (optional)
-    - Limiting collection: Click **Browse** and select **All Systems**
+   - Name: **Autopilot for existing devices collection**
+   - Comment: (optional)
+   - Limiting collection: Click **Browse** and select **All Systems**
 
-    >[!NOTE]
-    >You can optionally choose to use an alternative collection for the limiting collection. The device to be upgraded must be running the ConfigMgr agent in the collection that you select.
+     >[!NOTE]
+     >You can optionally choose to use an alternative collection for the limiting collection. The device to be upgraded must be running the ConfigMgr agent in the collection that you select.
 
 4. Click **Next**, then enter the following **Membership Rules** details:
-    - Click **Add Rule** and specify either a direct or query based collection rule to add the target test Windows 7 devices to the new collection.
-    - For example, if the hostname of the computer to be wiped and reloaded is PC-01 and you wish to use Name as the attribute, click **Add Rule > Direct Rule > (wizard opens) > Next** and then enter **PC-01** next to **Value**. Click **Next** and then choose **PC-01** under **Resources**. See the following examples.
+   - Click **Add Rule** and specify either a direct or query based collection rule to add the target test Windows 7 devices to the new collection.
+   - For example, if the hostname of the computer to be wiped and reloaded is PC-01 and you wish to use Name as the attribute, click **Add Rule > Direct Rule > (wizard opens) > Next** and then enter **PC-01** next to **Value**. Click **Next** and then choose **PC-01** under **Resources**. See the following examples.
 
-    ![Named resource1](images/pc-01a.png)
-    ![Named resource2](images/pc-01b.png)
+     ![Named resource1](images/pc-01a.png)
+     ![Named resource2](images/pc-01b.png)
 
 5. Continue creating the device collection with the default settings:
     - Use incremental updates for this collection: not selected
@@ -185,28 +194,28 @@ See the following examples.
 2. On the Home ribbon, click **Create Task Sequence**
 3. Select **Install an existing image package** and then click **Next**
 4. In the Create Task Sequence Wizard enter the following details:
-    - Task sequence name: **Autopilot for existing devices**
-    - Boot Image: Click **Browse** and select a Windows 10 boot image (1803 or later)
-    - Click **Next**, and then on the Install Windows page click **Browse** and select a Windows 10 **Image package** and **Image Index**, version 1803 or later.
-    - Select the **Partition and format the target computer before installing the operating system** checkbox.
-    - Select or clear **Configure task sequence for use with Bitlocker** checkbox. This is optional.
-    - Product Key and Server licensing mode: Optionally enter a product key and server licencing mode.
-    - Randomly generate the local administrator password and disable the account on all support platforms (recommended): Optional.
-    - Enable the account and specify the local administrator password: Optional.
-    - Click **Next**, and then on the Configure Network page choose **Join a workgroup** and specify a name (ex: workgroup) next to **Workgroup**.
+   - Task sequence name: **Autopilot for existing devices**
+   - Boot Image: Click **Browse** and select a Windows 10 boot image (1803 or later)
+   - Click **Next**, and then on the Install Windows page click **Browse** and select a Windows 10 **Image package** and **Image Index**, version 1803 or later.
+   - Select the **Partition and format the target computer before installing the operating system** checkbox.
+   - Select or clear **Configure task sequence for use with Bitlocker** checkbox. This is optional.
+   - Product Key and Server licensing mode: Optionally enter a product key and server licensing mode.
+   - Randomly generate the local administrator password and disable the account on all support platforms (recommended): Optional.
+   - Enable the account and specify the local administrator password: Optional.
+   - Click **Next**, and then on the Configure Network page choose **Join a workgroup** and specify a name (ex: workgroup) next to **Workgroup**.
 
-    >[!IMPORTANT]
-    >The Autopilot for existing devices task sequence will run the **Prepare Windows for capture** action which calls the System Preparation Tool (syeprep). This action will fail if the target machine is joined to a domain.
+     >[!IMPORTANT]
+     >The Autopilot for existing devices task sequence will run the **Prepare Windows for capture** action which calls the System Preparation Tool (syeprep). This action will fail if the target machine is joined to a domain.
 
 5. Click **Next** and then click **Next** again to accept the default settings on the Install Configuration Manager page.
 6. On the State Migration page, enter the following details:
-    - Clear the **Capture user settings and files** checkbox.
-    - Clear the **Capture network settings** checkbox.
-    - Clear the **Capture Microsoft Windows settings** checkbox.
-    - Click **Next**.
+   - Clear the **Capture user settings and files** checkbox.
+   - Clear the **Capture network settings** checkbox.
+   - Clear the **Capture Microsoft Windows settings** checkbox.
+   - Click **Next**.
 
-    >[!NOTE]
-    >The Autopilot for existing devices task sequence will result in an Azure Active Directory Domain (AAD) joined device. The User State Migration Toolkit (USMT) does not support AAD joined devices.
+     >[!NOTE]
+     >Because the Autopilot for existing devices task sequence completes while in Windows PE, User State Migration Toolkit (USMT) data migration is not supported as there is no way to restore the user state into the new OS.  Also, the User State Migration Toolkit (USMT) does not support Azure AD-joined devices.
 
 7. On the Include Updates page, choose one of the three available options. This selection is optional.
 8. On the Install applications page, add applications if desired. This is optional.
@@ -278,7 +287,7 @@ Next, ensure that all content required for the task sequence is deployed to dist
 
 ### Complete the client installation process
 
-1. Open the Software Center on the target Windows 7 client computer. You can do this by clicking Start and then typing **software** in the search box, or by typing the following at a Windows PowerShell or command prompt:
+1. Open the Software Center on the target Windows 7 or Windows 8.1 client computer. You can do this by clicking Start and then typing **software** in the search box, or by typing the following at a Windows PowerShell or command prompt:
 
     ```
     C:\Windows\CCM\SCClient.exe
@@ -295,9 +304,12 @@ The Task Sequence will download content, reboot, format the drives and install W
 ![refresh-2](images/up-2.png)
 ![refresh-3](images/up-3.png)
 
+>[!NOTE]
+>If joining devices to Active Directory (Hybrid Azure AD Join), it is necessary to create a Domain Join device configuration profile that is targeted to "All Devices" (since there is no Azure Active Directory device object for the computer to do group-based targeting).  See [User-driven mode for hybrid Azure Active Directory join](https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven#user-driven-mode-for-hybrid-azure-active-directory-join) for more information.
+
 ### Register the device for Windows Autopilot
 
-Devices provisioned through Autopilot will only receive the guided OOBE Autopilot experience on first boot. Once updated to Windows 10, the device should be registered to ensure a continued Autopilot experience in the event of PC reset. You can enable automatic registration for an assigned group using the **Convert all targeted devices to Autopilot** setting. For more information, see [Create an Autopilot deployment profile](https://docs.microsoft.com/en-us/intune/enrollment-autopilot#create-an-autopilot-deployment-profile).
+Devices provisioned through Autopilot will only receive the guided OOBE Autopilot experience on first boot. Once updated to Windows 10, the device should be registered to ensure a continued Autopilot experience in the event of PC reset. You can enable automatic registration for an assigned group using the **Convert all targeted devices to Autopilot** setting. For more information, see [Create an Autopilot deployment profile](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-deployment-profile).
 
 Also see [Adding devices to Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/add-devices).
 
diff --git a/windows/deployment/windows-autopilot/images/aad-lic1.png b/windows/deployment/windows-autopilot/images/aad-lic1.png
new file mode 100644
index 0000000000..569d601066
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/aad-lic1.png differ
diff --git a/windows/deployment/windows-autopilot/images/all-groups.png b/windows/deployment/windows-autopilot/images/all-groups.png
new file mode 100644
index 0000000000..6ae904ed62
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/all-groups.png differ
diff --git a/windows/deployment/windows-autopilot/images/allow-white-glove-oobe.png b/windows/deployment/windows-autopilot/images/allow-white-glove-oobe.png
new file mode 100644
index 0000000000..0f458e9306
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/allow-white-glove-oobe.png differ
diff --git a/windows/deployment/windows-autopilot/images/app01.png b/windows/deployment/windows-autopilot/images/app01.png
new file mode 100644
index 0000000000..f551c5ca68
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app01.png differ
diff --git a/windows/deployment/windows-autopilot/images/app02.png b/windows/deployment/windows-autopilot/images/app02.png
new file mode 100644
index 0000000000..e5036043cc
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app02.png differ
diff --git a/windows/deployment/windows-autopilot/images/app03.png b/windows/deployment/windows-autopilot/images/app03.png
new file mode 100644
index 0000000000..63ef76b3f8
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app03.png differ
diff --git a/windows/deployment/windows-autopilot/images/app04.png b/windows/deployment/windows-autopilot/images/app04.png
new file mode 100644
index 0000000000..bd307c4a46
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app04.png differ
diff --git a/windows/deployment/windows-autopilot/images/app05.png b/windows/deployment/windows-autopilot/images/app05.png
new file mode 100644
index 0000000000..83861dcd51
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app05.png differ
diff --git a/windows/deployment/windows-autopilot/images/app06.png b/windows/deployment/windows-autopilot/images/app06.png
new file mode 100644
index 0000000000..9563e0514c
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app06.png differ
diff --git a/windows/deployment/windows-autopilot/images/app07.png b/windows/deployment/windows-autopilot/images/app07.png
new file mode 100644
index 0000000000..59025e69fa
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app07.png differ
diff --git a/windows/deployment/windows-autopilot/images/app08.png b/windows/deployment/windows-autopilot/images/app08.png
new file mode 100644
index 0000000000..cea5edfc57
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app08.png differ
diff --git a/windows/deployment/windows-autopilot/images/app09.png b/windows/deployment/windows-autopilot/images/app09.png
new file mode 100644
index 0000000000..250c85dd8a
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app09.png differ
diff --git a/windows/deployment/windows-autopilot/images/app10.png b/windows/deployment/windows-autopilot/images/app10.png
new file mode 100644
index 0000000000..8d5af2ece1
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app10.png differ
diff --git a/windows/deployment/windows-autopilot/images/app11.png b/windows/deployment/windows-autopilot/images/app11.png
new file mode 100644
index 0000000000..9ca5bc10eb
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app11.png differ
diff --git a/windows/deployment/windows-autopilot/images/app12.png b/windows/deployment/windows-autopilot/images/app12.png
new file mode 100644
index 0000000000..3f82bf78a9
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app12.png differ
diff --git a/windows/deployment/windows-autopilot/images/app13.png b/windows/deployment/windows-autopilot/images/app13.png
new file mode 100644
index 0000000000..2b499f4ec2
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app13.png differ
diff --git a/windows/deployment/windows-autopilot/images/app14.png b/windows/deployment/windows-autopilot/images/app14.png
new file mode 100644
index 0000000000..e809db6134
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app14.png differ
diff --git a/windows/deployment/windows-autopilot/images/app15.png b/windows/deployment/windows-autopilot/images/app15.png
new file mode 100644
index 0000000000..b85a96bf9e
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app15.png differ
diff --git a/windows/deployment/windows-autopilot/images/app16.png b/windows/deployment/windows-autopilot/images/app16.png
new file mode 100644
index 0000000000..f22f74a091
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app16.png differ
diff --git a/windows/deployment/windows-autopilot/images/app17.png b/windows/deployment/windows-autopilot/images/app17.png
new file mode 100644
index 0000000000..5adfc9218f
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app17.png differ
diff --git a/windows/deployment/windows-autopilot/images/app18.png b/windows/deployment/windows-autopilot/images/app18.png
new file mode 100644
index 0000000000..24c4b9f331
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app18.png differ
diff --git a/windows/deployment/windows-autopilot/images/app19.png b/windows/deployment/windows-autopilot/images/app19.png
new file mode 100644
index 0000000000..281ba9fb40
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app19.png differ
diff --git a/windows/deployment/windows-autopilot/images/app20.png b/windows/deployment/windows-autopilot/images/app20.png
new file mode 100644
index 0000000000..a5a066b45e
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app20.png differ
diff --git a/windows/deployment/windows-autopilot/images/app21.png b/windows/deployment/windows-autopilot/images/app21.png
new file mode 100644
index 0000000000..d2e23f2db4
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app21.png differ
diff --git a/windows/deployment/windows-autopilot/images/app22.png b/windows/deployment/windows-autopilot/images/app22.png
new file mode 100644
index 0000000000..4541a69204
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app22.png differ
diff --git a/windows/deployment/windows-autopilot/images/app23.png b/windows/deployment/windows-autopilot/images/app23.png
new file mode 100644
index 0000000000..19b951c653
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app23.png differ
diff --git a/windows/deployment/windows-autopilot/images/app24.png b/windows/deployment/windows-autopilot/images/app24.png
new file mode 100644
index 0000000000..aa77e4083f
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app24.png differ
diff --git a/windows/deployment/windows-autopilot/images/app25.png b/windows/deployment/windows-autopilot/images/app25.png
new file mode 100644
index 0000000000..544d1ae37a
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app25.png differ
diff --git a/windows/deployment/windows-autopilot/images/app26.png b/windows/deployment/windows-autopilot/images/app26.png
new file mode 100644
index 0000000000..e210faa31b
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/app26.png differ
diff --git a/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.png b/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.png
new file mode 100644
index 0000000000..1533f68c7c
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/autopilot-aad-mdm.png differ
diff --git a/windows/deployment/windows-autopilot/images/branding.png b/windows/deployment/windows-autopilot/images/branding.png
new file mode 100644
index 0000000000..46dd37bc4a
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/branding.png differ
diff --git a/windows/deployment/windows-autopilot/images/choice.png b/windows/deployment/windows-autopilot/images/choice.png
new file mode 100644
index 0000000000..881744eec5
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/choice.png differ
diff --git a/windows/deployment/windows-autopilot/images/create-profile.png b/windows/deployment/windows-autopilot/images/create-profile.png
new file mode 100644
index 0000000000..52f087721d
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/create-profile.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device1.png b/windows/deployment/windows-autopilot/images/delete-device1.png
new file mode 100644
index 0000000000..e73f929fbd
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device1.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device2.png b/windows/deployment/windows-autopilot/images/delete-device2.png
new file mode 100644
index 0000000000..ed764ac1ed
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device2.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device3.png b/windows/deployment/windows-autopilot/images/delete-device3.png
new file mode 100644
index 0000000000..a2daa1c39a
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device3.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device4.png b/windows/deployment/windows-autopilot/images/delete-device4.png
new file mode 100644
index 0000000000..c0119fbc39
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device4.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device5.png b/windows/deployment/windows-autopilot/images/delete-device5.png
new file mode 100644
index 0000000000..33b539d33c
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device5.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device6.png b/windows/deployment/windows-autopilot/images/delete-device6.png
new file mode 100644
index 0000000000..23cbcb7c44
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device6.png differ
diff --git a/windows/deployment/windows-autopilot/images/delete-device7.png b/windows/deployment/windows-autopilot/images/delete-device7.png
new file mode 100644
index 0000000000..dcdeee5205
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/delete-device7.png differ
diff --git a/windows/deployment/windows-autopilot/images/deployment-profiles.png b/windows/deployment/windows-autopilot/images/deployment-profiles.png
new file mode 100644
index 0000000000..7888da55d1
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/deployment-profiles.png differ
diff --git a/windows/deployment/windows-autopilot/images/deployment-profiles2.png b/windows/deployment/windows-autopilot/images/deployment-profiles2.png
new file mode 100644
index 0000000000..6ff9fbb89e
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/deployment-profiles2.png differ
diff --git a/windows/deployment/windows-autopilot/images/device-import.png b/windows/deployment/windows-autopilot/images/device-import.png
new file mode 100644
index 0000000000..3be4cff996
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/device-import.png differ
diff --git a/windows/deployment/windows-autopilot/images/device-status.png b/windows/deployment/windows-autopilot/images/device-status.png
new file mode 100644
index 0000000000..5a78973ce5
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/device-status.png differ
diff --git a/windows/deployment/windows-autopilot/images/device2.png b/windows/deployment/windows-autopilot/images/device2.png
new file mode 100644
index 0000000000..6f7d1a5df0
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/device2.png differ
diff --git a/windows/deployment/windows-autopilot/images/device3.png b/windows/deployment/windows-autopilot/images/device3.png
new file mode 100644
index 0000000000..adf9c7a875
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/device3.png differ
diff --git a/windows/deployment/windows-autopilot/images/devices.png b/windows/deployment/windows-autopilot/images/devices.png
new file mode 100644
index 0000000000..a5b0dd1899
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/devices.png differ
diff --git a/windows/deployment/windows-autopilot/images/dfci.png b/windows/deployment/windows-autopilot/images/dfci.png
new file mode 100644
index 0000000000..6c68ed8b80
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/dfci.png differ
diff --git a/windows/deployment/windows-autopilot/images/enabled-device.png b/windows/deployment/windows-autopilot/images/enabled-device.png
new file mode 100644
index 0000000000..96dc935309
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/enabled-device.png differ
diff --git a/windows/deployment/windows-autopilot/images/hh.png b/windows/deployment/windows-autopilot/images/hh.png
new file mode 100644
index 0000000000..98fbc3cd7b
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/hh.png differ
diff --git a/windows/deployment/windows-autopilot/images/hwid-csv.png b/windows/deployment/windows-autopilot/images/hwid-csv.png
new file mode 100644
index 0000000000..ac177e0b5a
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/hwid-csv.png differ
diff --git a/windows/deployment/windows-autopilot/images/hwid.png b/windows/deployment/windows-autopilot/images/hwid.png
new file mode 100644
index 0000000000..fcc73fa0b0
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/hwid.png differ
diff --git a/windows/deployment/windows-autopilot/images/image1.png b/windows/deployment/windows-autopilot/images/image1.png
index ed70e84120..e5bd9e3cba 100644
Binary files a/windows/deployment/windows-autopilot/images/image1.png and b/windows/deployment/windows-autopilot/images/image1.png differ
diff --git a/windows/deployment/windows-autopilot/images/import-vm.png b/windows/deployment/windows-autopilot/images/import-vm.png
new file mode 100644
index 0000000000..5fb97cda5d
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/import-vm.png differ
diff --git a/windows/deployment/windows-autopilot/images/include-group.png b/windows/deployment/windows-autopilot/images/include-group.png
new file mode 100644
index 0000000000..fb7bca7efa
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/include-group.png differ
diff --git a/windows/deployment/windows-autopilot/images/include-group2.png b/windows/deployment/windows-autopilot/images/include-group2.png
new file mode 100644
index 0000000000..585d006bac
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/include-group2.png differ
diff --git a/windows/deployment/windows-autopilot/images/intune-devices.png b/windows/deployment/windows-autopilot/images/intune-devices.png
new file mode 100644
index 0000000000..bc29c76511
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/intune-devices.png differ
diff --git a/windows/deployment/windows-autopilot/images/landing.png b/windows/deployment/windows-autopilot/images/landing.png
new file mode 100644
index 0000000000..13dea20b07
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/landing.png differ
diff --git a/windows/deployment/windows-autopilot/images/mdm-intune.png b/windows/deployment/windows-autopilot/images/mdm-intune.png
new file mode 100644
index 0000000000..db9b144fad
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/mdm-intune.png differ
diff --git a/windows/deployment/windows-autopilot/images/mdm-intune2.png b/windows/deployment/windows-autopilot/images/mdm-intune2.png
new file mode 100644
index 0000000000..d464863f37
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/mdm-intune2.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-assign1.png b/windows/deployment/windows-autopilot/images/msfb-assign1.png
new file mode 100644
index 0000000000..c1e8e27e21
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-assign1.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-assign2.png b/windows/deployment/windows-autopilot/images/msfb-assign2.png
new file mode 100644
index 0000000000..fd3be16853
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-assign2.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-create1.png b/windows/deployment/windows-autopilot/images/msfb-create1.png
new file mode 100644
index 0000000000..f76aa82991
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-create1.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-create2.png b/windows/deployment/windows-autopilot/images/msfb-create2.png
new file mode 100644
index 0000000000..ec6c260fcd
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-create2.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-create3.png b/windows/deployment/windows-autopilot/images/msfb-create3.png
new file mode 100644
index 0000000000..a6241fb5ea
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-create3.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-device.png b/windows/deployment/windows-autopilot/images/msfb-device.png
new file mode 100644
index 0000000000..d338056013
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-device.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-manage.png b/windows/deployment/windows-autopilot/images/msfb-manage.png
new file mode 100644
index 0000000000..9bf684d844
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-manage.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-manage2.png b/windows/deployment/windows-autopilot/images/msfb-manage2.png
new file mode 100644
index 0000000000..406aaf5948
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-manage2.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb-manage3.png b/windows/deployment/windows-autopilot/images/msfb-manage3.png
new file mode 100644
index 0000000000..bf5fb1ccf9
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb-manage3.png differ
diff --git a/windows/deployment/windows-autopilot/images/msfb.png b/windows/deployment/windows-autopilot/images/msfb.png
new file mode 100644
index 0000000000..af937c2c5f
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/msfb.png differ
diff --git a/windows/deployment/windows-autopilot/images/new-group.png b/windows/deployment/windows-autopilot/images/new-group.png
new file mode 100644
index 0000000000..c18c1865f6
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/new-group.png differ
diff --git a/windows/deployment/windows-autopilot/images/profile.png b/windows/deployment/windows-autopilot/images/profile.png
new file mode 100644
index 0000000000..40cf26bee2
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/profile.png differ
diff --git a/windows/deployment/windows-autopilot/images/reset.png b/windows/deployment/windows-autopilot/images/reset.png
new file mode 100644
index 0000000000..0619b7fa03
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/reset.png differ
diff --git a/windows/deployment/windows-autopilot/images/update-flow.png b/windows/deployment/windows-autopilot/images/update-flow.png
new file mode 100644
index 0000000000..c90f54e96c
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/update-flow.png differ
diff --git a/windows/deployment/windows-autopilot/images/update1.png b/windows/deployment/windows-autopilot/images/update1.png
new file mode 100644
index 0000000000..83d98a29b5
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/update1.png differ
diff --git a/windows/deployment/windows-autopilot/images/update2.png b/windows/deployment/windows-autopilot/images/update2.png
new file mode 100644
index 0000000000..04dbcaddc1
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/update2.png differ
diff --git a/windows/deployment/windows-autopilot/images/update3.png b/windows/deployment/windows-autopilot/images/update3.png
new file mode 100644
index 0000000000..851adb58ec
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/update3.png differ
diff --git a/windows/deployment/windows-autopilot/images/wg01.png b/windows/deployment/windows-autopilot/images/wg01.png
new file mode 100644
index 0000000000..fa08be3f48
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/wg01.png differ
diff --git a/windows/deployment/windows-autopilot/images/wg02.png b/windows/deployment/windows-autopilot/images/wg02.png
new file mode 100644
index 0000000000..5de01d6803
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/wg02.png differ
diff --git a/windows/deployment/windows-autopilot/images/wg03.png b/windows/deployment/windows-autopilot/images/wg03.png
new file mode 100644
index 0000000000..89ac12747c
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/wg03.png differ
diff --git a/windows/deployment/windows-autopilot/images/wg04.png b/windows/deployment/windows-autopilot/images/wg04.png
new file mode 100644
index 0000000000..a59ea766b7
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/wg04.png differ
diff --git a/windows/deployment/windows-autopilot/images/wg05.png b/windows/deployment/windows-autopilot/images/wg05.png
new file mode 100644
index 0000000000..cea36fb6bd
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/wg05.png differ
diff --git a/windows/deployment/windows-autopilot/images/wg06.png b/windows/deployment/windows-autopilot/images/wg06.png
new file mode 100644
index 0000000000..68cd29c24d
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/wg06.png differ
diff --git a/windows/deployment/windows-autopilot/images/wg07.png b/windows/deployment/windows-autopilot/images/wg07.png
new file mode 100644
index 0000000000..bc5a81bb3f
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/wg07.png differ
diff --git a/windows/deployment/windows-autopilot/images/white-glove-result.png b/windows/deployment/windows-autopilot/images/white-glove-result.png
new file mode 100644
index 0000000000..de3701e76d
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/white-glove-result.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup1.png b/windows/deployment/windows-autopilot/images/winsetup1.png
new file mode 100644
index 0000000000..c8048256c4
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup1.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup2.png b/windows/deployment/windows-autopilot/images/winsetup2.png
new file mode 100644
index 0000000000..43db844334
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup2.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup3.png b/windows/deployment/windows-autopilot/images/winsetup3.png
new file mode 100644
index 0000000000..dbea3969de
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup3.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup4.png b/windows/deployment/windows-autopilot/images/winsetup4.png
new file mode 100644
index 0000000000..1121b1dff5
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup4.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup5.png b/windows/deployment/windows-autopilot/images/winsetup5.png
new file mode 100644
index 0000000000..2757253097
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup5.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup6.png b/windows/deployment/windows-autopilot/images/winsetup6.png
new file mode 100644
index 0000000000..e91843e1ff
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup6.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup7.png b/windows/deployment/windows-autopilot/images/winsetup7.png
new file mode 100644
index 0000000000..dadf85485e
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup7.png differ
diff --git a/windows/deployment/windows-autopilot/images/winsetup8.png b/windows/deployment/windows-autopilot/images/winsetup8.png
new file mode 100644
index 0000000000..9d7a499db0
Binary files /dev/null and b/windows/deployment/windows-autopilot/images/winsetup8.png differ
diff --git a/windows/deployment/windows-autopilot/index.md b/windows/deployment/windows-autopilot/index.md
new file mode 100644
index 0000000000..93abebfa65
--- /dev/null
+++ b/windows/deployment/windows-autopilot/index.md
@@ -0,0 +1,78 @@
+---
+title: Windows Autopilot deployment
+description: Discover resources for Windows Autopilot deployment with this guide.
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.reviewer: mniehaus
+manager: laurawi
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itpro
+author: greg-lindsay
+ms.author: greglin
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+
+# Windows Autopilot deployment
+
+**Applies to**
+
+-   Windows 10
+
+Windows Autopilot is a zero-touch, self-service Windows deployment platform introduced with Windows 10, version 1703. The Windows Autopilot process runs immediately after powering on a new computer for the first time, enabling employees to configure new devices to be business-ready with just a few clicks.  
+
+This guide is intended for use by an IT-specialist, system architect, or business decision maker. The guide provides information about how Windows Autopilot deployment works, including detailed requirements, deployment scenarios, and platform capabilities. The document highlights options that are available to you when planning a modern, cloud-joined Windows 10 deployment strategy. Links are provided to detailed step by step configuration procedures.
+
+## In this guide
+
+
+
                                  What's new Windows Autopilot is always being updated with new features! Check this topic to read about the latest capabilities.
+
                                  
+
+### Understanding Windows Autopilot
+
+
+
                                  Overview of Windows AutopilotA review of Windows Autopilot is provided with a video walkthrough. Benefits and general requirements are discussed.
+
                                  RequirementsDetailed software, network, licensing, and configuration requirements are provided.
+
                                  Scenarios and CapabilitiesA summary of Windows Autopilot deployment scenarios and capabilities.
+
                                  Get startedInterested in trying out Autopilot? See this step-by-step walkthrough to test Windows Autopilot on a virtual machine or physical device with a free 30-day trial premium Intune account.
+
                                  
+
+### Deployment scenarios
+
+
+
                                  User-driven modeRequirements and validation steps for deploying a new Azure Active Directory (AAD) joined or hybrid AAD-joined Windows 10 device are provided.
+
                                  Self-deploying modeRequirements and validation steps for deploying a new Windows 10 device with little to no user interaction are provided.
+
                                  Windows Autopilot ResetUsing Windows Autopilot Reset, a device can be restored to its original settings, taking it back to a business-ready state. Both local and remote reset scenarios are discussed.
+
                                  Windows Autopilot for white glove deploymentRequirements and procedures are described that enable additional policies and apps to be delivered to a Windows Autopilot device.
+
                                  Support for existing devicesThis topic describes how Windows Autopilot can be used to convert Windows 7 or Windows 8.1 domain-joined computers to AAD-joined computers running Windows 10.
+
                                  
+
+### Using Windows Autopilot
+
+
+
                                  Registering devicesThe process of registering a device with the Windows Autopilot deployment service is described.
+
                                  Configuring device profilesThe device profile settings that specific its behavior when it is deployed are described.
+
                                  Enrollment status pageSettings that are available on the Enrollment Status Page are described.
+
                                  BitLocker encryption Available options for configuring BitLocker on Windows Autopilot devices are described.
+
                                  DFCI management Manage UEFI settings using the Device Firmware Configuration Interface (DFCI) with Windows Autopilot and Intune.
+
                                  Troubleshooting Windows AutopilotDiagnostic event information and troubleshooting procedures are provided.
+
                                  Known issuesA list of current known issues and solutions is provided.
+
                                  
+
+### Support topics
+
+
+
                                  FAQFrequently asked questions on several topics are provided.
+
                                  Support contactsSupport information is provided.
+
                                  Registration authorizationThis article discusses how a CSP partner or OEM can obtain customer authorization to register Windows Autopilot devices.
+
                                  Motherboard replacementInformation about how to deal with Autopilot registration and device repair issues is provided.
+
                                  
+
+## Related topics
+
+[Windows Autopilot](https://www.microsoft.com/windowsforbusiness/windows-autopilot)
diff --git a/windows/deployment/windows-autopilot/intune-connector.md b/windows/deployment/windows-autopilot/intune-connector.md
deleted file mode 100644
index f557867c0b..0000000000
--- a/windows/deployment/windows-autopilot/intune-connector.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-title: Intune Connector (preview) requirements
-description: Intune Connector (preview) issue workaround
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: low
-ms.sitesec: library
-ms.pagetype: deploy
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.date: 11/26/2018
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Intune Connector (preview) language requirements
-
-**Applies to: Windows 10**
-
-Microsoft has released a [preview for Intune connector for Active Directory](https://docs.microsoft.com/intune/windows-autopilot-hybrid) that enables user-driven [Hybrid Azure Active Directory join](user-driven-hybrid.md) for Windows Autopilot.
-
-In this preview version of the Intune Connector, you might receive an error message indicating a setup failure with the following error code and message:
-
-**0x80070658 - Error applying transforms. Verify that the specified transform paths are valid.**
-
-An [example](#example) of the error message is displayed at the bottom of this topic. 
-
-This error can be resolved by ensuring that the member server where Intune Connector is running has one of the following language packs installed and configured to be the default keyboard layout:
-
-|  |  |  |  |  |  |  |  |  |  |  | 
-| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| en-US | cs-CZ | da-DK | de-DE | el-GR | es-ES | fi-FI | fr-FR | hu-HU | it-IT | ja-JP |
-| ko-KR | nb-NO | nl-NL | pl-PL | pt-BR | ro-RO | ru-RU | sv-SE | tr-TR | zh-CN | zh-TW |
-
->[!NOTE]
->After installing the Intune Connector, you can restore the keyboard layout to its previous settings.
                                  
->This solution is a workaround and will be fully resolved in a future release of the Intune Connector.
-
-To change the default keyboard layout:
-
-1. Click **Settings > Time & language > Region and language** 
-2. Select one of the languages listed above and choose **Set as default**.
-
-If the language you need isn't listed, you can add additional languages by selecting **Add a language**.
-
-## Example
-
-The following is an example of the error message that can be displayed if one of the listed languages is not used during setup:
-
-![Connector error](images/connector-fail.png)
-
-
diff --git a/windows/deployment/windows-autopilot/known-issues.md b/windows/deployment/windows-autopilot/known-issues.md
new file mode 100644
index 0000000000..5be64cc194
--- /dev/null
+++ b/windows/deployment/windows-autopilot/known-issues.md
@@ -0,0 +1,79 @@
+---
+title: Windows Autopilot known issues
+ms.reviewer: 
+manager: laurawi
+description: Inform yourself about known issues that may occur during Windows Autopilot deployment.
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itpro
+author: greg-lindsay
+ms.author: greglin
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+
+# Windows Autopilot - known issues
+
+**Applies to**
+
+- Windows 10
+
+
+
+
+
+
+  
+
                                  IssueMore information
+
+
                                  Windows Autopilot device provisioning can fail with TPM attestation errors or ESP timeouts on devices where the real-time clock is off by a significant amount of time (e.g. several minutes or more).To fix this issue: 
                                  1. Boot the device to the start of the out-of-box experience (OOBE).
+
                                  2. Establish a network connection (wired or wireless).
+
                                  3. Run the command w32tm /resync /force to sync the time with the default time server (time.windows.com).
                                  
+
                                  Windows Autopilot for existing devices does not work for Windows 10, version 1903; you see screens that you've disabled in your Windows Autopilot profile, such as the Windows 10 License Agreement screen.
+
                                   
                                  
+This happens because Windows 10, version 1903 deletes the AutopilotConfigurationFile.json file.
+                                  		To fix this issue: 
                                  1. Edit the Configuration Manager task sequence and disable the Prepare Windows for Capture step.
+
                                  2. Add a new Run command line step that runs c:\windows\system32\sysprep\sysprep.exe /oobe /reboot.
                                  
+More information
                                  TPM attestation fails on Windows 10 1903 due to missing AKI extension in EK certificate.  (An additional validation added in Windows 10 1903 to check that the TPM EK certs had the proper attributes according to the TCG specifications uncovered that a number of them don’t, so that validation will be removed).
+Download and install the KB4517211 update.
+
                                  The following known issues are resolved by installing the August 30, 2019 KB4512941 update (OS Build 18362.329):
+
+- Windows Autopilot for existing devices feature does not properly suppress “Activities” page during OOBE.  (Because of this, you’ll see that extra page during OOBE).
+- TPM attestation state is not cleared by sysprep /generalize, causing TPM attestation failure during later OOBE flow.  (This isn’t a particularly common issue, but you could run into it while testing if you are running sysprep /generalize and then rebooting or reimaging the device to go back through an Autopilot white glove or self-deploying scenario).
+- TPM attestation may fail if the device has a valid AIK cert but no EK cert.  (This is related to the previous item).
+- If TPM attestation fails during the Windows Autopilot white glove process, the landing page appears to be hung.  (Basically, the white glove landing page, where you click “Provision” to start the white glove process, isn’t reporting errors properly).
+- TPM attestation fails on newer Infineon TPMs (firmware version > 7.69).  (Prior to this fix, only a specific list of firmware versions was accepted).
+- Device naming templates may truncate the computer name at 14 characters instead of 15.
+- Assigned Access policies cause a reboot which can interfere with the configuration of single-app kiosk devices.
+Download and install the KB4512941 update. 

                                  See the section: How to get this update for information on specific release channels you can use to obtain the update.
+
                                  The following known issues are resolved by installing the July 26, 2019 KB4505903 update (OS Build 18362.267):
+
+- Windows Autopilot white glove does not work for a non-English OS and you see a red screen that says "Success."
+- Windows Autopilot reports an AUTOPILOTUPDATE error during OOBE after sysprep, reset or other variations.  This typically happens if you reset the OS or used a custom sysprepped image.
+- BitLocker encryption is not correctly configured. Ex: BitLocker didn’t get an expected notification after policies were applied to begin encryption.
+- You are unable to install UWP apps from the Microsoft Store, causing failures during Windows Autopilot.  If you are deploying Company Portal as a blocking app during Windows Autopilot ESP, you’ve probably seen this error.
+- A user is not granted administrator rights in the Windows Autopilot user-driven Hybrid Azure AD join scenario.  This is another non-English OS issue.
+Download and install the KB4505903 update. 

                                  See the section: How to get this update for information on specific release channels you can use to obtain the update.
+
                                  Windows Autopilot self-deploying mode fails with an error code:
+
+
                                  0x800705B4This is a general error indicating a timeout. A common cause of this error in self-deploying mode is that the device is not TPM 2.0 capable (ex: a virtual machine). Devices that are not TPM 2.0 capable cannot be used with self-deploying mode.
+
                                  0x801c03eaThis error indicates that TPM attestation failed, causing a failure to join Azure Active Directory with a device token.
+
                                  0xc1036501The device cannot do an automatic MDM enrollment because there are multiple MDM configurations in Azure AD. See Inside Windows Autopilot self-deploying mode.
+
                                  
+
                                  White glove gives a red screen and the Microsoft-Windows-User Device Registration/Admin event log displays HResult error code 0x801C03F3This can happen if Azure AD can’t find an AAD device object for the device that you are trying to deploy. This will occur if you manually delete the object. To fix it, remove the device from AAD, Intune, and Autopilot, then re-register it with Autopilot, which will recreate the AAD device object.
                                   
+
                                  To obtain troubleshooting logs use: Mdmdiagnosticstool.exe -area Autopilot;TPM -cab c:\autopilot.cab
+
                                  White glove gives a red screenWhite glove is not supported on a VM.
+
                                  Error importing Windows Autopilot devices from a .csv fileEnsure that you have not edited the .csv file in Microsoft Excel or an editor other than Notepad. Some of these editors can introduce extra characters causing the file format to be invalid. 
+
                                  Windows Autopilot for existing devices does not follow the Autopilot OOBE experience.Ensure that the JSON profile file is saved in ANSI/ASCII format, not Unicode or UTF-8.
+
                                  Something went wrong is displayed page during OOBE.The client is likely unable to access all the required AAD/MSA-related URLs. For more information, see Networking requirements.
+
                                  
+
+## Related topics
+
+[Diagnose MDM failures in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10)
                                  
+[Troubleshooting Windows Autopilot](troubleshooting.md)
diff --git a/windows/deployment/windows-autopilot/profiles.md b/windows/deployment/windows-autopilot/profiles.md
index 8884be069a..5cb74ed199 100644
--- a/windows/deployment/windows-autopilot/profiles.md
+++ b/windows/deployment/windows-autopilot/profiles.md
@@ -1,14 +1,17 @@
 ---
 title: Configure Autopilot profiles
-description: How to configure Windows Autopilot deployment
+description: Learn how to configure device profiles while performing a Windows Autopilot deployment.
 keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.reviewer: mniehaus
+manager: laurawi
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.localizationpriority: medium
 ms.sitesec: library
 ms.pagetype: deploy
+audience: itpro
 author: greg-lindsay
-ms.author: greg-lindsay
+ms.author: greglin
 ms.collection: M365-modern-desktop
 ms.topic: article
 ---
@@ -22,24 +25,6 @@ ms.topic: article
 
 For each device that has been defined to the Windows Autopilot deployment service, a profile of settings needs to be applied that specifies the exact behavior of that device when it is deployed. For detailed procedures on how to configure profile settings and register devices, see [Registering devices](add-devices.md#registering-devices).
 
-## Profile download
-
-When an Internet-connected Windows 10 device boots up, it will attempt to connect to the Autopilot service and download an Autopilot profile. Note: It is important that a profile exists at this stage so that a blank profile is not cached locally on the PC. To remove the currently cached local profile in Windows 10 version 1803 and earlier, it is necessary to re-generalize the OS using **sysprep /generalize /oobe**, reinstall the OS, or re-image the PC. In Windows 10 version 1809 and later, you can retrieve a new profile by rebooting the PC.
-
-When a profile is downloaded depends on the version of Windows 10 that is running on the PC. See the following table.
-
-| Windows 10 version | Profile download behavior |
-| --- | --- |
-| 1703 and 1709 | The profile is downloaded after the OOBE network connection page. This page is not displayed when using a wired connection. In this case, the profile is downloaded just prior to the EULA screen. |
-| 1803 | The profile is downloaded as soon as possible.  If wired, it is downloaded at the start of OOBE. If wireless, it is downloaded after the network connection page. |
-| 1809 | The profile is downloaded as soon as possible (same as 1803), and again after each reboot. |
-
-If you need to reboot a computer during OOBE: 
-- Press Shift-F10 to open a command prompt.
-- Enter **shutdown /r /t 0** to restart immediately, or **shutdown /s /t 0** to shutdown immediately.
-
-For more information, see [Windows Setup Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options).
-
 ## Profile settings
 
 The following profile settings are available:
@@ -60,4 +45,5 @@ The following profile settings are available:
 
 ## Related topics
 
-[Configure Autopilot deployment](configure-autopilot.md)
+[Profile download](troubleshooting.md#profile-download)
+[Registering devices](add-devices.md)
diff --git a/windows/deployment/windows-autopilot/registration-auth.md b/windows/deployment/windows-autopilot/registration-auth.md
index 563dc03e5f..a91c17be27 100644
--- a/windows/deployment/windows-autopilot/registration-auth.md
+++ b/windows/deployment/windows-autopilot/registration-auth.md
@@ -1,14 +1,17 @@
 ---
 title: Windows Autopilot customer consent
-description: Support information for Windows Autopilot
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, csp, OEM
+description: Learn how a cloud service provider (CSP) partner or an OEM can get customer authorization to register Windows Autopilot devices on the customer’s behalf.
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.reviewer: mniehaus
+manager: laurawi
 ms.prod: w10
 ms.mktglfcycl: deploy
-ms.localizationpriority: low
+ms.localizationpriority: medium
 ms.sitesec: library
 ms.pagetype: deploy
+audience: itpro
 author: greg-lindsay
-ms.author: greg-lindsay
+ms.author: greglin
 ms.collection: M365-modern-desktop
 ms.topic: article
 ---
@@ -34,7 +37,7 @@ CSP partners can get customer authorization to register Windows Autopilot device
 
 For a CSP to register Windows Autopilot devices on behalf of a customer, the customer must first grant that CSP partner permission using the following process:
 
-1.	CSP sends link to customer requesting authorization/consent to register/manage devices on their behalf.  To do so:
+1. CSP sends link to customer requesting authorization/consent to register/manage devices on their behalf.  To do so:
     - CSP logs into Microsoft Partner Center
     - Click **Dashboard** on the top menu
     - Click **Customer** on the side menu
@@ -42,18 +45,19 @@ For a CSP to register Windows Autopilot devices on behalf of a customer, the cus
     ![Request a reseller relationship](images/csp1.png)
     - Select the checkbox indicating whether or not you want delegated admin rights:
     ![Delegated rights](images/csp2.png)
-    - NOTE: Depending on your partner, they might request Delegated Admin Permissions (DAP) when requesting this consent.  You should ask them to use the newer DAP-free process (shown in this document) if possible. If not, you can easily remove their DAP status either from Microsoft Store for Business or the Office 365 admin portal:  https://docs.microsoft.com/en-us/partner-center/customers_revoke_admin_privileges
+    - NOTE: Depending on your partner, they might request Delegated Admin Permissions (DAP) when requesting this consent.  You should ask them to use the newer DAP-free process (shown in this document) if possible. If not, you can easily remove their DAP status either from Microsoft Store for Business or the Office 365 admin portal:  https://docs.microsoft.com/partner-center/customers_revoke_admin_privileges
     - Send the template above to the customer via email.
 2. Customer with global administrator privileges in Microsoft Store for Business (MSfB) clicks the link in the body of the email once they receive it from the CSP, which takes them directly to the following MSfB page:
 
     ![Global admin](images/csp3.png)
 
-    NOTE: A user without global admin privileges who clicks the link will see a message similar to the following:
+    > [!NOTE]
+    > A user without global admin privileges who clicks the link will see a message similar to the following:
 
     ![Not global admin](images/csp4.png)
 
-3.	Customer selects the **Yes** checkbox, followed by the **Accept** button. Authorization happens instantaneously.
-4.	The CSP will know that this consent/authorization request has been completed because the customer will show up in the CSP’s MPC account under their **customers** list, for example:
+3. Customer selects the **Yes** checkbox, followed by the **Accept** button. Authorization happens instantaneously.
+4. The CSP will know that this consent/authorization request has been completed because the customer will show up in the CSP’s MPC account under their **customers** list, for example:
 
 ![Customers](images/csp5.png)
 
@@ -61,19 +65,22 @@ For a CSP to register Windows Autopilot devices on behalf of a customer, the cus
 
 Each OEM has a unique link to provide to their respective customers, which the OEM can request from Microsoft via msoemops@microsoft.com.
 
-1.	OEM emails link to their customer.
-2.	Customer with global administrator privileges in Microsoft Store for Business (MSfB) clicks the link once they receive it from the OEM, which takes them directly to the following MSfB page:
+1. OEM emails link to their customer.
+2. Customer with global administrator privileges in Microsoft Store for Business (MSfB) clicks the link once they receive it from the OEM, which takes them directly to the following MSfB page:
 
     ![Global admin](images/csp6.png)
 
-    NOTE: A user without global admin privileges who clicks the link will see a message similar to the following:
+    > [!NOTE]
+    > A user without global admin privileges who clicks the link will see a message similar to the following:
 
     ![Not global admin](images/csp7.png)
-3.	Customer selects the **Yes** checkbox, followed by the **Accept** button, and they’re done.  Authorization happens instantaneously.
+3. Customer selects the **Yes** checkbox, followed by the **Accept** button, and they’re done.  Authorization happens instantaneously.
 
-4.	The OEM can use the Validate Device Submission Data API to verify the consent has completed.  This API is discussed in the latest version of the API Whitepaper, p. 14ff [https://devicepartner.microsoft.com/assets/detail/windows-autopilot-integration-with-oem-api-design-whitepaper-docx](https://devicepartner.microsoft.com/assets/detail/windows-autopilot-integration-with-oem-api-design-whitepaper-docx). **Note**: this link is only accessible by Microsoft Device Partners. As discussed in this whitepaper, it’s a best practice recommendation for OEM partners to run the API check to confirm they’ve received customer consent before attempting to register devices, thus avoiding errors in the registration process.
+4. The OEM can use the Validate Device Submission Data API to verify the consent has completed.  This API is discussed in the latest version of the API Whitepaper, p. 14ff [https://devicepartner.microsoft.com/assets/detail/windows-autopilot-integration-with-oem-api-design-whitepaper-docx](https://devicepartner.microsoft.com/assets/detail/windows-autopilot-integration-with-oem-api-design-whitepaper-docx). **Note**: this link is only accessible by Microsoft Device Partners. As discussed in this whitepaper, it’s a best practice recommendation for OEM partners to run the API check to confirm they’ve received customer consent before attempting to register devices, thus avoiding errors in the registration process.
+
+    > [!NOTE]
+    > During the OEM authorization registration process, no delegated admin permissions are granted to the OEM.
 
 ## Summary
 
 At this stage of the process, Microsoft is no longer involved; the consent exchange happens directly between the OEM and the customer.  And, it all happens instantaneously - as quickly as buttons are clicked.
-
diff --git a/windows/deployment/windows-autopilot/rip-and-replace.md b/windows/deployment/windows-autopilot/rip-and-replace.md
deleted file mode 100644
index 92c1d57447..0000000000
--- a/windows/deployment/windows-autopilot/rip-and-replace.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-title: Rip and Replace
-description: Listing of Autopilot scenarios
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: high
-ms.sitesec: library
-ms.pagetype: deploy
-author: coreyp-at-msft
-ms.author: coreyp
-ms.date: 06/01/2018
----
-
-# Rip and replace
-
-**Applies to: Windows 10**
-
-DO NOT PUBLISH.  Just a placeholder for now, coming with 1809.
\ No newline at end of file
diff --git a/windows/deployment/windows-autopilot/self-deploying.md b/windows/deployment/windows-autopilot/self-deploying.md
index be36013432..4bdb15131d 100644
--- a/windows/deployment/windows-autopilot/self-deploying.md
+++ b/windows/deployment/windows-autopilot/self-deploying.md
@@ -1,70 +1,74 @@
----
-title: Windows Autopilot Self-Deploying mode (Preview) 
-description: Gives an overview of Autopilot Plug and Forget and how to use it.
-keywords: Autopilot Plug and Forget, Windows 10
-ms.prod: w10
-ms.technology: Windows
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype:
-ms.localizationpriority: medium
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Windows Autopilot Self-Deploying mode (Preview)
-
-**Applies to: Windows 10, version 1809 or later**
-
-Windows Autopilot self-deploying mode enables a device to be deployed with little to no user interaction. For devices with an Ethernet connection, no user interaction is required; for devices connected via Wi-fi, no interaction is required after making the Wi-fi connection (choosing the language, locale, and keyboard, then making a network connection).  
-
-Self-deploying mode joins the device into Azure Active Directory, enrolls the device in Intune (or another MDM service) leveraging Azure AD for automatic MDM enrollment, and ensures that all policies, applications, certificates, and networking profiles are provisioned on the device, leveraging the enrollment status page to prevent access to the desktop until the device is fully provisioned. 
-
->[!NOTE]
->Self-deploying mode does not support Active Directory Join or Hybrid Azure AD Join.  All devices will be joined to Azure Active Directory.
-
-Self-deploying mode is designed to deploy Windows 10 as a kiosk, digital signage device, or a shared device. When setting up a kiosk, you can leverage the new Kiosk Browser, an app built on Microsoft Edge that can be used to create a tailored, MDM-managed browsing experience. When combined with MDM policies to create a local account and configure it to automatically log on, the complete configuration of the device can be automated. Find out more about these options by reading simplifying kiosk management for IT with Windows 10.  See [Set up a kiosk or digital sign in Intune or other MDM service](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage#set-up-a-kiosk-or-digital-sign-in-intune-or-other-mdm-service) for additional details.
-
->[!NOTE]
->Self-deploying mode does not presently associate a user with the device (since no user ID or password is specified as part of the process).  As a result, some Azure AD and Intune capabilities (such as BitLocker recovery, installation of apps from the Company Portal, or Conditional Access) may not be available to a user that signs into the device.
-
-![The user experience with Windows Autopilot self-deploying mode](images/self-deploy-welcome.png)
-
-## Requirements
-
-Because self-deploying mode uses a device’s TPM 2.0 hardware to authenticate the device into an organization’s Azure AD tenant, devices without TPM 2.0 cannot be used with this mode.  The devices must also support TPM device attestation.  (All newly-manufactured Windows devices should meet these requirements.)
-
->[!NOTE]
->If you attempt a self-deploying mode deployment on a device that does not have support TPM 2.0 or on a virtual machine, the process will fail when verifying the device with an 0x800705B4 timeout error.  (Hyper-V virtual TPMs are not supported.)
-
-In order to display an organization-specific logo and organization name during the Autopilot process, Azure Active Directory Company Branding needs to be configured with the images and text that should be displayed.  See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details. 
-
-## Step by step
-
-In order to perform a self-deploying mode deployment using Windows Autopilot, the following preparation steps need to be completed:
-
--   Create an Autopilot profile for self-deploying mode with the desired settings.  In Microsoft Intune, this mode is explicitly chosen when creating the profile. (Note that it is not possible to create a profile in the Microsoft Store for Business or Partner Center for self-deploying mode.)
--   If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group.  Ensure that the profile has been assigned to the device before attempting to deploy that device.
--   Boot the device, connecting it to Wi-fi if required, then wait for the provisioning process to complete.
-
-## Validation
-
-When performing a self-deploying mode deployment using Windows Autopilot, the following end-user experience should be observed:
-
--   Once connected to a network, the Autopilot profile will be downloaded.
--   If the Autopilot profile has been configured to automatically configure the language, locale, and keyboard layout, these OOBE screens should be skipped as long as Ethernet connectivity is available.  Otherwise, manual steps are required:
-    -   If multiple languages are preinstalled in Windows 10, the user must pick a language.
-    -   The user must pick a locale and a keyboard layout, and optionally a second keyboard layout.
--   If connected via Ethernet, no network prompt is expected.  If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network.
--   Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required).
--   The device will join Azure Active Directory.
--   After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services).
--   The [enrollment status page](enrollment-status.md) will be displayed.
--   Depending on the device settings deployed, the device will either:
-    -   Remain at the logon screen, where any member of the organization can log on by specifying their Azure AD credentials.
-    -   Automatically sign in as a local account, for devices configured as a kiosk or digital signage.
-
-In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation.
+---
+title: Windows Autopilot Self-Deploying mode
+description: Self-deploying mode allows a device to be deployed with little to no user interaction. This mode mode is designed to deploy Windows 10 as a kiosk, digital signage device, or a shared device.
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.reviewer: mniehaus
+manager: laurawi
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itpro
+author: greg-lindsay
+ms.author: greglin
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+# Windows Autopilot Self-Deploying mode
+
+**Applies to: Windows 10, version 1903 or later**
+
+Windows Autopilot self-deploying mode enables a device to be deployed with little to no user interaction. For devices with an Ethernet connection, no user interaction is required; for devices connected via Wi-fi, no interaction is required after making the Wi-fi connection (choosing the language, locale, and keyboard, then making a network connection).  
+
+Self-deploying mode joins the device into Azure Active Directory, enrolls the device in Intune (or another MDM service) leveraging Azure AD for automatic MDM enrollment, and ensures that all policies, applications, certificates, and networking profiles are provisioned on the device, leveraging the enrollment status page to prevent access to the desktop until the device is fully provisioned. 
+
+>[!NOTE]
+>Self-deploying mode does not support Active Directory Join or Hybrid Azure AD Join.  All devices will be joined to Azure Active Directory.
+
+Self-deploying mode is designed to deploy Windows 10 as a kiosk, digital signage device, or a shared device. When setting up a kiosk, you can leverage the new Kiosk Browser, an app built on Microsoft Edge that can be used to create a tailored, MDM-managed browsing experience. When combined with MDM policies to create a local account and configure it to automatically log on, the complete configuration of the device can be automated. Find out more about these options by reading simplifying kiosk management for IT with Windows 10.  See [Set up a kiosk or digital sign in Intune or other MDM service](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage#set-up-a-kiosk-or-digital-sign-in-intune-or-other-mdm-service) for additional details.
+
+>[!NOTE]
+>Self-deploying mode does not presently associate a user with the device (since no user ID or password is specified as part of the process).  As a result, some Azure AD and Intune capabilities (such as BitLocker recovery, installation of apps from the Company Portal, or Conditional Access) may not be available to a user that signs into the device. For more information see [Windows Autopilot scenarios and capabilities](windows-autopilot-scenarios.md) and [Setting the BitLocker encryption algorithm for Autopilot devices](bitlocker.md).
+
+![The user experience with Windows Autopilot self-deploying mode](images/self-deploy-welcome.png)
+
+## Requirements
+
+Because self-deploying mode uses a device’s TPM 2.0 hardware to authenticate the device into an organization’s Azure AD tenant, devices without TPM 2.0 cannot be used with this mode.  The devices must also support TPM device attestation.  (All newly-manufactured Windows devices should meet these requirements.)
+
+>[!IMPORTANT]
+>If you attempt a self-deploying mode deployment on a device that does not have support TPM 2.0 or on a virtual machine, the process will fail when verifying the device with an 0x800705B4 timeout error (Hyper-V virtual TPMs are not supported). Also note that Window 10, version 1903 or later is required to use self-deploying mode due to issues with TPM device attestation in Windows 10, version 1809. Since Windows 10 Enterprise 2019 LTSC is based on Windows 10 version 1809, self-deploying mode is also not supported on Windows 10 Enterprise 2019 LTSC. See [Windows Autopilot known issues](known-issues.md) to review other known errors and solutions.
+
+In order to display an organization-specific logo and organization name during the Autopilot process, Azure Active Directory Company Branding needs to be configured with the images and text that should be displayed.  See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details. 
+
+## Step by step
+
+In order to perform a self-deploying mode deployment using Windows Autopilot, the following preparation steps need to be completed:
+
+-   Create an Autopilot profile for self-deploying mode with the desired settings.  In Microsoft Intune, this mode is explicitly chosen when creating the profile. (Note that it is not possible to create a profile in the Microsoft Store for Business or Partner Center for self-deploying mode.)
+-   If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group.  Ensure that the profile has been assigned to the device before attempting to deploy that device.
+-   Boot the device, connecting it to Wi-fi if required, then wait for the provisioning process to complete.
+
+## Validation
+
+When performing a self-deploying mode deployment using Windows Autopilot, the following end-user experience should be observed:
+
+-   Once connected to a network, the Autopilot profile will be downloaded.
+-   If the Autopilot profile has been configured to automatically configure the language, locale, and keyboard layout, these OOBE screens should be skipped as long as Ethernet connectivity is available.  Otherwise, manual steps are required:
+    -   If multiple languages are preinstalled in Windows 10, the user must pick a language.
+    -   The user must pick a locale and a keyboard layout, and optionally a second keyboard layout.
+-   If connected via Ethernet, no network prompt is expected.  If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network.
+-   Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required).
+-   The device will join Azure Active Directory.
+-   After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services).
+-   The [enrollment status page](enrollment-status.md) will be displayed.
+-   Depending on the device settings deployed, the device will either:
+    -   Remain at the logon screen, where any member of the organization can log on by specifying their Azure AD credentials.
+    -   Automatically sign in as a local account, for devices configured as a kiosk or digital signage.
+
+>[!NOTE]
+>Deploying EAS policies using self-deploying mode for kiosk deployments will cause auto-logon functionality to fail. 
+
+In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation.
diff --git a/windows/deployment/windows-autopilot/troubleshooting.md b/windows/deployment/windows-autopilot/troubleshooting.md
index 0d365a9cac..f58d814409 100644
--- a/windows/deployment/windows-autopilot/troubleshooting.md
+++ b/windows/deployment/windows-autopilot/troubleshooting.md
@@ -1,96 +1,122 @@
----
-title: Troubleshooting Windows Autopilot
-description: This topic goes over Windows Autopilot and how it helps setup OOBE Windows 10 devices.
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: medium
-ms.sitesec: library
-ms.pagetype: deploy
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Troubleshooting Windows Autopilot
-
-**Applies to: Windows 10**
-
-Windows Autopilot is designed to simplify all parts of the Windows device lifecycle, but there are always situations where issues may arise, either due to configuration or other issues.  To assist with troubleshooting efforts, review the following information.
-
-## Windows Autopilot deployment
-
-Regardless of whether performing user-driven or self-deploying device deployments, the troubleshooting process is the mostly the same.  It is useful to understand the flow for a specific device:
-
--   Network connection established.  This can be a wireless (Wi-fi) or wired (Ethernet) connection.
--   Windows Autopilot profile downloaded.  Whether using a wired connection or manually establishing a wireless connection, the Windows Autopilot profile will be downloaded from the Autopilot deployment service as soon as the network connection is in place.
--   User authentication.  When performing a user-driven deployment, the user will enter their Azure Active Directory credentials, which will be validated.
--   Azure Active Directory join.  For user-driven deployments, the device will be joined to Azure AD using the specified user credentials.  For self-deploying scenarios, the device will be joined without specifying any user credentials.
--   Automatic MDM enrollment.  As part of the Azure AD join process, the device will enroll in the MDM service configured in Azure AD (e.g. Microsoft Intune).
--   Settings are applied.  If the [enrollment status page](enrollment-status.md) is configured, most settings will be applied while the enrollment status page is displayed.  If not configured or available, settings will be applied after the user is signed in.
-
-For troubleshooting, key activities to perform are:
-
--   Configuration.  Has Azure Active Directory and Microsoft Intune (or an equivalent MDM service) been configured as specified in [Windows Autopilot configuration requirements](windows-autopilot-requirements-configuration.md)?
--   Network connectivity.  Can the device access the services described in [Windows Autopilot networking requirements](windows-autopilot-requirements-network.md)?
--   Autopilot OOBE behavior.  Were only the expected out-of-box experience screens displayed?  Was the Azure AD credentials page customized with organization-specific details as expected?
--   Azure AD join issues.  Was the device able to join Azure Active Directory?
--   MDM enrollment issues.  Was the device able to enroll in Microsoft Intune (or an equivalent MDM service)?
-
-### Troubleshooting Autopilot OOBE issues
-
-If the expected Autopilot behavior does not occur during the out-of-box experience (OOBE), it is useful to see whether the device received an Autopilot profile and what settings that profile contained.  Depending on the Windows 10 release, there are different mechanisms available to do that.
-
-#### Windows 10 version 1803 and above
-
-To see details related to the Autopilot profile settings and OOBE flow, Windows 10 version 1803 and above adds event log entries.  These can be viewed using Event Viewer, navigating to the log at **Application and Services Logs –> Microsoft –> Windows –> Provisioning-Diagnostics-Provider –> AutoPilot**.  The following events may be recorded, depending on the scenario and profile configuration.
-
-| Event ID | Type | Description |
-|----------|------|-------------| 
-| 100 | Warning | “AutoPilot policy [name] not found.”  This is typically a temporary problem, while the device is waiting for an Autopilot profile to be downloaded. |
-| 101 | Info | “AutoPilotGetPolicyDwordByName succeeded: policy name = [setting name]; policy value [value].”  This shows Autopilot retrieving and processing numeric OOBE settings. |
-| 103 | Info | “AutoPilotGetPolicyStringByName succeeded: policy name = [name]; value = [value].”  This shows Autopilot retrieving and processing OOBE setting strings such as the Azure AD tenant name. |
-| 109 | Info | “AutoPilotGetOobeSettingsOverride succeeded:  OOBE setting [setting name]; state = [state].”  This shows Autopilot retrieving and processing state-related OOBE settings. |
-| 111 | Info | “AutoPilotRetrieveSettings succeeded.”  This means that the settings stored in the Autopilot profile that control the OOBE behavior have been retrieved successfully. |
-| 153 | Info | “AutoPilotManager reported the state changed from [original state] to [new state].”  Typically this should say “ProfileState_Unknown” to “ProfileState_Available” to show that a profile was available for the device and downloaded, so the device is ready to be deployed using Autopilot. |
-| 160 | Info | “AutoPilotRetrieveSettings beginning acquisition.”  This shows that Autopilot is getting ready to download the needed Autopilot profile settings. |
-| 161 | Info | “AutoPilotManager retrieve settings succeeded.”  The Autopilot profile was successfully downloaded. |
-| 163 | Info | “AutoPilotManager determined download is not required and the device is already provisioned.  Clean or reset the device to change this.”  This message indicates that an Autopilot profile is resident on the device; it typically would only be removed by the **Sysprep /Generalize** process. |
-| 164 | Info | “AutoPilotManager determined Internet is available to attempt policy download.” |
-| 171 | Error | “AutoPilotManager failed to set TPM identity confirmed.  HRESULT=[error code].”  This indicates an issue performing TPM attestation, needed to complete the self-deploying mode process. | 
-| 172 | Error | “AutoPilotManager failed to set AutoPilot profile as available.  HRESULT=[error code].”  This is typically related to event ID 171. |
-
-In addition to the event log entries, the registry and ETW trace options described below also work with Windows 10 version 1803 and above.
-
-#### Windows 10 version 1709 and above
-
-On Windows 10 version 1709 and above, information about the Autopilot profile settings are stored in the registry on the device after they are received from the Autopilot deployment service.  These can be found at **HKLM\SOFTWARE\Microsoft\Provisioning\Diagnostics\AutoPilot**.  Available registry entries include:
-
-| Value | Description |
-|-------|-------------|
-| AadTenantId | The GUID of the Azure AD tenant the user signed into.  This should match the tenant that the device was registered with; if it does not match the user will receive an error. |
-| CloudAssignedTenantDomain | The Azure AD tenant the device has been registered with, e.g. “contosomn.onmicrosoft.com.”  If the device is not registered with Autopilot, this value will be blank. |
-| CloudAssignedTenantId | The GUID of the Azure AD tenant the device has been registered with (the GUID corresponds to the tenant domain from the CloudAssignedTenantDomain registry value).  If the device isn’t registered with Autopilot, this value will be blank.|
-| IsAutoPilotDisabled | If set to 1, this indicates that the device is not registered with Autopilot.  This could also indicate that the Autopilot profile could not be downloaded due to network connectivity or firewall issues, or network timeouts. |
-| TenantMatched | This will be set to 1 if the tenant ID of the user matches the tenant ID that the device was registered with.  If this is 0, the user would be shown an error and forced to start over. |
-| CloudAssignedOobeConfig | This is a bitmap that shows which Autopilot settings were configured.  Values include: SkipCortanaOptIn = 1, OobeUserNotLocalAdmin = 2, SkipExpressSettings = 4, SkipOemRegistration = 8, SkipEula = 16 |
-
-#### Windows 10 version 1703 and above
-
-On Windows 10 version 1703 and above, ETW tracing can be used to capture detailed information from Autopilot and related components.  The resulting ETW trace files can then be viewed using the Windows Performance Analyzer or similar tools.  See [the advanced troubleshooting blog](https://blogs.technet.microsoft.com/mniehaus/2017/12/13/troubleshooting-windows-autopilot-level-300400/) for more information.
-
-### Troubleshooting Azure AD Join issues
-
-The most common issue joining a device to Azure AD is related to Azure AD permissions.  Ensure [the correct configuration is in place](windows-autopilot-requirements-configuration.md) to allow users to join devices to Azure AD.  Errors can also happen if the user has exceeded the number of devices that they are allowed to join, as configured in Azure AD.
-
-Error code 801C0003 will typically be reported on an error page titled "Something went wrong".  This error means that the Azure AD join failed.
-
-### Troubleshooting Intune enrollment issues
-
-See [this knowledge base article](https://support.microsoft.com/help/4089533/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for assistance with Intune enrollment issues.  Common issues include incorrect or missing licenses assigned to the user or too many devices enrolled for the user.
-
-Error code 80180018 will typically be reported on an error page titled "Something went wrong".  This error means that the MDM enrollment failed.
-
-If Autopilot Reset fails immediately with an error "Ran into trouble. Please sign in with an administrator account to see why and reset manually," see [Troubleshoot Autopilot Reset](https://docs.microsoft.com/education/windows/autopilot-reset#troubleshoot-autopilot-reset) for more help.
+---
+title: Troubleshooting Windows Autopilot
+description: Learn how to handle issues as they arise during the Windows Autopilot deployment process.
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.reviewer: mniehaus
+manager: laurawi
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itpro
+author: greg-lindsay
+ms.author: greglin
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+
+# Troubleshooting Windows Autopilot
+
+**Applies to: Windows 10**
+
+Windows Autopilot is designed to simplify all parts of the Windows device lifecycle, but there are always situations where issues may arise, either due to configuration or other issues.  To assist with troubleshooting efforts, review the following information.
+
+## Troubleshooting process
+
+Regardless of whether performing user-driven or self-deploying device deployments, the troubleshooting process is the mostly the same.  It is useful to understand the flow for a specific device:
+
+- Network connection established.  This can be a wireless (Wi-fi) or wired (Ethernet) connection.
+- Windows Autopilot profile downloaded.  Whether using a wired connection or manually establishing a wireless connection, the Windows Autopilot profile will be downloaded from the Autopilot deployment service as soon as the network connection is in place.
+- User authentication.  When performing a user-driven deployment, the user will enter their Azure Active Directory credentials, which will be validated.
+- Azure Active Directory join.  For user-driven deployments, the device will be joined to Azure AD using the specified user credentials.  For self-deploying scenarios, the device will be joined without specifying any user credentials.
+- Automatic MDM enrollment.  As part of the Azure AD join process, the device will enroll in the MDM service configured in Azure AD (e.g. Microsoft Intune).
+- Settings are applied.  If the [enrollment status page](enrollment-status.md) is configured, most settings will be applied while the enrollment status page is displayed.  If not configured or available, settings will be applied after the user is signed in.
+
+For troubleshooting, key activities to perform are:
+
+- Configuration.  Has Azure Active Directory and Microsoft Intune (or an equivalent MDM service) been configured as specified in [Windows Autopilot configuration requirements](windows-autopilot-requirements.md)?
+- Network connectivity.  Can the device access the services described in [Windows Autopilot networking requirements](windows-autopilot-requirements.md)?
+- Autopilot OOBE behavior.  Were only the expected out-of-box experience screens displayed?  Was the Azure AD credentials page customized with organization-specific details as expected?
+- Azure AD join issues.  Was the device able to join Azure Active Directory?
+- MDM enrollment issues.  Was the device able to enroll in Microsoft Intune (or an equivalent MDM service)?
+
+## Troubleshooting Autopilot OOBE issues
+
+If the expected Autopilot behavior does not occur during the out-of-box experience (OOBE), it is useful to see whether the device received an Autopilot profile and what settings that profile contained.  Depending on the Windows 10 release, there are different mechanisms available to do that.
+
+### Windows 10 version 1803 and above
+
+To see details related to the Autopilot profile settings and OOBE flow, Windows 10 version 1803 and above adds event log entries.  These can be viewed using Event Viewer, navigating to the log at **Application and Services Logs –> Microsoft –> Windows –> Provisioning-Diagnostics-Provider –> AutoPilot** for versions before 1903, or **Application and Services Logs –> Microsoft –> Windows –> ModernDeployment-Diagnostics-Provider –> AutoPilot** for 1903 and above.  The following events may be recorded, depending on the scenario and profile configuration.
+
+| Event ID | Type | Description |
+|----------|------|-------------| 
+| 100 | Warning | “AutoPilot policy [name] not found.”  This is typically a temporary problem, while the device is waiting for an Autopilot profile to be downloaded. |
+| 101 | Info | “AutoPilotGetPolicyDwordByName succeeded: policy name = [setting name]; policy value [value].”  This shows Autopilot retrieving and processing numeric OOBE settings. |
+| 103 | Info | “AutoPilotGetPolicyStringByName succeeded: policy name = [name]; value = [value].”  This shows Autopilot retrieving and processing OOBE setting strings such as the Azure AD tenant name. |
+| 109 | Info | “AutoPilotGetOobeSettingsOverride succeeded:  OOBE setting [setting name]; state = [state].”  This shows Autopilot retrieving and processing state-related OOBE settings. |
+| 111 | Info | “AutoPilotRetrieveSettings succeeded.”  This means that the settings stored in the Autopilot profile that control the OOBE behavior have been retrieved successfully. |
+| 153 | Info | “AutoPilotManager reported the state changed from [original state] to [new state].”  Typically this should say “ProfileState_Unknown” to “ProfileState_Available” to show that a profile was available for the device and downloaded, so the device is ready to be deployed using Autopilot. |
+| 160 | Info | “AutoPilotRetrieveSettings beginning acquisition.”  This shows that Autopilot is getting ready to download the needed Autopilot profile settings. |
+| 161 | Info | “AutoPilotManager retrieve settings succeeded.”  The Autopilot profile was successfully downloaded. |
+| 163 | Info | “AutoPilotManager determined download is not required and the device is already provisioned.  Clean or reset the device to change this.”  This message indicates that an Autopilot profile is resident on the device; it typically would only be removed by the **Sysprep /Generalize** process. |
+| 164 | Info | “AutoPilotManager determined Internet is available to attempt policy download.” |
+| 171 | Error | “AutoPilotManager failed to set TPM identity confirmed.  HRESULT=[error code].”  This indicates an issue performing TPM attestation, needed to complete the self-deploying mode process. | 
+| 172 | Error | “AutoPilotManager failed to set AutoPilot profile as available.  HRESULT=[error code].”  This is typically related to event ID 171. |
+
+In addition to the event log entries, the registry and ETW trace options described below also work with Windows 10 version 1803 and above.
+
+### Windows 10 version 1709 and above
+
+On Windows 10 version 1709 and above, information about the Autopilot profile settings are stored in the registry on the device after they are received from the Autopilot deployment service.  These can be found at **HKLM\SOFTWARE\Microsoft\Provisioning\Diagnostics\AutoPilot**.  Available registry entries include:
+
+| Value | Description |
+|-------|-------------|
+| AadTenantId | The GUID of the Azure AD tenant the user signed into.  This should match the tenant that the device was registered with; if it does not match the user will receive an error. |
+| CloudAssignedTenantDomain | The Azure AD tenant the device has been registered with, e.g. “contosomn.onmicrosoft.com.”  If the device is not registered with Autopilot, this value will be blank. |
+| CloudAssignedTenantId | The GUID of the Azure AD tenant the device has been registered with (the GUID corresponds to the tenant domain from the CloudAssignedTenantDomain registry value).  If the device isn’t registered with Autopilot, this value will be blank.|
+| IsAutoPilotDisabled | If set to 1, this indicates that the device is not registered with Autopilot.  This could also indicate that the Autopilot profile could not be downloaded due to network connectivity or firewall issues, or network timeouts. |
+| TenantMatched | This will be set to 1 if the tenant ID of the user matches the tenant ID that the device was registered with.  If this is 0, the user would be shown an error and forced to start over. |
+| CloudAssignedOobeConfig | This is a bitmap that shows which Autopilot settings were configured.  Values include: SkipCortanaOptIn = 1, OobeUserNotLocalAdmin = 2, SkipExpressSettings = 4, SkipOemRegistration = 8, SkipEula = 16 |
+
+### Windows 10 semi-annual channel supported versions
+
+On devices running a [supported version](https://docs.microsoft.com/windows/release-information/) of Windows 10 semi-annual channel, ETW tracing can be used to capture detailed information from Autopilot and related components.  The resulting ETW trace files can then be viewed using the Windows Performance Analyzer or similar tools.  See [the advanced troubleshooting blog](https://blogs.technet.microsoft.com/mniehaus/2017/12/13/troubleshooting-windows-autopilot-level-300400/) for more information.
+
+## Troubleshooting Azure AD Join issues
+
+The most common issue joining a device to Azure AD is related to Azure AD permissions.  Ensure [the correct configuration is in place](windows-autopilot-requirements.md) to allow users to join devices to Azure AD.  Errors can also happen if the user has exceeded the number of devices that they are allowed to join, as configured in Azure AD.
+
+Error code 801C0003 will typically be reported on an error page titled "Something went wrong".  This error means that the Azure AD join failed.
+
+## Troubleshooting Intune enrollment issues
+
+See [this knowledge base article](https://support.microsoft.com/help/4089533/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for assistance with Intune enrollment issues.  Common issues include incorrect or missing licenses assigned to the user or too many devices enrolled for the user.
+
+Error code 80180018 will typically be reported on an error page titled "Something went wrong".  This error means that the MDM enrollment failed.
+
+If Autopilot Reset fails immediately with an error "Ran into trouble. Please sign in with an administrator account to see why and reset manually," see [Troubleshoot Autopilot Reset](https://docs.microsoft.com/education/windows/autopilot-reset#troubleshoot-autopilot-reset) for more help.
+
+## Profile download
+
+When an Internet-connected Windows 10 device boots up, it will attempt to connect to the Autopilot service and download an Autopilot profile. Note: It is important that a profile exists at this stage so that a blank profile is not cached locally on the PC. To remove the currently cached local profile in Windows 10 version 1803 and earlier, it is necessary to re-generalize the OS using **sysprep /generalize /oobe**, reinstall the OS, or re-image the PC. In Windows 10 version 1809 and later, you can retrieve a new profile by rebooting the PC.
+
+When a profile is downloaded depends on the version of Windows 10 that is running on the PC. See the following table.
+
+| Windows 10 version | Profile download behavior |
+| --- | --- |
+| 1709 | The profile is downloaded after the OOBE network connection page. This page is not displayed when using a wired connection. In this case, the profile is downloaded just prior to the EULA screen. |
+| 1803 | The profile is downloaded as soon as possible.  If wired, it is downloaded at the start of OOBE. If wireless, it is downloaded after the network connection page. |
+| 1809 | The profile is downloaded as soon as possible (same as 1803), and again after each reboot. |
+
+If you need to reboot a computer during OOBE:
+- Press Shift-F10 to open a command prompt.
+- Enter **shutdown /r /t 0** to restart immediately, or **shutdown /s /t 0** to shutdown immediately.
+
+For more information, see [Windows Setup Command-Line Options](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-command-line-options).
+
+## Related topics
+
+[Windows Autopilot - known issues](known-issues.md)
                                  
+[Diagnose MDM failures in Windows 10](https://docs.microsoft.com/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10)
                                  
diff --git a/windows/deployment/windows-autopilot/user-driven-aad.md b/windows/deployment/windows-autopilot/user-driven-aad.md
deleted file mode 100644
index 2058c34488..0000000000
--- a/windows/deployment/windows-autopilot/user-driven-aad.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-title: User-driven mode for AAD
-description: Listing of Autopilot scenarios
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: low
-ms.sitesec: library
-ms.pagetype: deploy
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Windows Autopilot user-driven mode for Azure Active Directory join
-
-**Applies to: Windows 10**
-
-## Procedures
-
-In order to perform a user-driven deployment using Windows Autopilot, the following preparation steps need to be completed:
-
--   Ensure that the users who will be performing user-driven mode deployments are able to join devices to Azure Active Directory.  See [Configure device settings](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal#configure-device-settings) in the Azure Active Directory documentation for more information.
--   Create an Autopilot profile for user-driven mode with the desired settings.  In Microsoft Intune, this mode is explicitly chosen when creating the profile. With Microsoft Store for Business and Partner Center, user-driven mode is the default and does not need to be selected.
--   If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group.
-
-For each device that will be deployed using user-driven deployment, these additional steps are needed:
-
--   Ensure that the device has been added to Windows Autopilot.  This can be done automatically by an OEM or partner at the time the device is purchased, or it can be done through a manual harvesting process later.  See [Adding devices to Windows Autopilot](add-devices.md) for more information.
--   Ensure an Autopilot profile has been assigned to the device:
-    -   If using Intune and Azure Active Directory dynamic device groups, this can be done automatically.
-    -   If using Intune and Azure Active Directory static device groups, manually add the device to the device group.
-    -   If using other methods (e.g. Microsoft Store for Business or Partner Center), manually assign an Autopilot profile to the device.
-
-Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic.
\ No newline at end of file
diff --git a/windows/deployment/windows-autopilot/user-driven-hybrid.md b/windows/deployment/windows-autopilot/user-driven-hybrid.md
deleted file mode 100644
index c084916d3e..0000000000
--- a/windows/deployment/windows-autopilot/user-driven-hybrid.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-title: Hybrid AAD Join
-description: Listing of Autopilot scenarios
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: low
-ms.sitesec: library
-ms.pagetype: deploy
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-
-# Windows Autopilot user-driven mode for hybrid Azure Active Directory join
-
-**Applies to: Windows 10**
-
-Windows Autopilot requires that devices be Azure Active Directory joined. If you have an on-premises Active Directory environment and want to also join devices to your on-premises domain, you can accomplish this by configuring Autopilot devices to be [hybrid Azure Active Directory (AAD) joined](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan).  
-
-## Requirements
-
-To perform a user-driven hybrid AAD joined deployment using Windows Autopilot:
-
-- A Windows Autopilot profile for user-driven mode must be created and 
-    - **Hybrid Azure AD joined** must be specified as the selected option under **Join to Azure AD as** in the Autopilot profile.
-- If using Intune, a device group in Azure Active Directory must exist with the Windows Autopilot profile assigned to that group.
-- The device must be running Windows 10, version 1809 or later.
-- The device must be connected to the Internet and have access to an Active Directory domain controller.
-- The Intune Connector for Active Directory must be installed.
-    - Note: The Intune Connector will perform an on-prem AD join, therefore users do not need on-prem AD-join permission, assuming the Connector is [configured to perform this action](https://docs.microsoft.com/intune/windows-autopilot-hybrid#increase-the-computer-account-limit-in-the-organizational-unit) on the user's behalf. 
-- If using Proxy, WDAP Proxy settings option must be enabled and configured.
-
-**AAD device join**: The hybrid AAD join process uses the system context to perform device AAD join, therefore it is not affected by user based AAD join permission settings. In addition, all users are enabled to join devices to AAD by default.
-
-## Step by step instructions
-
-See [Deploy hybrid Azure AD joined devices using Intune and Windows Autopilot](https://docs.microsoft.com/intune/windows-autopilot-hybrid).
-
-Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic. 
diff --git a/windows/deployment/windows-autopilot/user-driven.md b/windows/deployment/windows-autopilot/user-driven.md
index eb34848a9d..45520df78e 100644
--- a/windows/deployment/windows-autopilot/user-driven.md
+++ b/windows/deployment/windows-autopilot/user-driven.md
@@ -1,54 +1,103 @@
----
-title: Windows Autopilot User-Driven Mode
-description: Canonical Autopilot scenario
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: medium
-ms.sitesec: library
-ms.pagetype: deploy
-author: greg-lindsay
-ms.date: 11/07/2018
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Windows Autopilot user-driven mode
-
-Windows Autopilot user-driven mode is designed to enable new Windows 10 devices to be transformed from their initial state, directly from the factory, into a ready-to-use state without requiring that IT personnel ever touch the device.  The process is designed to be simple so that anyone can complete it, enabling devices to be shipped or distributed to the end user directly with simple instructions:
-
--   Unbox the device, plug it in, and turn it on.
--   Choose a language, locale and keyboard.
--   Connect it to a wireless or wired network with internet access.
--   Specify your e-mail address and password for your organization account.
-
-After completing those simple steps, the remainder of the process is completely automated, with the device being joined to the organization, enrolled in Intune (or another MDM service), and fully configured as defined by the organization.  Any additional prompts during the Out-of-Box Experience (OOBE) can be supressed; see [Configuring Autopilot Profiles](profiles.md) for options that are available.
-
-Today, Windows Autopilot user-driven mode supports joining devices to Azure Active Directory.  Support for Hybrid Azure Active Directory Join (with devices joined to an on-premises Active Directory domain) will be available in a future Windows 10 release.  See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options.
-
-## Available user-driven modes
-
-The following options are available for user-driven deployment:
-
-- [Azure Active Directory join](user-driven-aad.md) is available if devices do not need to be joined to an on-prem Active Directory domain.
-- [Hybrid Azure Active Directory join](user-driven-hybrid.md) is available for devices that must be joined to both Azure Active Directory and your on-prem Active Directory domain.
-
-## Validation
-
-When performing a user-driven deployment using Windows Autopilot, the following end-user experience should be observed:
-
--   If multiple languages are preinstalled in Windows 10, the user must pick a language.
--   The user must pick a locale and a keyboard layout, and optionally a second keyboard layout.
--   If connected via Ethernet, no network prompt is expected.  If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network.
--   Once connected to a network, the Autopilot profile will be downloaded.
--   Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required).
--   The user will be prompted for Azure Active Directory credentials, with a customized user experience showing the Azure AD tenant name, logo, and sign-in text.
--   Once correct credentials have been entered, the device will join Azure Active Directory.
--   After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services).
--   If configured, the [enrollment status page](enrollment-status.md) will be displayed.
--   Once the device configuration tasks have completed, the user will be signed into Windows 10 using the credentials they previously provided.
--   Once signed in, the enrollment status page will again be displayed for user-targeted configuration tasks.
-
-In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation.
\ No newline at end of file
+---
+title: Windows Autopilot User-Driven Mode
+description: Windows Autopilot user-driven mode allows devices to be deployed to a ready-to-use state without requiring help from IT personnel.
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.reviewer: mniehaus
+manager: laurawi
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itpro
+author: greg-lindsay
+ms.author: greglin
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+
+# Windows Autopilot user-driven mode
+
+Windows Autopilot user-driven mode is designed to enable new Windows 10 devices to be transformed from their initial state, directly from the factory, into a ready-to-use state without requiring that IT personnel ever touch the device.  The process is designed to be simple so that anyone can complete it, enabling devices to be shipped or distributed to the end user directly with simple instructions:
+
+- Unbox the device, plug it in, and turn it on.
+- Choose a language, locale and keyboard.
+- Connect it to a wireless or wired network with internet access.
+- Specify your e-mail address and password for your organization account.
+
+After completing those simple steps, the remainder of the process is completely automated, with the device being joined to the organization, enrolled in Intune (or another MDM service), and fully configured as defined by the organization.  Any additional prompts during the Out-of-Box Experience (OOBE) can be suppressed; see [Configuring Autopilot Profiles](profiles.md) for options that are available.
+
+Today, Windows Autopilot user-driven mode supports Azure Active Directory and Hybrid Azure Active Directory joined devices.  See [What is a device identity](https://docs.microsoft.com/azure/active-directory/devices/overview) for more information about these two join options.
+
+## Available user-driven modes
+
+The following options are available for user-driven deployment:
+
+- [Azure Active Directory join](#user-driven-mode-for-azure-active-directory-join) is available if devices do not need to be joined to an on-prem Active Directory domain.
+- [Hybrid Azure Active Directory join](#user-driven-mode-for-hybrid-azure-active-directory-join) is available for devices that must be joined to both Azure Active Directory and your on-prem Active Directory domain.
+
+### User-driven mode for Azure Active Directory join
+
+In order to perform a user-driven deployment using Windows Autopilot, the following preparation steps need to be completed:
+
+- Ensure that the users who will be performing user-driven mode deployments are able to join devices to Azure Active Directory.  See [Configure device settings](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal#configure-device-settings) in the Azure Active Directory documentation for more information.
+- Create an Autopilot profile for user-driven mode with the desired settings.  In Microsoft Intune, this mode is explicitly chosen when creating the profile. With Microsoft Store for Business and Partner Center, user-driven mode is the default and does not need to be selected.
+- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group.
+
+For each device that will be deployed using user-driven deployment, these additional steps are needed:
+
+- Ensure that the device has been added to Windows Autopilot.  This can be done automatically by an OEM or partner at the time the device is purchased, or it can be done through a manual harvesting process later.  See [Adding devices to Windows Autopilot](add-devices.md) for more information.
+- Ensure an Autopilot profile has been assigned to the device:
+  - If using Intune and Azure Active Directory dynamic device groups, this can be done automatically.
+  - If using Intune and Azure Active Directory static device groups, manually add the device to the device group.
+  - If using other methods (e.g. Microsoft Store for Business or Partner Center), manually assign an Autopilot profile to the device.
+
+Also see the [Validation](#validation) section below.
+
+>[!NOTE]
+>If the device reboots during the device enrollment status page (ESP) in the user-driven Azure Active Directoy join scenario, the user will not automatically sign on because the user's credentials cannot be saved across reboots.  In this scenario, the user will need to sign in manually after the device ESP completes.
+
+### User-driven mode for hybrid Azure Active Directory join
+
+Windows Autopilot requires that devices be Azure Active Directory joined. If you have an on-premises Active Directory environment and want to also join devices to your on-premises domain, you can accomplish this by configuring Autopilot devices to be [hybrid Azure Active Directory (AAD) joined](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan).  
+
+#### Requirements
+
+To perform a user-driven hybrid AAD joined deployment using Windows Autopilot:
+
+- A Windows Autopilot profile for user-driven mode must be created and 
+  - **Hybrid Azure AD joined** must be specified as the selected option under **Join to Azure AD as** in the Autopilot profile.
+- If using Intune, a device group in Azure Active Directory must exist with the Windows Autopilot profile assigned to that group.
+- The device must be running Windows 10, version 1809 or later.
+- The device must be able to access an Active Directory domain controller, so it must be connected to the organization's network (where it can resolve the DNS records for the AD domain and the AD domain controller, and communicate with the domain controller to authenticate the user).
+- The device must be able to access the Internet, following the [documented Windows Autopilot network requirements](windows-autopilot-requirements.md).
+- The Intune Connector for Active Directory must be installed.
+  - Note: The Intune Connector will perform an on-prem AD join, therefore users do not need on-prem AD-join permission, assuming the Connector is [configured to perform this action](https://docs.microsoft.com/intune/windows-autopilot-hybrid#increase-the-computer-account-limit-in-the-organizational-unit) on the user's behalf. 
+- If using Proxy, WPAD Proxy settings option must be enabled and configured.
+
+**AAD device join**: The hybrid AAD join process uses the system context to perform device AAD join, therefore it is not affected by user based AAD join permission settings. In addition, all users are enabled to join devices to AAD by default.
+
+#### Step by step instructions
+
+See [Deploy hybrid Azure AD joined devices using Intune and Windows Autopilot](https://docs.microsoft.com/intune/windows-autopilot-hybrid).
+
+Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic. 
+
+## Validation
+
+When performing a user-driven deployment using Windows Autopilot, the following end-user experience should be observed:
+
+- If multiple languages are preinstalled in Windows 10, the user must pick a language.
+- The user must pick a locale and a keyboard layout, and optionally a second keyboard layout.
+- If connected via Ethernet, no network prompt is expected.  If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network.
+- Once connected to a network, the Autopilot profile will be downloaded.
+- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required).
+- The user will be prompted for Azure Active Directory credentials, with a customized user experience showing the Azure AD tenant name, logo, and sign-in text.
+- Once correct credentials have been entered, the device will join Azure Active Directory.
+- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services).
+- If configured, the [enrollment status page](enrollment-status.md) will be displayed.
+- Once the device configuration tasks have completed, the user will be signed into Windows 10 using the credentials they previously provided.
+- Once signed in, the enrollment status page will again be displayed for user-targeted configuration tasks.
+
+If your results do not match these expectations, see the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation.
diff --git a/windows/deployment/windows-autopilot/white-glove.md b/windows/deployment/windows-autopilot/white-glove.md
new file mode 100644
index 0000000000..9fd9e87869
--- /dev/null
+++ b/windows/deployment/windows-autopilot/white-glove.md
@@ -0,0 +1,119 @@
+---
+title: Windows Autopilot for white glove deployment
+description: Windows Autopilot for white glove deployment
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, pre-provisioning
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: low
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itproF
+author: greg-lindsay
+manager: laurawi
+ms.audience: itpro
+author: greg-lindsay
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+# Windows Autopilot for white glove deployment
+
+**Applies to: Windows 10, version 1903** 
+
+Windows Autopilot enables organizations to easily provision new devices - leveraging the preinstalled OEM image and drivers with a simple process that can be performed by the end user to help get their device business-ready.
+
+ ![OEM](images/wg01.png)
+
+Windows Autopilot can also provide a white glove service that enables partners or IT staff to pre-provision a Windows 10 PC so that it is fully configured and business-ready. From the end user’s perspective, the Windows Autopilot user-driven experience is unchanged, but getting their device to a fully provisioned state is faster.
+
+With **Windows Autopilot for white glove deployment**, the provisioning process is split. The time-consuming portions are performed by IT, partners, or OEMs. The end user simply completes a few necessary settings and polices and then they can begin using their device.
+
+ ![OEM](images/wg02.png)
+
+Enabled with Microsoft Intune in Windows 10, version 1903 and later, white glove deployment capabilities build on top of existing Windows Autopilot [user-driven scenarios](user-driven.md), supporting both the user-driven mode for Azure Active Directory Join, and user-driven mode for Hybrid Azure Active directory join scenarios.
+
+## Prerequisites
+
+In addition to [Windows Autopilot requirements](windows-autopilot-requirements.md), Windows Autopilot for white glove deployment adds the following:
+
+- Windows 10, version 1903 or later is required.
+- An Intune subscription.
+- Physical devices that support TPM 2.0 and device attestation; virtual machines are not supported.  The white glove provisioning process leverages Windows Autopilot self-deploying capabilities, hence the TPM 2.0 requirements.
+- Physical devices with Ethernet connectivity; Wi-fi connectivity is not supported due to the requirement to choose a language, locale, and keyboard to make that Wi-fi connection; doing that in a pre-provisioning process could prevent the user from choosing their own language, locale, and keyboard when they receive the device.
+
+>[!IMPORTANT]
+>Because the OEM or vendor performs the white glove process, this doesn’t require access to an end-user's on-prem domain infrastructure. This is unlike a typical hybrid Azure AD-joined scenario because rebooting the device is postponed. The device is resealed prior to the time when connectivity to a domain controller is expected, and the domain network is contacted when the device is unboxed on-prem by the end-user.
+
+## Preparation
+
+Devices slated for white glove provisioning are registered for Autopilot via the normal registration process. 
+
+To be ready to try out Windows Autopilot for white glove deployment, ensure that you can first successfully use existing Windows Autopilot user-driven scenarios:
+
+- User-driven Azure AD join.  Devices can be deployed using Windows Autopilot and joined to an Azure Active Directory tenant.
+- User-driven with Hybrid Azure AD join.  Devices can be deployed using Windows Autopilot and joined to an on-premises Active Directory domain, then registered with Azure Active Directory to enable the Hybrid Azure AD join features.
+
+If these scenarios cannot be completed, Windows Autopilot for white glove deployment will also not succeed since it builds on top of these scenarios.
+
+To enable white glove deployment, an additional Autopilot profile setting must be configured by the customer or IT Admin via their Intune account, prior to beginning the white glove process in the provisioning service facility:
+
+ ![allow white glove](images/allow-white-glove-oobe.png)
+
+The Windows Autopilot for white glove deployment pre-provisioning process will apply all device-targeted policies from Intune.  That includes certificates, security templates, settings, apps, and more – anything targeting the device.  Additionally, any apps (Win32 or LOB) that are configured to install in the device context and targeted to the user that has been pre-assigned to the Autopilot device will also be installed.  
+
+>[!NOTE]
+>Other user-targeted policies will not apply until the user signs into the device.  To verify these behaviors, be sure to create appropriate apps and policies targeted to devices and users.
+
+## Scenarios
+
+Windows Autopilot for white glove deployment supports two distinct scenarios:
+- User-driven deployments with Azure AD Join.  The device will be joined to an Azure AD tenant.
+- User-driven deployments with Hybrid Azure AD Join.  The device will be joined to an on-premises Active Directory domain, and separately registered with Azure AD.
+Each of these scenarios consists of two parts, a technician flow and a user flow.  At a high level, these parts are the same for Azure AD Join and Hybrid Azure AD join; differences are primarily seen by the end user in the authentication steps.
+
+### Technician flow
+
+After the customer or IT Admin has targeted all the apps and settings they want for their devices through Intune, the white glove technician can begin the white glove process.  The technician could be a member of the IT staff, a services partner, or an OEM – each organization can decide who should perform these activities. Regardless of the scenario, the process to be performed by the technician is the same:
+- Boot the device (running Windows 10 Pro, Enterprise, or Education SKUs, version 1903 or later).
+- From the first OOBE screen (which could be a language selection or locale selection screen), do not click **Next**.  Instead, press the Windows key five times to view an additional options dialog.  From that screen, choose the **Windows Autopilot provisioning** option and then click **Continue**.
+
+  ![choice](images/choice.png)
+
+- On the **Windows Autopilot Configuration** screen, information will be displayed about the device:
+    - The Autopilot profile assigned to the device.
+    - The organization name for the device.
+    - The user assigned to the device (if there is one).
+    - A QR code containing a unique identifier for the device, useful to look up the device in Intune to make any configuration changes needed (e.g. assigning a user, adding the device to any additional groups needed for app or policy targeting).
+    - **Note**: The QR codes can be scanned using a companion app, which will also configure the device to specify who it belongs to.  An [open-source sample of the companion app](https://github.com/Microsoft/WindowsAutopilotCompanion) that integrates with Intune via the Graph API has been published to GitHub by the Autopilot team.
+- Validate the information displayed.  If any changes are needed, make these and then click **Refresh** to re-download the updated Autopilot profile details.
+
+  ![landing](images/landing.png)
+
+- Click **Provision** to begin the provisioning process.
+
+If the pre-provisioning process completes successfully:
+- A green status screen will be displayed with information about the device, including the same details presented previously (e.g. Autopilot profile, organization name, assigned user, QR code), as well as the elapsed time for the pre-provisioning steps.
+ ![white-glove-result](images/white-glove-result.png)
+- Click **Reseal** to shut the device down.  At that point, the device can be shipped to the end user.
+
+>[!NOTE]
+>Technician Flow inherits behavior from [Self-Deploying Mode](self-deploying.md). Per the Self-Deploying Mode documentation, it leverages the Enrollment Status Page to hold the device in a provisioning state and prevent the user from proceeding to the desktop after enrollment but before software and configuration is done applying. As such, if Enrollment Status Page is disabled, the reseal button may appear before software and configuration is done applying letting you proceed to the user flow before technician flow provisioning is complete. The green screen validates that enrollment was successful, not that the technician flow is necessarily complete.
+
+If the pre-provisioning process fails:
+- A red status screen will be displayed with information about the device, including the same details presented previously (e.g. Autopilot profile, organization name, assigned user, QR code), as well as the elapsed time for the pre-provisioning steps.
+- Diagnostic logs can be gathered from the device, and then it can be reset to start the process over again.
+
+### User flow
+
+If the pre-provisioning process completed successfully and the device was resealed, it can be delivered to the end user to complete the normal Windows Autopilot user-driven process.  They will perform a standard set of steps:
+
+- Power on the device.
+- Select the appropriate language, locale, and keyboard layout.
+- Connect to a network (if using Wi-Fi).  If using Hybrid Azure AD Join, there must be connectivity to a domain controller; if using Azure AD Join, internet connectivity is required.
+- On the branded sign-on screen, enter the user’s Azure Active Directory credentials.
+- If using Hybrid Azure AD Join, the device will reboot; after the reboot, enter the user’s Active Directory credentials.
+- Additional policies and apps will be delivered to the device, as tracked by the Enrollment Status Page (ESP).  Once complete, the user will be able to access the desktop.
+
+## Related topics
+
+[White glove video](https://youtu.be/nE5XSOBV0rI)
diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements-configuration.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements-configuration.md
deleted file mode 100644
index 9610dbb4af..0000000000
--- a/windows/deployment/windows-autopilot/windows-autopilot-requirements-configuration.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-title: Windows Autopilot configuration requirements
-description: This topic goes over Windows Autopilot and how it helps setup OOBE Windows 10 devices.
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: medium
-ms.sitesec: library
-ms.pagetype: deploy
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Windows Autopilot configuration requirements
-
-**Applies to: Windows 10**
-
-Before Windows Autopilot can be used, some configuration tasks are required to support the common Autopilot scenarios.  
-
--   Configure Azure Active Directory automatic enrollment.  For Microsoft Intune, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment) for details.  If using a different MDM service, contact the vendor for the specific URLs or configuration needed for those services.
--   Configure Azure Active Directory custom branding.  In order to display an organization-specific logon page during the Autopilot process, Azure Active Directory needs to be configured with the images and text that should be displayed.  See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details.  Note that the "square logo" and "sign-in page text" are the key elements for Autopilot, as well as the Azure Active Directory tenant name (configured separately in the Azure AD tenant properties).
--   Enable [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation) if desired, in order to automatically step up from Windows 10 Pro to Windows 10 Enterprise.
-
-Specific scenarios will then have additional requirements.  Generally, there are two specific tasks:
-
--   Device registration.  Devices need to be added to Windows Autopilot to support most Windows Autopilot scenarios.  See [Adding devices to Windows Autopilot](add-devices.md) for more details.
--   Profile configuration.  Once devices have been added to Windows Autopilot, a profile of settings needs to be applied to each device.  See [Configure Autopilot profiles](profiles.md) for details.  Note that Microsoft Intune can automate this profile assignment; see [Create an AutoPilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an AutoPilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group) for more information.
-
-See [Windows Autopilot Scenarios](windows-autopilot-scenarios.md) for additional details.
-
-For a walkthrough for some of these and related steps, see this video:
-
                                  
- 
diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing.md
deleted file mode 100644
index aaae7ae596..0000000000
--- a/windows/deployment/windows-autopilot/windows-autopilot-requirements-licensing.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
-title: Windows Autopilot licensing requirements
-description: This topic goes over Windows Autopilot and how it helps setup OOBE Windows 10 devices.
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: high
-ms.sitesec: library
-ms.pagetype: deploy
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Windows Autopilot licensing requirements
-
-**Applies to: Windows 10**
-
-Windows Autopilot depends on specific capabilities available in Windows 10 and Azure Active Directory; it also requires an MDM service such as Microsoft Intune. These capabilities can be obtained through various editions and subscription programs:
-
--   To provide needed Azure Active Directory (automatic MDM enrollment and company branding features) and MDM functionality, one of the following is required:
-    -   [Microsoft 365 Business subscriptions](https://www.microsoft.com/en-us/microsoft-365/business)
-    -   [Microsoft 365 F1 subscriptions](https://www.microsoft.com/en-us/microsoft-365/enterprise/firstline)
-    -   [Microsoft 365 Academic A1, A3, or A5 subscriptions](https://www.microsoft.com/en-us/education/buy-license/microsoft365/default.aspx)
-    -   [Microsoft 365 Enterprise E3 or E5 subscriptions](https://www.microsoft.com/en-us/microsoft-365/enterprise), which include all Windows 10, Office 365, and EM+S features (Azure AD and Intune)
-    -   [Enterprise Mobility + Security E3 or E5 subscriptions](https://www.microsoft.com/en-us/cloud-platform/enterprise-mobility-security), which include all needed Azure AD and Intune features
-    -   [Intune for Education subscriptions](https://docs.microsoft.com/en-us/intune-education/what-is-intune-for-education), which include all needed Azure AD and Intune features
-    -   [Azure Active Directory Premium P1 or P2](https://azure.microsoft.com/en-us/services/active-directory/) and [Microsoft Intune subscriptions](https://www.microsoft.com/en-us/cloud-platform/microsoft-intune) (or an alternative MDM service)
-
-Additionally, the following are also recommended (but not required):
--   [Office 365 ProPlus](https://www.microsoft.com/en-us/p/office-365-proplus/CFQ7TTC0K8R0), which can be deployed easily via Intune (or other MDM services)
--   [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation), to automatically step up devices from Windows 10 Pro to Windows 10 Enterprise
diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements-network.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements-network.md
deleted file mode 100644
index f2b2c19fb8..0000000000
--- a/windows/deployment/windows-autopilot/windows-autopilot-requirements-network.md
+++ /dev/null
@@ -1,90 +0,0 @@
----
-title: Windows Autopilot networking requirements
-description: This topic goes over Windows Autopilot and how it helps setup OOBE Windows 10 devices.
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: high
-ms.sitesec: library
-ms.pagetype: deploy
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Windows Autopilot networking requirements
-
-**Applies to: Windows 10**
-
-Windows Autopilot depends on a variety of internet-based services; access to these services must be provided for Autopilot to function properly. In the simplest case, enabling proper functionality can be achieved by ensuring the following:
-
--   Ensure DNS name resolution for internet DNS names
-
--   Allow access to all hosts via port 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP)
-
-In environments that have more restrictive internet access, or for those that require authentication before internet access can be obtained, additional configuration may be required to whitelist access to the needed services. For additional details about each of these services and their specific requirements, review the following details:
-
--   **Windows Autopilot Deployment Service (and Windows Activation).**  After a network connection is in place, each Windows 10 device will contact the Windows Autopilot Deployment Service.  With Windows 10 builds 18204 and above, the following URLs are used:
-
-    -   https://ztd.dds.microsoft.com
-    -   https://cs.dds.microsoft.com
-    
-    For all supported Windows 10 releases, Windows Autopilot also uses Windows Activation services. See the following link for details:
-
-    -   
-
--   **Azure Active Directory.**  User credentials are validated by Azure Active Directory, then the device may also be joined to Azure Active Directory. See the following link for more information:
-
-    -   
-
--   **Intune.**  Once authenticated, Azure Active Directory will trigger the enrollment of the device into the Intune MDM service. See the following link for details:
-
-    -    (Network communication requirements section)
-
--   **Windows Update.**  During the OOBE process, as well as after the Windows 10 OS is fully configured, the Windows Update service is leveraged to retrieve needed updates.
-
-    -   
-
-    -   NOTE:  If Windows Update is inaccessible, the AutoPilot process will still continue.
-
--   **Delivery Optimization.**  When downloading Windows Updates, Microsoft Store apps and app updates, Office Updates and Intune Win32 Apps, the Delivery Optimization service is contacted to enable peer-to-peer sharing of content so that only a few devices need to download it from the internet.
-
-    -   
-
-    -   NOTE: If Delivery Optimization Service is inaccessible, the AutoPilot process will still continue with Delivery Optimization downloads from the cloud (without peer-to-peer).
-
--   **Network Time Protocol (NTP) Sync.**  When a Windows device starts up, it will talk to a network time server to ensure that the time on the device is accurate.
-
-    -   Ensure that UDP port 123 to time.windows.com is accessible.
-
--   **Domain Name Services (DNS).**  To resolve DNS names for all services, the device communicates with a DNS server, typically provided via DHCP.  This DNS server must be able to resolve internet names.
-
--   **Diagnostics data.**  To enable Windows Analytics and related diagnostics capabilities, see the following documentation:
-
-    -   
-
-    -   NOTE: If diagnostic data cannot be sent, the Autopilot process will still continue.
-
--   **Network Connection Status Indicator (NCSI).**  Windows must be able to tell that the device is able to access the internet.
-
-    -    (Network Connection Status Indicator section, [www.msftconnecttest.com](http://www.msftconnecttest.com) must be resolvable via DNS and accessible via HTTP)
-
--   **Windows Notification Services (WNS).**  This service is used to enable Windows to receive notifications from apps and services.
-
-    -    (Microsoft store section)
-
-    -   NOTE: If the WNS services are not available, the Autopilot process will still continue.
-
--   **Microsoft Store, Microsoft Store for Business.**  Apps in the Microsoft Store can be pushed to the device, triggered via Intune (MDM).  App updates and additional apps may also be needed when the user first logs in.
-
-    -    (also includes Azure AD and Windows Notification Services)
-
-    -   NOTE: If the Microsoft Store is not accessible, the AutoPilot process will still continue.
-
--   **Office 365.**  As part of the Intune device configuration, installation of Office 365 ProPlus may be required.
-
-    -    (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above)
-
--   **Certificate revocation lists (CRLs).**  Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services.  A full list of these is documented in the Office documentation at  and .
diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md
index fc304b4020..338d548271 100644
--- a/windows/deployment/windows-autopilot/windows-autopilot-requirements.md
+++ b/windows/deployment/windows-autopilot/windows-autopilot-requirements.md
@@ -1,43 +1,134 @@
----
-title: Windows Autopilot requirements
-description: This topic goes over Windows Autopilot and how it helps setup OOBE Windows 10 devices.
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: high
-ms.sitesec: library
-ms.pagetype: deploy
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Windows Autopilot requirements
-
-**Applies to: Windows 10**
-
-Windows Autopilot depends on specific capabilities available in Windows 10, Azure Active Directory, and MDM services such as Microsoft Intune.  In order to use Windows Autopilot and leverage these capabilities, some requirements must be met.
-
-- Windows 10 version 1703 (semi-annual channel) or higher is required. 
-- The following editions are supported:
-    -   Pro
-    -   Pro Education
-    -   Pro for Workstations
-    -   Enterprise
-    -   Education
-
-- Windows 10 Enterprise 2019 LTSC is also supported.
-
-See the following topics for details on licensing, network, and configuration requirements:
-- [Licensing requirements](windows-autopilot-requirements-licensing.md)
-- [Networking requirements](windows-autopilot-requirements-network.md)
-- [Configuration requirements](windows-autopilot-requirements-configuration.md)
-    - For details about specific configuration requirements to enable user-driven Hybrid Azure Active Directory join for Windows Autopilot, see [Intune Connector (preview) language requirements](intune-connector.md). This requirement is a temporary workaround, and will be removed in the next release of Intune Connector. 
-
-There are no additional hardware requirements to use Windows 10 Autopilot, beyond the [requirements to run Windows 10](https://www.microsoft.com/windows/windows-10-specifications).
-
-## Related topics
-
-[Configure Autopilot deployment](configure-autopilot.md)
+---
+title: Windows Autopilot requirements
+ms.reviewer: 
+manager: laurawi
+description: Inform yourself about software, networking, licensing, and configuration requirements for Windows Autopilot deployment.
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itpro
+author: greg-lindsay
+ms.author: greglin
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+
+# Windows Autopilot requirements
+
+**Applies to: Windows 10**
+
+Windows Autopilot depends on specific capabilities available in Windows 10, Azure Active Directory, and MDM services such as Microsoft Intune.  In order to use Windows Autopilot and leverage these capabilities, some requirements must be met.
+
+**Note**: For a list of OEMs that currently support Windows Autopilot, see the Participant device manufacturers section at [Windows Autopilot](https://aka.ms/windowsautopilot).
+
+## Software requirements
+
+- A [supported version](https://docs.microsoft.com/windows/release-information/) of Windows 10 semi-annual channel is required. Windows 10 Enterprise 2019 long-term servicing channel (LTSC) is also supported.
+- The following editions are supported:
+  - Windows 10 Pro
+  - Windows 10 Pro Education
+  - Windows 10 Pro for Workstations
+  - Windows 10 Enterprise
+  - Windows 10 Education
+  - Windows 10 Enterprise 2019 LTSC
+
+>[!NOTE]
+>Procedures for deploying Windows Autopilot might refer to specific products and versions. The inclusion of these products in this content doesn't imply an extension of support for a version that is beyond its support lifecycle. Windows Autopilot does not support products that are beyond their support lifecycle. For more information, see [Microsoft Lifecycle Policy](https://go.microsoft.com/fwlink/p/?LinkId=208270).
+
+## Networking requirements
+
+Windows Autopilot depends on a variety of internet-based services. Access to these services must be provided for Autopilot to function properly. In the simplest case, enabling proper functionality can be achieved by ensuring the following:
+
+- Ensure DNS name resolution for internet DNS names
+- Allow access to all hosts via port 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP)
+
+In environments that have more restrictive Internet access, or for those that require authentication before internet access can be obtained, additional configuration may be required to whitelist access to the required services. For additional details about each of these services and their specific requirements, review the following details:
+
+
                                  ServiceInformation
+
                                  Windows Autopilot Deployment ServiceAfter a network connection is in place, each Windows 10 device will contact the Windows Autopilot Deployment Service.  With Windows 10 version 1903 and above, the following URLs are used: https://ztd.dds.microsoft.com, https://cs.dds.microsoft.com. 
                                  
+
+
                                  Windows ActivationWindows Autopilot also requires Windows Activation services. See Windows activation or validation fails with error code 0x8004FE33 for details about the URLs that need to be accessible for the activation services.
                                  
+
+
                                  Azure Active DirectoryUser credentials are validated by Azure Active Directory, and the device can also be joined to Azure Active Directory. See Office 365 IP Address and URL Web service for more information.
+
                                  IntuneOnce authenticated, Azure Active Directory will trigger enrollment of the device into the Intune MDM service. See the following link for details about network communication requirements: Intune network configuration requirements and bandwidth.
+
                                  Windows UpdateDuring the OOBE process, as well as after the Windows 10 OS is fully configured, the Windows Update service is leveraged to retrieve needed updates. If there are problems connecting to Windows Update, see How to solve connection problems concerning Windows Update or Microsoft Update.
                                  
+
+If Windows Update is inaccessible, the AutoPilot process will still continue but critical updates will not be available.
+
+
                                  Delivery OptimizationWhen downloading Windows Updates, Microsoft Store apps and app updates, Office Updates and Intune Win32 Apps, the Delivery Optimization service is contacted to enable peer-to-peer sharing of content so that only a few devices need to download it from the internet.
                                  
+
+If the Delivery Optimization Service is inaccessible, the AutoPilot process will still continue with Delivery Optimization downloads from the cloud (without peer-to-peer).
+
+
                                  Network Time Protocol (NTP) SyncWhen a Windows device starts up, it will talk to a network time server to ensure that the time on the device is accurate. Ensure that UDP port 123 to time.windows.com is accessible.
+
                                  Domain Name Services (DNS)To resolve DNS names for all services, the device communicates with a DNS server, typically provided via DHCP.  This DNS server must be able to resolve internet names.
+
                                  Diagnostics dataStarting in Windows 10, 1903, diagnostic data collection will be enabled by default. To disable Windows Analytics and related diagnostics capabilities, see Manage enterprise diagnostic data level.
                                  
+
+If diagnostic data cannot be sent, the Autopilot process will still continue, but services that depend on diagnostic data, such as Windows Analytics, will not work.
+
                                  Network Connection Status Indicator (NCSI)Windows must be able to tell that the device is able to access the internet. For more information, see Network Connection Status Indicator (NCSI).
+
+www.msftconnecttest.com must be resolvable via DNS and accessible via HTTP.
+
                                  Windows Notification Services (WNS)This service is used to enable Windows to receive notifications from apps and services. See Microsoft Store for more information.
                                  
+
+If the WNS services are not available, the Autopilot process will still continue without notifications.
+
                                  Microsoft Store, Microsoft Store for BusinessApps in the Microsoft Store can be pushed to the device, triggered via Intune (MDM).  App updates and additional apps may also be needed when the user first logs in. For more information, see Prerequisites for Microsoft Store for Business and Education (also includes Azure AD and Windows Notification Services).
                                  
+
+If the Microsoft Store is not accessible, the AutoPilot process will still continue without Microsoft Store apps.
+
+
                                  Office 365As part of the Intune device configuration, installation of Office 365 ProPlus may be required. For more information, see Office 365 URLs and IP address ranges (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above).
+
                                  Certificate revocation lists (CRLs)Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services.  A full list of these is documented at Office 365 URLs and IP address ranges and Office 365 Certificate Chains.
+
                                  Hybrid AAD joinThe device can be hybrid AAD joined. The computer should be on corporate network for hybrid AAD join to work. See details at Windows Autopilot user-driven mode
+
                                  Autopilot Self-Deploying mode and Autopilot White GloveFirmware TPM devices, which are only provided by Intel, AMD, or Qualcomm, do not include all needed certificates at boot time and must be able to retrieve them from the manufacturer on first use. Devices with discrete TPM chips(including ones from any other manufacturer) come with these certificates preinstalled. Make sure that these URLs are accessible for each firmware TPM provider so that certificates can be successfully requested: 
+  
                                  Intel- https://ekop.intel.com/ekcertservice 
+  
                                  Qualcomm- https://ekcert.spserv.microsoft.com/EKCertificate/GetEKCertificate/v1
+  
                                  AMD- https://ftpm.amd.com/pki/aia
+  
                                  Infineon- https://pki.infineon.com
+
                                  
+
+## Licensing requirements
+
+Windows Autopilot depends on specific capabilities available in Windows 10 and Azure Active Directory. It also requires an MDM service such as Microsoft Intune. These capabilities can be obtained through various editions and subscription programs:
+
+To provide needed Azure Active Directory (automatic MDM enrollment and company branding features) and MDM functionality, one of the following is required:
+- [Microsoft 365 Business subscriptions](https://www.microsoft.com/microsoft-365/business)
+- [Microsoft 365 F1 subscriptions](https://www.microsoft.com/microsoft-365/enterprise/firstline)
+- [Microsoft 365 Academic A1, A3, or A5 subscriptions](https://www.microsoft.com/education/buy-license/microsoft365/default.aspx)
+- [Microsoft 365 Enterprise E3 or E5 subscriptions](https://www.microsoft.com/microsoft-365/enterprise), which include all Windows 10, Office 365, and EM+S features (Azure AD and Intune).
+- [Enterprise Mobility + Security E3 or E5 subscriptions](https://www.microsoft.com/cloud-platform/enterprise-mobility-security), which include all needed Azure AD and Intune features.
+- [Intune for Education subscriptions](https://docs.microsoft.com/intune-education/what-is-intune-for-education), which include all needed Azure AD and Intune features.
+- [Azure Active Directory Premium P1 or P2](https://azure.microsoft.com/services/active-directory/) and [Microsoft Intune subscriptions](https://www.microsoft.com/cloud-platform/microsoft-intune) (or an alternative MDM service).
+
+Additionally, the following are also recommended (but not required):
+- [Office 365 ProPlus](https://www.microsoft.com/p/office-365-proplus/CFQ7TTC0K8R0), which can be deployed easily via Intune (or other MDM services).
+- [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation), to automatically step up devices from Windows 10 Pro to Windows 10 Enterprise.
+
+## Configuration requirements
+
+Before Windows Autopilot can be used, some configuration tasks are required to support the common Autopilot scenarios.  
+
+- Configure Azure Active Directory automatic enrollment.  For Microsoft Intune, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment) for details.  If using a different MDM service, contact the vendor for the specific URLs or configuration needed for those services.
+- Configure Azure Active Directory custom branding.  In order to display an organization-specific logon page during the Autopilot process, Azure Active Directory needs to be configured with the images and text that should be displayed.  See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details.  Note that the "square logo" and "sign-in page text" are the key elements for Autopilot, as well as the Azure Active Directory tenant name (configured separately in the Azure AD tenant properties).
+- Enable [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation) if desired, in order to automatically step up from Windows 10 Pro to Windows 10 Enterprise.
+
+Specific scenarios will then have additional requirements.  Generally, there are two specific tasks:
+
+- Device registration.  Devices need to be added to Windows Autopilot to support most Windows Autopilot scenarios.  See [Adding devices to Windows Autopilot](add-devices.md) for more details.
+- Profile configuration.  Once devices have been added to Windows Autopilot, a profile of settings needs to be applied to each device.  See [Configure Autopilot profiles](profiles.md) for details.  Note that Microsoft Intune can automate this profile assignment; see [Create an AutoPilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an AutoPilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group) for more information.
+
+See [Windows Autopilot Scenarios](windows-autopilot-scenarios.md) for additional details.
+
+For a walkthrough for some of these and related steps, see this video:
+
+
                                  
+
+
+
+
+There are no additional hardware requirements to use Windows 10 Autopilot, beyond the [requirements to run Windows 10](https://www.microsoft.com/windows/windows-10-specifications).
+
+## Related topics
+
+[Configure Autopilot deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/)
diff --git a/windows/deployment/windows-autopilot/windows-autopilot-reset-local.md b/windows/deployment/windows-autopilot/windows-autopilot-reset-local.md
deleted file mode 100644
index ac25a597f7..0000000000
--- a/windows/deployment/windows-autopilot/windows-autopilot-reset-local.md
+++ /dev/null
@@ -1,66 +0,0 @@
----
-title: Reset devices using local Windows Autopilot Reset
-description: Gives an overview of Local Autopilot Reset and how to use it.
-keywords: Autopilot Reset, Windows 10
-ms.prod: w10
-ms.technology: Windows
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype:
-ms.localizationpriority: medium
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Reset devices with local Windows Autopilot Reset 
-
-**Applies to: Windows 10, version 1709 and above
-
-IT admins can perform a local Windows Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen any time and apply original settings and management enrollment (Azure Active Directory and device management) so the devices are ready to use. With a local Autopilot Reset, devices are returned to a fully configured or known IT-approved state.
-
-To enable local Autopilot Reset in Windows 10:
-
-1. [Enable the policy for the feature](#enable-autopilot-reset)
-2. [Trigger a reset for each device](#trigger-autopilot-reset)
-
-## Enable local Windows Autopilot Reset
-
-To enable a local Windows Autopilot Reset, the **DisableAutomaticReDeploymentCredentials** policy must be configured. This policy is documented in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialproviders), **CredentialProviders/DisableAutomaticReDeploymentCredentials**. By default, local Windows Autopilot is disabled. This ensures that a local Autopilot Reset is not triggered by accident.
-
-You can set the policy using one of these methods:
-
-- MDM provider
-
-    - When using Intune, you can create a new device configuration profile, specifying "Windows 10 or later" for the platform, "Device restrictions" for the profile type, and "General" for the settings category.  The **Automatic Redeployment** setting should be set to **Allow**.  Deploy this setting to all devices where a local reset should be permitted.
-    - If you're using an MDM provider other than Intune, check your MDM provider documentation on how to set this policy. 
-
-- Windows Configuration Designer
-
-    You can [use Windows Configuration Designer](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package) to set the **Runtime settings > Policies > CredentialProviders > DisableAutomaticReDeploymentCredentials** setting to 0 and then create a provisioning package.
-
-- Set up School PCs app
-
-    The latest release of the Set up School PCs app supports enabling local Windows Autopilot Reset.
-
-## Trigger local Windows Autopilot Reset
-
-Performing a local Windows Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it is done, the device is again ready for use. 
-
-**To trigger a local Autopilot Reset**
-
-1. From the Windows device lock screen, enter the keystroke: **CTRL + ![Windows key](images/windows_glyph.png) + R**. 
-
-    ![Enter CTRL+Windows key+R on the Windows lockscreen](images/autopilot-reset-lockscreen.png)
-
-    This will open up a custom login screen for the local Autopilot Reset. The screen serves two purposes:
-    1. Confirm/verify that the end user has the right to trigger Local Autopilot Reset
-    2. Notify the user in case a provisioning package, created using Windows Configuration Designer, will be used as part of the process.
-
-    ![Custom login screen for local Autopilot Reset](images/autopilot-reset-customlogin.png)
-
-2. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger the local Autopilot Reset.
-
-    Once the local Autopilot Reset is triggered, the reset process starts. Once provisioning is complete, the device is again ready for use.
diff --git a/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md b/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md
deleted file mode 100644
index 30fb733eb0..0000000000
--- a/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-title: Reset devices with remote Autopilot Reset (Preview)
-description: Gives an overview of remote Autopilot Reset and how to use it.
-keywords: Autopilot Reset, Windows 10
-ms.prod: w10
-ms.technology: Windows
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype:
-ms.localizationpriority: medium
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Reset devices with remote Windows Autopilot Reset (Preview)
-
-**Applies to: Windows 10, build 17672 or later**
-
-When performing a remote Windows Autopilot Reset, an MDM service such an Microsoft Intune can be used to initiate the reset process, avoiding the need for IT staff or other administrators to visit each machine to initiate the process.
-
-To enable a device for a remote Windows Autopilot Reset, the device must be MDM managed, joined to Azure AD, and configured to use the [enrollment status page](enrollment-status.md).
-
-## Triggering a remote Windows Autopilot Reset
-
-To trigger a remote Windows Autopilot Reset via Intune, follow these steps:
- 
--   Navigate to **Devices** tab in the Intune console. 
--   In the **All devices** view, select the targeted reset devices and then click **More** to view device actions. 
--   Select **Autopilot Reset** to kick-off the reset task. 
-
->[!NOTE]
->The Autopilot Reset option will not be enabled in Microsoft Intune for devices not running Windows 10 build 17672 or higher.
-
-Once the reset is complete, the device is again ready for use.
- 
\ No newline at end of file
diff --git a/windows/deployment/windows-autopilot/windows-autopilot-reset.md b/windows/deployment/windows-autopilot/windows-autopilot-reset.md
index 1a5c9e982d..e114e9f5ec 100644
--- a/windows/deployment/windows-autopilot/windows-autopilot-reset.md
+++ b/windows/deployment/windows-autopilot/windows-autopilot-reset.md
@@ -1,55 +1,138 @@
----
-title: Windows Autopilot Reset
-description: Gives an overview of Remote Autopilot Reset and how to use it.
-keywords: Autopilot Reset, Windows 10
-ms.prod: w10
-ms.technology: Windows
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype:
-ms.localizationpriority: medium
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Windows Autopilot Reset
-
-**Applies to: Windows 10** 
-
-Windows Autopilot Reset removes personal files, apps, and settings and reapplies a device’s original settings, maintaining its identity connection to Azure AD and its management connection to Intune so that the device is once again ready for use. Windows Autopilot Reset takes the device back to a business-ready state, allowing the next user to sign in and get productive quickly and simply. 
-
-The Windows Autopilot Reset process automatically retains information from the existing device:
- 
--   Set the region, language, and keyboard to the originally-configured values.
--   Wi-Fi connection details.
--   Provisioning packages previously applied to the device, as well as a provisioning package present on a USB drive when the reset process is initiated. 
--   Azure Active Directory device membership and MDM enrollment information.
-
-Windows Autopilot Reset will block the user from accessing the desktop until this information is restored, including re-applying any provisioning packages.  For devices enrolled in an MDM service, Windows Autopilot Reset will also block until an MDM sync is completed.  This requires configuring the device to use the [enrollment status page](enrollment-status.md).
-
->[!IMPORTANT] 
->To reestablish Wi-Fi connectivity after reset, make sure the **Connect automatically** box is checked for the device's wireless network connection. 
-
-## Scenarios
-
-Windows Autopilot Reset supports two scenarios:
-
--   [Local reset](windows-autopilot-reset-local.md), initiated by IT personnel or other administrators from the organization.
--   [Remote reset](windows-autopilot-reset-remote.md), initiated remotely by IT personnel via an MDM service such as Microsoft Intune.
-
-Additional requirements and configuration details apply with each scenario; see the detailed links above for more information.
-
-## Troubleshooting
-
-Windows Autopilot Reset requires that the [Windows Recovery Environment (WinRE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) is correctly configured and enabled on the device. If it is not configured and enabled, an error such as `Error code: ERROR_NOT_SUPPORTED (0x80070032)` will be reported.
-
-To make sure WinRE is enabled, use the [REAgentC.exe tool](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reagentc-command-line-options) to run the following command:
-
-```
-reagentc /enable
-```
-
-If Windows Autopilot Reset fails after enabling WinRE, or if you are unable to enable WinRE, please contact [Microsoft Support](https://support.microsoft.com) for assistance.
+---
+title: Windows Autopilot Reset
+description: Windows Autopilot Reset takes the device back to a business-ready state, allowing the next user to sign in and get productive quickly and easily. 
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.reviewer: mniehaus
+manager: laurawi
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itpro
+author: greg-lindsay
+ms.author: greglin
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+
+# Windows Autopilot Reset
+
+- Applies to: Windows 10, version 1709 and later (local reset)
+- Applies to: Windows 10, version 1809 and later (remote reset)
+
+Windows Autopilot Reset removes personal files, apps, and settings and reapplies a device’s original settings, maintaining its identity connection to Azure AD and its management connection to Intune so that the device is once again ready for use. Windows Autopilot Reset takes the device back to a business-ready state, allowing the next user to sign in and get productive quickly and simply. 
+
+The Windows Autopilot Reset process automatically retains information from the existing device:
+ 
+-   Set the region, language, and keyboard to the originally-configured values.
+-   Wi-Fi connection details.
+-   Provisioning packages previously applied to the device, as well as a provisioning package present on a USB drive when the reset process is initiated. 
+-   Azure Active Directory device membership and MDM enrollment information.
+
+Windows Autopilot Reset will block the user from accessing the desktop until this information is restored, including re-applying any provisioning packages.  For devices enrolled in an MDM service, Windows Autopilot Reset will also block until an MDM sync is completed.  
+When Autopilot reset is used on a device, the device's primary user will be removed. The next user who signs in after the reset will be set as the primary user.
+ 
+ 
+>[!NOTE]
+>The Autopilot Reset does not support Hybrid Azure AD joined devices.
+
+## Scenarios
+
+Windows Autopilot Reset supports two scenarios:
+
+-   [Local reset](#reset-devices-with-local-windows-autopilot-reset) initiated by IT personnel or other administrators from the organization.
+-   [Remote reset](#reset-devices-with-remote-windows-autopilot-reset) initiated remotely by IT personnel via an MDM service such as Microsoft Intune.
+
+Additional requirements and configuration details apply with each scenario; see the detailed links above for more information.
+
+## Reset devices with local Windows Autopilot Reset 
+
+**Applies to: Windows 10, version 1709 and above**
+
+The Intune Service Administrator role is required to perform this task.  For more information, see [Add users and grant administrative permission to Intune](https://docs.microsoft.com/intune/users-add).
+
+IT admins can perform a local Windows Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen any time and apply original settings and management enrollment (Azure Active Directory and device management) so the devices are ready to use. With a local Autopilot Reset, devices are returned to a fully configured or known IT-approved state.
+
+To enable local Autopilot Reset in Windows 10:
+
+1. [Enable the policy for the feature](#enable-local-windows-autopilot-reset)
+2. [Trigger a reset for each device](#trigger-local-windows-autopilot-reset)
+
+### Enable local Windows Autopilot Reset
+
+To enable a local Windows Autopilot Reset, the **DisableAutomaticReDeploymentCredentials** policy must be configured. This policy is documented in the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-credentialproviders), **CredentialProviders/DisableAutomaticReDeploymentCredentials**. By default, local Windows Autopilot is disabled. This ensures that a local Autopilot Reset is not triggered by accident.
+
+You can set the policy using one of these methods:
+
+- MDM provider
+
+    - When using Intune, you can create a new device configuration profile, specifying "Windows 10 or later" for the platform, "Device restrictions" for the profile type, and "General" for the settings category.  The **Automatic Redeployment** setting should be set to **Allow**.  Deploy this setting to all devices where a local reset should be permitted.
+    - If you're using an MDM provider other than Intune, check your MDM provider documentation on how to set this policy. 
+
+- Windows Configuration Designer
+
+    You can [use Windows Configuration Designer](https://docs.microsoft.com/windows/configuration/provisioning-packages/provisioning-create-package) to set the **Runtime settings > Policies > CredentialProviders > DisableAutomaticReDeploymentCredentials** setting to 0 and then create a provisioning package.
+
+- Set up School PCs app
+
+    The latest release of the Set up School PCs app supports enabling local Windows Autopilot Reset.
+
+### Trigger local Windows Autopilot Reset
+
+Performing a local Windows Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it is done, the device is again ready for use. 
+
+**To trigger a local Autopilot Reset**
+
+1. From the Windows device lock screen, enter the keystroke: **CTRL + ![Windows key](images/windows_glyph.png) + R**. 
+
+    ![Enter CTRL+Windows key+R on the Windows lock screen](images/autopilot-reset-lockscreen.png)
+
+    This will open up a custom login screen for the local Autopilot Reset. The screen serves two purposes:
+    1. Confirm/verify that the end user has the right to trigger Local Autopilot Reset
+    2. Notify the user in case a provisioning package, created using Windows Configuration Designer, will be used as part of the process.
+
+    ![Custom login screen for local Autopilot Reset](images/autopilot-reset-customlogin.png)
+
+2. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger the local Autopilot Reset.
+
+    Once the local Autopilot Reset is triggered, the reset process starts. Once provisioning is complete, the device is again ready for use.
+
+## Reset devices with remote Windows Autopilot Reset
+
+**Applies to: Windows 10, version 1809 or later**
+
+When performing a remote Windows Autopilot Reset, an MDM service such an Microsoft Intune can be used to initiate the reset process, avoiding the need for IT staff or other administrators to visit each machine to initiate the process.
+
+To enable a device for a remote Windows Autopilot Reset, the device must be MDM managed and joined to Azure AD. This feature is not supported on devices that were enrolled using [Autopilot self deploying mode](self-deploying.md).
+
+### Triggering a remote Windows Autopilot Reset
+
+To trigger a remote Windows Autopilot Reset via Intune, follow these steps:
+ 
+-   Navigate to **Devices** tab in the Intune console. 
+-   In the **All devices** view, select the targeted reset devices and then click **More** to view device actions. 
+-   Select **Autopilot Reset** to kick-off the reset task. 
+
+>[!NOTE]
+>The Autopilot Reset option will not be enabled in Microsoft Intune for devices not running Windows 10 build 17672 or higher.
+
+>[!IMPORTANT]
+>The feature for Autopilot Reset will stay grayed out, **unless** you reset the device using Autopilot (either using Fresh Reset or manually sysprep the device).
+
+Once the reset is complete, the device is again ready for use.
+ 
+
+
+## Troubleshooting
+
+Windows Autopilot Reset requires that the [Windows Recovery Environment (WinRE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) is correctly configured and enabled on the device. If it is not configured and enabled, an error such as `Error code: ERROR_NOT_SUPPORTED (0x80070032)` will be reported.
+
+To make sure WinRE is enabled, use the [REAgentC.exe tool](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reagentc-command-line-options) to run the following command:
+
+```
+reagentc /enable
+```
+
+If Windows Autopilot Reset fails after enabling WinRE, or if you are unable to enable WinRE, please contact [Microsoft Support](https://support.microsoft.com) for assistance.
diff --git a/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md b/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md
index d73e7bb81f..ab95bacbee 100644
--- a/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md
+++ b/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md
@@ -1,32 +1,70 @@
----
-title: Windows Autopilot scenarios
-description: Listing of Autopilot scenarios
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.localizationpriority: medium
-ms.sitesec: library
-ms.pagetype: deploy
-author: greg-lindsay
-ms.author: greg-lindsay
-ms.collection: M365-modern-desktop
-ms.topic: article
----
-
-
-# Windows Autopilot scenarios
-
-**Applies to: Windows 10**
-
-Windows Autopilot includes support for a growing list of scenarios, designed to support common organization needs which can vary based on the type of organization and their progress moving to Windows 10 and [transitioning to modern management](https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management).
-
-For details about these scenarios, see these additional topics:
-
-- [Windows Autopilot for existing devices](existing-devices.md), to deploy Windows 10 on an existing Windows 7 or 8.1 device.
-- [Windows Autopilot user-driven mode](user-driven.md), for devices that will be set up by a member of the organization and configured for that person.
-- [Windows Autopilot self-deploying mode](self-deploying.md), for devices that will be automatically configured for shared use, as a kiosk, or as a digital signage device.
-- [Windows Autopilot Reset](windows-autopilot-reset.md), to re-deploy a device in a business-ready state.
-
-## Related topics
-
-[Windows Autopilot Enrollment Status page](enrollment-status.md)
+---
+title: Windows Autopilot scenarios and capabilities
+description: Follow along with several typical  Windows Autopilot deployment scenarios, such as re-deploying a device in a business-ready state.
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.reviewer: mniehaus
+manager: laurawi
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itpro
+author: greg-lindsay
+ms.author: greglin
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+
+# Windows Autopilot scenarios and capabilities
+
+**Applies to: Windows 10**
+
+## Scenarios
+
+Windows Autopilot includes support for a growing list of scenarios, designed to support common organization needs which can vary based on the type of organization and their progress moving to Windows 10 and [transitioning to modern management](https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management).
+
+The following Windows Autopilot scenarios are described in this guide:
+
+| Scenario | More information |
+| --- | --- |
+| Deploy devices that will be set up by a member of the organization and configured for that person | [Windows Autopilot user-driven mode](user-driven.md) |
+| Deploy devices that will be automatically configured for shared use, as a kiosk, or as a digital signage device.| [Windows Autopilot self-deploying mode](self-deploying.md) |
+| Re-deploy a device in a business-ready state.| [Windows Autopilot Reset](windows-autopilot-reset.md) |
+| Pre-provision a device with up-to-date applications, policies and settings.| [White glove](white-glove.md) |
+| Deploy Windows 10 on an existing Windows 7 or 8.1 device | [Windows Autopilot for existing devices](existing-devices.md) |
+
+## Windows Autopilot capabilities
+
+### Windows Autopilot is self-updating during OOBE
+
+Starting with the Windows 10, version 1903, Autopilot functional and critical updates will begin downloading automatically during OOBE after a device gets connected to a network and the [critical driver and Windows zero-day patch (ZDP) updates](https://docs.microsoft.com/windows-hardware/customize/desktop/windows-updates-during-oobe) have completed. The user or IT admin cannot opt-out of these Autopilot updates; they are required for Windows Autopilot deployment to operate properly.  Windows will alert the user that the device is checking for, downloading and installing the updates.
+
+See [Windows Autopilot update](autopilot-update.md) for more information.
+
+### Cortana voiceover and speech recognition during OOBE
+
+In Windows 10, version 1903 and later Cortana voiceover and speech recognition during OOBE is DISABLED by default for all Windows 10 Pro, Education and Enterprise SKUs.
+
+If desired, you can enable Cortana voiceover and speech recognition during OOBE by creating the following registry key. This key does not exist by default.
+
+HKLM\Software\Microsoft\Windows\CurrentVersion\OOBE\EnableVoiceForAllEditions
+
+The key value is a DWORD with  **0** = disabled and **1** = enabled.
+
+| Value | Description |
+| --- | --- |
+| 0 | Cortana voiceover is disabled |
+| 1 | Cortana voiceover is enabled |
+| No value | Device will fall back to default behavior of the edition |
+
+To change this key value, use WCD tool to create as PPKG as documented [here](https://docs.microsoft.com/windows/configuration/wcd/wcd-oobe#nforce).
+
+### Bitlocker encryption
+
+With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. For more information, see [Setting the BitLocker encryption algorithm for Autopilot devices](bitlocker.md)
+
+## Related topics
+
+[Windows Autopilot: What's new](windows-autopilot-whats-new.md)
diff --git a/windows/deployment/windows-autopilot/windows-autopilot-whats-new.md b/windows/deployment/windows-autopilot/windows-autopilot-whats-new.md
new file mode 100644
index 0000000000..b10120467d
--- /dev/null
+++ b/windows/deployment/windows-autopilot/windows-autopilot-whats-new.md
@@ -0,0 +1,58 @@
+---
+title: Windows Autopilot what's new
+ms.reviewer: 
+manager: laurawi
+description: Read news and resources about the latest updates and past versions of Windows Autopilot.
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.localizationpriority: medium
+ms.sitesec: library
+ms.pagetype: deploy
+audience: itpro
+author: greg-lindsay
+ms.author: greglin
+ms.collection: M365-modern-desktop
+ms.topic: article
+---
+
+
+# Windows Autopilot: What's new
+
+**Applies to**
+
+-   Windows 10
+
+## Windows Autopilot update history
+
+The following [Windows Autopilot updates](autopilot-update.md) are available. **Note**: Updates are automatically downloaded and applied during the Windows Autopilot deployment process. 
+
+No updates are available yet. Check back here later for more information.
+
+## New in Windows 10, version 1903
+
+[Windows Autopilot for white glove deployment](white-glove.md) is new in Windows 10, version 1903. See the following video:
+
+
                                  
+
+> [!VIDEO https://www.youtube.com/embed/nE5XSOBV0rI]
+
+Also new in this version of Windows:
+- The Intune enrollment status page (ESP) now tracks Intune Management Extensions.
+- [Cortana voiceover and speech recognition during OOBE](windows-autopilot-scenarios.md#cortana-voiceover-and-speech-recognition-during-oobe) is disabled by default for all Windows 10 Pro Education, and Enterprise SKUs.
+- [Windows Autopilot is self-updating during OOBE](windows-autopilot-scenarios.md#windows-autopilot-is-self-updating-during-oobe). Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE.
+- Windows Autopilot will set the diagnostics data level to Full on Windows 10 version 1903 and later during OOBE. 
+
+## New in Windows 10, version 1809
+
+Windows Autopilot [self-deploying mode](self-deploying.md) enables a zero touch device provisioning experience. Simply power on the device, plug it into the Ethernet, and the device is fully configured by Windows Autopilot. This self-deploying capability removes the current need to have an end user interact by pressing the “Next” button during the deployment process. 
+
+You can utilize Windows Autopilot self-deploying mode to register the device to an AAD tenant, enroll in your organization’s MDM provider, and provision policies and applications, all with no user authentication or user interaction required. 
+
+>[!NOTE]
+>Window 10, version 1903 or later is required to use self-deploying mode due to issues with TPM device attestation in Windows 10, version 1809.
+
+## Related topics
+
+[What's new in Microsoft Intune](https://docs.microsoft.com/intune/whats-new)
                                  
+[What's new in Windows 10](https://docs.microsoft.com/windows/whats-new/)
diff --git a/windows/deployment/windows-autopilot/windows-autopilot.md b/windows/deployment/windows-autopilot/windows-autopilot.md
index bbbde28edc..a24ff772a4 100644
--- a/windows/deployment/windows-autopilot/windows-autopilot.md
+++ b/windows/deployment/windows-autopilot/windows-autopilot.md
@@ -1,14 +1,17 @@
 ---
 title: Overview of Windows Autopilot
-description: This topic goes over Windows Autopilot and how it helps setup OOBE Windows 10 devices.
-keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, msfb, intune
+description: Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. 
+keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
+ms.reviewer: mniehaus
+manager: laurawi
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.localizationpriority: medium
 ms.sitesec: library
 ms.pagetype: deploy
+audience: itpro
 author: greg-lindsay
-ms.author: greg-lindsay
+ms.author: greglin
 ms.collection: M365-modern-desktop
 ms.topic: article
 ---
@@ -20,16 +23,22 @@ ms.topic: article
 
 -   Windows 10
 
-Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, repurpose and recover devices.
                                  
-This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that's easy and simple.
+Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, repurpose and recover devices. This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that's easy and simple.
 
-Windows Autopilot is designed to simplify all parts of the lifecycle of Windows devices, for both IT and end users, from initial deployment through the eventual end of life. Leveraging cloud-based services, it can reduce the overall costs for deploying, managing, and retiring devices by reducing the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain, while ensuring ease of use for all types of end users.
+Windows Autopilot is designed to simplify all parts of the lifecycle of Windows devices, for both IT and end users, from initial deployment through the eventual end of life. Leveraging cloud-based services, it can reduce the overall costs for deploying, managing, and retiring devices by reducing the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain, while ensuring ease of use for all types of end users. See the following diagram:
 
-
+   ![Process overview](images/image1.png)
 
-When initially deploying new Windows devices, Windows Autopilot leverages the OEM-optimized version of Windows 10 that is preinstalled on the device, saving organizations the effort of having to maintain custom images as well as drivers for every model of device being used. Instead of re-imaging the device, that existing Windows 10 installation can be transformed into a “business-ready” state, applying settings and policies, installing apps, and even changing the edition of Windows 10 being used (e.g. from Windows 10 Pro to Windows 10 Enterprise, to support advanced features).
+When initially deploying new Windows devices, Windows Autopilot leverages the OEM-optimized version of Windows 10 that is preinstalled on the device, saving organizations the effort of having to maintain custom images and drivers for every model of device being used. Instead of re-imaging the device, your existing Windows 10 installation can be transformed into a “business-ready” state, applying settings and policies, installing apps, and even changing the edition of Windows 10 being used (e.g. from Windows 10 Pro to Windows 10 Enterprise) to support advanced features.
 
-Once deployed, Windows 10 devices can be managed by tools such as Microsoft Intune, Windows Update for Business, System Center Configuration Manager, and other similar tools. Windows Autopilot can help with device re-purposing scenarios, leveraging Windows Autopilot Reset to quickly prepare a device for a new user, as well as in break/fix scenarios to enable a device to quickly be brought back to a business-ready state.
+Once deployed, Windows 10 devices can be managed by tools such as Microsoft Intune, Windows Update for Business, Microsoft Endpoint Configuration Manager, and other similar tools. Windows Autopilot can also be used to re-purpose a device by leveraging Windows Autopilot Reset to quickly prepare a device for a new user, or in break/fix scenarios to enable a device to quickly be brought back to a business-ready state.
+
+Windows Autopilot enables you to:
+* Automatically join devices to Azure Active Directory (Azure AD) or Active Directory (via Hybrid Azure AD Join).  See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options.
+* Auto-enroll devices into MDM services, such as Microsoft Intune ([*Requires an Azure AD Premium subscription for configuration*](https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Windows-10-Azure-AD-and-Microsoft-Intune-Automatic-MDM/ba-p/244067)).
+* Restrict the Administrator account creation.
+* Create and auto-assign devices to configuration groups based on a device's profile.
+* Customize OOBE content specific to the organization.
 
 ## Windows Autopilot walkthrough
 
@@ -45,32 +54,13 @@ Traditionally, IT pros spend a lot of time building and customizing images that
 
 From the user's perspective, it only takes a few simple operations to make their device ready to use.
 
-From the IT pro's perspective, the only interaction required from the end user is to connect to a network and to verify their credentials. Everything past that is automated.
+From the IT pro's perspective, the only interaction required from the end user is to connect to a network and to verify their credentials. Everything beyond that is automated.
 
 ## Requirements
 
-Windows 10 version 1703 or higher is required to use Windows Autopilot. The following editions are supported:
-- Pro
-- Pro Education
-- Pro for Workstations
-- Enterprise
-- Education
-
-See [Windows Autopilot requirements](windows-autopilot-requirements.md) for detailed information on configuration, network, and licensing requirements.
-
-## Windows Autopilot Scenarios
-
-Windows Autopilot enables you to pre-register devices to your organization so that they will be fully configured with no additional intervention required by the user.
-
-Windows Autopilot enables you to:
-* Automatically join devices to Azure Active Directory (Azure AD) or Active Directory (via Hybrid Azure AD Join).  See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options.
-* Auto-enroll devices into MDM services, such as Microsoft Intune ([*Requires an Azure AD Premium subscription*](#prerequisites)).
-* Restrict the Administrator account creation.
-* Create and auto-assign devices to configuration groups based on a device's profile.
-* Customize OOBE content specific to the organization.
-
-See [Windows Autopilot scenarios](https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot-scenarios) for more information about scenarios for using Windows Autopilot.
+A [supported version](https://docs.microsoft.com/windows/release-information/) of Windows 10 semi-annual channel is required to use Windows Autopilot. Windows 10 Enterprise LTSC 2019 is also supported. See [Windows Autopilot requirements](windows-autopilot-requirements.md) for detailed information on software, configuration, network, and licensing requirements.
 
 ## Related topics
 
-[Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/en-us/intune/enrollment-autopilot)
+[Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot)
                                  
+[Windows Autopilot scenarios and capabilities](windows-autopilot-scenarios.md)
diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md
index 2682bbad0b..8c74c372fe 100644
--- a/windows/deployment/windows-deployment-scenarios-and-tools.md
+++ b/windows/deployment/windows-deployment-scenarios-and-tools.md
@@ -1,13 +1,17 @@
 ---
-title: Windows 10 deployment tools (Windows 10)
-description: To successfully deploy the Windows 10 operating system and applications for your organization, it is essential that you know about the available tools to help with the process.
+title: Windows 10 deployment scenarios and tools
+description: Learn about the tools you can use to deploy Windows 10 and related applications to your organization. Explore deployment scenarios.
 ms.assetid: 0d6cee1f-14c4-4b69-b29a-43b0b327b877
+ms.reviewer: 
+manager: laurawi
+ms.audience: itpro
+author: greg-lindsay
 keywords: deploy, volume activation, BitLocker, recovery, install, installation, VAMT, MDT, USMT, WDS
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.sitesec: library
-author: mtniehaus
-ms.date: 07/12/2017
+audience: itpro
+author: greg-lindsay
 ms.topic: article
 ---
 
@@ -59,7 +63,7 @@ USMT is a backup and restore tool that allows you to migrate user state, data, a
 **Note**  
 Occasionally, we find that customers are wary of USMT because they believe it requires significant configuration, but, as you will learn below, using USMT is not difficult. If you use MDT and Lite Touch to deploy your machines, the USMT feature is automatically configured and extended so that it is easy to use. With MDT, you do nothing at all and USMT just works.
 
- 
+ 
 
 USMT includes several command-line tools, the most important of which are ScanState and LoadState:
 
@@ -92,7 +96,7 @@ By default USMT migrates many settings, most of which are related to the user pr
     **Note**  
     The OpenDocument extensions (\*.odt, \*.odp, \*.ods, etc.) that Microsoft Office applications can use are not migrated by default.
 
-     
+     
 
 -   Operating system component settings
 
@@ -196,7 +200,7 @@ MDT has two main parts: the first is Lite Touch, which is a stand-alone deployme
 **Note**  
 Lite Touch and Zero Touch are marketing names for the two solutions that MDT supports, and the naming has nothing to do with automation. You can fully automate the stand-alone MDT solution (Lite Touch), and you can configure the solution integration with Configuration Manager to prompt for information.
 
- 
+ 
 
 ![figure 11](images/mdt-11-fig13.png)
 
@@ -338,9 +342,9 @@ For more information on UEFI, see the [UEFI firmware](https://go.microsoft.com/f
 
 [Windows ADK for Windows 10 scenarios for IT pros](windows-adk-scenarios-for-it-pros.md)
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/windows/device-security/docfx.json b/windows/device-security/docfx.json
index acfa4df08b..0dbfe2d2e9 100644
--- a/windows/device-security/docfx.json
+++ b/windows/device-security/docfx.json
@@ -20,7 +20,7 @@
         "files": [
           "**/*.png",
           "**/*.jpg",
-		  "**/*.gif"
+          "**/*.gif"
         ],
         "exclude": [
           "**/obj/**",
@@ -31,20 +31,20 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
-		"uhfHeaderId": "MSDocsHeader-WindowsIT", 
-		"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
-		"ms.technology": "windows",
-		"ms.topic": "article",
-		"ms.author": "justinha",
-		"ms.date": "04/05/2017",
-		"_op_documentIdPathDepotMapping": {
-			"./": {
-			  "depot_name": "MSDN.win-device-security"
-			}
-		}
-	},
+      "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
+      "ms.technology": "windows",
+      "ms.topic": "article",
+      "ms.date": "04/05/2017",
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "MSDN.win-device-security",
+          "folder_relative_path_in_docset": "./"
+        }
+      }
+    },
     "fileMetadata": {},
     "template": [],
-    "dest": "win-device-security"
+    "dest": "win-device-security",
+    "markdownEngineName": "markdig"
   }
-}
\ No newline at end of file
+}
diff --git a/windows/device-security/index.md b/windows/device-security/index.md
deleted file mode 100644
index be91262028..0000000000
--- a/windows/device-security/index.md
+++ /dev/null
@@ -1,3 +0,0 @@
----
-redirect_url: https://docs.microsoft.com/windows/security/threat-protection/
----
\ No newline at end of file
diff --git a/windows/docfx.json b/windows/docfx.json
index 0e7c823b17..afb77d1e77 100644
--- a/windows/docfx.json
+++ b/windows/docfx.json
@@ -9,17 +9,28 @@
       ],
     "resource": [
         {
-          "files": ["**/images/**"],
+          "files": ["**/images/**", "**/*.pdf"],
           "exclude": ["**/obj/**"]
         }
     ],
     "globalMetadata": {
         "ROBOTS": "INDEX, FOLLOW",
+        "audience": "ITPro",
         "breadcrumb_path": "/itpro/windows/breadcrumb/toc.json",
 		"_op_documentIdPathDepotMapping": {
 			"./": {
 			  "depot_name": "Win.windows"
-			}
+      },
+      "contributors_to_exclude": [ 
+        "rjagiewich", 
+        "traya1", 
+        "rmca14", 
+        "claydetels19", 
+        "Kellylorenebaker",
+        "jborsecnik",
+        "tiburd",
+        "garycentric"
+     ], 
 		}
     },
     "externalReference": [
diff --git a/windows/eulas/index.md b/windows/eulas/index.md
index 2eb00343d3..daa4838aac 100644
--- a/windows/eulas/index.md
+++ b/windows/eulas/index.md
@@ -1,12 +1,12 @@
----
-title: Windows 10 - Testing in live
-description: What are Windows, UWP, and Win32 apps
-ms.prod: w10
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: mobile
-ms.author: elizapo
-author: lizap
-ms.localizationpriority: medium
----
-# Testing non-editability
+---
+title: Windows 10 - Testing in live
+description: What are Windows, UWP, and Win32 apps
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: mobile
+ms.author: elizapo
+author: lizap
+ms.localizationpriority: medium
+---
+# Testing non-editability
diff --git a/windows/hub/TOC.md b/windows/hub/TOC.md
index 1883594880..1b9bb407c6 100644
--- a/windows/hub/TOC.md
+++ b/windows/hub/TOC.md
@@ -1,6 +1,6 @@
-# [Windows 10 and Windows 10 Mobile](index.md)
+# [Windows 10](index.md)
 ## [What's new](/windows/whats-new)
-## [Release information](release-information.md)
+## [Release information](/windows/release-information)
 ## [Deployment](/windows/deployment)
 ## [Configuration](/windows/configuration)
 ## [Client management](/windows/client-management)
@@ -8,4 +8,4 @@
 ## [Security](/windows/security)
 ## [Privacy](/windows/privacy)
 ## [Troubleshooting](/windows/client-management/windows-10-support-solutions)
-## [Other Windows client versions](https://docs.microsoft.com/previous-versions/windows)
\ No newline at end of file
+## [Previous Windows versions](https://docs.microsoft.com/previous-versions/windows)
diff --git a/windows/hub/breadcrumb/toc.yml b/windows/hub/breadcrumb/toc.yml
index 4539d3b751..a28aaa3b77 100644
--- a/windows/hub/breadcrumb/toc.yml
+++ b/windows/hub/breadcrumb/toc.yml
@@ -25,9 +25,9 @@
             - name: Mobile Device Management
               tocHref: /windows/client-management/mdm/
               topicHref: /windows/client-management/mdm/index
-        - name: Known issues
-          tocHref: /windows/known-issues/
-          topicHref: /windows/known-issues/index
+        - name: Release information
+          tocHref: /windows/release-information/
+          topicHref: /windows/release-information/index
         - name: Privacy
           tocHref: /windows/privacy/
           topicHref: /windows/privacy/index
diff --git a/windows/hub/docfx.json b/windows/hub/docfx.json
index a44aea3b51..07a8ea153b 100644
--- a/windows/hub/docfx.json
+++ b/windows/hub/docfx.json
@@ -4,7 +4,7 @@
       {
         "files": [
           "**/*.md",
-		  "**/*.yml"
+          "**/*.yml"
         ],
         "exclude": [
           "**/obj/**",
@@ -22,8 +22,8 @@
           "**/*.png",
           "**/*.jpg",
           "**/*.svg",
-		  "**/*.gif",
-		  "**/*.pdf"
+          "**/*.gif",
+          "**/*.pdf"
         ],
         "exclude": [
           "**/obj/**",
@@ -34,23 +34,24 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
-		"uhfHeaderId": "MSDocsHeader-WindowsIT", 
-		"breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
-		"ms.technology": "windows",
-		"ms.topic": "article",
-		"ms.author": "brianlic",
-		"feedback_system": "GitHub",
-		"feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
-		"feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
-		"_op_documentIdPathDepotMapping": {
-			"./": {
-			  "depot_name": "MSDN.windows-hub"
-			}
-		}
-	},
+      "audience": "ITPro",
+      "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
+      "ms.technology": "windows",
+      "ms.topic": "article",
+      "feedback_system": "GitHub",
+      "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
+      "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "MSDN.windows-hub",
+          "folder_relative_path_in_docset": "./"
+        }
+      },
+      "titleSuffix": "Windows 10 for IT Pros"
+    },
     "fileMetadata": {},
     "template": [],
     "dest": "windows-hub",
-    "markdownEngineName": "dfm"
+    "markdownEngineName": "markdig"
   }
-}
\ No newline at end of file
+}
diff --git a/windows/hub/index.md b/windows/hub/index.md
index dac41359d2..97ce2a79a5 100644
--- a/windows/hub/index.md
+++ b/windows/hub/index.md
@@ -1,58 +1,55 @@
 ---
-title: Windows 10 and Windows 10 Mobile (Windows 10)
-description: Find the latest how to and support content that IT pros need to evaluate, plan, deploy, secure and manage devices running Windows 10 or Windows 10 Mobile.
+title: Windows 10
+description: Find the latest how to and support content that IT pros need to evaluate, plan, deploy, secure and manage devices running Windows 10.
 ms.assetid: 345A4B4E-BC1B-4F5C-9E90-58E647D11C60
 ms.prod: w10
 ms.localizationpriority: high
-author: greg-lindsay
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: security
-ms.date: 10/02/2018
+ms.author: dansimp
+author: dansimp
+ms.reviewer: dansimp
+manager: dansimp
 ---
 
-# Windows 10 and Windows 10 Mobile
-
-Find the latest how to and support content that IT pros need to evaluate, plan, deploy, secure and manage devices running Windows 10 or Windows 10 Mobile.
+# Windows 10
 
+Find the latest how to and support content that IT pros need to evaluate, plan, deploy, secure and manage devices running Windows 10.
 
  
 
-
-> [!video https://www.youtube.com/embed/hAva4B-wsVA]
-
-
-## Check out [what's new in Windows 10, version 1809](/windows/whats-new/whats-new-windows-10-version-1809).
+## Check out [what's new in Windows 10, version 1909](/windows/whats-new/whats-new-windows-10-version-1909).
 
                                  
 
-     
-    
-    
-       
-    
                                  
   
                                  
     
-       
+       
         Read what's new in Windows 10
       
                                  What's New? 
                                  
                                       		
+     
       
         Configure Windows 10 in your enterprise
       
                                  Configuration 
                                  
                                       		
+    
       
         Windows 10 deployment
       
                                  Deployment 
                                  
   
                                  
   

                                  
+    
                                  
       
         Manage applications in your Windows 10 enterprise deployment
-      
                                  Application Management                                   
+      
                                  App Management 
     
                                  
+       
                                  
       
         Windows 10 client management
       
                                  Client Management                                   
     
                                  
+    
                                  
       
         Windows 10 security
       
                                  Security                                   
@@ -64,20 +61,8 @@ Find the latest how to and support content that IT pros need to evaluate, plan,
 
 ## Get to know Windows as a Service (WaaS)
 
-![Get to know Windows as a Service (WaaS)](images/w10-WaaS-poster.png)
-
 The Windows 10 operating system introduces a new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each part of the process, to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers.
 
 These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and leveling out the resources needed to deploy and maintain Windows over time.
   
-- [Read more about Windows as a Service](/windows/deployment/update/waas-overview)
-
-
-## Related topics
-[Windows 10 TechCenter](https://go.microsoft.com/fwlink/?LinkId=620009)
-
-
- 
-
-
- 
+- [Read more about Windows as a Service](/windows/deployment/update/waas-overview)
\ No newline at end of file
diff --git a/windows/hub/release-information.md b/windows/hub/release-information.md
deleted file mode 100644
index 2aa38be1de..0000000000
--- a/windows/hub/release-information.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-title: Windows 10 - release information
-description: Learn release information for Windows 10 releases
-keywords: ["Windows 10", "Windows 10 October 2018 Update"]
-ms.prod: w10
-layout: LandingPage  
-ms.topic: landing-page
-ms.mktglfcycl: deploy
-ms.sitesec: library
-author: lizap
-ms.author: elizapo
-ms.localizationpriority: high
----
-# Windows 10 release information
-
-Feature updates for Windows 10 are released twice a year, targeting March and September, via the Semi-Annual Channel (SAC) and will be serviced with monthly quality updates for 18 months from the date of the release. We recommend that you begin deployment of each SAC release immediately to devices selected for early adoption and ramp up to full deployment at your discretion. This will enable you to gain access to new features, experiences, and integrated security as soon as possible.
-
-Starting with Windows 10, version 1809, feature updates for Windows 10 Enterprise and Education editions with a targeted release month of September will be serviced for 30 months from their release date. For information about servicing timelines, see the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853).
-
->[!NOTE]
->If you are not using Windows Update for Business today, the "Semi-Annual Channel (Targeted)" servicing option has no impact on when your devices will be updated. It merely reflects a milestone for the semi-annual release, the period of time during which Microsoft recommends that your IT team make the release available to specific, "targeted" devices for the purpose of validating and generating data in order to get to a broad deployment decision. For more information, see [this blog post](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523).
-
-
-
                                  
-    
                                  
-    
-    
-
                                  
-
-
diff --git a/windows/hub/windows-10-landing.yml b/windows/hub/windows-10-landing.yml
deleted file mode 100644
index 9932c85367..0000000000
--- a/windows/hub/windows-10-landing.yml
+++ /dev/null
@@ -1,77 +0,0 @@
-### YamlMime:YamlDocument
-
-documentType: LandingData
-title: Windows 10
-metadata:
-  document_id: 
-  title: Windows 10
-  description: Find tools, step-by-step guides, and other resources to help you deploy and support Windows 10 in your organization. 
-  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
-  ms.localizationpriority: medium
-  author: lizap
-  ms.author: elizapo
-  manager: dougkim
-  ms.topic: article
-  ms.devlang: na
-
-sections:
-- items:
-  - type: markdown
-    text: "
-      Find tools, step-by-step guides, and other resources to help you deploy and support Windows 10 in your organization. 
-      "  
-- title: Explore
-- items:
-  - type: markdown
-    text: "
-      Get started with Windows 10. Evaluate free for 90 days, and set up virtual labs to test a proof of concept.
                                   
-      
-      

                                  **Download a free 90-day evaluation**
                                  Try the latest features. Test your apps, hardware, and deployment strategies.
                                  Start evaluation
                                  **Get started with virtual labs**
                                  Try setup, deployment, and management scenarios in a virtual environment, with no additional software or setup required.
                                  See Windows 10 labs
                                  **Conduct a proof of concept**
                                  Download a lab environment with MDT, Configuration Manager, Windows 10, and more.
                                  Get deployment kit
                                  
-      "
-- title: What's new
-- items:
-  - type: markdown
-    text: "
-      Learn about the latest releases and servicing options.
                                   
-      
-      
                                  What's new in Windows 10, version 1809
                                  What's new in Windows 10, version 1803
                                  What's new in Windows 10, version 1709
                                  Windows 10 release information
                                  Windows 10 update history
                                  Windows 10 roadmap
                                  
-      "
-- title: Frequently asked questions
-- items:
-  - type: markdown
-    text: "
-      Get answers to commom questions, or get help with a specific problem.
                                   
-      
-      
                                  Windows 10 FAQ for IT Pros
                                  Windows 10 forums
                                  Windows 10 TechCommunity
                                  Which edition is right for your organization?
                                  Infrastructure requirements
                                  What's Windows as a service?
                                  Windows 10 Mobile deployment and management guide
                                  
-      "
-- title: Plan
-- items:
-  - type: markdown
-    text: "
-      Prepare to deploy Windows 10 in your organization. Explore deployment methods, compatibility tools, and servicing options. 
                                   
-      
-      

                                  **Application compatibility**
                                  Get best practices and tools to help you address compatibility issues prior to deployment.
                                  Find apps that are ready for Windows 10.
                                  Identify and prioritize apps with Upgrade Readiness
                                  Test, validate, and implement with the Web Application Compatibility Lab Kit
                                  **Upgrade options**
                                  Learn about the options available for upgrading Windows 7, Windows 8, or Windows 8.1 PCs and devices to Windows 10.
                                  Manage Windows upgrades with Upgrade Readiness
                                  Windows 10 upgrade paths
                                  Windows 10 edition upgrades
                                  **Windows as a service**
                                  Windows as a service provides ongoing new capabilities and updates while maintaining a high level of hardware and software compatibility.
                                  Explore
                                  
-      "
-- title: Deploy
-- items:
-  - type: markdown
-    text: "
-      Download recommended tools and get step-by-step guidance for in-place upgrades, dynamic provisioning, or traditional deployments.
                                   
-      
-      

                                  **In-place upgrade**
                                  The simplest way to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 is to do an in-place upgrade.
                                  Upgrade to Windows 10 with Configuration Manager
                                  Upgrade to Windows 10 with MDT
                                  **Traditional deployment**
                                  Some organizations may still need to opt for an image-based deployment of Windows 10.
                                  Deploy Windows 10 with Configuration Manager
                                  Deploy Windows 10 with MDT

                                  **Dynamic provisioning**
                                  With Windows 10 you can create provisioning packages that let you quickly configure a device without having to install a new image.
                                  Provisioning packages for Windows 10
                                  Build and apply a provisioning package
                                  Customize Windows 10 start and the taskbar
                                  **Other deployment scenarios**
                                  Get guidance on how to deploy Windows 10 for students, faculty, and guest users - and how to deploy line-of-business apps.
                                  Windows deployment for education environments
                                  Set up a shared or guest PC with Windows 10
                                  Sideload apps in Windows 10
                                  
-      "
-- title: Management and security
-- items:
-  - type: markdown
-    text: "
-      Learn how to manage Windows 10 clients and apps, secure company data, and manage risk.
                                   
-      
-      

                                  **Manage Windows 10 updates**
                                  Get best practices and tools to help you manage clients and apps.
                                  Manage clients in Windows 10
                                  Manage apps and features in Windows 10
                                  **Security**
                                  Intelligent security, powered by the cloud. Out-of-the-box protection, advanced security features, and intelligent management to respond to advanced threats.
                                  Windows 10 enterprise security
                                  Threat protection
                                  Identity protection
                                  Information protection
                                  
-      "
-- title: Stay informed
-- items:
-  - type: markdown
-    text: "
-      
-      

                                  **Sign up for the Windows IT Pro Insider**
                                  Find out about new resources and get expert tips and tricks on deployment, management, security, and more.
                                  Learn more
                                  **Follow us on Twitter**
                                  Keep up with the latest desktop and device trends, Windows news, and events for IT pros.
                                  Visit Twitter
                                  **Join the Windows Insider Program for Business**
                                  Get early access to new builds and provide feedback on the latest features and functionalities.
                                  Get started
                                  
-      "
diff --git a/windows/hub/windows-10.yml b/windows/hub/windows-10.yml
index a981edf38a..1504e2cae3 100644
--- a/windows/hub/windows-10.yml
+++ b/windows/hub/windows-10.yml
@@ -33,15 +33,15 @@ sections:
   - type: markdown
     text: "
       Learn about the latest releases and servicing options.
                                   
-      
+      
                                  What's new in Windows 10, version 1809
                                  What's new in Windows 10, version 1803
                                  What's new in Windows 10, version 1709
                                  Windows 10 release information
                                  Windows 10 update history
                                  Windows 10 roadmap
                                  What's new in Windows 10, version 1809
                                  What's new in Windows 10, version 1803
                                  What's new in Windows 10, version 1709
                                  Windows 10 release information
                                  Windows 10 update history
                                  Windows 10 roadmap
                                  
       
                                  
       "
 - title: Frequently asked questions
 - items:
   - type: markdown
     text: "
-      Get answers to commom questions, or get help with a specific problem.
                                   
-      
+      Get answers to common questions, or get help with a specific problem.
                                   
+      
                                  Windows 10 FAQ for IT Pros
                                  Windows 10 forums
                                  Windows 10 TechCommunity
                                  Which edition is right for your organization?
                                  Infrastructure requirements
                                  What's Windows as a service?
                                  Windows 10 Mobile deployment and management guide
                                  Windows 10 FAQ for IT Pros
                                  Windows 10 forums
                                  Windows 10 TechCommunity
                                  Which edition is right for your organization?
                                  Infrastructure requirements
                                  What's Windows as a service?
                                  Windows 10 Mobile deployment and management guide
                                  
       
                                  
       "
 - title: Plan
@@ -57,7 +57,7 @@ sections:
   - type: markdown
     text: "
       Download recommended tools and get step-by-step guidance for in-place upgrades, dynamic provisioning, or traditional deployments.
                                   
-      
+      

                                  **In-place upgrade**
                                  The simplest way to upgrade PCs that are currently running WIndows 7, Windows 8, or Windows 8.1 is to do an in-place upgrade.
                                  Upgrade to Windows 10 with Configuration Manager
                                  Upgrade to Windows 10 with MDT
                                  **Traditional deployment**
                                  Some organizations may still need to opt for an image-based deployment of Windows 10.
                                  Deploy Windows 10 with Configuration Manager
                                  Deploy Windows 10 with MDT

                                  **Dynamic provisioning**
                                  With Windows 10 you can create provisioning packages that let you quickly configure a device without having to install a new image.
                                  Provisioning packages for Windows 10
                                  Build and apply a provisioning package
                                  Customize Windows 10 start and the taskbar                                  		Windows deployment for education environments
                                  Set up a shared or guest PC with Windows 10
                                  Sideload apps in Windows 10

                                  **In-place upgrade**
                                  The simplest way to upgrade PCs that are currently running WIndows 7, Windows 8, or Windows 8.1 is to do an in-place upgrade.
                                  Upgrade to Windows 10 with Configuration Manager
                                  Upgrade to Windows 10 with MDT
                                  **Traditional deployment**
                                  Some organizations may still need to opt for an image-based deployment of Windows 10.
                                  Deploy Windows 10 with Configuration Manager
                                  Deploy Windows 10 with MDT

                                  **Dynamic provisioning**
                                  With Windows 10 you can create provisioning packages that let you quickly configure a device without having to install a new image.
                                  Provisioning packages for Windows 10
                                  Build and apply a provisioning package
                                  Customize Windows 10 start and the taskbar                                  		Windows deployment for education environments
                                  Set up a shared or guest PC with Windows 10
                                  Sideload apps in Windows 10
                                  
       
                                  
       "
 - title: Management and security
@@ -65,7 +65,7 @@ sections:
   - type: markdown
     text: "
       Learn how to manage Windows 10 clients and apps, secure company data, and manage risk.
                                   
-      
+      

                                  **Manage Windows 10 updates**
                                  Get best practices and tools to help you manage clients and apps.
                                  Manage clients in Windows 10
                                  Manage apps and features in Windows 10
                                  **Security**
                                  Intelligent security, powered by the cloud. Out-of-the-box protection, advanced security features, and intelligent management to respond to advanced threats.
                                  Windows 10 enterprise security
                                  Threat protection
                                  Identity protection
                                  Information protection

                                  **Manage Windows 10 updates**
                                  Get best practices and tools to help you manage clients and apps.
                                  Manage clients in Windows 10
                                  Manage apps and features in Windows 10
                                  **Security**
                                  Intelligent security, powered by the cloud. Out-of-the-box protection, advanced security features, and intelligent management to respond to advanced threats.
                                  Windows 10 enterprise security
                                  Threat protection
                                  Identity protection
                                  Information protection
                                  
       
                                  
       "
 - title: Stay informed
diff --git a/windows/keep-secure/docfx.json b/windows/keep-secure/docfx.json
index c69d3e3f49..884e478dcb 100644
--- a/windows/keep-secure/docfx.json
+++ b/windows/keep-secure/docfx.json
@@ -30,14 +30,17 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
-		"_op_documentIdPathDepotMapping": {
-			"./": {
-			  "depot_name": "MSDN.keep-secure"
-			}
-		}
-	},
+      "feedback_system": "None",
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "MSDN.keep-secure",
+          "folder_relative_path_in_docset": "./"
+        }
+      }
+    },
     "fileMetadata": {},
     "template": [],
-    "dest": "keep-secure"
+    "dest": "keep-secure",
+    "markdownEngineName": "markdig"
   }
-}
\ No newline at end of file
+}
diff --git a/windows/known-issues/docfx.json b/windows/known-issues/docfx.json
index 102f32f826..ebcaf22f82 100644
--- a/windows/known-issues/docfx.json
+++ b/windows/known-issues/docfx.json
@@ -35,7 +35,6 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
-      "uhfHeaderId": "MSDocsHeader-WindowsIT",
       "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
       "feedback_system": "GitHub",
       "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
diff --git a/windows/manage/docfx.json b/windows/manage/docfx.json
index eee8740627..a65600c79b 100644
--- a/windows/manage/docfx.json
+++ b/windows/manage/docfx.json
@@ -30,14 +30,16 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
-		"_op_documentIdPathDepotMapping": {
-			"./": {
-			  "depot_name": "MSDN.windows-manage"
-			}
-		}
-	},
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "MSDN.windows-manage",
+          "folder_relative_path_in_docset": "./"
+        }
+      }
+    },
     "fileMetadata": {},
     "template": [],
-    "dest": "windows-manage"
+    "dest": "windows-manage",
+    "markdownEngineName": "markdig"
   }
-}
\ No newline at end of file
+}
diff --git a/windows/plan/docfx.json b/windows/plan/docfx.json
index 4a303a21bc..a05d2009a6 100644
--- a/windows/plan/docfx.json
+++ b/windows/plan/docfx.json
@@ -30,14 +30,16 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
-		"_op_documentIdPathDepotMapping": {
-			"./": {
-			  "depot_name": "MSDN.windows-plan"
-			}
-		}
-	},
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "MSDN.windows-plan",
+          "folder_relative_path_in_docset": "./"
+        }
+      }
+    },
     "fileMetadata": {},
     "template": [],
-    "dest": "windows-plan"
+    "dest": "windows-plan",
+    "markdownEngineName": "markdig"
   }
-}
\ No newline at end of file
+}
diff --git a/windows/privacy/Microsoft-DiagnosticDataViewer.md b/windows/privacy/Microsoft-DiagnosticDataViewer.md
index f0573631e9..98e412e213 100644
--- a/windows/privacy/Microsoft-DiagnosticDataViewer.md
+++ b/windows/privacy/Microsoft-DiagnosticDataViewer.md
@@ -8,20 +8,20 @@ ms.sitesec: library
 ms.pagetype: security
 ms.localizationpriority: high
 audience: ITPro
-author: danihalfin
-ms.author: daniha
+author: dansimp
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
 ms.date: 01/17/2018
+ms.reviewer: 
 ---
 
 # Diagnostic Data Viewer for PowerShell Overview
 
 **Applies to**
 
--   Windows 10, version 1809
--   Windows 10, version 1803
+-   Windows 10, version 1803 and newer
 -   Windows Server, version 1803
 -   Windows Server 2019
 
@@ -45,7 +45,7 @@ Using the Diagnostic Data Viewer for PowerShell requires administrative (elevate
 ### Install the Diagnostic Data Viewer for PowerShell
 
    >[!IMPORTANT]
-   >It is recommended to visit the documentation on [Getting Started](https://docs.microsoft.com/en-us/powershell/gallery/getting-started) with PowerShell Gallery. This page provides more specific details on installing a PowerShell module. 
+   >It is recommended to visit the documentation on [Getting Started](https://docs.microsoft.com/powershell/gallery/getting-started) with PowerShell Gallery. This page provides more specific details on installing a PowerShell module. 
 
 To install the newest version of the Diagnostic Data Viewer PowerShell module, run the following command within an elevated PowerShell session: 
 ```powershell
@@ -105,9 +105,9 @@ The Diagnostic Data Viewer for PowerShell provides you with the following featur
 
 - **View your diagnostic events.** Running `PS C:\> Get-DiagnosticData`, you can review your diagnostic events. These events reflect activities that occurred and were sent to Microsoft. 
 
-    Each event is displayed as a PowerShell Object. By default each event shows the event name, the time when it was seen by your Windows device, whether the event is [Basic](https://docs.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization), its [diagnostic event category](#view-diagnostic-event-categories), and a detailed JSON view of the information it contains, which shows the event exactly as it was when sent to Microsoft. Microsoft uses this info to continually improve the Windows operating system.
+    Each event is displayed as a PowerShell Object. By default each event shows the event name, the time when it was seen by your Windows device, whether the event is [Basic](https://docs.microsoft.com/windows/privacy/configure-windows-diagnostic-data-in-your-organization), its [diagnostic event category](#view-diagnostic-event-categories), and a detailed JSON view of the information it contains, which shows the event exactly as it was when sent to Microsoft. Microsoft uses this info to continually improve the Windows operating system.
 
-- **View Diagnostic event categories.** Each event shows the diagnostic event categories that it belongs to. These categories define how events are used by Microsoft. The categories are shown as numeric identifiers. For more information about these categories, see [Windows Diagnostic Data](https://docs.microsoft.com/en-us/windows/privacy/windows-diagnostic-data).  
+- **View diagnostic event categories.** Each event shows the diagnostic event categories that it belongs to. These categories define how events are used by Microsoft. The categories are shown as numeric identifiers. For more information about these categories, see [Windows Diagnostic Data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data).  
     
     To view the diagnostic category represented by each numeric identifier and what the category means, you can run the command:
 
@@ -185,4 +185,4 @@ When resetting the size of your data history to a lower value, be sure to turn o
 
 ## Related Links
 - [Module in PowerShell Gallery](https://www.powershellgallery.com/packages/Microsoft.DiagnosticDataViewer)
-- [Documentation for Diagnostic Data Viewer for PowerShell](https://docs.microsoft.com/en-us/powershell/module/microsoft.diagnosticdataviewer/?view=win10-ps)
\ No newline at end of file
+- [Documentation for Diagnostic Data Viewer for PowerShell](https://docs.microsoft.com/powershell/module/microsoft.diagnosticdataviewer/?view=win10-ps)
diff --git a/windows/privacy/TOC.md b/windows/privacy/TOC.md
index 35561d07af..de11fa6d06 100644
--- a/windows/privacy/TOC.md
+++ b/windows/privacy/TOC.md
@@ -1,26 +1,32 @@
-# [Privacy](index.yml)
-## [Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md)
-## [Windows and the GDPR: Information for IT Administrators and Decision Makers](gdpr-it-guidance.md)
-## [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md)
-## [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
-## Diagnostic Data Viewer
-### [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md)
-### [Diagnostic Data Viewer for PowerShell Overview](Microsoft-DiagnosticDataViewer.md)
-## Basic level Windows diagnostic data events and fields
-### [Windows 10, version 1809 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
-### [Windows 10, version 1803 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
-### [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
-### [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
-## Enhanced level Windows diagnostic data events and fields
-### [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
-## Full level categories
-### [Windows 10, version 1709 and newer diagnostic data for the Full level](windows-diagnostic-data.md)
-### [Windows 10, version 1703 diagnostic data for the Full level](windows-diagnostic-data-1703.md)
-## Manage Windows 10 connection endpoints
-### [Connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md)
-### [Connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md)
-### [Connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md)
-### [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md)
-### [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md)
-### [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md)
-## [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
+# [Privacy](index.yml)
+## [Beginning your General Data Protection Regulation (GDPR) journey for Windows 10](gdpr-win10-whitepaper.md)
+## [Windows and the GDPR: Information for IT Administrators and Decision Makers](gdpr-it-guidance.md)
+## [Windows 10 & Privacy Compliance: A Guide for IT and Compliance Professionals](Windows-10-and-privacy-compliance.md)
+## [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md)
+## [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
+## Diagnostic Data Viewer
+### [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md)
+### [Diagnostic Data Viewer for PowerShell Overview](Microsoft-DiagnosticDataViewer.md)
+## Basic level Windows diagnostic data events and fields
+### [Windows 10, version 1903 and Windows 10, version 1909 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
+### [Windows 10, version 1809 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
+### [Windows 10, version 1803 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
+### [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
+### [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
+## Enhanced level Windows diagnostic data events and fields
+### [Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy](enhanced-diagnostic-data-windows-analytics-events-and-fields.md)
+## Full level categories
+### [Windows 10, version 1709 and newer diagnostic data for the Full level](windows-diagnostic-data.md)
+### [Windows 10, version 1703 diagnostic data for the Full level](windows-diagnostic-data-1703.md)
+## Manage Windows 10 connection endpoints
+### [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
+### [Manage connections from Windows operating system components to Microsoft services using MDM](manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md)
+### [Connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md)
+### [Connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md)
+### [Connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md)
+### [Connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md)
+### [Connection endpoints for non-Enterprise editions of Windows 10, version 1903](windows-endpoints-1903-non-enterprise-editions.md)
+### [Connection endpoints for non-Enterprise editions of Windows 10, version 1809](windows-endpoints-1809-non-enterprise-editions.md)
+### [Connection endpoints for non-Enterprise editions of Windows 10, version 1803](windows-endpoints-1803-non-enterprise-editions.md)
+### [Connection endpoints for non-Enterprise editions of Windows 10, version 1709](windows-endpoints-1709-non-enterprise-editions.md)
+
diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md
index ab42290c6b..b679ecf92c 100644
--- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md
+++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md
@@ -7,13 +7,14 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: security
 localizationpriority: high
-audience: ITPro
 author: brianlic-msft
 ms.author: brianlic
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
-ms.date: 02/15/2019
+audience: ITPro
+ms.date: 01/04/2020
+ms.reviewer:
 ---
 
 
@@ -32,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
 
 You can learn more about Windows functional and diagnostic data through these articles:
 
-
+- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
 - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
 - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
 - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
@@ -58,6 +59,7 @@ The following fields are available:
 - **DataSourceMatchingInfoPostUpgrade_RS3**  The total DataSourceMatchingInfoPostUpgrade objects targeting the next release of Windows on this device.
 - **DatasourceSystemBios_RS3**  The total DatasourceSystemBios objects targeting the next release of Windows on this device.
 - **DecisionApplicationFile_RS3**  The total DecisionApplicationFile objects targeting the next release of Windows on this device.
+- **DecisionDevicePnp_RS2**  The count of DataSourceMatchingInfoBlock objects present on this machine targeting the next release of Windows
 - **DecisionDevicePnp_RS3**  The total DecisionDevicePnp objects targeting the next release of Windows on this device.
 - **DecisionDriverPackage_RS3**  The total DecisionDriverPackage objects targeting the next release of Windows on this device.
 - **DecisionMatchingInfoBlock_RS3**  The total DecisionMatchingInfoBlock objects targeting the next release of Windows on this device.
@@ -75,7 +77,6 @@ The following fields are available:
 - **SystemWim**  The total number of objects of this type present on this device.
 - **SystemWindowsActivationStatus**  The count of DecisionSystemBios objects present on this machine targeting the next release of Windows
 - **SystemWlan**  The total number of objects of this type present on this device.
-- **Wmdrm_RS3**  The total Wmdrm objects targeting the next release of Windows on this device.
 
 
 ### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
@@ -90,7 +91,7 @@ The following fields are available:
 - **HasCitData**  Indicates whether the file is present in CIT data.
 - **HasUpgradeExe**  Indicates whether the anti-virus app has an upgrade.exe file.
 - **IsAv**  Is the file an anti-virus reporting EXE?
-- **ResolveAttempted**  This will always be an empty string when sending telemetry.
+- **ResolveAttempted**  This will always be an empty string when sending diagnostic data.
 - **SdbEntries**  An array of fields that indicates the SDB entries that apply to this file.
 
 
@@ -188,7 +189,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
 
-This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
+This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date.
 
 The following fields are available:
 
@@ -219,7 +220,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
 
-This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
 
 The following fields are available:
 
@@ -250,7 +251,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
 
-This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date.
 
 The following fields are available:
 
@@ -281,7 +282,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
 
-This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
+This event sends compatibility database information about the BIOS to help keep Windows up to date.
 
 The following fields are available:
 
@@ -313,7 +314,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd
 
-This event sends compatibility decision data about a file to help keep Windows up-to-date.
+This event sends compatibility decision data about a file to help keep Windows up to date.
 
 The following fields are available:
 
@@ -340,7 +341,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
 
-This event indicates Indicates that the DecisionApplicationFile object is no longer present.
+This event indicates that the DecisionApplicationFile object is no longer present.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -362,7 +363,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
 
-This event sends compatibility decision data about a PNP device to help keep Windows up to date.
+This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date.
 
 The following fields are available:
 
@@ -676,7 +677,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
 
-This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
+This event indicates that a new set of InventoryApplicationFileAdd events will be sent.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -788,7 +789,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
 
 The following fields are available:
 
-- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **AppraiserVersion**  The version of the Appraiser binary (executable) generating the events.
 
 
 ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
@@ -854,7 +855,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
 
-This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
+This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date.
 
 The following fields are available:
 
@@ -925,7 +926,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
 
-This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date.
 
 The following fields are available:
 
@@ -958,7 +959,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
 
-This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date.
 
 The following fields are available:
 
@@ -1157,7 +1158,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemWlanAdd
 
-This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date.
+This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date.
 
 The following fields are available:
 
@@ -1194,32 +1195,32 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
 
-This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
+This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
 
 The following fields are available:
 
 - **AppraiserBranch**  The source branch in which the version of Appraiser that is running was built.
-- **AppraiserDataVersion**  The version of the data files being used by the Appraiser telemetry run.
+- **AppraiserDataVersion**  The version of the data files being used by the Appraiser diagnostic data run.
 - **AppraiserProcess**  The name of the process that launched Appraiser.
 - **AppraiserVersion**  The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
 - **AuxFinal**  Obsolete, always set to false.
 - **AuxInitial**  Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
 - **DeadlineDate**  A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
-- **EnterpriseRun**  Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
+- **EnterpriseRun**  Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
 - **FullSync**  Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
 - **InventoryFullSync**  Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent.
 - **PCFP**  An ID for the system calculated by hashing hardware identifiers.
 - **PerfBackoff**  Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
 - **PerfBackoffInsurance**  Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
 - **RunAppraiser**  Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
-- **RunDate**  The date that the telemetry run was stated, expressed as a filetime.
-- **RunGeneralTel**  Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic.
+- **RunDate**  The date that the diagnostic data run was stated, expressed as a filetime.
+- **RunGeneralTel**  Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic.
 - **RunOnline**  Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
-- **RunResult**  The hresult of the Appraiser telemetry run.
-- **SendingUtc**  Indicates if the Appraiser client is sending events during the current telemetry run.
+- **RunResult**  The hresult of the Appraiser diagnostic data run.
+- **SendingUtc**  Indicates whether the Appraiser client is sending events during the current diagnostic data run.
 - **StoreHandleIsNotNull**  Obsolete, always set to false
-- **TelementrySent**  Indicates if telemetry was successfully sent.
-- **ThrottlingUtc**  Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability.
+- **TelementrySent**  Indicates whether diagnostic data was successfully sent.
+- **ThrottlingUtc**  Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability.
 - **Time**  The client time of the event.
 - **VerboseMode**  Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
 - **WhyFullSyncWithoutTablePrefix**  Indicates the reason or reasons that a full sync was generated.
@@ -1320,9 +1321,9 @@ The following fields are available:
 - **IsEDPEnabled**  Represents if Enterprise data protected on the device.
 - **IsMDMEnrolled**  Whether the device has been MDM Enrolled or not.
 - **MPNId**  Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
-- **SCCMClientId**  This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise System Center Configuration Manager (SCCM) environment.
+- **SCCMClientId**  This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise Microsoft Endpoint Configuration Manager environment.
 - **ServerFeatures**  Represents the features installed on a Windows   Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
-- **SystemCenterID**  The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier.
+- **SystemCenterID**  The Microsoft Endpoint Configuration Manager ID is an anonymized one-way hash of the Active Directory Organization identifier.
 
 
 ### Census.Firmware
@@ -1442,6 +1443,7 @@ The following fields are available:
 - **LicenseStateReason**  Retrieves why (or how) a system is licensed or unlicensed.  The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store.
 - **OA3xOriginalProductKey**  Retrieves the License key stamped by the OEM to the machine.
 - **OSEdition**  Retrieves the version of the current OS.
+- **OSInstallDateTime**  Retrieves the date the OS was installed using ISO 8601 (Date part) == yyyy-mm-dd
 - **OSInstallType**  Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc
 - **OSOOBEDateTime**  Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC).
 - **OSSKU**  Retrieves the Friendly Name of OS Edition.
@@ -1464,7 +1466,7 @@ The following fields are available:
 
 ### Census.Processor
 
-This event sends data about the processor (architecture, speed, number of cores, manufacturer, and model number), to help keep Windows up to date.
+This event sends data about the processor to help keep Windows up to date.
 
 The following fields are available:
 
@@ -1536,6 +1538,7 @@ The following fields are available:
 - **InternalPrimaryDisplayResolutionVertical**  Retrieves the number of pixels in the vertical direction of the internal display.
 - **InternalPrimaryDisplaySizePhysicalH**  Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches .
 - **InternalPrimaryDisplaySizePhysicalY**  Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches
+- **InternalPrimaryDisplayType**  Represents the type of technology used in the monitor, such as Plasma, LED, LCOS, etc.
 - **NumberofExternalDisplays**  Retrieves the number of external displays connected to the machine
 - **NumberofInternalDisplays**  Retrieves the number of internal displays in a machine.
 - **VRAMDedicated**  Retrieves the video RAM in MB.
@@ -1718,7 +1721,7 @@ The following fields are available:
 - **mon**  Combined monitor and event sequence numbers in the format: monitor sequence : event sequence
 - **op**  Represents the ETW Op Code.
 - **raId**  Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW.
-- **sqmId**  The Windows SQM ID.
+- **sqmId**  The Windows SQM (Software Quality Metrics—a precursor of Windows 10 Diagnostic Data collection) device identifier.
 - **stId**  Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
 - **tickets**  An array of strings that refer back to a key in the X-Tickets http header that the client uploaded along with a batch of events.
 
@@ -1776,6 +1779,47 @@ This event provides information about the results of installing optional Windows
 
 
 
+### CbsServicingProvider.CbsQualityUpdateInstall
+
+This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date.
+
+
+
+### CbsServicingProvider.CbsSelectableUpdateChangeV2
+
+This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date.
+
+The following fields are available:
+
+- **applicableUpdateState**  Indicates the highest applicable state of the optional content.
+- **buildVersion**  The build version of the package being installed.
+- **clientId**  The name of the application requesting the optional content change.
+- **downloadSource**  Indicates if optional content was obtained from Windows Update or a locally accessible file.
+- **downloadtimeInSeconds**  Indicates if optional content was obtained from Windows Update or a locally accessible file.
+- **executionID**  A unique ID used to identify events associated with a single servicing operation and not reused for future operations.
+- **executionSequence**  A counter that tracks the number of servicing operations attempted on the device.
+- **firstMergedExecutionSequence**  The value of a pervious executionSequence counter that is being merged with the current operation, if applicable.
+- **firstMergedID**  A unique ID of a pervious servicing operation that is being merged with this operation, if applicable.
+- **hrDownloadResult**  The return code of the download operation.
+- **hrStatusUpdate**  The return code of the servicing operation.
+- **identityHash**  A pseudonymized (hashed) identifier for the Windows Package that is being installed or uninstalled.
+- **initiatedOffline**  Indicates whether the operation was performed against an offline Windows image file or a running instance of Windows.
+- **majorVersion**  The major version of the package being installed.
+- **minorVersion**  The minor version of the package being installed.
+- **packageArchitecture**  The architecture of the package being installed.
+- **packageLanguage**  The language of the package being installed.
+- **packageName**  The name of the package being installed.
+- **rebootRequired**  Indicates whether a reboot is required to complete the operation.
+- **revisionVersion**  The revision number of the package being installed.
+- **stackBuild**  The build number of the servicing stack binary performing the installation.
+- **stackMajorVersion**  The major version number of the servicing stack binary performing the installation.
+- **stackMinorVersion**  The minor version number of the servicing stack binary performing the installation.
+- **stackRevision**  The revision number of the servicing stack binary performing the installation.
+- **updateName**  The name of the optional Windows Operation System feature being enabled or disabled.
+- **updateStartState**  A value indicating the state of the optional content before the operation started.
+- **updateTargetState**  A value indicating the desired state of the optional content.
+
+
 ## Content Delivery Manager events
 
 ### Microsoft.Windows.ContentDeliveryManager.ProcessCreativeEvent
@@ -1822,61 +1866,6 @@ The following fields are available:
 
 ## Diagnostic data events
 
-### TelClientSynthetic.AbnormalShutdown_0
-
-This event sends data about boot IDs for which a normal clean shutdown was not observed, to help keep Windows up to date.
-
-The following fields are available:
-
-- **AbnormalShutdownBootId**  Retrieves the Boot ID for which the abnormal shutdown was observed.
-- **CrashDumpEnabled**  Indicates whether crash dumps are enabled.
-- **CumulativeCrashCount**  Cumulative count of operating system crashes since the BootId reset.
-- **CurrentBootId**  BootId at the time the abnormal shutdown event was being reported.
-- **FirmwareResetReasonEmbeddedController**  Firmware-supplied reason for the reset.
-- **FirmwareResetReasonEmbeddedControllerAdditional**  Additional data related to the reset reason provided by the firmware.
-- **FirmwareResetReasonPch**  Hardware-supplied reason for the reset.
-- **FirmwareResetReasonPchAdditional**  Additional data related to the reset reason provided by the hardware.
-- **FirmwareResetReasonSupplied**  Indicates whether the firmware supplied any reset reason.
-- **FirmwareType**  ID of the FirmwareType as enumerated in DimFirmwareType.
-- **HardwareWatchdogTimerGeneratedLastReset**  Indicates whether the hardware watchdog timer caused the last reset.
-- **HardwareWatchdogTimerPresent**  Indicates whether hardware watchdog timer was present or not.
-- **LastBugCheckBootId**  The Boot ID of the last captured crash.
-- **LastBugCheckCode**  Code that indicates the type of error.
-- **LastBugCheckContextFlags**  Additional crash dump settings.
-- **LastBugCheckOriginalDumpType**  The type of crash dump the system intended to save.
-- **LastBugCheckOtherSettings**  Other crash dump settings.
-- **LastBugCheckParameter1**  The first parameter with additional info on the type of the error.
-- **LastBugCheckProgress**  Progress towards writing out the last crash dump.
-- **LastSuccessfullyShutdownBootId**  The Boot ID of the last fully successful shutdown.
-- **PowerButtonCumulativePressCount**  Indicates the number of times the power button has been pressed ("pressed" not to be confused with "released").
-- **PowerButtonCumulativeReleaseCount**  Indicates the number of times the power button has been released ("released" not to be confused with "pressed").
-- **PowerButtonErrorCount**  Indicates the number of times there was an error attempting to record Power Button metrics (e.g.: due to a failure to lock/update the bootstat file).
-- **PowerButtonLastPressBootId**  The Boot ID of the last time the Power Button was detected to have been pressed ("pressed" not to be confused with "released").
-- **PowerButtonLastPressTime**  The date and time the Power Button was most recently pressed ("pressed" not to be confused with "released").
-- **PowerButtonLastReleaseBootId**  The Boot ID of the last time the Power Button was released ("released" not to be confused with "pressed").
-- **PowerButtonLastReleaseTime**  The date and time the Power Button was most recently released ("released" not to be confused with "pressed").
-- **PowerButtonPressCurrentCsPhase**  Represents the phase of Connected Standby exit when the power button was pressed.
-- **PowerButtonPressIsShutdownInProgress**  Indicates whether a system shutdown was in progress at the last time the Power Button was pressed.
-- **PowerButtonPressLastPowerWatchdogStage**  The last stage completed when the Power Button was most recently pressed.
-- **PowerButtonPressPowerWatchdogArmed**  Indicates whether or not the watchdog for the monitor was active at the time of the last power button press.
-- **TransitionInfoBootId**  The Boot ID of the captured transition information.
-- **TransitionInfoCSCount**  The total number of times the system transitioned from "Connected Standby" mode to "On" when the last marker was saved.
-- **TransitionInfoCSEntryReason**  Indicates the reason the device last entered "Connected Standby" mode ("entered" not to be confused with "exited").
-- **TransitionInfoCSExitReason**  Indicates the reason the device last exited "Connected Standby" mode ("exited" not to be confused with "entered").
-- **TransitionInfoCSInProgress**  Indicates whether the system was in or entering Connected Standby mode when the last marker was saved.
-- **TransitionInfoLastReferenceTimeChecksum**  The checksum of TransitionInfoLastReferenceTimestamp.
-- **TransitionInfoLastReferenceTimestamp**  The date and time that the marker was last saved.
-- **TransitionInfoPowerButtonTimestamp**  The most recent date and time when the Power Button was pressed (collected via a different mechanism than PowerButtonLastPressTime).
-- **TransitionInfoSleepInProgress**  Indicates whether the system was in or entering Sleep mode when the last marker was saved.
-- **TransitionInfoSleepTranstionsToOn**  The total number of times the system transitioned from Sleep mode to on, when the last marker was saved.
-- **TransitionInfoSystemRunning**  Indicates whether the system was running when the last marker was saved.
-- **TransitionInfoSystemShutdownInProgress**  Indicates whether a device shutdown was in progress when the power button was pressed.
-- **TransitionInfoUserShutdownInProgress**  Indicates whether a user shutdown was in progress when the power button was pressed.
-- **TransitionLatestCheckpointId**  Represents a unique identifier for a checkpoint during the device state transition.
-- **TransitionLatestCheckpointSeqNumber**  Represents the chronological sequence number of the checkpoint.
-- **TransitionLatestCheckpointType**  Represents the type of the checkpoint, which can be the start of a phase, end of a phase, or just informational.
-
-
 ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition
 
 This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect.
@@ -1917,7 +1906,7 @@ The following fields are available:
 
 ### TelClientSynthetic.ConnectivityHeartBeat_0
 
-This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
+This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network.
 
 The following fields are available:
 
@@ -2510,7 +2499,7 @@ The following fields are available:
 - **Enumerator**  Identifies the bus that enumerated the device.
 - **HWID**  A list of hardware IDs for the device. See [HWID](#hwid).
 - **Inf**  The name of the INF file (possibly renamed by the OS, such as oemXX.inf).
-- **InstallState**  The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx
+- **InstallState**  The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx
 - **InventoryVersion**  The version number of the inventory process generating the events.
 - **LowerClassFilters**  The identifiers of the Lower Class filters installed for the device.
 - **LowerFilters**  The identifiers of the Lower filters installed for the device.
@@ -2650,6 +2639,45 @@ The following fields are available:
 - **InventoryVersion**  The version of the inventory file generating the events.
 
 
+### Microsoft.Windows.Inventory.General.AppHealthStaticAdd
+
+This event sends details collected for a specific application on the source device.
+
+The following fields are available:
+
+- **AhaVersion**  The binary version of the App Health Analyzer tool.
+- **ApplicationErrors**  The count of application errors from the event log.
+- **Bitness**  The architecture type of the application (16 Bit or 32 bit or 64 bit).
+- **device_level**  Various JRE/JAVA versions installed on a particular device.
+- **ExtendedProperties**  Attribute used for aggregating all other attributes under this event type.
+- **Jar**  Flag to determine if an app has a Java JAR file dependency.
+- **Jre**  Flag to determine if an app has JRE framework dependency.
+- **Jre_version**  JRE versions an app has declared framework dependency for.
+- **Name**  Name of the application.
+- **NonDPIAware**  Flag to determine if an app is non-DPI aware
+- **NumBinaries**  Count of all binaries (.sys,.dll,.ini) from application install location.
+- **RequiresAdmin**  Flag to determine if an app requests admin privileges for execution.
+- **RequiresAdminv2**  Additional flag to determine if an app requests admin privileges for execution.
+- **RequiresUIAccess**  Flag to determine if an app is based on UI features for accessibility.
+- **VB6**  Flag to determine if an app is based on VB6 framework.
+- **VB6v2**  Additional flag to determine if an app is based on VB6 framework.
+- **Version**  Version of the application.
+- **VersionCheck**  Flag to determine if an app has a static dependency on OS version.
+- **VersionCheckv2**  Additional flag to determine if an app has a static dependency on OS version.
+
+
+### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync
+
+This event indicates the beginning of a series of AppHealthStaticAdd events.
+
+The following fields are available:
+
+- **AllowTelemetry**  Indicates the presence of the 'allowtelemetry' command line argument.
+- **CommandLineArgs**  Command line arguments passed when launching the App Health Analyzer executable.
+- **Enhanced**  Indicates the presence of the 'enhanced' command line argument.
+- **StartTime**  UTC date and time at which this event was sent.
+
+
 ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
 
 Invalid variant - Provides data on the installed Office Add-ins
@@ -2777,6 +2805,15 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
 The following fields are available:
 
 - **IndicatorValue**  The indicator value.
+- **Value**  Describes an operating system indicator that may be relevant for the device upgrade.
+
+
+### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync
+
+This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
 
 
 ### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove
@@ -2867,6 +2904,20 @@ The following fields are available:
 - **UptimeDeltaMS**  Duration in last state in milliseconds.
 
 
+## Migration events
+
+### Microsoft.Windows.MigrationCore.MigObjectCountKFSys
+
+This event returns data about the count of the migration objects across various phases during feature update.
+
+
+
+### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr
+
+This event returns data to track the count of the migration objects across various phases during feature update.
+
+
+
 ## OneDrive events
 
 ### Microsoft.OneDrive.Sync.Setup.APIOperation
@@ -3009,26 +3060,43 @@ The following fields are available:
 - **winInetError**  The HResult of the operation.
 
 
+## Privacy logging notification events
+
+### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted
+
+This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue.
+
+The following fields are available:
+
+- **cleanupTask**  Indicates whether the task that launched the dialog should be cleaned up.
+- **cleanupTaskResult**  The return code of the attempt to clean up the task used to show the dialog.
+- **deviceEvaluated**  Indicates whether the device was eligible for evaluation of a known issue.
+- **deviceImpacted**  Indicates whether the device was impacted by a known issue.
+- **modalAction**  The action the user took on the dialog that was presented to them.
+- **modalResult**  The return code of the attempt to show a dialog to the user explaining the issue.
+- **resetSettingsResult**  The return code of the action to correct the known issue.
+
+
 ## Remediation events
 
 ### Microsoft.Windows.Remediation.Applicable
 
-This event indicates a remedial plug-in is applicable if/when such a plug-in is detected. This is used to ensure Windows is up to date.
+deny
 
 The following fields are available:
 
 - **ActionName**  The name of the action to be taken by the plug-in.
-- **AppraiserBinariesValidResult**  Indicates whether plug-in was appraised as valid.
+- **AppraiserBinariesValidResult**  Indicates whether the plug-in was appraised as valid.
 - **AppraiserDetectCondition**  Indicates whether the plug-in passed the appraiser's check.
 - **AppraiserRegistryValidResult**  Indicates whether the registry entry checks out as valid.
 - **AppraiserTaskDisabled**  Indicates the appraiser task is disabled.
 - **AppraiserTaskValidFailed**  Indicates the Appraiser task did not function and requires intervention.
 - **CV**  Correlation vector
 - **DateTimeDifference**  The difference between local and reference clock times.
-- **DateTimeSyncEnabled**  Indicates whether the datetime sync plug-in is enabled.
+- **DateTimeSyncEnabled**  Indicates whether the Datetime Sync plug-in is enabled.
 - **DaysSinceLastSIH**  The number of days since the most recent SIH executed.
 - **DaysToNextSIH**  The number of days until the next scheduled SIH execution.
-- **DetectedCondition**  Indicates whether detect condition is true and the perform action will be run.
+- **DetectedCondition**  Indicates whether detected condition is true and the perform action will be run.
 - **EvalAndReportAppraiserBinariesFailed**  Indicates the EvalAndReportAppraiserBinaries event failed.
 - **EvalAndReportAppraiserRegEntries**  Indicates the EvalAndReportAppraiserRegEntriesFailed event failed.
 - **EvalAndReportAppraiserRegEntriesFailed**  Indicates the EvalAndReportAppraiserRegEntriesFailed event failed.
@@ -3042,12 +3110,12 @@ The following fields are available:
 - **PackageVersion**  The version of the current remediation package.
 - **PluginName**  Name of the plugin specified for each generic plugin event.
 - **Reload**  True if SIH reload is required.
-- **RemediationNoisyHammerAcLineStatus**  Event that indicates the AC Line Status of the machine.
+- **RemediationNoisyHammerAcLineStatus**  Indicates the AC Line Status of the device.
 - **RemediationNoisyHammerAutoStartCount**  The number of times hammer auto-started.
 - **RemediationNoisyHammerCalendarTaskEnabled**  Event that indicates Update Assistant Calendar Task is enabled.
 - **RemediationNoisyHammerCalendarTaskExists**  Event that indicates an Update Assistant Calendar Task exists.
 - **RemediationNoisyHammerCalendarTaskTriggerEnabledCount**  Event that indicates calendar triggers are enabled in the task.
-- **RemediationNoisyHammerDaysSinceLastTaskRunTime**  The number of days since the most recent hammer task ran.
+- **RemediationNoisyHammerDaysSinceLastTaskRunTime**  The number of days since the most recent Noisy Hammer task ran.
 - **RemediationNoisyHammerGetCurrentSize**  Size in MB of the $GetCurrent folder.
 - **RemediationNoisyHammerIsInstalled**  TRUE if the noisy hammer is installed.
 - **RemediationNoisyHammerLastTaskRunResult**  The result of the last hammer task run.
@@ -3061,7 +3129,7 @@ The following fields are available:
 - **RemediationNoisyHammerUserLoggedInAdmin**  TRUE if there is the user currently logged in is an Admin.
 - **RemediationShellDeviceManaged**  TRUE if the device is WSUS managed or Windows Updated disabled.
 - **RemediationShellDeviceNewOS**  TRUE if the device has a recently installed OS.
-- **RemediationShellDeviceSccm**  TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager).
+- **RemediationShellDeviceSccm**  TRUE if the device is managed by Microsoft Endpoint Configuration Manager.
 - **RemediationShellDeviceZeroExhaust**  TRUE if the device has opted out of Windows Updates completely.
 - **RemediationTargetMachine**  Indicates whether the device is a target of the specified fix.
 - **RemediationTaskHealthAutochkProxy**  True/False based on the health of the AutochkProxy task.
@@ -3097,7 +3165,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Remediation.Completed
 
-This event enables completion tracking of a process that remediates issues preventing security and quality updates.
+This event is sent when Windows Update sediment remediations have completed on the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates.
 
 The following fields are available:
 
@@ -3113,12 +3181,12 @@ The following fields are available:
 - **CV**  The Correlation Vector.
 - **DateTimeDifference**  The difference between the local and reference clocks.
 - **DaysSinceOsInstallation**  The number of days since the installation of the Operating System.
-- **DiskMbCleaned**  The amount of space cleaned on the hard disk, measured in Megabytes.
+- **DiskMbCleaned**  The amount of space cleaned on the hard disk, measured in megabytes.
 - **DiskMbFreeAfterCleanup**  The amount of free hard disk space after cleanup, measured in Megabytes.
 - **DiskMbFreeBeforeCleanup**  The amount of free hard disk space before cleanup, measured in Megabytes.
 - **ForcedAppraiserTaskTriggered**  TRUE if Appraiser task ran from the plug-in.
 - **GlobalEventCounter**  Client-side counter that indicates ordering of events sent by the active user.
-- **HandlerCleanupFreeDiskInMegabytes**  The amount of hard disk space cleaned by the storage sense handlers, measured in Megabytes.
+- **HandlerCleanupFreeDiskInMegabytes**  The amount of hard disk space cleaned by the storage sense handlers, measured in megabytes.
 - **HResult**  The result of the event execution.
 - **LatestState**  The final state of the plug-in component.
 - **PackageVersion**  The package version for the current Remediation.
@@ -3173,7 +3241,7 @@ The following fields are available:
 - **usoScanIsNetworkMetered**  TRUE if the device is currently connected to a metered network.
 - **usoScanIsNoAutoUpdateKeyPresent**  TRUE if no Auto Update registry key is set/present.
 - **usoScanIsUserLoggedOn**  TRUE if the user is logged on.
-- **usoScanPastThreshold**  TRUE if the most recent USO (Update Session Orchestrator) scan is past the threshold (late).
+- **usoScanPastThreshold**  TRUE if the most recent Update Session Orchestrator (USO) scan is past the threshold (late).
 - **usoScanType**  The type of USO (Update Session Orchestrator) scan: "Interactive" or "Background".
 - **WindowsHyberFilSysSizeInMegabytes**  The size of the Windows Hibernation file, measured in Megabytes.
 - **WindowsInstallerFolderSizeInMegabytes**  The size of the Windows Installer folder, measured in Megabytes.
@@ -3302,13 +3370,13 @@ The following fields are available:
 
 ### Microsoft.Windows.Remediation.Started
 
-This event reports whether a plug-in started, to help ensure Windows is up to date.
+deny
 
 The following fields are available:
 
 - **CV**  Correlation vector.
 - **GlobalEventCounter**  Client side counter which indicates ordering of events sent by this user.
-- **PackageVersion**  Current package version of Remediation.
+- **PackageVersion**  The version of the current remediation package.
 - **PluginName**  Name of the plugin specified for each generic plugin event.
 - **Result**  This is the HRESULT for detection or perform action phases of the plugin.
 
@@ -3717,7 +3785,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentLauncher.Applicable
 
-Indicates whether a given plugin is applicable.
+This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -3733,7 +3801,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentLauncher.Completed
 
-Indicates whether a given plugin has completed its work.
+This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -3779,7 +3847,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentLauncher.Started
 
-This event indicates that a given plug-in has started.
+This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -3817,7 +3885,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentService.Applicable
 
-This event indicates whether a given plug-in is applicable.
+This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -3833,7 +3901,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentService.Completed
 
-This event indicates whether a given plug-in has completed its work.
+This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -3886,7 +3954,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentService.Started
 
-This event indicates a specified plug-in has started. This information helps ensure Windows is up to date.
+This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -4042,7 +4110,7 @@ The following fields are available:
 
 ### SIHEngineTelemetry.EvalApplicability
 
-This event is sent when targeting logic is evaluated to determine if a device is eligible a given action.
+This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action.
 
 
 
@@ -4236,7 +4304,7 @@ The following fields are available:
 - **RelatedCV**  The Correlation Vector that was used before the most recent change to a new Correlation Vector.
 - **RepeatFailFlag**  Indicates whether this specific piece of content had previously failed to download.
 - **RevisionNumber**  The revision number of the specified piece of content.
-- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
 - **Setup360Phase**  Identifies the active phase of the upgrade download if the current download is for an Operating System upgrade.
 - **ShippingMobileOperator**  The mobile operator linked to the device when the device shipped.
 - **StatusCode**  Indicates the result of a Download event (success, cancellation, failure code HResult).
@@ -4423,7 +4491,7 @@ The following fields are available:
 
 - **EndpointUrl**  The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
 - **EventScenario**  The purpose of this event, such as scan started, scan succeeded, or scan failed.
-- **ExtendedStatusCode**  The secondary status code of the event.
+- **ExtendedStatusCode**  Secondary status code for certain scenarios where StatusCode was not specific enough.
 - **LeafCertId**  The integral ID from the FragmentSigning data for the certificate that failed.
 - **ListOfSHA256OfIntermediateCerData**  A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
 - **MetadataIntegrityMode**  The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
@@ -4460,7 +4528,7 @@ The following fields are available:
 - **DeviceIsMdmManaged**  This device is MDM managed.
 - **IsNetworkAvailable**  If the device network is not available.
 - **IsNetworkMetered**  If network is metered.
-- **IsSccmManaged**  This device is SCCM managed.
+- **IsSccmManaged**  This device is managed by Microsoft Endpoint Configuration Manager.
 - **NewlyInstalledOs**  OS is newly installed quiet period.
 - **PausedByPolicy**  Updates are paused by policy.
 - **RecoveredFromRS3**  Previously recovered from RS3.
@@ -4835,7 +4903,13 @@ The following fields are available:
 
 ### FacilitatorTelemetry.DCATDownload
 
-This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure.
+This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure.
+
+
+
+### FacilitatorTelemetry.DUDownload
+
+This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows.
 
 
 
@@ -4847,7 +4921,7 @@ This event determines whether devices received additional or critical supplement
 
 ### Setup360Telemetry.Downlevel
 
-This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure.
+This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure.
 
 The following fields are available:
 
@@ -5065,7 +5139,7 @@ The following fields are available:
 - **ReportId**  With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
 - **Setup360Extended**  Detailed information about the phase/action when the potential failure occurred.
 - **Setup360Mode**  The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
-- **Setup360Result**  The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
+- **Setup360Result**  The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
 - **Setup360Scenario**  The Setup360 flow type. Example: Boot, Media, Update, MCT.
 - **SetupVersionBuildNumber**  The build number of Setup360 (build number of target OS).
 - **State**  The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
@@ -5127,12 +5201,12 @@ This event lists the reboot reason when an app is going to reboot.
 
 The following fields are available:
 
-- **BootId**  The boot ID.
+- **BootId**  The system boot ID.
 - **BoottimeSinceLastShutdown**  The boot time since the last shutdown.
 - **RebootReason**  Reason for the reboot.
 
 
-## Microsoft Store events
+## Windows Store events
 
 ### Microsoft.Windows.Store.Partner.ReportApplication
 
@@ -5163,6 +5237,7 @@ The following fields are available:
 - **CategoryId**  The Item Category ID.
 - **ClientAppId**  The identity of the app that initiated this operation.
 - **HResult**  The result code of the last action performed before this operation.
+- **IntentPFNs**  Intent Product Family Name
 - **IsBundle**  Is this a bundle?
 - **IsInteractive**  Was this requested by a user?
 - **IsMandatory**  Was this a mandatory update?
@@ -5173,6 +5248,7 @@ The following fields are available:
 - **PFN**  The product family name of the product being installed.
 - **ProductId**  The identity of the package or packages being installed.
 - **SystemAttemptNumber**  The total number of automatic attempts at installation before it was canceled.
+- **UpdateId**  Update ID (if this is an update)
 - **UserAttemptNumber**  The total number of user attempts at installation before it was canceled.
 - **WUContentId**  The Windows Update content ID.
 
@@ -5200,6 +5276,7 @@ The following fields are available:
 - **BundleId**  The identity of the Windows Insider build that is associated with this product.
 - **CategoryId**  The identity of the package or packages being installed.
 - **ClientAppId**  The identity of the app that initiated this operation.
+- **IntentPFNs**  Intent Product Family Name
 - **IsBundle**  Is this a bundle?
 - **IsInteractive**  Was this requested by a user?
 - **IsMandatory**  Is this a mandatory update?
@@ -5239,16 +5316,20 @@ The following fields are available:
 
 - **AggregatedPackageFullNames**  Includes a set of package full names for each app that is part of an atomic set.
 - **AttemptNumber**  The total number of attempts to acquire this product.
+- **BundleId**  The bundle ID
 - **CategoryId**  The identity of the package or packages being installed.
 - **ClientAppId**  The identity of the app that initiated this operation.
 - **HResult**  HResult code to show the result of the operation (success/failure).
+- **IntentPFNs**  Intent Product Family Name
 - **IsBundle**  Is this a bundle?
 - **IsInteractive**  Did the user initiate the installation?
 - **IsMandatory**  Is this a mandatory update?
 - **IsRemediation**  Is this repairing a previous installation?
 - **IsRestore**  Is this happening after a device restore?
 - **IsUpdate**  Is this an update?
+- **IsWin32**  Flag indicating if this is a Win32app.
 - **ParentBundledId**  The product's parent bundle ID.
+- **ParentBundleId**  The parent bundle ID (if it's part of a bundle).
 - **PFN**  Product Family Name of the product being installed.
 - **ProductId**  The Store Product ID for the product being installed.
 - **SystemAttemptNumber**  The number of attempts by the system to acquire this product.
@@ -5271,16 +5352,19 @@ The following fields are available:
 - **DownloadSize**  The total size of the download.
 - **ExtendedHResult**  Any extended HResult error codes.
 - **HResult**  The result code of the last action performed.
+- **IntentPFNs**  Intent Product Family Name
 - **IsBundle**  Is this a bundle?
 - **IsInteractive**  Is this initiated by the user?
 - **IsMandatory**  Is this a mandatory installation?
 - **IsRemediation**  Is this repairing a previous installation?
 - **IsRestore**  Is this a restore of a previously acquired product?
 - **IsUpdate**  Is this an update?
+- **IsWin32**  Flag indicating if this is a Win32 app (unused).
 - **ParentBundleId**  The parent bundle ID (if it's part of a bundle).
 - **PFN**  The Product Family Name of the app being download.
 - **ProductId**  The Store Product ID for the product being installed.
 - **SystemAttemptNumber**  The number of attempts by the system to download.
+- **UpdateId**  Update ID (if this is an update)
 - **UserAttemptNumber**  The number of attempts by the user to download.
 - **WUContentId**  The Windows Update content ID.
 
@@ -5316,16 +5400,19 @@ The following fields are available:
 - **ClientAppId**  The identity of the app that initiated this operation.
 - **ExtendedHResult**  The extended HResult error code.
 - **HResult**  The result code of the last action performed.
+- **IntentPFNs**  Intent Product Family Name
 - **IsBundle**  Is this a bundle?
 - **IsInteractive**  Is this an interactive installation?
 - **IsMandatory**  Is this a mandatory installation?
 - **IsRemediation**  Is this repairing a previous installation?
 - **IsRestore**  Is this automatically restoring a previously acquired product?
 - **IsUpdate**  Is this an update?
+- **IsWin32**  Flag indicating if this a Win32 app (unused).
 - **ParentBundleId**  The product ID of the parent (if this product is part of a bundle).
 - **PFN**  Product Family Name of the product being installed.
 - **ProductId**  The Store Product ID for the product being installed.
 - **SystemAttemptNumber**  The total number of system attempts.
+- **UpdateId**  Update ID (if this is an update)
 - **UserAttemptNumber**  The total number of user attempts.
 - **WUContentId**  The Windows Update content ID.
 
@@ -5355,16 +5442,19 @@ The following fields are available:
 - **CategoryId**  The identity of the package or packages being installed.
 - **ClientAppId**  The identity of the app that initiated this operation.
 - **HResult**  The result code of the last action performed.
+- **IntentPFNs**  The licensing identity of this package.
 - **IsBundle**  Is this a bundle?
 - **IsInteractive**  Is this user requested?
 - **IsMandatory**  Is this a mandatory update?
 - **IsRemediation**  Is this repairing a previous installation?
 - **IsRestore**  Is this restoring previously acquired content?
 - **IsUpdate**  Is this an update?
+- **IsWin32**  Flag indicating if this a Win32 app (unused).
 - **ParentBundleId**  The product ID of the parent (if this product is part of a bundle).
 - **PFN**  The name of the package or packages requested for install.
 - **ProductId**  The Store Product ID for the product being installed.
 - **SystemAttemptNumber**  The total number of system attempts.
+- **UpdateId**  Update ID (if this is an update)
 - **UserAttemptNumber**  The total number of user attempts.
 - **WUContentId**  The Windows Update content ID.
 
@@ -5381,6 +5471,7 @@ The following fields are available:
 - **CategoryId**  The identity of the package or packages being installed.
 - **ClientAppId**  The identity of the app that initiated this operation.
 - **HResult**  The result code of the last action performed.
+- **IntentPFNs**  The licensing identity of this package.
 - **IsBundle**  Is this a bundle?
 - **IsInteractive**  Is this user requested?
 - **IsMandatory**  Is this a mandatory update?
@@ -5450,6 +5541,7 @@ The following fields are available:
 - **BundleId**  The identity of the build associated with this product.
 - **CategoryId**  The identity of the package or packages being installed.
 - **ClientAppId**  The identity of the app that initiated this operation.
+- **IntentPFNs**  The licensing identity of this package.
 - **IsBundle**  Is this a bundle?
 - **IsInteractive**  Is this user requested?
 - **IsMandatory**  Is this a mandatory update?
@@ -5479,6 +5571,7 @@ The following fields are available:
 - **CategoryId**  The identity of the package or packages being installed.
 - **ClientAppId**  The identity of the app that initiated this operation.
 - **HResult**  The result code of the last action performed before this operation.
+- **IntentPFNs**  Intent Product Family Name
 - **IsBundle**  Is this a bundle?
 - **IsInteractive**  Is this user requested?
 - **IsMandatory**  Is this a mandatory update?
@@ -6296,12 +6389,30 @@ This event sends data specific to the FixupEditionId mitigation used for OS Upda
 
 ## Windows Update Reserve Manager events
 
+### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment
+
+This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending.
+
+
+
+### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager
+
+This event returns data about the Update Reserve Manager, including whether it’s been initialized.
+
+
+
 ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment
 
 This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment.
 
 
 
+### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment
+
+This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed.
+
+
+
 ## Winlogon events
 
 ### Microsoft.Windows.Security.Winlogon.SetupCompleteLogon
diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md
index 658324d8b4..e6d8367682 100644
--- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md
+++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md
@@ -7,13 +7,14 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: security
 localizationpriority: high
-audience: ITPro
 author: brianlic-msft
 ms.author: brianlic
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
-ms.date: 02/15/2019
+audience: ITPro
+ms.date: 01/04/2020
+ms.reviewer:
 ---
 
 
@@ -32,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
 
 You can learn more about Windows functional and diagnostic data through these articles:
 
-
+- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
 - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
 - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
 - [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
@@ -68,7 +69,7 @@ The following fields are available:
 - **DecisionSystemBios_19H1Setup**  The total DecisionSystemBios objects targeting the next release of Windows on this device.
 - **DecisionSystemBios_RS4**  The total DecisionSystemBios objects targeting Windows 10 version, 1803 present on this device.
 - **InventoryApplicationFile**  The count of the number of this particular object type present on this device.
-- **InventoryLanguagePack**  The count of the number of this particular object type present on this device.
+- **InventoryLanguagePack**  The count of InventoryLanguagePack objects present on this machine.
 - **InventoryMediaCenter**  The count of the number of this particular object type present on this device.
 - **InventorySystemBios**  The count of the number of this particular object type present on this device.
 - **InventoryUplevelDriverPackage**  The count of the number of this particular object type present on this device.
@@ -100,7 +101,7 @@ The following fields are available:
 - **HasCitData**  Indicates whether the file is present in CIT data.
 - **HasUpgradeExe**  Indicates whether the anti-virus app has an upgrade.exe file.
 - **IsAv**  Is the file an anti-virus reporting EXE?
-- **ResolveAttempted**  This will always be an empty string when sending telemetry.
+- **ResolveAttempted**  This will always be an empty string when sending diagnostic data.
 - **SdbEntries**  An array of fields that indicates the SDB entries that apply to this file.
 
 
@@ -199,7 +200,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
 
-This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
+This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -232,7 +233,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
 
-This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -265,7 +266,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
 
-This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -298,7 +299,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
 
-This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
+This event sends compatibility database information about the BIOS to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -331,7 +332,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd
 
-This event sends compatibility decision data about a file to help keep Windows up-to-date.
+This event sends compatibility decision data about a file to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -345,7 +346,7 @@ The following fields are available:
 - **HasUxBlockOverride**  Does the file have a block that is overridden by a tag in the SDB?
 - **MigApplication**  Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode?
 - **MigRemoval**  Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade?
-- **NeedsDismissAction**  Will the file cause an action that can be dimissed?
+- **NeedsDismissAction**  Will the file cause an action that can be dismissed?
 - **NeedsInstallPostUpgradeData**  After upgrade, the file will have a post-upgrade notification to install a replacement for the app.
 - **NeedsNotifyPostUpgradeData**  Does the file have a notification that should be shown after upgrade?
 - **NeedsReinstallPostUpgradeData**  After upgrade, this file will have a post-upgrade notification to reinstall the app.
@@ -360,7 +361,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
 
-This event indicates Indicates that the DecisionApplicationFile object is no longer present.
+This event indicates that the DecisionApplicationFile object is no longer present.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -382,7 +383,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
 
-This event sends compatibility decision data about a PNP device to help keep Windows up to date.
+This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -708,7 +709,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
 
-This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
+This event indicates that a new set of InventoryApplicationFileAdd events will be sent.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -826,7 +827,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
 
 The following fields are available:
 
-- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **AppraiserVersion**  The version of the Appraiser binary (executable) generating the events.
 
 
 ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
@@ -893,7 +894,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
 
-This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
+This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -968,7 +969,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
 
-This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -1003,7 +1004,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
 
-This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -1214,7 +1215,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemWlanAdd
 
-This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date.
+This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -1253,7 +1254,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
 
-This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
+This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
 
 The following fields are available:
 
@@ -1264,21 +1265,21 @@ The following fields are available:
 - **AuxFinal**  Obsolete, always set to false.
 - **AuxInitial**  Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
 - **DeadlineDate**  A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
-- **EnterpriseRun**  Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
+- **EnterpriseRun**  Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
 - **FullSync**  Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
 - **InventoryFullSync**  Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent.
 - **PCFP**  An ID for the system calculated by hashing hardware identifiers.
 - **PerfBackoff**  Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
 - **PerfBackoffInsurance**  Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
 - **RunAppraiser**  Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
-- **RunDate**  The date that the telemetry run was stated, expressed as a filetime.
-- **RunGeneralTel**  Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic.
+- **RunDate**  The date that the diagnostic data run was stated, expressed as a filetime.
+- **RunGeneralTel**  Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic.
 - **RunOnline**  Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
-- **RunResult**  The hresult of the Appraiser telemetry run.
-- **SendingUtc**  Indicates if the Appraiser client is sending events during the current telemetry run.
+- **RunResult**  The hresult of the Appraiser diagnostic data run.
+- **SendingUtc**  Indicates whether the Appraiser client is sending events during the current diagnostic data run.
 - **StoreHandleIsNotNull**  Obsolete, always set to false
-- **TelementrySent**  Indicates if telemetry was successfully sent.
-- **ThrottlingUtc**  Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability.
+- **TelementrySent**  Indicates whether diagnostic data was successfully sent.
+- **ThrottlingUtc**  Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability.
 - **Time**  The client time of the event.
 - **VerboseMode**  Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
 - **WhyFullSyncWithoutTablePrefix**  Indicates the reason or reasons that a full sync was generated.
@@ -1329,7 +1330,7 @@ The following fields are available:
 
 ### Census.App
 
-Provides information on IE and Census versions running on the device
+This event sends version data about the Apps running on this device, to help keep Windows up to date.
 
 The following fields are available:
 
@@ -1538,7 +1539,7 @@ The following fields are available:
 
 ### Census.Processor
 
-Provides information on several important data points about Processor settings
+This event sends data about the processor to help keep Windows up to date.
 
 The following fields are available:
 
@@ -1817,7 +1818,7 @@ The following fields are available:
 - **mon**  Combined monitor and event sequence numbers in the format: monitor sequence : event sequence
 - **op**  Represents the ETW Op Code.
 - **raId**  Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW.
-- **sqmId**  The Windows SQM ID.
+- **sqmId**  The Windows SQM (Software Quality Metrics—a precursor of Windows 10 Diagnostic Data collection) device identifier.
 - **stId**  Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
 - **tickets**  An array of strings that refer back to a key in the X-Tickets http header that the client uploaded along with a batch of events.
 
@@ -1912,6 +1913,47 @@ The following fields are available:
 - **pendingDecision**  Indicates the cause of reboot, if applicable.
 
 
+### CbsServicingProvider.CbsQualityUpdateInstall
+
+This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date.
+
+
+
+### CbsServicingProvider.CbsSelectableUpdateChangeV2
+
+This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date.
+
+The following fields are available:
+
+- **applicableUpdateState**  Indicates the highest applicable state of the optional content.
+- **buildVersion**  The build version of the package being installed.
+- **clientId**  The name of the application requesting the optional content change.
+- **downloadSource**  Indicates if optional content was obtained from Windows Update or a locally accessible file.
+- **downloadtimeInSeconds**  Indicates if optional content was obtained from Windows Update or a locally accessible file.
+- **executionID**  A unique ID used to identify events associated with a single servicing operation and not reused for future operations.
+- **executionSequence**  A counter that tracks the number of servicing operations attempted on the device.
+- **firstMergedExecutionSequence**  The value of a pervious executionSequence counter that is being merged with the current operation, if applicable.
+- **firstMergedID**  A unique ID of a pervious servicing operation that is being merged with this operation, if applicable.
+- **hrDownloadResult**  The return code of the download operation.
+- **hrStatusUpdate**  The return code of the servicing operation.
+- **identityHash**  A pseudonymized (hashed) identifier for the Windows Package that is being installed or uninstalled.
+- **initiatedOffline**  Indicates whether the operation was performed against an offline Windows image file or a running instance of Windows.
+- **majorVersion**  The major version of the package being installed.
+- **minorVersion**  The minor version of the package being installed.
+- **packageArchitecture**  The architecture of the package being installed.
+- **packageLanguage**  The language of the package being installed.
+- **packageName**  The name of the package being installed.
+- **rebootRequired**  Indicates whether a reboot is required to complete the operation.
+- **revisionVersion**  The revision number of the package being installed.
+- **stackBuild**  The build number of the servicing stack binary performing the installation.
+- **stackMajorVersion**  The major version number of the servicing stack binary performing the installation.
+- **stackMinorVersion**  The minor version number of the servicing stack binary performing the installation.
+- **stackRevision**  The revision number of the servicing stack binary performing the installation.
+- **updateName**  The name of the optional Windows Operation System feature being enabled or disabled.
+- **updateStartState**  A value indicating the state of the optional content before the operation started.
+- **updateTargetState**  A value indicating the desired state of the optional content.
+
+
 ## Diagnostic data events
 
 ### TelClientSynthetic.AuthorizationInfo_RuntimeTransition
@@ -1928,7 +1970,7 @@ Fired by UTC at startup to signal what data we are allowed to collect.
 
 ### TelClientSynthetic.ConnectivityHeartBeat_0
 
-This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
+This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network.
 
 
 
@@ -2439,7 +2481,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
 
-This event represents the basic metadata about a plug and play (PNP) device and its associated driver.
+This event sends basic metadata about a PNP device and its associated driver to help keep Windows up to date. This information is used to assess if the PNP device and driver will remain compatible when upgrading Windows.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -2460,7 +2502,7 @@ The following fields are available:
 - **Enumerator**  Identifies the bus that enumerated the device.
 - **HWID**  A list of hardware IDs for the device.
 - **Inf**  The name of the INF file (possibly renamed by the OS, such as oemXX.inf).
-- **InstallState**  The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx
+- **InstallState**  The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx
 - **InventoryVersion**  The version number of the inventory process generating the events.
 - **LowerClassFilters**  The identifiers of the Lower Class filters installed for the device.
 - **LowerFilters**  The identifiers of the Lower filters installed for the device.
@@ -2613,6 +2655,45 @@ The following fields are available:
 - **InventoryVersion**  The version of the inventory file generating the events.
 
 
+### Microsoft.Windows.Inventory.General.AppHealthStaticAdd
+
+This event sends details collected for a specific application on the source device.
+
+The following fields are available:
+
+- **AhaVersion**  The binary version of the App Health Analyzer tool.
+- **ApplicationErrors**  The count of application errors from the event log.
+- **Bitness**  The architecture type of the application (16 Bit or 32 bit or 64 bit).
+- **device_level**  Various JRE/JAVA versions installed on a particular device.
+- **ExtendedProperties**  Attribute used for aggregating all other attributes under this event type.
+- **Jar**  Flag to determine if an app has a Java JAR file dependency.
+- **Jre**  Flag to determine if an app has JRE framework dependency.
+- **Jre_version**  JRE versions an app has declared framework dependency for.
+- **Name**  Name of the application.
+- **NonDPIAware**  Flag to determine if an app is non-DPI aware
+- **NumBinaries**  Count of all binaries (.sys,.dll,.ini) from application install location.
+- **RequiresAdmin**  Flag to determine if an app requests admin privileges for execution.
+- **RequiresAdminv2**  Additional flag to determine if an app requests admin privileges for execution.
+- **RequiresUIAccess**  Flag to determine if an app is based on UI features for accessibility.
+- **VB6**  Flag to determine if an app is based on VB6 framework.
+- **VB6v2**  Additional flag to determine if an app is based on VB6 framework.
+- **Version**  Version of the application.
+- **VersionCheck**  Flag to determine if an app has a static dependency on OS version.
+- **VersionCheckv2**  Additional flag to determine if an app has a static dependency on OS version.
+
+
+### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync
+
+This event indicates the beginning of a series of AppHealthStaticAdd events.
+
+The following fields are available:
+
+- **AllowTelemetry**  Indicates the presence of the 'allowtelemetry' command line argument.
+- **CommandLineArgs**  Command line arguments passed when launching the App Health Analyzer executable.
+- **Enhanced**  Indicates the presence of the 'enhanced' command line argument.
+- **StartTime**  UTC date and time at which this event was sent.
+
+
 ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
 
 Invalid variant - Provides data on the installed Office Add-ins
@@ -2800,7 +2881,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
 
 The following fields are available:
 
-- **BrowserFlags**  Browser flags for Office-related products
+- **BrowserFlags**  Browser flags for Office-related products.
 - **ExchangeProviderFlags**  Office Exchange provider policies
 - **InventoryVersion**  The version of the inventory binary generating the events.
 - **SharedComputerLicensing**  Office Shared Computer Licensing policies
@@ -3002,6 +3083,26 @@ The following fields are available:
 - **UserInputTime**  The amount of time the loader application spent waiting for user input.
 
 
+## Migration events
+
+### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr
+
+This event returns data to track the count of the migration objects across various phases during feature update.
+
+
+
+### Microsoft.Windows.MigrationCore.MigObjectCountKFSys
+
+This event returns data about the count of the migration objects across various phases during feature update.
+
+
+
+### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr
+
+This event returns data to track the count of the migration objects across various phases during feature update.
+
+
+
 ## OneDrive events
 
 ### Microsoft.OneDrive.Sync.Setup.APIOperation
@@ -3107,25 +3208,42 @@ The following fields are available:
 - **winInetError**  The HResult of the operation.
 
 
+## Privacy logging notification events
+
+### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted
+
+This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue.
+
+The following fields are available:
+
+- **cleanupTask**  Indicates whether the task that launched the dialog should be cleaned up.
+- **cleanupTaskResult**  The return code of the attempt to clean up the task used to show the dialog.
+- **deviceEvaluated**  Indicates whether the device was eligible for evaluation of a known issue.
+- **deviceImpacted**  Indicates whether the device was impacted by a known issue.
+- **modalAction**  The action the user took on the dialog that was presented to them.
+- **modalResult**  The return code of the attempt to show a dialog to the user explaining the issue.
+- **resetSettingsResult**  The return code of the action to correct the known issue.
+
+
 ## Remediation events
 
 ### Microsoft.Windows.Remediation.Applicable
 
-This event indicates a remedial plug-in is applicable if/when such a plug-in is detected. This is used to ensure Windows is up to date.
+deny
 
 The following fields are available:
 
 - **ActionName**  The name of the action to be taken by the plug-in.
-- **AppraiserBinariesValidResult**  Indicates whether plug-in was appraised as valid.
+- **AppraiserBinariesValidResult**  Indicates whether the plug-in was appraised as valid.
 - **AppraiserDetectCondition**  Indicates whether the plug-in passed the appraiser's check.
 - **AppraiserRegistryValidResult**  Indicates whether the registry entry checks out as valid.
 - **AppraiserTaskDisabled**  Indicates the appraiser task is disabled.
 - **CV**  Correlation vector
 - **DateTimeDifference**  The difference between local and reference clock times.
-- **DateTimeSyncEnabled**  Indicates whether the datetime sync plug-in is enabled.
+- **DateTimeSyncEnabled**  Indicates whether the Datetime Sync plug-in is enabled.
 - **DaysSinceLastSIH**  The number of days since the most recent SIH executed.
 - **DaysToNextSIH**  The number of days until the next scheduled SIH execution.
-- **DetectedCondition**  Indicates whether detect condition is true and the perform action will be run.
+- **DetectedCondition**  Indicates whether detected condition is true and the perform action will be run.
 - **EvalAndReportAppraiserBinariesFailed**  Indicates the EvalAndReportAppraiserBinaries event failed.
 - **EvalAndReportAppraiserRegEntries**  Indicates the EvalAndReportAppraiserRegEntriesFailed event failed.
 - **EvalAndReportAppraiserRegEntriesFailed**  Indicates the EvalAndReportAppraiserRegEntriesFailed event failed.
@@ -3139,12 +3257,12 @@ The following fields are available:
 - **PackageVersion**  The version of the current remediation package.
 - **PluginName**  Name of the plugin specified for each generic plugin event.
 - **Reload**  True if SIH reload is required.
-- **RemediationNoisyHammerAcLineStatus**  Event that indicates the AC Line Status of the machine.
+- **RemediationNoisyHammerAcLineStatus**  Indicates the AC Line Status of the device.
 - **RemediationNoisyHammerAutoStartCount**  The number of times hammer auto-started.
 - **RemediationNoisyHammerCalendarTaskEnabled**  Event that indicates Update Assistant Calendar Task is enabled.
 - **RemediationNoisyHammerCalendarTaskExists**  Event that indicates an Update Assistant Calendar Task exists.
 - **RemediationNoisyHammerCalendarTaskTriggerEnabledCount**  Event that indicates calendar triggers are enabled in the task.
-- **RemediationNoisyHammerDaysSinceLastTaskRunTime**  The number of days since the most recent hammer task ran.
+- **RemediationNoisyHammerDaysSinceLastTaskRunTime**  The number of days since the most recent Noisy Hammer task ran.
 - **RemediationNoisyHammerGetCurrentSize**  Size in MB of the $GetCurrent folder.
 - **RemediationNoisyHammerIsInstalled**  TRUE if the noisy hammer is installed.
 - **RemediationNoisyHammerLastTaskRunResult**  The result of the last hammer task run.
@@ -3158,7 +3276,7 @@ The following fields are available:
 - **RemediationNoisyHammerUserLoggedInAdmin**  TRUE if there is the user currently logged in is an Admin.
 - **RemediationShellDeviceManaged**  TRUE if the device is WSUS managed or Windows Updated disabled.
 - **RemediationShellDeviceNewOS**  TRUE if the device has a recently installed OS.
-- **RemediationShellDeviceSccm**  TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager).
+- **RemediationShellDeviceSccm**  TRUE if the device is managed by Microsoft Endpoint Configuration Manager.
 - **RemediationShellDeviceZeroExhaust**  TRUE if the device has opted out of Windows Updates completely.
 - **RemediationTargetMachine**  Indicates whether the device is a target of the specified fix.
 - **RemediationTaskHealthAutochkProxy**  True/False based on the health of the AutochkProxy task.
@@ -3214,7 +3332,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Remediation.Completed
 
-This event enables completion tracking of a process that remediates issues preventing security and quality updates.
+This event is sent when Windows Update sediment remediations have completed on the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates.
 
 The following fields are available:
 
@@ -3232,12 +3350,12 @@ The following fields are available:
 - **CV**  The Correlation Vector.
 - **DateTimeDifference**  The difference between the local and reference clocks.
 - **DaysSinceOsInstallation**  The number of days since the installation of the Operating System.
-- **DiskMbCleaned**  The amount of space cleaned on the hard disk, measured in Megabytes.
+- **DiskMbCleaned**  The amount of space cleaned on the hard disk, measured in megabytes.
 - **DiskMbFreeAfterCleanup**  The amount of free hard disk space after cleanup, measured in Megabytes.
 - **DiskMbFreeBeforeCleanup**  The amount of free hard disk space before cleanup, measured in Megabytes.
 - **ForcedAppraiserTaskTriggered**  TRUE if Appraiser task ran from the plug-in.
 - **GlobalEventCounter**  Client-side counter that indicates ordering of events sent by the active user.
-- **HandlerCleanupFreeDiskInMegabytes**  The amount of hard disk space cleaned by the storage sense handlers, measured in Megabytes.
+- **HandlerCleanupFreeDiskInMegabytes**  The amount of hard disk space cleaned by the storage sense handlers, measured in megabytes.
 - **hasRolledBack**  Indicates whether the client machine has rolled back.
 - **hasUninstalled**  Indicates whether the client machine has uninstalled a later version of the OS.
 - **hResult**  The result of the event execution.
@@ -3298,7 +3416,7 @@ The following fields are available:
 - **RunResult**  The HRESULT for Detection or Perform Action phases of the plug-in.
 - **ServiceHealthPlugin**  The nae of the Service Health plug-in.
 - **StartComponentCleanupTask**  TRUE if the Component Cleanup task started successfully.
-- **systemDriveFreeDiskSpace**  Indicates the free disk space on system drive in MBs.
+- **systemDriveFreeDiskSpace**  Indicates the free disk space on system drive, in megabytes.
 - **systemUptimeInHours**  Indicates the amount of time the system in hours has been on since the last boot.
 - **TotalSizeofOrphanedInstallerFilesInMegabytes**  The size of any orphaned Windows Installer files, measured in Megabytes.
 - **TotalSizeofStoreCacheAfterCleanupInMegabytes**  The size of the Microsoft Store cache after cleanup, measured in Megabytes.
@@ -3313,7 +3431,7 @@ The following fields are available:
 - **usoScanIsNetworkMetered**  TRUE if the device is currently connected to a metered network.
 - **usoScanIsNoAutoUpdateKeyPresent**  TRUE if no Auto Update registry key is set/present.
 - **usoScanIsUserLoggedOn**  TRUE if the user is logged on.
-- **usoScanPastThreshold**  TRUE if the most recent USO (Update Session Orchestrator) scan is past the threshold (late).
+- **usoScanPastThreshold**  TRUE if the most recent Update Session Orchestrator (USO) scan is past the threshold (late).
 - **usoScanType**  The type of USO (Update Session Orchestrator) scan: "Interactive" or "Background".
 - **windows10UpgraderBlockWuUpdates**  Event to report the value of Windows 10 Upgrader BlockWuUpdates Key.
 - **windowsEditionId**  Event to report the value of Windows Edition ID.
@@ -3347,13 +3465,13 @@ The following fields are available:
 
 ### Microsoft.Windows.Remediation.Started
 
-This event reports whether a plug-in started, to help ensure Windows is up to date.
+This event is sent when Windows Update sediment remediations have started on the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates.
 
 The following fields are available:
 
 - **CV**  Correlation vector.
 - **GlobalEventCounter**  Client side counter which indicates ordering of events sent by this user.
-- **PackageVersion**  Current package version of Remediation.
+- **PackageVersion**  The version of the current remediation package.
 - **PluginName**  Name of the plugin specified for each generic plugin event.
 - **Result**  This is the HRESULT for detection or perform action phases of the plugin.
 
@@ -3615,7 +3733,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentLauncher.Applicable
 
-Indicates whether a given plugin is applicable.
+This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -3631,7 +3749,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentLauncher.Completed
 
-Indicates whether a given plugin has completed its work.
+This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -3678,7 +3796,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentLauncher.Started
 
-This event indicates that a given plug-in has started.
+This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -3716,7 +3834,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentService.Applicable
 
-This event indicates whether a given plug-in is applicable.
+This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -3732,7 +3850,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentService.Completed
 
-This event indicates whether a given plug-in has completed its work.
+This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -3786,7 +3904,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentService.Started
 
-This event indicates a specified plug-in has started. This information helps ensure Windows is up to date.
+This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -4128,7 +4246,7 @@ The following fields are available:
 - **HandlerType**  Indicates the kind of content (app, driver, windows patch, etc.)
 - **RevisionNumber**  Unique revision number of Update
 - **ServerId**  Identifier for the service to which the software distribution client is connecting, such as Windows Update and Microsoft Store.
-- **ServiceGuid**  Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc)
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
 - **SystemBIOSMajorRelease**  Major version of the BIOS.
 - **SystemBIOSMinorRelease**  Minor version of the BIOS.
 - **UpdateId**  Unique Update ID
@@ -4192,7 +4310,7 @@ The following fields are available:
 - **RelatedCV**  The previous Correlation Vector that was used before swapping with a new one
 - **RepeatFailFlag**  Indicates whether this specific piece of content had previously failed to download.
 - **RevisionNumber**  The revision number of the specified piece of content.
-- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
 - **Setup360Phase**  Identifies the active phase of the upgrade download if the current download is for an Operating System upgrade.
 - **ShippingMobileOperator**  The mobile operator linked to the device when the device shipped.
 - **StatusCode**  Indicates the result of a Download event (success, cancellation, failure code HResult).
@@ -4357,7 +4475,7 @@ The following fields are available:
 
 - **EndpointUrl**  The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
 - **EventScenario**  The purpose of this event, such as scan started, scan succeeded, or scan failed.
-- **ExtendedStatusCode**  The secondary status code of the event.
+- **ExtendedStatusCode**  Secondary status code for certain scenarios where StatusCode was not specific enough.
 - **LeafCertId**  The integral ID from the FragmentSigning data for the certificate that failed.
 - **ListOfSHA256OfIntermediateCerData**  A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
 - **MetadataIntegrityMode**  The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
@@ -4978,7 +5096,13 @@ The following fields are available:
 
 ### FacilitatorTelemetry.DCATDownload
 
-This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure.
+This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure.
+
+
+
+### FacilitatorTelemetry.DUDownload
+
+This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows.
 
 
 
@@ -4990,7 +5114,7 @@ This event determines whether devices received additional or critical supplement
 
 ### Setup360Telemetry.Downlevel
 
-This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure.
+This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure.
 
 The following fields are available:
 
@@ -5239,6 +5363,18 @@ The following fields are available:
 - **m**  The WaaS (“Workspace as a Service”—cloud-based “workspace”) Assessment Error String.
 
 
+### Microsoft.Windows.WaaSMedic.RemediationFailed
+
+This event is sent when the WaaS Medic update stack remediation tool fails to apply a described resolution to a problem that is blocking Windows Update from operating correctly on a target device.
+
+The following fields are available:
+
+- **diagnostic**  Parameter where the resolution failed.
+- **hResult**  Error code that resulted from attempting the resolution.
+- **isRemediated**  Indicates whether the condition was remediated.
+- **pluginName**  Name of the attempted resolution.
+
+
 ### Microsoft.Windows.WaaSMedic.Summary
 
 This event provides the results of the WaaSMedic diagnostic run
@@ -5298,7 +5434,7 @@ The following fields are available:
 - **ReportId**  WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson).
 
 
-## Microsoft Store events
+## Windows Store events
 
 ### Microsoft.Windows.Store.Partner.ReportApplication
 
@@ -5405,6 +5541,7 @@ The following fields are available:
 
 - **AggregatedPackageFullNames**  Includes a set of package full names for each app that is part of an atomic set.
 - **AttemptNumber**  The total number of attempts to acquire this product.
+- **BundleId**  The bundle ID
 - **CategoryId**  The identity of the package or packages being installed.
 - **ClientAppId**  The identity of the app that initiated this operation.
 - **HResult**  HResult code to show the result of the operation (success/failure).
@@ -5414,6 +5551,7 @@ The following fields are available:
 - **IsRemediation**  Is this repairing a previous installation?
 - **IsRestore**  Is this happening after a device restore?
 - **IsUpdate**  Is this an update?
+- **ParentBundleId**  The parent bundle ID (if it's part of a bundle).
 - **PFN**  Product Family Name of the product being installed.
 - **ProductId**  The Store Product ID for the product being installed.
 - **SystemAttemptNumber**  The number of attempts by the system to acquire this product.
@@ -6514,12 +6652,30 @@ The following fields are available:
 
 ## Windows Update Reserve Manager events
 
+### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment
+
+This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending.
+
+
+
+### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager
+
+This event returns data about the Update Reserve Manager, including whether it’s been initialized.
+
+
+
 ### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment
 
 This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment.
 
 
 
+### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment
+
+This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed.
+
+
+
 ## Winlogon events
 
 ### Microsoft.Windows.Security.Winlogon.SetupCompleteLogon
diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md
index 55e5adf886..81f8c0c5fc 100644
--- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md
+++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md
@@ -7,13 +7,14 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: security
 localizationpriority: high
-audience: ITPro
 author: brianlic-msft
 ms.author: brianlic
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
-ms.date: 02/15/2019
+audience: ITPro
+ms.date: 01/04/2020
+ms.reviewer:
 ---
 
 
@@ -32,7 +33,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
 
 You can learn more about Windows functional and diagnostic data through these articles:
 
-
+- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
 - [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
 - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
 - [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
@@ -134,7 +135,7 @@ The following fields are available:
 - **HasCitData**  Indicates whether the file is present in CIT data.
 - **HasUpgradeExe**  Indicates whether the anti-virus app has an upgrade.exe file.
 - **IsAv**  Is the file an antivirus reporting EXE?
-- **ResolveAttempted**  This will always be an empty string when sent.
+- **ResolveAttempted**  This will always be an empty string when sending diagnostic data.
 - **SdbEntries**  An array of fields that indicates the SDB entries that apply to this file.
 
 
@@ -233,7 +234,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
 
-This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
+This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -266,7 +267,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
 
-This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -299,7 +300,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
 
-This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -332,7 +333,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
 
-This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
+This event sends compatibility database information about the BIOS to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -365,7 +366,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd
 
-This event sends compatibility decision data about a file to help keep Windows up-to-date.
+This event sends compatibility decision data about a file to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -380,7 +381,7 @@ The following fields are available:
 - **HasUxBlockOverride**  Does the file have a block that is overridden by a tag in the SDB?
 - **MigApplication**  Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode?
 - **MigRemoval**  Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade?
-- **NeedsDismissAction**  Will the file cause an action that can be dimissed?
+- **NeedsDismissAction**  Will the file cause an action that can be dismissed?
 - **NeedsInstallPostUpgradeData**  After upgrade, the file will have a post-upgrade notification to install a replacement for the app.
 - **NeedsNotifyPostUpgradeData**  Does the file have a notification that should be shown after upgrade?
 - **NeedsReinstallPostUpgradeData**  After upgrade, this file will have a post-upgrade notification to reinstall the app.
@@ -395,7 +396,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
 
-This event indicates Indicates that the DecisionApplicationFile object is no longer present.
+This event indicates that the DecisionApplicationFile object is no longer present.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -417,7 +418,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
 
-This event sends compatibility decision data about a PNP device to help keep Windows up to date.
+This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -746,7 +747,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
 
-This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
+This event indicates that a new set of InventoryApplicationFileAdd events will be sent.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -864,7 +865,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
 
 The following fields are available:
 
-- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **AppraiserVersion**  The version of the Appraiser binary (executable) generating the events.
 
 
 ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
@@ -930,7 +931,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
 
-This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
+This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -1005,7 +1006,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
 
-This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -1040,7 +1041,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
 
-This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -1257,7 +1258,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemWlanAdd
 
-This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date.
+This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -1296,18 +1297,18 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
 
-This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
+This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
 
 The following fields are available:
 
 - **AppraiserBranch**  The source branch in which the version of Appraiser that is running was built.
-- **AppraiserDataVersion**  The version of the data files being used by the Appraiser telemetry run.
+- **AppraiserDataVersion**  The version of the data files being used by the Appraiser diagnostic data run.
 - **AppraiserProcess**  The name of the process that launched Appraiser.
 - **AppraiserVersion**  The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
 - **AuxFinal**  Obsolete, always set to false.
 - **AuxInitial**  Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
 - **DeadlineDate**  A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
-- **EnterpriseRun**  Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
+- **EnterpriseRun**  Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
 - **FullSync**  Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
 - **InboxDataVersion**  The original version of the data files before retrieving any newer version.
 - **IndicatorsWritten**  Indicates if all relevant UEX indicators were successfully written or updated.
@@ -1316,14 +1317,14 @@ The following fields are available:
 - **PerfBackoff**  Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
 - **PerfBackoffInsurance**  Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
 - **RunAppraiser**  Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
-- **RunDate**  The date that the telemetry run was stated, expressed as a filetime.
-- **RunGeneralTel**  Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic.
+- **RunDate**  The date that the diagnostic data run was stated, expressed as a filetime.
+- **RunGeneralTel**  Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic.
 - **RunOnline**  Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
-- **RunResult**  The hresult of the Appraiser telemetry run.
-- **SendingUtc**  Indicates if the Appraiser client is sending events during the current telemetry run.
+- **RunResult**  The hresult of the Appraiser diagnostic data run.
+- **SendingUtc**  Indicates whether the Appraiser client is sending events during the current diagnostic data run.
 - **StoreHandleIsNotNull**  Obsolete, always set to false
-- **TelementrySent**  Indicates if telemetry was successfully sent.
-- **ThrottlingUtc**  Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability.
+- **TelementrySent**  Indicates whether diagnostic data was successfully sent.
+- **ThrottlingUtc**  Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability.
 - **Time**  The client time of the event.
 - **VerboseMode**  Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
 - **WhyFullSyncWithoutTablePrefix**  Indicates the reason or reasons that a full sync was generated.
@@ -1374,7 +1375,7 @@ The following fields are available:
 
 ### Census.App
 
-Provides information on IE and Census versions running on the device.
+This event sends version data about the Apps running on this device, to help keep Windows up to date.
 
 The following fields are available:
 
@@ -1390,6 +1391,18 @@ The following fields are available:
 - **IEVersion**  The version of Internet Explorer that is running on the device.
 
 
+### Census.Azure
+
+This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets.
+
+The following fields are available:
+
+- **CloudCoreBuildEx**  The Azure CloudCore build number.
+- **CloudCoreSupportBuildEx**  The Azure CloudCore support build number.
+- **NodeID**  The node identifier on the device that indicates whether the device is part of the Azure fleet.
+- **PartA_PrivTags**  The privacy tags associated with the event.
+
+
 ### Census.Battery
 
 This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date.
@@ -1582,9 +1595,53 @@ The following fields are available:
 - **SLICVersion**  Returns OS type/version from SLIC table.
 
 
+### Census.PrivacySettings
+
+This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values:  -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings.
+
+The following fields are available:
+
+- **Activity**  Current state of the activity history setting.
+- **ActivityHistoryCloudSync**  Current state of the activity history cloud sync setting.
+- **ActivityHistoryCollection**  Current state of the activity history collection setting.
+- **AdvertisingId**  Current state of the advertising ID setting.
+- **AppDiagnostics**  Current state of the app diagnostics setting.
+- **Appointments**  Current state of the calendar setting.
+- **Bluetooth**  Current state of the Bluetooth capability setting.
+- **BluetoothSync**  Current state of the Bluetooth sync capability setting.
+- **BroadFileSystemAccess**  Current state of the broad file system access setting.
+- **CellularData**  Current state of the cellular data capability setting.
+- **Chat**  Current state of the chat setting.
+- **Contacts**  Current state of the contacts setting.
+- **DocumentsLibrary**  Current state of the documents library setting.
+- **Email**  Current state of the email setting.
+- **FindMyDevice**  Current state of the "find my device" setting.
+- **GazeInput**  Current state of the gaze input setting.
+- **HumanInterfaceDevice**  Current state of the human interface device setting.
+- **InkTypeImprovement**  Current state of the improve inking and typing setting.
+- **Location**  Current state of the location setting.
+- **LocationHistory**  Current state of the location history setting.
+- **Microphone**  Current state of the microphone setting.
+- **PhoneCall**  Current state of the phone call setting.
+- **PhoneCallHistory**  Current state of the call history setting.
+- **PicturesLibrary**  Current state of the pictures library setting.
+- **Radios**  Current state of the radios setting.
+- **SensorsCustom**  Current state of the custom sensor setting.
+- **SerialCommunication**  Current state of the serial communication setting.
+- **Sms**  Current state of the text messaging setting.
+- **SpeechPersonalization**  Current state of the speech services setting.
+- **USB**  Current state of the USB setting.
+- **UserAccountInformation**  Current state of the account information setting.
+- **UserDataTasks**  Current state of the tasks setting.
+- **UserNotificationListener**  Current state of the notifications setting.
+- **VideosLibrary**  Current state of the videos library setting.
+- **Webcam**  Current state of the camera setting.
+- **WiFiDirect**  Current state of the Wi-Fi direct setting.
+
+
 ### Census.Processor
 
-Provides information on several important data points about Processor settings.
+This event sends data about the processor to help keep Windows up to date.
 
 The following fields are available:
 
@@ -1695,6 +1752,50 @@ The following fields are available:
 - **SpeechInputLanguages**  The Speech Input languages installed on the device.
 
 
+### Census.UserPrivacySettings
+
+This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings.
+
+The following fields are available:
+
+- **Activity**  Current state of the activity history setting.
+- **ActivityHistoryCloudSync**  Current state of the activity history cloud sync setting.
+- **ActivityHistoryCollection**  Current state of the activity history collection setting.
+- **AdvertisingId**  Current state of the advertising ID setting.
+- **AppDiagnostics**  Current state of the app diagnostics setting.
+- **Appointments**  Current state of the calendar setting.
+- **Bluetooth**  Current state of the Bluetooth capability setting.
+- **BluetoothSync**  Current state of the Bluetooth sync capability setting.
+- **BroadFileSystemAccess**  Current state of the broad file system access setting.
+- **CellularData**  Current state of the cellular data capability setting.
+- **Chat**  Current state of the chat setting.
+- **Contacts**  Current state of the contacts setting.
+- **DocumentsLibrary**  Current state of the documents library setting.
+- **Email**  Current state of the email setting.
+- **GazeInput**  Current state of the gaze input setting.
+- **HumanInterfaceDevice**  Current state of the human interface device setting.
+- **InkTypeImprovement**  Current state of the improve inking and typing setting.
+- **InkTypePersonalization**  Current state of the inking and typing personalization setting.
+- **Location**  Current state of the location setting.
+- **LocationHistory**  Current state of the location history setting.
+- **Microphone**  Current state of the microphone setting.
+- **PhoneCall**  Current state of the phone call setting.
+- **PhoneCallHistory**  Current state of the call history setting.
+- **PicturesLibrary**  Current state of the pictures library setting.
+- **Radios**  Current state of the radios setting.
+- **SensorsCustom**  Current state of the custom sensor setting.
+- **SerialCommunication**  Current state of the serial communication setting.
+- **Sms**  Current state of the text messaging setting.
+- **SpeechPersonalization**  Current state of the speech services setting.
+- **USB**  Current state of the USB setting.
+- **UserAccountInformation**  Current state of the account information setting.
+- **UserDataTasks**  Current state of the tasks setting.
+- **UserNotificationListener**  Current state of the notifications setting.
+- **VideosLibrary**  Current state of the videos library setting.
+- **Webcam**  Current state of the camera setting.
+- **WiFiDirect**  Current state of the Wi-Fi direct setting.
+
+
 ### Census.VM
 
 This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date.
@@ -1819,7 +1920,6 @@ The following fields are available:
 - **ext_cs**  Describes properties related to the schema of the event. See [Common Data Extensions.cs](#common-data-extensionscs).
 - **ext_device**  Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice).
 - **ext_os**  Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos).
-- **ext_receipts**  Describes the fields related to time as provided by the client for debugging purposes. See [Common Data Extensions.receipts](#common-data-extensionsreceipts).
 - **ext_sdk**  Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk).
 - **ext_user**  Describes the fields related to a user. See [Common Data Extensions.user](#common-data-extensionsuser).
 - **ext_utc**  Describes the fields that might be populated by a logging library on Windows. See [Common Data Extensions.utc](#common-data-extensionsutc).
@@ -1845,16 +1945,6 @@ The following fields are available:
 - **ver**  Represents the major and minor version of the extension.
 
 
-### Common Data Extensions.receipts
-
-Represents various time information as provided by the client and helps for debugging purposes.
-
-The following fields are available:
-
-- **originalTime**  The original event time.
-- **uploadTime**  The time the event was uploaded.
-
-
 ### Common Data Extensions.sdk
 
 Used by platform specific libraries to record fields that are required for a specific SDK.
@@ -2027,6 +2117,78 @@ The following fields are available:
 - **transactionCanceled**  Indicates whether the uninstall was cancelled.
 
 
+### CbsServicingProvider.CbsQualityUpdateInstall
+
+This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date.
+
+The following fields are available:
+
+- **buildVersion**  The build version number of the update package.
+- **clientId**  The name of the application requesting the optional content.
+- **corruptionHistoryFlags**  A bitmask of the types of component store corruption that have caused update failures on the device.
+- **corruptionType**  An enumeration listing the type of data corruption responsible for the current update failure.
+- **currentStateEnd**  The final state of the package after the operation has completed.
+- **doqTimeSeconds**  The time in seconds spent updating drivers.
+- **executeTimeSeconds**  The number of seconds required to execute the install.
+- **failureDetails**  The driver or installer that caused the update to fail.
+- **failureSourceEnd**  An enumeration indicating at what phase of the update a failure occurred.
+- **hrStatusEnd**  The return code of the install operation.
+- **initiatedOffline**  A true or false value indicating whether the package was installed into an offline Windows Imaging Format (WIM) file.
+- **majorVersion**  The major version number of the update package.
+- **minorVersion**  The minor version number of the update package.
+- **originalState**  The starting state of the package.
+- **overallTimeSeconds**  The time (in seconds) to perform the overall servicing operation.
+- **PartA_PrivTags**  The privacy tags associated with the event.
+- **planTimeSeconds**  The time in seconds required to plan the update operations.
+- **poqTimeSeconds**  The time in seconds processing file and registry operations.
+- **postRebootTimeSeconds**  The time (in seconds) to do startup processing for the update.
+- **preRebootTimeSeconds**  The time (in seconds) between execution of the installation and the reboot.
+- **primitiveExecutionContext**  An enumeration indicating at what phase of shutdown or startup the update was installed.
+- **rebootCount**  The number of reboots required to install the update.
+- **rebootTimeSeconds**  The time (in seconds) before startup processing begins for the update.
+- **resolveTimeSeconds**  The time in seconds required to resolve the packages that are part of the update.
+- **revisionVersion**  The revision version number of the update package.
+- **rptTimeSeconds**  The time in seconds spent executing installer plugins.
+- **shutdownTimeSeconds**  The time (in seconds) required to do shutdown processing for the update.
+- **stackRevision**  The revision number of the servicing stack.
+- **stageTimeSeconds**  The time (in seconds) required to stage all files that are part of the update.
+
+
+### CbsServicingProvider.CbsSelectableUpdateChangeV2
+
+This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date.
+
+The following fields are available:
+
+- **applicableUpdateState**  Indicates the highest applicable state of the optional content.
+- **buildVersion**  The build version of the package being installed.
+- **clientId**  The name of the application requesting the optional content change.
+- **downloadSource**  Indicates if optional content was obtained from Windows Update or a locally accessible file.
+- **downloadtimeInSeconds**  Indicates if optional content was obtained from Windows Update or a locally accessible file.
+- **executionID**  A unique ID used to identify events associated with a single servicing operation and not reused for future operations.
+- **executionSequence**  A counter that tracks the number of servicing operations attempted on the device.
+- **firstMergedExecutionSequence**  The value of a pervious executionSequence counter that is being merged with the current operation, if applicable.
+- **firstMergedID**  A unique ID of a pervious servicing operation that is being merged with this operation, if applicable.
+- **hrDownloadResult**  The return code of the download operation.
+- **hrStatusUpdate**  The return code of the servicing operation.
+- **identityHash**  A pseudonymized (hashed) identifier for the Windows Package that is being installed or uninstalled.
+- **initiatedOffline**  Indicates whether the operation was performed against an offline Windows image file or a running instance of Windows.
+- **majorVersion**  The major version of the package being installed.
+- **minorVersion**  The minor version of the package being installed.
+- **packageArchitecture**  The architecture of the package being installed.
+- **packageLanguage**  The language of the package being installed.
+- **packageName**  The name of the package being installed.
+- **rebootRequired**  Indicates whether a reboot is required to complete the operation.
+- **revisionVersion**  The revision number of the package being installed.
+- **stackBuild**  The build number of the servicing stack binary performing the installation.
+- **stackMajorVersion**  The major version number of the servicing stack binary performing the installation.
+- **stackMinorVersion**  The minor version number of the servicing stack binary performing the installation.
+- **stackRevision**  The revision number of the servicing stack binary performing the installation.
+- **updateName**  The name of the optional Windows Operation System feature being enabled or disabled.
+- **updateStartState**  A value indicating the state of the optional content before the operation started.
+- **updateTargetState**  A value indicating the desired state of the optional content.
+
+
 ## Deployment extensions
 
 ### DeploymentTelemetry.Deployment_End
@@ -2137,7 +2299,7 @@ The following fields are available:
 
 ### TelClientSynthetic.ConnectivityHeartbeat_0
 
-This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
+This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network.
 
 The following fields are available:
 
@@ -3281,7 +3443,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
 
-This event represents the basic metadata about a plug and play (PNP) device and its associated driver.
+This event sends basic metadata about a PNP device and its associated driver to help keep Windows up to date. This information is used to assess if the PNP device and driver will remain compatible when upgrading Windows.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -3302,7 +3464,7 @@ The following fields are available:
 - **Enumerator**  Identifies the bus that enumerated the device.
 - **HWID**  A list of hardware IDs for the device.
 - **Inf**  The name of the INF file (possibly renamed by the OS, such as oemXX.inf).
-- **InstallState**  The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx
+- **InstallState**  The device installation state. For a list of values, see: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx
 - **InventoryVersion**  The version number of the inventory process generating the events.
 - **LowerClassFilters**  The identifiers of the Lower Class filters installed for the device.
 - **LowerFilters**  The identifiers of the Lower filters installed for the device.
@@ -3455,6 +3617,50 @@ The following fields are available:
 - **InventoryVersion**  The version of the inventory file generating the events.
 
 
+### Microsoft.Windows.Inventory.General.AppHealthStaticAdd
+
+This event sends details collected for a specific application on the source device.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AhaVersion**  The binary version of the App Health Analyzer tool.
+- **ApplicationErrors**  The count of application errors from the event log.
+- **Bitness**  The architecture type of the application (16 Bit or 32 bit or 64 bit).
+- **device_level**  Various JRE/JAVA versions installed on a particular device.
+- **ExtendedProperties**  Attribute used for aggregating all other attributes under this event type.
+- **Jar**  Flag to determine if an app has a Java JAR file dependency.
+- **Jre**  Flag to determine if an app has JRE framework dependency.
+- **Jre_version**  JRE versions an app has declared framework dependency for.
+- **Name**  Name of the application.
+- **NonDPIAware**  Flag to determine if an app is non-DPI aware
+- **NumBinaries**  Count of all binaries (.sys,.dll,.ini) from application install location.
+- **ProgramId**  The ID of the associated program.
+- **RequiresAdmin**  Flag to determine if an app requests admin privileges for execution.
+- **RequiresAdminv2**  Additional flag to determine if an app requests admin privileges for execution.
+- **RequiresUIAccess**  Flag to determine if an app is based on UI features for accessibility.
+- **VB6**  Flag to determine if an app is based on VB6 framework.
+- **VB6v2**  Additional flag to determine if an app is based on VB6 framework.
+- **Version**  Version of the application.
+- **VersionCheck**  Flag to determine if an app has a static dependency on OS version.
+- **VersionCheckv2**  Additional flag to determine if an app has a static dependency on OS version.
+
+
+### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync
+
+This event indicates the beginning of a series of AppHealthStaticAdd events.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AllowTelemetry**  Indicates the presence of the 'allowtelemetry' command line argument.
+- **CommandLineArgs**  Command line arguments passed when launching the App Health Analyzer executable.
+- **Enhanced**  Indicates the presence of the 'enhanced' command line argument.
+- **StartTime**  UTC date and time at which this event was sent.
+
+
 ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
 
 Provides data on the installed Office Add-ins
@@ -3647,10 +3853,10 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
 
 The following fields are available:
 
-- **BrowserFlags**  Browser flags for Office-related products
-- **ExchangeProviderFlags**  Provider policies for Office Exchange
+- **BrowserFlags**  Browser flags for Office-related products.
+- **ExchangeProviderFlags**  Provider policies for Office Exchange.
 - **InventoryVersion**  The version of the inventory binary generating the events.
-- **SharedComputerLicensing**  Office shared computer licensing policies
+- **SharedComputerLicensing**  Office shared computer licensing policies.
 
 
 ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync
@@ -3881,6 +4087,215 @@ The following fields are available:
 - **UptimeDeltaMS**  Total time (in milliseconds) added to Uptime since the last event
 
 
+## Microsoft Edge events
+
+### Aria.160f0649efde47b7832f05ed000fc453.Microsoft.WebBrowser.SystemInfo.Config
+
+This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+### Aria.29e24d069f27450385c7acaa2f07e277.Microsoft.WebBrowser.SystemInfo.Config
+
+This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+### Aria.7005b72804a64fa4b2138faab88f877b.Microsoft.WebBrowser.SystemInfo.Config
+
+This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+### Aria.754de735ccd546b28d0bfca8ac52c3de.Microsoft.WebBrowser.SystemInfo.Config
+
+This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping
+
+This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's  used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date.
+
+The following fields are available:
+
+- **appAp**  Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''.
+- **appAppId**  The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update.
+- **appBrandCode**  The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown).
+- **appChannel**  An integer indicating the channel of the installation (e.g. Canary or Dev).
+- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''.
+- **appCohort**  A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''.
+- **appCohortHint**  A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''.
+- **appCohortName**  A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''.
+- **appConsentState**  Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited.
+- **appDayOfInstall**  The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown).
+- **appExperiments**  A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''.
+- **appInstallTimeDiffSec**  The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'.
+- **appLang**  The language of the product install, in IETF BCP 47 representation. Default: ''.
+- **appNextVersion**  The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'.
+- **appPingEventAppSize**  The total number of bytes of all downloaded packages. Default: '0'.
+- **appPingEventDownloadMetricsDownloadedBytes**  For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'.
+- **appPingEventDownloadMetricsDownloader**  A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''.
+- **appPingEventDownloadMetricsDownloadTimeMs**  For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'.
+- **appPingEventDownloadMetricsError**  The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'.
+- **appPingEventDownloadMetricsServerIpHint**  For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''.
+- **appPingEventDownloadMetricsTotalBytes**  For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'.
+- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''.
+- **appPingEventDownloadTimeMs**  For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'.
+- **appPingEventErrorCode**  The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'.
+- **appPingEventEventResult**  An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error).
+- **appPingEventEventType**  An enumeration indicating the type of the event and the event stage. Default: '0' (Unknown).
+- **appPingEventExtraCode1**  Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'.
+- **appPingEventInstallTimeMs**  For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'.
+- **appPingEventNumBytesDownloaded**  The number of bytes downloaded for the specified application. Default: '0'.
+- **appPingEventSequenceId**  An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event.
+- **appPingEventSourceUrlIndex**  For events representing a download, the position of the download URL in the list of URLs supplied by the server in a  tag.
+- **appPingEventUpdateCheckTimeMs**	For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'.
+- **appUpdateCheckIsUpdateDisabled**  The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not.
+- **appUpdateCheckTargetVersionPrefix**  A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''.
+- **appUpdateCheckTtToken**  An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''.
+- **appVersion**  The version of the product install. Default: '0.0.0.0'.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full.
+- **eventType**  A string representation of appPingEventEventType indicating the type of the event.
+- **hwHasAvx**  '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse**  '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse2**  '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse3**  '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse41**  '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse42**  '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSsse3**  '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'.
+- **hwPhysmemory**  The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'.
+- **isMsftDomainJoined**  '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'.
+- **osArch**  The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''.
+- **osPlatform**  The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''.
+- **osServicePack**  The secondary version of the operating system. '' if unknown. Default: ''.
+- **osVersion**  The primary version of the operating system. '' if unknown. Default: ''.
+- **requestCheckPeriodSec**  The update interval in seconds. The value is read from the registry. Default: '-1'.
+- **requestDlpref**  A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''.
+- **requestDomainJoined**  '1' if the device is part of a managed enterprise domain. Otherwise '0'.
+- **requestInstallSource**  A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''.
+- **requestIsMachine**  '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'.
+- **requestOmahaShellVersion**  The version of the Omaha installation folder. Default: ''.
+- **requestOmahaVersion**  The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'.
+- **requestProtocolVersion**  The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined.
+- **requestRequestId**  A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Default: ''.
+- **requestSessionCorrelationVectorBase**  A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''.
+- **requestSessionId**  A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique sessionid. Default: ''.
+- **requestTestSource**  Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''.
+- **requestUid**  A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''.
+
+
+### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config
+
+This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+## Migration events
+
+### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr
+
+This event returns data to track the count of the migration objects across various phases during feature update.
+
+
+
+### Microsoft.Windows.MigrationCore.MigObjectCountKFSys
+
+This event returns data about the count of the migration objects across various phases during feature update.
+
+
+
+### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr
+
+This event returns data to track the count of the migration objects across various phases during feature update.
+
+
+
 ## Miracast events
 
 ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd
@@ -4120,26 +4535,43 @@ The following fields are available:
 - **threadId**  The ID of the thread the activity was run on.
 
 
+## Privacy logging notification events
+
+### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted
+
+This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue.
+
+The following fields are available:
+
+- **cleanupTask**  Indicates whether the task that launched the dialog should be cleaned up.
+- **cleanupTaskResult**  The return code of the attempt to clean up the task used to show the dialog.
+- **deviceEvaluated**  Indicates whether the device was eligible for evaluation of a known issue.
+- **deviceImpacted**  Indicates whether the device was impacted by a known issue.
+- **modalAction**  The action the user took on the dialog that was presented to them.
+- **modalResult**  The return code of the attempt to show a dialog to the user explaining the issue.
+- **resetSettingsResult**  The return code of the action to correct the known issue.
+
+
 ## Remediation events
 
 ### Microsoft.Windows.Remediation.Applicable
 
-This event indicates a remedial plug-in is applicable if/when such a plug-in is detected. This is used to ensure Windows is up to date.
+deny
 
 The following fields are available:
 
 - **ActionName**  The name of the action to be taken by the plug-in.
-- **AppraiserBinariesValidResult**  Indicates whether plug-in was appraised as valid.
+- **AppraiserBinariesValidResult**  Indicates whether the plug-in was appraised as valid.
 - **AppraiserDetectCondition**  Indicates whether the plug-in passed the appraiser's check.
 - **AppraiserRegistryValidResult**  Indicates whether the registry entry checks out as valid.
 - **AppraiserTaskDisabled**  Indicates the appraiser task is disabled.
 - **AppraiserTaskValidFailed**  Indicates the Appraiser task did not function and requires intervention.
 - **CV**  Correlation vector
 - **DateTimeDifference**  The difference between local and reference clock times.
-- **DateTimeSyncEnabled**  Indicates whether the datetime sync plug-in is enabled.
+- **DateTimeSyncEnabled**  Indicates whether the Datetime Sync plug-in is enabled.
 - **DaysSinceLastSIH**  The number of days since the most recent SIH executed.
 - **DaysToNextSIH**  The number of days until the next scheduled SIH execution.
-- **DetectedCondition**  Indicates whether detect condition is true and the perform action will be run.
+- **DetectedCondition**  Indicates whether detected condition is true and the perform action will be run.
 - **EvalAndReportAppraiserBinariesFailed**  Indicates the EvalAndReportAppraiserBinaries event failed.
 - **EvalAndReportAppraiserRegEntries**  Indicates the EvalAndReportAppraiserRegEntriesFailed event failed.
 - **EvalAndReportAppraiserRegEntriesFailed**  Indicates the EvalAndReportAppraiserRegEntriesFailed event failed.
@@ -4153,12 +4585,12 @@ The following fields are available:
 - **PackageVersion**  The version of the current remediation package.
 - **PluginName**  Name of the plugin specified for each generic plugin event.
 - **Reload**  True if SIH reload is required.
-- **RemediationNoisyHammerAcLineStatus**  Event that indicates the AC Line Status of the machine.
+- **RemediationNoisyHammerAcLineStatus**  Indicates the AC Line Status of the device.
 - **RemediationNoisyHammerAutoStartCount**  The number of times hammer auto-started.
 - **RemediationNoisyHammerCalendarTaskEnabled**  Event that indicates Update Assistant Calendar Task is enabled.
 - **RemediationNoisyHammerCalendarTaskExists**  Event that indicates an Update Assistant Calendar Task exists.
 - **RemediationNoisyHammerCalendarTaskTriggerEnabledCount**  Event that indicates calendar triggers are enabled in the task.
-- **RemediationNoisyHammerDaysSinceLastTaskRunTime**  The number of days since the most recent hammer task ran.
+- **RemediationNoisyHammerDaysSinceLastTaskRunTime**  The number of days since the most recent Noisy Hammer task ran.
 - **RemediationNoisyHammerGetCurrentSize**  Size in MB of the $GetCurrent folder.
 - **RemediationNoisyHammerIsInstalled**  TRUE if the noisy hammer is installed.
 - **RemediationNoisyHammerLastTaskRunResult**  The result of the last hammer task run.
@@ -4172,7 +4604,7 @@ The following fields are available:
 - **RemediationNoisyHammerUserLoggedInAdmin**  TRUE if there is the user currently logged in is an Admin.
 - **RemediationShellDeviceManaged**  TRUE if the device is WSUS managed or Windows Updated disabled.
 - **RemediationShellDeviceNewOS**  TRUE if the device has a recently installed OS.
-- **RemediationShellDeviceSccm**  TRUE if the device is managed by SCCM (Microsoft System Center Configuration Manager).
+- **RemediationShellDeviceSccm**  TRUE if the device is managed by Microsoft Endpoint Configuration Manager.
 - **RemediationShellDeviceZeroExhaust**  TRUE if the device has opted out of Windows Updates completely.
 - **RemediationTargetMachine**  Indicates whether the device is a target of the specified fix.
 - **RemediationTaskHealthAutochkProxy**  True/False based on the health of the AutochkProxy task.
@@ -4228,7 +4660,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Remediation.Completed
 
-This event enables completion tracking of a process that remediates issues preventing security and quality updates.
+This event is sent when Windows Update sediment remediations have completed on the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates.
 
 The following fields are available:
 
@@ -4246,12 +4678,12 @@ The following fields are available:
 - **CV**  The Correlation Vector.
 - **DateTimeDifference**  The difference between the local and reference clocks.
 - **DaysSinceOsInstallation**  The number of days since the installation of the Operating System.
-- **DiskMbCleaned**  The amount of space cleaned on the hard disk, measured in Megabytes.
+- **DiskMbCleaned**  The amount of space cleaned on the hard disk, measured in megabytes.
 - **DiskMbFreeAfterCleanup**  The amount of free hard disk space after cleanup, measured in Megabytes.
 - **DiskMbFreeBeforeCleanup**  The amount of free hard disk space before cleanup, measured in Megabytes.
 - **ForcedAppraiserTaskTriggered**  TRUE if Appraiser task ran from the plug-in.
 - **GlobalEventCounter**  Client-side counter that indicates ordering of events sent by the active user.
-- **HandlerCleanupFreeDiskInMegabytes**  The amount of hard disk space cleaned by the storage sense handlers, measured in Megabytes.
+- **HandlerCleanupFreeDiskInMegabytes**  The amount of hard disk space cleaned by the storage sense handlers, measured in megabytes.
 - **hasRolledBack**  Indicates whether the client machine has rolled back.
 - **hasUninstalled**  Indicates whether the client machine has uninstalled a later version of the OS.
 - **hResult**  The result of the event execution.
@@ -4316,7 +4748,7 @@ The following fields are available:
 - **ServiceHealthInstalledBitMap**  List of services installed by the plugin.
 - **ServiceHealthPlugin**  The nae of the Service Health plug-in.
 - **StartComponentCleanupTask**  TRUE if the Component Cleanup task started successfully.
-- **systemDriveFreeDiskSpace**  Indicates the free disk space on system drive in MBs.
+- **systemDriveFreeDiskSpace**  Indicates the free disk space on system drive, in megabytes.
 - **systemUptimeInHours**  Indicates the amount of time the system in hours has been on since the last boot.
 - **TotalSizeofOrphanedInstallerFilesInMegabytes**  The size of any orphaned Windows Installer files, measured in Megabytes.
 - **TotalSizeofStoreCacheAfterCleanupInMegabytes**  The size of the Microsoft Store cache after cleanup, measured in Megabytes.
@@ -4331,7 +4763,7 @@ The following fields are available:
 - **usoScanIsNetworkMetered**  TRUE if the device is currently connected to a metered network.
 - **usoScanIsNoAutoUpdateKeyPresent**  TRUE if no Auto Update registry key is set/present.
 - **usoScanIsUserLoggedOn**  TRUE if the user is logged on.
-- **usoScanPastThreshold**  TRUE if the most recent USO (Update Session Orchestrator) scan is past the threshold (late).
+- **usoScanPastThreshold**  TRUE if the most recent Update Session Orchestrator (USO) scan is past the threshold (late).
 - **usoScanType**  The type of USO (Update Session Orchestrator) scan: "Interactive" or "Background".
 - **windows10UpgraderBlockWuUpdates**  Event to report the value of Windows 10 Upgrader BlockWuUpdates Key.
 - **windowsEditionId**  Event to report the value of Windows Edition ID.
@@ -4365,13 +4797,13 @@ The following fields are available:
 
 ### Microsoft.Windows.Remediation.Started
 
-This event reports whether a plug-in started, to help ensure Windows is up to date.
+This event is sent when Windows Update sediment remediations have started on the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates.
 
 The following fields are available:
 
 - **CV**  Correlation vector.
 - **GlobalEventCounter**  Client side counter which indicates ordering of events sent by this user.
-- **PackageVersion**  Current package version of Remediation.
+- **PackageVersion**  The version of the current remediation package.
 - **PluginName**  Name of the plugin specified for each generic plugin event.
 - **Result**  This is the HRESULT for detection or perform action phases of the plugin.
 - **RunCount**  The number of times the remediation event started (whether it completed successfully or not).
@@ -4598,7 +5030,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentLauncher.Applicable
 
-Indicates whether a given plugin is applicable.
+This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -4614,7 +5046,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentLauncher.Completed
 
-Indicates whether a given plugin has completed its work.
+This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -4629,7 +5061,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentLauncher.Started
 
-This event indicates that a given plug-in has started.
+This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -4642,7 +5074,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentService.Applicable
 
-This event indicates whether a given plug-in is applicable.
+This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -4658,7 +5090,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentService.Completed
 
-This event indicates whether a given plug-in has completed its work.
+This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -4680,7 +5112,7 @@ The following fields are available:
 
 ### Microsoft.Windows.SedimentService.Started
 
-This event indicates a specified plug-in has started. This information helps ensure Windows is up to date.
+This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
 
 The following fields are available:
 
@@ -4807,6 +5239,12 @@ The following fields are available:
 
 ## SIH events
 
+### SIHEngineTelemetry.ExecuteAction
+
+This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot.
+
+
+
 ### SIHEngineTelemetry.SLSActionData
 
 This event reports if the SIH client was able to successfully parse the manifest describing the actions to be evaluated.
@@ -4934,7 +5372,7 @@ The following fields are available:
 - **FlightId**  The specific id of the flight the device is getting
 - **HandlerType**  Indicates the kind of content (app, driver, windows patch, etc.)
 - **RevisionNumber**  Identifies the revision number of this specific piece of content
-- **ServiceGuid**  Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc)
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
 - **SystemBIOSMajorRelease**  Major release version of the system bios
 - **SystemBIOSMinorRelease**  Minor release version of the system bios
 - **UpdateId**  Identifier associated with the specific piece of content
@@ -4997,7 +5435,7 @@ The following fields are available:
 - **RelatedCV**  The Correlation Vector that was used before the most recent change to a new Correlation Vector.
 - **RepeatFailFlag**  Indicates whether this specific piece of content had previously failed to download.
 - **RevisionNumber**  The revision number of the specified piece of content.
-- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
 - **Setup360Phase**  Identifies the active phase of the upgrade download if the current download is for an Operating System upgrade.
 - **ShippingMobileOperator**  The mobile operator linked to the device when the device shipped.
 - **StatusCode**  Indicates the result of a Download event (success, cancellation, failure code HResult).
@@ -5157,28 +5595,111 @@ The following fields are available:
 - **CallerApplicationName**  Name of application making the Windows Update request. Used to identify context of request.
 - **EndpointUrl**  The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
 - **EventScenario**  The purpose of this event, such as scan started, scan succeeded, or scan failed.
-- **ExtendedStatusCode**  The secondary status code of the event.
+- **ExtendedStatusCode**  Secondary status code for certain scenarios where StatusCode was not specific enough.
 - **LeafCertId**  The integral ID from the FragmentSigning data for the certificate that failed.
 - **ListOfSHA256OfIntermediateCerData**  A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
 - **MetadataIntegrityMode**  The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
-- **MetadataSignature**  Base64 string of the signature associated with the update metadata (specified by revision id)
+- **MetadataSignature**  A base64-encoded string of the signature associated with the update metadata (specified by revision ID).
 - **RawMode**  The raw unparsed mode string from the SLS response. This field is null if not applicable.
 - **RawValidityWindowInDays**  The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable.
-- **RevisionId**  Identifies the revision of this specific piece of content
-- **RevisionNumber**  Identifies the revision number of this specific piece of content
+- **RevisionId**  The revision ID for a specific piece of content.
+- **RevisionNumber**  The revision number for a specific piece of content.
 - **ServiceGuid**  Identifies the service to which the software distribution client is connected, Example: Windows Update or Microsoft Store
 - **SHA256OfLeafCerData**  A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate.
-- **SHA256OfLeafCertPublicKey**  Base64 encoding of hash of the Base64CertData in the FragmentSigning data of leaf certificate.
+- **SHA256OfLeafCertPublicKey**  A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate.
 - **SHA256OfTimestampToken**  An encoded string of the timestamp token.
-- **SignatureAlgorithm**  Hash algorithm for the metadata signature
+- **SignatureAlgorithm**  The hash algorithm for the metadata signature.
 - **SLSPrograms**  A test program to which a device may have opted in. Example: Insider Fast
-- **StatusCode**  The status code of the event.
+- **StatusCode**  Result code of the event (success, cancellation, failure code HResult).
 - **TimestampTokenCertThumbprint**  The thumbprint of the encoded timestamp token.
 - **TimestampTokenId**  The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed.
-- **UpdateId**  Identifier associated with the specific piece of content
+- **UpdateId**  The update ID for a specific piece of content.
 - **ValidityWindowInDays**  The validity window that's in effect when verifying the timestamp.
 
 
+## Update Assistant events
+
+### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId
+
+The event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies.
+
+The following fields are available:
+
+- **ApplicabilityBlockedReason**  Blocked due to an applicability issue.
+- **BlockWuUpgrades**  The upgrade assistant is currently blocked.
+- **clientID**  An identification of the current release of Update Assistant.
+- **CloverTrail**  This device is Clovertrail.
+- **DeviceIsMdmManaged**  This device is MDM managed.
+- **IsNetworkAvailable**  If the device network is not available.
+- **IsNetworkMetered**  If network is metered.
+- **IsSccmManaged**  This device is SCCM managed.
+- **NewlyInstalledOs**  OS is newly installed quiet period.
+- **PausedByPolicy**  Updates are paused by policy.
+- **RecoveredFromRS3**  Previously recovered from RS3.
+- **RS1UninstallActive**  Blocked due to an active RS1 uninstall.
+- **RS3RollBacks**  Exceeded number of allowable RS3 rollbacks.
+- **triggerTaskSource**  Describe which task launches this instance.
+- **WsusManaged**  This device is WSUS managed.
+- **ZeroExhaust**  This device is zero exhaust.
+
+
+### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId
+
+The event sends basic info when a device was blocked or prevented from updating to the latest Windows 10 version.
+
+The following fields are available:
+
+- **clientID**  An identification of the current release of Update Assistant.
+- **denyReason**  All the reasons why the Update Assistant was prevented from launching. Bitmask with values from UpdateAssistant.cpp eUpgradeModeReason.
+- **triggerTaskSource**  Describe which task launches this instance.
+
+
+### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId
+
+Event to mark that Update Assistant Orchestrator failed to launch Update Assistant.
+
+The following fields are available:
+
+- **calendarRun**  Standard time-based triggered task.
+- **clientID**  An identification of the current release of Update Assistant.
+- **hResult**  Error code of the Update Assistant Orchestrator failure.
+- **triggerTaskSource**  Describe which task launches this instance.
+
+
+### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId
+
+Event indicating One Settings was not queried by update assistant.
+
+The following fields are available:
+
+- **clientID**  An identification of the current release of Update Assistant.
+- **hResult**  Error code of One Settings query failure.
+
+
+### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId
+
+This event sends basic information on whether the device should be updated to the latest Windows 10 version.
+
+The following fields are available:
+
+- **autoStartRunCount**  The auto start run count of Update Assistant.
+- **clientID**  The ID of the current release of Update Assistant.
+- **launchMode**  Indicates the type of launch performed.
+- **launchTypeReason**  A bitmask of all the reasons for type of launch.
+- **triggerTaskSource**  Indicates which task launches this instance.
+
+
+### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId
+
+The event sends basic info on whether the Windows 10 update notification has previously launched.
+
+The following fields are available:
+
+- **clientID**  ID of the current release of Update Assistant.
+- **restoreReason**  All the reasons for the restore.
+- **triggerTaskSource**  Indicates which task launches this instance.
+
+
 ## Update events
 
 ### Update360Telemetry.Revert
@@ -5592,7 +6113,7 @@ The following fields are available:
 
 ### FacilitatorTelemetry.DCATDownload
 
-This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure.
+This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure.
 
 The following fields are available:
 
@@ -5630,7 +6151,7 @@ The following fields are available:
 
 ### Setup360Telemetry.Downlevel
 
-This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure.
+This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure.
 
 The following fields are available:
 
@@ -5988,7 +6509,7 @@ The following fields are available:
 - **PertProb**  Constant used in algorithm for randomization.
 
 
-## Microsoft Store events
+## Windows Store events
 
 ### Microsoft.Windows.Store.StoreActivating
 
@@ -6089,6 +6610,7 @@ The following fields are available:
 
 - **AggregatedPackageFullNames**  Includes a set of package full names for each app that is part of an atomic set.
 - **AttemptNumber**  The total number of attempts to acquire this product.
+- **BundleId**  The bundle ID
 - **CategoryId**  The identity of the package or packages being installed.
 - **ClientAppId**  The identity of the app that initiated this operation.
 - **HResult**  HResult code to show the result of the operation (success/failure).
@@ -6098,6 +6620,7 @@ The following fields are available:
 - **IsRemediation**  Is this repairing a previous installation?
 - **IsRestore**  Is this happening after a device restore?
 - **IsUpdate**  Is this an update?
+- **ParentBundleId**  The parent bundle ID (if it's part of a bundle).
 - **PFN**  Product Family Name of the product being installed.
 - **ProductId**  The Store Product ID for the product being installed.
 - **SystemAttemptNumber**  The number of attempts by the system to acquire this product.
@@ -7039,6 +7562,19 @@ The following fields are available:
 - **wuDeviceid**  The unique device ID used by Windows Update.
 
 
+### Microsoft.Windows.Update.Orchestrator.DetectionResult
+
+This event runs when an update is detected. This helps ensure Windows is kept up to date.
+
+The following fields are available:
+
+- **applicableUpdateIdList**  A list of applicable update IDs.
+- **applicableUpdateList**  A list of applicable update names.
+- **seekerUpdateIdList**  A list of optional update IDs.
+- **seekerUpdateList**  A list of optional update names.
+- **wuDeviceid**  The Windows Update device identifier.
+
+
 ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded
 
 This event indicates the reboot was postponed due to needing a display.
@@ -7351,6 +7887,32 @@ The following fields are available:
 - **wuDeviceid**  Unique device ID used by Windows Update.
 
 
+### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable
+
+This event defines when an optional update is available for the device to help keep Windows up to date.
+
+The following fields are available:
+
+- **flightID**  The unique identifier of the Windows Insider build on this device.
+- **isFeatureUpdate**  Indicates whether the update is a Feature Update.
+- **revisionNumber**  The revision number of the update.
+- **updateId**  The GUID (Globally Unique Identifier) of the update.
+- **wuDeviceid**  The Windows Update device identifier.
+
+
+### Microsoft.Windows.Update.Orchestrator.SeekUpdate
+
+This event occurs when user initiates "seeker" scan. This helps keep Windows up to date.
+
+The following fields are available:
+
+- **flightID**  The ID of the Windows Insider builds on the device.
+- **isFeatureUpdate**  Indicates that the target of the Seek is a feature update.
+- **revisionNumber**  The revision number of the update.
+- **updateId**  The identifier of the update.
+- **wuDeviceid**  The Windows Update device identifier.
+
+
 ### Microsoft.Windows.Update.Orchestrator.SystemNeeded
 
 This event sends data about why a device is unable to reboot, to help keep Windows up to date.
@@ -7646,6 +8208,12 @@ This event is sent when the Update Reserve Manager returns an error from one of
 
 
 
+### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager
+
+This event returns data about the Update Reserve Manager, including whether it’s been initialized.
+
+
+
 ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization
 
 This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot.
diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md
index f8a042ef3d..8048327d37 100644
--- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md
+++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md
@@ -7,13 +7,14 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.pagetype: security
 localizationpriority: high
-audience: ITPro
 author: brianlic-msft
 ms.author: brianlic
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
-ms.date: 02/15/2019
+audience: ITPro
+ms.date: 01/04/2020
+ms.reviewer:
 ---
 
 
@@ -33,6 +34,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th
 You can learn more about Windows functional and diagnostic data through these articles:
 
 
+- [Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1903.md)
 - [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
 - [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
 - [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
@@ -80,7 +82,7 @@ Automatically closed activity for start/stop operations that aren't explicitly c
 
 ### Microsoft.Windows.Security.AppLockerCSP.AddParams
 
-Parameters passed to Add function of the AppLockerCSP Node.
+This event indicates the parameters passed to the Add function of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -90,13 +92,13 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.AddStart
 
-Start of "Add" Operation for the AppLockerCSP Node.
+This event indicates the start of an Add operation for the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 
 
 ### Microsoft.Windows.Security.AppLockerCSP.AddStop
 
-End of "Add" Operation for AppLockerCSP Node.
+This event indicates the end of an Add operation for the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -105,7 +107,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.CAppLockerCSP::Rollback
 
-Result of the 'Rollback' operation in AppLockerCSP.
+This event provides the result of the Rollback operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -115,7 +117,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.ClearParams
 
-Parameters passed to the "Clear" operation for AppLockerCSP.
+This event provides the parameters passed to the Clear operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -124,13 +126,13 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.ClearStart
 
-Start of the "Clear" operation for the AppLockerCSP Node.
+This event indicates the start of the Clear operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 
 
 ### Microsoft.Windows.Security.AppLockerCSP.ClearStop
 
-End of the "Clear" operation for the AppLockerCSP node.
+This event indicates the end of the Clear operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -139,7 +141,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.ConfigManagerNotificationStart
 
-Start of the "ConfigManagerNotification" operation for AppLockerCSP.
+This event indicates the start of the Configuration Manager Notification operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -148,7 +150,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.ConfigManagerNotificationStop
 
-End of the "ConfigManagerNotification" operation for AppLockerCSP.
+This event indicates the end of the Configuration Manager Notification operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -157,7 +159,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.CreateNodeInstanceParams
 
-Parameters passed to the CreateNodeInstance function of the AppLockerCSP node.
+This event provides the parameters that were passed to the Create Node Instance operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -168,13 +170,13 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.CreateNodeInstanceStart
 
-Start of the "CreateNodeInstance" operation for the AppLockerCSP node.
+This event indicates the start of the Create Node Instance operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 
 
 ### Microsoft.Windows.Security.AppLockerCSP.CreateNodeInstanceStop
 
-End of the "CreateNodeInstance" operation for the AppLockerCSP node
+This event indicates the end of the Create Node Instance operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -183,7 +185,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.DeleteChildParams
 
-Parameters passed to the DeleteChild function of the AppLockerCSP node.
+This event provides the parameters passed to the Delete Child operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -193,13 +195,13 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.DeleteChildStart
 
-Start of the "DeleteChild" operation for the AppLockerCSP node.
+This event indicates the start of the Delete Child operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 
 
 ### Microsoft.Windows.Security.AppLockerCSP.DeleteChildStop
 
-End of the "DeleteChild" operation for the AppLockerCSP node.
+This event indicates the end of the Delete Child operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -208,7 +210,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.EnumPolicies
 
-Logged URI relative to %SYSTEM32%\AppLocker, if the Plugin GUID is null, or the CSP doesn't believe the old policy is present.
+This event provides the logged Uniform Resource Identifier (URI) relative to %SYSTEM32%\AppLocker if the plug-in GUID is null or the Configuration Service Provider (CSP) doesn't believe the old policy is present.
 
 The following fields are available:
 
@@ -217,7 +219,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.GetChildNodeNamesParams
 
-Parameters passed to the GetChildNodeNames function of the AppLockerCSP node.
+This event provides the parameters passed to the Get Child Node Names operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -226,13 +228,13 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.GetChildNodeNamesStart
 
-Start of the "GetChildNodeNames" operation for the AppLockerCSP node.
+This event indicates the start of the Get Child Node Names operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 
 
 ### Microsoft.Windows.Security.AppLockerCSP.GetChildNodeNamesStop
 
-End of the "GetChildNodeNames" operation for the AppLockerCSP node.
+This event indicates the end of the Get Child Node Names operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -243,7 +245,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.GetLatestId
 
-The result of 'GetLatestId' in AppLockerCSP (the latest time stamped GUID).
+This event provides the latest time-stamped unique identifier in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -253,7 +255,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.HResultException
 
-HRESULT thrown by any arbitrary function in AppLockerCSP.
+This event provides the result code (HRESULT) generated by any arbitrary function in the AppLocker Configuration Service Provider (CSP).
 
 The following fields are available:
 
@@ -265,7 +267,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.SetValueParams
 
-Parameters passed to the SetValue function of the AppLockerCSP node.
+This event provides the parameters that were passed to the SetValue operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 The following fields are available:
 
@@ -275,7 +277,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.SetValueStart
 
-Start of the "SetValue" operation for the AppLockerCSP node.
+This event indicates the start of the SetValue operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
 
 
 
@@ -290,7 +292,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Security.AppLockerCSP.TryRemediateMissingPolicies
 
-EntryPoint of fix step or policy remediation, includes URI relative to %SYSTEM32%\AppLocker that needs to be fixed.
+This event provides information for fixing a policy in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. It includes Uniform Resource Identifier (URI) relative to %SYSTEM32%\AppLocker that needs to be fixed.
 
 The following fields are available:
 
@@ -308,9 +310,12 @@ The following fields are available:
 - **DatasourceApplicationFile_19ASetup**  The count of the number of this particular object type present on this device.
 - **DatasourceApplicationFile_19H1**  The count of the number of this particular object type present on this device.
 - **DatasourceApplicationFile_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceApplicationFile_20H1**  The count of the number of this particular object type present on this device.
+- **DatasourceApplicationFile_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DatasourceApplicationFile_RS1**  An ID for the system, calculated by hashing hardware identifiers.
 - **DatasourceApplicationFile_RS2**  An ID for the system, calculated by hashing hardware identifiers.
 - **DatasourceApplicationFile_RS3**  The count of the number of this particular object type present on this device.
+- **DatasourceApplicationFile_RS3Setup**  The count of the number of this particular object type present on this device.
 - **DatasourceApplicationFile_RS4**  The count of the number of this particular object type present on this device.
 - **DatasourceApplicationFile_RS4Setup**  The count of the number of this particular object type present on this device.
 - **DatasourceApplicationFile_RS5**  The count of the number of this particular object type present on this device.
@@ -320,6 +325,8 @@ The following fields are available:
 - **DatasourceDevicePnp_19ASetup**  The count of the number of this particular object type present on this device.
 - **DatasourceDevicePnp_19H1**  The count of the number of this particular object type present on this device.
 - **DatasourceDevicePnp_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_20H1**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DatasourceDevicePnp_RS1**  The total DataSourceDevicePnp objects targeting Windows 10 version 1607 on this device.
 - **DatasourceDevicePnp_RS2**  The count of the number of this particular object type present on this device.
 - **DatasourceDevicePnp_RS3**  The count of the number of this particular object type present on this device.
@@ -333,6 +340,8 @@ The following fields are available:
 - **DatasourceDriverPackage_19ASetup**  The count of the number of this particular object type present on this device.
 - **DatasourceDriverPackage_19H1**  The count of the number of this particular object type present on this device.
 - **DatasourceDriverPackage_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_20H1**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DatasourceDriverPackage_RS1**  The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device.
 - **DatasourceDriverPackage_RS2**  The total DataSourceDriverPackage objects targeting Windows 10, version 1703 on this device.
 - **DatasourceDriverPackage_RS3**  The count of the number of this particular object type present on this device.
@@ -346,9 +355,12 @@ The following fields are available:
 - **DataSourceMatchingInfoBlock_19ASetup**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoBlock_19H1**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoBlock_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_20H1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoBlock_RS1**  The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1607 on this device.
 - **DataSourceMatchingInfoBlock_RS2**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoBlock_RS3**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_RS3Setup**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoBlock_RS4**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoBlock_RS4Setup**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoBlock_RS5**  The count of the number of this particular object type present on this device.
@@ -358,9 +370,12 @@ The following fields are available:
 - **DataSourceMatchingInfoPassive_19ASetup**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPassive_19H1**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPassive_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_20H1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPassive_RS1**  The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device.
 - **DataSourceMatchingInfoPassive_RS2**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPassive_RS3**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_RS3Setup**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPassive_RS4**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPassive_RS4Setup**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPassive_RS5**  The count of the number of this particular object type present on this device.
@@ -370,9 +385,12 @@ The following fields are available:
 - **DataSourceMatchingInfoPostUpgrade_19ASetup**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPostUpgrade_19H1**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPostUpgrade_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPostUpgrade_20H1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPostUpgrade_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPostUpgrade_RS1**  The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device.
 - **DataSourceMatchingInfoPostUpgrade_RS2**  The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device.
 - **DataSourceMatchingInfoPostUpgrade_RS3**  The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS3Setup**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPostUpgrade_RS4**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPostUpgrade_RS4Setup**  The count of the number of this particular object type present on this device.
 - **DataSourceMatchingInfoPostUpgrade_RS5**  The count of the number of this particular object type present on this device.
@@ -382,6 +400,8 @@ The following fields are available:
 - **DatasourceSystemBios_19ASetup**  The count of the number of this particular object type present on this device.
 - **DatasourceSystemBios_19H1**  The count of the number of this particular object type present on this device.
 - **DatasourceSystemBios_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_20H1**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DatasourceSystemBios_RS1**  The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device.
 - **DatasourceSystemBios_RS2**  The total DatasourceSystemBios objects targeting Windows 10 version 1703 present on this device.
 - **DatasourceSystemBios_RS3**  The total DatasourceSystemBios objects targeting Windows 10 version 1709 present on this device.
@@ -395,9 +415,12 @@ The following fields are available:
 - **DecisionApplicationFile_19ASetup**  The count of the number of this particular object type present on this device.
 - **DecisionApplicationFile_19H1**  The count of the number of this particular object type present on this device.
 - **DecisionApplicationFile_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DecisionApplicationFile_RS1**  The count of the number of this particular object type present on this device.
 - **DecisionApplicationFile_RS2**  The count of the number of this particular object type present on this device.
 - **DecisionApplicationFile_RS3**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_RS3Setup**  The count of the number of this particular object type present on this device.
 - **DecisionApplicationFile_RS4**  The count of the number of this particular object type present on this device.
 - **DecisionApplicationFile_RS4Setup**  The count of the number of this particular object type present on this device.
 - **DecisionApplicationFile_RS5**  The count of the number of this particular object type present on this device.
@@ -407,6 +430,8 @@ The following fields are available:
 - **DecisionDevicePnp_19ASetup**  The count of the number of this particular object type present on this device.
 - **DecisionDevicePnp_19H1**  The count of the number of this particular object type present on this device.
 - **DecisionDevicePnp_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DecisionDevicePnp_RS1**  The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device.
 - **DecisionDevicePnp_RS2**  The count of the number of this particular object type present on this device.
 - **DecisionDevicePnp_RS3**  The count of the number of this particular object type present on this device.
@@ -420,6 +445,8 @@ The following fields are available:
 - **DecisionDriverPackage_19ASetup**  The count of the number of this particular object type present on this device.
 - **DecisionDriverPackage_19H1**  The count of the number of this particular object type present on this device.
 - **DecisionDriverPackage_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DecisionDriverPackage_RS1**  The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device.
 - **DecisionDriverPackage_RS2**  The count of the number of this particular object type present on this device.
 - **DecisionDriverPackage_RS3**  The count of the number of this particular object type present on this device.
@@ -433,9 +460,12 @@ The following fields are available:
 - **DecisionMatchingInfoBlock_19ASetup**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoBlock_19H1**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoBlock_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoBlock_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoBlock_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoBlock_RS1**  The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1607 present on this device.
 - **DecisionMatchingInfoBlock_RS2**  The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device.
 - **DecisionMatchingInfoBlock_RS3**  The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1709 present on this device.
+- **DecisionMatchingInfoBlock_RS3Setup**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoBlock_RS4**  The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1803 present on this device.
 - **DecisionMatchingInfoBlock_RS4Setup**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoBlock_RS5**  The count of the number of this particular object type present on this device.
@@ -445,9 +475,12 @@ The following fields are available:
 - **DecisionMatchingInfoPassive_19ASetup**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoPassive_19H1**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoPassive_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPassive_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPassive_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoPassive_RS1**  The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device.
 - **DecisionMatchingInfoPassive_RS2**  The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1703 on this device.
 - **DecisionMatchingInfoPassive_RS3**  The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1803 on this device.
+- **DecisionMatchingInfoPassive_RS3Setup**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoPassive_RS4**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoPassive_RS4Setup**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoPassive_RS5**  The count of the number of this particular object type present on this device.
@@ -457,9 +490,12 @@ The following fields are available:
 - **DecisionMatchingInfoPostUpgrade_19ASetup**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoPostUpgrade_19H1**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoPostUpgrade_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPostUpgrade_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPostUpgrade_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoPostUpgrade_RS1**  The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device.
 - **DecisionMatchingInfoPostUpgrade_RS2**  The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device.
 - **DecisionMatchingInfoPostUpgrade_RS3**  The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device.
+- **DecisionMatchingInfoPostUpgrade_RS3Setup**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoPostUpgrade_RS4**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoPostUpgrade_RS4Setup**  The count of the number of this particular object type present on this device.
 - **DecisionMatchingInfoPostUpgrade_RS5**  The count of the number of this particular object type present on this device.
@@ -469,9 +505,12 @@ The following fields are available:
 - **DecisionMediaCenter_19ASetup**  The count of the number of this particular object type present on this device.
 - **DecisionMediaCenter_19H1**  The count of the number of this particular object type present on this device.
 - **DecisionMediaCenter_19H1Setup**  The total DecisionMediaCenter objects targeting the next release of Windows on this device.
+- **DecisionMediaCenter_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionMediaCenter_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DecisionMediaCenter_RS1**  The total DecisionMediaCenter objects targeting Windows 10 version 1607 present on this device.
 - **DecisionMediaCenter_RS2**  The total DecisionMediaCenter objects targeting Windows 10 version 1703 present on this device.
 - **DecisionMediaCenter_RS3**  The total DecisionMediaCenter objects targeting Windows 10 version 1709 present on this device.
+- **DecisionMediaCenter_RS3Setup**  The count of the number of this particular object type present on this device.
 - **DecisionMediaCenter_RS4**  The total DecisionMediaCenter objects targeting Windows 10 version 1803 present on this device.
 - **DecisionMediaCenter_RS4Setup**  The count of the number of this particular object type present on this device.
 - **DecisionMediaCenter_RS5**  The count of the number of this particular object type present on this device.
@@ -481,6 +520,8 @@ The following fields are available:
 - **DecisionSystemBios_19ASetup**  The total DecisionSystemBios objects targeting the next release of Windows on this device.
 - **DecisionSystemBios_19H1**  The count of the number of this particular object type present on this device.
 - **DecisionSystemBios_19H1Setup**  The total DecisionSystemBios objects targeting the next release of Windows on this device.
+- **DecisionSystemBios_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionSystemBios_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DecisionSystemBios_RS1**  The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device.
 - **DecisionSystemBios_RS2**  The total DecisionSystemBios objects targeting Windows 10 version 1703 on this device.
 - **DecisionSystemBios_RS3**  The total DecisionSystemBios objects targeting Windows 10 version 1709 on this device.
@@ -492,6 +533,7 @@ The following fields are available:
 - **DecisionSystemBios_TH1**  The count of the number of this particular object type present on this device.
 - **DecisionSystemBios_TH2**  The count of the number of this particular object type present on this device.
 - **DecisionSystemProcessor_RS2**  The count of the number of this particular object type present on this device.
+- **DecisionTest_20H1Setup**  The count of the number of this particular object type present on this device.
 - **DecisionTest_RS1**  An ID for the system, calculated by hashing hardware identifiers.
 - **InventoryApplicationFile**  The count of the number of this particular object type present on this device.
 - **InventoryDeviceContainer**  A count of device container objects in cache.
@@ -519,9 +561,12 @@ The following fields are available:
 - **Wmdrm_19ASetup**  The count of the number of this particular object type present on this device.
 - **Wmdrm_19H1**  The count of the number of this particular object type present on this device.
 - **Wmdrm_19H1Setup**  The total Wmdrm objects targeting the next release of Windows on this device.
+- **Wmdrm_20H1**  The count of the number of this particular object type present on this device.
+- **Wmdrm_20H1Setup**  The count of the number of this particular object type present on this device.
 - **Wmdrm_RS1**  An ID for the system, calculated by hashing hardware identifiers.
 - **Wmdrm_RS2**  An ID for the system, calculated by hashing hardware identifiers.
 - **Wmdrm_RS3**  An ID for the system, calculated by hashing hardware identifiers.
+- **Wmdrm_RS3Setup**  The count of the number of this particular object type present on this device.
 - **Wmdrm_RS4**  The total Wmdrm objects targeting Windows 10, version 1803 present on this device.
 - **Wmdrm_RS4Setup**  The count of the number of this particular object type present on this device.
 - **Wmdrm_RS5**  The count of the number of this particular object type present on this device.
@@ -544,7 +589,7 @@ The following fields are available:
 - **HasCitData**  Indicates whether the file is present in CIT data.
 - **HasUpgradeExe**  Indicates whether the anti-virus app has an upgrade.exe file.
 - **IsAv**  Is the file an anti-virus reporting EXE?
-- **ResolveAttempted**  This will always be an empty string when sending telemetry.
+- **ResolveAttempted**  This will always be an empty string when sending diagnostic data.
 - **SdbEntries**  An array of fields that indicates the SDB entries that apply to this file.
 
 
@@ -624,6 +669,17 @@ The following fields are available:
 - **AppraiserVersion**  The version of the appraiser file generating the events.
 
 
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove
+
+This event indicates that the DatasourceDriverPackage object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
 ### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync
 
 This event indicates that a new set of DatasourceDriverPackageAdd events will be sent.
@@ -637,13 +693,14 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
 
-This event sends blocking data about any compatibility blocking entries hit on the system that are not directly related to specific applications or devices, to help keep Windows up-to-date.
+This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
 The following fields are available:
 
 - **AppraiserVersion**  The version of the appraiser file generating the events.
+- **ResolveAttempted**  This will always be an empty string when sending diagnostic data.
 
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockRemove
@@ -670,7 +727,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
 
-This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -703,7 +760,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
 
-This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up-to-date.
+This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -736,7 +793,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
 
-This event sends compatibility database information about the BIOS to help keep Windows up-to-date.
+This event sends compatibility database information about the BIOS to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -769,7 +826,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd
 
-This event sends compatibility decision data about a file to help keep Windows up-to-date.
+This event sends compatibility decision data about a file to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -784,7 +841,7 @@ The following fields are available:
 - **HasUxBlockOverride**  Does the file have a block that is overridden by a tag in the SDB?
 - **MigApplication**  Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode?
 - **MigRemoval**  Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade?
-- **NeedsDismissAction**  Will the file cause an action that can be dimissed?
+- **NeedsDismissAction**  Will the file cause an action that can be dismissed?
 - **NeedsInstallPostUpgradeData**  After upgrade, the file will have a post-upgrade notification to install a replacement for the app.
 - **NeedsNotifyPostUpgradeData**  Does the file have a notification that should be shown after upgrade?
 - **NeedsReinstallPostUpgradeData**  After upgrade, this file will have a post-upgrade notification to reinstall the app.
@@ -799,7 +856,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
 
-This event indicates Indicates that the DecisionApplicationFile object is no longer present.
+This event indicates that the DecisionApplicationFile object is no longer present.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -821,7 +878,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
 
-This event sends compatibility decision data about a PNP device to help keep Windows up to date.
+This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -919,10 +976,12 @@ The following fields are available:
 - **AppraiserVersion**  The version of the appraiser file generating the events.
 - **BlockingApplication**  Are there are any application issues that interfere with upgrade due to matching info blocks?
 - **DisplayGenericMessage**  Will a generic message be shown for this block?
+- **NeedsDismissAction**  Will the file cause an action that can be dismissed?
 - **NeedsUninstallAction**  Does the user need to take an action in setup due to a matching info block?
 - **SdbBlockUpgrade**  Is a matching info block blocking upgrade?
 - **SdbBlockUpgradeCanReinstall**  Is a matching info block blocking upgrade, but has the can reinstall tag?
 - **SdbBlockUpgradeUntilUpdate**  Is a matching info block blocking upgrade but has the until update tag?
+- **SdbReinstallUpgradeWarn**  The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade.
 
 
 ### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockRemove
@@ -1151,7 +1210,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
 
-This event indicates indicates that a new set of InventoryApplicationFileAdd events will be sent.
+This event indicates that a new set of InventoryApplicationFileAdd events will be sent.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -1273,7 +1332,7 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
 
 The following fields are available:
 
-- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **AppraiserVersion**  The version of the Appraiser binary (executable) generating the events.
 
 
 ### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
@@ -1341,7 +1400,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
 
-This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up-to-date.
+This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -1416,7 +1475,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
 
-This event sends data indicating whether the system supports the LahfSahf CPU requirement, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -1451,7 +1510,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
 
-This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up-to-date.
+This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -1662,7 +1721,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.SystemWlanAdd
 
-This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up-to-date.
+This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -1701,18 +1760,18 @@ The following fields are available:
 
 ### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
 
-This event indicates the parameters and result of a telemetry (diagnostic) run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
+This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
 
 The following fields are available:
 
 - **AppraiserBranch**  The source branch in which the version of Appraiser that is running was built.
-- **AppraiserDataVersion**  The version of the data files being used by the Appraiser telemetry run.
+- **AppraiserDataVersion**  The version of the data files being used by the Appraiser diagnostic data run.
 - **AppraiserProcess**  The name of the process that launched Appraiser.
 - **AppraiserVersion**  The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
 - **AuxFinal**  Obsolete, always set to false.
 - **AuxInitial**  Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
 - **DeadlineDate**  A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
-- **EnterpriseRun**  Indicates if the telemetry run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
+- **EnterpriseRun**  Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
 - **FullSync**  Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
 - **InboxDataVersion**  The original version of the data files before retrieving any newer version.
 - **IndicatorsWritten**  Indicates if all relevant UEX indicators were successfully written or updated.
@@ -1721,18 +1780,19 @@ The following fields are available:
 - **PerfBackoff**  Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
 - **PerfBackoffInsurance**  Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
 - **RunAppraiser**  Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
-- **RunDate**  The date that the telemetry run was stated, expressed as a filetime.
-- **RunGeneralTel**  Indicates if the generaltel.dll component was run. Generaltel collects additional telemetry on an infrequent schedule and only from machines at telemetry levels higher than Basic.
+- **RunDate**  The date that the diagnostic data run was stated, expressed as a filetime.
+- **RunGeneralTel**  Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic.
 - **RunOnline**  Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
-- **RunResult**  The hresult of the Appraiser telemetry run.
+- **RunResult**  The hresult of the Appraiser diagnostic data run.
 - **ScheduledUploadDay**  The day scheduled for the upload.
-- **SendingUtc**  Indicates if the Appraiser client is sending events during the current telemetry run.
+- **SendingUtc**  Indicates whether the Appraiser client is sending events during the current diagnostic data run.
 - **StoreHandleIsNotNull**  Obsolete, always set to false
-- **TelementrySent**  Indicates if telemetry was successfully sent.
-- **ThrottlingUtc**  Indicates if the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also telemetry reliability.
+- **TelementrySent**  Indicates whether diagnostic data was successfully sent.
+- **ThrottlingUtc**  Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability.
 - **Time**  The client time of the event.
 - **VerboseMode**  Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
 - **WhyFullSyncWithoutTablePrefix**  Indicates the reason or reasons that a full sync was generated.
+- **WhyRunSkipped**  Indicates the reason or reasons that an appraiser run was skipped.
 
 
 ### Microsoft.Windows.Appraiser.General.WmdrmAdd
@@ -1776,11 +1836,52 @@ The following fields are available:
 - **AppraiserVersion**  The version of the Appraiser file that is generating the events.
 
 
+## Audio endpoint events
+
+### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo
+
+This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint.
+
+The following fields are available:
+
+- **BusEnumeratorName**  The name of the bus enumerator (for example, HDAUDIO or USB).
+- **ContainerId**  An identifier that uniquely groups the functional devices associated with a single-function or multifunction device.
+- **DeviceInstanceId**  The unique identifier for this instance of the device.
+- **EndpointDevnodeId**  The IMMDevice identifier of the associated devnode.
+- **EndpointFormFactor**  The enumeration value for the form factor of the endpoint device (for example speaker, microphone, remote  network device).
+- **endpointID**  The unique identifier for the audio endpoint.
+- **endpointInstanceId**  The unique identifier for the software audio endpoint. Used for joining to other audio event.
+- **Flow**  Indicates whether the endpoint is capture (1) or render (0).
+- **HWID**  The hardware identifier for the endpoint.
+- **IsBluetooth**  Indicates whether the device is a Bluetooth device.
+- **IsSideband**  Indicates whether the device is a sideband device.
+- **IsUSB**  Indicates whether the device is a USB device.
+- **JackSubType**  A unique ID representing the KS node type of the endpoint.
+- **MicArrayGeometry**  Describes the microphone array, including the microphone position, coordinates, type, and frequency range. See [MicArrayGeometry](#micarraygeometry).
+- **persistentId**  A unique ID for this endpoint which is retained across migrations.
+
+### MicArrayGeometry
+
+This event provides information about the layout of the individual microphone elements in the microphone array.
+
+The following fields are available:
+
+- **MicCoords**  The location and orientation of the microphone element.
+- **usFrequencyBandHi**  The high end of the frequency range for the microphone.
+- **usFrequencyBandLo**  The low end of the frequency range for the microphone.
+- **usMicArrayType**  The type of the microphone array.
+- **usNumberOfMicrophones**  The number of microphones in the array.
+- **usVersion**  The version of the microphone array specification.
+- **wHorizontalAngleBegin**  The horizontal angle of the start of the working volume (reported as radians times 10,000).
+- **wHorizontalAngleEnd**  The horizontal angle of the end of the working volume (reported as radians times 10,000).
+- **wVerticalAngleBegin**  The vertical angle of the start of the working volume (reported as radians times 10,000).
+- **wVerticalAngleEnd**  The vertical angle of the end of the working volume (reported as radians times 10,000).
+
 ## Census events
 
 ### Census.App
 
-Provides information on IE and Census versions running on the device
+This event sends version data about the Apps running on this device, to help keep Windows up to date.
 
 The following fields are available:
 
@@ -1796,6 +1897,17 @@ The following fields are available:
 - **IEVersion**  The version of Internet Explorer that is running on the device.
 
 
+### Census.Azure
+
+This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets.
+
+The following fields are available:
+
+- **CloudCoreBuildEx**  The Azure CloudCore build number.
+- **CloudCoreSupportBuildEx**  The Azure CloudCore support build number.
+- **NodeID**  The node identifier on the device that indicates whether the device is part of the Azure fleet.
+
+
 ### Census.Battery
 
 This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date.
@@ -2038,7 +2150,7 @@ The following fields are available:
 
 ### Census.Processor
 
-Provides information on several important data points about Processor settings
+This event sends data about the processor to help keep Windows up to date.
 
 The following fields are available:
 
@@ -2214,6 +2326,7 @@ The following fields are available:
 - **IsVirtualDevice**  Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors.
 - **SLATSupported**  Represents whether Second Level Address Translation (SLAT) is supported by the hardware.
 - **VirtualizationFirmwareEnabled**  Represents whether virtualization is enabled in the firmware.
+- **VMId**  A string that identifies a virtual machine.
 
 
 ### Census.WU
@@ -2325,7 +2438,6 @@ The following fields are available:
 - **ext_cs**  Describes properties related to the schema of the event. See [Common Data Extensions.cs](#common-data-extensionscs).
 - **ext_device**  Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice).
 - **ext_os**  Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos).
-- **ext_receipts**  Describes the fields related to time as provided by the client for debugging purposes. See [Common Data Extensions.receipts](#common-data-extensionsreceipts).
 - **ext_sdk**  Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk).
 - **ext_user**  Describes the fields related to a user. See [Common Data Extensions.user](#common-data-extensionsuser).
 - **ext_utc**  Describes the fields that might be populated by a logging library on Windows. See [Common Data Extensions.utc](#common-data-extensionsutc).
@@ -2351,16 +2463,6 @@ The following fields are available:
 - **ver**  Represents the major and minor version of the extension.
 
 
-### Common Data Extensions.receipts
-
-Represents various time information as provided by the client and helps for debugging purposes.
-
-The following fields are available:
-
-- **originalTime**  The original event time.
-- **uploadTime**  The time the event was uploaded.
-
-
 ### Common Data Extensions.sdk
 
 Used by platform specific libraries to record fields that are required for a specific SDK.
@@ -2580,6 +2682,41 @@ The following fields are available:
 - **stageTimeSeconds**  The time (in seconds) required to stage all files that are part of the update.
 
 
+### CbsServicingProvider.CbsSelectableUpdateChangeV2
+
+This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date.
+
+The following fields are available:
+
+- **applicableUpdateState**  Indicates the highest applicable state of the optional content.
+- **buildVersion**  The build version of the package being installed.
+- **clientId**  The name of the application requesting the optional content change.
+- **downloadSource**  Indicates if optional content was obtained from Windows Update or a locally accessible file.
+- **downloadtimeInSeconds**  The number of seconds required to complete the optional content download.
+- **executionID**  A unique ID used to identify events associated with a single servicing operation and not reused for future operations.
+- **executionSequence**  A counter that tracks the number of servicing operations attempted on the device.
+- **firstMergedExecutionSequence**  The value of a pervious executionSequence counter that is being merged with the current operation, if applicable.
+- **firstMergedID**  A unique ID of a pervious servicing operation that is being merged with this operation, if applicable.
+- **hrDownloadResult**  The return code of the download operation.
+- **hrStatusUpdate**  The return code of the servicing operation.
+- **identityHash**  A pseudonymized (hashed) identifier for the Windows Package that is being installed or uninstalled.
+- **initiatedOffline**  Indicates whether the operation was performed against an offline Windows image file or a running instance of Windows.
+- **majorVersion**  The major version of the package being installed.
+- **minorVersion**  The minor version of the package being installed.
+- **packageArchitecture**  The architecture of the package being installed.
+- **packageLanguage**  The language of the package being installed.
+- **packageName**  The name of the package being installed.
+- **rebootRequired**  Indicates whether a reboot is required to complete the operation.
+- **revisionVersion**  The revision number of the package being installed.
+- **stackBuild**  The build number of the servicing stack binary performing the installation.
+- **stackMajorVersion**  The major version number of the servicing stack binary performing the installation.
+- **stackMinorVersion**  The minor version number of the servicing stack binary performing the installation.
+- **stackRevision**  The revision number of the servicing stack binary performing the installation.
+- **updateName**  The name of the optional Windows Operation System feature being enabled or disabled.
+- **updateStartState**  A value indicating the state of the optional content before the operation started.
+- **updateTargetState**  A value indicating the desired state of the optional content.
+
+
 ## Deployment extensions
 
 ### DeploymentTelemetry.Deployment_End
@@ -2677,7 +2814,7 @@ The following fields are available:
 
 ### TelClientSynthetic.ConnectivityHeartBeat_0
 
-This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it fires an event. A Connectivity Heartbeat event also fires when a device recovers from costed network to free network.
+This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network.
 
 The following fields are available:
 
@@ -2730,6 +2867,7 @@ The following fields are available:
 - **MaxActiveAgentConnectionCount**  The maximum number of active agents during this heartbeat timeframe.
 - **MaxInUseScenarioCounter**  Soft maximum number of scenarios loaded by UTC.
 - **PreviousHeartBeatTime**  Time of last heartbeat event (allows chaining of events).
+- **PrivacyBlockedCount**  The number of events blocked due to privacy settings or tags.
 - **RepeatedUploadFailureDropped**  Number of events lost due to repeated upload failures for a single buffer.
 - **SettingsHttpAttempts**  Number of attempts to contact OneSettings service.
 - **SettingsHttpFailures**  The number of failures from contacting the OneSettings service.
@@ -2769,6 +2907,7 @@ The following fields are available:
 - **LastEventSizeOffender**  Event name of last event which exceeded max event size.
 - **LastInvalidHttpCode**  Last invalid HTTP code received from Vortex.
 - **PreviousHeartBeatTime**  The FILETIME of the previous heartbeat fire.
+- **PrivacyBlockedCount**  The number of events blocked due to privacy settings or tags.
 - **RepeatedUploadFailureDropped**  Number of events lost due to repeated upload failures for a single buffer.
 - **SettingsHttpAttempts**  Number of attempts to contact OneSettings service.
 - **SettingsHttpFailures**  Number of failures from contacting OneSettings service.
@@ -2837,6 +2976,33 @@ The following fields are available:
 
 ## Direct to update events
 
+### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicability
+
+Event to indicate that the Coordinator CheckApplicability call succeeded.
+
+The following fields are available:
+
+- **ApplicabilityResult**  Result of CheckApplicability function.
+- **CampaignID**  Campaign ID being run.
+- **ClientID**  Client ID being run.
+- **CoordinatorVersion**  Coordinator version of DTU.
+- **CV**  Correlation vector.
+- **IsDeviceAADDomainJoined**  Indicates whether the device is logged in to the AAD (Azure Active Directory) domain.
+- **IsDeviceADDomainJoined**  Indicates whether the device is logged in to the AD (Active Directory) domain.
+- **IsDeviceCloverTrail**  Indicates whether the device has a Clover Trail system installed.
+- **IsDeviceFeatureUpdatingPaused**  Indicates whether Feature Update is paused on the device.
+- **IsDeviceNetworkMetered**  Indicates whether the device is connected to a metered network.
+- **IsDeviceOobeBlocked**  Indicates whether user approval is required to install updates on the device.
+- **IsDeviceRequireUpdateApproval**  Indicates whether user approval is required to install updates on the device.
+- **IsDeviceSccmManaged**  Indicates whether the device is running the Microsoft Endpoint Configuration Manager client to keep the operating system and applications up to date.
+- **IsDeviceUninstallActive**  Indicates whether the OS (operating system) on the device was recently updated.
+- **IsDeviceUpdateNotificationLevel**  Indicates whether the device has a set policy to control update notifications.
+- **IsDeviceUpdateServiceManaged**  Indicates whether the device uses WSUS (Windows Server Update Services).
+- **IsDeviceZeroExhaust**  Indicates whether the device subscribes to the Zero Exhaust policy to minimize connections from Windows to Microsoft.
+- **IsGreaterThanMaxRetry**  Indicates whether the DTU (Direct to Update) service has exceeded its maximum retry count.
+- **IsVolumeLicensed**  Indicates whether a volume license was used to authenticate the operating system or applications on the device.
+
+
 ### Microsoft.Windows.DirectToUpdate.DTUCoordinatorCheckApplicabilityGenericFailure
 
 This event indicatse that we have received an unexpected error in the Direct to Update (DTU) Coordinators CheckApplicability call.
@@ -3089,6 +3255,20 @@ The following fields are available:
 - **CV**  Correlation vector.
 
 
+### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityGenericFailure
+
+This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicability call.
+
+The following fields are available:
+
+- **CampaignID**  Campaign ID being run
+- **ClientID**  Client ID being run
+- **CoordinatorVersion**  Coordinator version of DTU
+- **CV**  Correlation vector
+- **CV_new**  New correlation vector
+- **hResult**  HRESULT of the failure
+
+
 ### Microsoft.Windows.DirectToUpdate.DTUHandlerCheckApplicabilityInternalGenericFailure
 
 This event indicates that we have received an unexpected error in the Direct to Update (DTU) Handler CheckApplicabilityInternal call.
@@ -3309,6 +3489,144 @@ The following fields are available:
 - **CV**  Correlation vector.
 
 
+## DISM events
+
+### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU
+
+The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot.
+
+The following fields are available:
+
+- **dismInstalledLCUPackageName**  The name of the latest installed package.
+
+
+### Microsoft.Windows.StartRepairCore.DISMPendingInstall
+
+The DISM Pending Install event sends information to report pending package installation found.
+
+The following fields are available:
+
+- **dismPendingInstallPackageName**  The name of the pending package.
+
+
+### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd
+
+The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in.
+
+The following fields are available:
+
+- **errorCode**  The result code returned by the event.
+- **flightIds**  The Flight IDs (identifier of the beta release) of found driver updates.
+- **foundDriverUpdateCount**  The number of found driver updates.
+- **srtRootCauseDiag**  The scenario name for a diagnosis event.
+
+
+### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart
+
+The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in.
+
+The following fields are available:
+
+- **srtRootCauseDiag**  The scenario name for a diagnosis event.
+
+
+## Driver installation events
+
+### Microsoft.Windows.DriverInstall.DeviceInstall
+
+This critical event sends information about the driver installation that took place.
+
+The following fields are available:
+
+- **ClassGuid**  The unique ID for the device class.
+- **ClassLowerFilters**  The list of lower filter class drivers.
+- **ClassUpperFilters**  The list of upper filter class drivers.
+- **CoInstallers**  The list of coinstallers.
+- **ConfigFlags**  The device configuration flags.
+- **DeviceConfigured**  Indicates whether this device was configured through the kernel configuration.
+- **DeviceInstanceId**  The unique identifier of the device in the system.
+- **DeviceStack**  The device stack of the driver being installed.
+- **DriverDate**  The date of the driver.
+- **DriverDescription**  A description of the driver function.
+- **DriverInfName**  Name of the INF file (the setup information file) for the driver.
+- **DriverInfSectionName**  Name of the DDInstall section within the driver INF file.
+- **DriverPackageId**  The ID of the driver package that is staged to the driver store.
+- **DriverProvider**  The driver manufacturer or provider.
+- **DriverUpdated**  Indicates whether the driver is replacing an old driver.
+- **DriverVersion**  The version of the driver file.
+- **EndTime**  The time the installation completed.
+- **Error**  Provides the WIN32 error code for the installation.
+- **ExtensionDrivers**  List of extension drivers that complement this installation.
+- **FinishInstallAction**  Indicates whether the co-installer invoked the finish-install action.
+- **FinishInstallUI**  Indicates whether the installation process shows the user interface.
+- **FirmwareDate**  The firmware date that will be stored in the EFI System Resource Table (ESRT).
+- **FirmwareRevision**  The firmware revision that will be stored in the EFI System Resource Table (ESRT).
+- **FirmwareVersion**  The firmware version that will be stored in the EFI System Resource Table (ESRT).
+- **FirstHardwareId**  The ID in the hardware ID list that provides the most specific device description.
+- **FlightIds**  A list of the different Windows Insider builds on the device.
+- **GenericDriver**  Indicates whether the driver is a generic driver.
+- **Inbox**  Indicates whether the driver package is included with Windows.
+- **InstallDate**  The date the driver was installed.
+- **LastCompatibleId**  The ID in the hardware ID list that provides the least specific device description.
+- **LegacyInstallReasonError**  The error code for the legacy installation.
+- **LowerFilters**  The list of lower filter drivers.
+- **MatchingDeviceId**  The hardware ID or compatible ID that Windows used to install the device instance.
+- **NeedReboot**  Indicates whether the driver requires a reboot.
+- **OriginalDriverInfName**  The original name of the INF file before it was renamed.
+- **ParentDeviceInstanceId**  The device instance ID of the parent of the device.
+- **PendedUntilReboot**  Indicates whether the installation is pending until the device is rebooted.
+- **Problem**  Error code returned by the device after installation.
+- **ProblemStatus**  The status of the device after the driver installation.
+- **RebootRequiredReason**  DWORD (Double Word—32-bit unsigned integer) containing the reason why the device required a reboot during install.
+- **SecondaryDevice**  Indicates whether the device is a secondary device.
+- **ServiceName**  The service name of the driver.
+- **SetupMode**  Indicates whether the driver installation took place before the Out Of Box Experience (OOBE) was completed.
+- **StartTime**  The time when the installation started.
+- **SubmissionId**  The driver submission identifier assigned by the Windows Hardware Development Center.
+- **UpperFilters**  The list of upper filter drivers.
+
+
+### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd
+
+This event sends data about the driver installation once it is completed.
+
+The following fields are available:
+
+- **DeviceInstanceId**  The unique identifier of the device in the system.
+- **DriverUpdated**  Indicates whether the driver was updated.
+- **Error**  The Win32 error code of the installation.
+- **FlightId**  The ID of the Windows Insider build the device received.
+- **InstallDate**  The date the driver was installed.
+- **InstallFlags**  The driver installation flags.
+- **OptionalData**  Metadata specific to WU (Windows Update) associated with the driver (flight IDs, recovery IDs, etc.)
+- **RebootRequired**  Indicates whether a reboot is required after the installation.
+- **RollbackPossible**  Indicates whether this driver can be rolled back.
+- **WuTargetedHardwareId**  Indicates that the driver was installed because the device hardware ID was targeted by the Windows Update.
+- **WuUntargetedHardwareId**  Indicates that the driver was installed because Windows Update performed a generic driver update for all devices of that hardware class.
+
+
+### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart
+
+This event sends data about the driver that the new driver installation is replacing.
+
+The following fields are available:
+
+- **DeviceInstanceId**  The unique identifier of the device in the system.
+- **FirstInstallDate**  The first time a driver was installed on this device.
+- **LastDriverDate**  Date of the driver that is being replaced.
+- **LastDriverInbox**  Indicates whether the previous driver was included with Windows.
+- **LastDriverInfName**  Name of the INF file (the setup information file) of the driver being replaced.
+- **LastDriverVersion**  The version of the driver that is being replaced.
+- **LastFirmwareDate**  The date of the last firmware reported from the EFI System Resource Table (ESRT).
+- **LastFirmwareRevision**  The last firmware revision number reported from EFI System Resource Table (ESRT).
+- **LastFirmwareVersion**  The last firmware version reported from the EFI System Resource Table (ESRT).
+- **LastInstallDate**  The date a driver was last installed on this device.
+- **LastMatchingDeviceId**  The hardware ID or compatible ID that Windows last used to install the device instance.
+- **LastProblem**  The previous problem code that was set on the device.
+- **LastProblemStatus**  The previous problem code that was set on the device.
+- **LastSubmissionId**  The driver submission identifier of the driver that is being replaced.
+
+
 ## DxgKernelTelemetry events
 
 ### DxgKrnlTelemetry.GPUAdapterInventoryV2
@@ -3322,12 +3640,15 @@ The following fields are available:
 - **bootId**  The system boot ID.
 - **BrightnessVersionViaDDI**  The version of the Display Brightness Interface.
 - **ComputePreemptionLevel**  The maximum preemption level supported by GPU for compute payload.
+- **DDIInterfaceVersion**  The device driver interface version.
 - **DedicatedSystemMemoryB**  The amount of system memory dedicated for GPU use (in bytes).
 - **DedicatedVideoMemoryB**  The amount of dedicated VRAM of the GPU (in bytes).
 - **DisplayAdapterLuid**  The display adapter LUID.
 - **DriverDate**  The date of the display driver.
 - **DriverRank**  The rank of the display driver.
 - **DriverVersion**  The display driver version.
+- **DriverWorkarounds**  Bitfield data for specific driver workarounds enabled for this device.
+- **DriverWorkarounds.Length**  The length of the DriverWorkarounds bitfield.
 - **DX10UMDFilePath**  The file path to the location of the DirectX 10 Display User Mode Driver in the Driver Store.
 - **DX11UMDFilePath**  The file path to the location of the DirectX 11 Display User Mode Driver in the Driver Store.
 - **DX12UMDFilePath**  The file path to the location of the DirectX 12 Display User Mode Driver in the Driver Store.
@@ -3336,8 +3657,11 @@ The following fields are available:
 - **GPUPreemptionLevel**  The maximum preemption level supported by GPU for graphics payload.
 - **GPURevisionID**  The GPU revision ID.
 - **GPUVendorID**  The GPU vendor ID.
+- **InterfaceFuncPointersProvided1**  The number of device driver interface function pointers provided.
+- **InterfaceFuncPointersProvided2**  The number of device driver interface function pointers provided.
 - **InterfaceId**  The GPU interface ID.
 - **IsDisplayDevice**  Does the GPU have displaying capabilities?
+- **IsHwSchEnabled**  Indicates whether Hardware Scheduling is enabled.
 - **IsHwSchSupported**  Indicates whether the adapter supports hardware scheduling.
 - **IsHybridDiscrete**  Does the GPU have discrete GPU capabilities in a hybrid device?
 - **IsHybridIntegrated**  Does the GPU have integrated GPU capabilities in a hybrid device?
@@ -3801,7 +4125,7 @@ The following fields are available:
 
 ### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
 
-This event represents the basic metadata about a plug and play (PNP) device and its associated driver.
+This event sends basic metadata about a PNP device and its associated driver to help keep Windows up to date. This information is used to assess if the PNP device and driver will remain compatible when upgrading Windows.
 
 This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
@@ -3813,6 +4137,8 @@ The following fields are available:
 - **COMPID**  The list of “Compatible IDs” for this device.
 - **ContainerId**  The system-supplied unique identifier that specifies which group(s) the device(s) installed on the parent (main) device belong to.
 - **Description**  The description of the device.
+- **DeviceDriverFlightId**  The test build (Flight) identifier of the device driver.
+- **DeviceExtDriversFlightIds**  The test build (Flight) identifier for all extended device drivers.
 - **DeviceInterfaceClasses**  The device interfaces that this device implements.
 - **DeviceState**  Identifies the current state of the parent (main) device.
 - **DriverId**  The unique identifier for the installed driver.
@@ -3822,9 +4148,11 @@ The following fields are available:
 - **DriverVerVersion**  The version number of the driver installed on the device.
 - **Enumerator**  Identifies the bus that enumerated the device.
 - **ExtendedInfs**  The extended INF file names.
+- **FirstInstallDate**  The first time this device was installed on the machine.
 - **HWID**  A list of hardware IDs for the device.
 - **Inf**  The name of the INF file (possibly renamed by the OS, such as oemXX.inf).
-- **InstallState**  The device installation state. For a list of values, see: https://msdn.microsoft.com/en-us/library/windows/hardware/ff543130.aspx
+- **InstallDate**  The date of the most recent installation of the device on the machine.
+- **InstallState**  The device installation state.  One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx
 - **InventoryVersion**  The version number of the inventory process generating the events.
 - **LowerClassFilters**  The identifiers of the Lower Class filters installed for the device.
 - **LowerFilters**  The identifiers of the Lower filters installed for the device.
@@ -3879,6 +4207,7 @@ The following fields are available:
 
 This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent.
 
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
 
 The following fields are available:
 
@@ -3980,51 +4309,30 @@ The following fields are available:
 
 This event collects traces of all other Core events, not used in typical customer scenarios. This event signals the beginning of the event download, and that tracing should begin.
 
+The following fields are available:
+
+- **key**  The globally unique identifier (GUID) used to identify the specific Json Trace logging session.
 
 
 ### Microsoft.Windows.Inventory.Core.StopUtcJsonTrace
 
 This event collects traces of all other Core events, not used in typical customer scenarios. This event signals the end of the event download, and that tracing should end.
 
+The following fields are available:
+
+- **key**  The globally unique identifier (GUID) used to identify the specific Json Trace logging session.
 
 
 ### Microsoft.Windows.Inventory.General.AppHealthStaticAdd
 
 This event sends details collected for a specific application on the source device.
 
-The following fields are available:
-
-- **AhaVersion**  The binary version of the App Health Analyzer tool.
-- **ApplicationErrors**  The count of application errors from the event log.
-- **Bitness**  The architecture type of the application (16 Bit or 32 bit or 64 bit).
-- **device_level**  Various JRE/JAVA versions installed on a particular device.
-- **ExtendedProperties**  Attribute used for aggregating all other attributes under this event type.
-- **Jar**  Flag to determine if an app has a Java JAR file dependency.
-- **Jre**  Flag to determine if an app has JRE framework dependency.
-- **Jre_version**  JRE versions an app has declared framework dependency for.
-- **Name**  Name of the application.
-- **NonDPIAware**  Flag to determine if an app is non-DPI aware.
-- **NumBinaries**  Count of all binaries (.sys,.dll,.ini) from application install location.
-- **RequiresAdmin**  Flag to determine if an app requests admin privileges for execution.
-- **RequiresAdminv2**  Additional flag to determine if an app requests admin privileges for execution.
-- **RequiresUIAccess**  Flag to determine if an app is based on UI features for accessibility.
-- **VB6**  Flag to determine if an app is based on VB6 framework.
-- **VB6v2**  Additional flag to determine if an app is based on VB6 framework.
-- **Version**  Version of the application.
-- **VersionCheck**  Flag to determine if an app has a static dependency on OS version.
-- **VersionCheckv2**  Additional flag to determine if an app has a static dependency on OS version.
 
 
 ### Microsoft.Windows.Inventory.General.AppHealthStaticStartSync
 
 This event indicates the beginning of a series of AppHealthStaticAdd events.
 
-The following fields are available:
-
-- **AllowTelemetry**  Indicates the presence of the 'allowtelemetry' command line argument.
-- **CommandLineArgs**  Command line arguments passed when launching the App Health Analyzer executable.
-- **Enhanced**  Indicates the presence of the 'enhanced' command line argument.
-- **StartTime**  UTC date and time at which this event was sent.
 
 
 ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
@@ -4219,10 +4527,10 @@ This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedevic
 
 The following fields are available:
 
-- **BrowserFlags**  Browser flags for Office-related products
-- **ExchangeProviderFlags**  Provider policies for Office Exchange
+- **BrowserFlags**  Browser flags for Office-related products.
+- **ExchangeProviderFlags**  Provider policies for Office Exchange.
 - **InventoryVersion**  The version of the inventory binary generating the events.
-- **SharedComputerLicensing**  Office shared computer licensing policies
+- **SharedComputerLicensing**  Office shared computer licensing policies.
 
 
 ### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync
@@ -4437,6 +4745,287 @@ The following fields are available:
 - **UserInputTime**  The amount of time the loader application spent waiting for user input.
 
 
+### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig
+
+This critical device configuration event provides information about drivers for a driver installation that took place within the kernel.
+
+The following fields are available:
+
+- **ClassGuid**  The unique ID for the device class.
+- **DeviceInstanceId**  The unique ID for the device on the system.
+- **DriverDate**  The date of the driver.
+- **DriverFlightIds**  The IDs for the driver flights.
+- **DriverInfName**  Driver INF file name.
+- **DriverProvider**  The driver manufacturer or provider.
+- **DriverSubmissionId**  The driver submission ID assigned by the hardware developer center.
+- **DriverVersion**  The driver version number.
+- **ExtensionDrivers**  The list of extension driver INF files, extension IDs, and associated flight IDs.
+- **FirstHardwareId**  The ID in the hardware ID list that provides the most specific device description.
+- **InboxDriver**  Indicates whether the driver package is included with Windows.
+- **InstallDate**  Date the driver was installed.
+- **LastCompatibleId**  The ID in the hardware ID list that provides the least specific device description.
+- **Legacy**  Indicates whether the driver is a legacy driver.
+- **NeedReboot**  Indicates whether the driver requires a reboot.
+- **SetupMode**  Indicates whether the device configuration occurred during the Out Of Box Experience (OOBE).
+- **StatusCode**  The NTSTATUS of device configuration operation.
+
+
+### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem
+
+This event is sent when a problem code is cleared from a device.
+
+The following fields are available:
+
+- **Count**  The total number of events.
+- **DeviceInstanceId**  The unique identifier of the device on the system.
+- **LastProblem**  The previous problem that was cleared.
+- **LastProblemStatus**  The previous NTSTATUS value that was cleared.
+- **Problem**  The new problem code set on the device node.
+- **ProblemStatus**  The new NT_STATUS set on the device node.
+- **ServiceName**  The name of the driver or service attached to the device.
+
+
+### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem
+
+This event is sent when a new problem code is assigned to a device.
+
+The following fields are available:
+
+- **Count**  The total number of events.
+- **DeviceInstanceId**  The unique identifier of the device in the system.
+- **LastProblem**  The previous problem code that was set on the device.
+- **LastProblemStatus**  The previous NTSTATUS value that was set on the device.
+- **Problem**  The new problem code that was set on the device.
+- **ProblemStatus**  The new NTSTATUS value that was set on the device.
+- **ServiceName**  The driver or service name that is attached to the device.
+
+
+## Microsoft Edge events
+
+### Aria.160f0649efde47b7832f05ed000fc453.Microsoft.WebBrowser.SystemInfo.Config
+
+This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+### Aria.29e24d069f27450385c7acaa2f07e277.Microsoft.WebBrowser.SystemInfo.Config
+
+This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+### Aria.7005b72804a64fa4b2138faab88f877b.Microsoft.WebBrowser.SystemInfo.Config
+
+This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+### Aria.754de735ccd546b28d0bfca8ac52c3de.Microsoft.WebBrowser.SystemInfo.Config
+
+This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping
+
+This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's  used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date.
+
+The following fields are available:
+
+- **appAp**  Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''.
+- **appAppId**  The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update.
+- **appBrandCode**  The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown).
+- **appChannel**  An integer indicating the channel of the installation (e.g. Canary or Dev).
+- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''.
+- **appCohort**  A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''.
+- **appCohortHint**  A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''.
+- **appCohortName**  A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''.
+- **appConsentState**  Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited.
+- **appDayOfInstall**  The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown).
+- **appExperiments**  A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''.
+- **appInstallTimeDiffSec**  The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'.
+- **appLang**  The language of the product install, in IETF BCP 47 representation. Default: ''.
+- **appNextVersion**  The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'.
+- **appPingEventAppSize**  The total number of bytes of all downloaded packages. Default: '0'.
+- **appPingEventDownloadMetricsDownloadedBytes**  For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'.
+- **appPingEventDownloadMetricsDownloader**  A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''.
+- **appPingEventDownloadMetricsDownloadTimeMs**  For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'.
+- **appPingEventDownloadMetricsError**  The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'.
+- **appPingEventDownloadMetricsServerIpHint**  For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''.
+- **appPingEventDownloadMetricsTotalBytes**  For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'.
+- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''.
+- **appPingEventDownloadTimeMs**  For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'.
+- **appPingEventErrorCode**  The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'.
+- **appPingEventEventResult**  An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error).
+- **appPingEventEventType**  An enumeration indicating the type of the event and the event stage. Default: '0' (Unknown).
+- **appPingEventExtraCode1**  Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'.
+- **appPingEventInstallTimeMs**  For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'.
+- **appPingEventNumBytesDownloaded**  The number of bytes downloaded for the specified application. Default: '0'.
+- **appPingEventSequenceId**  An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event.
+- **appPingEventSourceUrlIndex**  For events representing a download, the position of the download URL in the list of URLs supplied by the server in a  tag.
+- **appPingEventUpdateCheckTimeMs**	For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'.
+- **appUpdateCheckIsUpdateDisabled**  The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not.
+- **appUpdateCheckTargetVersionPrefix**  A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''.
+- **appUpdateCheckTtToken**  An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''.
+- **appVersion**  The version of the product install. Default: '0.0.0.0'.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full.
+- **eventType**  A string representation of appPingEventEventType indicating the type of the event.
+- **hwHasAvx**  '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse**  '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse2**  '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse3**  '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse41**  '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse42**  '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSsse3**  '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'.
+- **hwPhysmemory**  The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'.
+- **isMsftDomainJoined**  '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'.
+- **osArch**  The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''.
+- **osPlatform**  The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''.
+- **osServicePack**  The secondary version of the operating system. '' if unknown. Default: ''.
+- **osVersion**  The primary version of the operating system. '' if unknown. Default: ''.
+- **requestCheckPeriodSec**  The update interval in seconds. The value is read from the registry. Default: '-1'.
+- **requestDlpref**  A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''.
+- **requestDomainJoined**  '1' if the device is part of a managed enterprise domain. Otherwise '0'.
+- **requestInstallSource**  A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''.
+- **requestIsMachine**  '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'.
+- **requestOmahaShellVersion**  The version of the Omaha installation folder. Default: ''.
+- **requestOmahaVersion**  The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'.
+- **requestProtocolVersion**  The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined.
+- **requestRequestId**  A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Default: ''.
+- **requestSessionCorrelationVectorBase**  A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''.
+- **requestSessionId**  A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique sessionid. Default: ''.
+- **requestTestSource**  Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''.
+- **requestUid**  A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''.
+
+
+### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config
+
+This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+## Migration events
+
+### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr
+
+This event returns data to track the count of the migration objects across various phases during feature update.
+
+The following fields are available:
+
+- **currentSid**  Indicates the user SID for which the migration is being performed.
+- **knownFoldersUsr[i]**  Predefined folder path locations.
+- **migDiagSession->CString**  The phase of the upgrade where migration occurs. (E.g.: Validate tracked content)
+- **objectCount**  The count for the number of objects that are being transferred.
+
+
+### Microsoft.Windows.MigrationCore.MigObjectCountKFSys
+
+This event returns data about the count of the migration objects across various phases during feature update.
+
+The following fields are available:
+
+- **knownFoldersSys[i]**  The predefined folder path locations.
+- **migDiagSession->CString**  Identifies the phase of the upgrade where migration happens.
+- **objectCount**  The count of the number of objects that are being transferred.
+
+
+### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr
+
+This event returns data to track the count of the migration objects across various phases during feature update.
+
+The following fields are available:
+
+- **currentSid**  Indicates the user SID for which the migration is being performed.
+- **knownFoldersUsr[i]**  Predefined folder path locations.
+- **migDiagSession->CString**  The phase of the upgrade where the migration occurs. (For example, Validate tracked content.)
+- **objectCount**  The number of objects that are being transferred.
+
+
 ## Miracast events
 
 ### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd
@@ -4613,6 +5202,7 @@ This event determines the error code that was returned when verifying Internet c
 
 The following fields are available:
 
+- **failedCheck**  The error code returned by the operation.
 - **winInetError**  The HResult of the operation.
 
 
@@ -4668,6 +5258,365 @@ The following fields are available:
 - **originatingContextName**  The name of the originating call context that resulted in the failure.
 - **threadId**  The ID of the thread on which the activity is executing.
 
+## Privacy notifier events
+
+
+### Microsoft.Windows.Shell.PrivacyNotifierLogging.PrivacyNotifierCompleted
+
+This event returns data to report the efficacy of a single-use tool to inform users impacted by a known issue and to take corrective action to address the issue.
+
+The following fields are available:
+
+- **cleanupTask**  Indicates whether the task that launched the dialog should be cleaned up.
+- **cleanupTaskResult**  The return code of the attempt to clean up the task used to show the dialog.
+- **deviceEvaluated**  Indicates whether the device was eligible for evaluation of a known issue.
+- **deviceImpacted**  Indicates whether the device was impacted by a known issue.
+- **modalAction**  The action the user took on the dialog that was presented to them.
+- **modalResult**  The return code of the attempt to show a dialog to the user explaining the issue.
+- **resetSettingsResult**  The return code of the action to correct the known issue.
+
+
+## Remediation events
+
+### Microsoft.Windows.Remediation.Applicable
+
+This event indicates whether Windows Update sediment remediations need to be applied to the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates.
+
+The following fields are available:
+
+- **AllowAutoUpdateExists**  Indicates whether the Automatic Update feature is turned on.
+- **AllowAutoUpdateProviderSetExists**  Indicates whether the Allow Automatic Update provider exists.
+- **AppraiserBinariesValidResult**  Indicates whether the plug-in was appraised as valid.
+- **AppraiserRegistryValidResult**  Indicates whether the registry entry checks out as valid.
+- **AppraiserTaskRepairDisabled**  Task repair performed by the Appraiser plug-in is disabled.
+- **AppraiserTaskValid**  Indicates that the Appraiser task is valid.
+- **AUOptionsExists**  Indicates whether the Automatic Update options exist.
+- **CTACTargetingAttributesInvalid**  Indicates whether the Common Targeting Attribute Client (CTAC) attributes are valid. CTAC is a Windows Runtime client library.
+- **CTACVersion**  The Common Targeting Attribute Client (CTAT) version on the device. CTAT is a Windows Runtime client library.
+- **CV**  Correlation vector
+- **DataStoreSizeInBytes**  Size of the data store, in bytes.
+- **DateTimeDifference**  The difference between local and reference clock times.
+- **DateTimeSyncEnabled**  Indicates whether the Datetime Sync plug-in is enabled.
+- **daysSinceInstallThreshold**  The maximum number of days since the operating system was installed before the device is checked to see if remediation is needed.
+- **daysSinceInstallValue**  Number of days since the operating system was installed.
+- **DaysSinceLastSIH**  The number of days since the most recent SIH executed.
+- **DaysToNextSIH**  The number of days until the next scheduled SIH execution.
+- **DetectConditionEnabled**  Indicates whether a condition that the remediation tool can repair was detected.
+- **DetectedCondition**  Indicates whether detected condition is true and the perform action will be run.
+- **DetectionFailedReason**  Indicates why a given remediation failed to fix a problem that was detected.
+- **DiskFreeSpaceBeforeSedimentPackInMB**  Number of megabytes of disk space available on the device before running the Sediment Pack.
+- **DiskSpaceBefore**  The amount of free disk space available before a remediation was run.
+- **EditionIdFixCorrupted**  Indicates whether the Edition ID is corrupted.
+- **EscalationTimerResetFixResult**  The result of fixing the escalation timer.
+- **EvalAndReportAppraiserRegEntries**  Indicates the EvalAndReportAppraiserRegEntriesFailed event failed.
+- **FixedEditionId**  Indicates whether we fixed the edition ID.
+- **FlightRebootTime**  The amount of time before the system is rebooted.
+- **ForcedRebootToleranceDays**  The maximum number of days before a system reboot is forced on the devie.
+- **FreeSpaceRequirement**  The amount of free space required.
+- **GlobalEventCounter**  Client side counter that indicates ordering of events sent by the remediation system.
+- **HResult**  The HRESULT for detection or perform action phases of the plugin.
+- **installDateValue**  The date of the installation.
+- **IsAppraiserLatestResult**  The HRESULT from the appraiser task.
+- **IsConfigurationCorrected**  Indicates whether the configuration of SIH task was successfully corrected.
+- **IsEscalationTimerResetFixNeeded**  Determines whether a fix is applicable.
+- **IsForcedModeEnabled**  Indicates whether forced reboot mode is enabled.
+- **IsHomeSku**  Indicates whether the device is running the Windows 10 Home edition.
+- **IsRebootForcedMode**  Indicates whether the forced reboot mode is turned on.
+- **IsServiceHardeningEnabled**  Indicates whether the Windows Service Hardening feature was turned on for the device.
+- **IsServiceHardeningNeeded**  Indicates whether Windows Service Hardening was needed for the device (multiple instances of service tampering were detected.)
+- **isThreshold**  Indicates whether the value meets our threshold.
+- **IsUsoRebootPending**  Indicates whether a system reboot is pending.
+- **IsUsoRebootPendingInUpdateStore**  Indicates whether a reboot is pending.
+- **IsUsoRebootTaskEnabled**  Indicates whether the Update Service Orchestrator (USO) reboot task is enabled
+- **IsUsoRebootTaskExists**  Indicates whether the Update Service Orchestrator (USO) reboot task exists.
+- **IsUsoRebootTaskValid**  Indicates whether the Update Service Orchestrator (USO) reboot task is valid.
+- **LastHresult**  The HRESULT for detection or perform action phases of the plugin.
+- **LastRebootTaskRunResult**  Indicates the result of the last reboot task.
+- **LastRebootTaskRunTime**  The length of time the last reboot task took to run.
+- **LastRun**  The date of the most recent SIH run.
+- **LPCountBefore**  The number of language packs on the device before remediation started.
+- **NextCheck**  Indicates when remediation will next be attempted.
+- **NextRebootTaskRunTime**  Indicates when the next system reboot task will run.
+- **NextRun**  Date of the next scheduled SIH run.
+- **NoAutoUpdateExists**  Indicates whether the Automatic Updates feature is turned off.
+- **NumberOfDaysStuckInReboot**  The number of days tht the device has been unable to successfully reboot.
+- **OriginalEditionId**  The Windows edition ID before remediation started.
+- **PackageVersion**  The version of the current remediation package.
+- **PluginName**  Name of the plugin specified for each generic plugin event.
+- **ProductType**  The product type of Windows 10.
+- **QualityUpdateSedimentFunnelState**  Provides information about whether Windows Quality Updates are missing on the device.
+- **QualityUpdateSedimentJsonSchemaVersion**  The schema version of the Quality Update Sediment Remediation.
+- **QualityUpdateSedimentLastRunSeconds**  The number of seconds since the Quality Updates were run.
+- **QualityUpdateSedimentLocalStartTime**  Provides information about when Quality Updates were run.
+- **QualityUpdateSedimentLocaltTime**  The local time of the device running the Quality Update Sediment Remediation.
+- **QualityUpdateSedimentTargetedPlugins**  Provides the list of remediation plug-ins that are applicable to enable Quality Updates on the device.
+- **QualityUpdateSedimentTargetedTriggers**  Provides information about remediations that are applicable to enable Quality Updates on the device.
+- **RegkeysExist**  Indicates whether specified registry keys exist.
+- **Reload**  True if SIH reload is required.
+- **RemediationAutoUACleanupNeeded**  Automatic Update Assistant cleanup is required.
+- **RemediationAutoUAIsInstalled**  Indicates whether the Automatic Update Assistant tool is installed.
+- **RemediationAutoUATaskDisabled**  Indicates whether the Automatic Update Assistant tool task is disabled.
+- **RemediationAutoUATaskNotExists**  Indicates whether an Automatic Update Assistant tool task does not exist.
+- **RemediationAutoUATasksStalled**  Indicates whether an Automatic Update Assistant tool task is stalled.
+- **RemediationCorruptionRepairBuildNumber**  The build number to use to repair corruption.
+- **RemediationCorruptionRepairCorruptionsDetected**  Indicates whether corruption was detected.
+- **RemediationCorruptionRepairDetected**  Indicates whether an attempt was made to repair the corruption.
+- **RemediationDeliverToastBuildNumber**  Indicates a build number that should be applicable to this device.
+- **RemediationDeliverToastDetected**  Indicates that a plug-in has been detected.
+- **RemediationDeliverToastDeviceExcludedNation**  Indicates the geographic identity (GEO ID) that is not applicable for a given plug-in.
+- **RemediationDeliverToastDeviceFreeSpaceInMB**  Indicates the amount of free space, in megabytes.
+- **RemediationDeliverToastDeviceHomeSku**  Indicates whether the plug-in is applicable for the Windows 10 Home edition.
+- **RemediationDeliverToastDeviceIncludedNation**  Indicates the geographic identifier (GEO ID) that is applicable for a given plug-in.
+- **RemediationDeliverToastDeviceProSku**  Indicates whether the plug-in is applicable for the Windows 10 Professional edition.
+- **RemediationDeliverToastDeviceSystemDiskSizeInMB**  Indicates the size of a system disk, in megabytes.
+- **RemediationDeliverToastGeoId**  Indicates the geographic identifier (GEO ID) that is applicable for a given plug-in.
+- **RemediationDeviceSkuId**  The Windows 10 edition ID that maps to the version of Windows 10 on the device.
+- **RemediationGetCurrentFolderExist**  Indicates whether the GetCurrent folder exists.
+- **RemediationNoisyHammerAcLineStatus**  Indicates the AC Line Status of the device.
+- **RemediationNoisyHammerAutoStartCount**  The number of times hammer auto-started.
+- **RemediationNoisyHammerCalendarTaskEnabled**  Event that indicates Update Assistant Calendar Task is enabled.
+- **RemediationNoisyHammerCalendarTaskExists**  Event that indicates an Update Assistant Calendar Task exists.
+- **RemediationNoisyHammerCalendarTaskTriggerEnabledCount**  Event that indicates calendar triggers are enabled in the task.
+- **RemediationNoisyHammerDaysSinceLastTaskRunTime**  The number of days since the most recent Noisy Hammer task ran.
+- **RemediationNoisyHammerGetCurrentSize**  Size in MB of the $GetCurrent folder.
+- **RemediationNoisyHammerIsInstalled**  TRUE if the noisy hammer is installed.
+- **RemediationNoisyHammerLastTaskRunResult**  The result of the last hammer task run.
+- **RemediationNoisyHammerMeteredNetwork**  TRUE if the machine is on a metered network.
+- **RemediationNoisyHammerTaskEnabled**  Indicates whether the Update Assistant Task (Noisy Hammer) is enabled.
+- **RemediationNoisyHammerTaskExists**  Indicates whether the Update Assistant Task (Noisy Hammer) exists.
+- **RemediationNoisyHammerTasksStalled**  Indicates whether a task (Noisy Hammer) is stalled.
+- **RemediationNoisyHammerTaskTriggerEnabledCount**  Indicates whether counting is enabled for the Update Assistant (Noisy Hammer) task trigger.
+- **RemediationNoisyHammerUAExitCode**  The exit code of the Update Assistant (Noisy Hammer) task.
+- **RemediationNoisyHammerUAExitState**  The code for the exit state of the Update Assistant (Noisy Hammer) task.
+- **RemediationNoisyHammerUserLoggedIn**  TRUE if there is a user logged in.
+- **RemediationNoisyHammerUserLoggedInAdmin**  TRUE if there is the user currently logged in is an Admin.
+- **RemediationNotifyUserFixIssuesBoxStatusKey**  Status of the remediation plug-in.
+- **RemediationNotifyUserFixIssuesBuildNumber**  The build number of the remediation plug-in.
+- **RemediationNotifyUserFixIssuesDetected**  Indicates whether the remediation is necessary.
+- **RemediationNotifyUserFixIssuesDiskSpace**  Indicates whether the remediation is necessary due to low disk space.
+- **RemediationNotifyUserFixIssuesFeatureUpdateBlocked**  Indicates whether the remediation is necessary due to Feature Updates being blocked.
+- **RemediationNotifyUserFixIssuesFeatureUpdateInProgress**  Indicates whether the remediation is necessary due to Feature Updates in progress.
+- **RemediationNotifyUserFixIssuesIsUserAdmin**  Indicates whether the remediation requires that an Administrator is logged in.
+- **RemediationNotifyUserFixIssuesIsUserLoggedIn**  Indicates whether the remediation can take place when a non-Administrator is logged in.
+- **RemediationProgramDataFolderSizeInMB**  The size (in megabytes) of the Program Data folder on the device.
+- **RemediationProgramFilesFolderSizeInMB**  The size (in megabytes) of the Program Files folder on the device.
+- **RemediationShellDeviceApplicabilityFailedReason**  The reason the Remediation is not applicable to the device (expressed as a bitmap).
+- **RemediationShellDeviceEducationSku**  Indicates whether the Windows 10 Education edition is detected on the device.
+- **RemediationShellDeviceEnterpriseSku**  Indicates whether the Windows 10 Enterprise edition is detected on the device.
+- **RemediationShellDeviceFeatureUpdatesPaused**  Indicates whether Feature Updates are paused on the device.
+- **RemediationShellDeviceHomeSku**  Indicates whether the Windows 10 Home edition is detected on the device.
+- **RemediationShellDeviceIsAllowedSku**  Indicates whether the Windows 10 edition is applicable to the device.
+- **RemediationShellDeviceManaged**  TRUE if the device is WSUS managed or Windows Updated disabled.
+- **RemediationShellDeviceNewOS**  TRUE if the device has a recently installed OS.
+- **RemediationShellDeviceProSku**  Indicates whether a Windows 10 Professional edition is detected.
+- **RemediationShellDeviceQualityUpdatesPaused**  Indicates whether Quality Updates are paused on the device.
+- **RemediationShellDeviceSccm**  TRUE if the device is managed by Microsoft Endpoint Configuration Manager.
+- **RemediationShellDeviceSedimentMutexInUse**  Indicates whether the Sediment Pack mutual exclusion object (mutex) is in use.
+- **RemediationShellDeviceSetupMutexInUse**  Indicates whether device setup is in progress.
+- **RemediationShellDeviceWuRegistryBlocked**  Indicates whether the Windows Update is blocked on the device via the registry.
+- **RemediationShellDeviceZeroExhaust**  TRUE if the device has opted out of Windows Updates completely.
+- **RemediationShellHasExpired**  Indicates whether the remediation iterations have ended.
+- **RemediationShellHasUpgraded**  Indicates whether the device upgraded.
+- **RemediationShellIsDeviceApplicable**  Indicates whether the remediation is applicable to the device.
+- **RemediationTargetMachine**  Indicates whether the device is a target of the specified fix.
+- **RemediationTaskHealthAutochkProxy**  True/False based on the health of the AutochkProxy task.
+- **RemediationTaskHealthChkdskProactiveScan**  True/False based on the health of the Check Disk task.
+- **RemediationTaskHealthDiskCleanup_SilentCleanup**  True/False based on the health of the Disk Cleanup task.
+- **RemediationTaskHealthMaintenance_WinSAT**  True/False based on the health of the Health Maintenance task.
+- **RemediationTaskHealthServicing_ComponentCleanupTask**  True/False based on the health of the Health Servicing Component task.
+- **RemediationTaskHealthUSO_ScheduleScanTask**  True/False based on the health of the USO (Update Session Orchestrator) Schedule task.
+- **RemediationTaskHealthWindowsUpdate_ScheduledStartTask**  True/False based on the health of the Windows Update Scheduled Start task.
+- **RemediationTaskHealthWindowsUpdate_SihbootTask**  True/False based on the health of the Sihboot task.
+- **RemediationUHServiceDisabledBitMap**  A bitmap indicating which services were disabled.
+- **RemediationUHServiceNotExistBitMap**  A bitmap indicating which services were deleted.
+- **RemediationUsersFolderSizeInMB**  The size (in megabytes) of the Users folder on the device.
+- **RemediationWindows10UpgradeFolderExist**  Indicates whether the Windows 10 Upgrade folder exists.
+- **RemediationWindows10UpgradeFolderSizeInMB**  The size (in megabytes) of the Windows 10 Upgrade folder on the device.
+- **RemediationWindowsAppsFolderSizeInMB**  The size (in megabytes) of the Windows Applications folder on the device.
+- **RemediationWindowsBtFolderSizeInMB**  The size (in megabytes) of the Windows BT folder on the device.
+- **RemediationWindowsFolderSizeInMB**  The size (in megabytes) of the Windows folder on the device.
+- **RemediationWindowsServiceProfilesFolderSizeInMB**  The size (in megabytes) of the Windows service profile on the device.
+- **Result**  This is the HRESULT for Detection or Perform Action phases of the plugin.
+- **RunTask**  TRUE if SIH task should be run by the plug-in.
+- **StorageSenseDiskCompresserEstimateInMB**  The estimated amount of free space that can be cleaned up by running Storage Sense.
+- **StorageSenseHelloFaceRecognitionFodCleanupEstimateInByte**  The estimated amount of space that can be cleaned up by running Storage Sense and removing Windows Hello facial recognition.
+- **StorageSenseRestorePointCleanupEstimateInMB**  The estimated amount of free space (in megabytes) that can be cleaned up by running Storage Sense.
+- **StorageSenseUserDownloadFolderCleanupEstimateInByte**  The estimated amount of space that can be cleaned up by running Storage Sense to clean up the User Download folder.
+- **TimeServiceNTPServer**  The URL for the NTP time server used by device.
+- **TimeServiceStartType**  The startup type for the NTP time service.
+- **TimeServiceSyncDomainJoined**  True if device domain joined and hence uses DC for clock.
+- **TimeServiceSyncType**  Type of sync behavior for Date & Time service on device.
+- **uninstallActiveValue**  Indicates whether an uninstall is in progress.
+- **UpdateApplicabilityFixerTriggerBitMap**  A bitmap containing the reason(s) why the Update Applicability Fixer Plugin was executed.
+- **UpdateRebootTime**  The amount of time it took to reboot to install the updates.
+- **usoScanHoursSinceLastScan**  The number of hours since the last scan by the Update Service Orchestrator (USO).
+- **usoScanPastThreshold**  Indicates whether the Update Service Orchestrator (USO) scan is overdue.
+- **WindowsHiberFilSysSizeInMegabytes**  The size of the Windows Hibernation file, in megabytes.
+- **WindowsInstallerFolderSizeInMegabytes**  The size of the Windows Installer folder, in megabytes.
+- **WindowsPageFileSysSizeInMegabytes**  The size of the Windows Page file, in megabytes.
+- **WindowsSoftwareDistributionFolderSizeInMegabytes**  The size of the Software Distribution folder, in megabytes.
+- **WindowsSwapFileSysSizeInMegabytes**  The size of the Windows Swap file, in megabytes.
+- **WindowsSxsFolderSizeInMegabytes**  The size of the WinSxS (Windows Side-by-Side) folder, in megabytes.
+
+
+### Microsoft.Windows.Remediation.Completed
+
+This event is sent when Windows Update sediment remediations have completed on the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates.
+
+The following fields are available:
+
+- **ActionName**  Name of the action to be completed by the plug-in.
+- **AppraiserTaskMissing**  TRUE if the Appraiser task is missing.
+- **branchReadinessLevel**  Branch readiness level policy.
+- **cloudControlState**  Value indicating whether the shell is enabled on the cloud control settings.
+- **CV**  The Correlation Vector.
+- **DateTimeDifference**  The difference between the local and reference clocks.
+- **DiskFreeSpaceAfterSedimentPackInMB**  The amount of free disk space (in megabytes) after executing the Sediment Pack.
+- **DiskFreeSpaceBeforeSedimentPackInMB**  The amount of free disk space (in megabytes) before executing the Sediment Pack.
+- **DiskMbFreeAfterCleanup**  The amount of free hard disk space after cleanup, measured in Megabytes.
+- **DiskMbFreeBeforeCleanup**  The amount of free hard disk space before cleanup, measured in Megabytes.
+- **DiskSpaceCleanedByComponentCleanup**  The amount of disk space (in megabytes) in the component store that was cleaned up by the plug-in.
+- **DiskSpaceCleanedByNGenRemoval**  The amount of diskspace (megabytes) in the Native Image Generator (NGEN) cache that was cleaned up by the plug-in.
+- **DiskSpaceCleanedByRestorePointRemoval**  The amount of disk space (megabytes) in restore points that was cleaned up by the plug-in.
+- **ForcedAppraiserTaskTriggered**  TRUE if Appraiser task ran from the plug-in.
+- **GlobalEventCounter**  Client-side counter that indicates ordering of events sent by the active user.
+- **HandlerCleanupFreeDiskInMegabytes**  The amount of hard disk space cleaned by the storage sense handlers, measured in megabytes.
+- **hasRolledBack**  Indicates whether the client machine has rolled back.
+- **hasUninstalled**  Indicates whether the client machine has uninstalled a later version of the OS.
+- **hResult**  The result of the event execution.
+- **HResult**  The result of the event execution.
+- **installDate**  The value of installDate registry key. Indicates the install date.
+- **isNetworkMetered**  Indicates whether the client machine has uninstalled a later version of the OS.
+- **LatestState**  The final state of the plug-in component.
+- **MicrosoftCompatibilityAppraiser**  The name of the component targeted by the Appraiser plug-in.
+- **PackageVersion**  The package version for the current Remediation.
+- **PluginName**  The name of the plug-in specified for each generic plug-in event.
+- **QualityUpdateSedimentExecutedPlugins**  The number of plug-ins executed by the Windows Quality Update remediation.
+- **QualityUpdateSedimentFunnelState**  The state of the Windows Quality Update remediation funnel for the device.
+- **QualityUpdateSedimentJsonSchemaVersion**  The schema version of the Quality Update Sediment Remediation.
+- **QualityUpdateSedimentLocalEndTime**  The local time on the device when the Windows Quality Update remediation executed.
+- **QualityUpdateSedimentLocaltTime**  The local time of the device running the Quality Update Sediment Remediation.
+- **QualityUpdateSedimentMatchedTriggers**  The list of triggers that were matched by the Windows Quality Update remediation.
+- **QualityUpdateSedimentModelExecutionSeconds**  The number of seconds needed to execute the Windows Quality Update remediation.
+- **recoveredFromTargetOS**  Indicates whether the device recovered from the target operating system (OS).
+- **RemediationAutoUASpaceSaved**  Amount of disk space saved in MB after cleaning up AutoUA folders.
+- **RemediationBatteryPowerBatteryLevel**  Indicates the battery level at which it is acceptable to continue operation.
+- **RemediationBatteryPowerExitDueToLowBattery**  True when we exit due to low battery power.
+- **RemediationBatteryPowerOnBattery**  True if we allow execution on battery.
+- **RemediationCbsTempDiskSpaceCleanedInMB**  The amount of space (in megabytes) that the plug-in cleaned up in the CbsTemp folder.
+- **RemediationCbsTempEstimateInMB**  The amount of space (megabytes) in the CbsTemp folder that is available for cleanup by the plug-in.
+- **RemediationComponentCleanupEstimateInMB**  The amount of space (megabytes) in the WinSxS (Windows Side-by-Side) folder that is available for cleanup by the plug-in.
+- **RemediationConfigurationTroubleshooterIpconfigFix**  TRUE if IPConfig Fix completed successfully.
+- **RemediationConfigurationTroubleshooterNetShFix**  TRUE if network card cache reset ran successfully.
+- **RemediationCorruptionIsManifestFix**  Boolean indicating if the manifest was repaired.
+- **RemediationCorruptionRepairCorruptionsDetected**  Number of corruptions detected on the device.
+- **RemediationCorruptionRepairCorruptionsFixed**  Number of detected corruptions that were fixed on the device.
+- **RemediationCorruptionRepairDownloadCompleted**  Boolean indicating if the download of manifest cab was completed.
+- **RemediationCorruptionRepairDownloadRequired**  Boolean indicating if the download of manifest cab is required for repair.
+- **RemediationCorruptionRepairMeteredNetwork**  Boolean indicating if the device is on a metered network.
+- **RemediationCorruptionRepairPerformActionSuccessful**  Indicates whether corruption repair was successful on the device.
+- **RemediationDiskCleanupSearchFileSizeInMB**  The size of the Cleanup Search index file, measured in megabytes.
+- **RemediationDiskSpaceSavedByCompressionInMB**  The amount of disk space (megabytes) that was compressed by the plug-in.
+- **RemediationDiskSpaceSavedByUserProfileCompressionInMB**  The amount of User disk space (in megabytes) that was compressed by the plug-in.
+- **remediationExecution**  Remediation shell is in "applying remediation" state.
+- **RemediationHandlerCleanupEstimateInMB**  The estimated amount of disk space (in megabytes) to be cleaned up by running Storage Sense.
+- **RemediationHibernationMigrated**  TRUE if hibernation was migrated.
+- **RemediationHibernationMigrationSucceeded**  TRUE if hibernation migration succeeded.
+- **RemediationNGenDiskSpaceRestored**  The amount of disk space (in megabytes) that was restored after re-running the Native Image Generator (NGEN).
+- **RemediationNGenEstimateInMB**  The amount of disk space (in megabytes) estimated to be in the Native Image Generator (NGEN) cache by the plug-in.
+- **RemediationNGenMigrationSucceeded**  Indicates whether the Native Image Generator (NGEN) migration succeeded.
+- **RemediationRestorePointEstimateInMB**  The amount of disk space (in megabytes) estimated to be used by storage points found by the plug-in.
+- **RemediationSearchFileSizeEstimateInMB**  The amount of disk space (megabytes) estimated to be used by the Cleanup Search index file found by the plug-in.
+- **RemediationShellHasUpgraded**  TRUE if the device upgraded.
+- **RemediationShellMinimumTimeBetweenShellRuns**  Indicates the time between shell runs exceeded the minimum required to execute plugins.
+- **RemediationShellRunFromService**  TRUE if the shell driver was run from the service.
+- **RemediationShellSessionIdentifier**  Unique identifier tracking a shell session.
+- **RemediationShellSessionTimeInSeconds**  Indicates the time the shell session took in seconds.
+- **RemediationShellTaskDeleted**  Indicates that the shell task has been deleted so no additional sediment pack runs occur for this installation.
+- **RemediationSoftwareDistributionCleanedInMB**  The amount of disk space (megabytes) in the Software Distribution folder that was cleaned up by the plug-in.
+- **RemediationSoftwareDistributionEstimateInMB**  The amount of disk space (megabytes) in the Software Distribution folder that is available for clean up by the plug-in.
+- **RemediationTotalDiskSpaceCleanedInMB**  The total disk space (in megabytes) that was cleaned up by the plug-in.
+- **RemediationUpdateServiceHealthRemediationResult**  The result of the Update Service Health plug-in.
+- **RemediationUpdateTaskHealthRemediationResult**  The result of the Update Task Health plug-in.
+- **RemediationUpdateTaskHealthTaskList**  A list of tasks fixed by the Update Task Health plug-in.
+- **RemediationUserFolderCompressionEstimateInMB**  The amount of disk space (in megabytes) estimated to be compressible in User folders by the plug-in.
+- **RemediationUserProfileCompressionEstimateInMB**  The amount of disk space (megabytes) estimated to be compressible in User Profile folders by the plug-in.
+- **RemediationUSORebootRequred**  Indicates whether a reboot is determined to be required by calling the Update Service Orchestrator (USO).
+- **RemediationWindowsCompactedEstimateInMB**  The amount of disk space (megabytes) estimated to be available by compacting the operating system using the plug-in.
+- **RemediationWindowsLogSpaceEstimateInMB**  The amount of disk space (in megabytes) available in Windows logs that can be cleaned by the plug-in.
+- **RemediationWindowsLogSpaceFreed**  The amount of disk space freed by deleting the Windows log files, measured in Megabytes.
+- **RemediationWindowsOldSpaceEstimateInMB**  The amount of disk space (megabytes) in the Windows.OLD folder that can be cleaned up by the plug-in.
+- **RemediationWindowsSpaceCompactedInMB**  The amount of disk space (megabytes) that can be cleaned up by the plug-in.
+- **RemediationWindowsStoreSpaceCleanedInMB**  The amount of disk space (megabytes) from the Windows Store cache that was cleaned up by the plug-in.
+- **RemediationWindowsStoreSpaceEstimateInMB**  The amount of disk space (megabytes) in the Windows store cache that is estimated to be cleanable by the plug-in.
+- **Result**  The HRESULT for Detection or Perform Action phases of the plug-in.
+- **RunCount**  The number of times the plugin has executed.
+- **RunResult**  The HRESULT for Detection or Perform Action phases of the plug-in.
+- **ServiceHardeningExitCode**  The exit code returned by Windows Service Repair.
+- **ServiceHealthEnabledBitMap**  List of services updated by the plugin.
+- **ServiceHealthInstalledBitMap**  List of services installed by the plugin.
+- **StorageSenseDiskCompresserTotalInMB**  The total number of megabytes that Storage Sense cleaned up in the User Download folder.
+- **StorageSenseHelloFaceRecognitionFodCleanupTotalInByte**  The amount of space that Storage Sense was able to clean up in the User Download folder by removing Windows Hello facial recognition.
+- **StorageSenseRestorePointCleanupTotalInMB**  The total number of megabytes that Storage Sense cleaned up in the User Download folder.
+- **StorageSenseUserDownloadFolderCleanupTotalInByte**  The total number of bytes that Storage Sense cleaned up in the User Download folder.
+- **systemDriveFreeDiskSpace**  Indicates the free disk space on system drive, in megabytes.
+- **systemUptimeInHours**  Indicates the amount of time the system in hours has been on since the last boot.
+- **uninstallActive**  TRUE if previous uninstall has occurred for current OS
+- **UpdateApplicabilityFixedBitMap**  Bitmap indicating which fixes were applied by the plugin.
+- **usoScanDaysSinceLastScan**  The number of days since the last USO (Update Session Orchestrator) scan.
+- **usoScanInProgress**  TRUE if a USO (Update Session Orchestrator) scan is in progress, to prevent multiple simultaneous scans.
+- **usoScanIsAllowAutoUpdateKeyPresent**  TRUE if the AllowAutoUpdate registry key is set.
+- **usoScanIsAllowAutoUpdateProviderSetKeyPresent**  TRUE if AllowAutoUpdateProviderSet registry key is set.
+- **usoScanIsAuOptionsPresent**  TRUE if Auto Update Options registry key is set.
+- **usoScanIsFeatureUpdateInProgress**  TRUE if a USO (Update Session Orchestrator) scan is in progress, to prevent multiple simultaneous scans.
+- **usoScanIsNetworkMetered**  TRUE if the device is currently connected to a metered network.
+- **usoScanIsNoAutoUpdateKeyPresent**  TRUE if no Auto Update registry key is set/present.
+- **usoScanIsUserLoggedOn**  TRUE if the user is logged on.
+- **usoScanPastThreshold**  TRUE if the most recent Update Session Orchestrator (USO) scan is past the threshold (late).
+- **usoScanType**  The type of USO (Update Session Orchestrator) scan: "Interactive" or "Background".
+- **windows10UpgraderBlockWuUpdates**  Event to report the value of Windows 10 Upgrader BlockWuUpdates Key.
+- **windowsEditionId**  Event to report the value of Windows Edition ID.
+- **WindowsOldSpaceCleanedInMB**  The amount of disk space freed by removing the Windows.OLD folder, measured in Megabytes.
+- **windowsUpgradeRecoveredFromRs4**  Event to report the value of the Windows Upgrade Recovered key.
+
+
+### Microsoft.Windows.Remediation.Started
+
+This event is sent when Windows Update sediment remediations have started on the sediment device to keep Windows up to date. A sediment device is one that has been on a previous OS version for an extended period. The remediations address issues on the system that prevent the device from receiving OS updates.
+
+The following fields are available:
+
+- **CV**  Correlation vector.
+- **GlobalEventCounter**  Client side counter which indicates ordering of events sent by this user.
+- **PackageVersion**  The version of the current remediation package.
+- **PluginName**  Name of the plugin specified for each generic plugin event.
+- **QualityUpdateSedimentFunnelState**  Provides information about whether quality updates are missing on the device.
+- **QualityUpdateSedimentFunnelType**  Indicates whether the Remediation is for Quality Updates or Feature Updates.
+- **QualityUpdateSedimentJsonSchemaVersion**  The schema version of the Quality Update Sediment Remediation.
+- **QualityUpdateSedimentLastRunSeconds**  The number of seconds since Quality Updates were run.
+- **QualityUpdateSedimentLocaltTime**  The local time of the device running the Quality Update Sediment Remediation.
+- **QualityUpdateSedimentMatchedTriggers**  The list of triggers that were matched by the Windows Quality Update Remediation.
+- **QualityUpdateSedimentSelectedPlugins**  The number of plugins that were selected for execution in the Quality Update Sediment Remediation.
+- **QualityUpdateSedimentTargetedPlugins**  The list of plug-ins targeted by the current Quality Update Sediment Remediation.
+- **QualityUpdateSedimentTargetedTriggers**  The list of triggers targeted by the current Quality Update Sediment Remediation.
+- **RemediationProgramDataFolderSizeInMB**  The size (in megabytes) of the Program Data folder on the device.
+- **RemediationProgramFilesFolderSizeInMB**  The size (in megabytes) of the Program Files folder on the device.
+- **RemediationUsersFolderSizeInMB**  The size (in megabytes) of the Users folder on the device.
+- **RemediationWindowsAppsFolderSizeInMB**  The size (in megabytes) of the Windows Applications folder on the device.
+- **RemediationWindowsBtFolderSizeInMB**  The size (in megabytes) of the Windows BT folder on the device.
+- **RemediationWindowsFolderSizeInMB**  The size (in megabytes) of the Windows folder on the device.
+- **RemediationWindowsServiceProfilesFolderSizeInMB**  The size (in megabytes) of the Windows Service Profiles folder on the device.
+- **RemediationWindowsTotalSystemDiskSize**  The total storage capacity of the System disk drive, measured in megabytes.
+- **Result**  This is the HRESULT for detection or perform action phases of the plugin.
+- **RunCount**  The number of times the remediation event started (whether it completed successfully or not).
+- **WindowsHiberFilSysSizeInMegabytes**  The size of the Windows Hibernation file, measured in megabytes.
+- **WindowsInstallerFolderSizeInMegabytes**  The size of the Windows Installer folder, measured in megabytes.
+- **WindowsOldFolderSizeInMegabytes**  The size of the Windows.OLD folder, measured in megabytes.
+- **WindowsPageFileSysSizeInMegabytes**  The size of the Windows Page file, measured in megabytes.
+- **WindowsSoftwareDistributionFolderSizeInMegabytes**  The size of the Software Distribution folder, measured in megabytes.
+- **WindowsSwapFileSysSizeInMegabytes**  The size of the Windows Swap file, measured in megabytes.
+- **WindowsSxsFolderSizeInMegabytes**  The size of the WinSxS (Windows Side-by-Side) folder, measured in megabytes.
+
 
 ## Sediment events
 
@@ -4709,6 +5658,107 @@ The following fields are available:
 - **Time**  The system time at which the phase chance occurred.
 
 
+### Microsoft.Windows.SedimentLauncher.Applicable
+
+This event is sent when the Windows Update sediment remediations launcher finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
+
+The following fields are available:
+
+- **CV**  Correlation vector.
+- **DetectedCondition**  Boolean true if detect condition is true and perform action will be run.
+- **FileVersion**  The version of the data-link library (DLL) that will be applied by the self-update process.
+- **GlobalEventCounter**  Client side counter which indicates ordering of events sent by this user.
+- **IsHashMismatch**  Indicates whether the hash is a mismatch.
+- **IsSelfUpdateEnabledInOneSettings**  True if self update enabled in Settings.
+- **IsSelfUpdateNeeded**  True if self update needed by device.
+- **PackageVersion**  Current package version of Remediation.
+- **PluginName**  Name of the plugin specified for each generic plugin event.
+- **Result**  This is the HRESULT for detection or perform action phases of the plugin.
+
+
+### Microsoft.Windows.SedimentLauncher.Completed
+
+This event is sent when the Windows Update sediment remediations launcher finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
+
+The following fields are available:
+
+- **CV**  Correlation vector.
+- **FailedReasons**  Concatenated list of failure reasons.
+- **GlobalEventCounter**  Client side counter which indicates ordering of events sent by this user.
+- **PackageVersion**  Current package version of Remediation.
+- **PluginName**  Name of the plugin specified for each generic plugin event.
+- **Result**  This is the HRESULT for detection or perform action phases of the plugin.
+- **SedLauncherExecutionResult**  HRESULT for one execution of the Sediment Launcher.
+
+
+### Microsoft.Windows.SedimentLauncher.Started
+
+This event is sent when the Windows Update sediment remediations launcher starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
+
+The following fields are available:
+
+- **CV**  Correlation vector.
+- **GlobalEventCounter**  Client side counter which indicates ordering of events sent by this user.
+- **PackageVersion**  Current package version of Remediation.
+- **PluginName**  Name of the plugin specified for each generic plugin event.
+- **Result**  This is the HRESULT for detection or perform action phases of the plugin.
+
+
+### Microsoft.Windows.SedimentService.Applicable
+
+This event is sent when the Windows Update sediment remediations service finds that an applicable plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
+
+The following fields are available:
+
+- **CV**  Correlation vector.
+- **DetectedCondition**  Determine whether action needs to run based on device properties.
+- **FileVersion**  The version of the dynamic-link library (DLL) that will be applied by the self-update process.
+- **GlobalEventCounter**  Client side counter which indicates ordering of events sent by this user.
+- **IsHashMismatch**  Indicates whether the hash is a mismatch.
+- **IsSelfUpdateEnabledInOneSettings**  Indicates if self update is enabled in One Settings.
+- **IsSelfUpdateNeeded**  Indicates if self update is needed.
+- **PackageVersion**  Current package version of Remediation.
+- **PluginName**  Name of the plugin.
+- **Result**  This is the HRESULT for detection or perform action phases of the plugin.
+
+
+### Microsoft.Windows.SedimentService.Completed
+
+This event is sent when the Windows Update sediment remediations service finishes running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
+
+The following fields are available:
+
+- **CV**  Correlation vector.
+- **FailedReasons**  List of reasons when the plugin action failed.
+- **GlobalEventCounter**  Client side counter which indicates ordering of events sent by this user.
+- **PackageVersion**  Current package version of Remediation.
+- **PluginName**  Name of the plugin specified for each generic plugin event.
+- **Result**  This is the HRESULT for detection or perform action phases of the plugin.
+- **SedimentServiceCheckTaskFunctional**  True/False if scheduled task check succeeded.
+- **SedimentServiceCurrentBytes**  Number of current private bytes of memory consumed by sedsvc.exe.
+- **SedimentServiceKillService**  True/False if service is marked for kill (Shell.KillService).
+- **SedimentServiceMaximumBytes**  Maximum bytes allowed for the service.
+- **SedimentServiceRanShell**  Indicates whether the shell was run by the service.
+- **SedimentServiceRetrievedKillService**  True/False if result of One Settings check for kill succeeded - we only send back one of these indicators (not for each call).
+- **SedimentServiceShellRunHResult**  The HRESULT returned when the shell was run by the service.
+- **SedimentServiceStopping**  True/False indicating whether the service is stopping.
+- **SedimentServiceTaskFunctional**  True/False if scheduled task is functional. If task is not functional this indicates plugins will be run.
+- **SedimentServiceTotalIterations**  Number of 5 second iterations service will wait before running again.
+
+
+### Microsoft.Windows.SedimentService.Started
+
+This event is sent when the Windows Update sediment remediations service starts running a plug-in to address issues that may be preventing the sediment device from receiving OS updates.  A sediment device is one that has been on a previous OS version for an extended period.
+
+The following fields are available:
+
+- **CV**  The Correlation Vector.
+- **GlobalEventCounter**  The client-side counter that indicates ordering of events.
+- **PackageVersion**  The version number of the current remediation package.
+- **PluginName**  Name of the plugin specified for each generic plugin event.
+- **Result**  This is the HRESULT for Detection or Perform Action phases of the plugin.
+
+
 ## Setup events
 
 ### SetupPlatformTel.SetupPlatformTelActivityEvent
@@ -4748,6 +5798,71 @@ The following fields are available:
 - **Value**  Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time.
 
 
+## SIH events
+
+### SIHEngineTelemetry.EvalApplicability
+
+This event is sent when targeting logic is evaluated to determine if a device is eligible for a given action.
+
+The following fields are available:
+
+- **ActionReasons**  If an action has been assessed as inapplicable, the additional logic prevented it.
+- **AdditionalReasons**  If an action has been assessed as inapplicable, the additional logic prevented it.
+- **CachedEngineVersion**  The engine DLL version that is being used.
+- **EventInstanceID**  A unique identifier for event instance.
+- **EventScenario**  Indicates the purpose of sending this event – whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **HandlerReasons**  If an action has been assessed as inapplicable, the installer technology-specific logic prevented it.
+- **IsExecutingAction**  If the action is presently being executed.
+- **ServiceGuid**  A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.)
+- **SihclientVersion**  The client version that is being used.
+- **StandardReasons**  If an action has been assessed as inapplicable, the standard logic the prevented it.
+- **StatusCode**  Result code of the event (success, cancellation, failure code HResult).
+- **UpdateID**  A unique identifier for the action being acted upon.
+- **WuapiVersion**  The Windows Update API version that is currently installed.
+- **WuaucltVersion**  The Windows Update client version that is currently installed.
+- **WuauengVersion**  The Windows Update engine version that is currently installed.
+- **WUDeviceID**  The unique identifier controlled by the software distribution client.
+
+
+### SIHEngineTelemetry.ExecuteAction
+
+This event is triggered with SIH attempts to execute (e.g. install) the update or action in question. Includes important information like if the update required a reboot.
+
+The following fields are available:
+
+- **CachedEngineVersion**  The engine DLL version that is being used.
+- **EventInstanceID**  A unique identifier for event instance.
+- **EventScenario**  Indicates the purpose of sending this event, whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **RebootRequired**  Indicates if a reboot was required to complete the action.
+- **ServiceGuid**  A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.).
+- **SihclientVersion**  The SIH version.
+- **StatusCode**  Result code of the event (success, cancellation, failure code HResult).
+- **UpdateID**  A unique identifier for the action being acted upon.
+- **WuapiVersion**  The Windows Update API version.
+- **WuaucltVersion**  The Windows Update version identifier for SIH.
+- **WuauengVersion**  The Windows Update engine version identifier.
+- **WUDeviceID**  The unique identifier controlled by the software distribution client.
+
+
+### SIHEngineTelemetry.PostRebootReport
+
+This event reports the status of an action following a reboot, should one have been required.
+
+The following fields are available:
+
+- **CachedEngineVersion**  The engine DLL version that is being used.
+- **EventInstanceID**  A unique identifier for event instance.
+- **EventScenario**  Indicates the purpose of sending this event, whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **ServiceGuid**  A unique identifier that represents which service the software distribution client is connecting to (SIH, Windows Update, Microsoft Store, etc.).
+- **SihclientVersion**  Version of SIH Client on the device.
+- **StatusCode**  Result code of the event (success, cancellation, failure code HResult).
+- **UpdateID**  A unique identifier for the action being acted upon.
+- **WuapiVersion**  Version of Windows Update DLL on the device.
+- **WuaucltVersion**  Version of WUAUCLT (Windows Update Auto-Update Client) on the device.
+- **WuauengVersion**  Version of Windows Update (Auto-Update) engine on the device.
+- **WUDeviceID**  The unique identifier controlled by the software distribution client.
+
+
 ## Software update events
 
 ### SoftwareUpdateClientTelemetry.CheckForUpdates
@@ -4859,7 +5974,7 @@ The following fields are available:
 - **FlightId**  The specific id of the flight the device is getting
 - **HandlerType**  Indicates the kind of content (app, driver, windows patch, etc.)
 - **RevisionNumber**  Identifies the revision number of this specific piece of content
-- **ServiceGuid**  Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc)
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
 - **SystemBIOSMajorRelease**  Major release version of the system bios
 - **SystemBIOSMinorRelease**  Minor release version of the system bios
 - **UpdateId**  Identifier associated with the specific piece of content
@@ -4901,7 +6016,8 @@ The following fields are available:
 - **CurrentMobileOperator**  The mobile operator the device is currently connected to.
 - **DeviceModel**  The model of the device.
 - **DownloadPriority**  Indicates whether a download happened at background, normal, or foreground priority.
-- **DownloadProps**  Information about the download operation.
+- **DownloadProps**  Information about the download operation properties in the form of a bitmask.
+- **DownloadScenarioId**  A unique ID for a given download, used to tie together Windows Update and Delivery Optimizer events.
 - **DownloadType**  Differentiates the download type of “Self-Initiated Healing” (SIH) downloads between Metadata and Payload downloads.
 - **EventInstanceID**  A globally unique identifier for event instance.
 - **EventScenario**  Indicates the purpose for sending this event: whether because the software distribution just started downloading content; or whether it was cancelled, succeeded, or failed.
@@ -4935,7 +6051,7 @@ The following fields are available:
 - **RepeatFailCount**  Indicates whether this specific content has previously failed.
 - **RepeatFailFlag**  Indicates whether this specific content previously failed to download.
 - **RevisionNumber**  The revision number of the specified piece of content.
-- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
 - **Setup360Phase**  Identifies the active phase of the upgrade download if the current download is for an Operating System upgrade.
 - **ShippingMobileOperator**  The mobile operator linked to the device when the device shipped.
 - **SizeCalcTime**  Time (in seconds) taken to calculate the total download size of the payload.
@@ -5117,7 +6233,7 @@ The following fields are available:
 - **RelatedCV**  The previous correlation vector that was used by the client before swapping with a new one.
 - **RepeatFailCount**  Indicates whether this specific piece of content has previously failed.
 - **RevisionNumber**  Identifies the revision number of this specific piece of content.
-- **ServiceGuid**  Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc.).
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
 - **StatusCode**  Result code of the event (success, cancellation, failure code HResult).
 - **TargetGroupId**  For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
 - **TargetingVersion**  For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
@@ -5177,7 +6293,7 @@ The following fields are available:
 - **RelatedCV**  The previous correlation vector that was used by the client before swapping with a new one.
 - **RepeatFailCount**  Indicates whether this specific piece of content previously failed.
 - **RevisionNumber**  Identifies the revision number of this specific piece of content.
-- **ServiceGuid**  Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc.).
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
 - **StatusCode**  Result code of the event (success, cancellation, failure code HResult).
 - **TargetGroupId**  For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
 - **TargetingVersion**  For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
@@ -5210,8 +6326,8 @@ The following fields are available:
 
 - **CallerApplicationName**  Name of application making the Windows Update request. Used to identify context of request.
 - **EndpointUrl**  The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
-- **EventScenario**  The purpose of this event, such as scan started, scan succeeded, or scan failed.
-- **ExtendedStatusCode**  The secondary status code of the event.
+- **EventScenario**  Indicates the purpose of the event - whether because scan started, succeded, failed, etc.
+- **ExtendedStatusCode**  Secondary status code for certain scenarios where StatusCode was not specific enough.
 - **LeafCertId**  The integral ID from the FragmentSigning data for the certificate that failed.
 - **ListOfSHA256OfIntermediateCerData**  A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
 - **MetadataIntegrityMode**  The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
@@ -5226,7 +6342,7 @@ The following fields are available:
 - **SHA256OfTimestampToken**  An encoded string of the timestamp token.
 - **SignatureAlgorithm**  The hash algorithm for the metadata signature.
 - **SLSPrograms**  A test program to which a device may have opted in. Example: Insider Fast
-- **StatusCode**  The status code of the event.
+- **StatusCode**  Result code of the event (success, cancellation, failure code HResult).
 - **TimestampTokenCertThumbprint**  The thumbprint of the encoded timestamp token.
 - **TimestampTokenId**  The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed.
 - **UpdateId**  The update ID for a specific piece of content.
@@ -5245,7 +6361,6 @@ The following fields are available:
 - **UsageMean**  The mean of hourly average CPU usage.
 - **UsageMedian**  The median of hourly average CPU usage.
 - **UsageTwoHourMaxMean**  The mean of the maximum of every two hour of hourly average CPU usage.
-- **UsageTwoHourMedianMean**  The mean of the median of every two hour of hourly average CPU usage.
 
 
 ### Microsoft.Windows.Srum.Sdp.NetworkUsage
@@ -5259,7 +6374,6 @@ The following fields are available:
 - **BytesTotalMean**  The mean of the hourly average bytes total.
 - **BytesTotalMedian**  The median of the hourly average bytes total.
 - **BytesTotalTwoHourMaxMean**  The mean of the maximum of every two hours of hourly average bytes total.
-- **BytesTotalTwoHourMedianMean**  The mean of the median of every two hour of hourly average bytes total.
 - **LinkSpeed**  The adapter link speed.
 
 
@@ -5305,7 +6419,9 @@ This event sends data for the download request phase of updating Windows via the
 
 The following fields are available:
 
+- **ContainsSafeOSDUPackage**  Boolean indicating whether Safe DU packages are part of the payload.
 - **DeletedCorruptFiles**  Boolean indicating whether corrupt payload was deleted.
+- **DownloadComplete**  Indicates if the download is complete.
 - **DownloadRequests**  Number of times a download was retried.
 - **ErrorCode**  The error code returned for the current download request phase.
 - **ExtensionName**  Indicates whether the payload is related to Operating System content or a plugin.
@@ -5319,10 +6435,12 @@ The following fields are available:
 - **PackageCountTotalCanonical**  Total number of canonical packages.
 - **PackageCountTotalDiff**  Total number of diff packages.
 - **PackageCountTotalExpress**  Total number of express packages.
+- **PackageCountTotalPSFX**  The total number of PSFX packages.
 - **PackageExpressType**  Type of express package.
 - **PackageSizeCanonical**  Size of canonical packages in bytes.
 - **PackageSizeDiff**  Size of diff packages in bytes.
 - **PackageSizeExpress**  Size of express packages in bytes.
+- **PackageSizePSFX**  The size of PSFX packages, in bytes.
 - **RangeRequestState**  Indicates the range request type used.
 - **RelatedCV**  Correlation vector value generated from the latest USO scan.
 - **Result**  Outcome of the download request phase of update.
@@ -5525,12 +6643,15 @@ The following fields are available:
 
 - **ErrorCode**  The error code returned for the current reboot.
 - **FlightId**  Unique ID for the flight (test instance version).
+- **IsSuspendable**  Indicates whether the update has the ability to be suspended and resumed at the time of reboot. When the machine is rebooted and the update is in middle of Predownload or Install and Setup.exe is running, this field is TRUE, if not its FALSE.
 - **ObjectId**  The unique value for each Update Agent mode.
+- **Reason**  Indicates the HResult why the machine could not be suspended. If it is successfully suspended, the result is 0.
 - **RelatedCV**  The correlation vector value generated from the latest USO (Update Service Orchestrator) scan.
 - **Result**  The HResult of the event.
 - **ScenarioId**  The ID of the update scenario.
 - **SessionId**  The ID of the update attempt.
 - **UpdateId**  The ID of the update.
+- **UpdateState**  Indicates the state of the machine when Suspend is called. For example, Install, Download, Commit.
 
 
 ### Update360Telemetry.UpdateAgentSetupBoxLaunch
@@ -5549,6 +6670,7 @@ The following fields are available:
 - **SandboxSize**  Size of the sandbox.
 - **ScenarioId**  Indicates the update scenario.
 - **SessionId**  Unique value for each update attempt.
+- **SetupLaunchAttemptCount**  Indicates the count of attempts to launch setup for the current Update Agent instance.
 - **SetupMode**  Mode of setup to be launched.
 - **UpdateId**  Unique ID for each Update.
 - **UserSession**  Indicates whether install was invoked by user actions.
@@ -5556,6 +6678,22 @@ The following fields are available:
 
 ## Update notification events
 
+### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignHeartbeat
+
+This event is sent at the start of each campaign, to be used as a heartbeat.
+
+The following fields are available:
+
+- **CampaignConfigVersion**  Configuration version for the current campaign.
+- **CampaignID**  Current campaign that is running on Update Notification Pipeline.
+- **ConfigCatalogVersion**  Current catalog version of Update Notification Pipeline.
+- **ContentVersion**  Content version for the current campaign on Update Notification Pipeline.
+- **CV**  Correlation vector.
+- **DetectorVersion**  Most recently run detector version for the current campaign on Update Notification Pipeline.
+- **GlobalEventCounter**  Client-side counter that indicates the event ordering sent by the user.
+- **PackageVersion**  Current package version for Update Notification Pipeline.
+
+
 ### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat
 
 This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat.
@@ -5572,11 +6710,28 @@ The following fields are available:
 - **PackageVersion**  Current UNP package version.
 
 
+### Microsoft.Windows.UpdateNotificationPipeline.UnpCampaignManagerRunCampaignFailed
+
+This event is sent when the Campaign Manager encounters an unexpected error while running the campaign.
+
+The following fields are available:
+
+- **CampaignConfigVersion**  Configuration version for the current campaign.
+- **CampaignID**  Currently campaign that's running on Update Notification Pipeline (UNP).
+- **ConfigCatalogVersion**  Current catalog version of UNP.
+- **ContentVersion**  Content version for the current campaign on UNP.
+- **CV**  Correlation vector.
+- **DetectorVersion**  Most recently run detector version for the current campaign on UNP.
+- **GlobalEventCounter**  Client-side counter that indicates the event ordering sent by the user.
+- **hresult**  HRESULT of the failure.
+- **PackageVersion**  Current UNP package version.
+
+
 ## Upgrade events
 
 ### FacilitatorTelemetry.DCATDownload
 
-This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up-to-date and secure.
+This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure.
 
 The following fields are available:
 
@@ -5595,13 +6750,8 @@ This event returns data about the download of supplemental packages critical to
 
 The following fields are available:
 
-- **DownloadRequestAttributes**  The attributes sent for download.
 - **PackageCategoriesFailed**  Lists the categories of packages that failed to download.
 - **PackageCategoriesSkipped**  Lists the categories of package downloads that were skipped.
-- **ResultCode**  The result of the event execution.
-- **Scenario**  Identifies the active Download scenario.
-- **Url**  The URL the download request was sent to.
-- **Version**  Identifies the version of Facilitator used.
 
 
 ### FacilitatorTelemetry.InitializeDU
@@ -5620,7 +6770,7 @@ The following fields are available:
 
 ### Setup360Telemetry.Downlevel
 
-This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up-to-date and secure.
+This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure.
 
 The following fields are available:
 
@@ -5918,14 +7068,21 @@ Result of the WaaSMedic operation.
 The following fields are available:
 
 - **callerApplication**  The name of the calling application.
+- **capsuleCount**  The number of Sediment Pack capsules.
+- **capsuleFailureCount**  The number of capsule failures.
 - **detectionSummary**  Result of each applicable detection that was run.
 - **featureAssessmentImpact**  WaaS Assessment impact for feature updates.
+- **hrEngineBlockReason**  Indicates the reason for stopping WaaSMedic.
 - **hrEngineResult**  Error code from the engine operation.
+- **hrLastSandboxError**  The last error sent by the WaaSMedic sandbox.
+- **initSummary**  Summary data of the initialization method.
 - **insufficientSessions**  Device not eligible for diagnostics.
 - **isInteractiveMode**  The user started a run of WaaSMedic.
 - **isManaged**  Device is managed for updates.
 - **isWUConnected**  Device is connected to Windows Update.
 - **noMoreActions**  No more applicable diagnostics.
+- **pluginFailureCount**  The number of plugins that have failed.
+- **pluginsCount**  The number of plugins.
 - **qualityAssessmentImpact**  WaaS Assessment impact for quality updates.
 - **remediationSummary**  Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on.
 - **usingBackupFeatureAssessment**  Relying on backup feature assessment.
@@ -5955,6 +7112,18 @@ The following fields are available:
 - **IsValidDumpFile**  True if the dump file is valid for the debugger, false otherwise
 - **ReportId**  WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson).
 
+### Value
+
+This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy.
+
+The following fields are available:
+
+- **Algorithm**  The algorithm used to preserve privacy.
+- **DPRange**  The upper bound of the range being measured.
+- **DPValue**  The randomized response returned by the client.
+- **Epsilon**  The level of privacy to be applied.
+- **HistType**  The histogram type if the algorithm is a histogram algorithm.
+- **PertProb**  The probability the entry will be Perturbed if the algorithm chosen is “heavy-hitters”.
 
 ## Windows Error Reporting MTT events
 
@@ -5969,27 +7138,7 @@ The following fields are available:
 - **Value**  Standard UTC emitted DP value structure See [Value](#value).
 
 
-### Value
-
-This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy.
-
-The following fields are available:
-
-- **Algorithm**  The algorithm used to preserve privacy.
-- **DPRange**  The upper bound of the range being measured.
-- **DPValue**  The randomized response returned by the client.
-- **Epsilon**  The level of privacy to be applied.
-- **HistType**  The histogram type if the algorithm is a histogram algorithm.
-- **PertProb**  The probability the entry will be Perturbed if the algorithm chosen is “heavy-hitters”.
-
-
-## Microsoft Store events
-
-### Microsoft.Windows.Store.StoreActivating
-
-This event sends tracking data about when the Store app activation via protocol URI is in progress, to help keep Windows up to date.
-
-
+## Windows Store events
 
 ### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation
 
@@ -6079,6 +7228,7 @@ The following fields are available:
 
 - **AggregatedPackageFullNames**  Includes a set of package full names for each app that is part of an atomic set.
 - **AttemptNumber**  The total number of attempts to acquire this product.
+- **BundleId**  The identity of the test build (flight) associated with this product.
 - **CategoryId**  The identity of the package or packages being installed.
 - **ClientAppId**  The identity of the app that initiated this operation.
 - **HResult**  HResult code to show the result of the operation (success/failure).
@@ -6088,6 +7238,7 @@ The following fields are available:
 - **IsRemediation**  Is this repairing a previous installation?
 - **IsRestore**  Is this happening after a device restore?
 - **IsUpdate**  Is this an update?
+- **ParentBundleId**  The product identifier of the parent if this product is part of a bundle.
 - **PFN**  Product Family Name of the product being installed.
 - **ProductId**  The Store Product ID for the product being installed.
 - **SystemAttemptNumber**  The number of attempts by the system to acquire this product.
@@ -6378,6 +7529,11 @@ This event sends simple Product and Service usage data when a user is using the
 The following fields are available:
 
 - **Phase**  The image creation phase. Values are “Start” or “End”.
+- **Result**  Result of the image creation phase. Indicates if the image was created successfully. Value is integer.
+- **WorkspaceArchitecture**  Architecture of image created.
+- **WorkspaceOsEdition**  OSEdition of the image created.
+- **WskImageEnvironment**  Type of environment image was created for "Lab" or "Non-Lab".
+- **WskSessionId**  A string identifier (GUID) for the workspace.
 - **WskVersion**  The version of the Windows System Kit being used.
 
 
@@ -6391,7 +7547,9 @@ The following fields are available:
 - **CustomizationType**  Indicates the type of customization (drivers or apps).
 - **Mode**  The mode of update to image configuration files. Values are “New” or “Update”.
 - **Phase**  The image creation phase. Values are “Start” or “End”.
+- **Result**  Result of the image creation phase.
 - **Type**  The type of update to image configuration files. Values are “Apps” or “Drivers”.
+- **WskSessionId**  A string identifier (GUID) for the workspace.
 - **WskVersion**  The version of the Windows System Kit being used.
 
 
@@ -6404,11 +7562,21 @@ The following fields are available:
 - **Architecture**  The OS architecture that the workspace will target. Values are one of: “AMD64”, “ARM64”, “x86”, or “ARM”.
 - **OsEdition**  The Operating System Edition that the workspace will target.
 - **Phase**  The image creation phase. Values are “Start” or “End”.
+- **Result**  Stage result. Values are integers.
 - **WorkspaceArchitecture**  The operating system architecture that the workspace will target.
 - **WorkspaceOsEdition**  The operating system edition that the workspace will target.
+- **WskSessionId**  A string identifier (GUID) for the workspace.
 - **WskVersion**  The version of the Windows System Kit being used.
 
 
+## Windows Update CSP events
+
+### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted
+
+This event sends basic information indicating that Feature Rollback has started.
+
+
+
 ## Windows Update Delivery Optimization events
 
 ### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled
@@ -6422,6 +7590,7 @@ The following fields are available:
 - **bytesFromCDN**  The number of bytes received from a CDN source.
 - **bytesFromGroupPeers**  The number of bytes received from a peer in the same group.
 - **bytesFromIntPeers**  The number of bytes received from peers not in the same LAN or in the same group.
+- **bytesFromLinkLocalPeers**  The number of bytes received from local peers.
 - **bytesFromLocalCache**  Bytes copied over from local (on disk) cache.
 - **bytesFromPeers**  The number of bytes received from a peer in the same LAN.
 - **cdnErrorCodes**  A list of CDN connection errors since the last FailureCDNCommunication event.
@@ -6473,6 +7642,7 @@ The following fields are available:
 - **downloadModeReason**  Reason for the download.
 - **downloadModeSrc**  Source of the DownloadMode setting (KvsProvider = 0, GeoProvider = 1, GeoVerProvider = 2, CpProvider = 3, DiscoveryProvider = 4, RegistryProvider = 5, GroupPolicyProvider = 6, MdmProvider = 7, SettingsProvider = 8, InvalidProviderType = 9).
 - **experimentId**  When running a test, this is used to correlate with other events that are part of the same test.
+- **expiresAt**  The time when the content will expire from the Delivery Optimization Cache.
 - **fileID**  The ID of the file being downloaded.
 - **fileSize**  The size of the file being downloaded.
 - **gCurMemoryStreamBytes**  Current usage for memory streaming.
@@ -6480,6 +7650,7 @@ The following fields are available:
 - **groupConnectionCount**  The total number of connections made to peers in the same group.
 - **internetConnectionCount**  The total number of connections made to peers not in the same LAN or the same group.
 - **isEncrypted**  TRUE if the file is encrypted and will be decrypted after download.
+- **isThrottled**  Indicates the Event Rate was throttled (event represent aggregated data).
 - **isVpn**  Is the device connected to a Virtual Private Network?
 - **jobID**  Identifier for the Windows Update job.
 - **lanConnectionCount**  The total number of connections made to peers in the same LAN.
@@ -6884,6 +8055,16 @@ The following fields are available:
 - **wuDeviceid**  Device ID.
 
 
+### Microsoft.Windows.Update.Orchestrator.CommitFailed
+
+This event indicates that a device was unable to restart after an update.
+
+The following fields are available:
+
+- **errorCode**  The error code that was returned.
+- **wuDeviceid**  The Windows Update device GUID.
+
+
 ### Microsoft.Windows.Update.Orchestrator.DeferRestart
 
 This event indicates that a restart required for installing updates was postponed.
@@ -6925,6 +8106,39 @@ The following fields are available:
 - **wuDeviceid**  The unique device ID used by Windows Update.
 
 
+### Microsoft.Windows.Update.Orchestrator.DetectionActivity
+
+This event returns data about detected updates, as well as the types of update (optional or recommended). This data helps keep Windows up to date.
+
+The following fields are available:
+
+- **applicableUpdateIdList**  The list of update identifiers.
+- **applicableUpdateList**  The list of available updates.
+- **durationInSeconds**  The amount of time (in seconds) it took for the event to run.
+- **expeditedMode**  Indicates whether Expedited Mode is on.
+- **networkCostPolicy**  The network cost.
+- **scanTriggerSource**  Indicates whether the scan is Interactive or Background.
+- **scenario**  The result code of the event.
+- **scenarioReason**  The reason for the result code (scenario).
+- **seekerUpdateIdList**  The list of “seeker” update identifiers.
+- **seekerUpdateList**  The list of “seeker” updates.
+- **services**  The list of services that were called during update.
+- **wilActivity**  The activity results. See [wilActivity](#wilactivity).
+
+
+### Microsoft.Windows.Update.Orchestrator.DetectionResult
+
+This event runs when an update is detected. This helps ensure Windows is kept up to date.
+
+The following fields are available:
+
+- **applicableUpdateIdList**  A list of applicable update IDs.
+- **applicableUpdateList**  A list of applicable update names.
+- **seekerUpdateIdList**  A list of optional update IDs.
+- **seekerUpdateList**  A list of optional update names.
+- **wuDeviceid**  The Windows Update device identifier.
+
+
 ### Microsoft.Windows.Update.Orchestrator.DisplayNeeded
 
 This event indicates the reboot was postponed due to needing a display.
@@ -7100,6 +8314,23 @@ The following fields are available:
 - **wuDeviceid**  The Windows Update Device GUID (Globally-Unique ID).
 
 
+### Microsoft.Windows.Update.Orchestrator.PostInstall
+
+This event is sent after a Windows update install completes.
+
+The following fields are available:
+
+- **batteryLevel**  Current battery capacity in megawatt-hours (mWh) or percentage left.
+- **bundleId**  The unique identifier associated with the specific content bundle.
+- **bundleRevisionnumber**  Identifies the revision number of the content bundle.
+- **errorCode**  The error code returned for the current phase.
+- **eventScenario**  State of update action.
+- **flightID**  The unique identifier for the flight (Windows Insider pre-release build) should be delivered to the device, if applicable.
+- **sessionType**  The Windows Update session type (Interactive or Background).
+- **updateScenarioType**  Identifies the type of Update session being performed.
+- **wuDeviceid**  The unique device identifier used by Windows Update.
+
+
 ### Microsoft.Windows.Update.Orchestrator.PreShutdownStart
 
 This event is generated before the shutdown and commit operations.
@@ -7171,6 +8402,32 @@ The following fields are available:
 - **wuDeviceid**  Unique device ID used by Windows Update.
 
 
+### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable
+
+This event defines when an optional update is available for the device to help keep Windows up to date.
+
+The following fields are available:
+
+- **flightID**  The unique identifier of the Windows Insider build on this device.
+- **isFeatureUpdate**  Indicates whether the update is a Feature Update.
+- **revisionNumber**  The revision number of the update.
+- **updateId**  The GUID (Globally Unique Identifier) of the update.
+- **wuDeviceid**  The Windows Update device identifier.
+
+
+### Microsoft.Windows.Update.Orchestrator.SeekUpdate
+
+This event occurs when user initiates "seeker" scan. This helps keep Windows up to date.
+
+The following fields are available:
+
+- **flightID**  The ID of the Windows Insider builds on the device.
+- **isFeatureUpdate**  Indicates that the target of the Seek is a feature update.
+- **revisionNumber**  The revision number of the update.
+- **updateId**  The identifier of the update.
+- **wuDeviceid**  The Windows Update device identifier.
+
+
 ### Microsoft.Windows.Update.Orchestrator.StickUpdate
 
 This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update.
@@ -7398,19 +8655,19 @@ This event sends data specific to the FixAppXReparsePoints mitigation used for O
 
 The following fields are available:
 
-- **ClientId**  Unique identifier for each flight.
+- **ClientId**  In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
 - **FlightId**  Unique GUID that identifies each instances of setuphost.exe.
-- **InstanceId**  The update scenario in which the mitigation was executed.
-- **MitigationScenario**  Correlation vector value generated from the latest USO scan.
-- **RelatedCV**  Number of reparse points that are corrupted but we failed to fix them.
-- **ReparsePointsFailed**  Number of reparse points that were corrupted and were fixed by this mitigation.
-- **ReparsePointsFixed**  Number of reparse points that are not corrupted and no action is required.
-- **ReparsePointsSkipped**  HResult of this operation.
-- **Result**  ID indicating the mitigation scenario.
-- **ScenarioId**  Indicates whether the scenario was supported.
-- **ScenarioSupported**  Unique value for each update attempt.
-- **SessionId**  Unique ID for each Update.
-- **UpdateId**  Unique ID for the Windows Update client.
+- **InstanceId**  Unique GUID that identifies each instances of setuphost.exe.
+- **MitigationScenario**  The update scenario in which the mitigation was executed.
+- **RelatedCV**  Correlation vector value generated from the latest USO scan.
+- **ReparsePointsFailed**  Number of reparse points that were corrupted but were not fixed by this mitigation.
+- **ReparsePointsFixed**  Number of reparse points that were corrupted and were fixed by this mitigation.
+- **ReparsePointsSkipped**  Number of reparse points that are not corrupted and no action is required.
+- **Result**  HResult of this operation.
+- **ScenarioId**  ID indicating the mitigation scenario.
+- **ScenarioSupported**  Indicates whether the scenario was supported.
+- **SessionId**  Unique ID for the update session.
+- **UpdateId**  Unique ID for the Windows Update.
 - **WuId**  Unique ID for the Windows Update client.
 
 
@@ -7462,12 +8719,28 @@ The following fields are available:
 - **ReturnCode**  The return code of the function.
 
 
+### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager
+
+This event returns data about the Update Reserve Manager, including whether it’s been initialized.
+
+The following fields are available:
+
+- **ClientId**  The ID of the caller application.
+- **Flags**  The enumerated flags used to initialize the manager.
+- **FlightId**  The flight ID of the content the calling client is currently operating with.
+- **Offline**  Indicates whether or the reserve manager is called during offline operations.
+- **PolicyPassed**  Indicates whether the machine is able to use reserves.
+- **ReturnCode**  Return code of the operation.
+- **Version**  The version of the Update Reserve Manager.
+
+
 ### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization
 
 This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot.
 
 The following fields are available:
 
+- **FallbackLogicUsed**  Indicates whether fallback logic was used for initialization.
 - **Flags**  The flags that are passed to the function to prepare the Trusted Installer for reserve initialization.
 
 
@@ -7484,6 +8757,8 @@ This event is sent when the Update Reserve Manager needs to adjust the size of t
 The following fields are available:
 
 - **ChangeSize**  The change in the hard reserve size based on the addition or removal of optional content.
+- **Disposition**  The parameter for the hard reserve adjustment function.
+- **Flags**  The flags passed to the hard reserve adjustment function.
 - **PendingHardReserveAdjustment**  The final change to the hard reserve size.
 - **UpdateType**  Indicates whether the change is an increase or decrease in the size of the hard reserve.
 
diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md
new file mode 100644
index 0000000000..894a0dd764
--- /dev/null
+++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md
@@ -0,0 +1,8461 @@
+---
+description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. Specific to Windows 10, version 1903.
+title: Windows 10, version 1903 and Windows 10, version 1909 basic diagnostic events and fields (Windows 10)
+keywords: privacy, telemetry
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+localizationpriority: high
+author: brianlic-msft
+ms.author: brianlic
+manager: dansimp
+ms.collection: M365-security-compliance
+ms.topic: article
+audience: ITPro
+ms.date: 12/10/2019
+---
+
+
+# Windows 10, version 1903 and Windows 10, version 1909 basic level Windows diagnostic events and fields
+
+ **Applies to**
+
+- Windows 10, version 1909
+- Windows 10, version 1903
+
+
+The Basic level gathers a limited set of information that is critical for understanding the device and its configuration including: basic device information, quality-related information, app compatibility, and Microsoft Store. When the level is set to Basic, it also includes the Security level information.
+
+The Basic level helps to identify problems that can occur on a particular device hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a particular driver version. This helps Microsoft fix operating system or app problems.
+
+Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data.
+
+You can learn more about Windows functional and diagnostic data through these articles:
+
+
+- [Windows 10, version 1809 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1809.md)
+- [Windows 10, version 1803 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md)
+- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md)
+- [Windows 10, version 1703 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md)
+- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
+- [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
+
+
+
+
+## AppLocker events
+
+### Microsoft.Windows.Security.AppLockerCSP.AddParams
+
+This event indicates the parameters passed to the Add function of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **child**  The child URI of the node to add.
+- **uri**  URI of the node relative to %SYSTEM32%/AppLocker.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.AddStart
+
+This event indicates the start of an Add operation for the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+
+
+### Microsoft.Windows.Security.AppLockerCSP.AddStop
+
+This event indicates the end of an Add operation for the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **hr**  The HRESULT returned by Add function in AppLockerCSP.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.CAppLockerCSP::Commit
+
+This event returns information about the Commit operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure..
+
+The following fields are available:
+
+- **oldId**  The unique identifier for the most recent previous CSP transaction.
+- **txId**  The unique identifier for the current CSP transaction.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.CAppLockerCSP::Rollback
+
+This event provides the result of the Rollback operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **oldId**  Previous id for the CSP transaction.
+- **txId**  Current id for the CSP transaction.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.ClearParams
+
+This event provides the parameters passed to the Clear operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **uri**  The URI relative to the %SYSTEM32%\AppLocker folder.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.ClearStart
+
+This event indicates the start of the Clear operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+
+
+### Microsoft.Windows.Security.AppLockerCSP.ClearStop
+
+This event indicates the end of the Clear operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **hr**  HRESULT reported at the end of the 'Clear' function.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.CreateNodeInstanceParams
+
+This event provides the parameters that were passed to the Create Node Instance operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **NodeId**  NodeId passed to CreateNodeInstance.
+- **nodeOps**  NodeOperations parameter passed to CreateNodeInstance.
+- **uri**  URI passed to CreateNodeInstance, relative to %SYSTEM32%\AppLocker.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.CreateNodeInstanceStart
+
+This event indicates the start of the Create Node Instance operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+
+
+### Microsoft.Windows.Security.AppLockerCSP.CreateNodeInstanceStop
+
+This event indicates the end of the Create Node Instance operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **hr**  HRESULT returned by the CreateNodeInstance function in AppLockerCSP.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.DeleteChildParams
+
+This event provides the parameters passed to the Delete Child operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **child**  The child URI of the node to delete.
+- **uri**  URI relative to %SYSTEM32%\AppLocker.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.DeleteChildStart
+
+This event indicates the start of the Delete Child operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+
+
+### Microsoft.Windows.Security.AppLockerCSP.DeleteChildStop
+
+This event indicates the end of the Delete Child operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **hr**  HRESULT returned by the DeleteChild function in AppLockerCSP.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.EnumPolicies
+
+This event provides the logged Uniform Resource Identifier (URI) relative to %SYSTEM32%\AppLocker if the plug-in GUID is null or the Configuration Service Provider (CSP) doesn't believe the old policy is present.
+
+The following fields are available:
+
+- **uri**  URI relative to %SYSTEM32%\AppLocker.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.GetChildNodeNamesParams
+
+This event provides the parameters passed to the Get Child Node Names operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **uri**  URI relative to %SYSTEM32%/AppLocker for MDM node.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.GetChildNodeNamesStart
+
+This event indicates the start of the Get Child Node Names operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+
+
+### Microsoft.Windows.Security.AppLockerCSP.GetChildNodeNamesStop
+
+This event indicates the end of the Get Child Node Names operation of the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **child[0]**  If function succeeded, the first child's name, else "NA".
+- **count**  If function succeeded, the number of child node names returned by the function, else 0.
+- **hr**  HRESULT returned by the GetChildNodeNames function of AppLockerCSP.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.GetLatestId
+
+This event provides the latest time-stamped unique identifier in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **dirId**  The latest directory identifier found by GetLatestId.
+- **id**  The id returned by GetLatestId if id > 0 - otherwise the dirId parameter.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.HResultException
+
+This event provides the result code (HRESULT) generated by any arbitrary function in the AppLocker Configuration Service Provider (CSP).
+
+The following fields are available:
+
+- **file**  File in the OS code base in which the exception occurs.
+- **function**  Function in the OS code base in which the exception occurs.
+- **hr**  HRESULT that is reported.
+- **line**  Line in the file in the OS code base in which the exception occurs.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.SetValueParams
+
+This event provides the parameters that were passed to the SetValue operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+The following fields are available:
+
+- **dataLength**  Length of the value to set.
+- **uri**  The node URI to that should contain the value, relative to %SYSTEM32%\AppLocker.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.SetValueStart
+
+This event indicates the start of the SetValue operation in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure.
+
+
+
+### Microsoft.Windows.Security.AppLockerCSP.SetValueStop
+
+End of the "SetValue" operation for the AppLockerCSP node.
+
+The following fields are available:
+
+- **hr**  HRESULT returned by the SetValue function in AppLockerCSP.
+
+
+### Microsoft.Windows.Security.AppLockerCSP.TryRemediateMissingPolicies
+
+This event provides information for fixing a policy in the AppLocker Configuration Service Provider (CSP) to help keep Windows secure. It includes Uniform Resource Identifier (URI) relative to %SYSTEM32%\AppLocker that needs to be fixed.
+
+The following fields are available:
+
+- **uri**  URI for node relative to %SYSTEM32%/AppLocker.
+
+
+## Appraiser events
+
+### Microsoft.Windows.Appraiser.General.ChecksumTotalPictureCount
+
+This event lists the types of objects and how many of each exist on the client device. This allows for a quick way to ensure that the records present on the server match what is present on the client.
+
+The following fields are available:
+
+- **DatasourceApplicationFile_19H1**  The count of the number of this particular object type present on this device.
+- **DatasourceApplicationFile_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceApplicationFile_20H1**  The count of the number of this particular object type present on this device.
+- **DatasourceApplicationFile_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceApplicationFile_RS1**  An ID for the system, calculated by hashing hardware identifiers.
+- **DatasourceApplicationFile_RS2**  An ID for the system, calculated by hashing hardware identifiers.
+- **DatasourceApplicationFile_RS3**  The count of the number of this particular object type present on this device.
+- **DatasourceApplicationFile_RS4**  The count of the number of this particular object type present on this device.
+- **DatasourceApplicationFile_RS5**  The count of the number of this particular object type present on this device.
+- **DatasourceApplicationFile_TH1**  The count of the number of this particular object type present on this device.
+- **DatasourceApplicationFile_TH2**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_19H1**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_20H1**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_RS1**  The total DataSourceDevicePnp objects targeting Windows 10 version 1607 on this device.
+- **DatasourceDevicePnp_RS2**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_RS3**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_RS3Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_RS4**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_RS4Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_RS5**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_RS5Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_TH1**  The count of the number of this particular object type present on this device.
+- **DatasourceDevicePnp_TH2**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_19H1**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_20H1**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_RS1**  The total DataSourceDriverPackage objects targeting Windows 10 version 1607 on this device.
+- **DatasourceDriverPackage_RS2**  The total DataSourceDriverPackage objects targeting Windows 10, version 1703 on this device.
+- **DatasourceDriverPackage_RS3**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_RS3Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_RS4**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_RS4Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_RS5**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_RS5Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_TH1**  The count of the number of this particular object type present on this device.
+- **DatasourceDriverPackage_TH2**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_19H1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_20H1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_RS1**  The total DataSourceMatchingInfoBlock objects targeting Windows 10 version 1607 on this device.
+- **DataSourceMatchingInfoBlock_RS2**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_RS3**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_RS4**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_RS5**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_TH1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoBlock_TH2**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_19H1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_20H1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_RS1**  The total DataSourceMatchingInfoPassive objects targeting Windows 10 version 1607 on this device.
+- **DataSourceMatchingInfoPassive_RS2**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_RS3**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_RS4**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_RS5**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_TH1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPassive_TH2**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPoltUpgrade_20H1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPostUpgrade_19H1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPostUpgrade_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPostUpgrade_20H1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPostUpgrade_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS1**  The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS2**  The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS3**  The total DataSourceMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS4**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPostUpgrade_RS5**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPostUpgrade_TH1**  The count of the number of this particular object type present on this device.
+- **DataSourceMatchingInfoPostUpgrade_TH2**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_19ASetup**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_19H1**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_20H1**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_RS1**  The total DatasourceSystemBios objects targeting Windows 10 version 1607 present on this device.
+- **DatasourceSystemBios_RS2**  The total DatasourceSystemBios objects targeting Windows 10 version 1703 present on this device.
+- **DatasourceSystemBios_RS3**  The total DatasourceSystemBios objects targeting Windows 10 version 1709 present on this device.
+- **DatasourceSystemBios_RS3Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_RS4**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_RS4Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_RS5**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_RS5Setup**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_TH1**  The count of the number of this particular object type present on this device.
+- **DatasourceSystemBios_TH2**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_19H1**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_RS1**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_RS2**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_RS3**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_RS4**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_RS5**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_TH1**  The count of the number of this particular object type present on this device.
+- **DecisionApplicationFile_TH2**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_19H1**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_RS1**  The total DecisionDevicePnp objects targeting Windows 10 version 1607 on this device.
+- **DecisionDevicePnp_RS2**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_RS3**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_RS3Setup**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_RS4**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_RS4Setup**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_RS5**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_RS5Setup**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_TH1**  The count of the number of this particular object type present on this device.
+- **DecisionDevicePnp_TH2**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_19H1**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_RS1**  The total DecisionDriverPackage objects targeting Windows 10 version 1607 on this device.
+- **DecisionDriverPackage_RS2**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_RS3**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_RS3Setup**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_RS4**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_RS4Setup**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_RS5**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_RS5Setup**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_TH1**  The count of the number of this particular object type present on this device.
+- **DecisionDriverPackage_TH2**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoBlock_19H1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoBlock_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoBlock_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoBlock_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoBlock_RS1**  The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1607 present on this device.
+- **DecisionMatchingInfoBlock_RS2**  The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1703 present on this device.
+- **DecisionMatchingInfoBlock_RS3**  The total DecisionMatchingInfoBlock objects targeting Windows 10 version 1709 present on this device.
+- **DecisionMatchingInfoBlock_RS4**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoBlock_RS5**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoBlock_TH1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoBlock_TH2**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPassive_19H1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPassive_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPassive_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPassive_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPassive_RS1**  The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1607 on this device.
+- **DecisionMatchingInfoPassive_RS2**  The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1703 on this device.
+- **DecisionMatchingInfoPassive_RS3**  The total DecisionMatchingInfoPassive objects targeting Windows 10 version 1803 on this device.
+- **DecisionMatchingInfoPassive_RS4**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPassive_RS5**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPassive_TH1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPassive_TH2**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPoltUpgrade_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPostUpgrade_19H1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPostUpgrade_19H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPostUpgrade_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPostUpgrade_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPostUpgrade_RS1**  The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1607 on this device.
+- **DecisionMatchingInfoPostUpgrade_RS2**  The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1703 on this device.
+- **DecisionMatchingInfoPostUpgrade_RS3**  The total DecisionMatchingInfoPostUpgrade objects targeting Windows 10 version 1709 on this device.
+- **DecisionMatchingInfoPostUpgrade_RS4**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPostUpgrade_RS5**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPostUpgrade_TH1**  The count of the number of this particular object type present on this device.
+- **DecisionMatchingInfoPostUpgrade_TH2**  The count of the number of this particular object type present on this device.
+- **DecisionMediaCenter_19H1**  The count of the number of this particular object type present on this device.
+- **DecisionMediaCenter_19H1Setup**  The total DecisionMediaCenter objects targeting the next release of Windows on this device.
+- **DecisionMediaCenter_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionMediaCenter_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionMediaCenter_RS1**  The total DecisionMediaCenter objects targeting Windows 10 version 1607 present on this device.
+- **DecisionMediaCenter_RS2**  The total DecisionMediaCenter objects targeting Windows 10 version 1703 present on this device.
+- **DecisionMediaCenter_RS3**  The total DecisionMediaCenter objects targeting Windows 10 version 1709 present on this device.
+- **DecisionMediaCenter_RS4**  The count of the number of this particular object type present on this device.
+- **DecisionMediaCenter_RS5**  The count of the number of this particular object type present on this device.
+- **DecisionMediaCenter_TH1**  The count of the number of this particular object type present on this device.
+- **DecisionMediaCenter_TH2**  The count of the number of this particular object type present on this device.
+- **DecisionSystemBios_19ASetup**  The count of the number of this particular object type present on this device.
+- **DecisionSystemBios_19H1**  The count of the number of this particular object type present on this device.
+- **DecisionSystemBios_19H1Setup**  The total DecisionSystemBios objects targeting the next release of Windows on this device.
+- **DecisionSystemBios_20H1**  The count of the number of this particular object type present on this device.
+- **DecisionSystemBios_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionSystemBios_RS1**  The total DecisionSystemBios objects targeting Windows 10 version 1607 on this device.
+- **DecisionSystemBios_RS2**  The total DecisionSystemBios objects targeting Windows 10 version 1703 on this device.
+- **DecisionSystemBios_RS3**  The total DecisionSystemBios objects targeting Windows 10 version 1709 on this device.
+- **DecisionSystemBios_RS3Setup**  The count of the number of this particular object type present on this device.
+- **DecisionSystemBios_RS4**  The total DecisionSystemBios objects targeting Windows 10 version, 1803 present on this device.
+- **DecisionSystemBios_RS4Setup**  The total DecisionSystemBios objects targeting the next release of Windows on this device.
+- **DecisionSystemBios_RS5**  The total DecisionSystemBios objects targeting the next release of Windows on this device.
+- **DecisionSystemBios_RS5Setup**  The count of the number of this particular object type present on this device.
+- **DecisionSystemBios_TH1**  The count of the number of this particular object type present on this device.
+- **DecisionSystemBios_TH2**  The count of the number of this particular object type present on this device.
+- **DecisionSystemProcessor_RS2**  The count of the number of this particular object type present on this device.
+- **DecisionTest_20H1Setup**  The count of the number of this particular object type present on this device.
+- **DecisionTest_RS1**  An ID for the system, calculated by hashing hardware identifiers.
+- **InventoryApplicationFile**  The count of the number of this particular object type present on this device.
+- **InventoryDeviceContainer**  A count of device container objects in cache.
+- **InventoryDevicePnp**  A count of device Plug and Play objects in cache.
+- **InventoryDriverBinary**  A count of driver binary objects in cache.
+- **InventoryDriverPackage**  A count of device objects in cache.
+- **InventoryLanguagePack**  The count of the number of this particular object type present on this device.
+- **InventoryMediaCenter**  The count of the number of this particular object type present on this device.
+- **InventorySystemBios**  The count of the number of this particular object type present on this device.
+- **InventorySystemMachine**  The count of the number of this particular object type present on this device.
+- **InventorySystemProcessor**  The count of the number of this particular object type present on this device.
+- **InventoryTest**  The count of the number of this particular object type present on this device.
+- **InventoryUplevelDriverPackage**  The count of the number of this particular object type present on this device.
+- **PCFP**  The count of the number of this particular object type present on this device.
+- **SystemMemory**  The count of the number of this particular object type present on this device.
+- **SystemProcessorCompareExchange**  The count of the number of this particular object type present on this device.
+- **SystemProcessorLahfSahf**  The count of the number of this particular object type present on this device.
+- **SystemProcessorNx**  The total number of objects of this type present on this device.
+- **SystemProcessorPrefetchW**  The total number of objects of this type present on this device.
+- **SystemProcessorSse2**  The total number of objects of this type present on this device.
+- **SystemTouch**  The count of the number of this particular object type present on this device.
+- **SystemWim**  The total number of objects of this type present on this device.
+- **SystemWindowsActivationStatus**  The count of the number of this particular object type present on this device.
+- **SystemWlan**  The total number of objects of this type present on this device.
+- **Wmdrm_19H1**  The count of the number of this particular object type present on this device.
+- **Wmdrm_19H1Setup**  The total Wmdrm objects targeting the next release of Windows on this device.
+- **Wmdrm_20H1**  The count of the number of this particular object type present on this device.
+- **Wmdrm_20H1Setup**  The total Wmdrm objects targeting the next release of Windows on this device.
+- **Wmdrm_RS1**  An ID for the system, calculated by hashing hardware identifiers.
+- **Wmdrm_RS2**  An ID for the system, calculated by hashing hardware identifiers.
+- **Wmdrm_RS3**  An ID for the system, calculated by hashing hardware identifiers.
+- **Wmdrm_RS4**  The total Wmdrm objects targeting Windows 10, version 1803 present on this device.
+- **Wmdrm_RS5**  The count of the number of this particular object type present on this device.
+- **Wmdrm_TH1**  The count of the number of this particular object type present on this device.
+- **Wmdrm_TH2**  The count of the number of this particular object type present on this device.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileAdd
+
+Represents the basic metadata about specific application files installed on the system.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser file that is generating the events.
+- **AvDisplayName**  If the app is an anti-virus app, this is its display name.
+- **CompatModelIndex**  The compatibility prediction for this file.
+- **HasCitData**  Indicates whether the file is present in CIT data.
+- **HasUpgradeExe**  Indicates whether the anti-virus app has an upgrade.exe file.
+- **IsAv**  Is the file an anti-virus reporting EXE?
+- **ResolveAttempted**  This will always be an empty string when sending diagnostic data.
+- **SdbEntries**  An array of fields that indicates the SDB entries that apply to this file.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileRemove
+
+This event indicates that the DatasourceApplicationFile object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceApplicationFileStartSync
+
+This event indicates that a new set of DatasourceApplicationFileAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd
+
+This event sends compatibility data for a Plug and Play device, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **ActiveNetworkConnection**  Indicates whether the device is an active network device.
+- **AppraiserVersion**  The version of the appraiser file generating the events.
+- **CosDeviceRating**  An enumeration that indicates if there is a driver on the target operating system.
+- **CosDeviceSolution**  An enumeration that indicates how a driver on the target operating system is available.
+- **CosDeviceSolutionUrl**  Microsoft.Windows.Appraiser.General.DatasourceDevicePnpAdd . Empty string
+- **CosPopulatedFromId**  The expected uplevel driver matching ID based on driver coverage data.
+- **IsBootCritical**  Indicates whether the device boot is critical.
+- **UplevelInboxDriver**  Indicates whether there is a driver uplevel for this device.
+- **WuDriverCoverage**  Indicates whether there is a driver uplevel for this device, according to Windows Update.
+- **WuDriverUpdateId**  The Windows Update ID of the applicable uplevel driver.
+- **WuPopulatedFromId**  The expected uplevel driver matching ID based on driver coverage from Windows Update.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpRemove
+
+This event indicates that the DatasourceDevicePnp object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDevicePnpStartSync
+
+This event indicates that a new set of DatasourceDevicePnpAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageAdd
+
+This event sends compatibility database data about driver packages to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser file generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageRemove
+
+This event indicates that the DatasourceDriverPackage object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceDriverPackageStartSync
+
+This event indicates that a new set of DatasourceDriverPackageAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockAdd
+
+This event sends blocking data about any compatibility blocking entries on the system that are not directly related to specific applications or devices, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser file generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoBlockStartSync
+
+This event indicates that a full set of DataSourceMatchingInfoBlockStAdd events have been sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveAdd
+
+This event sends compatibility database information about non-blocking compatibility entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser file generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPassiveStartSync
+
+This event indicates that a new set of DataSourceMatchingInfoPassiveAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeAdd
+
+This event sends compatibility database information about entries requiring reinstallation after an upgrade on the system that are not keyed by either applications or devices, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser file generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DataSourceMatchingInfoPostUpgradeStartSync
+
+This event indicates that a new set of DataSourceMatchingInfoPostUpgradeAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosAdd
+
+This event sends compatibility database information about the BIOS to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DatasourceSystemBiosStartSync
+
+This event indicates that a new set of DatasourceSystemBiosAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionApplicationFileAdd
+
+This event sends compatibility decision data about a file to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser file that is generating the events.
+- **BlockAlreadyInbox**  The uplevel runtime block on the file already existed on the current OS.
+- **BlockingApplication**  Indicates whether there are any application issues that interfere with the upgrade due to the file in question.
+- **DisplayGenericMessage**  Will be a generic message be shown for this file?
+- **DisplayGenericMessageGated**  Indicates whether a generic message be shown for this file.
+- **HardBlock**  This file is blocked in the SDB.
+- **HasUxBlockOverride**  Does the file have a block that is overridden by a tag in the SDB?
+- **MigApplication**  Does the file have a MigXML from the SDB associated with it that applies to the current upgrade mode?
+- **MigRemoval**  Does the file have a MigXML from the SDB that will cause the app to be removed on upgrade?
+- **NeedsDismissAction**  Will the file cause an action that can be dismissed?
+- **NeedsInstallPostUpgradeData**  After upgrade, the file will have a post-upgrade notification to install a replacement for the app.
+- **NeedsNotifyPostUpgradeData**  Does the file have a notification that should be shown after upgrade?
+- **NeedsReinstallPostUpgradeData**  After upgrade, this file will have a post-upgrade notification to reinstall the app.
+- **NeedsUninstallAction**  The file must be uninstalled to complete the upgrade.
+- **SdbBlockUpgrade**  The file is tagged as blocking upgrade in the SDB,
+- **SdbBlockUpgradeCanReinstall**  The file is tagged as blocking upgrade in the SDB. It can be reinstalled after upgrade.
+- **SdbBlockUpgradeUntilUpdate**  The file is tagged as blocking upgrade in the SDB. If the app is updated, the upgrade can proceed.
+- **SdbReinstallUpgrade**  The file is tagged as needing to be reinstalled after upgrade in the SDB. It does not block upgrade.
+- **SdbReinstallUpgradeWarn**  The file is tagged as needing to be reinstalled after upgrade with a warning in the SDB. It does not block upgrade.
+- **SoftBlock**  The file is softblocked in the SDB and has a warning.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionApplicationFileRemove
+
+This event indicates that the DecisionApplicationFile object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionApplicationFileStartSync
+
+This event indicates that a new set of DecisionApplicationFileAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDevicePnpAdd
+
+This event sends compatibility decision data about a Plug and Play (PNP) device to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser file generating the events.
+- **AssociatedDriverIsBlocked**  Is the driver associated with this PNP device blocked?
+- **AssociatedDriverWillNotMigrate**  Will the driver associated with this plug-and-play device migrate?
+- **BlockAssociatedDriver**  Should the driver associated with this PNP device be blocked?
+- **BlockingDevice**  Is this PNP device blocking upgrade?
+- **BlockUpgradeIfDriverBlocked**  Is the PNP device both boot critical and does not have a driver included with the OS?
+- **BlockUpgradeIfDriverBlockedAndOnlyActiveNetwork**  Is this PNP device the only active network device?
+- **DisplayGenericMessage**  Will a generic message be shown during Setup for this PNP device?
+- **DisplayGenericMessageGated**  Indicates whether a generic message will be shown during Setup for this PNP device.
+- **DriverAvailableInbox**  Is a driver included with the operating system for this PNP device?
+- **DriverAvailableOnline**  Is there a driver for this PNP device on Windows Update?
+- **DriverAvailableUplevel**  Is there a driver on Windows Update or included with the operating system for this PNP device?
+- **DriverBlockOverridden**  Is there is a driver block on the device that has been overridden?
+- **NeedsDismissAction**  Will the user would need to dismiss a warning during Setup for this device?
+- **NotRegressed**  Does the device have a problem code on the source OS that is no better than the one it would have on the target OS?
+- **SdbDeviceBlockUpgrade**  Is there an SDB block on the PNP device that blocks upgrade?
+- **SdbDriverBlockOverridden**  Is there an SDB block on the PNP device that blocks upgrade, but that block was overridden?
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDevicePnpRemove
+
+This event indicates that the DecisionDevicePnp object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDevicePnpStartSync
+
+The DecisionDevicePnpStartSync event indicates that a new set of DecisionDevicePnpAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDriverPackageAdd
+
+This event sends decision data about driver package compatibility to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser file generating the events.
+- **DisplayGenericMessageGated**  Indicates whether a generic offer block message will be shown for this driver package.
+- **DriverBlockOverridden**  Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden?
+- **DriverIsDeviceBlocked**  Was the driver package was blocked because of a device block?
+- **DriverIsDriverBlocked**  Is the driver package blocked because of a driver block?
+- **DriverIsTroubleshooterBlocked**  Indicates whether the driver package is blocked because of a troubleshooter block.
+- **DriverShouldNotMigrate**  Should the driver package be migrated during upgrade?
+- **SdbDriverBlockOverridden**  Does the driver package have an SDB block that blocks it from migrating, but that block has been overridden?
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDriverPackageRemove
+
+This event indicates that the DecisionDriverPackage object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionDriverPackageStartSync
+
+This event indicates that a new set of DecisionDriverPackageAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockAdd
+
+This event sends compatibility decision data about blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser file generating the events.
+- **BlockingApplication**  Are there are any application issues that interfere with upgrade due to matching info blocks?
+- **DisplayGenericMessage**  Will a generic message be shown for this block?
+- **NeedsUninstallAction**  Does the user need to take an action in setup due to a matching info block?
+- **SdbBlockUpgrade**  Is a matching info block blocking upgrade?
+- **SdbBlockUpgradeCanReinstall**  Is a matching info block blocking upgrade, but has the can reinstall tag?
+- **SdbBlockUpgradeUntilUpdate**  Is a matching info block blocking upgrade but has the until update tag?
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoBlockStartSync
+
+This event indicates that a new set of DecisionMatchingInfoBlockAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveAdd
+
+This event sends compatibility decision data about non-blocking entries on the system that are not keyed by either applications or devices, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **BlockingApplication**  Are there any application issues that interfere with upgrade due to matching info blocks?
+- **DisplayGenericMessageGated**  Indicates whether a generic offer block message will be shown due to matching info blocks.
+- **MigApplication**  Is there a matching info block with a mig for the current mode of upgrade?
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPassiveStartSync
+
+This event indicates that a new set of DecisionMatchingInfoPassiveAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeAdd
+
+This event sends compatibility decision data about entries that require reinstall after upgrade. It's used to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **NeedsInstallPostUpgradeData**  Will the file have a notification after upgrade to install a replacement for the app?
+- **NeedsNotifyPostUpgradeData**  Should a notification be shown for this file after upgrade?
+- **NeedsReinstallPostUpgradeData**  Will the file have a notification after upgrade to reinstall the app?
+- **SdbReinstallUpgrade**  The file is tagged as needing to be reinstalled after upgrade in the compatibility database (but is not blocking upgrade).
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMatchingInfoPostUpgradeStartSync
+
+This event indicates that a new set of DecisionMatchingInfoPostUpgradeAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMediaCenterAdd
+
+This event sends decision data about the presence of Windows Media Center, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file generating the events.
+- **BlockingApplication**  Is there any application issues that interfere with upgrade due to Windows Media Center?
+- **MediaCenterActivelyUsed**  If Windows Media Center is supported on the edition, has it been run at least once and are the MediaCenterIndicators are true?
+- **MediaCenterIndicators**  Do any indicators imply that Windows Media Center is in active use?
+- **MediaCenterInUse**  Is Windows Media Center actively being used?
+- **MediaCenterPaidOrActivelyUsed**  Is Windows Media Center actively being used or is it running on a supported edition?
+- **NeedsDismissAction**  Are there any actions that can be dismissed coming from Windows Media Center?
+
+
+### Microsoft.Windows.Appraiser.General.DecisionMediaCenterStartSync
+
+This event indicates that a new set of DecisionMediaCenterAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionSystemBiosAdd
+
+This event sends compatibility decision data about the BIOS to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file generating the events.
+- **Blocking**  Is the device blocked from upgrade due to a BIOS block?
+- **DisplayGenericMessageGated**  Indicates whether a generic offer block message will be shown for the bios.
+- **HasBiosBlock**  Does the device have a BIOS block?
+
+
+### Microsoft.Windows.Appraiser.General.DecisionSystemBiosStartSync
+
+This event indicates that a new set of DecisionSystemBiosAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionTestRemove
+
+This event provides data that allows testing of “Remove” decisions to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser binary (executable) generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.DecisionTestStartSync
+
+This event provides data that allows testing of “Start Sync” decisions to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser binary (executable) generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.GatedRegChange
+
+This event sends data about the results of running a set of quick-blocking instructions, to help keep Windows up to date.
+
+The following fields are available:
+
+- **NewData**  The data in the registry value after the scan completed.
+- **OldData**  The previous data in the registry value before the scan ran.
+- **PCFP**  An ID for the system calculated by hashing hardware identifiers.
+- **RegKey**  The registry key name for which a result is being sent.
+- **RegValue**  The registry value for which a result is being sent.
+- **Time**  The client time of the event.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryApplicationFileAdd
+
+This event represents the basic metadata about a file on the system.  The file must be part of an app and either have a block in the compatibility database or be part of an antivirus program.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file generating the events.
+- **AvDisplayName**  If the app is an antivirus app, this is its display name.
+- **AvProductState**  Indicates whether the antivirus program is turned on and the signatures are up to date.
+- **BinaryType**  A binary type.  Example: UNINITIALIZED, ZERO_BYTE, DATA_ONLY, DOS_MODULE, NE16_MODULE, PE32_UNKNOWN, PE32_I386, PE32_ARM, PE64_UNKNOWN, PE64_AMD64, PE64_ARM64, PE64_IA64, PE32_CLR_32, PE32_CLR_IL, PE32_CLR_IL_PREFER32, PE64_CLR_64.
+- **BinFileVersion**  An attempt to clean up FileVersion at the client that tries to place the version into 4 octets.
+- **BinProductVersion**  An attempt to clean up ProductVersion at the client that tries to place the version into 4 octets.
+- **BoeProgramId**  If there is no entry in Add/Remove Programs, this is the ProgramID that is generated from the file metadata.
+- **CompanyName**  The company name of the vendor who developed this file.
+- **FileId**  A hash that uniquely identifies a file.
+- **FileVersion**  The File version field from the file metadata under Properties -> Details.
+- **HasUpgradeExe**  Indicates whether the antivirus app has an upgrade.exe file.
+- **IsAv**  Indicates whether the file an antivirus reporting EXE.
+- **LinkDate**  The date and time that this file was linked on.
+- **LowerCaseLongPath**  The full file path to the file that was inventoried on the device.
+- **Name**  The name of the file that was inventoried.
+- **ProductName**  The Product name field from the file metadata under Properties -> Details.
+- **ProductVersion**  The Product version field from the file metadata under Properties -> Details.
+- **ProgramId**  A hash of the Name, Version, Publisher, and Language of an application used to identify it.
+- **Size**  The size of the file (in hexadecimal bytes).
+
+
+### Microsoft.Windows.Appraiser.General.InventoryApplicationFileRemove
+
+This event indicates that the InventoryApplicationFile object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryApplicationFileStartSync
+
+This event indicates that a new set of InventoryApplicationFileAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryLanguagePackAdd
+
+This event sends data about the number of language packs installed on the system, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **HasLanguagePack**  Indicates whether this device has 2 or more language packs.
+- **LanguagePackCount**  The number of language packs are installed.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryLanguagePackRemove
+
+This event indicates that the InventoryLanguagePack object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryLanguagePackStartSync
+
+This event indicates that a new set of InventoryLanguagePackAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryMediaCenterAdd
+
+This event sends true/false data about decision points used to understand whether Windows Media Center is used on the system, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file generating the events.
+- **EverLaunched**  Has Windows Media Center ever been launched?
+- **HasConfiguredTv**  Has the user configured a TV tuner through Windows Media Center?
+- **HasExtendedUserAccounts**  Are any Windows Media Center Extender user accounts configured?
+- **HasWatchedFolders**  Are any folders configured for Windows  Media Center to watch?
+- **IsDefaultLauncher**  Is Windows Media Center the default app for opening music or video files?
+- **IsPaid**  Is the user running a Windows Media Center edition that implies they paid for Windows Media Center?
+- **IsSupported**  Does the running OS support Windows Media Center?
+
+
+### Microsoft.Windows.Appraiser.General.InventoryMediaCenterRemove
+
+This event indicates that the InventoryMediaCenter object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryMediaCenterStartSync
+
+This event indicates that a new set of InventoryMediaCenterAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventorySystemBiosAdd
+
+This event sends basic metadata about the BIOS to determine whether it has a compatibility block.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **BiosDate**  The release date of the BIOS in UTC format.
+- **BiosName**  The name field from Win32_BIOS.
+- **Manufacturer**  The manufacturer field from Win32_ComputerSystem.
+- **Model**  The model field from Win32_ComputerSystem.
+
+
+### Microsoft.Windows.Appraiser.General.InventorySystemBiosStartSync
+
+This event indicates that a new set of InventorySystemBiosAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser binary (executable) generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventorySystemProcessorEndSync
+
+This event indicates that a full set of InventorySystemProcessorAdd events has been sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser binary (executable) generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventorySystemProcessorStartSync
+
+This event indicates that a new set of InventorySystemProcessorAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser binary (executable) generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryTestRemove
+
+This event provides data that allows testing of “Remove” decisions to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser binary (executable) generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryTestStartSync
+
+This event provides data that allows testing of “Start Sync” decisions to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the appraiser binary (executable) generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageAdd
+
+This event is only runs during setup. It provides a listing of the uplevel driver packages that were downloaded before the upgrade. Is critical to understanding if failures in setup can be traced to not having sufficient uplevel drivers before the upgrade.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **BootCritical**  Is the driver package marked as boot critical?
+- **Build**  The build value from the driver package.
+- **CatalogFile**  The name of the catalog file within the driver package.
+- **Class**  The device class from the driver package.
+- **ClassGuid**  The device class unique ID from the driver package.
+- **Date**  The date from the driver package.
+- **Inbox**  Is the driver package of a driver that is included with Windows?
+- **OriginalName**  The original name of the INF file before it was renamed. Generally a path under $WINDOWS.~BT\Drivers\DU.
+- **Provider**  The provider of the driver package.
+- **PublishedName**  The name of the INF file after it was renamed.
+- **Revision**  The revision of the driver package.
+- **SignatureStatus**  Indicates if the driver package is signed. Unknown = 0, Unsigned = 1, Signed = 2.
+- **VersionMajor**  The major version of the driver package.
+- **VersionMinor**  The minor version of the driver package.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageRemove
+
+This event indicates that the InventoryUplevelDriverPackage object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.InventoryUplevelDriverPackageStartSync
+
+This event indicates that a new set of InventoryUplevelDriverPackageAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.RunContext
+
+This event indicates what should be expected in the data payload.
+
+The following fields are available:
+
+- **AppraiserBranch**  The source branch in which the currently running version of Appraiser was built.
+- **AppraiserProcess**  The name of the process that launched Appraiser.
+- **AppraiserVersion**  The version of the Appraiser file generating the events.
+- **CensusId**  A unique hardware identifier.
+- **Context**  Indicates what mode Appraiser is running in. Example: Setup or Telemetry.
+- **PCFP**  An ID for the system calculated by hashing hardware identifiers.
+- **Subcontext**  Indicates what categories of incompatibilities appraiser is scanning for. Can be N/A, Resolve, or a semicolon-delimited list that can include App, Dev, Sys, Gat, or Rescan.
+- **Time**  The client time of the event.
+
+
+### Microsoft.Windows.Appraiser.General.SystemMemoryAdd
+
+This event sends data on the amount of memory on the system and whether it meets requirements, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file generating the events.
+- **Blocking**  Is the device from upgrade due to memory restrictions?
+- **MemoryRequirementViolated**  Was a memory requirement violated?
+- **pageFile**  The current committed memory limit for the system or the current process, whichever is smaller (in bytes).
+- **ram**  The amount of memory on the device.
+- **ramKB**  The amount of memory (in KB).
+- **virtual**  The size of the user-mode portion of the virtual address space of the calling process (in bytes).
+- **virtualKB**  The amount of virtual memory (in KB).
+
+
+### Microsoft.Windows.Appraiser.General.SystemMemoryStartSync
+
+This event indicates that a new set of SystemMemoryAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeAdd
+
+This event sends data indicating whether the system supports the CompareExchange128 CPU requirement, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file generating the events.
+- **Blocking**  Is the upgrade blocked due to the processor?
+- **CompareExchange128Support**  Does the CPU support CompareExchange128?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorCompareExchangeStartSync
+
+This event indicates that a new set of SystemProcessorCompareExchangeAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfAdd
+
+This event sends data indicating whether the system supports the LAHF & SAHF CPU requirement, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file generating the events.
+- **Blocking**  Is the upgrade blocked due to the processor?
+- **LahfSahfSupport**  Does the CPU support LAHF/SAHF?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorLahfSahfStartSync
+
+This event indicates that a new set of SystemProcessorLahfSahfAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorNxAdd
+
+This event sends data indicating whether the system supports the NX CPU requirement, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **Blocking**  Is the upgrade blocked due to the processor?
+- **NXDriverResult**  The result of the driver used to do a non-deterministic check for NX support.
+- **NXProcessorSupport**  Does the processor support NX?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorNxStartSync
+
+This event  indicates that a new set of SystemProcessorNxAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWAdd
+
+This event sends data indicating whether the system supports the PrefetchW CPU requirement, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **Blocking**  Is the upgrade blocked due to the processor?
+- **PrefetchWSupport**  Does the processor support PrefetchW?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorPrefetchWStartSync
+
+This event indicates that a new set of SystemProcessorPrefetchWAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorSse2Add
+
+This event sends data indicating whether the system supports the SSE2 CPU requirement, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **Blocking**  Is the upgrade blocked due to the processor?
+- **SSE2ProcessorSupport**  Does the processor support SSE2?
+
+
+### Microsoft.Windows.Appraiser.General.SystemProcessorSse2StartSync
+
+This event indicates that a new set of SystemProcessorSse2Add events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemTouchAdd
+
+This event sends data indicating whether the system supports touch, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **IntegratedTouchDigitizerPresent**  Is there an integrated touch digitizer?
+- **MaximumTouches**  The maximum number of touch points supported by the device hardware.
+
+
+### Microsoft.Windows.Appraiser.General.SystemTouchStartSync
+
+This event indicates that a new set of SystemTouchAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWimAdd
+
+This event sends data indicating whether the operating system is running from a compressed Windows Imaging Format (WIM) file, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **IsWimBoot**  Is the current operating system running from a compressed WIM file?
+- **RegistryWimBootValue**  The raw value from the registry that is used to indicate if the device is running from a WIM.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWimStartSync
+
+This event indicates that a new set of SystemWimAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusAdd
+
+This event sends data indicating whether the current operating system is activated, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **WindowsIsLicensedApiValue**  The result from the API that's used to indicate if operating system is activated.
+- **WindowsNotActivatedDecision**  Is the current operating system activated?
+
+
+### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusRemove
+
+This event indicates that the SystemWindowsActivationStatus object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWindowsActivationStatusStartSync
+
+This event indicates that a new set of SystemWindowsActivationStatusAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.SystemWlanAdd
+
+This event sends data indicating whether the system has WLAN, and if so, whether it uses an emulated driver that could block an upgrade, to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **Blocking**  Is the upgrade blocked because of an emulated WLAN driver?
+- **HasWlanBlock**  Does the emulated WLAN driver have an upgrade block?
+- **WlanEmulatedDriver**  Does the device have an emulated WLAN driver?
+- **WlanExists**  Does the device support WLAN at all?
+- **WlanModulePresent**  Are any WLAN modules present?
+- **WlanNativeDriver**  Does the device have a non-emulated WLAN driver?
+
+
+### Microsoft.Windows.Appraiser.General.SystemWlanStartSync
+
+This event indicates that a new set of SystemWlanAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+### Microsoft.Windows.Appraiser.General.TelemetryRunHealth
+
+This event indicates the parameters and result of a diagnostic data run. This allows the rest of the data sent over the course of the run to be properly contextualized and understood, which is then used to keep Windows up to date.
+
+The following fields are available:
+
+- **AppraiserBranch**  The source branch in which the version of Appraiser that is running was built.
+- **AppraiserDataVersion**  The version of the data files being used by the Appraiser diagnostic data run.
+- **AppraiserProcess**  The name of the process that launched Appraiser.
+- **AppraiserVersion**  The file version (major, minor and build) of the Appraiser DLL, concatenated without dots.
+- **AuxFinal**  Obsolete, always set to false.
+- **AuxInitial**  Obsolete, indicates if Appraiser is writing data files to be read by the Get Windows 10 app.
+- **DeadlineDate**  A timestamp representing the deadline date, which is the time until which appraiser will wait to do a full scan.
+- **EnterpriseRun**  Indicates whether the diagnostic data run is an enterprise run, which means appraiser was run from the command line with an extra enterprise parameter.
+- **FullSync**  Indicates if Appraiser is performing a full sync, which means that full set of events representing the state of the machine are sent. Otherwise, only the changes from the previous run are sent.
+- **InboxDataVersion**  The original version of the data files before retrieving any newer version.
+- **IndicatorsWritten**  Indicates if all relevant UEX indicators were successfully written or updated.
+- **InventoryFullSync**  Indicates if inventory is performing a full sync, which means that the full set of events representing the inventory of machine are sent.
+- **PCFP**  An ID for the system calculated by hashing hardware identifiers.
+- **PerfBackoff**  Indicates if the run was invoked with logic to stop running when a user is present. Helps to understand why a run may have a longer elapsed time than normal.
+- **PerfBackoffInsurance**  Indicates if appraiser is running without performance backoff because it has run with perf backoff and failed to complete several times in a row.
+- **RunAppraiser**  Indicates if Appraiser was set to run at all. If this if false, it is understood that data events will not be received from this device.
+- **RunDate**  The date that the diagnostic data run was stated, expressed as a filetime.
+- **RunGeneralTel**  Indicates if the generaltel.dll component was run. Generaltel collects additional diagnostic data on an infrequent schedule and only from machines at diagnostic data levels higher than Basic.
+- **RunOnline**  Indicates if appraiser was able to connect to Windows Update and theefore is making decisions using up-to-date driver coverage information.
+- **RunResult**  The hresult of the Appraiser diagnostic data run.
+- **ScheduledUploadDay**  The day scheduled for the upload.
+- **SendingUtc**  Indicates whether the Appraiser client is sending events during the current diagnostic data run.
+- **StoreHandleIsNotNull**  Obsolete, always set to false
+- **TelementrySent**  Indicates whether diagnostic data was successfully sent.
+- **ThrottlingUtc**  Indicates whether the Appraiser client is throttling its output of CUET events to avoid being disabled. This increases runtime but also diagnostic data reliability.
+- **Time**  The client time of the event.
+- **VerboseMode**  Indicates if appraiser ran in Verbose mode, which is a test-only mode with extra logging.
+- **WhyFullSyncWithoutTablePrefix**  Indicates the reason or reasons that a full sync was generated.
+
+
+### Microsoft.Windows.Appraiser.General.WmdrmAdd
+
+This event sends data about the usage of older digital rights management on the system, to help keep Windows up to date. This data does not indicate the details of the media using the digital rights management, only whether any such files exist. Collecting this data was critical to ensuring the correct mitigation for customers, and should be able to be removed once all mitigations are in place.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+- **BlockingApplication**  Same as NeedsDismissAction.
+- **NeedsDismissAction**  Indicates if a dismissible message is needed to warn the user about a potential loss of data due to DRM deprecation.
+- **WmdrmApiResult**  Raw value of the API used to gather DRM state.
+- **WmdrmCdRipped**  Indicates if the system has any files encrypted with personal DRM, which was used for ripped CDs.
+- **WmdrmIndicators**  WmdrmCdRipped OR WmdrmPurchased.
+- **WmdrmInUse**  WmdrmIndicators AND dismissible block in setup was not dismissed.
+- **WmdrmNonPermanent**  Indicates if the system has any files with non-permanent licenses.
+- **WmdrmPurchased**  Indicates if the system has any files with permanent licenses.
+
+
+### Microsoft.Windows.Appraiser.General.WmdrmStartSync
+
+This event indicates that a new set of WmdrmAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AppraiserVersion**  The version of the Appraiser file that is generating the events.
+
+
+## Audio endpoint events
+
+### MicArrayGeometry
+
+This event provides information about the layout of the individual microphone elements in the microphone array.
+
+The following fields are available:
+
+- **MicCoords**  The location and orientation of the microphone element.
+- **usFrequencyBandHi**  The high end of the frequency range for the microphone.
+- **usFrequencyBandLo**  The low end of the frequency range for the microphone.
+- **usMicArrayType**  The type of the microphone array.
+- **usNumberOfMicrophones**  The number of microphones in the array.
+- **usVersion**  The version of the microphone array specification.
+- **wHorizontalAngleBegin**  The horizontal angle of the start of the working volume (reported as radians times 10,000).
+- **wHorizontalAngleEnd**  The horizontal angle of the end of the working volume (reported as radians times 10,000).
+- **wVerticalAngleBegin**  The vertical angle of the start of the working volume (reported as radians times 10,000).
+- **wVerticalAngleEnd**  The vertical angle of the end of the working volume (reported as radians times 10,000).
+
+
+### MicCoords
+
+This event provides information about the location and orientation of the microphone element.
+
+The following fields are available:
+
+- **usType**  The type of microphone.
+- **wHorizontalAngle**  The horizontal angle of the microphone (reported as radians times 10,000).
+- **wVerticalAngle**  The vertical angle of the microphone (reported as radians times 10,000).
+- **wXCoord**  The x-coordinate of the microphone.
+- **wYCoord**  The y-coordinate of the microphone.
+- **wZCoord**  The z-coordinate of the microphone.
+
+
+### Microsoft.Windows.Audio.EndpointBuilder.DeviceInfo
+
+This event logs the successful enumeration of an audio endpoint (such as a microphone or speaker) and provides information about the audio endpoint.
+
+The following fields are available:
+
+- **BusEnumeratorName**  The name of the bus enumerator (for example, HDAUDIO or USB).
+- **ContainerId**  An identifier that uniquely groups the functional devices associated with a single-function or multifunction device.
+- **DeviceInstanceId**  The unique identifier for this instance of the device.
+- **EndpointDevnodeId**  The IMMDevice identifier of the associated devnode.
+- **endpointEffectClsid**  The COM Class Identifier (CLSID) for the endpoint effect audio processing object.
+- **endpointEffectModule**  Module name for the endpoint effect audio processing object.
+- **EndpointFormFactor**  The enumeration value for the form factor of the endpoint device (for example speaker, microphone, remote  network device).
+- **endpointID**  The unique identifier for the audio endpoint.
+- **endpointInstanceId**  The unique identifier for the software audio endpoint. Used for joining to other audio event.
+- **Flow**  Indicates whether the endpoint is capture (1) or render (0).
+- **globalEffectClsid**  COM Class Identifier (CLSID) for the legacy global effect audio processing object.
+- **globalEffectModule**  Module name for the legacy global effect audio processing object.
+- **HWID**  The hardware identifier for the endpoint.
+- **IsBluetooth**  Indicates whether the device is a Bluetooth device.
+- **isFarField**  A flag indicating whether the microphone endpoint is capable of hearing far field audio.
+- **IsSideband**  Indicates whether the device is a sideband device.
+- **IsUSB**  Indicates whether the device is a USB device.
+- **JackSubType**  A unique ID representing the KS node type of the endpoint.
+- **localEffectClsid**  The COM Class Identifier (CLSID) for the legacy local effect audio processing object.
+- **localEffectModule**  Module name for the legacy local effect audio processing object.
+- **MicArrayGeometry**  Describes the microphone array, including the microphone position, coordinates, type, and frequency range. See [MicArrayGeometry](#micarraygeometry).
+- **modeEffectClsid**  The COM Class Identifier (CLSID) for the mode effect audio processing object.
+- **modeEffectModule**  Module name for the mode effect audio processing object.
+- **persistentId**  A unique ID for this endpoint which is retained across migrations.
+- **streamEffectClsid**  The COM Class Identifier (CLSID) for the stream effect audio processing object.
+- **streamEffectModule**  Module name for the stream effect audio processing object.
+
+
+## Census events
+
+### Census.App
+
+This event sends version data about the Apps running on this device, to help keep Windows up to date.
+
+The following fields are available:
+
+- **AppraiserEnterpriseErrorCode**  The error code of the last Appraiser enterprise run.
+- **AppraiserErrorCode**  The error code of the last Appraiser run.
+- **AppraiserRunEndTimeStamp**  The end time of the last Appraiser run.
+- **AppraiserRunIsInProgressOrCrashed**  Flag that indicates if the Appraiser run is in progress or has crashed.
+- **AppraiserRunStartTimeStamp**  The start time of the last Appraiser run.
+- **AppraiserTaskEnabled**  Whether the Appraiser task is enabled.
+- **AppraiserTaskExitCode**  The Appraiser task exist code.
+- **AppraiserTaskLastRun**  The last runtime for the Appraiser task.
+- **CensusVersion**  The version of Census that generated the current data for this device.
+- **IEVersion**  The version of Internet Explorer that is running on the device.
+
+
+### Census.Azure
+
+This event returns data from Microsoft-internal Azure server machines (only from Microsoft-internal machines with Server SKUs). All other machines (those outside Microsoft and/or machines that are not part of the “Azure fleet”) return empty data sets.
+
+The following fields are available:
+
+- **CloudCoreBuildEx**  The Azure CloudCore build number.
+- **CloudCoreSupportBuildEx**  The Azure CloudCore support build number.
+- **NodeID**  The node identifier on the device that indicates whether the device is part of the Azure fleet.
+
+
+### Census.Battery
+
+This event sends type and capacity data about the battery on the device, as well as the number of connected standby devices in use, type to help keep Windows up to date.
+
+The following fields are available:
+
+- **InternalBatteryCapablities**  Represents information about what the battery is capable of doing.
+- **InternalBatteryCapacityCurrent**  Represents the battery's current fully charged capacity in mWh (or relative). Compare this value to DesignedCapacity  to estimate the battery's wear.
+- **InternalBatteryCapacityDesign**  Represents the theoretical capacity of the battery when new, in mWh.
+- **InternalBatteryNumberOfCharges**  Provides the number of battery charges. This is used when creating new products and validating that existing products meets targeted functionality performance.
+- **IsAlwaysOnAlwaysConnectedCapable**  Represents whether the battery enables the device to be AlwaysOnAlwaysConnected . Boolean value.
+
+
+### Census.Camera
+
+This event sends data about the resolution of cameras on the device, to help keep Windows up to date.
+
+The following fields are available:
+
+- **FrontFacingCameraResolution**  Represents the resolution of the front facing camera in megapixels. If a front facing camera does not exist, then the value is 0.
+- **RearFacingCameraResolution**  Represents the resolution of the rear facing camera in megapixels. If a rear facing camera does not exist, then the value is 0.
+
+
+### Census.Enterprise
+
+This event sends data about Azure presence, type, and cloud domain use in order to provide an understanding of the use and integration of devices in an enterprise, cloud, and server environment.
+
+The following fields are available:
+
+- **AADDeviceId**  Azure Active Directory device ID.
+- **AzureOSIDPresent**  Represents the field used to identify an Azure machine.
+- **AzureVMType**  Represents whether the instance is Azure VM PAAS, Azure VM IAAS or any other VMs.
+- **CDJType**  Represents the type of cloud domain joined for the machine.
+- **CommercialId**  Represents the GUID for the commercial entity which the device is a member of.  Will be used to reflect insights back to customers.
+- **ContainerType**  The type of container, such as process or virtual machine hosted.
+- **EnrollmentType**  Defines the type of MDM enrollment on the device.
+- **HashedDomain**  The hashed representation of the user domain used for login.
+- **IsCloudDomainJoined**  Is this device joined to an Azure Active Directory (AAD) tenant? true/false
+- **IsDERequirementMet**  Represents if the device can do device encryption.
+- **IsDeviceProtected**  Represents if Device protected by BitLocker/Device Encryption
+- **IsDomainJoined**  Indicates whether a machine is joined to a domain.
+- **IsEDPEnabled**  Represents if Enterprise data protected on the device.
+- **IsMDMEnrolled**  Whether the device has been MDM Enrolled or not.
+- **MPNId**  Returns the Partner ID/MPN ID from Regkey. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\DeployID
+- **SCCMClientId**  This ID correlate systems that send data to Compat Analytics (OMS) and other OMS based systems with systems in an Enterprise SCCM environment.
+- **ServerFeatures**  Represents the features installed on a Windows Server. This can be used by developers and administrators who need to automate the process of determining the features installed on a set of server computers.
+- **SystemCenterID**  The SCCM ID is an anonymized one-way hash of the Active Directory Organization identifier
+
+
+### Census.Firmware
+
+This event sends data about the BIOS and startup embedded in the device, to help keep Windows up to date.
+
+The following fields are available:
+
+- **FirmwareManufacturer**  Represents the manufacturer of the device's firmware (BIOS).
+- **FirmwareReleaseDate**  Represents the date the current firmware was released.
+- **FirmwareType**  Represents the firmware type. The various types can be unknown, BIOS, UEFI.
+- **FirmwareVersion**  Represents the version of the current firmware.
+
+
+### Census.Flighting
+
+This event sends Windows Insider data from customers participating in improvement testing and feedback programs, to help keep Windows up to date.
+
+The following fields are available:
+
+- **DeviceSampleRate**  The telemetry sample rate assigned to the device.
+- **DriverTargetRing**  Indicates if the device is participating in receiving pre-release drivers and firmware contrent.
+- **EnablePreviewBuilds**  Used to enable Windows Insider builds on a device.
+- **FlightIds**  A list of the different Windows Insider builds on this device.
+- **FlightingBranchName**  The name of the Windows Insider branch currently used by the device.
+- **IsFlightsDisabled**  Represents if the device is participating in the Windows Insider program.
+- **MSA_Accounts**  Represents a list of hashed IDs of the Microsoft Accounts that are flighting (pre-release builds) on this device.
+- **SSRK**  Retrieves the mobile targeting settings.
+
+
+### Census.Hardware
+
+This event sends data about the device, including hardware type, OEM brand, model line, model, telemetry level setting, and TPM support, to help keep Windows up to date.
+
+The following fields are available:
+
+- **ActiveMicCount**  The number of active microphones attached to the device.
+- **ChassisType**  Represents the type of device chassis, such as desktop or low profile desktop. The possible values can range between 1 - 36.
+- **ComputerHardwareID**  Identifies a device class that is represented by a hash of different SMBIOS fields.
+- **D3DMaxFeatureLevel**  Supported Direct3D version.
+- **DeviceColor**  Indicates a color of the device.
+- **DeviceForm**  Indicates the form as per the device classification.
+- **DeviceName**  The device name that is set by the user.
+- **DigitizerSupport**  Is a digitizer supported?
+- **DUID**  The device unique ID.
+- **Gyroscope**  Indicates whether the device has a gyroscope (a mechanical component that measures and maintains orientation).
+- **InventoryId**  The device ID used for compatibility testing.
+- **Magnetometer**  Indicates whether the device has a magnetometer (a mechanical component that works like a compass).
+- **NFCProximity**  Indicates whether the device supports NFC (a set of communication protocols that helps establish communication when applicable devices are brought close together.)
+- **OEMDigitalMarkerFileName**  The name of the file placed in the \Windows\system32\drivers directory that specifies the OEM and model name of the device.
+- **OEMManufacturerName**  The device manufacturer name.  The OEMName for an inactive device is not reprocessed even if the clean OEM name is changed at a later date.
+- **OEMModelBaseBoard**  The baseboard model used by the OEM.
+- **OEMModelBaseBoardVersion**  Differentiates between developer and retail devices.
+- **OEMModelName**  The device model name.
+- **OEMModelNumber**  The device model number.
+- **OEMModelSKU**  The device edition that is defined by the manufacturer.
+- **OEMModelSystemFamily**  The system family set on the device by an OEM.
+- **OEMModelSystemVersion**  The system model version set on the device by the OEM.
+- **OEMOptionalIdentifier**  A Microsoft assigned value that represents a specific OEM subsidiary.
+- **OEMSerialNumber**  The serial number of the device that is set by the manufacturer.
+- **PhoneManufacturer**  The friendly name of the phone manufacturer.
+- **PowerPlatformRole**  The OEM preferred power management profile. It's used to help to identify the basic form factor of the device.
+- **SoCName**  The firmware manufacturer of the device.
+- **StudyID**  Used to identify retail and non-retail device.
+- **TelemetryLevel**  The telemetry level the user has opted into, such as Basic or Enhanced.
+- **TelemetryLevelLimitEnhanced**  The telemetry level for Windows Analytics-based solutions.
+- **TelemetrySettingAuthority**  Determines who set the telemetry level, such as GP, MDM, or the user.
+- **TPMManufacturerId**  The ID of the TPM manufacturer.
+- **TPMManufacturerVersion**  The version of the TPM manufacturer.
+- **TPMVersion**  The supported Trusted Platform Module (TPM) on the device. If no TPM is present, the value is 0.
+- **VoiceSupported**  Does the device have a cellular radio capable of making voice calls?
+
+
+### Census.Memory
+
+This event sends data about the memory on the device, including ROM and RAM, to help keep Windows up to date.
+
+The following fields are available:
+
+- **TotalPhysicalRAM**  Represents the physical memory (in MB).
+- **TotalVisibleMemory**  Represents the memory that is not reserved by the system.
+
+
+### Census.Network
+
+This event sends data about the mobile and cellular network used by the device (mobile service provider, network, device ID, and service cost factors), to help keep Windows up to date.
+
+The following fields are available:
+
+- **IMEI0**  Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
+- **IMEI1**  Represents the International Mobile Station Equipment Identity. This number is usually unique and used by the mobile operator to distinguish different phone hardware. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user. The two fields represent phone with dual sim coverage.
+- **MCC0**  Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MCC1**  Represents the Mobile Country Code (MCC). It used with the Mobile Network Code (MNC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MEID**  Represents the Mobile Equipment Identity (MEID). MEID is a worldwide unique phone ID assigned to CDMA phones. MEID replaces electronic serial number (ESN), and is equivalent to IMEI for GSM and WCDMA phones. Microsoft does not have access to mobile operator billing data so collecting this data does not expose or identify the user.
+- **MNC0**  Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MNC1**  Retrieves the Mobile Network Code (MNC). It used with the Mobile Country Code (MCC) to uniquely identify a mobile network operator. The two fields represent phone with dual sim coverage.
+- **MobileOperatorBilling**  Represents the telephone company that provides services for mobile phone users.
+- **MobileOperatorCommercialized**  Represents which reseller and geography the phone is commercialized for. This is the set of values on the phone for who and where it was intended to be used. For example, the commercialized mobile operator code AT&T in the US would be ATT-US.
+- **MobileOperatorNetwork0**  Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage.
+- **MobileOperatorNetwork1**  Represents the operator of the current mobile network that the device is used on. (AT&T, T-Mobile, Vodafone). The two fields represent phone with dual sim coverage.
+- **NetworkAdapterGUID**  The GUID of the primary network adapter.
+- **NetworkCost**  Represents the network cost associated with a connection.
+- **SPN0**  Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage.
+- **SPN1**  Retrieves the Service Provider Name (SPN). For example, these might be AT&T, Sprint, T-Mobile, or Verizon. The two fields represent phone with dual sim coverage.
+
+
+### Census.OS
+
+This event sends data about the operating system such as the version, locale, update service configuration, when and how it was originally installed, and whether it is a virtual device, to help keep Windows up to date.
+
+The following fields are available:
+
+- **ActivationChannel**  Retrieves the retail license key or Volume license key for a machine.
+- **AssignedAccessStatus**  Kiosk configuration mode.
+- **CompactOS**  Indicates if the Compact OS feature from Win10 is enabled.
+- **DeveloperUnlockStatus**  Represents if a device has been developer unlocked by the user or Group Policy.
+- **DeviceTimeZone**  The time zone that is set on the device. Example: Pacific Standard Time
+- **GenuineState**  Retrieves the ID Value specifying the OS Genuine check.
+- **InstallationType**  Retrieves the type of OS installation. (Clean, Upgrade, Reset, Refresh, Update).
+- **InstallLanguage**  The first language installed on the user machine.
+- **IsDeviceRetailDemo**  Retrieves if the device is running in demo mode.
+- **IsEduData**  Returns Boolean if the education data policy is enabled.
+- **IsPortableOperatingSystem**  Retrieves whether OS is running Windows-To-Go
+- **IsSecureBootEnabled**  Retrieves whether Boot chain is signed under UEFI.
+- **LanguagePacks**  The list of language packages installed on the device.
+- **LicenseStateReason**  Retrieves why (or how) a system is licensed or unlicensed.  The HRESULT may indicate an error code that indicates a key blocked error, or it may indicate that we are running an OS License granted by the MS store.
+- **OA3xOriginalProductKey**  Retrieves the License key stamped by the OEM to the machine.
+- **OSEdition**  Retrieves the version of the current OS.
+- **OSInstallType**  Retrieves a numeric description of what install was used on the device i.e. clean, upgrade, refresh, reset, etc
+- **OSOOBEDateTime**  Retrieves Out of Box Experience (OOBE) Date in Coordinated Universal Time (UTC).
+- **OSSKU**  Retrieves the Friendly Name of OS Edition.
+- **OSSubscriptionStatus**  Represents the existing status for enterprise subscription feature for PRO machines.
+- **OSSubscriptionTypeId**  Returns boolean for enterprise subscription feature for selected PRO machines.
+- **OSTimeZoneBiasInMins**  Retrieves the time zone set on machine.
+- **OSUILocale**  Retrieves the locale of the UI that is currently used by the OS.
+- **ProductActivationResult**  Returns Boolean if the OS Activation was successful.
+- **ProductActivationTime**  Returns the OS Activation time for tracking piracy issues.
+- **ProductKeyID2**  Retrieves the License key if the machine is updated with a new license key.
+- **RACw7Id**  Retrieves the Microsoft Reliability Analysis Component (RAC) Win7 Identifier. RAC is used to monitor and analyze system usage and reliability.
+- **ServiceMachineIP**  Retrieves the IP address of the KMS host used for anti-piracy.
+- **ServiceMachinePort**  Retrieves the port of the KMS host used for anti-piracy.
+- **ServiceProductKeyID**  Retrieves the License key of the KMS
+- **SharedPCMode**  Returns Boolean for education devices used as shared cart
+- **Signature**  Retrieves if it is a signature machine sold by Microsoft store.
+- **SLICStatus**  Whether a SLIC table exists on the device.
+- **SLICVersion**  Returns OS type/version from SLIC table.
+
+
+### Census.PrivacySettings
+
+This event provides information about the device level privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represent the authority that set the value. The effective consent (first 8 bits) is one of the following values:  -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority (last 8 bits) is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = system, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings.
+
+The following fields are available:
+
+- **Activity**  Current state of the activity history setting.
+- **ActivityHistoryCloudSync**  Current state of the activity history cloud sync setting.
+- **ActivityHistoryCollection**  Current state of the activity history collection setting.
+- **AdvertisingId**  Current state of the advertising ID setting.
+- **AppDiagnostics**  Current state of the app diagnostics setting.
+- **Appointments**  Current state of the calendar setting.
+- **Bluetooth**  Current state of the Bluetooth capability setting.
+- **BluetoothSync**  Current state of the Bluetooth sync capability setting.
+- **BroadFileSystemAccess**  Current state of the broad file system access setting.
+- **CellularData**  Current state of the cellular data capability setting.
+- **Chat**  Current state of the chat setting.
+- **Contacts**  Current state of the contacts setting.
+- **DocumentsLibrary**  Current state of the documents library setting.
+- **Email**  Current state of the email setting.
+- **FindMyDevice**  Current state of the "find my device" setting.
+- **GazeInput**  Current state of the gaze input setting.
+- **HumanInterfaceDevice**  Current state of the human interface device setting.
+- **InkTypeImprovement**  Current state of the improve inking and typing setting.
+- **Location**  Current state of the location setting.
+- **LocationHistory**  Current state of the location history setting.
+- **LocationHistoryCloudSync**  Current state of the location history cloud sync setting.
+- **LocationHistoryOnTimeline**  Current state of the location history on timeline setting.
+- **Microphone**  Current state of the microphone setting.
+- **PhoneCall**  Current state of the phone call setting.
+- **PhoneCallHistory**  Current state of the call history setting.
+- **PicturesLibrary**  Current state of the pictures library setting.
+- **Radios**  Current state of the radios setting.
+- **SensorsCustom**  Current state of the custom sensor setting.
+- **SerialCommunication**  Current state of the serial communication setting.
+- **Sms**  Current state of the text messaging setting.
+- **SpeechPersonalization**  Current state of the speech services setting.
+- **USB**  Current state of the USB setting.
+- **UserAccountInformation**  Current state of the account information setting.
+- **UserDataTasks**  Current state of the tasks setting.
+- **UserNotificationListener**  Current state of the notifications setting.
+- **VideosLibrary**  Current state of the videos library setting.
+- **Webcam**  Current state of the camera setting.
+- **WiFiDirect**  Current state of the Wi-Fi direct setting.
+
+
+### Census.Processor
+
+This event sends data about the processor to help keep Windows up to date.
+
+The following fields are available:
+
+- **KvaShadow**  This is the micro code information of the processor.
+- **MMSettingOverride**  Microcode setting of the processor.
+- **MMSettingOverrideMask**  Microcode setting override of the processor.
+- **PreviousUpdateRevision**  Previous microcode revision
+- **ProcessorArchitecture**  Retrieves the processor architecture of the installed operating system.
+- **ProcessorClockSpeed**  Clock speed of the processor in MHz.
+- **ProcessorCores**  Number of logical cores in the processor.
+- **ProcessorIdentifier**  Processor Identifier of a manufacturer.
+- **ProcessorManufacturer**  Name of the processor manufacturer.
+- **ProcessorModel**  Name of the processor model.
+- **ProcessorPhysicalCores**  Number of physical cores in the processor.
+- **ProcessorUpdateRevision**  The microcode revision.
+- **ProcessorUpdateStatus**  Enum value that represents the processor microcode load status
+- **SocketCount**  Count of CPU sockets.
+- **SpeculationControl**  If the system has enabled protections needed to validate the speculation control vulnerability.
+
+
+### Census.Security
+
+This event provides information on about security settings used to help keep Windows up to date and secure.
+
+The following fields are available:
+
+- **AvailableSecurityProperties**  This field helps to enumerate and report state on the relevant security properties for Device Guard.
+- **CGRunning**  Credential Guard isolates and hardens key system and user secrets against compromise, helping to minimize the impact and breadth of a Pass the Hash style attack in the event that malicious code is already running via a local or network based vector. This field tells if Credential Guard is running.
+- **DGState**  This field summarizes the Device Guard state.
+- **HVCIRunning**  Hypervisor Code Integrity (HVCI) enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s functionality to force all software running in kernel mode to safely allocate memory. This field tells if HVCI is running.
+- **IsSawGuest**  Indicates whether the device is running as a Secure Admin Workstation Guest.
+- **IsSawHost**  Indicates whether the device is running as a Secure Admin Workstation Host.
+- **RequiredSecurityProperties**  Describes the required security properties to enable virtualization-based security.
+- **SecureBootCapable**  Systems that support Secure Boot can have the feature turned off via BIOS. This field tells if the system is capable of running Secure Boot, regardless of the BIOS setting.
+- **SModeState**  The Windows S mode trail state.
+- **VBSState**  Virtualization-based security (VBS) uses the hypervisor to help protect the kernel and other parts of the operating system. Credential Guard and Hypervisor Code Integrity (HVCI) both depend on VBS to isolate/protect secrets, and kernel-mode code integrity validation.  VBS has a tri-state that can be Disabled, Enabled, or Running.
+
+
+### Census.Speech
+
+This event is used to gather basic speech settings on the device.
+
+The following fields are available:
+
+- **AboveLockEnabled**  Cortana setting that represents if Cortana can be invoked when the device is locked.
+- **GPAllowInputPersonalization**  Indicates if a Group Policy setting has enabled speech functionalities.
+- **HolographicSpeechInputDisabled**  Holographic setting that represents if the attached HMD devices have speech functionality disabled by the user.
+- **HolographicSpeechInputDisabledRemote**  Indicates if a remote policy has disabled speech functionalities for the HMD devices.
+- **KeyVer**  Version information for the census speech event.
+- **KWSEnabled**  Cortana setting that represents if a user has enabled the "Hey Cortana" keyword spotter (KWS).
+- **MDMAllowInputPersonalization**  Indicates if an MDM policy has enabled speech functionalities.
+- **RemotelyManaged**  Indicates if the device is being controlled by a remote administrator (MDM or Group Policy) in the context of speech functionalities.
+- **SpeakerIdEnabled**  Cortana setting that represents if keyword detection has been trained to try to respond to a single user's voice.
+- **SpeechServicesEnabled**  Windows setting that represents whether a user is opted-in for speech services on the device.
+- **SpeechServicesValueSource**  Indicates the deciding factor for the effective online speech recognition privacy policy settings: remote admin, local admin, or user preference.
+
+
+### Census.Storage
+
+This event sends data about the total capacity of the system volume and primary disk, to help keep Windows up to date.
+
+The following fields are available:
+
+- **PrimaryDiskTotalCapacity**  Retrieves the amount of disk space on the primary disk of the device in MB.
+- **PrimaryDiskType**  Retrieves an enumerator value of type STORAGE_BUS_TYPE that indicates the type of bus to which the device is connected. This should be used to interpret the raw device properties at the end of this structure (if any).
+- **StorageReservePassedPolicy**  Indicates whether the Storage Reserve policy, which ensures that updates have enough disk space and customers are on the latest OS, is enabled on this device.
+- **SystemVolumeTotalCapacity**  Retrieves the size of the partition that the System volume is installed on in MB.
+
+
+### Census.Userdefault
+
+This event sends data about the current user's default preferences for browser and several of the most popular extensions and protocols, to help keep Windows up to date.
+
+The following fields are available:
+
+- **CalendarType**  The calendar identifiers that are used to specify different calendars.
+- **DefaultApp**  The current uer's default program selected for the following extension or protocol: .html, .htm, .jpg, .jpeg, .png, .mp3, .mp4, .mov, .pdf.
+- **DefaultBrowserProgId**  The ProgramId of the current user's default browser.
+- **LocaleName**  Name of the current user locale given by LOCALE_SNAME via the GetLocaleInfoEx() function.
+- **LongDateFormat**  The long date format the user has selected.
+- **ShortDateFormat**  The short date format the user has selected.
+
+
+### Census.UserDisplay
+
+This event sends data about the logical/physical display size, resolution and number of internal/external displays, and VRAM on the system, to help keep Windows up to date.
+
+The following fields are available:
+
+- **InternalPrimaryDisplayLogicalDPIX**  Retrieves the logical DPI in the x-direction of the internal display.
+- **InternalPrimaryDisplayLogicalDPIY**  Retrieves the logical DPI in the y-direction of the internal display.
+- **InternalPrimaryDisplayPhysicalDPIX**  Retrieves the physical DPI in the x-direction of the internal display.
+- **InternalPrimaryDisplayPhysicalDPIY**  Retrieves the physical DPI in the y-direction of the internal display.
+- **InternalPrimaryDisplayResolutionHorizontal**  Retrieves the number of pixels in the horizontal direction of the internal display.
+- **InternalPrimaryDisplayResolutionVertical**  Retrieves the number of pixels in the vertical direction of the internal display.
+- **InternalPrimaryDisplaySizePhysicalH**  Retrieves the physical horizontal length of the display in mm. Used for calculating the diagonal length in inches .
+- **InternalPrimaryDisplaySizePhysicalY**  Retrieves the physical vertical length of the display in mm. Used for calculating the diagonal length in inches
+- **NumberofExternalDisplays**  Retrieves the number of external displays connected to the machine
+- **NumberofInternalDisplays**  Retrieves the number of internal displays in a machine.
+- **VRAMDedicated**  Retrieves the video RAM in MB.
+- **VRAMDedicatedSystem**  Retrieves the amount of memory on the dedicated video card.
+- **VRAMSharedSystem**  Retrieves the amount of RAM memory that the video card can use.
+
+
+### Census.UserNLS
+
+This event sends data about the default app language, input, and display language preferences set by the user, to help keep Windows up to date.
+
+The following fields are available:
+
+- **DefaultAppLanguage**  The current user Default App Language.
+- **DisplayLanguage**  The current user preferred Windows Display Language.
+- **HomeLocation**  The current user location, which is populated using GetUserGeoId() function.
+- **KeyboardInputLanguages**  The Keyboard input languages installed on the device.
+- **SpeechInputLanguages**  The Speech Input languages installed on the device.
+
+
+### Census.UserPrivacySettings
+
+This event provides information about the current users privacy settings and whether device-level access was granted to these capabilities. Not all settings are applicable to all devices. Each field records the consent state for the corresponding privacy setting. The consent state is encoded as a 16-bit signed integer, where the first 8 bits represents the effective consent value, and the last 8 bits represents the authority that set the value. The effective consent is one of the following values: -3 = unexpected consent value, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = undefined, 1 = allow, 2 = deny, 3 = prompt. The consent authority is one of the following values: -3 = unexpected authority, -2 = value was not requested, -1 = an error occurred while attempting to retrieve the value, 0 = user, 1 = a higher authority (a gating setting, the system-wide setting, or a group policy), 2 = advertising ID group policy, 3 = advertising ID policy for child account, 4 = privacy setting provider doesn't know the actual consent authority, 5 = consent was not configured and a default set in code was used, 6 = system default, 7 = organization policy, 8 = OneSettings.
+
+The following fields are available:
+
+- **Activity**  Current state of the activity history setting.
+- **ActivityHistoryCloudSync**  Current state of the activity history cloud sync setting.
+- **ActivityHistoryCollection**  Current state of the activity history collection setting.
+- **AdvertisingId**  Current state of the advertising ID setting.
+- **AppDiagnostics**  Current state of the app diagnostics setting.
+- **Appointments**  Current state of the calendar setting.
+- **Bluetooth**  Current state of the Bluetooth capability setting.
+- **BluetoothSync**  Current state of the Bluetooth sync capability setting.
+- **BroadFileSystemAccess**  Current state of the broad file system access setting.
+- **CellularData**  Current state of the cellular data capability setting.
+- **Chat**  Current state of the chat setting.
+- **Contacts**  Current state of the contacts setting.
+- **DocumentsLibrary**  Current state of the documents library setting.
+- **Email**  Current state of the email setting.
+- **GazeInput**  Current state of the gaze input setting.
+- **HumanInterfaceDevice**  Current state of the human interface device setting.
+- **InkTypeImprovement**  Current state of the improve inking and typing setting.
+- **InkTypePersonalization**  Current state of the inking and typing personalization setting.
+- **Location**  Current state of the location setting.
+- **LocationHistory**  Current state of the location history setting.
+- **LocationHistoryCloudSync**  Current state of the location history cloud sync setting.
+- **LocationHistoryOnTimeline**  Current state of the location history on timeline setting.
+- **Microphone**  Current state of the microphone setting.
+- **PhoneCall**  Current state of the phone call setting.
+- **PhoneCallHistory**  Current state of the call history setting.
+- **PicturesLibrary**  Current state of the pictures library setting.
+- **Radios**  Current state of the radios setting.
+- **SensorsCustom**  Current state of the custom sensor setting.
+- **SerialCommunication**  Current state of the serial communication setting.
+- **Sms**  Current state of the text messaging setting.
+- **SpeechPersonalization**  Current state of the speech services setting.
+- **USB**  Current state of the USB setting.
+- **UserAccountInformation**  Current state of the account information setting.
+- **UserDataTasks**  Current state of the tasks setting.
+- **UserNotificationListener**  Current state of the notifications setting.
+- **VideosLibrary**  Current state of the videos library setting.
+- **Webcam**  Current state of the camera setting.
+- **WiFiDirect**  Current state of the Wi-Fi direct setting.
+
+
+### Census.VM
+
+This event sends data indicating whether virtualization is enabled on the device, and its various characteristics, to help keep Windows up to date.
+
+The following fields are available:
+
+- **CloudService**  Indicates which cloud service, if any, that this virtual machine is running within.
+- **HyperVisor**  Retrieves whether the current OS is running on top of a Hypervisor.
+- **IOMMUPresent**  Represents if an input/output memory management unit (IOMMU) is present.
+- **IsVDI**  Is the device using Virtual Desktop Infrastructure?
+- **IsVirtualDevice**  Retrieves that when the Hypervisor is Microsoft's Hyper-V Hypervisor or other Hv#1 Hypervisor, this field will be set to FALSE for the Hyper-V host OS and TRUE for any guest OS's. This field should not be relied upon for non-Hv#1 Hypervisors.
+- **SLATSupported**  Represents whether Second Level Address Translation (SLAT) is supported by the hardware.
+- **VirtualizationFirmwareEnabled**  Represents whether virtualization is enabled in the firmware.
+- **VMId**  A string that uniquely identifies a virtual machine.
+
+
+### Census.WU
+
+This event sends data about the Windows update server and other App store policies, to help keep Windows up to date.
+
+The following fields are available:
+
+- **AppraiserGatedStatus**  Indicates whether a device has been gated for upgrading.
+- **AppStoreAutoUpdate**  Retrieves the Appstore settings for auto upgrade. (Enable/Disabled).
+- **AppStoreAutoUpdateMDM**  Retrieves the App Auto Update value for MDM: 0 - Disallowed. 1 - Allowed. 2 - Not configured. Default: [2] Not configured
+- **AppStoreAutoUpdatePolicy**  Retrieves the Microsoft Store App Auto Update group policy setting
+- **DelayUpgrade**  Retrieves the Windows upgrade flag for delaying upgrades.
+- **OSAssessmentFeatureOutOfDate**  How many days has it been since a the last feature update was released but the device did not install it?
+- **OSAssessmentForFeatureUpdate**  Is the device is on the latest feature update?
+- **OSAssessmentForQualityUpdate**  Is the device on the latest quality update?
+- **OSAssessmentForSecurityUpdate**  Is the device  on the latest security update?
+- **OSAssessmentQualityOutOfDate**  How many days has it been since a the last quality update was released but the device did not install it?
+- **OSAssessmentReleaseInfoTime**  The freshness of release information used to perform an assessment.
+- **OSRollbackCount**  The number of times feature updates have rolled back on the device.
+- **OSRolledBack**  A flag that represents when a feature update has rolled back during setup.
+- **OSUninstalled**  A flag that represents when a feature update is uninstalled on a device .
+- **OSWUAutoUpdateOptions**  Retrieves the auto update settings on the device.
+- **OSWUAutoUpdateOptionsSource**  The source of auto update setting that appears in the OSWUAutoUpdateOptions field.  For example: Group Policy (GP), Mobile Device Management (MDM), and Default.
+- **UninstallActive**  A flag that represents when a device has uninstalled a previous upgrade recently.
+- **UpdateServiceURLConfigured**  Retrieves if the device is managed by Windows Server Update Services (WSUS).
+- **WUDeferUpdatePeriod**  Retrieves if deferral is set for Updates.
+- **WUDeferUpgradePeriod**  Retrieves if deferral is set for Upgrades.
+- **WUDODownloadMode**  Retrieves whether DO is turned on and how to acquire/distribute updates Delivery Optimization (DO) allows users to deploy previously downloaded WU updates to other devices on the same network.
+- **WUMachineId**  Retrieves the Windows Update (WU) Machine Identifier.
+- **WUPauseState**  Retrieves WU setting to determine if updates are paused.
+- **WUServer**  Retrieves the HTTP(S) URL of the WSUS server that is used by Automatic Updates and API callers (by default).
+
+
+## Common data extensions
+
+### Common Data Extensions.app
+
+Describes the properties of the running application. This extension could be populated by a client app or a web app.
+
+The following fields are available:
+
+- **asId**  An integer value that represents the app session. This value starts at 0 on the first app launch and increments after each subsequent app launch per boot session.
+- **env**  The environment from which the event was logged.
+- **expId**  Associates a flight, such as an OS flight, or an experiment, such as a web site UX experiment, with an event.
+- **id**  Represents a unique identifier of the client application currently loaded in the process producing the event; and is used to group events together and understand usage pattern, errors by application.
+- **locale**  The locale of the app.
+- **name**  The name of the app.
+- **userId**  The userID as known by the application.
+- **ver**  Represents the version number of the application. Used to understand errors by Version, Usage by Version across an app.
+
+
+### Common Data Extensions.container
+
+Describes the properties of the container for events logged within a container.
+
+The following fields are available:
+
+- **epoch**  An ID that's incremented for each SDK initialization.
+- **localId**  The device ID as known by the client.
+- **osVer**  The operating system version.
+- **seq**  An ID that's incremented for each event.
+- **type**  The container type. Examples: Process or VMHost
+
+
+### Common Data Extensions.device
+
+Describes the device-related fields.
+
+The following fields are available:
+
+- **deviceClass**  The device classification. For example, Desktop, Server, or Mobile.
+- **localId**  A locally-defined unique ID for the device. This is not the human-readable device name. Most likely equal to the value stored at HKLM\Software\Microsoft\SQMClient\MachineId
+- **make**  Device manufacturer.
+- **model**  Device model.
+
+
+### Common Data Extensions.Envelope
+
+Represents an envelope that contains all of the common data extensions.
+
+The following fields are available:
+
+- **data**  Represents the optional unique diagnostic data for a particular event schema.
+- **ext_app**  Describes the properties of the running application. This extension could be populated by either a client app or a web app. See [Common Data Extensions.app](#common-data-extensionsapp).
+- **ext_container**  Describes the properties of the container for events logged within a container. See [Common Data Extensions.container](#common-data-extensionscontainer).
+- **ext_device**  Describes the device-related fields. See [Common Data Extensions.device](#common-data-extensionsdevice).
+- **ext_mscv**  Describes the correlation vector-related fields. See [Common Data Extensions.mscv](#common-data-extensionsmscv).
+- **ext_os**  Describes the operating system properties that would be populated by the client. See [Common Data Extensions.os](#common-data-extensionsos).
+- **ext_sdk**  Describes the fields related to a platform library required for a specific SDK. See [Common Data Extensions.sdk](#common-data-extensionssdk).
+- **ext_user**  Describes the fields related to a user. See [Common Data Extensions.user](#common-data-extensionsuser).
+- **ext_utc**  Describes the fields that might be populated by a logging library on Windows. See [Common Data Extensions.utc](#common-data-extensionsutc).
+- **ext_xbl**  Describes the fields related to XBOX Live. See [Common Data Extensions.xbl](#common-data-extensionsxbl).
+- **iKey**  Represents an ID for applications or other logical groupings of events.
+- **name**  Represents the uniquely qualified name for the event.
+- **time**  Represents the event date time in Coordinated Universal Time (UTC) when the event was generated on the client. This should be in ISO 8601 format.
+- **ver**  Represents the major and minor version of the extension.
+
+
+### Common Data Extensions.mscv
+
+Describes the correlation vector-related fields.
+
+The following fields are available:
+
+- **cV**  Represents the Correlation Vector: A single field for tracking partial order of related events across component boundaries.
+
+
+### Common Data Extensions.os
+
+Describes some properties of the operating system.
+
+The following fields are available:
+
+- **bootId**  An integer value that represents the boot session. This value starts at 0 on first boot after OS install and increments after every reboot.
+- **expId**  Represents the experiment ID. The standard for associating a flight, such as an OS flight (pre-release build), or an experiment, such as a web site UX experiment, with an event is to record the flight / experiment IDs in Part A of the common schema.
+- **locale**  Represents the locale of the operating system.
+- **name**  Represents the operating system name.
+- **ver**  Represents the major and minor version of the extension.
+
+
+### Common Data Extensions.sdk
+
+Used by platform specific libraries to record fields that are required for a specific SDK.
+
+The following fields are available:
+
+- **epoch**  An ID that is incremented for each SDK initialization.
+- **installId**  An ID that's created during the initialization of the SDK for the first time.
+- **libVer**  The SDK version.
+- **seq**  An ID that is incremented for each event.
+- **ver**  The version of the logging SDK.
+
+
+### Common Data Extensions.user
+
+Describes the fields related to a user.
+
+The following fields are available:
+
+- **authId**  This is an ID of the user associated with this event that is deduced from a token such as a Microsoft Account ticket or an XBOX token.
+- **locale**  The language and region.
+- **localId**  Represents a unique user identity that is created locally and added by the client. This is not the user's account ID.
+
+
+### Common Data Extensions.utc
+
+Describes the properties that could be populated by a logging library on Windows.
+
+The following fields are available:
+
+- **aId**  Represents the ETW ActivityId. Logged via TraceLogging or directly via ETW.
+- **bSeq**  Upload buffer sequence number in the format: buffer identifier:sequence number
+- **cat**  Represents a bitmask of the ETW Keywords associated with the event.
+- **cpId**  The composer ID, such as Reference, Desktop, Phone, Holographic, Hub, IoT Composer.
+- **epoch**  Represents the epoch and seqNum fields, which help track how many events were fired and how many events were uploaded, and enables identification of data lost during upload and de-duplication of events on the ingress server.
+- **eventFlags**  Represents a collection of bits that describe how the event should be processed by the Connected User Experience and Telemetry component pipeline. The lowest-order byte is the event persistence. The next byte is the event latency.
+- **flags**  Represents the bitmap that captures various Windows specific flags.
+- **loggingBinary**  The binary (executable, library, driver, etc.) that fired the event.
+- **mon**  Combined monitor and event sequence numbers in the format: monitor sequence : event sequence
+- **op**  Represents the ETW Op Code.
+- **pgName**  The short form of the provider group name associated with the event.
+- **popSample**  Represents the effective sample rate for this event at the time it was generated by a client.
+- **providerGuid**  The ETW provider ID associated with the provider name.
+- **raId**  Represents the ETW Related ActivityId. Logged via TraceLogging or directly via ETW.
+- **seq**  Represents the sequence field used to track absolute order of uploaded events. It is an incrementing identifier for each event added to the upload queue.  The Sequence helps track how many events were fired and how many events were uploaded and enables identification of data lost during upload and de-duplication of events on the ingress server.
+- **stId**  Represents the Scenario Entry Point ID. This is a unique GUID for each event in a diagnostic scenario. This used to be Scenario Trigger ID.
+- **wcmp**  The Windows Shell Composer ID.
+- **wPId**  The Windows Core OS product ID.
+- **wsId**  The Windows Core OS session ID.
+
+
+### Common Data Extensions.xbl
+
+Describes the fields that are related to XBOX Live.
+
+The following fields are available:
+
+- **claims**  Any additional claims whose short claim name hasn't been added to this structure.
+- **did**  XBOX device ID
+- **dty**  XBOX device type
+- **dvr**  The version of the operating system on the device.
+- **eid**  A unique ID that represents the developer entity.
+- **exp**  Expiration time
+- **ip**  The IP address of the client device.
+- **nbf**  Not before time
+- **pid**  A comma separated list of PUIDs listed as base10 numbers.
+- **sbx**  XBOX sandbox identifier
+- **sid**  The service instance ID.
+- **sty**  The service type.
+- **tid**  The XBOX Live title ID.
+- **tvr**  The XBOX Live title version.
+- **uts**  A bit field, with 2 bits being assigned to each user ID listed in xid. This field is omitted if all users are retail accounts.
+- **xid**  A list of base10-encoded XBOX User IDs.
+
+
+## Common data fields
+
+### Ms.Device.DeviceInventoryChange
+
+Describes the installation state for all hardware and software components available on a particular device.
+
+The following fields are available:
+
+- **action**  The change that was invoked on a device inventory object.
+- **inventoryId**  Device ID used for Compatibility testing
+- **objectInstanceId**  Object identity which is unique within the device scope.
+- **objectType**  Indicates the object type that the event applies to.
+- **syncId**  A string used to group StartSync, EndSync, Add, and Remove operations that belong together. This field is unique by Sync period and is used to disambiguate in situations where multiple agents perform overlapping inventories for the same object.
+
+
+## Component-based servicing events
+
+### CbsServicingProvider.CbsCapabilityEnumeration
+
+This event reports on the results of scanning for optional Windows content on Windows Update.
+
+The following fields are available:
+
+- **architecture**  Indicates the scan was limited to the specified architecture.
+- **capabilityCount**  The number of optional content packages found during the scan.
+- **clientId**  The name of the application requesting the optional content.
+- **duration**  The amount of time it took to complete the scan.
+- **hrStatus**  The HReturn code of the scan.
+- **language**  Indicates the scan was limited to the specified language.
+- **majorVersion**  Indicates the scan was limited to the specified major version.
+- **minorVersion**  Indicates the scan was limited to the specified minor version.
+- **namespace**  Indicates the scan was limited to packages in the specified namespace.
+- **sourceFilter**  A bitmask indicating the scan checked for locally available optional content.
+- **stackBuild**  The build number of the servicing stack.
+- **stackMajorVersion**  The major version number of the servicing stack.
+- **stackMinorVersion**  The minor version number of the servicing stack.
+- **stackRevision**  The revision number of the servicing stack.
+
+
+### CbsServicingProvider.CbsCapabilitySessionFinalize
+
+This event provides information about the results of installing or uninstalling optional Windows content from Windows Update.
+
+The following fields are available:
+
+- **capabilities**  The names of the optional content packages that were installed.
+- **clientId**  The name of the application requesting the optional content.
+- **currentID**  The ID of the current install session.
+- **downloadSource**  The source of the download.
+- **highestState**  The highest final install state of the optional content.
+- **hrLCUReservicingStatus**  Indicates whether the optional content was updated to the latest available version.
+- **hrStatus**  The HReturn code of the install operation.
+- **rebootCount**  The number of reboots required to complete the install.
+- **retryID**  The session ID that will be used to retry a failed operation.
+- **retryStatus**  Indicates whether the install will be retried in the event of failure.
+- **stackBuild**  The build number of the servicing stack.
+- **stackMajorVersion**  The major version number of the servicing stack.
+- **stackMinorVersion**  The minor version number of the servicing stack.
+- **stackRevision**  The revision number of the servicing stack.
+
+
+### CbsServicingProvider.CbsCapabilitySessionPended
+
+This event provides information about the results of installing optional Windows content that requires a reboot to keep Windows up to date.
+
+The following fields are available:
+
+- **clientId**  The name of the application requesting the optional content.
+- **pendingDecision**  Indicates the cause of reboot, if applicable.
+
+
+### CbsServicingProvider.CbsLateAcquisition
+
+This event sends data to indicate if some Operating System packages could not be updated as part of an upgrade, to help keep Windows up to date.
+
+The following fields are available:
+
+- **Features**  The list of feature packages that could not be updated.
+- **RetryID**  The ID identifying the retry attempt to update the listed packages.
+
+
+### CbsServicingProvider.CbsPackageRemoval
+
+This event provides information about the results of uninstalling a Windows Cumulative Security Update to help keep Windows up to date.
+
+The following fields are available:
+
+- **buildVersion**  The build number of the security update being uninstalled.
+- **clientId**  The name of the application requesting the uninstall.
+- **currentStateEnd**  The final state of the update after the operation.
+- **failureDetails**  Information about the cause of a failure, if applicable.
+- **failureSourceEnd**  The stage during the uninstall where the failure occurred.
+- **hrStatusEnd**  The overall exit code of the operation.
+- **initiatedOffline**  Indicates if the uninstall was initiated for a mounted Windows image.
+- **majorVersion**  The major version number of the security update being uninstalled.
+- **minorVersion**  The minor version number of the security update being uninstalled.
+- **originalState**  The starting state of the update before the operation.
+- **pendingDecision**  Indicates the cause of reboot, if applicable.
+- **primitiveExecutionContext**  The state during system startup when the uninstall was completed.
+- **revisionVersion**  The revision number of the security update being uninstalled.
+- **transactionCanceled**  Indicates whether the uninstall was cancelled.
+
+
+### CbsServicingProvider.CbsQualityUpdateInstall
+
+This event reports on the performance and reliability results of installing Servicing content from Windows Update to keep Windows up to date.
+
+The following fields are available:
+
+- **buildVersion**  The build version number of the update package.
+- **clientId**  The name of the application requesting the optional content.
+- **corruptionHistoryFlags**  A bitmask of the types of component store corruption that have caused update failures on the device.
+- **corruptionType**  An enumeration listing the type of data corruption responsible for the current update failure.
+- **currentStateEnd**  The final state of the package after the operation has completed.
+- **doqTimeSeconds**  The time in seconds spent updating drivers.
+- **executeTimeSeconds**  The number of seconds required to execute the install.
+- **failureDetails**  The driver or installer that caused the update to fail.
+- **failureSourceEnd**  An enumeration indicating at what phase of the update a failure occurred.
+- **hrStatusEnd**  The return code of the install operation.
+- **initiatedOffline**  A true or false value indicating whether the package was installed into an offline Windows Imaging Format (WIM) file.
+- **majorVersion**  The major version number of the update package.
+- **minorVersion**  The minor version number of the update package.
+- **originalState**  The starting state of the package.
+- **overallTimeSeconds**  The time (in seconds) to perform the overall servicing operation.
+- **planTimeSeconds**  The time in seconds required to plan the update operations.
+- **poqTimeSeconds**  The time in seconds processing file and registry operations.
+- **postRebootTimeSeconds**  The time (in seconds) to do startup processing for the update.
+- **preRebootTimeSeconds**  The time (in seconds) between execution of the installation and the reboot.
+- **primitiveExecutionContext**  An enumeration indicating at what phase of shutdown or startup the update was installed.
+- **rebootCount**  The number of reboots required to install the update.
+- **rebootTimeSeconds**  The time (in seconds) before startup processing begins for the update.
+- **resolveTimeSeconds**  The time in seconds required to resolve the packages that are part of the update.
+- **revisionVersion**  The revision version number of the update package.
+- **rptTimeSeconds**  The time in seconds spent executing installer plugins.
+- **shutdownTimeSeconds**  The time (in seconds) required to do shutdown processing for the update.
+- **stackRevision**  The revision number of the servicing stack.
+- **stageTimeSeconds**  The time (in seconds) required to stage all files that are part of the update.
+
+
+### CbsServicingProvider.CbsSelectableUpdateChangeV2
+
+This event reports the results of enabling or disabling optional Windows Content to keep Windows up to date.
+
+The following fields are available:
+
+- **applicableUpdateState**  Indicates the highest applicable state of the optional content.
+- **buildVersion**  The build version of the package being installed.
+- **clientId**  The name of the application requesting the optional content change.
+- **downloadSource**  Indicates if optional content was obtained from Windows Update or a locally accessible file.
+- **downloadtimeInSeconds**  Indicates if optional content was obtained from Windows Update or a locally accessible file.
+- **executionID**  A unique ID used to identify events associated with a single servicing operation and not reused for future operations.
+- **executionSequence**  A counter that tracks the number of servicing operations attempted on the device.
+- **firstMergedExecutionSequence**  The value of a pervious executionSequence counter that is being merged with the current operation, if applicable.
+- **firstMergedID**  A unique ID of a pervious servicing operation that is being merged with this operation, if applicable.
+- **hrDownloadResult**  The return code of the download operation.
+- **hrStatusUpdate**  The return code of the servicing operation.
+- **identityHash**  A pseudonymized (hashed) identifier for the Windows Package that is being installed or uninstalled.
+- **initiatedOffline**  Indicates whether the operation was performed against an offline Windows image file or a running instance of Windows.
+- **majorVersion**  The major version of the package being installed.
+- **minorVersion**  The minor version of the package being installed.
+- **packageArchitecture**  The architecture of the package being installed.
+- **packageLanguage**  The language of the package being installed.
+- **packageName**  The name of the package being installed.
+- **rebootRequired**  Indicates whether a reboot is required to complete the operation.
+- **revisionVersion**  The revision number of the package being installed.
+- **stackBuild**  The build number of the servicing stack binary performing the installation.
+- **stackMajorVersion**  The major version number of the servicing stack binary performing the installation.
+- **stackMinorVersion**  The minor version number of the servicing stack binary performing the installation.
+- **stackRevision**  The revision number of the servicing stack binary performing the installation.
+- **updateName**  The name of the optional Windows Operation System feature being enabled or disabled.
+- **updateStartState**  A value indicating the state of the optional content before the operation started.
+- **updateTargetState**  A value indicating the desired state of the optional content.
+
+
+### CbsServicingProvider.CbsUpdateDeferred
+
+This event reports the results of deferring Windows Content to keep Windows up to date.
+
+
+
+## Diagnostic data events
+
+### TelClientSynthetic.AbnormalShutdown_0
+
+This event sends data about boot IDs for which a normal clean shutdown was not observed, to help keep Windows up to date.
+
+The following fields are available:
+
+- **AbnormalShutdownBootId**  BootId of the abnormal shutdown being reported by this event.
+- **AbsCausedbyAutoChk**  This flag is set when AutoCheck forces a device restart to indicate that the shutdown was not an abnormal shutdown.
+- **AcDcStateAtLastShutdown**  Identifies if the device was on battery or plugged in.
+- **BatteryLevelAtLastShutdown**  The last recorded battery level.
+- **BatteryPercentageAtLastShutdown**  The battery percentage at the last shutdown.
+- **CrashDumpEnabled**  Are crash dumps enabled?
+- **CumulativeCrashCount**  Cumulative count of operating system crashes since the BootId reset.
+- **CurrentBootId**  BootId at the time the abnormal shutdown event was being reported.
+- **Firmwaredata->ResetReasonEmbeddedController**  The reset reason that was supplied by the firmware.
+- **Firmwaredata->ResetReasonEmbeddedControllerAdditional**  Additional data related to reset reason provided by the firmware.
+- **Firmwaredata->ResetReasonPch**  The reset reason that was supplied by the hardware.
+- **Firmwaredata->ResetReasonPchAdditional**  Additional data related to the reset reason supplied by the hardware.
+- **Firmwaredata->ResetReasonSupplied**  Indicates whether the firmware supplied any reset reason or not.
+- **FirmwareType**  ID of the FirmwareType as enumerated in DimFirmwareType.
+- **HardwareWatchdogTimerGeneratedLastReset**  Indicates whether the hardware watchdog timer caused the last reset.
+- **HardwareWatchdogTimerPresent**  Indicates whether hardware watchdog timer was present or not.
+- **InvalidBootStat**  This is a sanity check flag that ensures the validity of the bootstat file.
+- **LastBugCheckBootId**  bootId of the last captured crash.
+- **LastBugCheckCode**  Code that indicates the type of error.
+- **LastBugCheckContextFlags**  Additional crash dump settings.
+- **LastBugCheckOriginalDumpType**  The type of crash dump the system intended to save.
+- **LastBugCheckOtherSettings**  Other crash dump settings.
+- **LastBugCheckParameter1**  The first parameter with additional info on the type of the error.
+- **LastBugCheckProgress**  Progress towards writing out the last crash dump.
+- **LastBugCheckVersion**  The version of the information struct written during the crash.
+- **LastSuccessfullyShutdownBootId**  BootId of the last fully successful shutdown.
+- **LongPowerButtonPressDetected**  Identifies if the user was pressing and holding power button.
+- **OOBEInProgress**  Identifies if OOBE is running.
+- **OSSetupInProgress**  Identifies if the operating system setup is running.
+- **PowerButtonCumulativePressCount**  How many times has the power button been pressed?
+- **PowerButtonCumulativeReleaseCount**  How many times has the power button been released?
+- **PowerButtonErrorCount**  Indicates the number of times there was an error attempting to record power button metrics.
+- **PowerButtonLastPressBootId**  BootId of the last time the power button was pressed.
+- **PowerButtonLastPressTime**  Date and time of the last time the power button was pressed.
+- **PowerButtonLastReleaseBootId**  BootId of the last time the power button was released.
+- **PowerButtonLastReleaseTime**  Date and time of the last time the power button was released.
+- **PowerButtonPressCurrentCsPhase**  Represents the phase of Connected Standby exit when the power button was pressed.
+- **PowerButtonPressIsShutdownInProgress**  Indicates whether a system shutdown was in progress at the last time the power button was pressed.
+- **PowerButtonPressLastPowerWatchdogStage**  Progress while the monitor is being turned on.
+- **PowerButtonPressPowerWatchdogArmed**  Indicates whether or not the watchdog for the monitor was active at the time of the last power button press.
+- **ShutdownDeviceType**  Identifies who triggered a shutdown. Is it because of battery, thermal zones, or through a Kernel API.
+- **SleepCheckpoint**  Provides the last checkpoint when there is a failure during a sleep transition.
+- **SleepCheckpointSource**  Indicates whether the source is the EFI variable or bootstat file.
+- **SleepCheckpointStatus**  Indicates whether the checkpoint information is valid.
+- **StaleBootStatData**  Identifies if the data from bootstat is stale.
+- **TransitionInfoBootId**  BootId of the captured transition info.
+- **TransitionInfoCSCount**  l number of times the system transitioned from Connected Standby mode.
+- **TransitionInfoCSEntryReason**  Indicates the reason the device last entered Connected Standby mode.
+- **TransitionInfoCSExitReason**  Indicates the reason the device last exited Connected Standby mode.
+- **TransitionInfoCSInProgress**  At the time the last marker was saved, the system was in or entering Connected Standby mode.
+- **TransitionInfoLastReferenceTimeChecksum**  The checksum of TransitionInfoLastReferenceTimestamp,
+- **TransitionInfoLastReferenceTimestamp**  The date and time that the marker was last saved.
+- **TransitionInfoLidState**  Describes the state of the laptop lid.
+- **TransitionInfoPowerButtonTimestamp**  The date and time of the last time the power button was pressed.
+- **TransitionInfoSleepInProgress**  At the time the last marker was saved, the system was in or entering sleep mode.
+- **TransitionInfoSleepTranstionsToOn**  Total number of times the device transitioned from sleep mode.
+- **TransitionInfoSystemRunning**  At the time the last marker was saved, the device was running.
+- **TransitionInfoSystemShutdownInProgress**  Indicates whether a device shutdown was in progress when the power button was pressed.
+- **TransitionInfoUserShutdownInProgress**  Indicates whether a user shutdown was in progress when the power button was pressed.
+- **TransitionLatestCheckpointId**  Represents a unique identifier for a checkpoint during the device state transition.
+- **TransitionLatestCheckpointSeqNumber**  Represents the chronological sequence number of the checkpoint.
+- **TransitionLatestCheckpointType**  Represents the type of the checkpoint, which can be the start of a phase, end of a phase, or just informational.
+- **VirtualMachineId**  If the operating system is on a virtual Machine, it gives the virtual Machine ID (GUID) that can be used to correlate events on the host.
+
+
+### TelClientSynthetic.AuthorizationInfo_RuntimeTransition
+
+This event sends data indicating that a device has undergone a change of telemetry opt-in level detected at UTC startup, to help keep Windows up to date. The telemetry opt-in level signals what data we are allowed to collect.
+
+The following fields are available:
+
+- **CanAddMsaToMsTelemetry**  True if we can add MSA PUID and CID to telemetry, false otherwise.
+- **CanCollectAnyTelemetry**  True if we are allowed to collect partner telemetry, false otherwise.
+- **CanCollectCoreTelemetry**  True if we can collect CORE/Basic telemetry, false otherwise.
+- **CanCollectHeartbeats**  True if we can collect heartbeat telemetry, false otherwise.
+- **CanCollectOsTelemetry**  True if we can collect diagnostic data telemetry, false otherwise.
+- **CanCollectWindowsAnalyticsEvents**  True if we can collect Windows Analytics data, false otherwise.
+- **CanPerformDiagnosticEscalations**  True if we can perform diagnostic escalation collection, false otherwise.
+- **CanReportScenarios**  True if we can report scenario completions, false otherwise.
+- **PreviousPermissions**  Bitmask of previous telemetry state.
+- **TransitionFromEverythingOff**  True if we are transitioning from all telemetry being disabled, false otherwise.
+
+
+### TelClientSynthetic.AuthorizationInfo_Startup
+
+Fired by UTC at startup to signal what data we are allowed to collect.
+
+The following fields are available:
+
+- **CanAddMsaToMsTelemetry**  True if we can add MSA PUID and CID to telemetry, false otherwise.
+- **CanCollectAnyTelemetry**  True if we are allowed to collect partner telemetry, false otherwise.
+- **CanCollectCoreTelemetry**  True if we can collect CORE/Basic telemetry, false otherwise.
+- **CanCollectHeartbeats**  True if we can collect heartbeat telemetry, false otherwise.
+- **CanCollectOsTelemetry**  True if we can collect diagnostic data telemetry, false otherwise.
+- **CanCollectWindowsAnalyticsEvents**  True if we can collect Windows Analytics data, false otherwise.
+- **CanPerformDiagnosticEscalations**  True if we can perform diagnostic escalation collection, false otherwise.
+- **CanReportScenarios**  True if we can report scenario completions, false otherwise.
+- **PreviousPermissions**  Bitmask of previous telemetry state.
+- **TransitionFromEverythingOff**  True if we are transitioning from all telemetry being disabled, false otherwise.
+
+
+### TelClientSynthetic.ConnectivityHeartBeat_0
+
+This event sends data about the connectivity status of the Connected User Experience and Telemetry component that uploads telemetry events. If an unrestricted free network (such as Wi-Fi) is available, this event updates the last successful upload time. Otherwise, it checks whether a Connectivity Heartbeat event was fired in the past 24 hours, and if not, it sends an event. A Connectivity Heartbeat event is also sent when a device recovers from costed network to free network.
+
+The following fields are available:
+
+- **CensusExitCode**  Returns last execution codes from census client run.
+- **CensusStartTime**  Returns timestamp corresponding to last successful census run.
+- **CensusTaskEnabled**  Returns Boolean value for the census task (Enable/Disable) on client machine.
+- **LastConnectivityLossTime**  Retrieves the last time the device lost free network.
+- **NetworkState**  Retrieves the network state: 0 = No network. 1 = Restricted network. 2 = Free network.
+- **NoNetworkTime**  Retrieves the time spent with no network (since the last time) in seconds.
+- **RestrictedNetworkTime**  Retrieves the time spent on a metered (cost restricted) network in seconds.
+
+
+### TelClientSynthetic.GetFileInfoAction_FilePathNotApproved_0
+
+This event occurs when the DiagTrack escalation fails due to the scenario requesting a path that is not approved for GetFileInfo actions.
+
+The following fields are available:
+
+- **FilePath**  The unexpanded path in the scenario XML.
+- **ScenarioId**  The globally unique identifier (GUID) of the scenario.
+- **ScenarioInstanceId**  The error code denoting which path failed (internal or external).
+
+
+### TelClientSynthetic.HeartBeat_5
+
+This event sends data about the health and quality of the diagnostic data from the given device, to help keep Windows up to date. It also enables data analysts to determine how 'trusted' the data is from a given device.
+
+The following fields are available:
+
+- **AgentConnectionErrorsCount**  Number of non-timeout errors associated with the host/agent channel.
+- **CensusExitCode**  The last exit code of the Census task.
+- **CensusStartTime**  Time of last Census run.
+- **CensusTaskEnabled**  True if Census is enabled, false otherwise.
+- **CompressedBytesUploaded**  Number of compressed bytes uploaded.
+- **ConsumerDroppedCount**  Number of events dropped at consumer layer of telemetry client.
+- **CriticalDataDbDroppedCount**  Number of critical data sampled events dropped at the database layer.
+- **CriticalDataThrottleDroppedCount**  The number of critical data sampled events that were dropped because of throttling.
+- **CriticalOverflowEntersCounter**  Number of times critical overflow mode was entered in event DB.
+- **DbCriticalDroppedCount**  Total number of dropped critical events in event DB.
+- **DbDroppedCount**  Number of events dropped due to DB fullness.
+- **DbDroppedFailureCount**  Number of events dropped due to DB failures.
+- **DbDroppedFullCount**  Number of events dropped due to DB fullness.
+- **DecodingDroppedCount**  Number of events dropped due to decoding failures.
+- **EnteringCriticalOverflowDroppedCounter**  Number of events dropped due to critical overflow mode being initiated.
+- **EtwDroppedBufferCount**  Number of buffers dropped in the UTC ETW session.
+- **EtwDroppedCount**  Number of events dropped at ETW layer of telemetry client.
+- **EventsPersistedCount**  Number of events that reached the PersistEvent stage.
+- **EventStoreLifetimeResetCounter**  Number of times event DB was reset for the lifetime of UTC.
+- **EventStoreResetCounter**  Number of times event DB was reset.
+- **EventStoreResetSizeSum**  Total size of event DB across all resets reports in this instance.
+- **EventsUploaded**  Number of events uploaded.
+- **Flags**  Flags indicating device state such as network state, battery state, and opt-in state.
+- **FullTriggerBufferDroppedCount**  Number of events dropped due to trigger buffer being full.
+- **HeartBeatSequenceNumber**  The sequence number of this heartbeat.
+- **InvalidHttpCodeCount**  Number of invalid HTTP codes received from contacting Vortex.
+- **LastAgentConnectionError**  Last non-timeout error encountered in the host/agent channel.
+- **LastEventSizeOffender**  Event name of last event which exceeded max event size.
+- **LastInvalidHttpCode**  Last invalid HTTP code received from Vortex.
+- **MaxActiveAgentConnectionCount**  The maximum number of active agents during this heartbeat timeframe.
+- **MaxInUseScenarioCounter**  Soft maximum number of scenarios loaded by UTC.
+- **PreviousHeartBeatTime**  Time of last heartbeat event (allows chaining of events).
+- **PrivacyBlockedCount**  The number of events blocked due to privacy settings or tags.
+- **RepeatedUploadFailureDropped**  Number of events lost due to repeated upload failures for a single buffer.
+- **SettingsHttpAttempts**  Number of attempts to contact OneSettings service.
+- **SettingsHttpFailures**  The number of failures from contacting the OneSettings service.
+- **ThrottledDroppedCount**  Number of events dropped due to throttling of noisy providers.
+- **TopUploaderErrors**  List of top errors received from the upload endpoint.
+- **UploaderDroppedCount**  Number of events dropped at the uploader layer of telemetry client.
+- **UploaderErrorCount**  Number of errors received from the upload endpoint.
+- **VortexFailuresTimeout**  The number of timeout failures received from Vortex.
+- **VortexHttpAttempts**  Number of attempts to contact Vortex.
+- **VortexHttpFailures4xx**  Number of 400-499 error codes received from Vortex.
+- **VortexHttpFailures5xx**  Number of 500-599 error codes received from Vortex.
+- **VortexHttpResponseFailures**  Number of Vortex responses that are not 2XX or 400.
+- **VortexHttpResponsesWithDroppedEvents**  Number of Vortex responses containing at least 1 dropped event.
+
+
+### TelClientSynthetic.HeartBeat_Agent_5
+
+This event sends data about the health and quality of the diagnostic data from the specified device (agent), to help keep Windows up to date.
+
+The following fields are available:
+
+- **ConsumerDroppedCount**  The number of events dropped at the consumer layer of the diagnostic data collection client.
+- **ContainerBufferFullDropCount**  The number of events dropped due to the container buffer being full.
+- **ContainerBufferFullSevilleDropCount**  The number of “Seville” events dropped due to the container buffer being full.
+- **CriticalDataThrottleDroppedCount**  The number of critical data sampled events dropped due to data throttling.
+- **DecodingDroppedCount**  The number of events dropped due to decoding failures.
+- **EtwDroppedBufferCount**  The number of buffers dropped in the ETW (Event Tracing for Windows) session.
+- **EtwDroppedCount**  The number of events dropped at the ETW (Event Tracing for Windows) layer of the diagnostic data collection client on the user’s device.
+- **EventsForwardedToHost**  The number of events forwarded from agent (device) to host (server).
+- **FullTriggerBufferDroppedCount**  The number of events dropped due to the trigger buffer being full.
+- **HeartBeatSequenceNumber**  The heartbeat sequence number associated with this event.
+- **HostConnectionErrorsCount**  The number of non-timeout errors encountered in the host (server)/agent (device) socket transport channel.
+- **HostConnectionTimeoutsCount**  The number of connection timeouts between the host (server) and agent (device).
+- **LastHostConnectionError**  The last error from a connection between host (server) and agent (device).
+- **PreviousHeartBeatTime**  The timestamp of the last heartbeat event.
+- **ThrottledDroppedCount**  The number of events dropped due to throttling of “noisy” providers.
+
+
+### TelClientSynthetic.HeartBeat_DevHealthMon_5
+
+This event sends data (for Surface Hub devices) to monitor and ensure the correct functioning of those Surface Hub devices. This data helps ensure the device is up to date with the latest security and safety features.
+
+The following fields are available:
+
+- **HeartBeatSequenceNumber**  The heartbeat sequence number associated with this event.
+- **PreviousHeartBeatTime**  The timestamp of the last heartbeat event.
+
+
+### TelClientSynthetic.LifetimeManager_ConsumerBaseTimestampChange_0
+
+This event sends data when the Windows Diagnostic data collection mechanism detects a timestamp adjustment for incoming diagnostic events. This data is critical for dealing with time changes during diagnostic data analysis, to help keep the device up to date.
+
+The following fields are available:
+
+- **NewBaseTime**  The new QPC (Query Performance Counter) base time from ETW (Event Tracing for Windows).
+- **NewSystemTime**  The new system time of the device.
+- **OldSystemTime**  The previous system time of the device.
+
+
+### TelClientSynthetic.MatchEngine_ScenarioCompletionThrottled_0
+
+This event sends data when scenario completion is throttled (truncated or otherwise restricted) because the scenario is excessively large.
+
+The following fields are available:
+
+- **MaxHourlyCompletionsSetting**  The maximum number of scenario completions per hour until throttling kicks in.
+- **ScenarioId**  The globally unique identifier (GUID) of the scenario being throttled.
+- **ScenarioName**  The name of the scenario being throttled.
+
+
+### TelClientSynthetic.OsEvents_BootStatReset_0
+
+This event sends data when the Windows diagnostic data collection mechanism resets the Boot ID. This data helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **BootId**  The current Boot ID.
+- **ResetReason**  The reason code for resetting the Boot ID.
+
+
+### TelClientSynthetic.ProducerThrottled_At_TriggerBuffer_0
+
+This event sends data when a producer is throttled due to the trigger buffer exceeding defined thresholds.
+
+The following fields are available:
+
+- **BufferSize**  The size of the trigger buffer.
+- **DataType**  The type of event that this producer generates (Event Tracing for Windows, Time, Synthetic).
+- **EstSeenCount**  Estimated total number of inputs determining other “Est…” values.
+- **EstTopEvent1Count**  The count for estimated “noisiest” event from this producer.
+- **EstTopEvent1Name**  The name for estimated “noisiest” event from this producer.
+- **EstTopEvent2Count**  The count for estimated second “noisiest” event from this producer.
+- **EstTopEvent2Name**  The name for estimated second “noisiest” event from this producer.
+- **Hit**  The number of events seen from this producer.
+- **IKey**  The IKey identifier of the producer, if available.
+- **ProviderId**  The provider ID of the producer being throttled.
+- **ProviderName**  The provider name of the producer being throttled.
+- **Threshold**  The threshold crossed, which caused the throttling.
+
+
+### TelClientSynthetic.ProducerThrottled_Event_Rate_0
+
+This event sends data when an event producer is throttled by the Windows Diagnostic data collection mechanism. This data helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **EstSeenCount**  Estimated total number of inputs determining other “Est…” values.
+- **EstTopEvent1Count**  The count for estimated “noisiest” event from this producer.
+- **EstTopEvent1Name**  The name for estimated “noisiest” event from this producer.
+- **EstTopEvent2Count**  The count for estimated second “noisiest” event from this producer.
+- **EstTopEvent2Name**  The name for estimated second “noisiest” event from this producer.
+- **EventPerProviderThreshold**  The trigger point for throttling (value for each provider). This value is only applied once EventRateThreshold has been met.
+- **EventRateThreshold**  The total event rate trigger point for throttling.
+- **Hit**  The number of events seen from this producer.
+- **IKey**  The IKey identifier of the producer, if available.
+- **ProviderId**  The provider ID of the producer being throttled.
+- **ProviderName**  The provider name of the producer being throttled.
+
+
+### TelClientSynthetic.RunExeWithArgsAction_ExeTerminated_0
+
+This event sends data when an executable (EXE) file is terminated during escalation because it exceeded its maximum runtime (the maximum amount of time it was expected to run). This data helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **ExpandedExeName**  The expanded name of the executable (EXE) file.
+- **MaximumRuntimeMs**  The maximum runtime (in milliseconds) for this action.
+- **ScenarioId**  The globally unique identifier (GUID) of the scenario that was terminated.
+- **ScenarioInstanceId**  The globally unique identifier (GUID) of the scenario instance that was terminated.
+
+
+### TelClientSynthetic.RunExeWithArgsAction_ProcessReturnedNonZeroExitCode
+
+This event sends data when the RunExe process finishes during escalation, but returns a non-zero exit code. This data helps ensure Windows is up to date.
+
+The following fields are available:
+
+- **ExitCode**  The exit code of the process
+- **ExpandedExeName**  The expanded name of the executable (EXE) file.
+- **ScenarioId**  The globally unique identifier (GUID) of the escalating scenario.
+- **ScenarioInstanceId**  The globally unique identifier (GUID) of the scenario instance.
+
+
+### TelClientSynthetic.ServiceMain_DevHealthMonEvent
+
+This event is a low latency health alert that is part of the 4Nines device health monitoring feature currently available on Surface Hub devices. For a device that is opted in, this event is sent before shutdown to signal that the device is about to be powered down.
+
+
+
+## DISM events
+
+### Microsoft.Windows.StartRepairCore.DISMLatestInstalledLCU
+
+The DISM Latest Installed LCU sends information to report result of search for latest installed LCU after last successful boot.
+
+The following fields are available:
+
+- **dismInstalledLCUPackageName**  The name of the latest installed package.
+
+
+### Microsoft.Windows.StartRepairCore.DISMPendingInstall
+
+The DISM Pending Install event sends information to report pending package installation found.
+
+The following fields are available:
+
+- **dismPendingInstallPackageName**  The name of the pending package.
+
+
+### Microsoft.Windows.StartRepairCore.DISMRevertPendingActions
+
+The DISM Pending Install event sends information to report pending package installation found.
+
+The following fields are available:
+
+- **errorCode**  The result code returned by the event.
+
+
+### Microsoft.Windows.StartRepairCore.DISMUninstallLCU
+
+The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU.
+
+The following fields are available:
+
+- **errorCode**  The result code returned by the event.
+
+
+### Microsoft.Windows.StartRepairCore.SRTRepairActionEnd
+
+The DISM Uninstall LCU sends information to report result of uninstall attempt for found LCU.
+
+The following fields are available:
+
+- **errorCode**  The result code returned by the event.
+- **failedUninstallCount**  The number of driver updates that failed to uninstall.
+- **failedUninstallFlightIds**  The Flight IDs (identifiers of beta releases) of driver updates that failed to uninstall.
+- **foundDriverUpdateCount**  The number of found driver updates.
+- **srtRepairAction**  The scenario name for a repair.
+- **successfulUninstallCount**  The number of successfully uninstalled driver updates.
+- **successfulUninstallFlightIds**  The Flight IDs (identifiers of beta releases) of successfully uninstalled driver updates.
+
+
+### Microsoft.Windows.StartRepairCore.SRTRepairActionStart
+
+The SRT Repair Action Start event sends information to report repair operation started for given plug-in.
+
+The following fields are available:
+
+- **srtRepairAction**  The scenario name for a repair.
+
+
+### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagEnd
+
+The SRT Root Cause Diagnosis End event sends information to report diagnosis operation completed for given plug-in.
+
+The following fields are available:
+
+- **errorCode**  The result code returned by the event.
+- **flightIds**  The Flight IDs (identifier of the beta release) of found driver updates.
+- **foundDriverUpdateCount**  The number of found driver updates.
+- **srtRootCauseDiag**  The scenario name for a diagnosis event.
+
+
+### Microsoft.Windows.StartRepairCore.SRTRootCauseDiagStart
+
+The SRT Root Cause Diagnosis Start event sends information to report diagnosis operation started for given plug-in.
+
+The following fields are available:
+
+- **srtRootCauseDiag**  The scenario name for a diagnosis event.
+
+
+## Driver installation events
+
+### Microsoft.Windows.DriverInstall.DeviceInstall
+
+This critical event sends information about the driver installation that took place.
+
+The following fields are available:
+
+- **ClassGuid**  The unique ID for the device class.
+- **ClassLowerFilters**  The list of lower filter class drivers.
+- **ClassUpperFilters**  The list of upper filter class drivers.
+- **CoInstallers**  The list of coinstallers.
+- **ConfigFlags**  The device configuration flags.
+- **DeviceConfigured**  Indicates whether this device was configured through the kernel configuration.
+- **DeviceInstalled**  Indicates whether the legacy install code path was used.
+- **DeviceInstanceId**  The unique identifier of the device in the system.
+- **DeviceStack**  The device stack of the driver being installed.
+- **DriverDate**  The date of the driver.
+- **DriverDescription**  A description of the driver function.
+- **DriverInfName**  Name of the INF file (the setup information file) for the driver.
+- **DriverInfSectionName**  Name of the DDInstall section within the driver INF file.
+- **DriverPackageId**  The ID of the driver package that is staged to the driver store.
+- **DriverProvider**  The driver manufacturer or provider.
+- **DriverUpdated**  Indicates whether the driver is replacing an old driver.
+- **DriverVersion**  The version of the driver file.
+- **EndTime**  The time the installation completed.
+- **Error**  Provides the WIN32 error code for the installation.
+- **ExtensionDrivers**  List of extension drivers that complement this installation.
+- **FinishInstallAction**  Indicates whether the co-installer invoked the finish-install action.
+- **FinishInstallUI**  Indicates whether the installation process shows the user interface.
+- **FirmwareDate**  The firmware date that will be stored in the EFI System Resource Table (ESRT).
+- **FirmwareRevision**  The firmware revision that will be stored in the EFI System Resource Table (ESRT).
+- **FirmwareVersion**  The firmware version that will be stored in the EFI System Resource Table (ESRT).
+- **FirstHardwareId**  The ID in the hardware ID list that provides the most specific device description.
+- **FlightIds**  A list of the different Windows Insider builds on the device.
+- **GenericDriver**  Indicates whether the driver is a generic driver.
+- **Inbox**  Indicates whether the driver package is included with Windows.
+- **InstallDate**  The date the driver was installed.
+- **LastCompatibleId**  The ID in the hardware ID list that provides the least specific device description.
+- **LastInstallFunction**  The last install function invoked in a co-installer if the install timeout was reached while a co-installer was executing.
+- **LegacyInstallReasonError**  The error code for the legacy installation.
+- **LowerFilters**  The list of lower filter drivers.
+- **MatchingDeviceId**  The hardware ID or compatible ID that Windows used to install the device instance.
+- **NeedReboot**  Indicates whether the driver requires a reboot.
+- **OriginalDriverInfName**  The original name of the INF file before it was renamed.
+- **ParentDeviceInstanceId**  The device instance ID of the parent of the device.
+- **PendedUntilReboot**  Indicates whether the installation is pending until the device is rebooted.
+- **Problem**  Error code returned by the device after installation.
+- **ProblemStatus**  The status of the device after the driver installation.
+- **RebootRequiredReason**  DWORD (Double Word—32-bit unsigned integer) containing the reason why the device required a reboot during install.
+- **SecondaryDevice**  Indicates whether the device is a secondary device.
+- **ServiceName**  The service name of the driver.
+- **SessionGuid**  GUID (Globally Unique IDentifier) for the update session.
+- **SetupMode**  Indicates whether the driver installation took place before the Out Of Box Experience (OOBE) was completed.
+- **StartTime**  The time when the installation started.
+- **SubmissionId**  The driver submission identifier assigned by the Windows Hardware Development Center.
+- **UpperFilters**  The list of upper filter drivers.
+
+
+### Microsoft.Windows.DriverInstall.NewDevInstallDeviceEnd
+
+This event sends data about the driver installation once it is completed.
+
+The following fields are available:
+
+- **DeviceInstanceId**  The unique identifier of the device in the system.
+- **DriverUpdated**  Indicates whether the driver was updated.
+- **Error**  The Win32 error code of the installation.
+- **FlightId**  The ID of the Windows Insider build the device received.
+- **InstallDate**  The date the driver was installed.
+- **InstallFlags**  The driver installation flags.
+- **OptionalData**  Metadata specific to WU (Windows Update) associated with the driver (flight IDs, recovery IDs, etc.)
+- **RebootRequired**  Indicates whether a reboot is required after the installation.
+- **RollbackPossible**  Indicates whether this driver can be rolled back.
+- **WuTargetedHardwareId**  Indicates that the driver was installed because the device hardware ID was targeted by the Windows Update.
+- **WuUntargetedHardwareId**  Indicates that the driver was installed because Windows Update performed a generic driver update for all devices of that hardware class.
+
+
+### Microsoft.Windows.DriverInstall.NewDevInstallDeviceStart
+
+This event sends data about the driver that the new driver installation is replacing.
+
+The following fields are available:
+
+- **DeviceInstanceId**  The unique identifier of the device in the system.
+- **FirstInstallDate**  The first time a driver was installed on this device.
+- **LastDriverDate**  Date of the driver that is being replaced.
+- **LastDriverInbox**  Indicates whether the previous driver was included with Windows.
+- **LastDriverInfName**  Name of the INF file (the setup information file) of the driver being replaced.
+- **LastDriverVersion**  The version of the driver that is being replaced.
+- **LastFirmwareDate**  The date of the last firmware reported from the EFI System Resource Table (ESRT).
+- **LastFirmwareRevision**  The last firmware revision number reported from EFI System Resource Table (ESRT).
+- **LastFirmwareVersion**  The last firmware version reported from the EFI System Resource Table (ESRT).
+- **LastInstallDate**  The date a driver was last installed on this device.
+- **LastMatchingDeviceId**  The hardware ID or compatible ID that Windows last used to install the device instance.
+- **LastProblem**  The previous problem code that was set on the device.
+- **LastProblemStatus**  The previous problem code that was set on the device.
+- **LastSubmissionId**  The driver submission identifier of the driver that is being replaced.
+
+
+## DxgKernelTelemetry events
+
+### DxgKrnlTelemetry.GPUAdapterInventoryV2
+
+This event sends basic GPU and display driver information to keep Windows and display drivers up-to-date.
+
+The following fields are available:
+
+- **AdapterTypeValue**  The numeric value indicating the type of Graphics adapter.
+- **aiSeqId**  The event sequence ID.
+- **bootId**  The system boot ID.
+- **BrightnessVersionViaDDI**  The version of the Display Brightness Interface.
+- **ComputePreemptionLevel**  The maximum preemption level supported by GPU for compute payload.
+- **DedicatedSystemMemoryB**  The amount of system memory dedicated for GPU use (in bytes).
+- **DedicatedVideoMemoryB**  The amount of dedicated VRAM of the GPU (in bytes).
+- **Display1UMDFilePath**  File path to the location of the Display User Mode Driver in the Driver Store.
+- **DisplayAdapterLuid**  The display adapter LUID.
+- **DriverDate**  The date of the display driver.
+- **DriverRank**  The rank of the display driver.
+- **DriverVersion**  The display driver version.
+- **DriverWorkarounds**  Numeric value indicating the driver workarounds enabled for this device.
+- **DX10UMDFilePath**  The file path to the location of the DirectX 10 Display User Mode Driver in the Driver Store.
+- **DX11UMDFilePath**  The file path to the location of the DirectX 11 Display User Mode Driver in the Driver Store.
+- **DX12UMDFilePath**  The file path to the location of the DirectX 12 Display User Mode Driver in the Driver Store.
+- **DX9UMDFilePath**  The file path to the location of the DirectX 9 Display User Mode Driver in the Driver Store.
+- **GPUDeviceID**  The GPU device ID.
+- **GPUPreemptionLevel**  The maximum preemption level supported by GPU for graphics payload.
+- **GPURevisionID**  The GPU revision ID.
+- **GPUVendorID**  The GPU vendor ID.
+- **InterfaceId**  The GPU interface ID.
+- **IsDisplayDevice**  Does the GPU have displaying capabilities?
+- **IsHwSchEnabled**  Boolean value indicating whether hardware scheduling is enabled.
+- **IsHwSchSupported**  Indicates whether the adapter supports hardware scheduling.
+- **IsHybridDiscrete**  Does the GPU have discrete GPU capabilities in a hybrid device?
+- **IsHybridIntegrated**  Does the GPU have integrated GPU capabilities in a hybrid device?
+- **IsLDA**  Is the GPU comprised of Linked Display Adapters?
+- **IsMiracastSupported**  Does the GPU support Miracast?
+- **IsMismatchLDA**  Is at least one device in the Linked Display Adapters chain from a different vendor?
+- **IsMPOSupported**  Does the GPU support Multi-Plane Overlays?
+- **IsMsMiracastSupported**  Are the GPU Miracast capabilities driven by a Microsoft solution?
+- **IsPostAdapter**  Is this GPU the POST GPU in the device?
+- **IsRemovable**  TRUE if the adapter supports being disabled or removed.
+- **IsRenderDevice**  Does the GPU have rendering capabilities?
+- **IsSoftwareDevice**  Is this a software implementation of the GPU?
+- **KMDFilePath**  The file path to the location of the Display Kernel Mode Driver in the Driver Store.
+- **MeasureEnabled**  Is the device listening to MICROSOFT_KEYWORD_MEASURES?
+- **NumVidPnSources**  The number of supported display output sources.
+- **NumVidPnTargets**  The number of supported display output targets.
+- **SharedSystemMemoryB**  The amount of system memory shared by GPU and CPU (in bytes).
+- **SubSystemID**  The subsystem ID.
+- **SubVendorID**  The GPU sub vendor ID.
+- **TelemetryEnabled**  Is the device listening to MICROSOFT_KEYWORD_TELEMETRY?
+- **TelInvEvntTrigger**  What triggered this event to be logged?  Example: 0 (GPU enumeration) or 1 (DxgKrnlTelemetry provider toggling)
+- **version**  The event version.
+- **WDDMVersion**  The Windows Display Driver Model version.
+
+
+## Failover Clustering events
+
+### Microsoft.Windows.Server.FailoverClusteringCritical.ClusterSummary2
+
+This event returns information about how many resources and of what type are in the server cluster. This data is collected to keep Windows Server safe, secure, and up to date. The data includes information about whether hardware is configured correctly, if the software is patched correctly, and assists in preventing crashes by attributing issues (like fatal errors) to workloads and system configurations.
+
+The following fields are available:
+
+- **autoAssignSite**  The cluster parameter: auto site.
+- **autoBalancerLevel**  The cluster parameter: auto balancer level.
+- **autoBalancerMode**  The cluster parameter: auto balancer mode.
+- **blockCacheSize**  The configured size of the block cache.
+- **ClusterAdConfiguration**  The ad configuration of the cluster.
+- **clusterAdType**  The cluster parameter: mgmt_point_type.
+- **clusterDumpPolicy**  The cluster configured dump policy.
+- **clusterFunctionalLevel**  The current cluster functional level.
+- **clusterGuid**  The unique identifier for the cluster.
+- **clusterWitnessType**  The witness type the cluster is configured for.
+- **countNodesInSite**  The number of nodes in the cluster.
+- **crossSiteDelay**  The cluster parameter: CrossSiteDelay.
+- **crossSiteThreshold**  The cluster parameter: CrossSiteThreshold.
+- **crossSubnetDelay**  The cluster parameter: CrossSubnetDelay.
+- **crossSubnetThreshold**  The cluster parameter: CrossSubnetThreshold.
+- **csvCompatibleFilters**  The cluster parameter: ClusterCsvCompatibleFilters.
+- **csvIncompatibleFilters**  The cluster parameter: ClusterCsvIncompatibleFilters.
+- **csvResourceCount**  The number of resources in the cluster.
+- **currentNodeSite**  The name configured for the current site for the cluster.
+- **dasModeBusType**  The direct storage bus type of the storage spaces.
+- **downLevelNodeCount**  The number of nodes in the cluster that are running down-level.
+- **drainOnShutdown**  Specifies whether a node should be drained when it is shut down.
+- **dynamicQuorumEnabled**  Specifies whether dynamic Quorum has been enabled.
+- **enforcedAntiAffinity**  The cluster parameter: enforced anti affinity.
+- **genAppNames**  The win32 service name of a clustered service.
+- **genSvcNames**  The command line of a clustered genapp.
+- **hangRecoveryAction**  The cluster parameter: hang recovery action.
+- **hangTimeOut**  Specifies the “hang time out” parameter for the cluster.
+- **isCalabria**  Specifies whether storage spaces direct is enabled.
+- **isMixedMode**  Identifies if the cluster is running with different version of OS for nodes.
+- **isRunningDownLevel**  Identifies if the current node is running down-level.
+- **logLevel**  Specifies the granularity that is logged in the cluster log.
+- **logSize**  Specifies the size of the cluster log.
+- **lowerQuorumPriorityNodeId**  The cluster parameter: lower quorum priority node ID.
+- **minNeverPreempt**  The cluster parameter: minimum never preempt.
+- **minPreemptor**  The cluster parameter: minimum preemptor priority.
+- **netftIpsecEnabled**  The parameter: netftIpsecEnabled.
+- **NodeCount**  The number of nodes in the cluster.
+- **nodeId**  The current node number in the cluster.
+- **nodeResourceCounts**  Specifies the number of node resources.
+- **nodeResourceOnlineCounts**  Specifies the number of node resources that are online.
+- **numberOfSites**  The number of different sites.
+- **numNodesInNoSite**  The number of nodes not belonging to a site.
+- **plumbAllCrossSubnetRoutes**  The cluster parameter: plumb all cross subnet routes.
+- **preferredSite**  The preferred site location.
+- **privateCloudWitness**  Specifies whether a private cloud witness exists for this cluster.
+- **quarantineDuration**  The quarantine duration.
+- **quarantineThreshold**  The quarantine threshold.
+- **quorumArbitrationTimeout**  In the event of an arbitration event, this specifies the quorum timeout period.
+- **resiliencyLevel**  Specifies the level of resiliency.
+- **resourceCounts**  Specifies the number of resources.
+- **resourceTypeCounts**  Specifies the number of resource types in the cluster.
+- **resourceTypes**  Data representative of each resource type.
+- **resourceTypesPath**  Data representative of the DLL path for each resource type.
+- **sameSubnetDelay**  The cluster parameter: same subnet delay.
+- **sameSubnetThreshold**  The cluster parameter: same subnet threshold.
+- **secondsInMixedMode**  The amount of time (in seconds) that the cluster has been in mixed mode (nodes with different operating system versions in the same cluster).
+- **securityLevel**  The cluster parameter: security level.
+- **securityLevelForStorage**  The cluster parameter: security level for storage.
+- **sharedVolumeBlockCacheSize**  Specifies the block cache size for shared for shared volumes.
+- **shutdownTimeoutMinutes**  Specifies the amount of time it takes to time out when shutting down.
+- **upNodeCount**  Specifies the number of nodes that are up (online).
+- **useClientAccessNetworksForCsv**  The cluster parameter: use client access networks for CSV.
+- **vmIsolationTime**  The cluster parameter: VM isolation time.
+- **witnessDatabaseWriteTimeout**  Specifies the timeout period for writing to the quorum witness database.
+
+
+## Fault Reporting events
+
+### Microsoft.Windows.FaultReporting.AppCrashEvent
+
+This event sends data about crashes for both native and managed applications, to help keep Windows up to date. The data includes information about the crashing process and a summary of its exception record. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the crash to the Watson service, and the WER event will contain the same ReportID (see field 14 of crash event, field 19 of WER event) as the crash event for the crash being reported. AppCrash is emitted once for each crash handled by WER (e.g. from an unhandled exception or FailFast or ReportException). Note that Generic Watson event types (e.g. from PLM) that may be considered crashes\" by a user DO NOT emit this event.
+
+The following fields are available:
+
+- **AppName**  The name of the app that has crashed.
+- **AppSessionGuid**  GUID made up of process ID and is used as a correlation vector for process instances in the telemetry backend.
+- **AppTimeStamp**  The date/time stamp of the app.
+- **AppVersion**  The version of the app that has crashed.
+- **ExceptionCode**  The exception code returned by the process that has crashed.
+- **ExceptionOffset**  The address where the exception had occurred.
+- **Flags**  Flags indicating how reporting is done. For example, queue the report, do not offer JIT debugging, or do not terminate the process after reporting.
+- **FriendlyAppName**  The description of the app that has crashed, if different from the AppName. Otherwise, the process name.
+- **IsFatal**  True/False to indicate whether the crash resulted in process termination.
+- **ModName**  Exception module name (e.g. bar.dll).
+- **ModTimeStamp**  The date/time stamp of the module.
+- **ModVersion**  The version of the module that has crashed.
+- **PackageFullName**  Store application identity.
+- **PackageRelativeAppId**  Store application identity.
+- **ProcessArchitecture**  Architecture of the crashing process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64.
+- **ProcessCreateTime**  The time of creation of the process that has crashed.
+- **ProcessId**  The ID of the process that has crashed.
+- **ReportId**  A GUID used to identify the report. This can used to track the report across Watson.
+- **TargetAppId**  The kernel reported AppId of the application being reported.
+- **TargetAppVer**  The specific version of the application being reported
+- **TargetAsId**  The sequence number for the hanging process.
+
+
+## Feature update events
+
+### Microsoft.Windows.Upgrade.Uninstall.UninstallFailed
+
+This event sends diagnostic data about failures when uninstalling a feature update, to help resolve any issues preventing customers from reverting to a known state.
+
+The following fields are available:
+
+- **failureReason**  Provides data about the uninstall initialization operation failure.
+- **hr**  Provides the Win32 error code for the operation failure.
+
+
+### Microsoft.Windows.Upgrade.Uninstall.UninstallFinalizedAndRebootTriggered
+
+This event indicates that the uninstall was properly configured and that a system reboot was initiated.
+
+
+
+## Hang Reporting events
+
+### Microsoft.Windows.HangReporting.AppHangEvent
+
+This event sends data about hangs for both native and managed applications, to help keep Windows up to date. It does not contain any Watson bucketing information. The bucketing information is recorded in a Windows Error Reporting (WER) event that is generated when the WER client reports the hang to the Watson service, and the WER event will contain the same ReportID (see field 13 of hang event, field 19 of WER event) as the hang event for the hang being reported. AppHang is reported only on PC devices. It handles classic Win32 hangs and is emitted only once per report. Some behaviors that may be perceived by a user as a hang are reported by app managers (e.g. PLM/RM/EM) as Watson Generics and will not produce AppHang events.
+
+The following fields are available:
+
+- **AppName**  The name of the app that has hung.
+- **AppSessionGuid**  GUID made up of process id used as a correlation vector for process instances in the telemetry backend.
+- **AppVersion**  The version of the app that has hung.
+- **IsFatal**  True/False based on whether the hung application caused the creation of a Fatal Hang Report.
+- **PackageFullName**  Store application identity.
+- **PackageRelativeAppId**  Store application identity.
+- **ProcessArchitecture**  Architecture of the hung process, as one of the PROCESSOR_ARCHITECTURE_* constants: 0: PROCESSOR_ARCHITECTURE_INTEL. 5: PROCESSOR_ARCHITECTURE_ARM. 9: PROCESSOR_ARCHITECTURE_AMD64. 12: PROCESSOR_ARCHITECTURE_ARM64.
+- **ProcessCreateTime**  The time of creation of the process that has hung.
+- **ProcessId**  The ID of the process that has hung.
+- **ReportId**  A GUID used to identify the report. This can used to track the report across Watson.
+- **TargetAppId**  The kernel reported AppId of the application being reported.
+- **TargetAppVer**  The specific version of the application being reported.
+- **TargetAsId**  The sequence number for the hanging process.
+- **TypeCode**  Bitmap describing the hang type.
+- **WaitingOnAppName**  If this is a cross process hang waiting for an application, this has the name of the application.
+- **WaitingOnAppVersion**  If this is a cross process hang, this has the version of the application for which it is waiting.
+- **WaitingOnPackageFullName**  If this is a cross process hang waiting for a package, this has the full name of the package for which it is waiting.
+- **WaitingOnPackageRelativeAppId**  If this is a cross process hang waiting for a package, this has the relative application id of the package.
+
+
+## Holographic events
+
+### Microsoft.Windows.Analog.Spectrum.TelemetryHolographicDeviceAdded
+
+This event indicates Windows Mixed Reality device state. This event is also used to count WMR device.
+
+The following fields are available:
+
+- **ClassGuid**  Windows Mixed Reality device class GUID.
+- **DeviceInterfaceId**  Windows Mixed Reality device interface ID.
+- **DeviceName**  Windows Mixed Reality device name.
+- **DriverVersion**  Windows Mixed Reality device driver version.
+- **FirmwareVersion**  Windows Mixed Reality firmware version.
+- **Manufacturer**  Windows Mixed Reality device manufacturer.
+- **ModelName**  Windows Mixed Reality device model name.
+- **SerialNumber**  Windows Mixed Reality device serial number.
+
+### Microsoft.Windows.Holographic.Coordinator.HoloShellStateUpdated
+
+This event indicates Windows Mixed Reality HoloShell State. This event is also used to count WMR device.
+
+The following fields are available:
+
+- **HmdState**  Windows Mixed Reality Headset HMD state.
+- **NewHoloShellState**  Windows Mixed Reality HoloShell state.
+- **PriorHoloShellState**  Windows Mixed Reality state prior to entering to HoloShell.
+- **SimulationEnabled**  Windows Mixed Reality Simulation state.
+
+
+### Microsoft.Windows.Shell.HolographicFirstRun.AppActivated
+
+This event indicates Windows Mixed Reality Portal app activation state. This event also used to count WMR device.
+
+The following fields are available:
+
+- **IsDemoMode**  Windows Mixed Reality Portal app state of demo mode.
+- **IsDeviceSetupComplete**  Windows Mixed Reality Portal app state of device setup completion.
+- **PackageVersion**  Windows Mixed Reality Portal app package version.
+- **PreviousExecutionState**  Windows Mixed Reality Portal app prior execution state.
+- **wilActivity**  Windows Mixed Reality Portal app wilActivity ID. See [wilActivity](#wilactivity).
+
+
+### Microsoft.Windows.Shell.HolographicFirstRun.AppLifecycleService_Resuming
+
+This event indicates Windows Mixed Reality Portal app resuming. This event is also used to count WMR device.
+
+
+
+### TraceLoggingOasisUsbHostApiProvider.DeviceInformation
+
+This event provides Windows Mixed Reality device information. This event is also used to count WMR device and device type.
+
+The following fields are available:
+
+- **BootloaderMajorVer**  Windows Mixed Reality device boot loader major version.
+- **BootloaderMinorVer**  Windows Mixed Reality device boot loader minor version.
+- **BootloaderRevisionNumber**  Windows Mixed Reality device boot loader revision number.
+- **BTHFWMajorVer**  Windows Mixed Reality device BTHFW major version. This event also used to count WMR device.
+- **BTHFWMinorVer**  Windows Mixed Reality device BTHFW minor version. This event also used to count WMR device.
+- **BTHFWRevisionNumber**  Windows Mixed Reality device BTHFW revision number.
+- **CalibrationBlobSize**  Windows Mixed Reality device calibration blob size.
+- **CalibrationFwMajorVer**  Windows Mixed Reality device calibration firmware major version.
+- **CalibrationFwMinorVer**  Windows Mixed Reality device calibration firmware minor version.
+- **CalibrationFwRevNum**  Windows Mixed Reality device calibration firmware revision number.
+- **DeviceInfoFlags**  Windows Mixed Reality device info flags.
+- **DeviceName**  Windows Mixed Reality device Name. This event is also used to count WMR device.
+- **DeviceReleaseNumber**  Windows Mixed Reality device release number.
+- **FirmwareMajorVer**  Windows Mixed Reality device firmware major version.
+- **FirmwareMinorVer**  Windows Mixed Reality device firmware minor version.
+- **FirmwareRevisionNumber**  Windows Mixed Reality device calibration firmware revision number.
+- **FpgaFwMajorVer**  Windows Mixed Reality device FPGA firmware major version.
+- **FpgaFwMinorVer**  Windows Mixed Reality device FPGA firmware minor version.
+- **FpgaFwRevisionNumber**  Windows Mixed Reality device FPGA firmware revision number.
+- **FriendlyName**  Windows Mixed Reality device friendly name.
+- **HashedSerialNumber**  Windows Mixed Reality device hashed serial number.
+- **HeaderSize**  Windows Mixed Reality device header size.
+- **HeaderVersion**  Windows Mixed Reality device header version.
+- **LicenseKey**  Windows Mixed Reality device header license key.
+- **Make**  Windows Mixed Reality device make.
+- **ManufacturingDate**  Windows Mixed Reality device manufacturing date.
+- **Model**  Windows Mixed Reality device model.
+- **PresenceSensorHidVendorPage**  Windows Mixed Reality device presence sensor HID vendor page.
+- **PresenceSensorHidVendorUsage**  Windows Mixed Reality device presence sensor HID vendor usage.
+- **PresenceSensorUsbVid**  Windows Mixed Reality device presence sensor USB VId.
+- **ProductBoardRevision**  Windows Mixed Reality device product board revision number.
+- **SerialNumber**  Windows Mixed Reality device serial number.
+
+
+## Inventory events
+
+### Microsoft.Windows.Inventory.Core.AmiTelCacheChecksum
+
+This event captures basic checksum data about the device inventory items stored in the cache for use in validating data completeness for Microsoft.Windows.Inventory.Core events. The fields in this event may change over time, but they will always represent a count of a given object.
+
+The following fields are available:
+
+- **Device**  A count of device objects in cache.
+- **DeviceCensus**  A count of device census objects in cache.
+- **DriverPackageExtended**  A count of driverpackageextended objects in cache.
+- **File**  A count of file objects in cache.
+- **FileSigningInfo**  A count of file signing objects in cache.
+- **Generic**  A count of generic objects in cache.
+- **HwItem**  A count of hwitem objects in cache.
+- **InventoryApplication**  A count of application objects in cache.
+- **InventoryApplicationAppV**  A count of application AppV objects in cache.
+- **InventoryApplicationDriver**  A count of application driver objects in cache
+- **InventoryApplicationFile**  A count of application file objects in cache.
+- **InventoryApplicationFramework**  A count of application framework objects in cache
+- **InventoryApplicationShortcut**  A count of application shortcut objects in cache
+- **InventoryDeviceContainer**  A count of device container objects in cache.
+- **InventoryDeviceInterface**  A count of Plug and Play device interface objects in cache.
+- **InventoryDeviceMediaClass**  A count of device media objects in cache.
+- **InventoryDevicePnp**  A count of device Plug and Play objects in cache.
+- **InventoryDeviceUsbHubClass**  A count of device usb objects in cache
+- **InventoryDriverBinary**  A count of driver binary objects in cache.
+- **InventoryDriverPackage**  A count of device objects in cache.
+- **InventoryMiscellaneousOfficeAddIn**  A count of office add-in objects in cache
+- **InventoryMiscellaneousOfficeAddInUsage**  A count of office add-in usage objects in cache.
+- **InventoryMiscellaneousOfficeIdentifiers**  A count of office identifier objects in cache
+- **InventoryMiscellaneousOfficeIESettings**  A count of office ie settings objects in cache
+- **InventoryMiscellaneousOfficeInsights**  A count of office insights objects in cache
+- **InventoryMiscellaneousOfficeProducts**  A count of office products objects in cache
+- **InventoryMiscellaneousOfficeSettings**  A count of office settings objects in cache
+- **InventoryMiscellaneousOfficeVBA**  A count of office vba objects in cache
+- **InventoryMiscellaneousOfficeVBARuleViolations**  A count of office vba rule violations objects in cache
+- **InventoryMiscellaneousUUPInfo**  A count of uup info objects in cache
+- **InventoryVersion**  The version of the inventory file generating the events.
+- **Metadata**  A count of metadata objects in cache.
+- **Orphan**  A count of orphan file objects in cache.
+- **Programs**  A count of program objects in cache.
+
+
+### Microsoft.Windows.Inventory.Core.AmiTelCacheVersions
+
+This event sends inventory component versions for the Device Inventory data.
+
+The following fields are available:
+
+- **aeinv**  The version of the App inventory component.
+- **devinv**  The file version of the Device inventory component.
+
+
+### Microsoft.Windows.Inventory.Core.FileSigningInfoAdd
+
+This event enumerates the signatures of files, either driver packages or application executables. For driver packages, this data is collected on demand via Telecommand to limit it only to unrecognized driver packages, saving time for the client and space on the server. For applications, this data is collected for up to 10 random executables on a system.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **CatalogSigners**  Signers from catalog. Each signer starts with Chain.
+- **DigestAlgorithm**  The pseudonymizing (hashing) algorithm used when the file or package was signed.
+- **DriverPackageStrongName**  Optional. Available only if FileSigningInfo is collected on a driver package.
+- **EmbeddedSigners**  Embedded signers. Each signer starts with Chain.
+- **FileName**  The file name of the file whose signatures are listed.
+- **FileType**  Either exe or sys, depending on if a driver package or application executable.
+- **InventoryVersion**  The version of the inventory file generating the events.
+- **Thumbprint**  Comma separated hash of the leaf node of each signer. Semicolon is used to separate CatalogSigners from EmbeddedSigners. There will always be a trailing comma.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationAdd
+
+This event sends basic metadata about an application on the system to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **HiddenArp**  Indicates whether a program hides itself from showing up in ARP.
+- **InstallDate**  The date the application was installed (a best guess based on folder creation date heuristics).
+- **InstallDateArpLastModified**  The date of the registry ARP key for a given application. Hints at install date but not always accurate. Passed as an array. Example: 4/11/2015  00:00:00
+- **InstallDateFromLinkFile**  The estimated date of install based on the links to the files.  Passed as an array.
+- **InstallDateMsi**  The install date if the application was installed via Microsoft Installer (MSI). Passed as an array.
+- **InventoryVersion**  The version of the inventory file generating the events.
+- **Language**  The language code of the program.
+- **MsiPackageCode**  A GUID that describes the MSI Package. Multiple 'Products' (apps) can make up an MsiPackage.
+- **MsiProductCode**  A GUID that describe the MSI Product.
+- **Name**  The name of the application.
+- **OSVersionAtInstallTime**  The four octets from the OS version at the time of the application's install.
+- **PackageFullName**  The package full name for a Store application.
+- **ProgramInstanceId**  A hash of the file IDs in an app.
+- **Publisher**  The Publisher of the application. Location pulled from depends on the 'Source' field.
+- **RootDirPath**  The path to the root directory where the program was installed.
+- **Source**  How the program was installed (for example, ARP, MSI, Appx).
+- **StoreAppType**  A sub-classification for the type of Microsoft Store app, such as UWP or Win8StoreApp.
+- **Type**  One of ("Application", "Hotfix", "BOE", "Service", "Unknown"). Application indicates Win32 or Appx app, Hotfix indicates app updates (KBs), BOE indicates it's an app with no ARP or MSI entry, Service indicates that it is a service. Application and BOE are the ones most likely seen.
+- **Version**  The version number of the program.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverAdd
+
+This event represents what drivers an application installs.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory component
+- **ProgramIds**  The unique program identifier the driver is associated with
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationDriverStartSync
+
+The InventoryApplicationDriverStartSync event indicates that a new set of InventoryApplicationDriverStartAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory component.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationFileAdd
+
+This event provides file-level information about the applications that exist on the system. This event is used to understand the applications on a device to determine if those applications will experience compatibility issues when upgrading Windows.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **BinaryType**  The architecture of the binary (executable) file.
+- **BinFileVersion**  Version information for the binary (executable) file.
+- **BinProductVersion**  The product version provided by the binary (executable) file.
+- **BoeProgramId**  The “bag of evidence” program identifier.
+- **CompanyName**  The company name included in the binary (executable) file.
+- **FileId**  A pseudonymized (hashed) unique identifier derived from the file itself.
+- **FileVersion**  The version of the file.
+- **InventoryVersion**  The version of the inventory component.
+- **Language**  The language declared in the binary (executable) file.
+- **LinkDate**  The compiler link date.
+- **LowerCaseLongPath**  The file path in “long” format.
+- **Name**  The file name.
+- **ProductName**  The product name declared in the binary (executable) file.
+- **ProductVersion**  The product version declared in the binary (executable) file.
+- **ProgramId**  The program identifier associated with the binary (executable) file.
+- **Size**  The size of the binary (executable) file.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkAdd
+
+This event provides the basic metadata about the frameworks an application may depend on.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **FileId**  A hash that uniquely identifies a file.
+- **Frameworks**  The list of frameworks this file depends on.
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationFrameworkStartSync
+
+This event indicates that a new set of InventoryApplicationFrameworkAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationRemove
+
+This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryApplicationStartSync
+
+This event indicates that a new set of InventoryApplicationAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerAdd
+
+This event sends basic metadata about a device container (such as a monitor or printer as opposed to a Plug and Play device) to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **Categories**  A comma separated list of functional categories in which the container belongs.
+- **DiscoveryMethod**  The discovery method for the device container.
+- **FriendlyName**  The name of the device container.
+- **InventoryVersion**  The version of the inventory file generating the events.
+- **IsActive**  Is the device connected, or has it been seen in the last 14 days?
+- **IsConnected**  For a physically attached device, this value is the same as IsPresent. For wireless a device, this value represents a communication link.
+- **IsMachineContainer**  Is the container the root device itself?
+- **IsNetworked**  Is this a networked device?
+- **IsPaired**  Does the device container require pairing?
+- **Manufacturer**  The manufacturer name for the device container.
+- **ModelId**  A unique model ID.
+- **ModelName**  The model name.
+- **ModelNumber**  The model number for the device container.
+- **PrimaryCategory**  The primary category for the device container.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerRemove
+
+This event indicates that the InventoryDeviceContainer object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceContainerStartSync
+
+This event indicates that a new set of InventoryDeviceContainerAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceAdd
+
+This event retrieves information about what sensor interfaces are available on the device.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **Accelerometer3D**  Indicates if an Accelerator3D sensor is found.
+- **ActivityDetection**  Indicates if an Activity Detection sensor is found.
+- **AmbientLight**  Indicates if an Ambient Light sensor is found.
+- **Barometer**  Indicates if a Barometer sensor is found.
+- **Custom**  Indicates if a Custom sensor is found.
+- **EnergyMeter**  Indicates if an Energy sensor is found.
+- **FloorElevation**  Indicates if a Floor Elevation sensor is found.
+- **GeomagneticOrientation**  Indicates if a Geo Magnetic Orientation sensor is found.
+- **GravityVector**  Indicates if a Gravity Detector sensor is found.
+- **Gyrometer3D**  Indicates if a Gyrometer3D sensor is found.
+- **Humidity**  Indicates if a Humidity sensor is found.
+- **InventoryVersion**  The version of the inventory file generating the events.
+- **LinearAccelerometer**  Indicates if a Linear Accelerometer sensor is found.
+- **Magnetometer3D**  Indicates if a Magnetometer3D sensor is found.
+- **Orientation**  Indicates if an Orientation sensor is found.
+- **Pedometer**  Indicates if a Pedometer sensor is found.
+- **Proximity**  Indicates if a Proximity sensor is found.
+- **RelativeOrientation**  Indicates if a Relative Orientation sensor is found.
+- **SimpleDeviceOrientation**  Indicates if a Simple Device Orientation sensor is found.
+- **Temperature**  Indicates if a Temperature sensor is found.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceInterfaceStartSync
+
+This event indicates that a new set of InventoryDeviceInterfaceAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassAdd
+
+This event sends additional metadata about a Plug and Play device that is specific to a particular class of devices to help keep Windows up to date while reducing overall size of data payload.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **Audio.CaptureDriver**  The capture driver endpoint for the audio device.
+- **Audio.RenderDriver**  The render driver for the audio device.
+- **Audio_CaptureDriver**  The Audio device capture driver endpoint.
+- **Audio_RenderDriver**  The Audio device render driver endpoint.
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassRemove
+
+This event indicates that the InventoryDeviceMediaClassRemove object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceMediaClassStartSync
+
+This event indicates that a new set of InventoryDeviceMediaClassSAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDevicePnpAdd
+
+This event sends basic metadata about a PNP device and its associated driver to help keep Windows up to date. This information is used to assess if the PNP device and driver will remain compatible when upgrading Windows.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **BusReportedDescription**  The description of the device reported by the bux.
+- **Class**  The device setup class of the driver loaded for the device.
+- **ClassGuid**  The device class GUID from the driver package
+- **COMPID**  The device setup class guid of the driver loaded for the device.
+- **ContainerId**  The list of compat ids for the device.
+- **Description**  System-supplied GUID that uniquely groups the functional devices associated with a single-function or multifunction device installed in the computer.
+- **DeviceDriverFlightId**  The test build (Flight) identifier of the device driver.
+- **DeviceExtDriversFlightIds**  The test build (Flight) identifier for all extended device drivers.
+- **DeviceInterfaceClasses**  The device interfaces that this device implements.
+- **DeviceState**  The device description.
+- **DriverId**  DeviceState is a bitmask of the following: DEVICE_IS_CONNECTED 0x0001 (currently only for container). DEVICE_IS_NETWORK_DEVICE 0x0002 (currently only for container). DEVICE_IS_PAIRED 0x0004 (currently only for container). DEVICE_IS_ACTIVE 0x0008 (currently never set). DEVICE_IS_MACHINE 0x0010 (currently only for container). DEVICE_IS_PRESENT 0x0020 (currently always set). DEVICE_IS_HIDDEN 0x0040. DEVICE_IS_PRINTER 0x0080 (currently only for container). DEVICE_IS_WIRELESS 0x0100. DEVICE_IS_WIRELESS_FAT 0x0200. The most common values are therefore: 32 (0x20)= device is present. 96 (0x60)= device is present but hidden. 288 (0x120)= device is a wireless device that is present
+- **DriverName**  A unique identifier for the driver installed.
+- **DriverPackageStrongName**  The immediate parent directory name in the Directory field of InventoryDriverPackage
+- **DriverVerDate**  Name of the .sys image file (or wudfrd.sys if using user mode driver framework).
+- **DriverVerVersion**  The immediate parent directory name in the Directory field of InventoryDriverPackage.
+- **Enumerator**  The date of the driver loaded for the device.
+- **ExtendedInfs**  The extended INF file names.
+- **FirstInstallDate**  The first time this device was installed on the machine.
+- **HWID**  The version of the driver loaded for the device.
+- **Inf**  The bus that enumerated the device.
+- **InstallDate**  The date of the most recent installation of the device on the machine.
+- **InstallState**  The device installation state.  One of these values: https://msdn.microsoft.com/library/windows/hardware/ff543130.aspx
+- **InventoryVersion**  List of hardware ids for the device.
+- **LowerClassFilters**  Lower filter class drivers IDs installed for the device
+- **LowerFilters**  Lower filter drivers IDs installed for the device
+- **Manufacturer**  INF file name (the name could be renamed by OS, such as oemXX.inf)
+- **MatchingID**  Device installation state.
+- **Model**  The version of the inventory binary generating the events.
+- **ParentId**  Lower filter class drivers IDs installed for the device.
+- **ProblemCode**  Lower filter drivers IDs installed for the device.
+- **Provider**  The device manufacturer.
+- **Service**  The device service name
+- **STACKID**  Represents the hardware ID or compatible ID that Windows uses to install a device instance.
+- **UpperClassFilters**  Upper filter drivers IDs installed for the device
+- **UpperFilters**  The device model.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDevicePnpRemove
+
+This event indicates that the InventoryDevicePnpRemove object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDevicePnpStartSync
+
+This event indicates that a new set of InventoryDevicePnpAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassAdd
+
+This event sends basic metadata about the USB hubs on the device.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+- **TotalUserConnectablePorts**  Total number of connectable USB ports.
+- **TotalUserConnectableTypeCPorts**  Total number of connectable USB Type C ports.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDeviceUsbHubClassStartSync
+
+This event indicates that a new set of InventoryDeviceUsbHubClassAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryAdd
+
+This event provides the basic metadata about driver binaries running on the system.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **DriverCheckSum**  The checksum of the driver file.
+- **DriverCompany**  The company name that developed the driver.
+- **DriverInBox**  Is the driver included with the operating system?
+- **DriverIsKernelMode**  Is it a kernel mode driver?
+- **DriverName**  The file name of the driver.
+- **DriverPackageStrongName**  The strong name of the driver package
+- **DriverSigned**  The strong name of the driver package
+- **DriverTimeStamp**  The low 32 bits of the time stamp of the driver file.
+- **DriverType**  A bitfield of driver attributes: 1. define DRIVER_MAP_DRIVER_TYPE_PRINTER 0x0001. 2. define DRIVER_MAP_DRIVER_TYPE_KERNEL 0x0002. 3. define DRIVER_MAP_DRIVER_TYPE_USER 0x0004. 4. define DRIVER_MAP_DRIVER_IS_SIGNED 0x0008. 5. define DRIVER_MAP_DRIVER_IS_INBOX 0x0010. 6. define DRIVER_MAP_DRIVER_IS_WINQUAL 0x0040. 7. define DRIVER_MAP_DRIVER_IS_SELF_SIGNED 0x0020. 8. define DRIVER_MAP_DRIVER_IS_CI_SIGNED 0x0080. 9. define DRIVER_MAP_DRIVER_HAS_BOOT_SERVICE 0x0100. 10. define DRIVER_MAP_DRIVER_TYPE_I386 0x10000. 11. define DRIVER_MAP_DRIVER_TYPE_IA64 0x20000. 12. define DRIVER_MAP_DRIVER_TYPE_AMD64 0x40000. 13. define DRIVER_MAP_DRIVER_TYPE_ARM 0x100000. 14. define DRIVER_MAP_DRIVER_TYPE_THUMB 0x200000. 15. define DRIVER_MAP_DRIVER_TYPE_ARMNT 0x400000. 16. define DRIVER_MAP_DRIVER_IS_TIME_STAMPED 0x800000.
+- **DriverVersion**  The version of the driver file.
+- **ImageSize**  The size of the driver file.
+- **Inf**  The name of the INF file.
+- **InventoryVersion**  The version of the inventory file generating the events.
+- **Product**  The product name that is included in the driver file.
+- **ProductVersion**  The product version that is included in the driver file.
+- **Service**  The name of the service that is installed for the device.
+- **WdfVersion**  The Windows Driver Framework version.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryRemove
+
+This event indicates that the InventoryDriverBinary object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverBinaryStartSync
+
+This event indicates that a new set of InventoryDriverBinaryAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverPackageAdd
+
+This event sends basic metadata about drive packages installed on the system  to help keep Windows up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **Class**  The class name for the device driver.
+- **ClassGuid**  The class GUID for the device driver.
+- **Date**  The driver package date.
+- **Directory**  The path to the driver package.
+- **DriverInBox**  Is the driver included with the operating system?
+- **Inf**  The INF name of the driver package.
+- **InventoryVersion**  The version of the inventory file generating the events.
+- **Provider**  The provider for the driver package.
+- **SubmissionId**  The HLK submission ID for the driver package.
+- **Version**  The version of the driver package.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverPackageRemove
+
+This event indicates that the InventoryDriverPackageRemove object is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.InventoryDriverPackageStartSync
+
+This event indicates that a new set of InventoryDriverPackageAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory file generating the events.
+
+
+### Microsoft.Windows.Inventory.Core.StartUtcJsonTrace
+
+This event collects traces of all other Core events, not used in typical customer scenarios. This event signals the beginning of the event download, and that tracing should begin.
+
+The following fields are available:
+
+- **key**  The globally unique identifier (GUID) used to identify the specific Json Trace logging session.
+
+
+### Microsoft.Windows.Inventory.Core.StopUtcJsonTrace
+
+This event collects traces of all other Core events, not used in typical customer scenarios. This event signals the end of the event download, and that tracing should end.
+
+The following fields are available:
+
+- **key**  The globally unique identifier (GUID) used to identify the specific Json Trace logging session.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInAdd
+
+Provides data on the installed Office Add-ins.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **AddinCLSID**  The class identifier key for the Microsoft Office add-in.
+- **AddInId**  The identifier for the Microsoft Office add-in.
+- **AddinType**  The type of the Microsoft Office add-in.
+- **BinFileTimestamp**  The timestamp of the Office add-in.
+- **BinFileVersion**  The version of the Microsoft Office add-in.
+- **Description**  Description of the Microsoft Office add-in.
+- **FileId**  The file identifier of the Microsoft Office add-in.
+- **FileSize**  The file size of the Microsoft Office add-in.
+- **FriendlyName**  The friendly name for the Microsoft Office add-in.
+- **FullPath**  The full path to the Microsoft Office add-in.
+- **InventoryVersion**  The version of the inventory binary generating the events.
+- **LoadBehavior**  Integer that describes the load behavior.
+- **LoadTime**  Load time for the Office add-in.
+- **OfficeApplication**  The Microsoft Office application associated with the add-in.
+- **OfficeArchitecture**  The architecture of the add-in.
+- **OfficeVersion**  The Microsoft Office version for this add-in.
+- **OutlookCrashingAddin**  Indicates whether crashes have been found for this add-in.
+- **ProductCompany**  The name of the company associated with the Office add-in.
+- **ProductName**  The product name associated with the Microsoft Office add-in.
+- **ProductVersion**  The version associated with the Office add-in.
+- **ProgramId**  The unique program identifier of the Microsoft Office add-in.
+- **Provider**  Name of the provider for this add-in.
+- **Usage**  Data about usage for the add-in.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInRemove
+
+Indicates that this particular data object represented by the objectInstanceId is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeAddInStartSync
+
+This event indicates that a new sync is being generated for this object type.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersAdd
+
+Provides data on the Office identifiers.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+- **OAudienceData**  Sub-identifier for Microsoft Office release management, identifying the pilot group for a device
+- **OAudienceId**  Microsoft Office identifier for Microsoft Office release management, identifying the pilot group for a device
+- **OMID**  Identifier for the Office SQM Machine
+- **OPlatform**  Whether the installed Microsoft Office product is 32-bit or 64-bit
+- **OTenantId**  Unique GUID representing the Microsoft O365 Tenant
+- **OVersion**  Installed version of Microsoft Office. For example, 16.0.8602.1000
+- **OWowMID**  Legacy Microsoft Office telemetry identifier (SQM Machine ID) for WoW systems (32-bit Microsoft Office on 64-bit Windows)
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIdentifiersStartSync
+
+Diagnostic event to indicate a new sync is being generated for this object type.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsAdd
+
+Provides data on Office-related Internet Explorer features.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+- **OIeFeatureAddon**  Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_ADDON_MANAGEMENT feature lets applications hosting the WebBrowser Control to respect add-on management selections made using the Add-on Manager feature of Internet Explorer. Add-ons disabled by the user or by administrative group policy will also be disabled in applications that enable this feature.
+- **OIeMachineLockdown**  Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_LOCALMACHINE_LOCKDOWN feature is enabled, Internet Explorer applies security restrictions on content loaded from the user's local machine, which helps prevent malicious behavior involving local files.
+- **OIeMimeHandling**  Flag indicating which Microsoft Office products have this setting enabled. When the FEATURE_MIME_HANDLING feature control is enabled, Internet Explorer handles MIME types more securely. Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2)
+- **OIeMimeSniffing**  Flag indicating which Microsoft Office products have this setting enabled. Determines a file's type by examining its bit signature. Windows Internet Explorer uses this information to determine how to render the file. The FEATURE_MIME_SNIFFING feature, when enabled, allows to be set differently for each security zone by using the URLACTION_FEATURE_MIME_SNIFFING URL action flag
+- **OIeNoAxInstall**  Flag indicating which Microsoft Office products have this setting enabled. When a webpage attempts to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request. When a webpage tries to load or install an ActiveX control that isn't already installed, the FEATURE_RESTRICT_ACTIVEXINSTALL feature blocks the request
+- **OIeNoDownload**  Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_RESTRICT_FILEDOWNLOAD feature blocks file download requests that navigate to a resource, that display a file download dialog box, or that are not initiated explicitly by a user action (for example, a mouse click or key press). Only applies to Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2)
+- **OIeObjectCaching**  Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_OBJECT_CACHING feature prevents webpages from accessing or instantiating ActiveX controls cached from different domains or security contexts
+- **OIePasswordDisable**  Flag indicating which Microsoft Office products have this setting enabled. After Windows Internet Explorer 6 for Windows XP Service Pack 2 (SP2), Internet Explorer no longer allows usernames and passwords to be specified in URLs that use the HTTP or HTTPS protocols. URLs using other protocols, such as FTP, still allow usernames and passwords
+- **OIeSafeBind**  Flag indicating which Microsoft Office products have this setting enabled.  The FEATURE_SAFE_BINDTOOBJECT feature performs additional safety checks when calling MonikerBindToObject to create and initialize Microsoft ActiveX controls. Specifically, prevent the control from being created if COMPAT_EVIL_DONT_LOAD is in the registry for the control
+- **OIeSecurityBand**  Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_SECURITYBAND feature controls the display of the Internet Explorer Information bar. When enabled, the Information bar appears when file download or code installation is restricted
+- **OIeUncSaveCheck**  Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_UNC_SAVEDFILECHECK feature enables the Mark of the Web (MOTW) for local files loaded from network locations that have been shared by using the Universal Naming Convention (UNC)
+- **OIeValidateUrl**  Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_VALIDATE_NAVIGATE_URL feature control prevents Windows Internet Explorer from navigating to a badly formed URL
+- **OIeWebOcPopup**  Flag indicating which Microsoft Office products have this setting enabled. The FEATURE_WEBOC_POPUPMANAGEMENT feature allows applications hosting the WebBrowser Control to receive the default Internet Explorer pop-up window management behavior
+- **OIeWinRestrict**  Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_WINDOW_RESTRICTIONS feature adds several restrictions to the size and behavior of popup windows
+- **OIeZoneElevate**  Flag indicating which Microsoft Office products have this setting enabled. When enabled, the FEATURE_ZONE_ELEVATION feature prevents pages in one zone from navigating to pages in a higher security zone unless the navigation is generated by the user
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeIESettingsStartSync
+
+Diagnostic event to indicate a new sync is being generated for this object type.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsAdd
+
+This event provides insight data on the installed Office products
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+- **OfficeApplication**  The name of the Office application.
+- **OfficeArchitecture**  The bitness of the Office application.
+- **OfficeVersion**  The version of the Office application.
+- **Value**  The insights collected about this entity.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsRemove
+
+Indicates that this particular data object represented by the objectInstanceId is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeInsightsStartSync
+
+This diagnostic event indicates that a new sync is being generated for this object type.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsAdd
+
+Describes Office Products installed.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+- **OC2rApps**  A GUID the describes the Office Click-To-Run apps
+- **OC2rSkus**  Comma-delimited list (CSV) of Office Click-To-Run products installed on the device. For example, Office 2016 ProPlus
+- **OMsiApps**  Comma-delimited list (CSV) of Office MSI products installed on the device. For example, Microsoft Word
+- **OProductCodes**  A GUID that describes the Office MSI products
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeProductsStartSync
+
+Diagnostic event to indicate a new sync is being generated for this object type.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsAdd
+
+This event describes various Office settings
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **BrowserFlags**  Browser flags for Office-related products.
+- **ExchangeProviderFlags**  Provider policies for Office Exchange.
+- **InventoryVersion**  The version of the inventory binary generating the events.
+- **SharedComputerLicensing**  Office shared computer licensing policies.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeSettingsStartSync
+
+Indicates a new sync is being generated for this object type.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAAdd
+
+This event provides a summary rollup count of conditions encountered while performing a local scan of Office files, analyzing for known VBA programmability compatibility issues between legacy office version and ProPlus, and between 32 and 64-bit versions
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **Design**  Count of files with design issues found.
+- **Design_x64**  Count of files with 64 bit design issues found.
+- **DuplicateVBA**  Count of files with duplicate VBA code.
+- **HasVBA**  Count of files with VBA code.
+- **Inaccessible**  Count of files that were inaccessible for scanning.
+- **InventoryVersion**  The version of the inventory binary generating the events.
+- **Issues**  Count of files with issues detected.
+- **Issues_x64**  Count of files with 64-bit issues detected.
+- **IssuesNone**  Count of files with no issues detected.
+- **IssuesNone_x64**  Count of files with no 64-bit issues detected.
+- **Locked**  Count of files that were locked, preventing scanning.
+- **NoVBA**  Count of files with no VBA inside.
+- **Protected**  Count of files that were password protected, preventing scanning.
+- **RemLimited**  Count of files that require limited remediation changes.
+- **RemLimited_x64**  Count of files that require limited remediation changes for 64-bit issues.
+- **RemSignificant**  Count of files that require significant remediation changes.
+- **RemSignificant_x64**  Count of files that require significant remediation changes for 64-bit issues.
+- **Score**  Overall compatibility score calculated for scanned content.
+- **Score_x64**  Overall 64-bit compatibility score calculated for scanned content.
+- **Total**  Total number of files scanned.
+- **Validation**  Count of files that require additional manual validation.
+- **Validation_x64**  Count of files that require additional manual validation for 64-bit issues.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARemove
+
+Indicates that this particular data object represented by the objectInstanceId is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsAdd
+
+This event provides data on Microsoft Office VBA rule violations, including a rollup count per violation type, giving an indication of remediation requirements for an organization. The event identifier is a unique GUID, associated with the validation rule
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **Count**  Count of total Microsoft Office VBA rule violations
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsRemove
+
+Indicates that this particular data object represented by the objectInstanceId is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBARuleViolationsStartSync
+
+This event indicates that a new sync is being generated for this object type.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousOfficeVBAStartSync
+
+Diagnostic event to indicate a new sync is being generated for this object type.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **InventoryVersion**  The version of the inventory binary generating the events.
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoAdd
+
+Provides data on Unified Update Platform (UUP) products and what version they are at.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **Identifier**  UUP identifier
+- **LastActivatedVersion**  Last activated version
+- **PreviousVersion**  Previous version
+- **Source**  UUP source
+- **Version**  UUP version
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoRemove
+
+Indicates that this particular data object represented by the objectInstanceId is no longer present.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
+
+### Microsoft.Windows.Inventory.General.InventoryMiscellaneousUUPInfoStartSync
+
+Diagnostic event to indicate a new sync is being generated for this object type.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
+
+### Microsoft.Windows.Inventory.Indicators.Checksum
+
+This event summarizes the counts for the InventoryMiscellaneousUexIndicatorAdd events.
+
+The following fields are available:
+
+- **CensusId**  A unique hardware identifier.
+- **ChecksumDictionary**  A count of each operating system indicator.
+- **PCFP**  Equivalent to the InventoryId field that is found in other core events.
+
+
+### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorAdd
+
+These events represent the basic metadata about the OS indicators installed on the system which are used for keeping the device up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+The following fields are available:
+
+- **IndicatorValue**  The indicator value.
+
+
+### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorEndSync
+
+This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events has been sent. This data helps ensure the device is up to date.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
+
+### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorRemove
+
+This event is a counterpart to InventoryMiscellaneousUexIndicatorAdd that indicates that the item has been removed.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
+
+### Microsoft.Windows.Inventory.Indicators.InventoryMiscellaneousUexIndicatorStartSync
+
+This event indicates that a new set of InventoryMiscellaneousUexIndicatorAdd events will be sent.
+
+This event includes fields from [Ms.Device.DeviceInventoryChange](#msdevicedeviceinventorychange).
+
+
+
+## IoT events
+
+### Microsoft.Windows.IoT.Client.CEPAL.MonitorStarted
+
+This event identifies Windows Internet of Things (IoT) devices which are running the CE PAL subsystem by sending data during CE PAL startup.
+
+
+
+## Kernel events
+
+### IO
+
+This event indicates the number of bytes read from or read by the OS and written to or written by the OS upon system startup.
+
+The following fields are available:
+
+- **BytesRead**  The total number of bytes read from or read by the OS upon system startup.
+- **BytesWritten**  The total number of bytes written to or written by the OS upon system startup.
+
+
+### Microsoft.Windows.Kernel.BootEnvironment.OsLaunch
+
+OS information collected during Boot, used to evaluate the success of the upgrade process.
+
+The following fields are available:
+
+- **BootApplicationId**  This field tells us what the OS Loader Application Identifier is.
+- **BootAttemptCount**  The number of consecutive times the boot manager has attempted to boot into this operating system.
+- **BootSequence**  The current Boot ID, used to correlate events related to a particular boot session.
+- **BootStatusPolicy**  Identifies the applicable Boot Status Policy.
+- **BootType**  Identifies the type of boot (e.g.: "Cold", "Hiber", "Resume").
+- **EventTimestamp**  Seconds elapsed since an arbitrary time point. This can be used to identify the time difference in successive boot attempts being made.
+- **FirmwareResetReasonEmbeddedController**  Reason for system reset provided by firmware.
+- **FirmwareResetReasonEmbeddedControllerAdditional**  Additional information on system reset reason provided by firmware if needed.
+- **FirmwareResetReasonPch**  Reason for system reset provided by firmware.
+- **FirmwareResetReasonPchAdditional**  Additional information on system reset reason provided by firmware if needed.
+- **FirmwareResetReasonSupplied**  Flag indicating that a reason for system reset was provided by firmware.
+- **IO**  Amount of data written to and read from the disk by the OS Loader during boot. See [IO](#io).
+- **LastBootSucceeded**  Flag indicating whether the last boot was successful.
+- **LastShutdownSucceeded**  Flag indicating whether the last shutdown was successful.
+- **MaxAbove4GbFreeRange**  This field describes the largest memory range available above 4Gb.
+- **MaxBelow4GbFreeRange**  This field describes the largest memory range available below 4Gb.
+- **MeasuredLaunchCapable**  Indicates the system is capable of booting with Dynamic Root of Trust for Measurement (DRTM) support.
+- **MeasuredLaunchPrepared**  This field tells us if the OS launch was initiated using Measured/Secure Boot over DRTM (Dynamic Root of Trust for Measurement).
+- **MeasuredLaunchResume**  This field tells us if Dynamic Root of Trust for Measurement (DRTM) was used when resuming from hibernation.
+- **MenuPolicy**  Type of advanced options menu that should be shown to the user (Legacy, Standard, etc.).
+- **RecoveryEnabled**  Indicates whether recovery is enabled.
+- **TcbLaunch**  Indicates whether the Trusted Computing Base was used during the boot flow.
+- **UserInputTime**  The amount of time the loader application spent waiting for user input.
+
+
+### Microsoft.Windows.Kernel.DeviceConfig.DeviceConfig
+
+This critical device configuration event provides information about drivers for a driver installation that took place within the kernel.
+
+The following fields are available:
+
+- **ClassGuid**  The unique ID for the device class.
+- **DeviceInstanceId**  The unique ID for the device on the system.
+- **DriverDate**  The date of the driver.
+- **DriverFlightIds**  The IDs for the driver flights.
+- **DriverInfName**  Driver INF file name.
+- **DriverProvider**  The driver manufacturer or provider.
+- **DriverSubmissionId**  The driver submission ID assigned by the hardware developer center.
+- **DriverVersion**  The driver version number.
+- **ExtensionDrivers**  The list of extension driver INF files, extension IDs, and associated flight IDs.
+- **FirstHardwareId**  The ID in the hardware ID list that provides the most specific device description.
+- **InboxDriver**  Indicates whether the driver package is included with Windows.
+- **InstallDate**  Date the driver was installed.
+- **LastCompatibleId**  The ID in the hardware ID list that provides the least specific device description.
+- **Legacy**  Indicates whether the driver is a legacy driver.
+- **NeedReboot**  Indicates whether the driver requires a reboot.
+- **SetupMode**  Indicates whether the device configuration occurred during the Out Of Box Experience (OOBE).
+- **StatusCode**  The NTSTATUS of device configuration operation.
+
+
+### Microsoft.Windows.Kernel.PnP.AggregateClearDevNodeProblem
+
+This event is sent when a problem code is cleared from a device.
+
+The following fields are available:
+
+- **Count**  The total number of events.
+- **DeviceInstanceId**  The unique identifier of the device on the system.
+- **LastProblem**  The previous problem that was cleared.
+- **LastProblemStatus**  The previous NTSTATUS value that was cleared.
+- **ServiceName**  The name of the driver or service attached to the device.
+
+
+### Microsoft.Windows.Kernel.PnP.AggregateSetDevNodeProblem
+
+This event is sent when a new problem code is assigned to a device.
+
+The following fields are available:
+
+- **Count**  The total number of events.
+- **DeviceInstanceId**  The unique identifier of the device in the system.
+- **LastProblem**  The previous problem code that was set on the device.
+- **LastProblemStatus**  The previous NTSTATUS value that was set on the device.
+- **Problem**  The new problem code that was set on the device.
+- **ProblemStatus**  The new NTSTATUS value that was set on the device.
+- **ServiceName**  The driver or service name that is attached to the device.
+
+
+### Microsoft.Windows.Kernel.Power.PreviousShutdownWasThermalShutdown
+
+This event sends Product and Service Performance data on which area of the device exceeded safe temperature limits and caused the device to shutdown. This information is used to ensure devices are behaving as they are expected to.
+
+The following fields are available:
+
+- **temperature**  Contains the actual temperature measurement, in tenths of degrees Kelvin, for the area that exceeded the limit.
+- **thermalZone**  Contains an identifier that specifies which area it was that exceeded temperature limits.
+
+
+## Microsoft Edge events
+
+### Aria.160f0649efde47b7832f05ed000fc453.Microsoft.WebBrowser.SystemInfo.Config
+
+This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+### Aria.29e24d069f27450385c7acaa2f07e277.Microsoft.WebBrowser.SystemInfo.Config
+
+This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+### Aria.7005b72804a64fa4b2138faab88f877b.Microsoft.WebBrowser.SystemInfo.Config
+
+This event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+### Aria.754de735ccd546b28d0bfca8ac52c3de.Microsoft.WebBrowser.SystemInfo.Config
+
+This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+
+### Aria.af397ef28e484961ba48646a5d38cf54.Microsoft.WebBrowser.Installer.EdgeUpdate.Ping
+
+This event sends hardware and software inventory information about the Microsoft Edge Update service, Microsoft Edge applications, and the current system environment, including app configuration, update configuration, and hardware capabilities. It's  used to measure the reliability and performance of the EdgeUpdate service and if Microsoft Edge applications are up to date.
+
+The following fields are available:
+
+- **appAp**  Microsoft Edge Update parameters, including channel, architecture, platform, and additional parameters identifying the release of Microsoft Edge to update and how to install it. Example: 'beta-arch_x64-full'. Default: ''.
+- **appAppId**  The GUID that identifies the product channels such as Edge Canary, Dev, Beta, Stable, and Edge Update.
+- **appBrandCode**  The 4-digit brand code under which the the product was installed, if any. Possible values: 'GGLS' (default), 'GCEU' (enterprise install), and '' (unknown).
+- **appChannel**  An integer indicating the channel of the installation (e.g. Canary or Dev).
+- **appClientId** A generalized form of the brand code that can accept a wider range of values and is used for similar purposes. Default: ''.
+- **appCohort**  A machine-readable string identifying the release channel that the app belongs to. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''.
+- **appCohortHint**  A machine-readable enum indicating that the client has a desire to switch to a different release cohort. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''.
+- **appCohortName**  A stable non-localized human-readable enum indicating which (if any) set of messages the app should display to the user. For example, an app with a cohort name of 'beta' might display beta-specific branding to the user. Limited to ASCII characters 32 to 127 (inclusive) and a maximum length of 1024 characters. Default: ''.
+- **appConsentState**  Bit flags describing the diagnostic data disclosure and response flow where 1 indicates the affirmative and 0 indicates the negative or unspecified data. Bit 1 indicates consent was given, bit 2 indicates data originated from the download page, bit 18 indicates choice for sending data about how the browser is used, and bit 19 indicates choice for sending data about websites visited.
+- **appDayOfInstall**  The date-based counting equivalent of appInstallTimeDiffSec (the numeric calendar day that the app was installed on). This value is provided by the server in the response to the first request in the installation flow. Default: '-2' (Unknown).
+- **appExperiments**  A semicolon-delimited key/value list of experiment identifiers and treatment groups. This field is unused and always empty in Edge Update. Default: ''.
+- **appInstallTimeDiffSec**  The difference between the current time and the install date in seconds. '0' if unknown. Default: '-1'.
+- **appLang**  The language of the product install, in IETF BCP 47 representation. Default: ''.
+- **appNextVersion**  The version of the app that the update attempted to reach, regardless of the success or failure of the update operation. Default: '0.0.0.0'.
+- **appPingEventAppSize**  The total number of bytes of all downloaded packages. Default: '0'.
+- **appPingEventDownloadMetricsDownloadedBytes**  For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'.
+- **appPingEventDownloadMetricsDownloader**  A string identifying the download algorithm and/or stack. Example values include: 'bits', 'direct', 'winhttp', 'p2p'. Sent in events that have an event type of '14' only. Default: ''.
+- **appPingEventDownloadMetricsDownloadTimeMs**  For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'.
+- **appPingEventDownloadMetricsError**  The error code (if any) of the operation, encoded as a signed base-10 integer. Default: '0'.
+- **appPingEventDownloadMetricsServerIpHint**  For events representing a download, the CDN Host IP address that corresponds to the update file server. The CDN host is controlled by Microsoft servers and always maps to IP addresses hosting *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''.
+- **appPingEventDownloadMetricsTotalBytes**  For events representing a download, the number of bytes expected to be downloaded. For events representing an entire update flow, the sum of all such expected bytes over the course of the update flow. Default: '0'.
+- **appPingEventDownloadMetricsUrl** For events representing a download, the CDN URL provided by the update server for the client to download the update, the URL is controlled by Microsoft servers and always maps back to either *.delivery.mp.microsoft.com or msedgesetup.azureedge.net. Default: ''.
+- **appPingEventDownloadTimeMs**  For events representing a download, the time elapsed between the start of the download and the end of the download, in milliseconds. For events representing an entire update flow, the sum of all such download times over the course of the update flow. Sent in events that have an event type of '1', '2', '3', and '14' only. Default: '0'.
+- **appPingEventErrorCode**  The error code (if any) of the operation, encoded as a signed, base-10 integer. Default: '0'.
+- **appPingEventEventResult**  An enumeration indicating the result of the event. Common values are '0' (Error) and '1' (Success). Default: '0' (Error).
+- **appPingEventEventType**  An enumeration indicating the type of the event and the event stage. Default: '0' (Unknown).
+- **appPingEventExtraCode1**  Additional numeric information about the operation's result, encoded as a signed, base-10 integer. Default: '0'.
+- **appPingEventInstallTimeMs**  For events representing an install, the time elapsed between the start of the install and the end of the install, in milliseconds. For events representing an entire update flow, the sum of all such durations. Sent in events that have an event type of '2' and '3' only. Default: '0'.
+- **appPingEventNumBytesDownloaded**  The number of bytes downloaded for the specified application. Default: '0'.
+- **appPingEventSequenceId**  An ID that uniquely identifies particular events within one requestId. Since a request can contain multiple ping events, this field is necessary to uniquely identify each possible event.
+- **appPingEventSourceUrlIndex**  For events representing a download, the position of the download URL in the list of URLs supplied by the server in a  tag.
+- **appPingEventUpdateCheckTimeMs**	For events representing an entire update flow, the time elapsed between the start of the update check and the end of the update check, in milliseconds. Sent in events that have an event type of '2' and '3' only. Default: '0'.
+- **appUpdateCheckIsUpdateDisabled**  The state of whether app updates are restricted by group policy. True if updates have been restricted by group policy or false if they have not.
+- **appUpdateCheckTargetVersionPrefix**  A component-wise prefix of a version number, or a complete version number suffixed with the $ character. The prefix is interpreted a dotted-tuple that specifies the exactly-matching elements; it is not a lexical prefix (for example, '1.2.3' MUST match '1.2.3.4' but MUST NOT match '1.2.34'). Default: ''.
+- **appUpdateCheckTtToken**  An opaque access token that can be used to identify the requesting client as a member of a trusted-tester group. If non-empty, the request is sent over SSL or another secure protocol. This field is unused by Edge Update and always empty. Default: ''.
+- **appVersion**  The version of the product install. Default: '0.0.0.0'.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event where 1 is basic, 2 is enhanced, and 3 is full.
+- **eventType**  A string representation of appPingEventEventType indicating the type of the event.
+- **hwHasAvx**  '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse**  '1' if the client's hardware supports the SSE instruction set. '0' if the client's hardware does not support the SSE instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse2**  '1' if the client's hardware supports the SSE2 instruction set. '0' if the client's hardware does not support the SSE2 instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse3**  '1' if the client's hardware supports the SSE3 instruction set. '0' if the client's hardware does not support the SSE3 instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse41**  '1' if the client's hardware supports the SSE4.1 instruction set. '0' if the client's hardware does not support the SSE4.1 instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSse42**  '1' if the client's hardware supports the SSE4.2 instruction set. '0' if the client's hardware does not support the SSE4.2 instruction set. '-1' if unknown. Default: '-1'.
+- **hwHasSsse3**  '1' if the client's hardware supports the SSSE3 instruction set. '0' if the client's hardware does not support the SSSE3 instruction set. '-1' if unknown. Default: '-1'.
+- **hwPhysmemory**  The physical memory available to the client, truncated down to the nearest gibibyte. '-1' if unknown. This value is intended to reflect the maximum theoretical storage capacity of the client, not including any hard drive or paging to a hard drive or peripheral. Default: '-1'.
+- **isMsftDomainJoined**  '1' if the client is a member of a Microsoft domain. '0' otherwise. Default: '0'.
+- **osArch**  The architecture of the operating system (e.g. 'x86', 'x64', 'arm'). '' if unknown. Default: ''.
+- **osPlatform**  The operating system family that the within which the Omaha client is running (e.g. 'win', 'mac', 'linux', 'ios', 'android'). '' if unknown. The operating system name should be transmitted in lowercase with minimal formatting. Default: ''.
+- **osServicePack**  The secondary version of the operating system. '' if unknown. Default: ''.
+- **osVersion**  The primary version of the operating system. '' if unknown. Default: ''.
+- **requestCheckPeriodSec**  The update interval in seconds. The value is read from the registry. Default: '-1'.
+- **requestDlpref**  A comma-separated list of values specifying the preferred download URL behavior. The first value is the highest priority, further values reflect secondary, tertiary, et cetera priorities. Legal values are '' (in which case the entire list must be empty, indicating unknown or no-preference) or 'cacheable' (the server should prioritize sending URLs that are easily cacheable). Default: ''.
+- **requestDomainJoined**  '1' if the device is part of a managed enterprise domain. Otherwise '0'.
+- **requestInstallSource**  A string specifying the cause of the update flow. For example: 'ondemand', or 'scheduledtask'. Default: ''.
+- **requestIsMachine**  '1' if the client is known to be installed with system-level or administrator privileges. '0' otherwise. Default: '0'.
+- **requestOmahaShellVersion**  The version of the Omaha installation folder. Default: ''.
+- **requestOmahaVersion**  The version of the Omaha updater itself (the entity sending this request). Default: '0.0.0.0'.
+- **requestProtocolVersion**  The version of the Omaha protocol. Compatible clients MUST provide a value of '3.0'. Compatible clients MUST always transmit this attribute. Default: undefined.
+- **requestRequestId**  A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha request. Default: ''.
+- **requestSessionCorrelationVectorBase**  A client generated random MS Correlation Vector base code used to correlate the update session with update and CDN servers. Default: ''.
+- **requestSessionId**  A randomly-generated (uniformly distributed) GUID. Each single update flow (e.g. update check, update application, event ping sequence) should have (with high probability) a single unique sessionid. Default: ''.
+- **requestTestSource**  Either '', 'dev', 'qa', 'prober', 'auto', or 'ossdev'. Any value except '' indicates that the request is a test and should not be counted toward normal metrics. Default: ''.
+- **requestUid**  A randomly-generated (uniformly distributed) GUID, corresponding to the Omaha user. Each request attempt should have (with high probability) a unique request id. Default: ''.
+
+
+### Aria.f4a7d46e472049dfba756e11bdbbc08f.Microsoft.WebBrowser.SystemInfo.Config
+
+This config event sends basic device connectivity and configuration information from Microsoft Edge about the current data collection consent, app version, and installation state to keep Microsoft Edge up to date and secure.
+
+The following fields are available:
+
+- **app_version**  The internal Microsoft Edge build version string.
+- **appConsentState**  Bit flags that describe the consent for data collection on the device, or zero if the state was not retrieved. The following are true when the associated bit is set: consent was granted (0x1), consent was communicated at install (0x2), diagnostic data consent granted (0x20000), browsing data consent granted (0x40000).
+- **Channel**  An integer indicating the channel of the installation (Canary or Dev).
+- **client_id**  A non-durable unique identifier with which all other diagnostic client data is associated. This value is reset whenever UMA data collection is disabled, or when the application is uninstalled.
+- **ConnectionType**  The first reported type of network connection currently connected. Possible values: Unknown, Ethernet, WiFi, 2G, 3G, 4G, None, or Bluetooth
+- **container_client_id**  The client ID of the container if the device is in Windows Defender Application Guard mode.
+- **container_session_id**  The session ID of the container if the device is in Windows Defender Application Guard mode.
+- **Etag**  Etag is an identifier representing all service applied configurations and experiments for the current browser session. There is not value in this field is the device is at the Basic diagnostic data level.
+- **EventInfo.Level**  The minimum Windows diagnostic data level required for the event. Possible values: 1 -- Basic, 2 -- Enhanced, 3 -- Full
+- **install_date**  The date and time of the most recent installation in seconds since midnight on January 1, 1970 UTC, rounded down to the nearest hour.
+- **installSource**  An enumeration representing the source of this installation. Possible values: source was not retrieved (0), unspecified source (1), website installer (2), enterprise MSI (3), Windows update (4), Edge updater (5), scheduled or timed task (6, 7), uninstall (8), Edge about page (9), self-repair (10), other install command line (11), reserved (12), unknown source (13).
+- **PayloadClass**  The base class used to serialize and deserialize the Protobuf binary payload.
+- **PayloadGUID**  A random identifier generated for each original monolithic Protobuf payload, before the payload is potentially broken up into manageably-sized chunks for transmission.
+- **PayloadLogType**  The log type for the event correlating with. Possible values: 0 -- Unknown, 1 -- Stability, 2 -- On-going, 3 -- Independent, 4 -- UKM, or 5 -- Instance level
+- **session_id** An ordered identifier that is guaranteed to be greater than the previous session identifier each time the user launches the application, reset on subsequent launch after client_id changes. session_id is seeded during the initial installation of the application. session_id is effectively unique per client_id value. Several other internal identifier values, such as window or tab IDs, are only meaningful within a particular session. The session_id value is forgotten when the application is uninstalled, but not during an upgrade.
+
+## Migration events
+
+### Microsoft.Windows.MigrationCore.MigObjectCountDLUsr
+
+This event returns data to track the count of the migration objects across various phases during feature update.
+
+The following fields are available:
+
+- **currentSid**  Indicates the user SID for which the migration is being performed.
+- **knownFoldersUsr[i]**  Predefined folder path locations.
+- **migDiagSession->CString**  The phase of the upgrade where migration occurs. (E.g.: Validate tracked content)
+- **objectCount**  The count for the number of objects that are being transferred.
+
+
+### Microsoft.Windows.MigrationCore.MigObjectCountKFSys
+
+This event returns data about the count of the migration objects across various phases during feature update.
+
+The following fields are available:
+
+- **knownFoldersSys[i]**  The predefined folder path locations.
+- **migDiagSession->CString**  Identifies the phase of the upgrade where migration happens.
+- **objectCount**  The count of the number of objects that are being transferred.
+
+
+### Microsoft.Windows.MigrationCore.MigObjectCountKFUsr
+
+This event returns data to track the count of the migration objects across various phases during feature update.
+
+The following fields are available:
+
+- **currentSid**  Indicates the user SID for which the migration is being performed.
+- **knownFoldersUsr[i]**  Predefined folder path locations.
+- **migDiagSession->CString**  The phase of the upgrade where the migration occurs. (For example, Validate tracked content.)
+- **objectCount**  The number of objects that are being transferred.
+
+
+## Miracast events
+
+### Microsoft.Windows.Cast.Miracast.MiracastSessionEnd
+
+This event sends data at the end of a Miracast session that helps determine RTSP related Miracast failures along with some statistics about the session
+
+The following fields are available:
+
+- **AudioChannelCount**  The number of audio channels.
+- **AudioSampleRate**  The sample rate of audio in terms of samples per second.
+- **AudioSubtype**  The unique subtype identifier of the audio codec (encoding method) used for audio encoding.
+- **AverageBitrate**  The average video bitrate used during the Miracast session, in bits per second.
+- **AverageDataRate**  The average available bandwidth reported by the WiFi driver during the Miracast session, in bits per second.
+- **AveragePacketSendTimeInMs**  The average time required for the network to send a sample, in milliseconds.
+- **ConnectorType**  The type of connector used during the Miracast session.
+- **EncodeAverageTimeMS**  The average time to encode a frame of video, in milliseconds.
+- **EncodeCount**  The count of total frames encoded in the session.
+- **EncodeMaxTimeMS**  The maximum time to encode a frame, in milliseconds.
+- **EncodeMinTimeMS**  The minimum time to encode a frame, in milliseconds.
+- **EncoderCreationTimeInMs**  The time required to create the video encoder, in milliseconds.
+- **ErrorSource**  Identifies the component that encountered an error that caused a disconnect, if applicable.
+- **FirstFrameTime**  The time (tick count) when the first frame is sent.
+- **FirstLatencyMode**  The first latency mode.
+- **FrameAverageTimeMS**  Average time to process an entire frame, in milliseconds.
+- **FrameCount**  The total number of frames processed.
+- **FrameMaxTimeMS**  The maximum time required to process an entire frame, in milliseconds.
+- **FrameMinTimeMS**  The minimum time required to process an entire frame, in milliseconds.
+- **Glitches**  The number of frames that failed to be delivered on time.
+- **HardwareCursorEnabled**  Indicates if hardware cursor was enabled when the connection ended.
+- **HDCPState**  The state of HDCP (High-bandwidth Digital Content Protection) when the connection ended.
+- **HighestBitrate**  The highest video bitrate used during the Miracast session, in bits per second.
+- **HighestDataRate**  The highest available bandwidth reported by the WiFi driver, in bits per second.
+- **LastLatencyMode**  The last reported latency mode.
+- **LogTimeReference**  The reference time, in tick counts.
+- **LowestBitrate**  The lowest video bitrate used during the Miracast session, in bits per second.
+- **LowestDataRate**  The lowest video bitrate used during the Miracast session, in bits per second.
+- **MediaErrorCode**  The error code reported by the media session, if applicable.
+- **MiracastEntry**  The time (tick count) when the Miracast driver was first loaded.
+- **MiracastM1**  The time (tick count) when the M1 request was sent.
+- **MiracastM2**  The time (tick count) when the M2 request was sent.
+- **MiracastM3**  The time (tick count) when the M3 request was sent.
+- **MiracastM4**  The time (tick count) when the M4 request was sent.
+- **MiracastM5**  The time (tick count) when the M5 request was sent.
+- **MiracastM6**  The time (tick count) when the M6 request was sent.
+- **MiracastM7**  The time (tick count) when the M7 request was sent.
+- **MiracastSessionState**  The state of the Miracast session when the connection ended.
+- **MiracastStreaming**  The time (tick count) when the Miracast session first started processing frames.
+- **ProfileCount**  The count of profiles generated from the receiver M4 response.
+- **ProfileCountAfterFiltering**  The count of profiles after filtering based on available bandwidth and encoder capabilities.
+- **RefreshRate**  The refresh rate set on the remote display.
+- **RotationSupported**  Indicates if the Miracast receiver supports display rotation.
+- **RTSPSessionId**  The unique identifier of the RTSP session. This matches the RTSP session ID for the receiver for the same session.
+- **SessionGuid**  The unique identifier of to correlate various Miracast events from a session.
+- **SinkHadEdid**  Indicates if the Miracast receiver reported an EDID.
+- **SupportMicrosoftColorSpaceConversion**  Indicates whether the Microsoft color space conversion for extra color fidelity is supported by the receiver.
+- **SupportsMicrosoftDiagnostics**  Indicates whether the Miracast receiver supports the Microsoft Diagnostics Miracast extension.
+- **SupportsMicrosoftFormatChange**  Indicates whether the Miracast receiver supports the Microsoft Format Change Miracast extension.
+- **SupportsMicrosoftLatencyManagement**  Indicates whether the Miracast receiver supports the Microsoft Latency Management Miracast extension.
+- **SupportsMicrosoftRTCP**  Indicates whether the Miracast receiver supports the Microsoft RTCP Miracast extension.
+- **SupportsMicrosoftVideoFormats**  Indicates whether the Miracast receiver supports Microsoft video format for 3:2 resolution.
+- **SupportsWiDi**  Indicates whether Miracast receiver supports Intel WiDi extensions.
+- **TeardownErrorCode**  The error code reason for teardown provided by the receiver, if applicable.
+- **TeardownErrorReason**  The text string reason for teardown provided by the receiver, if applicable.
+- **UIBCEndState**  Indicates whether UIBC was enabled when the connection ended.
+- **UIBCEverEnabled**  Indicates whether UIBC was ever enabled.
+- **UIBCStatus**  The result code reported by the UIBC setup process.
+- **VideoBitrate**  The starting bitrate for the video encoder.
+- **VideoCodecLevel**  The encoding level used for encoding, specific to the video subtype.
+- **VideoHeight**  The height of encoded video frames.
+- **VideoSubtype**  The unique subtype identifier of the video codec (encoding method) used for video encoding.
+- **VideoWidth**  The width of encoded video frames.
+- **WFD2Supported**  Indicates if the Miracast receiver supports WFD2 protocol.
+
+
+## OneDrive events
+
+### Microsoft.OneDrive.Sync.Setup.OSUpgradeInstallationOperation
+
+This event is related to the OS version when the OS is upgraded with OneDrive installed.
+
+The following fields are available:
+
+- **CurrentOneDriveVersion**  The current version of OneDrive.
+- **CurrentOSBuildBranch**  The current branch of the operating system.
+- **CurrentOSBuildNumber**  The current build number of the operating system.
+- **CurrentOSVersion**  The current version of the operating system.
+- **HResult**  The HResult of the operation.
+- **SourceOSBuildBranch**  The source branch of the operating system.
+- **SourceOSBuildNumber**  The source build number of the operating system.
+- **SourceOSVersion**  The source version of the operating system.
+
+## Privacy consent logging events
+
+### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentCompleted
+
+This event is used to determine whether the user successfully completed the privacy consent experience.
+
+The following fields are available:
+
+- **presentationVersion**  Which display version of the privacy consent experience the user completed
+- **privacyConsentState**  The current state of the privacy consent experience
+- **settingsVersion**  Which setting version of the privacy consent experience the user completed
+- **userOobeExitReason**  The exit reason of the privacy consent experience
+
+
+### Microsoft.Windows.Shell.PrivacyConsentLogging.PrivacyConsentStatus
+
+Event tells us effectiveness of new privacy experience.
+
+The following fields are available:
+
+- **isAdmin**  whether the person who is logging in is an admin
+- **isExistingUser**  whether the account existed in a downlevel OS
+- **isLaunching**  Whether or not the privacy consent experience will be launched
+- **isSilentElevation**  whether the user has most restrictive UAC controls
+- **privacyConsentState**  whether the user has completed privacy experience
+- **userRegionCode**  The current user's region setting
+
+
+## Push Button Reset events
+
+### Microsoft.Windows.PBR.BitLockerWipeFinished
+
+This event sends error data after the BitLocker wipe finishes if there were any issues during the wipe.
+
+The following fields are available:
+
+- **error**  The error code if there were any issues during the BitLocker wipe.
+- **sessionID**  This is the session ID.
+- **succeeded**  Indicates the BitLocker wipe successful completed.
+- **timestamp**  Time the event occurred.
+
+
+### Microsoft.Windows.PBR.BootState
+
+This event sends data on the Windows Recovery Environment (WinRE) boot, which can be used to determine whether the boot was successful.
+
+The following fields are available:
+
+- **BsdSummaryInfo**  Summary of the last boot.
+- **sessionID**  The ID of the push-button reset session.
+- **timestamp**  The timestamp of the boot state.
+
+
+### Microsoft.Windows.PBR.ClearTPMStarted
+
+This event sends basic data about the recovery operation on the device to allow investigation.
+
+The following fields are available:
+
+- **sessionID**  The ID for this push-button restart session.
+- **timestamp**  The time when the Trusted Platform Module will be erased.
+
+
+### Microsoft.Windows.PBR.ClientInfo
+
+This event indicates whether push-button reset (PBR) was initiated while the device was online or offline.
+
+The following fields are available:
+
+- **name**  Name of the user interface entry point.
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The time when this event occurred.
+
+
+### Microsoft.Windows.PBR.Completed
+
+This event sends data about the recovery operation on the device to allow for investigation.
+
+The following fields are available:
+
+- **sessionID**  The ID of the push-button reset session.
+- **timestamp**  Timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.DataVolumeCount
+
+This event provides the number of additional data volumes that the push-button reset operation has detected.
+
+The following fields are available:
+
+- **count**  The number of attached data drives.
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  Time the event occurred.
+
+
+### Microsoft.Windows.PBR.DiskSpaceRequired
+
+This event sends the peak disk usage required for the push-button reset operation.
+
+The following fields are available:
+
+- **numBytes**  The number of bytes required for the reset operation.
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  Time the event occurred.
+
+
+### Microsoft.Windows.PBR.EnterAPI
+
+This event is sent at the beginning of each push-button reset (PRB) operation.
+
+The following fields are available:
+
+- **apiName**  Name of the API command that is about to execute.
+- **sessionID**  The session ID.
+- **timestamp**  Timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.EnteredOOBE
+
+This event is sent when the push-button reset (PRB) process enters the Out Of Box Experience (OOBE).
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  Timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.LeaveAPI
+
+This event is sent when the push-button reset operation is complete.
+
+The following fields are available:
+
+- **apiName**  Name of the API command that completed.
+- **errorCode**  Error code if an error occurred during the API call.
+- **sessionID**  The ID of this push-button reset session.
+- **success**  Indicates whether the API call was successful.
+- **timestamp**  Timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.OEMExtensionFinished
+
+This event is sent when the OEM extensibility scripts have completed.
+
+The following fields are available:
+
+- **exitCode**  The exit code from OEM extensibility scripts to push-button reset.
+- **param**  Parameters used for the OEM extensibility script.
+- **phase**  Name of the OEM extensibility script phase.
+- **script**  The path to the OEM extensibility script.
+- **sessionID**  The ID of this push-button reset session.
+- **succeeded**  Indicates whether the OEM extensibility script executed successfully.
+- **timedOut**  Indicates whether the OEM extensibility script timed out.
+- **timestamp**  Timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.OEMExtensionStarted
+
+This event is sent when the OEM extensibility scripts start to execute.
+
+The following fields are available:
+
+- **param**  The parameters used by the OEM extensibility script.
+- **phase**  The name of the OEM extensibility script phase.
+- **script**  The path to the OEM extensibility script.
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  Timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.OperationExecuteFinished
+
+This event is sent at the end of a push-button reset (PBR) operation.
+
+The following fields are available:
+
+- **error**  Indicates the result code of the event.
+- **index**  The operation index.
+- **operation**  The name of the operation.
+- **phase**  The name of the operation phase.
+- **sessionID**  The ID of this push-button reset session.
+- **succeeded**  Indicates whether the operation successfully completed.
+- **timestamp**  Timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.OperationExecuteStarted
+
+This event is sent at the beginning of a push-button reset operation.
+
+The following fields are available:
+
+- **index**  The index of this operation.
+- **operation**  The name of this operation.
+- **phase**  The phase of this operation.
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  Timestamp of this push-button reset event.
+- **weight**  The weight of the operation used to distribute the change in percentage.
+
+
+### Microsoft.Windows.PBR.OperationQueueConstructFinished
+
+This event is sent when construction of the operation queue for push-button reset is finished.
+
+The following fields are available:
+
+- **error**  The result code for operation queue construction.
+- **sessionID**  The ID of this push-button reset session.
+- **succeeded**  Indicates whether the operation successfully completed.
+- **timestamp**  Timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.OperationQueueConstructStarted
+
+This event is sent when construction of the operation queue for push-button reset is started.
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  Timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.PBRClearTPMFailed
+
+This event is sent when there was a failure while clearing the Trusted Platform Module (TPM).
+
+The following fields are available:
+
+- **SessionID**  The ID of this push-button reset session.
+
+
+### Microsoft.Windows.PBR.PBRCreateNewSystemReconstructionFailed
+
+This event is sent when the push-button reset operation fails to construct a new copy of the operating system.
+
+The following fields are available:
+
+- **HRESULT**  Indicates the result code of the event.
+- **PBRType**  The type of push-button reset.
+- **SessionID**  The ID of this push-button reset session.
+- **SPErrorCode**  The error code for the Setup Platform operation.
+- **SPOperation**  The last Setup Platform operation.
+- **SPPhase**  The last phase of the Setup Platform operation.
+
+
+### Microsoft.Windows.PBR.PBRFailed
+
+This event is sent when the push-button reset operation fails and rolls back to the previous state.
+
+The following fields are available:
+
+- **ErrorType**  The result code for the push-button reset error.
+- **PBRType**  The type of push-button reset.
+- **SessionID**  The ID of this push-button reset session.
+
+
+### Microsoft.Windows.PBR.PBRFinalUserSelection
+
+This event is sent when the user makes the final selection in the user interface.
+
+The following fields are available:
+
+- **PBREraseData**  Indicates whether the option to erase data is selected.
+- **PBRRecoveryStrategy**  The recovery strategy for the push-button reset operation.
+- **PBRRepartitionDisk**  Indicates whether the user has selected the option to repartition the disk.
+- **PBRVariation**  Indicates the push-button reset type.
+- **PBRWipeDataDrives**  Indicates whether the option to wipe the data drives is selected.
+- **SessionID**  The ID of this push-button reset session.
+
+
+### Microsoft.Windows.PBR.PBROEM1Failed
+
+This event is sent when the first OEM extensibility operation is successfully completed.
+
+The following fields are available:
+
+- **HRESULT**  The result error code from the OEM extensibility script.
+- **Parameters**  The parameters that were passed to the OEM extensibility script.
+- **PBRType**  The type of push-button reset.
+- **ScriptName**  The path to the OEM extensibility script.
+- **SessionID**  The ID of this push-button reset session.
+
+
+### Microsoft.Windows.PBR.PBRReachedOOBE
+
+This event returns data when the PBR (Push Button Reset) process reaches the OOBE (Out of Box Experience).
+
+The following fields are available:
+
+- **SessionID**  The ID of this push-button reset session.
+
+
+### Microsoft.Windows.PBR.PBRReconstructionInitiated
+
+This event returns data when a PBR (Push Button Reset) reconstruction operation begins.
+
+The following fields are available:
+
+- **SessionID**  The ID of this push-button reset session.
+
+
+### Microsoft.Windows.PBR.PBRRequirementChecks
+
+This event returns data when PBR (Push Button Reset) requirement checks begin.
+
+The following fields are available:
+
+- **DeploymentType**  The type of deployment.
+- **InstallType**  The type of installation.
+- **PBRType**  The type of push-button reset.
+- **SessionID**  The ID for this push-button reset session.
+
+
+### Microsoft.Windows.PBR.PBRRequirementChecksFailed
+
+This event returns data when PBR (Push Button Reset) requirement checks fail.
+
+The following fields are available:
+
+- **DiskSpaceAvailable**  The disk space available for the push-button reset.
+- **DiskSpaceRequired**  The disk space required for the push-button reset.
+- **ErrorType**  The type of error that occurred during the requirement checks phase of the push-button reset operation.
+- **PBRImageVersion**  The image version of the push-button reset tool.
+- **PBRRecoveryStrategy**  The recovery strategy for this phase of push-button reset.
+- **PBRStartedFrom**  Identifies the push-button reset entry point.
+- **PBRType**  The type of push-button reset specified by the user interface.
+- **SessionID**  The ID of this push-button reset session.
+
+
+### Microsoft.Windows.PBR.PBRRequirementChecksPassed
+
+This event returns data when PBR (Push Button Reset) requirement checks are passed.
+
+The following fields are available:
+
+- **OSVersion**  The OS version installed on the device.
+- **PBRImageType**  The push-button reset image type.
+- **PBRImageVersion**  The version of the push-button reset image.
+- **PBRRecoveryStrategy**  The push-button reset recovery strategy.
+- **PBRStartedFrom**  Identifies the push-button reset entry point.
+- **SessionID**  The ID of this push-button reset session.
+
+
+### Microsoft.Windows.PBR.PBRSucceed
+
+This event returns data when PBR (Push Button Reset) succeeds.
+
+The following fields are available:
+
+- **OSVersion**  The OS version installed on the device.
+- **PBRType**  The type of push-button reset.
+- **SessionID**  The ID of this push-button reset session.
+
+
+### Microsoft.Windows.PBR.PhaseFinished
+
+This event returns data when a phase of PBR (Push Button Reset) has completed.
+
+The following fields are available:
+
+- **error**  The result code for this phase of push-button reset.
+- **phase**  The name of this push-button reset phase.
+- **sessionID**  The ID of this push-button reset session.
+- **succeeded**  Indicates whether this phase of push-button reset executed successfully.
+- **timestamp**  The timestamp for this push-button reset event.
+
+
+### Microsoft.Windows.PBR.PhaseStarted
+
+This event is sent when a phase of the push-button reset (PBR) operation starts.
+
+The following fields are available:
+
+- **phase**  The name of this phase of push-button reset.
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp for this push-button reset event.
+
+
+### Microsoft.Windows.PBR.ReconstructionInfo
+
+This event returns data about the PBR (Push Button Reset) reconstruction.
+
+The following fields are available:
+
+- **numPackagesAbandoned**  The number of packages that were abandoned during the reconstruction operation of push-button reset.
+- **numPackagesFailed**  The number of packages that failed during the reconstruction operation of push-button reset.
+- **sessionID**  The ID of this push-button reset session.
+- **slowMode**  The mode of reconstruction.
+- **targetVersion**  The target version of the OS for the reconstruction.
+- **timestamp**  The timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.ResetOptions
+
+This event returns data about the PBR (Push Button Reset) reset options selected by the user.
+
+The following fields are available:
+
+- **overwriteSpace**  Indicates whether the option was selected to erase data during push-button reset.
+- **preserveWorkplace**  Indicates whether the option was selected to reserve the workplace during push-button reset.
+- **scenario**  The selected scenario for the push-button on reset operation.
+- **sessionID**  The ID of this push-button on reset session.
+- **timestamp**  The timestamp of this push-button on reset event.
+- **usePayload**  Indicates whether Cloud PBR or Reconstruction was used.
+- **wipeData**  Indicates whether the option was selected to wipe additional drives during push-button reset.
+
+
+### Microsoft.Windows.PBR.RetryQueued
+
+This event returns data about the retry count when PBR (Push Button Reset) is restarted due to a reboot.
+
+The following fields are available:
+
+- **attempt**  The number of retry attempts that were made
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.ReturnedToOldOS
+
+This event returns data after PBR (Push Button Reset) has completed the rollback.
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp  of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.ReturnTaskSchedulingFailed
+
+This event returns data when there is a failure scheduling a boot into WinRE (Windows Recovery).
+
+The following fields are available:
+
+- **errorCode**  The error that occurred while scheduling the task.
+- **sessionID**  The ID of this push-button reset session.
+- **taskName**  The name of the task.
+- **timestamp**  The ID of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.RollbackFinished
+
+This event returns data when the PBR (Push Button Reset) rollback completes.
+
+The following fields are available:
+
+- **error**  Any errors that occurred during rollback to the old operating system.
+- **sessionID**  The ID of this push-button reset session.
+- **succeeded**  Indicates whether the rollback succeeded.
+- **timestamp**  The timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.RollbackStarted
+
+This event returns data when the PBR (Push Button Reset) rollback begins.
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.ScenarioNotSupported
+
+This event returns data when the PBR (Push Button Reset) scenario selected is not supported on the device.
+
+The following fields are available:
+
+- **errorCode**  The error that occurred.
+- **reason**  The reason why this push-button reset scenario is not supported.
+- **sessionID**  The ID for this push-button reset session.
+- **timestamp**  The timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.SessionCreated
+
+This event returns data when the PRB (Push Button Reset) session is created at the beginning of the UI (user interface) process.
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.SessionResumed
+
+This event returns data when the PRB (Push Button Reset) session is resumed after reboots.
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.SessionSaved
+
+This event returns data when the PRB (Push Button Reset) session is suspended between reboots.
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.SetupExecuteFinished
+
+This event returns data when the PBR (Push Button Reset) setup finishes.
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **systemState**  Information about the system state of the Setup Platform operation.
+- **timestamp**  The timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.SetupExecuteStarted
+
+This event returns data when the PBR (Push Button Reset) setup starts.
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp for this push-button reset event.
+
+
+### Microsoft.Windows.PBR.SetupFinalizeStarted
+
+This event returns data when the Finalize operation is completed by setup during PBR (Push Button Reset).
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp for this push-button reset event.
+
+
+### Microsoft.Windows.PBR.SetupOperationFailed
+
+This event returns data when a PRB (Push Button Reset) setup operation fails.
+
+The following fields are available:
+
+- **errorCode**  An error that occurred during the setup phase of push-button reset.
+- **sessionID**  The ID of this push-button reset session.
+- **setupExecutionOperation**  The name of the Setup Platform operation.
+- **setupExecutionPhase**  The phase of the setup operation that failed.
+- **timestamp**  The timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.SystemInfoField
+
+This event returns data about the device when the user initiates the PBR UI (Push Button Reset User Interface), to ensure the appropriate reset options are shown to the user.
+
+The following fields are available:
+
+- **name**  Name of the system information field.
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp of this push-button reset event.
+- **value**  The system information field value.
+
+
+### Microsoft.Windows.PBR.SystemInfoListItem
+
+This event returns data about the device when the user initiates the PBR UI (Push Button Reset User Interface), to ensure the appropriate options can be shown to the user.
+
+The following fields are available:
+
+- **index**  The index number associated with the system information item.
+- **name**  The name of the list of system information items.
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp for this push-button reset event.
+- **value**  The value of the system information item.
+
+
+### Microsoft.Windows.PBR.SystemInfoSenseFinished
+
+This event returns data when System Info Sense is finished.
+
+The following fields are available:
+
+- **error**  The error code if an error occurred while querying for system information.
+- **sessionID**  The ID of this push-button reset session.
+- **succeeded**  Indicates whether the query for system information was successful.
+- **timestamp**  The timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.SystemInfoSenseStarted
+
+This event returns data when System Info Sense is started.
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset event.
+- **timestamp**  The timestamp of this push-button reset event.
+
+
+### Microsoft.Windows.PBR.UserAcknowledgeCleanupWarning
+
+This event returns data when the user acknowledges the cleanup warning pop-up after PRB (Push Button Reset) is complete.
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp for this push-button reset event.
+
+
+### Microsoft.Windows.PBR.UserCancel
+
+This event returns data when the user confirms they wish to cancel PBR (Push Button Reset) from the user interface.
+
+The following fields are available:
+
+- **pageID**  The page ID for the page the user canceled.
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp for this push-button reset event.
+
+
+### Microsoft.Windows.PBR.UserConfirmStart
+
+This event returns data when the user confirms they wish to reset their device and PBR (Push Button Reset) begins.
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp for this push-button reset event.
+
+
+### Microsoft.Windows.PBR.WinREInstallFinished
+
+This event returns data when WinRE (Windows Recovery) installation is complete.
+
+The following fields are available:
+
+- **errorCode**  Any error that occurred during the Windows Recovery Environment (WinRE) installation.
+- **sessionID**  The ID of this push-button reset session.
+- **success**  Indicates whether the Windows Recovery Environment (WinRE) installation successfully completed.
+- **timestamp**  The timestamp for this push-button reset event.
+
+
+### Microsoft.Windows.PBR.WinREInstallStarted
+
+This event returns data when WinRE (Windows Recovery) installation starts.
+
+The following fields are available:
+
+- **sessionID**  The ID of this push-button reset session.
+- **timestamp**  The timestamp for this push-button reset event.
+
+
+## Sediment events
+
+### Microsoft.Windows.Sediment.Info.DetailedState
+
+This event is sent when detailed state information is needed from an update trial run.
+
+The following fields are available:
+
+- **Data**  Data relevant to the state, such as what percent of disk space the directory takes up.
+- **Id**  Identifies the trial being run, such as a disk related trial.
+- **ReleaseVer**  The version of the component.
+- **State**  The state of the reporting data from the trial, such as the top-level directory analysis.
+- **Time**  The time the event was fired.
+
+
+### Microsoft.Windows.Sediment.Info.PhaseChange
+
+The event indicates progress made by the updater. This information assists in keeping Windows up to date.
+
+The following fields are available:
+
+- **NewPhase**  The phase of progress made.
+- **ReleaseVer**  The version information for the component in which the change occurred.
+- **Time**  The system time at which the phase chance occurred.
+
+
+## Setup events
+
+### SetupPlatformTel.SetupPlatformTelActivityEvent
+
+This event sends basic metadata about the SetupPlatform update installation process, to help keep Windows up to date.
+
+The following fields are available:
+
+- **FieldName**  Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc.
+- **GroupName**  Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc.
+- **Value**  Value associated with the corresponding event name. For example, time-related events will include the system time
+
+
+### SetupPlatformTel.SetupPlatformTelActivityStarted
+
+This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date.
+
+The following fields are available:
+
+- **Name**  The name of the dynamic update type. Example: GDR driver
+
+
+### SetupPlatformTel.SetupPlatformTelActivityStopped
+
+This event sends basic metadata about the update installation process generated by SetupPlatform to help keep Windows up to date.
+
+
+
+### SetupPlatformTel.SetupPlatformTelEvent
+
+This service retrieves events generated by SetupPlatform, the engine that drives the various deployment scenarios.
+
+The following fields are available:
+
+- **FieldName**  Retrieves the event name/data point. Examples: InstallStartTime, InstallEndtime, OverallResult etc.
+- **GroupName**  Retrieves the groupname the event belongs to. Example: Install Information, DU Information, Disk Space Information etc.
+- **Value**  Retrieves the value associated with the corresponding event name (Field Name). For example: For time related events this will include the system time.
+
+
+## Software update events
+
+### SoftwareUpdateClientTelemetry.CheckForUpdates
+
+Scan process event on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded).
+
+The following fields are available:
+
+- **ActivityMatchingId**  Contains a unique ID identifying a single CheckForUpdates session from initialization to completion.
+- **AllowCachedResults**  Indicates if the scan allowed using cached results.
+- **ApplicableUpdateInfo**  Metadata for the updates which were detected as applicable
+- **BiosFamily**  The family of the BIOS (Basic Input Output System).
+- **BiosName**  The name of the device BIOS.
+- **BiosReleaseDate**  The release date of the device BIOS.
+- **BiosSKUNumber**  The sku number of the device BIOS.
+- **BIOSVendor**  The vendor of the BIOS.
+- **BiosVersion**  The version of the BIOS.
+- **BranchReadinessLevel**  The servicing branch configured on the device.
+- **CachedEngineVersion**  For self-initiated healing, the version of the SIH engine that is cached on the device. If the SIH engine does not exist, the value is null.
+- **CallerApplicationName**  The name provided by the caller who initiated API calls into the software distribution client.
+- **CapabilityDetectoidGuid**  The GUID for a hardware applicability detectoid that could not be evaluated.
+- **CDNCountryCode**  Two letter country abbreviation for the Content Distribution Network (CDN) location.
+- **CDNId**  The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+- **ClientVersion**  The version number of the software distribution client.
+- **CommonProps**  A bitmask for future flags associated with the Windows Update client behavior. No data is currently reported in this field. Expected value for this field is 0.
+- **Context**  Gives context on where the error has occurred. Example: AutoEnable, GetSLSData, AddService, Misc, or Unknown
+- **CurrentMobileOperator**  The mobile operator the device is currently connected to.
+- **DeferralPolicySources**  Sources for any update deferral policies defined (GPO = 0x10, MDM = 0x100, Flight = 0x1000, UX = 0x10000).
+- **DeferredUpdates**  Update IDs which are currently being deferred until a later time
+- **DeviceModel**  What is the device model.
+- **DriverError**  The error code hit during a driver scan. This is 0 if no error was encountered.
+- **DriverExclusionPolicy**  Indicates if the policy for not including drivers with Windows Update is enabled.
+- **DriverSyncPassPerformed**  Were drivers scanned this time?
+- **EventInstanceID**  A globally unique identifier for event instance.
+- **EventScenario**  Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **ExtendedMetadataCabUrl**  Hostname that is used to download an update.
+- **ExtendedStatusCode**  Secondary error code for certain scenarios where StatusCode wasn't specific enough.
+- **FailedUpdateGuids**  The GUIDs for the updates that failed to be evaluated during the scan.
+- **FailedUpdatesCount**  The number of updates that failed to be evaluated during the scan.
+- **FeatureUpdateDeferral**  The deferral period configured for feature OS updates on the device (in days).
+- **FeatureUpdatePause**  Indicates whether feature OS updates are paused on the device.
+- **FeatureUpdatePausePeriod**  The pause duration configured for feature OS updates on the device (in days).
+- **FlightBranch**  The branch that a device is on if participating in flighting (pre-release builds).
+- **FlightRing**  The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
+- **HomeMobileOperator**  The mobile operator that the device was originally intended to work with.
+- **IntentPFNs**  Intended application-set metadata for atomic update scenarios.
+- **IPVersion**  Indicates whether the download took place over IPv4 or IPv6
+- **IsWUfBDualScanEnabled**  Indicates if Windows Update for Business dual scan is enabled on the device.
+- **IsWUfBEnabled**  Indicates if Windows Update for Business is enabled on the device.
+- **IsWUfBFederatedScanDisabled**  Indicates if Windows Update for Business federated scan is disabled on the device.
+- **MetadataIntegrityMode**  The mode of the update transport metadata integrity check. 0-Unknown, 1-Ignoe, 2-Audit, 3-Enforce
+- **MSIError**  The last error that was encountered during a scan for updates.
+- **NetworkConnectivityDetected**  Indicates the type of network connectivity that was detected. 0 - IPv4, 1 - IPv6
+- **NumberOfApplicableUpdates**  The number of updates which were ultimately deemed applicable to the system after the detection process is complete
+- **NumberOfApplicationsCategoryScanEvaluated**  The number of categories (apps) for which an app update scan checked
+- **NumberOfLoop**  The number of round trips the scan required
+- **NumberOfNewUpdatesFromServiceSync**  The number of updates which were seen for the first time in this scan
+- **NumberOfUpdatesEvaluated**  The total number of updates which were evaluated as a part of the scan
+- **NumFailedMetadataSignatures**  The number of metadata signatures checks which failed for new metadata synced down.
+- **Online**  Indicates if this was an online scan.
+- **PausedUpdates**  A list of UpdateIds which that currently being paused.
+- **PauseFeatureUpdatesEndTime**  If feature OS updates are paused on the device, this is the date and time for the end of the pause time window.
+- **PauseFeatureUpdatesStartTime**  If feature OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
+- **PauseQualityUpdatesEndTime**  If quality OS updates are paused on the device, this is the date and time for the end of the pause time window.
+- **PauseQualityUpdatesStartTime**  If quality OS updates are paused on the device, this is the date and time for the beginning of the pause time window.
+- **PhonePreviewEnabled**  Indicates whether a phone was getting preview build, prior to flighting (pre-release builds) being introduced.
+- **ProcessName**  The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **QualityUpdateDeferral**  The deferral period configured for quality OS updates on the device (in days).
+- **QualityUpdatePause**  Indicates whether quality OS updates are paused on the device.
+- **QualityUpdatePausePeriod**  The pause duration configured for quality OS updates on the device (in days).
+- **RelatedCV**  The previous Correlation Vector that was used before swapping with a new one
+- **ScanDurationInSeconds**  The number of seconds a scan took
+- **ScanEnqueueTime**  The number of seconds it took to initialize a scan
+- **ScanProps**  This is a 32-bit integer containing Boolean properties for a given Windows Update scan. The following bits are used; all remaining bits are reserved and set to zero. Bit 0 (0x1): IsInteractive - is set to 1 if the scan is requested by a user, or 0 if the scan is requested by Automatic Updates. Bit 1 (0x2): IsSeeker - is set to 1 if the Windows Update client's Seeker functionality is enabled. Seeker functionality is enabled on certain interactive scans, and results in the scans returning certain updates that are in the initial stages of release (not yet released for full adoption via Automatic Updates).
+- **ServiceGuid**  An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.).
+- **ServiceUrl**  The environment URL a device is configured to scan with
+- **ShippingMobileOperator**  The mobile operator that a device shipped on.
+- **StatusCode**  Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult).
+- **SyncType**  Describes the type of scan the event was
+- **SystemBIOSMajorRelease**  Major version of the BIOS.
+- **SystemBIOSMinorRelease**  Minor version of the BIOS.
+- **TargetMetadataVersion**  For self-initiated healing, this is the target version of the SIH engine to download (if needed). If not, the value is null.
+- **TotalNumMetadataSignatures**  The total number of metadata signatures checks done for new metadata that was synced down.
+- **WebServiceRetryMethods**  Web service method requests that needed to be retried to complete operation.
+- **WUDeviceID**  The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+
+
+### SoftwareUpdateClientTelemetry.Commit
+
+This event tracks the commit process post the update installation when software update client is trying to update the device.
+
+The following fields are available:
+
+- **BiosFamily**  Device family as defined in the system BIOS
+- **BiosName**  Name of the system BIOS
+- **BiosReleaseDate**  Release date of the system BIOS
+- **BiosSKUNumber**  Device SKU as defined in the system BIOS
+- **BIOSVendor**  Vendor of the system BIOS
+- **BiosVersion**  Version of the system BIOS
+- **BundleId**  Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **BundleRevisionNumber**  Identifies the revision number of the content bundle
+- **CallerApplicationName**  Name provided by the caller who initiated API calls into the software distribution client
+- **ClientVersion**  Version number of the software distribution client
+- **DeploymentProviderMode**  The mode of operation of the update deployment provider.
+- **DeviceModel**  Device model as defined in the system bios
+- **EventInstanceID**  A globally unique identifier for event instance
+- **EventScenario**  Indicates the purpose of the event - whether because scan started, succeded, failed, etc.
+- **EventType**  Possible values are "Child", "Bundle", "Relase" or "Driver".
+- **FlightId**  The specific id of the flight the device is getting
+- **HandlerType**  Indicates the kind of content (app, driver, windows patch, etc.)
+- **RevisionNumber**  Identifies the revision number of this specific piece of content
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
+- **SystemBIOSMajorRelease**  Major release version of the system bios
+- **SystemBIOSMinorRelease**  Minor release version of the system bios
+- **UpdateId**  Identifier associated with the specific piece of content
+- **WUDeviceID**  Unique device id controlled by the software distribution client
+
+
+### SoftwareUpdateClientTelemetry.Download
+
+Download process event for target update on Windows Update client. See the EventScenario field for specifics (started/failed/succeeded).
+
+The following fields are available:
+
+- **ActiveDownloadTime**  Number of seconds the update was actively being downloaded.
+- **AppXBlockHashFailures**  Indicates the number of blocks that failed hash validation during download.
+- **AppXBlockHashValidationFailureCount**  A count of the number of blocks that have failed validation after being downloaded.
+- **AppXDownloadScope**  Indicates the scope of the download for application content.
+- **AppXScope**  Indicates the scope of the app download.
+- **BiosFamily**  The family of the BIOS (Basic Input Output System).
+- **BiosName**  The name of the device BIOS.
+- **BiosReleaseDate**  The release date of the device BIOS.
+- **BiosSKUNumber**  The sku number of the device BIOS.
+- **BIOSVendor**  The vendor of the BIOS.
+- **BiosVersion**  The version of the BIOS.
+- **BundleBytesDownloaded**  Number of bytes downloaded for the specific content bundle.
+- **BundleId**  Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **BundleRepeatFailCount**  Indicates whether this particular update bundle previously failed.
+- **BundleRepeatFailFlag**  Indicates whether this particular update bundle previously failed to download.
+- **BundleRevisionNumber**  Identifies the revision number of the content bundle.
+- **BytesDownloaded**  Number of bytes that were downloaded for an individual piece of content (not the entire bundle).
+- **CachedEngineVersion**  The version of the “Self-Initiated Healing” (SIH) engine that is cached on the device, if applicable.
+- **CallerApplicationName**  The name provided by the caller who initiated API calls into the software distribution client.
+- **CbsDownloadMethod**  Indicates whether the download was a full- or a partial-file download.
+- **CbsMethod**  The method used for downloading the update content related to the Component Based Servicing (CBS) technology.
+- **CDNCountryCode**  Two letter country abbreviation for the Content Distribution Network (CDN) location.
+- **CDNId**  ID which defines which CDN the software distribution client downloaded the content from.
+- **ClientVersion**  The version number of the software distribution client.
+- **CommonProps**  A bitmask for future flags associated with the Windows Update client behavior.
+- **ConnectTime**  Indicates the cumulative amount of time (in seconds) it took to establish the connection for all updates in an update bundle.
+- **CurrentMobileOperator**  The mobile operator the device is currently connected to.
+- **DeviceModel**  The model of the device.
+- **DownloadPriority**  Indicates whether a download happened at background, normal, or foreground priority.
+- **DownloadProps**  Information about the download operation properties in the form of a bitmask.
+- **DownloadScenarioId**  A unique ID for a given download, used to tie together Windows Update and Delivery Optimizer events.
+- **DownloadType**  Differentiates the download type of “Self-Initiated Healing” (SIH) downloads between Metadata and Payload downloads.
+- **EventInstanceID**  A globally unique identifier for event instance.
+- **EventScenario**  Indicates the purpose of sending this event - whether because the software distribution just started downloading content, or whether it was cancelled, succeeded, or failed.
+- **EventType**  Possible values are Child, Bundle, or Driver.
+- **ExtendedStatusCode**  Secondary error code for certain scenarios where StatusCode wasn't specific enough.
+- **FeatureUpdatePause**  Indicates whether feature OS updates are paused on the device.
+- **FlightBranch**  The branch that a device is on if participating in flighting (pre-release builds).
+- **FlightBuildNumber**  If this download was for a flight (pre-release build), this indicates the build number of that flight.
+- **FlightId**  The specific ID of the flight (pre-release build) the device is getting.
+- **FlightRing**  The ring (speed of getting builds) that a device is on if participating in flighting (pre-release builds).
+- **HandlerType**  Indicates what kind of content is being downloaded (app, driver, windows patch, etc.).
+- **HardwareId**  If this download was for a driver targeted to a particular device model, this ID indicates the model of the device.
+- **HomeMobileOperator**  The mobile operator that the device was originally intended to work with.
+- **HostName**  The hostname URL the content is downloading from.
+- **IPVersion**  Indicates whether the download took place over IPv4 or IPv6.
+- **IsDependentSet**  Indicates whether a driver is a part of a larger System Hardware/Firmware Update
+- **IsWUfBDualScanEnabled**  Indicates if Windows Update for Business dual scan is enabled on the device.
+- **IsWUfBEnabled**  Indicates if Windows Update for Business is enabled on the device.
+- **NetworkCost**  A flag indicating the cost of the network (congested, fixed, variable, over data limit, roaming, etc.) used for downloading the update content.
+- **NetworkCostBitMask**  Indicates what kind of network the device is connected to (roaming, metered, over data cap, etc.)
+- **NetworkRestrictionStatus**  More general version of NetworkCostBitMask, specifying whether Windows considered the current network to be "metered."
+- **PackageFullName**  The package name of the content.
+- **PhonePreviewEnabled**  Indicates whether a phone was opted-in to getting preview builds, prior to flighting (pre-release builds) being introduced.
+- **PostDnldTime**  Time taken (in seconds) to signal download completion after the last job has completed downloading payload.
+- **ProcessName**  The process name of the caller who initiated API calls, in the event where CallerApplicationName was not provided.
+- **QualityUpdatePause**  Indicates whether quality OS updates are paused on the device.
+- **Reason**  A 32-bit integer representing the reason the update is blocked from being downloaded in the background.
+- **RegulationResult**  The result code (HResult) of the last attempt to contact the regulation web service for download regulation of update content.
+- **RelatedCV**  The previous Correlation Vector that was used before swapping with a new one.
+- **RepeatFailCount**  Indicates whether this specific content has previously failed.
+- **RepeatFailFlag**  Indicates whether this specific content previously failed to download.
+- **RevisionNumber**  The revision number of the specified piece of content.
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
+- **Setup360Phase**  Identifies the active phase of the upgrade download if the current download is for an Operating System upgrade.
+- **ShippingMobileOperator**  The mobile operator linked to the device when the device shipped.
+- **SizeCalcTime**  Time taken (in seconds) to calculate the total download size of the payload.
+- **StatusCode**  Indicates the result of a Download event (success, cancellation, failure code HResult).
+- **SystemBIOSMajorRelease**  Major version of the BIOS.
+- **SystemBIOSMinorRelease**  Minor version of the BIOS.
+- **TargetGroupId**  For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
+- **TargetingVersion**  For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
+- **TargetMetadataVersion**  The version of the currently downloading (or most recently downloaded) package.
+- **ThrottlingServiceHResult**  Result code (success/failure) while contacting a web service to determine whether this device should download content yet.
+- **TimeToEstablishConnection**  Time (in milliseconds) it took to establish the connection prior to beginning downloaded.
+- **TotalExpectedBytes**  The total count of bytes that the download is expected to be.
+- **UpdateId**  An identifier associated with the specific piece of content.
+- **UpdateID**  An identifier associated with the specific piece of content.
+- **UpdateImportance**  Indicates whether a piece of content was marked as Important, Recommended, or Optional.
+- **UsedDO**  Whether the download used the delivery optimization service.
+- **UsedSystemVolume**  Indicates whether the content was downloaded to the device's main system storage drive, or an alternate storage drive.
+- **WUDeviceID**  The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+
+
+### SoftwareUpdateClientTelemetry.DownloadCheckpoint
+
+This event provides a checkpoint between each of the Windows Update download phases for UUP content
+
+The following fields are available:
+
+- **CallerApplicationName**  The name provided by the caller who initiated API calls into the software distribution client
+- **ClientVersion**  The version number of the software distribution client
+- **EventScenario**  Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed
+- **EventType**  Possible values are "Child", "Bundle", "Relase" or "Driver"
+- **ExtendedStatusCode**  Secondary error code for certain scenarios where StatusCode wasn't specific enough
+- **FileId**  A hash that uniquely identifies a file
+- **FileName**  Name of the downloaded file
+- **FlightId**  The unique identifier for each flight
+- **RelatedCV**  The previous Correlation Vector that was used before swapping with a new one
+- **RevisionNumber**  Unique revision number of Update
+- **ServiceGuid**  An ID which represents which service the software distribution client is checking for content (Windows Update, Microsoft Store, etc.)
+- **StatusCode**  Indicates the result of a CheckForUpdates event (success, cancellation, failure code HResult)
+- **UpdateId**  Unique Update ID
+- **WUDeviceID**  The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
+
+
+### SoftwareUpdateClientTelemetry.DownloadHeartbeat
+
+This event allows tracking of ongoing downloads and contains data to explain the current state of the download
+
+The following fields are available:
+
+- **BytesTotal**  Total bytes to transfer for this content
+- **BytesTransferred**  Total bytes transferred for this content at the time of heartbeat
+- **CallerApplicationName**  Name provided by the caller who initiated API calls into the software distribution client
+- **ClientVersion**  The version number of the software distribution client
+- **ConnectionStatus**  Indicates the connectivity state of the device at the time of heartbeat
+- **CurrentError**  Last (transient) error encountered by the active download
+- **DownloadFlags**  Flags indicating if power state is ignored
+- **DownloadState**  Current state of the active download for this content (queued, suspended, or progressing)
+- **EventType**  Possible values are "Child", "Bundle", or "Driver"
+- **FlightId**  The unique identifier for each flight
+- **IsNetworkMetered**  Indicates whether Windows considered the current network to be ?metered"
+- **MOAppDownloadLimit**  Mobile operator cap on size of application downloads, if any
+- **MOUpdateDownloadLimit**  Mobile operator cap on size of operating system update downloads, if any
+- **PowerState**  Indicates the power state of the device at the time of heartbeart (DC, AC, Battery Saver, or Connected Standby)
+- **RelatedCV**  The previous correlation vector that was used by the client, before swapping with a new one
+- **ResumeCount**  Number of times this active download has resumed from a suspended state
+- **RevisionNumber**  Identifies the revision number of this specific piece of content
+- **ServiceGuid**  Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc)
+- **SuspendCount**  Number of times this active download has entered a suspended state
+- **SuspendReason**  Last reason for why this active download entered a suspended state
+- **UpdateId**  Identifier associated with the specific piece of content
+- **WUDeviceID**  Unique device id controlled by the software distribution client
+
+
+### SoftwareUpdateClientTelemetry.Install
+
+This event sends tracking data about the software distribution client installation of the content for that update, to help keep Windows up to date.
+
+The following fields are available:
+
+- **BiosFamily**  The family of the BIOS (Basic Input Output System).
+- **BiosName**  The name of the device BIOS.
+- **BiosReleaseDate**  The release date of the device BIOS.
+- **BiosSKUNumber**  The sku number of the device BIOS.
+- **BIOSVendor**  The vendor of the BIOS.
+- **BiosVersion**  The version of the BIOS.
+- **BundleId**  Identifier associated with the specific content bundle; should not be all zeros if the bundleID was found.
+- **BundleRepeatFailCount**  Indicates whether this particular update bundle has previously failed.
+- **BundleRepeatFailFlag**  Indicates whether this particular update bundle previously failed to install.
+- **BundleRevisionNumber**  Identifies the revision number of the content bundle.
+- **CallerApplicationName**  The name provided by the caller who initiated API calls into the software distribution client.
+- **ClientVersion**  The version number of the software distribution client.
+- **CommonProps**  A bitmask for future flags associated with the Windows Update client behavior. No value is currently reported in this field. Expected value for this field is 0.
+- **CSIErrorType**  The stage of CBS installation where it failed.
+- **CurrentMobileOperator**  The mobile operator to which the device is currently connected.
+- **DeploymentProviderMode**  The mode of operation of the update deployment provider.
+- **DeviceModel**  The device model.
+- **DriverPingBack**  Contains information about the previous driver and system state.
+- **DriverRecoveryIds**  The list of identifiers that could be used for uninstalling the drivers if a recovery is required.
+- **EventInstanceID**  A globally unique identifier for event instance.
+- **EventScenario**  Indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
+- **EventType**  Possible values are Child, Bundle, or Driver.
+- **ExtendedErrorCode**  The extended error code.
+- **ExtendedStatusCode**  Secondary error code for certain scenarios where StatusCode is not specific enough.
+- **FeatureUpdatePause**  Indicates whether feature OS updates are paused on the device.
+- **FlightBranch**  The branch that a device is on if participating in the Windows Insider Program.
+- **FlightBuildNumber**  If this installation was for a Windows Insider build, this is the build number of that build.
+- **FlightId**  The specific ID of the Windows Insider build the device is getting.
+- **FlightRing**  The ring that a device is on if participating in the Windows Insider Program.
+- **HandlerType**  Indicates what kind of content is being installed (for example, app, driver, Windows update).
+- **HardwareId**  If this install was for a driver targeted to a particular device model, this ID indicates the model of the device.
+- **HomeMobileOperator**  The mobile operator that the device was originally intended to work with.
+- **InstallProps**  A bitmask for future flags associated with the install operation. No value is currently reported in this field. Expected value for this field is 0.
+- **IntentPFNs**  Intended application-set metadata for atomic update scenarios.
+- **IsDependentSet**  Indicates whether the driver is part of a larger System Hardware/Firmware update.
+- **IsFinalOutcomeEvent**  Indicates whether this event signals the end of the update/upgrade process.
+- **IsFirmware**  Indicates whether this update is a firmware update.
+- **IsSuccessFailurePostReboot**  Indicates whether the update succeeded and then failed after a restart.
+- **IsWUfBDualScanEnabled**  Indicates whether Windows Update for Business dual scan is enabled on the device.
+- **IsWUfBEnabled**  Indicates whether Windows Update for Business is enabled on the device.
+- **MergedUpdate**  Indicates whether the OS update and a BSP update merged for installation.
+- **MsiAction**  The stage of MSI installation where it failed.
+- **MsiProductCode**  The unique identifier of the MSI installer.
+- **PackageFullName**  The package name of the content being installed.
+- **PhonePreviewEnabled**  Indicates whether a phone was getting preview build, prior to flighting being introduced.
+- **ProcessName**  The process name of the caller who initiated API calls, in the event that CallerApplicationName was not provided.
+- **QualityUpdatePause**  Indicates whether quality OS updates are paused on the device.
+- **RelatedCV**  The previous Correlation Vector that was used before swapping with a new one
+- **RepeatFailCount**  Indicates whether this specific piece of content has previously failed.
+- **RepeatFailFlag**  Indicates whether this specific piece of content previously failed to install.
+- **RevisionNumber**  The revision number of this specific piece of content.
+- **ServiceGuid**  An ID which represents which service the software distribution client is installing content for (Windows Update, Microsoft Store, etc.).
+- **Setup360Phase**  If the install is for an operating system upgrade, indicates which phase of the upgrade is underway.
+- **ShippingMobileOperator**  The mobile operator that a device shipped on.
+- **StatusCode**  Indicates the result of an installation event (success, cancellation, failure code HResult).
+- **SystemBIOSMajorRelease**  Major version of the BIOS.
+- **SystemBIOSMinorRelease**  Minor version of the BIOS.
+- **TargetGroupId**  For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
+- **TargetingVersion**  For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
+- **TransactionCode**  The ID that represents a given MSI installation.
+- **UpdateId**  Unique update ID.
+- **UpdateImportance**  Indicates whether a piece of content was marked as Important, Recommended, or Optional.
+- **UsedSystemVolume**  Indicates whether the content was downloaded and then installed from the device's main system storage drive, or an alternate storage drive.
+- **WUDeviceID**  The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+
+
+### SoftwareUpdateClientTelemetry.Revert
+
+Revert event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded).
+
+The following fields are available:
+
+- **BundleId**  Identifier associated with the specific content bundle. Should not be all zeros if the BundleId was found.
+- **BundleRepeatFailCount**  Indicates whether this particular update bundle has previously failed.
+- **BundleRevisionNumber**  Identifies the revision number of the content bundle.
+- **CallerApplicationName**  Name of application making the Windows Update request. Used to identify context of request.
+- **ClientVersion**  Version number of the software distribution client.
+- **CommonProps**  A bitmask for future flags associated with the Windows Update client behavior. There is no value being reported in this field right now. Expected value for this field is 0.
+- **CSIErrorType**  Stage of CBS installation that failed.
+- **DeploymentProviderMode**  The mode of operation of the update deployment provider.
+- **DriverPingBack**  Contains information about the previous driver and system state.
+- **DriverRecoveryIds**  The list of identifiers that could be used for uninstalling the drivers if a recovery is required.
+- **EventInstanceID**  A globally unique identifier for event instance.
+- **EventScenario**  Indicates the purpose of the event (scan started, succeeded, failed, etc.).
+- **EventType**  Event type (Child, Bundle, Release, or Driver).
+- **ExtendedStatusCode**  Secondary status code for certain scenarios where StatusCode is not specific enough.
+- **FeatureUpdatePause**  Indicates whether feature OS updates are paused on the device.
+- **FlightBuildNumber**  Indicates the build number of the flight.
+- **FlightId**  The specific ID of the flight the device is getting.
+- **HandlerType**  Indicates the kind of content (app, driver, windows patch, etc.).
+- **HardwareId**  If this download was for a driver targeted to a particular device model, this ID indicates the model of the device.
+- **IsFinalOutcomeEvent**  Indicates whether this event signals the end of the update/upgrade process.
+- **IsFirmware**  Indicates whether an update was a firmware update.
+- **IsSuccessFailurePostReboot**  Indicates whether an initial success was a failure after a reboot.
+- **IsWUfBDualScanEnabled**  Flag indicating whether WU-for-Business dual scan is enabled on the device.
+- **IsWUfBEnabled**  Flag indicating whether WU-for-Business is enabled on the device.
+- **MergedUpdate**  Indicates whether an OS update and a BSP update were merged for install.
+- **ProcessName**  Process name of the caller who initiated API calls into the software distribution client.
+- **QualityUpdatePause**  Indicates whether quality OS updates are paused on the device.
+- **RelatedCV**  The previous correlation vector that was used by the client before swapping with a new one.
+- **RepeatFailCount**  Indicates whether this specific piece of content has previously failed.
+- **RevisionNumber**  Identifies the revision number of this specific piece of content.
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
+- **StatusCode**  Result code of the event (success, cancellation, failure code HResult).
+- **TargetGroupId**  For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
+- **TargetingVersion**  For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
+- **UpdateId**  The identifier associated with the specific piece of content.
+- **UpdateImportance**  Indicates the importance of a driver, and why it received that importance level (0-Unknown, 1-Optional, 2-Important-DNF, 3-Important-Generic, 4-Important-Other, 5-Recommended).
+- **UsedSystemVolume**  Indicates whether the device's main system storage drive or an alternate storage drive was used.
+- **WUDeviceID**  Unique device ID controlled by the software distribution client.
+
+
+### SoftwareUpdateClientTelemetry.TaskRun
+
+Start event for Server Initiated Healing client. See EventScenario field for specifics (for example, started/completed).
+
+The following fields are available:
+
+- **CallerApplicationName**  Name of application making the Windows Update request. Used to identify context of request.
+- **ClientVersion**  Version number of the software distribution client.
+- **CmdLineArgs**  Command line arguments passed in by the caller.
+- **EventInstanceID**  A globally unique identifier for the event instance.
+- **EventScenario**  Indicates the purpose of the event (scan started, succeeded, failed, etc.).
+- **ServiceGuid**  Identifier for the service to which the software distribution client is connecting (Windows Update, Microsoft Store, etc.).
+- **StatusCode**  Result code of the event (success, cancellation, failure code HResult).
+- **WUDeviceID**  Unique device ID controlled by the software distribution client.
+
+
+### SoftwareUpdateClientTelemetry.Uninstall
+
+Uninstall event for target update on Windows Update Client. See EventScenario field for specifics (for example, Started/Failed/Succeeded).
+
+The following fields are available:
+
+- **BundleId**  The identifier associated with the specific content bundle. This should not be all zeros if the bundleID was found.
+- **BundleRepeatFailCount**  Indicates whether this particular update bundle previously failed.
+- **BundleRevisionNumber**  Identifies the revision number of the content bundle.
+- **CallerApplicationName**  Name of the application making the Windows Update request. Used to identify context of request.
+- **ClientVersion**  Version number of the software distribution client.
+- **CommonProps**  A bitmask for future flags associated with the Windows Update client behavior. There is no value being reported in this field right now. Expected value for this field is 0.
+- **DeploymentProviderMode**  The mode of operation of the Update Deployment Provider.
+- **DriverPingBack**  Contains information about the previous driver and system state.
+- **DriverRecoveryIds**  The list of identifiers that could be used for uninstalling the drivers when a recovery is required.
+- **EventInstanceID**  A globally unique identifier for event instance.
+- **EventScenario**  Indicates the purpose of the event (a scan started, succeded, failed, etc.).
+- **EventType**  Indicates the event type. Possible values are "Child", "Bundle", "Release" or "Driver".
+- **ExtendedStatusCode**  Secondary status code for certain scenarios where StatusCode is not specific enough.
+- **FeatureUpdatePause**  Indicates whether feature OS updates are paused on the device.
+- **FlightBuildNumber**  Indicates the build number of the flight.
+- **FlightId**  The specific ID of the flight the device is getting.
+- **HandlerType**  Indicates the kind of content (app, driver, windows patch, etc.).
+- **HardwareId**  If the download was for a driver targeted to a particular device model, this ID indicates the model of the device.
+- **IsFinalOutcomeEvent**  Indicates whether this event signals the end of the update/upgrade process.
+- **IsFirmware**  Indicates whether an update was a firmware update.
+- **IsSuccessFailurePostReboot**  Indicates whether an initial success was then a failure after a reboot.
+- **IsWUfBDualScanEnabled**  Flag indicating whether WU-for-Business dual scan is enabled on the device.
+- **IsWUfBEnabled**  Flag indicating whether WU-for-Business is enabled on the device.
+- **MergedUpdate**  Indicates whether an OS update and a BSP update were merged for install.
+- **ProcessName**  Process name of the caller who initiated API calls into the software distribution client.
+- **QualityUpdatePause**  Indicates whether quality OS updates are paused on the device.
+- **RelatedCV**  The previous correlation vector that was used by the client before swapping with a new one.
+- **RepeatFailCount**  Indicates whether this specific piece of content previously failed.
+- **RevisionNumber**  Identifies the revision number of this specific piece of content.
+- **ServiceGuid**  A unique identifier for the service that the software distribution client is installing content for (Windows Update, Microsoft Store, etc).
+- **StatusCode**  Result code of the event (success, cancellation, failure code HResult).
+- **TargetGroupId**  For drivers targeted to a specific device model, this ID indicates the distribution group of devices receiving that driver.
+- **TargetingVersion**  For drivers targeted to a specific device model, this is the version number of the drivers being distributed to the device.
+- **UpdateId**  Identifier associated with the specific piece of content.
+- **UpdateImportance**  Indicates the importance of a driver and why it received that importance level (0-Unknown, 1-Optional, 2-Important-DNF, 3-Important-Generic, 4-Important-Other, 5-Recommended).
+- **UsedSystemVolume**  Indicates whether the device’s main system storage drive or an alternate storage drive was used.
+- **WUDeviceID**  Unique device ID controlled by the software distribution client.
+
+
+### SoftwareUpdateClientTelemetry.UpdateDetected
+
+This event sends data about an AppX app that has been updated from the Microsoft Store, including what app needs an update and what version/architecture is required, in order to understand and address problems with apps getting required updates.
+
+The following fields are available:
+
+- **ApplicableUpdateInfo**  Metadata for the updates which were detected as applicable.
+- **CallerApplicationName**  The name provided by the caller who initiated API calls into the software distribution client.
+- **IntentPFNs**  Intended application-set metadata for atomic update scenarios.
+- **NumberOfApplicableUpdates**  The number of updates ultimately deemed applicable to the system after the detection process is complete.
+- **RelatedCV**  The previous Correlation Vector that was used before swapping with a new one.
+- **ServiceGuid**  An ID that represents which service the software distribution client is connecting to (Windows Update, Microsoft Store, etc.).
+- **WUDeviceID**  The unique device ID controlled by the software distribution client.
+
+
+### SoftwareUpdateClientTelemetry.UpdateMetadataIntegrity
+
+Ensures Windows Updates are secure and complete. Event helps to identify whether update content has been tampered with and protects against man-in-the-middle attack.
+
+The following fields are available:
+
+- **CallerApplicationName**  Name of application making the Windows Update request. Used to identify context of request.
+- **EndpointUrl**  The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments.
+- **EventScenario**  The purpose of this event, such as scan started, scan succeeded, or scan failed.
+- **ExtendedStatusCode**  Secondary status code for certain scenarios where StatusCode was not specific enough.
+- **LeafCertId**  The integral ID from the FragmentSigning data for the certificate that failed.
+- **ListOfSHA256OfIntermediateCerData**  A semicolon delimited list of base64 encoding of hashes for the Base64CerData in the FragmentSigning data of an intermediate certificate.
+- **MetadataIntegrityMode**  The mode of the transport metadata integrity check. 0 = unknown; 1 = ignore; 2 = audit; 3 = enforce
+- **MetadataSignature**  A base64-encoded string of the signature associated with the update metadata (specified by revision ID).
+- **RawMode**  The raw unparsed mode string from the SLS response. This field is null if not applicable.
+- **RawValidityWindowInDays**  The raw unparsed validity window string in days of the timestamp token. This field is null if not applicable.
+- **RevisionId**  The revision ID for a specific piece of content.
+- **RevisionNumber**  The revision number for a specific piece of content.
+- **ServiceGuid**  Identifies the service to which the software distribution client is connected, Example: Windows Update or Microsoft Store
+- **SHA256OfLeafCerData**  A base64 encoding of the hash for the Base64CerData in the FragmentSigning data of the leaf certificate.
+- **SHA256OfLeafCertPublicKey**  A base64 encoding of the hash of the Base64CertData in the FragmentSigning data of the leaf certificate.
+- **SHA256OfTimestampToken**  An encoded string of the timestamp token.
+- **SignatureAlgorithm**  The hash algorithm for the metadata signature.
+- **SLSPrograms**  A test program to which a device may have opted in. Example: Insider Fast
+- **StatusCode**  Result code of the event (success, cancellation, failure code HResult)
+- **TimestampTokenCertThumbprint**  The thumbprint of the encoded timestamp token.
+- **TimestampTokenId**  The time this was created. It is encoded in a timestamp blob and will be zero if the token is malformed.
+- **UpdateId**  The update ID for a specific piece of content.
+- **ValidityWindowInDays**  The validity window that's in effect when verifying the timestamp.
+
+
+## System reset events
+
+### Microsoft.Windows.SysReset.FlightUninstallCancel
+
+This event indicates the customer has cancelled uninstallation of Windows.
+
+
+
+### Microsoft.Windows.SysReset.FlightUninstallError
+
+This event sends an error code when the Windows uninstallation fails.
+
+The following fields are available:
+
+- **ErrorCode**  Error code for uninstallation failure.
+
+
+### Microsoft.Windows.SysReset.FlightUninstallReboot
+
+This event is sent to signal an upcoming reboot during uninstallation of Windows.
+
+
+
+### Microsoft.Windows.SysReset.FlightUninstallStart
+
+This event indicates that the Windows uninstallation has started.
+
+
+
+### Microsoft.Windows.SysReset.FlightUninstallUnavailable
+
+This event sends diagnostic data when the Windows uninstallation is not available.
+
+The following fields are available:
+
+- **AddedProfiles**  Indicates that new user profiles have been created since the flight was installed.
+- **MissingExternalStorage**  Indicates that the external storage used to install the flight is not available.
+- **MissingInfra**  Indicates that uninstall resources are missing.
+- **MovedProfiles**  Indicates that the user profile has been moved since the flight was installed.
+
+
+### Microsoft.Windows.SysReset.HasPendingActions
+
+This event is sent when users have actions that will block the uninstall of the latest quality update.
+
+
+
+### Microsoft.Windows.SysReset.IndicateLCUWasUninstalled
+
+This event is sent when the registry indicates that the latest cumulative Windows update package has finished uninstalling.
+
+The following fields are available:
+
+- **errorCode**  The error code if there was a failure during uninstallation of the latest cumulative Windows update package.
+
+
+### Microsoft.Windows.SysReset.LCUUninstall
+
+This event is sent when the latest cumulative Windows update was uninstalled on a device.
+
+The following fields are available:
+
+- **errorCode**  An error that occurred while the Windows update package was being uninstalled.
+- **packageName**  The name of the Windows update package that is being uninstalled.
+- **removalTime**  The amount of time it took to uninstall the Windows update package.
+
+
+### Microsoft.Windows.SysReset.PBRBlockedByPolicy
+
+This event is sent when a push-button reset operation is blocked by the System Administrator.
+
+The following fields are available:
+
+- **PBRBlocked**  Reason the push-button reset operation was blocked.
+- **PBRType**  The type of push-button reset operation that was blocked.
+
+
+### Microsoft.Windows.SysReset.PBREngineInitFailed
+
+This event signals a failed handoff between two recovery binaries.
+
+The following fields are available:
+
+- **Operation**  Legacy customer scenario.
+
+
+### Microsoft.Windows.SysReset.PBREngineInitSucceed
+
+This event signals successful handoff between two recovery binaries.
+
+The following fields are available:
+
+- **Operation**  Legacy customer scenario.
+
+
+### Microsoft.Windows.SysReset.PBRFailedOffline
+
+This event reports the error code when recovery fails.
+
+The following fields are available:
+
+- **HRESULT**  Error code for the failure.
+- **PBRType**  The recovery scenario.
+- **SessionID**  The unique ID for the recovery session.
+
+
+### Microsoft.Windows.SystemReset.EsimPresentCheck
+
+This event is sent when a device is checked to see whether it has an embedded SIM (eSIM).
+
+The following fields are available:
+
+- **errorCode**  Any error that occurred while checking for the presence of an embedded SIM.
+- **esimPresent**  Indicates whether an embedded SIM is present on the device.
+- **sessionID**  The ID of this session.
+
+
+### Microsoft.Windows.SystemReset.PBRCorruptionRepairOption
+
+This event sends corruption repair diagnostic data when the PBRCorruptionRepairOption encounters a corruption error.
+
+The following fields are available:
+
+- **cbsSessionOption**  The corruption repair configuration.
+- **errorCode**  The error code encountered.
+- **meteredConnection**  Indicates whether the device is connected to a metered network (wired or WiFi).
+- **sessionID**  The globally unique identifier (GUID) for the session.
+
+
+### Microsoft.Windows.SystemReset.RepairNeeded
+
+This event provides information about whether a system reset needs repair.
+
+The following fields are available:
+
+- **repairNeeded**  Indicates whether there was corruption in the system reset which needs repair.
+- **sessionID**  The ID of this push-button reset session.
+
+
+## UEFI events
+
+### Microsoft.Windows.UEFI.ESRT
+
+This event sends basic data during boot about the firmware loaded or recently installed on the machine. This helps to keep Windows up to date.
+
+The following fields are available:
+
+- **DriverFirmwareFilename**  The firmware file name reported by the device hardware key.
+- **DriverFirmwarePolicy**  The optional version update policy value.
+- **DriverFirmwareStatus**  The firmware status reported by the device hardware key.
+- **DriverFirmwareVersion**  The firmware version reported by the device hardware key.
+- **FirmwareId**  The UEFI (Unified Extensible Firmware Interface) identifier.
+- **FirmwareLastAttemptStatus**  The reported status of the most recent firmware installation attempt, as reported by the EFI System Resource Table (ESRT).
+- **FirmwareLastAttemptVersion**  The version of the most recent attempted firmware installation, as reported by the EFI System Resource Table (ESRT).
+- **FirmwareType**  The UEFI (Unified Extensible Firmware Interface) type.
+- **FirmwareVersion**  The UEFI (Unified Extensible Firmware Interface) version as reported by the EFI System Resource Table (ESRT).
+- **InitiateUpdate**  Indicates whether the system is ready to initiate an update.
+- **LastAttemptDate**  The date of the most recent attempted firmware installation.
+- **LastAttemptStatus**  The result of the most recent attempted firmware installation.
+- **LastAttemptVersion**  The version of the most recent attempted firmware installation.
+- **LowestSupportedFirmwareVersion**  The oldest (lowest) version of firmware supported.
+- **MaxRetryCount**  The maximum number of retries, defined by the firmware class key.
+- **RetryCount**  The number of attempted installations (retries), reported by the driver software key.
+- **Status**  The status returned to the PnP (Plug-and-Play) manager.
+- **UpdateAttempted**  Indicates if installation of the current update has been attempted before.
+
+
+## Update events
+
+### Update360Telemetry.Revert
+
+This event sends data relating to the Revert phase of updating Windows.
+
+The following fields are available:
+
+- **ErrorCode**  The error code returned for the Revert phase.
+- **FlightId**  Unique ID for the flight (test instance version).
+- **ObjectId**  The unique value for each Update Agent mode.
+- **RebootRequired**  Indicates reboot is required.
+- **RelatedCV**  The correlation vector value generated from the latest USO (Update Service Orchestrator) scan.
+- **Result**  The HResult of the event.
+- **RevertResult**  The result code returned for the Revert operation.
+- **ScenarioId**  The ID of the update scenario.
+- **SessionId**  The ID of the update attempt.
+- **UpdateId**  The ID of the update.
+
+
+### Update360Telemetry.UpdateAgentCommit
+
+This event collects information regarding the commit phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop.
+
+The following fields are available:
+
+- **ErrorCode**  The error code returned for the current install phase.
+- **FlightId**  Unique ID for each flight.
+- **ObjectId**  Unique value for each Update Agent mode.
+- **RelatedCV**  Correlation vector value generated from the latest USO scan.
+- **Result**  Outcome of the install phase of the update.
+- **ScenarioId**  Indicates the update scenario.
+- **SessionId**  Unique value for each update attempt.
+- **UpdateId**  Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentDownloadRequest
+
+This event sends data for the download request phase of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to PC and Mobile.
+
+The following fields are available:
+
+- **ContainsSafeOSDUPackage**  Boolean indicating whether Safe DU packages are part of the payload.
+- **DeletedCorruptFiles**  Boolean indicating whether corrupt payload was deleted.
+- **DownloadComplete**  Indicates if the download is complete.
+- **DownloadRequests**  Number of times a download was retried.
+- **ErrorCode**  The error code returned for the current download request phase.
+- **ExtensionName**  Indicates whether the payload is related to Operating System content or a plugin.
+- **FlightId**  Unique ID for each flight.
+- **InternalFailureResult**  Indicates a non-fatal error from a plugin.
+- **ObjectId**  Unique value for each Update Agent mode (same concept as InstanceId for Setup360).
+- **PackageCategoriesSkipped**  Indicates package categories that were skipped, if applicable.
+- **PackageCountOptional**  Number of optional packages requested.
+- **PackageCountRequired**  Number of required packages requested.
+- **PackageCountTotal**  Total number of packages needed.
+- **PackageCountTotalCanonical**  Total number of canonical packages.
+- **PackageCountTotalDiff**  Total number of diff packages.
+- **PackageCountTotalExpress**  Total number of express packages.
+- **PackageCountTotalPSFX**  The total number of PSFX packages.
+- **PackageExpressType**  Type of express package.
+- **PackageSizeCanonical**  Size of canonical packages in bytes.
+- **PackageSizeDiff**  Size of diff packages in bytes.
+- **PackageSizeExpress**  Size of express packages in bytes.
+- **PackageSizePSFX**  The size of PSFX packages, in bytes.
+- **RangeRequestState**  Indicates the range request type used.
+- **RelatedCV**  Correlation vector value generated from the latest USO scan.
+- **Result**  Outcome of the download request phase of update.
+- **SandboxTaggedForReserves**  The sandbox for reserves.
+- **ScenarioId**  Indicates the update scenario.
+- **SessionId**  Unique value for each attempt (same value for initialize, download, install commit phases).
+- **UpdateId**  Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentExpand
+
+This event collects information regarding the expansion phase of the new Unified Update Platform (UUP) update scenario, which is leveraged by both Mobile and Desktop.
+
+The following fields are available:
+
+- **CanonicalRequestedOnError**  Indicates if an error caused a reversion to a different type of compressed update (TRUE or FALSE).
+- **ElapsedTickCount**  Time taken for expand phase.
+- **EndFreeSpace**  Free space after expand phase.
+- **EndSandboxSize**  Sandbox size after expand phase.
+- **ErrorCode**  The error code returned for the current install phase.
+- **FlightId**  Unique ID for each flight.
+- **ObjectId**  Unique value for each Update Agent mode.
+- **RelatedCV**  Correlation vector value generated from the latest USO scan.
+- **ScenarioId**  Indicates the update scenario.
+- **SessionId**  Unique value for each update attempt.
+- **StartFreeSpace**  Free space before expand phase.
+- **StartSandboxSize**  Sandbox size after expand phase.
+- **UpdateId**  Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentInitialize
+
+This event sends data for the initialize phase of updating Windows via the new Unified Update Platform (UUP) scenario, which is applicable to both PCs and Mobile.
+
+The following fields are available:
+
+- **ErrorCode**  The error code returned for the current install phase.
+- **FlightId**  Unique ID for each flight.
+- **FlightMetadata**  Contains the FlightId and the build being flighted.
+- **ObjectId**  Unique value for each Update Agent mode.
+- **RelatedCV**  Correlation vector value generated from the latest USO scan.
+- **Result**  Outcome of the install phase of the update.
+- **ScenarioId**  Indicates the update scenario.
+- **SessionData**  String containing instructions to update agent for processing FODs and DUICs (Null for other scenarios).
+- **SessionId**  Unique value for each update attempt.
+- **UpdateId**  Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentInstall
+
+This event sends data for the install phase of updating Windows.
+
+The following fields are available:
+
+- **ErrorCode**  The error code returned for the current install phase.
+- **ExtensionName**  Indicates whether the payload is related to Operating System content or a plugin.
+- **FlightId**  Unique value for each Update Agent mode (same concept as InstanceId for Setup360).
+- **InternalFailureResult**  Indicates a non-fatal error from a plugin.
+- **ObjectId**  Correlation vector value generated from the latest USO scan.
+- **RelatedCV**  Correlation vector value generated from the latest USO scan.
+- **Result**  The result for the current install phase.
+- **ScenarioId**  Indicates the update scenario.
+- **SessionId**  Unique value for each update attempt.
+- **UpdateId**  Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentMerge
+
+The UpdateAgentMerge event sends data on the merge phase when updating Windows.
+
+The following fields are available:
+
+- **ErrorCode**  The error code returned for the current merge phase.
+- **FlightId**  Unique ID for each flight.
+- **MergeId**  The unique ID to join two update sessions being merged.
+- **ObjectId**  Unique value for each Update Agent mode.
+- **RelatedCV**  Related correlation vector value.
+- **Result**  Outcome of the merge phase of the update.
+- **ScenarioId**  Indicates the update scenario.
+- **SessionId**  Unique value for each attempt.
+- **UpdateId**  Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentMitigationResult
+
+This event sends data indicating the result of each update agent mitigation.
+
+The following fields are available:
+
+- **Applicable**  Indicates whether the mitigation is applicable for the current update.
+- **CommandCount**  The number of command operations in the mitigation entry.
+- **CustomCount**  The number of custom operations in the mitigation entry.
+- **FileCount**  The number of file operations in the mitigation entry.
+- **FlightId**  Unique identifier for each flight.
+- **Index**  The mitigation index of this particular mitigation.
+- **MitigationScenario**  The update scenario in which the mitigation was executed.
+- **Name**  The friendly name of the mitigation.
+- **ObjectId**  Unique value for each Update Agent mode.
+- **OperationIndex**  The mitigation operation index (in the event of a failure).
+- **OperationName**  The friendly name of the mitigation operation (in the event of failure).
+- **RegistryCount**  The number of registry operations in the mitigation entry.
+- **RelatedCV**  The correlation vector value generated from the latest USO scan.
+- **Result**  The HResult of this operation.
+- **ScenarioId**  The update agent scenario ID.
+- **SessionId**  Unique value for each update attempt.
+- **TimeDiff**  The amount of time spent performing the mitigation (in 100-nanosecond increments).
+- **UpdateId**  Unique ID for each Update.
+
+
+### Update360Telemetry.UpdateAgentMitigationSummary
+
+This event sends a summary of all the update agent mitigations available for an this update.
+
+The following fields are available:
+
+- **Applicable**  The count of mitigations that were applicable to the system and scenario.
+- **Failed**  The count of mitigations that failed.
+- **FlightId**  Unique identifier for each flight.
+- **MitigationScenario**  The update scenario in which the mitigations were attempted.
+- **ObjectId**  The unique value for each Update Agent mode.
+- **RelatedCV**  The correlation vector value generated from the latest USO scan.
+- **Result**  The HResult of this operation.
+- **ScenarioId**  The update agent scenario ID.
+- **SessionId**  Unique value for each update attempt.
+- **TimeDiff**  The amount of time spent performing all mitigations (in 100-nanosecond increments).
+- **Total**  Total number of mitigations that were available.
+- **UpdateId**  Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentModeStart
+
+This event sends data for the start of each mode during the process of updating Windows via the new Unified Update Platform (UUP) scenario. Applicable to both PCs and Mobile.
+
+The following fields are available:
+
+- **FlightId**  Unique ID for each flight.
+- **Mode**  Indicates the mode that has started.
+- **ObjectId**  Unique value for each Update Agent mode.
+- **RelatedCV**  Correlation vector value generated from the latest USO scan.
+- **ScenarioId**  Indicates the update scenario.
+- **SessionId**  Unique value for each update attempt.
+- **UpdateId**  Unique ID for each update.
+- **Version**  Version of update
+
+
+### Update360Telemetry.UpdateAgentOneSettings
+
+This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop.
+
+The following fields are available:
+
+- **Count**  The count of applicable OneSettings for the device.
+- **FlightId**  Unique ID for the flight (test instance version).
+- **ObjectId**  The unique value for each Update Agent mode.
+- **Parameters**  The set of name value pair parameters sent to OneSettings to determine if there are any applicable OneSettings.
+- **RelatedCV**  The correlation vector value generated from the latest USO (Update Service Orchestrator) scan.
+- **Result**  The HResult of the event.
+- **ScenarioId**  The ID of the update scenario.
+- **SessionId**  The ID of the update attempt.
+- **UpdateId**  The ID of the update.
+- **Values**  The values sent back to the device, if applicable.
+
+
+### Update360Telemetry.UpdateAgentPostRebootResult
+
+This event collects information for both Mobile and Desktop regarding the post reboot phase of the new Unified Update Platform (UUP) update scenario.
+
+The following fields are available:
+
+- **ErrorCode**  The error code returned for the current post reboot phase.
+- **FlightId**  The specific ID of the Windows Insider build the device is getting.
+- **ObjectId**  Unique value for each Update Agent mode.
+- **PostRebootResult**  Indicates the Hresult.
+- **RelatedCV**  Correlation vector value generated from the latest USO scan.
+- **ScenarioId**  The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate.
+- **SessionId**  Unique value for each update attempt.
+- **UpdateId**  Unique ID for each update.
+
+
+### Update360Telemetry.UpdateAgentReboot
+
+This event sends information indicating that a request has been sent to suspend an update.
+
+The following fields are available:
+
+- **ErrorCode**  The error code returned for the current reboot.
+- **FlightId**  Unique ID for the flight (test instance version).
+- **IsSuspendable**  Indicates whether the update has the ability to be suspended and resumed at the time of reboot. When the machine is rebooted and the update is in middle of Predownload or Install and Setup.exe is running, this field is TRUE, if not its FALSE.
+- **ObjectId**  The unique value for each Update Agent mode.
+- **Reason**  Indicates the HResult why the machine could not be suspended. If it is successfully suspended, the result is 0.
+- **RelatedCV**  The correlation vector value generated from the latest USO (Update Service Orchestrator) scan.
+- **Result**  The HResult of the event.
+- **ScenarioId**  The ID of the update scenario.
+- **SessionId**  The ID of the update attempt.
+- **UpdateId**  The ID of the update.
+- **UpdateState**  Indicates the state of the machine when Suspend is called. For example, Install, Download, Commit.
+
+
+### Update360Telemetry.UpdateAgentSetupBoxLaunch
+
+The UpdateAgent_SetupBoxLaunch event sends data for the launching of the setup box when updating Windows via the new Unified Update Platform (UUP) scenario. This event is only applicable to PCs.
+
+The following fields are available:
+
+- **ContainsExpressPackage**  Indicates whether the download package is express.
+- **FlightId**  Unique ID for each flight.
+- **FreeSpace**  Free space on OS partition.
+- **InstallCount**  Number of install attempts using the same sandbox.
+- **ObjectId**  Unique value for each Update Agent mode.
+- **Quiet**  Indicates whether setup is running in quiet mode.
+- **RelatedCV**  Correlation vector value generated from the latest USO scan.
+- **SandboxSize**  Size of the sandbox.
+- **ScenarioId**  Indicates the update scenario.
+- **SessionId**  Unique value for each update attempt.
+- **SetupMode**  Mode of setup to be launched.
+- **UpdateId**  Unique ID for each Update.
+- **UserSession**  Indicates whether install was invoked by user actions.
+
+
+## Update notification events
+
+### Microsoft.Windows.UpdateNotificationPipeline.UNPCampaignManagerHeartbeat
+
+This event is sent at the start of the CampaignManager event and is intended to be used as a heartbeat.
+
+The following fields are available:
+
+- **CampaignConfigVersion**  Configuration version for the current campaign.
+- **CampaignID**  Currently campaign that is running on Update Notification Pipeline (UNP).
+- **ConfigCatalogVersion**  Current catalog version of UNP.
+- **ContentVersion**  Content version for the current campaign on UNP.
+- **CV**  Correlation vector.
+- **DetectorVersion**  Most recently run detector version for the current campaign on UNP.
+- **GlobalEventCounter**  Client-side counter that indicates the event ordering sent by the user.
+- **PackageVersion**  Current UNP package version.
+
+
+## Upgrade events
+
+### FacilitatorTelemetry.DCATDownload
+
+This event indicates whether devices received additional or critical supplemental content during an OS Upgrade, to help keep Windows up to date and secure.
+
+The following fields are available:
+
+- **DownloadSize**  Download size of payload.
+- **ElapsedTime**  Time taken to download payload.
+- **MediaFallbackUsed**  Used to determine if we used Media CompDBs to figure out package requirements for the upgrade.
+- **ResultCode**  Result returned by the Facilitator DCAT call.
+- **Scenario**  Dynamic update scenario (Image DU, or Setup DU).
+- **Type**  Type of package that was downloaded.
+- **UpdateId**  The ID of the update that was downloaded.
+
+
+### FacilitatorTelemetry.DUDownload
+
+This event returns data about the download of supplemental packages critical to upgrading a device to the next version of Windows.
+
+The following fields are available:
+
+- **PackageCategoriesFailed**  Lists the categories of packages that failed to download.
+- **PackageCategoriesSkipped**  Lists the categories of package downloads that were skipped.
+
+
+### FacilitatorTelemetry.InitializeDU
+
+This event determines whether devices received additional or critical supplemental content during an OS upgrade.
+
+The following fields are available:
+
+- **DCATUrl**  The Delivery Catalog (DCAT) URL we send the request to.
+- **DownloadRequestAttributes**  The attributes we send to DCAT.
+- **ResultCode**  The result returned from the initiation of Facilitator with the URL/attributes.
+- **Scenario**  Dynamic Update scenario (Image DU, or Setup DU).
+- **Url**  The Delivery Catalog (DCAT) URL we send the request to.
+- **Version**  Version of Facilitator.
+
+
+### Setup360Telemetry.Downlevel
+
+This event sends data indicating that the device has started the downlevel phase of the upgrade, to help keep Windows up to date and secure.
+
+The following fields are available:
+
+- **ClientId**  If using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but it can be overwritten by the caller to a unique value.
+- **FlightData**  Unique value that identifies the flight.
+- **HostOSBuildNumber**  The build number of the downlevel OS.
+- **HostOsSkuName**  The operating system edition which is running Setup360 instance (downlevel OS).
+- **InstanceId**  A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId**  In the Windows Update scenario, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended**  More detailed information about phase/action when the potential failure occurred.
+- **Setup360Mode**  The phase of Setup360 (for example, Predownload, Install, Finalize, Rollback).
+- **Setup360Result**  The result of Setup360 (HRESULT used to diagnose errors).
+- **Setup360Scenario**  The Setup360 flow type (for example, Boot, Media, Update, MCT).
+- **SetupVersionBuildNumber**  The build number of Setup360 (build number of the target OS).
+- **State**  Exit state of given Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId**  An ID that uniquely identifies a group of events.
+- **WuId**  This is the Windows Update Client ID. In the Windows Update scenario, this is the same as the clientId.
+
+
+### Setup360Telemetry.Finalize
+
+This event sends data indicating that the device has started the phase of finalizing the upgrade, to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **ClientId**  With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData**  Unique value that identifies the flight.
+- **HostOSBuildNumber**  The build number of the previous OS.
+- **HostOsSkuName**  The OS edition which is running Setup360 instance (previous OS).
+- **InstanceId**  A unique GUID that identifies each instance of setuphost.exe
+- **ReportId**  With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended**  More detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode**  The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result**  The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
+- **Setup360Scenario**  The Setup360 flow type. Example: Boot, Media, Update, MCT.
+- **SetupVersionBuildNumber**  The build number of Setup360 (build number of target OS).
+- **State**  The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId**  ID that uniquely identifies a group of events.
+- **WuId**  This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+
+
+### Setup360Telemetry.OsUninstall
+
+This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10. Specifically, it indicates the outcome of an OS uninstall.
+
+The following fields are available:
+
+- **ClientId**  For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData**  Unique value that identifies the flight.
+- **HostOSBuildNumber**  The build number of the previous OS.
+- **HostOsSkuName**  The OS edition which is running the Setup360 instance (previous OS).
+- **InstanceId**  A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId**  For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
+- **Setup360Extended**  Detailed information about the phase or action when the potential failure occurred.
+- **Setup360Mode**  The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result**  The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
+- **Setup360Scenario**  The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **SetupVersionBuildNumber**  The build number of Setup360 (build number of target OS).
+- **State**  Exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId**  ID that uniquely identifies a group of events.
+- **WuId**  Windows Update client ID.
+
+
+### Setup360Telemetry.PostRebootInstall
+
+This event sends data indicating that the device has invoked the post reboot install phase of the upgrade, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **ClientId**  With Windows Update, this is the Windows Update client ID that is passed to Setup. In Media setup, the default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData**  Unique value that identifies the flight.
+- **HostOSBuildNumber**  The build number of the previous OS.
+- **HostOsSkuName**  The OS edition which is running Setup360 instance (previous OS).
+- **InstanceId**  A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId**  With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended**  Extension of result - more granular information about phase/action when the potential failure happened
+- **Setup360Mode**  The phase of Setup360. Example: Predownload, Install, Finalize, Rollback
+- **Setup360Result**  The result of Setup360. This is an HRESULT error code that's used to diagnose errors.
+- **Setup360Scenario**  The Setup360 flow type. Example: Boot, Media, Update, MCT
+- **SetupVersionBuildNumber**  The build number of Setup360 (build number of target OS).
+- **State**  The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled
+- **TestId**  A string to uniquely identify a group of events.
+- **WuId**  This is the Windows Update Client ID. With Windows Update, this is the same as ClientId.
+
+
+### Setup360Telemetry.PreDownloadQuiet
+
+This event sends data indicating that the device has invoked the predownload quiet phase of the upgrade, to help keep Windows up to date.
+
+The following fields are available:
+
+- **ClientId**  Using Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData**  Unique value that identifies the flight.
+- **HostOSBuildNumber**  The build number of the previous OS.
+- **HostOsSkuName**  The OS edition which is running Setup360 instance (previous operating system).
+- **InstanceId**  A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId**  Using Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended**  Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode**  The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result**  The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
+- **Setup360Scenario**  The Setup360 flow type. Example: Boot, Media, Update, MCT.
+- **SetupVersionBuildNumber**  The build number of Setup360 (build number of target OS).
+- **State**  The exit state of a Setup360 run. Example: succeeded, failed, blocked, canceled.
+- **TestId**  ID that uniquely identifies a group of events.
+- **WuId**  This is the Windows Update Client ID. Using Windows Update, this is the same as the clientId.
+
+
+### Setup360Telemetry.PreDownloadUX
+
+This event sends data regarding OS Updates and Upgrades from Windows 7.X, Windows 8.X, Windows 10 and RS, to help keep Windows up-to-date and secure. Specifically, it indicates the outcome of the PredownloadUX portion of the update process.
+
+The following fields are available:
+
+- **ClientId**  For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData**  In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **HostOSBuildNumber**  The build number of the previous operating system.
+- **HostOsSkuName**  The OS edition which is running the Setup360 instance (previous operating system).
+- **InstanceId**  Unique GUID that identifies each instance of setuphost.exe.
+- **ReportId**  For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
+- **Setup360Extended**  Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode**  The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result**  The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
+- **Setup360Scenario**  The Setup360 flow type. Example: Boot, Media, Update, MCT.
+- **SetupVersionBuildNumber**  The build number of Setup360 (build number of the target OS).
+- **State**  The exit state of the Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId**  ID that uniquely identifies a group of events.
+- **WuId**  Windows Update client ID.
+
+
+### Setup360Telemetry.PreInstallQuiet
+
+This event sends data indicating that the device has invoked the preinstall quiet phase of the upgrade, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **ClientId**  With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData**  Unique value that identifies the flight.
+- **HostOSBuildNumber**  The build number of the previous OS.
+- **HostOsSkuName**  The OS edition which is running Setup360 instance (previous OS).
+- **InstanceId**  A unique GUID that identifies each instance of setuphost.exe
+- **ReportId**  With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended**  Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode**  The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result**  The result of Setup360. This is an HRESULT error code that can be used to diagnose errors.
+- **Setup360Scenario**  Setup360 flow type (Boot, Media, Update, MCT).
+- **SetupVersionBuildNumber**  The build number of Setup360 (build number of target OS).
+- **State**  The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId**  A string to uniquely identify a group of events.
+- **WuId**  This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+
+
+### Setup360Telemetry.PreInstallUX
+
+This event sends data regarding OS updates and upgrades from Windows 7, Windows 8, and Windows 10, to help keep Windows up-to-date.  Specifically, it indicates the outcome of the PreinstallUX portion of the update process.
+
+The following fields are available:
+
+- **ClientId**  For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData**  Unique value that identifies the flight.
+- **HostOSBuildNumber**  The build number of the previous OS.
+- **HostOsSkuName**  The OS edition which is running the Setup360 instance (previous OS).
+- **InstanceId**  A unique GUID that identifies each instance of setuphost.exe.
+- **ReportId**  For Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, this is the GUID for the install.wim.
+- **Setup360Extended**  Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode**  The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result**  The result of Setup360. This is an HRESULT error code that is used to diagnose errors.
+- **Setup360Scenario**  The Setup360 flow type, Example: Boot, Media, Update, MCT.
+- **SetupVersionBuildNumber**  The build number of Setup360 (build number of target OS).
+- **State**  The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId**  A string to uniquely identify a group of events.
+- **WuId**  Windows Update client ID.
+
+
+### Setup360Telemetry.Setup360
+
+This event sends data about OS deployment scenarios, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **ClientId**  Retrieves the upgrade ID. In the Windows Update scenario, this will be the Windows Update client ID. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FieldName**  Retrieves the data point.
+- **FlightData**  Specifies a unique identifier for each group of Windows Insider builds.
+- **InstanceId**  Retrieves a unique identifier for each instance of a setup session.
+- **ReportId**  Retrieves the report ID.
+- **ScenarioId**  Retrieves the deployment scenario.
+- **Value**  Retrieves the value associated with the corresponding FieldName.
+
+
+### Setup360Telemetry.Setup360DynamicUpdate
+
+This event helps determine whether the device received supplemental content during an operating system upgrade, to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **FlightData**  Specifies a unique identifier for each group of Windows Insider builds.
+- **InstanceId**  Retrieves a unique identifier for each instance of a setup session.
+- **Operation**  Facilitator’s last known operation (scan, download, etc.).
+- **ReportId**  ID for tying together events stream side.
+- **ResultCode**  Result returned for the entire setup operation.
+- **Scenario**  Dynamic Update scenario (Image DU, or Setup DU).
+- **ScenarioId**  Identifies the update scenario.
+- **TargetBranch**  Branch of the target OS.
+- **TargetBuild**  Build of the target OS.
+
+
+### Setup360Telemetry.Setup360MitigationResult
+
+This event sends data indicating the result of each setup mitigation.
+
+The following fields are available:
+
+- **Applicable**  TRUE if the mitigation is applicable for the current update.
+- **ClientId**  In the Windows Update scenario, this is the client ID passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **CommandCount**  The number of command operations in the mitigation entry.
+- **CustomCount**  The number of custom operations in the mitigation entry.
+- **FileCount**  The number of file operations in the mitigation entry.
+- **FlightData**  The unique identifier for each flight (test release).
+- **Index**  The mitigation index of this particular mitigation.
+- **InstanceId**  The GUID (Globally Unique ID) that identifies each instance of SetupHost.EXE.
+- **MitigationScenario**  The update scenario in which the mitigation was executed.
+- **Name**  The friendly (descriptive) name of the mitigation.
+- **OperationIndex**  The mitigation operation index (in the event of a failure).
+- **OperationName**  The friendly (descriptive) name of the mitigation operation (in the event of failure).
+- **RegistryCount**  The number of registry operations in the mitigation entry.
+- **ReportId**  In the Windows Update scenario, the Update ID that is passed to Setup. In media setup, this is the GUID for the INSTALL.WIM.
+- **Result**  HResult of this operation.
+- **ScenarioId**  Setup360 flow type.
+- **TimeDiff**  The amount of time spent performing the mitigation (in 100-nanosecond increments).
+
+
+### Setup360Telemetry.Setup360MitigationSummary
+
+This event sends a summary of all the setup mitigations available for this update.
+
+The following fields are available:
+
+- **Applicable**  The count of mitigations that were applicable to the system and scenario.
+- **ClientId**  The Windows Update client ID passed to Setup.
+- **Failed**  The count of mitigations that failed.
+- **FlightData**  The unique identifier for each flight (test release).
+- **InstanceId**  The GUID (Globally Unique ID) that identifies each instance of SetupHost.EXE.
+- **MitigationScenario**  The update scenario in which the mitigations were attempted.
+- **ReportId**  In the Windows Update scenario, the Update ID that is passed to Setup. In media setup, this is the GUID for the INSTALL.WIM.
+- **Result**  HResult of this operation.
+- **ScenarioId**  Setup360 flow type.
+- **TimeDiff**  The amount of time spent performing the mitigation (in 100-nanosecond increments).
+- **Total**  The total number of mitigations that were available.
+
+
+### Setup360Telemetry.Setup360OneSettings
+
+This event collects information regarding the post reboot phase of the new UUP (Unified Update Platform) update scenario; which is leveraged by both Mobile and Desktop.
+
+The following fields are available:
+
+- **ClientId**  The Windows Update client ID passed to Setup.
+- **Count**  The count of applicable OneSettings for the device.
+- **FlightData**  The ID for the flight (test instance version).
+- **InstanceId**  The GUID (Globally-Unique ID) that identifies each instance of setuphost.exe.
+- **Parameters**  The set of name value pair parameters sent to OneSettings to determine if there are any applicable OneSettings.
+- **ReportId**  The Update ID passed to Setup.
+- **Result**  The HResult of the event error.
+- **ScenarioId**  The update scenario ID.
+- **Values**  Values sent back to the device, if applicable.
+
+
+### Setup360Telemetry.UnexpectedEvent
+
+This event sends data indicating that the device has invoked the unexpected event phase of the upgrade, to help keep Windows up to date.
+
+The following fields are available:
+
+- **ClientId**  With Windows Update, this will be the Windows Update client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightData**  Unique value that identifies the flight.
+- **HostOSBuildNumber**  The build number of the previous OS.
+- **HostOsSkuName**  The OS edition which is running Setup360 instance (previous OS).
+- **InstanceId**  A unique GUID that identifies each instance of setuphost.exe
+- **ReportId**  With Windows Update, this is the updateID that is passed to Setup. In media setup, this is the GUID for the install.wim.
+- **Setup360Extended**  Detailed information about the phase/action when the potential failure occurred.
+- **Setup360Mode**  The phase of Setup360. Example: Predownload, Install, Finalize, Rollback.
+- **Setup360Result**  The result of Setup360. This is an HRESULT error code that can be used used to diagnose errors.
+- **Setup360Scenario**  The Setup360 flow type. Example: Boot, Media, Update, MCT.
+- **SetupVersionBuildNumber**  The build number of Setup360 (build number of target OS).
+- **State**  The exit state of a Setup360 run. Example: succeeded, failed, blocked, cancelled.
+- **TestId**  A string to uniquely identify a group of events.
+- **WuId**  This is the Windows Update Client ID. With Windows Update, this is the same as the clientId.
+
+
+## Windows as a Service diagnostic events
+
+### Microsoft.Windows.WaaSMedic.SummaryEvent
+
+Result of the WaaSMedic operation.
+
+The following fields are available:
+
+- **callerApplication**  The name of the calling application.
+- **capsuleCount**  The number of Sediment Pack capsules.
+- **capsuleFailureCount**  The number of capsule failures.
+- **detectionSummary**  Result of each applicable detection that was run.
+- **featureAssessmentImpact**  WaaS Assessment impact for feature updates.
+- **hrEngineBlockReason**  Indicates the reason for stopping WaaSMedic.
+- **hrEngineResult**  Error code from the engine operation.
+- **hrLastSandboxError**  The last error sent by the WaaSMedic sandbox.
+- **initSummary**  Summary data of the initialization method.
+- **isInteractiveMode**  The user started a run of WaaSMedic.
+- **isManaged**  Device is managed for updates.
+- **isWUConnected**  Device is connected to Windows Update.
+- **noMoreActions**  No more applicable diagnostics.
+- **pluginFailureCount**  The number of plugins that have failed.
+- **pluginsCount**  The number of plugins.
+- **qualityAssessmentImpact**  WaaS Assessment impact for quality updates.
+- **remediationSummary**  Result of each operation performed on a device to fix an invalid state or configuration that's preventing the device from getting updates. For example, if Windows Update service is turned off, the fix is to turn the it back on.
+- **usingBackupFeatureAssessment**  Relying on backup feature assessment.
+- **usingBackupQualityAssessment**  Relying on backup quality assessment.
+- **usingCachedFeatureAssessment**  WaaS Medic run did not get OS build age from the network on the previous run.
+- **usingCachedQualityAssessment**  WaaS Medic run did not get OS revision age from the network on the previous run.
+- **versionString**  Version of the WaaSMedic engine.
+- **waasMedicRunMode**  Indicates whether this was a background regular run of the medic or whether it was triggered by a user launching Windows Update Troubleshooter.
+
+
+## Windows Error Reporting events
+
+### Microsoft.Windows.WERVertical.OSCrash
+
+This event sends binary data from the collected dump file wheneveer a bug check occurs, to help keep Windows up to date. The is the OneCore version of this event.
+
+The following fields are available:
+
+- **BootId**  Uint32 identifying the boot number for this device.
+- **BugCheckCode**  Uint64 "bugcheck code" that identifies a proximate cause of the bug check.
+- **BugCheckParameter1**  Uint64 parameter providing additional information.
+- **BugCheckParameter2**  Uint64 parameter providing additional information.
+- **BugCheckParameter3**  Uint64 parameter providing additional information.
+- **BugCheckParameter4**  Uint64 parameter providing additional information.
+- **DumpFileAttributes**  Codes that identify the type of data contained in the dump file
+- **DumpFileSize**  Size of the dump file
+- **IsValidDumpFile**  True if the dump file is valid for the debugger, false otherwise
+- **ReportId**  WER Report Id associated with this bug check (used for finding the corresponding report archive in Watson).
+
+
+### Value
+
+This event returns data about Mean Time to Failure (MTTF) for Windows devices. It is the primary means of estimating reliability problems in Basic Diagnostic reporting with very strong privacy guarantees. Since Basic Diagnostic reporting does not include system up-time, and since that information is important to ensuring the safe and stable operation of Windows, the data provided by this event provides that data in a manner which does not threaten a user’s privacy.
+
+The following fields are available:
+
+- **Algorithm**  The algorithm used to preserve privacy.
+- **DPRange**  The upper bound of the range being measured.
+- **DPValue**  The randomized response returned by the client.
+- **Epsilon**  The level of privacy to be applied.
+- **HistType**  The histogram type if the algorithm is a histogram algorithm.
+- **PertProb**  The probability the entry will be Perturbed if the algorithm chosen is “heavy-hitters”.
+
+
+## Windows Error Reporting MTT events
+
+### Microsoft.Windows.WER.MTT.Denominator
+
+This event provides a denominator to calculate MTTF (mean-time-to-failure) for crashes and other errors, to help keep Windows up to date.
+
+The following fields are available:
+
+- **Value**  Standard UTC emitted DP value structure See [Value](#value).
+
+
+## Windows Hardware Error Architecture events
+
+### WheaProvider.WheaErrorRecord
+
+This event collects data about common platform hardware error recorded by the Windows Hardware Error Architecture (WHEA) mechanism.
+
+The following fields are available:
+
+- **creatorId**  The unique identifier for the entity that created the error record.
+- **errorFlags**  Any flags set on the error record.
+- **notifyType**  The unique identifier for the notification mechanism which reported the error to the operating system.
+- **partitionId**  The unique identifier for the partition on which the hardware error occurred.
+- **platformId**  The unique identifier for the platform on which the hardware error occurred.
+- **record**  A collection of binary data containing the full error record.
+- **recordId**  The identifier of the error record.
+- **sectionFlags**  The flags for each section recorded in the error record.
+- **sectionTypes**  The unique identifier that represents the type of sections contained in the error record.
+- **severityCount**  The severity of each individual section.
+- **timeStamp**  The error time stamp as recorded in the error record.
+
+
+## Windows Security Center events
+
+### Microsoft.Windows.Security.WSC.DatastoreMigratedVersion
+
+This event provides information about the datastore migration and whether it was successful.
+
+The following fields are available:
+
+- **datastoreisvtype**  The product category of the datastore.
+- **datastoremigrated**  The version of the datastore that was migrated.
+- **status**  The result code of the migration.
+
+
+### Microsoft.Windows.Security.WSC.GetCallerViaWdsp
+
+This event returns data if the registering product EXE (executable file) does not allow COM (Component Object Model) impersonation.
+
+The following fields are available:
+
+- **callerExe**  The registering product EXE that does not support COM impersonation.
+
+
+## Windows Store events
+
+### Microsoft.Windows.StoreAgent.Telemetry.AbortedInstallation
+
+This event is sent when an installation or update is canceled by a user or the system and is used to help keep Windows Apps up to date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames**  The names of all packages to be downloaded and installed.
+- **AttemptNumber**  Number of retry attempts before it was canceled.
+- **BundleId**  The Item Bundle ID.
+- **CategoryId**  The Item Category ID.
+- **ClientAppId**  The identity of the app that initiated this operation.
+- **HResult**  The result code of the last action performed before this operation.
+- **IsBundle**  Is this a bundle?
+- **IsInteractive**  Was this requested by a user?
+- **IsMandatory**  Was this a mandatory update?
+- **IsRemediation**  Was this a remediation install?
+- **IsRestore**  Is this automatically restoring a previously acquired product?
+- **IsUpdate**  Flag indicating if this is an update.
+- **ParentBundleId**  The product ID of the parent (if this product is part of a bundle).
+- **PFN**  The product family name of the product being installed.
+- **ProductId**  The identity of the package or packages being installed.
+- **SystemAttemptNumber**  The total number of automatic attempts at installation before it was canceled.
+- **UserAttemptNumber**  The total number of user attempts at installation before it was canceled.
+- **WUContentId**  The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.BeginGetInstalledContentIds
+
+This event is sent when an inventory of the apps installed is started to determine whether updates for those apps are available. It's used to help keep Windows up-to-date and secure.
+
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.BeginUpdateMetadataPrepare
+
+This event is sent when the Store Agent cache is refreshed with any available package updates. It's used to help keep Windows up-to-date and secure.
+
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.CancelInstallation
+
+This event is sent when an app update or installation is canceled while in interactive mode. This can be canceled by the user or the system. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames**  The names of all package or packages to be downloaded and installed.
+- **AttemptNumber**  Total number of installation attempts.
+- **BundleId**  The identity of the Windows Insider build that is associated with this product.
+- **CategoryId**  The identity of the package or packages being installed.
+- **ClientAppId**  The identity of the app that initiated this operation.
+- **IsBundle**  Is this a bundle?
+- **IsInteractive**  Was this requested by a user?
+- **IsMandatory**  Is this a mandatory update?
+- **IsRemediation**  Is this repairing a previous installation?
+- **IsRestore**  Is this an automatic restore of a previously acquired product?
+- **IsUpdate**  Is this a product update?
+- **ParentBundleId**  The product ID of the parent (if this product is part of a bundle).
+- **PFN**  The name of all packages to be downloaded and installed.
+- **PreviousHResult**  The previous HResult code.
+- **PreviousInstallState**  Previous installation state before it was canceled.
+- **ProductId**  The name of the package or packages requested for installation.
+- **RelatedCV**  Correlation Vector of a previous performed action on this product.
+- **SystemAttemptNumber**  Total number of automatic attempts to install before it was canceled.
+- **UserAttemptNumber**  Total number of user attempts to install before it was canceled.
+- **WUContentId**  The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.CompleteInstallOperationRequest
+
+This event is sent at the end of app installations or updates to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **CatalogId**  The Store Product ID of the app being installed.
+- **HResult**  HResult code of the action being performed.
+- **IsBundle**  Is this a bundle?
+- **PackageFamilyName**  The name of the package being installed.
+- **ProductId**  The Store Product ID of the product being installed.
+- **SkuId**  Specific edition of the item being installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndAcquireLicense
+
+This event is sent after the license is acquired when a product is being installed. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames**  Includes a set of package full names for each app that is part of an atomic set.
+- **AttemptNumber**  The total number of attempts to acquire this product.
+- **BundleId**  The identity of the test build (flight) associated with this product.
+- **CategoryId**  The identity of the package or packages being installed.
+- **ClientAppId**  The identity of the app that initiated this operation.
+- **HResult**  HResult code to show the result of the operation (success/failure).
+- **IsBundle**  Is this a bundle?
+- **IsInteractive**  Did the user initiate the installation?
+- **IsMandatory**  Is this a mandatory update?
+- **IsRemediation**  Is this repairing a previous installation?
+- **IsRestore**  Is this happening after a device restore?
+- **IsUpdate**  Is this an update?
+- **ParentBundleId**  The product identifier of the parent if this product is part of a bundle.
+- **PFN**  Product Family Name of the product being installed.
+- **ProductId**  The Store Product ID for the product being installed.
+- **SystemAttemptNumber**  The number of attempts by the system to acquire this product.
+- **UserAttemptNumber**  The number of attempts by the user to acquire this product
+- **WUContentId**  The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndDownload
+
+This event is sent after an app is downloaded to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames**  The name of all packages to be downloaded and installed.
+- **AttemptNumber**  Number of retry attempts before it was canceled.
+- **BundleId**  The identity of the Windows Insider build associated with this product.
+- **CategoryId**  The identity of the package or packages being installed.
+- **ClientAppId**  The identity of the app that initiated this operation.
+- **DownloadSize**  The total size of the download.
+- **ExtendedHResult**  Any extended HResult error codes.
+- **HResult**  The result code of the last action performed.
+- **IsBundle**  Is this a bundle?
+- **IsInteractive**  Is this initiated by the user?
+- **IsMandatory**  Is this a mandatory installation?
+- **IsRemediation**  Is this repairing a previous installation?
+- **IsRestore**  Is this a restore of a previously acquired product?
+- **IsUpdate**  Is this an update?
+- **ParentBundleId**  The parent bundle ID (if it's part of a bundle).
+- **PFN**  The Product Family Name of the app being download.
+- **ProductId**  The Store Product ID for the product being installed.
+- **SystemAttemptNumber**  The number of attempts by the system to download.
+- **UserAttemptNumber**  The number of attempts by the user to download.
+- **WUContentId**  The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndFrameworkUpdate
+
+This event is sent when an app update requires an updated Framework package and the process starts to download it. It is used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **HResult**  The result code of the last action performed before this operation.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndGetInstalledContentIds
+
+This event is sent after sending the inventory of the products installed to determine whether updates for those products are available.  It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **HResult**  The result code of the last action performed before this operation.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndInstall
+
+This event is sent after a product has been installed to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames**  The names of all packages to be downloaded and installed.
+- **AttemptNumber**  The number of retry attempts before it was canceled.
+- **BundleId**  The identity of the build associated with this product.
+- **CategoryId**  The identity of the package or packages being installed.
+- **ClientAppId**  The identity of the app that initiated this operation.
+- **ExtendedHResult**  The extended HResult error code.
+- **HResult**  The result code of the last action performed.
+- **IsBundle**  Is this a bundle?
+- **IsInteractive**  Is this an interactive installation?
+- **IsMandatory**  Is this a mandatory installation?
+- **IsRemediation**  Is this repairing a previous installation?
+- **IsRestore**  Is this automatically restoring a previously acquired product?
+- **IsUpdate**  Is this an update?
+- **ParentBundleId**  The product ID of the parent (if this product is part of a bundle).
+- **PFN**  Product Family Name of the product being installed.
+- **ProductId**  The Store Product ID for the product being installed.
+- **SystemAttemptNumber**  The total number of system attempts.
+- **UserAttemptNumber**  The total number of user attempts.
+- **WUContentId**  The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndScanForUpdates
+
+This event is sent after a scan for product updates to determine if there are packages to install. It's used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **ClientAppId**  The identity of the app that initiated this operation.
+- **HResult**  The result code of the last action performed.
+- **IsApplicability**  Is this request to only check if there are any applicable packages to install?
+- **IsInteractive**  Is this user requested?
+- **IsOnline**  Is the request doing an online check?
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndSearchUpdatePackages
+
+This event is sent after searching for update packages to install. It is used to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames**  The names of all packages to be downloaded and installed.
+- **AttemptNumber**  The total number of retry attempts before it was canceled.
+- **BundleId**  The identity of the build associated with this product.
+- **CategoryId**  The identity of the package or packages being installed.
+- **ClientAppId**  The identity of the app that initiated this operation.
+- **HResult**  The result code of the last action performed.
+- **IsBundle**  Is this a bundle?
+- **IsInteractive**  Is this user requested?
+- **IsMandatory**  Is this a mandatory update?
+- **IsRemediation**  Is this repairing a previous installation?
+- **IsRestore**  Is this restoring previously acquired content?
+- **IsUpdate**  Is this an update?
+- **ParentBundleId**  The product ID of the parent (if this product is part of a bundle).
+- **PFN**  The name of the package or packages requested for install.
+- **ProductId**  The Store Product ID for the product being installed.
+- **SystemAttemptNumber**  The total number of system attempts.
+- **UserAttemptNumber**  The total number of user attempts.
+- **WUContentId**  The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndStageUserData
+
+This event is sent after restoring user data (if any) that needs to be restored following a product install. It is used to keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames**  The name of all packages to be downloaded and installed.
+- **AttemptNumber**  The total number of retry attempts before it was canceled.
+- **BundleId**  The identity of the build associated with this product.
+- **CategoryId**  The identity of the package or packages being installed.
+- **ClientAppId**  The identity of the app that initiated this operation.
+- **HResult**  The result code of the last action performed.
+- **IsBundle**  Is this a bundle?
+- **IsInteractive**  Is this user requested?
+- **IsMandatory**  Is this a mandatory update?
+- **IsRemediation**  Is this repairing a previous installation?
+- **IsRestore**  Is this restoring previously acquired content?
+- **IsUpdate**  Is this an update?
+- **ParentBundleId**  The product ID of the parent (if this product is part of a bundle).
+- **PFN**  The name of the package or packages requested for install.
+- **ProductId**  The Store Product ID for the product being installed.
+- **SystemAttemptNumber**  The total number of system attempts.
+- **UserAttemptNumber**  The total number of system attempts.
+- **WUContentId**  The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.EndUpdateMetadataPrepare
+
+This event is sent after a scan for available app updates to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **HResult**  The result code of the last action performed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentComplete
+
+This event is sent at the end of an app install or update to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **CatalogId**  The name of the product catalog from which this app was chosen.
+- **FailedRetry**  Indicates whether the installation or update retry was successful.
+- **HResult**  The HResult code of the operation.
+- **PFN**  The Package Family Name of the app that is being installed or updated.
+- **ProductId**  The product ID of the app that is being updated or installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.FulfillmentInitiate
+
+This event is sent at the beginning of an app install or update to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **CatalogId**  The name of the product catalog from which this app was chosen.
+- **FulfillmentPluginId**  The ID of the plugin needed to install the package type of the product.
+- **PFN**  The Package Family Name of the app that is being installed or updated.
+- **PluginTelemetryData**  Diagnostic information specific to the package-type plug-in.
+- **ProductId**  The product ID of the app that is being updated or installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.InstallOperationRequest
+
+This event is sent when a product install or update is initiated, to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **BundleId**  The identity of the build associated with this product.
+- **CatalogId**  If this product is from a private catalog, the Store Product ID for the product being installed.
+- **ProductId**  The Store Product ID for the product being installed.
+- **SkuId**  Specific edition ID being installed.
+- **VolumePath**  The disk path of the installation.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.PauseInstallation
+
+This event is sent when a product install or update is paused (either by a user or the system), to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames**  The names of all packages to be downloaded and installed.
+- **AttemptNumber**  The total number of retry attempts before it was canceled.
+- **BundleId**  The identity of the build associated with this product.
+- **CategoryId**  The identity of the package or packages being installed.
+- **ClientAppId**  The identity of the app that initiated this operation.
+- **IsBundle**  Is this a bundle?
+- **IsInteractive**  Is this user requested?
+- **IsMandatory**  Is this a mandatory update?
+- **IsRemediation**  Is this repairing a previous installation?
+- **IsRestore**  Is this restoring previously acquired content?
+- **IsUpdate**  Is this an update?
+- **ParentBundleId**  The product ID of the parent (if this product is part of a bundle).
+- **PFN**  The Product Full Name.
+- **PreviousHResult**  The result code of the last action performed before this operation.
+- **PreviousInstallState**  Previous state before the installation or update was paused.
+- **ProductId**  The Store Product ID for the product being installed.
+- **RelatedCV**  Correlation Vector of a previous performed action on this product.
+- **SystemAttemptNumber**  The total number of system attempts.
+- **UserAttemptNumber**  The total number of user attempts.
+- **WUContentId**  The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.ResumeInstallation
+
+This event is sent when a product install or update is resumed (either by a user or the system), to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **AggregatedPackageFullNames**  The names of all packages to be downloaded and installed.
+- **AttemptNumber**  The number of retry attempts before it was canceled.
+- **BundleId**  The identity of the build associated with this product.
+- **CategoryId**  The identity of the package or packages being installed.
+- **ClientAppId**  The identity of the app that initiated this operation.
+- **HResult**  The result code of the last action performed before this operation.
+- **IsBundle**  Is this a bundle?
+- **IsInteractive**  Is this user requested?
+- **IsMandatory**  Is this a mandatory update?
+- **IsRemediation**  Is this repairing a previous installation?
+- **IsRestore**  Is this restoring previously acquired content?
+- **IsUpdate**  Is this an update?
+- **IsUserRetry**  Did the user initiate the retry?
+- **ParentBundleId**  The product ID of the parent (if this product is part of a bundle).
+- **PFN**  The name of the package or packages requested for install.
+- **PreviousHResult**  The previous HResult error code.
+- **PreviousInstallState**  Previous state before the installation was paused.
+- **ProductId**  The Store Product ID for the product being installed.
+- **RelatedCV**  Correlation Vector for the original install before it was resumed.
+- **ResumeClientId**  The ID of the app that initiated the resume operation.
+- **SystemAttemptNumber**  The total number of system attempts.
+- **UserAttemptNumber**  The total number of user attempts.
+- **WUContentId**  The Windows Update content ID.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.ResumeOperationRequest
+
+This event is sent when a product install or update is resumed by a user or on installation retries, to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **ProductId**  The Store Product ID for the product being installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.SearchForUpdateOperationRequest
+
+This event is sent when searching for update packages to install, to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **CatalogId**  The Store Catalog ID for the product being installed.
+- **ProductId**  The Store Product ID for the product being installed.
+- **SkuId**  Specfic edition of the app being updated.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.StateTransition
+
+Products in the process of being fulfilled (installed or updated) are maintained in a list. This event is sent any time there is a change in a product's fulfillment status (pending, working, paused, cancelled, or complete), to help keep Windows up to date and secure.
+
+The following fields are available:
+
+- **CatalogId**  The ID for the product being installed if the product is from a private catalog, such as the Enterprise catalog.
+- **FulfillmentPluginId**  The ID of the plugin needed to install the package type of the product.
+- **HResult**  The resulting HResult error/success code of this operation.
+- **NewState**  The current fulfillment state of this product.
+- **PFN**  The Package Family Name of the app that is being installed or updated.
+- **PluginLastStage**  The most recent product fulfillment step that the plug-in has reported (different than its state).
+- **PluginTelemetryData**  Diagnostic information specific to the package-type plug-in.
+- **Prevstate**  The previous fulfillment state of this product.
+- **ProductId**  Product ID of the app that is being updated or installed.
+
+
+### Microsoft.Windows.StoreAgent.Telemetry.UpdateAppOperationRequest
+
+This event occurs when an update is requested for an app, to help keep Windows up-to-date and secure.
+
+The following fields are available:
+
+- **PFamN**  The name of the app that is requested for update.
+
+
+## Windows Update CSP events
+
+### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureFailed
+
+This event sends basic telemetry on the failure of the Feature Rollback.
+
+The following fields are available:
+
+- **current**  Result of currency check.
+- **dismOperationSucceeded**  Dism uninstall operation status.
+- **hResult**  Failure error code.
+- **oSVersion**  Build number of the device.
+- **paused**  Indicates whether the device is paused.
+- **rebootRequestSucceeded**  Reboot Configuration Service Provider (CSP) call success status.
+- **sacDevice**  This is the device info.
+- **wUfBConnected**  Result of WUfB connection check.
+
+
+### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureNotApplicable
+
+This event sends basic telemetry on whether Feature Rollback (rolling back features updates) is applicable to a device.
+
+The following fields are available:
+
+- **current**  Result of currency check.
+- **dismOperationSucceeded**  Dism uninstall operation status.
+- **oSVersion**  Build number of the device.
+- **paused**  Indicates whether the device is paused.
+- **rebootRequestSucceeded**  Reboot Configuration Service Provider (CSP) call success status.
+- **sacDevice**  Represents the device info.
+- **wUfBConnected**  Result of WUfB connection check.
+
+
+### Microsoft.Windows.UpdateCsp.ExecuteRollBackFeatureStarted
+
+This event sends basic information indicating that Feature Rollback has started.
+
+
+
+## Windows Update Delivery Optimization events
+
+### Microsoft.OSG.DU.DeliveryOptClient.DownloadCanceled
+
+This event describes when a download was canceled with Delivery Optimization. It's used to understand and address problems regarding downloads.
+
+The following fields are available:
+
+- **background**  Is the download being done in the background?
+- **bytesFromCacheServer**  Bytes received from a cache host.
+- **bytesFromCDN**  The number of bytes received from a CDN source.
+- **bytesFromGroupPeers**  The number of bytes received from a peer in the same group.
+- **bytesFromIntPeers**  The number of bytes received from peers not in the same LAN or in the same group.
+- **bytesFromLinkLocalPeers**  The number of bytes received from local peers.
+- **bytesFromLocalCache**  Bytes copied over from local (on disk) cache.
+- **bytesFromPeers**  The number of bytes received from a peer in the same LAN.
+- **cdnErrorCodes**  A list of CDN connection errors since the last FailureCDNCommunication event.
+- **cdnErrorCounts**  The number of times each error in cdnErrorCodes was encountered.
+- **cdnIp**  The IP Address of the source CDN (Content Delivery Network).
+- **cdnUrl**  The URL of the source CDN (Content Delivery Network).
+- **dataSourcesTotal**  Bytes received per source type, accumulated for the whole session.
+- **errorCode**  The error code that was returned.
+- **experimentId**  When running a test, this is used to correlate events that are part of the same test.
+- **fileID**  The ID of the file being downloaded.
+- **gCurMemoryStreamBytes**  Current usage for memory streaming.
+- **gMaxMemoryStreamBytes**  Maximum usage for memory streaming.
+- **isVpn**  Is the device connected to a Virtual Private Network?
+- **jobID**  Identifier for the Windows Update job.
+- **predefinedCallerName**  The name of the API Caller.
+- **reasonCode**  Reason the action or event occurred.
+- **routeToCacheServer**  The cache server setting, source, and value.
+- **sessionID**  The ID of the file download session.
+- **updateID**  The ID of the update being downloaded.
+- **usedMemoryStream**  TRUE if the download is using memory streaming for App downloads.
+
+
+### Microsoft.OSG.DU.DeliveryOptClient.DownloadCompleted
+
+This event describes when a download has completed with Delivery Optimization. It's used to understand and address problems regarding downloads.
+
+The following fields are available:
+
+- **background**  Is the download a background download?
+- **bytesFromCacheServer**  Bytes received from a cache host.
+- **bytesFromCDN**  The number of bytes received from a CDN source.
+- **bytesFromGroupPeers**  The number of bytes received from a peer in the same domain group.
+- **bytesFromIntPeers**  The number of bytes received from peers not in the same LAN or in the same domain group.
+- **bytesFromLinkLocalPeers**  The number of bytes received from local peers.
+- **bytesFromLocalCache**  Bytes copied over from local (on disk) cache.
+- **bytesFromPeers**  The number of bytes received from a peer in the same LAN.
+- **bytesRequested**  The total number of bytes requested for download.
+- **cacheServerConnectionCount**  Number of connections made to cache hosts.
+- **cdnConnectionCount**  The total number of connections made to the CDN.
+- **cdnErrorCodes**  A list of CDN connection errors since the last FailureCDNCommunication event.
+- **cdnErrorCounts**  The number of times each error in cdnErrorCodes was encountered.
+- **cdnIp**  The IP address of the source CDN.
+- **cdnUrl**  Url of the source Content Distribution Network (CDN).
+- **congestionPrevention**  Indicates a download may have been suspended to prevent network congestion.
+- **dataSourcesTotal**  Bytes received per source type, accumulated for the whole session.
+- **doErrorCode**  The Delivery Optimization error code that was returned.
+- **downlinkBps**  The maximum measured available download bandwidth (in bytes per second).
+- **downlinkUsageBps**  The download speed (in bytes per second).
+- **downloadMode**  The download mode used for this file download session.
+- **downloadModeReason**  Reason for the download.
+- **downloadModeSrc**  Source of the DownloadMode setting.
+- **experimentId**  When running a test, this is used to correlate with other events that are part of the same test.
+- **expiresAt**  The time when the content will expire from the Delivery Optimization Cache.
+- **fileID**  The ID of the file being downloaded.
+- **fileSize**  The size of the file being downloaded.
+- **gCurMemoryStreamBytes**  Current usage for memory streaming.
+- **gMaxMemoryStreamBytes**  Maximum usage for memory streaming.
+- **groupConnectionCount**  The total number of connections made to peers in the same group.
+- **internetConnectionCount**  The total number of connections made to peers not in the same LAN or the same group.
+- **isEncrypted**  TRUE if the file is encrypted and will be decrypted after download.
+- **isThrottled**  Indicates the Event Rate was throttled (event represent aggregated data).
+- **isVpn**  Is the device connected to a Virtual Private Network?
+- **jobID**  Identifier for the Windows Update job.
+- **lanConnectionCount**  The total number of connections made to peers in the same LAN.
+- **linkLocalConnectionCount**  The number of connections made to peers in the same Link-local network.
+- **numPeers**  The total number of peers used for this download.
+- **numPeersLocal**  The total number of local peers used for this download.
+- **predefinedCallerName**  The name of the API Caller.
+- **restrictedUpload**  Is the upload restricted?
+- **routeToCacheServer**  The cache server setting, source, and value.
+- **sessionID**  The ID of the download session.
+- **totalTimeMs**  Duration of the download (in seconds).
+- **updateID**  The ID of the update being downloaded.
+- **uplinkBps**  The maximum measured available upload bandwidth (in bytes per second).
+- **uplinkUsageBps**  The upload speed (in bytes per second).
+- **usedMemoryStream**  TRUE if the download is using memory streaming for App downloads.
+
+
+### Microsoft.OSG.DU.DeliveryOptClient.DownloadPaused
+
+This event represents a temporary suspension of a download with Delivery Optimization. It's used to understand and address problems regarding downloads.
+
+The following fields are available:
+
+- **background**  Is the download a background download?
+- **cdnUrl**  The URL of the source CDN (Content Delivery Network).
+- **errorCode**  The error code that was returned.
+- **experimentId**  When running a test, this is used to correlate with other events that are part of the same test.
+- **fileID**  The ID of the file being paused.
+- **isVpn**  Is the device connected to a Virtual Private Network?
+- **jobID**  Identifier for the Windows Update job.
+- **predefinedCallerName**  The name of the API Caller object.
+- **reasonCode**  The reason for pausing the download.
+- **routeToCacheServer**  The cache server setting, source, and value.
+- **sessionID**  The ID of the download session.
+- **updateID**  The ID of the update being paused.
+
+
+### Microsoft.OSG.DU.DeliveryOptClient.DownloadStarted
+
+This event sends data describing the start of a new download to enable Delivery Optimization. It's used to understand and address problems regarding downloads.
+
+The following fields are available:
+
+- **background**  Indicates whether the download is happening in the background.
+- **bytesRequested**  Number of bytes requested for the download.
+- **cdnUrl**  The URL of the source Content Distribution Network (CDN).
+- **costFlags**  A set of flags representing network cost.
+- **deviceProfile**  Identifies the usage or form factor (such as Desktop, Xbox, or VM).
+- **diceRoll**  Random number used for determining if a client will use peering.
+- **doClientVersion**  The version of the Delivery Optimization client.
+- **doErrorCode**  The Delivery Optimization error code that was returned.
+- **downloadMode**  The download mode used for this file download session (CdnOnly = 0, Lan = 1, Group = 2, Internet = 3, Simple = 99, Bypass = 100).
+- **downloadModeReason**  Reason for the download.
+- **downloadModeSrc**  Source of the DownloadMode setting (KvsProvider = 0, GeoProvider = 1, GeoVerProvider = 2, CpProvider = 3, DiscoveryProvider = 4, RegistryProvider = 5, GroupPolicyProvider = 6, MdmProvider = 7, SettingsProvider = 8, InvalidProviderType = 9).
+- **errorCode**  The error code that was returned.
+- **experimentId**  ID used to correlate client/services calls that are part of the same test during A/B testing.
+- **fileID**  The ID of the file being downloaded.
+- **filePath**  The path to where the downloaded file will be written.
+- **fileSize**  Total file size of the file that was downloaded.
+- **fileSizeCaller**  Value for total file size provided by our caller.
+- **groupID**  ID for the group.
+- **isEncrypted**  Indicates whether the download is encrypted.
+- **isThrottled**  Indicates the Event Rate was throttled (event represent aggregated data).
+- **isVpn**  Indicates whether the device is connected to a Virtual Private Network.
+- **jobID**  The ID of the Windows Update job.
+- **peerID**  The ID for this delivery optimization client.
+- **predefinedCallerName**  Name of the API caller.
+- **routeToCacheServer**  Cache server setting, source, and value.
+- **sessionID**  The ID for the file download session.
+- **setConfigs**  A JSON representation of the configurations that have been set, and their sources.
+- **updateID**  The ID of the update being downloaded.
+- **usedMemoryStream**  Indicates whether the download used memory streaming.
+
+
+### Microsoft.OSG.DU.DeliveryOptClient.FailureCdnCommunication
+
+This event represents a failure to download from a CDN with Delivery Optimization. It's used to understand and address problems regarding downloads.
+
+The following fields are available:
+
+- **cdnHeaders**  The HTTP headers returned by the CDN.
+- **cdnIp**  The IP address of the CDN.
+- **cdnUrl**  The URL of the CDN.
+- **errorCode**  The error code that was returned.
+- **errorCount**  The total number of times this error code was seen since the last FailureCdnCommunication event was encountered.
+- **experimentId**  When running a test, this is used to correlate with other events that are part of the same test.
+- **fileID**  The ID of the file being downloaded.
+- **httpStatusCode**  The HTTP status code returned by the CDN.
+- **isHeadRequest**  The type of  HTTP request that was sent to the CDN. Example: HEAD or GET
+- **peerType**  The type of peer (LAN, Group, Internet, CDN, Cache Host, etc.).
+- **requestOffset**  The byte offset within the file in the sent request.
+- **requestSize**  The size of the range requested from the CDN.
+- **responseSize**  The size of the range response received from the CDN.
+- **sessionID**  The ID of the download session.
+
+
+### Microsoft.OSG.DU.DeliveryOptClient.JobError
+
+This event represents a Windows Update job error. It allows for investigation of top errors.
+
+The following fields are available:
+
+- **cdnIp**  The IP Address of the source CDN (Content Delivery Network).
+- **doErrorCode**  Error code returned for delivery optimization.
+- **errorCode**  The error code returned.
+- **experimentId**  When running a test, this is used to correlate with other events that are part of the same test.
+- **fileID**  The ID of the file being downloaded.
+- **jobID**  The Windows Update job ID.
+
+
+## Windows Update events
+
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentAnalysisSummary
+
+This event collects information regarding the state of devices and drivers on the system following a reboot after the install phase of the new device manifest UUP (Unified Update Platform) update scenario which is used to install a device manifest describing a set of driver packages.
+
+The following fields are available:
+
+- **activated**  Whether the entire device manifest update is considered activated and in use.
+- **analysisErrorCount**  The number of driver packages that could not be analyzed because errors occurred during analysis.
+- **flightId**  Unique ID for each flight.
+- **missingDriverCount**  The number of driver packages delivered by the device manifest that are missing from the system.
+- **missingUpdateCount**  The number of updates in the device manifest that are missing from the system.
+- **objectId**  Unique value for each diagnostics session.
+- **publishedCount**  The number of drivers packages delivered by the device manifest that are published and available to be used on devices.
+- **relatedCV**  Correlation vector value generated from the latest USO scan.
+- **scenarioId**  Indicates the update scenario.
+- **sessionId**  Unique value for each update session.
+- **summary**  A summary string that contains basic information about driver packages that are part of the device manifest and any devices on the system that those driver packages match.
+- **summaryAppendError**  A Boolean indicating if there was an error appending more information to the summary string.
+- **truncatedDeviceCount**  The number of devices missing from the summary string because there is not enough room in the string.
+- **truncatedDriverCount**  The number of driver packages missing from the summary string because there is not enough room in the string.
+- **unpublishedCount**  How many drivers packages that were delivered by the device manifest that are still unpublished and unavailable to be used on devices.
+- **updateId**  The unique ID for each update.
+
+
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentCommit
+
+This event collects information regarding the final commit phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages.
+
+The following fields are available:
+
+- **errorCode**  The error code returned for the current session initialization.
+- **flightId**  The unique identifier for each flight.
+- **objectId**  The unique GUID for each diagnostics session.
+- **relatedCV**  A correlation vector value generated from the latest USO scan.
+- **result**  Outcome of the initialization of the session.
+- **scenarioId**  Identifies the Update scenario.
+- **sessionId**  The unique value for each update session.
+- **updateId**  The unique identifier for each Update.
+
+
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentDownloadRequest
+
+This event collects information regarding the download request phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages.
+
+The following fields are available:
+
+- **deletedCorruptFiles**  Indicates if UpdateAgent found any corrupt payload files and whether the payload was deleted.
+- **errorCode**  The error code returned for the current session initialization.
+- **flightId**  The unique identifier for each flight.
+- **objectId**  Unique value for each Update Agent mode.
+- **packageCountOptional**  Number of optional packages requested.
+- **packageCountRequired**  Number of required packages requested.
+- **packageCountTotal**  Total number of packages needed.
+- **packageCountTotalCanonical**  Total number of canonical packages.
+- **packageCountTotalDiff**  Total number of diff packages.
+- **packageCountTotalExpress**  Total number of express packages.
+- **packageSizeCanonical**  Size of canonical packages in bytes.
+- **packageSizeDiff**  Size of diff packages in bytes.
+- **packageSizeExpress**  Size of express packages in bytes.
+- **rangeRequestState**  Represents the state of the download range request.
+- **relatedCV**  Correlation vector value generated from the latest USO scan.
+- **result**  Result of the download request phase of update.
+- **scenarioId**  The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate.
+- **sessionId**  Unique value for each Update Agent mode attempt.
+- **updateId**  Unique ID for each update.
+
+
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInitialize
+
+This event sends data for initializing a new update session for the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages.
+
+The following fields are available:
+
+- **errorCode**  The error code returned for the current session initialization.
+- **flightId**  The unique identifier for each flight.
+- **flightMetadata**  Contains the FlightId and the build being flighted.
+- **objectId**  Unique value for each Update Agent mode.
+- **relatedCV**  Correlation vector value generated from the latest USO scan.
+- **result**  Result of the initialize phase of the update. 0 = Succeeded, 1 = Failed, 2 = Cancelled, 3 = Blocked, 4 = BlockCancelled.
+- **scenarioId**  The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate.
+- **sessionData**  Contains instructions to update agent for processing FODs and DUICs (Null for other scenarios).
+- **sessionId**  Unique value for each Update Agent mode attempt.
+- **updateId**  Unique ID for each update.
+
+
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentInstall
+
+This event collects information regarding the install phase of the new device manifest UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages.
+
+The following fields are available:
+
+- **errorCode**  The error code returned for the current install phase.
+- **flightId**  The unique identifier for each flight.
+- **objectId**  The unique identifier for each diagnostics session.
+- **relatedCV**  Correlation vector value generated from the latest USO scan.
+- **result**  Outcome of the install phase of the update.
+- **scenarioId**  The unique identifier for the update scenario.
+- **sessionId**  Unique value for each update session.
+- **updateId**  The unique identifier for each update.
+
+
+### Microsoft.Windows.Update.DeviceUpdateAgent.UpdateAgentModeStart
+
+This event sends data for the start of each mode during the process of updating device manifest assets via the UUP (Unified Update Platform) update scenario, which is used to install a device manifest describing a set of driver packages.
+
+The following fields are available:
+
+- **flightId**  The unique identifier for each flight.
+- **mode**  The mode that is starting.
+- **objectId**  The unique value for each diagnostics session.
+- **relatedCV**  Correlation vector value generated from the latest USO scan.
+- **scenarioId**  The scenario ID. Example: MobileUpdate, DesktopLanguagePack, DesktopFeatureOnDemand, or DesktopDriverUpdate.
+- **sessionId**  Unique value for each Update Agent mode attempt.
+- **updateId**  Unique identifier for each update.
+
+
+### Microsoft.Windows.Update.NotificationUx.DialogNotificationToBeDisplayed
+
+This event indicates that a notification dialog box is about to be displayed to user.
+
+The following fields are available:
+
+- **AcceptAutoModeLimit**  The maximum number of days for a device to automatically enter Auto Reboot mode.
+- **AutoToAutoFailedLimit**  The maximum number of days for Auto Reboot mode to fail before the RebootFailed dialog box is shown.
+- **DaysSinceRebootRequired**  Number of days since restart was required.
+- **DeviceLocalTime**  The local time on the device sending the event.
+- **EngagedModeLimit**  The number of days to switch between DTE dialog boxes.
+- **EnterAutoModeLimit**  The maximum number of days for a device to enter Auto Reboot mode.
+- **ETag**  OneSettings versioning value.
+- **IsForcedEnabled**  Indicates whether Forced Reboot mode is enabled for this device.
+- **IsUltimateForcedEnabled**  Indicates whether Ultimate Forced Reboot mode is enabled for this device.
+- **NotificationUxState**  Indicates which dialog box is shown.
+- **NotificationUxStateString**  Indicates which dialog box is shown.
+- **RebootUxState**  Indicates  the state of the restart (Engaged, Auto, Forced, or UltimateForced).
+- **RebootUxStateString**  Indicates the state of the restart (Engaged, Auto, Forced, or UltimateForced).
+- **RebootVersion**  Version of DTE.
+- **SkipToAutoModeLimit**  The minimum length of time to pass in restart pending before a device can be put into auto mode.
+- **UpdateId**  The ID of the update that is pending restart to finish installation.
+- **UpdateRevision**  The revision of the update that is pending restart to finish installation.
+- **UtcTime**  The time the dialog box notification will be displayed, in Coordinated Universal Time.
+
+
+### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootAcceptAutoDialog
+
+This event indicates that the Enhanced Engaged restart "accept automatically" dialog box was displayed.
+
+The following fields are available:
+
+- **DeviceLocalTime**  The local time on the device sending the event.
+- **EnterpriseAttributionValue**  Indicates whether the Enterprise attribution is on in this dialog box.
+- **ETag**  OneSettings versioning value.
+- **ExitCode**  Indicates how users exited the dialog box.
+- **RebootVersion**  Version of DTE.
+- **UpdateId**  The ID of the update that is pending restart to finish installation.
+- **UpdateRevision**  The revision of the update that is pending restart to finish installation.
+- **UserResponseString**  The option that user chose on this dialog box.
+- **UtcTime**  The time that the dialog box was displayed, in Coordinated Universal Time.
+
+
+### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootFailedDialog
+
+This event indicates that the Enhanced Engaged restart "restart failed" dialog box was displayed.
+
+The following fields are available:
+
+- **DeviceLocalTime**  The local time of the device sending the event.
+- **EnterpriseAttributionValue**  Indicates whether the Enterprise attribution is on in this dialog box.
+- **ETag**  OneSettings versioning value.
+- **ExitCode**  Indicates how users exited the dialog box.
+- **RebootVersion**  Version of DTE.
+- **UpdateId**  The ID of the update that is pending restart to finish installation.
+- **UpdateRevision**  The revision of the update that is pending restart to finish installation.
+- **UserResponseString**  The option that the user chose in this dialog box.
+- **UtcTime**  The time that the dialog box was displayed, in Coordinated Universal Time.
+
+
+### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootRebootImminentDialog
+
+This event indicates that the Enhanced Engaged restart "restart imminent" dialog box was displayed.
+
+The following fields are available:
+
+- **DeviceLocalTime**  Time the dialog box was shown on the local device.
+- **EnterpriseAttributionValue**  Indicates whether the Enterprise attribution is on in this dialog box.
+- **ETag**  OneSettings versioning value.
+- **ExitCode**  Indicates how users exited the dialog box.
+- **RebootVersion**  Version of DTE.
+- **UpdateId**  The ID of the update that is pending restart to finish installation.
+- **UpdateRevision**  The revision of the update that is pending restart to finish installation.
+- **UserResponseString**  The option that user chose in this dialog box.
+- **UtcTime**  The time that dialog box was displayed, in Coordinated Universal Time.
+
+
+### Microsoft.Windows.Update.NotificationUx.EnhancedEngagedRebootReminderDialog
+
+This event returns information relating to the Enhanced Engaged reboot reminder dialog that was displayed.
+
+The following fields are available:
+
+- **DeviceLocalTime**  The time at which the reboot reminder dialog was shown (based on the local device time settings).
+- **EnterpriseAttributionValue**  Indicates whether Enterprise attribution is on for this dialog.
+- **ETag**  The OneSettings versioning value.
+- **ExitCode**  Indicates how users exited the reboot reminder dialog box.
+- **RebootVersion**  The version of the DTE (Direct-to-Engaged).
+- **UpdateId**  The ID of the update that is waiting for reboot to finish installation.
+- **UpdateRevision**  The revision of the update that is waiting for reboot to finish installation.
+- **UserResponseString**  The option chosen by the user on the reboot dialog box.
+- **UtcTime**  The time at which the reboot reminder dialog was shown (in UTC).
+
+
+### Microsoft.Windows.Update.NotificationUx.RebootScheduled
+
+Indicates when a reboot is scheduled by the system or a user for a security, quality, or feature update.
+
+The following fields are available:
+
+- **activeHoursApplicable**  Indicates whether an Active Hours policy is present on the device.
+- **IsEnhancedEngagedReboot**  Indicates whether this is an Enhanced Engaged reboot.
+- **rebootArgument**  Argument for the reboot task. It also represents specific reboot related action.
+- **rebootOutsideOfActiveHours**  Indicates whether a restart is scheduled outside of active hours.
+- **rebootScheduledByUser**  Indicates whether the restart was scheduled by user (if not, it was scheduled automatically).
+- **rebootState**  The current state of the restart.
+- **rebootUsingSmartScheduler**  Indicates whether the reboot is scheduled by smart scheduler.
+- **revisionNumber**  Revision number of the update that is getting installed with this restart.
+- **scheduledRebootTime**  Time of the scheduled restart.
+- **scheduledRebootTimeInUTC**  Time of the scheduled restart in Coordinated Universal Time.
+- **updateId**  ID of the update that is getting installed with this restart.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.ActivityRestrictedByActiveHoursPolicy
+
+This event indicates a policy is present that may restrict update activity to outside of active hours.
+
+The following fields are available:
+
+- **activeHoursEnd**  The end of the active hours window.
+- **activeHoursStart**  The start of the active hours window.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.BlockedByActiveHours
+
+This event indicates that update activity was blocked because it is within the active hours window.
+
+The following fields are available:
+
+- **activeHoursEnd**  The end of the active hours window.
+- **activeHoursStart**  The start of the active hours window.
+- **updatePhase**  The current state of the update process.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.BlockedByBatteryLevel
+
+This event indicates that Windows Update activity was blocked due to low battery level.
+
+The following fields are available:
+
+- **batteryLevel**  The current battery charge capacity.
+- **batteryLevelThreshold**  The battery capacity threshold to stop update activity.
+- **updatePhase**  The current state of the update process.
+- **wuDeviceid**  Device ID.
+
+
+### Microsoft.Windows.Update.Orchestrator.DeferRestart
+
+This event indicates that a restart required for installing updates was postponed.
+
+The following fields are available:
+
+- **displayNeededReason**  List of reasons for needing display.
+- **eventScenario**  Indicates the purpose of the event (scan started, succeeded, failed, etc.).
+- **filteredDeferReason**  Applicable filtered reasons why reboot was postponed (such as user active, or low battery).
+- **gameModeReason**  Name of the executable that caused the game mode state check to start.
+- **ignoredReason**  List of reasons that were intentionally ignored.
+- **IgnoreReasonsForRestart**  List of reasons why restart was deferred.
+- **revisionNumber**  Update ID revision number.
+- **systemNeededReason**  List of reasons why system is needed.
+- **updateId**  Update ID.
+- **updateScenarioType**  Update session type.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.Detection
+
+This event indicates that a scan for a Windows Update occurred.
+
+The following fields are available:
+
+- **deferReason**  Reason why the device could not check for updates.
+- **detectionBlockingPolicy**  State of update action.
+- **detectionBlockreason**  The reason detection did not complete.
+- **detectionRetryMode**  Indicates whether we will try to scan again.
+- **errorCode**  The error code returned for the current process.
+- **eventScenario**  End-to-end update session ID, or indicates the purpose of sending this event - whether because the software distribution just started installing content, or whether it was cancelled, succeeded, or failed.
+- **flightID**  The specific ID of the Windows Insider build the device is getting.
+- **interactive**  Indicates whether the session was user initiated.
+- **networkStatus**  Error info
+- **revisionNumber**  Update revision number.
+- **scanTriggerSource**  Source of the triggered scan.
+- **updateId**  Update ID.
+- **updateScenarioType**  Identifies the type of update session being performed.
+- **wuDeviceid**  The unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.DetectionActivity
+
+This event returns data about detected updates, as well as the types of update (optional or recommended). This data helps keep Windows up to date.
+
+The following fields are available:
+
+- **applicableUpdateIdList**  The list of update identifiers.
+- **applicableUpdateList**  The list of available updates.
+- **durationInSeconds**  The amount of time (in seconds) it took for the event to run.
+- **expeditedMode**  Indicates whether Expedited Mode is on.
+- **networkCostPolicy**  The network cost.
+- **scanTriggerSource**  Indicates whether the scan is Interactive or Background.
+- **scenario**  The result code of the event.
+- **scenarioReason**  The reason for the result code (scenario).
+- **seekerUpdateIdList**  The list of “seeker” update identifiers.
+- **seekerUpdateList**  The list of “seeker” updates.
+- **services**  The list of services that were called during update.
+- **wilActivity**  The activity results. See [wilActivity](#wilactivity).
+
+
+### Microsoft.Windows.Update.Orchestrator.DisplayNeeded
+
+This event indicates the reboot was postponed due to needing a display.
+
+The following fields are available:
+
+- **displayNeededReason**  Reason the display is needed.
+- **eventScenario**  Indicates the purpose of sending this event - whether because the software distribution just started checking for content, or whether it was cancelled, succeeded, or failed.
+- **rebootOutsideOfActiveHours**  Indicates whether the reboot was to occur outside of active hours.
+- **revisionNumber**  Revision number of the update.
+- **updateId**  Update ID.
+- **updateScenarioType**  The update session type.
+- **uxRebootstate**  Indicates the exact state of the user experience at the time the required reboot was initiated.
+- **wuDeviceid**  The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue
+
+
+### Microsoft.Windows.Update.Orchestrator.Download
+
+This event sends launch data for a Windows Update download to help keep Windows up to date.
+
+The following fields are available:
+
+- **deferReason**  Reason for download not completing.
+- **errorCode**  An error code represented as a hexadecimal value.
+- **eventScenario**  End-to-end update session ID.
+- **flightID**  The specific ID of the Windows Insider build the device is getting.
+- **interactive**  Indicates whether the session is user initiated.
+- **revisionNumber**  Update revision number.
+- **updateId**  Update ID.
+- **updateScenarioType**  The update session type.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.EscalationRiskLevels
+
+This event is sent during update scan, download, or install, and indicates that the device is at risk of being out-of-date.
+
+The following fields are available:
+
+- **configVersion**  The escalation configuration version on the device.
+- **downloadElapsedTime**  Indicates how long since the download is required on device.
+- **downloadRiskLevel**  At-risk level of download phase.
+- **installElapsedTime**  Indicates how long since the install is required on device.
+- **installRiskLevel**  The at-risk level of install phase.
+- **isSediment**  Assessment of whether is device is at risk.
+- **scanElapsedTime**  Indicates how long since the scan is required on device.
+- **scanRiskLevel**  At-risk level of the scan phase.
+- **wuDeviceid**  Device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.FailedToAddTimeTriggerToScanTask
+
+This event indicated that USO failed to add a trigger time to a task.
+
+The following fields are available:
+
+- **errorCode**  The Windows Update error code.
+- **wuDeviceid**  The Windows Update device ID.
+
+
+### Microsoft.Windows.Update.Orchestrator.FlightInapplicable
+
+This event indicates that the update is no longer applicable to this device.
+
+The following fields are available:
+
+- **EventPublishedTime**  Time when this event was generated.
+- **flightID**  The specific ID of the Windows Insider build.
+- **inapplicableReason**  The reason why the update is inapplicable.
+- **revisionNumber**  Update revision number.
+- **updateId**  Unique Windows Update ID.
+- **updateScenarioType**  Update session type.
+- **UpdateStatus**  Last status of update.
+- **UUPFallBackConfigured**  Indicates whether UUP fallback is configured.
+- **wuDeviceid**  Unique Device ID.
+
+
+### Microsoft.Windows.Update.Orchestrator.InitiatingReboot
+
+This event sends data about an Orchestrator requesting a reboot from power management to help keep Windows up to date.
+
+The following fields are available:
+
+- **EventPublishedTime**  Time of the event.
+- **flightID**  Unique update ID
+- **interactive**  Indicates whether the reboot initiation stage of the update process was entered as a result of user action.
+- **rebootOutsideOfActiveHours**  Indicates whether the reboot was to occur outside of active hours.
+- **revisionNumber**  Revision number of the update.
+- **updateId**  Update ID.
+- **updateScenarioType**  The update session type.
+- **uxRebootstate**  Indicates the exact state of the user experience at the time the required reboot was initiated.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.Install
+
+This event sends launch data for a Windows Update install to help keep Windows up to date.
+
+The following fields are available:
+
+- **batteryLevel**  Current battery capacity in mWh or percentage left.
+- **deferReason**  Reason for install not completing.
+- **errorCode**  The error code reppresented by a hexadecimal value.
+- **eventScenario**  End-to-end update session ID.
+- **flightID**  The ID of the Windows Insider build the device is getting.
+- **flightUpdate**  Indicates whether the update is a Windows Insider build.
+- **ForcedRebootReminderSet**  A boolean value that indicates if a forced reboot will happen for updates.
+- **IgnoreReasonsForRestart**  The reason(s) a Postpone Restart command was ignored.
+- **installCommitfailedtime**  The time it took for a reboot to happen but the upgrade failed to progress.
+- **installRebootinitiatetime**  The time it took for a reboot to be attempted.
+- **interactive**  Identifies if session is user initiated.
+- **minutesToCommit**  The time it took to install updates.
+- **rebootOutsideOfActiveHours**  Indicates whether a reboot is scheduled outside of active hours.
+- **revisionNumber**  Update revision number.
+- **updateId**  Update ID.
+- **updateScenarioType**  The update session type.
+- **uxRebootstate**  Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.LowUptimes
+
+This event is sent if a device is identified as not having sufficient uptime to reliably process updates in order to keep secure.
+
+The following fields are available:
+
+- **availableHistoryMinutes**  The number of minutes available from the local machine activity history.
+- **isLowUptimeMachine**  Is the machine considered low uptime or not.
+- **lowUptimeMinHours**  Current setting for the minimum number of hours needed to not be considered low uptime.
+- **lowUptimeQueryDays**  Current setting for the number of recent days to check for uptime.
+- **uptimeMinutes**  Number of minutes of uptime measured.
+- **wuDeviceid**  Unique device ID for Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.OneshotUpdateDetection
+
+This event returns data about scans initiated through settings UI, or background scans that are urgent; to help keep Windows up to date.
+
+The following fields are available:
+
+- **externalOneshotupdate**  The last time a task-triggered scan was completed.
+- **interactiveOneshotupdate**  The last time an interactive scan was completed.
+- **oldlastscanOneshotupdate**  The last time a scan completed successfully.
+- **wuDeviceid**  The Windows Update Device GUID (Globally-Unique ID).
+
+
+### Microsoft.Windows.Update.Orchestrator.PreShutdownStart
+
+This event is generated before the shutdown and commit operations.
+
+The following fields are available:
+
+- **wuDeviceid**  The unique identifier of a specific device, used to identify how many devices are encountering success or a particular issue.
+
+
+### Microsoft.Windows.Update.Orchestrator.RebootFailed
+
+This event sends information about whether an update required a reboot and reasons for failure, to help keep Windows up to date.
+
+The following fields are available:
+
+- **batteryLevel**  Current battery capacity in mWh or percentage left.
+- **deferReason**  Reason for install not completing.
+- **EventPublishedTime**  The time that the reboot failure occurred.
+- **flightID**  Unique update ID.
+- **rebootOutsideOfActiveHours**  Indicates whether a reboot was scheduled outside of active hours.
+- **RebootResults**  Hex code indicating failure reason. Typically, we expect this to be a specific USO generated hex code.
+- **revisionNumber**  Update revision number.
+- **updateId**  Update ID.
+- **updateScenarioType**  The update session type.
+- **uxRebootstate**  Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.RefreshSettings
+
+This event sends basic data about the version of upgrade settings applied to the system to help keep Windows up to date.
+
+The following fields are available:
+
+- **errorCode**  Hex code for the error message, to allow lookup of the specific error.
+- **settingsDownloadTime**  Timestamp of the last attempt to acquire settings.
+- **settingsETag**  Version identifier for the settings.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.RestoreRebootTask
+
+This event sends data indicating that a reboot task is missing unexpectedly on a device and the task is restored because a reboot is still required, to help keep Windows up to date.
+
+The following fields are available:
+
+- **RebootTaskMissedTimeUTC**  The time when the reboot task was scheduled to run, but did not.
+- **RebootTaskNextTimeUTC**  The time when the reboot task was rescheduled for.
+- **RebootTaskRestoredTime**  Time at which this reboot task was restored.
+- **wuDeviceid**  Device ID for the device on which the reboot is restored.
+
+
+### Microsoft.Windows.Update.Orchestrator.ScanTriggered
+
+This event indicates that Update Orchestrator has started a scan operation.
+
+The following fields are available:
+
+- **interactive**  Indicates whether the scan is interactive.
+- **isDTUEnabled**  Indicates whether DTU (internal abbreviation for Direct Feature Update) channel is enabled on the client system.
+- **isScanPastSla**  Indicates whether the SLA has elapsed for scanning.
+- **isScanPastTriggerSla**  Indicates whether the SLA has elapsed for triggering a scan.
+- **minutesOverScanSla**  Indicates how many minutes the scan exceeded the scan SLA.
+- **minutesOverScanTriggerSla**  Indicates how many minutes the scan exceeded the scan trigger SLA.
+- **scanTriggerSource**  Indicates what caused the scan.
+- **updateScenarioType**  The update session type.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.SeekerUpdateAvailable
+
+This event defines when an optional update is available for the device to help keep Windows up to date.
+
+The following fields are available:
+
+- **flightID**  The unique identifier of the Windows Insider build on this device.
+- **isFeatureUpdate**  Indicates whether the update is a Feature Update.
+- **revisionNumber**  The revision number of the update.
+- **updateId**  The GUID (Globally Unique Identifier) of the update.
+- **wuDeviceid**  The Windows Update device identifier.
+
+
+### Microsoft.Windows.Update.Orchestrator.SeekUpdate
+
+This event occurs when user initiates "seeker" scan. This helps keep Windows up to date.
+
+The following fields are available:
+
+- **flightID**  The ID of the Windows Insider builds on the device.
+- **isFeatureUpdate**  Indicates that the target of the Seek is a feature update.
+- **revisionNumber**  The revision number of the update.
+- **updateId**  The identifier of the update.
+- **wuDeviceid**  The Windows Update device identifier.
+
+
+### Microsoft.Windows.Update.Orchestrator.StickUpdate
+
+This event is sent when the update service orchestrator (USO) indicates the update cannot be superseded by a newer update.
+
+The following fields are available:
+
+- **updateId**  Identifier associated with the specific piece of content.
+- **wuDeviceid**  Unique device ID controlled by the software distribution client.
+
+
+### Microsoft.Windows.Update.Orchestrator.SystemNeeded
+
+This event sends data about why a device is unable to reboot, to help keep Windows up to date.
+
+The following fields are available:
+
+- **eventScenario**  End-to-end update session ID.
+- **rebootOutsideOfActiveHours**  Indicates whether a reboot is scheduled outside of active hours.
+- **revisionNumber**  Update revision number.
+- **systemNeededReason**  List of apps or tasks that are preventing the system from restarting.
+- **updateId**  Update ID.
+- **updateScenarioType**  The update session type.
+- **uxRebootstate**  Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.TerminatedByActiveHours
+
+This event indicates that update activity was stopped due to active hours starting.
+
+The following fields are available:
+
+- **activeHoursEnd**  The end of the active hours window.
+- **activeHoursStart**  The start of the active hours window.
+- **updatePhase**  The current state of the update process.
+- **wuDeviceid**  The device identifier.
+
+
+### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorInvalidSignature
+
+This event is sent when an updater has attempted to register a binary that is not signed by Microsoft.
+
+The following fields are available:
+
+- **updaterCmdLine**  The callback executable for the updater.
+- **updaterId**  The ID of the updater.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.UniversalOrchestratorScheduleWorkInvalidCmd
+
+Event to indicate a critical error with the callback binary requested by the updater
+
+The following fields are available:
+
+- **updaterCmdLine**  The callback executable for the updater.
+- **updaterId**  The ID of the updater.
+- **wuDeviceid**  The Windows Update device identifier.
+
+
+### Microsoft.Windows.Update.Orchestrator.UnstickUpdate
+
+This event is sent when the update service orchestrator (USO) indicates that the update can be superseded by a newer update.
+
+The following fields are available:
+
+- **updateId**  Identifier associated with the specific piece of content.
+- **wuDeviceid**  Unique device ID controlled by the software distribution client.
+
+
+### Microsoft.Windows.Update.Orchestrator.UpdateNotApplicableForReserves
+
+This event reports a critical error when using update reserves for OS updates to help keep Windows up to date.
+
+The following fields are available:
+
+- **updateId**  The GUID (Globally Unique Identifier) of the update.
+- **wuDeviceid**  The Windows Update device identifier.
+
+
+### Microsoft.Windows.Update.Orchestrator.UpdatePolicyCacheRefresh
+
+This event sends data on whether Update Management Policies were enabled on a device, to help keep Windows up to date.
+
+The following fields are available:
+
+- **configuredPoliciescount**  Number of policies on the device.
+- **policiesNamevaluesource**  Policy name and source of policy (group policy, MDM or flight).
+- **policyCacherefreshtime**  Time when policy cache was refreshed.
+- **updateInstalluxsetting**  Indicates whether a user has set policies via a user experience option.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.UpdaterCallbackFailed
+
+This event is sent when an updater failed to execute the registered callback.
+
+The following fields are available:
+
+- **updaterArgument**  The argument to pass to the updater callback.
+- **updaterCmdLine**  The callback executable for the updater.
+- **updaterId**  The ID of the updater.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.UpdateRebootRequired
+
+This event sends data about whether an update required a reboot to help keep Windows up to date.
+
+The following fields are available:
+
+- **flightID**  The specific ID of the Windows Insider build the device is getting.
+- **interactive**  Indicates whether the reboot initiation stage of the update process was entered as a result of user action.
+- **revisionNumber**  Update revision number.
+- **updateId**  Update ID.
+- **updateScenarioType**  The update session type.
+- **uxRebootstate**  Indicates the exact state of the user experience at the time the required reboot was initiated to ensure the correct update process and experience is provided to keep Windows up to date.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.UpdaterMalformedData
+
+This event is sent when a registered updater has missing or corrupted information, to help keep Windows up to date.
+
+The following fields are available:
+
+- **malformedRegValue**  The registry value that contains the malformed or missing entry.
+- **updaterId**  The ID of the updater.
+- **wuDeviceid**  Unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Orchestrator.updateSettingsFlushFailed
+
+This event sends information about an update that encountered problems and was not able to complete.
+
+The following fields are available:
+
+- **errorCode**  The error code encountered.
+- **wuDeviceid**  The ID of the device in which the error occurred.
+
+
+### Microsoft.Windows.Update.Orchestrator.UsoSession
+
+This event represents the state of the USO service at start and completion.
+
+The following fields are available:
+
+- **activeSessionid**  A unique session GUID.
+- **eventScenario**  The state of the update action.
+- **interactive**  Is the USO session interactive?
+- **lastErrorcode**  The last error that was encountered.
+- **lastErrorstate**  The state of the update when the last error was encountered.
+- **sessionType**  A GUID that refers to the update session type.
+- **updateScenarioType**  A descriptive update session type.
+- **wuDeviceid**  The Windows Update device GUID.
+
+
+### Microsoft.Windows.Update.Ux.MusNotification.EnhancedEngagedRebootUxState
+
+This event sends information about the configuration of Enhanced Direct-to-Engaged (eDTE), which includes values for the timing of how eDTE will progress through each phase of the reboot.
+
+The following fields are available:
+
+- **AcceptAutoModeLimit**  The maximum number of days for a device to automatically enter Auto Reboot mode.
+- **AutoToAutoFailedLimit**  The maximum number of days for Auto Reboot mode to fail before a Reboot Failed dialog will be shown.
+- **DeviceLocalTime**  The date and time (based on the device date/time settings) the reboot mode changed.
+- **EngagedModeLimit**  The number of days to switch between DTE (Direct-to-Engaged) dialogs.
+- **EnterAutoModeLimit**  The maximum number of days a device can enter Auto Reboot mode.
+- **ETag**  The Entity Tag that represents the OneSettings version.
+- **IsForcedEnabled**  Identifies whether Forced Reboot mode is enabled for the device.
+- **IsUltimateForcedEnabled**  Identifies whether Ultimate Forced Reboot mode is enabled for the device.
+- **OldestUpdateLocalTime**  The date and time (based on the device date/time settings) this update’s reboot began pending.
+- **RebootUxState**  Identifies the reboot state: Engaged, Auto, Forced, UltimateForced.
+- **RebootVersion**  The version of the DTE (Direct-to-Engaged).
+- **SkipToAutoModeLimit**  The maximum number of days to switch to start while in Auto Reboot mode.
+- **UpdateId**  The ID of the update that is waiting for reboot to finish installation.
+- **UpdateRevision**  The revision of the update that is waiting for reboot to finish installation.
+
+
+### Microsoft.Windows.Update.Ux.MusNotification.RebootNoLongerNeeded
+
+This event is sent when a security update has successfully completed.
+
+The following fields are available:
+
+- **UtcTime**  The Coordinated Universal Time that the restart was no longer needed.
+
+
+### Microsoft.Windows.Update.Ux.MusNotification.RebootScheduled
+
+This event sends basic information about scheduling an update-related reboot, to get security updates and to help keep Windows up-to-date.
+
+The following fields are available:
+
+- **activeHoursApplicable**  Indicates whether Active Hours applies on this device.
+- **IsEnhancedEngagedReboot**  Indicates whether Enhanced reboot was enabled.
+- **rebootArgument**  Argument for the reboot task. It also represents specific reboot related action.
+- **rebootOutsideOfActiveHours**  True, if a reboot is scheduled outside of active hours. False, otherwise.
+- **rebootScheduledByUser**  True, if a reboot is scheduled by user. False, if a reboot is scheduled automatically.
+- **rebootState**  Current state of the reboot.
+- **rebootUsingSmartScheduler**  Indicates that the reboot is scheduled by SmartScheduler.
+- **revisionNumber**  Revision number of the OS.
+- **scheduledRebootTime**  Time scheduled for the reboot.
+- **scheduledRebootTimeInUTC**  Time scheduled for the reboot, in UTC.
+- **updateId**  Identifies which update is being scheduled.
+- **wuDeviceid**  The unique device ID used by Windows Update.
+
+
+### Microsoft.Windows.Update.Ux.MusUpdateSettings.RebootScheduled
+
+This event sends basic information for scheduling a device restart to install security updates. It's used to help keep Windows up-to-date
+
+The following fields are available:
+
+- **activeHoursApplicable**  Is the restart respecting Active Hours?
+- **IsEnhancedEngagedReboot**  TRUE if the reboot path is Enhanced Engaged. Otherwise, FALSE.
+- **rebootArgument**  The arguments that are passed to the OS for the restarted.
+- **rebootOutsideOfActiveHours**  Was the restart scheduled outside of Active Hours?
+- **rebootScheduledByUser**  Was the restart scheduled by the user? If the value is false, the restart was scheduled by the device.
+- **rebootState**  The state of the restart.
+- **rebootUsingSmartScheduler**  TRUE if the reboot should be performed by the Smart Scheduler. Otherwise, FALSE.
+- **revisionNumber**  The revision number of the OS being updated.
+- **scheduledRebootTime**  Time of the scheduled reboot
+- **scheduledRebootTimeInUTC**  Time of the scheduled restart, in Coordinated Universal Time.
+- **updateId**  The Windows Update device GUID.
+- **wuDeviceid**  The Windows Update device GUID.
+
+
+### wilActivity
+
+This event provides a Windows Internal Library context used for Product and Service diagnostics.
+
+The following fields are available:
+
+- **callContext**  The function where the failure occurred.
+- **currentContextId**  The ID of the current call context where the failure occurred.
+- **currentContextMessage**  The message of the current call context where the failure occurred.
+- **currentContextName**  The name of the current call context where the failure occurred.
+- **failureCount**  The number of failures for this failure ID.
+- **failureId**  The ID of the failure that occurred.
+- **failureType**  The type of the failure that occurred.
+- **fileName**  The file name where the failure occurred.
+- **function**  The function where the failure occurred.
+- **hresult**  The HResult of the overall activity.
+- **lineNumber**  The line number where the failure occurred.
+- **message**  The message of the failure that occurred.
+- **module**  The module where the failure occurred.
+- **originatingContextId**  The ID of the originating call context that resulted in the failure.
+- **originatingContextMessage**  The message of the originating call context that resulted in the failure.
+- **originatingContextName**  The name of the originating call context that resulted in the failure.
+- **threadId**  The ID of the thread on which the activity is executing.
+
+
+## Windows Update mitigation events
+
+### Mitigation360Telemetry.MitigationCustom.CleanupSafeOsImages
+
+This event sends data specific to the CleanupSafeOsImages mitigation used for OS Updates.
+
+The following fields are available:
+
+- **ClientId**  The client ID used by Windows Update.
+- **FlightId**  The ID of each Windows Insider build the device received.
+- **InstanceId**  A unique device ID that identifies each update instance.
+- **MitigationScenario**  The update scenario in which the mitigation was executed.
+- **MountedImageCount**  The number of mounted images.
+- **MountedImageMatches**  The number of mounted image matches.
+- **MountedImagesFailed**  The number of mounted images that could not be removed.
+- **MountedImagesRemoved**  The number of mounted images that were successfully removed.
+- **MountedImagesSkipped**  The number of mounted images that were not found.
+- **RelatedCV**  The correlation vector value generated from the latest USO scan.
+- **Result**  HResult of this operation.
+- **ScenarioId**  ID indicating the mitigation scenario.
+- **ScenarioSupported**  Indicates whether the scenario was supported.
+- **SessionId**  Unique value for each update attempt.
+- **UpdateId**  Unique ID for each Windows Update.
+- **WuId**  Unique ID for the Windows Update client.
+
+
+### Mitigation360Telemetry.MitigationCustom.FixAppXReparsePoints
+
+This event sends data specific to the FixAppXReparsePoints mitigation used for OS updates.
+
+The following fields are available:
+
+- **ClientId**  In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **FlightId**  Unique identifier for each flight.
+- **InstanceId**  Unique GUID that identifies each instances of setuphost.exe.
+- **MitigationScenario**  The update scenario in which the mitigation was executed.
+- **RelatedCV**  Correlation vector value generated from the latest USO scan.
+- **ReparsePointsFailed**  Number of reparse points that are corrupted but we failed to fix them.
+- **ReparsePointsFixed**  Number of reparse points that were corrupted and were fixed by this mitigation.
+- **ReparsePointsSkipped**  Number of reparse points that are not corrupted and no action is required.
+- **Result**  HResult of this operation.
+- **ScenarioId**  ID indicating the mitigation scenario.
+- **ScenarioSupported**  Indicates whether the scenario was supported.
+- **SessionId**  Unique value for each update attempt.
+- **UpdateId**  Unique ID for each Update.
+- **WuId**  Unique ID for the Windows Update client.
+
+
+### Mitigation360Telemetry.MitigationCustom.FixupEditionId
+
+This event sends data specific to the FixupEditionId mitigation used for OS updates.
+
+The following fields are available:
+
+- **ClientId**  In the WU scenario, this will be the WU client ID that is passed to Setup. In Media setup, default value is Media360, but can be overwritten by the caller to a unique value.
+- **EditionIdUpdated**  Determine whether EditionId was changed.
+- **FlightId**  Unique identifier for each flight.
+- **InstanceId**  Unique GUID that identifies each instances of setuphost.exe.
+- **MitigationScenario**  The update scenario in which the mitigation was executed.
+- **ProductEditionId**  Expected EditionId value based on GetProductInfo.
+- **ProductType**  Value returned by GetProductInfo.
+- **RegistryEditionId**  EditionId value in the registry.
+- **RelatedCV**  Correlation vector value generated from the latest USO scan.
+- **Result**  HResult of this operation.
+- **ScenarioId**  ID indicating the mitigation scenario.
+- **ScenarioSupported**  Indicates whether the scenario was supported.
+- **SessionId**  Unique value for each update attempt.
+- **UpdateId**  Unique ID for each update.
+- **WuId**  Unique ID for the Windows Update client.
+
+
+## Windows Update Reserve Manager events
+
+### Microsoft.Windows.UpdateReserveManager.BeginScenario
+
+This event is sent when the Update Reserve Manager is called to begin a scenario.
+
+The following fields are available:
+
+- **Flags**  The flags that are passed to the begin scenario function.
+- **HardReserveSize**  The size of the hard reserve.
+- **HardReserveUsedSpace**  The used space in the hard reserve.
+- **OwningScenarioId**  The scenario ID the client that called the begin scenario function.
+- **ReturnCode**  The return code for the begin scenario operation.
+- **ScenarioId**  The scenario ID that is internal to the reserve manager.
+- **SoftReserveSize**  The size of the soft reserve.
+- **SoftReserveUsedSpace**  The amount of soft reserve space that was used.
+
+
+### Microsoft.Windows.UpdateReserveManager.ClearReserve
+
+This event is sent when the Update Reserve Manager clears one of the reserves.
+
+The following fields are available:
+
+- **FinalReserveUsedSpace**  The amount of used space for the reserve after it was cleared.
+- **InitialReserveUsedSpace**  The amount of used space for the reserve before it was cleared.
+- **ReserveId**  The ID of the reserve that needs to be cleared.
+
+
+### Microsoft.Windows.UpdateReserveManager.CommitPendingHardReserveAdjustment
+
+This event is sent when the Update Reserve Manager commits a hard reserve adjustment that was pending.
+
+The following fields are available:
+
+- **FinalAdjustment**  Final adjustment for the hard reserve following the addition or removal of optional content.
+- **InitialAdjustment**  Initial intended adjustment for the hard reserve following the addition or removal of optional content.
+
+
+### Microsoft.Windows.UpdateReserveManager.EndScenario
+
+This event is sent when the Update Reserve Manager ends an active scenario.
+
+The following fields are available:
+
+- **ActiveScenario**  The current active scenario.
+- **Flags**  The flags passed to the end scenario call.
+- **HardReserveSize**  The size of the hard reserve when the end scenario is called.
+- **HardReserveUsedSpace**  The used space in the hard reserve when the end scenario is called.
+- **ReturnCode**  The return code of this operation.
+- **ScenarioId**  The ID of the internal reserve manager scenario.
+- **SoftReserveSize**  The size of the soft reserve when end scenario is called.
+- **SoftReserveUsedSpace**  The amount of the soft reserve used when end scenario is called.
+
+
+### Microsoft.Windows.UpdateReserveManager.FunctionReturnedError
+
+This event is sent when the Update Reserve Manager returns an error from one of its internal functions.
+
+The following fields are available:
+
+- **FailedExpression**  The failed expression that was returned.
+- **FailedFile**  The binary file that contained the failed function.
+- **FailedFunction**  The name of the function that originated the failure.
+- **FailedLine**  The line number of the failure.
+- **ReturnCode**  The return code of the function.
+
+
+### Microsoft.Windows.UpdateReserveManager.InitializeReserves
+
+This event is sent when reserves are initialized on the device.
+
+The following fields are available:
+
+- **FallbackInitUsed**  Indicates whether fallback initialization is used.
+- **FinalUserFreeSpace**  The amount of user free space after initialization.
+- **Flags**  The flags used in the initialization of Update Reserve Manager.
+- **FreeSpaceToLeaveInUpdateScratch**  The amount of space that should be left free after using the reserves.
+- **HardReserveFinalSize**  The final size of the hard reserve.
+- **HardReserveFinalUsedSpace**  The used space in the hard reserve.
+- **HardReserveInitialSize**  The size of the hard reserve after initialization.
+- **HardReserveInitialUsedSpace**  The utilization of the hard reserve after initialization.
+- **HardReserveTargetSize**  The target size that was set for the hard reserve.
+- **InitialUserFreeSpace**  The user free space during initialization.
+- **PostUpgradeFreeSpace**  The free space value passed into the Update Reserve Manager to determine reserve sizing post upgrade.
+- **SoftReserveFinalSize**  The final size of the soft reserve.
+- **SoftReserveFinalUsedSpace**  The used space in the soft reserve.
+- **SoftReserveInitialSize**  The soft reserve size after initialization.
+- **SoftReserveInitialUsedSpace**  The utilization of the soft reserve after initialization.
+- **SoftReserveTargetSize**  The target size that was set for the soft reserve.
+- **TargetUserFreeSpace**  The target user free space that was passed into the reserve manager to determine reserve sizing post upgrade.
+- **UpdateScratchFinalUsedSpace**  The used space in the scratch reserve.
+- **UpdateScratchInitialUsedSpace**  The utilization of the scratch reserve after initialization.
+- **UpdateScratchReserveFinalSize**  The utilization of the scratch reserve after initialization.
+- **UpdateScratchReserveInitialSize**  The size of the scratch reserve after initialization.
+
+
+### Microsoft.Windows.UpdateReserveManager.InitializeUpdateReserveManager
+
+This event returns data about the Update Reserve Manager, including whether it’s been initialized.
+
+The following fields are available:
+
+- **ClientId**  The ID of the caller application.
+- **Flags**  The enumerated flags used to initialize the manager.
+- **FlightId**  The flight ID of the content the calling client is currently operating with.
+- **Offline**  Indicates whether or the reserve manager is called during offline operations.
+- **PolicyPassed**  Indicates whether the machine is able to use reserves.
+- **ReturnCode**  Return code of the operation.
+- **Version**  The version of the Update Reserve Manager.
+
+
+### Microsoft.Windows.UpdateReserveManager.PrepareTIForReserveInitialization
+
+This event is sent when the Update Reserve Manager prepares the Trusted Installer to initialize reserves on the next boot.
+
+The following fields are available:
+
+- **FallbackLogicUsed**  Indicates whether fallback logic was used for initialization.
+- **Flags**  The flags that are passed to the function to prepare the Trusted Installer for reserve initialization.
+
+
+### Microsoft.Windows.UpdateReserveManager.ReevaluatePolicy
+
+This event is sent when the Update Reserve Manager reevaluates policy to determine reserve usage.
+
+The following fields are available:
+
+- **PolicyChanged**  Indicates whether the policy has changed.
+- **PolicyFailedEnum**  The reason why the policy failed.
+- **PolicyPassed**  Indicates whether the policy passed.
+
+
+### Microsoft.Windows.UpdateReserveManager.RemovePendingHardReserveAdjustment
+
+This event is sent when the Update Reserve Manager removes a pending hard reserve adjustment.
+
+
+
+### Microsoft.Windows.UpdateReserveManager.TurnOffReserves
+
+This event is sent when the Update Reserve Manager turns off reserve functionality for certain operations.
+
+The following fields are available:
+
+- **Flags**  Flags used in the turn off reserves function.
+- **HardReserveSize**  The size of the hard reserve when Turn Off is called.
+- **HardReserveUsedSpace**  The amount of space used by the hard reserve when Turn Off is called
+- **ScratchReserveSize**  The size of the scratch reserve when Turn Off is called.
+- **ScratchReserveUsedSpace**  The amount of space used by the scratch reserve when Turn Off is called.
+- **SoftReserveSize**  The size of the soft reserve when Turn Off is called.
+- **SoftReserveUsedSpace**  The amount of the soft reserve used when Turn Off is called.
+
+
+### Microsoft.Windows.UpdateReserveManager.UpdatePendingHardReserveAdjustment
+
+This event is sent when the Update Reserve Manager needs to adjust the size of the hard reserve after the option content is installed.
+
+The following fields are available:
+
+- **ChangeSize**  The change in the hard reserve size based on the addition or removal of optional content.
+- **Disposition**  The parameter for the hard reserve adjustment function.
+- **Flags**  The flags passed to the hard reserve adjustment function.
+- **PendingHardReserveAdjustment**  The final change to the hard reserve size.
+- **UpdateType**  Indicates whether the change is an increase or decrease in the size of the hard reserve.
+
+
+## Winlogon events
+
+### Microsoft.Windows.Security.Winlogon.SetupCompleteLogon
+
+This event signals the completion of the setup process. It happens only once during the first logon.
+
+
+
+## XBOX events
+
+### Microsoft.Xbox.XamTelemetry.AppActivationError
+
+This event indicates whether the system detected an activation error in the app.
+
+The following fields are available:
+
+- **ActivationUri**  Activation URI (Uniform Resource Identifier) used in the attempt to activate the app.
+- **AppId**  The Xbox LIVE Title ID.
+- **AppUserModelId**  The AUMID (Application User Model ID) of the app to activate.
+- **Result**  The HResult error.
+- **UserId**  The Xbox LIVE User ID (XUID).
+
+
+### Microsoft.Xbox.XamTelemetry.AppActivity
+
+This event is triggered whenever the current app state is changed by: launch, switch, terminate, snap, etc.
+
+The following fields are available:
+
+- **AppActionId**  The ID of the application action.
+- **AppCurrentVisibilityState**  The ID of the current application visibility state.
+- **AppId**  The Xbox LIVE Title ID of the app.
+- **AppPackageFullName**  The full name of the application package.
+- **AppPreviousVisibilityState**  The ID of the previous application visibility state.
+- **AppSessionId**  The application session ID.
+- **AppType**  The type ID of the application (AppType_NotKnown, AppType_Era, AppType_Sra, AppType_Uwa).
+- **BCACode**  The BCA (Burst Cutting Area) mark code of the optical disc used to launch the application.
+- **DurationMs**  The amount of time (in milliseconds) since the last application state transition.
+- **IsTrialLicense**  This boolean value is TRUE if the application is on a trial license.
+- **LicenseType**  The type of licensed used to authorize the app (0 - Unknown, 1 - User, 2 - Subscription, 3 - Offline, 4 - Disc).
+- **LicenseXuid**  If the license type is 1 (User), this field contains the XUID (Xbox User ID) of the registered owner of the license.
+- **ProductGuid**  The Xbox product GUID (Globally-Unique ID) of the application.
+- **UserId**  The XUID (Xbox User ID) of the current user.
+
+
+
diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
index da571eeaf2..52f53de9e4 100644
--- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
+++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md
@@ -1,456 +1,445 @@
----
-description: Use this article to make informed decisions about how you can configure diagnostic data in your organization.
-title: Configure Windows diagnostic data in your organization (Windows 10)
-keywords: privacy
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: high
-audience: ITPro
-author: danihalfin
-ms.author: daniha
-manager: dansimp
-ms.collection: M365-security-compliance
-ms.topic: article
-ms.date: 04/04/2018
----
-
-# Configure Windows diagnostic data in your organization
-
-**Applies to**
-
--   Windows 10 Enterprise
--   Windows 10 Mobile
--   Windows Server
-
-At Microsoft, we use Windows diagnostic data to inform our decisions and focus our efforts in providing the most robust, most valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Diagnostic data gives users a voice in the operating system’s development. This guide describes the importance of Windows diagnostic data and how we protect that data. Additionally, it differentiates between diagnostic data and functional data. It also describes the diagnostic data levels that Windows supports. Of course, you can choose how much diagnostic data is shared with Microsoft, and this guide demonstrates how.
-
-To frame a discussion about diagnostic data, it is important to understand Microsoft’s privacy principles. We earn customer trust every day by focusing on six key privacy principles as described at [privacy.microsoft.com](https://privacy.microsoft.com/). These principles guided the implementation of the Windows diagnostic data system in the following ways:
-
--	**Control.** We offer customers control of the diagnostic data they share with us by providing easy-to-use management tools.
--	**Transparency.** We provide information about the diagnostic data that Windows and Windows Server collects so our customers can make informed decisions.
--	**Security.** We encrypt diagnostic data in transit from your device via TLS 1.2, and additionally use certificate pinning to secure the connection.
--	**Strong legal protections.** We respect customers’ local privacy laws and fight for legal protection of their privacy as a fundamental human right.
--	**No content-based targeting.** We take steps to avoid and minimize the collection of customer content, such as the content of files, chats, or emails, through the Windows diagnostic data system.  Customer content inadvertently collected is kept confidential and not used for user targeting.
--	**Benefits to you.** We collect Windows diagnostic data to help provide you with an up-to-date, more secure, reliable and performant product, and to improve Windows for all our customers.
-
-This article applies to Windows and Windows Server diagnostic data only. Other Microsoft or third-party apps, such as System Center Configuration Manager, System Center Endpoint Protection, or System Center Data Protection Manager, might send data to their cloud services in ways that are inconsistent with this guide. Their publishers are responsible for notifying users of their privacy policies, diagnostic data controls, and so on. This article describes the types of diagnostic data we may gather, the ways you might manage it in your organization, and some examples of how diagnostic data can provide you with valuable insights into your enterprise deployments. Microsoft uses the data to quickly identify and address issues affecting its customers.
-
-Use this article to make informed decisions about how you might configure diagnostic data in your organization. Diagnostic data is a term that means different things to different people and organizations. For this article, we discuss diagnostic data as system data that is uploaded by the Connected User Experiences and Telemetry component. The diagnostic data is used to help keep Windows devices secure by identifying malware trends and other threats and to help Microsoft improve the quality of Windows and Microsoft services.
-
-We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com.
-
-## Overview
-
-In previous versions of Windows and Windows Server, Microsoft used diagnostic data to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC), and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server 2016, you can control diagnostic data streams by using the Privacy option in Settings, Group Policy, or MDM.
-
-For Windows 10, we invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows work better for your organization.
-
-## Understanding Windows diagnostic data
-
-Windows as a Service is a fundamental change in how Microsoft plans, builds, and delivers the operating system. Historically, we released a major Windows version every few years. The effort required to deploy large and infrequent Windows versions was substantial. That effort included updating the infrastructure to support the upgrade. Windows as a Service accelerates the cadence to provide rich updates more frequently, and these updates require substantially less effort to roll out than earlier versions of Windows. Since it provides more value to organizations in a shorter timeframe, delivering Windows as a Service is a top priority for us.
-
-The release cadence of Windows may be fast, so feedback is critical to its success. We rely on diagnostic data at each stage of the process to inform our decisions and prioritize our efforts.
-
-### What is Windows diagnostic data?
-Windows diagnostic data is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways:
-
-- 	Keep Windows up to date
--	Keep Windows secure, reliable, and performant
--	Improve Windows – through the aggregate analysis of the use of Windows
--	Personalize Windows engagement surfaces
-
-Here are some specific examples of Windows diagnostic data:
-
--	Type of hardware being used
--	Applications installed and usage details
--	Reliability information on device drivers
-
-### What is NOT diagnostic data?
-
-Diagnostic data can sometimes be confused with functional data. Some Windows components and apps connect to Microsoft services directly, but the data they exchange is not diagnostic data. For example, exchanging a user’s location for local weather or news is not an example of diagnostic data—it is functional data that the app or service requires to satisfy the user’s request.
-
-There are subtle differences between diagnostic data and functional data. Windows collects and sends diagnostic data in the background automatically. You can control how much information is gathered by setting the diagnostic data level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash).    On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data.
-
-If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services).
-
-The following are specific examples of functional data:
-
-- Current location for weather
-- Bing searches
-- Wallpaper and desktop settings synced across multiple devices
-
-### Diagnostic data gives users a voice
-
-Windows and Windows Server diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server 2016 behaves in the real world, focus on user priorities, and make informed decisions that benefit them. For our enterprise customers, representation in the dataset on which we will make future design decisions is a real benefit. The following sections offer real examples of these benefits.
-
-### Drive higher app and driver quality
-
-Our ability to collect diagnostic data that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Diagnostic data helps us to quickly identify and fix critical reliability and security issues with apps and device drivers on given configurations. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues.
-
-#### Real-world example of how Windows diagnostic data helps
-There was a version of a video driver that was crashing on some devices running Windows 10, causing the device to reboot. We detected the problem in our diagnostic data, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on diagnostic data from the Windows Insiders’ devices, we were able to validate the new version of the video driver, and rolled it out to the broad public as an update the next day. Diagnostic data helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls.
-
-### Improve end-user productivity
-
-Windows diagnostic data also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. Examples are:
-
--	**Start menu.** How do people change the Start menu layout? Do they pin other apps to it? Are there any apps that they frequently unpin? We use this dataset to adjust the default Start menu layout to better reflect people’s expectations when they turn on their device for the first time.
--	**Cortana.** We use diagnostic data to monitor the scalability of our cloud service, improving search performance.
--	**Application switching.**  Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between applications.  After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature.
-
-**These examples show how the use of diagnostic data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls.**
-
-
-### Insights into your own organization
-
-Sharing information with Microsoft helps make Windows and other products better, but it can also help make your internal processes and user experiences better, as well.  Microsoft is in the process of developing a set of analytics customized for your internal use.  The first of these, called [Upgrade Readiness](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness).
-
-#### Upgrade Readiness
-
-Upgrading to new operating system versions has traditionally been a challenging, complex, and slow process for many enterprises. Discovering applications and drivers and then testing them for potential compatibility issues have been among the biggest pain points.
-
-To better help customers through this difficult process, Microsoft developed Upgrade Readiness to give enterprises the tools to plan and manage the upgrade process end to end and allowing them to adopt new Windows releases more quickly and on an ongoing basis.
-
-With Windows diagnostic data enabled, Microsoft collects computer, application, and driver compatibility-related information for analysis. We then identify compatibility issues that can block your upgrade and suggest fixes when they are known to Microsoft.
-
-Use Upgrade Readiness to get:
-
-- A visual workflow that guides you from pilot to production
-- Detailed computer, driver, and application inventory
-- Powerful computer level search and drill-downs
-- Guidance and insights into application and driver compatibility issues with suggested fixes
-- Data driven application rationalization tools
-- Application usage information, allowing targeted validation; workflow to track validation progress and decisions
-- Data export to commonly used software deployment tools
-
-The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded.
-
-## How is diagnostic data handled by Microsoft?
-
-### Data collection
-
-Windows 10 and Windows Server 2016 includes the Connected User Experiences and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology that gathers and stores diagnostic data events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology.
-
-1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces.
-2. Events are gathered using public operating system event logging and tracing APIs.
-3. You can configure the diagnostic data level by using MDM policy, Group Policy, or registry settings.
-4. The Connected User Experiences and Telemetry component transmits the diagnostic data.
-
-Info collected at the Enhanced and Full levels of diagnostic data is typically gathered at a fractional sampling rate, which can be as low as 1% of devices reporting data at those levels.
-
-### Data transmission
-
-All diagnostic data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks.
-
-The data transmitted at the Basic and Enhanced data diagnostic levels is quite small; typically less than 1 MB per device per day,  but occasionally up to 2 MB per device per day).
-
-
-### Endpoints
-
-The Microsoft Data Management Service routes data back to our secure cloud storage. Only Microsoft personnel with a valid business justification are permitted access.
-
-The following table defines the endpoints for Connected User Experiences and Telemetry component:
-
-Windows release | Endpoint
---- | ---
-Windows 10, versions 1703 and 1709 | Diagnostics data: v10.vortex-win.data.microsoft.com/collect/v1

                                  Functional: v20.vortex-win.data.microsoft.com/collect/v1
                                  Windows Advanced Threat Protection is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com/collect/v1
                                  settings-win.data.microsoft.com
-Windows 10, version 1607 | v10.vortex-win.data.microsoft.com

                                  settings-win.data.microsoft.com
-
-The following table defines the endpoints for other diagnostic data services:
-
-| Service | Endpoint |
-| - | - |
-| [Windows Error Reporting](https://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com | 
-| | ceuswatcab01.blob.core.windows.net |
-| | ceuswatcab02.blob.core.windows.net |
-| | eaus2watcab01.blob.core.windows.net |
-| | eaus2watcab02.blob.core.windows.net |
-| | weus2watcab01.blob.core.windows.net |
-| | weus2watcab02.blob.core.windows.net |
-| [Online Crash Analysis](https://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com |
-| OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 |
-
-### Data use and access
-
-The principle of least privileged access guides access to diagnostic data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third-party partners that include aggregated and anonymized diagnostic data information. Data-sharing decisions are made by an internal team including privacy, legal, and data management.
-
-### Retention
-
-Microsoft believes in and practices information minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Microsoft Store purchase history.
-
-## Diagnostic data levels
-This section explains the different diagnostic data levels in Windows 10, Windows Server 2016, and System Center. These levels are available on all desktop and mobile editions of Windows 10, except for the **Security** level, which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016.
-
-The diagnostic data is categorized into four levels:
-
--   **Security**. Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
-
--   **Basic**. Basic device info, including: quality-related data, app compatibility, and data from the **Security** level.
-
--   **Enhanced**. Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the **Basic** and the **Security** levels.
-
--   **Full**. All data necessary to identify and help to fix problems, plus data from the **Security**, **Basic**, and **Enhanced** levels.
-
-The levels are cumulative and are illustrated in the following diagram. Also, these levels apply to all editions of Windows Server 2016.
-
-![breakdown of diagnostic data levels and types of administrative controls](images/priv-telemetry-levels.png)
-
-### Security level
-
-The Security level gathers only the diagnostic data info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server 2016, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windows IoT Core editions.
-
-> [!NOTE]
-> If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates.
-
-Windows Server Update Services (WSUS) and System Center Configuration Manager functionality is not affected at this level, nor is diagnostic data about Windows Server features or System Center gathered.
-
-The data gathered at this level includes:
-
--   **Connected User Experiences and Telemetry component settings**. If general diagnostic data has been gathered and is queued, it is sent to Microsoft. Along with this diagnostic data, the Connected User Experiences and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experiences and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop).
-
--   **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address.
-
-    > [!NOTE]
-    > You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](https://support.microsoft.com/kb/891716).
-
--   **Windows Defender/Endpoint Protection**. Windows Defender and System Center Endpoint Protection requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address.
-
-    > [!NOTE]
-    > This reporting can be turned off and no information is included if a customer is using third-party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender).
-
-    Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, System Center Configuration Manager, or a third-party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates.
-
-For servers with default diagnostic data settings and no Internet connectivity, you should set the diagnostic data level to **Security**. This stops data gathering for events that would not be uploaded due to the lack of Internet connectivity.
-
-No user content, such as user files or communications, is gathered at the **Security** diagnostic data level, and we take steps to avoid gathering any information that directly identifies a company or user, such as name, email address, or account ID. However, in rare circumstances, MSRT information may unintentionally contain personal information. For instance, some malware may create entries in a computer’s registry that include information such as a username, causing it to be gathered. MSRT reporting is optional and can be turned off at any time.
-
-### Basic level
-
-The Basic level gathers a limited set of data that’s critical for understanding the device and its configuration. This level also includes the **Security** level data. This level helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. The Connected User Experiences and Telemetry component does not gather diagnostic data about System Center, but it can transmit diagnostic data for other non-Windows applications if they have user consent.
-
-The normal upload range for the Basic diagnostic data level is between 109 KB - 159 KB per day, per device.
-
-The data gathered at this level includes:
-
--   **Basic device data**. Helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Server 2016 in the ecosystem. Examples include:
-
-    -   Device attributes, such as camera resolution and display type
-
-    -   Internet Explorer version
-
-    -   Battery attributes, such as capacity and type
-
-    -   Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number
-
-    -   Processor and memory attributes, such as number of cores, architecture, speed, memory size, and firmware
-
-    -   Virtualization attribute, such as Second Level Address Translation (SLAT) support and guest operating system
-
-    -   Operating system attributes, such as Windows edition and virtualization state
-
-    -   Storage attributes, such as number of drives, type, and size
-
--   **Connected User Experiences and Telemetry component quality metrics**. Helps provide an understanding about how the Connected User Experiences and Telemetry component is functioning, including % of uploaded events, dropped events, and the last upload time.
-
--   **Quality-related information**. Helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app.
-
--   **Compatibility data**. Helps provide an understanding about which apps are installed on a device or virtual machine and identifies potential compatibility problems.
-
-    -   **General app data and app data for Internet Explorer add-ons**. Includes a list of apps that are installed on a native or virtualized instance of the OS and whether these apps function correctly after an upgrade. This app data includes the app name, publisher, version, and basic details about which files have been blocked from usage.
-
-    -   **Internet Explorer add-ons**. Includes a list of Internet Explorer add-ons that are installed on a device and whether these apps will work after an upgrade.
-
-    -   **System data**. Helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS.
-
-    -   **Accessory device data**. Includes a list of accessory devices, such as printers or external storage devices, that are connected to Windows PCs and whether these devices will function after upgrading to a new version of the operating system.
-
-    -   **Driver data**. Includes specific driver usage that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements.
-
--   **Microsoft Store**. Provides information about how the Microsoft Store performs, including app downloads, installations, and updates. It also includes Microsoft Store launches, page views, suspend and resumes, and obtaining licenses.
-
-
-### Enhanced level
-
-The Enhanced level gathers data about how Windows and apps are used and how they perform. This level also includes data from both the **Basic** and **Security** levels. This level helps to improve the user experience with the operating system and apps. Data from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements.
-
-This is the default level for Windows 10 Enterprise and Windows 10 Education editions, and the minimum level needed to quickly identify and address Windows, Windows Server, and System Center quality issues.
-
-The normal upload range for the Enhanced diagnostic data level is between 239 KB - 348 KB per day, per device.
-
-The data gathered at this level includes:
-
--   **Operating system events**. Helps to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components.
-
--   **Operating system app events**. A set of events resulting from Microsoft applications and management tools that were downloaded from the Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge.
-
--   **Device-specific events**. Contains data about events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events.
-
--   **Some crash dump types**. All crash dump types, except for heap dumps and full dumps.
-
-If the Connected User Experiences and Telemetry component detects a problem on Windows 10 that requires gathering more detailed instrumentation, the Connected User Experiences and Telemetry component at the **Enhanced** diagnostic data level will only gather data about the events associated with the specific issue.
-
-#### Limit Enhanced diagnostic data to the minimum required by Windows Analytics
-Windows Analytics Device Health reports are powered by diagnostic data not included in the **Basic** level, such as crash reports and certain operating system events. In the past, organizations sending **Enhanced** or **Full** level diagnostic data were able to participate in Device Health. However, organizations that required detailed event and field level documentation were unable to move from **Basic** to **Enhanced**.
-
-In Windows 10, version 1709, we introduce the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data. For more info about Device Health, see the [Monitor the health of devices with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor) topic.
-
-- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) topic.
-
-- **Some crash dump types.** All crash dump types, except for heap and full dumps.
-
-**To turn on this behavior for devices**
-
-1.	Set the diagnostic data level to **Enhanced**, using either Group Policy or MDM.
-
-    a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds/Allow telemetry** setting to **2**.
-
-    -OR-
-
-    b. Using MDM, use the Policy CSP to set the **System/AllowTelemetry** value to **2**.
-
-    -AND-
-
-2.	Enable the **LimitEnhancedDiagnosticDataWindowsAnalytics** setting, using either Group Policy or MDM.
-
-    a.	Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data collection and Preview builds/Limit Enhanced diagnostic data to the minimum required by Windows Analytics** setting to **Enabled**.
-
-    -OR-
-
-    b. Using MDM, use the Policy CSP to set the **System/LimitEnhancedDiagnosticDataWindowsAnalytics** value to **1**.
-
-### Full level
-
-The **Full** level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the **Basic**, **Enhanced**, and **Security** levels. This is the default level for Windows 10 Pro.
-
-Additionally, at this level, devices opted in to the [Windows Insider Program](http://insider.windows.com) will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the [Windows Insider Program](http://insider.windows.com) are automatically set to this level.
-
-If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional data becomes necessary. This data can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the **Full** diagnostic data level and have exhibited the problem.
-
-However, before more data is gathered, Microsoft’s privacy governance team, including privacy and other subject matter experts, must approve the diagnostics request made by a Microsoft engineer. If the request is approved, Microsoft engineers can use the following capabilities to get the information:
-
--   Ability to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe.
-
--   Ability to get registry keys.
-
--   All crash dump types, including heap dumps and full dumps.
-
-## Enterprise management
-
-Sharing diagnostic data with Microsoft provides many benefits to enterprises, so we do not recommend turning it off. For most enterprise customers, simply adjusting the diagnostic data level and managing specific components is the best option.
-
-Customers can set the diagnostic data level in both the user interface and with existing management tools. Users can change the diagnostic data level in the **Diagnostic data** setting. In the **Settings** app, it is in **Privacy\Feedback & diagnostics**. They can choose between Basic and Full. The Enhanced level will only be displayed as an option when Group Policy or Mobile Device Management (MDM) are invoked with this level. The Security level is not available.
-
-IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a diagnostic data level.  If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016, the Security diagnostic data level is available when managing the policy. Setting the diagnostic data level through policy sets the upper boundary for the users’ choices. To disable user choice after setting the level with the policy, you will need to use the "Configure telemetry opt-in setting user interface" group policy. The remainder of this section describes how to use group policy to configure levels and settings interface.
-
-
-### Manage your diagnostic data settings
-
-We do not recommend that you turn off diagnostic data in your organization as valuable functionality may be impacted, but we recognize that in some scenarios this may be required. Use the steps in this section to do so for Windows, Windows Server, and System Center.
-
-> [!IMPORTANT]
-> These diagnostic data levels only apply to Windows, Windows Server, and System Center components and apps that use the Connected User Experiences and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these diagnostic data levels. You should work with your app vendors to understand their diagnostic data policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of Office Telemetry](https://technet.microsoft.com/library/jj863580.aspx).
-
-You can turn on or turn off System Center diagnostic data gathering. The default is on and the data gathered at this level represents what is gathered by default when System Center diagnostic data is turned on. However, setting the operating system diagnostic data level to **Basic** will turn off System Center diagnostic data, even if the System Center diagnostic data switch is turned on.
-
-The lowest diagnostic data setting level supported through management policies is **Security**. The lowest diagnostic data setting supported through the Settings UI is **Basic**. The default diagnostic data setting for Windows Server 2016 is **Enhanced**.
-
-### Configure the operating system diagnostic data level
-
-You can configure your operating system diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy sets the upper level for diagnostic data on the device.
-
-Use the appropriate value in the table below when you configure the management policy.
-
-| Level    | Data gathered | Value |
-| - | - | -  |
-| Security | Security data only. | **0** |
-| Basic | Security data, and basic system and quality data. | **1** |
-| Enhanced | Security data, basic system and quality data, and enhanced insights and advanced reliability data. | **2** |
-| Full | Security data, basic system and quality data, enhanced insights and advanced reliability data, and full diagnostics data. | **3** |
-
-   > [!NOTE]
-   > When both the Computer Configuration policy and User Configuration policy are set, the more restrictive policy is used.
-
-### Use Group Policy to set the diagnostic data level
-
-Use a Group Policy object to set your organization’s diagnostic data level.
-
-1.  From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**.
-
-2.  Double-click **Allow Telemetry**.
-
-3.  In the **Options** box, select the level that you want to configure, and then click **OK**.
-
-### Use MDM to set the diagnostic data level
-
-Use the [Policy Configuration Service Provider (CSP)](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to apply the System/AllowTelemetry MDM policy.
-
-### Use Registry Editor to set the diagnostic data level
-
-Use Registry Editor to manually set the registry level on each device in your organization or you can write a script to edit the registry. If a management policy already exists, such as Group Policy or MDM, it will override this registry setting.
-
-1.  Open Registry Editor, and go to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection**.
-
-2.  Right-click **DataCollection**, click New, and then click **DWORD (32-bit) Value**.
-
-3.  Type **AllowTelemetry**, and then press ENTER.
-
-4.  Double-click **AllowTelemetry**, set the desired value from the table above, and then click **OK.**
-
-5.  Click **File** > **Export**, and then save the file as a .reg file, such as **C:\\AllowTelemetry.reg**. You can run this file from a script on each device in your organization.
-
-### Configure System Center 2016 diagnostic data
-
-For System Center 2016 Technical Preview, you can turn off System Center diagnostic data by following these steps:
-
--   Turn off diagnostic data by using the System Center UI Console settings workspace.
-
--   For information about turning off diagnostic data for Service Management Automation and Service Provider Foundation, see [How to disable telemetry for Service Management Automation and Service Provider Foundation](https://support.microsoft.com/kb/3096505).
-
-### Additional diagnostic data controls
-
-There are a few more settings that you can turn off that may send diagnostic data information:
-
--   To turn off Windows Update diagnostic data, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](https://technet.microsoft.com/library/hh852345.aspx) or [System Center Configuration Manager](https://www.microsoft.com/server-cloud/products/system-center-2012-r2-configuration-manager/).
-
--   Turn off **Windows Defender Cloud-based Protection** and **Automatic sample submission** in **Settings** > **Update & security** > **Windows Defender**.
-
--   Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](https://support.microsoft.com/kb/891716).
-
--   Turn off **Linguistic Data Collection** in **Settings** > **Privacy**. At diagnostic data levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary.
-
-    > [!NOTE]
-    > Microsoft does not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information.
-
-## Additional resources
-
-FAQs
-
-- [Cortana, Search, and privacy](https://privacy.microsoft.com/windows-10-cortana-and-privacy)
-- [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy)
-- [Windows 10 camera and privacy](https://privacy.microsoft.com/windows-10-camera-and-privacy)
-- [Windows 10 location service and privacy](https://privacy.microsoft.com/windows-10-location-and-privacy)
-- [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy)
-- [Windows 10 speech, inking, typing, and privacy](https://privacy.microsoft.com/windows-10-speech-inking-typing-and-privacy-faq)
-- [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy)
-- [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense)
-- [Windows Update Delivery Optimization](https://privacy.microsoft.com/windows-10-windows-update-delivery-optimization)
-
-Blogs
-
-- [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10)
-
-Privacy Statement
-
-- [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
-
-TechNet
-
-- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
-
-Web Pages
-
-- [Privacy at Microsoft](https://privacy.microsoft.com)
-
-
+---
+description: Use this article to make informed decisions about how you can configure diagnostic data in your organization.
+title: Configure Windows diagnostic data in your organization (Windows 10)
+keywords: privacy
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: high
+audience: ITPro
+author: dansimp
+ms.author: dansimp
+manager: dansimp
+ms.collection: M365-security-compliance
+ms.topic: article
+ms.date: 04/29/2019
+---
+
+# Configure Windows diagnostic data in your organization
+
+**Applies to**
+
+- Windows 10 Enterprise
+- Windows 10 Mobile
+- Windows Server
+
+This article applies to Windows and Windows Server diagnostic data only. It describes the types of diagnostic data we may gather, the ways you might manage it in your organization, and some examples of how diagnostic data can provide you with valuable insights into your enterprise deployments. Microsoft uses the data to quickly identify and address issues affecting its customers.
+
+Use this article to make informed decisions about how you might configure diagnostic data in your organization. Diagnostic data is a term that means different things to different people and organizations. For this article, we discuss diagnostic data as system data that is uploaded by the Connected User Experiences and Telemetry component. Microsoft uses diagnostic data to keep Windows secure and up to date, troubleshoot problems, and make product improvements.
+
+We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com.
+
+## Overview of Windows diagnostic data
+
+At Microsoft, we use Windows diagnostic data to inform our decisions and focus our efforts in providing the most robust, most valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Diagnostic data gives users a voice in the operating system’s development. This guide describes the importance of Windows diagnostic data and how we protect that data. Additionally, it differentiates between diagnostic data and functional data. It also describes the diagnostic data levels that Windows supports. Of course, you can choose how much diagnostic data is shared with Microsoft, and this guide demonstrates how.
+
+To frame a discussion about diagnostic data, it is important to understand Microsoft’s privacy principles. We earn customer trust every day by focusing on six key privacy principles as described at [privacy.microsoft.com](https://privacy.microsoft.com/). These principles guided the implementation of the Windows diagnostic data system in the following ways:
+
+- **Control.** We offer customers control of the diagnostic data they share with us by providing easy-to-use management tools.
+- **Transparency.** We provide information about the diagnostic data that Windows and Windows Server collects so our customers can make informed decisions.
+- **Security.** We encrypt diagnostic data in transit from your device via TLS 1.2, and additionally use certificate pinning to secure the connection.
+- **Strong legal protections.** We respect customers’ local privacy laws and fight for legal protection of their privacy as a fundamental human right.
+- **No content-based targeting.** We take steps to avoid and minimize the collection of customer content, such as the content of files, chats, or emails, through the Windows diagnostic data system.  Customer content inadvertently collected is kept confidential and not used for user targeting.
+- **Benefits to you.** We collect Windows diagnostic data to help provide you with an up-to-date, more secure, reliable and performant product, and to improve Windows for all our customers.
+
+In previous versions of Windows and Windows Server, Microsoft used diagnostic data to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC), and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server, you can control diagnostic data streams by using the Privacy option in Settings, Group Policy, or MDM.
+
+For Windows 10, we invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows work better for your organization.
+
+## Understanding Windows diagnostic data
+
+Windows as a Service is a fundamental change in how Microsoft plans, builds, and delivers the operating system. Historically, we released a major Windows version every few years. The effort required to deploy large and infrequent Windows versions was substantial. That effort included updating the infrastructure to support the upgrade. Windows as a Service accelerates the cadence to provide rich updates more frequently, and these updates require substantially less effort to roll out than earlier versions of Windows. Since it provides more value to organizations in a shorter timeframe, delivering Windows as a Service is a top priority for us.
+
+The release cadence of Windows may be fast, so feedback is critical to its success. We rely on diagnostic data at each stage of the process to inform our decisions and prioritize our efforts.
+
+### What is Windows diagnostic data?
+
+Windows diagnostic data is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways:
+
+- Keep Windows up to date
+- Keep Windows secure, reliable, and performant
+- Improve Windows – through the aggregate analysis of the use of Windows
+- Personalize Windows engagement surfaces
+
+Here are some specific examples of Windows diagnostic data:
+
+- Type of hardware being used
+- Applications installed and usage details
+- Reliability information on device drivers
+
+### What is NOT diagnostic data?
+
+Diagnostic data can sometimes be confused with functional data. Some Windows components and apps connect to Microsoft services directly, but the data they exchange is not diagnostic data. For example, exchanging a user’s location for local weather or news is not an example of diagnostic data—it is functional data that the app or service requires to satisfy the user’s request.
+
+There are subtle differences between diagnostic data and functional data. Windows collects and sends diagnostic data in the background automatically. You can control how much information is gathered by setting the diagnostic data level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash).  
+On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data.
+
+If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services/).
+
+The following are specific examples of functional data:
+
+- Current location for weather
+- Bing searches
+- Wallpaper and desktop settings synced across multiple devices
+
+### Diagnostic data gives users a voice
+
+Windows and Windows Server diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server behaves in the real world, focus on user priorities, and make informed decisions that benefit them. For our enterprise customers, representation in the dataset on which we will make future design decisions is a real benefit. The following sections offer real examples of these benefits.
+
+### Improve app and driver quality
+
+Our ability to collect diagnostic data that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Diagnostic data helps us to quickly identify and fix critical reliability and security issues with apps and device drivers on given configurations. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues.
+
+#### Real-world example of how Windows diagnostic data helps
+
+There was a version of a video driver that was crashing on some devices running Windows 10, causing the device to reboot. We detected the problem in our diagnostic data, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on diagnostic data from the Windows Insiders’ devices, we were able to validate the new version of the video driver, and rolled it out to the broad public as an update the next day. Diagnostic data helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls.
+
+### Improve end-user productivity
+
+Windows diagnostic data also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. Examples are:
+
+- **Start menu.** How do people change the Start menu layout? Do they pin other apps to it? Are there any apps that they frequently unpin? We use this dataset to adjust the default Start menu layout to better reflect people’s expectations when they turn on their device for the first time.
+- **Cortana.** We use diagnostic data to monitor the scalability of our cloud service, improving search performance.
+- **Application switching.**  Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between applications.  After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature.
+
+**These examples show how the use of diagnostic data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls.**
+
+### Insights into your own organization
+
+Sharing information with Microsoft helps make Windows and other products better, but it can also help make your internal processes and user experiences better. Microsoft provides a set of solutions that leverage information shared by customers to provide insights customized for your internal use. The first of these was [Upgrade Readiness](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness), followed by [Desktop Analytics](https://aka.ms/DADocs). Both help organizations with [Windows as a Service](/windows/deployment/update/wass-overview) adoption and potential compatibility challenges. For E5 customers, [Microsoft Defender Advanced Threat Protection](/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection), a platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats.
+
+## How Microsoft handles diagnostic data
+
+The diagnostic data is categorized into four levels:
+
+- [**Security**](#security-level). Information that’s required to help keep Windows and Windows Server secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
+
+- [**Basic**](#basic-level). Basic device info, including: quality-related data, app compatibility, and data from the **Security** level.
+
+- [**Enhanced**](#enhanced-level). Additional insights, including: how Windows, Windows Server, and apps are used, how they perform, advanced reliability data, and data from both the **Basic** and the **Security** levels.
+
+- [**Full**](#full-level). Includes information about the websites you browse, how you use apps and features, plus additional information about device health, device activity (sometimes referred to as usage), and enhanced error reporting. At Full, Microsoft also collects the memory state of your device when a system or app crash occurs. It includes data from the **Security**, **Basic**, and **Enhanced** levels.
+
+Diagnostic data levels are cumulative, meaning each subsequent level includes data collected through lower levels. For more information see the [Diagnostic data levels](#diagnostic-data-levels) section.
+
+### Data collection
+
+Windows 10 and Windows Server includes the Connected User Experiences and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology that gathers and stores diagnostic data events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology.
+
+1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces.
+1. Events are gathered using public operating system event logging and tracing APIs.
+1. You can configure the diagnostic data level by using MDM policy, Group Policy, or registry settings.
+1. The Connected User Experiences and Telemetry component transmits the diagnostic data.
+
+Info collected at the Enhanced and Full levels of diagnostic data is typically gathered at a fractional sampling rate, which can be as low as 1% of devices reporting data at those levels.
+
+### Data transmission
+
+All diagnostic data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks.
+
+The data transmitted at the Basic and Enhanced data diagnostic levels is quite small; typically less than 1 MB per device per day,  but occasionally up to 2 MB per device per day.
+
+### Endpoints
+
+The Microsoft Data Management Service routes data back to our secure cloud storage. Only Microsoft personnel with a valid business justification are permitted access.
+
+Solutions like Desktop Analytics or Microsoft Defender Advanced Threat Protection need Windows devices to reach diagnostics endpoints which enable organizations to leverage solutions based on diagnostics data. These solutions leverage Windows components like the Connected User Experiences and Telemetry service, Windows Defender Advanced Threat Protection service, Windows Error Reporting, and Online Crash Analysis.
+
+For a complete list of diagnostics endpoints leveraged by Desktop Analytics, see [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/configmgr/desktop-analytics/enable-data-sharing).
+For a complete list of diagnostics endpoints leveraged by Microsoft Defender Advanced Threat Protection, see [Enable access to Microsoft Defender ATP service URLs in the proxy server](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
+
+The following table defines the endpoints for Connected User Experiences and Telemetry component:
+
+| Windows release | Endpoint |
+| - | - |
+| Windows 10, versions 1703 or later, with the 2018-09 cumulative update installed | **Diagnostics data:** v10c.vortex-win.data.microsoft.com

                                  **Functional:** v20.vortex-win.data.microsoft.com

                                  **Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,
                                  for example: **de**.vortex-win.data.microsoft.com

                                  **Settings:** settings-win.data.microsoft.com |
+| Windows 10, versions 1803 or later, without the 2018-09 cumulative update installed | **Diagnostics data:** v10.events.data.microsoft.com

                                  **Functional:** v20.vortex-win.data.microsoft.com

                                  **Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,
                                  for example: **de**.vortex-win.data.microsoft.com

                                  **Settings:** settings-win.data.microsoft.com |
+| Windows 10, version 1709 or earlier | **Diagnostics data:** v10.vortex-win.data.microsoft.com

                                  **Functional:** v20.vortex-win.data.microsoft.com

                                  **Microsoft Defender Advanced Threat Protection** is country specific and the prefix changes by country,
                                  for example: **de**.vortex-win.data.microsoft.com

                                  **Settings:** settings-win.data.microsoft.com  |
+
+The following table defines **additional diagnostics endpoints** not covered by services in the links above:
+
+| Service | Endpoint |
+| - | - |
+| OneDrive app for Windows 10 |  |
+
+The following table defines the endpoints for other diagnostic data services:
+
+| Service | Endpoint |
+| - | - |
+| [Windows Error Reporting](https://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com |
+| | ceuswatcab01.blob.core.windows.net |
+| | ceuswatcab02.blob.core.windows.net |
+| | eaus2watcab01.blob.core.windows.net |
+| | eaus2watcab02.blob.core.windows.net |
+| | weus2watcab01.blob.core.windows.net |
+| | weus2watcab02.blob.core.windows.net |
+| [Online Crash Analysis](https://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com |
+| OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 |
+| Microsoft Defender Advanced Threat Protection | 
                                   |
+
+### Data use and access
+
+The principle of least privileged access guides access to diagnostic data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third-party partners that include aggregated and anonymized diagnostic data information. Data-sharing decisions are made by an internal team including privacy, legal, and data management.
+
+### Retention
+
+Microsoft believes in and practices information minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Microsoft Store purchase history.
+
+## Manage enterprise diagnostic data level
+
+### Enterprise management
+
+Sharing diagnostic data with Microsoft is enabled by default on Windows 10, 1903 and later. Sharing this data provides many benefits to enterprises, so we do not recommend turning it off. For most enterprise customers, simply adjusting the diagnostic data level and managing specific components is the best option.
+
+Customers can set the diagnostic data level in both the user interface and with existing management tools. Users can change the diagnostic data level in the **Diagnostic data** setting. In the **Settings** app, in **Privacy** > **Diagnostics & feedback**. They can choose between Basic and Full. The Enhanced level will only be displayed as an option when Group Policy or Mobile Device Management (MDM) are invoked with this level. The Security level is not available.
+
+IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a diagnostic data level.  If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server, the Security diagnostic data level is available when managing the policy. Setting the diagnostic data level through policy sets the upper boundary for the users’ choices. To disable user choice after setting the level with the policy, you will need to use the "Configure telemetry opt-in setting user interface" group policy. The remainder of this article describes how to use group policy to configure levels and settings interface.
+
+#### Manage your diagnostic data settings
+
+Use the steps in this article to set and/or adjust the diagnostic data settings for Windows and Windows Server in your organization.
+
+> [!IMPORTANT]
+> These diagnostic data levels only apply to Windows and Windows Server components and apps that use the Connected User Experiences and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these diagnostic data levels. You should work with your app vendors to understand their diagnostic data policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of privacy controls for Office 365 ProPlus](/deployoffice/privacy/overview-privacy-controls).
+
+The lowest diagnostic data setting level supported through management policies is **Security**. The lowest diagnostic data setting supported through the Settings UI is **Basic**. The default diagnostic data setting for Windows Server is **Enhanced**.
+
+### Configure the diagnostic data level
+
+You can configure your device's diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy sets the upper level for diagnostic data on the device.
+
+Use the appropriate value in the table below when you configure the management policy.
+
+| Level | Value |
+| - | - |
+| Security | **0** |
+| Basic | **1** |
+| Enhanced | **2** |
+| Full | **3** |
+
+   > [!NOTE]
+   > When both the Computer Configuration policy and User Configuration policy are set, the more restrictive policy is used.
+
+### Use Group Policy to set the diagnostic data level
+
+Use a Group Policy object to set your organization’s diagnostic data level.
+
+1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**.
+
+1. Double-click **Allow Telemetry**.
+
+1. In the **Options** box, select the level that you want to configure, and then click **OK**.
+
+### Use MDM to set the diagnostic data level
+
+Use the [Policy Configuration Service Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) to apply the System/AllowTelemetry MDM policy.
+
+### Use Registry Editor to set the diagnostic data level
+
+Use Registry Editor to manually set the registry level on each device in your organization or you can write a script to edit the registry. If a management policy already exists, such as Group Policy or MDM, it will override this registry setting.
+
+1. Open Registry Editor, and go to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection**.
+
+1. Right-click **DataCollection**, click New, and then click **DWORD (32-bit) Value**.
+
+1. Type **AllowTelemetry**, and then press ENTER.
+
+1. Double-click **AllowTelemetry**, set the desired value from the table above, and then click **OK.**
+
+1. Click **File** > **Export**, and then save the file as a .reg file, such as **C:\\AllowTelemetry.reg**. You can run this file from a script on each device in your organization.
+
+### Additional diagnostic data controls
+
+There are a few more settings that you can turn off that may send diagnostic data information:
+
+- To turn off Windows Update diagnostic data, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](https://docs.microsoft.com/windows-server/administration/windows-server-update-services/get-started/windows-server-update-services-wsus) or [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr/index/).
+
+- Turn off **Windows Defender Cloud-based Protection** and **Automatic sample submission** in **Settings** > **Update & security** > **Windows Defender**.
+
+- Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](https://support.microsoft.com/kb/891716).
+
+- Turn off **Improve inking and typing** in **Settings** > **Privacy**. At diagnostic data levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary.
+
+    > [!NOTE]
+    > Microsoft does not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information.
+
+## Diagnostic data levels
+
+These levels are available on all desktop and mobile editions of Windows 10, except for the **Security** level, which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server.
+
+### Security level
+
+The Security level gathers only the diagnostic data info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windows IoT Core editions.
+
+> [!NOTE]
+> If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates.
+
+Windows Server Update Services (WSUS) and Microsoft Endpoint Configuration Manager functionality is not affected at this level, nor is diagnostic data about Windows Server features or System Center gathered.
+
+The data gathered at this level includes:
+
+- **Connected User Experiences and Telemetry component settings**. If general diagnostic data has been gathered and is queued, it is sent to Microsoft. Along with this diagnostic data, the Connected User Experiences and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experiences and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop).
+
+- **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address.
+
+    > [!NOTE]
+    > You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](https://support.microsoft.com/kb/891716).
+
+- **Windows Defender/Endpoint Protection**. Windows Defender and System Center Endpoint Protection requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address.
+
+    > [!NOTE]
+    > This reporting can be turned off and no information is included if a customer is using third-party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender).
+
+    Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, Microsoft Endpoint Configuration Manager, or a third-party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates.
+
+For servers with default diagnostic data settings and no Internet connectivity, you should set the diagnostic data level to **Security**. This stops data gathering for events that would not be uploaded due to the lack of Internet connectivity.
+
+No user content, such as user files or communications, is gathered at the **Security** diagnostic data level, and we take steps to avoid gathering any information that directly identifies a company or user, such as name, email address, or account ID. However, in rare circumstances, MSRT information may unintentionally contain personal information. For instance, some malware may create entries in a computer’s registry that include information such as a username, causing it to be gathered. MSRT reporting is optional and can be turned off at any time.
+
+### Basic level
+
+The Basic level gathers a limited set of data that’s critical for understanding the device and its configuration. This level also includes the **Security** level data. This level helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. The Connected User Experiences and Telemetry component does not gather diagnostic data about System Center, but it can transmit diagnostic data for other non-Windows applications if they have user consent.
+
+This is the default level for Windows 10 Education editions, as well as all desktop editions starting with Windows 10, version 1903.
+
+The normal upload range for the Basic diagnostic data level is between 109 KB - 159 KB per day, per device.
+
+The data gathered at this level includes:
+
+- **Basic device data**. Helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Servers in the ecosystem. Examples include:
+
+  - Device attributes, such as camera resolution and display type
+  - Internet Explorer version
+  - Battery attributes, such as capacity and type
+  - Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number
+  - Processor and memory attributes, such as number of cores, architecture, speed, memory size, and firmware
+  - Virtualization attribute, such as Second Level Address Translation (SLAT) support and guest operating system
+  - Operating system attributes, such as Windows edition and virtualization state
+  - Storage attributes, such as number of drives, type, and size
+
+- **Connected User Experiences and Telemetry component quality metrics**. Helps provide an understanding about how the Connected User Experiences and Telemetry component is functioning, including % of uploaded events, dropped events, and the last upload time.
+
+- **Quality-related information**. Helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app.
+
+- **Compatibility data**. Helps provide an understanding about which apps are installed on a device or virtual machine and identifies potential compatibility problems.
+
+  - **General app data and app data for Internet Explorer add-ons**. Includes a list of apps that are installed on a native or virtualized instance of the OS and whether these apps function correctly after an upgrade. This app data includes the app name, publisher, version, and basic details about which files have been blocked from usage.
+
+  - **Internet Explorer add-ons**. Includes a list of Internet Explorer add-ons that are installed on a device and whether these apps will work after an upgrade.
+
+  - **System data**. Helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS.
+
+  - **Accessory device data**. Includes a list of accessory devices, such as printers or external storage devices, that are connected to Windows PCs and whether these devices will function after upgrading to a new version of the operating system.
+
+  - **Driver data**. Includes specific driver usage that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements.
+
+- **Microsoft Store**. Provides information about how the Microsoft Store performs, including app downloads, installations, and updates. It also includes Microsoft Store launches, page views, suspend and resumes, and obtaining licenses.
+
+### Enhanced level
+
+The Enhanced level gathers data about how Windows and apps are used and how they perform. This level also includes data from both the **Basic** and **Security** levels. This level helps to improve the user experience with the operating system and apps. Data from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements.
+
+This level is needed to quickly identify and address Windows and Windows Server quality issues.
+
+The normal upload range for the Enhanced diagnostic data level is between 239 KB - 348 KB per day, per device.
+
+The data gathered at this level includes:
+
+- **Operating system events**. Helps to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components.
+
+- **Operating system app events**. A set of events resulting from Microsoft applications and management tools that were downloaded from the Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge.
+
+- **Device-specific events**. Contains data about events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events.
+
+- **Some crash dump types**. All crash dump types, except for heap dumps and full dumps.
+
+If the Connected User Experiences and Telemetry component detects a problem on Windows 10 that requires gathering more detailed instrumentation, the Connected User Experiences and Telemetry component at the **Enhanced** diagnostic data level will only gather data about the events associated with the specific issue.
+
+### Full level
+
+The Full level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the Basic, Enhanced, and Security levels.
+
+Additionally, at this level, devices opted in to the [Windows Insider Program](http://insider.windows.com) will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the [Windows Insider Program](http://insider.windows.com) are automatically set to this level.
+
+If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional data becomes necessary. This data can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the **Full** diagnostic data level and have exhibited the problem.
+
+However, before more data is gathered, Microsoft’s privacy governance team, including privacy and other subject matter experts, must approve the diagnostics request made by a Microsoft engineer. If the request is approved, Microsoft engineers can use the following capabilities to get the information:
+
+- Ability to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe.
+
+- Ability to get registry keys.
+
+- All crash dump types, including heap dumps and full dumps.
+
+> [!NOTE]
+> Crash dumps collected at this diagnostic data level may unintentionally contain personal data, such as portions of memory from a documents, a web page, etc.
+
+## Limit Enhanced diagnostic data to the minimum required by Desktop Analytics
+
+> [!IMPORTANT]
+> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported.
+> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/help/4521815/windows-analytics-retirement).
+
+Desktop Analytics reports are powered by diagnostic data not included in the **Basic** level, such as crash reports and certain operating system events.
+
+In Windows 10, version 1709, we introduced the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data.
+
+- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) topic.
+
+- **Some crash dump types.** Triage dumps for user mode and mini dumps for kernel mode.
+
+> [!NOTE]
+> Triage dumps are a type of [minidumps](https://docs.microsoft.com/windows/desktop/debug/minidump-files) that go through a process of user-sensitive information scrubbing. Some user-sensitive information may be missed in the process, and will therefore be sent with the dump.
+
+With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data.
+
+### Enable limiting enhanced diagnostic data to the minimum required by Desktop Analytics
+
+1. Set the diagnostic data level to **Enhanced**, using either Group Policy or MDM.
+
+    a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds/Allow telemetry** setting to **2**.
+
+    -OR-
+
+    b. Using MDM, use the Policy CSP to set the **System/AllowTelemetry** value to **2**.
+
+    -AND-
+
+1. Enable the **LimitEnhancedDiagnosticDataWindowsAnalytics** setting, using either Group Policy or MDM.
+
+    a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data collection and Preview builds/Limit Enhanced diagnostic data to the minimum required by Windows Analytics** setting to **Enabled**.
+
+    -OR-
+
+    b. Using MDM, use the Policy CSP to set the **System/LimitEnhancedDiagnosticDataWindowsAnalytics** value to **1**.
+
+## Additional resources
+
+FAQs
+
+- [Cortana, Search, and privacy](https://privacy.microsoft.com/windows-10-cortana-and-privacy)
+- [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy)
+- [Windows 10 camera and privacy](https://privacy.microsoft.com/windows-10-camera-and-privacy)
+- [Windows 10 location service and privacy](https://privacy.microsoft.com/windows-10-location-and-privacy)
+- [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy)
+- [Windows 10 speech, inking, typing, and privacy](https://privacy.microsoft.com/windows-10-speech-inking-typing-and-privacy-faq)
+- [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy)
+- [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense)
+- [Windows Update Delivery Optimization](https://privacy.microsoft.com/windows-10-windows-update-delivery-optimization)
+
+Blogs
+
+- [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10)
+
+Privacy Statement
+
+- [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
+
+TechNet
+
+- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
+
+Web Pages
+
+- [Privacy at Microsoft](https://privacy.microsoft.com)
diff --git a/windows/privacy/diagnostic-data-viewer-overview.md b/windows/privacy/diagnostic-data-viewer-overview.md
index 2f7c2c256d..c70d65a6ce 100644
--- a/windows/privacy/diagnostic-data-viewer-overview.md
+++ b/windows/privacy/diagnostic-data-viewer-overview.md
@@ -8,30 +8,30 @@ ms.sitesec: library
 ms.pagetype: security
 ms.localizationpriority: high
 audience: ITPro
-author: danihalfin
-ms.author: daniha
+author: dansimp
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
 ms.date: 01/17/2018
+ms.reviewer: 
 ---
 
 # Diagnostic Data Viewer Overview
 
 **Applies to**
 
--   Windows 10, version 1809
--   Windows 10, version 1803
+-   Windows 10, version 1803 and newer
 
 ## Introduction
-The Diagnostic Data Viewer is a Windows app that lets you review the diagnostic data your device is sending to Microsoft, grouping the info into simple categories based on how it's used by Microsoft.
+The Diagnostic Data Viewer is a Windows app that lets you review the Windows diagnostic data your device is sending to Microsoft, grouping the info into simple categories based on how it's used by Microsoft.
 
 ## Install and Use the Diagnostic Data Viewer
 
-You must turn on data viewing and download the app before you can use the Diagnostic Data Viewer to review your device's diagnostic data.
+You must download the app before you can use the Diagnostic Data Viewer to review your device's diagnostic data.
 
 ### Turn on data viewing
-Before you can use this tool, you must turn on data viewing in the **Settings** panel. Turning on data viewing lets Windows store your device's diagnostic data until you turn it off. Turning off data viewing stops Windows from collecting your diagnostic data and clears the existing diagnostic data from your device.
+Before you can use this tool for viewing Windows diagnostic data, you must turn on data viewing in the **Settings** panel. Turning on data viewing lets Windows store your device's diagnostic data until you turn it off. Turning off data viewing stops Windows from collecting your diagnostic data and clears the existing diagnostic data from your device. Note that this setting does not affect your Office data viewing or history.
 
 **To turn on data viewing**
 1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
@@ -41,10 +41,13 @@ Before you can use this tool, you must turn on data viewing in the **Settings**
     ![Location to turn on data viewing](images/ddv-data-viewing.png)
 
 ### Download the Diagnostic Data Viewer
-Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/en-us/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page.
+Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page.
+
+> [!Important]
+> It's possible that your Windows device doesn't have the Microsoft Store available (for example, Windows Server). If this is the case, see [Diagnostic Data Viewer for PowerShell](https://go.microsoft.com/fwlink/?linkid=2094264).
 
 ### Start the Diagnostic Data Viewer
-You must start this app from the **Settings** panel.
+You can start this app from the **Settings** panel.
 
 **To start the Diagnostic Data Viewer**
 1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
@@ -58,29 +61,25 @@ You must start this app from the **Settings** panel.
 3. Close the Diagnostic Data Viewer app, use your device as you normally would for a few days, and then open Diagnostic Data Viewer again to review the updated list of diagnostic data.
 
     >[!Important]
-    >Turning on data viewing can use up to 1GB of disk space on your system drive. We strongly recommend that your turn off data viewing when you're done using the Diagnostic Data Viewer. For info about turning off data viewing, see the [Turn off data viewing](#turn-off-data-viewing) section in this article.
+    >Turning on data viewing can use up to 1GB (by default) of disk space on your system drive. We strongly recommend that you turn off data viewing when you're done using the Diagnostic Data Viewer. For info about turning off data viewing, see the [Turn off data viewing](#turn-off-data-viewing) section in this article.
 
 ### Use the Diagnostic Data Viewer
 The Diagnostic Data Viewer provides you with the following features to view and filter your device's diagnostic data.
 
-- **View your diagnostic events.** In the left column, you can review your diagnostic events. These events reflect activities that occurred and were sent to Microsoft. 
+- **View your Windows diagnostic events.** In the left column, you can review your diagnostic events. These events reflect activities that occurred and were sent to Microsoft. 
 
     Selecting an event opens the detailed JSON view, which provides the exact details uploaded to Microsoft. Microsoft uses this info to continually improve the Windows operating system.
-
+    
     >[!Important]
     >Seeing an event does not necessarily mean it has been uploaded yet. It’s possible that some events are still queued and will be uploaded at a later time.
-    
-     ![View your diagnostic events](images/ddv-event-view.png)
+
+     ![View your diagnostic events](images/ddv-event-view.jpg)
 
 - **Search your diagnostic events.** The **Search** box at the top of the screen lets you search amongst all of the diagnostic event details. The returned search results include any diagnostic event that contains the matching text. 
 
     Selecting an event opens the detailed JSON view, with the matching text highlighted.
 
-- **Filter your diagnostic event categories.** The apps Menu button opens the detailed menu. In here, you'll find a list of diagnostic event categories, which define how the events are used by Microsoft.
-
-    Selecting a check box lets you filter between the diagnostic event categories.
-    
-     ![Filter your diagnostic event categories](images/ddv-event-view-filter.png)
+- **Filter your diagnostic event categories.** The app's **Menu** button opens the detailed menu. In here, you'll find a list of diagnostic event categories, which define how the events are used by Microsoft. Selecting a check box lets you filter between the diagnostic event categories.
 
 - **Help to make your Windows experience better.** Microsoft only needs diagnostic data from a small amount of devices to make big improvements to the Windows operating system and ultimately, your experience. If you’re a part of this small device group and you experience issues, Microsoft will collect the associated event diagnostic data, allowing your info to potentially help fix the issue for others.
 
@@ -93,8 +92,20 @@ The Diagnostic Data Viewer provides you with the following features to view and
     >[!Important]
     >All content in the Feedback Hub is publicly viewable. Therefore, make sure you don't put any personal info into your feedback comments.
 
+- **View a summary of the data you've shared with us over time.** Available for users on build 19H1+, 'About my data' in Diagnostic Data Viewer lets you see an overview of the Windows data you've shared with Microsoft.
+
+    Through this feature, you can checkout how much data you send on average each day, the breakdown of your data by category, the top components and services that have sent data, and more.  
+    
+    >[!Important]
+    >This content is a reflection of the history of Windows data the app has stored. If you'd like to have extended analyses, please modify the storage capacity of Diagnostic Data Viewer. 
+
+    ![Look at an overview of what data you've shared with Microsoft through the 'About my data' page in Diagnostic Data Viewer](images/ddv-analytics.png) 
+
+## View Office Diagnostic Data
+By default, Diagnostic Data Viewer shows you Windows data. You can also view Office diagnostic data by enabling the feature in the app settings page. To learn more about how to view Office diagnostic data, please visit this [page](https://go.microsoft.com/fwlink/?linkid=2023830). 
+
 ## Turn off data viewing
-When you're done reviewing your diagnostic data, you should turn of data viewing.
+When you're done reviewing your diagnostic data, you should turn of data viewing. This will also remove your Windows data history. Note that this setting does not affect your Office data viewing or history.
 
 **To turn off data viewing**
 1. Go to **Start**, select **Settings** > **Privacy** > **Diagnostics & feedback**.
@@ -103,8 +114,22 @@ When you're done reviewing your diagnostic data, you should turn of data viewing
 
     ![Location to turn off data viewing](images/ddv-settings-off.png)
 
+## Modifying the size of your data history
+By default, Diagnostic Data Viewer shows you up to 1GB or 30 days of data (whichever comes first) for Windows diagnostic data. Once either the time or space limit is reached, the data is incrementally dropped with the oldest data points dropped first. 
+
+> [!Important]
+> Note that if you have [Office diagnostic data viewing enabled](#view-office-diagnostic-data), the Office data history is fixed at 1 GB and cannot be modified.
+
+**Modify the size of your data history**
+    
+To make changes to the size of your Windows diagnostic data history, visit the **app settings**, located at the bottom of the navigation menu. Data will be incrementally dropped with the oldest data points first once your chosen size or time limit is reached.  
+
+> [!Important]
+> Decreasing the maximum amount of diagnostic data viewable through the tool will remove all data history and requires a reboot of your device. Additionally, increasing the maximum amount of diagnostic data viewable by the tool may come with performance impacts to your machine.
+
 ## View additional diagnostic data in the View problem reports tool
 Available on Windows 1809 and higher, you can review additional Windows Error Reporting diagnostic data in the **View problem reports** page within the Diagnostic Data Viewer. 
+
 This page provides you with a summary of various crash reports that are sent to Microsoft as part of Windows Error Reporting. 
 We use this data to find and fix specific issues that are hard to replicate and to improve the Windows operating system. 
 
@@ -112,7 +137,7 @@ You can also use the Windows Error Reporting tool available in the Control Panel
 
 **To view your Windows Error Reporting diagnostic data using the Diagnostic Data Viewer**
 
-Starting with Windows 1809 and higher, you can review Windows Error Reporting diagnostic data in the Diagnostic Data Viewer.
+Starting with Windows 1809 and higher, you can review Windows Error Reporting diagnostic data in the Diagnostic Data Viewer.  
 
 ![Starting with Windows 1809 and higher, you can review Windows Error Reporting diagnostic data in the Diagnostic Data Viewer](images/ddv-problem-reports.png)
 
@@ -123,3 +148,21 @@ Go to **Start** and search for _Problem Reports_.
 The **Review problem reports** tool opens, showing you your Windows Error Reporting reports, along with a status about whether it was sent to Microsoft.
 
 ![View problem reports tool with report statuses](images/control-panel-problem-reports-screen.png)
+
+## Known Issues with Diagnostic Data Viewer
+
+### Microsoft Edge diagnostic data appearing as a blob of text
+
+**Applicable to:** The new Microsoft Edge (v. 79.x.x.x or higher)
+
+**Issue:** In some cases, diagnostic data collected and sent from the New Microsoft Edge fails to be translated by the decoder. When decoding fails, the data appears as a blob of text in the Diagnostic Data Viewer. We are working on a fix for this issue.
+
+**Workaround:**
+
+- Restart your computer and open Diagnostic Data Viewer.
+
+*OR*
+
+- Restart the *DiagTrack* service, through the Services tab in task manager, and open Diagnostic Data Viewer.
+
+**Background:** Some of the diagnostic data collected from the new Microsoft Edge is sent using a Protocol Buffers (protobuf) to reduce network bandwidth and to improve data transfer efficiency. Diagnostic Data Viewer has a decoding capability to translate this protobuf format into human readable text. Due to a bug, sometimes the decoder fails to translate these protobuf messages and hence some of the New Microsoft Edge diagnostic data will appear as a blob of encoded text.
\ No newline at end of file
diff --git a/windows/privacy/docfx.json b/windows/privacy/docfx.json
index 98296c6b76..f7ff32cbfe 100644
--- a/windows/privacy/docfx.json
+++ b/windows/privacy/docfx.json
@@ -32,17 +32,24 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
-      "uhfHeaderId": "MSDocsHeader-WindowsIT", 
       "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
       "ms.technology": "windows",
+      "audience": "ITPro",
       "ms.topic": "article",
-		  "feedback_system": "GitHub",
+      "feedback_system": "GitHub",
       "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
-      "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app"
+      "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "MSDN.privacy",
+                            "folder_relative_path_in_docset": "./"
+        }
+      },
+      "titleSuffix": "Windows Privacy"
     },
     "fileMetadata": {},
     "template": [],
     "dest": "privacy",
     "markdownEngineName": "markdig"
   }
-}
\ No newline at end of file
+}
diff --git a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
index f3f9bf6b3f..41c5fa5a8a 100644
--- a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
+++ b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md
@@ -1,6 +1,6 @@
 ---
-description: Use this article to learn more about the enhanced diagnostic data events used by Windows Analytics
-title: Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics (Windows 10)
+title: Enhanced diagnostic data required by Windows Analytics (Windows 10)
+description: Use this article to learn more about the limit enhanced diagnostic data events policy used by Desktop Analytics
 keywords: privacy, diagnostic data
 ms.prod: w10
 ms.mktglfcycl: manage
@@ -8,28 +8,34 @@ ms.sitesec: library
 ms.pagetype: security
 ms.localizationpriority: high
 audience: ITPro
-author: danihalfin
-ms.author: daniha
+author: dansimp
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
 ms.date: 11/9/2018
+ms.reviewer: 
 ---
 
 
-# Windows 10 enhanced diagnostic data events and fields used by Windows Analytics
+# Windows 10 diagnostic data events and fields collected through the limit enhanced diagnostic data policy
 
  **Applies to**
 
 - Windows 10, version 1709 and newer
 
-Windows Analytics Device Health reports are powered by diagnostic data not included in the Basic level. This includes crash reports and certain OS diagnostic data events. Organizations sending Enhanced or Full level diagnostic data were able to participate in Device Health, but some organizations which required detailed event and field level documentation were unable to move from Basic to Enhanced. 
+> [!IMPORTANT]
+> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported.
+> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
 
-In Windows 10, version 1709, we introduce a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to only those described below. Note that the Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
+Desktop Analytics reports are powered by diagnostic data not included in the Basic level.
 
+In Windows 10, version 1709, we introduced a new feature: "Limit Enhanced diagnostic data to the minimum required by Windows Analytics". When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to only those described below. Note that the Enhanced level also includes limited crash reports, which are not described below. For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
+
+With the retirement of Windows Analytics, this policy will continue to be supported by Desktop Analytics, but will not include Office related diagnostic data.
 
 ## KernelProcess.AppStateChangeSummary
-This event summarizes application usage and performance characteristics to help Microsoft improve performance and reliability. Organizations can use this event with Windows Analytics to gain insights into application reliability.
+This event summarizes application usage and performance characteristics to help Microsoft improve performance and reliability. Organizations can use this event with Desktop Analytics to gain insights into application reliability.
 
 The following fields are available:
 
@@ -240,7 +246,7 @@ This event is fired when the office application suspends as per app life-cycle c
 - **SuspendType:** Type of suspend
 
 ## Microsoft.OSG.OSS.CredProvFramework.ReportResultStop
-This event indicates the result of an attempt to authenticate a user with a credential provider. It helps Microsoft to improve logon reliability. Using this event with Windows Analytics can help organizations monitor and improve logon success for different methods (for example, biometric) on managed devices.
+This event indicates the result of an attempt to authenticate a user with a credential provider. It helps Microsoft to improve logon reliability. Using this event with Desktop Analytics can help organizations monitor and improve logon success for different methods (for example, biometric) on managed devices.
 
 The following fields are available:
 
@@ -260,7 +266,7 @@ The following fields are available:
 - **UserTag:** Count of the number of times a user has selected a provider
 
 ## Microsoft.Windows.Kernel.Power.OSStateChange
-This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Windows Analytics, organizations can use this to monitor reliability and performance of managed devices
+This event denotes the transition between operating system states (e.g., On, Off, Sleep, etc.). By using this event with Desktop Analytics, organizations can use this to monitor reliability and performance of managed devices
 
 The following fields are available:
 
@@ -321,7 +327,7 @@ The following field is available:
 - **ticksSinceBoot:** Duration of boot event (milliseconds)
 
 ## Microsoft.Windows.Shell.Desktop.LogonFramework.AllLogonTasks
-This event summarizes the logon procedure to help Microsoft improve performance and reliability. By using this event with Windows Analytics organizations can help identify logon problems on managed devices.
+This event summarizes the logon procedure to help Microsoft improve performance and reliability. By using this event with Desktop Analytics organizations can help identify logon problems on managed devices.
 
 The following fields are available:
 
@@ -358,7 +364,7 @@ The following fields are available:
 - **status:** Indicates whether errors occurred during WIP learning events
 
 ## Win32kTraceLogging.AppInteractivitySummary
-Summarizes which app windows are being used (for example, have focus) to help Microsoft improve compatibility and user experience. Also helps organizations (by using Windows Analytics) to understand and improve application reliability on managed devices.
+Summarizes which app windows are being used (for example, have focus) to help Microsoft improve compatibility and user experience. Also helps organizations (by using Desktop Analytics) to understand and improve application reliability on managed devices.
 
 The following fields are available:
    
@@ -414,8 +420,11 @@ A previous revision of this list stated that a field named PartA_UserSid was a m
 ### Office events added
 In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 16 events were added, describing Office app launch and availability. These events were added to improve the precision of Office data in Windows Analytics.
 
+> [!NOTE]
+> Office data will no longer be provided through this policy in Desktop Analytics.
+
 ### CertAnalytics events removed
-In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 3 "CertAnalytics" events were removed, as they are no longer required for Windows Analytics.
+In Windows 10, version 1809 (also applies to versions 1709 and 1803 starting with [KB 4462932](https://support.microsoft.com/help/4462932/windows-10-update-kb4462932) and [KB 4462933](https://support.microsoft.com/help/4462933/windows-10-update-kb4462933) respectively), 3 "CertAnalytics" events were removed, as they are no longer required for Desktop Analytics.
 
 >[!NOTE]
 >You can use the Windows Diagnostic Data Viewer to observe and review events and their fields as described in this topic.
diff --git a/windows/privacy/gdpr-it-guidance.md b/windows/privacy/gdpr-it-guidance.md
index 3cc4c3a5d1..892203bace 100644
--- a/windows/privacy/gdpr-it-guidance.md
+++ b/windows/privacy/gdpr-it-guidance.md
@@ -1,308 +1,308 @@
----
-title: Windows and the GDPR-Information for IT Administrators and Decision Makers
-description: Use this topic to understand the relationship between users in your organization and Microsoft in the context of the GDPR (General Data Protection Regulation).
-keywords: privacy, GDPR, windows, IT
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: high
-audience: ITPro
-author: danihalfin
-ms.author: daniha
-manager: dansimp
-ms.collection: M365-security-compliance
-ms.topic: article
-ms.date: 05/11/2018
----
-# Windows and the GDPR: Information for IT Administrators and Decision Makers
-
-Applies to:
-- Windows 10, version 1809
-- Windows 10, version 1803
-- Windows 10, version 1709
-- Windows 10, version 1703
-- Windows 10 Team Edition, version 1703 for Surface Hub
-- Windows Server 2019
-- Windows Server 2016
-- Windows Analytics
-
-This topic provides IT Decision Makers with a basic understanding of the relationship between users in an organization and Microsoft in the context of the GDPR (General Data Protection Regulation). You will also learn what role an IT organization plays for that relationship.
-
-For more information about the GDPR, see:
-* [Microsoft GDPR Overview](https://aka.ms/GDPROverview)
-* [Microsoft Trust Center FAQs about the GDPR](https://aka.ms/gdpr-faq)
-* [Microsoft Service Trust Portal (STP)](https://aka.ms/stp)
-* [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted)
-
-## GDPR fundamentals
-
-Here are some GDPR fundamentals:
-
-* On May 25, 2018, this EU data privacy law is implemented. It sets a new global bar for data privacy rights, security, and compliance.
-* The GDPR is fundamentally about protecting and enabling the privacy rights of individuals – both customers and employees.
-* The European law establishes strict global data privacy requirements governing how organizations manage and protect personal data while respecting individual choice – no matter where data is sent, processed, or stored.
-* A request by an individual to an organization to take an action on their personal data is referred to here as a *data subject request*, or *DSR*.
-
-Microsoft believes data privacy is a fundamental right, and that the GDPR is an important step forward for clarifying and enabling individual privacy rights. We also recognize that the GDPR required significant changes by organizations all over the world with regard to the discovery, management, protection, and reporting of personal data that is collected, processed, and stored within an organization.
-
-### What is personal data under the GDPR?
-
-Article 4 (1) of [the GDPR](http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=en) defines personal data as any information relating to an identified or identifiable person. There is no distinction between a person’s private, public, or work roles. As defined by the GDPR, personal data includes, but is not limited to:
-* Name
-* Email address
-* Credit card numbers
-* IP addresses
-* Social media posts
-* Location information
-* Handwriting patterns
-* Voice input to cloud-based speech services
-
-### Controller and processor under the GDPR: Who does what
-
-#### Definition
-
-The GDPR describes specific requirements for allocating responsibility for controller and processor activities related to personal data. Thus, every organization that processes personal data must determine whether it is acting as a controller or processor for a specific scenario.
-
-* **Controller**: GDPR Article 4 (7) defines the ‘controller’ as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
-* **Processor**: According to the GDPR Article 4 (8) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
-
-#### Controller scenario
-
-For example, when an organization is using Microsoft Windows Defender Advanced Threat Protection (ATP) to detect, investigate, and respond to advanced threats on their networks as part of their IT operations, that organization is collecting data from the user’s device – data, that might include personal data. In this scenario, the organization is the *controller* of the respective personal data, since the organization controls the purpose and means of the processing for data being collected from the devices that have Windows Defender ATP enabled.
-
-#### Processor scenario
-
-In the controller scenario described above, Microsoft is a *processor* because Microsoft provides data processing services to that controller (in the given example, an organization that subscribed to Windows Defender ATP and enabled it for the user’s device). As processor, Microsoft only processes data on behalf of the enterprise customer and does not have the right to process data beyond their instructions as specified in a written contract, such as the [Microsoft Product Terms and the Microsoft Online Services Terms (OST)](https://www.microsoft.com/en-us/licensing/product-licensing/products.aspx).
-
-## GDPR relationship between a Windows 10 user and Microsoft
-
-For Windows 10 services, Microsoft usually is the controller (with exceptions, such as Windows Defender ATP). The following sections describe what that means for the related data.
-
-### Types of data exchanged with Microsoft
-
-Microsoft collects data from or generates data through interactions with users of Windows 10 devices. This information can contain personal data, as defined in [Article 4 (1) of the GDPR](http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2016:119:FULL&from=EN), that may be used to provide, support, and improve Windows 10 services.
-
-Microsoft discloses data collection and privacy practices in detail, for example:
-* As part of the Windows 10 installation;
-* In the Windows 10 privacy settings;
-* Via the web-based [Microsoft Privacy dashboard](https://account.microsoft.com/privacy); and
-* In the [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement).
-
-It is important to differentiate between two distinct types of data Windows services are dealing with.
-
-#### Windows functional data
-
-A user action, such as performing a Skype call, usually triggers the collection and transmission of Windows *functional data*. Some Windows components and applications connecting to Microsoft services also exchange Windows functional data to provide user functionality.
-
-Some other examples of Windows functional data:
-* The Weather app which can use the device’s location to retrieve local weather or community news.
-* Wallpaper and desktop settings that are synchronized across multiple devices.
-
-For more info on how IT Professionals can manage Windows functional data sent from an organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
-
-#### Windows diagnostic data
-
-Windows diagnostic data is used to keep the operating system secure and up-to-date, troubleshoot problems, and make product improvements. The data is encrypted before being sent back to Microsoft.
-
-Some examples of diagnostic data include:
-* The type of hardware being used, information about installed apps and usage details, and reliability data on drivers running on the device.
-* For users who have turned on “Tailored experiences”, it can be used to offer personalized tips, ads, and recommendations to enhance Microsoft products and services for the needs of the user.
-
-Diagnostic data is categorized into the levels "Security", "Basic", "Enhanced", and "Full". For a detailed discussion about these diagnostic data levels please see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). To find more about what information is collected and how it is handled, see [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data).
-
->[!IMPORTANT]
->Other Microsoft services as well as 3rd party applications and drivers running on Windows devices may implement their own functionality, independently from Windows, to transport their diagnostic data. Please contact the publisher for further guidance on how to control the diagnostic data collection level and transmission of these applications and services.
-
-### Windows services where Microsoft is the processor under the GDPR
-
-Most Windows 10 services are controller services in terms of the GDPR – for both Windows functional data and Windows diagnostic data. But there are a few Windows services where Microsoft is a processor for functional data under the GDPR, such as [Windows Analytics](https://www.microsoft.com/windowsforbusiness/windows-analytics) and [Windows Defender Advanced Threat Protection (ATP)](https://www.microsoft.com/windowsforbusiness/windows-atp).
-
->[!NOTE]
->Both Windows Analytics and Windows Defender ATP are subscription services for organizations. Some functionality requires a certain license (please see [Compare Windows 10 editions](https://www.microsoft.com/en-us/windowsforbusiness/compare)).
-
-#### Windows Analytics
-
-[Windows Analytics](https://www.microsoft.com/en-us/windowsforbusiness/windows-analytics) is a service that provides rich, actionable information for helping organizations to gain deep insights into the operational efficiency and health of the Windows devices in their environment. It uses Windows diagnostic data from devices enrolled by the IT organization of an enterprise into the Windows Analytics service.
-
-Windows [transmits Windows diagnostic data](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) to Microsoft datacenters, where that data is analyzed and stored. With Windows Analytics, the IT organization can then view the analyzed data to detect and fix issues or to improve their processes for upgrading to Windows 10.
-
-As a result, in terms of the GDPR, the organization that has subscribed to Windows Analytics is acting as the controller, while Microsoft is the processor for Windows Analytics.
->[!NOTE]
->The IT organization must explicitly enable Windows Analytics for a device after the organization subscribes.
-
->[!IMPORTANT]
->Windows Analytics does not collect Windows Diagnostic data by itself. Instead, Windows Analytics only uses a subset of Windows Diagnostic data that is collected by Windows for an enrolled device. The Windows Diagnostic data collection is controlled by the IT department of an organization or the user of a device.
-
-#### Windows Defender ATP
-
-[Windows Defender ATP](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp) is cloud-based service that collects and analyzes usage data from an organization’s devices to detect security threats. Some of the data can contain personal data as defined by the GDPR. Enrolled devices transmit usage data to Microsoft datacenters, where that data is analyzed, processed, and stored. The security operations center (SOC) of the organization can view the analyzed data using the [Windows Defender ATP portal](https://securitycenter.windows.com/).
-
-As a result, in terms of the GDPR, the organization that has subscribed to Windows Defender ATP is acting as the controller, while Microsoft is the processor for Windows Defender ATP.
-
->[!NOTE]
->The IT organization must explicitly enable Windows Defender ATP for a device after the organization subscribes.
-
-#### At a glance – Windows 10 services GDPR mode of operations
-
-The following table lists in what GDPR mode – controller or processor – Windows 10 services are operating.
-
-| Service | Microsoft GDPR mode of operation |
-| --- | --- |
-| Windows Functional data | Controller or Processor* |
-| Windows Diagnostic data | Controller |
-| Windows Analytics | Processor |
-| Windows Defender Advanced Threat Detection (ATP) | Processor |
-
-*Table 1: Windows 10 GDPR modes of operations for different Windows 10 services*
-
-*/*Depending on which application/feature this is referring to.*
-
-##  Windows diagnostic data and Windows 10
-
-
-### Recommended Windows 10 settings
-
-Windows diagnostic data collection level for Windows 10 can be set by a user in Windows (*Start > Settings > Privacy > Diagnostics & feedback*) or by the IT department of an organization, using Group Policy or Mobile Device Management (MDM) techniques.
-
-* For Windows 10, version 1803 and version 1809, Microsoft recommends setting the Windows diagnostic level to “Enhanced”. This enables organizations to get the full functionality of [Windows Analytics](#windows-analytics).
-
->[!NOTE]
->For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
-
-* For Windows 10, version 1709, and Windows 10, version 1703, the recommended Windows diagnostic level configuration for EEA and Switzerland commercial users is “Basic”.
-
->[!NOTE]
->For Windows 7, Microsoft recommends [configuring enterprise devices for Windows Analytics](/windows/deployment/update/windows-analytics-get-started) to facilitate upgrade planning to Windows 10.
-
-### Additional information for Windows Analytics
-
-Some Windows Analytics solutions and functionality, such as Update Compliance, works with “Basic” as minimum Windows diagnostic level. Other solutions and functionality of Windows Analytics, such as Device Health, require “Enhanced”.
-
-Those organizations who wish to share the smallest set of events for Windows Analytics and have set the Windows diagnostic level to “Enhanced” can use the “Limit Enhanced diagnostic data to the minimum required by Windows Analytics” setting. This filtering mechanism was that Microsoft introduced in Windows 10, version 1709. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by Windows Analytics.
-
->[!NOTE]
->Additional information can be found at [Windows Analytics and privacy](/windows/deployment/update/windows-analytics-privacy
-).
-
-## Controlling Windows 10 data collection and notification about it
-
-Windows 10 sends diagnostic data to Microsoft services, and some of that data can contain personal data. Both the user and the IT organization have the ability to control the transmission of that data to Microsoft.
-
-### Adjusting privacy settings by the user
-
-A user has the ability to adjust additional privacy settings in Windows by navigating to *Start > Settings > Privacy*. For example, a user can control if location is enabled or disabled, whether or not to transmit feedback on inking and typing input to Microsoft for improving the personal accuracy of these services, or if Windows collects activities for syncing it with other devices.
-
-For a standard user in an organization, some privacy settings might be controlled by their IT department. This is done using Group Policies or Mobile Device Management (MDM) settings. If this is the case, the user will see an alert that says ‘Some settings are hidden or managed by your organization’ when they navigate to *Start > Settings > Privacy*. As such, the user can only change some settings, but not all.
-
-### Users can lower the diagnostic level
-
-Starting with Windows 10, version 1803, a user can change the Windows diagnostics data level for their device below to what was set by their IT department. Organizations can allow or disallow this feature by configuring the Group Policy **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in setting user interface** or the MDM policy **ConfigureTelemetryOptInSettingsUx**.
-
-If an IT organization has not disabled this policy, users within the organization can change their own Windows diagnostic data collection level in *Start > Settings > Privacy > Diagnostics & feedback*. For example, if the IT organization enabled this policy and set the level to “Full”, a user can modify the Windows diagnostics data level setting to “Basic”.
-
-### Notification at logon
-
-Windows 10, version 1803, and later can provide users with a notification during their logon. If the IT organization has not disabled the Group Policy **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in change notifications** or the MDM policy **ConfigureTelemetryOptInChangeNotification**, Windows diagnostic data notifications can appear at logon so that the users of a device are aware of the data collection.
-
-This notification can also be shown when the diagnostic level for the device was changed. For instance, if the diagnostic level on the device is set to “Basic” and the IT organization changes it to “Full”, users will be notified on their next logon.
-
-### Diagnostic Data Viewer (DDV)
-
-In Windows 10, version 1803 and later, users can invoke the [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) to see what Windows diagnostic data is collected on their local device. This app lets a user review the diagnostic data collected on his device that is being sent to Microsoft. The DDV groups the information into simple categories based on how it is used by Microsoft.
-
-A user can turn on Windows diagnostic data viewing by going to go to *Start > Settings > Privacy > Diagnostics & feedback*. Under the ‘Diagnostic data viewer’ section, the user has to enable the ‘If data viewing is enabled, you can see your diagnostics data’ option. After DDV is installed on the device, the user can start it by clicking the ‘Diagnostic Data Viewer’ in the ‘Diagnostic data viewer’ section of *Start > Settings > Privacy > Diagnostics & feedback*.
-
-Also, the user can delete all Windows diagnostic data collected from the device. This is done by clicking the ‘Delete’ button in the ‘Delete diagnostic data’ section of *Start > Settings > Privacy > Diagnostics & feedback*.
-
-### Windows 10 personal data services configuration
-
-Microsoft assembled a list of Windows 10 services configuration settings that are useful for personal data privacy protection and related regulations, such as the General Data Protection Regulation (GDPR). There is one section with settings for service data that is managed at Microsoft and a section for local data that is managed by an IT organization.
-
-IT Professionals that are interested in this configuration, see [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md).
-
-### Windows 10 connections to Microsoft
-
-To find out more about the network connections that Windows components make to Microsoft as well as the privacy settings that affect data shared with either Microsoft or apps, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) and [Manage Windows 10 connection endpoints](manage-windows-endpoints.md). These articles describe how these settings can be managed by an IT Professional.
-
-### At-a-glance: the relationship between an IT organization and the GDPR
-
-Because Microsoft is a controller for data collected by Windows 10, the user can work with Microsoft to satisfy GDPR requirements. While this relationship between Microsoft and a user is evident in a consumer scenario, an IT organization can influence that relationship in an enterprise scenario. For example, the IT organization has the ability to centrally configure the Windows diagnostic data level by using Group Policy or MDM settings.
-
-## Windows Server
-
-Windows Server follows the same mechanisms as Windows 10 for handling of personal data – for example, when collecting Windows diagnostic data.
-
-More detailed information about Windows Server and the GDPR is available at Beginning your General Data Protection Regulation (GDPR) journey for Windows Server.
-
-### Windows diagnostic data and Windows Server
-
-The lowest diagnostic data setting level supported on Windows Server 2016 and Windows Server 2019 through management policies is “Security”. The lowest diagnostic data setting supported through the Settings UI is “Basic”. The default diagnostic data level for all Windows Server 2016 and Windows Server 2019 editions is “Enhanced”.
-
-IT administrators can configure the Windows Server diagnostic data settings using familiar management tools, such as Group Policy, MDM, or Windows Provisioning. IT administrators can also manually change settings using Registry Editor. Setting the Windows Server diagnostic data levels through a management policy overrides any device-level settings.
-
-There are two options for deleting Windows diagnostic data from a Windows Server machine:
-
-- If the “Desktop Experience” option was chosen during the installation of Windows Server 2019, then there are the same options available for an IT administrator that end users have with Windows 10, version 1803 and version 1809, to submit a request for deleting that device’s diagnostic data. This is done by clicking the **Delete** button in the **Delete diagnostic data** section of **Start > Settings > Privacy > Diagnostics & feedback**.
-- Microsoft has provided a [PowerShell cmdlet](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata) that IT administrators can use to delete Windows diagnostic data via the command line on a machine running Windows Server 2016 or Windows Server 2019. This cmdlet provides the same functionality for deleting Windows diagnostic data as with Desktop Experience on Windows Server 2019. For more information, see [the PowerShell Gallery](https://www.powershellgallery.com/packages/WindowsDiagnosticData).
-
-### Backups and Windows Server
-
-Backups, including live backups and backups that are stored locally within an organization or in the cloud, can contain personal data.
-
-- Backups an organizations creates, for example by using Windows Server Backup (WSB), are under its control. For example, for exporting personal data contained in a backup, the organization needs to restore the appropriate backup sets to facilitate the respective data subject request (DSR).
-- The GDPR also applies when storing backups in the cloud. For example, an organization can use Microsoft Azure Backup to backup files and folders from physical or virtual Windows Server machines (located on-premises or in Azure) to the cloud. The organization that is subscribed to this backup service also has the obligation to restore the data in order to exercise the respective DSR.
-
-## Windows 10 Team Edition, Version 1703 for Surface Hub
-
-Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to a user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store.
-
->[!NOTE]
->Additional apps running on the device, that are not delivered as part of the in-box experience of Surface Hub, may implement their own diagnostic data collection and transmission functionality independently to collect and process personal data. Please contact the app publisher for further guidance on how to control this.
-
-An IT administrator can configure privacy- related settings, such as setting the Windows diagnostic data level to Basic. Surface Hub does not support group policy for centralized management; however, IT administrators can use MDM to apply these settings to Surface Hub. For more information about Surface Hub and MDM, please see [Manage settings with an MDM provider](https://docs.microsoft.com/surface-hub/manage-settings-with-mdm-for-surface-hub).
-
-## Further reading
-
-### Optional settings / features that further improve the protection of personal data
-
-Personal data protection is one of the goals of the GDPR. One way of improving personal data protection is to use the modern and advanced security features of Windows 10. An IT organization can learn more at [Mitigate threats by using Windows 10 security features](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10) and [Standards for a highly secure Windows 10 device](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-highly-secure).
-
->[!NOTE]
->Some of these features might require a particular Windows hardware, such as a computer with a Trusted Platform Module (TPM) chip, and can depend on a particular Windows product (such as Windows 10 E5).
-
-### Windows Security Baselines
-
-Microsoft has created Windows Security Baselines to efficiently configure Windows 10 and Windows Server. For more information, please visit [Windows Security Baselines](/windows/security/threat-protection/windows-security-baselines).
-
-### Windows Restricted Traffic Limited Functionality Baseline
-
-To make it easier to deploy settings that restrict connections from Windows 10 and Windows Server to Microsoft, IT Professionals can apply the Windows Restricted Traffic Limited Functionality Baseline, available [here](https://go.microsoft.com/fwlink/?linkid=828887).
-
->[!IMPORTANT]
->Some of the settings of the Windows Restricted Traffic Limited Functionality Baseline will reduce the functionality and security configuration of a device in the organization and are therefore not recommended.
-
-### Microsoft Trust Center and Service Trust Portal
-
-Please visit our [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/privacy/gdpr) to obtain additional resources and to learn more about how Microsoft can help you fulfill specific GDPR requirements. There you can find lots of useful information about the GDPR, including how Microsoft is helping customers to successfully master the GDPR, a FAQ list, and a list of [resources for GDPR compliance](https://www.microsoft.com/en-us/TrustCenter/Privacy/gdpr/resources). Also, please check out the [Compliance Manager](https://aka.ms/compliancemanager) of the Microsoft [Service Trust Portal (STP)](https://aka.ms/stp) and [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted).
-
-### Additional resources
-
-#### FAQs
-
-* [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy)
-* [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy)
-* [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy)
-* [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense)
-
-#### Blogs
-
-* [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10)
-
-#### Privacy Statement
-
-* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
-
-#### Other resources
-
-* [Privacy at Microsoft](https://privacy.microsoft.com/)
\ No newline at end of file
+---
+title: Windows and the GDPR-Information for IT Administrators and Decision Makers
+description: Use this topic to understand the relationship between users in your organization and Microsoft in the context of the GDPR (General Data Protection Regulation).
+keywords: privacy, GDPR, windows, IT
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: high
+audience: ITPro
+author: dansimp
+ms.author: dansimp
+manager: dansimp
+ms.collection: M365-security-compliance
+ms.topic: article
+ms.date: 05/11/2018
+ms.reviewer: 
+---
+# Windows and the GDPR: Information for IT Administrators and Decision Makers
+
+Applies to:
+- Windows 10, version 1703 and newer
+- Windows 10 Team Edition, version 1703 for Surface Hub
+- Windows Server 2016 and newer
+- Desktop Analytics
+
+This topic provides IT Decision Makers with a basic understanding of the relationship between users in an organization and Microsoft in the context of the GDPR (General Data Protection Regulation). You will also learn what role an IT organization plays for that relationship.
+
+For more information about the GDPR, see:
+* [Microsoft GDPR Overview](https://aka.ms/GDPROverview)
+* [Microsoft Trust Center FAQs about the GDPR](https://aka.ms/gdpr-faq)
+* [Microsoft Service Trust Portal (STP)](https://aka.ms/stp)
+* [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted)
+
+## GDPR fundamentals
+
+Here are some GDPR fundamentals:
+
+* On May 25, 2018, this EU data privacy law is implemented. It sets a new global bar for data privacy rights, security, and compliance.
+* The GDPR is fundamentally about protecting and enabling the privacy rights of individuals – both customers and employees.
+* The European law establishes strict global data privacy requirements governing how organizations manage and protect personal data while respecting individual choice – no matter where data is sent, processed, or stored.
+* A request by an individual to an organization to take an action on their personal data is referred to here as a *data subject request*, or *DSR*.
+
+Microsoft believes data privacy is a fundamental right, and that the GDPR is an important step forward for clarifying and enabling individual privacy rights. We also recognize that the GDPR required significant changes by organizations all over the world with regard to the discovery, management, protection, and reporting of personal data that is collected, processed, and stored within an organization.
+
+### What is personal data under the GDPR?
+
+Article 4 (1) of [the GDPR](http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=en) defines personal data as any information relating to an identified or identifiable person. There is no distinction between a person’s private, public, or work roles. As defined by the GDPR, personal data includes, but is not limited to:
+* Name
+* Email address
+* Credit card numbers
+* IP addresses
+* Social media posts
+* Location information
+* Handwriting patterns
+* Voice input to cloud-based speech services
+
+### Controller and processor under the GDPR: Who does what
+
+#### Definition
+
+The GDPR describes specific requirements for allocating responsibility for controller and processor activities related to personal data. Thus, every organization that processes personal data must determine whether it is acting as a controller or processor for a specific scenario.
+
+* **Controller**: GDPR Article 4 (7) defines the ‘controller’ as the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
+* **Processor**: According to the GDPR Article 4 (8) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
+
+#### Controller scenario
+
+For example, when an organization is using Microsoft Windows Defender Advanced Threat Protection (ATP) to detect, investigate, and respond to advanced threats on their networks as part of their IT operations, that organization is collecting data from the user’s device – data, that might include personal data. In this scenario, the organization is the *controller* of the respective personal data, since the organization controls the purpose and means of the processing for data being collected from the devices that have Windows Defender ATP enabled.
+
+#### Processor scenario
+
+In the controller scenario described above, Microsoft is a *processor* because Microsoft provides data processing services to that controller (in the given example, an organization that subscribed to Windows Defender ATP and enabled it for the user’s device). As processor, Microsoft only processes data on behalf of the enterprise customer and does not have the right to process data beyond their instructions as specified in a written contract, such as the [Microsoft Product Terms and the Microsoft Online Services Terms (OST)](https://www.microsoft.com/licensing/product-licensing/products.aspx).
+
+## GDPR relationship between a Windows 10 user and Microsoft
+
+For Windows 10 services, Microsoft usually is the controller (with exceptions, such as Windows Defender ATP). The following sections describe what that means for the related data.
+
+### Types of data exchanged with Microsoft
+
+Microsoft collects data from or generates data through interactions with users of Windows 10 devices. This information can contain personal data, as defined in [Article 4 (1) of the GDPR](http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ:L:2016:119:FULL&from=EN), that may be used to provide, support, and improve Windows 10 services.
+
+Microsoft discloses data collection and privacy practices in detail, for example:
+* As part of the Windows 10 installation;
+* In the Windows 10 privacy settings;
+* Via the web-based [Microsoft Privacy dashboard](https://account.microsoft.com/privacy); and
+* In the [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement).
+
+It is important to differentiate between two distinct types of data Windows services are dealing with.
+
+#### Windows functional data
+
+A user action, such as performing a Skype call, usually triggers the collection and transmission of Windows *functional data*. Some Windows components and applications connecting to Microsoft services also exchange Windows functional data to provide user functionality.
+
+Some other examples of Windows functional data:
+* The Weather app which can use the device’s location to retrieve local weather or community news.
+* Wallpaper and desktop settings that are synchronized across multiple devices.
+
+For more info on how IT Professionals can manage Windows functional data sent from an organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
+
+#### Windows diagnostic data
+
+Windows diagnostic data is used to keep the operating system secure and up-to-date, troubleshoot problems, and make product improvements. The data is encrypted before being sent back to Microsoft.
+
+Some examples of diagnostic data include:
+* The type of hardware being used, information about installed apps and usage details, and reliability data on drivers running on the device.
+* For users who have turned on “Tailored experiences”, it can be used to offer personalized tips, ads, and recommendations to enhance Microsoft products and services for the needs of the user.
+
+Diagnostic data is categorized into the levels "Security", "Basic", "Enhanced", and "Full". For a detailed discussion about these diagnostic data levels please see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). To find more about what information is collected and how it is handled, see [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data).
+
+> [!IMPORTANT]
+> Other Microsoft services as well as 3rd party applications and drivers running on Windows devices may implement their own functionality, independently from Windows, to transport their diagnostic data. Please contact the publisher for further guidance on how to control the diagnostic data collection level and transmission of these applications and services.
+
+### Windows services where Microsoft is the processor under the GDPR
+
+Most Windows 10 services are controller services in terms of the GDPR – for both Windows functional data and Windows diagnostic data. But there are a few Windows services where Microsoft is a processor for functional data under the GDPR, such as [Desktop Analytics](https://aka.ms/dadocs), [Update Compliance](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor) and [Windows Defender Advanced Threat Protection (ATP)](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp).
+
+>[!NOTE]
+>Both Desktop Analytics and Windows Defender ATP are subscription services for organizations. Some functionality requires a certain license (please see [Compare Windows 10 editions](https://www.microsoft.com/windowsforbusiness/compare)).
+
+#### Desktop Analytics
+
+> [!IMPORTANT]
+> The Upgrade Readiness and Device Health solutions of Windows Analytics are being retired on January 31, 2020. [Update Compliance](/windows/deployment/update/update-compliance-get-started) will continue to be supported.
+> For more information, see [Windows Analytics retirement on January 31, 2020](https://support.microsoft.com/en-us/help/4521815/windows-analytics-retirement).
+
+[Desktop Analytics](https://aka.ms/dadocs) is a cloud-based service that integrates with Configuration Manager. The service provides insight and intelligence for you to make more informed decisions about the update readiness of Windows Windows devices in their environment. It uses Windows diagnostic data from devices enrolled by the IT organization of an enterprise with data aggregated from millions of devices into the Desktop Analytics service.
+
+Windows [transmits Windows diagnostic data](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) to Microsoft datacenters, where that data is analyzed and stored. With Desktop Analytics, the IT organization can then view the analyzed data to detect and fix issues or to improve their processes for upgrading to Windows 10.
+
+As a result, in terms of the GDPR, the organization that has subscribed to Desktop Analytics is acting as the controller, while Microsoft is the processor for Desktop Analytics.
+> [!NOTE]
+> The IT organization must explicitly enable Desktop Analytics for a device after the organization subscribes.
+
+> [!IMPORTANT]
+> Desktop Analytics does not collect Windows Diagnostic data by itself. Instead, Desktop Analytics only uses a subset of Windows Diagnostic data that is collected by Windows for an enrolled device. The Windows Diagnostic data collection is controlled by the IT department of an organization or the user of a device. See [Enable data sharing for Desktop Analytics](https://docs.microsoft.com/sccm/desktop-analytics/enable-data-sharing)
+
+#### Windows Defender ATP
+
+[Windows Defender ATP](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) is cloud-based service that collects and analyzes usage data from an organization’s devices to detect security threats. Some of the data can contain personal data as defined by the GDPR. Enrolled devices transmit usage data to Microsoft datacenters, where that data is analyzed, processed, and stored. The security operations center (SOC) of the organization can view the analyzed data using the [Windows Defender ATP portal](https://securitycenter.windows.com/).
+
+As a result, in terms of the GDPR, the organization that has subscribed to Windows Defender ATP is acting as the controller, while Microsoft is the processor for Windows Defender ATP.
+
+> [!NOTE]
+> The IT organization must explicitly enable Windows Defender ATP for a device after the organization subscribes.
+
+#### At a glance – Windows 10 services GDPR mode of operations
+
+The following table lists in what GDPR mode – controller or processor – Windows 10 services are operating.
+
+| Service | Microsoft GDPR mode of operation |
+| --- | --- |
+| Windows Functional data | Controller or Processor* |
+| Windows Diagnostic data | Controller |
+| Desktop Analytics | Processor |
+| Windows Defender Advanced Threat Detection (ATP) | Processor |
+
+*Table 1: Windows 10 GDPR modes of operations for different Windows 10 services*
+
+*/*Depending on which application/feature this is referring to.*
+
+## Windows diagnostic data and Windows 10
+
+
+### Recommended Windows 10 settings
+
+Windows diagnostic data collection level for Windows 10 can be set by a user in Windows (*Start > Settings > Privacy > Diagnostics & feedback*) or by the IT department of an organization, using Group Policy or Mobile Device Management (MDM) techniques.
+
+* For Windows 10, version 1803 and version 1809, Microsoft recommends setting the Windows diagnostic level to “Enhanced”. This enables organizations to get the full functionality of [Desktop Analytics](#desktop-analytics).
+
+>[!NOTE]
+>For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
+
+* For Windows 10, version 1709, and Windows 10, version 1703, the recommended Windows diagnostic level configuration for EEA and Switzerland commercial users is “Basic”.
+
+>[!NOTE]
+>For Windows 7, Microsoft recommends [using  Commercial Data Opt-in setting](/previous-versions/windows/it-pro/windows-7/ee126127(v=ws.10)) to facilitate upgrade planning to Windows 10.
+
+### Additional information for Desktop Analytics
+
+The basic functionality of Desktop Analytics works at the “Basic” diagnostic data level. Other functionality of Desktop Analytics, such as usage or health data for updated devices, require “Enhanced”. 
+
+Those organizations who wish to share the smallest set of events for Desktop Analytics and have set the Windows diagnostic level to “Enhanced” can use the [“Limit Enhanced diagnostic data to the minimum required by Desktop Analytics”](/windows/privacy/configure-windows-diagnostic-data-in-your-organization#limit-enhanced-diagnostic-data-to-the-minimum-required-by-desktop-analytics) setting. This filtering mechanism was that Microsoft introduced in Windows 10, version 1709. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by Desktop Analytics.
+
+> [!NOTE]
+> Additional information can be found at [Desktop Analytics and privacy](/sccm/desktop-analytics/privacy).
+
+## Controlling Windows 10 data collection and notification about it
+
+Windows 10 sends diagnostic data to Microsoft services, and some of that data can contain personal data. Both the user and the IT organization have the ability to control the transmission of that data to Microsoft.
+
+### Adjusting privacy settings by the user
+
+A user has the ability to adjust additional privacy settings in Windows by navigating to *Start > Settings > Privacy*. For example, a user can control if location is enabled or disabled, whether or not to transmit feedback on inking and typing input to Microsoft for improving the personal accuracy of these services, or if Windows collects activities for syncing it with other devices.
+
+For a standard user in an organization, some privacy settings might be controlled by their IT department. This is done using Group Policies or Mobile Device Management (MDM) settings. If this is the case, the user will see an alert that says ‘Some settings are hidden or managed by your organization’ when they navigate to *Start > Settings > Privacy*. As such, the user can only change some settings, but not all.
+
+### Users can lower the diagnostic level
+
+Starting with Windows 10, version 1803, a user can change the Windows diagnostics data level for their device below to what was set by their IT department. Organizations can allow or disallow this feature by configuring the Group Policy **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in setting user interface** or the MDM policy **ConfigureTelemetryOptInSettingsUx**.
+
+If an IT organization has not disabled this policy, users within the organization can change their own Windows diagnostic data collection level in *Start > Settings > Privacy > Diagnostics & feedback*. For example, if the IT organization enabled this policy and set the level to “Full”, a user can modify the Windows diagnostics data level setting to “Basic”.
+
+### Notification at logon
+
+Windows 10, version 1803, and later can provide users with a notification during their logon. If the IT organization has not disabled the Group Policy **Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\Configure telemetry opt-in change notifications** or the MDM policy **ConfigureTelemetryOptInChangeNotification**, Windows diagnostic data notifications can appear at logon so that the users of a device are aware of the data collection.
+
+This notification can also be shown when the diagnostic level for the device was changed. For instance, if the diagnostic level on the device is set to “Basic” and the IT organization changes it to “Full”, users will be notified on their next logon.
+
+### Diagnostic Data Viewer (DDV)
+
+In Windows 10, version 1803 and later, users can invoke the [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) to see what Windows diagnostic data is collected on their local device. This app lets a user review the diagnostic data collected on his device that is being sent to Microsoft. The DDV groups the information into simple categories based on how it is used by Microsoft.
+
+A user can turn on Windows diagnostic data viewing by going to go to *Start > Settings > Privacy > Diagnostics & feedback*. Under the ‘Diagnostic data viewer’ section, the user has to enable the ‘If data viewing is enabled, you can see your diagnostics data’ option. After DDV is installed on the device, the user can start it by clicking the ‘Diagnostic Data Viewer’ in the ‘Diagnostic data viewer’ section of *Start > Settings > Privacy > Diagnostics & feedback*.
+
+Also, the user can delete all Windows diagnostic data collected from the device. This is done by clicking the ‘Delete’ button in the ‘Delete diagnostic data’ section of *Start > Settings > Privacy > Diagnostics & feedback*.
+
+### Windows 10 personal data services configuration
+
+Microsoft assembled a list of Windows 10 services configuration settings that are useful for personal data privacy protection and related regulations, such as the General Data Protection Regulation (GDPR). There is one section with settings for service data that is managed at Microsoft and a section for local data that is managed by an IT organization.
+
+IT Professionals that are interested in this configuration, see [Windows 10 personal data services configuration](windows-personal-data-services-configuration.md).
+
+### Windows 10 connections to Microsoft
+
+To find out more about the network connections that Windows components make to Microsoft as well as the privacy settings that affect data shared with either Microsoft or apps, see [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services). This article describe how these settings can be managed by an IT Professional, and fronts an array of Windows version-specific articles.
+
+### At-a-glance: the relationship between an IT organization and the GDPR
+
+Because Microsoft is a controller for data collected by Windows 10, the user can work with Microsoft to satisfy GDPR requirements. While this relationship between Microsoft and a user is evident in a consumer scenario, an IT organization can influence that relationship in an enterprise scenario. For example, the IT organization has the ability to centrally configure the Windows diagnostic data level by using Group Policy or MDM settings.
+
+## Windows Server
+
+Windows Server follows the same mechanisms as Windows 10 for handling of personal data – for example, when collecting Windows diagnostic data.
+
+More detailed information about Windows Server and the GDPR is available at Beginning your General Data Protection Regulation (GDPR) journey for Windows Server.
+
+### Windows diagnostic data and Windows Server
+
+The lowest diagnostic data setting level supported on Windows Server 2016 and Windows Server 2019 through management policies is “Security”. The lowest diagnostic data setting supported through the Settings UI is “Basic”. The default diagnostic data level for all Windows Server 2016 and Windows Server 2019 editions is “Enhanced”.
+
+IT administrators can configure the Windows Server diagnostic data settings using familiar management tools, such as Group Policy, MDM, or Windows Provisioning. IT administrators can also manually change settings using Registry Editor. Setting the Windows Server diagnostic data levels through a management policy overrides any device-level settings.
+
+There are two options for deleting Windows diagnostic data from a Windows Server machine:
+
+- If the “Desktop Experience” option was chosen during the installation of Windows Server 2019, then there are the same options available for an IT administrator that end users have with Windows 10, version 1803 and version 1809, to submit a request for deleting that device’s diagnostic data. This is done by clicking the **Delete** button in the **Delete diagnostic data** section of **Start > Settings > Privacy > Diagnostics & feedback**.
+- Microsoft has provided a [PowerShell cmdlet](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata) that IT administrators can use to delete Windows diagnostic data via the command line on a machine running Windows Server 2016 or Windows Server 2019. This cmdlet provides the same functionality for deleting Windows diagnostic data as with Desktop Experience on Windows Server 2019. For more information, see [the PowerShell Gallery](https://www.powershellgallery.com/packages/WindowsDiagnosticData).
+
+### Backups and Windows Server
+
+Backups, including live backups and backups that are stored locally within an organization or in the cloud, can contain personal data.
+
+- Backups an organizations creates, for example by using Windows Server Backup (WSB), are under its control. For example, for exporting personal data contained in a backup, the organization needs to restore the appropriate backup sets to facilitate the respective data subject request (DSR).
+- The GDPR also applies when storing backups in the cloud. For example, an organization can use Microsoft Azure Backup to backup files and folders from physical or virtual Windows Server machines (located on-premises or in Azure) to the cloud. The organization that is subscribed to this backup service also has the obligation to restore the data in order to exercise the respective DSR.
+
+## Windows 10 Team Edition, Version 1703 for Surface Hub
+
+Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to a user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store.
+
+> [!NOTE]
+> Additional apps running on the device, that are not delivered as part of the in-box experience of Surface Hub, may implement their own diagnostic data collection and transmission functionality independently to collect and process personal data. Please contact the app publisher for further guidance on how to control this.
+
+An IT administrator can configure privacy- related settings, such as setting the Windows diagnostic data level to Basic. Surface Hub does not support group policy for centralized management; however, IT administrators can use MDM to apply these settings to Surface Hub. For more information about Surface Hub and MDM, please see [Manage settings with an MDM provider](https://docs.microsoft.com/surface-hub/manage-settings-with-mdm-for-surface-hub).
+
+## Further reading
+
+### Optional settings / features that further improve the protection of personal data
+
+Personal data protection is one of the goals of the GDPR. One way of improving personal data protection is to use the modern and advanced security features of Windows 10. An IT organization can learn more at [Mitigate threats by using Windows 10 security features](/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10) and [Standards for a highly secure Windows 10 device](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-highly-secure).
+
+> [!NOTE]
+> Some of these features might require a particular Windows hardware, such as a computer with a Trusted Platform Module (TPM) chip, and can depend on a particular Windows product (such as Windows 10 E5).
+
+### Windows Security Baselines
+
+Microsoft has created Windows Security Baselines to efficiently configure Windows 10 and Windows Server. For more information, please visit [Windows Security Baselines](/windows/security/threat-protection/windows-security-baselines).
+
+### Windows Restricted Traffic Limited Functionality Baseline
+
+To make it easier to deploy settings that restrict connections from Windows 10 and Windows Server to Microsoft, IT Professionals can apply the Windows Restricted Traffic Limited Functionality Baseline, available [here](https://go.microsoft.com/fwlink/?linkid=828887).
+
+>[!IMPORTANT]
+>Some of the settings of the Windows Restricted Traffic Limited Functionality Baseline will reduce the functionality and security configuration of a device in the organization and are therefore not recommended.
+
+### Microsoft Trust Center and Service Trust Portal
+
+Please visit our [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/trustcenter/privacy/gdpr) to obtain additional resources and to learn more about how Microsoft can help you fulfill specific GDPR requirements. There you can find lots of useful information about the GDPR, including how Microsoft is helping customers to successfully master the GDPR, a FAQ list, and a list of [resources for GDPR compliance](https://www.microsoft.com/TrustCenter/Privacy/gdpr/resources). Also, please check out the [Compliance Manager](https://aka.ms/compliancemanager) of the Microsoft [Service Trust Portal (STP)](https://aka.ms/stp) and [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted).
+
+### Additional resources
+
+#### FAQs
+
+* [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy)
+* [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy)
+* [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy)
+* [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense)
+
+#### Blogs
+
+* [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10)
+
+#### Privacy Statement
+
+* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
+
+#### Other resources
+
+* [Privacy at Microsoft](https://privacy.microsoft.com/)
diff --git a/windows/privacy/gdpr-win10-whitepaper.md b/windows/privacy/gdpr-win10-whitepaper.md
index 62925e34b9..fb8707befe 100644
--- a/windows/privacy/gdpr-win10-whitepaper.md
+++ b/windows/privacy/gdpr-win10-whitepaper.md
@@ -1,6 +1,6 @@
 ---
-title: Beginning your General Data Protection Regulation (GDPR) journey for Windows 10 (Windows 10)
-description: Use this article to understand what GDPR is and about the products Microsoft provides to help you get started towards compliance.
+title: General Data Protection Regulation (GDPR) for Windows 10
+description: Use this article to understand what GDPR is and which products Microsoft provides to help you get started towards compliance.
 keywords: privacy, GDPR
 ms.prod: w10
 ms.mktglfcycl: manage
@@ -8,12 +8,13 @@ ms.sitesec: library
 ms.pagetype: security
 ms.localizationpriority: high
 audience: ITPro
-author: pwiglemsft
-ms.author: pwigle
+author: dansimp
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
 ms.date: 09/25/2017
+ms.reviewer: 
 ---
 
 # Beginning your General Data Protection Regulation (GDPR) journey for Windows 10
@@ -29,7 +30,7 @@ Microsoft and our customers are now on a journey to achieve the privacy goals of
 
 We have outlined our commitment to the GDPR and how we are supporting our customers within the [Get GDPR compliant with the Microsoft Cloud](https://blogs.microsoft.com/on-the-issues/2017/02/15/get-gdpr-compliant-with-the-microsoft-cloud/#hv52B68OZTwhUj2c.99) blog post by our Chief Privacy Officer [Brendon Lynch](https://blogs.microsoft.com/on-the-issues/author/brendonlynch/) and the [Earning your trust with contractual commitments to the General Data Protection Regulation](https://blogs.microsoft.com/on-the-issues/2017/04/17/earning-trust-contractual-commitments-general-data-protection-regulation/#6QbqoGWXCLavGM63.99)” blog post by [Rich Sauer](https://blogs.microsoft.com/on-the-issues/author/rsauer/) - Microsoft Corporate Vice President & Deputy General Counsel.
 
-Although your journey to GDPR-compliance may seem challenging, we're here to help you. For specific information about the GDPR, our commitments and how to begin your journey, please visit the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/privacy/gdpr).
+Although your journey to GDPR-compliance may seem challenging, we're here to help you. For specific information about the GDPR, our commitments and how to begin your journey, please visit the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/trustcenter/privacy/gdpr).
 
 ## GDPR and its implications
 The GDPR is a complex regulation that may require significant changes in how you gather, use and manage personal data. Microsoft has a long history of helping our customers comply with complex regulations, and when it comes to preparing for the GDPR, we are your partner on this journey.
@@ -81,7 +82,7 @@ Given how much is involved to become GDPR-compliant, we strongly recommend that
 
     ![Diagram about how the 4 key GDPR steps work together](images/gdpr-steps-diagram.png)
 
-For each of the steps, we've outlined example tools, resources, and features in various Microsoft solutions, which can be used to help you address the requirements of that step. While this article isn't a comprehensive “how to,” we've included links for you to find out more details, and more information is available in the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/privacy/gdpr).
+For each of the steps, we've outlined example tools, resources, and features in various Microsoft solutions, which can be used to help you address the requirements of that step. While this article isn't a comprehensive “how to,” we've included links for you to find out more details, and more information is available in the [GDPR section of the Microsoft Trust Center](https://www.microsoft.com/trustcenter/privacy/gdpr).
 
 ## Windows 10 security and privacy
 As you work to comply with the GDPR, understanding the role of your desktop and laptop client machines in creating, accessing, processing, storing and managing data that may qualify as personal and potentially sensitive data under the GDPR is important. Windows 10 provides capabilities that will help you comply with the GDPR requirements to implement appropriate technical and organizational security measures to protect personal data.
@@ -104,11 +105,11 @@ A key provision within the GDPR is data protection by design and by default, and
 
 The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. Some of the key advantages of using TPM technology are that you can:
 
--	Generate, store, and limit the use of cryptographic keys.
+- Generate, store, and limit the use of cryptographic keys.
 
--	Use TPM technology for platform device authentication by using the TPM’s unique RSA key, which is burned into itself.
+- Use TPM technology for platform device authentication by using the TPM’s unique RSA key, which is burned into itself.
 
--	Help to ensure platform integrity by taking and storing security measurements.
+- Help to ensure platform integrity by taking and storing security measurements.
 
 Additional advanced device protection relevant to your operating without data breaches include Windows Trusted Boot to help maintain the integrity of the system by ensuring malware is unable to start before system defenses.
 
@@ -251,7 +252,7 @@ There are numerous ways one can use the Windows Hello Companion Device Framework
 - Wear a fitness band that has already authenticated the wearer. Upon approaching PC, and by performing a special gesture (like clapping), the PC unlocks.
 
 #### Protection against attacks by isolating user credentials
-As noted in the [Windows 10 Credential Theft Mitigation Guide](https://www.microsoft.com/en-us/download/confirmation.aspx?id=54095), “_the tools and techniques criminals use to carry out credential theft and reuse attacks improve, malicious attackers are finding it easier to achieve their goals. Credential theft often relies on operational practices or user credential exposure, so effective mitigations require a holistic approach that addresses people, processes, and technology. In addition, these attacks rely on the attacker stealing credentials after compromising a system to expand or persist access, so organizations must contain breaches rapidly by implementing strategies that prevent attackers from moving freely and undetected in a compromised network._”
+As noted in the [Windows 10 Credential Theft Mitigation Guide](https://www.microsoft.com/download/confirmation.aspx?id=54095), “_the tools and techniques criminals use to carry out credential theft and reuse attacks improve, malicious attackers are finding it easier to achieve their goals. Credential theft often relies on operational practices or user credential exposure, so effective mitigations require a holistic approach that addresses people, processes, and technology. In addition, these attacks rely on the attacker stealing credentials after compromising a system to expand or persist access, so organizations must contain breaches rapidly by implementing strategies that prevent attackers from moving freely and undetected in a compromised network._”
 
 An important design consideration for Windows 10 was mitigating credential theft — in particular, derived credentials. Windows Defender Credential Guard provides significantly improved security against derived credential theft and reuse by implementing a significant architectural change in Windows designed to help eliminate hardware-based isolation attacks rather than simply trying to defend against them.
 
diff --git a/windows/privacy/images/ddv-analytics.png b/windows/privacy/images/ddv-analytics.png
new file mode 100644
index 0000000000..499a541b00
Binary files /dev/null and b/windows/privacy/images/ddv-analytics.png differ
diff --git a/windows/privacy/images/ddv-event-view.jpg b/windows/privacy/images/ddv-event-view.jpg
new file mode 100644
index 0000000000..0a6c2ef113
Binary files /dev/null and b/windows/privacy/images/ddv-event-view.jpg differ
diff --git a/windows/privacy/images/ddv-event-view.png b/windows/privacy/images/ddv-event-view.png
deleted file mode 100644
index 264add2d9c..0000000000
Binary files a/windows/privacy/images/ddv-event-view.png and /dev/null differ
diff --git a/windows/privacy/images/ddv-problem-reports.png b/windows/privacy/images/ddv-problem-reports.png
index 49ae0fffc0..bd3dc7ba7d 100644
Binary files a/windows/privacy/images/ddv-problem-reports.png and b/windows/privacy/images/ddv-problem-reports.png differ
diff --git a/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md b/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md
index 142906d55e..8fa6e44dc7 100644
--- a/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md
+++ b/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md
@@ -8,12 +8,13 @@ ms.sitesec: library
 ms.pagetype: security
 ms.localizationpriority: high
 audience: ITPro
-author: danihalfin
-ms.author: daniha
+author: dansimp
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
 ms.date: 11/16/2018
+ms.reviewer: 
 robots: noindex,nofollow
 ---
 
@@ -45,7 +46,7 @@ d) use the software in any way that is against the law or to create or propagate
 
 e) share, publish, distribute, or lend the software, provide the software as a stand-alone hosted solution for others to use, or transfer the software or this agreement to any third party.
 
-4. EXPORT RESTRICTIONS. You must comply with all domestic and international export laws and regulations that apply to the software, which include restrictions on destinations, end users, and end use. For further information on export restrictions, visit http://aka.ms/exporting.
+4. EXPORT RESTRICTIONS. You must comply with all domestic and international export laws and regulations that apply to the software, which include restrictions on destinations, end users, and end use. For further information on export restrictions, visit https://aka.ms/exporting.
 
 5. SUPPORT SERVICES. Microsoft is not obligated under this agreement to provide any support services for the software. Any support provided is “as is”, “with all faults”, and without warranty of any kind.
 
@@ -61,9 +62,9 @@ b) Canada. If you acquired this software in Canada, you may stop receiving updat
 
 c) Germany and Austria.
 
-i.	Warranty. The properly licensed software will perform substantially as described in any Microsoft materials that accompany the software. However, Microsoft gives no contractual guarantee in relation to the licensed software.
+i. Warranty. The properly licensed software will perform substantially as described in any Microsoft materials that accompany the software. However, Microsoft gives no contractual guarantee in relation to the licensed software.
 
-ii.	Limitation of Liability. In case of intentional conduct, gross negligence, claims based on the Product Liability Act, as well as, in case of death or personal or physical injury, Microsoft is liable according to the statutory law.
+ii. Limitation of Liability. In case of intentional conduct, gross negligence, claims based on the Product Liability Act, as well as, in case of death or personal or physical injury, Microsoft is liable according to the statutory law.
 
 Subject to the foregoing clause ii., Microsoft will only be liable for slight negligence if Microsoft is in breach of such material contractual obligations, the fulfillment of which facilitate the due performance of this agreement, the breach of which would endanger the purpose of this agreement and the compliance with which a party may constantly trust in (so-called "cardinal obligations"). In other cases of slight negligence, Microsoft will not be liable for slight negligence.
 
@@ -93,4 +94,4 @@ Cette limitation concerne:
 
 Elle s’applique également, même si Microsoft connaissait ou devrait connaître l’éventualité d’un tel dommage. Si votre pays n’autorise pas l’exclusion ou la limitation de responsabilité pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l’exclusion ci-dessus ne s’appliquera pas à votre égard.
 
-EFFET JURIDIQUE. Le présent contrat décrit certains droits juridiques. Vous pourriez avoir d’autres droits prévus par les lois de votre pays. Le présent contrat ne modifie pas les droits que vous confèrent les lois de votre pays si celles-ci ne le permettent pas.
\ No newline at end of file
+EFFET JURIDIQUE. Le présent contrat décrit certains droits juridiques. Vous pourriez avoir d’autres droits prévus par les lois de votre pays. Le présent contrat ne modifie pas les droits que vous confèrent les lois de votre pays si celles-ci ne le permettent pas.
diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md
new file mode 100644
index 0000000000..291b0a7d56
--- /dev/null
+++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md
@@ -0,0 +1,174 @@
+---
+title: Manage connections from Windows operating system components to Microsoft services using Microsoft Intune MDM Server
+description: Use MDM CSPs to minimize connections from Windows to Microsoft services, or to configure particular privacy settings.
+ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9
+keywords: privacy, manage connections to Microsoft, Windows 10
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.localizationpriority: high
+audience: ITPro
+author: medgarmedgar
+ms.author: v-medgar
+manager: sanashar
+ms.date: 9/10/2019
+---
+
+# Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server
+
+**Applies to**
+
+-   Windows 10 Enterprise 1903 version and newer
+
+
+This article describes the network connections that Windows 10 components make to Microsoft and the Mobile Device Management/Configuration Service Provider (MDM/CSP) and custom Open Mobile Alliance Uniform Resource Identifier ([OMA URI](https://docs.microsoft.com/intune/custom-settings-windows-10)) policies available to IT Professionals using Microsoft Intune to help manage the data shared with Microsoft. If you want to minimize connections from Windows to Microsoft services, or configure privacy settings, there are a number of settings for consideration. For example, you can configure diagnostic data to the lowest level for your edition of Windows and evaluate other connections Windows makes to Microsoft services you want to turn off using the instructions in this article.  While it is possible to minimize network connections to Microsoft, there are many reasons why these communications are enabled by default, such as updating malware definitions and maintaining current certificate revocation lists. This data helps us deliver a secure, reliable, and up-to-date experience.
+
+>[!IMPORTANT]
+>- The Allowed Traffic endpoints for an MDM configuration are here: [Allowed Traffic](#bkmk-mdm-allowedtraffic)
+>   - CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) network traffic cannot be disabled and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of these authorities. There are many others such as DigiCert, Thawte, Google, Symantec, and VeriSign.
+>   - There is some traffic which is specifically required for the Microsoft Intune based management of Windows 10 devices. This traffic includes Windows Notifications Service (WNS), Automatic Root Certificates Update (ARCU), and some Windows Update related traffic. The aforementioned traffic comprises the Allowed Traffic for Microsoft Intune MDM Server to manage Windows 10 devices.
+>- For security reasons, it is important to take care in deciding which settings to configure as some of them may result in a less secure device. Examples of settings that can lead to a less secure device configuration include: disabling Windows Update, disabling Automatic Root Certificates Update, and disabling Windows Defender. Accordingly, we do not recommend disabling any of these features.
+>- To ensure CSPs take priority over Group Policies in case of conflicts, use the [ControlPolicyConflict](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-controlpolicyconflict) policy.
+>- The **Get Help** and **Give us Feedback** links in Windows may no longer work after applying some or all of the MDM/CSP settings.
+
+For more information on Microsoft Intune please see [Transform IT service delivery for your modern workplace](https://www.microsoft.com/en-us/enterprise-mobility-security/microsoft-intune?rtc=1) and [Microsoft Intune documentation](https://docs.microsoft.com/intune/).
+
+For detailed information about managing network connections to Microsoft services using Windows Settings, Group Policies and Registry settings see [Manage connections from Windows 10 operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services).
+
+We are always striving to improve our documentation and welcome your feedback. You can provide feedback by sending email to **telmhelp**@**microsoft.com**. 
+
+
+## Settings for Windows 10 Enterprise edition 1903 and newer
+
+The following table lists management options for each setting.
+
+For Windows 10, the following MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
+
+1. **Automatic Root Certificates Update**
+   1. MDM Policy: There is intentionally no MDM available for Automatic Root Certificate Update. This MDM does not exist since it would prevent the operation and management of MDM management of devices.
+
+1. **Cortana and Search**
+   1. MDM Policy: [Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana). Choose whether to let Cortana install and run on the device. **Set to 0 (zero)**
+   1. MDM Policy: [Search/AllowSearchToUseLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-search#search-allowsearchtouselocation). Choose whether Cortana and Search can provide location-aware search results. **Set to 0 (zero)**
+
+1. **Date & Time**
+   1. MDM Policy: [Settings/AllowDateTime](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-settings#settings-allowdatetime). Allows the user to change date and time settings.  **Set to 0 (zero)**
+
+1. **Device metadata retrieval** 
+   1. MDM Policy: [DeviceInstallation/PreventDeviceMetadataFromNetwork](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventdevicemetadatafromnetwork). Choose whether to prevent Windows from retrieving device metadata from the Internet.  **Set to Enabled**
+
+1. **Find My Device** 
+   1. MDM Policy: [Experience/AllowFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice). This policy turns on Find My Device.  **Set to 0  (zero)**
+
+1. **Font streaming** 
+   1. MDM Policy: [System/AllowFontProviders](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowfontproviders).  Setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. **Set to 0  (zero)**
+1. **Insider Preview builds** 
+   1. MDM Policy: [System/AllowBuildPreview](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowbuildpreview). This policy setting determines whether users can access the Insider build controls in the Advanced Options for Windows Update. **Set to 0  (zero)**
+
+1. **Internet Explorer** The following Microsoft Internet Explorer MDM policies are available in the [Internet Explorer CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer)
+   1. MDM Policy: [InternetExplorer/AllowSuggestedSites](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-allowsuggestedsites). Recommends websites based on the user’s browsing activity. **Set to Disabled**
+   1. MDM Policy: [InternetExplorer/PreventManagingSmartScreenFilter]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-preventmanagingsmartscreenfilter). Prevents the user from managing Windows Defender SmartScreen, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware. **Set to String** with Value:
+      1. **\\**
+   1. MDM Policy: [InternetExplorer/DisableFlipAheadFeature]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disableflipaheadfeature). Determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website. **Set to Enabled**
+   1. MDM Policy: [InternetExplorer/DisableHomePageChange]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablehomepagechange). Determines whether users can change the default Home Page or not. **Set to String** with Value:
+      1. **\\**
+   1. MDM Policy: [InternetExplorer/DisableFirstRunWizard]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer#internetexplorer-disablefirstrunwizard). Prevents Internet Explorer from running the First Run wizard the first time a user starts the browser after installing Internet Explorer or Windows. **Set to String** with Value:
+      1. **\\** 
+
+1. **Live Tiles**
+   1. MDM Policy: [Notifications/DisallowTileNotification](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-notifications). This policy setting turns off tile notifications. If you enable this policy setting applications and system features will not be able to update their tiles and tile badges in the Start screen.  **Integer value 1**
+
+1. **Mail synchronization**
+   1. MDM Policy: [Accounts/AllowMicrosoftAccountConnection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-accounts#accounts-allowmicrosoftaccountconnection). Specifies whether the user is allowed to use an MSA account for non-email related connection authentication and services. **Set to 0 (zero)**
+
+1. **Microsoft Account**
+   1. MDM Policy: [Accounts/AllowMicrosoftAccountSignInAssistant](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-accounts#accounts-allowmicrosoftaccountsigninassistant). Disable the Microsoft Account Sign-In Assistant. **Set to 0 (zero)**
+
+1. **Microsoft Edge** The following Microsoft Edge MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/available-policies).
+   1. MDM Policy: [Browser/AllowAutoFill](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowautofill). Choose whether employees can use autofill on websites. **Set to 0 (zero)**
+   1. MDM Policy: [Browser/AllowDoNotTrack](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowdonottrack). Choose whether employees can send Do Not Track headers. **Set to 0 (zero)**
+   1. MDM Policy: [Browser/AllowMicrosoftCompatbilityList](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowmicrosoftcompatibilitylist). Specify the Microsoft compatibility list in Microsoft Edge. **Set to 0 (zero)**
+   1. MDM Policy: [Browser/AllowPasswordManager](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowpasswordmanager). Choose whether employees can save passwords locally on their devices. **Set to 0 (zero)**
+   1. MDM Policy: [Browser/AllowSearchSuggestionsinAddressBar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsearchsuggestionsinaddressbar). Choose whether the Address Bar shows search suggestions. **Set to 0  (zero)**
+   1. MDM Policy: [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen). Choose whether Windows Defender SmartScreen is turned on or off.  **Set to 0  (zero)**
+
+1. **Network Connection Status Indicator**
+   1. [Connectivity/DisallowNetworkConnectivityActiveTests](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-connectivity#connectivity-disallownetworkconnectivityactivetests).  Note: After you apply this policy you must restart the device for the policy setting to take effect. **Set to 1 (one)**
+
+1. **Offline maps**
+   1. MDM Policy: [AllowOfflineMapsDownloadOverMeteredConnection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-maps). Allows the download and update of map data over metered connections. 
                                   **Set to 0 (zero)**
+   1. MDM Policy: [EnableOfflineMapsAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-maps#maps-enableofflinemapsautoupdate). Disables the automatic download and update of map data. **Set to 0  (zero)**
+
+1. **OneDrive**
+   1. MDM Policy: [DisableOneDriveFileSync](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-disableonedrivefilesync). Allows IT Admins to prevent apps and features from working with files on OneDrive. **Set to 1 (one)** 
+   1. Ingest the ADMX - To get the latest OneDrive ADMX file you need an up-to-date Windows 10 client. The ADMX files are located under the following path: %LocalAppData%\Microsoft\OneDrive\ there's a folder with the current OneDrive build (e.g. "18.162.0812.0001"). There is a folder named "adm" which contains the admx and adml policy definition files. 
+   1. MDM Policy: Prevent Network Traffic before User SignIn. **PreventNetworkTrafficPreUserSignIn**. The OMA-URI value is:  **./Device/Vendor/MSFT/Policy/Config/OneDriveNGSC\~Policy\~OneDriveNGSC/PreventNetworkTrafficPreUserSignIn**, Data type: **String**, Value: **\**
+
+
+1. **Privacy settings** Except for the Feedback & Diagnostics page, these settings must be configured for every user account that signs into the PC.
+   1. General - [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection). This policy setting controls the ability to send inking and typing data to Microsoft. **Set to 0 (zero)**
+   1. Location - [System/AllowLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowlocation). Specifies whether to allow app access to the Location service. **Set to 0  (zero)**
+   1. Camera - [Camera/AllowCamera](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-camera#camera-allowcamera). Disables or enables the camera. **Set to 0  (zero)**
+   1. Microphone - [Privacy/LetAppsAccessMicrophone](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessmicrophone). Specifies whether Windows apps can access the microphone. **Set to 2 (two)**
+   1. Notifications - [Privacy/LetAppsAccessNotifications](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessnotifications). Specifies whether Windows apps can access notifications. **Set to 2 (two)**
+   1. Notifications - [Settings/AllowOnlineTips]( https://docs.microsoft.com/windows/client-management/mdm/policy-csp-settings#settings-allowonlinetips). Enables or disables the retrieval of online tips and help for the Settings app. **Integer value 0**
+   1. Speech, Inking, & Typing - [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization). This policy specifies whether users on the device have the option to enable online speech recognition. **Set to 0 (zero)**
+   1. Speech, Inking, & Typing - [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection). This policy setting controls the ability to send inking and typing data to Microsoft  **Set to 0 (zero)**
+   1. Account info - [Privacy/LetAppsAccessAccountInfo](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessaccountinfo). Specifies whether Windows apps can access account information. **Set to 2 (two)**
+   1. Contacts - [Privacy/LetAppsAccessContacts](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesscontacts). Specifies whether Windows apps can access contacts. **Set to 2 (two)**
+   1. Calendar - [Privacy/LetAppsAccessCalendar](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesscalendar). Specifies whether Windows apps can access the calendar. **Set to 2 (two)**
+   1. Call history - [Privacy/LetAppsAccessCallHistory](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesscallhistory). Specifies whether Windows apps can access account information. **Set to 2 (two)** 
+   1. Email - [Privacy/LetAppsAccessEmail](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessemail). Specifies whether Windows apps can access email. **Set to 2 (two)** 
+   1. Messaging - [Privacy/LetAppsAccessMessaging](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessmessaging). Specifies whether Windows apps can read or send messages (text or MMS). **Set to 2 (two)** 
+   1. Phone calls - [Privacy/LetAppsAccessPhone](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessphone). Specifies whether Windows apps can make phone calls. **Set to 2 (two)**
+   1. Radios - [Privacy/LetAppsAccessRadios](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessradios). Specifies whether Windows apps have access to control radios. **Set to 2 (two)** 
+   1. Other devices - [Privacy/LetAppsSyncWithDevices](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappssyncwithdevices). Specifies whether Windows apps can sync with devices. **Set to 2 (two)** 
+   1. Other devices - [Privacy/LetAppsAccessTrustedDevices](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesstrusteddevices). Specifies whether Windows apps can access trusted devices. **Set to 2 (two)**
+   1. Feedback & diagnostics - [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry). Allow the device to send diagnostic and usage telemetry data, such as Watson. **Set to 0 (zero)**
+   1. Feedback & diagnostics - [Experience/DoNotShowFeedbackNotifications](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-donotshowfeedbacknotifications). Prevents devices from showing feedback questions from Microsoft.  **Set to 1 (one)** 
+   1. Background apps - [Privacy/LetAppsRunInBackground](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsruninbackground). Specifies whether Windows apps can run in the background. **Set to 2 (two)**
+   1. Motion - [Privacy/LetAppsAccessMotion](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessmotion). Specifies whether Windows apps can access motion data. **Set to 2 (two)**
+   1. Tasks - [Privacy/LetAppsAccessTasks](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesstasks). Turn off the ability to choose which apps have access to tasks. **Set to 2 (two)**
+   1. App Diagnostics - [Privacy/LetAppsGetDiagnosticInfo](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsgetdiagnosticinfo). Force allow, force deny or give user control of apps that can get diagnostic information about other running apps. **Set to 2 (two)** 
+1. **Software Protection Platform** - [Licensing/DisallowKMSClientOnlineAVSValidation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-licensing#licensing-disallowkmsclientonlineavsvalidation). Opt out of sending KMS client activation data to Microsoft automatically. **Set to 1 (one)**
+1. **Storage Health** - [Storage/AllowDiskHealthModelUpdates](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-storage#storage-allowdiskhealthmodelupdates). Allows disk health model updates. **Set to 0 (zero)** 
+1. **Sync your settings** - [Experience/AllowSyncMySettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowsyncmysettings). Control whether your settings are synchronized. **Set to 0 (zero)** 
+1. **Teredo** - No MDM needed. Teredo is **Off by default**. Delivery Optimization (DO) can turn on Teredo, but DO itself is turned Off via MDM. 
+1. **Wi-Fi Sense** - No MDM needed. Wi-Fi Sense is no longer available from Windows 10 version 1803 and newer. 
+1. **Windows Defender**
+   1. [Defender/AllowCloudProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-allowcloudprotection). Disconnect from the Microsoft Antimalware Protection Service. **Set to 0 (zero)** 
+   1. [Defender/SubmitSamplesConsent](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-submitsamplesconsent). Stop sending file samples back to Microsoft. **Set to 2 (two)**
+   1. [Defender/EnableSmartScreenInShell](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-smartscreen/windows-defender-smartscreen-available-settings#mdm-settings). Turns off SmartScreen in Windows for app and file execution. **Set to 0 (zero)**
+   1. Windows Defender Smartscreen - [Browser/AllowSmartScreen](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen). Disable Windows Defender Smartscreen. **Set to 0 (zero)**
+   1. Windows Defender Smartscreen EnableAppInstallControl - [SmartScreen/EnableAppInstallControl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-smartscreen#smartscreen-enableappinstallcontrol). Controls whether users are allowed to install apps from places other than the Microsoft Store. **Set to 0 (zero)** 
+   1. Windows Defender Potentially Unwanted Applications(PUA) Protection - [Defender/PUAProtection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-puaprotection). Specifies the level of detection for potentially unwanted applications (PUAs). **Set to 1 (one)**
+   1. [Defender/SignatureUpdateFallbackOrder](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm). Allows you to define the order in which different definition update sources should be contacted. The OMA-URI for this is: **./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFallbackOrder**, Data type: **String**, Value: **FileShares**
+1. **Windows Spotlight** - [Experience/AllowWindowsSpotlight](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowwindowsspotlight). Disable Windows Spotlight. **Set to 0 (zero)**
+1. **Microsoft Store**
+   1. [ApplicationManagement/DisableStoreOriginatedApps](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-disablestoreoriginatedapps). Boolean value that disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded.  **Set to 1 (one)**
+   1. [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate). Specifies whether automatic update of apps from Microsoft Store are allowed. **Set to 0 (zero)**
+1. **Apps for websites** - [ApplicationDefaults/EnableAppUriHandlers](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationdefaults#applicationdefaults-enableappurihandlers). This policy setting determines whether Windows supports web-to-app linking with app URI handlers. **Set to 0 (zero)** 
+1. **Windows Update Delivery Optimization** - The following Delivery Optimization MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
+   1. [DeliveryOptimization/DODownloadMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodownloadmode). Let’s you choose where Delivery Optimization gets or sends updates and apps. **Set to 100 (one hundred)**
+1. **Windows Update**
+   1. [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate). Control automatic updates. **Set to 5 (five)**
+   1. Windows Update Allow Update Service - [Update/AllowUpdateService](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowupdateservice). Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. **Set to 0 (zero)**
+   1. Windows Update Service URL - [Update/UpdateServiceUrl](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-updateserviceurl). Allows the device to check for updates from a WSUS server instead of Microsoft Update. **Set to String** with the Value: 
+      1. **\\$CmdID$\\\chr\text/plain\\ \./Vendor/MSFT/Policy/Config/Update/UpdateServiceUrl\\http://abcd-srv:8530\\**
+
+###                                    Allowed traffic for Microsoft Intune / MDM configurations
+
+|**Allowed traffic endpoints** | 
+| --- | 
+|activation-v2.sls.microsoft.com/*|
+|cdn.onenote.net|
+|client.wns.windows.com|
+|crl.microsoft.com/pki/crl/*|
+|ctldl.windowsupdate.com|
+|*displaycatalog.mp.microsoft.com|
+|dm3p.wns.windows.com|
+|\*microsoft.com/pkiops/\*|
+|ocsp.digicert.com/*|
+|r.manage.microsoft.com|
+|tile-service.weather.microsoft.com|
+|settings-win.data.microsoft.com|
diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md
index 0cbf266f2a..70e294409e 100644
--- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md
+++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md
@@ -1,22 +1,23 @@
----
-title: Manage connections from Windows operating system components to Microsoft services (Windows 10)
-description: If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider.
+--- 
+title: Manage connections from Windows 10 operating system components to Microsoft services
+description: Learn how to minimize connections from Windows to Microsoft services, and configure particular privacy settings related to these connections.
 ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9
+ms.reviewer: 
 keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
-ms.localizationpriority: medium
+ms.localizationpriority: high
 audience: ITPro
-author: danihalfin
-ms.author: daniha
-manager: dansimp
+author: medgarmedgar
+ms.author: v-medgar
+manager: sanashar
 ms.collection: M365-security-compliance
 ms.topic: article
-ms.date: 06/05/2018
+ms.date: 9/17/2019
 ---
 
-# Manage connections from Windows operating system components to Microsoft services
+# Manage connections from Windows 10 operating system components to Microsoft services
 
 **Applies to** 
 
@@ -24,254 +25,194 @@ ms.date: 06/05/2018
 - Windows Server 2016
 - Windows Server 2019
 
-If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
+This article describes the network connections that Windows 10 components make to Microsoft and the Windows Settings, Group Policies and registry settings available to IT Professionals to help manage the data shared with Microsoft. If you want to minimize connections from Windows to Microsoft services, or configure privacy settings, there are a number of settings for consideration. For example, you can configure diagnostic data to the lowest level for your edition of Windows and evaluate other connections Windows makes to Microsoft services you want to turn off using the instructions in this article.  While it is possible to minimize network connections to Microsoft, there are many reasons why these communications are enabled by default, such as updating malware definitions and maintaining current certificate revocation lists. This data helps us deliver a secure, reliable, and up-to-date experience.
 
-Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro.
-
-If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure diagnostic data at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article.
-
-You can configure diagnostic data at the Security/Basic level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all other connections to Microsoft network endpoints as described in this article to help prevent Windows from sending any data to Microsoft. There are many reasons why these communications are enabled by default, such as updating malware definitions and maintain current certificate revocation lists, which is why we strongly recommend against this. This data helps us deliver a secure, reliable, and more delightful personalized experience.
-
-To help make it easier to deploy settings to restrict connections from Windows 10 to Microsoft, you can apply the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887).
-This baseline was created in the same way as the [Windows security baselines](/windows/device-security/windows-security-baselines) that are often used to efficiently configure Windows to a known secure state.
-Running the Windows Restricted Traffic Limited Functionality Baseline on devices in your organization will allow you to quickly configure all of the settings covered in this document.
-However, some of the settings reduce the functionality and security configuration of your device and are therefore not recommended.
-Make sure you've chosen the right settings configuration for your environment before applying.
-You should not extract this package to the windows\\system32 folder because it will not apply correctly.
+Microsoft provides a [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887) package that will allow your organization to quickly configure the settings covered in this document to restrict connections from Windows 10 to Microsoft. The Windows Restricted Traffic Limited Baseline is based on [Group Policy Administrative Template](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra) functionality and the package you download contains further instructions on how to deploy to devices in your organization. Since some of the settings can reduce the functionality and security configuration of your device, **before deploying Windows Restricted Traffic Limited Functionality Baseline** make sure you **choose the right settings configuration for your environment** and **ensure that Windows and Windows Defender are fully up to date**. Failure to do so may result in errors or unexpected behavior. You should not extract this package to the windows\system32 folder because it will not apply correctly.
 
 >[!IMPORTANT]
-> As part of the [Windows Restricted Traffic Limited Functionality Baseline](https://go.microsoft.com/fwlink/?linkid=828887), MDM functionallity is disabled. If you manage devices through MDM, make sure [cloud notifications are enabled](#bkmk-priv-notifications).
+> - The Allowed Traffic endpoints are listed here: [Allowed Traffic](#bkmk-allowedtraffic)
+>     -   CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) network traffic cannot be disabled and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of these authorities. There are many others such as DigiCert, Thawte, Google, Symantec, and VeriSign.
+> - For security reasons, it is important to take care in deciding which settings to configure as some of them may result in a less secure device. Examples of settings that can lead to a less secure device configuration include: Windows Update, Automatic Root Certificates Update, and Windows Defender. Accordingly, we do not recommend disabling any of these features.
+> - It is recommended that you restart a device after making configuration changes to it. 
+> - The **Get Help** and **Give us Feedback** links no longer work after the Windows Restricted Traffic Limited Functionality Baseline is applied.
 
-Applying the Windows Restricted Traffic Limited Functionality Baseline is the same as applying each setting covered in this article.
-It is recommended that you restart a device after making configuration changes to it.
-Note that **Get Help** and **Give us Feedback** links no longer work after the Windows Restricted Traffic Limited Functionality Baseline is applied.
+To use Microsoft Intune cloud based device management for restricting traffic please refer to the [Manage connections from Windows 10 operating system components to Microsoft services using Microsoft Intune MDM Server](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-mdm)
 
-We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com.
+We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting **telmhelp**@**microsoft.com**.
 
-## What's new in Windows 10, version 1809 Enterprise edition
+## Management options for each setting
 
-Here's a list of changes that were made to this article for Windows 10, version 1809:
-
-- Added a policy to disable Windows Defender SmartScreen
-
-## What's new in Windows 10, version 1803 Enterprise edition
-
-Here's a list of changes that were made to this article for Windows 10, version 1803:
-
-- Added a policy to turn off notifications network usage
-- Added a policy for Microsoft Edge to turn off configuration updates for the Books Library
-- Added a policy for Microsoft Edge to turn off Address Bar drop-down list suggestions
-
-## What's new in Windows 10, version 1709 Enterprise edition
-
-Here's a list of changes that were made to this article for Windows 10, version 1709:
-
-- Added the Phone calls section
-- Added the Storage Health section
-- Added discussion of apps for websites in the Microsoft Store section
-
-## What's new in Windows 10, version 1703 Enterprise edition
-
-Here's a list of changes that were made to this article for Windows 10, version 1703:
-
-- Added an MDM policy for Font streaming
-- Added an MDM policy for Network Connection Status Indicator
-- Added an MDM policy for the Micosoft Account Sign-In Assistant
-- Added instructions for removing the Sticky Notes app
-- Added registry paths for some Group Policies
-- Added the Find My Device section
-- Added the Tasks section
-- Added the App Diagnostics section
-
-- Added the following Group Policies:
-
-  - Prevent managing SmartScreen Filter
-  - Turn off Compatibility View
-  - Turn off Automatic Download and Install of updates
-  - Do not connect to any Windows Update locations
-  - Turn off access to all Windows Update features
-  - Specify Intranet Microsoft update service location
-  - Enable Windows NTP client
-  - Turn off Automatic download of the ActiveX VersionList
-  - Allow Automatic Update of Speech Data
-  - Accounts: Block Microsoft Accounts
-  - Do not use diagnostic data for tailored experiences
-
-## Management options for each setting
-
-The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure diagnostic data at the Security level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all of these connections.
+The following sections list the components that make network connections to Microsoft services by default. You can configure these settings to control the data that is sent to Microsoft. To prevent Windows from sending any data to Microsoft, configure diagnostic data at the Security level, turn off Windows Defender diagnostic data and MSRT reporting, and turn off all of these connections
 
 ### Settings for Windows 10 Enterprise edition
 
 The following table lists management options for each setting, beginning with Windows 10 Enterprise version 1607.
 
->[!NOTE]
->For some settings, MDM policies only partly cover capabilities available through Group Policy. See each setting’s section for more details.
 
-| Setting | UI | Group Policy | MDM policy | Registry | Command line |
-| - | :-: | :-: | :-: | :-: | :-: |
-| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |  |
-| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [9. License Manager](#bkmk-licmgr) | | | | ![Check mark](images/checkmark.png) | |
-| [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [12. Microsoft Account](#bkmk-microsoft-account) | | ![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [13. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |  |
-| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [17. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) |
-| [18. Settings > Privacy](#bkmk-settingssection) | | | | | |
-|     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| ![Check mark](images/checkmark.png) | |
-|     [18.6 Speech, inking, & typing](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | |
-|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [20. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) |  |  | |
-| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
-| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [24. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [24.1 Windows Defender Smartscreen](#bkmk-defender-smartscreen) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [25. Windows Media Player](#bkmk-wmp) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) |
-| [26. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [27. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-|     [27.1 Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) |  | |
-| [28. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [29. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | |
+| Setting | UI | Group Policy | Registry | 
+| - | :-: | :-: | :-: | 
+| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [9. License Manager](#bkmk-licmgr) | | |  ![Check mark](images/checkmark.png) |
+| [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) |
+| [12. Microsoft Account](#bkmk-microsoft-account) | | |  ![Check mark](images/checkmark.png) |
+| [13. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [17. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | 
+| [18. Settings > Privacy](#bkmk-settingssection) | | | | 
+|     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+|     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| 
+|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) | 
+|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) | 
+|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark](images/checkmark.png) | |  ![Check mark](images/checkmark.png) | 
+|     [18.22 Activity History](#bkmk-act-history) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) |
+|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) |
+| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+| [20. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+| [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+| [24. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+| [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [28. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+| [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
 
 
 ### Settings for Windows Server 2016 with Desktop Experience
 
 See the following table for a summary of the management settings for Windows Server 2016 with Desktop Experience.
 
-| Setting | UI | Group Policy | Registry | Command line |
-| - | :-: | :-: | :-: | :-: |
-| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [12. Microsoft Account](#bkmk-microsoft-account) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | |
-| [18. Settings > Privacy](#bkmk-settingssection) | | | | |
-|     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [20. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
-| [24. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [25. Windows Media Player](#bkmk-wmp) | | | | ![Check mark](images/checkmark.png) |
-| [27. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [27.1 Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) |  | |
-| [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
+| Setting | UI | Group Policy | Registry | 
+| - | :-: | :-: | :-: | 
+| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) |
+| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [18. Settings > Privacy](#bkmk-settingssection) | | | |
+| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [24. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
 
 ### Settings for Windows Server 2016 Server Core
 
 See the following table for a summary of the management settings for Windows Server 2016 Server Core.
 
-| Setting | Group Policy | Registry | Command line |
-| - | :-: | :-: | :-: | :-: | :-: |
-| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [6. Font streaming](#font-streaming) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [14. Network Connection Status Indicator](#bkmk-ncsi) | ![Check mark](images/checkmark.png) | | |
-| [19. Software Protection Platform](#bkmk-spp) | ![Check mark](images/checkmark.png) | | |
-| [22. Teredo](#bkmk-teredo) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) |
-| [24. Windows Defender](#bkmk-defender) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [29. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
+| Setting | Group Policy | Registry | 
+| - | :-: | :-: | 
+| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [6. Font streaming](#font-streaming) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [14. Network Connection Status Indicator](#bkmk-ncsi) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [19. Software Protection Platform](#bkmk-spp) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [22. Teredo](#bkmk-teredo) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [24. Windows Defender](#bkmk-defender) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [29. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
 
 ### Settings for Windows Server 2016 Nano Server
 
 See the following table for a summary of the management settings for Windows Server 2016 Nano Server.
 
-| Setting | Registry | Command line |
-| - | :-: | :-: | :-: | :-: | :-: |
-| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | ![Check mark](images/checkmark.png) | |
-| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | |
-| [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) |
-| [29. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | |
+| Setting | Registry |
+| - | :-: |  
+| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | ![Check mark](images/checkmark.png) |
+| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) |
+| [22. Teredo](#bkmk-teredo) | ![Check mark](images/checkmark.png) |
+| [29. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) |
 
 ### Settings for Windows Server 2019
 
 See the following table for a summary of the management settings for Windows Server 2019.
 
-| Setting | UI | Group Policy | MDM policy | Registry | Command line |
-| - | :-: | :-: | :-: | :-: | :-: |
-| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |  |
-| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [12. Microsoft Account](#bkmk-microsoft-account) | | ![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [13. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |  |
-| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [17. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) |
-| [18. Settings > Privacy](#bkmk-settingssection) | | | | | |
-|     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| ![Check mark](images/checkmark.png) | |
-|     [18.6 Speech, inking, & typing](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | |
-|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [20. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) |  |  | |
-| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
-| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-| [24. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-|     [24.1 Windows Defender Smartscreen](#bkmk-defender-smartscreen) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [25. Windows Media Player](#bkmk-wmp) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) |
-| [26. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [27. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | |
-|     [27.1 Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) |  | |
-| [28. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | |
-| [29. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | |
+| Setting | UI | Group Policy | Registry | 
+| - | :-: | :-: | :-: |
+| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) |
+| [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) |
+| [13. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [17. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | |
+| [18. Settings > Privacy](#bkmk-settingssection) | | | |
+|     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+|     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| 
+|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) | 
+|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) | 
+|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark](images/checkmark.png) | |  ![Check mark](images/checkmark.png) | 
+|     [18.22 Activity History](#bkmk-act-history) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) |
+|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) |  ![Check mark](images/checkmark.png) |
+| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+| [20. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)  |
+| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [24. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | 
+| [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) |
+| [28. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
+| [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) |
 
 ## How to configure each setting
 
@@ -284,7 +225,7 @@ For more information, see [Automatic Root Certificates Update Configuration](htt
 Although not recommended, you can turn off Automatic Root Certificates Update, which also prevents updates to the disallowed certificate list and the pin rules list.
 
 > [!CAUTION]
-> By not automatically downloading the root certificates, the device might have not be able to connect to some websites.
+> By not automatically downloading the root certificates the device may not be able to connect to some websites.
 
 For Windows 10, Windows Server 2016 with Desktop Experience, and Windows Server 2016 Server Core:
 
@@ -299,7 +240,7 @@ For Windows 10, Windows Server 2016 with Desktop Experience, and Windows Server
 
   -or-
 
-- Create the registry path **HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot** and then add a REG\_DWORD registry setting, named **DisableRootAutoUpdate**, with a value of 1.
+- Create the registry path **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\AuthRoot** and then add a REG_DWORD registry setting, named **DisableRootAutoUpdate**, with a value of 1.
 
   -and-
 
@@ -311,14 +252,14 @@ For Windows 10, Windows Server 2016 with Desktop Experience, and Windows Server
 
 On Windows Server 2016 Nano Server:
 
-- Create the registry path **HKEY\_LOCAL\_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot** and then add a REG\_DWORD registry setting, named **DisableRootAutoUpdate**, with a value of 1.
+- Create the registry path **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\AuthRoot** and then add a REG_DWORD registry setting, named **DisableRootAutoUpdate**, with a value of 1.
 
 >[!NOTE]
->CRL and OCSP network traffic is currently whitelisted and will still show up in network traces.  CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign.
+>CRL and OCSP network traffic is currently Allowed Traffic and will still show up in network traces.  CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of them, but there are many others, such as DigiCert, Thawte, Google, Symantec, and VeriSign.
 
 ### 2. Cortana and Search
 
-Use either Group Policy or MDM policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730683).
+Use Group Policies to manage settings for Cortana. For more info, see [Cortana, Search, and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730683).
 
 ### 2.1 Cortana and Search Group Policies
 
@@ -326,26 +267,25 @@ Find the Cortana Group Policy objects under **Computer Configuration** > **Ad
 
 | Policy                                               | Description                                                                           |
 |------------------------------------------------------|---------------------------------------------------------------------------------------|
-| Allow Cortana                                        | Choose whether to let Cortana install and run on the device.

                                  Disable this policy to turn off Cortana. |
-| Allow search and Cortana to use location             | Choose whether Cortana and Search can provide location-aware search results.

                                  Disable this policy to block access to location information for Cortana. |
-| Do not allow web search                              | Choose whether to search the web from Windows Desktop Search.

                                  Enable this policy to remove the option to search the Internet from Cortana. |
-| Don't search the web or display web results in Search| Choose whether to search the web from Cortana.

                                  Enable this policy to stop web queries and results from showing in Search. |
-| Set what information is shared in Search             | Control what information is shared with Bing in Search.

                                  If you enable this policy and set it to **Anonymous info**, usage information will be shared but not search history, Microsoft Account information, or specific location. |
+| Allow Cortana                                        | Choose whether to let Cortana install and run on the device.

                                  **Disable** this policy to turn off Cortana. |
+| Allow search and Cortana to use location             | Choose whether Cortana and Search can provide location-aware search results.

                                  **Disable** this policy to block access to location information for Cortana. |
+| Do not allow web search                              | Choose whether to search the web from Windows Desktop Search.

                                  **Enable** this policy to remove the option to search the Internet from Cortana. |
+| Don't search the web or display web results in Search| Choose whether to search the web from Cortana.

                                  **Enable** this policy to stop web queries and results from showing in Search. |
 
 You can also apply the Group Policies using the following registry keys:
 
 | Policy                                               | Registry Path                                                                           |
 |------------------------------------------------------|---------------------------------------------------------------------------------------|
-| Allow Cortana                                        | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                                  REG_DWORD: AllowCortana 
                                  Value: 0|
-| Allow search and Cortana to use location             | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                                  REG_DWORD: AllowSearchToUseLocation 
                                  Value: 0 |
-| Do not allow web search                              | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                                  REG_DWORD: DisableWebSearch 
                                  Value: 1 |
-| Don't search the web or display web results in Search| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                                  REG_DWORD: ConnectedSearchUseWeb 
                                  Value: 0 |
-| Set what information is shared in Search             | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                                  REG_DWORD: ConnectedSearchPrivacy 
                                  Value: 3 |
+| Allow Cortana                                        | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                                  REG_DWORD: AllowCortana 
                                  Value: 0|
+| Allow search and Cortana to use location             | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                                  REG_DWORD: AllowSearchToUseLocation 
                                  Value: 0 |
+| Do not allow web search                              | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                                  REG_DWORD: DisableWebSearch 
                                  Value: 1 |
+| Don't search the web or display web results in Search| HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search
                                  REG_DWORD: ConnectedSearchUseWeb 
                                  Value: 0 |
+
 
 >[!IMPORTANT]
->These steps are not required for devices running Windows 10, version 1607 or Windows Server 2016.
+> Using the Group Policy editor these steps are required for all supported versions of Windows 10, however they are not required for devices running Windows 10, version 1607 or Windows Server 2016.
 
-1.  Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Firewall with Advanced Security** > **Windows Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**.
+1.  Expand **Computer Configuration** > **Windows Settings** > **Security Settings** > **Windows Defender Firewall with Advanced Security** > **Windows Defender Firewall with Advanced Security - <LDAP name>**, and then click **Outbound Rules**.
 
 2.  Right-click **Outbound Rules**, and then click **New Rule**. The **New Outbound Rule Wizard** starts.
 
@@ -363,23 +303,18 @@ You can also apply the Group Policies using the following registry keys:
 
 9.  Configure the **Protocols and Ports** page with the following info, and then click **OK**.
 
-  - For **Protocol type**, choose **TCP**.
+    - For **Protocol type**, choose **TCP**.
 
-  - For **Local port**, choose **All Ports**.
+    - For **Local port**, choose **All Ports**.
 
-  - For **Remote port**, choose **All ports**.
+    - For **Remote port**, choose **All ports**.
 
+-or-
+
+-  Create a new REG_SZ registry setting named **{0DE40C8E-C126-4A27-9371-A27DAB1039F7}** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsFirewall\\FirewallRules** and set it to a value of **v2.25|Action=Block|Active=TRUE|Dir=Out|Protocol=6|App=%windir%\\SystemApps\\Microsoft.Windows.Cortana_cw5n1h2txyewy\\searchUI.exe|Name=Block outbound Cortana|**
 
 If your organization tests network traffic, do not use a network proxy as Windows Firewall does not block proxy traffic. Instead, use a network traffic analyzer. Based on your needs, there are many network traffic analyzers available at no cost.
 
-### 2.2 Cortana and Search MDM policies
-
-For Windows 10 only, the following Cortana MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
-
-| Policy                                               | Description                                                                                         |
-|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
-| Experience/AllowCortana                              | Choose whether to let Cortana install and run on the device.                                        |
-| Search/AllowSearchToUseLocation                      | Choose whether Cortana and Search can provide location-aware search results. 
                                   Default: Allowed|
 
 ### 3. Date & Time
 
@@ -389,45 +324,41 @@ You can prevent Windows from setting the time automatically.
 
   -or-
 
-- Create a REG\_SZ registry setting in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters\\Type** with a value of **NoSync**.
+- Create a REG_SZ registry setting in **HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\W32Time\\Parameters\\Type** with a value of **NoSync**.
 
 After that, configure the following:
 
-- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Enable Windows NTP Server** > **Windows Time Service** > **Configure Windows NTP Client**
+- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Windows Time Service** > **Time Providers** > **Enable Windows NTP Client**
 
-    > [!NOTE]
-    > This is only available on Windows 10, version 1703 and later. If you're using Windows 10, version 1607, the Group Policy setting is **Computer Configuration** > **Administrative Templates** > **System** > **Windows Time Service** > **Time Providers** > **Enable Windows NTP Client**
+  -or-
 
-  -or -
-
--  Create a new REG\_DWORD registry setting named **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient** and set it to 0 (zero).
+-  Create a new REG_DWORD registry setting named **Enabled** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\W32time\\TimeProviders\\NtpClient** and set it to **0 (zero)**.
 
 
 ### 4. Device metadata retrieval
 
 To prevent Windows from retrieving device metadata from the Internet:
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**.
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**.
 
   -or -
 
-- Create a new REG\_DWORD registry setting named **PreventDeviceMetadataFromNetwork** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata** and set it to 1 (one).
+- Create a new REG_DWORD registry setting named **PreventDeviceMetadataFromNetwork** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata** and set it to 1 (one).
 
-  -or -
-
-- Apply the DeviceInstallation/PreventDeviceMetadataFromNetwork MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventdevicemetadatafromnetwork).
 
 ### 5. Find My Device
 
 To turn off Find My Device:
 
-- Turn off the feature in the UI
+- Turn **Off** the feature in the UI by going to **Settings -> Update & Security -> Find My Device**, click the Change button, and set the value to **Off**
 
   -or-
 
-- Disable the Group Policy: **Computer Configuration** > **Administrative Template** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**
+- **Disable** the Group Policy: **Computer Configuration** > **Administrative Template** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**
 
-You can also create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FindMyDevice\\AllowFindMyDevice** to 0 (zero).
+  -or-
+
+- You can also create a new REG_DWORD registry setting **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FindMyDevice\\AllowFindMyDevice** to **0 (zero)**.
 
 ### 6. Font streaming
 
@@ -435,15 +366,12 @@ Fonts that are included in Windows but that are not stored on the local device c
 
 If you're running Windows 10, version 1607, Windows Server 2016, or later:
 
-- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **Fonts** > **Enable Font Providers**.
+- **Disable** the Group Policy: **Computer Configuration** >   **Administrative Templates** > **Network** > **Fonts** > **Enable Font Providers**.
 
-- Create a new REG\_DWORD registry setting **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\System\\EnableFontProviders** to 0 (zero).
+  -or-
 
-- In Windows 10, version 1703, you can apply the System/AllowFontProviders MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where:
+- Create a new REG_DWORD registry setting **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\EnableFontProviders** to **0 (zero)**.
 
-  - **false**. Font streaming is disabled.
-
-  - **true**. Font streaming is enabled.
 
 > [!NOTE]
 > After you apply this policy, you must restart the device for it to take effect.
@@ -451,17 +379,16 @@ If you're running Windows 10, version 1607, Windows Server 2016, or later:
 
 ### 7. Insider Preview builds
 
-The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10.
-This setting stops communication with the Windows Insider Preview service that checks for new builds.
+The Windows Insider Preview program lets you help shape the future of Windows, be part of the community, and get early access to releases of Windows 10. This setting stops communication with the Windows Insider Preview service that checks for new builds.
 Windows Insider Preview builds only apply to Windows 10 and are not available for Windows Server 2016.
 
 
 > [!NOTE]
-> If you upgrade a device that is configured to minimize connections from Windows to Microsoft services (that is, a device configured for zero exhaust) to a Windows Insider Preview build, the Feedback & Diagnostic setting will automatically be set to **Full**. Although the diagnostic data level may initially appear as **Basic**, a few hours after the UI is refreshed or the machine is rebooted, the setting will become **Full**.
+> If you upgrade a device that is configured to minimize connections from Windows to Microsoft services (that is, a device configured for Restricted Traffic) to a Windows Insider Preview build, the Feedback & Diagnostic setting will automatically be set to **Full**. Although the diagnostic data level may initially appear as **Basic**, a few hours after the UI is refreshed or the machine is rebooted, the setting will become **Full**.
 
 To turn off Insider Preview builds for a released version of Windows 10:
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**.
+- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**.
 
 To turn off Insider Preview builds for Windows 10:
 
@@ -472,79 +399,83 @@ To turn off Insider Preview builds for Windows 10:
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Toggle user control over Insider builds**.
-
-  -or -
-
--  Create a new REG\_DWORD registry setting named **AllowBuildPreview** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\PreviewBuilds** with a vlue of 0 (zero)
+- **Enable** the Group Policy **Toggle user control over Insider builds** under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**
 
   -or-
 
-- Apply the System/AllowBuildPreview MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where:
+- Create a new REG_DWORD registry setting named **AllowBuildPreview** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\PreviewBuilds** with a **value of 0 (zero)**
 
-  - **0**. Users cannot make their devices available for downloading and installing preview software.
 
-  - **1**. Users can make their devices available for downloading and installing preview software.
-
-  - **2**. (default) Not configured. Users can make their devices available for download and installing preview software.
-
-  -or-
-
-- Create a provisioning package: **Runtime settings** > **Policies** > **System** > **AllowBuildPreview**, where:
-
-  - **0**. Users cannot make their devices available for downloading and installing preview software.
-
-  - **1**. Users can make their devices available for downloading and installing preview software.
-
-  - **2**. (default) Not configured. Users can make their devices available for download and installing preview software.
 
 ### 8. Internet Explorer
-
-Use Group Policy to manage settings for Internet Explorer.  You can find the Internet Explorer Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer**.
+> [!NOTE]
+>When attempting to use Internet Explorer on any edition of Windows Server be aware there are restrictions enforced by [Enhanced Security Configuration (ESC)](https://support.microsoft.com/en-us/help/815141/ie-enhanced-security-configuration-changes-browsing-experience). The following Group Policies and Registry Keys are for user interactive scenarios rather than the typical idle traffic scenario. Find the Internet Explorer Group Policy objects under **Computer Configuration > Administrative Templates > Windows Components > Internet Explorer** and make these settings:  
 
 | Policy                                               | Description                                                                                         |
 |------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
-| Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites. 
                                   Default: Enabled 
                                   You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.|
-| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the Address Bar. 
                                   Default: Enabled|
-| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the Address Bar. 
                                   Default: Disabled 
                                   You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.|
-| Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer. 
                                   Default: Disabled|
-| Prevent managing SmartScreen filter | Choose whether employees can manage the SmartScreen Filter in Internet Explorer. 
                                   Default: Disabled |
+| Turn on Suggested Sites| Choose whether an employee can configure Suggested Sites. 
                                   **Set Value to: Disabled** 
                                   You can also turn this off in the UI by clearing the **Internet Options** > **Advanced** > **Enable Suggested Sites** check box.|
+| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | Choose whether an employee can configure enhanced suggestions, which are presented to the employee as they type in the Address Bar. 
                                   **Set Value to: Disabled**|
+| Turn off the auto-complete feature for web addresses | Choose whether auto-complete suggests possible matches when employees are typing web address in the Address Bar. 
                                   **Set Value to: Enabled** 
                                   You can also turn this off in the UI by clearing the Internet Options > **Advanced** > **Use inline AutoComplete in the Internet Explorer Address Bar and Open Dialog** check box.|
+| Turn off browser geolocation | Choose whether websites can request location data from Internet Explorer. 
                                   **Set Value to: Enabled**|
+| Prevent managing Windows Defender SmartScreen | Choose whether employees can manage the Windows Defender SmartScreen in Internet Explorer. 
                                   **Set Value to: Enabled** and then set **Select Windows Defender SmartScreen mode** to **Off**.|
 
-Alternatively, you could use the registry to set the Group Policies.
 
-| Policy                                               | Registry path                                                                                         |
+| Registry Key                                         | Registry path                                                                                       |
 |------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
-| Turn on Suggested Sites| HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Suggested Sites
                                  REG_DWORD: Enabled 
                                  Value: 0|
-| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer
                                  REG_DWORD: AllowServicePoweredQSA 
                                  Value: 0|
-| Turn off the auto-complete feature for web addresses | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\AutoComplete
                                  REG_SZ: AutoSuggest
                                  Value: **No** |
-| Turn off browser geolocation | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation
                                  REG_DWORD: PolicyDisableGeolocation 
                                  Value: 1 |
-| Prevent managing SmartScreen filter | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter
                                  REG_DWORD: EnabledV9 
                                  Value: 0 |
+| Turn on Suggested Sites| HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Suggested Sites
                                  REG_DWORD: Enabled 
                                  **Set Value to: 0**|
+| Allow Microsoft services to provide enhanced suggestions as the user types in the Address Bar | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer
                                  REG_DWORD: AllowServicePoweredQSA 
                                  **Set Value to: 0**|
+| Turn off the auto-complete feature for web addresses |HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\CurrentVersion\\Explorer\\AutoComplete
                                  REG_SZ: AutoSuggest 
                                  Set Value to: **no** |
+| Turn off browser geolocation | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Geolocation
                                  REG_DWORD: PolicyDisableGeolocation 
                                  **Set Value to: 1** |
+| Prevent managing Windows Defender SmartScreen | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\PhishingFilter
                                  REG_DWORD: EnabledV9 
                                  **Set Value to: 0** |
 
 There are more Group Policy objects that are used by Internet Explorer:
 
 | Path | Policy | Description |
 | - | - | - |
-| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Compatibility View** > **Turn off Compatibility View** | Choose whether employees can configure Compatibility View. | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website. 
                                   Default: Disabled |
-| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page**  | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website. 
                                   Default: Enabled |
-| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices. 
                                   Default: Enabled |
-| **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Allow Online Tips** | Allow Online Tips | Enables or disables the retrieval of online tips and help for the Settings app. 
                                   Set to : Disabled |
+| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Compatibility View** > **Turn off Compatibility View** | Choose whether employees can configure Compatibility View. | Choose whether an employee can fix website display problems that he or she may encounter while browsing. 
                                   **Set to: Enabled** |
+| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Internet Control Panel** > **Advanced Page**  | Turn off the flip ahead with page prediction feature | Choose whether an employee can swipe across a screen or click forward to go to the next pre-loaded page of a website. 
                                   **Set to: Enabled** |
+| **Computer Configuration** > **Administrative Templates** > **Windows Components** > **RSS Feeds** | Turn off background synchronization for feeds and Web Slices | Choose whether to have background synchronization for feeds and Web Slices. 
                                   **Set to: Enabled** |
+| **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Allow Online Tips** | Allow Online Tips | Enables or disables the retrieval of online tips and help for the Settings app. 
                                   **Set to: Disabled** |
 
-You can also use registry entries to set these Group Policies.
+You can also use Registry keys to set these policies.
 
-| Policy                                               | Registry path                                                                                         |
+| Registry Key                                         | Registry path                                                                                       |
 |------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
-| Choose whether employees can configure Compatibility View. | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BrowserEmulation
                                  REG_DWORD: MSCompatibilityMode 
                                  Value: 0|
-| Turn off the flip ahead with page prediction feature | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\FlipAhead
                                  REG_DWORD: Enabled 
                                  Value: 0|
-| Turn off background synchronization for feeds and Web Slices | HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds
                                  REG_DWORD: BackgroundSyncStatus 
                                  Value: 0|
-| Turn off Online Tips | HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer
                                  REG_DWORD: AllowOnlineTips 
                                  Value: 0|
+| Choose whether employees can configure Compatibility View. | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\BrowserEmulation
                                  REG_DWORD: DisableSiteListEditing 
                                   **Set Value to 1**|
+| Turn off the flip ahead with page prediction feature | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\FlipAhead
                                  REG_DWORD: Enabled 
                                   **Set Value to 0**|
+| Turn off background synchronization for feeds and Web Slices | HKLM\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Feeds
                                  REG_DWORD: BackgroundSyncStatus 
                                   **Set Value to 0**|
+| Allow Online Tips | HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer
                                  REG_DWORD: AllowOnlineTips 
                                   **Set Value to 0**|
+
+To turn off the home page:
+
+- **Enable** the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Disable changing home page settings**, and set it to **about:blank**
+
+  -or-
+
+- Create a new REG_SZ registry setting named **Start Page** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main** with a **about:blank**
+
+  -and -
+
+- Create a new REG_DWORD registry setting named **HomePage** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Control Panel** with a **1 (one)**
 
 
+To configure the First Run Wizard:
 
-To turn off the home page, enable the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Disable changing home page settings**, and set it to **about:blank**.
+- **Enable** the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Prevent running First Run wizard**, and set it to **Go directly to home page**
 
-To configure the First Run Wizard, enable the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Prevent running First Run wizard**, and set it to **Go directly to home page**.
+  -or-
+
+- Create a new REG_DWORD registry setting named **DisableFirstRunCustomize** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main** with a **1 (one)**
+
+
+To configure the behavior for a new tab:
+
+- **Enable** the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Specify default behavior for a new tab**, and set it to **about:blank**
+
+  -or-
+
+- Create a new REG_DWORD registry setting named **NewTabPageShow** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\TabbedBrowsing** with a **0 (zero)**
 
-To configure the behavior for a new tab, enable the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Specify default behavior for a new tab**, and set it to **about:blank**.
 
 ### 8.1 ActiveX control blocking
 
@@ -552,11 +483,11 @@ ActiveX control blocking periodically downloads a new list of out-of-date Active
 
 You can turn this off by:
 
--  Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Features** > **Add-on Management** > **Turn off Automatic download of the ActiveX VersionList**
+-  **Enable** the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Internet Explorer** > **Security Features** > **Add-on Management** > **Turn off Automatic download of the ActiveX VersionList**
 
-  -or -
+  -or-
 
--  Changing the REG\_DWORD registry setting **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to 0 (zero).
+-  Changing the REG_DWORD registry setting **HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\VersionManager\\DownloadVersionList** to **0 (zero)**.
 
 For more info, see [Out-of-date ActiveX control blocking](https://technet.microsoft.com/library/dn761713.aspx).
 
@@ -564,7 +495,7 @@ For more info, see [Out-of-date ActiveX control blocking](https://technet.micros
 
 You can turn off License Manager related traffic by setting the following registry entry:
 
--   Add a REG\_DWORD value named **Start** to **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\LicenseManager** and set the value to 4
+-   Add a REG_DWORD value named **Start** to **HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LicenseManager** and set the **value to 4**
 
 -   The value 4 is to disable the service. Here are the available options to set the registry:
 
@@ -582,11 +513,11 @@ You can turn off License Manager related traffic by setting the following regist
 
 To turn off Live Tiles:
 
-- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage**
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn Off notifications network usage**
 
   -or-
 
-- Create a REG\_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a value of 1 (one).
+- Create a REG_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a **value of 1 (one)** 
 
 In Windows 10 Mobile, you must also unpin all tiles that are pinned to Start.
 
@@ -600,39 +531,23 @@ To turn off mail synchronization for Microsoft Accounts that are configured on a
 
 - Remove any Microsoft Accounts from the Mail app.
 
-  -or-
-
-- Apply the Accounts/AllowMicrosoftAccountConnection MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed. This does not apply to Microsoft Accounts that have already been configured on the device.
 
 To turn off the Windows Mail app:
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Mail** > **Turn off Windows Mail application**
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **ManualLaunchAllowed** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Mail** with a value of 0 (zero).
+- Create a REG_DWORD registry setting named **ManualLaunchAllowed** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Mail** with a **value of 0 (zero)**.
 
 ### 12. Microsoft Account
 
-To prevent communication to the Microsoft Account cloud authentication service. Many apps and system components that depend on Microsoft Account authentication may lose functionality. Some of them could be in unexpected ways. For example, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
-
-- Apply the Group Policy: **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options** > **Accounts: Block Microsoft Accounts** and set it to **Users can't add Microsoft accounts**.
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **NoConnectedUser** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System** with a value of 3.
-
+Use the below setting to prevent communication to the Microsoft Account cloud authentication service. Many apps and system components that depend on Microsoft Account authentication may lose functionality. Some of them could be in unexpected ways. For example, Windows Update will no longer offer feature updates to devices running Windows 10 1709 or higher. See [Feature updates are not being offered while other updates are](https://docs.microsoft.com/windows/deployment/update/windows-update-troubleshooting#feature-updates-are-not-being-offered-while-other-updates-are).
 
 To disable the Microsoft Account Sign-In Assistant:
 
-- Apply the Accounts/AllowMicrosoftAccountSignInAssistant MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on.
-
-- Change the Start REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\wlidsvc** to a value of **4**.
+- Change the **Start** REG_DWORD registry setting in **HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\wlidsvc** to a value of **4**.
 
 
 ### 13. Microsoft Edge
 
-Use either Group Policy or MDM policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730682).
+Use Group Policies to manage settings for Microsoft Edge. For more info, see [Microsoft Edge and privacy: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730682).
 
 ### 13.1 Microsoft Edge Group Policies
 
@@ -640,111 +555,90 @@ Find the Microsoft Edge Group Policy objects under **Computer Configuration** &g
 
 | Policy                                               | Description                                                                                         |
 |------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
-| Allow configuration updates for the Books Library            | Choose whether configuration updates are done for the Books Library. 
                                   Default: Enabled       |
-| Configure Autofill                                    | Choose whether employees can use autofill on websites. 
                                   Default: Enabled                      |
-| Configure Do Not Track         | Choose whether employees can send Do Not Track headers.
                                   Default: Disabled                     |
-| Configure Password Manager                            | Choose whether employees can save passwords locally on their devices. 
                                   Default: Enabled       |
-| Configure search suggestions in Address Bar              | Choose whether the Address Bar shows search suggestions. 
                                   Default: Enabled                    |
-| Configure Windows Defender SmartScreen (Windows 10, version 1703)               | Choose whether Windows Defender SmartScreen is turned on or off.  
                                   Default: Enabled                            |
-| Allow web content on New Tab page                     | Choose whether a new tab page appears.  
                                   Default: Enabled                                     |
-| Configure Start pages                       | Choose the Start page for domain-joined devices. 
                                   Set this to **\**        |
-| Prevent the First Run webpage from opening on Microsoft Edge                       | Choose whether employees see the First Run webpage. 
                                   Set to: Enable        |
+| Allow Address bar drop-down list suggestions            |  Choose whether to show the address bar drop-down list 
                                   **Set to Disabled**       |
+| Allow configuration updates for the Books Library            | Choose whether configuration updates are done for the Books Library. 
                                   **Set to Disabled**       |
+| Configure Autofill                                    | Choose whether employees can use autofill on websites. 
                                   **Set to Disabled**                      |
+| Configure Do Not Track         | Choose whether employees can send Do Not Track headers.
                                   **Set to Enabled**                     |
+| Configure Password Manager                            | Choose whether employees can save passwords locally on their devices. 
                                   **Set to Disabled**       |
+| Configure search suggestions in Address Bar              | Choose whether the Address Bar shows search suggestions. 
                                   **Set to Disabled**                    |
+| Configure Windows Defender SmartScreen (Windows 10, version 1703)               | Choose whether Windows Defender SmartScreen is turned on or off.  
                                   **Set to Disabled**                            |
+| Allow web content on New Tab page                     | Choose whether a new tab page appears.  
                                   **Set to Disabled**                                     |
+| Configure Start pages                       | Choose the Start page for domain-joined devices. 
                                   **Enabled** and **Set this to <>**         |
+| Prevent the First Run webpage from opening on Microsoft Edge                       | Choose whether employees see the First Run webpage. 
                                   **Set to: Enable**        |
+| Allow Microsoft Compatibility List                       | Choose whether to use the Microsoft Compatibility List in Microsoft Edge. 
                                   **Set to: Disabled**        |
 
-Alternatively, you can configure the Microsoft Group Policies using the following registry entries:
+Alternatively, you can configure the following Registry keys as described:
 
-| Policy | Registry path |
+| Registry Key | Registry path |
 | - | - |
-| Allow Address Bar drop-down list suggestions  | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
                                  REG_DWORD name: ShowOneBox
                                  Value: 0|
-| Allow configuration updates for the Books Library  | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary
                                  REG_DWORD name: AllowConfigurationUpdateForBooksLibrary
                                  Value: 1|
-| Configure Autofill  | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
                                  REG_SZ name: Use FormSuggest
                                  Value : **no** |
-| Configure Do Not Track   | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
                                  REG_DWORD name: DoNotTrack
                                   REG_DWORD: 1 |
-| Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
                                  REG_SZ name: FormSuggest Passwords
                                   REG_SZ: **no** |
-| Configure search suggestions in Address Bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes
                                  REG_DWORD name: ShowSearchSuggestionsGlobal 
                                  Value: 0|
-| Configure Windows Defender SmartScreen Filter (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
                                  REG_DWORD name: EnabledV9 
                                  Value: 0 |
-| Allow web content on New Tab page  | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes
                                  REG_DWORD name: AllowWebContentOnNewTabPage 
                                  Value: 0 |
-| Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
                                  REG_DWORD name: ProvisionedHomePages 
                                  Value: 0|
-| Prevent the First Run webpage from opening on Microsoft Edge | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main 
                                  REG_DWORD name: PreventFirstRunPage 
                                  Value: 1|
-
-
-### 13.2 Microsoft Edge MDM policies
-
-The following Microsoft Edge MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
-
-| Policy                                               | Description                                                                                         |
-|------------------------------------------------------|-----------------------------------------------------------------------------------------------------|
-| Browser/AllowAutoFill                                | Choose whether employees can use autofill on websites. 
                                   Default: Allowed                      |
-| Browser/AllowDoNotTrack                              | Choose whether employees can send Do Not Track headers.
                                   Default: Not allowed                  |
-| Browser/AllowMicrosoftCompatbilityList               | Specify the Microsoft compatibility list in Microsoft Edge. 
                                   Default: Enabled                 |
-| Browser/AllowPasswordManager                         | Choose whether employees can save passwords locally on their devices. 
                                   Default: Allowed       |
-| Browser/AllowSearchSuggestionsinAddressBar           | Choose whether the Address Bar shows search suggestions.. 
                                   Default: Allowed                   |
-| Browser/AllowSmartScreen                             | Choose whether SmartScreen is turned on or off.  
                                   Default: Allowed                            |
-| Browser/FirstRunURL                                  | Choose the home page for Microsoft Edge on Windows Mobile 10. 
                                   Default: blank                 |
+| Allow Address Bar drop-down list suggestions  | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
                                  REG_DWORD name: ShowOneBox
                                   Set to **0**|
+| Allow configuration updates for the Books Library  | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary
                                  REG_DWORD name: AllowConfigurationUpdateForBooksLibrary
                                   Set to **0**|
+| Configure Autofill  | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
                                  REG_SZ name: Use FormSuggest
                                  Value : **No** |
+| Configure Do Not Track   | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
                                  REG_DWORD name: DoNotTrack
                                   REG_DWORD: **1** |
+| Configure Password Manager | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main
                                  REG_SZ name: FormSuggest Passwords
                                   REG_SZ: **No** |
+| Configure search suggestions in Address Bar | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes
                                  REG_DWORD name: ShowSearchSuggestionsGlobal 
                                  Value: **0**|
+| Configure Windows Defender SmartScreen (Windows 10, version 1703) | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\PhishingFilter
                                  REG_DWORD name: EnabledV9 
                                  Value: **0** |
+| Allow web content on New Tab page  | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI
                                  REG_DWORD name: AllowWebContentOnNewTabPage 
                                  Value: **0** |
+| Configure corporate Home pages | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Internet Settings
                                  REG_SZ name: ProvisionedHomePages 
                                  Value: **<>**|
+| Prevent the First Run webpage from opening on Microsoft Edge | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\Main 
                                  REG_DWORD name: PreventFirstRunPage 
                                  Value: **1**|
+| Choose whether employees can configure Compatibility View. | HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\MicrosoftEdge\\BrowserEmulation
                                  REG_DWORD: MSCompatibilityMode 
                                  Value: **0**|
 
 
 For a complete list of the Microsoft Edge policies, see [Available policies for Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/available-policies).
 
 ### 14. Network Connection Status Indicator
 
-Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. For more info about NCSI, see [The Network Connection Status Icon](http://blogs.technet.com/b/networking/archive/2012/12/20/the-network-connection-status-icon.aspx).
+Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet. See the [Microsoft Networking Blog](https://techcommunity.microsoft.com/t5/Networking-Blog/bg-p/NetworkingBlog) to learn more.
 
-In versions of Windows 10 prior to Windows 10, version 1607 and Windows Server 2016, the URL was [http://www.msftncsi.com]().
+In versions of Windows 10 prior to version 1607 and Windows Server 2016, the URL was `http://www.msftncsi.com/ncsi.txt`.
 
 You can turn off NCSI by doing one of the following:
 
-- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests**
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests**
 
-- In Windows 10, version 1703 and later, apply the Connectivity/DisallowNetworkConnectivityActiveTests MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-connectivity#connectivity-disallownetworkconnectivityactivetests) with a value of 1.
 
 > [!NOTE]
 > After you apply this policy, you must restart the device for the policy setting to take effect.
 
 -or-
 
-- Create a REG\_DWORD registry setting named **NoActiveProbe** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkConnectivityStatusIndicator** with a value of 1 (one).
+- Create a REG_DWORD registry setting named **NoActiveProbe** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\NetworkConnectivityStatusIndicator** with a value of 1 (one).
 
 ### 15. Offline maps
 
 You can turn off the ability to download and update offline maps.
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data**
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data**
 
   -or-
 
-- Create a REG\_DWORD registry setting named **AutoDownloadAndUpdateMapData** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps** with a value of 0 (zero).
-
-  -or-
-
-- In Windows 10, version 1607 and later, apply the Maps/EnableOfflineMapsAutoUpdate MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-maps#maps-enableofflinemapsautoupdate) with a value of 0.
+- Create a REG_DWORD registry setting named **AutoDownloadAndUpdateMapData** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps** with a **value of 0 (zero)**.
 
   -and-
 
-- In Windows 10, version 1607 and later, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off unsolicited network traffic on the Offline Maps settings page**
+- In Windows 10, version 1607 and later, **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off unsolicited network traffic on the Offline Maps settings page**
 
   -or-
 
-- Create a REG\_DWORD registry setting named **AllowUntriggeredNetworkTrafficOnSettingsPage** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps** with a value of 0 (zero).
+- Create a REG_DWORD registry setting named **AllowUntriggeredNetworkTrafficOnSettingsPage** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Maps** with a value of 0 (zero).
 
 ### 16. OneDrive
 
 To turn off OneDrive in your organization:
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent the usage of OneDrive for file storage**
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent the usage of OneDrive for file storage**
 
   -or-
 
-- Create a REG\_DWORD registry setting named **DisableFileSyncNGSC** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\OneDrive** with a value of 1 (one).
+- Create a REG_DWORD registry setting named **DisableFileSyncNGSC** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\OneDrive** with a value of 1 (one).
 
   -and-
 
--   Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent OneDrive from generating network traffic until the user signs in to OneDrive (Enable)**
+-   **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **OneDrive** > **Prevent OneDrive from generating network traffic until the user signs in to OneDrive (Enable)**
 
     -or-
 
-- Create a REG\_DWORD registry setting named **PreventNetworkTrafficPreUserSignIn** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\OneDrive** with a value of 1 (one).
-
- -or-
-
--   Set the System/DisableOneDriveFileSync MDM policy from the [Policy CSP](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#system-disableonedrivefilesync) to True (value 1) to disable OneDrive File Sync. 
+- Create a REG_DWORD registry setting named **PreventNetworkTrafficPreUserSignIn** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OneDrive** with a **value of 1 (one)** 
 
 
 ### 17. Preinstalled apps
@@ -756,12 +650,14 @@ To remove the News app:
 - Right-click the app in Start, and then click **Uninstall**.
 
   -or-
-
+>[!IMPORTANT]
+> If you have any issues with these commands, restart the system and try the scripts again.
+>
 - Remove the app for new user accounts. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxProvisionedPackage -Online | Where-Object {$\_.PackageName -Like "Microsoft.BingNews"} | ForEach-Object { Remove-AppxProvisionedPackage -Online -PackageName $\_.PackageName}**
 
   -and-
 
-    Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingNews | Remove-AppxPackage**
+- Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingNews | Remove-AppxPackage**
 
 To remove the Weather app:
 
@@ -769,7 +665,7 @@ To remove the Weather app:
 
   -and-
 
-    Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingWeather | Remove-AppxPackage**
+- Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingWeather | Remove-AppxPackage**
 
 To remove the Money app:
 
@@ -781,7 +677,7 @@ To remove the Money app:
 
   -and-
 
-    Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingFinance | Remove-AppxPackage**
+- Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingFinance | Remove-AppxPackage**
 
 To remove the Sports app:
 
@@ -793,7 +689,7 @@ To remove the Sports app:
 
   -and-
 
-    Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingSports | Remove-AppxPackage**
+- Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.BingSports | Remove-AppxPackage**
 
 To remove the Twitter app:
 
@@ -805,7 +701,7 @@ To remove the Twitter app:
 
   -and-
 
-    Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage \*.Twitter | Remove-AppxPackage**
+- Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage \*.Twitter | Remove-AppxPackage**
 
 To remove the XBOX app:
 
@@ -813,7 +709,7 @@ To remove the XBOX app:
 
   -and-
 
-    Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.XboxApp | Remove-AppxPackage**
+- Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.XboxApp | Remove-AppxPackage**
 
 To remove the Sway app:
 
@@ -825,7 +721,7 @@ To remove the Sway app:
 
   -and-
 
-    Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.Sway | Remove-AppxPackage**
+- Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.Sway | Remove-AppxPackage**
 
 To remove the OneNote app:
 
@@ -833,7 +729,7 @@ To remove the OneNote app:
 
   -and-
 
-    Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.OneNote | Remove-AppxPackage**
+- Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.Office.OneNote | Remove-AppxPackage**
 
 To remove the Get Office app:
 
@@ -845,7 +741,7 @@ To remove the Get Office app:
 
   -and-
 
-    Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.MicrosoftOfficeHub | Remove-AppxPackage**
+- Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.MicrosoftOfficeHub | Remove-AppxPackage**
 
 To remove the Get Skype app:
 
@@ -857,7 +753,7 @@ To remove the Get Skype app:
 
   -and-
 
-    Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.SkypeApp | Remove-AppxPackage**
+- Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.SkypeApp | Remove-AppxPackage**
 
 To remove the Sticky notes app:
 
@@ -865,7 +761,7 @@ To remove the Sticky notes app:
 
   -and-
 
-    Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.MicrosoftStickyNotes | Remove-AppxPackage**
+- Remove the app for the current user. From an elevated command prompt, run the following Windows PowerShell command: **Get-AppxPackage Microsoft.MicrosoftStickyNotes | Remove-AppxPackage**
 
 ### 18. Settings > Privacy
 
@@ -881,7 +777,7 @@ Use Settings > Privacy to configure some settings that may be important to yo
 
 - [18.5 Notifications](#bkmk-priv-notifications)
 
-- [18.6 Speech, inking, & typing](#bkmk-priv-speech)
+- [18.6 Speech](#bkmk-priv-speech)
 
 - [18.7 Account info](#bkmk-priv-accounts)
 
@@ -895,19 +791,27 @@ Use Settings > Privacy to configure some settings that may be important to yo
 
 - [18.12 Messaging](#bkmk-priv-messaging)
 
-- [18.13 Radios](#bkmk-priv-radios)
+- [18.13 Phone Calls](#bkmk-priv-phone-calls)
 
-- [18.14 Other devices](#bkmk-priv-other-devices)
+- [18.14 Radios](#bkmk-priv-radios)
 
-- [18.15 Feedback & diagnostics](#bkmk-priv-feedback)
+- [18.15 Other devices](#bkmk-priv-other-devices)
 
-- [18.16 Background apps](#bkmk-priv-background)
+- [18.16 Feedback & diagnostics](#bkmk-priv-feedback)
 
-- [18.17 Motion](#bkmk-priv-motion)
+- [18.17 Background apps](#bkmk-priv-background)
 
-- [18.18 Tasks](#bkmk-priv-tasks)
+- [18.18 Motion](#bkmk-priv-motion)
 
-- [18.19 App Diagnostics](#bkmk-priv-diag)
+- [18.19 Tasks](#bkmk-priv-tasks)
+
+- [18.20 App Diagnostics](#bkmk-priv-diag)
+
+- [18.21 Inking & Typing](#bkmk-priv-ink)
+
+- [18.22 Activity History](#bkmk-act-history)
+
+- [18.23 Voice Activation](#bkmk-voice-act)
 
 ### 18.1 General
 
@@ -924,15 +828,15 @@ To turn off **Let apps use advertising ID to make ads more interesting to you ba
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**.
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**.
 
   -or-
 
-- Create a REG\_DWORD registry setting named **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo** with a value of 0 (zero).
+- Create a REG_DWORD registry setting named **Enabled** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo** with a value of 0 (zero).
 
-  -or-
+  -and-
 
-- Create a REG\_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one).
+- Create a REG_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one).
 
 To turn off **Let websites provide locally relevant content by accessing my language list**:
 
@@ -940,7 +844,7 @@ To turn off **Let websites provide locally relevant content by accessing my lang
 
   -or-
 
-- Create a new REG\_DWORD registry setting named **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile** with a value of 1.
+- Create a new REG_DWORD registry setting named **HttpAcceptLanguageOptOut** in **HKEY_CURRENT_USER\\Control Panel\\International\\User Profile** with a value of 1.
 
 To turn off **Let Windows track app launches to improve Start and search results**:
 
@@ -948,7 +852,7 @@ To turn off **Let Windows track app launches to improve Start and search results
 
   -or-
 
-- Create a REG_DWORD registry setting named **Start_TrackProgs** in **HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced** with value of 0 (zero).
+- Create a REG_DWORD registry setting named **Start_TrackProgs** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced** with value of 0 (zero).
 
 #### Windows Server 2016 and Windows 10, version 1607 and earlier options
 
@@ -961,56 +865,40 @@ To turn off **Let apps use my advertising ID for experiences across apps (turnin
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**.
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **User Profiles** > **Turn off the advertising ID**.
+
+ -or-
+
+- Create a REG_DWORD registry setting named **Enabled** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo** with a value of 0 (zero).
 
   -or-
 
-- Create a REG\_DWORD registry setting named **Enabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo** with a value of 0 (zero).
+- Create a REG_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one).
 
-  -or-
-
-- Create a REG\_DWORD registry setting named **DisabledByGroupPolicy** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo** with a value of 1 (one).
-
-To turn off **Turn on SmartScreen Filter to check web content (URLs) that Microsoft Store apps use**:
+To turn off **Turn on Windows Defender SmartScreen to check web content (URLs) that Microsoft Store apps use**:
 
 - Turn off the feature in the UI.
 
   -or-
 
-- Create a provisioning package, using:
-  - For Internet Explorer: **Runtime settings > Policies > Browser > AllowSmartScreen**
-  - For Microsoft Edge: **Runtime settings > Policies > MicrosoftEdge > AllowSmartScreen**
-
-  -or-
-
-- Create a REG_DWORD registry setting named **EnableWebContentEvaluation** in **HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost** with a value of 0 (zero).
+- Create a REG_DWORD registry setting named **EnableWebContentEvaluation** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost** with a value of 0 (zero).
 
 To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**:
 
 > [!NOTE]
 > If the diagnostic data level is set to either **Basic** or **Security**, this is turned off automatically.
 
-
-
 - Turn off the feature in the UI.
 
-  -or-
-
-- Apply the TextInput/AllowLinguisticDataCollection MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where:
-
-  - **0**. Not allowed
-
-  - **1**. Allowed (default)
-
 To turn off **Let websites provide locally relevant content by accessing my language list**:
 
 - Turn off the feature in the UI.
 
   -or-
 
-- Create a new REG\_DWORD registry setting named **HttpAcceptLanguageOptOut** in **HKEY\_CURRENT\_USER\\Control Panel\\International\\User Profile** with a value of 1.
+- Create a new REG_DWORD registry setting named **HttpAcceptLanguageOptOut** in **HKEY_CURRENT_USER\\Control Panel\\International\\User Profile** with a value of 1.
 
-To turn off **Let apps on my other devices open apps and continue experiences on this devices**:
+To turn off **Let apps on my other devices open apps and continue experiences on this device**:
 
 - Turn off the feature in the UI.
 
@@ -1020,7 +908,7 @@ To turn off **Let apps on my other devices open apps and continue experiences on
 
   -or-
 
-- Create a REG\_DWORD registry setting named **EnableCdp** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a value of 0 (zero).
+- Create a REG_DWORD registry setting named **EnableCdp** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a value of 0 (zero).
 
 To turn off **Let apps on my other devices use Bluetooth to open apps and continue experiences on this device**:
 
@@ -1036,46 +924,25 @@ To turn off **Location for this device**:
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**.
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Location and Sensors** > **Turn off location**.
 
   -or-
 
-- Create a REG\_DWORD registry setting named **LetAppsAccessLocation** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
+- Create a REG_DWORD registry setting named **LetAppsAccessLocation** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**.
 
-  -or-
-
-- Apply the System/AllowLocation MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
-
-  - **0**. Turned off and the employee can't turn it back on.
-
-  - **1**. Turned on, but lets the employee choose whether to use it. (default)
-
-  - **2**. Turned on and the employee can't turn it off.
-
-    > [!NOTE]
-    > You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](https://msdn.microsoft.com/library/dn905224.aspx).
-
-  -or-
-
-- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowLocation**, where
-
-  - **No**. Turns off location service.
-
-  - **Yes**. Turns on location service. (default)
 
 To turn off **Location**:
 
 - Turn off the feature in the UI.
-
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location**
-
-  - Set the **Select a setting** box to **Force Deny**.
+  
+  -or-
+  
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access location** and set the **Select a setting** box to **Force Deny**.
 
   -or-
 
-- Create a REG\_DWORD registry setting named **DisableLocation** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\LocationAndSensors** with a value of 1 (one).
+- Create a REG_DWORD registry setting named **DisableLocation** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\LocationAndSensors** with a value of 1 (one).
 
-  -or-
 
 To turn off **Location history**:
 
@@ -1101,26 +968,8 @@ To turn off **Let apps use my camera**:
 
   -or-
 
-- Create a REG\_DWORD registry setting named **LetAppsAccessCamera** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
+- Create a REG_DWORD registry setting named **LetAppsAccessCamera** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
 
-  -or-
-
-- Apply the Camera/AllowCamera MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
-
-  - **0**. Apps can't use the camera.
-
-  - **1**. Apps can use the camera.
-
-    > [!NOTE]
-    > You can also set this MDM policy in System Center Configuration Manager using the [WMI Bridge Provider](https://msdn.microsoft.com/library/dn905224.aspx).
-
-  -or-
-
-- Create a provisioning package with use Windows ICD, using **Runtime settings** > **Policies** > **Camera** > **AllowCamera**, where:
-
-  - **0**. Apps can't use the camera.
-
-  - **1**. Apps can use the camera.
 
 To turn off **Choose apps that can use your camera**:
 
@@ -1142,15 +991,7 @@ To turn off **Let apps use my microphone**:
 
   -or-
 
--  Apply the Privacy/LetAppsAccessMicrophone MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessmicrophone), where:
-
-  - **0**. User in control
-  - **1**. Force allow
-  - **2**. Force deny
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **LetAppsAccessMicrophone** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two)
+- Create a REG_DWORD registry setting named **LetAppsAccessMicrophone** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two)
 
 To turn off **Choose apps that can use your microphone**:
 
@@ -1158,26 +999,14 @@ To turn off **Choose apps that can use your microphone**:
 
 ### 18.5 Notifications
 
->[!IMPORTANT]
->Disabling notifications will also disable the ability to manage the device through MDM. If you are using an MDM solution, make sure cloud notifications are enabled through one of the options below.
-
 To turn off notifications network usage:
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn off Notifications network usage**
-
-  - Set to **Enabled**.
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Start Menu and Taskbar** > **Notifications** > **Turn off Notifications network usage**
 
   -or-
 
-- Create a REG\_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a value of 1 (one)
+- Create a REG_DWORD registry setting named **NoCloudApplicationNotification** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\PushNotifications** with a value of 1 (one)
 
-  -or-
-
-
-- Apply the Notifications/DisallowCloudNotification MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-notifications#notifications-disallowcloudnotification), where:
-
-  - **0**. WNS notifications allowed
-  - **1**. No WNS notifications allowed
 
 In the **Notifications** area, you can also choose which apps have access to notifications.
 
@@ -1193,57 +1022,34 @@ To turn off **Let apps access my notifications**:
 
   -or-
 
--  Apply the Privacy/LetAppsAccessNotifications MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessnotifications), where:
+- Create a REG_DWORD registry setting named **LetAppsAccessNotifications** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two)
 
-  - **0**. User in control
-  - **1**. Force allow
-  - **2**. Force deny
+### 18.6 Speech
+
+In the **Speech** area, you can configure the functionality as such: 
+
+To turn off dictation of your voice, speaking to Cortana and other apps, and to prevent sending your voice input to Microsoft Speech services:
+
+- Toggle the Settings -> Privacy -> Speech -> **Online speech recognition** switch to **Off** 
 
   -or-
 
-- Create a REG\_DWORD registry setting named **LetAppsAccessNotifications** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two)
-
-### 18.6 Speech, inking, & typing
-
-In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees.
-
-> [!NOTE]
-> For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article.
-
-To turn off the functionality:
-
-- Click the **Stop getting to know me** button, and then click **Turn off**.
+- **Disable** the Group Policy: **Computer Configuration > Administrative Templates > Control Panel > Regional and Language Options > Allow users to enable online speech recognition services** 
 
   -or-
 
-- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Regional and Language Options** > **Handwriting personalization** > **Turn off automatic learning**
+- Create a REG_DWORD registry setting named **HasAccepted** in **HKEY_CURRENT_USER\\Software\\Microsoft\\Speech_OneCore\\Settings\\OnlineSpeechPrivacy** with a **value of 0 (zero)**
+
+
+If you're running at Windows 10, version 1703 up to and including Windows 10, version 1803, you can turn off updates to the speech recognition and speech synthesis models:
+
+- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Speech** > **Allow automatic update of Speech Data** 
 
   -or-
 
-- Create a REG\_DWORD registry setting named **RestrictImplicitInkCollection** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\InputPersonalization** with a value of 1 (one).
+- Create a REG_DWORD registry setting named **AllowSpeechModelUpdate** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Speech** with a **value of 0 (zero)** 
 
-  -or-
 
-- Create a REG\_DWORD registry setting named **AcceptedPrivacyPolicy** in **HKEY\_CURRENT\_USER\\Software\\Microsoft\\Personalization\\Settings** with a value of 0 (zero).
-
-   -and-
-
--  Create a REG\_DWORD registry setting named **HarvestContacts** in **HKEY\_CURRENT\_USER\\Software\\Microsoft\\InputPersonalization\\TrainedDataStore** with a value of 0 (zero).
-
-If you're running at least Windows 10, version 1703, you can turn off updates to the speech recognition and speech synthesis models:
-
-- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Speech** > **Allow automatically update of Speech Data**
-
-If you're running at least Windows 10, version 1607, you can turn off updates to the speech recognition and speech synthesis models:
-
-Apply the Speech/AllowSpeechModelUpdate MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962(v=vs.85).aspx#Speech_AllowSpeechModelUpdate), where:
-
-- **0** (default). Not allowed.
-- **1**. Allowed.
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **ModelDownloadAllowed** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Preferences** with a value of 0 (zero).
 
 ### 18.7 Account info
 
@@ -1261,15 +1067,9 @@ To turn off **Let apps access my name, picture, and other account info**:
 
   -or-
 
--  Apply the Privacy/LetAppsAccessAccountInfo MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessaccountinfo), where:
+- Create a REG_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
 
-  - **0**. User in control
-  - **1**. Force allow
-  - **2**. Force deny
 
-  -or-
-
-- Create a REG\_DWORD registry setting named **LetAppsAccessAccountInfo** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
 
 To turn off **Choose the apps that can access your account info**:
 
@@ -1291,15 +1091,7 @@ To turn off **Choose apps that can access contacts**:
 
   -or-
 
--  Apply the Privacy/LetAppsAccessContacts MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccesscontacts), where:
-
-   - **0**. User in control
-   - **1**. Force allow
-   - **2**. Force deny
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **LetAppsAccessContacts** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
+- Create a REG_DWORD registry setting named **LetAppsAccessContacts** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
 
 ### 18.9 Calendar
 
@@ -1311,21 +1103,11 @@ To turn off **Let apps access my calendar**:
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the calendar**
-
-  - Set the **Select a setting** box to **Force Deny**.
+- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access the calendar**.  Set the **Select a setting** box to **Force Deny**.
 
   -or-
 
--  Apply the Privacy/LetAppsAccessCalendar MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccesscalendar), where:
-
-  - **0**. User in control
-  - **1**. Force allow
-  - **2**. Force deny
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **LetAppsAccessCalendar** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
+- Create a REG_DWORD registry setting named **LetAppsAccessCalendar** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
 
 To turn off **Choose apps that can access calendar**:
 
@@ -1347,19 +1129,11 @@ To turn off **Let apps access my call history**:
 
   -or-
 
-  -  Apply the Privacy/LetAppsAccessCallHistory MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccesscallhistory), where:
-
-  - **0**. User in control
-  - **1**. Force allow
-  - **2**. Force deny
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **LetAppsAccessCallHistory** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
+- Create a REG_DWORD registry setting named **LetAppsAccessCallHistory** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
 
 ### 18.11 Email
 
-In the **Email** area, you can choose which apps have can access and send email.
+In the **Email** area, you can choose which apps have access and can send email.
 
 To turn off **Let apps access and send email**:
 
@@ -1373,15 +1147,7 @@ To turn off **Let apps access and send email**:
 
   -or-
 
-  -  Apply the Privacy/LetAppsAccessEmail MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessemail), where:
-
-     - **0**. User in control
-     - **1**. Force allow
-     - **2**. Force deny
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **LetAppsAccessEmail** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
+- Create a REG_DWORD registry setting named **LetAppsAccessEmail** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
 
 ### 18.12 Messaging
 
@@ -1399,15 +1165,7 @@ To turn off **Let apps read or send messages (text or MMS)**:
 
   -or-
 
--  Apply the Privacy/LetAppsAccessMessaging MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessmessaging), where:
-
-  - **0**. User in control
-  - **1**. Force allow
-  - **2**. Force deny
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **LetAppsAccessMessaging** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
+- Create a REG_DWORD registry setting named **LetAppsAccessMessaging** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
 
 To turn off **Choose apps that can read or send messages**:
 
@@ -1415,13 +1173,13 @@ To turn off **Choose apps that can read or send messages**:
 
 **To turn off Message Sync** 
 
--   Create a REG\_DWORD registry setting named **AllowMessageSync** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\Messaging and set the value to 0.
+-   Create a REG_DWORD registry setting named **AllowMessageSync** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Messaging** and set the **value to 0 (zero)**.
    
     -or-
 
 -   Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Messaging**
 
-    -   Set the **Allow Message Service Cloud** to **Disable**.
+    -   Set the **Allow Message Service Cloud Sync** to **Disable**.
 
 ### 18.13 Phone calls
 
@@ -1433,21 +1191,11 @@ To turn off **Let apps make phone calls**:
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps make phone calls**
-
-  - Set the **Select a setting** box to **Force Deny**.
+- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps make phone calls** and set the **Select a setting** box to **Force Deny**.
 
   -or-
 
--  Apply the Privacy/LetAppsAccessPhone MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessphone), where:
-
-  - **0**. User in control
-  - **1**. Force allow
-  - **2**. Force deny
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **LetAppsAccessPhone** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
+- Create a REG_DWORD registry setting named **LetAppsAccessPhone** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
 
 
 To turn off **Choose apps that can make phone calls**:
@@ -1464,21 +1212,11 @@ To turn off **Let apps control radios**:
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps control radios**
-
-  - Set the **Select a setting** box to **Force Deny**.
+- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps control radios** and set the **Select a setting** box to **Force Deny**.
 
   -or-
 
--  Apply the Privacy/LetAppsAccessRadios MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessradios), where:
-
-  - **0**. User in control
-  - **1**. Force allow
-  - **2**. Force deny
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **LetAppsAccessRadios** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
+- Create a REG_DWORD registry setting named **LetAppsAccessRadios** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
 
 
 To turn off **Choose apps that can control radios**:
@@ -1491,23 +1229,15 @@ In the **Other Devices** area, you can choose whether devices that aren't paired
 
 To turn off **Let apps automatically share and sync info with wireless devices that don't explicitly pair with your PC, tablet, or phone**:
 
-- Turn off the feature in the UI.
+- Turn off the feature in the UI by going to Settings > Privacy > Other devices >  "Communicate with unpaired devices.    Let apps automatically share and sync info with wireless devices that don't explicitly pair with your PC, tablet, or phone" and **Turn it OFF**. 
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps sync with devices**
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps communicate with unpaired devices** and set the **Select a setting** box to **Force Deny**.
 
   -or-
 
-- Apply the Privacy/LetAppsSyncWithDevices MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappssyncwithdevices), where:
-
-    - **0**. User in control
-    - **1**. Force allow
-    - **2**. Force deny
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **LetAppsSyncWithDevices** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
+- Create a REG_DWORD registry setting named **LetAppsSyncWithDevices** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**.
 
 To turn off **Let your apps use your trusted devices (hardware you've already connected, or comes with your PC, tablet, or phone)**:
 
@@ -1515,22 +1245,16 @@ To turn off **Let your apps use your trusted devices (hardware you've already co
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access trusted devices**
-
-- Set the **Select a setting** box to **Force Deny**.
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access trusted devices** and set the **Select a setting** box to **Force Deny**.
 
   -or-
 
-- Apply the **Privacy/LetAppsAccessTrustedDevices** MDM policy from the [Policy CSP](/windows/client-management/mdm/policy-csp-privacy.md#privacy-letappsaccesstrusteddevices
-), where:
+- Create a REG_DWORD registry setting named **LetAppsAccessTrustedDevices** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**.
 
-     - **0**. User in control
-     - **1**. Force allow
-     - **2**. Force deny
 
 ### 18.16 Feedback & diagnostics
 
-In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft.
+In the **Feedback & Diagnostics** area, you can choose how often you're asked for feedback and how much diagnostic and usage information is sent to Microsoft.  If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
 
 To change how frequently **Windows should ask for my feedback**:
 
@@ -1538,24 +1262,23 @@ To change how frequently **Windows should ask for my feedback**:
 > Feedback frequency only applies to user-generated feedback, not diagnostic and usage data sent from the device.
 
 
-
 - To change from **Automatically (Recommended)**, use the drop-down list in the UI.
 
   -or-
 
-- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Do not show feedback notifications**
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Do not show feedback notifications**
 
   -or-
 
-- Create a REG\_DWORD registry setting named **DoNotShowFeedbackNotifications** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection** with a value of 1 (one).
+- Create a REG_DWORD registry setting named **DoNotShowFeedbackNotifications** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection** with a value of 1 (one).
 
   -or-
 
-- Create the registry keys (REG\_DWORD type):
+- Create the registry keys (REG_DWORD type):
 
-  - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\PeriodInNanoSeconds
+  - HKEY_CURRENT_USER\\Software\\Microsoft\\Siuf\\Rules\\PeriodInNanoSeconds
 
-  - HKEY\_CURRENT\_USER\\Software\\Microsoft\\Siuf\\Rules\\NumberOfSIUFInPeriod
+  - HKEY_CURRENT_USER\\Software\\Microsoft\\Siuf\\Rules\\NumberOfSIUFInPeriod
 
     Based on these settings:
 
@@ -1574,38 +1297,15 @@ To change the level of diagnostic and usage data sent when you **Send your devic
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection And Preview Builds\\Allow Telemetry** and select the appropriate option for your deployment.
+- **Enable** the Group Policy: **Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection And Preview Builds\\Allow Telemetry** and **set it to a value of 0**.
 
   -or-
 
-- Create a REG\_DWORD registry setting in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry** with a value of 0-3, as appropriate for your deployment (see below for the values for each level).
+- Create a REG_DWORD registry setting in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection\\AllowTelemetry** with a **value of 0**.
 
 > [!NOTE]
 > If the **Security** option is configured by using Group Policy or the Registry, the value will not be reflected in the UI. The **Security** option is only available in Windows 10 Enterprise edition.
-
-  -or-
-
-- Apply the System/AllowTelemetry MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx), where:
-
-  - **0**. Maps to the **Security** level.
-
-  - **1**. Maps to the **Basic** level.
-
-  - **2**. Maps to the **Enhanced** level.
-
-  - **3**. Maps to the **Full** level.
-
-  -or-
-
-- Create a provisioning package, using **Runtime settings** > **Policies** > **System** > **AllowTelemetry**, where:
-
-  - **0**. Maps to the **Security** level.
-
-  - **1**. Maps to the **Basic** level.
-
-  - **2**. Maps to the **Enhanced** level.
-
-  - **3**. Maps to the **Full** level.
+  
 
 To turn off tailored experiences with relevant tips and recommendations by using your diagnostics data:
 
@@ -1613,7 +1313,20 @@ To turn off tailored experiences with relevant tips and recommendations by using
 
   -or-
 
-- Apply the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**
+
+  -or-
+
+- Create a REG_DWORD registry setting named **DisableWindowsConsumerFeatures** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of **1**
+
+  -and-
+
+- **Enable** the Group Policy: **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**
+
+  -or-
+
+- Create a REG_DWORD registry setting named **DisableTailoredExperiencesWithDiagnosticData** in **HKEY_Current_User\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of **1**
+
 
 ### 18.17 Background apps
 
@@ -1621,25 +1334,20 @@ In the **Background Apps** area, you can choose which apps can run in the backgr
 
 To turn off **Let apps run in the background**:
 
-- In **Background apps**, set **Let apps run in the background** to **Off**.
+- In the **Background apps** settings page, set **Let apps run in the background** to **Off**.
 
   -or-
 
-- In **Background apps**, turn off the feature for each app.
+- In the **Background apps** settings page, turn off the feature for each app.
+
+ -or-
+
+- **Enable** the Group Policy (only applicable for Windows 10 version 1703 and above): **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps run in the background** and set the **Select a setting** box to **Force Deny**.
 
   -or-
 
-- Apply the Group Policy (only applicable for Windows 10, version 1703): **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps run in the background**
+- Create a REG_DWORD registry setting named **LetAppsRunInBackground** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**
 
-  - Set the **Select a setting** box to **Force Deny**.
-
-  -or-
-
--  Apply the Privacy/LetAppsRunInBackground MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessruninbackground), where:
-
-  - **0**. User in control
-  - **1**. Force allow
-  - **2**. Force deny
 
 > [!NOTE]
 > Some apps, including Cortana and Search, might not function as expected if you set **Let apps run in the background** to **Force Deny**.
@@ -1654,19 +1362,12 @@ To turn off **Let Windows and your apps use your motion data and collect motion
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access motion**
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access motion** and set the **Default for all apps** to **Force Deny**
 
   -or-
 
--  Apply the Privacy/LetAppsAccessMotion MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccessmotion), where:
+- Create a REG_DWORD registry setting named **LetAppsAccessMotion** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**.
 
-  - **0**. User in control
-  - **1**. Force allow
-  - **2**. Force deny
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **LetAppsAccessMotion** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a value of 2 (two).
 
 ### 18.19 Tasks
 
@@ -1678,17 +1379,12 @@ To turn this off:
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access Tasks**
-
-  - Set the **Select a setting** box to **Force Deny**.
+- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access Tasks**.  Set the **Select a setting** box to **Force Deny**.
 
   -or-
 
--  Apply the Privacy/LetAppsAccessTasks MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsaccesstasks), where:
+- Create a REG_DWORD registry setting named **LetAppsAccessTasks** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**.
 
-  - **0**. User in control
-  - **1**. Force allow
-  - **2**. Force deny
 
 ### 18.20 App Diagnostics
 
@@ -1700,59 +1396,126 @@ To turn this off:
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access dignostic information about other apps**
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access diagnostic information about other apps**
 
   -or-
 
--  Apply the Privacy/LetAppsGetDiagnosticInfo MDM policy from the [Policy CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#privacy-letappsgetdiagnosticinfo), where:
+- Create a REG_DWORD registry setting named **LetAppsGetDiagnosticInfo** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**.
+
+
+### 18.21 Inking & Typing
+
+In the **Inking & Typing** area you can configure the functionality as such: 
+
+To turn off Inking & Typing data collection (note: there is no Group Policy for this setting):
+
+- In the UI go to **Settings -> Privacy -> Diagnostics & Feedback -> Inking and typing** and turn **Improve inking & typing** to **Off** 
+
+  -or-
+
+- Set **RestrictImplicitTextCollection** registry REG_DWORD setting in **HKEY_CURRENT_USER\Software\Microsoft\InputPersonalization** to a **value of 1 (one)**
+
+  -and-
+ 
+- Set **RestrictImplicitInkCollection** registry REG_DWORD setting in **HKEY_CURRENT_USER\Software\Microsoft\InputPersonalization** to a **value of 1 (one)**
+
+
+### 18.22 Activity History
+In the **Activity History** area, you can choose turn Off tracking of your Activity History.  
+
+To turn this Off in the UI:
+
+- Turn **Off** the feature in the UI by going to Settings -> Privacy -> Activity History and **un-checking** the **Store my activity history on this device** AND **unchecking** the **Send my activity History to Microsoft** checkboxes 
+
+-OR-
+
+- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **OS Policies** named **Enables Activity Feed** 
+
+     -and-
+
+- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **OS Policies** named **Allow publishing of User Activities** 
+
+     -and-
+
+- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **OS Policies** > named **Allow upload of User Activities** 
+
+-OR-
+ 
+- Create a REG_DWORD registry setting named **EnableActivityFeed** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a **value of 2 (two)**
+
+     -and-
+
+- Create a REG_DWORD registry setting named **PublishUserActivities** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a **value of 2 (two)**
+
+     -and-
+
+- Create a REG_DWORD registry setting named **UploadUserActivities** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a **value of 2 (two)**
+    
+### 18.23 Voice Activation
+
+In the **Voice activation** area, you can choose turn Off apps ability to listen for a Voice keyword.  
+
+To turn this Off in the UI:
+
+- Turn **Off** the feature in the UI by going to **Settings -> Privacy -> Voice activation** and toggle **Off** the **Allow apps to use voice activation** AND also toggle **Off** the **Allow apps to use voice activation when this device is locked** 
+
+-OR-
+
+- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** >  named **Let Windows apps activate with voice** 
+
+     -and-
+
+- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** >  named **Let Windows apps activate with voice while the system is locked** 
+
+
+-OR-
+ 
+- Create a REG_DWORD registry setting named **LetAppsActivateWithVoice** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy** with a **value of 2 (two)**
+
+     -and-
+
+- Create a REG_DWORD registry setting named **LetAppsActivateWithVoiceAboveLock** in **HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppPrivacy** with a **value of 2 (two)**
 
-  - **0**. User in control
-  - **1**. Force allow
-  - **2**. Force deny
 
 
 ### 19. Software Protection Platform
 
 Enterprise customers can manage their Windows activation status with volume licensing using an on-premises Key Management Server. You can opt out of sending KMS client activation data to Microsoft automatically by doing one of the following:
 
-For Windows 10:
+**For Windows 10:**
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation**
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation**
 
   -or-
 
-- Apply the Licensing/DisallowKMSClientOnlineAVSValidation MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is disabled (default) and 1 is enabled.
+- Create a REG_DWORD registry setting named **NoGenTicket** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a **value of 1 (one)**.
+
+**For Windows Server 2019 or later:**
+
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation**
 
   -or-
 
-- Create a REG\_DWORD registry setting named **NoGenTicket** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one).
+- Create a REG_DWORD registry setting named **NoGenTicket** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one).
 
-For Windows Server 2019 or later:
+**For Windows Server 2016:**
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Software Protection Platform** > **Turn off KMS Client Online AVS Validation**
-
-  -or-
-
-- Create a REG\_DWORD registry setting named **NoGenTicket** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one).
-
-For Windows Server 2016:
-- Create a REG\_DWORD registry setting named **NoAcquireGT** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one).
+- Create a REG_DWORD registry setting named **NoAcquireGT** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Software Protection Platform** with a value of 1 (one).
 
 >[!NOTE]
 >Due to a known issue the **Turn off KMS Client Online AVS Validation** group policy does not work as intended on Windows Server 2016, the **NoAcquireGT** value needs to be set instead.
-
-The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS.
+>The Windows activation status will be valid for a rolling period of 180 days with weekly activation status checks to the KMS.
 
 ### 20. Storage health
 
 Enterprise customers can manage updates to the Disk Failure Prediction Model.
 
 For Windows 10:
-- Disable this Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Storage Health** > **Allow downloading updates to the Disk Failure Prediction Model**
+- **Disable** this Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Storage Health** > **Allow downloading updates to the Disk Failure Prediction Model**
 
   -or-
 
-- Create a REG\_DWORD registry setting named **AllowDiskHealthModelUpdates** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\StorageHealth** with a value of 0.
+- Create a REG_DWORD registry setting named **AllowDiskHealthModelUpdates** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\StorageHealth** with a **value of 0**.
 
 ### 21. Sync your settings
 
@@ -1762,28 +1525,19 @@ You can control if your settings are synchronized:
 
   -or-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Sync your settings** > **Do not sync**
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Sync your settings** > **Do not sync**. Leave the "Allow users to turn syncing on" checkbox **unchecked**. 
 
   -or-
 
-- Create a REG\_DWORD registry setting named **DisableSettingSync** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\SettingSync** with a value of 2 (two) and another named **DisableSettingSyncUserOverride** in **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\SettingSync** with a value of 1 (one).
-
-  -or-
-
-- Apply the Experience/AllowSyncMySettings MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is not allowed and 1 is allowed.
-
-  -or-
-
-- Create a provisioning package, using **Runtime settings** > **Policies** > **Experience** > **AllowSyncMySettings**, where
-
-  - **No**. Settings are not synchronized.
-
-  - **Yes**. Settings are synchronized. (default)
+- Create a REG_DWORD registry setting named **DisableSettingSync** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\SettingSync** with a value of 2 (two) and another named **DisableSettingSyncUserOverride** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\SettingSync** with a value of 1 (one).
 
 To turn off Messaging cloud sync:
 
--   Set the Group Policy Allow Message Service Cloud to Disable.  The Group Policy path is Computer Configuration\Administrative templates\Windows Components\Messaging\Allow Message Service Cloud
--   Create a REG\_DWORD registry setting named **CloudServiceSyncEnabled** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Messaging** with a value of 0 (zero).
+-   Note: There is no Group Policy corresponding to this registry key.
+
+  -or-
+
+-   Create a REG_DWORD registry setting named **CloudServiceSyncEnabled** in **HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Messaging** and set to a **value of 0 (zero)**.
 
 ### 22. Teredo
 
@@ -1792,15 +1546,12 @@ You can disable Teredo by using Group Policy or by using the netsh.exe command.
 >[!NOTE]
 >If you disable Teredo, some XBOX gaming features and Windows Update Delivery Optimization will not work.
 
-- Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **TCPIP Settings** > **IPv6 Transition Technologies** > **Set Teredo State** and set it to **Disabled State**.
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **TCPIP Settings** > **IPv6 Transition Technologies** > **Set Teredo State** and set it to **Disabled State**.
 
   -or-
 
-- Create a new REG\_SZ registry setting named **Teredo_State** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TCPIP\\v6Transition** with a value of **Disabled**.
+- Create a new REG_SZ registry setting named **Teredo_State** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\TCPIP\\v6Transition** with a value of **Disabled**.
 
-  -or-
-
-- From an elevated command prompt, run **netsh interface teredo set state disabled**
 
 ### 23. Wi-Fi Sense
 
@@ -1811,91 +1562,92 @@ Wi-Fi Sense automatically connects devices to known hotspots and to the wireless
 
 To turn off **Connect to suggested open hotspots** and **Connect to networks shared by my contacts**:
 
-- Turn off the feature in the UI.
+- Turn off the feature in the UI in Settings  > Network & Internet  > Wi-Fi 
 
   -or-
 
-- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **WLAN Service** > **WLAN Settings** > **Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services**.
+- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Network** > **WLAN Service** > **WLAN Settings** > **Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services**.
 
   -or-
 
-- Create a new REG\_DWORD registry setting named **AutoConnectAllowedOEM** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\WcmSvc\\wifinetworkmanager\\config** with a value of 0 (zero).
+- Create a new REG_DWORD registry setting named **AutoConnectAllowedOEM** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WcmSvc\\wifinetworkmanager\\config** with a **value of 0 (zero)**.
 
-  -or-
-
-- Change the Windows Provisioning setting, WiFISenseAllowed, to 0 (zero). For more info, see the Windows Provisioning Settings reference doc, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620909).
-
-  -or-
-
-- Use the Unattended settings to set the value of WiFiSenseAllowed to 0 (zero). For more info, see the Unattended Windows Setup reference doc, [WiFiSenseAllowed](https://go.microsoft.com/fwlink/p/?LinkId=620910).
 
 When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but they’re non-functional and they can’t be controlled by the employee.
 
 ### 24. Windows Defender
 
-You can disconnect from the Microsoft Antimalware Protection Service.
+You can disconnect from the Microsoft Antimalware Protection Service. 
 
-- Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Join Microsoft MAPS**
+>[!IMPORTANT]
+>**Required Steps BEFORE setting the Windows Defender Group Policy or RegKey on Windows 10 version 1903**
+>1. Ensure Windows and Windows Defender are fully up to date.
+>2. Search the Start menu for "Tamper Protection" by clicking on the search icon next to the Windows Start button.  Then scroll down to the Tamper Protection toggle and turn it **Off**.  This will allow you to modify the Registry key and allow the Group Policy to make the setting. Alternatively, you can go to **Windows Security Settings -> Virus & threat protection, click on Manage Settings** link and then scroll down to the Tamper Protection toggle to set it to **Off**. 
 
-  -or-
+- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Join Microsoft MAPS** and then select **Disabled** from the drop-down box named **Join Microsoft MAPS**
 
-- Delete the registry setting **named** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Updates**.
+-OR-
 
-  -or-
-
-- For Windows 10 only, apply the Defender/AllowClouldProtection MDM policy from the [Defender CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
-
-  -or-
-
-- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SpyNetReporting** to 0 (zero).
+- Use the registry to set the REG_DWORD value **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SpyNetReporting** to **0 (zero)**.
 
   -and-
 
-    From an elevated Windows PowerShell prompt, run **set-mppreference -Mapsreporting 0**
+- Delete the registry setting **named** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Updates**.
+
 
 You can stop sending file samples back to Microsoft.
 
-- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Send file samples when further analysis is required** to **Always Prompt** or **Never Send**.
+- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **MAPS** > **Send file samples when further analysis is required** to **Never Send**.
 
   -or-
 
-- For Windows 10 only, apply the Defender/SubmitSamplesConsent MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender), where:
+- Use the registry to set the REG_DWORD value **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SubmitSamplesConsent** to **2 (two) for Never Send**.
 
-  - **0**. Always prompt.
 
-  - **1**. (default) Send safe samples automatically.
+You can stop downloading **Definition Updates**:
 
-  - **2**. Never send.
-
-  - **3**. Send all samples automatically.
-
-  -or-
-
-- Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SubmitSamplesConsent** to 0 (zero) to always prompt or 2 to never send.
-
-You can stop downloading definition updates:
-
-- Enable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**.
+- **Enable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define the order of sources for downloading definition updates** and set it to **FileShares**.
 
   -and-
 
-- Disable the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to nothing.
+- **Disable** the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Signature Updates** > **Define file shares for downloading definition updates** and set it to **Nothing**.
 
   -or-
 
-- Create a new REG\_SZ registry setting named **FallbackOrder** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Updates** with a value of **FileShares**.
+- Create a new REG_SZ registry setting named **FallbackOrder** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Signature Updates** with a value of **FileShares**.
 
-For Windows 10 only, you can stop Enhanced Notifications:
+  -and-
 
-- Turn off the feature in the UI.
+- **Remove** the **DefinitionUpdateFileSharesSources** reg value if it exists under **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Signature Updates** 
+
+
+You can turn off **Malicious Software Reporting Tool (MSRT) diagnostic data**:
+
+- Set the REG_DWORD value **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to **1**.
+
+**Note:** There is no Group Policy to turn off the Malicious Software Reporting Tool diagnostic data. 
+
+
+You can turn off **Enhanced Notifications** as follows:
+
+- Set in the UI: Settings -> Update & Security -> Windows Security -> Virus & Threat Protection ->  Virus & Threat Protection Manage Settings -> scroll to bottom for Notifications, click Change Notifications Settings -> Notifications -> click Manage Notifications ->  Turn off General Notifications
+
+  -or-
+
+- **Enable** the Group Policy **Turn off enhanced notifications** under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Defender Antivirus** > **Reporting**.  
+
+  -or-
+
+- Create a new REG_SZ registry setting named **DisableEnhancedNotifications** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\Reporting** to a value of **1**.
 
-You can also use the registry to turn off Malicious Software Reporting Tool diagnostic data by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1.
 
 ### 24.1 Windows Defender SmartScreen
 
 To disable Windows Defender Smartscreen:
 
-- In Group Policy, configure - **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure Windows Defender SmartScreen** : **Disable**
+In Group Policy, configure: 
+
+- **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure Windows Defender SmartScreen** to be **Disabled**
 
    -and-
 
@@ -1903,135 +1655,138 @@ To disable Windows Defender Smartscreen:
 
    -and-
 
-- **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure app install control** : **Enable**
+- **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure app install control** : **Enable**, and select **Turn off app recommendations**
 
-  -or-
+-OR-
 
-- Create a REG_DWORD registry setting named **EnableSmartScreen** in **HKEY_LOCAL_MACHINE\Sofware\Policies\Microsoft\Windows\System** with a value of 0 (zero).
+- Create a REG_DWORD registry setting named **EnableSmartScreen** in **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\System** with a **value of 0 (zero)**.
 
    -and-
 
-- Create a REG_DWORD registry setting named **ConfigureAppInstallControlEnabled** in **HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen** with a value of 1.
- 
+- Create a REG_DWORD registry setting named **ConfigureAppInstallControlEnabled** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SmartScreen** with a **value of 1**.
+
    -and-
 
-- Create a SZ registry setting named **ConfigureAppInstallControl** in **HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen** with a value of **Anywhere**.
+- Create a SZ registry setting named **ConfigureAppInstallControl** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\SmartScreen** with a value of **Anywhere**.
 
-  -or-
 
-- Apply the Browser/AllowSmartScreen MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on.
+### 25. Windows Spotlight
 
-### 25. Windows Media Player
+Windows Spotlight provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. You can control it by using the user interface or Group Policy.
 
-To remove Windows Media Player on Windows 10:
+If you're running Windows 10, version 1607 or later, you need to: 
 
-- From the **Programs and Features** control panel, click **Turn Windows features on or off**, under **Media Features**, clear the **Windows Media Player** check box, and then click **OK**.
-
-  -or-
-
-- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer**
-
-To remove Windows Media Player on Windows Server 2016:
-
-- Run the following DISM command from an elevated command prompt: **dism /online /Disable-Feature /FeatureName:WindowsMediaPlayer**
-
-### 26. Windows Spotlight
-
-Windows Spotlight provides features such as different background images and text on the lock screen, suggested apps, Microsoft account notifications, and Windows tips. You can control it by using the user interface, MDM policy, or through Group Policy.
-
-If you're running Windows 10, version 1607 or later, you only need to enable the following Group Policy:
-
-- **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off all Windows spotlight features**
+- **Enable** the following Group Policy **User Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off all Windows spotlight features**
 
     > [!NOTE]
     > This must be done within 15 minutes after Windows 10 is installed. Alternatively, you can create an image with this setting.
 
-  -or-
+   -or-
 
-- For Windows 10 only, apply the Experience/AllowWindowsSpotlight MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience), with a value of 0 (zero).
-
-  -or-
-
-- Create a new REG\_DWORD registry setting named **DisableWindowsSpotlightFeatures** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one).
+- Create a new REG_DWORD registry setting named **DisableWindowsSpotlightFeatures** in **HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one).
 
 
--and-
+-AND-
 
 
-- **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the Lock Screen**
+- Enable the following Group Policy **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the Lock Screen**
 
- -or-
+   -or-
 
--   Create a new REG\_DWORD registry setting named **NoLockScreen** in **HKEY\Local\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of 1 (one).
+- Create a new REG_DWORD registry setting named **NoLockScreen** in **HKEY_Local_Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a **value of 1 (one)**
 
-If you're not running Windows 10, version 1607 or later, you can use the other options in this section.
 
-- Configure the following in **Settings**:
+-AND-
 
-  - **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Get fun facts, tips, tricks and more on your lock screen**.
 
-  - **Personalization** > **Start** > **Occasionally show suggestions in Start**.
+- Configure the following in **Settings** UI:
 
-  - **System** > **Notifications & actions** > **Show me tips about Windows**.
+  - **Personalization** > **Lock screen** > **Background** > **Windows spotlight**, select a different background, and turn off **Get fun facts, tips, tricks and more on your lock screen**
 
-  -or-
+  - **Personalization** > **Start** > **Occasionally show suggestions in Start**
+
+  - **System** > **Notifications & actions** > **Show me tips about Windows**
+
+   -or-
 
 - Apply the Group Policies:
 
-  - **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image**.
-     - Add a location in the **Path to local lock screen image** box.
+  - **Enable** the **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Force a specific default lock screen image and logon image** Group Policy. 
+     - Add **C:\\windows\\web\\screen\\lockscreen.jpg** as the location in the **Path to local lock screen image** box.
 
-     - Set the **Turn off fun facts, tips, tricks, and more on lock screen** check box.
+     - Check the **Turn off fun facts, tips, tricks, and more on lock screen** check box.
 
        > [!NOTE]
-       > This will only take effect if the policy is applied before the first logon. If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, you can apply this policy: **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** > **Do not display the lock screen**. Alternatively, you can create a new REG\_SZ registry setting named **LockScreenImage** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG\_DWORD registry setting named **LockScreenOverlaysDisabled** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of 1 (one).
+       > This will only take effect if the policy is applied before the first logon. 
+       > If you cannot apply the **Force a specific default lock screen image** policy before the first logon to the device, 
+       > you can **Enable** the **Do not display the lock screen** policy under **Computer Configuration** > **Administrative Templates** > **Control Panel** > **Personalization** 
+
+       > Alternatively, you can create a new REG_SZ registry setting named **LockScreenImage** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** 
+       > with a value of **C:\\windows\\web\\screen\\lockscreen.jpg** and create a new REG_DWORD registry setting named **LockScreenOverlaysDisabled** in 
+       > **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Personalization** with a value of **1 (one)**.
+
+       > The Group Policy for the **LockScreenOverlaysDisabled** regkey is **Force a specific default lock screen and logon image** that is under **Control Panel** **Personalization**. 
 
 
-  - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips**.
+  \-AND-
 
-  -or-
 
-  - Create a new REG\_DWORD registry setting named **DisableSoftLanding** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one).
+  - Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Do not show Windows tips** to **Enabled** 
 
-  - **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences**.
+    -or-
 
-  -or-
+  - Create a new REG_DWORD registry setting named **DisableSoftLanding** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)**
 
-  - Create a new REG\_DWORD registry setting named **DisableWindowsConsumerFeatures** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a value of 1 (one).
 
-  -   This policy setting controls whether the lock screen appears for users.  The Do not display the lock screen Group Policy should be set to Enable to prevent the lock screen from being displayed. The Group Computer Configuration\Administrative templates\Control Panel\Personalization!Do not display the lock screen.
+  \-AND-
 
-  -       If you enable this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see their selected tile after locking their PC.
 
-  -       If you disable or do not configure this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see a lock screen after locking their PC. They must dismiss the lock screen using touch, the keyboard, or by dragging it with the mouse.
+  - Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Cloud Content** > **Turn off Microsoft consumer experiences** to **Enabled**
+
+    -or-
+
+  - Create a new REG_DWORD registry setting named **DisableWindowsConsumerFeatures** in **HKEY_LOCAL_MACHINE\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent** with a **value of 1 (one)**
+   
+ 
+This policy setting controls whether the lock screen appears for users.  The Do not display the lock screen Group Policy should be set to Enable to prevent the lock screen from being displayed. The Group Computer Configuration\Administrative templates\Control Panel\Personalization!Do not display the lock screen.
+
+If you enable this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see their selected tile after locking their PC.
+
+If you disable or do not configure this policy setting, users that are not required to press CTRL + ALT + DEL before signing in will see a lock screen after locking their PC. They must dismiss the lock screen using touch, the keyboard, or by dragging it with the mouse.
 
 
 For more info, see [Windows Spotlight on the lock screen](/windows/configuration/windows-spotlight).
 
-### 27. Microsoft Store
+### 26. Microsoft Store
 
 You can turn off the ability to launch apps from the Microsoft Store that were preinstalled or downloaded.
 This will also turn off automatic app updates, and the Microsoft Store will be disabled.
 In addition, new email accounts cannot be created by clicking **Settings** > **Accounts** > **Email & app accounts** > **Add an account**.
 On Windows Server 2016, this will block Microsoft Store calls from Universal Windows Apps.
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Microsoft Store**.
+- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Disable all apps from Microsoft Store**.
 
   -or-
 
-  - Create a new REG\_DWORD registry setting named **DisableStoreApps** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore** with a value of 1 (one).
+- Create a new REG_DWORD registry setting named **DisableStoreApps** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore** with a value of 1 (one).
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Turn off Automatic Download and Install of updates**.
+-AND-
+
+- **Enable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Store** > **Turn off Automatic Download and Install of updates**.
 
   -or-
 
-  - Create a new REG\_DWORD registry setting named **AutoDownload** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore** with a value of 2 (two).
+- Create a new REG_DWORD registry setting named **AutoDownload** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\WindowsStore** with a value of 2 (two).
 
-### 27.1 Apps for websites
+### 27. Apps for websites
 
 You can turn off apps for websites, preventing customers who visit websites that are registered with their associated app from directly launching the app.
 
-Disable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Configure web-to-app linking with URI handlers**
+- **Disable** the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Group Policy** > **Configure web-to-app linking with URI handlers**
+
+  -or-
+
+- Create a new REG_DWORD registry setting named **EnableAppUriHandlers** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\System** with a **value of 0 (zero)**.
 
 ### 28. Windows Update Delivery Optimization
 
@@ -2039,9 +1794,9 @@ Windows Update Delivery Optimization lets you get Windows updates and Microsoft
 
 By default, PCs running Windows 10 Enterprise and Windows 10 Education will only use Delivery Optimization to get and receive updates for PCs and apps on your local network.
 
-Use the UI, Group Policy, MDM policies, or Windows Provisioning to set up Delivery Optimization.
+Use the UI, Group Policy, or Registry Keys to set up Delivery Optimization.
 
-In Windows 10, version 1607, you can stop network traffic related to Windows Update Delivery Optimization by setting **Download Mode** to **Simple** (99) or **Bypass** (100), as described below.
+In Windows 10 version 1607 and above you can stop network traffic related to Windows Update Delivery Optimization by setting **Download Mode** to  **Bypass** (100), as described below.
 
 ### 28.1 Settings > Update & security
 
@@ -2055,89 +1810,86 @@ You can find the Delivery Optimization Group Policy objects under **Computer Con
 
 | Policy                    | Description                                                                                         |
 |---------------------------|-----------------------------------------------------------------------------------------------------|
-| Download Mode             | Lets you choose where Delivery Optimization gets or sends updates and apps, including 
                                  • None. Turns off Delivery Optimization.
                                  • Group. Gets or sends updates and apps to PCs on the same local network domain.
                                  • Internet. Gets or sends updates and apps to PCs on the Internet.
                                  • LAN. Gets or sends updates and apps to PCs on the same NAT only.
                                  • Simple. Simple download mode with no peering.
                                  • Bypass. Use BITS instead of Windows Update Delivery Optimization.Set to Bypass to restrict traffic.
                                  |
+| Download Mode             | Lets you choose where Delivery Optimization gets or sends updates and apps, including 
                                  • None. Turns off Delivery Optimization.
                                  • Group. Gets or sends updates and apps to PCs on the same local network domain.
                                  • Internet. Gets or sends updates and apps to PCs on the Internet.
                                  • LAN. Gets or sends updates and apps to PCs on the same NAT only.
                                  • Simple. Simple download mode with no peering.
                                  • Bypass. Use BITS instead of Windows Update Delivery Optimization. **Set to Bypass** to restrict traffic.
                                  |
 | Group ID                  | Lets you provide a Group ID that limits which PCs can share apps and updates. 
                                   **Note:** This ID must be a GUID.|
 | Max Cache Age             | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache. 
                                   The default value is 259200 seconds (3 days).|
 | Max Cache Size            | Lets you specify the maximum cache size as a percentage of disk size. 
                                   The default value is 20, which represents 20% of the disk.|
 | Max Upload Bandwidth      | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity. 
                                   The default value is 0, which means unlimited possible bandwidth.|
 
-Set the Delivery Optimization Group Policy to "Bypass" to prevent traffic.  Alternatively, you can set the **Download Mode** policy by creating a new REG\_DWORD registry setting named **DODownloadMode** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization** to a value of 100 (one hundred).
+### 28.3 Delivery Optimization
 
-### 28.3 Delivery Optimization MDM policies
+- **Enable** the **Download Mode** Group Policy under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Delivery Optimization** and set the **Download Mode** to **"Bypass"** to prevent traffic.
 
-The following Delivery Optimization MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx).
+-or-
 
-| Policy                    | Description                                                                                         |
-|---------------------------|-----------------------------------------------------------------------------------------------------|
-| DeliveryOptimization/DODownloadMode            | Lets you choose where Delivery Optimization gets or sends updates and apps, including 
                                  • 0. Turns off Delivery Optimization.
                                  • 1. Gets or sends updates and apps to PCs on the same NAT only.
                                  • 2. Gets or sends updates and apps to PCs on the same local network domain.
                                  • 3. Gets or sends updates and apps to PCs on the Internet.
                                  • 99. Simple download mode with no peering.
                                  • 100. Use BITS instead of Windows Update Delivery Optimization.
                                  |
-| DeliveryOptimization/DOGroupID                 | Lets you provide a Group ID that limits which PCs can share apps and updates. 
                                   **Note** This ID must be a GUID.|
-| DeliveryOptimization/DOMaxCacheAge             | Lets you specify the maximum time (in seconds) that a file is held in the Delivery Optimization cache. 
                                   The default value is 259200 seconds (3 days).|
-| DeliveryOptimization/DOMaxCacheSize            | Lets you specify the maximum cache size as a percentage of disk size. 
                                   The default value is 20, which represents 20% of the disk.|
-| DeliveryOptimization/DOMaxUploadBandwidth      | Lets you specify the maximum upload bandwidth (in KB/second) that a device uses across all concurrent upload activity. 
                                   The default value is 0, which means unlimited possible bandwidth.|
+- Create a new REG_DWORD registry setting named **DODownloadMode** in **HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization** to a value of **100 (one hundred)**. 
 
 
-### 28.4 Delivery Optimization Windows Provisioning
-
-If you don't have an MDM server in your enterprise, you can use Windows Provisioning to configure the Delivery Optimization policies
-
-Use Windows ICD, included with the [Windows Assessment and Deployment Kit (Windows ADK)](https://go.microsoft.com/fwlink/p/?LinkId=526803), to create a provisioning package for Delivery Optimization.
-
-1.  Open Windows ICD, and then click **New provisioning package**.
-
-2.  In the **Name** box, type a name for the provisioning package, and then click **Next.**
-
-3.  Click the **Common to all Windows editions** option, click **Next**, and then click **Finish**.
-
-4.  Go to **Runtime settings** > **Policies** > **DeliveryOptimization** to configure the policies.
-
 For more info about Delivery Optimization in general, see [Windows Update Delivery Optimization: FAQ](https://go.microsoft.com/fwlink/p/?LinkId=730684).
 
 ### 29. Windows Update
 
 You can turn off Windows Update by setting the following registry entries:
 
-- Add a REG\_DWORD value named **DoNotConnectToWindowsUpdateInternetLocations** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1.
+- Add a REG_DWORD value named **DoNotConnectToWindowsUpdateInternetLocations** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1.
 
   -and-
 
-- Add a REG\_DWORD value named **DisableWindowsUpdateAccess** to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1.
+- Add a REG_DWORD value named **DisableWindowsUpdateAccess** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and set the value to 1.
 
   -and-
 
-- Add a REG\_DWORD value named **UseWUServer** to **HKEY\_LOCAL\_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU** and set the value to 1.
-
-  -or-
-
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Do not connect to any Windows Update Internet locations**.
+- Add a REG_SZ value named **WUServer** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and ensure it is blank with a space character **" "**. 
 
   -and-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off access to all Windows Update features**.
+- Add a REG_SZ value named **WUStatusServer** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and ensure it is blank with a space character **" "**. 
 
   -and-
 
-- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Specify intranet Microsoft update service location** and set the **Set the alternate download server** to " ".
+- Add a REG_SZ value named **UpdateServiceUrlAlternate** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate** and ensure it is blank with a space character **" "**. 
+
+  -and-
+
+- Add a REG_DWORD value named **UseWUServer** to **HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\WindowsUpdate\\AU** and set the value to 1.
+
+-OR-
+
+- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Do not connect to any Windows Update Internet locations** to **Enabled** 
+
+  -and-
+
+- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off access to all Windows Update features** to **Enabled**
+
+  -and-
+
+- Set the Group Policy **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Specify intranet Microsoft update service location** to **Enabled** and ensure all Option settings (Intranet Update Service, Intranet Statistics Server, Alternate Download Server) are set to **" "** 
+
+  -and-
+
+- Set the Group Policy **User Configuration** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Remove access to use all Windows Update features** to **Enabled** and then set **Computer Configurations** to **0 (zero)**.  
 
 
-You can turn off automatic updates by doing one of the following. This is not recommended.
+You can turn off automatic updates by doing the following. This is not recommended.
 
-- Add a REG\_DWORD value named **AutoDownload** to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate** and set the value to 5.
+- Add a REG_DWORD value named **AutoDownload** to **HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate** and set the value to 5.
 
-  -or-
 
-- For Windows 10 only, apply the Update/AllowAutoUpdate MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update), where:
+For China releases of Windows 10 there is one additional Regkey to be set to prevent traffic:
 
-  - **0**. Notify the user before downloading the update.
+- Add a REG_DWORD value named **HapDownloadEnabled** to **HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LexiconUpdate\\loc_0804** and set the value to 0.
 
-  - **1**. Auto install the update and then notify the user to schedule a device restart.
+  
 
-  - **2** (default). Auto install and restart.
+###  Allowed traffic list for Windows Restricted Traffic Limited Functionality Baseline
 
-  - **3**. Auto install and restart at a specified time.
+|**Allowed traffic endpoints** | 
+| --- | 
+|activation-v2.sls.microsoft.com/*|
+|crl.microsoft.com/pki/crl/*|
+|ocsp.digicert.com/*|
+|www.microsoft.com/pkiops/*|
 
-  - **4**. Auto install and restart without end-user control.
-
-  - **5**. Turn off automatic updates.
 
 To learn more, see [Device update management](https://msdn.microsoft.com/library/windows/hardware/dn957432.aspx) and [Configure Automatic Updates by using Group Policy](https://technet.microsoft.com/library/cc720539.aspx).
 
diff --git a/windows/privacy/manage-windows-1709-endpoints.md b/windows/privacy/manage-windows-1709-endpoints.md
index a3e6817d6a..32fc4b968a 100644
--- a/windows/privacy/manage-windows-1709-endpoints.md
+++ b/windows/privacy/manage-windows-1709-endpoints.md
@@ -1,32 +1,33 @@
 ---
-title: Connection endpoints for Windows 10, version 1709
-description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact.
+title: Connection endpoints for Windows 10 Enterprise, version 1709
+description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1709.
 keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
 ms.localizationpriority: high
 audience: ITPro
-author: danihalfin
-ms.author: daniha
+author: dansimp
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
 ms.date: 6/26/2018
+ms.reviewer: 
 ---
-# Manage connection endpoints for Windows 10, version 1709
+# Manage connection endpoints for Windows 10 Enterprise, version 1709
 
 **Applies to**
 
-- Windows 10, version 1709
+- Windows 10 Enterprise, version 1709
 
 Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include:
 
--	Connecting to Microsoft Office and Windows sites to download the latest app and security updates.
--	Connecting to email servers to send and receive email.
--	Connecting to the web for every day web browsing.
--	Connecting to the cloud to store and access backups.
--	Using your location to show a weather forecast.
+- Connecting to Microsoft Office and Windows sites to download the latest app and security updates.
+- Connecting to email servers to send and receive email.
+- Connecting to the web for every day web browsing.
+- Connecting to the cloud to store and access backups.
+- Using your location to show a weather forecast.
 
 This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later.
 Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). 
@@ -34,10 +35,10 @@ Where applicable, each endpoint covered in this topic includes a link to specifi
 
 We used the following methodology to derive these network endpoints:
 
-1.	Set up the latest version of Windows 10 on a test virtual machine using the default settings. 
-2.	Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
-3.	Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.  
-4.	Compile reports on traffic going to public IP addresses.
+1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. 
+2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
+3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.  
+4. Compile reports on traffic going to public IP addresses.
 5.  The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory.
 6.  All traffic was captured in our lab using a IPV4 network.  Therefore no IPV6 traffic is reported here. 
 
@@ -83,7 +84,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a
 |----------------|----------|------------|
 |  |    | star-mini.c10r.facebook.com |
 
-The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office Online. 
+The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office. 
 To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). 
 If you disable the Microsoft store, other Store apps cannot be installed or updated. 
 Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
@@ -292,7 +293,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper
 
 ## Office
 
-The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office Online. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). 
+The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). 
 You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps.
 If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.
 
@@ -303,7 +304,7 @@ If you turn off traffic for these endpoints, users won't be able to save documen
 |   |    | *.e-msedge.net  |
 |   |    | *.s-msedge.net  |
 
-The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office Online. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). 
+The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). 
 You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps.
 If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.
 
@@ -405,52 +406,25 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper
 |----------------|----------|------------|
 | svchost  | HTTPS   | *.prod.do.dsp.mp.microsoft.com  |
 
-The following endpoints are used to download operating system patches and updates. 
+The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. 
 If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to download updates for the operating system.
 
 | Source process | Protocol | Destination |
 |----------------|----------|------------|
 | svchost | HTTP  | *.windowsupdate.com |
-|         | HTTP   | fg.download.windowsupdate.com.c.footprint.net |
-
-The following endpoint is used by the Highwinds Content Delivery Network to perform Windows updates. 
-If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not perform updates.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-|  |            | cds.d2s7q6s2.hwcdn.net |
-
-The following endpoints are used by the Verizon Content Delivery Network to perform Windows updates. 
-If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not perform updates.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-|  |  HTTP          | *wac.phicdn.net |
-|  |                | *wac.edgecastcdn.net |
-
-The following endpoint is used to download apps and Windows Insider Preview builds from the Microsoft Store. Time Limited URL (TLU) is a mechanism for protecting the content. For example, it prevents someone from copying the URL and then getting access to the app that the person has not acquired).
-If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the updating functionality on this device is essentially in a disabled state, resulting in user unable to get apps from the Store, get latest version of Windows, and so on.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-| svchost |    | *.tlu.dl.delivery.mp.microsoft.com.c.footprint.net |
-
-The following endpoint is used to download apps from the Microsoft Store. It's used as part of calculating the right ranges for apps.
-If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), users of the device will not able to get apps from the Microsoft Store.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-| svchost |    | emdl.ws.microsoft.com  |
+| svchost | HTTP  | *.dl.delivery.mp.microsoft.com |
 
 The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. 
 If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store.
 
 | Source process | Protocol | Destination |
 |----------------|----------|------------|
-| svchost | HTTPS   | fe2.update.microsoft.com |
-| svchost |    | fe3.delivery.mp.microsoft.com  |
-|       |      | fe3.delivery.dsp.mp.microsoft.com.nsatc.net |
-| svchost | HTTPS   | sls.update.microsoft.com |
+| svchost | HTTPS   | *.update.microsoft.com |
+| svchost | HTTPS   | *.delivery.mp.microsoft.com  |
+
+These are dependent on enabling:
+- [Device authentication](manage-windows-1709-endpoints.md#device-authentication)
+- [Microsoft account](manage-windows-1709-endpoints.md#microsoft-account)
 
 The following endpoint is used for content regulation.
 If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.
@@ -459,14 +433,6 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper
 |----------------|----------|------------|
 | svchost | HTTPS   | tsfe.trafficshaping.dsp.mp.microsoft.com |
 
-The following endpoints are used to download content.
-If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), you will block any content from being downloaded.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-|  |    | a122.dscd.akamai.net  |
-|  |    | a1621.g.akamai.net   |
-
 ## Microsoft forward link redirection service (FWLink)
 
 The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer.
@@ -490,4 +456,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see:
 ## Related links
 
 - [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US)
-- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
\ No newline at end of file
+- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
diff --git a/windows/privacy/manage-windows-1803-endpoints.md b/windows/privacy/manage-windows-1803-endpoints.md
index c23ac04672..f62497b8ad 100644
--- a/windows/privacy/manage-windows-1803-endpoints.md
+++ b/windows/privacy/manage-windows-1803-endpoints.md
@@ -1,32 +1,33 @@
 ---
 title: Connection endpoints for Windows 10, version 1803
-description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact.
+description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1803.
 keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
 ms.localizationpriority: high
 audience: ITPro
-author: danihalfin
-ms.author: daniha
+author: dansimp
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
 ms.date: 6/26/2018
+ms.reviewer: 
 ---
-# Manage connection endpoints for Windows 10, version 1803
+# Manage connection endpoints for Windows 10 Enterprise, version 1803
 
 **Applies to**
 
-- Windows 10, version 1803
+- Windows 10 Enterprise, version 1803
 
 Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include:
 
--	Connecting to Microsoft Office and Windows sites to download the latest app and security updates.
--	Connecting to email servers to send and receive email.
--	Connecting to the web for every day web browsing.
--	Connecting to the cloud to store and access backups.
--	Using your location to show a weather forecast.
+- Connecting to Microsoft Office and Windows sites to download the latest app and security updates.
+- Connecting to email servers to send and receive email.
+- Connecting to the web for every day web browsing.
+- Connecting to the cloud to store and access backups.
+- Using your location to show a weather forecast.
 
 This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later.
 Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). 
@@ -34,10 +35,10 @@ Where applicable, each endpoint covered in this topic includes a link to specifi
 
 We used the following methodology to derive these network endpoints:
 
-1.	Set up the latest version of Windows 10 on a test virtual machine using the default settings. 
-2.	Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
-3.	Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.  
-4.	Compile reports on traffic going to public IP addresses.
+1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. 
+2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
+3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.  
+4. Compile reports on traffic going to public IP addresses.
 5.  The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory.
 6.  All traffic was captured in our lab using a IPV4 network.  Therefore no IPV6 traffic is reported here. 
 
@@ -84,7 +85,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a
 |----------------|----------|------------|
 |  |    | star-mini.c10r.facebook.com |
 
-The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office Online. 
+The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office. 
 To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). 
 If you disable the Microsoft store, other Store apps cannot be installed or updated. 
 Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
@@ -296,7 +297,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper
 
 ## Office
 
-The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office Online. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). 
+The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). 
 You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps.
 If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.
 
@@ -308,7 +309,7 @@ If you turn off traffic for these endpoints, users won't be able to save documen
 |   |    | *.s-msedge.net  |
 |   | HTTPS | ocos-office365-s2s.msedge.net |
 
-The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office Online. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). 
+The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). 
 You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps.
 If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.
 
@@ -410,53 +411,25 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper
 |----------------|----------|------------|
 | svchost  | HTTPS   | *.prod.do.dsp.mp.microsoft.com  |
 
-The following endpoints are used to download operating system patches and updates. 
+The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. 
 If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to download updates for the operating system.
 
 | Source process | Protocol | Destination |
 |----------------|----------|------------|
 | svchost | HTTP  | *.windowsupdate.com |
-|         | HTTP   | fg.download.windowsupdate.com.c.footprint.net |
-
-The following endpoint is used by the Highwinds Content Delivery Network to perform Windows updates. 
-If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not perform updates.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-|  |            | cds.d2s7q6s2.hwcdn.net |
-
-The following endpoints are used by the Verizon Content Delivery Network to perform Windows updates. 
-If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not perform updates.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-|  |  HTTP          | *wac.phicdn.net |
-|  |                | *wac.edgecastcdn.net |
-
-The following endpoint is used to download apps and Windows Insider Preview builds from the Microsoft Store. Time Limited URL (TLU) is a mechanism for protecting the content. For example, it prevents someone from copying the URL and then getting access to the app that the person has not acquired).
-If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the updating functionality on this device is essentially in a disabled state, resulting in user unable to get apps from the Store, get latest version of Windows, and so on.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-| svchost |    | *.tlu.dl.delivery.mp.microsoft.com.c.footprint.net |
-
-The following endpoint is used to download apps from the Microsoft Store. It's used as part of calculating the right ranges for apps.
-If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), users of the device will not able to get apps from the Microsoft Store.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-| svchost |    | emdl.ws.microsoft.com  |
+| svchost | HTTP  | *.dl.delivery.mp.microsoft.com |
 
 The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. 
 If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store.
 
 | Source process | Protocol | Destination |
 |----------------|----------|------------|
-| svchost | HTTPS   | fe2.update.microsoft.com |
-| svchost |    | fe3.delivery.mp.microsoft.com  |
-|       |      | fe3.delivery.dsp.mp.microsoft.com.nsatc.net |
-| svchost | HTTPS   | sls.update.microsoft.com |
-|   | HTTP | *.dl.delivery.mp.microsoft.com |
+| svchost | HTTPS   | *.update.microsoft.com |
+| svchost | HTTPS   | *.delivery.mp.microsoft.com  |
+
+These are dependent on enabling:
+- [Device authentication](manage-windows-1803-endpoints.md#device-authentication)
+- [Microsoft account](manage-windows-1803-endpoints.md#microsoft-account)
 
 The following endpoint is used for content regulation.
 If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.
@@ -465,14 +438,6 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper
 |----------------|----------|------------|
 | svchost | HTTPS   | tsfe.trafficshaping.dsp.mp.microsoft.com |
 
-The following endpoints are used to download content.
-If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), you will block any content from being downloaded.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-|  |    | a122.dscd.akamai.net  |
-|  |    | a1621.g.akamai.net   |
-
 ## Microsoft forward link redirection service (FWLink)
 
 The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer.
@@ -496,4 +461,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see:
 ## Related links
 
 - [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US)
-- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
\ No newline at end of file
+- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md
index 74fa377991..0504d6eceb 100644
--- a/windows/privacy/manage-windows-1809-endpoints.md
+++ b/windows/privacy/manage-windows-1809-endpoints.md
@@ -1,32 +1,33 @@
 ---
 title: Connection endpoints for Windows 10, version 1809
-description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact.
+description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1809.
 keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
 ms.localizationpriority: high
 audience: ITPro
-author: danihalfin
-ms.author: daniha
+author: dansimp
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
 ms.date: 6/26/2018
+ms.reviewer: 
 ---
-# Manage connection endpoints for Windows 10, version 1809
+# Manage connection endpoints for Windows 10 Enterprise, version 1809
 
 **Applies to**
 
-- Windows 10, version 1809
+- Windows 10 Enterprise, version 1809
 
 Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include:
 
--	Connecting to Microsoft Office and Windows sites to download the latest app and security updates.
--	Connecting to email servers to send and receive email.
--	Connecting to the web for every day web browsing.
--	Connecting to the cloud to store and access backups.
--	Using your location to show a weather forecast.
+- Connecting to Microsoft Office and Windows sites to download the latest app and security updates.
+- Connecting to email servers to send and receive email.
+- Connecting to the web for every day web browsing.
+- Connecting to the cloud to store and access backups.
+- Using your location to show a weather forecast.
 
 This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later.
 Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). 
@@ -34,10 +35,10 @@ Where applicable, each endpoint covered in this topic includes a link to specifi
 
 We used the following methodology to derive these network endpoints:
 
-1.	Set up the latest version of Windows 10 on a test virtual machine using the default settings. 
-2.	Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
-3.	Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.  
-4.	Compile reports on traffic going to public IP addresses.
+1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. 
+2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
+3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.  
+4. Compile reports on traffic going to public IP addresses.
 5.  The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory.
 6.  All traffic was captured in our lab using a IPV4 network.  Therefore no IPV6 traffic is reported here. 
 
@@ -84,7 +85,7 @@ Additionally, the Microsoft Store won't be able to revoke malicious Store apps a
 |----------------|----------|------------|
 |  |    | star-mini.c10r.facebook.com |
 
-The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office Online. 
+The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office. 
 To turn off traffic for this endpoint, either uninstall the Photos app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). 
 If you disable the Microsoft store, other Store apps cannot be installed or updated. 
 Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
@@ -260,6 +261,8 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op
 | Source process | Protocol | Destination |
 |----------------|----------|------------|
 |  |   | login.msa.akadns6.net  |
+|  |   | login.live.com  |
+|  |   | account.live.com |
 | system32\Auth.Host.exe | HTTPS | auth.gfx.ms |
 |  |   | us.configsvc1.live.com.akadns.net |
 
@@ -308,7 +311,7 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper
 
 ## Office
 
-The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office Online. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). 
+The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). 
 You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps.
 If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.
 
@@ -322,7 +325,7 @@ If you turn off traffic for these endpoints, users won't be able to save documen
 |   | HTTPS | nexusrules.officeapps.live.com |
 |   | HTTPS | officeclient.microsoft.com |
 
-The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office Online. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). 
+The following endpoint is used to connect to the Office 365 portal's shared infrastructure, including Office. For more info, see [Office 365 URLs and IP address ranges](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US#BKMK_Portal-identity). 
 You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps.
 If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.
 
@@ -395,7 +398,7 @@ The following endpoint is used to retrieve Skype configuration values. To turn o
 ## Windows Defender
 
 The following endpoint is used for Windows Defender when Cloud-based Protection is enabled.
-If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), the device will not use Cloud-based Protection.
+If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender), the device will not use Cloud-based Protection. For a detailed list of Windows Defender Antivirus cloud service connections, see [Allow connections to the Windows Defender Antivirus cloud service](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-network-connections-windows-defender-antivirus#allow-connections-to-the-windows-defender-antivirus-cloud-service).
 
 | Source process | Protocol | Destination |
 |----------------|----------|------------|
@@ -410,7 +413,7 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op
 |MpCmdRun.exe|HTTPS|go.microsoft.com |
 
 The following endpoints are used for Windows Defender Smartscreen reporting and notifications.
-If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender-smartscreen), Smartscreen notifications will no appear.
+If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender-smartscreen), Windows Defender Smartscreen notifications will no appear.
 
 | Source process | Protocol | Destination |
 |----------------|----------|------------|
@@ -440,53 +443,25 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper
 |----------------|----------|------------|
 | svchost  | HTTPS   | *.prod.do.dsp.mp.microsoft.com  |
 
-The following endpoints are used to download operating system patches and updates. 
+The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. 
 If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to download updates for the operating system.
 
 | Source process | Protocol | Destination |
 |----------------|----------|------------|
 | svchost | HTTP  | *.windowsupdate.com |
-|         | HTTP   | fg.download.windowsupdate.com.c.footprint.net |
-
-The following endpoint is used by the Highwinds Content Delivery Network to perform Windows updates. 
-If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not perform updates.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-|  |            | cds.d2s7q6s2.hwcdn.net |
-
-The following endpoints are used by the Verizon Content Delivery Network to perform Windows updates. 
-If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not perform updates.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-|  |  HTTP          | *wac.phicdn.net |
-|  |                | *wac.edgecastcdn.net |
-
-The following endpoint is used to download apps and Windows Insider Preview builds from the Microsoft Store. Time Limited URL (TLU) is a mechanism for protecting the content. For example, it prevents someone from copying the URL and then getting access to the app that the person has not acquired).
-If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the updating functionality on this device is essentially in a disabled state, resulting in user unable to get apps from the Store, get latest version of Windows, and so on.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-| svchost |    | *.tlu.dl.delivery.mp.microsoft.com.c.footprint.net |
-
-The following endpoint is used to download apps from the Microsoft Store. It's used as part of calculating the right ranges for apps.
-If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), users of the device will not able to get apps from the Microsoft Store.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-| svchost |    | emdl.ws.microsoft.com  |
+| svchost | HTTP  | *.dl.delivery.mp.microsoft.com |
 
 The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. 
 If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store.
 
 | Source process | Protocol | Destination |
 |----------------|----------|------------|
-| svchost | HTTPS   | fe2.update.microsoft.com |
-| svchost |    | fe3.delivery.mp.microsoft.com  |
-|       |      | fe3.delivery.dsp.mp.microsoft.com.nsatc.net |
-| svchost | HTTPS   | sls.update.microsoft.com |
-|   | HTTP | *.dl.delivery.mp.microsoft.com |
+| svchost | HTTPS   | *.update.microsoft.com |
+| svchost | HTTPS   | *.delivery.mp.microsoft.com  |
+
+These are dependent on enabling:
+- [Device authentication](manage-windows-1809-endpoints.md#device-authentication)
+- [Microsoft account](manage-windows-1809-endpoints.md#microsoft-account)
 
 The following endpoint is used for content regulation.
 If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.
@@ -495,13 +470,6 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper
 |----------------|----------|------------|
 | svchost | HTTPS   | tsfe.trafficshaping.dsp.mp.microsoft.com |
 
-The following endpoints are used to download content.
-If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-wu), you will block any content from being downloaded.
-
-| Source process | Protocol | Destination |
-|----------------|----------|------------|
-|  |    | a122.dscd.akamai.net  |
-|  |    | a1621.g.akamai.net   |
 
 ## Microsoft forward link redirection service (FWLink)
 
@@ -528,4 +496,4 @@ To view endpoints for non-Enterprise Windows 10 editions, see:
 ## Related links
 
 - [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US)
-- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
\ No newline at end of file
+- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
diff --git a/windows/privacy/manage-windows-1903-endpoints.md b/windows/privacy/manage-windows-1903-endpoints.md
new file mode 100644
index 0000000000..786649ef6a
--- /dev/null
+++ b/windows/privacy/manage-windows-1903-endpoints.md
@@ -0,0 +1,190 @@
+---
+title: Connection endpoints for Windows 10 Enterprise, version 1903
+description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1903.
+keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.localizationpriority: high
+audience: ITPro
+author: danihalfin
+ms.author: v-medgar
+manager: sanashar
+ms.collection: M365-security-compliance
+ms.topic: article
+ms.date: 5/3/2019
+---
+# Manage connection endpoints for Windows 10 Enterprise, version 1903
+
+**Applies to**
+
+- Windows 10 Enterprise, version 1903
+
+Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include:
+
+- Connecting to Microsoft Office and Windows sites to download the latest app and security updates.
+- Connecting to email servers to send and receive email.
+- Connecting to the web for every day web browsing.
+- Connecting to the cloud to store and access backups.
+- Using your location to show a weather forecast.
+
+This article lists different endpoints that are available on a clean installation of Windows 10, version 1709 and later.
+Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). 
+Where applicable, each endpoint covered in this topic includes a link to the specific details on how to control that traffic. 
+
+The following methodology was used to derive these network endpoints:
+
+1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. 
+2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device).
+3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.  
+4. Compile reports on traffic going to public IP addresses.
+5.  The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory.
+6.  All traffic was captured in our lab using a IPV4 network.  Therefore, no IPV6 traffic is reported here. 
+7.  These tests were conducted in an approved Microsoft lab.  It's possible your results may be different.
+8.  These tests were conducted for one week, but if you capture traffic for longer you may have different results.
+
+> [!NOTE]
+> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time.
+
+## Windows 10 1903 Enterprise connection endpoints
+
+|Area|Description|Protocol|Destination|
+|----------------|----------|----------|------------|
+|Apps|||[Learn how to turn off traffic to the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)|
+||The following endpoints are used to download updates to the Weather app Live Tile. If you turn off traffic to this endpoint, no Live Tiles will be updated.|HTTP|blob.weather.microsoft.com|
+|||HTTP|tile-service.weather.microsoft.com
+|||HTTP|tile-service.weather.microsoft.com
+||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|cdn.onenote.net/livetile/?Language=en-US
+||The following endpoint is used for Twitter updates. To turn off traffic for these endpoints, either uninstall Twitter or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|*.twimg.com*|
+||The following endpoint is used for Candy Crush Saga updates. To turn off traffic for this endpoint, either uninstall Candy Crush Saga or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLS v1.2|candycrushsoda.king.com|
+||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|evoke-windowsservices-tas.msedge.net|
+||The following endpoint is used for by the Microsoft Wallet app. To turn off traffic for this endpoint, either uninstall the Wallet app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTPS|wallet.microsoft.com|
+||The following endpoint is used by the Groove Music app for update HTTP handler status. If you turn off traffic for this endpoint, apps for websites won't work and customers who visit websites (such as mediaredirect.microsoft.com) that are registered with their associated app (such as Groove Music) will stay at the website and won't be able to directly launch the app.|HTTPS|mediaredirect.microsoft.com|
+||The following endpoints are used when using the Whiteboard app. To turn off traffic for this endpoint disable the Microsoft Store.|HTTPS|int.whiteboard.microsoft.com|
+|||HTTPS|wbd.ms|
+|||HTTPS|whiteboard.microsoft.com|
+|||HTTP / HTTPS|whiteboard.ms|
+|Azure |The following endpoints are related to Azure. |HTTPS|wd-prod-*fe*.cloudapp.azure.com|
+|||HTTPS|ris-prod-atm.trafficmanager.net|
+|||HTTPS|validation-v2.sls.trafficmanager.net|
+|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible turn off traffic to this endpoint, but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)|
+|||HTTP|ctldl.windowsupdate.com|
+|Cortana and Search|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)|
+||The following endpoint is used to get images that are used for Microsoft Store suggestions. If you turn off traffic for this endpoint, you will block images that are used for Microsoft Store suggestions.|HTTPS|store-images.*microsoft.com|
+||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|HTTPS|www.bing.com/client|
+|||HTTPS|www.bing.com|
+|||HTTPS|www.bing.com/proactive|
+|||HTTPS|www.bing.com/threshold/xls.aspx|
+|||HTTP|exo-ring.msedge.net|
+|||HTTP|fp.msedge.net|
+|||HTTP|fp-vp.azureedge.net|
+|||HTTP|odinvzc.azureedge.net|
+|||HTTP|spo-ring.msedge.net|
+|Device authentication|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)|
+||The following endpoint is used to authenticate a device. If you  turn off traffic for this endpoint, the device will not be authenticated.|HTTPS|login.live.com*|
+|Device metadata|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#4-device-metadata-retrieval)|
+||The following endpoint is used to retrieve device metadata. If you  turn off traffic for this endpoint, metadata will not be updated for the device.|HTTP|dmd.metaservices.microsoft.com|
+|Diagnostic Data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)|
+|||HTTP|v10.events.data.microsoft.com|
+|||HTTPS|v10.vortex-win.data.microsoft.com/collect/v1|
+|||HTTP|www.microsoft.com|
+||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|HTTPS|co4.telecommand.telemetry.microsoft.com|
+|||HTTP|cs11.wpc.v0cdn.net|
+|||HTTPS|cs1137.wpc.gammacdn.net|
+|||TLS v1.2|modern.watson.data.microsoft.com*|
+|||HTTPS|watson.telemetry.microsoft.com|
+|Licensing|The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#9-license-manager)|
+|||HTTPS|*licensing.mp.microsoft.com*|
+|Location|The following endpoints are used for location data. If you turn off traffic for this endpoint, apps cannot use location data. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location)|
+|||HTTPS|inference.location.live.net|
+|||HTTP|location-inference-westus.cloudapp.net|
+|Maps|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps)|
+||The following endpoints are used to check for updates to maps that have been downloaded for offline use. If you turn off traffic for this endpoint, offline maps will not be updated.|HTTPS|*g.akamaiedge.net|
+|||HTTP|*maps.windows.com*|
+|Microsoft Account|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account)|
+||The following endpoints are used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users cannot sign in with Microsoft accounts. |HTTP|login.msa.akadns6.net|
+|||HTTP|us.configsvc1.live.com.akadns.net|
+|Microsoft Edge|This traffic is related to the Microsoft Edge browser.|HTTPS|iecvlist.microsoft.com|
+|Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTPS|go.microsoft.com|
+|Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)|
+||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way. If you turn off traffic for this endpoint, push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.|HTTPS|*.wns.windows.com|
+||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|HTTP|storecatalogrevocation.storequality.microsoft.com|
+||The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you turn off traffic for these endpoints, the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|HTTPS|img-prod-cms-rt-microsoft-com*|
+|||HTTPS|store-images.microsoft.com|
+||The following endpoints are used to communicate with Microsoft Store. If you turn off traffic for these endpoints, apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|TLS v1.2|*.md.mp.microsoft.com*|
+|||HTTPS|*displaycatalog.mp.microsoft.com|
+|||HTTP \ HTTPS|pti.store.microsoft.com|
+|||HTTP|storeedgefd.dsx.mp.microsoft.com|
+|||HTTP|markets.books.microsoft.com|
+|||HTTP |share.microsoft.com|
+|Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)|
+||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.|HTTP|www.msftconnecttest.com*|
+|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)|
+|||HTTP|*.c-msedge.net|
+|||HTTPS|*.e-msedge.net|
+|||HTTPS|*.s-msedge.net|
+|||HTTPS|nexusrules.officeapps.live.com|
+|||HTTPS|ocos-office365-s2s.msedge.net|
+|||HTTPS|officeclient.microsoft.com|
+|||HTTPS|outlook.office365.com|
+|||HTTPS|client-office365-tas.msedge.net|
+|||HTTPS|www.office.com|
+|||HTTPS|onecollector.cloudapp.aria|
+|||HTTP|v10.events.data.microsoft.com/onecollector/1.0/|
+|||HTTPS|self.events.data.microsoft.com|
+||The following endpoint is used to connect the Office To-Do app to its cloud service. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store.|HTTPS|to-do.microsoft.com|
+|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)|
+|||HTTP \ HTTPS|g.live.com/1rewlive5skydrive/*|
+|||HTTP|msagfx.live.com|
+|||HTTPS|oneclient.sfx.ms|
+|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)|
+|||HTTPS|cy2.settings.data.microsoft.com.akadns.net|
+|||HTTPS|settings.data.microsoft.com|
+|||HTTPS|settings-win.data.microsoft.com|
+|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)|
+|||HTTPS|browser.pipe.aria.microsoft.com|
+|||HTTP|config.edge.skype.com|
+|||HTTP|s2s.config.skype.com|
+|||HTTPS|skypeecs-prod-usw-0-b.cloudapp.net|
+|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device will not use Cloud-based Protection.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)|
+|||HTTPS|wdcp.microsoft.com|
+|||HTTPS|definitionupdates.microsoft.com|
+|||HTTPS|go.microsoft.com|
+||The following endpoints are used for Windows Defender Smartscreen reporting and notifications. If you turn off traffic for these endpoints, Smartscreen notifications will not appear.|HTTPS|*smartscreen.microsoft.com|
+|||HTTPS|smartscreen-sn3p.smartscreen.microsoft.com|
+|||HTTPS|unitedstates.smartscreen-prod.microsoft.com|
+|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see Windows Spotlight.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)|
+|||TLS v1.2|*.search.msn.com|
+|||HTTPS|arc.msn.com|
+|||HTTPS|g.msn.com*|
+|||HTTPS|query.prod.cms.rt.microsoft.com|
+|||HTTPS|ris.api.iris.microsoft.com|
+|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)|
+|||HTTPS|*.prod.do.dsp.mp.microsoft.com|
+|||HTTP|cs9.wac.phicdn.net|
+|||HTTP|emdl.ws.microsoft.com|
+||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device will not be able to download updates for the operating system.|HTTP|*.dl.delivery.mp.microsoft.com|
+|||HTTP|*.windowsupdate.com|
+||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|HTTPS|*.delivery.mp.microsoft.com|
+|||HTTPS|*.update.microsoft.com|
+||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly.|HTTPS|tsfe.trafficshaping.dsp.mp.microsoft.com|
+
+## Other Windows 10 editions
+
+To view endpoints for other versions of Windows 10 Enterprise, see:
+- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md)
+- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md)
+- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md)
+
+To view endpoints for non-Enterprise Windows 10 editions, see:
+- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md)
+- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md)
+- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md)
+
+
+## Related links
+
+- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US)
+- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/intune/get-started/network-infrastructure-requirements-for-microsoft-intune)
+
+
diff --git a/windows/privacy/windows-10-and-privacy-compliance.md b/windows/privacy/windows-10-and-privacy-compliance.md
new file mode 100644
index 0000000000..50ebcf0f14
--- /dev/null
+++ b/windows/privacy/windows-10-and-privacy-compliance.md
@@ -0,0 +1,202 @@
+---
+title: Windows 10 & Privacy Compliance Guide
+description: This article provides information to help IT and compliance professionals understand the personal data policies as related to Windows 10.
+keywords: privacy, GDPR, compliance
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: high
+audience: ITPro
+author: brianlic-msft
+ms.author: brianlic
+manager: dansimp
+ms.collection: M365-security-compliance
+ms.topic: article
+ms.date: 05/21/2019
+---
+
+# Windows 10 & Privacy Compliance:
                                  A Guide for IT and Compliance Professionals
+
+Applies to:
+- Windows 10, version 1809 and newer
+- Windows 10 Team Edition, version 1703 for Surface Hub
+- Windows Server 2016 and newer
+- Windows Analytics
+
+For more information about the GDPR, see:
+* [Windows and the GDPR: Information for IT Administrators and Decision Makers](gdpr-it-guidance.md)
+* [Microsoft GDPR Overview](https://aka.ms/GDPROverview)
+* [Microsoft Trust Center FAQs about the GDPR](https://aka.ms/gdpr-faq)
+* [Microsoft Service Trust Portal (STP)](https://aka.ms/stp)
+* [Get Started: Support for GDPR Accountability](https://servicetrust.microsoft.com/ViewPage/GDPRGetStarted)
+
+## Overview
+
+At Microsoft, we are deeply committed to data privacy across all our products and services. With this guide, we provide IT and compliance professionals with data privacy considerations for Windows 10.
+
+Microsoft collects data through multiple interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, secure, and improve Windows 10 services. To help users and organizations control the collection of personal data, Windows 10 provides comprehensive transparency features, settings choices, controls and support for data subject requests, all of which are detailed in this guide.
+
+This information allows IT and compliance professionals work together to better manage personal data privacy considerations and related regulations, such as the General Data Protection Regulation (GDPR).
+
+
+## 1. Windows 10 data collection transparency
+
+Transparency is an important part of the data collection process in Windows 10. Comprehensive information about the features and processes used to collect data is available to users and administrators directly within Windows, both during and after device set up.
+
+If interested in understanding how to manage settings related to data collection skip to the next section [Windows 10 data collection management](#12-data-collection-monitoring).
+
+
+### 1.1 Device set up experience and support for layered transparency
+
+When setting up a device, a user can configure their privacy settings. Those privacy settings are key in determining the amount of personal data collected. For each privacy setting, the user is provided information about the setting along with the links to supporting information. This information explains what data is collected, how the data is used and how to manage the setting after the device setup is complete. The user can also review the privacy statement when connected to the network during this portion of setup. A brief overview of the set up experience for privacy settings are described in [this blog](https://blogs.windows.com/windowsexperience/2018/03/06/windows-insiders-get-first-look-new-privacy-screen-settings-layout-coming-windows-10/#uCC2bKYP8M5BqrDP.97).
+
+The following table provides an overview of the Windows 10 privacy settings presented during the device setup experience that involve processing personal data and where to find additional information.
+
+> [!NOTE]
+> This table is limited to the privacy settings that are available as part of setting up a Windows 10 device (Windows 10, version 1809 and later). For the full list of settings that involve data collection, see: [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
+
+| Feature/Setting | Description | Supporting Content | Privacy Statement |
+| --- | --- | --- | --- |
+| Diagnostic Data | 
                                  Microsoft uses diagnostic data to: keep Windows secure and up to date, troubleshoot problems, and make product improvements as described in more detail below. Regardless of level selected, the device will be just as secure and will operate normally. This data is collected by Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device, and understand the device's service issues and use patterns.
                                  Diagnostic data is categorized into four levels:
                                  • **Security**
                                    Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender.
                                  • **Basic**
                                    Basic device info, including: quality-related data, app compatibility, and data from the Security level.
                                  • **Enhanced**
                                    Additional insights, including: how Windows, Windows Server, System Center, and apps are used; how they perform; advanced reliability data; and data from both the Basic and the Security levels.
                                  • **Full**
                                    Information about the websites you browse, how you use apps and features; plus additional information about device health, device activity, enhanced error reporting, and data from Enhanced, Basic and the Security levels.
                                    At Full, Microsoft also collects the memory state of your device when a system or app crash occurs (which may unintentionally include parts of a file you were using when a problem occurred).
                                   | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy)

                                  [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
+| Inking and typing diagnostics | Microsoft collects inking and typing data to improve the language recognition and suggestion capabilities of apps and services running on Windows. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
+| Speech | Use your voice for dictation and to talk to Cortana and other apps that use Windows cloud-based speech recognition. Microsoft collects voice data to help improve speech services. | [Learn more](https://support.microsoft.com/help/4468250/speech-inking-typing-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainspeechinkingtypingmodule) |
+| Location | Get location-based experiences like directions and weather. Let Windows and apps request your location and allow Microsoft to use your location data to improve location services. | [Learn more](https://support.microsoft.com/help/4468240/windows-10-location-service-and-privacy-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) |
+| Find my device | Use your device’s location data to help you find your device if you lose it. | [Learn more](https://support.microsoft.com/help/11579/microsoft-account-find-and-lock-lost-windows-device) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainlocationservicesmotionsensingmodule) |
+| Tailored Experiences | Let Microsoft offer you tailored experiences based on the diagnostic data you have chosen (Security, Basic, Enhanced, or Full). Tailored experiences mean personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. | [Learn more](https://support.microsoft.com/help/4468236/diagnostics-feedback-and-privacy-in-windows-10-microsoft-privacy) | [Privacy Statement](https://privacy.microsoft.com/privacystatement#maindiagnosticsmodule) |
+| Advertising Id | Apps can use advertising ID to provide more personalized advertising in accordance with the privacy policy of the app provider. | [Learn more](https://support.microsoft.com/help/4459081/general-privacy-settings-in-windows-10-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainadvertisingidmodule) |
+| Activity History/Timeline – Cloud Sync | If you want timeline and other Windows features to help you continue what you were doing, even when you switch devices, send Microsoft your activity history, which includes info about websites you browse and how you use apps and services. | [Learn more](https://support.microsoft.com/help/4468227/windows-10-activity-history-and-your-privacy-microsoft-privacy) | [Privacy statement](https://privacy.microsoft.com/privacystatement#mainactivityhistorymodule) |
+| Cortana | 
                                  Cortana is Microsoft’s personal digital assistant, which helps busy people get things done, even while they’re at work. Cortana on Windows is available in [certain regions and languages](https://support.microsoft.com/instantanswers/557b5e0e-0eb0-44db-87d6-5e5db6f9c5b0/cortana-s-regions-and-languages). Cortana learns from certain data about the user, such as location, searches, calendar, contacts, voice input, speech patterns, email, content and communication history from text messages. In Microsoft Edge, Cortana uses browsing history. The user is in control of how much data is shared.

                                  Cortana has powerful configuration options, specifically optimized for a business. By signing in with an Azure Active Directory (Azure AD) account, enterprise users can give Cortana access to their enterprise/work identity, while getting all the functionality Cortana provides to them outside of work.
                                   | [Learn more](https://support.microsoft.com/help/4468233/cortana-and-privacy-microsoft-privacy)

                                  [Cortana integration in your business or enterprise](https://docs.microsoft.com/windows/configuration/cortana-at-work/cortana-at-work-overview) | [Privacy statement](https://privacy.microsoft.com/privacystatement#maincortanamodule) |
+
+### 1.2 Data collection monitoring
+
+The Diagnostic Data Viewer (DDV) is a Windows app (available in Windows 10, version 1803 or later) that lets a user review the Windows diagnostic data that is being collected on their Windows 10 device and sent to Microsoft. DDV groups the information into simple categories based on how it is used by Microsoft. The [DDV Overview](diagnostic-data-viewer-overview.md) provides information on how users can get started on using this tool.
+
+An administrator can also use the Diagnostic Data Viewer for PowerShell module to view the diagnostic data collected from the device instead of using the Diagnostic Data Viewer UI. The [Diagnostic Data Viewer for PowerShell Overview](microsoft-diagnosticdataviewer.md) provides further information.
+
+
+## 2. Windows 10 data collection management
+
+Windows 10 provides the ability to manage privacy settings through several different methods. Users can change their privacy settings using the Windows 10 settings (**Start** > **Settings** > **Privacy**). The organization can also manage the privacy settings using group policy or mobile device management (MDM). The following sections provide an overview on how to manage the privacy settings previously discussed in this article.
+
+### 2.1 Privacy setting options for users
+
+Once a Windows 10 device is set up, a user can manage data collection settings by going to **Start** > **Settings** > **Privacy**. IT administrators can control privacy settings via setting policy on the device (see Section 2.2 below). If this is the case, the user will see an alert that says ‘Some settings are hidden or managed by your organization’ when they navigate to **Start** > **Settings** > **Privacy**. Meaning the user can only change settings in accordance with the policies that the administrator has applied to the device.
+
+### 2.2 Privacy setting controls for administrators
+
+The IT department can configure and control privacy settings across their organization by using Group Policy, registry, or Mobile Device Management (MDM) settings.
+
+The following table provides an overview of the privacy settings discussed earlier in this document with details on how to configure these via policy. The table also provides information on what the default value would be for each of these privacy settings if you do not manage the setting via policy and suppress the Out-of-box Experience (OOBE) during device setup. For an IT administrator interested in minimizing data, we also provide the recommended value to set.
+
+> [!NOTE]
+> This is not a complete list of settings that involve connecting to Microsoft services. To see a more detailed list, please refer to Manage connections from [Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md).
+
+| Feature/Setting | GP/MDM Documentation | Default State if the Setup experience is suppressed | State to stop/minimize data collection |
+|---|---|---|---|
+| [Speech](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-speech) | Group Policy:
                                  **Computer Configuration** > **Control Panel** > **Regional and Language Options** > **Allow users to enable online speech recognition services**

                                  MDM: [Privacy/AllowInputPersonalization](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-allowinputpersonalization) | Off | Off |
+| [Location](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-location) | Group Policy:
                                  **Computer Configuration** > **Windows Components** > **App Privacy** > **Let Windows apps access location**

                                  MDM: [Privacy/LetAppsAccessLocation](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccesslocation) | Off (Windows 10, version 1903 and later) | Off |
+| [Find my device](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#find-my-device) | Group Policy:
                                  **Computer Configuration** > **Windows Components** > **Find My Device** > **Turn On/Off Find My Device**

                                  MDM: [Experience/AllFindMyDevice](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowfindmydevice) | Off | Off |
+| [Diagnostic Data](configure-windows-diagnostic-data-in-your-organization.md#enterprise-management) | Group Policy:
                                  **Computer Configuration** > **Windows Components** > **Data Collection and Preview Builds** > **Allow Telemetry**

                                  MDM: [System/AllowTelemetry](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-system#system-allowtelemetry) | Desktop SKUs:
                                  Basic (Windows 10, version 1903 and later)

                                  Server SKUs:
                                  Enhanced | Security and block endpoints | 
+| [Inking and typing diagnostics](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-ink) | Group Policy:
                                  **Computer Configuration** > **Windows Components** > **Text Input** > **Improve inking and typing recognition**

                                  MDM: [TextInput/AllowLinguisticDataCollection](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-textinput#textinput-allowlinguisticdatacollection) | Off (Windows 10, version 1809 and later) | Off | 
+| Tailored Experiences | Group Policy:
                                  **User Configuration** > **Windows Components** > **Cloud Content** > **Do not use diagnostic data for tailored experiences**

                                  MDM: Link TBD | Off | Off | 
+| Advertising ID | Group Policy:
                                  **Configuration** > **System** > **User Profile** > **Turn off the advertising Id**

                                  MDM: [Privacy/DisableAdvertisingId](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-disableadvertisingid) | Off | Off | 
+| Activity History/Timeline – Cloud Sync | Group Policy:
                                  **Computer Configuration** > **System** > **OS Policies** > **Allow upload of User Activities**

                                  MDM: [Privacy/EnableActivityFeed](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-privacy#privacy-enableactivityfeed) | Off | Off | 
+| [Cortana](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#2-cortana-and-search) | Group Policy:
                                  **Computer Configuration** > **Windows Components** > **Search** > **Allow Cortana**

                                  MDM: [Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | Off | Off | 
+
+### 2.3 Guidance for configuration options
+
+This section provides general details and links to more detailed information as well as instructions for IT administrators and compliance professional. These instructions allow IT admins and compliance pros to manage the device compliance. This information includes details about setting up a device, to configuring the device’s settings after setup is completed to minimize data collected and drive privacy related user experiences.
+
+#### 2.3.1 Managing the device setup experience
+
+Windows deployment can be configured using several different methods, which provide an administrator with options to control: how a device is set up, what’s enabled by default, and what the user is able to change on the system after they log on.
+
+The [Deploy and update Windows 10](https://docs.microsoft.com/windows/deployment/) section of the Windows IT Pro Center provides an overview of the different options.
+
+#### 2.3.2 Managing connections from Windows components to Microsoft services
+
+IT administrators can manage the data sent from their organization to Microsoft by configuring settings associated with the functionality provided by these Windows components.
+
+See [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services) for more details, including the different methods available on how to configure each setting, the impact to functionality and which versions of Windows that are applicable.
+
+#### 2.3.3 Managing Windows 10 connections
+
+Some Windows components, apps, and related services transfer data to Microsoft network endpoints. An administrator may want to block these endpoints as an additional measure of ensuring privacy compliance within their organization.
+
+[Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) provides a list of endpoints for the latest Windows 10 release, along with the functionality that would be impacted. Details for additional Windows versions can be found on the [Windows Privacy site](https://docs.microsoft.com/windows/privacy/) under the “Manage Windows 10 connection endpoints” section of the left-hand navigation menu.
+
+#### 2.3.4 Limited functionality baseline
+
+An organization may want to further minimize the amount of data shared with Microsoft or apps by managing the connections and configuring additional settings on their devices. Similar to [Security baselines](https://docs.microsoft.com/windows/security/threat-protection/windows-security-baselines), we have a limited functionality baseline-focused configuring settings to minimize the data shared, however this comes with some potential impact to functionality on the device. The [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) article provides details on how to apply the baseline, along with the full list of settings covered in the baseline and the functionality that would be impacted. Administrators who don’t want to apply the baseline can still find details on how to configure each setting individually to find the right balance between data sharing and impact to functionality for their organization.
+
+#### 2.3.5 Diagnostic data: Managing notifications for change of level at logon
+
+Windows 10, version 1803, and later provides users with a notification during sign in about changes to the diagnostic data level on the device so they are aware of any changes where additional data may be collected. For instance, if the diagnostic level on the device is set to Basic and an administrator changes it to Full, users will be notified when they next sign in. The IT administrator can disable these notifications by setting Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in change notifications** or the MDM policy `ConfigureTelemetryOptInChangeNotification`.
+
+#### 2.3.6 Diagnostic data: Managing end user choice for changing the setting
+
+Windows 10, version 1803 and later, allows users to change their diagnostic data level to a lower setting than what their IT administrator has set. For instance, if the administrator has set the diagnostic data level to Enhanced or Full, a user can change the setting to Basic by going into **Settings** > **Privacy** > **Diagnostic & feedback**. The administrator can disable the user ability to change the setting via **Setting** > **Privacy** by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Configure telemetry opt-in setting user interface** or the MDM policy `ConfigureTelemetryOptInSettingsUx`.
+
+#### 2.3.7 Diagnostic data: Managing device-based data delete
+
+Windows 10, version 1809 and later, allows a user to delete diagnostic data collected from their device by going into **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. An IT administrator can also delete diagnostic data for a device using the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script.
+
+An administrator can disable a user’s ability to delete their device’s diagnostic data by setting the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds** > **Disable deleting diagnostic data** or the MDM policy `DisableDeviceDelete`.
+
+
+## 3. The process for exercising data subject rights
+
+This section discusses the different methods Microsoft provides for users and IT administrators to exercise data subject rights for data collected from a Windows 10 device.
+
+### 3.1 Delete
+
+Users can delete their device-based data by going to **Settings** > **Privacy** > **Diagnostic & feedback** and clicking the **Delete** button. Administrators can also use the [Clear-WindowsDiagnosticData](https://docs.microsoft.com/powershell/module/windowsdiagnosticdata/Clear-WindowsDiagnosticData?view=win10-ps) PowerShell cmdlet script.
+
+### 3.2 View
+
+The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides a view into the diagnostic data being collected from the Windows 10 device. IT administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script.
+
+### 3.3 Export
+
+The [Diagnostic Data Viewer (DDV)](diagnostic-data-viewer-overview.md) provides the ability to export the diagnostic data captured while the app is running, by clicking the Export data button in the top menu. IT administrators can also use the [Get-DiagnosticData](microsoft-diagnosticdataviewer.md#install-and-use-the-diagnostic-data-viewer-for-powershell) PowerShell cmdlet script.
+
+### 3.4 Devices connected to a Microsoft account
+
+If a user signs in to a Windows experience or app on their device with their Microsoft account (MSA), they can view, delete, and export data associated with their MSA on the [Privacy dashboard](https://account.microsoft.com/privacy).
+
+
+## 4. Cross-border data transfers
+
+Microsoft complies with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom, and Switzerland to the United States.
+
+Microsoft’s [Privacy Statement](https://privacy.microsoft.com/privacystatement#mainwherewestoreandprocessdatamodule) provides details on how we store and process personal data.
+
+
+## 5. Related Windows product considerations
+
+The following sections provide details about how privacy data is collected and managed across related Windows products.
+
+### 5.1 Windows Server 2016 and 2019
+
+Windows Server follows the same mechanisms as Windows 10 for handling of personal data. There are some differences regarding [diagnostic default settings for Windows Server](https://microsoft-my.sharepoint.com/personal/v-colinm_microsoft_com/Documents/WINDOWS%20PRIVACY/Windows%20diagnostic%20data%20and%20Windows%20Server).
+
+### 5.2 Surface Hub
+
+Surface Hub is a shared device used within an organization. The device identifier collected as part of diagnostic data is not connected to an individual user. For removing Windows diagnostic data sent to Microsoft for a Surface Hub, Microsoft created the Surface Hub Delete Diagnostic Data tool available in the Microsoft Store.
+
+For more details, see [Windows 10 Team Edition, Version 1703 for Surface Hub](gdpr-it-guidance.md#windows-10-team-edition-version-1703-for-surface-hub).
+
+### 5.3 Windows 10 Analytics
+
+[Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-overview) is a set of solutions for Azure Portal that provide you with extensive data about the state of devices in your deployment. There are currently three solutions which you can use singly or in any combination: Device Health, Update Compliance, and Upgrade Readiness. Windows Analytics is a separate offering from Windows 10 and is dependent on enabling a minimum set of data collection on the device to function.
+
+For more details, see the [Windows Analytics overview page](https://docs.microsoft.com/windows/deployment/update/windows-analytics-overview).
+
+
+## Additional Resources
+
+* [Microsoft Trust Center: GDPR Overview](https://www.microsoft.com/trustcenter/privacy/gdpr/gdpr-overview)
+* [Microsoft Trust Center: Privacy at Microsoft](https://www.microsoft.com/TrustCenter/Privacy/privacy-overview)
+* [Windows IT Pro Docs](https://docs.microsoft.com/windows/#pivot=it-pro)
+
diff --git a/windows/privacy/windows-diagnostic-data-1703.md b/windows/privacy/windows-diagnostic-data-1703.md
index de1f934651..73ccd75c12 100644
--- a/windows/privacy/windows-diagnostic-data-1703.md
+++ b/windows/privacy/windows-diagnostic-data-1703.md
@@ -7,12 +7,13 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.localizationpriority: high
 audience: ITPro
-author: danihalfin
-ms.author: daniha
+author: dansimp
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
 ms.date: 11/28/2017
+ms.reviewer: 
 ---
 
 # Windows 10 diagnostic data for the Full diagnostic data level
@@ -20,7 +21,7 @@ ms.date: 11/28/2017
 **Applies to:**
 - Windows 10, version 1703
 
-Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on “tailored experiences”, can be used to provide more relevant tips and recommendations to tailor Microsoft products to the user’s needs.   This article describes all types diagnostic data collected by Windows at the Full diagnostic data level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 Basic level diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md).
+Microsoft collects Windows diagnostic data to keep Windows up-to-date, secure, and operating properly. It also helps us improve Windows and, for users who have turned on “tailored experiences”, can be used to provide more relevant tips and recommendations to tailor Microsoft products to the user’s needs.   This article describes all types diagnostic data collected by Windows at the Full diagnostic data level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1709 Basic level diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709) and [Windows 10, version 1703 Basic level diagnostic events and fields](https://docs.microsoft.com/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703).
 
 The data covered in this article is grouped into the following categories:
 
@@ -32,7 +33,7 @@ The data covered in this article is grouped into the following categories:
 -   Browsing History data
 -   Inking, Typing, and Speech Utterance data
 
-> [!NOTE]  
+> [!NOTE]
 > The majority of diagnostic data falls into the first four categories.
 
 ## Common data
@@ -106,4 +107,4 @@ This type of data gathers details about the voice, inking, and typing input feat
 
 | Category Name | Description and Examples |
 | - | - |
-| Voice, inking, and typing | Information about voice, inking and typing features such as:
                                  • Type of pen used (highlighter, ball point, pencil), pen color, stroke height and width, and how long it is used
                                  • Pen gestures (click, double click, pan, zoom, rotate)
                                  • Palm Touch x,y coordinates
                                  • Input latency, missed pen signals, number of frames, strokes, first frame commit time, sample rate
                                  • Ink strokes written, text before and after the ink insertion point, recognized text entered, Input language - processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values) which could be used to reconstruct the original content or associate the input to the user.
                                  • Text input from Windows Mobile on-screen keyboards except from password fields and private sessions - processed to remove identifiers, sequencing information, and other data (such as email addresses, and numeric values) which could be used to reconstruct the original content or associate the input to the user.
                                  • Text of speech recognition results -- result codes and recognized text
                                  • Language and model of the recognizer, System Speech language
                                  • App ID using speech features
                                  • Whether user is known to be a child
                                  • Confidence and Success/Failure of speech recognition
                                   |
\ No newline at end of file
+| Voice, inking, and typing | Information about voice, inking and typing features such as:
                                  • Type of pen used (highlighter, ball point, pencil), pen color, stroke height and width, and how long it is used
                                  • Pen gestures (click, double click, pan, zoom, rotate)
                                  • Palm Touch x,y coordinates
                                  • Input latency, missed pen signals, number of frames, strokes, first frame commit time, sample rate
                                  • Ink strokes written, text before and after the ink insertion point, recognized text entered, Input language - processed to remove identifiers, sequencing information, and other data (such as email addresses and numeric values) which could be used to reconstruct the original content or associate the input to the user.
                                  • Text input from Windows Mobile on-screen keyboards except from password fields and private sessions - processed to remove identifiers, sequencing information, and other data (such as email addresses, and numeric values) which could be used to reconstruct the original content or associate the input to the user.
                                  • Text of speech recognition results -- result codes and recognized text
                                  • Language and model of the recognizer, System Speech language
                                  • App ID using speech features
                                  • Whether user is known to be a child
                                  • Confidence and Success/Failure of speech recognition
                                   |
diff --git a/windows/privacy/windows-diagnostic-data.md b/windows/privacy/windows-diagnostic-data.md
index 2b73716da2..85c77ad883 100644
--- a/windows/privacy/windows-diagnostic-data.md
+++ b/windows/privacy/windows-diagnostic-data.md
@@ -7,28 +7,31 @@ ms.mktglfcycl: manage
 ms.sitesec: library
 ms.localizationpriority: high
 audience: ITPro
-author: danihalfin
-ms.author: daniha
+author: dansimp
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
-ms.date: 03/13/2018
+ms.date: 12/04/2019
+ms.reviewer: 
 ---
 
 # Windows 10, version 1709 and newer diagnostic data for the Full level
 
 Applies to:
+- Windows 10, version 1909
+- Windows 10, version 1903
 - Windows 10, version 1809
 - Windows 10, version 1803
 - Windows 10, version 1709
 
-Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1803 Basic level diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields).
+Microsoft uses Windows diagnostic data to keep Windows secure and up-to-date, troubleshoot problems, and make product improvements. For users who have turned on "Tailored experiences", it can also be used to offer you personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs. This article describes all types of diagnostic data collected by Windows at the Full level (inclusive of data collected at Basic), with comprehensive examples of data we collect per each type. For additional, detailed technical descriptions of Basic data items, see [Windows 10, version 1903 Basic level diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields).
 
 In addition, this article provides references to equivalent definitions for the data types and examples from [ISO/IEC 19944:2017 Information technology -- Cloud computing -- Cloud services and devices: Data flow, data categories and data use](https://www.iso.org/standard/66674.html). Each data type also has a Data Use statement, for diagnostics and for Tailored experiences on the device, using the terms as defined by the standard. These Data Use statements define the purposes for which Microsoft processes each type of Windows diagnostic data, using a uniform set of definitions referenced at the end of this document and based on the ISO standard. Reference to the ISO standard provides additional clarity about the information collected, and allows easy comparison with other services or guidance that also references the standard.
 
 The data covered in this article is grouped into the following types:
 
-- Common data (diagnostic header information)
+- Common data extensions (diagnostic header information)
 - Device, Connectivity, and Configuration data
 - Product and Service Usage data
 - Product and Service Performance data
@@ -36,15 +39,15 @@ The data covered in this article is grouped into the following types:
 - Browsing History data
 - Inking, Typing, and Speech Utterance data
 
-## Common data
+## Common data extensions
 Most diagnostic events contain a header of common data. In each example, the info in parentheses provides the equivalent definition for ISO/IEC 19944:2017.
 
-**Data Use for Common data**
+**Data Use for Common data extensions**
 Header data supports the use of data associated with all diagnostic events. Therefore, Common data is used to [provide](#provide) Windows 10, and may be used to [improve](#improve), [personalize](#personalize), [recommend](#recommend), [offer](#offer), or [promote](#promote) Microsoft and third-party products and services, depending on the uses described in the **Data Use** statements for each data category.
 
-### Data Description for Common data type
+### Data Description for Common data extensions type
 
-#### Common data type
+#### Common data extensions type
 
 Information that is added to most diagnostic events, if relevant and available:
 
@@ -246,7 +249,7 @@ This type of data includes details about the health of the device, operating sys
 [Pseudonymized](#pseudo) Product and Service Performance data from Windows 10 is used by Microsoft to [provide](#provide) and [improve](#improve) Windows 10 and related Microsoft product and services. For example:
 
 - Data about the reliability of content that appears in the [Windows Spotlight](https://docs.microsoft.com/windows/configuration/windows-spotlight) (rotating lock screen images) is used for Windows Spotlight reliability investigations.
-- Timing data about how quickly Cortana responds to voice commands is used to improve Cortana listening peformance.
+- Timing data about how quickly Cortana responds to voice commands is used to improve Cortana listening performance.
 - Timing data about how quickly the facial recognition feature starts up and finishes is used to improve facial recognition performance.
 - Data about when an Application Window fails to appear is used to investigate issues with Application Window reliability and performance.
 
@@ -506,6 +509,6 @@ Use of the specified data categories to promote a product or service in or on a
 
 Here are the list of data identification qualifiers and the ISO/IEC 19944:2017 reference:
 
-- **Pseudonymized Data** 8.3.3 Pseudonymized data. Microsoft usage notes are as defined.
-- **Anonymized Data** 8.3.5 Anonymized data. Microsoft usage notes are as defined.
-- **Aggregated Data** 8.3.6 Aggregated data. Microsoft usage notes are as defined.
\ No newline at end of file
+- **Pseudonymized Data** 8.3.3 Pseudonymized data. Microsoft usage notes are as defined.
+- **Anonymized Data** 8.3.5 Anonymized data. Microsoft usage notes are as defined.
+- **Aggregated Data** 8.3.6 Aggregated data. Microsoft usage notes are as defined.
diff --git a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md
index 58b39b8a65..29accd3e32 100644
--- a/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md
+++ b/windows/privacy/windows-endpoints-1709-non-enterprise-editions.md
@@ -1,294 +1,295 @@
----
-title: Windows 10, version 1709, connection endpoints for non-Enterprise editions
-description: Explains what Windows 10 endpoints are used in non-Enterprise editions.
-keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-ms.localizationpriority: high
-audience: ITPro
-author: danihalfin
-ms.author: daniha
-manager: dansimp
-ms.collection: M365-security-compliance
-ms.topic: article
-ms.date: 6/26/2018
----
-# Windows 10, version 1709, connection endpoints for non-Enterprise editions
-
- **Applies to**
-
-- Windows 10 Home, version 1709
-- Windows 10 Professional, version 1709
-- Windows 10 Education, version 1709
-
-In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-endpoints.md), the following endpoints are available on other editions of Windows 10, version 1709.
-
-We used the following methodology to derive these network endpoints:
-
-1.	Set up the latest version of Windows 10 on a test virtual machine using the default settings.
-2.	Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
-3.	Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.
-4.	Compile reports on traffic going to public IP addresses.
-5.  The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory.
-6.  All traffic was captured in our lab using a IPV4 network.  Therefore no IPV6 traffic is reported here. 
-
-> [!NOTE]
-> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time.
-
-## Windows 10 Home
-
-| **Destination** | **Protocol** | **Description** |
-| --- | --- | --- |
-| *.tlu.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
-| *.wac.phicdn.net | HTTP | Used by the Verizon Content Delivery Network to perform Windows updates. |
-| *.1.msftsrvcs.vo.llnwi.net | HTTP | Used for Windows Update downloads of apps and OS updates. |
-| *.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. |
-| *.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
-| *.dscd.akamai.net | HTTP | Used to download content. |
-| *.dspg.akamaiedge.net | HTTP | Used to check for updates to maps that have been downloaded for offline use. |
-| *.hwcdn.net | HTTP | Used by the Highwinds Content Delivery Network to perform Windows updates. |
-| *.m1-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
-| *.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
-| *.wac.edgecastcdn.net | TLSv1.2 | Used by the Verizon Content Delivery Network to perform Windows updates. |
-| *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). |
-| *prod.do.dsp.mp.microsoft.com | TLSv1.2\/HTTPS | Used for Windows Update downloads of apps and OS updates. |
-| .g.akamaiedge.net | HTTP | Used to check for updates to maps that have been downloaded for offline use. |
-| 2.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. |
-| 2.tlu.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. |
-| arc.msn.com | HTTPS | Used to retrieve Windows Spotlight metadata. |
-| arc.msn.com.nsatc.net | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
-| a-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
-| au.download.windowsupdate.com | HTTP | Used to download operating system patches and updates. |
-| b-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
-| candycrushsoda.king.com | TLSv1.2 | Used for Candy Crush Saga updates. |
-| cdn.content.prod.cms.msn.com | HTTP | Used to retrieve Windows Spotlight metadata. |
-| cdn.onenote.net | HTTP | Used for OneNote Live Tile. |
-| client-office365-tas.msedge.net | HTTP | Used to connect to the Office 365 portal’s shared infrastructure, including Office Online. |
-| config.edge.skype.com | HTTP | Used to retrieve Skype configuration values. |
-| ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. |
-| cy2.displaycatalog.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
-| cy2.licensing.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
-| cy2.purchase.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
-| cy2.settings.data.microsoft.com.akadns.net | TLSv1.2 | Used as a way for apps to dynamically update their configuration. |
-| cy2.vortex.data.microsoft.com.akadns.net | TLSv1.2 | Used to retrieve Windows Insider Preview builds. |
-| definitionupdates.microsoft.com | HTTPS | Used for Windows Defender definition updates. |
-| displaycatalog.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
-| dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
-| dual-a-0001.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
-| fe2.update.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. |
-| fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
-| g.live.com/1rewlive5skydrive/ | HTTPS | Used by a redirection service to automatically update URLs. |
-| g.msn.com.nsatc.net | HTTP | Used to retrieve Windows Spotlight metadata. |
-| geo-prod.do.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
-| go.microsoft.com | HTTPS | Used by a redirection service to automatically update URLs. |
-| img-prod-cms-rt-microsoft-com.akamaized.net | HTTPS | Used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). |
-| *.login.msa.akadns6.net | TLSv1.2 | Used for Microsoft accounts to sign in. |
-| licensing.mp.microsoft.com | HTTPS | Used for online activation and some app licensing. |
-| location-inference-westus.cloudapp.net | TLSv1.2 | Used for location data. |
-| login.live.com | HTTPS | Used to authenticate a device. |
-| mediaredirect.microsoft.com | HTTPS | Used by the Groove Music app to update HTTP handler status. |
-| modern.watson.data.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
-| msftsrvcs.vo.llnwd.net | HTTP | Enables connections to Windows Update. |
-| msnbot-*.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
-| oem.twimg.com | HTTPS | Used for the Twitter Live Tile. |
-| oneclient.sfx.ms | HTTPS | Used by OneDrive for Business to download and verify app updates. |
-| peer4-wst.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
-| pti.store.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
-| pti.store.microsoft.com.unistore.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
-| purchase.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
-| ris.api.iris.microsoft.com.akadns.net | TLSv1.2\/HTTPS | Used to retrieve Windows Spotlight metadata. |
-| settings-win.data.microsoft.com | HTTPS | Used for Windows apps to dynamically update their configuration. |
-| sls.update.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update. |
-| star-mini.c10r.facebook.com | TLSv1.2 | Used for the Facebook Live Tile. |
-| storecatalogrevocation.storequality.microsoft.com | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store. |
-| storeedgefd.dsx.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
-| store-images.s-microsoft.com | HTTP | Used to get images that are used for Microsoft Store suggestions. |
-| tile-service.weather.microsoft.com | HTTP | Used to download updates to the Weather app Live Tile. |
-| tsfe.trafficshaping.dsp.mp.microsoft.com | TLSv1.2 | Used for content regulation. |
-| v10.vortex-win.data.microsoft.com | HTTPS | Used to retrieve Windows Insider Preview builds. |
-| wallet.microsoft.com | HTTPS | Used by the Microsoft Wallet app. |
-| wallet-frontend-prod-westus.cloudapp.net | TLSv1.2 | Used by the Microsoft Wallet app. |
-| *.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. |
-| ceuswatcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| ceuswatcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| eaus2watcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| eaus2watcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| weus2watcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| weus2watcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| wdcp.microsoft.akadns.net | TLSv1.2 | Used for Windows Defender when Cloud-based Protection is enabled. |
-| wildcard.twimg.com | TLSv1.2 | Used for the Twitter Live Tile. |
-| www.bing.com | HTTP | Used for updates for Cortana, apps, and Live Tiles. |
-| www.facebook.com | HTTPS | Used for the Facebook Live Tile. |
-| [www.microsoft.com](https://www.microsoft.com/) | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
-
-## Windows 10 Pro
-
-| **Destination** | **Protocol** | **Description** |
-| --- | --- | --- |
-| *.*.akamai.net | HTTP | Used to download content. |
-| *.*.akamaiedge.net | TLSv1.2\/HTTP | Used to check for updates to maps that have been downloaded for offline use. |
-| *.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
-| *.blob.core.windows.net | HTTPS | Used by Windows Update to update words used for language input methods. |
-| *.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. |
-| *.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. |
-| *.dspb.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
-| *.dspg.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
-| *.e-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
-| *.login.msa.akadns6.net | TLSv1.2 | Used for Microsoft accounts to sign in. |
-| *.s-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
-| *.telecommand.telemetry.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
-| *.wac.edgecastcdn.net | TLSv1.2 | Used by the Verizon Content Delivery Network to perform Windows updates. |
-| *.wac.phicdn.net | HTTP | Used by the Verizon Content Delivery Network to perform Windows updates. |
-| *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). |
-| *prod.do.dsp.mp.microsoft.com | TLSv1.2\/HTTPS | Used for Windows Update downloads of apps and OS updates. |
-| 3.dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
-| 3.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
-| 3.tlu.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. |
-| 3.tlu.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
-| arc.msn.com | HTTPS | Used to retrieve Windows Spotlight metadata. |
-| arc.msn.com.nsatc.net | TLSv1.3 | Used to retrieve Windows Spotlight metadata. |
-| au.download.windowsupdate.com | HTTPS | Used to download operating system patches and updates. |
-| b-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
-| candycrushsoda.king.com | HTTPS | Used for Candy Crush Saga updates. |
-| cdn.content.prod.cms.msn.com | HTTP | Used to retrieve Windows Spotlight metadata. |
-| cdn.onenote.net | HTTPS | Used for OneNote Live Tile. |
-| client-office365-tas.msedge.net | HTTPS | Used to connect to the Office 365 portal’s shared infrastructure, including Office Online. |
-| config.edge.skype.com | HTTPS | Used to retrieve Skype configuration values. |
-| ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. |
-| cs12.wpc.v0cdn.net | HTTP | Used by the Verizon Content Delivery Network to download content for Windows upgrades with Wireless Planning and Coordination (WPC). |
-| cy2.displaycatalog.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
-| cy2.settings.data.microsoft.com.akadns.net | TLSv1.2 | Used as a way for apps to dynamically update their configuration. |
-| cy2.vortex.data.microsoft.com.akadns.net | TLSv1.2 | Used to retrieve Windows Insider Preview builds. |
-| definitionupdates.microsoft.com | HTTPS | Used for Windows Defender definition updates. |
-| displaycatalog.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
-| download.windowsupdate.com | HTTP | Enables connections to Windows Update. |
-| evoke-windowsservices-tas.msedge.net | HTTPS | Used by the Photos app to download configuration files, and to connect to the Office 365 portal’s shared infrastructure, including Office Online. |
-| fe2.update.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| fe3.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. |
-| fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
-| fs.microsoft.com | HTTPS | Used to download fonts on demand |
-| g.live.com | HTTP | Used by a redirection service to automatically update URLs. |
-| g.msn.com | HTTPS | Used to retrieve Windows Spotlight metadata. |
-| g.msn.com.nsatc.net | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
-| geo-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
-| geover-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
-| go.microsoft.com | HTTPS | Used by a redirection service to automatically update URLs. |
-| gpla1.wac.v2cdn.net | HTTP | Used for Baltimore CyberTrust Root traffic. . |
-| img-prod-cms-rt-microsoft-com.akamaized.net | HTTPS | Used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). |
-| licensing.mp.microsoft.com | HTTPS | Used for online activation and some app licensing. |
-| location-inference-westus.cloudapp.net | TLSv1.2 | Used for location data. |
-| login.live.com | HTTPS | Used to authenticate a device. |
-| l-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
-| mediaredirect.microsoft.com | HTTPS | Used by the Groove Music app to update HTTP handler status. |
-| modern.watson.data.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
-| msnbot-*.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
-| oem.twimg.com | HTTP | Used for the Twitter Live Tile. |
-| oneclient.sfx.ms | HTTP | Used by OneDrive for Business to download and verify app updates. |
-| peer1-wst.msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. |
-| pti.store.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
-| pti.store.microsoft.com.unistore.akadns.net | HTTPS | Used to communicate with Microsoft Store. |
-| purchase.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
-| ris.api.iris.microsoft.com | HTTPS | Used to retrieve Windows Spotlight metadata. |
-| settings-win.data.microsoft.com | HTTPS | Used for Windows apps to dynamically update their configuration. |
-| sls.update.microsoft.com | HTTPS | Enables connections to Windows Update. |
-| storecatalogrevocation.storequality.microsoft.com | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store. |
-| storeedgefd.dsx.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
-| store-images.s-microsoft.com | HTTPS | Used to get images that are used for Microsoft Store suggestions. |
-| store-images.s-microsoft.com | HTTPS | Used to get images that are used for Microsoft Store suggestions. |
-| *.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. |
-| ceuswatcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| ceuswatcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| eaus2watcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| eaus2watcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| weus2watcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| weus2watcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| tile-service.weather.microsoft.com | HTTP | Used to download updates to the Weather app Live Tile. |
-| tsfe.trafficshaping.dsp.mp.microsoft.com | HTTPS | Used for content regulation. |
-| v10.vortex-win.data.microsoft.com | HTTPS | Used to retrieve Windows Insider Preview builds. |
-| wallet.microsoft.com | HTTPS | Used by the Microsoft Wallet app. |
-| wdcp.microsoft.akadns.net | HTTPS | Used for Windows Defender when Cloud-based Protection is enabled. |
-| wildcard.twimg.com | TLSv1.2 | Used for the Twitter Live Tile. |
-| www.bing.com | TLSv1.2 | Used for updates for Cortana, apps, and Live Tiles. |
-| www.facebook.com | HTTPS | Used for the Facebook Live Tile. |
-| [www.microsoft.com](https://www.microsoft.com/) | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
-
-## Windows 10 Education
-
-| **Destination** | **Protocol** | **Description** |
-| --- | --- | --- |
-| *.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
-| *.b.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
-| *.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. |
-| *.dscb1.akamaiedge.net | HTTP | Used to check for updates to maps that have been downloaded for offline use. |
-| *.dscd.akamai.net | HTTP | Used to download content. |
-| *.dspb.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
-| *.dspw65.akamai.net | HTTP | Used to download content. |
-| *.e-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
-| *.g.akamai.net | HTTP | Used to download content. |
-| *.g.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
-| *.l.windowsupdate.com | HTTP | Enables connections to Windows Update. |
-| *.s-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
-| *.wac.phicdn.net | HTTP | Used by the Verizon Content Delivery Network to perform Windows updates |
-| *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). |
-| *prod.do.dsp.mp.microsoft.com | TLSv1.2 | Used for Windows Update downloads of apps and OS updates. |
-| *prod.do.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Used for Windows Update downloads of apps and OS updates. |
-| 3.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
-| 3.tlu.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
-| a-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
-| au.download.windowsupdate.com | HTTP | Used to download operating system patches and updates. |
-| cdn.onenote.net | HTTPS | Used for OneNote Live Tile. |
-| cds.*.hwcdn.net | HTTP | Used by the Highwinds Content Delivery Network to perform Windows updates. |
-| co4.telecommand.telemetry.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
-| config.edge.skype.com | HTTPS | Used to retrieve Skype configuration values. |
-| ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. |
-| cs12.wpc.v0cdn.net | HTTP | Used by the Verizon Content Delivery Network to download content for Windows upgrades with Wireless Planning and Coordination (WPC). |
-| cy2.displaycatalog.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
-| cy2.settings.data.microsoft.com.akadns.net | TLSv1.2 | Used as a way for apps to dynamically update their configuration. |
-| cy2.vortex.data.microsoft.com.akadns.net | TLSv1.2 | Used to retrieve Windows Insider Preview builds. |
-| dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
-| download.windowsupdate.com | HTTP | Enables connections to Windows Update. |
-| evoke-windowsservices-tas.msedge.net/ab | HTTPS | Used by the Photos app to download configuration files, and to connect to the Office 365 portal’s shared infrastructure, including Office Online. |
-| fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
-| fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. |
-| fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
-| g.msn.com.nsatc.net | TLSv1.2\/HTTP | Used to retrieve Windows Spotlight metadata. |
-| geo-prod.do.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
-| geover-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
-| go.microsoft.com | HTTPS | Used by a redirection service to automatically update URLs. |
-| gpla1.wac.v2cdn.net | HTTP | Used for Baltimore CyberTrust Root traffic. . |
-| ipv4.login.msa.akadns6.net | TLSv1.2 | Used for Microsoft accounts to sign in. |
-| licensing.mp.microsoft.com | HTTPS | Used for online activation and some app licensing. |
-| location-inference-westus.cloudapp.net | TLSv1.2 | Used for location data. |
-| login.live.com/* | HTTPS | Used to authenticate a device. |
-| l-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
-| mediaredirect.microsoft.com | HTTPS | Used by the Groove Music app to update HTTP handler status. |
-| modern.watson.data.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
-| msftconnecttest.com/* | HTTP | Used by Network Connection Status Indicator (NCSI) to detect Internet connectivity and corporate network connectivity status. |
-| msnbot-65-52-108-198.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
-| oneclient.sfx.ms | HTTP | Used by OneDrive for Business to download and verify app updates. |
-| peer1-wst.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
-| pti.store.microsoft.com.unistore.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
-| settings-win.data.microsoft.com | HTTPS | Used for Windows apps to dynamically update their configuration. |
-| sls.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
-| store-images.s-microsoft.com | HTTPS | Used to get images that are used for Microsoft Store suggestions. |
-| tile-service.weather.microsoft.com | HTTP | Used to download updates to the Weather app Live Tile. |
-| *.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. |
-| ceuswatcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| ceuswatcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| eaus2watcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| eaus2watcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| weus2watcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| weus2watcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
-| tsfe.trafficshaping.dsp.mp.microsoft.com | TLSv1.2 | Used for content regulation. |
-| wallet.microsoft.com | HTTPS | Used by the Microsoft Wallet app. |
-
-| wdcp.microsoft.akadns.net | TLSv1.2 | Used for Windows Defender when Cloud-based Protection is enabled. |
-| www.bing.com | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
\ No newline at end of file
+---
+title: Windows 10, version 1709, connection endpoints for non-Enterprise editions
+description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1709.
+keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.localizationpriority: high
+audience: ITPro
+author: dansimp
+ms.author: dansimp
+manager: dansimp
+ms.collection: M365-security-compliance
+ms.topic: article
+ms.date: 6/26/2018
+ms.reviewer: 
+---
+# Windows 10, version 1709, connection endpoints for non-Enterprise editions
+
+ **Applies to**
+
+- Windows 10 Home, version 1709
+- Windows 10 Professional, version 1709
+- Windows 10 Education, version 1709
+
+In addition to the endpoints listed for [Windows 10 Enterprise](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services), the following endpoints are available on other editions of Windows 10, version 1709.
+
+We used the following methodology to derive these network endpoints:
+
+1. Set up the latest version of Windows 10 on a test virtual machine using the default settings.
+2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
+3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.
+4. Compile reports on traffic going to public IP addresses.
+5.  The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory.
+6.  All traffic was captured in our lab using a IPV4 network.  Therefore no IPV6 traffic is reported here. 
+
+> [!NOTE]
+> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time.
+
+## Windows 10 Home
+
+| **Destination** | **Protocol** | **Description** |
+| --- | --- | --- |
+| *.tlu.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
+| *.wac.phicdn.net | HTTP | Used by the Verizon Content Delivery Network to perform Windows updates. |
+| *.1.msftsrvcs.vo.llnwi.net | HTTP | Used for Windows Update downloads of apps and OS updates. |
+| *.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. |
+| *.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
+| *.dscd.akamai.net | HTTP | Used to download content. |
+| *.dspg.akamaiedge.net | HTTP | Used to check for updates to maps that have been downloaded for offline use. |
+| *.hwcdn.net | HTTP | Used by the Highwinds Content Delivery Network to perform Windows updates. |
+| *.m1-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| *.wac.edgecastcdn.net | TLSv1.2 | Used by the Verizon Content Delivery Network to perform Windows updates. |
+| *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). |
+| *prod.do.dsp.mp.microsoft.com | TLSv1.2\/HTTPS | Used for Windows Update downloads of apps and OS updates. |
+| .g.akamaiedge.net | HTTP | Used to check for updates to maps that have been downloaded for offline use. |
+| 2.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. |
+| 2.tlu.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. |
+| arc.msn.com | HTTPS | Used to retrieve Windows Spotlight metadata. |
+| arc.msn.com.nsatc.net | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| a-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| au.download.windowsupdate.com | HTTP | Used to download operating system patches and updates. |
+| b-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| candycrushsoda.king.com | TLSv1.2 | Used for Candy Crush Saga updates. |
+| cdn.content.prod.cms.msn.com | HTTP | Used to retrieve Windows Spotlight metadata. |
+| cdn.onenote.net | HTTP | Used for OneNote Live Tile. |
+| client-office365-tas.msedge.net | HTTP | Used to connect to the Office 365 portal’s shared infrastructure, including Office. |
+| config.edge.skype.com | HTTP | Used to retrieve Skype configuration values. |
+| ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. |
+| cy2.displaycatalog.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| cy2.licensing.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| cy2.purchase.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| cy2.settings.data.microsoft.com.akadns.net | TLSv1.2 | Used as a way for apps to dynamically update their configuration. |
+| cy2.vortex.data.microsoft.com.akadns.net | TLSv1.2 | Used to retrieve Windows Insider Preview builds. |
+| definitionupdates.microsoft.com | HTTPS | Used for Windows Defender definition updates. |
+| displaycatalog.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| dual-a-0001.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| fe2.update.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. |
+| fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| g.live.com/1rewlive5skydrive/ | HTTPS | Used by a redirection service to automatically update URLs. |
+| g.msn.com.nsatc.net | HTTP | Used to retrieve Windows Spotlight metadata. |
+| geo-prod.do.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
+| go.microsoft.com | HTTPS | Used by a redirection service to automatically update URLs. |
+| img-prod-cms-rt-microsoft-com.akamaized.net | HTTPS | Used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). |
+| *.login.msa.akadns6.net | TLSv1.2 | Used for Microsoft accounts to sign in. |
+| licensing.mp.microsoft.com | HTTPS | Used for online activation and some app licensing. |
+| location-inference-westus.cloudapp.net | TLSv1.2 | Used for location data. |
+| login.live.com | HTTPS | Used to authenticate a device. |
+| mediaredirect.microsoft.com | HTTPS | Used by the Groove Music app to update HTTP handler status. |
+| modern.watson.data.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
+| msftsrvcs.vo.llnwd.net | HTTP | Enables connections to Windows Update. |
+| msnbot-*.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| oem.twimg.com | HTTPS | Used for the Twitter Live Tile. |
+| oneclient.sfx.ms | HTTPS | Used by OneDrive for Business to download and verify app updates. |
+| peer4-wst.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| pti.store.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| pti.store.microsoft.com.unistore.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| purchase.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| ris.api.iris.microsoft.com.akadns.net | TLSv1.2\/HTTPS | Used to retrieve Windows Spotlight metadata. |
+| settings-win.data.microsoft.com | HTTPS | Used for Windows apps to dynamically update their configuration. |
+| sls.update.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update. |
+| star-mini.c10r.facebook.com | TLSv1.2 | Used for the Facebook Live Tile. |
+| storecatalogrevocation.storequality.microsoft.com | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store. |
+| storeedgefd.dsx.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| store-images.s-microsoft.com | HTTP | Used to get images that are used for Microsoft Store suggestions. |
+| tile-service.weather.microsoft.com | HTTP | Used to download updates to the Weather app Live Tile. |
+| tsfe.trafficshaping.dsp.mp.microsoft.com | TLSv1.2 | Used for content regulation. |
+| v10.vortex-win.data.microsoft.com | HTTPS | Used to retrieve Windows Insider Preview builds. |
+| wallet.microsoft.com | HTTPS | Used by the Microsoft Wallet app. |
+| wallet-frontend-prod-westus.cloudapp.net | TLSv1.2 | Used by the Microsoft Wallet app. |
+| *.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. |
+| ceuswatcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| ceuswatcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| eaus2watcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| eaus2watcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| weus2watcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| weus2watcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| wdcp.microsoft.akadns.net | TLSv1.2 | Used for Windows Defender when Cloud-based Protection is enabled. |
+| wildcard.twimg.com | TLSv1.2 | Used for the Twitter Live Tile. |
+| www.bing.com | HTTP | Used for updates for Cortana, apps, and Live Tiles. |
+| www.facebook.com | HTTPS | Used for the Facebook Live Tile. |
+| [www.microsoft.com](https://www.microsoft.com/) | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
+
+## Windows 10 Pro
+
+| **Destination** | **Protocol** | **Description** |
+| --- | --- | --- |
+| *.*.akamai.net | HTTP | Used to download content. |
+| *.*.akamaiedge.net | TLSv1.2\/HTTP | Used to check for updates to maps that have been downloaded for offline use. |
+| *.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.blob.core.windows.net | HTTPS | Used by Windows Update to update words used for language input methods. |
+| *.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. |
+| *.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. |
+| *.dspb.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
+| *.dspg.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
+| *.e-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.login.msa.akadns6.net | TLSv1.2 | Used for Microsoft accounts to sign in. |
+| *.s-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.telecommand.telemetry.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
+| *.wac.edgecastcdn.net | TLSv1.2 | Used by the Verizon Content Delivery Network to perform Windows updates. |
+| *.wac.phicdn.net | HTTP | Used by the Verizon Content Delivery Network to perform Windows updates. |
+| *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). |
+| *prod.do.dsp.mp.microsoft.com | TLSv1.2\/HTTPS | Used for Windows Update downloads of apps and OS updates. |
+| 3.dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| 3.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
+| 3.tlu.dl.delivery.mp.microsoft.com | HTTP | Enables connections to Windows Update. |
+| 3.tlu.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
+| arc.msn.com | HTTPS | Used to retrieve Windows Spotlight metadata. |
+| arc.msn.com.nsatc.net | TLSv1.3 | Used to retrieve Windows Spotlight metadata. |
+| au.download.windowsupdate.com | HTTPS | Used to download operating system patches and updates. |
+| b-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| candycrushsoda.king.com | HTTPS | Used for Candy Crush Saga updates. |
+| cdn.content.prod.cms.msn.com | HTTP | Used to retrieve Windows Spotlight metadata. |
+| cdn.onenote.net | HTTPS | Used for OneNote Live Tile. |
+| client-office365-tas.msedge.net | HTTPS | Used to connect to the Office 365 portal’s shared infrastructure, including Office. |
+| config.edge.skype.com | HTTPS | Used to retrieve Skype configuration values. |
+| ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. |
+| cs12.wpc.v0cdn.net | HTTP | Used by the Verizon Content Delivery Network to download content for Windows upgrades with Wireless Planning and Coordination (WPC). |
+| cy2.displaycatalog.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| cy2.settings.data.microsoft.com.akadns.net | TLSv1.2 | Used as a way for apps to dynamically update their configuration. |
+| cy2.vortex.data.microsoft.com.akadns.net | TLSv1.2 | Used to retrieve Windows Insider Preview builds. |
+| definitionupdates.microsoft.com | HTTPS | Used for Windows Defender definition updates. |
+| displaycatalog.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| download.windowsupdate.com | HTTP | Enables connections to Windows Update. |
+| evoke-windowsservices-tas.msedge.net | HTTPS | Used by the Photos app to download configuration files, and to connect to the Office 365 portal’s shared infrastructure, including Office. |
+| fe2.update.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2\/HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe3.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. |
+| fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| fs.microsoft.com | HTTPS | Used to download fonts on demand |
+| g.live.com | HTTP | Used by a redirection service to automatically update URLs. |
+| g.msn.com | HTTPS | Used to retrieve Windows Spotlight metadata. |
+| g.msn.com.nsatc.net | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| geo-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| geover-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| go.microsoft.com | HTTPS | Used by a redirection service to automatically update URLs. |
+| gpla1.wac.v2cdn.net | HTTP | Used for Baltimore CyberTrust Root traffic. . |
+| img-prod-cms-rt-microsoft-com.akamaized.net | HTTPS | Used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). |
+| licensing.mp.microsoft.com | HTTPS | Used for online activation and some app licensing. |
+| location-inference-westus.cloudapp.net | TLSv1.2 | Used for location data. |
+| login.live.com | HTTPS | Used to authenticate a device. |
+| l-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| mediaredirect.microsoft.com | HTTPS | Used by the Groove Music app to update HTTP handler status. |
+| modern.watson.data.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
+| msnbot-*.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| oem.twimg.com | HTTP | Used for the Twitter Live Tile. |
+| oneclient.sfx.ms | HTTP | Used by OneDrive for Business to download and verify app updates. |
+| peer1-wst.msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. |
+| pti.store.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| pti.store.microsoft.com.unistore.akadns.net | HTTPS | Used to communicate with Microsoft Store. |
+| purchase.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| ris.api.iris.microsoft.com | HTTPS | Used to retrieve Windows Spotlight metadata. |
+| settings-win.data.microsoft.com | HTTPS | Used for Windows apps to dynamically update their configuration. |
+| sls.update.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| storecatalogrevocation.storequality.microsoft.com | HTTPS | Used to revoke licenses for malicious apps on the Microsoft Store. |
+| storeedgefd.dsx.mp.microsoft.com | HTTPS | Used to communicate with Microsoft Store. |
+| store-images.s-microsoft.com | HTTPS | Used to get images that are used for Microsoft Store suggestions. |
+| store-images.s-microsoft.com | HTTPS | Used to get images that are used for Microsoft Store suggestions. |
+| *.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. |
+| ceuswatcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| ceuswatcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| eaus2watcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| eaus2watcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| weus2watcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| weus2watcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| tile-service.weather.microsoft.com | HTTP | Used to download updates to the Weather app Live Tile. |
+| tsfe.trafficshaping.dsp.mp.microsoft.com | HTTPS | Used for content regulation. |
+| v10.vortex-win.data.microsoft.com | HTTPS | Used to retrieve Windows Insider Preview builds. |
+| wallet.microsoft.com | HTTPS | Used by the Microsoft Wallet app. |
+| wdcp.microsoft.akadns.net | HTTPS | Used for Windows Defender when Cloud-based Protection is enabled. |
+| wildcard.twimg.com | TLSv1.2 | Used for the Twitter Live Tile. |
+| www.bing.com | TLSv1.2 | Used for updates for Cortana, apps, and Live Tiles. |
+| www.facebook.com | HTTPS | Used for the Facebook Live Tile. |
+| [www.microsoft.com](https://www.microsoft.com/) | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
+
+## Windows 10 Education
+
+| **Destination** | **Protocol** | **Description** |
+| --- | --- | --- |
+| *.a-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.b.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
+| *.c-msedge.net | HTTP | Used by OfficeHub to get the metadata of Office apps. |
+| *.dscb1.akamaiedge.net | HTTP | Used to check for updates to maps that have been downloaded for offline use. |
+| *.dscd.akamai.net | HTTP | Used to download content. |
+| *.dspb.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
+| *.dspw65.akamai.net | HTTP | Used to download content. |
+| *.e-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.g.akamai.net | HTTP | Used to download content. |
+| *.g.akamaiedge.net | TLSv1.2 | Used to check for updates to maps that have been downloaded for offline use. |
+| *.l.windowsupdate.com | HTTP | Enables connections to Windows Update. |
+| *.s-msedge.net | TLSv1.2 | Used by OfficeHub to get the metadata of Office apps. |
+| *.wac.phicdn.net | HTTP | Used by the Verizon Content Delivery Network to perform Windows updates |
+| *.wns.windows.com | TLSv1.2 | Used for the Windows Push Notification Services (WNS). |
+| *prod.do.dsp.mp.microsoft.com | TLSv1.2 | Used for Windows Update downloads of apps and OS updates. |
+| *prod.do.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Used for Windows Update downloads of apps and OS updates. |
+| 3.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
+| 3.tlu.dl.delivery.mp.microsoft.com.c.footprint.net | HTTP | Enables connections to Windows Update. |
+| a-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| au.download.windowsupdate.com | HTTP | Used to download operating system patches and updates. |
+| cdn.onenote.net | HTTPS | Used for OneNote Live Tile. |
+| cds.*.hwcdn.net | HTTP | Used by the Highwinds Content Delivery Network to perform Windows updates. |
+| co4.telecommand.telemetry.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
+| config.edge.skype.com | HTTPS | Used to retrieve Skype configuration values. |
+| ctldl.windowsupdate.com | HTTP | Used to download certificates that are publicly known to be fraudulent. |
+| cs12.wpc.v0cdn.net | HTTP | Used by the Verizon Content Delivery Network to download content for Windows upgrades with Wireless Planning and Coordination (WPC). |
+| cy2.displaycatalog.md.mp.microsoft.com.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| cy2.settings.data.microsoft.com.akadns.net | TLSv1.2 | Used as a way for apps to dynamically update their configuration. |
+| cy2.vortex.data.microsoft.com.akadns.net | TLSv1.2 | Used to retrieve Windows Insider Preview builds. |
+| dl.delivery.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| download.windowsupdate.com | HTTP | Enables connections to Windows Update. |
+| evoke-windowsservices-tas.msedge.net/ab | HTTPS | Used by the Photos app to download configuration files, and to connect to the Office 365 portal’s shared infrastructure, including Office. |
+| fe2.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe3.delivery.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
+| fg.download.windowsupdate.com.c.footprint.net | HTTP | Used to download operating system patches and updates. |
+| fp.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| g.msn.com.nsatc.net | TLSv1.2\/HTTP | Used to retrieve Windows Spotlight metadata. |
+| geo-prod.do.dsp.mp.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
+| geover-prod.do.dsp.mp.microsoft.com | HTTPS | Enables connections to Windows Update. |
+| go.microsoft.com | HTTPS | Used by a redirection service to automatically update URLs. |
+| gpla1.wac.v2cdn.net | HTTP | Used for Baltimore CyberTrust Root traffic. . |
+| ipv4.login.msa.akadns6.net | TLSv1.2 | Used for Microsoft accounts to sign in. |
+| licensing.mp.microsoft.com | HTTPS | Used for online activation and some app licensing. |
+| location-inference-westus.cloudapp.net | TLSv1.2 | Used for location data. |
+| login.live.com/* | HTTPS | Used to authenticate a device. |
+| l-ring.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| mediaredirect.microsoft.com | HTTPS | Used by the Groove Music app to update HTTP handler status. |
+| modern.watson.data.microsoft.com.akadns.net | TLSv1.2 | Used by Windows Error Reporting. |
+| msftconnecttest.com/* | HTTP | Used by Network Connection Status Indicator (NCSI) to detect Internet connectivity and corporate network connectivity status. |
+| msnbot-65-52-108-198.search.msn.com | TLSv1.2 | Used to retrieve Windows Spotlight metadata. |
+| oneclient.sfx.ms | HTTP | Used by OneDrive for Business to download and verify app updates. |
+| peer1-wst.msedge.net | HTTPS | Used by OfficeHub to get the metadata of Office apps. |
+| pti.store.microsoft.com.unistore.akadns.net | TLSv1.2 | Used to communicate with Microsoft Store. |
+| settings-win.data.microsoft.com | HTTPS | Used for Windows apps to dynamically update their configuration. |
+| sls.update.microsoft.com.nsatc.net | TLSv1.2 | Enables connections to Windows Update. |
+| store-images.s-microsoft.com | HTTPS | Used to get images that are used for Microsoft Store suggestions. |
+| tile-service.weather.microsoft.com | HTTP | Used to download updates to the Weather app Live Tile. |
+| *.telemetry.microsoft.com | HTTPS | Used by Windows Error Reporting. |
+| ceuswatcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| ceuswatcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| eaus2watcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| eaus2watcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| weus2watcab01.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| weus2watcab02.blob.core.windows.net | HTTPS | Used by Windows Error Reporting. |
+| tsfe.trafficshaping.dsp.mp.microsoft.com | TLSv1.2 | Used for content regulation. |
+| wallet.microsoft.com | HTTPS | Used by the Microsoft Wallet app. |
+
+| wdcp.microsoft.akadns.net | TLSv1.2 | Used for Windows Defender when Cloud-based Protection is enabled. |
+| www.bing.com | HTTPS | Used for updates for Cortana, apps, and Live Tiles. |
diff --git a/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md
index 833236d614..1744c60ff7 100644
--- a/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md
+++ b/windows/privacy/windows-endpoints-1803-non-enterprise-editions.md
@@ -1,164 +1,165 @@
----
-title: Windows 10, version 1803, connection endpoints for non-Enterprise editions
-description: Explains what Windows 10 endpoints are used in non-Enterprise editions.
-keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-ms.localizationpriority: high
-audience: ITPro
-author: danihalfin
-ms.author: daniha
-manager: dansimp
-ms.collection: M365-security-compliance
-ms.topic: article
-ms.date: 6/26/2018
----
-# Windows 10, version 1803, connection endpoints for non-Enterprise editions
-
- **Applies to**
-
-- Windows 10 Home, version 1803
-- Windows 10 Professional, version 1803
-- Windows 10 Education, version 1803
-
-In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-endpoints.md), the following endpoints are available on other editions of Windows 10, version 1803.
-
-We used the following methodology to derive these network endpoints:
-
-1.	Set up the latest version of Windows 10 on a test virtual machine using the default settings. 
-2.	Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
-3.	Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.  
-4.	Compile reports on traffic going to public IP addresses.
-5.  The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory.
-6.  All traffic was captured in our lab using a IPV4 network.  Therefore no IPV6 traffic is reported here. 
-
-> [!NOTE]
-> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time.
-
-## Windows 10 Family
-
-| **Destination** | **Protocol** | **Description** |
-| --- | --- | --- |
-| *.e-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
-| *.g.akamaiedge.net	| HTTPS |	Used to check for updates to maps that have been downloaded for offline use. |
-| *.s-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
-| *.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ | HTTP | Enables connections to Windows Update. |
-| arc.msn.com.nsatc.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
-| arc.msn.com/v3/Delivery/Placement	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
-| client-office365-tas.msedge.net*	| HTTPS |	Used to connect to the Office 365 portal’s shared infrastructure, including Office Online. |
-| config.edge.skype.com/config/*	| HTTPS |	Used to retrieve Skype configuration values. |
-| ctldl.windowsupdate.com/msdownload/update* | HTTP | Used to download certificates that are publicly known to be fraudulent. |
-| cy2.displaycatalog.md.mp.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
-| cy2.licensing.md.mp.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
-| cy2.settings.data.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
-| displaycatalog.mp.microsoft.com*	| HTTPS |	Used to communicate with Microsoft Store. |
-| dm3p.wns.notify.windows.com.akadns.net	| HTTPS |	Used for the Windows Push Notification Services (WNS). |
-| fe2.update.microsoft.com*	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| fe3.delivery.dsp.mp.microsoft.com.nsatc.net	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| fe3.delivery.mp.microsoft.com	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| g.live.com/odclientsettings/Prod	| HTTPS |	Used by OneDrive for Business to download and verify app updates. |
-| g.msn.com.nsatc.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
-| geo-prod.dodsp.mp.microsoft.com.nsatc.net	| HTTPS |	Enables connections to Windows Update. |
-| ip5.afdorigin-prod-am02.afdogw.com	| HTTPS |	Used to serve office 365 experimentation traffic. |
-| ipv4.login.msa.akadns6.net	| HTTPS |	Used for Microsoft accounts to sign in. |
-| licensing.mp.microsoft.com/v7.0/licenses/content	| HTTPS |	Used for online activation and some app licensing. |
-| location-inference-westus.cloudapp.net	| HTTPS |	Used for location data. |
-| maps.windows.com/windows-app-web-link	| HTTPS |	Link to Maps application. |
-| modern.watson.data.microsoft.com.akadns.net	| HTTPS |	Used by Windows Error Reporting. |
-| ocos-office365-s2s.msedge.net*	| HTTPS | Used to connect to the Office 365 portal's shared infrastructure. |
-| ocsp.digicert.com* |	HTTP | CRL and OCSP checks to the issuing certificate authorities. |
-| oneclient.sfx.ms*	| HTTPS |	Used by OneDrive for Business to download and verify app updates. |
-| onecollector.cloudapp.aria.akadns.net	| HTTPS |	Office Telemetry |
-| prod.nexusrules.live.com.akadns.net	| HTTPS |	Office Telemetry |
-| query.prod.cms.rt.microsoft.com*	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
-| ris.api.iris.microsoft.com*	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
-| settings.data.microsoft.com/settings/v2.0/*	| HTTPS |	Used for Windows apps to dynamically update their configuration. |
-| settings-win.data.microsoft.com/settings/*	| HTTPS |	Used as a way for apps to dynamically update their configuration.  |
-| share.microsoft.com/windows-app-web-link	| HTTPS |	Traffic related to Books app |
-| sls.update.microsoft.com*	| HTTPS |	Enables connections to Windows Update. |
-| storecatalogrevocation.storequality.microsoft.com*	| HTTPS |	Used to revoke licenses for malicious apps on the Microsoft Store. |
-| storeedgefd.dsx.mp.microsoft.com*	| HTTPS |	Used to communicate with Microsoft Store. |
-| tile-service.weather.microsoft.com* | HTTP | Used to download updates to the Weather app Live Tile. |
-| tsfe.trafficshaping.dsp.mp.microsoft.com	| HTTPS |	Used for content regulation. |
-| us.configsvc1.live.com.akadns.net	| HTTPS |	Microsoft Office configuration related traffic |
-| watson.telemetry.microsoft.com/Telemetry.Request	| HTTPS |	Used by Windows Error Reporting. |
-| wd-prod-cp-us-east-2-fe.eastus.cloudapp.azure.com	| HTTPS |	Azure front end traffic |
-
-
-## Windows 10 Pro
-| **Destination** | **Protocol** | **Description** |
-| --- | --- | --- |
-| *.e-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
-| *.g.akamaiedge.net	| HTTPS |	Used to check for updates to maps that have been downloaded for offline use. |
-| *.s-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
-| *.tlu.dl.delivery.mp.microsoft.com/* | HTTP | Enables connections to Windows Update. |
-| *geo-prod.dodsp.mp.microsoft.com.nsatc.net	| HTTPS |	Enables connections to Windows Update. |
-| arc.msn.com.nsatc.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
-| au.download.windowsupdate.com/* | HTTP | Enables connections to Windows Update. |
-| ctldl.windowsupdate.com/msdownload/update/* | HTTP |	Used to download certificates that are publicly known to be fraudulent. |
-| cy2.licensing.md.mp.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
-| cy2.settings.data.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
-| dm3p.wns.notify.windows.com.akadns.net	| HTTPS |	Used for the Windows Push Notification Services (WNS) |
-| fe3.delivery.dsp.mp.microsoft.com.nsatc.net	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| flightingservicewus.cloudapp.net	| HTTPS |	Insider Program |
-| g.msn.com.nsatc.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
-| ipv4.login.msa.akadns6.net	| HTTPS |	Used for Microsoft accounts to sign in. |
-| location-inference-westus.cloudapp.net	| HTTPS |	Used for location data. |
-| modern.watson.data.microsoft.com.akadns.net	| HTTPS |	Used by Windows Error Reporting. |
-| ocsp.digicert.com* |	HTTP | CRL and OCSP checks to the issuing certificate authorities. |
-| onecollector.cloudapp.aria.akadns.net	| HTTPS |	Office Telemetry |
-| ris.api.iris.microsoft.com.akadns.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
-| tile-service.weather.microsoft.com/* | HTTP |	Used to download updates to the Weather app Live Tile. |
-| tsfe.trafficshaping.dsp.mp.microsoft.com	| HTTPS |	Used for content regulation. |
-| vip5.afdorigin-prod-am02.afdogw.com	| HTTPS |	Used to serve office 365 experimentation traffic |
-
-
-## Windows 10 Education
-
-| **Destination** | **Protocol** | **Description** |
-| --- | --- | --- |
-| *.b.akamaiedge.net	| HTTPS |	Used to check for updates to maps that have been downloaded for offline use. |
-| *.e-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
-| *.g.akamaiedge.net	| HTTPS |	Used to check for updates to maps that have been downloaded for offline use. |
-| *.s-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
-| *.telecommand.telemetry.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting. |
-| *.tlu.dl.delivery.mp.microsoft.com* | HTTP | Enables connections to Windows Update. |
-| *.windowsupdate.com* | HTTP | Enables connections to Windows Update. |
-| *geo-prod.do.dsp.mp.microsoft.com	| HTTPS |	Enables connections to Windows Update. |
-| au.download.windowsupdate.com* | HTTP | Enables connections to Windows Update. |
-| cdn.onenote.net/livetile/*	| HTTPS |	Used for OneNote Live Tile. |
-| client-office365-tas.msedge.net/*	| HTTPS |	Used to connect to the Office 365 portal’s shared infrastructure, including Office Online. |
-| cloudtile.photos.microsoft.com.akadns.net	| HTTPS |	Photos App in MS Store 
-| config.edge.skype.com/*	| HTTPS |	Used to retrieve Skype configuration values.  |
-| ctldl.windowsupdate.com/* | HTTP | Used to download certificates that are publicly known to be fraudulent. |
-| cy2.displaycatalog.md.mp.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
-| cy2.licensing.md.mp.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
-| cy2.settings.data.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
-| displaycatalog.mp.microsoft.com/*	| HTTPS |	Used to communicate with Microsoft Store. | 
-| download.windowsupdate.com/*	| HTTPS |	Enables connections to Windows Update. |
-| emdl.ws.microsoft.com/* | HTTP | Used to download apps from the Microsoft Store. |
-| fe2.update.microsoft.com/*	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| fe3.delivery.dsp.mp.microsoft.com.nsatc.net	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| fe3.delivery.mp.microsoft.com/*	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
-| flightingservicewus.cloudapp.net	| HTTPS |	Insider Program | 
-| g.live.com/odclientsettings/*	| HTTPS |	Used by OneDrive for Business to download and verify app updates. |
-| g.msn.com.nsatc.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
-| ipv4.login.msa.akadns6.net	| HTTPS |	Used for Microsoft accounts to sign in. |
-| licensing.mp.microsoft.com/*	| HTTPS |	Used for online activation and some app licensing. |
-| maps.windows.com/windows-app-web-link	| HTTPS |	Link to Maps application |
-| modern.watson.data.microsoft.com.akadns.net	| HTTPS |	Used by Windows Error Reporting. |
-| ocos-office365-s2s.msedge.net/*	| HTTPS |	Used to connect to the Office 365 portal's shared infrastructure. |
-| ocsp.digicert.com* |	HTTP | CRL and OCSP checks to the issuing certificate authorities. |
-| oneclient.sfx.ms/*	| HTTPS |	Used by OneDrive for Business to download and verify app updates. |
-| onecollector.cloudapp.aria.akadns.net	| HTTPS |	Office telemetry | 
-| settings-win.data.microsoft.com/settings/*	| HTTPS |	Used as a way for apps to dynamically update their configuration. |
-| share.microsoft.com/windows-app-web-link	| HTTPS |	Traffic related to Books app | 
-| sls.update.microsoft.com/*	| HTTPS |	Enables connections to Windows Update. |
-| storecatalogrevocation.storequality.microsoft.com/*	| HTTPS |	Used to revoke licenses for malicious apps on the Microsoft Store. |
-| tile-service.weather.microsoft.com/* | HTTP | Used to download updates to the Weather app Live Tile. |
-| tsfe.trafficshaping.dsp.mp.microsoft.com	| HTTPS |	Used for content regulation. |
-| vip5.afdorigin-prod-ch02.afdogw.com	| HTTPS |	Used to serve office 365 experimentation traffic. |
-| watson.telemetry.microsoft.com/Telemetry.Request	| HTTPS |	Used by Windows Error Reporting. |
-| wd-prod-cp-us-west-3-fe.westus.cloudapp.azure.com	| HTTPS |	Azure front end traffic | 
-| www.bing.com/*	| HTTPS |	Used for updates for Cortana, apps, and Live Tiles. | 
+---
+title: Windows 10, version 1803, connection endpoints for non-Enterprise editions
+description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1803.
+keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.localizationpriority: high
+audience: ITPro
+author: dansimp
+ms.author: dansimp
+manager: dansimp
+ms.collection: M365-security-compliance
+ms.topic: article
+ms.date: 6/26/2018
+ms.reviewer: 
+---
+# Windows 10, version 1803, connection endpoints for non-Enterprise editions
+
+ **Applies to**
+
+- Windows 10 Home, version 1803
+- Windows 10 Professional, version 1803
+- Windows 10 Education, version 1803
+
+In addition to the endpoints listed for [Windows 10 Enterprise](https://docs.microsoft.com/windows/privacy/manage-windows-1803-endpoints ), the following endpoints are available on other editions of Windows 10, version 1803.
+
+We used the following methodology to derive these network endpoints:
+
+1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. 
+2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
+3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.  
+4. Compile reports on traffic going to public IP addresses.
+5.  The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory.
+6.  All traffic was captured in our lab using a IPV4 network.  Therefore no IPV6 traffic is reported here. 
+
+> [!NOTE]
+> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time.
+
+## Windows 10 Family
+
+| **Destination** | **Protocol** | **Description** |
+| --- | --- | --- |
+| *.e-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
+| *.g.akamaiedge.net	| HTTPS |	Used to check for updates to maps that have been downloaded for offline use. |
+| *.s-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
+| *.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ | HTTP | Enables connections to Windows Update. |
+| arc.msn.com.nsatc.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
+| arc.msn.com/v3/Delivery/Placement	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
+| client-office365-tas.msedge.net*	| HTTPS |	Used to connect to the Office 365 portal’s shared infrastructure, including Office. |
+| config.edge.skype.com/config/*	| HTTPS |	Used to retrieve Skype configuration values. |
+| ctldl.windowsupdate.com/msdownload/update* | HTTP | Used to download certificates that are publicly known to be fraudulent. |
+| cy2.displaycatalog.md.mp.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
+| cy2.licensing.md.mp.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
+| cy2.settings.data.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
+| displaycatalog.mp.microsoft.com*	| HTTPS |	Used to communicate with Microsoft Store. |
+| dm3p.wns.notify.windows.com.akadns.net	| HTTPS |	Used for the Windows Push Notification Services (WNS). |
+| fe2.update.microsoft.com*	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe3.delivery.dsp.mp.microsoft.com.nsatc.net	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe3.delivery.mp.microsoft.com	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| g.live.com/odclientsettings/Prod	| HTTPS |	Used by OneDrive for Business to download and verify app updates. |
+| g.msn.com.nsatc.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
+| geo-prod.dodsp.mp.microsoft.com.nsatc.net	| HTTPS |	Enables connections to Windows Update. |
+| ip5.afdorigin-prod-am02.afdogw.com	| HTTPS |	Used to serve office 365 experimentation traffic. |
+| ipv4.login.msa.akadns6.net	| HTTPS |	Used for Microsoft accounts to sign in. |
+| licensing.mp.microsoft.com/v7.0/licenses/content	| HTTPS |	Used for online activation and some app licensing. |
+| location-inference-westus.cloudapp.net	| HTTPS |	Used for location data. |
+| maps.windows.com/windows-app-web-link	| HTTPS |	Link to Maps application. |
+| modern.watson.data.microsoft.com.akadns.net	| HTTPS |	Used by Windows Error Reporting. |
+| ocos-office365-s2s.msedge.net*	| HTTPS | Used to connect to the Office 365 portal's shared infrastructure. |
+| ocsp.digicert.com* |	HTTP | CRL and OCSP checks to the issuing certificate authorities. |
+| oneclient.sfx.ms*	| HTTPS |	Used by OneDrive for Business to download and verify app updates. |
+| onecollector.cloudapp.aria.akadns.net	| HTTPS |	Office Telemetry |
+| prod.nexusrules.live.com.akadns.net	| HTTPS |	Office Telemetry |
+| query.prod.cms.rt.microsoft.com*	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
+| ris.api.iris.microsoft.com*	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
+| settings.data.microsoft.com/settings/v2.0/*	| HTTPS |	Used for Windows apps to dynamically update their configuration. |
+| settings-win.data.microsoft.com/settings/*	| HTTPS |	Used as a way for apps to dynamically update their configuration.  |
+| share.microsoft.com/windows-app-web-link	| HTTPS |	Traffic related to Books app |
+| sls.update.microsoft.com*	| HTTPS |	Enables connections to Windows Update. |
+| storecatalogrevocation.storequality.microsoft.com*	| HTTPS |	Used to revoke licenses for malicious apps on the Microsoft Store. |
+| storeedgefd.dsx.mp.microsoft.com*	| HTTPS |	Used to communicate with Microsoft Store. |
+| tile-service.weather.microsoft.com* | HTTP | Used to download updates to the Weather app Live Tile. |
+| tsfe.trafficshaping.dsp.mp.microsoft.com	| HTTPS |	Used for content regulation. |
+| us.configsvc1.live.com.akadns.net	| HTTPS |	Microsoft Office configuration related traffic |
+| watson.telemetry.microsoft.com/Telemetry.Request	| HTTPS |	Used by Windows Error Reporting. |
+| wd-prod-cp-us-east-2-fe.eastus.cloudapp.azure.com	| HTTPS |	Azure front end traffic |
+
+
+## Windows 10 Pro
+| **Destination** | **Protocol** | **Description** |
+| --- | --- | --- |
+| *.e-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
+| *.g.akamaiedge.net	| HTTPS |	Used to check for updates to maps that have been downloaded for offline use. |
+| *.s-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
+| *.tlu.dl.delivery.mp.microsoft.com/* | HTTP | Enables connections to Windows Update. |
+| *geo-prod.dodsp.mp.microsoft.com.nsatc.net	| HTTPS |	Enables connections to Windows Update. |
+| arc.msn.com.nsatc.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
+| au.download.windowsupdate.com/* | HTTP | Enables connections to Windows Update. |
+| ctldl.windowsupdate.com/msdownload/update/* | HTTP |	Used to download certificates that are publicly known to be fraudulent. |
+| cy2.licensing.md.mp.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
+| cy2.settings.data.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
+| dm3p.wns.notify.windows.com.akadns.net	| HTTPS |	Used for the Windows Push Notification Services (WNS) |
+| fe3.delivery.dsp.mp.microsoft.com.nsatc.net	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| flightingservicewus.cloudapp.net	| HTTPS |	Insider Program |
+| g.msn.com.nsatc.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
+| ipv4.login.msa.akadns6.net	| HTTPS |	Used for Microsoft accounts to sign in. |
+| location-inference-westus.cloudapp.net	| HTTPS |	Used for location data. |
+| modern.watson.data.microsoft.com.akadns.net	| HTTPS |	Used by Windows Error Reporting. |
+| ocsp.digicert.com* |	HTTP | CRL and OCSP checks to the issuing certificate authorities. |
+| onecollector.cloudapp.aria.akadns.net	| HTTPS |	Office Telemetry |
+| ris.api.iris.microsoft.com.akadns.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
+| tile-service.weather.microsoft.com/* | HTTP |	Used to download updates to the Weather app Live Tile. |
+| tsfe.trafficshaping.dsp.mp.microsoft.com	| HTTPS |	Used for content regulation. |
+| vip5.afdorigin-prod-am02.afdogw.com	| HTTPS |	Used to serve office 365 experimentation traffic |
+
+
+## Windows 10 Education
+
+| **Destination** | **Protocol** | **Description** |
+| --- | --- | --- |
+| *.b.akamaiedge.net	| HTTPS |	Used to check for updates to maps that have been downloaded for offline use. |
+| *.e-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
+| *.g.akamaiedge.net	| HTTPS |	Used to check for updates to maps that have been downloaded for offline use. |
+| *.s-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
+| *.telecommand.telemetry.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting. |
+| *.tlu.dl.delivery.mp.microsoft.com* | HTTP | Enables connections to Windows Update. |
+| *.windowsupdate.com* | HTTP | Enables connections to Windows Update. |
+| *geo-prod.do.dsp.mp.microsoft.com	| HTTPS |	Enables connections to Windows Update. |
+| au.download.windowsupdate.com* | HTTP | Enables connections to Windows Update. |
+| cdn.onenote.net/livetile/*	| HTTPS |	Used for OneNote Live Tile. |
+| client-office365-tas.msedge.net/*	| HTTPS |	Used to connect to the Office 365 portal’s shared infrastructure, including Office. |
+| cloudtile.photos.microsoft.com.akadns.net	| HTTPS |	Photos App in MS Store 
+| config.edge.skype.com/*	| HTTPS |	Used to retrieve Skype configuration values.  |
+| ctldl.windowsupdate.com/* | HTTP | Used to download certificates that are publicly known to be fraudulent. |
+| cy2.displaycatalog.md.mp.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
+| cy2.licensing.md.mp.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
+| cy2.settings.data.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
+| displaycatalog.mp.microsoft.com/*	| HTTPS |	Used to communicate with Microsoft Store. | 
+| download.windowsupdate.com/*	| HTTPS |	Enables connections to Windows Update. |
+| emdl.ws.microsoft.com/* | HTTP | Used to download apps from the Microsoft Store. |
+| fe2.update.microsoft.com/*	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe3.delivery.dsp.mp.microsoft.com.nsatc.net	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| fe3.delivery.mp.microsoft.com/*	| HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store. |
+| flightingservicewus.cloudapp.net	| HTTPS |	Insider Program | 
+| g.live.com/odclientsettings/*	| HTTPS |	Used by OneDrive for Business to download and verify app updates. |
+| g.msn.com.nsatc.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
+| ipv4.login.msa.akadns6.net	| HTTPS |	Used for Microsoft accounts to sign in. |
+| licensing.mp.microsoft.com/*	| HTTPS |	Used for online activation and some app licensing. |
+| maps.windows.com/windows-app-web-link	| HTTPS |	Link to Maps application |
+| modern.watson.data.microsoft.com.akadns.net	| HTTPS |	Used by Windows Error Reporting. |
+| ocos-office365-s2s.msedge.net/*	| HTTPS |	Used to connect to the Office 365 portal's shared infrastructure. |
+| ocsp.digicert.com* |	HTTP | CRL and OCSP checks to the issuing certificate authorities. |
+| oneclient.sfx.ms/*	| HTTPS |	Used by OneDrive for Business to download and verify app updates. |
+| onecollector.cloudapp.aria.akadns.net	| HTTPS |	Office telemetry | 
+| settings-win.data.microsoft.com/settings/*	| HTTPS |	Used as a way for apps to dynamically update their configuration. |
+| share.microsoft.com/windows-app-web-link	| HTTPS |	Traffic related to Books app | 
+| sls.update.microsoft.com/*	| HTTPS |	Enables connections to Windows Update. |
+| storecatalogrevocation.storequality.microsoft.com/*	| HTTPS |	Used to revoke licenses for malicious apps on the Microsoft Store. |
+| tile-service.weather.microsoft.com/* | HTTP | Used to download updates to the Weather app Live Tile. |
+| tsfe.trafficshaping.dsp.mp.microsoft.com	| HTTPS |	Used for content regulation. |
+| vip5.afdorigin-prod-ch02.afdogw.com	| HTTPS |	Used to serve office 365 experimentation traffic. |
+| watson.telemetry.microsoft.com/Telemetry.Request	| HTTPS |	Used by Windows Error Reporting. |
+| wd-prod-cp-us-west-3-fe.westus.cloudapp.azure.com	| HTTPS |	Azure front end traffic | 
+| www.bing.com/*	| HTTPS |	Used for updates for Cortana, apps, and Live Tiles. | 
diff --git a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md
index 370860330f..0bde8377e9 100644
--- a/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md
+++ b/windows/privacy/windows-endpoints-1809-non-enterprise-editions.md
@@ -1,18 +1,19 @@
 ---
 title: Windows 10, version 1809, connection endpoints for non-Enterprise editions
-description: Explains what Windows 10 endpoints are used in non-Enterprise editions.
+description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1809.
 keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
 ms.prod: w10
 ms.mktglfcycl: manage
 ms.sitesec: library
 ms.localizationpriority: high
 audience: ITPro
-author: danihalfin
-ms.author: daniha
+author: dansimp
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-security-compliance
 ms.topic: article
 ms.date: 6/26/2018
+ms.reviewer: 
 ---
 # Windows 10, version 1809, connection endpoints for non-Enterprise editions
 
@@ -26,10 +27,10 @@ In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-1
 
 We used the following methodology to derive these network endpoints:
 
-1.	Set up the latest version of Windows 10 on a test virtual machine using the default settings. 
-2.	Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
-3.	Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.  
-4.	Compile reports on traffic going to public IP addresses.
+1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. 
+2. Leave the devices running idle for a week (that is, a user is not interacting with the system/device).
+3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.  
+4. Compile reports on traffic going to public IP addresses.
 5.  The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory.
 6.  All traffic was captured in our lab using a IPV4 network.  Therefore no IPV6 traffic is reported here. 
 
@@ -40,52 +41,52 @@ We used the following methodology to derive these network endpoints:
 
 | **Destination** | **Protocol** | **Description** |
 | --- | --- | --- |
-|*.aria.microsoft.com*	| HTTPS |	Office Telemetry
-|*.dl.delivery.mp.microsoft.com*	| HTTP |	Enables connections to Windows Update.
-|*.download.windowsupdate.com*	| HTTP |	Used to download operating system patches and updates.
-|*.g.akamai.net	| HTTPS |	Used to check for updates to maps that have been downloaded for offline use.
-|*.msn.com*	|TLSv1.2/HTTPS |	Windows Spotlight related traffic
-|*.Skype.com	| HTTP/HTTPS |	Skype related traffic
-|*.smartscreen.microsoft.com*	| HTTPS |	Windows Defender Smartscreen related traffic
-|*.telecommand.telemetry.microsoft.com*	| HTTPS |	Used by Windows Error Reporting.
-|*cdn.onenote.net*	| HTTP |	OneNote related traffic
-|*displaycatalog.mp.microsoft.com*	| HTTPS |	Used to communicate with Microsoft Store.
-|*emdl.ws.microsoft.com*	| HTTP |	Windows Update related traffic
-|*geo-prod.do.dsp.mp.microsoft.com*	|TLSv1.2/HTTPS |	Enables connections to Windows Update.
-|*hwcdn.net*	| HTTP |	Used by the Highwinds Content Delivery Network to perform Windows updates.
-|*img-prod-cms-rt-microsoft-com.akamaized.net*	| HTTPS |	Used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps).
-|*maps.windows.com*	| HTTPS |	Related to Maps application.
-|*msedge.net*	| HTTPS |	Used by OfficeHub to get the metadata of Office apps.
-|*nexusrules.officeapps.live.com*	| HTTPS |	Office Telemetry
-|*photos.microsoft.com*	| HTTPS |	Photos App related traffic
-|*prod.do.dsp.mp.microsoft.com*	|TLSv1.2/HTTPS |	Used for Windows Update downloads of apps and OS updates.
-|*wac.phicdn.net*	| HTTP |	Windows Update related traffic
-|*windowsupdate.com*	| HTTP |	Windows Update related traffic
-|*wns.windows.com*	| HTTPS, TLSv1.2 |	Used for the Windows Push Notification Services (WNS).
-|*wpc.v0cdn.net*	| |	Windows Telemetry related traffic
+|\*.aria.microsoft.com\*	| HTTPS |	Office Telemetry
+|\*.dl.delivery.mp.microsoft.com\*	| HTTP |	Enables connections to Windows Update.
+|\*.download.windowsupdate.com\*	| HTTP |	Used to download operating system patches and updates.
+|\*.g.akamai.net	| HTTPS |	Used to check for updates to maps that have been downloaded for offline use.
+|\*.msn.com\*	|TLSv1.2/HTTPS |	Windows Spotlight related traffic
+|\*.Skype.com	| HTTP/HTTPS |	Skype related traffic
+|\*.smartscreen.microsoft.com\*	| HTTPS |	Windows Defender Smartscreen related traffic
+|\*.telecommand.telemetry.microsoft.com\*	| HTTPS |	Used by Windows Error Reporting.
+|\*cdn.onenote.net*	| HTTP |	OneNote related traffic
+|\*displaycatalog.mp.microsoft.com\*	| HTTPS |	Used to communicate with Microsoft Store.
+|\*emdl.ws.microsoft.com\*	| HTTP |	Windows Update related traffic
+|\*geo-prod.do.dsp.mp.microsoft.com\*	|TLSv1.2/HTTPS |	Enables connections to Windows Update.
+|\*hwcdn.net*	| HTTP |	Used by the Highwinds Content Delivery Network to perform Windows updates.
+|\*img-prod-cms-rt-microsoft-com.akamaized.net*	| HTTPS |	Used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps).
+|\*maps.windows.com\*	| HTTPS |	Related to Maps application.
+|\*msedge.net*	| HTTPS |	Used by OfficeHub to get the metadata of Office apps.
+|\*nexusrules.officeapps.live.com\*	| HTTPS |	Office Telemetry
+|\*photos.microsoft.com\*	| HTTPS |	Photos App related traffic
+|\*prod.do.dsp.mp.microsoft.com\*	|TLSv1.2/HTTPS |	Used for Windows Update downloads of apps and OS updates.
+|\*wac.phicdn.net*	| HTTP |	Windows Update related traffic
+|\*windowsupdate.com\*	| HTTP |	Windows Update related traffic
+|\*wns.windows.com\*	| HTTPS, TLSv1.2 |	Used for the Windows Push Notification Services (WNS).
+|\*wpc.v0cdn.net*	| |	Windows Telemetry related traffic
 |auth.gfx.ms/16.000.27934.1/OldConvergedLogin_PCore.js	| |	MSA related
-|evoke-windowsservices-tas.msedge*	| HTTPS |	The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office Online. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
-|fe2.update.microsoft.com*	|TLSv1.2/HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store.
-|fe3.*.mp.microsoft.com.* 	|TLSv1.2/HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store.
+|evoke-windowsservices-tas.msedge*	| HTTPS |	The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.
+|fe2.update.microsoft.com\*	|TLSv1.2/HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store.
+|fe3.\*.mp.microsoft.com.\* 	|TLSv1.2/HTTPS |	Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store.
 |fs.microsoft.com	| |	Font Streaming (in ENT traffic)
-|g.live.com*	| HTTPS |	Used by OneDrive
+|g.live.com\*	| HTTPS |	Used by OneDrive
 |iriscoremetadataprod.blob.core.windows.net	| HTTPS |	Windows Telemetry
-|mscrl.micorosoft.com	| |	Certificate Revocation List related traffic.
-|ocsp.digicert.com*	| HTTP |	CRL and OCSP checks to the issuing certificate authorities.
+|mscrl.microsoft.com	| |	Certificate Revocation List related traffic.
+|ocsp.digicert.com\*	| HTTP |	CRL and OCSP checks to the issuing certificate authorities.
 |officeclient.microsoft.com	| HTTPS |	Office related traffic.
 |oneclient.sfx.ms*	| HTTPS |	Used by OneDrive for Business to download and verify app updates.
-|purchase.mp.microsoft.com*	| HTTPS |	Used to communicate with Microsoft Store.
-|query.prod.cms.rt.microsoft.com*	| HTTPS |	Used to retrieve Windows Spotlight metadata.
-|ris.api.iris.microsoft.com*	|TLSv1.2/HTTPS |	Used to retrieve Windows Spotlight metadata.
+|purchase.mp.microsoft.com\*	| HTTPS |	Used to communicate with Microsoft Store.
+|query.prod.cms.rt.microsoft.com\*	| HTTPS |	Used to retrieve Windows Spotlight metadata.
+|ris.api.iris.microsoft.com\*	|TLSv1.2/HTTPS |	Used to retrieve Windows Spotlight metadata.
 |ris-prod-atm.trafficmanager.net	| HTTPS |	Azure traffic manager
-|settings.data.microsoft.com*	| HTTPS |	Used for Windows apps to dynamically update their configuration.
-|settings-win.data.microsoft.com*	| HTTPS |	Used for Windows apps to dynamically update their configuration.
-|sls.update.microsoft.com*	|TLSv1.2/HTTPS |	Enables connections to Windows Update.
-|store*.dsx.mp.microsoft.com*	| HTTPS |	Used to communicate with Microsoft Store.
-|storecatalogrevocation.storequality.microsoft.com*	| HTTPS |	Used to revoke licenses for malicious apps on the Microsoft Store.
-|store-images.s-microsoft.com*	| HTTP |	Used to get images that are used for Microsoft Store suggestions.
-|tile-service.weather.microsoft.com*	| HTTP |	Used to download updates to the Weather app Live Tile.
-|tsfe.trafficshaping.dsp.mp.microsoft.com*	|TLSv1.2 |	Used for content regulation.
+|settings.data.microsoft.com\*	| HTTPS |	Used for Windows apps to dynamically update their configuration.
+|settings-win.data.microsoft.com\*	| HTTPS |	Used for Windows apps to dynamically update their configuration.
+|sls.update.microsoft.com\*	|TLSv1.2/HTTPS |	Enables connections to Windows Update.
+|store*.dsx.mp.microsoft.com\*	| HTTPS |	Used to communicate with Microsoft Store.
+|storecatalogrevocation.storequality.microsoft.com\*	| HTTPS |	Used to revoke licenses for malicious apps on the Microsoft Store.
+|store-images.s-microsoft.com\*	| HTTP |	Used to get images that are used for Microsoft Store suggestions.
+|tile-service.weather.microsoft.com\*	| HTTP |	Used to download updates to the Weather app Live Tile.
+|tsfe.trafficshaping.dsp.mp.microsoft.com\*	|TLSv1.2 |	Used for content regulation.
 |v10.events.data.microsoft.com	| HTTPS |	Diagnostic Data
 |wdcp.microsoft.*	|TLSv1.2 |	Used for Windows Defender when Cloud-based Protection is enabled.
 |wd-prod-cp-us-west-1-fe.westus.cloudapp.azure.com	| HTTPS |	Windows Defender related traffic.
@@ -98,7 +99,7 @@ We used the following methodology to derive these network endpoints:
 | *.e-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
 | *.g.akamaiedge.net	| HTTPS |	Used to check for updates to maps that have been downloaded for offline use. |
 | *.s-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
-| *.tlu.dl.delivery.mp.microsoft.com/* | HTTP | Enables connections to Windows Update. |
+| \*.tlu.dl.delivery.mp.microsoft.com/\* | HTTP | Enables connections to Windows Update. |
 | *geo-prod.dodsp.mp.microsoft.com.nsatc.net	| HTTPS |	Enables connections to Windows Update. |
 | arc.msn.com.nsatc.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
 | au.download.windowsupdate.com/* | HTTP | Enables connections to Windows Update. |
@@ -111,7 +112,7 @@ We used the following methodology to derive these network endpoints:
 | ipv4.login.msa.akadns6.net	| HTTPS |	Used for Microsoft accounts to sign in. |
 | location-inference-westus.cloudapp.net	| HTTPS |	Used for location data. |
 | modern.watson.data.microsoft.com.akadns.net	| HTTPS |	Used by Windows Error Reporting. |
-| ocsp.digicert.com* |	HTTP | CRL and OCSP checks to the issuing certificate authorities. |
+| ocsp.digicert.com\* |	HTTP | CRL and OCSP checks to the issuing certificate authorities. |
 | ris.api.iris.microsoft.com.akadns.net	| HTTPS |	Used to retrieve Windows Spotlight metadata. |
 | tile-service.weather.microsoft.com/* | HTTP |	Used to download updates to the Weather app Live Tile. |
 | tsfe.trafficshaping.dsp.mp.microsoft.com	| HTTPS |	Used for content regulation. |
@@ -127,12 +128,12 @@ We used the following methodology to derive these network endpoints:
 | *.g.akamaiedge.net	| HTTPS |	Used to check for updates to maps that have been downloaded for offline use. |
 | *.s-msedge.net	| HTTPS |	Used by OfficeHub to get the metadata of Office apps. |
 | *.telecommand.telemetry.microsoft.com.akadns.net | HTTPS | Used by Windows Error Reporting. |
-| *.tlu.dl.delivery.mp.microsoft.com* | HTTP | Enables connections to Windows Update. |
-| *.windowsupdate.com* | HTTP | Enables connections to Windows Update. |
+| *.tlu.dl.delivery.mp.microsoft.com\* | HTTP | Enables connections to Windows Update. |
+| *.windowsupdate.com\* | HTTP | Enables connections to Windows Update. |
 | *geo-prod.do.dsp.mp.microsoft.com	| HTTPS |	Enables connections to Windows Update. |
-| au.download.windowsupdate.com* | HTTP | Enables connections to Windows Update. |
+| au.download.windowsupdate.com\* | HTTP | Enables connections to Windows Update. |
 | cdn.onenote.net/livetile/*	| HTTPS |	Used for OneNote Live Tile. |
-| client-office365-tas.msedge.net/*	| HTTPS |	Used to connect to the Office 365 portal’s shared infrastructure, including Office Online. |
+| client-office365-tas.msedge.net/*	| HTTPS |	Used to connect to the Office 365 portal’s shared infrastructure, including Office. |
 | config.edge.skype.com/*	| HTTPS |	Used to retrieve Skype configuration values.  |
 | ctldl.windowsupdate.com/* | HTTP | Used to download certificates that are publicly known to be fraudulent. |
 | cy2.displaycatalog.md.mp.microsoft.com.akadns.net	| HTTPS |	Used to communicate with Microsoft Store. |
@@ -151,7 +152,7 @@ We used the following methodology to derive these network endpoints:
 | maps.windows.com/windows-app-web-link	| HTTPS |	Link to Maps application |
 | modern.watson.data.microsoft.com.akadns.net	| HTTPS |	Used by Windows Error Reporting. |
 | ocos-office365-s2s.msedge.net/*	| HTTPS |	Used to connect to the Office 365 portal's shared infrastructure. |
-| ocsp.digicert.com* |	HTTP | CRL and OCSP checks to the issuing certificate authorities. |
+| ocsp.digicert.com\* |	HTTP | CRL and OCSP checks to the issuing certificate authorities. |
 | oneclient.sfx.ms/*	| HTTPS |	Used by OneDrive for Business to download and verify app updates. |
 | settings-win.data.microsoft.com/settings/*	| HTTPS |	Used as a way for apps to dynamically update their configuration. |
 | sls.update.microsoft.com/*	| HTTPS |	Enables connections to Windows Update. |
diff --git a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md
new file mode 100644
index 0000000000..6c791a5536
--- /dev/null
+++ b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md
@@ -0,0 +1,274 @@
+---
+title: Windows 10, version 1903, connection endpoints for non-Enterprise editions
+description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 1903.
+keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.localizationpriority: high
+audience: ITPro
+author: mikeedgar
+ms.author: v-medgar
+manager: sanashar
+ms.collection: M365-security-compliance
+ms.topic: article
+ms.date: 5/9/2019
+---
+# Windows 10, version 1903, connection endpoints for non-Enterprise editions
+
+ **Applies to**
+
+- Windows 10 Home, version 1903
+- Windows 10 Professional, version 1903
+- Windows 10 Education, version 1903
+
+In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-1903-endpoints.md), the following endpoints are available on other non-Enterprise editions of Windows 10, version 1903.
+
+The following methodology was used to derive the network endpoints:
+
+1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. 
+2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device).
+3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic.  
+4. Compile reports on traffic going to public IP addresses.
+5.  The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory.
+6.  All traffic was captured in our lab using a IPV4 network.  Therefore, no IPV6 traffic is reported here. 
+7.  These tests were conducted in an approved Microsoft lab.  It's possible your results may be different.
+8.  These tests were conducted for one week, but if you capture traffic for longer you may have different results.
+
+
+> [!NOTE]
+> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time.
+
+## Windows 10 Family
+
+| **Destination** | **Protocol** | **Description** |
+| --- | --- | --- |
+|\*.aria.microsoft.com*|HTTPS|Microsoft Office Telemetry
+|\*.b.akamai*.net|HTTPS|Used to check for updates to Maps that have been downloaded for offline use
+|\*.c-msedge.net|HTTP|Microsoft Office 
+|\*.dl.delivery.mp.microsoft.com*|HTTP|Enables connections to Windows Update
+|\*.download.windowsupdate.com*|HTTP|Used to download operating system patches and updates
+|\*.g.akamai*.net|HTTPS|Used to check for updates to Maps that have been downloaded for offline use
+|\*.login.msa.*.net|HTTPS|Microsoft Account related
+|\*.msn.com*|TLSv1.2/HTTPS|Windows Spotlight 
+|\*.skype.com|HTTP/HTTPS|Skype 
+|\*.smartscreen.microsoft.com*|HTTPS|Windows Defender Smartscreen 
+|\*.telecommand.telemetry.microsoft.com*|HTTPS|Used by Windows Error Reporting
+|*cdn.onenote.net*|HTTP|OneNote 
+|*displaycatalog.*mp.microsoft.com*|HTTPS|Used to communicate with Microsoft Store 
+|*emdl.ws.microsoft.com*|HTTP|Windows Update 
+|*geo-prod.do.dsp.mp.microsoft.com*|TLSv1.2/HTTPS|Enables connections to Windows Update 
+|*hwcdn.net*|HTTP|Highwinds Content Delivery Network / Windows updates 
+|*img-prod-cms-rt-microsoft-com*|HTTPS|Microsoft Store or Inbox MSN Apps image download 
+|*licensing.*mp.microsoft.com*|HTTPS|Licensing 
+|*maps.windows.com*|HTTPS|Related to Maps application 
+|*msedge.net*|HTTPS|Used by Microsoft OfficeHub to get the metadata of Microsoft Office apps 
+|*nexusrules.officeapps.live.com*|HTTPS|Microsoft Office Telemetry
+|*photos.microsoft.com*|HTTPS|Photos App 
+|*prod.do.dsp.mp.microsoft.com*|TLSv1.2/HTTPS|Used for Windows Update downloads of apps and OS updates 
+|*purchase.md.mp.microsoft.com.akadns.net|HTTPS|Used to communicate with Microsoft Store 
+|*settings.data.microsoft.com.akadns.net|HTTPS|Used for Windows apps to dynamically update their configuration
+|*wac.phicdn.net*|HTTP|Windows Update 
+|*windowsupdate.com*|HTTP|Windows Update 
+|*wns.*windows.com*|TLSv1.2/HTTPS|Used for the Windows Push Notification Services (WNS)
+|*wpc.v0cdn.net*|HTTP|Windows Telemetry 
+|arc.msn.com|HTTPS|Spotlight  
+|auth.gfx.ms*|HTTPS|MSA related
+|cdn.onenote.net|HTTPS|OneNote Live Tile
+|dmd.metaservices.microsoft.com*|HTTP|Device Authentication 
+|e-0009.e-msedge.net|HTTPS|Microsoft Office 
+|e10198.b.akamaiedge.net|HTTPS|Maps application 
+|evoke-windowsservices-tas.msedge*|HTTPS|Photos app 
+|fe2.update.microsoft.com*|TLSv1.2/HTTPS|Enables connections to Windows Update, Microsoft Update, and the online services of Microsoft Store
+|fe3.*.mp.microsoft.com.*|TLSv1.2/HTTPS|Windows Update, Microsoft Update, and Microsoft Store services 
+|g.live.com*|HTTPS|OneDrive 
+|go.microsoft.com|HTTP|Windows Defender
+|iriscoremetadataprod.blob.core.windows.net|HTTPS|Windows Telemetry
+|login.live.com|HTTPS|Device Authentication  
+|msagfx.live.com|HTTP|OneDrive 
+|ocsp.digicert.com*|HTTP|CRL and OCSP checks to the issuing certificate authorities
+|officeclient.microsoft.com|HTTPS|Microsoft Office 
+|oneclient.sfx.ms*|HTTPS|Used by OneDrive for Business to download and verify app updates
+|onecollector.cloudapp.aria.akadns.net|HTTPS|Microsoft Office
+|ow1.res.office365.com|HTTP|Microsoft Office
+|pti.store.microsoft.com|HTTPS|Microsoft Store
+|purchase.mp.microsoft.com*|HTTPS|Used to communicate with Microsoft Store
+|query.prod.cms.rt.microsoft.com*|HTTPS|Used to retrieve Windows Spotlight metadata
+|ris.api.iris.microsoft.com*|TLSv1.2/HTTPS|Used to retrieve Windows Spotlight metadata
+|ris-prod-atm.trafficmanager.net|HTTPS|Azure traffic manager
+|s-0001.s-msedge.net|HTTPS|Microsoft Office
+|self.events.data.microsoft.com|HTTPS|Microsoft Office
+|settings.data.microsoft.com*|HTTPS|Used for Windows apps to dynamically update their configuration
+|settings-win.data.microsoft.com*|HTTPS|Used for Windows apps to dynamically update their configuration
+|share.microsoft.com|HTTPS|Microsoft Store
+|skypeecs-prod-usw-0.cloudapp.net|HTTPS|Microsoft Store
+|sls.update.microsoft.com*|TLSv1.2/HTTPS|Enables connections to Windows Update
+|slscr.update.microsoft.com*|HTTPS|Enables connections to Windows Update
+|store*.dsx.mp.microsoft.com*|HTTPS|Used to communicate with Microsoft Store
+|storecatalogrevocation.storequality.microsoft.com|HTTPS|Microsoft Store
+|storecatalogrevocation.storequality.microsoft.com*|HTTPS|Used to revoke licenses for malicious apps on the Microsoft Store
+|store-images.*microsoft.com*|HTTP|Used to get images that are used for Microsoft Store suggestions
+|storesdk.dsx.mp.microsoft.com|HTTP|Microsoft Store
+|tile-service.weather.microsoft.com*|HTTP|Used to download updates to the Weather app Live Tile
+|time.windows.com|HTTP|Microsoft Windows Time related
+|tsfe.trafficshaping.dsp.mp.microsoft.com*|TLSv1.2/HTTPS|Used for content regulation
+|v10.events.data.microsoft.com|HTTPS|Diagnostic Data
+|watson.telemetry.microsoft.com|HTTPS|Diagnostic Data
+|wdcp.microsoft.*|TLSv1.2, HTTPS|Used for Windows Defender when Cloud-based Protection is enabled
+|wd-prod-cp-us-west-1-fe.westus.cloudapp.azure.com|HTTPS|Windows Defender 
+|wusofficehome.msocdn.com|HTTPS|Microsoft Office
+|www.bing.com*|HTTP|Used for updates for Cortana, apps, and Live Tiles
+|www.msftconnecttest.com|HTTP|Network Connection (NCSI)
+|www.office.com|HTTPS|Microsoft Office
+
+
+## Windows 10 Pro
+
+| **Destination** | **Protocol** | **Description** |
+| --- | --- | --- |
+|\*.cloudapp.azure.com|HTTPS|Azure 
+|\*.delivery.dsp.mp.microsoft.com.nsatc.net|HTTPS|Windows Update, Microsoft Update, and Microsoft Store services 
+|\*.displaycatalog.md.mp.microsoft.com.akadns.net|HTTPS|Microsoft Store 
+|\*.dl.delivery.mp.microsoft.com*|HTTP|Enables connections to Windows Update
+|\*.e-msedge.net|HTTPS|Used by OfficeHub to get the metadata of Office apps
+|\*.g.akamaiedge.net|HTTPS|Used to check for updates to maps that have been downloaded for offline use
+|\*.s-msedge.net|HTTPS|Used by OfficeHub to get the metadata of Office apps
+|\*.windowsupdate.com*|HTTP|Enables connections to Windows Update
+|\*.wns.notify.windows.com.akadns.net|HTTPS|Used for the Windows Push Notification Services (WNS)
+|\*dsp.mp.microsoft.com.nsatc.net|HTTPS|Enables connections to Windows Update
+|\*c-msedge.net|HTTP|Office
+|a1158.g.akamai.net|HTTP|Maps application 
+|arc.msn.com*|HTTP / HTTPS|Used to retrieve Windows Spotlight metadata
+|blob.mwh01prdstr06a.store.core.windows.net|HTTPS|Microsoft Store 
+|browser.pipe.aria.microsoft.com|HTTPS|Microsoft Office 
+|bubblewitch3mobile.king.com|HTTPS|Bubble Witch application 
+|candycrush.king.com|HTTPS|Candy Crush application 
+|cdn.onenote.net|HTTP|Microsoft OneNote 
+|cds.p9u4n2q3.hwcdn.net|HTTP|Highwinds Content Delivery Network traffic for Windows updates
+|client.wns.windows.com|HTTPS|Winddows Notification System 
+|co4.telecommand.telemetry.microsoft.com.akadns.net|HTTPS|Windows Error Reporting 
+|config.edge.skype.com|HTTPS|Microsoft Skype 
+|cs11.wpc.v0cdn.net|HTTP|Windows Telemetry 
+|cs9.wac.phicdn.net|HTTP|Windows Update 
+|cy2.licensing.md.mp.microsoft.com.akadns.net|HTTPS|Used to communicate with Microsoft Store
+|cy2.purchase.md.mp.microsoft.com.akadns.net|HTTPS|Used to communicate with Microsoft Store
+|cy2.settings.data.microsoft.com.akadns.net|HTTPS|Used to communicate with Microsoft Store
+|dmd.metaservices.microsoft.com.akadns.net|HTTP|Device Authentication 
+|e-0009.e-msedge.net|HTTPS|Microsoft Office 
+|e10198.b.akamaiedge.net|HTTPS|Maps application 
+|fe3.update.microsoft.com|HTTPS|Windows Update 
+|g.live.com|HTTPS|Microsoft OneDrive 
+|g.msn.com.nsatc.net|HTTPS|Used to retrieve Windows Spotlight metadata
+|geo-prod.do.dsp.mp.microsoft.com|HTTPS|Windows Update 
+|go.microsoft.com|HTTP|Windows Defender 
+|iecvlist.microsoft.com|HTTPS|Microsoft Edge 
+|img-prod-cms-rt-microsoft-com.akamaized.net|HTTP / HTTPS|Microsoft Store 
+|ipv4.login.msa.akadns6.net|HTTPS|Used for Microsoft accounts to sign in
+|licensing.mp.microsoft.com|HTTP|Licensing 
+|location-inference-westus.cloudapp.net|HTTPS|Used for location data
+|login.live.com|HTTP|Device Authentication 
+|maps.windows.com|HTTP|Maps application 
+|modern.watson.data.microsoft.com.akadns.net|HTTPS|Used by Windows Error Reporting
+|msagfx.live.com|HTTP|OneDrive 
+|nav.smartscreen.microsoft.com|HTTPS|Windows Defender 
+|ocsp.digicert.com*|HTTP|CRL and OCSP checks to the issuing certificate authorities
+|oneclient.sfx.ms|HTTP|OneDrive 
+|pti.store.microsoft.com|HTTPS|Microsoft Store 
+|ris.api.iris.microsoft.com.akadns.net|HTTPS|Used to retrieve Windows Spotlight metadata
+|ris-prod-atm.trafficmanager.net|HTTPS|Azure 
+|s2s.config.skype.com|HTTP|Microsoft Skype 
+|settings-win.data.microsoft.com|HTTPS|Application settings 
+|share.microsoft.com|HTTPS|Microsoft Store 
+|skypeecs-prod-usw-0.cloudapp.net|HTTPS|Microsoft Skype 
+|slscr.update.microsoft.com|HTTPS|Windows Update 
+|storecatalogrevocation.storequality.microsoft.com|HTTPS|Microsoft Store 
+|store-images.microsoft.com|HTTPS|Microsoft Store 
+|tile-service.weather.microsoft.com/*|HTTP|Used to download updates to the Weather app Live Tile
+|time.windows.com|HTTP|Windows time 
+|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTPS|Used for content regulation
+|v10.events.data.microsoft.com*|HTTPS|Microsoft Office 
+|vip5.afdorigin-prod-am02.afdogw.com|HTTPS|Used to serve office 365 experimentation traffic
+|watson.telemetry.microsoft.com|HTTPS|Telemetry 
+|wdcp.microsoft.com|HTTPS|Windows Defender 
+|wusofficehome.msocdn.com|HTTPS|Microsoft Office 
+|www.bing.com|HTTPS|Cortana and Search 
+|www.microsoft.com|HTTP|Diagnostic 
+|www.msftconnecttest.com|HTTP|Network connection 
+|www.office.com|HTTPS|Microsoft Office
+
+
+
+## Windows 10 Education
+
+| **Destination** | **Protocol** | **Description** |
+| --- | --- | --- |
+|\*.b.akamaiedge.net|HTTPS|Used to check for updates to maps that have been downloaded for offline use
+|\*.c-msedge.net|HTTP|Used by OfficeHub to get the metadata of Office apps
+|\*.dl.delivery.mp.microsoft.com*|HTTP|Windows Update
+|\*.e-msedge.net|HTTPS|Used by OfficeHub to get the metadata of Office apps
+|\*.g.akamaiedge.net|HTTPS|Used to check for updates to Maps that have been downloaded for offline use
+|\*.licensing.md.mp.microsoft.com.akadns.net|HTTPS|Microsoft Store
+|\*.settings.data.microsoft.com.akadns.net|HTTPS|Microsoft Store
+|\*.skype.com*|HTTPS|Used to retrieve Skype configuration values 
+|\*.smartscreen*.microsoft.com|HTTPS|Windows Defender 
+|\*.s-msedge.net|HTTPS|Used by OfficeHub to get the metadata of Office apps
+|\*.telecommand.telemetry.microsoft.com*|HTTPS|Used by Windows Error Reporting
+|\*.wac.phicdn.net|HTTP|Windows Update 
+|\*.windowsupdate.com*|HTTP|Windows Update
+|\*.wns.windows.com|HTTPS|Windows Notifications Service 
+|\*.wpc.*.net|HTTP|Diagnostic Data
+|\*displaycatalog.md.mp.microsoft.com.akadns.net|HTTPS|Microsoft Store
+|\*dsp.mp.microsoft.com|HTTPS|Windows Update
+|a1158.g.akamai.net|HTTP|Maps 
+|a122.dscg3.akamai.net|HTTP|Maps 
+|a767.dscg3.akamai.net|HTTP|Maps 
+|au.download.windowsupdate.com*|HTTP|Windows Update
+|bing.com/*|HTTPS|Used for updates for Cortana, apps, and Live Tiles
+|blob.dz5prdstr01a.store.core.windows.net|HTTPS|Microsoft Store 
+|browser.pipe.aria.microsoft.com|HTTP|Used by OfficeHub to get the metadata of Office apps
+|cdn.onenote.net/livetile/*|HTTPS|Used for OneNote Live Tile
+|cds.p9u4n2q3.hwcdn.net|HTTP|Used by the Highwinds Content Delivery Network to perform Windows updates
+|client-office365-tas.msedge.net/*|HTTPS|Office 365 portal and Office in a browser
+|ctldl.windowsupdate.com*|HTTP|Used to download certificates that are publicly known to be fraudulent
+|displaycatalog.mp.microsoft.com/*|HTTPS|Microsoft Store
+|dmd.metaservices.microsoft.com*|HTTP|Device Authentication
+|download.windowsupdate.com*|HTTPS|Windows Update
+|emdl.ws.microsoft.com/*|HTTP|Used to download apps from the Microsoft Store
+|evoke-windowsservices-tas.msedge.net|HTTPS|Photo app 
+|fe2.update.microsoft.com*|HTTPS|Windows Update, Microsoft Update, Microsoft Store services 
+|fe3.delivery.dsp.mp.microsoft.com.nsatc.net|HTTPS|Windows Update, Microsoft Update, Microsoft Store services 
+|fe3.delivery.mp.microsoft.com*|HTTPS|Windows Update, Microsoft Update, Microsoft Store services 
+|g.live.com*|HTTPS|Used by OneDrive for Business to download and verify app updates
+|g.msn.com.nsatc.net|HTTPS|Used to retrieve Windows Spotlight metadata
+|go.microsoft.com|HTTP|Windows Defender 
+|iecvlist.microsoft.com|HTTPS|Microsoft Edge browser 
+|ipv4.login.msa.akadns6.net|HTTPS|Used for Microsoft accounts to sign in
+|licensing.mp.microsoft.com*|HTTPS|Used for online activation and some app licensing
+|login.live.com|HTTPS|Device Authentication
+|maps.windows.com/windows-app-web-link|HTTPS|Maps application
+|modern.watson.data.microsoft.com.akadns.net|HTTPS|Used by Windows Error Reporting
+|msagfx.live.com|HTTPS|OneDrive 
+|ocos-office365-s2s.msedge.net/*|HTTPS|Used to connect to the Office 365 portal's shared infrastructure
+|ocsp.digicert.com*|HTTP|CRL and OCSP checks to the issuing certificate authorities
+|oneclient.sfx.ms/*|HTTPS|Used by OneDrive for Business to download and verify app updates
+|onecollector.cloudapp.aria.akadns.net|HTTPS|Microsoft Office 
+|pti.store.microsoft.com|HTTPS|Microsoft Store 
+|settings-win.data.microsoft.com/settings/*|HTTPS|Used as a way for apps to dynamically update their configuration 
+|share.microsoft.com|HTTPS|Microsoft Store 
+|skypeecs-prod-usw-0.cloudapp.net|HTTPS|Skype 
+|sls.update.microsoft.com*|HTTPS|Windows Update
+|storecatalogrevocation.storequality.microsoft.com*|HTTPS|Used to revoke licenses for malicious apps on the Microsoft Store
+|tile-service.weather.microsoft.com*|HTTP|Used to download updates to the Weather app Live Tile
+|tsfe.trafficshaping.dsp.mp.microsoft.com|HTTPS|Windows Update 
+|v10.events.data.microsoft.com*|HTTPS|Diagnostic Data
+|vip5.afdorigin-prod-ch02.afdogw.com|HTTPS|Used to serve Office 365 experimentation traffic
+|watson.telemetry.microsoft.com*|HTTPS|Used by Windows Error Reporting
+|wdcp.microsoft.com|HTTPS|Windows Defender 
+|wd-prod-cp-us-east-1-fe.eastus.cloudapp.azure.com|HTTPS|Azure 
+|wusofficehome.msocdn.com|HTTPS|Microsoft Office 
+|www.bing.com|HTTPS|Cortana and Search 
+|www.microsoft.com|HTTP|Diagnostic Data
+|www.microsoft.com/pkiops/certs/*|HTTP|CRL and OCSP checks to the issuing certificate authorities
+|www.msftconnecttest.com|HTTP|Network Connection 
+|www.office.com|HTTPS|Microsoft Office
+
diff --git a/windows/privacy/windows-personal-data-services-configuration.md b/windows/privacy/windows-personal-data-services-configuration.md
index bb0d5fa4f5..273f2bac8d 100644
--- a/windows/privacy/windows-personal-data-services-configuration.md
+++ b/windows/privacy/windows-personal-data-services-configuration.md
@@ -1,407 +1,408 @@
----
-title: Windows 10 personal data services configuration
-description: An overview of Windows 10 services configuration settings that are used for personal data privacy protection relevant for regulations, such as the General Data Protection Regulation (GDPR)
-keywords: privacy, GDPR, windows, IT
-ms.prod: w10
-ms.mktglfcycl: manage
-ms.sitesec: library
-ms.pagetype: security
-ms.localizationpriority: high
-audience: ITPro
-author: danihalfin
-ms.author: daniha
-manager: dansimp
-ms.collection: M365-security-compliance
-ms.topic: article
-ms.date: 05/11/2018
----
-# Windows 10 personal data services configuration
-
-Applies to:
-- Windows 10, version 1803
-
-Microsoft assembled a list of Windows 10 services configuration settings that are useful for personal data privacy protection and related regulations, such as the General Data Protection Regulation (GDPR). There is one section with settings for service data that is managed at Microsoft and a section for local data that is managed by an IT organization.
-
-IT Professionals that are interested in applying these settings via group policies can find the configuration for download [here](https://go.microsoft.com/fwlink/?linkid=874149).
-
-## Introduction
-
-Microsoft collects data from or generates it through interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, support, and improve Windows 10 services.
-
-Many Windows 10 services are controller services. A user can manage data collection settings, for example by opening *Start > Settings > Privacy* or by visiting the [Microsoft Privacy dashboard](https://account.microsoft.com/privacy). While this relationship between Microsoft and a user is evident in a consumer type scenario, an IT organization can influence that relationship. For example, the IT department has the ability to configure the Windows diagnostic data level across their organization by using Group Policy, registry, or Mobile Device Management (MDM) settings.
-
-Below is a collection of settings related to the Windows 10 personal data services configuration that IT Professionals can use as guidance for influencing Windows diagnostic data collection and personal data protection.
-
-## Windows diagnostic data
-
-Windows 10 collects Windows diagnostic data—such as usage data, performance data, inking, typing, and utterance data—and sends it back to Microsoft. That data is used for keeping the operating system secure and up-to-date, to troubleshoot problems, and to make product improvements. For users who have turned on "Tailored experiences", that data can also be used to offer personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs.
-
-The following options for configuring Windows diagnostic data are relevant in this context.
-
-### Diagnostic level
-
-This setting determines the amount of Windows diagnostic data sent to Microsoft.
-
->[!NOTE]
->In Windows 10, version 1709, Microsoft introduced a new feature: “Limit Enhanced diagnostic data to the minimum required by Windows Analytics”. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by [Windows Analytics](https://www.microsoft.com/windowsforbusiness/windows-analytics). For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds |
->| **Policy Name** | Allow Telemetry |
->| **Default setting** | 2 - Enhanced |
->| **Recommended** | 2 - Enhanced |
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds |
->| **Policy Name** | Allow Telemetry |
->| **Default setting** | 2 - Enhanced |
->| **Recommended** | 2 - Enhanced |
-
->[!NOTE]
->When both the Computer Configuration policy and User Configuration policy are set, the more restrictive policy is used.
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection |
->| **Value** | AllowTelemetry |
->| **Type** | REG_DWORD |
->| **Setting** | "00000002" |
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKCU\Software\Policies\Microsoft\Windows\DataCollection |
->| **Value** | AllowTelemetry |
->| **Type** | REG_DWORD |
->| **Setting** | "00000002" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | System |
->| **Policy** | AllowTelemetry (scope: device and user)  |
->| **Default setting** | 2 – Enhanced |
->| **Recommended** | 2 – Allowed |
-
-### Diagnostic opt-in change notifications
-
-This setting determines whether a device shows notifications about Windows diagnostic data levels to people on first logon or when changes occur in the diagnostic configuration.
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds |
->| **Policy Name** | Configure telemetry opt-in change notifications |
->| **Default setting** | Enabled |
->| **Recommended** | Enabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection |
->| **Value** | DisableTelemetryOptInChangeNotification |
->| **Type** | REG_DWORD |
->| **Setting** | "00000000" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | System |
->| **Policy** | ConfigureTelemetryOptInChangeNotification  |
->| **Default setting** | 0 – Enabled |
->| **Recommended** | 0 – Enabled |
-
-### Configure telemetry opt-in setting user interface
-
-This setting determines whether people can change their own Windows diagnostic data level in *Start > Settings > Privacy > Diagnostics & feedback*.
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds |
->| **Policy Name** | Configure telemetry opt-in setting user interface |
->| **Default setting** | Enabled |
->| **Recommended** | Enabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection |
->| **Value** | DisableTelemetryOptInSettingsUx |
->| **Type** | REG_DWORD |
->| **Setting** | "00000001" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | System |
->| **Policy** | ConfigureTelemetryOptInSettingsUx  |
->| **Default setting** | 0 – Enabled |
->| **Recommended** | 0 – Enabled |
-
-## Policies affecting personal data protection managed by the Enterprise IT
-
-There are additional settings usually managed by the Enterprise IT that also affect the protection of personal data.
-
-The following options for configuring these policies are relevant in this context.
-
-### BitLocker
-
-The following settings determine whether fixed and removable drives are protected by the BitLocker Drive Encryption.
-
-#### Fixed Data Drives
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption\Fixed Data Drives |
->| **Policy Name** | Deny write access to fixed drives not protected by BitLocker |
->| **Default setting** | Not configured |
->| **Recommended** | Enabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE |
->| **Value** | FDVDenyWriteAccess |
->| **Type** | REG_DWORD |
->| **Setting** | "00000001" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | BitLocker |
->| **Policy** | FixedDrivesRequireEncryption  |
->| **Default setting** | Disabled |
->| **Recommended** | Enabled (see [instructions](/windows/client-management/mdm/bitlocker-csp#fixeddrivesrequireencryption)) |
-
-#### Removable Data Drives
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption\Removable Data Drives |
->| **Policy Name** | Deny write access to removable drives not protected by BitLocker |
->| **Default setting** | Not configured |
->| **Recommended** | Enabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE |
->| **Value** | RDVDenyWriteAccess |
->| **Type** | REG_DWORD |
->| **Setting** | "00000001" |
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\FVE |
->| **Value** | RDVDenyCrossOrg |
->| **Type** | REG_DWORD |
->| **Setting** | "00000000" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | BitLocker |
->| **Policy** | RemovableDrivesRequireEncryption  |
->| **Default setting** | Disabled |
->| **Recommended** | Enabled (see [instructions](/windows/client-management/mdm/bitlocker-csp#removabledrivesrequireencryption)) |
-
-### Privacy – AdvertisingID
-
-This setting determines if the advertising ID, which preventing apps from using the ID for experiences across apps, is turned off.
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\System\User Profiles |
->| **Policy Name** | Turn off the advertising ID |
->| **Default setting** | Not configured |
->| **Recommended** | Enabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo |
->| **Value** | DisabledByGroupPolicy |
->| **Type** | REG_DWORD |
->| **Setting** | "00000001" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | Privacy |
->| **Policy** | DisableAdvertisingId  |
->| **Default setting** | 65535 (default) - Not configured |
->| **Recommended** | 1 – Enabled |
-
-### Edge
-
-These settings whether employees send “Do Not Track” from the Microsoft Edge web browser to websites.
-
->[!NOTE]
->Please see [this Microsoft blog post](https://blogs.microsoft.com/on-the-issues/2015/04/03/an-update-on-microsofts-approach-to-do-not-track/) for more details on why the “Do Not Track” is no longer the default setting.
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge |
->| **Policy Name** | Configure Do Not Track |
->| **Default setting** | Disabled |
->| **Recommended** | Disabled |
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Microsoft Edge |
->| **Policy Name** | Configure Do Not Track |
->| **Default setting** | Disabled |
->| **Recommended** | Disabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main |
->| **Value** | DoNotTrack |
->| **Type** | REG_DWORD |
->| **Setting** | "00000000" |
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Registry key** | HKCU\Software\Policies\Microsoft\MicrosoftEdge\Main |
->| **Value** | DoNotTrack |
->| **Type** | REG_DWORD |
->| **Setting** | "00000000" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **MDM CSP** | Browser |
->| **Policy** | AllowDoNotTrack (scope: device + user)  |
->| **Default setting** | 0 (default) – Not allowed |
->| **Recommended** | 0 – Not allowed |
-
-### Internet Explorer
-
-These settings whether employees send “Do Not Track” header from the Microsoft Explorer web browser to websites.
-
-#### Group Policy
-
-> [!div class="mx-tableFixed"]
->| | |
->|:-|:-|
->| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |
->| **Policy Name** | Always send Do Not Track header |
->| **Default setting** | Disabled |
->| **Recommended** | Disabled |
-
-> [!div class="mx-tableFixed"]
->|||
->|:-|:-|
->| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |
->| **Policy Name** | Always send Do Not Track header |
->| **Default setting** | Disabled |
->| **Recommended** | Disabled |
-
-#### Registry
-
-> [!div class="mx-tableFixed"]
->|||
->|:-|:-|
->| **Registry key** | HKLM\Software\Policies\Microsoft\Internet Explorer\Main |
->| **Value** | DoNotTrack |
->| **Type** | REG_DWORD |
->| **Setting** | "00000000" |
-
-> [!div class="mx-tableFixed"]
->|||
->|:-|:-|
->| **Registry key** | HKCU\Software\Policies\Microsoft\Internet Explorer\Main |
->| **Value** | DoNotTrack |
->| **Type** | REG_DWORD |
->| **Setting** | "00000000" |
-
-#### MDM
-
-> [!div class="mx-tableFixed"]
->|||
->|:-|:-|
->| **MDM CSP** | N/A |
-
-## Additional resources
-
-### FAQs
-
-* [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy)
-* [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy)
-* [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy)
-* [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense)
-
-### Blogs
-
-* [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10)
-
-### Privacy Statement
-
-* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
-
-### Windows Privacy on docs.microsoft.com
-
-* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
-* [Manage Windows 10 connection endpoints](manage-windows-endpoints.md)
-* [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data)
-* [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
-
-### Other resources
-
-* [Privacy at Microsoft](https://privacy.microsoft.com/)
+---
+title: Windows 10 personal data services configuration
+description: Learn more about Windows 10 configuration settings that are useful for complying with regulations such as the GDPR and protecting users' personal data.
+keywords: privacy, GDPR, windows, IT
+ms.prod: w10
+ms.mktglfcycl: manage
+ms.sitesec: library
+ms.pagetype: security
+ms.localizationpriority: high
+audience: ITPro
+author: dansimp
+ms.author: dansimp
+manager: dansimp
+ms.collection: M365-security-compliance
+ms.topic: article
+ms.date: 05/11/2018
+ms.reviewer: 
+---
+# Windows 10 personal data services configuration
+
+Applies to:
+- Windows 10, version 1803 and newer
+
+Microsoft assembled a list of Windows 10 services configuration settings that are useful for personal data privacy protection and related regulations, such as the General Data Protection Regulation (GDPR). There is one section with settings for service data that is managed at Microsoft and a section for local data that is managed by an IT organization.
+
+IT Professionals that are interested in applying these settings via group policies can find the configuration for download [here](https://go.microsoft.com/fwlink/?linkid=874149).
+
+## Introduction
+
+Microsoft collects data from or generates it through interactions with users of Windows 10 devices. This information can contain personal data that may be used to provide, support, and improve Windows 10 services.
+
+Many Windows 10 services are controller services. A user can manage data collection settings, for example by opening *Start > Settings > Privacy* or by visiting the [Microsoft Privacy dashboard](https://account.microsoft.com/privacy). While this relationship between Microsoft and a user is evident in a consumer type scenario, an IT organization can influence that relationship. For example, the IT department has the ability to configure the Windows diagnostic data level across their organization by using Group Policy, registry, or Mobile Device Management (MDM) settings.
+
+Below is a collection of settings related to the Windows 10 personal data services configuration that IT Professionals can use as guidance for influencing Windows diagnostic data collection and personal data protection.
+
+## Windows diagnostic data
+
+Windows 10 collects Windows diagnostic data—such as usage data, performance data, inking, typing, and utterance data—and sends it back to Microsoft. That data is used for keeping the operating system secure and up-to-date, to troubleshoot problems, and to make product improvements. For users who have turned on "Tailored experiences", that data can also be used to offer personalized tips, ads, and recommendations to enhance Microsoft products and services for your needs.
+
+The following options for configuring Windows diagnostic data are relevant in this context.
+
+### Diagnostic level
+
+This setting determines the amount of Windows diagnostic data sent to Microsoft.
+
+>[!NOTE]
+>In Windows 10, version 1709, Microsoft introduced a new feature: “Limit Enhanced diagnostic data to the minimum required by Windows Analytics”. When enabled, this feature limits the operating system diagnostic data events included in the Enhanced level to the smallest set of data required by [Windows Analytics](https://www.microsoft.com/windowsforbusiness/windows-analytics). For more information on the Enhanced level, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md).
+
+#### Group Policy
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds |
+>| **Policy Name** | Allow Telemetry |
+>| **Default setting** | 2 - Enhanced |
+>| **Recommended** | 2 - Enhanced |
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds |
+>| **Policy Name** | Allow Telemetry |
+>| **Default setting** | 2 - Enhanced |
+>| **Recommended** | 2 - Enhanced |
+
+>[!NOTE]
+>When both the Computer Configuration policy and User Configuration policy are set, the more restrictive policy is used.
+
+#### Registry
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection |
+>| **Value** | AllowTelemetry |
+>| **Type** | REG_DWORD |
+>| **Setting** | "00000002" |
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Registry key** | HKCU\Software\Policies\Microsoft\Windows\DataCollection |
+>| **Value** | AllowTelemetry |
+>| **Type** | REG_DWORD |
+>| **Setting** | "00000002" |
+
+#### MDM
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **MDM CSP** | System |
+>| **Policy** | AllowTelemetry (scope: device and user)  |
+>| **Default setting** | 2 – Enhanced |
+>| **Recommended** | 2 – Allowed |
+
+### Diagnostic opt-in change notifications
+
+This setting determines whether a device shows notifications about Windows diagnostic data levels to people on first logon or when changes occur in the diagnostic configuration.
+
+#### Group Policy
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds |
+>| **Policy Name** | Configure telemetry opt-in change notifications |
+>| **Default setting** | Enabled |
+>| **Recommended** | Enabled |
+
+#### Registry
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection |
+>| **Value** | DisableTelemetryOptInChangeNotification |
+>| **Type** | REG_DWORD |
+>| **Setting** | "00000000" |
+
+#### MDM
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **MDM CSP** | System |
+>| **Policy** | ConfigureTelemetryOptInChangeNotification  |
+>| **Default setting** | 0 – Enabled |
+>| **Recommended** | 0 – Enabled |
+
+### Configure telemetry opt-in setting user interface
+
+This setting determines whether people can change their own Windows diagnostic data level in *Start > Settings > Privacy > Diagnostics & feedback*.
+
+#### Group Policy
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds |
+>| **Policy Name** | Configure telemetry opt-in setting user interface |
+>| **Default setting** | Enabled |
+>| **Recommended** | Enabled |
+
+#### Registry
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\DataCollection |
+>| **Value** | DisableTelemetryOptInSettingsUx |
+>| **Type** | REG_DWORD |
+>| **Setting** | "00000001" |
+
+#### MDM
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **MDM CSP** | System |
+>| **Policy** | ConfigureTelemetryOptInSettingsUx  |
+>| **Default setting** | 0 – Enabled |
+>| **Recommended** | 0 – Enabled |
+
+## Policies affecting personal data protection managed by the Enterprise IT
+
+There are additional settings usually managed by the Enterprise IT that also affect the protection of personal data.
+
+The following options for configuring these policies are relevant in this context.
+
+### BitLocker
+
+The following settings determine whether fixed and removable drives are protected by the BitLocker Drive Encryption.
+
+#### Fixed Data Drives
+
+#### Group Policy
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption\Fixed Data Drives |
+>| **Policy Name** | Deny write access to fixed drives not protected by BitLocker |
+>| **Default setting** | Not configured |
+>| **Recommended** | Enabled |
+
+#### Registry
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Registry key** | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE |
+>| **Value** | FDVDenyWriteAccess |
+>| **Type** | REG_DWORD |
+>| **Setting** | "00000001" |
+
+#### MDM
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **MDM CSP** | BitLocker |
+>| **Policy** | FixedDrivesRequireEncryption  |
+>| **Default setting** | Disabled |
+>| **Recommended** | Enabled (see [instructions](/windows/client-management/mdm/bitlocker-csp#fixeddrivesrequireencryption)) |
+
+#### Removable Data Drives
+
+#### Group Policy
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Bitlocker Drive Encryption\Removable Data Drives |
+>| **Policy Name** | Deny write access to removable drives not protected by BitLocker |
+>| **Default setting** | Not configured |
+>| **Recommended** | Enabled |
+
+#### Registry
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Registry key** | HKLM\System\CurrentControlSet\Policies\Microsoft\FVE |
+>| **Value** | RDVDenyWriteAccess |
+>| **Type** | REG_DWORD |
+>| **Setting** | "00000001" |
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Registry key** | HKLM\Software\Policies\Microsoft\FVE |
+>| **Value** | RDVDenyCrossOrg |
+>| **Type** | REG_DWORD |
+>| **Setting** | "00000000" |
+
+#### MDM
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **MDM CSP** | BitLocker |
+>| **Policy** | RemovableDrivesRequireEncryption  |
+>| **Default setting** | Disabled |
+>| **Recommended** | Enabled (see [instructions](/windows/client-management/mdm/bitlocker-csp#removabledrivesrequireencryption)) |
+
+### Privacy – AdvertisingID
+
+This setting determines if the advertising ID, which preventing apps from using the ID for experiences across apps, is turned off.
+
+#### Group Policy
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Group Policy** | Computer Configuration\Administrative Templates\System\User Profiles |
+>| **Policy Name** | Turn off the advertising ID |
+>| **Default setting** | Not configured |
+>| **Recommended** | Enabled |
+
+#### Registry
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Registry key** | HKLM\Software\Policies\Microsoft\Windows\AdvertisingInfo |
+>| **Value** | DisabledByGroupPolicy |
+>| **Type** | REG_DWORD |
+>| **Setting** | "00000001" |
+
+#### MDM
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **MDM CSP** | Privacy |
+>| **Policy** | DisableAdvertisingId  |
+>| **Default setting** | 65535 (default) - Not configured |
+>| **Recommended** | 1 – Enabled |
+
+### Edge
+
+These settings whether employees send “Do Not Track” from the Microsoft Edge web browser to websites.
+
+>[!NOTE]
+>Please see [this Microsoft blog post](https://blogs.microsoft.com/on-the-issues/2015/04/03/an-update-on-microsofts-approach-to-do-not-track/) for more details on why the “Do Not Track” is no longer the default setting.
+
+#### Group Policy
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge |
+>| **Policy Name** | Configure Do Not Track |
+>| **Default setting** | Disabled |
+>| **Recommended** | Disabled |
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Microsoft Edge |
+>| **Policy Name** | Configure Do Not Track |
+>| **Default setting** | Disabled |
+>| **Recommended** | Disabled |
+
+#### Registry
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Registry key** | HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main |
+>| **Value** | DoNotTrack |
+>| **Type** | REG_DWORD |
+>| **Setting** | "00000000" |
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Registry key** | HKCU\Software\Policies\Microsoft\MicrosoftEdge\Main |
+>| **Value** | DoNotTrack |
+>| **Type** | REG_DWORD |
+>| **Setting** | "00000000" |
+
+#### MDM
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **MDM CSP** | Browser |
+>| **Policy** | AllowDoNotTrack (scope: device + user)  |
+>| **Default setting** | 0 (default) – Not allowed |
+>| **Recommended** | 0 – Not allowed |
+
+### Internet Explorer
+
+These settings whether employees send “Do Not Track” header from the Microsoft Explorer web browser to websites.
+
+#### Group Policy
+
+> [!div class="mx-tableFixed"]
+>| | |
+>|:-|:-|
+>| **Group Policy** | Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |
+>| **Policy Name** | Always send Do Not Track header |
+>| **Default setting** | Disabled |
+>| **Recommended** | Disabled |
+
+> [!div class="mx-tableFixed"]
+>|||
+>|:-|:-|
+>| **Group Policy** | User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page |
+>| **Policy Name** | Always send Do Not Track header |
+>| **Default setting** | Disabled |
+>| **Recommended** | Disabled |
+
+#### Registry
+
+> [!div class="mx-tableFixed"]
+>|||
+>|:-|:-|
+>| **Registry key** | HKLM\Software\Policies\Microsoft\Internet Explorer\Main |
+>| **Value** | DoNotTrack |
+>| **Type** | REG_DWORD |
+>| **Setting** | "00000000" |
+
+> [!div class="mx-tableFixed"]
+>|||
+>|:-|:-|
+>| **Registry key** | HKCU\Software\Policies\Microsoft\Internet Explorer\Main |
+>| **Value** | DoNotTrack |
+>| **Type** | REG_DWORD |
+>| **Setting** | "00000000" |
+
+#### MDM
+
+> [!div class="mx-tableFixed"]
+>|||
+>|:-|:-|
+>| **MDM CSP** | N/A |
+
+## Additional resources
+
+### FAQs
+
+* [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy)
+* [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy)
+* [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy)
+* [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense)
+
+### Blogs
+
+* [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10)
+
+### Privacy Statement
+
+* [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement)
+
+### Windows Privacy on docs.microsoft.com
+
+* [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md)
+* [Manage connections from Windows 10 operating system components to Microsoft services](https://docs.microsoft.com/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services)
+* [Understanding Windows diagnostic data](configure-windows-diagnostic-data-in-your-organization.md#understanding-windows-diagnostic-data)
+* [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md)
+
+### Other resources
+
+* [Privacy at Microsoft](https://privacy.microsoft.com/)
diff --git a/windows/release-information/TOC.md b/windows/release-information/TOC.md
new file mode 100644
index 0000000000..f0457af621
--- /dev/null
+++ b/windows/release-information/TOC.md
@@ -0,0 +1,36 @@
+# [Windows 10 release information](index.md)
+# [Message center](windows-message-center.yml)
+# Version 1909
+## [Known issues and notifications](status-windows-10-1909.yml)
+## [Resolved issues](resolved-issues-windows-10-1909.yml)
+# Version 1903
+## [Known issues and notifications](status-windows-10-1903.yml)
+## [Resolved issues](resolved-issues-windows-10-1903.yml)
+# Version 1809 and Windows Server 2019
+## [Known issues and notifications](status-windows-10-1809-and-windows-server-2019.yml)
+## [Resolved issues](resolved-issues-windows-10-1809-and-windows-server-2019.yml)
+# Version 1803
+## [Known issues and notifications](status-windows-10-1803.yml)
+## [Resolved issues](resolved-issues-windows-10-1803.yml)
+# Version 1709
+## [Known issues and notifications](status-windows-10-1709.yml)
+## [Resolved issues](resolved-issues-windows-10-1709.yml)
+# Version 1607 and Windows Server 2016
+## [Known issues and notifications](status-windows-10-1607-and-windows-server-2016.yml)
+## [Resolved issues](resolved-issues-windows-10-1607.yml)
+# Version 1507
+## [Known issues and notifications](status-windows-10-1507.yml)
+## [Resolved issues](resolved-issues-windows-10-1507.yml)
+# Previous versions
+## Windows 8.1 and Windows Server 2012 R2
+### [Known issues and notifications](status-windows-8.1-and-windows-server-2012-r2.yml)
+### [Resolved issues](resolved-issues-windows-8.1-and-windows-server-2012-r2.yml)
+## Windows Server 2012
+### [Known issues and notifications](status-windows-server-2012.yml)
+### [Resolved issues](resolved-issues-windows-server-2012.yml)
+## Windows 7 and Windows Server 2008 R2
+### [Known issues and notifications](status-windows-7-and-windows-server-2008-r2-sp1.yml)
+### [Resolved issues](resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml)
+## Windows Server 2008 SP2
+### [Known issues and notifications](status-windows-server-2008-sp2.yml)
+### [Resolved issues](resolved-issues-windows-server-2008-sp2.yml)
diff --git a/windows/release-information/breadcrumb/toc.yml b/windows/release-information/breadcrumb/toc.yml
new file mode 100644
index 0000000000..5c9f236497
--- /dev/null
+++ b/windows/release-information/breadcrumb/toc.yml
@@ -0,0 +1,11 @@
+- name: Docs
+  tocHref: /
+  topicHref: /
+  items:
+    - name: Windows
+      tocHref: /windows
+      topicHref: /windows/windows-10
+      items:
+        - name: Release information
+          tocHref: /windows/release-information/
+          topicHref: /windows/release-information/index
diff --git a/windows/release-information/docfx.json b/windows/release-information/docfx.json
new file mode 100644
index 0000000000..4dcacaf204
--- /dev/null
+++ b/windows/release-information/docfx.json
@@ -0,0 +1,51 @@
+{
+  "build": {
+    "content": [
+      {
+        "files": [
+          "**/*.md",
+          "**/*.yml"
+        ],
+        "exclude": [
+          "**/obj/**",
+          "**/includes/**",
+          "_themes/**",
+          "_themes.pdf/**",
+          "README.md",
+          "LICENSE",
+          "LICENSE-CODE",
+          "ThirdPartyNotices"
+        ]
+      }
+    ],
+    "resource": [
+      {
+        "files": [
+          "**/*.png",
+          "**/*.jpg"
+        ],
+        "exclude": [
+          "**/obj/**",
+          "**/includes/**",
+          "_themes/**",
+          "_themes.pdf/**"
+        ]
+      }
+    ],
+    "overwrite": [],
+    "externalReference": [],
+    "globalMetadata": {
+      "breadcrumb_path": "/windows/release-information/breadcrumb/toc.json",
+      "ms.prod": "w10",
+      "ms.date": "4/30/2019",
+      "audience": "ITPro",
+      "titleSuffix": "Windows Release Information",
+      "extendBreadcrumb": true,
+      "feedback_system": "None"
+    },
+    "fileMetadata": {},
+    "template": [],
+    "dest": "release-information",
+    "markdownEngineName": "markdig"
+  }
+}
diff --git a/windows/release-information/index.md b/windows/release-information/index.md
new file mode 100644
index 0000000000..c6eba252f9
--- /dev/null
+++ b/windows/release-information/index.md
@@ -0,0 +1,30 @@
+---
+title: Windows 10 - release information
+description: Learn release information for Windows 10 releases
+keywords: ["Windows 10", "Windows 10 October 2018 Update"]
+ms.prod: w10
+layout: LandingPage
+ms.topic: landing-page
+ms.mktglfcycl: deploy
+ms.sitesec: library
+author: lizap
+ms.author: elizapo
+ms.localizationpriority: high
+---
+
+# Windows 10 release information
+
+Feature updates for Windows 10 are released twice a year, around March and September, via the Semi-Annual Channel. They will be serviced with monthly quality updates for 18 or 30 months from the date of the release, depending on the lifecycle policy.
+
+We recommend that you begin deployment of each Semi-Annual Channel release immediately as a targeted deployment to devices selected for early adoption and ramp up to full deployment at your discretion. This will enable you to gain access to new features, experiences, and integrated security as soon as possible.
+
+For information about servicing timelines, see the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853).
+
+> [!NOTE]
+> Beginning with Windows 10, version 1903, you will find a [single entry for each SAC release](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523).
+
+
                                  
+    
                                  
+    
+    
+
                                  
diff --git a/windows/release-information/resolved-issues-windows-10-1507.yml b/windows/release-information/resolved-issues-windows-10-1507.yml
new file mode 100644
index 0000000000..1469d2dcf0
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-10-1507.yml
@@ -0,0 +1,65 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 10, version 1507
+metadata:
+  document_id: 
+  title: Resolved issues in Windows 10, version 1507
+  description: Resolved issues in Windows 10, version 1507
+  keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1507"]
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      See a list of known issues that have been resolved for Windows 10, version 1507 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+      
+      " 
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Resolved issues
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusDate resolved
                                  Intermittent issues when printing
                                  The print spooler service may intermittently have issues completing a print job and results print job failure.

                                  See details >                                  		OS Build 10240.18334

                                  September 23, 2019
                                  KB4522009                                  		Resolved
                                  KB4520011                                  		October 08, 2019 
                                  10:00 AM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.

                                  See details >                                  		OS Build 10240.18305

                                  August 13, 2019
                                  KB4512497                                  		Resolved
                                  KB4517276                                  		August 17, 2019 
                                  02:00 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.

                                  See details >                                  		OS Build 10240.18244

                                  June 11, 2019
                                  KB4503291                                  		Resolved External
                                  		August 09, 2019 
                                  07:03 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: September 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Intermittent issues when printing
                                  Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
                                  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
                                  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4520011.

                                  Back to top                                  		OS Build 10240.18334

                                  September 23, 2019
                                  KB4522009                                  		Resolved
                                  KB4520011                                  		Resolved:
                                  October 08, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 30, 2019 
                                  06:26 PM PT
                                  
+      "
+
+- title: August 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  After installing KB4512497, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4517276. This ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4517276 and install. For instructions, see Update Windows 10.

                                  Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                                  Back to top                                  		OS Build 10240.18305

                                  August 13, 2019
                                  KB4512497                                  		Resolved
                                  KB4517276                                  		Resolved:
                                  August 17, 2019 
                                  02:00 PM PT

                                  Opened:
                                  August 14, 2019 
                                  03:34 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503291) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                                  Back to top                                  		OS Build 10240.18244

                                  June 11, 2019
                                  KB4503291                                  		Resolved External
                                  		Last updated:
                                  August 09, 2019 
                                  07:03 PM PT

                                  Opened:
                                  August 09, 2019 
                                  04:25 PM PT
                                  
+      "
diff --git a/windows/release-information/resolved-issues-windows-10-1607.yml b/windows/release-information/resolved-issues-windows-10-1607.yml
new file mode 100644
index 0000000000..829cea21b4
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-10-1607.yml
@@ -0,0 +1,94 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 10, version 1607 and Windows Server 2016
+metadata:
+  document_id: 
+  title: Resolved issues in Windows 10, version 1607 and Windows Server 2016
+  description: Resolved issues in Windows 10, version 1607
+  keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1607"]
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      See a list of known issues that have been resolved for Windows 10, version 1607 and Windows Server 2016 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+      
+      " 
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Resolved issues
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusDate resolved
                                  Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
                                  Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

                                  See details >                                  		OS Build 14393.2608

                                  November 13, 2018
                                  KB4467691                                  		Resolved External
                                  		January 23, 2020 
                                  02:08 PM PT
                                  Intermittent issues when printing
                                  The print spooler service may intermittently have issues completing a print job and results print job failure.

                                  See details >                                  		OS Build 14393.3206

                                  September 23, 2019
                                  KB4522010                                  		Resolved
                                  KB4519998                                  		October 08, 2019 
                                  10:00 AM PT
                                  IME may become unresponsive or have High CPU usage
                                  Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                                  See details >                                  		OS Build 14393.3204

                                  September 10, 2019
                                  KB4516044                                  		Resolved
                                  		September 17, 2019 
                                  04:47 PM PT
                                  Apps and scripts using the NetQueryDisplayInformation API may fail with error
                                  Applications and scripts that call NetQueryDisplayInformation may fail to return results after the first page of data.

                                  See details >                                  		OS Build 14393.3053

                                  June 18, 2019
                                  KB4503294                                  		Resolved
                                  KB4516044                                  		September 10, 2019 
                                  10:00 AM PT
                                  Domain connected devices that use MIT Kerberos realms will not start up
                                  Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.

                                  See details >                                  		OS Build 14393.3115

                                  July 16, 2019
                                  KB4507459                                  		Resolved
                                  KB4512517                                  		August 13, 2019 
                                  10:00 AM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                                  See details >                                  		OS Build 14393.3025

                                  June 11, 2019
                                  KB4503267                                  		Resolved
                                  KB4512495                                  		August 17, 2019 
                                  02:00 PM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.

                                  See details >                                  		OS Build 14393.3144

                                  August 13, 2019
                                  KB4512517                                  		Resolved
                                  KB4512495                                  		August 17, 2019 
                                  02:00 PM PT
                                  Internet Explorer 11 and apps using the WebBrowser control may fail to render
                                  JavaScript may fail to render as expected in IE11 and in apps using JavaScript or the WebBrowser control.

                                  See details >                                  		OS Build 14393.3085

                                  July 09, 2019
                                  KB4507460                                  		Resolved
                                  KB4512517                                  		August 13, 2019 
                                  10:00 AM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.

                                  See details >                                  		OS Build 14393.3025

                                  June 11, 2019
                                  KB4503267                                  		Resolved External
                                  		August 09, 2019 
                                  07:03 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: September 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Intermittent issues when printing
                                  Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
                                  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
                                  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4519998.

                                  Back to top                                  		OS Build 14393.3206

                                  September 23, 2019
                                  KB4522010                                  		Resolved
                                  KB4519998                                  		Resolved:
                                  October 08, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 30, 2019 
                                  06:26 PM PT
                                  IME may become unresponsive or have High CPU usage
                                  Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                                  Resolution: After investigation, we have found that this issue does not affect this version of Windows.

                                  Back to top                                  		OS Build 14393.3204

                                  September 10, 2019
                                  KB4516044                                  		Resolved
                                  		Resolved:
                                  September 17, 2019 
                                  04:47 PM PT

                                  Opened:
                                  September 13, 2019 
                                  05:25 PM PT
                                  
+      "
+
+- title: August 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Apps and scripts using the NetQueryDisplayInformation API may fail with error
                                   Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

                                  Affected platforms:
                                  • Server: Windows Server 2019; Windows Server 2016
                                  Resolution: This issue was resolved in KB4516044.

                                  Back to top                                  		OS Build 14393.3053

                                  June 18, 2019
                                  KB4503294                                  		Resolved
                                  KB4516044                                  		Resolved:
                                  September 10, 2019 
                                  10:00 AM PT

                                  Opened:
                                  August 01, 2019 
                                  05:00 PM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  After installing KB4512517, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4512495. This ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512495 and install. For instructions, see Update Windows 10.

                                  Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                                  Back to top                                  		OS Build 14393.3144

                                  August 13, 2019
                                  KB4512517                                  		Resolved
                                  KB4512495                                  		Resolved:
                                  August 17, 2019 
                                  02:00 PM PT

                                  Opened:
                                  August 14, 2019 
                                  03:34 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503267) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                                  Back to top                                  		OS Build 14393.3025

                                  June 11, 2019
                                  KB4503267                                  		Resolved External
                                  		Last updated:
                                  August 09, 2019 
                                  07:03 PM PT

                                  Opened:
                                  August 09, 2019 
                                  04:25 PM PT
                                  
+      "
+
+- title: July 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Domain connected devices that use MIT Kerberos realms will not start up
                                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507459. Devices that are domain controllers or domain members are both affected.

                                  To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                                  Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                                  HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                                  Resolution: This issue was resolved in KB4512517 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                                  Back to top                                  		OS Build 14393.3115

                                  July 16, 2019
                                  KB4507459                                  		Resolved
                                  KB4512517                                  		Resolved:
                                  August 13, 2019 
                                  10:00 AM PT

                                  Opened:
                                  July 25, 2019 
                                  06:10 PM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503267 on a WDS server.

                                  Affected platforms:
                                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                                  Resolution: This issue was resolved in KB4512495.

                                  Back to top                                  		OS Build 14393.3025

                                  June 11, 2019
                                  KB4503267                                  		Resolved
                                  KB4512495                                  		Resolved:
                                  August 17, 2019 
                                  02:00 PM PT

                                  Opened:
                                  July 10, 2019 
                                  02:51 PM PT
                                  Internet Explorer 11 and apps using the WebBrowser control may fail to render
                                  Internet Explorer 11 may fail to render some JavaScript after installing KB4507460. You may also have issues with apps using JavaScript or the WebBrowser control, such as the present PowerPoint feature of Skype Meeting Broadcast.

                                  Affected platforms:
                                  • Client: Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                                  • Server: Windows Server 2016
                                  Resolution: This issue was resolved in KB4512517.

                                  Back to top                                  		OS Build 14393.3085

                                  July 09, 2019
                                  KB4507460                                  		Resolved
                                  KB4512517                                  		Resolved:
                                  August 13, 2019 
                                  10:00 AM PT

                                  Opened:
                                  July 26, 2019 
                                  04:58 PM PT
                                  
+      "
+
+- title: November 2018
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
                                  After installing KB4467691, Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

                                  Affected platforms:
                                  • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                                  • Server: Windows Server 2016
                                  Workaround: Restart the affected machine using the Unified Extensible Firmware Interface (UEFI). Disable Secure Boot and then restart.

                                  If BitLocker is enabled on your machine, you may have to go through BitLocker recovery after Secure Boot has been disabled.

                                  Resolution: Lenovo and Fujitsu are aware of this issue. Please contact your OEM to ask if there is a firmware update available for your device.

                                  Back to top                                  		OS Build 14393.2608

                                  November 13, 2018
                                  KB4467691                                  		Resolved External
                                  		Last updated:
                                  January 23, 2020 
                                  02:08 PM PT

                                  Opened:
                                  November 13, 2018 
                                  10:00 AM PT
                                  
+      "
diff --git a/windows/release-information/resolved-issues-windows-10-1709.yml b/windows/release-information/resolved-issues-windows-10-1709.yml
new file mode 100644
index 0000000000..82bf0df89e
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-10-1709.yml
@@ -0,0 +1,90 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 10, version 1709 and Windows Server, version 1709
+metadata:
+  document_id: 
+  title: Resolved issues in Windows 10, version 1709 and Windows Server, version 1709
+  description: Resolved issues in Windows 10, version 1709 and Windows Server 1709
+  keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1709"]
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      See a list of known issues that have been resolved for Windows 10, version 1709 and Windows Server, version 1709 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+      
+      " 
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Resolved issues
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusDate resolved
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

                                  See details >                                  		OS Build 16299.1387

                                  September 10, 2019
                                  KB4516066                                  		Resolved
                                  KB4534318                                  		January 23, 2020 
                                  02:00 PM PT
                                  Intermittent issues when printing
                                  The print spooler service may intermittently have issues completing a print job and results print job failure.

                                  See details >                                  		OS Build 16299.1392

                                  September 23, 2019
                                  KB4522012                                  		Resolved
                                  KB4520004                                  		October 08, 2019 
                                  10:00 AM PT
                                  IME may become unresponsive or have High CPU usage
                                  Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                                  See details >                                  		OS Build 16299.1387

                                  September 10, 2019
                                  KB4516066                                  		Resolved
                                  		September 19, 2019 
                                  04:08 PM PT
                                  Domain connected devices that use MIT Kerberos realms will not start up
                                  Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.

                                  See details >                                  		OS Build 16299.1296

                                  July 16, 2019
                                  KB4507465                                  		Resolved
                                  KB4512516                                  		August 13, 2019 
                                  10:00 AM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                                  See details >                                  		OS Build 16299.1217

                                  June 11, 2019
                                  KB4503284                                  		Resolved
                                  KB4512494                                  		August 16, 2019 
                                  02:00 PM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.

                                  See details >                                  		OS Build 16299.1331

                                  August 13, 2019
                                  KB4512516                                  		Resolved
                                  KB4512494                                  		August 16, 2019 
                                  02:00 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.

                                  See details >                                  		OS Build 16299.1217

                                  June 11, 2019
                                  KB4503284                                  		Resolved External
                                  		August 09, 2019 
                                  07:03 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: October 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

                                  Note This issue does not affect using a Microsoft Account during OOBE.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
                                  • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                                  Resolution: This issue was resolved in KB4534318.

                                  Back to top                                  		OS Build 16299.1387

                                  September 10, 2019
                                  KB4516066                                  		Resolved
                                  KB4534318                                  		Resolved:
                                  January 23, 2020 
                                  02:00 PM PT

                                  Opened:
                                  October 29, 2019 
                                  05:15 PM PT
                                  
+      "
+
+- title: September 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Intermittent issues when printing
                                  Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
                                  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
                                  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4520004.

                                  Back to top                                  		OS Build 16299.1392

                                  September 23, 2019
                                  KB4522012                                  		Resolved
                                  KB4520004                                  		Resolved:
                                  October 08, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 30, 2019 
                                  06:26 PM PT
                                  IME may become unresponsive or have High CPU usage
                                  Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

                                  Resolution: Due to security related changes in KB4516066, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
                                  1. Select the Start button and type Services.
                                  2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
                                  3. Locate Startup type: and change it to Manual
                                  4. Select Ok
                                  5. The TabletInputService service is now in the default configuration and IME should work as expected.

                                  Back to top                                  		OS Build 16299.1387

                                  September 10, 2019
                                  KB4516066                                  		Resolved
                                  		Resolved:
                                  September 19, 2019 
                                  04:08 PM PT

                                  Opened:
                                  September 13, 2019 
                                  05:25 PM PT
                                  
+      "
+
+- title: August 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  After installing KB4512516, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4512494. The ‘optional’ update will be available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512494 and install. For instructions, see Update Windows 10.

                                  Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                                  Back to top                                  		OS Build 16299.1331

                                  August 13, 2019
                                  KB4512516                                  		Resolved
                                  KB4512494                                  		Resolved:
                                  August 16, 2019 
                                  02:00 PM PT

                                  Opened:
                                  August 14, 2019 
                                  03:34 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503284) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                                  Back to top                                  		OS Build 16299.1217

                                  June 11, 2019
                                  KB4503284                                  		Resolved External
                                  		Last updated:
                                  August 09, 2019 
                                  07:03 PM PT

                                  Opened:
                                  August 09, 2019 
                                  04:25 PM PT
                                  
+      "
+
+- title: July 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Domain connected devices that use MIT Kerberos realms will not start up
                                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507465. Devices that are domain controllers or domain members are both affected.

                                  To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                                  Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                                  HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                                  Resolution: This issue was resolved in KB4512516 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                                  Back to top                                  		OS Build 16299.1296

                                  July 16, 2019
                                  KB4507465                                  		Resolved
                                  KB4512516                                  		Resolved:
                                  August 13, 2019 
                                  10:00 AM PT

                                  Opened:
                                  July 25, 2019 
                                  06:10 PM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503284 on a WDS server.

                                  Affected platforms:
                                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                                  Resolution: This issue was resolved in KB4512494.

                                  Back to top                                  		OS Build 16299.1217

                                  June 11, 2019
                                  KB4503284                                  		Resolved
                                  KB4512494                                  		Resolved:
                                  August 16, 2019 
                                  02:00 PM PT

                                  Opened:
                                  July 10, 2019 
                                  02:51 PM PT
                                  
+      "
diff --git a/windows/release-information/resolved-issues-windows-10-1803.yml b/windows/release-information/resolved-issues-windows-10-1803.yml
new file mode 100644
index 0000000000..bdf3c62854
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-10-1803.yml
@@ -0,0 +1,104 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 10, version 1803
+metadata:
+  document_id: 
+  title: Resolved issues in Windows 10, version 1803
+  description: Resolved issues in Windows 10, version 1803
+  keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1803"]
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      See a list of known issues that have been resolved for Windows 10, version 1803 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+      
+      " 
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Resolved issues
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusDate resolved
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

                                  See details >                                  		OS Build 17134.1006

                                  September 10, 2019
                                  KB4516058                                  		Resolved
                                  KB4534308                                  		January 23, 2020 
                                  02:00 PM PT
                                  Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
                                  You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.

                                  See details >                                  		OS Build 17134.950

                                  August 13, 2019
                                  KB4512501                                  		Resolved
                                  KB4519978                                  		October 15, 2019 
                                  10:00 AM PT
                                  Startup to a black screen after installing updates
                                  Your device may startup to a black screen during the first logon after installing updates.

                                  See details >                                  		OS Build 17134.829

                                  June 11, 2019
                                  KB4503286                                  		Resolved
                                  KB4519978                                  		October 15, 2019 
                                  10:00 AM PT
                                  Intermittent issues when printing
                                  The print spooler service may intermittently have issues completing a print job and results print job failure.

                                  See details >                                  		OS Build 17134.1009

                                  September 23, 2019
                                  KB4522014                                  		Resolved
                                  KB4520008                                  		October 08, 2019 
                                  10:00 AM PT
                                  IME may become unresponsive or have High CPU usage
                                  Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                                  See details >                                  		OS Build 17134.1006

                                  September 10, 2019
                                  KB4516058                                  		Resolved
                                  		September 19, 2019 
                                  04:08 PM PT
                                  Domain connected devices that use MIT Kerberos realms will not start up
                                  Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.

                                  See details >                                  		OS Build 17134.915

                                  July 16, 2019
                                  KB4507466                                  		Resolved
                                  KB4512501                                  		August 13, 2019 
                                  10:00 AM PT
                                  Notification issue: \"Your device is missing important security and quality fixes.\"
                                  Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes.\"

                                  See details >                                  		N/A 

                                  		Resolved
                                  		September 03, 2019 
                                  12:32 PM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                                  See details >                                  		OS Build 17134.829

                                  June 11, 2019
                                  KB4503286                                  		Resolved
                                  KB4512509                                  		August 19, 2019 
                                  02:00 PM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.

                                  See details >                                  		OS Build 17134.950

                                  August 13, 2019
                                  KB4512501                                  		Resolved
                                  KB4512509                                  		August 19, 2019 
                                  02:00 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.

                                  See details >                                  		OS Build 17134.829

                                  June 11, 2019
                                  KB4503286                                  		Resolved External
                                  		August 09, 2019 
                                  07:03 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: October 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

                                  Note This issue does not affect using a Microsoft Account during OOBE.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
                                  • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                                  Resolution: This issue was resolved in KB4534308.

                                  Back to top                                  		OS Build 17134.1006

                                  September 10, 2019
                                  KB4516058                                  		Resolved
                                  KB4534308                                  		Resolved:
                                  January 23, 2020 
                                  02:00 PM PT

                                  Opened:
                                  October 29, 2019 
                                  05:15 PM PT
                                  
+      "
+
+- title: September 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
                                  After installing KB4512501, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.

                                  Affected platforms:
                                  • Client: Windows 10, version 1809; Windows 10, version 1803
                                  Resolution: This issue was resolved in KB4519978.

                                  Back to top                                  		OS Build 17134.950

                                  August 13, 2019
                                  KB4512501                                  		Resolved
                                  KB4519978                                  		Resolved:
                                  October 15, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 11, 2019 
                                  05:32 PM PT
                                  Intermittent issues when printing
                                  Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
                                  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
                                  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4520008.

                                  Back to top                                  		OS Build 17134.1009

                                  September 23, 2019
                                  KB4522014                                  		Resolved
                                  KB4520008                                  		Resolved:
                                  October 08, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 30, 2019 
                                  06:26 PM PT
                                  IME may become unresponsive or have High CPU usage
                                  Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

                                  Resolution: Due to security related changes in KB4516058, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
                                  1. Select the Start button and type Services.
                                  2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
                                  3. Locate Startup type: and change it to Manual
                                  4. Select Ok
                                  5. The TabletInputService service is now in the default configuration and IME should work as expected.

                                  Back to top                                  		OS Build 17134.1006

                                  September 10, 2019
                                  KB4516058                                  		Resolved
                                  		Resolved:
                                  September 19, 2019 
                                  04:08 PM PT

                                  Opened:
                                  September 13, 2019 
                                  05:25 PM PT
                                  Notification issue: \"Your device is missing important security and quality fixes.\"
                                  Some users may have incorrectly received the notification \"Your device is missing important security and quality fixes\" in the Windows Update dialog and a red \"!\" in the task tray on the Windows Update tray icon. This notification is intended for devices that are 90 days or more out of date, but some users with installed updates released in June or July also saw this notification.

                                  Affected platforms:
                                  • Client: Windows 10, version 1803
                                  • Server: Windows Server, version 1803
                                  Resolution: This issue was resolved on the server side on August 30, 2019. Only devices that are out of date by 90 days or more should now see the notification. No action is required by the user to resolve this issue. If you are still seeing the \"Your device is missing important security and quality fixes\" notification, we recommend selecting Check for Updates in the Windows Update dialog. For instructions, see Update Windows 10. Microsoft always recommends trying to keep your devices up to date, as the monthly updates contain important security fixes. 

                                  Back to top                                  		N/A 

                                  		Resolved
                                  		Resolved:
                                  September 03, 2019 
                                  12:32 PM PT

                                  Opened:
                                  September 03, 2019 
                                  12:32 PM PT
                                  
+      "
+
+- title: August 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  After installing KB4512501, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4512509. The ‘optional’ update will be available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512509 and install. For instructions, see Update Windows 10.

                                  Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                                  Back to top                                  		OS Build 17134.950

                                  August 13, 2019
                                  KB4512501                                  		Resolved
                                  KB4512509                                  		Resolved:
                                  August 19, 2019 
                                  02:00 PM PT

                                  Opened:
                                  August 14, 2019 
                                  03:34 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503286) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                                  Back to top                                  		OS Build 17134.829

                                  June 11, 2019
                                  KB4503286                                  		Resolved External
                                  		Last updated:
                                  August 09, 2019 
                                  07:03 PM PT

                                  Opened:
                                  August 09, 2019 
                                  04:25 PM PT
                                  
+      "
+
+- title: July 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Domain connected devices that use MIT Kerberos realms will not start up
                                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4507466. Devices that are domain controllers or domain members are both affected.

                                  To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                                  Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                                  HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                                  Resolution: This issue was resolved in KB4512501 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                                  Back to top                                  		OS Build 17134.915

                                  July 16, 2019
                                  KB4507466                                  		Resolved
                                  KB4512501                                  		Resolved:
                                  August 13, 2019 
                                  10:00 AM PT

                                  Opened:
                                  July 25, 2019 
                                  06:10 PM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503286 on a WDS server.

                                  Affected platforms:
                                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                                  Resolution: This issue was resolved in KB4512509.

                                  Back to top                                  		OS Build 17134.829

                                  June 11, 2019
                                  KB4503286                                  		Resolved
                                  KB4512509                                  		Resolved:
                                  August 19, 2019 
                                  02:00 PM PT

                                  Opened:
                                  July 10, 2019 
                                  02:51 PM PT
                                  
+      "
+
+- title: June 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Startup to a black screen after installing updates
                                  We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.


                                  Affected platforms:
                                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
                                  • Server: Windows Server 2019
                                  Resolution: This issue was resolved in KB4519978.

                                  Back to top                                  		OS Build 17134.829

                                  June 11, 2019
                                  KB4503286                                  		Resolved
                                  KB4519978                                  		Resolved:
                                  October 15, 2019 
                                  10:00 AM PT

                                  Opened:
                                  June 14, 2019 
                                  04:41 PM PT
                                  
+      "
diff --git a/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml
new file mode 100644
index 0000000000..d113831f80
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-10-1809-and-windows-server-2019.yml
@@ -0,0 +1,106 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 10, version 1809 and Windows Server 2019
+metadata:
+  document_id: 
+  title: Resolved issues in Windows 10, version 1809 and Windows Server 2019
+  description: Resolved issues in Windows 10, version 1809 or Windows Server 2019
+  keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10 1809"]
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      See a list of known issues that have been resolved for Windows 10, version 1809 and Windows Server 2019 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+      
+      " 
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Resolved issues
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusDate resolved
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

                                  See details >                                  		OS Build 17763.737

                                  September 10, 2019
                                  KB4512578                                  		Resolved
                                  KB4534321                                  		January 23, 2020 
                                  02:00 PM PT
                                  Microsoft Defender Advanced Threat Protection might stop running
                                  The Microsoft Defender ATP service might stop running and might fail to send reporting data.

                                  See details >                                  		OS Build 17763.832

                                  October 15, 2019
                                  KB4520062                                  		Resolved
                                  KB4523205                                  		November 12, 2019 
                                  10:00 AM PT
                                  Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
                                  You may receive a 15-5 error code in Windows Mixed Reality Portal and your headset may not wake up from sleep.

                                  See details >                                  		OS Build 17763.678

                                  August 13, 2019
                                  KB4511553                                  		Resolved
                                  KB4520062                                  		October 15, 2019 
                                  10:00 AM PT
                                  Startup to a black screen after installing updates
                                  Your device may startup to a black screen during the first logon after installing updates.

                                  See details >                                  		OS Build 17763.557

                                  June 11, 2019
                                  KB4503327                                  		Resolved
                                  KB4520062                                  		October 15, 2019 
                                  10:00 AM PT
                                  Intermittent issues when printing
                                  The print spooler service may intermittently have issues completing a print job and results print job failure.

                                  See details >                                  		OS Build 17763.740

                                  September 23, 2019
                                  KB4522015                                  		Resolved
                                  KB4519338                                  		October 08, 2019 
                                  10:00 AM PT
                                  Apps and scripts using the NetQueryDisplayInformation API may fail with error
                                  Applications and scripts that call NetQueryDisplayInformation may fail to return results after the first page of data.

                                  See details >                                  		OS Build 17763.55

                                  October 09, 2018
                                  KB4464330                                  		Resolved
                                  KB4516077                                  		September 24, 2019 
                                  10:00 AM PT
                                  IME may become unresponsive or have High CPU usage
                                  Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                                  See details >                                  		OS Build 17763.737

                                  September 10, 2019
                                  KB4512578                                  		Resolved
                                  		September 19, 2019 
                                  04:08 PM PT
                                  Domain connected devices that use MIT Kerberos realms will not start up
                                  Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.

                                  See details >                                  		OS Build 17763.652

                                  July 22, 2019
                                  KB4505658                                  		Resolved
                                  KB4511553                                  		August 13, 2019 
                                  10:00 AM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                                  See details >                                  		OS Build 17763.557

                                  June 11, 2019
                                  KB4503327                                  		Resolved
                                  KB4512534                                  		August 17, 2019 
                                  02:00 PM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.

                                  See details >                                  		OS Build 17763.678

                                  August 13, 2019
                                  KB4511553                                  		Resolved
                                  KB4512534                                  		August 17, 2019 
                                  02:00 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.

                                  See details >                                  		OS Build 17763.557

                                  June 11, 2019
                                  KB4503327                                  		Resolved External
                                  		August 09, 2019 
                                  07:03 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: October 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

                                  Note This issue does not affect using a Microsoft Account during OOBE.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
                                  • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                                  Resolution: This issue was resolved in KB4534321.

                                  Back to top                                  		OS Build 17763.737

                                  September 10, 2019
                                  KB4512578                                  		Resolved
                                  KB4534321                                  		Resolved:
                                  January 23, 2020 
                                  02:00 PM PT

                                  Opened:
                                  October 29, 2019 
                                  05:15 PM PT
                                  Microsoft Defender Advanced Threat Protection might stop running
                                  After installing the optional non-security update (KB4520062), the Microsoft Defender Advanced Threat Protection (ATP) service might stop running and might fail to send reporting data. You might also receive a 0xc0000409 error in Event Viewer on MsSense.exe.

                                  Note Microsoft Windows Defender Antivirus is not affected by this issue.

                                  Affected platforms:
                                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                                  • Server: Windows Server, version 1809; Windows Server 2019
                                  Resolution: This issue was resolved in KB4523205.

                                  Back to top                                  		OS Build 17763.832

                                  October 15, 2019
                                  KB4520062                                  		Resolved
                                  KB4523205                                  		Resolved:
                                  November 12, 2019 
                                  10:00 AM PT

                                  Opened:
                                  October 17, 2019 
                                  05:14 PM PT
                                  
+      "
+
+- title: September 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Windows Mixed Reality Portal users may intermittently receive a 15-5 error code
                                  After installing KB4511553, Windows Mixed Reality Portal users may intermittently receive a 15-5 error code. In some cases, Windows Mixed Reality Portal may report that the headset is sleeping and pressing “Wake up” may appear to produce no action.

                                  Affected platforms:
                                  • Client: Windows 10, version 1809; Windows 10, version 1803
                                  Resolution: This issue was resolved in KB4520062.

                                  Back to top                                  		OS Build 17763.678

                                  August 13, 2019
                                  KB4511553                                  		Resolved
                                  KB4520062                                  		Resolved:
                                  October 15, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 11, 2019 
                                  05:32 PM PT
                                  Intermittent issues when printing
                                  Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
                                  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
                                  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4519338.

                                  Back to top                                  		OS Build 17763.740

                                  September 23, 2019
                                  KB4522015                                  		Resolved
                                  KB4519338                                  		Resolved:
                                  October 08, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 30, 2019 
                                  06:26 PM PT
                                  IME may become unresponsive or have High CPU usage
                                  Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

                                  Resolution: Due to security related changes in KB4512578, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
                                  1. Select the Start button and type Services.
                                  2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
                                  3. Locate Startup type: and change it to Manual
                                  4. Select Ok
                                  5. The TabletInputService service is now in the default configuration and IME should work as expected.

                                  Back to top                                  		OS Build 17763.737

                                  September 10, 2019
                                  KB4512578                                  		Resolved
                                  		Resolved:
                                  September 19, 2019 
                                  04:08 PM PT

                                  Opened:
                                  September 13, 2019 
                                  05:25 PM PT
                                  
+      "
+
+- title: August 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Apps and scripts using the NetQueryDisplayInformation API may fail with error
                                   Applications and scripts that call the NetQueryDisplayInformation API or the WinNT provider equivalent may fail to return results after the first page of data, often 50 or 100 entries. When requesting additional pages you may receive the error, “1359: an internal error occurred.”

                                  Affected platforms:
                                  • Server: Windows Server 2019; Windows Server 2016
                                  Resolution: This issue was resolved in KB4516077.

                                  Back to top                                  		OS Build 17763.55

                                  October 09, 2018
                                  KB4464330                                  		Resolved
                                  KB4516077                                  		Resolved:
                                  September 24, 2019 
                                  10:00 AM PT

                                  Opened:
                                  August 01, 2019 
                                  05:00 PM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  After installing KB4511553, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4512534. This ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512534 and install. For instructions, see Update Windows 10.

                                  Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                                  Back to top                                  		OS Build 17763.678

                                  August 13, 2019
                                  KB4511553                                  		Resolved
                                  KB4512534                                  		Resolved:
                                  August 17, 2019 
                                  02:00 PM PT

                                  Opened:
                                  August 14, 2019 
                                  03:34 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503327) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                                  Back to top                                  		OS Build 17763.557

                                  June 11, 2019
                                  KB4503327                                  		Resolved External
                                  		Last updated:
                                  August 09, 2019 
                                  07:03 PM PT

                                  Opened:
                                  August 09, 2019 
                                  04:25 PM PT
                                  
+      "
+
+- title: July 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Domain connected devices that use MIT Kerberos realms will not start up
                                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4505658. Devices that are domain controllers or domain members are both affected.

                                  To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                                  Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                                  HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                                  Resolution: This issue was resolved in KB4511553 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                                  Back to top                                  		OS Build 17763.652

                                  July 22, 2019
                                  KB4505658                                  		Resolved
                                  KB4511553                                  		Resolved:
                                  August 13, 2019 
                                  10:00 AM PT

                                  Opened:
                                  July 25, 2019 
                                  06:10 PM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503327 on a WDS server.

                                  Affected platforms:
                                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                                  Resolution: This issue was resolved in KB4512534.

                                  Back to top                                  		OS Build 17763.557

                                  June 11, 2019
                                  KB4503327                                  		Resolved
                                  KB4512534                                  		Resolved:
                                  August 17, 2019 
                                  02:00 PM PT

                                  Opened:
                                  July 10, 2019 
                                  02:51 PM PT
                                  
+      "
+
+- title: June 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Startup to a black screen after installing updates
                                  We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.


                                  Affected platforms:
                                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803
                                  • Server: Windows Server 2019
                                  Resolution: This issue was resolved in KB4520062.

                                  Back to top                                  		OS Build 17763.557

                                  June 11, 2019
                                  KB4503327                                  		Resolved
                                  KB4520062                                  		Resolved:
                                  October 15, 2019 
                                  10:00 AM PT

                                  Opened:
                                  June 14, 2019 
                                  04:41 PM PT
                                  
+      "
diff --git a/windows/release-information/resolved-issues-windows-10-1903.yml b/windows/release-information/resolved-issues-windows-10-1903.yml
new file mode 100644
index 0000000000..0554cb4e28
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-10-1903.yml
@@ -0,0 +1,126 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 10, version 1903 and Windows Server, version 1903
+metadata:
+  document_id: 
+  title: Resolved issues in Windows 10, version 1903 and Windows Server, version 1903
+  description: Resolved issues in Windows 10, version 1903 and Windows Server 1903
+  keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1903"]
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      See a list of known issues that have been resolved for Windows 10, version 1903 and Windows Server, version 1903 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+      
+      " 
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Resolved issues
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusDate resolved
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

                                  See details >                                  		OS Build 18362.356

                                  September 10, 2019
                                  KB4515384                                  		Resolved
                                  KB4530684                                  		December 10, 2019 
                                  10:00 AM PT
                                  Intermittent loss of Wi-Fi connectivity
                                  Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. 

                                  See details >                                  		OS Build 18362.116

                                  May 21, 2019
                                  KB4505057                                  		Resolved External
                                  		November 22, 2019 
                                  04:10 PM PT
                                  Unable to discover or connect to Bluetooth devices using some Realtek adapters
                                  Microsoft has identified compatibility issues with some versions of Realtek Bluetooth radio drivers.

                                  See details >                                  		OS Build 18362.116

                                  May 21, 2019
                                  KB4505057                                  		Resolved External
                                  		November 15, 2019 
                                  05:59 PM PT
                                  Updates may fail to install and you may receive Error 0x80073701
                                  Installation of updates may fail and you may receive error code 0x80073701.

                                  See details >                                  		OS Build 18362.145

                                  May 29, 2019
                                  KB4497935                                  		Resolved
                                  		November 12, 2019 
                                  08:11 AM PT
                                  Intel Audio displays an intcdaud.sys notification
                                  Devices with a range of Intel Display Audio device drivers may experience battery drain.

                                  See details >                                  		OS Build 18362.116

                                  May 21, 2019
                                  KB4505057                                  		Resolved External
                                  		November 12, 2019 
                                  08:04 AM PT
                                  Unable to discover or connect to Bluetooth devices using some Qualcomm adapters
                                  Microsoft has identified compatibility issues with some versions of Qualcomm Bluetooth radio drivers.

                                  See details >                                  		OS Build 18362.116

                                  May 21, 2019
                                  KB4505057                                  		Resolved
                                  KB4517389                                  		October 08, 2019 
                                  10:00 AM PT
                                  Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
                                  Some devices with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards may experience compatibility issues.

                                  See details >                                  		N/A 

                                  		Resolved
                                  KB4522355                                  		October 24, 2019 
                                  10:00 AM PT
                                  dGPU occasionally disappear from device manager on Surface Book 2
                                  Some apps or games may close or fail to open on Surface Book 2 devices with Nvidia dGPU.

                                  See details >                                  		OS Build 18362.145

                                  May 29, 2019
                                  KB4497935                                  		Resolved
                                  		October 18, 2019 
                                  04:33 PM PT
                                  Intermittent issues when printing
                                  The print spooler service may intermittently have issues completing a print job and results print job failure.

                                  See details >                                  		OS Build 18362.357

                                  September 23, 2019
                                  KB4522016                                  		Resolved
                                  KB4517389                                  		October 08, 2019 
                                  10:00 AM PT
                                  Audio in games is quiet or different than expected
                                  Microsoft has received reports that audio in certain games is quieter or different than expected.

                                  See details >                                  		OS Build 18362.356

                                  September 10, 2019
                                  KB4515384                                  		Resolved
                                  KB4517211                                  		September 26, 2019 
                                  02:00 PM PT
                                  IME may become unresponsive or have High CPU usage
                                  Some Input Method Editor (IME) including ChsIME.EXE and ChtIME.EXE, may become unresponsive or may have high CPU usage.

                                  See details >                                  		OS Build 18362.356

                                  September 10, 2019
                                  KB4515384                                  		Resolved
                                  		September 19, 2019 
                                  04:08 PM PT
                                  Some users report issues related to the Start menu and Windows Desktop Search
                                  A small number of users have reported issues related to the Start menu and Windows Desktop Search.

                                  See details >                                  		OS Build 18362.356

                                  September 10, 2019
                                  KB4515384                                  		Resolved
                                  		September 19, 2019 
                                  04:58 PM PT
                                  Screenshots and Snips have an unnatural orange tint
                                  Users have reported an orange tint on Screenshots and Snips with the Lenovo Vantage app installed

                                  See details >                                  		OS Build 18362.356

                                  September 10, 2019
                                  KB4516115                                  		Resolved External
                                  		September 11, 2019 
                                  08:54 PM PT
                                  Windows Desktop Search may not return any results and may have high CPU usage
                                  Windows Desktop Search may not return any results and SearchUI.exe may have high CPU usage after installing KB4512941.

                                  See details >                                  		OS Build 18362.329

                                  August 30, 2019
                                  KB4512941                                  		Resolved
                                  KB4515384                                  		September 10, 2019 
                                  10:00 AM PT
                                  Domain connected devices that use MIT Kerberos realms will not start up
                                  Devices may not start after updating when connected to a domain that is configured to use MIT Kerberos realms.

                                  See details >                                  		OS Build 18362.145

                                  May 29, 2019
                                  KB4497935                                  		Resolved
                                  KB4512941                                  		August 30, 2019 
                                  10:00 AM PT
                                  Issues updating when certain versions of Intel storage drivers are installed
                                  Windows 10, version 1903 update may fail with certain versions of Intel Rapid Storage Technology (Intel RST) drivers.

                                  See details >                                  		OS Build 18362.145

                                  May 29, 2019
                                  KB4497935                                  		Resolved
                                  KB4512941                                  		August 30, 2019 
                                  10:00 AM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.

                                  See details >                                  		OS Build 18362.295

                                  August 13, 2019
                                  KB4512508                                  		Resolved
                                  KB4512941                                  		August 30, 2019 
                                  10:00 AM PT
                                  Initiating a Remote Desktop connection may result in black screen
                                  When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen.

                                  See details >                                  		OS Build 18362.145

                                  May 29, 2019
                                  KB4497935                                  		Resolved
                                  KB4512941                                  		August 30, 2019 
                                  10:00 AM PT
                                  Windows Sandbox may fail to start with error code “0x80070002”
                                  Windows Sandbox may fail to start on devices in which the operating system language was changed between updates.

                                  See details >                                  		OS Build 18362.116

                                  May 21, 2019
                                  KB4505057                                  		Resolved
                                  KB4512941                                  		August 30, 2019 
                                  10:00 AM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                                  See details >                                  		OS Build 18362.175

                                  June 11, 2019
                                  KB4503293                                  		Resolved
                                  KB4512941                                  		August 30, 2019 
                                  10:00 AM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.

                                  See details >                                  		OS Build 18362.175

                                  June 11, 2019
                                  KB4503293                                  		Resolved External
                                  		August 09, 2019 
                                  07:03 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: October 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

                                  Note This issue does not affect using a Microsoft Account during OOBE.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
                                  • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                                  Resolution: This issue was resolved in KB4530684.

                                  Back to top                                  		OS Build 18362.356

                                  September 10, 2019
                                  KB4515384                                  		Resolved
                                  KB4530684                                  		Resolved:
                                  December 10, 2019 
                                  10:00 AM PT

                                  Opened:
                                  October 29, 2019 
                                  05:15 PM PT
                                  Unable to discover or connect to Bluetooth devices using some Qualcomm adapters
                                  Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903
                                  • Server: Windows Server, version 1903
                                  Resolution: This issue was resolved in KB4517389 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                                  Back to top                                  		OS Build 18362.116

                                  May 21, 2019
                                  KB4505057                                  		Resolved
                                  KB4517389                                  		Resolved:
                                  October 08, 2019 
                                  10:00 AM PT

                                  Opened:
                                  October 25, 2019 
                                  04:21 PM PT
                                  
+      "
+
+- title: September 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Safeguard on certain devices with some Intel and Broadcom Wi-Fi adapters
                                  Microsoft and NEC have found incompatibility issues with Intel Centrino 6205/6235 and Broadcom 802.11ac Wi-Fi cards when running Windows 10, version 1903 on specific models of NEC devices. If these devices are updated to Windows 10, version 1903, they will no longer be able to use any Wi-Fi connections. The Wi-Fi driver may have a yellow exclamation point in device manager. The task tray icon for networking may show the icon for no internet and Network & Internet settings may not show any Wi-Fi networks.

                                  To safeguard your update experience, we have applied a compatibility hold on the affected devices from being offered Windows 10, version 1903.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903
                                  Resolution: This issue was resolved in KB4522355. The safeguard hold is estimated to be removed in mid-November.

                                  Back to top                                  		N/A 

                                  		Resolved
                                  KB4522355                                  		Resolved:
                                  October 24, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 13, 2019 
                                  05:25 PM PT
                                  Intermittent issues when printing
                                  Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
                                  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
                                  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4517389.

                                  Back to top                                  		OS Build 18362.357

                                  September 23, 2019
                                  KB4522016                                  		Resolved
                                  KB4517389                                  		Resolved:
                                  October 08, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 30, 2019 
                                  06:26 PM PT
                                  Audio in games is quiet or different than expected
                                  Microsoft has received reports that audio in certain games is quieter or different than expected. At the request of some of our audio partners, we implemented a compatibility change that enabled certain games to query support and render multi-channel audio. Due to customer feedback, we are reverting this change as some games and some devices are not rendering multi-channel audio as expected. This may result in games sounding different than customers are used to and may have missing channels.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903
                                  Resolution: This issue was resolved in KB4517211.

                                  Back to top                                  		OS Build 18362.356

                                  September 10, 2019
                                  KB4515384                                  		Resolved
                                  KB4517211                                  		Resolved:
                                  September 26, 2019 
                                  02:00 PM PT

                                  Opened:
                                  September 13, 2019 
                                  05:25 PM PT
                                  IME may become unresponsive or have High CPU usage
                                  Some Input Method Editor (IME) may become unresponsive or may have high CPU usage. Affected IMEs include Chinese Simplified (ChsIME.EXE) and Chinese Traditional (ChtIME.EXE) with Changjie/Quick keyboard.


                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016

                                  Resolution: Due to security related changes in KB4515384, this issue may occur when Touch Keyboard and Handwriting Panel Service is not configured to its default startup type of Manual. To resolve the issue, perform the following steps:
                                  1. Select the Start button and type Services.
                                  2. Locate Touch Keyboard and Handwriting Panel Service and double click on it or long press and select Properties.
                                  3. Locate Startup type: and change it to Manual
                                  4. Select Ok
                                  5. The TabletInputService service is now in the default configuration and IME should work as expected.

                                  Back to top                                  		OS Build 18362.356

                                  September 10, 2019
                                  KB4515384                                  		Resolved
                                  		Resolved:
                                  September 19, 2019 
                                  04:08 PM PT

                                  Opened:
                                  September 13, 2019 
                                  05:25 PM PT
                                  Some users report issues related to the Start menu and Windows Desktop Search
                                  Microsoft has received reports that a small number of users are having issues related to the Start menu and Windows Desktop Search.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903
                                  Resolution: At this time, Microsoft has not found a Search or Start issue significantly impacting users originating from KB4515384. We will continue monitoring to ensure users have a high-quality experience when interacting with these areas. If you are currently having issues, we recommend you to take a moment to report it in via the Feedback Hub (Windows + F) then try the Windows 10 Troubleshoot settings (found in Settings). If you are having an issue with search, see Fix problems in Windows Search.

                                  Back to top                                  		OS Build 18362.356

                                  September 10, 2019
                                  KB4515384                                  		Resolved
                                  		Resolved:
                                  September 19, 2019 
                                  04:58 PM PT

                                  Opened:
                                  September 11, 2019 
                                  05:18 PM PT
                                  Screenshots and Snips have an unnatural orange tint
                                  When creating screenshots or using similar tools (such as Snipping Tool or Snip & Sketch), the resulting images may have an unnatural orange tint. This issue is caused by the Eye Care mode feature of Lenovo Vantage. This issue started on or around September 5, 2019. 

                                  Affected platforms:
                                  • Client: Windows 10, version 1903
                                  • Server: None
                                  Resolution: For guidance on this issue, see the Lenovo support article Screenshots and Snips have an unnatural orange tint. There is no update for Windows needed for this issue.

                                  Back to top                                  		OS Build 18362.356

                                  September 10, 2019
                                  KB4516115                                  		Resolved External
                                  		Last updated:
                                  September 11, 2019 
                                  08:54 PM PT

                                  Opened:
                                  September 11, 2019 
                                  08:54 PM PT
                                  Windows Desktop Search may not return any results and may have high CPU usage
                                  Microsoft is getting reports that a small number of users may not receive results when using Windows Desktop Search and may see high CPU usage from SearchUI.exe when searching after installing KB4512941. This issue is only encountered on devices in which searching the web from Windows Desktop Search has been disabled.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903
                                  Resolution: This issue was resolved in KB4515384.

                                  Back to top                                  		OS Build 18362.329

                                  August 30, 2019
                                  KB4512941                                  		Resolved
                                  KB4515384                                  		Resolved:
                                  September 10, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 04, 2019 
                                  02:25 PM PT
                                  
+      "
+
+- title: August 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Updates may fail to install and you may receive Error 0x80073701
                                  Installation of updates may fail and you may receive the error message, \"Updates Failed, There were problems installing some updates, but we'll try again later\" or \"Error 0x80073701\" on the Windows Update dialog or within Update history.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903
                                  • Server: Windows Server, version 1903
                                  Resolution: This issue has been resolved for most users. If you are still having issues, please see KB4528159.

                                  Back to top                                  		OS Build 18362.145

                                  May 29, 2019
                                  KB4497935                                  		Resolved
                                  		Resolved:
                                  November 12, 2019 
                                  08:11 AM PT

                                  Opened:
                                  August 16, 2019 
                                  01:41 PM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  After installing KB4512508, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4512941. The ‘optional’ update is available on Microsoft Update Catalog, Windows Update, Microsoft Update and Windows Server Update Services (WSUS). As with any 'optional' update, you will need to Check for updates to receive KB4512941 and install. For instructions, see Update Windows 10.

                                  Note Windows Update for Business customers should apply the update via Microsoft Update Catalog or Windows Server Update Services (WSUS).

                                  Back to top                                  		OS Build 18362.295

                                  August 13, 2019
                                  KB4512508                                  		Resolved
                                  KB4512941                                  		Resolved:
                                  August 30, 2019 
                                  10:00 AM PT

                                  Opened:
                                  August 14, 2019 
                                  03:34 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503293) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                                  Back to top                                  		OS Build 18362.175

                                  June 11, 2019
                                  KB4503293                                  		Resolved External
                                  		Last updated:
                                  August 09, 2019 
                                  07:03 PM PT

                                  Opened:
                                  August 09, 2019 
                                  04:25 PM PT
                                  
+      "
+
+- title: July 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  dGPU occasionally disappear from device manager on Surface Book 2
                                  Microsoft has identified a compatibility issue on some Surface Book 2 devices configured with Nvidia discrete graphics processing units (dGPUs). After updating to Windows 10, version 1903 (the May 2019 Update), some apps or games that needs to perform graphics intensive operations may close or fail to open.
                                   
                                  To safeguard your update experience, we have applied a compatibility hold on Surface Book 2 devices with Nvidia dGPU from being offered Windows 10, version 1903 until this issue is resolved.
                                   
                                  Affected platforms:
                                  • Client: Windows 10, version 1903
                                  Resolved: To resolve this issue, you will need to update the firmware of your Surface Book 2 device. Please see the Surface Book 2 update history page for instructions on how to install the October 2019 updates on your device. There is no update for Windows needed for this issue.
                                   
                                  The safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903.

                                  Back to top                                  		OS Build 18362.145

                                  May 29, 2019
                                  KB4497935                                  		Resolved
                                  		Resolved:
                                  October 18, 2019 
                                  04:33 PM PT

                                  Opened:
                                  July 12, 2019 
                                  04:20 PM PT
                                  Domain connected devices that use MIT Kerberos realms will not start up
                                  Devices connected to a domain that is configured to use MIT Kerberos realms will not start up or may continue to restart after installation of KB4497935. Devices that are domain controllers or domain members are both affected.

                                  To safeguard your update experience, we have applied a compatibility hold on devices configured to use MIT Kerberos realm from being offered Windows 10, version 1903 or Windows Server, version 1903.

                                  Note If you are not sure if your device is affected, contact your administrator. Advanced users can check for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos or check if this registry key exists:
                                  HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Kerberos\\MitRealms
+

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016
                                  Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1903 or Windows Server, version 1903.

                                  Back to top                                  		OS Build 18362.145

                                  May 29, 2019
                                  KB4497935                                  		Resolved
                                  KB4512941                                  		Resolved:
                                  August 30, 2019 
                                  10:00 AM PT

                                  Opened:
                                  July 25, 2019 
                                  06:10 PM PT
                                  Issues updating when certain versions of Intel storage drivers are installed
                                  Intel and Microsoft have found incompatibility issues with certain versions of the Intel Rapid Storage Technology (Intel RST) drivers and the Windows 10 May 2019 Update (Windows 10, version 1903).  

                                  To safeguard your update experience, we have applied a compatibility hold on devices with Intel RST drivers, versions 15.1.0.1002 through version 15.5.2.1053 installed from installing or being offered Windows 10, version 1903 or Windows Server, version 1903, until the driver has been updated.

                                  Versions 15.5.2.1054 or later are compatible, and a device that has these drivers installed can install the Windows 10 May 2019 Update. For affected devices, the recommended version is 15.9.8.1050.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903
                                  • Server: Windows Server, version 1903
                                  Resolution: This issue was resolved in KB4512941 and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to Windows 10, version 1903.

                                  Back to top                                  		OS Build 18362.145

                                  May 29, 2019
                                  KB4497935                                  		Resolved
                                  KB4512941                                  		Resolved:
                                  August 30, 2019 
                                  10:00 AM PT

                                  Opened:
                                  July 25, 2019 
                                  06:10 PM PT
                                  Initiating a Remote Desktop connection may result in black screen
                                  When initiating a Remote Desktop connection to devices with some older GPU drivers, you may receive a black screen. Any version of Windows may encounter this issue when initiating a Remote Desktop connection to a Windows 10, version 1903 device which is running an affected display driver, including the drivers for the Intel 4 series chipset integrated GPU (iGPU).

                                  Affected platforms:
                                  • Client: Windows 10, version 1903
                                  • Server: Windows Server, version 1903
                                  Resolution: This issue was resolved in KB4512941.

                                  Back to top                                  		OS Build 18362.145

                                  May 29, 2019
                                  KB4497935                                  		Resolved
                                  KB4512941                                  		Resolved:
                                  August 30, 2019 
                                  10:00 AM PT

                                  Opened:
                                  July 12, 2019 
                                  04:42 PM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503293 on a WDS server.

                                  Affected platforms:
                                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                                  Resolution: This issue was resolved in KB4512941.

                                  Back to top                                  		OS Build 18362.175

                                  June 11, 2019
                                  KB4503293                                  		Resolved
                                  KB4512941                                  		Resolved:
                                  August 30, 2019 
                                  10:00 AM PT

                                  Opened:
                                  July 10, 2019 
                                  02:51 PM PT
                                  
+      "
+
+- title: May 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Intermittent loss of Wi-Fi connectivity
                                  Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).

                                  To safeguard your upgrade experience, we have applied a hold on devices with affected Qualcomm driver from being offered Windows 10, version 1903 or Windows 10, version 1909, until the updated driver is installed.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903
                                  Resolution: This issue was resolved with an updated Qualcomm Wifi driver and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1909 or Windows 10, version 1903.

                                  Back to top                                  		OS Build 18362.116

                                  May 21, 2019
                                  KB4505057                                  		Resolved External
                                  		Last updated:
                                  November 22, 2019 
                                  04:10 PM PT

                                  Opened:
                                  May 21, 2019 
                                  07:13 AM PT
                                  Unable to discover or connect to Bluetooth devices using some Realtek adapters
                                  Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903
                                  • Server: Windows 10, version 1909; Windows Server, version 1903
                                  Resolution: This issue was resolved with an updated driver for the affected Realtek Bluetooth radio and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1909 or Windows 10, version 1903.

                                  Back to top                                  		OS Build 18362.116

                                  May 21, 2019
                                  KB4505057                                  		Resolved External
                                  		Last updated:
                                  November 15, 2019 
                                  05:59 PM PT

                                  Opened:
                                  May 21, 2019 
                                  07:29 AM PT
                                  Intel Audio displays an intcdaud.sys notification
                                  Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an intcdaud.sys notification or “What needs your attention” notification when trying to update to Windows 10, version 1903, you have an affected Intel Audio Display device driver installed on your machine (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8).
                                    
                                  To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809
                                  Resolution: This issue was resolved with updated drivers from your device manufacturer (OEM) or Intel. The safeguard hold has been removed.

                                  Note If you are still experiencing the issue described, please contact your device manufacturer (OEM).

                                  Back to top                                  		OS Build 18362.116

                                  May 21, 2019
                                  KB4505057                                  		Resolved External
                                  		Last updated:
                                  November 12, 2019 
                                  08:04 AM PT

                                  Opened:
                                  May 21, 2019 
                                  07:22 AM PT
                                  Windows Sandbox may fail to start with error code “0x80070002”
                                  Windows Sandbox may fail to start with \"ERROR_FILE_NOT_FOUND (0x80070002)\" on devices in which the operating system language is changed during the update process when installing Windows 10, version 1903.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903
                                  Resolution: This issue was resolved in KB4512941.

                                  Back to top                                  		OS Build 18362.116

                                  May 21, 2019
                                  KB4505057                                  		Resolved
                                  KB4512941                                  		Resolved:
                                  August 30, 2019 
                                  10:00 AM PT

                                  Opened:
                                  May 24, 2019 
                                  04:20 PM PT
                                  
+      "
diff --git a/windows/release-information/resolved-issues-windows-10-1909.yml b/windows/release-information/resolved-issues-windows-10-1909.yml
new file mode 100644
index 0000000000..a1e9bd5092
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-10-1909.yml
@@ -0,0 +1,65 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 10, version 1909 and Windows Server, version 1909
+metadata:
+  document_id: 
+  title: Resolved issues in Windows 10, version 1909 and Windows Server, version 1909
+  description: Resolved issues in Windows 10, version 1909 and Windows Server 1909
+  keywords: ["Resolved issues in Windows 10", "Windows 10", "Windows 10, version 1909"]
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      See a list of known issues that have been resolved for Windows 10, version 1909 and Windows Server, version 1909 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+      
+      " 
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Resolved issues
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusDate resolved
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

                                  See details >                                  		OS Build 18363.476

                                  November 12, 2019
                                  KB4524570                                  		Resolved
                                  KB4530684                                  		December 10, 2019 
                                  10:00 AM PT
                                  Intermittent loss of Wi-Fi connectivity
                                  Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. 

                                  See details >                                  		OS Build 18363.476

                                  November 12, 2019
                                  KB4524570                                  		Resolved External
                                  		November 22, 2019 
                                  04:10 PM PT
                                  Unable to discover or connect to Bluetooth devices using some Realtek adapters
                                  Microsoft has identified compatibility issues with some versions of Realtek Bluetooth radio drivers.

                                  See details >                                  		OS Build 18363.476

                                  November 12, 2019
                                  KB4524570                                  		Resolved External
                                  		November 15, 2019 
                                  05:59 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: October 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

                                  Note This issue does not affect using a Microsoft Account during OOBE.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
                                  • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                                  Resolution: This issue was resolved in KB4530684.

                                  Back to top                                  		OS Build 18363.476

                                  November 12, 2019
                                  KB4524570                                  		Resolved
                                  KB4530684                                  		Resolved:
                                  December 10, 2019 
                                  10:00 AM PT

                                  Opened:
                                  October 29, 2019 
                                  05:15 PM PT
                                  
+      "
+
+- title: May 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Intermittent loss of Wi-Fi connectivity
                                  Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).

                                  To safeguard your upgrade experience, we have applied a hold on devices with affected Qualcomm driver from being offered Windows 10, version 1903 or Windows 10, version 1909, until the updated driver is installed.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903
                                  Resolution: This issue was resolved with an updated Qualcomm Wifi driver and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1909 or Windows 10, version 1903.

                                  Back to top                                  		OS Build 18363.476

                                  November 12, 2019
                                  KB4524570                                  		Resolved External
                                  		Last updated:
                                  November 22, 2019 
                                  04:10 PM PT

                                  Opened:
                                  May 21, 2019 
                                  07:13 AM PT
                                  Unable to discover or connect to Bluetooth devices using some Realtek adapters
                                  Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903
                                  • Server: Windows 10, version 1909; Windows Server, version 1903
                                  Resolution: This issue was resolved with an updated driver for the affected Realtek Bluetooth radio and the safeguard hold has been removed. Please note, it can take up to 48 hours before you can update to offered Windows 10, version 1909 or Windows 10, version 1903.

                                  Back to top                                  		OS Build 18363.476

                                  November 12, 2019
                                  KB4524570                                  		Resolved External
                                  		Last updated:
                                  November 15, 2019 
                                  05:59 PM PT

                                  Opened:
                                  May 21, 2019 
                                  07:29 AM PT
                                  
+      "
diff --git a/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml
new file mode 100644
index 0000000000..9856117a73
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-7-and-windows-server-2008-r2-sp1.yml
@@ -0,0 +1,99 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 7 and Windows Server 2008 R2 SP1
+metadata:
+  document_id: 
+  title: Resolved issues in Windows 7 and Windows Server 2008 R2 SP1
+  description: Resolved issues in Windows 7 and Windows Server 2008 R2 SP1
+  keywords: ["Resolved issues in Windows 7", "Windows 7", "Windows Server 2008 R2 SP1"]
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      See a list of known issues that have been resolved for Windows 7 and Windows Server 2008 R2 SP1 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+      
+      " 
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Resolved issues
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusDate resolved
                                  MSRT might fail to install and be re-offered from Windows Update or WSUS 
                                  The November 2019 update for Windows Malicious Software Removal Tool (MSRT) might fail to install from WU/WSUS.

                                  See details >
                                  		Resolved
                                  		January 23, 2020 
                                  02:08 PM PT
                                  Intermittent issues when printing
                                  The print spooler service may intermittently have issues completing a print job and results print job failure.

                                  See details >                                  		September 24, 2019
                                  KB4516048                                  		Resolved
                                  KB4519976                                  		October 08, 2019 
                                  10:00 AM PT
                                  You may receive an error when opening or using the Toshiba Qosmio AV Center
                                  Toshiba Qosmio AV Center may error when opening and you may also receive an error in Event Log related to cryptnet.dll.

                                  See details >                                  		August 13, 2019
                                  KB4512506                                  		Resolved
                                  KB4516048                                  		September 24, 2019 
                                  10:00 AM PT
                                  Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
                                  Windows updates that are SHA-2 signed are not available with Symantec or Norton antivirus program installed

                                  See details >                                  		August 13, 2019
                                  KB4512506                                  		Resolved External
                                  		August 27, 2019 
                                  02:29 PM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                                  See details >                                  		June 11, 2019
                                  KB4503292                                  		Resolved
                                  KB4512514                                  		August 17, 2019 
                                  02:00 PM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.

                                  See details >                                  		August 13, 2019
                                  KB4512506                                  		Resolved
                                  KB4517297                                  		August 16, 2019 
                                  02:00 PM PT
                                  System may be unresponsive after restart with certain McAfee antivirus products
                                  Devices running certain McAfee Endpoint security applications may be slow or unresponsive at startup.

                                  See details >                                  		April 09, 2019
                                  KB4493472                                  		Resolved External
                                  		August 13, 2019 
                                  06:59 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.

                                  See details >                                  		June 11, 2019
                                  KB4503292                                  		Resolved External
                                  		August 09, 2019 
                                  07:03 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  MSRT might fail to install and be re-offered from Windows Update or WSUS 
                                  The November 2019 update for Windows Malicious Software Removal Tool (MSRT) might fail to install from Windows Update (WU), Windows Server Update Services (WSUS) or Configuration Manager and might be re-offered. If you use WU or WSUS, you might also receive the following error in the WindowsUpdate.log, “Misc  WARNING: Digital Signatures on file C:\\Windows\\SoftwareDistribution\\Download\\XXXX are not trusted: Error 0x800b0109”. If you use Configuration Manager, you might also receive the following error in the WUAHandler.log, \"Failed to download updates to the WUAgent datastore. Error = 0x800b0109.     WUAHandler   14/11/2019 16:33:23        980 (0x03D4)\". Note All Configuration Manager information also applies to System Center Configuration Manager (SCCM) and Microsoft Endpoint Configuration Manager.

                                  Affected platforms:
                                  • Client: Windows 7 SP1
                                  • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in the December 2019 release of Windows Malicious Software Removal Tool (MSRT).

                                  Back to top
                                  		Resolved
                                  		Resolved:
                                  January 23, 2020 
                                  02:08 PM PT

                                  Opened:
                                  November 15, 2019 
                                  05:59 PM PT
                                  
+      "
+
+- title: September 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Intermittent issues when printing
                                  Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
                                  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
                                  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
                                  Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4519976. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

                                  Back to top                                  		September 24, 2019
                                  KB4516048                                  		Resolved
                                  KB4519976                                  		Resolved:
                                  October 08, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 30, 2019 
                                  06:26 PM PT
                                  You may receive an error when opening or using the Toshiba Qosmio AV Center
                                  After installing KB4512506, you may receive an error when opening or using the Toshiba Qosmio AV Center. You may also receive an error in Event Log related to cryptnet.dll.

                                  Affected platforms:
                                  • Client: Windows 7 SP1
                                  Resolution: This issue was resolved in KB4516048.

                                  Back to top                                  		August 13, 2019
                                  KB4512506                                  		Resolved
                                  KB4516048                                  		Resolved:
                                  September 24, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 10, 2019 
                                  09:48 AM PT
                                  
+      "
+
+- title: August 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Windows updates that are SHA-2 signed may not be offered for Symantec and Norton AV
                                  Symantec identified the potential for a negative interaction that may occur after Windows Updates code signed with SHA-2 only certificates are installed on devices with Symantec or Norton antivirus programs installed. The software may not correctly identify files included in the update as code signed by Microsoft, putting the device at risk for a delayed or incomplete update.

                                  Affected platforms:
                                  • Client: Windows 7 SP1
                                  • Server: Windows Server 2008 R2 SP1
                                  Resolution: The safeguard hold has been removed. Symantec has completed its evaluation of the impact of this update and future updates to Windows 7/Windows 2008 R2 and has determined that there is no increased risk of a false positive detection for all in-field versions of Symantec Endpoint Protection and Norton antivirus programs. See the Symantec support article for additional detail and please reach out to Symantec or Norton support if you encounter any issues.

                                  Back to top                                  		August 13, 2019
                                  KB4512506                                  		Resolved External
                                  		Last updated:
                                  August 27, 2019 
                                  02:29 PM PT

                                  Opened:
                                  August 13, 2019 
                                  10:05 AM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  After installing KB4512506, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4517297. The ‘optional’ update is now available on Microsoft Update Catalog and Windows Server Update Services (WSUS).

                                  Back to top                                  		August 13, 2019
                                  KB4512506                                  		Resolved
                                  KB4517297                                  		Resolved:
                                  August 16, 2019 
                                  02:00 PM PT

                                  Opened:
                                  August 14, 2019 
                                  03:34 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503292) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                                  Back to top                                  		June 11, 2019
                                  KB4503292                                  		Resolved External
                                  		Last updated:
                                  August 09, 2019 
                                  07:03 PM PT

                                  Opened:
                                  August 09, 2019 
                                  04:25 PM PT
                                  
+      "
+
+- title: July 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503292 on a WDS server.

                                  Affected platforms:
                                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                                  Resolution: This issue was resolved in KB4512514.

                                  Back to top                                  		June 11, 2019
                                  KB4503292                                  		Resolved
                                  KB4512514                                  		Resolved:
                                  August 17, 2019 
                                  02:00 PM PT

                                  Opened:
                                  July 10, 2019 
                                  02:51 PM PT
                                  
+      "
+
+- title: April 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  System may be unresponsive after restart with certain McAfee antivirus products
                                  Microsoft and McAfee have identified an issue on devices with McAfee Endpoint Security (ENS) Threat Prevention 10.x or McAfee Host Intrusion Prevention (Host IPS) 8.0 or McAfee VirusScan Enterprise (VSE) 8.8 installed. It may cause the system to have slow startup or become unresponsive at restart after installing this update. 

                                  Affected platforms:
                                  • Client: Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
                                  Resolution: This issue has been resolved. McAfee has released an automatic update to address this issue. Guidance for McAfee customers can be found in the following McAfee support articles: 

                                  Back to top                                  		April 09, 2019
                                  KB4493472                                  		Resolved External
                                  		Last updated:
                                  August 13, 2019 
                                  06:59 PM PT

                                  Opened:
                                  April 09, 2019 
                                  10:00 AM PT
                                  
+      "
diff --git a/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml
new file mode 100644
index 0000000000..d7ed2c1633
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-8.1-and-windows-server-2012-r2.yml
@@ -0,0 +1,97 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows 8.1 and Windows Server 2012 R2
+metadata:
+  document_id: 
+  title: Resolved issues in Windows 8.1 and Windows Server 2012 R2
+  description: Resolved issues in Windows 8.1 and Windows Server 2012 R2
+  keywords: ["Resolved issues in Windows 8.1", "Windows 8.1", "Windows Server 2012 R2"]
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      See a list of known issues that have been resolved for Windows 8.1 and Windows Server 2012 R2 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+      
+      " 
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Resolved issues
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusDate resolved
                                  Printing from 32-bit apps might fail on a 64-bit OS
                                  When attempting to print, you may receive an error or the application may stop responding or close.

                                  See details >                                  		August 13, 2019
                                  KB4512489                                  		Resolved
                                  KB4525250                                  		November 12, 2019 
                                  10:00 AM PT
                                  Intermittent issues when printing
                                  The print spooler service may intermittently have issues completing a print job and results print job failure.

                                  See details >                                  		September 24, 2019
                                  KB4516041                                  		Resolved
                                  KB4520005                                  		October 08, 2019 
                                  10:00 AM PT
                                  Windows RT 8.1 devices may have issues opening Internet Explorer 11
                                  On Windows RT 8.1 devices, Internet Explorer 11 may not open and you may receive an error.

                                  See details >                                  		September 10, 2019
                                  KB4516067                                  		Resolved
                                  KB4516041                                  		September 24, 2019 
                                  10:00 AM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                                  See details >                                  		June 11, 2019
                                  KB4503276                                  		Resolved
                                  KB4512478                                  		August 17, 2019 
                                  02:00 PM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.

                                  See details >                                  		August 13, 2019
                                  KB4512488                                  		Resolved
                                  KB4517298                                  		August 16, 2019 
                                  02:00 PM PT
                                  System may be unresponsive after restart with certain McAfee antivirus products
                                  Devices running certain McAfee Endpoint security applications may be slow or unresponsive at startup.

                                  See details >                                  		April 09, 2019
                                  KB4493446                                  		Resolved External
                                  		August 13, 2019 
                                  06:59 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.

                                  See details >                                  		June 11, 2019
                                  KB4503276                                  		Resolved External
                                  		August 09, 2019 
                                  07:03 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Printing from 32-bit apps might fail on a 64-bit OS
                                  When attempting to print from a 32-bit app on a 64-bit operating system (OS), you may receive an error, or the application may stop responding or close. Note This issue only affects the 64-bit Security Only updates listed and does not affect any Monthly Rollup.

                                  Affected platforms:
                                  • Client: Windows 8.1
                                  • Server: Windows Server 2012 R2; Windows Server 2012
                                  Resolution: This issue is resolved in KB4525250. However, the issue occurs when you install only KB4512489 (released on August 13, 2019) without installing KB4507457, the previous Security Only update (released July 9, 2019). Reminder When using the Security Only updates, you must install the latest and all previous Security Only updates to ensure that the device contains all resolved security vulnerabilities.

                                  Back to top                                  		August 13, 2019
                                  KB4512489                                  		Resolved
                                  KB4525250                                  		Resolved:
                                  November 12, 2019 
                                  10:00 AM PT

                                  Opened:
                                  November 27, 2019 
                                  04:02 PM PT
                                  
+      "
+
+- title: September 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Intermittent issues when printing
                                  Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
                                  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
                                  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
                                  Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4520005. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

                                  Back to top                                  		September 24, 2019
                                  KB4516041                                  		Resolved
                                  KB4520005                                  		Resolved:
                                  October 08, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 30, 2019 
                                  06:26 PM PT
                                  Windows RT 8.1 devices may have issues opening Internet Explorer 11
                                  On Windows 8.1 RT devices, Internet Explorer 11 may not open and you may receive the error, \"C:\\Program Files\\Internet Explorer\\iexplore.exe: A certificate was explicitly revoked by its issuer.\"


                                  Affected platforms:
                                  • Client: Windows RT 8.1
                                  Resolution: This issue was resolved in KB4516041.

                                  Back to top                                  		September 10, 2019
                                  KB4516067                                  		Resolved
                                  KB4516041                                  		Resolved:
                                  September 24, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 13, 2019 
                                  05:25 PM PT
                                  
+      "
+
+- title: August 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  After installing KB4512488, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4517298. The ‘optional’ update is now available on Microsoft Update Catalog and Windows Server Update Services (WSUS).

                                  Back to top                                  		August 13, 2019
                                  KB4512488                                  		Resolved
                                  KB4517298                                  		Resolved:
                                  August 16, 2019 
                                  02:00 PM PT

                                  Opened:
                                  August 14, 2019 
                                  03:34 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503276) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                                  Back to top                                  		June 11, 2019
                                  KB4503276                                  		Resolved External
                                  		Last updated:
                                  August 09, 2019 
                                  07:03 PM PT

                                  Opened:
                                  August 09, 2019 
                                  04:25 PM PT
                                  
+      "
+
+- title: July 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503276 on a WDS server.

                                  Affected platforms:
                                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                                  Resolution: This issue was resolved in KB4512478.

                                  Back to top                                  		June 11, 2019
                                  KB4503276                                  		Resolved
                                  KB4512478                                  		Resolved:
                                  August 17, 2019 
                                  02:00 PM PT

                                  Opened:
                                  July 10, 2019 
                                  02:51 PM PT
                                  
+      "
+
+- title: April 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  System may be unresponsive after restart with certain McAfee antivirus products
                                  Microsoft and McAfee have identified an issue on devices with McAfee Endpoint Security (ENS) Threat Prevention 10.x or McAfee Host Intrusion Prevention (Host IPS) 8.0 or McAfee VirusScan Enterprise (VSE) 8.8 installed. It may cause the system to have slow startup or become unresponsive at restart after installing this update. 

                                  Affected platforms:
                                  • Client: Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server 2012 R2; Windows Server 2008 R2 SP1
                                  Resolution: This issue has been resolved. McAfee has released an automatic update to address this issue. Guidance for McAfee customers can be found in the following McAfee support articles:  

                                  Back to top                                  		April 09, 2019
                                  KB4493446                                  		Resolved External
                                  		Last updated:
                                  August 13, 2019 
                                  06:59 PM PT

                                  Opened:
                                  April 09, 2019 
                                  10:00 AM PT
                                  
+      "
diff --git a/windows/release-information/resolved-issues-windows-server-2008-sp2.yml b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml
new file mode 100644
index 0000000000..8f891fdf1a
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-server-2008-sp2.yml
@@ -0,0 +1,87 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows Server 2008 SP2
+metadata:
+  document_id: 
+  title: Resolved issues in Windows Server 2008 SP2
+  description: Resolved issues in Windows Server 2008 SP2
+  keywords: ["Resolved issues in Windows Server 2008 SP2", "Windows Server 2008 SP2"]
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      See a list of known issues that have been resolved for Windows Server 2008 SP2 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+      
+      " 
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Resolved issues
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusDate resolved
                                  MSRT might fail to install and be re-offered from Windows Update or WSUS 
                                  The November 2019 update for Windows Malicious Software Removal Tool (MSRT) might fail to install from WU/WSUS.

                                  See details >
                                  		Resolved
                                  		January 23, 2020 
                                  02:08 PM PT
                                  Issues manually installing updates by double-clicking the .msu file
                                  You may encounter issues manually installing updates by double-clicking the .msu file and may receive an error.

                                  See details >                                  		September 10, 2019
                                  KB4474419                                  		Resolved
                                  KB4474419                                  		September 23, 2019 
                                  10:00 AM PT
                                  Intermittent issues when printing
                                  The print spooler service may intermittently have issues completing a print job and results print job failure.

                                  See details >                                  		September 24, 2019
                                  KB4516030                                  		Resolved
                                  KB4520002                                  		October 08, 2019 
                                  10:00 AM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                                  See details >                                  		June 11, 2019
                                  KB4503273                                  		Resolved
                                  KB4512499                                  		August 17, 2019 
                                  02:00 PM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.

                                  See details >                                  		August 13, 2019
                                  KB4512476                                  		Resolved
                                  KB4517301                                  		August 16, 2019 
                                  02:00 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.

                                  See details >                                  		June 11, 2019
                                  KB4503273                                  		Resolved External
                                  		August 09, 2019 
                                  07:03 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  MSRT might fail to install and be re-offered from Windows Update or WSUS 
                                  The November 2019 update for Windows Malicious Software Removal Tool (MSRT) might fail to install from Windows Update (WU), Windows Server Update Services (WSUS) or Configuration Manager and might be re-offered. If you use WU or WSUS, you might also receive the following error in the WindowsUpdate.log, “Misc  WARNING: Digital Signatures on file C:\\Windows\\SoftwareDistribution\\Download\\XXXX are not trusted: Error 0x800b0109”. If you use Configuration Manager, you might also receive the following error in the WUAHandler.log, \"Failed to download updates to the WUAgent datastore. Error = 0x800b0109.     WUAHandler   14/11/2019 16:33:23        980 (0x03D4)\". Note All Configuration Manager information also applies to System Center Configuration Manager (SCCM) and Microsoft Endpoint Configuration Manager.

                                  Affected platforms:
                                  • Client: Windows 7 SP1
                                  • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in the December 2019 release of Windows Malicious Software Removal Tool (MSRT).

                                  Back to top
                                  		Resolved
                                  		Resolved:
                                  January 23, 2020 
                                  02:08 PM PT

                                  Opened:
                                  November 15, 2019 
                                  05:59 PM PT
                                  
+      "
+
+- title: September 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Issues manually installing updates by double-clicking the .msu file
                                  After installing the SHA-2 update (KB4474419) released on September 10, 2019, you may encounter issues manually installing updates by double-clicking on the .msu file and may receive the error, \"Installer encountered an error: 0x80073afc. The resource loader failed to find MUI file.\"

                                  Affected platforms:
                                  • Server: Windows Server 2008 SP2
                                  Workaround: Open a command prompt and use the following command (replacing <msu location> with the actual location and filename of the update): wusa.exe <msu location> /quiet

                                  Resolution: This issue is resolved in KB4474419 released October 8, 2019. It will install automatically from Windows Update and Windows Server Update Services (WSUS). If you need to install this update manually, you will need to use the workaround above.

                                  Note If you previously installed KB4474419 released September 23, 2019, then you already have the latest version of this update and do not need to reinstall.

                                  Back to top                                  		September 10, 2019
                                  KB4474419                                  		Resolved
                                  KB4474419                                  		Resolved:
                                  September 23, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 20, 2019 
                                  04:57 PM PT
                                  Intermittent issues when printing
                                  Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
                                  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
                                  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
                                  Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4520002. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

                                  Back to top                                  		September 24, 2019
                                  KB4516030                                  		Resolved
                                  KB4520002                                  		Resolved:
                                  October 08, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 30, 2019 
                                  06:26 PM PT
                                  
+      "
+
+- title: August 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  After installing KB4512476, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4517301. The ‘optional’ update is now available on Microsoft Update Catalog and Windows Server Update Services (WSUS).

                                  Back to top                                  		August 13, 2019
                                  KB4512476                                  		Resolved
                                  KB4517301                                  		Resolved:
                                  August 16, 2019 
                                  02:00 PM PT

                                  Opened:
                                  August 14, 2019 
                                  03:34 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503273) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                                  Back to top                                  		June 11, 2019
                                  KB4503273                                  		Resolved External
                                  		Last updated:
                                  August 09, 2019 
                                  07:03 PM PT

                                  Opened:
                                  August 09, 2019 
                                  04:25 PM PT
                                  
+      "
+
+- title: July 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503273 on a WDS server.

                                  Affected platforms:
                                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                                  Resolution: This issue was resolved in KB4512499.

                                  Back to top                                  		June 11, 2019
                                  KB4503273                                  		Resolved
                                  KB4512499                                  		Resolved:
                                  August 17, 2019 
                                  02:00 PM PT

                                  Opened:
                                  July 10, 2019 
                                  02:51 PM PT
                                  
+      "
diff --git a/windows/release-information/resolved-issues-windows-server-2012.yml b/windows/release-information/resolved-issues-windows-server-2012.yml
new file mode 100644
index 0000000000..c2bef06cf8
--- /dev/null
+++ b/windows/release-information/resolved-issues-windows-server-2012.yml
@@ -0,0 +1,85 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Resolved issues in Windows Server 2012
+metadata:
+  document_id: 
+  title: Resolved issues in Windows Server 2012
+  description: Resolved issues in Windows Server 2012
+  keywords: ["Resolved issues in Windows Server 2012", "Windows Server 2012"]
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      See a list of known issues that have been resolved for Windows Server 2012 over the last six months. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s) to search the page.
+      
+      " 
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Resolved issues
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusDate resolved
                                  Printing from 32-bit apps might fail on a 64-bit OS
                                  When attempting to print, you may receive an error or the application may stop responding or close.

                                  See details >                                  		August 13, 2019
                                  KB4512482                                  		Resolved
                                  KB4525253                                  		November 12, 2019 
                                  10:00 AM PT
                                  Intermittent issues when printing
                                  The print spooler service may intermittently have issues completing a print job and results print job failure.

                                  See details >                                  		September 24, 2019
                                  KB4516069                                  		Resolved
                                  KB4520007                                  		October 08, 2019 
                                  10:00 AM PT
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using PXE images from Windows Deployment Services (WDS) may fail to start with error \"0xc0000001.\"

                                  See details >                                  		June 11, 2019
                                  KB4503285                                  		Resolved
                                  KB4512512                                  		August 17, 2019 
                                  02:00 PM PT
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  Applications made using VB6, macros using VBA, and VBScript may stop responding and you may receive an error.

                                  See details >                                  		August 13, 2019
                                  KB4512518                                  		Resolved
                                  KB4517302                                  		August 16, 2019 
                                  02:00 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on MacOS when trying to access network shares via CIFS or SMBv1 on certain Windows devices.

                                  See details >                                  		June 11, 2019
                                  KB4503285                                  		Resolved External
                                  		August 09, 2019 
                                  07:03 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Printing from 32-bit apps might fail on a 64-bit OS
                                  When attempting to print from a 32-bit app on a 64-bit operating system (OS), you may receive an error, or the application may stop responding or close. Note This issue only affects the 64-bit Security Only updates listed and does not affect any Monthly Rollup.

                                  Affected platforms:
                                  • Client: Windows 8.1
                                  • Server: Windows Server 2012 R2; Windows Server 2012
                                  Resolution: This issue is resolved in KB4525253. However, the issue occurs when you install only KB4512482 (released on August 13, 2019) without installing KB4507447, the previous Security Only update (released July 9, 2019). Reminder When using the Security Only updates, you must install the latest and all previous Security Only updates to ensure that the device contains all resolved security vulnerabilities.

                                  Back to top                                  		August 13, 2019
                                  KB4512482                                  		Resolved
                                  KB4525253                                  		Resolved:
                                  November 12, 2019 
                                  10:00 AM PT

                                  Opened:
                                  November 27, 2019 
                                  04:02 PM PT
                                  
+      "
+
+- title: September 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Intermittent issues when printing
                                  Applications and printer drivers that leverage the Windows Javascript engine (jscript.dll) for processing print jobs might experience one or more of the following symptoms:
                                  • Applications interacting with the V4 printer driver might close or error when printing. Issues might only be encountered when printing but might also be encountered at any time the app is running, depending on when the app interacts with the print driver.
                                  • The printer spooler service (spoolsv.exe) might close or error in jscript.dll with exception code 0xc0000005 causing the print jobs to stop processing. Only part of the print job might print and the rest might be canceled or error.
                                  Note This issue also affects the Internet Explorer Cumulative Update KB4522007, release September 23, 2019.

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4520007. If you are using Security Only updates, see KB4519974 for resolving KB for your platform.

                                  Back to top                                  		September 24, 2019
                                  KB4516069                                  		Resolved
                                  KB4520007                                  		Resolved:
                                  October 08, 2019 
                                  10:00 AM PT

                                  Opened:
                                  September 30, 2019 
                                  06:26 PM PT
                                  
+      "
+
+- title: August 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Apps using Visual Basic 6 (VB6), VBA, and VBScript may stop responding with error
                                  After installing KB4512518, applications that were made using Visual Basic 6 (VB6), macros using Visual Basic for Applications (VBA), and scripts or apps using Visual Basic Scripting Edition (VBScript) may stop responding and you may receive an \"invalid procedure call error.\"

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in KB4517302. The ‘optional’ update is now available on Microsoft Update Catalog and Windows Server Update Services (WSUS).

                                  Back to top                                  		August 13, 2019
                                  KB4512518                                  		Resolved
                                  KB4517302                                  		Resolved:
                                  August 16, 2019 
                                  02:00 PM PT

                                  Opened:
                                  August 14, 2019 
                                  03:34 PM PT
                                  MacOS may be unable to access network shares via CIFS or SMBv1 on Windows devices
                                  You may receive an error on your Apple MacOS device when trying to access network shares via CIFS or SMBv1 on a Windows devices that has installed updates on June 11, 2019 (KB4503285) or later. When you encounter this issue, in MacOS you may receive the error, “There was a problem connecting to the server “{Server Host Name}”. Check the server name or IP address, and then try again. If you continue to have problems, contact your system administrator.”

                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: For guidance on this issue, see the Apple support article If your Mac can't use NTLM to connect to a Windows server. There is no update for Windows needed for this issue.

                                  Back to top                                  		June 11, 2019
                                  KB4503285                                  		Resolved External
                                  		Last updated:
                                  August 09, 2019 
                                  07:03 PM PT

                                  Opened:
                                  August 09, 2019 
                                  04:25 PM PT
                                  
+      "
+
+- title: July 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Devices starting using PXE from a WDS or SCCM servers may fail to start
                                  Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error \"Status: 0xc0000001, Info: A required device isn't connected or can't be accessed\" after installing KB4503285 on a WDS server.

                                  Affected platforms:
                                  • Server: Windows Server 2008 SP2; Windows Server 2008 R2 SP1; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server, version 1803; Windows Server 2019; Windows Server, version 1809; Windows Server, version 1903
                                  Resolution: This issue was resolved in KB4512512.

                                  Back to top                                  		June 11, 2019
                                  KB4503285                                  		Resolved
                                  KB4512512                                  		Resolved:
                                  August 17, 2019 
                                  02:00 PM PT

                                  Opened:
                                  July 10, 2019 
                                  02:51 PM PT
                                  
+      "
diff --git a/windows/release-information/status-windows-10-1507.yml b/windows/release-information/status-windows-10-1507.yml
new file mode 100644
index 0000000000..9891ddf467
--- /dev/null
+++ b/windows/release-information/status-windows-10-1507.yml
@@ -0,0 +1,91 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1507
+metadata:
+  document_id: 
+  title: Windows 10, version 1507
+  description: View announcements and review known issues and fixes for Windows 10 version 1507
+  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      Find information on known issues for Windows 10, version 1507. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+      
+      " 
+
+- items:
+  - type: list
+    style: cards
+    className: cardsM
+    columns: 3
+    items:
+    
+    - href: https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/14/windows-7-support-ends-today-and-windows-10-is-better-than-ever/
+      html: Find out what you need to know >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_alert.svg
+      title: Windows 7 has reached end of support
+    - href: https://aka.ms/1909mechanics
+      html: Explore the improvements >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_investigate.svg
+      title: Windows 10, version 1909 delivery options
+    - href: https://aka.ms/whats-new-in-1909
+      html: Learn about the latest capabilities for IT >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_article.svg
+      title: What’s new in Windows 10, version 1909
+- items:
+  - type: markdown
+    text: "
+      
+      "
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Known issues
+- items:
+  - type: markdown
+    text: "
                                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                                  
+      
+      
+      
+      
                                  SummaryOriginating updateStatusLast updated
                                  TLS connections might fail or timeout
                                  Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

                                  See details >                                  		OS Build 10240.18368

                                  October 08, 2019
                                  KB4520011                                  		Mitigated External
                                  		November 05, 2019 
                                  03:36 PM PT
                                  Certain operations performed on a Cluster Shared Volume may fail
                                  Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

                                  See details >                                  		OS Build 10240.18094

                                  January 08, 2019
                                  KB4480962                                  		Mitigated
                                  		April 25, 2019 
                                  02:00 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  TLS connections might fail or timeout
                                  Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
                                  • \"The request was aborted: Could not create SSL/TLS secure Channel\"
                                  • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

                                  Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

                                  Back to top                                  		OS Build 10240.18368

                                  October 08, 2019
                                  KB4520011                                  		Mitigated External
                                  		Last updated:
                                  November 05, 2019 
                                  03:36 PM PT

                                  Opened:
                                  November 05, 2019 
                                  03:36 PM PT
                                  
+      "
+
+- title: January 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Certain operations performed on a Cluster Shared Volume may fail
                                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

                                  Affected platforms: 
                                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                                  Workaround: Do one of the following: 
                                  • Perform the operation from a process that has administrator privilege. 
                                  • Perform the operation from a node that doesn’t have CSV ownership. 
                                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                                  Back to top                                  		OS Build 10240.18094

                                  January 08, 2019
                                  KB4480962                                  		Mitigated
                                  		Last updated:
                                  April 25, 2019 
                                  02:00 PM PT

                                  Opened:
                                  January 08, 2019 
                                  10:00 AM PT
                                  
+      "
diff --git a/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml
new file mode 100644
index 0000000000..4a3d572494
--- /dev/null
+++ b/windows/release-information/status-windows-10-1607-and-windows-server-2016.yml
@@ -0,0 +1,103 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1607 and Windows Server 2016
+metadata:
+  document_id: 
+  title: Windows 10, version 1607 and Windows Server 2016
+  description: View announcements and review known issues and fixes for Windows 10 version 1607 and Windows Server 2016
+  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      Find information on known issues for Windows 10, version 1607 and Windows Server 2016. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+      
+      " 
+
+- items:
+  - type: list
+    style: cards
+    className: cardsM
+    columns: 3
+    items:
+    
+    - href: https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/14/windows-7-support-ends-today-and-windows-10-is-better-than-ever/
+      html: Find out what you need to know >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_alert.svg
+      title: Windows 7 has reached end of support
+    - href: https://aka.ms/1909mechanics
+      html: Explore the improvements >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_investigate.svg
+      title: Windows 10, version 1909 delivery options
+    - href: https://aka.ms/whats-new-in-1909
+      html: Learn about the latest capabilities for IT >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_article.svg
+      title: What’s new in Windows 10, version 1909
+- items:
+  - type: markdown
+    text: "
+      
+      "
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Known issues
+- items:
+  - type: markdown
+    text: "
                                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                                  
+      
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusLast updated
                                  Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
                                  Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

                                  See details >                                  		OS Build 14393.2608

                                  November 13, 2018
                                  KB4467691                                  		Resolved External
                                  		January 23, 2020 
                                  02:08 PM PT
                                  TLS connections might fail or timeout
                                  Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

                                  See details >                                  		OS Build 14393.3274

                                  October 08, 2019
                                  KB4519998                                  		Mitigated External
                                  		November 05, 2019 
                                  03:36 PM PT
                                  Certain operations performed on a Cluster Shared Volume may fail
                                  Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

                                  See details >                                  		OS Build 14393.2724

                                  January 08, 2019
                                  KB4480961                                  		Mitigated
                                  		April 25, 2019 
                                  02:00 PM PT
                                  Cluster service may fail if the minimum password length is set to greater than 14
                                  The cluster service may fail to start if “Minimum Password Length” is configured with greater than 14 characters.

                                  See details >                                  		OS Build 14393.2639

                                  November 27, 2018
                                  KB4467684                                  		Mitigated
                                  		April 25, 2019 
                                  02:00 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  TLS connections might fail or timeout
                                  Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
                                  • \"The request was aborted: Could not create SSL/TLS secure Channel\"
                                  • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

                                  Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

                                  Back to top                                  		OS Build 14393.3274

                                  October 08, 2019
                                  KB4519998                                  		Mitigated External
                                  		Last updated:
                                  November 05, 2019 
                                  03:36 PM PT

                                  Opened:
                                  November 05, 2019 
                                  03:36 PM PT
                                  
+      "
+
+- title: January 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Certain operations performed on a Cluster Shared Volume may fail
                                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. 

                                  Affected platforms: 
                                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507;  Windows 10 Enterprise LTSB 2015; Windows 8.1
                                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                                  Workaround: Do one of the following:
                                  • Perform the operation from a process that has administrator privilege. 
                                  • Perform the operation from a node that doesn’t have CSV ownership.
                                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                                  Back to top                                  		OS Build 14393.2724

                                  January 08, 2019
                                  KB4480961                                  		Mitigated
                                  		Last updated:
                                  April 25, 2019 
                                  02:00 PM PT

                                  Opened:
                                  January 08, 2019 
                                  10:00 AM PT
                                  
+      "
+
+- title: November 2018
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Windows may not start on certain Lenovo and Fujitsu laptops with less than 8GB of RAM
                                  After installing KB4467691, Windows may fail to start on certain Lenovo and Fujitsu laptops that have less than 8 GB of RAM.

                                  Affected platforms:
                                  • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                                  • Server: Windows Server 2016
                                  Workaround: Restart the affected machine using the Unified Extensible Firmware Interface (UEFI). Disable Secure Boot and then restart.

                                  If BitLocker is enabled on your machine, you may have to go through BitLocker recovery after Secure Boot has been disabled.

                                  Resolution: Lenovo and Fujitsu are aware of this issue. Please contact your OEM to ask if there is a firmware update available for your device.

                                  Back to top                                  		OS Build 14393.2608

                                  November 13, 2018
                                  KB4467691                                  		Resolved External
                                  		Last updated:
                                  January 23, 2020 
                                  02:08 PM PT

                                  Opened:
                                  November 13, 2018 
                                  10:00 AM PT
                                  Cluster service may fail if the minimum password length is set to greater than 14
                                  After installing KB4467684, the cluster service may fail to start with the error \"2245 (NERR_PasswordTooShort)\" if the Group Policy \"Minimum Password Length\" is configured with greater than 14 characters.

                                  Affected platforms:
                                  • Client: Windows 10, version 1607; Windows 10 Enterprise LTSC 2016
                                  • Server: Windows Server 2016
                                  Workaround: Set the domain default \"Minimum Password Length\" policy to less than or equal to 14 characters.

                                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                                  Back to top                                  		OS Build 14393.2639

                                  November 27, 2018
                                  KB4467684                                  		Mitigated
                                  		Last updated:
                                  April 25, 2019 
                                  02:00 PM PT

                                  Opened:
                                  November 27, 2018 
                                  10:00 AM PT
                                  
+      "
diff --git a/windows/release-information/status-windows-10-1709.yml b/windows/release-information/status-windows-10-1709.yml
new file mode 100644
index 0000000000..47169eb98d
--- /dev/null
+++ b/windows/release-information/status-windows-10-1709.yml
@@ -0,0 +1,101 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1709 and Windows Server, version 1709
+metadata:
+  document_id: 
+  title: Windows 10, version 1709 and Windows Server, version 1709
+  description: View announcements and review known issues and fixes for Windows 10 version 1709 and Windows Server 1709
+  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      Find information on known issues for Windows 10, version 1709 and Windows Server, version 1709. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+      
+      " 
+
+- items:
+  - type: list
+    style: cards
+    className: cardsM
+    columns: 3
+    items:
+    
+    - href: https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/14/windows-7-support-ends-today-and-windows-10-is-better-than-ever/
+      html: Find out what you need to know >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_alert.svg
+      title: Windows 7 has reached end of support
+    - href: https://aka.ms/1909mechanics
+      html: Explore the improvements >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_investigate.svg
+      title: Windows 10, version 1909 delivery options
+    - href: https://aka.ms/whats-new-in-1909
+      html: Learn about the latest capabilities for IT >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_article.svg
+      title: What’s new in Windows 10, version 1909
+- items:
+  - type: markdown
+    text: "
+      
+      "
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Known issues
+- items:
+  - type: markdown
+    text: "
                                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                                  
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusLast updated
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

                                  See details >                                  		OS Build 16299.1387

                                  September 10, 2019
                                  KB4516066                                  		Resolved
                                  KB4534318                                  		January 23, 2020 
                                  02:00 PM PT
                                  TLS connections might fail or timeout
                                  Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

                                  See details >                                  		OS Build 16299.1451

                                  October 08, 2019
                                  KB4520004                                  		Mitigated External
                                  		November 05, 2019 
                                  03:36 PM PT
                                  Certain operations performed on a Cluster Shared Volume may fail
                                  Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

                                  See details >                                  		OS Build 16299.904

                                  January 08, 2019
                                  KB4480978                                  		Mitigated
                                  		April 25, 2019 
                                  02:00 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  TLS connections might fail or timeout
                                  Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
                                  • \"The request was aborted: Could not create SSL/TLS secure Channel\"
                                  • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

                                  Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

                                  Back to top                                  		OS Build 16299.1451

                                  October 08, 2019
                                  KB4520004                                  		Mitigated External
                                  		Last updated:
                                  November 05, 2019 
                                  03:36 PM PT

                                  Opened:
                                  November 05, 2019 
                                  03:36 PM PT
                                  
+      "
+
+- title: October 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

                                  Note This issue does not affect using a Microsoft Account during OOBE.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
                                  • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                                  Resolution: This issue was resolved in KB4534318.

                                  Back to top                                  		OS Build 16299.1387

                                  September 10, 2019
                                  KB4516066                                  		Resolved
                                  KB4534318                                  		Resolved:
                                  January 23, 2020 
                                  02:00 PM PT

                                  Opened:
                                  October 29, 2019 
                                  05:15 PM PT
                                  
+      "
+
+- title: January 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Certain operations performed on a Cluster Shared Volume may fail
                                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. 

                                  Affected platforms: 
                                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                                  Workaround: Do one of the following:
                                  • Perform the operation from a process that has administrator privilege. 
                                  • Perform the operation from a node that doesn’t have CSV ownership. 
                                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                                  Back to top                                  		OS Build 16299.904

                                  January 08, 2019
                                  KB4480978                                  		Mitigated
                                  		Last updated:
                                  April 25, 2019 
                                  02:00 PM PT

                                  Opened:
                                  January 08, 2019 
                                  10:00 AM PT
                                  
+      "
diff --git a/windows/release-information/status-windows-10-1803.yml b/windows/release-information/status-windows-10-1803.yml
new file mode 100644
index 0000000000..9f10885c6c
--- /dev/null
+++ b/windows/release-information/status-windows-10-1803.yml
@@ -0,0 +1,105 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1803
+metadata:
+  document_id: 
+  title: Windows 10, version 1803
+  description: View announcements and review known issues and fixes for Windows 10 version 1803
+  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      Find information on known issues for Windows 10, version 1803. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+      
+ 
+
                                  Current status as of November 12, 2019:       
                                  Windows 10, version 1803 (the April 2018 Update) Home and Pro editions have reached end of service. For Windows 10 devices that are at, or within several months of reaching end of service, Windows Update will automatically initiate a feature update (with users having the ability to choose a convenient time); keeping those devices supported and receiving the monthly updates that are critical to device security and ecosystem health.
                                  
+
                                  
+
+      " 
+
+- items:
+  - type: list
+    style: cards
+    className: cardsM
+    columns: 3
+    items:
+    
+    - href: https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/14/windows-7-support-ends-today-and-windows-10-is-better-than-ever/
+      html: Find out what you need to know >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_alert.svg
+      title: Windows 7 has reached end of support
+    - href: https://aka.ms/1909mechanics
+      html: Explore the improvements >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_investigate.svg
+      title: Windows 10, version 1909 delivery options
+    - href: https://aka.ms/whats-new-in-1909
+      html: Learn about the latest capabilities for IT >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_article.svg
+      title: What’s new in Windows 10, version 1909
+- items:
+  - type: markdown
+    text: "
+      
+      "
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Known issues
+- items:
+  - type: markdown
+    text: "
                                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                                  
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusLast updated
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

                                  See details >                                  		OS Build 17134.1006

                                  September 10, 2019
                                  KB4516058                                  		Resolved
                                  KB4534308                                  		January 23, 2020 
                                  02:00 PM PT
                                  TLS connections might fail or timeout
                                  Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

                                  See details >                                  		OS Build 17134.1069

                                  October 08, 2019
                                  KB4520008                                  		Mitigated External
                                  		November 05, 2019 
                                  03:36 PM PT
                                  Certain operations performed on a Cluster Shared Volume may fail
                                  Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

                                  See details >                                  		OS Build 17134.523

                                  January 08, 2019
                                  KB4480966                                  		Mitigated
                                  		April 25, 2019 
                                  02:00 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  TLS connections might fail or timeout
                                  Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
                                  • \"The request was aborted: Could not create SSL/TLS secure Channel\"
                                  • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

                                  Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

                                  Back to top                                  		OS Build 17134.1069

                                  October 08, 2019
                                  KB4520008                                  		Mitigated External
                                  		Last updated:
                                  November 05, 2019 
                                  03:36 PM PT

                                  Opened:
                                  November 05, 2019 
                                  03:36 PM PT
                                  
+      "
+
+- title: October 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

                                  Note This issue does not affect using a Microsoft Account during OOBE.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
                                  • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                                  Resolution: This issue was resolved in KB4534308.

                                  Back to top                                  		OS Build 17134.1006

                                  September 10, 2019
                                  KB4516058                                  		Resolved
                                  KB4534308                                  		Resolved:
                                  January 23, 2020 
                                  02:00 PM PT

                                  Opened:
                                  October 29, 2019 
                                  05:15 PM PT
                                  
+      "
+
+- title: January 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Certain operations performed on a Cluster Shared Volume may fail
                                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

                                  Affected platforms: 
                                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                                  Workaround: Do one of the following:
                                  • Perform the operation from a process that has administrator privilege. 
                                  • Perform the operation from a node that doesn’t have CSV ownership. 
                                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                                  Back to top                                  		OS Build 17134.523

                                  January 08, 2019
                                  KB4480966                                  		Mitigated
                                  		Last updated:
                                  April 25, 2019 
                                  02:00 PM PT

                                  Opened:
                                  January 08, 2019 
                                  10:00 AM PT
                                  
+      "
diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml
new file mode 100644
index 0000000000..2e9516660f
--- /dev/null
+++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml
@@ -0,0 +1,115 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1809 and Windows Server 2019
+metadata:
+  document_id: 
+  title: Windows 10, version 1809 and Windows Server 2019
+  description: View announcements and review known issues and fixes for Windows 10 version 1809 and Windows Server 2019
+  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      Find information on known issues for Windows 10, version 1809 and Windows Server 2019. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+      
+ 
+
                                  Current status as of November 12, 2019:
                                  Windows 10, version 1809 is designated for broad deployment. The recommended servicing status is Semi-Annual Channel.
                                  
+
                                  
+
+      " 
+
+- items:
+  - type: list
+    style: cards
+    className: cardsM
+    columns: 3
+    items:
+    
+    - href: https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/14/windows-7-support-ends-today-and-windows-10-is-better-than-ever/
+      html: Find out what you need to know >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_alert.svg
+      title: Windows 7 has reached end of support
+    - href: https://aka.ms/1909mechanics
+      html: Explore the improvements >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_investigate.svg
+      title: Windows 10, version 1909 delivery options
+    - href: https://aka.ms/whats-new-in-1909
+      html: Learn about the latest capabilities for IT >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_article.svg
+      title: What’s new in Windows 10, version 1909
+- items:
+  - type: markdown
+    text: "
+      
+      "
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Known issues
+- items:
+  - type: markdown
+    text: "
                                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                                  
+      
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusLast updated
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  You might be unable to create users in Chinese, Japanese and Korean using Input Method Editor (IME) during OOBE.

                                  See details >                                  		OS Build 17763.737

                                  September 10, 2019
                                  KB4512578                                  		Resolved
                                  KB4534321                                  		January 23, 2020 
                                  02:00 PM PT
                                  TLS connections might fail or timeout
                                  Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

                                  See details >                                  		OS Build 17763.805

                                  October 08, 2019
                                  KB4519338                                  		Mitigated External
                                  		November 05, 2019 
                                  03:36 PM PT
                                  Devices with some Asian language packs installed may receive an error
                                  Devices with Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\"

                                  See details >                                  		OS Build 17763.437

                                  April 09, 2019
                                  KB4493509                                  		Mitigated
                                  		May 03, 2019 
                                  10:59 AM PT
                                  Certain operations performed on a Cluster Shared Volume may fail 
                                  Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

                                  See details >                                  		OS Build 17763.253

                                  January 08, 2019
                                  KB4480116                                  		Mitigated
                                  		April 09, 2019 
                                  10:00 AM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  TLS connections might fail or timeout
                                  Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
                                  • \"The request was aborted: Could not create SSL/TLS secure Channel\"
                                  • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

                                  Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

                                  Back to top                                  		OS Build 17763.805

                                  October 08, 2019
                                  KB4519338                                  		Mitigated External
                                  		Last updated:
                                  November 05, 2019 
                                  03:36 PM PT

                                  Opened:
                                  November 05, 2019 
                                  03:36 PM PT
                                  
+      "
+
+- title: October 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Unable to create local users in Chinese, Japanese and Korean during device setup
                                  When setting up a new Windows device using the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages.

                                  Note This issue does not affect using a Microsoft Account during OOBE.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709
                                  • Server: Windows Server, version 1909; Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709
                                  Resolution: This issue was resolved in KB4534321.

                                  Back to top                                  		OS Build 17763.737

                                  September 10, 2019
                                  KB4512578                                  		Resolved
                                  KB4534321                                  		Resolved:
                                  January 23, 2020 
                                  02:00 PM PT

                                  Opened:
                                  October 29, 2019 
                                  05:15 PM PT
                                  
+      "
+
+- title: May 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Devices with some Asian language packs installed may receive an error
                                  After installing the April 2019 Cumulative Update (KB4493509), devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\"

                                  Affected platforms:
                                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
                                  • Server: Windows Server, version 1809; Windows Server 2019
                                  Workaround: 
                                  1. Uninstall and reinstall any recently added language packs. For instructions, see \"Manage the input and display language settings in Windows 10\".
                                  2. Click Check for Updates and install the April 2019 Cumulative Update. For instructions, see \"Update Windows 10\".
                                  Note: If reinstalling the language pack does not mitigate the issue, reset your PC as follows:
                                    1. Go to Settings app -> Recovery.
                                    2. Click on Get Started under \"Reset this PC\" recovery option.
                                    3. Select \"Keep my Files\".
                                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                                  Back to top                                  		OS Build 17763.437

                                  April 09, 2019
                                  KB4493509                                  		Mitigated
                                  		Last updated:
                                  May 03, 2019 
                                  10:59 AM PT

                                  Opened:
                                  May 02, 2019 
                                  04:36 PM PT
                                  
+      "
+
+- title: January 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Certain operations performed on a Cluster Shared Volume may fail 
                                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege. 

                                  Affected platforms: 
                                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                                  Workaround: Do one of the following:  
                                  • Perform the operation from a process that has administrator privilege. 
                                  • Perform the operation from a node that doesn’t have CSV ownership. 
                                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                                  Back to top                                  		OS Build 17763.253

                                  January 08, 2019
                                  KB4480116                                  		Mitigated
                                  		Last updated:
                                  April 09, 2019 
                                  10:00 AM PT

                                  Opened:
                                  January 08, 2019 
                                  10:00 AM PT
                                  
+      "
diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml
new file mode 100644
index 0000000000..b1bf959c78
--- /dev/null
+++ b/windows/release-information/status-windows-10-1903.yml
@@ -0,0 +1,87 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1903 and Windows Server, version 1903
+metadata:
+  document_id: 
+  title: Windows 10, version 1903 and Windows Server, version 1903
+  description: View announcements and review known issues and fixes for Windows 10 version 1903 and Windows Server 1903
+  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      Find information on known issues and the status of the rollout for Windows 10, version 1903 and Windows Server, version 1903. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+      
+ 
+
                                  Current status as of November 12, 2019:   
                                  Windows 10, version 1903 (the May 2019 Update) is designated ready for broad deployment for all users via Windows Update.

                                  We recommend commercial customers running earlier versions of Windows 10 begin broad deployments of Windows 10, version 1903 in their organizations.

                                  Note Follow @WindowsUpdate to find out when new content is published to the release information dashboard.
                                  
+
                                  
+
+      " 
+
+- items:
+  - type: list
+    style: cards
+    className: cardsM
+    columns: 3
+    items:
+    
+    - href: https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/14/windows-7-support-ends-today-and-windows-10-is-better-than-ever/
+      html: Find out what you need to know >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_alert.svg
+      title: Windows 7 has reached end of support
+    - href: https://aka.ms/1909mechanics
+      html: Explore the improvements >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_investigate.svg
+      title: Windows 10, version 1909 delivery options
+    - href: https://aka.ms/whats-new-in-1909
+      html: Learn about the latest capabilities for IT >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_article.svg
+      title: What’s new in Windows 10, version 1909
+- items:
+  - type: markdown
+    text: "
+      
+      "
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Known issues
+- items:
+  - type: markdown
+    text: "
                                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                                  
+      
+      
+      
+      
                                  SummaryOriginating updateStatusLast updated
                                  Issues with some older versions of Avast and AVG anti-virus products
                                  Microsoft and Avast has identified compatibility issues with some versions of Avast and AVG Antivirus.

                                  See details >                                  		N/A 

                                  		Mitigated External
                                  		November 25, 2019 
                                  05:25 PM PT
                                  TLS connections might fail or timeout
                                  Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

                                  See details >                                  		OS Build 18362.418

                                  October 08, 2019
                                  KB4517389                                  		Mitigated External
                                  		November 05, 2019 
                                  03:36 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Issues with some older versions of Avast and AVG anti-virus products
                                  Microsoft and Avast has identified compatibility issues with some older versions of Avast Antivirus and AVG Antivirus that might still be installed by a small number of users. Any application from Avast or AVG that contains Antivirus version 19.5.4444.567 or earlier is affected.

                                  To safeguard your upgrade experience, we have applied a hold on devices with affected Avast and AVG Antivirus from being offered or installing Windows 10, version 1903 or Windows 10, version 1909, until the application is updated.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903
                                  • Server: Windows Server, version 1909; Windows Server, version 1903
                                  Workaround: Before updating to Windows 10, version 1903 or Windows 10, version 1909, you will need to download and install an updated version of your Avast or AVG application. Guidance for Avast and AVG customers can be found in the following support articles:
                                  Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new version of your Avast or AVG application has been installed and the Windows 10, version 1903 or Windows 10, version 1909 feature update has been automatically offered to you.

                                  Back to top                                  		N/A 

                                  		Mitigated External
                                  		Last updated:
                                  November 25, 2019 
                                  05:25 PM PT

                                  Opened:
                                  November 22, 2019 
                                  04:10 PM PT
                                  TLS connections might fail or timeout
                                  Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
                                  • \"The request was aborted: Could not create SSL/TLS secure Channel\"
                                  • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

                                  Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

                                  Back to top                                  		OS Build 18362.418

                                  October 08, 2019
                                  KB4517389                                  		Mitigated External
                                  		Last updated:
                                  November 05, 2019 
                                  03:36 PM PT

                                  Opened:
                                  November 05, 2019 
                                  03:36 PM PT
                                  
+      "
diff --git a/windows/release-information/status-windows-10-1909.yml b/windows/release-information/status-windows-10-1909.yml
new file mode 100644
index 0000000000..36288e57f2
--- /dev/null
+++ b/windows/release-information/status-windows-10-1909.yml
@@ -0,0 +1,85 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 10, version 1909 and Windows Server, version 1909
+metadata:
+  document_id: 
+  title: Windows 10, version 1909 and Windows Server, version 1909
+  description: View announcements and review known issues and fixes for Windows 10 version 1909 and Windows Server 1909
+  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      Find information on known issues and the status of the rollout for Windows 10, version 1909 and Windows Server, version 1909. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+      
+ 
+
                                  Current status as of January 21, 2020:
                                  Windows 10, version 1909 is available for any user on a recent version of Windows 10 who manually selects “Check for updates” via Windows Update. The recommended servicing status is Semi-Annual Channel.
                                   
                                  We are starting the next phase in our controlled approach to automatically initiate a feature update for an increased number of devices running the October 2018 Update (Windows 10, version 1809) Home and Pro editions, keeping those devices supported and receiving the monthly updates that are critical to device security and ecosystem health. Our rollout process starts several months in advance of the end of service date to provide adequate time for a smooth update process.

                                  For information on how users running Windows 10, version 1903 can update to Windows 10, version 1909 in a new, streamlined way, see this post.
                                   
                                  Note follow @WindowsUpdate on Twitter to find out when new content is published to the release information dashboard.
                                  
+
                                  
+
+      " 
+
+- items:
+  - type: list
+    style: cards
+    className: cardsM
+    columns: 3
+    items:
+    
+    - href: https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/14/windows-7-support-ends-today-and-windows-10-is-better-than-ever/
+      html: Find out what you need to know >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_alert.svg
+      title: Windows 7 has reached end of support
+    - href: https://aka.ms/1909mechanics
+      html: Explore the improvements >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_investigate.svg
+      title: Windows 10, version 1909 delivery options
+    - href: https://aka.ms/whats-new-in-1909
+      html: Learn about the latest capabilities for IT >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_article.svg
+      title: What’s new in Windows 10, version 1909
+- items:
+  - type: markdown
+    text: "
+      
+      "
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Known issues
+- items:
+  - type: markdown
+    text: "
                                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                                  
+      
+      
+      
                                  SummaryOriginating updateStatusLast updated
                                  Issues with some older versions of Avast and AVG anti-virus products
                                  Microsoft and Avast has identified compatibility issues with some versions of Avast and AVG Antivirus.

                                  See details >                                  		N/A 

                                  		Mitigated External
                                  		November 25, 2019 
                                  05:25 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Issues with some older versions of Avast and AVG anti-virus products
                                  Microsoft and Avast has identified compatibility issues with some older versions of Avast Antivirus and AVG Antivirus that might still be installed by a small number of users. Any application from Avast or AVG that contains Antivirus version 19.5.4444.567 or earlier is affected.

                                  To safeguard your upgrade experience, we have applied a hold on devices with affected Avast and AVG Antivirus from being offered or installing Windows 10, version 1903 or Windows 10, version 1909, until the application is updated.

                                  Affected platforms:
                                  • Client: Windows 10, version 1909; Windows 10, version 1903
                                  • Server: Windows Server, version 1909; Windows Server, version 1903
                                  Workaround: Before updating to Windows 10, version 1903 or Windows 10, version 1909, you will need to download and install an updated version of your Avast or AVG application. Guidance for Avast and AVG customers can be found in the following support articles:
                                  Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new version of your Avast or AVG application has been installed and the Windows 10, version 1903 or Windows 10, version 1909 feature update has been automatically offered to you.

                                  Back to top                                  		N/A 

                                  		Mitigated External
                                  		Last updated:
                                  November 25, 2019 
                                  05:25 PM PT

                                  Opened:
                                  November 22, 2019 
                                  04:10 PM PT
                                  
+      "
diff --git a/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml
new file mode 100644
index 0000000000..a5cd7e2724
--- /dev/null
+++ b/windows/release-information/status-windows-7-and-windows-server-2008-r2-sp1.yml
@@ -0,0 +1,103 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 7 and Windows Server 2008 R2 SP1
+metadata:
+  document_id: 
+  title: Windows 7 and Windows Server 2008 R2 SP1
+  description: View announcements and review known issues and fixes for Windows 7 and Windows Server 2008 R2 SP1
+  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      Find information on known issues for Windows 7 and Windows Server 2008 R2 SP1. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+      
+      " 
+
+- items:
+  - type: list
+    style: cards
+    className: cardsM
+    columns: 3
+    items:
+    
+    - href: https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/14/windows-7-support-ends-today-and-windows-10-is-better-than-ever/
+      html: Find out what you need to know >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_alert.svg
+      title: Windows 7 has reached end of support
+    - href: https://aka.ms/1909mechanics
+      html: Explore the improvements >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_investigate.svg
+      title: Windows 10, version 1909 delivery options
+    - href: https://aka.ms/whats-new-in-1909
+      html: Learn about the latest capabilities for IT >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_article.svg
+      title: What’s new in Windows 10, version 1909
+- items:
+  - type: markdown
+    text: "
+      
+      "
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Known issues
+- items:
+  - type: markdown
+    text: "
                                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                                  
+      
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusLast updated
                                  Custom wallpaper displays as black
                                  Using a custom image set to \"Stretch\" might not display as expected.

                                  See details >                                  		January 14, 2020
                                  KB4534310                                  		Mitigated
                                  		January 27, 2020 
                                  12:27 PM PT
                                  MSRT might fail to install and be re-offered from Windows Update or WSUS 
                                  The November 2019 update for Windows Malicious Software Removal Tool (MSRT) might fail to install from WU/WSUS.

                                  See details >
                                  		Resolved
                                  		January 23, 2020 
                                  02:08 PM PT
                                  TLS connections might fail or timeout
                                  Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

                                  See details >                                  		October 08, 2019
                                  KB4519976                                  		Mitigated External
                                  		November 05, 2019 
                                  03:36 PM PT
                                  IA64 and x64 devices may fail to start after installing updates
                                  After installing updates released on or after August 13, 2019, IA64 and x64 devices using EFI Boot may fail to start.

                                  See details >                                  		August 13, 2019
                                  KB4512506                                  		Mitigated
                                  		August 17, 2019 
                                  12:59 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: January 2020
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Custom wallpaper displays as black
                                  After installing KB4534310, your desktop wallpaper when set to \"Stretch\" might display as black.

                                  Affected platforms:
                                  • Client: Windows 7 SP1
                                  • Server: Windows Server 2008 R2 SP1
                                  Workaround: To mitigate the issue, you can do one of the following:
                                  • Set your custom image to an option other than \"Stretch\", such as “Fill”, “Fit”, “Tile”, or “Center”, or
                                  • Choose a custom wallpaper that matches the resolution of your desktop.
                                  Next steps: We are working on a resolution and estimate a solution will be available mid-February, which will be released to all customers running Windows 7 and Windows Server 2008 R2 SP1.

                                  Back to top                                  		January 14, 2020
                                  KB4534310                                  		Mitigated
                                  		Last updated:
                                  January 27, 2020 
                                  12:27 PM PT

                                  Opened:
                                  January 24, 2020 
                                  09:15 AM PT
                                  
+      "
+
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  MSRT might fail to install and be re-offered from Windows Update or WSUS 
                                  The November 2019 update for Windows Malicious Software Removal Tool (MSRT) might fail to install from Windows Update (WU), Windows Server Update Services (WSUS) or Configuration Manager and might be re-offered. If you use WU or WSUS, you might also receive the following error in the WindowsUpdate.log, “Misc  WARNING: Digital Signatures on file C:\\Windows\\SoftwareDistribution\\Download\\XXXX are not trusted: Error 0x800b0109”. If you use Configuration Manager, you might also receive the following error in the WUAHandler.log, \"Failed to download updates to the WUAgent datastore. Error = 0x800b0109.     WUAHandler   14/11/2019 16:33:23        980 (0x03D4)\". Note All Configuration Manager information also applies to System Center Configuration Manager (SCCM) and Microsoft Endpoint Configuration Manager.

                                  Affected platforms:
                                  • Client: Windows 7 SP1
                                  • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in the December 2019 release of Windows Malicious Software Removal Tool (MSRT).

                                  Back to top
                                  		Resolved
                                  		Resolved:
                                  January 23, 2020 
                                  02:08 PM PT

                                  Opened:
                                  November 15, 2019 
                                  05:59 PM PT
                                  TLS connections might fail or timeout
                                  Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
                                  • \"The request was aborted: Could not create SSL/TLS secure Channel\"
                                  • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

                                  Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

                                  Back to top                                  		October 08, 2019
                                  KB4519976                                  		Mitigated External
                                  		Last updated:
                                  November 05, 2019 
                                  03:36 PM PT

                                  Opened:
                                  November 05, 2019 
                                  03:36 PM PT
                                  
+      "
+
+- title: August 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  IA64 and x64 devices may fail to start after installing updates
                                  IA64 devices (in any configuration) and x64 devices using EFI boot that were provisioned after the July 9th updates and/or skipped the recommended update (KB3133977), may fail to start with the following error:
                                  \"File: \\Windows\\system32\\winload.efi
                                  Status: 0xc0000428
                                  Info: Windows cannot verify the digital signature for this file.\"

                                  Affected platforms:
                                  • Client: Windows 7 SP1
                                  • Server: Windows Server 2008 R2 SP1
                                  Take Action: To resolve this issue please follow the steps outlined in the SHA-2 support FAQ article for error code 0xc0000428.

                                  Back to top                                  		August 13, 2019
                                  KB4512506                                  		Mitigated
                                  		Last updated:
                                  August 17, 2019 
                                  12:59 PM PT

                                  Opened:
                                  August 13, 2019 
                                  08:34 AM PT
                                  
+      "
diff --git a/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml
new file mode 100644
index 0000000000..388b55fa0a
--- /dev/null
+++ b/windows/release-information/status-windows-8.1-and-windows-server-2012-r2.yml
@@ -0,0 +1,101 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows 8.1 and Windows Server 2012 R2
+metadata:
+  document_id: 
+  title: Windows 8.1 and Windows Server 2012 R2
+  description: View announcements and review known issues and fixes for Windows 8.1 and Windows Server 2012 R2
+  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      Find information on known issues for Windows 8.1 and Windows Server 2012 R2. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+      
+      " 
+
+- items:
+  - type: list
+    style: cards
+    className: cardsM
+    columns: 3
+    items:
+    
+    - href: https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/14/windows-7-support-ends-today-and-windows-10-is-better-than-ever/
+      html: Find out what you need to know >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_alert.svg
+      title: Windows 7 has reached end of support
+    - href: https://aka.ms/1909mechanics
+      html: Explore the improvements >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_investigate.svg
+      title: Windows 10, version 1909 delivery options
+    - href: https://aka.ms/whats-new-in-1909
+      html: Learn about the latest capabilities for IT >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_article.svg
+      title: What’s new in Windows 10, version 1909
+- items:
+  - type: markdown
+    text: "
+      
+      "
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Known issues
+- items:
+  - type: markdown
+    text: "
                                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                                  
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusLast updated
                                  TLS connections might fail or timeout
                                  Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

                                  See details >                                  		October 08, 2019
                                  KB4520005                                  		Mitigated External
                                  		November 05, 2019 
                                  03:36 PM PT
                                  Japanese IME doesn't show the new Japanese Era name as a text input option
                                  With previous dictionary updates installed, the Japanese IME doesn't show the new Japanese Era name as an input option.

                                  See details >                                  		April 25, 2019
                                  KB4493443                                  		Mitigated
                                  		May 15, 2019 
                                  05:53 PM PT
                                  Certain operations performed on a Cluster Shared Volume may fail
                                  Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

                                  See details >                                  		January 08, 2019
                                  KB4480963                                  		Mitigated
                                  		April 25, 2019 
                                  02:00 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  TLS connections might fail or timeout
                                  Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
                                  • \"The request was aborted: Could not create SSL/TLS secure Channel\"
                                  • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

                                  Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

                                  Back to top                                  		October 08, 2019
                                  KB4520005                                  		Mitigated External
                                  		Last updated:
                                  November 05, 2019 
                                  03:36 PM PT

                                  Opened:
                                  November 05, 2019 
                                  03:36 PM PT
                                  
+      "
+
+- title: May 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Japanese IME doesn't show the new Japanese Era name as a text input option
                                  If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

                                  Affected platforms:
                                  • Client: Windows 8.1
                                  • Server: Windows Server 2012 R2; Windows Server 2012
                                  Workaround: 
                                  If you see any of the previous dictionary updates listed below, uninstall it from Programs and features > Uninstall or change a program. New words that were in previous dictionary updates are also in this update.
                                  • Update for Japanese Microsoft IME Standard Dictionary (15.0.2013)
                                  • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.2013)
                                  • Update for Japanese Microsoft IME Standard Dictionary (15.0.1215)
                                  • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1215)
                                  • Update for Japanese Microsoft IME Standard Dictionary (15.0.1080)
                                  • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1080)

                                  Back to top                                  		April 25, 2019
                                  KB4493443                                  		Mitigated
                                  		Last updated:
                                  May 15, 2019 
                                  05:53 PM PT

                                  Opened:
                                  May 15, 2019 
                                  05:53 PM PT
                                  
+      "
+
+- title: January 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Certain operations performed on a Cluster Shared Volume may fail
                                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

                                  Affected platforms: 
                                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                                  Workaround: Do one of the following:
                                  • Perform the operation from a process that has administrator privilege.
                                  • Perform the operation from a node that doesn’t have CSV ownership.
                                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                                  Back to top                                  		January 08, 2019
                                  KB4480963                                  		Mitigated
                                  		Last updated:
                                  April 25, 2019 
                                  02:00 PM PT

                                  Opened:
                                  January 08, 2019 
                                  10:00 AM PT
                                  
+      "
diff --git a/windows/release-information/status-windows-server-2008-sp2.yml b/windows/release-information/status-windows-server-2008-sp2.yml
new file mode 100644
index 0000000000..2ea115dab7
--- /dev/null
+++ b/windows/release-information/status-windows-server-2008-sp2.yml
@@ -0,0 +1,83 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows Server 2008 SP2
+metadata:
+  document_id: 
+  title: Windows Server 2008 SP2
+  description: View announcements and review known issues and fixes for Windows Server 2008 SP2
+  keywords: Windows, Windows 10, issues, fixes, announcements, Windows Server, advisories
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      Find information on known issues for Windows Server 2008 SP2. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+      
+      " 
+
+- items:
+  - type: list
+    style: cards
+    className: cardsM
+    columns: 3
+    items:
+    
+    - href: https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/14/windows-7-support-ends-today-and-windows-10-is-better-than-ever/
+      html: Find out what you need to know >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_alert.svg
+      title: Windows 7 has reached end of support
+    - href: https://aka.ms/1909mechanics
+      html: Explore the improvements >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_investigate.svg
+      title: Windows 10, version 1909 delivery options
+    - href: https://aka.ms/whats-new-in-1909
+      html: Learn about the latest capabilities for IT >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_article.svg
+      title: What’s new in Windows 10, version 1909
+- items:
+  - type: markdown
+    text: "
+      
+      "
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Known issues
+- items:
+  - type: markdown
+    text: "
                                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                                  
+      
+      
+      
+      
                                  SummaryOriginating updateStatusLast updated
                                  MSRT might fail to install and be re-offered from Windows Update or WSUS 
                                  The November 2019 update for Windows Malicious Software Removal Tool (MSRT) might fail to install from WU/WSUS.

                                  See details >
                                  		Resolved
                                  		January 23, 2020 
                                  02:08 PM PT
                                  TLS connections might fail or timeout
                                  Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

                                  See details >                                  		October 08, 2019
                                  KB4520002                                  		Mitigated External
                                  		November 05, 2019 
                                  03:36 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  MSRT might fail to install and be re-offered from Windows Update or WSUS 
                                  The November 2019 update for Windows Malicious Software Removal Tool (MSRT) might fail to install from Windows Update (WU), Windows Server Update Services (WSUS) or Configuration Manager and might be re-offered. If you use WU or WSUS, you might also receive the following error in the WindowsUpdate.log, “Misc  WARNING: Digital Signatures on file C:\\Windows\\SoftwareDistribution\\Download\\XXXX are not trusted: Error 0x800b0109”. If you use Configuration Manager, you might also receive the following error in the WUAHandler.log, \"Failed to download updates to the WUAgent datastore. Error = 0x800b0109.     WUAHandler   14/11/2019 16:33:23        980 (0x03D4)\". Note All Configuration Manager information also applies to System Center Configuration Manager (SCCM) and Microsoft Endpoint Configuration Manager.

                                  Affected platforms:
                                  • Client: Windows 7 SP1
                                  • Server: Windows Server 2008 R2 SP1; Windows Server 2008 SP2
                                  Resolution: This issue was resolved in the December 2019 release of Windows Malicious Software Removal Tool (MSRT).

                                  Back to top
                                  		Resolved
                                  		Resolved:
                                  January 23, 2020 
                                  02:08 PM PT

                                  Opened:
                                  November 15, 2019 
                                  05:59 PM PT
                                  TLS connections might fail or timeout
                                  Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
                                  • \"The request was aborted: Could not create SSL/TLS secure Channel\"
                                  • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

                                  Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

                                  Back to top                                  		October 08, 2019
                                  KB4520002                                  		Mitigated External
                                  		Last updated:
                                  November 05, 2019 
                                  03:36 PM PT

                                  Opened:
                                  November 05, 2019 
                                  03:36 PM PT
                                  
+      "
diff --git a/windows/release-information/status-windows-server-2012.yml b/windows/release-information/status-windows-server-2012.yml
new file mode 100644
index 0000000000..96c3cad5e2
--- /dev/null
+++ b/windows/release-information/status-windows-server-2012.yml
@@ -0,0 +1,101 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows Server 2012
+metadata:
+  document_id: 
+  title: Windows Server 2012
+  description: View announcements and review known issues and fixes for Windows Server 2012
+  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+- items:
+  - type: markdown
+    text: "
+      Find information on known issues for Windows Server 2012. Looking for a specific issue? Press CTRL + F (or Command + F if you are using a Mac) and enter your search term(s).
+      
+      " 
+
+- items:
+  - type: list
+    style: cards
+    className: cardsM
+    columns: 3
+    items:
+    
+    - href: https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/14/windows-7-support-ends-today-and-windows-10-is-better-than-ever/
+      html: Find out what you need to know >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_alert.svg
+      title: Windows 7 has reached end of support
+    - href: https://aka.ms/1909mechanics
+      html: Explore the improvements >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_investigate.svg
+      title: Windows 10, version 1909 delivery options
+    - href: https://aka.ms/whats-new-in-1909
+      html: Learn about the latest capabilities for IT >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_article.svg
+      title: What’s new in Windows 10, version 1909
+- items:
+  - type: markdown
+    text: "
+      
+      "
+- items:
+  - type: markdown
+    text: "
+        
                                  
+      "
+
+- title: Known issues
+- items:
+  - type: markdown
+    text: "
                                  This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

                                  
+      
+      
+      
+      
+      
                                  SummaryOriginating updateStatusLast updated
                                  TLS connections might fail or timeout
                                  Transport Layer Security (TLS) connections might fail or timeout when connecting or attempting a resumption.

                                  See details >                                  		October 08, 2019
                                  KB4520007                                  		Mitigated External
                                  		November 05, 2019 
                                  03:36 PM PT
                                  Japanese IME doesn't show the new Japanese Era name as a text input option
                                  With previous dictionary updates installed, the Japanese IME doesn't show the new Japanese Era name as an input option.

                                  See details >                                  		April 25, 2019
                                  KB4493462                                  		Mitigated
                                  		May 15, 2019 
                                  05:53 PM PT
                                  Certain operations performed on a Cluster Shared Volume may fail
                                  Operations performed on files or folders on a CSV may fail with the error: STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).

                                  See details >                                  		January 08, 2019
                                  KB4480975                                  		Mitigated
                                  		April 25, 2019 
                                  02:00 PM PT
                                  
+      "
+
+- title: Issue details
+- items:
+  - type: markdown
+    text: "
+        
                                  
+        
                                   
+      "
+- title: November 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  TLS connections might fail or timeout
                                  Updates for Windows released October 8, 2019 or later provide protections, tracked by CVE-2019-1318, against an attack that could allow unauthorized access to information or data within TLS connections. This type of attack is known as a man-in-the-middle exploit. Windows might fail to connect to TLS clients and servers that do not support Extended Master Secret for resumption (RFC 7627). Lack of RFC support might cause one or more of the following errors or logged events:
                                  • \"The request was aborted: Could not create SSL/TLS secure Channel\"
                                  • SCHANNEL event 36887 is logged in the System event log with the description, \"A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 20.​\"
                                  Affected platforms:
                                  • Client: Windows 10, version 1903; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise LTSC 2015; Windows 8.1; Windows 7 SP1
                                  • Server: Windows Server, version 1903; Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709 ; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

                                  Next Steps: Connections between two devices running any supported version of Windows should not have this issue when fully updated. There is no update for Windows needed for this issue. These changes are required to address a security issue and security compliance. For information, see KB4528489.

                                  Back to top                                  		October 08, 2019
                                  KB4520007                                  		Mitigated External
                                  		Last updated:
                                  November 05, 2019 
                                  03:36 PM PT

                                  Opened:
                                  November 05, 2019 
                                  03:36 PM PT
                                  
+      "
+
+- title: May 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Japanese IME doesn't show the new Japanese Era name as a text input option
                                  If previous dictionary updates are installed, the Japanese input method editor (IME) doesn't show the new Japanese Era name as a text input option.

                                  Affected platforms:
                                  • Client: Windows 8.1
                                  • Server: Windows Server 2012 R2; Windows Server 2012
                                  Workaround: 
                                  If you see any of the previous dictionary updates listed below, uninstall it from Programs and features > Uninstall or change a program. New words that were in previous dictionary updates are also in this update.
                                  • Update for Japanese Microsoft IME Standard Dictionary (15.0.2013)
                                  • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.2013)
                                  • Update for Japanese Microsoft IME Standard Dictionary (15.0.1215)
                                  • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1215)
                                  • Update for Japanese Microsoft IME Standard Dictionary (15.0.1080)
                                  • Update for Japanese Microsoft IME Standard Extended Dictionary (15.0.1080)

                                  Back to top                                  		April 25, 2019
                                  KB4493462                                  		Mitigated
                                  		Last updated:
                                  May 15, 2019 
                                  05:53 PM PT

                                  Opened:
                                  May 15, 2019 
                                  05:53 PM PT
                                  
+      "
+
+- title: January 2019
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
                                  DetailsOriginating updateStatusHistory
                                  Certain operations performed on a Cluster Shared Volume may fail
                                  Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, \"STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)\". This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

                                  Affected platforms: 
                                  • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10 Enterprise LTSC 2016; Windows 10, version 1507; Windows 10 Enterprise LTSB 2015; Windows 8.1
                                  • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012
                                  Workaround: Do one of the following:
                                  • Perform the operation from a process that has administrator privilege.
                                  • Perform the operation from a node that doesn’t have CSV ownership.
                                  Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

                                  Back to top                                  		January 08, 2019
                                  KB4480975                                  		Mitigated
                                  		Last updated:
                                  April 25, 2019 
                                  02:00 PM PT

                                  Opened:
                                  January 08, 2019 
                                  10:00 AM PT
                                  
+      "
diff --git a/windows/release-information/windows-message-center.yml b/windows/release-information/windows-message-center.yml
new file mode 100644
index 0000000000..7cd86d392d
--- /dev/null
+++ b/windows/release-information/windows-message-center.yml
@@ -0,0 +1,116 @@
+### YamlMime:YamlDocument
+
+documentType: LandingData
+title: Windows message center
+metadata:
+  document_id: 
+  title: Windows message center
+  description: Windows message center
+  keywords: Windows 10, issues, fixes, announcements, Windows Server, advisories
+  ms.localizationpriority: high
+  author: greg-lindsay
+  ms.author: greglin
+  manager: dougkim
+  ms.topic: article
+  ms.devlang: na
+
+sections:
+
+- items:
+  - type: list
+    style: cards
+    className: cardsM
+    columns: 2
+    items:
+    
+    - href: https://www.microsoft.com/en-us/microsoft-365/blog/2020/01/14/windows-7-support-ends-today-and-windows-10-is-better-than-ever/
+      html: Find out what you need to know >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_alert.svg
+      title: Windows 7 has reached end of support
+    - href: https://aka.ms/1909mechanics
+      html: Explore the improvements >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_investigate.svg
+      title: Windows 10, version 1909 delivery options
+    - href: https://aka.ms/whats-new-in-1909
+      html: Learn about the latest capabilities for IT >
+      image: 
+        src: http://docs.microsoft.com/media/common/i_article.svg
+      title: What’s new in Windows 10, version 1909
+    - href: https://docs.microsoft.com/windows/windows-10/release-information
+      html: Visit the Windows 10 release information page >
+      image: 
+        src: https://docs.microsoft.com/media/common/i_download-monitor.svg
+      title: Find a list of currently supported versions and previous releases
+
+- title: Recent announcements
+- items:
+  - type: markdown
+    text: "
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
+      
                                  MessageDate
                                  January 2020 Windows 10, version 1909 \"D\" optional release is available.
                                  The January 2020 optional monthly “D” release for Windows 10, version 1909 and Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
                                  		January 28, 2020 
                                  08:00 AM PT
                                  January 2020 Windows \"C\" optional release is available.
                                  The January 2020 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
                                  		January 23, 2020 
                                  12:00 PM PT
                                  Windows 7 has reached end of support
                                  Windows 7 reached end of support on January 14, 2020. If your organization has not yet been able to complete your transition from Windows 7 to Windows 10, and want to continue to receive security updates while you complete your upgrade projects, please read How to get Extended Security Updates for eligible Windows devices. For more information on end of service dates for currently supported versions of Windows 10, see the Windows lifecycle fact sheet.
                                  		January 15, 2020 
                                  10:00 AM PT
                                  Take action: January 2020 security update available for all supported versions of Windows
                                  The January 2020 security update release, referred to as our “B” release, is now available for Windows 10, version 1909 and all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
                                  		January 14, 2020 
                                  08:00 AM PT
                                  Advisory: Windows CryptoAPI certificate validation vulnerability
                                  On January 14, 2020, Microsoft released security updates to address an elliptic-curve cryptography (ECC) certificate validation issue in the Windows CryptoAPI. This vulnerability applies to all versions of the Windows 10 operating system, client and server. While we have not observed an attack exploiting this vulnerability, we recommend that you apply this update to all of your Windows 10 devices with priority. Here is what you need to know:
                                  • If you are running a supported version of Windows 10 and have automatic updates enabled, you are automatically protected and do not need to take any further action.
                                  • If you are managing updates on behalf of your organization, you should download the latest updates from the Microsoft Security Update Guide and apply those updates to your Windows 10 devices and servers as soon as possible.
                                  If you are running an unsupported version of Windows 10, we recommend that you upgrade to the current version of Windows 10 to benefit from the latest security protections. For more information about this vulnerability, see the Microsoft Security Guidance for CVE-2020-0601 and the Microsoft Security Response Center blog, January 2020 Security Updates: CVE-2020-0601.
                                  		January 14, 2020 
                                  08:00 AM PT
                                  Take action: December 2019 security update available for all supported versions of Windows
                                  The December 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1909 and all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
                                  		December 10, 2019 
                                  08:00 AM PT
                                  Timing of Windows 10 optional update releases (December 2019)
                                  For the balance of this calendar year, there will be no optional non-security “C” and “D” releases for Windows 10. The \"C\" releases normally target the third week of the month, with \"D\" releases targeting the fourth week. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer.
                                  		December 10, 2019 
                                  08:00 AM PT
                                  Windows 10, version 1909 now available
                                  Learn how to get Windows 10, version 1909 (the November 2019 Update), and explore how we’ve worked to make this a great experience for all devices, including a new, streamlined (and fast) update experience for devices updating directly from the May 2019 Update.
                                  		November 12, 2019 
                                  10:00 AM PT
                                  Windows 10, version 1909 delivery options
                                  Learn how devices running Windows 10, version 1903 can update to Windows 10, version 1909 using the same servicing technology used to deliver monthly quality updates, resulting in a single restart and reducing update-related downtime.
                                  		November 12, 2019 
                                  10:00 AM PT
                                  What’s new for IT pros in Windows 10, version 1909
                                  Explore the latest features for IT, get information about media availability and related tools, and find answers to frequently asked questions.
                                  		November 12, 2019 
                                  10:00 AM PT
                                  Take action: November 2019 security update available for all supported versions of Windows
                                  The November 2019 security update release, referred to as our “B” release, is now available for all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
                                  		November 12, 2019 
                                  10:00 AM PT
                                  Timing of Windows 10 optional update releases (November/December 2019)
                                  For the balance of this calendar year, there will be no optional non-security “C” and “D” releases for Windows 10. The \"C\" releases normally target the third week of the month, with \"D\" releases targeting the fourth week. Note There will be a December Security Update Tuesday release, as usual. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer
                                  		November 12, 2019 
                                  10:00 AM PT
                                  Windows 10, version 1803 Home and Pro editions have reached end of service
                                  Windows 10, version 1803 (the April 2018 Update) Home and Pro editions have reached end of service. For Windows 10 devices that are at, or within several months of reaching end of service, Windows Update will automatically initiate a feature update (with users having the ability to choose a convenient time); keeping those devices supported and receiving the monthly updates that are critical to device security and ecosystem health. For more information on end of service dates for currently supported versions of Windows 10, see the Windows lifecycle fact sheet.
                                  		November 12, 2019 
                                  10:00 AM PT
                                  October 2019 Windows 10, version 1903 \"D\" optional release is available.
                                  The October 2019 optional monthly “D” release for Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
                                  		October 24, 2019 
                                  08:00 AM PT
                                  October 2019 Windows \"C\" optional release is available.
                                  The October 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
                                  		October 15, 2019 
                                  09:59 AM PT
                                  Windows 10, version 1703 has reached end of service
                                  Consumer and commercial editions of Windows 10, version 1703 have reached end of service. As devices running these editions are no longer receiving monthly security and quality updates containing protections from the latest security threats, we recommend that you update these devices to the latest version of Windows 10 immediately. For more information on end of service dates for currently supported versions of Windows 10, see the Windows lifecycle fact sheet.

                                  Note The Windows 10, version 1703 section will be removed from this dashboard on November 12, 2019.
                                  		October 09, 2019 
                                  12:00 PM PT
                                  Take Action: October 2019 security update available for all supported versions of Windows
                                  The October 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. We recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
                                   
                                  		October 08, 2019 
                                  08:00 AM PT
                                  Take action: Security update available for all supported versions of Windows
                                  On October 3, 2019, Microsoft expanded delivery of the out-of-band Internet Explorer scripting engine security vulnerability (CVE-2019-1367) update released on September 23, 2019 to Windows Update and Windows Server Update Services (WSUS). This is now a required security update for all supported versions of Windows as it includes the Internet Explorer scripting engine vulnerability mitigation and corrects a recent printing issue some users have experienced. All customers using Windows Update or WSUS will be offered this update automatically. We recommend that you install this update as soon as a possible, then restart your PC to fully apply the mitigations and help secure your devices. As with all cumulative updates, this update supersedes any preceding update.
                                   
                                  Note: This update does not replace the standard October 2019 monthly security update release, which is scheduled for October 8, 2019.
                                  		October 03, 2019 
                                  08:00 AM PT
                                  September 2019 Windows 10, version 1903 \"D\" optional release is available
                                  The September 2019 optional monthly “D” release for Windows 10, version 1903 is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
                                  		September 26, 2019 
                                  02:00 PM PT
                                  Status update: September 2019 Windows \"C\" optional release available
                                  The September 2019 optional monthly “C” release for all supported versions of Windows is now available. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
                                  		September 24, 2019 
                                  08:10 AM PT
                                  Plan for change: Windows Media Center Electronic Program Guide retiring in January 2020
                                  Starting in January 2020, Microsoft is retiring its Electronic Program Guide (EPG) service for all versions of Windows Media Center. To continue receiving TV Program Guide information on your Windows Media Center, you’ll need to configure an alternate TV listing provider.
                                  		September 24, 2019 
                                  08:00 AM PT
                                  Status of September 2019 “C” release
                                  The optional monthly “C” release for September 2019 for all supported versions of Windows and Windows Server prior to Windows 10, version 1903 and Windows Server, version 1903 will be available in the near term. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. Follow @WindowsUpdate for the latest on the availability of this release.
                                  		September 19, 2019 
                                  04:11 PM PT
                                  Plan for change: End of service reminders for Windows 10, versions 1703 and 1803
                                  The Enterprise and Education editions of Windows 10, version 1703 (the Creators Update) will reach end of service on October 8, 2019. The Home, Pro, Pro for Workstations, and IoT Core editions of Windows 10, version 1803 (the April 2018 Update) will reach end of service on November 12, 2019. We recommend that you update devices running these versions and editions to the latest version of Windows 10—Windows 10, version 1903—as soon as possible to help keep them protected and your environments secure.
                                  		September 13, 2019 
                                  03:23 PM PT
                                  September 2019 security update available for all supported versions of Windows
                                  The September 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. We recommend that you install these updates promptly. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
                                  		September 10, 2019 
                                  09:34 AM PT
                                  Status update: Windows 10, version 1903 \"D\" optional release available August 30th
                                  The August optional monthly “D” release for Windows 10, version 1903 is now available. Follow @WindowsUpdate for the latest on the availability of this release.
                                  		August 30, 2019 
                                  08:00 AM PT
                                  Feature update install notification on Windows 10, version 1809 (the October 2018 Update)
                                  We've had reports on August 29th that some customers running Windows 10, version 1809 (the October 2018 Update) have received notification to install the latest feature update (version 1903) early. Updating remains in your control. To install the update, you must select one of the following options: \"Pick a Time\", \"Restart Tonight,\" or \"Restart Now\". If you are not ready to update at this time, simply dismiss the notification by clicking the arrow in the top right corner. If you have updated to Windows 10, version 1903 and would like to go back to your previous version, see the instructions here.
                                  		August 29, 2019 
                                  04:39 PM PT
                                  Take Action: Internet Explorer 11 now available on Windows Update/WSUS for Windows Server 2012 and Windows Embedded 8 Standard
                                  Internet Explorer 11 (KB 4492872) is now available via Windows Update (WU) and Windows Server Update Services (WSUS) for commercial customers running Windows Server 2012 and Windows Embedded 8 Standard. For details about these changes and end of support for IE10, please refer to the IT Pro blog. 
                                  		August 29, 2019 
                                  08:00 AM PT
                                  Take action: SHA-2 code signing support guidance for Windows 7 SP1 and Windows Server 2008 RS2 SP1
                                  Windows 7 SP1 and Windows Server 2008 R2 SP1 update signatures are now SHA-2 based signatures and requires that SHA-2 support to be installed. For important customer guidance on installation and troubleshooting tips, please read the knowledge base article 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.
                                  		August 23, 2019 
                                  03:35 PM PT
                                  Take action: Windows 10, version 1703 (the Windows 10 Creators Update) reaches end of life on October 9, 2019 
                                  The Enterprise and Education editions of Windows 10, version 1703 (the Windows 10 Creators Update) will reach end of life on October 9, 2019. The Home, Pro, Pro for Workstations, and IoT Core editions reached end of service on October 8, 2018.

                                  There is no extended support available for any edition of Windows 10, version 1703. Therefore, it will no longer be supported after October 9, 2019 and will not receive monthly security and quality updates containing protections from the latest security threats.

                                  To continue receiving security and quality updates, Microsoft recommends that you update your devices to the latest version of Windows 10. For more information on end of service dates and currently supported versions of Windows 10, see the Windows lifecycle fact sheet.
                                  		August 23, 2019 
                                  02:17 PM PT
                                  Resolved:  Delays starting Internet Explorer 11
                                  On August 16, 2019 at 7:16 AM a server required for downloading the Internet Explorer 11 (IE11) startup page, went down. As a result of the server outage, IE 11 became unresponsive for some customers who had not yet installed the August 2019 security updates. Customers who had the August 2019 security update installed were not affected. In order to ensure your devices remain in a serviced and secure state, we recommend you install the latest monthly update.

                                  This issue was resolved on the server side at 1:00 pm PST. 
                                  		August 16, 2019 
                                  04:00 PM PT
                                  August 2019 security update now available for Windows 10, version 1903 and all supported versions of Windows
                                  The August 2019 security update release, referred to as our “B” release, is now available for Windows 10, version 1903 and all supported versions of Windows. A “B” release is the primary, regular update event for each month and is the only regular release that contains security fixes. As a result, we recommend that you install these updates promptly. For more information on the different types of monthly quality updates, see our Windows 10 update servicing cadence primer. To be informed about the latest updates and releases, follow us on Twitter @WindowsUpdate.
                                  		August 13, 2019 
                                  10:00 AM PT
                                  Advisory: Bluetooth encryption key size vulnerability disclosed (CVE-2019-9506)
                                  On August 13, 2019, Microsoft released security updates to address a Bluetooth key length encryption vulnerability. To exploit this vulnerability, an attacker would need specialized hardware and would be limited by the signal range of the Bluetooth devices in use. For more information about this industry-wide issue, see CVE-2019-9506 | Bluetooth Encryption Key Size Vulnerability in the Microsoft Security Update Guide and important guidance for IT pros in KB4514157. (Note: we are documenting this vulnerability together with guidance for IT admins as part of a coordinated industry disclosure effort.)
                                  		August 13, 2019 
                                  10:00 AM PT
                                  Advisory: Windows Advanced Local Procedure Call Elevation of Privilege vulnerability disclosed (CVE-2019-1162)
                                  On August 13, 2019, Google Project Zero (GPZ) disclosed an Elevation of Privilege (EoP) vulnerability in how Windows handles calls to Advanced Local Procedure Call (ALPC) that affects Windows operating systems, versions 8.1 and higher. An attacker must already have code execution on the target system to leverage these vulnerabilities. Microsoft released security updates on August 13, 2019 that partially address this issue. Other items disclosed by GPZ require more time to address and we are working to release a resolution in mid-September. For more information, see CVE-2019-1162 | Windows ALPC Elevation of Privilege Vulnerability
                                  		August 13, 2019 
                                  10:00 AM PT
                                  Take action: Windows 10, version 1803 (the April 2018 Update) reaches end of service on November 12, 2019 
                                  Windows 10, version 1803 (the April 2018 Update) will reach end of service on November 12, 2019 for Home and Pro editions. We will begin updating devices running Windows 10, version 1803 to Windows 10, version 1903 (the May 2019 Update) starting July 16, 2019 to help ensure that these devices remain in a serviced and secure state. For more information, see the Windows 10, version 1903 section of the Windows release health dashboard.
                                  		August 13, 2019 
                                  10:00 AM PT
                                  Advisory: Windows Kernel Information Disclosure Vulnerability (CVE-2019-1125)
                                  On July 9, 2019, Microsoft released a security update for a Windows kernel information disclosure vulnerability (CVE-2019-1125). Customers who have Windows Update enabled and have applied the security updates released on July 9, 2019 are protected automatically; no further configuration is necessary. For more information, see CVE-2019-1125 | Windows Kernel Information Disclosure Vulnerability in the Microsoft Security Update Guide. (Note: we are documenting this mitigation publicly today, instead of back in July, as part of a coordinated industry disclosure effort.)
                                  		August 06, 2019 
                                  10:00 AM PT
                                  Resolved August 1, 2019 16:00 PT: Microsoft Store users may encounter blank screens when clicking on certain buttons
                                  Some customers running the version of the Microsoft Store app released on July 29, 2019 encountered a blank screen when selecting “Switch out of S mode,” “Get Genuine,” or some “Upgrade to [version]” OS upgrade options. This issue has now been resolved and a new version of the Microsoft Store app has been released. Users who encountered this issue will need to update the Microsoft Store app on their device. If you are still encountering an issue, please see Fix problems with apps from Microsoft Store.
                                  		August 01, 2019 
                                  02:00 PM PT
                                  Status update: Windows 10, version 1903 “D” release now available
                                  The optional monthly “D” release for Windows 10, version 1903 is now available. Follow @WindowsUpdate for the latest on the availability of this release.
                                  		July 26, 2019 
                                  02:00 PM PT
                                  Plan for change: Microsoft Silverlight will reach end of support on October 12, 2021
                                  After this date, Silverlight will not receive any future quality or security updates. Microsoft will continue to ship updates to the Silverlight 5 Developer Runtime for supported browsers and versions (Internet Explorer 10 and Internet Explorer 11); however, please note that support for Internet Explorer 10 will end on 31 January 2020. See the Silverlight end of support FAQ for more details.
                                  		July 19, 2019 
                                  12:00 AM PT
                                  Evolving Windows 10 servicing and quality
                                  Find out how we plan to further optimize the delivery of the next Windows 10 feature update for devices running Windows 10, version 1903. If you're a commercial customer, please see the Windows IT Pro Blog for more details on how to plan for this new update option in your environment.
                                  		July 01, 2019 
                                  02:00 PM PT
                                  Windows 10, version 1903 starting to roll out to devices running Windows 10, version 1803 and earlier
                                  We are now beginning to build and train the machine learning (ML) based rollout process to update devices running Windows 10, version 1803 (the April 2018 Update) and earlier versions of Windows 10, to ensure we can continue to service these devices and provide the latest updates, security updates, and improvements.
                                  		June 18, 2019 
                                  02:00 PM PT
                                  Windows 10, version 1903 available by selecting “Check for updates”
                                  Windows 10, version 1903 is now available for any user who manually selects “Check for updates” via Windows Update. The recommended servicing status is Semi-Annual Channel.
                                  		June 06, 2019 
                                  06:00 PM PT
                                  Windows 10, version 1903 rollout begins
                                  The Windows 10 May 2019 Update (Windows 10, version 1903) is available today to commercial customers via Windows Server Update Services (WSUS), Windows Update for Business, and the Volume Licensing Service Center (VLSC)—and to end users who manually select “Check for updates.” We are slowly throttling up availability while we carefully monitor data and feedback.                                  		May 21, 2019 
                                  10:00 AM PT
                                  What’s new in Windows Update for Business
                                  We are enhancing and expanding the capabilities of Windows Update for Business to make the move to the cloud even easier. From simplified branch readiness options to better control over deadlines and reboots, read about the enhancements to Windows Update for Business as a part of Windows 10, version 1903.                                   		May 21, 2019 
                                  10:00 AM PT
                                  What’s new for businesses and IT pros in Windows 10
                                  Explore the newest capabilities for businesses and IT in the latest feature update in the areas of intelligent security, simplified updates, flexible management, and enhanced productivity.                                   		May 21, 2019 
                                  10:00 AM PT
                                  Reminder: Install the latest SSU for a smoother update experience 
                                  We strongly recommend that you install the latest servicing stack update (SSU) before installing any Windows update; especially as an SSU may be a prerequisite for some updates. If you have difficulty installing Windows updates, verify that you have installed the latest SSU package for your version of Windows and then try installing the update again. Links to the latest SSU are always provided in the “How to get this update” section of each update KB article (e.g., KB4494441).  For more information about SSUs, see our Servicing stack updates guidance.
                                  		May 14, 2019 
                                  10:00 AM PT
                                  Take action: Update Remote Desktop Services on older versions of Windows
                                  Today, we released fixes for a critical wormable, remote code execution vulnerability (CVE-2019-0708) in Remote Desktop Services—formerly known as Terminal Services. This vulnerability affects Windows 7, Windows Server 2008 R2, and earlier versions of Windows nearing end of support. It does not affect Windows 8, Windows Server 2012, or newer operating systems. While we have not observed attacks exploiting this vulnerability, affected systems should be patched with priority. Here is what you need to know:
                                   
                                  
+Call to action:
+
                                    
+
                                  • 	If you are running a supported version of Windows and have automatic updates enabled, you are automatically protected and do not need to take any action. 
                                    • 
+
                                  • 	If you are managing updates on behalf of your organization, you should download the latest updates from the Microsoft Security Update Guide and apply them to your Windows 7, Windows Server 2008 R2, and Windows Server 2008 devices as soon as possible.
                                    • 
+
                                  
+Given the potential impact to customers and their businesses, we have also released security updates for Windows XP and Windows Server 2003, even though these operating systems have reached end of support (except by custom support agreements). While we recommend that you upgrade to the current version of Windows to benefit from the latest security protections, these updates are available from the Microsoft Update Catalog only. For more information, see KB4500705.
+ 
                                  
+                                  		May 14, 2019 
                                  10:00 AM PT
                                  Reminder: Windows 10  update servicing cadence
                                  This month we received questions about the cadence of updates we released in April and May 2019. Here's a quick recap of our releases and servicing cadence: 
                                  
+ 
                                    
+
                                  • 	April 9, 2019 was the regular Update Tuesday release for all versions of Windows.
                                    •  
+
                                  • 	May 1, 2019 was an \\\"optional,\\\" out of band non-security update (OOB) for Windows 10, version 1809. It was released to Microsoft Catalog and WSUS, providing a critical fix for our OEM partners.
                                    • 
+
                                  • 	May 3, 2019 was the \\\"optional\\\" Windows 10, version 1809 \\\"C\\\" release for April. This update contained important Japanese era packages for commercial customers to preview. It was released later than expected and mistakenly targeted as \\\"required\\\" (instead of \\\"optional\\\") for consumers, which pushed the update out to customers and required a reboot. Within 24 hours of receiving customer reports, we corrected the targeting logic and mitigated the issue.
                                    • 
+ 
                                  
+ For more information about the Windows 10  update servicing cadence, please see the Window IT Pro blog.
                                  
+                                  		May 10, 2019 
                                  10:00 AM PT
                                  
+      "
diff --git a/windows/security/docfx.json b/windows/security/docfx.json
index 018d611769..d1b2905bad 100644
--- a/windows/security/docfx.json
+++ b/windows/security/docfx.json
@@ -21,7 +21,7 @@
         "files": [
           "**/*.png",
           "**/*.jpg",
-           "**/*.gif"
+          "**/*.gif"
         ],
         "exclude": [
           "**/obj/**",
@@ -32,18 +32,29 @@
     "overwrite": [],
     "externalReference": [],
     "globalMetadata": {
-	  "uhfHeaderId": "MSDocsHeader-WindowsIT", 
-	  "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
-	  "ms.technology": "windows",
-	  "ms.topic": "article",
-	  "feedback_system": "GitHub",
-	  "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
+      "breadcrumb_path": "/windows/windows-10/breadcrumb/toc.json",
+      "ms.technology": "windows",
+      "ms.topic": "article",
+      "manager": "dansimp",
+      "audience": "ITPro",
+      "feedback_system": "GitHub",
+      "feedback_github_repo": "MicrosoftDocs/windows-itpro-docs",
       "feedback_product_url": "https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app",
-	  "ms.author": "justinha"
+      "_op_documentIdPathDepotMapping": {
+        "./": {
+          "depot_name": "MSDN.security",
+          "folder_relative_path_in_docset": "./"
+        }
+      },
+      "titleSuffix": "Microsoft 365 Security"
+    },
+    "fileMetadata": {
+      "titleSuffix":{
+        "threat-protection/**/*.md": "Windows security"
+      }
     },
-    "fileMetadata": {},
     "template": [],
     "dest": "security",
-    "markdownEngineName": "dfm"
+    "markdownEngineName": "markdig"
   }
-}
\ No newline at end of file
+}
diff --git a/windows/security/identity-protection/TOC.md b/windows/security/identity-protection/TOC.md
index a3c24b5cf6..b03ec007b8 100644
--- a/windows/security/identity-protection/TOC.md
+++ b/windows/security/identity-protection/TOC.md
@@ -1,5 +1,7 @@
 # [Identity and access management](index.md)
 
+## [Technical support policy for lost or forgotten passwords](password-support-policy.md)
+
 ## [Access Control Overview](access-control/access-control.md)
 ### [Dynamic Access Control Overview](access-control/dynamic-access-control.md)
 ### [Security identifiers](access-control/security-identifiers.md)
diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md
index 2743a5eb64..8e6cf74f38 100644
--- a/windows/security/identity-protection/access-control/access-control.md
+++ b/windows/security/identity-protection/access-control/access-control.md
@@ -6,13 +6,14 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: security
 audience: ITPro
-author: danihalfin
-ms.author: daniha
+author: dulcemontemayor
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-identity-device-management
 ms.topic: article
 ms.localizationpriority: medium
 ms.date: 07/18/2017
+ms.reviewer: 
 ---
 
 # Access Control Overview
@@ -105,7 +106,7 @@ When you need to change the permissions on a file, you can run Windows Explorer,
 **Note**  
 Another kind of permissions, called share permissions, is set on the Sharing tab of a folder's **Properties** page or by using the Shared Folder Wizard. For more information see [Share and NTFS Permissions on a File Server](https://technet.microsoft.com/library/cc754178.aspx).
 
- 
+ 
 
 ### Ownership of objects
 
@@ -136,9 +137,9 @@ For more information about auditing, see [Security Auditing Overview](/windows/d
 -   For more information about access control and authorization, see [Access Control and Authorization Overview](https://technet.microsoft.com/library/jj134043(v=ws.11).aspx).
 
 
- 
+ 
 
- 
+ 
 
 
 
diff --git a/windows/security/identity-protection/access-control/active-directory-accounts.md b/windows/security/identity-protection/access-control/active-directory-accounts.md
index f9fd22c432..0665f58b3c 100644
--- a/windows/security/identity-protection/access-control/active-directory-accounts.md
+++ b/windows/security/identity-protection/access-control/active-directory-accounts.md
@@ -6,13 +6,14 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: security
 audience: ITPro
-author: danihalfin
-ms.author: daniha
+author: dulcemontemayor
+ms.author: dansimp
 manager: dansimp
 ms.collection: M365-identity-device-management
 ms.topic: article
 ms.localizationpriority: medium
-ms.date: 04/19/2017
+ms.date: 08/23/2019
+ms.reviewer: 
 ---
 
 # Active Directory Accounts
@@ -60,7 +61,7 @@ This topic describes the following:
 
 Default local accounts are built-in accounts that are created automatically when a Windows Server domain controller is installed and the domain is created. These default local accounts have counterparts in Active Directory. These accounts also have domain-wide access and are completely separate from the default local user accounts for a member or standalone server.
 
-You can assign rights and permissions to default local accounts on a particular domain controller, and only on that domain controller. These accounts are local to the domain. After the default local accounts are installed, they are stored in the Users container in Active Directory Users and Computers. It is a best practice to keep the default local accounts in the User container and not attempt to move these accounts, for example, to a different organizational unit (OU).
+You can assign rights and permissions to default local accounts on a particular domain controller, and only on that domain controller. These accounts are local to the domain. After the default local accounts are installed, they are stored in the Users container in Active Directory Users and Computers. It is a best practice to keep the default local accounts in the User container and not attempt to move these accounts, for example, to a different organizational unit (OU).
 
 The default local accounts in the Users container include: Administrator, Guest, and KRBTGT. The HelpAssistant account is installed when a Remote Assistance session is established. The following sections describe the default local accounts and their use in Active Directory.
 
@@ -72,7 +73,7 @@ Primarily, default local accounts do the following:
 
 -   Audit the actions that are carried out on a user account.
 
-In Active Directory, default local accounts are used by administrators to manage domain and member servers directly and from dedicated administrative workstations. Active Directory accounts provide access to network resources. Active Directory User accounts and Computer accounts can represent a physical entity, such as a computer or person, or act as dedicated service accounts for some applications.
+In Active Directory, default local accounts are used by administrators to manage domain and member servers directly and from dedicated administrative workstations. Active Directory accounts provide access to network resources. Active Directory User accounts and Computer accounts can represent a physical entity, such as a computer or person, or act as dedicated service accounts for some applications.
 
 Each default local account is automatically assigned to a security group that is preconfigured with the appropriate rights and permissions to perform specific tasks. Active Directory security groups collect user accounts, computer accounts, and other groups into manageable units. For more information, see [Active Directory Security Groups](active-directory-security-groups.md).
 
@@ -105,10 +106,10 @@ The Administrator account can also be disabled when it is not required. Renaming
 
 On a domain controller, the Administrator account becomes the Domain Admin account. The Domain Admin account is used to sign in to the domain controller and this account requires a strong password. The Domain Admin account gives you access to domain resources.
 
-**Note**  
+**Note**  
 When the domain controller is initially installed, you can sign in and use Server Manager to set up a local Administrator account, with the rights and permissions you want to assign. For example, you can use a local Administrator account to manage the operating system when you first install it. By using this approach, you can set up the operating system without getting locked out. Generally, you do not need to use the account after installation. You can only create local user accounts on the domain controller, before Active Directory Domain Services is installed, and not afterwards.
 
- 
+
 
 When Active Directory is installed on the first domain controller in the domain, the Administrator account is created for Active Directory. The Administrator account is the most powerful account in the domain. It is given domain-wide access and administrative rights to administer the computer and the domain, and it has the most extensive rights and permissions over the domain. The person who installs Active Directory Domain Services on the computer creates the password for this account during the installation.
 
@@ -163,7 +164,7 @@ When Active Directory is installed on the first domain controller in the domain,
 
                                  
 
                                  
 
- 
+
 
 ## Guest account
 
@@ -245,7 +246,7 @@ For details about the Guest account attributes, see the following table.
                                  -  + ## HelpAssistant account (installed with a Remote Assistance session) @@ -316,7 +317,7 @@ For details about the HelpAssistant account attributes, see the following table. -  + ## KRBTGT account @@ -329,13 +330,11 @@ Windows Server Kerberos authentication is achieved by the use of a special Kerbe ### KRBTGT account maintenance considerations -A strong password is assigned to the KRBTGT account automatically. Be sure that you change the password on a regular schedule. The password for the KDC account is used to derive a secret key for encrypting and decrypting the TGT requests that are issued. The password for a domain trust account is used to derive an inter-realm key for encrypting referral tickets. +A strong password is assigned to the KRBTGT and trust accounts automatically. Like any privileged service accounts, organizations should change these passwords on a regular schedule. The password for the KDC account is used to derive a secret key for encrypting and decrypting the TGT requests that are issued. The password for a domain trust account is used to derive an inter-realm key for encrypting referral tickets. -On occasion, the KRBTGT account password requires a reset, for example, when an attempt to change the password on the KRBTGT account fails. In order to resolve this issue, you reset the KRBTGT user account password twice by using Active Directory Users and Computers. You must reset the password twice because the KRBTGT account stores only two of the most recent passwords in the password history. By resetting the password twice, you effectively clear all passwords from the password history. +Resetting the password requires you either to be a member of the Domain Admins group, or to have been delegated with the appropriate authority. In addition, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority. -Resetting the password requires you either to be a member of the Domain Admins group, or to have been delegated with the appropriate authority. In addition, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority. - -After you reset the KRBTGT password, ensure that event ID 6 in the (Kerberos) Key-Distribution-Center event source is written to the System event log. +After you reset the KRBTGT password, ensure that event ID 9 in the (Kerberos) Key-Distribution-Center event source is written to the System event log. ### Security considerations @@ -355,14 +354,14 @@ For all account types (users, computers, and services) Because it is impossible to predict the specific errors that will occur for any given user in a production operating environment, you must assume all computers and users will be affected. -**Important**   +**Important** Rebooting a computer is the only reliable way to recover functionality as this will cause both the computer account and user accounts to log back in again. Logging in again will request new TGTs that are valid with the new KRBTGT, correcting any KRBTGT related operational issues on that computer. For information about how to help mitigate the risks associated with a potentially compromised KRBTGT account, see [KRBTGT Account Password Reset Scripts now available for customers](https://blogs.microsoft.com/cybertrust/2015/02/11/krbtgt-account-password-reset-scripts-now-available-for-customers/). ### Read-only domain controllers and the KRBTGT account -Windows Server 2008 introduced the read-only domain controller (RODC). The RODC is advertised as the Key Distribution Center (KDC) for the branch office. The RODC uses a different KRBTGT account and password than the KDC on a writable domain controller when it signs or encrypts ticket-granting ticket (TGT) requests. After an account is successfully authenticated, the RODC determines if a user's credentials or a computer's credentials can be replicated from the writable domain controller to the RODC by using the Password Replication Policy. +Windows Server 2008 introduced the read-only domain controller (RODC). The RODC is advertised as the Key Distribution Center (KDC) for the branch office. The RODC uses a different KRBTGT account and password than the KDC on a writable domain controller when it signs or encrypts ticket-granting ticket (TGT) requests. After an account is successfully authenticated, the RODC determines if a user's credentials or a computer's credentials can be replicated from the writable domain controller to the RODC by using the Password Replication Policy. After the credentials are cached on the RODC, the RODC can accept that user's sign-in requests until the credentials change. When a TGT is signed with the KRBTGT account of the RODC, the RODC recognizes that it has a cached copy of the credentials. If another domain controller signs the TGT, the RODC forwards requests to a writable domain controller. @@ -417,7 +416,7 @@ For details about the KRBTGT account attributes, see the following table. -  + ## Settings for default local accounts in Active Directory @@ -453,7 +452,7 @@ Each default local account in Active Directory has a number of account settings

                                  Store passwords using reversible encryption

                                  Provides support for applications that use protocols requiring knowledge of the plaintext form of the user’s password for authentication purposes.

                                  -

                                  This option is required when using Challenge Handshake Authentication Protocol (CHAP) in Internet Authentication Services (IAS), and when using digest authentication in Internet Information Services (IIS).

                                  +

                                  This option is required when using Challenge Handshake Authentication Protocol (CHAP) in Internet Authentication Services (IAS), and when using digest authentication in Internet Information Services (IIS).

                                  Account is disabled

                                  @@ -471,7 +470,7 @@ Each default local account in Active Directory has a number of account settings

                                  Account is trusted for delegation

                                  -

                                  Lets a service running under this account perform operations on behalf of other user accounts on the network. A service running under a user account (also known as a service account) that is trusted for delegation can impersonate a client to gain access to resources, either on the computer where the service is running or on other computers. For example, in a forest that is set to the Windows Server 2003 functional level, this setting is found on the Delegation tab. It is available only for accounts that have been assigned service principal names (SPNs), which are set by using the setspn command from Windows Support Tools. This setting is security-sensitive and should be assigned cautiously.

                                  +

                                  Lets a service running under this account perform operations on behalf of other user accounts on the network. A service running under a user account (also known as a service account) that is trusted for delegation can impersonate a client to gain access to resources, either on the computer where the service is running or on other computers. For example, in a forest that is set to the Windows Server 2003 functional level, this setting is found on the Delegation tab. It is available only for accounts that have been assigned service principal names (SPNs), which are set by using the setspn command from Windows Support Tools. This setting is security-sensitive and should be assigned cautiously.

                                  Account is sensitive and cannot be delegated

                                  @@ -481,26 +480,25 @@ Each default local account in Active Directory has a number of account settings

                                  Use DES encryption types for this account

                                  Provides support for the Data Encryption Standard (DES). DES supports multiple levels of encryption, including Microsoft Point-to-Point Encryption (MPPE) Standard (40-bit and 56-bit), MPPE standard (56-bit), MPPE Strong (128-bit), Internet Protocol security (IPSec) DES (40-bit), IPSec 56-bit DES, and IPSec Triple DES (3DES).

                                  -Note   -

                                  DES is not enabled by default in Windows Server operating systems starting with Windows Server 2008 R2, nor in Windows client operating systems starting with Windows 7. For these operating systems, computers will not use DES-CBC-MD5 or DES-CBC-CRC cipher suites by default. If your environment requires DES, then this setting might affect compatibility with client computers or services and applications in your environment. For more information, see [Hunting down DES in order to securely deploy Kerberos](http://blogs.technet.com/b/askds/archive/2010/10/19/hunting-down-des-in-order-to-securely-deploy-kerberos.aspx).

                                  +Note

                                  DES is not enabled by default in Windows Server operating systems starting with Windows Server 2008 R2, nor in Windows client operating systems starting with Windows 7. For these operating systems, computers will not use DES-CBC-MD5 or DES-CBC-CRC cipher suites by default. If your environment requires DES, then this setting might affect compatibility with client computers or services and applications in your environment. For more information, see Hunting down DES in order to securely deploy Kerberos.

                                  -  +

                                  Do not require Kerberos preauthentication

                                  -

                                  Provides support for alternate implementations of the Kerberos protocol. Because preauthentication provides additional security, use caution when enabling this option. Note that domain controllers running Windows 2000 or Windows Server 2003 can use other mechanisms to synchronize time.

                                  +

                                  Provides support for alternate implementations of the Kerberos protocol. Because preauthentication provides additional security, use caution when enabling this option. Note that domain controllers running Windows 2000 or Windows Server 2003 can use other mechanisms to synchronize time.

                                  -  + ## Manage default local accounts in Active Directory -After the default local accounts are installed, these accounts reside in the Users container in Active Directory Users and Computers. Default local accounts can be created, disabled, reset, and deleted by using the Active Directory Users and Computers Microsoft Management Console (MMC) and by using command-line tools. +After the default local accounts are installed, these accounts reside in the Users container in Active Directory Users and Computers. Default local accounts can be created, disabled, reset, and deleted by using the Active Directory Users and Computers Microsoft Management Console (MMC) and by using command-line tools. You can use Active Directory Users and Computers to assign rights and permissions on a given local domain controller, and that domain controller only, to limit the ability of local users and groups to perform certain actions. A right authorizes a user to perform certain actions on a computer, such as backing up files and folders or shutting down a computer. In contrast, an access permission is a rule that is associated with an object, usually a file, folder, or printer, that regulates which users can have access to the object and in what manner. @@ -553,19 +551,19 @@ Restrict Domain Admins accounts and other sensitive accounts to prevent them fro - **Standard user account**. Grant standard user rights for standard user tasks, such as email, web browsing, and using line-of-business (LOB) applications. These accounts should not be granted administrator rights. -**Important**   +**Important** Ensure that sensitive administrator accounts cannot access email or browse the Internet as described in the following section. -  + ### Create dedicated workstation hosts without Internet and email access Administrators need to manage job responsibilities that require sensitive administrator rights from a dedicated workstation because they do not have easy physical access to the servers. A workstation that is connected to the Internet and has email and web browsing access is regularly exposed to compromise through phishing, downloading, and other types of Internet attacks. Because of these threats, it is a best practice to set these administrators up by using workstations that are dedicated to administrative duties only, and not provide access to the Internet, including email and web browsing. For more information, see [Separate administrator accounts from user accounts](#task1-separate-admin-accounts). -**Note**   +**Note** If the administrators in your environment can sign in locally to managed servers and perform all tasks without elevated rights or domain rights from their workstation, you can skip this task. -  + - **Minimum**. Build dedicated administrative workstations and block Internet access on those workstations including web browsing and email. Use the following ways to block Internet access: @@ -583,7 +581,7 @@ If the administrators in your environment can sign in locally to managed servers The following procedure describes how to block Internet access by creating a Group Policy Object (GPO) that configures an invalid proxy address on administrative workstations. These instructions apply only to computers running Internet Explorer and other Windows components that use these proxy settings. -**Note**   +**Note** In this procedure, the workstations are dedicated to domain administrators. By simply modifying the administrator accounts to grant permission to administrators to sign in locally, you can create additional OUs to manage administrators that have fewer administrative rights to use the instructions described in the following procedure. **To install administrative workstations in a domain and block Internet and email access (minimum)** @@ -620,10 +618,10 @@ In this procedure, the workstations are dedicated to domain administrators. By s 4. Click **Add User or Group** > **Browse**, type **Domain Admins**, and > **OK**. - **Important**   + **Important** These instructions assume that the workstation is to be dedicated to domain administrators. -   + 5. Click **Add User or Group**, type **Administrators**, and > **OK**. @@ -714,10 +712,10 @@ In this procedure, the workstations are dedicated to domain administrators. By s It is a best practice to restrict administrators from using sensitive administrator accounts to sign in to lower-trust servers and workstations. This restriction prevents administrators from inadvertently increasing the risk of credential theft by signing in to a lower-trust computer. -**Important**   +**Important** Ensure that you either have local access to the domain controller or that you have built at least one dedicated administrative workstation. -  + Restrict logon access to lower-trust servers and workstations by using the following guidelines: @@ -727,10 +725,10 @@ Restrict logon access to lower-trust servers and workstations by using the follo - **Ideal**. Restrict server administrators from signing in to workstations, in addition to domain administrators. -**Note**   +**Note** For this procedure, do not link accounts to the OU that contain workstations for administrators that perform administration duties only, and do not provide Internet or email access. For more information, see [Create dedicated workstation hosts for administrators](#task2-admin-workstations) -  + **To restrict domain administrators from workstations (minimum)** @@ -760,19 +758,19 @@ For this procedure, do not link accounts to the OU that contain workstations for ![Active Directory local accounts](images/adlocalaccounts-proc2-sample3.png) - **Note**   + **Note** You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. -   + 4. Click **OK** to complete the configuration. 8. Configure the user rights to deny batch and service logon rights for domain administrators as follows: - **Note**   + **Note** Completing this step might cause issues with administrator tasks that run as scheduled tasks or services with accounts in the Domain Admins group. The practice of using domain administrator accounts to run services and tasks on workstations creates a significant risk of credential theft attacks and therefore should be replaced with alternative means to run scheduled tasks or services. -   + 1. Double-click **Deny logon as a batch job**, and > **Define these policy settings**. @@ -782,10 +780,10 @@ For this procedure, do not link accounts to the OU that contain workstations for ![Active Directory local accounts](images/adlocalaccounts-proc2-sample4.png) - **Note**   + **Note** You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. -   + 4. Double-click **Deny logon as a service**, and > **Define these policy settings**. @@ -795,10 +793,10 @@ For this procedure, do not link accounts to the OU that contain workstations for ![Active Directory local accounts](images/adlocalaccounts-proc2-sample5.png) - **Note**   + **Note** You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. -   + 9. Link the GPO to the first Workstations OU. @@ -818,10 +816,10 @@ For this procedure, do not link accounts to the OU that contain workstations for However, do not create a link to the Administrative Workstation OU if it is created for administrative workstations that are dedicated to administration duties only, and that are without Internet or email access. For more information, see [Create dedicated workstation hosts for administrators](#task2-admin-workstations). - **Important**   + **Important** If you later extend this solution, do not deny logon rights for the **Domain Users** group. The **Domain Users** group includes all user accounts in the domain, including Users, Domain Administrators, and Enterprise Administrators. -   + ### Disable the account delegation right for sensitive administrator accounts diff --git a/windows/security/identity-protection/access-control/active-directory-security-groups.md b/windows/security/identity-protection/access-control/active-directory-security-groups.md index 0b2f989db7..228b863e82 100644 --- a/windows/security/identity-protection/access-control/active-directory-security-groups.md +++ b/windows/security/identity-protection/access-control/active-directory-security-groups.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Active Directory Security Groups @@ -81,7 +82,7 @@ Groups are characterized by a scope that identifies the extent to which the grou **Note**   In addition to these three scopes, the default groups in the **Builtin** container have a group scope of Builtin Local. This group scope and group type cannot be changed. -  + The following table lists the three group scopes and more information about each scope for a security group. @@ -111,7 +112,7 @@ The following table lists the three group scopes and more information about each

                                  Global groups from any domain in the same forest

                                  Other Universal groups from any domain in the same forest

                                  Can be converted to Domain Local scope

                                  -

                                  Can be converted to Global scope if the group does not contain any other Universal groups

                                  +

                                  Can be converted to Global scope if the group is not a member of any other Universal groups

                                  On any domain in the same forest or trusting forests

                                  Other Universal groups in the same forest

                                  Domain Local groups in the same forest or trusting forests

                                  @@ -142,7 +143,7 @@ The following table lists the three group scopes and more information about each -  + ### Special identity groups @@ -188,350 +189,357 @@ The following tables provide descriptions of the default groups that are located -

                                  [Access Control Assistance Operators](#bkmk-acasstops)

                                  +

                                  Access Control Assistance Operators

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Account Operators](#bkmk-accountoperators)

                                  +

                                  Account Operators

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Administrators](#bkmk-admins)

                                  +

                                  Administrators

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Allowed RODC Password Replication Group](#bkmk-allowedrodcpwdrepl)

                                  +

                                  Allowed RODC Password Replication Group

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Backup Operators](#bkmk-backupoperators)

                                  +

                                  Backup Operators

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Certificate Service DCOM Access](#bkmk-certificateservicedcomaccess)

                                  +

                                  Certificate Service DCOM Access

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Cert Publishers](#bkmk-certpublishers)

                                  +

                                  Cert Publishers

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Cloneable Domain Controllers](#bkmk-cloneabledomaincontrollers)

                                  +

                                  Cloneable Domain Controllers

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Cryptographic Operators](#bkmk-cryptographicoperators)

                                  +

                                  Cryptographic Operators

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)

                                  +

                                  Denied RODC Password Replication Group

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Distributed COM Users](#bkmk-distributedcomusers)

                                  +

                                  Device Owners

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [DnsUpdateProxy](#bkmk-dnsupdateproxy)

                                  +

                                  Distributed COM Users

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [DnsAdmins](#bkmk-dnsadmins)

                                  +

                                  DnsUpdateProxy

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Domain Admins](#bkmk-domainadmins)

                                  +

                                  DnsAdmins

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Domain Computers](#bkmk-domaincomputers)

                                  +

                                  Domain Admins

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Domain Controllers](#bkmk-domaincontrollers)

                                  +

                                  Domain Computers

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Domain Guests](#bkmk-domainguests)

                                  +

                                  Domain Controllers

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Domain Users](#bkmk-domainusers)

                                  +

                                  Domain Guests

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Enterprise Admins](#bkmk-entadmins)

                                  +

                                  Domain Users

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Enterprise Key Admins](#bkmk-enterprise-key-admins)

                                  -

                                  Yes

                                  -

                                  -

                                  -

                                  - - -

                                  [Enterprise Read-only Domain Controllers](#bkmk-entrodc)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Event Log Readers](#bkmk-eventlogreaders)

                                  +

                                  Enterprise Admins

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Group Policy Creator Owners](#bkmk-gpcreatorsowners)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Guests](#bkmk-guests)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Hyper-V Administrators](#bkmk-hypervadministrators)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  - - -

                                  [IIS_IUSRS](#bkmk-iis-iusrs)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Incoming Forest Trust Builders](#bkmk-inforesttrustbldrs)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Key Admins](#key-admins)

                                  -

                                  Yes

                                  -

                                  -

                                  -

                                  - - -

                                  [Network Configuration Operators](#bkmk-networkcfgoperators)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Performance Log Users](#bkmk-perflogusers)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Performance Monitor Users](#bkmk-perfmonitorusers)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Pre–Windows 2000 Compatible Access](#bkmk-pre-ws2kcompataccess)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Print Operators](#bkmk-printoperators)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Protected Users](#bkmk-protectedusers)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  -

                                  - - -

                                  [RAS and IAS Servers](#bkmk-rasandias)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [RDS Endpoint Servers](#bkmk-rdsendpointservers)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  - - -

                                  [RDS Management Servers](#bkmk-rdsmanagementservers)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  - - -

                                  [RDS Remote Access Servers](#bkmk-rdsremoteaccessservers)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  - - -

                                  [Read-only Domain Controllers](#bkmk-rodc)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Remote Desktop Users](#bkmk-remotedesktopusers)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Remote Management Users](#bkmk-remotemanagementusers)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  - - -

                                  [Replicator](#bkmk-replicator)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Schema Admins](#bkmk-schemaadmins)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Server Operators](#bkmk-serveroperators)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Storage Replica Administrators](#storage-replica-administrators)

                                  +

                                  Enterprise Key Admins

                                  Yes

                                  -

                                  [System Managed Accounts Group](#system-managed-accounts-group)

                                  -

                                  Yes

                                  -

                                  -

                                  -

                                  - - -

                                  [Terminal Server License Servers](#bkmk-terminalserverlic)

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  -

                                  Yes

                                  - - -

                                  [Users](#bkmk-users)

                                  +

                                  Enterprise Read-only Domain Controllers

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [Windows Authorization Access Group](#bkmk-winauthaccess)

                                  +

                                  Event Log Readers

                                  Yes

                                  Yes

                                  Yes

                                  Yes

                                  -

                                  [WinRMRemoteWMIUsers_](#bkmk-winrmremotewmiusers-)

                                  +

                                  Group Policy Creator Owners

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Guests

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Hyper-V Administrators

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  + + +

                                  IIS_IUSRS

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Incoming Forest Trust Builders

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Key Admins

                                  +

                                  Yes

                                  +

                                  +

                                  +

                                  + + +

                                  Network Configuration Operators

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Performance Log Users

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Performance Monitor Users

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Pre–Windows 2000 Compatible Access

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Print Operators

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Protected Users

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  +

                                  + + +

                                  RAS and IAS Servers

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  RDS Endpoint Servers

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  + + +

                                  RDS Management Servers

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  + + +

                                  RDS Remote Access Servers

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  + + +

                                  Read-only Domain Controllers

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Remote Desktop Users

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Remote Management Users

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  + + +

                                  Replicator

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Schema Admins

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Server Operators

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Storage Replica Administrators

                                  +

                                  Yes

                                  +

                                  +

                                  +

                                  + + +

                                  System Managed Accounts Group

                                  +

                                  Yes

                                  +

                                  +

                                  +

                                  + + +

                                  Terminal Server License Servers

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Users

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  Windows Authorization Access Group

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  +

                                  Yes

                                  + + +

                                  WinRMRemoteWMIUsers_

                                  Yes

                                  Yes

                                  @@ -540,7 +548,7 @@ The following tables provide descriptions of the default groups that are located -  + ### Access Control Assistance Operators @@ -602,7 +610,7 @@ This security group has not changed since Windows Server 2008. -  + ### Account Operators @@ -615,7 +623,7 @@ The Account Operators group applies to versions of the Windows Server operating **Note**   By default, this built-in group has no members, and it can create and manage users and groups in the domain, including its own membership and that of the Server Operators group. This group is considered a service administrator group because it can modify Server Operators, which in turn can modify domain controller settings. As a best practice, leave the membership of this group empty, and do not use it for any delegated administration. This group cannot be renamed, deleted, or moved. -  + This security group has not changed since Windows Server 2008. @@ -665,12 +673,12 @@ This security group has not changed since Windows Server 2008.

                                  Default User Rights

                                  -

                                  [Allow log on locally](/windows/device-security/security-policy-settings/allow-log-on-locally): SeInteractiveLogonRight

                                  +

                                  Allow log on locally: SeInteractiveLogonRight

                                  -  + ### Administrators @@ -683,7 +691,7 @@ The Administrators group has built-in capabilities that give its members full co Membership can be modified by members of the following groups: the default service Administrators, Domain Admins in the domain, or Enterprise Admins. This group has the special privilege to take ownership of any object in the directory or any resource on a domain controller. This account is considered a service administrator group because its members have full access to the domain controllers in the domain. -  + This security group includes the following changes since Windows Server 2008: @@ -737,38 +745,38 @@ This security group includes the following changes since Windows Server 2008:

                                  Default User Rights

                                  -

                                  [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege

                                  -

                                  [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight

                                  -

                                  [Allow log on locally](/windows/device-security/security-policy-settings/allow-log-on-locally): SeInteractiveLogonRight

                                  -

                                  [Allow log on through Remote Desktop Services](/windows/device-security/security-policy-settings/allow-log-on-through-remote-desktop-services): SeRemoteInteractiveLogonRight

                                  -

                                  [Back up files and directories](/windows/device-security/security-policy-settings/back-up-files-and-directories): SeBackupPrivilege

                                  -

                                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

                                  -

                                  [Change the system time](/windows/device-security/security-policy-settings/change-the-system-time): SeSystemTimePrivilege

                                  -

                                  [Change the time zone](/windows/device-security/security-policy-settings/change-the-time-zone): SeTimeZonePrivilege

                                  -

                                  [Create a pagefile](/windows/device-security/security-policy-settings/create-a-pagefile): SeCreatePagefilePrivilege

                                  -

                                  [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege

                                  -

                                  [Create symbolic links](/windows/device-security/security-policy-settings/create-symbolic-links): SeCreateSymbolicLinkPrivilege

                                  -

                                  [Debug programs](/windows/device-security/security-policy-settings/debug-programs): SeDebugPrivilege

                                  -

                                  [Enable computer and user accounts to be trusted for delegation](/windows/device-security/security-policy-settings/enable-computer-and-user-accounts-to-be-trusted-for-delegation): SeEnableDelegationPrivilege

                                  -

                                  [Force shutdown from a remote system](/windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system): SeRemoteShutdownPrivilege

                                  -

                                  [Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege

                                  -

                                  [Increase scheduling priority](/windows/device-security/security-policy-settings/increase-scheduling-priority): SeIncreaseBasePriorityPrivilege

                                  -

                                  [Load and unload device drivers](/windows/device-security/security-policy-settings/load-and-unload-device-drivers): SeLoadDriverPrivilege

                                  -

                                  [Log on as a batch job](/windows/device-security/security-policy-settings/log-on-as-a-batch-job): SeBatchLogonRight

                                  -

                                  [Manage auditing and security log](/windows/device-security/security-policy-settings/manage-auditing-and-security-log): SeSecurityPrivilege

                                  -

                                  [Modify firmware environment values](/windows/device-security/security-policy-settings/modify-firmware-environment-values): SeSystemEnvironmentPrivilege

                                  -

                                  [Perform volume maintenance tasks](/windows/device-security/security-policy-settings/perform-volume-maintenance-tasks): SeManageVolumePrivilege

                                  -

                                  [Profile system performance](/windows/device-security/security-policy-settings/profile-system-performance): SeSystemProfilePrivilege

                                  -

                                  [Profile single process](/windows/device-security/security-policy-settings/profile-single-process): SeProfileSingleProcessPrivilege

                                  -

                                  [Remove computer from docking station](/windows/device-security/security-policy-settings/remove-computer-from-docking-station): SeUndockPrivilege

                                  -

                                  [Restore files and directories](/windows/device-security/security-policy-settings/restore-files-and-directories): SeRestorePrivilege

                                  -

                                  [Shut down the system](/windows/device-security/security-policy-settings/shut-down-the-system): SeShutdownPrivilege

                                  -

                                  [Take ownership of files or other objects](/windows/device-security/security-policy-settings/take-ownership-of-files-or-other-objects): SeTakeOwnershipPrivilege

                                  +

                                  Adjust memory quotas for a process: SeIncreaseQuotaPrivilege

                                  +

                                  Access this computer from the network: SeNetworkLogonRight

                                  +

                                  Allow log on locally: SeInteractiveLogonRight

                                  +

                                  Allow log on through Remote Desktop Services: SeRemoteInteractiveLogonRight

                                  +

                                  Back up files and directories: SeBackupPrivilege

                                  +

                                  Bypass traverse checking: SeChangeNotifyPrivilege

                                  +

                                  Change the system time: SeSystemTimePrivilege

                                  +

                                  Change the time zone: SeTimeZonePrivilege

                                  +

                                  Create a pagefile: SeCreatePagefilePrivilege

                                  +

                                  Create global objects: SeCreateGlobalPrivilege

                                  +

                                  Create symbolic links: SeCreateSymbolicLinkPrivilege

                                  +

                                  Debug programs: SeDebugPrivilege

                                  +

                                  Enable computer and user accounts to be trusted for delegation: SeEnableDelegationPrivilege

                                  +

                                  Force shutdown from a remote system: SeRemoteShutdownPrivilege

                                  +

                                  Impersonate a client after authentication: SeImpersonatePrivilege

                                  +

                                  Increase scheduling priority: SeIncreaseBasePriorityPrivilege

                                  +

                                  Load and unload device drivers: SeLoadDriverPrivilege

                                  +

                                  Log on as a batch job: SeBatchLogonRight

                                  +

                                  Manage auditing and security log: SeSecurityPrivilege

                                  +

                                  Modify firmware environment values: SeSystemEnvironmentPrivilege

                                  +

                                  Perform volume maintenance tasks: SeManageVolumePrivilege

                                  +

                                  Profile system performance: SeSystemProfilePrivilege

                                  +

                                  Profile single process: SeProfileSingleProcessPrivilege

                                  +

                                  Remove computer from docking station: SeUndockPrivilege

                                  +

                                  Restore files and directories: SeRestorePrivilege

                                  +

                                  Shut down the system: SeShutdownPrivilege

                                  +

                                  Take ownership of files or other objects: SeTakeOwnershipPrivilege

                                  -  + ### Allowed RODC Password Replication Group @@ -829,7 +837,7 @@ This security group has not changed since Windows Server 2008. -  + ### Backup Operators @@ -885,16 +893,16 @@ This security group has not changed since Windows Server 2008.

                                  Default User Rights

                                  -

                                  [Allow log on locally](/windows/device-security/security-policy-settings/allow-log-on-locally): SeInteractiveLogonRight

                                  -

                                  [Back up files and directories](/windows/device-security/security-policy-settings/back-up-files-and-directories): SeBackupPrivilege

                                  -

                                  [Log on as a batch job](/windows/device-security/security-policy-settings/log-on-as-a-batch-job): SeBatchLogonRight

                                  -

                                  [Restore files and directories](/windows/device-security/security-policy-settings/restore-files-and-directories): SeRestorePrivilege

                                  -

                                  [Shut down the system](/windows/device-security/security-policy-settings/shut-down-the-system): SeShutdownPrivilege

                                  +

                                  Allow log on locally: SeInteractiveLogonRight

                                  +

                                  Back up files and directories: SeBackupPrivilege

                                  +

                                  Log on as a batch job: SeBatchLogonRight

                                  +

                                  Restore files and directories: SeRestorePrivilege

                                  +

                                  Shut down the system: SeShutdownPrivilege

                                  -  + ### Certificate Service DCOM Access @@ -955,7 +963,7 @@ This security group has not changed since Windows Server 2008. -  + ### Cert Publishers @@ -995,7 +1003,7 @@ This security group has not changed since Windows Server 2008.

                                  Default member of

                                  -

                                  [Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)

                                  +

                                  Denied RODC Password Replication Group

                                  Protected by ADMINSDHOLDER?

                                  @@ -1016,7 +1024,7 @@ This security group has not changed since Windows Server 2008. -  + ### Cloneable Domain Controllers @@ -1077,7 +1085,7 @@ This security group was introduced in Windows Server 2012, and it has not chang -  + ### Cryptographic Operators @@ -1138,7 +1146,7 @@ This security group was introduced in Windows Vista Service Pack 1, and it h -  + ### Denied RODC Password Replication Group @@ -1176,14 +1184,14 @@ This security group includes the following changes since Windows Server 2008:

                                  Default members

                                  -

                                  [Cert Publishers](#bkmk-certpublishers)

                                  -

                                  [Domain Admins](#bkmk-domainadmins)

                                  -

                                  [Domain Controllers](#bkmk-domaincontrollers)

                                  -

                                  [Enterprise Admins](#bkmk-entadmins)

                                  +

                                  Cert Publishers

                                  +

                                  Domain Admins

                                  +

                                  Domain Controllers

                                  +

                                  Enterprise Admins

                                  Group Policy Creator Owners

                                  krbtgt

                                  -

                                  [Read-only Domain Controllers](#bkmk-rodc)

                                  -

                                  [Schema Admins](#bkmk-schemaadmins)

                                  +

                                  Read-only Domain Controllers

                                  +

                                  Schema Admins

                                  Default member of

                                  @@ -1208,7 +1216,69 @@ This security group includes the following changes since Windows Server 2008: -  +### Device Owners +This group is not currently used in Windows. + +Microsoft does not recommend changing the default configuration where this security group has zero members. Changing the default configuration could hinder future scenarios that rely on this group. + +The Device Owners group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-32-583

                                  Type

                                  BuiltIn Local

                                  Default container

                                  CN=BuiltIn, DC=<domain>, DC=

                                  Default members

                                  None

                                  Default member of

                                  None

                                  Protected by ADMINSDHOLDER?

                                  No

                                  Safe to move out of default container?

                                  Can be moved out but it is not recommended

                                  Safe to delegate management of this group to non-Service admins?

                                  No

                                  Default User Rights

                                  Allow log on locally: SeInteractiveLogonRight

                                  +

                                  Access this computer from the network: SeNetworkLogonRight

                                  +

                                  Bypass traverse checking: SeChangeNotifyPrivilege

                                  +

                                  Change the time zone: SeTimeZonePrivilege

                                  +
                                  + + ### Distributed COM Users @@ -1269,7 +1339,7 @@ This security group has not changed since Windows Server 2008. -  + ### DnsUpdateProxy @@ -1332,7 +1402,7 @@ This security group has not changed since Windows Server 2008. -  + ### DnsAdmins @@ -1393,7 +1463,7 @@ This security group has not changed since Windows Server 2008. -  + ### Domain Admins @@ -1435,8 +1505,8 @@ This security group has not changed since Windows Server 2008.

                                  Default member of

                                  -

                                  [Administrators](#bkmk-admins)

                                  -

                                  [Denied RODC Password ReplicationGroup](#bkmk-deniedrodcpwdrepl)

                                  +

                                  Administrators

                                  +

                                  Denied RODC Password ReplicationGroup

                                  Protected by ADMINSDHOLDER?

                                  @@ -1452,13 +1522,13 @@ This security group has not changed since Windows Server 2008.

                                  Default User Rights

                                  -

                                  See [Administrators](#bkmk-admins)

                                  -

                                  See [Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)

                                  +

                                  See Administrators

                                  +

                                  See Denied RODC Password Replication Group

                                  -  + ### Domain Computers @@ -1519,7 +1589,7 @@ This security group has not changed since Windows Server 2008. -  + ### Domain Controllers @@ -1559,7 +1629,7 @@ This security group has not changed since Windows Server 2008.

                                  Default member of

                                  -

                                  [Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)

                                  +

                                  Denied RODC Password Replication Group

                                  Protected by ADMINSDHOLDER?

                                  @@ -1580,7 +1650,7 @@ This security group has not changed since Windows Server 2008. -  + ### Domain Guests @@ -1620,7 +1690,7 @@ This security group has not changed since Windows Server 2008.

                                  Default member of

                                  -

                                  [Guests](#bkmk-guests)

                                  +

                                  Guests

                                  Protected by ADMINSDHOLDER?

                                  @@ -1636,12 +1706,12 @@ This security group has not changed since Windows Server 2008.

                                  Default User Rights

                                  -

                                  See [Guests](#bkmk-guests)

                                  +

                                  See Guests

                                  -  + ### Domain Users @@ -1684,7 +1754,7 @@ This security group has not changed since Windows Server 2008.

                                  Default member of

                                  -

                                  [Users](#bkmk-users)

                                  +

                                  Users

                                  Protected by ADMINSDHOLDER?

                                  @@ -1700,12 +1770,12 @@ This security group has not changed since Windows Server 2008.

                                  Default User Rights

                                  -

                                  See [Users](#bkmk-users)

                                  +

                                  See Users

                                  -  + ### Enterprise Admins @@ -1747,8 +1817,8 @@ This security group has not changed since Windows Server 2008.

                                  Default member of

                                  -

                                  [Administrators](#bkmk-admins)

                                  -

                                  [Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)

                                  +

                                  Administrators

                                  +

                                  Denied RODC Password Replication Group

                                  Protected by ADMINSDHOLDER?

                                  @@ -1764,8 +1834,8 @@ This security group has not changed since Windows Server 2008.

                                  Default User Rights

                                  -

                                  See [Administrators](#bkmk-admins)

                                  -

                                  See [Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)

                                  +

                                  See Administrators

                                  +

                                  See Denied RODC Password Replication Group

                                  @@ -1788,7 +1858,7 @@ The Enterprise Key Admins group was introduced in Windows Server 2016. | Safe to delegate management of this group to non-Service admins? | No | | Default User Rights | None | -  + ### Enterprise Read-Only Domain Controllers Members of this group are Read-Only Domain Controllers in the enterprise. Except for account passwords, a Read-only domain controller holds all the Active Directory objects and attributes that a writable domain controller holds. However, changes cannot be made to the database that is stored on the Read-only domain controller. Changes must be made on a writable domain controller and then replicated to the Read-only domain controller. @@ -1852,7 +1922,7 @@ This security group has not changed since Windows Server 2008. -  + ### Event Log Readers @@ -1913,7 +1983,7 @@ This security group has not changed since Windows Server 2008. -  + ### Group Policy Creators Owners @@ -1955,7 +2025,7 @@ This security group has not changed since Windows Server 2008.

                                  Default member of

                                  -

                                  [Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)

                                  +

                                  Denied RODC Password Replication Group

                                  Protected by ADMINSDHOLDER?

                                  @@ -1971,12 +2041,12 @@ This security group has not changed since Windows Server 2008.

                                  Default User Rights

                                  -

                                  See [Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)

                                  +

                                  See Denied RODC Password Replication Group

                                  -  + ### Guests @@ -1991,7 +2061,7 @@ A Guest account is a default member of the Guests security group. People who do The Guest account does not require a password. You can set rights and permissions for the Guest account as in any user account. By default, the Guest account is a member of the built-in Guests group and the Domain Guests global group, which allows a user to sign in to a domain. The Guest account is disabled by default, and we recommend that it stay disabled. -  + The Guests group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). @@ -2027,7 +2097,7 @@ This security group has not changed since Windows Server 2008.

                                  Default member of

                                  -

                                  [Domain Guests](#bkmk-domainguests)

                                  +

                                  Domain Guests

                                  Guest

                                  @@ -2049,7 +2119,7 @@ This security group has not changed since Windows Server 2008. -  + ### Hyper-V Administrators @@ -2058,7 +2128,7 @@ Members of the Hyper-V Administrators group have complete and unrestricted acces **Note**   Prior to Windows Server 2012, access to features in Hyper-V was controlled in part by membership in the Administrators group. -  + This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions. @@ -2113,7 +2183,7 @@ This security group was introduced in Windows Server 2012, and it has not chang -  + ### IIS\_IUSRS @@ -2174,7 +2244,7 @@ This security group has not changed since Windows Server 2008. -  + ### Incoming Forest Trust Builders @@ -2185,7 +2255,7 @@ To make this determination, the Windows security system computes a trust path be **Note**   This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). -  + For more information, see [How Domain and Forest Trusts Work: Domain and Forest Trusts](https://technet.microsoft.com/library/f5c70774-25cd-4481-8b7a-3d65c86e69b1). @@ -2194,7 +2264,7 @@ The Incoming Forest Trust Builders group applies to versions of the Windows Serv **Note**   This group cannot be renamed, deleted, or moved. -  + This security group has not changed since Windows Server 2008. @@ -2292,14 +2362,14 @@ Members of the Network Configuration Operators group can have the following admi **Note**   This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). -  + The Network Configuration Operators group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). **Note**   This group cannot be renamed, deleted, or moved. -  + This security group has not changed since Windows Server 2008. @@ -2354,7 +2424,7 @@ This security group has not changed since Windows Server 2008. -  + ### Performance Log Users @@ -2367,7 +2437,7 @@ Members of the Performance Log Users group can manage performance counters, logs **Warning**   If you are a member of the Performance Log Users group, you must configure Data Collector Sets that you create to run under your credentials. -   + - Cannot use the Windows Kernel Trace event provider in Data Collector Sets. @@ -2376,14 +2446,14 @@ For members of the Performance Log Users group to initiate data logging or modif **Note**   This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). -  + The Performance Log Users group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). **Note**   This account cannot be renamed, deleted, or moved. -  + This security group has not changed since Windows Server 2008. @@ -2433,12 +2503,12 @@ This security group has not changed since Windows Server 2008.

                                  Default User Rights

                                  -

                                  [Log on as a batch job](/windows/device-security/security-policy-settings/log-on-as-a-batch-job): SeBatchLogonRight

                                  +

                                  Log on as a batch job: SeBatchLogonRight

                                  -  + ### Performance Monitor Users @@ -2457,12 +2527,12 @@ Specifically, members of this security group: **Warning**   You cannot configure a Data Collector Set to run as a member of the Performance Monitor Users group. -   + **Note**   This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). This group cannot be renamed, deleted, or moved. -  + The Performance Monitor Users group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). @@ -2519,7 +2589,7 @@ This security group has not changed since Windows Server 2008. -  + ### Pre–Windows 2000 Compatible Access @@ -2528,7 +2598,7 @@ Members of the Pre–Windows 2000 Compatible Access group have Read access for **Warning**   This group appears as a SID until the domain controller is made the primary domain controller and it holds the operations master role (also known as flexible single master operations or FSMO). -  + The Pre–Windows 2000 Compatible Access group applies to versions of the Windows Server operating system listed in the [Active Directory Default Security Groups table](#bkmk-groupstable). @@ -2580,13 +2650,13 @@ This security group has not changed since Windows Server 2008.

                                  Default User Rights

                                  -

                                  [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight

                                  -

                                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

                                  +

                                  Access this computer from the network: SeNetworkLogonRight

                                  +

                                  Bypass traverse checking: SeChangeNotifyPrivilege

                                  -  + ### Print Operators @@ -2644,14 +2714,14 @@ This security group has not changed since Windows Server 2008. However, in Windo

                                  Default User Rights

                                  -

                                  [Allow log on locally](/windows/device-security/security-policy-settings/allow-log-on-locally): SeInteractiveLogonRight

                                  -

                                  [Load and unload device drivers](/windows/device-security/security-policy-settings/load-and-unload-device-drivers): SeLoadDriverPrivilege

                                  -

                                  [Shut down the system](/windows/device-security/security-policy-settings/shut-down-the-system): SeShutdownPrivilege

                                  +

                                  Allow log on locally: SeInteractiveLogonRight

                                  +

                                  Load and unload device drivers: SeLoadDriverPrivilege

                                  +

                                  Shut down the system: SeShutdownPrivilege

                                  -  + ### Protected Users @@ -2728,7 +2798,7 @@ The following table specifies the properties of the Protected Users group. -  + ### RAS and IAS Servers @@ -2789,7 +2859,7 @@ This security group has not changed since Windows Server 2008. -  + ### RDS Endpoint Servers @@ -2813,7 +2883,7 @@ This security group was introduced in Windows Server 2012, and it has not chang

                                  Well-Known SID/RID

                                  -

                                  S-1-5-21-<domain>-553

                                  +

                                  S-1-5-32-<domain>-576

                                  Type

                                  @@ -2850,7 +2920,7 @@ This security group was introduced in Windows Server 2012, and it has not chang -  + ### RDS Management Servers @@ -2909,7 +2979,7 @@ This security group was introduced in Windows Server 2012, and it has not chang -  + ### RDS Remote Access Servers @@ -2970,7 +3040,7 @@ This security group was introduced in Windows Server 2012, and it has not chang -  + ### Remote Desktop Users @@ -3031,7 +3101,7 @@ This security group has not changed since Windows Server 2008. -  + ### Read-Only Domain Controllers @@ -3083,7 +3153,7 @@ This security group was introduced in Windows Server 2008, and it has not chang

                                  Default member of

                                  -

                                  [Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)

                                  +

                                  Denied RODC Password Replication Group

                                  Protected by ADMINSDHOLDER?

                                  @@ -3099,12 +3169,12 @@ This security group was introduced in Windows Server 2008, and it has not chang

                                  Default User Rights

                                  -

                                  See [Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)

                                  +

                                  See Denied RODC Password Replication Group

                                  -  + ### Remote Management Users @@ -3167,7 +3237,7 @@ This security group was introduced in Windows Server 2012, and it has not chang -  + ### Replicator @@ -3234,7 +3304,7 @@ This security group has not changed since Windows Server 2008. -  + ### Schema Admins @@ -3280,7 +3350,7 @@ This security group has not changed since Windows Server 2008.

                                  Default member of

                                  -

                                  [Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)

                                  +

                                  Denied RODC Password Replication Group

                                  Protected by ADMINSDHOLDER?

                                  @@ -3296,12 +3366,12 @@ This security group has not changed since Windows Server 2008.

                                  Default User Rights

                                  -

                                  See [Denied RODC Password Replication Group](#bkmk-deniedrodcpwdrepl)

                                  +

                                  See Denied RODC Password Replication Group

                                  -  + ### Server Operators @@ -3359,13 +3429,13 @@ This security group has not changed since Windows Server 2008.

                                  Default User Rights

                                  -

                                  [Allow log on locally](/windows/device-security/security-policy-settings/allow-log-on-locally): SeInteractiveLogonRight

                                  -

                                  [Back up files and directories](/windows/device-security/security-policy-settings/back-up-files-and-directories): SeBackupPrivilege

                                  -

                                  [Change the system time](/windows/device-security/security-policy-settings/change-the-system-time): SeSystemTimePrivilege

                                  -

                                  [Change the time zone](/windows/device-security/security-policy-settings/change-the-time-zone): SeTimeZonePrivilege

                                  -

                                  [Force shutdown from a remote system](/windows/device-security/security-policy-settings/force-shutdown-from-a-remote-system): SeRemoteShutdownPrivilege

                                  -

                                  [Restore files and directories](/windows/device-security/security-policy-settings/restore-files-and-directories): Restore files and directories SeRestorePrivilege

                                  -

                                  [Shut down the system](/windows/device-security/security-policy-settings/shut-down-the-system): SeShutdownPrivilege

                                  +

                                  Allow log on locally: SeInteractiveLogonRight

                                  +

                                  Back up files and directories: SeBackupPrivilege

                                  +

                                  Change the system time: SeSystemTimePrivilege

                                  +

                                  Change the time zone: SeTimeZonePrivilege

                                  +

                                  Force shutdown from a remote system: SeRemoteShutdownPrivilege

                                  +

                                  Restore files and directories: Restore files and directories SeRestorePrivilege

                                  +

                                  Shut down the system: SeShutdownPrivilege

                                  @@ -3422,7 +3492,7 @@ The Terminal Server License Servers group applies to versions of the Windows Ser **Note**   This group cannot be renamed, deleted, or moved. -  + This security group only applies to Windows Server 2003 and Windows Server 2008 because Terminal Services was replaced by Remote Desktop Services in Windows Server 2008 R2. @@ -3477,7 +3547,7 @@ This security group only applies to Windows Server 2003 and Windows Server 200 -  + ### Users @@ -3520,7 +3590,7 @@ This security group includes the following changes since Windows Server 2008:

                                  Default members

                                  Authenticated Users

                                  -

                                  [Domain Users](#bkmk-domainusers)

                                  +

                                  Domain Users

                                  INTERACTIVE

                                  @@ -3546,7 +3616,7 @@ This security group includes the following changes since Windows Server 2008: -  + ### Windows Authorization Access Group @@ -3557,7 +3627,7 @@ The Windows Authorization Access group applies to versions of the Windows Server **Note**   This group cannot be renamed, deleted, or moved. -  + This security group has not changed since Windows Server 2008. @@ -3612,7 +3682,7 @@ This security group has not changed since Windows Server 2008. -  + ### WinRMRemoteWMIUsers\_ @@ -3637,7 +3707,7 @@ In Windows Server 2012, the Access Denied Assistance functionality adds the Aut **Note**   The WinRMRemoteWMIUsers\_ group allows running Windows PowerShell commands remotely whereas the [Remote Management Users](#bkmk-remotemanagementusers) group is generally used to allow users to manage servers by using the Server Manager console. -  + This security group was introduced in Windows Server 2012, and it has not changed in subsequent versions. @@ -3692,6 +3762,7 @@ This security group was introduced in Windows Server 2012, and it has not chang + ## See also - [Security Principals](security-principals.md) diff --git a/windows/security/identity-protection/access-control/dynamic-access-control.md b/windows/security/identity-protection/access-control/dynamic-access-control.md index ee4a831edc..1ef5a24b40 100644 --- a/windows/security/identity-protection/access-control/dynamic-access-control.md +++ b/windows/security/identity-protection/access-control/dynamic-access-control.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Dynamic Access Control Overview @@ -95,10 +96,6 @@ By default, devices running any of the supported versions of Windows are able to Every domain controller needs to have the same Administrative Template policy setting, which is located at **Computer Configuration\\Policies\\Administrative Templates\\System\\KDC\\Support Dynamic Access Control and Kerberos armoring**. -### Support for using the Key Distribution Center (KDC) Group Policy setting to enable Dynamic Access Control for a domain. - -Every domain controller needs to have the same Administrative Template policy setting, which is located at **Computer Configuration\\Policies\\Administrative Templates\\System\\KDC\\Support Dynamic Access Control and Kerberos armoring**. - ### Support in Active Directory to store user and device claims, resource properties, and central access policy objects. ### Support for using Group Policy to deploy central access policy objects. diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index 2fefc6e157..33ef3a0add 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 02/28/2019 +ms.reviewer: --- # Local Accounts @@ -95,12 +96,12 @@ In this case, Group Policy can be used to enable secure settings that can contro **Note**   Blank passwords are not allowed in the versions designated in the **Applies To** list at the beginning of this topic. -  + **Important**   Even when the Administrator account has been disabled, it can still be used to gain access to a computer by using safe mode. In the Recovery Console or in safe mode, the Administrator account is automatically enabled. When normal operations are resumed, it is disabled. -  + ### Guest account @@ -116,19 +117,87 @@ When enabling the Guest account, only grant limited rights and permissions. For In addition, the guest user in the Guest account should not be able to view the event logs. After the Guest account is enabled, it is a best practice to monitor the Guest account frequently to ensure that other users cannot use services and other resources, such as resources that were unintentionally left available by a previous user. +## HelpAssistant account (installed with a Remote Assistance session) + + +The HelpAssistant account is a default local account that is enabled when a Remote Assistance session is run. This account is automatically disabled when no Remote Assistance requests are pending. + +HelpAssistant is the primary account that is used to establish a Remote Assistance session. The Remote Assistance session is used to connect to another computer running the Windows operating system, and it is initiated by invitation. For solicited remote assistance, a user sends an invitation from their computer, through e-mail or as a file, to a person who can provide assistance. After the user’s invitation for a Remote Assistance session is accepted, the default HelpAssistant account is automatically created to give the person who provides assistance limited access to the computer. The HelpAssistant account is managed by the Remote Desktop Help Session Manager service. + +**Security considerations** + +The SIDs that pertain to the default HelpAssistant account include: + +- SID: S-1-5-<domain>-13, display name Terminal Server User. This group includes all users who sign in to a server with Remote Desktop Services enabled. Note that, in Windows Server 2008, Remote Desktop Services are called Terminal Services. + +- SID: S-1-5-<domain>-14, display name Remote Interactive Logon. This group includes all users who connect to the computer by using a remote desktop connection. This group is a subset of the Interactive group. Access tokens that contain the Remote Interactive Logon SID also contain the Interactive SID. + +For the Windows Server operating system, Remote Assistance is an optional component that is not installed by default. You must install Remote Assistance before it can be used. + +For details about the HelpAssistant account attributes, see the following table. + +**HelpAssistant account attributes** + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-<domain>-13 (Terminal Server User), S-1-5-<domain>-14 (Remote Interactive Logon)

                                  Type

                                  User

                                  Default container

                                  CN=Users, DC=<domain>, DC=

                                  Default members

                                  None

                                  Default member of

                                  Domain Guests

                                  +

                                  Guests

                                  Protected by ADMINSDHOLDER?

                                  No

                                  Safe to move out of default container?

                                  Can be moved out, but we do not recommend it.

                                  Safe to delegate management of this group to non-Service admins?

                                  No

                                  ### DefaultAccount The DefaultAccount, also known as the Default System Managed Account (DSMA), is a built-in account introduced in Windows 10 version 1607 and Windows Server 2016. -The DMSA is a well-known user account type. +The DSMA is a well-known user account type. It is a user neutral account that can be used to run processes that are either multi-user aware or user-agnostic. -The DMSA is disabled by default on the desktop SKUs (full windows SKUs) and WS 2016 with the Desktop. +The DSMA is disabled by default on the desktop SKUs (full windows SKUs) and WS 2016 with the Desktop. -The DMSA has a well-known RID of 503. The security identifier (SID) of the DMSA will thus have a well-known SID in the following format: S-1-5-21--503 +The DSMA has a well-known RID of 503. The security identifier (SID) of the DSMA will thus have a well-known SID in the following format: S-1-5-21-\-503 -The DMSA is a member of the well-known group **System Managed Accounts Group**, which has a well-known SID of S-1-5-32-581. +The DSMA is a member of the well-known group **System Managed Accounts Group**, which has a well-known SID of S-1-5-32-581. -The DMSA alias can be granted access to resources during offline staging even before the account itself has been created. The account and the group are created during first boot of the machine within the Security Accounts Manager (SAM). +The DSMA alias can be granted access to resources during offline staging even before the account itself has been created. The account and the group are created during first boot of the machine within the Security Accounts Manager (SAM). #### How Windows uses the DefaultAccount From a permission perspective, the DefaultAccount is a standard user account. @@ -181,7 +250,7 @@ You can use Local Users and Groups to assign rights and permissions on the local You cannot use Local Users and Groups on a domain controller. However, you can use Local Users and Groups on a domain controller to target remote computers that are not domain controllers on the network. **Note**   -You use Active Directory Users and Computers to manage users and groups in Active Directory.loca +You use Active Directory Users and Computers to manage users and groups in Active Directory. You can also manage local users by using NET.EXE USER and manage local groups by using NET.EXE LOCALGROUP, or by using a variety of PowerShell cmdlets and other scripting technologies. @@ -204,7 +273,7 @@ Each of these approaches is described in the following sections. **Note**   These approaches do not apply if all administrative local accounts are disabled. -  + ### Enforce local account restrictions for remote access @@ -240,7 +309,7 @@ The following table shows the Group Policy and registry settings that are used t

                                  1

                                  Policy name

                                  -

                                  [User Account Control: Run all administrators in Admin Approval Mode](/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode)

                                  +

                                  User Account Control: Run all administrators in Admin Approval Mode

                                  @@ -255,7 +324,7 @@ The following table shows the Group Policy and registry settings that are used t

                                  Policy name

                                  -

                                  [User Account Control: Run all administrators in Admin Approval Mode](/windows/device-security/security-policy-settings/user-account-control-run-all-administrators-in-admin-approval-mode)

                                  +

                                  User Account Control: Run all administrators in Admin Approval Mode

                                  @@ -288,7 +357,7 @@ The following table shows the Group Policy and registry settings that are used t >[!NOTE] >You can also enforce the default for LocalAccountTokenFilterPolicy by using the custom ADMX in Security Templates. -  + **To enforce local account restrictions for remote access** @@ -363,7 +432,7 @@ Denying local accounts the ability to perform network logons can help prevent a **Note**   In order to perform this procedure, you must first identify the name of the local, default Administrator account, which might not be the default user name "Administrator", and any other accounts that are members of the local Administrators group. -  + The following table shows the Group Policy settings that are used to deny network logon for all local Administrator accounts. @@ -387,7 +456,7 @@ The following table shows the Group Policy settings that are used to deny networ

                                  1

                                  Policy name

                                  -

                                  [Deny access to this computer from the network](/windows/device-security/security-policy-settings/deny-access-to-this-computer-from-the-network)

                                  +

                                  Deny access to this computer from the network

                                  @@ -403,7 +472,7 @@ The following table shows the Group Policy settings that are used to deny networ

                                  Policy name

                                  -

                                  [Deny log on through Remote Desktop Services](/windows/device-security/security-policy-settings/deny-log-on-through-remote-desktop-services)

                                  +

                                  Deny log on through Remote Desktop Services

                                  @@ -414,7 +483,7 @@ The following table shows the Group Policy settings that are used to deny networ -  + **To deny network logon to all local administrator accounts** @@ -446,7 +515,7 @@ The following table shows the Group Policy settings that are used to deny networ 2. Double-click **Deny log on through Remote Desktop Services**. - 3. Click **Add User or Group**, type type **Local account and member of Administrators group**, and > **OK**. + 3. Click **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**. 8. Link the GPO to the first **Workstations** OU as follows: diff --git a/windows/security/identity-protection/access-control/microsoft-accounts.md b/windows/security/identity-protection/access-control/microsoft-accounts.md index 38c26d9546..d1f2624bf6 100644 --- a/windows/security/identity-protection/access-control/microsoft-accounts.md +++ b/windows/security/identity-protection/access-control/microsoft-accounts.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 10/13/2017 +ms.reviewer: --- # Microsoft Accounts @@ -22,7 +23,7 @@ ms.date: 10/13/2017 This topic for the IT professional explains how a Microsoft account works to enhance security and privacy for users, and how you can manage this consumer account type in your organization. -Microsoft sites, services, and properties, as well as computers running Windows 10, can use a Microsoft account as a mean of identifying a user. Microsoft account was previously called Windows Live ID. It has user-defined secrets, and consists of a unique email address and a password. +Microsoft sites, services, and properties, as well as computers running Windows 10, can use a Microsoft account as a means of identifying a user. Microsoft account was previously called Windows Live ID. It has user-defined secrets, and consists of a unique email address and a password. When a user signs in with a Microsoft account, the device is connected to cloud services. Many of the user's settings, preferences, and apps can be shared across devices. diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index f0034aa645..c8bdc813a2 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Security identifiers @@ -193,9 +194,9 @@ The SECURITY\_NT\_AUTHORITY (S-1-5) predefined identifier authority produces SID | S-1-5-2 | Network | A group that includes all users who are logged on by means of a network connection. Access tokens for interactive users do not contain the Network SID.| | S-1-5-3 | Batch | A group that includes all users who have logged on by means of a batch queue facility, such as task scheduler jobs.| | S-1-5-4 | Interactive| A group that includes all users who log on interactively. A user can start an interactive logon session by logging on directly at the keyboard, by opening a Remote Desktop Services connection from a remote computer, or by using a remote shell such as Telnet. In each case, the user's access token contains the Interactive SID. If the user signs in by using a Remote Desktop Services connection, the user's access token also contains the Remote Interactive Logon SID.| -| S-1-5-5- *X *- *Y * | Logon Session| The *X * and *Y * values for these SIDs uniquely identify a particular logon session.| +| S-1-5-5- *X*-*Y* | Logon Session| The *X* and *Y* values for these SIDs uniquely identify a particular logon session.| | S-1-5-6 | Service| A group that includes all security principals that have signed in as a service.| -| S-1-5-7 | Anonymous Logon| A user who has connected to the computer without supplying a user name and password.
                                  The Anonymous Logon identity is different from the identity that is used by Internet Information Services (IIS) for anonymous web access. IIS uses an actual account—by default, IUSR_ *ComputerName *, for anonymous access to resources on a website. Strictly speaking, such access is not anonymous because the security principal is known even though unidentified people are using the account. IUSR_ *ComputerName * (or whatever you name the account) has a password, and IIS logs on the account when the service starts. As a result, the IIS "anonymous" user is a member of Authenticated Users but Anonymous Logon is not.| +| S-1-5-7 | Anonymous Logon| A user who has connected to the computer without supplying a user name and password.
                                  The Anonymous Logon identity is different from the identity that is used by Internet Information Services (IIS) for anonymous web access. IIS uses an actual account—by default, IUSR_ *ComputerName*, for anonymous access to resources on a website. Strictly speaking, such access is not anonymous because the security principal is known even though unidentified people are using the account. IUSR_ *ComputerName* (or whatever you name the account) has a password, and IIS logs on the account when the service starts. As a result, the IIS "anonymous" user is a member of Authenticated Users but Anonymous Logon is not.| | S-1-5-8| Proxy| Does not currently apply: this SID is not used.| | S-1-5-9 | Enterprise Domain Controllers| A group that includes all domain controllers in a forest of domains.| | S-1-5-10 | Self| A placeholder in an ACE for a user, group, or computer object in Active Directory. When you grant permissions to Self, you grant them to the security principal that is represented by the object. During an access check, the operating system replaces the SID for Self with the SID for the security principal that is represented by the object.| @@ -282,6 +283,24 @@ The following table describes changes in SID implementation in the Windows opera | Most of the operating system files are owned by the TrustedInstaller security identifier (SID)| Windows Server 2008, Windows Vista| The purpose of this change is to prevent a process that is running as an administrator or under the LocalSystem account from automatically replacing the operating system files. | | Restricted SID checks are implemented| Windows Server 2008, Windows Vista| When restricting SIDs are present, Windows performs two access checks. The first is the normal access check, and the second is the same access check against the restricting SIDs in the token. Both access checks must pass to allow the process to access the object. | +## Capability SIDs + +Capability Security Identifiers (SIDs) are used to uniquely and immutably identify capabilities. Capabilities represent an unforgeable token of authority that grants access to resources (Examples: documents, camera, locations etc...) to Universal Windows Applications. An App that “has” a capability is granted access to the resource the capability is associated with, and one that “does not have” a capability is denied access to the resource. + +All Capability SIDs that the operating system is aware of are stored in the Windows Registry in the path `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities'. Any Capability SID added to Windows by first or third-party applications will be added to this location. + +## Examples of registry keys taken from Windows 10, version 1909, 64-bit Enterprise edition +You may see the following registry keys under AllCachedCapabilities: + +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_DevUnlock_Internal +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Enterprise +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_General +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Restricted +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapabilityClasses\AllCachedCapabilities\capabilityClass_Windows + +All Capability SIDs are prefixed by S-1-15-3 + ## See also - [Access Control Overview](access-control.md) diff --git a/windows/security/identity-protection/access-control/security-principals.md b/windows/security/identity-protection/access-control/security-principals.md index 8442ef86cb..111f5d902d 100644 --- a/windows/security/identity-protection/access-control/security-principals.md +++ b/windows/security/identity-protection/access-control/security-principals.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Security Principals @@ -148,4 +149,4 @@ For descriptions and settings information about the Special Identities group, se ## See also -- [Access Control Overview](access-control.md) \ No newline at end of file +- [Access Control Overview](access-control.md) diff --git a/windows/security/identity-protection/access-control/service-accounts.md b/windows/security/identity-protection/access-control/service-accounts.md index 1569d03c49..bc52668527 100644 --- a/windows/security/identity-protection/access-control/service-accounts.md +++ b/windows/security/identity-protection/access-control/service-accounts.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Service Accounts @@ -83,7 +84,7 @@ A managed service account is dependent on encryption types supported by Kerberos **Note**   Introduced in Windows Server 2008 R2, the Data Encryption Standard (DES) is disabled by default. For more information about supported encryption types, see [Changes in Kerberos Authentication](https://technet.microsoft.com/library/dd560670(WS.10).aspx). -  + Group managed service accounts are not applicable in Windows operating systems prior to Windows Server 2012. @@ -114,4 +115,4 @@ The following table provides links to additional resources that are related to s |---------------|-------------| | **Product evaluation** | [What's New for Managed Service Accounts](https://technet.microsoft.com/library/hh831451(v=ws.11).aspx)
                                  [Getting Started with Group Managed Service Accounts](https://technet.microsoft.com/library/jj128431(v=ws.11).aspx) | | **Deployment** | [Windows Server 2012: Group Managed Service Accounts - Ask Premier Field Engineering (PFE) Platforms - Site Home - TechNet Blogs](http://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx) | -| **Related technologies** | [Security Principals](security-principals.md)
                                  [What's new in Active Directory Domain Services](https://technet.microsoft.com/library/mt163897.aspx) | \ No newline at end of file +| **Related technologies** | [Security Principals](security-principals.md)
                                  [What's new in Active Directory Domain Services](https://technet.microsoft.com/library/mt163897.aspx) | diff --git a/windows/security/identity-protection/access-control/special-identities.md b/windows/security/identity-protection/access-control/special-identities.md index 86165f1bf1..48f324427e 100644 --- a/windows/security/identity-protection/access-control/special-identities.md +++ b/windows/security/identity-protection/access-control/special-identities.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Special Identities @@ -34,364 +35,153 @@ Although the special identity groups can be assigned rights and permissions to r For information about security groups and group scope, see [Active Directory Security Groups](active-directory-security-groups.md). -The special identity groups are described in the following tables. +The special identity groups are described in the following tables: -- [Anonymous Logon](#bkmk-anonymouslogon) +- [Anonymous Logon](#anonymous-logon) -- [Authenticated User](#bkmk-authenticateduser) +- [Authenticated User](#authenticated-users) -- [Batch](#bkmk-batch) +- [Batch](#batch) -- [Creator Group](#bkmk-creatorgroup) +- [Creator Group](#creator-group) -- [Creator Owner](#bkmk-creatorowner) +- [Creator Owner](#creator-owner) -- [Dialup](#bkmk-dialup) +- [Dialup](#dialup) -- [Digest Authentication](#bkmk-digestauth) +- [Digest Authentication](#digest-authentication) -- [Enterprise Domain Controllers](#bkmk-entdcs) +- [Enterprise Domain Controllers](#enterprise-domain-controllers) -- [Everyone](#bkmk-everyone) +- [Everyone](#everyone) -- [Interactive](#bkmk-interactive) +- [Interactive](#interactive) -- [Local Service](#bkmk-localservice) +- [Local Service](#local-service) -- [LocalSystem](#bkmk-localsystem) +- [LocalSystem](#localsystem) -- [Network](#bkmk-network) +- [Network](#network) -- [Network Service](#bkmk-networkservice) +- [Network Service](#network-service) -- [NTLM Authentication](#bkmk-ntlmauth) +- [NTLM Authentication](#ntlm-authentication) -- [Other Organization](#bkmk-otherorganization) +- [Other Organization](#other-organization) -- [Principal Self](#bkmk-principalself) +- [Principal Self](#principal-self) -- [Remote Interactive Logon](#bkmk-remoteinteractivelogon) +- [Remote Interactive Logon](#remote-interactive-logon) -- [Restricted](#bkmk-restrictedcode) +- [Restricted](#restricted) -- [SChannel Authentication](#bkmk-schannelauth) +- [SChannel Authentication](#schannel-authentication) -- [Service](#bkmk-service) +- [Service](#service) -- [Terminal Server User](#bkmk-terminalserveruser) +- [Terminal Server User](#terminal-server-user) -- [This Organization](#bkmk-thisorg) +- [This Organization](#this-organization) -- [Window Manager\\Window Manager Group](#bkmk-windowmanager) +- [Window Manager\\Window Manager Group](#window-managerwindow-manager-group) -## Anonymous Logon +## Anonymous Logon Any user who accesses the system through an anonymous logon has the Anonymous Logon identity. This identity allows anonymous access to resources, such as a web page that is published on corporate servers. The Anonymous Logon group is not a member of the Everyone group by default. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-7

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-7 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights|None| -  - -## Authenticated Users +## Authenticated Users Any user who accesses the system through a sign-in process has the Authenticated Users identity. This identity allows access to shared resources within the domain, such as files in a shared folder that should be accessible to all the workers in the organization. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-11

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight

                                  -

                                  [Add workstations to domain](/windows/device-security/security-policy-settings/add-workstations-to-domain): SeMachineAccountPrivilege

                                  -

                                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-11 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=System,cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight
                                  [Add workstations to domain](/windows/device-security/security-policy-settings/add-workstations-to-domain): SeMachineAccountPrivilege
                                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege| -  - -## Batch +## Batch Any user or process that accesses the system as a batch job (or through the batch queue) has the Batch identity. This identity allows batch jobs to run scheduled tasks, such as a nightly cleanup job that deletes temporary files. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-3

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-3 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none| -  - -## Creator Group +## Creator Group The person who created the file or the directory is a member of this special identity group. Windows Server operating systems use this identity to automatically grant access permissions to the creator of a file or directory. A placeholder security identifier (SID) is created in an inheritable access control entry (ACE). When the ACE is inherited, the system replaces this SID with the SID for the primary group of the object’s current owner. The primary group is used only by the Portable Operating System Interface for UNIX (POSIX) subsystem. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-3-1

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-3-1 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none| -  - -## Creator Owner +## Creator Owner The person who created the file or the directory is a member of this special identity group. Windows Server operating systems use this identity to automatically grant access permissions to the creator of a file or directory. A placeholder SID is created in an inheritable ACE. When the ACE is inherited, the system replaces this SID with the SID for the object’s current owner. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-3-0

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-3-0 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none| -  - -## Dialup +## Dialup Any user who accesses the system through a dial-up connection has the Dial-Up identity. This identity distinguishes dial-up users from other types of authenticated users. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-1

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-1 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none|  -  - -## Digest Authentication +## Digest Authentication - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-64-21

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-64-21 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| none|  -  - -## Enterprise Domain Controllers +## Enterprise Domain Controllers This group includes all domain controllers in an Active Directory forest. Domain controllers with enterprise-wide roles and responsibilities have the Enterprise Domain Controllers identity. This identity allows them to perform certain tasks in the enterprise by using transitive trusts. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-9

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights Assignment

                                  [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight

                                  -

                                  [Allow log on locally](/windows/device-security/security-policy-settings/allow-log-on-locally): SeInteractiveLogonRight

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-9 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight
                                  [Allow log on locally](/windows/device-security/security-policy-settings/allow-log-on-locally): SeInteractiveLogonRight| -  - -## Everyone +## Everyone All interactive, network, dial-up, and authenticated users are members of the Everyone group. This special identity group gives wide access to system resources. Whenever a user logs on to the network, the user is automatically added to the Everyone group. @@ -400,615 +190,184 @@ On computers running Windows 2000 and earlier, the Everyone group included the Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-1-0

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight

                                  -

                                  [Act as part of the operating system](/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system): SeTcbPrivilege

                                  -

                                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-1-0 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Access this computer from the network](/windows/device-security/security-policy-settings/access-this-computer-from-the-network): SeNetworkLogonRight
                                  [Act as part of the operating system](/windows/device-security/security-policy-settings/act-as-part-of-the-operating-system): SeTcbPrivilege
                                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege| -  - -## Interactive +## Interactive Any user who is logged on to the local system has the Interactive identity. This identity allows only local users to access a resource. Whenever a user accesses a given resource on the computer to which they are currently logged on, the user is automatically added to the Interactive group. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-4

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-4 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None| -  - -## Local Service +## Local Service The Local Service account is similar to an Authenticated User account. The Local Service account has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard your system if individual services or processes are compromised. Services that run as the Local Service account access network resources as a null session with anonymous credentials. The name of the account is NT AUTHORITY\\LocalService. This account does not have a password. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-19

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default user rights

                                  [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege

                                  -

                                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

                                  -

                                  [Change the system time](/windows/device-security/security-policy-settings/change-the-system-time): SeSystemtimePrivilege

                                  -

                                  [Change the time zone](/windows/device-security/security-policy-settings/change-the-time-zone): SeTimeZonePrivilege

                                  -

                                  [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege

                                  -

                                  [Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege

                                  -

                                  [Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege

                                  -

                                  [Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-19 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege
                                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
                                  [Change the system time](/windows/device-security/security-policy-settings/change-the-system-time): SeSystemtimePrivilege
                                  [Change the time zone](/windows/device-security/security-policy-settings/change-the-time-zone): SeTimeZonePrivilege
                                  [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
                                  [Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege
                                  [Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
                                  [Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege
                                  | -  - -## LocalSystem +## LocalSystem This is a service account that is used by the operating system. The LocalSystem account is a powerful account that has full access to the system and acts as the computer on the network. If a service logs on to the LocalSystem account on a domain controller, that service has access to the entire domain. Some services are configured by default to log on to the LocalSystem account. Do not change the default service setting. The name of the account is LocalSystem. This account does not have a password. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-18

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  -  - -## Network +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-18 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights|None| +## Network This group implicitly includes all users who are logged on through a network connection. Any user who accesses the system through a network has the Network identity. This identity allows only remote users to access a resource. Whenever a user accesses a given resource over the network, the user is automatically added to the Network group. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-2

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-2 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights|None| -  - -## Network Service +## Network Service The Network Service account is similar to an Authenticated User account. The Network Service account has the same level of access to resources and objects as members of the Users group. This limited access helps safeguard your system if individual services or processes are compromised. Services that run as the Network Service account access network resources by using the credentials of the computer account. The name of the account is NT AUTHORITY\\NetworkService. This account does not have a password. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-20

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege

                                  -

                                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

                                  -

                                  [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege

                                  -

                                  [Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege

                                  -

                                  [Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege

                                  -

                                  [Restore files and directories](/windows/device-security/security-policy-settings/restore-files-and-directories): SeRestorePrivilege

                                  -

                                  [Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-20 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Adjust memory quotas for a process](/windows/device-security/security-policy-settings/adjust-memory-quotas-for-a-process): SeIncreaseQuotaPrivilege
                                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
                                  [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
                                  [Generate security audits](/windows/device-security/security-policy-settings/generate-security-audits): SeAuditPrivilege
                                  [Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
                                  [Replace a process level token](/windows/device-security/security-policy-settings/replace-a-process-level-token): SeAssignPrimaryTokenPrivilege
                                  | -  - -## NTLM Authentication +## NTLM Authentication - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-64-10

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-64-10 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None| -  - -## Other Organization +## Other Organization This group implicitly includes all users who are logged on to the system through a dial-up connection. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-1000

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-1000 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## Principal Self +## Principal Self This identify is a placeholder in an ACE on a user, group, or computer object in Active Directory. When you grant permissions to Principal Self, you grant them to the security principal that is represented by the object. During an access check, the operating system replaces the SID for Principal Self with the SID for the security principal that is represented by the object. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-10

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-10 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## Remote Interactive Logon +## Remote Interactive Logon This identity represents all users who are currently logged on to a computer by using a Remote Desktop connection. This group is a subset of the Interactive group. Access tokens that contain the Remote Interactive Logon SID also contain the Interactive SID. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-14

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-14| +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## Restricted +## Restricted Users and computers with restricted capabilities have the Restricted identity. This identity group is used by a process that is running in a restricted security context, such as running an application with the RunAs service. When code runs at the Restricted security level, the Restricted SID is added to the user’s access token. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-12

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-12 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## SChannel Authentication +## SChannel Authentication - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-64-14

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-64-14 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## Service +## Service Any service that accesses the system has the Service identity. This identity group includes all security principals that are signed in as a service. This identity grants access to processes that are being run by Windows Server services. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-6

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege

                                  -

                                  [Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege

                                  -  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-6 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Create global objects](/windows/device-security/security-policy-settings/create-global-objects): SeCreateGlobalPrivilege
                                  [Impersonate a client after authentication](/windows/device-security/security-policy-settings/impersonate-a-client-after-authentication): SeImpersonatePrivilege
                                  | -## Terminal Server User +## Terminal Server User Any user accessing the system through Terminal Services has the Terminal Server User identity. This identity allows users to access Terminal Server applications and to perform other necessary tasks with Terminal Server services. Membership is controlled by the operating system. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-13

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-13 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  - -## This Organization +## This Organization - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  S-1-5-15

                                  Object Class

                                  Foreign Security Principal

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  None

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | S-1-5-15 | +|Object Class| Foreign Security Principal| +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| None | -  +## Window Manager\\Window Manager Group -## Window Manager\\Window Manager Group - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
                                  AttributeValue

                                  Well-Known SID/RID

                                  Object Class

                                  Default Location in Active Directory

                                  cn=WellKnown Security Principals, cn=Configuration, dc=<forestRootDomain>

                                  Default User Rights

                                  [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege

                                  -

                                  [Increase a process working set](/windows/device-security/security-policy-settings/increase-a-process-working-set): SeIncreaseWorkingSetPrivilege

                                  +| **Attribute** | **Value** | +| :--: | :--: | +| Well-Known SID/RID | | +|Object Class| | +|Default Location in Active Directory |cn=WellKnown Security Principals, cn=Configuration, dc=\| +|Default User Rights| [Bypass traverse checking](/windows/device-security/security-policy-settings/bypass-traverse-checking): SeChangeNotifyPrivilege
                                  [Increase a process working set](/windows/device-security/security-policy-settings/increase-a-process-working-set): SeIncreaseWorkingSetPrivilege
                                  | ## See also @@ -1016,4 +375,4 @@ Any user accessing the system through Terminal Services has the Terminal Server - [Security Principals](security-principals.md) -- [Access Control Overview](access-control.md) \ No newline at end of file +- [Access Control Overview](access-control.md) diff --git a/windows/security/identity-protection/change-history-for-access-protection.md b/windows/security/identity-protection/change-history-for-access-protection.md index b2b7f6daf9..954dd6020d 100644 --- a/windows/security/identity-protection/change-history-for-access-protection.md +++ b/windows/security/identity-protection/change-history-for-access-protection.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 08/11/2017 +ms.reviewer: --- # Change history for access protection diff --git a/windows/security/identity-protection/configure-s-mime.md b/windows/security/identity-protection/configure-s-mime.md index b6fa386ae3..0dd5d09a40 100644 --- a/windows/security/identity-protection/configure-s-mime.md +++ b/windows/security/identity-protection/configure-s-mime.md @@ -1,15 +1,16 @@ --- title: Configure S/MIME for Windows 10 and Windows 10 Mobile (Windows 10) -description: In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. +description: S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients with a digital ID, aka a certificate, can read them. ms.assetid: 7F9C2A99-42EB-4BCC-BB53-41C04FBBBF05 +ms.reviewer: keywords: encrypt, digital signature ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md index 39d4a423a8..68410a7305 100644 --- a/windows/security/identity-protection/credential-guard/additional-mitigations.md +++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md @@ -1,29 +1,30 @@ --- title: Additional mitigations -description: Scripts listed in this topic for obtaining the available issuance policies on the certificate authority for Windows Defender Credential Guard on Windows 10. +description: Advice and sample code for making your domain environment more secure and robust with Windows Defender Credential Guard. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.date: 08/17/2017 +ms.reviewer: --- -## Additional mitigations +# Additional mitigations Windows Defender Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Windows Defender Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, re-using previously stolen credentials prior to Windows Defender Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also must be deployed to make the domain environment more robust. -### Restricting domain users to specific domain-joined devices +## Restricting domain users to specific domain-joined devices Credential theft attacks allow the attacker to steal secrets from one device and use them from another device. If a user can sign on to multiple devices then any device could be used to steal credentials. How do you ensure that users only sign on using devices that have Windows Defender Credential Guard enabled? By deploying authentication policies that restrict them to specific domain-joined devices that have been configured with Windows Defender Credential Guard. For the domain controller to know what device a user is signing on from, Kerberos armoring must be used. -#### Kerberos armoring +### Kerberos armoring Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, its TGT is used to protect the user's proof of possession which can mitigate offline dictionary attacks. Kerberos armoring also provides the additional benefit of signed KDC errors this mitigates tampering which can result in things such as downgrade attacks. @@ -33,7 +34,7 @@ Kerberos armoring is part of RFC 6113. When a device supports Kerberos armoring, - All the domain controllers in these domains must be configured to support Kerberos armoring. Set the **KDC support for claims, compound authentication, and Kerberos armoring** Group Policy setting to either **Supported** or **Always provide claims**. - All the devices with Windows Defender Credential Guard that the users will be restricted to must be configured to support Kerberos armoring. Enable the **Kerberos client support for claims, compound authentication and Kerberos armoring** Group Policy settings under **Computer Configuration** -> **Administrative Templates** -> **System** -> **Kerberos**. -#### Protecting domain-joined device secrets +### Protecting domain-joined device secrets Since domain-joined devices also use shared secrets for authentication, attackers can steal those secrets as well. By deploying device certificates with Windows Defender Credential Guard, the private key can be protected. Then authentication policies can require that users sign on devices that authenticate using those certificates. This prevents shared secrets stolen from the device to be used with stolen user credentials to sign on as the user. @@ -45,7 +46,7 @@ Domain-joined device certificate authentication has the following requirements: - Windows 10 devices have the CA issuing the domain controller certificates in the enterprise store. - A process is established to ensure the identity and trustworthiness of the device in a similar manner as you would establish the identity and trustworthiness of a user before issuing them a smartcard. -##### Deploying domain-joined device certificates +#### Deploying domain-joined device certificates To guarantee that certificates with the required issuance policy are only installed on the devices these users must use, they must be deployed manually on each device. The same security procedures used for issuing smart cards to users should be applied to device certificates. @@ -70,14 +71,14 @@ Then on the devices that are running Windows Defender Credential Guard, enroll t **Enrolling devices in a certificate** Run the following command: -``` syntax +```powershell CertReq -EnrollCredGuardCert MachineAuthentication ``` -> [!NOTE] +> [!NOTE] > You must restart the device after enrolling the machine authentication certificate.   -##### How a certificate issuance policy can be used for access control +#### How a certificate issuance policy can be used for access control Beginning with the Windows Server 2008 R2 domain functional level, domain controllers support for authentication mechanism assurance provides a way to map certificate issuance policy OIDs to universal security groups. Windows Server 2012 domain controllers with claim support can map them to claims. To learn more about authentication mechanism assurance, see [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](https://technet.microsoft.com/library/dd378897(v=ws.10).aspx) on TechNet. @@ -86,7 +87,7 @@ Beginning with the Windows Server 2008 R2 domain functional level, domain contro - The [get-IssuancePolicy.ps1](#bkmk-getscript) shows all of the issuance policies that are available on the certificate authority. From a Windows PowerShell command prompt, run the following command: - ``` syntax + ```powershell .\get-IssuancePolicy.ps1 –LinkedToGroup:All ``` @@ -95,11 +96,11 @@ Beginning with the Windows Server 2008 R2 domain functional level, domain contro - The [set-IssuancePolicyToGroupLink.ps1](#bkmk-setscript) creates a Universal security group, creates an organizational unit, and links the issuance policy to that Universal security group. From a Windows PowerShell command prompt, run the following command: - ``` syntax + ```powershell .\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:"" –groupOU:"" –groupName:”" ``` -#### Restricting user sign on +### Restricting user sign on So we now have completed the following: @@ -125,24 +126,24 @@ Authentication policies have the following requirements: 11. Click **OK** to create the authentication policy. 12. Close Active Directory Administrative Center. -> [!NOTE] +> [!NOTE] > When the authentication policy enforces policy restrictions, users will not be able to sign on using devices that do not have a certificate with the appropriate issuance policy deployed. This applies to both local and remote sign on scenarios. Therefore, it is strongly recommended to first only audit policy restrictions to ensure you don't have unexpected failures. -##### Discovering authentication failures due to authentication policies +#### Discovering authentication failures due to authentication policies To make tracking authentication failures due to authentication policies easier, an operational log exists with just those events. To enable the logs on the domain controllers, in Event Viewer, navigate to **Applications and Services Logs\\Microsoft\\Windows\\Authentication, right-click AuthenticationPolicyFailures-DomainController**, and then click **Enable Log**. To learn more about authentication policy events, see [Authentication Policies and Authentication Policy Silos](https://technet.microsoft.com/library/dn486813(v=ws.11).aspx). -### Appendix: Scripts +## Appendix: Scripts Here is a list of scripts mentioned in this topic. -#### Get the available issuance policies on the certificate authority +### Get the available issuance policies on the certificate authority Save this script file as get-IssuancePolicy.ps1. -``` syntax +```powershell ####################################### ## Parameters to be defined ## ## by the user ## @@ -326,14 +327,14 @@ write-host "There are no issuance policies which are not mapped to groups" } } ``` -> [!NOTE] +> [!NOTE] > If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter.   -#### Link an issuance policy to a group +### Link an issuance policy to a group Save the script file as set-IssuancePolicyToGroupLink.ps1. -``` syntax +```powershell ####################################### ## Parameters to be defined ## ## by the user ## @@ -608,11 +609,5 @@ write-host $tmp -Foreground Red } ``` -> [!NOTE] +> [!NOTE] > If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. - -## See also - -**Deep Dive into Windows Defender Credential Guard: Related videos** - -[Protecting privileged users with Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=JNbjYMJyC_8104300474) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index b3c0ba0502..6d52746433 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -1,5 +1,5 @@ ---- -title: Considerations when using Windows Defender Credential Guard (Windows 10) +--- +title: Advice while using Windows Defender Credential Guard (Windows 10) description: Considerations and recommendations for certain scenarios when using Windows Defender Credential Guard in Windows 10. ms.prod: w10 ms.mktglfcycl: explore @@ -7,12 +7,13 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.date: 08/31/2017 +ms.reviewer: --- # Considerations when using Windows Defender Credential Guard @@ -21,9 +22,6 @@ ms.date: 08/31/2017 - Windows 10 - Windows Server 2016 -Prefer video? See [Credentials Protected by Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=mD3geLJyC_8304300474) -in the **Deep Dive into Windows Defender Credential Guard** video series. - Passwords are still weak. We recommend that in addition to deploying Windows Defender Credential Guard, organizations move away from passwords to other authentication methods, such as physical smart cards, virtual smart cards, or Windows Hello for Business. Windows Defender Credential Guard uses hardware security, so some features such as Windows To Go, are not supported. @@ -98,6 +96,6 @@ When data protected with user DPAPI is unusable, then the user loses access to a ## See also -**Deep Dive into Windows Defender Credential Guard: Related videos** +**Related videos** -[Virtualization-based security](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=1CoELLJyC_6704300474) +[What is virtualization-based security?](https://www.linkedin.com/learning/microsoft-cybersecurity-stack-advanced-identity-and-endpoint-protection/what-is-virtualization-based-security) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index 0e10a79093..4eaf65890c 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -1,18 +1,19 @@ --- title: How Windows Defender Credential Guard works -description: Using virtualization-based security, Windows Defender Credential Guard features a new component called the isolated LSA process, which stores and protects secrets, isolating them from the rest of the operating system, so that only privileged system software can access them. +description: Learn how Windows Defender Credential Guard uses virtualization to protect secrets, so that only privileged system software can access them. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.date: 08/17/2017 +ms.reviewer: --- # How Windows Defender Credential Guard works @@ -22,8 +23,6 @@ ms.date: 08/17/2017 - Windows Server 2016 -Prefer video? See [Windows Defender Credential Guard Design](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=mD3geLJyC_8304300474) in the **Deep Dive into Windows Defender Credential Guard** video series. - Kerberos, NTLM, and Credential manager isolate secrets by using virtualization-based security. Previous versions of Windows stored secrets in the Local Security Authority (LSA). Prior to Windows 10, the LSA stored secrets used by the operating system in its process memory. With Windows Defender Credential Guard enabled, the LSA process in the operating system talks to a new component called the isolated LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and is not accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process. For security reasons, the isolated LSA process doesn't host any device drivers. Instead, it only hosts a small subset of operating system binaries that are needed for security and nothing else. All of these binaries are signed with a certificate that is trusted by virtualization-based security and these signatures are validated before launching the file in the protected environment. @@ -36,14 +35,8 @@ Here's a high-level overview on how the LSA is isolated by using virtualization- ![Windows Defender Credential Guard overview](images/credguard.png) -
                                  - ## See also -**Deep Dive into Windows Defender Credential Guard: Related videos** +**Related videos** -[Credential Theft and Lateral Traversal](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=cfGBPlIyC_9404300474) - -[Virtualization-based security](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=1CoELLJyC_6704300474) - -[Credentials protected by Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) \ No newline at end of file +[What is virtualization-based security?](https://www.linkedin.com/learning/microsoft-cybersecurity-stack-advanced-identity-and-endpoint-protection/what-is-virtualization-based-security) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index d999f556ba..e2c7665e97 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -7,15 +7,16 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.date: 08/17/2017 +ms.reviewer: --- -# Windows Defender Credential Guard: Known issues +# Windows Defender Credential Guard: Known issues **Applies to** - Windows 10 @@ -33,14 +34,14 @@ The following known issue has been fixed in the [Cumulative Security Update for The following known issues have been fixed by servicing releases made available in the Cumulative Security Updates for April 2017: -- [KB4015217 Windows Defender Credential Guard generates double bad password count on Active Directory domain-joined Windows 10 machines](https://support.microsoft.com/help/4015217/windows-10-update-kb4015217) +- [KB4015217 Windows Defender Credential Guard generates double bad password count on Active Directory domain-joined Windows 10 machines](https://support.microsoft.com/help/4015217/windows-10-update-kb4015217) This issue can potentially lead to unexpected account lockouts. See also Microsoft® Knowledge Base articles [KB4015219](https://support.microsoft.com/help/4015219/windows-10-update-kb4015219) and [KB4015221](https://support.microsoft.com/help/4015221/windows-10-update-kb4015221) -- [KB4033236 Two incorrect logon attempts sent to Active Directory after Windows Defender Credential Guard installed on Windows 10](https://support.microsoft.com/help/4033236/two-incorrect-logon-attempts-sent-to-active-directory-after-credential?preview) +- [KB4033236 Two incorrect logon attempts sent to Active Directory after Windows Defender Credential Guard installed on Windows 10](https://support.microsoft.com/help/4033236/two-incorrect-logon-attempts-sent-to-active-directory-after-credential?preview) - This issue can potentially lead to unexpected account lockouts. The issue was fixed in servicing updates for each of the following operating systems: + This issue can potentially lead to unexpected account lockouts. The issue was fixed in servicing updates for each of the following operating systems: - Windows 10 Version 1607 and Windows Server 2016: [KB4015217 (OS Build 14393.1066 and 14393.1083)](https://support.microsoft.com/help/4015217) @@ -51,30 +52,30 @@ The following known issues have been fixed by servicing releases made available The following issue affects the Java GSS API. See the following Oracle bug database article: -- [JDK-8161921: Windows 10 Windows Defender Credential Guard does not allow sharing of TGT with Java](http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8161921) +- [JDK-8161921: Windows 10 Windows Defender Credential Guard does not allow sharing of TGT with Java](http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8161921) When Windows Defender Credential Guard is enabled on Windows 10, the Java GSS API will not authenticate. This is expected behavior because Windows Defender Credential Guard blocks specific application authentication capabilities and will not provide the TGT session key to applications regardless of registry key settings. For further information see [Application requirements](https://docs.microsoft.com/windows/access-protection/credential-guard/credential-guard-requirements#application-requirements). The following issue affects Cisco AnyConnect Secure Mobility Client: -- [Blue screen on Windows 10 computers running Windows Defender Device Guard and Windows Defender Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692) \* +- [Blue screen on Windows 10 computers running Windows Defender Device Guard and Windows Defender Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692) \* *Registration required to access this article. The following issue affects McAfee Application and Change Control (MACC): -- [KB88869 Windows 10 machines exhibit high CPU usage with McAfee Application and Change Control (MACC) installed when Windows Defender Credential Guard is enabled](https://kc.mcafee.com/corporate/index?page=content&id=KB88869) [1] +- [KB88869 Windows 10 machines exhibit high CPU usage with McAfee Application and Change Control (MACC) installed when Windows Defender Credential Guard is enabled](https://kc.mcafee.com/corporate/index?page=content&id=KB88869) [1] The following issue affects AppSense Environment Manager. For further information, see the following Knowledge Base article: -- [Installing AppSense Environment Manager on Windows 10 machines causes LSAISO.exe to exhibit high CPU usage when Windows Defender Credential Guard is enabled](http://www.appsense.com/kb/160525073917945) [1] \** +- [Installing AppSense Environment Manager on Windows 10 machines causes LSAISO.exe to exhibit high CPU usage when Windows Defender Credential Guard is enabled](http://www.appsense.com/kb/160525073917945) [1] \** The following issue affects Citrix applications: -- Windows 10 machines exhibit high CPU usage with Citrix applications installed when Windows Defender Credential Guard is enabled. [1] +- Windows 10 machines exhibit high CPU usage with Citrix applications installed when Windows Defender Credential Guard is enabled. [1] [1] Products that connect to Virtualization Based Security (VBS) protected processes can cause Windows Defender Credential Guard-enabled Windows 10 or Windows Server 2016 machines to exhibit high CPU usage. For technical and troubleshooting information, see the following Microsoft Knowledge Base article: -- [KB4032786 High CPU usage in the LSAISO process on Windows 10 or Windows Server 2016](https://support.microsoft.com/help/4032786) +- [KB4032786 High CPU usage in the LSAISO process on Windows 10 or Windows Server 2016](https://support.microsoft.com/help/4032786) For further technical information on LSAISO.exe, see the MSDN article: [Isolated User Mode (IUM) Processes](https://msdn.microsoft.com/library/windows/desktop/mt809132(v=vs.85).aspx) @@ -85,25 +86,25 @@ For further technical information on LSAISO.exe, see the MSDN article: [Isolated ## Vendor support See the following article on Citrix support for Secure Boot: -- [Citrix Support for Secure Boot](https://www.citrix.com/blogs/2016/12/08/windows-server-2016-hyper-v-secure-boot-support-now-available-in-xenapp-7-12/) +- [Citrix Support for Secure Boot](https://www.citrix.com/blogs/2016/12/08/windows-server-2016-hyper-v-secure-boot-support-now-available-in-xenapp-7-12/) Windows Defender Credential Guard is not supported by either these products, products versions, computer systems, or Windows 10 versions: -- For Windows Defender Credential Guard on Windows 10 with McAfee Encryption products, see: -[Support for Windows Defender Device Guard and Windows Defender Credential Guard on Windows 10 with McAfee encryption products](https://kc.mcafee.com/corporate/index?page=content&id=KB86009) +- For Windows Defender Credential Guard on Windows 10 with McAfee Encryption products, see: + [Support for Windows Defender Device Guard and Windows Defender Credential Guard on Windows 10 with McAfee encryption products](https://kc.mcafee.com/corporate/index?page=content&id=KB86009) -- For Windows Defender Credential Guard on Windows 10 with Check Point Endpoint Security Client, see: -[Check Point Endpoint Security Client support for Microsoft Windows 10 Windows Defender Credential Guard and Windows Defender Device Guard features](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113912) +- For Windows Defender Credential Guard on Windows 10 with Check Point Endpoint Security Client, see: + [Check Point Endpoint Security Client support for Microsoft Windows 10 Windows Defender Credential Guard and Windows Defender Device Guard features](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113912) -- For Windows Defender Credential Guard on Windows 10 with VMWare Workstation -[Windows 10 host fails when running VMWare Workstation when Windows Defender Credential Guard is enabled](https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2146361) +- For Windows Defender Credential Guard on Windows 10 with VMWare Workstation + [Windows 10 host fails when running VMWare Workstation when Windows Defender Credential Guard is enabled](https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2146361) -- For Windows Defender Credential Guard on Windows 10 with specific versions of the Lenovo ThinkPad -[ThinkPad support for Windows Defender Device Guard and Windows Defender Credential Guard in Microsoft Windows 10 – ThinkPad](https://support.lenovo.com/in/en/solutions/ht503039) +- For Windows Defender Credential Guard on Windows 10 with specific versions of the Lenovo ThinkPad + [ThinkPad support for Windows Defender Device Guard and Windows Defender Credential Guard in Microsoft Windows 10 – ThinkPad](https://support.lenovo.com/in/en/solutions/ht503039) -- For Windows Defender Credential Guard on Windows 10 with Symantec Endpoint Protection -[Windows 10 with Windows Defender Credential Guard and Symantec Endpoint Protection 12.1](https://www.symantec.com/connect/forums/windows-10-device-guard-credentials-guard-and-sep-121) +- For Windows Defender Credential Guard on Windows 10 with Symantec Endpoint Protection + [Windows 10 with Windows Defender Credential Guard and Symantec Endpoint Protection 12.1](https://www.symantec.com/connect/forums/windows-10-device-guard-credentials-guard-and-sep-121) - This is not a comprehensive list. Check whether your product vendor, product version, or computer system, supports Windows Defender Credential Guard on systems that run Windows 10 or specific versions of Windows 10. Specific computer system models may be incompatible with Windows Defender Credential Guard. + This is not a comprehensive list. Check whether your product vendor, product version, or computer system, supports Windows Defender Credential Guard on systems that run Windows 10 or specific versions of Windows 10. Specific computer system models may be incompatible with Windows Defender Credential Guard. - Microsoft encourages third-party vendors to contribute to this page by providing relevant product support information and by adding links to their own product support statements. \ No newline at end of file + Microsoft encourages third-party vendors to contribute to this page by providing relevant product support information and by adding links to their own product support statements. diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 0edce00395..69155363d3 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -1,18 +1,19 @@ ---- +--- title: Manage Windows Defender Credential Guard (Windows 10) -description: Deploying and managing Windows Defender Credential Guard using Group Policy, the registry, or the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool. +description: Learn how to deploy and manage Windows Defender Credential Guard using Group Policy, the registry, or hardware readiness tools. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.date: 03/01/2019 +ms.reviewer: --- # Manage Windows Defender Credential Guard @@ -20,11 +21,11 @@ ms.date: 03/01/2019 **Applies to** - Windows 10 - Windows Server 2016 +- Windows Server 2019 -Prefer video? See [Windows Defender Credential Guard Deployment](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=sRcyvLJyC_3304300474) in the Deep Dive into Windows Defender Credential Guard video series. ## Enable Windows Defender Credential Guard -Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-credential-guard-by-using-group-policy), the [registry](#enable-credential-guard-by-using-the-registry), or the Windows Defender Device Guard and Windows Defender Credential Guard [hardware readiness tool](#hardware-readiness-tool). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. +Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-windows-defender-credential-guard-by-using-group-policy), the [registry](#enable-windows-defender-credential-guard-by-using-the-registry), or the Windows Defender Device Guard and Windows Defender Credential Guard [hardware readiness tool](#hardware-readiness-tool). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine. The same set of procedures used to enable Windows Defender Credential Guard on physical machines applies also to virtual machines. @@ -43,6 +44,14 @@ You can use Group Policy to enable Windows Defender Credential Guard. This will To enforce processing of the group policy, you can run ```gpupdate /force```. +### Enable Windows Defender Credential Guard by using Intune + +1. From **Home** click **Microsoft Intune** +2. Click **Device configuration** +3. Click **Profiles** > **Create Profile** > **Endpoint protection** > **Windows Defender Credential Guard**. + +> [!NOTE] +> It will enable VBS and Secure Boot and you can do it with or without UEFI Lock. If you will need to disable Credential Guard remotely, enable it without UEFI lock. ### Enable Windows Defender Credential Guard by using the registry @@ -55,9 +64,9 @@ Starting with Windows 10, version 1607 and Windows Server 2016, enabling Windows If you are using Windows 10, version 1507 (RTM) or Windows 10, version 1511, Windows features have to be enabled to use virtualization-based security. You can do this by using either the Control Panel or the Deployment Image Servicing and Management tool (DISM). > [!NOTE] -If you enable Windows Defender Credential Guard by using Group Policy, the steps to enable Windows features through Control Panel or DISM are not required. Group Policy will install Windows features for you. +> If you enable Windows Defender Credential Guard by using Group Policy, the steps to enable Windows features through Control Panel or DISM are not required. Group Policy will install Windows features for you. -  + **Add the virtualization-based security features by using Programs and Features** 1. Open the Programs and Features control panel. @@ -77,6 +86,8 @@ If you enable Windows Defender Credential Guard by using Group Policy, the steps ``` dism /image: /Enable-Feature /FeatureName:IsolatedUserMode ``` +> [!NOTE] +> In Windows 10, version 1607 and later, the Isolated User Mode feature has been integrated into the core operating system. Running the command in step 3 above is therefore no longer required. > [!NOTE] > You can also add these features to an online image by using either DISM or Configuration Manager. @@ -97,14 +108,18 @@ If you enable Windows Defender Credential Guard by using Group Policy, the steps > [!NOTE] > You can also enable Windows Defender Credential Guard by setting the registry entries in the [FirstLogonCommands](https://msdn.microsoft.com/library/windows/hardware/dn922797.aspx) unattend setting. - + + ### Enable Windows Defender Credential Guard by using the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool -You can also enable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). +You can also enable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](dg_readiness_tool.md). ``` -DG_Readiness_Tool_v3.5.ps1 -Enable -AutoReboot +DG_Readiness_Tool.ps1 -Enable -AutoReboot ``` +> [!IMPORTANT] +> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> This is a known issue. ### Review Windows Defender Credential Guard performance @@ -123,12 +138,14 @@ You can view System Information to check that Windows Defender Credential Guard You can also check that Windows Defender Credential Guard is running by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). ``` -DG_Readiness_Tool_v3.5.ps1 -Ready +DG_Readiness_Tool_v3.6.ps1 -Ready ``` +> [!IMPORTANT] +> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSAch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> This is a known issue. > [!NOTE] - -For client machines that are running Windows 10 1703, LsaIso.exe is running whenever virtualization-based security is enabled for other features. +> For client machines that are running Windows 10 1703, LsaIso.exe is running whenever virtualization-based security is enabled for other features. - We recommend enabling Windows Defender Credential Guard before a device is joined to a domain. If Windows Defender Credential Guard is enabled after domain join, the user and device secrets may already be compromised. In other words, enabling Credential Guard will not help to secure a device or identity that has already been compromised, which is why we recommend turning on Credential Guard as early as possible. @@ -147,42 +164,46 @@ For client machines that are running Windows 10 1703, LsaIso.exe is running when To disable Windows Defender Credential Guard, you can use the following set of procedures or [the Device Guard and Credential Guard hardware readiness tool](#turn-off-with-hardware-readiness-tool). If Credential Guard was enabled with UEFI Lock then you must use the following procedure as the settings are persisted in EFI (firmware) variables and it will require physical presence at the machine to press a function key to accept the change. If Credential Guard was enabled without UEFI Lock then you can turn it off by using Group Policy. -1. If you used Group Policy, disable the Group Policy setting that you used to enable Windows Defender Credential Guard (**Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard** -> **Turn on Virtualization Based Security**). -2. Delete the following registry settings: - - HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA\LsaCfgFlags - - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\EnableVirtualizationBasedSecurity - - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\RequirePlatformSecurityFeatures +1. If you used Group Policy, disable the Group Policy setting that you used to enable Windows Defender Credential Guard (**Computer Configuration** -> **Administrative Templates** -> **System** -> **Device Guard** -> **Turn on Virtualization Based Security**). +2. Delete the following registry settings: + - HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Control\\LSA\LsaCfgFlags + - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\LsaCfgFlags +3. If you also wish to disable virtualization-based security delete the following registry settings: + - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\EnableVirtualizationBasedSecurity + - HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DeviceGuard\\RequirePlatformSecurityFeatures + > [!IMPORTANT] + > If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery. - > [!IMPORTANT] - > If you manually remove these registry settings, make sure to delete them all. If you don't remove them all, the device might go into BitLocker recovery. +4. Delete the Windows Defender Credential Guard EFI variables by using bcdedit. From an elevated command prompt, type the following commands: -3. Delete the Windows Defender Credential Guard EFI variables by using bcdedit. From an elevated command prompt, type the following commands: + ``` syntax + mountvol X: /s + copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y + bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader + bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi" + bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215} + bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO + bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X: + mountvol X: /d + ``` - ``` syntax - mountvol X: /s - copy %WINDIR%\System32\SecConfig.efi X:\EFI\Microsoft\Boot\SecConfig.efi /Y - bcdedit /create {0cb3b571-2f2e-4343-a879-d86a476d7215} /d "DebugTool" /application osloader - bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} path "\EFI\Microsoft\Boot\SecConfig.efi" - bcdedit /set {bootmgr} bootsequence {0cb3b571-2f2e-4343-a879-d86a476d7215} - bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS - bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} device partition=X: - bcdedit /set hypervisorlaunchtype off - mountvol X: /d - ``` - -2. Restart the PC. -3. Accept the prompt to disable Windows Defender Credential Guard. -4. Alternatively, you can disable the virtualization-based security features to turn off Windows Defender Credential Guard. +5. Restart the PC. +6. Accept the prompt to disable Windows Defender Credential Guard. +7. Alternatively, you can disable the virtualization-based security features to turn off Windows Defender Credential Guard. > [!NOTE] -> The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Windows Defender Credential Guard and virtualization-based security, run the following bcdedit command after turning off all virtualization-based security Group Policy and registry settings: bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS +> The PC must have one-time access to a domain controller to decrypt content, such as files that were encrypted with EFS. If you want to turn off both Windows Defender Credential Guard and virtualization-based security, run the following bcdedit commands after turning off all virtualization-based security Group Policy and registry settings: + + bcdedit /set {0cb3b571-2f2e-4343-a879-d86a476d7215} loadoptions DISABLE-LSA-ISO,DISABLE-VBS + bcdedit /set vsmlaunchtype off > [!NOTE] > Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs. These options will be made available with future Gen 2 VMs. For more info on virtualization-based security and Windows Defender Device Guard, see [Windows Defender Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide). - + + #### Disable Windows Defender Credential Guard by using the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool You can also disable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). @@ -190,6 +211,9 @@ You can also disable Windows Defender Credential Guard by using the [Windows Def ``` DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot ``` +> [!IMPORTANT] +> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work. +> This is a known issue. #### Disable Windows Defender Credential Guard for a virtual machine diff --git a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md index a83bbf8af8..0083c4e274 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md @@ -1,18 +1,19 @@ ---- -title: Windows Defender Credential Guard protection limits (Windows 10) -description: Scenarios not protected by Windows Defender Credential Guard in Windows 10. +--- +title: Windows Defender Credential Guard protection limits & mitigations (Windows 10) +description: Scenarios not protected by Windows Defender Credential Guard in Windows 10, and additional mitigations you can use. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.date: 08/17/2017 +ms.reviewer: --- # Windows Defender Credential Guard protection limits @@ -95,11 +96,11 @@ Then on the devices that are running Windows Defender Credential Guard, enroll t **Enrolling devices in a certificate** Run the following command: -``` syntax +```powershell CertReq -EnrollCredGuardCert MachineAuthentication ``` -> [!NOTE] +> [!NOTE] > You must restart the device after enrolling the machine authentication certificate.   ##### How a certificate issuance policy can be used for access control @@ -111,7 +112,7 @@ Beginning with the Windows Server 2008 R2 domain functional level, domain contro - The [get-IssuancePolicy.ps1](#bkmk-getscript) shows all of the issuance policies that are available on the certificate authority. From a Windows PowerShell command prompt, run the following command: - ``` syntax + ```powershell .\get-IssuancePolicy.ps1 –LinkedToGroup:All ``` @@ -120,7 +121,7 @@ Beginning with the Windows Server 2008 R2 domain functional level, domain contro - The [set-IssuancePolicyToGroupLink.ps1](#bkmk-setscript) creates a Universal security group, creates an organizational unit, and links the issuance policy to that Universal security group. From a Windows PowerShell command prompt, run the following command: - ``` syntax + ```powershell .\set-IssuancePolicyToGroupLink.ps1 –IssuancePolicyName:"" –groupOU:"" –groupName:”" ``` @@ -150,7 +151,7 @@ Authentication policies have the following requirements: 11. Click **OK** to create the authentication policy. 12. Close Active Directory Administrative Center. -> [!NOTE] +> [!NOTE] > When the authentication policy enforces policy restrictions, users will not be able to sign on using devices that do not have a certificate with the appropriate issuance policy deployed. This applies to both local and remote sign on scenarios. Therefore, it is strongly recommended to first only audit policy restrictions to ensure you don't have unexpected failures. ##### Discovering authentication failures due to authentication policies @@ -171,7 +172,7 @@ Here is a list of scripts mentioned in this topic. Save this script file as get-IssuancePolicy.ps1. -``` syntax +```powershell ####################################### ## Parameters to be defined ## ## by the user ## @@ -355,14 +356,14 @@ write-host "There are no issuance policies which are not mapped to groups" } } ``` -> [!NOTE] +> [!NOTE] > If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter.   #### Link an issuance policy to a group Save the script file as set-IssuancePolicyToGroupLink.ps1. -``` syntax +```powershell ####################################### ## Parameters to be defined ## ## by the user ## @@ -637,7 +638,7 @@ write-host $tmp -Foreground Red } ``` -> [!NOTE] +> [!NOTE] > If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. ## See also diff --git a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md index 0277d8dcf5..792587963f 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md @@ -1,18 +1,19 @@ ---- +--- title: Windows Defender Credential Guard protection limits (Windows 10) -description: Scenarios not protected by Windows Defender Credential Guard in Windows 10. +description: Some ways to store credentials are not protected by Windows Defender Credential Guard in Windows 10. Learn more with this guide. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.date: 08/17/2017 +ms.reviewer: --- # Windows Defender Credential Guard protection limits @@ -21,9 +22,6 @@ ms.date: 08/17/2017 - Windows 10 - Windows Server 2016 -Prefer video? See [Credentials protected by Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) -in the Deep Dive into Windows Defender Credential Guard video series. - Some ways to store credentials are not protected by Windows Defender Credential Guard, including: - Software that manages credentials outside of Windows feature protection @@ -45,4 +43,6 @@ do not qualify as credentials because they cannot be presented to another comput **Deep Dive into Windows Defender Credential Guard: Related videos** -[Protecting privileged users with Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=JNbjYMJyC_8104300474) +[Microsoft Cybersecurity Stack: Advanced Identity and Endpoint Protection: Manage Credential Guard](https://www.linkedin.com/learning/microsoft-cybersecurity-stack-advanced-identity-and-endpoint-protection/manage-credential-guard?u=3322) +> [!NOTE] +> - Note: Requires [LinkedIn Learning subscription](https://www.linkedin.com/learning/subscription/products) to view the full video diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 01d5a2d5a7..d0124ff8cf 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -1,18 +1,19 @@ --- title: Windows Defender Credential Guard Requirements (Windows 10) -description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security associated with available hardware and firmware options. +description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.date: 01/12/2018 +ms.reviewer: --- # Windows Defender Credential Guard: Requirements @@ -21,9 +22,6 @@ ms.date: 01/12/2018 - Windows 10 - Windows Server 2016 -Prefer video? See -[Windows Defender Credential Guard Deployment](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=sRcyvLJyC_3304300474) -in the Deep Dive into Windows Defender Credential Guard video series. For Windows Defender Credential Guard to provide protection, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally, Windows Defender Credential Guard blocks specific authentication capabilities, so applications that require such capabilities will break. We will refer to this as [Application requirements](#application-requirements). Beyond that, computers can meet additional hardware and firmware qualifications, and receive additional protections. Those computers will be more hardened against certain threats. For detailed information on baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017, refer to the tables in [Security Considerations](#security-considerations). @@ -80,9 +78,6 @@ Applications may cause performance issues when they attempt to hook the isolated Services or protocols that rely on Kerberos, such as file shares, remote desktop, or BranchCache, continue to work and are not affected by Windows Defender Credential Guard. -See this video: [Credentials Protected by Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) - - ## Security considerations All computers that meet baseline protections for hardware, firmware, and software can use Windows Defender Credential Guard. @@ -110,11 +105,11 @@ The following tables describe baseline protections, plus protections for improve ### 2015 Additional security qualifications starting with Windows 10, version 1507, and Windows Server 2016 Technical Preview 4 -| Protections for Improved Security | Description | -|---------------------------------------------|----------------------------------------------------| -| Hardware: **IOMMU** (input/output memory management unit) | **Requirement**: VT-D or AMD Vi IOMMU **Security benefits**: An IOMMU can enhance system resiliency against memory attacks. For more information, see [ACPI description tables](https://msdn.microsoft.com/windows/hardware/drivers/bringup/acpi-system-description-tables). | -| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
                                  • BIOS password or stronger authentication must be supported.
                                  • In the BIOS configuration, BIOS authentication must be set.
                                  • There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
                                  • In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings. | **Security benefits**:
                                  • BIOS password or stronger authentication helps ensure that only authenticated Platform BIOS administrators can change BIOS settings. This helps protect against a physically present user with BIOS access.
                                  • Boot order when locked provides protection against the computer being booted into WinRE or another operating system on bootable media. | -| Firmware: **Secure MOR, revision 2 implementation** | **Requirement**: Secure MOR, revision 2 implementation | **Security benefits**: A secure MOR bit prevents advanced memory attacks. For more information, see [Secure MOR implementation](https://msdn.microsoft.com/windows/hardware/drivers/bringup/device-guard-requirements). | +| Protections for Improved Security | Description | +|-----------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Hardware: **IOMMU** (input/output memory management unit) | **Requirement**: VT-D or AMD Vi IOMMU **Security benefits**: An IOMMU can enhance system resiliency against memory attacks. For more information, see [ACPI description tables](https://msdn.microsoft.com/windows/hardware/drivers/bringup/acpi-system-description-tables). | +| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
                                  • BIOS password or stronger authentication must be supported.
                                  • In the BIOS configuration, BIOS authentication must be set.
                                  • There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
                                  • In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings. | +| Firmware: **Secure MOR, revision 2 implementation** | **Requirement**: Secure MOR, revision 2 implementation |
                                  diff --git a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md index f6c5fda88e..b62a1d9818 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md @@ -1,18 +1,19 @@ --- title: Scripts for Certificate Issuance Policies in Windows Defender Credential Guard (Windows 10) -description: Scripts listed in this topic for obtaining the available issuance policies on the certificate authority for Windows Defender Credential Guard on Windows 10. +description: Obtain issuance policies from the certificate authority for Windows Defender Credential Guard on Windows 10. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.date: 08/17/2017 +ms.reviewer: --- # Windows Defender Credential Guard: Scripts for Certificate Authority Issuance Policies @@ -24,7 +25,7 @@ Here is a list of scripts mentioned in this topic. Save this script file as get-IssuancePolicy.ps1. -``` syntax +```powershell ####################################### ## Parameters to be defined ## ## by the user ## @@ -208,14 +209,14 @@ write-host "There are no issuance policies which are not mapped to groups" } } ``` -> [!NOTE] +> [!NOTE] > If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter.   ## Link an issuance policy to a group Save the script file as set-IssuancePolicyToGroupLink.ps1. -``` syntax +```powershell ####################################### ## Parameters to be defined ## ## by the user ## @@ -490,5 +491,5 @@ write-host $tmp -Foreground Red } ``` -> [!NOTE] -> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. \ No newline at end of file +> [!NOTE] +> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md index 54db450ede..38bbbfc5cd 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard.md +++ b/windows/security/identity-protection/credential-guard/credential-guard.md @@ -1,15 +1,16 @@ --- title: Protect derived domain credentials with Windows Defender Credential Guard (Windows 10) -description: Introduced in Windows 10 Enterprise, Windows Defender Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. +description: Windows Defender Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. ms.assetid: 4F1FE390-A166-4A24-8530-EA3369FEB4B1 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -22,8 +23,6 @@ ms.date: 08/17/2017 - Windows 10 - Windows Server 2016 -Prefer video? See [Credential Theft and Lateral Traversal](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=cfGBPlIyC_9404300474) in the Deep Dive into Windows Defender Credential Guard video series. - Introduced in Windows 10 Enterprise and Windows Server 2016, Windows Defender Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Windows Defender Credential Guard prevents these attacks by protecting NTLM password hashes, Kerberos Ticket Granting Tickets, and credentials stored by applications as domain credentials. By enabling Windows Defender Credential Guard, the following features and solutions are provided: @@ -36,7 +35,7 @@ By enabling Windows Defender Credential Guard, the following features and soluti ## Related topics - [Isolated User Mode in Windows 10 with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-in-Windows-10-with-Dave-Probert) -- [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](http://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel) +- [Isolated User Mode Processes and Features in Windows 10 with Logan Gabriel (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Isolated-User-Mode-Processes-and-Features-in-Windows-10-with-Logan-Gabriel) - [More on Processes and Features in Windows 10 Isolated User Mode with Dave Probert (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/More-on-Processes-and-Features-in-Windows-10-Isolated-User-Mode-with-Dave-Probert) - [Mitigating Credential Theft using the Windows 10 Isolated User Mode (Channel 9)](https://channel9.msdn.com/Blogs/Seth-Juarez/Mitigating-Credential-Theft-using-the-Windows-10-Isolated-User-Mode) - [Protecting network passwords with Windows Defender Credential Guard](https://www.microsoft.com/itshowcase/Article/Content/831/Protecting-network-passwords-with-Windows-10-Credential-Guard) @@ -44,10 +43,3 @@ By enabling Windows Defender Credential Guard, the following features and soluti - [What's New in Kerberos Authentication for Windows Server 2012](https://technet.microsoft.com/library/hh831747.aspx) - [Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide](https://technet.microsoft.com/library/dd378897.aspx) - [Trusted Platform Module](/windows/device-security/tpm/trusted-platform-module-overview) -  - -## See also - -**Deep Dive into Windows Defender Credential Guard: Related videos** - -[Credentials protected by Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=pdc37LJyC_1204300474) \ No newline at end of file diff --git a/windows/security/identity-protection/credential-guard/dg_readiness_tool.md b/windows/security/identity-protection/credential-guard/dg_readiness_tool.md new file mode 100644 index 0000000000..0022d48998 --- /dev/null +++ b/windows/security/identity-protection/credential-guard/dg_readiness_tool.md @@ -0,0 +1,1380 @@ +--- +title: Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool +description: Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool script +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +author: SteveSyfuhs +ms.author: stsyfuhs +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +ms.date: 09/18/2019 +ms.reviewer: +--- +# Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool + +```powershell +# Script to find out if machine is Device Guard compliant +# requires driver verifier on system. +param([switch]$Capable, [switch]$Ready, [switch]$Enable, [switch]$Disable, $SIPolicyPath, [switch]$AutoReboot, [switch]$DG, [switch]$CG, [switch]$HVCI, [switch]$HLK, [switch]$Clear, [switch]$ResetVerifier) + +$path = "C:\DGLogs\" +$LogFile = $path + "DeviceGuardCheckLog.txt" + +$CompatibleModules = New-Object System.Text.StringBuilder +$FailingModules = New-Object System.Text.StringBuilder +$FailingExecuteWriteCheck = New-Object System.Text.StringBuilder + +$DGVerifyCrit = New-Object System.Text.StringBuilder +$DGVerifyWarn = New-Object System.Text.StringBuilder +$DGVerifySuccess = New-Object System.Text.StringBuilder + + +$Sys32Path = "$env:windir\system32" +$DriverPath = "$env:windir\system32\drivers" + +#generated by certutil -encode +$SIPolicy_Encoded = "BQAAAA43RKLJRAZMtVH2AW5WMHbk9wcuTBkgTbfJb0SmxaI0BACNkAgAAAAAAAAA +HQAAAAIAAAAAAAAAAAAKAEAAAAAMAAAAAQorBgEEAYI3CgMGDAAAAAEKKwYBBAGC +NwoDBQwAAAABCisGAQQBgjc9BAEMAAAAAQorBgEEAYI3PQUBDAAAAAEKKwYBBAGC +NwoDFQwAAAABCisGAQQBgjdMAwEMAAAAAQorBgEEAYI3TAUBDAAAAAEKKwYBBAGC +N0wLAQEAAAAGAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AQAAAAYAAAABAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA +BgAAAAEAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAGAAAA +AQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAUAAAABAAAA +AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAABAAAAAEAAAABAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAGAAAAAQAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAYAAAABAAAAAgAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAABAAAABgAAAAEAAAADAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAEAAAAGAAAAAQAAAAEAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAQAAAAUAAAABAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAABAAAADgAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAEAAAAOAAAAAQAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AQAAAA4AAAABAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA +DgAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAOAAAA +AQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAA4AAAABAAAA +AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAADgAAAAEAAAADAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAOAAAAAQAAAAEAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAQAAAABAAAAAQAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAPye3j3MoJGGstO/m3OKIFDLGlVN +otyttV8/cu4XchN4AQAAAAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AQAAAAYAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAA +DgAAAAEAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAHAAAA +AQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAoAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAKAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAABAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAQAAAAYAAAABAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAABAAAABwAAAAEAAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAABAAAAFAAAAIMAAAAAAAAADIAAAAsAAAAAAAAAAAAAAAEAAAAAAAAA +AgAAAAAAAAADAAAAAAAAAAQAAAAAAAAABQAAAAAAAAALAAAAAAAAAAwAAAAAAAAA +DQAAAAAAAAAOAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAMAAAAAAAAAAyAAAASAAAABgAAAAAAAAAHAAAAAAAAAAgAAAAAAAAA +CQAAAAAAAAAKAAAAAAAAABMAAAAAAAAADwAAAAAAAAAQAAAAAAAAABEAAAAAAAAA +EgAAAAAAAAAUAAAAAAAAABUAAAAAAAAAGgAAAAAAAAAbAAAAAAAAABwAAAAAAAAA +FgAAAAAAAAAXAAAAAAAAABkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAgAAABQAAABQAG8AbABpAGMAeQBJAG4AZgBvAAAAAAAWAAAA +SQBuAGYAbwByAG0AYQB0AGkAbwBuAAAAAAAAAAQAAABJAGQAAAAAAAMAAAAMAAAA +MAAzADEAMAAxADcAAAAAABQAAABQAG8AbABpAGMAeQBJAG4AZgBvAAAAAAAWAAAA +SQBuAGYAbwByAG0AYQB0AGkAbwBuAAAAAAAAAAgAAABOAGEAbQBlAAAAAAADAAAA +JgAAAEQAZQBmAGEAdQBsAHQAVwBpAG4AZABvAHcAcwBBAHUAZABpAHQAAAAAAAAA +AwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA +AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAA +BQAAAAYAAAA=" + +$HSTITest_Encoded = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADxXZfstTz5v7U8+b+1PPm/2GH4vrc8+b+8RGq/ojz5v9hh+r63PPm/2GH9vr48+b+1PPi/qjz5v9hh+b60PPm/2GHwvrc8+b/YYfu+tDz5v1JpY2i1PPm/AAAAAAAAAABQRQAAZIYFAGt3EVgAAAAAAAAAAPAAIiALAg4AABIAAAAaAAAAAAAAkBsAAAAQAAAAAACAAQAAAAAQAAAAAgAACgAAAAoAAAAKAAAAAAAAAABwAAAABAAAxcwAAAMAYEEAAAQAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAEDkAAGQAAAB0OQAABAEAAAAAAAAAAAAAAFAAACABAAAAAAAAAAAAAABgAAAYAAAAwDUAADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMAAA0AAAAAAAAAAAAAAA4DAAAEgBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAMURAAAAEAAAABIAAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAB4DwAAADAAAAAQAAAAFgAAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAAwAUAAABAAAAAAgAAACYAAAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAACABAAAAUAAAAAIAAAAoAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAYAAAAAGAAAAACAAAAKgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIiVwkCFVWV0FWQVdIi+xIg+wwM/9IjUU4TIv5iX1ISI1NSIl9QEUzyYl9OEyNRUBIiUQkIDPS6AwJAACL2D1XAAeAD4WrAAAAi0VASGnYDCIAAP8V/yAAAI13CEyLw0iLyIvW/xX2IAAATIvwSIXAdQe7DgAHgOtxi104/xXWIAAARIvDi9ZIi8j/FdAgAABIi/BIhcB1B7sOAAeA6x5IjUU4TIvOTI1FQEiJRCQgSYvWSI1NSOiNCAAAi9j/FZUgAABNi8Yz0kiLyP8VlyAAAEiF9nQU/xV8IAAATIvGM9JIi8j/FX4gAAA5fUhAD5THQYk/i8NIi1wkYEiDxDBBX0FeX15dw8zMzMzMzMzMzOkzCAAAzMzMzMzMzEiJXCQYSIl0JCBXSIHscAEAAEiLBbsuAABIM8RIiYQkYAEAAA8QBRkhAACL8kiL+TPSSI1MJGBBuPQAAADzD39EJFDo6g4AAEiDZCQwAEiNTCRQg2QkQABFM8nHRCQogAAAALoAAABAx0QkIAMAAABFjUEB/xWSHwAASIvYSIP4/3RGQbkCAAAARTPAM9JIi8j/FX0fAACD+P90HkiDZCQgAEyNTCRARIvGSIvXSIvL/xVmHwAAhcB1Bv8VPB8AAEiLy/8VYx8AAEiLjCRgAQAASDPM6AsLAABMjZwkcAEAAEmLWyBJi3MoSYvjX8PMzMzMzMxIg+woM9JMi8lIhcl0Hrr///9/M8BEi8I4AXQJSP/BSYPoAXXzTYXAdSEz0rhXAAeAM8mFwEgPScp4C41RAUmLyejG/v//SIPEKMNJK9Dr4czMzMzMzMzMSIlcJAhIiXQkEFdIg+wgQYvZSYv4SIvy6Iv///+L00iLz+iN/v//SIvOSItcJDBIi3QkOEiDxCBf6Wr////MzMzMzMyJVCQQSIPsKAkRSI0Nsx8AAOhO////ugQAAABIjUwkOOhL/v//SI0NqB8AAOgz////SIPEKMPMzMzMzMxAVVNWV0FUQVVBVkFXSI1sJOFIgeyYAAAASIsF6CwAAEgzxEiJRQ9FM/ZIiVXnM9JIiU3vRIl1p0GL3kiJXbdJi8BIiUXXTYvpRIl1r0GL/kSJdfdFi+ZIiVX7RYv+SIlVA0yJdc9IhckPhBEFAABIhcAPhAgFAABNhckPhP8EAABBgzkBdBHHRaeAAAAAvwJAAIDp7QQAAEiNDQkfAADohP7//0WLfQREiX2/SWnfDCIAAP8Vtx0AAEyLw7oIAAAASIvI/xWuHQAATIvgSIXAdShIjQ3vHgAA6Er+////FUwdAAAPt/iBzwAAB4CFwA9O+EmL3umLBAAASI0N9x4AAOgi/v//RIl1s0WF/w+EiwIAAEmNXQhIiV3HSY20JAwCAABIjQ32HgAA6Pn9//+LQwiJhvT9//+FwHktPbsAAMB1EUiNDe4eAADo2f3//+kaAgAASI0N/R4AAOjI/f//g02nQOkFAgAAixtJA92DOwN0Gw+6bacIugEAAABIjY78/f//6Dv+///p4AEAAEyNhgD+//+6BAAAAEmLwEiNSwgPEAFIjYmAAAAADxEASI2AgAAAAA8QSZAPEUiQDxBBoA8RQKAPEEmwDxFIsA8QQcAPEUDADxBJ0A8RSNAPEEHgDxFA4A8QSfAPEUjwSIPqAXWuQbkAAgAASI0VgB4AAEiNDYEeAADodP3//4uLCAIAALoAEAAAQYv+TI0ES0iBwQwCAABMA8FIi85MK8ZIjYL+7/9/SIXAdBdBD7cECGaFwHQNZokBSIPBAkiD6gF13UiF0nUJSIPpAr96AAeAZkSJMUiNFSYeAABIjQ0nHgAAQbkAIAAATIvG6AH9//9MjXMEQYsOjUH/g/gDD4fDAAAA/0SN90iNFQMeAACJjvj9//9BuQQAAABIjQ34HQAATYvG6Mj8//9BiwaDfIX3AXZESI2O/P3//7oEAAAA6PH8//9Biw6D6QF0JYPpAXQag+kBdA+D+QEPhaIAAACDTacI63eDTacE63GDTacC62uDTacB62WD+AF1YIuDCAIAAEyNRa9BuQQAAACJRa9IjRWTHQAASI0NrB0AAOhP/P//RTP2RDl1r3UOD7ptpwlBjVYI6TX+//9IjYMMAgAASIlFz+sZD7ptpwlIjY78/f//ugIAAADoWfz//0Uz9otFs0iBxgwiAABIg0XHDP/AiUWzQTvHcxdIi13H6ZP9//+/BUAAgEiLXbfp5wEAAEQ5dad0DkiNDU0dAADoePv//+vji12v/xW1GgAARIvDuggAAABIi8j/FawaAABIiUW3SIvYSIXAdRZIjQ1JHQAA6ET7//+/FwAA0OmXAQAASI0NYx0AAOgu+///i0WvRI2wBgEAAEaNNHBEiXWzRYX/D4TFAAAASY1cJAhJjXUISI0N+xsAAOj++v//gXv4uwAAwHUOSI0N/hsAAOjp+v//63xEOXYEcxS6EAAAAA+6bacJSIvL6Gv7///rYosOSQPNi4EIAgAAO0WvdAe6CAAAAOvaRTPATI0MQUyNFAhEOUWvdjpMi3W3Qw+2jBAMAgAA99FDhIwIDAIAAHQID7ptpwmDCyBDioQIDAIAAEMIBDBB/8BEO0Wvcs5Ei3WzSIPGDEiBwwwiAABJg+8BD4VM////RIt9v0iLXbdFM/ZEOXWndBFIjQ0OHAAA6Dn6///pkQAAAEGL9kQ5da8PhoQAAABMi3W3TIttz0iNDYgcAADoE/r//4vGTI1Fq0G5AQAAAEiNFZgcAABCigwwSo0cKCILiE2rSI0NlBwAAOg/+v//QbkBAAAASI0VkhwAAEyLw0iNDZgcAADoI/r//4oDOEWrdBBIjQ2dHAAA6Lj5//+DTacg/8Y7da9yjuly+///v1cAB4BIjQ2sHAAA6Jf5//9BuQQAAABMjUWnSI0VphwAAEiNDa8cAADo0vn//02F5HRdTIt150iLdddNhfZ0NEQ5PnIvSI0NnBwAAOhX+f//QYvHSYvUTGnADCIAAEmLzuh0BwAASI0NmxwAAOg2+f//6wW/VwAHgESJPv8VbhgAAE2LxDPSSIvI/xVwGAAASIXbdBT/FVUYAABMi8Mz0kiLyP8VVxgAAEiLRe9IhcB0BYtNp4kIi8dIi00PSDPM6NMDAABIgcSYAAAAQV9BXkFdQVxfXltdw8zMzMzMzMxIi8RIiVgISIloEEiJcBhXQVZBV0iD7DCDYNgATYvxSYv4TI1I2EiL8kyL+UUzwDPSuaYAAAD/FWwYAACL2D0EAADAdAkPuusc6dkAAACDfCQgFHMKuwVAAIDpyAAAAItcJCD/FacXAABEi8O6CAAAAEiLyP8VnhcAAEiL6EiFwHUKuw4AB4DpmwAAAESLRCQgRTPJSIvQuaYAAAD/FQYYAACL2IXAeQYPuusc6zdIjQ2TGwAA6A74//+LVCQgSIvN6A73//9IjQ2LGwAA6Pb3//9Mi81Mi8dIi9ZJi8/ovfj//4vYSIt8JHCLdCQgSIX/dBk5N3IVTYX2dBBEi8ZIi9VJi87o8AUAAOsFu1cAB4CJN/8V9xYAAEyLxTPSSIvI/xX5FgAASItsJFiLw0iLXCRQSIt0JGBIg8QwQV9BXl/DzMzMzMzMSIlcJAhXSIPsIIP6AXU8SI0VmhcAAEiNDYsXAADoaAMAAIXAdAczwOmjAAAASI0VbBcAAEiNDV0XAADoVgMAAP8FKiUAAOmAAAAAhdJ1fDkVUyUAAHRtSIsNGiUAAOgxAgAASIsNFiUAAEiL+OgiAgAASI1Y+OsXSIsL6BQCAABIhcB0Bv8VBRcAAEiD6whIO99z5IM9DSUAAAR2FP8VJRYAAEyLxzPSSIvI/xUnFgAA6O4BAABIiQXDJAAASIkFtCQAAIMlpSQAAAC4AQAAAEiLXCQwSIPEIF/DzMzMzMzMzMzMzMzMzMzMzMzMzMzMSIlcJAhIiXQkEFdIg+wgSYv4i9pIi/GD+gF1BeijAQAATIvHi9NIi85Ii1wkMEiLdCQ4SIPEIF/pBwAAAMzMzMzMzMxMiUQkGIlUJBBIiUwkCFNWV0iB7JAAAACL+kiL8cdEJCABAAAAhdJ1EzkVDSQAAHULM9uJXCQg6d8AAACNQv+D+AF3MkyLhCTAAAAA6Hv+//+L2IlEJCDrFTPbiVwkIIu8JLgAAABIi7QksAAAAIXbD4SlAAAATIuEJMAAAACL10iLzujoAQAAi9iJRCQg6xUz24lcJCCLvCS4AAAASIu0JLAAAACD/wF1SIXbdURFM8Az0kiLzui1AQAA6xOLvCS4AAAASIu0JLAAAACLXCQgRTPAM9JIi87o7/3//+sTi7wkuAAAAEiLtCSwAAAAi1wkIIX/dAWD/wN1IEyLhCTAAAAAi9dIi87ov/3//4vYiUQkIOsGM9uJXCQgi8NIgcSQAAAAX15bw8zMzMzMzMzMzMxmZg8fhAAAAAAASDsN6SIAAHUQSMHBEGb3wf//dQHDSMHJEOmSAQAAzMzMzMzMSP8ltRQAAMzMzMzMzMzMzDPJSP8lmxQAAMzMzMzMzMxIiVwkIFVIi+xIg+wgSINlGABIuzKi3y2ZKwAASIsFiSIAAEg7ww+FjwAAAEiNTRj/FU4UAABIi0UYSIlFEP8VABQAAIvASDFFEP8V/BMAAIvASDFFEP8VIBQAAIvASMHgGEgxRRD/FRAUAACLwEiNTRBIM0UQSDPBSI1NIEiJRRD/FeUTAACLRSBIuf///////wAASMHgIEgzRSBIM0UQSCPBSLkzot8tmSsAAEg7w0gPRMFIiQXxIQAASItcJEhI99BIiQXqIQAASIPEIF3DzMzMzMzM/yXYEgAAzMzMzMzM/yXEEgAAzMzMzMzMzMxIg+wog/oBdQb/FTUTAAC4AQAAAEiDxCjDzMzMzMzMzMzMzMzMzMzMzMzMzMIAAMzMzMzMzMzMzEBTSIPsIEiL2TPJ/xWTEgAASIvL/xWCEgAA/xUUEwAASIvIugkEAMBIg8QgW0j/JfgSAADMzMzMzMzMzMzMzMzMzMzMSIlMJAhIgeyIAAAASI0NHSIAAP8VLxMAAEiLBQgjAABIiUQkSEUzwEiNVCRQSItMJEj/FSATAABIiUQkQEiDfCRAAHRCSMdEJDgAAAAASI1EJFhIiUQkMEiNRCRgSIlEJChIjQXHIQAASIlEJCBMi0wkQEyLRCRISItUJFAzyf8VyxIAAOsjSIsFOiIAAEiLAEiJBZAiAABIiwUpIgAASIPACEiJBR4iAABIiwV3IgAASIkF6CAAAEiLhCSQAAAASIkF6SEAAMcFvyAAAAkEAMDHBbkgAAABAAAAxwXDIAAAAwAAALgIAAAASGvAAEiNDbsgAABIxwQBAgAAALgIAAAASGvAAUiNDaMgAABIixUsIAAASIkUAbgIAAAASGvAAkiNDYggAABIixUZIAAASIkUAbgIAAAASGvAAEiLDf0fAABIiUwEaLgIAAAASGvAAUiLDfAfAABIiUwEaEiNDdwPAADoU/7//0iBxIgAAADDzMzMzMzMzMzMzMzMzMzMzMzMzMzM/yWUEAAAzMzMzMzM/yWQEAAAzMzMzMzM/yWMEAAAzMzMzMzMzMxIg+woTYtBOEiLykmL0egRAAAAuAEAAABIg8Qow8zMzMzMzMxAU0WLGEiL2kGD4/hMi8lB9gAETIvRdBNBi0AITWNQBPfYTAPRSGPITCPRSWPDSosUEEiLQxCLSAhIA0sI9kEDD3QMD7ZBA4Pg8EiYTAPITDPKSYvJW+kl/P//zMzMzMzMzMzMzMxmZg8fhAAAAAAA/+DMzMzMzMxAVUiD7CBIi+pIiU04SIsBixCJVSRIiU1AM8BIg8QgXcPMQFVIg+wgSIvqSIlNSEiLAYsQiVUoSIlNUDPASIPEIF3DzEBVSIPsIEiL6kiJTVhIiwGLEIlVLEiJTWAzwEiDxCBdw8xAVUiD7CBIi+pIiU1oSIsBixCJVTBIiU1wM8BIg8QgXcPMQFVIg+wgSIvqSIlNeEiLAYsQiVU0SImNgAAAADPASIPEIF3DzEBVSIPsIEiL6kiDxCBdw8wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFBAAIABAAAA8EAAgAEAAADQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAgAEAAAAAAAAAAAAAAAAAAAAAAAAAKDIAgAEAAAAwMgCAAQAAAFgyAIABAAAABQAAAAAAAAAANQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeD4AAAAAAABkPwAAAAAAAG4/AAAAAAAAAAAAAAAAAADOOwAAAAAAAMA7AAAAAAAAAAAAAAAAAAAQPQAAAAAAACw9AAAAAAAA6j4AAAAAAAAAAAAAAAAAAPo+AAAAAAAA2D4AAAAAAADMPgAAAAAAAAAAAAAAAAAACD8AAAAAAAAAAAAAAAAAAFI8AAAAAAAAFj8AAAAAAABGPAAAAAAAAAAAAAAAAAAA9DwAAAAAAAAAAAAAAAAAAJ48AAAAAAAAtDwAAAAAAABePQAAAAAAAEo9AAAAAAAAAAAAAAAAAACEPAAAAAAAAAAAAAAAAAAA5DwAAAAAAADKPAAAAAAAAAAAAAAAAAAAZDwAAAAAAAB0PAAAAAAAAAAAAAAAAAAAsD4AAAAAAAD6OwAAAAAAACg8AAAAAAAADjwAAAAAAAAAAAAAAAAAAHAeAIABAAAAACEAgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQAAAgEQAAkBsAAHAeAADAHgAAAAAAAC5caHN0aXRyYWNlLmxvZwAgUHJvdmlkZXJFcnJvcjoAOlByb3ZpZGVyRXJyb3IgAERldGVybWluaW5nIENvdW50LiAAAAAAAAAAAAAAAAAAICEhISBFcnJvciBidWZmZXIgZmFpbGVkIGFsbG9jYXRpb24gISEhIAAAAAAAAAAARGV0ZXJtaW5lIFNlY3VyaXR5RmVhdHVyZXNTaXplLiAAAAAAAAAAAExvb3AuLi4gAAAAAAAAAAAAAAAAAAAAACBVbnN1cHBvcnRlZCBBSVAgaWdub3JlZCAAAAAAAAAAICEhISBVRUZJIFByb3RvY29sIEVycm9yIERldGVjdGVkICEhISAAADpJRCAAAAAAIElEOgAAAAA6RVJST1IgACBFUlJPUjoAOlJPTEUgAAAgUk9MRToAAAAAAAAAAAAAOnNlY3VyaXR5RmVhdHVyZXNTaXplIAAAAAAAAAAAAAAgc2VjdXJpdHlGZWF0dXJlc1NpemU6AAAAAAAAAAAAACAhISEgRXJyb3IgZGV0ZWN0ZWQsIGJhaWxpbmcgb3V0ICEhISAAAAAAAAAAAAAAAFZlcmlmaWVkIGJ1ZmZlciBhbGxvY2F0aW9uIGZhaWxlZC4AAAAAAAAAAAAAAAAAAExvb3Bpbmcgb24gcHJvdmlkZXJzIHRvIGFjY3VtdWxhdGUgaW1wbGVtZW50ZWQgYW5kIHZlcmlmaWVkLgAAAABDb21wYXJpbmcgcmVxdWlyZWQgYnl0ZSB0byB2ZXJpZmllZC4uLgAAOlZFUklGSUVEIAAAAAAAACBWRVJJRklFRDoAAAAAAAA6UkVRVUlSRUQgAAAAAAAAIFJFUVVJUkVEOgAAAAAAAAAAAAAAAAAAISEhIHZlcmlmaWVkIGJ5dGUgZG9lcyBub3QgbWF0Y2ggcmVxdWlyZWQgISEhAAAAQ0xFQU5VUCAAAAAAAAAAADpPVkVSQUxMAAAAAAAAAABPVkVSQUxMOgAAAAAAAAAAUHJvdmlkZXIgRXJyb3JzIGNvcHkgc3RhcnQAAAAAAABQcm92aWRlciBFcnJvcnMgY29weSBlbmQAAAAAAAAAAEJMT0IgU3RhcnQ6AAAAAAA6QkxPQiBFbmQgIAAAAAAAAAAAAGt3EVgAAAAAAgAAACUAAAD4NQAA+BsAAAAAAABrdxFYAAAAAA0AAACgAQAAIDYAACAcAABSU0RT1J4Ttoijw0G4zY0uYG3g7wEAAABIc3RpVGVzdC5wZGIAAAAAR0NUTAAQAADwEAAALnRleHQkbW4AAAAA8CAAABIAAAAudGV4dCRtbiQwMAACIQAAwwAAAC50ZXh0JHgAADAAAOAAAAAucmRhdGEkYnJjAADgMAAASAEAAC5pZGF0YSQ1AAAAACgyAAAQAAAALjAwY2ZnAAA4MgAACAAAAC5DUlQkWENBAAAAAEAyAAAIAAAALkNSVCRYQ1oAAAAASDIAAAgAAAAuQ1JUJFhJQQAAAABQMgAACAAAAC5DUlQkWElaAAAAAFgyAAAYAAAALmNmZ3VhcmQAAAAAcDIAAIgDAAAucmRhdGEAAPg1AADIAQAALnJkYXRhJHp6emRiZwAAAMA3AABQAQAALnhkYXRhAAAQOQAAZAAAAC5lZGF0YQAAdDkAAPAAAAAuaWRhdGEkMgAAAABkOgAAFAAAAC5pZGF0YSQzAAAAAHg6AABIAQAALmlkYXRhJDQAAAAAwDsAALgDAAAuaWRhdGEkNgAAAAAAQAAAEAAAAC5kYXRhAAAAEEAAALAFAAAuYnNzAAAAAABQAAAgAQAALnBkYXRhAAABEwgAEzQMABNSDPAK4AhwB2AGUBkkBwASZDMAEjQyABIBLgALcAAAbCAAAGABAAABBAEABEIAAAEPBgAPZAcADzQGAA8yC3ABCAEACEIAABknCgAZARMADfAL4AnQB8AFcARgAzACUGwgAACIAAAAARgKABhkDAAYVAsAGDQKABhSFPAS4BBwGRgFABgBEgARcBBgDzAAAEYgAAAGAAAAGBwAAC0cAAAIIQAALRwAAEocAABkHAAAKiEAAGQcAACCHAAAkRwAAEwhAACRHAAApBwAALMcAABuIQAAsxwAAM8cAADpHAAAkCEAAOkcAAD5GwAA7xwAALUhAAAAAAAAAQYCAAYyAlABCgQACjQGAAoyBnAAAAAAAQAAAAENBAANNAkADTIGUAEGAgAGMgIwAQwCAAwBEQABAAAAAQIBAAIwAAAAAAAAAAAAAAAAAAAAAAAAd24RWAAAAABMOQAAAQAAAAIAAAACAAAAODkAAEA5AABIOQAAEBAAACARAABZOQAAYzkAAAAAAQBIU1RJVEVTVC5kbGwAUXVlcnlIU1RJAFF1ZXJ5SFNUSWRldGFpbHMAmDoAAAAAAAAAAAAA2jsAAAAxAACYOwAAAAAAAAAAAAA8PAAAADIAAAA7AAAAAAAAAAAAAHI9AABoMQAAgDsAAAAAAAAAAAAAkj0AAOgxAABYOwAAAAAAAAAAAACyPQAAwDEAADA7AAAAAAAAAAAAANY9AACYMQAAaDsAAAAAAAAAAAAAAD4AANAxAAAgOwAAAAAAAAAAAAAkPgAAiDEAALA6AAAAAAAAAAAAAE4+AAAYMQAAeDoAAAAAAAAAAAAAkD4AAOAwAADQOgAAAAAAAAAAAAAiPwAAODEAAPA6AAAAAAAAAAAAAEI/AABYMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4PgAAAAAAAGQ/AAAAAAAAbj8AAAAAAAAAAAAAAAAAAM47AAAAAAAAwDsAAAAAAAAAAAAAAAAAABA9AAAAAAAALD0AAAAAAADqPgAAAAAAAAAAAAAAAAAA+j4AAAAAAADYPgAAAAAAAMw+AAAAAAAAAAAAAAAAAAAIPwAAAAAAAAAAAAAAAAAAUjwAAAAAAAAWPwAAAAAAAEY8AAAAAAAAAAAAAAAAAAD0PAAAAAAAAAAAAAAAAAAAnjwAAAAAAAC0PAAAAAAAAF49AAAAAAAASj0AAAAAAAAAAAAAAAAAAIQ8AAAAAAAAAAAAAAAAAADkPAAAAAAAAMo8AAAAAAAAAAAAAAAAAABkPAAAAAAAAHQ8AAAAAAAAAAAAAAAAAACwPgAAAAAAAPo7AAAAAAAAKDwAAAAAAAAOPAAAAAAAAAAAAAAAAAAABwBfaW5pdHRlcm1fZQAGAF9pbml0dGVybQBhcGktbXMtd2luLWNvcmUtY3J0LWwyLTEtMC5kbGwAANACUnRsQ2FwdHVyZUNvbnRleHQAjQRSdGxMb29rdXBGdW5jdGlvbkVudHJ5AAC3BVJ0bFZpcnR1YWxVbndpbmQAAG50ZGxsLmRsbAAGAEhlYXBGcmVlAAAAAEdldFByb2Nlc3NIZWFwAAAEAEVuY29kZVBvaW50ZXIAAQBEZWNvZGVQb2ludGVyAAAAUXVlcnlQZXJmb3JtYW5jZUNvdW50ZXIADQBHZXRDdXJyZW50UHJvY2Vzc0lkABEAR2V0Q3VycmVudFRocmVhZElkAAAUAEdldFN5c3RlbVRpbWVBc0ZpbGVUaW1lABgAR2V0VGlja0NvdW50AAABAERpc2FibGVUaHJlYWRMaWJyYXJ5Q2FsbHMAEQBVbmhhbmRsZWRFeGNlcHRpb25GaWx0ZXIAAA8AU2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVyAAwAR2V0Q3VycmVudFByb2Nlc3MATQBUZXJtaW5hdGVQcm9jZXNzAABhcGktbXMtd2luLWNvcmUtaGVhcC1sMS0yLTAuZGxsAGFwaS1tcy13aW4tY29yZS11dGlsLWwxLTEtMC5kbGwAYXBpLW1zLXdpbi1jb3JlLXByb2ZpbGUtbDEtMS0wLmRsbAAAYXBpLW1zLXdpbi1jb3JlLXByb2Nlc3N0aHJlYWRzLWwxLTEtMi5kbGwAYXBpLW1zLXdpbi1jb3JlLXN5c2luZm8tbDEtMi0xLmRsbAAAYXBpLW1zLXdpbi1jb3JlLWxpYnJhcnlsb2FkZXItbDEtMi0wLmRsbAAAYXBpLW1zLXdpbi1jb3JlLWVycm9yaGFuZGxpbmctbDEtMS0xLmRsbAAAAABfX0Nfc3BlY2lmaWNfaGFuZGxlcgAAYXBpLW1zLXdpbi1jb3JlLWNydC1sMS0xLTAuZGxsAADbAU50UXVlcnlTeXN0ZW1JbmZvcm1hdGlvbgAAWQBXcml0ZUZpbGUAUwBTZXRGaWxlUG9pbnRlcgAABQBHZXRMYXN0RXJyb3IAAAUAQ3JlYXRlRmlsZUEAAABDbG9zZUhhbmRsZQACAEhlYXBBbGxvYwBhcGktbXMtd2luLWNvcmUtZmlsZS1sMS0yLTEuZGxsAGFwaS1tcy13aW4tY29yZS1oYW5kbGUtbDEtMS0wLmRsbAAzAG1lbWNweQAANwBtZW1zZXQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyot8tmSsAAM1dINJm1P//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAQAAAXEQAAwDcAACwRAAAaEgAA1DcAACASAABwEgAA8DcAAHgSAAC2EgAA+DcAALwSAADyEgAACDgAAPgSAABRGQAAEDgAAFgZAACaGgAAMDgAAKAaAAB7GwAAyDgAAJAbAADNGwAA+DcAANQbAAD8HAAASDgAABAdAAAuHQAA2DgAAFQdAAAkHgAA3DgAAEQeAABdHgAA8DcAAHweAACwHgAA6DgAAMAeAAAxIAAA8DgAAGwgAACJIAAA8DcAAJAgAADrIAAA/DgAAAAhAAACIQAA+DgAAAghAAAqIQAAwDgAACohAABMIQAAwDgAAEwhAABuIQAAwDgAAG4hAACQIQAAwDgAAJAhAAC1IQAAwDgAALUhAADFIQAAwDgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAABgAAAAAoAigaKCAoIigkKAoojCiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" + +function Log($message) +{ + $message | Out-File $LogFile -Append -Force +} + +function LogAndConsole($message) +{ + Write-Host $message + Log $message +} + +function LogAndConsoleWarning($message) +{ + Write-Host $message -foregroundcolor "Yellow" + Log $message +} + +function LogAndConsoleSuccess($message) +{ + Write-Host $message -foregroundcolor "Green" + Log $message +} + +function LogAndConsoleError($message) +{ + Write-Host $message -foregroundcolor "Red" + Log $message +} + +function IsExempted([System.IO.FileInfo] $item) +{ + $cert = (Get-AuthenticodeSignature $item.FullName).SignerCertificate + if($cert.ToString().Contains("CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US")) + { + Log $item.FullName + "MS Exempted" + return 1 + } + else + { + Log $item.FullName + "Not-exempted" + Log $cert.ToString() + return 0 + } +} + +function CheckExemption($_ModName) +{ + $mod1 = Get-ChildItem $Sys32Path $_ModName + $mod2 = Get-ChildItem $DriverPath $_ModName + if($mod1) + { + Log "NonDriver module" + $mod1.FullName + return IsExempted($mod1) + } + elseif($mod2) + { + Log "Driver Module" + $mod2.FullName + return IsExempted($mod2) + } + +} + +function CheckFailedDriver($_ModName, $CIStats) +{ + Log "Module: " $_ModName.Trim() + if(CheckExemption($_ModName.Trim()) - eq 1) + { + $CompatibleModules.AppendLine("Windows Signed: " + $_ModName.Trim()) | Out-Null + return + } + $index = $CIStats.IndexOf("execute pool type count:".ToLower()) + if($index -eq -1) + { + return + } + $_tempStr = $CIStats.Substring($index) + $Result = "PASS" + $separator = "`r`n","" + $option = [System.StringSplitOptions]::RemoveEmptyEntries + $stats = $_tempStr.Split($separator,$option) + Log $stats.Count + + $FailingStat = "" + foreach( $stat in $stats) + { + $_t =$stat.Split(":") + if($_t.Count -eq 2 -and $_t[1].trim() -ne "0") + { + $Result = "FAIL" + $FailingStat = $stat + break + } + } + if($Result.Contains("PASS")) + { + $CompatibleModules.AppendLine($_ModName.Trim()) | Out-Null + } + elseif($FailingStat.Trim().Contains("execute-write")) + { + $FailingExecuteWriteCheck.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null + } + else + { + $FailingModules.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null + } + Log "Result: " $Result +} + +function ListCIStats($_ModName, $str1) +{ + $i1 = $str1.IndexOf("Code Integrity Statistics:".ToLower()) + if($i1 -eq -1 ) + { + Log "String := " $str1 + Log "Warning! CI Stats are missing for " $_ModName + return + } + $temp_str1 = $str1.Substring($i1) + $CIStats = $temp_str1.Substring(0).Trim() + + CheckFailedDriver $_ModName $CIStats +} + +function ListDrivers($str) +{ + $_tempStr= $str + + $separator = "module:","" + $option = [System.StringSplitOptions]::RemoveEmptyEntries + $index1 = $_tempStr.IndexOf("MODULE:".ToLower()) + if($index1 -lt 0) + { + return + } + $_tempStr = $_tempStr.Substring($Index1) + $_SplitStr = $_tempStr.Split($separator,$option) + + + Log $_SplitStr.Count + LogAndConsole "Verifying each module please wait ... " + foreach($ModuleDetail in $_Splitstr) + { + #LogAndConsole $Module + $Index2 = $ModuleDetail.IndexOf("(") + if($Index2 -eq -1) + { + "Skipping .." + continue + } + $ModName = $ModuleDetail.Substring(0,$Index2-1) + Log "Driver: " $ModName + Log "Processing module: " $ModName + ListCIStats $ModName $ModuleDetail + } + + $DriverScanCompletedMessage = "Completed scan. List of Compatible Modules can be found at " + $LogFile + LogAndConsole $DriverScanCompletedMessage + + if($FailingModules.Length -gt 0 -or $FailingExecuteWriteCheck.Length -gt 0 ) + { + $WarningMessage = "Incompatible HVCI Kernel Driver Modules found" + if($HLK) + { + LogAndConsoleError $WarningMessage + } + else + { + LogAndConsoleWarning $WarningMessage + } + + LogAndConsoleError $FailingExecuteWriteCheck.ToString() + if($HLK) + { + LogAndConsoleError $FailingModules.ToString() + } + else + { + LogAndConsoleWarning $FailingModules.ToString() + } + if($FailingModules.Length -ne 0 -or $FailingExecuteWriteCheck.Length -ne 0 ) + { + if($HLK) + { + $DGVerifyCrit.AppendLine($WarningMessage) | Out-Null + } + else + { + $DGVerifyWarn.AppendLine($WarningMessage) | Out-Null + } + } + } + else + { + LogAndConsoleSuccess "No Incompatible Drivers found" + } +} + +function ListSummary() +{ + if($DGVerifyCrit.Length -ne 0 ) + { + LogAndConsoleError "Machine is not Device Guard / Credential Guard compatible because of the following:" + LogAndConsoleError $DGVerifyCrit.ToString() + LogAndConsoleWarning $DGVerifyWarn.ToString() + if(!$HVCI -and !$DG) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Capable" /t REG_DWORD /d 0 /f ' + } + if(!$CG) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Capable" /t REG_DWORD /d 0 /f ' + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "HVCI_Capable" /t REG_DWORD /d 0 /f ' + } + + } + elseif ($DGVerifyWarn.Length -ne 0 ) + { + LogAndConsoleSuccess "Device Guard / Credential Guard can be enabled on this machine.`n" + LogAndConsoleWarning "The following additional qualifications, if present, can enhance the security of Device Guard / Credential Guard on this system:" + LogAndConsoleWarning $DGVerifyWarn.ToString() + if(!$HVCI -and !$DG) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Capable" /t REG_DWORD /d 1 /f ' + } + if(!$CG) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Capable" /t REG_DWORD /d 1 /f ' + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "HVCI_Capable" /t REG_DWORD /d 1 /f ' + } + } + else + { + LogAndConsoleSuccess "Machine is Device Guard / Credential Guard Ready.`n" + if(!$HVCI -and !$DG) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Capable" /t REG_DWORD /d 2 /f ' + } + if(!$CG) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Capable" /t REG_DWORD /d 2 /f ' + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "HVCI_Capable" /t REG_DWORD /d 2 /f ' + } + } +} + + +function Instantiate-Kernel32 { + try + { + Add-Type -TypeDefinition @" + using System; + using System.Diagnostics; + using System.Runtime.InteropServices; + + public static class Kernel32 + { + [DllImport("kernel32", SetLastError=true, CharSet = CharSet.Ansi)] + public static extern IntPtr LoadLibrary( + [MarshalAs(UnmanagedType.LPStr)]string lpFileName); + + [DllImport("kernel32", CharSet=CharSet.Ansi, ExactSpelling=true, SetLastError=true)] + public static extern IntPtr GetProcAddress( + IntPtr hModule, + string procName); + } + +"@ + } + catch + { + Log $_.Exception.Message + LogAndConsole "Instantiate-Kernel32 failed" + } +} + +function Instantiate-HSTI { + try + { + Add-Type -TypeDefinition @" + using System; + using System.Diagnostics; + using System.Runtime.InteropServices; + using System.Net; + + public static class HstiTest3 + { + [DllImport("hstitest.dll", CharSet = CharSet.Unicode)] + public static extern int QueryHSTIdetails( + ref HstiOverallError pHstiOverallError, + [In, Out] HstiProviderErrorDuple[] pHstiProviderErrors, + ref uint pHstiProviderErrorsCount, + byte[] hstiPlatformSecurityBlob, + ref uint pHstiPlatformSecurityBlobBytes); + + [DllImport("hstitest.dll", CharSet = CharSet.Unicode)] + public static extern int QueryHSTI(ref bool Pass); + + [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)] + public struct HstiProviderErrorDuple + { + internal uint protocolError; + internal uint role; + internal HstiProviderErrors providerError; + [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)] + internal string ID; + [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 4096)] + internal string ErrorString; + } + + [FlagsAttribute] + public enum HstiProviderErrors : int + { + None = 0x00000000, + VersionMismatch = 0x00000001, + RoleUnknown = 0x00000002, + RoleDuplicated = 0x00000004, + SecurityFeatureSizeMismatch = 0x00000008, + SizeTooSmall = 0x00000010, + VerifiedMoreThanImplemented = 0x00000020, + VerifiedNotMatchImplemented = 0x00000040 + } + + [FlagsAttribute] + public enum HstiOverallError : int + { + None = 0x00000000, + RoleTooManyPlatformReference = 0x00000001, + RoleTooManyIbv = 0x00000002, + RoleTooManyOem = 0x00000004, + RoleTooManyOdm = 0x00000008, + RoleMissingPlatformReference = 0x00000010, + VerifiedIncomplete = 0x00000020, + ProtocolErrors = 0x00000040, + BlobVersionMismatch = 0x00000080, + PlatformSecurityVersionMismatch = 0x00000100, + ProviderError = 0x00000200 + } + + } +"@ + + $LibHandle = [Kernel32]::LoadLibrary("C:\Windows\System32\hstitest.dll") + $FuncHandle = [Kernel32]::GetProcAddress($LibHandle, "QueryHSTIdetails") + $FuncHandle2 = [Kernel32]::GetProcAddress($LibHandle, "QueryHSTI") + + if ([System.IntPtr]::Size -eq 8) + { + #assuming 64 bit + Log "`nKernel32::LoadLibrary 64bit --> 0x$("{0:X16}" -f $LibHandle.ToInt64())" + Log "HstiTest2::QueryHSTIdetails 64bit --> 0x$("{0:X16}" -f $FuncHandle.ToInt64())" + } + else + { + return + } + $overallError = New-Object HstiTest3+HstiOverallError + $providerErrorDupleCount = New-Object int + $blobByteSize = New-Object int + $hr = [HstiTest3]::QueryHSTIdetails([ref] $overallError, $null, [ref] $providerErrorDupleCount, $null, [ref] $blobByteSize) + + [byte[]]$blob = New-Object byte[] $blobByteSize + [HstiTest3+HstiProviderErrorDuple[]]$providerErrors = New-Object HstiTest3+HstiProviderErrorDuple[] $providerErrorDupleCount + $hr = [HstiTest3]::QueryHSTIdetails([ref] $overallError, $providerErrors, [ref] $providerErrorDupleCount, $blob, [ref] $blobByteSize) + $string = $null + $blob | foreach { $string = $string + $_.ToString("X2")+"," } + + $hstiStatus = New-Object bool + $hr = [HstiTest3]::QueryHSTI([ref] $hstiStatus) + + LogAndConsole "HSTI Duple Count: $providerErrorDupleCount" + LogAndConsole "HSTI Blob size: $blobByteSize" + LogAndConsole "String: $string" + LogAndConsole "HSTIStatus: $hstiStatus" + if(($blobByteSize -gt 512) -and ($providerErrorDupleCount -gt 0) -and $hstiStatus) + { + LogAndConsoleSuccess "HSTI validation successful" + } + elseif(($providerErrorDupleCount -eq 0) -or ($blobByteSize -le 512)) + { + LogAndConsoleWarning "HSTI is absent" + $DGVerifyWarn.AppendLine("HSTI is absent") | Out-Null + } + else + { + $ErrorMessage = "HSTI validation failed" + if($HLK) + { + LogAndConsoleError $ErrorMessage + $DGVerifyCrit.AppendLine($ErrorMessage) | Out-Null + } + else + { + LogAndConsoleWarning $ErrorMessage + $DGVerifyWarn.AppendLine("HSTI is absent") | Out-Null + } + } + + } + catch + { + LogAndConsoleError $_.Exception.Message + LogAndConsoleError "Instantiate-HSTI failed" + } +} + + +function CheckDGRunning($_val) +{ + $DGObj = Get-CimInstance -classname Win32_DeviceGuard -namespace root\Microsoft\Windows\DeviceGuard + for($i=0; $i -lt $DGObj.SecurityServicesRunning.length; $i++) + { + if($DGObj.SecurityServicesRunning[$i] -eq $_val) + { + return 1 + } + + } + return 0 +} + +function CheckDGFeatures($_val) +{ + $DGObj = Get-CimInstance -classname Win32_DeviceGuard -namespace root\Microsoft\Windows\DeviceGuard + Log "DG_obj $DG_obj" + Log "DG_obj.AvailableSecurityProperties.length $DG_obj.AvailableSecurityProperties.length" + for($i=0; $i -lt $DGObj.AvailableSecurityProperties.length; $i++) + { + if($DGObj.AvailableSecurityProperties[$i] -eq $_val) + { + return 1 + } + + } + return 0 +} + +function PrintConfigCIDetails($_ConfigCIState) +{ + $_ConfigCIRunning = "Config-CI is enabled and running." + $_ConfigCIDisabled = "Config-CI is not running." + $_ConfigCIMode = "Not Enabled" + switch ($_ConfigCIState) + { + 0 { $_ConfigCIMode = "Not Enabled" } + 1 { $_ConfigCIMode = "Audit mode" } + 2 { $_ConfigCIMode = "Enforced mode" } + default { $_ConfigCIMode = "Not Enabled" } + } + + if($_ConfigCIState -ge 1) + { + LogAndConsoleSuccess "$_ConfigCIRunning ($_ConfigCIMode)" + } + else + { + LogAndConsoleWarning "$_ConfigCIDisabled ($_ConfigCIMode)" + } +} + +function PrintHVCIDetails($_HVCIState) +{ + $_HvciRunning = "HVCI is enabled and running." + $_HvciDisabled = "HVCI is not running." + + if($_HVCIState) + { + LogAndConsoleSuccess $_HvciRunning + } + else + { + LogAndConsoleWarning $_HvciDisabled + } +} + +function PrintCGDetails ($_CGState) +{ + $_CGRunning = "Credential-Guard is enabled and running." + $_CGDisabled = "Credential-Guard is not running." + + if($_CGState) + { + LogAndConsoleSuccess $_CGRunning + } + else + { + LogAndConsoleWarning $_CGDisabled + } +} + +if(![IO.Directory]::Exists($path)) +{ + New-Item -ItemType directory -Path $path +} +else +{ + #Do Nothing!! +} + +function IsRedstone +{ + $_osVersion = [environment]::OSVersion.Version + Log $_osVersion + #Check if build Major is Windows 10 + if($_osVersion.Major -lt 10) + { + return 0 + } + #Check if the build is post Threshold2 (1511 release) => Redstone + if($_osVersion.Build -gt 10586) + { + return 1 + } + #default return False + return 0 +} + +function ExecuteCommandAndLog($_cmd) +{ + try + { + Log "Executing: $_cmd" + $CmdOutput = Invoke-Expression $_cmd | Out-String + Log "Output: $CmdOutput" + } + catch + { + Log "Exception while exectuing $_cmd" + Log $_.Exception.Message + } + + +} + +function PrintRebootWarning +{ + LogAndConsoleWarning "Please reboot the machine, for settings to be applied." +} + +function AutoRebootHelper +{ + if($AutoReboot) + { + LogAndConsole "PC will restart in 30 seconds" + ExecuteCommandAndLog 'shutdown /r /t 30' + } + else + { + PrintRebootWarning + } + +} + +function VerifierReset +{ + $verifier_state = verifier /query | Out-String + if(!$verifier_state.ToString().Contains("No drivers are currently verified.")) + { + ExecuteCommandAndLog 'verifier.exe /reset' + } + AutoRebootHelper +} + +function PrintHardwareReq +{ + LogAndConsole "###########################################################################" + LogAndConsole "OS and Hardware requirements for enabling Device Guard and Credential Guard" + LogAndConsole " 1. OS SKUs: Available only on these OS Skus - Enterprise, Server, Education, Enterprise IoT, Pro, and Home" + LogAndConsole " 2. Hardware: Recent hardware that supports virtualization extension with SLAT" + LogAndConsole "To learn more please visit: https://aka.ms/dgwhcr" + LogAndConsole "########################################################################### `n" +} + +function CheckDriverCompat +{ + $_HVCIState = CheckDGRunning(2) + if($_HVCIState) + { + LogAndConsoleWarning "HVCI is already enabled on this machine, driver compat list might not be complete." + LogAndConsoleWarning "Please disable HVCI and run the script again..." + } + $verifier_state = verifier /query | Out-String + if($verifier_state.ToString().Contains("No drivers are currently verified.")) + { + LogAndConsole "Enabling Driver verifier" + verifier.exe /flags 0x02000000 /all /log.code_integrity + + LogAndConsole "Enabling Driver Verifier and Rebooting system" + Log $verifier_state + LogAndConsole "Please re-execute this script after reboot...." + if($AutoReboot) + { + LogAndConsole "PC will restart in 30 seconds" + ExecuteCommandAndLog 'shutdown /r /t 30' + } + else + { + LogAndConsole "Please reboot manually and run the script again...." + } + exit + } + else + { + LogAndConsole "Driver verifier already enabled" + Log $verifier_state + ListDrivers($verifier_state.Trim().ToLowerInvariant()) + } +} +function IsDomainController +{ + $_isDC = 0 + $CompConfig = Get-WmiObject Win32_ComputerSystem + foreach ($ObjItem in $CompConfig) + { + $Role = $ObjItem.DomainRole + Log "Role=$Role" + Switch ($Role) + { + 0 { Log "Standalone Workstation" } + 1 { Log "Member Workstation" } + 2 { Log "Standalone Server" } + 3 { Log "Member Server" } + 4 + { + Log "Backup Domain Controller" + $_isDC=1 + break + } + 5 + { + Log "Primary Domain Controller" + $_isDC=1 + break + } + default { Log "Unknown Domain Role" } + } + } + return $_isDC +} + +function CheckOSSKU +{ + $osname = $((gwmi win32_operatingsystem).Name).ToLower() + $_SKUSupported = 0 + Log "OSNAME:$osname" + $SKUarray = @("Enterprise", "Education", "IoT", "Windows Server", "Pro", "Home") + $HLKAllowed = @("microsoft windows 10 pro") + foreach ($SKUent in $SKUarray) + { + if($osname.ToString().Contains($SKUent.ToLower())) + { + $_SKUSupported = 1 + break + } + } + + # For running HLK tests only, professional SKU's are marked as supported. + if($HLK) + { + if($osname.ToString().Contains($HLKAllowed.ToLower())) + { + $_SKUSupported = 1 + } + } + $_isDomainController = IsDomainController + if($_SKUSupported) + { + LogAndConsoleSuccess "This PC edition is Supported for DeviceGuard"; + if(($_isDomainController -eq 1) -and !$HVCI -and !$DG) + { + LogAndConsoleError "This PC is configured as a Domain Controller, Credential Guard is not supported on DC." + } + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "OSSKU" /t REG_DWORD /d 2 /f ' + } + else + { + LogAndConsoleError "This PC edition is Unsupported for Device Guard" + $DGVerifyCrit.AppendLine("OS SKU unsupported") | Out-Null + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "OSSKU" /t REG_DWORD /d 0 /f ' + } +} + +function CheckOSArchitecture +{ + $OSArch = $(gwmi win32_operatingsystem).OSArchitecture.ToLower() + Log $OSArch + if($OSArch.Contains("64-bit")) + { + LogAndConsoleSuccess "64 bit archictecture" + } + elseif($OSArch.Contains("32-bit")) + { + LogAndConsoleError "32 bit archictecture" + $DGVerifyCrit.AppendLine("32 Bit OS, OS Architecture failure.") | Out-Null + } + else + { + LogAndConsoleError "Unknown architecture" + $DGVerifyCrit.AppendLine("Unknown OS, OS Architecture failure.") | Out-Null + } +} + +function CheckSecureBootState +{ + $_secureBoot = Confirm-SecureBootUEFI + Log $_secureBoot + if($_secureBoot) + { + LogAndConsoleSuccess "Secure Boot is present" + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "SecureBoot" /t REG_DWORD /d 2 /f ' + } + else + { + LogAndConsoleError "Secure Boot is absent / not enabled." + LogAndConsoleError "If Secure Boot is supported on the system, enable Secure Boot in the BIOS and run the script again." + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "SecureBoot" /t REG_DWORD /d 0 /f ' + $DGVerifyCrit.AppendLine("Secure boot validation failed.") | Out-Null + } +} + +function CheckVirtualization +{ + $_vmmExtension = $(gwmi -Class Win32_processor).VMMonitorModeExtensions + $_vmFirmwareExtension = $(gwmi -Class Win32_processor).VirtualizationFirmwareEnabled + $_vmHyperVPresent = (gcim -Class Win32_ComputerSystem).HypervisorPresent + Log "VMMonitorModeExtensions $_vmmExtension" + Log "VirtualizationFirmwareEnabled $_vmFirmwareExtension" + Log "HyperVisorPresent $_vmHyperVPresent" + + #success if either processor supports and enabled or if hyper-v is present + if(($_vmmExtension -and $_vmFirmwareExtension) -or $_vmHyperVPresent ) + { + LogAndConsoleSuccess "Virtualization firmware check passed" + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "Virtualization" /t REG_DWORD /d 2 /f ' + } + else + { + LogAndConsoleError "Virtualization firmware check failed." + LogAndConsoleError "If Virtualization extensions are supported on the system, enable hardware virtualization (Intel Virtualization Technology, Intel VT-x, Virtualization Extensions, or similar) in the BIOS and run the script again." + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "Virtualization" /t REG_DWORD /d 0 /f ' + $DGVerifyCrit.AppendLine("Virtualization firmware check failed.") | Out-Null + } +} + +function CheckTPM +{ + $TPMLockout = $(get-tpm).LockoutCount + + if($TPMLockout) + { + + if($TPMLockout.ToString().Contains("Not Supported for TPM 1.2")) + { + if($HLK) + { + LogAndConsoleSuccess "TPM 1.2 is present." + } + else + { + $WarningMsg = "TPM 1.2 is Present. TPM 2.0 is Preferred." + LogAndConsoleWarning $WarningMsg + $DGVerifyWarn.AppendLine($WarningMsg) | Out-Null + } + } + else + { + LogAndConsoleSuccess "TPM 2.0 is present." + } + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "TPM" /t REG_DWORD /d 2 /f ' + } + else + { + $WarningMsg = "TPM is absent or not ready for use" + if($HLK) + { + LogAndConsoleError $WarningMsg + $DGVerifyCrit.AppendLine($WarningMsg) | Out-Null + } + else + { + LogAndConsoleWarning $WarningMsg + $DGVerifyWarn.AppendLine($WarningMsg) | Out-Null + } + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "TPM" /t REG_DWORD /d 0 /f ' + } +} + +function CheckSecureMOR +{ + $isSecureMOR = CheckDGFeatures(4) + Log "isSecureMOR= $isSecureMOR " + if($isSecureMOR -eq 1) + { + LogAndConsoleSuccess "Secure MOR is available" + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "SecureMOR" /t REG_DWORD /d 2 /f ' + } + else + { + $WarningMsg = "Secure MOR is absent" + if($HLK) + { + LogAndConsoleError $WarningMsg + $DGVerifyCrit.AppendLine($WarningMsg) | Out-Null + } + else + { + LogAndConsoleWarning $WarningMsg + $DGVerifyWarn.AppendLine($WarningMsg) | Out-Null + } + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "SecureMOR" /t REG_DWORD /d 0 /f ' + } +} + +function CheckNXProtection +{ + $isNXProtected = CheckDGFeatures(5) + Log "isNXProtected= $isNXProtected " + if($isNXProtected -eq 1) + { + LogAndConsoleSuccess "NX Protector is available" + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "UEFINX" /t REG_DWORD /d 2 /f ' + } + else + { + LogAndConsoleWarning "NX Protector is absent" + $DGVerifyWarn.AppendLine("NX Protector is absent") | Out-Null + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "UEFINX" /t REG_DWORD /d 0 /f ' + } +} + +function CheckSMMProtection +{ + $isSMMMitigated = CheckDGFeatures(6) + Log "isSMMMitigated= $isSMMMitigated " + if($isSMMMitigated -eq 1) + { + LogAndConsoleSuccess "SMM Mitigation is available" + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "SMMProtections" /t REG_DWORD /d 2 /f ' + } + else + { + LogAndConsoleWarning "SMM Mitigation is absent" + $DGVerifyWarn.AppendLine("SMM Mitigation is absent") | Out-Null + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "SMMProtections" /t REG_DWORD /d 0 /f ' + } +} + +function CheckHSTI +{ + LogAndConsole "Copying HSTITest.dll" + try + { + $HSTITest_Decoded = [System.Convert]::FromBase64String($HSTITest_Encoded) + [System.IO.File]::WriteAllBytes("$env:windir\System32\hstitest.dll",$HSTITest_Decoded) + + } + catch + { + LogAndConsole $_.Exception.Message + LogAndConsole "Copying and loading HSTITest.dll failed" + } + + Instantiate-Kernel32 + Instantiate-HSTI +} + +function PrintToolVersion +{ + LogAndConsole "" + LogAndConsole "###########################################################################" + LogAndConsole "" + LogAndConsole "Readiness Tool Version 3.7 Release. `nTool to check if your device is capable to run Device Guard and Credential Guard." + LogAndConsole "" + LogAndConsole "###########################################################################" + LogAndConsole "" + +} + +PrintToolVersion + +if(!($Ready) -and !($Capable) -and !($Enable) -and !($Disable) -and !($Clear) -and !($ResetVerifier)) +{ + #Print Usage if none of the options are specified + LogAndConsoleWarning "How to read the output:" + LogAndConsoleWarning "" + LogAndConsoleWarning " 1. Red Errors: Basic things are missing that will prevent enabling and using DG/CG" + LogAndConsoleWarning " 2. Yellow Warnings: This device can be used to enable and use DG/CG, but `n additional security benefits will be absent. To learn more please go through: https://aka.ms/dgwhcr" + LogAndConsoleWarning " 3. Green Messages: This device is fully compliant with DG/CG requirements`n" + + LogAndConsoleWarning "###########################################################################" + LogAndConsoleWarning "" + LogAndConsoleWarning "Hardware requirements for enabling Device Guard and Credential Guard" + LogAndConsoleWarning " 1. Hardware: Recent hardware that supports virtualization extension with SLAT" + LogAndConsoleWarning "" + LogAndConsoleWarning "########################################################################### `n" + + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -[Capable/Ready/Enable/Disable/Clear] -[DG/CG/HVCI] -[AutoReboot] -Path" + LogAndConsoleWarning "Log file with details is found here: C:\DGLogs `n" + + LogAndConsoleWarning "To Enable DG/CG. If you have a custom SIPolicy.p7b then use the -Path parameter else the hardcoded default policy is used" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Enable OR DG_Readiness.ps1 -Enable -Path `n" + + LogAndConsoleWarning "To Enable only HVCI" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Enable -HVCI `n" + + LogAndConsoleWarning "To Enable only CG" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Enable -CG `n" + + LogAndConsoleWarning "To Verify if DG/CG is enabled" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Ready `n" + + LogAndConsoleWarning "To Disable DG/CG." + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Disable `n" + + LogAndConsoleWarning "To Verify if DG/CG is disabled" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Ready `n" + + LogAndConsoleWarning "To Verify if this device is DG/CG Capable" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Capable`n" + + LogAndConsoleWarning "To Verify if this device is HVCI Capable" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -Capable -HVCI`n" + + LogAndConsoleWarning "To Auto reboot with each option" + LogAndConsoleWarning "Usage: DG_Readiness.ps1 -[Capable/Enable/Disable] -AutoReboot`n" + LogAndConsoleWarning "###########################################################################" + LogAndConsoleWarning "" + LogAndConsoleWarning "When the Readiness Tool with '-capable' is run the following RegKey values are set:" + LogAndConsoleWarning "" + LogAndConsoleWarning "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities" + LogAndConsoleWarning "CG_Capable" + LogAndConsoleWarning "DG_Capable" + LogAndConsoleWarning "HVCI_Capable" + LogAndConsoleWarning "" + LogAndConsoleWarning "Value 0 = not possible to enable DG/CG/HVCI on this device" + LogAndConsoleWarning "Value 1 = not fully compatible but has sufficient firmware/hardware/software features to enable DG/CG/HVCI" + LogAndConsoleWarning "Value 2 = fully compatible for DG/CG/HVCI" + LogAndConsoleWarning "" + LogAndConsoleWarning "########################################################################### `n" +} + +$user = [Security.Principal.WindowsIdentity]::GetCurrent(); +$TestForAdmin = (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator) + +if(!$TestForAdmin) +{ + LogAndConsoleError "This script requires local administrator privileges. Please execute this script as a local administrator." + exit +} + +$isRunningOnVM = (get-wmiobject win32_computersystem).model +if($isRunningOnVM.Contains("Virtual")) +{ + LogAndConsoleWarning "Running on a Virtual Machine. DG/CG is supported only if both guest VM and host machine are running with Windows 10, version 1703 or later with English localization." +} + + +<# Check the DG status if enabled or disabled, meaning if the device is ready or not #> +if($Ready) +{ + PrintHardwareReq + + $DGRunning = $(Get-CimInstance -classname Win32_DeviceGuard -namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning + $_ConfigCIState = $(Get-CimInstance -classname Win32_DeviceGuard -namespace root\Microsoft\Windows\DeviceGuard).CodeIntegrityPolicyEnforcementStatus + Log "Current DGRunning = $DGRunning, ConfigCI= $_ConfigCIState" + $_HVCIState = CheckDGRunning(2) + $_CGState = CheckDGRunning(1) + + if($HVCI) + { + Log "_HVCIState: $_HVCIState" + PrintHVCIDetails $_HVCIState + } + elseif($CG) + { + Log "_CGState: $_CGState" + PrintCGDetails $_CGState + + if($_CGState) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Running" /t REG_DWORD /d 1 /f' + } + else + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Running" /t REG_DWORD /d 0 /f' + } + } + elseif($DG) + { + Log "_HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState" + + PrintHVCIDetails $_HVCIState + PrintConfigCIDetails $_ConfigCIState + + if($_ConfigCIState -and $_HVCIState) + { + LogAndConsoleSuccess "HVCI, and Config-CI are enabled and running." + + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Running" /t REG_DWORD /d 1 /f' + } + else + { + LogAndConsoleWarning "Not all services are running." + + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Running" /t REG_DWORD /d 0 /f' + } + } + else + { + Log "_CGState: $_CGState, _HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState" + + PrintCGDetails $_CGState + PrintHVCIDetails $_HVCIState + PrintConfigCIDetails $_ConfigCIState + + if(($DGRunning.Length -ge 2) -and ($_CGState) -and ($_HVCIState) -and ($_ConfigCIState -ge 1)) + { + LogAndConsoleSuccess "HVCI, Credential Guard, and Config CI are enabled and running." + } + else + { + LogAndConsoleWarning "Not all services are running." + } + } +} + +<# Enable and Disable #> +if($Enable) +{ + PrintHardwareReq + + LogAndConsole "Enabling Device Guard and Credential Guard" + LogAndConsole "Setting RegKeys to enable DG/CG" + + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f' + #Only SecureBoot is required as part of RequirePlatformSecurityFeatures + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f' + + $_isRedstone = IsRedstone + if(!$_isRedstone) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG_DWORD /d 1 /f' + } + else + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f' + } + + if(!$HVCI -and !$DG) + { + # value is 2 for both Th2 and RS1 + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "LsaCfgFlags" /t REG_DWORD /d 2 /f' + } + if(!$CG) + { + if(!$_isRedstone) + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f' + } + else + { + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f' + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f' + } + } + + try + { + if(!$HVCI -and !$CG) + { + if(!$SIPolicyPath) + { + Log "Writing Decoded SIPolicy.p7b" + $SIPolicy_Decoded = [System.Convert]::FromBase64String($SIPolicy_Encoded) + [System.IO.File]::WriteAllBytes("$env:windir\System32\CodeIntegrity\SIPolicy.p7b",$SIPolicy_Decoded) + } + else + { + LogAndConsole "Copying user provided SIpolicy.p7b" + $CmdOutput = Copy-Item $SIPolicyPath "$env:windir\System32\CodeIntegrity\SIPolicy.p7b" | Out-String + Log $CmdOutput + } + } + } + catch + { + LogAndConsole "Writing SIPolicy.p7b file failed" + } + + LogAndConsole "Enabling Hyper-V and IOMMU" + $_isRedstone = IsRedstone + if(!$_isRedstone) + { + LogAndConsole "OS Not Redstone, enabling IsolatedUserMode separately" + #Enable/Disable IOMMU seperately + ExecuteCommandAndLog 'DISM.EXE /Online /Enable-Feature:IsolatedUserMode /NoRestart' + } + $CmdOutput = DISM.EXE /Online /Enable-Feature:Microsoft-Hyper-V-Hypervisor /All /NoRestart | Out-String + if(!$CmdOutput.Contains("The operation completed successfully.")) + { + $CmdOutput = DISM.EXE /Online /Enable-Feature:Microsoft-Hyper-V-Online /All /NoRestart | Out-String + } + + Log $CmdOutput + if($CmdOutput.Contains("The operation completed successfully.")) + { + LogAndConsoleSuccess "Enabling Hyper-V and IOMMU successful" + #Reg key for HLK validation of DISM.EXE step + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "HyperVEnabled" /t REG_DWORD /d 1 /f' + } + else + { + LogAndConsoleWarning "Enabling Hyper-V failed please check the log file" + #Reg key for HLK validation of DISM.EXE step + ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "HyperVEnabled" /t REG_DWORD /d 0 /f' + } + AutoRebootHelper +} + +if($Disable) +{ + LogAndConsole "Disabling Device Guard and Credential Guard" + LogAndConsole "Deleting RegKeys to disable DG/CG" + + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /f' + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /f' + + $_isRedstone = IsRedstone + if(!$_isRedstone) + { + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "NoLock" /f' + } + else + { + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /f' + } + + if(!$CG) + { + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /f' + if($_isRedstone) + { + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /f' + } + } + + if(!$HVCI -and !$DG) + { + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v "LsaCfgFlags" /f' + } + + if(!$HVCI -and !$CG) + { + ExecuteCommandAndLog 'del "$env:windir\System32\CodeIntegrity\SIPolicy.p7b"' + } + + if(!$HVCI -and !$DG -and !$CG) + { + LogAndConsole "Disabling Hyper-V and IOMMU" + $_isRedstone = IsRedstone + if(!$_isRedstone) + { + LogAndConsole "OS Not Redstone, disabling IsolatedUserMode separately" + #Enable/Disable IOMMU seperately + ExecuteCommandAndLog 'DISM.EXE /Online /disable-Feature /FeatureName:IsolatedUserMode /NoRestart' + } + $CmdOutput = DISM.EXE /Online /disable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /NoRestart | Out-String + if(!$CmdOutput.Contains("The operation completed successfully.")) + { + $CmdOutput = DISM.EXE /Online /disable-Feature /FeatureName:Microsoft-Hyper-V-Online /NoRestart | Out-String + } + Log $CmdOutput + if($CmdOutput.Contains("The operation completed successfully.")) + { + LogAndConsoleSuccess "Disabling Hyper-V and IOMMU successful" + } + else + { + LogAndConsoleWarning "Disabling Hyper-V failed please check the log file" + } + + #set of commands to run SecConfig.efi to delete UEFI variables if were set in pre OS + #these steps can be performed even if the UEFI variables were not set - if not set it will lead to No-Op but this can be run in general always + #this requires a reboot and accepting the prompt in the Pre-OS which is self explanatory in the message that is displayed in pre-OS + $FreeDrive = ls function:[s-z]: -n | ?{ !(test-path $_) } | random + Log "FreeDrive=$FreeDrive" + ExecuteCommandAndLog 'mountvol $FreeDrive /s' + $CmdOutput = Copy-Item "$env:windir\System32\SecConfig.efi" $FreeDrive\EFI\Microsoft\Boot\SecConfig.efi -Force | Out-String + LogAndConsole $CmdOutput + ExecuteCommandAndLog 'bcdedit /create "{0cb3b571-2f2e-4343-a879-d86a476d7215}" /d DGOptOut /application osloader' + ExecuteCommandAndLog 'bcdedit /set "{0cb3b571-2f2e-4343-a879-d86a476d7215}" path \EFI\Microsoft\Boot\SecConfig.efi' + ExecuteCommandAndLog 'bcdedit /set "{bootmgr}" bootsequence "{0cb3b571-2f2e-4343-a879-d86a476d7215}"' + ExecuteCommandAndLog 'bcdedit /set "{0cb3b571-2f2e-4343-a879-d86a476d7215}" loadoptions DISABLE-LSA-ISO,DISABLE-VBS' + ExecuteCommandAndLog 'bcdedit /set "{0cb3b571-2f2e-4343-a879-d86a476d7215}" device partition=$FreeDrive' + ExecuteCommandAndLog 'mountvol $FreeDrive /d' + #steps complete + + } + AutoRebootHelper +} + +if($Clear) +{ + ExecuteCommandAndLog 'REG DELETE "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities" /f' + VerifierReset +} + +if($ResetVerifier) +{ + VerifierReset +} + +<# Is machine Device Guard / Cred Guard Capable and Verify #> +if($Capable) +{ + PrintHardwareReq + + LogAndConsole "Checking if the device is DG/CG Capable" + + $_isRedstone = IsRedstone + if(!$_isRedstone) + { + LogAndConsoleWarning "Capable is currently fully supported in Redstone only.." + } + $_StepCount = 1 + if(!$CG) + { + LogAndConsole " ====================== Step $_StepCount Driver Compat ====================== " + $_StepCount++ + CheckDriverCompat + } + + LogAndConsole " ====================== Step $_StepCount Secure boot present ====================== " + $_StepCount++ + CheckSecureBootState + + if(!$HVCI -and !$DG -and !$CG) + { + #check only if sub-options are absent + LogAndConsole " ====================== Step $_StepCount MS UEFI HSTI tests ====================== " + $_StepCount++ + CheckHSTI + } + + LogAndConsole " ====================== Step $_StepCount OS Architecture ====================== " + $_StepCount++ + CheckOSArchitecture + + LogAndConsole " ====================== Step $_StepCount Supported OS SKU ====================== " + $_StepCount++ + CheckOSSKU + + LogAndConsole " ====================== Step $_StepCount Virtualization Firmware ====================== " + $_StepCount++ + CheckVirtualization + + if(!$HVCI -and !$DG) + { + LogAndConsole " ====================== Step $_StepCount TPM version ====================== " + $_StepCount++ + CheckTPM + + LogAndConsole " ====================== Step $_StepCount Secure MOR ====================== " + $_StepCount++ + CheckSecureMOR + } + + LogAndConsole " ====================== Step $_StepCount NX Protector ====================== " + $_StepCount++ + CheckNXProtection + + LogAndConsole " ====================== Step $_StepCount SMM Mitigation ====================== " + $_StepCount++ + CheckSMMProtection + + LogAndConsole " ====================== End Check ====================== " + + LogAndConsole " ====================== Summary ====================== " + ListSummary + LogAndConsole "To learn more about required hardware and software please visit: https://aka.ms/dgwhcr" +} + + + +# SIG # Begin signature block +## REPLACE +# SIG # End signature block + +``` diff --git a/windows/security/identity-protection/enterprise-certificate-pinning.md b/windows/security/identity-protection/enterprise-certificate-pinning.md index aa7b5c3ba4..b45b7ac061 100644 --- a/windows/security/identity-protection/enterprise-certificate-pinning.md +++ b/windows/security/identity-protection/enterprise-certificate-pinning.md @@ -2,10 +2,10 @@ title: Enterprise Certificate Pinning ms.mktglfcycl: manage ms.sitesec: library -description: Enterprise certificate pinning is a Windows feature for remembering, or “pinning” a root, issuing certificate authority, or end entity certificate to a given domain name. +description: Enterprise certificate pinning is a Windows feature for remembering, or “pinning” a root, issuing certificate authority, or end entity certificate to a given domain name. audience: ITPro -author: MikeStephens-MS -ms.author: mstephens +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -15,17 +15,18 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: --- # Enterprise Certificate Pinning **Applies to** -- Windows 10 +- Windows 10 Enterprise certificate pinning is a Windows feature for remembering, or “pinning,” a root issuing certificate authority or end entity certificate to a given domain name. Enterprise certificate pinning helps reduce man-in-the-middle attacks by enabling you to protect your internal domain names from chaining to unwanted certificates or to fraudulently issued certificates. ->[!NOTE] +>[!NOTE] > External domain names, where the certificate issued to these domains is issued by a public certificate authority, are not ideal for enterprise certificate pinning. Windows Certificate APIs (CertVerifyCertificateChainPolicy and WinVerifyTrust) are updated to check if the site’s server authentication certificate chain matches a restricted set of certificates. @@ -68,7 +69,6 @@ Each PinRule element contains a sequence of one or more Site elements and a sequ - ``` #### PinRules Element @@ -111,7 +111,7 @@ The **Site** element can have the following attributes. |-----------|-------------|----------| | **Domain** | Contains the DNS name to be matched for this pin rule. When creating the certificate trust list, the parser normalizes the input name string value as follows:
                                  - If the DNS name has a leading "*" it is removed.
                                  - Non-ASCII DNS name are converted to ASCII Puny Code.
                                  - Upper case ASCII characters are converted to lower case.
                                  If the normalized name has a leading ".", then, wildcard left hand label matching is enabled. For example, ".xyz.com" would match "abc.xyz.com". | Yes.| | **AllSubdomains** | By default, wildcard left hand label matching is restricted to a single left hand label. This attribute can be set to "true" to enable wildcard matching of all of the left-hand labels.
                                  For example, setting this attribute would also match "123.abc.xyz.com" for the ".xyz.com" domain value.| No.| - + ### Create a Pin Rules Certificate Trust List The command line utility, **Certutil.exe**, includes the **generatePinRulesCTL** argument to parse the XML file and generate the encoded certificate trust list (CTL) that you add to your reference Windows 10 version 1703 computer and subsequently deploy. @@ -184,27 +184,27 @@ Now you need to configure a Group Policy object to include the applied certifica Sign-in to the reference computer using domain administrator equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the forest node and then expand the domain node. -3. Expand the node that has contains your Active Directory’s domain name -4. Select the **Group Policy objects** node. Right-click the **Group Policy objects** node and click **New**. -5. In the **New GPO** dialog box, type _Enterprise Certificate Pinning Rules_ in the **Name** text box and click **OK**. -6. In the content pane, right-click the **Enterprise Certificate Pinning Rules** Group Policy object and click **Edit**. -7. In the **Group Policy Management Editor**, in the navigation pane, expand the **Preferences** node under **Computer Configuration**. Expand **Windows Settings**. -8. Right-click the **Registry** node and click **New**. -9. In the **New Registry Properties** dialog box, select **Update** from the **Action** list. Select **HKEY_LOCAL_MACHINE** from the **Hive** list. -10. For the **Key Path**, click **…** to launch the **Registry Item Browser**. Navigate to the following registry key and select the **PinRules** registry value name: +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the forest node and then expand the domain node. +3. Expand the node that has contains your Active Directory’s domain name +4. Select the **Group Policy objects** node. Right-click the **Group Policy objects** node and click **New**. +5. In the **New GPO** dialog box, type _Enterprise Certificate Pinning Rules_ in the **Name** text box and click **OK**. +6. In the content pane, right-click the **Enterprise Certificate Pinning Rules** Group Policy object and click **Edit**. +7. In the **Group Policy Management Editor**, in the navigation pane, expand the **Preferences** node under **Computer Configuration**. Expand **Windows Settings**. +8. Right-click the **Registry** node and click **New**. +9. In the **New Registry Properties** dialog box, select **Update** from the **Action** list. Select **HKEY_LOCAL_MACHINE** from the **Hive** list. +10. For the **Key Path**, click **…** to launch the **Registry Item Browser**. Navigate to the following registry key and select the **PinRules** registry value name: HKLM\SOFTWARE\Microsoft\Cryptography\OID\EncodingType0\CertDllCreateCertificateChainEngine\Config Click **Select** to close the **Registry Item Browser**. - -11. The **Key Path** should contain the selected registry key. The **Value name** configuration should contain the registry value name **_PinRules_**. **Value type** should read **_REG\_BINARY_** and **Value data** should contain a long series of numbers from 0-9 and letters ranging from A-F (hexadecimal). Click **OK** to save your settings and close the dialog box. + +11. The **Key Path** should contain the selected registry key. The **Value name** configuration should contain the registry value name **_PinRules_**. **Value type** should read **_REG\_BINARY_** and **Value data** should contain a long series of numbers from 0-9 and letters ranging from A-F (hexadecimal). Click **OK** to save your settings and close the dialog box. ![PinRules Properties](images/enterprise-certificate-pinning-pinrules-properties.png) - + 12. Close the **Group Policy Management Editor** to save your settings. -13. Link the **Enterprise Certificate Pinning Rules** Group Policy object to apply to computers that run Windows 10, version 1703 in your enterprise. When these domain-joined computers apply Group Policy, the registry information configured in the Group Policy object is applied to the computer. +13. Link the **Enterprise Certificate Pinning Rules** Group Policy object to apply to computers that run Windows 10, version 1703 in your enterprise. When these domain-joined computers apply Group Policy, the registry information configured in the Group Policy object is applied to the computer. ## Additional Pin Rules Logging diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 768730bf01..4579829e90 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: aabhathipsay -ms.author: aathipsa +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 02/15/2019 +ms.reviewer: --- # WebAuthn APIs for password-less authentication on Windows 10 diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index 1f39421330..4ddcb35964 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 03/20/2018 +ms.reviewer: --- # Multifactor Unlock @@ -30,7 +31,7 @@ ms.date: 03/20/2018 Windows, today, natively only supports the use of a single credential (password, PIN, fingerprint, face, etc.) for unlocking a device. Therefore, if any of those credentials are compromised (shoulder surfed), an attacker could gain access to the system. -Windows 10 offers Multi-factor device unlock by extending Windows Hello with trusted signals, administrators can configure Windows 10 to request a combination of factors and trusted signals to unlock their devices. +Windows 10 offers Multi-factor device unlock by extending Windows Hello with trusted signals. Administrators can configure Windows 10 to request a combination of factors and trusted signals to unlock their devices. Which organizations can take advantage of Multi-factor unlock? Those who: * Have expressed that PINs alone do not meet their security needs. @@ -100,7 +101,7 @@ Each rule element has a **signal** element. All signal elements have a **type** | type| "wifi" (Windows 10, version 1803) #### Bluetooth -You define the bluetooth signal with additional attribute in the signal element. The bluetooth configuration does not use any other elements. You can end the signal element with short ending tag "\/>". +You define the bluetooth signal with additional attributes in the signal element. The bluetooth configuration does not use any other elements. You can end the signal element with short ending tag "\/>". |Attribute|Value|Required| |---------|-----|--------| @@ -116,7 +117,7 @@ Example: ``` -The **classofDevice** attribute defaults Phones and uses the values from the following table +The **classofDevice** attribute defaults to Phone and uses the values from the following table: |Description|Value| |:-------------|:-------:| @@ -137,7 +138,7 @@ The **rssiMin** attribute value signal indicates the strength needed for the dev RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other. >[!IMPORTANT] ->Microsoft recommends using the default values for this policy settings. Measurements are relative, based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. Use the rssiMIN and rssiMaxDelta values from the XML file created by the Group Policy Management Editor or remove both attributes to use the default values. +>Microsoft recommends using the default values for this policy setting. Measurements are relative, based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. Use the rssiMIN and rssiMaxDelta values from the XML file created by the Group Policy Management Editor or remove both attributes to use the default values. #### IP Configuration You define IP configuration signals using one or more ipConfiguration elements. Each element has a string value. IpConfiguration elements do not have attributes or nested elements. @@ -197,7 +198,7 @@ The IPv6 DNS server represented in Internet standard hexadecimal encoding. An IP 21DA:00D3:0000:2F3B:02AA:00FF:FE28:9C5A%2 ``` ##### dnsSuffix -The fully qualified domain name of your organizations internal DNS suffix where any part of the fully qualified domain name in this setting exists in the computer's primary DNS suffix. The **signal** element may contain one or more **dnsSuffix** elements.
                                  +The fully qualified domain name of your organization's internal DNS suffix where any part of the fully qualified domain name in this setting exists in the computer's primary DNS suffix. The **signal** element may contain one or more **dnsSuffix** elements.
                                  **Example** ``` corp.contoso.com @@ -252,7 +253,7 @@ Contains numeric value ranging from 0 to 100 to represent the wireless network's 80 ``` -### Sample Trusted Signal Congfigurations +### Sample Trusted Signal Configurations These examples are wrapped for readability. Once properly formatted, the entire XML contents must be a single line. @@ -272,7 +273,7 @@ This example configures an IPConfig signal type using Ipv4Prefix, Ipv4DnsServer, #### Example 2 This example configures an IpConfig signal type using a dnsSuffix element and a bluetooth signal for phones. This configuration is wrapped for reading. Once properly formatted, the entire XML contents must be a single line. This example implies that either the ipconfig **or** the Bluetooth rule must evaluate to true, for the resulting signal evaluation to be true. ->[!NOTE] +>[!NOTE] >Separate each rule element using a comma. ``` @@ -318,7 +319,7 @@ This example configures Wi-Fi as a trusted signal (Windows 10, version 1803) ### How to configure Multifactor Unlock policy settings -You need a Windows 10, version 1709 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business Group Policy settings, which includes multi-factor unlock. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1709. +You need a Windows 10, version 1709 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business Group Policy settings, which includes multi-factor unlock. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1709. Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. @@ -331,6 +332,7 @@ The Group Policy object contains the policy settings needed to trigger Windows H > * PIN **must** be in at least one of the groups > * Trusted signals **must** be combined with another credential provider > * You cannot use the same unlock factor to satisfy both categories. Therefore, if you include any credential provider in both categories, it means it can satisfy either category, but not both. +> * The multifactor unlock feature is also supported via the Passport for Work CSP. See [Passport For Work CSP](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp) for more information. 1. Start the **Group Policy Management Console** (gpmc.msc) 2. Expand the domain and select the **Group Policy Object** node in the navigation pane. @@ -339,15 +341,15 @@ The Group Policy object contains the policy settings needed to trigger Windows H 5. In the content pane, right-click the **Multifactor Unlock** Group Policy object and click **Edit**. 6. In the navigation pane, expand **Policies** under **Computer Configuration**. 7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**.
                                  -![Group Policy Editor](images/multifactorUnlock/gpme.png) + ![Group Policy Editor](images/multifactorUnlock/gpme.png) 8. In the content pane, double-click **Configure device unlock factors**. Click **Enable**. The **Options** section populates the policy setting with default values.
                                  -![Multifactor Policy Setting](images/multifactorUnlock/gp-setting.png) + ![Multifactor Policy Setting](images/multifactorUnlock/gp-setting.png) 9. Configure first and second unlock factors using the information in the [Configure Unlock Factors](#configuring-unlock-factors) section. 10. If using trusted signals, configure the trusted signals used by the unlock factor using the information in the [Configure Signal Rules for the Trusted Signal Credential Provider](#configure-signal-rules-for-the-trusted-signal-credential-provider) section. 11. Click **Ok** to close the **Group Policy Management Editor**. Use the **Group Policy Management Console** to deploy the newly created Group Policy object to your organization's computers. - ## Troubleshooting -Multi-factor unlock writes events to event log under **Application and Services Logs\Microsoft\Windows\HelloForBusiness** with the category name **Device Unlock**. + ## Troubleshooting + Multi-factor unlock writes events to event log under **Application and Services Logs\Microsoft\Windows\HelloForBusiness** with the category name **Device Unlock**. ### Events diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md index bd94c85aeb..013c2a4130 100644 --- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -1,103 +1,112 @@ --- -title: Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments -description: Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments +title: Having enough Domain Controllers for Windows Hello for Business deployments +description: Guide for planning to have an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/20/2018 +ms.reviewer: --- -# Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments +# Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments **Applies to** -- Windows 10, version 1702 or later -- Hybrid or On-Premises deployment -- Key trust + +- Windows 10, version 1703 or later +- Windows Server, versions 2016 or later +- Hybrid or On-Premises deployment +- Key trust + +> [!NOTE] +>There was an issue with key trust on Windows Server 2019. To fix it, refer to [KB4487044](https://support.microsoft.com/en-us/help/4487044/windows-10-update-kb4487044). ## How many is adequate -How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 includes the KDC AS Requests performance counter. You can use these counters to determine how much of a domain controllers load is due to initial Kerberos authentication. It's important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authentication--it remains unchanged. +How can you find out how many domain controllers are needed? You can use performance monitoring on your domain controllers to determine existing authentication traffic. Windows Server 2016 and above includes the KDC AS Requests performance counter. You can use this counter to determine how much of a domain controller's load is due to initial Kerberos authentication. It's important to remember that authentication for a Windows Hello for Business key trust deployment does not affect Kerberos authentication - it remains unchanged. -Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 domain controller. +Windows 10 accomplishes Windows Hello for Business key trust authentication by mapping an Active Directory user account to one or more public keys. This mapping occurs on the domain controller, which is why the deployment needs Windows Server 2016 or later domain controllers. Public key mapping is only supported by Windows Server 2016 domain controllers and above. Therefore, users in a key trust deployment must authenticate to a Windows Server 2016 and above domain controller. -Determining an adequate number of Windows Server 2016 domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding the most current version of a domain controller (in this case Windows Server 2016) to a deployment of existing domain controllers (Windows Server 2008R2 or Windows Server 2012R2) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as "piling on". To illustrate the "piling on" concept, consider the following scenario. - -Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following. +Determining an adequate number of Windows Server domain controllers is important to ensure you have enough domain controllers to satisfy all authentication requests, including users mapped with public key trust. What many administrators do not realize is that adding a domain controller that supports public key mapping (in this case Windows Server 2016 or later) to a deployment of existing domain controllers which do not support public key mapping (Windows Server 2008R2, Windows Server 2012R2) instantly makes that single domain controller susceptible to carrying the most load, or what is commonly referred to as "piling on". To illustrate the "piling on" concept, consider the following scenario: + +Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following: ![dc-chart1](images/plan/dc-chart1.png) -The environment changes. The first change includes DC1 upgraded to Windows Server 2016 to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following. +The environment changes. The first change includes DC1 upgraded to Windows Server 2016 or later to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following: ![dc-chart2](images/plan/dc-chart2.png) -The Windows Server 2016 domain controller is handling 100 percent of all public key trust authentication. However, it is also handling 10 percent of the password authentication. Why? This behavior occurs because domain controllers 2- 10 only support password and certificate trust authentication; only a Windows Server 2016 domain controller supports authentication public key trust authentication. The Windows Server 2016 domain controller understands how to authenticate password and certificate trust authentication and will continue to share the load of authenticating those clients. Because DC1 can handle all forms of authentication, it will be bear more of the authentication load, and easily become overloaded. What if another Windows Server 2016 domain controller is added, but without deploying Windows Hello for Business to anymore clients. +The Windows Server 2016 or later domain controller is handling 100 percent of all public key trust authentication. However, it is also handling 10 percent of password authentication. Why? This behavior occurs because domain controllers 2 - 10 only support password and certificate trust authentication; only a Windows Server 2016 and above domain controller supports public key trust authentication. The Windows Server 2016 and above domain controller still understands how to authenticate password and certificate trust authentication and will continue to share the load of authenticating those clients. Because DC1 can handle all forms of authentication, it will bear more of the authentication load, and easily become overloaded. What if another Windows Server 2016 or later domain controller is added, but without deploying Windows Hello for Business to any more clients? ![dc-chart3](images/plan/dc-chart3.png) -Upgrading another Windows Server 2016 domain controller distributes the public key trust authentication across two domain controllers--each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2016 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016, but the number of WHFB clients remains the same. +Upgrading another domain controller to Windows Server 2016 or later distributes the public key trust authentication across two domain controllers - each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2019 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016 or later, but the number of WHFB clients remains the same. ![dc-chart4](images/plan/dc-chart4.png) -Domain controllers 1 through 5 now share the public key trust authentication load where each domain controller handles 20 percent of the public key trust load but they each still handle 10 percent of the password and certificate trust authentication. These domain controllers still have a heavier load than domain controllers 6 through 10; however, the load is adequately distributed. Now look the scenario when half of the client computers are upgraded to Windows Hello for Business using a key-trust deployment. +Domain controllers 1 through 5 now share the public key trust authentication load where each domain controller handles 20 percent of the public key trust load but they each still handle 10 percent of the password and certificate trust authentication. These domain controllers still have a heavier load than domain controllers 6 through 10; however, the load is adequately distributed. Now look the scenario when half of the client computers are upgraded to Windows Hello for Business using a key-trust deployment. ![dc-chart5](images/plan/dc-chart5.png) -You'll notice the distribution did not change. Each Windows Server 2016 domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentication decreased across the older domain controllers. +You'll notice the distribution did not change. Each Windows Server 2016 or later domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume of 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentications decreased across the older domain controllers. -There are several conclusions here: -* Upgrading domain controllers changes the distribution of new authentication, but doesn't change the distribution of older authentication. -* Upgrading domain controllers does not affect the distribution of password and certificate trust authentication because newer domain controllers can support password and certificate trust authentication. -* Upgraded domain controllers typically carry a heavier authentication load than down-level domain controllers because they support more forms of authentication. -* Upgrading clients to Windows Hello for Business, increases the volume of public key trust authentication distributed across domain controllers which support it and, reduces the volume of password and certificate trust authentication across all domain controllers -* Upgrading clients to Windows Hello for Business but does not affect the distribution of authentication; only the volume of authentication. +There are several conclusions here: -The preceding was an example to show why it's unrealistic to have a "one-size-fits-all" number to describe what "an adequate amount" means. In the real world, authentication is not evenly distributed across domain controllers. +- Upgrading domain controllers changes the distribution of new authentication, but doesn't change the distribution of older authentication. +- Upgrading domain controllers does not affect the distribution of password and certificate trust authentication because newer domain controllers can support password and certificate trust authentication. +- Upgraded domain controllers typically carry a heavier authentication load than down-level domain controllers because they support more forms of authentication. +- Upgrading clients to Windows Hello for Business, increases the volume of public key trust authentication distributed across domain controllers which support it and, reduces the volume of password and certificate trust authentication across all domain controllers +- Upgrading clients to Windows Hello for Business but does not affect the distribution of authentication; only the volume of authentication. + +The preceding was an example to show why it's unrealistic to have a "one-size-fits-all" number to describe what "an adequate amount" means. In the real world, authentication is not evenly distributed across domain controllers. ## Determining total AS Request load -Each organization needs to have an baseline of the AS request load that occurs in their environment. Windows Server provides the KDC AS Requests performance counter that helps you determine this. +Each organization needs to have a baseline of the AS request load that occurs in their environment. Windows Server provides the KDC AS Requests performance counter that helps you determine this. -Pick a site where you plan to upgrade the clients to Windows Hello for Business public key trust. Pick a time when authentication traffic is most significant--Monday morning is great time as everyone is returning to the office. Enable the performance counter on *all* the domain controllers in that site. Collect KDC AS Requests performance counters for two hours: -* A half-hour before you expect initial authentication (sign-ins and unlocks) to be significant -* The hour you believe initial authentication to be significant -* And a half-hour after you expect initial authentication to be significant +Pick a site where you plan to upgrade the clients to Windows Hello for Business public key trust. Pick a time when authentication traffic is most significant--Monday morning is great time as everyone is returning to the office. Enable the performance counter on *all* the domain controllers in that site. Collect KDC AS Requests performance counters for two hours: -For example, if employees are scheduled to come into the office at 9:00am. Your performance capture should begin at 8:30am and end at 10:30am. Ensure your performance logs do not wrap the data. You want to see authentication trend upward, peak, and trend downward. +- A half-hour before you expect initial authentication (sign-ins and unlocks) to be significant +- The hour you believe initial authentication to be significant +- And a half-hour after you expect initial authentication to be significant + +For example, if employees are scheduled to come into the office at 9:00am. Your performance capture should begin at 8:30am and end at 10:30am. Ensure your performance logs do not wrap the data. You want to see authentication trend upward, peak, and trend downward. > [!NOTE] > To capture all the authentication traffic. Ensure that all computers are powered down to get the most accurate authentication information (computers and services authenticate at first power up--you need to consider this authentication in your evaluation). -Aggregate the performance data of all domain controllers. Look for the maximum KDC AS Requests for each domain controller. Find the median time when the maximum number of requests occurred for the site, this should represent when the site is experience the highest amount of authentication. - -Add the number of authentications for each domain controller for the median time. You now have the total authentication for the site during a peak time. Using this metric, you can determine the distribution of authentication across the domain controllers in the site by dividing the domain controller's authentication number for the median time by the total authentication. Multiple the quotient by 10 to convert the distribution to a percentage. To validate your math, all the distributions should equal 100 percent. +Aggregate the performance data of all domain controllers. Look for the maximum KDC AS Requests for each domain controller. Find the median time when the maximum number of requests occurred for the site, this should represent when the site is experiencing the highest amount of authentication. -Review the distribution of authentication. Hopefully, none of these are above 70 percent. It's always good to reserve some capacity for the unexpected. Also, the primary purposes of a domain controller is to provide authentication and handle Active Directory operations. Identify domain controllers with lower distributions of authentication as potential candidates for the initial domain controller upgrades in conjunction with a reasonable distribution of clients provisioned for Windows Hello for Business. +Add the number of authentications for each domain controller for the median time. You now have the total authentication for the site during a peak time. Using this metric, you can determine the distribution of authentication across the domain controllers in the site by dividing the domain controller's authentication number for the median time by the total authentication. Multiply the quotient by 10 to convert the distribution to a percentage. To validate your math, all the distributions should equal 100 percent. + +Review the distribution of authentication. Hopefully, none of these are above 70 percent. It's always good to reserve some capacity for the unexpected. Also, the primary purposes of a domain controller are to provide authentication and handle Active Directory operations. Identify domain controllers with lower distributions of authentication as potential candidates for the initial domain controller upgrades in conjunction with a reasonable distribution of clients provisioned for Windows Hello for Business. ## Monitoring Authentication -Using the same methods previously described above, monitor the Kerberos authentication after upgrading a domain controller and your first phase of Windows Hello for Business deployments. Make note of the delta of authentication before and after upgrading the domain controller to Windows Server 2016. This delta is representative of authentication resulting from the first phase of your Windows Hello for Business clients. This gives you a baseline for your environment to where you can form a statement such as + +Using the same methods described above, monitor the Kerberos authentication after upgrading a domain controller and your first phase of Windows Hello for Business deployments. Make note of the delta of authentication before and after upgrading the domain controller to Windows Server 2016 or newer. This delta is representative of authentication resulting from the first phase of your Windows Hello for Business clients. It gives you a baseline for your environment to where you can form a statement such as: ```"Every n Windows Hello for Business clients results in x percentage of key-trust authentication."``` -Where _n_ equals the number of clients you switched to Windows Hello for Business and _x_ equals the increased percentage of authentication from the upgraded domain controller. Armed with information, you can apply the observations of upgrading domain controllers and increasing Windows Hello for Business client count to appropriately phase your deployment. +Where _n_ equals the number of clients you switched to Windows Hello for Business and _x_ equals the increased percentage of authentication from the upgraded domain controller. Armed with this information, you can apply the observations of upgrading domain controllers and increasing Windows Hello for Business client count to appropriately phase your deployment. -Remember, increasing the number of clients changes the volume of authentication distributed across the Windows Server 2016 domain controllers. If there is only one Windows Server 2016 domain controller, there's no distribution and you are simply increasing the volume of authentication for which THAT domain controller is responsible. +Remember, increasing the number of clients changes the volume of authentication distributed across the Windows Server 2016 or newer domain controllers. If there is only one Windows Server 2016 or newer domain controller, there's no distribution and you are simply increasing the volume of authentication for which THAT domain controller is responsible. -Increasing the number of number of domain controllers distributes the volume of authentication, but doesn't change it. Therefore, as you add more domain controllers, the burden of authentication for which each domain controller is responsible decrease. Upgrading two domain controller changes the distribution to 50 percent. Upgrading three domain controllers changes the distribution to 33 percent, and so on. +Increasing the number of domain controllers distributes the volume of authentication, but doesn't change it. Therefore, as you add more domain controllers, the burden of authentication, for which each domain controller is responsible, decreases. Upgrading two domain controller changes the distribution to 50 percent. Upgrading three domain controllers changes the distribution to 33 percent, and so on. ## Strategy + The simplest strategy you can employ is to upgrade one domain controller and monitor the single domain controller as you continue to phase in new Windows Hello for Business key-trust clients until it reaches a 70 or 80 percent threshold. -Then, upgrade a second domain controller. Monitor the authentication on both domain controllers to determine how the authentication distributes between the two domain controllers. Introduce more Windows Hello for Business clients while monitoring the authentication on the two upgraded domain controllers. Once those reach your environments designated capacity, then upgrade another domain controller. +Then, upgrade a second domain controller. Monitor the authentication on both domain controllers to determine how the authentication distributes between the two domain controllers. Introduce more Windows Hello for Business clients while monitoring the authentication on the two upgraded domain controllers. Once those reach your environment's designated capacity, you can upgrade another domain controller. -Repeat until your deployment for that site is complete. Now, monitor authentication across all your domain controllers like you did the very first time. Determine the distribution of authentication for each domain controller. Identify the percentage of distribution for which it is responsible. If a single domain controller is responsible for 70 percent of more of the authentication, you may want to consider adding a domain controller to reduce the distribution of authentication volume. +Repeat until your deployment for that site is complete. Now, monitor authentication across all your domain controllers like you did the very first time. Determine the distribution of authentication for each domain controller. Identify the percentage of distribution for which it is responsible. If a single domain controller is responsible for 70 percent of more of the authentication, you may want to consider adding a domain controller to reduce the distribution of authentication volume. -However, before considering this, ensure the high load of authentication is not a result of applications and services where their configuration has a statically configured domain controller. Adding domain controllers will not resolve the additional authentication load problem in this scenario. Instead, manually distribute the authentication to different domain controllers among all the services or applications. Alternatively, try simply using the domain name rather than a specific domain controller. Each domain controller has an A record registered in DNS for the domain name, which DNS will round robin with each DNS query. It's not the best load balancer, however, it is a better alternative to static domain controller configurations, provided the configuration is compatible with your service or application. - +However, before considering this, ensure the high load of authentication is not a result of applications and services where their configuration has a statically-configured domain controller. Adding domain controllers will not resolve the additional authentication load problem in this scenario. Instead, manually distribute the authentication to different domain controllers among all the services or applications. Alternatively, try simply using the domain name rather than a specific domain controller. Each domain controller has an A record registered in DNS for the domain name, which DNS will round robin with each DNS query. It's not the best load balancer, however, it is a better alternative to static domain controller configurations, provided the configuration is compatible with your service or application. diff --git a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md index 097b826fd6..2eb9365b7b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md +++ b/windows/security/identity-protection/hello-for-business/hello-and-password-changes.md @@ -2,13 +2,14 @@ title: Windows Hello and password changes (Windows 10) description: When you change your password on a device, you may need to sign in with a password on other devices to reset Hello. ms.assetid: 83005FE4-8899-47A6-BEA9-C17CCA0B6B55 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -50,4 +51,4 @@ Suppose instead that you sign in on **Device B** and change your password for yo - [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) - [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) - [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md index e4763d7e10..c0e102cb90 100644 --- a/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md +++ b/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise.md @@ -1,15 +1,16 @@ --- title: Windows Hello biometrics in the enterprise (Windows 10) -description: Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. +description: Windows Hello uses biometrics to authenticate users and guard against potential spoofing, through fingerprint matching and facial recognition. ms.assetid: d3f27d94-2226-4547-86c0-65c84d6df8Bc +ms.reviewer: keywords: Windows Hello, enterprise biometrics ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -29,7 +30,7 @@ Windows Hello is the biometric authentication feature that helps strengthen auth Because we realize your employees are going to want to use this new technology in your enterprise, we’ve been actively working with the device manufacturers to create strict design and performance recommendations that help to ensure that you can more confidently introduce Windows Hello biometrics into your organization. -##How does Windows Hello work? +## How does Windows Hello work? Windows Hello lets your employees use fingerprint or facial recognition as an alternative method to unlocking a device. With Windows Hello, authentication happens when the employee provides his or her unique biometric identifier while accessing the device-specific Windows Hello credentials. The Windows Hello authenticator works to authenticate and allow employees onto your enterprise network. Authentication doesn’t roam among devices, isn’t shared with a server, and can’t easily be extracted from a device. If multiple employees share a device, each employee will use his or her own biometric data on the device. @@ -43,7 +44,7 @@ Windows Hello provides many benefits, including: - Support for Windows Hello is built into the operating system so you can add additional biometric devices and polices as part of a coordinated rollout or to individual employees or groups using Group Policy or Mobile Device Management (MDM) configurations service provider (CSP) policies.
                                  For more info about the available Group Policies and MDM CSPs, see the [Implement Windows Hello for Business in your organization](hello-manage-in-organization.md) topic. -## Where is Microsoft Hello data stored? +## Where is Windows Hello data stored? The biometric data used to support Windows Hello is stored on the local device only. It doesn’t roam and is never sent to external devices or servers. This separation helps to stop potential attackers by providing no single collection point that an attacker could potentially compromise to steal biometric data. Additionally, even if an attacker was actually able to get the biometric data, it still can’t be easily converted to a form that could be recognized by the biometric sensor. ## Has Microsoft set any device requirements for Windows Hello? @@ -71,7 +72,7 @@ To allow fingerprint matching, you must have devices with fingerprint sensors an ### Facial recognition sensors To allow facial recognition, you must have devices with integrated special infrared (IR) sensors and software. Facial recognition sensors use special cameras that see in IR light, letting them tell the difference between a photo and a living person while scanning an employee’s facial features. These sensors, like the fingerprint sensors, must also include anti-spoofing measures (required) and a way to configure them (optional). -- False Accept Rate (FAR): <0.001 +- False Accept Rate (FAR): <0.001% - False Reject Rate (FRR) without Anti-spoofing or liveness detection: <5% @@ -87,9 +88,9 @@ To allow facial recognition, you must have devices with integrated special infra - [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) - [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -  + -  + diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index 2f9757d9d9..f42095fd31 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -1,24 +1,25 @@ --- -title: Prepare and Deploy Windows Server 2016 Active Directory Federation Services (Windows Hello for Business) -description: How toPrepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business +title: Prepare & Deploy Windows AD FS certificate trust (Windows Hello for Business) +description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services (AD FS) for Windows Hello for Business, using certificate trust. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Prepare and Deploy Windows Server 2016 Active Directory Federation Services **Applies to** -- Windows 10, version 1703 or later +- Windows 10, version 1703 or later - On-premises deployment - Certificate trust @@ -37,11 +38,11 @@ A new Active Directory Federation Services farm should have a minimum of two fed Prepare the Active Directory Federation Services deployment by installing and updating two Windows Server 2016 Servers. Ensure the update listed below is applied to each server before continuing. -## Update Windows Server 2016 +## Update Windows Server 2016 Sign-in the federation server with _local admin_ equivalent credentials. -1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please advise the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed. -2. Ensure the latest server updates to the federation server includes [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). +1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please advise the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed. +2. Ensure the latest server updates to the federation server includes [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). >[!IMPORTANT] >The above referenced updates are mandatory for Windows Hello for Business all on-premises deployment and hybrid certificate trust deployments for domain joined computers. @@ -53,6 +54,7 @@ Windows Hello for Business on-premises deployments require a federation server f The AD FS role needs a server authentication certificate for the federation services, but you can use a certificate issued by your enterprise (internal) certificate authority. The server authentication certificate should have the following names included in the certificate if you are requesting an individual certificate for each node in the federation farm: * Subject Name: The internal FQDN of the federation server (the name of the computer running AD FS) * Subject Alternate Name: Your federation service name, such as *fs.corp.contoso.com* (or an appropriate wildcard entry such as *.corp.contoso.com) +* Subject Alternate Name: Your device registration service name, such as *enterpriseregistration.contoso.com* You configure your federation service name when you configure the AD FS role. You can choose any name, but that name must be different than the name of the server or host. For example, you can name the host server **adfs** and the federation service **fs**. The FQDN of the host is adfs.corp.contoso.com and the FQDN of the federation service is fs.corp.contoso.com. @@ -91,15 +93,15 @@ The Active Directory Federation Service (AD FS) role provides the following serv Windows Hello for Business depends on proper device registration. For on-premises deployments, Windows Server 2016 AD FS handles device registration. Sign-in the federation server with _Enterprise Admin_ equivalent credentials. -1. Start **Server Manager**. Click **Local Server** in the navigation pane. -2. Click **Manage** and then click **Add Roles and Features**. -3. Click **Next** on the **Before you begin** page. -4. On the **Select installation type** page, select **Role-based or feature-based installation** and click **Next**. -5. On the **Select destination server** page, choose **Select a server from the server pool**. Select the federation server from the **Server Pool** list. Click **Next**. -6. On the **Select server roles** page, select **Active Directory Federation Services**. Click **Next**. -7. Click **Next** on the **Select features** page. -8. Click **Next** on the **Active Directory Federation Service** page. -9. Click **Install** to start the role installation. +1. Start **Server Manager**. Click **Local Server** in the navigation pane. +2. Click **Manage** and then click **Add Roles and Features**. +3. Click **Next** on the **Before you begin** page. +4. On the **Select installation type** page, select **Role-based or feature-based installation** and click **Next**. +5. On the **Select destination server** page, choose **Select a server from the server pool**. Select the federation server from the **Server Pool** list. Click **Next**. +6. On the **Select server roles** page, select **Active Directory Federation Services**. Click **Next**. +7. Click **Next** on the **Select features** page. +8. Click **Next** on the **Active Directory Federation Service** page. +9. Click **Install** to start the role installation. ## Review @@ -116,13 +118,13 @@ Before you continue with the deployment, validate your deployment progress by re The service account used for the device registration server depends on the domain controllers in the environment. >[!NOTE] ->Follow the procedures below based on the domain controllers deployed in your environment. If the domain controller is not listed below, then it is not supported for Windows Hello for Business. +> Follow the procedures below based on the domain controllers deployed in your environment. If the domain controller is not listed below, then it is not supported for Windows Hello for Business. ### Windows Server 2012 or later Domain Controllers Windows Server 2012 or later domain controllers support Group Managed Service Accounts—the preferred way to deploy service accounts for services that support them. Group Managed Service Accounts, or GMSA have security advantages over normal user accounts because Windows handles password management. This means the password is long, complex, and changes periodically. The best part of GMSA is all this happens automatically. AD FS supports GMSA and should be configured using them for additional defense in depth security. -GSMA uses the Microsoft Key Distribution Service that is located on Windows Server 2012 or later domain controllers. Windows uses the Microsoft Key Distribution Service to protect secrets stored and used by the GSMA. Before you can create a GSMA, you must first create a root key for the service. You can skip this if your environment already uses GSMA. +GMSA uses the Microsoft Key Distribution Service that is located on Windows Server 2012 or later domain controllers. Windows uses the Microsoft Key Distribution Service to protect secrets stored and used by the GMSA. Before you can create a GMSA, you must first create a root key for the service. You can skip this if your environment already uses GMSA. #### Create KDS Root Key @@ -137,20 +139,20 @@ Windows Server 2008 and 2008 R2 domain controllers do not host the Microsoft Key #### Create an AD FS Service Account Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Right-click the **Users** container, Click **New**. Click **User**. -3. In the **New Object – User** window, type **adfssvc** in the **Full name** text box. Type **adfssvc** in the **User logon name** text box. Click **Next**. -4. Enter and confirm a password for the **adfssvc** user. Clear the **User must change password at next logon** check box. -5. Click **Next** and then click **Finish**. +1. Open **Active Directory Users and Computers**. +2. Right-click the **Users** container, Click **New**. Click **User**. +3. In the **New Object – User** window, type **adfssvc** in the **Full name** text box. Type **adfssvc** in the **User logon name** text box. Click **Next**. +4. Enter and confirm a password for the **adfssvc** user. Clear the **User must change password at next logon** check box. +5. Click **Next** and then click **Finish**. ## Configure the Active Directory Federation Service Role >[!IMPORTANT] ->Follow the procedures below based on the domain controllers deployed in your environment. If the domain controller is not listed below, then it is not supported for Windows Hello for Business. +> Follow the procedures below based on the domain controllers deployed in your environment. If the domain controller is not listed below, then it is not supported for Windows Hello for Business. ### Windows Server 2012 or later Domain Controllers -Use the following procedures to configure AD FS when your environment uses **Windows Server 2012 or later Domain Controllers**. If you are not using Windows Server 2012 or later Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2008 or 2008R2 Domain Controllers)](#windows-server-2008-or-2008R2-domain-controllers) section. +Use the following procedures to configure AD FS when your environment uses **Windows Server 2012 or later Domain Controllers**. If you are not using Windows Server 2012 or later Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2008 or 2008R2 Domain Controllers)](#windows-server-2008-or-2008-r2-domain-controllers) section. Sign-in the federation server with _domain administrator_ equivalent credentials. These procedures assume you are configuring the first federation server in a federation server farm. @@ -192,6 +194,9 @@ Sign-in the federation server with _domain administrator_ equivalent credentials ### Add the AD FS Service account to the KeyCredential Admin group and the Windows Hello for Business Users group +> [!NOTE] +> If you have a Windows Server 2016 domain controller in your domain, you can use the **Key Admins** group instead of **KeyCredential Administrators** and skip the **Configure Permissions for Key Registration** step. + The **KeyCredential Administrators** global group provides the AD FS service with the permissions needed to perform key registration. The Windows Hello for Business group provides the AD FS service with the permissions needed to enroll a Windows Hello for Business authentication certificate on behalf of the provisioning user. Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. @@ -204,8 +209,8 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva 7. Right-click **Windows Hello for Business Users** group 8. Click the **Members** tab and click **Add…** 9. In the **Enter the object names to select** text box, type **adfssvc**. Click **OK**. -10. Click **OK** to return to **Active Directory Users and Computers**. -11. Change to server hosting the AD FS role and restart it. +10. Click **OK** to return to **Active Directory Users and Computers**. +11. Change to server hosting the AD FS role and restart it. ### Configure Permissions for Key Registration @@ -275,7 +280,8 @@ Sign-in a certificate authority or management workstations with _domain administ 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. 5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. 6. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. -> [!NOTE] + +>[!NOTE] > The preceding step is very important. Group Managed Service Accounts (GMSA) do not support the Build from this Active Directory information option and will result in the AD FS server failing to enroll the enrollment agent certificate. You must configure the certificate template with Supply in the request to ensure that AD FS servers can perform the automatic enrollment and renewal of the enrollment agent certificate. 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. @@ -297,7 +303,7 @@ Sign-in a certificate authority or management workstations with _Domain Admin_ e 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 8. On the **Security** tab, click **Add**. Type **adfssvc** in the **Enter the object names to select text box** and click **OK**. 9. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check boxes for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. -10. Close the console. +10. Close the console. ### Configure the Windows Hello for Business Authentication Certificate template @@ -313,13 +319,13 @@ Sign-in a certificate authority or management workstations with _domain administ 6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. 8. On the **Issuance Requirements** tab, select the T**his number of authorized signatures** check box. Type **1** in the text box. - * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. + * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. 9. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. -10. On the **Request Handling** tab, select the **Renew with same key** check box. -11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. -12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Enroll** permission. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. -13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. -14. Click on the **Apply** to save changes and close the console. +10. On the **Request Handling** tab, select the **Renew with same key** check box. +11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. +12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Enroll** permission. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. +13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. +14. Click on the **Apply** to save changes and close the console. #### Mark the template as the Windows Hello Sign-in template @@ -345,14 +351,14 @@ Sign-in a certificate authority or management workstations with _Enterprise Admi Sign-in the AD FS server with domain administrator equivalent credentials. -1. Open a **Windows PowerShell** prompt. -2. Type the following command +1. Open a **Windows PowerShell** prompt. +2. Type the following command - ```PowerShell - Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication - ``` ->[!NOTE] -> If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace **WHFBEnrollmentAgent** and WHFBAuthentication in the above command with the name of your certificate templates. It’s important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority. + ```PowerShell + Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication + ``` + >[!NOTE] + > If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace **WHFBEnrollmentAgent** and WHFBAuthentication in the above command with the name of your certificate templates. It’s important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority. ### Enrollment Agent Certificate Enrollment @@ -360,6 +366,33 @@ Active Directory Federation Server used for Windows Hello for Business certifica Approximately 60 days prior to enrollment agent certificate’s expiration, the AD FS service attempts to renew the certificate until it is successful. If the certificate fails to renew, and the certificate expires, the AD FS server will request a new enrollment agent certificate. You can view the AD FS event logs to determine the status of the enrollment agent certificate. +### Service Connection Point (SCP) in Active Directory for ADFS Device Registration Service +> [!NOTE] +> Normally this script is not needed, as enabling Device Registration via the ADFS Management console already creates the objects. You can validate the SCP using the script below. For detailed information about the Device Registration Service, see [Configuring Device Registration](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn614658(v=ws.11)?redirectedfrom=MSDN) + +Now you will add the Service connection Point to ADFS device registration Service for your Active directory by running the following script: + +> [!TIP] +> Make sure to change the $enrollmentService and $configNC variables before running the script. + +```Powershell +# Replace this with your Device Registration Service endpoint +$enrollmentService = "enterpriseregistration.contoso.com" +# Replace this with your Active Directory configuration naming context +$configNC = "CN=Configuration,DC=corp,DC=contoso,DC=org" + +$de = New-Object System.DirectoryServices.DirectoryEntry +$de.Path = "LDAP://CN=Device Registration Configuration,CN=Services," + $configNC + +$deSCP = $de.Children.Add("CN=62a0ff2e-97b9-4513-943f-0d221bd30080", "serviceConnectionPoint") +$deSCP.Properties["keywords"].Add("enterpriseDrsName:" + $enrollmentService) +$deSCP.CommitChanges() +``` + +>[!NOTE] +> You can save the modified script in notepad and save them as "add-scpadfs.ps1" and the way to run it is just navigating into the script path folder and running .\add-scpAdfs.ps1. +> + ## Additional Federation Servers Organizations should deploy more than one federation server in their federation farm for high-availability. You should have a minimum of two federation services in your AD FS farm, however most organizations are likely to have more. This largely depends on the number of devices and users using the services provided by the AD FS farm. @@ -444,9 +477,9 @@ Sign-in the domain controller or administrative workstation with _Domain Admin_ ### Deploy the Intranet Zone Group Policy object -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO…** -3. In the **Select GPO** dialog box, select **Intranet Zone Settings** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO…** +3. In the **Select GPO** dialog box, select **Intranet Zone Settings** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. ## Review @@ -457,7 +490,7 @@ Before you continue with the deployment, validate your deployment progress by re * Confirm you properly configured the Windows Hello for Business authentication certificate template—to include: * Issuance requirements of an authorized signature from a certificate request agent. * The certificate template was properly marked as a Windows Hello for Business certificate template using certutil.exe - * The Windows Hello for Business Users group, or equivalent has the allow enroll and allow auto enroll permissions + * The Windows Hello for Business Users group, or equivalent has the allow enroll permissions * Confirm all certificate templates were properly published to the appropriate issuing certificate authorities. * Confirm the AD FS service account has the allow enroll permission for the Windows Hello Business authentication certificate template. * Confirm the AD FS certificate registration authority is properly configured using the `Get-AdfsCertificateAuthority` Windows PowerShell cmdlet. @@ -470,6 +503,11 @@ Before you continue with the deployment, validate your deployment progress by re You need to verify the AD FS service has properly enrolled for an enrollment agent certificate template. You can verify this is a variety ways, depending on if your service account is a normal user account or if the service account is a group managed service account. +> [!IMPORTANT] +> After following the previous steps, if you are unable to validate that the devices are, in fact, being registered automatically, there is a Group Policy at: +> **Computer Configuration > Policies > Administrative Templates > Windows Components > Device Registration >** "Register Domain Joined Computers As Devices". Set the policy to **Enabled** +> and the registration will happen automatically. + ### Event Logs Use the event logs on the AD FS service to confirm the service account enrolled for an enrollment agent certificate. First, look for the AD FS event ID 443 that confirms certificate enrollment cycle has finished. Once confirmed the AD FS certificate enrollment cycle completed review the CertificateLifecycle-User event log. In this event log, look for event ID 1006, which indicates a new certificate was installed. Details of the event log should show @@ -500,12 +538,3 @@ For detailed information about the certificate, use `Certutil -q -v [!TIP] ->Please make sure you've read [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) before proceeding any further. - -## Prerequisites - -The Azure MFA Server and User Portal servers have several prerequisites and must have connectivity to the Internet. - -### Primary MFA Server - -The Azure MFA server uses a primary and secondary replication model for its configuration database. The primary Azure MFA server hosts the writable partition of the configuration database. All secondary Azure MFA servers hosts read-only partitions of the configuration database. All production environment should deploy a minimum of two MFA Servers. - -For this documentation, the primary MFA uses the name **mf*a*** or **mfa.corp.contoso.com**. All secondary servers use the name **mfa*n*** or **mfa*n*.corp.contoso.com**, where *n* is the number of the deployed MFA server. - -The primary MFA server is also responsible for synchronizing from Active Directory. Therefore, the primary MFA server should be domain joined and fully patched. - -#### Enroll for Server Authentication - -The communication between the primary MFA server, secondary MFA servers, User Portal servers, and the client is protected using TLS, which needs a server authentication certificate. - -Sign-in the primary MFA server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (mfa.corp.contoso.com). Click **Add**. Click **OK** when finished. -9. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. - -#### Install the Web Server Role - -The Azure MFA server does not require the Web Server role, however, User Portal and the optional Mobile Application server communicate with the MFA server database using the MFA Web Services SDK. The MFA Web Services SDK uses the Web Server role. - -To install the Web Server (IIS) role, please follow [Installing IIS 7 on Windows Server 2008 or Windows Server 2008 R2](https://docs.microsoft.com/iis/install/installing-iis-7/installing-iis-7-and-above-on-windows-server-2008-or-windows-server-2008-r2) or [Installing IIS 8.5 on Windows Server 2012 R2](https://docs.microsoft.com/iis/install/installing-iis-85/installing-iis-85-on-windows-server-2012-r2) depending on the host Operating System you're going to use. - -The following services are required: -* Common Parameters > Default Document. -* Common Parameters > Directory Browsing. -* Common Parameters > HTTP Errors. -* Common Parameters > Static Content. -* Health and Diagnostics > HTTP Logging. -* Performance > Static Content Compression. -* Security > Request Filtering. -* Security > Basic Authentication. -* Management Tools > IIS Management Console. -* Management Tools > IIS 6 Management Compatibility. -* Application Development > ASP.NET 4.5. - -#### Update the Server - -Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. - -#### Configure the IIS Server’s Certificate - -The TLS protocol protects all the communication to and from the MFA server. To enable this protection, you must configure the default web site to use the previously enrolled server authentication certificate. - -Sign in the primary MFA server with _administrator_ equivalent credentials. -1. From **Administrators**, Start the **Internet Information Services (IIS) Manager** console -2. In the navigation pane, expand the node with the same name as the local computer. Expand **Settings** and select **Default Web Site**. -3. In the **Actions** pane, click **Bindings**. -4. In the **Site Bindings** dialog, Click **Add**. -5. In the **Add Site Binding** dialog, select **https** from the **Type** list. In the **SSL certificate** list, select the certificate with the name that matches the FQDN of the computer. -6. Click **OK**. Click **Close**. From the **Action** pane, click **Restart**. - -#### Configure the Web Service’s Security - -The Azure MFA Server service runs in the security context of the Local System. The MFA User Portal gets its user and configuration information from the Azure MFA server using the MFA Web Services. Access control to the information is gated by membership to the **Phonefactor Admins** security group. You need to configure the Web Service’s security to ensure the User Portal and the Mobile Application servers can securely communicate to the Azure MFA Server. Also, all User Portal server administrators must be included in the **Phonefactor Admins** security group. - -Sign in the domain controller with _domain administrator_ equivalent credentials. - -##### Create Phonefactor Admin group - -1. Open **Active Directory Users and Computers** -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **Group**. -3. In the **New Object – Group** dialog box, type **Phonefactor Admins** in Group name. -4. Click **OK**. - -##### Add accounts to the Phonefactor Admins group - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select Users. In the content pane. Right-click the **Phonefactor Admins** security group and select **Properties**. -3. Click the **Members** tab. -4. Click **Add**. Click **Object Types..** In the **Object Types** dialog box, select **Computers** and click **OK**. Enter the following user and/or computers accounts in the **Enter the object names to select** box and then click **OK**. - * The computer account for the primary MFA Server - * Group or user account that will manage the User Portal server. - - -#### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: - -* Confirm the hosts of the MFA service has enrolled a server authentication certificate with the proper names. - * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: - * Certificate serial number - * Certificate thumbprint - * Common name of the certificate - * Subject alternate name of the certificate - * Name of the physical host server - * The issued date - * The expiration date - * Issuing CA Vendor (if a third-party certificate) - -* Confirm the Web Services Role was installed with the correct configuration (including Basic Authentication, ASP.NET 4.5, etc). -* Confirm the host has all the available updates from Windows Update. -* Confirm you bound the server authentication certificate to the IIS web site. -* Confirm you created the Phonefactor Admins group. -* Confirm you added the computer account hosting the MFA service to the Phonefactor Admins group and any user account who are responsible for administrating the MFA server or User Portal. - -### User Portal Server - -The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. User Portal Administrators may be set up and granted permission to add new users and update existing users. - -The User Portal web site uses the user database that is synchronized across the MFA Servers, which enables a design to support multiple web servers for the User Portal and those servers can support internal and external customers. While the user portal web site can be installed directly on the MFA server, it is recommended to install the User Portal on a server separate from the MFA Server to protect the MFA user database, as a layered, defense-in-depth security design. - -#### Enroll for Server Authentication - -Internal and external users use the User Portal to manage their multifactor authentication settings. To protect this communication, you need to enroll all User Portal servers with a server authentication certificate. You can use an enterprise certificate to protect communication to internal User Portal servers. - -For external User Portal servers, it is typical to request a server authentication certificate from a public certificate authority. Contact a public certificate authority for more information on requesting a certificate for public use. Follow the procedures below to enroll an enterprise certificate on your User Portal server. - -Sign-in the User Portal server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (app1.corp.contoso.com). -9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your User Portal service (mfaweb.corp.contoso.com). -10. Click **Add**. Click **OK** when finished. -11. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. - -#### Install the Web Server Role - -To do this, please follow the instructions mentioned in the previous [Install the Web Server Role](#install-the-web-server-role) section. However, do **not** install Security > Basic Authentication. The user portal server does not require this. - -#### Update the Server - -Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. - -#### Configure the IIS Server’s Certificate - -To do this, please follow the instructions mentioned in the previous [Configure the IIS Server’s Certificate](#configure-the-iis-server’s-certificate) section. - -#### Create WebServices SDK user account - -The User Portal and Mobile Application web services need to communicate with the configuration database hosted on the primary MFA server. These services use a user account to communicate to authenticate to the primary MFA server. You can think of the WebServices SDK account as a service account used by other servers to access the WebServices SDK on the primary MFA server. - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **User**. -3. In the **New Object – User** dialog box, type **PFWSDK_** in the **First name** and **User logon name** boxes, where ** is the name of the primary MFA server running the Web Services SDK. Click **Next**. -4. Type a strong password and confirm it in the respective boxes. Clear **User must change password at next logon**. Click **Next**. Click **Finish** to create the user account. - -#### Add the MFA SDK user account to the Phonefactor Admins group - -Adding the WebServices SDK user account to the Phonefactor Admins group provides the user account with the proper authorization needed to access the configuration data on the primary MFA server using the WebServices SDK. - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select **Users**. In the content pane. Right-click the **Phonefactor Admins** security group and select Properties. -3. Click the Members tab. -4. Click **Add**. Click **Object Types..** Type the PFWSDK_ user name in the **Enter the object names to select** box and then click **OK**. - * The computer account for the primary MFA Server - * The Webservices SDK user account - * Group or user account that will manage the User Portal server. - - -#### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: - -* Confirm the hosts of the user portal are properly configure for load balancing and high-availability. -* Confirm the hosts of the user portal have enrolled a server authentication certificate with the proper names. - * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: - * Certificate serial number - * Certificate thumbprint - * Common name of the certificate - * Subject alternate name of the certificate - * Name of the physical host server - * The issued date - * The expiration date - * Issuing CA Vendor (if a third-party certificate) - -* Confirm the Web Server Role was properly configured on all servers. -* Confirm all the hosts have the latest updates from Windows Update. -* Confirm you created the web service SDK domain account and the account is a member of the Phonefactor Admins group. - -## Installing Primary Azure MFA Server - -When you install Azure Multi-Factor Authentication Server, you have the following options: -1. Install Azure Multi-Factor Authentication Server locally on the same server as AD FS -2. Install the Azure Multi-Factor Authentication adapter locally on the AD FS server, and then install Multi-Factor Authentication Server on a different computer (preferred deployment for production environments) - -See [Configure Azure Multi-Factor Authentication Server to work with AD FS in Windows Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12) to view detailed installation and configuration options. - -Sign-in the federation server with _Domain Admin_ equivalent credentials and follow [To install and configure the Azure Multi-Factor Authentication server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#to-install-and-configure-the-azure-multi-factor-authentication-server) for an express setup with the configuration wizard. You can re-run the authentication wizard by selecting it from the Tools menu on the server. - ->[!IMPORTANT] ->Only follow the above mention article to install Azure MFA Server. Once it is intstalled, continue configuration using this article. - -### Configuring Company Settings - -You need to configure the MFA server with the default settings it applies to each user account when it is imported or synchronized from Active Directory. - -Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. -1. Start the **Multi-Factor Server** application -2. Click **Company Settings**. -3. On the **General** Tab, select **Fail Authentication** from the **When internet is not accessible** list. -4. In **User defaults**, select **Phone Call** or **Text Message** - **Note:** You can use the mobile application; however, the configuration is beyond the scope of this document. Read [Getting started the MFA Server Mobile App Web Service](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice) to configure and use mobile application multi-factor authentication or the Install User Portal topic in the Multi-Factor Server help. -5. Select **Enable Global Services** if you want to allow Multi-Factor Authentications to be made to telephone numbers in rate zones that have an associated charge. -6. Clear the **User can change phone** check box to prevent users from changing their phone during the Multi-Factor Authentication call or in the User Portal. A consistent configuration is for users to change their phone numbers in Active Directory and let those changes synchronize to the multi-factor server using the Synchronization features in Directory Integration. -7. Select **Fail Authentication** from the **When user is disabled** list. Users should provision their account through the user portal. -8. Select the appropriate language from the **Phone call language**, **Text message language**, **Mobile app language**, and **OATH token language** lists. -9. Under default PIN rules, Select the User can change PIN check box to enable users to change their PIN during multi-factor authentication and through the user portal. -10. Configure the minimum length for the PIN. -11. Select the **Prevent weak PINs** check box to reject weak PINs. A weak PIN is any PIN that could be easily guessed by a hacker: 3 sequential digits, 3 repeating digits, or any 4 digit subset of user phone number are not allowed. If you clear this box, then there are no restrictions on PIN format. For example: User tries to reset PIN to 1235 and is rejected because it's a weak PIN. User will be prompted to enter a valid PIN. -12. Select the **Expiration days** check box if you want to expire PINs. If enabled, provide a numeric value representing the number of days the PIN is valid. -13. Select the **PIN history** check box if you want to remember previously used PINs for the user. PIN History stores old PINs for each user. Users are not allowed to reset their PIN to any value stored in their PIN History. When cleared, no PIN History is stored. The default value is 5 and range is 1 to 10. - -![Azure MFA Server Company settings configured](images/hello-mfa-company-settings.png) - -### Configuring Email Settings and Content - -If you are deploying in a lab or proof-of-concept, then you have the option of skipping this step. In a production environment, ideally, you’ll want to setup the Azure Multifactor Authentication Server and its user portal web interface prior to sending the email. The email gives your users time to visit the user portal and configure the multi-factor settings. - -Now that you have imported or synchronized with your Azure Multi-Factor Authentication server, it is advised that you send your users an email that informs them that they have been enrolled in multi-factor authentication. - -With the Azure Multi-Factor Authentication Server there are various ways to configure your users for using multi-factor authentication. For instance, if you know the users’ phone numbers or were able to import the phone numbers into the Azure Multi-Factor Authentication Server from their company’s directory, the email will let users know that they have been configured to use Azure Multi-Factor Authentication, provide some instructions on using Azure Multi-Factor Authentication and inform the user of the phone number they will receive their authentications on. - -The content of the email will vary depending on the method of authentication that has been set for the user (e.g. phone call, SMS, mobile application). For example, if the user is required to use a PIN when they authenticate, the email will tell them what their initial PIN has been set to. Users are usually required to change their PIN during their first authentication. - -If users’ phone numbers have not been configured or imported into the Azure Multi-Factor Authentication Server, or users are pre-configured to use the mobile application for authentication, you can send them an email that lets them know that they have been configured to use Azure Multi-Factor Authentication and it will direct them to complete their account enrollment through the Azure Multi-Factor Authentication User Portal. A hyperlink will be included that the user clicks on to access the User Portal. When the user clicks on the hyperlink, their web browser will open and take them to their company’s Azure Multi-Factor Authentication User Portal. - -#### Settings - -By clicking the email icon on the left you can setup the settings for sending these emails. This is where you can enter the SMTP information of your mail server and it allows you to send a blanket wide email by adding a check to the Send mails to users check box. - -#### Content - -On the Email Content tab, you will see all of the various email templates that are available to choose from. So, depending on how you have configured your users to use multi-factor authentication, you can choose the template that best suits you. - -##### Edit the Content Settings - -The Azure MFA server does not send emails, even when configured to do so, until you configured the sender information for each email template listed in the Content tab. - -Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. Click **Email** from the list of icons and click the **Email Content** tab. -3. Select an email template from the list of templates. Click **Edit**. -4. In the **Edit Email** dialog, in the **From** text box, type the email address of the person or group that should appear to have sent the email. - ![Edit email dialog within content settings](images/hello-mfa-content-edit-email.png) - -5. Optionally, customize other options in the email template. -6. When finished editing the template, Click **Apply**. -7. Click **Next** to move to the next email in the list. Repeat steps 4 and 6 to edit the changes. -8. Click **Close** when you are done editing the email templates. - -### Configuring Directory Integration Settings and Synchronization - -Synchronization keeps the Multi-Factor Authentication user database synchronized with the users in Active Directory or another LDAP Lightweight Directory Access Protocol directory. The process is similar to Importing Users from Active Directory, but periodically polls for Active Directory user and security group changes to process. It also provides for disabling or removing users removed from a container or security group and removing users deleted from Active Directory. - -It is important to use a different group memberships for synchronizing users from Active Directory and for enabling Windows Hello for Business. Keeping the group memberships separated enables you to synchronize users and configure MFA options without immediately deploying Windows Hello for Business to that user. This deployment approach provides the maximum flexibility, which gives users the ability to configure their settings before they provision Windows Hello for Business. To start provisioning, simply add the group used for synchronization to the Windows Hello for Business Users group (or equivalent if you use custom names). - -#### MultiFactorAuthAdSync Service - -The MultiFactorAuthAdSync service is a Windows service that performs the periodic polling of Active Directory. It is installed in a Stopped state and is started by the MultiFactorAuth service when configured to run. If you have a multi-server Multi-Factor Authentication configuration, the MultiFactorAuthAdSync may only be run on a single server. - -The MultiFactorAuthAdSync service uses the DirSync LDAP server extension provided by Microsoft to efficiently poll for changes. This DirSync control caller must have the "directory get changes" right and DS-Replication-Get-Changes extended control access right. By default, these rights are assigned to the Administrator and LocalSystem accounts on domain controllers. The MultiFactorAuthAdSync service is configured to run as LocalSystem by default. Therefore, it is simplest to run the service on a domain controller. The service can run as an account with lesser permissions if you configure it to always perform a full synchronization. This is less efficient, but requires less account privileges. - -#### Settings - -Configuring the directory synchronization between Active Directory and the Azure MFA server is easy. - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. -3. Click the **Synchronization** tab. -4. Select **Use Active Directory**. -5. Select **Include trusted domains** to have the Multi-Factor Authentication Server attempt to connect to domains trusted by the current domain, another domain in the forest, or domains involved in a forest trust. When not importing or synchronizing users from any of the trusted domains, clear the check box to improve performance. - -#### Synchronization - -The MFA server uses synchronization items to synchronize users from Active Directory to the MFA server database. Synchronization items enables you to synchronize a collection of users based security groups or Active Directory containers. - -You can configure synchronization items based on different criteria and filters. For the purpose of configuring Windows Hello for Business, you need to create a synchronization item based membership of the Windows Hello for Business user group. This ensures the same users who receive Windows Hello for Business policy settings are the same users synchronized to the MFA server (and are the same users with permission to enroll in the certificate). This significantly simplifies deployment and troubleshooting. - -See [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint) for more details. - -##### To add a synchronization item - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. -3. Select the **Synchronization** tab. -4. On the **Synchronization** tab, click **Add**. - ![Azure MFA Server - add synchronization item screen](images/hello-mfa-sync-item.png) - -5. In the **Add Synchronization Item** dialog, select **Security Groups** from the **View** list. -6. Select the group you are using for replication from the list of groups -7. Select **Selected Security Groups – Recursive** or, select **Security Group** from the **Import** list if you do not plan to nest groups. -8. Select **Add new users and Update existing users**. -9. Select **Disable/Remove users no longer a member** and select **Disable** from the list. -10. Select the attributes appropriate for your environment for **Import phone** and **Backup**. -11. Select **Enabled** and select **Only New Users with Phone Number** from the list. -12. Select **Send email** and select **New and Updated Users**. - -##### Configure synchronization item defaults - -1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Method Defaults** tab. -2. Select the default second factor authentication method. For example, if the second factor of authentication is a text message, select **Text message**. Select if the direction of text message authentication and if the authentication should use a one-time password or one-time password and PIN (Ensure users are configured to create a PIN if the default second factor of communication requires a PIN). - -##### Configure synchronization language defaults - -1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Language Defaults** tab. -2. Select the appropriate default language for these groups of users synchronized by these synchronization item. -3. If creating a new synchronization item, click **Add** to save the item. If editing an existing synchronization item, click **Apply** and then click **Close**. - ->[!TIP] ->For more information on these settings and the behaviors they control, see [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint). - -### Installing the MFA Web Services SDK - -The Web Service SDK section allows the administrator to install the Multi-Factor Authentication Web Service SDK. The Web Service SDK is an IIS (Internet Information Server) web service that provides an interface for integrating the full features of the Multi-Factor Authentication Server into most any application. The Web Service SDK uses the Multi-Factor Authentication Server as the data store. - -Remember the Web Services SDK is only need on the primary Multi-Factor to easily enable other servers access to the configuration information. The prerequisites section guided you through installing and configuring the items needed for the Web Services SDK, however the installer will validate the prerequisites and make suggest any corrective action needed. - -Please follow the instructions under [Install the web service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice#install-the-web-service-sdk) to install the MFA Web Services SDK. - -## Install Secondary MFA Servers - -Additional MFA servers provided redundancy of the MFA configuration. The MFA server models uses one primary MFA server with multiple secondary servers. Servers within the same group establish communication with the primary server for that group. The primary server replicates to each of the secondary servers. You can use groups to partition the data stored on different servers, for example you can create a group for each domain, forest, or organizational unit. - -Follow the same procedures for installing the primary MFA server software for each additional server. Remember that each server must be activated. - -Sign in the secondary MFA server with _domain administrator_ equivalent credentials. -1. Once the Multi-Factor Authentication Server console starts, you must configure the current server’s replication group membership. You have the option to join an existing group or create a new group. When joining an existing group, the server becomes a secondary server in the existing replication group. When creating a new group, the server becomes the primary server of that replication group. Click **OK**. - **Note:** Group membership cannot be changed after activation. If a server was joined to the wrong group, it must be activated again to join a different group. Please contact support for assistance with deactivating and reactivating a server. -2. The console asks you if you want to enable replication by running the **Multi-Server Configuration Wizard**. Click **Yes**. -3. In the **Multi-Server Configuration Wizard**, leave **Active Directory** selected and clear **Certificates**. Click **Next**. -4. On the **Active Directory** page, the wizard determines what configuration is needed to enable replication. Typically, the wizard recommends adding the computer account for the current server to the **PhoneFactor Admin** group. Click **Next** to add the computer account to the group. -5. On the **Multi-Server Configuration Complete** page, click **Finish** to reboot the computer to update its group membership. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm you downloaded the latest Azure MFA Server from the Azure Portal. -* Confirm the server has Internet connectivity. -* Confirm you installed and activated the Azure MFA Server. -* Confirm your Azure MFA Server configuration meets your organization’s needs (Company Settings, Email Settings, etc). -* Confirm you created Directory Synchronization items based on your deployment to synchronize users from Active Directory to the Azure MFA server. - * For example, you have security groups representing each collection of users that represent a phase of your deployment and a corresponding synchronization item for each of those groups. - -* Confirm the Azure MFA server properly communicates with the Azure MFA cloud service by testing multifactor authentication with a newly synchronized user account. -* Confirm you installed the Web Service SDK on the primary MFA server. -* Confirm your MFA servers have adequate redundancy, should you need to promote a secondary server to the primary server. - - -## Installing the User Portal Server - -You previously configured the User Portal settings on the primary MFA server. The User Portal web application communicates to the primary MFA server using the Web Services SDK to retrieve these settings. This configuration is ideal to ensure you can scale up the User Portal application to meet the needs of your internal users. - -### Copying the User Portal Installation file - -Sign in the primary MFA server with _local administrator_ equivalent credentials. -1. Open Windows Explorer. -2. Browse to the C:\Program Files\MultiFactor Authentication Server folder. -3. Copy the **MultiFactorAuthenticationUserPortalSetup64.msi** file to a folder on the User Portal server. - -### Configure Virtual Directory name - -Sign in the User Portal server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to the folder to which you saved the installation file from the previous step. -2. Run the **MultiFactorAuthenticationUserPortalSetup64.msi**. The installation package asks if you want to download **Visual Studio C++ Redistributable for Visual Studio 2015**. Click **Yes**. When prompted, select **Save As**. The downloaded file is missing its file extension. **Save the file with a .exe extension and install the runtime**. -3. Run the installation package again. The installer package asks about the C++ runtime again; however, this is for the X64 version (the previous prompt was for x86). Click **Yes** to download the installation package and select **Save As** so you can save the downloaded file with a .exe extension. **Install** the run time. -4. Run the User Portal installation package. On the **Select Installation Address** page, use the default settings for **Site** and **Application Pool** settings. You can modify the Virtual directory to use a name that is more fitting for the environment, such as **mfa** (This virtual directory must match the virtual directory specified in the User Portal settings). Click **Next**. -5. Click **Close**. - -### Edit MFA User Portal config file - -Sign in the User Portal server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to C:\inetpub\wwwroot\MultiFactorAuth (or appropriate directory based on the virtual directory name) and edit the **web.config** file. -2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. -3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. -4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. -5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from **“http://localhost:4898/PfWsSdk.asmx”** to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. https://computer1.domain.local/MultiFactorAuthWebServiceSdk/PfWsSdk.asmx). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the Internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **web.config** file after changes have been made. - -### Create a DNS entry for the User Portal web site - -Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials. -1. Open the **DNS Management** console. -2. In the navigation pane, expand the domain controller name node and **Forward Lookup Zones**. -3. In the navigation pane, select the node that has the name of your internal Active Directory domain name. -4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**. -5. In the **name** box, type the host name of the User Portal, such as *mfaweb* (this name must match the name of the certificate used to secure communication to the User Portal). In the IP address box, type the load balanced **IP address** of the User Portal. Click **Add Host**. -6. Close the **DNS Management** console. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the user portal application is properly installed on all user portal hosts -* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. -* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME -* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. -* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. -* Confirm you saved the changes to the web.config file. - -### Validating your work - -Windows Hello for Business is a distributed system, which on the surface appears complex and difficult. The key to a successful Windows Hello for Business deployment is to validate phases of work prior to moving to the next phase. - -Using a web browser, navigate to the URL provided in the *pf_up_pfwssdk_PfWsSdk* named value in the web.config file of any one of the user portal servers. The URL should be protected by a server authentication certificate and should prompt you for authentication. Authenticate to the web site using the username and password provided in the web.config file. Successful authentication and page view confirms the Web SDK configured on the primary MFA server is correctly configured and ready to work with the user portal. - -### Configuring the User Portal - -The User Portal section allows the administrator to install and configure the Multi-Factor Authentication User Portal. The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. -User Portal Administrators may be set up and granted permission to add new users and update existing users. - -#### Settings - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the Multi-Factor Authentication Server console. -2. From the Multi-Factor Authentication Server window, click the User Portal icon. - ![Azure MFA Server - User Portal settings](images/hello-mfa-user-portal-settings.png) - -3. On the Settings tab, type the URL your users use to access the User Portal. The URL should begin with https, such as `https://mfaportal.corp.contoso.com/mfa`. -The Multi-Factor Authentication Server uses this information when sending emails to users. -4. Select Allow users to log in and Allow user enrollment check boxes. -5. Select Allow users to select method. Select Phone call and select Text message (you can select Mobile application later once you have deployed the Mobile application web service). Select Automatically trigger user’s default method. -6. Select Allow users to select language. -7. Select Use security questions for fallback and select 4 from the Questions to answer list. - ->[!TIP] ->For more information on these settings and the behaviors they control, see [Deploy the user portal for the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal). - -#### Administrators - -The User Portal Settings tab allows the administrator to install and configure the User Portal. -1. Open the Multi-Factor Authentication Server console. -2. From the Multi-Factor Authentication Server window, click the User Portal icon. -3. On the Administrators tab, Click Add -4. In the Add Administrator dialog, Click Select User… to pick a user to install and manage the User Portal. Use the default permissions. -5. Click Add. - ->[!TIP] ->For more information on these settings and the behaviors they control, read the **Multi-Factor Authentication Server Help content**. - -#### Security Questions - -[Security questions](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#security-questions) for the User Portal may be customized to meet your requirements. The questions defined here will be offered as options for each of the four security questions a user is prompted to configure during their first log on to User Portal. The order of the questions is important since the first four items in the list will be used as defaults for the four security questions. - -#### Trusted IPs - -The [Trusted IPs](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#trusted-ips) tab allows you to skip Multi-Factor Authentication for User Portal log ins originating from specific IPs. For example, if users use the User Portal from the office and from home, you may decide you don't want their phones ringing for Multi-Factor Authentication while at the office. For this, you would specify the office subnet as a trusted IP entry. - -## Configure the AD FS Server to use the MFA for multifactor authentication - -You need to configure the AD FS server to use the MFA server. You do this by Installing the MFA Adapter on the primary AD FS Server. - -### Install the MFA AD FS Adapter - -Follow [Install a standalone instance of the AD FS adapter by using the Web Service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12#install-a-standalone-instance-of-the-ad-fs-adapter-by-using-the-web-service-sdk). You should follow this instructions on all AD FS servers. You can find the files needed on the MFA server. - -### Edit the MFA AD FS Adapter config file on all ADFS Servers - -Sign in the primary AD FS server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to **C:\inetpub\wwwroot\MultiFactorAuth** (or appropriate directory based on the virtual directory name) and edit the **MultiFactorAuthenticationAdfsAdapter.config** file. -2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. -3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. -4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. -5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from “http://localhost:4898/PfWsSdk.asmx” to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. https://computer1.domain.local/MultiFactorAuthWebServiceSdk/PfWsSdk.asmx). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the Internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **MultiFactorAuthenticationAdfsAdapter.config** file after changes have been made. - -### Edit the AD FS Adapter Windows PowerShell cmdlet - -Sign in the primary AD FS server with _local administrator_ equivalent credentials. - -Edit the **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script adding `-ConfigurationFilePath ` to the end of the `Register-AdfsAuthenticationProvider` command where **** is the full path to the **MultiFactorAuthenticationAdfsAdapter.config** file. - -### Run the AD FS Adapter PowerShell cmdlet - -Sign in the primary AD FS server with local administrator equivalent credentials. - -Run **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script in PowerShell to register the adapter. The adapter is registered as **WindowsAzureMultiFactorAuthentication**. - ->[!NOTE] ->You must restart the AD FS service for the registration to take effect. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the user portal application is properly installed on all user portal hosts -* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. -* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME -* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. -* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. -* Confirm you saved the changes to the web.config file. -* Confirm you restarted the AD FS Service after completing the configuration. - -## Test Multifactor Authentication - -Now, you should test your Azure Multi-Factor Authentication server configuration before proceeding any further in the deployment. The AD FS and Azure Multi-Factor Authentication server configurations are complete. - -1. In the **Multi-Factor Authentication** server, on the left, click **Users**. -2. In the list of users, select a user that is enabled and has a valid phone number to which you have access. -3. Click **Test**. -4. In the **Test User** dialog, provide the user’s password to authenticate the user to Active Directory. - -The Multi-Factor Authentication server communicates with the Azure MFA cloud service to perform a second factor authentication for the user. The Azure MFA cloud service contacts the phone number provided and asks for the user to perform the second factor authentication configured for the user. Successfully providing the second factor should result in the Multi-factor authentication server showing a success dialog. - - -## Follow the Windows Hello for Business on premises certificate trust deployment guide -1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) -2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) -3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) -4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md index 1528aad8e3..7f7f59156a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-policy-settings.md @@ -1,19 +1,20 @@ --- -title: Configure Windows Hello for Business Policy settings (Windows Hello for Business) -description: Configure Windows Hello for Business Policy settings for Windows Hello for Business +title: Configure Windows Hello for Business Policy settings - certificate trust +description: Configure Windows Hello for Business Policy settings for Windows Hello for Business. Certificate-based deployments need three group policy settings. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/20/2018 +ms.reviewer: --- # Configure Windows Hello for Business Policy settings @@ -22,12 +23,9 @@ ms.date: 08/20/2018 - On-premises deployment - Certificate trust - -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. -Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. - On-premises certificate-based deployments of Windows Hello for Business needs three Group Policy settings: * Enable Windows Hello for Business * Use certificate for on-premises authentication @@ -35,9 +33,9 @@ On-premises certificate-based deployments of Windows Hello for Business needs th ## Enable Windows Hello for Business Group Policy -The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should be attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled. +The Group Policy setting determines whether users are allowed, and prompted, to enroll for Windows Hello for Business. It can be configured for computers or users. -You can configure the Enable Windows Hello for Business Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. Additionally, you can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence. +If you configure the Group Policy for computers, all users that sign-in to those computers will be allowed and prompted to enroll for Windows Hello for Business. If you configure the Group Policy for users, only those users will be allowed and prompted to enroll for Windows Hello for Business . ## Use certificate for on-premises authentication @@ -75,7 +73,7 @@ The Group Policy object contains the policy settings needed to trigger Windows H 7. Select **Enabled** from the **Configuration Model** list. 8. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. 9. Select the **Update certificates that use certificate templates** check box. -10. Click **OK**. Close the **Group Policy Management Editor**. +10. Click **OK**. Close the **Group Policy Management Editor**. ## Configure Security in the Windows Hello for Business Group Policy object diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md index 18164a1c75..f3b86a3536 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md @@ -1,19 +1,20 @@ --- -title: Validate Active Directory prerequisites (Windows Hello for Business) -description: How to Validate Active Directory prerequisites for Windows Hello for Business +title: Update Active Directory schema for cert-trust deployment (Windows Hello for Business) +description: How to Validate Active Directory prerequisites for Windows Hello for Business when deploying with the certificate trust model. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Validate Active Directory prerequisites @@ -23,7 +24,7 @@ ms.date: 08/19/2018 - Certificate trust -The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The certificate trust model requires manually updating the current schema to the Windows Server 2016 schema. If you already have a Windows Server 2016 domain controller in your forest, you can skip the next step. +The key registration process for the On-premises deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema. The key-trust model receives the schema extension when the first Windows Server 2016 domain controller is added to the forest. The certificate trust model requires manually updating the current schema to the Windows Server 2016 schema. If you already have a Windows Server 2016 domain controller in your forest, you can skip the **Updating the Schema** and **Create the KeyCredential Admins Security Global Group** steps. Manually updating Active Directory uses the command-line utility **adprep.exe** located at **\:\support\adprep** on the Windows Server 2016 DVD or ISO. Before running adprep.exe, you must identify the domain controller hosting the schema master role. @@ -43,11 +44,11 @@ Windows Hello for Business uses asymmetric keys as user credentials (rather than Sign-in to the domain controller hosting the schema master operational role using enterprise administrator equivalent credentials. -1. Open an elevated command prompt. -2. Type ```cd /d x:\support\adprep``` where *x* is the drive letter of the DVD or mounted ISO. -3. To update the schema, type ```adprep /forestprep```. -4. Read the Adprep Warning. Type the letter **C** and press **Enter** to update the schema. -5. Close the Command Prompt and sign-out. +1. Open an elevated command prompt. +2. Type ```cd /d x:\support\adprep``` where *x* is the drive letter of the DVD or mounted ISO. +3. To update the schema, type ```adprep /forestprep```. +4. Read the Adprep Warning. Type the letter **C** and press **Enter** to update the schema. +5. Close the Command Prompt and sign-out. ## Create the KeyCredential Admins Security Global Group @@ -55,25 +56,25 @@ The Windows Server 2016 Active Directory Federation Services (AD FS) role regist Sign-in a domain controller or management workstation with domain administrator equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Click **View** and click **Advance Features**. -3. Expand the domain node from the navigation pane. -4. Right-click the **Users** container. Click **New**. Click **Group**. -5. Type **KeyCredential Admins** in the **Group Name** text box. -6. Click **OK**. +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advance Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **KeyCredential Admins** in the **Group Name** text box. +6. Click **OK**. ## Create the Windows Hello for Business Users Security Global Group The Windows Hello for Business Users group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy and Certificate template permissions to this group to simplify the deployment by simply adding the users to the group. This provides them the proper permissions to provision Windows Hello for Business and to enroll in the Windows Hello for Business authentication certificate. -Sign-in a domain controller or management workstation with domain administrator equivalent credentials. +Sign into a domain controller or management workstation with domain administrator equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Click **View** and click **Advanced Features**. -3. Expand the domain node from the navigation pane. -4. Right-click the **Users** container. Click **New**. Click **Group**. -5. Type **Windows Hello for Business Users** in the **Group Name** text box. -6. Click **OK**. +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advanced Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **Windows Hello for Business Users** in the **Group Name** text box. +6. Click **OK**. ## Follow the Windows Hello for Business on premises certificate trust deployment guide @@ -81,4 +82,4 @@ Sign-in a domain controller or management workstation with domain administrator 2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) 4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) \ No newline at end of file +5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md index ac2f4ba332..4681b5725d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-deploy-mfa.md @@ -1,54 +1,38 @@ --- -title: Validate and Deploy Multifactor Authentication Services (MFA) (Windows Hello for Business) -description: How to Validate and Deploy Multifactor Authentication Services for Windows Hello for Business +title: Validate and Deploy MFA for Windows Hello for Business with certificate trust +description: How to Validate and Deploy Multifactor Authentication (MFA) Services for Windows Hello for Business with certificate trust keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- -# Validate and Deploy Multifactor Authentication Services (MFA) +# Validate and Deploy Multi-factor Authentication (MFA) **Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Certificate trust +- Windows 10, version 1703 or later +- On-premises deployment +- Certificate trust -Windows Hello for Business requires all users perform multi-factor authentication prior to creating and registering a Windows Hello for Business credential. Windows Hello for Business deployments use Azure Multi-Factor Authentication (Azure MFA) services for the secondary authentication. On-Premises deployments use Azure MFA server, an on-premises implementation that do not require synchronizing Active Directory credentials to Azure Active Directory. +Windows Hello for Business requires all users perform multi-factor authentication prior to creating and registering a Windows Hello for Business credential. On-premises deployments can use certificates, third-party authentication providers for AD FS, or a custom authentication provider for AD FS as an on-premises MFA option. -Azure Multi-Factor Authentication is an easy to use, scalable, and reliable solution that provides a second method of authentication so your users are always protected. -* **Easy to Use** - Azure Multi-Factor Authentication is simple to set up and use. The extra protection that comes with Azure Multi-Factor Authentication allows users to manage their own devices. Best of all, in many instances it can be set up with just a few simple clicks. -* **Scalable** - Azure Multi-Factor Authentication uses the power of the cloud and integrates with your on-premises AD and custom applications. This protection is even extended to your high-volume, mission-critical scenarios. -* **Always Protected** - Azure Multi-Factor Authentication provides strong authentication using the highest industry standards. -* **Reliable** - We guarantee 99.9% availability of Azure Multi-Factor Authentication. The service is considered unavailable when it is unable to receive or process verification requests for the two-step verification. +For information on available third-party authentication methods see [Configure Additional Authentication Methods for AD FS](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs). For creating a custom authentication method see [Build a Custom Authentication Method for AD FS in Windows Server](https://docs.microsoft.com/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method) -## On-Premises Azure MFA Server - -On-premises deployments, both key and certificate trust, use the Azure MFA server where the credentials are not synchronized to Azure Active Directory. - -### Infrastructure - -A lab or proof-of-concept environment does not need high-availability or scalability. However, a production environment needs both of these. Ensure your environment considers and incorporates these factors, as necessary. All production environments should have a minimum of two MFA servers—one primary and one secondary server. The environment should have a minimum of two User Portal Servers that are load balanced using hardware or Windows Network Load Balancing. - -Please follow [Download the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#download-the-azure-multi-factor-authentication-server) to download Azure MFA server. - ->[!IMPORTANT] ->Make sure to validate the requirements for Azure MFA server, as outlined in [Install and Configure the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#install-and-configure-the-azure-multi-factor-authentication-server) before proceeding. Do not use instllation instructions provided in the article. - -Once you have validated all the requirements, please proceed to [Configure or Deploy Multifactor Authentication Services](hello-cert-trust-deploy-mfa.md). +Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-authentication-policies). ## Follow the Windows Hello for Business on premises certificate trust deployment guide 1. [Validate Active Directory prerequisites](hello-cert-trust-validate-ad-prereq.md) 2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) 4. Validate and Deploy Multifactor Authentication Services (MFA) (*You are here*) -5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) \ No newline at end of file +5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md index 89d53fc368..067d2d3504 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki.md @@ -1,19 +1,20 @@ --- -title: Validate Public Key Infrastructure (Windows Hello for Business) -description: How to Validate Public Key Infrastructure for Windows Hello for Business +title: Validate Public Key Infrastructure - certificate trust model (Windows Hello for Business) +description: How to Validate Public Key Infrastructure for Windows Hello for Business, under a certificate trust model. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Validate and Configure Public Key Infrastructure @@ -62,15 +63,15 @@ Domain controllers automatically request a domain controller certificate (if pub By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the Kerberos Authentication certificate template as a baseline to create an updated domain controller certificate template. Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise’s needs. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Templates Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise’s needs. **Note**If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. -6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. -8. Close the console. +6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +8. Close the console. ### Superseding the existing Domain Controller certificate @@ -79,15 +80,15 @@ Many domain controllers may have an existing domain controller certificate. The The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers and should be the one you deploy to all your domain controllers (2008 or later). The autoenrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate using the Kerberos Authentication certificate template. Sign-in to a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. -4. Click the **Superseded Templates** tab. Click **Add**. -5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. -6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. -7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. -8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. -9. Click **OK** and close the **Certificate Templates** console. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Templates Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. +4. Click the **Superseded Templates** tab. Click **Add**. +5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. +6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. Click **Add**. +7. From the **Add Superseded Template** dialog, select the **Kerberos Authentication** certificate template and click **OK**. Click **Add**. +8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. +9. Click **OK** and close the **Certificate Templates** console. The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. @@ -96,17 +97,17 @@ The certificate template is configured to supersede all the certificate template Windows 10 clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate. Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and click **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Templates Console**, right-click the **Web Server** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. **Note:** If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. -6. On the **Request Handling** tab, select **Allow private key to be exported**. -7. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. -8. On the **Security** tab, Click **Add**. Type **Domain Computers** in the **Enter the object names to select** box. Click **OK**. Select the **Allow** check box next to the **Enroll** permission. -9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. -10. Close the console. +6. On the **Request Handling** tab, select **Allow private key to be exported**. +7. On the **Subject Name** tab, select the **Supply in the request** button if it is not already selected. +8. On the **Security** tab, Click **Add**. Type **Domain Computers** in the **Enter the object names to select** box. Click **OK**. Select the **Allow** check box next to the **Enroll** permission. +9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +10. Close the console. ### Unpublish Superseded Certificate Templates @@ -115,11 +116,11 @@ The certificate authority only issues certificates based on published certificat The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities. Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. -5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. +5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. ### Publish Certificate Templates to the Certificate Authority @@ -140,25 +141,25 @@ Sign-in to the certificate authority or management workstations with an _enterpr Domain controllers automatically request a certificate from the domain controller certificate template. However, the domain controller is unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment and link the Group Policy object to the Domain Controllers OU. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. Expand the domain and select the **Group Policy Object** node in the navigation pane. -3. Right-click **Group Policy object** and select **New** -4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. -5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. -6. In the navigation pane, expand **Policies** under **Computer Configuration**. -7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. -8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. -9. Select **Enabled** from the **Configuration Model** list. -10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. -11. Select the **Update certificates that use certificate templates** check box. -12. Click **OK**. Close the **Group Policy Management Editor**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New** +4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. +5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **Computer Configuration**. +7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. +8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. +9. Select **Enabled** from the **Configuration Model** list. +10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +11. Select the **Update certificates that use certificate templates** check box. +12. Click **OK**. Close the **Group Policy Management Editor**. ### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object Sign-in to a domain controller or management workstations with _Domain Admin_ equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…** -3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…** +3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. ### Validating your work @@ -168,11 +169,11 @@ You want to confirm your domain controllers enroll the correct certificates and #### Use the Event Logs -Windows Server 2012 and later include Certificate Lifecycle events to determine the lifecycles of certificates for both users and computers. Using the Event Viewer, navigate to the **CertificateServices-Lifecycles-System** event log under **Application and Services/Microsoft/Windows**. +Windows Server 2012 and later include Certificate Lifecycle events to determine the lifecycles of certificates for both users and computers. Using the Event Viewer, navigate to the **CertificateServicesClient-Lifecycle-System** event log under **Application and Services/Microsoft/Windows**. Look for an event indicating a new certificate enrollment (autoenrollment). The details of the event include the certificate template on which the certificate was issued. The name of the certificate template used to issue the certificate should match the certificate template name included in the event. The certificate thumbprint and EKUs for the certificate are also included in the event. The EKU needed for proper Windows Hello for Business authentication is Kerberos Authentication, in addition to other EKUs provide by the certificate template. -Certificates superseded by your new domain controller certificate generate an archive event in the CertificateServices-Lifecycles-System event. The archive event contains the certificate template name and thumbprint of the certificate that was superseded by the new certificate. +Certificates superseded by your new domain controller certificate generate an archive event in the CertificateServicesClient-Lifecycle-System event. The archive event contains the certificate template name and thumbprint of the certificate that was superseded by the new certificate. #### Certificate Manager diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md index 4aeeb5bb8b..c8f3f83f76 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-cert-trust.md @@ -1,19 +1,20 @@ --- title: Windows Hello for Business Deployment Guide - On Premises Certificate Trust Deployment -description: A guide to an On Premises, Certificate trust Windows Hello for Business deployment +description: A guide to on premises, certificate trust Windows Hello for Business deployment. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # On Premises Certificate Trust Deployment @@ -30,4 +31,4 @@ Below, you can find all the information you will need to deploy Windows Hello fo 2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) 4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) \ No newline at end of file +5. [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index 36e3dad339..d1efe88759 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -7,20 +7,20 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/29/2018 +ms.reviewer: --- # Windows Hello for Business Deployment Guide **Applies to** - Windows 10, version 1703 or later - Windows Hello for Business is the springboard to a world without passwords. It replaces username and password sign-in to Windows with strong user authentication based on an asymmetric key pair. This deployment guide is to guide you through deploying Windows Hello for Business, based on the planning decisions made using the Planning a Windows Hello for Business Deployment Guide. It provides you with the information needed to successfully deploy Windows Hello for Business in an existing environment. @@ -51,15 +51,22 @@ The trust model determines how you want users to authenticate to the on-premises * The certificate-trust model is for enterprise that *do* want to issue end-entity certificates to their users and have the benefits of certificate expiration and renewal, similar to how smart cards work today. * The certificate trust model also supports enterprises which are not ready to deploy Windows Server 2016 Domain Controllers. -Following are the various deployment guides included in this topic: +> [!NOTE] +> Remote Desktop Protocol (RDP) does not support authentication with Windows Hello for Business key trust deployments. RDP is only supported with certificate trust deployments at this time. See [Remote Desktop](hello-feature-remote-desktop.md) to learn more. + +Following are the various deployment guides and models included in this topic: - [Hybrid Azure AD Joined Key Trust Deployment](hello-hybrid-key-trust.md) - [Hybrid Azure AD Joined Certificate Trust Deployment](hello-hybrid-cert-trust.md) - [Azure AD Join Single Sign-on Deployment Guides](hello-hybrid-aadj-sso.md) - [On Premises Key Trust Deployment](hello-deployment-key-trust.md) - [On Premises Certificate Trust Deployment](hello-deployment-cert-trust.md) +> [!NOTE] +> For Windows Hello for Business hybrid [certificate trust prerequisites](hello-hybrid-cert-trust-prereqs.md#directory-synchronization) and [key trust prerequisites](hello-hybrid-key-trust-prereqs.md#directory-synchronization) deployments, you will need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory. For on-premises deployments, both key and certificate trust, use the Azure MFA server where the credentials are not synchronized to Azure Active Directory. Learn how to [deploy Multifactor Authentication Services (MFA) for key trust](hello-key-trust-validate-deploy-mfa.md) and [for certificate trust](hello-cert-trust-validate-deploy-mfa.md) deployments. ## Provisioning Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. +> [!NOTE] +> You need to allow access to the URL account.microsoft.com to initiate Windows Hello for Business provisioning. This URL launches the subsequent steps in the provisioning process and is required to successfully complete Windows Hello for Business provisioning. This URL does not require any authentication and as such, does not collect any user data. diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md index 0d99dddd85..e748408fb5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-key-trust.md @@ -1,19 +1,20 @@ --- title: Windows Hello for Business Deployment Guide - On Premises Key Deployment -description: A guide to an On Premises, Certificate trust Windows Hello for Business deployment +description: A guide to on premises, key trust Windows Hello for Business deployment. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/20/2018 +ms.reviewer: --- # On Premises Key Trust Deployment diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index d392da1bd0..300a074c68 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -2,14 +2,15 @@ title: Windows Hello errors during PIN creation (Windows 10) description: When you set up Windows Hello in Windows 10, you may get an error during the Create a work PIN step. ms.assetid: DFEFE22C-4FEF-4FD9-BFC4-9B419C339502 +ms.reviewer: keywords: PIN, error, create a work PIN ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: troubleshooting @@ -40,190 +41,64 @@ When a user encounters an error when creating the work PIN, advise the user to t 5. On mobile devices, if you are unable to setup a PIN after multiple attempts, reset your device and start over. For help on how to reset your phone go to [Reset my phone](https://go.microsoft.com/fwlink/p/?LinkId=715697). If the error occurs again, check the error code against the following table to see if there is another mitigation for that error. When no mitigation is listed in the table, contact Microsoft Support for assistance. - +| Hex | Cause | Mitigation | +| :--------- | :----------------------------------------------------------------- | :------------------------------------------ | +| 0x80090005 | NTE\_BAD\_DATA | Unjoin the device from Azure AD and rejoin. | +| 0x8009000F | The container or key already exists. | Unjoin the device from Azure AD and rejoin. | +| 0x80090011 | The container or key was not found. | Unjoin the device from Azure AD and rejoin. | +| 0x80090029 | TPM is not set up. | Sign on with an administrator account. Click **Start**, type "tpm.msc", and select **tpm.msc Microsoft Common Console Document**. In the **Actions** pane, select **Prepare the TPM**. | +| 0x8009002A | NTE\_NO\_MEMORY | Close programs which are taking up memory and try again. | +| 0x80090031 | NTE\_AUTHENTICATION\_IGNORED | Reboot the device. If the error occurs again after rebooting, [reset the TPM](https://go.microsoft.com/fwlink/p/?LinkId=619969) or run [Clear-TPM](https://go.microsoft.com/fwlink/p/?LinkId=629650). | +| 0x80090035 | Policy requires TPM and the device does not have TPM. | Change the Windows Hello for Business policy to not require a TPM. | +| 0x80090036 | User canceled an interactive dialog. | User will be asked to try again. | +| 0x801C0003 | User is not authorized to enroll. | Check if the user has permission to perform the operation​. | +| 0x801C000E | Registration quota reached. | Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](https://go.microsoft.com/fwlink/p/?LinkId=626933). | +| 0x801C000F | Operation successful, but the device requires a reboot. | Reboot the device. | +| 0x801C0010 | The AIK certificate is not valid or trusted. | Sign out and then sign in again. | +| 0x801C0011 | The attestation statement of the transport key is invalid. | Sign out and then sign in again. | +| 0x801C0012 | Discovery request is not in a valid format. | Sign out and then sign in again. | +| 0x801C0015 | The device is required to be joined to an Active Directory domain. | ​Join the device to an Active Directory domain. | +| 0x801C0016 | The federation provider configuration is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the file is not empty. | +| 0x801C0017 | ​The federation provider domain is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the FPDOMAINNAME element is not empty. | +| 0x801C0018 | The federation provider client configuration URL is empty | Go to http://clientconfig.microsoftonline-p.net/FPURL.xml and verify that the CLIENTCONFIG element contains a valid URL. | +| 0x801C03E9 | Server response message is invalid | Sign out and then sign in again. | +| 0x801C03EA | Server failed to authorize user or device. | Check if the token is valid and user has permission to register Windows Hello for Business keys. | +| 0x801C03EB | Server response http status is not valid | Sign out and then sign in again. | +| 0x801C03EC | Unhandled exception from server. | sign out and then sign in again. | +| 0x801C03ED | Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed.

                                  -or-

                                  Token was not found in the Authorization header.

                                  -or-

                                  Failed to read one or more objects.

                                  -or-

                                  The request sent to the server was invalid. | Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin. +| 0x801C03EE | Attestation failed. | Sign out and then sign in again. | +| 0x801C03EF | The AIK certificate is no longer valid. | Sign out and then sign in again. | +| 0x801C03F2 | Windows Hello key registration failed. | ERROR\_BAD\_DIRECTORY\_REQUEST. Another object with the same value for property proxyAddresses already exists. To resolve the issue refer to [Duplicate Attributes Prevent Dirsync](https://docs.microsoft.com/office365/troubleshoot/administration/duplicate-attributes-prevent-dirsync). +| 0x801C044D | Authorization token does not contain device ID. | Unjoin the device from Azure AD and rejoin. | +| | Unable to obtain user token. | Sign out and then sign in again. Check network and credentials. | +| 0x801C044E | Failed to receive user credentials input. | Sign out and then sign in again. | - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                  HexCauseMitigation
                                  0x801C044DAuthorization token does not contain device IDUnjoin the device from Azure AD and rejoin
                                  0x80090036User cancelled an interactive dialogUser will be asked to try again
                                  0x80090011The container or key was not foundUnjoin the device from Azure AD and rejoin
                                  0x8009000FThe container or key already existsUnjoin the device from Azure AD and rejoin
                                  0x8009002ANTE_NO_MEMORYClose programs which are taking up memory and try again.
                                  0x80090005NTE_BAD_DATAUnjoin the device from Azure AD and rejoin
                                  0x80090029TPM is not set up.Sign on with an administrator account. Click **Start**, type "tpm.msc", and select **tpm.msc Microsoft Common Console Document**. In the **Actions** pane, select **Prepare the TPM**.
                                  0x80090031NTE_AUTHENTICATION_IGNOREDReboot the device. If the error occurs again after rebooting, [reset the TPM]( https://go.microsoft.com/fwlink/p/?LinkId=619969) or run [Clear-TPM](https://go.microsoft.com/fwlink/p/?LinkId=629650)
                                  0x80090035Policy requires TPM and the device does not have TPM.Change the Windows Hello for Business policy to not require a TPM.
                                  0x801C0003User is not authorized to enrollCheck if the user has permission to perform the operation​.
                                  0x801C000ERegistration quota reached

                                  Unjoin some other device that is currently joined using the same account or [increase the maximum number of devices per user](https://go.microsoft.com/fwlink/p/?LinkId=626933).

                                  0x801C000FOperation successful but the device requires a rebootReboot the device.
                                  0x801C0010The AIK certificate is not valid or trustedSign out and then sign in again.
                                  0x801C0011The attestation statement of the transport key is invalidSign out and then sign in again.
                                  0x801C0012Discovery request is not in a valid formatSign out and then sign in again.
                                  0x801C0015The device is required to be joined to an Active Directory domain​Join the device to an Active Directory domain.
                                  0x801C0016The federation provider configuration is emptyGo to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the file is not empty.
                                  0x801C0017​The federation provider domain is emptyGo to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the FPDOMAINNAME element is not empty.
                                  0x801C0018The federation provider client configuration URL is emptyGo to [http://clientconfig.microsoftonline-p.net/FPURL.xml](http://clientconfig.microsoftonline-p.net/FPURL.xml) and verify that the CLIENTCONFIG element contains a valid URL.
                                  0x801C03E9Server response message is invalidSign out and then sign in again.
                                  0x801C03EAServer failed to authorize user or device.Check if the token is valid and user has permission to register Windows Hello for Business keys.
                                  0x801C03EBServer response http status is not validSign out and then sign in again.
                                  0x801C03ECUnhandled exception from server.sign out and then sign in again.
                                  0x801C03ED

                                  Multi-factor authentication is required for a 'ProvisionKey' operation, but was not performed

                                  -

                                  -or-

                                  -

                                  Token was not found in the Authorization header

                                  -

                                  -or-

                                  -

                                  Failed to read one or more objects

                                  -

                                  -or-

                                  The request sent to the server was invalid.

                                  		Sign out and then sign in again. If that doesn't resolve the issue, unjoin the device from Azure Active Directory (Azure AD) and rejoin.
                                  0x801C03EEAttestation failedSign out and then sign in again.
                                  0x801C03EFThe AIK certificate is no longer validSign out and then sign in again.
                                  ​0x801C044DUnable to obtain user tokenSign out and then sign in again. Check network and credentials.
                                  0x801C044EFailed to receive user creds inputSign out and then sign in again.
                                  -  ## Errors with unknown mitigation + For errors listed in this table, contact Microsoft Support for assistance. -| Hex | Cause | +| Hex | Cause | |-------------|---------| -| 0x80072f0c | Unknown | -| 0x80070057 | Invalid parameter or argument is passed | -| 0x80090027 | Caller provided wrong parameter. If third-party code receives this error they must change their code. | -| 0x8009002D | NTE\_INTERNAL\_ERROR | -| 0x80090020 | NTE\_FAIL | -| 0x801C0001 | ​ADRS server response is not in valid format | -| 0x801C0002 | Server failed to authenticate the user | -| 0x801C0006 | Unhandled exception from server | -| 0x801C000C | Discovery failed | -| 0x801C001B | ​The device certificate is not found | -| 0x801C000B | Redirection is needed and redirected location is not a well known server | +| 0X80072F0C | Unknown | +| 0x80070057 | Invalid parameter or argument is passed. | +| 0x80090020 | NTE\_FAIL | +| 0x80090027 | Caller provided a wrong parameter. If third-party code receives this error, they must change their code. | +| 0x8009002D | NTE\_INTERNAL\_ERROR | +| 0x801C0001 | ​ADRS server response is not in a valid format. | +| 0x801C0002 | Server failed to authenticate the user. | +| 0x801C0006 | Unhandled exception from server. | +| 0x801C000B | Redirection is needed and redirected location is not a well known server. | +| 0x801C000C | Discovery failed. | +| 0x801C0013 | Tenant ID is not found in the token. | +| 0x801C0014 | User SID is not found in the token. | | 0x801C0019 | ​The federation provider client configuration is empty | -| 0x801C001A | The DRS endpoint in the federation provider client configuration is empty | -| 0x801C0013 | Tenant ID is not found in the token | -| 0x801C0014 | User SID is not found in the token | -| 0x801C03F1 | There is no UPN in the token | -| 0x801C03F0 | ​There is no key registered for the user | -| 0x801C03F1 | ​There is no UPN in the token | -| ​0x801C044C | There is no core window for the current thread | -  +| 0x801C001A | The DRS endpoint in the federation provider client configuration is empty. | +| 0x801C001B | ​The device certificate is not found. | +| 0x801C03F0 | ​There is no key registered for the user. | +| 0x801C03F1 | ​There is no UPN in the token. | +| ​0x801C044C | There is no core window for the current thread. | + ## Related topics @@ -234,4 +109,4 @@ For errors listed in this table, contact Microsoft Support for assistance. - [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) - [Windows Hello and password changes](hello-and-password-changes.md) - [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-event-300.md b/windows/security/identity-protection/hello-for-business/hello-event-300.md index 9de0743e58..fd2d0dbe71 100644 --- a/windows/security/identity-protection/hello-for-business/hello-event-300.md +++ b/windows/security/identity-protection/hello-for-business/hello-event-300.md @@ -2,14 +2,15 @@ title: Event ID 300 - Windows Hello successfully created (Windows 10) description: This event is created when a Windows Hello for Business is successfully created and registered with Azure Active Directory (Azure AD). ms.assetid: 0DD59E75-1C5F-4CC6-BB0E-71C83884FF04 +ms.reviewer: keywords: ngc ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -27,13 +28,14 @@ This event is created when Windows Hello for Business is successfully created an ## Event details -| **Product:** | Windows 10 operating system | -| --- | --- | -| **ID:** | 300 | -| **Source:** | Microsoft Azure Device Registration Service | -| **Version:** | 10 | +| **Product:** | Windows 10 operating system | +|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **Log:** | Event Viewer > Applications and Service Logs\Microsoft\Windows\User Device Registration\Admin | +| **ID:** | 300 | +| **Source:** | Microsoft Azure Device Registration Service | +| **Version:** | 10 | | **Message:** | The NGC key was successfully registered. Key ID: {4476694e-8e3b-4ef8-8487-be21f95e6f07}. UPN:test@contoso.com. Attestation: ATT\_SOFT. Client request ID: . Server request ID: db2da6bd-3d70-4b9b-b26b-444f669902da.
                                  Server response: {"kid":"4476694e-8e3b-4ef8-8487-be21f95e6f07","upn":"test@contoso.com"} | -  + ## Resolve This is a normal condition. No further action is required. diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.md b/windows/security/identity-protection/hello-for-business/hello-faq.md index 4cbd7ca983..57b0ea0add 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.md +++ b/windows/security/identity-protection/hello-for-business/hello-faq.md @@ -7,32 +7,36 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- -# Windows Hello for Business Frequently Ask Questions +# Windows Hello for Business Frequently Asked Questions **Applies to** - Windows 10 ## What about virtual smart cards? -Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future but not date at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends new Windows 10 deployments to use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8. +Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date is set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends new Windows 10 deployments to use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8. ## What about convenience PIN? Microsoft is committed to its vision of a world without passwords. We recognize the *convenience* provided by convenience PIN, but it stills uses a password for authentication. Microsoft recommends customers using Windows 10 and convenience PINs should move to Windows Hello for Business. New Windows 10 deployments should deploy Windows Hello for Business and not convenience PINs. Microsoft will be deprecating convenience PINs in the future and will publish the date early to ensure customers have adequate lead time to deploy Windows Hello for Business. -## Can I deploy Windows Hello for Business using System Center Configuration Manager? -Windows Hello for Business deployments using System Center Configuration Manager need to move to the hybrid deployment model that uses Active Directory Federation Services. Deployments using System Center Configuration Manager will no long be supported after November 2018. +## Can I use Windows Hello for Business key trust and RDP? +RDP currently does not support key based authentication and does not support self signed certificates. RDP with Windows Hello for Business is currently only supported with certificate based deployments. + +## Can I deploy Windows Hello for Business using Microsoft Endpoint Configuration Manager? +Windows Hello for Business deployments using Configuration Manager need to move to the hybrid deployment model that uses Active Directory Federation Services. Deployments using Configuration Manager will no longer be supported after November 2018. ## How many users can enroll for Windows Hello for Business on a single Windows 10 computer? The maximum number of supported enrollments on a single Windows 10 computer is 10. That enables 10 users to each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we will strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. -## How can PIN be more secure than a Password? +## How can a PIN be more secure than a password? When using Windows Hello for Business, the PIN is not a symmetric key where is the password is a symmetric key. With passwords, there is a server that has some representation of the password. With Windows Hello for Business, the PIN is user provided entropy used to load the private key in the TPM. The server does not have a copy of the PIN. For that matter, the Windows client does not have a copy of the current PIN either. The user must provide the entropy, the TPM protected key, and the TPM that generated that key to successfully have access to the private key. The statement "PIN is stronger than Password" is not directed at the strength of the entropy used by the PIN. It is about the difference of providing entropy vs continuing the use of a symmetric key (the password). The TPM has anti-hammering features which thwart brute-force PIN attacks (an attackers continuous attempt to try all combination of PINs). Some organizations may worry about shoulder surfing. For those organizations, rather than increased the complexity of the PIN, implement the [Multifactor Unlock](feature-multifactor-unlock.md) feature. @@ -40,8 +44,8 @@ The statement "PIN is stronger than Password" is not directed at the strength of ## Why is the Key Admins group missing, I have Windows Server 2016 domain controller(s)? The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server cannot translate the security identifier (SID) to a name. To resolve this, transfer the PDC emulator domain role to a domain controller running Windows Server 2016. -## Can I use convenience PIN with Azure AD? -No. If you want to use PIN or biometrics with Azure Active Directory identities on Azure AD registered, Azure AD joined, or hybrid Azure AD joined devices, then you must deploy Windows Hello for Business. +## Can I use a convenience PIN with Azure AD? +It is currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts. It is only supported for on-premises only Domain Joined users and local account users. ## Can I use an external camera when my laptop is closed or docked? No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further. @@ -75,8 +79,8 @@ If your environment uses Microsoft Intune, you need these additional URLs: - portal.manage-beta.microsoft.com - portal.manage.microsoft.com -## What is the difference between non-destructive and destructive PIN Reset? -Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once on-boarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provided a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user does not delete the current credential and obtain a new one. Read [PIN Reset](hello-features.md#pin-reset) from our [Windows Hello for Business Features](hello-features.md) page for more information. +## What is the difference between non-destructive and destructive PIN reset? +Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once on-boarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provided a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user does not delete the current credential and obtain a new one. Read [PIN Reset](hello-feature-pin-reset.md) page for more information. Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. with destructive PIN reset, users that have forgotten their PIN can authenticate using their password, perform a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. @@ -100,28 +104,32 @@ Windows Hello for Business is two-factor authentication based the observed authe ## What are the biometric requirements for Windows Hello for Business? Read [Windows Hello biometric requirements](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-biometric-requirements) for more information. -## Can I use PIN and biometrics to unlock my device? +## Can I use both a PIN and biometrics to unlock my device? Starting in Windows 10, version 1709, you can use multi-factor unlock to require the user to provide an additional factor to unlock the device. Authentication remains two-factor, but another factor is required before Windows allows the user to reach the desktop. Read more about [multifactor unlock](feature-multifactor-unlock.md). ## What is the difference between Windows Hello and Windows Hello for Business? Windows Hello represents the biometric framework provided in Windows 10. Windows Hello enables users to use biometrics to sign into their devices by securely storing their user name and password and releasing it for authentication when the user successfully identifies themselves using biometrics. Windows Hello for Business uses asymmetric keys protected by the device's security module that requires a user gesture (PIN or biometrics) to authenticate. -## Why can I not enroll biometrics for my local built-in Administrator? +## Why can't I enroll biometrics for my local built-in Administrator? Windows 10 does not allow the local administrator to enroll biometric gestures(face or fingerprint). ## I have extended Active Directory to Azure Active Directory. Can I use the on-premises deployment model? No. If your organization is federated or using on-line services, such as Azure AD Connect, Office 365, or OneDrive, then you must use a hybrid deployment model. On-premises deployments are exclusive to organization who need more time before moving to the cloud and exclusively use Active Directory. ## Does Windows Hello for Business prevent the use of simple PINs? -Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. This prevents repeating numbers, sequential numbers and simple patterns. +Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. The algorithm counts the number of steps required to reach the next digit, overflowing at ten ('zero'). So, for example: -* 1111 has a constant delta of 0, so it is not allowed -* 1234 has a constant delta of 1, so it is not allowed -* 1357 has a constant delta of 2, so it is not allowed -* 9630 has a constant delta of -3, so it is not allowed -* 1231 does not have a constant delta, so it is okay -* 1593 does not have a constant delta, so it is okay +* The PIN 1111 has a constant delta of (0,0,0), so it is not allowed +* The PIN 1234 has a constant delta of (1,1,1), so it is not allowed +* The PIN 1357 has a constant delta of (2,2,2), so it is not allowed +* The PIN 9630 has a constant delta of (7,7,7), so it is not allowed +* The PIN 1593 has a constant delta of (4,4,4), so it is not allowed +* The PIN 7036 has a constant delta of (3,3,3), so it is not allowed +* The PIN 1231 does not have a constant delta (1,1,8), so it is allowed +* The PIN 1872 does not have a constant delta (7,9,5), so it is allowed +This prevents repeating numbers, sequential numbers, and simple patterns. +It always results in a list of 100 disallowed PINs (independent of the PIN length). This algorithm does not apply to alphanumeric PINs. ## How does PIN caching work with Windows Hello for Business? @@ -135,12 +143,12 @@ The smart card emulation feature of Windows Hello for Business verifies the PIN ## Can I disable the PIN while using Windows Hello for Business? No. The movement away from passwords is accomplished by gradually reducing the use of the password. In the occurrence where you cannot authenticate with biometrics, you need a fall back mechanism that is not a password. The PIN is the fall back mechanism. Disabling or hiding the PIN credential provider disabled the use of biometrics. -## How keys are protected? +## How are keys protected? Wherever possible, Windows Hello for Business takes advantage of trusted platform module (TPM) 2.0 hardware to generate and protect keys. However, Windows Hello and Windows Hello for Business does not require a TPM. Administrators can choose to allow key operations in software Whenever possible, Microsoft strongly recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will have to reset the PIN (which means he or she will have to use MFA to re-authenticate to the IDP before the IDP allows him or her to re-register). -## Can Windows Hello for Business work in air gapped environments? +## Can Windows Hello for Business work in air-gapped environments? Yes. You can use the on-premises Windows Hello for Business deployment and combine it with a third-party MFA provider that does not require Internet connectivity to achieve an air-gapped Windows Hello for Business deployment. ## Can I use third-party authentication providers with Windows Hello for Business? diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md new file mode 100644 index 0000000000..a1810a0b03 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md @@ -0,0 +1,45 @@ +--- +title: Conditional Access +description: Learn more about conditional access in Azure Active Directory. +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, conditional access +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# Conditional access + +**Requirements:** + +* Azure Active Directory +* Hybrid Windows Hello for Business deployment + +In a mobile-first, cloud-first world, Azure Active Directory enables single sign-on to devices, applications, and services from anywhere. With the proliferation of devices (including BYOD), work off corporate networks, and 3rd party SaaS applications, IT professionals are faced with two opposing goals: + +* Empower the end users to be productive wherever and whenever +* Protect the corporate assets at any time + +To improve productivity, Azure Active Directory provides your users with a broad range of options to access your corporate assets. With application access management, Azure Active Directory enables you to ensure that only the right people can access your applications. What if you want to have more control over how the right people are accessing your resources under certain conditions? What if you even have conditions under which you want to block access to certain applications even for the right people? For example, it might be OK for you if the right people are accessing certain applications from a trusted network; however, you might not want them to access these applications from a network you don't trust. You can address these questions using conditional access. + +Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access. + +## Related topics + +* [Windows Hello for Business](hello-identity-verification.md) +* [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +* [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +* [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +* [Windows Hello and password changes](hello-and-password-changes.md) +* [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +* [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md new file mode 100644 index 0000000000..015331499c --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md @@ -0,0 +1,90 @@ +--- +title: Dual Enrollment +description: Dual Enrollment +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, dual enrollment, +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# Dual Enrollment + +**Requirements** + +* Hybrid and On-premises Windows Hello for Business deployments +* Enterprise Joined or Hybrid Azure joined devices +* Windows 10, version 1709 + +> [!NOTE] +> This feature was previously known as **Privileged Credential** but was renamed to **Dual Enrollment** to prevent any confusion with the **Privileged Access Workstation** feature. + +> [!IMPORTANT] +> Dual enrollment does not replace or provide the same security as Privileged Access Workstations feature. Microsoft encourages enterprises to use the Privileged Access Workstations for their privileged credential users. Enterprises can consider Windows Hello for Business dual enrollment in situations where the Privileged Access feature cannot be used. Read [Privileged Access Workstations](https://docs.microsoft.com/windows-server/identity/securing-privileged-access/privileged-access-workstations) for more information. + +Dual enrollment enables administrators to perform elevated, administrative functions by enrolling both their non-privileged and privileged credentials on their device. + +By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, **Allow enumeration of emulated smart card for all users**, you can configure a device to enumerate all enrolled Windows Hello for Business credentials on selected devices. + +With this setting, administrative users can sign-in to Windows 10, version 1709 using their non-privileged Windows Hello for Business credentials for normal work flow such as email, but can launch Microsoft Management Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign-in and out, or use fast user switching when alternating between privileged and non-privileged workloads. + +> [!IMPORTANT] +> You must configure a Windows 10 computer for Windows Hello for Business dual enrollment before either user (privileged or non-privileged) provisions Windows Hello for Business. Dual enrollment is a special setting that is configured on the Windows Hello container during creation. + +## Configure Windows Hello for Business Dual Enrollment + +In this task you will + +* Configure Active Directory to support Domain Administrator enrollment +* Configure Dual Enrollment using Group Policy + +### Configure Active Directory to support Domain Administrator enrollment + +The designed Windows for Business configuration has you give the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy. + +Active Directory Domain Services uses AdminSDHolder to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account may receive the permissions but they will disappear from the user object unless you give the AdminSDHolder read and write permissions to the msDS-KeyCredential attribute. + +Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. + +1. Type the following command to add the **allow** read and write property permissions for msDS-KeyCredentialLink attribute for the **Key Admins** (or **KeyCredential Admins**) group on the AdminSDHolder object.
                                  +```dsacls "CN=AdminSDHolder,CN=System,DC=domain,DC=com" /g "[domainName\keyAdminGroup]":RPWP;msDS-KeyCredentialLink```
                                  +where **DC=domain,DC=com** is the LDAP path of your Active Directory domain and **domainName\keyAdminGroup]** is the NetBIOS name of your domain and the name of the group you use to give access to keys based on your deployment. For example:
                                  +```dsacls "CN=AdminSDHolder,CN=System,DC=corp,DC=mstepdemo,DC=net" /g "mstepdemo\Key Admins":RPWP;msDS-KeyCredentialLink``` +2. To trigger security descriptor propagation, open **ldp.exe**. +3. Click **Connection** and select **Connect...** Next to **Server**, type the name of the domain controller that holds the PDC role for the domain. Next to **Port**, type **389** and click **OK**. +4. Click **Connection** and select **Bind...** Click **OK** to bind as the currently signed-in user. +5. Click **Browser** and select **Modify**. Leave the **DN** text box blank. Next to **Attribute**, type **RunProtectAdminGroupsTask**. Next to **Values**, type **1**. Click **Enter** to add this to the **Entry List**. +6. Click **Run** to start the task. +7. Close LDP. + +### Configuring Dual Enrollment using Group Policy + +You configure Windows 10 to support dual enrollment using the computer configuration portion of a Group Policy object. + +1. Using the Group Policy Management Console (GPMC), create a new domain-based Group Policy object and link it to an organizational Unit that contains Active Directory computer objects used by privileged users. +2. Edit the Group Policy object from step 1. +3. Enable the **Allow enumeration of emulated smart cards for all users** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. +4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. +5. Restart computers targeted by this Group Policy object. + +The computer is ready for dual enrollment. Sign-in as the privileged user first and enroll for Windows Hello for Business. Once completed, sign-out and sign-in as the non-privileged user and enroll for Windows Hello for Business. You can now use your privileged credential to perform privileged tasks without using your password and without needing to switch users. + +## Related topics + +* [Windows Hello for Business](hello-identity-verification.md) +* [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +* [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +* [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +* [Windows Hello and password changes](hello-and-password-changes.md) +* [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +* [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md new file mode 100644 index 0000000000..53985965fb --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-dynamic-lock.md @@ -0,0 +1,70 @@ +--- +title: Dynamic lock +description: Learn how to set Dynamic lock on Windows 10 devices, by configuring group policies. This feature locks a device when a Bluetooth signal falls below a set value. +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, conditional access +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# Dynamic lock + +**Requirements:** + +* Windows 10, version 1703 + +Dynamic lock enables you to configure Windows 10 devices to automatically lock when Bluetooth paired device signal falls below the maximum Received Signal Strength Indicator (RSSI) value. This makes it more difficult for someone to gain access to your device if you step away from your PC and forget to lock it. + +You configure the dynamic lock policy using Group Policy. You can locate the policy setting at **Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Business**. The name of the policy is **Configure dynamic lock factors**. + +The Group Policy Editor, when the policy is enabled, creates a default signal rule policy with the following value: + +``` + + + +``` + +>[!IMPORTANT] +>Microsoft recommends using the default values for this policy settings. Measurements are relative based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. + +For this policy setting, the **type** and **scenario** attribute values are static and cannot change. The **classofDevice** is configurable but Phone is the only currently supported configuration. The attribute defaults to Phones sand uses the values from the following table: + +|Description|Value| +|:-------------|:-------:| +|Miscellaneous|0| +|Computer|256| +|Phone|512| +|LAN/Network Access Point|768| +|Audio/Video|1024| +|Peripheral|1280| +|Imaging|1536| +|Wearable|1792| +|Toy|2048| +|Health|2304| +|Uncategorized|7936| + +The **rssiMin** attribute value signal indicates the strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows 10 to lock the device once the signal strength weakens by more than measurement of 10. + +RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other. + +## Related topics + +* [Windows Hello for Business](hello-identity-verification.md) +* [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +* [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +* [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +* [Windows Hello and password changes](hello-and-password-changes.md) +* [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +* [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +* [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md new file mode 100644 index 0000000000..a40f945ba3 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -0,0 +1,133 @@ +--- +title: Pin Reset +description: Pin Reset +keywords: identity, PIN, Hello, passport, WHFB, hybrid, cert-trust, device, reset +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# PIN reset + +**Applies to:** + +- Windows 10, version 1709 or later + +## Hybrid Deployments + +**Requirements:** + +- Azure Active Directory +- Hybrid Windows Hello for Business deployment +- Azure AD registered, Azure AD joined, and Hybrid Azure AD joined +- Windows 10, version 1709 to 1809, **Enterprise Edition**. There is no licensing requirement for this feature since version 1903. + +The Microsoft PIN reset services enables you to help users recover who have forgotten their PIN. Using Group Policy, Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables users to reset their forgotten PIN through settings or above the lock screen without requiring re-enrollment. + +>[!IMPORTANT] +> The Microsoft PIN Reset service only works with Windows 10, version 1709 to 1809 with **Enterprise Edition**. The feature works with **Pro** edition with Windows 10, version 1903 and newer. + +### Onboarding the Microsoft PIN reset service to your Intune tenant + +Before you can remotely reset PINs, you must on-board the Microsoft PIN reset service to your Azure Active Directory tenant, and configure devices you manage. + +### Connect Azure Active Directory with the PIN reset service + +1. Go to the [Microsoft PIN Reset Service Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Azure Active Directory tenant. +2. After you log in, click **Accept** to give consent for the PIN reset service to access your account. +![PIN reset service application in Azure](images/pinreset/pin-reset-service-prompt.png) +3. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Azure Active Directory tenant. +4. After you log in, click **Accept** to give consent for the PIN reset client to access your account. +![PIN reset client application in Azure](images/pinreset/pin-reset-client-prompt.png) +5. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant. +![PIN reset service permissions page](images/pinreset/pin-reset-applications.png) + +>[!NOTE] +>After you Accept the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN Reset applications are listed for your tenant. + +### Configure Windows devices to use PIN reset using Group Policy + +You configure Windows 10 to use the Microsoft PIN Reset service using the computer configuration portion of a Group Policy object. + +1. Using the Group Policy Management Console (GPMC), scope a domain-based Group Policy to computer accounts in Active Directory. +2. Edit the Group Policy object from step 1. +3. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. +4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. + +### Configure Windows devices to use PIN reset using Microsoft Intune + +To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 custom device policy](https://docs.microsoft.com/intune/custom-settings-windows-10) to enable the feature. Configure the policy using the following Windows policy configuration service provider (CSP): + +#### Create a PIN Reset Device configuration profile using Microsoft Intune + +1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. +2. You need your tenant ID to complete the following task. You can discovery your tenant ID viewing the **Properties** of your Azure Active Directory from the Azure Portal. It will be listed under Directory ID. You can also use the following command in a command Window on any Azure AD joined or hybrid Azure AD joined computer.
                                  + + ``` + dsregcmd /status | findstr -snip "tenantid" + ``` + +1. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. Click **Create profile**. +1. Type **Use PIN Recovery** in the **Name** field. Select **Windows 10 and later** from the **Platform** list. Select **Custom** from the **Profile type** list. +1. In the **Custom OMA-URI Settings** blade, Click **Add**. +1. In the **Add Row** blade, type **PIN Reset Settings** in the **Name** field. In the **OMA-URI** field, type **./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery** where *tenant ID* is your Azure Active Directory tenant ID from step 2. +1. Select **Boolean** from the **Data type** list and select **True** from the **Value** list. +1. Click **OK** to save the row configuration. Click **OK** to close the Custom OMA-URI Settings blade. Click **Create to save the profile. + +#### Assign the PIN Reset Device configuration profile using Microsoft Intune + +1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. +2. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. From the list of device configuration profiles, click the profile that contains the PIN reset configuration. +3. In the device configuration profile, click **Assignments**. +4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups. + +## On-premises Deployments + +**Requirements** + +* Active Directory +* On-premises Windows Hello for Business deployment +* Reset from settings - Windows 10, version 1703, Professional +* Reset above Lock - Windows 10, version 1709, Professional + +On-premises deployments provide users with the ability to reset forgotten PINs either through the settings page or from above the user's lock screen. Users must know or be provided their password for authentication, must perform a second factor of authentication, and then re-provision Windows Hello for Business. + +>[!IMPORTANT] +>Users must have corporate network connectivity to domain controllers and the federation service to reset their PINs. + +### Reset PIN from Settings + +1. Sign-in to Windows 10, version 1703 or later using an alternate credential. +2. Open **Settings**, click **Accounts**, click **Sign-in options**. +3. Under **PIN**, click **I forgot my PIN** and follow the instructions. + +#### Reset PIN above the Lock Screen + + 1. On Windows 10, version 1709, click **I forgot my PIN** from the Windows Sign-in + 2. Enter your password and press enter. + 3. Follow the instructions provided by the provisioning process + 4. When finished, unlock your desktop using your newly created PIN. + +>[!NOTE] +> Visit the [Windows Hello for Business Videos](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos.md) page and watch the [Windows Hello for Business forgotten PIN user experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience) video. + +## Related topics + +- [Windows Hello for Business](hello-identity-verification.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md new file mode 100644 index 0000000000..981587e970 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -0,0 +1,74 @@ +--- +title: Remote Desktop +description: Remote Desktop +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, remote desktop, RDP +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +audience: ITPro +author: mapalko +ms.author: mapalko +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +localizationpriority: medium +ms.date: 09/09/2019 +ms.reviewer: +--- + +# Remote Desktop + +**Requirements** + +- Windows 10 +- Certificate trust deployments +- Hybrid and On-premises Windows Hello for Business deployments +- Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices +- Certificate trust deployments + +Windows Hello for Business supports using a certificate deployed to a WHFB container to a remote desktop to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. + +Microsoft continues to investigate supporting this feature for key trust deployments in a future release. + +## Remote Desktop with Biometrics + +**Requirements** + +- Hybrid and On-premises Windows Hello for Business deployments +- Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices +- Certificate trust deployments +- Biometric enrollments +- Windows 10, version 1809 + +Users using earlier versions of Windows 10 could remote desktop to using Windows Hello for Business but were limited to the using their PIN as their authentication gesture. Windows 10, version 1809 introduces the ability for users to authenticate to a remote desktop session using their Windows Hello for Business biometric gesture. The feature is on by default, so your users can take advantage of it as soon as they upgrade to Windows 10, version 1809. + +### How does it work + +Windows generates and stores cryptographic keys using a software component called a key storage provider (KSP). Software-based keys are created and stored using the Microsoft Software Key Storage Provider. Smart card keys are created and stored using the Microsoft Smart Card Key Storage Provider. Keys created and protected by Windows Hello for Business are created and stored using the Microsoft Passport Key Storage Provider. + +A certificate on a smart card starts with creating an asymmetric key pair using the Microsoft Smart Card KSP. Windows requests a certificate based on the key pair from your enterprises issuing certificate authority, which returns a certificate that is stored in the user's Personal certificate store. The private key remains on the smart card and the public key is stored with the certificate. Metadata on the certificate (and the key) store the key storage provider used to create the key (remember the certificate contains the public key). + +This same concept applies to Windows Hello for Business. Except, the keys are created using the Microsoft Passport KSP and the user's private key remains protected by the device's security module (TPM) and the user's gesture (PIN/biometric). The certificate APIs hide this complexity. When an application uses a certificate, the certificate APIs locate the keys using the saved key storage provider. The key storage providers directs the certificate APIs on which provider they use to find the private key associated with the certificate. This is how Windows knows you have a smart card certificate without the smart card inserted (and prompts you to insert the smart card). + +Windows Hello for Business emulates a smart card for application compatibility. Versions of Windows 10 prior to version 1809, would redirect private key access for Windows Hello for Business certificate to use its emulated smart card using the Microsoft Smart Card KSP, which would enable the user to provide their PIN. Windows 10, version 1809 no longer redirects private key access for Windows Hello for Business certificates to the Microsoft Smart Card KSP-- it continues using the Microsoft Passport KSP. The Microsoft Passport KSP enabled Windows 10 to prompt the user for their biometric gesture or PIN. + +### Compatibility + +Users appreciate convenience of biometrics and administrators value the security however, you may experience compatibility issues with your applications and Windows Hello for Business certificates. You can relax knowing a Group Policy setting and a [MDM URI](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp) exist to help you revert to the previous behavior for those users who need it. + +![WHFB Certificate GP Setting](images/rdpbio/rdpbiopolicysetting.png) + +> [!IMPORTANT] +> The remote desktop with biometric feature does not work with [Dual Enrollment](hello-feature-dual-enrollment.md) feature or scenarios where the user provides alternative credentials. Microsoft continues to investigate supporting the feature. + +## Related topics + +- [Windows Hello for Business](hello-identity-verification.md) +- [Manage Windows Hello for Business in your organization](hello-manage-in-organization.md) +- [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) +- [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) +- [Windows Hello and password changes](hello-and-password-changes.md) +- [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) +- [Event ID 300 - Windows Hello successfully created](hello-event-300.md) +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-features.md b/windows/security/identity-protection/hello-for-business/hello-features.md index 280135c5b3..d9832ef853 100644 --- a/windows/security/identity-protection/hello-for-business/hello-features.md +++ b/windows/security/identity-protection/hello-for-business/hello-features.md @@ -2,264 +2,48 @@ title: Windows Hello for Business Features description: Windows Hello for Business Features ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E +ms.reviewer: keywords: identity, PIN, biometric, Hello, passport, WHFB, Windows Hello, PIN Reset, Dynamic Lock, Multifactor Unlock, Forgot PIN, Privileged credentials ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 05/05/2018 +ms.date: 11/27/2019 --- # Windows Hello for Business Features **Applies to:** -- Windows 10 -Consider these additional features you can use after your organization deploys Windows Hello for Business. +- Windows 10 -- [Conditional access](#conditional-access) -- [Dynamic lock](#dynamic-lock) -- [PIN reset](#pin-reset) -- [Dual Enrollment](#dual-enrollment) -- [Remote Desktop with Biometrics](#remote-desktop-with-biometrics) +Consider these additional features you can use after your organization deploys Windows Hello for Business. -## Conditional access +## Conditional access -**Requirements:** -* Azure Active Directory -* Hybrid Windows Hello for Business deployment - - -In a mobile-first, cloud-first world, Azure Active Directory enables single sign-on to devices, applications, and services from anywhere. With the proliferation of devices (including BYOD), work off corporate networks, and 3rd party SaaS applications, IT professionals are faced with two opposing goals:+ -* Empower the end users to be productive wherever and whenever -* Protect the corporate assets at any time - -To improve productivity, Azure Active Directory provides your users with a broad range of options to access your corporate assets. With application access management, Azure Active Directory enables you to ensure that only the right people can access your applications. What if you want to have more control over how the right people are accessing your resources under certain conditions? What if you even have conditions under which you want to block access to certain applications even for the right people? For example, it might be OK for you if the right people are accessing certain applications from a trusted network; however, you might not want them to access these applications from a network you don't trust. You can address these questions using conditional access. - -Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access. +Azure Active Directory provides a wide set of options for protecting access to corporate resources. Conditional access provides more fine grained control over who can access certain resources and under what conditions. For more information see [Conditional Access](hello-feature-conditional-access.md). ## Dynamic lock -**Requirements:** -* Windows 10, version 1703 - -Dynamic lock enables you to configure Windows 10 devices to automatically lock when Bluetooth paired device signal falls below the maximum Received Signal Strength Indicator (RSSI) value. You configure the dynamic lock policy using Group Policy. You can locate the policy setting at **Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Business**. The name of the policy is **Configure dynamic lock factors**. - -The Group Policy Editor, when the policy is enabled, creates a default signal rule policy with the following value: - ->[!IMPORTANT] ->Microsoft recommends using the default values for this policy settings. Measurements are relative based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. - -``` - - - -``` - -For this policy setting, the **type** and **scenario** attribute values are static and cannot change. The **classofDevice** attribute defaults Phones and uses the values from the following table - -|Description|Value| -|:-------------|:-------:| -|Miscellaneous|0| -|Computer|256| -|Phone|512| -|LAN/Network Access Point|768| -|Audio/Video|1024| -|Peripheral|1280| -|Imaging|1536| -|Wearable|1792| -|Toy|2048| -|Health|2304| -|Uncategorized|7936| - -The **rssiMin** attribute value signal indicates the strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows 10 to lock the device once the signal strength weakens by more than measurement of 10. - -RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other. +Dynamic lock uses a paired Bluetooth device to determine user presence and locks the device if a user is not present. For more information and configuration steps see [Dynamic Lock](hello-feature-dynamic-lock.md). ## PIN reset -**Applies to:** -- Windows 10, version 1709 or later - - -### Hybrid Deployments - -**Requirements:** -- Azure Active Directory -- Hybrid Windows Hello for Business deployment -- Azure AD registered, Azure AD joined, and Hybrid Azure AD joined -- Windows 10, version 1709 or later, **Enterprise Edition** - -The Microsoft PIN reset services enables you to help users who have forgotten their PIN. Using Group Policy, Microsoft Intune or a compatible MDM, you can configure Windows 10 devices to securely use the Microsoft PIN reset service that enables users to reset their forgotten PIN through settings or above the lock screen without requiring re-enrollment. - ->[!IMPORTANT] -> The Microsoft PIN Reset service only works with Windows 10, version 1709 or later **Enterprise Edition**. The feature does not work with the **Pro** edition.] - -#### Onboarding the Microsoft PIN reset service to your Intune tenant - -Before you can remotely reset PINs, you must on-board the Microsoft PIN reset service to your Azure Active Directory tenant, and configure devices you manage. - -#### Connect Azure Active Directory with the PIN reset service - -1. Visit [Microsoft PIN Reset Service Integration website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=b8456c59-1230-44c7-a4a2-99b085333e84&resource=https%3A%2F%2Fgraph.windows.net&redirect_uri=https%3A%2F%2Fcred.microsoft.com&state=e9191523-6c2f-4f1d-a4f9-c36f26f89df0&prompt=admin_consent), and sign in using the tenant administrator account you use to manage your Azure Active Directory tenant. -2. After you log in, click **Accept** to give consent for the PIN reset service to access your account.
                                  -![PIN reset service application in Azure](images/pinreset/pin-reset-service-home-screen.png)
                                  -3. In the Azure portal, you can verify that the Microsoft PIN reset service is integrated from the **Enterprise applications**, **All applications** blade.
                                  -![PIN reset service permissions page](images/pinreset/pin-reset-service-application.png) - -#### Configure Windows devices to use PIN reset using Group Policy -You configure Windows 10 to use the Microsoft PIN Reset service using the computer configuration portion of a Group Policy object. - -1. Using the Group Policy Management Console (GPMC), scope a domain-based Group Policy to computer accounts in Active Directory. -2. Edit the Group Policy object from step 1. -3. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. -4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. - -#### Configure Windows devices to use PIN reset using Microsoft Intune -To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 custom device policy](https://docs.microsoft.com/intune/custom-settings-windows-10) to enable the feature. Configure the policy using the following Windows policy configuration service provider (CSP): - -##### Create a PIN Reset Device configuration profile using Microsoft Intune - -1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. -2. You need your tenant ID to complete the following task. You can discovery your tenant ID viewing the **Properties** of your Azure Active Directory from the Azure Portal. You can also use the following command in a command Window on any Azure AD joined or hybrid Azure AD joined computer.
                                  -``` -dsregcmd /status | findstr -snip "tenantid" -``` -3. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. Click **Create profile**. -4. Type **Use PIN Recovery** in the **Name** field. Select **Windows 10 and later** from the **Platform** list. Select **Custom** from the **Profile type** list. -5. In the **Custom OMA-URI Settings** blade, Click **Add**. -6. In the **Add Row** blade, type **PIN Reset Settings** in the **Name** field. In the **OMA-URI** field, type **./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery** where *tenant ID* is your Azure Active Directory tenant ID from step 2. -7. Select **Boolean** from the **Data type** list and select **True** from the **Value** list. -8. Click **OK** to save the row configuration. Click **OK** to close the **Custom OMA-URI Settings blade. Click **Create** to save the profile. - -##### Assign the PIN Reset Device configuration profile using Microsoft Intune -1. Sign-in to [Azure Portal](https://portal.azure.com) using a tenant administrator account. -2. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. From the list of device configuration profiles, click the profile that contains the PIN reset configuration. -3. In the device configuration profile, click **Assignments**. -4. Use the **Include** and/or **Exclude** tabs to target the device configuration profile to select groups. - -### On-premises Deployments - -** Requirements** -* Active Directory -* On-premises Windows Hello for Business deployment -* Reset from settings - Windows 10, version 1703, Professional -* Reset above Lock - Windows 10, version 1709, Professional - -On-premises deployments provide users with the ability to reset forgotten PINs either through the settings page or from above the user's lock screen. Users must know or be provided their password for authentication, must perform a second factor of authentication, and then re-provision Windows Hello for Business. - ->[!IMPORTANT] ->Users must have corporate network connectivity to domain controllers and the federation service to reset their PINs. - -#### Reset PIN from Settings -1. Sign-in to Windows 10, version 1703 or later using an alternate credential. -2. Open **Settings**, click **Accounts**, click **Sign-in options**. -3. Under **PIN**, click **I forgot my PIN** and follow the instructions. - -#### Reset PIN above the Lock Screen - 1. On Windows 10, version 1709, click **I forgot my PIN** from the Windows Sign-in - 2. Enter your password and press enter. - 3. Follow the instructions provided by the provisioning process - 4. When finished, unlock your desktop using your newly created PIN. - ->[!NOTE] -> Visit the [Windows Hello for Business Videos](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos.md) page and watch the [Windows Hello for Business forgotten PIN user experience](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-videos#windows-hello-for-business-forgotten-pin-user-experience) video. +Windows Hello for Business supports user self-management of their PIN. If a user forgets their PIN, they have the ability to reset it from Settings or the lock screen. The Microsoft PIN reset service can be used for completing this reset without the user needing to enroll a new Windows Hello for Business credential. For more information and configuration steps see [Pin Reset](hello-feature-pin-reset.md). ## Dual Enrollment -**Requirements** -* Hybrid and On-premises Windows Hello for Business deployments -* Enterprise Joined or Hybrid Azure joined devices -* Windows 10, version 1709 +This feature enables provisioning of administrator Windows Hello for Business credentials that can be used by non-privileged accounts to perform administrative actions. These credentials can be used from the non-privileged accounts using **Run as different user** or **Run as administrator**. For more information and configuration steps see [Dual Enrollment](hello-feature-dual-enrollment.md). -> [!NOTE] -> This feature was previously known as **Privileged Credential** but was renamed to **Dual Enrollment** to prevent any confusion with the **Privileged Access Workstation** feature. +## Remote Desktop -> [!IMPORTANT] -> Dual enrollment does not replace or provide the same security as Privileged Access Workstations feature. Microsoft encourages enterprises to use the Privileged Access Workstations for their privileged credential users. Enterprises can consider Windows Hello for Business dual enrollment in situations where the Privileged Access feature cannot be used. Read [Privileged Access Workstations](https://docs.microsoft.com/windows-server/identity/securing-privileged-access/privileged-access-workstations) for more information. - -Dual enrollment enables administrators to perform elevated, administrative functions by enrolling both their non-privileged and privileged credentials on their device. - -By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, **Allow enumeration of emulated smart card for all users**, you can configure a device to enumerate all enrolled Windows Hello for Business credentials on selected devices. - -With this setting, administrative users can sign-in to Windows 10, version 1709 using their non-privileged Windows Hello for Business credentials for normal work flow such as email, but can launch Microsoft Management Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign-in and out, or use fast user switching when alternating between privileged and non-privileged workloads. - -> [!IMPORTANT] -> You must configure a Windows 10 computer for Windows Hello for Business dual enrollment before either user (privileged or non-privileged) provisions Windows Hello for Business. Dual enrollment is a special setting that is configured on the Windows Hello container during creation. - -### Configure Windows Hello for Business Dual Enroll -In this task you will -- Configure Active Directory to support Domain Administrator enrollment -- Configure Dual Enrollment using Group Policy - -#### Configure Active Directory to support Domain Administrator enrollment -The designed Windows for Business configuration has you give the **Key Admins** (or **KeyCredential Admins** when using domain controllers prior to Windows Server 2016) group read and write permissions to the msDS-KeyCredentialsLink attribute. You provided these permissions at root of the domain and use object inheritance to ensure the permissions apply to all users in the domain regardless of their location within the domain hierarchy. - -Active Directory Domain Services uses AdminSDHolder to secure privileged users and groups from unintentional modification by comparing and replacing the security on privileged users and groups to match those defined on the AdminSDHolder object on an hourly cycle. For Windows Hello for Business, your domain administrator account may receive the permissions but will they will disappear from the user object unless you give the AdminSDHolder read and write permissions to the msDS-KeyCredential attribute. - -Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. - -1. Type the following command to add the **allow** read and write property permissions for msDS-KeyCredentialLink attribute for the **Key Admins** (or **KeyCredential Admins**) group on the AdminSDHolder object.
                                  -```dsacls "CN=AdminSDHolder,CN=System,DC=domain,DC=com" /g "[domainName\keyAdminGroup]":RPWP;msDS-KeyCredentialLink```
                                  -where **DC=domain,DC=com** is the LDAP path of your Active Directory domain and **domainName\keyAdminGroup]** is the NetBIOS name of your domain and the name of the group you use to give access to keys based on your deployment. For example:
                                  -```dsacls "CN=AdminSDHolder,CN=System,DC=corp,DC=mstepdemo,DC=net" /g "mstepdemo\Key Admins":RPWP;msDS-KeyCredentialLink``` -2. To trigger security descriptor propagation, open **ldp.exe**. -3. Click **Connection** and select **Connect...** Next to **Server**, type the name of the domain controller that holds the PDC role for the domain. Next to **Port**, type **389** and click **OK**. -4. Click **Connection** and select **Bind...** Click **OK** to bind as the currently signed-in user. -5. Click **Browser** and select **Modify**. Leave the **DN** text box blank. Next to **Attribute**, type **RunProtectAdminGroupsTask**. Next to **Values**, type **1**. Click **Enter** to add this to the **Entry List**. -6. Click **Run** to start the task. -7. Close LDP. - -#### Configuring Dual Enrollment using Group Policy -You configure Windows 10 to support dual enrollment using the computer configuration portion of a Group Policy object. - -1. Using the Group Policy Management Console (GPMC), create a new domain-based Group Policy object and link it to an organizational Unit that contains Active Directory computer objects used by privileged users. -2. Edit the Group Policy object from step 1. -3. Enable the **Allow enumeration of emulated smart cards for all users** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. -4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. -5. Restart computers targeted by this Group Policy object. - -The computer is ready for dual enrollment. Sign-in as the privileged user first and enroll for Windows Hello for Business. Once completed, sign-out and sign-in as the non-privileged user and enroll for Windows Hello for Business. You can now use your privileged credential to perform privileged tasks without using your password and without needing to switch users. - -## Remote Desktop with Biometrics - -> [!Warning] -> Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - -**Requirements** -- Hybrid and On-premises Windows Hello for Business deployments -- Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices -- Certificate trust deployments -- Biometric enrollments -- Windows 10, version 1809 - -Users using earlier versions of Windows 10 could remote desktop to using Windows Hello for Business but were limited to the using their PIN as their authentication gesture. Windows 10, version 1809 introduces the ability for users to authenticate to a remote desktop session using their Windows Hello for Business biometric gesture. The feature is on by default, so your users can take advantage of it as soon as they upgrade to Windows 10, version 1809. - -> [!IMPORTANT] -> The remote desktop with biometrics feature only works with certificate trust deployments. The feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Microsoft continues to investigate supporting this feature for key trust deployments. - -### How does it work -It start with creating cryptographic keys. Windows generates and stores cryptographic keys using a software component called a key storage provider (KSP). Software-based keys are created and stored using the Microsoft Software Key Storage Provider. Smart card keys are created and stored using the Microsoft Smart Card Key Storage Provider. Keys created and protected by Windows Hello for Business are created and stored using the Microsoft Passport Key Storage Provider. - -A certificate on a smart card starts with creating an asymmetric key pair using the Microsoft Smart Card KSP. Windows requests a certificate based on the key pair from your enterprises issuing certificate authority, which returns a certificate that is stored in the user's Personal certificate store. The private key remains on the smart card and the public key is stored with the certificate. Metadata on the certificate (and the key) store the key storage provider used to create the key (remember the certificate contains the public key). - -This same concept applies to Windows Hello for Business. Except, the keys are created using the Microsoft Passport KSP and the user's private key remains protected by the device's security module (TPM) and the user's gesture (PIN/biometric). The certificate APIs hide this complexity. When an application uses a certificate, the certificate APIs locate the keys using the saved key storage provider. The key storage providers directs the certificate APIs on which provider they use to find the private key associated with the certificate. This is how Windows knows you have a smart card certificate without the smart card inserted (and prompts you to insert the smart card). - -Windows Hello for Business emulates a smart card for application compatibility. Versions of Windows 10 prior to version 1809, would redirect private key access for Windows Hello for Business certificate to use its emulated smart card using the Microsoft Smart Card KSP, which would enable the user to provide their PIN. Windows 10, version 1809 no longer redirects private key access for Windows Hello for Business certificates to the Microsoft Smart Card KSP-- it continues using the Microsoft Passport KSP. The Microsoft Passport KSP enabled Windows 10 to prompt the user for their biometric gesture or PIN. - -### Compatibility -Users appreciate convenience of biometrics and administrators value the security however, you may experience compatibility issues with your applications and Windows Hello for Business certificates. You can relax knowing a Group Policy setting and a [MDM URI](https://docs.microsoft.com/windows/client-management/mdm/passportforwork-csp) exist to help you revert to the previous behavior for those users who need it. - -![WHFB Certificate GP Setting](images/rdpbio/rdpbiopolicysetting.png) - -> [!IMPORTANT] -> The remote desktop with biometric feature does not work with [Dual Enrollment](#dual-enrollment) feature or scenarios where the user provides alternative credentials. Microsoft continues to investigate supporting the feature.\ +Users with Windows Hello for Business certificate trust can use their credential to authenticate to remote desktop sessions over RDP. When authenticating to the session, biometric gestures can be used if they are enrolled. For more information and configuration steps see [Remote Desktop](hello-feature-remote-desktop.md). ## Related topics diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md index 5a2a096de4..c75524b41e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md @@ -1,18 +1,19 @@ --- title: How Windows Hello for Business works - Authentication -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. +description: Learn about the authentication flow for Windows Hello for Business. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Windows Hello for Business and Authentication @@ -22,11 +23,11 @@ ms.date: 08/19/2018 Windows Hello for Business authentication is passwordless, two-factor authentication. Authenticating with Windows Hello for Business provides a convenient sign-in experience that authenticates the user to both Azure Active Directory and Active Directory resources.
                                  Azure Active Directory joined devices authenticate to Azure during sign-in and can optional authenticate to Active Directory. Hybrid Azure Active Directory joined devices authenticate to Active Directory during sign-in, and authenticate to Azure Active Directory in the background.
                                  -[Azure AD join authentication to Azure Active Directory](#Azure-AD-join-authentication-to-Azure-Active-Directory)
                                  -[Azure AD join authentication to Active Directory using a Key](#Azure-AD-join-authentication-to-Active-Directory-using-a-Key)
                                  -[Azure AD join authentication to Active Directory using a Certificate](#Azure-AD-join-authentication-to-Active-Directory-using-a-Certificate)
                                  -[Hybrid Azure AD join authentication using a Key](#Hybrid-Azure-AD-join-authentication-using-a-Key)
                                  -[Hybrid Azure AD join authentication using a Certificate](#Hybrid-Azure-AD-join-authentication-using-a-Certificate)
                                  +[Azure AD join authentication to Azure Active Directory](#azure-ad-join-authentication-to-azure-active-directory)
                                  +[Azure AD join authentication to Active Directory using a Key](#azure-ad-join-authentication-to-active-directory-using-a-key)
                                  +[Azure AD join authentication to Active Directory using a Certificate](#azure-ad-join-authentication-to-active-directory-using-a-certificate)
                                  +[Hybrid Azure AD join authentication using a Key](#hybrid-azure-ad-join-authentication-using-a-key)
                                  +[Hybrid Azure AD join authentication using a Certificate](#hybrid-azure-ad-join-authentication-using-a-certificate)
                                  ## Azure AD join authentication to Azure Active Directory @@ -40,7 +41,6 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |D | The Cloud AP provider receives the encrypted PRT with session key. Using the device's private transport key, the Cloud AP provider decrypt the session key and protects the session key using the device's TPM.| |E | The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT, and informs winlogon of the success authentication. Winlogon creates a logon session, loads the user's profile, and starts explorer.exe.| -[Return to top](#Windows-Hello-for-Business-and-Authentication) ## Azure AD join authentication to Active Directory using a Key ![Azure AD join authentication to Active Directory using a Key](images/howitworks/auth-aadj-keytrust-kerb.png) @@ -52,7 +52,6 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |C | The Kerberos provider ensures it can trust the response from the domain controller. First, it ensures the KDC certificate chains to a root certificate that is trusted by the device. Next, it ensures the certificate is within its validity period and that it has not be revoked. The Kerberos provider then verifies the certificate has the KDC Authentication present and that the subject alternate name listed in the KDC's certificate matches the domain name to which the user is authenticating. After passing this criteria, Kerberos returns the TGT to lsass, where it is cached and used for subsequent service ticket requests.| -[Return to top](#Windows-Hello-for-Business-and-Authentication) ## Azure AD join authentication to Active Directory using a Certificate ![Azure AD join authentication to Active Directory using a Certificate](images/howitworks/auth-aadj-certtrust-kerb.png) @@ -62,7 +61,6 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |B | The Kerberos provider sends the signed pre-authentication data and user's certificate, which includes the public key, to the Key Distribution Center (KDC) service running on the domain controller in the form of a KERB_AS_REQ.
                                  The domain controller determines the certificate is not self-signed certificate. The domain controller ensures the certificate chains to trusted root certificate, is within its validity period, can be used for authentication, and has not been revoked. It retrieves the public key and UPN from the certificate included in the KERB_AS_REQ and searches for the UPN in Active Directory. It validates the signed pre-authentication data using the public key from the certificate. On success, the KDC returns a TGT to the client with its certificate in a KERB_AS_REP.| |C | The Kerberos provider ensures it can trust the response from the domain controller. First, it ensures the KDC certificate chains to a root certificate that is trusted by the device. Next, it ensures the certificate is within its validity period and that it has not be revoked. The Kerberos provider then verifies the certificate has the KDC Authentication present and that the subject alternate name listed in the KDC's certificate matches the domain name to which the user is authenticating. After passing this criteria, Kerberos returns the TGT to lsass, where it is cached and used for subsequent service ticket requests.| -[Return to top](#Windows-Hello-for-Business-and-Authentication) ## Hybrid Azure AD join authentication using a Key ![Hybrid Azure AD join authentication using a Key](images/howitworks/auth-haadj-keytrust.png) @@ -76,7 +74,6 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |F | While Windows loads the user's desktop, lsass passes the collected credentials to the Cloud Authentication security support provider, referred to as the Cloud AP provider. The Cloud AP provider requests a nonce from Azure Active Directory. Azure AD returns a nonce.| |G | The Cloud AP provider signs the nonce using the user's private key and returns the signed nonce to the Azure Active Directory. Azure Active Directory validates the signed nonce using the user's securely registered public key against the nonce signature. After validating the signature, Azure AD then validates the returned signed nonce. After validating the nonce, Azure AD creates a PRT with session key that is encrypted to the device's transport key and returns it to the Cloud AP provider.
                                  The Cloud AP provider receives the encrypted PRT with session key. Using the device's private transport key, the Cloud AP provider decrypt the session key and protects the session key using the device's TPM.
                                  The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT.| -[Return to top](#Windows-Hello-for-Business-and-Authentication) ## Hybrid Azure AD join authentication using a Certificate ![Hybrid Azure AD join authentication using a Certificate](images/howitworks/auth-haadj-certtrust.png) @@ -90,6 +87,3 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |F | While Windows loads the user's desktop, lsass passes the collected credentials to the Cloud Authentication security support provider, referred to as the Cloud AP provider. The Cloud AP provider requests a nonce from Azure Active Directory. Azure AD returns a nonce.| |G | The Cloud AP provider signs the nonce using the user's private key and returns the signed nonce to the Azure Active Directory. Azure Active Directory validates the signed nonce using the user's securely registered public key against the nonce signature. After validating the signature, Azure AD then validates the returned signed nonce. After validating the nonce, Azure AD creates a PRT with session key that is encrypted to the device's transport key and returns it to the Cloud AP provider.
                                  The Cloud AP provider receives the encrypted PRT with session key. Using the device's private transport key, the Cloud AP provider decrypt the session key and protects the session key using the device's TPM.
                                  The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT.| -[Return to top](#Windows-Hello-for-Business-and-Authentication) - - diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md index 5bdfbc21f8..4cbec54f34 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Windows Hello for Business and Device Registration @@ -26,9 +27,6 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning [Hybrid Azure AD joined in Managed environments](#hybrid-azure-ad-joined-in-managed-environments)
                                  [Hybrid Azure AD joined in Federated environments](#hybrid-azure-ad-joined-in-federated-environments)
                                  - - - ## Azure AD joined in Managed environments ![Azure AD joined in Managed environments](images/howitworks/devreg-aadj-managed.png) @@ -43,7 +41,7 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning |G | The application sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then writes a device object in Azure Active Directory and sends the device ID and the device certificate to the client.| |H | Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the process continues with MDM enrollment.| -[Return to top](#Windows-Hello-for-Business-and-Device-Registration) +[Return to top](#windows-hello-for-business-and-device-registration) ## Azure AD joined in Federated environments ![Azure AD joined in Managed environments](images/howitworks/devreg-aadj-federated.png) @@ -59,7 +57,7 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning |H | The application sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then writes a device object in Azure Active Directory and sends the device ID and the device certificate to the client.| |I | Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the process continues with MDM enrollment.| -[Return to top](#Windows-Hello-for-Business-and-Device-Registration) +[Return to top](#windows-hello-for-business-and-device-registration) ## Hybrid Azure AD joined in Managed environments ![Hybrid Azure AD joined in Managed environments](images/howitworks/devreg-hybrid-haadj-managed.png) @@ -74,7 +72,7 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning |G | The task sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then updates the device object in Azure Active Directory and sends the device ID and the device certificate to the client.| |H | Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the task exits.| -[Return to top](#Windows-Hello-for-Business-and-Device-Registration) +[Return to top](#windows-hello-for-business-and-device-registration) ## Hybrid Azure AD joined in Federated environments ![Hybrid Azure AD joined in Managed environments](images/howitworks/devreg-hybrid-haadj-federated.png) @@ -88,4 +86,4 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning |F | The task sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then writes a device object in Azure Active Directory and sends the device ID and the device certificate to the client. Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the task exits.| |G | If Azure AD Connect device write-back is enabled, Azure AD Connect requests updates from Azure Active Directory at its next synchronization cycle (device write-back is required for hybrid deployment using certificate trust). Azure Active Directory correlates the device object with a matching synchronized computer object. Azure AD Connect receives the device object that includes the object GUID and computer SID and writes the device object to Active Directory.| -[Return to top](#Windows-Hello-for-Business-and-Device-Registration) +[Return to top](#windows-hello-for-business-and-device-registration) diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index f07f4f199a..f220db21f6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -1,22 +1,23 @@ --- title: How Windows Hello for Business works - Provisioning -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. +description: Explore the provisioning flows for Windows Hello for Business, from within a variety of environments. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Windows Hello for Business Provisioning -**Applies to:** +Applies to: - Windows 10 Windows Hello for Business provisioning enables a user to enroll a new, strong, two-factor credential that they can use for passwordless authentication. Provisioning experience vary based on: @@ -27,12 +28,12 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Azure AD joined provisioning in a Managed environment](#azure-ad-joined-provisioning-in-a-managed-environment)
                                  [Azure AD joined provisioning in a Federated environment](#azure-ad-joined-provisioning-in-a-federated-environment)
                                  [Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment](#hybrid-azure-ad-joined-provisioning-in-a-key-trust-deployment-in-a-managed-environment)
                                  -[Hybrid Azure AD joined provisioning in a Certificate Trust deployment in a Managed environment](#hybrid-azure-ad-joined-provisioning-in-a-certificate-trust-deployment-in-a-managed-environment)
                                  -[Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Managed environment](#hybrid-azure-ad-joined-provisioning-in-a-synchronous-certificate-trust-deployment-in-a-managed-environment)
                                  [Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment](#hybrid-azure-ad-joined-provisioning-in-a-synchronous-certificate-trust-deployment-in-a-federated-environment)
                                  [Domain joined provisioning in an On-premises Key Trust deployment](#domain-joined-provisioning-in-an-on-premises-key-trust-deployment)
                                  [Domain joined provisioning in an On-premises Certificate Trust deployment](#domain-joined-provisioning-in-an-on-premises-certificate-trust-deployment)
                                  +> [!NOTE] +> The flows in this section are not exhaustive for every possible scenario. For example, Federated Key Trust is also a supported configuration. ## Azure AD joined provisioning in a Managed environment @@ -56,71 +57,40 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, |C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates MFA claim remains current. On successful validation, Azure DRS locates the user's object in Azure Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Azure Active Directory returns key ID to the application which signals the end of user provisioning and the application exits.| [Return to top](#windows-hello-for-business-provisioning) -## Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed envrionment -![Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed ennvironment](images/howitworks/prov-haadj-keytrust-managed.png) +## Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment +![Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment](images/howitworks/prov-haadj-keytrust-managed.png) + + +| Phase | Description | +|:-----:|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Azure Active Directory Web Account Manager plug-in.
                                  Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Azure MFA services provides the second factor of authentication. If the user has performed Azure MFA within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they are not prompted for MFA because the current MFA remains valid.
                                  Azure Active Directory validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. | +| B | After receiving a ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pre-generation pool, which includes attestation data. This is the user key (ukpub/ukpriv). | +| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Azure Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Azure Active Directory returns a key ID to the application which signals the end of user provisioning and the application exits. | +| D | Azure AD Connect requests updates on its next synchronization cycle. Azure Active Directory sends the user's public key that was securely registered through provisioning. AAD Connect receives the public key and writes it to user's msDS-KeyCredentialLink attribute in Active Directory. | -| Phase | Description | -| :----: | :----------- | -| A|The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Azure Active Directory Web Account Manager plug-in.
                                  Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Azure MFA services provides the second factor of authentication. If the user has performed Azure MFA within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they are not prompted for MFA because the current MFA remains valid.
                                  Azure Active Directory validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. | -|B | After receiving a ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pre-generation pool, which includes attestation data. This is the user key (ukpub/ukpriv).| -|C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Azure Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Azure Active Directory returns a key ID to the application which signals the end of user provisioning and the application exits.| -|D | Azure AD Connect requests updates on its next synchronization cycle. Azure Active Directory sends the user's public key that was securely registered through provisioning. AAD Connect receives the public key and writes it to user's msDS-KeyCredentialLink attribute in Active Directory.| > [!IMPORTANT] -> The newly provisionied user will not be able to sign in using Windows Hello for Business until Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory. +> The newly provisioned user will not be able to sign in using Windows Hello for Business until Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory. -[Return to top](#windows-hello-for-business-provisioning) -## Hybrid Azure AD joined provisioning in a Certificate Trust deployment in a Managed environment -![Hybrid Azure AD joined provisioning in a Certificate Trust deployment in a Managed environment](images/howitworks/prov-haadj-certtrust-managed.png) - -| Phase | Description | -| :----: | :----------- | -| A|The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Azure Active Directory Web Account Manager plug-in.
                                  Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Azure MFA services provides the second factor of authentication. If the user has performed Azure MFA within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they are not prompted for MFA because the current MFA remains valid.
                                  Azure Active Directory validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. | -|B | After receiving a ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pre-generation pool, which includes attestation data. This is the user key (ukpub/ukpriv).| -|C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Azure Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Azure Active Directory returns a key ID to the application, which represents the end of user key registration.| -|D | The certificate request portion of provisioning begins after the application receives a successful response from key registration. The application creates a PKCS#10 certificate request. The key used in the certificate request is the same key that was securely provisioned.
                                  The application sends the certificate request, which includes the public key, to the certificate registration authority hosted on the Active Directory Federation Services (AD FS) farm.
                                  After receiving the certificate request, the certificate registration authority queries Active Directory for the msDS-KeyCredentailsLink for a list of registered public keys.| -|E | The registration authority validates the public key in the certificate request matches a registered key for the user.
                                  If the public key in the certificate is not found in the list of registered public keys, certificate enrollment is deferred until Phase F completes. The application is informed of the deferment and exits to the user's desktop. The automatic certificate enrollment client triggers the Azure AD Web Account Manager plug-in to retry the certificate enrollment at 24, 85, 145, 205, 265, and 480 minutes after phase C successfully completes. The user must remain signed in for automatic certificate enrollment to trigger certificate enrollment. If the user signs out, automatic certificate enrollment is triggered approximately 30 minutes after the user's next sign in.
                                  After validating the public key, the registration authority signs the certificate request using its enrollment agent certificate.| -|G |The registration authority sends the certificate request to the enterprise issuing certificate authority. The certificate authority validates the certificate request is signed by a valid enrollment agent and, on success, issues a certificate and returns it to the registration authority that then returns the certificate to the application.| -|H | The application receives the newly issued certificate and installs the it into the Personal store of the user. This signals the end of provisioning.| -|F | Azure AD Connect requests updates on its next synchronization cycle. Azure Active Directory sends the user's public key that was securely registered through provisioning. AAD Connect receives the public key and writes it to user's msDS-KeyCredentialLink attribute in Active Directory.| -> [!IMPORTANT] -> The newly provisionied user will not be able to sign in using Windows Hello for Business until Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory. - - -[Return to top](#windows-hello-for-business-provisioning) -## Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Managed environment -![Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Managed environment](images/howitworks/prov-haadj-instant-certtrust-managed.png) - -| Phase | Description | -| :----: | :----------- | -| A|The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Azure Active Directory Web Account Manager plug-in.
                                  Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Azure MFA services provides the second factor of authentication. If the user has performed Azure MFA within the last 10 minutes, such as when registering the device from the out-of-box-experience (OOBE), then they are not prompted for MFA because the current MFA remains valid.
                                  Azure Active Directory validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. | -|B | After receiving a ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pre-generation pool, which includes attestation data. This is the user key (ukpub/ukpriv).| -|C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Azure Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Azure Active Directory returns a key ID and a key receipt to the application, which represents the end of user key registration.| -|D | The certificate request portion of provisioning begins after the application receives a successful response from key registration. The application creates a PKCS#10 certificate request. The key used in the certificate request is the same key that was securely provisioned.
                                  The application sends the key receipt and certificate request, which includes the public key, to the certificate registration authority hosted on the Active Directory Federation Services (AD FS) farm.
                                  After receiving the certificate request, the certificate registration authority queries Active Directory for the msDS-KeyCredentailsLink for a list of registered public keys.| -|E | The registration authority validates the public key in the certificate request matches a registered key for the user.
                                  If the public key in the certificate is not found in the list of registered public keys, it then validates the key receipt to confirm the key was securely registered with Azure.
                                  After validating the key receipt or public key, the registration authority signs the certificate request using its enrollment agent certificate.| -|F |The registration authority sends the certificate request to the enterprise issuing certificate authority. The certificate authority validates the certificate request is signed by a valid enrollment agent and, on success, issues a certificate and returns it to the registration authority that then returns the certificate to the application.| -|G | The application receives the newly issued certificate and installs the it into the Personal store of the user. This signals the end of provisioning.| -> [!IMPORTANT] -> Synchronous certificate enrollment does not depend on Azure AD Connect to syncrhonize the user's public key to issue the Windows Hello for Business authentication certificate. Users can sign-in using the certificate immediately after provisioning completes. Azure AD Connect continues to synchronize the public key to Active Directory, but is not show in this flow. - - [Return to top](#windows-hello-for-business-provisioning) ## Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment -![Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Fedeerated environment](images/howitworks/prov-haadj-instant-certtrust-federated.png) +![Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment](images/howitworks/prov-haadj-instant-certtrust-federated.png) + + +| Phase | Description | +|:-----:|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| A | The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Azure Active Directory Web Account Manager plug-in.
                                  In a federated environment, the plug-in sends the token request to the on-premises STS, such as Active Directory Federation Services. The on-premises STS authenticates the user and determines if the user should perform another factor of authentication.
                                  Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Azure MFA services (or a third party MFA service) provides the second factor of authentication.
                                  The on-premises STS server issues a enterprise token on successful MFA. The application sends the token to Azure Active Directory.
                                  Azure Active Directory validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. | +| B | After receiving a ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pre-generation pool, which includes attestation data. This is the user key (ukpub/ukpriv). | +| C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Azure Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Azure Active Directory returns a key ID and a key receipt to the application, which represents the end of user key registration. | +| D | The certificate request portion of provisioning begins after the application receives a successful response from key registration. The application creates a PKCS#10 certificate request. The key used in the certificate request is the same key that was securely provisioned.
                                  The application sends the key receipt and certificate request, which includes the public key, to the certificate registration authority hosted on the Active Directory Federation Services (AD FS) farm.
                                  After receiving the certificate request, the certificate registration authority queries Active Directory for the msDS-KeyCredentialsLink for a list of registered public keys. | +| E | The registration authority validates the public key in the certificate request matches a registered key for the user.
                                  If the public key in the certificate is not found in the list of registered public keys, it then validates the key receipt to confirm the key was securely registered with Azure.
                                  After validating the key receipt or public key, the registration authority signs the certificate request using its enrollment agent certificate. | +| F | The registration authority sends the certificate request to the enterprise issuing certificate authority. The certificate authority validates the certificate request is signed by a valid enrollment agent and, on success, issues a certificate and returns it to the registration authority that then returns the certificate to the application. | +| G | The application receives the newly issued certificate and installs the it into the Personal store of the user. This signals the end of provisioning. | -| Phase | Description | -| :----: | :----------- | -| A|The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Azure Device Registration Service (ADRS). The application makes the request using the Azure Active Directory Web Account Manager plug-in.
                                  In a federated environment, the plug-in sends the token request to the on-premises STS, such as Active Directory Federation Services. The on-premises STS authenticates the user and determines if the user should perform another factor of authentication.
                                  Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Azure MFA services (or a third party MFA service) provides the second factor of authentication.
                                  The on-premises STS server issues a enterprise token on successful MFA. The application sends the token to Azure Active Directory.
                                  Azure Active Directory validates the access token request and the MFA claim associated with it, creates an ADRS access token, and returns it to the application. | -|B | After receiving a ADRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pre-generation pool, which includes attestation data. This is the user key (ukpub/ukpriv).| -|C | The application sends the ADRS token, ukpub, attestation data, and device information to ADRS for user key registration. Azure DRS validates the MFA claim remains current. On successful validation, Azure DRS locates the user's object in Azure Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. Azure Active Directory returns a key ID and a key receipt to the application, which represents the end of user key registration.| -|D | The certificate request portion of provisioning begins after the application receives a successful response from key registration. The application creates a PKCS#10 certificate request. The key used in the certificate request is the same key that was securely provisioned.
                                  The application sends the key receipt and certificate request, which includes the public key, to the certificate registration authority hosted on the Active Directory Federation Services (AD FS) farm.
                                  After receiving the certificate request, the certificate registration authority queries Active Directory for the msDS-KeyCredentailsLink for a list of registered public keys.| -|E | The registration authority validates the public key in the certificate request matches a registered key for the user.
                                  If the public key in the certificate is not found in the list of registered public keys, it then validates the key receipt to confirm the key was securely registered with Azure.
                                  After validating the key receipt or public key, the registration authority signs the certificate request using its enrollment agent certificate.| -|F |The registration authority sends the certificate request to the enterprise issuing certificate authority. The certificate authority validates the certificate request is signed by a valid enrollment agent and, on success, issues a certificate and returns it to the registration authority that then returns the certificate to the application.| -|G | The application receives the newly issued certificate and installs the it into the Personal store of the user. This signals the end of provisioning.| > [!IMPORTANT] -> Synchronous certificate enrollment does not depend on Azure AD Connect to syncrhonize the user's public key to issue the Windows Hello for Business authentication certificate. Users can sign-in using the certificate immediately after provisioning completes. Azure AD Connect continues to synchronize the public key to Active Directory, but is not show in this flow. +> Synchronous certificate enrollment does not depend on Azure AD Connect to synchronize the user's public key to issue the Windows Hello for Business authentication certificate. Users can sign-in using the certificate immediately after provisioning completes. Azure AD Connect continues to synchronize the public key to Active Directory, but is not shown in this flow. [Return to top](#windows-hello-for-business-provisioning) ## Domain joined provisioning in an On-premises Key Trust deployment @@ -142,7 +112,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, |A| The provisioning application hosted in the Cloud Experience Host (CXH) starts provisioning by requesting an access token for the Enterprise Device Registration Service (EDRS). The application makes the request using the Azure Active Directory Web Account Manager plug-in.
                                  In an on-premises deployment, the plug-in sends the token request to the on-premises STS, such as Active Directory Federation Services. The on-premises STS authenticates the user and determines if the user should perform another factor of authentication.
                                  Users must provide two factors of authentication. In this phase, the user has already provided one factor of authentication, typically user name and password. Azure MFA server (or a third party MFA service) provides the second factor of authentication.
                                  The on-premises STS server issues a enterprise DRS token on successful MFA.| | B| After receiving a EDRS access token, the application detects if the device has a Windows Hello biometric compatible sensor. If the application detects a biometric sensor, it gives the user the choice to enroll biometrics. After completing or skipping biometric enrollment, the application requires the user to create a PIN and the default (and fall-back gesture when used with biometrics). The user provides and confirms their PIN. Next, the application requests a Windows Hello for Business key pair from the key pre-generation pool, which includes attestation data. This is the user key (ukpub/ukpriv).| |C | The application sends the EDRS token, ukpub, attestation data, and device information to the Enterprise DRS for user key registration. Enterprise DRS validates the MFA claim remains current. On successful validation, the Enterprise DRS locates the user's object in Active Directory, writes the key information to a multi-values attribute. The key information includes a reference to the device from which it was created. The Enterprise DRS returns a key ID to the application, which represents the end of user key registration.| -|D | The certificate request portion of provisioning begins after the application receives a successful response from key registration. The application creates a PKCS#10 certificate request. The key used in the certificate request is the same key that was securely provisioned.
                                  The application sends the certificate request, which includes the public key, to the certificate registration authority hosted on the Active Directory Federation Services (AD FS) farm.
                                  After receiving the certificate request, the certificate registration authority queries Active Directory for the msDS-KeyCredentailsLink for a list of registered public keys.| +|D | The certificate request portion of provisioning begins after the application receives a successful response from key registration. The application creates a PKCS#10 certificate request. The key used in the certificate request is the same key that was securely provisioned.
                                  The application sends the certificate request, which includes the public key, to the certificate registration authority hosted on the Active Directory Federation Services (AD FS) farm.
                                  After receiving the certificate request, the certificate registration authority queries Active Directory for the msDS-KeyCredentialsLink for a list of registered public keys.| |E | The registration authority validates the public key in the certificate request matches a registered key for the user.
                                  After validating the public key, the registration authority signs the certificate request using its enrollment agent certificate.| |F |The registration authority sends the certificate request to the enterprise issuing certificate authority. The certificate authority validates the certificate request is signed by a valid enrollment agent and, on success, issues a certificate and returns it to the registration authority that then returns the certificate to the application.| |G | The application receives the newly issued certificate and installs it into the Personal store of the user. This signals the end of provisioning.| diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md index e3304e2432..0e03beb9e3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-tech-deep-dive.md @@ -1,19 +1,20 @@ --- -title: How Windows Hello for Business works - Techincal Deep Dive -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. +title: How Windows Hello for Business works - Technical Deep Dive +description: Deeply explore how Windows Hello for Business works, and how it can help your users authenticate to services. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust, works ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Technical Deep Dive @@ -21,9 +22,9 @@ ms.date: 08/19/2018 - Windows 10 Windows Hello for Business authentication works through collection of components and infrastructure working together. You can group the infrastructure and components in three categories: -- [Registration](#Registration) -- [Provisioning](#Provisioning) -- [Authentication](#Authentication) +- [Registration](#registration) +- [Provisioning](#provisioning) +- [Authentication](#authentication) ## Registration @@ -43,6 +44,6 @@ Provision can occur automatically through the out-of-box-experience (OOBE) on Az ## Authentication -Authentication using Windows Hello for Business is the goal, and the first step in getting to a passwordless environment. With the device registered, and provisioning complete. Users can sign-in to Windows 10 using biometrics or a PIN. PIN is the most common gesture and is avaiable on most computers and devices. Regardless of the gesture used, authentication occurs using the private portion of the Windows Hello for Business credential. The PIN nor the private portion of the credential are never sent to the identity provider, and the PIN is not stored on the device. It is user provided entropy when performing operations that use the private portion of the credential. +Authentication using Windows Hello for Business is the goal, and the first step in getting to a passwordless environment. With the device registered, and provisioning complete. Users can sign-in to Windows 10 using biometrics or a PIN. PIN is the most common gesture and is available on most computers and devices. Regardless of the gesture used, authentication occurs using the private portion of the Windows Hello for Business credential. The PIN nor the private portion of the credential are never sent to the identity provider, and the PIN is not stored on the device. It is user provided entropy when performing operations that use the private portion of the credential. -[How Windows Hello for Business authentication works](hello-how-it-works-authentication.md) \ No newline at end of file +[How Windows Hello for Business authentication works](hello-how-it-works-authentication.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md index 936c4a59e4..7de79a7f47 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-technology.md @@ -1,29 +1,31 @@ --- title: How Windows Hello for Business works - Technology and Terms -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. +description: Explore technology and terms associated with Windows Hello for Business. Learn how Windows Hello for Business works. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 10/08/2018 +ms.reviewer: --- # Technology and Terms **Applies to:** -- Windows 10 +- Windows 10 - [Attestation Identity Keys](#attestation-identity-keys) - [Azure AD Joined](#azure-ad-joined) - [Azure AD Registered](#azure-ad-registered) - [Certificate Trust](#certificate-trust) - [Cloud Deployment](#cloud-deployment) +- [Cloud Experience Host](#cloud-experience-host) - [Deployment Type](#deployment-type) - [Endorsement Key](#endorsement-key) - [Federated Environment](#federated-environment) @@ -33,13 +35,13 @@ ms.date: 10/08/2018 - [Key Trust](#key-trust) - [Managed Environment](#managed-environment) - [On-premises Deployment](#on-premises-deployment) -- [Pass-through Authentication](#passthrough-authentication) -- [Password Hash Synchronization](#password-hash-synchronization) +- [Pass-through Authentication](#pass-through-authentication) +- [Password Hash Synchronization](#password-hash-sync) - [Primary Refresh Token](#primary-refresh-token) - [Storage Root Key](#storage-root-key) - [Trust Type](#trust-type) - [Trusted Platform Module](#trusted-platform-module) -
                                  +
                                  ## Attestation Identity Keys Because the endorsement certificate is unique for each device and does not change, the usage of it may present privacy concerns because it's theoretically possible to track a specific device. To avoid this privacy problem, Windows 10 issues a derived attestation anchor based on the endorsement certificate. This intermediate key, which can be attested to an endorsement key, is the Attestation Identity Key (AIK) and the corresponding certificate is called the AIK certificate. This AIK certificate is issued by a Microsoft cloud service. @@ -69,7 +71,7 @@ Azure AD Join is intended for organizations that desire to be cloud-first or clo [Join Type](#join-type), [Hybrid Azure AD Joined](#hybrid-azure-ad-joined) ### More information - - [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction). +- [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction). [Return to Top](hello-how-it-works-technology.md) ## Azure AD Registered @@ -99,6 +101,17 @@ The Windows Hello for Business Cloud deployment is exclusively for organizations [Azure AD Joined](#azure-ad-joined), [Azure AD Registered](#azure-ad-registered), [Deployment Type](#deployment-type), [Join Type](#join-type) [Return to Top](hello-how-it-works-technology.md) +## Cloud Experience Host +In Windows 10, Cloud Experience Host is an application used while joining the workplace environment or Azure AD for rendering the experience when collecting your company-provided credentials. Once you enroll your device to your workplace environment or Azure AD, your organization will be able to manage your PC and collect information about you (including your location). It might add or remove apps or content, change settings, disable features, prevent you from removing your company account, or reset your PC. + +### Related topics +[Windows Hello for Business](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-identity-verification), [Managed Windows Hello in Organization](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-manage-in-organization) + +### More information +- [Windows Hello for Business and Device Registration](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration) + +[Return to Top](hello-how-it-works-technology.md) + ## Deployment Type Windows Hello for Business has three deployment models to accommodate the needs of different organizations. The three deployment models include: - Cloud @@ -149,7 +162,7 @@ Primarily for large enterprise organizations with more complex authentication re For more than a decade, many organizations have used the domain join to their on-premises Active Directory to enable: - IT departments to manage work-owned devices from a central location. - Users to sign in to their devices with their Active Directory work or school accounts. -Typically, organizations with an on-premises footprint rely on imaging methods to provision devices, and they often use System Center Configuration Manager (SCCM) or group policy (GP) to manage them. +Typically, organizations with an on-premises footprint rely on imaging methods to provision devices, and they often use Microsoft Endpoint Configuration Manager or group policy (GP) to manage them. If your environment has an on-premises AD footprint and you also want benefit from the capabilities provided by Azure Active Directory, you can implement hybrid Azure AD joined devices. These are devices that are both, joined to your on-premises Active Directory and your Azure Active Directory. @@ -187,7 +200,7 @@ Joining a device is an extension to registering a device. This means, it provide [Return to Top](hello-how-it-works-technology.md) ## Key Trust -The key trust model uses the user's Windows Hello for Business identity to authenticate to on-premises Active Directory. The certificate trust model is supported in hybrid and on-premises deployments and requires Windows Server 2016 domain controllers. +The key trust model uses the user's Windows Hello for Business identity to authenticate to on-premises Active Directory. The key trust model is supported in hybrid and on-premises deployments and requires Windows Server 2016 domain controllers. ### Related topics [Certificate Trust](#certificate-trust), [Deployment Type](#deployment-type), [Hybrid Azure AD Joined](#hybrid-azure-ad-joined), [Hybrid Deployment](#hybrid-deployment), [On-premises Deployment](#on-premises-deployment), [Trust Type](#trust-type) @@ -200,9 +213,9 @@ The key trust model uses the user's Windows Hello for Business identity to authe Managed environments are for non-federated environments where Azure Active Directory manages the authentication using technologies such as Password Hash Synchronization and Pass-through Authentication rather than a federation service such as Active Directory Federation Services. ### Related topics -[Federated Environment](#federated-environment), [Pass-through authentication](#pass-through-authentication), [Password Hash Synchronization](#password-hash-synchronization) +[Federated Environment](#federated-environment), [Pass-through authentication](#pass-through-authentication), [Password Hash Synchronization](#password-hash-sync) -[Return to Top](#Technology-and-Terms) +[Return to Top](#technology-and-terms) ## On-premises Deployment The Windows Hello for Business on-premises deployment is for organizations that exclusively have on-premises resources that are accessed using Active Directory identities. On-premises deployments support domain joined devices. The on-premises deployment model supports two authentication trust types, key trust and certificate trust. @@ -217,13 +230,13 @@ The Windows Hello for Business on-premises deployment is for organizations that Provides a simple password validation for Azure AD authentication services using a software agent running on one or more on-premises servers to validate the users directly with your on-premises Active Directory. With pass-through authentication (PTA), you synchronize on-premises Active Directory user account objects with Office 365 and manage your users on-premises. Allows your users to sign in to both on-premises and Office 365 resources and applications using their on-premises account and password. This configuration validates users' passwords directly against your on-premises Active Directory without sending password hashes to Office 365. Companies with a security requirement to immediately enforce on-premises user account states, password policies, and logon hours would use this authentication method. With seamless single sign-on, users are automatically signed in to Azure AD when they are on their corporate devices and connected to your corporate network. ### Related topics -[Federated Environment](#federated-environment), [Managed Environment](#managed-environment), [Password Hash Synchronization](#password-hash-synchronization) +[Federated Environment](#federated-environment), [Managed Environment](#managed-environment), [Password Hash Synchronization](#password-hash-sync) ### More information - [Choosing the right authentication method for your Azure Active Directory hybrid identity solution](https://docs.microsoft.com/azure/security/azure-ad-choose-authn) -[Return to Top](#hello-how-it-works-technology.md) +[Return to Top](hello-how-it-works-technology.md) ## Password Hash Sync The simplest way to enable authentication for on-premises directory objects in Azure AD. With password hash sync (PHS), you synchronize your on-premises Active Directory user account objects with Office 365 and manage your users on-premises. Hashes of user passwords are synchronized from your on-premises Active Directory to Azure AD so that the users have the same password on-premises and in the cloud. When passwords are changed or reset on-premises, the new password hashes are synchronized to Azure AD so that your users can always use the same password for cloud resources and on-premises resources. The passwords are never sent to Azure AD or stored in Azure AD in clear text. Some premium features of Azure AD, such as Identity Protection, require PHS regardless of which authentication method is selected. With seamless single sign-on, users are automatically signed in to Azure AD when they are on their corporate devices and connected to your corporate network. @@ -241,7 +254,7 @@ The PRT is initially obtained during Windows Logon (user sign-in/unlock) in a si The PRT is needed for SSO. Without it, the user will be prompted for credentials when accessing applications every time. Please also note that the PRT contains information about the device. This means that if you have any [device-based conditional access](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-policy-connected-applications) policy set on an application, without the PRT, access will be denied. -[Return to Top](#Technology-and-Terms) +[Return to Top](#technology-and-terms) ## Storage Root Key The storage root key (SRK) is also an asymmetric key pair (RSA with a minimum of 2048 bits length). The SRK has a major role and is used to protect TPM keys, so that these keys cannot be used without the TPM. The SRK key is created when the ownership of the TPM is taken. @@ -272,9 +285,9 @@ A TPM implements controls that meet the specification described by the Trusted C - The first TPM specification, version 1.2, was published in February 2005 by the TCG and standardized under ISO / IEC 11889 standard. - The latest TPM specification, referred to as TPM 2.0, was released in April 2014 and has been approved by the ISO/IEC Joint Technical Committee (JTC) as ISO/IEC 11889:2015. -Windows�10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Windows Hello, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=733948). +Windows 10 uses the TPM for cryptographic calculations as part of health attestation and to protect the keys for BitLocker, Windows Hello, virtual smart cards, and other public key certificates. For more information, see [TPM requirements in Windows 10](https://go.microsoft.com/fwlink/p/?LinkId=733948). -Windows�10 recognizes versions 1.2 and 2.0 TPM specifications produced by the TCG. For the most recent and modern security features, Windows�10 supports only TPM 2.0. +Windows 10 recognizes versions 1.2 and 2.0 TPM specifications produced by the TCG. For the most recent and modern security features, Windows 10 supports only TPM 2.0. TPM 2.0 provides a major revision to the capabilities over TPM 1.2: @@ -304,18 +317,3 @@ In a simplified manner, the TPM is a passive component with limited resources. I [Return to Top](hello-how-it-works-technology.md) - - - - - - - - - - - - - - - diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md index d5904c2e0e..de0d46631b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md @@ -1,18 +1,19 @@ --- title: How Windows Hello for Business works -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. +description: Learn how Windows Hello for Business works, and how it can help your users authenticate to services. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 05/05/2018 +ms.reviewer: --- # How Windows Hello for Business works @@ -41,4 +42,4 @@ Windows Hello for Business is a distributed system that uses several components - [Windows Hello and password changes](hello-and-password-changes.md) - [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) - [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index d231dc9a9c..54e4021adc 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -1,19 +1,20 @@ --- title: Configure Azure AD joined devices for On-premises Single-Sign On using Windows Hello for Business -description: Azure Active Directory joined devices in a hybrid Deployment for on-premises single sign-on +description: Before adding Azure Active Directory (Azure AD) joined devices to your existing hybrid deployment, you need to verify the existing deployment can support them. keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Configure Azure AD joined devices for On-premises Single-Sign On using Windows Hello for Business @@ -43,7 +44,7 @@ If you upgraded your Active Directory schema to the Windows Server 2016 schema a A fundamental prerequisite of all cloud and hybrid Windows Hello for Business deployments is device registration. A user cannot provision Windows Hello for Business unless the device from which they are trying to provision has registered with Azure Active Directory. For more information about device registration, read [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/devices/overview). You can use the **dsregcmd.exe** command to determine if your device is registered to Azure Active Directory. -![dsregcmd outpout](images/aadj/dsregcmd.png) +![dsregcmd output](images/aadj/dsregcmd.png) ### CRL Distribution Point (CDP) @@ -57,6 +58,9 @@ To resolve this issue, the CRL distribution point must be a location that is acc If your CRL distribution point does not list an HTTP distribution point, then you need to reconfigure the issuing certificate authority to include an HTTP CRL distribution point, preferably first in the list of distribution points. +> [!NOTE] +> If your CA has published both the Base and the Delta CRL, please make sure you have included publishing the Delta CRL in the HTTP path. Include web server to fetch the Delta CRL by allowing double escaping in the (IIS) web server. + ### Windows Server 2016 Domain Controllers If you are interested in configuring your environment to use the Windows Hello for Business key rather than a certificate, then your environment must have an adequate number of Windows Server 2016 domain controllers. Only Windows Server 2016 domain controllers are capable of authenticating user with a Windows Hello for Business key. What do we mean by adequate? We are glad you asked. Read [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. @@ -89,7 +93,7 @@ Steps you will perform include: - [Configure Internet Information Services to host CRL distribution point](#configure-internet-information-services-to-host-crl-distribution-point) - [Prepare a file share to host the certificate revocation list](#prepare-a-file-share-to-host-the-certificate-revocation-list) -- [Configure the new CRL distribution point in the issuing certificate authority](#Configure-the-new-crl-distribution-point-in-the-issuing-certificate-authority) +- [Configure the new CRL distribution point and Publishing location in the issuing certificate authority](#configure-the-new-crl-distribution-point-and-publishing-location-in-the-issuing-certificate-authority) - [Publish CRL](#publish-a-new-crl) - [Reissue domain controller certificates](#reissue-domain-controller-certificates) @@ -113,16 +117,16 @@ You need to host your new certificate revocation list of a web server so Azure A 1. From **Windows Administrative Tools**, Open **Internet Information Services (IIS) Manager**. 2. Expand the navigation pane to show **Default Web Site**. Select and then right-click **Default Web site** and click **Add Virtual Directory...**. 3. In the **Add Virtual Directory** dialog box, type **cdp** in **alias**. For physical path, type or browse for the physical file location where you will host the certificate revocation list. For this example, the path **c:\cdp** is used. Click **OK**. -![Add Virtual Directory](images/aadj/iis-add-virtual-directory.png) -> [!NOTE] -> Make note of this path as you will use it later to configure share and file permissions. + ![Add Virtual Directory](images/aadj/iis-add-virtual-directory.png) + > [!NOTE] + > Make note of this path as you will use it later to configure share and file permissions. 4. Select **CDP** under **Default Web Site** in the navigation pane. Double-click **Directory Browsing** in the content pane. Click **Enable** in the details pane. 5. Select **CDP** under **Default Web Site** in the navigation pane. Double-click **Configuration Editor**. 6. In the **Section** list, navigate to **system.webServer/security/requestFiltering**. -![IIS Configuration Editor requestFiltering](images/aadj/iis-config-editor-requestFiltering.png) -In the list of named value-pairs in the content pane, configure **allowDoubleEscapting** to **True**. Click **Apply** in the actions pane. -![IIS Configuration Editor double escaping](images/aadj/iis-config-editor-allowDoubleEscaping.png) + ![IIS Configuration Editor requestFiltering](images/aadj/iis-config-editor-requestFiltering.png) + In the list of named value-pairs in the content pane, configure **allowDoubleEscaping** to **True**. Click **Apply** in the actions pane. + ![IIS Configuration Editor double escaping](images/aadj/iis-config-editor-allowDoubleEscaping.png) 7. Close **Internet Information Services (IIS) Manager**. #### Create a DNS resource record for the CRL distribution point URL @@ -141,7 +145,7 @@ These procedures configure NTFS and share permissions on the web server to allow 1. On the web server, open **Windows Explorer** and navigate to the **cdp** folder you created in step 3 of [Configure the Web Server](#configure-the-web-server). 2. Right-click the **cdp** folder and click **Properties**. Click the **Sharing** tab. Click **Advanced Sharing**. -3. Select **Share this folder**. Type **cdp$** in **Share name:**. Click **Permissions**. +3. Select **Share this folder**. Type **cdp$** in **Share name**. Click **Permissions**. ![cdp sharing](images/aadj/cdp-sharing.png) 4. In the **Permissions for cdp$** dialog box, click **Add**. 5. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, click **Object Types**. In the **Object Types** dialog box, select **Computers**, and then click **OK**. @@ -179,12 +183,12 @@ The web server is ready to host the CRL distribution point. Now, configure the 1. On the issuing certificate authority, sign-in as a local administrator. Start the **Certificate Authority** console from **Administrative Tools**. 2. In the navigation pane, right-click the name of the certificate authority and click **Properties** 3. Click **Extensions**. On the **Extensions** tab, select **CRL Distribution Point (CDP)** from the **Select extension** list. -4. On the **Extensions** tab, click **Add**. Type **http://crl.[domainname]/cdp/** in **location**. For example, *http://crl.corp.contoso.com/cdp/* or *http://crl.contoso.com/cdp/* (do not forget the trailing forward slash). -![CDP New Location dialog box](images/aadj/cdp-extension-new-location.png) +4. On the **Extensions** tab, click **Add**. Type http://crl.[domainname]/cdp/ in **location**. For example, ** or ** (do not forget the trailing forward slash). + ![CDP New Location dialog box](images/aadj/cdp-extension-new-location.png) 5. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. 6. Type **.crl** at the end of the text in **Location**. Click **OK**. 7. Select the CDP you just created. -![CDP complete http](images/aadj/cdp-extension-complete-http.png) + ![CDP complete http](images/aadj/cdp-extension-complete-http.png) 8. Select **Include in CRLs. Clients use this to find Delta CRL locations**. 9. Select **Include in the CDP extension of issued certificates**. 10. Click **Apply** save your selections. Click **No** when ask to restart the service. @@ -197,11 +201,11 @@ The web server is ready to host the CRL distribution point. Now, configure the 1. On the issuing certificate authority, sign-in as a local administrator. Start the **Certificate Authority** console from **Administrative Tools**. 2. In the navigation pane, right-click the name of the certificate authority and click **Properties** 3. Click **Extensions**. On the **Extensions** tab, select **CRL Distribution Point (CDP)** from the **Select extension** list. -4. On the **Extensions** tab, click **Add**. Type the computer and share name you create for your CRL distribution point in [Configure the CDP file share](#configure-the-cdp-file-share). For example, **\\\app\cdp$\** (do not forget the trailing backwards slash). +4. On the **Extensions** tab, click **Add**. Type the computer and share name you create for your CRL distribution point in [Configure the CDP file share](#configure-the-cdp-file-share). For example, **\\\app\cdp$\\** (do not forget the trailing backwards slash). 5. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. 6. Type **.crl** at the end of the text in **Location**. Click **OK**. 7. Select the CDP you just created. -![CDP publishing location](images/aadj/cdp-extension-complete-unc.png) + ![CDP publishing location](images/aadj/cdp-extension-complete-unc.png) 8. Select **Publish CRLs to this location**. 9. Select **Publish Delta CRLs to this location**. 10. Click **Apply** save your selections. Click **Yes** when ask to restart the service. Click **OK** to close the properties dialog box. @@ -217,8 +221,8 @@ The web server is ready to host the CRL distribution point. Now, configure the Validate your new CRL distribution point is working. -1. Open a web browser. Navigate to **http://crl.[yourdomain].com/cdp**. You should see two files created from publishing your new CRL. -![Validate the new CRL](images/aadj/validate-cdp-using-browser.png) +1. Open a web browser. Navigate to http://crl.[yourdomain].com/cdp. You should see two files created from publishing your new CRL. + ![Validate the new CRL](images/aadj/validate-cdp-using-browser.png) ### Reissue domain controller certificates @@ -263,7 +267,7 @@ Steps you will perform include: 1. Sign-in a domain controller using administrative credentials. 2. Open the **Run** dialog box. Type **certlm.msc** to open the **Certificate Manager** for the local computer. 3. In the navigation pane, expand **Personal**. Click **Certificates**. In the details pane, double-click the existing domain controller certificate includes **KDC Authentication** in the list of **Intended Purposes**. -4. Click the **Certification Path** tab. In the **Certifcation path** view, select the top most node and click **View Certificate**. +4. Click the **Certification Path** tab. In the **Certification path** view, select the top most node and click **View Certificate**. ![Certificate Path](images/aadj/certlm-cert-path-tab.png) 5. In the new **Certificate** dialog box, click the **Details** tab. Click **Copy to File**. ![Details tab and copy to file](images/aadj/certlm-root-cert-details-tab.png) @@ -280,10 +284,10 @@ A **Trusted Certificate** device configuration profile is how you deploy trusted 1. Sign-in to the [Microsoft Azure Portal](https://portal.azure.com) and select **Microsoft Intune**. 2. Click **Device configuration**. In the **Device Configuration** blade, click **Create profile**. ![Intune Create Profile](images/aadj/intune-create-device-config-profile.png) -3. In the **Create profle** blade, type **Enterprise Root Certificate** in **Name**. Provide a description. Select **Windows 10 and later** from the **Platform** list. Select **Trusted certificate** from the **Profile type** list. Click **Configure**. +3. In the **Create profile** blade, type **Enterprise Root Certificate** in **Name**. Provide a description. Select **Windows 10 and later** from the **Platform** list. Select **Trusted certificate** from the **Profile type** list. Click **Configure**. 4. In the **Trusted Certificate** blade, use the folder icon to browse for the location of the enterprise root certificate file you created in step 8 of [Export Enterprise Root certificate](#export-enterprise-root-certificate). Click **OK**. Click **Create**. ![Intune Trusted Certificate Profile](images/aadj/intune-create-trusted-certificate-profile.png) -5. In the **Enterprise Root Certificate** blade, click **Assignmnets**. In the **Include** tab, select **All Devices** from the **Assign to** list. Click **Save**. +5. In the **Enterprise Root Certificate** blade, click **Assignments**. In the **Include** tab, select **All Devices** from the **Assign to** list. Click **Save**. ![Intune Profile assignment](images/aadj/intune-device-config-enterprise-root-assignment.png) 6. Sign out of the Microsoft Azure Portal. @@ -296,25 +300,25 @@ Sign-in a workstation with access equivalent to a _domain user_. 3. Click **device enrollment**. 4. Click **Windows enrollment** 5. Under **Windows enrollment**, click **Windows Hello for Business**. -![Create Intune Windows Hello for Business Policy](images/aadj/IntuneWHFBPolicy-00.png) + ![Create Intune Windows Hello for Business Policy](images/aadj/IntuneWHFBPolicy-00.png) 6. Under **Priority**, click **Default**. 7. Under **All users and all devices**, click **Settings**. 8. Select **Enabled** from the **Configure Windows Hello for Business** list. 9. Select **Required** next to **Use a Trusted Platform Module (TPM)**. By default, Windows Hello for Business prefers TPM 2.0 or falls backs to software. Choosing **Required** forces Windows Hello for Business to only use TPM 2.0 or TPM 1.2 and does not allow fall back to software based keys. 10. Type the desired **Minimum PIN length** and **Maximum PIN length**. -> [!IMPORTANT] -> The default minimum PIN length for Windows Hello for Business on Windows 10 is 6. Microsoft Intune defaults the minimum PIN length to 4, which reduces the security of the user's PIN. If you do not have a desired PIN length, set the minimum PIN length to 6. + > [!IMPORTANT] + > The default minimum PIN length for Windows Hello for Business on Windows 10 is 6. Microsoft Intune defaults the minimum PIN length to 4, which reduces the security of the user's PIN. If you do not have a desired PIN length, set the minimum PIN length to 6. ![Intune Windows Hello for Business policy settings](images/aadj/IntuneWHFBPolicy-01.png) 11. Select the appropriate configuration for the following settings. - * **Lowercase letters in PIN** - * **Uppercase letters in PIN** - * **Special characters in PIN** - * **PIN expiration (days)** - * **Remember PIN history** -> [!NOTE] -> The Windows Hello for Business PIN is not a symmetric key (a password). A copy of the current PIN is not stored locally or on a server like in the case of passwords. Making the PIN as complex and changed frequently as a password increases the likelihood of forgotten PINs. Additionally, enabling PIN history is the only scenario that requires Windows 10 to store older PIN combinations (protected to the current PIN). Windows Hello for Business combined with a TPM provides anti-hammering functionality that prevents brute force attacks of the user's PIN. If you are concerned with user-to-user shoulder surfacing, rather that forcing complex PIN that change frequently, consider using the [Multifactor Unlock](feature-multifactor-unlock.md) feature. + * **Lowercase letters in PIN** + * **Uppercase letters in PIN** + * **Special characters in PIN** + * **PIN expiration (days)** + * **Remember PIN history** + > [!NOTE] + > The Windows Hello for Business PIN is not a symmetric key (a password). A copy of the current PIN is not stored locally or on a server like in the case of passwords. Making the PIN as complex and changed frequently as a password increases the likelihood of forgotten PINs. Additionally, enabling PIN history is the only scenario that requires Windows 10 to store older PIN combinations (protected to the current PIN). Windows Hello for Business combined with a TPM provides anti-hammering functionality that prevents brute force attacks of the user's PIN. If you are concerned with user-to-user shoulder surfacing, rather that forcing complex PIN that change frequently, consider using the [Multifactor Unlock](feature-multifactor-unlock.md) feature. 12. Select **Yes** next to **Allow biometric authentication** if you want to allow users to use biometrics (fingerprint and/or facial recognition) to unlock the device. To further secure the use of biometrics, select **Yes** to **Use enhanced anti-spoofing, when available**. 13. Select **No** to **Allow phone sign-in**. This feature has been deprecated. @@ -334,6 +338,3 @@ Sign-in a workstation with access equivalent to a _domain user_. If you plan on using certificates for on-premises single-sign on, perform the additional steps in [Using Certificates for On-premises Single-sign On](hello-hybrid-aadj-sso-cert.md). - - - diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 5ea3bbbae9..54f37c9b50 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -1,19 +1,20 @@ --- title: Using Certificates for AADJ On-premises Single-sign On single sign-on -description: Azure Active Directory joined devices in a hybrid Deployment for on-premises single sign-on +description: If you want to use certificates for on-premises single-sign on for Azure Active Directory joined devices, then follow these additional steps. keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Using Certificates for AADJ On-premises Single-sign On @@ -69,8 +70,8 @@ To include the on-premises distinguished name in the certificate's subject, Azur ### Verify AAD Connect version Sign-in to computer running Azure AD Connect with access equivalent to _local administrator_. -1. Open **Syncrhonization Services** from the **Azure AD Connect** folder. -2. In the **Syncrhonization Service Manager**, click **Help** and then click **About**. +1. Open **Synchronization Services** from the **Azure AD Connect** folder. +2. In the **Synchronization Service Manager**, click **Help** and then click **About**. 3. If the version number is not **1.1.819** or later, then upgrade Azure AD Connect to the latest version. ### Verify the onPremisesDistinguishedName attribute is synchronized @@ -78,9 +79,9 @@ The easiest way to verify the onPremisesDistingushedNamne attribute is synchroni 1. Open a web browser and navigate to https://graphexplorer.azurewebsites.net/ 2. Click **Login** and provide Azure credentials -3. In the Azure AD Graph Explorer URL, type **https://graph.windows.net/myorganization/users/[userid], where **[userid]** is the user principal name of user in Azure Active Directory. Click **Go** +3. In the Azure AD Graph Explorer URL, type https://graph.windows.net/myorganization/users/[userid], where **[userid]** is the user principal name of user in Azure Active Directory. Click **Go** 4. In the returned results, review the JSON data for the **onPremisesDistinguishedName** attribute. Ensure the attribute has a value and the value is accurate for the given user. -![Azure AD Connect On-Prem DN Attribute](images/aadjcert/aadconnectonpremdn.png) + ![Azure AD Connect On-Prem DN Attribute](images/aadjcert/aadconnectonpremdn.png) ## Prepare the Network Device Enrollment Services (NDES) Service Account @@ -89,16 +90,16 @@ The deployment uses the **NDES Servers** security group to assign the NDES servi Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. -1. Open **Active Directory Users and Computers**. -2. Expand the domain node from the navigation pane. -3. Right-click the **Users** container. Hover over **New** and click **Group**. -4. Type **NDES Servers** in the **Group Name** text box. -5. Click **OK**. +1. Open **Active Directory Users and Computers**. +2. Expand the domain node from the navigation pane. +3. Right-click the **Users** container. Hover over **New** and click **Group**. +4. Type **NDES Servers** in the **Group Name** text box. +5. Click **OK**. ### Add the NDES server to the NDES Servers global security group Sign-in to a domain controller or management workstation with access equivalent to _domain administrator_. -1. Open **Active Directory Users and Computers**. +1. Open **Active Directory Users and Computers**. 2. Expand the domain node from the navigation pane. 3. Click **Computers** from the navigation pane. Right-click the name of the NDES server that will host the NDES server role. Click **Add to a group...**. 4. Type **NDES Servers** in **Enter the object names to select**. Click **OK**. Click **OK** on the **Active Directory Domain Services** success dialog. @@ -172,14 +173,14 @@ You must prepare the public key infrastructure and the issuing certificate autho When deploying certificates using Microsoft Intune, you have the option of providing the validity period in the SCEP certificate profile rather than relying on the validity period in the certificate template. If you need to issue the same certificate with different validity periods, it may be advantageous to use the SCEP profile, given the limited number of certificates a single NDES server can issue. > [!NOTE] -> Skip this step if you do not want to enable Microsoft Intune to specify the validity period of the certificate. Without this configuiration, the certificate request uses the validity period configured in the certificate template. +> Skip this step if you do not want to enable Microsoft Intune to specify the validity period of the certificate. Without this configuration, the certificate request uses the validity period configured in the certificate template. Sign-in to the issuing certificate authority with access equivalent to _local administrator_. 1. Open and elevated command prompt. Type the command -``` -certutil -setreg Policy\EditFlags +EDITF_ATTRIBUTEENDDATE -``` + ``` + certutil -setreg Policy\EditFlags +EDITF_ATTRIBUTEENDDATE + ``` 2. Restart the **Active Directory Certificate Services** service. ### Create an NDES-Intune authentication certificate template @@ -188,9 +189,9 @@ NDES uses a server authentication certificate to authenticate the server endpoin Sign-in to the issuing certificate authority or management workstations with _Domain Admin_ equivalent credentials. 1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Computer** template in the details pane and click **Duplicate Template**. -4. On the **General** tab, type **NDES-Intune Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Computer** template in the details pane and click **Duplicate Template**. +4. On the **General** tab, type **NDES-Intune Authentication** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. **Note:** If you use different template names, you'll need to remember and substitute these names in different portions of the lab. 5. On the **Subject** tab, select **Supply in the request**. 6. On the **Cryptography** tab, validate the **Minimum key size** is **2048**. @@ -213,25 +214,25 @@ Sign-in a certificate authority or management workstations with _Domain Admin eq 6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. 8. On the **Subject** tab, select **Supply in the request**. -9. On the **Request Handling** tab, select **Signature and encryption** from the **Purpose** list. Select the **Renew with same key** check box. Select **Enroll subject without requiring any user input**. -10. On the **Security** tab, click **Add**. Type **NDESSvc** in the **Enter the object names to select** text box and click **OK**. -12. Select **NDESSvc** from the **Group or users names** list. In the **Permissions for NDES Servers** section, select the **Allow** check box for the **Read**, **Enroll**. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. -13. Close the console. +9. On the **Request Handling** tab, select **Signature and encryption** from the **Purpose** list. Select the **Renew with same key** check box. Select **Enroll subject without requiring any user input**. +10. On the **Security** tab, click **Add**. Type **NDESSvc** in the **Enter the object names to select** text box and click **OK**. +12. Select **NDESSvc** from the **Group or users names** list. In the **Permissions for NDES Servers** section, select the **Allow** check box for the **Read**, **Enroll**. Clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. +13. Close the console. ### Publish certificate templates The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. > [!Important] -> Ensure you publish the **AADJ WHFB Authentication** certificate templates to the certificate authority that Microsoft Intune uses by way of the NDES servers. The NDES configuration asks you to choose a certificate authority from which it requests certificates. You need to publish that cerificate templates to that issuing certificate authority. The **NDES-Intune Authentication** certificate is directly enrolled and can be published to any certificate authority. +> Ensure you publish the **AADJ WHFB Authentication** certificate templates to the certificate authority that Microsoft Intune uses by way of the NDES servers. The NDES configuration asks you to choose a certificate authority from which it requests certificates. You need to publish that certificate templates to that issuing certificate authority. The **NDES-Intune Authentication** certificate is directly enrolled and can be published to any certificate authority. Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. -5. In the **Enable Certificates Templates** window, select the **NDES-Intune Authentication** and **AADJ WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. -6. Close the console. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. +5. In the **Enable Certificates Templates** window, select the **NDES-Intune Authentication** and **AADJ WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. +6. Close the console. ## Install and Configure the NDES Role This section includes the following topics: @@ -251,27 +252,27 @@ Sign-in to the certificate authority or management workstations with an _Enterpr 1. Open **Server Manager** on the NDES server. 2. Click **Manage**. Click **Add Roles and Features**. 3. In the **Add Roles and Features Wizard**, on the **Before you begin** page, click **Next**. Select **Role-based or feature-based installation** on the **Select installation type** page. Click **Next**. Click **Select a server from the server pool**. Select the local server from the **Server Pool** list. Click **Next**. -![Server Manager destination server](images/aadjCert/servermanager-destination-server-ndes.png) + ![Server Manager destination server](images/aadjCert/servermanager-destination-server-ndes.png) 4. On the **Select server roles** page, select **Active Directory Certificate Services** from the **Roles** list. -![Server Manager AD CS Role](images/aadjCert/servermanager-adcs-role.png) -Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Click **Next**. -![Server Manager Add Features](images/aadjcert/serverManager-adcs-add-features.png) + ![Server Manager AD CS Role](images/aadjCert/servermanager-adcs-role.png) + Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Click **Next**. + ![Server Manager Add Features](images/aadjcert/serverManager-adcs-add-features.png) 5. On the **Features** page, expand **.NET Framework 3.5 Features**. Select **HTTP Activation**. Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Expand **.NET Framework 4.5 Features**. Expand **WCF Services**. Select **HTTP Activation**. Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Click **Next**. -![Server Manager Feature HTTP Activation](images/aadjcert/servermanager-adcs-http-activation.png) + ![Server Manager Feature HTTP Activation](images/aadjcert/servermanager-adcs-http-activation.png) 6. On the **Select role services** page, clear the **Certificate Authority** check box. Select the **Network Device Enrollment Service**. Click **Add Features** on the **Add Roles and Features Wizard** dialog box. Click **Next**. -![Server Manager ADCS NDES Role](images/aadjcert/servermanager-adcs-ndes-role-checked.png) + ![Server Manager ADCS NDES Role](images/aadjcert/servermanager-adcs-ndes-role-checked.png) 7. Click **Next** on the **Web Server Role (IIS)** page. 8. On the **Select role services** page for the Web Serve role, Select the following additional services if they are not already selected and then click **Next**. - * **Web Server > Security > Request Filtering** - * **Web Server > Application Development > ASP.NET 3.5**. - * **Web Server > Application Development > ASP.NET 4.5**. . - * **Management Tools > IIS 6 Management Compatibility > IIS 6 Metabase Compatibility** - * **Management Tools > IIS 6 Management Compatibility > IIS 6 WMI Compatibility** -![Server Manager Web Server Role](images/aadjcert/servermanager-adcs-webserver-role.png) + * **Web Server > Security > Request Filtering** + * **Web Server > Application Development > ASP.NET 3.5**. + * **Web Server > Application Development > ASP.NET 4.5**. . + * **Management Tools > IIS 6 Management Compatibility > IIS 6 Metabase Compatibility** + * **Management Tools > IIS 6 Management Compatibility > IIS 6 WMI Compatibility** + ![Server Manager Web Server Role](images/aadjcert/servermanager-adcs-webserver-role.png) 9. Click **Install**. When the installation completes, continue with the next procedure. **Do not click Close**. -> [!Important] -> The .NET Framework 3.5 is not included in the typical installation. If the server is connected to the Internet, the installation attempts to get the files using Windows Update. If the server is not connected to the Internet, you need to **Specify an alternate source path** such as \:\\Sources\SxS\ -![.NET Side by Side](images/aadjcert/dotNet35sidebyside.png) + > [!Important] + > The .NET Framework 3.5 is not included in the typical installation. If the server is connected to the Internet, the installation attempts to get the files using Windows Update. If the server is not connected to the Internet, you need to **Specify an alternate source path** such as \:\\Sources\SxS\ + ![.NET Side by Side](images/aadjcert/dotNet35sidebyside.png) ### Configure the NDES service account This task adds the NDES service account to the local IIS_USRS group. The task also configures the NDES service account for Kerberos authentication and delegation @@ -373,7 +374,7 @@ where **registryValueName** is one of the three value names from the above table 5. Close the command prompt. > [!IMPORTANT] -> Use the **name** of the certificate template; not the **display name**. The certificate template name does not include spaces. You can view the certificate names by looking at the **General** tab of the certificate template's properties in the **Certifcates Templates** management console (certtmpl.msc). +> Use the **name** of the certificate template; not the **display name**. The certificate template name does not include spaces. You can view the certificate names by looking at the **General** tab of the certificate template's properties in the **Certificates Templates** management console (certtmpl.msc). ### Create a Web Application Proxy for the internal NDES URL. Certificate enrollment for Azure AD joined devices occurs over the Internet. As a result, the internal NDES URLs must be accessible externally. You can do this easily and securely using Azure Active Directory Application Proxy. Azure AD Application Proxy provides single sign-on and secure remote access for web applications hosted on-premises, such as Network Device Enrollment Services. @@ -391,18 +392,18 @@ Sign-in a workstation with access equivalent to a _domain user_. 2. Select **All Services**. Type **Azure Active Directory** to filter the list of services. Under **SERVICES**, Click **Azure Active Directory**. 3. Under **MANAGE**, click **Application proxy**. 4. Click **Download connector service**. Click **Accept terms & Download**. Save the file (AADApplicationProxyConnectorInstaller.exe) in a location accessible by others on the domain. -![Azure Application Proxy Connectors](images/aadjcert/azureconsole-applicationproxy-connectors-empty.png) + ![Azure Application Proxy Connectors](images/aadjcert/azureconsole-applicationproxy-connectors-empty.png) 5. Sign-in the computer that will run the connector with access equivalent to a _domain user_. -> [!IMPORTANT] -> Install a minimum of two Azure Active Directory Proxy connectors for each NDES Application Proxy. Strategtically locate Azure AD application proxy connectors throughout your organization to ensure maximum availablity. Remember, devices running the connector must be able to communicate with Azure and the on-premises NDES servers. + > [!IMPORTANT] + > Install a minimum of two Azure Active Directory Proxy connectors for each NDES Application Proxy. Strategtically locate Azure AD application proxy connectors throughout your organization to ensure maximum availablity. Remember, devices running the connector must be able to communicate with Azure and the on-premises NDES servers. 6. Start **AADApplicationProxyConnectorInstaller.exe**. 7. Read the license terms and then select **I agree to the license terms and conditions**. Click **Install**. -![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-01.png) + ![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-01.png) 8. Sign-in to Microsoft Azure with access equivalent to **Global Administrator**. -![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-02.png) + ![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-02.png) 9. When the installation completes. Read the information regarding outbound proxy servers. Click **Close**. -![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-03.png) + ![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-03.png) 10. Repeat steps 5 - 10 for each device that will run the Azure AD Application Proxy connector for Windows Hello for Business certificate deployments. #### Create a Connector Group @@ -425,16 +426,16 @@ Sign-in a workstation with access equivalent to a _domain user_. 3. Under **MANAGE**, click **Application proxy**. 4. Click **Configure an app**. 5. Under **Basic Settings** next to **Name**, type **WHFB NDES 01**. Choose a name that correlates this Azure AD Application Proxy setting with the on-premises NDES server. Each NDES server must have its own Azure AD Application Proxy as two NDES servers cannot share the same internal URL. -6. Next to **Internal Url**, type the internal fully qualified DNS name of the NDES server associated with this Azure AD Application Proxy. For example, https://ndes.corp.mstepdemo.net). This must match the internal DNS name of the NDES server and ensure you prefix the Url with **https**. +6. Next to **Internal Url**, type the internal, fully qualified DNS name of the NDES server associated with this Azure AD Application Proxy. For example, https://ndes.corp.mstepdemo.net). You need to match the primary host name (AD Computer Account name) of the NDES server, and prefix the URL with **https**. 7. Under **Internal Url**, select **https://** from the first list. In the text box next to **https://**, type the hostname you want to use as your external hostname for the Azure AD Application Proxy. In the list next to the hostname you typed, select a DNS suffix you want to use externally for the Azure AD Application Proxy. It is recommended to use the default, -[tenantName].msapproxy.net where **[tenantName]** is your current Azure Active Directory tenant name (-mstephendemo.msappproxy.net). -![Azure NDES Application Proxy Configuration](images/aadjcert/azureconsole-appproxyconfig.png) + ![Azure NDES Application Proxy Configuration](images/aadjcert/azureconsole-appproxyconfig.png) 8. Select **Passthrough** from the **Pre Authentication** list. 9. Select **NDES WHFB Connectors** from the **Connector Group** list. 10. Under **Additional Settings**, select **Default** from **Backend Application Timeout**. Under the **Translate URLLs In** section, select **Yes** next to **Headers** and select **No** next to **Application Body**. 11. Click **Add**. 12. Sign-out of the Azure Portal. -> [!IMPORTANT] -> Write down the internal and external URLs. You will need this information when you enroll the NDES-Intune Authentication certificate. + > [!IMPORTANT] + > Write down the internal and external URLs. You will need this information when you enroll the NDES-Intune Authentication certificate. ### Enroll the NDES-Intune Authentication certificate @@ -534,7 +535,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Azure Portal](https://portal.azure.com/). 2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. ![Microsoft Intune Console](images/aadjcert/microsoftintuneconsole.png) -3. Select **Device Configuration**, and then select **Certificate Authority**. +3. Select **Device Configuration**, and then select **Certificate Connectors**. ![Intune Certificate Authority](images/aadjcert/intunedeviceconfigurationcertauthority.png) 4. Click **Add**, and then click **Download the certificate connector software** under the **Steps to install connector for SCEP** section. ![Intune Download Certificate connector](images/aadjcert/intunedownloadcertconnector.png) @@ -547,39 +548,39 @@ Sign-in the NDES server with access equivalent to _domain administrator_. 1. Copy the Intune Certificate Connector Setup (NDESConnectorSetup.exe) downloaded in the previous task locally to the NDES server. 2. Run **NDESConnectorSetup.exe** as an administrator. If the setup shows a dialog that reads **Microsoft Intune NDES Connector requires HTTP Activation**, ensure you started the application as an administrator, then check HTTP Activation is enabled on the NDES server. 3. On the **Microsoft Intune** page, click **Next**. -![Intune Connector Install 01](images/aadjcert/intunecertconnectorinstall-01.png) + ![Intune Connector Install 01](images/aadjcert/intunecertconnectorinstall-01.png) 4. Read the **End User License Agreement**. Click **Next** to accept the agreement and to proceed with the installation. 5. On the **Destination Folder** page, click **Next**. 6. On the **Installation Options** page, select **SCEP and PFX Profile Distribution** and click **Next**. -![Intune Connector Install 03](images/aadjcert/intunecertconnectorinstall-03.png) + ![Intune Connector Install 03](images/aadjcert/intunecertconnectorinstall-03.png) 7. On the **Client certificate for Microsoft Intune** page, Click **Select**. Select the certificate previously enrolled for the NDES server. Click **Next**. -![Intune Connector Install 05](images/aadjcert/intunecertconnectorinstall-05.png) -> [!NOTE] -> The **Client certificate for Microsoft Intune** page does not update after selecting the client authentication certificate. However, the application rembers the selection and shows it in the next page. + ![Intune Connector Install 05](images/aadjcert/intunecertconnectorinstall-05.png) + > [!NOTE] + > The **Client certificate for Microsoft Intune** page does not update after selecting the client authentication certificate. However, the application rembers the selection and shows it in the next page. 8. On the **Client certificate for the NDES Policy Module** page, verify the certificate information and then click **Next**. 9. ON the **Ready to install Microsoft Intune Connector** page. Click **Install**. -![Intune Connector Install 06](images/aadjcert/intunecertconnectorinstall-06.png) -> [!NOTE] -> You can review the results of the install using the **SetupMsi.log** file located in the **C:\\NDESConnectorSetupMsi** folder + ![Intune Connector Install 06](images/aadjcert/intunecertconnectorinstall-06.png) + > [!NOTE] + > You can review the results of the install using the **SetupMsi.log** file located in the **C:\\NDESConnectorSetupMsi** folder 10. When the installation completes, select **Launch Intune Connector** and click Finish. Proceed to the Configure the Intune Certificate Connector task. -![Intune Connector install 07](images/aadjcert/intunecertconnectorinstall-07.png) + ![Intune Connector install 07](images/aadjcert/intunecertconnectorinstall-07.png) ### Configure the Intune Certificate Connector Sign-in the NDES server with access equivalent to _domain administrator_. 1. The **NDES Connector** user interface should be open from the last task. -> [!NOTE] -> If the **NDES Connector** user interface is not open, you can start it from **\\NDESConnectorUI\NDESConnectorUI.exe**. + > [!NOTE] + > If the **NDES Connector** user interface is not open, you can start it from **\\NDESConnectorUI\NDESConnectorUI.exe**. 2. If your organization uses a proxy server and the proxy is needed for the NDES server to access the Internet, select **Use proxy server**, and then enter the proxy server name, port, and credentials to connect. Click **Apply** -![Intune Certificate Connector Configuration 01](images/aadjcert/intunecertconnectorconfig-01.png) + ![Intune Certificate Connector Configuration 01](images/aadjcert/intunecertconnectorconfig-01.png) 3. Click **Sign-in**. Type credentials for your Intune administrator, or tenant administrator that has the **Global Administrator** directory role. -![Intune Certificate Connector Configuration 02](images/aadjcert/intunecertconnectorconfig-02.png) -> [!IMPORTANT] -> The user account must have a valid Intune licenese asssigned. If the user account does not have a valid Intune license, the sign-in fails. + ![Intune Certificate Connector Configuration 02](images/aadjcert/intunecertconnectorconfig-02.png) + > [!IMPORTANT] + > The user account must have a valid Intune licenese assigned. If the user account does not have a valid Intune license, the sign-in fails. 4. Optionally, you can configure the NDES Connector for certificate revocation. If you want to do this, continue to the next task. Otherwise, Click **Close**, restart the **Intune Connector Service** and the **World Wide Web Publishing Service**, and skip the next task. @@ -609,7 +610,7 @@ Sign-in the NDES server with access equivalent to _domain admin_. 1. Open a command prompt. 2. Type the following command to confirm the NDES Connector's last connection time is current.
                                  -```reg query hklm\software\Micosoft\MicrosoftIntune\NDESConnector\ConnectionStatus```
                                  +```reg query hklm\software\Microsoft\MicrosoftIntune\NDESConnector\ConnectionStatus```
                                  3. Close the command prompt. 4. Open **Internet Explorer**. 5. In the navigation bar, type
                                  @@ -635,35 +636,36 @@ Sign-in a workstation with access equivalent to a _domain user_. 8. Click **Members**. Use the **Select members** pane to add members to this group. When finished click **Select**. 9. Click **Create**. -### Create a SCEP Certificte Profile +### Create a SCEP Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Azure Portal](https://portal.azure.com/). 2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. 3. Select **Device Configuration**, and then click **Profiles**. 4. Select **Create Profile**. -![Intune Device Configuration Create Profile](images/aadjcert/intunedeviceconfigurationcreateprofile.png) + ![Intune Device Configuration Create Profile](images/aadjcert/intunedeviceconfigurationcreateprofile.png) 5. Next to **Name**, type **WHFB Certificate Enrollment**. 6. Next to **Description**, provide a description meaningful for your environment. 7. Select **Windows 10 and later** from the **Platform** list. 8. Select **SCEP certificate** from the **Profile** list. -![WHFB Scep Profile Blade](images/aadjcert/intunewhfbscepprofile-00.png) + ![WHFB Scep Profile Blade](images/aadjcert/intunewhfbscepprofile-00.png) 9. The **SCEP Certificate** blade should open. Configure **Certificate validity period** to match your organization. -> [!IMPORTANT] + > [!IMPORTANT] > Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity. 10. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list. 11. Select **Custom** from the **Subject name format** list. 12. Next to **Custom**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate. -13. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. -14. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority. -![WHFB SCEP certificate profile Trusted Certificate selection](images/aadjcert/intunewhfbscepprofile-01.png) -15. Under **Extended key usage**, type **Smart Card Logon** under **Name. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. -16. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. -![WHFB SCEP certificate Profile EKUs](images/aadjcert/intunewhfbscepprofile-03.png) -17. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests amongst the URLs listed in the SCEP certificate profile. -18. Click **OK**. -19. Click **Create**. +13. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** value. +14. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. +15. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority. + ![WHFB SCEP certificate profile Trusted Certificate selection](images/aadjcert/intunewhfbscepprofile-01.png) +16. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. +17. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. + ![WHFB SCEP certificate Profile EKUs](images/aadjcert/intunewhfbscepprofile-03.png) +18. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. +19. Click **OK**. +20. Click **Create**. ### Assign Group to the WHFB Certificate Enrollment Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md index 2bfa7ac0bd..4eed2e7435 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso.md @@ -1,21 +1,22 @@ --- -title: Azure AD Join Single Sign-on Deployment Guides -description: Azure Active Directory joined devices in a hybrid Deployment for on-premises single sign-on +title: Azure AD Join Single Sign-on Deployment +description: Learn how to provide single sign-on to your on-premises resources for Azure Active Directory joined devices, using Windows Hello for Business. keywords: identity, PIN, biometric, Hello, passport, AADJ, SSO, ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- -# Azure AD Join Single Sign-on Deployment Guides +# Azure AD Join Single Sign-on Deployment **Applies to** - Windows 10 diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md index 4b487da424..c2550cdfa7 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Windows Hello for Business Certificate Trust New Installation @@ -28,7 +29,7 @@ Windows Hello for Business involves configuring distributed technologies that ma * [Active Directory](#active-directory) * [Public Key Infrastructure](#public-key-infrastructure) * [Azure Active Directory](#azure-active-directory) -* [Multi-factor Authentication Services](#multi-factor-authentication-services) +* [Multifactor Authentication Services](#multifactor-authentication-services) New installations are considerably more involved than existing implementations because you are building the entire infrastructure. Microsoft recommends you review the new installation baseline to validate your existing environment has all the needed configurations to support your hybrid certificate trust Windows Hello for Business deployment. If your environment meets these needs, you can read the [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) section to prepare your Windows Hello for Business deployment by configuring Azure device registration. @@ -65,12 +66,12 @@ Sign-in using _Enterprise Admin_ equivalent credentials on Windows Server 2012 o 1. Open an elevated Windows PowerShell prompt. 2. Use the following command to install the Active Directory Certificate Services role. ```PowerShell - Add-WindowsFeature Adcs-Cert-Authority -IncludeManageTools + Add-WindowsFeature Adcs-Cert-Authority -IncludeManagementTools ``` 3. Use the following command to configure the Certificate Authority using a basic certificate authority configuration. ```PowerShell - Install-AdcsCertificateAuthority + Install-AdcsCertificationAuthority ``` ### Configure a Production Public Key Infrastructure @@ -80,7 +81,7 @@ If you do have an existing public key infrastructure, please review [Certificati ### Section Review ### > [!div class="checklist"] -> * Miniumum Windows Server 2012 Certificate Authority. +> * Minimum Windows Server 2012 Certificate Authority. > * Enterprise Certificate Authority. > * Functioning public key infrastructure. @@ -103,11 +104,11 @@ Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.co ### Azure Multi-Factor Authentication (MFA) Cloud ### > [!IMPORTANT] -As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: +> As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: > * Azure Multi-Factor Authentication > * Azure Active Directory Premium > * Enterprise Mobility + Security -> +> > If you have one of these subscriptions or licenses, skip the Azure MFA Adapter section. #### Azure MFA Provider #### @@ -128,7 +129,7 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation > * Review the overview and uses of Azure Multifactor Authentication. > * Review your Azure Active Directory subscription for Azure Multifactor Authentication. > * Create an Azure Multifactor Authentication Provider, if necessary. -> * Configure Azure Multufactor Authentiation features and settings. +> * Configure Azure Multifactor Authentication features and settings. > * Understand the different User States and their effect on Azure Multifactor Authentication. > * Consider using Azure Multifactor Authentication or a third-party multifactor authentication provider with Windows Server 2016 Active Directory Federation Services, if necessary. @@ -141,8 +142,8 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. New Installation Baseline (*You are here*) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index cfbf292815..cf63fb2c17 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/18/2018 +ms.reviewer: --- # Configure Device Registration for Hybrid Windows Hello for Business @@ -22,25 +23,31 @@ ms.date: 08/18/2018 - Hybrid deployment - Certificate trust - + Your environment is federated and you are ready to configure device registration for your hybrid environment. Hybrid Windows Hello for Business deployment needs device registration and device write-back to enable proper device authentication. - + > [!IMPORTANT] > If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment. -Use this three phased approach for configuring device registration. +>[!TIP] +>Refer to the [Tutorial: Configure hybrid Azure Active Directory join for federated domains](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-federated-domains) to learn more about setting up Azure Active Directory Connect for a simplified join flow for Azure AD device registration. + +Use this three-phased approach for configuring device registration. 1. [Configure devices to register in Azure](#configure-azure-for-device-registration) -2. [Synchronize devices to on-premises Active Directory](#configure-active-directory-to-support-azure-device-syncrhonization) +2. [Synchronize devices to on-premises Active Directory](#configure-active-directory-to-support-azure-device-synchronization) 3. [Configure AD FS to use cloud devices](#configure-ad-fs-to-use-azure-registered-devices) > [!NOTE] -> Before proceeding, you should familiarize yourself with device regisration concepts such as: +> Before proceeding, you should familiarize yourself with device registration concepts such as: > * Azure AD registered devices > * Azure AD joined devices > * Hybrid Azure AD joined devices > > You can learn about this and more by reading [Introduction to Device Management in Azure Active Directory.](https://docs.microsoft.com/azure/active-directory/device-management-introduction) +>[!IMPORTANT] +> To use hybrid identity with Azure Active Directory and device WriteBack features, you must use the built-in GUI with the [latest updates for ADConnect](https://www.microsoft.com/download/details.aspx?id=47594). + ## Configure Azure for Device Registration Begin configuring device registration to support Hybrid Windows Hello for Business by configuring device registration capabilities in Azure AD. @@ -65,7 +72,7 @@ To locate the schema master role holder, open and command prompt and type: ![Netdom example output](images/hello-cmd-netdom.png) -The command should return the name of the domain controller where you need to adprep.exe. Update the schema locally on the domain controller hosting the Schema master role. +The command should return the name of the domain controller where you need to run adprep.exe. Update the schema locally on the domain controller hosting the Schema master role. #### Updating the Schema @@ -75,11 +82,11 @@ Manually updating Active Directory uses the command-line utility **adprep.exe** Sign-in to the domain controller hosting the schema master operational role using enterprise administrator equivalent credentials. -1. Open an elevated command prompt. -2. Type ```cd /d x:\support\adprep``` where *x* is the drive letter of the DVD or mounted ISO. -3. To update the schema, type ```adprep /forestprep```. -4. Read the Adprep Warning. Type the letter **C*** and press **Enter** to update the schema. -5. Close the Command Prompt and sign-out. +1. Open an elevated command prompt. +2. Type ```cd /d x:\support\adprep``` where *x* is the drive letter of the DVD or mounted ISO. +3. To update the schema, type ```adprep /forestprep```. +4. Read the Adprep Warning. Type the letter **C*** and press **Enter** to update the schema. +5. Close the Command Prompt and sign-out. > [!NOTE] > If you installed Azure AD Connect prior to upgrading the schema, you will need to re-run the Azure AD Connect installation and refresh the on-premises AD schema to ensure the synchronization rule for msDS-KeyCredentialLink is configured. @@ -100,7 +107,7 @@ Federation server proxies are computers that run AD FS software that have been c Use the [Setting of a Federation Proxy](https://docs.microsoft.com/windows-server/identity/ad-fs/deployment/checklist--setting-up-a-federation-server-proxy) checklist to configure AD FS proxy servers in your environment. ### Deploy Azure AD Connect -Next, you need to synchronizes the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771). +Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771). When you are ready to install, follow the **Configuring federation with AD FS** section of [Custom installation of Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-get-started-custom). Select the **Federation with AD FS** option on the **User sign-in** page. At the **AD FS Farm** page, select the use an existing option and click **Next**. @@ -115,12 +122,12 @@ If your AD FS farm is not already configured for Device Authentication (you can 1. Run the **Add Roles & Features** wizard and select feature **Remote Server Administration Tools** -> **Role Administration Tools** -> **AD DS and AD LDS Tools** -> Choose both the **Active Directory module for Windows PowerShell** and the **AD DS Tools**. ![Device Registration](images/hybridct/device2.png) - -2. On your AD FS primary server, ensure you are logged in as AD DS user with enterprise administrator privileges and open an elevated Windows PowerShell prompt. Then, run the following commands: - - `Import-module activedirectory` - `PS C:\> Initialize-ADDeviceRegistration -ServiceAccountName "" ` -3. On the pop-up window click **Yes**. + +2. On your AD FS primary server, ensure you are logged in as AD DS user with enterprise administrator privileges and open an elevated Windows PowerShell prompt. Then, run the following commands: + + `Import-module activedirectory` + `PS C:\> Initialize-ADDeviceRegistration -ServiceAccountName ""` +3. On the pop-up window click **Yes**. > [!NOTE] > If your AD FS service is configured to use a GMSA account, enter the account name in the format "domain\accountname$" @@ -129,22 +136,21 @@ If your AD FS farm is not already configured for Device Authentication (you can The above PSH creates the following objects: - - RegisteredDevices container under the AD domain partition - Device Registration Service container and object under Configuration --> Services --> Device Registration Configuration - Device Registration Service DKM container and object under Configuration --> Services --> Device Registration Configuration ![Device Registration](images/hybridct/device4.png) -4. Once this is done, you will see a successful completion message. +4. Once this is done, you will see a successful completion message. ![Device Registration](images/hybridct/device5.png) ### Create Service Connection Point (SCP) in Active Directory If you plan to use Windows 10 domain join (with automatic registration to Azure AD) as described here, execute the following commands to create a service connection point in AD DS 1. Open Windows PowerShell and execute the following: - - `PS C:>Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1" ` + + `PS C:>Import-Module -Name "C:\Program Files\Microsoft Azure Active Directory Connect\AdPrep\AdSyncPrep.psm1"` > [!NOTE] > If necessary, copy the AdSyncPrep.psm1 file from your Azure AD Connect server. This file is located in Program Files\Microsoft Azure Active Directory Connect\AdPrep @@ -153,16 +159,16 @@ If you plan to use Windows 10 domain join (with automatic registration to Azure 2. Provide your Azure AD global administrator credentials - `PS C:>$aadAdminCred = Get-Credential` + `PS C:>$aadAdminCred = Get-Credential` ![Device Registration](images/hybridct/device7.png) -3. Run the following PowerShell command +3. Run the following PowerShell command - `PS C:>Initialize-ADSyncDomainJoinedComputerSync -AdConnectorAccount [AD connector account name] -AzureADCredentials $aadAdminCred ` + `PS C:>Initialize-ADSyncDomainJoinedComputerSync -AdConnectorAccount [AD connector account name] -AzureADCredentials $aadAdminCred` Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory. - + The above commands enable Windows 10 clients to find the correct Azure AD domain to join by creating the serviceConnectionpoint object in AD DS. ### Prepare AD for Device Write Back @@ -170,7 +176,7 @@ To ensure AD DS objects and containers are in the correct state for write back o 1. Open Windows PowerShell and execute the following: - `PS C:>Initialize-ADSyncDeviceWriteBack -DomainName -AdConnectorAccount [AD connector account name] ` + `PS C:>Initialize-ADSyncDeviceWriteBack -DomainName -AdConnectorAccount [AD connector account name]` Where the [AD connector account name] is the name of the account you configured in Azure AD Connect when adding your on-premises AD DS directory in domain\accountname format @@ -190,10 +196,19 @@ In a federated Azure AD configuration, devices rely on Active Directory Federati Windows current devices authenticate using Integrated Windows Authentication to an active WS-Trust endpoint (either 1.3 or 2005 versions) hosted by the on-premises federation service. +When you're using AD FS, you need to enable the following WS-Trust endpoints: +`/adfs/services/trust/2005/windowstransport` +`/adfs/services/trust/13/windowstransport` +`/adfs/services/trust/2005/usernamemixed` +`/adfs/services/trust/13/usernamemixed` +`/adfs/services/trust/2005/certificatemixed` +`/adfs/services/trust/13/certificatemixed` + +> [!WARNING] +> Both **adfs/services/trust/2005/windowstransport** and **adfs/services/trust/13/windowstransport** should be enabled as intranet facing endpoints only and must NOT be exposed as extranet facing endpoints through the Web Application Proxy. To learn more on how to disable WS-Trust Windows endpoints, see [Disable WS-Trust Windows endpoints on the proxy](https://docs.microsoft.com/windows-server/identity/ad-fs/deployment/best-practices-securing-ad-fs#disable-ws-trust-windows-endpoints-on-the-proxy-ie-from-extranet). You can see what endpoints are enabled through the AD FS management console under **Service** > **Endpoints**. + > [!NOTE] -> When using AD FS, either **adfs/services/trust/13/windowstransport** or **adfs/services/trust/2005/windowstransport** must be enabled. If you are using the Web Authentication Proxy, also ensure that this endpoint is published through the proxy. You can see what end-points are enabled through the AD FS management console under **Service > Endpoints**. -> -> If you don't have AD FS as your on-premises federation service, follow the instructions of your vendor to make sure they support WS-Trust 1.3 or 2005 end-points and that these are published through the Metadata Exchange file (MEX). +>If you don’t have AD FS as your on-premises federation service, follow the instructions from your vendor to make sure they support WS-Trust 1.3 or 2005 endpoints and that these are published through the Metadata Exchange file (MEX). The following claims must exist in the token received by Azure DRS for device registration to complete. Azure DRS will create a device object in Azure AD with some of this information which is then used by Azure AD Connect to associate the newly created device object with the computer account on-premises. @@ -210,7 +225,7 @@ If you are already issuing an ImmutableID claim (e.g., alternate login ID) you n * `http://schemas.microsoft.com/LiveID/Federation/2008/05/ImmutableID` In the following sections, you find information about: - + - The values each claim should have - How a definition would look like in AD FS @@ -255,7 +270,7 @@ The definition helps you to verify whether the values are present or if you need query = ";objectguid;{0}", param = c2.Value ); - + #### Issue objectSID of the computer account on-premises **`http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid`** - This claim must contain the **objectSid** value of the on-premises computer account. In AD FS, you can add an issuance transform rule that looks like this: @@ -277,7 +292,8 @@ The definition helps you to verify whether the values are present or if you need **`http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid`** - This claim must contain the Uniform Resource Identifier (URI) of any of the verified domain names that connect with the on-premises federation service (AD FS or 3rd party) issuing the token. In AD FS, you can add issuance transform rules that look like the ones below in that specific order after the ones above. Please note that one rule to explicitly issue the rule for users is necessary. In the rules below, a first rule identifying user vs. computer authentication is added. - @RuleName = "Issue account type with the value User when its not a computer" + @RuleName = "Issue account type with the value User when it is not a computer" + NOT EXISTS( [ Type == "http://schemas.microsoft.com/ws/2012/01/accounttype", @@ -288,7 +304,7 @@ The definition helps you to verify whether the values are present or if you need Type = "http://schemas.microsoft.com/ws/2012/01/accounttype", Value = "User" ); - + @RuleName = "Capture UPN when AccountType is User and issue the IssuerID" c1:[ Type == "http://schemas.xmlsoap.org/claims/UPN" @@ -306,7 +322,7 @@ The definition helps you to verify whether the values are present or if you need "http://${domain}/adfs/services/trust/" ) ); - + @RuleName = "Issue issuerID for domain-joined computers" c:[ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", @@ -353,10 +369,10 @@ To get a list of your verified company domains, you can use the [Get-MsolDomain] The following script helps you with the creation of the issuance transform rules described above. - $multipleVerifiedDomainNames = $false + $multipleVerifiedDomainNames = $false $immutableIDAlreadyIssuedforUsers = $false $oneOfVerifiedDomainNames = 'example.com' # Replace example.com with one of your verified domains - + $rule1 = '@RuleName = "Issue account type for domain-joined computers" c:[ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", @@ -412,7 +428,7 @@ The following script helps you with the creation of the issuance transform rules Type = "http://schemas.microsoft.com/ws/2012/01/accounttype", Value = "User" ); - + @RuleName = "Capture UPN when AccountType is User and issue the IssuerID" c1:[ Type == "http://schemas.xmlsoap.org/claims/UPN" @@ -430,7 +446,7 @@ The following script helps you with the creation of the issuance transform rules "http://${domain}/adfs/services/trust/" ) ); - + @RuleName = "Issue issuerID for domain-joined computers" c:[ Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", @@ -464,13 +480,14 @@ The following script helps you with the creation of the issuance transform rules );' } - $existingRules = (Get-ADFSRelyingPartyTrust -Identifier urn:federation:MicrosoftOnline).IssuanceTransformRules + $existingRules = (Get-ADFSRelyingPartyTrust -Identifier urn:federation:MicrosoftOnline).IssuanceTransformRules - $updatedRules = $existingRules + $rule1 + $rule2 + $rule3 + $rule4 + $rule5 + $updatedRules = $existingRules + $rule1 + $rule2 + $rule3 + $rule4 + $rule5 - $crSet = New-ADFSClaimRuleSet -ClaimRule $updatedRules + $crSet = New-ADFSClaimRuleSet -ClaimRule $updatedRules + + Set-AdfsRelyingPartyTrust -TargetIdentifier urn:federation:MicrosoftOnline -IssuanceTransformRules $crSet.ClaimRulesString - Set-AdfsRelyingPartyTrust -TargetIdentifier urn:federation:MicrosoftOnline -IssuanceTransformRules $crSet.ClaimRulesString #### Remarks @@ -479,8 +496,10 @@ The following script helps you with the creation of the issuance transform rules - If you have multiple verified domain names (as shown in the Azure AD portal or via the Get-MsolDomains cmdlet), set the value of **$multipleVerifiedDomainNames** in the script to **$true**. Also make sure that you remove any existing issuerid claim that might have been created by Azure AD Connect or via other means. Here is an example for this rule: - c:[Type == "http://schemas.xmlsoap.org/claims/UPN"] - => issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", Value = regexreplace(c.Value, ".+@(?.+)", "http://${domain}/adfs/services/trust/")); +~~~ + c:[Type == "http://schemas.xmlsoap.org/claims/UPN"] + => issue(Type = "http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid", Value = regexreplace(c.Value, ".+@(?.+)", "http://${domain}/adfs/services/trust/")); +~~~ - If you have already issued an **ImmutableID** claim for user accounts, set the value of **$immutableIDAlreadyIssuedforUsers** in the script to **$true**. @@ -492,29 +511,28 @@ Using an elevated PowerShell command window, configure AD FS policy by executing #### Check your configuration For your reference, below is a comprehensive list of the AD DS devices, containers and permissions required for device write-back and authentication to work -- object of type ms-DS-DeviceContainer at CN=RegisteredDevices,DC=<domain> - - read access to the AD FS service account - - read/write access to the Azure AD Connect sync AD connector account +- object of type ms-DS-DeviceContainer at CN=RegisteredDevices,DC=<domain> + - read access to the AD FS service account + - read/write access to the Azure AD Connect sync AD connector account - Container CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> - Container Device Registration Service DKM under the above container ![Device Registration](images/hybridct/device8.png) - + - object of type serviceConnectionpoint at CN=<guid>, CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> - read/write access to the specified AD connector account name on the new object - object of type msDS-DeviceRegistrationServiceContainer at CN=Device Registration Services,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> - object of type msDS-DeviceRegistrationService in the above container ->[!div class="nextstepaction"] -[Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) - -

                                  +> [!div class="nextstepaction"] +> [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) +
                                  ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. Configure Azure Device Registration (*You are here*) 5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md index 6f443cff4f..f7a5eed854 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs.md @@ -1,19 +1,20 @@ --- -title: Hybrid Windows Hello for Business Prerequistes (Windows Hello for Business) -description: Prerequisites for Hybrid Windows Hello for Business Deployments +title: Hybrid Windows Hello for Business Prerequisites +description: Prerequisites for hybrid Windows Hello for Business deployments using certificate trust. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Hybrid Windows Hello for Business Prerequisites @@ -27,10 +28,10 @@ Hybrid environments are distributed systems that enable organizations to use on- The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include: * [Directories](#directories) -* [Public Key Infrastucture](#public-key-infrastructure) +* [Public Key Infrastructure](#public-key-infrastructure) * [Directory Synchronization](#directory-synchronization) * [Federation](#federation) -* [MultiFactor Authentication](#multifactor-authentication) +* [Multifactor Authentication](#multifactor-authentication) * [Device Registration](#device-registration) ## Directories ## @@ -57,7 +58,7 @@ Review these requirements and those from the Windows Hello for Business planning ## Public Key Infrastructure ## The Windows Hello for Business deployment depends on an enterprise public key infrastructure as trust anchor for authentication. Domain controllers for hybrid deployments need a certificate in order for Windows 10 devices to trust the domain controller. -Certificate trust deployments need an enterprise public key infrastructure and a certificate registration authority to issue authentication certificates to users. When using Group Policy, hybrid certificate trust deployment use the Windows Server 2016 Active Directory Federation Server (AS FS) as a certificate registration authority. +Certificate trust deployments need an enterprise public key infrastructure and a certificate registration authority to issue authentication certificates to users. When using Group Policy, hybrid certificate trust deployment uses the Windows Server 2016 Active Directory Federation Server (AD FS) as a certificate registration authority. The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012. @@ -71,7 +72,10 @@ The minimum required enterprise certificate authority that can be used with Wind ## Directory Synchronization ## The two directories used in hybrid deployments must be synchronized. You need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory. -Organizations using older directory synchronization technology, such as DirSync or Azure AD sync need to upgrade to Azure AD Connect +Organizations using older directory synchronization technology, such as DirSync or Azure AD sync, need to upgrade to Azure AD Connect. In case the schema of your local AD DS was changed since the last directory synchronization, you may need to [refresh directory schema](https://docs.microsoft.com/azure/active-directory/hybrid/how-to-connect-installation-wizard#refresh-directory-schema). + +> [!NOTE] +> Windows Hello for Business is tied between a user and a device. Both the user and device need to be synchronized between Azure Active Directory and Active Directory. ### Section Review > [!div class="checklist"] @@ -82,7 +86,7 @@ Organizations using older directory synchronization technology, such as DirSync
                                  ## Federation ## -Federating your on-premises Active Directory with Azure Active Directory ensures all identities have access to all resources regardless if they reside in cloud or on-premises. Windows Hello for Business hybrid certificate trust needs Windows Server 2016 Active Directory Federation Services. All nodes in the AD FS farm must run the same version of AD FS. Additionally, you need to configure your AD FS farm to support Azure registered devices. +Windows Hello for Business hybrid certificate trust requires Active Directory being federated with Azure Active Directory and needs Windows Server 2016 Active Directory Federation Services or newer. Windows Hello for Business hybrid certificate trust doesn’t support Managed Azure Active Directory using Pass-through authentication or password hash sync. All nodes in the AD FS farm must run the same version of AD FS. Additionally, you need to configure your AD FS farm to support Azure registered devices. The AD FS farm used with Windows Hello for Business must be Windows Server 2016 with minimum update of [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). If your AD FS farm is not running the AD FS role with updates from Windows Server 2016, then read [Upgrading to AD FS in Windows Server 2016](https://docs.microsoft.com/windows-server/identity/ad-fs/deployment/upgrading-to-ad-fs-in-windows-server-2016) @@ -96,7 +100,7 @@ The AD FS farm used with Windows Hello for Business must be Windows Server 2016 ## Multifactor Authentication ## Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their username and password as one factor. but needs a second factor of authentication. -Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Authentication service or they can use multifactor authentication provides by Windows Server 2016 Active Directory Federation Services, which includes an adapter model that enables third parties to integrate their multifactor authentication into AD FS. +Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Authentication service, or they can use multifactor authentication provides by Windows Server 2016 Active Directory Federation Services, which includes an adapter model that enables third parties to integrate their multifactor authentication into AD FS. ### Section Review > [!div class="checklist"] @@ -111,6 +115,14 @@ Organizations wanting to deploy hybrid certificate trust need their domain joine Hybrid certificate trust deployments need the device write back feature. Authentication to the Windows Server 2016 Active Directory Federation Services needs both the user and the computer to authenticate. Typically the users are synchronized, but not devices. This prevents AD FS from authenticating the computer and results in Windows Hello for Business certificate enrollment failures. For this reason, Windows Hello for Business deployments need device writeback, which is an Azure Active Directory premium feature. +> [!NOTE] +> Windows Hello for Business is tied between a user and a device. Both the user and device need to be synchronized between Azure Active Directory and Active Directory, and therefore the device writeback is used to update the msDS-KeyCredentialLink on the computer object. + +## Provisioning + +You need to allow access to the URL account.microsoft.com to initiate Windows Hello for Business provisioning. This URL launches the subsequent steps in the provisioning process and is required to successfully complete Windows Hello for Business provisioning. This URL does not require any authentication and as such, does not collect any user data. + + ### Section Checklist ### > [!div class="checklist"] > * Azure Active Directory Device writeback @@ -119,7 +131,7 @@ Hybrid certificate trust deployments need the device write back feature. Authen
                                  ### Next Steps ### -Follow the Windows Hello for Business hybrid certificate trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Basline**. +Follow the Windows Hello for Business hybrid certificate trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Baseline**. If your environment is already federated, but does not include Azure device registration, choose **Configure Azure Device Registration**. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md index 317a2481b3..ea04aadb72 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust.md @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 09/08/2017 +ms.reviewer: --- # Hybrid Azure AD joined Certificate Trust Deployment @@ -37,10 +38,10 @@ This baseline provides detailed procedures to move your environment from an on-p ## Federated Baseline ## The federated baseline helps organizations that have completed their federation with Azure Active Directory and Office 365 and enables them to introduce Windows Hello for Business into their hybrid environment. This baseline exclusively focuses on the procedures needed to add Azure Device Registration and Windows Hello for Business to an existing hybrid deployment. -Regardless of the baseline you choose, you’re next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. +Regardless of the baseline you choose, your next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. > [!div class="nextstepaction"] -> [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +> [Prerequisites](hello-hybrid-cert-trust-prereqs.md)

                                  @@ -48,8 +49,8 @@ Regardless of the baseline you choose, you’re next step is to familiarize your ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. Overview (*You are here*) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Device Registration](hello-hybrid-cert-trust-devreg.md) 5. [Configure Windows Hello for Business settings](hello-hybrid-cert-whfb-settings.md) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index 461d86ca82..9d05788513 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -1,19 +1,20 @@ ---- +--- title: Hybrid Windows Hello for Business Provisioning (Windows Hello for Business) -description: Provisioning for Hybrid Windows Hello for Business Deployments +description: Provisioning for hybrid certificate trust deployments of Windows Hello for Businesss. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Hybrid Windows Hello for Business Provisioning @@ -53,19 +54,22 @@ The remainder of the provisioning includes Windows Hello for Business requesting > [!IMPORTANT] > The following is the enrollment behavior prior to Windows Server 2016 update [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). - +> > The minimum time needed to synchronize the user's public key from Azure Active Directory to the on-premises Active Directory is 30 minutes. The Azure AD Connect scheduler controls the synchronization interval. -> **This synchronization latency delays the user's ability to authenticate and use on-premises resouces until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. +> **This synchronization latency delays the user's ability to authenticate and use on-premises resources until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. > Read [Azure AD Connect sync: Scheduler](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler) to view and adjust the **synchronization cycle** for your organization. - +> > [!NOTE] -> Windows Server 2016 update [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889) provides synchronous certificate enrollment during hybrid certificate trust provisioning. With this update, users no longer need to wait for Azure AD Connect to sync their public key on-premises. Users enroll their certificate during provisioning and can use the certificate for sign-in immediately after completeling the provisioning. +> Windows Server 2016 update [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889) provides synchronous certificate enrollment during hybrid certificate trust provisioning. With this update, users no longer need to wait for Azure AD Connect to sync their public key on-premises. Users enroll their certificate during provisioning and can use the certificate for sign-in immediately after completing the provisioning. The update needs to be installed on the federation servers. After a successful key registration, Windows creates a certificate request using the same key pair to request a certificate. Windows send the certificate request to the AD FS server for certificate enrollment. The AD FS registration authority verifies the key used in the certificate request matches the key that was previously registered. On a successful match, the AD FS registration authority signs the certificate request using its enrollment agent certificate and sends it to the certificate authority. -The certificate authority validates the certificate was signed by the registration authority. On successful validation of the signature, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current user’s certificate store. Once this process completes, the Windows Hello for Business provisioning workflow informs the user they can use their PIN to sign-in through the Windows Action Center. +> [!NOTE] +> In order for AD FS to verify the key used in the certificate request, it needs to be able to access the https://enterpriseregistration.windows.net endpoint. + +The certificate authority validates the certificate was signed by the registration authority. On successful validation of the signature, it issues a certificate based on the request and returns the certificate to the AD FS registration authority. The registration authority returns the certificate to Windows where it then installs the certificate in the current user’s certificate store. Once this process completes, the Windows Hello for Business provisioning workflow informs the user that they can use their PIN to sign-in through the Windows Action Center.

                                  @@ -73,9 +77,9 @@ The certificate authority validates the certificate was signed by the registrati ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. [Configure Windows Hello for Business policy settings](hello-hybrid-cert-whfb-settings-policy.md) -6. Sign-in and Provision(*You are here*)  +6. Sign-in and Provision (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md index 4f7dca8320..b186880166 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md @@ -1,5 +1,5 @@ --- -title: Configuring Hybrid Windows Hello for Business - Active Directory (AD) +title: Configure Hybrid Windows Hello for Business - Active Directory (AD) description: Discussing the configuration of Active Directory (AD) in a Hybrid deployment of Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport, WHFB, ad ms.prod: w10 @@ -7,15 +7,16 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- -# Configuring Windows Hello for Business: Active Directory +# Configure Windows Hello for Business: Active Directory **Applies to** - Windows 10, version 1703 or later @@ -38,12 +39,12 @@ Azure Active Directory Connect synchronizes the public key on the user object cr Sign-in a domain controller or management workstation with *Domain Admin* equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Click **View** and click **Advance Features**. -3. Expand the domain node from the navigation pane. -4. Right-click the **Users** container. Click **New**. Click **Group**. -5. Type **KeyCredential Admins** in the **Group Name** text box. -6. Click **OK**. +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advance Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **KeyCredential Admins** in the **Group Name** text box. +6. Click **OK**. #### Create the Windows Hello for Business Users Security Group @@ -51,22 +52,22 @@ The Windows Hello for Business Users group is used to make it easy to deploy Win Sign-in a domain controller or management workstation with *Domain Admin* equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Click **View** and click **Advanced Features**. -3. Expand the domain node from the navigation pane. -4. Right-click the **Users** container. Click **New**. Click **Group**. -5. Type **Windows Hello for Business Users** in the **Group Name** text box. -6. Click **OK**. +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advanced Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **Windows Hello for Business Users** in the **Group Name** text box. +6. Click **OK**. ### Section Review > [!div class="checklist"] > * Create the KeyCredential Admins Security group (optional) > * Create the Windows Hello for Business Users group - ->[!div class="step-by-step"] -[< Configure Windows Hello for Business](hello-hybrid-cert-whfb-settings.md) -[Configure Azure AD Connect >](hello-hybrid-cert-whfb-settings-dir-sync.md) +> +> [!div class="step-by-step"] +> [< Configure Windows Hello for Business](hello-hybrid-cert-whfb-settings.md) +> [Configure Azure AD Connect >](hello-hybrid-cert-whfb-settings-dir-sync.md)

                                  @@ -74,8 +75,8 @@ Sign-in a domain controller or management workstation with *Domain Admin* equiva ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings: Active Directory (*You are here*) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md index fb95263ea4..be3bc06968 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-adfs.md @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/20/2018 +ms.reviewer: --- # Configure Windows Hello for Business: Active Directory Federation Services @@ -27,15 +28,18 @@ The Windows Server 2016 Active Directory Federation Server Certificate Registrat The Windows Hello for Business Authentication certificate template is configured to only issue certificates to certificate requests that have been signed with an enrollment agent certificate. +> [!NOTE] +> In order for AD FS to verify user certificate requests for Windows Hello for Business, it needs to be able to access the https://enterpriseregistration.windows.net endpoint. + ### Configure the Registration Authority Sign-in the AD FS server with *Domain Admin* equivalent credentials. -1. Open a **Windows PowerShell** prompt. -2. Type the following command +1. Open a **Windows PowerShell** prompt. +2. Type the following command ```PowerShell - Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication + Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication -WindowsHelloCertificateProxyEnabled $true ``` @@ -47,25 +51,28 @@ Sign-in the AD FS server with *Domain Admin* equivalent credentials. The Windows Hello for Business group provides the AD FS service with the permissions needed to enroll a Windows Hello for Business authentication certificate on behalf of the provisioning user. +> [!TIP] +> The adfssvc account is the AD FS service account. + Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. 1. Open **Active Directory Users and Computers**. 2. Click the **Users** container in the navigation pane. 3. Right-click **Windows Hello for Business Users** group 4. Click the **Members** tab and click **Add** -5. In the **Enter the object names to select** text box, type **adfssvc**. Click **OK**. -6. Click **OK** to return to **Active Directory Users and Computers**. -7. Restart the AD FS server. +5. In the **Enter the object names to select** text box, type **adfssvc** or substitute the name of the AD FS service account in your AD FS deployment. Click **OK**. +6. Click **OK** to return to **Active Directory Users and Computers**. +7. Restart the AD FS server. ### Section Review > [!div class="checklist"] > * Configure the registration authority > * Update group memberships for the AD FS service account - - ->[!div class="step-by-step"] -[< Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) -[Configure policy settings >](hello-hybrid-cert-whfb-settings-policy.md) +> +> +> [!div class="step-by-step"] +> [< Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) +> [Configure policy settings >](hello-hybrid-cert-whfb-settings-policy.md)

                                  @@ -73,7 +80,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings: AD FS (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md index 559462a9db..16c17aa3f9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync.md @@ -1,5 +1,5 @@ --- -title: Configuring Hybrid Windows Hello for Business - Directory Synchronization +title: Configure Hybrid Windows Hello for Business Directory Synch description: Discussing Directory Synchronization in a Hybrid deployment of Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport, WHFB, dirsync, connect ms.prod: w10 @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 10/23/2017 +ms.reviewer: --- # Configure Hybrid Windows Hello for Business: Directory Synchronization @@ -30,7 +31,7 @@ In hybrid deployments, users register the public portion of their Windows Hello The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually. > [!IMPORTANT] -> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. +> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. In this case, you should use the pre-created group KeyAdmins in step 3 of the "Group Memberships for the Azure AD Connect Service Account" section of this article. ### Configure Permissions for Key Synchronization @@ -55,9 +56,6 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva 1. Open **Active Directory Users and Computers**. 2. Click the **Users** container in the navigation pane. ->[!IMPORTANT] -> If you already have a Windows Server 2016 domain controller in your domain, use the Keyadmins group in the next step, otherwise use the KeyCredential admins group you previously created. - 3. Right-click either the **KeyAdmins** or **KeyCredential Admins** in the details pane and click **Properties**. 4. Click the **Members** tab and click **Add** 5. In the **Enter the object names to select** text box, type the name of the Azure AD Connect service account. Click **OK**. @@ -68,10 +66,10 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva > [!div class="checklist"] > * Configure Permissions for Key Synchronization > * Configure group membership for Azure AD Connect - ->[!div class="step-by-step"] -[< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md) -[Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md) +> +> [!div class="step-by-step"] +> [< Configure Active Directory](hello-hybrid-cert-whfb-settings-ad.md) +> [Configure PKI >](hello-hybrid-cert-whfb-settings-pki.md)

                                  @@ -79,7 +77,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings: Directory Synchronization (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md index 56921a06b0..7c4e019e6d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki.md @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Configure Hybrid Windows Hello for Business: Public Key Infrastructure @@ -44,17 +45,17 @@ By default, the Active Directory Certificate Authority provides and publishes th Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. **Note**If you use different template names, you'll need to remember and substitute these names in different portions of the lab. -6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. -8. Close the console. +6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +8. Close the console. -#### Configure Certificate Suspeding for the Domain Controller Authentication (Kerberos) Certificate Template +#### Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template Many domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers--the domain controller certificate template. Later releases provided a new certificate template--the domain controller authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the **KDC Authentication** extension. @@ -64,18 +65,22 @@ The auto-enrollment feature in Windows enables you to effortlessly replace these Sign-in a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. -4. Click the **Superseded Templates** tab. Click **Add**. -5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. -6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. -7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. -8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. -9. Click **OK** and close the **Certificate Templates** console. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. +4. Click the **Superseded Templates** tab. Click **Add**. +5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. +6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. +7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. +8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. +9. Click **OK** and close the **Certificate Templates** console. The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. +> [!NOTE] +> * The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. +> * If you are using a 3rd party CA, add the certificate to the NTAuth store. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail. + ### Enrollment Agent certificate template Active Directory Federation Server used for Windows Hello for Business certificate enrollment performs its own certificate life-cycle management. Once the registration authority is configured with the proper certificate template, the AD FS server attempts to enroll the certificate on the first certificate request or when the service first starts. @@ -100,9 +105,9 @@ Sign-in a certificate authority or management workstations with _Domain Admin_ e 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 8. On the **Security** tab, click **Add**. 9. Click **Object Types**. Select the **Service Accounts** check box and click **OK**. -10. Type **adfssvc** in the **Enter the object names to select** text box and click **OK**. -11. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. -12. Close the console. +10. Type **adfssvc** in the **Enter the object names to select** text box and click **OK**. +11. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. +12. Close the console. #### Creating an Enrollment Agent certificate for typical Service Acconts @@ -110,14 +115,14 @@ Sign-in a certificate authority or management workstations with *Domain Admin* e 1. Open the **Certificate Authority** management console. 2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template** console, right-click the **Exchange Enrollment Agent** template in the details pane and click **Duplicate Template**. +3. In the **Certificate Template** console, right-click the **Exchange Enrollment Agent (Offline request)** template in the details pane and click **Duplicate Template**. 4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. 5. On the **General** tab, type **WHFB Enrollment Agent** in **Template display name**. Adjust the validity and renewal period to meet your enterprise's needs. 6. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 8. On the **Security** tab, click **Add**. Type **adfssvc** in the **Enter the object names to select text box** and click **OK**. 9. Click the **adfssvc** from the **Group or users names** list. In the **Permissions for adfssvc** section, select the **Allow** check box for the **Enroll** permission. Excluding the **adfssvc** user, clear the **Allow** check boxes for the **Enroll** and **Autoenroll** permissions for all other items in the **Group or users names** list if the check boxes are not already cleared. Click **OK**. -10. Close the console. +10. Close the console. ### Creating Windows Hello for Business authentication certificate template @@ -134,13 +139,13 @@ Sign-in a certificate authority or management workstations with _Domain Admin eq 6. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. 7. On the **Extensions** tab, verify the **Application Policies** extension includes **Smart Card Logon**. 8. On the **Issuance Requirements** tab, select the **This number of authorized signatures** check box. Type **1** in the text box. - * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. + * Select **Application policy** from the **Policy type required in signature**. Select **Certificate Request Agent** from in the **Application policy** list. Select the **Valid existing certificate** option. 9. On the **Subject** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **Fully distinguished name** from the **Subject name format** list if **Fully distinguished name** is not already selected. Select the **User Principal Name (UPN)** check box under **Include this information in alternative subject name**. -10. On the **Request Handling** tab, select the **Renew with same key** check box. -11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. -12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Read**, **Enroll**, and **AutoEnroll** permissions. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. -13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. -14. Click on the **Apply** to save changes and close the console. +10. On the **Request Handling** tab, select the **Renew with same key** check box. +11. On the **Security** tab, click **Add**. Type **Window Hello for Business Users** in the **Enter the object names to select** text box and click **OK**. +12. Click the **Windows Hello for Business Users** from the **Group or users names** list. In the **Permissions for Windows Hello for Business Users** section, select the **Allow** check box for the **Read**, **Enroll**, and **AutoEnroll** permissions. Excluding the **Windows Hello for Business Users** group, clear the **Allow** check box for the **Enroll** and **Autoenroll** permissions for all other entries in the **Group or users names** section if the check boxes are not already cleared. Click **OK**. +13. If you previously issued Windows Hello for Business sign-in certificates using Configuration Manger and are switching to an AD FS registration authority, then on the **Superseded Templates** tab, add the previously used **Windows Hello for Business Authentication** template(s), so they will be superseded by this template for the users that have Enroll permission for this template. +14. Click on the **Apply** to save changes and close the console. #### Mark the template as the Windows Hello Sign-in template @@ -148,8 +153,8 @@ Sign-in to an **AD FS Windows Server 2016** computer with _Enterprise Admin_ equ 1. Open an elevated command prompt. 2. Run `certutil -dsTemplate WHFBAuthentication msPKI-Private-Key-Flag +CTPRIVATEKEY_FLAG_HELLO_LOGON_KEY` ->[!NOTE] ->If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority. +> [!NOTE] +> If you gave your Windows Hello for Business Authentication certificate template a different name, then replace **WHFBAuthentication** in the above command with the name of your certificate template. It's important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the Certificate Template management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on our Windows Server 2012 or later certificate authority. ## Publish Templates @@ -160,12 +165,12 @@ The certificate authority may only issue certificates for certificate templates #### Publish Certificate Templates to the Certificate Authority Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. -5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, **WHFB Enrollment Agent** and **WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. -6. Close the console. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. +5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, **WHFB Enrollment Agent** and **WHFB Authentication** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. +6. Close the console. #### Unpublish Superseded Certificate Templates @@ -176,11 +181,12 @@ The newly created domain controller authentication certificate template supersed Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. -5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. +5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. + ### Section Review > [!div class="checklist"] @@ -191,11 +197,11 @@ Sign-in to the certificate authority or management workstation with _Enterprise > * Mark the certificate template as Windows Hello for Business sign-in template > * Publish Certificate templates to certificate authorities > * Unpublish superseded certificate templates - - +> +> > [!div class="step-by-step"] -[< Configure Azure AD Connect](hello-hybrid-cert-whfb-settings-dir-sync.md) -[Configure AD FS >](hello-hybrid-cert-whfb-settings-adfs.md) +> [< Configure Azure AD Connect](hello-hybrid-cert-whfb-settings-dir-sync.md) +> [Configure AD FS >](hello-hybrid-cert-whfb-settings-adfs.md)

                                  @@ -203,7 +209,7 @@ Sign-in to the certificate authority or management workstation with _Enterprise ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings: PKI (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md index 0ffc39e4d5..80325188e6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-policy.md @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Configure Hybrid Windows Hello for Business: Group Policy @@ -25,7 +26,7 @@ ms.date: 08/19/2018 ## Policy Configuration -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 Creators Edition (1703) to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. @@ -47,26 +48,26 @@ To continue automatic enrollment and renewal of domain controller certificates t Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. Expand the domain and select the **Group Policy Object** node in the navigation pane. -3. Right-click **Group Policy object** and select **New** -4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. -5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. -6. In the navigation pane, expand **Policies** under **Computer Configuration**. -7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. -8. In the details pane, right-click **Certificate Services Client - Auto-Enrollment** and select **Properties**. -9. Select **Enabled** from the **Configuration Model** list. -10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. -11. Select the **Update certificates that use certificate templates** check box. -12. Click **OK**. Close the **Group Policy Management Editor**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New** +4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. +5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **Computer Configuration**. +7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. +8. In the details pane, right-click **Certificate Services Client - Auto-Enrollment** and select **Properties**. +9. Select **Enabled** from the **Configuration Model** list. +10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +11. Select the **Update certificates that use certificate templates** check box. +12. Click **OK**. Close the **Group Policy Management Editor**. #### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO** -3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO** +3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. ### Windows Hello for Business Group Policy @@ -117,7 +118,7 @@ Sign-in a domain controller or management workstations with _Domain Admin_ equiv 7. Select **Enabled** from the **Configuration Model** list. 8. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. 9. Select the **Update certificates that use certificate templates** check box. -10. Click **OK**. Close the **Group Policy Management Editor**. +10. Click **OK**. Close the **Group Policy Management Editor**. #### Configure Security in the Windows Hello for Business Group Policy object @@ -150,7 +151,7 @@ The default configuration for Windows Hello for Business is to prefer hardware p You can enable and deploy the **Use a hardware security device** Group Policy Setting to force Windows Hello for Business to only create hardware protected credentials. Users that sign-in from a computer incapable of creating a hardware protected credential do not enroll for Windows Hello for Business. -Another policy setting becomes available when you enable the **Use a hardware security device** Group Policy setting that enables you to prevent Windows Hello for Business enrollment from using version 1.2 Trusted Platform Modules (TPM). Version 1.2 TPMs typically perform cryptographic operations slower than version 2.0 TPMs and are more unforgiving during anti-hammering and PIN lockout activities. Therefore, some organization may want not want slow sign-in performance and management overhead associated with version 1.2 TPMs. To prevent Windows Hello for Business from using version 1.2 TPMs, simply select the TPM 1.2 check box after you enable the Use a hardware security device Group Policy object. +Another policy setting becomes available when you enable the **Use a hardware security device** Group Policy setting that enables you to prevent Windows Hello for Business enrollment from using version 1.2 Trusted Platform Modules (TPM). Version 1.2 TPMs typically perform cryptographic operations slower than version 2.0 TPMs and are more unforgiving during anti-hammering and PIN lockout activities. Therefore, some organization may not want slow sign-in performance and management overhead associated with version 1.2 TPMs. To prevent Windows Hello for Business from using version 1.2 TPMs, simply select the TPM 1.2 check box after you enable the Use a hardware security device Group Policy object. #### Use biometrics @@ -186,10 +187,10 @@ Users must receive the Windows Hello for Business group policy settings and have > * Enable the Use certificate for on-premises authentication policy setting. > * Enable user automatic certificate enrollment. > * Add users or groups to the Windows Hello for Business group - - +> +> > [!div class="nextstepaction"] -[Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) +> [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md)

                                  @@ -197,8 +198,8 @@ Users must receive the Windows Hello for Business group policy settings and have ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business policy settings (*You are here*) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md index 49af90f1e4..fba1fd76f8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings.md @@ -1,19 +1,20 @@ --- title: Configure Hybrid Windows Hello for Business Settings (Windows Hello for Business) -description: Configuring Windows Hello for Business Settings in Hybrid deployment +description: Configuring Windows Hello for Business settings in hybrid certificate trust deployment. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Configure Windows Hello for Business @@ -23,7 +24,7 @@ ms.date: 08/19/2018 - Certificate trust -You're environment is federated and you are ready to configure your hybrid environment for Windows Hello for business using the certificate trust model. +Your environment is federated and you are ready to configure your hybrid environment for Windows Hello for business using the certificate trust model. > [!IMPORTANT] > If your environment is not federated, review the [New Installation baseline](hello-hybrid-cert-new-install.md) section of this deployment document to learn how to federate your environment for your Windows Hello for Business deployment. @@ -36,7 +37,7 @@ The configuration for Windows Hello for Business is grouped in four categories. For the most efficient deployment, configure these technologies in order beginning with the Active Directory configuration > [!div class="step-by-step"] -[Configure Active Directory >](hello-hybrid-cert-whfb-settings-ad.md) +> [Configure Active Directory >](hello-hybrid-cert-whfb-settings-ad.md)

                                  @@ -44,8 +45,8 @@ For the most efficient deployment, configure these technologies in order beginni ## Follow the Windows Hello for Business hybrid certificate trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) 5. Configure Windows Hello for Business settings (*You are here*) -6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) \ No newline at end of file +6. [Sign-in and Provision](hello-hybrid-cert-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md index 27ed68512f..6ab596d350 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md @@ -1,19 +1,20 @@ --- -title: Windows Hello for Business Key Trust New Installation (Windows Hello for Business) -description: Windows Hello for Business Hybrid baseline deployment +title: Windows Hello for Business Key Trust New Installation +description: Learn how to perform a hybrid key trust deployment of Windows Hello for Business, for systems with no previous installations. keywords: identity, PIN, biometric, Hello, passport, WHFB ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Windows Hello for Business Key Trust New Installation @@ -28,14 +29,14 @@ Windows Hello for Business involves configuring distributed technologies that ma * [Active Directory](#active-directory) * [Public Key Infrastructure](#public-key-infrastructure) * [Azure Active Directory](#azure-active-directory) -* [Active Directory Federation Services](#active-directory-federation-services) +* [Multifactor Authentication Services](#multifactor-authentication-services) New installations are considerably more involved than existing implementations because you are building the entire infrastructure. Microsoft recommends you review the new installation baseline to validate your existing environment has all the needed configurations to support your hybrid certificate trust Windows Hello for Business deployment. If your environment meets these needs, you can read the [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) section to prepare your Windows Hello for Business deployment by configuring directory synchronization. The new installation baseline begins with a basic Active Directory deployment and enterprise PKI. -## Active Directory ## +## Active Directory This document expects you have Active Directory deployed with an _adequate_ number of Windows Server 2016 domain controllers for each site. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. Lab environments and isolated proof of concepts may want to limit the number of domain controllers. The purpose of these environments is to experiment and learn. Reducing the number of domain controllers can prevent troubleshooting issue, such as Active Directory replication, which is unrelated to activity's goal. @@ -80,9 +81,9 @@ If you do not have an existing public key infrastructure, please review [Certifi > [!IMPORTANT] > For Azure AD joined device to authenticate to and use on-premises resources, ensure you: > * Install the root certificate authority certificate for your organization in the user's trusted root certificate store. -> * Publish your certificate revocation list to a location that is available to Azure AD joined devices, such as a web-based url. +> * Publish your certificate revocation list to a location that is available to Azure AD joined devices, such as a web-based URL. -### Section Review ### +### Section Review > [!div class="checklist"] > * Minimum Windows Server 2012 Certificate Authority. @@ -91,7 +92,7 @@ If you do not have an existing public key infrastructure, please review [Certifi > * Root certificate authority certificate (Azure AD Joined devices). > * Highly available certificate revocation list (Azure AD Joined devices). -## Azure Active Directory ## +## Azure Active Directory You’ve prepared your Active Directory. Hybrid Windows Hello for Business deployment needs Azure Active Directory to host your cloud-based identities. The next step of the deployment is to follow the [Creating an Azure AD tenant](https://docs.microsoft.com/azure/active-directory/develop/active-directory-howto-tenant) process to provision an Azure tenant for your organization. @@ -103,30 +104,31 @@ The next step of the deployment is to follow the [Creating an Azure AD tenant](h > * Create an Azure Active Directory Tenant. > * Purchase the appropriate Azure Active Directory subscription or licenses, if necessary. -## Multifactor Authentication Services ## +## Multifactor Authentication Services Windows Hello for Business uses multifactor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multifactor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA or a third-party MFA adapter Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. -### Azure Multi-Factor Authentication (MFA) Cloud ### +### Azure Multi-Factor Authentication (MFA) Cloud + > [!IMPORTANT] -As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: +> As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: > * Azure Multi-Factor Authentication > * Azure Active Directory Premium > * Enterprise Mobility + Security -> +> > If you have one of these subscriptions or licenses, skip the Azure MFA Adapter section. -#### Azure MFA Provider #### +#### Azure MFA Provider If your organization uses Azure MFA on a per-consumption model (no licenses), then review the [Create a Multifactor Authentication Provider](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-auth-provider) section to create an Azure MFA Authentication provider and associate it with your Azure tenant. -#### Configure Azure MFA Settings #### +#### Configure Azure MFA Settings Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. -#### Azure MFA User States #### -After you have completed configuring your Azure MFA settings, you want to review configure [User States](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users. +#### Azure MFA User States +After you have completed configuring your Azure MFA settings, you want to review [How to require two-step verification for a user](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users. -### Azure MFA via ADFS ### +### Azure MFA via ADFS Alternatively, you can configure Windows Server 2016 Active Directory Federation Services (AD FS) to provide additional multi-factor authentication. To configure, read the [Configure AD FS 2016 and Azure MFA](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-ad-fs-2016-and-azure-mfa) section. ### Section Review @@ -135,7 +137,7 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation > * Review the overview and uses of Azure Multifactor Authentication. > * Review your Azure Active Directory subscription for Azure Multifactor Authentication. > * Create an Azure Multifactor Authentication Provider, if necessary. -> * Configure Azure Multifactor Authentiation features and settings. +> * Configure Azure Multifactor Authentication features and settings. > * Understand the different User States and their effect on Azure Multifactor Authentication. > * Consider using Azure Multifactor Authentication or a third-party multifactor authentication provider with Windows Server Active Directory Federation Services, if necessary. @@ -148,7 +150,7 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-key-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. New Installation Baseline (*You are here*) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md index baf9a0401a..0977f9b6a8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-devreg.md @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Configure Device Registration for Hybrid key trust Windows Hello for Business @@ -38,7 +39,7 @@ Begin configuring device registration to support Hybrid Windows Hello for Busine To do this, follow the **Configure device settings** steps under [Setting up Azure AD Join in your organization](https://azure.microsoft.com/documentation/articles/active-directory-azureadjoin-setup/) -Next, follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/device-management-hybrid-azuread-joined-devices-setup) page. In the **Configuration steps** section, identify you configuration at the top of the table (either **Windows current and password hash sync** or **Windows current and federation**) and perform only the steps identified with a check mark. +Next, follow the guidance on the [How to configure hybrid Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-manual) page. In the **Configuration steps** section, identify your configuration at the top of the table (either **Windows current and password hash sync** or **Windows current and federation**) and perform only the steps identified with a check mark.

                                  @@ -47,7 +48,7 @@ Next, follow the guidance on the [How to configure hybrid Azure Active Directory ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-cert-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-cert-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-cert-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. Configure Azure Device Registration (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md index 3e829f4aa7..0f5cdfa98a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-dirsync.md @@ -1,19 +1,20 @@ --- title: Configure Directory Synchronization for Hybrid key trust Windows Hello for Business -description: Azure Directory Syncrhonization for Hybrid Certificate Key Deployment (Windows Hello for Business) -keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust, directory, syncrhonization, AADConnect +description: Azure Directory Synchronization for Hybrid Certificate Key Deployment (Windows Hello for Business) +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust, directory, synchronization, AADConnect ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Configure Directory Synchronization for Hybrid key trust Windows Hello for Business @@ -26,7 +27,7 @@ ms.date: 08/19/2018 You are ready to configure directory synchronization for your hybrid environment. Hybrid Windows Hello for Business deployment needs both a cloud and an on-premises identity to authenticate and access resources in the cloud or on-premises. ## Deploy Azure AD Connect -Next, you need to synchronizes the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](http://go.microsoft.com/fwlink/?LinkId=615771). +Next, you need to synchronize the on-premises Active Directory with Azure Active Directory. To do this, first review the [Integrating on-prem directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect) and [hardware and prerequisites](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-prerequisites) needed and then [download the software](https://go.microsoft.com/fwlink/?LinkId=615771). > [!NOTE] @@ -38,9 +39,9 @@ Next, you need to synchronizes the on-premises Active Directory with Azure Activ ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-key-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. Configure Directory Synchronization (*You are here*) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) 6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) -7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 1993139da7..d2b1de480f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -1,19 +1,20 @@ --- title: Hybrid Key trust Windows Hello for Business Prerequisites (Windows Hello for Business) -description: Prerequisites for Hybrid Windows Hello for Business Deployments +description: Prerequisites for hybrid Windows Hello for Business deployments using key trust. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, key-trust ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/20/2018 +ms.reviewer: --- # Hybrid Key trust Windows Hello for Business Prerequisites @@ -27,22 +28,23 @@ Hybrid environments are distributed systems that enable organizations to use on- The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include: * [Directories](#directories) -* [Public Key Infrastucture](#public-key-infastructure) +* [Public Key Infrastructure](#public-key-infrastructure) * [Directory Synchronization](#directory-synchronization) -* [Federation](#federation) +* [Federation](#federation-with-azure) * [MultiFactor Authentication](#multifactor-authentication) * [Device Registration](#device-registration) -## Directories ## +## Directories + Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. A hybrid Windows Hello for Business deployment needs an Azure Active Directory subscription. The hybrid key trust deployment, does not need a premium Azure Active Directory subscription. -You can deploy Windows Hello for Business in any environment with Windows Server 2008 R2 or later domain controllers. However, the key trust deployment needs an ***adequate*** number of Windows Server 2016 domain controllers at each site where users authenticate using Windows Hello for Business. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. +You can deploy Windows Hello for Business in any environment with Windows Server 2008 R2 or later domain controllers. However, the key trust deployment needs an ***adequate*** number of Windows Server 2016 or later domain controllers at each site where users authenticate using Windows Hello for Business. Read the [Planning an adequate number of Windows Server 2016 or later Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. Review these requirements and those from the Windows Hello for Business planning guide and worksheet. Based on your deployment decisions you may need to upgrade your on-premises Active Directory or your Azure Active Directory subscription to meet your needs. -### Section Review ### +### Section Review > [!div class="checklist"] > * Active Directory Domain Functional Level @@ -53,12 +55,23 @@ Review these requirements and those from the Windows Hello for Business planning
                                  -## Public Key Infrastructure ## +## Public Key Infrastructure The Windows Hello for Business deployment depends on an enterprise public key infrastructure as trust anchor for authentication. Domain controllers for hybrid deployments need a certificate in order for Windows 10 devices to trust the domain controller. Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object. -The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012. +The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party enterprise certification authority. The detailed requirements for the Domain Controller certificate are shown below. + +* The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL. +* Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name). +* The certificate Key Usage section must contain Digital Signature and Key Encipherment. +* Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None]. +* The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2), Server Authentication (1.3.6.1.5.5.7.3.1), and KDC Authentication (1.3.6.1.5.2.3.5). +* The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. +* The certificate template must have an extension that has the BMP data value "DomainController". +* The domain controller certificate must be installed in the local computer's certificate store. + + > [!IMPORTANT] > For Azure AD joined device to authenticate to and use on-premises resources, ensure you: @@ -71,7 +84,8 @@ The minimum required enterprise certificate authority that can be used with Wind
                                  -## Directory Synchronization ## +## Directory Synchronization + The two directories used in hybrid deployments must be synchronized. You need Azure Active Directory Connect to synchronize user accounts in the on-premises Active Directory with Azure Active Directory. Organizations using older directory synchronization technology, such as DirSync or Azure AD sync need to upgrade to Azure AD Connect. @@ -84,20 +98,21 @@ Organizations using older directory synchronization technology, such as DirSync
                                  -## Federation with Azure ## -You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization) and [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later. -### Section Review ### +## Federation with Azure ## +You can deploy Windows Hello for Business key trust in non-federated and federated environments. For non-federated environments, key trust deployments work in environments that have deployed [Password Synchronization with Azure AD Connect](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-implement-password-synchronization) or [Azure Active Directory Pass-through-Authentication](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect-pass-through-authentication). For federated environments, you can deploy Windows Hello for Business key trust using Active Directory Federation Services (AD FS) 2012 R2 or later. + > [!div class="checklist"] > * Non-federated environments > * Federated environments
                                  -## Multifactor Authentication ## +## Multifactor Authentication + Windows Hello for Business is a strong, two-factor credential the helps organizations reduce their dependency on passwords. The provisioning process lets a user enroll in Windows Hello for Business using their user name and password as one factor, but needs a second factor of authentication. -Hybrid Windows Hello for Business deployments can use Azure’s Multi-factor Authentication service or they can use multi-factor authentication provides by Windows Server 2012 R2 or later Active Directory Federation Services, which includes an adapter model that enables third parties to integrate their multi-factor authentication into AD FS. +Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Authentication (MFA) service or they can use multifactor authentication provided by AD FS beginning with Windows Server 2012 R2, which includes an adapter model that enables third parties to integrate their MFA into AD FS. The MFA enabled by an Office 365 license is sufficient for Azure AD. ### Section Review > [!div class="checklist"] @@ -107,20 +122,27 @@ Hybrid Windows Hello for Business deployments can use Azure’s Multi-factor Aut
                                  -## Device Registration ## -Organizations wanting to deploy hybrid key trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. - +## Device Registration + +Organizations wanting to deploy hybrid key trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. + +## Provisioning + +You need to allow access to the URL account.microsoft.com to initiate Windows Hello for Business provisioning. This URL launches the subsequent steps in the provisioning process and is required to successfully complete Windows Hello for Business provisioning. This URL does not require any authentication and as such, does not collect any user data. + + +### Section Checklist -### Section Checklist ### > [!div class="checklist"] > * Device Registration with Azure Device Registration
                                  -### Next Steps ### -Follow the Windows Hello for Business hybrid key trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Basline**. +### Next Steps -For environments transitioning from on-premises to hybrid, start with **Configure Azure Directory Syncrhonization**. +Follow the Windows Hello for Business hybrid key trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Baseline**. + +For environments transitioning from on-premises to hybrid, start with **Configure Azure Directory Synchronization**. For federated and non-federated environments, start with **Configure Windows Hello for Business settings**. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md index 6759f1e112..1f4f6b976d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust.md @@ -7,22 +7,23 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/20/2018 +ms.reviewer: --- # Hybrid Azure AD joined Key Trust Deployment **Applies to** -- Windows 10, version 1703 or later -- Hybrid deployment -- Key trust - +- Windows 10, version 1703 or later +- Hybrid deployment +- Key trust + Windows Hello for Business replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. The following deployment guide provides the information needed to successfully deploy Windows Hello for Business in a hybrid key trust scenario. It is recommended that you review the Windows Hello for Business planning guide prior to using the deployment guide. The planning guide helps you make decisions by explaining the available options with each aspect of the deployment and explains the potential outcomes based on each of these decisions. You can review the [planning guide](https://docs.microsoft.com/windows/access-protection/hello-for-business/hello-planning-guide) and download the [planning worksheet](https://go.microsoft.com/fwlink/?linkid=852514). @@ -30,24 +31,24 @@ It is recommended that you review the Windows Hello for Business planning guide This deployment guide provides guidance for new deployments and customers who are already federated with Office 365. These two scenarios provide a baseline from which you can begin your deployment. ## New Deployment Baseline ## + The new deployment baseline helps organizations who are moving to Azure and Office 365 to include Windows Hello for Business as part of their deployments. This baseline is good for organizations who are looking to deploy proof of concepts as well as IT professionals who want to familiarize themselves Windows Hello for Business by deploying a lab environment. - + This baseline provides detailed procedures to move your environment from an on-premises only environment to a hybrid environment using Windows Hello for Business to authenticate to Azure Active Directory and to your on-premises Active Directory using a single Windows sign-in. - -You’re next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. + +Your next step is to familiarize yourself with the prerequisites needed for the deployment. Many of the prerequisites will be new for organizations and individuals pursuing the new deployment baseline. Organizations and individuals starting from the federated baseline will likely be familiar with most of the prerequisites, but should validate they are using the proper versions that include the latest updates. > [!div class="nextstepaction"] -> [Prerequistes](hello-hybrid-key-trust-prereqs.md) +> [Prerequisites](hello-hybrid-key-trust-prereqs.md)

                                  -
                                  - ## Follow the Windows Hello for Business hybrid key trust deployment guide + 1. Overview (*You are here*) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) 6. [Configure Windows Hello for Business settings](hello-hybrid-key-whfb-settings.md) -7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md index 47f83cea11..85992e20d5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -1,24 +1,25 @@ ---- +--- title: Hybrid Windows Hello for Business key trust Provisioning (Windows Hello for Business) -description: Provisioning for Hybrid Windows Hello for Business Deployments +description: Provisioning for hybrid key trust deployments of Windows Hello for Business. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/20/2018 +ms.reviewer: --- # Hybrid Windows Hello for Business Provisioning **Applies to** -- Windows 10, version 1703 or later +- Windows 10, version 1703 or later - Hybrid deployment - Key trust diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md index 1e1d1effdc..3d7c456790 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/20/2018 +ms.reviewer: --- # Configuring Hybrid key trust Windows Hello for Business: Active Directory @@ -36,21 +37,21 @@ The Windows Hello for Business Users group is used to make it easy to deploy Win Sign-in a domain controller or management workstation with *Domain Admin* equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Click **View** and click **Advanced Features**. -3. Expand the domain node from the navigation pane. -4. Right-click the **Users** container. Click **New**. Click **Group**. -5. Type **Windows Hello for Business Users** in the **Group Name** text box. -6. Click **OK**. +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advanced Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **Windows Hello for Business Users** in the **Group Name** text box. +6. Click **OK**. ### Section Review > [!div class="checklist"] > * Create the Windows Hello for Business Users group - ->[!div class="step-by-step"] -[< Configure Windows Hello for Business](hello-hybrid-key-whfb-settings.md) -[Configure Azure AD Connect >](hello-hybrid-key-whfb-settings-dir-sync.md) +> +> [!div class="step-by-step"] +> [< Configure Windows Hello for Business](hello-hybrid-key-whfb-settings.md) +> [Configure Azure AD Connect >](hello-hybrid-key-whfb-settings-dir-sync.md)

                                  @@ -58,7 +59,7 @@ Sign-in a domain controller or management workstation with *Domain Admin* equiva ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md index 4ef86bfee8..ce98019039 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-dir-sync.md @@ -1,19 +1,20 @@ --- -title: Configuring Hybrid key trust Windows Hello for Business - Directory Synchronization -description: Configuring Hybrid key trust Windows Hello for Business - Directory Synchronization +title: Hybrid Windows Hello for Business - Directory Synchronization +description: How to configure Hybrid key trust Windows Hello for Business - Directory Synchronization keywords: identity, PIN, biometric, Hello, passport, WHFB, dirsync, connect, Windows Hello, AD Connect, key trust, key-trust ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Configure Hybrid Windows Hello for Business: Directory Synchronization @@ -22,12 +23,13 @@ ms.date: 08/19/2018 - Hybrid deployment - Key trust - ## Directory Synchronization In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory. ### Group Memberships for the Azure AD Connect Service Account +>[!IMPORTANT] +> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. For more detail see [Configure Hybrid Windows Hello for Business: Directory Synchronization](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-dir-sync). The KeyAdmins global group provides the Azure AD Connect service with the permissions needed to read and write the public key to Active Directory. @@ -45,17 +47,15 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva > [!div class="checklist"] > * Configure group membership for Azure AD Connect ->[!div class="step-by-step"] -[< Configure Active Directory](hello-hybrid-key-whfb-settings-ad.md) -[Configure PKI >](hello-hybrid-key-whfb-settings-pki.md) - -

                                  +> [!div class="step-by-step"] +> [< Configure Active Directory](hello-hybrid-key-whfb-settings-ad.md) +> [Configure PKI >](hello-hybrid-key-whfb-settings-pki.md)
                                  ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md index 3382dcb530..bbe8176263 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -1,5 +1,5 @@ --- -title: Configuring Hybrid key trust Windows Hello for Business - Public Key Infrastructure (PKI) +title: Configure Hybrid key trust Windows Hello for Business description: Configuring Hybrid key trust Windows Hello for Business - Public Key Infrastructure (PKI) keywords: identity, PIN, biometric, Hello, passport, WHFB, PKI, Windows Hello, key trust, key-trust ms.prod: w10 @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Configure Hybrid Windows Hello for Business: Public Key Infrastructure @@ -44,15 +45,18 @@ By default, the Active Directory Certificate Authority provides and publishes th Sign-in a certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise's needs. **Note**If you use different template names, you'll need to remember and substitute these names in different portions of the lab. -6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. -8. Close the console. +6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +8. Close the console. + +>[!NOTE] +>Don't confuse the **Request hash** algorithm with the hash argorithm of the certificate. #### Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template @@ -64,18 +68,20 @@ The autoenrollment feature in Windows enables you to effortlessly replace these Sign-in a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. -4. Click the **Superseded Templates** tab. Click **Add**. -5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. -6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. -7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. -8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. -9. Click **OK** and close the **Certificate Templates** console. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. +4. Click the **Superseded Templates** tab. Click **Add**. +5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. +6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. +7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. +8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. +9. Click **OK** and close the **Certificate Templates** console. The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. +>[!NOTE] +>The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. If you are using a 3rd party CA, this may not be done by default. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail. ### Publish Certificate Templates to a Certificate Authority @@ -100,11 +106,11 @@ The newly created domain controller authentication certificate template supersed Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. -5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. +5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. ### Section Review > [!div class="checklist"] @@ -112,11 +118,11 @@ Sign-in to the certificate authority or management workstation with _Enterprise > * Configure superseded domain controller certificate templates > * Publish Certificate templates to certificate authorities > * Unpublish superseded certificate templates - - +> +> > [!div class="step-by-step"] -[< Configure Azure AD Connect](hello-hybrid-key-whfb-settings-dir-sync.md) -[Configure policy settings >](hello-hybrid-key-whfb-settings-policy.md) +> [< Configure Azure AD Connect](hello-hybrid-key-whfb-settings-dir-sync.md) +> [Configure policy settings >](hello-hybrid-key-whfb-settings-policy.md)

                                  diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index 9f081c920a..440ab1ea70 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -1,5 +1,5 @@ --- -title: Configuring Hybrid key trust Windows Hello for Business - Group Policy +title: Configure Hybrid Windows Hello for Business - Group Policy description: Configuring Hybrid key trust Windows Hello for Business - Group Policy keywords: identity, PIN, biometric, Hello, passport, WHFB, Windows Hello, key trust, key-trust ms.prod: w10 @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/20/2018 +ms.reviewer: --- # Configure Hybrid Windows Hello for Business: Group Policy @@ -25,7 +26,7 @@ ms.date: 08/20/2018 ## Policy Configuration -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10 Creators Edition (1703) to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. @@ -45,26 +46,29 @@ To continue automatic enrollment and renewal of domain controller certificates t Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. Expand the domain and select the **Group Policy Object** node in the navigation pane. -3. Right-click **Group Policy object** and select **New** -4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. -5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. -6. In the navigation pane, expand **Policies** under **Computer Configuration**. -7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. -8. In the details pane, right-click **Certificate Services Client � Auto-Enrollment** and select **Properties**. -9. Select **Enabled** from the **Configuration Model** list. -10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. -11. Select the **Update certificates that use certificate templates** check box. -12. Click **OK**. Close the **Group Policy Management Editor**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New** +4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. +5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **Computer Configuration**. +7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. +8. In the details pane, right-click **Certificate Services Client � Auto-Enrollment** and select **Properties**. +9. Select **Enabled** from the **Configuration Model** list. +10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +11. Select the **Update certificates that use certificate templates** check box. +12. Click **OK**. Close the **Group Policy Management Editor**. #### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object Sign-in a domain controller or management workstations with _Domain Admin_ equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO�** -3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO�** +3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. + +>[!IMPORTANT] +>If you don't find options in GPO, you have to load the [PolicyDefinitions folder](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra). ### Windows Hello for Business Group Policy @@ -157,10 +161,10 @@ Users must receive the Windows Hello for Business group policy settings and have > * Create Windows Hello for Business Group Policy object. > * Enable the Use Windows Hello for Business policy setting. > * Add users or groups to the Windows Hello for Business group - - +> +> > [!div class="nextstepaction"] -[Sign-in and Provision](hello-hybrid-key-whfb-provision.md) +> [Sign-in and Provision](hello-hybrid-key-whfb-provision.md)

                                  @@ -168,7 +172,7 @@ Users must receive the Windows Hello for Business group policy settings and have ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md index 448963dfbd..d8eb2ac3ed 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -1,19 +1,20 @@ --- -title: Configure Hybrid Windows Hello for Business key trust Settings (Windows Hello for Business) -description: Configuring Windows Hello for Business Settings in Hybrid deployment +title: Configure Hybrid Windows Hello for Business key trust Settings +description: Configuring Windows Hello for Business settings in hybrid key trust deployment. keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, certificate-trust ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Configure Hybrid Windows Hello for Business key trust settings @@ -37,7 +38,7 @@ The configuration for Windows Hello for Business is grouped in four categories. For the most efficient deployment, configure these technologies in order beginning with the Active Directory configuration > [!div class="step-by-step"] -[Configure Active Directory >](hello-hybrid-key-whfb-settings-ad.md) +> [Configure Active Directory >](hello-hybrid-key-whfb-settings-ad.md)

                                  @@ -45,7 +46,7 @@ For the most efficient deployment, configure these technologies in order beginni ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index 672ad0f33f..3e982143da 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -2,39 +2,42 @@ title: Windows Hello for Business (Windows 10) description: Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. ms.assetid: 5BF09642-8CF5-4FBC-AC9A-5CA51E19387E +ms.reviewer: keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 05/05/2018 --- + # Windows Hello for Business In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN.
                                  Windows Hello for Business lets user authenticate to an Active Directory or Azure Active Directory account. Windows Hello addresses the following problems with passwords: -- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites. -- Server breaches can expose symmetric network credentials (passwords). -- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). -- Users can inadvertently expose their passwords due to [phishing attacks](https://go.microsoft.com/fwlink/p/?LinkId=615674). ->[!div class="mx-tdBreakAll"] ->| | | | ->| :---: | :---: | :---: | ->| [![Overview Icon](images/hello_filter.png)](hello-overview.md)
                                  [Overview](hello-overview.md) | [![Why a PIN is better than a password Icon](images/hello_lock.png)](hello-why-pin-is-better-than-password.md)
                                  [Why PIN is better than a password](hello-why-pin-is-better-than-password.md) | [![Manage Hello Icon](images/hello_gear.png)](hello-manage-in-organization.md)
                                  [Manage Windows Hello in your Organization](hello-manage-in-organization.md) | +- Strong passwords can be difficult to remember, and users often reuse passwords on multiple sites. +- Server breaches can expose symmetric network credentials (passwords). +- Passwords are subject to [replay attacks](https://go.microsoft.com/fwlink/p/?LinkId=615673). +- Users can inadvertently expose their passwords due to [phishing attacks](https://docs.microsoft.com/windows/security/threat-protection/intelligence/phishing). -## Prerequisites +> | | | | +> | :---: | :---: | :---: | +> | [![Overview Icon](images/hello_filter.png)](hello-overview.md)
                                  [Overview](hello-overview.md) | [![Why a PIN is better than a password Icon](images/hello_lock.png)](hello-why-pin-is-better-than-password.md)
                                  [Why PIN is better than a password](hello-why-pin-is-better-than-password.md) | [![Manage Hello Icon](images/hello_gear.png)](hello-manage-in-organization.md)
                                  [Manage Windows Hello in your Organization](hello-manage-in-organization.md) | + +## Prerequisites ### Cloud Only Deployment + * Windows 10, version 1511 or later * Microsoft Azure Account * Azure Active Directory @@ -43,6 +46,7 @@ Windows Hello addresses the following problems with passwords: * Azure AD Premium subscription - *optional*, needed for automatic MDM enrollment when the device joins Azure Active Directory ### Hybrid Deployments + The table shows the minimum requirements for each deployment. For key trust in a multi-domain/multi-forest deployment, the following requirements are applicable for each domain/forest that hosts Windows Hello for business components or is involved in the Kerberos referral process. | Key trust
                                  Group Policy managed | Certificate trust
                                  Mixed managed | Key trust
                                  Modern managed | Certificate trust
                                  Modern managed | @@ -50,25 +54,41 @@ The table shows the minimum requirements for each deployment. For key trust in a | Windows 10, version 1511 or later| **Hybrid Azure AD Joined:**
                                  *Minimum:* Windows 10, version 1703
                                  *Best experience:* Windows 10, version 1709 or later (supports synchronous certificate enrollment).
                                  **Azure AD Joined:**
                                  Windows 10, version 1511 or later| Windows 10, version 1511 or later | Windows 10, version 1511 or later | | Windows Server 2016 Schema | Windows Server 2016 Schema | Windows Server 2016 Schema | Windows Server 2016 Schema | | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level| Windows Server 2008 R2 Domain/Forest functional level |Windows Server 2008 R2 Domain/Forest functional level | -| Windows Server 2016 Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | +| Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | | N/A | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) (hybrid Azure AD joined clients),
                                  and
                                  Windows Server 2012 or later Network Device Enrollment Service (Azure AD joined) | N/A | Windows Server 2012 or later Network Device Enrollment Service | -| Azure MFA tenant, or
                                  AD FS w/Azure MFA adapter, or
                                  AD FS w/Azure MFA Server adapter, or
                                  AD FS w/3rd Party MFA Adapter| Azure MFA tenant, or
                                  AD FS w/Azure MFA adapter, or
                                  AD FS w/Azure MFA Server adapter, or
                                  AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
                                  AD FS w/Azure MFA adapter, or
                                  AD FS w/Azure MFA Server adapter, or
                                  AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
                                  AD FS w/Azure MFA adapter, or
                                  AD FS w/Azure MFA Server adapter, or
                                  AD FS w/3rd Party MFA Adapter | +| Azure MFA tenant, or
                                  AD FS w/Azure MFA adapter, or
                                  AD FS w/Azure MFA Server adapter, or
                                  AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
                                  AD FS w/Azure MFA adapter, or
                                  AD FS w/Azure MFA Server adapter, or
                                  AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
                                  AD FS w/Azure MFA adapter, or
                                  AD FS w/Azure MFA Server adapter, or
                                  AD FS w/3rd Party MFA Adapter | Azure MFA tenant, or
                                  AD FS w/Azure MFA adapter, or
                                  AD FS w/Azure MFA Server adapter, or
                                  AD FS w/3rd Party MFA Adapter | | Azure Account | Azure Account | Azure Account | Azure Account | | Azure Active Directory | Azure Active Directory | Azure Active Directory | Azure Active Directory | | Azure AD Connect | Azure AD Connect | Azure AD Connect | Azure AD Connect | | Azure AD Premium, optional | Azure AD Premium, needed for device write-back | Azure AD Premium, optional for automatic MDM enrollment | Azure AD Premium, optional for automatic MDM enrollment | -### On-premises Deployments +> [!Important] +> 1. Hybrid deployments support non-destructive PIN reset that works with both the certificate trust and key trust models.
                                  +> **Requirements:**
                                  +> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903
                                  +> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 +> +> 2. On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
                                  +> **Requirements:**
                                  +> Reset from settings - Windows 10, version 1703, Professional
                                  +> Reset above lock screen - Windows 10, version 1709, Professional
                                  +> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 + +### On-premises Deployments + The table shows the minimum requirements for each deployment. | Key trust
                                  Group Policy managed | Certificate trust
                                  Group Policy managed| -| --- | --- | +| --- | --- | | Windows 10, version 1703 or later | Windows 10, version 1703 or later | | Windows Server 2016 Schema | Windows Server 2016 Schema| | Windows Server 2008 R2 Domain/Forest functional level | Windows Server 2008 R2 Domain/Forest functional level | -| Windows Server 2016 Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | +| Windows Server 2016 or later Domain Controllers | Windows Server 2008 R2 or later Domain Controllers | | Windows Server 2012 or later Certificate Authority | Windows Server 2012 or later Certificate Authority | | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | Windows Server 2016 AD FS with [KB4088889 update](https://support.microsoft.com/help/4088889) | -| AD FS with Azure MFA Server, or
                                  AD FS with 3rd Party MFA Adapter | AD FS with Azure MFA Server, or
                                  AD FS with 3rd Party MFA Adapter | +| AD FS with 3rd Party MFA Adapter | AD FS with 3rd Party MFA Adapter | | Azure Account, optional for Azure MFA billing | Azure Account, optional for Azure MFA billing | + +> [!IMPORTANT] +> For Windows Hello for Business key trust deployments, if you have several domains, at least one Windows Server Domain Controller 2016 or newer is required for each domain. For more information, see the [planning guide](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers). diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index 5cef71faf7..a908e96533 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -1,19 +1,20 @@ --- -title: Prepare and Deploy Windows Server 2016 Active Directory Federation Services (Windows Hello for Business) -description: How toPrepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business +title: Prepare & Deploy Windows Active Directory Federation Services with key trust (Windows Hello for Business) +description: How to Prepare and Deploy Windows Server 2016 Active Directory Federation Services for Windows Hello for Business using key trust. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Prepare and Deploy Windows Server 2016 Active Directory Federation Services @@ -37,11 +38,11 @@ A new Active Directory Federation Services farm should have a minimum of two fed Prepare the Active Directory Federation Services deployment by installing and updating two Windows Server 2016 Servers. Ensure the update listed below is applied to each server before continuing. -## Update Windows Server 2016 +## Update Windows Server 2016 Sign-in the federation server with _local admin_ equivalent credentials. -1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please review the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed. -2. Ensure the latest server updates to the federation server includes [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). +1. Ensure Windows Server 2016 is current by running **Windows Update** from **Settings**. Continue this process until no further updates are needed. If you’re not using Windows Update for updates, please review the [Windows Server 2016 update history page](https://support.microsoft.com/help/4000825/windows-10-windows-server-2016-update-history) to make sure you have the latest updates available installed. +2. Ensure the latest server updates to the federation server includes [KB4088889 (14393.2155)](https://support.microsoft.com/help/4088889). >[!IMPORTANT] >The above referenced updates are mandatory for Windows Hello for Business all on-premises deployment and hybrid certificate trust deployments for domain joined computers. @@ -90,15 +91,15 @@ The Active Directory Federation Service (AD FS) role provides the following serv Windows Hello for Business depends on proper device registration. For on-premises key trust deployments, Windows Server 2016 AD FS handles device and key registration. Sign-in the federation server with _Enterprise Admin_ equivalent credentials. -1. Start **Server Manager**. Click **Local Server** in the navigation pane. -2. Click **Manage** and then click **Add Roles and Features**. -3. Click **Next** on the **Before you begin** page. -4. On the **Select installation type** page, select **Role-based or feature-based installation** and click **Next**. -5. On the **Select destination server** page, choose **Select a server from the server pool**. Select the federation server from the **Server Pool** list. Click **Next**. -6. On the **Select server roles** page, select **Active Directory Federation Services**. Click **Next**. -7. Click **Next** on the **Select features** page. -8. Click **Next** on the **Active Directory Federation Service** page. -9. Click **Install** to start the role installation. +1. Start **Server Manager**. Click **Local Server** in the navigation pane. +2. Click **Manage** and then click **Add Roles and Features**. +3. Click **Next** on the **Before you begin** page. +4. On the **Select installation type** page, select **Role-based or feature-based installation** and click **Next**. +5. On the **Select destination server** page, choose **Select a server from the server pool**. Select the federation server from the **Server Pool** list. Click **Next**. +6. On the **Select server roles** page, select **Active Directory Federation Services**. Click **Next**. +7. Click **Next** on the **Select features** page. +8. Click **Next** on the **Active Directory Federation Service** page. +9. Click **Install** to start the role installation. ## Review @@ -136,11 +137,11 @@ Windows Server 2008 and 2008 R2 domain controllers do not host the Microsoft Key #### Create an AD FS Service Account Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Right-click the **Users** container, Click **New**. Click **User**. -3. In the **New Object – User** window, type **adfssvc** in the **Full name** text box. Type **adfssvc** in the **User logon name** text box. Click **Next**. -4. Enter and confirm a password for the **adfssvc** user. Clear the **User must change password at next logon** check box. -5. Click **Next** and then click **Finish**. +1. Open **Active Directory Users and Computers**. +2. Right-click the **Users** container, Click **New**. Click **User**. +3. In the **New Object – User** window, type **adfssvc** in the **Full name** text box. Type **adfssvc** in the **User logon name** text box. Click **Next**. +4. Enter and confirm a password for the **adfssvc** user. Clear the **User must change password at next logon** check box. +5. Click **Next** and then click **Finish**. ## Configure the Active Directory Federation Service Role @@ -149,7 +150,7 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva ### Windows Server 2016, 2012 R2 or later Domain Controllers -Use the following procedures to configure AD FS when your environment uses **Windows Server 2012 or later Domain Controllers**. If you are not using Windows Server 2012 or later Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2008 or 2008R2 Domain Controllers)](#windows-server-2008-or-2008R2-domain-controllers) section. +Use the following procedures to configure AD FS when your environment uses **Windows Server 2012 or later Domain Controllers**. If you are not using Windows Server 2012 or later Domain Controllers, follow the procedures under the [Configure the Active Directory Federation Service Role (Windows Server 2008 or 2008R2 Domain Controllers)](#windows-server-2008-or-2008-r2-domain-controllers) section. Sign-in the federation server with _Domain Admin_ equivalent credentials. These procedures assume you are configuring the first federation server in a federation server farm. 1. Start **Server Manager**. @@ -164,8 +165,8 @@ Sign-in the federation server with _Domain Admin_ equivalent credentials. These 8. On the **Specify Service Account** page, select **Create a Group Managed Service Account**. In the **Account Name** box, type **adfssvc**. 9. On the **Specify Configuration Database** page, select **Create a database on this server using Windows Internal Database** and click **Next**. 10. On the **Review Options** page, click **Next**. -11. On the **Pre-requisite Checks** page, click **Configure**. -12. When the process completes, click **Close**. +11. On the **Pre-requisite Checks** page, click **Configure**. +12. When the process completes, click **Close**. ### Windows Server 2008 or 2008 R2 Domain Controllers @@ -183,11 +184,11 @@ Sign-in the federation server with _Domain Admin_ equivalent credentials. These 7. Type the Federation Service Display Name in the text box. This is the name users see when signing in. Click **Next**. 8. On the **Specify Service Account** page, Select **Use an existing domain user account or group Managed Service Account** and click **Select**. * In the **Select User or Service Account** dialog box, type the name of the previously created AD FS service account (example adfssvc) and click **OK**. Type the password for the AD FS service account and click **Next**. -9. On the **Specify Configuration Database** page, select **Create a database on this server using Windows Internal Database** and click **Next**. -10. On the **Review Options** page, click **Next**. -11. On the **Pre-requisite Checks** page, click **Configure**. -12. When the process completes, click **Close**. -13. Do not restart the AD FS server. You will do this later. +9. On the **Specify Configuration Database** page, select **Create a database on this server using Windows Internal Database** and click **Next**. +10. On the **Review Options** page, click **Next**. +11. On the **Pre-requisite Checks** page, click **Configure**. +12. When the process completes, click **Close**. +13. Do not restart the AD FS server. You will do this later. ### Add the AD FS Service account to the KeyAdmins group @@ -318,9 +319,9 @@ Sign-in the domain controller or administrative workstation with _Domain Admin_ ### Deploy the Intranet Zone Group Policy object -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO…** -3. In the **Select GPO** dialog box, select **Intranet Zone Settings** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and right-click the node that has your Active Directory domain name and click **Link an existing GPO…** +3. In the **Select GPO** dialog box, select **Intranet Zone Settings** or the name of the Windows Hello for Business Group Policy object you previously created and click **OK**. ## Review diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md deleted file mode 100644 index 1d92e64857..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-deploy-mfa.md +++ /dev/null @@ -1,548 +0,0 @@ ---- -title: Configure or Deploy Multifactor Authentication Services (Windows Hello for Business) -description: How to Configure or Deploy Multifactor Authentication Services for Windows Hello for Business -keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security, mobile -audience: ITPro -author: mikestephens-MS -ms.author: mstephen -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -localizationpriority: medium -ms.date: 08/19/2018 ---- -# Configure or Deploy Multifactor Authentication Services - -**Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Key trust - - -On-premises deployments must use the On-premises Azure MFA Server using the AD FS adapter model Optionally, you can use a third-party MFA server that provides an AD FS Multifactor authentication adapter. - ->[!TIP] ->Please make sure you've read [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) before proceeding any further. - -## Prerequisites - -The Azure MFA Server and User Portal servers have several perquisites and must have connectivity to the Internet. - -### Primary MFA Server - -The Azure MFA server uses a primary and secondary replication model for its configuration database. The primary Azure MFA server hosts the writable partition of the configuration database. All secondary Azure MFA servers hosts read-only partitions of the configuration database. All production environment should deploy a minimum of two MFA Servers. - -For this documentation, the primary MFA uses the name **mf*a*** or **mfa.corp.contoso.com**. All secondary servers use the name **mfa*n*** or **mfa*n*.corp.contoso.com**, where *n* is the number of the deployed MFA server. - -The primary MFA server is also responsible for synchronizing from Active Directory. Therefore, the primary MFA server should be domain joined and fully patched. - -#### Enroll for Server Authentication - -The communication between the primary MFA server, secondary MFA servers, User Portal servers, and the client is protected using TLS, which needs a server authentication certificate. - -Sign-in the primary MFA server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (mfa.corp.contoso.com). Click **Add**. Click **OK** when finished. -9. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. - -#### Install the Web Server Role - -The Azure MFA server does not require the Web Server role, however, User Portal and the optional Mobile Application server communicate with the MFA server database using the MFA Web Services SDK. The MFA Web Services SDK uses the Web Server role. - -To install the Web Server (IIS) role, please follow [Installing IIS 7 on Windows Server 2008 or Windows Server 2008 R2](https://docs.microsoft.com/iis/install/installing-iis-7/installing-iis-7-and-above-on-windows-server-2008-or-windows-server-2008-r2) or [Installing IIS 8.5 on Windows Server 2012 R2](https://docs.microsoft.com/iis/install/installing-iis-85/installing-iis-85-on-windows-server-2012-r2) depending on the host Operating System you're going to use. - -The following services are required: -* Common Parameters > Default Document. -* Common Parameters > Directory Browsing. -* Common Parameters > HTTP Errors. -* Common Parameters > Static Content. -* Health and Diagnostics > HTTP Logging. -* Performance > Static Content Compression. -* Security > Request Filtering. -* Security > Basic Authentication. -* Management Tools > IIS Management Console. -* Management Tools > IIS 6 Management Compatibility. -* Application Development > ASP.NET 4.5. - -#### Update the Server - -Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. - -#### Configure the IIS Server’s Certificate - -The TLS protocol protects all the communication to and from the MFA server. To enable this protection, you must configure the default web site to use the previously enrolled server authentication certificate. - -Sign in the primary MFA server with _administrator_ equivalent credentials. -1. From **Administrators**, Start the **Internet Information Services (IIS) Manager** console -2. In the navigation pane, expand the node with the same name as the local computer. Expand **Settings** and select **Default Web Site**. -3. In the **Actions** pane, click **Bindings**. -4. In the **Site Bindings** dialog, Click **Add**. -5. In the **Add Site Binding** dialog, select **https** from the **Type** list. In the **SSL certificate** list, select the certificate with the name that matches the FQDN of the computer. -6. Click **OK**. Click **Close**. From the **Action** pane, click **Restart**. - -#### Configure the Web Service’s Security - -The Azure MFA Server service runs in the security context of the Local System. The MFA User Portal gets its user and configuration information from the Azure MFA server using the MFA Web Services. Access control to the information is gated by membership to the Phonefactor Admins security group. You need to configure the Web Service’s security to ensure the User Portal and the Mobile Application servers can securely communicate to the Azure MFA Server. Also, all User Portal server administrators must be included in the Phonefactor Admins security group. - -Sign in the domain controller with _domain administrator_ equivalent credentials. - -##### Create Phonefactor Admin group - -1. Open **Active Directory Users and Computers** -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **Group**. -3. In the **New Object – Group** dialog box, type **Phonefactor Admins** in Group name. -4. Click **OK**. - -##### Add accounts to the Phonefactor Admins group - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select Users. In the content pane. Right-click the **Phonefactor Admins** security group and select **Properties**. -3. Click the **Members** tab. -4. Click **Add**. Click **Object Types..** In the **Object Types** dialog box, select **Computers** and click **OK**. Enter the following user and/or computers accounts in the **Enter the object names to select** box and then click **OK**. - * The computer account for the primary MFA Server - * Group or user account that will manage the User Portal server. - - -#### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: - -* Confirm the hosts of the MFA service has enrolled a server authentication certificate with the proper names. - * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: - * Certificate serial number - * Certificate thumbprint - * Common name of the certificate - * Subject alternate name of the certificate - * Name of the physical host server - * The issued date - * The expiration date - * Issuing CA Vendor (if a third-party certificate) - -* Confirm the Web Services Role was installed with the correct configuration (including Basic Authentication, ASP.NET 4.5, etc). -* Confirm the host has all the available updates from Windows Update. -* Confirm you bound the server authentication certificate to the IIS web site. -* Confirm you created the Phonefactor Admins group. -* Confirm you added the computer account hosting the MFA service to the Phonefactor Admins group and any user account who are responsible for administrating the MFA server or User Portal. - -### User Portal Server - -The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. User Portal Administrators may be set up and granted permission to add new users and update existing users. - -The User Portal web site uses the user database that is synchronized across the MFA Servers, which enables a design to support multiple web servers for the User Portal and those servers can support internal and external customers. While the user portal web site can be installed directly on the MFA server, it is recommended to install the User Portal on a server separate from the MFA Server to protect the MFA user database, as a layered, defense-in-depth security design. - -#### Enroll for Server Authentication - -Internal and external users use the User Portal to manage their multifactor authentication settings. To protect this communication, you need to enroll all User Portal servers with a server authentication certificate. You can use an enterprise certificate to protect communication to internal User Portal servers. - -For external User Portal servers, it is typical to request a server authentication certificate from a public certificate authority. Contact a public certificate authority for more information on requesting a certificate for public use. Follow the procedures below to enroll an enterprise certificate on your User Portal server. - -Sign-in the User Portal server with _domain admin_ equivalent credentials. -1. Start the Local Computer **Certificate Manager** (certlm.msc). -2. Expand the **Personal** node in the navigation pane. -3. Right-click **Personal**. Select **All Tasks** and **Request New Certificate**. -4. Click **Next** on the **Before You Begin** page. -5. Click **Next** on the **Select Certificate Enrollment Policy** page. -6. On the **Request Certificates** page, Select the **Internal Web Server** check box. -7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link. -8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the primary MFA server and then click **Add** (app1.corp.contoso.com). -9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your User Portal service (mfaweb.corp.contoso.com). -10. Click **Add**. Click **OK** when finished. -11. Click **Enroll**. - -A server authentication certificate should appear in the computer’s Personal certificate store. - -#### Install the Web Server Role - -To do this, please follow the instructions mentioned in the previous [Install the Web Server Role](#install-the-web-server-role) section. However, do **not** install Security > Basic Authentication. The user portal server does not require this. - -#### Update the Server - -Update the server using Windows Update until the server has no required or optional updates as the Azure MFA Server software may require one or more of these updates for the installation and software to correctly work. These procedures install additional components that may need to be updated. - -#### Configure the IIS Server’s Certificate - -To do this, please follow the instructions mentioned in the previous [Configure the IIS Server’s Certificate](#configure-the-iis-server’s-certificate) section. - -#### Create WebServices SDK user account - -The User Portal and Mobile Application web services need to communicate with the configuration database hosted on the primary MFA server. These services use a user account to communicate to authenticate to the primary MFA server. You can think of the WebServices SDK account as a service account used by other servers to access the WebServices SDK on the primary MFA server. - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Right-click the **Users** container, select **New**, and select **User**. -3. In the **New Object – User** dialog box, type **PFWSDK_** in the **First name** and **User logon name** boxes, where ** is the name of the primary MFA server running the Web Services SDK. Click **Next**. -4. Type a strong password and confirm it in the respective boxes. Clear **User must change password at next logon**. Click **Next**. Click **Finish** to create the user account. - -#### Add the MFA SDK user account to the Phonefactor Admins group - -Adding the WebServices SDK user account to the Phonefactor Admins group provides the user account with the proper authorization needed to access the configuration data on the primary MFA server using the WebServices SDK. - -1. Open **Active Directory Users and Computers**. -2. In the navigation pane, expand the node with the organization’s Active Directory domain name. Select **Users**. In the content pane. Right-click the **Phonefactors Admin** security group and select Properties. -3. Click the Members tab. -4. Click **Add**. Click **Object Types..** Type the PFWSDK_ user name in the **Enter the object names to select** box and then click **OK**. - * The computer account for the primary MFA Server - * The Webservices SDK user account - * Group or user account that will manage the User Portal server. - - -#### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: - -* Confirm the hosts of the user portal are properly configure for load balancing and high-availability. -* Confirm the hosts of the user portal have enrolled a server authentication certificate with the proper names. - * Record the expiration date of the certificate and set a renewal reminder at least six weeks before it expires that includes the: - * Certificate serial number - * Certificate thumbprint - * Common name of the certificate - * Subject alternate name of the certificate - * Name of the physical host server - * The issued date - * The expiration date - * Issuing CA Vendor (if a third-party certificate) - -* Confirm the Web Server Role was properly configured on all servers. -* Confirm all the hosts have the latest updates from Windows Update. -* Confirm you created the web service SDK domain account and the account is a member of the Phonefactor Admins group. - -## Installing Primary Azure MFA Server - -When you install Azure Multi-Factor Authentication Server, you have the following options: -1. Install Azure Multi-Factor Authentication Server locally on the same server as AD FS -2. Install the Azure Multi-Factor Authentication adapter locally on the AD FS server, and then install Multi-Factor Authentication Server on a different computer (preferred deployment for production environments) - -See [Configure Azure Multi-Factor Authentication Server to work with AD FS in Windows Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12) to view detailed installation and configuration options. - -Sign-in the federation server with _Domain Admin_ equivalent credentials and follow [To install and configure the Azure Multi-Factor Authentication server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#to-install-and-configure-the-azure-multi-factor-authentication-server) for an express setup with the configuration wizard. You can re-run the authentication wizard by selecting it from the Tools menu on the server. - ->[!IMPORTANT] ->Only follow the above mention article to install Azure MFA Server. Once it is installed, continue configuration using this article. - -### Configuring Company Settings - -You need to configure the MFA server with the default settings it applies to each user account when it is imported or synchronized from Active Directory. - -Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. -1. Start the **Multi-Factor Server** application -2. Click **Company Settings**. -3. On the **General** Tab, select **Fail Authentication** from the **When internet is not accessible** list. -4. In **User defaults**, select **Phone Call** or **Text Message** - **Note:** You can use mobile application; however, the configuration is beyond the scope of this document. Read [Getting started the MFA Server Mobile App Web Service](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice) to configure and use mobile application multi-factor authentication or the Install User Portal topic in the Multi-Factor Server help. -5. Select **Enable Global Services** if you want to allow Multi-Factor Authentications to be made to telephone numbers in rate zones that have an associated charge. -6. Clear the **User can change phone** check box to prevent users from changing their phone during the Multi-Factor Authentication call or in the User Portal. A consistent configuration is for users to change their phone numbers in Active Directory and let those changes synchronize to the multi-factor server using the Synchronization features in Directory Integration. -7. Select **Fail Authentication** from the **When user is disabled** list. Users should provision their account through the user portal. -8. Select the appropriate language from the **Phone call language**, **Text message language**, **Mobile app language**, and **OATH token language** lists. -9. Under default PIN rules, Select the User can change PIN check box to enable users to change their PIN during multi-factor authentication and through the user portal. -10. Configure the minimum length for the PIN. -11. Select the **Prevent weak PINs** check box to reject weak PINs. A weak PIN is any PIN that could be easily guessed by a hacker: 3 sequential digits, 3 repeating digits, or any 4 digit subset of user phone number are not allowed. If you clear this box, then there are no restrictions on PIN format. For example: User tries to reset PIN to 1235 and is rejected because it's a weak PIN. User will be prompted to enter a valid PIN. -12. Select the **Expiration days** check box if you want to expire PINs. If enabled, provide a numeric value representing the number of days the PIN is valid. -13. Select the **PIN history** check box if you want to remember previously used PINs for the user. PIN History stores old PINs for each user. Users are not allowed to reset their PIN to any value stored in their PIN History. When cleared, no PIN History is stored. The default value is 5 and range is 1 to 10. - -![Azure MFA Server Company settings configured](images/hello-mfa-company-settings.png) - -### Configuring Email Settings and Content - -If you are deploying in a lab or proof-of-concept, then you have the option of skipping this step. In a production environment, ideally, you’ll want to setup the Azure Multifactor Authentication Server and its user portal web interface prior to sending the email. The email gives your users time to visit the user portal and configure the multi-factor settings. - -Now that you have imported or synchronized with your Azure Multi-Factor Authentication server, it is advised that you send your users an email that informs them that they have been enrolled in multi-factor authentication. - -With the Azure Multi-Factor Authentication Server there are various ways to configure your users for using multi-factor authentication. For instance, if you know the users’ phone numbers or were able to import the phone numbers into the Azure Multi-Factor Authentication Server from their company’s directory, the email will let users know that they have been configured to use Azure Multi-Factor Authentication, provide some instructions on using Azure Multi-Factor Authentication and inform the user of the phone number they will receive their authentications on. - -The content of the email will vary depending on the method of authentication that has been set for the user (e.g. phone call, SMS, mobile application). For example, if the user is required to use a PIN when they authenticate, the email will tell them what their initial PIN has been set to. Users are usually required to change their PIN during their first authentication. - -If users’ phone numbers have not been configured or imported into the Azure Multi-Factor Authentication Server, or users are pre-configured to use the mobile application for authentication, you can send them an email that lets them know that they have been configured to use Azure Multi-Factor Authentication and it will direct them to complete their account enrollment through the Azure Multi-Factor Authentication User Portal. A hyperlink will be included that the user clicks on to access the User Portal. When the user clicks on the hyperlink, their web browser will open and take them to their company’s Azure Multi-Factor Authentication User Portal. - -#### Settings - -By clicking the email icon on the left you can setup the settings for sending these emails. This is where you can enter the SMTP information of your mail server and it allows you to send a blanket wide email by adding a check to the Send mails to users check box. - -#### Content - -On the Email Content tab, you will see all of the various email templates that are available to choose from. So, depending on how you have configured your users to use multi-factor authentication, you can choose the template that best suits you. - -##### Edit the Content Settings - -The Azure MFA server does not send emails, even when configured to do so, until you configured the sender information for each email template listed in the Content tab. - -Sign-in the primary MFA server with MFA _administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. Click **Email** from the list of icons and click the **Email Content** tab. -3. Select an email template from the list of templates. Click **Edit**. -4. In the **Edit Email** dialog, in the **From** text box, type the email address of the person or group that should appear to have sent the email. - ![Edit email dialog within content settings](images/hello-mfa-content-edit-email.png) - -5. Optionally, customize other options in the email template. -6. When finished editing the template, Click **Apply**. -7. Click **Next** to move to the next email in the list. Repeat steps 4 and 6 to edit the changes. -8. Click **Close** when you are done editing the email templates. - -### Configuring Directory Integration Settings and Synchronization - -Synchronization keeps the Multi-Factor Authentication user database synchronized with the users in Active Directory or another LDAP Lightweight Directory Access Protocol directory. The process is similar to Importing Users from Active Directory, but periodically polls for Active Directory user and security group changes to process. It also provides for disabling or removing users removed from a container or security group and removing users deleted from Active Directory. - -It is important to use a different group memberships for synchronizing users from Active Directory and for enabling Windows Hello for Business. Keeping the group memberships separated enables you to synchronize users and configure MFA options without immediately deploying Windows Hello for Business to that user. This deployment approach provides the maximum flexibility, which gives users the ability to configure their settings before they provision Windows Hello for Business. To start provisioning, simply add the group used for synchronization to the Windows Hello for Business Users group (or equivalent if you use custom names). - -#### MultiFactorAuthAdSync Service - -The MultiFactorAuthAdSync service is a Windows service that performs the periodic polling of Active Directory. It is installed in a Stopped state and is started by the MultiFactorAuth service when configured to run. If you have a multi-server Multi-Factor Authentication configuration, the MultiFactorAuthAdSync may only be run on a single server. - -The MultiFactorAuthAdSync service uses the DirSync LDAP server extension provided by Microsoft to efficiently poll for changes. This DirSync control caller must have the "directory get changes" right and DS-Replication-Get-Changes extended control access right. By default, these rights are assigned to the Administrator and LocalSystem accounts on domain controllers. The MultiFactorAuthAdSync service is configured to run as LocalSystem by default. Therefore, it is simplest to run the service on a domain controller. The service can run as an account with lesser permissions if you configure it to always perform a full synchronization. This is less efficient, but requires less account privileges. - -#### Settings - -Configuring the directory synchronization between Active Directory and the Azure MFA server is easy. - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. -3. Click the **Synchronization** tab. -4. Select **Use Active Directory**. -5. Select **Include trusted domains** to have the Multi-Factor Authentication Server attempt to connect to domains trusted by the current domain, another domain in the forest, or domains involved in a forest trust. When not importing or synchronizing users from any of the trusted domains, clear the check box to improve performance. - -#### Synchronization - -The MFA server uses synchronization items to synchronize users from Active Directory to the MFA server database. Synchronization items enables you to synchronize a collection of users based security groups or Active Directory containers. - -You can configure synchronization items based on different criteria and filters. For the purpose of configuring Windows Hello for Business, you need to create a synchronization item based membership of the Windows Hello for Business user group. This ensures the same users who receive Windows Hello for Business policy settings are the same users synchronized to the MFA server (and are the same users with permission to enroll in the certificate). This significantly simplifies deployment and troubleshooting. - -See [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint) for more details. - -##### To add a synchronization item - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the **Multi-Factor Authentication Server** console. -2. From the **Multi-Factor Authentication Server** window, click the **Directory Integration** icon. -3. Select the **Synchronization** tab. -4. On the **Synchronization** tab, click **Add**. - ![Azure MFA Server - add synchronization item screen](images/hello-mfa-sync-item.png) - -5. In the **Add Synchronization Item** dialog, select **Security Groups** from the **View** list. -6. Select the group you are using for replication from the list of groups -7. Select **Selected Security Groups – Recursive** or, select **Security Group** from the **Import** list if you do not plan to nest groups. -8. Select **Add new users and Update existing users**. -9. Select **Disable/Remove users no longer a member** and select **Disable** from the list. -10. Select the attributes appropriate for your environment for **Import phone** and **Backup**. -11. Select **Enabled** and select **Only New Users with Phone Number** from the list. -12. Select **Send email** and select **New and Updated Users**. - -##### Configure synchronization item defaults - -1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Method Defaults** tab. -2. Select the default second factor authentication method. For example, if the second factor of authentication is a text message, select **Text message**. Select if the direction of text message authentication and if the authentication should use a one-time password or one-time password and PIN (Ensure users are configured to create a PIN if the default second factor of communication requires a PIN). - -##### Configure synchronization language defaults - -1. When creating a new or editing a synchronization item from the Multi-Factor Authentication Server, select the **Language Defaults** tab. -2. Select the appropriate default language for these groups of users synchronized by these synchronization item. -3. If creating a new synchronization item, click **Add** to save the item. If editing an existing synchronization item, click **Apply** and then click **Close**. - ->[!TIP] ->For more information on these settings and the behaviors they control, see [Directory integration between Azure MFA Server and Active Directory](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-dirint). - -### Installing the MFA Web Services SDK - -The Web Service SDK section allows the administrator to install the Multi-Factor Authentication Web Service SDK. The Web Service SDK is an IIS (Internet Information Server) web service that provides an interface for integrating the full features of the Multi-Factor Authentication Server into most any application. The Web Service SDK uses the Multi-Factor Authentication Server as the data store. - -Remember the Web Services SDK is only need on the primary Multi-Factor to easily enable other servers access to the configuration information. The prerequisites section guided you through installing and configuring the items needed for the Web Services SDK, however the installer will validate the prerequisites and make suggest any corrective action needed. - -Please follow the instructions under [Install the web service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server-webservice#install-the-web-service-sdk) to install the MFA Web Services SDK. - -## Install Secondary MFA Servers - -Additional MFA servers provided redundancy of the MFA configuration. The MFA server models uses one primary MFA server with multiple secondary servers. Servers within the same group establish communication with the primary server for that group. The primary server replicates to each of the secondary servers. You can use groups to partition the data stored on different servers, for example you can create a group for each domain, forest, or organizational unit. - -Follow the same procedures for installing the primary MFA server software for each additional server. Remember that each server must be activated. - -Sign in the secondary MFA server with _domain administrator_ equivalent credentials. -1. Once the Multi-Factor Authentication Server console starts, you must configure the current server’s replication group membership. You have the option to join an existing group or create a new group. When joining an existing group, the server becomes a secondary server in the existing replication group. When creating a new group, the server becomes the primary server of that replication group. Click **OK**. - **Note:** Group membership cannot be changed after activation. If a server was joined to the wrong group, it must be activated again to join a different group. Please contact support for assistance with deactivating and reactivating a server. -2. The console asks you if you want to enable replication by running the **Multi-Server Configuration Wizard**. Click **Yes**. -3. In the **Multi-Server Configuration Wizard**, leave **Active Directory** selected and clear **Certificates**. Click **Next**. -4. On the **Active Directory** page, the wizard determines what configuration is needed to enable replication. Typically, the wizard recommends adding the computer account for the current server to the **PhoneFactor Admin** group. Click **Next** to add the computer account to the group. -5. On the **Multi-Server Configuration Complete** page, click **Finish** to reboot the computer to update its group membership. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm you downloaded the latest Azure MFA Server from the Azure Portal. -* Confirm the server has Internet connectivity. -* Confirm you installed and activated the Azure MFA Server. -* Confirm your Azure MFA Server configuration meets your organization’s needs (Company Settings, Email Settings, etc). -* Confirm you created Directory Synchronization items based on your deployment to synchronize users from Active Directory to the Azure MFA server. - * For example, you have security groups representing each collection of users that represent a phase of your deployment and a corresponding synchronization item for each of those groups. - -* Confirm the Azure MFA server properly communicates with the Azure MFA cloud service by testing multifactor authentication with a newly synchronized user account. -* Confirm you installed the Web Service SDK on the primary MFA server. -* Confirm your MFA servers have adequate redundancy, should you need to promote a secondary server to the primary server. - - -## Installing the User Portal Server - -You previously configured the User Portal settings on the primary MFA server. The User Portal web application communicates to the primary MFA server using the Web Services SDK to retrieve these settings. This configuration is ideal to ensure you can scale up the User Portal application to meet the needs of your internal users. - -### Copying the User Portal Installation file - -Sign in the primary MFA server with _local administrator_ equivalent credentials. -1. Open Windows Explorer. -2. Browse to the C:\Program Files\MultiFactor Authentication Server folder. -3. Copy the **MultiFactorAuthenticationUserPortalSetup64.msi** file to a folder on the User Portal server. - -### Configure Virtual Directory name - -Sign in the User Portal server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to the folder to which you saved the installation file from the previous step. -2. Run the **MultiFactorAuthenticationUserPortalSetup64.msi**. The installation package asks if you want to download **Visual Studio C++ Redistributable for Visual Studio 2015**. Click **Yes**. When prompted, select **Save As**. The downloaded file is missing its file extension. **Save the file with a .exe extension and install the runtime**. -3. Run the installation package again. The installer package asks about the C++ runtime again; however, this is for the X64 version (the previous prompt was for x86). Click **Yes** to download the installation package and select **Save As** so you can save the downloaded file with a .exe extension. **Install** the run time. -4. Run the User Portal installation package. On the **Select Installation Address** page, use the default settings for **Site** and **Application Pool** settings. You can modify the Virtual directory to use a name that is more fitting for the environment, such as **mfa** (This virtual directory must match the virtual directory specified in the User Portal settings). Click **Next**. -5. Click **Close**. - -### Edit MFA User Portal config file - -Sign in the User Portal server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to C:\inetpub\wwwroot\MultiFactorAuth (or appropriate directory based on the virtual directory name) and edit the **web.config** file. -2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. -3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. -4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. -5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from **“http://localhost:4898/PfWsSdk.asmx”** to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. https://computer1.domain.local/MultiFactorAuthWebServiceSdk/PfWsSdk.asmx). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the Internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **web.config** file after changes have been made. - -### Create a DNS entry for the User Portal web site - -Sign-in the domain controller or administrative workstation with _Domain Admin_ equivalent credentials. -1. Open the **DNS Management** console. -2. In the navigation pane, expand the domain controller name node and **Forward Lookup Zones**. -3. In the navigation pane, select the node that has the name of your internal Active Directory domain name. -4. In the navigation pane, right-click the domain name node and click **New Host (A or AAAA)**. -5. In the **name** box, type the host name of the User Portal, such as *mfaweb* (this name must match the name of the certificate used to secure communication to the User Portal). In the IP address box, type the load balanced **IP address** of the User Portal. Click **Add Host**. -6. Close the **DNS Management** console. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the user portal application is properly installed on all user portal hosts -* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. -* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME -* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. -* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. -* Confirm you saved the changes to the web.config file. - -### Validating your work - -Windows Hello for Business is a distributed system, which on the surface appears complex and difficult. The key to a successful Windows Hello for Business deployment is to validate phases of work prior to moving to the next phase. - -Using a web browser, navigate to the URL provided in the *pf_up_pfwssdk_PfWsSdk* named value in the web.config file of any one of the user portal servers. The URL should be protected by a server authentication certificate and should prompt you for authentication. Authenticate to the web site using the username and password provided in the web.config file. Successful authentication and page view confirms the Web SDK configured on the primary MFA server is correctly configured and ready to work with the user portal. - -### Configuring the User Portal - -The User Portal section allows the administrator to install and configure the Multi-Factor Authentication User Portal. The User Portal is an IIS Internet Information Server web site that allows users to enroll in Multi-Factor Authentication and maintain their accounts. A user may change their phone number, change their PIN, or bypass Multi-Factor Authentication during their next sign on. Users will log in to the User Portal using their normal username and password and will either complete a Multi-Factor Authentication call or answer security questions to complete their authentication. If user enrollment is allowed, a user will configure their phone number and PIN the first time they log in to the User Portal. -User Portal Administrators may be set up and granted permission to add new users and update existing users. - -#### Settings - -Sign in the primary MFA server with _MFA administrator_ equivalent credentials. -1. Open the Multi-Factor Authentication Server console. -2. From the Multi-Factor Authentication Server window, click the User Portal icon. - ![Azure MFA Server - User Portal settings](images/hello-mfa-user-portal-settings.png) - -3. On the Settings tab, type the URL your users use to access the User Portal. The URL should begin with https, such as `https://mfaportal.corp.contoso.com/mfa`. -The Multi-Factor Authentication Server uses this information when sending emails to users. -4. Select Allow users to log in and Allow user enrollment check boxes. -5. Select Allow users to select method. Select Phone call and select Text message (you can select Mobile application later once you have deployed the Mobile application web service). Select Automatically trigger user’s default method. -6. Select Allow users to select language. -7. Select Use security questions for fallback and select 4 from the Questions to answer list. - ->[!TIP] ->For more information on these settings and the behaviors they control, see [Deploy the user portal for the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal). - -#### Administrators - -The User Portal Settings tab allows the administrator to install and configure the User Portal. -1. Open the Multi-Factor Authentication Server console. -2. From the Multi-Factor Authentication Server window, click the User Portal icon. -3. On the Administrators tab, Click Add -4. In the Add Administrator dialog, Click Select User… to pick a user to install and manage the User Portal. Use the default permissions. -5. Click Add. - ->[!TIP] ->For more information on these settings and the behaviors they control, read the **Multi-Factor Authentication Server Help content**. - -#### Security Questions - -[Security questions](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#security-questions) for the User Portal may be customized to meet your requirements. The questions defined here will be offered as options for each of the four security questions a user is prompted to configure during their first log on to User Portal. The order of the questions is important since the first four items in the list will be used as defaults for the four security questions. - -#### Trusted IPs - -The [Trusted IPs](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-portal#trusted-ips) tab allows you to skip Multi-Factor Authentication for User Portal log ins originating from specific IPs. For example, if users use the User Portal from the office and from home, you may decide you don't want their phones ringing for Multi-Factor Authentication while at the office. For this, you would specify the office subnet as a trusted IP entry. - -## Configure the AD FS Server to use the MFA for multifactor authentication - -You need to configure the AD FS server to use the MFA server. You do this by Installing the MFA Adapter on the primary AD FS Server. - -### Install the MFA AD FS Adapter - -Follow [Install a standalone instance of the AD FS adapter by using the Web Service SDK](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-adfs-w2k12#install-a-standalone-instance-of-the-ad-fs-adapter-by-using-the-web-service-sdk). You should follow this instructions on all AD FS servers. You can find the files needed on the MFA server. - -### Edit the MFA AD FS Adapter config file on all ADFS Servers - -Sign in the primary AD FS server with _local administrator_ equivalent credentials. -1. Open Windows Explorer and browse to **C:\inetpub\wwwroot\MultiFactorAuth** (or appropriate directory based on the virtual directory name) and edit the **MultiFactorAuthenticationAdfsAdapter.config** file. -2. Locate the **USE_WEB_SERVICE_SDK** key and change the value from **false** to **true**. -3. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_USERNAME** key and set the value to the username of the Web Service SDK account in the **PhoneFactor Admins** security group. Use a qualified username, like domain\username or machine\username. -4. Locate the **WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD** key and set the value to the password of the Web Service SDK account in the **PhoneFactor Admins** security group. -5. Locate the **pfup_pfwssdk_PfWsSdk** setting and change the value from “http://localhost:4898/PfWsSdk.asmx” to the URL of the Web Service SDK that is running on the Azure Multi-Factor Authentication Server (e.g. https://computer1.domain.local/MultiFactorAuthWebServiceSdk/PfWsSdk.asmx). Since SSL is used for this connection, refer to the Web Service SDK by server name, not IP address, since the SSL certificate was issued for the server name. If the server name does not resolve to an IP address from the Internet-facing server, add an entry to the hosts file on that server to map the name of the Azure Multi-Factor Authentication Server to its IP address. Save the **MultiFactorAuthenticationAdfsAdapter.config** file after changes have been made. - -### Edit the AD FS Adapter Windows PowerShell cmdlet - -Sign in the primary AD FS server with _local administrator_ equivalent credentials. - -Edit the **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script adding `-ConfigurationFilePath ` to the end of the `Register-AdfsAuthenticationProvider` command where **** is the full path to the **MultiFactorAuthenticationAdfsAdapter.config** file. - -### Run the AD FS Adapter PowerShell cmdlet - -Sign in the primary AD FS server with local administrator equivalent credentials. - -Run **Register-MultiFactorAuthenticationAdfsAdapter.ps1** script in PowerShell to register the adapter. The adapter is registered as **WindowsAzureMultiFactorAuthentication**. - ->[!NOTE] ->You must restart the AD FS service for the registration to take effect. - -### Review - -Before you continue with the deployment, validate your deployment progress by reviewing the following items: -* Confirm the user portal application is properly installed on all user portal hosts -* Confirm the USE_WEB_SERVICE_SDK named value has a value equal to true. -* Confirm the WEB_SERVICE_SDK_AUTHENTICATION_USERNAME named value has the username of the web service SDK domain account previously created and that the user name is represented as DOMAIN\USERNAME -* Confirm the WEB_SERVICES_SDK_AUTHENTICATION_PASSWORD named value has the correct password for the web service SDK domain account. -* Confirm the pfup_pfwssdk_PfWsSdk named value has value that matches the URL of for the SDK service installed on the primary MFA server. -* Confirm you saved the changes to the web.config file. -* Confirm you restarted the AD FS Service after completing the configuration. - -## Test AD FS with the Multifactor Authentication connector - -Now, you should test your Azure Multi-Factor Authentication server configuration before proceeding any further in the deployment. The AD FS and Azure Multi-Factor Authentication server configurations are complete. - -1. In the **Multi-Factor Authentication** server, on the left, click **Users**. -2. In the list of users, select a user that is enabled and has a valid phone number to which you have access. -3. Click **Test**. -4. In the **Test User** dialog, provide the user’s password to authenticate the user to Active Directory. - -The Multi-Factor Authentication server communicates with the Azure MFA cloud service to perform a second factor authentication for the user. The Azure MFA cloud service contacts the phone number provided and asks for the user to perform the second factor authentication configured for the user. Successfully providing the second factor should result in the Multi-factor authentication server showing a success dialog. - - -## Follow the Windows Hello for Business on premises certificate trust deployment guide -1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) -2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) -3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) -4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md index e8cd8acaa1..26a28b9593 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-policy-settings.md @@ -1,5 +1,5 @@ --- -title: Configure Windows Hello for Business Policy settings (Windows Hello for Business) +title: Configure Windows Hello for Business Policy settings - key trust description: Configure Windows Hello for Business Policy settings for Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Configure Windows Hello for Business Policy settings @@ -23,7 +24,7 @@ ms.date: 08/19/2018 - Key trust -You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). +You need a Windows 10, version 1703 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business and PIN Complexity Group Policy settings. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1703. Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. @@ -32,9 +33,9 @@ On-premises certificate-based deployments of Windows Hello for Business needs on ## Enable Windows Hello for Business Group Policy -The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should be attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled. +The Group Policy setting determines whether users are allowed, and prompted, to enroll for Windows Hello for Business. It can be configured for computers or users. -You can configure the Enable Windows Hello for Business Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. Additionally, you can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence. +If you configure the Group Policy for computers, all users that sign-in to those computers will be allowed and prompted to enroll for Windows Hello for Business. If you configure the Group Policy for users, only those users will be allowed and prompted to enroll for Windows Hello for Business. For these settings to be configured using GPO, you need to download and install the latest Administrative Templates (.admx) for Windows 10. ## Create the Windows Hello for Business Group Policy object @@ -130,4 +131,4 @@ Users must receive the Windows Hello for Business group policy settings and have 2. [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) 4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) -5. Configure Windows Hello for Business Policy settings (*You are here*) \ No newline at end of file +5. Configure Windows Hello for Business Policy settings (*You are here*) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md index 4bd120cf26..42d9d4b606 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-ad-prereq.md @@ -1,6 +1,6 @@ --- -title: Validate Active Directory prerequisites (Windows Hello for Business) -description: How to Validate Active Directory prerequisites for Windows Hello for Business +title: Key registration for on-premises deployment of Windows Hello for Business +description: How to Validate Active Directory prerequisites for Windows Hello for Business when deploying with the key trust model. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy @@ -9,12 +9,13 @@ ms.pagetype: security, mobile author: DaniHalfin audience: ITPro author: mikestephens-MS -ms.author: mstephen +ms.author: dolmont manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Validate Active Directory prerequisites @@ -34,12 +35,12 @@ The Windows Hello for Business Users group is used to make it easy to deploy Win Sign-in a domain controller or management workstation with _Domain Admin_ equivalent credentials. -1. Open **Active Directory Users and Computers**. -2. Click **View** and click **Advanced Features**. -3. Expand the domain node from the navigation pane. -4. Right-click the **Users** container. Click **New**. Click **Group**. -5. Type **Windows Hello for Business Users** in the **Group Name** text box. -6. Click **OK**. +1. Open **Active Directory Users and Computers**. +2. Click **View** and click **Advanced Features**. +3. Expand the domain node from the navigation pane. +4. Right-click the **Users** container. Click **New**. Click **Group**. +5. Type **Windows Hello for Business Users** in the **Group Name** text box. +6. Click **OK**. ## Follow the Windows Hello for Business on premises certificate trust deployment guide @@ -47,4 +48,4 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva 2. [Validate and Configure Public Key Infrastructure](hello-key-trust-validate-pki.md) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) 4. [Validate and Deploy Multifactor Authentication Services (MFA)](hello-key-trust-validate-deploy-mfa.md) -5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) \ No newline at end of file +5. [Configure Windows Hello for Business Policy settings](hello-key-trust-policy-settings.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 11c3a1d90a..6377afa5a8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -1,50 +1,37 @@ --- -title: Validate and Deploy Multifactor Authentication Services (MFA) (Windows Hello for Business) -description: How to Validate and Deploy Multifactor Authentication Services for Windows Hello for Business +title: Validate and Deploy MFA for Windows Hello for Business with key trust +description: How to Validate and Deploy Multifactor Authentication (MFA) Services for Windows Hello for Business with key trust keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- -# Validate and Deploy Multifactor Authentication Services (MFA) +# Validate and Deploy Multi-factor Authentication (MFA) + +> [!IMPORTANT] +> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who would like to require multi-factor authentication from their users should use cloud-based Azure Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1 will be able to download the latest version, future updates and generate activation credentials as usual. **Applies to** -- Windows 10, version 1703 or later -- On-premises deployment -- Key trust +- Windows 10, version 1703 or later +- On-premises deployment +- Key trust -Windows Hello for Business requires all users perform an additional factor of authentication prior to creating and registering a Windows Hello for Business credential. Windows Hello for Business deployments use Azure Multi-Factor Authentication (Azure MFA) services for the secondary authentication. On-Premises deployments use Azure MFA server, an on-premises implementation that do not require synchronizing Active Directory credentials to Azure Active Directory. +Windows Hello for Business requires all users perform multi-factor authentication prior to creating and registering a Windows Hello for Business credential. On-premises deployments can use certificates, third-party authentication providers for AD FS, or a custom authentication provider for AD FS as an on-premises MFA option. -Azure Multi-Factor Authentication is an easy to use, scalable, and reliable solution that provides a second method of authentication so your users are always protected. -* **Easy to Use** - Azure Multi-Factor Authentication is simple to set up and use. The extra protection that comes with Azure Multi-Factor Authentication allows users to manage their own devices. Best of all, in many instances it can be set up with just a few simple clicks. -* **Scalable** - Azure Multi-Factor Authentication uses the power of the cloud and integrates with your on-premises AD and custom applications. This protection is even extended to your high-volume, mission-critical scenarios. -* **Always Protected** - Azure Multi-Factor Authentication provides strong authentication using the highest industry standards. -* **Reliable** - We guarantee 99.9% availability of Azure Multi-Factor Authentication. The service is considered unavailable when it is unable to receive or process verification requests for the two-step verification. +For information on available third-party authentication methods see [Configure Additional Authentication Methods for AD FS](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs). For creating a custom authentication method see [Build a Custom Authentication Method for AD FS in Windows Server](https://docs.microsoft.com/windows-server/identity/ad-fs/development/ad-fs-build-custom-auth-method) -## On-Premises Azure MFA Server - -On-premises deployments, both key and certificate trust, use the Azure MFA server where the credentials are not synchronized to Azure Active Directory. - -### Infrastructure - -A lab or proof-of-concept environment does not need high-availability or scalability. However, a production environment needs both of these. Ensure your environment considers and incorporates these factors, as necessary. All production environments should have a minimum of two MFA servers—one primary and one secondary server. The environment should have a minimum of two User Portal Servers that are load balanced using hardware or Windows Network Load Balancing. - -Please follow [Download the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#download-the-azure-multi-factor-authentication-server) to download Azure MFA server. - ->[!IMPORTANT] ->Make sure to validate the requirements for Azure MFA server, as outlined in [Install and Configure the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-server#install-and-configure-the-azure-multi-factor-authentication-server) before proceeding. Do not use installation instructions provided in the article. - -Once you have validated all the requirements, please proceed to [Configure or Deploy Multifactor Authentication Services](hello-key-trust-deploy-mfa.md). +Follow the integration and deployment guide for the authentication provider you select to integrate and deploy it to AD FS. Make sure that the authentication provider is selected as a multi-factor authentication option in the AD FS authentication policy. For information on configuring AD FS authentication policies see [Configure Authentication Policies](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-authentication-policies). ## Follow the Windows Hello for Business on premises certificate trust deployment guide 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md index 8c28287378..57a2493e4c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-pki.md @@ -1,20 +1,22 @@ --- -title: Validate Public Key Infrastructure (Windows Hello for Business) -description: How to Validate Public Key Infrastructure for Windows Hello for Business +title: Validate Public Key Infrastructure - key trust model (Windows Hello for Business) +description: How to Validate Public Key Infrastructure for Windows Hello for Business, under a key trust model. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- + # Validate and Configure Public Key Infrastructure **Applies to** @@ -62,15 +64,15 @@ Domain controllers automatically request a domain controller certificate (if pub By default, the Active Directory Certificate Authority provides and publishes the Kerberos Authentication certificate template. However, the cryptography configuration included in the provided template is based on older and less performant cryptography APIs. To ensure domain controllers request the proper certificate with the best available cryptography, use the Kerberos Authentication certificate template as a baseline to create an updated domain controller certificate template. Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise’s needs. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Kerberos Authentication** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2008 R2** from the **Certification Authority** list. Select **Windows 7.Server 2008 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Domain Controller Authentication (Kerberos)** in Template display name. Adjust the validity and renewal period to meet your enterprise’s needs. **Note**If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. -6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. -7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. -8. Close the console. +6. On the **Subject Name** tab, select the **Build from this Active Directory information** button if it is not already selected. Select **None** from the **Subject name format** list. Select **DNS name** from the **Include this information in alternate subject** list. Clear all other items. +7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +8. Close the console. ### Superseding the existing Domain Controller certificate @@ -79,15 +81,15 @@ Many domain controllers may have an existing domain controller certificate. The The Kerberos Authentication certificate template is the most current certificate template designated for domain controllers and should be the one you deploy to all your domain controllers (2008 or later). The autoenrollment feature in Windows enables you to effortlessly replace these domain controller certificates. You can use the following configuration to replace older domain controller certificates with a new certificate using the Kerberos Authentication certificate template. Sign-in to a certificate authority or management workstations with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. -4. Click the **Superseded Templates** tab. Click **Add**. -5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. -6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. -7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. -8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. -9. Click **OK** and close the **Certificate Templates** console. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Domain Controller Authentication (Kerberos)** (or the name of the certificate template you created in the previous section) template in the details pane and click **Properties**. +4. Click the **Superseded Templates** tab. Click **Add**. +5. From the **Add Superseded Template** dialog, select the **Domain Controller** certificate template and click **OK**. Click **Add**. +6. From the **Add Superseded Template** dialog, select the **Domain Controller Authentication** certificate template and click **OK**. +7. From the **Add Superseded Template dialog**, select the **Kerberos Authentication** certificate template and click **OK**. +8. Add any other enterprise certificate templates that were previously configured for domain controllers to the **Superseded Templates** tab. +9. Click **OK** and close the **Certificate Templates** console. The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities. @@ -96,17 +98,17 @@ The certificate template is configured to supersede all the certificate template Windows 10 clients use the https protocol when communicating with Active Directory Federation Services. To meet this need, you must issue a server authentication certificate to all the nodes in the Active Directory Federation Services farm. On-premises deployments can use a server authentication certificate issued by their enterprise PKI. You must configure a server authentication certificate template so the host running the Active Directory Federation Service can request the certificate. Sign-in to a certificate authority or management workstations with _Domain Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Right-click **Certificate Templates** and click **Manage**. -3. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and click **Duplicate Template**. -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. -5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. +1. Open the **Certificate Authority** management console. +2. Right-click **Certificate Templates** and click **Manage**. +3. In the **Certificate Template Console**, right-click the **Web Server** template in the details pane and click **Duplicate Template**. +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Authority** list. Select **Windows Server 2012** or **Windows Server 2012 R2** from the **Certification Recipient** list. +5. On the **General** tab, type **Internal Web Server** in **Template display name**. Adjust the validity and renewal period to meet your enterprise’s needs. **Note:** If you use different template names, you’ll need to remember and substitute these names in different portions of the lab. -6. On the **Request Handling** tab, select **Allow private key to be exported**. -7. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. -8. On the **Security** tab, Click **Add**. Type **Domain Computers** in the **Enter the object names to select** box. Click **OK**. Select the **Allow** check box next to the **Enroll** permission. -9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. -10. Close the console. +6. On the **Request Handling** tab, select **Allow private key to be exported**. +7. On the **Subject** tab, select the **Supply in the request** button if it is not already selected. +8. On the **Security** tab, Click **Add**. Type **Domain Computers** in the **Enter the object names to select** box. Click **OK**. Select the **Allow** check box next to the **Enroll** permission. +9. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. +10. Close the console. ### Unpublish Superseded Certificate Templates @@ -115,50 +117,50 @@ The certificate authority only issues certificates based on published certificat The newly created domain controller authentication certificate template supersedes previous domain controller certificate templates. Therefore, you need to unpublish these certificate templates from all issuing certificate authorities. Sign-in to the certificate authority or management workstation with _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. -5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Domain Controller** certificate template in the content pane and select **Delete**. Click **Yes** on the **Disable certificate templates** window. +5. Repeat step 4 for the **Domain Controller Authentication** and **Kerberos Authentication** certificate templates. ### Publish Certificate Templates to the Certificate Authority The certificate authority may only issue certificates for certificate templates that are published to that certificate authority. If you have more than one certificate authority and you want that certificate authority to issue certificates based on a specific certificate template, then you must publish the certificate template to all certificate authorities that are expected to issue the certificate. Sign-in to the certificate authority or management workstations with an _Enterprise Admin_ equivalent credentials. -1. Open the **Certificate Authority** management console. -2. Expand the parent node from the navigation pane. -3. Click **Certificate Templates** in the navigation pane. -4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. -5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. -6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list. +1. Open the **Certificate Authority** management console. +2. Expand the parent node from the navigation pane. +3. Click **Certificate Templates** in the navigation pane. +4. Right-click the **Certificate Templates** node. Click **New**, and click **Certificate Template** to issue. +5. In the **Enable Certificates Templates** window, select the **Domain Controller Authentication (Kerberos)**, and **Internal Web Server** templates you created in the previous steps. Click **OK** to publish the selected certificate templates to the certificate authority. +6. If you published the Domain Controller Authentication (Kerberos) certificate template, then you should unpublish the certificate templates you included in the superseded templates list. * To unpublish a certificate template, right-click the certificate template you want to unpublish in the details pane of the Certificate Authority console and select **Delete**. Click **Yes** to confirm the operation. -7. Close the console. +7. Close the console. ### Configure Domain Controllers for Automatic Certificate Enrollment Domain controllers automatically request a certificate from the domain controller certificate template. However, the domain controller is unaware of newer certificate templates or superseded configurations on certificate templates. To continue automatic enrollment and renewal of domain controller certificates that understand newer certificate template and superseded certificate template configurations, create and configure a Group Policy object for automatic certificate enrollment and link the Group Policy object to the Domain Controllers OU. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. Expand the domain and select the **Group Policy Object** node in the navigation pane. -3. Right-click **Group Policy object** and select **New** -4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. -5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. -6. In the navigation pane, expand **Policies** under **Computer Configuration**. -7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. -8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. -9. Select **Enabled** from the **Configuration Model** list. -10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. -11. Select the **Update certificates that use certificate templates** check box. -12. Click **OK**. Close the **Group Policy Management Editor**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New** +4. Type *Domain Controller Auto Certificate Enrollment* in the name box and click **OK**. +5. Right-click the **Domain Controller Auto Certificate Enrollment** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **Computer Configuration**. +7. Expand **Windows Settings**, **Security Settings**, and click **Public Key Policies**. +8. In the details pane, right-click **Certificate Services Client – Auto-Enrollment** and select **Properties**. +9. Select **Enabled** from the **Configuration Model** list. +10. Select the **Renew expired certificates**, **update pending certificates**, and **remove revoked certificates** check box. +11. Select the **Update certificates that use certificate templates** check box. +12. Click **OK**. Close the **Group Policy Management Editor**. ### Deploy the Domain Controller Auto Certificate Enrollment Group Policy Object Sign-in to a domain controller or management workstations with _Domain Admin_ equivalent credentials. -1. Start the **Group Policy Management Console** (gpmc.msc) -2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…** -3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. In the navigation pane, expand the domain and expand the node that has your Active Directory domain name. Right-click the **Domain Controllers** organizational unit and click **Link an existing GPO…** +3. In the **Select GPO** dialog box, select **Domain Controller Auto Certificate Enrollment** or the name of the domain controller certificate enrollment Group Policy object you previously created and click **OK**. ### Validating your work @@ -194,7 +196,7 @@ Alternatively, you can forcefully trigger automatic certificate enrollment using Use the event logs to monitor certificate enrollment and archive. Review the configuration, such as publishing certificate templates to issuing certificate authority and the allow auto enrollment permissions. -## Follow the Windows Hello for Business on premises certificate trust deployment guide +## Follow the Windows Hello for Business on premises key trust deployment guide 1. [Validate Active Directory prerequisites](hello-key-trust-validate-ad-prereq.md) 2. Validate and Configure Public Key Infrastructure (*You are here*) 3. [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-key-trust-adfs.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md index 56c4b7a2a8..c9213a887f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md +++ b/windows/security/identity-protection/hello-for-business/hello-manage-in-organization.md @@ -2,14 +2,15 @@ title: Manage Windows Hello in your organization (Windows 10) description: You can create a Group Policy or mobile device management (MDM) policy that will implement Windows Hello for Business on devices running Windows 10. ms.assetid: 47B55221-24BE-482D-BD31-C78B22AC06D8 +ms.reviewer: keywords: identity, PIN, biometric, Hello ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -30,12 +31,14 @@ You can create a Group Policy or mobile device management (MDM) policy that will >Beginning in version 1607, Windows Hello as a convenience PIN is disabled by default on all domain-joined computers. To enable a convenience PIN for Windows 10, version 1607, enable the Group Policy setting **Turn on convenience PIN sign-in**. > >Use **PIN Complexity** policy settings to manage PINs for Windows Hello for Business. -  + ## Group Policy settings for Windows Hello for Business The following table lists the Group Policy settings that you can configure for Windows Hello use in your workplace. These policy settings are available in both **User configuration** and **Computer Configuration** under **Policies** > **Administrative Templates** > **Windows Components** > **Windows Hello for Business**. - +> [!NOTE] +> Starting with Windows 10, version 1709, the location of the PIN complexity section of the Group Policy is: **Computer Configuration** > **Administrative Templates** > **System** > **PIN Complexity**. + @@ -113,7 +116,7 @@ The following table lists the Group Policy settings that you can configure for W - + @@ -293,9 +296,9 @@ The following table lists the MDM policy settings that you can configure for Win
                                  PolicyHistory

                                  Not configured: Previous PINs are not stored.

                                  -

                                  Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused.

                                  +

                                  Enabled: Specify the number of previous PINs that can be associated to a user account that can't be reused.

                                  Disabled: Previous PINs are not stored.

                                  Note  Current PIN is included in PIN history.
                                   
                                  @@ -136,7 +139,7 @@ The following table lists the Group Policy settings that you can configure for W
                                  >Phone Sign-in>Phone Sign-in

                                  Use Phone Sign-in

                                  ->[!NOTE]   +>[!NOTE] > If policy is not configured to explicitly require letters or special characters, users will be restricted to creating a numeric PIN. -  + ## How to use Windows Hello for Business with Azure Active Directory @@ -319,4 +322,3 @@ If you want to use Windows Hello for Business with certificates, you’ll need a - [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) - [Event ID 300 - Windows Hello successfully created](hello-event-300.md) - [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) - diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 773be29f77..30d604bb53 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -1,5 +1,6 @@ --- -title: Windows Hello for Business (Windows 10) +title: Windows Hello for Business Overview (Windows 10) +ms.reviewer: An overview of Windows Hello for Business description: An overview of Windows Hello for Business keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 @@ -7,13 +8,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: conceptual localizationpriority: medium --- + # Windows Hello for Business Overview **Applies to** @@ -49,12 +51,18 @@ As an administrator in an enterprise or educational organization, you can create Windows stores biometric data that is used to implement Windows Hello securely on the local device only. The biometric data doesn’t roam and is never sent to external devices or servers. Because Windows Hello only stores biometric identification data on the device, there’s no single collection point an attacker can compromise to steal biometric data. +## From Windows 10 version 1803, the Windows Hello feature can be used as a safe and secure sign-in method. +Fingerprint scan can be enabled on laptop computers using a built-in fingerprint reader or an external USB fingerprint reader, as follows: +1. Go to **Settings** > **Accounts** > **Sign-in-options** > **Windows Hello Fingerprint** > **Add fingerprint** +2. Users will need to add a PIN after adding their fingerprint(s) to the reader configuration. +3. Windows Biometric data is located in the `C:\Windows\System32\WinBioDatabase\` folder (fingerprint data is stored with the .DAT file name extension). +4. If you are unable to sign in with previously registered fingerprints, delete the entire content of this folder and register your fingerprints again. ## The difference between Windows Hello and Windows Hello for Business -- Individuals can create a PIN or biometric gesture on their personal devices for convenient sign-in. This use of Windows Hello is unique to the device on which it is set up, however it is not backed by asymmetric (public/private key) or certificate-based authentication. +- Individuals can create a PIN or biometric gesture on their personal devices for convenient sign-in. This use of Windows Hello is unique to the device on which it is set up, but can use a simple password hash depending on an individual's account type. This configuration is referred to as Windows Hello convenience PIN and it is not backed by asymmetric (public/private key) or certificate-based authentication. -- Windows Hello for Business, which is configured by Group Policy or mobile device management (MDM) policy, uses key-based or certificate-based authentication. +- **Windows Hello for Business**, which is configured by Group Policy or mobile device management (MDM) policy, always uses key-based or certificate-based authentication. This makes it much more secure than **Windows Hello convenience PIN**. ## Benefits of Windows Hello @@ -91,13 +99,14 @@ For details, see [How Windows Hello for Business works](hello-how-it-works.md). ## Comparing key-based and certificate-based authentication -Windows Hello for Business can use either keys (hardware or software) or certificates in hardware or software. Enterprises that have a public key infrastructure (PKI) for issuing and managing certificates can continue to use PKI in combination with Windows Hello. Enterprises that do not use PKI or want to reduce the effort associated with managing certificates can rely on key-based credentials for Windows Hello but still use certificates on their domain controllers as a root of trust. +Windows Hello for Business can use either keys (hardware or software) or certificates in hardware or software. Enterprises that have a public key infrastructure (PKI) for issuing and managing end user certificates can continue to use PKI in combination with Windows Hello. Enterprises that do not use PKI or want to reduce the effort associated with managing user certificates can rely on key-based credentials for Windows Hello but still use certificates on their domain controllers as a root of trust. +Windows Hello for Business with a key does not support RDP. RDP does not support authentication with a key or a self signed certificate. RDP with Windows Hello for Business is supported with certificate based deployments. ## Learn more -[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/itshowcase/Article/Content/830/Implementing-Windows-Hello-for-Business-at-Microsoft) +[Implementing Windows Hello for Business at Microsoft](https://www.microsoft.com/itshowcase/implementing-windows-hello-for-business-at-microsoft) [Introduction to Windows Hello](https://go.microsoft.com/fwlink/p/?LinkId=786649), video presentation on Microsoft Virtual Academy diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 04dc168342..7dffe7b0a9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -7,23 +7,22 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: conceptual ms.date: 08/19/2018 +ms.reviewer: --- # Planning a Windows Hello for Business Deployment **Applies to** - Windows 10 -> This guide only applies to Windows 10, version 1511 or higher. - Congratulations! You are taking the first step forward in helping move your organizations away from password to a two-factor, convenience authentication for Windows — Windows Hello for Business. This planning guide helps you understand the different topologies, architectures, and components that encompass a Windows Hello for Business infrastructure. - + This guide explains the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of the infrastructure. Armed with your planning worksheet, you’ll use that information to select the correct deployment guide for your needs. ## Using this guide @@ -37,7 +36,7 @@ This guide removes the appearance of complexity by helping you make decisions on Read this document and record your decisions on the worksheet. When finished, your worksheet has all the necessary information for your Windows Hello for Business deployment. There are six major categories you need to consider for a Windows Hello for Business deployment. Those categories are: -* Deployment Options +* Deployment Options * Client * Management * Active Directory @@ -46,7 +45,7 @@ There are six major categories you need to consider for a Windows Hello for Busi ### Baseline Prerequisites -Windows Hello for Business has a few baseline prerequisites with which you can begin. These baseline prerequisites are provided in the worksheet. +Windows Hello for Business has a few baseline prerequisites with which you can begin. These baseline prerequisites are provided in the worksheet. ### Deployment Options @@ -65,19 +64,34 @@ The hybrid deployment model is for organizations that: * Have identities synchronized to Azure Active Directory using Azure Active Directory Connect * Use applications hosted in Azure Active Directory, and want a single sign-in user experience for both on-premises and Azure Active Directory resources +> [!Important] +> Hybrid deployments support non-destructive PIN reset that only works with the certificate trust model.
                                  +> **Requirements:**
                                  +> Microsoft PIN Reset Service - Windows 10, versions 1709 to 1809, Enterprise Edition. There is no licensing requirement for this service since version 1903
                                  +> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 + ##### On-premises The on-premises deployment model is for organizations that do not have cloud identities or use applications hosted in Azure Active Directory. +> [!Important] +> On-premises deployments support destructive PIN reset that works with both the certificate trust and the key trust models.
                                  +> **Requirements:**
                                  +> Reset from settings - Windows 10, version 1703, Professional
                                  +> Reset above lock screen - Windows 10, version 1709, Professional
                                  +> Reset above lock screen (_I forgot my PIN_ link) - Windows 10, version 1903 -It’s fundamentally important to understand which deployment model to use for a successful deployment. Some of aspects of the deployment may already be decided for you based on your current infrastructure. +It’s fundamentally important to understand which deployment model to use for a successful deployment. Some aspects of the deployment may have already been decided for you based on your current infrastructure. #### Trust types A deployment's trust type defines how each Windows Hello for Business client authenticates to the on-premises Active Directory. There are two trust types: key trust and certificate trust. - + The key trust type does not require issuing authentication certificates to end users. Users authenticate using a hardware-bound key created during the built-in provisioning experience. This requires an adequate distribution of Windows Server 2016 domain controllers relative to your existing authentication and the number of users included in your Windows Hello for Business deployment. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. -The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers. Users can authenticate using their certificate to any Windows Server 2008 R2 or later domain controller. +The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers (but still requires [Windows Server 2016 Active Directory schema](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs#directories)). Users can use their certificate to authenticate to any Windows Server 2008 R2, or later, domain controller. + +> [!NOTE] +> RDP does not support authentication with Windows Hello for Business key trust deployments. RDP is only supported with certificate trust deployments at this time. #### Device registration @@ -89,19 +103,21 @@ The built-in Windows Hello for Business provisioning experience creates a hardwa #### Multifactor authentication +> [!IMPORTANT] +> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who require multi-factor authentication for their users should use cloud-based Azure Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1, 2019 will be able to download the latest version, future updates and generate activation credentials as usual. See [Getting started with the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfaserver-deploy) for more details. + The goal of Windows Hello for Business is to move organizations away from passwords by providing them a strong credential that provides easy two-factor authentication. The built-in provisioning experience accepts the user’s weak credentials (username and password) as the first factor authentication; however, the user must provide a second factor of authentication before Windows provisions a strong credential. Cloud only and hybrid deployments provide many choices for multi-factor authentication. On-premises deployments must use a multi-factor authentication that provides an AD FS multi-factor adapter to be used in conjunction with the on-premises Windows Server 2016 AD FS server role. Organizations can use the on-premises Azure Multi-factor Authentication server, or choose from several third parties (Read [Microsoft and third-party additional authentication methods](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods) for more information). ->[!NOTE] +> [!NOTE] > Azure Multi-Factor Authentication is available through: ->* Microsoft Enterprise Agreement ->* Open Volume License Program ->* Cloud Solution Providers program ->* Bundled with +> * Microsoft Enterprise Agreement +> * Open Volume License Program +> * Cloud Solution Providers program +> * Bundled with > * Azure Active Directory Premium > * Enterprise Mobility Suite > * Enterprise Cloud Suite ->* A per-user and per-authentication consumption-based model that is billed monthly against Azure monetary commitment (Read [Multi-Factor Authentication Pricing](https://azure.microsoft.com/pricing/details/multi-factor-authentication/) for more information) #### Directory synchronization @@ -136,7 +152,7 @@ The Windows Hello for Business deployment depends on an enterprise public key in ### Cloud -Some deployment combinations require an Azure account and some require Azure Active Directory for user identities. These cloud requirements may only need an Azure account while other features need an Azure Active Directory Premium subscription. The planning process identifies and differentiates the components that are needed from the those that are optional. +Some deployment combinations require an Azure account, and some require Azure Active Directory for user identities. These cloud requirements may only need an Azure account while other features need an Azure Active Directory Premium subscription. The planning process identifies and differentiates the components that are needed from the those that are optional. ## Planning a Deployment @@ -150,24 +166,26 @@ Choose the deployment model based on the resources your users access. Use the f If your organization does not have on-premises resources, write **Cloud Only** in box **1a** on your planning worksheet. -If your organization is federated with Azure or uses any online service, such as Office365 or OneDrive, or your users access cloud and on-premises resources, write **Hybrid** in box **1a** on your planning worksheet. +If your organization is federated with Azure or uses any online service, such as Office365 or OneDrive, or your users' access cloud and on-premises resources, write **Hybrid** in box **1a** on your planning worksheet. If your organization does not have cloud resources, write **On-Premises** in box **1a** on your planning worksheet. ->[!NOTE] ->If you’re unsure if your organization is federated, run the following Active Directory Windows PowerShell command from an elevated Windows PowerShell prompt and evaluate the results. ->```Get-AdObject “CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=[forest_root_CN_name],DC=com" -Properties keywords``` ->* If the command returns an error stating it could not find the object, then you have yet to configured AAD Connect or on-premises Device Registration Services using AD FS. Ensure the name is accurate and validate the object does not exist with another Active Directory Management tool such as **ADSIEdit.msc**. If the object truly does not exist, then you environment does not bind you to a specific deployment or require changes to accommodate the desired deployment type. ->* If the command returns a value, compare that value with the values below. The value indicates the deployment model you should implement -> * If the value begins with **azureADName:** – write **Hybrid** in box **1a**on your planning worksheet. - > * If the value begins with **enterpriseDrsName:** – write **On-Premises** in box **1a** on your planning worksheet. +> [!NOTE] +> If you’re unsure if your organization is federated, run the following Active Directory Windows PowerShell command from an elevated Windows PowerShell prompt and evaluate the results. +> ```Get-AdObject “CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=[forest_root_CN_name],DC=com" -Properties keywords``` +> * If the command returns an error stating it could not find the object, then you have yet to configured AAD Connect or on-premises Device Registration Services using AD FS. Ensure the name is accurate and validate the object does not exist with another Active Directory Management tool such as **ADSIEdit.msc**. If the object truly does not exist, then your environment does not bind you to a specific deployment or require changes to accommodate the desired deployment type. +> * If the command returns a value, compare that value with the values below. The value indicates the deployment model you should implement +> * If the value begins with **azureADName:** – write **Hybrid** in box **1a**on your planning worksheet. +> * If the value begins with **enterpriseDrsName:** – write **On-Premises** in box **1a** on your planning worksheet. ### Trust type +Hybrid Azure AD joined devices managed by Group Policy need the Windows Server 2016 AD FS role to issue certificates. Hybrid Azure AD joined devices and Azure AD joined devices managed by Intune or a compatible MDM need the Windows Server NDES server role to issue certificates. + Choose a trust type that is best suited for your organizations. Remember, the trust type determines two things. Whether you issue authentication certificates to your users and if your deployment needs Windows Server 2016 domain controllers. One trust model is not more secure than the other. The major difference is based on the organization comfort with deploying Windows Server 2016 domain controllers and not enrolling users with end entity certificates (key-trust) against using existing domain controllers (Windows Server 2008R2 or later) and needing to enroll certificates for all their users (certificate trust). -Because the certificate trust types issues certificates, there is more configuration and infrastructure needed to accommodate user certificate enrollment, which could also be a factor to consider in your decision. Additional infrastructure needed for certificate-trust deployments includes a certificate registration authority. Hybrid Azure AD joined devices managed by Group Policy need the Windows Server 2016 AD FS role to issue certificates. Hybrid Azure AD joined devices and Azure AD joined devices managed by Intune or a compatible MDM need the Windows Server NDES server role to issue certificates. +Because the certificate trust types issues certificates, there is more configuration and infrastructure needed to accommodate user certificate enrollment, which could also be a factor to consider in your decision. Additional infrastructure needed for certificate-trust deployments includes a certificate registration authority. In a federated environment, you need to activate the Device Writeback option in Azure AD Connect. If your organization wants to use the key trust type, write **key trust** in box **1b** on your planning worksheet. Write **Windows Server 2016** in box **4d**. Write **N/A** in box **5b**. @@ -197,7 +215,7 @@ If box **1a** on your planning worksheet reads **cloud only**, write **N/A** in If box **1a** on your planning worksheet reads **hybrid**, then write **Azure AD Connect** in box **1e** on your planning worksheet. -If box **1a** on your planning worksheet reads **on-premises**, then write **Azure MFA Server**. This deployment exclusively uses Active Directory for user information with the exception of the multi-factor authentication. The on-premises Azure MFA server synchronizes a subset of the user information, such as phone number, to provide multi-factor authentication while the user’s credential remain on the on-premises network. +If box **1a** on your planning worksheet reads **on-premises**, then write **Azure MFA Server**. This deployment exclusively uses Active Directory for user information with the exception of the multi-factor authentication. The on-premises Azure MFA server synchronizes a subset of the user information, such as phone number, to provide multi-factor authentication while the user’s credentials remain on the on-premises network. ### Multifactor Authentication @@ -212,7 +230,7 @@ If box **1a** on your planning worksheet reads **hybrid**, then you have a few o * Use AD FS w/3rd Party MFA Adapter You can directly use the Azure MFA cloud service for the second factor of authentication. Users contacting the service must authenticate to Azure prior to using the service. - + If your Azure AD Connect is configured to synchronize identities (usernames only), then your users are redirected to your local on-premises federation server for authentication and then redirected back to the Azure MFA cloud service. Otherwise, your Azure AD Connect is configured to synchronize credentials (username and passwords), which enables your users to authenticate to Azure Active Directory and use the Azure MFA cloud service. If you choose to use the Azure MFA cloud service directly, write **Azure MFA** in box **1f** on your planning worksheet. You can configure your on-premises Windows Server 2016 AD FS role to use the Azure MFA service adapter. In this configuration, users are redirected to the on premises AD FS server (synchronizing identities only). The AD FS server uses the MFA adapter to communicate to the Azure MFA service to perform the second factor of authentication. If you choose to use AD FS with the Azure MFA cloud service adapter, write **AD FS with Azure MFA cloud adapter** in box **1f** on your planning worksheet. @@ -231,7 +249,7 @@ Windows Hello for Business provides organizations with many policy settings and If box **1a** on your planning worksheet reads **cloud only**, write **N/A** in box **2a** on your planning worksheet. You have the option to manage non-domain joined devices. If you choose to manage Azure Active Directory joined devices, write **modern management** in box **2b** on your planning worksheet. Otherwise, write** N/A** in box **2b**. ->[!NOTE] +> [!NOTE] > Azure Active Directory joined devices without modern management automatically enroll in Windows Hello for Business using the default policy settings. Use modern management to adjust policy settings to match the business needs of your organization. If box **1a** on your planning worksheet reads **on-prem**, write **GP** in box **2a** on your planning worksheet. Write **N/A** in box **2b** on your worksheet. @@ -247,14 +265,14 @@ If you use modern management for both domain and non-domain joined devices, writ Windows Hello for Business is a feature exclusive to Windows 10. Some deployments and features are available using earlier versions of Windows 10. Others need the latest versions. If box **1a** on your planning worksheet reads **cloud only**, write **N/A** in box **3a** on your planning worksheet. Optionally, you may write **1511 or later** in box **3b** on your planning worksheet if you plan to manage non-domain joined devices. ->[!NOTE] ->Azure Active Directory joined devices without modern management automatically enroll in Windows Hello for Business using the default policy settings. Use modern management to adjust policy settings to match the business needs of your organization. +> [!NOTE] +> Azure Active Directory joined devices without modern management automatically enroll in Windows Hello for Business using the default policy settings. Use modern management to adjust policy settings to match the business needs of your organization. Write **1511 or later** in box **3a** on your planning worksheet if any of the following are true. * Box **2a** on your planning worksheet read **modern management**. * Optionally, you may write **1511 or later** in box **3b** on your planning worksheet if you plan to manage non-domain joined devices. * Box **1a** on your planning worksheet reads **hybrid**, box **1b** reads **key trust**, and box **2a** reads **GP**. - *Optionally, you may write **1511 or later** in box **3b** on your planning worksheet if you plan to manage non-domain joined devices. + Optionally, you may write **1511 or later* in box **3b** on your planning worksheet if you plan to manage non-domain joined devices. Write **1703 or later** in box **3a** on your planning worksheet if any of the following are true. * Box **1a** on your planning worksheet reads **on-premises**. @@ -274,7 +292,7 @@ Public key infrastructure prerequisites already exist in your planning worksheet If box **1a** on your planning worksheet reads **cloud only**, ignore the public key infrastructure section of your planning worksheet. Cloud only deployments do not use a public key infrastructure. -If box **1b** on your planning worksheet reads **key trust**, write **N/A** in box **5b** on your planning worksheet. +If box **1b** on your planning worksheet reads **key trust**, write **N/A** in box **5b** on your planning worksheet. Key trust doesn't require any change in public key infrastructure, skip this part and go to **Cloud** section. The registration authority only relates to certificate trust deployments and the management used for domain and non-domain joined devices. Hybrid Azure AD joined devices managed by Group Policy need the Windows Server 2016 AD FS role to issue certificates. Hybrid Azure AD joined devices and Azure AD joined devices managed by Intune or a compatible MDM need the Windows Server NDES server role to issue certificates. diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md index 9f76cf67c8..3ff85f511f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md +++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md @@ -2,14 +2,15 @@ title: Prepare people to use Windows Hello (Windows 10) description: When you set a policy to require Windows Hello for Business in the workplace, you will want to prepare people in your organization. ms.assetid: 5270B416-CE31-4DD9-862D-6C22A2AE508B +ms.reviewer: keywords: identity, PIN, biometric, Hello ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/hello-for-business/hello-videos.md b/windows/security/identity-protection/hello-for-business/hello-videos.md index cea13ff9d2..d9ecb9798b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-videos.md +++ b/windows/security/identity-protection/hello-for-business/hello-videos.md @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/19/2018 +ms.reviewer: --- # Windows Hello for Business Videos @@ -47,4 +48,4 @@ If the user can sign-in with a password, they can reset their PIN by clicking th > [!VIDEO https://www.youtube.com/embed/KcVTq8lTlkI] -For on-premises deployments, devices must be well connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. \ No newline at end of file +For on-premises deployments, devices must be well connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. diff --git a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md index 388993c2d8..375f2be134 100644 --- a/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md +++ b/windows/security/identity-protection/hello-for-business/hello-why-pin-is-better-than-password.md @@ -2,14 +2,15 @@ title: Why a PIN is better than a password (Windows 10) description: Windows Hello in Windows 10 enables users to sign in to their device using a PIN. How is a PIN different from (and better than) a password . ms.assetid: A6FC0520-01E6-4E90-B53D-6C4C4E780212 +ms.reviewer: keywords: pin, security, password, hello ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -43,7 +44,7 @@ When the PIN is created, it establishes a trusted relationship with the identity The Hello PIN is backed by a Trusted Platform Module (TPM) chip, which is a secure crypto-processor that is designed to carry out cryptographic operations. The chip includes multiple physical security mechanisms to make it tamper resistant, and malicious software is unable to tamper with the security functions of the TPM. All Windows 10 Mobile phones and many modern laptops have TPM. -User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Hello uses asymmetrical key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. +User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Because Hello uses asymmetric key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. After too many incorrect guesses, the device is locked. diff --git a/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png b/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png index bc2fdb105b..44bbc4a572 100644 Binary files a/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png and b/windows/security/identity-protection/hello-for-business/images/howitworks/devreg-aadj-managed.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-applications.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-applications.png new file mode 100644 index 0000000000..3001e771d8 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-applications.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-client-prompt.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-client-prompt.png new file mode 100644 index 0000000000..9e5e339b30 Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-client-prompt.png differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-application.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-application.png deleted file mode 100644 index bacdb127ea..0000000000 Binary files a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-application.png and /dev/null differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-home-screen.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-home-screen.png deleted file mode 100644 index ae7328c4a4..0000000000 Binary files a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-home-screen.png and /dev/null differ diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-prompt.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-prompt.png new file mode 100644 index 0000000000..e4a92204ee Binary files /dev/null and b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-service-prompt.png differ diff --git a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md index 376a238c8e..d924d3f98c 100644 --- a/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md +++ b/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key.md @@ -1,26 +1,27 @@ --- title: Microsoft-compatible security key -description: Windows 10 enables users to sign in to their device using a security key. How is a Microsoft-compatible security key different (and better) than any other FIDO2 security key +description: Learn how a Microsoft-compatible security key for Windows 10 is different (and better) than any other FIDO2 security key. keywords: FIDO2, security key, CTAP, Hello, WHFB ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: aabhathipsay -ms.author: aathipsa +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 11/14/2018 +ms.reviewer: --- # What is a Microsoft-compatible security key? > [!Warning] > Some information relates to pre-released product that may change before it is commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -Microsoft has been aligned with the [FIDO Alliance](https://fidoalliance.org/) with a mission to replace passwords with an easy to use, strong 2FA credential. We have been working with our partners to extensively test and deliver a seamless and secure authentication experience to end users. +Microsoft has been aligned with the [FIDO Alliance](https://fidoalliance.org/) with a mission to replace passwords with an easy to use, strong 2FA credential. We have been working with our partners to extensively test and deliver a seamless and secure authentication experience to end users. See [FIDO2 security keys features and providers](https://docs.microsoft.com/azure/active-directory/authentication/concept-authentication-passwordless#fido2-security-keys). The [FIDO2 CTAP specification](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html) contains a few optional features and extensions which are crucial to provide that seamless and secure experience. diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 5f1296e64e..57238c3214 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -1,5 +1,5 @@ --- -title: Password-less Strategy +title: Passwordless Strategy description: Reducing Password Usage Surface keywords: identity, PIN, biometric, Hello, passport, video, watch, passwordless ms.prod: w10 @@ -7,201 +7,202 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: mikestephens-MS -ms.author: mstephen +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 08/20/2018 +ms.reviewer: --- -# Password-less Strategy +# Passwordless Strategy -## Four steps to Password-less +## Four steps to password freedom -Over the past few years, Microsoft has continued their commitment to enabling a world without passwords. At Microsoft Ignite 2017, we shared our four-step approach to password-less. -![Password-less approach](images/four-steps-passwordless.png) +Over the past few years, Microsoft has continued their commitment to enabling a world without passwords. At Microsoft Ignite 2017, we shared our four-step approach to password freedom. +![Passwordless approach](images/four-steps-passwordless.png) ### 1. Develop a password replacement offering -Before you move away from passwords, you need something to replace them. With Windows 10, Microsoft introduced Windows Hello for Business, a strong, hardware protected two-factor credential that enables single-sign on to Azure Active Directory and Active Directory. +Before you move away from passwords, you need something to replace them. With Windows 10, Microsoft introduced Windows Hello for Business, a strong, hardware protected two-factor credential that enables single sign-on to Azure Active Directory and Active Directory. -Deploying Windows Hello for Business is the first step towards password-less. With Windows Hello for Business deployed, it coexists with password nicely. Users are likely to use Windows Hello for Business because of its convenience, especially when combined with biometrics. However, some workflows and applications may still need passwords. This early stage is about implementing an alternative and getting users used to it. +Deploying Windows Hello for Business is the first step towards a passwordless environment. Windows Hello for Business coexists nicely with existing password-based security. Users are likely to use Windows Hello for Business because of its convenience, especially when combined with biometrics. However, some workflows and applications may still need passwords. This early stage is about implementing an alternative and getting users used to it. ### 2. Reduce user-visible password surface area -With Windows Hello for Business and passwords coexisting in your environment, the next step towards password-less is to reduce the password surface. The environment and workflows need to stop asking for passwords. The goal of this step is to achieve a state where the user knows they have a password, but they never use it. This state helps decondition users from providing a password any time a password prompt shows on their computer. This is how passwords are phished. Users who rarely, if at all, use their password are unlikely to provide it. Password prompts are no longer the norm. +With Windows Hello for Business and passwords coexisting in your environment, the next step is to reduce the password surface. The environment and workflows need to stop asking for passwords. The goal of this step is to achieve a state where the users know they have a password, but they never use it. This state helps decondition users from providing a password any time a password prompt shows on their computer. This is how passwords are phished. Users who rarely, if at all, use their password are unlikely to provide it. Password prompts are no longer the norm. -### 3. Transition into a password-less deployment -Once the user-visible password surface has been eliminated, your organization can begin to transition those users into a password-less world. A world where: - - the user never types their password - - the user never changes their password - - the user does not know their password +### 3. Transition into a passwordless deployment +Once the user-visible password surface has been eliminated, your organization can begin to transition those users into a passwordless world. A world where: +- the users never type their password +- the users never change their password +- the users do not know their password -In this world, the user signs in to Windows 10 using Windows Hello for Business and enjoys single sign-on to Azure and Active Directory resources. If the user is forced to authenticate, their authentication uses Windows Hello for Business. +In this world, the user signs in to Windows 10 using Windows Hello for Business and enjoys single sign-on to Azure and Active Directory resources. If the user is forced to authenticate, their authentication uses Windows Hello for Business. ### 4. Eliminate passwords from the identity directory -The final step of the password-less story is where passwords simply do not exist. At this step, identity directories no longer persist any form of the password. This is where Microsoft achieves the long-term security promise of a truly password-less environment. +The final step of the passwordless story is where passwords simply do not exist. At this step, identity directories no longer persist any form of the password. This is where Microsoft achieves the long-term security promise of a truly passwordless environment. ## Methodology -The four steps to password-less provides a overall view of how Microsoft envisions the road to password-less. But the road to password-less is frequently traveled and derailed by many. The scope of work is vast and filled with many challenges and frustrations. Nearly everyone wants the instant gratification of password-less, but can easily become overwhelmed in any of the steps. You are not alone and Microsoft understands. While there are many ways to accomplish password-less, here is one recommendation based on several years of research, investigation, and customer conversations. +Four steps to password freedom provides an overall view of how Microsoft envisions the road to eliminating passwords. But this road is frequently traveled and derailed by many. The scope of work is vast and filled with many challenges and frustrations. Nearly everyone wants the instant gratification of achieving a passwordless environment, but can easily become overwhelmed by any of the steps. You are not alone and Microsoft understands. While there are many ways to accomplish freedom from passwords, here is one recommendation based on several years of research, investigation, and customer conversations. -### Prepare for the Journey -The road to password-less is a journey. The duration of that journey varies from each organization. It is important for IT decision makers to understand the criteria that influences the length of the journey. +### Prepare for the Journey +The road to being passwordless is a journey. The duration of that journey varies for each organization. It is important for IT decision-makers to understand the criteria influencing the length of that journey. -The most intuitive answer is the size of the organization, and that would be correct. However, what exactly determines size. One way to break down the size of the organization is: +The most intuitive answer is the size of the organization, and that would be correct. However, what exactly determines size? One way to break down the size of the organization is by creating a summary of the: - Number of departments -- Organization or department hierarchy +- Organization or department hierarchy - Number and type of applications and services - Number of work personas - Organization's IT structure -#### Number of departments -The number of departments within an organization varies. Most organizations have a common set of departments such as executive leadership, human resources, accounting, sales, and marketing. Other organizations will have those departments and additional ones such research and development or support. Small organizations may not segment their departments this explicitly while larger ones may. Additionally, there may be sub-departments, and sub-departments of those sub-departments as well. +#### Number of departments +The number of departments within an organization varies. Most organizations have a common set of departments such as executive leadership, human resources, accounting, sales, and marketing. Other organizations will have those departments and additional ones such research and development or support. Small organizations may not segment their departments this explicitly, while larger ones may. Additionally, there may be sub-departments, and sub-departments of those sub-departments as well. -You need to know all the departments within your organization and you need to know which departments use computers and which do not. It is fine if a department does not use computer (probably rare, but acceptable). This is one less department with which you need to concern yourself. Nevertheless, ensure this department is in your list and you have assessed it is not applicable for password-less. +You need to know all the departments within your organization and you need to know which departments use computers and which ones do not. It is fine if a department does not use computers (probably rare, but acceptable). This is one less department with which you need to concern yourself. Nevertheless, ensure this department is in your list and you have assessed that it is not applicable. -Your count of the departments must be thorough and accurate, as well as knowing the stakeholders for those departments that will you and your staff on the road to password-less. Realistically, many of us lose sight of our organization chart and how it grows or shrinks over time. This is why you need to inventory all of them. Also, do not forget to include external departments such as vendors or federated partners. If your organizations goes password-less, but partners continue to use passwords and then access your corporate resources, you should know about it and include them in your password-less strategy. +Your count of the departments must be thorough and accurate, as well as knowing the stakeholders for those departments that will put you and your staff on the road to password freedom. Realistically, many of us lose sight of our organizational chart and how it grows or shrinks over time. This is why you need to inventory all of them. Also, do not forget to include external departments such as vendors or federated partners. If your organization goes password-free, but your partners continue to use passwords and then access your corporate resources, you should know about it and include them in your passwordless strategy. #### Organization or department hierarchy -Organization and department hierarchy is the management layers within the departments or the organization as a whole. How the device is used, what applications and how they are used most likely differ between each department, but also within the structure of the department. To determine the correct password-less strategy, you need to know these differences across your organization. An executive leader is likely to use their device differently than a member of middle management in the sales department. Both of those use cases are likely different than how an individual contributor in the customer service department uses their device. +Organization and department hierarchy is the management layers within the departments or the organization as a whole. How the device is used, what applications and how they are used, most likely differs between each department, but also within the structure of the department. To determine the correct passwordless strategy, you need to know these differences across your organization. An executive leader is likely to use their device differently compared to a member of middle management in the sales department. Both of those user cases are probably different to how an individual contributor in the customer service department uses their device. #### Number and type of applications and services -The number of applications within an organization is simply astonishing and rarely is there one centralized list that is accurate. Applications and services are the most critical item in your password-less assessment. Applications and services take considerable effort to move to a different type of authentication. That is not to say changing policies and procedures is not a daunting task, but there is something to be said of updating a company's set of standard operating procedure and security policies compared to changing 100 lines (or more) of authentication code in the critical path of your internally developed CRM application. +The number of applications within an organization is simply astonishing and rarely is there one centralized list that is accurate. Applications and services are the most critical items in your passwordless assessment. Applications and services take considerable effort to move to a different type of authentication. That is not to say changing policies and procedures is not a daunting task, but there is something to be said of updating a company's set of standard operating procedures and security policies compared to changing 100 lines (or more) of authentication code in the critical path of your internally developed CRM application. -Capturing the number of applications used is easier once you have the departments, their hierarchy, and their stakeholders. In this approach, you should have an organized list of departments and the hierarchy in each. You can now associate the applications that are used by all levels within each department. You'll also want to document whether the application is internally developed or commercially available off-the-shelf (COTS). If the later, document the manufacture and the version. Also, do not forget web-based applications or services when inventorying applications. +Capturing the number of applications used is easier once you have the departments, their hierarchy, and their stakeholders. In this approach, you should have an organized list of departments and the hierarchy in each. You can now associate the applications that are used by all levels within each department. You'll also want to document whether the application is internally developed or commercially available off-the-shelf (COTS). If the latter, document the manufacturer and the version. Also, do not forget web-based applications or services when inventorying applications. #### Number of work personas -Work personas is where the three previous efforts converge. You know the departments, the organizational levels within each department, the numbers of applications used by each, respectively, and the type of application. From this you want to create a work persona. +Work personas is where the three previous efforts converge. You know the departments, the organizational levels within each department, the numbers of applications used by each, respectively, and the type of application. From this you want to create a work persona. -A work persona classifies a category of user, title or role (individual contributor, manager, middle manager, etc), within a specific department to a collection of applications used. There is a high possibility and probability that you will have many work personas. These work personas will become units of work an you will refer to them in documentation and in meetings. You need to give them a name. +A work persona classifies a category of user, title or role (individual contributor, manager, middle manager, etc.), within a specific department to a collection of applications used. There is a high probability that you will have many work personas. These work personas will become units of work, and you will refer to them in documentation and in meetings. You need to give them a name. -Give your personas easy and intuitive name like Abby Accounting, Mark Marketing, or Sue Sales. If the organization levels are common across departments then decide on a first name that represents the common levels in a department. For example, Abby could be the first name of an individual contributor in any given department, while the first name Sue could represent someone from middle management in any given department. Additionally, you can use suffixes such as (I, II, Senior, etc.) to further define departmental structure for a given persona. +Give your personas easy and intuitive names like Abby Accounting, Mark Marketing, or Sue Sales. If the organization levels are common across departments, then decide on a first name that represents the common levels in a department. For example, Abby could be the first name of an individual contributor in any given department, while the first name Sue could represent someone from middle management in any given department. Additionally, you can use suffixes such as (I, II, Senior, etc.) to further define departmental structure for a given persona. -Ultimately, create a naming convention that does not require your stakeholders and partners to read through a long list of tables or that needs a secret decoder ring. Also, if possible, try to keep the references as names of people. After all, you are talking about a person, who is in that department, who uses that specific software. +Ultimately, create a naming convention that does not require your stakeholders and partners to read through a long list of tables or a secret decoder ring. Also, if possible, try to keep the references as names of people. After all, you are talking about a person who is in that department and who uses that specific software. #### Organization's IT structure -IT department structures can vary more than the organization. Some IT departments are centralized while others are decentralized. Also, the road to password-less will likely have you interacting with the client authentication team, the deployment team, the security team, the PKI team, the Active Directory team, the cloud team, and the list continues. Most of these teams will be your partner on your journey to password-less. Ensure there is a password-less stakeholder on each of these teams and that the effort is understood and funded. +IT department structures can vary more than the organization. Some IT departments are centralized while others are decentralized. Also, the road to password freedom will probably have you interacting with the client authentication team, the deployment team, the security team, the PKI team, the Active Directory team, the cloud team, and the list continues. Most of these teams will be your partner on your journey to password freedom. Ensure there is a passwordless stakeholder on each of these teams, and that the effort is understood and funded. #### Assess your Organization -You have a ton of information. You have created your work personas, you identified your stakeholders throughout the different IT groups. Now what? +You have a ton of information. You have created your work personas, you have identified your stakeholders throughout the different IT groups. Now what? -By now you can see why its a journey and not a weekend project. You need to investigate user-visible password surfaces for each of your work personas. Once you identified the password surfaces, you need to mitigate them. Resolving some password surfaces are simple-- meaning a solution already exists in the environment and its a matter of moving users to it. Resolution to some passwords surfaces may exist, but are not deployed in your environment. That resolution results in a project that must be planned, tested, and then deployed. That is likely to span multiple IT departments with multiple people, and potentially one or more distributed systems. Those types of projects take time and need dedicated cycles. This same sentiment is true with in-house software development. Even with agile development methodologies, changing the way someone authenticates to an application is critical. Without the proper planning and testing, it has the potential to severely impact productivity. +By now you can see why it is a journey and not a weekend project. You need to investigate user-visible password surfaces for each of your work personas. Once you have identified the password surfaces, you need to mitigate them. Resolving some password surfaces are simple - meaning a solution already exists in the environment and it is only a matter of moving users to it. Resolution to some passwords surfaces may exist, but are not deployed in your environment. That resolution results in a project which must be planned, tested, and then deployed. That is likely to span multiple IT departments with multiple people, and potentially one or more distributed systems. Those types of projects take time and need dedicated cycles. This same sentiment is true with in-house software development. Even with agile development methodologies, changing the way someone authenticates to an application is critical. Without the proper planning and testing, it has the potential to severely impact productivity. -How long does it take to reach password-less? The answer is "it depends". It depends on the organizational alignment of a password-less strategy. Top-down agreement that password-less is the organization's goal makes conversations much easier. Easier conversations means less time spent convincing people and more time spent moving forward toward the goal. Top-down agreement on password-less as a priority within the ranks of other on-going IT projects helps everyone understand how to prioritize existing projects. Agreeing on priorities should reduce and minimize manager and executive level escalations. After these organizational discussions, modern project management techniques are used to continue the password-less effort. The organization allocates resources based on the priority (after they agreed on the strategy). Those resources will: +How long does it take to become passwordless? The answer is "it depends". It depends on the organizational alignment of a passwordless strategy. Top-down agreement that a passwordless environment is the organization's goal makes conversations much easier. Easier conversations means less time spent convincing people and more time spent moving forward toward the goal. Top-down agreement, as a priority within the ranks of other on-going IT projects, helps everyone understand how to prioritize existing projects. Agreeing on priorities should reduce and minimize manager and executive level escalations. After these organizational discussions, modern project management techniques are used to continue the passwordless effort. The organization allocates resources based on the priority (after they have agreed on the strategy). Those resources will: - work through the work personas - organize and deploy user acceptance testing - evaluate user acceptance testing results for user-visible password surfaces - work with stakeholders to create solutions that mitigate user-visible password surfaces - add the solution to the project backlog and prioritize against other projects -- deploy solution -- User acceptance testing to confirm the solution mitigates the user-visible password surface -- Repeat as needed +- deploy the solution +- perform user acceptance testing to confirm that the solution mitigates the user-visible password surface +- repeat the testing as needed -Your organization's journey to password-less may take some time to get there. Counting the number of work personas and the number of applications is probably a good indicator of the investment. Hopefully, your organization is growing, which means that the list of personas and the list of applications is unlikely to shrink. If the work to go password-less today is *n*, then it is likely that to go password-less tomorrow is *n x 2* or perhaps more, *n x n*. Do not let the size or duration of the project be a distraction. As you progress through each work persona, the actions and tasks will become more familiar for you and your stakeholders. Scope the project to sizable, realistic phases, pick the correct work personas, and soon you will see parts of your organization transition to password-less. +Your organization's journey to password freedom may take some time. Counting the number of work personas and the number of applications is probably a good indicator of the investment. Hopefully, your organization is growing, which means that the list of personas and the list of applications is unlikely to shrink. If the work to go passwordless today is *n*, then it is likely that to go passwordless tomorrow is *n x 2* or perhaps more, *n x n*. Do not let the size or duration of the project be a distraction. As you progress through each work persona, the actions and tasks will become more familiar for you and your stakeholders. Scope the project to sizable, realistic phases, pick the correct work personas, and soon you will see parts of your organization transition to a passwordless state. ### Where to start? -What is the best guidance for kicking off the journey to password-less? You will want to show you management a proof of concept as soon as possible. Ideally, you want to show this at each step of your password-less journey. Keeping password-less top of mind and showing consistent progress keeps everyone focused. +What is the best guidance for kicking off the journey to password freedom? You will want to show your management a proof of concept as soon as possible. Ideally, you want to show this at each step of your passwordless journey. Keeping your passwordless strategy top of mind and showing consistent progress keeps everyone focused. -#### Work persona -You begin with your work personas. These were part of your preparation process. They have a persona name, such as Abby Accounting II, or any other naming convention your organization defined. That work persona includes a list of all the applications that Abby uses to perform her assigned duties in the accounting department. To start, you need to pick a work persona. This is the targeted work persona you will enable to climb the password-less steps. +#### Work persona +You begin with your work personas. These were part of your preparation process. They have a persona name, such as Abby Accounting II, or any other naming convention your organization defined. That work persona includes a list of all the applications Abby uses to perform her assigned duties in the accounting department. To start, you need to pick a work persona. This is the targeted work persona you will enable to climb the steps to password freedom. > [!IMPORTANT] -> Avoid using any work personas from your IT department. This is probably the worst way to start the password-less journey. IT roles are very difficult and time consuming. IT workers typically have multiple credentials, run a multitude of scripts and custom applications, and are the worst offenders of password usage. It is better to save these work personas for the middle or end of your journey. +> Avoid using any work personas from your IT department. This is probably the worst way to start the passwordless journey. IT roles are very difficult and time consuming. IT workers typically have multiple credentials, run a multitude of scripts and custom applications, and are the worst offenders of password usage. It is better to save these work personas for the middle or end of your journey. -Review your collection of work personas. Early in your password-less journey, identify personas that have the fewest applications. These work personas could represent an entire department or two. These are the perfect work personas for your proof-of-concept or pilot. +Review your collection of work personas. Early in your passwordless journey, identify personas with the fewest applications. These work personas could represent an entire department or two. These are the perfect work personas for your proof-of-concept or pilot. -Most organizations host their proof of concept in a test lab or environment. To do that with password-less may be more challenging and take more time. To test in a lab, you must first duplicate the environment of the targeted persona. This could be a few days or several weeks depending on the complexity of targeted work persona. +Most organizations host their proof of concept in a test lab or environment. To do that with a password-free strategy may be more challenging and take more time. To test in a lab, you must first duplicate the environment of the targeted persona. This could take a few days or several weeks, depending on the complexity of the targeted work persona. -You will want to balance testing in a lab with providing results to management quickly. Continuing to show forward progress on your password-less journey is always good thing. If there are ways you can test in production with low or now risk, that may be advantageous to your time line. +You will want to balance lab testing with providing results to management quickly. Continuing to show forward progress on your journey to password freedom is always a good thing. If there are ways you can test in production with low or no risk, it may be advantageous to your timeline. ## The Process -The journey to password-less is to take each work persona through each password-less step. In the begging, we encourage working with one persona at a time to ensure team members and stakeholders are familiar with the process. Once comfortable with the process, you can cover as many work personas in parallel as resources allow. The process looks something like +The journey to password freedom is to take each work persona through each step of the process. In the beginning, we encourage working with one persona at a time to ensure team members and stakeholders are familiar with the process. Once comfortable with the process, you can cover as many work personas in parallel as resources allow. The process looks something like this: -1. Password-less replacement offering (Step 1) - 1. Identify test users that represent the targeted work persona. +1. Passwordless replacement offering (Step 1) + 1. Identify test users representing the targeted work persona. 2. Deploy Windows Hello for Business to test users. - 3. Validate password and Windows Hello for Business work. + 3. Validate that passwords and Windows Hello for Business work. 2. Reduce User-visible Password Surface (Step 2) 1. Survey test user workflow for password usage. 2. Identify password usage and plan, develop, and deploy password mitigations. 3. Repeat until all user password usage is mitigated. - 4. Remove password capabilities from the Windows. - 5. Validate **all** workflows do not need passwords. -3. Transition into a password-less (Step 3) - 1. Awareness campaign and user education. - 2. Including remaining users that fit the work persona. - 3. Validate **all** users of the work personas do not need passwords. - 4. Configure user accounts to disallow password authentication. + 4. Remove password capabilities from Windows. + 5. Validate that **none of the workflows** need passwords. +3. Transition into a passwordless scenario (Step 3) + 1. Awareness campaign and user education. + 2. Include remaining users who fit the work persona. + 3. Validate that **none of the users** of the work personas need passwords. + 4. Configure user accounts to disallow password authentication. -After successfully moving a work persona to password-less, you can prioritize the remaining work personas, and repeat the process. +After successfully moving a work persona to password freedom, you can prioritize the remaining work personas and repeat the process. -### Password-less replacement offering (Step 1) -THe first step to password-less is providing an alternative to passwords. Windows 10 provides an affordable and easy in-box alternative to passwords, Windows Hello for Business, a strong, two-factor authentication to Azure Active Directory and Active Directory. +### Passwordless replacement offering (Step 1) +The first step to password freedom is providing an alternative to passwords. Windows 10 provides an affordable and easy in-box alternative to passwords, Windows Hello for Business, a strong, two-factor authentication to Azure Active Directory and Active Directory. #### Identify test users that represent the targeted work persona -A successful transition to password-less heavily relies on user acceptance testing. It is impossible for you to know how every work persona goes about their day-to-day activities, or to accurately validate them. You need to enlist the help of users that fit the targeted work persona. You only need a few users from the targeted work persona. As you cycle through step 2, you may want to change a few of the users (or add a few) as part of your validation process. +A successful transition relies on user acceptance testing. It is impossible for you to know how every work persona goes about their day-to-day activities, or how to accurately validate them. You need to enlist the help of users who fit the targeted work persona. You only need a few users from the targeted work persona. As you cycle through step 2, you may want to change a few of the users (or add a few) as part of your validation process. #### Deploy Windows Hello for Business to test users -Next, you will want to plan your Windows Hello for Business deployment. Your test users will need an alternative way to sign-in during step 2 of the password-less journey. Use the [Windows Hello for Business Planning Guide](hello-planning-guide.md) to help learn which deployment is best for your environment. Next, use the [Windows Hello for Business deployment guides](hello-deployment-guide.md) to deploy Windows Hello for Business. +Next, you will want to plan your Windows Hello for Business deployment. Your test users will need an alternative way to sign-in during step 2 of the journey to becoming passwordless. Use the [Windows Hello for Business Planning Guide](hello-planning-guide.md) to help learning which deployment is best suited for your environment. Next, use the [Windows Hello for Business deployment guides](hello-deployment-guide.md) to deploy Windows Hello for Business. -With the Windows Hello for Business infrastructure in place, you can limit Windows Hello for Business enrollments to the targeted work personas. The great news is you will only need to deploy the infrastructure once. When other targeted work personas need to provision Windows Hello for Business, you can simply add them to a group. You will use the first work persona to validate your Windows Hello for Business deployment. +With the Windows Hello for Business infrastructure in place, you can limit Windows Hello for Business enrollments to the targeted work personas. The great news is that you will only need to deploy the infrastructure once. When other targeted work personas need to provision Windows Hello for Business, you can simply add them to a group. You will use the first work persona to validate your Windows Hello for Business deployment. > [!NOTE] -> There are many different ways to connect a device to Azure. Deployments may vary based on how the device is joined to Azure Active Directory. Review your planning guide and deployment guide to ensure additional infrastructure is not needed for an additional Azure joined devices. +> There are many different ways to connect a device to Azure. Deployments may vary based on how the device is joined to Azure Active Directory. Review your planning guide and deployment guide to ensure additional infrastructure is not needed for an additional Azure joined devices. -#### Validate password and Windows Hello for Business work -In this first step, passwords and Windows Hello for Business must coexist. You want to validate that while your targeted work personas can sign in and unlock using Windows Hello for Business, but they can also sign-in, unlock, and use passwords as needed. Reducing the user-visible password surface too soon can create frustration and confusion with your targeted user personas. +#### Validate that passwords and Windows Hello for Business work +In this first step, passwords and Windows Hello for Business must coexist. You want to validate that while your targeted work personas can sign in and unlock using Windows Hello for Business, but they can also sign-in, unlock, and use passwords as needed. Reducing the user-visible password surface too soon can create frustration and confusion with your targeted user personas. ### Reduce User-visible Password Surface (Step 2) Before you move to step 2, ensure you have: -- selected your targeted work persona. -- identified your test users that represented the targeted work persona. +- selected your targeted work persona. +- identified your test users who represent the targeted work persona. - deployed Windows Hello for Business to test users. - validated passwords and Windows Hello for Business both work for the test users. #### Survey test user workflow for password usage -Now is the time to learn more about the targeted work persona. You have a list of applications they use, but you do not know what, why, when, and how frequently. This information is important as your further your progress through step 2. +Now is the time to learn more about the targeted work persona. You have a list of applications they use, but you do not know what, why, when, and how frequently. This information is important as you further your progress through step 2. -Test users create the workflows associated with the targeted work persona. Their initial goal is to do one simply task. Document password usage. This list is not a comprehensive one, but it gives you an idea of the type of information you want. The general idea is to learn about all the scenarios in which that work persona encounters a password. A good approach is: +Test users create the workflows associated with the targeted work persona. Their initial goal is to do one simple task: Document password usage. This list is not a comprehensive one, but it gives you an idea of the type of information you want. The general idea is to learn about all the scenarios in which that work persona encounters a password. A good approach is to ask yourself the following set of questions: - What is the name of the application that asked for a password?. - Why do they use the application that asked for a password? (Example: is there more than one application that can do the same thing?). - What part of their workflow makes them use the application? Try to be as specific as possible (I use application x to issue credit card refunds for amounts over y.). - How frequently do you use this application in a given day? week? -- Is the password you type into the application the same as the password you use to sign-in to Windows? +- Is the password you type into the application the same as the password you use to sign-in to Windows? -Some organizations will empower their users to write this information while some may insist on having a member of the IT department shadow them. An objective viewer may notice a password prompt that the user overlooks simply because of muscle memory. As previously mentioned, this information is critical. You could miss one password prompt which could delay the transition to password-less. +Some organizations will empower their users to write this information while some may insist on having a member of the IT department shadow them. An objective viewer may notice a password prompt that the user overlooks simply because of muscle memory. As previously mentioned, this information is critical. You could miss one password prompt that could delay the transition to being passwordless. #### Identify password usage and plan, develop, and deploy password mitigations -Your test users have provided you valuable information that describes the how, what, why and when they use a password. It is now time for your team to identify each of these password use cases and understand why the user must use a password. +Your test users have provided you valuable information that describes the how, what, why and when they use a password. It is now time for your team to identify each of these password use cases and understand why the user must use a password. -Create a master list of the scenarios. Each scenario should have a clear problem statement. Name the scenario with a one-sentence summary of the problem statement. Include in the scenario the results of your team's investigation as to why the user is prompted by a password. Include relevant, but accurate details. If its policy or procedure driven, then include the name and section of the policy that dictates why the workflow uses a password. +Create a master list of the scenarios. Each scenario should have a clear problem statement. Name the scenario with a one-sentence summary of the problem statement. Include in the scenario the results of your team's investigation as to why the user is prompted by a password. Include relevant, but accurate details. If it is policy or procedure driven, then include the name and section of the policy that dictates why the workflow uses a password. -Keep in mind your test users will not uncover all scenarios. Some scenarios you will need to force on your users because they low percentage scenarios. Remember to include scenarios like: +Keep in mind your test users will not uncover all scenarios. Some scenarios you will need to force on your users because they are low percentage scenarios. Remember to include scenarios like: - Provisioning a new brand new user without a password. - Users who forget the PIN or other remediation flows when the strong credential is unusable. -Next, review your master list of scenarios. You can start with the workflows that are dictated by process or policy or, you can begin with workflows that need technical solutions-- whichever of the two is easier or quicker. This will certainly vary by organization. +Next, review your master list of scenarios. You can start with the workflows that are dictated by process or policy, or you can begin with workflows that need technical solutions - whichever of the two is easier or quicker. This will certainly vary by organization. -Start mitigating password usages based on the workflows of your targeted personas. Document the mitigation as a solution to your scenario. Don't worry about the implementation details for the solution. A overview of the changes needed to reduce the password usages is all you need. If there are technical changes needed either infrastructure or code changes-- the exact details will likely be included in the project documentation. However your organization tracks projects, create a new project in that system. Associate your scenario to that project and start the processes needed to get that project funded. +Start mitigating password usages based on the workflows of your targeted personas. Document the mitigation as a solution to your scenario. Don't worry about the implementation details for the solution. An overview of the changes needed to reduce the password usages is all you need. If there are technical changes needed, either infrastructure or code changes, the exact details will likely be included in the project documentation. However your organization tracks projects, create a new project in that system. Associate your scenario to that project and start the processes needed to get that project funded. -Mitigating password usage with applications is one or the more challenging obstacle in the journey to password-less. If your organization develops the application, then you are in better shape the common-off-the-shelf software (COTS). +Mitigating password usage with applications is one of the more challenging obstacles in the passwordless journey. If your organization develops the application, then you are in better shape the common-off-the-shelf software (COTS). -The ideal mitigation for applications that prompt the user for a password is to enable those enable those applications to use an existing authenticated identity, such as Azure Active Directory or Active Directory. Work with the applications vendors to have them add support for Azure identities. For on-premises applications, have the application use Windows integrated authentication. The goal for your users should be a seamless single sign-on experience where each user authenticates once-- when they sign-in to Windows. Use this same strategy for applications that store their own identities in their own databases. +The ideal mitigation for applications that prompt the user for a password is to enable those applications to use an existing authenticated identity, such as Azure Active Directory or Active Directory. Work with the applications vendors to have them add support for Azure identities. For on-premises applications, have the application use Windows integrated authentication. The goal for your users should be a seamless single sign-on experience where each user authenticates once when they sign-in to Windows. Use this same strategy for applications that store their own identities in their own databases. -Each scenario on your master list should now have a problem statement, an investigation as to why the password was used, and a mitigation plan on how to make the password usage go away. Armed with this data, one-by-one, close the gaps on user-visible passwords. Change policies and procedures as needed, make infrastructure changes where possible. Convert in-house applications to use federated identities or Windows integrated authentication. Work with third-party software vendors to update their software to support federated identities or Windows integrated authenticate. +Each scenario on your master list should now have a problem statement, an investigation as to why the password was used, and a mitigation plan on how to make the password usage go away. Armed with this data, one-by-one, close the gaps on user-visible passwords. Change policies and procedures as needed, make infrastructure changes where possible. Convert in-house applications to use federated identities or Windows integrated authentication. Work with third-party software vendors to update their software to support federated identities or Windows integrated authentication. #### Repeat until all user password usage is mitigated -Some or all of your mitigations are in place. You need to validate your solutions have solved their problem statements. This is where you rely on your test users. You want to keep a good portion of your first test users, but this is a good opportunity to replace a few or add a few. Survey test users workflow for password usage. If all goes well, you have closed most or all the gaps. A few are likely to remain. Evaluate your solutions and what went wrong, change your solution as needed until you reach a solution that removes your user's need to type a password. If your stuck, others might be too. Use the forums from various sources or your network of IT colleague to describe your problem and see how others are solving it. If your out of options, contact Microsoft for assistance. +Some or all of your mitigations are in place. You need to validate that your solutions have solved their problem statements. This is where you rely on your test users. You want to keep a good portion of your first test users, but this is a good opportunity to replace a few or add a few. Survey test users workflow for password usage. If all goes well, you have closed most or all of the gaps. A few are likely to remain. Evaluate your solutions and what went wrong, change your solution as needed until you reach a solution that removes your user's need to type a password. If you are stuck, others might be too. Use the forums from various sources or your network of IT colleagues to describe your problem and see how others are solving it. If you are out of options, contact Microsoft for assistance. -#### Remove password capabilities from the Windows -You believe you have mitigates all the password usage for the targeted work persona. Now comes the true test-- configure Windows so the user cannot use a password. +#### Remove password capabilities from Windows +You believe you have mitigated all the password usage for the targeted work persona. Now comes the true test - configure Windows so the user cannot use a password. -Windows provides two ways to prevent your users from using passwords. You can use an interactive logon security policy to only allow Windows Hello for Business sign-in and unlocks, or you can exclude the password credential provider. +Windows provides two ways to prevent your users from using passwords. You can use an interactive logon security policy to only allow Windows Hello for Business sign-in and unlocks, or you can exclude the password credential provider. -##### Security Policy -You can use Group Policy to deploy an interactive logon security policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Windows Settings > Local Policy > Security Options**. The name of the policy setting depends on the version of the operating systems you use to configure Group Policy. +##### Security Policy +You can use Group Policy to deploy an interactive logon security policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Windows Settings > Local Policy > Security Options**. The name of the policy setting depends on the version of the operating systems you use to configure Group Policy. ![securityPolicyLocation](images/passwordless/00-securityPolicy.png) **Windows Server 2016 and earlier** @@ -212,33 +213,33 @@ The policy name for these operating systems is **Interactive logon: Require smar The policy name for these operating systems is **Interactive logon: Require Windows Hello for Business or smart card**. ![securityPolicyRSAT](images/passwordless/00-updatedsecuritypolicytext.png) -When you enables this security policy setting, Windows prevents users from signing in or unlocking with a password. The password credential provider remains visible to the user. If a user tries to use a password, Windows informs the user they must use Windows Hello for Business or a smart card. +When you enable this security policy setting, Windows prevents users from signing in or unlocking with a password. The password credential provider remains visible to the user. If a user tries to use a password, Windows informs the user they must use Windows Hello for Business or a smart card. #### Excluding the password credential provider -You can use Group Policy to deploy an administrative template policy settings to the computer. This policy settings is found under **Computer Configuration > Policies > Administrative Templates > Logon** +You can use Group Policy to deploy an administrative template policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Administrative Templates > Logon** ![HideCredProvPolicy](images/passwordless/00-hidecredprov.png) -The name of the policy setting is **Exclude credential providers**. The value to enter in the policy to hide the password credential provider is **60b78e88-ead8-445c-9cfd-0b87f74ea6cd**. +The name of the policy setting is **Exclude credential providers**. The value to enter in the policy to hide the password credential provider is **60b78e88-ead8-445c-9cfd-0b87f74ea6cd**. ![HideCredProvPolicy2](images/passwordless/01-hidecredprov.png) -Excluding the password credential provider hides the password credential provider from Windows and any application that attempts to load it. This prevents the user from entering a password using the credential provider. However, this does not prevent applications from creating their own password collection dialogs and prompting the user for a password using custom dialogs. +Excluding the password credential provider hides the password credential provider from Windows and any application that attempts to load it. This prevents the user from entering a password using the credential provider. However, this does not prevent applications from creating their own password collection dialogs and prompting the user for a password using custom dialogs. -#### Validate all workflows do not need passwords -This is the big moment. You have identified password usage, developed solutions to mitigate password usage, and have removed or disabled password usage from Windows. In this configuration, your users will not be able to use a passwords. Users will be blocked is any of their workflows ask them for a password. Ideally, your test users should be able to complete all the work flows of the targeted work persona without any password usage. Do not forget those low percentage work flows, such as provisioning a new user or a user that forgot their PIN or cannot use their strong credential. Ensure those scenarios are validated as well. +#### Validate that none of the workflows needs passwords +This is the big moment. You have identified password usage, developed solutions to mitigate password usage, and have removed or disabled password usage from Windows. In this configuration, your users will not be able to use a password. Users will be blocked if any of their workflows ask them for a password. Ideally, your test users should be able to complete all the work flows of the targeted work persona without any password usage. Do not forget those low percentage work flows, such as provisioning a new user or a user that forgot their PIN or cannot use their strong credential. Ensure those scenarios are validated as well. -### Transition into a password-less deployment (Step 3) -Congratulations! You are ready to transition one or more portions of your organization to a password-less deployment. You have validated the targeted work-persona is ready to go where the user no longer needs to know or use their password. You are just few steps away from declaring success. +### Transition into a passwordless deployment (Step 3) +Congratulations! You are ready to transition one or more portions of your organization to a passwordless deployment. You have validated that the targeted work persona is ready to go where the user no longer needs to know or use their password. You are just a few steps away from declaring success. #### Awareness and user education -In this last step, you are going to include the remaining users that fit the targeted work persona to the wonderful world of password-less. Before you do this, you want to invest in an awareness campaign. +In this last step, you are going to include the remaining users that fit the targeted work persona to the wonderful world of password freedom. Before you do this, you want to invest in an awareness campaign. -An awareness campaign is introduces the users to the new way of authenticating to their device, such as using Windows Hello for Business. The idea of the campaign is to positively promote the change to the users in advance. Explain the value and why your company is changing. The campaign should provide dates and encourage questions and feedback. This campaign can coincide user education, where you can show the users the changes and, if your environment allows, enable the users to try the experience out. +An awareness campaign introduces the users to the new way of authenticating to their device, such as using Windows Hello for Business. The idea of the campaign is to positively promote the change to the users in advance. Explain the value and why your company is changing. The campaign should provide dates and encourage questions and feedback. This campaign can coincide with user education, where you can show the users the changes and, if your environment allows, enable the users to try out the experience. #### Including remaining users that fit the work persona -You have implemented the awareness campaign for the targeted users. These users are informed and ready to transition to password-less. Add the remaining users that match the targeted work persona to your deployment. +You have implemented the awareness campaign for the targeted users. These users are informed and ready to transition to being passwordless. Add the remaining users that match the targeted work persona to your deployment. -#### Validate **all** users of the work personas do not need passwords. -You have successfully transitioned all users for the targeted work persona to password-less. Monitor the users within the work persona to ensure they do not encounter any issues while working in a password-less environment. +#### Validate that none of the users of the work personas needs passwords +You have successfully transitioned all users for the targeted work persona to being passwordless. Monitor the users within the work persona to ensure they do not encounter any issues while working in a passwordless environment. Track all reported issues. Set priority and severity to each reported issue and have your team triage the issues appropriately. As you triage issues, some things to consider are: - Is the reporting user performing a task outside the work persona? @@ -246,24 +247,24 @@ Track all reported issues. Set priority and severity to each reported issue and - Is the outage a result of a misconfiguration? - Is the outage a overlooked gap from step 2? -Each organization's priority and severity will differ however most organizations consider work stoppages fairly significant. Your team should pre-define levels of priority and severity. With each of these levels, create service level agreements (SLAs) for each combination of severity and priority and hold everyone accountable to those agreements. Reactive planning enables people to spend more time on the issue and resolving it and less time on process. +Each organization's priority and severity will differ. However, most organizations consider work stoppages to be fairly significant. Your team should predefine levels of priority and severity. With each of these levels, create service level agreements (SLAs) for each combination of severity and priority, and hold everyone accountable to those agreements. Reactive planning enables people to spend more time on the issue and resolving it, and less time on the process. -Resolve the issues per your service level agreements. Higher severity items may require returning some or all of the user's password surface. Clearly this is not the end goal but, do not let this slow your password-less momentum. Refer to how you reduced the user's password surface in step 2 and progress forward to a solution, deploying that solution and validating. +Resolve the issues per your service level agreements. Higher severity items may require returning some or all of the user's password surface. Clearly this is not the end goal, but do not let this slow down your momentum towards becoming passwordless. Refer to how you reduced the user's password surface in step 2 and progress forward to a solution, deploying that solution and validating it. #### Configure user accounts to disallow password authentication. -You transitioned all the users for the targeted work persona to a password-less environment and you have successfully validated all their workflows. The last step to complete the password-less transition is to remove the user's knowledge of the password and prevent the authenticating authority from accepting passwords. +You transitioned all the users for the targeted work persona to a passwordless environment and you have successfully validated all their workflows. The last step to complete the passwordless transition is to remove the user's knowledge of the password and prevent the authenticating authority from accepting passwords. You can change the user's password to random data and prevent domain controllers from allowing users to use passwords for interactive sign-ins using an account configuration on the user object. The account options on a user account includes an option -- **Smart card is required for interactive logon**, also known as (SCRIL). > [!NOTE] -> Do not confuse the Interactive Logon security policy for SCRIL. Security policies are enforced on the client (locally). A user account configured for SCRIL is enforced at the domain controller. +> Do not confuse the Interactive Logon security policy for SCRIL. Security policies are enforced on the client (locally). A user account configured for SCRIL is enforced at the domain controller. ![SCRIL setting on AD Users and Computers](images/passwordless/00-scril-dsa.png) **SCRIL setting for a user on Active Directory Users and Computers.** -When you configure an user account for SCRIL, Active Directory changes the affected user's password to a random 128 bits of data. Additionally, domain controllers hosting the user account do not allow the user to sign-in interactively with a password. Also, users will no longer be troubled with needing to change their password when it expires, because passwords for SCRIL users in domains with a Windows Server 2012 R2 or early domain functional level do not expire. The users is effectively password-less because: +When you configure a user account for SCRIL, Active Directory changes the affected user's password to a random 128 bits of data. Additionally, domain controllers hosting the user account do not allow the user to sign-in interactively with a password. Also, users will no longer be troubled with needing to change their password when it expires, because passwords for SCRIL users in domains with a Windows Server 2012 R2 or early domain functional level do not expire. The users are effectively passwordless because: - the do not know their password. - their password is 128 random bits of data and is likely to include non-typable characters. - the user is not asked to change their password @@ -273,7 +274,7 @@ When you configure an user account for SCRIL, Active Directory changes the affec **SCRIL setting for a user in Active Directory Administrative Center on Windows Server 2012.** > [!NOTE] -> Although a SCRIL user's password never expires in early domains, you can toggle the SCRIL configuration on a user account (clear the check box, save the settings, select the check box and save the settings) to generate a new random 128 bit password. However, you should consider upgrading the domain to Windows Server 2016 domain forest functional level and allow the domain controller to do this for you automatically. +> Although a SCRIL user's password never expires in early domains, you can toggle the SCRIL configuration on a user account (clear the check box, save the settings, select the check box and save the settings) to generate a new random 128 bit password. However, you should consider upgrading the domain to Windows Server 2016 domain forest functional level and allow the domain controller to do this for you automatically. ![SCRIL setting from ADAC on Windows Server 2016](images/passwordless/01-scril-adac-2016.png) **SCRIL setting for a user in Active Directory Administrative Center on Windows Server 2016.** @@ -282,14 +283,14 @@ When you configure an user account for SCRIL, Active Directory changes the affec > Windows Hello for Business was formerly known as Microsoft Passport. ##### Automatic password change for SCRIL configured users -Domains configured for Windows Server 2016 domain functional level can further secure the unknown password for a SCRIL enabled users by configuring the domain to automatically change the password for SCRIL users. +Domains configured for Windows Server 2016 domain functional level can further secure the unknown password for SCRIL-enabled users by configuring the domain to automatically change the password for SCRIL users. -In this configuration, passwords for SCRIL configured users expired based on Active Directory password policy settings. When the SCRIL user authentication from a domain controller, the domain controller recognizes the password has expired, and automatically generates a new random 128 bit password for the user as part of the authentication. What is great about this feature is your users do not experience any change password notifications or experience any authentication outages. +In this configuration, passwords for SCRIL-configured users expire based on Active Directory password policy settings. When the SCRIL user authenticates from a domain controller, the domain controller recognizes the password has expired, and automatically generates a new random 128 bit password for the user as part of the authentication. What is great about this feature is your users do not experience any change password notifications or any authentication outages. ![Rotate Password 2016](images/passwordless/02-rotate-scril-2016.png) > [!NOTE] -> Some components within Windows 10, such as Data Protection APIs and NTLM authentication, still need artifacts of a user possessing a password. This configuration provides interoperability with while reducing the usage surface while Microsoft continues to close the gaps to remove the password completely. +> Some components within Windows 10, such as Data Protection APIs and NTLM authentication, still need artifacts of a user possessing a password. This configuration provides interoperability by reducing the usage surface while Microsoft continues to close the gaps to remove the password completely. ## The Road Ahead -The information presented here is just the beginning. We will update this guide with improved tool and methods and scenarios, like Azure AD joined and MDM managed environments, As we continue to invest in password-less, we would love to hear from you. Your feedback is important. Send us an email at [pwdless@microsoft.com](mailto:pwdless@microsoft.com?subject=Passwordless%20Feedback). +The information presented here is just the beginning. We will update this guide with improved tools, methods, and scenarios, like Azure AD joined and MDM managed environments. As we continue to invest in a passwordless future, we would love to hear from you. Your feedback is important. Send us an email at [pwdless@microsoft.com](mailto:pwdless@microsoft.com?subject=Passwordless%20Feedback). diff --git a/windows/security/identity-protection/hello-for-business/reset-security-key.md b/windows/security/identity-protection/hello-for-business/reset-security-key.md index 1ed55612fa..d2a4db9205 100644 --- a/windows/security/identity-protection/hello-for-business/reset-security-key.md +++ b/windows/security/identity-protection/hello-for-business/reset-security-key.md @@ -7,13 +7,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile audience: ITPro -author: aabhathipsay -ms.author: aathipsa +author: mapalko +ms.author: mapalko manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium ms.date: 11/14/2018 +ms.reviewer: --- # How to reset a Microsoft-compatible security key? > [!Warning] @@ -23,7 +24,7 @@ ms.date: 11/14/2018 >This operation will wipe everything from your security key and reset it to factory defaults.
                                  **All data and credentials will be cleared.** -A [Microsoft-compatible security key](https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key) can be reset via Settings app ( Settings > Accounts > Sign-in options > Security key ). +A [Microsoft-compatible security key](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/microsoft-compatible-security-key) can be reset via Settings app ( Settings > Accounts > Sign-in options > Security key ).
                                  Follow the instructions in the Settings app and look for specific instructions based on your security key manufacturer below: @@ -36,4 +37,4 @@ Follow the instructions in the Settings app and look for specific instructions b >[!NOTE] >The steps to reset your security key may vary based on the security key manufacturer.
                                  ->If your security key is not listed here, please reach out to your security key manufacturer for reset instructions. \ No newline at end of file +>If your security key is not listed here, please reach out to your security key manufacturer for reset instructions. diff --git a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md index 929535ee97..00b0bd2e95 100644 --- a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md @@ -1,14 +1,16 @@ --- title: How Windows Hello for Business works (Windows 10) -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. +description: Learn about registration, authentication, key material, and infrastructure for Windows Hello for Business. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: DaniHalfin +author: mapalko ms.localizationpriority: high -ms.author: daniha +ms.author: mapalko ms.date: 10/16/2017 +ms.reviewer: +manager: dansimp ms.topic: article --- # How Windows Hello for Business works @@ -77,14 +79,14 @@ These keys are used to sign requests that are sent to the IDP, requesting access For example, the authentication process for Azure Active Directory works like this: -1. The client sends an empty authentication request to the IDP. (This is merely for the handshake process.) -2. The IDP returns a challenge, known as a nonce. -3. The device signs the nonce with the appropriate private key. -4. The device returns the original nonce, the signed nonce, and the ID of the key used to sign the nonce. -5. The IDP fetches the public key that the key ID specified, uses it to verify the signature on the nonce, and verifies that the nonce the device returned matches the original. -6. If all the checks in step 5 succeed, the IDP returns two data items: a symmetric key, which is encrypted with the device’s public key, and a security token, which is encrypted with the symmetric key. -7. The device uses its private key to decrypt the symmetric key, and then uses that symmetric key to decrypt the token. -8. The device makes a normal authentication request for the original resource, presenting the token from the IDP as its proof of authentication. +1. The client sends an empty authentication request to the IDP. (This is merely for the handshake process.) +2. The IDP returns a challenge, known as a nonce. +3. The device signs the nonce with the appropriate private key. +4. The device returns the original nonce, the signed nonce, and the ID of the key used to sign the nonce. +5. The IDP fetches the public key that the key ID specified, uses it to verify the signature on the nonce, and verifies that the nonce the device returned matches the original. +6. If all the checks in step 5 succeed, the IDP returns two data items: a symmetric key, which is encrypted with the device’s public key, and a security token, which is encrypted with the symmetric key. +7. The device uses its private key to decrypt the symmetric key, and then uses that symmetric key to decrypt the token. +8. The device makes a normal authentication request for the original resource, presenting the token from the IDP as its proof of authentication. When the IDP validates the signature, it is verifying that the request came from the specified user and device. The private key specific to the device signs the nonce, which allows the IDP to determine the identity of the requesting user and device so that it can apply policies for content access based on user, device type, or both together. For example, an IDP could allow access to one set of resources only from mobile devices and a different set from desktop devices. diff --git a/windows/security/identity-protection/hello-for-business/toc.md b/windows/security/identity-protection/hello-for-business/toc.md index c286b36226..3fe33458fc 100644 --- a/windows/security/identity-protection/hello-for-business/toc.md +++ b/windows/security/identity-protection/hello-for-business/toc.md @@ -1,13 +1,18 @@ # [Windows Hello for Business](hello-identity-verification.md) -##[Password-less Strategy](passwordless-strategy.md) +## [Password-less Strategy](passwordless-strategy.md) ## [Windows Hello for Business Overview](hello-overview.md) ## [Why a PIN is better than a password](hello-why-pin-is-better-than-password.md) ## [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) ## [Windows Hello for Business Features](hello-features.md) +### [Conditional Access](hello-feature-conditional-access.md) +### [Dual Enrollment](hello-feature-dual-enrollment.md) +### [Dynamic Lock](hello-feature-dynamic-lock.md) ### [Multifactor Unlock](feature-multifactor-unlock.md) +### [PIN Reset](hello-feature-pin-reset.md) +### [Remote Desktop](hello-feature-remote-desktop.md) ## [How Windows Hello for Business works](hello-how-it-works.md) ### [Technical Deep Dive](hello-how-it-works.md#technical-deep-dive) @@ -53,7 +58,6 @@ #### [Validate and Configure Public Key Infrastructure](hello-cert-trust-validate-pki.md) #### [Prepare and Deploy Windows Server 2016 Active Directory Federation Services](hello-cert-trust-adfs.md) #### [Validate and Deploy Multifactor Authentication Services (MFA)](hello-cert-trust-validate-deploy-mfa.md) -##### [Configure or Deploy Multifactor Authentication Services](hello-cert-trust-deploy-mfa.md) #### [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) ## [Windows Hello and password changes](hello-and-password-changes.md) @@ -63,4 +67,4 @@ ### [Windows Hello for Business Videos](hello-videos.md) ## [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) -## [Event ID 300 - Windows Hello successfully created](hello-event-300.md) \ No newline at end of file +## [Event ID 300 - Windows Hello successfully created](hello-event-300.md) diff --git a/windows/security/identity-protection/images/remote-credential-guard-gp.png b/windows/security/identity-protection/images/remote-credential-guard-gp.png index a65253b04e..f7db3ee411 100644 Binary files a/windows/security/identity-protection/images/remote-credential-guard-gp.png and b/windows/security/identity-protection/images/remote-credential-guard-gp.png differ diff --git a/windows/security/identity-protection/index.md b/windows/security/identity-protection/index.md index b6001998ed..98e0bb9835 100644 --- a/windows/security/identity-protection/index.md +++ b/windows/security/identity-protection/index.md @@ -17,10 +17,11 @@ ms.date: 02/05/2018 # Identity and access management -Learn more about identity annd access management technologies in Windows 10 and Windows 10 Mobile. +Learn more about identity and access management technologies in Windows 10 and Windows 10 Mobile. | Section | Description | |-|-| +| [Technical support policy for lost or forgotten passwords](password-support-policy.md)| Outlines the ways in which Microsoft can help you reset a lost or forgotten password, and provides links to instructions for doing so. | | [Access control](access-control/access-control.md) | Describes access control in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer. Key concepts that make up access control are permissions, ownership of objects, inheritance of permissions, user rights, and object auditing. | | [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) | In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. | | [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) | Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. | diff --git a/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md b/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md index 07bb80474c..65e353cb81 100644 --- a/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md +++ b/windows/security/identity-protection/installing-digital-certificates-on-windows-10-mobile.md @@ -2,14 +2,15 @@ title: Install digital certificates on Windows 10 Mobile (Windows 10) description: Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. ms.assetid: FF7B1BE9-41F4-44B0-A442-249B650CEE25 +ms.reviewer: keywords: S/MIME, PFX, SCEP ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -30,7 +31,7 @@ Certificates in Windows 10 Mobile are primarily used for the following purposes - For installation and licensing of applications (from the Windows Phone Store or a custom company distribution site). ->[!WARNING]   +>[!WARNING] >In Windows 10, Version 1607, if you have multiple certificates provisioned on the device and the Wi-Fi profile provisioned does not have a strict filtering criteria, you may see connection failures when connecting to Wi-Fi. [Learn more about this known issue in Version 1607](https://go.microsoft.com/fwlink/p/?LinkId=786764) ## Install certificates using Microsoft Edge @@ -44,9 +45,10 @@ The Windows 10 Mobile certificate installer supports .cer, .p7b, .pem, and .pfx ## Install certificates using mobile device management (MDM) Windows 10 Mobile supports root, CA, and client certificate to be configured via MDM. Using MDM, an administrator can directly add, delete, or query root and CA certificates, and configure the device to enroll a client certificate with a certificate enrollment server that supports Simple Certificate Enrollment Protocol (SCEP). SCEP enrolled client certificates are used by Wi-Fi, VPN, email, and browser for certificate-based client authentication. An MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. + >[!WARNING] >Do not use SCEP for encryption certificates for S/MIME. You must use a PFX certificate profile to support S/MIME on Windows 10 Mobile. For instructions on creating a PFX certificate profile in Microsoft Intune, see [Enable access to company resources using certificate profiles with Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkID=718216). -  + **Process of installing certificates using MDM** 1. The MDM server generates the initial cert enroll request including challenge password, SCEP server URL, and other enrollment related parameters. @@ -63,13 +65,12 @@ Windows 10 Mobile supports root, CA, and client certificate to be configured vi >- A certificate is successfully received from the server >- The server returns an error >- The number of retries reaches the preconfigured limit -   + 8. The cert is installed in the device. Browser, Wi-Fi, VPN, email, and other first party applications have access to this certificate. >[!NOTE] >If MDM requested private key stored in Trusted Process Module (TPM) (configured during enrollment request), the private key will be saved in TPM. Note that SCEP enrolled cert protected by TPM isn’t guarded by a PIN. However, if the certificate is imported to the Windows Hello for Business Key Storage Provider (KSP), it is guarded by the Hello PIN. -   + ## Related topics -[Configure S/MIME](configure-s-mime.md) -  \ No newline at end of file +[Configure S/MIME](configure-s-mime.md) \ No newline at end of file diff --git a/windows/security/identity-protection/password-support-policy.md b/windows/security/identity-protection/password-support-policy.md new file mode 100644 index 0000000000..b92183cdd3 --- /dev/null +++ b/windows/security/identity-protection/password-support-policy.md @@ -0,0 +1,58 @@ +--- +title: Technical support policy for lost or forgotten passwords +description: Outlines the ways in which Microsoft can help you reset a lost or forgotten password, and provides links to instructions for doing so. +ms.reviewer: kaushika +manager: kaushika +ms.custom: +- CI ID 110060 +- CSSTroubleshoot +ms.author: v-tea +ms.prod: w10 +ms.sitesec: library +ms.pagetype: security +author: Teresa-Motiv +ms.topic: article +ms.localizationpriority: medium +ms.date: 11/20/2019 +audience: ITPro +--- + +# Technical support policy for lost or forgotten passwords + +Microsoft takes security seriously. This is for your protection. Microsoft accounts, the Windows operating system, and other Microsoft products include passwords to help secure your information. This article provides some options that you can use to reset or recover your password if you forget it. Be aware that, if these options don’t work, Microsoft support engineers can't help you retrieve or circumvent a lost or forgotten password. + +If you lose or forget a password, you can use the links in this article to find published support information that will help you reset the password. + +## How to reset a password for a domain account + +If you lose or forget the password for a domain account, contact your IT administrator or Helpdesk. For more information, see [Change or reset your Windows password](https://support.microsoft.com/help/4490115). + +## How to reset a password for a Microsoft account + +If you lose or forget the password for your Microsoft Account, use the [Recover your account](https://account.live.com/ResetPassword.aspx) wizard. + +This wizard requests your security proofs. If you have forgotten your security proofs, or no longer have access to them, select **I no longer have these anymore**. After you select this option, fill out a form for the Microsoft Account team. Provide as much information as you can on this form. The Microsoft Account team reviews the information that you provide to determine whether you are the account holder. This decision is final. Microsoft does not influence the team's choice of action. + +## How to reset a password for a local account on a Windows device + +Local accounts on a device include the device's Administrator account. + +### Windows 10 + +If you lose or forget the password for a local account on a device that runs Windows 10, see [Reset your Windows 10 local account password](https://support.microsoft.com/help/4028457). + +### Windows 8.1 or Windows 7 + +If you lose or forget the password for a local account on a device that runs Windows 8.1 or Windows 7, see [Change or reset your Windows password](https://support.microsoft.com/help/4490115). In that article, you can select your operating system version from the **Select Product Version** menu. + +## How to reset a hardware BIOS password + +If you lose or forget the password for the hardware BIOS of a device, contact the device manufacturer for help and support. If you do contact the manufacturer online, make sure that you visit the manufacturer website and not the website of some third party. + +## How to reset a password for an individual file + +Some applications let you password-protect individual files. If you lose or forget such a password, you can rely on that application only to reset or recover it. Microsoft support engineers cannot help you reset, retrieve, or circumvent such passwords. + +## Using third-party password tools + +Some third-party companies claim to be able to circumvent passwords that have been applied to files and features that Microsoft programs use. For legal reasons, we cannot recommend or endorse any one of these companies. If you want help to circumvent or reset a password, you can locate and contact a third party for this help. However, you use such third-party products and services at your own risk. diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index d4040d63f5..a4029266dd 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -6,15 +6,16 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 01/12/2018 +ms.reviewer: --- -# Protect Remote Desktop credentials with Windows Defender Remote Credential Guard +# Protect Remote Desktop credentials with Windows Defender Remote Credential Guard **Applies to** - Windows 10 @@ -51,16 +52,18 @@ Use the following table to compare different Remote Desktop connection security

                                  -|**Feature** | **Remote Desktop** | **Windows Defender Remote Credential Guard** | **Restricted Admin mode** | -|---|---|---|---| -| **Protection benefits** | Credentials on the server are not protected from Pass-the-Hash attacks. |User credentials remain on the client. An attacker can act on behalf of the user *only* when the session is ongoing | User logs on to the server as local administrator, so an attacker cannot act on behalf of the “domain user”. Any attack is local to the server| -| **Version support** | The remote computer can run any Windows operating system|Both the client and the remote computer must be running **at least Windows 10, version 1607, or Windows Server 2016**.|The remote computer must be running **at least patched Windows 7 or patched Windows Server 2008 R2**.

                                  For more information about patches (software updates) related to Restricted Admin mode, see [Microsoft Security Advisory 2871997](https://technet.microsoft.com/library/security/2871997.aspx). -|**Helps prevent**                    |      N/A         |
                                  • Pass-the-Hash
                                  • Use of a credential after disconnection
                                  |
                                  • Pass-the-Hash
                                  • Use of domain identity during connection
                                  | -|**Credentials supported from the remote desktop client device**|
                                  • **Signed on** credentials
                                  • **Supplied** credentials
                                  • **Saved** credentials
                                  |
                                  • **Signed on** credentials only |
                                    • **Signed on** credentials
                                    • **Supplied** credentials
                                    • **Saved** credentials
                                    -|**Access**|**Users allowed**, that is, members of Remote Desktop Users group of remote host.|**Users allowed**, that is, members of Remote Desktop Users of remote host.|**Administrators only**, that is, only members of Administrators group of remote host. -|**Network identity**|Remote Desktop session **connects to other resources as signed-in user**. | Remote Desktop session **connects to other resources as signed-in user**. |Remote Desktop session **connects to other resources as remote host’s identity**.| -|**Multi-hop**|From the remote desktop, **you can connect through Remote Desktop to another computer** | From the remote desktop, you **can connect through Remote Desktop to another computer**.|Not allowed for user as the session is running as a local host account| -|**Supported authentication** |Any negotiable protocol.| Kerberos only.|Any negotiable protocol| + +| **Feature** | **Remote Desktop** | **Windows Defender Remote Credential Guard** | **Restricted Admin mode** | +|--------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **Protection benefits** | Credentials on the server are not protected from Pass-the-Hash attacks. | User credentials remain on the client. An attacker can act on behalf of the user *only* when the session is ongoing | User logs on to the server as local administrator, so an attacker cannot act on behalf of the “domain user”. Any attack is local to the server | +| **Version support** | The remote computer can run any Windows operating system | Both the client and the remote computer must be running **at least Windows 10, version 1607, or Windows Server 2016**. | The remote computer must be running **at least patched Windows 7 or patched Windows Server 2008 R2**.

                                    For more information about patches (software updates) related to Restricted Admin mode, see [Microsoft Security Advisory 2871997](https://technet.microsoft.com/library/security/2871997.aspx). | +| **Helps prevent**                    |      N/A          |
                                    • Pass-the-Hash
                                    • Use of a credential after disconnection
                                    |
                                    • Pass-the-Hash
                                    • Use of domain identity during connection
                                    | +| **Credentials supported from the remote desktop client device** |
                                    • Signed on credentials
                                    • Supplied credentials
                                    • Saved credentials
                                    |
                                    • Signed on credentials only |
                                      • Signed on credentials
                                      • Supplied credentials
                                      • Saved credentials
                                      | +| **Access** | **Users allowed**, that is, members of Remote Desktop Users group of remote host. | **Users allowed**, that is, members of Remote Desktop Users of remote host. | **Administrators only**, that is, only members of Administrators group of remote host. | +| **Network identity** | Remote Desktop session **connects to other resources as signed-in user**. | Remote Desktop session **connects to other resources as signed-in user**. | Remote Desktop session **connects to other resources as remote host’s identity**. | +| **Multi-hop** | From the remote desktop, **you can connect through Remote Desktop to another computer** | From the remote desktop, you **can connect through Remote Desktop to another computer**. | Not allowed for user as the session is running as a local host account | +| **Supported authentication** | Any negotiable protocol. | Kerberos only. | Any negotiable protocol | +
                                      For further technical information, see [Remote Desktop Protocol](https://msdn.microsoft.com/library/aa383015(v=vs.85).aspx) @@ -76,7 +79,7 @@ For helpdesk support scenarios in which personnel require administrative access Therefore, we recommend instead that you use the Restricted Admin mode option. For helpdesk support scenarios, RDP connections should only be initiated using the /RestrictedAdmin switch. This helps ensure that credentials and other user resources are not exposed to compromised remote hosts. For more information, see [Mitigating Pass-the-Hash and Other Credential Theft v2](https://download.microsoft.com/download/7/7/A/77ABC5BD-8320-41AF-863C-6ECFB10CB4B9/Mitigating-Pass-the-Hash-Attacks-and-Other-Credential-Theft-Version-2.pdf). -To further harden security, we also recommend that you implement Local Administrator Password Solution (LAPS), a Group Policy client-side extension (CSE) introduced in Windows 8.1 that automates local administrator password management. LAPS mitigates the risk of lateral escalation and other cyberattacks facilitated when customers use the same administrative local account and password combination on all their computers. You can download and install LAPS [here](https://www.microsoft.com/en-us/download/details.aspx?id=46899). +To further harden security, we also recommend that you implement Local Administrator Password Solution (LAPS), a Group Policy client-side extension (CSE) introduced in Windows 8.1 that automates local administrator password management. LAPS mitigates the risk of lateral escalation and other cyberattacks facilitated when customers use the same administrative local account and password combination on all their computers. You can download and install LAPS [here](https://www.microsoft.com/download/details.aspx?id=46899). For further information on LAPS, see [Microsoft Security Advisory 3062591](https://technet.microsoft.com/library/security/3062591.aspx). @@ -89,7 +92,7 @@ To use Windows Defender Remote Credential Guard, the Remote Desktop client and r The Remote Desktop client device: -- Must be running at least Windows 10, version 1703 to be able to supply credentials. +- Must be running at least Windows 10, version 1703 to be able to supply credentials, which is sent to the remote device. This allows users to run as different users without having to send credentials to the remote machine. - Must be running at least Windows 10, version 1607 or Windows Server 2016 to use the user’s signed-in credentials. This requires the user’s account be able to sign in to both the client device and the remote host. - Must be running the Remote Desktop Classic Windows application. The Remote Desktop Universal Windows Platform application doesn't support Windows Defender Remote Credential Guard. - Must use Kerberos authentication to connect to the remote host. If the client cannot connect to a domain controller, then RDP attempts to fall back to NTLM. Windows Defender Remote Credential Guard does not allow NTLM fallback because this would expose credentials to risk. @@ -176,4 +179,4 @@ mstsc.exe /remoteGuard - No credentials are sent to the target device, but the target device still acquires Kerberos Service Tickets on its own. -- The server and client must authenticate using Kerberos. \ No newline at end of file +- The server and client must authenticate using Kerberos. diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index afcbf6f6a8..5e5003aa9f 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Smart Card and Remote Desktop Services diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 89bbf2b1b7..89ddb7fa8a 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -1,4 +1,4 @@ ---- +--- title: Smart Card Architecture (Windows 10) description: This topic for the IT professional describes the system architecture that supports smart cards in the Windows operating system. ms.prod: w10 @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Smart Card Architecture @@ -81,7 +82,7 @@ Credential providers must be registered on a computer running Windows, and they ## Smart card subsystem architecture -Vendors provide smart cards and smart card readers, and in many cases the vendors are different for the smart card and the smart card reader. Drivers for smart card readers are written to the [Personal Computer/Smart Card (PC/SC) standard](https://www.pcscworkgroup.com/). Each smart card must have a Credential Service Provider (CSP) that uses the CryptoAPI interfaces to enable cryptographic operations, and the WinSCard APIs to enable communications with smart card hardware. +Vendors provide smart cards and smart card readers, and in many cases the vendors are different for the smart card and the smart card reader. Drivers for smart card readers are written to the [Personal Computer/Smart Card (PC/SC) standard](https://www.pcscworkgroup.com/). Each smart card must have a Cryptographic Service Provider (CSP) that uses the CryptoAPI interfaces to enable cryptographic operations, and the WinSCard APIs to enable communications with smart card hardware. ### Base CSP and smart card minidriver architecture @@ -333,7 +334,7 @@ The following properties are supported in versions of Windows designated in the ### Implications for CSPs in Windows -Credential Service Providers (CSPs), including custom smart card CSPs, continue to be supported but this approach is not recommended. Using the existing Base CSP and smart card KSP with the smart card minidriver model for smart cards provides significant benefits in terms of performance, and PIN and data caching. One minidriver can be configured to work under CryptoAPI and CNG layers. This provides benefits from enhanced cryptographic support, including elliptic curve cryptography and AES. +Cryptographic Service Providers (CSPs), including custom smart card CSPs, continue to be supported but this approach is not recommended. Using the existing Base CSP and smart card KSP with the smart card minidriver model for smart cards provides significant benefits in terms of performance, and PIN and data caching. One minidriver can be configured to work under CryptoAPI and CNG layers. This provides benefits from enhanced cryptographic support, including elliptic curve cryptography and AES. If a smart card is registered by a CSP and a smart card minidriver, the one that was installed most recently will be used to communicate with the smart card. diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index 62c98ae6fb..997384b9e0 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Certificate Propagation Service diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index e529dc00ea..17564fc13b 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -1,4 +1,4 @@ ---- +--- title: Certificate Requirements and Enumeration (Windows 10) description: This topic for the IT professional and smart card developers describes how certificates are managed and used for smart card sign-in. ms.prod: w10 @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Certificate Requirements and Enumeration @@ -33,7 +34,7 @@ When a smart card is inserted, the following steps are performed. 4. The name of the container is retrieved by using the PP\_CONTAINER parameter with CryptGetProvParam. -5. Using the context acquired in Step 3, the CSP is queried for the PP\_USER\_CERTSTORE parameter (added in Windows Vista). For more information, see [Smart Card Architecture](smart-card-architecture.md). If the operation is successful, the name of a certificate store is returned, and the program flow skips to Step 8. +5. Using the context acquired in Step 3, the CSP is queried for the PP\_USER\_CERTSTORE parameter (added in Windows Vista). For more information, see [Smart Card Architecture](smart-card-architecture.md). If the operation is successful, the name of a certificate store is returned, and the program flow skips to Step 8. 6. If the operation in Step 5 fails, the default container context from Step 3 is queried for the AT\_KEYEXCHANGE key. @@ -53,7 +54,7 @@ When a smart card is inserted, the following steps are performed. Any certificate that meets these requirements is displayed to the user with the certificate's UPN (or e-mail address or subject, depending on the presence of the certificate extensions). - > **Note**  These requirements are the same as those in Windows Server 2003, but they are performed before the user enters the PIN. You can override many of them by using Group Policy settings. + > **Note**  These requirements are the same as those in Windows Server 2003, but they are performed before the user enters the PIN. You can override many of them by using Group Policy settings. 9. The process then chooses a certificate, and the PIN is entered. @@ -63,7 +64,7 @@ When a smart card is inserted, the following steps are performed. ## About Certificate support for compatibility -Although versions of Windows earlier than Windows Vista include support for smart cards, the types of certificates that smart cards can contain are limited. The limitations are: +Although versions of Windows earlier than Windows Vista include support for smart cards, the types of certificates that smart cards can contain are limited. The limitations are: - Each certificate must have a user principal name (UPN) and the smart card sign-in object identifier (also known as OID) in the enhanced key usage (EKU) attribute field. There is a Group Policy setting, Allow ECC certificates to be used for logon and authentication, to make the EKU optional. @@ -94,45 +95,45 @@ The following diagram illustrates how smart card sign-in works in the supported Following are the steps that are performed during a smart card sign-in: -1. Winlogon requests the sign-in UI credential information. +1. Winlogon requests the sign-in UI credential information. -2. Asynchronously, smart card resource manager starts, and the smart card credential provider does the following: +2. Asynchronously, smart card resource manager starts, and the smart card credential provider does the following: - 1. Gets credential information (a list of known credentials, or if no credentials exist, the smart card reader information that Windows detected). + 1. Gets credential information (a list of known credentials, or if no credentials exist, the smart card reader information that Windows detected). - 2. Gets a list of smart card readers (by using the WinSCard API) and the list of smart cards inserted in each of them. + 2. Gets a list of smart card readers (by using the WinSCard API) and the list of smart cards inserted in each of them. - 3. Enumerates each card to verify that a sign-in certificate that is controlled by Group Policy is present. If the certificate is present, the smart card credential provider copies it into a temporary, secure cache on the computer or terminal. + 3. Enumerates each card to verify that a sign-in certificate that is controlled by Group Policy is present. If the certificate is present, the smart card credential provider copies it into a temporary, secure cache on the computer or terminal. - > **Note**  Smartcard cache entries are created for certificates with a subject name or with a subject key identifier. If the certificate has a subject name, it is stored with an index that is based on the subject name and certificate issuer. If another certificate with the same subject name and certificate issuer is used, it will replace the existing cached entry. A change in this behavior after Windows Vista, allows for the condition when the certificate does not have a subject name, the cache is created with an index that is based on the subject key identifier and certificate issuer. If another certificate has the same the subject key identifier and certificate issuer, the cache entry is replaced. When certificates have neither a subject name nor subject key identifier, a cached entry is not created. + > **Note**  Smartcard cache entries are created for certificates with a subject name or with a subject key identifier. If the certificate has a subject name, it is stored with an index that is based on the subject name and certificate issuer. If another certificate with the same subject name and certificate issuer is used, it will replace the existing cached entry. A change in this behavior after Windows Vista, allows for the condition when the certificate does not have a subject name, the cache is created with an index that is based on the subject key identifier and certificate issuer. If another certificate has the same the subject key identifier and certificate issuer, the cache entry is replaced. When certificates have neither a subject name nor subject key identifier, a cached entry is not created. - 4. Notifies the sign-in UI that it has new credentials. + 4. Notifies the sign-in UI that it has new credentials. -3. The sign-in UI requests the new credentials from the smart card credential provider. As a response, the smart card credential provider provides each sign-in certificate to the sign-in UI, and corresponding sign-in tiles are displayed. The user selects a smart card-based sign-in certificate tile, and Windows displays a PIN dialog box. +3. The sign-in UI requests the new credentials from the smart card credential provider. As a response, the smart card credential provider provides each sign-in certificate to the sign-in UI, and corresponding sign-in tiles are displayed. The user selects a smart card-based sign-in certificate tile, and Windows displays a PIN dialog box. -4. The user enters the PIN, and then presses ENTER. The smart card credential provider encrypts the PIN. +4. The user enters the PIN, and then presses ENTER. The smart card credential provider encrypts the PIN. -5. The credential provider that resides in the LogonUI system collects the PIN. As part of packaging credentials in the smart card credential provider, the data is packaged in a KERB\_CERTIFICATE\_LOGON structure. The main contents of the KERB\_CERTIFICATE\_LOGON structure are the smart card PIN, CSP data (such as reader name and container name), user name, and domain name. User name is required if the sign-in domain is not in the same forest because it enables a certificate to be mapped to multiple user accounts. +5. The credential provider that resides in the LogonUI system collects the PIN. As part of packaging credentials in the smart card credential provider, the data is packaged in a KERB\_CERTIFICATE\_LOGON structure. The main contents of the KERB\_CERTIFICATE\_LOGON structure are the smart card PIN, CSP data (such as reader name and container name), user name, and domain name. User name is required if the sign-in domain is not in the same forest because it enables a certificate to be mapped to multiple user accounts. -6. The credential provider wraps the data (such as the encrypted PIN, container name, reader name, and card key specification) and sends it back to LogonUI. +6. The credential provider wraps the data (such as the encrypted PIN, container name, reader name, and card key specification) and sends it back to LogonUI. -7. Winlogon presents the data from LogonUI to the LSA with the user information in LSALogonUser. +7. Winlogon presents the data from LogonUI to the LSA with the user information in LSALogonUser. -8. LSA calls the Kerberos authentication package (Kerberos SSP) to create a Kerberos authentication service request (KRB\_AS\_REQ), which containing a preauthenticator (as specified in RFC 4556: [Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)](http://www.ietf.org/rfc/rfc4556.txt)). +8. LSA calls the Kerberos authentication package (Kerberos SSP) to create a Kerberos authentication service request (KRB\_AS\_REQ), which containing a preauthenticator (as specified in RFC 4556: [Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)](http://www.ietf.org/rfc/rfc4556.txt)). - If the authentication is performed by using a certificate that uses a digital signature, the preauthentication data consists of the user's public certificate and the certificate that is digitally signed with the corresponding private key.
                                      If the authentication is performed by using a certificate that uses key encipherment, the preauthentication data consists of the user's public certificate and the certificate that is encrypted with the corresponding private key. + If the authentication is performed by using a certificate that uses a digital signature, the preauthentication data consists of the user's public certificate and the certificate that is digitally signed with the corresponding private key.
                                      If the authentication is performed by using a certificate that uses key encipherment, the preauthentication data consists of the user's public certificate and the certificate that is encrypted with the corresponding private key. -9. To sign the request digitally (as per RFC 4556), a call is made to the corresponding CSP for a private key operation. Because the private key in this case is stored in a smart card, the smart card subsystem is called, and the necessary operation is completed. The result is sent back to the Kerberos security support provider (SSP). +9. To sign the request digitally (as per RFC 4556), a call is made to the corresponding CSP for a private key operation. Because the private key in this case is stored in a smart card, the smart card subsystem is called, and the necessary operation is completed. The result is sent back to the Kerberos security support provider (SSP). -10. The Kerberos SSP sends an authentication request for a ticket-granting-ticket (TGT) (per RFC 4556) to the Key Distribution Center (KDC) service that runs on a domain controller. +10. The Kerberos SSP sends an authentication request for a ticket-granting-ticket (TGT) (per RFC 4556) to the Key Distribution Center (KDC) service that runs on a domain controller. -11. The KDC finds the user's account object in Active Directory Domain Services (AD DS), as detailed in [Client certificate requirements and mappings](#client-certificate-requirements-and-mappings), and uses the user's certificate to verify the signature. +11. The KDC finds the user's account object in Active Directory Domain Services (AD DS), as detailed in [Client certificate requirements and mappings](#client-certificate-requirements-and-mappings), and uses the user's certificate to verify the signature. -12. The KDC validates the user's certificate (time, path, and revocation status) to ensure that the certificate is from a trusted source. The KDC uses CryptoAPI to build a certification path from the user's certificate to a root certification authority (CA) certificate that resides in the root store on the domain controller. The KDC then uses CryptoAPI to verify the digital signature on the signed authenticator that was included in the preauthentication data fields. The domain controller verifies the signature and uses the public key from the user's certificate to prove that the request originated from the owner of the private key that corresponds to the public key. The KDC also verifies that the issuer is trusted and appears in the NTAUTH certificate store. +12. The KDC validates the user's certificate (time, path, and revocation status) to ensure that the certificate is from a trusted source. The KDC uses CryptoAPI to build a certification path from the user's certificate to a root certification authority (CA) certificate that resides in the root store on the domain controller. The KDC then uses CryptoAPI to verify the digital signature on the signed authenticator that was included in the preauthentication data fields. The domain controller verifies the signature and uses the public key from the user's certificate to prove that the request originated from the owner of the private key that corresponds to the public key. The KDC also verifies that the issuer is trusted and appears in the NTAUTH certificate store. -13. The KDC service retrieves user account information from AD DS. The KDC constructs a TGT, which is based on the user account information that it retrieves from AD DS. The TGT’s authorization data fields include the user's security identifier (SID), the SIDs for universal and global domain groups to which the user belongs, and (in a multidomain environment) the SIDs for any universal groups of which the user is a member. +13. The KDC service retrieves user account information from AD DS. The KDC constructs a TGT, which is based on the user account information that it retrieves from AD DS. The TGT’s authorization data fields include the user's security identifier (SID), the SIDs for universal and global domain groups to which the user belongs, and (in a multidomain environment) the SIDs for any universal groups of which the user is a member. -14. The domain controller returns the TGT to the client as part of the KRB\_AS\_REP response. +14. The domain controller returns the TGT to the client as part of the KRB\_AS\_REP response. > **Note**  The KRB\_AS\_REP packet consists of: >- Privilege attribute certificate (PAC) @@ -143,21 +144,21 @@ Following are the steps that are performed during a smart card sign-in: TGT is encrypted with the master key of the KDC, and the session key is encrypted with a temporary key. This temporary key is derived based on RFC 4556. Using CryptoAPI, the temporary key is decrypted. As part of the decryption process, if the private key is on a smart card, a call is made to the smart card subsystem by using the specified CSP to extract the certificate corresponding to the user's public key. (Programmatic calls for the certificate include CryptAcquireContext, CryptSetProvParam with the PIN, CryptgetUserKey, and CryptGetKeyParam.) After the temporary key is obtained, the Kerberos SSP decrypts the session key. -15. The client validates the reply from the KDC (time, path, and revocation status). It first verifies the KDC's signature by the construction of a certification path from the KDC's certificate to a trusted root CA, and then it uses the KDC's public key to verify the reply signature. +15. The client validates the reply from the KDC (time, path, and revocation status). It first verifies the KDC's signature by the construction of a certification path from the KDC's certificate to a trusted root CA, and then it uses the KDC's public key to verify the reply signature. -16. Now that a TGT has been obtained, the client obtains a service ticket, which is used to sign in to the local computer. +16. Now that a TGT has been obtained, the client obtains a service ticket, which is used to sign in to the local computer. -17. With success, LSA stores the tickets and returns a success message to LSALogonUser. After this success message is issued, user profile for the device is selected and set, Group Policy refresh is instantiated, and other actions are performed. +17. With success, LSA stores the tickets and returns a success message to LSALogonUser. After this success message is issued, user profile for the device is selected and set, Group Policy refresh is instantiated, and other actions are performed. -18. After the user profile is loaded, the Certification Propagation Service (CertPropSvc) detects this event, reads the certificates from the smart card (including the root certificates), and then populates them into the user's certificate store (MYSTORE). +18. After the user profile is loaded, the Certification Propagation Service (CertPropSvc) detects this event, reads the certificates from the smart card (including the root certificates), and then populates them into the user's certificate store (MYSTORE). -19. CSP to smart card resource manager communication happens on the LRPC Channel. +19. CSP to smart card resource manager communication happens on the LRPC Channel. -20. On successful authentication, certificates are propagated to the user's store asynchronously by the Certificate Propagation Service (CertPropSvc). +20. On successful authentication, certificates are propagated to the user's store asynchronously by the Certificate Propagation Service (CertPropSvc). -21. When the card is removed, certificates in the temporary secure cache store are removed. The Certificates are no longer available for sign-in, but they remain in the user's certificate store. +21. When the card is removed, certificates in the temporary secure cache store are removed. The Certificates are no longer available for sign-in, but they remain in the user's certificate store. -> **Note**  A SID is created for each user or group at the time a user account or a group account is created within the local security accounts database or within AD DS. The SID never changes, even if the user or group account is renamed. +> **Note**  A SID is created for each user or group at the time a user account or a group account is created within the local security accounts database or within AD DS. The SID never changes, even if the user or group account is renamed. For more information about the Kerberos protocol, see [Microsoft Kerberos](https://msdn.microsoft.com/library/windows/desktop/aa378747(v=vs.85).aspx). @@ -183,18 +184,19 @@ Certificate requirements are listed by versions of the Windows operating system. The smart card certificate has specific format requirements when it is used with Windows XP and earlier operating systems. You can enable any certificate to be visible for the smart card credential provider. -| **Component** | **Requirements for Windows 8.1, Windows 8, Windows 7, and Windows Vista** | **Requirements for Windows XP** | -|--------------------------------------|--------------------------------|------| -| CRL distribution point location | Not required | The location must be specified, online, and available, for example:
                                      \[1\]CRL Distribution Point
                                      Distribution Point Name:
                                      Full Name:
                                      URL=http://server1.contoso.com/CertEnroll/caname.crl | -| Key usage | Digital signature | Digital signature | -| Basic constraints | Not required | \[Subject Type=End Entity, Path Length Constraint=None\] (Optional) | -| Enhanced key usage (EKU) | The smart card sign-in object identifier is not required.

                                      **Note**  If an EKU is present, it must contain the smart card sign-in EKU. Certificates with no EKU can be used for sign-in. | - Client Authentication (1.3.6.1.5.5.7.3.2)
                                      The client authentication object identifier is required only if a certificate is used for SSL authentication.

                                      - Smart Card Sign-in (1.3.6.1.4.1.311.20.2.2) | -| Subject alternative name | E-mail ID is not required for smart card sign-in. | Other Name: Principal Name=(UPN), for example:
                                      UPN=user1@contoso.com
                                      The UPN OtherName object identifier is 1.3.6.1.4.1.311.20.2.3.
                                      The UPN OtherName value must be an ASN1-encoded UTF8 string. | -| Subject | Not required | Distinguished name of user. This field is a mandatory extension, but the population of this field is optional. | -| Key exchange (AT\_KEYEXCHANGE field) | Not required for smart card sign-in certificates if a Group Policy setting is enabled. (By default, Group Policy settings are not enabled.) | Not required | -| CRL | Not required | Not required | -| UPN | Not required | Not required | -| Notes | You can enable any certificate to be visible for the smart card credential provider. | There are two predefined types of private keys. These keys are Signature Only (AT\_SIGNATURE) and Key Exchange (AT\_KEYEXCHANGE). Smart card sign-in certificates must have a Key Exchange (AT\_KEYEXCHANGE) private key type. | + +| **Component** | **Requirements for Windows 8.1, Windows 8, Windows 7, Windows Vista, and Windows 10** | **Requirements for Windows XP** | +|--------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| CRL distribution point location | Not required | The location must be specified, online, and available, for example:
                                      \[1\]CRL Distribution Point
                                      Distribution Point Name:
                                      Full Name:
                                      URL= | +| Key usage | Digital signature | Digital signature | +| Basic constraints | Not required | \[Subject Type=End Entity, Path Length Constraint=None\] (Optional) | +| Enhanced key usage (EKU) | The smart card sign-in object identifier is not required.

                                      **Note**  If an EKU is present, it must contain the smart card sign-in EKU. Certificates with no EKU can be used for sign-in. | - Client Authentication (1.3.6.1.5.5.7.3.2)
                                      The client authentication object identifier is required only if a certificate is used for SSL authentication.

                                      - Smart Card Sign-in (1.3.6.1.4.1.311.20.2.2) | +| Subject alternative name | E-mail ID is not required for smart card sign-in. | Other Name: Principal Name=(UPN), for example:
                                      UPN=user1@contoso.com
                                      The UPN OtherName object identifier is 1.3.6.1.4.1.311.20.2.3.
                                      The UPN OtherName value must be an ASN1-encoded UTF8 string. | +| Subject | Not required | Distinguished name of user. This field is a mandatory extension, but the population of this field is optional. | +| Key exchange (AT\_KEYEXCHANGE field) | Not required for smart card sign-in certificates if a Group Policy setting is enabled. (By default, Group Policy settings are not enabled.) | Not required | +| CRL | Not required | Not required | +| UPN | Not required | Not required | +| Notes | You can enable any certificate to be visible for the smart card credential provider. | There are two predefined types of private keys. These keys are Signature Only (AT\_SIGNATURE) and Key Exchange (AT\_KEYEXCHANGE). Smart card sign-in certificates must have a Key Exchange (AT\_KEYEXCHANGE) private key type. | ### Client certificate mappings @@ -268,7 +270,7 @@ For example, if Certificate1 has CN=CNName1, Certificate2 has CN=User1, and Cert ## Smart card sign-in across forests -For account mapping to work across forests, particularly in cases where there is not enough information available on the certificate, the user might enter a hint in the form of a user name, such as *domain\\user*, or a fully qualified UPN such as *user@contoso.com*. +For account mapping to work across forests, particularly in cases where there is not enough information available on the certificate, the user might enter a hint in the form of a user name, such as *domain\\user*, or a fully qualified UPN such as user@contoso.com. > **Note**  For the hint field to appear during smart card sign-in, the **Allow user name hint** Group Policy setting (**X509HintsNeeded** registry key) must be enabled on the client. @@ -284,19 +286,19 @@ Windows client computers attempt to request the OCSP responses and use them in t For sign-in to work in a smart card-based domain, the smart card certificate must meet the following conditions: -- The KDC root certificate on the smart card must have an HTTP CRL distribution point listed in its certificate. +- The KDC root certificate on the smart card must have an HTTP CRL distribution point listed in its certificate. -- The smart card sign-in certificate must have the HTTP CRL distribution point listed in its certificate. +- The smart card sign-in certificate must have the HTTP CRL distribution point listed in its certificate. -- The CRL distribution point must have a valid CRL published and a delta CRL, if applicable, even if the CRL distribution point is empty. +- The CRL distribution point must have a valid CRL published and a delta CRL, if applicable, even if the CRL distribution point is empty. -- The smart card certificate must contain one of the following: +- The smart card certificate must contain one of the following: - - A subject field that contains the DNS domain name in the distinguished name. If it does not, resolution to an appropriate domain fails, so Remote Desktop Services and the domain sign-in with the smart card fail. + - A subject field that contains the DNS domain name in the distinguished name. If it does not, resolution to an appropriate domain fails, so Remote Desktop Services and the domain sign-in with the smart card fail. - - A UPN where the domain name resolves to the actual domain. For example, if the domain name is Engineering.Corp.Contoso, the UPN is username@engineering.corp.contoso.com. If any part of the domain name is omitted, the Kerberos client cannot find the appropriate domain. + - A UPN where the domain name resolves to the actual domain. For example, if the domain name is Engineering.Corp.Contoso, the UPN is username@engineering.corp.contoso.com. If any part of the domain name is omitted, the Kerberos client cannot find the appropriate domain. -Although the HTTP CRL distribution points are on by default in Windows Server 2008, subsequent versions of the Windows Server operating system do not include HTTP CRL distribution points. To allow smart card sign-in to a domain in these versions, do the following: +Although the HTTP CRL distribution points are on by default in Windows Server 2008, subsequent versions of the Windows Server operating system do not include HTTP CRL distribution points. To allow smart card sign-in to a domain in these versions, do the following: 1. Enable HTTP CRL distribution points on the CA. diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index 8c99bb0570..9ee26abcab 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -1,4 +1,4 @@ ---- +--- title: Smart Cards Debugging Information (Windows 10) description: This topic explains tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. ms.prod: w10 @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Smart Cards Debugging Information @@ -61,9 +62,9 @@ Windows software trace preprocessor (WPP) simplifies tracing the operation of th Using WPP, use one of the following commands to enable tracing: -- **tracelog.exe -kd -rt -start** <*FriendlyName*> **-guid \#**<*GUID*> **-f .\\**<*LogFileName*>**.etl -flags** <*flags*> **-ft 1** +- **tracelog.exe -kd -rt -start** <*FriendlyName*> **-guid \#**<*GUID*> **-f .\\**<*LogFileName*>**.etl -flags** <*flags*> **-ft 1** -- **logman start** <*FriendlyName*> **-ets -p {**<*GUID*>**} -**<*Flags*> **-ft 1 -rt -o .\\**<*LogFileName*>***.etl -mode 0x00080000** +- **logman start** <*FriendlyName*> **-ets -p {**<*GUID*>**} -**<*Flags*> **-ft 1 -rt -o .\\**<*LogFileName*>**.etl -mode 0x00080000* You can use the parameters in the following table. diff --git a/windows/security/identity-protection/smart-cards/smart-card-events.md b/windows/security/identity-protection/smart-cards/smart-card-events.md index facd8ddf40..d905fbf992 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-events.md +++ b/windows/security/identity-protection/smart-cards/smart-card-events.md @@ -1,4 +1,4 @@ ---- +--- title: Smart Card Events (Windows 10) description: This topic for the IT professional and smart card developer describes events that are related to smart card deployment and development. ms.prod: w10 @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Smart Card Events @@ -96,14 +97,14 @@ The smart card reader device name is constructed in the form <*VendorName*> | 607 | Reader object failed to start monitor thread:  %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
                                      %1 = Windows error code | | 608 | Reader monitor failed to create power down timer: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
                                      %1 = Windows error code | | 609 | Reader monitor failed to create overlapped event:  %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
                                      %1 = Windows error code | -| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1  If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This can indicate hardware failure, but this error can also occur if a smart card or smart card reader is removed from the system while an operation is in progress.
                                      %1 = Windows error code
                                      %2 = Name of the smart card reader
                                      %3 = IOCTL that was sent
                                      %4 = First 4 bytes of the command sent to the smart card | +| 610 | Smart Card Reader '%2' rejected IOCTL %3: %1  If this error persists, your smart card or reader may not be functioning correctly.%n%nCommand Header: %4 | The reader cannot successfully transmit the indicated IOCTL to the smart card. This can indicate hardware failure, but this error can also occur if a smart card or smart card reader is removed from the system while an operation is in progress.
                                      %1 = Windows error code
                                      %2 = Name of the smart card reader
                                      %3 = IOCTL that was sent
                                      %4 = First 4 bytes of the command sent to the smart card
                                      These events are caused by legacy functionality in the smart card stack. It can be ignored if there is no noticeable failure in the smart card usage scenarios.| | 611 | Smart Card Reader initialization failed | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve this issue. | | 612 | Reader insertion monitor error retry threshold reached:  %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
                                      %1 = Windows error code | | 615 | Reader removal monitor error retry threshold reached:  %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
                                      %1 = Windows error code | | 616 | Reader monitor '%2' received uncaught error code:  %1 | This occurs when a smart card reader fails several times to respond properly to the IOCTL, which indicates whether a smart card is present in the reader. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
                                      %1 = Windows error code
                                      %2 = Reader name | | 617 | Reader monitor '%1' exception -- exiting thread | An unknown error occurred while monitoring a smart card reader for smart card insertions and removals. The smart card reader is marked as defective, and it is not recognized by the service until it is removed from the computer and reinserted or until the computer is restarted.
                                      %1 = Smart card reader name | | 618 | Smart Card Resource Manager encountered an unrecoverable internal error. | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue. | -| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
                                      %1 = Windows error code | +| 621 | Server Control failed to access start event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
                                      %1 = Windows error code
                                      These events are caused by legacy functionality in the smart card stack. It can be ignored if there is no noticeable failure in the smart card usage scenarios. | | 622 | Server Control failed to access stop event: %1 | This is an internal, unrecoverable error that indicates a failure in the smart card service. The most common cause is limited computer resources. Restarting the computer may resolve the issue.
                                      %1 = Windows error code | ## Smart card Plug and Play events diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index bb6e5da969..f663299fb7 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -1,18 +1,19 @@ --- title: Smart Card Group Policy and Registry Settings (Windows 10) -description: This topic for the IT professional and smart card developer describes the Group Policy settings, registry key settings, local security policy settings, and credential delegation policy settings that are available for configuring smart cards. +description: Discover the Group Policy, registry key, local security policy, and credential delegation policy settings that are available for configuring smart cards. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Smart Card Group Policy and Registry Settings @@ -94,7 +95,7 @@ This policy setting allows certificates without an enhanced key usage (EKU) set > **Note**  Enhanced key usage certificate attribute is also known as extended key usage. -In versions of Windows prior to Windows Vista, smart card certificates that are used to sign in require an EKU extension with a smart card logon object identifier. This policy setting can be used to modify that restriction. +In versions of Windows prior to Windows Vista, smart card certificates that are used to sign in require an EKU extension with a smart card logon object identifier. This policy setting can be used to modify that restriction. When this policy setting is enabled, certificates with the following attributes can also be used to sign in with a smart card: @@ -126,7 +127,7 @@ This policy setting allows you to control whether elliptic curve cryptography (E ### Allow Integrated Unblock screen to be displayed at the time of logon -This policy setting lets you determine whether the integrated unblock feature is available in the sign-in user interface (UI). The feature was introduced as a standard feature in the Credential Security Support Provider in Windows Vista. +This policy setting lets you determine whether the integrated unblock feature is available in the sign-in user interface (UI). The feature was introduced as a standard feature in the Credential Security Support Provider in Windows Vista. When this setting is enabled, the integrated unblock feature is available. When this setting is disabled or not configured, the feature is not available. @@ -152,7 +153,7 @@ This policy setting lets you allow signature key-based certificates to be enumer This policy setting permits those certificates that are expired or not yet valid to be displayed for sign-in. -Prior to Windows Vista, certificates were required to contain a valid time and to not expire. To be used, the certificate must be accepted by the domain controller. This policy setting only controls which certificates are displayed on the client computer. +Prior to Windows Vista, certificates were required to contain a valid time and to not expire. To be used, the certificate must be accepted by the domain controller. This policy setting only controls which certificates are displayed on the client computer. When this setting is enabled, certificates are listed on the sign-in screen whether they have an invalid time or their time validity has expired. When this setting is disabled or not configured, certificates that are expired or not yet valid are not listed on the sign-in screen. @@ -217,7 +218,7 @@ This policy setting is applied to the computer after the [Allow time invalid cer | Registry key | FilterDuplicateCerts | | Default values | No changes per operating system versions
                                      Disabled and not configured are equivalent | | Policy management | Restart requirement: None
                                      Sign off requirement: None
                                      Policy conflicts: None | -| Notes and resources | If there are two or more of the same certificates on a smart card and this policy setting is enabled, the certificate that is used to sign in to computers running Windows 2000, Windows XP, or Windows Server 2003 will be displayed. Otherwise, the certificate with the most distant expiration time will be displayed. | +| Notes and resources | If there are two or more of the same certificates on a smart card and this policy setting is enabled, the certificate that is used to sign in to computers running Windows 2000, Windows XP, or Windows Server 2003 will be displayed. Otherwise, the certificate with the most distant expiration time will be displayed. | ### Force the reading of all certificates from the smart card @@ -354,8 +355,8 @@ The following smart card-related Group Policy settings are located in Computer C | Group Policy Setting and Registry Key | Default | Description | |------------------------------------------|------------|---------------| -| Interactive logon: Require smart card

                                      scforceoption | Disabled | This security policy setting requires users to sign in to a computer by using a smart card.

                                      **Enabled**  Users can only sign in to the computer by using a smart card.
                                      **Disabled**  Users can sign in to the computer by using any method. | -| Interactive logon: Smart card removal behavior

                                      scremoveoption | This policy setting is not defined, which means that the system treats it as **No Action**. | This setting determines what happens when the smart card for a signed-in user is removed from the smart card reader. The options are:
                                      **No Action**
                                      **Lock Workstation**: The workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session.
                                      **Force Logoff**: The user is automatically signed out when the smart card is removed.
                                      **Disconnect if a Remote Desktop Services session**: Removal of the smart card disconnects the session without signing out the user. This allows the user to reinsert the smart card and resume the session later, or at another computer that is equipped with a smart card reader, without having to sign in again. If the session is local, this policy setting functions identically to the **Lock Workstation** option.

                                      **Note**  Remote Desktop Services was called Terminal Services in previous versions of Windows Server. | +| Interactive logon: Require smart card

                                      scforceoption | Disabled | This security policy setting requires users to sign in to a computer by using a smart card.

                                      **Enabled** Users can only sign in to the computer by using a smart card.
                                      **Disabled** Users can sign in to the computer by using any method. | +| Interactive logon: Smart card removal behavior

                                      scremoveoption | This policy setting is not defined, which means that the system treats it as **No Action**. | This setting determines what happens when the smart card for a signed-in user is removed from the smart card reader. The options are:
                                      **No Action**
                                      **Lock Workstation**: The workstation is locked when the smart card is removed, allowing users to leave the area, take their smart card with them, and still maintain a protected session.
                                      **Force Logoff**: The user is automatically signed out when the smart card is removed.
                                      **Disconnect if a Remote Desktop Services session**: Removal of the smart card disconnects the session without signing out the user. This allows the user to reinsert the smart card and resume the session later, or at another computer that is equipped with a smart card reader, without having to sign in again. If the session is local, this policy setting functions identically to the **Lock Workstation** option.

                                      **Note**  Remote Desktop Services was called Terminal Services in previous versions of Windows Server. | From the Local Security Policy Editor (secpol.msc), you can edit and apply system policies to manage credential delegation for local or domain computers. @@ -367,11 +368,12 @@ Registry keys are located in HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Contro **Credential delegation policy settings** -| Group Policy Setting and Registry Key | Default | Description | -|----------------------------------------|-----------|-------------| -| **Allow Delegating Fresh Credentials**

                                      AllowFreshCredentials | Not Configured | This policy setting applies:
                                      When server authentication was achieved through a trusted X509 certificate or Kerberos protocol.
                                      To applications that use the CredSSP component (for example, Remote Desktop Services).

                                      **Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
                                      **Not Configured**: After proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Services running on any computer.
                                      **Disabled**: Delegation of fresh credentials to any computer is not permitted.

                                      **Note**  This policy setting can be set to one or more service principal names (SPNs). The SPN represents the target server where the user credentials can be delegated. A single wildcard character is permitted when specifying the SPN, for example:
                                      Use *TERMSRV/\** for Remote Desktop Session Host (RD Session Host) running on any computer.
                                      Use *TERMSRV/host.humanresources.fabrikam.com* for RD Session Host running on the host.humanresources.fabrikam.com computer.
                                      Use *TERMSRV/\*.humanresources.fabrikam.com* for RD Session Host running on all computers in .humanresources.fabrikam.com | -| **Allow Delegating Fresh Credentials with NTLM-only Server Authentication**

                                      AllowFreshCredentialsWhenNTLMOnly | Not Configured | This policy setting applies:
                                      When server authentication was achieved by using NTLM.
                                      To applications that use the CredSSP component (for example, Remote Desktop).

                                      **Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
                                      **Not Configured**: After proper mutual authentication, delegation of fresh credentials is permitted to RD Session Host running on any computer (TERMSRV/\*).
                                      **Disabled**: Delegation of fresh credentials is not permitted to any computer.

                                      **Note**  This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials can be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
                                      See the **Allow Delegating Fresh Credentials** policy setting description for examples. | -| **Deny Delegating Fresh Credentials**

                                      DenyFreshCredentials | Not Configured | This policy setting applies to applications that use the CredSSP component (for example, Remote Desktop).

                                      **Enabled**: You can specify the servers where the user's fresh credentials cannot be delegated.
                                      **Disabled** or **Not Configured**: A server is not specified.

                                      **Note**  This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials cannot be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
                                      See the **Allow Delegating Fresh Credentials** policy setting description for examples. | + +| Group Policy Setting and Registry Key | Default | Description | +|----------------------------------------------------------------------------------------------------------------------|----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| **Allow Delegating Fresh Credentials**

                                      AllowFreshCredentials | Not Configured | This policy setting applies:
                                      When server authentication was achieved through a trusted X509 certificate or Kerberos protocol.
                                      To applications that use the CredSSP component (for example, Remote Desktop Services).

                                      **Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
                                      **Not Configured**: After proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Services running on any computer.
                                      **Disabled**: Delegation of fresh credentials to any computer is not permitted.

                                      **Note**  This policy setting can be set to one or more service principal names (SPNs). The SPN represents the target server where the user credentials can be delegated. A single wildcard character is permitted when specifying the SPN, for example:
                                      Use \*TERMSRV/\*\* for Remote Desktop Session Host (RD Session Host) running on any computer.
                                      Use *TERMSRV/host.humanresources.fabrikam.com* for RD Session Host running on the host.humanresources.fabrikam.com computer.
                                      Use *TERMSRV/\*.humanresources.fabrikam.com* for RD Session Host running on all computers in .humanresources.fabrikam.com | +| **Allow Delegating Fresh Credentials with NTLM-only Server Authentication**

                                      AllowFreshCredentialsWhenNTLMOnly | Not Configured | This policy setting applies:
                                      When server authentication was achieved by using NTLM.
                                      To applications that use the CredSSP component (for example, Remote Desktop).

                                      **Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
                                      **Not Configured**: After proper mutual authentication, delegation of fresh credentials is permitted to RD Session Host running on any computer (TERMSRV/\*).
                                      **Disabled**: Delegation of fresh credentials is not permitted to any computer.

                                      **Note**  This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials can be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
                                      See the **Allow Delegating Fresh Credentials** policy setting description for examples. | +| **Deny Delegating Fresh Credentials**

                                      DenyFreshCredentials | Not Configured | This policy setting applies to applications that use the CredSSP component (for example, Remote Desktop).

                                      **Enabled**: You can specify the servers where the user's fresh credentials cannot be delegated.
                                      **Disabled** or **Not Configured**: A server is not specified.

                                      **Note**  This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials cannot be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
                                      See the **Allow Delegating Fresh Credentials** policy setting description for examples. | If you are using Remote Desktop Services with smart card logon, you cannot delegate default and saved credentials. The registry keys in the following table, which are located at HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Credssp\\PolicyDefaults, and the corresponding Group Policy settings are ignored. diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md index ea407b1937..56228dff85 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md +++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # How Smart Card Sign-in Works in Windows diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index 34b355d1cd..dd8812970c 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Smart Card Removal Policy Service diff --git a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md index 634ec44834..a913f4c769 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Smart Cards for Windows Service diff --git a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md index 5b0a21f2f9..794b8e096c 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Smart Card Tools and Settings diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index bf3020f5bd..53ebc5b4f6 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -1,18 +1,19 @@ --- title: Smart Card Technical Reference (Windows 10) -description: This technical reference for the IT professional and smart card developer describes the Windows smart card infrastructure for physical smart cards and how smart card-related components work in Windows. +description: Learn about the Windows smart card infrastructure for physical smart cards, and how smart card-related components work in Windows. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Smart Card Technical Reference diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index f478817d07..4a92507705 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -2,13 +2,14 @@ title: How User Account Control works (Windows 10) description: User Account Control (UAC) is a fundamental component of Microsoft's overall security vision. UAC helps mitigate the impact of malware. ms.assetid: 9f921779-0fd3-4206-b0e4-05a19883ee59 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: operate ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -146,7 +147,7 @@ To better understand each component, review the table below:

                                      Application Information service

                                      -

                                      A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required and (depending on Group Policy) consent is given by the user to do so.

                                      +

                                      A system service that helps start apps that require one or more elevated privileges or user rights to run, such as local administrative tasks, and apps that require higher integrity levels. The Application Information service helps start such apps by creating a new process for the application with an administrative user's full access token when elevation is required and (depending on Group Policy) consent is given by the user to do so.

                                      @@ -209,7 +210,7 @@ To better understand each component, review the table below:

                                      If the secure desktop is enabled, all elevation requests go to the secure desktop regardless of prompt behavior policy settings for administrators and standard users.

                                    • -

                                      If the secure desktop is not enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used.

                                      +

                                      If the secure desktop is not enabled, all elevation requests go to the interactive user's desktop, and the per-user settings for administrators and standard users are used.

                                    @@ -243,7 +244,7 @@ To better understand each component, review the table below:

                                    Installer detection

                                    -

                                    Installer detection detects setup files, which helps prevent installations from being run without the user's knowledge and consent.

                                    +

                                    Installer detection detects setup files, which helps prevent installations from being run without the user's knowledge and consent.

                                    @@ -268,17 +269,17 @@ To better understand each component, review the table below: -  -The slider will never turn UAC completely off. If you set it to **Never notify**, it will: + +The slider will never turn UAC completely off. If you set it to Never notify, it will: - Keep the UAC service running. - Cause all elevation request initiated by administrators to be auto-approved without showing a UAC prompt. - Automatically deny all elevation requests for standard users. ->**Important:**  In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. -  ->**Warning:**  Universal Windows apps will not work when UAC is disabled. -  +> **Important:** In order to fully disable UAC you must disable the policy **User Account Control: Run all administrators in Admin Approval Mode**. +> +> **Warning:** Universal Windows apps will not work when UAC is disabled. + ### Virtualization Because system administrators in enterprise environments attempt to secure systems, many line-of-business (LOB) applications are designed to use only a standard user access token. As a result, you do not need to replace the majority of apps when UAC is turned on. @@ -318,6 +319,6 @@ Before a 32-bit process is created, the following attributes are checked to dete - Key attributes in the resource script data are linked in the executable file. - There are targeted sequences of bytes within the executable file. ->**Note:**  The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. -  ->**Note:**  The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). +> **Note:** The keywords and sequences of bytes were derived from common characteristics observed from various installer technologies. +> +> **Note:** The User Account Control: Detect application installations and prompt for elevation policy setting must be enabled for installer detection to detect installation programs. For more info, see [User Account Control security policy settings](user-account-control-security-policy-settings.md). diff --git a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md index 9f3048c408..e8d50dc97f 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # User Account Control Group Policy and registry key settings diff --git a/windows/security/identity-protection/user-account-control/user-account-control-overview.md b/windows/security/identity-protection/user-account-control/user-account-control-overview.md index 786f8d9b6e..15ea04101f 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-overview.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-overview.md @@ -2,14 +2,15 @@ title: User Account Control (Windows 10) description: User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. ms.assetid: 43ac4926-076f-4df2-84af-471ee7d20c38 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: operate ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -20,7 +21,7 @@ ms.date: 07/27/2017 # User Account Control **Applies to** -- Windows 10 +- Windows 10 - Windows Server 2016 User Account Control (UAC) helps prevent malware from damaging a PC and helps organizations deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account, unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings. @@ -37,11 +38,12 @@ Admin Approval Mode in UAC helps prevent malware from silently installing withou ## In this section + | Topic | Description | | - | - | | [How User Account Control works](how-user-account-control-works.md) | User Account Control (UAC) is a fundamental component of Microsoft's overall security vision. UAC helps mitigate the impact of malware. | | [User Account Control security policy settings](user-account-control-security-policy-settings.md) | You can use security policies to configure how User Account Control works in your organization. They can be configured locally by using the Local Security Policy snap-in (secpol.msc) or configured for the domain, OU, or specific groups by Group Policy. | | [User Account Control Group Policy and registry key settings](user-account-control-group-policy-and-registry-key-settings.md) | Here's a list of UAC Group Policy and registry key settings that your organization can use to manage UAC. | -  -  -  + + + diff --git a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md index 3964a0f292..f107a2346a 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-security-policy-settings.md @@ -1,14 +1,15 @@ --- title: User Account Control security policy settings (Windows 10) -description: You can use security policies to configure how User Account Control works in your organization. They can be configured locally by using the Local Security Policy snap-in (secpol.msc) or configured for the domain, OU, or specific groups by Group Policy. +description: You can use security policies to configure how User Account Control works in your organization. ms.assetid: 3D75A9AC-69BB-4EF2-ACB3-1769791E1B98 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md index 766f4cf4a7..5e643f7d75 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Deploy Virtual Smart Cards diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md index 65c4b4ded6..f0b0220678 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Evaluate Virtual Smart Card Security diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index 46c153bf96..34daf7a11e 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Get Started with Virtual Smart Cards: Walkthrough Guide @@ -57,65 +58,65 @@ On your domain server, you need to create a template for the certificate that yo ### To create the certificate template -1. On your server, open the Microsoft Management Console (MMC). One way to do this is to type **mmc.exe** from the **Start** menu, right-click **mmc.exe**, and click **Run as administrator**. +1. On your server, open the Microsoft Management Console (MMC). One way to do this is to type **mmc.exe** from the **Start** menu, right-click **mmc.exe**, and click **Run as administrator**. -2. Click **File**, and then click **Add/Remove Snap-in**. +2. Click **File**, and then click **Add/Remove Snap-in**. - ![Add or remove snap-in](images/vsc-02-mmc-add-snap-in.png) + ![Add or remove snap-in](images/vsc-02-mmc-add-snap-in.png) -3. In the available snap-ins list, click **Certificate Templates**, and then click **Add**. +3. In the available snap-ins list, click **Certificate Templates**, and then click **Add**. - ![Add Certificate Templates snap-in](images/vsc-03-add-certificate-templates-snap-in.png) + ![Add Certificate Templates snap-in](images/vsc-03-add-certificate-templates-snap-in.png) -4. Certificate Templates is now located under **Console Root** in the MMC. Double-click it to view all the available certificate templates. +4. Certificate Templates is now located under **Console Root** in the MMC. Double-click it to view all the available certificate templates. -5. Right-click the **Smartcard Logon** template, and click **Duplicate Template**. +5. Right-click the **Smartcard Logon** template, and click **Duplicate Template**. - ![Duplicating the Smartcard Logon template](images/vsc-04-right-click-smartcard-logon-template.png) + ![Duplicating the Smartcard Logon template](images/vsc-04-right-click-smartcard-logon-template.png) -6. On the **Compatibility** tab, under **Certification Authority**, review the selection, and change it if needed. +6. On the **Compatibility** tab, under **Certification Authority**, review the selection, and change it if needed. - ![Compatibility tab, certification authority setting](images/vsc-05-certificate-template-compatibility.png) + ![Compatibility tab, certification authority setting](images/vsc-05-certificate-template-compatibility.png) -7. On the **General** tab: +7. On the **General** tab: - 1. Specify a name, such as **TPM Virtual Smart Card Logon**. + 1. Specify a name, such as **TPM Virtual Smart Card Logon**. - 2. Set the validity period to the desired value. + 2. Set the validity period to the desired value. -8. On the **Request Handling** tab: +8. On the **Request Handling** tab: - 1. Set the **Purpose** to **Signature and smartcard logon**. + 1. Set the **Purpose** to **Signature and smartcard logon**. - 2. Click **Prompt the user during enrollment**. + 2. Click **Prompt the user during enrollment**. -9. On the **Cryptography** tab: +9. On the **Cryptography** tab: - 1. Set the minimum key size to 2048. + 1. Set the minimum key size to 2048. - 2. Click **Requests must use one of the following providers**, and then select **Microsoft Base Smart Card Crypto Provider**. + 2. Click **Requests must use one of the following providers**, and then select **Microsoft Base Smart Card Crypto Provider**. -10. On the **Security** tab, add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated users** group, and then select **Enroll** permissions for them. +10. On the **Security** tab, add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated users** group, and then select **Enroll** permissions for them. -11. Click **OK** to finalize your changes and create the new template. Your new template should now appear in the list of Certificate Templates. +11. Click **OK** to finalize your changes and create the new template. Your new template should now appear in the list of Certificate Templates. -12. Select **File**, then click **Add/Remove Snap-in** to add the Certification Authority snap-in to your MMC console. When asked which computer you want to manage, select the computer on which the CA is located, probably **Local Computer**. +12. Select **File**, then click **Add/Remove Snap-in** to add the Certification Authority snap-in to your MMC console. When asked which computer you want to manage, select the computer on which the CA is located, probably **Local Computer**. ![Add Certification Authority snap-in](images/vsc-06-add-certification-authority-snap-in.png) -13. In the left pane of the MMC, expand **Certification Authority (Local)**, and then expand your CA within the Certification Authority list. +13. In the left pane of the MMC, expand **Certification Authority (Local)**, and then expand your CA within the Certification Authority list. -14. Right-click **Certificate Templates**, click **New**, and then click **Certificate Template to Issue**. +14. Right-click **Certificate Templates**, click **New**, and then click **Certificate Template to Issue**. ![Right-click menu for Certificate Templates](images/vsc-07-right-click-certificate-templates.png) -15. From the list, select the new template that you just created (**TPM Virtual Smart Card Logon**), and then click **OK**. +15. From the list, select the new template that you just created (**TPM Virtual Smart Card Logon**), and then click **OK**. > **Note**  It can take some time for your template to replicate to all servers and become available in this list. ![Selecting a certificate template](images/vsc-08-enable-certificate-template.png) -16. After the template replicates, in the MMC, right-click in the Certification Authority list, click **All Tasks**, and then click **Stop Service**. Then, right-click the name of the CA again, click **All Tasks**, and then click **Start Service**. +16. After the template replicates, in the MMC, right-click in the Certification Authority list, click **All Tasks**, and then click **Stop Service**. Then, right-click the name of the CA again, click **All Tasks**, and then click **Start Service**. ![Stopping and starting the service](images/vsc-09-stop-service-start-service.png) diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md index e95e0215c2..aa61d00b97 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md @@ -1,18 +1,19 @@ --- title: Virtual Smart Card Overview (Windows 10) -description: This topic for IT professional provides an overview of the virtual smart card technology that was developed by Microsoft, and links to additional topics about virtual smart cards. +description: Learn more about the virtual smart card technology that was developed by Microsoft. Find links to additional topics about virtual smart cards. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: conceptual ms.localizationpriority: medium ms.date: 10/13/2017 +ms.reviewer: --- # Virtual Smart Card Overview @@ -25,6 +26,9 @@ This topic for IT professional provides an overview of the virtual smart card te - [Smart Cards](../smart-cards/smart-card-windows-smart-card-technical-reference.md) +> [!NOTE] +> [Windows Hello for Business](../hello-for-business/hello-identity-verification.md) is the modern, two-factor authentication for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date has been set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. We recommend that new Windows 10 deployments use Windows Hello for Business. Virtual smart cards remain supported for Windows 7 and Windows 8. + ## Feature description Virtual smart card technology from Microsoft offers comparable security benefits to physical smart cards by using two-factor authentication. Virtual smart cards emulate the functionality of physical smart cards, but they use the Trusted Platform Module (TPM) chip that is available on computers in many organizations, rather than requiring the use of a separate physical smart card and reader. Virtual smart cards are created in the TPM, where the keys that are used for authentication are stored in cryptographically secured hardware. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md index 55a77a6140..cb25136eb0 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Tpmvscmgr diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index a770e703ca..0194ee2c80 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -1,18 +1,19 @@ --- title: Understanding and Evaluating Virtual Smart Cards (Windows 10) -description: This topic for IT professional provides information about how smart card technology can fit into your authentication design, and provides links to additional topics about virtual smart cards. +description: Learn how smart card technology can fit into your authentication design. Find links to additional topics about virtual smart cards. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 04/19/2017 +ms.reviewer: --- # Understanding and Evaluating Virtual Smart Cards diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index 9e9a8627c3..db7f20bb3e 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.date: 10/13/2017 +ms.reviewer: --- # Use Virtual Smart Cards diff --git a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md index 7b30f32d4d..22355b9383 100644 --- a/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md +++ b/windows/security/identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md @@ -5,10 +5,12 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: shortpatti -ms.author: pashort +author: dulcemontemayor +ms.author: dansimp ms.localizationpriority: medium ms.date: 02/08/2018 +ms.reviewer: +manager: dansimp --- # How to configure Diffie Hellman protocol over IKEv2 VPN connections diff --git a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md index b5fede2f00..a162e20e45 100644 --- a/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md +++ b/windows/security/identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md @@ -5,8 +5,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: justinha +author: dulcemontemayor ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # How to use single sign on (SSO) over VPN and Wi-Fi connections diff --git a/windows/security/identity-protection/vpn/vpn-authentication.md b/windows/security/identity-protection/vpn/vpn-authentication.md index ecd0f4cbd7..9f6f6fa2a5 100644 --- a/windows/security/identity-protection/vpn/vpn-authentication.md +++ b/windows/security/identity-protection/vpn/vpn-authentication.md @@ -5,9 +5,12 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: jdeckerms +author: dulcemontemayor ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # VPN authentication options @@ -59,4 +62,4 @@ The following image shows the field for EAP XML in a Microsoft Intune VPN profil - [VPN name resolution](vpn-name-resolution.md) - [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) - [VPN security features](vpn-security-features.md) -- [VPN profile options](vpn-profile-options.md) \ No newline at end of file +- [VPN profile options](vpn-profile-options.md) diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md index a57b762d3a..09ca26d20e 100644 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md @@ -5,9 +5,12 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: jdeckerms +author: dulcemontemayor ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # VPN auto-triggered profile options @@ -56,7 +59,7 @@ Always On is a feature in Windows 10 which enables the active VPN profile to con When the trigger occurs, VPN tries to connect. If an error occurs or any user input is needed, the user is shown a toast notification for additional interaction. -When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. +When a device has multiple profiles with Always On triggers, the user can specify the active profile in **Settings** > **Network & Internet** > **VPN** > *VPN profile* by selecting the **Let apps automatically use this VPN connection** checkbox. By default, the first MDM-configured profile is marked as **Active**. Devices with multiple users have the same restriction: only one profile and therefore only one user will be able to use the Always On triggers. Preserving user Always On preference diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md index 69944937b7..df414d1e79 100644 --- a/windows/security/identity-protection/vpn/vpn-conditional-access.md +++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md @@ -1,13 +1,13 @@ --- title: VPN and conditional access (Windows 10) -description: The VPN client is now able to integrate with the cloud-based Conditional Access Platform to provide a device compliance option for remote clients. Conditional Access is a policy-based evaluation engine that lets you create access rules for any Azure Active Directory (Azure AD) connected application. +description: Learn how to integrate the VPN client with the Conditional Access Platform, so you can create access rules for Azure Active Directory (Azure AD) connected apps. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: shortpatti -ms.author: pashort -manager: elizapo +author: dulcemontemayor +ms.author: dansimp +manager: dansimp ms.reviewer: ms.localizationpriority: medium ms.date: 03/21/2019 @@ -111,4 +111,4 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](https://msdn.m - [VPN name resolution](vpn-name-resolution.md) - [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) - [VPN security features](vpn-security-features.md) -- [VPN profile options](vpn-profile-options.md) \ No newline at end of file +- [VPN profile options](vpn-profile-options.md) diff --git a/windows/security/identity-protection/vpn/vpn-connection-type.md b/windows/security/identity-protection/vpn/vpn-connection-type.md index 240ea4403e..b6fab222d1 100644 --- a/windows/security/identity-protection/vpn/vpn-connection-type.md +++ b/windows/security/identity-protection/vpn/vpn-connection-type.md @@ -5,9 +5,12 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: jdeckerms +author: dulcemontemayor ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # VPN connection types diff --git a/windows/security/identity-protection/vpn/vpn-guide.md b/windows/security/identity-protection/vpn/vpn-guide.md index 2703ed270a..c72139b6db 100644 --- a/windows/security/identity-protection/vpn/vpn-guide.md +++ b/windows/security/identity-protection/vpn/vpn-guide.md @@ -4,9 +4,12 @@ description: Use this guide to configure VPN deployment for Windows 10. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -author: jdeckerms +author: dulcemontemayor ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Windows 10 VPN technical guide diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md index 42d8fb786f..5c277ef964 100644 --- a/windows/security/identity-protection/vpn/vpn-name-resolution.md +++ b/windows/security/identity-protection/vpn/vpn-name-resolution.md @@ -5,9 +5,12 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: jdeckerms +author: dulcemontemayor ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # VPN name resolution @@ -80,4 +83,4 @@ The fields in **Add or edit DNS rule** in the Intune profile correspond to the X - [VPN and conditional access](vpn-conditional-access.md) - [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) - [VPN security features](vpn-security-features.md) -- [VPN profile options](vpn-profile-options.md) \ No newline at end of file +- [VPN profile options](vpn-profile-options.md) diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md index 3051e37b8b..0206bbd776 100644 --- a/windows/security/identity-protection/vpn/vpn-profile-options.md +++ b/windows/security/identity-protection/vpn/vpn-profile-options.md @@ -1,13 +1,15 @@ --- title: VPN profile options (Windows 10) -description: Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. +description: Windows 10 adds Virtual Private Network (VPN) profile options to help manage how users connect. VPNs give users secure remote access to the company network. ms.assetid: E3F99DF9-863D-4E28-BAED-5C1B1B913523 +ms.reviewer: +manager: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: shortpatti -ms.author: pashort +author: dulcemontemayor +ms.author: dansimp ms.localizationpriority: medium ms.date: 05/17/2018 --- @@ -298,7 +300,7 @@ The following is a sample plug-in VPN profile. This blob would fall under the Pr After you configure the settings that you want using ProfileXML, you can apply it using Intune and a **Custom Configuration (Windows 10 Desktop and Mobile and later)** policy. 1. Sign into the [Azure portal](https://portal.azure.com). -2. Go to **Intune** > **Device Configuration** > **Properties**. +2. Go to **Intune** > **Device Configuration** > **Profiles**. 3. Click **Create Profile**. 4. Enter a name and (optionally) a description. 5. Choose **Windows 10 and later** as the platform. diff --git a/windows/security/identity-protection/vpn/vpn-routing.md b/windows/security/identity-protection/vpn/vpn-routing.md index d39cb4249c..c8ce525e53 100644 --- a/windows/security/identity-protection/vpn/vpn-routing.md +++ b/windows/security/identity-protection/vpn/vpn-routing.md @@ -5,9 +5,12 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: jdeckerms +author: dulcemontemayor ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # VPN routing decisions @@ -66,4 +69,4 @@ Next, in **Corporate Boundaries**, you add the routes that should use the VPN co - [VPN name resolution](vpn-name-resolution.md) - [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) - [VPN security features](vpn-security-features.md) -- [VPN profile options](vpn-profile-options.md) \ No newline at end of file +- [VPN profile options](vpn-profile-options.md) diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index cd409e2b48..18e7b41ec9 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -5,9 +5,12 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, networking -author: jdeckerms +author: dulcemontemayor ms.localizationpriority: medium ms.date: 07/27/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # VPN security features @@ -85,4 +88,4 @@ The following image shows the interface to configure traffic rules in a VPN Prof - [VPN and conditional access](vpn-conditional-access.md) - [VPN name resolution](vpn-name-resolution.md) - [VPN auto-triggered profile options](vpn-auto-trigger-profile.md) -- [VPN profile options](vpn-profile-options.md) \ No newline at end of file +- [VPN profile options](vpn-profile-options.md) diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md index 13fc6ad9e2..26db02bc64 100644 --- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md +++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md @@ -2,13 +2,14 @@ title: Windows 10 Credential Theft Mitigation Guide Abstract (Windows 10) description: Provides a summary of the Windows 10 credential theft mitigation guide. ms.assetid: 821ddc1a-f401-4732-82a7-40d1fff5a78a +ms.reviewer: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security audience: ITPro -author: danihalfin -ms.author: daniha +author: dulcemontemayor +ms.author: dansimp manager: dansimp ms.collection: M365-identity-device-management ms.topic: article @@ -30,7 +31,7 @@ This guide explains how credential theft attacks occur and the strategies and co - Respond to suspicious activity - Recover from a breach -![Security stages](images\security-stages.png) +![Security stages](images/security-stages.png) ## Attacks that steal credentials diff --git a/windows/security/includes/improve-request-performance.md b/windows/security/includes/improve-request-performance.md new file mode 100644 index 0000000000..ddff438e13 --- /dev/null +++ b/windows/security/includes/improve-request-performance.md @@ -0,0 +1,23 @@ +--- +title: Improve request performance +description: Improve request performance +keywords: server, request, performance +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +>[!NOTE] +>For better performance, you can use server closer to your geo location: +> - api-us.securitycenter.windows.com +> - api-eu.securitycenter.windows.com +> - api-uk.securitycenter.windows.com diff --git a/windows/security/includes/machineactionsnote.md b/windows/security/includes/machineactionsnote.md new file mode 100644 index 0000000000..246c89eb92 --- /dev/null +++ b/windows/security/includes/machineactionsnote.md @@ -0,0 +1,13 @@ +--- +title: Perform a Machine Action via the Microsoft Defender ATP API +description: This page focuses on performing a machine action via the Microsoft Defender Advanced Threat Protection (MDATP) API. +ms.date: 08/28/2017 +ms.reviewer: +manager: dansimp +ms.author: macapara +author: mjcaparas +ms.prod: w10 +--- + +>[!Note] +> This page focuses on performing a machine action via API. See [take response actions on a machine](../threat-protection/microsoft-defender-atp/respond-machine-alerts.md) for more information about response actions functionality via Microsoft Defender ATP. diff --git a/windows/security/includes/prerelease.md b/windows/security/includes/prerelease.md new file mode 100644 index 0000000000..a83544340f --- /dev/null +++ b/windows/security/includes/prerelease.md @@ -0,0 +1,13 @@ +--- +title: Microsoft Defender ATP Pre-release Disclaimer +description: Disclaimer for pre-release version of Microsoft Defender ATP. +ms.date: 08/28/2017 +ms.reviewer: +manager: dansimp +ms.author: macapara +author: mjcaparas +ms.prod: w10 +--- + +> [!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. diff --git a/windows/security/information-protection/TOC.md b/windows/security/information-protection/TOC.md index f6f4fac5a3..31855ca5b2 100644 --- a/windows/security/information-protection/TOC.md +++ b/windows/security/information-protection/TOC.md @@ -24,6 +24,17 @@ ### [BitLocker Recovery Guide](bitlocker\bitlocker-recovery-guide-plan.md) ### [BitLocker Countermeasures](bitlocker\bitlocker-countermeasures.md) ### [Protecting cluster shared volumes and storage area networks with BitLocker](bitlocker\protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md) +### Troubleshoot BitLocker +#### [Troubleshoot BitLocker](bitlocker\troubleshoot-bitlocker.md) +#### [BitLocker cannot encrypt a drive: known issues](bitlocker\ts-bitlocker-cannot-encrypt-issues.md) +#### [Enforcing BitLocker policies by using Intune: known issues](bitlocker\ts-bitlocker-intune-issues.md) +#### [BitLocker Network Unlock: known issues](bitlocker\ts-bitlocker-network-unlock-issues.md) +#### [BitLocker recovery: known issues](bitlocker\ts-bitlocker-recovery-issues.md) +#### [BitLocker configuration: known issues](bitlocker\ts-bitlocker-config-issues.md) +#### Troubleshoot BitLocker and TPM issues +##### [BitLocker cannot encrypt a drive: known TPM issues](bitlocker\ts-bitlocker-cannot-encrypt-tpm-issues.md) +##### [BitLocker and TPM: other known issues](bitlocker\ts-bitlocker-tpm-issues.md) +##### [Decode Measured Boot logs to track PCR changes](bitlocker\ts-bitlocker-decode-measured-boot-logs.md) ## [Encrypted Hard Drive](encrypted-hard-drive.md) diff --git a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md index fb5a32c9ae..77709b6ef2 100644 --- a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md @@ -2,13 +2,14 @@ title: BCD settings and BitLocker (Windows 10) description: This topic for IT professionals describes the BCD settings that are used by BitLocker. ms.assetid: c4ab7ac9-16dc-4c7e-b061-c0b0deb2c4fa +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md index 15a2f305ae..65e915649a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md @@ -1,14 +1,15 @@ --- title: BitLocker and Active Directory Domain Services (AD DS) FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +description: Learn more about how BitLocker and Active Directory Domain Services (AD DS) can work together to keep devices secure. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -36,11 +37,19 @@ If BitLocker is enabled on a drive before Group Policy has been applied to enfor For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). -The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the C: drive to AD DS, you would use the following command from an elevated command prompt: **manage-bde -protectors -adbackup C:**. +The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt: -> [!IMPORTANT]   +```PowerShell +$BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive +$RecoveryProtector = $BitLocker.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' } + +Backup-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID +BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $RecoveryProtector.KeyProtectorID +``` + +> [!IMPORTANT] > Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy). -  + ## Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup? Yes, an event log entry that indicates the success or failure of an Active Directory backup is recorded on the client computer. However, even if an event log entry says "Success," the information could have been subsequently removed from AD DS, or BitLocker could have been reconfigured in such a way that the Active Directory information can no longer unlock the drive (such as by removing the recovery password key protector). In addition, it is also possible that the log entry could be spoofed. diff --git a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md index c9ba5464a6..406d096165 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md +++ b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md @@ -2,13 +2,14 @@ title: BitLocker basic deployment (Windows 10) description: This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. ms.assetid: 97c646cb-9e53-4236-9678-354af41151c4 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -30,7 +31,7 @@ BitLocker provides full volume encryption (FVE) for operating system volumes, as In the event that the drive was prepared as a single contiguous space, BitLocker requires a new volume to hold the boot files. BdeHdCfg.exe can create these volumes. > **Note:**  For more info about using this tool, see [Bdehdcfg](https://technet.microsoft.com/library/ee732026.aspx) in the Command-Line Reference. -  + BitLocker encryption can be done using the following methods: - BitLocker control panel @@ -91,7 +92,7 @@ Upon launch, the BitLocker Drive Encryption Wizard verifies the computer meets t -  + Upon passing the initial configuration, users are required to enter a password for the volume. If the volume does not pass the initial configuration for BitLocker, the user is presented with an error dialog describing the appropriate actions to be taken. Once a strong password has been created for the volume, a recovery key will be generated. The BitLocker Drive Encryption Wizard will prompt for a location to save this key. A BitLocker recovery key is a special key that you can create when you turn on BitLocker Drive Encryption for the first time on each drive that you encrypt. You can use the recovery key to gain access to your computer if the drive that Windows is installed on (the operating system drive) is encrypted using BitLocker Drive Encryption and BitLocker detects a condition that prevents it from unlocking the drive when the computer is starting up. A recovery key can also be used to gain access to your files and folders on a removable data drive (such as an external hard drive or USB flash drive) that is encrypted using BitLocker To Go, if for some reason you forget the password or your computer cannot access the drive. @@ -105,7 +106,7 @@ When the recovery key has been properly stored, the BitLocker Drive Encryption W It is recommended that drives with little to no data utilize the **used disk space only** encryption option and that drives with data or an operating system utilize the **encrypt entire drive** option. > **Note:**  Deleted files appear as free space to the file system, which is not encrypted by **used disk space only**. Until they are wiped or overwritten, deleted files hold information that could be recovered with common data forensic tools. -  + Selecting an encryption type and choosing **Next** will give the user the option of running a BitLocker system check (selected by default) which will ensure that BitLocker can properly access the recovery and encryption keys before the volume encryption begins. It is recommended to run this system check before starting the encryption process. If the system check is not run and a problem is encountered when the operating system attempts to start, the user will need to provide the recovery key to start Windows. After completing the system check (if selected), the BitLocker Drive Encryption Wizard will restart the computer to begin encryption. Upon reboot, users are required to enter the password chosen to boot into the operating system volume. Users can check encryption status by checking the system notification area or the BitLocker control panel. @@ -205,7 +206,7 @@ This command returns the volumes on the target, current encryption status and vo For example, suppose that you want to enable BitLocker on a computer without a TPM chip. To properly enable BitLocker for the operating system volume, you will need to use a USB flash drive as a startup key to boot (in this example, the drive letter E). You would first create the startup key needed for BitLocker using the –protectors option and save it to the USB drive on E: and then begin the encryption process. You will need to reboot the computer when prompted to complete the encryption process. -``` syntax +```powershell manage-bde –protectors -add C: -startupkey E: manage-bde -on C: ``` @@ -236,7 +237,7 @@ Data volumes use the same syntax for encryption as operating system volumes but A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on. -``` syntax +```powershell manage-bde -protectors -add -pw C: manage-bde -on C: ``` @@ -370,46 +371,46 @@ Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Us -  + Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets. -A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the `Get-BitLocker` volume cmdlet. The output from this cmdlet displays information on the volume type, protectors, protection status, and other useful information. -Occasionally, all protectors may not be shown when using **Get-BitLockerVolume** due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a listing of the protectors. +A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the Get-BitLocker volume cmdlet. The output from this cmdlet displays information on the volume type, protectors, protection status, and other useful information. +Occasionally, all protectors may not be shown when using Get-BitLockerVolume due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a listing of the protectors. > **Note:**  In the event that there are more than four protectors for a volume, the pipe command may run out of display space. For volumes with more than four protectors, use the method described in the section below to generate a listing of all protectors with protector ID. -  + `Get-BitLockerVolume C: | fl` If you wanted to remove the existing protectors prior to provisioning BitLocker on the volume, you can utilize the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this requires the GUID associated with the protector to be removed. A simple script can pipe the values of each **Get-BitLockerVolume** return out to another variable as seen below: -``` syntax +```powershell $vol = Get-BitLockerVolume $keyprotectors = $vol.KeyProtector ``` Using this, we can display the information in the **$keyprotectors** variable to determine the GUID for each protector. Using this information, we can then remove the key protector for a specific volume using the command: -``` syntax +```powershell Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" ``` > **Note:**  The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. -  + ### Operating system volume Using the BitLocker Windows PowerShell cmdlets is similar to working with the manage-bde tool for encrypting operating system volumes. Windows PowerShell offers users a lot of flexibility. For example, users can add the desired protector as part command for encrypting the volume. Below are examples of common user scenarios and steps to accomplish them using the BitLocker cmdlets for Windows PowerShell. To enable BitLocker with just the TPM protector. This can be done using the command: -``` syntax +```powershell Enable-BitLocker C: ``` The example below adds one additional protector, the StartupKey protectors, and chooses to skip the BitLocker hardware test. In this example, encryption starts immediately without the need for a reboot. -``` syntax +```powershell Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTest ``` ### Data volume Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user defined password. Last, encryption begins. -``` syntax +```powershell $pw = Read-Host -AsSecureString Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw @@ -419,28 +420,28 @@ Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw The ADAccountOrGroup protector is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover and be unlocked to any member computer of the cluster. >**Warning:**  The SID-based protector requires the use of an additional protector (such as TPM, PIN, recovery key, etc.) when used on operating system volumes. -  + To add an ADAccountOrGroup protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. -``` syntax +```powershell Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator ``` For users who wish to use the SID for the account or group, the first step is to determine the SID associated with the account. To get the specific SID for a user account in Windows PowerShell, use the following command: -``` syntax +```powershell get-aduser -filter {samaccountname -eq "administrator"} ``` > **Note:**  Use of this command requires the RSAT-AD-PowerShell feature. -  +> > **Tip:**  In addition to the Windows PowerShell command above, information about the locally logged on user and group membership can be found using: WHOAMI /ALL. This does not require the use of additional features. -  + In the example below, the user wishes to add a domain SID based protector to the previously encrypted operating system volume. The user knows the SID for the user account or group they wish to add and uses the following command: -``` syntax +```powershell Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup "" ``` > **Note:**  Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes. -  + ## Checking BitLocker status To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet, Windows Explorer, manage-bde command line tool, or Windows PowerShell cmdlets. Each option offers different levels of detail and ease of use. We will look at each of the available methods in the following section. @@ -455,7 +456,7 @@ Checking BitLocker status with the control panel is the most common method used | **Off**| BitLocker is not enabled for the volume | | **Suspended** | BitLocker is suspended and not actively protecting the volume | | **Waiting for Activation**| BitLocker is enabled with a clear protector key and requires further action to be fully protected| -  + If a drive is pre-provisioned with BitLocker, a status of "Waiting for Activation" displays with a yellow exclamation icon on volume E. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not in a protected state and needs to have a secure key added to the volume before the drive is fully protected. Administrators can use the control panel, manage-bde tool, or WMI APIs to add an appropriate key protector. Once complete, the control panel will update to reflect the new status. Using the control panel, administrators can choose **Turn on BitLocker** to start the BitLocker Drive Encryption wizard and add a protector, like PIN for an operating system volume (or password if no TPM exists), or a password or smart card protector to a data volume. The drive security window displays prior to changing the volume status. Selecting **Activate BitLocker** will complete the encryption process. @@ -468,18 +469,18 @@ Administrators who prefer a command line interface can utilize manage-bde to che To check the status of a volume using manage-bde, use the following command: -``` syntax +```powershell manage-bde -status ``` > **Note:**  If no volume letter is associated with the -status command, all volumes on the computer display their status. -  + ### Checking BitLocker status with Windows PowerShell Windows PowerShell commands offer another way to query BitLocker status for volumes. Like manage-bde, Windows PowerShell includes the advantage of being able to check the status of a volume on a remote computer. Using the Get-BitLockerVolume cmdlet, each volume on the system will display its current BitLocker status. To get information that is more detailed on a specific volume, use the following command: -``` syntax +```powershell Get-BitLockerVolume -Verbose | fl ``` This command will display information about the encryption method, volume type, key protectors, etc. @@ -505,12 +506,12 @@ Once decryption is complete, the drive will update its status in the control pan Decrypting volumes using manage-bde is very straightforward. Decryption with manage-bde offers the advantage of not requiring user confirmation to start the process. Manage-bde uses the -off command to start the decryption process. A sample command for decryption is: -``` syntax +```powershell manage-bde -off C: ``` This command disables protectors while it decrypts the volume and removes all protectors when decryption is complete. If a user wishes to check the status of the decryption, they can use the following command: -``` syntax +```powershell manage-bde -status C: ``` ### Decrypting volumes using the BitLocker Windows PowerShell cmdlets @@ -519,19 +520,19 @@ Decryption with Windows PowerShell cmdlets is straightforward, similar to manage Using the Disable-BitLocker command, they can remove all protectors and encryption at the same time without the need for additional commands. An example of this command is: -``` syntax +```powershell Disable-BitLocker ``` If a user did not want to input each mount point individually, using the `-MountPoint` parameter in an array can sequence the same command into one line without requiring additional user input. An example command is: -``` syntax +```powershell Disable-BitLocker -MountPoint E:,F:,G: ``` ## See also -- [Prepare your organization for BitLocker: Planning and p\\olicies](prepare-your-organization-for-bitlocker-planning-and-policies.md) +- [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md) - [BitLocker recovery guide](bitlocker-recovery-guide-plan.md) - [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md) - [BitLocker overview](bitlocker-overview.md) -  -  + + diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index 8f4bf8f1e5..ab57ef7b30 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -2,13 +2,14 @@ title: BitLocker Countermeasures (Windows 10) description: Windows uses technologies including TPM, Secure Boot, Trusted Boot, and Early Launch Antimalware (ELAM) to protect against attacks on the BitLocker encryption key. ms.assetid: ebdb0637-2597-4da1-bb18-8127964686ea +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -30,7 +31,7 @@ BitLocker helps mitigate unauthorized data access on lost or stolen computers be - **Encrypting volumes on your computer.** For example, you can turn on BitLocker for your operating system volume, or a volume on a fixed or removable data drive (such as a USB flash drive, SD card, and so on). Turning on BitLocker for your operating system volume encrypts all system files on the volume, including the paging files and hibernation files. The only exception is for the System partition, which includes the Windows Boot Manager and minimal boot collateral required for decryption of the operating system volume after the key is unsealed. - **Ensuring the integrity of early boot components and boot configuration data.** On devices that have a TPM version 1.2 or higher, BitLocker uses the enhanced security capabilities of the TPM to make data accessible only if the computer’s BIOS firmware code and configuration, original boot sequence, boot components, and BCD configuration all appear unaltered and the encrypted disk is located in the original computer. On systems that leverage TPM PCR[7], BCD setting changes deemed safe are permitted to improve usability. -  + The next sections provide more details about how Windows protects against various attacks on the BitLocker encryption keys in Windows 10, Windows 8.1, and Windows 8. For more information about how to enable the best overall security configuration for devices beginning with Windows 10 version 1803, see [Standards for a highly secure Windows 10 device](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-highly-secure). @@ -112,9 +113,9 @@ You can use the System Information desktop app (MSINFO32) to check if a device h If kernel DMA protection *not* enabled, follow these steps to protect Thunderbolt™ 3 enabled ports: -1. Require a password for BIOS changes -2. Intel Thunderbolt Security must be set to User Authorization in BIOS settings. Please refer to [Intel Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating System documentation](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) -3. Additional DMA security may be added by deploying policy (beginning with Windows 10 version 1607): +1. Require a password for BIOS changes +2. Intel Thunderbolt Security must be set to User Authorization in BIOS settings. Please refer to [Intel Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating System documentation](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) +3. Additional DMA security may be added by deploying policy (beginning with Windows 10 version 1607): - MDM: [DataProtection/AllowDirectMemoryAccess](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-dataprotection#dataprotection-allowdirectmemoryaccess) policy - Group Policy: [Disable new DMA devices when this computer is locked](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#disable-new-dma-devices-when-this-computer-is-locked) (This setting is not configured by default.) diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md index 4dddbd05fe..f8fa65855e 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-and-administration-faq.md @@ -1,14 +1,15 @@ --- -title: BitLocker frequently asked questions (FAQ) (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +title: BitLocker deployment and administration FAQ (Windows 10) +description: Browse frequently asked questions about BitLocker deployment and administration, such as, "Can BitLocker deployment be automated in an enterprise environment?" ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md index 2cb23707fe..e4fb0170b4 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md +++ b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md @@ -6,13 +6,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.reviewer: --- # Overview of BitLocker Device Encryption in Windows 10 @@ -21,7 +22,6 @@ ms.date: 02/28/2019 - Windows 10 This topic explains how BitLocker Device Encryption can help protect data on devices running Windows 10. -For an architectural overview about how BitLocker Device Encryption works with Secure Boot, see [Secure boot and BitLocker Device Encryption overview](https://docs.microsoft.com/windows-hardware/drivers/bringup/secure-boot-and-device-encryption-overview). For a general overview and list of topics about BitLocker, see [BitLocker](bitlocker-overview.md). When users travel, their organization’s confidential data goes with them. Wherever confidential data is stored, it must be protected against unauthorized access. Windows has a long history of providing at-rest data-protection solutions that guard against nefarious attackers, beginning with the Encrypting File System in the Windows 2000 operating system. More recently, BitLocker has provided encryption for full drives and portable drives. Windows consistently improves data protection by improving existing options and by providing new strategies. diff --git a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md index 8ffbf8ec53..3c5449bfe9 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md +++ b/windows/security/information-protection/bitlocker/bitlocker-frequently-asked-questions.md @@ -1,14 +1,15 @@ --- -title: BitLocker frequently asked questions (FAQ) (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +title: BitLocker FAQ (Windows 10) +description: Find the answers you need by exploring this brief hub page listing FAQ pages for various aspects of BitLocker. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index f1d02e941e..09d6973301 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -2,31 +2,32 @@ title: BitLocker Group Policy settings (Windows 10) description: This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. ms.assetid: 4904e336-29fe-4cef-bb6c-3950541864af +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 04/02/2019 +ms.date: 04/17/2019 --- # BitLocker Group Policy settings **Applies to** -- Windows 10 +- Windows 10 This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. To control what drive encryption tasks the user can perform from the Windows Control Panel or to modify other configuration options, you can use Group Policy administrative templates or local computer policy settings. How you configure these policy settings depends on how you implement BitLocker and what level of user interaction will be allowed. ->**Note:**  A separate set of Group Policy settings supports the use of the Trusted Platform Module (TPM). For details about those settings, see [Trusted Platform Module Group Policy settings](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings). -  +>**Note:** A separate set of Group Policy settings supports the use of the Trusted Platform Module (TPM). For details about those settings, see [Trusted Platform Module Group Policy settings](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings). + BitLocker Group Policy settings can be accessed using the Local Group Policy Editor and the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. Most of the BitLocker Group Policy settings are applied when BitLocker is initially turned on for a drive. If a computer is not compliant with existing Group Policy settings, BitLocker may not be turned on or modified until the computer is in a compliant state. When a drive is out of compliance with Group Policy settings (for example, if a Group Policy setting was changed after the initial BitLocker deployment in your organization, and then the setting was applied to previously encrypted drives), no change can be made to the BitLocker configuration of that drive except a change that will bring it into compliance. @@ -47,7 +48,7 @@ The following policy settings can be used to determine how a BitLocker-protected - [Disable new DMA devices when this computer is locked](#disable-new-dma-devices-when-this-computer-is-locked) - [Disallow standard users from changing the PIN or password](#bkmk-dpinchange) - [Configure use of passwords for operating system drives](#bkmk-ospw) -- [Require additional authentication at startup (Windows Server 2008 and Windows Vista)](#bkmk-unlockpol4) +- [Require additional authentication at startup (Windows Server 2008 and Windows Vista)](#bkmk-unlockpol4) - [Configure use of smart cards on fixed data drives](#bkmk-unlockpol5) - [Configure use of passwords on fixed data drives](#bkmk-unlockpol6) - [Configure use of smart cards on removable data drives](#bkmk-unlockpol7) @@ -74,8 +75,8 @@ The following policy settings determine the encryption methods and encryption ty The following policy settings define the recovery methods that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unable to be used. - [Choose how BitLocker-protected operating system drives can be recovered](#bkmk-rec1) -- [Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)](#bkmk-rec2) -- [Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)](#bkmk-rec3) +- [Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista)](#bkmk-rec2) +- [Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)](#bkmk-rec3) - [Choose default folder for recovery password](#bkmk-rec4) - [Choose how BitLocker-protected fixed drives can be recovered](#bkmk-rec6) - [Choose how BitLocker-protected removable drives can be recovered](#bkmk-rec7) @@ -87,7 +88,7 @@ The following policies are used to support customized deployment scenarios in yo - [Provide the unique identifiers for your organization](#bkmk-depopt1) - [Prevent memory overwrite on restart](#bkmk-depopt2) - [Configure TPM platform validation profile for BIOS-based firmware configurations](#bkmk-tpmbios) -- [Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2)](#bkmk-depopt3) +- [Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2)](#bkmk-depopt3) - [Configure TPM platform validation profile for native UEFI firmware configurations](#bkmk-tpmvaluefi) - [Reset platform validation data after BitLocker recovery](#bkmk-resetrec) - [Use enhanced Boot Configuration Data validation profile](#bkmk-enbcd) @@ -122,7 +123,7 @@ This policy setting allows users on devices that are compliant with Modern Stand

                                    Conflicts

                                    -

                                    This setting overrides the Require startup PIN with TPM option of the [Require additional authentication at startup](#bkmk-unlockpol1) policy on compliant hardware. +

                                    This setting overrides the Require startup PIN with TPM option of the Require additional authentication at startup policy on compliant hardware.

                                    @@ -132,12 +133,12 @@ This policy setting allows users on devices that are compliant with Modern Stand

                                    When disabled or not configured

                                    -

                                    The options of the [Require additional authentication at startup](#bkmk-unlockpol1) policy apply.

                                    +

                                    The options of the Require additional authentication at startup policy apply.

                                    -  -**Reference** + +Reference The preboot authentication option Require startup PIN with TPM of the [Require additional authentication at startup](#bkmk-unlockpol1) policy is often enabled to help ensure security for older devices that do not support Modern Standby. But visually impaired users have no audible way to know when to enter a PIN. @@ -184,13 +185,13 @@ This policy is used in addition to the BitLocker Drive Encryption Network Unlock -  -**Reference** + +Reference To use a network key protector to unlock the computer, the computer and the server that hosts BitLocker Drive Encryption Network Unlock must be provisioned with a Network Unlock certificate. The Network Unlock certificate is used to create a network key protector and to protect the information exchange with the server to unlock the computer. You can use the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate** on the domain controller to distribute this certificate to computers in your organization. This unlock method uses the TPM on the computer, so computers that do not have a TPM cannot create network key protectors to automatically unlock by using Network Unlock. ->**Note:**  For reliability and security, computers should also have a TPM startup PIN that can be used when the computer is disconnected from the wired network or cannot connect to the domain controller at startup. -  +>**Note:** For reliability and security, computers should also have a TPM startup PIN that can be used when the computer is disconnected from the wired network or cannot connect to the domain controller at startup. + For more information about Network Unlock, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). ### Require additional authentication at startup @@ -209,7 +210,7 @@ This policy setting is used to control which unlock options are available for op

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -235,16 +236,16 @@ This policy setting is used to control which unlock options are available for op -  -**Reference** -If you want to use BitLocker on a computer without a TPM, select the **Allow BitLocker without a compatible TPM** check box. In this mode, a USB drive is required for startup. Key information that is used to encrypt the drive is stored on the USB drive, which creates a USB key. When the USB key is inserted, access to the drive is authenticated and the drive is accessible. If the USB key is lost or unavailable, you need to use one of the BitLocker recovery options to access the drive. +Reference -On a computer with a compatible TPM, four types of authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can use: +If you want to use BitLocker on a computer without a TPM, select **Allow BitLocker without a compatible TPM**. In this mode, a password or USB drive is required for startup. The USB drive stores the startup key that is used to encrypt the drive. When the USB drive is inserted, the startup key is authenticated and the operating system drive is accessible. If the USB drive is lost or unavailable, BitLocker recovery is required to access the drive. -- only the TPM for authentication +On a computer with a compatible TPM, additional authentication methods can be used at startup to improve protection for encrypted data. When the computer starts, it can use: + +- only the TPM - insertion of a USB flash drive containing the startup key -- the entry of a 4-digit to 20-digit personal identification number (PIN) +- the entry of a 4-digit to 20-digit personal identification number (PIN) - a combination of the PIN and the USB flash drive There are four options for TPM-enabled computers or devices: @@ -286,7 +287,7 @@ This policy setting permits the use of enhanced PINs when you use an unlock meth

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -310,14 +311,14 @@ This policy setting permits the use of enhanced PINs when you use an unlock meth -  + **Reference** Enhanced startup PINs permit the use of characters (including uppercase and lowercase letters, symbols, numbers, and spaces). This policy setting is applied when you turn on BitLocker. ->**Important:**  Not all computers support enhanced PIN characters in the preboot environment. It is strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used. -  +>**Important:** Not all computers support enhanced PIN characters in the preboot environment. It is strongly recommended that users perform a system check during the BitLocker setup to verify that enhanced PIN characters can be used. + ### Configure minimum PIN length for startup This policy setting is used to set a minimum PIN length when you use an unlock method that includes a PIN. @@ -330,11 +331,11 @@ This policy setting is used to set a minimum PIN length when you use an unlock m

                                    Policy description

                                    -

                                    With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.

                                    +

                                    With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -354,15 +355,15 @@ This policy setting is used to set a minimum PIN length when you use an unlock m

                                    When disabled or not configured

                                    -

                                    Users can configure a startup PIN of any length between 6 and 20 digits.

                                    +

                                    Users can configure a startup PIN of any length between 6 and 20 digits.

                                    -  -**Reference** + +Reference This policy setting is applied when you turn on BitLocker. -The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits. +The startup PIN must have a minimum length of 4 digits and can have a maximum length of 20 digits. Originally, BitLocker allowed from 4 to 20 characters for a PIN. Windows Hello has its own PIN for logon, which can be 4 to 127 characters. @@ -392,14 +393,14 @@ This policy setting allows you to block direct memory access (DMA) for all hot p | **Policy description** | This setting helps prevent attacks that use external PCI-based devices to access BitLocker keys. | | **Introduced** | Windows 10, version 1703 | | **Drive type** | Operating system drives | -| **Policy path** | Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +| **Policy path** | Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| | **Conflicts** | None | | **When enabled** | Every time the user locks the screen, DMA will be blocked on hot pluggable PCI ports until the user signs in again. | | **When disabled or not configured** | DMA is available on hot pluggable PCI devices if the device is turned on, regardless of whether a user is signed in.| **Reference** -This policy setting is only enforced when BitLocker or device encyption is enabled. As explained in the [Microoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2018/01/18/issue-with-bitlockerdma-setting-in-windows-10-fall-creators-update-v1709/), in some cases when this setting is enabled, internal, PCI-based peripherals can fail, including wireless network drivers and input and audio peripherals. This problem is fixed in the [April 2018 quality update](https://support.microsoft.com/help/4093105/windows-10-update-kb4093105). +This policy setting is only enforced when BitLocker or device encryption is enabled. As explained in the [Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2018/01/18/issue-with-bitlockerdma-setting-in-windows-10-fall-creators-update-v1709/), in some cases when this setting is enabled, internal, PCI-based peripherals can fail, including wireless network drivers and input and audio peripherals. This problem is fixed in the [April 2018 quality update](https://support.microsoft.com/help/4093105/windows-10-update-kb4093105). ### Disallow standard users from changing the PIN or password @@ -441,7 +442,7 @@ This policy setting allows you to configure whether standard users are allowed t -  + **Reference** @@ -477,11 +478,10 @@ This policy controls how non-TPM based systems utilize the password protector. U

                                    Conflicts

                                    Passwords cannot be used if FIPS-compliance is enabled.

                                    -Note   -

                                    The System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing policy setting, which is located at Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options specifies whether FIPS-compliance is enabled.

                                    +Note

                                    The System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing policy setting, which is located at Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options specifies whether FIPS-compliance is enabled.

                                    -  +
                                    @@ -494,14 +494,14 @@ This policy controls how non-TPM based systems utilize the password protector. U -  + **Reference** If non-TPM protectors are allowed on operating system drives, you can provision a password, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\** must be also enabled. ->**Note:**  These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. -  +>**Note:** These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. + When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. If no domain controllers are found, the password will be accepted regardless of actual password complexity, and the drive will be encrypted by using that password as a protector. When set to **Do not allow complexity**, there is no password complexity validation. Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. @@ -511,9 +511,9 @@ When this policy setting is enabled, you can set the option **Configure password - Do not allow password complexity - Require password complexity -### Require additional authentication at startup (Windows Server 2008 and Windows Vista) +### Require additional authentication at startup (Windows Server 2008 and Windows Vista) -This policy setting is used to control what unlock options are available for computers running Windows Server 2008 or Windows Vista. +This policy setting is used to control what unlock options are available for computers running Windows Server 2008 or Windows Vista. @@ -523,15 +523,15 @@ This policy setting is used to control what unlock options are available for com - + - + - + @@ -551,10 +551,10 @@ This policy setting is used to control what unlock options are available for com

                                    Policy description

                                    With this policy setting, you can control whether the BitLocker Setup Wizard on computers running Windows Vista or Windows Server 2008 can set up an additional authentication method that is required each time the computer starts.

                                    With this policy setting, you can control whether the BitLocker Setup Wizard on computers running Windows Vista or Windows Server 2008 can set up an additional authentication method that is required each time the computer starts.

                                    Introduced

                                    Windows Server 2008 and Windows Vista

                                    Windows Server 2008 and Windows Vista

                                    Drive type

                                    Operating system drives (Windows Server 2008 and Windows Vista)

                                    Operating system drives (Windows Server 2008 and Windows Vista)

                                    Policy path
                                    -  -**Reference** -On a computer with a compatible TPM, two authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can require users to insert a USB drive that contains a startup key. It can also require users to enter a 6-digit to 20-digit startup PIN. +Reference + +On a computer with a compatible TPM, two authentication methods can be used at startup to provide added protection for encrypted data. When the computer starts, it can require users to insert a USB drive that contains a startup key. It can also require users to enter a 6-digit to 20-digit startup PIN. A USB drive that contains a startup key is needed on computers without a compatible TPM. Without a TPM, BitLocker-encrypted data is protected solely by the key material that is on this USB drive. @@ -591,7 +591,7 @@ This policy setting is used to require, allow, or deny the use of smart cards wi

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -619,11 +619,11 @@ This policy setting is used to require, allow, or deny the use of smart cards wi -  -**Reference** ->**Note:**  These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive by using any of the protectors that are available on the drive. -  +Reference + +>**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive by using any of the protectors that are available on the drive. + ### Configure use of passwords on fixed data drives This policy setting is used to require, allow, or deny the use of passwords with fixed data drives. @@ -640,7 +640,7 @@ This policy setting is used to require, allow, or deny the use of passwords with

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -668,8 +668,8 @@ This policy setting is used to require, allow, or deny the use of passwords with -  -**Reference** + +Reference When set to **Require complexity**, a connection to a domain controller is necessary to validate the complexity of the password when BitLocker is enabled. @@ -679,15 +679,15 @@ When set to **Do not allow complexity**, no password complexity validation is pe Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. ->**Note:**  These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. -  +>**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. + For the complexity requirement setting to be effective, the Group Policy setting **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Password must meet complexity requirements** must also be enabled. This policy setting is configured on a per-computer basis. This means that it applies to local user accounts and domain user accounts. Because the password filter that is used to validate password complexity is located on the domain controllers, local user accounts cannot access the password filter because they are not authenticated for domain access. When this policy setting is enabled, if you sign in with a local user account, and you attempt to encrypt a drive or change a password on an existing BitLocker-protected drive, an "Access denied" error message is displayed. In this situation, the password key protector cannot be added to the drive. Enabling this policy setting requires that connectivity to a domain be established before adding a password key protector to a BitLocker-protected drive. Users who work remotely and have periods of time in which they cannot connect to the domain should be made aware of this requirement so that they can schedule a time when they will be connected to the domain to turn on BitLocker or to change a password on a BitLocker-protected data drive. ->**Important:**  Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. -  +>**Important:** Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. + ### Configure use of smart cards on removable data drives This policy setting is used to require, allow, or deny the use of smart cards with removable data drives. @@ -704,7 +704,7 @@ This policy setting is used to require, allow, or deny the use of smart cards wi

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -732,11 +732,11 @@ This policy setting is used to require, allow, or deny the use of smart cards wi -  -**Reference** ->**Note:**  These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. -  +Reference + +>**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. + ### Configure use of passwords on removable data drives This policy setting is used to require, allow, or deny the use of passwords with removable data drives. @@ -753,7 +753,7 @@ This policy setting is used to require, allow, or deny the use of passwords with

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -781,14 +781,14 @@ This policy setting is used to require, allow, or deny the use of passwords with -  -**Reference** + +Reference If you choose to allow the use of a password, you can require a password to be used, enforce complexity requirements, and configure a minimum length. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** must also be enabled. ->**Note:**  These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. -  +>**Note:** These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. + Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. When set to **Require complexity**, a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. @@ -797,8 +797,8 @@ When set to **Allow complexity**, a connection to a domain controller will be at When set to **Do not allow complexity**, no password complexity validation will be done. ->**Note:**  Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. -  +>**Note:** Passwords cannot be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in **Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** specifies whether FIPS compliance is enabled. + For information about this setting, see [System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing](https://technet.microsoft.com/library/jj852211.aspx). ### Validate smart card certificate usage rule compliance @@ -817,7 +817,7 @@ This policy setting is used to determine what certificate to use with BitLocker.

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -841,8 +841,8 @@ This policy setting is used to determine what certificate to use with BitLocker. -  -**Reference** + +Reference This policy setting is applied when you turn on BitLocker. @@ -850,8 +850,8 @@ The object identifier is specified in the enhanced key usage (EKU) of a certific The default object identifier is 1.3.6.1.4.1.311.67.1.1. ->**Note:**  BitLocker does not require that a certificate have an EKU attribute; however, if one is configured for the certificate, it must be set to an object identifier that matches the object identifier configured for BitLocker. -  +>**Note:** BitLocker does not require that a certificate have an EKU attribute; however, if one is configured for the certificate, it must be set to an object identifier that matches the object identifier configured for BitLocker. + ### Enable use of BitLocker authentication requiring preboot keyboard input on slates This policy setting allows users to enable authentication options that require user input from the preboot environment even if the platform indicates a lack of preboot input capability. @@ -892,8 +892,8 @@ This policy setting allows users to enable authentication options that require u -  -**Reference** + +Reference The Windows touch keyboard (such as used by tablets) is not available in the preboot environment where BitLocker requires additional information, such as a PIN or password. @@ -923,7 +923,7 @@ This policy setting is used to require encryption of fixed drives prior to grant

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -947,8 +947,8 @@ This policy setting is used to require encryption of fixed drives prior to grant -  -**Reference** + +Reference This policy setting is applied when you turn on BitLocker. @@ -978,7 +978,7 @@ This policy setting is used to require that removable drives are encrypted prior

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -1002,13 +1002,13 @@ This policy setting is used to require that removable drives are encrypted prior -  -**Reference** + +Reference If the **Deny write access to devices configured in another organization** option is selected, only drives with identification fields that match the computer's identification fields are given Write access. When a removable data drive is accessed, it is checked for a valid identification field and allowed identification fields. These fields are defined by the **Provide the unique identifiers for your organization** policy setting. ->**Note:**  You can override this policy setting with the policy settings under **User Configuration\\Administrative Templates\\System\\Removable Storage Access**. If the **Removable Disks: Deny write access** policy setting is enabled, this policy setting will be ignored. -  +>**Note:** You can override this policy setting with the policy settings under **User Configuration\\Administrative Templates\\System\\Removable Storage Access**. If the **Removable Disks: Deny write access** policy setting is enabled, this policy setting will be ignored. + Conflict considerations include: 1. Use of BitLocker with the TPM plus a startup key or with the TPM plus a PIN and startup key must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. @@ -1031,7 +1031,7 @@ This policy setting is used to prevent users from turning BitLocker on or off on

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -1059,8 +1059,8 @@ This policy setting is used to prevent users from turning BitLocker on or off on -  -**Reference** + +Reference This policy setting is applied when you turn on BitLocker. @@ -1068,8 +1068,8 @@ For information about suspending BitLocker protection, see [BitLocker Basic Depl The options for choosing property settings that control how users can configure BitLocker are: -- **Allow users to apply BitLocker protection on removable data drives**   Enables the user to run the BitLocker Setup Wizard on a removable data drive. -- **Allow users to suspend and decrypt BitLocker on removable data drives**   Enables the user to remove BitLocker from the drive or to suspend the encryption while performing maintenance. +- **Allow users to apply BitLocker protection on removable data drives** Enables the user to run the BitLocker Setup Wizard on a removable data drive. +- **Allow users to suspend and decrypt BitLocker on removable data drives** Enables the user to remove BitLocker from the drive or to suspend the encryption while performing maintenance. ### Choose drive encryption method and cipher strength @@ -1111,8 +1111,8 @@ This policy setting is used to control the encryption method and cipher strength -  -**Reference** + +Reference The values of this policy determine the strength of the cipher that BitLocker uses for encryption. Enterprises may want to control the encryption level for increased security (AES-256 is stronger than AES-128). @@ -1123,8 +1123,8 @@ For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the d Changing the encryption method has no effect if the drive is already encrypted or if encryption is in progress. In these cases, this policy setting is ignored. ->**Warning:**  This policy does not apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning. -  +>**Warning:** This policy does not apply to encrypted drives. Encrypted drives utilize their own algorithm, which is set by the drive during partitioning. + When this policy setting is disabled or not configured, BitLocker will use the default encryption method of XTS-AES 128-bit or the encryption method that is specified in the setup script. ### Configure use of hardware-based encryption for fixed data drives @@ -1172,15 +1172,15 @@ This policy controls how BitLocker reacts to systems that are equipped with encr -  -**Reference** ->**Note:**  The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. -  +Reference + +>**Note:** The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. + The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: -- Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 -- AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 +- Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 +- AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 ### Configure use of hardware-based encryption for operating system drives @@ -1226,17 +1226,17 @@ This policy controls how BitLocker reacts when encrypted drives are used as oper -  -**Reference** + +Reference If hardware-based encryption is not available, BitLocker software-based encryption is used instead. ->**Note:**  The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. -  +>**Note:** The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. + The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: -- Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 -- AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 +- Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 +- AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 ### Configure use of hardware-based encryption for removable data drives @@ -1282,17 +1282,17 @@ This policy controls how BitLocker reacts to encrypted drives when they are used -  -**Reference** + +Reference If hardware-based encryption is not available, BitLocker software-based encryption is used instead. ->**Note:**  The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. -  +>**Note:** The **Choose drive encryption method and cipher strength** policy setting does not apply to hardware-based encryption. + The encryption algorithm that is used by hardware-based encryption is set when the drive is partitioned. By default, BitLocker uses the algorithm that is configured on the drive to encrypt the drive. The **Restrict encryption algorithms and cipher suites allowed for hardware-based encryption** option of this setting enables you to restrict the encryption algorithms that BitLocker can use with hardware encryption. If the algorithm that is set for the drive is not available, BitLocker disables the use of hardware-based encryption. Encryption algorithms are specified by object identifiers (OID), for example: -- Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 -- AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 +- Advanced Encryption Standard (AES) 128 in Cipher Block Chaining (CBC) mode OID: 2.16.840.1.101.3.4.1.2 +- AES 256 in CBC mode OID: 2.16.840.1.101.3.4.1.42 ### Enforce drive encryption type on fixed data drives @@ -1334,13 +1334,13 @@ This policy controls whether fixed data drives utilize Used Space Only encryptio -  -**Reference** + +Reference This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. ->**Note:**  This policy is ignored when you are shrinking or expanding a volume and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. -  +>**Note:** This policy is ignored when you are shrinking or expanding a volume and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. + For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). ### Enforce drive encryption type on operating system drives @@ -1383,13 +1383,13 @@ This policy controls whether operating system drives utilize Full encryption or -  -**Reference** + +Reference This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. ->**Note:**  This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. -  +>**Note:** This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that uses Full encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. + For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). ### Enforce drive encryption type on removable data drives @@ -1432,13 +1432,13 @@ This policy controls whether fixed data drives utilize Full encryption or Used S -  -**Reference** + +Reference This policy setting is applied when you turn on BitLocker. Changing the encryption type has no effect if the drive is already encrypted or if encryption is in progress. Choose Full encryption to require that the entire drive be encrypted when BitLocker is turned on. Choose Used Space Only encryption to require that only the portion of the drive that is used to store data is encrypted when BitLocker is turned on. ->**Note:**  This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full Encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. -  +>**Note:** This policy is ignored when shrinking or expanding a volume, and the BitLocker driver uses the current encryption method. For example, when a drive that is using Used Space Only encryption is expanded, the new free space is not wiped as it would be for a drive that is using Full Encryption. The user could wipe the free space on a Used Space Only drive by using the following command: **manage-bde -w**. If the volume is shrunk, no action is taken for the new free space. + For more information about the tool to manage BitLocker, see [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx). ### Choose how BitLocker-protected operating system drives can be recovered @@ -1457,7 +1457,7 @@ This policy setting is used to configure recovery methods for operating system d

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -1478,12 +1478,12 @@ This policy setting is used to configure recovery methods for operating system d

                                    When disabled or not configured

                                    -

                                    The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.

                                    +

                                    The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.

                                    -  -**Reference** + +Reference This policy setting is applied when you turn on BitLocker. @@ -1496,15 +1496,15 @@ In **Configure user storage of BitLocker recovery information**, select whether Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you will not be able to specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. -In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS) for operating system drives. If you select **Store recovery password and key packages**, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that is physically corrupted. If you select **Store recovery password only**, only the recovery password is stored in AD DS. +In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS) for operating system drives. If you select **Store recovery password and key packages**, the BitLocker recovery password and the key package are stored in AD DS. Storing the key package supports recovering data from a drive that is physically corrupted. If you select **Store recovery password only**, only the recovery password is stored in AD DS. -Select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. +Select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. ->**Note:**  If the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box is selected, a recovery password is automatically generated. -  -### Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista) +>**Note:** If the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** check box is selected, a recovery password is automatically generated. -This policy setting is used to configure recovery methods for BitLocker-protected drives on computers running Windows Server 2008 or Windows Vista. +### Choose how users can recover BitLocker-protected drives (Windows Server 2008 and Windows Vista) + +This policy setting is used to configure recovery methods for BitLocker-protected drives on computers running Windows Server 2008 or Windows Vista. @@ -1518,11 +1518,11 @@ This policy setting is used to configure recovery methods for BitLocker-protecte - + - + @@ -1530,7 +1530,7 @@ This policy setting is used to configure recovery methods for BitLocker-protecte - + @@ -1542,23 +1542,23 @@ This policy setting is used to configure recovery methods for BitLocker-protecte

                                    Introduced

                                    Windows Server 2008 and Windows Vista

                                    Windows Server 2008 and Windows Vista

                                    Drive type

                                    Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista

                                    Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista

                                    Policy path

                                    Conflicts

                                    This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If you choose the Do not allow option for both user recovery options, you must enable the Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista) policy setting to prevent a policy error.

                                    This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If you choose the Do not allow option for both user recovery options, you must enable the Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista) policy setting to prevent a policy error.

                                    When enabled
                                    -  -**Reference** -This policy is only applicable to computers running Windows Server 2008 or Windows Vista. This policy setting is applied when you turn on BitLocker. +Reference -Two recovery options can be used to unlock BitLocker-encrypted data in the absence of the required startup key information. Users can type a 48-digit numerical recovery password, or they can insert a USB drive that contains a 256-bit recovery key. +This policy is only applicable to computers running Windows Server 2008 or Windows Vista. This policy setting is applied when you turn on BitLocker. -Saving the recovery password to a USB drive stores the 48-digit recovery password as a text file and the 256-bit recovery key as a hidden file. Saving it to a folder stores the 48-digit recovery password as a text file. Printing it sends the 48-digit recovery password to the default printer. For example, not allowing the 48-digit recovery password prevents users from printing or saving recovery information to a folder. +Two recovery options can be used to unlock BitLocker-encrypted data in the absence of the required startup key information. Users can type a 48-digit numerical recovery password, or they can insert a USB drive that contains a 256-bit recovery key. ->**Important:**  If TPM initialization is performed during the BitLocker setup, TPM owner information is saved or printed with the BitLocker recovery information. -The 48-digit recovery password is not available in FIPS-compliance mode. -  ->**Important:**  To prevent data loss, you must have a way to recover BitLocker encryption keys. If you do not allow both recovery options, you must enable the backup of BitLocker recovery information to AD DS. Otherwise, a policy error occurs. -  -### Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista) +Saving the recovery password to a USB drive stores the 48-digit recovery password as a text file and the 256-bit recovery key as a hidden file. Saving it to a folder stores the 48-digit recovery password as a text file. Printing it sends the 48-digit recovery password to the default printer. For example, not allowing the 48-digit recovery password prevents users from printing or saving recovery information to a folder. -This policy setting is used to configure the storage of BitLocker recovery information in AD DS. This provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. +> **Important:** If TPM initialization is performed during the BitLocker setup, TPM owner information is saved or printed with the BitLocker recovery information. +> The 48-digit recovery password is not available in FIPS-compliance mode. +> +> **Important:** To prevent data loss, you must have a way to recover BitLocker encryption keys. If you do not allow both recovery options, you must enable the backup of BitLocker recovery information to AD DS. Otherwise, a policy error occurs. + +### Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista) + +This policy setting is used to configure the storage of BitLocker recovery information in AD DS. This provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. @@ -1568,15 +1568,15 @@ This policy setting is used to configure the storage of BitLocker recovery infor - + - + - + @@ -1588,28 +1588,28 @@ This policy setting is used to configure the storage of BitLocker recovery infor - + - +

                                    Policy description

                                    With this policy setting, you can manage the AD DS backup of BitLocker Drive Encryption recovery information.

                                    With this policy setting, you can manage the AD DS backup of BitLocker Drive Encryption recovery information.

                                    Introduced

                                    Windows Server 2008 and Windows Vista

                                    Windows Server 2008 and Windows Vista

                                    Drive type

                                    Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista.

                                    Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista.

                                    Policy path

                                    When enabled

                                    BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.

                                    BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.

                                    When disabled or not configured

                                    BitLocker recovery information is not backed up to AD DS.

                                    BitLocker recovery information is not backed up to AD DS.
                                    -  -**Reference** -This policy is only applicable to computers running Windows Server 2008 or Windows Vista. +Reference + +This policy is only applicable to computers running Windows Server 2008 or Windows Vista. This policy setting is applied when you turn on BitLocker. BitLocker recovery information includes the recovery password and unique identifier data. You can also include a package that contains an encryption key for a BitLocker-protected drive. This key package is secured by one or more recovery passwords, and it can help perform specialized recovery when the disk is damaged or corrupted. -If you select **Require BitLocker backup to AD DS**, BitLocker cannot be turned on unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. This option is selected by default to help ensure that BitLocker recovery is possible. +If you select **Require BitLocker backup to AD DS**, BitLocker cannot be turned on unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. This option is selected by default to help ensure that BitLocker recovery is possible. A recovery password is a 48-digit number that unlocks access to a BitLocker-protected drive. A key package contains a drive’s BitLocker encryption key, which is secured by one or more recovery passwords. Key packages may help perform specialized recovery when the disk is damaged or corrupted. -If the **Require BitLocker backup to AD DS** option is not selected, AD DS backup is attempted, but network or other backup failures do not prevent the BitLocker setup. The Backup process is not automatically retried, and the recovery password might not be stored in AD DS during BitLocker setup. +If the **Require BitLocker backup to AD DS** option is not selected, AD DS backup is attempted, but network or other backup failures do not prevent the BitLocker setup. The Backup process is not automatically retried, and the recovery password might not be stored in AD DS during BitLocker setup. TPM initialization might be needed during the BitLocker setup. Enable the **Turn on TPM backup to Active Directory Domain Services** policy setting in **Computer Configuration\\Administrative Templates\\System\\Trusted Platform Module Services** to ensure that TPM information is also backed up. For more information about this setting, see [TPM Group Policy settings](/windows/device-security/tpm/trusted-platform-module-services-group-policy-settings). @@ -1630,7 +1630,7 @@ This policy setting is used to configure the default folder for recovery passwor

                                    Introduced

                                    -

                                    Windows Vista

                                    +

                                    Windows Vista

                                    Drive type

                                    @@ -1646,21 +1646,21 @@ This policy setting is used to configure the default folder for recovery passwor

                                    When enabled

                                    -

                                    You can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker Setup Wizard displays the computer's top-level folder view.

                                    +

                                    You can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker Setup Wizard displays the computer's top-level folder view.

                                    When disabled or not configured

                                    -

                                    The BitLocker Setup Wizard displays the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.

                                    +

                                    The BitLocker Setup Wizard displays the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.

                                    -  -**Reference** + +Reference This policy setting is applied when you turn on BitLocker. ->**Note:**  This policy setting does not prevent the user from saving the recovery password in another folder. -  +>**Note:** This policy setting does not prevent the user from saving the recovery password in another folder. + ### Choose how BitLocker-protected fixed drives can be recovered This policy setting is used to configure recovery methods for fixed data drives. @@ -1677,7 +1677,7 @@ This policy setting is used to configure recovery methods for fixed data drives.

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -1698,30 +1698,30 @@ This policy setting is used to configure recovery methods for fixed data drives.

                                    When disabled or not configured

                                    -

                                    The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.

                                    +

                                    The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.

                                    -  -**Reference** + +Reference This policy setting is applied when you turn on BitLocker. The **Allow data recovery agent** check box is used to specify whether a data recovery agent can be used with BitLocker-protected fixed data drives. Before a data recovery agent can be used, it must be added from **Public Key Policies**, which is located in the Group Policy Management Console (GPMC) or in the Local Group Policy Editor. -In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. +In **Configure user storage of BitLocker recovery information**, select whether users are allowed, required, or not allowed to generate a 48-digit recovery password or a 256-bit recovery key. Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you cannot specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. -In **Save BitLocker recovery information to Active Directory Doman Services**, choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. -Storing the key package supports recovering data from a drive that has been physically corrupted. To recover this data, you can use the **Repair-bde** command-line tool. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. +In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in AD DS for fixed data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. +Storing the key package supports recovering data from a drive that has been physically corrupted. To recover this data, you can use the **Repair-bde** command-line tool. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. For more information about the BitLocker repair tool, see [Repair-bde](https://technet.microsoft.com/library/ff829851.aspx). -Select the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. +Select the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. + +>**Note:** If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. ->**Note:**  If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. -  ### Choose how BitLocker-protected removable drives can be recovered This policy setting is used to configure recovery methods for removable data drives. @@ -1738,7 +1738,7 @@ This policy setting is used to configure recovery methods for removable data dri

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -1759,12 +1759,12 @@ This policy setting is used to configure recovery methods for removable data dri

                                    When disabled or not configured

                                    -

                                    The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.

                                    +

                                    The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.

                                    -  -**Reference** + +Reference This policy setting is applied when you turn on BitLocker. @@ -1774,12 +1774,12 @@ In **Configure user storage of BitLocker recovery information**, select whether Select **Omit recovery options from the BitLocker setup wizard** to prevent users from specifying recovery options when they enable BitLocker on a drive. This means that you cannot specify which recovery option to use when you enable BitLocker. Instead, BitLocker recovery options for the drive are determined by the policy setting. -In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in AD DS for removable data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. +In **Save BitLocker recovery information to Active Directory Domain Services**, choose which BitLocker recovery information to store in AD DS for removable data drives. If you select **Backup recovery password and key package**, the BitLocker recovery password and the key package are stored in AD DS. If you select **Backup recovery password only**, only the recovery password is stored in AD DS. -Select the **Do not enable BitLocker until recovery information is stored in AD DS for removable data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. +Select the **Do not enable BitLocker until recovery information is stored in AD DS for removable data drives** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. + +>**Note:** If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. ->**Note:**  If the **Do not enable BitLocker until recovery information is stored in AD DS for fixed data drives** check box is selected, a recovery password is automatically generated. -  ### Configure the pre-boot recovery message and URL This policy setting is used to configure the entire recovery message and to replace the existing URL that is displayed on the pre-boot recovery screen when the operating system drive is locked. @@ -1796,7 +1796,7 @@ This policy setting is used to configure the entire recovery message and to repl

                                    Introduced

                                    -

                                    Windows 10

                                    +

                                    Windows 10

                                    Drive type

                                    @@ -1820,8 +1820,8 @@ This policy setting is used to configure the entire recovery message and to repl -  -**Reference** + +Reference Enabling the **Configure the pre-boot recovery message and URL** policy setting allows you to customize the default recovery screen message and URL to assist customers in recovering their key. @@ -1831,10 +1831,10 @@ Once you enable the setting you have three options: - If you select the **Use custom recovery message** option, type the custom message in the **Custom recovery message option** text box. The message that you type in the **Custom recovery message option** text box will be displayed on the pre-boot recovery screen. If a recovery URL is available, include it in the message. - If you select the **Use custom recovery URL** option, type the custom message URL in the **Custom recovery URL option** text box. The URL that you type in the **Custom recovery URL option** text box replaces the default URL in the default recovery message, which will be displayed on the pre-boot recovery screen. ->**Important:**  Not all characters and languages are supported in the pre-boot environment. We strongly recommended that you verify the correct appearance of the characters that you use for the custom message and URL on the pre-boot recovery screen. -  ->**Important:**  Because you can alter the BCDEdit commands manually before you have set Group Policy settings, you cannot return the policy setting to the default setting by selecting the **Not Configured** option after you have configured this policy setting. To return to the default pre-boot recovery screen leave the policy setting enabled and select the **Use default message** options from the **Choose an option for the pre-boot recovery message** drop-down list box. -  +> **Important:** Not all characters and languages are supported in the pre-boot environment. We strongly recommended that you verify the correct appearance of the characters that you use for the custom message and URL on the pre-boot recovery screen. +> +> **Important:** Because you can alter the BCDEdit commands manually before you have set Group Policy settings, you cannot return the policy setting to the default setting by selecting the **Not Configured** option after you have configured this policy setting. To return to the default pre-boot recovery screen leave the policy setting enabled and select the **Use default message** options from the **Choose an option for the pre-boot recovery message** drop-down list box. + ### Allow Secure Boot for integrity validation This policy controls how BitLocker-enabled system volumes are handled in conjunction with the Secure Boot feature. Enabling this feature forces Secure Boot validation during the boot process and verifies Boot Configuration Data (BCD) settings according to the Secure Boot policy. @@ -1863,8 +1863,8 @@ This policy controls how BitLocker-enabled system volumes are handled in conjunc

                                    Conflicts

                                    -

                                    If you enable **Allow Secure Boot for integrity validation**, make sure the Configure TPM platform validation profile for native UEFI firmware configurations Group Policy setting is not enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.

                                    -

                                    For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.

                                    +

                                    If you enable Allow Secure Boot for integrity validation, make sure the Configure TPM platform validation profile for native UEFI firmware configurations Group Policy setting is not enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.

                                    +

                                    For more information about PCR 7, see Platform Configuration Register (PCR) in this topic.

                                    When enabled or not configured

                                    @@ -1876,14 +1876,14 @@ This policy controls how BitLocker-enabled system volumes are handled in conjunc -  -**Reference** + +Reference Secure Boot ensures that the computer's preboot environment loads only firmware that is digitally signed by authorized software publishers. Secure Boot also provides more flexibility for managing preboot configurations than BitLocker integrity checks prior to Windows Server 2012 and Windows 8. When this policy is enabled and the hardware is capable of using Secure Boot for BitLocker scenarios, the **Use enhanced Boot Configuration Data validation profile** Group Policy setting is ignored, and Secure Boot verifies BCD settings according to the Secure Boot policy setting, which is configured separately from BitLocker. ->**Warning:**  Enabling this policy might result in BitLocker recovery when manufacturer-specific firmware is updated. If you disable this policy, suspend BitLocker prior to applying firmware updates. -  +>**Warning:** Enabling this policy might result in BitLocker recovery when manufacturer-specific firmware is updated. If you disable this policy, suspend BitLocker prior to applying firmware updates. + ### Provide the unique identifiers for your organization This policy setting is used to establish an identifier that is applied to all drives that are encrypted in your organization. @@ -1900,7 +1900,7 @@ This policy setting is used to establish an identifier that is applied to all dr

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -1924,8 +1924,8 @@ This policy setting is used to establish an identifier that is applied to all dr -  -**Reference** + +Reference These identifiers are stored as the identification field and the allowed identification field. The identification field allows you to associate a unique organizational identifier to BitLocker-protected drives. This identifier is automatically added to new BitLocker-protected drives, and it can be updated on existing BitLocker-protected drives by using the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line tool. @@ -1939,7 +1939,7 @@ You can configure the identification fields on existing drives by using the [Man When a BitLocker-protected drive is mounted on another BitLocker-enabled computer, the identification field and the allowed identification field are used to determine whether the drive is from an outside organization. -Multiple values separated by commas can be entered in the identification and allowed identification fields. The identification field can be any value up to 260 characters. +Multiple values separated by commas can be entered in the identification and allowed identification fields. The identification field can be any value up to 260 characters. ### Prevent memory overwrite on restart @@ -1957,7 +1957,7 @@ This policy setting is used to control whether the computer's memory will be ove

                                    Introduced

                                    -

                                    Windows Vista

                                    +

                                    Windows Vista

                                    Drive type

                                    @@ -1981,8 +1981,8 @@ This policy setting is used to control whether the computer's memory will be ove -  -**Reference** + +Reference This policy setting is applied when you turn on BitLocker. BitLocker secrets include key material that is used to encrypt data. This policy setting applies only when BitLocker protection is enabled. @@ -1998,7 +1998,7 @@ This policy setting determines what values the TPM measures when it validates ea

                                    Policy description

                                    -

                                    With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.

                                    +

                                    With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.

                                    Introduced

                                    @@ -2026,30 +2026,30 @@ This policy setting determines what values the TPM measures when it validates ea -  -**Reference** + +Reference This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker has already been turned on with TPM protection. ->**Important:**  This Group Policy setting only applies to computers with BIOS configurations or to computers with UEFI firmware with the CSM enabled. Computers that use a native UEFI firmware configuration store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware. -  -A platform validation profile consists of a set of PCR indices that range from 0 to 23. The default platform validation profile secures the encryption key against changes to the following: +>**Important:** This Group Policy setting only applies to computers with BIOS configurations or to computers with UEFI firmware with the CSM enabled. Computers that use a native UEFI firmware configuration store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting to configure the TPM PCR profile for computers that use native UEFI firmware. + +A platform validation profile consists of a set of PCR indices that range from 0 to 23. The default platform validation profile secures the encryption key against changes to the following: - Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions (PCR 0) -- Option ROM Code (PCR 2) +- Option ROM Code (PCR 2) - Master Boot Record (MBR) Code (PCR 4) - NTFS Boot Sector (PCR 8) - NTFS Boot Block (PCR 9) - Boot Manager (PCR 10) - BitLocker Access Control (PCR 11) ->**Note:**  Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. -  +>**Note:** Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. + The following list identifies all of the PCRs available: - PCR 0: Core root-of-trust for measurement, BIOS, and Platform extensions - PCR 1: Platform and motherboard configuration and data. -- PCR 2: Option ROM code +- PCR 2: Option ROM code - PCR 3: Option ROM data and configuration - PCR 4: Master Boot Record (MBR) code - PCR 5: Master Boot Record (MBR) partition table @@ -2061,9 +2061,9 @@ The following list identifies all of the PCRs available: - PCR 11: BitLocker access control - PCR 12-23: Reserved for future use -### Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2) +### Configure TPM platform validation profile (Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2) -This policy setting determines what values the TPM measures when it validates early boot components before unlocking a drive on a computer running Windows Vista, Windows Server 2008, or Windows 7. +This policy setting determines what values the TPM measures when it validates early boot components before unlocking a drive on a computer running Windows Vista, Windows Server 2008, or Windows 7. @@ -2073,11 +2073,11 @@ This policy setting determines what values the TPM measures when it validates ea - + - + @@ -2101,28 +2101,28 @@ This policy setting determines what values the TPM measures when it validates ea

                                    Policy description

                                    With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.

                                    With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.

                                    Introduced

                                    Windows Server 2008 and Windows Vista

                                    Windows Server 2008 and Windows Vista

                                    Drive type
                                    -  -**Reference** + +Reference This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker is already turned on with TPM protection. -A platform validation profile consists of a set of PCR indices that range from 0 to 23. The default platform validation profile secures the encryption key against changes to the following: +A platform validation profile consists of a set of PCR indices that range from 0 to 23. The default platform validation profile secures the encryption key against changes to the following: - Core Root of Trust of Measurement (CRTM), BIOS, and Platform Extensions (PCR 0) -- Option ROM Code (PCR 2) +- Option ROM Code (PCR 2) - Master Boot Record (MBR) Code (PCR 4) - NTFS Boot Sector (PCR 8) - NTFS Boot Block (PCR 9) - Boot Manager (PCR 10) - BitLocker Access Control (PCR 11) ->**Note:**  The default TPM validation profile PCR settings for computers that use an Extensible Firmware Interface (EFI) are the PCRs 0, 2, 4, and 11 only. -  +>**Note:** The default TPM validation profile PCR settings for computers that use an Extensible Firmware Interface (EFI) are the PCRs 0, 2, 4, and 11 only. + The following list identifies all of the PCRs available: - PCR 0: Core root-of-trust for measurement, EFI boot and run-time services, EFI drivers embedded in system ROM, ACPI static tables, embedded SMM code, and BIOS code - PCR 1: Platform and motherboard configuration and data. Hand-off tables and EFI variables that affect system configuration -- PCR 2: Option ROM code +- PCR 2: Option ROM code - PCR 3: Option ROM data and configuration - PCR 4: Master Boot Record (MBR) code or code from other boot devices - PCR 5: Master Boot Record (MBR) partition table. Various EFI variables and the GPT table @@ -2132,10 +2132,10 @@ The following list identifies all of the PCRs available: - PCR 9: NTFS boot block - PCR 10: Boot manager - PCR 11: BitLocker access control -- PCR 12 - 23: Reserved for future use +- PCR 12 - 23: Reserved for future use + +>**Warning:** Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. ->**Warning:**  Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. -  ### Configure TPM platform validation profile for native UEFI firmware configurations This policy setting determines what values the TPM measures when it validates early boot components before unlocking an operating system drive on a computer with native UEFI firmware configurations. @@ -2148,7 +2148,7 @@ This policy setting determines what values the TPM measures when it validates ea

                                    Policy description

                                    -

                                    With this policy setting, you can configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key.

                                    +

                                    With this policy setting, you can configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key.

                                    Introduced

                                    @@ -2166,7 +2166,7 @@ This policy setting determines what values the TPM measures when it validates ea

                                    Conflicts

                                    Setting this policy with PCR 7 omitted, overrides the Allow Secure Boot for integrity validation Group Policy setting, and it prevents BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation.

                                    If your environments use TPM and Secure Boot for platform integrity checks, this policy should not be configured.

                                    -

                                    For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.

                                    +

                                    For more information about PCR 7, see Platform Configuration Register (PCR) in this topic.

                                    When enabled

                                    @@ -2178,20 +2178,20 @@ This policy setting determines what values the TPM measures when it validates ea -  -**Reference** + +Reference This policy setting does not apply if the computer does not have a compatible TPM or if BitLocker is already turned on with TPM protection. ->**Important:**  This Group Policy setting only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Support Module (CSM) enabled store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for BIOS-based firmware configurations** Group Policy setting to configure the TPM PCR profile for computers with BIOS configurations or for computers with UEFI firmware with a CSM enabled. -  -A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23. The default platform validation profile secures the encryption key against changes to the core system firmware executable code (PCR 0), extended or pluggable executable code (PCR 2), boot manager (PCR 4), and the BitLocker access control (PCR 11). +>**Important:** This Group Policy setting only applies to computers with a native UEFI firmware configuration. Computers with BIOS or UEFI firmware with a Compatibility Support Module (CSM) enabled store different values in the Platform Configuration Registers (PCRs). Use the **Configure TPM platform validation profile for BIOS-based firmware configurations** Group Policy setting to configure the TPM PCR profile for computers with BIOS configurations or for computers with UEFI firmware with a CSM enabled. + +A platform validation profile consists of a set of Platform Configuration Register (PCR) indices ranging from 0 to 23. The default platform validation profile secures the encryption key against changes to the core system firmware executable code (PCR 0), extended or pluggable executable code (PCR 2), boot manager (PCR 4), and the BitLocker access control (PCR 11). The following list identifies all of the PCRs available: - PCR 0: Core System Firmware executable code - PCR 1: Core System Firmware data -- PCR 2: Extended or pluggable executable code +- PCR 2: Extended or pluggable executable code - PCR 3: Extended or pluggable firmware data - PCR 4: Boot Manager - PCR 5: GPT/Partition Table @@ -2207,13 +2207,13 @@ The following list identifies all of the PCRs available: - PCR 12: Data events and highly volatile events - PCR 13: Boot Module Details - PCR 14: Boot Authorities -- PCR 15 – 23: Reserved for future use +- PCR 15 – 23: Reserved for future use + +>**Warning:** Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. ->**Warning:**  Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker's sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. -  ### Reset platform validation data after BitLocker recovery -This policy setting determines if you want platform validation data to refresh when Windows is started following a BitLocker recovery. A platform validation data profile consists of the values in a set of Platform Configuration Register (PCR) indices that range from 0 to 23. +This policy setting determines if you want platform validation data to refresh when Windows is started following a BitLocker recovery. A platform validation data profile consists of the values in a set of Platform Configuration Register (PCR) indices that range from 0 to 23. @@ -2255,14 +2255,14 @@ This policy setting determines if you want platform validation data to refresh w
                                    -  -**Reference** + +Reference For more information about the recovery process, see the [BitLocker recovery guide](bitlocker-recovery-guide-plan.md). ### Use enhanced Boot Configuration Data validation profile -This policy setting determines specific Boot Configuration Data (BCD) settings to verify during platform validation. A platform validation uses the data in the platform validation profile, which consists of a set of Platform Configuration Register (PCR) indices that range from 0 to 23. +This policy setting determines specific Boot Configuration Data (BCD) settings to verify during platform validation. A platform validation uses the data in the platform validation profile, which consists of a set of Platform Configuration Register (PCR) indices that range from 0 to 23. @@ -2296,7 +2296,7 @@ This policy setting determines specific Boot Configuration Data (BCD) settings t - + @@ -2304,11 +2304,11 @@ This policy setting determines specific Boot Configuration Data (BCD) settings t

                                    When disabled

                                    The computer reverts to a BCD profile validation similar to the default BCD profile that is used by Windows 7.

                                    The computer reverts to a BCD profile validation similar to the default BCD profile that is used by Windows 7.

                                    When not configured
                                    -  -**Reference** ->**Note:**  The setting that controls boot debugging (0x16000010) is always validated, and it has no effect if it is included in the inclusion or the exclusion list. -  +Reference + +>**Note:** The setting that controls boot debugging (0x16000010) is always validated, and it has no effect if it is included in the inclusion or the exclusion list. + ### Allow access to BitLocker-protected fixed data drives from earlier versions of Windows This policy setting is used to control whether access to drives is allowed by using the BitLocker To Go Reader, and if the application is installed on the drive. @@ -2325,7 +2325,7 @@ This policy setting is used to control whether access to drives is allowed by us

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -2349,12 +2349,12 @@ This policy setting is used to control whether access to drives is allowed by us -  -**Reference** ->**Note:**  This policy setting does not apply to drives that are formatted with the NTFS file system. -  -When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted fixed drives** check box to help prevent users from running BitLocker To Go Reader from their fixed drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user is prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the fixed drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the fixed drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. +Reference + +>**Note:** This policy setting does not apply to drives that are formatted with the NTFS file system. + +When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted fixed drives** check box to help prevent users from running BitLocker To Go Reader from their fixed drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user is prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the fixed drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the fixed drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. ### Allow access to BitLocker-protected removable data drives from earlier versions of Windows @@ -2372,7 +2372,7 @@ This policy setting controls access to removable data drives that are using the

                                    Introduced

                                    -

                                    Windows Server 2008 R2 and Windows 7

                                    +

                                    Windows Server 2008 R2 and Windows 7

                                    Drive type

                                    @@ -2396,12 +2396,12 @@ This policy setting controls access to removable data drives that are using the -  -**Reference** ->**Note:**  This policy setting does not apply to drives that are formatted with the NTFS file system. -  -When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted removable drives** check box to help prevent users from running BitLocker To Go Reader from their removable drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user will be prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the removable drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the removable drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2 that do not have BitLocker To Go Reader installed. +Reference + +>**Note:** This policy setting does not apply to drives that are formatted with the NTFS file system. + +When this policy setting is enabled, select the **Do not install BitLocker To Go Reader on FAT formatted removable drives** check box to help prevent users from running BitLocker To Go Reader from their removable drives. If BitLocker To Go Reader (bitlockertogo.exe) is present on a drive that does not have an identification field specified, or if the drive has the same identification field as specified in the **Provide unique identifiers for your organization** policy setting, the user will be prompted to update BitLocker, and BitLocker To Go Reader is deleted from the drive. In this situation, for the removable drive to be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, BitLocker To Go Reader must be installed on the computer. If this check box is not selected, BitLocker To Go Reader will be installed on the removable drive to enable users to unlock the drive on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2 that do not have BitLocker To Go Reader installed. ## FIPS setting @@ -2419,7 +2419,7 @@ You can configure the Federal Information Processing Standard (FIPS) setting for

                                    Introduced

                                    -

                                    Windows Server 2003 with SP1

                                    +

                                    Windows Server 2003 with SP1

                                    Drive type

                                    @@ -2435,7 +2435,7 @@ You can configure the Federal Information Processing Standard (FIPS) setting for

                                    When enabled

                                    -

                                    Users will be unable to save a recovery password to any location. This includes AD DS and network folders. In addition, you cannot use WMI or the BitLocker Drive Encryption Setup izard to create a recovery password.

                                    +

                                    Users will be unable to save a recovery password to any location. This includes AD DS and network folders. In addition, you cannot use WMI or the BitLocker Drive Encryption Setup wizard to create a recovery password.

                                    When disabled or not configured

                                    @@ -2443,12 +2443,12 @@ You can configure the Federal Information Processing Standard (FIPS) setting for -  -**Reference** + +Reference This policy needs to be enabled before any encryption key is generated for BitLocker. Note that when this policy is enabled, BitLocker prevents creating or using recovery passwords, so recovery keys should be used instead. -You can save the optional recovery key to a USB drive. Because recovery passwords cannot be saved to AD DS when FIPS is enabled, an error is caused if AD DS backup is required by Group Policy. +You can save the optional recovery key to a USB drive. Because recovery passwords cannot be saved to AD DS when FIPS is enabled, an error is caused if AD DS backup is required by Group Policy. You can edit the FIPS setting by using the Security Policy Editor (Secpol.msc) or by editing the Windows registry. You must be an administrator to perform these procedures. @@ -2467,7 +2467,7 @@ You can use disable the following Group Policy settings, which are located in ** ## About the Platform Configuration Register (PCR) -A platform validation profile consists of a set of PCR indices that range from 0 to 23. The scope of the values can be specific to the version of the operating system. +A platform validation profile consists of a set of PCR indices that range from 0 to 23. The scope of the values can be specific to the version of the operating system. Changing from the default platform validation profile affects the security and manageability of your computer. BitLocker’s sensitivity to platform modifications (malicious or authorized) is increased or decreased depending on inclusion or exclusion (respectively) of the PCRs. diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md index 8f9df7aad6..121b0d3e49 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md @@ -2,13 +2,14 @@ title: BitLocker How to deploy on Windows Server 2012 and later description: This topic for the IT professional explains how to deploy BitLocker and Windows Server 2012 and later ms.assetid: 91c18e9e-6ab4-4607-8c75-d983bbe2542f +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -51,14 +52,14 @@ The `servermanager` Windows PowerShell module can use either the `Install-Window By default, installation of features in Windows PowerShell does not include optional sub-features or management tools as part of the install process. This can be seen using the `-WhatIf` option in Windows PowerShell. -``` syntax +```powershell Install-WindowsFeature BitLocker -WhatIf ``` The results of this command show that only the BitLocker Drive Encryption feature installs using this command. To see what would be installed with the BitLocker feature including all available management tools and sub-features, use the following command: -``` syntax +```powershell Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -WhatIf | fl ``` @@ -74,7 +75,7 @@ The result of this command displays the following list of all the administration The command to complete a full installation of the BitLocker feature with all available features and then rebooting the server at completion is: -``` syntax +```powershell Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -Restart ``` @@ -84,7 +85,7 @@ Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools - The `dism` Windows PowerShell module uses the `Enable-WindowsOptionalFeature` cmdlet to install features. The BitLocker feature name for BitLocker is `BitLocker`. The `dism` module does not support wildcards when searching for feature names. To list feature names for the `dism` module, use the `Get-WindowsOptionalFeatures` cmdlet. The following command will list all of the optional features in an online (running) operating system. -``` syntax +```powershell Get-WindowsOptionalFeature -Online | ft ``` @@ -92,13 +93,13 @@ From this output, we can see that there are three BitLocker related optional fea To install BitLocker using the `dism` module, use the following command: -``` syntax +```powershell Enable-WindowsOptionalFeature -Online -FeatureName BitLocker -All ``` This command will prompt the user for a reboot. The Enable-WindowsOptionalFeature cmdlet does not offer support for forcing a reboot of the computer. This command does not include installation of the management tools for BitLocker. For a complete installation of BitLocker and all available management tools, use the following command: -``` syntax +```powershell Enable-WindowsOptionalFeature -Online -FeatureName BitLocker, BitLocker-Utilities -All ``` ## More information diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index ed0dece280..7cdd7f45b1 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -2,13 +2,14 @@ title: BitLocker How to enable Network Unlock (Windows 10) description: This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. ms.assetid: be45bc28-47db-4931-bfec-3c348151d2e9 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -57,7 +58,7 @@ The network stack must be enabled to use the Network Unlock feature. Equipment m >**Note:**  To properly support DHCP within UEFI, the UEFI-based system should be in native mode without a compatibility support module (CSM) enabled. For Network Unlock to work reliably on computers running Windows 8 and later, the first network adapter on the computer, usually the onboard adapter, must be configured to support DHCP and used for Network Unlock. This is especially worth noting when you have multiple adapters, and you wish to configure one without DHCP, such as for a lights-out management protocol. This configuration is necessary because Network Unlock will stop enumerating adapters when it reaches one with a DHCP port failure for any reason. Thus, if the first enumerated adapter does not support DHCP, is not plugged into the network, or fails to report availability of the DHCP port for any reason, then Network Unlock will fail. -  + The Network Unlock server component installs on supported versions of Windows Server 2012 and later as a Windows feature using Server Manager or Windows PowerShell cmdlets. The feature name is BitLocker Network Unlock in Server Manager and BitLocker-NetworkUnlock in Windows PowerShell. This feature is a core requirement. Network Unlock requires Windows Deployment Services (WDS) in the environment where the feature will be utilized. Configuration of the WDS installation is not required; however, the WDS service needs to be running on the server. @@ -96,11 +97,11 @@ The BitLocker Network Unlock feature will install the WDS role if it is not alre To install the role using Windows PowerShell, use the following command: -``` syntax +```powershell Install-WindowsFeature WDS-Deployment ``` -You must configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Doman Services) and the client computer. You can do using the WDS management tool, wdsmgmt.msc, which starts the Windows Deployment Services Configuration Wizard. +You must configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Domain Services) and the client computer. You can do using the WDS management tool, wdsmgmt.msc, which starts the Windows Deployment Services Configuration Wizard. ### Confirm the WDS Service is running @@ -108,7 +109,7 @@ To confirm the WDS service is running, use the Services Management Console or Wi To confirm the service is running using Windows PowerShell, use the following command: -``` syntax +```powershell Get-Service WDSServer ``` ### Install the Network Unlock feature @@ -117,7 +118,7 @@ To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature using Windows PowerShell, use the following command: -``` syntax +```powershell Install-WindowsFeature BitLocker-NetworkUnlock ``` ### Create the certificate template for Network Unlock @@ -183,7 +184,7 @@ To create a self-signed certificate, you can either use the New-SelfSignedCertif Windows PowerShell example: -```syntax +```powershell New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -Subject "CN=BitLocker Network Unlock certificate" -Provider "Microsoft Software Key Storage Provider" -KeyUsage KeyEncipherment -KeyUsageProperty Decrypt,Sign -KeyLength 2048 -HashAlgorithm sha512 -TextExtension @("1.3.6.1.4.1.311.21.10={text}OID=1.3.6.1.4.1.311.67.1.1","2.5.29.37={text}1.3.6.1.4.1.311.67.1.1") ``` @@ -192,7 +193,7 @@ Certreq example: 1. Create a text file with an .inf extension. For example, notepad.exe BitLocker-NetworkUnlock.inf. 2. Add the following contents to the previously created file: - ``` syntax + ```ini [NewRequest] Subject="CN=BitLocker Network Unlock certificate" ProviderType=0 @@ -243,7 +244,7 @@ The following steps describe how to enable the Group Policy setting that is a re The following steps describe how to deploy the required Group Policy setting: >**Note:**  The Group Policy settings **Allow network unlock at startup** and **Add Network Unlock Certificate** were introduced in Windows Server 2012. -  + 1. Copy the .cer file created for Network Unlock to the domain controller. 2. On the domain controller, launch Group Policy Management Console (gpmc.msc). 3. Create a new Group Policy Object or modify an existing object to enable the **Allow network unlock at startup** setting. @@ -256,8 +257,8 @@ The following steps describe how to deploy the required Group Policy setting: >**Note:**  Only one network unlock certificate can be available at a time. If a new certificate is required, delete the current certificate before deploying a new one. The Network Unlock certificate is located in the **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** key on the client computer. 5. Reboot the clients after deploying the group policy. ->**Note:** The **Network (Certificate Based)** protector will be added only after a reboot with the policy enabled and a valid certificate present in the FVE_NKP store. -  + >**Note:** The **Network (Certificate Based)** protector will be added only after a reboot with the policy enabled and a valid certificate present in the FVE_NKP store. + ### Subnet policy configuration files on WDS Server (Optional) By default, all clients with the correct Network Unlock Certificate and valid Network Unlock protectors that have wired access to a Network Unlock-enabled WDS server via DHCP are unlocked by the server. A subnet policy configuration file on the WDS server can be created to limit which subnet(s) Network Unlock clients can use to unlock. @@ -266,24 +267,27 @@ The configuration file, called bde-network-unlock.ini, must be located in the sa The subnet policy configuration file must use a “\[SUBNETS\]” section to identify the specific subnets. The named subnets may then be used to specify restrictions in certificate subsections. Subnets are defined as simple name-value pairs, in the common INI format, where each subnet has its own line, with the name on the left of the equals sign, and the subnet identified on the right of the equal sign as a Classless Inter-Domain Routing (CIDR) address or range. The key word “ENABLED” is disallowed for subnet names. - [SUBNETS] - SUBNET1=10.185.250.0/24 ; comment about this subrange could be here, after the semi-colon - SUBNET2=10.185.252.200/28 - SUBNET3= 2001:4898:a:2::/64 ; an IPv6 subnet - SUBNET4=2001:4898:a:3::/64; in production, the admin would likely give more useful names, like BUILDING9-EXCEPT-RECEP. - ``` - Following the \[SUBNETS\] section, there can be sections for each Network Unlock certificate, identified by the certificate thumbprint formatted without any spaces, which define subnets clients can be unlocked from with that certificate. +```ini +[SUBNETS] +SUBNET1=10.185.250.0/24 ; comment about this subrange could be here, after the semi-colon +SUBNET2=10.185.252.200/28 +SUBNET3= 2001:4898:a:2::/64 ; an IPv6 subnet +SUBNET4=2001:4898:a:3::/64; in production, the admin would likely give more useful names, like BUILDING9-EXCEPT-RECEP. +``` +Following the \[SUBNETS\] section, there can be sections for each Network Unlock certificate, identified by the certificate thumbprint formatted without any spaces, which define subnets clients can be unlocked from with that certificate. - >**Note:**  When specifying the certificate thumbprint, do not include any spaces. If spaces are included in the thumbprint the subnet configuration will fail because the thumbprint will not be recognized as valid. -   - Subnet restrictions are defined within each certificate section by denoting the allowed list of permitted subnets. If any subnet is listed in a certificate section, then only those subnets listed are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate does not have a section in the subnet policy configuration file, then no subnet restrictions are applied for unlocking with that certificate. This means for restrictions to apply to every certificate, there must be a certificate section for every Network Unlock certificate on the server, and an explicit allowed list set for each certificate section. - Subnet lists are created by putting the name of a subnet from the \[SUBNETS\] section on its own line below the certificate section header. Then, the server will only unlock clients with this certificate on the subnet(s) specified as in the list. For troubleshooting, a subnet can be quickly excluded without deleting it from the section by simply commenting it out with a prepended semi-colon. - [‎2158a767e1c14e88e27a4c0aee111d2de2eafe60] - ;Comments could be added here to indicate when the cert was issued, which Group Policy should get it, and so on. - ;This list shows this cert is only allowed to unlock clients on SUBNET1 and SUBNET3 subnets. In this example, SUBNET2 is commented out. - SUBNET1 - ;SUBNET2 - SUBNET3 +>**Note:**  When specifying the certificate thumbprint, do not include any spaces. If spaces are included in the thumbprint the subnet configuration will fail because the thumbprint will not be recognized as valid. + +Subnet restrictions are defined within each certificate section by denoting the allowed list of permitted subnets. If any subnet is listed in a certificate section, then only those subnets listed are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate does not have a section in the subnet policy configuration file, then no subnet restrictions are applied for unlocking with that certificate. This means for restrictions to apply to every certificate, there must be a certificate section for every Network Unlock certificate on the server, and an explicit allowed list set for each certificate section. +Subnet lists are created by putting the name of a subnet from the \[SUBNETS\] section on its own line below the certificate section header. Then, the server will only unlock clients with this certificate on the subnet(s) specified as in the list. For troubleshooting, a subnet can be quickly excluded without deleting it from the section by simply commenting it out with a prepended semi-colon. +```ini +[‎2158a767e1c14e88e27a4c0aee111d2de2eafe60] +;Comments could be added here to indicate when the cert was issued, which Group Policy should get it, and so on. +;This list shows this cert is only allowed to unlock clients on SUBNET1 and SUBNET3 subnets. In this example, SUBNET2 is commented out. +SUBNET1 +;SUBNET2 +SUBNET3 +``` To disallow the use of a certificate altogether, its subnet list may contain the line “DISABLED". @@ -292,7 +296,7 @@ To disallow the use of a certificate altogether, its subnet list may contain the To turn off the unlock server, the PXE provider can be unregistered from the WDS server or uninstalled altogether. However, to stop clients from creating Network Unlock protectors the **Allow Network Unlock at startup** Group Policy setting should be disabled. When this policy setting is updated to disabled on client computers any Network Unlock key protectors on the computer will be deleted. Alternatively, the BitLocker Network Unlock certificate policy can be deleted on the domain controller to accomplish the same task for an entire domain. >**Note:**  Removing the FVE_NKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server’s ability to respond to unlock requests for that certificate. However, this is seen as an error condition and is not a supported or recommended method for turning off the Network Unlock server. -  + ## Update Network Unlock certificates To update the certificates used by Network Unlock, administrators need to import or generate the new certificate for the server and then update the Network Unlock certificate Group Policy setting on the domain controller. @@ -301,19 +305,19 @@ To update the certificates used by Network Unlock, administrators need to import Troubleshooting Network Unlock issues begins by verifying the environment. Many times, a small configuration issue will be the root cause of the failure. Items to verify include: -- Verify client hardware is UEFI-based and is on firmware version is 2.3.1 and that the UEFI firmware is in native mode without a Compatibility Support Module (CSM) for BIOS mode enabled. Do this by checking that the firmware does not have an option enabled such as "Legacy mode" or "Compatibility mode" or that the firmware does not appear to be in a BIOS-like mode. -- All required roles and services are installed and started -- Public and private certificates have been published and are in the proper certificate containers. The presence of the Network Unlock certificate can be verified in the Microsoft Management Console (MMC.exe) on the WDS server with the certificate snap-ins for the local computer enabled. The client certificate can be verified by checking the registry key **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** on the client computer. -- Group policy for Network Unlock is enabled and linked to the appropriate domains. -- Verify group policy is reaching the clients properly. This can be done using the GPRESULT.exe or RSOP.msc utilities. -- Verify the clients were rebooted after applying the policy. -- Verify the **Network (Certificate Based)** protector is listed on the client. This can be done using either manage-bde or Windows PowerShell cmdlets. For example the following command will list the key protectors currently configured on the C: drive of the lcoal computer: +- Verify client hardware is UEFI-based and is on firmware version is 2.3.1 and that the UEFI firmware is in native mode without a Compatibility Support Module (CSM) for BIOS mode enabled. Do this by checking that the firmware does not have an option enabled such as "Legacy mode" or "Compatibility mode" or that the firmware does not appear to be in a BIOS-like mode. +- All required roles and services are installed and started +- Public and private certificates have been published and are in the proper certificate containers. The presence of the Network Unlock certificate can be verified in the Microsoft Management Console (MMC.exe) on the WDS server with the certificate snap-ins for the local computer enabled. The client certificate can be verified by checking the registry key **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** on the client computer. +- Group policy for Network Unlock is enabled and linked to the appropriate domains. +- Verify group policy is reaching the clients properly. This can be done using the GPRESULT.exe or RSOP.msc utilities. +- Verify the clients were rebooted after applying the policy. +- Verify the **Network (Certificate Based)** protector is listed on the client. This can be done using either manage-bde or Windows PowerShell cmdlets. For example the following command will list the key protectors currently configured on the C: drive of the lcoal computer: - ``` syntax - manage-bde –protectors –get C: - ``` ->**Note:**  Use the output of manage-bde along with the WDS debug log to determine if the proper certificate thumbprint is being used for Network Unlock -  + ```powershell + manage-bde -protectors -get C: + ``` + >**Note:** Use the output of manage-bde along with the WDS debug log to determine if the proper certificate thumbprint is being used for Network Unlock + Files to gather when troubleshooting BitLocker Network Unlock include: 1. The Windows event logs. Specifically the BitLocker event logs and the Microsoft-Windows-Deployment-Services-Diagnostics-Debug log diff --git a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md index 52925ce212..226acb2e7c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-key-management-faq.md @@ -1,14 +1,15 @@ --- title: BitLocker Key Management FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +description: Browse frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -57,9 +58,9 @@ For older hardware, where a PIN may be needed, it’s recommended to enable [enh BitLocker is designed to make the encrypted drive unrecoverable without the required authentication. When in recovery mode, the user needs the recovery password or recovery key to unlock the encrypted drive. -> [!IMPORTANT]   +> [!IMPORTANT] > Store the recovery information in AD DS, along with your Microsoft Account, or another safe location. -  + ## Can the USB flash drive that is used as the startup key also be used to store the recovery key? While this is technically possible, it is not a best practice to use one USB flash drive to store both keys. If the USB flash drive that contains your startup key is lost or stolen, you also lose access to your recovery key. In addition, inserting this key would cause your computer to automatically boot from the recovery key even if TPM-measured files have changed, which circumvents the TPM's system integrity check. diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md index 9879494122..2314ea2eaf 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md +++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md @@ -6,13 +6,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 02/28/2019 +ms.reviewer: --- # BitLocker Management for Enterprises @@ -21,19 +22,25 @@ The ideal for BitLocker management is to eliminate the need for IT admins to set Though much Windows BitLocker [documentation](bitlocker-overview.md) has been published, customers frequently ask for recommendations and pointers to specific, task-oriented documentation that is both easy to digest and focused on how to deploy and manage BitLocker. This article links to relevant documentation, products, and services to help answer this and other related frequently-asked questions, and also provides BitLocker recommendations for different types of computers. + +> [!IMPORTANT] +> Microsoft BitLocker Administration and Monitoring (MBAM) capabilities will be offered from [ConfigMgr in on-prem scenarios](https://docs.microsoft.com/configmgr/core/get-started/2019/technical-preview-1909#bkmk_bitlocker/) in the future. + ## Managing domain-joined computers and moving to cloud -Companies that image their own computers using Microsoft System Center 2012 Configuration Manager SP1 (SCCM) or later can use an existing task sequence to [pre-provision BitLocker](https://technet.microsoft.com/library/hh846237.aspx#BKMK_PreProvisionBitLocker) encryption while in Windows Preinstallation Environment (WinPE) and can then [enable protection](https://technet.microsoft.com/library/hh846237.aspx#BKMK_EnableBitLocker). This can help ensure that computers are encrypted from the start, even before users receive them. As part of the imaging process, a company could also decide to use SCCM to pre-set any desired [BitLocker Group Policy](https://technet.microsoft.com/library/ee706521(v=ws.10).aspx). +Companies that image their own computers using Microsoft System Center 2012 Configuration Manager SP1 (SCCM) or later can use an existing task sequence to [pre-provision BitLocker](https://docs.microsoft.com/configmgr/osd/understand/task-sequence-steps#BKMK_PreProvisionBitLocker) encryption while in Windows Preinstallation Environment (WinPE) and can then [enable protection](https://docs.microsoft.com/configmgr/osd/understand/task-sequence-steps#BKMK_EnableBitLocker). This can help ensure that computers are encrypted from the start, even before users receive them. As part of the imaging process, a company could also decide to use SCCM to pre-set any desired [BitLocker Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings/). -Enterprises can use [Microsoft BitLocker Administration and Monitoring (MBAM)](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/) to manage client computers with BitLocker that are domain-joined on-premises until [mainstream support ends in July 2019](https://support.microsoft.com/lifecycle/search?alpha=Microsoft%20BitLocker%20Administration%20and%20Monitoring%202.5%20Service%20Pack%201) or they can receive extended support until July 2024. Thus, over the next few years, a good strategy for enterprises will be to plan and move to cloud-based management for BitLocker. Refer to the [PowerShell examples](#powershell-examples) to see how to store recovery keys in Azure Active Directory (Azure AD). +Enterprises can use [Microsoft BitLocker Administration and Monitoring (MBAM)](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/) to manage client computers with BitLocker that are domain-joined on-premises until [mainstream support ends in July 2019](https://support.microsoft.com/lifecycle/search?alpha=Microsoft%20BitLocker%20Administration%20and%20Monitoring%202.5%20Service%20Pack%201/) or they can receive extended support until April 2026. Thus, over the next few years, a good strategy for enterprises will be to plan and move to cloud-based management for BitLocker. Refer to the [PowerShell examples](#powershell-examples) to see how to store recovery keys in Azure Active Directory (Azure AD). ## Managing devices joined to Azure Active Directory -Devices joined to Azure AD are managed using Mobile Device Management (MDM) policy from an MDM solution such as Microsoft Intune. [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) status can be queried from managed machines via the [Policy Configuration Settings Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider), which reports on whether BitLocker Device Encryption is enabled on the device. Compliance with BitLocker Device Encryption policy can be a requirement for [Conditional Access](https://www.microsoft.com/cloud-platform/conditional-access) to services like Exchange Online and SharePoint Online. +Devices joined to Azure AD are managed using Mobile Device Management (MDM) policy from an MDM solution such as Microsoft Intune. Without Windows 10, version 1809, only local administrators can enable BitLocker via Intune policy. Starting with Windows 10, version 1809, Intune can enable BitLocker for standard users. [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) status can be queried from managed machines via the [Policy Configuration Settings Provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider/), which reports on whether BitLocker Device Encryption is enabled on the device. Compliance with BitLocker Device Encryption policy can be a requirement for [Conditional Access](https://www.microsoft.com/cloud-platform/conditional-access/) to services like Exchange Online and SharePoint Online. -Starting with Windows 10 version 1703 (also known as the Windows Creators Update), the enablement of BitLocker can be triggered over MDM either by the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) or the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp). The BitLocker CSP adds policy options that go beyond ensuring that encryption has occurred, and is available on computers that run Windows 10 Business or Enterprise editions and on Windows Phones. +Starting with Windows 10 version 1703 (also known as the Windows Creators Update), the enablement of BitLocker can be triggered over MDM either by the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider/) or the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp/). The BitLocker CSP adds policy options that go beyond ensuring that encryption has occurred, and is available on computers that run Windows 10 and on Windows phones. -For hardware that is compliant with Modern Standby and HSTI, when using either of these features, [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) is automatically turned on whenever the user joins a device to Azure AD. Azure AD provides a portal where recovery keys are also backed up, so users can retrieve their own recovery key for self-service, if required. For older devices that are not yet encrypted, beginning with Windows 10 version 1703 (the Windows 10 Creators Update), admins can use the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) to trigger encryption and store the recovery key in Azure AD. +For hardware that is compliant with Modern Standby and HSTI, when using either of these features, [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) is automatically turned on whenever the user joins a device to Azure AD. Azure AD provides a portal where recovery keys are also backed up, so users can retrieve their own recovery key for self-service, if required. For older devices that are not yet encrypted, beginning with Windows 10 version 1703 (the Windows 10 Creators Update), admins can use the [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp/) to trigger encryption and store the recovery key in Azure AD. + +This is applicable to Azure Hybrid AD as well. ## Managing workplace-joined PCs and phones @@ -41,81 +48,77 @@ For hardware that is compliant with Modern Standby and HSTI, when using either o For Windows PCs and Windows Phones that enroll using **Connect to work or school account**, BitLocker Device Encryption is managed over MDM, the same as devices joined to Azure AD. -## Managing servers +## Managing servers -Servers are often installed, configured, and deployed using PowerShell, so the recommendation is to also use [PowerShell to enable BitLocker on a server](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md#a-href-idbkmk-blcmdletsabitlocker-cmdlets-for-windows-powershell), ideally as part of the initial setup. BitLocker is an Optional Component (OC) in Windows Server, so follow the directions in [BitLocker: How to deploy on Windows Server 2012 and later](bitlocker-how-to-deploy-on-windows-server.md) to add the BitLocker OC. +Servers are often installed, configured, and deployed using PowerShell, so the recommendation is to also use [PowerShell to enable BitLocker on a server](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md#bitlocker-cmdlets-for-windows-powershell), ideally as part of the initial setup. BitLocker is an Optional Component (OC) in Windows Server, so follow the directions in [BitLocker: How to deploy on Windows Server 2012 and later](bitlocker-how-to-deploy-on-windows-server.md) to add the BitLocker OC. -The Minimal Server Interface is a prerequisite for some of the BitLocker administration tools. On a [Server Core](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-core) installation, you must add the necessary GUI components first. The steps to add shell components to Server Core are described in [Using Features on Demand with Updated Systems and Patched Images](https://blogs.technet.microsoft.com/server_core/2012/11/05/using-features-on-demand-with-updated-systems-and-patched-images/) and [How to update local source media to add roles and features](https://blogs.technet.microsoft.com/joscon/2012/11/14/how-to-update-local-source-media-to-add-roles-and-features/). +The Minimal Server Interface is a prerequisite for some of the BitLocker administration tools. On a [Server Core](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-core/) installation, you must add the necessary GUI components first. The steps to add shell components to Server Core are described in [Using Features on Demand with Updated Systems and Patched Images](https://blogs.technet.microsoft.com/server_core/2012/11/05/using-features-on-demand-with-updated-systems-and-patched-images/) and [How to update local source media to add roles and features](https://blogs.technet.microsoft.com/joscon/2012/11/14/how-to-update-local-source-media-to-add-roles-and-features/). -If you are installing a server manually, such as a stand-alone server, then choosing [Server with Desktop Experience](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-with-desktop-experience) is the easiest path because you can avoid performing the steps to add a GUI to Server Core. +If you are installing a server manually, such as a stand-alone server, then choosing [Server with Desktop Experience](https://docs.microsoft.com/windows-server/get-started/getting-started-with-server-with-desktop-experience/) is the easiest path because you can avoid performing the steps to add a GUI to Server Core. Additionally, lights out data centers can take advantage of the enhanced security of a second factor while avoiding the need for user intervention during reboots by optionally using a combination of BitLocker (TPM+PIN) and BitLocker Network Unlock. BitLocker Network Unlock brings together the best of hardware protection, location dependence, and automatic unlock, while in the trusted location. For the configuration steps, see [BitLocker: How to enable Network Unlock](bitlocker-how-to-enable-network-unlock.md). - For more information, see the Bitlocker FAQs article and other useful links in [Related Articles](#articles). + For more information, see the Bitlocker FAQs article and other useful links in [Related Articles](#related-articles).   ## PowerShell examples For Azure AD-joined computers, including virtual machines, the recovery password should be stored in Azure Active Directory. *Example: Use PowerShell to add a recovery password and back it up to Azure AD before enabling BitLocker* -``` -PS C:\>Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector +```powershell +Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector -PS C:\>$BLV = Get-BitLockerVolume -MountPoint "C:" +$BLV = Get-BitLockerVolume -MountPoint "C:" + +BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId +``` -PS C:\>BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId -``` For domain-joined computers, including servers, the recovery password should be stored in Active Directory Domain Services (AD DS). *Example: Use PowerShell to add a recovery password and back it up to AD DS before enabling BitLocker* -``` -PS C:\>Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector +```powershell +Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector -PS C:\>$BLV = Get-BitLockerVolume -MountPoint "C:" +$BLV = Get-BitLockerVolume -MountPoint "C:" -PS C:\>Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId - ``` +Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[0].KeyProtectorId +``` Subsequently, you can use PowerShell to enable BitLocker. *Example: Use PowerShell to enable BitLocker with a TPM protector* - ``` -PS C:\>Enable-BitLocker -MountPoint "D:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector - ``` -*Example: Use PowerShell to enable BitLocker with a TPM+PIN protector, in this case with a PIN set to 123456* - ``` -PS C:\>$SecureString = ConvertTo-SecureString "123456" -AsPlainText -Force +```powershell +Enable-BitLocker -MountPoint "D:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector +``` -PS C:\> Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -Pin $SecureString -TPMandPinProtector - ``` +*Example: Use PowerShell to enable BitLocker with a TPM+PIN protector, in this case with a PIN set to 123456* +```powershell +$SecureString = ConvertTo-SecureString "123456" -AsPlainText -Force + +Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -Pin $SecureString -TPMandPinProtector +``` ## Related Articles [BitLocker: FAQs](bitlocker-frequently-asked-questions.md) -[Microsoft BitLocker Administration and Management (MBAM)](https://technet.microsoft.com/windows/hh826072.aspx) +[Microsoft BitLocker Administration and Management (MBAM)](https://docs.microsoft.com/microsoft-desktop-optimization-pack/mbam-v25/) [Overview of BitLocker Device Encryption in Windows 10](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) -[System Center 2012 Configuration Manager SP1](https://technet.microsoft.com/library/hh846237.aspx#BKMK_PreProvisionBitLocker) *(Pre-provision BitLocker task sequence)* +[BitLocker Group Policy Reference](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings) -[Enable BitLocker task sequence](https://technet.microsoft.com/library/hh846237.aspx#BKMK_EnableBitLocker) - -[BitLocker Group Policy Reference](https://technet.microsoft.com/library/ee706521(v=ws.10).aspx) - -[Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune) +[Microsoft Intune](https://www.microsoft.com/cloud-platform/microsoft-intune/) *(Overview)* [Configuration Settings Providers](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) *(Policy CSP: See [Security-RequireDeviceEncryption](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-security#security-policies))* -[BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) - -
                                    +[BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp/) **Windows Server setup tools** -[Windows Server Installation Options](https://technet.microsoft.com/library/hh831786(v=ws.11).aspx) +[Windows Server Installation Options](https://docs.microsoft.com/windows-server/get-started-19/install-upgrade-migrate-19/) [How to update local source media to add roles and features](https://blogs.technet.microsoft.com/joscon/2012/11/14/how-to-update-local-source-media-to-add-roles-and-features/) @@ -127,11 +130,9 @@ PS C:\> Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpace [Shielded VMs and Guarded Fabric](https://blogs.technet.microsoft.com/windowsserver/2016/05/10/a-closer-look-at-shielded-vms-in-windows-server-2016/) -
                                    -                                     -**Powershell** +**PowerShell** -[BitLocker cmdlets for Windows PowerShell](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md#a-href-idbkmk-blcmdletsabitlocker-cmdlets-for-windows-powershell) +[BitLocker cmdlets for Windows PowerShell](bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md#bitlocker-cmdlets-for-windows-powershell) -[Surface Pro Specifications](https://www.microsoft.com/surface/support/surface-pro-specs) \ No newline at end of file +[Surface Pro Specifications](https://www.microsoft.com/surface/support/surface-pro-specs/) diff --git a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md index 9710cd5603..153be07099 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-network-unlock-faq.md @@ -1,18 +1,19 @@ --- -title: BitLocker frequently asked questions (FAQ) (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +title: BitLocker Network Unlock FAQ (Windows 10) +description: Familiarize yourself with BitLocker Network Unlock. Learn how it can make desktop and server management easier within domain environments. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.reviewer: --- # BitLocker Network Unlock FAQ diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md index 96f2cf4b98..aca61b7f1d 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview-and-requirements-faq.md @@ -2,13 +2,14 @@ title: BitLocker overview and requirements FAQ (Windows 10) description: This topic for the IT professional answers frequently asked questions concerning the requirements to use BitLocker. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -39,9 +40,9 @@ Yes, BitLocker supports multifactor authentication for operating system drives. For requirements, see [System requirements](bitlocker-overview.md#system-requirements). -> [!NOTE]   -> Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it is cannot be protected by BitLocker. -  +> [!NOTE] +> Dynamic disks are not supported by BitLocker. Dynamic data volumes will not be displayed in the Control Panel. Although the operating system volume will always be displayed in the Control Panel, regardless of whether it is a Dynamic disk, if it is a dynamic disk it cannot be protected by BitLocker. + ## Why are two partitions required? Why does the system drive have to be so large? Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive. @@ -50,6 +51,11 @@ Two partitions are required to run BitLocker because pre-startup authentication BitLocker supports TPM version 1.2 or higher. BitLocker support for TPM 2.0 requires Unified Extensible Firmware Interface (UEFI) for the device. +> [!NOTE] +> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. + +> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. + ## How can I tell if a TPM is on my computer? Beginning with Windows 10, version 1803, you can check TPM status in **Windows Defender Security Center** > **Device Security** > **Security processor details**. In previous versions of Windows, open the TPM MMC console (tpm.msc) and look under the **Status** heading. @@ -72,4 +78,4 @@ To turn on, turn off, or change configurations of BitLocker on operating system ## What is the recommended boot order for computers that are going to be BitLocker-protected? -You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such ach as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.  \ No newline at end of file +You should configure the startup options of your computer to have the hard disk drive first in the boot order, before any other drives such as CD/DVD drives or USB drives. If the hard disk is not first and you typically boot from hard disk, then a boot order change may be detected or assumed when removable media is found during boot. The boot order typically affects the system measurement that is verified by BitLocker and a change in boot order will cause you to be prompted for your BitLocker recovery key. For the same reason, if you have a laptop with a docking station, ensure that the hard disk drive is first in the boot order both when docked and undocked.  diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index 42574c9514..ebece73d96 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -2,12 +2,14 @@ title: BitLocker (Windows 10) description: This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features. ms.assetid: 40526fcc-3e0d-4d75-90e0-c7d0615f33b2 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -58,6 +60,14 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment. +> [!IMPORTANT] +> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the Day: Bitlocker without TPM or USB](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/). + +> [!NOTE] +> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. + +> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. + The hard disk must be partitioned with at least two drives: - The operating system drive (or boot drive) contains the operating system and its support files. It must be formatted with the NTFS file system. @@ -83,6 +93,7 @@ When installing the BitLocker optional component on a server you will also need | [BCD settings and BitLocker](bcd-settings-and-bitlocker.md) | This topic for IT professionals describes the BCD settings that are used by BitLocker.| | [BitLocker Recovery Guide](bitlocker-recovery-guide-plan.md)| This topic for IT professionals describes how to recover BitLocker keys from AD DS. | | [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md)| This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration. | +| [Troubleshoot BitLocker](troubleshoot-bitlocker.md) | This guide describes the resources that can help you troubleshoot BitLocker issues, and provides solutions for several common BitLocker issues. | | [Protecting cluster shared volumes and storage area networks with BitLocker](protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)| This topic for IT pros describes how to protect CSVs and SANs with BitLocker.| | [Enabling Secure Boot and BitLocker Device Encryption on Windows 10 IoT Core](https://developer.microsoft.com/windows/iot/docs/securebootandbitlocker) | This topic covers how to use BitLocker with Windows 10 IoT Core | diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md index 43aa2cefe9..26a7658ef1 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md @@ -2,13 +2,14 @@ title: BitLocker recovery guide (Windows 10) description: This topic for IT professionals describes how to recover BitLocker keys from AD DS. ms.assetid: d0f722e9-1773-40bf-8456-63ee7a95ea14 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -63,7 +64,7 @@ The following list provides examples of specific events that will cause BitLocke - Modifying the Platform Configuration Registers (PCRs) used by the TPM validation profile. For example, including **PCR\[1\]** would result in BitLocker measuring most changes to BIOS settings, causing BitLocker to enter recovery mode even when non-boot critical BIOS settings change. >**Note:**  Some computers have BIOS settings that skip measurements to certain PCRs, such as **PCR\[2\]**. Changing this setting in the BIOS would cause BitLocker to enter recovery mode because the PCR measurement will be different. -   + - Moving the BitLocker-protected drive into a new computer. - Upgrading the motherboard to a new one with a new TPM. - Losing the USB flash drive containing the startup key when startup key authentication has been enabled. @@ -72,20 +73,20 @@ The following list provides examples of specific events that will cause BitLocke - Changing the usage authorization for the storage root key of the TPM to a non-zero value. >**Note:**  The BitLocker TPM initialization process sets the usage authorization value to zero, so another user or process must explicitly have changed this value. -   + - Disabling the code integrity check or enabling test signing on Windows Boot Manager (Bootmgr). - Pressing the F8 or F10 key during the boot process. - Adding or removing add-in cards (such as video or network cards), or upgrading firmware on add-in cards. - Using a BIOS hot key during the boot process to change the boot order to something other than the hard drive. >**Note:**  Before you begin recovery, we recommend that you determine what caused recovery. This might help prevent the problem from occurring again in the future. For instance, if you determine that an attacker has modified your computer by obtaining physical access, you can create new security policies for tracking who has physical presence. After the recovery password has been used to recover access to the PC, BitLocker will reseal the encryption key to the current values of the measured components. -  + For planned scenarios, such as a known hardware or firmware upgrades, you can avoid initiating recovery by temporarily suspending BitLocker protection. Because suspending BitLocker leaves the drive fully encrypted, the administrator can quickly resume BitLocker protection after the planned task has been completed. Using suspend and resume also reseals the encryption key without requiring the entry of the recovery key. >**Note:**  If suspended BitLocker will automatically resume protection when the PC is rebooted, unless a reboot count is specified using the manage-bde command line tool. If software maintenance requires the computer be restarted and you are using two-factor authentication, you can enable BitLocker Network Unlock to provide the secondary authentication factor when the computers do not have an on-premises user to provide the additional authentication method. -  + Recovery has been described within the context of unplanned or undesired behavior, but you can also cause recovery as an intended production scenario, in order to manage access control. For example, when you redeploy desktop or laptop computers to other departments or employees in your enterprise, you can force BitLocker into recovery before the computer is given to a new user. ## Testing recovery @@ -106,7 +107,7 @@ Before you create a thorough BitLocker recovery process, we recommend that you t `manage-bde. -ComputerName -forcerecovery ` > **Note:**  Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user. When using Modern Standby devices (such as Surface devices), the `-forcerecovery` option is not recommended because BitLocker will have to be unlocked and disabled manually from the WinRE environment before the OS can boot up again. For more information, see [BitLocker Troubleshooting: Continuous reboot loop with BitLocker recovery on a slate device](https://social.technet.microsoft.com/wiki/contents/articles/18671.bitlocker-troubleshooting-continuous-reboot-loop-with-bitlocker-recovery-on-a-slate-device.aspx). -  + ## Planning your recovery process When planning the BitLocker recovery process, first consult your organization's current best practices for recovering sensitive information. For example: How does your enterprise handle lost Windows passwords? How does your organization perform smart card PIN resets? You can use these best practices and related resources (people and tools) to help formulate a BitLocker recovery model. @@ -142,7 +143,7 @@ In each of these policies, select **Save BitLocker recovery information to Activ DS** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information for the drive to AD DS succeeds. >**Note:**  If the PCs are part of a workgroup, users should be advised to save their BitLocker recovery password with their Microsoft Account online. Having an online copy of your BitLocker recovery password is recommended to help ensure that you do not lose access to your data in the event that recovery is required. -  + The BitLocker Recovery Password Viewer for Active Directory Users and Computers tool allows domain administrators to view BitLocker recovery passwords for specific computer objects in Active Directory. You can use the following list as a template for creating your own recovery process for recovery password retrieval. This sample process uses the BitLocker Recovery Password Viewer for Active Directory Users and Computers tool. @@ -182,7 +183,7 @@ Before you give the user the recovery password, you should gather any informatio Because the recovery password is 48 digits long the user may need to record the password by writing it down or typing it on a different computer. If you are using MBAM, the recovery password will be regenerated after it is recovered from the MBAM database to avoid the security risks associated with an uncontrolled password. >**Note:**  Because the 48-digit recovery password is long and contains a combination of digits, the user might mishear or mistype the password. The boot-time recovery console uses built-in checksum numbers to detect input errors in each 6-digit block of the 48-digit recovery password, and offers the user the opportunity to correct such errors. -  + ### Post-recovery analysis When a volume is unlocked using a recovery password, an event is written to the event log and the platform validation measurements are reset in the TPM to match the current configuration. Unlocking the volume means that the encryption key has been released and is ready for on-the-fly encryption @@ -217,11 +218,11 @@ After you have identified what caused recovery, you can reset BitLocker protecti The details of this reset can vary according to the root cause of the recovery. If you cannot determine the root cause, or if malicious software or a rootkit might have infected the computer, Helpdesk should apply best-practice virus policies to react appropriately. >**Note:**  You can perform a BitLocker validation profile reset by suspending and resuming BitLocker. -  -- [Unknown PIN](#bkmk-unknownpin) -- [Lost startup key](#bkmk-loststartup) -- [Changes to boot files](#bkmk-changebootknown) -### Unknown PIN + +- [Unknown PIN](#bkmk-unknownpin) +- [Lost startup key](#bkmk-loststartup) +- [Changes to boot files](#bkmk-changebootknown) + ### Unknown PIN If a user has forgotten the PIN, you must reset the PIN while you are logged on to the computer in order to prevent BitLocker from initiating recovery each time the computer is restarted. @@ -261,7 +262,7 @@ Besides the 48-digit BitLocker recovery password, other types of recovery inform If the recovery methods discussed earlier in this document do not unlock the volume, you can use the BitLocker Repair tool to decrypt the volume at the block level. The tool uses the BitLocker key package to help recover encrypted data from severely damaged drives. You can then use this recovered data to salvage encrypted data, even after the correct recovery password has failed to unlock the damaged volume. We recommend that you still save the recovery password. A key package cannot be used without the corresponding recovery password. >**Note:**  You must use the BitLocker Repair tool **repair-bde** to use the BitLocker key package. -  + The BitLocker key package is not saved by default. To save the package along with the recovery password in AD DS you must select the **Backup recovery password and key package** option in the Group Policy settings that control the recovery method. You can also export the key package from a working volume. For more details on how to export key packages, see [Retrieving the BitLocker Key Package](#bkmk-appendixc). ## Resetting recovery passwords @@ -277,30 +278,29 @@ You can reset the recovery password in two ways: 1. Remove the previous recovery password - ``` syntax + ```powershell Manage-bde –protectors –delete C: –type RecoveryPassword ``` 2. Add the new recovery password - ``` syntax + ```powershell Manage-bde –protectors –add C: -RecoveryPassword - ``` 3. Get the ID of the new recovery password. From the screen copy the ID of the recovery password. - ``` syntax + ```powershell Manage-bde –protectors –get C: -Type RecoveryPassword - ``` + 4. Backup the new recovery password to AD DS - ``` syntax + ```powershell Manage-bde –protectors –adbackup C: -id {EXAMPLE6-5507-4924-AA9E-AFB2EB003692} ``` >**Warning:**  You must include the braces in the ID string. -   + **To run the sample recovery password script** 1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs. @@ -308,13 +308,13 @@ You can reset the recovery password in two ways: **cscript ResetPassword.vbs** ->**Important:**  This sample script is configured to work only for the C volume. You must customize the script to match the volume where you want to test password reset. -  +> **Important:** This sample script is configured to work only for the C volume. You must customize the script to match the volume where you want to test password reset. +> > **Note:**  To manage a remote computer, you can specify the remote computer name rather than the local computer name. -  + You can use the following sample script to create a VBScript file to reset the recovery passwords. -``` syntax +```vb ' Target drive letter strDriveLetter = "c:" ' Target computer name @@ -403,7 +403,7 @@ The following sample script exports all previously-saved key packages from AD D You can use the following sample script to create a VBScript file to retrieve the BitLocker key package from AD DS. -``` syntax +```vb ' -------------------------------------------------------------------------------- ' Usage ' -------------------------------------------------------------------------------- @@ -550,7 +550,7 @@ The following sample script exports a new key package from an unlocked, encrypte **cscript GetBitLockerKeyPackage.vbs -?** -``` syntax +```vb ' -------------------------------------------------------------------------------- ' Usage ' -------------------------------------------------------------------------------- @@ -731,5 +731,5 @@ End Function ## See also - [BitLocker overview](bitlocker-overview.md) -  -  + + diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md new file mode 100644 index 0000000000..36decb2b2f --- /dev/null +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-loop-break.md @@ -0,0 +1,40 @@ +--- +title: Breaking out of a Bitlocker recovery loop +description: This topic for IT professionals describes how to break out of a Bitlocker recovery loop. +ms.assetid: #c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: #medium +ms.author: v-maave +author: martyav +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 10/28/2019 +--- + +# Breaking out of a Bitlocker recovery loop + +Sometimes, following a crash, you might be unable to successfully boot into your operating system, due to the recovery screen repeatedly prompting you to enter your recovery key. This can be very frustrating. + +If you've entered the correct Bitlocker recovery key multiple times, and are still unable to continue past the initial recovery screen, follow these steps to break out of the loop. + +> [!NOTE] +> Only try these steps after you have restarted your device at least once. + +1. On the initial recovery screen, don't enter your recovery key. Instead, select **Skip this drive**. + +1. On the next screen, select **Troubleshoot**. + +1. On the Troubleshoot screen, select **Advanced options**. + +1. On the Advanced options screen, select **Command prompt**. + +1. From the WinRE command prompt, manually unlock your drive: `manage-bde.exe -unlock C: -rp ` + +1. Suspend operating system drive protection: `manage-bde.exe -protectors -disable C:` + +1. Once the last command is run, you can safely exit the command prompt and continue to boot into your operating system diff --git a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md index 2a2971042f..2962d7533b 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-security-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-security-faq.md @@ -1,19 +1,20 @@ --- title: BitLocker Security FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +description: Learn more about how BitLocker security works. Browse frequently asked questions, such as, "What form of encryption does BitLocker use?" ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 02/28/2019 --- # BitLocker Security FAQ @@ -38,6 +39,6 @@ BitLocker on operating system drives in its basic configuration (with a TPM but Most operating systems use a shared memory space and rely on the operating system to manage physical memory. A TPM is a hardware component that uses its own internal firmware and logic circuits for processing instructions, thus shielding it from external software vulnerabilities. Attacking the TPM requires physical access to the computer. Additionally, the tools and skills necessary to attack hardware are often more expensive, and usually are not as available as the ones used to attack software. And because each TPM is unique to the computer that contains it, attacking multiple TPM computers would be difficult and time-consuming. -> [!NOTE]   +> [!NOTE] > Configuring BitLocker with an additional factor of authentication provides even more protection against TPM hardware attacks. -  + diff --git a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md index eb1afcd6a5..e8bd11f12b 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-to-go-faq.md @@ -1,13 +1,15 @@ --- title: BitLocker To Go FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +description: Learn more about BitLocker To Go — BitLocker drive encryption for removable drives. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md index 4b09766a7c..7873e99c18 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-upgrading-faq.md @@ -1,18 +1,19 @@ --- title: BitLocker Upgrading FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +description: Learn more about upgrading systems that have BitLocker enabled. Find frequently asked questions, such as, "Can I upgrade to Windows 10 with BitLocker enabled?" ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/28/2019 +ms.reviewer: --- # BitLocker Upgrading FAQ @@ -39,6 +40,6 @@ Users need to suspend BitLocker for Non-Microsoft software updates, such as: - TPM firmware updates - Non-Microsoft application updates that modify boot components -> [!NOTE]   +> [!NOTE] > If you have suspended BitLocker, you can resume BitLocker protection after you have installed the upgrade or update. Upon resuming protection, BitLocker will reseal the encryption key to the new values of the measured components that changed as a part of the upgrade or update. If these types of upgrades or updates are applied without suspending BitLocker, your computer will enter recovery mode when restarting and will require a recovery key or password to access the computer. -  + diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index 31674e2c0e..e4e1a3ffcd 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -2,18 +2,19 @@ title: BitLocker Use BitLocker Drive Encryption Tools to manage BitLocker (Windows 10) description: This topic for the IT professional describes how to use tools to manage BitLocker. ms.assetid: e869db9c-e906-437b-8c70-741dd61b5ea6 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 02/28/2019 --- # BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker @@ -45,7 +46,7 @@ Listed below are examples of basic valid commands for operating system volumes. A good practice when using manage-bde is to determine the volume status on the target system. Use the following command to determine volume status: -``` syntax +```powershell manage-bde -status ``` This command returns the volumes on the target, current encryption status, encryption method, and volume type (operating system or data) for each volume: @@ -54,16 +55,16 @@ This command returns the volumes on the target, current encryption status, encry The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process. -``` syntax +```powershell manage-bde –protectors -add C: -startupkey E: manage-bde -on C: ``` >**Note:**  After the encryption is completed, the USB startup key must be inserted before the operating system can be started. -  + An alternative to the startup key protector on non-TPM hardware is to use a password and an **ADaccountorgroup** protector to protect the operating system volume. In this scenario, you would add the protectors first. This is done with the command: -``` syntax +```powershell manage-bde -protectors -add C: -pw -sid ``` @@ -71,13 +72,13 @@ This command will require you to enter and then confirm the password protector b On computers with a TPM it is possible to encrypt the operating system volume without any defined protectors using manage-bde. The command to do this is: -``` syntax +```powershell manage-bde -on C: ``` This will encrypt the drive using the TPM as the default protector. If you are not sure if a TPM protector is available, to list the protectors available for a volume, run the following command: -``` syntax +```powershell manage-bde -protectors -get ``` ### Using manage-bde with data volumes @@ -86,7 +87,7 @@ Data volumes use the same syntax for encryption as operating system volumes but A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on. -``` syntax +```powershell manage-bde -protectors -add -pw C: manage-bde -on C: ``` @@ -98,7 +99,7 @@ You may experience a problem that damages an area of a hard disk on which BitLoc The BitLocker Repair Tool (Repair-bde) can be used to access encrypted data on a severely damaged hard disk if the drive was encrypted by using BitLocker. Repair-bde can reconstruct critical parts of the drive and salvage recoverable data as long as a valid recovery password or recovery key is used to decrypt the data. If the BitLocker metadata data on the drive has become corrupt, you must be able to supply a backup key package in addition to the recovery password or recovery key. This key package is backed up in Active Directory Domain Services (AD DS) if you used the default setting for AD DS backup. With this key package and either the recovery password or recovery key, you can decrypt portions of a BitLocker-protected drive if the disk is corrupted. Each key package will work only for a drive that has the corresponding drive identifier. You can use the BitLocker Recovery Password Viewer to obtain this key package from AD DS. >**Tip:**  If you are not backing up recovery information to AD DS or if you want to save key packages alternatively, you can use the command `manage-bde -KeyPackage` to generate a key package for a volume. -  + The Repair-bde command-line tool is intended for use when the operating system does not start or when you cannot start the BitLocker Recovery Console. You should use Repair-bde if the following conditions are true: 1. You have encrypted the drive by using BitLocker Drive Encryption. @@ -106,7 +107,7 @@ The Repair-bde command-line tool is intended for use when the operating system d 3. You do not have a copy of the data that is contained on the encrypted drive. >**Note:**  Damage to the drive may not be related to BitLocker. Therefore, we recommend that you try other tools to help diagnose and resolve the problem with the drive before you use the BitLocker Repair Tool. The Windows Recovery Environment (Windows RE) provides additional options to repair computers. -  + The following limitations exist for Repair-bde: - The Repair-bde command-line tool cannot repair a drive that failed during the encryption or decryption process. @@ -244,19 +245,19 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work -  + Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets. -A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the `Get-BitLockerVolume` cmdlet. -The `Get-BitLockerVolume` cmdlet output gives information on the volume type, protectors, protection status and other details. +A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the Get-BitLockerVolume cmdlet. +The Get-BitLockerVolume cmdlet output gives information on the volume type, protectors, protection status and other details. >**Tip:**  Occasionally, all protectors may not be shown when using `Get-BitLockerVolume` due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a full listing of the protectors. `Get-BitLockerVolume C: | fl` -  + If you want to remove the existing protectors prior to provisioning BitLocker on the volume, you could use the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this requires the GUID associated with the protector to be removed. A simple script can pipe the values of each Get-BitLockerVolume return out to another variable as seen below: -``` syntax +```powershell $vol = Get-BitLockerVolume $keyprotectors = $vol.KeyProtector ``` @@ -265,25 +266,25 @@ Using this, you can display the information in the $keyprotectors variable to de Using this information, you can then remove the key protector for a specific volume using the command: -``` syntax +```powershell Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" ``` >**Note:**  The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. -  + ### Using the BitLocker Windows PowerShell cmdlets with operating system volumes Using the BitLocker Windows PowerShell cmdlets is similar to working with the manage-bde tool for encrypting operating system volumes. Windows PowerShell offers users a lot of flexibility. For example, users can add the desired protector as part command for encrypting the volume. Below are examples of common user scenarios and steps to accomplish them in BitLocker Windows PowerShell. The following example shows how to enable BitLocker on an operating system drive using only the TPM protector: -``` syntax +```powershell Enable-BitLocker C: - ``` + In the example below, adds one additional protector, the StartupKey protector and chooses to skip the BitLocker hardware test. In this example, encryption starts immediately without the need for a reboot. -``` syntax +```powershell Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTest ``` @@ -292,7 +293,7 @@ Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath -SkipHardwareTes Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user defined password. -``` syntax +```powershell $pw = Read-Host -AsSecureString Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw @@ -302,31 +303,31 @@ Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw The **ADAccountOrGroup** protector, introduced in Windows 8 and Windows Server 2012, is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover to and be unlocked by any member computer of the cluster. >**Warning:**  The **ADAccountOrGroup** protector requires the use of an additional protector for use (such as TPM, PIN, or recovery key) when used on operating system volumes -  + To add an **ADAccountOrGroup** protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G. -``` syntax +```powershell Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator ``` For users who wish to use the SID for the account or group, the first step is to determine the SID associated with the account. To get the specific SID for a user account in Windows PowerShell, use the following command: >**Note:**  Use of this command requires the RSAT-AD-PowerShell feature. -  -``` syntax + +```powershell get-aduser -filter {samaccountname -eq "administrator"} ``` >**Tip:**  In addition to the PowerShell command above, information about the locally logged on user and group membership can be found using: WHOAMI /ALL. This does not require the use of additional features. -  + The following example adds an **ADAccountOrGroup** protector to the previously encrypted operating system volume using the SID of the account: -``` syntax +```powershell Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup S-1-5-21-3651336348-8937238915-291003330-500 ``` >**Note:**  Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes. -  + ## More information - [BitLocker overview](bitlocker-overview.md) diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md index 56d19b8cbc..9f41146f0d 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md @@ -2,18 +2,19 @@ title: BitLocker Use BitLocker Recovery Password Viewer (Windows 10) description: This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. ms.assetid: 04c93ac5-5dac-415e-b636-de81435753a2 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 02/28/2019 --- # BitLocker: Use BitLocker Recovery Password Viewer diff --git a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md index 48020eea3e..0aebf543c2 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-using-with-other-programs-faq.md @@ -1,14 +1,15 @@ --- title: Using BitLocker with other programs FAQ (Windows 10) -description: This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker. +description: Learn how to integrate BitLocker with other software on your device. ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -77,9 +78,9 @@ Limited BitLocker functionality is available in Safe Mode. BitLocker-protected d Both fixed and removable data drives can be locked by using the Manage-bde command-line tool and the –lock command. -> [!NOTE]   +> [!NOTE] > Ensure all data is saved to the drive before locking it. Once locked, the drive will become inaccessible. -  + The syntax of this command is: manage-bde driveletter -lock diff --git a/windows/security/information-protection/bitlocker/images/4509186-en-1.png b/windows/security/information-protection/bitlocker/images/4509186-en-1.png new file mode 100644 index 0000000000..11f986fb68 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509186-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509188-en-1.png b/windows/security/information-protection/bitlocker/images/4509188-en-1.png new file mode 100644 index 0000000000..5b5b7b1b4a Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509188-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509189-en-1.png b/windows/security/information-protection/bitlocker/images/4509189-en-1.png new file mode 100644 index 0000000000..8d243a1899 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509189-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509190-en-1.png b/windows/security/information-protection/bitlocker/images/4509190-en-1.png new file mode 100644 index 0000000000..bd37969b5d Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509190-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509191-en-1.png b/windows/security/information-protection/bitlocker/images/4509191-en-1.png new file mode 100644 index 0000000000..00ef607ab3 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509191-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509193-en-1.png b/windows/security/information-protection/bitlocker/images/4509193-en-1.png new file mode 100644 index 0000000000..2085613b3d Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509193-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509194-en-1.png b/windows/security/information-protection/bitlocker/images/4509194-en-1.png new file mode 100644 index 0000000000..f4506c399b Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509194-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509195-en-1.png b/windows/security/information-protection/bitlocker/images/4509195-en-1.png new file mode 100644 index 0000000000..cbecb03c4e Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509195-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509196-en-1.png b/windows/security/information-protection/bitlocker/images/4509196-en-1.png new file mode 100644 index 0000000000..01e94b1243 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509196-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509198-en-1.png b/windows/security/information-protection/bitlocker/images/4509198-en-1.png new file mode 100644 index 0000000000..9056658662 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509198-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509199-en-1.png b/windows/security/information-protection/bitlocker/images/4509199-en-1.png new file mode 100644 index 0000000000..d68a22eef7 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509199-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509200-en-1.png b/windows/security/information-protection/bitlocker/images/4509200-en-1.png new file mode 100644 index 0000000000..689bb19299 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509200-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509201-en-1.png b/windows/security/information-protection/bitlocker/images/4509201-en-1.png new file mode 100644 index 0000000000..d521e86eed Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509201-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509202-en-1.png b/windows/security/information-protection/bitlocker/images/4509202-en-1.png new file mode 100644 index 0000000000..bfcd2326b6 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509202-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509203-en-1.png b/windows/security/information-protection/bitlocker/images/4509203-en-1.png new file mode 100644 index 0000000000..05acc571fe Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509203-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509204-en-1.png b/windows/security/information-protection/bitlocker/images/4509204-en-1.png new file mode 100644 index 0000000000..fa13f38ba9 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509204-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509205-en-1.png b/windows/security/information-protection/bitlocker/images/4509205-en-1.png new file mode 100644 index 0000000000..a4f5cc15d2 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509205-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/4509206-en-1.png b/windows/security/information-protection/bitlocker/images/4509206-en-1.png new file mode 100644 index 0000000000..7b7e449443 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/4509206-en-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/pcptool-output.jpg b/windows/security/information-protection/bitlocker/images/pcptool-output.jpg new file mode 100644 index 0000000000..91d10e6c66 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/pcptool-output.jpg differ diff --git a/windows/security/information-protection/bitlocker/images/psget-winevent-1.png b/windows/security/information-protection/bitlocker/images/psget-winevent-1.png new file mode 100644 index 0000000000..21adc928de Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/psget-winevent-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/psget-winevent-2.png b/windows/security/information-protection/bitlocker/images/psget-winevent-2.png new file mode 100644 index 0000000000..2941452109 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/psget-winevent-2.png differ diff --git a/windows/security/information-protection/bitlocker/images/sccm-imageconfig.jpg b/windows/security/information-protection/bitlocker/images/sccm-imageconfig.jpg new file mode 100644 index 0000000000..40ddf183f6 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/sccm-imageconfig.jpg differ diff --git a/windows/security/information-protection/bitlocker/images/ts-bitlocker-usb-default-sddl.png b/windows/security/information-protection/bitlocker/images/ts-bitlocker-usb-default-sddl.png new file mode 100644 index 0000000000..53b374d26e Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-bitlocker-usb-default-sddl.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-bitlocker-usb-sddl.png b/windows/security/information-protection/bitlocker/images/ts-bitlocker-usb-sddl.png new file mode 100644 index 0000000000..bc299cc0e9 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-bitlocker-usb-sddl.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-1.png b/windows/security/information-protection/bitlocker/images/ts-tpm-1.png new file mode 100644 index 0000000000..1bef01d587 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-1.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-2.png b/windows/security/information-protection/bitlocker/images/ts-tpm-2.png new file mode 100644 index 0000000000..d4d825029c Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-2.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-3.png b/windows/security/information-protection/bitlocker/images/ts-tpm-3.png new file mode 100644 index 0000000000..2acac0f3ea Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-3.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-4.png b/windows/security/information-protection/bitlocker/images/ts-tpm-4.png new file mode 100644 index 0000000000..cb5b84d6b9 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-4.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-5.png b/windows/security/information-protection/bitlocker/images/ts-tpm-5.png new file mode 100644 index 0000000000..3b3cd2b961 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-5.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-6.png b/windows/security/information-protection/bitlocker/images/ts-tpm-6.png new file mode 100644 index 0000000000..4e82b9b76e Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-6.png differ diff --git a/windows/security/information-protection/bitlocker/images/ts-tpm-7.png b/windows/security/information-protection/bitlocker/images/ts-tpm-7.png new file mode 100644 index 0000000000..8fb9446d93 Binary files /dev/null and b/windows/security/information-protection/bitlocker/images/ts-tpm-7.png differ diff --git a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md index e6b09cec2e..72436ef74d 100644 --- a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -2,58 +2,49 @@ title: Prepare your organization for BitLocker Planning and policies (Windows 10) description: This topic for the IT professional explains how can you plan your BitLocker deployment. ms.assetid: 6e3593b5-4e8a-40ac-808a-3fdbc948059d +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/28/2019 +ms.date: 04/24/2019 --- # Prepare your organization for BitLocker: Planning and policies **Applies to** -- Windows 10 + +- Windows 10 This topic for the IT professional explains how can you plan your BitLocker deployment. When you design your BitLocker deployment strategy, define the appropriate policies and configuration requirements based on the business requirements of your organization. The following topics will help you collect information that you can use to frame your decision-making process about deploying and managing BitLocker systems. -- [Audit your environment](#bkmk-audit) -- [Encryption keys and authentication](#bkk-encrypt) -- [TPM hardware configurations](#bkmk-tpmconfigurations) -- [Non-TPM hardware configurations](#bkmk-nontpm) -- [Disk configuration considerations](#bkmk-disk) -- [BitLocker provisioning](#bkmk-prov) -- [Used Disk Space Only encryption](#bkk-used) -- [Active Directory Domain Services considerations](#bkmk-addscons) -- [FIPS support for recovery password protector](#bkmk-fipssupport) -- [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) - -## Audit your environment +## Audit your environment To plan your enterprise deployment of BitLocker, you must first understand your current environment. Conduct an informal audit to define your current policies, procedures, and hardware environment. Begin by reviewing your existing corporate security policies as they relate to disk encryption software. If your organization is not currently using disk encryption software, none of these policies will exist. If you are using disk encryption software, then you might need to modify your organization's policies to address the capabilities of BitLocker. Use the following questions to help you document your organization's current disk encryption security policies: -1. Are there policies to address which computers will use BitLocker and which computers will not use BitLocker? -2. What policies exist to control recovery password and recovery key storage? -3. What are the policies for validating the identity of users that need to perform BitLocker recovery? -4. What policies exist to control who in the organization has access to recovery data? -5. What policies exist to control computer decommissioning or retirement? +1. Are there policies to address which computers will use BitLocker and which computers will not use BitLocker? +2. What policies exist to control recovery password and recovery key storage? +3. What are the policies for validating the identity of users that need to perform BitLocker recovery? +4. What policies exist to control who in the organization has access to recovery data? +5. What policies exist to control computer decommissioning or retirement? -## Encryption keys and authentication +## Encryption keys and authentication BitLocker helps prevent unauthorized access to data on lost or stolen computers by: -- Encrypting the entire Windows operating system volume on the hard disk. -- Verifying the boot process integrity. +- Encrypting the entire Windows operating system volume on the hard disk. +- Verifying the boot process integrity. The trusted platform module (TPM) is a hardware component installed in many newer computers by the computer manufacturers. It works with BitLocker to help protect user data and to ensure that a computer has not been tampered with while the system was offline. @@ -71,7 +62,7 @@ On computers that do not have a TPM version 1.2 or higher, you can still use Bi | Startup key | An encryption key that can be stored on most removable media. This key protector can be used alone on non-TPM computers, or in conjunction with a TPM for added security.| | Recovery password | A 48-digit number used to unlock a volume when it is in recovery mode. Numbers can often be typed on a regular keyboard, if the numbers on the normal keyboard are not responding you can always use the function keys (F1-F10) to input the numbers.| | Recovery key| An encryption key stored on removable media that can be used for recovering data encrypted on a BitLocker volume.| -  + ### BitLocker authentication methods | Authentication method | Requires user interaction | Description | @@ -81,7 +72,7 @@ On computers that do not have a TPM version 1.2 or higher, you can still use Bi | TPM + Network key | No | The TPM successfully validates early boot components, and a valid encrypted network key has been provided from the WDS server. This authentication method provides automatic unlock of operating system volumes at system reboot while still maintaining multifactor authentication. | | TPM + startup key| Yes| The TPM successfully validates early boot components, and a USB flash drive containing the startup key has been inserted.| | Startup key only | Yes| The user is prompted to insert the USB flash drive that holds the recovery key and/or startup key and reboot the computer.| -  + **Will you support computers without TPM version 1.2 or higher?** Determine whether you will support computers that do not have a TPM version 1.2 or higher in your environment. If you choose to support BitLocker on this type of computer, a user must use a USB startup key to boot the system. This requires additional support processes similar to multifactor authentication. @@ -100,7 +91,7 @@ If there are areas of your organization where data residing on user computers is The protection differences provided by multifactor authentication methods cannot be easily quantified. Consider each authentication method's impact on Helpdesk support, user education, user productivity, and automated systems management processes. -## TPM hardware configurations +## TPM hardware configurations In your deployment plan, identify what TPM-based hardware platforms will be supported. Document the hardware models from an OEM of your choice, so that their configurations can be tested and supported. TPM hardware requires special consideration during all aspects of planning and deployment. @@ -116,24 +107,24 @@ An endorsement key can be created at various points in the TPM’s lifecycle, bu For more information about the TPM and the TCG, see the Trusted Computing Group: Trusted Platform Module (TPM) Specifications (). -## Non-TPM hardware configurations +## Non-TPM hardware configurations Devices that do not include a TPM can still be protected by drive encryption. Windows To Go workspaces can be BitLocker protected using a startup password and PCs without a TPM can use a startup key. Use the following questions to identify issues that might affect your deployment in a non-TPM configuration: -- Are password complexity rules in place? -- Do you have budget for USB flash drives for each of these computers? -- Do your existing non-TPM devices support USB devices at boot time? +- Are password complexity rules in place? +- Do you have budget for USB flash drives for each of these computers? +- Do your existing non-TPM devices support USB devices at boot time? Test your individual hardware platforms with the BitLocker system check option while you are enabling BitLocker. The system check will ensure that BitLocker can read the recovery information from a USB device and encryption keys correctly before it encrypts the volume. CD and DVD drives cannot act as a block storage device and cannot be used to store the BitLocker recovery material. -## Disk configuration considerations +## Disk configuration considerations To function correctly, BitLocker requires a specific disk configuration. BitLocker requires two partitions that meet the following requirements: -- The operating system partition contains the operating system and its support files; it must be formatted with the NTFS file system -- The system partition (or boot partition) contains the files that are needed to load Windows after the BIOS or UEFI firware has prepared the system hardware. BitLocker is not enabled on this partition. For BitLocker to work, the system partition must not be encrypted and must be on a different partition than the operating system. On UEFI platforms the system partition must be formatted with the FAT 32 file system. On BIOS platforms the system partition must be formatted with the NTFS file system. It should be at least 350 MB in size +- The operating system partition contains the operating system and its support files; it must be formatted with the NTFS file system +- The system partition (or boot partition) contains the files that are needed to load Windows after the BIOS or UEFI firware has prepared the system hardware. BitLocker is not enabled on this partition. For BitLocker to work, the system partition must not be encrypted and must be on a different partition than the operating system. On UEFI platforms the system partition must be formatted with the FAT 32 file system. On BIOS platforms the system partition must be formatted with the NTFS file system. It should be at least 350 MB in size Windows setup will automatically configure the disk drives of your computer to support BitLocker encryption. @@ -141,7 +132,7 @@ Windows Recovery Environment (Windows RE) is an extensible recovery platform tha Windows RE can also be used from boot media other than the local hard disk. If you choose not to install Windows RE on the local hard disk of BitLocker-enabled computers, you can use alternate boot methods, such as Windows Deployment Services, CD-ROM, or USB flash drive, for recovery. -## BitLocker provisioning +## BitLocker provisioning In Windows Vista and Windows 7, BitLocker was provisioned post installation for system and data volumes through either the manage-bde command line interface or the Control Panel user interface. With newer operating systems, BitLocker can be easily provisioned before the operating system is installed. Preprovisioning requires that the computer have a TPM. @@ -151,7 +142,7 @@ When using the control panel options, administrators can choose to **Turn on Bit Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment (WinPE). This is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option this step takes only a few seconds and so incorporates well into regular deployment processes. -## Used Disk Space Only encryption +## Used Disk Space Only encryption The BitLocker Setup wizard provides administrators the ability to choose the Used Disk Space Only or Full encryption method when enabling BitLocker for a volume. Administrators can use the new BitLocker Group Policy setting to enforce either Used Disk Space Only or Full disk encryption. @@ -161,39 +152,40 @@ Used Disk Space Only means that only the portion of the drive that contains data Full drive encryption means that the entire drive will be encrypted, regardless of whether data is stored on it or not. This is useful for drives that have been repurposed and may contain data remnants from their previous use. -## Active Directory Domain Services considerations +## Active Directory Domain Services considerations -BitLocker integrates with Active Directory Domain Services (AD DS) to provide centralized key management. By default, no recovery information is backed up to Active Directory. Administrators can configure the following Group Policy setting to enable backup of BitLocker recovery information: +BitLocker integrates with Active Directory Domain Services (AD DS) to provide centralized key management. By default, no recovery information is backed up to Active Directory. Administrators can configure the following Group Policy setting for each drive type to enable backup of BitLocker recovery information: -Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Turn on BitLocker backup to Active Directory Domain Services +Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\*drive type*\\Choose how BitLocker protected drives can be recovered. By default, only Domain Admins have access to BitLocker recovery information, but [access can be delegated to others](https://blogs.technet.microsoft.com/craigf/2011/01/26/delegating-access-in-ad-to-bitlocker-recovery-information/). The following recovery data is saved for each computer object: -- **Recovery password** +- **Recovery password** A 48-digit recovery password used to recover a BitLocker-protected volume. Users enter this password to unlock a volume when BitLocker enters recovery mode. -- **Key package data** +- **Key package data** With this key package and the recovery password, you will be able decrypt portions of a BitLocker-protected volume if the disk is severely damaged. Each key package will only work with the volume it was created on, which can be identified by the corresponding volume ID. -## FIPS support for recovery password protector +## FIPS support for recovery password protector Functionality introduced in Windows Server 2012 R2 and Windows 8.1, allows BitLocker to be fully functional in FIPS mode. ->**Note:**  The United States Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems that are used by the U.S. federal government. The FIPS 140 standard defines approved cryptographic algorithms. The FIPS 140 standard also sets forth requirements for key generation and for key management. The National Institute of Standards and Technology (NIST) uses the Cryptographic Module Validation Program (CMVP) to determine whether a particular implementation of a cryptographic algorithm is compliant with the FIPS 140 standard. An implementation of a cryptographic algorithm is considered FIPS 140-compliant only if it has been submitted for and has passed NIST validation. An algorithm that has not been submitted cannot be considered FIPS-compliant even if the implementation produces identical data as a validated implementation of the same algorithm.  -  +> [!NOTE] +> The United States Federal Information Processing Standard (FIPS) defines security and interoperability requirements for computer systems that are used by the U.S. federal government. The FIPS 140 standard defines approved cryptographic algorithms. The FIPS 140 standard also sets forth requirements for key generation and for key management. The National Institute of Standards and Technology (NIST) uses the Cryptographic Module Validation Program (CMVP) to determine whether a particular implementation of a cryptographic algorithm is compliant with the FIPS 140 standard. An implementation of a cryptographic algorithm is considered FIPS 140-compliant only if it has been submitted for and has passed NIST validation. An algorithm that has not been submitted cannot be considered FIPS-compliant even if the implementation produces identical data as a validated implementation of the same algorithm. + Prior to these supported versions of Windows, when Windows was in FIPS mode, BitLocker prevented the creation or use of recovery passwords and instead forced the user to use recovery keys. For more information about these issues, see the support article [kb947249](https://support.microsoft.com/kb/947249). But on computers running these supported systems with BitLocker enabled: -- FIPS-compliant recovery password protectors can be created when Windows is in FIPS mode. These protectors use the FIPS 140 NIST SP800-132 algorithm. -- Recovery passwords created in FIPS mode on Windows 8.1 can be distinguished from recovery passwords created on other systems. -- Recovery unlock using the FIPS-compliant algorithm based recovery password protector work in all cases that currently work for recovery passwords. -- When FIPS-compliant recovery passwords unlock volumes, the volume is unlocked to allow read/write access even while in FIPS mode. -- FIPS-compliant recovery password protectors can be exported and stored in AD a while in FIPS mode. +- FIPS-compliant recovery password protectors can be created when Windows is in FIPS mode. These protectors use the FIPS 140 NIST SP800-132 algorithm. +- Recovery passwords created in FIPS mode on Windows 8.1 can be distinguished from recovery passwords created on other systems. +- Recovery unlock using the FIPS-compliant algorithm based recovery password protector work in all cases that currently work for recovery passwords. +- When FIPS-compliant recovery passwords unlock volumes, the volume is unlocked to allow read/write access even while in FIPS mode. +- FIPS-compliant recovery password protectors can be exported and stored in AD a while in FIPS mode. The BitLocker Group Policy settings for recovery passwords work the same for all Windows versions that support BitLocker, whether in FIPs mode or not. @@ -201,8 +193,8 @@ However, you cannot use recovery passwords generated on a system in FIPS mode fo ## More information -- [Trusted Platform Module](/windows/security/hardware-protection/tpm/trusted-platform-module-overview.md) -- [TPM Group Policy settings](/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md) +- [Trusted Platform Module](https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-top-node) +- [TPM Group Policy settings](https://docs.microsoft.com/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings) - [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.md) - [BitLocker](bitlocker-overview.md) - [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) diff --git a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md index 22ebe4babb..1473dadc79 100644 --- a/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md +++ b/windows/security/information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md @@ -2,13 +2,14 @@ title: Protecting cluster shared volumes and storage area networks with BitLocker (Windows 10) description: This topic for IT pros describes how to protect CSVs and SANs with BitLocker. ms.assetid: ecd25a10-42c7-4d31-8a7e-ea52c8ebc092 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -32,14 +33,14 @@ BitLocker can protect both physical disk resources and cluster shared volumes ve BitLocker on volumes within a cluster are managed based on how the cluster service "views" the volume to be protected. The volume can be a physical disk resource such as a logical unit number (LUN) on a storage area network (SAN) or network attached storage (NAS). >**Important**  SANs used with BitLocker must have obtained Windows Hardware Certification. For more info, see [Windows Hardware Lab Kit](https://msdn.microsoft.com/library/windows/hardware/dn930814.aspx). -  + Alternatively, the volume can be a cluster-shared volume, a shared namespace, within the cluster. Windows Server 2012 expanded the CSV architecture, now known as CSV2.0, to enable support for BitLocker. When using BitLocker with volumes designated for a cluster, the volume will need to turn on BitLocker before its addition to the storage pool within cluster or put the resource into maintenance mode before BitLocker operations will complete. Windows PowerShell or the manage-bde command line interface is the preferred method to manage BitLocker on CSV2.0 volumes. This is recommended over the BitLocker Control Panel item because CSV2.0 volumes are mount points. Mount points are an NTFS object that is used to provide an entry point to other volumes. Mount points do not require the use of a drive letter. Volumes that lack drive letters do not appear in the BitLocker Control Panel item. Additionally, the new Active Directory-based protector option required for cluster disk resource or CSV2.0 resources is not available in the Control Panel item. >**Note:**  Mount points can be used to support remote mount points on SMB based network shares. This type of share is not supported for BitLocker encryption. -  + For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde -WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This is blocked in order to avoid expanding thinly provisioned volumes to occupy the entire backing store while wiping the unoccupied (free) space. ### Active Directory-based protector @@ -56,7 +57,7 @@ You can also use an Active Directory Domain Services (AD DS) protector for prote 4. Registry-based auto-unlock key >**Note:**  A Windows Server 2012 or later domain controller is required for this feature to work properly. -  + ### Turning on BitLocker before adding disks to a cluster using Windows PowerShell BitLocker encryption is available for disks before or after addition to a cluster storage pool. The advantage of encrypting volumes prior to adding them to a cluster is that the disk resource does not require suspending the resource to complete the operation. To turn on BitLocker for a disk before adding it to a cluster, do the following: @@ -65,18 +66,18 @@ BitLocker encryption is available for disks before or after addition to a cluste 2. Ensure the disk is formatted NTFS and has a drive letter assigned to it. 3. Identify the name of the cluster with Windows PowerShell. - ``` syntax + ```powershell Get-Cluster - ``` + 4. Enable BitLocker on the volume of your choice with an **ADAccountOrGroup** protector, using the cluster name. For example, use a command such as: - ``` syntax + ```powershell Enable-BitLocker E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$ ``` >**Warning:**  You must configure an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to fail over properly in a traditional failover cluster. -   + 5. Repeat the preceding steps for each disk in the cluster. 6. Add the volume(s) to the cluster. @@ -87,32 +88,32 @@ When the cluster service owns a disk resource already, it needs to be set into m 1. Install the BitLocker Drive Encryption feature if it is not already installed. 2. Check the status of the cluster disk using Windows PowerShell. - ``` syntax + ```powershell Get-ClusterResource "Cluster Disk 1" ``` 3. Put the physical disk resource into maintenance mode using Windows PowerShell. - ``` syntax + ```powershell Get-ClusterResource "Cluster Disk 1" | Suspend-ClusterResource ``` 4. Identify the name of the cluster with Windows PowerShell. - ``` syntax + ```powershell Get-Cluster ``` 5. Enable BitLocker on the volume of your choice with an **ADAccountOrGroup** protector, using the cluster name. For example, use a command such as: - ``` syntax + ```powershell Enable-BitLocker E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$ ``` >**Warning:**  You must configure an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to fail over properly in a traditional failover cluster. -   + 6. Use **Resume-ClusterResource** to take the physical disk resource back out of maintenance mode: - ``` syntax + ```powershell Get-ClusterResource "Cluster Disk 1" | Resume-ClusterResource ``` @@ -145,7 +146,7 @@ You can also use manage-bde to enable BitLocker on clustered volumes. The steps 6. Once the disk is online in the storage pool, it can be added to a CSV by right clicking on the disk resource and choosing "**Add to cluster shared volumes**". CSVs can include both encrypted and unencrypted volumes. To check the status of a particular volume for BitLocker encryption, administrators can utilize the manage-bde -status command with a path to the volume inside the CSV namespace as seen in the example command line below. -``` syntax +```powershell manage-bde -status "C:\ClusterStorage\volume1" ``` @@ -190,7 +191,7 @@ The following table contains information about both Physical Disk Resources (i.e

                                    Manage-bde Pause/Resume

                                    Blocked

                                    -

                                    Blocked**

                                    +

                                    Blocked

                                    Blocked

                                    Allowed

                                    @@ -259,9 +260,9 @@ The following table contains information about both Physical Disk Resources (i.e -  ->**Note:**  Although the manage-bde -pause command is Blocked in clusters, the cluster service will automatically resume a paused encryption or decryption from the MDS node -  + +>                                    Note:** Although the manage-bde -pause command is Blocked in clusters, the cluster service will automatically resume a paused encryption or decryption from the MDS node + In the case where a physical disk resource experiences a failover event during conversion, the new owning node will detect the conversion is not complete and will complete the conversion process. ### Other considerations when using BitLocker on CSV2.0 diff --git a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md new file mode 100644 index 0000000000..88e28e59eb --- /dev/null +++ b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md @@ -0,0 +1,136 @@ +--- +title: Guidelines for troubleshooting BitLocker +description: Describes approaches for investigating BitLocker issues, including how to gather diagnostic information +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/17/2019 +--- + +# Guidelines for troubleshooting BitLocker + +This article addresses common issues in BitLocker and provides guidelines to troubleshoot these issues. This article also provides pointers to start the troubleshooting process, including what data to collect and what settings to check in order to narrow down the location in which these issues occur. + +## Review the event logs + +Open Event Viewer and review the following logs under Applications and Services logs\\Microsoft\\Windows: + +- **BitLocker-API**. Review the Management log, the Operational log, and any other logs that are generated in this folder. The default logs have the following unique names: + - Microsoft-Windows-BitLocker/BitLocker Operational + - Microsoft-Windows-BitLocker/BitLocker Management + +- **BitLocker-DrivePreparationTool**. Review the Admin log, the **Operational log, and any other logs that are generated in this folder. The default logs have the following unique names: + - Microsoft-Windows-BitLocker-DrivePreparationTool/Operational + - Microsoft-Windows-BitLocker-DrivePreparationTool/Admin + +Additionally, review the Windows logs\\System log for events that were produced by the TCM and TCM-WMI event sources. + +To filter and display or export logs, you can use the [wevtutil.exe](https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil) command-line tool or the [Get-WinEvent](https://docs.microsoft.com/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-6) cmdlet. + +For example, to use wevtutil to export the contents of the Operational log from the BitLocker-API folder to a text file that is named BitLockerAPIOpsLog.txt, open a Command Prompt window, and run a command that resembles the following: + +```cmd +wevtutil qe "Microsoft-Windows-BitLocker/BitLocker Operational" /f:text > BitLockerAPIOpsLog.txt +``` + +To use the **Get-WinEvent** cmdlet to export the same log to a comma-separated text file, open a Windows Powershell window and run a command that resembles the following: + +```ps +Get-WinEvent -logname "Microsoft-Windows-BitLocker/BitLocker Operational"  | Export-Csv -Path Bitlocker-Operational.csv +``` + +You can use Get-WinEvent in an elevated PowerShell window to display filtered information from the System or Application log by using syntax that resembles the following: + +- To display BitLocker-related information: + ```ps + Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object -Property Message -Match 'BitLocker' | fl + ``` + + The output of such a command resembles the following. + + ![Display of events that is produced by using Get-WinEvent and a BitLocker filter](./images/psget-winevent-1.png) + +- To export BitLocker-related information: + ```ps + Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object -Property Message -Match 'BitLocker' | Export-Csv -Path System-BitLocker.csv + ``` + +- To display TPM-related information: + ```ps + Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object -Property Message -Match 'TPM' | fl + ``` + +- To export TPM-related information: + ```ps + Get-WinEvent -FilterHashtable @{LogName='System'} | Where-Object -Property Message -Match 'TPM' | Export-Csv -Path System-TPM.csv + ``` + + The output of such a command resembles the following. + + ![Display of events that is produced by using Get-WinEvent and a TPM filter](./images/psget-winevent-2.png) + +> [!NOTE] +> If you intend to contact Microsoft Support, we recommend that you export the logs listed in this section. + +## Gather status information from the BitLocker technologies + +Open an elevated Windows PowerShell window, and run each of the following commands. + +|Command |Notes | +| - | - | +|[**get-tpm \> C:\\TPM.txt**](https://docs.microsoft.com/powershell/module/trustedplatformmodule/get-tpm?view=win10-ps) |Exports information about the local computer's Trusted Platform Module (TPM). This cmdlet shows different values depending on whether the TPM chip is version 1.2 or 2.0. This cmdlet is not supported in Windows 7. | +|[**manage-bde –status \> C:\\BDEStatus.txt**](https://docs.microsoft.com/windows-server/administration/windows-commands/manage-bde-status) |Exports information about the general encryption status of all drives on the computer. | +|[**manage-bde c:
                                    -protectors -get \> C:\\Protectors**](https://docs.microsoft.com/windows-server/administration/windows-commands/manage-bde-protectors) |Exports information about the protection methods that are used for the BitLocker encryption key. | +|[**reagentc /info \> C:\\reagent.txt**](https://docs.microsoft.com/windows-hardware/manufacture/desktop/reagentc-command-line-options) |Exports information about an online or offline image about the current status of the Windows Recovery Environment (WindowsRE) and any available recovery image. | +|[**get-BitLockerVolume \| fl**](https://docs.microsoft.com/powershell/module/bitlocker/get-bitlockervolume?view=win10-ps) |Gets information about volumes that BitLocker Drive Encryption can protect. | + +## Review the configuration information + +1. Open an elevated Command Prompt window, and run the following commands. + + |Command |Notes | + | - | - | + |[**gpresult /h \**](https://docs.microsoft.com/windows-server/administration/windows-commands/gpresult) |Exports the Resultant Set of Policy information, and saves the information as an HTML file. | + |[**msinfo /report \ /computer \**](https://docs.microsoft.com/windows-server/administration/windows-commands/msinfo32) |Exports comprehensive information about the hardware, system components, and software environment on the local computer. The **/report** option saves the information as a .txt file. | + +1. Open Registry Editor, and export the entries in the following subkeys: + + - **HKLM\\SOFTWARE\\Policies\\Microsoft\\FVE** + - **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM\\** + +## Check the BitLocker prerequisites + +Common settings that can cause issues for BitLocker include the following: + +- The TPM must be unlocked. You can check the output of the **get-tpm** command for the status of the TPM. +- Windows RE must be enabled. You can check the output of the **reagentc** command for the status of WindowsRE. +- The system reserved partition must use the correct format. + - On Unified Extensible Firmware Interface (UEFI) computers, the system reserved partition must be formatted as FAT32. + - On legacy computers, the system reserved partition must be formatted as NTFS. +- If the device that you are troubleshooting is a slate or tablet PC, use to verify the status of the **Enable use of BitLocker authentication requiring preboot keyboard input on slates** option. + +For more information about the BitLocker prerequisites, see [BitLocker basic deployment: Using BitLocker to encrypt volumes](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-basic-deployment#using-bitlocker-to-encrypt-volumes) + +## Next steps + +If the information that you have examined so far indicates a specific issue (for example, WindowsRE is not enabled), the issue may have a straightforward fix. + +Resolving issues that do not have obvious causes depends on exactly which components are involved and what behavior you see. The information that you have gathered can help you narrow down the areas to investigate. + +- If you are working on a device that is managed by Microsoft Intune, see [Enforcing BitLocker policies by using Intune: known issues](ts-bitlocker-intune-issues.md). +- If BitLocker does not start or cannot encrypt a drive and you notice errors or events that are related to the TPM, see [BitLocker cannot encrypt a drive: known TPM issues](ts-bitlocker-cannot-encrypt-tpm-issues.md). +- If BitLocker does not start or cannot encrypt a drive, see [BitLocker cannot encrypt a drive: known issues](ts-bitlocker-cannot-encrypt-issues.md). +- If BitLocker Network Unlock does not behave as expected, see [BitLocker Network Unlock: known issues](ts-bitlocker-network-unlock-issues.md). +- If BitLocker does not behave as expected when you recover an encrypted drive, or if you did not expect BitLocker to recover the drive, see [BitLocker recovery: known issues](ts-bitlocker-recovery-issues.md). +- If BitLocker does not behave as expected or the encrypted drive does not behave as expected, and you notice errors or events that are related to the TPM, see [BitLocker and TPM: other known issues](ts-bitlocker-tpm-issues.md). +- If BitLocker does not behave as expected or the encrypted drive does not behave as expected, see [BitLocker configuration: known issues](ts-bitlocker-config-issues.md). + +We recommend that you keep the information that you have gathered handy in case you decide to contact Microsoft Support for help to resolve your issue. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md new file mode 100644 index 0000000000..2382b91a2a --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md @@ -0,0 +1,103 @@ +--- +title: BitLocker cannot encrypt a drive known issues +description: Provides guidance for troubleshooting known issues that may prevent BitLocker Drive Encryption from encrypting a drive +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/17/2019 +--- + +# BitLocker cannot encrypt a drive: known issues + +This article describes common issues that may prevent BitLocker from encrypting a drive. This article also provides guidance to address these issues. + +> [!NOTE] +> If you have determined that your BitLocker issue involves the Trusted Platform Module (TPM), see [BitLocker cannot encrypt a drive: known TPM issues](ts-bitlocker-cannot-encrypt-tpm-issues.md). + +## Error 0x80310059: BitLocker Drive Encryption is already performing an operation on this drive + +When you turn on BitLocker Drive Encryption on a computer that is running Windows 10 Professional, you receive a message that resembles the following: + +> **ERROR:** An error occurred (code 0x80310059):BitLocker Drive Encryption is already performing an operation on this drive. Please complete all operations before continuing.NOTE: If the -on switch has failed to add key protectors or start encryption,you may need to call manage-bde -off before attempting -on again. + +### Cause + +This issue may be caused by settings that are controlled by Group Policy Objects (GPOs). + +### Resolution + +> [!IMPORTANT] +> Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, [back up the registry for restoration](https://support.microsoft.com/help/322756) in case problems occur. + +To resolve this issue, follow these steps: + +1. Start Registry Editor, and navigate to the following subkey: + **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE** + +1. Delete the following entries: + - **OSPlatformValidation\_BIOS** + - **OSPlatformValidation\_UEFI** + - **PlatformValidation** + +1. Exit Registry Editor, and turn on BitLocker Drive Encryption again. + +## "Access is denied" message when you try to encrypt removable drives + +You have a computer that is running Windows 10, version 1709 or version 1607. You try to encrypt a USB drive by following these steps: + +1. In Windows Explorer, right-click the USB drive and select **Turn on BitLocker**. +1. On the **Choose how you want to unlock this drive** page, select **Use a password to unlock the drive**. +1. Follow the instructions on the page to enter your password. +1. On the **Are you ready to encrypt this drive?** page, select **Start encrypting**. +1. The **Starting encryption** page displays the message "Access is denied." + +You receive this message on any computer that runs Windows 10 version 1709 or version 1607, when you use any USB drive. + +### Cause + +The security descriptor of the BitLocker Drive Encryption service (BDESvc) has an incorrect entry. Instead of NT AUTHORITY\Authenticated Users, the security descriptor uses NT AUTHORITY\INTERACTIVE. + +To verify that this issue has occurred, follow these steps: + +1. On an affected computer, open an elevated Command Prompt window and an elevated PowerShell window. + +1. At the command prompt, enter the following command: + + ```cmd + C:\>sc sdshow bdesvc + ``` + + The output of this command resembles the following: + + > D:(A;;CCDCLCSWRPWPDTLORCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLORCWDWO;;;BA)(A;;CCLCSWRPLORC;;;BU)(A;;CCLCSWRPLORC;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOSDRCWDWO;;;WD) + +1. Copy this output, and use it as part of the [**ConvertFrom-SddlString**](https://docs.microsoft.com/powershell/module/microsoft.powershell.utility/convertfrom-sddlstring?view=powershell-6) command in the PowerShell window, as follows. + + ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\INTERACTIVE](./images/ts-bitlocker-usb-sddl.png) + + If you see NT AUTHORITY\INTERACTIVE (as highlighted), in the output of this command, this is the cause of the issue. Under typical conditions, the output should resemble the following: + + ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\Authenticated Users](./images/ts-bitlocker-usb-default-sddl.png) + +> [!NOTE] +> GPOs that change the security descriptors of services have been known to cause this issue. + +### Resolution + +1. To repair the security descriptor of BDESvc, open an elevated PowerShell window and enter the following command: + + ```ps + sc sdset bdesvc D:(A;;CCDCLCSWRPWPDTLORCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLORCWDWO;;;BA)(A;;CCLCSWRPLORC;;;BU)(A;;CCLCSWRPLORC;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOSDRCWDWO;;;WD) + ``` + +1. Restart the computer. + +The issue should now be resolved. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md new file mode 100644 index 0000000000..c69bb9ab25 --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md @@ -0,0 +1,129 @@ +--- +title: BitLocker cannot encrypt a drive known TPM issues +description: Provides guidance for troubleshooting known issues that may prevent BitLocker Drive Encryption from encrypting a drive, and that you can attribute to the TPM +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/18/2019 +--- + +# BitLocker cannot encrypt a drive: known TPM issues + +This article describes common issues that affect the Trusted Platform Module (TPM) and that may prevent BitLocker from encrypting a drive. This article also provides guidance to address these issues. + +> [!NOTE] +> If you have determined that your BitLocker issue does not involve the TPM, see [BitLocker cannot encrypt a drive: known issues](ts-bitlocker-cannot-encrypt-issues.md). + +## The TPM is locked and you see "The TPM is defending against dictionary attacks and is in a time-out period" + +When you turn on BitLocker Drive Encryption, it does not start. Instead, you receive a message that resembles "The TPM is defending against dictionary attacks and is in a time-out period." + +### Cause + +The TPM is locked out. + +### Resolution + +To resolve this issue, follow these steps: + +1. Open an elevated PowerShell window and run the following script: + + ```ps + $Tpm = Get-WmiObject -class Win32_Tpm -namespace "root\CIMv2\Security\MicrosoftTpm" $ConfirmationStatus = $Tpm.GetPhysicalPresenceConfirmationStatus(22).ConfirmationStatus if($ConfirmationStatus -ne 4) {$Tpm.SetPhysicalPresenceRequest(22)} + ``` + +1. Restart the computer. If you are prompted at the restart screen, press F12 to agree. +1. Try again to start BitLocker Drive Encryption. + +## You cannot prepare the TPM, and you see "The TPM is defending against dictionary attacks and is in a time-out period" + +You cannot turn on BitLocker Drive Encryption on a device. You use the TPM management console (tpm.msc) to prepare the TPM on a device. The operation fails and you receive a message that resembles "The TPM is defending against dictionary attacks and is in a time-out period." + +### Cause + +The TPM is locked out. + +### Resolution + +To resolve this issue, disable and re-enable the TPM. To do this, follow these steps: + +1. Restart the device, and change the BIOS configuration to disable the TPM. +1. Restart the device again, and return to the TPM management console. You should receive a message that resembles the following: + > Compatible Trusted Platform Module (TPM) cannot be found on this computer. Verify that this computer has 1.2 TPM and it is turned on in the BIOS. + +1. Restart the device, and change the BIOS configuration to enable the TPM. +1. Restart the device, and return to the TPM management console. + +If you still cannot prepare the TPM, clear the existing TPM keys. To do this, follow the instructions in [Troubleshoot the TPM: Clear all the keys from the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm#clear-all-the-keys-from-the-tpm). + +> [!WARNING] +> Clearing the TPM can cause data loss. + +## Access Denied: Failed to backup TPM Owner Authorization information to Active Directory Domain Services. Errorcode: 0x80070005 + +You have an environment that enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy. You try to turn on BitLocker Drive Encryption on a computer that runs Windows 7, but the operation fails. You receive a message that resembles "Access Denied" or "Insufficient Rights." + +### Cause + +The TPM did not have sufficient permissions on the TPM Devices container in Active Directory Domain Services (AD DS). Therefore, the BitLocker recovery information could not be backed up to AD DS, and BitLocker Drive Encryption could not run. + +This issue appears to be limited to computers that run versions of Windows that are earlier than Windows 10. + +### Resolution + +To verify that you have correctly identified this issue, use one of the following methods: + +- Disable the policy or remove the computer from the domain. Then try to turn on BitLocker Drive Encryption again. The operation should now succeed. +- Use LDAP and network trace tools to examine the LDAP exchanges between the client and the AD DS domain controller to identify the cause of the "Access Denied" or "Insufficient Rights" error. In this case, you should see the error when the client tries to access its object in the "CN=TPM Devices,DC=\<*domain*>,DC=com" container. + +1. To review the TPM information for the affected computer, open an elevated Windows PowerShell window and run the following command: + + ```ps + Get-ADComputer -Filter {Name -like "ComputerName"} -Property * | Format-Table name,msTPM-TPMInformationForComputer + ``` + + In this command, *ComputerName* is the name of the affected computer. + +1. To resolve the issue, use a tool such as dsacls.exe to make sure that the access control list of msTPM-TPMInformationForComputer grants both Read and Write permissions to NTAUTHORITY/SELF. + +## Cannot prepare the TPM, error 0x80072030: "There is no such object on the server" + +Your domain controllers were upgraded from Windows Server 2008 R2to Windows Server 2012 R2. A Group Policy Object (GPO) enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy. + +You cannot turn on BitLocker Drive Encryption on a device. You use the TPM management console (tpm.msc) to prepare the TPM on a device. The operation fails and you see a message that resembles the following: + +> 0x80072030 There is no such object on the server when a policy to back up TPM information to active directory is enabled + +You have confirmed that the **ms-TPM-OwnerInformation** and **msTPM-TpmInformationForComputer** attributes are present. + +### Cause + +The domain and forest functional level of the environment may still be set to Windows 2008 R2. Additionally, the permissions in AD DS may not be correctly set. + +### Resolution + +To resolve this issue, follow these steps: + +1. Upgrade the functional level of the domain and forest to Windows Server 2012 R2. +1. Download [Add-TPMSelfWriteACE.vbs](https://go.microsoft.com/fwlink/p/?LinkId=167133). +1. In the script, modify the value of **strPathToDomain** to your domain name. +1. Open an elevated PowerShell window, and run the following command: + + ```ps + cscript Add-TPMSelfWriteACE.vbs + ``` + + In this command \<*Path*> is the path to the script file. + +For more information, see the following articles: + +- [Back up the TPM recovery information to AD DS](https://docs.microsoft.com/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds) +- [Prepare your organization for BitLocker: Planning and policies](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md new file mode 100644 index 0000000000..346095b34e --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md @@ -0,0 +1,182 @@ +--- +title: BitLocker configuration known issues +description: Describes common issues that involve your BitLocker configuration and BitLocker's general functionality, and provides guidance for addressing those issues. +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/17/2019 +--- + +# BitLocker configuration: known issues + +This article describes common issues that affect your BitLocker configuration and BitLocker's general functionality. This article also provides guidance to address these issues. + +## BitLocker encryption is slower in Windows 10 + +In both Windows 10 and Windows 7, BitLocker runs in the background to encrypt drives. However, in Windows 10, BitLocker is less aggressive about requesting resources. This behavior reduces the chance that BitLocker will affect the computer's performance. + +To compensate for these changes, BitLocker uses a new conversion model. This model, (referred to as Encrypt-On-Write), makes sure that any new disk writes on all client SKUs and any internal drives are always encrypted *as soon as you turn on BitLocker*. + +> [!IMPORTANT] +> To preserve backward compatibility, BitLocker uses the previous conversion model to encrypt removable drives. + +### Benefits of using the new conversion model + +By using the previous conversion model, you cannot consider an internal drive to be protected (and compliant with data protection standards) until the BitLocker conversion is 100 percent complete. Before the process finishes, the data that existed on the drive before encryption began—that is, potentially compromised data—can still be read and written without encryption. Therefore, you must wait for the encryption process to finish before you store sensitive data on the drive. Depending on the size of the drive, this delay can be substantial. + +By using the new conversion model, you can safely store sensitive data on the drive as soon as you turn on BitLocker. You don't have to wait for the encryption process to finish, and encryption does not adversely affect performance. The tradeoff is that the encryption process for pre-existing data takes more time. + +### Other BitLocker enhancements + +After Windows 7 was released, several other areas of BitLocker were improved: + +- **New encryption algorithm, XTS-AES**. The new algorithm provides additional protection from a class of attacks on encrypted data that rely on manipulating cipher text to cause predictable changes in plain text. + + By default, this algorithm complies with the Federal Information Processing Standards (FIPS). FIPS are United States Government standards that provide a benchmark for implementing cryptographic software. + +- **Improved administration features**. You can manage BitLocker on PCs or other devices by using the following interfaces: + - BitLocker Wizard + - manage-bde + - Group Policy Objects (GPOs) + - Mobile Device Management (MDM) policy + - Windows PowerShell + - Windows Management Interface (WMI) + +- **Integration with Azure Active Directory** (Azure AD). BitLocker can store recovery information in Azure AD to make it easier to recover. + +- **[Direct memory access (DMA) Port Protection](https://docs.microsoft.com/windows/security/information-protection/kernel-dma-protection-for-thunderbolt)**. By using MDM policies to manage BitLocker, you can block a device's DMA ports and secure the device during its startup. + +- **[BitLocker Network Unlock](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock)**. If your BitLocker-enabled desktop or server computer is connected to a wired corporate network in a domain environment, you can automatically unlock its operating system volume during a system restart. + +- **Support for [Encrypted Hard Drives](https://docs.microsoft.com/windows/security/information-protection/encrypted-hard-drive)**. Encrypted Hard Drives are a new class of hard drives that are self-encrypting at a hardware level and allow for full disk hardware encryption. By taking on that workload, Encrypted Hard Drives increase BitLocker performance and reduce CPU usage and power consumption. + +- **Support for classes of HDD/SSD hybrid disks**. BitLocker can encrypt a disk that uses a small SSD as a non-volatile cache in front of the HDD, such as Intel Rapid Storage Technology. + +## Hyper-V Gen 2 VM: Cannot access the volume after BitLocker encryption + +Consider the following scenario: + +1. You turn on BitLocker on a generation-2 virtual machine (VM) that runs on Hyper-V. +1. You add data to the data disk as it encrypts. +1. You restart the VM, and observe the following: + - The system volume is not encrypted. + - The encrypted volume is not accessible, and the computer lists the volume's file system as "Unknown." + - You see a message that resembles: "You need to format the disk in \<*x:*> drive before you can use it" + +### Cause + +This issue occurs because the third-party filter driver Stcvsm.sys (from StorageCraft) is installed on the VM. + +### Resolution + +To resolve this issue, remove the third-party software. + +## Production snapshots fail for virtualized domain controllers that use BitLocker-encrypted disks + +You have a Windows Server 2019 or 2016 Hyper-V Server that is hosting VMs (guests) that are configured as Windows domain controllers. BitLocker has encrypted the disks that store the Active Directory database and log files. When you run a “production snapshot” of the domain controller guests, the Volume Snap-Shot (VSS) service does not correctly process the backup. + +This issue occurs regardless of any of the following variations in the environment: + +- How the domain controller volumes are unlocked. +- Whether the VMs are generation 1 or generation 2. +- Whether the guest operating system is Windows Server 2019, 2016 or 2012 R2. + +In the domain controller Application log, the VSS event source records event ID 8229: + +> ID: 8229 +> Level: Warning +> ‎Source: VSS +> Message: A VSS writer has rejected an event with error 0x800423f4, The writer experienced a non-transient error. If the backup process is retried, the error is likely to reoccur. +> +> Changes that the writer made to the writer components while handling the event will not be available to the requester. +> +> Check the event log for related events from the application hosting the VSS writer. +> +> Operation: +> PostSnapshot Event +> +> Context: +> Execution Context: Writer +> Writer Class Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757} +> Writer Name: NTDS +> Writer Instance ID: {d170b355-a523-47ba-a5c8-732244f70e75} +> Command Line: C:\\Windows\\system32\\lsass.exe +> +> Process ID: 680 + +In the domain controller Directory Services event log, you see an event that resembles the following: + +> Error Microsoft-Windows-ActiveDirectory\_DomainService 1168 +> Internal Processing Internal error: An Active Directory Domain Services error has occurred. +> +>‎  Additional Data +> ‎  Error value (decimal): -1022 +> +> Error value (hex): fffffc02 +> +> Internal ID: 160207d9 + +> [!NOTE] +> The internal ID of this event may differ based on your operating system release and path level. + +After this issue occurs, if you run the **VSSADMIN list writers** command, you see output that resembles the following for the Active Directory Domain Services (NTDS) VSS Writer: + +> Writer name: 'NTDS' +>   Writer Id: {b2014c9e-8711-4c5c-a5a9-3cf384484757} +>   Writer Instance Id: {08321e53-4032-44dc-9b03-7a1a15ad3eb8} +>   State: \[11\] Failed +>   Last error: Non-retryable error + +Additionally, you cannot back up the VMs until you restart them. + +### Cause + +After VSS creates a snapshot of a volume, the VSS writer takes "post snapshot" actions. In the case of a "production snapshot," which you initiate from the host server, Hyper-V tries to mount the snapshotted volume. However, it cannot unlock the volume for unencrypted access. BitLocker on the Hyper-V server does not recognize the volume. Therefore, the access attempt fails and then the snapshot operation fails. + +This behavior is by design. + +### Workaround + +There is one supported way to perform backup and restore of a virtualized domain controller: + +- Run Windows Server Backup in the guest operating system. + +If you have to take a production snapshot of a virtualized domain controller, you can suspend BitLocker in the guest operating system before you start the production snapshot. However, this approach is not recommended. + +For more information and recommendations about backing up virtualized domain controllers, see [Virtualizing Domain Controllers using Hyper-V: Backup and Restore Considerations for Virtualized Domain Controllers](https://docs.microsoft.com/windows-server/identity/ad-ds/get-started/virtual-dc/virtualized-domain-controllers-hyper-v#backup-and-restore-considerations-for-virtualized-domain-controllers) + +### More information + +When the VSS NTDS writer requests access to the encrypted drive, the Local Security Authority Subsystem Service (LSASS) generates an error entry that resembles the following: + +``` +\# for hex 0xc0210000 / decimal -1071579136 +‎ STATUS\_FVE\_LOCKED\_VOLUME ntstatus.h +‎ \# This volume is locked by BitLocker Drive Encryption. +``` + +The operation produces the following call stack: + +``` +\# Child-SP RetAddr Call Site +‎ 00 00000086\`b357a800 00007ffc\`ea6e7a4c KERNELBASE\!FindFirstFileExW+0x1ba \[d:\\rs1\\minkernel\\kernelbase\\filefind.c @ 872\] +‎ 01 00000086\`b357abd0 00007ffc\`e824accb KERNELBASE\!FindFirstFileW+0x1c \[d:\\rs1\\minkernel\\kernelbase\\filefind.c @ 208\] +‎ 02 00000086\`b357ac10 00007ffc\`e824afa1 ESENT\!COSFileFind::ErrInit+0x10b \[d:\\rs1\\onecore\\ds\\esent\\src\\os\\osfs.cxx @ 2476\] +‎ 03 00000086\`b357b700 00007ffc\`e827bf02 ESENT\!COSFileSystem::ErrFileFind+0xa1 \[d:\\rs1\\onecore\\ds\\esent\\src\\os\\osfs.cxx @ 1443\] +‎ 04 00000086\`b357b960 00007ffc\`e82882a9 ESENT\!JetGetDatabaseFileInfoEx+0xa2 \[d:\\rs1\\onecore\\ds\\esent\\src\\ese\\jetapi.cxx @ 11503\] +‎ 05 00000086\`b357c260 00007ffc\`e8288166 ESENT\!JetGetDatabaseFileInfoExA+0x59 \[d:\\rs1\\onecore\\ds\\esent\\src\\ese\\jetapi.cxx @ 11759\] +‎ 06 00000086\`b357c390 00007ffc\`e84c64fb ESENT\!JetGetDatabaseFileInfoA+0x46 \[d:\\rs1\\onecore\\ds\\esent\\src\\ese\\jetapi.cxx @ 12076\] +‎ 07 00000086\`b357c3f0 00007ffc\`e84c5f23 ntdsbsrv\!CVssJetWriterLocal::RecoverJetDB+0x12f \[d:\\rs1\\ds\\ds\\src\\jetback\\snapshot.cxx @ 2009\] +‎ 08 00000086\`b357c710 00007ffc\`e80339e0 ntdsbsrv\!CVssJetWriterLocal::OnPostSnapshot+0x293 \[d:\\rs1\\ds\\ds\\src\\jetback\\snapshot.cxx @ 2190\] +‎ 09 00000086\`b357cad0 00007ffc\`e801fe6d VSSAPI\!CVssIJetWriter::OnPostSnapshot+0x300 \[d:\\rs1\\base\\stor\\vss\\modules\\jetwriter\\ijetwriter.cpp @ 1704\] +‎ 0a 00000086\`b357ccc0 00007ffc\`e8022193 VSSAPI\!CVssWriterImpl::OnPostSnapshotGuard+0x1d \[d:\\rs1\\base\\stor\\vss\\modules\\vswriter\\vswrtimp.cpp @ 5228\] +‎ 0b 00000086\`b357ccf0 00007ffc\`e80214f0 VSSAPI\!CVssWriterImpl::PostSnapshotInternal+0xc3b \[d:\\rs1\\base\\stor\\vss\\modules\\vswriter\\vswrtimp.cpp @ 3552\] +``` diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md new file mode 100644 index 0000000000..c3e4f16427 --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md @@ -0,0 +1,113 @@ +--- +title: Decode Measured Boot logs to track PCR changes +description: Provides instructions for installing and using a tool for analyzing log information to identify changes to PCRs +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/17/2019 +--- + +# Decode Measured Boot logs to track PCR changes + +Platform Configuration Registers (PCRs) are memory locations in the Trusted Platform Module (TPM). BitLocker and its related technologies depend on specific PCR configurations. Additionally, specific change in PCRs can cause a device or computer to enter BitLocker recovery mode. + +By tracking changes in the PCRs, and identifying when they changed, you can gain insight into issues that occur or learn why a device or computer entered BitLocker recovery mode. The Measured Boot logs record PCR changes and other information. These logs are located in the C:\\Windows\\Logs\\MeasuredBoot\\ folder. + +This article describes tools that you can use to decode these logs: TBSLogGenerator and PCPTool. + +For more information about Measured Boot and PCRs, see the following articles: + +- [TPM fundamentals: Measured Boot with support for attestation](https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-fundamentals#measured-boot-with-support-for-attestation) +- [Understanding PCR banks on TPM 2.0 devices](https://docs.microsoft.com/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices) + +## Use TBSLogGenerator to decode Measured Boot logs + +Use TBSLogGenerator to decode Measured Boot logs that you have collected from Windows 10 and earlier versions. You can install this tool on the following systems: + +- A computer that is running Windows Server 2016 and that has a TPM enabled +- A Gen 2 virtual machine (running on Hyper-V) that is running Windows Server 2016 (you can use the virtual TPM) + +To install the tool, follow these steps: + +1. Download the Windows Hardware Lab Kit from one of the following locations: + + - [Windows Hardware Lab Kit](https://docs.microsoft.com/windows-hardware/test/hlk/) + - Direct download link for Windows Server 2016: [Windows HLK, version 1607](https://go.microsoft.com/fwlink/p/?LinkID=404112) + +1. Accept the default installation path. + + ![Specify Location page of the Windows Hardware Lab Kit installation wizard](./images/ts-tpm-1.png) + +1. Under **Select the features you want to install**, select **Windows Hardware Lab Kit—Controller + Studio**. + + ![Select features page of the Windows Hardware Lab Kit installation wizard](./images/ts-tpm-2.png) + +1. Finish the installation. + +To use TBSLogGenerator, follow these steps: + +1. After the installation finishes, open an elevated Command Prompt window and navigate to the following folder: + **C:\\Program Files (x86)\\Windows Kits\\10\\Hardware Lab Kit\\Tests\\amd64\\NTTEST\\BASETEST\\ngscb** + + This folder contains the TBSLogGenerator.exe file. + + ![Properties and location of the TBSLogGenerator.exe file](./images/ts-tpm-3.png) + +1. Run the following command: + ```cmd + TBSLogGenerator.exe -LF \.log > \.txt + ``` + where the variables represent the following values: + - \<*LogFolderName*> = the name of the folder that contains the file to be decoded + - \<*LogFileName*> = the name of the file to be decoded + - \<*DestinationFolderName*> = the name of the folder for the decoded text file + - \<*DecodedFileName*> = the name of the decoded text file + + For example, the following figure shows Measured Boot logs that were collected from a Windows 10 computer and put into the C:\\MeasuredBoot\\ folder. The figure also shows a Command Prompt window and the command to decode the **0000000005-0000000000.log** file: + + ```cmd + TBSLogGenerator.exe -LF C:\MeasuredBoot\0000000005-0000000000.log > C:\MeasuredBoot\0000000005-0000000000.txt + ``` + + ![Command Prompt window that shows an example of how to use TBSLogGenerator](./images/ts-tpm-4.png) + + The command produces a text file that uses the specified name. In the case of the example, the file is **0000000005-0000000000.txt**. The file is located in the same folder as the original .log file. + + ![Windows Explorer window that shows the text file that TBSLogGenerator produces](./images/ts-tpm-5.png) + +The content of this text file resembles the following. + +![Contents of the text file, as shown in NotePad](./images/ts-tpm-6.png) + +To find the PCR information, go to the end of the file. + + ![View of NotePad that shows the PCR information at the end of the text file](./images/ts-tpm-7.png) + +## Use PCPTool to decode Measured Boot logs + +PCPTool is part of the [TPM Platform Crypto-Provider Toolkit](https://www.microsoft.com/download/details.aspx?id=52487). The tool decodes a Measured Boot log file and converts it into an XML file. + +To download and install PCPTool, go to the Toolkit page, select **Download**, and follow the instructions. + +To decode a log, run the following command: +```cmd +PCPTool.exe decodelog \.log > \.xml +``` + +where the variables represent the following values: +- \<*LogFolderPath*> = the path to the folder that contains the file to be decoded +- \<*LogFileName*> = the name of the file to be decoded +- \<*DestinationFolderName*> = the name of the folder for the decoded text file +- \<*DecodedFileName*> = the name of the decoded text file + +The content of the XML file resembles the following. + +![Command Prompt window that shows an example of how to use PCPTool](./images/pcptool-output.jpg) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md new file mode 100644 index 0000000000..cb9490e9cd --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md @@ -0,0 +1,346 @@ +--- +title: Enforcing BitLocker policies by using Intune known issues +description: provides assistance for issues that you may see if you use Microsoft Intune policy to manage silent BitLocker encryption on devices. +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/18/2019 +--- + +# Enforcing BitLocker policies by using Intune: known issues + +This article helps you troubleshoot issues that you may experience if you use Microsoft Intune policy to manage silent BitLocker encryption on devices. The Intune portal indicates whether BitLocker has failed to encrypt one or more managed devices. + +![The BitLocker status indictors on the Intune portal](./images/4509189-en-1.png) + +To start narrowing down the cause of the problem, review the event logs as described in [Troubleshoot BitLocker](troubleshoot-bitlocker.md). Concentrate on the Management and Operations logs in the **Applications and Services logs\\Microsoft\\Windows\\BitLocker-API** folder. The following sections provide more information about how to resolve the indicated events and error messages: + +- [Event ID 853: Error: A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer](#issue-1) +- [Event ID 853: Error: BitLocker Drive Encryption detected bootable media (CD or DVD) in the computer](#issue-2) +- [Event ID 854: WinRE is not configured](#issue-3) +- [Event ID 851: Contact manufacturer for BIOS upgrade](#issue-4) +- [Error message: The UEFI variable 'SecureBoot' could not be read](#issue-6) +- [Event ID 846, 778, and 851: Error 0x80072f9a](#issue-7) +- [Error message: Conflicting Group Policy settings for recovery options on operating system drives](#issue-5) + +If you do not have a clear trail of events or error messages to follow, other areas to investigate include the following: + +- [Review the hardware requirements for using Intune to manage BitLocker on devices](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-bitlocker#bitlocker-automatic-device-encryption-hardware-requirements) +- [Review your BitLocker policy configuration](#policy) + +For information about how to verify that Intune policies are enforcing BitLocker correctly, see [Verifying that BitLocker is operating correctly](#verifying-that-bitlocker-is-operating-correctly). + +## Event ID 853: Error: A compatible Trusted Platform Module (TPM) Security Device cannot be found on this computer + +Event ID 853 can carry different error messages, depending on the context. In this case, the Event ID 853 error message indicates that the device does not appear to have a TPM. The event information resembles the following: + +![Details of event ID 853 (TPM is not available, cannot find TPM)](./images/4509190-en-1.png) + +### Cause + +The device that you are trying to secure may not have a TPM chip, or the device BIOS might be configured to disable the TPM. + +### Resolution + +To resolve this issue, verify the following: + +- The TPM is enabled in the device BIOS. +- The TPM status in the TPM management console resembles the following: + - Ready (TPM 2.0) + - Initialized (TPM 1.2) + +For more information, see [Troubleshoot the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm). + +## Event ID 853: Error: BitLocker Drive Encryption detected bootable media (CD or DVD) in the computer + +In this case, you see event ID 853, and the error message in the event indicates that bootable media is available to the device. The event information resembles the following. + +![Details of event ID 853 (TPM is not available, bootable media found)](./images/4509191-en-1.png) + +### Cause + +During the provisioning process, BitLocker Drive Encryption records the configuration of the device to establish a baseline. If the device configuration changes later (for example, if you remove the media), BitLocker recovery mode automatically starts. + +To avoid this situation, the provisioning process stops if it detects removable bootable media. + +### Resolution + +Remove the bootable media, and restart the device. After the device restarts, verify the encryption status. + +## Event ID 854: WinRE is not configured + +The event information resembles the following: + +> Failed to enable Silent Encryption. WinRe is not configured. +> +> Error: This PC cannot support device encryption because WinRE is not properly configured. + +### Cause + +Windows Recovery Environment (WinRE) is a minimal Windows operating system that is based on Windows Preinstallation Environment (Windows PE). WinRE includes several tools that an administrator can use to recover or reset Windows and diagnose Windows issues. If a device cannot start the regular Windows operating system, the device tries to start WinRE. + +The provisioning process enables BitLocker Drive Encryption on the operating system drive during the Windows PE phase of provisioning. This action makes sure that the drive is protected before the full operating system is installed. The provisioning process also creates a system partition for WinRE to use if the system crashes. + +If WinRE is not available on the device, provisioning stops. + +### Resolution + +You can resolve this issue by verifying the configuration of the disk partitions, the status of WinRE, and the Windows Boot Loader configuration. To do this, follow these steps. + +#### Step 1: Verify the configuration of the disk partitions + +The procedures described in this section depend on the default disk partitions that Windows configures during installation. Windows 10 automatically creates a recovery partition that contains the Winre.wim file. The partition configuration resembles the following. + +![Default disk partitions, including the recovery partition](./images/4509194-en-1.png) + +To verify the configuration of the disk partitions, open an elevated Command Prompt window, and run the following commands: + +``` +diskpart +list volume +``` +![Output of the list volume command in the Diskpart app](./images/4509195-en-1.png) + +If the status of any of the volumes is not healthy or if the recovery partition is missing, you may have to reinstall Windows. Before you do this, check the configuration of the Windows image that you are using for provisioning. Make sure that the image uses the correct disk configuration. The image configuration should resemble the following (this example is from System Center Configuration Manager). + +![Windows image configuration in System Center Configuration Manager](./images/sccm-imageconfig.jpg) + +#### Step 2: Verify the status of WinRE + +To verify the status of WinRE on the device, open an elevated Command Prompt window and run the following command: + +```cmd +reagentc /info +``` +The output of this command resembles the following. + +![Output of the reagentc /info command](./images/4509193-en-1.png) + +If the **Windows RE status** is not **Enabled**, run the following command to enable it: + +```cmd +reagentc /enable +``` + +#### Step 3: Verify the Windows Boot Loader configuration + +If the partition status is healthy, but the **reagentc /enable** command results in an error, verify that Windows Boot Loader contains the recovery sequence GUID. To do this, run the following command in an elevated Command Prompt window: + +```cmd +bcdedit /enum all +``` + +The output of this command resembles the following. + +![Output of the bcdedit /enum all command](./images/4509196-en-1.png) + +In the output, locate the **Windows Boot Loader** section that includes the line **identifier={current}**. In that section, locate the **recoverysequence** attribute. The value of this attribute should be a GUID value, not a string of zeros. + +## Event ID 851: Contact the manufacturer for BIOS upgrade instructions + +The event information resembles the following: + +> Failed to enable Silent Encryption. +> +> Error: BitLocker Drive Encryption cannot be enabled on the operating system drive. Contact the computer manufacturer for BIOS upgrade instructions. + +### Cause + +The device must have Unified Extensible Firmware Interface (UEFI) BIOS. Silent BitLocker Drive Encryption does not support legacy BIOS. + +### Resolution + +To verify the BIOS mode, use the System Information app. To do this, follow these steps: + +1. Select **Start**, and enter **msinfo32** in the **Search** box. +1. Verify that the **BIOS Mode** setting is **UEFI** and not **Legacy**. + ![System Information app, showing the BIOS Mode setting](./images/4509198-en-1.png) +1. If the **BIOS Mode** setting is **Legacy**, you have to switch the BIOS into **UEFI** or **EFI** mode. The steps for doing this are specific to the device. + > [!NOTE] + > If the device supports only Legacy mode, you cannot use Intune to manage BitLocker Device Encryption on the device. + +## Error message: The UEFI variable 'SecureBoot' could not be read + +You receive an error message that resembles the following: + +> **Error:** BitLocker cannot use Secure Boot for integrity because the UEFI variable ‘SecureBoot’ could not be read. A required privilege is not held by the client. + +### Cause + +A Platform Configuration Register (PCR) is a memory location in the TPM. In particular, PCR 7 measures the state of Secure Boot. Silent BitLocker Drive Encryption requires that Secure Boot is turned on. + +### Resolution + +You can resolve this issue by verifying the PCR validation profile of the TPM and the Secure Boot state. To do this, follow these steps: + +#### Step 1: Verify the PCR validation profile of the TPM + +To verify that PCR 7 is in use, open an elevated Command Prompt window and run the following command: + +```cmd +Manage-bde -protectors -get %systemdrive% +``` + +In the TPM section of the output of this command, verify that the **PCR Validation Profile** setting includes **7**, as follows. + +![Output of the manage-bde command](./images/4509199-en-1.png) + +If **PCR Validation Profile** doesn't include **7** (for example, the values include **0**, **2**, **4**, and **11**, but not **7**), then Secure Boot is not turned on. + +![Output of the manage-bde command when PCR 7 is not present](./images/4509200-en-1.png) + +#### 2. Verify the Secure Boot state + +To verify the Secure Boot state, use the System Information app. To do this, follow these steps: + +1. Select **Start**, and enter **msinfo32** in the **Search** box. +1. Verify that the **Secure Boot State** setting is **On**, as follows: + ![System Information app, showing a supported Secure Boot State](./images/4509201-en-1.png) +1. If the **Secure Boot State** setting is **Unsupported**, you cannot use Silent BitLocker Encryption on this device. + ![System Information app, showing a supported Secure Boot State](./images/4509202-en-1.png) + +> [!NOTE] +> You can also use the [Confirm-SecureBootUEFI](https://docs.microsoft.com/powershell/module/secureboot/confirm-securebootuefi?view=win10-ps) cmdlet to verify the Secure Boot state. To do this, open an elevated PowerShell window and run the following command: +> ```ps +> PS C:\> Confirm-SecureBootUEFI +> ``` +> If the computer supports Secure Boot and Secure Boot is enabled, this cmdlet returns "True." +> +> If the computer supports Secure Boot and Secure Boot is disabled, this cmdlet returns "False." +> +> If the computer does not support Secure Boot or is a BIOS (non-UEFI) computer, this cmdlet returns "Cmdlet not supported on this platform." + +## Event ID 846, 778, and 851: Error 0x80072f9a + +In this case, you are deploying Intune policy to encrypt a Windows 10, version 1809 device and store the recovery password in Azure Active Directory (Azure AD). As part of the policy configuration, you have selected the **Allow standard users to enable encryption during Azure AD Join** option. + +The policy deployment fails and generates the following events (visible in Event Viewer in the **Applications and Services Logs\\Microsoft\\Windows\\BitLocker API** folder): + +> Event ID:846 +> +> Event: +> Failed to backup BitLocker Drive Encryption recovery information for volume C: to your Azure AD. +> +> TraceId: {cbac2b6f-1434-4faa-a9c3-597b17c1dfa3} +> Error: Unknown HResult Error code: 0x80072f9a + +> Event ID:778 +> +> Event: The BitLocker volume C: was reverted to an unprotected state. + +> Event ID: 851 +> +> Event: +> Failed to enable Silent Encryption. +> +> Error: Unknown HResult Error code: 0x80072f9a. + +These events refer to Error code 0x80072f9a. + +### Cause + +These events indicate that the signed-in user does not have permission to read the private key on the certificate that is generated as part of the provisioning and enrollment process. Therefore, the BitLocker MDM policy refresh fails. + +The issue affects Windows 10 version 1809. + +### Resolution + +To resolve this issue, install the [May 21, 2019](https://support.microsoft.com/help/4497934/windows-10-update-kb4497934) update. + +## Error message: There are conflicting Group Policy settings for recovery options on operating system drives + +You receive a message that resembles the following: + +> **Error:** BitLocker Drive Encryption cannot be applied to this drive because there are conflicting Group Policy settings for recovery options on operating system drives. Storing recovery information to Active Directory Domain Services cannot be required when the generation of recovery passwords is not permitted. Please have your system administrator resolve these policy conflicts before attempting to enable BitLocker… + +### Resolution + +To resolve this issue, review your Group Policy Object (GPO) settings for conflicts. For further guidance, see the next section, [Review your BitLocker policy configuration](#policy). + +For more information about GPOs and BitLocker, see [BitLocker Group Policy Reference](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-7/ee706521(v=ws.10)?redirectedfrom=MSDN). + +## Review your BitLocker policy configuration + +For information about how to use policy together with BitLocker and Intune, see the following resources: + +- [BitLocker management for enterprises: Managing devices joined to Azure Active Directory](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises#managing-devices-joined-to-azure-active-directory) +- [BitLocker Group Policy Reference](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-7/ee706521(v=ws.10)?redirectedfrom=MSDN) +- [Configuration service provider reference](https://docs.microsoft.com/windows/client-management/mdm/configuration-service-provider-reference) +- [Policy CSP – BitLocker](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-bitlocker) +- [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) +- [Enable ADMX-backed policies in MDM](https://docs.microsoft.com/windows/client-management/mdm/enable-admx-backed-policies-in-mdm) +- [gpresult](https://docs.microsoft.com/windows-server/administration/windows-commands/gpresult) + +Intune offers the following enforcement types for BitLocker: + +- **Automatic** (Enforced when the device joins Azure AD during the provisioning process. This option is available in Windows 10 version 1703 and later.) +- **Silent** (Endpoint protection policy. This option is available in Windows 10 version 1803 and later.) +- **Interactive** (Endpoint policy for Windows versions that are older than Windows 10 version 1803.) + +If your device runs Windows 10 version 1703 or later, supports Modern Standby (also known as Instant Go) and is HSTI-compliant, joining the device to Azure AD triggers automatic device encryption. A separate endpoint protection policy is not required to enforce device encryption. + +If your device is HSTI-compliant but does not support Modern Standby, you have to configure an endpoint protection policy to enforce silent BitLocker Drive Encryption. The settings for this policy should resemble the following: + +![Intune policy settings](./images/4509186-en-1.png) + +The OMA-URI references for these settings are as follows: + +- OMA-URI: **./Device/Vendor/MSFT/BitLocker/RequireDeviceEncryption** + Value Type: **Integer** + Value: **1**  (1 = Require, 0 = Not Configured) + +- OMA-URI: **./Device/Vendor/MSFT/BitLocker/AllowWarningForOtherDiskEncryption** + Value Type: **Integer** + Value: **0** (0 = Blocked, 1 = Allowed) + +> [!NOTE] +> Because of an update to the BitLocker Policy CSP, if the device uses Windows 10 version 1809 or later, you can use an endpoint protection policy to enforce silent BitLocker Device Encryption even if the device is not HSTI-compliant. + +> [!NOTE] +> If the **Warning for other disk encryption** setting is set to **Not configured**, you have to manually start the BitLocker Drive Encryption wizard. + +If the device does not support Modern Standby but is HSTI-compliant, and it uses a version of Windows that is earlier than Windows 10, version 1803, an endpoint protection policy that has the settings that are described in this article delivers the policy configuration to the device. However, Windows then notifies the user to manually enable BitLocker Drive Encryption. To do this, the user selects the notification. This action starts the BitLocker Drive Encryption wizard. + +The Intune 1901 release provides settings that you can use to configure automatic device encryption for Autopilot devices for standard users. Each device must meet the following requirements: + +- Be HSTI-compliant +- Support Modern Standby +- Use Windows 10 version 1803 or later + +![Intune policy setting](./images/4509188-en-1.png) + +The OMA-URI references for these settings are as follows: + +- OMA-URI: **./Device/Vendor/MSFT/BitLocker/AllowStandardUserEncryption** + Value Type: **Integer** + Value: **1** + +> [!NOTE] +> This node works together with the **RequireDeviceEncryption** and **AllowWarningForOtherDiskEncryption** nodes. For this reason, when you set **RequireDeviceEncryption** to **1**, **AllowStandardUserEncryption** to **1**, and **AllowWarningForOtherDiskEncryption** to **0**. Intune can enforce silent BitLocker encryption for Autopilot devices that have standard user profiles. + +## Verifying that BitLocker is operating correctly + +During regular operations, BitLocker Drive Encryption generates events such as Event ID 796 and Event ID 845. + +![Event ID 796, as shown in Event Viewer](./images/4509203-en-1.png) + +![Event ID 845, as shown in Event Viewer](./images/4509204-en-1.png) + +You can also determine whether the BitLocker recovery password has been uploaded to Azure AD by checking the device details in the Azure AD Devices section. + +![BitLocker recovery information as viewed in Azure AD](./images/4509205-en-1.png) + +On the device, check the Registry Editor to verify the policy settings on the device. Verify the entries under the following subkeys: + +- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\BitLocker** +- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device** + +![Registry subkeys that relate to Intune policy](./images/4509206-en-1.png) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md new file mode 100644 index 0000000000..77216f2dd1 --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md @@ -0,0 +1,87 @@ +--- +title: BitLocker Network Unlock known issues +description: Describes several known issues that you may encounter while using Network Unlock, and provided guidance for addressing those issues. +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/7/2019 +--- +# BitLocker Network Unlock: known issues + +By using the BitLocker Network Unlock feature, you can manage computers remotely without having to enter a BitLocker PIN when each computer starts up. To do this, You have to configure your environment to meet the following requirements: + +- Each computer belongs to a domain +- Each computer has a wired connection to the corporate network +- The corporate network uses DHCP to manage IP addresses +- Each computer has a DHCP driver implemented in its Unified Extensible Firmware Interface (UEFI) firmware + +For general guidelines about how to troubleshoot Network Unlock, see [How to enable Network Unlock: Troubleshoot Network Unlock](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock#troubleshoot-network-unlock). + +This article describes several known issues that you may encounter when you use Network Unlock, and provides guidance to address these issues. + +## Tip: Detect whether BitLocker Network Unlock is enabled on a specific computer + +You can use the following steps on computers that have either x64 or x32 UEFI systems. You can also script these commands. + +1. Open an elevated Command Prompt window and run the following command: + + ```cmd + manage-bde protectors get + ``` + + where \<*Drive*> is the drive letter, followed by a colon (:), of the bootable drive. + If the output of this command includes a key protector of type **TpmCertificate (9)**, the configuration is correct for BitLocker Network Unlock. + +1. Start Registry Editor, and verify the following settings: + - Entry **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE: OSManageNKP** is set to **1** + - Subkey **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP\\Certificates** has an entry whose name matches the name of the certificate thumbprint of the Network Unlock key protector that you found in step 1. + +## On a Surface Pro 4 device, BitLocker Network Unlock does not work because the UEFI network stack is incorrectly configured + +You have configured BitLocker Network Unlock as described in [BitLocker: How to enable Network Unlock](https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock). You have configured the UEFI of the device to use DHCP. However, when you restart the device, it still prompts you for the BitLocker PIN. + +You test another device, such as a different type of tablet or laptop PC, that is configured to use the same infrastructure. The device restarts as expected, without prompting for the BitLocker PIN. You conclude that the infrastructure is correctly configured, and the issue is specific to the device. + +### Cause + +The UEFI network stack on the device was incorrectly configured. + +### Resolution + +To correctly configure the UEFI network stack of the Surface Pro 4, you have to use Microsoft Surface Enterprise Management Mode (SEMM). For information about SEMM, see [Enroll and configure Surface devices with SEMM](https://docs.microsoft.com/surface/enroll-and-configure-surface-devices-with-semm). + +> [!NOTE] +> If you cannot use SEMM, you may be able to configure the Surface Pro 4 to use BitLocker Network Unlock by configuring the device to use the network as its first boot option. + +## Unable to use BitLocker Network Unlock feature on a Windows client computer + +You have configured BitLocker Network Unlock as described in [BitLocker: How to enable Network Unlock](https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock). You have a Windows 8-based client computer that is connected to the corporate LAN by using an Ethernet Cable. However, when you restart the computer, it still prompts you for the BitLocker PIN. + +### Cause + +A Windows 8-based or Windows Server 2012-based client computer sometimes does not receive or use the Network Unlock protector, depending on whether the client receives unrelated BOOTP replies from a DHCP server or WDS server. + +DHCP servers may send any DHCP options to a BOOTP client as allowed by the DHCP options and BOOTP vendor extensions. This means that because a DHCP server supports BOOTP clients, the DHCP server replies to BOOTP requests. + +The manner in which a DHCP server handles an incoming message depends in part on whether the message uses the Message Type option: + +- The first two messages that the BitLocker Network Unlock client sends are DHCP DISCOVER\REQUEST messages. They use the Message Type option, so the DHCP server treats them as DHCP messages. +- The third message that the BitLocker Network Unlock client sends does not have the Message Type option. The DHCP server treats the message as a BOOTP request. + +A DHCP server that supports BOOTP clients must interact with those clients according to the BOOTP protocol. The server must create a BOOTP BOOTREPLY message instead of a DHCP DHCPOFFER message. (In other words, the server must not include the DHCP message option type and must not exceed the size limit for BOOTREPLY messages.) After the server sends the BOOTP BOOTREPLY message, the server marks a binding for a BOOTP client as BOUND. A non-DHCP client does not send a DHCPREQUEST message, nor does that client expect a DHCPACK message. + +If a DHCP server that is not configured to support BOOTP clients receives a BOOTREQUEST message from a BOOTP client, that server silently discards the BOOTREQUEST message. + +For more information about DHCP and BitLocker Network Unlock, see [BitLocker: How to enable Network Unlock: Network Unlock sequence](https://docs.microsoft.com/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock#network-unlock-sequence) + +### Resolution + +To resolve this issue, change the configuration of the DHCP server by changing the **DHCP** option from **DHCP and BOOTP** to **DHCP**. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md new file mode 100644 index 0000000000..a25ea79f8a --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md @@ -0,0 +1,290 @@ +--- +title: BitLocker recovery known issues +description: Describes common issues that can occur that prevent BitLocker from behaving as expected when recovering a drive, or may cause BitLocker to start recovery unexpectedly. The article provides guidance for addressing those issues. +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/18/2019 +--- + +# BitLocker recovery: known issues + +This article describes common issues that may prevent BitLocker from behaving as expected when you recover a drive, or that may cause BitLocker to start recovery unexpectedly. The article provides guidance to address these issues. + +> [!NOTE] +> In this article, "recovery password" refers to the 48-digit recovery password and "recovery key" refers to 32-digit recovery key. For more information, see [BitLocker key protectors](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#bitlocker-key-protectors). + +## Windows 10 prompts for a non-existing BitLocker recovery password + +Windows 10 prompts you for a BitLocker recovery password. However, you did not configure a BitLocker recovery password. + +### Resolution + +The BitLocker and Active Directory Domain Services (AD DS) FAQ addresses situations that may produce this symptom, and provides information about how to resolve the issue: + +- [What if BitLocker is enabled on a computer before the computer has joined the domain?](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) +- [What happens if the backup initially fails? Will BitLocker retry the backup?](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq#what-happens-if-the-backup-initially-fails-will-bitlocker-retry-the-backup) + +## The recovery password for a laptop was not backed up, and the laptop is locked + +You have a Windows 10 Home-based laptop, and you have to recover its hard disk. The disk was encrypted by using BitLocker Driver Encryption. However, the BitLocker recovery password was not backed up, and the usual user of the laptop is not available to provide the password. + +### Resolution + +You can use either of the following methods to manually back up or synchronize an online client's existing recovery information: + +- Create a Windows Management Instrumentation (WMI) script that backs up the information. For more information, see [BitLocker Drive Encryption Provider](https://docs.microsoft.com/windows/win32/secprov/bitlocker-drive-encryption-provider). + +- In an elevated Command Prompt window, use the [manage-bde](https://docs.microsoft.com/windows-server/administration/windows-commands/manage-bde) command to back up the information. + + For example, to back up all of the recovery information for the C: drive to AD DS, open an elevated Command Prompt window and run the following command: + + ```cmd + manage-bde -protectors -adbackup C: + ``` + +> [!NOTE] +> BitLocker does not automatically manage this backup process. + +## Tablet devices do not support using Manage-bde -forcerecovery to test recovery mode + +You have a tablet or slate device, and you try to test BitLocker Recovery by running the following command: + +```cmd +Manage-bde -forcerecovery +``` + +However, after you enter the recovery password, the device cannot start. + +### Cause + +> [!IMPORTANT] +> Tablet devices do not support the **manage-bde -forcerecovery** command. + +This issue occurs because the Windows Boot Manager cannot process touch input during the pre-boot phase of startup. If Boot Manager detects that the device is a tablet, it redirects the startup process to the Windows Recovery Environment (WinRE), which can process touch input. + +If WindowsRE detects the TPM protector on the hard disk, it does a PCR reseal. However, the **manage-bde -forcerecovery** command deletes the TPM protectors on the hard disk. Therefore, WinRE cannot reseal the PCRs. This failure triggers an infinite BitLocker recovery cycle and prevents Windows from starting. + +This behavior is by design for all versions of Windows. + +### Workaround + +To resolve the restart loop, follow these steps: + +1. On the BitLocker Recovery screen, select **Skip this drive**. +1. Select **Troubleshoot** \> **Advanced Options** \> **Command Prompt**. +1. In the Command Prompt window, run the following commands : + ```cmd + manage-bde –unlock C: -rp <48-digit BitLocker recovery password> + manage-bde -protectors -disable C: + ``` +1. Close the Command Prompt window. +1. Shut down the device. +1. Start the device. Windows should start as usual. + +## After you install UEFI or TPM firmware updates on Surface, BitLocker prompts for the recovery password + +You have a Surface device that has BitLocker Drive Encryption turned on. You update the firmware of the device TPM or install an update that changes the signature of the system firmware. For example, you install the Surface TPM (IFX) update. + +You experience one or more of the following symptoms on the Surface device: + +- At startup, you are prompted for your BitLocker recovery password. You enter the correct recovery password, but Windows doesn’t start up. +- Startup progresses directly into the Surface Unified Extensible Firmware Interface (UEFI) settings. +- The Surface device appears to be in an infinite restart loop. + +### Cause + +This issue occurs if the Surface device TPM is configured to use Platform Configuration Register (PCR) values other than the default values of PCR 7 and PCR 11. For example, the following settings can configure the TPM this way: + +- Secure Boot is turned off. +- PCR values have been explicitly defined, such as by Group Policy. + +Devices that support Connected Standby (also known as *InstantGO* or *Always On, Always Connected PCs*), including Surface devices, must use PCR 7 of the TPM. In its default configuration on such systems, BitLocker binds to PCR 7 and PCR 11 if PCR 7 and Secure Boot are correctly configured. For more information, see "About the Platform Configuration Register (PCR)" at [BitLocker Group Policy Settings](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj679890(v=ws.11)#about-the-platform-configuration-register-pcr)). + +### Resolution + +To verify the PCR values that are in use on a device, open and elevated Command Prompt window and run the following command: + +```cmd +manage-bde.exe -protectors -get : +``` + +In this command, <*OSDriveLetter*> represents the drive letter of the operating system drive. + +To resolve this issue and repair the device, follow these steps. + +#### Step 1: Disable the TPM protectors on the boot drive + +If you have installed a TPM or UEFI update and your device cannot start, even if you enter the correct BitLocker recovery password, you can restore the ability to start by using the BitLocker recovery password and a Surface recovery image to remove the TPM protectors from the boot drive. + +To do this, follow these steps: + +1. Obtain your BitLocker recovery password from [your Microsoft.com account](https://account.microsoft.com/devices/recoverykey). If BitLocker is managed by a different method, such as Microsoft BitLocker Administration and Monitoring (MBAM), contact your administrator for help. +1. Use another computer to download the Surface recovery image from [Download a recovery image for your Surface](https://support.microsoft.com/surfacerecoveryimage). Use the downloaded image to create a USB recovery drive. +1. Insert the USB Surface recovery image drive into the Surface device, and start the device. +1. When you are prompted, select the following items: + 1. Your operating system language. + 1. Your keyboard layout. +1. Select **Troubleshoot** > **Advanced Options** > **Command Prompt**. +1. In the Command Prompt window, run the following commands: + ```cmd + manage-bde -unlock -recoverypassword : + manage-bde -protectors -disable : + ``` + In these commands, \<*Password*\> is the BitLocker recovery password that you obtained in step 1, and \<*DriveLetter*> is the drive letter that is assigned to your operating system drive. + > [!NOTE] + > For more information about how to use this command, see [manage-bde: unlock](https://docs.microsoft.com/windows-server/administration/windows-commands/manage-bde-unlock). +1. Restart the computer. +1. When you are prompted, enter the BitLocker recovery password that you obtained in step 1. + +> [!NOTE] +> After you disable the TPM protectors, BitLocker Drive Encryption no longer protects your device. To re-enable BitLocker Drive Encryption, select **Start**, type **Manage BitLocker**, and then press Enter. Follow the steps to encrypt your drive. + +#### Step 2: Use Surface BMR to recover data and reset your device + +To recover data from your Surface device if you cannot start Windows, follow steps 1 through 5 of [Step 1](#step-1) to return to the Command Prompt window, and then follow these steps: + +1. At the command prompt, run the following command: + ```cmd + manage-bde -unlock -recoverypassword : + ``` + In this command, \<*Password*\> is the BitLocker recovery password that you obtained in step 1 of [Step 1](#step-1), and \<*DriveLetter*> is the drive letter that is assigned to your operating system drive. +1. After the drive is unlocked, use the **copy** or **xcopy** command to copy the user data to another drive. + > [!NOTE] + > For more information about the these commands, see the [Windows commands](https://docs.microsoft.com/windows-server/administration/windows-commands/windows-commands). + +1. To reset your device by using a Surface recovery image, follow the instructions in the "How to reset your Surface using your USB recovery drive" section in [Creating and using a USB recovery drive](https://support.microsoft.com/help/4023512). + +#### Step 3: Restore the default PCR values + +To prevent this issue from recurring, we strongly recommend that you restore the default configuration of Secure Boot and the PCR values. + +To enable Secure Boot on a Surface device, follow these steps: + +1. Suspend BitLocker. to do this, open an elevated Windows PowerShell window, and run the following cmdlet: + ```ps + Suspend-BitLocker -MountPoint ":" -RebootCount 0 + ``` + In this command, <*DriveLetter*> is the letter that is assigned to your drive. +1. Restart the device, and then edit the BIOS to set the **Secure Boot** option to **Microsoft Only**. +1. Restart the device. +1. Open an elevated PowerShell window, and run the following cmdlet: + ```ps + Resume-BitLocker -MountPoint ":" + ``` + +To reset the PCR settings on the TPM, follow these steps: + +1. Disable any Group Policy Objects that configure the PCR settings, or remove the device from any groups that enforce such policies. + For more information, see [BitLocker Group Policy settings](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings). +1. Suspend BitLocker. To do this, open an elevated Windows PowerShell window, and run the following cmdlet: + ```ps + Suspend-BitLocker -MountPoint ":" -RebootCount 0 + ``` + + where <*DriveLetter*> is the letter assigned to your drive. +1. Run the following cmdlet: + ```ps + Resume-BitLocker -MountPoint ":" + +#### Step 4: Suspend BitLocker during TPM or UEFI firmware updates + +You can avoid this scenario when you install updates to system firmware or TPM firmware by temporarily suspending BitLocker before you apply such updates. + +> [!IMPORTANT] +> TPM and UEFI firmware updates may require multiple restarts while they install. To keep BitLocker suspended during this process, you must use [Suspend-BitLocker](https://docs.microsoft.com/powershell/module/bitlocker/suspend-bitlocker?view=winserver2012r2-ps) and set the **Reboot Count** parameter to either of the following values: +> - **2** or greater: This value sets the number of times the device can restart before BitLocker Device Encryption resumes. +> - **0**: This value suspends BitLocker Drive Encryption indefinitely, until you use [Resume-BitLocker](https://docs.microsoft.com/powershell/module/bitlocker/resume-bitlocker?view=winserver2012r2-ps) or another mechanism to resume protection. + +To suspend BitLocker while you install TPM or UEFI firmware updates: + +1. Open an elevated Windows PowerShell window, and run the following cmdlet: + ```ps + Suspend-BitLocker -MountPoint ":" -RebootCount 0 + ``` + In this cmdlet <*DriveLetter*> is the letter that is assigned to your drive. +1. Install the Surface device driver and firmware updates. +1. After you install the firmware updates, restart the computer, open an elevated PowerShell window, and then run the following cmdlet: + ```ps + Resume-BitLocker -MountPoint ":" + ``` + +To re-enable BitLocker Drive Encryption, select **Start**, type **Manage BitLocker**, and then press Enter. Follow the steps to encrypt your drive. + +## After you install an update to a Hyper V-enabled computer, BitLocker prompts for the recovery password and returns error 0xC0210000 + +You have a device that runs Windows 10, version 1703, Windows 10, version 1607, or Windows Server 2016. Also, Hyper-V is enabled on the device. After you install an affected update and restart the device, the device enters BitLocker Recovery mode and you see error code 0xC0210000. + +### Workaround + +If your device is already in this state, you can successfully start Windows after suspending BitLocker from the Windows Recovery Environment (WinRE). To do this, follow these steps: + +1. Retrieve the 48-digit BitLocker recovery password for the operating system drive from your organization's portal or from wherever the password was stored when BitLocker Drive Encryption was first turned on. +1. On the Recovery screen, press Enter. When you are prompted, enter the recovery password. +1. If your device starts in the (WinRE) and prompts you for the recovery password again, select **Skip the drive**. +1. Select **Advanced options** > **Troubleshoot** > **Advanced options** > **Command Prompt**. +1. In the Command Prompt window, run the following commands: + ```cmd + Manage-bde -unlock c: -rp <48 digit numerical recovery password separated by “-“ in 6 digit group> + Manage-bde -protectors -disable c: + exit + ``` + + These commands unlock the drive and then suspend BitLocker by disabling the TPM protectors on the drive. The final command closes the Command Prompt window. + > [!NOTE] + > These commands suspend BitLocker for one restart of the device. The **-rc 1** option works only inside the operating system and does not work in the recovery environment. +1. Select **Continue**. Windows should start. +1. After Windows has started, open an elevated Command Prompt window and run the following command: + ```cmd + Manage-bde -protectors -enable c: + ``` + +> [!IMPORTANT] +> Unless you suspend BitLocker before you start the device, this issue recurs. + +To temporarily suspend BitLocker just before you restart the device, open an elevated Command Prompt window and run the following command: + +```cmd +Manage-bde -protectors -disable c: -rc 1 +``` + +### Resolution + +To resolve this issue, install the appropriate update on the affected device: + +- For Windows 10, version 1703: [July 9, 2019—KB4507450 (OS Build 15063.1928)](https://support.microsoft.com/help/4507450/windows-10-update-kb4507450) +- For Windows 10, version 1607 and Windows Server 2016: [July 9, 2019—KB4507460 (OS Build 14393.3085)](https://support.microsoft.com/help/4507460/windows-10-update-kb4507460) + +## Credential Guard/Device Guard on TPM 1.2: At every restart, BitLocker prompts for the recovery password and returns error 0xC0210000 + +You have a device that uses TPM 1.2 and runs Windows 10, version 1809. Also, the device uses [Virtualization-based Security](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-vbs) features such as [Device Guard and Credential Guard](https://docs.microsoft.com/windows-hardware/drivers/bringup/device-guard-and-credential-guard). Every time that you start the device, the device enters BitLocker Recovery mode and you see error code 0xc0210000, and a message that resembles the following. + +> Recovery +> +> Your PC/Device needs to be repaired. +> A required file couldn't be accessed because your BitLocker key wasn't loaded correctly. +> +> Error code 0xc0210000 +> +> You'll need to use recovery tools. If you don't have any installation media (like a disc or USB device), contact your PC administrator or PC/Device manufacturer. + +### Cause + +TPM 1.2 does not support Secure Launch. For more information, see [System Guard Secure Launch and SMM protection: Requirements Met by System Guard Enabled Machines](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection\#requirements-met-by-system-guard-enabled-machines) + +For more information about this technology, see [Windows Defender System Guard: How a hardware-based root of trust helps protect Windows 10](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) + +### Resolution + +To resolve this issue, do one of the following: + +- Remove any device that uses TPM 1.2 from any group that is subject to Group Policy Objects (GPOs) that enforce Secure Launch. +- Edit the **Turn On Virtualization Based Security** GPO to set **Secure Launch Configuration** to **Disabled**. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md new file mode 100644 index 0000000000..553780277a --- /dev/null +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md @@ -0,0 +1,113 @@ +--- +title: BitLocker and TPM other known issues +description: Describes common issues that relate directly to the TPM, and provides guidance for resolving those issues. +ms.reviewer: kaushika +ms.technology: windows +ms.prod: w10 +ms.sitesec: library +ms.localizationpriority: medium +author: Teresa-Motiv +ms.author: v-tea +manager: kaushika +audience: ITPro +ms.collection: Windows Security Technologies\BitLocker +ms.topic: troubleshooting +ms.date: 10/18/2019 +--- + +# BitLocker and TPM: other known issues + +This article describes common issues that relate directly to the Trusted Platform Module (TPM), and provides guidance to address these issues. + +## Azure AD: Windows Hello for Business and single sign-on do not work + +You have an Azure Active Directory (Azure AD)-joined client computer that cannot authenticate correctly. You experience one or more of the following symptoms: + +- Windows Hello for Business does not work. +- Conditional access fails. +- Single sign-on (SSO) does not work. + +Additionally, the computer logs an entry for Event ID 1026, which resembles the following: + +> Log Name: System +> Source: Microsoft-Windows-TPM-WMI +> Date: \ +> Event ID: 1026 +> Task Category: None +> Level: Information +> Keywords: +> User: SYSTEM +> Computer: \ +> Description: +> The Trusted Platform Module (TPM) hardware on this computer cannot be provisioned for use automatically.  To set up the TPM interactively use the TPM management console (Start-\>tpm.msc) and use the action to make the TPM ready. +> Error: The TPM is defending against dictionary attacks and is in a time-out period. +> Additional Information: 0x840000 + +### Cause + +This event indicates that the TPM is not ready or has some setting that prevents access to the TPM keys. + +Additionally, the behavior indicates that the client computer cannot obtain a [Primary Refresh Token (PRT)](https://docs.microsoft.com/azure/active-directory/devices/concept-primary-refresh-token). + +### Resolution + +To verify the status of the PRT, use the [dsregcmd /status command](https://docs.microsoft.com/azure/active-directory/devices/troubleshoot-device-dsregcmd) to collect information. In the tool output, verify that either **User state** or **SSO state** contains the **AzureAdPrt** attribute. If the value of this attribute is **No**, the PRT was not issued. This may indicate that the computer could not present its certificate for authentication. + +To resolve this issue, follow these steps to troubleshoot the TPM: + +1. Open the TPM management console (tpm.msc). To do this, select **Start**, and enter **tpm.msc** in the **Search** box. +1. If you see a notice to either unlock the TPM or reset the lockout, follow those instructions. +1. If you do not see such a notice, review the BIOS settings of the computer for any setting that you can use to reset or disable the lockout. +1. Contact the hardware vendor to determine whether there is a known fix for the issue. +1. If you still cannot resolve the issue, clear and re-initialize the TPM. To do this, follow the instructions in [Troubleshoot the TPM: Clear all the keys from the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm#clear-all-the-keys-from-the-tpm). + > [!WARNING] + > Clearing the TPM can cause data loss. + +## TPM 1.2 Error: Loading the management console failed. The device that is required by the cryptographic provider is not ready for use + +You have a Windows 10 version 1703-based computer that uses TPM version 1.2. When you try to open the TPM management console, you receive a message that resembles the following: + +> Loading the management console failed. The device that is required by the cryptographic provider is not ready for use. +> HRESULT 0x800900300x80090030 - NTE\_DEVICE\_NOT\_READY +> The device that is required by this cryptographic provider is not ready for use. +> TPM Spec version: TPM v1.2 + +On a different device that is running the same version of Windows, you can open the TPM management console. + +### Cause (suspected) + +These symptoms indicate that the TPM has hardware or firmware issues. + +### Resolution + +To resolve this issue, switch the TPM operating mode from version 1.2 to version 2.0. + +If this does not resolve the issue, consider replacing the device motherboard. After you replace the motherboard, switch the TPM operating mode from version 1.2 to version 2.0. + +## Devices do not join hybrid Azure AD because of a TPM issue + +You have a device that you are trying to join to a hybrid Azure AD. However, the join operation appears to fail. + +To verify that the join succeeded, use the [dsregcmd /status command](https://docs.microsoft.com/azure/active-directory/devices/troubleshoot-device-dsregcmd). In the tool output, the following attributes indicate that the join succeeded: + +- **AzureAdJoined: YES** +- **DomainName: \<*on-prem Domain name*\>** + +If the value of **AzureADJoined** is **No**, the join failed. + +### Causes and Resolutions + +This issue may occur when the Windows operating system is not the owner of the TPM. The specific fix for this issue depends on which errors or events you experience, as shown in the following table: + +|Message |Reason | Resolution| +| - | - | - | +|NTE\_BAD\_KEYSET (0x80090016/-2146893802) |TPM operation failed or was invalid |This issue was probably caused by a corrupted sysprep image. Make sure that you create the sysprep image by using a computer that is not joined to or registered in Azure AD or hybrid Azure AD. | +|TPM\_E\_PCP\_INTERNAL\_ERROR (0x80290407/-2144795641) |Generic TPM error. |If the device returns this error, disable its TPM. Windows 10, version 1809 and later versions automatically detect TPM failures and finish the hybrid Azure AD join without using the TPM. | +|TPM\_E\_NOTFIPS (0x80280036/-2144862154) |The FIPS mode of the TPM is currently not supported. |If the device gives this error, disable its TPM. Windows 10, version 1809 and later versions automatically detect TPM failures and finish the hybrid Azure AD join without using the TPM. | +|NTE\_AUTHENTICATION\_IGNORED (0x80090031/-2146893775) |The TPM is locked out. |This error is transient. Wait for the cooldown period, and then retry the join operation. | + +For more information about TPM issues, see the following articles: + +- [TPM fundamentals: Anti-hammering](https://docs.microsoft.com/windows/security/information-protection/tpm/tpm-fundamentals#anti-hammering) +- [Troubleshooting hybrid Azure Active Directory joined devices](https://docs.microsoft.com/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current) +- [Troubleshoot the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm) diff --git a/windows/security/information-protection/encrypted-hard-drive.md b/windows/security/information-protection/encrypted-hard-drive.md index 700a3d2672..d9b80efe97 100644 --- a/windows/security/information-protection/encrypted-hard-drive.md +++ b/windows/security/information-protection/encrypted-hard-drive.md @@ -2,11 +2,14 @@ title: Encrypted Hard Drive (Windows 10) description: Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: brianlic-msft +author: dulcemontemayor ms.date: 04/02/2019 --- @@ -38,9 +41,9 @@ Encrypted Hard Drives are supported natively in the operating system through the - **API**: API support for applications to manage Encrypted Hard Drives independently of BitLocker Drive Encryption (BDE) - **BitLocker support**: Integration with the BitLocker Control Panel provides a seamless BitLocker end user experience. ->[!WARNING]   +>[!WARNING] >Self-Encrypting Hard Drives and Encrypted Hard Drives for Windows are not the same type of device. Encrypted Hard Drives for Windows require compliance for specific TCG protocols as well as IEEE 1667 compliance; Self-Encrypting Hard Drives do not have these requirements. It is important to confirm the device type is an Encrypted Hard Drive for Windows when planning for deployment. -  + If you are a storage device vendor who is looking for more info on how to implement Encrypted Hard Drive, see the [Encrypted Hard Drive Device Guide](https://msdn.microsoft.com/library/windows/hardware/dn653989.aspx). ## System Requirements @@ -60,9 +63,9 @@ For an Encrypted Hard Drive used as a **startup drive**: - The computer must have the Compatibility Support Module (CSM) disabled in UEFI. - The computer must always boot natively from UEFI. ->[!WARNING]   +>[!WARNING] >All Encrypted Hard Drives must be attached to non-RAID controllers to function properly. -  + ## Technical overview Rapid encryption in BitLocker directly addresses the security needs of enterprises while offering significantly improved performance. In versions of Windows earlier than Windows Server 2012, BitLocker required a two-step process to complete read/write requests. In Windows Server 2012, Windows 8, or later, Encrypted Hard Drives offload the cryptographic operations to the drive controller for much greater efficiency. When the operating system identifies an Encrypted Hard Drive, it activates the security mode. This activation lets the drive controller generate a media key for every volume that the host computer creates. This media key, which is never exposed outside the disk, is used to rapidly encrypt or decrypt every byte of data that is sent or received from the disk. @@ -80,9 +83,9 @@ Configuration of Encrypted Hard Drives as startup drives is done using the same There are three related Group Policy settings that help you manage how BitLocker uses hardware-based envryption and which encryption algorithms to use. If these settings are not configured or disabled on systems that are equipped with encrypted drives, BitLocker uses software-based encryption: -- [Configure use of hardware-based encryption for fixed data drives](bitlocker/bitlocker-group-policy-settings.md#a-href-idbkmk-hdefxdaconfigure-use-of-hardware-based-encryption-for-fixed-data-drives) -- [Configure use of hardware-based encryption for removable data drives](bitlocker/bitlocker-group-policy-settings.md#a-href-idbkmk-hderddaconfigure-use-of-hardware-based-encryption-for-removable-data-drives) -- [Configure use of hardware-based encryption for operating system drives](bitlocker/bitlocker-group-policy-settings.md#a-href-idbkmk-hdeosdaconfigure-use-of-hardware-based-encryption-for-operating-system-drives) +- [Configure use of hardware-based encryption for fixed data drives](bitlocker/bitlocker-group-policy-settings.md#bkmk-hdefxd) +- [Configure use of hardware-based encryption for removable data drives](bitlocker/bitlocker-group-policy-settings.md#configure-use-of-hardware-based-encryption-for-removable-data-drives) +- [Configure use of hardware-based encryption for operating system drives](bitlocker/bitlocker-group-policy-settings.md#configure-use-of-hardware-based-encryption-for-operating-system-drives) ## Encrypted Hard Drive Architecture @@ -104,4 +107,4 @@ Many Encrypted Hard Drive devices come pre-configured for use. If reconfiguratio 1. Open Disk Management (diskmgmt.msc) 2. Initialize the disk and select the appropriate partition style (MBR or GPT) 3. Create one or more volumes on the disk. -4. Use the BitLocker setup wizard to enable BitLocker on the volume. +4. Use the BitLocker setup wizard to enable BitLocker on the volume. \ No newline at end of file diff --git a/windows/security/information-protection/index.md b/windows/security/information-protection/index.md index e17bd5c51b..c2050be90b 100644 --- a/windows/security/information-protection/index.md +++ b/windows/security/information-protection/index.md @@ -5,7 +5,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: justinha +author: dansimp +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index bfded5408a..5474e7faf1 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -5,13 +5,14 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: aadake -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 03/26/2019 +ms.reviewer: --- # Kernel DMA Protection for Thunderbolt™ 3 @@ -72,7 +73,7 @@ Systems running Windows 10 version 1803 that do support Kernel DMA Protection do ### Using Security Center -Beginning with Wndows 10 version 1809, you can use Security Center to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**. +Beginning with Windows 10 version 1809, you can use Security Center to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**. ![Kernel DMA protection in Security Center](bitlocker/images/kernel-dma-protection-security-center.png) @@ -99,7 +100,7 @@ In-market systems, released with Windows 10 version 1709 or earlier, will not su No, Kernel DMA Protection only protects against drive-by DMA attacks after the OS is loaded. It is the responsibility of the system firmware/BIOS to protect against attacks via the Thunderbolt™ 3 ports during boot. ### How can I check if a certain driver supports DMA-remapping? -DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping. +DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping. If the property is not available, then the policy is not set by the device driver (i.e. the device driver does not support DMA-remapping). Please check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external). *For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the following image. diff --git a/windows/security/information-protection/secure-the-windows-10-boot-process.md b/windows/security/information-protection/secure-the-windows-10-boot-process.md index 072e16abfe..384c907c62 100644 --- a/windows/security/information-protection/secure-the-windows-10-boot-process.md +++ b/windows/security/information-protection/secure-the-windows-10-boot-process.md @@ -7,12 +7,14 @@ ms.mktglfcycl: Explore ms.pagetype: security ms.sitesec: library ms.localizationpriority: medium -author: justinha +author: dulcemontemayor manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 11/16/2018 +ms.reviewer: +ms.author: dansimp --- # Secure the Windows 10 boot process @@ -23,7 +25,7 @@ ms.date: 11/16/2018 The Windows operating system has many features to help protect you from malware, and it does an amazingly good job. Except for apps that businesses develop and use internally, all Microsoft Store apps must meet a series of requirements to be certified and included in the Microsoft Store. This certification process examines several criteria, including security, and is an effective means of preventing malware from entering the Microsoft Store. Even if a malicious app does get through, the Windows 10 operating system includes a series of security features that can mitigate the impact. For instance, Microsoft Store apps are sandboxed and lack the privileges necessary to access user data or change system settings. -Windows 10 has multiple levels of protection for desktop apps and data, too. Windows Defender uses signatures to detect and quarantine apps that are known to be malicious. The SmartScreen Filter warns users before allowing them to run an untrustworthy app, even if it’s recognized as malware. Before an app can change system settings, the user would have to grant the app administrative privileges by using User Account Control. +Windows 10 has multiple levels of protection for desktop apps and data, too. Windows Defender uses signatures to detect and quarantine apps that are known to be malicious. Windows Defender SmartScreen warns users before allowing them to run an untrustworthy app, even if it’s recognized as malware. Before an app can change system settings, the user would have to grant the app administrative privileges by using User Account Control. Those are just some of the ways that Windows 10 protects you from malware. However, those security features protect you only after Windows 10 starts. Modern malware—and bootkits specifically—are capable of starting before Windows, completely bypassing operating system security, and remaining completely hidden. @@ -78,7 +80,7 @@ All x86-based Certified For Windows 10 PCs must meet several requirements relat These requirements help protect you from rootkits while allowing you to run any operating system you want. You have three options for running non-Microsoft operating systems: -- **Use an operating system with a certified bootloader.** Because all Certified For Windows 10 PCs must trust Microsoft’s certificate, Microsoft offers a service to analyze and sign any non-Microsoft bootloader so that it will be trusted by all Certified For Windows 10 PCs. In fact, an [open source bootloader](http://mjg59.dreamwidth.org/20303.html) capable of loading Linux is already available. To begin the process of obtaining a certificate, go to . +- **Use an operating system with a certified bootloader.** Because all Certified For Windows 10 PCs must trust Microsoft’s certificate, Microsoft offers a service to analyze and sign any non-Microsoft bootloader so that it will be trusted by all Certified For Windows 10 PCs. In fact, an [open source bootloader](http://mjg59.dreamwidth.org/20303.html) capable of loading Linux is already available. To begin the process of obtaining a certificate, go to . - **Configure UEFI to trust your custom bootloader.** All Certified For Windows 10 PCs allow you to trust a non-certified bootloader by adding a signature to the UEFI database, allowing you to run any operating system, including homemade operating systems. - **Turn off Secure Boot.** All Certified For Windows 10 PCs allow you to turn off Secure Boot so that you can run any software. This does not help protect you from bootkits, however. @@ -94,7 +96,7 @@ Because Secure Boot has protected the bootloader and Trusted Boot has protected Early Launch Anti-Malware (ELAM) can load a Microsoft or non-Microsoft anti-malware driver before all non-Microsoft boot drivers and applications, thus continuing the chain of trust established by Secure Boot and Trusted Boot. Because the operating system hasn’t started yet, and because Windows needs to boot as quickly as possible, ELAM has a simple task: examine every boot driver and determine whether it is on the list of trusted drivers. If it’s not trusted, Windows won’t load it. -An ELAM driver isn’t a full-featured anti-malware solution; that loads later in the boot process. Windows Defender (included with Windows 10) supports ELAM, as does [Microsoft System Center 2012 Endpoint Protection](https://www.microsoft.com/en-us/server-cloud/system-center/endpoint-protection-2012.aspx) and several non-Microsoft anti-malware apps. +An ELAM driver isn’t a full-featured anti-malware solution; that loads later in the boot process. Windows Defender (included with Windows 10) supports ELAM, as does [Microsoft System Center 2012 Endpoint Protection](https://www.microsoft.com/server-cloud/system-center/endpoint-protection-2012.aspx) and several non-Microsoft anti-malware apps. ## Measured Boot If a PC in your organization does become infected with a rootkit, you need to know about it. Enterprise anti-malware apps can report malware infections to the IT department, but that doesn’t work with rootkits that hide their presence. In other words, you can’t trust the client to tell you whether it’s healthy. diff --git a/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md b/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md index 2ad21a5ff0..3e3fdfd9b5 100644 --- a/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md @@ -2,12 +2,13 @@ title: Back up the TPM recovery information to AD DS (Windows 10) description: This topic for the IT professional describes backup of Trusted Platform Module (TPM) information. ms.assetid: 62bcec80-96a1-464e-8b3f-d177a7565ac5 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: andreabichsel -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -30,4 +31,4 @@ With Windows 10, versions 1511 and 1507, you can back up a computer’s Trusted ## Related topics - [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) -- [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) \ No newline at end of file +- [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md) diff --git a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md index 5f8805bb4e..1cb7f1c281 100644 --- a/windows/security/information-protection/tpm/change-the-tpm-owner-password.md +++ b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md @@ -2,12 +2,13 @@ title: Change the TPM owner password (Windows 10) description: This topic for the IT professional describes how to change the password or PIN for the owner of the Trusted Platform Module (TPM) that is installed on your system. ms.assetid: e43dcff3-acb4-4a92-8816-d6b64b7f2f45 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: andreabichsel -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md index 6800a86d9a..c802bfae51 100644 --- a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md +++ b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md @@ -2,13 +2,14 @@ title: How Windows uses the TPM description: This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it to enhance security. ms.assetid: 0f7e779c-bd25-42a8-b8c1-69dfb54d0c7f +ms.reviewer: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: andreabichsel -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -23,11 +24,11 @@ The Windows 10 operating system improves most existing security features in the **See also:** - - [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications) +- [Windows 10 Specifications](https://www.microsoft.com/windows/windows-10-specifications) - - [TPM Fundamentals](tpm-fundamentals.md) +- [TPM Fundamentals](tpm-fundamentals.md) - - [TPM Recommendations](tpm-recommendations.md)  +- [TPM Recommendations](tpm-recommendations.md)  ## TPM Overview @@ -162,4 +163,4 @@ The TPM adds hardware-based security benefits to Windows 10. When installed on h
                                    -Although some of the aforementioned features have additional hardware requirements (e.g., virtualization support), the TPM is a cornerstone of Windows 10 security. Microsoft and other industry stakeholders continue to improve the global standards associated with TPM and find more and more applications that use it to provide tangible benefits to customers. Microsoft has included support for most TPM features in its version of Windows for the Internet of Things (IoT) called [Windows 10 IoT Core](https://developer.microsoft.com/windows/iot/iotcore). IoT devices that might be deployed in insecure physical locations and connected to cloud services like [Azure IoT Hub](https://azure.microsoft.com/documentation/services/iot-hub/) for management can use the TPM in innovative ways to address their emerging security requirements. \ No newline at end of file +Although some of the aforementioned features have additional hardware requirements (e.g., virtualization support), the TPM is a cornerstone of Windows 10 security. Microsoft and other industry stakeholders continue to improve the global standards associated with TPM and find more and more applications that use it to provide tangible benefits to customers. Microsoft has included support for most TPM features in its version of Windows for the Internet of Things (IoT) called [Windows 10 IoT Core](https://developer.microsoft.com/windows/iot/iotcore). IoT devices that might be deployed in insecure physical locations and connected to cloud services like [Azure IoT Hub](https://azure.microsoft.com/documentation/services/iot-hub/) for management can use the TPM in innovative ways to address their emerging security requirements. diff --git a/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md b/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md index 5296588ad5..cf6d045df3 100644 --- a/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md +++ b/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md @@ -2,12 +2,13 @@ title: Troubleshoot the TPM (Windows 10) description: This topic for the IT professional describes how to view status for, clear, or troubleshoot the Trusted Platform Module (TPM). ms.assetid: 1166efaf-7aa3-4420-9279-435d9c6ac6f8 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: andreabichsel -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -130,17 +131,17 @@ If you want to stop using the services that are provided by the TPM, you can use **To turn off the TPM (TPM 1.2 with Windows 10, version 1507 or 1511 only)** -1. Open the TPM MMC (tpm.msc). +1. Open the TPM MMC (tpm.msc). -2. In the **Action** pane, click **Turn TPM Off** to display the **Turn off the TPM security hardware** page. +2. In the **Action** pane, click **Turn TPM Off** to display the **Turn off the TPM security hardware** page. -3. In the **Turn off the TPM security hardware** dialog box, select a method to enter your owner password and turning off the TPM: +3. In the **Turn off the TPM security hardware** dialog box, select a method to enter your owner password and turning off the TPM: - - If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, click **Browse** to locate the .tpm file that is saved on your removable storage device, click **Open**, and then click **Turn TPM Off**. + - If you saved your TPM owner password on a removable storage device, insert it, and then click **I have the owner password file**. In the **Select backup file with the TPM owner password** dialog box, click **Browse** to locate the .tpm file that is saved on your removable storage device, click **Open**, and then click **Turn TPM Off**. - - If you do not have the removable storage device with your saved TPM owner password, click **I want to enter the password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and then click **Turn TPM Off**. + - If you do not have the removable storage device with your saved TPM owner password, click **I want to enter the password**. In the **Type your TPM owner password** dialog box, type your password (including hyphens), and then click **Turn TPM Off**. - - If you did not save your TPM owner password or no longer know it, click **I do not have the TPM owner password**, and follow the instructions that are provided in the dialog box and subsequent UEFI screens to turn off the TPM without entering the password. + - If you did not save your TPM owner password or no longer know it, click **I do not have the TPM owner password**, and follow the instructions that are provided in the dialog box and subsequent UEFI screens to turn off the TPM without entering the password. ## Use the TPM cmdlets diff --git a/windows/security/information-protection/tpm/manage-tpm-commands.md b/windows/security/information-protection/tpm/manage-tpm-commands.md index ce4f195e2f..bd30e9b8f2 100644 --- a/windows/security/information-protection/tpm/manage-tpm-commands.md +++ b/windows/security/information-protection/tpm/manage-tpm-commands.md @@ -2,11 +2,13 @@ title: Manage TPM commands (Windows 10) description: This topic for the IT professional describes how to manage which Trusted Platform Module (TPM) commands are available to domain users and to local users. ms.assetid: a78e751a-2806-43ae-9c20-2e7ca466b765 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: justinha +author: dulcemontemayor manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/manage-tpm-lockout.md b/windows/security/information-protection/tpm/manage-tpm-lockout.md index 8508fd4dae..37f9839c3e 100644 --- a/windows/security/information-protection/tpm/manage-tpm-lockout.md +++ b/windows/security/information-protection/tpm/manage-tpm-lockout.md @@ -2,11 +2,13 @@ title: Manage TPM lockout (Windows 10) description: This topic for the IT professional describes how to manage the lockout feature for the Trusted Platform Module (TPM) in Windows. ms.assetid: bf27adbe-404c-4691-a644-29ec722a3f7b +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: justinha +author: dulcemontemayor manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -48,18 +50,18 @@ The following procedure explains the steps to reset the TPM lockout by using the **To reset the TPM lockout** -1. Open the TPM MMC (tpm.msc). +1. Open the TPM MMC (tpm.msc). -2. In the **Action** pane, click **Reset TPM Lockout** to start the Reset TPM Lockout Wizard. +2. In the **Action** pane, click **Reset TPM Lockout** to start the Reset TPM Lockout Wizard. -3. Choose one of the following methods to enter the TPM owner password: +3. Choose one of the following methods to enter the TPM owner password: - - If you saved your TPM owner password to a .tpm file, click **I have the owner password file**, and then type the path to the file, or click **Browse** to navigate to the file location. + - If you saved your TPM owner password to a .tpm file, click **I have the owner password file**, and then type the path to the file, or click **Browse** to navigate to the file location. - - If you want to manually enter your TPM owner password, click **I want to enter the owner password**, and then type the password in the text box provided. + - If you want to manually enter your TPM owner password, click **I want to enter the owner password**, and then type the password in the text box provided. - > [!NOTE] - > If you enabled BitLocker and your TPM at the same time, and you printed your BitLocker recovery password when you turned on BitLocker, your TPM owner password may have printed with it. + > [!NOTE] + > If you enabled BitLocker and your TPM at the same time, and you printed your BitLocker recovery password when you turned on BitLocker, your TPM owner password may have printed with it. ## Use Group Policy to manage TPM lockout settings diff --git a/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md index eacf850aab..d9e1befbcd 100644 --- a/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md +++ b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md @@ -1,13 +1,14 @@ --- title: Understanding PCR banks on TPM 2.0 devices (Windows 10) -description: This topic for the IT professional provides background about what happens when you switch PCR banks on TPM 2.0 devices. +description: This topic for the IT professional provides background about what happens when you switch PCR banks on TPM 2.0 devices. ms.assetid: 743FCCCB-99A9-4636-8F48-9ECB3A3D10DE +ms.reviewer: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: andreabichsel -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -42,7 +43,7 @@ It is important to note that this binding to PCR values also includes the hashin ## What happens when PCR banks are switched? -When the PCR banks are switched, the algorithm used to compute the hashed values stored in the PCRs during extend operations is changed. For the same input, each hash algorithm will return a different cryptographic signature for the same inputs. +When the PCR banks are switched, the algorithm used to compute the hashed values stored in the PCRs during extend operations is changed. Each hash algorithm will return a different cryptographic signature for the same inputs. As a result, if the currently used PCR bank is switched all keys that have been bound to the previous PCR values will no longer work. For example, if you had a key bound to the SHA-1 value of PCR\[12\] and subsequently changed the PCR banks to SHA-256, the banks wouldn’t match, and you would be unable to use that key. The BitLocker key is secured using the PCR banks and Windows 10 will not be able to unseal it if the PCR banks are switched while BitLocker is enabled. @@ -50,6 +51,24 @@ As a result, if the currently used PCR bank is switched all keys that have been Before switching PCR banks you should suspend or disable BitLocker – or have your recovery key ready. For steps on how to switch PCR banks on your PC, you should contact your OEM or UEFI vendor. +## How can I identify which PCR bank is being used? + +A TPM can be configured to have multiple PCR banks active. When BIOS is performing measurements it will do so into all active PCR banks, depending on its capability to make these measurements. BIOS may chose to deactivate PCR banks that it does not support or "cap" PCR banks that it does not support by extending a separator. The following registry value identifies which PCR banks are active. + +- Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IntegrityServices
                                    +- DWORD: TPMActivePCRBanks
                                    +- Defines which PCR banks are currently active. (This value should be interpreted as a bitmap for which the bits are defined in the [TCG Algorithm Registry](https://trustedcomputinggroup.org/resource/tcg-algorithm-registry/) Table 21 of Revision 1.27.)
                                    + +Windows checks which PCR banks are active and supported by the BIOS. Windows also checks if the measured boot log supports measurements for all active PCR banks. Windows will prefer the use of the SHA-256 bank for measurements and will fall back to SHA1 PCR bank if one of the pre-conditions is not met. + +You can identify which PCR bank is currently used by Windows by looking at the registry. + +- Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\IntegrityServices
                                    +- DWORD: TPMDigestAlgID
                                    +- Algorithm ID of the PCR bank that Windows is currently using. (This value represents an algorithm identifier as defined in the [TCG Algorithm Registry](https://trustedcomputinggroup.org/resource/tcg-algorithm-registry/) Table 3 of Revision 1.27.)
                                    + +Windows only uses one PCR bank to continue boot measurements. All other active PCR banks will be extended with a separator to indicate that they are not used by Windows and measurements that appear to be from Windows should not be trusted. + ## Related topics - [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) diff --git a/windows/security/information-protection/tpm/tpm-fundamentals.md b/windows/security/information-protection/tpm/tpm-fundamentals.md index e826eb601c..e2ae8c85e5 100644 --- a/windows/security/information-protection/tpm/tpm-fundamentals.md +++ b/windows/security/information-protection/tpm/tpm-fundamentals.md @@ -1,13 +1,14 @@ --- title: TPM fundamentals (Windows 10) -description: This topic for the IT professional provides a description of the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and explains how they are used to mitigate dictionary attacks. +description: Inform yourself about the components of the Trusted Platform Module (TPM 1.2 and TPM 2.0) and how they are used to mitigate dictionary attacks. ms.assetid: ac90f5f9-9a15-4e87-b00d-4adcf2ec3000 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: andreabichsel -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md index c7ef09ffc6..4ab3d8f320 100644 --- a/windows/security/information-protection/tpm/tpm-recommendations.md +++ b/windows/security/information-protection/tpm/tpm-recommendations.md @@ -2,13 +2,14 @@ title: TPM recommendations (Windows 10) description: This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. ms.assetid: E85F11F5-4E6A-43E7-8205-672F77706561 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: andreabichsel -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -19,8 +20,9 @@ ms.date: 11/29/2018 # TPM recommendations **Applies to** -- Windows 10 -- Windows Server 2016 + +- Windows 10 +- Windows Server 2016 This topic provides recommendations for Trusted Platform Module (TPM) technology for Windows 10. @@ -46,40 +48,42 @@ From an industry standard, Microsoft has been an industry leader in moving and s TPM 2.0 products and systems have important security advantages over TPM 1.2, including: -- The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm. +- The TPM 1.2 spec only allows for the use of RSA and the SHA-1 hashing algorithm. -- For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017. +- For security reasons, some entities are moving away from SHA-1. Notably, NIST has required many federal agencies to move to SHA-256 as of 2014, and technology leaders, including Microsoft and Google have announced they will remove support for SHA-1 based signing or certificates in 2017. -- TPM 2.0 **enables greater crypto agility** by being more flexible with respect to cryptographic algorithms. +- TPM 2.0 **enables greater crypto agility** by being more flexible with respect to cryptographic algorithms. - - TPM 2.0 supports newer algorithms, which can improve drive signing and key generation performance. For the full list of supported algorithms, see the [TCG Algorithm Registry](http://www.trustedcomputinggroup.org/tcg-algorithm-registry/). Some TPMs do not support all algorithms. + - TPM 2.0 supports newer algorithms, which can improve drive signing and key generation performance. For the full list of supported algorithms, see the [TCG Algorithm Registry](http://www.trustedcomputinggroup.org/tcg-algorithm-registry/). Some TPMs do not support all algorithms. - - For the list of algorithms that Windows supports in the platform cryptographic storage provider, see [CNG Cryptographic Algorithm Providers](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx). + - For the list of algorithms that Windows supports in the platform cryptographic storage provider, see [CNG Cryptographic Algorithm Providers](https://msdn.microsoft.com/library/windows/desktop/bb931354(v=vs.85).aspx). - - TPM 2.0 achieved ISO standardization ([ISO/IEC 11889:2015](https://blogs.microsoft.com/cybertrust/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/)). + - TPM 2.0 achieved ISO standardization ([ISO/IEC 11889:2015](https://blogs.microsoft.com/cybertrust/2015/06/29/governments-recognize-the-importance-of-tpm-2-0-through-iso-adoption/)). - - Use of TPM 2.0 may help eliminate the need for OEMs to make exception to standard configurations for certain countries and regions. + - Use of TPM 2.0 may help eliminate the need for OEMs to make exception to standard configurations for certain countries and regions. -- TPM 2.0 offers a more **consistent experience** across different implementations. +- TPM 2.0 offers a more **consistent experience** across different implementations. - - TPM 1.2 implementations vary in policy settings. This may result in support issues as lockout policies vary. + - TPM 1.2 implementations vary in policy settings. This may result in support issues as lockout policies vary. - - TPM 2.0 lockout policy is configured by Windows, ensuring a consistent dictionary attack protection guarantee. + - TPM 2.0 lockout policy is configured by Windows, ensuring a consistent dictionary attack protection guarantee. -- While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a single semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC. +- While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a single semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC. > [!NOTE] -> TPM 2.0 requires UEFI firmware. A computer with legacy BIOS and TPM 2.0 won't work as expected. +> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature. + +> Installed Operating System on hardware in legacy mode will stop the OS from booting when the BIOS mode is changed to UEFI. Use the tool [MBR2GPT](https://docs.microsoft.com/windows/deployment/mbr-to-gpt) before changing the BIOS mode which will prepare the OS and the disk to support UEFI. ## Discrete, Integrated or Firmware TPM? There are three implementation options for TPMs: -- Discrete TPM chip as a separate component in its own semiconductor package +- Discrete TPM chip as a separate component in its own semiconductor package -- Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components +- Integrated TPM solution, using dedicated hardware integrated into one or more semiconductor packages alongside, but logically separate from, other components -- Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit +- Firmware TPM solution, running the TPM in firmware in a Trusted Execution mode of a general purpose computation unit Windows uses any compatible TPM in the same way. Microsoft does not take a position on which way a TPM should be implemented and there is a wide ecosystem of available TPM solutions which should suit all needs. @@ -91,39 +95,37 @@ For end consumers, TPM is behind the scenes but is still very relevant. TPM is u ### Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) -- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7 of the [Minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) page). The requirement to enable TPM 2.0 only applies to the manufacturing of new devices. For TPM recommendations for specific Windows features, see [TPM and Windows Features](#tpm-and-windows-features). +- Since July 28, 2016, all new device models, lines or series (or if you are updating the hardware configuration of a existing model, line or series with a major update, such as CPU, graphic cards) must implement and enable by default TPM 2.0 (details in section 3.7 of the [Minimum hardware requirements](https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview) page). The requirement to enable TPM 2.0 only applies to the manufacturing of new devices. For TPM recommendations for specific Windows features, see [TPM and Windows Features](#tpm-and-windows-features). ### IoT Core -- TPM is optional on IoT Core. +- TPM is optional on IoT Core. ### Windows Server 2016 -- TPM is optional for Windows Server SKUs unless the SKU meets the additional qualification (AQ) criteria for the Host Guardian Services scenario in which case TPM 2.0 is required. +- TPM is optional for Windows Server SKUs unless the SKU meets the additional qualification (AQ) criteria for the Host Guardian Services scenario in which case TPM 2.0 is required. ## TPM and Windows Features The following table defines which Windows features require TPM support. -| Windows Features | TPM Required | Supports TPM 1.2 | Supports TPM 2.0 | Details | -|-------------------------|--------------|--------------------|--------------------|----------| -| Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot | -| BitLocker | Yes | Yes | Yes | TPM 1.2 or 2.0 is required, but [Automatic Device Encryption requires Modern Standby](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) including TPM 2.0 support | -| Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. | -| Windows Defender Application Control (Device Guard) | No | Yes | Yes | | -| Windows Defender Exploit Guard | No | N/A | N/A | | -| Windows Defender System Guard | Yes | No | Yes | | -| Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. | -| Device Health Attestation| Yes | Yes | Yes | | -| Windows Hello/Windows Hello for Business| No | Yes | Yes | Azure AD join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. | -| UEFI Secure Boot | No | Yes | Yes | | -| TPM Platform Crypto Provider Key Storage Provider| Yes | Yes| Yes | | -| Virtual Smart Card | Yes | Yes | Yes | | -| Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. | -| Autopilot | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | -| SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | -| DRTM | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. | - + Windows Features | TPM Required | Supports TPM 1.2 | Supports TPM 2.0 | Details | +-|-|-|-|- + Measured Boot | Yes | Yes | Yes | Measured Boot requires TPM 1.2 or 2.0 and UEFI Secure Boot + BitLocker | Yes | Yes | Yes | TPM 1.2 or 2.0 is required, but [Automatic Device Encryption requires Modern Standby](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) including TPM 2.0 support + Device Encryption | Yes | N/A | Yes | Device Encryption requires Modern Standby/Connected Standby certification, which requires TPM 2.0. + Windows Defender Application Control (Device Guard) | No | Yes | Yes + Windows Defender System Guard | Yes | No | Yes + Credential Guard | No | Yes | Yes | Windows 10, version 1507 (End of Life as of May 2017) only supported TPM 2.0 for Credential Guard. Beginning with Windows 10, version 1511, TPM 1.2 and 2.0 are supported. + Device Health Attestation| Yes | Yes | Yes + Windows Hello/Windows Hello for Business| No | Yes | Yes | Azure AD join supports both versions of TPM, but requires TPM with keyed-hash message authentication code (HMAC) and Endorsement Key (EK) certificate for key attestation support. + UEFI Secure Boot | No | Yes | Yes + TPM Platform Crypto Provider Key Storage Provider| Yes | Yes | Yes + Virtual Smart Card | Yes | Yes | Yes + Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM. + Autopilot | Yes | No | Yes | TPM 2.0 and UEFI firmware is required for white glove and self-deploying scenarios. + SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. + DRTM | Yes | No | Yes | TPM 2.0 and UEFI firmware is required. ## OEM Status on TPM 2.0 system availability and certified parts diff --git a/windows/security/information-protection/tpm/trusted-platform-module-overview.md b/windows/security/information-protection/tpm/trusted-platform-module-overview.md index 3f858bbcb9..a6c748fa89 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-overview.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-overview.md @@ -2,13 +2,14 @@ title: Trusted Platform Module Technology Overview (Windows 10) description: This topic for the IT professional describes the Trusted Platform Module (TPM) and how Windows uses it for access control and authentication. ms.assetid: face8932-b034-4319-86ac-db1163d46538 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: andreabichsel -ms-author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -19,7 +20,7 @@ ms.date: 11/29/2018 # Trusted Platform Module Technology Overview **Applies to** -- Windows 10 +- Windows 10 - Windows Server 2016 - Windows Server 2019 @@ -53,13 +54,13 @@ Certificates can be installed or created on computers that are using the TPM. Af Automated provisioning in the TPM reduces the cost of TPM deployment in an enterprise. New APIs for TPM management can determine if TPM provisioning actions require physical presence of a service technician to approve TPM state change requests during the boot process. -Antimalware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows 10 or Windows Server 2016. These measurements include the launch of Hyper-V to test that datacenters using virtualization are not running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry. +Antimalware software can use the boot measurements of the operating system start state to prove the integrity of a computer running Windows 10 or Windows Server 2016. These measurements include the launch of Hyper-V to test that datacenters using virtualization are not running untrusted hypervisors. With BitLocker Network Unlock, IT administrators can push an update without concerns that a computer is waiting for PIN entry. The TPM has several Group Policy settings that might be useful in certain enterprise scenarios. For more info, see [TPM Group Policy Settings](trusted-platform-module-services-group-policy-settings.md). ## New and changed functionality -For more info on new and changed functionality for Trusted Platform Module in Windows 10, see [What's new in Trusted Platform Module?](https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511#trusted-platform-module). +For more info on new and changed functionality for Trusted Platform Module in Windows 10, see [What's new in Trusted Platform Module?](https://technet.microsoft.com/itpro/windows/whats-new/whats-new-windows-10-version-1507-and-1511#trusted-platform-module). ## Device health attestation @@ -78,7 +79,7 @@ Some things that you can check on the device are: ## Supported versions for device health attestation -| TPM version | Windows 10 | Windows Server 2016 | Windows Server 2019 | +| TPM version | Windows 10 | Windows Server 2016 | Windows Server 2019 | |-------------|-------------|---------------------|---------------------| | TPM 1.2 | >= ver 1607 | >= ver 1607 | Yes | | TPM 2.0 | Yes | Yes | Yes | @@ -87,5 +88,12 @@ Some things that you can check on the device are: ## Related topics - [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) -- [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/trustedplatformmodule) -- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations) +- [Details on the TPM standard](https://www.microsoft.com/research/project/the-trusted-platform-module-tpm/) (has links to features using TPM) +- [TPM Base Services Portal](https://docs.microsoft.com/windows/desktop/TBS/tpm-base-services-portal) +- [TPM Base Services API](https://docs.microsoft.com/windows/desktop/api/_tbs/) +- [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/trustedplatformmodule) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations) +- [Azure device provisioning: Identity attestation with TPM](https://azure.microsoft.com/blog/device-provisioning-identity-attestation-with-tpm/) +- [Azure device provisioning: A manufacturing timeline for TPM devices](https://azure.microsoft.com/blog/device-provisioning-a-manufacturing-timeline-for-tpm-devices/) +- [Windows 10: Enabling vTPM (Virtual TPM)](https://social.technet.microsoft.com/wiki/contents/articles/34431.windows-10-enabling-vtpm-virtual-tpm.aspx) +- [How to Multiboot with Bitlocker, TPM, and a Non-Windows OS](https://social.technet.microsoft.com/wiki/contents/articles/9528.how-to-multiboot-with-bitlocker-tpm-and-a-non-windows-os.aspx) diff --git a/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md b/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md index 6b661fde27..94634c4b79 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md @@ -2,12 +2,13 @@ title: TPM Group Policy settings (Windows 10) description: This topic describes the Trusted Platform Module (TPM) Services that can be controlled centrally by using Group Policy settings. ms.assetid: 54ff1c1e-a210-4074-a44e-58fee26e4dbd +ms.reviewer: ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: andreabichsel -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -122,28 +123,28 @@ Introduced in Windows 10, version 1703, this policy setting configures the TPM t > [!IMPORTANT] > Setting this policy will take effect only if: -- The TPM was originally prepared using a version of Windows after Windows 10 Version 1607 -- The system has a TPM 2.0. - +> - The TPM was originally prepared using a version of Windows after Windows 10 Version 1607 +> - The system has a TPM 2.0. +> > [!NOTE] > Enabling this policy will only take effect after the TPM maintenance task runs (which typically happens after a system restart). Once this policy has been enabled on a system and has taken effect (after a system restart), disabling it will have no impact and the system's TPM will remain configured using the legacy Dictionary Attack Prevention parameters, regardless of the value of this group policy. The only ways for the disabled setting of this policy to take effect on a system where it was once enabled are to either: > - Disable it from group policy > - Clear the TPM on the system -# TPM Group Policy settings in the Windows Security app +## TPM Group Policy settings in the Windows Security app You can change what users see about TPM in the Windows Security app. The Group Policy settings for the TPM area in the Windows Security app are located at: **Computer Configuration\\Administrative Templates\\Windows Components\\Windows Security\\Device security** -## Disable the Clear TPM button +### Disable the Clear TPM button If you don't want users to be able to click the **Clear TPM** button in the Windows Security app, you can disable it with this Group Policy setting. Select **Enabled** to make the **Clear TPM** button unavailable for use. -## Hide the TPM Firmware Update recommendation +### Hide the TPM Firmware Update recommendation If you don't want users to see the recommendation to update TPM firmware, you can disable it with this setting. Select **Enabled** to prevent users from seeing a recommendation to update their TPM firmware when a vulnerable firmware is detected. ## Related topics - [Trusted Platform Module](trusted-platform-module-top-node.md) - [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/trustedplatformmodule/?view=win10-ps) -- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations) \ No newline at end of file +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations) diff --git a/windows/security/information-protection/tpm/trusted-platform-module-top-node.md b/windows/security/information-protection/tpm/trusted-platform-module-top-node.md index 91a5e57e1f..45c32cd7da 100644 --- a/windows/security/information-protection/tpm/trusted-platform-module-top-node.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-top-node.md @@ -6,13 +6,14 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: andreabichsel -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 09/11/2018 +ms.reviewer: --- # Trusted Platform Module diff --git a/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md b/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md index a30bed2776..60283edd89 100644 --- a/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md @@ -1,6 +1,6 @@ --- title: Unenlightened and enlightened app behavior while using Windows Information Protection (WIP) (Windows 10) -description: How unenlightened and enlightened apps might behave, based on Windows Information Protection (WIP) networking policies, app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames. +description: Learn how unenlightened and enlightened apps might behave, based on Windows Information Protection (WIP) network policies, app configuration, and other criteria keywords: WIP, Enterprise Data Protection, EDP, Windows Information Protection, unenlightened apps, enlightened apps ms.prod: w10 ms.mktglfcycl: explore @@ -8,13 +8,14 @@ ms.pagetype: security ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/26/2019 +ms.reviewer: --- # Unenlightened and enlightened app behavior while using Windows Information Protection (WIP) diff --git a/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md b/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md index 137f60c277..78edc9a59e 100644 --- a/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md +++ b/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md @@ -1,18 +1,19 @@ --- title: How to collect Windows Information Protection (WIP) audit event logs (Windows 10) -description: How to collect and understand your Windows Information Protection audit event logs by using the Reporting configuration service provider (CSP) or the Windows Event Forwarding (for Windows desktop domain-joined devices only). +description: How to collect & understand Windows Information Protection audit event logs via the Reporting configuration service provider (CSP) or Windows Event Forwarding. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/26/2019 +ms.reviewer: --- # How to collect Windows Information Protection (WIP) audit event logs @@ -159,20 +160,45 @@ Use Windows Event Forwarding to collect and aggregate your WIP audit events. You >Windows 10 Mobile requires you to use the [Reporting CSP process](#collect-wip-audit-logs-by-using-the-reporting-configuration-service-provider-csp) instead. **To view the WIP events in the Event Viewer** -1. Open Event Viewer. - -2. In the console tree under **Application and Services Logs\Microsoft\Windows**, click **EDP-Audit-Regular** and **EDP-Audit-TCB**. - +1. Open Event Viewer. +2. In the console tree under **Application and Services Logs\Microsoft\Windows**, click **EDP-Audit-Regular** and **EDP-Audit-TCB**. +## Collect WIP audit logs using Azure Monitor +You can collect audit logs using Azure Monitor. See [Windows event log data sources in Azure Monitor.](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs) +**To view the WIP events in Azure Monitor** +1. Use an existing or create a new Log Analytics workspace. +2. In **Log Analytics** > **Advanced Settings**, select **Data**. In Windows Event Logs, add logs to receive: + ``` + Microsoft-Windows-EDP-Application-Learning/Admin + Microsoft-Windows-EDP-Audit-TCB/Admin + ``` + >[!NOTE] + >If using Windows Events Logs, the event log names can be found under Properties of the event in the Events folder (Application and Services Logs\Microsoft\Windows, click EDP-Audit-Regular and EDP-Audit-TCB). +3. Download Microsoft [Monitoring Agent](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#install-the-agent-using-dsc-in-azure-automation). +4. To get MSI for Intune installation as stated in the Azure Monitor article, extract: MMASetup-.exe /c /t: +Install Microsoft Monitoring Agent to WIP devices using Workspace ID and Primary key. More information on Workspace ID and Primary key can be found in **Log Analytics** > **Advanced Settings**. +5. To deploy MSI via Intune, in installation parameters add: /q /norestart NOAPM=1 ADD_OPINSIGHTS_WORKSPACE=1 OPINSIGHTS_WORKSPACE_AZURE_CLOUD_TYPE=0 OPINSIGHTS_WORKSPACE_ID= OPINSIGHTS_WORKSPACE_KEY= AcceptEndUserLicenseAgreement=1 +>[!NOTE] +>Replace & received from step 5. In installation parameters, don't place & in quotes ("" or ''). +6. After the agent is deployed, data will be received within approximately 10 minutes. +7. To search for logs, go to **Log Analytics workspace** > **Logs**, and type **Event** in search. +***Example*** +``` +Event | where EventLog == "Microsoft-Windows-EDP-Audit-TCB/Admin" +``` +## Additional resources +- [How to deploy app via Intune](https://docs.microsoft.com/intune/apps-add) +- [How to create Log workspace](https://docs.microsoft.com/azure/azure-monitor/learn/quick-create-workspace) +- [How to use Microsoft Monitoring Agents for Windows](https://docs.microsoft.com/azure/azure-monitor/platform/agents-overview) diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index 4b46dd2dc1..a6029ffb2a 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -1,5 +1,5 @@ --- -title: Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate (Windows 10) +title: Make & verify an EFS Data Recovery Agent certificate (Windows 10) description: Follow these steps to create, verify, and perform a quick recovery by using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. keywords: Windows Information Protection, WIP, EDP, Enterprise Data Protection ms.prod: w10 @@ -7,13 +7,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 03/05/2019 +ms.reviewer: --- # Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate @@ -31,15 +32,15 @@ The recovery process included in this topic only works for desktop devices. WIP ## Manually create an EFS DRA certificate -1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate. +1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate. -2. Run this command: +2. Run this command: cipher /r:EFSRA Where *EFSRA* is the name of the .cer and .pfx files that you want to create. -3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file. +3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file. The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1. @@ -48,6 +49,9 @@ The recovery process included in this topic only works for desktop devices. WIP 4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as [Microsoft Intune](create-wip-policy-using-intune-azure.md) or [System Center Configuration Manager](create-wip-policy-using-sccm.md). +> [!NOTE] +> This certificate can be used in Intune for policies both _with_ device enrollment (MDM) and _without_ device enrollment (MAM). + ## Verify your data recovery certificate is correctly set up on a WIP client computer 1. Find or create a file that's encrypted using Windows Information Protection. For example, you could open an app on your allowed app list, and then create and save a file so it’s encrypted by WIP. @@ -60,15 +64,15 @@ The recovery process included in this topic only works for desktop devices. WIP Where *filename* is the name of the file you created in Step 1. -4. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list. +4. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list. ## Recover your data using the EFS DRA certificate in a test environment -1. Copy your WIP-encrypted file to a location where you have admin access. +1. Copy your WIP-encrypted file to a location where you have admin access. -2. Install the EFSDRA.pfx file, using its password. +2. Install the EFSDRA.pfx file, using its password. -3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command: +3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command: cipher /d encryptedfile.extension @@ -89,7 +93,7 @@ It's possible that you might revoke data from an unenrolled device only to later To start Robocopy in S mode, open Task Manager. Click **File** > **Run new task**, type the command, and click **Create this task with administrative privileges**. - ![Robocopy in S mode](images\robocopy-s-mode.png) + ![Robocopy in S mode](images/robocopy-s-mode.png) If the employee performed a clean installation and there is no user profile, you need to recover the keys from the System Volume folder in each drive. Type: @@ -126,15 +130,15 @@ The employee experience is based on sign in with an Azure AD work account. The e After signing in, the necessary WIP key info is automatically downloaded and employees are able to access the files again. **To test what the employee sees during the WIP key recovery process** -1. Attempt to open a work file on an unenrolled device. +1. Attempt to open a work file on an unenrolled device. The **Connect to Work to access work files** box appears. -2. Click **Connect**. +2. Click **Connect**. The **Access work or school settings** page appears. -3. Sign-in to Azure AD as the employee and verify that the files now open +3. Sign-in to Azure AD as the employee and verify that the files now open ## Related topics - [Security Watch Deploying EFS: Part 1](https://technet.microsoft.com/magazine/2007.02.securitywatch.aspx) @@ -149,4 +153,4 @@ After signing in, the necessary WIP key info is automatically downloaded and emp >[!Note] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to this article](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file +>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to this article](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md index b96fe95c7b..6c672171ac 100644 --- a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md @@ -1,19 +1,20 @@ --- title: Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune (Windows 10) -description: After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Intune to associate and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy. +description: After you've created and deployed your Windows Information Protection (WIP) policy, use Microsoft Intune to link it to your Virtual Private Network (VPN) policy keywords: WIP, Enterprise Data Protection ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/26/2019 +ms.reviewer: --- # Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune @@ -75,4 +76,4 @@ After you’ve created your VPN policy, you'll need to deploy it to the same gro ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed](images/wip-azure-add-user-groups.png) >[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file +>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index fc50cfc48c..b3f555bb13 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -1,34 +1,46 @@ --- title: Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune (Windows 10) -description: The Azure portal for Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, supporting mobile device management (MDM), to let you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +description: Learn how to use the Azure portal for Microsoft Intune to create and deploy your Windows Information Protection (WIP) policy to protect data on your network. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 03/25/2019 +ms.date: 05/13/2019 +ms.reviewer: --- -# Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune +# Create a Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune **Applies to:** - Windows 10, version 1607 and later - Windows 10 Mobile, version 1607 and later (except Microsoft Azure Rights Management, which is only available on the desktop) -Microsoft Intune has an easy way to create and deploy a Windows Information Protection (WIP) policy. You can choose which apps to protect, the level of protection, and how to find enterprise data on the network. The devices can be fully managed by Mobile Device Management (MDM), or managed by Mobile Application Management (MAM), where Intune only manages the apps on a user's personal device. +Microsoft Intune has an easy way to create and deploy a Windows Information Protection (WIP) policy. You can choose which apps to protect, the level of protection, and how to find enterprise data on the network. The devices can be fully managed by Mobile Device Management (MDM), or managed by Mobile Application Management (MAM), where Intune manages only the apps on a user's personal device. + +## Differences between MDM and MAM for WIP + +You can create an app protection policy in Intune either with device enrollment for MDM or without device enrollment for MAM. The process to create either policy is similar, but there are important differences: + +- MAM has additional **Access** settings for Windows Hello for Business. +- MAM can [selectively wipe company data](https://docs.microsoft.com/intune/apps-selective-wipe) from a user's personal device. +- MAM requires an [Azure Active Directory (Azure AD) Premium license](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). +- An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery depends on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. +- MAM supports only one user per device. +- MAM can only manage [enlightened apps](enlightened-microsoft-apps-and-wip.md). +- Only MDM can use [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) policies. +- If the same user and device are targeted for both MDM and MAM, the MDM policy will be applied to devices joined to Azure AD. For personal devices that are workplace-joined (that is, added by using **Settings** > **Email & accounts** > **Add a work or school account**), the MAM-only policy will be preferred but it's possible to upgrade the device management to MDM in **Settings**. Windows Home edition only supports WIP for MAM-only; upgrading to MDM policy on Home edition will revoke WIP-protected data access. ->[!NOTE] ->If the same user and device are targeted for both MDM and MAM, the MDM policy will be applied to devices joined to Azure AD. For personal devices that are workplace-joined (that is, added by using **Settings** > **Email & accounts** > **Add a work or school account**). the MAM-only policy will be preferred but it's possible to upgrade the device management to MDM in **Settings**. Windows Home edition only supports WIP for MAM-only; upgrading to MDM policy on Home edition will revoke WIP-protected data access. MAM supports only one user per device. ## Prerequisites -Before you can create a WIP policy using Intune, you need to configure an MDM or MAM provider in Azure Active Directory (Azure AD). MAM requires an [Azure Active Direcory (Azure AD) Premium license](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery depends on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. +Before you can create a WIP policy using Intune, you need to configure an MDM or MAM provider in Azure Active Directory (Azure AD). MAM requires an [Azure Active Directory (Azure AD) Premium license](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery relies on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM. ## Configure the MDM or MAM provider @@ -85,17 +97,17 @@ Select **Store apps**, type the app product name and publisher, and click **OK** - **Publisher**: `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` - **Product Name**: `Microsoft.MicrosoftPowerBIForWindows` -![Add Store app](images\add-a-protected-store-app.png) +![Add Store app](images/add-a-protected-store-app.png) -To add multiple Store apps, click the elipsis **…**. +To add multiple Store apps, click the ellipsis **…**. If you don't know the Store app publisher or product name, you can find them by following these steps. -1. Go to the [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Power BI Mobile App*. +1. Go to the [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Power BI Mobile App*. -2. Copy the ID value from the app URL. For example, the Power BI Mobile App ID URL is https://www.microsoft.com/store/p/microsoft-power-bi/9nblgggzlxn1, and you'd copy the ID value, `9nblgggzlxn1`. +2. Copy the ID value from the app URL. For example, the Power BI Mobile App ID URL is https://www.microsoft.com/store/p/microsoft-power-bi/9nblgggzlxn1, and you'd copy the ID value, `9nblgggzlxn1`. -3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblgggzlxn1/applockerdata, where `9nblgggzlxn1` is replaced with your ID value. +3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblgggzlxn1/applockerdata, where `9nblgggzlxn1` is replaced with your ID value. The API runs and opens a text editor with the app details. @@ -119,19 +131,19 @@ If you need to add Windows 10 mobile apps that aren't distributed through the St >**Note**
                                    Your PC and phone must be on the same wireless network. -1. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. +1. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. -2. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. +2. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. -3. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. +3. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. -4. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. +4. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. -6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. +6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. -7. Start the app for which you're looking for the publisher and product name values. +7. Start the app for which you're looking for the publisher and product name values. -8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. +8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. >[!Important] >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

                                    For example:
                                    @@ -148,7 +160,7 @@ To add **Desktop apps**, complete the following fields, based on what results yo All fields marked as “*” - All files signed by any publisher. (Not recommended) + All files signed by any publisher. (Not recommended and may not work) Publisher only @@ -176,7 +188,7 @@ To add **Desktop apps**, complete the following fields, based on what results yo -To add another Desktop app, click the elipsis **…**. After you’ve entered the info into the fields, click **OK**. +To add another Desktop app, click the ellipsis **…**. After you’ve entered the info into the fields, click **OK**. ![Microsoft Intune management console: Adding Desktop app info](images/wip-azure-add-desktop-apps.png) @@ -213,13 +225,13 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com #### Create a Packaged App rule for Store apps -1. Open the Local Security Policy snap-in (SecPol.msc). +1. Open the Local Security Policy snap-in (SecPol.msc). -2. In the left blade, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. +2. In the left blade, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. ![Local security snap-in, showing the Packaged app Rules](images/wip-applocker-secpol-1.png) -3. Right-click in the right-hand blade, and then click **Create New Rule**. +3. Right-click in the right-hand blade, and then click **Create New Rule**. The **Create Packaged app Rules** wizard appears. @@ -231,7 +243,7 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com ![Create Packaged app Rules wizard, showing the Before You Begin page](images/wip-applocker-secpol-wizard-2.png) -6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. +6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. ![Create Packaged app Rules wizard, showing the Publisher](images/wip-applocker-secpol-wizard-3.png) @@ -251,13 +263,13 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com ![Local security snap-in, showing the new rule](images/wip-applocker-secpol-create.png) -10. In the left blade, right-click on **AppLocker**, and then click **Export policy**. +10. In the left blade, right-click on **AppLocker**, and then click **Export policy**. The **Export policy** box opens, letting you export and save your new policy as XML. ![Local security snap-in, showing the Export Policy option](images/wip-applocker-secpol-export.png) -11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. +11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. The policy is saved and you’ll see a message that says 1 rule was exported from the policy. @@ -283,10 +295,12 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com ``` -12. After you’ve created your XML file, you need to import it by using Microsoft Intune. +12. After you’ve created your XML file, you need to import it by using Microsoft Intune. ## Create an Executable rule for unsigned apps +The executable rule helps to create an AppLocker rule to sign any unsigned apps. It enables adding the file path or the app publisher contained in the file's digital signature needed for the WIP policy to be applied. + 1. Open the Local Security Policy snap-in (SecPol.msc). 2. In the left pane, click **Application Control Policies** > **AppLocker** > **Executable Rules**. @@ -311,17 +325,17 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com 9. On the **Name** page, type a name and description for the rule and then click **Create**. -10. In the left pane, right-click **AppLocker** > **Export policy**. +10. In the left pane, right-click **AppLocker** > **Export policy**. -11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. +11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. The policy is saved and you’ll see a message that says 1 rule was exported from the policy. -12. After you’ve created your XML file, you need to import it by using Microsoft Intune. +12. After you’ve created your XML file, you need to import it by using Microsoft Intune. **To import a list of protected apps using Microsoft Intune** -1. In **Protected apps**, click **Import apps**. +1. In **Protected apps**, click **Import apps**. ![Import protected apps](images/import-protected-apps.png) @@ -329,22 +343,22 @@ For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com ![Microsoft Intune, Importing your AppLocker policy file using Intune](images/wip-azure-import-apps.png) -2. Browse to your exported AppLocker policy file, and then click **Open**. +2. Browse to your exported AppLocker policy file, and then click **Open**. The file imports and the apps are added to your **Protected apps** list. ### Exempt apps from a WIP policy If your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. -1. In **Client apps - App protection policies**, click **Exempt apps**. +1. In **Client apps - App protection policies**, click **Exempt apps**. ![Exempt apps](images/exempt-apps.png) -2. In **Exempt apps**, click **Add apps**. +2. In **Exempt apps**, click **Add apps**. Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. -3. Fill out the rest of the app info, based on the type of app you’re adding: +3. Fill out the rest of the app info, based on the type of app you’re adding: - [Add Recommended apps](#add-recommended-apps) @@ -361,7 +375,7 @@ After you've added the apps you want to protect with WIP, you'll need to apply a We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, **Block**. -1. From the **App protection policy** blade, click the name of your policy, and then click **Required settings**. +1. From the **App protection policy** blade, click the name of your policy, and then click **Required settings**. ![Microsoft Intune, Required settings blade showing Windows Information Protection mode](images/wip-azure-required-settings-protection-mode.png) @@ -372,7 +386,7 @@ We recommend that you start with **Silent** or **Allow Overrides** while verifyi |Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.| |Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

                                    After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| -2. Click **Save**. +2. Click **Save**. ## Define your enterprise-managed corporate identity Corporate identity, usually expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies. @@ -392,7 +406,7 @@ Starting with Windows 10, version 1703, Intune automatically determines your cor ![Add protected domains](images/add-protected-domains.png) ## Choose where apps can access enterprise data -After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. Every WIP policy should include policy that defines your enterprise network locations. +After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. Every WIP policy should include your enterprise network locations. There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). @@ -542,7 +556,7 @@ After you create and deploy your WIP policy to your employees, Windows begins to >Using a DRA certificate isn’t mandatory. However, we strongly recommend it. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](https://docs.microsoft.com/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate) topic. **To upload your DRA certificate** -1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears. +1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears. The **Advanced settings** blade appears. @@ -551,56 +565,50 @@ After you create and deploy your WIP policy to your employees, Windows begins to ![Microsoft Intune, Upload your Data Recovery Agent (DRA) certificate](images/wip-azure-advanced-settings-efsdra.png) ## Choose your optional WIP-related settings -After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings. +After you've decided where your protected apps can access enterprise data on your network, you can choose optional settings. -**To set your optional settings** - -1. Choose to set any or all optional settings: - - ![Microsoft Intune, Choose if you want to include any of the optional settings](images/wip-azure-advanced-settings-optional.png) - - - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile.** Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: +![Advanced optional settings](images/wip-azure-advanced-settings-optional.png) + +**Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile.** Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: - - **On.** Turns on the feature and provides the additional protection. +- **On.** Turns on the feature and provides the additional protection. - - **Off, or not configured.** Doesn't enable this feature. +- **Off, or not configured.** Doesn't enable this feature. - - **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: +**Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: - - **On, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. +- **On, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. - - **Off.** Stop local encryption keys from being revoked from a device during unenrollment. For example if you’re migrating between Mobile Device Management (MDM) solutions. +- **Off.** Stop local encryption keys from being revoked from a device during unenrollment. For example if you’re migrating between Mobile Device Management (MDM) solutions. - - **Show the enterprise data protection icon.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are: +**Show the enterprise data protection icon.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are: - - **On.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but protected apps, the icon overlay also appears on the app tile and with Managed text on the app name in the **Start** menu. +- **On.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but protected apps, the icon overlay also appears on the app tile and with Managed text on the app name in the **Start** menu. - - **Off, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but protected apps. Not configured is the default option. +- **Off, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but protected apps. Not configured is the default option. - - **Use Azure RMS for WIP.** Determines whether to use Azure Rights Management encryption with Windows Information Protection. +**Use Azure RMS for WIP.** Determines whether WIP uses [Microsoft Azure Rights Management](https://products.office.com/business/microsoft-azure-rights-management) to apply EFS encryption to files that are copied from Windows 10 to USB or other removable drives so they can be securely shared amongst employees. In other words, WIP uses Azure Rights Management "machinery" to apply EFS encryption to files when they are copied to removable drives. You must already have Azure Rights Management set up. The EFS file encryption key is protected by the RMS template’s license. Only users with permission to that template will be able to read it from the removable drive. WIP can also integrate with Azure RMS by using the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings in the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp). - - **On.** Starts using Azure Rights Management encryption with WIP. By turning this option on, you can also add a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. For more info about setting up Azure Rights management and using a template ID with WIP, see the [Choose to set up Azure Rights Management with WIP](#choose-to-set-up-azure-rights-management-with-wip) section of this topic. +- **On.** Protects files that are copied to a removable drive. You can enter a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. The RMS template is only applied to the files on removable media, and is only used for access control—it doesn’t actually apply Azure Information Protection to the files. Curly braces {} are required around the RMS Template ID, but they are removed after you save the policy. - - **Off, or not configured.** Stops using Azure Rights Management encryption with WIP. - - - **Allow Windows Search Indexer to search encrypted files.** Determines whether to allow the Windows Search Indexer to index items that are encrypted, such as WIP protected files. - - - **On.** Starts Windows Search Indexer to index encrypted files. - - - **Off, or not configured.** Stops Windows Search Indexer from indexing encrypted files. - -## Choose to set up Azure Rights Management with WIP -WIP can integrate with Microsoft Azure Rights Management to enable secure sharing of files by using removable drives such as USB drives. For more info about Azure Rights Management, see [Microsoft Azure Rights Management](https://products.office.com/business/microsoft-azure-rights-management). To integrate Azure Rights Management with WIP, you must already have Azure Rights Management set up. - -To configure WIP to use Azure Rights Management, you must set the **AllowAzureRMSForEDP** MDM setting to **1** in Microsoft Intune. This setting tells WIP to encrypt files copied to removable drives with Azure Rights Management, so they can be shared amongst your employees on computers running at least Windows 10, version 1703. - -Optionally, if you don’t want everyone in your organization to be able to share your enterprise data, you can set the **RMSTemplateIDForEDP** MDM setting to the **TemplateID** of the Azure Rights Management template used to encrypt the data. You must make sure to mark the template with the **EditRightsData** option. This template will be applied to the protected data that is copied to a removable drive. - ->[!IMPORTANT] ->Curly braces -- {} -- are required around the RMS Template ID. + If you don’t specify an [RMS template](https://docs.microsoft.com/information-protection/deploy-use/configure-custom-templates), it’s a regular EFS file using a default RMS template that all users can access. + +- **Off, or not configured.** Stops WIP from encrypting Azure Rights Management files that are copied to a removable drive. >[!NOTE] ->For more info about setting the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp) topic. For more info about setting up and using a custom template, see [Configuring custom templates for the Azure Rights Management service](https://docs.microsoft.com/information-protection/deploy-use/configure-custom-templates) topic. +>Regardless of this setting, all files in OneDrive for Business will be encrypted, including moved Known Folders. + +**Allow Windows Search Indexer to search encrypted files.** Determines whether to allow the Windows Search Indexer to index items that are encrypted, such as WIP protected files. + +- **On.** Starts Windows Search Indexer to index encrypted files. + +- **Off, or not configured.** Stops Windows Search Indexer from indexing encrypted files. + +## Encrypted file extensions + +You can restrict which files are protected by WIP when they are downloaded from an SMB share within your enterprise network locations. If this setting is configured, only files with the extensions in the list will be encrypted. If this setting is not specified, the existing auto-encryption behavior is applied. + +![WIP encrypted file extensions](images/wip-encrypted-file-extensions.png) ## Related topics diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md index 2783e1edb2..288347b3aa 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md @@ -1,39 +1,43 @@ --- -title: Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager (Windows 10) -description: Configuration Manager (version 1606 or later) helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +title: Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager (Windows 10) +description: Use Configuration Manager to make & deploy a Windows Information Protection (WIP) policy. Choose protected apps, WIP-protection level, and find enterprise data. ms.assetid: 85b99c20-1319-4aa3-8635-c1a87b244529 -keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager +ms.reviewer: +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager, MEMCM, Microsoft Endpoint Configuration Manager ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/26/2019 +ms.date: 01/09/2020 --- -# Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager +# Create and deploy a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager **Applies to:** -- Windows 10, version 1607 and later -- Windows 10 Mobile, version 1607 and later -- System Center Configuration Manager +- Windows 10, version 1607 and later +- Windows 10 Mobile, version 1607 and later +- Microsoft Endpoint Configuration Manager -System Center Configuration Manager helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network. +Configuration Manager helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network. ## Add a WIP policy -After you’ve installed and set up System Center Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy. +After you’ve installed and set up Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy. + +>[!TIP] +> Review the [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) article before creating a new configuration item to avoid common issues. **To create a configuration item for WIP** -1. Open the System Center Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node. +1. Open the Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node. - ![System Center Configuration Manager, Configuration Items screen](images/wip-sccm-addpolicy.png) + ![Configuration Manager, Configuration Items screen](images/wip-sccm-addpolicy.png) 2. Click the **Create Configuration Item** button.

                                    The **Create Configuration Item Wizard** starts. @@ -42,7 +46,7 @@ The **Create Configuration Item Wizard** starts. 3. On the **General Information screen**, type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. -4. In the **Specify the type of configuration item you want to create** area, pick the option that represents whether you use System Center Configuration Manager for device management, and then click **Next**. +4. In the **Specify the type of configuration item you want to create** area, pick the option that represents whether you use Configuration Manager for device management, and then click **Next**. - **Settings for devices managed with the Configuration Manager client:** Windows 10 @@ -61,7 +65,7 @@ The **Create Configuration Item Wizard** starts. The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization. ## Add app rules to your policy -During the policy-creation process in System Center Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. +During the policy-creation process in Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file. @@ -73,107 +77,107 @@ For this example, we’re going to add Microsoft OneNote, a store app, to the ** **To add a store app** -1. From the **App rules** area, click **Add**. - +1. From the **App rules** area, click **Add**. + The **Add app rule** box appears. ![Create Configuration Item wizard, add a universal store app](images/wip-sccm-adduniversalapp.png) -2. Add a friendly name for your app into the **Title** box. In this example, it’s *Microsoft OneNote*. +2. Add a friendly name for your app into the **Title** box. In this example, it’s *Microsoft OneNote*. -3. Click **Allow** from the **Windows Information Protection mode** drop-down list. +3. Click **Allow** from the **Windows Information Protection mode** drop-down list. Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. -4. Pick **Store App** from the **Rule template** drop-down list. +4. Pick **Store App** from the **Rule template** drop-down list. The box changes to show the store app rule options. -5. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.Office.OneNote`. +5. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.Office.OneNote`. If you don't know the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps. **To find the Publisher and Product Name values for Store apps without installing them** -1. Go to the [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, Microsoft OneNote. +1. Go to the [Microsoft Store for Business](https://businessstore.microsoft.com/store) website, and find your app. For example, Microsoft OneNote. - >[!NOTE] + > [!NOTE] + > + > If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section. - >If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section. +2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. -2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. +3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata, where `9wzdncrfhvjl` is replaced with your ID value. -3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata, where `9wzdncrfhvjl` is replaced with your ID value. + The API runs and opens a text editor with the app details. - The API runs and opens a text editor with the app details. + ``` json + { + "packageIdentityName": "Microsoft.Office.OneNote", + "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" + } + ``` - ``` json - { - "packageIdentityName": "Microsoft.Office.OneNote", - "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" - } - ``` +4. Copy the `publisherCertificateName` value and paste them into the **Publisher Name** box, copy the `packageIdentityName` value into the **Product Name** box of Intune. -4. Copy the `publisherCertificateName` value and paste them into the **Publisher Name** box, copy the `packageIdentityName` value into the **Product Name** box of Intune. - - >[!IMPORTANT] - >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.

                                    For example:

                                    - ```json - { - "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", - } - ``` + > [!IMPORTANT] + > The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.

                                    For example:

                                    + > ```json + > { + > "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", + > } + > ``` **To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones** -1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. +1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. - >[!NOTE] - >Your PC and phone must be on the same wireless network. + >[!NOTE] + >Your PC and phone must be on the same wireless network. -2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. +2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. -3. On the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. +3. On the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. -4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. +4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. -5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. +5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. -6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. +6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. -7. Start the app for which you're looking for the publisher and product name values. +7. Start the app for which you're looking for the publisher and product name values. -8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. +8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. - >[!IMPORTANT] - >The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. - >For example:

                                    - ```json - { - "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", - } - ``` + > [!IMPORTANT] + > The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. + > For example:

                                    + > ```json + > { + > "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", + > } + > ``` ### Add a desktop app rule to your policy For this example, we’re going to add Internet Explorer, a desktop app, to the **App Rules** list. **To add a desktop app to your policy** -1. From the **App rules** area, click **Add**. - +1. From the **App rules** area, click **Add**. + The **Add app rule** box appears. ![Create Configuration Item wizard, add a classic desktop app](images/wip-sccm-adddesktopapp.png) -2. Add a friendly name for your app into the **Title** box. In this example, it’s *Internet Explorer*. +2. Add a friendly name for your app into the **Title** box. In this example, it’s *Internet Explorer*. -3. Click **Allow** from the **Windows Information Protection mode** drop-down list. +3. Click **Allow** from the **Windows Information Protection mode** drop-down list. Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. -4. Pick **Desktop App** from the **Rule template** drop-down list. +4. Pick **Desktop App** from the **Rule template** drop-down list. The box changes to show the desktop app rule options. -5. Pick the options you want to include for the app rule (see table), and then click **OK**. +5. Pick the options you want to include for the app rule (see table), and then click **OK**. @@ -230,13 +234,13 @@ Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the For this example, we’re going to add an AppLocker XML file to the **App Rules** list. You’ll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) content. **To create an app rule and xml file using the AppLocker tool** -1. Open the Local Security Policy snap-in (SecPol.msc). - -2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. +1. Open the Local Security Policy snap-in (SecPol.msc). + +2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. ![Local security snap-in, showing the Packaged app Rules](images/intune-local-security-snapin.png) -3. Right-click in the right-hand pane, and then click **Create New Rule**. +3. Right-click in the right-hand pane, and then click **Create New Rule**. The **Create Packaged app Rules** wizard appears. @@ -248,7 +252,7 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-permissions.png) -6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. +6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. ![Create Packaged app Rules wizard, showing the Publisher](images/intune-applocker-publisher.png) @@ -264,13 +268,13 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* ![Local security snap-in, showing the new rule](images/intune-local-security-snapin-updated.png) -10. In the left pane, right-click on **AppLocker**, and then click **Export policy**. +10. In the left pane, right-click on **AppLocker**, and then click **Export policy**. The **Export policy** box opens, letting you export and save your new policy as XML. ![Local security snap-in, showing the Export Policy option](images/intune-local-security-export.png) -11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. +11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. The policy is saved and you’ll see a message that says 1 rule was exported from the policy. @@ -292,24 +296,24 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* - + ``` -12. After you’ve created your XML file, you need to import it by using System Center Configuration Manager. +12. After you’ve created your XML file, you need to import it by using Configuration Manager. + +**To import your Applocker policy file app rule using Configuration Manager** +1. From the **App rules** area, click **Add**. -**To import your Applocker policy file app rule using System Center Configuration Manager** -1. From the **App rules** area, click **Add**. - The **Add app rule** box appears. ![Create Configuration Item wizard, add an AppLocker policy](images/wip-sccm-addapplockerfile.png) -2. Add a friendly name for your app into the **Title** box. In this example, it’s *Allowed app list*. +2. Add a friendly name for your app into the **Title** box. In this example, it’s *Allowed app list*. -3. Click **Allow** from the **Windows Information Protection mode** drop-down list. +3. Click **Allow** from the **Windows Information Protection mode** drop-down list. Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section. -4. Pick the **AppLocker policy file** from the **Rule template** drop-down list. +4. Pick the **AppLocker policy file** from the **Rule template** drop-down list. The box changes to let you import your AppLocker XML policy file. @@ -322,17 +326,17 @@ If you're running into compatibility issues where your app is incompatible with **To exempt a store app, a desktop app, or an AppLocker policy file app rule** -1. From the **App rules** area, click **Add**. - +1. From the **App rules** area, click **Add**. + The **Add app rule** box appears. -2. Add a friendly name for your app into the **Title** box. In this example, it’s *Exempt apps list*. +2. Add a friendly name for your app into the **Title** box. In this example, it’s *Exempt apps list*. -3. Click **Exempt** from the **Windows Information Protection mode** drop-down list. +3. Click **Exempt** from the **Windows Information Protection mode** drop-down list. Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. -4. Fill out the rest of the app rule info, based on the type of rule you’re adding: +4. Fill out the rest of the app rule info, based on the type of rule you’re adding: - **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic. @@ -340,7 +344,7 @@ If you're running into compatibility issues where your app is incompatible with - **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this topic, using a list of exempted apps. -5. Click **OK**. +5. Click **OK**. ## Manage the WIP-protection level for your enterprise data After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode. @@ -385,74 +389,72 @@ There are no default locations included with WIP, you must add each of your netw The **Add or edit corporate network definition** box appears. -2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. +2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. - ![Add or edit corporate network definition box, Add your enterprise network locations](images/wip-sccm-add-network-domain.png) - -
                                    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                    Network location typeFormatDescription
                                    Enterprise Cloud ResourcesWith proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
                                    contoso.visualstudio.com,contoso.internalproxy2.com

                                    Without proxy: contoso.sharepoint.com|contoso.visualstudio.com

                                    		Specify the cloud resources to be treated as corporate and protected by WIP.

                                    For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.

                                    If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

                                    Important
                                    In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

                                    Enterprise Network Domain Names (Required)corp.contoso.com,region.contoso.comSpecify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

                                    This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

                                    If you have multiple resources, you must separate them using the "," delimiter.

                                    Proxy serversproxy.contoso.com:80;proxy2.contoso.com:443Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

                                    This list shouldn’t include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.

                                    If you have multiple resources, you must separate them using the ";" delimiter.
                                    Internal proxy serverscontoso.internalproxy1.com;contoso.internalproxy2.comSpecify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

                                    This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.

                                    If you have multiple resources, you must separate them using the ";" delimiter.
                                    Enterprise IPv4 Range (Required)**Starting IPv4 Address:** 3.4.0.1
                                    **Ending IPv4 Address:** 3.4.255.254
                                    **Custom URI:** 3.4.0.1-3.4.255.254,
                                    10.0.0.1-10.255.255.254                                    		Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

                                    If you have multiple ranges, you must separate them using the "," delimiter.

                                    Enterprise IPv6 Range**Starting IPv6 Address:** 2a01:110::
                                    **Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
                                    **Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
                                    fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff                                    		Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

                                    If you have multiple ranges, you must separate them using the "," delimiter.

                                    Neutral Resourcessts.contoso.com,sts.contoso2.comSpecify your authentication redirection endpoints for your company.

                                    These locations are considered enterprise or personal, based on the context of the connection before the redirection.

                                    If you have multiple resources, you must separate them using the "," delimiter.

                                    + ![Add or edit corporate network definition box, Add your enterprise network locations](images/wip-sccm-add-network-domain.png) -3. Add as many locations as you need, and then click **OK**. + + + + + + + + + + + + + + + + + + + + + + + + +
                                    + + + + + + + + + + + + + + +
                                    Network location typeFormatDescription
                                    Enterprise Cloud ResourcesWith proxy: contoso.sharepoint.com,contoso.internalproxy1.com|
                                    contoso.visualstudio.com,contoso.internalproxy2.com

                                    Without proxy: contoso.sharepoint.com|contoso.visualstudio.com

                                    		Specify the cloud resources to be treated as corporate and protected by WIP.

                                    For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.

                                    If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.

                                    Important
                                    In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.

                                    Enterprise Network Domain Names (Required)corp.contoso.com,region.contoso.comSpecify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

                                    This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

                                    If you have multiple resources, you must separate them using the "," delimiter.

                                    Proxy serversproxy.contoso.com:80;proxy2.contoso.com:443Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

                                    This list shouldn’t include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.

                                    If you have multiple resources, you must separate them using the ";" delimiter.
                                    Internal proxy serverscontoso.internalproxy1.com;contoso.internalproxy2.comSpecify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

                                    This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.

                                    If you have multiple resources, you must separate them using the ";" delimiter.
                                    Enterprise IPv4 Range (Required)Starting IPv4 Address: 3.4.0.1
                                    Ending IPv4 Address: 3.4.255.254
                                    Custom URI: 3.4.0.1-3.4.255.254,
                                    10.0.0.1-10.255.255.254                                    		Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

                                    If you have multiple ranges, you must separate them using the "," delimiter.

                                    Enterprise IPv6 RangeStarting IPv6 Address: 2a01:110::
                                    Ending IPv6 Address: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
                                    Custom URI: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
                                    fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff                                    		Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

                                    If you have multiple ranges, you must separate them using the "," delimiter.

                                    Neutral Resourcessts.contoso.com,sts.contoso2.comSpecify your authentication redirection endpoints for your company.

                                    These locations are considered enterprise or personal, based on the context of the connection before the redirection.

                                    If you have multiple resources, you must separate them using the "," delimiter.

                                    - The **Add or edit corporate network definition** box closes. +3. Add as many locations as you need, and then click **OK**. -4. Decide if you want to Windows to look for additional network settings and if you want to show the WIP icon on your corporate files while in File Explorer. + The **Add or edit corporate network definition** box closes. - ![Create Configuration Item wizard, Add whether to search for additional network settings](images/wip-sccm-optsettings.png) +4. Decide if you want to Windows to look for additional network settings and if you want to show the WIP icon on your corporate files while in File Explorer. - - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. Not configured is the default option. + ![Create Configuration Item wizard, Add whether to search for additional network settings](images/wip-sccm-optsettings.png) - - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. Not configured is the default option. + - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. Not configured is the default option. - - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. Not configured is the default option. + - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. Not configured is the default option. -5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - - ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/wip-sccm-dra.png) + - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. Not configured is the default option. - After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. - - For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md). +5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. + + ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/wip-sccm-dra.png) + + After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. + + For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md). ## Choose your optional WIP-related settings After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings. @@ -460,35 +462,28 @@ After you've decided where your protected apps can access enterprise data on you ![Create Configuration Item wizard, Choose any additional, optional settings](images/wip-sccm-additionalsettings.png) **To set your optional settings** -1. Choose to set any or all of the optional settings: - - - **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box.** Determines whether users can see the Personal option for files within File Explorer and the **Save As** dialog box. The options are: - - - **Yes, or not configured (recommended).** Employees can choose whether a file is **Work** or **Personal** in File Explorer and the **Save As** dialog box. - - - **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult. - - >[!IMPORTANT] - >The **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box** option is only available for Configuration Manager versions 1610 and below. +1. Choose to set any or all of the optional settings: - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are: - + - **Yes (recommended).** Turns on the feature and provides the additional protection. - + - **No, or not configured.** Doesn't enable this feature. - **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are: - - **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps. + - **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps. - - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. + - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. - - **Revoke local encryption keys during the unerollment process.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: + - **Revoke local encryption keys during the unenrollment process.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: - **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. - + - **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions. + - **Allow Azure RMS.** Enables secure sharing of files by using removable media such as USB drives. For more information about how RMS works with WIP, see [Create a WIP policy using Intune](create-wip-policy-using-intune-azure.md). To confirm what templates your tenant has, run [Get-AadrmTemplate](https://docs.microsoft.com/powershell/module/aadrm/get-aadrmtemplate) from the [AADRM PowerShell module](https://docs.microsoft.com/azure/information-protection/administer-powershell). If you don’t specify a template, WIP uses a key from a default RMS template that everyone in the tenant will have access to. + 2. After you pick all of the settings you want to include, click **Summary**. ## Review your configuration choices in the Summary screen @@ -498,24 +493,21 @@ After you've finished configuring your policy, you can review all of your info o - Click the **Summary** button to review your policy choices, and then click **Next** to finish and to save your policy. ![Create Configuration Item wizard, Summary screen for all of your policy choices](images/wip-sccm-summaryscreen.png) - + A progress bar appears, showing you progress for your policy. After it's done, click **Close** to return to the **Configuration Items** page. ## Deploy the WIP policy After you’ve created your WIP policy, you'll need to deploy it to your organization's devices. For info about your deployment options, see these topics: - [Operations and Maintenance for Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708224) -- [How to Create Configuration Baselines for Compliance Settings in Configuration Manager]( https://go.microsoft.com/fwlink/p/?LinkId=708225) +- [How to Create Configuration Baselines for Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708225) -- [How to Deploy Configuration Baselines in Configuration Manager]( https://go.microsoft.com/fwlink/p/?LinkId=708226) +- [How to Deploy Configuration Baselines in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708226) ## Related topics -- [System Center Configuration Manager and Endpoint Protection (Version 1606)](https://go.microsoft.com/fwlink/p/?LinkId=717372) - -- [TechNet documentation for Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=691623) - -- [Manage mobile devices with Configuration Manager and Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=691624) - [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md) -- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) \ No newline at end of file +- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) + +- [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) diff --git a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md index 84fcae9939..42caa212cd 100644 --- a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md @@ -7,13 +7,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 03/05/2019 +ms.reviewer: --- # Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune diff --git a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md index 3de2479c2a..37be2ff41c 100644 --- a/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md +++ b/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md @@ -1,20 +1,21 @@ --- title: List of enlightened Microsoft apps for use with Windows Information Protection (WIP) (Windows 10) -description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. +description: Learn the difference between enlightened and unenlightened apps. Find out which enlightened apps are provided by Microsoft. Learn how to allow-list them. ms.assetid: 17c85ea3-9b66-4b80-b511-8f277cb4345f +ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/26/2019 +ms.date: 05/02/2019 --- # List of enlightened Microsoft apps for use with Windows Information Protection (WIP) @@ -42,6 +43,8 @@ Apps can be enlightened or unenlightened: ## List of enlightened Microsoft apps Microsoft has made a concerted effort to enlighten several of our more popular apps, including the following: +- Microsoft 3D Viewer + - Microsoft Edge - Internet Explorer 11 @@ -70,36 +73,44 @@ Microsoft has made a concerted effort to enlighten several of our more popular a - Microsoft Remote Desktop +>[!NOTE] +>Microsoft Visio and Microsoft Project are not enlightended apps and need to be exempted from WIP policy. If they are allowed, there is a risk of data loss. For example, if a device is workplace-joined and managed and the user leaves the company, metadata files that the apps rely on remain encrypted and the apps stop functioining. + ## List of WIP-work only apps from Microsoft Microsoft still has apps that are unenlightened, but which have been tested and deemed safe for use in an enterprise with WIP and MAM solutions. - Skype for Business ## Adding enlightened Microsoft apps to the allowed apps list + +> [!NOTE] +> As of January 2019 it is no longer necessary to add Intune Company Portal as an exempt app since it is now included in the default list of protected apps. + You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and System Center Configuration Manager. -|Product name |App info | -|-------------|---------| -|Microsoft Edge |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.MicrosoftEdge
                                    **App Type:** Universal app | -|Microsoft People |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.People
                                    **App Type:** Universal app | -|Word Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Office.Word
                                    **App Type:** Universal app | -|Excel Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Office.Excel
                                    **App Type:** Universal app | -|PowerPoint Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Office.PowerPoint
                                    **App Type:** Universal app | -|OneNote |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Office.OneNote
                                    **App Type:** Universal app | -|Outlook Mail and Calendar |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** microsoft.windowscommunicationsapps
                                    **App Type:** Universal app | -|Office 365 ProPlus and Office 2019 Professional Plus |Office 365 ProPlus and Office 2019 Professional Plus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](https://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP.
                                    We don't recommend setting up Office by using individual paths or publisher rules.| -|Microsoft Photos |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Windows.Photos
                                    **App Type:** Universal app | -|Groove Music |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.ZuneMusic
                                    **App Type:** Universal app | -|Microsoft Movies & TV |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.ZuneVideo
                                    **App Type:** Universal app | -|Microsoft Messaging |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Messaging
                                    **App Type:** Universal app | -|IE11 |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Binary Name:** iexplore.exe
                                    **App Type:** Desktop app | -|OneDrive Sync Client|**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Binary Name:** onedrive.exe
                                    **App Type:** Desktop app| -|OneDrive app|**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Microsoftskydrive
                                    **Product Version:**Product version: 17.21.0.0 (and later)
                                    **App Type:** Universal app | -|Notepad |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Binary Name:** notepad.exe
                                    **App Type:** Desktop app | -|Microsoft Paint |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Binary Name:** mspaint.exe
                                    **App Type:** Desktop app | -|Microsoft Remote Desktop |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Binary Name:** mstsc.exe
                                    **App Type:** Desktop app | -|Microsoft MAPI Repair Tool |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Binary Name:** fixmapi.exe
                                    **App Type:** Desktop app | +| Product name | App info | +|------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Microsoft 3D Viewer | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Microsoft3DViewer
                                    **App Type:** Universal app | +| Microsoft Edge | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.MicrosoftEdge
                                    **App Type:** Universal app | +| Microsoft People | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.People
                                    **App Type:** Universal app | +| Word Mobile | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Office.Word
                                    **App Type:** Universal app | +| Excel Mobile | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Office.Excel
                                    **App Type:** Universal app | +| PowerPoint Mobile | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Office.PowerPoint
                                    **App Type:** Universal app | +| OneNote | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Office.OneNote
                                    **App Type:** Universal app | +| Outlook Mail and Calendar | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** microsoft.windowscommunicationsapps
                                    **App Type:** Universal app | +| Office 365 ProPlus and Office 2019 Professional Plus | Office 365 ProPlus and Office 2019 Professional Plus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](https://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP.
                                    We don't recommend setting up Office by using individual paths or publisher rules. | +| Microsoft Photos | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Windows.Photos
                                    **App Type:** Universal app | +| Groove Music | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.ZuneMusic
                                    **App Type:** Universal app | +| Microsoft Movies & TV | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.ZuneVideo
                                    **App Type:** Universal app | +| Microsoft Messaging | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Messaging
                                    **App Type:** Universal app | +| IE11 | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Binary Name:** iexplore.exe
                                    **App Type:** Desktop app | +| OneDrive Sync Client | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Binary Name:** onedrive.exe
                                    **App Type:** Desktop app | +| OneDrive app | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Product Name:** Microsoft.Microsoftskydrive
                                    Product Version:Product version: 17.21.0.0 (and later)
                                    **App Type:** Universal app | +| Notepad | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Binary Name:** notepad.exe
                                    **App Type:** Desktop app | +| Microsoft Paint | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Binary Name:** mspaint.exe
                                    **App Type:** Desktop app | +| Microsoft Remote Desktop | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Binary Name:** mstsc.exe
                                    **App Type:** Desktop app | +| Microsoft MAPI Repair Tool | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
                                    **Binary Name:** fixmapi.exe
                                    **App Type:** Desktop app | >[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file +>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md b/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md index 437815bd4a..576fe7cf71 100644 --- a/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md +++ b/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md @@ -1,15 +1,16 @@ --- title: General guidance and best practices for Windows Information Protection (WIP) (Windows 10) -description: This section includes info about the enlightened Microsoft apps, including how to add them to your Protected Apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with Windows Information Protection (WIP). +description: Find resources about apps that can work with Windows Information Protection (WIP) to protect data. Enlightened apps can tell corporate and personal data apart. ms.assetid: aa94e733-53be-49a7-938d-1660deaf52b0 +ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md index bcad37a020..116ddd8e14 100644 --- a/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md +++ b/windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md @@ -7,21 +7,27 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 02/26/2019 +ms.date: 04/30/2019 +ms.reviewer: --- # How Windows Information Protection (WIP) protects a file that has a sensitivity label **Applies to:** +- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +- Windows 10, version 1903 - Windows 10, version 1809 +>[!IMPORTANT] +>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + This topic explains how Windows Information Protection works with other Microsoft information protection technologies to protect files that have a sensitivity label. Microsoft information protection technologies work together as an integrated solution to help enterprises: @@ -34,58 +40,77 @@ Microsoft information protection technologies include: - [Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) is built in to Windows 10 and protects local data at rest on endpoint devices, and manages apps to protect local data in use. Data that leaves the endpoint device, such as email attachment, is not protected by WIP. -- [Office 365 Information Protection](https://docs.microsoft.com/office365/securitycompliance/office-365-info-protection-for-gdpr-overview) is a solution to classify, protect, and monitor personal data in Office 365. - - [Azure Information Protection](https://docs.microsoft.com/azure/information-protection/what-is-information-protection) is a cloud-based solution that can be purchased either standalone or as part of Microsoft 365 Enterprise. It helps an organization classify and protect its documents and emails by applying labels. Azure Information Protection is applied directly to content, and roams with the content as it's moved between locations and cloud services. - [Microsoft Cloud App Security](https://docs.microsoft.com/cloud-app-security/what-is-cloud-app-security) is a cloud access security broker (CASB) solution that allows you to discover, classify, protect, and monitor user data in first-party and third-party Software-as-a-Service (SaaS) apps used by your organization. -End users can choose and apply sensitivity labels from a bar that appears below the ribbon in Office apps: +## How WIP protects sensitivity labels with endpoint data loss prevention + +You can create and manage [sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) in the Microsoft 365 compliance center. +When you [create a sensitivity label](https://docs.microsoft.com/microsoft-365/compliance/create-sensitivity-labels), you can specify that endpoint data loss prevention applies to content with that label. + +![Endpoint data loss prevention](images/sensitivity-label-endpoint-dlp.png) + +Office app users can choose a sensitivity label from a menu and apply it to a file. ![Sensitivity labels](images/sensitivity-labels.png) -## Default WIP behaviors for a sensitivity label +WIP enforces default endpoint protection as follows: -Enterprises can create and manage sensitivity labels on the **Labels** page in the Office 365 Security & Compliance Center. -When you create a sensitivity label, you can specify that endpoint protection should apply to content with that label. -WIP enforces default endpoint protection depending on how the sensitivity label is configured: +- If endpoint data loss prevention is enabled, the device enforces work protection for any file with the label +- If endpoint data loss prevention is not enabled: + - The device enforces work protection to a file downloaded from a work site + - The device does not enforce work protection to a file downloaded from a personal site -- When the sensitivity label is configured for endpoint protection of content that includes business data, the device enforces work protection for documents with the label -- When the sensitivity label is *not configured* for endpoint protection, the device reverts to whatever WIP policy has been defined in Intune or System Center Configuration Manager (SCCM): - - If the document is downloaded from a work site, the device enforces work protection - - If the document is downloaded from a personal site, no work protection is applied - -For more information about labels, see [Overview of labels](https://docs.microsoft.com/office365/securitycompliance/labels). - -## Use cases - -This section covers how WIP works with sensitivity labels in specific use cases. - -### User downloads from or creates a document on a work site - -If WIP policy is deployed, any document that is downloaded from a work site, or created on a work site, will have WIP protection regardless of whether the document has a sensitivity label. - -If the document also has a sensitivity label, which can be Office or PDF files, WIP protection is applied according to the label. - -### User downloads a confidential Office or PDF document from a personal site - -Windows Defender Advanced Threat Protection (Windows Defender ATP) scans for any file that gets modified or created, including files that were created on a personal site. -If the file has a sensitivity label, the corresponding WIP protection gets applied even though the file came from a personal site. -For example: +Here's an example where a file remains protected without any work context beyond the sensitivity label: 1. Sara creates a PDF file on a Mac and labels it as **Confidential**. -2. She emails the PDF from her Gmail account to Laura. -3. Laura opens the PDF file on her Windows 10 device. -4. WIP policy gets applied and the file is protected. +1. She emails the PDF from her Gmail account to Laura. +1. Laura opens the PDF file on her Windows 10 device. +1. Windows Defender Advanced Threat Protection (Windows Defender ATP) scans Windows 10 for any file that gets modified or created, including files that were created on a personal site. +1. Windows Defender ATP triggers WIP policy. +1. WIP policy protects the file even though it came from a personal site. -The PDF file doesn't need any work context beyond the sensitivity label. +## How WIP protects automatically classified files + +The next sections cover how Windows Defender ATP extends discovery and protection of sensitive information with improvements in Windows 10 version 1903. + +### Discovery + +Windows Defender ATP can extract the content of the file itself and evaluate whether it contains sensitive information types such as credit card numbers or employee ID numbers. +When you create a sensitivity label, you can specify that the label be added to any file that contains a sensitive information type. + +![Sensitivity labels](images/sensitivity-label-auto-label.png) + +A default set of [sensitive information types](https://docs.microsoft.com/office365/securitycompliance/what-the-sensitive-information-types-look-for) in Microsoft 365 compliance center includes credit card numbers, phone numbers, driver’s license numbers, and so on. +You can also [create a custom sensitive information type](https://docs.microsoft.com/office365/securitycompliance/create-a-custom-sensitive-information-type), which can include any keyword or expression that you want to evaluate. + +### Protection + +When a file is created or edited on a Windows 10 endpoint, Windows Defender ATP extracts the content and evaluates if it contains any default or custom sensitive information types that have been defined. +If the file has a match, Windows Defender ATP applies endpoint data loss prevention even if the file had no label previously. + +Windows Defender ATP is integrated with Azure Information Protection for data discovery and reports sensitive information types that were discovered. +Azure Information Protection aggregates the files with sensitivity labels and the sensitive information types they contain across the enterprise. + +![Image of Azure Information Protection - Data discovery](images/azure-data-discovery.png) + +You can see sensitive information types in Microsoft 365 compliance under **Classifications**. Default sensitive information types have Microsoft as the publisher. The publisher for custom types is the tenant name. + +![Sensitive information types](images/sensitive-info-types.png) + +>[!NOTE] +>Automatic classification does not change the file itself, but it applies protection based on the label. +>WIP protects a file that contains a sensitive information type as a work file. +>Azure Information Protection works differently in that it extends a file with a new attribute so the protection persists if the file is copied. ## Prerequisites -- Windows 10, version 1809 -- [Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection) scans content for a label and applies corresponding WIP protection -- [Sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) need to be configured in the Office 365 Security & Compliance Center -- WIP policy needs to be applied to endpoint devices by using [Intune](create-wip-policy-using-intune-azure.md) or [System Center Configuration Manager (SCCM)](overview-create-wip-policy-sccm.md). +- Endpoint data loss prevention requires Windows 10, version 1809 +- Auto labelling requires Windows 10, version 1903 +- Devices need to be onboarded to [Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection), which scans content for a label and applies WIP policy +- [Sensitivity labels](https://docs.microsoft.com/office365/securitycompliance/labels) need to be configured in Microsoft 365 compliance center +- WIP policy needs to be applied to endpoint devices by using [Intune](create-wip-policy-using-intune-azure.md) or [System Center Configuration Manager (SCCM)](overview-create-wip-policy-sccm.md) diff --git a/windows/security/threat-protection/windows-defender-atp/images/azure-data-discovery.png b/windows/security/information-protection/windows-information-protection/images/azure-data-discovery.png similarity index 100% rename from windows/security/threat-protection/windows-defender-atp/images/azure-data-discovery.png rename to windows/security/information-protection/windows-information-protection/images/azure-data-discovery.png diff --git a/windows/security/information-protection/windows-information-protection/images/sensitive-info-types.png b/windows/security/information-protection/windows-information-protection/images/sensitive-info-types.png new file mode 100644 index 0000000000..58f675399a Binary files /dev/null and b/windows/security/information-protection/windows-information-protection/images/sensitive-info-types.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/sensitivity-label-auto-label.png b/windows/security/information-protection/windows-information-protection/images/sensitivity-label-auto-label.png new file mode 100644 index 0000000000..dd6450af37 Binary files /dev/null and b/windows/security/information-protection/windows-information-protection/images/sensitivity-label-auto-label.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/sensitivity-label-endpoint-dlp.png b/windows/security/information-protection/windows-information-protection/images/sensitivity-label-endpoint-dlp.png new file mode 100644 index 0000000000..3dbbb4e09b Binary files /dev/null and b/windows/security/information-protection/windows-information-protection/images/sensitivity-label-endpoint-dlp.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-azure-advanced-settings-optional.png b/windows/security/information-protection/windows-information-protection/images/wip-azure-advanced-settings-optional.png index cd8e0d0388..785925efdf 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-azure-advanced-settings-optional.png and b/windows/security/information-protection/windows-information-protection/images/wip-azure-advanced-settings-optional.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-encrypted-file-extensions.png b/windows/security/information-protection/windows-information-protection/images/wip-encrypted-file-extensions.png new file mode 100644 index 0000000000..8ec000d2a7 Binary files /dev/null and b/windows/security/information-protection/windows-information-protection/images/wip-encrypted-file-extensions.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-adddesktopapp.png b/windows/security/information-protection/windows-information-protection/images/wip-sccm-adddesktopapp.png index e6c9769e68..5da4686e3f 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-sccm-adddesktopapp.png and b/windows/security/information-protection/windows-information-protection/images/wip-sccm-adddesktopapp.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-additionalsettings.png b/windows/security/information-protection/windows-information-protection/images/wip-sccm-additionalsettings.png index 4b66070098..89c1eae2a8 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-sccm-additionalsettings.png and b/windows/security/information-protection/windows-information-protection/images/wip-sccm-additionalsettings.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-adduniversalapp.png b/windows/security/information-protection/windows-information-protection/images/wip-sccm-adduniversalapp.png index 8d1815ddf9..b2fc9ee966 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-sccm-adduniversalapp.png and b/windows/security/information-protection/windows-information-protection/images/wip-sccm-adduniversalapp.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-appmgmt.png b/windows/security/information-protection/windows-information-protection/images/wip-sccm-appmgmt.png index 495fdfdb95..8af8967001 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-sccm-appmgmt.png and b/windows/security/information-protection/windows-information-protection/images/wip-sccm-appmgmt.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-generalscreen.png b/windows/security/information-protection/windows-information-protection/images/wip-sccm-generalscreen.png index c2c85c62d4..2d6cadb5c6 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-sccm-generalscreen.png and b/windows/security/information-protection/windows-information-protection/images/wip-sccm-generalscreen.png differ diff --git a/windows/security/information-protection/windows-information-protection/images/wip-sccm-optsettings.png b/windows/security/information-protection/windows-information-protection/images/wip-sccm-optsettings.png index c52e7a4fdb..f3d12e7f2f 100644 Binary files a/windows/security/information-protection/windows-information-protection/images/wip-sccm-optsettings.png and b/windows/security/information-protection/windows-information-protection/images/wip-sccm-optsettings.png differ diff --git a/windows/security/information-protection/windows-information-protection/limitations-with-wip.md b/windows/security/information-protection/windows-information-protection/limitations-with-wip.md index 1e633ed77d..7cdf0d2dfd 100644 --- a/windows/security/information-protection/windows-information-protection/limitations-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/limitations-with-wip.md @@ -6,21 +6,22 @@ ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual -ms.date: 03/06/2019 +ms.date: 04/05/2019 +ms.reviewer: ms.localizationpriority: medium --- # Limitations while using Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 and later -- Windows 10 Mobile, version 1607 and later +- Windows 10, version 1607 and later +- Windows 10 Mobile, version 1607 and later This table provides info about the most common problems you might encounter while running WIP in your organization. @@ -32,7 +33,7 @@ This table provides info about the most common problems you might encounter whil Your enterprise data on USB drives might be tied to the device it was protected on, based on your Azure RMS configuration. - If you’re using Azure RMS: Authenticated users can open enterprise data on USB drives, on computers running Windows 10, version 1703.

                                    If you’re not using Azure RMS: Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text. + If you’re using Azure RMS: Authenticated users can open enterprise data on USB drives, on computers running Windows 10, version 1703.

                                    If you’re not using Azure RMS: Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text. Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.

                                    We strongly recommend educating employees about how to limit or eliminate the need for this decryption. @@ -48,7 +49,7 @@ This table provides info about the most common problems you might encounter whil Cortana can potentially allow data leakage if it’s on the allowed apps list. If Cortana is on the allowed list, some files might become unexpectedly encrypted after an employee performs a search using Cortana. Your employees will still be able to use Cortana to search and provide results on enterprise documents and locations, but results might be sent to Microsoft. - We don’t recommend adding Cortana to your allowed apps list. However, if you wish to use Cortana and don't mind whether the results potentially go to Microsoft, you can make Cortana an Exempt app. + We don’t recommend adding Cortana to your allowed apps list. However, if you wish to use Cortana and don't mind whether the results potentially go to Microsoft, you can make Cortana an Exempt app. WIP is designed for use by a single user per device. @@ -73,7 +74,7 @@ This table provides info about the most common problems you might encounter whil Redirected folders with Client Side Caching are not compatible with WIP. Apps might encounter access errors while attempting to read a cached, offline file. - Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.

                                    Note
                                    For more info about Work Folders and Offline Files, see the blog, [Work Folders and Offline Files support for Windows Information Protection](https://blogs.technet.microsoft.com/filecab/2016/08/29/work-folders-and-offline-files-support-for-windows-information-protection/). If you're having trouble opening files offline while using Offline Files and WIP, see the support article, [Can't open files offline when you use Offline Files and Windows Information Protection](https://support.microsoft.com/kb/3187045). + Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.

                                    Note
                                    For more info about Work Folders and Offline Files, see the blog, Work Folders and Offline Files support for Windows Information Protection. If you're having trouble opening files offline while using Offline Files and WIP, see the support article, Can't open files offline when you use Offline Files and Windows Information Protection. An unmanaged device can use Remote Desktop Protocol (RDP) to connect to a WIP-managed device. @@ -81,17 +82,17 @@ This table provides info about the most common problems you might encounter whil Disable RDP to prevent access because there is no way to restrict access to only devices managed by WIP. RDP is disabled by default. - You can't upload an enterprise file to a personal location using Microsoft Edge or Internet Explorer. - A message appears stating that the content is marked as Work and the user isn't given an option to override to Personal. + You can't upload an enterprise file to a personal location using Microsoft Edge or Internet Explorer. + A message appears stating that the content is marked as Work and the user isn't given an option to override to Personal. Open File Explorer and change the file ownership to Personal before you upload. ActiveX controls should be used with caution. Webpages that use ActiveX controls can potentially communicate with other outside processes that aren’t protected by using WIP. - We recommend that you switch to using Microsoft Edge, the more secure and safer browser that prevents the use of ActiveX controls. We also recommend that you limit the usage of Internet Explorer 11 to only those line-of-business apps that require legacy technology.

                                    For more info, see [Out-of-date ActiveX control blocking](https://technet.microsoft.com/itpro/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking). + We recommend that you switch to using Microsoft Edge, the more secure and safer browser that prevents the use of ActiveX controls. We also recommend that you limit the usage of Internet Explorer 11 to only those line-of-business apps that require legacy technology.

                                    For more info, see Out-of-date ActiveX control blocking. - Resilient File System (ReFS) isn't currently supported with WIP. + Resilient File System (ReFS) isn't currently supported with WIP. Trying to save or transfer WIP files to ReFS will fail. Format drive for NTFS, or use a different drive. @@ -114,7 +115,7 @@ This table provides info about the most common problems you might encounter whil

                                  WIP isn’t turned on for employees in your organization. Error code 0x807c0008 will result if WIP is deployed by using System Center Configuration Manager. - Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders.

                                  If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. For more info about these potential access errors, see [Can't open files offline when you use Offline Files and Windows Information Protection](https://support.microsoft.com/help/3187045/can-t-open-files-offline-when-you-use-offline-files-and-windows-information-protection). + Don’t set the MakeFolderAvailableOfflineDisabled option to False for any of the specified folders.

                                  If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports WIP, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after WIP is already in place, you might be unable to open your files offline. For more info about these potential access errors, see Can't open files offline when you use Offline Files and Windows Information Protection. @@ -124,7 +125,18 @@ This table provides info about the most common problems you might encounter whil If all apps need to be managed, enroll the device for MDM. + + By design, files in the Windows directory (%windir% or C:/Windows) cannot be encrypted because they need to be accessed by any user. If a file in the Windows directory gets encypted by one user, other users can't access it.
                                  + Any attempt to encrypt a file in the Windows directory will return a file access denied error. But if you copy or drag and drop an encrypted file to the Windows directory, it will retain encryption to honor the intent of the owner. + + If you need to save an encrypted file in the Windows directory, create and encrypt the file in a different directory and copy it. + + ->[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to our content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). +> [!NOTE] +> When corporate data is written to disk, WIP uses the Windows-provided Encrypting File System (EFS) to protect it and associate it with your enterprise identity. One caveat to keep in mind is that the Preview Pane in File Explorer will not work for encrypted files. + +> [!NOTE] +> Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to our content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). + diff --git a/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md b/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md index 4c8459fac2..27d3f1d9c9 100644 --- a/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md @@ -1,19 +1,20 @@ --- title: Mandatory tasks and settings required to turn on Windows Information Protection (WIP) (Windows 10) -description: This list provides all of the tasks that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP) in your enterprise. +description: Review all of the tasks required for Windows to turn on Windows Information Protection (WIP), formerly enterprise data protection (EDP), in your enterprise. keywords: Windows Information Protection, WIP, EDP, Enterprise Data Protection, protected apps, protected app list, App Rules, Protected apps list ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 03/05/2019 +ms.reviewer: --- # Mandatory tasks and settings required to turn on Windows Information Protection (WIP) @@ -35,4 +36,4 @@ This list provides all of the tasks and settings that are required for the opera >[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file +>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md index b577d9e9e5..e8ad475fda 100644 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm.md @@ -1,14 +1,15 @@ --- title: Create a Windows Information Protection (WIP) policy using System Center Configuration Manager (Windows 10) -description: System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +description: System Center Configuration Manager helps you create & deploy your enterprise data protection (WIP) policy. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -29,4 +30,4 @@ System Center Configuration Manager helps you create and deploy your enterprise |------|------------| |[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) |System Center Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | |[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. | -|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). | \ No newline at end of file +|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). | diff --git a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md index 3af1d9b274..3338a0ebab 100644 --- a/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md +++ b/windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md @@ -1,14 +1,15 @@ --- title: Create a Windows Information Protection (WIP) policy using Microsoft Intune (Windows 10) -description: Microsoft Intune and System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +description: Microsoft Intune and System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 +ms.reviewer: ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md index 626c296a9d..fc2050b5d2 100644 --- a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md +++ b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md @@ -1,15 +1,16 @@ --- title: Protect your enterprise data using Windows Information Protection (WIP) (Windows 10) -description: With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. +description: Learn how to prevent accidental enterprise data leaks through apps and services, such as email, social media, and the public cloud. ms.assetid: 6cca0119-5954-4757-b2bc-e0ea4d2c7032 +ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, DLP, data loss prevention, data leakage protection ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -34,7 +35,7 @@ Windows Information Protection (WIP), previously known as enterprise data protec ## Video: Protect enterprise data from being accidentally copied to the wrong place -> [!Video https://www.microsoft.com/en-us/videoplayer/embed/RE2IGhh] +> [!Video https://www.microsoft.com/videoplayer/embed/RE2IGhh] ## Prerequisites You’ll need this software to run WIP in your enterprise: @@ -58,7 +59,7 @@ To help address this security insufficiency, companies developed data loss preve - **The ability to specify what happens when data matches a rule, including whether employees can bypass enforcement.** For example, in Microsoft SharePoint and SharePoint Online, the Microsoft data loss prevention system lets you warn your employees that shared data includes sensitive info, and to share it anyway (with an optional audit log entry). -Unfortunately, data loss prevention systems have their own problems. For example, the more detailed the rule set, the more false positives are created, leading employees to believe that the rules slow down their work and need to be bypassed in order to remain productive, potentially leading to data being incorrectly blocked or improperly released. Another major problem is that data loss prevention systems must be widely implemented to be effective. For example, if your company uses a data loss prevention system for email, but not for file shares or document storage, you might find that your data leaks through the unprotected channels. But perhaps the biggest problem with data loss preventions systems is that it provides a jarring experience that interrupts the employees’ natural workflow by stopping some operations (such as sending a message with an attachment that the system tags as sensitive) while allowing others, often according to subtle rules that the employee doesn’t see and can’t understand. +Unfortunately, data loss prevention systems have their own problems. For example, the more detailed the rule set, the more false positives are created, leading employees to believe that the rules slow down their work and need to be bypassed in order to remain productive, potentially leading to data being incorrectly blocked or improperly released. Another major problem is that data loss prevention systems must be widely implemented to be effective. For example, if your company uses a data loss prevention system for email, but not for file shares or document storage, you might find that your data leaks through the unprotected channels. But perhaps the biggest problem with data loss prevention systems is that it provides a jarring experience that interrupts the employees’ natural workflow by stopping some operations (such as sending a message with an attachment that the system tags as sensitive) while allowing others, often according to subtle rules that the employee doesn’t see and can’t understand. ### Using information rights management systems To help address the potential data loss prevention system problems, companies developed information rights management (also known as IRM) systems. Information rights management systems embed protection directly into documents, so that when an employee creates a document, he or she determines what kind of protection to apply. For example, an employee can choose to stop the document from being forwarded, printed, shared outside of the organization, and so on. diff --git a/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md b/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md index 46b7344b5f..c3e7e88640 100644 --- a/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md @@ -1,5 +1,5 @@ --- -title: Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP) (Windows 10) +title: Recommended URLs for Windows Information Protection (Windows 10) description: Recommended URLs to add to your Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP). keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and Neutral Resources, WIP and Enterprise Cloud Resources ms.prod: w10 @@ -7,13 +7,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 03/25/2019 +ms.reviewer: --- # Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP) @@ -34,6 +35,7 @@ This table includes the recommended URLs to add to your Enterprise Cloud Resourc |-----------------------------|---------------------------------------------------------------------| |Office 365 for Business |
                                  • contoso.sharepoint.com
                                  • contoso-my.sharepoint.com
                                  • contoso-files.sharepoint.com
                                  • tasks.office.com
                                  • protection.office.com
                                  • meet.lync.com
                                  • teams.microsoft.com
                                  | |Yammer |
                                  • www.yammer.com
                                  • yammer.com
                                  • persona.yammer.com
                                  | +|Outlook Web Access (OWA) |
                                  • outlook.office.com
                                  • outlook.office365.com
                                  • attachments.office.net
                                  | |Microsoft Dynamics |contoso.crm.dynamics.com | |Visual Studio Online |contoso.visualstudio.com | |Power BI |contoso.powerbi.com | @@ -53,4 +55,4 @@ We recommended adding these URLs if you use the Neutral Resources network settin
                                  • login.microsoftonline.com
                                  • login.windows.net
                                    • -
                                  \ No newline at end of file + diff --git a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md index 6f698cb26c..d056e573c8 100644 --- a/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md +++ b/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md @@ -2,14 +2,15 @@ title: Testing scenarios for Windows Information Protection (WIP) (Windows 10) description: A list of suggested testing scenarios that you can use to test Windows Information Protection (WIP) in your company. ms.assetid: 53db29d2-d99d-4db6-b494-90e2b3962ca2 +ms.reviewer: keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -20,8 +21,8 @@ ms.date: 03/05/2019 # Testing scenarios for Windows Information Protection (WIP) **Applies to:** -- Windows 10, version 1607 and later -- Windows 10 Mobile, version 1607 and later +- Windows 10, version 1607 and later +- Windows 10 Mobile, version 1607 and later We've come up with a list of suggested testing scenarios that you can use to test Windows Information Protection (WIP) in your company. @@ -47,7 +48,7 @@ You can try any of the processes included in these scenarios, but you should foc
                                  1. Open the File Explorer app, browse to a file location, click the elipsis (...), and then click Select to mark at least one file as work-related.
                                  2. Click the elipsis (...) again, click File ownership from the drop down menu, and then click Work.
                                    Make sure the file is encrypted, by locating the Briefcase icon next to the file name.
                                    3. -
                                  3. Select the same file, click File ownership from the drop down menu, and then click Personal.
                                    Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
                                    4. +
                                  4. Select the same file, click File ownership from the drop down menu, and then click Personal.
                                    Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
                                  @@ -55,21 +56,20 @@ You can try any of the processes included in these scenarios, but you should foc Create work documents in enterprise-allowed apps. For desktop:

                                    -
                                  • Start an unenlightened but allowed app, such as a line-of-business app, and then create a new document, saving your changes.
                                    Make sure the document is encrypted to your Enterprise Identity. This might take a few minutes and require you to close and re-open the file.

                                    Important
                                    Certain file types like .exe and .dll, along with certain file paths, such as %windir% and %programfiles% are excluded from automatic encryption.

                                    For more info about your Enterprise Identity and adding apps to your allowed apps list, see either [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune-azure.md) or [Create a Windows Information Protection (WIP) policy using Microsoft System Center Configuration Manager](create-wip-policy-using-sccm.md), based on your deployment system.
                                    • +
                                  • Start an unenlightened but allowed app, such as a line-of-business app, and then create a new document, saving your changes.
                                    Make sure the document is encrypted to your Enterprise Identity. This might take a few minutes and require you to close and re-open the file.

                                    Important
                                    Certain file types like .exe and .dll, along with certain file paths, such as %windir% and %programfiles% are excluded from automatic encryption.

                                    For more info about your Enterprise Identity and adding apps to your allowed apps list, see either Create a Windows Information Protection (WIP) policy using Microsoft Intune or Create a Windows Information Protection (WIP) policy using Microsoft System Center Configuration Manager, based on your deployment system.
                                  For mobile:

                                  1. Start an allowed mobile app, such as Word Mobile, create a new document, and then save your changes as Work to a local, work-related location.
                                    Make sure the document is encrypted, by locating the Briefcase icon next to the file name.
                                  2. Open the same document and attempt to save it to a non-work-related location.
                                    WIP should stop you from saving the file to this location.
                                    3. -
                                  3. Open the same document one last time, make a change to the contents, and then save it again using the Personal option.
                                    Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
                                    4. +
                                  4. Open the same document one last time, make a change to the contents, and then save it again using the Personal option.
                                    Make sure the file is decrypted and that you're no longer seeing the Briefcase icon next to file name.
                                  - - +
                                  Block enterprise data from non-enterprise apps.
                                    -
                                  1. Start an app that doesn't appear on your allowed apps list, and then try to open a work-encrypted file.
                                    The app shouldn't be able to access the file.
                                    2. +
                                  2. Start an app that doesn't appear on your allowed apps list, and then try to open a work-encrypted file.
                                    The app shouldn't be able to access the file.
                                  3. Try double-clicking or tapping on the work-encrypted file.
                                    If your default app association is an app not on your allowed apps list, you should get an Access Denied error message.
                                  @@ -78,8 +78,8 @@ You can try any of the processes included in these scenarios, but you should foc Copy and paste from enterprise apps to non-enterprise apps.
                                    -
                                  1. Copy (CTRL+C) content from an app on your allowed apps list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your allowed apps list.
                                    You should see a WIP-related warning box, asking you to click either Change to personal or Keep at work.
                                    2. -
                                  2. Click Keep at work.
                                    The content isn't pasted into the non-enterprise app.
                                    3. +
                                  3. Copy (CTRL+C) content from an app on your allowed apps list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your allowed apps list.
                                    You should see a WIP-related warning box, asking you to click either Change to personal or Keep at work.
                                    4. +
                                  4. Click Keep at work.
                                    The content isn't pasted into the non-enterprise app.
                                  5. Repeat Step 1, but this time click Change to personal, and try to paste the content again.
                                    The content is pasted into the non-enterprise app.
                                  6. Try copying and pasting content between apps on your allowed apps list.
                                    The content should copy and paste between apps without any warning messages.
                                  @@ -89,8 +89,8 @@ You can try any of the processes included in these scenarios, but you should foc Drag and drop from enterprise apps to non-enterprise apps.
                                    -
                                  1. Drag content from an app on your allowed apps list, and then try to drop the content into an app that doesn't appear on your allowed apps list.
                                    You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
                                    2. -
                                  2. Click Keep at work.
                                    The content isn't dropped into the non-enterprise app.
                                    3. +
                                  3. Drag content from an app on your allowed apps list, and then try to drop the content into an app that doesn't appear on your allowed apps list.
                                    You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
                                    4. +
                                  4. Click Keep at work.
                                    The content isn't dropped into the non-enterprise app.
                                  5. Repeat Step 1, but this time click Change to personal, and try to drop the content again.
                                    The content is dropped into the non-enterprise app.
                                  6. Try dragging and dropping content between apps on your allowed apps list.
                                    The content should move between the apps without any warning messages.
                                  @@ -100,8 +100,8 @@ You can try any of the processes included in these scenarios, but you should foc Share between enterprise apps and non-enterprise apps.
                                    -
                                  1. Open an app on your allowed apps list, like Microsoft Photos, and try to share content with an app that doesn't appear on your allowed apps list, like Facebook.
                                    You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
                                    2. -
                                  2. Click Keep at work.
                                    The content isn't shared into Facebook.
                                    3. +
                                  3. Open an app on your allowed apps list, like Microsoft Photos, and try to share content with an app that doesn't appear on your allowed apps list, like Facebook.
                                    You should see a WIP-related warning box, asking you to click either Keep at work or Change to personal.
                                    4. +
                                  4. Click Keep at work.
                                    The content isn't shared into Facebook.
                                  5. Repeat Step 1, but this time click Change to personal, and try to share the content again.
                                    The content is shared into Facebook.
                                  6. Try sharing content between apps on your allowed apps list.
                                    The content should share between the apps without any warning messages.
                                  @@ -113,7 +113,7 @@ You can try any of the processes included in these scenarios, but you should foc
                                  1. Start Windows Journal and Internet Explorer 11, creating, editing, and saving files in both apps.
                                    Make sure that all of the files you worked with are encrypted to your configured Enterprise Identity. In some cases, you might need to close the file and wait a few moments for it to be automatically encrypted.
                                  2. Open File Explorer and make sure your modified files are appearing with a Lock icon.
                                    3. -
                                  3. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.

                                    Note
                                    Most Windows-signed components like File Explorer (when running in the user’s context), should have access to enterprise data.

                                    A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.
                                    4. +
                                  4. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.

                                    Note
                                    Most Windows-signed components like File Explorer (when running in the user’s context), should have access to enterprise data.

                                    A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.
                                  @@ -132,7 +132,7 @@ You can try any of the processes included in these scenarios, but you should foc
                                  1. Download a file from a protected file share, making sure the file is encrypted by locating the Briefcase icon next to the file name.
                                  2. Open the same file, make a change, save it and then try to upload it back to the file share. Again, this should work without any warnings.
                                    3. -
                                  3. Open an app that doesn't appear on your allowed apps list and attempt to access a file on the WIP-enabled file share.
                                    The app shouldn't be able to access the file share.
                                    4. +
                                  4. Open an app that doesn't appear on your allowed apps list and attempt to access a file on the WIP-enabled file share.
                                    The app shouldn't be able to access the file share.
                                  @@ -141,8 +141,8 @@ You can try any of the processes included in these scenarios, but you should foc
                                  1. Add both Internet Explorer 11 and Microsoft Edge to your allowed apps list.
                                    2. -
                                  2. Open SharePoint (or another cloud resource that's part of your policy) and access a WIP-enabled resource by using both IE11 and Microsoft Edge.
                                    Both browsers should respect the enterprise and personal boundary.
                                    3. -
                                  3. Remove Internet Explorer 11 from your allowed app list and then try to access an intranet site or enterprise-related cloud resource.
                                    IE11 shouldn't be able to access the sites.

                                    Note
                                    Any file downloaded from your work SharePoint site, or any other WIP-enabled cloud resource, is automatically marked as Work.
                                    4. +
                                  4. Open SharePoint (or another cloud resource that's part of your policy) and access a WIP-enabled resource by using both IE11 and Microsoft Edge.
                                    Both browsers should respect the enterprise and personal boundary.
                                    5. +
                                  5. Remove Internet Explorer 11 from your allowed app list and then try to access an intranet site or enterprise-related cloud resource.
                                    IE11 shouldn't be able to access the sites.

                                    Note
                                    Any file downloaded from your work SharePoint site, or any other WIP-enabled cloud resource, is automatically marked as Work.
                                  @@ -150,9 +150,9 @@ You can try any of the processes included in these scenarios, but you should foc Verify your Virtual Private Network (VPN) can be auto-triggered.
                                    -
                                  1. Set up your VPN network to start based on the WIPModeID setting.
                                    For specific info about how to do this, see the [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune-azure.md) topic.
                                    2. +
                                  2. Set up your VPN network to start based on the WIPModeID setting.
                                    For specific info about how to do this, see the Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune topic.
                                  3. Start an app from your allowed apps list.
                                    The VPN network should automatically start.
                                    4. -
                                  4. Disconnect from your network and then start an app that isn't on your allowed apps list.
                                    The VPN shouldn't start and the app shouldn't be able to access your enterprise network.
                                    5. +
                                  5. Disconnect from your network and then start an app that isn't on your allowed apps list.
                                    The VPN shouldn't start and the app shouldn't be able to access your enterprise network.
                                  @@ -160,7 +160,7 @@ You can try any of the processes included in these scenarios, but you should foc Unenroll client devices from WIP.
                                    -
                                  • Unenroll a device from WIP by going to Settings, click Accounts, click Work, click the name of the device you want to unenroll, and then click Remove.
                                    The device should be removed and all of the enterprise content for that managed account should be gone.

                                    Important
                                    On desktop devices, the data isn't removed and can be recovered, so you must make sure the content is marked as Revoked and that access is denied for the employee. On mobile devices, the data is removed.
                                    • +
                                  • Unenroll a device from WIP by going to Settings, click Accounts, click Work, click the name of the device you want to unenroll, and then click Remove.
                                    The device should be removed and all of the enterprise content for that managed account should be gone.

                                    Important
                                    On desktop devices, the data isn't removed and can be recovered, so you must make sure the content is marked as Revoked and that access is denied for the employee. On mobile devices, the data is removed.
                                  @@ -168,11 +168,22 @@ You can try any of the processes included in these scenarios, but you should foc Verify that app content is protected when a Windows 10 Mobile phone is locked.
                                    -
                                  • Check that protected app data doesn't appear on the Lock screen of a Windows 10 Mobile phone.
                                    • +
                                  • Check that protected app data doesn't appear on the Lock screen of a Windows 10 Mobile phone.
                                    • +
                                  + + + + Stop Google Drive from syncing WIP protected files and folders. + +
                                    +
                                  • In silent configuration, add Google Drive to Protected Apps and set it to Deny. This way, Google Drive will not sync WIP protected files and folders.
                                    • +
                                  • Google Drive details
                                    • + Publisher=O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US + File=GOOGLEDRIVESYNC.EXE
                                  >[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file +>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md b/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md index 4f4a47aff3..94df767962 100644 --- a/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md +++ b/windows/security/information-protection/windows-information-protection/using-owa-with-wip.md @@ -1,5 +1,5 @@ --- -title: Using Outlook on the web with Windows Information Protection (WIP) (Windows 10) +title: Using Outlook on the web with WIP (Windows 10) description: Options for using Outlook on the web with Windows Information Protection (WIP). keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP and OWA configuration, OWA, Outlook Web access ms.prod: w10 @@ -7,13 +7,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/26/2019 +ms.reviewer: --- # Using Outlook on the web with Windows Information Protection (WIP) diff --git a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md index 13b9c07410..5a8333cab2 100644 --- a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md +++ b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md @@ -7,13 +7,14 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium -author: justinha -ms.author: justinha +author: dulcemontemayor +ms.author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual ms.date: 02/26/2019 +ms.reviewer: --- # Determine the Enterprise Context of an app running in Windows Information Protection (WIP) diff --git a/windows/security/information-protection/windows-information-protection/wip-learning.md b/windows/security/information-protection/windows-information-protection/wip-learning.md index 6574cf15e2..7679c60ed8 100644 --- a/windows/security/information-protection/windows-information-protection/wip-learning.md +++ b/windows/security/information-protection/windows-information-protection/wip-learning.md @@ -1,104 +1,117 @@ ---- -title: -# Fine-tune Windows Information Policy (WIP) with WIP Learning -description: How to access the WIP Learning report to monitor and apply Windows Information Protection in your company. -ms.assetid: 53db29d2-d99d-4db6-b494-90e2b4872ca2 -keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP Learning -ms.prod: w10 -ms.mktglfcycl: -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: justinha -ms.author: justinha -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual -ms.date: 02/26/2019 ---- - -# Fine-tune Windows Information Protection (WIP) with WIP Learning -**Applies to:** - -- Windows 10, version 1703 and later -- Windows 10 Mobile, version 1703 and later - -With WIP Learning, you can intelligently tune which apps and websites are included in your WIP policy to help reduce disruptive prompts and keep it accurate and relevant. WIP Learning generates two reports: The **App learning report** and the **Website learning report**. Both reports are accessed from Microsoft Azure Intune, and you can alternately access the App learning report from Microsoft Operations Management Suite (OMS). - -The **App learning report** monitors your apps, not in policy, that attempt to access work data. You can identify these apps using the report and add them to your WIP policies to avoid productivity disruption before fully enforcing WIP with [“Block”](protect-enterprise-data-using-wip.md#bkmk-modes) mode. Frequent monitoring of the report will help you continuously identify access attempts so you can update your policy accordingly. - -In the **Website learning report**, you can view a summary of the devices that have shared work data with websites. You can use this information to determine which websites should be added to group and user WIP policies. The summary shows which website URLs are accessed by WIP-enabled apps so you can decide which ones are cloud or personal, and add them to the resource list. - -## Access the WIP Learning reports - -1. Open the [Azure portal](http://portal.azure.com/). - -1. Click **All services**, type **Intune** in the text box filter, and click the star to add it to **Favorites**. - -1. Click **Intune** > **Client apps** > **App protection status** > **Reports**. - - ![Image showing the UI path to the WIP report](images/access-wip-learning-report.png) - -1. Select either **App learning report for Windows Information Protection** or **Website learning report for Windows Information Protection**. - - ![Image showing the UI with for app and website learning reports](images/wip-learning-select-report.png) - -Once you have the apps and websites showing up in the WIP Learning logging reports, you can decide whether to add them to your app protection policies. Next, we'll look at how to do that in Operations Management Suite (OMS). - -## View the WIP app learning report in Microsoft Operations Management Suite - -From Intune, you can open OMS by choosing **WIP in the OMS console**. Then you can view the WIP App learning blade to monitor access events per app, and devices that have reported WIP access events: - -![View in Intune of the link to OMS](images/wip-in-oms-console-link.png) - -If you don't have OMS linked to your Microsoft Azure Account, and want to configure your environment for Windows Analytics: Device Health, see [Get Started with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-get-started) for more information. - ->[!NOTE] ->Intune has a 14 day data retention capacity, while OMS offers better querying capabilities and longer data retention. - -Once you have WIP policies in place, by using the WIP section of Device Health, you can: - -- Reduce disruptive prompts by adding rules to allow data sharing from approved apps. -- Tune WIP rules by confirming that certain apps are allowed or denied by current policy. - -![Main Windows Information Protection view](images/oms-wip-app-learning-tile.png) - -The **APP LEARNING** tile shows details of app statistics that you can use to evaluate each incident and update app policies by using WIP AppIDs. - -![Details view](images/WIPNEW1-chart-selected-sterile.png) - -In this chart view, you can see apps that have been used on connected devices which, when clicked on, will open additional details on the app, including details you need to adjust your WIP Policy: - -![Details view for a specific app](images/WIPappID-sterile.png) - -Here, you can copy the **WipAppid** and use it to adjust your WIP protection policies. - -## Use OMS and Intune to adjust WIP protection policy - -1. Click the **APP LEARNING** tile in OMS, as described above, to determine which apps are being used for work so you can add those you choose to your WIP policy. - -2. Click the app you want to add to your policy and copy the publisher information from the app details screen. - -3. Back in Intune, click **App protection policies** and then choose the app policy you want to add an application to. - -4. Click **Protected apps**, and then click **Add Apps**. - -5. In the **Recommended apps** drop down menu, choose either **Store apps** or **Desktop apps**, depending on the app you've chosen (for example, an executable (EXE) is a desktop app). - - ![View of drop down menu for Store or desktop apps](images/wip-learning-choose-store-or-desktop-app.png) - -6. In **NAME** (optional), type the name of the app, and then in **PUBLISHER** (required), paste the publisher information that you copied in step 2 above. - - ![View of Add Apps app info entry boxes](images/wip-learning-app-info.png) - -7. Type the name of the product in **PRODUCT NAME** (required) (this will probably be the same as what you typed for **NAME**). - -8. Back in OMS, copy the name of the executable (for example, snippingtool.exe) and then go back to Intune and paste it in **FILE** (required). - -9. Go back to OMS one more time and note the version number of the app and type it in **MIN VERSION** in Intune (alternately, you can specify the max version, but one or the other is required), and then select the **ACTION**: **Allow** or **Deny** - -When working with WIP-enabled apps and WIP-unknown apps, it is recommended that you start with **Silent** or **Allow overrides** while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, **Block**. For more information about WIP modes, see: [Protect enterprise data using WIP: WIP-modes](protect-enterprise-data-using-wip.md#bkmk-modes) - ->[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). +--- +title: Fine-tune Windows Information Policy (WIP) with WIP Learning +description: How to access the WIP Learning report to monitor and apply Windows Information Protection in your company. +ms.assetid: 53db29d2-d99d-4db6-b494-90e2b4872ca2 +ms.reviewer: +keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, WIP Learning +ms.prod: w10 +ms.mktglfcycl: +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: cabailey +ms.author: cabailey +manager: laurawi +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ms.date: 02/26/2019 +--- + +# Fine-tune Windows Information Protection (WIP) with WIP Learning +**Applies to:** + +- Windows 10, version 1703 and later +- Windows 10 Mobile, version 1703 and later + +With WIP Learning, you can intelligently tune which apps and websites are included in your WIP policy to help reduce disruptive prompts and keep it accurate and relevant. WIP Learning generates two reports: The **App learning report** and the **Website learning report**. Both reports can be accessed from Microsoft Azure Intune. + +The **App learning report** monitors your apps, not in policy, that attempt to access work data. You can identify these apps using the report and add them to your WIP policies to avoid productivity disruption before fully enforcing WIP with [“Block”](protect-enterprise-data-using-wip.md#bkmk-modes) mode. Frequent monitoring of the report will help you continuously identify access attempts so you can update your policy accordingly. + +In the **Website learning report**, you can view a summary of the devices that have shared work data with websites. You can use this information to determine which websites should be added to group and user WIP policies. The summary shows which website URLs are accessed by WIP-enabled apps so you can decide which ones are cloud or personal, and add them to the resource list. + +## Access the WIP Learning reports + +1. Open the [Azure portal](https://portal.azure.com/). + +1. Click **All services**, type **Intune** in the text box filter, and click the star to add it to **Favorites**. + +1. Click **Intune** > **Client apps** > **App protection status** > **Reports**. + + ![Image showing the UI path to the WIP report](images/access-wip-learning-report.png) + +1. Select either **App learning report for Windows Information Protection** or **Website learning report for Windows Information Protection**. + + ![Image showing the UI with for app and website learning reports](images/wip-learning-select-report.png) + +Once you have the apps and websites showing up in the WIP Learning logging reports, you can decide whether to add them to your app protection policies. + +## Use the WIP section of Device Health + +You can use Device Health to adjust your WIP protection policy. See [Using Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-using#windows-information-protection) to learn more. + +If you want to configure your environment for Windows Analytics: Device Health, see [Get Started with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-get-started) for more information. + +Once you have WIP policies in place, by using the WIP section of Device Health, you can: + +- Reduce disruptive prompts by adding rules to allow data sharing from approved apps. +- Tune WIP rules by confirming that certain apps are allowed or denied by current policy. + +## Use Device Health and Intune to adjust WIP protection policy + +The information needed for the following steps can be found using Device Health, which you will first have to set up. Learn more about how you can [Monitor the health of devices with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor). + +1. In **Device Health** click the app you want to add to your policy and copy the **WipAppId**. + + For example, if the app is Google Chrome, the WipAppId is: + + `O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US\GOOGLE CHROME\CHROME.EXE\74.0.3729.108` + + In the steps below, you separate the WipAppId by back slashes into the **PUBLISHER**, **PRODUCT NAME**, and **FILE** fields. + +2. In Intune, click **App protection policies** and then choose the app policy you want to add an application to. + +3. Click **Protected apps**, and then click **Add Apps**. + +4. In the **Recommended apps** drop down menu, choose either **Store apps** or **Desktop apps**, depending on the app you've chosen (for example, an executable (EXE) is a desktop app). + + ![View of drop down menu for Store or desktop apps](images/wip-learning-choose-store-or-desktop-app.png) + +5. In **NAME** (optional), type the name of the app, and then in **PUBLISHER** (required), paste the publisher information that you copied in step 1 above. + + For example, if the WipAppId is + + `O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US\GOOGLE CHROME\CHROME.EXE\74.0.3729.108` + + the text before the first back slash is the publisher: + + `O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US` + + ![View of Add Apps app info entry boxes](images/wip-learning-app-info.png) + +6. Type the name of the product in **PRODUCT NAME** (required) (this will probably be the same as what you typed for **NAME**). + + For example, if the WipAppId is + + `O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US\GOOGLE CHROME\CHROME.EXE\74.0.3729.108` + + the text between the first and second back slashes is the product name: + + `GOOGLE CHROME` + +7. Copy the name of the executable (for example, snippingtool.exe) and paste it in **FILE** (required). + + For example, if the WipAppId is + + `O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US\GOOGLE CHROME\CHROME.EXE\74.0.3729.108` + + the text between the second and third back slashes is the file: + + `CHROME.EXE` + +8. Type the version number of the app into **MIN VERSION** in Intune (alternately, you can specify the max version, but one or the other is required), and then select the **ACTION**: **Allow** or **Deny** + +When working with WIP-enabled apps and WIP-unknown apps, it is recommended that you start with **Silent** or **Allow overrides** while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, **Block**. For more information about WIP modes, see: [Protect enterprise data using WIP: WIP-modes](protect-enterprise-data-using-wip.md#bkmk-modes) + +>[!NOTE] +>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index f99bc88986..e37e6d8711 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -1,422 +1,619 @@ # [Threat protection](index.md) -## [Windows Defender Advanced Threat Protection](windows-defender-atp/windows-defender-advanced-threat-protection.md) - -### [Overview](windows-defender-atp/overview.md) -#### [Attack surface reduction](windows-defender-atp/overview-attack-surface-reduction.md) -##### [Hardware-based isolation](windows-defender-atp/overview-hardware-based-isolation.md) -###### [Application isolation](windows-defender-application-guard/wd-app-guard-overview.md) -####### [System requirements](windows-defender-application-guard/reqs-wd-app-guard.md) -###### [System integrity](windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) -##### [Application control](windows-defender-application-control/windows-defender-application-control.md) -##### [Exploit protection](windows-defender-exploit-guard/exploit-protection-exploit-guard.md) -##### [Network protection](windows-defender-exploit-guard/network-protection-exploit-guard.md) -##### [Controlled folder access](windows-defender-exploit-guard/controlled-folders-exploit-guard.md) -##### [Attack surface reduction](windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md) -##### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) -#### [Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) -#### [Endpoint detection and response](windows-defender-atp/overview-endpoint-detection-response.md) -##### [Security operations dashboard](windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md) - -##### [Incidents queue](windows-defender-atp/incidents-queue.md) -###### [View and organize the Incidents queue](windows-defender-atp/view-incidents-queue.md) -###### [Manage incidents](windows-defender-atp/manage-incidents-windows-defender-advanced-threat-protection.md) -###### [Investigate incidents](windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md) +## [Overview]() +### [What is Microsoft Defender Advanced Threat Protection?](microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) +### [Overview of Microsoft Defender ATP capabilities](microsoft-defender-atp/overview.md) +### [Threat & Vulnerability Management]() +#### [Next-generation capabilities](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) +#### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md) +#### [What's in the dashboard and what it means for my organization](microsoft-defender-atp/tvm-dashboard-insights.md) +#### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) +#### [Configuration score](microsoft-defender-atp/configuration-score.md) +#### [Security recommendation](microsoft-defender-atp/tvm-security-recommendation.md) +#### [Remediation and exception](microsoft-defender-atp/tvm-remediation.md) +#### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md) +#### [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md) +#### [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md) -##### Alerts queue -###### [View and organize the Alerts queue](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) -###### [Manage alerts](windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md) -###### [Investigate alerts](windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md) -###### [Investigate files](windows-defender-atp/investigate-files-windows-defender-advanced-threat-protection.md) -###### [Investigate machines](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md) -###### [Investigate an IP address](windows-defender-atp/investigate-ip-windows-defender-advanced-threat-protection.md) -###### [Investigate a domain](windows-defender-atp/investigate-domain-windows-defender-advanced-threat-protection.md) -###### [Investigate a user account](windows-defender-atp/investigate-user-windows-defender-advanced-threat-protection.md) +### [Attack surface reduction]() +#### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md) +#### [Hardware-based isolation]() +##### [Hardware-based isolation in Windows 10](microsoft-defender-atp/overview-hardware-based-isolation.md) + +##### [Application isolation]() +###### [Application guard overview](windows-defender-application-guard/wd-app-guard-overview.md) +###### [System requirements](windows-defender-application-guard/reqs-wd-app-guard.md) + +##### [System integrity](windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) + +#### [Application control](windows-defender-application-control/windows-defender-application-control.md) +#### [Exploit protection](microsoft-defender-atp/exploit-protection.md) +#### [Network protection](microsoft-defender-atp/network-protection.md) + +#### [Web protection]() +##### [Web protection overview](microsoft-defender-atp/web-protection-overview.md) +##### [Web threat protection]() +###### [Web threat protection overview](microsoft-defender-atp/web-threat-protection.md) +###### [Monitor web security](microsoft-defender-atp/web-protection-monitoring.md) +###### [Respond to web threats](microsoft-defender-atp/web-protection-response.md) +##### [Web content filtering](microsoft-defender-atp/web-content-filtering.md) + +#### [Controlled folder access](microsoft-defender-atp/controlled-folders.md) +#### [Attack surface reduction](microsoft-defender-atp/attack-surface-reduction.md) +#### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) + +### [Next generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) +#### [Better together: Windows Defender Antivirus and Microsoft Defender ATP](windows-defender-antivirus/why-use-microsoft-antivirus.md) + +### [Endpoint detection and response]() +#### [Endpoint detection and response overview](microsoft-defender-atp/overview-endpoint-detection-response.md) +#### [Security operations dashboard](microsoft-defender-atp/security-operations-dashboard.md) + +#### [Incidents queue]() +##### [View and organize the Incidents queue](microsoft-defender-atp/view-incidents-queue.md) +##### [Manage incidents](microsoft-defender-atp/manage-incidents.md) +##### [Investigate incidents](microsoft-defender-atp/investigate-incidents.md) + +#### [Alerts queue]() +##### [View and organize the Alerts queue](microsoft-defender-atp/alerts-queue.md) +##### [Manage alerts](microsoft-defender-atp/manage-alerts.md) +##### [Investigate alerts](microsoft-defender-atp/investigate-alerts.md) +##### [Investigate files](microsoft-defender-atp/investigate-files.md) +##### [Investigate machines](microsoft-defender-atp/investigate-machines.md) +##### [Investigate an IP address](microsoft-defender-atp/investigate-ip.md) +##### [Investigate a domain](microsoft-defender-atp/investigate-domain.md) +###### [Investigate connection events that occur behind forward proxies](microsoft-defender-atp/investigate-behind-proxy.md) +##### [Investigate a user account](microsoft-defender-atp/investigate-user.md) -##### Machines list -###### [View and organize the Machines list](windows-defender-atp/machines-view-overview-windows-defender-advanced-threat-protection.md) -###### [Manage machine group and tags](windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md) -###### [Alerts related to this machine](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) -###### [Machine timeline](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) -####### [Search for specific events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) -####### [Filter events from a specific date](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date) -####### [Export machine timeline events](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) -####### [Navigate between pages](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) +#### [Machines list]() +##### [View and organize the Machines list](microsoft-defender-atp/machines-view-overview.md) +##### [Manage machine group and tags](microsoft-defender-atp/machine-tags.md) -##### [Take response actions](windows-defender-atp/response-actions-windows-defender-advanced-threat-protection.md) -###### [Take response actions on a machine](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md) -####### [Collect investigation package](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) -####### [Run antivirus scan](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines) -####### [Restrict app execution](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution) -####### [Remove app restriction](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction) -####### [Isolate machines from the network](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) -####### [Release machine from isolation](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) -####### [Check activity details in Action center](windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) +#### [Take response actions]() +##### [Take response actions on a machine]() +###### [Response actions on machines](microsoft-defender-atp/respond-machine-alerts.md) +###### [Manage tags](microsoft-defender-atp/respond-machine-alerts.md#manage-tags) +###### [Initiate Automated investigation](microsoft-defender-atp/respond-machine-alerts.md#initiate-automated-investigation) +###### [Initiate Live Response session](microsoft-defender-atp/respond-machine-alerts.md#initiate-live-response-session) +###### [Collect investigation package](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-machines) +###### [Run antivirus scan](microsoft-defender-atp/respond-machine-alerts.md#run-windows-defender-antivirus-scan-on-machines) +###### [Restrict app execution](microsoft-defender-atp/respond-machine-alerts.md#restrict-app-execution) +###### [Isolate machines from the network](microsoft-defender-atp/respond-machine-alerts.md#isolate-machines-from-the-network) +###### [Consult a threat expert](microsoft-defender-atp/respond-machine-alerts.md#consult-a-threat-expert) +###### [Check activity details in Action center](microsoft-defender-atp/respond-machine-alerts.md#check-activity-details-in-action-center) -###### [Take response actions on a file](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md) -####### [Stop and quarantine files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) -####### [Remove file from quarantine](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) -####### [Block files in your network](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network) -####### [Remove file from blocked list](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list) -####### [Check activity details in Action center](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) -####### [Deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis) -####### [Submit files for analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) -####### [View deep analysis reports](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) -####### [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) - - -#### [Automated investigation and remediation](windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md) -##### [Learn about the automated investigation and remediation dashboard](windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md) +##### [Take response actions on a file]() +###### [Response actions on files](microsoft-defender-atp/respond-file-alerts.md) +###### [Stop and quarantine files in your network](microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network) +###### [Restore file from quarantine](microsoft-defender-atp/respond-file-alerts.md#restore-file-from-quarantine) +###### [Add indicators to block or allow a file](microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) +###### [Consult a threat expert](microsoft-defender-atp/respond-file-alerts.md#consult-a-threat-expert) +###### [Check activity details in Action center](microsoft-defender-atp/respond-file-alerts.md#check-activity-details-in-action-center) +###### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file) +###### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis) +###### [Submit files for analysis](microsoft-defender-atp/respond-file-alerts.md#submit-files-for-analysis) +###### [View deep analysis reports](microsoft-defender-atp/respond-file-alerts.md#view-deep-analysis-reports) +###### [Troubleshoot deep analysis](microsoft-defender-atp/respond-file-alerts.md#troubleshoot-deep-analysis) -#### [Secure score](windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md) -#### [Threat analytics](windows-defender-atp/threat-analytics.md) +##### [Investigate entities using Live response]() +###### [Investigate entities on machines](microsoft-defender-atp/live-response.md) +###### [Live response command examples](microsoft-defender-atp/live-response-command-examples.md) -#### [Advanced hunting](windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md) -##### [Query data using Advanced hunting](windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md) -###### [Advanced hunting reference](windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md) -###### [Advanced hunting query language best practices](windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) -##### [Custom detections](windows-defender-atp/overview-custom-detections.md) -###### [Create custom detections rules](windows-defender-atp/custom-detection-rules.md) +### [Automated investigation and remediation]() +#### [Automated investigation and remediation overview](microsoft-defender-atp/automated-investigations.md) +#### [Learn about the automated investigation and remediation dashboard](microsoft-defender-atp/manage-auto-investigation.md) +##### [Manage actions related to automated investigation and remediation](microsoft-defender-atp/auto-investigation-action-center.md) - +### [Secure score](microsoft-defender-atp/overview-secure-score.md) +### [Threat analytics](microsoft-defender-atp/threat-analytics.md) -#### [Management and APIs](windows-defender-atp/management-apis.md) -##### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md) -##### [Windows Defender ATP APIs](windows-defender-atp/apis-intro.md) -##### [Managed security service provider support](windows-defender-atp/mssp-support-windows-defender-advanced-threat-protection.md) +### [Advanced hunting]() +#### [Advanced hunting overview](microsoft-defender-atp/advanced-hunting-overview.md) +#### [Learn the query language](microsoft-defender-atp/advanced-hunting-query-language.md) +#### [Use shared queries](microsoft-defender-atp/advanced-hunting-shared-queries.md) +#### [Advanced hunting schema reference]() +##### [Understand the schema](microsoft-defender-atp/advanced-hunting-schema-reference.md) +##### [DeviceAlertEvents](microsoft-defender-atp/advanced-hunting-devicealertevents-table.md) +##### [DeviceFileEvents](microsoft-defender-atp/advanced-hunting-devicefileevents-table.md) +##### [DeviceImageLoadEvents](microsoft-defender-atp/advanced-hunting-deviceimageloadevents-table.md) +##### [DeviceLogonEvents](microsoft-defender-atp/advanced-hunting-devicelogonevents-table.md) +##### [DeviceInfo](microsoft-defender-atp/advanced-hunting-deviceinfo-table.md) +##### [DeviceNetworkInfo](microsoft-defender-atp/advanced-hunting-devicenetworkinfo-table.md) +##### [DeviceEvents](microsoft-defender-atp/advanced-hunting-deviceevents-table.md) +##### [DeviceFileCertificateInfoBeta](microsoft-defender-atp/advanced-hunting-devicefilecertificateinfobeta-table.md) +##### [DeviceNetworkEvents](microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md) +##### [DeviceProcessEvents](microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md) +##### [DeviceRegistryEvents](microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md) +##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md) +##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md) +##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md) +##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md) +#### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md) -#### [Microsoft threat protection](windows-defender-atp/threat-protection-integration.md) -##### [Protect users, data, and devices with conditional access](windows-defender-atp/conditional-access-windows-defender-advanced-threat-protection.md) -##### [Microsoft Cloud App Security integration overview](windows-defender-atp/microsoft-cloud-app-security-integration.md) -##### [Information protection in Windows overview](windows-defender-atp/information-protection-in-windows-overview.md) + +#### [Custom detections]() +##### [Understand custom detection rules](microsoft-defender-atp/overview-custom-detections.md) +##### [Create and manage custom detections rules](microsoft-defender-atp/custom-detection-rules.md) + +### [Management and APIs]() +#### [Overview of management and APIs](microsoft-defender-atp/management-apis.md) + +### [Integrations]() +#### [Microsoft Defender ATP integrations](microsoft-defender-atp/threat-protection-integration.md) +#### [Protect users, data, and devices with conditional access](microsoft-defender-atp/conditional-access.md) +#### [Microsoft Cloud App Security integration overview](microsoft-defender-atp/microsoft-cloud-app-security-integration.md) + +### [Information protection in Windows overview]() +#### [Windows integration](microsoft-defender-atp/information-protection-in-windows-overview.md) +#### [Use sensitivity labels to prioritize incident response](microsoft-defender-atp/information-protection-investigation.md) + +### [Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md) + +### [Portal overview](microsoft-defender-atp/portal-overview.md) +### [Microsoft Defender ATP for US Government Community Cloud High customers](microsoft-defender-atp/commercial-gov.md) + + +## [Deployment guide]() +### [Product brief](microsoft-defender-atp/product-brief.md) +### [Prepare deployment](microsoft-defender-atp/prepare-deployment.md) +### [Evaluate capabilities](microsoft-defender-atp/evaluation-lab.md) +### [Production deployment](microsoft-defender-atp/production-deployment.md) +### [Helpful resources](microsoft-defender-atp/helpful-resources.md) + + +## [Get started]() +### [What's new in Microsoft Defender ATP](microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) +### [Minimum requirements](microsoft-defender-atp/minimum-requirements.md) +### [Validate licensing and complete setup](microsoft-defender-atp/licensing.md) +### [Evaluation lab](microsoft-defender-atp/evaluation-lab.md) +### [Preview features](microsoft-defender-atp/preview.md) +### [Data storage and privacy](microsoft-defender-atp/data-storage-privacy.md) +### [Assign user access to the portal](microsoft-defender-atp/assign-portal-access.md) -#### [Microsoft Threat Experts](windows-defender-atp/microsoft-threat-experts.md) - - -#### [Portal overview](windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md) - - - -### [Get started](windows-defender-atp/get-started.md) -#### [What's new in Windows Defender ATP](windows-defender-atp/whats-new-in-windows-defender-atp.md) -#### [Minimum requirements](windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md) -#### [Validate licensing and complete setup](windows-defender-atp/licensing-windows-defender-advanced-threat-protection.md) -#### [Preview features](windows-defender-atp/preview-windows-defender-advanced-threat-protection.md) -#### [Data storage and privacy](windows-defender-atp/data-storage-privacy-windows-defender-advanced-threat-protection.md) -#### [Assign user access to the portal](windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection.md) - -#### [Evaluate Windows Defender ATP](windows-defender-atp/evaluate-atp.md) -#####Evaluate attack surface reduction -###### [Hardware-based isolation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) -###### [Application control](windows-defender-application-control/audit-windows-defender-application-control-policies.md) -###### [Exploit protection](windows-defender-exploit-guard/evaluate-exploit-protection.md) -###### [Network Protection](windows-defender-exploit-guard/evaluate-network-protection.md) -###### [Controlled folder access](windows-defender-exploit-guard/evaluate-controlled-folder-access.md) -###### [Attack surface reduction](windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) -###### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) +### [Evaluate Microsoft Defender ATP]() +#### [Attack surface reduction and next-generation capability evaluation]() +##### [Attack surface reduction and nex-generation evaluation overview](microsoft-defender-atp/evaluate-atp.md) +##### [Hardware-based isolation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) +##### [Application control](windows-defender-application-control/audit-windows-defender-application-control-policies.md) +##### [Exploit protection](microsoft-defender-atp/evaluate-exploit-protection.md) +##### [Network Protection](microsoft-defender-atp/evaluate-network-protection.md) +##### [Controlled folder access](microsoft-defender-atp/evaluate-controlled-folder-access.md) +##### [Attack surface reduction](microsoft-defender-atp/evaluate-attack-surface-reduction.md) +##### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) ##### [Evaluate next generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md) -#### [Access the Windows Defender Security Center Community Center](windows-defender-atp/community-windows-defender-advanced-threat-protection.md) +### [Access the Windows Defender Security Center Community Center](microsoft-defender-atp/community.md) -### [Configure and manage capabilities](windows-defender-atp/onboard.md) -#### [Configure attack surface reduction](windows-defender-atp/configure-attack-surface-reduction.md) -#####Hardware-based isolation -###### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) -###### [Application isolation](windows-defender-application-guard/install-wd-app-guard.md) -####### [Configuration settings](windows-defender-application-guard/configure-wd-app-guard.md) +## [Configure and manage capabilities]() + +### [Configure attack surface reduction]() +#### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md) + + +### [Hardware-based isolation]() +#### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) + +#### [Application isolation]() +##### [Install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) ##### [Application control](windows-defender-application-control/windows-defender-application-control.md) -##### Device control -###### [Control USB devices](device-control/control-usb-devices-using-intune.md) -###### [Device Guard](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) -####### [Memory integrity](windows-defender-exploit-guard/memory-integrity.md) -######## [Hardware qualifications](windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) -######## [Enable HVCI](windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md) -##### [Exploit protection](windows-defender-exploit-guard/enable-exploit-protection.md) -###### [Import/export configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) -##### [Network protection](windows-defender-exploit-guard/enable-network-protection.md) -##### [Controlled folder access](windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md) -##### [Attack surface reduction controls](windows-defender-exploit-guard/enable-attack-surface-reduction.md) -###### [Customize attack surface reduction](windows-defender-exploit-guard/customize-attack-surface-reduction.md) -##### [Network firewall](windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md) + +#### [Device control]() +##### [Control USB devices](device-control/control-usb-devices-using-intune.md) + +##### [Device Guard]() +###### [Code integrity](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) + +###### [Memory integrity]() +####### [Understand memory integrity](device-guard/memory-integrity.md) +####### [Hardware qualifications](device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) +####### [Enable HVCI](device-guard/enable-virtualization-based-protection-of-code-integrity.md) + +#### [Exploit protection]() +##### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md) +##### [Import/export configurations](microsoft-defender-atp/import-export-exploit-protection-emet-xml.md) + +#### [Network protection](microsoft-defender-atp/enable-network-protection.md) +#### [Controlled folder access](microsoft-defender-atp/enable-controlled-folders.md) + +#### [Attack surface reduction controls]() +##### [Enable attack surface reduction rules](microsoft-defender-atp/enable-attack-surface-reduction.md) +##### [Customize attack surface reduction](microsoft-defender-atp/customize-attack-surface-reduction.md) + +#### [Network firewall](windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md) -#### [Configure next generation protection](windows-defender-antivirus/configure-windows-defender-antivirus-features.md) -##### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -###### [Enable cloud-delivered protection](windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) -###### [Specify the cloud-delivered protection level](windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md) -###### [Configure and validate network connections](windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md) -###### [Enable Block at first sight](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md) -###### [Configure the cloud block timeout period](windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md) -##### [Configure behavioral, heuristic, and real-time protection](windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md) -###### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) -###### [Enable and configure always-on protection and monitoring](windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) -##### [Antivirus on Windows Server 2016](windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md) -##### [Antivirus compatibility](windows-defender-antivirus/windows-defender-antivirus-compatibility.md) -###### [Use limited periodic antivirus scanning](windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md) -##### [Deploy, manage updates, and report on antivirus](windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md) -###### [Deploy and enable antivirus](windows-defender-antivirus/deploy-windows-defender-antivirus.md) -####### [Deployment guide for VDI environments](windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md) -###### [Report on antivirus protection](windows-defender-antivirus/report-monitor-windows-defender-antivirus.md) -####### [Troubleshoot antivirus reporting in Update Compliance](windows-defender-antivirus/troubleshoot-reporting.md) -###### [Manage updates and apply baselines](windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md) -####### [Manage protection and definition updates](windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md) -####### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md) -####### [Manage updates for endpoints that are out of date](windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md) -####### [Manage event-based forced updates](windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md) -####### [Manage updates for mobile devices and VMs](windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md) +### [Configure next generation protection]() +#### [Configure Windows Defender Antivirus features](windows-defender-antivirus/configure-windows-defender-antivirus-features.md) -##### [Customize, initiate, and review the results of scans and remediation](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) -###### [Configure and validate exclusions in antivirus scans](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) -####### [Configure antivirus exclusions Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) -###### [Configure scanning antivirus options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) -###### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -###### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) -###### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) -###### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) -###### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) +#### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) +##### [Enable cloud-delivered protection](windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) +##### [Specify the cloud-delivered protection level](windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md) +##### [Configure and validate network connections](windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md) +##### [Prevent security settings changes with tamper protection](windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md) +##### [Enable Block at first sight](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md) +##### [Configure the cloud block timeout period](windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md) + +#### [Configure behavioral, heuristic, and real-time protection]() +##### [Configuration overview](windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md) +##### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) +##### [Enable and configure always-on protection and monitoring](windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) + +#### [Antivirus on Windows Server 2016](windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md) + +#### [Antivirus compatibility]() +##### [Compatibility charts](windows-defender-antivirus/windows-defender-antivirus-compatibility.md) +##### [Use limited periodic antivirus scanning](windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md) + +#### [Deploy, manage updates, and report on antivirus]() +##### [Preparing to deploy](windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md) +##### [Deploy and enable antivirus](windows-defender-antivirus/deploy-windows-defender-antivirus.md) +###### [Deployment guide for VDI environments](windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md) + +##### [Report on antivirus protection]() +###### [Review protection status and alerts](windows-defender-antivirus/report-monitor-windows-defender-antivirus.md) +###### [Troubleshoot antivirus reporting in Update Compliance](windows-defender-antivirus/troubleshoot-reporting.md) + +##### [Manage updates and apply baselines]() +###### [Learn about the different kinds of updates](windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md) +###### [Manage protection and security intelligence updates](windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md) +###### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md) +###### [Manage updates for endpoints that are out of date](windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md) +###### [Manage event-based forced updates](windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md) +###### [Manage updates for mobile devices and VMs](windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md) + +#### [Customize, initiate, and review the results of scans and remediation]() +##### [Configuration overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) + +##### [Configure and validate exclusions in antivirus scans]() +###### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) +###### [Configure antivirus exclusions Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) + +##### [Configure scanning antivirus options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) +##### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) +##### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) +##### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) +##### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) +##### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) + +#### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) + +#### [Manage antivirus in your business]() +##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) +##### [Use Group Policy settings to configure and manage antivirus](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) +##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage antivirus](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) +##### [Use PowerShell cmdlets to configure and manage antivirus](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) +##### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) +##### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) + +#### [Manage scans and remediation]() +##### [Management overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) + +##### [Configure and validate exclusions in antivirus scans]() +###### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) +###### [Configure antivirus exclusions on Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) + +##### [Configure scanning options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) + +#### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) +##### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) +##### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) +##### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) +##### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) +##### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) ##### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) -##### [Manage antivirus in your business](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -###### [Use Group Policy settings to configure and manage antivirus](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -###### [Use System Center Configuration Manager and Microsoft Intune to configure and manage antivirus](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) -###### [Use PowerShell cmdlets to configure and manage antivirus](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) -###### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) -###### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) -##### [Manage scans and remediation](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) -###### [Configure and validate exclusions in antivirus scans](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) -####### [Configure antivirus exclusions on Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) -###### [Configure scanning options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) -###### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -###### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) -###### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) -###### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) -###### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) -###### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) -##### [Manage next generation protection in your business](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -###### [Use Microsoft Intune and System Center Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) -###### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -###### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) -###### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) -###### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) +#### [Manage next generation protection in your business]() +##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) +##### [Use Microsoft Intune and System Center Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) +##### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) +##### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) +##### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) +##### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) -#### [Configure Secure score dashboard security controls](windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md) +### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md) +#### [What's New](microsoft-defender-atp/mac-whatsnew.md) +#### [Deploy]() +##### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md) +##### [JAMF-based deployment](microsoft-defender-atp/mac-install-with-jamf.md) +##### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md) +##### [Manual deployment](microsoft-defender-atp/mac-install-manually.md) +#### [Update](microsoft-defender-atp/mac-updates.md) +#### [Configure]() +##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md) +##### [Set preferences](microsoft-defender-atp/mac-preferences.md) +##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md) +#### [Troubleshoot]() +##### [Troubleshoot performance issues](microsoft-defender-atp/mac-support-perf.md) +##### [Troubleshoot kernel extension issues](microsoft-defender-atp/mac-support-kext.md) +#### [Privacy](microsoft-defender-atp/mac-privacy.md) +#### [Resources](microsoft-defender-atp/mac-resources.md) -#### Management and API support -##### [Onboard machines](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md) -###### [Onboard previous versions of Windows](windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md) -###### [Onboard Windows 10 machines](windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md) -####### [Onboard machines using Group Policy](windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md) -####### [Onboard machines using System Center Configuration Manager](windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -####### [Onboard machines using Mobile Device Management tools](windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) -######## [Onboard machines using Microsoft Intune](windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) -####### [Onboard machines using a local script](windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md) -####### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) -###### [Onboard servers](windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md) -###### [Onboard non-Windows machines](windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) -###### [Run a detection test on a newly onboarded machine](windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md) -###### [Run simulated attacks on machines](windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md) -###### [Configure proxy and Internet connectivity settings](windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md) -###### [Troubleshoot onboarding issues](windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) -####### [Troubleshoot subscription and portal access issues](windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) - -##### [Windows Defender ATP API](windows-defender-atp/use-apis.md) -###### [Get started with Windows Defender ATP APIs](windows-defender-atp/apis-intro.md) -####### [Hello World](windows-defender-atp/api-hello-world.md) -####### [Get access with application context](windows-defender-atp/exposed-apis-create-app-webapp.md) -####### [Get access with user context](windows-defender-atp/exposed-apis-create-app-nativeapp.md) -###### [APIs](windows-defender-atp/exposed-apis-list.md) +### [Configure Secure score dashboard security controls](microsoft-defender-atp/secure-score-dashboard.md) -####### [Advanced Hunting](windows-defender-atp/run-advanced-query-api.md) +### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md) -####### [Alert](windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md) -######## [List alerts](windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md) -######## [Create alert](windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md) -######## [Update Alert](windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md) -######## [Get alert information by ID](windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md) -######## [Get alert related domains information](windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md) -######## [Get alert related file information](windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md) -######## [Get alert related IPs information](windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md) -######## [Get alert related machine information](windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md) -######## [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md) +### [Management and API support]() +#### [Onboard devices to the service]() +##### [Onboard machines to Microsoft Defender ATP](microsoft-defender-atp/onboard-configure.md) +##### [Onboard previous versions of Windows](microsoft-defender-atp/onboard-downlevel.md) +##### [Onboard Windows 10 machines]() +###### [Onboarding tools and methods](microsoft-defender-atp/configure-endpoints.md) +###### [Onboard machines using Group Policy](microsoft-defender-atp/configure-endpoints-gp.md) +###### [Onboard machines using System Center Configuration Manager](microsoft-defender-atp/configure-endpoints-sccm.md) +###### [Onboard machines using Mobile Device Management tools](microsoft-defender-atp/configure-endpoints-mdm.md) +###### [Onboard machines using a local script](microsoft-defender-atp/configure-endpoints-script.md) +###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](microsoft-defender-atp/configure-endpoints-vdi.md) -####### [Machine](windows-defender-atp/machine-windows-defender-advanced-threat-protection-new.md) -######## [List machines](windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md) -######## [Get machine by ID](windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md) -######## [Get machine log on users](windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md) -######## [Get machine related alerts](windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md) -######## [Add or Remove machine tags](windows-defender-atp/add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md) -######## [Find machines by IP](windows-defender-atp/find-machines-by-ip-windows-defender-advanced-threat-protection-new.md) - -####### [Machine Action](windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md) -######## [List Machine Actions](windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection-new.md) -######## [Get Machine Action](windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection-new.md) -######## [Collect investigation package](windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md) -######## [Get investigation package SAS URI](windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md) -######## [Isolate machine](windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md) -######## [Release machine from isolation](windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md) -######## [Restrict app execution](windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md) -######## [Remove app restriction](windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md) -######## [Run antivirus scan](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md) -######## [Offboard machine](windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md) -######## [Stop and quarantine file](windows-defender-atp/stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md) -######## [Initiate investigation (preview)](windows-defender-atp/initiate-autoir-investigation-windows-defender-advanced-threat-protection-new.md) - -####### [Indicators (preview)](windows-defender-atp/ti-indicator-windows-defender-advanced-threat-protection-new.md) -######## [Submit Indicator](windows-defender-atp/post-ti-indicator-windows-defender-advanced-threat-protection-new.md) -######## [List Indicators](windows-defender-atp/get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md) -######## [Delete Indicator](windows-defender-atp/delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md) - -####### Domain -######## [Get domain related alerts](windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md) -######## [Get domain related machines](windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md) -######## [Get domain statistics](windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md) -######## [Is domain seen in organization](windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md) - -####### [File](windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md) -######## [Get file information](windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md) -######## [Get file related alerts](windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md) -######## [Get file related machines](windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md) -######## [Get file statistics](windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md) - -####### IP -######## [Get IP related alerts](windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md) -######## [Get IP related machines](windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md) -######## [Get IP statistics](windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md) -######## [Is IP seen in organization](windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md) - -####### [User](windows-defender-atp/user-windows-defender-advanced-threat-protection-new.md) -######## [Get user related alerts](windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md) -######## [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md) +##### [Onboard servers](microsoft-defender-atp/configure-server-endpoints.md) +##### [Onboard non-Windows machines](microsoft-defender-atp/configure-endpoints-non-windows.md) +##### [Onboard machines without Internet access](microsoft-defender-atp/onboard-offline-machines.md) +##### [Run a detection test on a newly onboarded machine](microsoft-defender-atp/run-detection-test.md) +##### [Run simulated attacks on machines](microsoft-defender-atp/attack-simulations.md) +##### [Configure proxy and Internet connectivity settings](microsoft-defender-atp/configure-proxy-internet.md) +##### [Create an onboarding or offboarding notification rule](microsoft-defender-atp/onboarding-notification.md) -###### How to use APIs - Samples -####### Advanced Hunting API -######## [Schedule advanced Hunting using Microsoft Flow](windows-defender-atp/run-advanced-query-sample-ms-flow.md) -######## [Advanced Hunting using PowerShell](windows-defender-atp/run-advanced-query-sample-powershell.md) -######## [Advanced Hunting using Python](windows-defender-atp/run-advanced-query-sample-python.md) -######## [Create custom Power BI reports](windows-defender-atp/run-advanced-query-sample-power-bi-app-token.md) -####### Multiple APIs -######## [PowerShell](windows-defender-atp/exposed-apis-full-sample-powershell.md) -####### [Using OData Queries](windows-defender-atp/exposed-apis-odata-samples.md) +##### [Troubleshoot onboarding issues]() +###### [Troubleshoot issues during onboarding](microsoft-defender-atp/troubleshoot-onboarding.md) +###### [Troubleshoot subscription and portal access issues](microsoft-defender-atp/troubleshoot-onboarding-error-messages.md) + +#### [Microsoft Defender ATP API]() +##### [Get started with Microsoft Defender ATP APIs]() +###### [Microsoft Defender ATP API license and terms](microsoft-defender-atp/api-terms-of-use.md) +###### [Access the Microsoft Defender ATP APIs](microsoft-defender-atp/apis-intro.md) +###### [Hello World](microsoft-defender-atp/api-hello-world.md) +###### [Get access with application context](microsoft-defender-atp/exposed-apis-create-app-webapp.md) +###### [Get access with user context](microsoft-defender-atp/exposed-apis-create-app-nativeapp.md) +###### [Get partner application access](microsoft-defender-atp/exposed-apis-create-app-partners.md) + +##### [Microsoft Defender ATP APIs Schema]() +###### [Supported Microsoft Defender ATP APIs](microsoft-defender-atp/exposed-apis-list.md) +###### [Advanced Hunting](microsoft-defender-atp/run-advanced-query-api.md) + +###### [Alert]() +####### [Alert methods and properties](microsoft-defender-atp/alerts.md) +####### [List alerts](microsoft-defender-atp/get-alerts.md) +####### [Create alert](microsoft-defender-atp/create-alert-by-reference.md) +####### [Update Alert](microsoft-defender-atp/update-alert.md) +####### [Get alert information by ID](microsoft-defender-atp/get-alert-info-by-id.md) +####### [Get alert related domains information](microsoft-defender-atp/get-alert-related-domain-info.md) +####### [Get alert related file information](microsoft-defender-atp/get-alert-related-files-info.md) +####### [Get alert related IPs information](microsoft-defender-atp/get-alert-related-ip-info.md) +####### [Get alert related machine information](microsoft-defender-atp/get-alert-related-machine-info.md) +####### [Get alert related user information](microsoft-defender-atp/get-alert-related-user-info.md) + +###### [Machine]() +####### [Machine methods and properties](microsoft-defender-atp/machine.md) +####### [List machines](microsoft-defender-atp/get-machines.md) +####### [Get machine by ID](microsoft-defender-atp/get-machine-by-id.md) +####### [Get machine log on users](microsoft-defender-atp/get-machine-log-on-users.md) +####### [Get machine related alerts](microsoft-defender-atp/get-machine-related-alerts.md) +####### [Get installed software](microsoft-defender-atp/get-installed-software.md) +####### [Get discovered vulnerabilities](microsoft-defender-atp/get-discovered-vulnerabilities.md) +####### [Get security recommendation](microsoft-defender-atp/get-security-recommendations.md) +####### [Add or Remove machine tags](microsoft-defender-atp/add-or-remove-machine-tags.md) +####### [Find machines by IP](microsoft-defender-atp/find-machines-by-ip.md) + +###### [Machine Action]() +####### [Machine Action methods and properties](microsoft-defender-atp/machineaction.md) +####### [List Machine Actions](microsoft-defender-atp/get-machineactions-collection.md) +####### [Get Machine Action](microsoft-defender-atp/get-machineaction-object.md) +####### [Collect investigation package](microsoft-defender-atp/collect-investigation-package.md) +####### [Get investigation package SAS URI](microsoft-defender-atp/get-package-sas-uri.md) +####### [Isolate machine](microsoft-defender-atp/isolate-machine.md) +####### [Release machine from isolation](microsoft-defender-atp/unisolate-machine.md) +####### [Restrict app execution](microsoft-defender-atp/restrict-code-execution.md) +####### [Remove app restriction](microsoft-defender-atp/unrestrict-code-execution.md) +####### [Run antivirus scan](microsoft-defender-atp/run-av-scan.md) +####### [Offboard machine](microsoft-defender-atp/offboard-machine-api.md) +####### [Stop and quarantine file](microsoft-defender-atp/stop-and-quarantine-file.md) + +###### [Automated Investigation]() +####### [Investigation methods and properties](microsoft-defender-atp/investigation.md) +####### [List Investigation](microsoft-defender-atp/get-investigation-collection.md) +####### [Get Investigation](microsoft-defender-atp/get-investigation-object.md) +####### [Start Investigation](microsoft-defender-atp/initiate-autoir-investigation.md) + +###### [Indicators]() +####### [Indicators methods and properties](microsoft-defender-atp/ti-indicator.md) +####### [Submit Indicator](microsoft-defender-atp/post-ti-indicator.md) +####### [List Indicators](microsoft-defender-atp/get-ti-indicators-collection.md) +####### [Delete Indicator](microsoft-defender-atp/delete-ti-indicator-by-id.md) + +###### [Domain]() +####### [Get domain related alerts](microsoft-defender-atp/get-domain-related-alerts.md) +####### [Get domain related machines](microsoft-defender-atp/get-domain-related-machines.md) +####### [Get domain statistics](microsoft-defender-atp/get-domain-statistics.md) + +###### [File]() +####### [File methods and properties](microsoft-defender-atp/files.md) +####### [Get file information](microsoft-defender-atp/get-file-information.md) +####### [Get file related alerts](microsoft-defender-atp/get-file-related-alerts.md) +####### [Get file related machines](microsoft-defender-atp/get-file-related-machines.md) +####### [Get file statistics](microsoft-defender-atp/get-file-statistics.md) + +###### [IP]() +####### [Get IP related alerts](microsoft-defender-atp/get-ip-related-alerts.md) +####### [Get IP statistics](microsoft-defender-atp/get-ip-statistics.md) + +###### [User]() +####### [User methods](microsoft-defender-atp/user.md) +####### [Get user related alerts](microsoft-defender-atp/get-user-related-alerts.md) +####### [Get user related machines](microsoft-defender-atp/get-user-related-machines.md) + +###### [Score]() +####### [Score methods and properties](microsoft-defender-atp/score.md) +####### [List exposure score by machine group](microsoft-defender-atp/get-machine-group-exposure-score.md) +####### [Get exposure score](microsoft-defender-atp/get-exposure-score.md) +####### [Get device secure score](microsoft-defender-atp/get-device-secure-score.md) + +###### [Software]() +####### [Software methods and properties](microsoft-defender-atp/software.md) +####### [List software](microsoft-defender-atp/get-software.md) +####### [Get software by Id](microsoft-defender-atp/get-software-by-id.md) +####### [List software version distribution](microsoft-defender-atp/get-software-ver-distribution.md) +####### [List machines by software](microsoft-defender-atp/get-machines-by-software.md) +####### [List vulnerabilities by software](microsoft-defender-atp/get-vuln-by-software.md) + +###### [Vulnerability]() +####### [Vulnerability methods and properties](microsoft-defender-atp/vulnerability.md) +####### [Get all vulnerabilities](microsoft-defender-atp/get-all-vulnerabilities.md) +####### [Get vulnerability by Id](microsoft-defender-atp/get-vulnerability-by-id.md) +####### [List machines by vulnerability](microsoft-defender-atp/get-machines-by-vulnerability.md) + +###### [Recommendation]() +####### [Recommendation methods and properties](microsoft-defender-atp/recommendation.md) +####### [List all recommendations](microsoft-defender-atp/get-all-recommendations.md) +####### [Get recommendation by Id](microsoft-defender-atp/get-recommendation-by-id.md) +####### [Get recommendation by software](microsoft-defender-atp/get-recommendation-software.md) +####### [Get recommendation by machines](microsoft-defender-atp/get-recommendation-machines.md) +####### [Get recommendation by vulnerabilities](microsoft-defender-atp/get-recommendation-vulnerabilities.md) + +##### [How to use APIs - Samples]() +###### [Microsoft Flow](microsoft-defender-atp/api-microsoft-flow.md) +###### [Power BI](microsoft-defender-atp/api-power-bi.md) +###### [Advanced Hunting using Python](microsoft-defender-atp/run-advanced-query-sample-python.md) +###### [Advanced Hunting using PowerShell](microsoft-defender-atp/run-advanced-query-sample-powershell.md) +###### [Using OData Queries](microsoft-defender-atp/exposed-apis-odata-samples.md) + +#### [Windows updates (KB) info]() +##### [Get KbInfo collection](microsoft-defender-atp/get-kbinfo-collection.md) + +#### [Common Vulnerabilities and Exposures (CVE) to KB map]() +##### [Get CVE-KB map](microsoft-defender-atp/get-cvekbmap-collection.md) + +#### [Pull detections to your SIEM tools]() +#### [Raw data streaming API]() +##### [Raw data streaming (preview)](microsoft-defender-atp/raw-data-export.md) +##### [Stream advanced hunting events to Azure Events hub](microsoft-defender-atp/raw-data-export-event-hub.md) +##### [Stream advanced hunting events to your storage account](microsoft-defender-atp/raw-data-export-storage.md) -#####Windows updates (KB) info -###### [Get KbInfo collection](windows-defender-atp/get-kbinfo-collection-windows-defender-advanced-threat-protection.md) -#####Common Vulnerabilities and Exposures (CVE) to KB map -###### [Get CVE-KB map](windows-defender-atp/get-cvekbmap-collection-windows-defender-advanced-threat-protection.md) +#### [SIEM integration]() +##### [Understand threat intelligence concepts](microsoft-defender-atp/threat-indicator-concepts.md) +##### [Learn about different ways to pull detections](microsoft-defender-atp/configure-siem.md) +##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md) +##### [Configure Splunk to pull detections](microsoft-defender-atp/configure-splunk.md) +##### [Configure HP ArcSight to pull detections](microsoft-defender-atp/configure-arcsight.md) +##### [Microsoft Defender ATP detection fields](microsoft-defender-atp/api-portal-mapping.md) +##### [Pull detections using SIEM REST API](microsoft-defender-atp/pull-alerts-using-rest-api.md) +##### [Troubleshoot SIEM tool integration issues](microsoft-defender-atp/troubleshoot-siem.md) + + +#### [Reporting]() +##### [Power BI - How to use API - Samples](microsoft-defender-atp/api-power-bi.md) +##### [Create and build Power BI reports using Microsoft Defender ATP data connectors (deprecated)](microsoft-defender-atp/powerbi-reports.md) +##### [Threat protection reports](microsoft-defender-atp/threat-protection-reports.md) +##### [Machine health and compliance reports](microsoft-defender-atp/machine-reports.md) + +#### [Partners & APIs]() +##### [Partner applications](microsoft-defender-atp/partner-applications.md) +##### [Connected applications](microsoft-defender-atp/connected-applications.md) +##### [API explorer](microsoft-defender-atp/api-explorer.md) + + +#### [Manage machine configuration]() +##### [Ensure your machines are configured properly](microsoft-defender-atp/configure-machines.md) +##### [Monitor and increase machine onboarding](microsoft-defender-atp/configure-machines-onboarding.md) +##### [Increase compliance to the security baseline](microsoft-defender-atp/configure-machines-security-baseline.md) +##### [Optimize ASR rule deployment and detections](microsoft-defender-atp/configure-machines-asr.md) + + +#### [Role-based access control]() +##### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md) +##### [Create and manage roles](microsoft-defender-atp/user-roles.md) +##### [Create and manage machine groups]() +###### [Using machine groups](microsoft-defender-atp/machine-groups.md) +###### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md) + +#### [Configure managed security service provider (MSSP) integration](microsoft-defender-atp/configure-mssp-support.md) + +## [Partner integration scenarios]() +### [Technical partner opportunities](microsoft-defender-atp/partner-integration.md) +### [Managed security service provider opportunity](microsoft-defender-atp/mssp-support.md) +### [Become a Microsoft Defender ATP partner](microsoft-defender-atp/get-started-partner-integration.md) + + +## [Configure Microsoft threat protection integration]() +### [Configure conditional access](microsoft-defender-atp/configure-conditional-access.md) +### [Configure Microsoft Cloud App Security integration](microsoft-defender-atp/microsoft-cloud-app-security-config.md) +### [Configure information protection in Windows](microsoft-defender-atp/information-protection-in-windows-config.md) + +## [Configure portal settings]() +### [Set up preferences](microsoft-defender-atp/preferences-setup.md) +### [General]() +#### [Update data retention settings](microsoft-defender-atp/data-retention-settings.md) +#### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md) +#### [Enable and create Power BI reports using Windows Defender Security center data](microsoft-defender-atp/powerbi-reports.md) +#### [Enable Secure score security controls](microsoft-defender-atp/enable-secure-score.md) +#### [Configure advanced features](microsoft-defender-atp/advanced-features.md) + +### [Permissions]() +#### [Use basic permissions to access the portal](microsoft-defender-atp/basic-permissions.md) +#### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md) +##### [Create and manage roles](microsoft-defender-atp/user-roles.md) +##### [Create and manage machine groups](microsoft-defender-atp/machine-groups.md) +###### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md) + +### [APIs]() +#### [Enable Threat intel (Deprecated)](microsoft-defender-atp/enable-custom-ti.md) +#### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md) - -##### API for custom alerts -###### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md) -###### [Use the threat intelligence API to create custom alerts](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md) -###### [Create custom threat intelligence alerts](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md) -###### [PowerShell code examples](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md) -###### [Python code examples](windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md) -###### [Experiment with custom threat intelligence alerts](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md) -###### [Troubleshoot custom threat intelligence issues](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) +### [Rules]() +#### [Manage suppression rules](microsoft-defender-atp/manage-suppression-rules.md) +#### [Manage indicators](microsoft-defender-atp/manage-indicators.md) +#### [Manage automation file uploads](microsoft-defender-atp/manage-automation-file-uploads.md) +#### [Manage automation folder exclusions](microsoft-defender-atp/manage-automation-folder-exclusions.md) - -##### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) -###### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) -###### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md) -###### [Configure HP ArcSight to pull alerts](windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md) -###### [Windows Defender ATP SIEM alert API fields](windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md) -###### [Pull alerts using SIEM REST API](windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) -###### [Troubleshoot SIEM tool integration issues](windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md) - - -##### Reporting -###### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md) -###### [Threat protection reports](windows-defender-atp/threat-protection-reports-windows-defender-advanced-threat-protection.md) -###### [Machine health and compliance reports](windows-defender-atp/machine-reports-windows-defender-advanced-threat-protection.md) - -##### Role-based access control -###### [Manage portal access using RBAC](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md) -####### [Create and manage roles](windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md) -####### [Create and manage machine groups](windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md) -######## [Create and manage machine tags](windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md) - - -##### [Configure managed security service provider (MSSP) support](windows-defender-atp/configure-mssp-support-windows-defender-advanced-threat-protection.md) - - -#### [Configure and manage Microsoft Threat Experts capabilities](windows-defender-atp/configure-microsoft-threat-experts.md) - - - -#### Configure Microsoft threat protection integration -##### [Configure conditional access](windows-defender-atp/configure-conditional-access-windows-defender-advanced-threat-protection.md) -##### [Configure Microsoft Cloud App Security integration](windows-defender-atp/microsoft-cloud-app-security-config.md) -##### [Configure information protection in Windows](windows-defender-atp/information-protection-in-windows-config.md) - - - - -#### [Configure Windows Defender Security Center settings](windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md) -##### General -###### [Update data retention settings](windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md) -###### [Configure alert notifications](windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md) -###### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md) -###### [Enable Secure score security controls](windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md) -###### [Configure advanced features](windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md) - -##### Permissions -###### [Use basic permissions to access the portal](windows-defender-atp/basic-permissions-windows-defender-advanced-threat-protection.md) -###### [Manage portal access using RBAC](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md) -####### [Create and manage roles](windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md) -####### [Create and manage machine groups](windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md) -######## [Create and manage machine tags](windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md) - -##### APIs -###### [Enable Threat intel](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md) -###### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) - -#####Rules -###### [Manage suppression rules](windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md) -###### [Manage automation allowed/blocked lists](windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -###### [Manage allowed/blocked lists](windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -###### [Manage automation file uploads](windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) -###### [Manage automation folder exclusions](windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) - -#####Machine management -###### [Onboarding machines](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md) -###### [Offboarding machines](windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md) - -##### [Configure Windows Defender Security Center time zone settings](windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md) - - -### [Troubleshoot Windows Defender ATP](windows-defender-atp/troubleshoot-wdatp.md) -####Troubleshoot sensor state -##### [Check sensor state](windows-defender-atp/check-sensor-status-windows-defender-advanced-threat-protection.md) -##### [Fix unhealthy sensors](windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) -##### [Inactive machines](windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) -##### [Misconfigured machines](windows-defender-atp/fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) -##### [Review sensor events and errors on machines with Event Viewer](windows-defender-atp/event-error-codes-windows-defender-advanced-threat-protection.md) - -#### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md) -##### [Check service health](windows-defender-atp/service-status-windows-defender-advanced-threat-protection.md) - -####Troubleshoot attack surface reduction -##### [Network protection](windows-defender-exploit-guard/troubleshoot-np.md) -##### [Attack surface reduction rules](windows-defender-exploit-guard/troubleshoot-asr.md) -##### [Collect diagnostic data for files](windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md) +### [Machine management]() +#### [Onboarding machines](microsoft-defender-atp/onboard-configure.md) +#### [Offboarding machines](microsoft-defender-atp/offboard-machines.md) -#### [Troubleshoot next generation protection](windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md) +### [Configure Microsoft Defender Security Center time zone settings](microsoft-defender-atp/time-settings.md) + + + + + + + +## [Troubleshoot Microsoft Defender ATP]() +### [Troubleshoot sensor state]() +#### [Check sensor state](microsoft-defender-atp/check-sensor-status.md) +#### [Fix unhealthy sensors](microsoft-defender-atp/fix-unhealthy-sensors.md) +#### [Inactive machines](microsoft-defender-atp/fix-unhealthy-sensors.md#inactive-machines) +#### [Misconfigured machines](microsoft-defender-atp/fix-unhealthy-sensors.md#misconfigured-machines) +#### [Review sensor events and errors on machines with Event Viewer](microsoft-defender-atp/event-error-codes.md) + +### [Troubleshoot Microsoft Defender ATP service issues]() +#### [Troubleshoot service issues](microsoft-defender-atp/troubleshoot-mdatp.md) +#### [Check service health](microsoft-defender-atp/service-status.md) + +### [Troubleshoot live response issues]() +#### [Troubleshoot issues related to live response](microsoft-defender-atp/troubleshoot-live-response.md) + +### [Troubleshoot attack surface reduction]() +#### [Network protection](microsoft-defender-atp/troubleshoot-np.md) +#### [Attack surface reduction rules](microsoft-defender-atp/troubleshoot-asr.md) + +### [Troubleshoot next generation protection](windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md) + + ## [Security intelligence](intelligence/index.md) ### [Understand malware & other threats](intelligence/understanding-malware.md) @@ -467,9 +664,9 @@ #### [Family options](windows-defender-security-center/wdsc-family-options.md) -### [SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) -#### [SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md) -#### [Set up and use SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) +### [Windows Defender SmartScreen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) +#### [Windows Defender SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md) +#### [Set up and use Windows Defender SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) ### [Windows Defender Device Guard: virtualization-based security and WDAC](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) @@ -506,7 +703,7 @@ ##### [Planning and deploying advanced security audit policies](auditing/planning-and-deploying-advanced-security-audit-policies.md) ##### [Advanced security auditing FAQ](auditing/advanced-security-auditing-faq.md) ###### [Which editions of Windows support advanced audit policy configuration](auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md) -###### [How to list XML elements in ](auditing/how-to-list-xml-elements-in-eventdata.md) +###### [How to list XML elements in \](auditing/how-to-list-xml-elements-in-eventdata.md) ###### [Using advanced security auditing options to monitor dynamic access control objects](auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) ####### [Monitor the central access policies that apply on a file server](auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md) @@ -840,8 +1037,8 @@ ####### [Event 1105 S: Event log automatic backup.](auditing/event-1105.md) ####### [Event 1108 S: The event logging service encountered an error while processing an incoming event published from %1.](auditing/event-1108.md) ###### [Appendix A: Security monitoring recommendations for many audit events](auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md) -###### [Registry (Global Object Access Auditing) ](auditing/registry-global-object-access-auditing.md) -###### [File System (Global Object Access Auditing) ](auditing/file-system-global-object-access-auditing.md) +###### [Registry (Global Object Access Auditing)](auditing/registry-global-object-access-auditing.md) +###### [File System (Global Object Access Auditing)](auditing/file-system-global-object-access-auditing.md) @@ -931,13 +1128,13 @@ ###### [Network access: Remotely accessible registry paths](security-policy-settings/network-access-remotely-accessible-registry-paths.md) ###### [Network access: Remotely accessible registry paths and subpaths](security-policy-settings/network-access-remotely-accessible-registry-paths-and-subpaths.md) ###### [Network access: Restrict anonymous access to Named Pipes and Shares](security-policy-settings/network-access-restrict-anonymous-access-to-named-pipes-and-shares.md) -###### [Network access: Restrict clients allowed to make remote calls to SAM](security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md) +###### [Network access: Restrict clients allowed to make remote calls to SAM](security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md) ###### [Network access: Shares that can be accessed anonymously](security-policy-settings/network-access-shares-that-can-be-accessed-anonymously.md) ###### [Network access: Sharing and security model for local accounts](security-policy-settings/network-access-sharing-and-security-model-for-local-accounts.md) ###### [Network security: Allow Local System to use computer identity for NTLM](security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md) ###### [Network security: Allow LocalSystem NULL session fallback](security-policy-settings/network-security-allow-localsystem-null-session-fallback.md) ###### [Network security: Allow PKU2U authentication requests to this computer to use online identities](security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities.md) -###### [Network security: Configure encryption types allowed for Kerberos Win7 only](security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md) +###### [Network security: Configure encryption types allowed for Kerberos](security-policy-settings/network-security-configure-encryption-types-allowed-for-kerberos.md) ###### [Network security: Do not store LAN Manager hash value on next password change](security-policy-settings/network-security-do-not-store-lan-manager-hash-value-on-next-password-change.md) ###### [Network security: Force logoff when logon hours expire](security-policy-settings/network-security-force-logoff-when-logon-hours-expire.md) ###### [Network security: LAN Manager authentication level](security-policy-settings/network-security-lan-manager-authentication-level.md) @@ -1018,11 +1215,11 @@ ###### [Synchronize directory service data](security-policy-settings/synchronize-directory-service-data.md) ###### [Take ownership of files or other objects](security-policy-settings/take-ownership-of-files-or-other-objects.md) +### Windows security guidance for enterprises -### [Windows security baselines](windows-security-baselines.md) -#### [Security Compliance Toolkit](security-compliance-toolkit-10.md) -#### [Get support](get-support-for-security-baselines.md) - +#### [Windows security baselines](windows-security-configuration-framework/windows-security-baselines.md) +##### [Security Compliance Toolkit](windows-security-configuration-framework/security-compliance-toolkit-10.md) +##### [Get support](windows-security-configuration-framework/get-support-for-security-baselines.md) ### [MBSA removal and alternatives](mbsa-removal-and-guidance.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) diff --git a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md index 842cb0b7bb..e36022563e 100644 --- a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md @@ -2,12 +2,14 @@ title: Advanced security audit policy settings (Windows 10) description: This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. ms.assetid: 93b28b92-796f-4036-a53b-8b9e80f9f171 +ms.reviewer: This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -57,11 +59,13 @@ The security audit policy settings in this category can be used to monitor chang Detailed Tracking security policy settings and audit events can be used to monitor the activities of individual applications and users on that computer, and to understand how a computer is being used. This category includes the following subcategories: -- [Audit DPAPI Activity](audit-dpapi-activity.md) -- [Audit PNP activity](audit-pnp-activity.md) -- [Audit Process Creation](audit-process-creation.md) -- [Audit Process Termination](audit-process-termination.md) -- [Audit RPC Events](audit-rpc-events.md) +- [Audit DPAPI Activity](audit-dpapi-activity.md) +- [Audit PNP activity](audit-pnp-activity.md) +- [Audit Process Creation](audit-process-creation.md) +- [Audit Process Termination](audit-process-termination.md) +- [Audit RPC Events](audit-rpc-events.md) +- [Audit Credential Validation](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-credential-validation) +- [Audit Token Right Adjusted](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-token-right-adjusted) ## DS Access @@ -90,7 +94,7 @@ Logon/Logoff security policy settings and audit events allow you to track attemp ## Object Access -Object Access policy settings and audit events allow you to track attempts to access specific objects or types of objects on a network or computer. To audit attempts to access a file, directory, registry key, or any other object, you must enable the appropriate object Aaccess auditing subcategory for success and/or failure events. For example, the file system subcategory needs to be enabled to audit file operations, and the Registry subcategory needs to be enabled to audit registry accesses. +Object Access policy settings and audit events allow you to track attempts to access specific objects or types of objects on a network or computer. To audit attempts to access a file, directory, registry key, or any other object, you must enable the appropriate Object Access auditing subcategory for success and/or failure events. For example, the file system subcategory needs to be enabled to audit file operations, and the Registry subcategory needs to be enabled to audit registry accesses. Proving that these audit policies are in effect to an external auditor is more difficult. There is no easy way to verify that the proper SACLs are set on all inherited objects. To address this issue, see [Global Object Access Auditing](#global-object-access-auditing). @@ -149,7 +153,7 @@ Resource SACLs are also useful for diagnostic scenarios. For example, setting th > **Note:**  If a file or folder SACL and a Global Object Access Auditing policy setting (or a single registry setting SACL and a Global Object Access Auditing policy setting) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the Global Object Access Auditing policy. This means that an audit event is generated if an activity matches the file or folder SACL or the Global Object Access Auditing policy. -  + This category includes the following subcategories: - [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md) - [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md index 6935b85eb1..99b8a989c4 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing-faq.md @@ -2,12 +2,14 @@ title: Advanced security auditing FAQ (Windows 10) description: This topic for the IT professional lists questions and answers about understanding, deploying, and managing security audit policies. ms.assetid: 80f8f187-0916-43c2-a7e8-ea712b115a06 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -83,7 +85,7 @@ The rules that govern how Group Policy settings are applied propagate to the sub | - | - | - | -| | Detailed File Share Auditing | Success | Failure | Success | | Process Creation Auditing | Disabled | Success | Disabled | -| Logon Auditing | Success | Failure | Failure | +| Logon Auditing | Failure | Success | Failure | ## What is the difference between an object DACL and an object SACL? diff --git a/windows/security/threat-protection/auditing/advanced-security-auditing.md b/windows/security/threat-protection/auditing/advanced-security-auditing.md index 4d960b6b9a..7c55d51d21 100644 --- a/windows/security/threat-protection/auditing/advanced-security-auditing.md +++ b/windows/security/threat-protection/auditing/advanced-security-auditing.md @@ -1,13 +1,15 @@ --- title: Advanced security audit policies (Windows 10) -description: Advanced security audit policy settings are found in Security Settings\\Advanced Audit Policy Configuration\\System Audit Policies and appear to overlap with basic security audit policies, but they are recorded and applied differently. +description: Advanced security audit policy settings may appear to overlap with basic policies, but they are recorded and applied differently. Learn more about them here. ms.assetid: 6FE8AC10-F48E-4BBF-979B-43A5DFDC5DFC +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md index 454c14422b..d212b266b1 100644 --- a/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md +++ b/windows/security/threat-protection/auditing/appendix-a-security-monitoring-recommendations-for-many-audit-events.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # Appendix A: Security monitoring recommendations for many audit events diff --git a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md index 6622f7fc55..f15fee7c4d 100644 --- a/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md +++ b/windows/security/threat-protection/auditing/apply-a-basic-audit-policy-on-a-file-or-folder.md @@ -1,13 +1,15 @@ --- title: Apply a basic audit policy on a file or folder (Windows 10) -description: You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. +description: Apply audit policies to individual files and folders on your computer by setting the permission type to record access attempts in the security log. ms.assetid: 565E7249-5CD0-4B2E-B2C0-B3A0793A51E2 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -37,6 +39,26 @@ To complete this procedure, you must be logged on as a member of the built-in Ad - To audit failure events, click **Fail.** - To audit all events, click **All.** + + +6. In the **Applies to** box, select the object(s) that the audit of events will apply to. These include: + + - **This folder only** + - **This folder, subfolders and files** + - **This folder and subfolders** + - **This folder and files** + - **Subfolders and files only** + - **Subfolders only** + - **Files only** + +7. By default, the selected **Basic Permissions** to audit are the following: + - **Read and execute** + - **List folder contents** + - **Read** + - Additionally, you can choose **Full control**, **Modify**, and/or **Write** permissions with your selected audit combination. + + + > **Important:**  Before setting up auditing for files and folders, you must enable [object access auditing](basic-audit-object-access.md) by defining auditing policy settings for the object access event category. If you do not enable object access auditing, you will receive an error message when you set up auditing for files and folders, and no files or folders will be audited.   ## Additional considerations diff --git a/windows/security/threat-protection/auditing/audit-account-lockout.md b/windows/security/threat-protection/auditing/audit-account-lockout.md index 9cb1d5053c..1ea3e878e6 100644 --- a/windows/security/threat-protection/auditing/audit-account-lockout.md +++ b/windows/security/threat-protection/auditing/audit-account-lockout.md @@ -1,13 +1,16 @@ --- title: Audit Account Lockout (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Account Lockout, which enables you to audit security events that are generated by a failed attempt to log on to an account that is locked out. +description: The policy setting, Audit Account Lockout, enables you to audit security events generated by a failed attempt to log on to an account that is locked out. ms.assetid: da68624b-a174-482c-9bc5-ddddab38e589 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 07/16/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-application-generated.md b/windows/security/threat-protection/auditing/audit-application-generated.md index 10fcf365b8..b594ba40ca 100644 --- a/windows/security/threat-protection/auditing/audit-application-generated.md +++ b/windows/security/threat-protection/auditing/audit-application-generated.md @@ -1,13 +1,16 @@ --- title: Audit Application Generated (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Application Generated, which determines whether the operating system generates audit events when applications attempt to use the Windows Auditing application programming interfaces (APIs). +description: The policy setting, Audit Application Generated, determines if audit events are generated when applications attempt to use the Windows Auditing APIs. ms.assetid: 6c58a365-b25b-42b8-98ab-819002e31871 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -17,24 +20,22 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Application Generated generates events for actions related to Authorization Manager [applications](https://technet.microsoft.com/library/cc770563.aspx). Audit Application Generated subcategory is out of scope of this document, because [Authorization Manager](https://technet.microsoft.com/library/cc726036.aspx) is very rarely in use and it is deprecated starting from Windows Server 2012. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| | Domain Controller | IF | IF | IF | IF | IF – if you use [Authorization Manager](https://technet.microsoft.com/library/cc726036.aspx) in your environment and you need to monitor events related to Authorization Manager [applications](https://technet.microsoft.com/library/cc770563.aspx), enable this subcategory. | | Member Server | IF | IF | IF | IF | IF – if you use [Authorization Manager](https://technet.microsoft.com/library/cc726036.aspx) in your environment and you need to monitor events related to Authorization Manager [applications](https://technet.microsoft.com/library/cc770563.aspx), enable this subcategory. | | Workstation | IF | IF | IF | IF | IF – if you use [Authorization Manager](https://technet.microsoft.com/library/cc726036.aspx) in your environment and you need to monitor events related to Authorization Manager [applications](https://technet.microsoft.com/library/cc770563.aspx), enable this subcategory. | **Events List:** -## 4665: An attempt was made to create an application client context. +- 4665: An attempt was made to create an application client context. -## 4666: An application attempted an operation. +- 4666: An application attempted an operation. -## 4667: An application client context was deleted. - -## 4668: An application was initialized. +- 4667: An application client context was deleted. +- 4668: An application was initialized. diff --git a/windows/security/threat-protection/auditing/audit-application-group-management.md b/windows/security/threat-protection/auditing/audit-application-group-management.md index 54f30393c1..8dce282dfa 100644 --- a/windows/security/threat-protection/auditing/audit-application-group-management.md +++ b/windows/security/threat-protection/auditing/audit-application-group-management.md @@ -1,13 +1,16 @@ --- title: Audit Application Group Management (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Application Group Management, which determines whether the operating system generates audit events when application group management tasks are performed. +description: The policy setting, Audit Application Group Management, determines if audit events are generated when application group management tasks are performed. ms.assetid: 1bcaa41e-5027-4a86-96b7-f04eaf1c0606 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -17,7 +20,6 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Application Group Management generates events for actions related to [application groups](https://technet.microsoft.com/library/cc771579.aspx), such as group creation, modification, addition or removal of group member and some other actions. [Application groups](https://technet.microsoft.com/library/cc771579.aspx) are used by [Authorization Manager](https://technet.microsoft.com/library/cc726036.aspx). @@ -30,23 +32,22 @@ Audit Application Group Management subcategory is out of scope of this document, | Member Server | - | - | - | - | This subcategory is outside the scope of this document. | | Workstation | - | - | - | - | This subcategory is outside the scope of this document. | -## 4783(S): A basic application group was created. +- 4783(S): A basic application group was created. -## 4784(S): A basic application group was changed. +- 4784(S): A basic application group was changed. -## 4785(S): A member was added to a basic application group. +- 4785(S): A member was added to a basic application group. -## 4786(S): A member was removed from a basic application group. +- 4786(S): A member was removed from a basic application group. -## 4787(S): A non-member was added to a basic application group. +- 4787(S): A non-member was added to a basic application group. -## 4788(S): A non-member was removed from a basic application group. +- 4788(S): A non-member was removed from a basic application group. -## 4789(S): A basic application group was deleted. +- 4789(S): A basic application group was deleted. -## 4790(S): An LDAP query group was created. +- 4790(S): An LDAP query group was created. -## 4791(S): An LDAP query group was changed. - -## 4792(S): An LDAP query group was deleted. +- 4791(S): An LDAP query group was changed. +- 4792(S): An LDAP query group was deleted. diff --git a/windows/security/threat-protection/auditing/audit-audit-policy-change.md b/windows/security/threat-protection/auditing/audit-audit-policy-change.md index 46038a5e5c..376cab2bcf 100644 --- a/windows/security/threat-protection/auditing/audit-audit-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-audit-policy-change.md @@ -1,13 +1,16 @@ --- title: Audit Audit Policy Change (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Audit Policy Change, which determines whether the operating system generates audit events when changes are made to audit policy. +description: The Advanced Security Audit policy setting, Audit Audit Policy Change, determines if audit events are generated when changes are made to audit policy. ms.assetid: 7153bf75-6978-4d7e-a821-59a699efb8a9 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-authentication-policy-change.md b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md index 9c4f4f01b9..4a6f754c01 100644 --- a/windows/security/threat-protection/auditing/audit-authentication-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-authentication-policy-change.md @@ -1,13 +1,16 @@ --- title: Audit Authentication Policy Change (Windows 10) -description: This topic for the IT professional describes this Advanced Security Audit policy setting, Audit Authentication Policy Change, which determines whether the operating system generates audit events when changes are made to authentication policy. +description: The Advanced Security Audit policy setting, Audit Authentication Policy Change, determines if audit events are generated when authentication policy is changed. ms.assetid: aa9cea7a-aadf-47b7-b704-ac253b8e79be +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md index d2a34b5e82..bb4d048a5f 100644 --- a/windows/security/threat-protection/auditing/audit-authorization-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-authorization-policy-change.md @@ -1,13 +1,16 @@ --- title: Audit Authorization Policy Change (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Authorization Policy Change, which determines whether the operating system generates audit events when specific changes are made to the authorization policy. +description: The policy setting, Audit Authorization Policy Change, determines if audit events are generated when specific changes are made to the authorization policy. ms.assetid: ca0587a2-a2b3-4300-aa5d-48b4553c3b36 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md index 7248f8b951..f655b5d8c6 100644 --- a/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md +++ b/windows/security/threat-protection/auditing/audit-central-access-policy-staging.md @@ -1,13 +1,16 @@ --- title: Audit Central Access Policy Staging (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Central Access Policy Staging, which determines permissions on a Central Access Policy. +description: The Advanced Security Audit policy setting, Audit Central Access Policy Staging, determines permissions on a Central Access Policy. ms.assetid: D9BB11CE-949A-4B48-82BF-30DC5E6FC67D +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-certification-services.md b/windows/security/threat-protection/auditing/audit-certification-services.md index 109237d268..a1e50c1538 100644 --- a/windows/security/threat-protection/auditing/audit-certification-services.md +++ b/windows/security/threat-protection/auditing/audit-certification-services.md @@ -1,13 +1,16 @@ --- title: Audit Certification Services (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Certification Services, which determines whether the operating system generates events when Active Directory Certificate Services (ADÂ CS) operations are performed. +description: The policy setting, Audit Certification Services, decides if events are generated when Active Directory Certificate Services (ADA CS) operations are performed. ms.assetid: cdefc34e-fb1f-4eff-b766-17713c5a1b03 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -17,7 +20,6 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Certification Services determines whether the operating system generates events when Active Directory Certificate Services (AD CS) operations are performed. Examples of AD CS operations include: @@ -56,65 +58,64 @@ Role-specific subcategories are outside the scope of this document. | Member Server | IF | IF | IF | IF | IF – if a server has the [Active Directory Certificate Services](https://technet.microsoft.com/windowsserver/dd448615.aspx) (AD CS) role installed and you need to monitor AD CS related events, enable this subcategory. | | Workstation | No | No | No | No | [Active Directory Certificate Services](https://technet.microsoft.com/windowsserver/dd448615.aspx) (AD CS) role cannot be installed on client OS. | -## 4868: The certificate manager denied a pending certificate request. +- 4868: The certificate manager denied a pending certificate request. -## 4869: Certificate Services received a resubmitted certificate request. +- 4869: Certificate Services received a resubmitted certificate request. -## 4870: Certificate Services revoked a certificate. +- 4870: Certificate Services revoked a certificate. -## 4871: Certificate Services received a request to publish the certificate revocation list (CRL). +- 4871: Certificate Services received a request to publish the certificate revocation list (CRL). -## 4872: Certificate Services published the certificate revocation list (CRL). +- 4872: Certificate Services published the certificate revocation list (CRL). -## 4873: A certificate request extension changed. +- 4873: A certificate request extension changed. -## 4874: One or more certificate request attributes changed. +- 4874: One or more certificate request attributes changed. -## 4875: Certificate Services received a request to shut down. +- 4875: Certificate Services received a request to shut down. -## 4876: Certificate Services backup started. +- 4876: Certificate Services backup started. -## 4877: Certificate Services backup completed. +- 4877: Certificate Services backup completed. -## 4878: Certificate Services restore started. +- 4878: Certificate Services restore started. -## 4879: Certificate Services restore completed. +- 4879: Certificate Services restore completed. -## 4880: Certificate Services started. +- 4880: Certificate Services started. -## 4881: Certificate Services stopped. +- 4881: Certificate Services stopped. -## 4882: The security permissions for Certificate Services changed. +- 4882: The security permissions for Certificate Services changed. -## 4883: Certificate Services retrieved an archived key. +- 4883: Certificate Services retrieved an archived key. -## 4884: Certificate Services imported a certificate into its database. +- 4884: Certificate Services imported a certificate into its database. -## 4885: The audit filter for Certificate Services changed. +- 4885: The audit filter for Certificate Services changed. -## 4886: Certificate Services received a certificate request. +- 4886: Certificate Services received a certificate request. -## 4887: Certificate Services approved a certificate request and issued a certificate. +- 4887: Certificate Services approved a certificate request and issued a certificate. -## 4888: Certificate Services denied a certificate request. +- 4888: Certificate Services denied a certificate request. -## 4889: Certificate Services set the status of a certificate request to pending. +- 4889: Certificate Services set the status of a certificate request to pending. -## 4890: The certificate manager settings for Certificate Services changed. +- 4890: The certificate manager settings for Certificate Services changed. -## 4891: A configuration entry changed in Certificate Services. +- 4891: A configuration entry changed in Certificate Services. -## 4892: A property of Certificate Services changed. +- 4892: A property of Certificate Services changed. -## 4893: Certificate Services archived a key. +- 4893: Certificate Services archived a key. -## 4894: Certificate Services imported and archived a key. +- 4894: Certificate Services imported and archived a key. -## 4895: Certificate Services published the CA certificate to Active Directory Domain Services. +- 4895: Certificate Services published the CA certificate to Active Directory Domain Services. -## 4896: One or more rows have been deleted from the certificate database. +- 4896: One or more rows have been deleted from the certificate database. -## 4897: Role separation enabled. - -## 4898: Certificate Services loaded a template. +- 4897: Role separation enabled. +- 4898: Certificate Services loaded a template. diff --git a/windows/security/threat-protection/auditing/audit-computer-account-management.md b/windows/security/threat-protection/auditing/audit-computer-account-management.md index 9ba95826d4..ab838fd042 100644 --- a/windows/security/threat-protection/auditing/audit-computer-account-management.md +++ b/windows/security/threat-protection/auditing/audit-computer-account-management.md @@ -1,13 +1,16 @@ --- title: Audit Computer Account Management (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Computer Account Management, which determines whether the operating system generates audit events when a computer account is created, changed, or deleted. +description: The policy setting, Audit Computer Account Management, determines if audit events are generated when a computer account is created, changed, or deleted. ms.assetid: 6c406693-57bf-4411-bb6c-ff83ce548991 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-credential-validation.md b/windows/security/threat-protection/auditing/audit-credential-validation.md index 1053fc3b3e..9ce3b5aa5b 100644 --- a/windows/security/threat-protection/auditing/audit-credential-validation.md +++ b/windows/security/threat-protection/auditing/audit-credential-validation.md @@ -1,13 +1,16 @@ --- title: Audit Credential Validation (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Credential Validation, which determines whether the operating system generates audit events on credentials that are submitted for a user account logon request. +description: The policy setting, Audit Credential Validation, determines if audit events are generated when user account logon request credentials are submitted. ms.assetid: 6654b33a-922e-4a43-8223-ec5086dfc926 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md index c20e709c3f..859859fc2b 100644 --- a/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md +++ b/windows/security/threat-protection/auditing/audit-detailed-directory-service-replication.md @@ -1,13 +1,16 @@ --- title: Audit Detailed Directory Service Replication (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Detailed Directory Service Replication, which determines whether the operating system generates audit events that contain detailed tracking information about data that is replicated between domain controllers. +description: The Audit Detailed Directory Service Replication setting decides if audit events contain detailed tracking info about data replicated between domain controllers ms.assetid: 1b89c8f5-bce7-4b20-8701-42585c7ab993 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-detailed-file-share.md b/windows/security/threat-protection/auditing/audit-detailed-file-share.md index 512ffb1d82..69a9d636c7 100644 --- a/windows/security/threat-protection/auditing/audit-detailed-file-share.md +++ b/windows/security/threat-protection/auditing/audit-detailed-file-share.md @@ -1,13 +1,16 @@ --- title: Audit Detailed File Share (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Detailed File Share, which allows you to audit attempts to access files and folders on a shared folder. +description: The Advanced Security Audit policy setting, Audit Detailed File Share, allows you to audit attempts to access files and folders on a shared folder. ms.assetid: 60310104-b820-4033-a1cb-022a34f064ae +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-directory-service-access.md b/windows/security/threat-protection/auditing/audit-directory-service-access.md index f0d54b7e51..0a13f90a87 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-access.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-access.md @@ -1,13 +1,16 @@ --- title: Audit Directory Service Access (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Access, which determines whether the operating system generates audit events when an Active Directory Domain Services (ADÂ DS) object is accessed. +description: The policy setting Audit Directory Service Access determines if audit events are generated when an Active Directory Domain Services (ADA DS) object is accessed. ms.assetid: ba2562ba-4282-4588-b87c-a3fcb771c7d0 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-directory-service-changes.md b/windows/security/threat-protection/auditing/audit-directory-service-changes.md index a668880442..1a962ee86f 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-changes.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-changes.md @@ -1,13 +1,16 @@ --- title: Audit Directory Service Changes (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Changes, which determines whether the operating system generates audit events when changes are made to objects in Active Directory Domain Services (ADÂ DS). +description: The policy setting Audit Directory Service Changes determines if audit events are generated when objects in Active Directory Domain Services (AD DS) are changed ms.assetid: 9f7c0dd4-3977-47dd-a0fb-ec2f17cad05e +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-directory-service-replication.md b/windows/security/threat-protection/auditing/audit-directory-service-replication.md index 41ced142b1..dffea817d4 100644 --- a/windows/security/threat-protection/auditing/audit-directory-service-replication.md +++ b/windows/security/threat-protection/auditing/audit-directory-service-replication.md @@ -1,13 +1,16 @@ --- title: Audit Directory Service Replication (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Directory Service Replication, which determines whether the operating system generates audit events when replication between two domain controllers begins and ends. +description: Audit Directory Service Replication is a policy setting that decides if audit events are created when replication between two domain controllers begins or ends. ms.assetid: b95d296c-7993-4e8d-8064-a8bbe284bd56 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-distribution-group-management.md b/windows/security/threat-protection/auditing/audit-distribution-group-management.md index 88a2692952..2bacdbe3a1 100644 --- a/windows/security/threat-protection/auditing/audit-distribution-group-management.md +++ b/windows/security/threat-protection/auditing/audit-distribution-group-management.md @@ -1,13 +1,16 @@ --- title: Audit Distribution Group Management (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Distribution Group Management, which determines whether the operating system generates audit events for specific distribution-group management tasks. +description: The policy setting, Audit Distribution Group Management, determines if audit events are generated for specific distribution-group management tasks. ms.assetid: d46693a4-5887-4a58-85db-2f6cba224a66 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -17,7 +20,6 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Distribution Group Management determines whether the operating system generates audit events for specific distribution-group management tasks. This subcategory generates events only on domain controllers. @@ -26,47 +28,46 @@ This subcategory generates events only on domain controllers. This subcategory allows you to audit events generated by changes to distribution groups such as the following: -- Distribution group is created, changed, or deleted. +- Distribution group is created, changed, or deleted. -- Member is added or removed from a distribution group. +- Member is added or removed from a distribution group. If you need to monitor for group type changes, you need to monitor for “[4764](event-4764.md): A group’s type was changed.” “Audit Security Group Management” subcategory success auditing must be enabled. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | IF | No | IF | No | IF - Typically actions related to distribution groups have low security relevance, much more important to monitor Security Group changes. But if you want to monitor for critical distribution groups changes, such as member was added to internal critical distribution group (executives, administrative group, for example), you need to enable this subcategory for Success auditing.
                                  Typically volume of these events is low on domain controllers.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | No | No | No | No | This subcategory generates events only on domain controllers. | -| Workstation | No | No | No | No | This subcategory generates events only on domain controllers. | +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| +| Domain Controller | IF | No | IF | No | IF - Typically, actions related to distribution groups have low security relevance. It is much more important to monitor Security Group changes. However, if you want to monitor for critical distribution groups changes, such as if a member was added to internal critical distribution group (executives, administrative group, for example), you need to enable this subcategory for Success auditing.
                                  Typically, volume of these events is low on domain controllers.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | No | No | No | No | This subcategory generates events only on domain controllers. | +| Workstation | No | No | No | No | This subcategory generates events only on domain controllers. | **Events List:** -- [4749](event-4749.md)(S): A security-disabled global group was created. +- [4749](event-4749.md)(S): A security-disabled global group was created. -- [4750](event-4750.md)(S): A security-disabled global group was changed. +- [4750](event-4750.md)(S): A security-disabled global group was changed. -- [4751](event-4751.md)(S): A member was added to a security-disabled global group. +- [4751](event-4751.md)(S): A member was added to a security-disabled global group. -- [4752](event-4752.md)(S): A member was removed from a security-disabled global group. +- [4752](event-4752.md)(S): A member was removed from a security-disabled global group. -- [4753](event-4753.md)(S): A security-disabled global group was deleted. +- [4753](event-4753.md)(S): A security-disabled global group was deleted. -**4759(S): A security-disabled universal group was created.** See event “[4749](event-4749.md): A security-disabled global group was created.” Event 4759 is the same, but it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4759(S): A security-disabled universal group was created. See event _[4749](event-4749.md): A security-disabled global group was created._ Event 4759 is the same, except it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4760(S): A security-disabled universal group was changed.** See event “[4750](event-4750.md): A security-disabled global group was changed.” Event 4760 is the same, but it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4760(S): A security-disabled universal group was changed. See event _[4750](event-4750.md): A security-disabled global group was changed._ Event 4760 is the same, except it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4761(S): A member was added to a security-disabled universal group.** See event “[4751](event-4751.md): A member was added to a security-disabled global group.” Event 4761 is the same, but it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4761(S): A member was added to a security-disabled universal group. See event _[4751](event-4751.md): A member was added to a security-disabled global group._ Event 4761 is the same, except it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4762(S): A member was removed from a security-disabled universal group.** See event “[4752](event-4752.md): A member was removed from a security-disabled global group.” Event 4762 is the same, but it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4762(S): A member was removed from a security-disabled universal group. See event _[4752](event-4752.md): A member was removed from a security-disabled global group._ Event 4762 is the same, except it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4763(S): A security-disabled universal group was deleted.** See event “[4753](event-4753.md): A security-disabled global group was deleted.” Event 4763 is the same, but it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4763(S): A security-disabled universal group was deleted. See event _[4753](event-4753.md): A security-disabled global group was deleted._ Event 4763 is the same, except it is generated for a **universal** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4744(S): A security-disabled local group was created.** See event “[4749](event-4749.md): A security-disabled global group was created.” Event 4744 is the same, but it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4744(S): A security-disabled local group was created. See event _[4749](event-4749.md): A security-disabled global group was created._ Event 4744 is the same, except it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4745(S): A security-disabled local group was changed.** See event “[4750](event-4750.md): A security-disabled global group was changed.” Event 4745 is the same, but it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4745(S): A security-disabled local group was changed. See event _[4750](event-4750.md): A security-disabled global group was changed._ Event 4745 is the same, except it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4746(S): A member was added to a security-disabled local group.** See event “[4751](event-4751.md): A member was added to a security-disabled global group.” Event 4746 is the same, but it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4746(S): A member was added to a security-disabled local group. See event _[4751](event-4751.md): A member was added to a security-disabled global group._ Event 4746 is the same, except it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**4747(S): A member was removed from a security-disabled local group.** See event “[4752](event-4752.md): A member was removed from a security-disabled global group.” Event 4747 is the same, but it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. - -**4748(S): A security-disabled local group was deleted.** See event “[4753](event-4753.md): A security-disabled global group was deleted.” Event 4748 is the same, but it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4747(S): A member was removed from a security-disabled local group. See event _[4752](event-4752.md): A member was removed from a security-disabled global group._ Event 4747 is the same, except it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4748(S): A security-disabled local group was deleted. See event _[4753](event-4753.md): A security-disabled global group was deleted._ Event 4748 is the same, except it is generated for a **local** distribution group instead of a **global** distribution group. All event fields, XML, and recommendations are the same. The type of group is the only difference. diff --git a/windows/security/threat-protection/auditing/audit-dpapi-activity.md b/windows/security/threat-protection/auditing/audit-dpapi-activity.md index 86b22ef36d..fc94d79d95 100644 --- a/windows/security/threat-protection/auditing/audit-dpapi-activity.md +++ b/windows/security/threat-protection/auditing/audit-dpapi-activity.md @@ -1,13 +1,16 @@ --- title: Audit DPAPI Activity (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit DPAPI Activity, which determines whether the operating system generates audit events when encryption or decryption calls are made into the data protection application interface (DPAPI). +description: The policy setting, Audit DPAPI Activity, decides if encryption/decryption calls to the data protection application interface (DPAPI) generate audit events. ms.assetid: be4d4c83-c857-4e3d-a84e-8bcc3f2c99cd +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-file-share.md b/windows/security/threat-protection/auditing/audit-file-share.md index 6664fafb8d..ccab879b4f 100644 --- a/windows/security/threat-protection/auditing/audit-file-share.md +++ b/windows/security/threat-protection/auditing/audit-file-share.md @@ -1,13 +1,16 @@ --- title: Audit File Share (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File Share, which determines whether the operating system generates audit events when a file share is accessed. +description: The Advanced Security Audit policy setting, Audit File Share, determines if the operating system generates audit events when a file share is accessed. ms.assetid: 9ea985f8-8936-4b79-abdb-35cbb7138f78 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-file-system.md b/windows/security/threat-protection/auditing/audit-file-system.md index 57d6cee236..57ea7bc917 100644 --- a/windows/security/threat-protection/auditing/audit-file-system.md +++ b/windows/security/threat-protection/auditing/audit-file-system.md @@ -1,13 +1,16 @@ --- title: Audit File System (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit File System, which determines whether the operating system generates audit events when users attempt to access file system objects. +description: The Advanced Security Audit policy setting, Audit File System, determines if audit events are generated when users attempt to access file system objects. ms.assetid: 6a71f283-b8e5-41ac-b348-0b7ec6ea0b1f +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md index 611e14619a..52475e4276 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-connection.md @@ -1,13 +1,16 @@ --- title: Audit Filtering Platform Connection (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Connection, which determines whether the operating system generates audit events when connections are allowed or blocked by the Windows Filtering Platform. +description: The policy setting, Audit Filtering Platform Connection, decides if audit events are generated when connections are allow/blocked by Windows Filtering Platform. ms.assetid: d72936e9-ff01-4d18-b864-a4958815df59 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md index 3aeb8b5e37..bdaff33b06 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-packet-drop.md @@ -1,13 +1,16 @@ --- title: Audit Filtering Platform Packet Drop (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Packet Drop, which determines whether the operating system generates audit events when packets are dropped by the Windows Filtering Platform. +description: The policy setting, Audit Filtering Platform Packet Drop, determines if audit events are generated when packets are dropped by the Windows Filtering Platform. ms.assetid: 95457601-68d1-4385-af20-87916ddab906 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md index bcfe72948a..4103970aa4 100644 --- a/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-filtering-platform-policy-change.md @@ -1,13 +1,16 @@ --- title: Audit Filtering Platform Policy Change (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Filtering Platform Policy Change, which determines whether the operating system generates audit events for certain IPsec and Windows Filtering Platform actions. +description: The policy setting, Audit Filtering Platform Policy Change, determines if audit events are generated for certain IPsec and Windows Filtering Platform actions. ms.assetid: 0eaf1c56-672b-4ea9-825a-22dc03eb4041 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -17,16 +20,15 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Filtering Platform Policy Change allows you to audit events generated by changes to the [Windows Filtering Platform](https://msdn.microsoft.com/library/windows/desktop/aa366510(v=vs.85).aspx) (WFP), such as the following: -- IPsec services status. +- IPsec services status. -- Changes to IPsec policy settings. +- Changes to IPsec policy settings. -- Changes to Windows Filtering Platform Base Filtering Engine policy settings. +- Changes to Windows Filtering Platform Base Filtering Engine policy settings. -- Changes to WFP providers and engine. +- Changes to WFP providers and engine. Windows Filtering Platform (WFP) enables independent software vendors (ISVs) to filter and modify TCP/IP packets, monitor or authorize connections, filter Internet Protocol security (IPsec)-protected traffic, and filter remote procedure calls (RPCs). @@ -38,83 +40,82 @@ This subcategory is outside the scope of this document. | Member Server | - | - | - | - | This subcategory is outside the scope of this document. | | Workstation | - | - | - | - | This subcategory is outside the scope of this document. | -## 4709(S): IPsec Services was started. +- 4709(S): IPsec Services was started. -## 4710(S): IPsec Services was disabled. +- 4710(S): IPsec Services was disabled. -## 4711(S): May contain any one of the following: +- 4711(S): May contain any one of the following: -## 4712(F): IPsec Services encountered a potentially serious failure. +- 4712(F): IPsec Services encountered a potentially serious failure. -## 5040(S): A change has been made to IPsec settings. An Authentication Set was added. +- 5040(S): A change has been made to IPsec settings. An Authentication Set was added. -## 5041(S): A change has been made to IPsec settings. An Authentication Set was modified. +- 5041(S): A change has been made to IPsec settings. An Authentication Set was modified. -## 5042(S): A change has been made to IPsec settings. An Authentication Set was deleted. +- 5042(S): A change has been made to IPsec settings. An Authentication Set was deleted. -## 5043(S): A change has been made to IPsec settings. A Connection Security Rule was added. +- 5043(S): A change has been made to IPsec settings. A Connection Security Rule was added. -## 5044(S): A change has been made to IPsec settings. A Connection Security Rule was modified. +- 5044(S): A change has been made to IPsec settings. A Connection Security Rule was modified. -## 5045(S): A change has been made to IPsec settings. A Connection Security Rule was deleted. +- 5045(S): A change has been made to IPsec settings. A Connection Security Rule was deleted. -## 5046(S): A change has been made to IPsec settings. A Crypto Set was added. +- 5046(S): A change has been made to IPsec settings. A Crypto Set was added. -## 5047(S): A change has been made to IPsec settings. A Crypto Set was modified. +- 5047(S): A change has been made to IPsec settings. A Crypto Set was modified. -## 5048(S): A change has been made to IPsec settings. A Crypto Set was deleted. +- 5048(S): A change has been made to IPsec settings. A Crypto Set was deleted. -## 5440(S): The following callout was present when the Windows Filtering Platform Base Filtering Engine started. +- 5440(S): The following callout was present when the Windows Filtering Platform Base Filtering Engine started. -## 5441(S): The following filter was present when the Windows Filtering Platform Base Filtering Engine started. +- 5441(S): The following filter was present when the Windows Filtering Platform Base Filtering Engine started. -## 5442(S): The following provider was present when the Windows Filtering Platform Base Filtering Engine started. +- 5442(S): The following provider was present when the Windows Filtering Platform Base Filtering Engine started. -## 5443(S): The following provider context was present when the Windows Filtering Platform Base Filtering Engine started. +- 5443(S): The following provider context was present when the Windows Filtering Platform Base Filtering Engine started. -## 5444(S): The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started. +- 5444(S): The following sub-layer was present when the Windows Filtering Platform Base Filtering Engine started. -## 5446(S): A Windows Filtering Platform callout has been changed. +- 5446(S): A Windows Filtering Platform callout has been changed. -## 5448(S): A Windows Filtering Platform provider has been changed. +- 5448(S): A Windows Filtering Platform provider has been changed. -## 5449(S): A Windows Filtering Platform provider context has been changed. +- 5449(S): A Windows Filtering Platform provider context has been changed. -## 5450(S): A Windows Filtering Platform sub-layer has been changed. +- 5450(S): A Windows Filtering Platform sub-layer has been changed. -## 5456(S): PAStore Engine applied Active Directory storage IPsec policy on the computer. +- 5456(S): PAStore Engine applied Active Directory storage IPsec policy on the computer. -## 5457(F): PAStore Engine failed to apply Active Directory storage IPsec policy on the computer. +- 5457(F): PAStore Engine failed to apply Active Directory storage IPsec policy on the computer. -## 5458(S): PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer. +- 5458(S): PAStore Engine applied locally cached copy of Active Directory storage IPsec policy on the computer. -## 5459(F): PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer. +- 5459(F): PAStore Engine failed to apply locally cached copy of Active Directory storage IPsec policy on the computer. -## 5460(S): PAStore Engine applied local registry storage IPsec policy on the computer. +- 5460(S): PAStore Engine applied local registry storage IPsec policy on the computer. -## 5461(F): PAStore Engine failed to apply local registry storage IPsec policy on the computer. +- 5461(F): PAStore Engine failed to apply local registry storage IPsec policy on the computer. -## 5462(F): PAStore Engine failed to apply some rules of the active IPsec policy on the computer. Use the IP Security Monitor snap-in to diagnose the problem. +- 5462(F): PAStore Engine failed to apply some rules of the active IPsec policy on the computer. Use the IP Security Monitor snap-in to diagnose the problem. -## 5463(S): PAStore Engine polled for changes to the active IPsec policy and detected no changes. +- 5463(S): PAStore Engine polled for changes to the active IPsec policy and detected no changes. -## 5464(S): PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services. +- 5464(S): PAStore Engine polled for changes to the active IPsec policy, detected changes, and applied them to IPsec Services. -## 5465(S): PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully. +- 5465(S): PAStore Engine received a control for forced reloading of IPsec policy and processed the control successfully. -## 5466(F): PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead. Any changes made to the Active Directory IPsec policy since the last poll could not be applied. +- 5466(F): PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory cannot be reached, and will use the cached copy of the Active Directory IPsec policy instead. Any changes made to the Active Directory IPsec policy since the last poll could not be applied. -## 5467(F): PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used. +- 5467(F): PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, and found no changes to the policy. The cached copy of the Active Directory IPsec policy is no longer being used. -## 5468(S): PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes. The cached copy of the Active Directory IPsec policy is no longer being used. +- 5468(S): PAStore Engine polled for changes to the Active Directory IPsec policy, determined that Active Directory can be reached, found changes to the policy, and applied those changes. The cached copy of the Active Directory IPsec policy is no longer being used. -## 5471(S): PAStore Engine loaded local storage IPsec policy on the computer. +- 5471(S): PAStore Engine loaded local storage IPsec policy on the computer. -## 5472(F): PAStore Engine failed to load local storage IPsec policy on the computer. +- 5472(F): PAStore Engine failed to load local storage IPsec policy on the computer. -## 5473(S): PAStore Engine loaded directory storage IPsec policy on the computer. +- 5473(S): PAStore Engine loaded directory storage IPsec policy on the computer. -## 5474(F): PAStore Engine failed to load directory storage IPsec policy on the computer. - -## 5477(F): PAStore Engine failed to add quick mode filter. +- 5474(F): PAStore Engine failed to load directory storage IPsec policy on the computer. +- 5477(F): PAStore Engine failed to add quick mode filter. diff --git a/windows/security/threat-protection/auditing/audit-group-membership.md b/windows/security/threat-protection/auditing/audit-group-membership.md index c503247f64..e9047b6c8a 100644 --- a/windows/security/threat-protection/auditing/audit-group-membership.md +++ b/windows/security/threat-protection/auditing/audit-group-membership.md @@ -1,13 +1,16 @@ --- title: Audit Group Membership (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Group Membership, which enables you to audit group memberships when they are enumerated on the client PC. +description: The advanced security audit policy setting, Audit Group Membership, enables you to audit group memberships when they are enumerated on the client PC. ms.assetid: 1CD7B014-FBD9-44B9-9274-CC5715DE58B9 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-handle-manipulation.md b/windows/security/threat-protection/auditing/audit-handle-manipulation.md index 032486cabe..64fd2edce2 100644 --- a/windows/security/threat-protection/auditing/audit-handle-manipulation.md +++ b/windows/security/threat-protection/auditing/audit-handle-manipulation.md @@ -1,13 +1,16 @@ --- title: Audit Handle Manipulation (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Handle Manipulation, which determines whether the operating system generates audit events when a handle to an object is opened or closed. +description: The Advanced Security Audit policy setting, Audit Handle Manipulation, determines if audit events are generated when a handle to an object is opened or closed. ms.assetid: 1fbb004a-ccdc-4c80-b3da-a4aa7a9f4091 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -17,24 +20,20 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Handle Manipulation enables generation of “4658: The handle to an object was closed” in [Audit File System](audit-file-system.md), [Audit Kernel Object](audit-kernel-object.md), [Audit Registry](audit-registry.md), [Audit Removable Storage](audit-removable-storage.md) and [Audit SAM](audit-sam.md) subcategories, and shows object’s handle duplication and close actions. **Event volume**: High. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| | Domain Controller | No | No | No | No | Typically, information about the duplication or closing of an object handle has little to no security relevance and is hard to parse or analyze.
                                  There is no recommendation to enable this subcategory for Success or Failure auditing, unless you know exactly what you need to monitor in Object’s Handles level. | | Member Server | No | No | No | No | Typically, information about the duplication or closing of an object handle has little to no security relevance and is hard to parse or analyze.
                                  There is no recommendation to enable this subcategory for Success or Failure auditing, unless you know exactly what you need to monitor in Object’s Handles level. | | Workstation | No | No | No | No | Typically, information about the duplication or closing of an object handle has little to no security relevance and is hard to parse or analyze.
                                  There is no recommendation to enable this subcategory for Success or Failure auditing, unless you know exactly what you need to monitor in Object’s Handles level. | **Events List:** -- [4658](event-4658.md)(S): The handle to an object was closed. +- [4658](event-4658.md)(S): The handle to an object was closed. -- [4690](event-4690.md)(S): An attempt was made to duplicate a handle to an object. - -## 4658(S): The handle to an object was closed. - -This event doesn’t generate in this subcategory, but you can use this subcategory to enable it. For a description of the event, see “[4658](event-4658.md)(S): The handle to an object was closed” in the Audit File System subcategory. +- [4690](event-4690.md)(S): An attempt was made to duplicate a handle to an object. +- 4658(S): The handle to an object was closed. For a description of the event, see _[4658](event-4658.md)(S): The handle to an object was closed._ in the Audit File System subcategory. This event doesn’t generate in the Audit Handle Manipulation subcategory, but you can use this subcategory to enable it. diff --git a/windows/security/threat-protection/auditing/audit-ipsec-driver.md b/windows/security/threat-protection/auditing/audit-ipsec-driver.md index 1fb88b5fd4..d396f0ed40 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-driver.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-driver.md @@ -1,13 +1,16 @@ --- title: Audit IPsec Driver (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit IPsec Driver, which determines whether the operating system generates audit events for the activities of the IPsec driver. +description: The Advanced Security Audit policy setting, Audit IPsec Driver, determines if audit events are generated for the activities of the IPsec driver. ms.assetid: c8b8c02f-5ad0-4ee5-9123-ea8cdae356a5 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 10/02/2018 --- @@ -17,7 +20,6 @@ ms.date: 10/02/2018 - Windows 10 - Windows Server 2016 - Audit IPsec Driver allows you to audit events generated by IPSec driver such as the following: - Startup and shutdown of the IPsec services. @@ -34,9 +36,11 @@ Audit IPsec Driver allows you to audit events generated by IPSec driver such as A high rate of packet drops by the IPsec filter driver may indicate attempts to gain access to the network by unauthorized systems. -Failure to process IPsec filters poses a potential security risk because some network interfaces may not get the protection that is provided by the IPsec filter. +Failure to process IPsec filters poses a potential security risk because some network interfaces may not get the protection that is provided by the IPsec filter. This subcategory is outside the scope of this document. -This subcategory is outside the scope of this document. +**Event volume:** Medium + +**Default:** Not configured | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|-------------------------------------------------------------------------------------------------------------------------------------------| @@ -44,25 +48,26 @@ This subcategory is outside the scope of this document. | Member Server | - | - | - | - | There is no recommendation for this subcategory in this document, unless you know exactly what you need to monitor at IPsec Driver level. | | Workstation | - | - | - | - | There is no recommendation for this subcategory in this document, unless you know exactly what you need to monitor at IPsec Driver level. | -## 4960(S): IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations. +**Events List:** -## 4961(S): IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer. +- 4960(S): IPsec dropped an inbound packet that failed an integrity check. If this problem persists, it could indicate a network issue or that packets are being modified in transit to this computer. Verify that the packets sent from the remote computer are the same as those received by this computer. This error might also indicate interoperability problems with other IPsec implementations. -## 4962(S): IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay. +- 4961(S): IPsec dropped an inbound packet that failed a replay check. If this problem persists, it could indicate a replay attack against this computer. -## 4963(S): IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt. +- 4962(S): IPsec dropped an inbound packet that failed a replay check. The inbound packet had too low a sequence number to ensure it was not a replay. -## 4965(S): IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error may also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored. +- 4963(S): IPsec dropped an inbound clear text packet that should have been secured. This is usually due to the remote computer changing its IPsec policy without informing this computer. This could also be a spoofing attack attempt. -## 5478(S): IPsec Services has started successfully. +- 4965(S): IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI). This is usually caused by malfunctioning hardware that is corrupting packets. If these errors persist, verify that the packets sent from the remote computer are the same as those received by this computer. This error may also indicate interoperability problems with other IPsec implementations. In that case, if connectivity is not impeded, then these events can be ignored. -## 5479(S): IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. +- 5478(S): IPsec Services has started successfully. -## 5480(F): IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. +- 5479(S): IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. -## 5483(F): IPsec Services failed to initialize RPC server. IPsec Services could not be started. +- 5480(F): IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. -## 5484(F): IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. +- 5483(F): IPsec Services failed to initialize RPC server. IPsec Services could not be started. -## 5485(F): IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. +- 5484(F): IPsec Services has experienced a critical failure and has been shut down. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. +- 5485(F): IPsec Services failed to process some IPsec filters on a plug-and-play event for network interfaces. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. diff --git a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md index e9388ef13f..37421d3b3e 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md @@ -1,13 +1,16 @@ --- title: Audit IPsec Extended Mode (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Extended Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations. +description: The setting, Audit IPsec Extended Mode, determines if audit events are generated for the results of IKE protocol and AuthIP during Extended Mode negotiations. ms.assetid: 2b4fee9e-482a-4181-88a8-6a79d8fc8049 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 10/02/2018 --- @@ -22,23 +25,22 @@ Audit IPsec Extended Mode allows you to audit events generated by Internet Key E Audit IPsec Extended Mode subcategory is out of scope of this document, because this subcategory is mainly used for IPsec Extended Mode troubleshooting. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|--------------------------------------------------------------------------------------------------------------------------------------------| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| | Domain Controller | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Extended Mode troubleshooting, or for tracing or monitoring IPsec Extended Mode operations. | | Member Server | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Extended Mode troubleshooting, or for tracing or monitoring IPsec Extended Mode operations. | | Workstation | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Extended Mode troubleshooting, or for tracing or monitoring IPsec Extended Mode operations. | -## 4978(S): During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. +- 4978(S): During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. -## 4979(S): IPsec Main Mode and Extended Mode security associations were established. +- 4979(S): IPsec Main Mode and Extended Mode security associations were established. -## 4980(S): IPsec Main Mode and Extended Mode security associations were established. +- 4980(S): IPsec Main Mode and Extended Mode security associations were established. -## 4981(S): IPsec Main Mode and Extended Mode security associations were established. +- 4981(S): IPsec Main Mode and Extended Mode security associations were established. -## 4982(S): IPsec Main Mode and Extended Mode security associations were established. +- 4982(S): IPsec Main Mode and Extended Mode security associations were established. -## 4983(S): An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. - -## 4984(S): An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. +- 4983(S): An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. +- 4984(S): An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. diff --git a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md index 1a34ba32f3..bf2db28b53 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md @@ -1,13 +1,16 @@ --- title: Audit IPsec Main Mode (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Main Mode, which determines whether the operating system generates events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. +description: Learn about the policy setting, Audit IPsec Main Mode, which determines if the results of certain protocols generate events during Main Mode negotiations. ms.assetid: 06ed26ec-3620-4ef4-a47a-c70df9c8827b +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 10/02/2018 --- @@ -17,32 +20,30 @@ ms.date: 10/02/2018 - Windows 10 - Windows Server 2016 - Audit IPsec Main Mode allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations. Audit IPsec Main Mode subcategory is out of scope of this document, because this subcategory is mainly used for IPsec Main Mode troubleshooting. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|------------------------------------------------------------------------------------------------------------------------------------| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| | Domain Controller | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Main Mode troubleshooting, or for tracing or monitoring IPsec Main Mode operations. | | Member Server | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Main Mode troubleshooting, or for tracing or monitoring IPsec Main Mode operations. | | Workstation | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Main Mode troubleshooting, or for tracing or monitoring IPsec Main Mode operations. | -## 4646(S): Security ID: %1 +- 4646(S): Security ID: %1 -## 4650(S): An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used. +- 4650(S): An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used. -## 4651(S): An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication. +- 4651(S): An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication. -## 4652(F): An IPsec Main Mode negotiation failed. +- 4652(F): An IPsec Main Mode negotiation failed. -## 4653(F): An IPsec Main Mode negotiation failed. +- 4653(F): An IPsec Main Mode negotiation failed. -## 4655(S): An IPsec Main Mode security association ended. +- 4655(S): An IPsec Main Mode security association ended. -## 4976(S): During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. +- 4976(S): During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. -## 5049(S): An IPsec Security Association was deleted. - -## 5453(S): An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started. +- 5049(S): An IPsec Security Association was deleted. +- 5453(S): An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started. diff --git a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md index 40aabcd719..290c41687a 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md @@ -1,13 +1,16 @@ --- title: Audit IPsec Quick Mode (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit IPsec Quick Mode, which determines whether the operating system generates audit events for the results of the Internet Key Exchange (IKE) protocol and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. +description: The policy setting, Audit IPsec Quick Mode, decides if audit events are generated for the results of the IKE protocol and AuthIP during Quick Mode negotiations. ms.assetid: 7be67a15-c2ce-496a-9719-e25ac7699114 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 10/02/2018 --- @@ -17,20 +20,18 @@ ms.date: 10/02/2018 - Windows 10 - Windows Server 2016 - Audit IPsec Quick Mode allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations. Audit IPsec Quick Mode subcategory is out of scope of this document, because this subcategory is mainly used for IPsec Quick Mode troubleshooting. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|--------------------------------------------------------------------------------------------------------------------------------------| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| | Domain Controller | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Quick Mode troubleshooting, or for tracing or monitoring IPsec Quick Mode operations. | | Member Server | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Quick Mode troubleshooting, or for tracing or monitoring IPsec Quick Mode operations. | | Workstation | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Quick Mode troubleshooting, or for tracing or monitoring IPsec Quick Mode operations. | -## 4977(S): During Quick Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. +- 4977(S): During Quick Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. -## 5451(S): An IPsec Quick Mode security association was established. - -## 5452(S): An IPsec Quick Mode security association ended. +- 5451(S): An IPsec Quick Mode security association was established. +- 5452(S): An IPsec Quick Mode security association ended. diff --git a/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md index fa45372c3e..529003459d 100644 --- a/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md +++ b/windows/security/threat-protection/auditing/audit-kerberos-authentication-service.md @@ -1,13 +1,16 @@ --- title: Audit Kerberos Authentication Service (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kerberos Authentication Service, which determines whether to generate audit events for Kerberos authentication ticket-granting ticket (TGT) requests. +description: The policy setting Audit Kerberos Authentication Service decides if audit events are generated for Kerberos authentication ticket-granting ticket (TGT) requests ms.assetid: 990dd6d9-1a1f-4cce-97ba-5d7e0a7db859 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md index 555286d0f5..27a1d4a933 100644 --- a/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md +++ b/windows/security/threat-protection/auditing/audit-kerberos-service-ticket-operations.md @@ -1,13 +1,16 @@ --- title: Audit Kerberos Service Ticket Operations (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kerberos Service Ticket Operations, which determines whether the operating system generates security audit events for Kerberos service ticket requests. +description: The policy setting, Audit Kerberos Service Ticket Operations, determines if security audit events are generated for Kerberos service ticket requests. ms.assetid: ddc0abef-ac7f-4849-b90d-66700470ccd6 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-kernel-object.md b/windows/security/threat-protection/auditing/audit-kernel-object.md index 4ee34b9790..60f0a374d8 100644 --- a/windows/security/threat-protection/auditing/audit-kernel-object.md +++ b/windows/security/threat-protection/auditing/audit-kernel-object.md @@ -1,13 +1,16 @@ --- title: Audit Kernel Object (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Kernel Object, which determines whether the operating system generates audit events when users attempt to access the system kernel, which includes mutexes and semaphores. +description: The policy setting, Audit Kernel Object, decides if user attempts to access the system kernel (which includes mutexes and semaphores) generate audit events. ms.assetid: 75619d8b-b1eb-445b-afc9-0f9053be97fb +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-logoff.md b/windows/security/threat-protection/auditing/audit-logoff.md index 521a5e8e0f..c4d6606795 100644 --- a/windows/security/threat-protection/auditing/audit-logoff.md +++ b/windows/security/threat-protection/auditing/audit-logoff.md @@ -1,13 +1,16 @@ --- title: Audit Logoff (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logoff, which determines whether the operating system generates audit events when logon sessions are terminated. +description: The Advanced Security Audit policy setting, Audit Logoff, determines if audit events are generated when logon sessions are terminated. ms.assetid: 681e51f2-ba06-46f5-af8c-d9c48d515432 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 07/16/2018 --- diff --git a/windows/security/threat-protection/auditing/audit-logon.md b/windows/security/threat-protection/auditing/audit-logon.md index 4b4cc2f5de..711c16301c 100644 --- a/windows/security/threat-protection/auditing/audit-logon.md +++ b/windows/security/threat-protection/auditing/audit-logon.md @@ -1,13 +1,16 @@ --- title: Audit Logon (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Logon, which determines whether the operating system generates audit events when a user attempts to log on to a computer. +description: The Advanced Security Audit policy setting, Audit Logon, determines if audit events are generated when a user attempts to log on to a computer. ms.assetid: ca968d03-7d52-48c4-ba0e-2bcd2937231b +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md index f3bb9e035a..d58bafa0de 100644 --- a/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md +++ b/windows/security/threat-protection/auditing/audit-mpssvc-rule-level-policy-change.md @@ -1,13 +1,16 @@ --- title: Audit MPSSVC Rule-Level Policy Change (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit MPSSVC Rule-Level Policy Change, which determines whether the operating system generates audit events when changes are made to policy rules for the Microsoft Protection Service (MPSSVC.exe). +description: Audit MPSSVC Rule-Level Policy Change determines if audit events are generated when policy rules are altered for the Microsoft Protection Service (MPSSVC.exe). ms.assetid: 263461b3-c61c-4ec3-9dee-851164845019 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-network-policy-server.md b/windows/security/threat-protection/auditing/audit-network-policy-server.md index 5f50082169..697ae99b16 100644 --- a/windows/security/threat-protection/auditing/audit-network-policy-server.md +++ b/windows/security/threat-protection/auditing/audit-network-policy-server.md @@ -1,13 +1,16 @@ --- title: Audit Network Policy Server (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Network Policy Server, which determines whether the operating system generates audit events for RADIUS (IAS) and Network Access Protection (NAP) activity on user access requests (Grant, Deny, Discard, Quarantine, Lock, and Unlock). +description: The policy setting, Audit Network Policy Server, determines if audit events are generated for RADIUS (IAS) and NAP activity on user access requests. ms.assetid: 43b2aea4-26df-46da-b761-2b30f51a80f7 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -17,7 +20,6 @@ ms.date: 04/19/2017 - Windows 10 - Windows Server 2016 - Audit Network Policy Server allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) activity related to user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock. If you configure this subcategory, an audit event is generated for each IAS and NAP user access request. @@ -30,27 +32,26 @@ NAP events can be used to help understand the overall health of the network. Role-specific subcategories are outside the scope of this document. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| | Domain Controller | IF | IF | IF | IF | IF – if a server has the [Network Policy Server](https://msdn.microsoft.com/library/cc732912.aspx) (NPS) role installed and you need to monitor access requests and other NPS-related events, enable this subcategory. | | Member Server | IF | IF | IF | IF | IF – if a server has the [Network Policy Server](https://msdn.microsoft.com/library/cc732912.aspx) (NPS) role installed and you need to monitor access requests and other NPS-related events, enable this subcategory. | -| Workstation | No | No | No | No | [Network Policy Server](https://msdn.microsoft.com/library/cc732912.aspx) (NPS) role cannot be installed on client OS. | +| Workstation | No | No | No | No | [Network Policy Server](https://msdn.microsoft.com/library/cc732912.aspx) (NPS) role cannot be installed on client OS. | -## 6272: Network Policy Server granted access to a user. +- 6272: Network Policy Server granted access to a user. -## 6273: Network Policy Server denied access to a user. +- 6273: Network Policy Server denied access to a user. -## 6274: Network Policy Server discarded the request for a user. +- 6274: Network Policy Server discarded the request for a user. -## 6275: Network Policy Server discarded the accounting request for a user. +- 6275: Network Policy Server discarded the accounting request for a user. -## 6276: Network Policy Server quarantined a user. +- 6276: Network Policy Server quarantined a user. -## 6277: Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy. +- 6277: Network Policy Server granted access to a user but put it on probation because the host did not meet the defined health policy. -## 6278: Network Policy Server granted full access to a user because the host met the defined health policy. +- 6278: Network Policy Server granted full access to a user because the host met the defined health policy. -## 6279: Network Policy Server locked the user account due to repeated failed authentication attempts. - -## 6280: Network Policy Server unlocked the user account. +- 6279: Network Policy Server locked the user account due to repeated failed authentication attempts. +- 6280: Network Policy Server unlocked the user account. diff --git a/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md index 9f0a2a2a2f..f1227802bd 100644 --- a/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md +++ b/windows/security/threat-protection/auditing/audit-non-sensitive-privilege-use.md @@ -2,12 +2,15 @@ title: Audit Non Sensitive Privilege Use (Windows 10) description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Non-Sensitive Privilege Use, which determines whether the operating system generates audit events when non-sensitive privileges (user rights) are used. ms.assetid: 8fd74783-1059-443e-aa86-566d78606627 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-account-logon-events.md b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md index 8a13f5aac2..959a951636 100644 --- a/windows/security/threat-protection/auditing/audit-other-account-logon-events.md +++ b/windows/security/threat-protection/auditing/audit-other-account-logon-events.md @@ -1,13 +1,16 @@ --- title: Audit Other Account Logon Events (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Other Account Logon Events, which allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets. +description: The policy setting, Audit Other Account Logon Events, allows you to audit events generated by responses to credential requests for certain kinds of user logons. ms.assetid: c8c6bfe0-33d2-4600-bb1a-6afa840d75b3 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-account-management-events.md b/windows/security/threat-protection/auditing/audit-other-account-management-events.md index 2118e8090b..2795a0bb73 100644 --- a/windows/security/threat-protection/auditing/audit-other-account-management-events.md +++ b/windows/security/threat-protection/auditing/audit-other-account-management-events.md @@ -1,13 +1,16 @@ --- title: Audit Other Account Management Events (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Account Management Events, which determines whether the operating system generates user account management audit events. +description: The Advanced Security Audit policy setting, Audit Other Account Management Events, determines if user account management audit events are generated. ms.assetid: 4ce22eeb-a96f-4cf9-a46d-6642961a31d5 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md index 1be1e370f1..9265129828 100644 --- a/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md +++ b/windows/security/threat-protection/auditing/audit-other-logonlogoff-events.md @@ -1,13 +1,16 @@ --- title: Audit Other Logon/Logoff Events (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Logon/Logoff Events, which determines whether Windows generates audit events for other logon or logoff events. +description: The Advanced Security Audit policy setting, Audit Other Logon/Logoff Events, determines if Windows generates audit events for other logon or logoff events. ms.assetid: 76d987cd-1917-4907-a739-dd642609a458 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-object-access-events.md b/windows/security/threat-protection/auditing/audit-other-object-access-events.md index 199192018a..54b132e114 100644 --- a/windows/security/threat-protection/auditing/audit-other-object-access-events.md +++ b/windows/security/threat-protection/auditing/audit-other-object-access-events.md @@ -1,13 +1,16 @@ --- title: Audit Other Object Access Events (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Object Access Events, which determines whether the operating system generates audit events for the management of Task Scheduler jobs or COM+ objects. +description: The policy setting, Audit Other Object Access Events, determines if audit events are generated for the management of Task Scheduler jobs or COM+ objects. ms.assetid: b9774595-595d-4199-b0c5-8dbc12b6c8b2 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 05/29/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-policy-change-events.md b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md index 08d287a0cb..2ceacf7bd7 100644 --- a/windows/security/threat-protection/auditing/audit-other-policy-change-events.md +++ b/windows/security/threat-protection/auditing/audit-other-policy-change-events.md @@ -1,13 +1,16 @@ --- title: Audit Other Policy Change Events (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other Policy Change Events, which determines whether the operating system generates audit events for security policy changes that are not otherwise audited in the Policy Change category. +description: The policy setting, Audit Other Policy Change Events, determines if audit events are generated for security policy changes that are not otherwise audited. ms.assetid: 8618502e-c21c-41cc-8a49-3dc1eb359e60 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md index 45be00eab8..e13d22c6e3 100644 --- a/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md +++ b/windows/security/threat-protection/auditing/audit-other-privilege-use-events.md @@ -2,12 +2,15 @@ title: Audit Other Privilege Use Events (Windows 10) description: This security policy setting is not used. ms.assetid: 5f7f5b25-42a6-499f-8aa2-01ac79a2a63c +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-other-system-events.md b/windows/security/threat-protection/auditing/audit-other-system-events.md index e70d6e2681..314723a738 100644 --- a/windows/security/threat-protection/auditing/audit-other-system-events.md +++ b/windows/security/threat-protection/auditing/audit-other-system-events.md @@ -1,13 +1,16 @@ --- title: Audit Other System Events (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Other System Events, which determines whether the operating system audits various system events. +description: The Advanced Security Audit policy setting, Audit Other System Events, determines if the operating system audits various system events. ms.assetid: 2401e4cc-d94e-41ec-82a7-e10914295f8b +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-pnp-activity.md b/windows/security/threat-protection/auditing/audit-pnp-activity.md index 51f7778df1..2d1298584a 100644 --- a/windows/security/threat-protection/auditing/audit-pnp-activity.md +++ b/windows/security/threat-protection/auditing/audit-pnp-activity.md @@ -1,13 +1,16 @@ --- title: Audit PNP Activity (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit PNP Activity, which determines when plug and play detects an external device. +description: The advanced security audit policy setting, Audit PNP Activity, determines when plug and play detects an external device. ms.assetid: A3D87B3B-EBBE-442A-953B-9EB75A5F600E +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-process-creation.md b/windows/security/threat-protection/auditing/audit-process-creation.md index 39e53664c4..2eb2aa20f8 100644 --- a/windows/security/threat-protection/auditing/audit-process-creation.md +++ b/windows/security/threat-protection/auditing/audit-process-creation.md @@ -1,13 +1,16 @@ --- title: Audit Process Creation (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Process Creation, which determines whether the operating system generates audit events when a process is created (starts). +description: The Advanced Security Audit policy setting, Audit Process Creation, determines if audit events are generated when a process is created (starts). ms.assetid: 67e39fcd-ded6-45e8-b1b6-d411e4e93019 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-process-termination.md b/windows/security/threat-protection/auditing/audit-process-termination.md index d1a88331d5..7ba49fbd59 100644 --- a/windows/security/threat-protection/auditing/audit-process-termination.md +++ b/windows/security/threat-protection/auditing/audit-process-termination.md @@ -1,13 +1,16 @@ --- title: Audit Process Termination (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Process Termination, which determines whether the operating system generates audit events when an attempt is made to end a process. +description: The Advanced Security Audit policy setting, Audit Process Termination, determines if audit events are generated when an attempt is made to end a process. ms.assetid: 65d88e53-14aa-48a4-812b-557cebbf9e50 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-registry.md b/windows/security/threat-protection/auditing/audit-registry.md index 7454355c57..4b0d88838f 100644 --- a/windows/security/threat-protection/auditing/audit-registry.md +++ b/windows/security/threat-protection/auditing/audit-registry.md @@ -1,13 +1,16 @@ --- title: Audit Registry (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Registry, which determines whether the operating system generates audit events when users attempt to access registry objects. +description: The Advanced Security Audit policy setting, Audit Registry, determines if audit events are generated when users attempt to access registry objects. ms.assetid: 02bcc23b-4823-46ac-b822-67beedf56b32 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-removable-storage.md b/windows/security/threat-protection/auditing/audit-removable-storage.md index 3e4c82578c..82d5170b7c 100644 --- a/windows/security/threat-protection/auditing/audit-removable-storage.md +++ b/windows/security/threat-protection/auditing/audit-removable-storage.md @@ -1,13 +1,16 @@ --- title: Audit Removable Storage (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Removable Storage, which determines when there is a read or a write to a removable drive. +description: The Advanced Security Audit policy setting, Audit Removable Storage, determines when there is a read or a write to a removable drive. ms.assetid: 1746F7B3-8B41-4661-87D8-12F734AFFB26 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-rpc-events.md b/windows/security/threat-protection/auditing/audit-rpc-events.md index 584b5fb9ff..b35eacaf51 100644 --- a/windows/security/threat-protection/auditing/audit-rpc-events.md +++ b/windows/security/threat-protection/auditing/audit-rpc-events.md @@ -1,13 +1,16 @@ --- title: Audit RPC Events (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit RPC Events, which determines whether the operating system generates audit events when inbound remote procedure call (RPC) connections are made. +description: Audit RPC Events is an audit policy setting that determines if audit events are generated when inbound remote procedure call (RPC) connections are made. ms.assetid: 868aec2d-93b4-4bc8-a150-941f88838ba6 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-sam.md b/windows/security/threat-protection/auditing/audit-sam.md index 57071fda29..6e60284ead 100644 --- a/windows/security/threat-protection/auditing/audit-sam.md +++ b/windows/security/threat-protection/auditing/audit-sam.md @@ -1,13 +1,16 @@ --- title: Audit SAM (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit SAM, which enables you to audit events that are generated by attempts to access Security Account Manager (SAM) objects. +description: The Advanced Security Audit policy setting, Audit SAM, enables you to audit events generated by attempts to access Security Account Manager (SAM) objects. ms.assetid: 1d00f955-383d-4c95-bbd1-fab4a991a46e +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -53,6 +56,3 @@ For information about reducing the number of events generated in this subcategor **Events List:** - [4661](event-4661.md)(S, F): A handle to an object was requested. - -# - diff --git a/windows/security/threat-protection/auditing/audit-security-group-management.md b/windows/security/threat-protection/auditing/audit-security-group-management.md index 66dbdee966..d75b85e522 100644 --- a/windows/security/threat-protection/auditing/audit-security-group-management.md +++ b/windows/security/threat-protection/auditing/audit-security-group-management.md @@ -1,13 +1,16 @@ --- title: Audit Security Group Management (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit Security Group Management, which determines whether the operating system generates audit events when specific security group management tasks are performed. +description: The policy setting, Audit Security Group Management, determines if audit events are generated when specific security group management tasks are performed. ms.assetid: ac2ee101-557b-4c84-b9fa-4fb23331f1aa +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 02/28/2019 --- @@ -17,78 +20,86 @@ ms.date: 02/28/2019 - Windows 10 - Windows Server 2016 - Audit Security Group Management determines whether the operating system generates audit events when specific security group management tasks are performed. **Event volume**: Low. This subcategory allows you to audit events generated by changes to security groups such as the following: -- Security group is created, changed, or deleted. +- Security group is created, changed, or deleted. -- Member is added or removed from a security group. +- Member is added or removed from a security group. -- Group type is changed. +- Group type is changed. -| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | -|-------------------|-----------------|-----------------|------------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory.| -| Member Server | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory.| -| Workstation | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory.| +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|----------| +| Domain Controller | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | Yes | No | Yes | No | We recommend Success auditing of security groups, to see new group creation events, changes and deletion of critical groups. Also you will get information about new members of security groups, when a member was removed from a group and when security group membership was enumerated.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | **Events List:** -- [4731](event-4731.md)(S): A security-enabled local group was created. +- [4731](event-4731.md)(S): A security-enabled local group was created. -- [4732](event-4732.md)(S): A member was added to a security-enabled local group. +- [4732](event-4732.md)(S): A member was added to a security-enabled local group. -- [4733](event-4733.md)(S): A member was removed from a security-enabled local group. +- [4733](event-4733.md)(S): A member was removed from a security-enabled local group. -- [4734](event-4734.md)(S): A security-enabled local group was deleted. +- [4734](event-4734.md)(S): A security-enabled local group was deleted. -- [4735](event-4735.md)(S): A security-enabled local group was changed. +- [4735](event-4735.md)(S): A security-enabled local group was changed. -- [4764](event-4764.md)(S): A group’s type was changed. +- [4764](event-4764.md)(S): A group’s type was changed. -- [4799](event-4799.md)(S): A security-enabled local group membership was enumerated. +- [4799](event-4799.md)(S): A security-enabled local group membership was enumerated. -**4727(S): A security-enabled global group was created.** See event “[4731](event-4731.md): A security-enabled local group was created.” Event 4727 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4727(S): A security-enabled global group was created. See event _[4731](event-4731.md): A security-enabled local group was created._ Event 4727 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4731](event-4731.md) do not apply. + > [!IMPORTANT] + > Event 4727(S) generates only for domain groups, so the Local sections in event [4731](event-4731.md) do not apply. -**4737(S): A security-enabled global group was changed.** See event “[4735](event-4735.md): A security-enabled local group was changed.” Event 4737 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4737(S): A security-enabled global group was changed. See event _[4735](event-4735.md): A security-enabled local group was changed._ Event 4737 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4735](event-4735.md) do not apply. + > [!IMPORTANT] + > Event 4737(S) generates only for domain groups, so the Local sections in event [4735](event-4735.md) do not apply. -**4728(S): A member was added to a security-enabled global group.** See event “[4732](event-4732.md): A member was added to a security-enabled local group.” Event 4728 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4728(S): A member was added to a security-enabled global group. See event _[4732](event-4732.md): A member was added to a security-enabled local group._ Event 4728 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4732](event-4732.md) do not apply. + > [!IMPORTANT] + > Event 4728(S) generates only for domain groups, so the Local sections in event [4732](event-4732.md) do not apply. -**4729(S): A member was removed from a security-enabled global group.** See event “[4733](event-4733.md): A member was removed from a security-enabled local group.” Event 4729 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4729(S): A member was removed from a security-enabled global group. See event _[4733](event-4733.md): A member was removed from a security-enabled local group._ Event 4729 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4733](event-4733.md) do not apply. + > [!IMPORTANT] + > Event 4729(S) generates only for domain groups, so the Local sections in event [4733](event-4733.md) do not apply. -**4730(S): A security-enabled global group was deleted.** See event “[4734](event-4734.md): A security-enabled local group was deleted.” Event 4730 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4730(S): A security-enabled global group was deleted. See event _[4734](event-4734.md): A security-enabled local group was deleted._ Event 4730 is the same, but it is generated for a **global** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4734](event-4734.md) do not apply. + > [!IMPORTANT] + > Event 4730(S) generates only for domain groups, so the Local sections in event [4734](event-4734.md) do not apply. -**4754(S): A security-enabled universal group was created.** See event “[4731](event-4731.md): A security-enabled local group was created.”. Event 4754 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4754(S): A security-enabled universal group was created. See event _[4731](event-4731.md): A security-enabled local group was created._ Event 4754 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4731](event-4731.md) do not apply. + > [!IMPORTANT] + > Event 4754(S) generates only for domain groups, so the Local sections in event [4731](event-4731.md) do not apply. -**4755(S): A security-enabled universal group was changed.** See event “[4735](event-4735.md): A security-enabled local group was changed.”. Event 4737 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4755(S): A security-enabled universal group was changed. See event _[4735](event-4735.md): A security-enabled local group was changed._ Event 4737 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4735](event-4735.md) do not apply. + > [!IMPORTANT] + > Event 4755(S) generates only for domain groups, so the Local sections in event [4735](event-4735.md) do not apply. -**4756(S): A member was added to a security-enabled universal group.** See event “[4732](event-4732.md): A member was added to a security-enabled local group.”. Event 4756 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4756(S): A member was added to a security-enabled universal group. See event _[4732](event-4732.md): A member was added to a security-enabled local group._ Event 4756 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4732](event-4732.md) do not apply. + > [!IMPORTANT] + > Event 4756(S) generates only for domain groups, so the Local sections in event [4732](event-4732.md) do not apply. -**4757(S): A member was removed from a security-enabled universal group.** See event “[4733](event-4733.md): A member was removed from a security-enabled local group.”. Event 4757 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. +- 4757(S): A member was removed from a security-enabled universal group. See event _[4733](event-4733.md): A member was removed from a security-enabled local group._ Event 4757 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. -**Important:** this event generates only for domain groups, so the Local sections in event [4733](event-4733.md) do not apply. + > [!IMPORTANT] + > Event 4757(S) generates only for domain groups, so the Local sections in event [4733](event-4733.md) do not apply. -**4758(S): A security-enabled universal group was deleted.** See event “[4734](event-4734.md): A security-enabled local group was deleted.”. Event 4758 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. - -**Important:** this event generates only for domain groups, so the Local sections in event [4734](event-4734.md) do not apply. +- 4758(S): A security-enabled universal group was deleted. See event _[4734](event-4734.md): A security-enabled local group was deleted._ Event 4758 is the same, but it is generated for a **universal** security group instead of a **local** security group. All event fields, XML, and recommendations are the same. The type of group is the only difference. + >[!IMPORTANT] + > Event 4758(S) generates only for domain groups, so the Local sections in event [4734](event-4734.md) do not apply. diff --git a/windows/security/threat-protection/auditing/audit-security-state-change.md b/windows/security/threat-protection/auditing/audit-security-state-change.md index 127b34b44a..c10e8072f7 100644 --- a/windows/security/threat-protection/auditing/audit-security-state-change.md +++ b/windows/security/threat-protection/auditing/audit-security-state-change.md @@ -1,13 +1,16 @@ --- title: Audit Security State Change (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Security State Change, which determines whether Windows generates audit events for changes in the security state of a system. +description: The policy setting, Audit Security State Change, which determines whether Windows generates audit events for changes in the security state of a system. ms.assetid: decb3218-a67d-4efa-afc0-337c79a89a2d +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -36,5 +39,6 @@ Audit Security State Change contains Windows startup, recovery, and shutdown eve - [4621](event-4621.md)(S): Administrator recovered system from CrashOnAuditFail. ->**Note**  Event **4609(S): Windows is shutting down** currently doesn’t generate. It is a defined event, but it is never invoked by the operating system. +>[!NOTE] +>Event **4609(S): Windows is shutting down** doesn't currently generate. It is a defined event, but it is never invoked by the operating system. diff --git a/windows/security/threat-protection/auditing/audit-security-system-extension.md b/windows/security/threat-protection/auditing/audit-security-system-extension.md index 778abbd8c0..50dcccadde 100644 --- a/windows/security/threat-protection/auditing/audit-security-system-extension.md +++ b/windows/security/threat-protection/auditing/audit-security-system-extension.md @@ -1,13 +1,16 @@ --- title: Audit Security System Extension (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Security System Extension, which determines whether the operating system generates audit events related to security system extensions. +description: The Advanced Security Audit policy setting, Audit Security System Extension, determines if audit events related to security system extensions are generated. ms.assetid: 9f3c6bde-42b2-4a0a-b353-ed3106ebc005 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md index 0320c9d421..3bdb900b00 100644 --- a/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md +++ b/windows/security/threat-protection/auditing/audit-sensitive-privilege-use.md @@ -1,13 +1,16 @@ --- title: Audit Sensitive Privilege Use (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Sensitive Privilege Use, which determines whether the operating system generates audit events when sensitive privileges (user rights) are used. +description: The policy setting, Audit Sensitive Privilege Use, determines if the operating system generates audit events when sensitive privileges (user rights) are used. ms.assetid: 915abf50-42d2-45f6-9fd1-e7bd201b193d +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -68,6 +71,7 @@ If you configure this policy setting, an audit event is generated when sensitive - [4985](event-4985.md)(S): The state of a transaction has changed. ->**Note**  For some reason event “[4985](event-4985.md)(S): The state of a transaction has changed" from [Audit File System](audit-file-system.md) subcategory generates also in this subcategory. See description of event [4985](event-4985.md) in [Audit File System](audit-file-system.md) subcategory. +>[!NOTE] +> The event “[4985](event-4985.md)(S): The state of a transaction has changed" from [Audit File System](audit-file-system.md) subcategory also generates in this subcategory. See description of event [4985](event-4985.md) in [Audit File System](audit-file-system.md) subcategory. diff --git a/windows/security/threat-protection/auditing/audit-special-logon.md b/windows/security/threat-protection/auditing/audit-special-logon.md index bfd47e55e9..ec7e84c990 100644 --- a/windows/security/threat-protection/auditing/audit-special-logon.md +++ b/windows/security/threat-protection/auditing/audit-special-logon.md @@ -1,13 +1,16 @@ --- title: Audit Special Logon (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Special Logon, which determines whether the operating system generates audit events under special sign on (or log on) circumstances. +description: The Advanced Security Audit policy setting, Audit Special Logon, determines if audit events are generated under special sign in (or logon) circumstances. ms.assetid: e1501bac-1d09-4593-8ebb-f311231567d3 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- @@ -34,9 +37,9 @@ This subcategory allows you to audit events generated by special logons such as | Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | |-------------------|-----------------|-----------------|------------------|------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Domain Controller | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](http://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.
                                  At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Member Server | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](http://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.
                                  At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | -| Workstation | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](http://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.
                                  At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Domain Controller | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.
                                  At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.
                                  At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | Yes | No | Yes | No | This subcategory is very important because of [Special Groups](https://blogs.technet.com/b/askds/archive/2008/03/11/special-groups-auditing-via-group-policy-preferences.aspx) related events, you must enable this subcategory for Success audit if you use this feature.
                                  At the same time this subcategory allows you to track account logon sessions to which sensitive privileges were assigned.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | **Events List:** diff --git a/windows/security/threat-protection/auditing/audit-system-integrity.md b/windows/security/threat-protection/auditing/audit-system-integrity.md index a244a43880..89d27ff3cb 100644 --- a/windows/security/threat-protection/auditing/audit-system-integrity.md +++ b/windows/security/threat-protection/auditing/audit-system-integrity.md @@ -1,13 +1,16 @@ --- title: Audit System Integrity (Windows 10) -description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit System Integrity, which determines whether the operating system audits events that violate the integrity of the security subsystem. +description: The policy setting, Audit System Integrity, determines if the operating system audits events that violate the integrity of the security subsystem. ms.assetid: 942a9a7f-fa31-4067-88c7-f73978bf2034 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-token-right-adjusted.md b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md new file mode 100644 index 0000000000..a4fb47fef4 --- /dev/null +++ b/windows/security/threat-protection/auditing/audit-token-right-adjusted.md @@ -0,0 +1,27 @@ +--- +title: Audit Token Right Adjusted (Windows 10) +description: This topic for the IT professional describes the Advanced Security Audit policy setting, Audit Token Right Adjusted, which determines whether the operating system generates audit events when specific changes are made to the privileges of a token. +--- + +# Audit Token Right Adjusted + +**Applies to** +- Windows 10 +- Windows Server 2016 + + +Audit Token Right Adjusted allows you to audit events generated by adjusting the privileges of a token. + +For more information, see [Security Monitoring: A Possible New Way to Detect Privilege Escalation](https://blogs.technet.microsoft.com/nathangau/2018/01/25/security-monitoring-a-possible-new-way-to-detect-privilege-escalation/). + +| Computer Type | General Success | General Failure | Stronger Success | Stronger Failure | Comments | +|-------------------|-----------------|-----------------|------------------|------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Domain Controller | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
                                  However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                                  If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Member Server | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
                                  However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                                  If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | +| Workstation | IF | No | IF | No | IF – With Success auditing for this subcategory, you can get information related to changes to the privileges of a token.
                                  However, if you are using an application or system service that dynamically adjusts token privileges, we do not recommend Success auditing because of the high volume of event “[4703](event-4703.md)(S): A user right was adjusted” that may be generated. As of Windows 10, event 4703 is generated by applications or services that dynamically adjust token privileges. An example of such an application is System Center Configuration Manager, which makes WMI queries at recurring intervals and quickly generates a large number of 4703 events (with the WMI activity listed as coming from **svchost.exe**).
                                  If one of your applications or services is generating a large number of 4703 events, you might find that your event-management software has filtering logic that can automatically discard the recurring events, which would make it easier to work with Success auditing for this category.
                                  This subcategory doesn’t have Failure events, so there is no recommendation to enable Failure auditing for this subcategory. | + +**Events List:** + +- [4703](event-4703.md)(S): A user right was adjusted. + +**Event volume**: High. diff --git a/windows/security/threat-protection/auditing/audit-user-account-management.md b/windows/security/threat-protection/auditing/audit-user-account-management.md index 3315c7f053..5b2d45cc98 100644 --- a/windows/security/threat-protection/auditing/audit-user-account-management.md +++ b/windows/security/threat-protection/auditing/audit-user-account-management.md @@ -1,13 +1,16 @@ --- title: Audit User Account Management (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit User Account Management, which determines whether the operating system generates audit events when specific user account management tasks are performed. +description: Audit User Account Management is an audit policy setting that determines if the operating system generates audit events when certain tasks are performed. ms.assetid: f7e72998-3858-4197-a443-19586ecc4bfb +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/audit-user-device-claims.md b/windows/security/threat-protection/auditing/audit-user-device-claims.md index 988736426a..74c7755cb8 100644 --- a/windows/security/threat-protection/auditing/audit-user-device-claims.md +++ b/windows/security/threat-protection/auditing/audit-user-device-claims.md @@ -1,13 +1,16 @@ --- title: Audit User/Device Claims (Windows 10) -description: This topic for the IT professional describes the advanced security audit policy setting, Audit User/Device Claims, which enables you to audit security events that are generated by user and device claims. +description: Audit User/Device Claims is an audit policy setting which enables you to audit security events that are generated by user and device claims. ms.assetid: D3D2BFAF-F2C0-462A-9377-673DB49D5486 +ms.reviewer: +manager: dansimp +ms.author: dansimp ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 --- diff --git a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md index 7f78b5f46d..f345a84336 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-logon-events.md @@ -2,12 +2,14 @@ title: Audit account logon events (Windows 10) description: Determines whether to audit each instance of a user logging on to or logging off from another device in which this device is used to validate the account. ms.assetid: 84B44181-E325-49A1-8398-AECC3CE0A516 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -45,9 +47,9 @@ You can configure this security setting by opening the appropriate policy under | 681 | Logon failure. A domain account logon was attempted. This event is not generated in Windows XP or in the Windows Server 2003 family. | | 682 | A user has reconnected to a disconnected terminal server session. | | 683 | A user disconnected a terminal server session without logging off. | -  + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -  -  + + diff --git a/windows/security/threat-protection/auditing/basic-audit-account-management.md b/windows/security/threat-protection/auditing/basic-audit-account-management.md index ac22b4c4fe..e699a88ac1 100644 --- a/windows/security/threat-protection/auditing/basic-audit-account-management.md +++ b/windows/security/threat-protection/auditing/basic-audit-account-management.md @@ -2,12 +2,14 @@ title: Audit account management (Windows 10) description: Determines whether to audit each event of account management on a device. ms.assetid: 369197E1-7E0E-45A4-89EA-16D91EF01689 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -18,7 +20,7 @@ ms.date: 04/19/2017 # Audit account management **Applies to** -- Windows 10 +- Windows 10 Determines whether to audit each event of account management on a device. @@ -40,54 +42,55 @@ set this value to **No auditing**, in the **Properties** dialog box for this pol You can configure this security setting by opening the appropriate policy under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. -| Account management events | Description | -| - | - | -| 624 | A user account was created.| -| 627 | A user password was changed.| -| 628 | A user password was set. | -| 630 | A user account was deleted.| -| 631 | A global group was created. | -| 632 | A member was added to a global group.| -| 633 | A member was removed from a global group.| -| 634 | A global group was deleted. | -| 635 | A new local group was created.| -| 636 | A member was added to a local group.| -| 637 | A member was removed from a local group.| -| 638 | A local group was deleted. | -| 639 | A local group account was changed.| -| 641 | A global group account was changed.| -| 642 | A user account was changed. | -| 643 | A domain policy was modified. | -| 644 | A user account was auto locked. | -| 645 | A computer account was created. | -| 646 | A computer account was changed. | -| 647 | A computer account was deleted. | -| 648 | A local security group with security disabled was created.
                                  **Note:** SECURITY_DISABLED in the formal name means that this group cannot be used to grant permissions in access checks. | | -| 649 | A local security group with security disabled was changed. | -| 650 | A member was added to a security-disabled local security group. | -| 651 | A member was removed from a security-disabled local security group. | -| 652 | A security-disabled local group was deleted. | -| 653 | A security-disabled global group was created. | -| 645 | A security-disabled global group was changed. | -| 655 | A member was added to a security-disabled global group. | -| 656 | A member was removed from a security-disabled global group. | -| 657 | A security-disabled global group was deleted. | -| 658 | A security-enabled universal group was created. | -| 659 | A security-enabled universal group was changed. | -| 660 | A member was added to a security-enabled universal group. | -| 661 | A member was removed from a security-enabled universal group. | -| 662 | A security-enabled universal group was deleted. | -| 663 | A security-disabled universal group was created. | -| 664 | A security-disabled universal group was changed. | -| 665 | A member was added to a security-disabled universal group. | -| 666 | A member was removed from a security-disabled universal group. | -| 667 | A security-disabled universal group was deleted. | -| 668 | A group type was changed. | -| 684 | Set the security descriptor of members of administrative groups. | -| 685 | Set the security descriptor of members of administrative groups.
                                  **Note:**  Every 60 minutes on a domain controller a background thread searches all members of administrative groups (such as domain, enterprise, and schema administrators) and applies a fixed security descriptor on them. This event is logged.| -  + +| Account management events | Description | +|---------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 624 | A user account was created. | +| 627 | A user password was changed. | +| 628 | A user password was set. | +| 630 | A user account was deleted. | +| 631 | A global group was created. | +| 632 | A member was added to a global group. | +| 633 | A member was removed from a global group. | +| 634 | A global group was deleted. | +| 635 | A new local group was created. | +| 636 | A member was added to a local group. | +| 637 | A member was removed from a local group. | +| 638 | A local group was deleted. | +| 639 | A local group account was changed. | +| 641 | A global group account was changed. | +| 642 | A user account was changed. | +| 643 | A domain policy was modified. | +| 644 | A user account was auto locked. | +| 645 | A computer account was created. | +| 646 | A computer account was changed. | +| 647 | A computer account was deleted. | +| 648 | A local security group with security disabled was created.
                                  **Note:** SECURITY_DISABLED in the formal name means that this group cannot be used to grant permissions in access checks. | +| 649 | A local security group with security disabled was changed. | +| 650 | A member was added to a security-disabled local security group. | +| 651 | A member was removed from a security-disabled local security group. | +| 652 | A security-disabled local group was deleted. | +| 653 | A security-disabled global group was created. | +| 645 | A security-disabled global group was changed. | +| 655 | A member was added to a security-disabled global group. | +| 656 | A member was removed from a security-disabled global group. | +| 657 | A security-disabled global group was deleted. | +| 658 | A security-enabled universal group was created. | +| 659 | A security-enabled universal group was changed. | +| 660 | A member was added to a security-enabled universal group. | +| 661 | A member was removed from a security-enabled universal group. | +| 662 | A security-enabled universal group was deleted. | +| 663 | A security-disabled universal group was created. | +| 664 | A security-disabled universal group was changed. | +| 665 | A member was added to a security-disabled universal group. | +| 666 | A member was removed from a security-disabled universal group. | +| 667 | A security-disabled universal group was deleted. | +| 668 | A group type was changed. | +| 684 | Set the security descriptor of members of administrative groups. | +| 685 | Set the security descriptor of members of administrative groups.
                                  **Note:** Every 60 minutes on a domain controller a background thread searches all members of administrative groups (such as domain, enterprise, and schema administrators) and applies a fixed security descriptor on them. This event is logged. | + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -  -  + + diff --git a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md index 0de79e98e7..530a4255bc 100644 --- a/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md +++ b/windows/security/threat-protection/auditing/basic-audit-directory-service-access.md @@ -1,13 +1,15 @@ --- -title: Audit directory service access (Windows 10) +title: Basic audit directory service access (Windows 10) description: Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified. ms.assetid: 52F02EED-3CFE-4307-8D06-CF1E27693D09 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -26,7 +28,7 @@ By default, this value is set to no auditing in the Default Domain Controller Gr If you define this policy setting, you can specify whether to audit successes, audit failures, or not audit the event type at all. Success audits generate an audit entry when a user successfully accesses an Active Directory object that has a SACL specified. Failure audits generate an audit entry when a user unsuccessfully attempts to access an Active Directory object that has a SACL specified. To set this value to **No auditing,** in the **Properties** dialog box for this policy setting, select the **Define these policy settings** check box and clear the **Success** and **Failure** check boxes. > **Note:**  You can set a SACL on an Active Directory object by using the **Security** tab in that object's **Properties** dialog box. This is the same as Audit object access, except that it applies only to Active Directory objects and not to file system and registry objects. -  + **Default:** - Success on domain controllers. @@ -41,9 +43,9 @@ There is only one directory service access event, which is identical to the Obje | Directory service access events | Description | |---------------------------------|----------------------------------------| | 566 | A generic object operation took place. | -  + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -  -  + + diff --git a/windows/security/threat-protection/auditing/basic-audit-logon-events.md b/windows/security/threat-protection/auditing/basic-audit-logon-events.md index 2bcf48cc8b..5c7672c13a 100644 --- a/windows/security/threat-protection/auditing/basic-audit-logon-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-logon-events.md @@ -2,12 +2,14 @@ title: Audit logon events (Windows 10) description: Determines whether to audit each instance of a user logging on to or logging off from a device. ms.assetid: 78B5AFCB-0BBD-4C38-9FE9-6B4571B94A35 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -63,7 +65,7 @@ You can configure this security setting by opening the appropriate policy under | 552 | A user successfully logged on to a computer using explicit credentials while already logged on as a different user. | | 682 | A user has reconnected to a disconnected terminal server session. | | 683 | A user disconnected a terminal server session without logging off. | -  + When event 528 is logged, a logon type is also listed in the event log. The following table describes each logon type. @@ -78,9 +80,9 @@ When event 528 is logged, a logon type is also listed in the event log. The foll | 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections.| | 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop.| | 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials.| -  + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -  -  + + diff --git a/windows/security/threat-protection/auditing/basic-audit-object-access.md b/windows/security/threat-protection/auditing/basic-audit-object-access.md index ec41b532a0..b6b09ddae8 100644 --- a/windows/security/threat-protection/auditing/basic-audit-object-access.md +++ b/windows/security/threat-protection/auditing/basic-audit-object-access.md @@ -1,13 +1,15 @@ --- title: Audit object access (Windows 10) -description: Determines whether to audit the event of a user accessing an object--for example, a file, folder, registry key, printer, and so forth--that has its own system access control list (SACL) specified. +description: The policy setting, Audit object access, determines whether to audit the event generated when a user accesses an object that has its own SACL specified. ms.assetid: D15B6D67-7886-44C2-9972-3F192D5407EA +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -18,7 +20,7 @@ ms.date: 04/19/2017 # Audit object access **Applies to** -- Windows 10 +- Windows 10 Determines whether to audit the event of a user accessing an object--for example, a file, folder, registry key, printer, and so forth--that has its own system access control list (SACL) specified. @@ -26,60 +28,61 @@ If you define this policy setting, you can specify whether to audit successes, a To set this value to **No auditing**, in the **Properties** dialog box for this policy setting, select the Define these policy settings check box and clear the **Success** and **Failure** check boxes. -> **Note:**  You can set a SACL on a file system object using the **Security** tab in that object's **Properties** dialog box. -  +> **Note:** You can set a SACL on a file system object using the **Security** tab in that object's **Properties** dialog box. + **Default:** No auditing. ## Configure this audit setting You can configure this security setting by opening the appropriate policy under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. -| Object access events | Description | -| - | - | -| 560 | Access was granted to an already existing object.| -| 562 | A handle to an object was closed. | -| 563 | An attempt was made to open an object with the intent to delete it.
                                  **Note: **  This is used by file systems when the FILE_DELETE_ON_CLOSE flag is specified in Createfile().|| -| 564 | A protected object was deleted. | -| 565 | Access was granted to an already existing object type.| -| 567 | A permission associated with a handle was used.
                                  **Note: **  A handle is created with certain granted permissions (Read, Write, and so on). When the handle is used, up to one audit is generated for each of the permissions that was used.| -| 568 | An attempt was made to create a hard link to a file that is being audited. | -| 569 | The resource manager in Authorization Manager attempted to create a client context.| -| 570 | A client attempted to access an object.
                                  **Note:**  An event will be generated for every attempted operation on the object.| -| 571 | The client context was deleted by the Authorization Manager application. | -| 572 | The administrator manager initialized the application. | -| 772 | The certificate manager denied a pending certificate request.| -| 773 | Certificate Services received a resubmitted certificate request.| -| 774 | Certificate Services revoked a certificate.| -| 775 | Certificate Services received a request to publish the certificate revocation list (CRL).| -| 776 | Certificate Services published the certificate revocation list (CRL). | -| 777 | A certificate request extension was made. | -| 778 | One or more certificate request attributes changed.| -| 779 | Certificate Services received a request to shutdown.| -| 780 | Certificate Services backup started. | -| 781 | Certificate Services backup completed | -| 782 | Certificate Services restore started. | -| 783 | Certificate Services restore completed.| -| 784 | Certificate Services started. | -| 785 | Certificate Services stopped. | -| 786 | The security permissions for Certificate Services changed.| -| 787 | Certificate Services retrieved an archived key. | -| 788 | Certificate Services imported a certificate into its database.| -| 789 | The audit filter for Certificate Services changed. | -| 790 | Certificate Services received a certificate request.| -| 791 | Certificate Services approved a certificate request and issued a certificate.| -| 792 | Certificate Services denied a certificate request. | -| 793 | Certificate Services set the status of a certificate request to pending.| -| 794 | The certificate manager settings for Certificate Services changed. | -| 795 | A configuration entry changed in Certificate Services. | -| 796 | A property of Certificate Services changed. | -| 797 | Certificate Services archived a key. | -| 798 | Certificate Services imported and archived a key.| -| 799 | Certificate Services published the CA certificate to Active Directory.| -| 800 | One or more rows have been deleted from the certificate database. | -| 801 | Role separation enabled. | + +| Object access events | Description | +|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| 560 | Access was granted to an already existing object. | +| 562 | A handle to an object was closed. | +| 563 | An attempt was made to open an object with the intent to delete it.
                                  \*\*Note: \*\* This is used by file systems when the FILE_DELETE_ON_CLOSE flag is specified in Createfile(). | +| 564 | A protected object was deleted. | +| 565 | Access was granted to an already existing object type. | +| 567 | A permission associated with a handle was used.
                                  \*\*Note: \*\* A handle is created with certain granted permissions (Read, Write, and so on). When the handle is used, up to one audit is generated for each of the permissions that was used. | +| 568 | An attempt was made to create a hard link to a file that is being audited. | +| 569 | The resource manager in Authorization Manager attempted to create a client context. | +| 570 | A client attempted to access an object.
                                  **Note:** An event will be generated for every attempted operation on the object. | +| 571 | The client context was deleted by the Authorization Manager application. | +| 572 | The administrator manager initialized the application. | +| 772 | The certificate manager denied a pending certificate request. | +| 773 | Certificate Services received a resubmitted certificate request. | +| 774 | Certificate Services revoked a certificate. | +| 775 | Certificate Services received a request to publish the certificate revocation list (CRL). | +| 776 | Certificate Services published the certificate revocation list (CRL). | +| 777 | A certificate request extension was made. | +| 778 | One or more certificate request attributes changed. | +| 779 | Certificate Services received a request to shutdown. | +| 780 | Certificate Services backup started. | +| 781 | Certificate Services backup completed | +| 782 | Certificate Services restore started. | +| 783 | Certificate Services restore completed. | +| 784 | Certificate Services started. | +| 785 | Certificate Services stopped. | +| 786 | The security permissions for Certificate Services changed. | +| 787 | Certificate Services retrieved an archived key. | +| 788 | Certificate Services imported a certificate into its database. | +| 789 | The audit filter for Certificate Services changed. | +| 790 | Certificate Services received a certificate request. | +| 791 | Certificate Services approved a certificate request and issued a certificate. | +| 792 | Certificate Services denied a certificate request. | +| 793 | Certificate Services set the status of a certificate request to pending. | +| 794 | The certificate manager settings for Certificate Services changed. | +| 795 | A configuration entry changed in Certificate Services. | +| 796 | A property of Certificate Services changed. | +| 797 | Certificate Services archived a key. | +| 798 | Certificate Services imported and archived a key. | +| 799 | Certificate Services published the CA certificate to Active Directory. | +| 800 | One or more rows have been deleted from the certificate database. | +| 801 | Role separation enabled. | ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -  -  + + diff --git a/windows/security/threat-protection/auditing/basic-audit-policy-change.md b/windows/security/threat-protection/auditing/basic-audit-policy-change.md index 129ea370a0..b80e5788af 100644 --- a/windows/security/threat-protection/auditing/basic-audit-policy-change.md +++ b/windows/security/threat-protection/auditing/basic-audit-policy-change.md @@ -2,12 +2,14 @@ title: Audit policy change (Windows 10) description: Determines whether to audit every incident of a change to user rights assignment policies, audit policies, or trust policies. ms.assetid: 1025A648-6B22-4C85-9F47-FE0897F1FA31 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -58,9 +60,9 @@ You can configure this security setting under Computer Configuration\\Windows Se | 770 | Trusted forest information was deleted.
                                  **Note:**  This event message is generated when forest trust information is updated and one or more entries are added. One event message is generated per added, deleted, or modified entry. If multiple entries are added, deleted, or modified in a single update of the forest trust information, all the generated event messages have a single unique identifier called an operation ID. This allows you to determine that the multiple generated event messages are the result of a single operation. Not all parameters are valid for each entry type. For example, parameters such as DNS name, NetBIOS name and SID are not valid for an entry of type "TopLevelName".| | 771 | Trusted forest information was modified.
                                  **Note:**  This event message is generated when forest trust information is updated and one or more entries are added. One event message is generated per added, deleted, or modified entry. If multiple entries are added, deleted, or modified in a single update of the forest trust information, all the generated event messages have a single unique identifier called an operation ID. This allows you to determine that the multiple generated event messages are the result of a single operation. Not all parameters are valid for each entry type. For example, parameters such as DNS name, NetBIOS name and SID are not valid for an entry of type "TopLevelName".| | 805 | The event log service read the security log configuration for a session. -  + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -  -  + + diff --git a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md index 7980a4d633..a3e7893fe6 100644 --- a/windows/security/threat-protection/auditing/basic-audit-privilege-use.md +++ b/windows/security/threat-protection/auditing/basic-audit-privilege-use.md @@ -2,12 +2,14 @@ title: Audit privilege use (Windows 10) description: Determines whether to audit each instance of a user exercising a user right. ms.assetid: C5C6DAAF-8B58-4DFB-B1CE-F0675AE0E9F8 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -47,9 +49,9 @@ You can configure this security setting under Computer Configuration\\Windows Se | 576 | Specified privileges were added to a user's access token.
                                  **Note:**  This event is generated when the user logs on.| | 577 | A user attempted to perform a privileged system service operation. | | 578 | Privileges were used on an already open handle to a protected object. | -  + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -  -  + + diff --git a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md index 6c5869c87d..4f02eab9a3 100644 --- a/windows/security/threat-protection/auditing/basic-audit-process-tracking.md +++ b/windows/security/threat-protection/auditing/basic-audit-process-tracking.md @@ -2,12 +2,14 @@ title: Audit process tracking (Windows 10) description: Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access. ms.assetid: 91AC5C1E-F4DA-4B16-BEE2-C92D66E4CEEA +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -45,9 +47,9 @@ You can configure this security setting under Computer Configuration\\Windows Se | 600 | A process was assigned a primary token.| | 601 | A user attempted to install a service. | | 602 | A scheduler job was created. | -  + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -  -  + + diff --git a/windows/security/threat-protection/auditing/basic-audit-system-events.md b/windows/security/threat-protection/auditing/basic-audit-system-events.md index efc11bd08e..7811de4253 100644 --- a/windows/security/threat-protection/auditing/basic-audit-system-events.md +++ b/windows/security/threat-protection/auditing/basic-audit-system-events.md @@ -2,12 +2,14 @@ title: Audit system events (Windows 10) description: Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log. ms.assetid: BF27588C-2AA7-4365-A4BF-3BB377916447 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policies.md b/windows/security/threat-protection/auditing/basic-security-audit-policies.md index 9a3ba69bf5..1e73acf50d 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policies.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policies.md @@ -2,12 +2,14 @@ title: Basic security audit policies (Windows 10) description: Before you implement auditing, you must decide on an auditing policy. ms.assetid: 3B678568-7AD7-4734-9BB4-53CF5E04E1D3 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -44,5 +46,5 @@ If you choose to audit access to objects as part of your audit policy, you must | [Apply a basic audit policy on a file or folder](apply-a-basic-audit-policy-on-a-file-or-folder.md) | You can apply audit policies to individual files and folders on your computer by setting the permission type to record successful access attempts or failed access attempts in the security log. | | [View the security event log](view-the-security-event-log.md) | The security log records each event as defined by the audit policies you set on each object.| | [Basic security audit policy settings](basic-security-audit-policy-settings.md) | Basic security audit policy settings are found under Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy.| -  -  + + diff --git a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md index 2a98ef92e3..686cdfdc71 100644 --- a/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/basic-security-audit-policy-settings.md @@ -2,12 +2,14 @@ title: Basic security audit policy settings (Windows 10) description: Basic security audit policy settings are found under Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Audit Policy. ms.assetid: 31C2C453-2CFC-4D9E-BC88-8CE1C1A8F900 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance @@ -35,9 +37,9 @@ Basic security audit policy settings are found under Computer Configuration\\Win | [Audit privilege use](basic-audit-privilege-use.md) | Determines whether to audit each instance of a user exercising a user right. | | [Audit process tracking](basic-audit-process-tracking.md) | Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access.| | [Audit system events](basic-audit-system-events.md) | Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log. | -  + ## Related topics - [Basic security audit policy settings](basic-security-audit-policy-settings.md) -  -  + + diff --git a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md index b3ca1eb32d..745c787671 100644 --- a/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md +++ b/windows/security/threat-protection/auditing/create-a-basic-audit-policy-settings-for-an-event-category.md @@ -2,12 +2,14 @@ title: Create a basic audit policy for an event category (Windows 10) description: By defining auditing settings for specific event categories, you can create an auditing policy that suits the security needs of your organization. ms.assetid: C9F52751-B40D-482E-BE9D-2C61098249D3 +ms.reviewer: +ms.author: dansimp ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security ms.localizationpriority: none -author: justinha +author: dansimp manager: dansimp audience: ITPro ms.collection: M365-security-compliance diff --git a/windows/security/threat-protection/auditing/event-1100.md b/windows/security/threat-protection/auditing/event-1100.md index 8ae8a12264..251aa8834c 100644 --- a/windows/security/threat-protection/auditing/event-1100.md +++ b/windows/security/threat-protection/auditing/event-1100.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 1100(S): The event logging service has shut down. diff --git a/windows/security/threat-protection/auditing/event-1102.md b/windows/security/threat-protection/auditing/event-1102.md index 4508e8029a..c1d44d55e0 100644 --- a/windows/security/threat-protection/auditing/event-1102.md +++ b/windows/security/threat-protection/auditing/event-1102.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 1102(S): The audit log was cleared. diff --git a/windows/security/threat-protection/auditing/event-1104.md b/windows/security/threat-protection/auditing/event-1104.md index 36c41f9d28..5854f68b90 100644 --- a/windows/security/threat-protection/auditing/event-1104.md +++ b/windows/security/threat-protection/auditing/event-1104.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 1104(S): The security log is now full. diff --git a/windows/security/threat-protection/auditing/event-1105.md b/windows/security/threat-protection/auditing/event-1105.md index 9b170d57a8..cd3b89cac3 100644 --- a/windows/security/threat-protection/auditing/event-1105.md +++ b/windows/security/threat-protection/auditing/event-1105.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 1105(S): Event log automatic backup. diff --git a/windows/security/threat-protection/auditing/event-1108.md b/windows/security/threat-protection/auditing/event-1108.md index 937b44bb97..0aaa3b6a99 100644 --- a/windows/security/threat-protection/auditing/event-1108.md +++ b/windows/security/threat-protection/auditing/event-1108.md @@ -1,13 +1,16 @@ --- -title: 1108(S) The event logging service encountered an error while processing an incoming event published from %1. (Windows 10) +title: The event logging service encountered an error (Windows 10) description: Describes security event 1108(S) The event logging service encountered an error while processing an incoming event published from %1. ms.pagetype: security ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 1108(S): The event logging service encountered an error while processing an incoming event published from %1. diff --git a/windows/security/threat-protection/auditing/event-4608.md b/windows/security/threat-protection/auditing/event-4608.md index cff87d7dea..22a7d07d71 100644 --- a/windows/security/threat-protection/auditing/event-4608.md +++ b/windows/security/threat-protection/auditing/event-4608.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4608(S): Windows is starting up. diff --git a/windows/security/threat-protection/auditing/event-4610.md b/windows/security/threat-protection/auditing/event-4610.md index b774388a33..c9be68814f 100644 --- a/windows/security/threat-protection/auditing/event-4610.md +++ b/windows/security/threat-protection/auditing/event-4610.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4610(S): An authentication package has been loaded by the Local Security Authority. diff --git a/windows/security/threat-protection/auditing/event-4611.md b/windows/security/threat-protection/auditing/event-4611.md index 4683b8e287..d245a30f27 100644 --- a/windows/security/threat-protection/auditing/event-4611.md +++ b/windows/security/threat-protection/auditing/event-4611.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4611(S): A trusted logon process has been registered with the Local Security Authority. diff --git a/windows/security/threat-protection/auditing/event-4612.md b/windows/security/threat-protection/auditing/event-4612.md index 4a380aceb6..2ca7cca35a 100644 --- a/windows/security/threat-protection/auditing/event-4612.md +++ b/windows/security/threat-protection/auditing/event-4612.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4612(S): Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. @@ -27,9 +30,9 @@ There is no example of this event in this document. ***Event Schema:*** -*Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. * +*Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits.* -*Number of audit messages discarded: %1 * +*Number of audit messages discarded: %1* *This event is generated when audit queues are filled and events must be discarded. This most commonly occurs when security events are being generated faster than they are being written to disk, or when the auditing system loses connectivity to the event log, such as when the event log service is stopped.* diff --git a/windows/security/threat-protection/auditing/event-4614.md b/windows/security/threat-protection/auditing/event-4614.md index 5d049126d3..8dd6e72adc 100644 --- a/windows/security/threat-protection/auditing/event-4614.md +++ b/windows/security/threat-protection/auditing/event-4614.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4614(S): A notification package has been loaded by the Security Account Manager. diff --git a/windows/security/threat-protection/auditing/event-4615.md b/windows/security/threat-protection/auditing/event-4615.md index 2f460fcef2..9231f28b82 100644 --- a/windows/security/threat-protection/auditing/event-4615.md +++ b/windows/security/threat-protection/auditing/event-4615.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4615(S): Invalid use of LPC port. @@ -45,7 +48,7 @@ It appears that this event never occurs. *LPC Server Port Name:%6* -*Windows Local Security Authority (LSA) communicates with the Windows kernel using Local Procedure Call (LPC) ports. If you see this event, an application has inadvertently or intentionally accessed this port which is reserved exclusively for LSA’s use. The application (process) should be investigated to ensure that it is not attempting to tamper with this communications channel." * +*Windows Local Security Authority (LSA) communicates with the Windows kernel using Local Procedure Call (LPC) ports. If you see this event, an application has inadvertently or intentionally accessed this port which is reserved exclusively for LSA’s use. The application (process) should be investigated to ensure that it is not attempting to tamper with this communications channel."* ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4616.md b/windows/security/threat-protection/auditing/event-4616.md index 8079480ca1..8681a67e8f 100644 --- a/windows/security/threat-protection/auditing/event-4616.md +++ b/windows/security/threat-protection/auditing/event-4616.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4616(S): The system time was changed. diff --git a/windows/security/threat-protection/auditing/event-4618.md b/windows/security/threat-protection/auditing/event-4618.md index 6f99221add..9dcc575df1 100644 --- a/windows/security/threat-protection/auditing/event-4618.md +++ b/windows/security/threat-protection/auditing/event-4618.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4618(S): A monitored security event pattern has occurred. diff --git a/windows/security/threat-protection/auditing/event-4621.md b/windows/security/threat-protection/auditing/event-4621.md index b0b851608d..f3365acf99 100644 --- a/windows/security/threat-protection/auditing/event-4621.md +++ b/windows/security/threat-protection/auditing/event-4621.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4621(S): Administrator recovered system from CrashOnAuditFail. diff --git a/windows/security/threat-protection/auditing/event-4622.md b/windows/security/threat-protection/auditing/event-4622.md index 392f672814..e425430b75 100644 --- a/windows/security/threat-protection/auditing/event-4622.md +++ b/windows/security/threat-protection/auditing/event-4622.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4622(S): A security package has been loaded by the Local Security Authority. diff --git a/windows/security/threat-protection/auditing/event-4624.md b/windows/security/threat-protection/auditing/event-4624.md index 4b806cfc45..1eaf9e6b79 100644 --- a/windows/security/threat-protection/auditing/event-4624.md +++ b/windows/security/threat-protection/auditing/event-4624.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4624(S): An account was successfully logged on. @@ -30,55 +33,55 @@ This event generates when a logon session is created (on destination machine). I
                                  ***Event XML:*** -``` -- -- - - 4624 - 2 - 0 - 12544 - 0 - 0x8020000000000000 - - 211 - - - Security - WIN-GG82ULGC9GO - - -- - S-1-5-18 - WIN-GG82ULGC9GO$ - WORKGROUP - 0x3e7 - S-1-5-21-1377283216-344919071-3415362939-500 - Administrator - WIN-GG82ULGC9GO - 0x8dcdc - 2 - User32 - Negotiate - WIN-GG82ULGC9GO - {00000000-0000-0000-0000-000000000000} - - - - - 0 - 0x44c - C:\\Windows\\System32\\svchost.exe - 127.0.0.1 - 0 - %%1833 - - - - - - - %%1843 - 0x0 - %%1842 - - - +```xml + + + + + 4624 + 2 + 0 + 12544 + 0 + 0x8020000000000000 + + 211 + + + Security + WIN-GG82ULGC9GO + + + + S-1-5-18 + WIN-GG82ULGC9GO$ + WORKGROUP + 0x3e7 + S-1-5-21-1377283216-344919071-3415362939-500 + Administrator + WIN-GG82ULGC9GO + 0x8dcdc + 2 + User32 + Negotiate + WIN-GG82ULGC9GO + {00000000-0000-0000-0000-000000000000} + - + - + 0 + 0x44c + C:\\Windows\\System32\\svchost.exe + 127.0.0.1 + 0 + %%1833 + - + - + - + %%1843 + 0x0 + %%1842 + + ``` ***Required Server Roles:*** None. @@ -135,23 +138,23 @@ This event generates when a logon session is created (on destination machine). I - **Logon ID** \[Type = HexInt64\]**:** hexadecimal value that can help you correlate this event with recent events that might contain the same Logon ID, for example, “[4672](event-4672.md)(S): Special privileges assigned to new logon.” -**Logon Information** \[Version 2\]**: ** +**Logon Information** \[Version 2\]**:** - **Logon Type** \[Version 0, 1, 2\] \[Type = UInt32\]**:** the type of logon which was performed. The table below contains the list of possible values for this field. ## Logon types and descriptions -| Logon Type | Logon Title | Description | -|------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| 2 | Interactive | A user logged on to this computer. | -| 3 | Network | A user or computer logged on to this computer from the network. | -| 4 | Batch | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | -| 5 | Service | A service was started by the Service Control Manager. | -| 7 | Unlock | This workstation was unlocked. | -| 8 | NetworkCleartext | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). | -| 9 | NewCredentials | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | -| 10 | RemoteInteractive | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | -| 11 | CachedInteractive | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | +| Logon Type | Logon Title | Description | +|:----------:|---------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `2` | `Interactive` | A user logged on to this computer. | +| `3` | `Network` | A user or computer logged on to this computer from the network. | +| `4` | `Batch` | Batch logon type is used by batch servers, where processes may be executing on behalf of a user without their direct intervention. | +| `5` | `Service` | A service was started by the Service Control Manager. | +| `7` | `Unlock` | This workstation was unlocked. | +| `8` | `NetworkCleartext` | A user logged on to this computer from the network. The user's password was passed to the authentication package in its unhashed form. The built-in authentication packages all hash credentials before sending them across the network. The credentials do not traverse the network in plaintext (also called cleartext). | +| `9` | `NewCredentials` | A caller cloned its current token and specified new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. | +| `10` | `RemoteInteractive` | A user logged on to this computer remotely using Terminal Services or Remote Desktop. | +| `11` | `CachedInteractive` | A user logged on to this computer with network credentials that were stored locally on the computer. The domain controller was not contacted to verify the credentials. | - **Restricted Admin Mode** \[Version 2\] \[Type = UnicodeString\]**:** Only populated for **RemoteInteractive** logon type sessions. This is a Yes/No flag indicating if the credentials provided were passed using Restricted Admin mode. Restricted Admin mode was added in Win8.1/2012R2 but this flag was added to the event in Win10. diff --git a/windows/security/threat-protection/auditing/event-4625.md b/windows/security/threat-protection/auditing/event-4625.md index 2c05bde4a6..08fcff8219 100644 --- a/windows/security/threat-protection/auditing/event-4625.md +++ b/windows/security/threat-protection/auditing/event-4625.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4625(F): An account failed to log on. @@ -76,7 +79,6 @@ This event generates on domain controllers, member servers, and workstations. 0                                   - ``` ***Required Server Roles:*** None. @@ -164,7 +166,7 @@ This event generates on domain controllers, member servers, and workstations. | 0xC0000072 | User logon to account disabled by administrator | | 0XC00000DC | Indicates the Sam Server was in the wrong state to perform the desired operation. | | 0XC0000133 | Clocks between DC and other computer too far out of sync | -| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine | +| 0XC000015B | The user has not been granted the requested logon type (aka logon right) at this machine | | 0XC000018C | The logon request failed because the trust relationship between the primary domain and the trusted domain failed. | | 0XC0000192 | An attempt was made to logon, but the N**etlogon** service was not started. | | 0xC0000193 | User logon with expired account | @@ -176,7 +178,7 @@ This event generates on domain controllers, member servers, and workstations. | 0x0 | Status OK. | > Table: Windows logon status codes. - +> > **Note**  To see the meaning of other status\\sub-status codes you may also check for status code in the Window header file ntstatus.h in Windows SDK. More information: diff --git a/windows/security/threat-protection/auditing/event-4626.md b/windows/security/threat-protection/auditing/event-4626.md index d8a85f95bc..d0474f5941 100644 --- a/windows/security/threat-protection/auditing/event-4626.md +++ b/windows/security/threat-protection/auditing/event-4626.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4626(S): User/Device claims information. @@ -72,7 +75,6 @@ This event generates on the computer to which the logon was performed (target co -                                   - ``` ***Required Server Roles:*** None. @@ -155,7 +157,7 @@ This event generates on the computer to which the logon was performed (target co - “dadmin” – claim value. -**Device Claims** \[Type = UnicodeString\]**:** list of device claims for new logon session. For user accounts this field typically has “**-**“ value**.** For computer accounts this field has device claims listed. +**Device Claims** \[Type = UnicodeString\]**:** list of device claims for new logon session. For user accounts this field typically has “**-**“ value. For computer accounts this field has device claims listed. ## Security Monitoring Recommendations diff --git a/windows/security/threat-protection/auditing/event-4627.md b/windows/security/threat-protection/auditing/event-4627.md index 43df6798b8..37bc83b16f 100644 --- a/windows/security/threat-protection/auditing/event-4627.md +++ b/windows/security/threat-protection/auditing/event-4627.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4627(S): Group membership information. diff --git a/windows/security/threat-protection/auditing/event-4634.md b/windows/security/threat-protection/auditing/event-4634.md index 8e486213ed..c7fd725041 100644 --- a/windows/security/threat-protection/auditing/event-4634.md +++ b/windows/security/threat-protection/auditing/event-4634.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 11/20/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4634(S): An account was logged off. diff --git a/windows/security/threat-protection/auditing/event-4647.md b/windows/security/threat-protection/auditing/event-4647.md index fb96f3f25e..3cb68ae77c 100644 --- a/windows/security/threat-protection/auditing/event-4647.md +++ b/windows/security/threat-protection/auditing/event-4647.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4647(S): User initiated logoff. diff --git a/windows/security/threat-protection/auditing/event-4648.md b/windows/security/threat-protection/auditing/event-4648.md index a8a8518c4c..97bb3eda59 100644 --- a/windows/security/threat-protection/auditing/event-4648.md +++ b/windows/security/threat-protection/auditing/event-4648.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4648(S): A logon was attempted using explicit credentials. diff --git a/windows/security/threat-protection/auditing/event-4649.md b/windows/security/threat-protection/auditing/event-4649.md index 9214d1fc97..0c3b10dff5 100644 --- a/windows/security/threat-protection/auditing/event-4649.md +++ b/windows/security/threat-protection/auditing/event-4649.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4649(S): A replay attack was detected. diff --git a/windows/security/threat-protection/auditing/event-4656.md b/windows/security/threat-protection/auditing/event-4656.md index 68f1286e56..918d665121 100644 --- a/windows/security/threat-protection/auditing/event-4656.md +++ b/windows/security/threat-protection/auditing/event-4656.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4656(S, F): A handle to an object was requested. diff --git a/windows/security/threat-protection/auditing/event-4657.md b/windows/security/threat-protection/auditing/event-4657.md index cf9a1f22b9..f27a05c4d3 100644 --- a/windows/security/threat-protection/auditing/event-4657.md +++ b/windows/security/threat-protection/auditing/event-4657.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4657(S): A registry value was modified. diff --git a/windows/security/threat-protection/auditing/event-4658.md b/windows/security/threat-protection/auditing/event-4658.md index b8befe0926..1569c43d0f 100644 --- a/windows/security/threat-protection/auditing/event-4658.md +++ b/windows/security/threat-protection/auditing/event-4658.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4658(S): The handle to an object was closed. diff --git a/windows/security/threat-protection/auditing/event-4660.md b/windows/security/threat-protection/auditing/event-4660.md index 1eef286432..7c03634e8e 100644 --- a/windows/security/threat-protection/auditing/event-4660.md +++ b/windows/security/threat-protection/auditing/event-4660.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4660(S): An object was deleted. diff --git a/windows/security/threat-protection/auditing/event-4661.md b/windows/security/threat-protection/auditing/event-4661.md index f51210b9c3..13513c1eb8 100644 --- a/windows/security/threat-protection/auditing/event-4661.md +++ b/windows/security/threat-protection/auditing/event-4661.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4661(S, F): A handle to an object was requested. @@ -71,7 +74,6 @@ This event generates only if Success auditing is enabled for the [Audit Handle M {bf967a90-0de6-11d0-a285-00aa003049e2} %%5400 {ccc2dc7d-a6ad-4a7a-8846-c04e3cc53501} - ``` ***Required Server Roles:*** For an Active Directory object, the domain controller role is required. For a SAM object, there is no required role. @@ -133,15 +135,15 @@ This event generates only if Success auditing is enabled for the [Audit Handle M - SAM\_SERVER - distinguished name of the accessed object. > **Note**  The LDAP API references an LDAP object by its **distinguished name (DN)**. A DN is a sequence of relative distinguished names (RDN) connected by commas. - +> > An RDN is an attribute with an associated value in the form attribute=value; . These are examples of RDNs attributes: - +> > • DC - domainComponent - +> > • CN - commonName - +> > • OU - organizationalUnitName - +> > • O - organizationName - **Handle ID** \[Type = Pointer\]: hexadecimal value of a handle to **Object Name**. This field can help you correlate this event with other events that might contain the same Handle ID, for example, “[4662](event-4662.md): An operation was performed on an object.” This parameter might not be captured in the event, and in that case appears as “0x0”. diff --git a/windows/security/threat-protection/auditing/event-4662.md b/windows/security/threat-protection/auditing/event-4662.md index bc4d1b5050..31fd7fd716 100644 --- a/windows/security/threat-protection/auditing/event-4662.md +++ b/windows/security/threat-protection/auditing/event-4662.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4662(S, F): An operation was performed on an object. @@ -71,7 +74,6 @@ You will get one 4662 for each operation type which was performed. - ``` ***Required Server Roles:*** Active Directory domain controller. @@ -125,15 +127,15 @@ You will get one 4662 for each operation type which was performed. - **Object Name** \[Type = UnicodeString\]: distinguished name of the object that was accessed. > **Note**  The LDAP API references an LDAP object by its **distinguished name (DN)**. A DN is a sequence of relative distinguished names (RDN) connected by commas. - +> > An RDN is an attribute with an associated value in the form attribute=value; . These are examples of RDNs attributes: - +> > • DC - domainComponent - +> > • CN - commonName - +> > • OU - organizationalUnitName - +> > • O - organizationName - **Handle ID** \[Type = Pointer\]: hexadecimal value of a handle to **Object Name**. This field can help you correlate this event with other events that might contain the same Handle ID, for example, “[4661](event-4661.md): A handle to an object was requested.” This parameter might not be captured in the event, and in that case appears as “0x0”. diff --git a/windows/security/threat-protection/auditing/event-4663.md b/windows/security/threat-protection/auditing/event-4663.md index 534366322f..44da729457 100644 --- a/windows/security/threat-protection/auditing/event-4663.md +++ b/windows/security/threat-protection/auditing/event-4663.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4663(S): An attempt was made to access an object. diff --git a/windows/security/threat-protection/auditing/event-4664.md b/windows/security/threat-protection/auditing/event-4664.md index af4feb6149..6f60cce3a7 100644 --- a/windows/security/threat-protection/auditing/event-4664.md +++ b/windows/security/threat-protection/auditing/event-4664.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4664(S): An attempt was made to create a hard link. diff --git a/windows/security/threat-protection/auditing/event-4670.md b/windows/security/threat-protection/auditing/event-4670.md index 008b34039d..45dcd000c9 100644 --- a/windows/security/threat-protection/auditing/event-4670.md +++ b/windows/security/threat-protection/auditing/event-4670.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4670(S): Permissions on an object were changed. @@ -67,7 +70,6 @@ Before this event can generate, certain ACEs might need to be set in the object C:\\Windows\\System32\\dllhost.exe - ``` ***Required Server Roles:*** None. @@ -140,12 +142,12 @@ Before this event can generate, certain ACEs might need to be set in the object - **New Security Descriptor** \[Type = UnicodeString\]**:** the new Security Descriptor Definition Language (SDDL) value for the object. -> **Note**  The ** Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. - +> **Note**  The **Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. +> > Example: - +> > *O*:BA*G*:SY*D*:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0×7;;;BA)*S*:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) - +> > - *O*: = Owner. SID of specific security principal, or reserved (pre-defined) value, for example: BA (BUILTIN\_ADMINISTRATORS), WD (Everyone), SY (LOCAL\_SYSTEM), etc. > See the list of possible values in the table below: @@ -268,9 +270,9 @@ For file system and registry objects, the following recommendations apply. -- If you have a pre-defined list of restricted substrings or words in process names (for example, “**mimikatz**” or “**cain.exe**”), check for these substrings in “**Process Name**.” +- If you have a pre-defined list of restricted substrings or words in process names (for example, “**mimikatz**” or “**cain.exe**”), check for these substrings in “**Process Name**.” -- If you have critical registry objects for which you need to monitor all modifications (especially permissions changes and owner changes), monitor for the specific **Object\\Object Name.** +- If you have critical registry objects for which you need to monitor all modifications (especially permissions changes and owner changes), monitor for the specific **Object\\Object Name.** -- If you have high-value computers for which you need to monitor all changes for all or specific objects (for example, file system or registry objects), monitor for all [4670](event-4670.md) events on these computers**.** For example, you could monitor the **ntds.dit** file on domain controllers. +- If you have high-value computers for which you need to monitor all changes for all or specific objects (for example, file system or registry objects), monitor for all [4670](event-4670.md) events on these computers. For example, you could monitor the **ntds.dit** file on domain controllers. diff --git a/windows/security/threat-protection/auditing/event-4671.md b/windows/security/threat-protection/auditing/event-4671.md index eb364f29f6..3e81e5f2f6 100644 --- a/windows/security/threat-protection/auditing/event-4671.md +++ b/windows/security/threat-protection/auditing/event-4671.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4671(-): An application attempted to access a blocked ordinal through the TBS. diff --git a/windows/security/threat-protection/auditing/event-4672.md b/windows/security/threat-protection/auditing/event-4672.md index baac7dff4d..1641acbc10 100644 --- a/windows/security/threat-protection/auditing/event-4672.md +++ b/windows/security/threat-protection/auditing/event-4672.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 12/20/2018 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4672(S): Special privileges assigned to new logon. @@ -19,7 +22,7 @@ ms.date: 12/20/2018 Event 4672 illustration
                                  -***Subcategory:*** [Audit Special Logon](audit-special-logon.md) +Subcategory: Audit Special Logon ***Event Description:*** @@ -84,7 +87,6 @@ You typically will see many of these events in the event log, because every logo SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeEnableDelegationPrivilege SeImpersonatePrivilege - ``` ***Required Server Roles:*** None. diff --git a/windows/security/threat-protection/auditing/event-4673.md b/windows/security/threat-protection/auditing/event-4673.md index a37fc4fdc7..1caa24d32d 100644 --- a/windows/security/threat-protection/auditing/event-4673.md +++ b/windows/security/threat-protection/auditing/event-4673.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4673(S, F): A privileged service was called. @@ -64,7 +67,6 @@ Failure event generates when service call attempt fails. C:\\Windows\\System32\\lsass.exe - ``` ***Required Server Roles:*** None. @@ -131,42 +133,42 @@ Failure event generates when service call attempt fails. - **Privileges** \[Type = UnicodeString\]: the list of user privileges which were requested. The possible privileges depend on the subcategory, either **Audit Non Sensitive Privilege Use** or **Audit Sensitive Privilege Use**, as shown in the following two tables: -| **Subcategory of event** | **Privilege Name:
                                  User Right Group Policy Name** | **Description** | -|-----------------------------------|----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Audit Non Sensitive Privilege Use | **SeChangeNotifyPrivilege:
                                  **Bypass traverse checking | Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks.
                                  With this privilege, the user can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. | -| Audit Non Sensitive Privilege Use | **SeCreateGlobalPrivilege:
                                  **Create global objects | Required to create named file mapping objects in the global namespace during Terminal Services sessions. | -| Audit Non Sensitive Privilege Use | **SeCreatePagefilePrivilege:
                                  **Create a pagefile | With this privilege, the user can create and change the size of a pagefile. | -| Audit Non Sensitive Privilege Use | **SeCreatePermanentPrivilege:
                                  **Create permanent shared objects | Required to create a permanent object.
                                  This privilege is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode already have this privilege inherently; it is not necessary to assign them the privilege. | -| Audit Non Sensitive Privilege Use | **SeCreateSymbolicLinkPrivilege:
                                  **Create symbolic links | Required to create a symbolic link. | -| Audit Non Sensitive Privilege Use | **SeIncreaseBasePriorityPrivilege:
                                  **Increase scheduling priority | Required to increase the base priority of a process.
                                  With this privilege, the user can use a process with Write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. | -| Audit Non Sensitive Privilege Use | **SeIncreaseQuotaPrivilege:
                                  **Adjust memory quotas for a process | Required to increase the quota assigned to a process.
                                  With this privilege, the user can change the maximum memory that can be consumed by a process. | -| Audit Non Sensitive Privilege Use | **SeIncreaseWorkingSetPrivilege:
                                  **Increase a process working set | Required to allocate more memory for applications that run in the context of users. | -| Audit Non Sensitive Privilege Use | **SeLockMemoryPrivilege:
                                  **Lock pages in memory | Required to lock physical pages in memory.
                                  With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | -| Audit Non Sensitive Privilege Use | **SeMachineAccountPrivilege:
                                  **Add workstations to domain | With this privilege, the user can create a computer account.
                                  This privilege is valid only on domain controllers. | -| Audit Non Sensitive Privilege Use | **SeManageVolumePrivilege:
                                  **Perform volume maintenance tasks | Required to run maintenance tasks on a volume, such as remote defragmentation. | -| Audit Non Sensitive Privilege Use | **SeProfileSingleProcessPrivilege:
                                  **Profile single process | Required to gather profiling information for a single process.
                                  With this privilege, the user can use performance monitoring tools to monitor the performance of non-system processes. | -| Audit Non Sensitive Privilege Use | **SeRelabelPrivilege:
                                  **Modify an object label | Required to modify the mandatory integrity level of an object. | -| Audit Non Sensitive Privilege Use | **SeRemoteShutdownPrivilege:
                                  **Force shutdown from a remote system | Required to shut down a system using a network request. | -| Audit Non Sensitive Privilege Use | **SeShutdownPrivilege:
                                  **Shut down the system | Required to shut down a local system. | -| Audit Non Sensitive Privilege Use | **SeSyncAgentPrivilege:
                                  **Synchronize directory service data | This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.
                                  With this privilege, the user can synchronize all directory service data. This is also known as Active Directory synchronization. | -| Audit Non Sensitive Privilege Use | **SeSystemProfilePrivilege:
                                  **Profile system performance | Required to gather profiling information for the entire system.
                                  With this privilege, the user can use performance monitoring tools to monitor the performance of system processes. | -| Audit Non Sensitive Privilege Use | **SeSystemtimePrivilege:
                                  **Change the system time | Required to modify the system time. With this privilege, the user can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs.
                                  If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. | -| Audit Non Sensitive Privilege Use | **SeTimeZonePrivilege:
                                  **Change the time zone | Required to adjust the time zone associated with the computer's internal clock. | -| Audit Non Sensitive Privilege Use | **SeTrustedCredManAccessPrivilege:
                                  **Access Credential Manager as a trusted caller | Required to access Credential Manager as a trusted caller. | -| Audit Non Sensitive Privilege Use | **SeUndockPrivilege:
                                  **Remove computer from docking station | Required to undock a laptop.
                                  With this privilege, the user can undock a portable computer from its docking station without logging on. | +| **Subcategory of event** | **Privilege Name:
                                  User Right Group Policy Name** | **Description** | +|-----------------------------------|-----------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Audit Non Sensitive Privilege Use | SeChangeNotifyPrivilege:
                                  Bypass traverse checking | Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks.
                                  With this privilege, the user can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. | +| Audit Non Sensitive Privilege Use | SeCreateGlobalPrivilege:
                                  Create global objects | Required to create named file mapping objects in the global namespace during Terminal Services sessions. | +| Audit Non Sensitive Privilege Use | SeCreatePagefilePrivilege:
                                  Create a pagefile | With this privilege, the user can create and change the size of a pagefile. | +| Audit Non Sensitive Privilege Use | SeCreatePermanentPrivilege:
                                  Create permanent shared objects | Required to create a permanent object.
                                  This privilege is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode already have this privilege inherently; it is not necessary to assign them the privilege. | +| Audit Non Sensitive Privilege Use | SeCreateSymbolicLinkPrivilege:
                                  Create symbolic links | Required to create a symbolic link. | +| Audit Non Sensitive Privilege Use | SeIncreaseBasePriorityPrivilege:
                                  Increase scheduling priority | Required to increase the base priority of a process.
                                  With this privilege, the user can use a process with Write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. | +| Audit Non Sensitive Privilege Use | SeIncreaseQuotaPrivilege:
                                  Adjust memory quotas for a process | Required to increase the quota assigned to a process.
                                  With this privilege, the user can change the maximum memory that can be consumed by a process. | +| Audit Non Sensitive Privilege Use | SeIncreaseWorkingSetPrivilege:
                                  Increase a process working set | Required to allocate more memory for applications that run in the context of users. | +| Audit Non Sensitive Privilege Use | SeLockMemoryPrivilege:
                                  Lock pages in memory | Required to lock physical pages in memory.
                                  With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | +| Audit Non Sensitive Privilege Use | SeMachineAccountPrivilege:
                                  Add workstations to domain | With this privilege, the user can create a computer account.
                                  This privilege is valid only on domain controllers. | +| Audit Non Sensitive Privilege Use | SeManageVolumePrivilege:
                                  Perform volume maintenance tasks | Required to run maintenance tasks on a volume, such as remote defragmentation. | +| Audit Non Sensitive Privilege Use | SeProfileSingleProcessPrivilege:
                                  Profile single process | Required to gather profiling information for a single process.
                                  With this privilege, the user can use performance monitoring tools to monitor the performance of non-system processes. | +| Audit Non Sensitive Privilege Use | SeRelabelPrivilege:
                                  Modify an object label | Required to modify the mandatory integrity level of an object. | +| Audit Non Sensitive Privilege Use | SeRemoteShutdownPrivilege:
                                  Force shutdown from a remote system | Required to shut down a system using a network request. | +| Audit Non Sensitive Privilege Use | SeShutdownPrivilege:
                                  Shut down the system | Required to shut down a local system. | +| Audit Non Sensitive Privilege Use | SeSyncAgentPrivilege:
                                  Synchronize directory service data | This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.
                                  With this privilege, the user can synchronize all directory service data. This is also known as Active Directory synchronization. | +| Audit Non Sensitive Privilege Use | SeSystemProfilePrivilege:
                                  Profile system performance | Required to gather profiling information for the entire system.
                                  With this privilege, the user can use performance monitoring tools to monitor the performance of system processes. | +| Audit Non Sensitive Privilege Use | SeSystemtimePrivilege:
                                  Change the system time | Required to modify the system time. With this privilege, the user can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs.
                                  If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. | +| Audit Non Sensitive Privilege Use | SeTimeZonePrivilege:
                                  Change the time zone | Required to adjust the time zone associated with the computer's internal clock. | +| Audit Non Sensitive Privilege Use | SeTrustedCredManAccessPrivilege:
                                  Access Credential Manager as a trusted caller | Required to access Credential Manager as a trusted caller. | +| Audit Non Sensitive Privilege Use | SeUndockPrivilege:
                                  Remove computer from docking station | Required to undock a laptop.
                                  With this privilege, the user can undock a portable computer from its docking station without logging on. | -| **Subcategory of event** | **Privilege Name:
                                  User Right Group Policy Name** | **Description** | -|-------------------------------|-----------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Audit Sensitive Privilege Use | **SeAssignPrimaryTokenPrivilege:
                                  **Replace a process-level token | Required to assign the [*primary token*](https://msdn.microsoft.com/library/windows/desktop/ms721603(v=vs.85).aspx#_security_primary_token_gly) of a process. With this privilege, the user can initiate a process to replace the default token associated with a started subprocess. | -| Audit Sensitive Privilege Use | **SeAuditPrivilege:
                                  **Generate security audits | With this privilege, the user can add entries to the security log. | -| Audit Sensitive Privilege Use | **SeCreateTokenPrivilege:
                                  **Create a token object | Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs. When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it. | -| Audit Sensitive Privilege Use | **SeDebugPrivilege:
                                  **Debug programs | Required to debug and adjust the memory of a process owned by another account. With this privilege, the user can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right. This user right provides complete access to sensitive and critical operating system components. | -| Audit Sensitive Privilege Use | **SeImpersonatePrivilege:
                                  **Impersonate a client after authentication | With this privilege, the user can impersonate other accounts. | -| Audit Sensitive Privilege Use | **SeLoadDriverPrivilege:
                                  **Load and unload device drivers | Required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. | -| Audit Sensitive Privilege Use | **SeLockMemoryPrivilege:
                                  **Lock pages in memory | Required to lock physical pages in memory. With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | -| Audit Sensitive Privilege Use | **SeSystemEnvironmentPrivilege:
                                  **Modify firmware environment values | Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. | -| Audit Sensitive Privilege Use | **SeTcbPrivilege:
                                  **Act as part of the operating system | This privilege identifies its holder as part of the trusted computer base. This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. | -| Audit Sensitive Privilege Use | **SeEnableDelegationPrivilege:
                                  **Enable computer and user accounts to be trusted for delegation | Required to mark user and computer accounts as trusted for delegation. With this privilege, the user can set the **Trusted for Deleg**ation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using the delegated credentials of a client, as long as the account of the client does not have the **Account cannot be delegated** account control flag set. | +| **Subcategory of event** | **Privilege Name:
                                  User Right Group Policy Name** | **Description** | +|-------------------------------|------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Audit Sensitive Privilege Use | SeAssignPrimaryTokenPrivilege:
                                  Replace a process-level token | Required to assign the [*primary token*](https://msdn.microsoft.com/library/windows/desktop/ms721603(v=vs.85).aspx#_security_primary_token_gly) of a process. With this privilege, the user can initiate a process to replace the default token associated with a started subprocess. | +| Audit Sensitive Privilege Use | SeAuditPrivilege:
                                  Generate security audits | With this privilege, the user can add entries to the security log. | +| Audit Sensitive Privilege Use | SeCreateTokenPrivilege:
                                  Create a token object | Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs. When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it. | +| Audit Sensitive Privilege Use | SeDebugPrivilege:
                                  Debug programs | Required to debug and adjust the memory of a process owned by another account. With this privilege, the user can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right. This user right provides complete access to sensitive and critical operating system components. | +| Audit Sensitive Privilege Use | SeImpersonatePrivilege:
                                  Impersonate a client after authentication | With this privilege, the user can impersonate other accounts. | +| Audit Sensitive Privilege Use | SeLoadDriverPrivilege:
                                  Load and unload device drivers | Required to load or unload a device driver. With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. | +| Audit Sensitive Privilege Use | SeLockMemoryPrivilege:
                                  Lock pages in memory | Required to lock physical pages in memory. With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | +| Audit Sensitive Privilege Use | SeSystemEnvironmentPrivilege:
                                  Modify firmware environment values | Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. | +| Audit Sensitive Privilege Use | SeTcbPrivilege:
                                  Act as part of the operating system | This privilege identifies its holder as part of the trusted computer base. This user right allows a process to impersonate any user without authentication. The process can therefore gain access to the same local resources as that user. | +| Audit Sensitive Privilege Use | SeEnableDelegationPrivilege:
                                  Enable computer and user accounts to be trusted for delegation | Required to mark user and computer accounts as trusted for delegation. With this privilege, the user can set the **Trusted for Deleg**ation setting on a user or computer object. The user or object that is granted this privilege must have write access to the account control flags on the user or computer object. A server process running on a computer (or under a user context) that is trusted for delegation can access resources on another computer using the delegated credentials of a client, as long as the account of the client does not have the **Account cannot be delegated** account control flag set. | ## Security Monitoring Recommendations diff --git a/windows/security/threat-protection/auditing/event-4674.md b/windows/security/threat-protection/auditing/event-4674.md index a7403d9250..b4146f681a 100644 --- a/windows/security/threat-protection/auditing/event-4674.md +++ b/windows/security/threat-protection/auditing/event-4674.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4674(S, F): An operation was attempted on a privileged object. @@ -67,7 +70,6 @@ Failure event generates when operation attempt fails. C:\\Windows\\System32\\lsass.exe - ``` ***Required Server Roles:*** None. @@ -153,44 +155,44 @@ Failure event generates when operation attempt fails. - **Privileges** \[Type = UnicodeString\]: the list of user privileges which were requested. The possible privileges depend on the subcategory, either **Audit Non Sensitive Privilege Use** or **Audit Sensitive Privilege Use**, as shown in the following two tables: -| **Subcategory of event** | **Privilege Name:
                                  User Right Group Policy Name** | **Description** | -|-----------------------------------|----------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Audit Non Sensitive Privilege Use | **SeChangeNotifyPrivilege:
                                  **Bypass traverse checking | Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks.
                                  With this privilege, the user can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. | -| Audit Non Sensitive Privilege Use | **SeCreateGlobalPrivilege:
                                  **Create global objects | Required to create named file mapping objects in the global namespace during Terminal Services sessions. | -| Audit Non Sensitive Privilege Use | **SeCreatePagefilePrivilege:
                                  **Create a pagefile | With this privilege, the user can create and change the size of a pagefile. | -| Audit Non Sensitive Privilege Use | **SeCreatePermanentPrivilege:
                                  **Create permanent shared objects | Required to create a permanent object.
                                  This privilege is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode already have this privilege inherently; it is not necessary to assign them the privilege. | -| Audit Non Sensitive Privilege Use | **SeCreateSymbolicLinkPrivilege:
                                  **Create symbolic links | Required to create a symbolic link. | -| Audit Non Sensitive Privilege Use | **SeIncreaseBasePriorityPrivilege:
                                  **Increase scheduling priority | Required to increase the base priority of a process.
                                  With this privilege, the user can use a process with Write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. | -| Audit Non Sensitive Privilege Use | **SeIncreaseQuotaPrivilege:
                                  **Adjust memory quotas for a process | Required to increase the quota assigned to a process.
                                  With this privilege, the user can change the maximum memory that can be consumed by a process. | -| Audit Non Sensitive Privilege Use | **SeIncreaseWorkingSetPrivilege:
                                  **Increase a process working set | Required to allocate more memory for applications that run in the context of users. | -| Audit Non Sensitive Privilege Use | **SeLockMemoryPrivilege:
                                  **Lock pages in memory | Required to lock physical pages in memory.
                                  With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | -| Audit Non Sensitive Privilege Use | **SeMachineAccountPrivilege:
                                  **Add workstations to domain | With this privilege, the user can create a computer account. This privilege is valid only on domain controllers. | -| Audit Non Sensitive Privilege Use | **SeManageVolumePrivilege:
                                  **Perform volume maintenance tasks | Required to run maintenance tasks on a volume, such as remote defragmentation. | -| Audit Non Sensitive Privilege Use | **SeProfileSingleProcessPrivilege:
                                  **Profile single process | Required to gather profiling information for a single process.
                                  With this privilege, the user can use performance monitoring tools to monitor the performance of non-system processes. | -| Audit Non Sensitive Privilege Use | **SeRelabelPrivilege:
                                  **Modify an object label | Required to modify the mandatory integrity level of an object. | -| Audit Non Sensitive Privilege Use | **SeRemoteShutdownPrivilege:
                                  **Force shutdown from a remote system | Required to shut down a system using a network request. | -| Audit Non Sensitive Privilege Use | **SeShutdownPrivilege:
                                  **Shut down the system | Required to shut down a local system. | -| Audit Non Sensitive Privilege Use | **SeSyncAgentPrivilege:
                                  **Synchronize directory service data | This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.
                                  With this privilege, the user can synchronize all directory service data. This is also known as Active Directory synchronization. | -| Audit Non Sensitive Privilege Use | **SeSystemProfilePrivilege:
                                  **Profile system performance | Required to gather profiling information for the entire system.
                                  With this privilege, the user can use performance monitoring tools to monitor the performance of system processes. | -| Audit Non Sensitive Privilege Use | **SeSystemtimePrivilege:
                                  **Change the system time | Required to modify the system time.
                                  With this privilege, the user can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. | -| Audit Non Sensitive Privilege Use | **SeTimeZonePrivilege:
                                  **Change the time zone | Required to adjust the time zone associated with the computer's internal clock. | -| Audit Non Sensitive Privilege Use | **SeTrustedCredManAccessPrivilege:
                                  **Access Credential Manager as a trusted caller | Required to access Credential Manager as a trusted caller. | -| Audit Non Sensitive Privilege Use | **SeUndockPrivilege:
                                  **Remove computer from docking station | Required to undock a laptop.
                                  With this privilege, the user can undock a portable computer from its docking station without logging on. | +| **Subcategory of event** | **Privilege Name:
                                  User Right Group Policy Name** | **Description** | +|-----------------------------------|-----------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Audit Non Sensitive Privilege Use | SeChangeNotifyPrivilege:
                                  Bypass traverse checking | Required to receive notifications of changes to files or directories. This privilege also causes the system to skip all traversal access checks.
                                  With this privilege, the user can traverse directory trees even though the user may not have permissions on the traversed directory. This privilege does not allow the user to list the contents of a directory, only to traverse directories. | +| Audit Non Sensitive Privilege Use | SeCreateGlobalPrivilege:
                                  Create global objects | Required to create named file mapping objects in the global namespace during Terminal Services sessions. | +| Audit Non Sensitive Privilege Use | SeCreatePagefilePrivilege:
                                  Create a pagefile | With this privilege, the user can create and change the size of a pagefile. | +| Audit Non Sensitive Privilege Use | SeCreatePermanentPrivilege:
                                  Create permanent shared objects | Required to create a permanent object.
                                  This privilege is useful to kernel-mode components that extend the object namespace. Components that are running in kernel mode already have this privilege inherently; it is not necessary to assign them the privilege. | +| Audit Non Sensitive Privilege Use | SeCreateSymbolicLinkPrivilege:
                                  Create symbolic links | Required to create a symbolic link. | +| Audit Non Sensitive Privilege Use | SeIncreaseBasePriorityPrivilege:
                                  Increase scheduling priority | Required to increase the base priority of a process.
                                  With this privilege, the user can use a process with Write property access to another process to increase the execution priority assigned to the other process. A user with this privilege can change the scheduling priority of a process through the Task Manager user interface. | +| Audit Non Sensitive Privilege Use | SeIncreaseQuotaPrivilege:
                                  Adjust memory quotas for a process | Required to increase the quota assigned to a process.
                                  With this privilege, the user can change the maximum memory that can be consumed by a process. | +| Audit Non Sensitive Privilege Use | SeIncreaseWorkingSetPrivilege:
                                  Increase a process working set | Required to allocate more memory for applications that run in the context of users. | +| Audit Non Sensitive Privilege Use | SeLockMemoryPrivilege:
                                  Lock pages in memory | Required to lock physical pages in memory.
                                  With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | +| Audit Non Sensitive Privilege Use | SeMachineAccountPrivilege:
                                  Add workstations to domain | With this privilege, the user can create a computer account. This privilege is valid only on domain controllers. | +| Audit Non Sensitive Privilege Use | SeManageVolumePrivilege:
                                  Perform volume maintenance tasks | Required to run maintenance tasks on a volume, such as remote defragmentation. | +| Audit Non Sensitive Privilege Use | SeProfileSingleProcessPrivilege:
                                  Profile single process | Required to gather profiling information for a single process.
                                  With this privilege, the user can use performance monitoring tools to monitor the performance of non-system processes. | +| Audit Non Sensitive Privilege Use | SeRelabelPrivilege:
                                  Modify an object label | Required to modify the mandatory integrity level of an object. | +| Audit Non Sensitive Privilege Use | SeRemoteShutdownPrivilege:
                                  Force shutdown from a remote system | Required to shut down a system using a network request. | +| Audit Non Sensitive Privilege Use | SeShutdownPrivilege:
                                  Shut down the system | Required to shut down a local system. | +| Audit Non Sensitive Privilege Use | SeSyncAgentPrivilege:
                                  Synchronize directory service data | This privilege enables the holder to read all objects and properties in the directory, regardless of the protection on the objects and properties. By default, it is assigned to the Administrator and LocalSystem accounts on domain controllers.
                                  With this privilege, the user can synchronize all directory service data. This is also known as Active Directory synchronization. | +| Audit Non Sensitive Privilege Use | SeSystemProfilePrivilege:
                                  Profile system performance | Required to gather profiling information for the entire system.
                                  With this privilege, the user can use performance monitoring tools to monitor the performance of system processes. | +| Audit Non Sensitive Privilege Use | SeSystemtimePrivilege:
                                  Change the system time | Required to modify the system time.
                                  With this privilege, the user can change the time and date on the internal clock of the computer. Users that are assigned this user right can affect the appearance of event logs. If the system time is changed, events that are logged will reflect this new time, not the actual time that the events occurred. | +| Audit Non Sensitive Privilege Use | SeTimeZonePrivilege:
                                  Change the time zone | Required to adjust the time zone associated with the computer's internal clock. | +| Audit Non Sensitive Privilege Use | SeTrustedCredManAccessPrivilege:
                                  Access Credential Manager as a trusted caller | Required to access Credential Manager as a trusted caller. | +| Audit Non Sensitive Privilege Use | SeUndockPrivilege:
                                  Remove computer from docking station | Required to undock a laptop.
                                  With this privilege, the user can undock a portable computer from its docking station without logging on. | -| **Subcategory of event** | **Privilege Name:
                                  User Right Group Policy Name** | **Description** | -|-------------------------------|----------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Audit Sensitive Privilege Use | **SeAssignPrimaryTokenPrivilege:
                                  **Replace a process-level token | Required to assign the [*primary token*](https://msdn.microsoft.com/library/windows/desktop/ms721603(v=vs.85).aspx#_security_primary_token_gly) of a process.
                                  With this privilege, the user can initiate a process to replace the default token associated with a started subprocess. | -| Audit Sensitive Privilege Use | **SeAuditPrivilege:
                                  **Generate security audits | With this privilege, the user can add entries to the security log. | -| Audit Sensitive Privilege Use | **SeBackupPrivilege:
                                  **Back up files and directories | - Required to perform backup operations.
                                  With this privilege, the user can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This privilege causes the system to grant all read access control to any file, regardless of the [*access control list*](https://msdn.microsoft.com/library/windows/desktop/ms721532(v=vs.85).aspx#_security_access_control_list_gly) (ACL) specified for the file. Any access request other than read is still evaluated with the ACL.
                                  The following access rights are granted if this privilege is held:
                                  READ\_CONTROL
                                  ACCESS\_SYSTEM\_SECURITY
                                  FILE\_GENERIC\_READ
                                  FILE\_TRAVERSE | -| Audit Sensitive Privilege Use | **SeCreateTokenPrivilege:
                                  **Create a token object | Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs.
                                  When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it. | -| Audit Sensitive Privilege Use | **SeDebugPrivilege:
                                  **Debug programs | Required to debug and adjust the memory of a process owned by another account.
                                  With this privilege, the user can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right.
                                  This user right provides complete access to sensitive and critical operating system components. | -| Audit Sensitive Privilege Use | **SeImpersonatePrivilege:
                                  **Impersonate a client after authentication | With this privilege, the user can impersonate other accounts. | -| Audit Sensitive Privilege Use | **SeLoadDriverPrivilege:
                                  **Load and unload device drivers | Required to load or unload a device driver.
                                  With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. | -| Audit Sensitive Privilege Use | **SeLockMemoryPrivilege:
                                  **Lock pages in memory | Required to lock physical pages in memory.
                                  With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | -| Audit Sensitive Privilege Use | **SeRestorePrivilege:
                                  **Restore files and directories | Required to perform restore operations. This privilege causes the system to grant all write access control to any file, regardless of the ACL specified for the file. Any access request other than write is still evaluated with the ACL. Additionally, this privilege enables you to set any valid user or group SID as the owner of a file. The following access rights are granted if this privilege is held:
                                  WRITE\_DAC
                                  WRITE\_OWNER
                                  ACCESS\_SYSTEM\_SECURITY
                                  FILE\_GENERIC\_WRITE
                                  FILE\_ADD\_FILE
                                  FILE\_ADD\_SUBDIRECTORY
                                  DELETE
                                  With this privilege, the user can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories and determines which users can set any valid security principal as the owner of an object. | -| Audit Sensitive Privilege Use | **SeSecurityPrivilege:
                                  **Manage auditing and security log | Required to perform a number of security-related functions, such as controlling and viewing audit events in security event log.
                                  With this privilege, the user can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. A user with this privilege can also view and clear the security log. | -| Audit Sensitive Privilege Use | **SeSystemEnvironmentPrivilege:
                                  **Modify firmware environment values | Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. | -| Audit Sensitive Privilege Use | **SeTakeOwnershipPrivilege:
                                  **Take ownership of files or other objects | Required to take ownership of an object without being granted discretionary access. This privilege allows the owner value to be set only to those values that the holder may legitimately assign as the owner of an object.
                                  With this privilege, the user can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. | +| **Subcategory of event** | **Privilege Name:
                                  User Right Group Policy Name** | **Description** | +|-------------------------------|-----------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| Audit Sensitive Privilege Use | SeAssignPrimaryTokenPrivilege:
                                  Replace a process-level token | Required to assign the [*primary token*](https://msdn.microsoft.com/library/windows/desktop/ms721603(v=vs.85).aspx#_security_primary_token_gly) of a process.
                                  With this privilege, the user can initiate a process to replace the default token associated with a started subprocess. | +| Audit Sensitive Privilege Use | SeAuditPrivilege:
                                  Generate security audits | With this privilege, the user can add entries to the security log. | +| Audit Sensitive Privilege Use | SeBackupPrivilege:
                                  Back up files and directories | - Required to perform backup operations.
                                  With this privilege, the user can bypass file and directory, registry, and other persistent object permissions for the purposes of backing up the system. This privilege causes the system to grant all read access control to any file, regardless of the [*access control list*](https://msdn.microsoft.com/library/windows/desktop/ms721532(v=vs.85).aspx#_security_access_control_list_gly) (ACL) specified for the file. Any access request other than read is still evaluated with the ACL.
                                  The following access rights are granted if this privilege is held:
                                  READ\_CONTROL
                                  ACCESS\_SYSTEM\_SECURITY
                                  FILE\_GENERIC\_READ
                                  FILE\_TRAVERSE | +| Audit Sensitive Privilege Use | SeCreateTokenPrivilege:
                                  Create a token object | Allows a process to create a token which it can then use to get access to any local resources when the process uses NtCreateToken() or other token-creation APIs.
                                  When a process requires this privilege, we recommend using the LocalSystem account (which already includes the privilege), rather than creating a separate user account and assigning this privilege to it. | +| Audit Sensitive Privilege Use | SeDebugPrivilege:
                                  Debug programs | Required to debug and adjust the memory of a process owned by another account.
                                  With this privilege, the user can attach a debugger to any process or to the kernel. Developers who are debugging their own applications do not need this user right. Developers who are debugging new system components need this user right.
                                  This user right provides complete access to sensitive and critical operating system components. | +| Audit Sensitive Privilege Use | SeImpersonatePrivilege:
                                  Impersonate a client after authentication | With this privilege, the user can impersonate other accounts. | +| Audit Sensitive Privilege Use | SeLoadDriverPrivilege:
                                  Load and unload device drivers | Required to load or unload a device driver.
                                  With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode. This user right does not apply to Plug and Play device drivers. | +| Audit Sensitive Privilege Use | SeLockMemoryPrivilege:
                                  Lock pages in memory | Required to lock physical pages in memory.
                                  With this privilege, the user can use a process to keep data in physical memory, which prevents the system from paging the data to virtual memory on disk. Exercising this privilege could significantly affect system performance by decreasing the amount of available random access memory (RAM). | +| Audit Sensitive Privilege Use | SeRestorePrivilege:
                                  Restore files and directories | Required to perform restore operations. This privilege causes the system to grant all write access control to any file, regardless of the ACL specified for the file. Any access request other than write is still evaluated with the ACL. Additionally, this privilege enables you to set any valid user or group SID as the owner of a file. The following access rights are granted if this privilege is held:
                                  WRITE\_DAC
                                  WRITE\_OWNER
                                  ACCESS\_SYSTEM\_SECURITY
                                  FILE\_GENERIC\_WRITE
                                  FILE\_ADD\_FILE
                                  FILE\_ADD\_SUBDIRECTORY
                                  DELETE
                                  With this privilege, the user can bypass file, directory, registry, and other persistent objects permissions when restoring backed up files and directories and determines which users can set any valid security principal as the owner of an object. | +| Audit Sensitive Privilege Use | SeSecurityPrivilege:
                                  Manage auditing and security log | Required to perform a number of security-related functions, such as controlling and viewing audit events in security event log.
                                  With this privilege, the user can specify object access auditing options for individual resources, such as files, Active Directory objects, and registry keys. A user with this privilege can also view and clear the security log. | +| Audit Sensitive Privilege Use | SeSystemEnvironmentPrivilege:
                                  Modify firmware environment values | Required to modify the nonvolatile RAM of systems that use this type of memory to store configuration information. | +| Audit Sensitive Privilege Use | SeTakeOwnershipPrivilege:
                                  Take ownership of files or other objects | Required to take ownership of an object without being granted discretionary access. This privilege allows the owner value to be set only to those values that the holder may legitimately assign as the owner of an object.
                                  With this privilege, the user can take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads. | ## Security Monitoring Recommendations diff --git a/windows/security/threat-protection/auditing/event-4675.md b/windows/security/threat-protection/auditing/event-4675.md index 8b6c45689b..20ed1e1911 100644 --- a/windows/security/threat-protection/auditing/event-4675.md +++ b/windows/security/threat-protection/auditing/event-4675.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4675(S): SIDs were filtered. diff --git a/windows/security/threat-protection/auditing/event-4688.md b/windows/security/threat-protection/auditing/event-4688.md index 013d9b7aef..94d84a85cf 100644 --- a/windows/security/threat-protection/auditing/event-4688.md +++ b/windows/security/threat-protection/auditing/event-4688.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4688(S): A new process has been created. @@ -66,7 +69,6 @@ This event generates every time a new process starts. S-1-16-8192 - ``` ***Required Server Roles:*** None. @@ -149,7 +151,7 @@ This event generates every time a new process starts. - **New Process Name** \[Type = UnicodeString\]**:** full path and the name of the executable for the new process. -- **Token Elevation Type** \[Type = UnicodeString\]**: ** +- **Token Elevation Type** \[Type = UnicodeString\]**:** - **TokenElevationTypeDefault (1):** Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account (for which UAC disabled by default), service account or local system account. @@ -196,19 +198,19 @@ For 4688(S): A new process has been created. | **Restricted-use computers or devices**: You might have certain computers, machines, or devices on which certain people (accounts) should not typically perform any actions. | Monitor the target **Computer:** (or other target device) for actions performed by the **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** that you are concerned about. | | **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor **“Creator Subject\\Security ID”** or **“Target Subject\\Security ID”** for names that don’t comply with naming conventions. | -- If you have a pre-defined “**New** **Process Name**” or **“Creator Process Name**” for the process reported in this event, monitor all events with “**New** **Process Name**” or **“Creator Process Name**” not equal to your defined value. +- If you have a pre-defined “**New** **Process Name**” or **“Creator Process Name**” for the process reported in this event, monitor all events with “**New** **Process Name**” or **“Creator Process Name**” not equal to your defined value. -- You can monitor to see if “**New** **Process Name**” or **“Creator Process Name**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). +- You can monitor to see if “**New** **Process Name**” or **“Creator Process Name**” is not in a standard folder (for example, not in **System32** or **Program Files**) or is in a restricted folder (for example, **Temporary Internet Files**). -- If you have a pre-defined list of restricted substrings or words in process names (for example “**mimikatz**” or “**cain.exe**”), check for these substrings in “**New** **Process Name**” or **“Creator Process Name**.” +- If you have a pre-defined list of restricted substrings or words in process names (for example “**mimikatz**” or “**cain.exe**”), check for these substrings in “**New** **Process Name**” or **“Creator Process Name**.” -- It can be unusual for a process to run using a local account in either **Creator Subject\\Security ID** or in **Target** **Subject\\Security ID**. +- It can be unusual for a process to run using a local account in either **Creator Subject\\Security ID** or in **Target** **Subject\\Security ID**. -- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (1)** when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn’t contain the $ symbol**.** Typically this means that UAC is disabled for this account for some reason. +- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (1)** when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn’t contain the $ symbol. Typically this means that UAC is disabled for this account for some reason. -- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn’t contain the $ symbol**.** This means that a user ran a program using administrative privileges. +- Monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when **Subject\\Security ID** lists a real user account, for example when **Account Name** doesn’t contain the $ symbol. This means that a user ran a program using administrative privileges. -- You can also monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when a computer object was used to run the process, but that computer object is not the same computer where the event occurs. +- You can also monitor for **Token Elevation Type** with value **TokenElevationTypeDefault (2)** on standard workstations, when a computer object was used to run the process, but that computer object is not the same computer where the event occurs. -- If you need to monitor all new processes with a specific Mandatory Label, for example S-1-16-20480 (Protected process), check the “**Mandatory Label**” in this event. +- If you need to monitor all new processes with a specific Mandatory Label, for example S-1-16-20480 (Protected process), check the “**Mandatory Label**” in this event. diff --git a/windows/security/threat-protection/auditing/event-4689.md b/windows/security/threat-protection/auditing/event-4689.md index cb7fd77b72..cf6f0fce07 100644 --- a/windows/security/threat-protection/auditing/event-4689.md +++ b/windows/security/threat-protection/auditing/event-4689.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4689(S): A process has exited. diff --git a/windows/security/threat-protection/auditing/event-4690.md b/windows/security/threat-protection/auditing/event-4690.md index 5959189ef0..be4ce4de7c 100644 --- a/windows/security/threat-protection/auditing/event-4690.md +++ b/windows/security/threat-protection/auditing/event-4690.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4690(S): An attempt was made to duplicate a handle to an object. diff --git a/windows/security/threat-protection/auditing/event-4691.md b/windows/security/threat-protection/auditing/event-4691.md index e0ba6fb4f2..001cce1266 100644 --- a/windows/security/threat-protection/auditing/event-4691.md +++ b/windows/security/threat-protection/auditing/event-4691.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4691(S): Indirect access to an object was requested. diff --git a/windows/security/threat-protection/auditing/event-4692.md b/windows/security/threat-protection/auditing/event-4692.md index 77e4da1228..15199dbda5 100644 --- a/windows/security/threat-protection/auditing/event-4692.md +++ b/windows/security/threat-protection/auditing/event-4692.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4692(S, F): Backup of data protection master key was attempted. diff --git a/windows/security/threat-protection/auditing/event-4693.md b/windows/security/threat-protection/auditing/event-4693.md index bc0733db9c..72c5473fe1 100644 --- a/windows/security/threat-protection/auditing/event-4693.md +++ b/windows/security/threat-protection/auditing/event-4693.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4693(S, F): Recovery of data protection master key was attempted. diff --git a/windows/security/threat-protection/auditing/event-4694.md b/windows/security/threat-protection/auditing/event-4694.md index 69a89c89cb..9d96a529ac 100644 --- a/windows/security/threat-protection/auditing/event-4694.md +++ b/windows/security/threat-protection/auditing/event-4694.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4694(S, F): Protection of auditable protected data was attempted. diff --git a/windows/security/threat-protection/auditing/event-4695.md b/windows/security/threat-protection/auditing/event-4695.md index d29cf80e5f..675ba33601 100644 --- a/windows/security/threat-protection/auditing/event-4695.md +++ b/windows/security/threat-protection/auditing/event-4695.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4695(S, F): Unprotection of auditable protected data was attempted. diff --git a/windows/security/threat-protection/auditing/event-4696.md b/windows/security/threat-protection/auditing/event-4696.md index ee53883c2f..cc31b9e54f 100644 --- a/windows/security/threat-protection/auditing/event-4696.md +++ b/windows/security/threat-protection/auditing/event-4696.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4696(S): A primary token was assigned to process. diff --git a/windows/security/threat-protection/auditing/event-4697.md b/windows/security/threat-protection/auditing/event-4697.md index 86c985d030..d454c05905 100644 --- a/windows/security/threat-protection/auditing/event-4697.md +++ b/windows/security/threat-protection/auditing/event-4697.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4697(S): A service was installed in the system. @@ -111,11 +114,11 @@ This event generates when new service was installed in the system. | 0x2 | ​File System Driver | ​A file system driver, which is also a Kernel device driver. | | 0x8 | ​Recognizer Driver | ​A file system driver used during startup to determine the file systems present on the system. | | 0x10 | ​Win32 Own Process | ​A Win32 program that can be started by the Service Controller and that obeys the service control protocol. This type of Win32 service runs in a process by itself (this is the most common). | -| 0x20 | ​Win32 Share Process | ​A Win32 service that can share a process with other Win32 services.
                                  (see: | -| 0x110 | ​Interactive Own Process | ​A service that should be run as a standalone process and can communicate with the desktop.
                                  (see: ) | +| 0x20 | ​Win32 Share Process | ​A Win32 service that can share a process with other Win32 services.
                                  (see: | +| 0x110 | ​Interactive Own Process | ​A service that should be run as a standalone process and can communicate with the desktop.
                                  (see: ) | | 0x120 | Interactive Share Process | A service that can share address space with other services of the same type and can communicate with the desktop. | -- **Service Start Type** \[Type = HexInt32\]: The service start type can have one of the following values (see: : +- **Service Start Type** \[Type = HexInt32\]: The service start type can have one of the following values (see: : | Value | Service Type | Description | |-------|---------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------| diff --git a/windows/security/threat-protection/auditing/event-4698.md b/windows/security/threat-protection/auditing/event-4698.md index f47bfb676a..2742b717ce 100644 --- a/windows/security/threat-protection/auditing/event-4698.md +++ b/windows/security/threat-protection/auditing/event-4698.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4698(S): A scheduled task was created. diff --git a/windows/security/threat-protection/auditing/event-4699.md b/windows/security/threat-protection/auditing/event-4699.md index fbe8720d38..280aad111e 100644 --- a/windows/security/threat-protection/auditing/event-4699.md +++ b/windows/security/threat-protection/auditing/event-4699.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4699(S): A scheduled task was deleted. diff --git a/windows/security/threat-protection/auditing/event-4700.md b/windows/security/threat-protection/auditing/event-4700.md index 02a1cd7a54..a53997c7b8 100644 --- a/windows/security/threat-protection/auditing/event-4700.md +++ b/windows/security/threat-protection/auditing/event-4700.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4700(S): A scheduled task was enabled. diff --git a/windows/security/threat-protection/auditing/event-4701.md b/windows/security/threat-protection/auditing/event-4701.md index 6482686719..d1991b0941 100644 --- a/windows/security/threat-protection/auditing/event-4701.md +++ b/windows/security/threat-protection/auditing/event-4701.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4701(S): A scheduled task was disabled. diff --git a/windows/security/threat-protection/auditing/event-4702.md b/windows/security/threat-protection/auditing/event-4702.md index 1cd62dc082..01ef0250a8 100644 --- a/windows/security/threat-protection/auditing/event-4702.md +++ b/windows/security/threat-protection/auditing/event-4702.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4702(S): A scheduled task was updated. diff --git a/windows/security/threat-protection/auditing/event-4703.md b/windows/security/threat-protection/auditing/event-4703.md index 3fbaa67128..a04ae9c4c5 100644 --- a/windows/security/threat-protection/auditing/event-4703.md +++ b/windows/security/threat-protection/auditing/event-4703.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4703(S): A user right was adjusted. diff --git a/windows/security/threat-protection/auditing/event-4704.md b/windows/security/threat-protection/auditing/event-4704.md index 3904837027..f78b83ef3c 100644 --- a/windows/security/threat-protection/auditing/event-4704.md +++ b/windows/security/threat-protection/auditing/event-4704.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4704(S): A user right was assigned. @@ -96,7 +99,7 @@ You will see unique event for every user. - **Account Name** \[Type = SID\]: the SID of security principal for which user rights were assigned. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -**New Right: ** +**New Right:** - **User Right** \[Type = UnicodeString\]: the list of assigned user rights. This event generates only for *user* rights, not logon rights. Here is the list of possible user rights: diff --git a/windows/security/threat-protection/auditing/event-4705.md b/windows/security/threat-protection/auditing/event-4705.md index c5e09ceddf..09c240e026 100644 --- a/windows/security/threat-protection/auditing/event-4705.md +++ b/windows/security/threat-protection/auditing/event-4705.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4705(S): A user right was removed. @@ -96,7 +99,7 @@ You will see unique event for every user. - **Account Name** \[Type = SID\]: the SID of security principal for which user rights were removed. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. -**Removed Right: ** +**Removed Right:** - **User Right** \[Type = UnicodeString\]: the list of removed user rights. This event generates only for *user* rights, not logon rights. Here is the list of possible user rights: diff --git a/windows/security/threat-protection/auditing/event-4706.md b/windows/security/threat-protection/auditing/event-4706.md index 4b8feef3f1..c566c246bf 100644 --- a/windows/security/threat-protection/auditing/event-4706.md +++ b/windows/security/threat-protection/auditing/event-4706.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4706(S): A new trust was created to a domain. diff --git a/windows/security/threat-protection/auditing/event-4707.md b/windows/security/threat-protection/auditing/event-4707.md index 3f8f230754..f998718c41 100644 --- a/windows/security/threat-protection/auditing/event-4707.md +++ b/windows/security/threat-protection/auditing/event-4707.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4707(S): A trust to a domain was removed. diff --git a/windows/security/threat-protection/auditing/event-4713.md b/windows/security/threat-protection/auditing/event-4713.md index f6501093b7..a4809630b7 100644 --- a/windows/security/threat-protection/auditing/event-4713.md +++ b/windows/security/threat-protection/auditing/event-4713.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4713(S): Kerberos policy was changed. diff --git a/windows/security/threat-protection/auditing/event-4714.md b/windows/security/threat-protection/auditing/event-4714.md index cc78c83197..c81891ffc9 100644 --- a/windows/security/threat-protection/auditing/event-4714.md +++ b/windows/security/threat-protection/auditing/event-4714.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4714(S): Encrypted data recovery policy was changed. diff --git a/windows/security/threat-protection/auditing/event-4715.md b/windows/security/threat-protection/auditing/event-4715.md index 0b6e732faf..c51f51c999 100644 --- a/windows/security/threat-protection/auditing/event-4715.md +++ b/windows/security/threat-protection/auditing/event-4715.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh +author: dansimp ms.date: 04/19/2017 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4715(S): The audit policy (SACL) on an object was changed. @@ -59,7 +62,6 @@ This event is always logged regardless of the "Audit Policy Change" sub-category D:(A;;DCSWRPDTRC;;;BA)(A;;DCSWRPDTRC;;;SY)S:NO\_ACCESS\_CONTROL - ``` ***Required Server Roles:*** None. @@ -98,12 +100,12 @@ This event is always logged regardless of the "Audit Policy Change" sub-category - **New Security Descriptor** \[Type = UnicodeString\]**:** new Security Descriptor Definition Language (SDDL) value for the audit policy. -> **Note**  The ** Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. - +> **Note**  The **Security Descriptor Definition Language (SDDL)** defines string elements for enumerating information contained in the security descriptor. +> > Example: - +> > *O*:BA*G*:SY*D*:(D;;0xf0007;;;AN)(D;;0xf0007;;;BG)(A;;0xf0007;;;SY)(A;;0×7;;;BA)*S*:ARAI(AU;SAFA;DCLCRPCRSDWDWO;;;WD) - +> > - *O*: = Owner. SID of specific security principal, or reserved (pre-defined) value, for example: BA (BUILTIN\_ADMINISTRATORS), WD (Everyone), SY (LOCAL\_SYSTEM), etc. > See the list of possible values in the table below: diff --git a/windows/security/threat-protection/auditing/event-4716.md b/windows/security/threat-protection/auditing/event-4716.md index 651817d90c..4ab122d7f1 100644 --- a/windows/security/threat-protection/auditing/event-4716.md +++ b/windows/security/threat-protection/auditing/event-4716.md @@ -6,8 +6,11 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none -author: Mir0sh -ms.date: 04/19/2017 +author: dansimp +ms.date: 04/04/2019 +ms.reviewer: +manager: dansimp +ms.author: dansimp --- # 4716(S): Trusted domain information was modified. @@ -132,7 +135,7 @@ This event is generated only on domain controllers. | 0x8 | TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE | If this bit is set, the trust link is a [cross-forest trust](https://msdn.microsoft.com/library/cc223126.aspx#gt_86f3dbf2-338f-462e-8c5b-3c8e05798dbc) [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx) between the root domains of two [forests](https://msdn.microsoft.com/library/cc223126.aspx#gt_fd104241-4fb3-457c-b2c4-e0c18bb20b62), both of which are running in a [forest functional level](https://msdn.microsoft.com/library/cc223126.aspx#gt_b3240417-ca43-4901-90ec-fde55b32b3b8) of DS\_BEHAVIOR\_WIN2003 or greater.
                                  Only evaluated on Windows Server 2003 operating system, Windows Server 2008 operating system, Windows Server 2008 R2 operating system, Windows Server 2012 operating system, Windows Server 2012 R2 operating system, and Windows Server 2016 operating system.
                                  Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | | 0x10 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION | If this bit is set, then the trust is to a domain or forest that is not part of the [organization](https://msdn.microsoft.com/library/cc223126.aspx#gt_6fae7775-5232-4206-b452-f298546ab54f). The behavior controlled by this bit is explained in [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx) section [3.3.5.7.5](https://msdn.microsoft.com/library/cc233949.aspx) and [\[MS-APDS\]](https://msdn.microsoft.com/library/cc223948.aspx) section [3.1.5](https://msdn.microsoft.com/library/cc223991.aspx).
                                  Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
                                  Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | | 0x20 | TRUST\_ATTRIBUTE\_WITHIN\_FOREST | If this bit is set, then the trusted domain is within the same forest.
                                  Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. | -| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are more stringently [filtered](https://msdn.microsoft.com/library/cc223126.aspx#gt_ffbe7b55-8e84-4f41-a18d-fc29191a4cda) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/library/cc237917.aspx) section 4.1.2.2.
                                  Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
                                  Only evaluated if SID Filtering is used.
                                  Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
                                  Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | +| 0x40 | TRUST\_ATTRIBUTE\_TREAT\_AS\_EXTERNAL | If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are [more stringently filtered](https://docs.microsoft.com/openspecs/windows_protocols/ms-adts/e9a2d23c-c31e-4a6f-88a0-6646fdb51a3c) than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts.
                                  Only evaluated on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016.
                                  Only evaluated if SID Filtering is used.
                                  Only evaluated on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
                                  Can only be set if forest and trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WIN2003 or greater. | | 0x80 | TRUST\_ATTRIBUTE\_USES\_RC4\_ENCRYPTION | This bit is set on trusts with the [trustType](https://msdn.microsoft.com/library/cc220955.aspx) set to TRUST\_TYPE\_MIT, which are capable of using RC4 keys. Historically, MIT Kerberos distributions supported only DES and 3DES keys ([\[RFC4120\]](https://go.microsoft.com/fwlink/?LinkId=90458), [\[RFC3961\]](https://go.microsoft.com/fwlink/?LinkId=90450)). MIT 1.4.1 adopted the RC4HMAC encryption type common to Windows 2000 [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx), so trusted domains deploying later versions of the MIT distribution required this bit. For more information, see "Keys and Trusts", section [6.1.6.9.1](https://msdn.microsoft.com/library/cc223782.aspx).
                                  Only evaluated on TRUST\_TYPE\_MIT | | 0x200 | TRUST\_ATTRIBUTE\_CROSS\_ORGANIZATION\_NO\_TGT\_DELEGATION | If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [\[MS-KILE\]](https://msdn.microsoft.com/library/cc233855.aspx) section 3.3.5.7.5.
                                  Only supported on Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016. | | 0x400 | TRUST\_ATTRIBUTE\_PIM\_TRUST | If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [\[MS-PAC\]](https://msdn.microsoft.com/library/cc237917.aspx) section 4.1.2.2.
                                  Evaluated only on Windows Server 2016
                                  Evaluated only if SID Filtering is used.
                                  Evaluated only on cross-forest trusts having TRUST\_ATTRIBUTE\_FOREST\_TRANSITIVE.
                                  Can be set only if the forest and the trusted forest are running in a forest functional level of DS\_BEHAVIOR\_WINTHRESHOLD or greater. | @@ -151,3 +154,69 @@ For 4716(S): Trusted domain information was modified. - Any changes in Active Directory domain trust settings must be monitored and alerts should be triggered. If this change was not planned, investigate the reason for the change. +## Anonymous Logon account + +If the account reported in the event is **Anonymous Logon**, it means the password is changed by system automatic password reset. For example: + +``` +Log Name: Security +Source: Microsoft-Windows-Security-Auditing +Date: